@pathmode/mcp-server 1.18.0 → 1.20.0

package/dist/index.js

@@ -39170,6 +39170,562 @@ module.exports = function(str) {
 };
 
 
+/***/ }),
+
+/***/ 229:
+/***/ ((__unused_webpack_module, exports) => {
+
+"use strict";
+
+/**
+ * serializeIntentMd — the one implementation of the intent.md file format.
+ *
+ * Two writers used to exist: `lib/agentPromptGenerator.ts` (cloud exports, browser downloads) and
+ * `packages/mcp-server/src/intent-compiler.ts` (every local, keyless write). They diverged in BOTH
+ * directions, and the divergence cost more than tidiness:
+ *
+ *   - the cloud writer emitted no `## Confirmations`, so a human's authenticated confirmation died
+ *     at the boundary and never reached the repo;
+ *   - the local writer emitted no authorization gate, so an agent proposal still pending human
+ *     judgment lost its DO-NOT-IMPLEMENT banner on the next local save.
+ *
+ * Both are the same failure: judgment recorded in one place not travelling to the other. This
+ * module emits the union, and `serializer-parity.test.ts` holds the two callers to it.
+ *
+ * ZERO IMPORTS, deliberately. The local writer is bundled by ncc into a published npm package that
+ * must run keyless and offline, and the cloud writer is reached from `'use client'` components — so
+ * a single node builtin here (`crypto`, say) would break the browser bundle. Callers compute their
+ * own environment-specific values (id minting, readiness verdicts, evidence resolution) and hand
+ * the results in as plain data.
+ */
+Object.defineProperty(exports, "__esModule", ({ value: true }));
+exports.toSerializableChecks = toSerializableChecks;
+exports.renderAuthorizationGateText = renderAuthorizationGateText;
+exports.renderConfirmationsBody = renderConfirmationsBody;
+exports.serializeIntentMd = serializeIntentMd;
+// ── Small helpers ───────────────────────────────────────────────────────────
+const VERIFICATION_KIND_LABELS = {
+    fastest: 'Fastest check',
+    'shipped-signal': 'Shipped signal',
+    'regression-guard': 'Regression guard',
+    manual: 'Manual check',
+    test: 'Automated test',
+};
+const VERIFICATION_KIND_ORDER = ['fastest', 'shipped-signal', 'regression-guard', 'manual', 'test'];
+const VERIFICATION_KIND_SET = new Set(VERIFICATION_KIND_ORDER);
+function nonEmpty(v) {
+    return typeof v === 'string' && v.trim().length > 0;
+}
+/** YAML double-quoted scalars. Both writers used to interpolate raw, so a product named `The "Real"
+ *  One` produced a file gray-matter could not parse. */
+function yamlScalar(value) {
+    if (typeof value === 'number')
+        return String(value);
+    return `"${String(value).replace(/\\/g, '\\\\').replace(/"/g, '\\"')}"`;
+}
+function outcomeOf(o) {
+    return typeof o === 'string' ? { text: o } : o;
+}
+function constraintOf(c) {
+    return typeof c === 'string' ? { text: c } : c;
+}
+/** `backed by:` suffix on its own indented bullet. Empty when nothing resolved, so callers append
+ *  unconditionally. */
+function backedBySuffix(refs, indent = '  ') {
+    const clean = (refs || []).filter(nonEmpty);
+    if (!clean.length)
+        return '';
+    return `\n${indent}- backed by: ${clean.join('; ')}`;
+}
+/** Read verification uniformly as a check collection: canonical `checks[]` plus the legacy
+ *  {manual,unit,e2e} buckets, which are adapted rather than dropped. */
+function toSerializableChecks(v) {
+    if (!v || typeof v !== 'object')
+        return [];
+    const out = [];
+    for (const c of Array.isArray(v.checks) ? v.checks : []) {
+        if (!nonEmpty(c?.description))
+            continue;
+        out.push({
+            kind: VERIFICATION_KIND_SET.has(String(c.kind)) ? String(c.kind) : 'test',
+            description: c.description.trim(),
+            status: c.status,
+            verifies: c.verifies,
+        });
+    }
+    for (const d of Array.isArray(v.manualChecks) ? v.manualChecks : []) {
+        if (nonEmpty(d))
+            out.push({ kind: 'manual', description: d.trim() });
+    }
+    for (const d of Array.isArray(v.unitTests) ? v.unitTests : []) {
+        if (nonEmpty(d))
+            out.push({ kind: 'test', description: d.trim() });
+    }
+    for (const d of Array.isArray(v.e2eTests) ? v.e2eTests : []) {
+        if (nonEmpty(d))
+            out.push({ kind: 'test', description: d.trim() });
+    }
+    return out;
+}
+function groupChecks(v) {
+    const checks = toSerializableChecks(v);
+    return VERIFICATION_KIND_ORDER
+        .map(kind => ({ kind, label: VERIFICATION_KIND_LABELS[kind], checks: checks.filter(c => c.kind === kind) }))
+        .filter(g => g.checks.length > 0);
+}
+function checkLine(c) {
+    const verifies = nonEmpty(c.verifies) ? ` (verifies: ${c.verifies})` : '';
+    const status = nonEmpty(c.status) && c.status !== 'unknown' ? ` [${c.status}]` : '';
+    return `${c.description}${verifies}${status}`;
+}
+// ── The authorization gate ──────────────────────────────────────────────────
+/**
+ * The DO-NOT-IMPLEMENT banner for an agent proposal a human has not authorized.
+ *
+ * Lives here, not in either caller, because the local writer used to omit it entirely: a pending
+ * proposal pulled into a repo and re-saved came back without its gate, which is the one thing in
+ * the file an agent must not be able to lose.
+ *
+ * Trailing blank line included, so callers can prepend unconditionally.
+ */
+function renderAuthorizationGateText(opts) {
+    if (opts.origin !== 'agent' || opts.authorization === 'authorized')
+        return '';
+    if (opts.authorization === 'rejected') {
+        const note = nonEmpty(opts.authorizationNote) ? ` The human's note: "${opts.authorizationNote}".` : '';
+        return `> **REJECTED BY HUMAN REVIEW — DO NOT IMPLEMENT.** This spec was proposed by an agent and a human rejected it.${note} Revise the proposal per the note, or ask your operator before proceeding.\n\n`;
+    }
+    return `> **PENDING HUMAN AUTHORIZATION — DO NOT IMPLEMENT YET.** This spec was proposed by an agent and no human has authorized it. Ask your operator to review it in Pathmode before building against it.\n\n`;
+}
+// ── Confirmations ───────────────────────────────────────────────────────────
+/**
+ * Render confirmation records as the `## Confirmations` section body.
+ *
+ * Derived fields (`assurance`, `source`) are NOT written: anything read back out of a file is
+ * local-unverified by definition, so persisting a trust level would let a record vouch for itself.
+ * Records outside the dimensions the readiness gate can resolve are dropped rather than emitted,
+ * so an unwaivable dimension never leaves an empty section behind.
+ */
+function renderConfirmationsBody(records) {
+    const emittable = (records || []).filter(c => {
+        const dim = String(c?.dimension ?? '').toLowerCase();
+        const kind = String(c?.kind ?? '').toLowerCase();
+        const by = String(c?.by ?? '').toLowerCase();
+        return ['objective', 'outcomes'].includes(dim)
+            && ['confirmed', 'waived'].includes(kind)
+            && ['agent', 'human'].includes(by);
+    });
+    if (!emittable.length)
+        return '';
+    const out = ['## Confirmations'];
+    for (const c of emittable) {
+        out.push('');
+        out.push(`**${String(c.dimension).toLowerCase()}** — ${String(c.kind).toLowerCase()} by ${String(c.by).toLowerCase()}`);
+        for (const key of ['actor', 'problem', 'outcome', 'observable', 'reason', 'anchor', 'at']) {
+            const v = c[key];
+            if (!nonEmpty(v))
+                continue;
+            out.push(`- ${key}: ${v.replace(/\s+/g, ' ').trim()}`);
+        }
+    }
+    return out.join('\n');
+}
+// ── The serializer ──────────────────────────────────────────────────────────
+/**
+ * Frontmatter key order. Fixed so a file rewritten by the other implementation produces a clean
+ * diff instead of a reordering churn that hides the real change.
+ */
+const FRONTMATTER_ORDER = [
+    'id', 'version', 'status', 'readiness', 'source', 'specVersion',
+    'origin', 'authorization', 'authorizationNote', 'evidence', 'space', 'severity', 'created', 'updated',
+];
+function serializeIntentMd(spec, opts = {}) {
+    const values = {
+        id: spec.id,
+        version: opts.version && opts.version >= 1 ? opts.version : 1,
+        status: opts.status || 'draft',
+        readiness: opts.readiness,
+        source: opts.source,
+        specVersion: opts.specVersion,
+        origin: opts.origin,
+        // Only meaningful for agent-originated specs; human-authored ones are authorized by
+        // authorship and carrying a key here would imply a gate that does not exist.
+        authorization: opts.origin === 'agent' ? (opts.authorization ?? 'pending') : undefined,
+        // The banner renders the note as prose, but prose is not recoverable: a reader cannot tell
+        // the reviewer's words from the sentence around them. Persisting it here is what stops a
+        // local rewrite from keeping the REJECTED verdict while erasing the correction it asked
+        // for. Single-line by contract, like a confirmation value; flattened rather than escaped.
+        authorizationNote: opts.origin === 'agent' && nonEmpty(opts.authorizationNote)
+            ? opts.authorizationNote.replace(/\s+/g, ' ').trim()
+            : undefined,
+        evidence: opts.evidence?.length || undefined,
+        space: opts.space?.name,
+        severity: opts.severity,
+        created: opts.created,
+        updated: opts.updated,
+    };
+    // null, not just undefined: the cloud mapper reads absent columns as null (`problemSeverity`,
+    // `currentState`, a product with no name), and an unguarded null reached the quoter as a
+    // crash rather than an omitted key.
+    const yamlLines = FRONTMATTER_ORDER
+        .filter(key => values[key] !== undefined && values[key] !== null && values[key] !== '')
+        .map(key => `${key}: ${yamlScalar(values[key])}`)
+        .join('\n');
+    const sections = ['---', yamlLines, '---', ''];
+    // Directly under the frontmatter: the `authorization` key is machine-readable, but the body
+    // must also say DO NOT IMPLEMENT before any instruction an agent might act on.
+    const gate = renderAuthorizationGateText(opts).trim();
+    if (gate) {
+        sections.push(gate);
+        sections.push('');
+    }
+    sections.push(`# ${spec.title || 'Untitled Intent'}`);
+    const space = opts.space;
+    if (space && (nonEmpty(space.productVision) || nonEmpty(space.northStar) || nonEmpty(space.targetAudience)
+        || space.constraints?.length || space.principles?.length)) {
+        sections.push('');
+        sections.push('## Space Context');
+        if (nonEmpty(space.productVision))
+            sections.push(`**Product Vision**: ${space.productVision}`);
+        if (nonEmpty(space.northStar))
+            sections.push(`**North Star**: ${space.northStar}`);
+        if (nonEmpty(space.targetAudience))
+            sections.push(`**Target Audience**: ${space.targetAudience}`);
+        if (space.constraints?.length)
+            sections.push('**Constraints**: ' + space.constraints.join(', '));
+        if (space.principles?.length)
+            sections.push('**Principles**: ' + space.principles.join(', '));
+    }
+    if (nonEmpty(spec.objective)) {
+        sections.push('');
+        sections.push('## Objective');
+        sections.push(spec.objective);
+    }
+    // Heading text is the round-trip key (the reader keys sections by exact heading) — keep it
+    // plain, exactly like Objective above.
+    if (nonEmpty(spec.currentState)) {
+        sections.push('');
+        sections.push('## Current State');
+        sections.push(spec.currentState.trim());
+    }
+    // Sits next to Current State on purpose: one is what the author says is true today, the other
+    // is what the repo says. Same heading in both modes, so a handoff reads identically either way.
+    const icBody = implementationContextBody(spec);
+    if (icBody.length) {
+        sections.push('');
+        sections.push('## Implementation Context');
+        sections.push(...icBody);
+    }
+    const decisions = (spec.decisions || []).filter(d => d && nonEmpty(d.choice) && typeof d.reason === 'string');
+    if (decisions.length) {
+        sections.push('');
+        sections.push('## Decisions & Ruled-Out Alternatives');
+        for (const d of decisions) {
+            sections.push(`- **${d.choice}**${nonEmpty(d.ruledOut) ? ` (instead of: ${d.ruledOut})` : ''} — ${d.reason}`);
+            if (nonEmpty(d.reopenTrigger))
+                sections.push(`  - reopen if: ${d.reopenTrigger.trim()}`);
+        }
+    }
+    const outcomes = (spec.outcomes || []).map(outcomeOf).filter(o => nonEmpty(o.text));
+    if (outcomes.length) {
+        sections.push('');
+        sections.push('## Outcomes');
+        // No priority prefix. The writer used to emit `[MUST] `, which is in neither SPEC.md nor the
+        // normalization corpus, and neither parser strips it — so it read back as part of the
+        // outcome text. Emitting a label the format cannot read back is worse than omitting it.
+        for (const o of outcomes) {
+            sections.push(`- [ ] ${o.text}${backedBySuffix(o.backedBy)}`);
+        }
+    }
+    if (spec.scope?.inScope?.length || spec.scope?.outOfScope?.length) {
+        sections.push('');
+        sections.push('## Scope');
+        if (spec.scope.inScope?.length) {
+            sections.push('**In scope:**');
+            for (const s of spec.scope.inScope)
+                sections.push(`- ${s}`);
+        }
+        if (spec.scope.outOfScope?.length) {
+            sections.push('**Out of scope:**');
+            for (const s of spec.scope.outOfScope)
+                sections.push(`- ${s}`);
+        }
+    }
+    const constraints = (spec.constraints || []).map(constraintOf).filter(c => nonEmpty(c.text));
+    if (constraints.length) {
+        sections.push('');
+        sections.push('## Constraints');
+        for (const c of constraints)
+            sections.push(`- ${c.text}${backedBySuffix(c.backedBy)}`);
+    }
+    const edgeCases = (spec.edgeCases || []).filter(ec => ec && nonEmpty(ec.scenario));
+    if (edgeCases.length) {
+        sections.push('');
+        sections.push('## Edge Cases');
+        for (const ec of edgeCases) {
+            sections.push(`- **${ec.scenario}**: ${ec.expectedBehavior}${backedBySuffix(ec.backedBy)}`);
+        }
+    }
+    const evidenceBody = renderCompactEvidence(opts.evidence);
+    if (evidenceBody.length) {
+        sections.push('');
+        sections.push('## Supporting Evidence');
+        sections.push(...evidenceBody);
+    }
+    if (spec.healthMetrics?.length) {
+        sections.push('');
+        sections.push('## Health Metrics');
+        for (const metric of spec.healthMetrics)
+            sections.push(`- ${metric}`);
+    }
+    const checkGroups = groupChecks(spec.verification);
+    if (checkGroups.length) {
+        sections.push('');
+        sections.push('## Verification');
+        sections.push('_A feedback loop, not just a test list._');
+        for (const g of checkGroups) {
+            sections.push(`**${g.label}**:`);
+            for (const c of g.checks)
+                sections.push(`- [ ] ${checkLine(c)}`);
+        }
+    }
+    // `## Confirmations` is emitted LAST so it never sits between the fields a reader is comparing,
+    // and so appending one cannot shift any other section's parse.
+    const confirmationsBody = renderConfirmationsBody(spec.confirmations);
+    if (confirmationsBody) {
+        sections.push('');
+        sections.push(confirmationsBody);
+    }
+    return sections.join('\n');
+}
+/**
+ * The body of `## Implementation Context`.
+ *
+ * Two sources, one section. Local mode carries prose the agent gathered; cloud intents carry the
+ * analyzer's structured object. Rendering both under the same heading is what lets a spec move
+ * between modes without the section disappearing on the way through.
+ */
+function implementationContextBody(spec) {
+    if (nonEmpty(spec.implementationContextText))
+        return [spec.implementationContextText.trim()];
+    const ic = spec.implementationContext;
+    if (!ic)
+        return [];
+    const lines = [];
+    if (ic.relevantAreas?.length) {
+        lines.push('### Relevant areas');
+        for (const a of ic.relevantAreas) {
+            if (nonEmpty(a?.path))
+                lines.push(`- \`${a.path}\`${nonEmpty(a.reason) ? ` — ${a.reason}` : ''}`);
+        }
+    }
+    if (nonEmpty(ic.currentBehavior)) {
+        if (lines.length)
+            lines.push('');
+        lines.push('### Current behavior');
+        lines.push(ic.currentBehavior.trim());
+    }
+    if (ic.risks?.length) {
+        if (lines.length)
+            lines.push('');
+        lines.push('### Risks');
+        for (const r of ic.risks)
+            if (nonEmpty(r))
+                lines.push(`- ${r.trim()}`);
+    }
+    if (ic.verificationSuggestions?.length) {
+        if (lines.length)
+            lines.push('');
+        lines.push('### Verification suggestions');
+        for (const v of ic.verificationSuggestions)
+            if (nonEmpty(v))
+                lines.push(`- ${v.trim()}`);
+    }
+    return lines;
+}
+/** Compact evidence list — one truncated line per item, quotes as blockquotes. Lighter than the
+ *  execution prompt's full rendering so a committed intent.md stays readable. */
+function renderCompactEvidence(evidence) {
+    const items = (evidence || []).filter(e => nonEmpty(e?.content));
+    if (!items.length)
+        return [];
+    const lines = [];
+    const truncate = (s) => (s.length > 160 ? `${s.slice(0, 160)}…` : s);
+    for (const q of items.filter(e => e.type === 'quote')) {
+        lines.push(`> "${truncate(q.content)}"${nonEmpty(q.source) ? ` — ${q.source}` : ''}`);
+    }
+    for (const e of items.filter(e => e.type !== 'quote')) {
+        const severity = nonEmpty(e.severity) ? ` (${e.severity})` : '';
+        lines.push(`- [${e.type}]${severity} ${truncate(e.content)}${nonEmpty(e.source) ? ` — ${e.source}` : ''}`);
+    }
+    return lines;
+}
+
+
+/***/ }),
+
+/***/ 7797:
+/***/ (function(__unused_webpack_module, exports, __nccwpck_require__) {
+
+"use strict";
+
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", ({ value: true }));
+exports.isAdoptCommand = isAdoptCommand;
+exports.patchAdoptedIntentFrontmatter = patchAdoptedIntentFrontmatter;
+exports.runAdopt = runAdopt;
+const fs_1 = __importDefault(__nccwpck_require__(9896));
+const path_1 = __importDefault(__nccwpck_require__(6928));
+const api_client_1 = __nccwpck_require__(7475);
+const local_reader_1 = __nccwpck_require__(3518);
+const push_spec_1 = __nccwpck_require__(4239);
+const project_config_1 = __nccwpck_require__(581);
+const CODE_RE = /^pm_adopt_[A-Za-z0-9_-]{32}$/;
+function isAdoptCommand(argv = process.argv) {
+    return argv.includes('adopt');
+}
+function getAdoptCode(argv = process.argv) {
+    const index = argv.findIndex(arg => arg === 'adopt');
+    return index < 0 ? undefined : argv.slice(index + 1).find(arg => CODE_RE.test(arg));
+}
+function apiOrigin(argv = process.argv) {
+    const apiArg = argv.find(arg => arg.startsWith('--api-url='));
+    if (apiArg)
+        return apiArg.slice('--api-url='.length).replace(/\/$/, '');
+    return argv.includes('--staging') ? 'https://staging.pathmode.io' : 'https://pathmode.io';
+}
+async function exchangeCode(code, origin, existing) {
+    const response = await fetch(`${origin}/api/v1/onboarding/repo/exchange`, {
+        method: 'POST',
+        headers: {
+            'Content-Type': 'application/json',
+            ...(existing?.apiKey ? { Authorization: `Bearer ${existing.apiKey}` } : {}),
+        },
+        body: JSON.stringify({ code }),
+    });
+    const body = await response.json().catch(() => ({}));
+    if (!response.ok || !body.sessionId || !body.workspaceId || !body.productId) {
+        throw new Error(body.error || `Adoption code exchange failed (${response.status})`);
+    }
+    if (!body.apiKey && !body.reusedCredential)
+        throw new Error('The adoption exchange returned no credential.');
+    return body;
+}
+/** Add cloud identity to the existing frontmatter without reformatting the user's spec body. */
+function patchAdoptedIntentFrontmatter(filePath, values) {
+    const raw = fs_1.default.readFileSync(filePath, 'utf8');
+    const newline = raw.includes('\r\n') ? '\r\n' : '\n';
+    if (!raw.startsWith(`---${newline}`)) {
+        throw new Error('intent.md must start with YAML frontmatter before it can be adopted.');
+    }
+    const close = raw.indexOf(`${newline}---`, 4);
+    if (close < 0)
+        throw new Error('intent.md has an unterminated YAML frontmatter block.');
+    const headerEnd = 3 + newline.length;
+    const managed = new Set(['id', 'specVersion', 'source', 'origin', 'authorization', 'authorizationNote']);
+    const lines = raw.slice(headerEnd, close).split(/\r?\n/).filter(line => {
+        const match = line.match(/^([A-Za-z][A-Za-z0-9_-]*):/);
+        return !match || !managed.has(match[1]);
+    });
+    const add = (key, value) => {
+        if (value !== undefined && value !== null && value !== '')
+            lines.push(`${key}: ${JSON.stringify(value)}`);
+    };
+    add('id', values.id);
+    add('specVersion', values.specVersion);
+    add('source', values.sourceUrl);
+    add('origin', values.origin);
+    add('authorization', values.authorization);
+    add('authorizationNote', values.authorizationNote);
+    fs_1.default.writeFileSync(filePath, `---${newline}${lines.join(newline)}${raw.slice(close)}`, 'utf8');
+}
+async function runAdopt(argv = process.argv) {
+    const code = getAdoptCode(argv);
+    if (!code)
+        throw new Error('Usage: npx @pathmode/mcp-server@latest adopt pm_adopt_…');
+    const filePath = path_1.default.join(process.cwd(), 'intent.md');
+    const intent = (0, local_reader_1.readIntentFile)(filePath);
+    const meta = (0, local_reader_1.readIntentMeta)(filePath);
+    if (!intent || !meta?.id) {
+        throw new Error('No valid intent.md with an id was found in this directory.');
+    }
+    console.log('');
+    console.log('Pathmode repo adoption');
+    console.log('──────────────────────');
+    console.log(`  Found: ${intent.title}`);
+    process.stdout.write('  Connecting…');
+    const origin = apiOrigin(argv);
+    const current = (0, api_client_1.loadConfig)();
+    let exchange;
+    try {
+        exchange = await exchangeCode(code, origin, current?.apiUrl.replace(/\/$/, '') === origin ? current : null);
+    }
+    catch (error) {
+        // A valid key for a different workspace is not useful for this adoption, but it
+        // must not block minting the correctly scoped project credential.
+        if (current
+            && error instanceof Error
+            && (error.message.includes('different workspace') || error.message.includes('Invalid API key'))) {
+            exchange = await exchangeCode(code, origin, null);
+        }
+        else {
+            throw error;
+        }
+    }
+    const apiKey = exchange.apiKey || current?.apiKey;
+    if (!apiKey)
+        throw new Error('No repository credential is available after adoption exchange.');
+    const config = {
+        apiKey,
+        apiUrl: exchange.apiUrl,
+        workspaceId: exchange.workspaceId,
+    };
+    // Persist immediately after the one-time exchange. If a later network call fails, the
+    // credential remains recoverable from this repo without minting a duplicate key.
+    (0, project_config_1.saveProjectConnection)(config);
+    (0, project_config_1.ensureProjectMcpConfig)();
+    const client = new api_client_1.PathmodeClient(config);
+    const pushed = await (0, push_spec_1.pushSpec)({
+        client,
+        id: meta.id,
+        ...(meta.specVersion ? { existingSpecVersion: meta.specVersion } : {}),
+        payload: {
+            title: intent.title,
+            objective: intent.objective,
+            ...(intent.currentState ? { currentState: intent.currentState } : {}),
+            outcomes: intent.outcomes,
+            constraints: intent.constraints,
+            healthMetrics: intent.healthMetrics,
+            edgeCases: intent.edgeCases,
+            verification: intent.verification,
+            ...(intent.scope ? { scope: intent.scope } : {}),
+            productId: exchange.productId,
+        },
+        decisions: intent.decisions,
+        implementationContext: intent.implementationContext,
+        onIdentitySettled: settled => patchAdoptedIntentFrontmatter(filePath, {
+            id: settled.canonicalId,
+            specVersion: settled.specVersion,
+            sourceUrl: settled.sourceUrl,
+            origin: settled.origin,
+            authorization: settled.authorization,
+            authorizationNote: settled.authorizationNote,
+        }),
+    });
+    if (!pushed.ok)
+        throw new Error(pushed.error);
+    await client.completeRepoOnboarding(exchange.sessionId, pushed.canonicalId);
+    console.log(' ✓');
+    console.log(`  Adopted into ${exchange.workspaceName} / ${exchange.productName}`);
+    console.log(`  ${pushed.sourceUrl}`);
+    console.log('');
+    console.log('Restart your coding tool once so it reloads the connected Pathmode server.');
+    console.log('');
+}
+
+
 /***/ }),
 
 /***/ 7475:
@@ -39191,6 +39747,7 @@ exports.loadConfig = loadConfig;
 const fs_1 = __importDefault(__nccwpck_require__(9896));
 const path_1 = __importDefault(__nccwpck_require__(6928));
 const os_1 = __importDefault(__nccwpck_require__(857));
+const project_config_1 = __nccwpck_require__(581);
 const isDebug = process.env.PATHMODE_MCP_DEBUG === '1';
 /** An API failure that keeps the response body, so callers can act on `code` and its payload. */
 class ApiError extends Error {
@@ -39218,6 +39775,12 @@ function normalizeApiKey(raw) {
     return key;
 }
 function loadConfig() {
+    // A complete repository binding is the most specific configuration. It wins
+    // over process/global defaults on this machine; CI still falls through to env
+    // because the external home-secret file is intentionally not in the repository.
+    const projectConfig = (0, project_config_1.loadProjectConnection)();
+    if (projectConfig)
+        return projectConfig;
     const envKey = normalizeApiKey(process.env.PATHMODE_API_KEY);
     if (envKey) {
         return {
@@ -39370,6 +39933,13 @@ class PathmodeClient {
         const res = await this.fetch(`/intents/${id}`);
         return res.json();
     }
+    async completeRepoOnboarding(sessionId, intentId) {
+        const res = await this.fetch('/onboarding/repo/complete', {
+            method: 'POST',
+            body: JSON.stringify({ sessionId, intentId }),
+        });
+        await res.json();
+    }
     async getIntentPrompt(id, agentType = 'claude-code', mode = 'execute') {
         const res = await this.fetch(`/intents/${id}/prompt?agent_type=${agentType}&mode=${mode}`);
         return res.json();
@@ -39548,6 +40118,7 @@ function formatHelp(version) {
         '  npx @pathmode/mcp-server                 Start the server (stdio). This is what an',
         '                                           MCP client runs; it waits on stdin by design.',
         '  npx @pathmode/mcp-server setup [key]     Configure Claude Code/Desktop, Cursor, Windsurf.',
+        '  npx @pathmode/mcp-server adopt <code>    Adopt this repo\'s existing intent.md.',
         '  npx @pathmode/mcp-server install-skills  Install the skill pack into this project.',
         '  npx @pathmode/mcp-server --version       Print the version.',
         '  npx @pathmode/mcp-server --help          Print this help.',
@@ -39792,6 +40363,10 @@ exports.writeConfirmationRecord = writeConfirmationRecord;
 // Verification check collection. Mirrors lib/verification in the main app — this package is
 // standalone (own ncc build) and can't import it, so the type + adapter live here. `kind` is the
 const crypto_1 = __nccwpck_require__(6982);
+// The intent.md file format itself. Shared verbatim with the cloud writer
+// (lib/agentPromptGenerator.ts) so a spec crossing between local and connected mode keeps every
+// section — notably `## Confirmations` and the authorization gate, which each side used to drop.
+const serializeIntentMd_1 = __nccwpck_require__(229);
 const VERIFICATION_KIND_LABELS = {
     fastest: 'Fastest check',
     'shipped-signal': 'Shipped signal',
@@ -39984,185 +40559,27 @@ function decisionLines(decisions, heading) {
  * is saved twice must keep its identity and its lifecycle state. Only a genuinely new intent
  * (no id) gets a minted id, version 1, and status 'draft'.
  */
-/**
- * The body of `## Implementation Context` in intent.md.
- *
- * Two sources, one section. Local mode carries prose the agent gathered; cloud intents carry the
- * analyzer's structured object. Rendering both under the same heading is what lets a spec move
- * between modes without the section disappearing on the way through.
- */
-function implementationContextBody(spec) {
-    const text = spec.implementationContextText?.trim();
-    if (text)
-        return [text];
-    const ic = spec.implementationContext;
-    if (!ic)
-        return [];
-    const lines = [];
-    if (ic.relevantAreas?.length) {
-        lines.push('### Relevant areas');
-        for (const a of ic.relevantAreas) {
-            if (a?.path?.trim())
-                lines.push(`- \`${a.path}\`${a.reason?.trim() ? ` — ${a.reason}` : ''}`);
-        }
-    }
-    if (ic.currentBehavior?.trim()) {
-        if (lines.length)
-            lines.push('');
-        lines.push('### Current behavior');
-        lines.push(ic.currentBehavior.trim());
-    }
-    if (ic.risks?.length) {
-        if (lines.length)
-            lines.push('');
-        lines.push('### Risks');
-        for (const r of ic.risks)
-            if (r?.trim())
-                lines.push(`- ${r.trim()}`);
-    }
-    if (ic.verificationSuggestions?.length) {
-        if (lines.length)
-            lines.push('');
-        lines.push('### Verification suggestions');
-        for (const v of ic.verificationSuggestions)
-            if (v?.trim())
-                lines.push(`- ${v.trim()}`);
-    }
-    return lines;
-}
 function formatIntentMd(spec, opts = {}) {
     const now = new Date().toISOString();
-    const frontmatter = {
+    // The only thing this wrapper still owns is id minting, which needs `crypto` and therefore
+    // cannot live in the shared serializer (it is imported from browser bundles too).
+    return (0, serializeIntentMd_1.serializeIntentMd)({
+        ...spec,
+        // Only a genuinely new intent gets a minted id; a re-save keeps its identity.
         id: spec.id || (0, crypto_1.randomUUID)(),
-        version: opts.version && opts.version >= 1 ? opts.version : 1,
-        status: opts.status || 'draft',
-        ...(opts.readiness ? { readiness: opts.readiness } : {}),
-        ...(opts.source ? { source: opts.source } : {}),
-        ...(opts.specVersion ? { specVersion: opts.specVersion } : {}),
+        confirmations: spec.confirmations,
+    }, {
+        version: opts.version,
+        status: opts.status,
+        readiness: opts.readiness,
+        source: opts.source,
+        specVersion: opts.specVersion,
         created: opts.created || now,
         updated: now,
-    };
-    const yamlLines = Object.entries(frontmatter)
-        .map(([key, value]) => `${key}: ${typeof value === 'string' ? `"${value}"` : value}`)
-        .join('\n');
-    const sections = [];
-    sections.push('---');
-    sections.push(yamlLines);
-    sections.push('---');
-    sections.push('');
-    sections.push(`# ${spec.title || 'Untitled Intent'}`);
-    if (spec.objective) {
-        sections.push('');
-        sections.push('## Objective');
-        sections.push(spec.objective);
-    }
-    // Heading text is the round-trip key (readIntentFile keys sections by exact
-    // heading) — keep it plain, exactly like Objective above.
-    if (spec.currentState?.trim()) {
-        sections.push('');
-        sections.push('## Current State');
-        sections.push(spec.currentState.trim());
-    }
-    // Sits next to Current State on purpose: one is what the author says is true today, the other is
-    // what the repo says. Same heading the cloud agent prompt emits, so a handoff reads identically
-    // in either mode.
-    const icBody = implementationContextBody(spec);
-    if (icBody.length) {
-        sections.push('');
-        sections.push('## Implementation Context');
-        sections.push(...icBody);
-    }
-    sections.push(...decisionLines(spec.decisions, '## Decisions & Ruled-Out Alternatives'));
-    if (spec.outcomes?.length) {
-        sections.push('');
-        sections.push('## Outcomes');
-        for (const outcome of spec.outcomes) {
-            sections.push(`- [ ] ${getPriorityLabel(outcome)}${getOutcomeText(outcome)}`);
-        }
-    }
-    if (spec.scope?.inScope?.length || spec.scope?.outOfScope?.length) {
-        sections.push('');
-        sections.push('## Scope');
-        if (spec.scope.inScope?.length) {
-            sections.push('**In scope:**');
-            for (const s of spec.scope.inScope)
-                sections.push(`- ${s}`);
-        }
-        if (spec.scope.outOfScope?.length) {
-            sections.push('**Out of scope:**');
-            for (const s of spec.scope.outOfScope)
-                sections.push(`- ${s}`);
-        }
-    }
-    if (spec.constraints?.length) {
-        sections.push('');
-        sections.push('## Constraints');
-        for (const constraint of spec.constraints) {
-            sections.push(`- ${constraint}`);
-        }
-    }
-    if (spec.edgeCases?.length) {
-        sections.push('');
-        sections.push('## Edge Cases');
-        for (const ec of spec.edgeCases) {
-            sections.push(`- **${ec.scenario}**: ${ec.expectedBehavior}`);
-        }
-    }
-    if (spec.healthMetrics?.length) {
-        sections.push('');
-        sections.push('## Health Metrics');
-        for (const metric of spec.healthMetrics) {
-            sections.push(`- ${metric}`);
-        }
-    }
-    const intentMdChecks = groupVerificationChecks(spec.verification);
-    if (intentMdChecks.length) {
-        sections.push('');
-        sections.push('## Verification');
-        sections.push('_A feedback loop, not just a test list._');
-        for (const g of intentMdChecks) {
-            sections.push(`**${g.label}**:`);
-            for (const c of g.checks)
-                sections.push(`- [ ] ${renderCheckLine(c)}`);
-        }
-    }
-    // `## Confirmations` is emitted LAST so it never sits between the fields a reader is
-    // comparing, and so appending one cannot shift any other section's parse. Derived fields
-    // (assurance, source) are NOT written: anything read from a file is local-unverified.
-    const rawConfirmations = spec.confirmations;
-    const confirmations = Array.isArray(rawConfirmations)
-        ? rawConfirmations
-        : [];
-    // Filter BEFORE emitting the heading: a spec whose only confirmation targets an
-    // unwaivable dimension must not leave an empty `## Confirmations` section behind.
-    const emittable = confirmations.filter((c) => {
-        const dim = String(c.dimension ?? '').toLowerCase();
-        const kind = String(c.kind ?? '').toLowerCase();
-        const by = String(c.by ?? '').toLowerCase();
-        return ['objective', 'outcomes'].includes(dim)
-            && ['confirmed', 'waived'].includes(kind)
-            && ['agent', 'human'].includes(by);
-    });
-    if (emittable.length) {
-        sections.push('');
-        sections.push('## Confirmations');
-        for (const c of emittable) {
-            const dim = String(c.dimension ?? '').toLowerCase();
-            const kind = String(c.kind ?? '').toLowerCase();
-            const by = String(c.by ?? '').toLowerCase();
-            sections.push('');
-            sections.push(`**${dim}** — ${kind} by ${by}`);
-            for (const key of ['actor', 'problem', 'outcome', 'observable', 'reason', 'anchor', 'at']) {
-                const v = c[key];
-                if (typeof v !== 'string' || !v.trim())
-                    continue;
-                // Values are single-line by contract; the writer flattens rather than escaping.
-                sections.push(`- ${key}: ${v.replace(/\s+/g, ' ').trim()}`);
-            }
-        }
-    }
-    sections.push('');
-    return sections.join('\n');
+        origin: opts.origin,
+        authorization: opts.authorization,
+        authorizationNote: opts.authorizationNote,
+    }) + '\n';
 }
 // ============================================================
 // Format: .cursorrules
@@ -40576,30 +40993,10 @@ function spliceConfirmationsSection(original, section) {
     const after = lines.slice(end).join('\n').replace(/^\s*/, '');
     return `${before}\n\n${section.trim()}\n${after ? `\n${after}` : ''}`;
 }
-/** Render confirmation records as the `## Confirmations` section body. */
+/** Render confirmation records as the `## Confirmations` section body. Thin wrapper over the
+ *  shared serializer so the splice path and the full-file write cannot format records differently. */
 function renderConfirmationsSection(records) {
-    const emittable = records.filter((c) => {
-        const dim = String(c.dimension ?? '').toLowerCase();
-        const kind = String(c.kind ?? '').toLowerCase();
-        const by = String(c.by ?? '').toLowerCase();
-        return ['objective', 'outcomes'].includes(dim)
-            && ['confirmed', 'waived'].includes(kind)
-            && ['agent', 'human'].includes(by);
-    });
-    if (!emittable.length)
-        return '';
-    const out = ['## Confirmations'];
-    for (const c of emittable) {
-        out.push('');
-        out.push(`**${String(c.dimension).toLowerCase()}** — ${String(c.kind).toLowerCase()} by ${String(c.by).toLowerCase()}`);
-        for (const key of ['actor', 'problem', 'outcome', 'observable', 'reason', 'anchor', 'at']) {
-            const v = c[key];
-            if (typeof v !== 'string' || !v.trim())
-                continue;
-            out.push(`- ${key}: ${v.replace(/\s+/g, ' ').trim()}`);
-        }
-    }
-    return out.join('\n');
+    return (0, serializeIntentMd_1.renderConfirmationsBody)(records);
 }
 function writeConfirmationRecord(opts) {
     let raw = opts.read();
@@ -40734,6 +41131,9 @@ function readIntentMeta(filePath) {
             status: typeof data.status === 'string' && data.status.trim() ? data.status.trim() : 'draft',
             created: typeof data.created === 'string' ? data.created : undefined,
             specVersion: typeof data.specVersion === 'string' && data.specVersion.trim() ? data.specVersion.trim() : undefined,
+            origin: typeof data.origin === 'string' && data.origin.trim() ? data.origin.trim() : undefined,
+            authorization: typeof data.authorization === 'string' && data.authorization.trim() ? data.authorization.trim() : undefined,
+            authorizationNote: typeof data.authorizationNote === 'string' && data.authorizationNote.trim() ? data.authorizationNote.trim() : undefined,
         };
     }
     catch {
@@ -41798,6 +42198,83 @@ function mergePathmodeSection(existing, section) {
 }
 
 
+/***/ }),
+
+/***/ 581:
+/***/ (function(__unused_webpack_module, exports, __nccwpck_require__) {
+
+"use strict";
+
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", ({ value: true }));
+exports.projectBindingFile = projectBindingFile;
+exports.loadProjectConnection = loadProjectConnection;
+exports.saveProjectConnection = saveProjectConnection;
+exports.ensureProjectMcpConfig = ensureProjectMcpConfig;
+const fs_1 = __importDefault(__nccwpck_require__(9896));
+const os_1 = __importDefault(__nccwpck_require__(857));
+const path_1 = __importDefault(__nccwpck_require__(6928));
+const homeWorkspaceFile = (workspaceId, homeDir = os_1.default.homedir()) => path_1.default.join(homeDir, '.pathmode', 'workspaces', `${workspaceId}.json`);
+function projectBindingFile(cwd = process.cwd()) {
+    return path_1.default.join(cwd, '.pathmode', 'config.json');
+}
+function readJson(filePath) {
+    try {
+        return JSON.parse(fs_1.default.readFileSync(filePath, 'utf8'));
+    }
+    catch {
+        return null;
+    }
+}
+function loadProjectConnection(cwd = process.cwd(), homeDir = os_1.default.homedir()) {
+    const binding = readJson(projectBindingFile(cwd));
+    const workspaceId = typeof binding?.workspaceId === 'string' ? binding.workspaceId.trim() : '';
+    if (!workspaceId)
+        return null;
+    const secret = readJson(homeWorkspaceFile(workspaceId, homeDir));
+    const apiKey = typeof secret?.apiKey === 'string' ? secret.apiKey.trim() : '';
+    if (!apiKey)
+        return null;
+    const apiUrl = typeof binding?.apiUrl === 'string' && binding.apiUrl.trim()
+        ? binding.apiUrl.trim()
+        : (typeof secret?.apiUrl === 'string' && secret.apiUrl.trim() ? secret.apiUrl.trim() : 'https://pathmode.io');
+    return { apiKey, apiUrl, workspaceId };
+}
+function saveProjectConnection(config, cwd = process.cwd(), homeDir = os_1.default.homedir()) {
+    const bindingPath = projectBindingFile(cwd);
+    fs_1.default.mkdirSync(path_1.default.dirname(bindingPath), { recursive: true });
+    fs_1.default.writeFileSync(bindingPath, JSON.stringify({
+        workspaceId: config.workspaceId,
+        apiUrl: config.apiUrl,
+    }, null, 2) + '\n', 'utf8');
+    const secretPath = homeWorkspaceFile(config.workspaceId, homeDir);
+    fs_1.default.mkdirSync(path_1.default.dirname(secretPath), { recursive: true });
+    fs_1.default.writeFileSync(secretPath, JSON.stringify({
+        apiKey: config.apiKey,
+        apiUrl: config.apiUrl,
+    }, null, 2) + '\n', { encoding: 'utf8', mode: 0o600 });
+    try {
+        fs_1.default.chmodSync(secretPath, 0o600);
+    }
+    catch { /* best effort on non-POSIX filesystems */ }
+}
+/** Ensure the repository has a keyless MCP declaration. The credential is resolved
+ * from the project binding at runtime and is never written into a committable file. */
+function ensureProjectMcpConfig(cwd = process.cwd()) {
+    const configPath = path_1.default.join(cwd, '.mcp.json');
+    const existing = fs_1.default.existsSync(configPath) ? readJson(configPath) : {};
+    if (!existing)
+        throw new Error(`${configPath} is not valid JSON; fix it before adopting.`);
+    const servers = existing.mcpServers && typeof existing.mcpServers === 'object'
+        ? existing.mcpServers
+        : {};
+    servers.pathmode = { command: 'npx', args: ['@pathmode/mcp-server'] };
+    fs_1.default.writeFileSync(configPath, JSON.stringify({ ...existing, mcpServers: servers }, null, 2) + '\n', 'utf8');
+}
+
+
 /***/ }),
 
 /***/ 4239:
@@ -41836,6 +42313,9 @@ async function pushSpec(input) {
     let canonicalId;
     let specVersion;
     let sourceUrl;
+    let origin;
+    let authorization;
+    let authorizationNote;
     try {
         // On create the local id travels with the spec. Promotion must not change identity: a
         // keyless author may already have stamped `intent/<uuid>` on a branch, and a new id would
@@ -41863,6 +42343,9 @@ async function pushSpec(input) {
         }
         canonicalId = saved.id || id;
         specVersion = saved.specVersion;
+        origin = saved.origin;
+        authorization = saved.authorization;
+        authorizationNote = saved.authorizationNote;
         sourceUrl = `https://www.pathmode.io/intent/${canonicalId}`;
     }
     catch (e) {
@@ -41876,7 +42359,7 @@ async function pushSpec(input) {
             ...(products ? { products } : {}),
         };
     }
-    input.onIdentitySettled({ canonicalId, specVersion, sourceUrl });
+    input.onIdentitySettled({ canonicalId, specVersion, sourceUrl, origin, authorization, authorizationNote });
     const didNotTravel = [];
     for (const d of input.decisions ?? []) {
         try {
@@ -71463,7 +71946,7 @@ module.exports = /*#__PURE__*/JSON.parse('{"$schema":"http://json-schema.org/dra
 /***/ ((module) => {
 
 "use strict";
-module.exports = /*#__PURE__*/JSON.parse('{"name":"@pathmode/mcp-server","version":"1.18.0","publishConfig":{"access":"public"},"mcpName":"io.github.pathmodeio/mcp-server","description":"Deterministic intent preflight before your agent builds: six calibrated gates, keyless, no model call. Draft and sharpen specs in conversation, or connect a Pathmode workspace to sync intent and evidence across a team.","main":"dist/index.js","bin":{"pathmode-mcp":"dist/index.js"},"files":["dist/","manifest.json","icon.svg","README.md","skills/"],"scripts":{"build":"rm -rf dist && ncc build src/index.ts -o dist","dev":"ts-node src/index.ts","prepublishOnly":"npm run build"},"keywords":["pathmode","mcp","model-context-protocol","claude-code","claude-code-skills","agent-skills","cursor","windsurf","intent-engineering","intent-compiler","ai-agents","product-development","dependency-graph","strategic-planning"],"author":"Pathmode","license":"MIT","type":"commonjs","engines":{"node":">=18.0.0"},"homepage":"https://pathmode.io","dependencies":{"@modelcontextprotocol/sdk":"^1.12.1","gray-matter":"^4.0.3","zod":"^3.24.0"},"devDependencies":{"@types/node":"^25.1.0","@vercel/ncc":"^0.38.4","ts-node":"^10.9.2","typescript":"^5.9.3"}}');
+module.exports = /*#__PURE__*/JSON.parse('{"name":"@pathmode/mcp-server","version":"1.20.0","publishConfig":{"access":"public"},"mcpName":"io.github.pathmodeio/mcp-server","description":"Deterministic intent preflight before your agent builds: six calibrated gates, keyless, no model call. Draft and sharpen specs in conversation, or connect a Pathmode workspace to sync intent and evidence across a team.","main":"dist/index.js","bin":{"pathmode-mcp":"dist/index.js"},"files":["dist/","manifest.json","icon.svg","README.md","skills/"],"scripts":{"build":"rm -rf dist && ncc build src/index.ts -o dist","dev":"ts-node src/index.ts","prepublishOnly":"npm run build"},"keywords":["pathmode","mcp","model-context-protocol","claude-code","claude-code-skills","agent-skills","cursor","windsurf","intent-engineering","intent-compiler","ai-agents","product-development","dependency-graph","strategic-planning"],"author":"Pathmode","license":"MIT","type":"commonjs","engines":{"node":">=18.0.0"},"homepage":"https://pathmode.io","dependencies":{"@modelcontextprotocol/sdk":"^1.12.1","gray-matter":"^4.0.3","zod":"^3.24.0"},"devDependencies":{"@types/node":"^25.1.0","@vercel/ncc":"^0.38.4","ts-node":"^10.9.2","typescript":"^5.9.3"}}');
 
 /***/ })
 
@@ -71573,6 +72056,7 @@ const setup_1 = __nccwpck_require__(8294);
 const measurement_schema_1 = __nccwpck_require__(1635);
 const install_skills_1 = __nccwpck_require__(3783);
 const cli_info_1 = __nccwpck_require__(7198);
+const adopt_1 = __nccwpck_require__(7797);
 // Server version is sourced from package.json so the version reported to MCP
 // clients always matches the published package. ncc statically resolves this
 // require() and inlines the JSON at build time (no runtime fs read).
@@ -71595,6 +72079,12 @@ else if ((0, setup_1.isSetupCommand)()) {
         process.exit(1);
     });
 }
+else if ((0, adopt_1.isAdoptCommand)()) {
+    (0, adopt_1.runAdopt)().then(() => process.exit(0)).catch((err) => {
+        console.error(`\n  ✗ ${err instanceof Error ? err.message : String(err)}\n`);
+        process.exit(1);
+    });
+}
 else if ((0, install_skills_1.isInstallSkillsCommand)()) {
     (0, install_skills_1.runInstallSkills)().then(() => process.exit(0)).catch((err) => {
         console.error(err);
@@ -72932,6 +73422,24 @@ function startMcpServer() {
                     readiness: (0, readiness_1.formatReadinessFrontmatter)(verdict),
                     specVersion: opts.specVersion,
                     source: opts.sourceUrl,
+                    // The gate is carried, never inferred. Two sources, and the order matters:
+                    //
+                    //   - CLOUD: whatever identity just settled to. A v1 create is stamped
+                    //     origin='agent' + pending by the API, so a create that took the file's
+                    //     value (there is none) wrote an UNGATED file for a spec the workspace
+                    //     considers unauthorized. The server is the authority in this mode; it
+                    //     also means a human authorizing in the workspace clears the local banner
+                    //     on the next save instead of leaving a stale one.
+                    //   - LOCAL: the file being replaced, and only on an update. Without it, an
+                    //     agent editing a pending proposal cleared its own gate.
+                    //
+                    // The note follows the same rule, and the distinction that makes it work is
+                    // `undefined` (the server did not speak) versus `null` (the server says there
+                    // is none now). `??` would collapse the two and keep showing a rejection note
+                    // after the reviewer authorized the spec, or after they rewrote the note.
+                    origin: opts.origin !== undefined ? opts.origin : (decision.action === 'update' ? existing?.origin : undefined),
+                    authorization: opts.authorization !== undefined ? opts.authorization : (decision.action === 'update' ? existing?.authorization : undefined),
+                    authorizationNote: opts.authorizationNote !== undefined ? opts.authorizationNote : existing?.authorizationNote,
                 });
                 // Carry existing confirmations across the rewrite. intent_save builds its content from
                 // the incoming spec, which by design has no `confirmations` field (that absence is what