@pareto4/pp-core 1.13.0 → 1.18.0

package/pp-core/bin/lib/clusters.cjs

@@ -44,6 +44,9 @@ exports.CLUSTERS = Object.freeze({
         'eval-review',
         'add-tests',
         'secure-phase',
+        // Retroactive, non-gating review of a completed phase against the client
+        // vault's standards documents (`check vault-review`, a report) — the same
+        // family as secure-phase / ui-review / validate-phase.
         'vault-review',
     ]),
     milestone: Object.freeze([

package/pp-core/bin/lib/command-aliases.cjs

@@ -698,27 +698,6 @@ exports.NON_FAMILY_COMMAND_ALIASES = [
         ],
         "mutation": true
     },
-    {
-        "canonical": "phase.dispatch-plan",
-        "aliases": [
-            "phase dispatch-plan"
-        ],
-        "mutation": false
-    },
-    {
-        "canonical": "phase.install-run",
-        "aliases": [
-            "phase install-run"
-        ],
-        "mutation": true
-    },
-    {
-        "canonical": "phase.manifest",
-        "aliases": [
-            "phase manifest"
-        ],
-        "mutation": true
-    },
     {
         "canonical": "phase.mvp-mode",
         "aliases": [
@@ -726,20 +705,6 @@ exports.NON_FAMILY_COMMAND_ALIASES = [
         ],
         "mutation": false
     },
-    {
-        "canonical": "phase.tier",
-        "aliases": [
-            "phase tier"
-        ],
-        "mutation": false
-    },
-    {
-        "canonical": "phase.tier-propose",
-        "aliases": [
-            "phase tier-propose"
-        ],
-        "mutation": true
-    },
     {
         "canonical": "progress.bar",
         "aliases": [

package/pp-core/bin/lib/commands.cjs

@@ -47,6 +47,10 @@ const { extractFrontmatter } = frontmatter;
 const modelProfiles = require("./model-profiles.cjs");
 const { MODEL_PROFILES, VALID_PHASE_TYPES } = modelProfiles;
 const runtime_slash_cjs_1 = require("./runtime-slash.cjs");
+// 16-03: the one `.planning/` path test. The seal leaf's top level imports only
+// Node built-ins and it never requires this module, so the edge adds no cycle.
+// eslint-disable-next-line @typescript-eslint/no-require-imports
+const vaultSeal = require("./vault-seal.cjs");
 // ─── Phase Status ─────────────────────────────────────────────────────────────
 /**
  * Determine phase status by checking plan/summary counts AND verification state.
@@ -458,7 +462,7 @@ function cmdCommit(cwd, message, files, raw, amend, noVerify) {
             const phaseMatch = (files || []).join(' ').match(/(\d+(?:\.\d+)*)-/);
             if (phaseMatch) {
                 const phaseNum = phaseMatch[1];
-                // D-03: a prior milestone's archived phase whose number the current
+                // PBI 75323 D-03: a prior milestone's archived phase whose number the current
                 // ROADMAP reuses names no branch (the phase-scope owner drops it).
                 const phaseInfo = resolvePhaseForRead(cwd, phaseNum);
                 if (phaseInfo) {
@@ -907,7 +911,7 @@ function cmdTodoMatchPhase(cwd, phase, raw) {
     const phaseKeywords = new Set(phaseText.split(/[\s\-_/.,;:()\[\]{}|]+/)
         .map(w => w.replace(/[^a-z0-9]/g, ''))
         .filter(w => w.length > 2 && !stopWords.has(w)));
-    // Find phase directory to get expected file paths (D-03: through the
+    // Find phase directory to get expected file paths (PBI 75323 D-03: through the
     // phase-scope owner, so a prior milestone's archive never lends this phase its plans)
     const phaseInfoDisk = resolvePhaseForRead(cwd, phase);
     const phasePlans = [];
@@ -993,7 +997,7 @@ function cmdScaffold(cwd, type, options, raw) {
     const { phase, name } = options;
     const padded = phase ? normalizePhaseName(phase) : '00';
     const today = new Date().toISOString().split('T')[0];
-    // Find phase directory. D-02 (todo "template-fill-writes-
+    // Find phase directory. PBI 75323 / quick 261009-gvf D-02 (todo "template-fill-writes-
     // into-an-archived-phase-directory"): context / uat / verification never write into a
     // closed milestone's archive. The phase-scope owner hands back a live match only; an
     // archive this phase still names is refused naming it, and a prior milestone's archive
@@ -1223,7 +1227,8 @@ function cmdCheckCommit(cwd, raw) {
     // commit_docs is false — check if any .planning/ files are staged
     const stagedResult = (0, shell_command_projection_cjs_1.execGit)(['diff', '--cached', '--name-only'], { cwd });
     if (stagedResult.exitCode === 0) {
-        const planningFiles = stagedResult.stdout.split('\n').filter(f => f.startsWith('.planning/') || f.startsWith('.planning\\'));
+        // 16-03: the seal leaf owns the `.planning/` path test (both separators).
+        const planningFiles = stagedResult.stdout.split('\n').filter((f) => vaultSeal.isPlanningPath(f));
         if (planningFiles.length > 0) {
             error(`commit_docs is false but ${planningFiles.length} .planning/ file(s) are staged:\n` +
                 planningFiles.map(f => `  ${f}`).join('\n') +

package/pp-core/bin/lib/compose-bindings.cjs

@@ -31,8 +31,9 @@
  * `JSON.stringify`/object literals — never by `.md` shell string
  * concatenation.
  *
- * This module sits at the top of the CommonJS graph — nothing imports it —
- * so its top-level imports of `./org-profile.cjs`, `./platform-bindings.cjs`,
+ * Its importers today are `src/vault-update.cts`, `src/init-contract.cts`
+ * and (quick 261003-lqi) `src/check-command-router.cts`
+ * — and this module imports none of them, so its top-level imports of `./org-profile.cjs`, `./platform-bindings.cjs`,
  * `./git-provider.cjs`, `./vault-coordinates.cjs`, `./io.cjs`,
  * `./project-root.cjs`, `./package-identity.cjs` and
  * `./shell-command-projection.cjs` create no require cycle: none of those
@@ -49,13 +50,16 @@ exports.COMPOSE_BINDINGS_FLAGS = exports.SEED_VALUE_MAX_LENGTH = void 0;
 exports._resetPlatformTagMemoForTests = _resetPlatformTagMemoForTests;
 exports.listStableTagsAt = listStableTagsAt;
 exports.pickLatestStableTag = pickLatestStableTag;
+exports.resolveLatestVaultTag = resolveLatestVaultTag;
+exports.resolvePlatformRepoUrl = resolvePlatformRepoUrl;
+exports.resolveLatestPlatformTag = resolveLatestPlatformTag;
 exports.resolveCreatedWithFrom = resolveCreatedWithFrom;
 exports.composeBindings = composeBindings;
 exports.redactComposeResultForEmission = redactComposeResultForEmission;
 exports.cmdComposeBindings = cmdComposeBindings;
+exports.cmdPlatformLatestTag = cmdPlatformLatestTag;
 const node_fs_1 = __importDefault(require("node:fs"));
 const node_path_1 = __importDefault(require("node:path"));
-const node_child_process_1 = __importDefault(require("node:child_process"));
 // eslint-disable-next-line @typescript-eslint/no-require-imports
 const io = require("./io.cjs");
 const { output } = io;
@@ -356,17 +360,112 @@ const platformTagMemo = new Map();
  * `src/active-workstream-store.cts`'s controlling-TTY probe cache. */
 function _resetPlatformTagMemoForTests() {
     platformTagMemo.clear();
+    vaultTagMemo.clear();
+}
+/** Per-process memo for `resolveLatestVaultTag`, keyed by clone target. */
+const vaultTagMemo = new Map();
+/**
+ * List the stable `vX.Y.Z` tags at `url`, never shell-eval'd (T-34-25):
+ * `git ls-remote` is spawned with an argv array through `execGitLocal`, the
+ * owner of a vault git invocation's environment (D-116, D-117): the URL names
+ * the remote, but git still reads the config of the repository an inherited
+ * location variable selects, so the location is unset and transport is kept.
+ * Bounded by a 10 s `timeout`, `windowsHide` and spawnSync's default buffer
+ * (T-34-26), with the child's stderr piped and discarded — the owner prints
+ * nothing (`init-tag-lookup-raw-git-error`). `--` separates the target from
+ * the options so a flag-shaped value can never be read as one (T-29-26).
+ * Filtered with `isStableTripletSemver`, the single blessed predicate. THROWS
+ * on any git fault (a non-zero exit, which the owner also reports for a
+ * timeout or a missing git) — callers own the degrade-to-warning policy.
+ */
+function listStableTagsAt(url, opts = {}) {
+    const lsOutput = (() => {
+        if (typeof opts._lsRemote === 'function')
+            return opts._lsRemote(url);
+        const result = (0, shell_command_projection_cjs_1.execGitLocal)(['ls-remote', '--tags', '--refs', '--sort=-v:refname', '--', url, 'v*'], { timeout: 10_000 });
+        if (result.exitCode !== 0 || result.error)
+            throw new Error(`git ls-remote exited ${result.exitCode}`);
+        return result.stdout;
+    })();
+    return lsOutput
+        .split('\n')
+        .map((line) => {
+        const m = line.match(/\brefs\/tags\/([^\s^]+)$/);
+        return m ? m[1].trim() : '';
+    })
+        .filter((t) => t && (0, semver_compare_cjs_1.isStableTripletSemver)(t));
+}
+/** The highest tag by `compareSemverCore`, or `null` for an empty list. */
+function pickLatestStableTag(tags) {
+    if (tags.length === 0)
+        return null;
+    let latest = tags[0];
+    for (const t of tags) {
+        if ((0, semver_compare_cjs_1.compareSemverCore)(t, latest) > 0)
+            latest = t;
+    }
+    return latest;
+}
+/**
+ * FORK-ONLY (PBI 74316). Propose the vault version a NEW project builds on:
+ * the latest stable tag of the client vault repo. The embedded org profile
+ * seeds no vault ref on purpose — the version is a per-project choice,
+ * committed in `.platform-bindings.json`, so no pp-core release can move it.
+ * The proposal reaches the operator through the provenance table
+ * (`resolved-tag`) they confirm before anything is written.
+ *
+ * The clone target is composed by `composeCloneTarget`, so the scp-style SSH
+ * form passes through verbatim. Tagless, offline and unreachable all degrade
+ * to `{ tag: null }` plus one bounded warning naming the consequence: with no
+ * `client.vaultRef` the vault resolves `main`, i.e. the project is unpinned.
+ */
+function resolveLatestVaultTag(repo, host, provider, opts = {}) {
+    const unpinned = (why) => ({
+        tag: null,
+        warnings: [
+            bound(`client.vaultRef could not be proposed — ${why}; the vault resolves "main" until the project is pinned with "pp-tools vault update <tag>".`),
+        ],
+    });
+    const target = (0, git_provider_cjs_1.composeCloneTarget)(provider, repo, host);
+    const cached = vaultTagMemo.get(target.url);
+    if (cached)
+        return cached;
+    let result;
+    try {
+        const tag = pickLatestStableTag(listStableTagsAt(target.url, opts));
+        result = tag ? { tag, warnings: [] } : unpinned('the vault repo has no stable v* tag');
+    }
+    catch {
+        result = unpinned('the tag lookup failed or was unreachable');
+    }
+    vaultTagMemo.set(target.url, result);
+    return result;
+}
+/**
+ * The platform repo URL rule — the ONE place the platform URL string is
+ * composed (quick 261003-my0). The host is `resolvePlatformHost(cwd).host`
+ * when it resolves, else `defaultHostForProvider(provider)`; it is never
+ * derived from the repo string (Phase 31 D-09). `resolveLatestPlatformTag`
+ * and, through it, `pp-tools init`, `check ship.platform-drift` and
+ * `query platform-latest-tag` all read this rule, so a shell copy cannot
+ * drift from it. May throw when `resolvePlatformHost` throws; the owner's
+ * try/catch is the degrade policy.
+ */
+function resolvePlatformRepoUrl(cwd, repo, provider) {
+    const host = (0, vault_coordinates_cjs_1.resolvePlatformHost)(cwd).host ?? (0, vault_coordinates_cjs_1.defaultHostForProvider)(provider);
+    return `https://${host}/${repo}`;
 }
 /**
  * Resolve the latest STABLE tag for `repo` over the resolved host, never
- * shell-eval'd (T-34-25): `git ls-remote` is spawned with an argv array via
- * `childProcess.execFileSync`, bounded by `timeout`/`maxBuffer`/`windowsHide`
- * (T-34-26). The host is `resolvePlatformHost(cwd).host` when it resolves,
- * else `defaultHostForProvider(provider)` — the host is authoritative and
- * never derived from the repo string (Phase 31 D-09).
+ * shell-eval'd (T-34-25): `git ls-remote` is spawned with an argv array
+ * through `execGitLocal` (D-116, D-117), bounded by `timeout`/`windowsHide`
+ * (T-34-26). The URL comes from `resolvePlatformRepoUrl`: the host is
+ * `resolvePlatformHost(cwd).host` when it resolves, else
+ * `defaultHostForProvider(provider)` — the host is authoritative and never
+ * derived from the repo string (Phase 31 D-09).
  *
  * The child's stderr is piped into the parent's buffer rather than inherited
- * — an explicit `stdio: ['ignore', 'pipe', 'pipe']` — and deliberately
+ * — the owner spawns with `stdio: 'pipe'` — and deliberately
  * discarded rather than logged: the bounded warning this function returns on
  * failure is the single user-visible surface for a lookup failure. Inheriting
  * the child's stream let a raw git `fatal:` line reach the terminal during an
@@ -374,22 +473,29 @@ function _resetPlatformTagMemoForTests() {
  *
  * Every candidate ref is filtered with `isStableTripletSemver` and ordered
  * with `compareSemverCore` — the single blessed comparison source, never
- * reimplemented. An empty result degrades to `{ tag: null, warnings: [] }`
- * (tagless is valid, D-01/D-02); any thrown fault (offline, unreachable,
- * DNS failure, non-zero git exit) degrades to `{ tag: null, warnings: [one
+ * reimplemented. An empty result degrades to `{ tag: null, outcome:
+ * 'tagless', warnings: [] }` (tagless is valid, D-01/D-02); any thrown fault
+ * (offline, unreachable, DNS failure, non-zero git exit, an unresolvable
+ * host) degrades to `{ tag: null, outcome: 'unreachable', warnings: [one
  * bounded warning] }` — offline, unreachable and tagless all resolve to the
- * platform being unpinned, never a compose failure.
+ * platform being unpinned, never a compose failure, and `outcome` says which
+ * one was measured (quick 261003-my0).
+ *
+ * Quick 261003-lqi: the ship-time drift check (`cmdShipPlatformDrift`) calls
+ * this same owner, so init and ship resolve one URL from one host rule.
+ * Quick 261003-my0: the init.md / new-project.md preflights reach it through
+ * `query platform-latest-tag` (`cmdPlatformLatestTag`).
  */
 function resolveLatestPlatformTag(cwd, repo, provider, opts) {
     let url;
     try {
-        const hostRes = (0, vault_coordinates_cjs_1.resolvePlatformHost)(cwd);
-        const host = hostRes.host ?? (0, vault_coordinates_cjs_1.defaultHostForProvider)(provider);
-        url = `https://${host}/${repo}`;
+        url = resolvePlatformRepoUrl(cwd, repo, provider);
     }
     catch {
         return {
             tag: null,
+            url: null,
+            outcome: 'unreachable',
             warnings: [
                 bound('platform.tag could not be resolved — the tag lookup failed or was unreachable; the platform is unpinned.'),
             ],
@@ -400,11 +506,14 @@ function resolveLatestPlatformTag(cwd, repo, provider, opts) {
         return cached;
     let result;
     try {
-        result = { tag: pickLatestStableTag(listStableTagsAt(url, opts)), warnings: [] };
+        const tag = pickLatestStableTag(listStableTagsAt(url, opts));
+        result = tag ? { tag, url, outcome: 'resolved', warnings: [] } : { tag: null, url, outcome: 'tagless', warnings: [] };
     }
     catch {
         result = {
             tag: null,
+            url,
+            outcome: 'unreachable',
             warnings: [
                 bound('platform.tag could not be resolved — the tag lookup failed or was unreachable; the platform is unpinned.'),
             ],
@@ -413,44 +522,6 @@ function resolveLatestPlatformTag(cwd, repo, provider, opts) {
     platformTagMemo.set(url, result);
     return result;
 }
-/**
- * List the stable `vX.Y.Z` tags at `url`, never shell-eval'd (T-34-25):
- * `git ls-remote` is spawned with an argv array, bounded by
- * `timeout`/`maxBuffer`/`windowsHide` (T-34-26), with the child's stderr piped
- * and discarded. `--` ends the options, so a flag-shaped target can never be
- * read as one. Filtered with `isStableTripletSemver`, the single blessed
- * predicate. THROWS on any git fault — callers own the degrade policy. Shared
- * by the platform-tag lookup and `vault update`.
- */
-function listStableTagsAt(url, opts = {}) {
-    const lsOutput = typeof opts._lsRemote === 'function'
-        ? opts._lsRemote(url)
-        : node_child_process_1.default.execFileSync('git', ['ls-remote', '--tags', '--refs', '--sort=-v:refname', '--', url, 'v*'], {
-            encoding: 'utf-8',
-            timeout: 10_000,
-            maxBuffer: 512 * 1024,
-            windowsHide: true,
-            stdio: ['ignore', 'pipe', 'pipe'],
-        });
-    return lsOutput
-        .split('\n')
-        .map((line) => {
-        const m = line.match(/\brefs\/tags\/([^\s^]+)$/);
-        return m ? m[1].trim() : '';
-    })
-        .filter((t) => t && (0, semver_compare_cjs_1.isStableTripletSemver)(t));
-}
-/** The highest tag by `compareSemverCore`, or `null` for an empty list. */
-function pickLatestStableTag(tags) {
-    if (tags.length === 0)
-        return null;
-    let latest = tags[0];
-    for (const t of tags) {
-        if ((0, semver_compare_cjs_1.compareSemverCore)(t, latest) > 0)
-            latest = t;
-    }
-    return latest;
-}
 /**
  * Read the first readable, semver-shaped `VERSION` file among the candidate
  * locations resolved against `baseDir`, returning `<binName>@<version>`.
@@ -547,6 +618,25 @@ function composeCandidate(cwd, seed, provider, opts) {
     setField('client.vaultRepo', seed.clientVaultRepo, 'profile-seed');
     setField('client.vaultRef', seed.clientVaultRef, 'profile-seed');
     setField('client.vaultHost', seed.clientVaultHost, 'profile-seed');
+    // client.vaultRef (resolved-tag) — FORK-ONLY (PBI 74316). When the seed
+    // names a vault repo but no ref, propose the repo's latest stable tag.
+    if (isUsableString(seed.clientVaultRepo) && !isUsableString(seed.clientVaultRef)) {
+        if (opts.offline === true) {
+            pushDeduped(warnings, [
+                bound('client.vaultRef was not proposed (offline) — the vault resolves "main" until the project is pinned with "pp-tools vault update <tag>".'),
+            ]);
+        }
+        else {
+            const vaultHost = isUsableString(seed.clientVaultHost)
+                ? seed.clientVaultHost
+                : (hostRes.host ?? (0, vault_coordinates_cjs_1.defaultHostForProvider)(provider));
+            const vaultTag = resolveLatestVaultTag(seed.clientVaultRepo, vaultHost, provider, opts);
+            pushDeduped(warnings, vaultTag.warnings);
+            if (vaultTag.tag) {
+                setField('client.vaultRef', vaultTag.tag, 'resolved-tag');
+            }
+        }
+    }
     // project.name / project.slug (project-answer)
     setField('project.name', cfgGet(cwd, 'project.name', undefined), 'project-answer');
     setField('project.slug', cfgGet(cwd, 'project.slug', undefined), 'project-answer');
@@ -810,6 +900,41 @@ function composeBindings(cwd, opts = {}) {
         };
     }
 }
+// ─── Emission projection (VAULT-EGRESS-1) ─────────────────────────────────────
+/** The seed short names whose bindings field is a coordinate — DERIVED from
+ * `SEED_KEY_SHORT_NAMES` and the coordinate field list, never retyped. */
+const SEED_COORDINATE_SHORT_NAMES = Object.freeze(Object.entries(SEED_KEY_SHORT_NAMES)
+    .filter(([seedKey]) => platform_bindings_cjs_1.BINDINGS_COORDINATE_FIELDS.includes(seedKey.slice(org_profile_cjs_1.ORG_PROFILE_SEED_SECTION.length + 1)))
+    .map(([, short]) => short));
+/**
+ * VAULT-EGRESS-1 (quick 261005-8py gap closure): the display-safe copy of a
+ * compose result, for EMISSION only. Every place a coordinate field can carry
+ * a value — `composed`, `seed`, each `provenance[].value` and each
+ * `drift[].profileValue/effectiveValue` — goes through the one owner. The
+ * comparisons that decided `drift` and `action` already ran on the RAW values
+ * inside `composeBindings`, and `composeBindings(..., { write: true })` writes
+ * the RAW composed object; neither path ever sees this projection.
+ */
+function redactComposeResultForEmission(result) {
+    const seed = result.seed === undefined ? undefined : { ...result.seed };
+    if (seed !== undefined) {
+        for (const short of SEED_COORDINATE_SHORT_NAMES) {
+            if (typeof seed[short] === 'string')
+                seed[short] = (0, platform_bindings_cjs_1.redactCoordinateForEmission)(seed[short]);
+        }
+    }
+    return {
+        ...result,
+        ...(seed === undefined ? {} : { seed }),
+        composed: result.composed === null ? null : (0, platform_bindings_cjs_1.redactBindingsForEmission)(result.composed),
+        provenance: result.provenance.map((e) => ({ ...e, value: (0, platform_bindings_cjs_1.redactBindingsField)(e.field, e.value) })),
+        drift: result.drift.map((d) => ({
+            ...d,
+            profileValue: (0, platform_bindings_cjs_1.redactBindingsField)(d.key, d.profileValue),
+            effectiveValue: (0, platform_bindings_cjs_1.redactBindingsField)(d.key, d.effectiveValue),
+        })),
+    };
+}
 // ─── cmdComposeBindings ───────────────────────────────────────────────────────
 /**
  * CLI adapter for `pp-tools query compose-bindings`. Resolves the project
@@ -817,39 +942,6 @@ function composeBindings(cwd, opts = {}) {
  * does, then calls `composeBindings` and emits the result as data — a
  * verdict is never a process error.
  */
-/**
- * Pack 6 D-07: the display-safe copy of a compose result, for EMISSION only.
- * Every remote coordinate field (`platform.repo`, `client.vaultRepo`) in
- * `composed`, `seed`, `provenance` and `drift` goes through the one owner
- * (`redactCloneTarget`, src/vault.cts); warnings go through the prose
- * redactor. `composeBindings` itself, its drift/action comparison and every
- * write keep the RAW values — never write or compare the result of this.
- */
-function redactComposeResultForEmission(result) {
-    // eslint-disable-next-line @typescript-eslint/no-require-imports
-    const v = require('./vault.cjs');
-    const COORD = new Set(['platform.repo', 'client.vaultRepo']);
-    const safe = (x) => (typeof x === 'string' ? v.redactCloneTarget(x) : x);
-    const out = JSON.parse(JSON.stringify(result));
-    if (out.composed && typeof out.composed === 'object') {
-        for (const field of COORD) {
-            const [ns, key] = field.split('.');
-            const parent = out.composed[ns];
-            if (parent && typeof parent === 'object' && typeof parent[key] === 'string')
-                parent[key] = safe(parent[key]);
-        }
-    }
-    if (out.seed) {
-        if (typeof out.seed.platformRepo === 'string')
-            out.seed.platformRepo = safe(out.seed.platformRepo);
-        if (typeof out.seed.clientVaultRepo === 'string')
-            out.seed.clientVaultRepo = safe(out.seed.clientVaultRepo);
-    }
-    out.provenance = (out.provenance ?? []).map((p) => (COORD.has(p.field) ? { ...p, value: safe(p.value) } : p));
-    out.drift = (out.drift ?? []).map((d) => COORD.has(d.key) ? { ...d, profileValue: safe(d.profileValue), effectiveValue: safe(d.effectiveValue) } : d);
-    out.warnings = (out.warnings ?? []).map((w) => (typeof w === 'string' ? v.redactRemoteText(w) : w));
-    return out;
-}
 function cmdComposeBindings(cwd, options, raw) {
     let root;
     try {
@@ -861,3 +953,74 @@ function cmdComposeBindings(cwd, options, raw) {
     const result = composeBindings(root, { write: options.write === true, offline: options.offline === true });
     output(redactComposeResultForEmission(result), raw);
 }
+// ─── cmdPlatformLatestTag ─────────────────────────────────────────────────────
+/**
+ * CLI adapter for `pp-tools query platform-latest-tag` (quick 261003-my0).
+ * Its whole job is to run the owner — `resolveLatestPlatformTag`, the same
+ * lookup `pp-tools init` and `check ship.platform-drift` use — and print
+ * `{ present, pinned, repo, provider, url, latest, outcome }`, so a shell
+ * preflight (init.md / new-project.md Step 0) reads `--pick latest` instead
+ * of composing a URL of its own.
+ *
+ * Absent bindings → `{ present: false }` with NO network call (the parity
+ * `--help` smoke runs from a repo root that has no bindings file). Malformed
+ * bindings → `outcome: 'malformed'` and no lookup — inert data, never
+ * `error()`, the same posture as the drift check's malformed arm. No
+ * `platform.repo` → `outcome: 'no-repo'`. `args` is accepted for the
+ * dispatcher's uniform shape; no flags are read (`--pick`/`--raw`/`--cwd`
+ * are stripped before dispatch, and `--pick` prints `''` for a null field —
+ * the shell contract). The owner's warnings are init-time prose and are not
+ * forwarded.
+ */
+function cmdPlatformLatestTag(cwd, args, raw) {
+    void args;
+    let root;
+    try {
+        root = (0, project_root_cjs_1.findProjectRoot)(cwd) || cwd;
+    }
+    catch {
+        root = cwd;
+    }
+    const bindingsPath = node_path_1.default.join(root, '.platform-bindings.json');
+    if (!node_fs_1.default.existsSync(bindingsPath)) {
+        output({ present: false }, raw);
+        return;
+    }
+    let provider;
+    try {
+        provider = (0, git_provider_cjs_1.resolveProvider)(root).provider;
+    }
+    catch {
+        provider = git_provider_cjs_1.DEFAULT_PROVIDER;
+    }
+    let parsed;
+    try {
+        parsed = JSON.parse(node_fs_1.default.readFileSync(bindingsPath, 'utf-8'));
+    }
+    catch {
+        parsed = null;
+    }
+    if (!isObject(parsed)) {
+        output({ present: true, pinned: null, repo: null, provider, url: null, latest: null, outcome: 'malformed' }, raw);
+        return;
+    }
+    const platform = isObject(parsed.platform) ? parsed.platform : null;
+    const trimmedOrNull = (v) => typeof v === 'string' && v.trim() !== '' ? v.trim() : null;
+    const pinned = trimmedOrNull(platform?.tag);
+    const repo = trimmedOrNull(platform?.repo);
+    if (repo === null) {
+        output({ present: true, pinned, repo: null, provider, url: null, latest: null, outcome: 'no-repo' }, raw);
+        return;
+    }
+    const result = resolveLatestPlatformTag(root, repo, provider, {});
+    // VAULT-EGRESS-1: `repo` and `url` are display-safe; the lookup above used the raw repo.
+    output({
+        present: true,
+        pinned,
+        repo: (0, platform_bindings_cjs_1.redactCoordinateForEmission)(repo),
+        provider,
+        url: (0, platform_bindings_cjs_1.redactCoordinateForEmission)(result.url),
+        latest: result.tag,
+        outcome: result.outcome,
+    }, raw);
+}