cohorte 2.10.0 → 3.0.0-dev.0

package/dist/chunks/config-DefHA2Lw.mjs

@@ -0,0 +1,96 @@
+import { n as sha256Hex } from "./canonical-C8UxeEmB.mjs";
+import "./src-Cu3TxNob.mjs";
+import { n as createKeyStore, r as createTrustStore } from "./auth-BT5oVp76.mjs";
+import { i as resolveConfig, n as loadConfig } from "./src-DcU4IXMe.mjs";
+import { readFile, writeFile } from "node:fs/promises";
+import { join } from "node:path";
+import { parse, stringify } from "yaml";
+//#region src/commands/config/index.ts
+const config = {
+	verb: "config",
+	async run(ctx, args) {
+		const path = join(ctx.cwd, ".cohorte", "config.yaml");
+		let value;
+		try {
+			value = parse(await readFile(path, "utf8"));
+		} catch (error) {
+			ctx.stdio.stderr.write(`cannot read ${path}: ${String(error)}\n`);
+			return 1;
+		}
+		if (args.subVerb === "validate") {
+			const valid = typeof value === "object" && value !== null && !Array.isArray(value) && value.schemaVersion === 1;
+			ctx.stdio.stdout.write(`${valid ? "valid" : "invalid"}\n`);
+			return valid ? 0 : 1;
+		}
+		if (args.subVerb === "set") {
+			const [key, rawValue] = args.positionals;
+			if (!key || rawValue === void 0 || !value || typeof value !== "object" || Array.isArray(value)) return 2;
+			const next = { ...value };
+			const parts = key.split(".").filter(Boolean);
+			if (parts.length === 0) return 2;
+			let cursor = next;
+			for (const part of parts.slice(0, -1)) {
+				const child = cursor[part];
+				cursor[part] = child && typeof child === "object" && !Array.isArray(child) ? { ...child } : {};
+				cursor = cursor[part];
+			}
+			cursor[parts.at(-1)] = parse(rawValue);
+			await writeFile(path, stringify(next), "utf8");
+			if (args.json) ctx.stdio.stdout.write(`${JSON.stringify(next)}\n`);
+			else ctx.stdio.stdout.write(`updated ${key}\n`);
+			return 0;
+		}
+		if (args.subVerb === "trust") {
+			const home = ctx.env.HOME ?? ctx.cwd;
+			const projectKeyId = sha256Hex(ctx.cwd).slice(0, 24);
+			const keys = createKeyStore({ directory: join(home, ".cohorte", "keys") });
+			const trustStore = createTrustStore({
+				directory: join(home, ".cohorte", "trust"),
+				keys
+			});
+			const loaded = await loadConfig({
+				cwd: ctx.cwd,
+				home
+			});
+			const resolved = await resolveConfig(loaded, {
+				trustStore,
+				projectKeyId
+			});
+			const policySha256 = resolved.status === "untrusted" ? resolved.policySha256 : resolved.trust.policySha256;
+			const loosenedKeys = resolved.status === "untrusted" ? resolved.loosenedKeys : resolved.trust.loosenedKeys;
+			if (policySha256 === void 0) return 1;
+			const flag = args.positionals.find((value) => value.startsWith("--"));
+			if (flag === "--revoke") {
+				const revoked = await trustStore.revoke(projectKeyId);
+				ctx.stdio.stdout.write(`${JSON.stringify({ revoked })}\n`);
+				return 0;
+			}
+			if (flag === "--grant") {
+				const record = await trustStore.grant(projectKeyId, {
+					policySha256,
+					loosenedKeys,
+					grantedBy: ctx.env.USER ?? "cli"
+				});
+				ctx.stdio.stdout.write(`${JSON.stringify(record)}\n`);
+				return 0;
+			}
+			const record = await trustStore.lookup(projectKeyId, policySha256);
+			ctx.stdio.stdout.write(`${JSON.stringify({
+				policySha256,
+				loosenedKeys,
+				trusted: record !== void 0,
+				record: record ?? null
+			})}\n`);
+			return 0;
+		}
+		if (args.subVerb === "get" || args.subVerb === void 0) {
+			ctx.stdio.stdout.write(`${JSON.stringify(value, null, 2)}\n`);
+			return 0;
+		}
+		return 10;
+	}
+};
+//#endregion
+export { config as default };
+
+//# sourceMappingURL=config-DefHA2Lw.mjs.map

package/dist/chunks/config-DefHA2Lw.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"config-DefHA2Lw.mjs","names":[],"sources":["../../../../apps/cli/src/commands/config/index.ts"],"sourcesContent":["// apps/cli/src/commands/config/index.ts — DESIGN §9 verb `config` (PLAN §3 rule 3 \"later units fill\n// stub files that lie inside their owned paths; they never edit ... the registry\"). Wave-0 stub: exits with the\n// documented not-available error (spec 24 `configuration/phase-not-available`); filled by the Wave-4/5\n// unit that owns `apps/cli/src/commands/config/**`.\nimport { readFile, writeFile } from 'node:fs/promises';\nimport { join } from 'node:path';\nimport { sha256Hex } from '@cohorte/base';\nimport { loadConfig, resolveConfig } from '@cohorte/config';\nimport { createKeyStore, createTrustStore } from '@cohorte/security/auth';\nimport { parse, stringify } from 'yaml';\nimport type { CommandModule } from '../../contract/index.ts';\n\nconst config: CommandModule = {\n  verb: 'config',\n  async run(ctx, args) {\n    const path = join(ctx.cwd, '.cohorte', 'config.yaml');\n    let value: unknown;\n    try {\n      value = parse(await readFile(path, 'utf8'));\n    } catch (error) {\n      ctx.stdio.stderr.write(`cannot read ${path}: ${String(error)}\\n`);\n      return 1;\n    }\n    if (args.subVerb === 'validate') {\n      const valid =\n        typeof value === 'object' &&\n        value !== null &&\n        !Array.isArray(value) &&\n        (value as { schemaVersion?: unknown }).schemaVersion === 1;\n      ctx.stdio.stdout.write(`${valid ? 'valid' : 'invalid'}\\n`);\n      return valid ? 0 : 1;\n    }\n    if (args.subVerb === 'set') {\n      const [key, rawValue] = args.positionals;\n      if (!key || rawValue === undefined || !value || typeof value !== 'object' || Array.isArray(value)) return 2;\n      const next: Record<string, unknown> = { ...(value as Record<string, unknown>) };\n      const parts = key.split('.').filter(Boolean);\n      if (parts.length === 0) return 2;\n      let cursor = next;\n      for (const part of parts.slice(0, -1)) {\n        const child = cursor[part];\n        cursor[part] = child && typeof child === 'object' && !Array.isArray(child) ? { ...child } : {};\n        cursor = cursor[part] as Record<string, unknown>;\n      }\n      cursor[parts.at(-1) as string] = parse(rawValue);\n      await writeFile(path, stringify(next), 'utf8');\n      if (args.json) ctx.stdio.stdout.write(`${JSON.stringify(next)}\\n`);\n      else ctx.stdio.stdout.write(`updated ${key}\\n`);\n      return 0;\n    }\n    if (args.subVerb === 'trust') {\n      const home = ctx.env.HOME ?? ctx.cwd;\n      const projectKeyId = sha256Hex(ctx.cwd).slice(0, 24);\n      const keys = createKeyStore({ directory: join(home, '.cohorte', 'keys') });\n      const trustStore = createTrustStore({ directory: join(home, '.cohorte', 'trust'), keys });\n      const loaded = await loadConfig({ cwd: ctx.cwd, home });\n      const resolved = await resolveConfig(loaded, {\n        trustStore,\n        projectKeyId,\n      });\n      const policySha256 = resolved.status === 'untrusted' ? resolved.policySha256 : resolved.trust.policySha256;\n      const loosenedKeys = resolved.status === 'untrusted' ? resolved.loosenedKeys : resolved.trust.loosenedKeys;\n      if (policySha256 === undefined) return 1;\n      const flag = args.positionals.find((value) => value.startsWith('--'));\n      if (flag === '--revoke') {\n        const revoked = await trustStore.revoke(projectKeyId);\n        ctx.stdio.stdout.write(`${JSON.stringify({ revoked })}\\n`);\n        return 0;\n      }\n      if (flag === '--grant') {\n        const record = await trustStore.grant(projectKeyId, {\n          policySha256,\n          loosenedKeys,\n          grantedBy: ctx.env.USER ?? 'cli',\n        });\n        ctx.stdio.stdout.write(`${JSON.stringify(record)}\\n`);\n        return 0;\n      }\n      const record = await trustStore.lookup(projectKeyId, policySha256);\n      ctx.stdio.stdout.write(\n        `${JSON.stringify({ policySha256, loosenedKeys, trusted: record !== undefined, record: record ?? null })}\\n`,\n      );\n      return 0;\n    }\n    if (args.subVerb === 'get' || args.subVerb === undefined) {\n      ctx.stdio.stdout.write(`${JSON.stringify(value, null, 2)}\\n`);\n      return 0;\n    }\n    return 10;\n  },\n};\n\nexport default config;\n"],"mappings":";;;;;;;;AAYA,MAAM,SAAwB;CAC5B,MAAM;CACN,MAAM,IAAI,KAAK,MAAM;EACnB,MAAM,OAAO,KAAK,IAAI,KAAK,YAAY,aAAa;EACpD,IAAI;EACJ,IAAI;GACF,QAAQ,MAAM,MAAM,SAAS,MAAM,MAAM,CAAC;EAC5C,SAAS,OAAO;GACd,IAAI,MAAM,OAAO,MAAM,eAAe,KAAK,IAAI,OAAO,KAAK,EAAE,GAAG;GAChE,OAAO;EACT;EACA,IAAI,KAAK,YAAY,YAAY;GAC/B,MAAM,QACJ,OAAO,UAAU,YACjB,UAAU,QACV,CAAC,MAAM,QAAQ,KAAK,KACnB,MAAsC,kBAAkB;GAC3D,IAAI,MAAM,OAAO,MAAM,GAAG,QAAQ,UAAU,UAAU,GAAG;GACzD,OAAO,QAAQ,IAAI;EACrB;EACA,IAAI,KAAK,YAAY,OAAO;GAC1B,MAAM,CAAC,KAAK,YAAY,KAAK;GAC7B,IAAI,CAAC,OAAO,aAAa,KAAA,KAAa,CAAC,SAAS,OAAO,UAAU,YAAY,MAAM,QAAQ,KAAK,GAAG,OAAO;GAC1G,MAAM,OAAgC,EAAE,GAAI,MAAkC;GAC9E,MAAM,QAAQ,IAAI,MAAM,GAAG,CAAC,CAAC,OAAO,OAAO;GAC3C,IAAI,MAAM,WAAW,GAAG,OAAO;GAC/B,IAAI,SAAS;GACb,KAAK,MAAM,QAAQ,MAAM,MAAM,GAAG,EAAE,GAAG;IACrC,MAAM,QAAQ,OAAO;IACrB,OAAO,QAAQ,SAAS,OAAO,UAAU,YAAY,CAAC,MAAM,QAAQ,KAAK,IAAI,EAAE,GAAG,MAAM,IAAI,CAAC;IAC7F,SAAS,OAAO;GAClB;GACA,OAAO,MAAM,GAAG,EAAE,KAAe,MAAM,QAAQ;GAC/C,MAAM,UAAU,MAAM,UAAU,IAAI,GAAG,MAAM;GAC7C,IAAI,KAAK,MAAM,IAAI,MAAM,OAAO,MAAM,GAAG,KAAK,UAAU,IAAI,EAAE,GAAG;QAC5D,IAAI,MAAM,OAAO,MAAM,WAAW,IAAI,GAAG;GAC9C,OAAO;EACT;EACA,IAAI,KAAK,YAAY,SAAS;GAC5B,MAAM,OAAO,IAAI,IAAI,QAAQ,IAAI;GACjC,MAAM,eAAe,UAAU,IAAI,GAAG,CAAC,CAAC,MAAM,GAAG,EAAE;GACnD,MAAM,OAAO,eAAe,EAAE,WAAW,KAAK,MAAM,YAAY,MAAM,EAAE,CAAC;GACzE,MAAM,aAAa,iBAAiB;IAAE,WAAW,KAAK,MAAM,YAAY,OAAO;IAAG;GAAK,CAAC;GACxF,MAAM,SAAS,MAAM,WAAW;IAAE,KAAK,IAAI;IAAK;GAAK,CAAC;GACtD,MAAM,WAAW,MAAM,cAAc,QAAQ;IAC3C;IACA;GACF,CAAC;GACD,MAAM,eAAe,SAAS,WAAW,cAAc,SAAS,eAAe,SAAS,MAAM;GAC9F,MAAM,eAAe,SAAS,WAAW,cAAc,SAAS,eAAe,SAAS,MAAM;GAC9F,IAAI,iBAAiB,KAAA,GAAW,OAAO;GACvC,MAAM,OAAO,KAAK,YAAY,MAAM,UAAU,MAAM,WAAW,IAAI,CAAC;GACpE,IAAI,SAAS,YAAY;IACvB,MAAM,UAAU,MAAM,WAAW,OAAO,YAAY;IACpD,IAAI,MAAM,OAAO,MAAM,GAAG,KAAK,UAAU,EAAE,QAAQ,CAAC,EAAE,GAAG;IACzD,OAAO;GACT;GACA,IAAI,SAAS,WAAW;IACtB,MAAM,SAAS,MAAM,WAAW,MAAM,cAAc;KAClD;KACA;KACA,WAAW,IAAI,IAAI,QAAQ;IAC7B,CAAC;IACD,IAAI,MAAM,OAAO,MAAM,GAAG,KAAK,UAAU,MAAM,EAAE,GAAG;IACpD,OAAO;GACT;GACA,MAAM,SAAS,MAAM,WAAW,OAAO,cAAc,YAAY;GACjE,IAAI,MAAM,OAAO,MACf,GAAG,KAAK,UAAU;IAAE;IAAc;IAAc,SAAS,WAAW,KAAA;IAAW,QAAQ,UAAU;GAAK,CAAC,EAAE,GAC3G;GACA,OAAO;EACT;EACA,IAAI,KAAK,YAAY,SAAS,KAAK,YAAY,KAAA,GAAW;GACxD,IAAI,MAAM,OAAO,MAAM,GAAG,KAAK,UAAU,OAAO,MAAM,CAAC,EAAE,GAAG;GAC5D,OAAO;EACT;EACA,OAAO;CACT;AACF"}

package/dist/chunks/contract-B0ra2-bm.mjs

@@ -0,0 +1,295 @@
+import { F as EXIT_CODE_BY_CLASS, L as ERROR_CLASSES, N as errorOf, j as CohorteError } from "./src-Cu3TxNob.mjs";
+import "./contract-vYbwYr0Y.mjs";
+import { f as HALTED_STATES, m as SUSPENDED_STATES, r as CONTROLLER_EXIT_CODES } from "./src-s7YRvk0t.mjs";
+//#region src/contract/command-module.ts
+/**
+* The Wave-0 body of every verb (DESIGN §9 "stubbed with a seam" and the plain "not yet built" ones alike): a verb
+* a later wave fills replaces this factory call with a real implementation, never the module's shape.
+*
+* It throws a CLASSIFIED `CohorteError`, not a bare `NotImplemented`: `toErrorInfo` keeps a `CohorteError`'s own
+* code, so the documented `configuration/phase-not-available` (DESIGN §9, exit 10) is what the stub MEANS rather
+* than what `cli.ts`'s unknown-throwable fallback happens to be. `cli.ts`'s fallback is `configuration/unexpected`
+* (DESIGN 2.8 "Unknown throwables -> `<nearest class>/unexpected`"), so a real defect in a filled-in verb can never
+* masquerade as "this phase is not available in this build".
+*/
+function notImplementedCommand(verb) {
+	return {
+		verb,
+		async run(_ctx, _args) {
+			throw new CohorteError(errorOf("configuration/phase-not-available", `the verb \`${verb}\` is not available in this build`));
+		}
+	};
+}
+//#endregion
+//#region src/contract/documents.ts
+const protocolDoc = (name) => ({
+	source: "protocol",
+	name
+});
+const reconcilePlanDoc = {
+	source: "project-model",
+	name: "reconcile-plan"
+};
+/** DESIGN §9 verb semantics: "`cohorte discover` prints the deterministic scan as a Project Model document". */
+const projectModelDoc = {
+	source: "project-model",
+	name: "project-model"
+};
+/** DESIGN 2.3.4's inbox route: every mutating command answers with a `CommandResultDocument`. */
+const commandResult = [protocolDoc("command-result")];
+Object.freeze({
+	status: [protocolDoc("project-status"), protocolDoc("run-state")],
+	inspect: [protocolDoc("inspect")],
+	diff: [protocolDoc("run-diff")],
+	doctor: [protocolDoc("doctor-report")],
+	auth: [protocolDoc("auth-status")],
+	reconcile: [reconcilePlanDoc],
+	discover: [projectModelDoc],
+	run: [protocolDoc("command-result"), protocolDoc("run-state")],
+	resume: commandResult,
+	pause: commandResult,
+	cancel: commandResult,
+	approve: commandResult,
+	deny: commandResult,
+	retry: commandResult,
+	skip: commandResult,
+	shutdown: commandResult,
+	send: commandResult,
+	"run-tool": commandResult
+});
+new Set(SUSPENDED_STATES);
+new Set(HALTED_STATES);
+/** DESIGN 2.3.4 "Controller exit codes: 0 completed · 3 rejected · 4 accepted-but-pending · 2 usage." */
+const CONTROLLER_EXIT_HELP = [
+	{
+		code: CONTROLLER_EXIT_CODES.completed,
+		meaning: "completed"
+	},
+	{
+		code: CONTROLLER_EXIT_CODES.usage,
+		meaning: "usage error"
+	},
+	{
+		code: CONTROLLER_EXIT_CODES.rejected,
+		meaning: "rejected"
+	},
+	{
+		code: CONTROLLER_EXIT_CODES.pending,
+		meaning: "accepted, pending at --wait expiry (not an error: durable inbox)"
+	}
+];
+/** DESIGN 2.8's table, class by class, in spec order. */
+const ERROR_CLASS_EXIT_HELP = ERROR_CLASSES.map((errorClass) => ({
+	code: EXIT_CODE_BY_CLASS[errorClass],
+	meaning: `${errorClass} error`
+}));
+const CANCELLED_EXIT_HELP = {
+	code: 16,
+	meaning: "cancelled"
+};
+/** Rendered into `--help` (PLAN U0.10 test: "controller codes 0/2/3/4 documented in --help"). */
+function formatExitCodesHelp() {
+	const rows = [
+		...CONTROLLER_EXIT_HELP,
+		...ERROR_CLASS_EXIT_HELP,
+		CANCELLED_EXIT_HELP
+	];
+	const width = Math.max(...rows.map((row) => String(row.code).length));
+	return ["Exit codes:", ...rows.map((row) => `  ${String(row.code).padStart(width)}  ${row.meaning}`)].join("\n");
+}
+//#endregion
+//#region src/contract/verbs.ts
+const VERBS = [
+	{
+		name: "init",
+		summary: "Scaffold .cohorte/ for this repository"
+	},
+	{
+		name: "doctor",
+		summary: "Diagnose the installation, configuration and toolchain",
+		json: true
+	},
+	{
+		name: "discover",
+		summary: "Print the deterministic project scan (no write)",
+		json: true
+	},
+	{
+		name: "run",
+		summary: "Start a pipeline run",
+		commandType: "start",
+		json: true
+	},
+	{
+		name: "status",
+		summary: "Show a run, or the project, status",
+		commandType: "status",
+		json: true
+	},
+	{
+		name: "inspect",
+		summary: "Inspect one agent, context, approval, effect, snapshot, lock, diff or artifact",
+		commandType: "inspect",
+		json: true
+	},
+	{
+		name: "resume",
+		summary: "Resume a suspended run",
+		commandType: "resume",
+		json: true
+	},
+	{
+		name: "pause",
+		summary: "Pause an active run",
+		commandType: "pause",
+		json: true
+	},
+	{
+		name: "cancel",
+		summary: "Cancel a run",
+		commandType: "cancel",
+		json: true
+	},
+	{
+		name: "shutdown",
+		summary: "Ask the detached host to shut down gracefully",
+		commandType: "shutdown",
+		json: true
+	},
+	{
+		name: "approve",
+		summary: "Approve a pending approval request",
+		commandType: "approve",
+		json: true
+	},
+	{
+		name: "deny",
+		summary: "Deny a pending approval request",
+		commandType: "deny",
+		json: true
+	},
+	{
+		name: "retry",
+		summary: "Retry a phase or an agent",
+		commandType: "retry",
+		json: true
+	},
+	{
+		name: "skip",
+		summary: "Skip a phase (only if policy.skip lists it)",
+		commandType: "skip",
+		json: true
+	},
+	{
+		name: "logs",
+		summary: "Print durable run events"
+	},
+	{
+		name: "tail",
+		summary: "Follow a run (durable + ephemeral events)",
+		commandType: "tail"
+	},
+	{
+		name: "diff",
+		summary: "Show the run diff for a surface",
+		json: true
+	},
+	{
+		name: "review",
+		summary: "Start a review-profile run over a ref range or a prior run"
+	},
+	{
+		name: "fix",
+		summary: "Retry a run's FIX phase"
+	},
+	{
+		name: "ship",
+		summary: "Show and resolve the pending ship approval"
+	},
+	{
+		name: "auth",
+		summary: "Manage provider authentication",
+		subVerbs: [
+			"login",
+			"status",
+			"logout"
+		],
+		json: true
+	},
+	{
+		name: "providers",
+		summary: "List or test configured providers",
+		subVerbs: ["list", "test"]
+	},
+	{
+		name: "models",
+		summary: "List available models",
+		subVerbs: ["list"]
+	},
+	{
+		name: "config",
+		summary: "Read, write, validate or trust the project configuration",
+		subVerbs: [
+			"get",
+			"set",
+			"validate",
+			"trust"
+		]
+	},
+	{
+		name: "migrate",
+		summary: "Check or apply state-store migrations"
+	},
+	{
+		name: "reconcile",
+		summary: "Plan the project configuration against the discovered state",
+		commandType: "reconcile",
+		json: true
+	},
+	{
+		name: "spec",
+		summary: "Validate or freeze a human-written spec",
+		subVerbs: ["validate", "freeze"]
+	},
+	{
+		name: "policy",
+		summary: "Explain the effective security policy",
+		subVerbs: ["explain"]
+	},
+	{
+		name: "gc",
+		summary: "Garbage-collect worktrees, spools and old runs"
+	},
+	{
+		name: "update",
+		summary: "Check for a newer pinned install (offline, --check only in V3.0)"
+	},
+	{
+		name: "brainstorm",
+		summary: "Not available in V3.0 (reserved verb id, DESIGN §9)"
+	},
+	{
+		name: "run-tool",
+		summary: "Run one tool directly (admin; policy.admin.runTool)",
+		commandType: "run-tool",
+		json: true
+	},
+	{
+		name: "send",
+		summary: "Send text to a running agent (policy.steer.enabled)",
+		commandType: "agent.send",
+		json: true
+	},
+	{
+		name: "__host",
+		summary: "Internal: run the detached host in-process",
+		hidden: true
+	}
+];
+new Map(VERBS.map((verb) => [verb.name, verb]));
+VERBS.map((verb) => verb.name);
+Object.freeze(Object.fromEntries(VERBS.filter((verb) => verb.commandType !== void 0).map((verb) => [verb.commandType, verb.name])));
+//#endregion
+export { formatExitCodesHelp as n, notImplementedCommand as r, VERBS as t };
+
+//# sourceMappingURL=contract-B0ra2-bm.mjs.map

package/dist/chunks/contract-B0ra2-bm.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"contract-B0ra2-bm.mjs","names":[],"sources":["../../../../apps/cli/src/contract/command-module.ts","../../../../apps/cli/src/contract/documents.ts","../../../../apps/cli/src/contract/exit-codes.ts","../../../../apps/cli/src/contract/verbs.ts"],"sourcesContent":["// apps/cli/src/contract/command-module.ts — DESIGN 10.1 rule 3 \"every barrel entry is a live export\": each verb's\n// `commands/<verb>/index.ts` implements `CommandModule`. Wave 0 fills every one with `notImplementedCommand` (the\n// documented not-available error, spec 24 `configuration/phase-not-available`); later waves replace the body,\n// never the shape — `cli.ts` and `lazy.ts` never change to accommodate a filled-in verb.\nimport { CohorteError, errorOf } from '@cohorte/base';\nimport type { CliContext } from './context.ts';\n\n/** What `cli.ts` hands a module after commander parsed the line: positionals, options, and the JSON flag. */\nexport interface CommandArgs {\n  /**\n   * Every token commander did not consume, IN ORDER — which in V3.0 means every flag a verb defines for itself:\n   * `cohorte run spec-1 --wait 8 --detach` arrives as `['spec-1', '--wait', '8', '--detach']`. A verb module parses\n   * its own flags from here.\n   */\n  readonly positionals: readonly string[];\n  /**\n   * In V3.0 this carries ONLY `json`. The registry is frozen (PLAN §3 rule 3) and `cli.ts` registers no option but\n   * `--json`, on the verbs that publish a document; with `allowUnknownOption(true)` every other flag is left\n   * unparsed in `positionals`. So `args.options.wait` / `args.options.check` are ALWAYS `undefined` — read\n   * `positionals`. The map is kept open (rather than typed `{ json?: boolean }`) because a post-3.0 registry\n   * amendment that declares a real option is a MINOR, not a breaking change to this contract.\n   */\n  readonly options: Readonly<Record<string, unknown>>;\n  /** Set when the verb has DESIGN §9 sub-verbs (`config get`, `auth login`, ...): the one commander matched. */\n  readonly subVerb?: string;\n  readonly json: boolean;\n}\n\nexport interface CommandModule {\n  readonly verb: string;\n  /**\n   * Runs the verb; returns the process exit code (DESIGN 2.8 / 2.3.4). Throwing is equivalent to returning the\n   * class exit code of `toErrorInfo(thrown, …)`: `cli.ts` converts every throw at the boundary, so a module is\n   * free to throw a `CohorteError`, a `NotImplemented`, or let an unexpected error surface — nothing here writes to\n   * `ctx.stdio` on error, `cli.ts` alone owns the spec-21 `cause / impact / run / next action / exit code` format.\n   */\n  run(ctx: CliContext, args: CommandArgs): Promise<number>;\n}\n\n/**\n * The Wave-0 body of every verb (DESIGN §9 \"stubbed with a seam\" and the plain \"not yet built\" ones alike): a verb\n * a later wave fills replaces this factory call with a real implementation, never the module's shape.\n *\n * It throws a CLASSIFIED `CohorteError`, not a bare `NotImplemented`: `toErrorInfo` keeps a `CohorteError`'s own\n * code, so the documented `configuration/phase-not-available` (DESIGN §9, exit 10) is what the stub MEANS rather\n * than what `cli.ts`'s unknown-throwable fallback happens to be. `cli.ts`'s fallback is `configuration/unexpected`\n * (DESIGN 2.8 \"Unknown throwables -> `<nearest class>/unexpected`\"), so a real defect in a filled-in verb can never\n * masquerade as \"this phase is not available in this build\".\n */\nexport function notImplementedCommand(verb: string): CommandModule {\n  return {\n    verb,\n    // `ctx`/`args` intentionally unused: the Wave-0 stub never touches a port (DESIGN 1.3).\n    async run(_ctx, _args): Promise<number> {\n      throw new CohorteError(\n        errorOf('configuration/phase-not-available', `the verb \\`${verb}\\` is not available in this build`),\n      );\n    },\n  };\n}\n","// apps/cli/src/contract/documents.ts — DESIGN 2.3.5 \"one [S] document per --json output\". `JSON_OUTPUTS` is the\n// map a Wave-4 command unit's `--json validates` test reads: verb -> the published document(s) that verb's\n// `--json` can print, each resolvable to a real schema in the protocol, project-model or security contract (PLAN\n// U0.10 test list, 6th row).\n\nimport { ProjectModel, ReconcilePlan } from '@cohorte/project-model/contract';\nimport { DOCUMENTS, type DocumentName } from '@cohorte/protocol';\nimport type { TSchema } from 'typebox';\n\n/** The two project-model documents a `--json` verb may print (DESIGN §9: `reconcile --plan`, `discover`). */\nexport const PROJECT_MODEL_DOCUMENT_NAMES = ['reconcile-plan', 'project-model'] as const;\nexport type ProjectModelDocumentName = (typeof PROJECT_MODEL_DOCUMENT_NAMES)[number];\n\nexport type DocumentRef =\n  | { readonly source: 'protocol'; readonly name: DocumentName }\n  | { readonly source: 'project-model'; readonly name: ProjectModelDocumentName };\n\n/** Resolves a `DocumentRef` to its real schema; throws when the referenced contract has no such entry (a drift\n * guard, not a runtime path: every entry of `JSON_OUTPUTS` below is checked against this at test time). */\nexport function resolveDocumentSchema(ref: DocumentRef): TSchema {\n  if (ref.source === 'protocol') {\n    const schema = DOCUMENTS[ref.name];\n    if (!schema) throw new RangeError(`resolveDocumentSchema: no protocol document named ${ref.name}`);\n    return schema;\n  }\n  // A plain lookup, not a `switch` with an unreachable default: the ref may come from a Wave-4 unit's data, so an\n  // unknown name must throw at run time and not only fail to typecheck.\n  // No cast: `TUnsafe<T> extends TSchema`, and there is exactly one typebox install (the `pnpm-workspace.yaml`\n  // override pins 1.3.7), so `@cohorte/project-model/contract`'s schemas ARE `TSchema`s here. If this ever stops\n  // compiling, the cause is a second typebox identity in the graph — a real defect to report, not to cast away.\n  const projectModelSchemas: Record<ProjectModelDocumentName, TSchema> = {\n    'reconcile-plan': ReconcilePlan,\n    'project-model': ProjectModel,\n  };\n  const schema = projectModelSchemas[ref.name];\n  if (!schema) throw new RangeError(`resolveDocumentSchema: no project-model document named ${String(ref.name)}`);\n  return schema;\n}\n\nconst protocolDoc = (name: DocumentName): DocumentRef => ({ source: 'protocol', name });\nconst reconcilePlanDoc: DocumentRef = { source: 'project-model', name: 'reconcile-plan' };\n/** DESIGN §9 verb semantics: \"`cohorte discover` prints the deterministic scan as a Project Model document\". */\nconst projectModelDoc: DocumentRef = { source: 'project-model', name: 'project-model' };\n/** DESIGN 2.3.4's inbox route: every mutating command answers with a `CommandResultDocument`. */\nconst commandResult: readonly DocumentRef[] = [protocolDoc('command-result')];\n\n/**\n * Keyed by CLI verb (not by `CommandType`: read-only verbs publish a document with no command behind them).\n *\n * The key set is exactly `{ verb.name | verb.json }` of `contract/verbs.ts`, and `cli.ts` registers `--json` only\n * for those verbs — `apps/cli/test/registry/json-outputs.test.ts` pins both directions. `logs` and `tail` are\n * deliberately absent: DESIGN 4.7 gives an observer `--format=line|json` over an NDJSON *stream* of event\n * envelopes, not a single `--json` document (request U0.10 R1 asks U0.G to confirm that reading).\n */\nexport const JSON_OUTPUTS: Readonly<Record<string, readonly DocumentRef[]>> = Object.freeze({\n  // `status <run>` -> run-state; `status` (no run) -> project-status (DESIGN 2.3.4 \"no runId => ProjectStatusDocument\")\n  status: [protocolDoc('project-status'), protocolDoc('run-state')],\n  inspect: [protocolDoc('inspect')],\n  diff: [protocolDoc('run-diff')],\n  doctor: [protocolDoc('doctor-report')],\n  auth: [protocolDoc('auth-status')],\n  reconcile: [reconcilePlanDoc],\n  discover: [projectModelDoc],\n  // `run` drives `start`; its `--wait`/`--json` prints the same run-state an observer would (DESIGN 4.7).\n  run: [protocolDoc('command-result'), protocolDoc('run-state')],\n  resume: commandResult,\n  pause: commandResult,\n  cancel: commandResult,\n  approve: commandResult,\n  deny: commandResult,\n  retry: commandResult,\n  skip: commandResult,\n  shutdown: commandResult,\n  send: commandResult,\n  'run-tool': commandResult,\n});\n","// apps/cli/src/contract/exit-codes.ts — DESIGN 2.8 \"Exit codes of a process that waits for a run\" + DESIGN 4.7 +\n// the controller codes of DESIGN 2.3.4 (`CONTROLLER_EXIT_CODES`). Total over `ErrorClass` because it is built\n// directly from `@cohorte/base`'s `EXIT_CODE_BY_CLASS`, which is itself total (a `satisfies Record<ErrorClass, …>`\n// literal): the totality test in `apps/cli/test/registry` checks that equality holds, it does not re-derive it.\nimport { ERROR_CLASSES, type ErrorClass, EXIT_CODE_BY_CLASS } from '@cohorte/base';\nimport { CONTROLLER_EXIT_CODES, HALTED_STATES, type PipelineState, SUSPENDED_STATES } from '@cohorte/protocol';\n\nexport { CONTROLLER_EXIT_CODES, EXIT_CODE_BY_CLASS };\n\n/** DESIGN 4.7 \"4 on a suspended state\" / DESIGN 2.3.4 \"4 accepted-but-pending at --wait expiry (not an error)\". */\nexport const SUSPENDED_EXIT_CODE = 4;\n/** DESIGN 2.8 \"16 on CANCELLED\" (shares the `conflict` class code, but CANCELLED is not itself an error). */\nexport const CANCELLED_EXIT_CODE = 16;\nexport const COMPLETED_EXIT_CODE = 0;\n\nconst SUSPENDED = new Set<string>(SUSPENDED_STATES);\nconst HALTED = new Set<string>(HALTED_STATES);\n\n/**\n * DESIGN 2.8 / 4.7: \"an observer started by `run`, or any `--wait`, exits 0 on COMPLETED, the class code of\n * `run.lastError` on FAILED/BLOCKED, 4 on a suspended state, 16 on CANCELLED.\" `lastErrorClass` is required\n * exactly when `state` is FAILED or BLOCKED (DESIGN 2.8: every halted run carries a `lastError`).\n */\nexport function waitExitCode(state: PipelineState, lastErrorClass?: ErrorClass): number {\n  if (state === 'COMPLETED') return COMPLETED_EXIT_CODE;\n  if (state === 'CANCELLED') return CANCELLED_EXIT_CODE;\n  if (SUSPENDED.has(state)) return SUSPENDED_EXIT_CODE;\n  if (HALTED.has(state)) {\n    if (!lastErrorClass) throw new RangeError(`waitExitCode: ${state} requires lastErrorClass (DESIGN 2.8)`);\n    return EXIT_CODE_BY_CLASS[lastErrorClass];\n  }\n  // IDLE and every ACTIVE_PIPELINE_STATE are not terminal/suspended: a waiter never observes them as a final state.\n  throw new RangeError(`waitExitCode: ${state} is not a terminal or suspended state (DESIGN 2.8)`);\n}\n\nexport interface ExitCodeHelpRow {\n  readonly code: number;\n  readonly meaning: string;\n}\n\n/** DESIGN 2.3.4 \"Controller exit codes: 0 completed · 3 rejected · 4 accepted-but-pending · 2 usage.\" */\nexport const CONTROLLER_EXIT_HELP: readonly ExitCodeHelpRow[] = [\n  { code: CONTROLLER_EXIT_CODES.completed, meaning: 'completed' },\n  { code: CONTROLLER_EXIT_CODES.usage, meaning: 'usage error' },\n  { code: CONTROLLER_EXIT_CODES.rejected, meaning: 'rejected' },\n  { code: CONTROLLER_EXIT_CODES.pending, meaning: 'accepted, pending at --wait expiry (not an error: durable inbox)' },\n];\n\n/** DESIGN 2.8's table, class by class, in spec order. */\nexport const ERROR_CLASS_EXIT_HELP: readonly ExitCodeHelpRow[] = ERROR_CLASSES.map((errorClass) => ({\n  code: EXIT_CODE_BY_CLASS[errorClass],\n  meaning: `${errorClass} error`,\n}));\n\nexport const CANCELLED_EXIT_HELP: ExitCodeHelpRow = { code: CANCELLED_EXIT_CODE, meaning: 'cancelled' };\n\n/** Rendered into `--help` (PLAN U0.10 test: \"controller codes 0/2/3/4 documented in --help\"). */\nexport function formatExitCodesHelp(): string {\n  const rows = [...CONTROLLER_EXIT_HELP, ...ERROR_CLASS_EXIT_HELP, CANCELLED_EXIT_HELP];\n  const width = Math.max(...rows.map((row) => String(row.code).length));\n  const lines = rows.map((row) => `  ${String(row.code).padStart(width)}  ${row.meaning}`);\n  return ['Exit codes:', ...lines].join('\\n');\n}\n","// apps/cli/src/contract/verbs.ts — DESIGN §9 \"V3.0 scope cut\" CLI row + the verb-semantics paragraph, and DESIGN\n// 2.3.4 \"every command type has a CLI verb, because one-shot CLI spawns are the only V3.0 transport\". `cli.ts`\n// builds the whole commander tree from this table and NOTHING ELSE (PLAN §3 rule 3: \"cli.ts pre-registers every\n// verb against commands/<verb>/index.ts\"); a later wave fills a verb's module, never this table's shape.\nimport type { CommandType } from '@cohorte/protocol';\n\nexport interface VerbSpec {\n  readonly name: string;\n  readonly summary: string;\n  /** DESIGN §9: `config get|set|validate|trust`, `auth login|status|logout`, `providers list|test`, ... */\n  readonly subVerbs?: readonly string[];\n  /** Not listed in `cohorte --help` (the `__host` internal entry point, DESIGN 4.7). */\n  readonly hidden?: boolean;\n  /**\n   * This verb accepts `--json` and publishes a document for it (DESIGN 2.3.5). Set exactly on the verbs that have\n   * a `JSON_OUTPUTS` entry — `cli.ts` registers the `--json` option only for those, and\n   * `apps/cli/test/registry/json-outputs.test.ts` pins the two sides equal in BOTH directions, so a verb can never\n   * be silently flagged `--json` with no document behind it.\n   */\n  readonly json?: boolean;\n  /** The `@cohorte/protocol` `CommandType` this verb drives 1:1, when it drives exactly one (DESIGN 2.3.4). */\n  readonly commandType?: CommandType;\n}\n\nexport const VERBS: readonly VerbSpec[] = [\n  { name: 'init', summary: 'Scaffold .cohorte/ for this repository' },\n  { name: 'doctor', summary: 'Diagnose the installation, configuration and toolchain', json: true },\n  { name: 'discover', summary: 'Print the deterministic project scan (no write)', json: true },\n  { name: 'run', summary: 'Start a pipeline run', commandType: 'start', json: true },\n  { name: 'status', summary: 'Show a run, or the project, status', commandType: 'status', json: true },\n  {\n    name: 'inspect',\n    summary: 'Inspect one agent, context, approval, effect, snapshot, lock, diff or artifact',\n    commandType: 'inspect',\n    json: true,\n  },\n  { name: 'resume', summary: 'Resume a suspended run', commandType: 'resume', json: true },\n  { name: 'pause', summary: 'Pause an active run', commandType: 'pause', json: true },\n  { name: 'cancel', summary: 'Cancel a run', commandType: 'cancel', json: true },\n  { name: 'shutdown', summary: 'Ask the detached host to shut down gracefully', commandType: 'shutdown', json: true },\n  { name: 'approve', summary: 'Approve a pending approval request', commandType: 'approve', json: true },\n  { name: 'deny', summary: 'Deny a pending approval request', commandType: 'deny', json: true },\n  { name: 'retry', summary: 'Retry a phase or an agent', commandType: 'retry', json: true },\n  { name: 'skip', summary: 'Skip a phase (only if policy.skip lists it)', commandType: 'skip', json: true },\n  { name: 'logs', summary: 'Print durable run events' },\n  { name: 'tail', summary: 'Follow a run (durable + ephemeral events)', commandType: 'tail' },\n  { name: 'diff', summary: 'Show the run diff for a surface', json: true },\n  { name: 'review', summary: 'Start a review-profile run over a ref range or a prior run' },\n  { name: 'fix', summary: \"Retry a run's FIX phase\" },\n  { name: 'ship', summary: 'Show and resolve the pending ship approval' },\n  { name: 'auth', summary: 'Manage provider authentication', subVerbs: ['login', 'status', 'logout'], json: true },\n  { name: 'providers', summary: 'List or test configured providers', subVerbs: ['list', 'test'] },\n  { name: 'models', summary: 'List available models', subVerbs: ['list'] },\n  {\n    name: 'config',\n    summary: 'Read, write, validate or trust the project configuration',\n    subVerbs: ['get', 'set', 'validate', 'trust'],\n  },\n  { name: 'migrate', summary: 'Check or apply state-store migrations' },\n  {\n    name: 'reconcile',\n    summary: 'Plan the project configuration against the discovered state',\n    commandType: 'reconcile',\n    json: true,\n  },\n  { name: 'spec', summary: 'Validate or freeze a human-written spec', subVerbs: ['validate', 'freeze'] },\n  { name: 'policy', summary: 'Explain the effective security policy', subVerbs: ['explain'] },\n  { name: 'gc', summary: 'Garbage-collect worktrees, spools and old runs' },\n  {\n    name: 'update',\n    // DESIGN §9 spells it as a FLAG, `update --check`, not a sub-verb: the Wave-5 unit that fills\n    // `commands/update/index.ts` reads `--check` from `args.options`/`args.positionals` like every other verb flag.\n    summary: 'Check for a newer pinned install (offline, --check only in V3.0)',\n  },\n  { name: 'brainstorm', summary: 'Not available in V3.0 (reserved verb id, DESIGN §9)' },\n  {\n    name: 'run-tool',\n    summary: 'Run one tool directly (admin; policy.admin.runTool)',\n    commandType: 'run-tool',\n    json: true,\n  },\n  {\n    name: 'send',\n    summary: 'Send text to a running agent (policy.steer.enabled)',\n    commandType: 'agent.send',\n    json: true,\n  },\n  { name: '__host', summary: 'Internal: run the detached host in-process', hidden: true },\n];\n\nconst BY_NAME = new Map(VERBS.map((verb) => [verb.name, verb]));\n\nexport function findVerb(name: string): VerbSpec | undefined {\n  return BY_NAME.get(name);\n}\n\nexport const VERB_NAMES: readonly string[] = VERBS.map((verb) => verb.name);\n\n/** DESIGN 2.3.4: every `CommandType` has exactly one driving verb. Built from `VERBS`, so it can never drift. */\nexport const COMMAND_TYPE_TO_VERB: Readonly<Record<CommandType, string>> = Object.freeze(\n  Object.fromEntries(\n    VERBS.filter((verb): verb is VerbSpec & { commandType: CommandType } => verb.commandType !== undefined).map(\n      (verb) => [verb.commandType, verb.name],\n    ),\n  ) as Record<CommandType, string>,\n);\n"],"mappings":";;;;;;;;;;;;;;AAiDA,SAAgB,sBAAsB,MAA6B;CACjE,OAAO;EACL;EAEA,MAAM,IAAI,MAAM,OAAwB;GACtC,MAAM,IAAI,aACR,QAAQ,qCAAqC,cAAc,KAAK,kCAAkC,CACpG;EACF;CACF;AACF;;;ACpBA,MAAM,eAAe,UAAqC;CAAE,QAAQ;CAAY;AAAK;AACrF,MAAM,mBAAgC;CAAE,QAAQ;CAAiB,MAAM;AAAiB;;AAExF,MAAM,kBAA+B;CAAE,QAAQ;CAAiB,MAAM;AAAgB;;AAEtF,MAAM,gBAAwC,CAAC,YAAY,gBAAgB,CAAC;AAUE,OAAO,OAAO;CAE1F,QAAQ,CAAC,YAAY,gBAAgB,GAAG,YAAY,WAAW,CAAC;CAChE,SAAS,CAAC,YAAY,SAAS,CAAC;CAChC,MAAM,CAAC,YAAY,UAAU,CAAC;CAC9B,QAAQ,CAAC,YAAY,eAAe,CAAC;CACrC,MAAM,CAAC,YAAY,aAAa,CAAC;CACjC,WAAW,CAAC,gBAAgB;CAC5B,UAAU,CAAC,eAAe;CAE1B,KAAK,CAAC,YAAY,gBAAgB,GAAG,YAAY,WAAW,CAAC;CAC7D,QAAQ;CACR,OAAO;CACP,QAAQ;CACR,SAAS;CACT,MAAM;CACN,OAAO;CACP,MAAM;CACN,UAAU;CACV,MAAM;CACN,YAAY;AACd,CAAC;AC5DiB,IAAI,IAAY,gBAAgB;AACnC,IAAI,IAAY,aAAa;;AAyB5C,MAAa,uBAAmD;CAC9D;EAAE,MAAM,sBAAsB;EAAW,SAAS;CAAY;CAC9D;EAAE,MAAM,sBAAsB;EAAO,SAAS;CAAc;CAC5D;EAAE,MAAM,sBAAsB;EAAU,SAAS;CAAW;CAC5D;EAAE,MAAM,sBAAsB;EAAS,SAAS;CAAmE;AACrH;;AAGA,MAAa,wBAAoD,cAAc,KAAK,gBAAgB;CAClG,MAAM,mBAAmB;CACzB,SAAS,GAAG,WAAW;AACzB,EAAE;AAEF,MAAa,sBAAuC;CAAE,MAAA;CAA2B,SAAS;AAAY;;AAGtG,SAAgB,sBAA8B;CAC5C,MAAM,OAAO;EAAC,GAAG;EAAsB,GAAG;EAAuB;CAAmB;CACpF,MAAM,QAAQ,KAAK,IAAI,GAAG,KAAK,KAAK,QAAQ,OAAO,IAAI,IAAI,CAAC,CAAC,MAAM,CAAC;CAEpE,OAAO,CAAC,eAAe,GADT,KAAK,KAAK,QAAQ,KAAK,OAAO,IAAI,IAAI,CAAC,CAAC,SAAS,KAAK,EAAE,IAAI,IAAI,SAChD,CAAC,CAAC,CAAC,KAAK,IAAI;AAC5C;;;ACtCA,MAAa,QAA6B;CACxC;EAAE,MAAM;EAAQ,SAAS;CAAyC;CAClE;EAAE,MAAM;EAAU,SAAS;EAA0D,MAAM;CAAK;CAChG;EAAE,MAAM;EAAY,SAAS;EAAmD,MAAM;CAAK;CAC3F;EAAE,MAAM;EAAO,SAAS;EAAwB,aAAa;EAAS,MAAM;CAAK;CACjF;EAAE,MAAM;EAAU,SAAS;EAAsC,aAAa;EAAU,MAAM;CAAK;CACnG;EACE,MAAM;EACN,SAAS;EACT,aAAa;EACb,MAAM;CACR;CACA;EAAE,MAAM;EAAU,SAAS;EAA0B,aAAa;EAAU,MAAM;CAAK;CACvF;EAAE,MAAM;EAAS,SAAS;EAAuB,aAAa;EAAS,MAAM;CAAK;CAClF;EAAE,MAAM;EAAU,SAAS;EAAgB,aAAa;EAAU,MAAM;CAAK;CAC7E;EAAE,MAAM;EAAY,SAAS;EAAiD,aAAa;EAAY,MAAM;CAAK;CAClH;EAAE,MAAM;EAAW,SAAS;EAAsC,aAAa;EAAW,MAAM;CAAK;CACrG;EAAE,MAAM;EAAQ,SAAS;EAAmC,aAAa;EAAQ,MAAM;CAAK;CAC5F;EAAE,MAAM;EAAS,SAAS;EAA6B,aAAa;EAAS,MAAM;CAAK;CACxF;EAAE,MAAM;EAAQ,SAAS;EAA+C,aAAa;EAAQ,MAAM;CAAK;CACxG;EAAE,MAAM;EAAQ,SAAS;CAA2B;CACpD;EAAE,MAAM;EAAQ,SAAS;EAA6C,aAAa;CAAO;CAC1F;EAAE,MAAM;EAAQ,SAAS;EAAmC,MAAM;CAAK;CACvE;EAAE,MAAM;EAAU,SAAS;CAA6D;CACxF;EAAE,MAAM;EAAO,SAAS;CAA0B;CAClD;EAAE,MAAM;EAAQ,SAAS;CAA6C;CACtE;EAAE,MAAM;EAAQ,SAAS;EAAkC,UAAU;GAAC;GAAS;GAAU;EAAQ;EAAG,MAAM;CAAK;CAC/G;EAAE,MAAM;EAAa,SAAS;EAAqC,UAAU,CAAC,QAAQ,MAAM;CAAE;CAC9F;EAAE,MAAM;EAAU,SAAS;EAAyB,UAAU,CAAC,MAAM;CAAE;CACvE;EACE,MAAM;EACN,SAAS;EACT,UAAU;GAAC;GAAO;GAAO;GAAY;EAAO;CAC9C;CACA;EAAE,MAAM;EAAW,SAAS;CAAwC;CACpE;EACE,MAAM;EACN,SAAS;EACT,aAAa;EACb,MAAM;CACR;CACA;EAAE,MAAM;EAAQ,SAAS;EAA2C,UAAU,CAAC,YAAY,QAAQ;CAAE;CACrG;EAAE,MAAM;EAAU,SAAS;EAAyC,UAAU,CAAC,SAAS;CAAE;CAC1F;EAAE,MAAM;EAAM,SAAS;CAAiD;CACxE;EACE,MAAM;EAGN,SAAS;CACX;CACA;EAAE,MAAM;EAAc,SAAS;CAAsD;CACrF;EACE,MAAM;EACN,SAAS;EACT,aAAa;EACb,MAAM;CACR;CACA;EACE,MAAM;EACN,SAAS;EACT,aAAa;EACb,MAAM;CACR;CACA;EAAE,MAAM;EAAU,SAAS;EAA8C,QAAQ;CAAK;AACxF;AAEgB,IAAI,IAAI,MAAM,KAAK,SAAS,CAAC,KAAK,MAAM,IAAI,CAAC,CAAC;AAMjB,MAAM,KAAK,SAAS,KAAK,IAAI;AAGC,OAAO,OAChF,OAAO,YACL,MAAM,QAAQ,SAA0D,KAAK,gBAAgB,KAAA,CAAS,CAAC,CAAC,KACrG,SAAS,CAAC,KAAK,aAAa,KAAK,IAAI,CACxC,CACF,CACF"}

package/dist/chunks/contract-vYbwYr0Y.mjs

@@ -0,0 +1,123 @@
+import { S as IsoInstant, T as Sha256, x as ID_PATTERN } from "./src-Cu3TxNob.mjs";
+import { Type } from "typebox";
+//#region ../../packages/project-model/src/contract.ts
+const closed = { additionalProperties: false };
+const oneOf = (values) => Type.Unsafe({
+	type: "string",
+	enum: [...values]
+});
+/** Spec 13: every field of the model, and every file of `.cohorte/`, has exactly one class. */
+const FIELD_CLASSES = [
+	"human",
+	"generated",
+	"derived",
+	"observed",
+	"mixed"
+];
+/** Spec 13: what the diff engine must tell apart. */
+const DIFF_CLASSES = [
+	"absent",
+	"expected-change",
+	"human-change",
+	"conflict",
+	"potential-deletion",
+	"unknown"
+];
+const strings = () => Type.Array(Type.String());
+const ProvenanceSchema = Type.Object({
+	detector: Type.String({ minLength: 1 }),
+	sources: strings(),
+	confidence: Type.Optional(Type.Number({
+		minimum: 0,
+		maximum: 1
+	}))
+}, closed);
+const field = (value) => Type.Object({
+	value,
+	class: oneOf(FIELD_CLASSES),
+	provenance: ProvenanceSchema
+}, closed);
+const nullableString = () => Type.Union([Type.String(), Type.Null()]);
+Type.Unsafe(Type.Object({
+	schemaVersion: Type.Literal(1),
+	project: Type.Object({
+		id: field(Type.String({ pattern: ID_PATTERN })),
+		root: field(Type.String())
+	}, closed),
+	stack: Type.Object({
+		languages: field(strings()),
+		packageManager: field(nullableString()),
+		frameworks: field(strings())
+	}, closed),
+	surfaces: Type.Record(Type.String({ pattern: ID_PATTERN }), Type.Object({ paths: field(strings()) }, closed)),
+	commands: Type.Record(Type.String(), field(Type.Array(Type.String(), { minItems: 1 }))),
+	testStrategy: field(Type.Object({
+		runner: nullableString(),
+		locations: strings()
+	}, closed)),
+	deploymentHints: field(strings()),
+	ownership: field(Type.Object({ codeowners: nullableString() }, closed)),
+	risks: Type.Array(Type.Object({
+		id: Type.String(),
+		severity: oneOf([
+			"high",
+			"medium",
+			"low"
+		]),
+		message: Type.String(),
+		sources: strings()
+	}, closed)),
+	conventions: field(strings()),
+	generatedArtifacts: field(strings()),
+	unknowns: Type.Array(Type.Object({
+		id: Type.String(),
+		question: Type.String(),
+		candidates: strings(),
+		sources: strings()
+	}, closed)),
+	provenance: Type.Object({
+		generatedAt: IsoInstant,
+		toolVersion: Type.String(),
+		analysis: Type.Literal("deterministic")
+	}, closed)
+}, closed));
+const RECONCILE_OPS = [
+	"create",
+	"replace",
+	"delete",
+	"keep",
+	"ask"
+];
+const sha = () => Type.Optional(Sha256);
+const DriftReportSchema = Type.Object({
+	schemaVersion: Type.Literal(1),
+	generatedAt: IsoInstant,
+	entries: Type.Array(Type.Object({
+		target: Type.String({ minLength: 1 }),
+		class: oneOf(FIELD_CLASSES),
+		diff: oneOf(DIFF_CLASSES),
+		desiredSha256: sha(),
+		actualSha256: sha(),
+		recordedSha256: sha(),
+		detail: Type.String()
+	}, closed))
+}, closed);
+Type.Unsafe(DriftReportSchema);
+Type.Unsafe(Type.Object({
+	schemaVersion: Type.Literal(1),
+	cohorteVersion: Type.String({ minLength: 1 }),
+	generatedAt: IsoInstant,
+	drift: DriftReportSchema,
+	operations: Type.Array(Type.Object({
+		op: oneOf(RECONCILE_OPS),
+		target: Type.String({ minLength: 1 }),
+		diff: oneOf(DIFF_CLASSES),
+		reason: Type.String()
+	}, closed)),
+	conflicts: Type.Array(Type.String()),
+	applyAvailable: Type.Literal(false)
+}, closed));
+//#endregion
+export {};
+
+//# sourceMappingURL=contract-vYbwYr0Y.mjs.map

package/dist/chunks/contract-vYbwYr0Y.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"contract-vYbwYr0Y.mjs","names":[],"sources":["../../../../packages/project-model/src/contract.ts"],"sourcesContent":["// @cohorte/project-model/contract (PLAN PC-4, spec 12-13): frozen in Wave 0 so that the scan unit and the drift unit\n// never import each other. Types are written by hand and the schema consts annotated: see docs/v3/requests/U0.02.md R1.\nimport { ID_PATTERN, IsoInstant, Sha256 } from '@cohorte/base';\nimport type { Manifest } from '@cohorte/config/schema';\nimport { type TSchema, type TUnsafe, Type } from 'typebox';\n\nconst closed = { additionalProperties: false } as const;\nconst oneOf = <const V extends readonly string[]>(values: V): TUnsafe<V[number]> =>\n  Type.Unsafe<V[number]>({ type: 'string', enum: [...values] });\n\n/** Spec 13: every field of the model, and every file of `.cohorte/`, has exactly one class. */\nexport const FIELD_CLASSES = ['human', 'generated', 'derived', 'observed', 'mixed'] as const;\nexport type FieldClass = (typeof FIELD_CLASSES)[number];\n\n/** Spec 13: what the diff engine must tell apart. */\nexport const DIFF_CLASSES = [\n  'absent',\n  'expected-change',\n  'human-change',\n  'conflict',\n  'potential-deletion',\n  'unknown',\n] as const;\nexport type DiffClass = (typeof DIFF_CLASSES)[number];\n\nexport interface Provenance {\n  /** which deterministic detector produced the value, e.g. 'package-json', 'lockfile', 'git', 'human-config' */\n  detector: string;\n  /** repo-relative POSIX paths the value was read from */\n  sources: string[];\n  /** 0..1; only a SEMANTIC inference carries one (spec 12), and V3.0 has none */\n  confidence?: number;\n}\n\nexport interface ModelField<T> {\n  value: T;\n  class: FieldClass;\n  provenance: Provenance;\n}\n\n/** Ambiguity is recorded, NEVER resolved by inventing a value (a command least of all). */\nexport interface Unknown {\n  id: string;\n  question: string;\n  candidates: string[];\n  sources: string[];\n}\n\nexport interface Risk {\n  id: string;\n  severity: 'high' | 'medium' | 'low';\n  message: string;\n  sources: string[];\n}\n\n/** Spec 12. `commands` are argv arrays, not the shell strings of the spec's example: the product is argv-only (I3, D-25). */\nexport interface ProjectModel {\n  schemaVersion: 1;\n  project: { id: ModelField<string>; root: ModelField<string> };\n  stack: {\n    languages: ModelField<string[]>;\n    packageManager: ModelField<string | null>;\n    frameworks: ModelField<string[]>;\n  };\n  surfaces: Record<string, { paths: ModelField<string[]> }>;\n  commands: Record<string, ModelField<string[]>>;\n  testStrategy: ModelField<{ runner: string | null; locations: string[] }>;\n  deploymentHints: ModelField<string[]>;\n  ownership: ModelField<{ codeowners: string | null }>;\n  risks: Risk[];\n  conventions: ModelField<string[]>;\n  generatedArtifacts: ModelField<string[]>;\n  unknowns: Unknown[];\n  provenance: { generatedAt: IsoInstant; toolVersion: string; analysis: 'deterministic' };\n}\n\nconst strings = () => Type.Array(Type.String());\nconst ProvenanceSchema = Type.Object(\n  {\n    detector: Type.String({ minLength: 1 }),\n    sources: strings(),\n    confidence: Type.Optional(Type.Number({ minimum: 0, maximum: 1 })),\n  },\n  closed,\n);\nconst field = (value: TSchema) =>\n  Type.Object({ value, class: oneOf(FIELD_CLASSES), provenance: ProvenanceSchema }, closed);\nconst nullableString = () => Type.Union([Type.String(), Type.Null()]);\n\n/** [S] `.cohorte/project.yaml`, and the document `cohorte discover` prints. */\nexport const ProjectModel: TUnsafe<ProjectModel> = Type.Unsafe<ProjectModel>(\n  Type.Object(\n    {\n      schemaVersion: Type.Literal(1),\n      project: Type.Object({ id: field(Type.String({ pattern: ID_PATTERN })), root: field(Type.String()) }, closed),\n      stack: Type.Object(\n        { languages: field(strings()), packageManager: field(nullableString()), frameworks: field(strings()) },\n        closed,\n      ),\n      surfaces: Type.Record(Type.String({ pattern: ID_PATTERN }), Type.Object({ paths: field(strings()) }, closed)),\n      commands: Type.Record(Type.String(), field(Type.Array(Type.String(), { minItems: 1 }))),\n      testStrategy: field(Type.Object({ runner: nullableString(), locations: strings() }, closed)),\n      deploymentHints: field(strings()),\n      ownership: field(Type.Object({ codeowners: nullableString() }, closed)),\n      risks: Type.Array(\n        Type.Object(\n          {\n            id: Type.String(),\n            severity: oneOf(['high', 'medium', 'low']),\n            message: Type.String(),\n            sources: strings(),\n          },\n          closed,\n        ),\n      ),\n      conventions: field(strings()),\n      generatedArtifacts: field(strings()),\n      unknowns: Type.Array(\n        Type.Object({ id: Type.String(), question: Type.String(), candidates: strings(), sources: strings() }, closed),\n      ),\n      provenance: Type.Object(\n        { generatedAt: IsoInstant, toolVersion: Type.String(), analysis: Type.Literal('deterministic') },\n        closed,\n      ),\n    },\n    closed,\n  ),\n);\n\n/** One file Cohorte wants to exist under `.cohorte/` (desired) or found there (actual). */\nexport interface StateFile {\n  /** `.cohorte`-relative POSIX path */\n  path: string;\n  class: FieldClass;\n  sha256: Sha256;\n  templateId?: string;\n}\nexport interface DesiredState {\n  cohorteVersion: string;\n  files: StateFile[];\n}\nexport interface ActualState {\n  /** the manifest found on disk; null = not initialised */\n  manifest: Manifest | null;\n  files: StateFile[];\n}\n\nexport interface DriftEntry {\n  /** `.cohorte`-relative POSIX path, or a JSON pointer into project.yaml prefixed with `project.yaml#` */\n  target: string;\n  class: FieldClass;\n  diff: DiffClass;\n  /** what the desired state renders to */\n  desiredSha256?: Sha256;\n  /** what is on disk */\n  actualSha256?: Sha256;\n  /** `renderedSha256` of the manifest: the previous-hash guard of spec 14 */\n  recordedSha256?: Sha256;\n  detail: string;\n}\n\nexport interface DriftReport {\n  schemaVersion: 1;\n  generatedAt: IsoInstant;\n  entries: DriftEntry[];\n}\n\nexport const RECONCILE_OPS = ['create', 'replace', 'delete', 'keep', 'ask'] as const;\n\nexport interface ReconcileOperation {\n  op: (typeof RECONCILE_OPS)[number];\n  target: string;\n  diff: DiffClass;\n  reason: string;\n}\n\n/** The `--json` document of `cohorte reconcile --plan`. READ-ONLY: `--apply` is rejected in V3.0. */\nexport interface ReconcilePlan {\n  schemaVersion: 1;\n  cohorteVersion: string;\n  generatedAt: IsoInstant;\n  drift: DriftReport;\n  /** a human override is never in here as `replace` or `delete`: a collision is a `conflict` */\n  operations: ReconcileOperation[];\n  /** targets whose diff class is `conflict` */\n  conflicts: string[];\n  applyAvailable: false;\n}\n\nconst sha = () => Type.Optional(Sha256);\nconst DriftReportSchema = Type.Object(\n  {\n    schemaVersion: Type.Literal(1),\n    generatedAt: IsoInstant,\n    entries: Type.Array(\n      Type.Object(\n        {\n          target: Type.String({ minLength: 1 }),\n          class: oneOf(FIELD_CLASSES),\n          diff: oneOf(DIFF_CLASSES),\n          desiredSha256: sha(),\n          actualSha256: sha(),\n          recordedSha256: sha(),\n          detail: Type.String(),\n        },\n        closed,\n      ),\n    ),\n  },\n  closed,\n);\n\n/** [S] */\nexport const DriftReport: TUnsafe<DriftReport> = Type.Unsafe<DriftReport>(DriftReportSchema);\n\n/** [S] published by `gen-schemas` */\nexport const ReconcilePlan: TUnsafe<ReconcilePlan> = Type.Unsafe<ReconcilePlan>(\n  Type.Object(\n    {\n      schemaVersion: Type.Literal(1),\n      cohorteVersion: Type.String({ minLength: 1 }),\n      generatedAt: IsoInstant,\n      drift: DriftReportSchema,\n      operations: Type.Array(\n        Type.Object(\n          {\n            op: oneOf(RECONCILE_OPS),\n            target: Type.String({ minLength: 1 }),\n            diff: oneOf(DIFF_CLASSES),\n            reason: Type.String(),\n          },\n          closed,\n        ),\n      ),\n      conflicts: Type.Array(Type.String()),\n      applyAvailable: Type.Literal(false),\n    },\n    closed,\n  ),\n);\n\nexport interface InitFile {\n  /** `.cohorte`-relative POSIX path */\n  path: string;\n  /** an existing human file is NEVER overwritten */\n  action: 'create' | 'keep-existing';\n  class: FieldClass;\n  content: string;\n  templateId?: string;\n  templateSha256?: Sha256;\n  renderedSha256?: Sha256;\n}\n\n/** What `cohorte init` will do, computed without writing anything. Idempotent: planning twice yields the same plan. */\nexport interface InitPlan {\n  projectRoot: string;\n  model: ProjectModel;\n  files: InitFile[];\n  manifest: Manifest;\n  warnings: string[];\n}\n\n/** INJECTED into `planReconcile`, so the drift unit never imports the scan unit. */\nexport type RepositoryScanner = (root: string) => Promise<ProjectModel>;\n"],"mappings":";;;AAMA,MAAM,SAAS,EAAE,sBAAsB,MAAM;AAC7C,MAAM,SAA4C,WAChD,KAAK,OAAkB;CAAE,MAAM;CAAU,MAAM,CAAC,GAAG,MAAM;AAAE,CAAC;;AAG9D,MAAa,gBAAgB;CAAC;CAAS;CAAa;CAAW;CAAY;AAAO;;AAIlF,MAAa,eAAe;CAC1B;CACA;CACA;CACA;CACA;CACA;AACF;AAsDA,MAAM,gBAAgB,KAAK,MAAM,KAAK,OAAO,CAAC;AAC9C,MAAM,mBAAmB,KAAK,OAC5B;CACE,UAAU,KAAK,OAAO,EAAE,WAAW,EAAE,CAAC;CACtC,SAAS,QAAQ;CACjB,YAAY,KAAK,SAAS,KAAK,OAAO;EAAE,SAAS;EAAG,SAAS;CAAE,CAAC,CAAC;AACnE,GACA,MACF;AACA,MAAM,SAAS,UACb,KAAK,OAAO;CAAE;CAAO,OAAO,MAAM,aAAa;CAAG,YAAY;AAAiB,GAAG,MAAM;AAC1F,MAAM,uBAAuB,KAAK,MAAM,CAAC,KAAK,OAAO,GAAG,KAAK,KAAK,CAAC,CAAC;AAGjB,KAAK,OACtD,KAAK,OACH;CACE,eAAe,KAAK,QAAQ,CAAC;CAC7B,SAAS,KAAK,OAAO;EAAE,IAAI,MAAM,KAAK,OAAO,EAAE,SAAS,WAAW,CAAC,CAAC;EAAG,MAAM,MAAM,KAAK,OAAO,CAAC;CAAE,GAAG,MAAM;CAC5G,OAAO,KAAK,OACV;EAAE,WAAW,MAAM,QAAQ,CAAC;EAAG,gBAAgB,MAAM,eAAe,CAAC;EAAG,YAAY,MAAM,QAAQ,CAAC;CAAE,GACrG,MACF;CACA,UAAU,KAAK,OAAO,KAAK,OAAO,EAAE,SAAS,WAAW,CAAC,GAAG,KAAK,OAAO,EAAE,OAAO,MAAM,QAAQ,CAAC,EAAE,GAAG,MAAM,CAAC;CAC5G,UAAU,KAAK,OAAO,KAAK,OAAO,GAAG,MAAM,KAAK,MAAM,KAAK,OAAO,GAAG,EAAE,UAAU,EAAE,CAAC,CAAC,CAAC;CACtF,cAAc,MAAM,KAAK,OAAO;EAAE,QAAQ,eAAe;EAAG,WAAW,QAAQ;CAAE,GAAG,MAAM,CAAC;CAC3F,iBAAiB,MAAM,QAAQ,CAAC;CAChC,WAAW,MAAM,KAAK,OAAO,EAAE,YAAY,eAAe,EAAE,GAAG,MAAM,CAAC;CACtE,OAAO,KAAK,MACV,KAAK,OACH;EACE,IAAI,KAAK,OAAO;EAChB,UAAU,MAAM;GAAC;GAAQ;GAAU;EAAK,CAAC;EACzC,SAAS,KAAK,OAAO;EACrB,SAAS,QAAQ;CACnB,GACA,MACF,CACF;CACA,aAAa,MAAM,QAAQ,CAAC;CAC5B,oBAAoB,MAAM,QAAQ,CAAC;CACnC,UAAU,KAAK,MACb,KAAK,OAAO;EAAE,IAAI,KAAK,OAAO;EAAG,UAAU,KAAK,OAAO;EAAG,YAAY,QAAQ;EAAG,SAAS,QAAQ;CAAE,GAAG,MAAM,CAC/G;CACA,YAAY,KAAK,OACf;EAAE,aAAa;EAAY,aAAa,KAAK,OAAO;EAAG,UAAU,KAAK,QAAQ,eAAe;CAAE,GAC/F,MACF;AACF,GACA,MACF,CACF;AAwCA,MAAa,gBAAgB;CAAC;CAAU;CAAW;CAAU;CAAQ;AAAK;AAsB1E,MAAM,YAAY,KAAK,SAAS,MAAM;AACtC,MAAM,oBAAoB,KAAK,OAC7B;CACE,eAAe,KAAK,QAAQ,CAAC;CAC7B,aAAa;CACb,SAAS,KAAK,MACZ,KAAK,OACH;EACE,QAAQ,KAAK,OAAO,EAAE,WAAW,EAAE,CAAC;EACpC,OAAO,MAAM,aAAa;EAC1B,MAAM,MAAM,YAAY;EACxB,eAAe,IAAI;EACnB,cAAc,IAAI;EAClB,gBAAgB,IAAI;EACpB,QAAQ,KAAK,OAAO;CACtB,GACA,MACF,CACF;AACF,GACA,MACF;AAGiD,KAAK,OAAoB,iBAAiB;AAGtC,KAAK,OACxD,KAAK,OACH;CACE,eAAe,KAAK,QAAQ,CAAC;CAC7B,gBAAgB,KAAK,OAAO,EAAE,WAAW,EAAE,CAAC;CAC5C,aAAa;CACb,OAAO;CACP,YAAY,KAAK,MACf,KAAK,OACH;EACE,IAAI,MAAM,aAAa;EACvB,QAAQ,KAAK,OAAO,EAAE,WAAW,EAAE,CAAC;EACpC,MAAM,MAAM,YAAY;EACxB,QAAQ,KAAK,OAAO;CACtB,GACA,MACF,CACF;CACA,WAAW,KAAK,MAAM,KAAK,OAAO,CAAC;CACnC,gBAAgB,KAAK,QAAQ,KAAK;AACpC,GACA,MACF,CACF"}

package/dist/chunks/deny-ClTxSvHJ.mjs

@@ -0,0 +1,15 @@
+//#region src/commands/deny/index.ts
+const deny = {
+	verb: "deny",
+	async run(ctx, args) {
+		const [runId, approvalId] = args.positionals;
+		if (!runId || !approvalId) return 2;
+		const result = await ctx.controller.send("deny", { approvalId }, { runId });
+		ctx.stdio.stdout.write(`${JSON.stringify(result)}\n`);
+		return result.status === "rejected" ? 3 : result.status === "pending" ? 4 : 0;
+	}
+};
+//#endregion
+export { deny as default };
+
+//# sourceMappingURL=deny-ClTxSvHJ.mjs.map

package/dist/chunks/deny-ClTxSvHJ.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"deny-ClTxSvHJ.mjs","names":[],"sources":["../../../../apps/cli/src/commands/deny/index.ts"],"sourcesContent":["// apps/cli/src/commands/deny/index.ts — DESIGN §9 verb `deny` (PLAN §3 rule 3 \"later units fill\n// stub files that lie inside their owned paths; they never edit ... the registry\"). Wave-0 stub: exits with the\n// documented not-available error (spec 24 `configuration/phase-not-available`); filled by the Wave-4/5\n// unit that owns `apps/cli/src/commands/deny/**`.\nimport type { CommandModule } from '../../contract/index.ts';\n\nconst deny: CommandModule = {\n  verb: 'deny',\n  async run(ctx, args) {\n    const [runId, approvalId] = args.positionals;\n    if (!runId || !approvalId) return 2;\n    const result = await ctx.controller.send('deny', { approvalId: approvalId as never }, { runId });\n    ctx.stdio.stdout.write(`${JSON.stringify(result)}\\n`);\n    return result.status === 'rejected' ? 3 : result.status === 'pending' ? 4 : 0;\n  },\n};\n\nexport default deny;\n"],"mappings":";AAMA,MAAM,OAAsB;CAC1B,MAAM;CACN,MAAM,IAAI,KAAK,MAAM;EACnB,MAAM,CAAC,OAAO,cAAc,KAAK;EACjC,IAAI,CAAC,SAAS,CAAC,YAAY,OAAO;EAClC,MAAM,SAAS,MAAM,IAAI,WAAW,KAAK,QAAQ,EAAc,WAAoB,GAAG,EAAE,MAAM,CAAC;EAC/F,IAAI,MAAM,OAAO,MAAM,GAAG,KAAK,UAAU,MAAM,EAAE,GAAG;EACpD,OAAO,OAAO,WAAW,aAAa,IAAI,OAAO,WAAW,YAAY,IAAI;CAC9E;AACF"}