cohorte 2.10.1 → 3.0.0-dev.0

package/dist/chunks/inspect-Buby4cQD.mjs

@@ -0,0 +1,22 @@
+import { n as writeHuman } from "./render-DyZr5Lgi.mjs";
+//#region src/commands/inspect/index.ts
+const inspect = {
+	verb: "inspect",
+	async run(ctx, args) {
+		const runId = args.positionals[0];
+		if (!runId) return 2;
+		const store = await ctx.openStore();
+		const value = await store.readRunTree(runId);
+		try {
+			if (args.json) ctx.stdio.stdout.write(`${JSON.stringify(value)}\n`);
+			else writeHuman(ctx, JSON.stringify(value, null, 2));
+			return 0;
+		} finally {
+			await store.close();
+		}
+	}
+};
+//#endregion
+export { inspect as default };
+
+//# sourceMappingURL=inspect-Buby4cQD.mjs.map

package/dist/chunks/inspect-Buby4cQD.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"inspect-Buby4cQD.mjs","names":[],"sources":["../../../../apps/cli/src/commands/inspect/index.ts"],"sourcesContent":["// apps/cli/src/commands/inspect/index.ts — DESIGN §9 verb `inspect` (PLAN §3 rule 3 \"later units fill\n// stub files that lie inside their owned paths; they never edit ... the registry\"). Wave-0 stub: exits with the\n// documented not-available error (spec 24 `configuration/phase-not-available`); filled by the Wave-4/5\n// unit that owns `apps/cli/src/commands/inspect/**`.\nimport type { CommandModule } from '../../contract/index.ts';\nimport { writeHuman } from '../../render/index.ts';\n\nconst inspect: CommandModule = {\n  verb: 'inspect',\n  async run(ctx, args) {\n    const runId = args.positionals[0];\n    if (!runId) return 2;\n    const store = await ctx.openStore();\n    const value = await store.readRunTree(runId as never);\n    try {\n      if (args.json) ctx.stdio.stdout.write(`${JSON.stringify(value)}\\n`);\n      else writeHuman(ctx, JSON.stringify(value, null, 2));\n      return 0;\n    } finally {\n      await store.close();\n    }\n  },\n};\n\nexport default inspect;\n"],"mappings":";;AAOA,MAAM,UAAyB;CAC7B,MAAM;CACN,MAAM,IAAI,KAAK,MAAM;EACnB,MAAM,QAAQ,KAAK,YAAY;EAC/B,IAAI,CAAC,OAAO,OAAO;EACnB,MAAM,QAAQ,MAAM,IAAI,UAAU;EAClC,MAAM,QAAQ,MAAM,MAAM,YAAY,KAAc;EACpD,IAAI;GACF,IAAI,KAAK,MAAM,IAAI,MAAM,OAAO,MAAM,GAAG,KAAK,UAAU,KAAK,EAAE,GAAG;QAC7D,WAAW,KAAK,KAAK,UAAU,OAAO,MAAM,CAAC,CAAC;GACnD,OAAO;EACT,UAAU;GACR,MAAM,MAAM,MAAM;EACpB;CACF;AACF"}

package/dist/chunks/logs-Giq5sUau.mjs

@@ -0,0 +1,25 @@
+import { n as writeHuman } from "./render-DyZr5Lgi.mjs";
+//#region src/commands/logs/index.ts
+const logs = {
+	verb: "logs",
+	async run(ctx, args) {
+		const runId = args.positionals[0];
+		if (!runId) return 2;
+		const store = await ctx.openStore();
+		const events = await store.readEvents(runId, {
+			afterSequence: 0,
+			limit: 1e3
+		});
+		try {
+			for (const event of events) if (args.json) ctx.stdio.stdout.write(`${JSON.stringify(event)}\n`);
+			else writeHuman(ctx, JSON.stringify(event));
+			return 0;
+		} finally {
+			await store.close();
+		}
+	}
+};
+//#endregion
+export { logs as default };
+
+//# sourceMappingURL=logs-Giq5sUau.mjs.map

package/dist/chunks/logs-Giq5sUau.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"logs-Giq5sUau.mjs","names":[],"sources":["../../../../apps/cli/src/commands/logs/index.ts"],"sourcesContent":["// apps/cli/src/commands/logs/index.ts — DESIGN §9 verb `logs` (PLAN §3 rule 3 \"later units fill\n// stub files that lie inside their owned paths; they never edit ... the registry\"). Wave-0 stub: exits with the\n// documented not-available error (spec 24 `configuration/phase-not-available`); filled by the Wave-4/5\n// unit that owns `apps/cli/src/commands/logs/**`.\nimport type { CommandModule } from '../../contract/index.ts';\nimport { writeHuman } from '../../render/index.ts';\n\nconst logs: CommandModule = {\n  verb: 'logs',\n  async run(ctx, args) {\n    const runId = args.positionals[0];\n    if (!runId) return 2;\n    const store = await ctx.openStore();\n    const events = await store.readEvents(runId as never, { afterSequence: 0, limit: 1000 });\n    try {\n      for (const event of events) {\n        if (args.json) ctx.stdio.stdout.write(`${JSON.stringify(event)}\\n`);\n        else writeHuman(ctx, JSON.stringify(event));\n      }\n      return 0;\n    } finally {\n      await store.close();\n    }\n  },\n};\n\nexport default logs;\n"],"mappings":";;AAOA,MAAM,OAAsB;CAC1B,MAAM;CACN,MAAM,IAAI,KAAK,MAAM;EACnB,MAAM,QAAQ,KAAK,YAAY;EAC/B,IAAI,CAAC,OAAO,OAAO;EACnB,MAAM,QAAQ,MAAM,IAAI,UAAU;EAClC,MAAM,SAAS,MAAM,MAAM,WAAW,OAAgB;GAAE,eAAe;GAAG,OAAO;EAAK,CAAC;EACvF,IAAI;GACF,KAAK,MAAM,SAAS,QAClB,IAAI,KAAK,MAAM,IAAI,MAAM,OAAO,MAAM,GAAG,KAAK,UAAU,KAAK,EAAE,GAAG;QAC7D,WAAW,KAAK,KAAK,UAAU,KAAK,CAAC;GAE5C,OAAO;EACT,UAAU;GACR,MAAM,MAAM,MAAM;EACpB;CACF;AACF"}

package/dist/chunks/migrate-DRoFUg53.mjs

@@ -0,0 +1,19 @@
+//#region src/commands/migrate/index.ts
+const migrate = {
+	verb: "migrate",
+	async run(ctx, args) {
+		const store = await (ctx.openMigrationStore ?? ctx.openStore)();
+		try {
+			const apply = args.positionals.includes("--apply");
+			const report = await store.migrate(apply ? "apply" : "check");
+			ctx.stdio.stdout.write(`${JSON.stringify(report)}\n`);
+			return !apply && report.pending.length > 0 ? 3 : 0;
+		} finally {
+			await store.close();
+		}
+	}
+};
+//#endregion
+export { migrate as default };
+
+//# sourceMappingURL=migrate-DRoFUg53.mjs.map

package/dist/chunks/migrate-DRoFUg53.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"migrate-DRoFUg53.mjs","names":[],"sources":["../../../../apps/cli/src/commands/migrate/index.ts"],"sourcesContent":["// apps/cli/src/commands/migrate/index.ts — DESIGN §9 verb `migrate` (PLAN §3 rule 3 \"later units fill\n// stub files that lie inside their owned paths; they never edit ... the registry\"). Wave-0 stub: exits with the\n// documented not-available error (spec 24 `configuration/phase-not-available`); filled by the Wave-4/5\n// unit that owns `apps/cli/src/commands/migrate/**`.\nimport type { CommandModule } from '../../contract/index.ts';\n\nconst migrate: CommandModule = {\n  verb: 'migrate',\n  async run(ctx, args) {\n    const store = await (ctx.openMigrationStore ?? ctx.openStore)();\n    try {\n      const apply = args.positionals.includes('--apply');\n      const report = await store.migrate(apply ? 'apply' : 'check');\n      ctx.stdio.stdout.write(`${JSON.stringify(report)}\\n`);\n      return !apply && report.pending.length > 0 ? 3 : 0;\n    } finally {\n      await store.close();\n    }\n  },\n};\n\nexport default migrate;\n"],"mappings":";AAMA,MAAM,UAAyB;CAC7B,MAAM;CACN,MAAM,IAAI,KAAK,MAAM;EACnB,MAAM,QAAQ,OAAO,IAAI,sBAAsB,IAAI,UAAA,CAAW;EAC9D,IAAI;GACF,MAAM,QAAQ,KAAK,YAAY,SAAS,SAAS;GACjD,MAAM,SAAS,MAAM,MAAM,QAAQ,QAAQ,UAAU,OAAO;GAC5D,IAAI,MAAM,OAAO,MAAM,GAAG,KAAK,UAAU,MAAM,EAAE,GAAG;GACpD,OAAO,CAAC,SAAS,OAAO,QAAQ,SAAS,IAAI,IAAI;EACnD,UAAU;GACR,MAAM,MAAM,MAAM;EACpB;CACF;AACF"}

package/dist/chunks/models-Btp6X2YZ.mjs

@@ -0,0 +1,24 @@
+//#region src/commands/models/index.ts
+const MODELS = [{
+	provider: "openai-codex",
+	model: "gpt-5.5",
+	capabilities: ["coding", "reasoning"]
+}, {
+	provider: "openai-codex",
+	model: "gpt-5.4-mini",
+	capabilities: ["fast", "cheap"]
+}];
+const models = {
+	verb: "models",
+	async run(ctx, args) {
+		if (args.subVerb !== "list" && args.subVerb !== void 0) return 10;
+		const value = { models: MODELS };
+		if (args.json) ctx.stdio.stdout.write(`${JSON.stringify(value)}\n`);
+		else for (const model of MODELS) ctx.stdio.stdout.write(`${model.provider}/${model.model}\n`);
+		return 0;
+	}
+};
+//#endregion
+export { models as default };
+
+//# sourceMappingURL=models-Btp6X2YZ.mjs.map

package/dist/chunks/models-Btp6X2YZ.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"models-Btp6X2YZ.mjs","names":[],"sources":["../../../../apps/cli/src/commands/models/index.ts"],"sourcesContent":["// apps/cli/src/commands/models/index.ts — DESIGN §9 verb `models` (PLAN §3 rule 3 \"later units fill\n// stub files that lie inside their owned paths; they never edit ... the registry\"). Wave-0 stub: exits with the\n// documented not-available error (spec 24 `configuration/phase-not-available`); filled by the Wave-4/5\n// unit that owns `apps/cli/src/commands/models/**`.\nimport type { CommandModule } from '../../contract/index.ts';\n\nconst MODELS = [\n  { provider: 'openai-codex', model: 'gpt-5.5', capabilities: ['coding', 'reasoning'] },\n  { provider: 'openai-codex', model: 'gpt-5.4-mini', capabilities: ['fast', 'cheap'] },\n] as const;\n\nconst models: CommandModule = {\n  verb: 'models',\n  async run(ctx, args) {\n    if (args.subVerb !== 'list' && args.subVerb !== undefined) return 10;\n    const value = { models: MODELS };\n    if (args.json) ctx.stdio.stdout.write(`${JSON.stringify(value)}\\n`);\n    else for (const model of MODELS) ctx.stdio.stdout.write(`${model.provider}/${model.model}\\n`);\n    return 0;\n  },\n};\n\nexport default models;\n"],"mappings":";AAMA,MAAM,SAAS,CACb;CAAE,UAAU;CAAgB,OAAO;CAAW,cAAc,CAAC,UAAU,WAAW;AAAE,GACpF;CAAE,UAAU;CAAgB,OAAO;CAAgB,cAAc,CAAC,QAAQ,OAAO;AAAE,CACrF;AAEA,MAAM,SAAwB;CAC5B,MAAM;CACN,MAAM,IAAI,KAAK,MAAM;EACnB,IAAI,KAAK,YAAY,UAAU,KAAK,YAAY,KAAA,GAAW,OAAO;EAClE,MAAM,QAAQ,EAAE,QAAQ,OAAO;EAC/B,IAAI,KAAK,MAAM,IAAI,MAAM,OAAO,MAAM,GAAG,KAAK,UAAU,KAAK,EAAE,GAAG;OAC7D,KAAK,MAAM,SAAS,QAAQ,IAAI,MAAM,OAAO,MAAM,GAAG,MAAM,SAAS,GAAG,MAAM,MAAM,GAAG;EAC5F,OAAO;CACT;AACF"}

package/dist/chunks/pause-BASBfKLO.mjs

@@ -0,0 +1,16 @@
+//#region src/commands/pause/index.ts
+const pause = {
+	verb: "pause",
+	async run(ctx, args) {
+		const runId = args.positionals[0];
+		if (!runId) return 2;
+		const reason = args.positionals.slice(1).join(" ");
+		const result = await ctx.controller.send("pause", reason ? { reason } : {}, { runId });
+		ctx.stdio.stdout.write(`${JSON.stringify(result)}\n`);
+		return result.status === "rejected" ? 3 : result.status === "pending" ? 4 : 0;
+	}
+};
+//#endregion
+export { pause as default };
+
+//# sourceMappingURL=pause-BASBfKLO.mjs.map

package/dist/chunks/pause-BASBfKLO.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"pause-BASBfKLO.mjs","names":[],"sources":["../../../../apps/cli/src/commands/pause/index.ts"],"sourcesContent":["// apps/cli/src/commands/pause/index.ts — DESIGN §9 verb `pause` (PLAN §3 rule 3 \"later units fill\n// stub files that lie inside their owned paths; they never edit ... the registry\"). Wave-0 stub: exits with the\n// documented not-available error (spec 24 `configuration/phase-not-available`); filled by the Wave-4/5\n// unit that owns `apps/cli/src/commands/pause/**`.\nimport type { CommandModule } from '../../contract/index.ts';\n\nconst pause: CommandModule = {\n  verb: 'pause',\n  async run(ctx, args) {\n    const runId = args.positionals[0];\n    if (!runId) return 2;\n    const reason = args.positionals.slice(1).join(' ');\n    const result = await ctx.controller.send('pause', reason ? { reason } : {}, { runId });\n    ctx.stdio.stdout.write(`${JSON.stringify(result)}\\n`);\n    return result.status === 'rejected' ? 3 : result.status === 'pending' ? 4 : 0;\n  },\n};\n\nexport default pause;\n"],"mappings":";AAMA,MAAM,QAAuB;CAC3B,MAAM;CACN,MAAM,IAAI,KAAK,MAAM;EACnB,MAAM,QAAQ,KAAK,YAAY;EAC/B,IAAI,CAAC,OAAO,OAAO;EACnB,MAAM,SAAS,KAAK,YAAY,MAAM,CAAC,CAAC,CAAC,KAAK,GAAG;EACjD,MAAM,SAAS,MAAM,IAAI,WAAW,KAAK,SAAS,SAAS,EAAE,OAAO,IAAI,CAAC,GAAG,EAAE,MAAM,CAAC;EACrF,IAAI,MAAM,OAAO,MAAM,GAAG,KAAK,UAAU,MAAM,EAAE,GAAG;EACpD,OAAO,OAAO,WAAW,aAAa,IAAI,OAAO,WAAW,YAAY,IAAI;CAC9E;AACF"}

package/dist/chunks/policy-DUIgzF3W.mjs

@@ -0,0 +1,139 @@
+import { n as sha256Hex, t as canonicalJson } from "./canonical-C8UxeEmB.mjs";
+import { N as errorOf, j as CohorteError } from "./src-Cu3TxNob.mjs";
+import { n as createKeyStore, r as createTrustStore } from "./auth-BT5oVp76.mjs";
+import { i as resolveConfig, n as loadConfig } from "./src-DcU4IXMe.mjs";
+import "./src-CId6kMsY.mjs";
+import { a as buildPolicySnapshot, c as createCommandPolicy, i as createGlobMatcher, l as createProgramResolver, n as toolIntrospection, o as createPolicyEngine, r as createPathResolver, s as explainPolicy } from "./catalogue-BvwSrM_j.mjs";
+import { join, resolve } from "node:path";
+import { realpathSync } from "node:fs";
+//#region src/commands/policy/index.ts
+function canonical(path) {
+	const absolute = resolve(path);
+	try {
+		return realpathSync.native(absolute);
+	} catch {
+		return absolute;
+	}
+}
+function grantFor(root, argv) {
+	const tools = ["run_command"];
+	return {
+		agentId: "agt_policy_explain",
+		role: "policy-explain",
+		digest: sha256Hex(canonicalJson({
+			root,
+			argv: [...argv]
+		})),
+		tools,
+		roots: {
+			workspace: root,
+			readOnly: []
+		},
+		read: {
+			include: ["**"],
+			exclude: []
+		},
+		write: {
+			include: ["**"],
+			exclude: []
+		},
+		denyRead: {
+			include: ["**/.cohorte/**", "**/.git/**"],
+			exclude: []
+		},
+		denyWrite: {
+			include: ["**/.cohorte/**", "**/.git/**"],
+			exclude: []
+		},
+		commands: {
+			default: "deny",
+			rules: []
+		},
+		secrets: [],
+		temporary: [],
+		limits: {
+			maxToolCalls: 1,
+			maxCallsPerMinute: 1,
+			perTool: { run_command: {
+				timeoutMs: 12e4,
+				maxOutputBytes: 1048576
+			} }
+		}
+	};
+}
+const policy = {
+	verb: "policy",
+	async run(ctx, args) {
+		if (args.subVerb !== "explain") return 2;
+		const argv = args.positionals.filter((value) => value !== "--");
+		if (argv.length === 0) return 2;
+		const home = ctx.env.HOME ?? ctx.cwd;
+		const projectKeyId = sha256Hex(ctx.cwd).slice(0, 24);
+		const keys = createKeyStore({ directory: join(home, ".cohorte", "keys") });
+		const trustStore = createTrustStore({
+			directory: join(home, ".cohorte", "trust"),
+			keys
+		});
+		const loaded = await loadConfig({
+			cwd: ctx.cwd,
+			home
+		});
+		const resolved = await resolveConfig(loaded, {
+			trustStore,
+			projectKeyId
+		});
+		if (resolved.status === "untrusted") throw new CohorteError(errorOf("security/project-policy-untrusted", `project policy is untrusted (${resolved.loosenedKeys.join(", ") || "unknown key"})`));
+		const root = canonical(loaded.projectRoot);
+		const pathResolver = createPathResolver({
+			roots: [root],
+			protectedRoots: [canonical(join(root, ".cohorte"))],
+			symlinks: resolved.config.policy.symlinks
+		});
+		const pathDirs = (ctx.env.PATH ?? "").split(":").filter(Boolean).map(canonical);
+		const programs = createProgramResolver({ pathDirs });
+		const branches = { branchOf: () => ({
+			kind: "detached-or-unknown",
+			protected: true
+		}) };
+		const commands = createCommandPolicy({
+			programs,
+			branches
+		});
+		const engine = createPolicyEngine({
+			tools: toolIntrospection,
+			globs: createGlobMatcher(),
+			commands
+		});
+		const policySnapshot = buildPolicySnapshot(resolved.config, loaded.ownership, { sandboxLevel: "L0-process" });
+		const ports = {
+			paths: pathResolver,
+			branches,
+			budgets: {
+				remaining: () => ({}),
+				callsInLastMinute: () => 0
+			},
+			programs,
+			clock: ctx.clock
+		};
+		const verdict = explainPolicy(engine, {
+			runId: "run_policy_explain",
+			agentId: "agt_policy_explain",
+			incarnation: 1,
+			toolCallId: "tool_policy_explain",
+			tool: "run_command",
+			input: {
+				argv,
+				cwd: root,
+				timeoutMs: 12e4
+			},
+			phase: "PREFLIGHT",
+			role: "policy-explain"
+		}, grantFor(root, argv), policySnapshot, ports);
+		ctx.stdio.stdout.write(`${JSON.stringify(verdict)}\n`);
+		return 0;
+	}
+};
+//#endregion
+export { policy as default };
+
+//# sourceMappingURL=policy-DUIgzF3W.mjs.map

package/dist/chunks/policy-DUIgzF3W.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"policy-DUIgzF3W.mjs","names":[],"sources":["../../../../apps/cli/src/commands/policy/index.ts"],"sourcesContent":["// apps/cli/src/commands/policy/index.ts — DESIGN §9 verb `policy` (PLAN §3 rule 3 \"later units fill\n// stub files that lie inside their owned paths; they never edit ... the registry\"). Wave-0 stub: exits with the\n// documented not-available error (spec 24 `configuration/phase-not-available`); filled by the Wave-4/5\n// unit that owns `apps/cli/src/commands/policy/**`.\nimport { realpathSync } from 'node:fs';\nimport { join, resolve } from 'node:path';\nimport { CohorteError, canonicalJson, errorOf, sha256Hex } from '@cohorte/base';\nimport { loadConfig, resolveConfig } from '@cohorte/config';\nimport {\n  buildPolicySnapshot,\n  createCommandPolicy,\n  createGlobMatcher,\n  createPathResolver,\n  createPolicyEngine,\n  createProgramResolver,\n  explainPolicy,\n} from '@cohorte/security';\nimport { createKeyStore, createTrustStore } from '@cohorte/security/auth';\nimport type { AgentGrant, GateCall, PolicyPorts } from '@cohorte/security/contract';\nimport { toolIntrospection } from '@cohorte/tools/catalogue';\nimport type { CommandModule } from '../../contract/index.ts';\n\nfunction canonical(path: string): string {\n  const absolute = resolve(path);\n  try {\n    return realpathSync.native(absolute);\n  } catch {\n    return absolute;\n  }\n}\n\nfunction grantFor(root: string, argv: readonly string[]): AgentGrant {\n  const tools = ['run_command'];\n  const digest = sha256Hex(canonicalJson({ root, argv: [...argv] }));\n  return {\n    agentId: 'agt_policy_explain' as AgentGrant['agentId'],\n    role: 'policy-explain',\n    digest,\n    tools,\n    roots: { workspace: root as AgentGrant['roots']['workspace'], readOnly: [] },\n    read: { include: ['**'], exclude: [] },\n    write: { include: ['**'], exclude: [] },\n    denyRead: { include: ['**/.cohorte/**', '**/.git/**'], exclude: [] },\n    denyWrite: { include: ['**/.cohorte/**', '**/.git/**'], exclude: [] },\n    commands: { default: 'deny', rules: [] },\n    secrets: [],\n    temporary: [],\n    limits: {\n      maxToolCalls: 1,\n      maxCallsPerMinute: 1,\n      perTool: { run_command: { timeoutMs: 120_000, maxOutputBytes: 1024 * 1024 } },\n    },\n  };\n}\n\nconst policy: CommandModule = {\n  verb: 'policy',\n  async run(ctx, args) {\n    if (args.subVerb !== 'explain') return 2;\n    const argv = args.positionals.filter((value) => value !== '--');\n    if (argv.length === 0) return 2;\n\n    const home = ctx.env.HOME ?? ctx.cwd;\n    const projectKeyId = sha256Hex(ctx.cwd).slice(0, 24);\n    const keys = createKeyStore({ directory: join(home, '.cohorte', 'keys') });\n    const trustStore = createTrustStore({ directory: join(home, '.cohorte', 'trust'), keys });\n    const loaded = await loadConfig({ cwd: ctx.cwd, home });\n    const resolved = await resolveConfig(loaded, { trustStore, projectKeyId });\n    if (resolved.status === 'untrusted') {\n      throw new CohorteError(\n        errorOf(\n          'security/project-policy-untrusted',\n          `project policy is untrusted (${resolved.loosenedKeys.join(', ') || 'unknown key'})`,\n        ),\n      );\n    }\n\n    const root = canonical(loaded.projectRoot);\n    const pathResolver = createPathResolver({\n      roots: [root as never],\n      protectedRoots: [canonical(join(root, '.cohorte')) as never],\n      symlinks: resolved.config.policy.symlinks,\n    });\n    const pathDirs = (ctx.env.PATH ?? '').split(':').filter(Boolean).map(canonical);\n    const programs = createProgramResolver({ pathDirs });\n    const branches: PolicyPorts['branches'] = {\n      branchOf: () => ({ kind: 'detached-or-unknown', protected: true }),\n    };\n    const commands = createCommandPolicy({ programs, branches });\n    const engine = createPolicyEngine({ tools: toolIntrospection, globs: createGlobMatcher(), commands });\n    const policySnapshot = buildPolicySnapshot(resolved.config, loaded.ownership, { sandboxLevel: 'L0-process' });\n    const ports: PolicyPorts = {\n      paths: pathResolver,\n      branches,\n      budgets: { remaining: () => ({}), callsInLastMinute: () => 0 },\n      programs,\n      clock: ctx.clock,\n    };\n    const call: GateCall = {\n      runId: 'run_policy_explain' as GateCall['runId'],\n      agentId: 'agt_policy_explain' as GateCall['agentId'],\n      incarnation: 1,\n      toolCallId: 'tool_policy_explain' as GateCall['toolCallId'],\n      tool: 'run_command',\n      input: { argv, cwd: root, timeoutMs: 120_000 },\n      phase: 'PREFLIGHT',\n      role: 'policy-explain',\n    };\n    const verdict = explainPolicy(engine, call, grantFor(root, argv), policySnapshot, ports);\n    ctx.stdio.stdout.write(`${JSON.stringify(verdict)}\\n`);\n    return 0;\n  },\n};\n\nexport default policy;\n"],"mappings":";;;;;;;;;AAsBA,SAAS,UAAU,MAAsB;CACvC,MAAM,WAAW,QAAQ,IAAI;CAC7B,IAAI;EACF,OAAO,aAAa,OAAO,QAAQ;CACrC,QAAQ;EACN,OAAO;CACT;AACF;AAEA,SAAS,SAAS,MAAc,MAAqC;CACnE,MAAM,QAAQ,CAAC,aAAa;CAE5B,OAAO;EACL,SAAS;EACT,MAAM;EACN,QAJa,UAAU,cAAc;GAAE;GAAM,MAAM,CAAC,GAAG,IAAI;EAAE,CAAC,CAIzD;EACL;EACA,OAAO;GAAE,WAAW;GAA0C,UAAU,CAAC;EAAE;EAC3E,MAAM;GAAE,SAAS,CAAC,IAAI;GAAG,SAAS,CAAC;EAAE;EACrC,OAAO;GAAE,SAAS,CAAC,IAAI;GAAG,SAAS,CAAC;EAAE;EACtC,UAAU;GAAE,SAAS,CAAC,kBAAkB,YAAY;GAAG,SAAS,CAAC;EAAE;EACnE,WAAW;GAAE,SAAS,CAAC,kBAAkB,YAAY;GAAG,SAAS,CAAC;EAAE;EACpE,UAAU;GAAE,SAAS;GAAQ,OAAO,CAAC;EAAE;EACvC,SAAS,CAAC;EACV,WAAW,CAAC;EACZ,QAAQ;GACN,cAAc;GACd,mBAAmB;GACnB,SAAS,EAAE,aAAa;IAAE,WAAW;IAAS,gBAAgB;GAAY,EAAE;EAC9E;CACF;AACF;AAEA,MAAM,SAAwB;CAC5B,MAAM;CACN,MAAM,IAAI,KAAK,MAAM;EACnB,IAAI,KAAK,YAAY,WAAW,OAAO;EACvC,MAAM,OAAO,KAAK,YAAY,QAAQ,UAAU,UAAU,IAAI;EAC9D,IAAI,KAAK,WAAW,GAAG,OAAO;EAE9B,MAAM,OAAO,IAAI,IAAI,QAAQ,IAAI;EACjC,MAAM,eAAe,UAAU,IAAI,GAAG,CAAC,CAAC,MAAM,GAAG,EAAE;EACnD,MAAM,OAAO,eAAe,EAAE,WAAW,KAAK,MAAM,YAAY,MAAM,EAAE,CAAC;EACzE,MAAM,aAAa,iBAAiB;GAAE,WAAW,KAAK,MAAM,YAAY,OAAO;GAAG;EAAK,CAAC;EACxF,MAAM,SAAS,MAAM,WAAW;GAAE,KAAK,IAAI;GAAK;EAAK,CAAC;EACtD,MAAM,WAAW,MAAM,cAAc,QAAQ;GAAE;GAAY;EAAa,CAAC;EACzE,IAAI,SAAS,WAAW,aACtB,MAAM,IAAI,aACR,QACE,qCACA,gCAAgC,SAAS,aAAa,KAAK,IAAI,KAAK,cAAc,EACpF,CACF;EAGF,MAAM,OAAO,UAAU,OAAO,WAAW;EACzC,MAAM,eAAe,mBAAmB;GACtC,OAAO,CAAC,IAAa;GACrB,gBAAgB,CAAC,UAAU,KAAK,MAAM,UAAU,CAAC,CAAU;GAC3D,UAAU,SAAS,OAAO,OAAO;EACnC,CAAC;EACD,MAAM,YAAY,IAAI,IAAI,QAAQ,GAAA,CAAI,MAAM,GAAG,CAAC,CAAC,OAAO,OAAO,CAAC,CAAC,IAAI,SAAS;EAC9E,MAAM,WAAW,sBAAsB,EAAE,SAAS,CAAC;EACnD,MAAM,WAAoC,EACxC,iBAAiB;GAAE,MAAM;GAAuB,WAAW;EAAK,GAClE;EACA,MAAM,WAAW,oBAAoB;GAAE;GAAU;EAAS,CAAC;EAC3D,MAAM,SAAS,mBAAmB;GAAE,OAAO;GAAmB,OAAO,kBAAkB;GAAG;EAAS,CAAC;EACpG,MAAM,iBAAiB,oBAAoB,SAAS,QAAQ,OAAO,WAAW,EAAE,cAAc,aAAa,CAAC;EAC5G,MAAM,QAAqB;GACzB,OAAO;GACP;GACA,SAAS;IAAE,kBAAkB,CAAC;IAAI,yBAAyB;GAAE;GAC7D;GACA,OAAO,IAAI;EACb;EAWA,MAAM,UAAU,cAAc,QAAQ;GATpC,OAAO;GACP,SAAS;GACT,aAAa;GACb,YAAY;GACZ,MAAM;GACN,OAAO;IAAE;IAAM,KAAK;IAAM,WAAW;GAAQ;GAC7C,OAAO;GACP,MAAM;EAEiC,GAAG,SAAS,MAAM,IAAI,GAAG,gBAAgB,KAAK;EACvF,IAAI,MAAM,OAAO,MAAM,GAAG,KAAK,UAAU,OAAO,EAAE,GAAG;EACrD,OAAO;CACT;AACF"}

package/dist/chunks/providers-Dx78imKj.mjs

@@ -0,0 +1,19 @@
+//#region src/commands/providers/index.ts
+const PROVIDERS = ["openai-codex", "anthropic"];
+const providers = {
+	verb: "providers",
+	async run(ctx, args) {
+		if (args.subVerb !== "list" && args.subVerb !== "test" && args.subVerb !== void 0) return 10;
+		const statuses = await ctx.runtime.resolve().authStatus([...PROVIDERS]);
+		if (args.subVerb === "test") {
+			for (const status of statuses) ctx.stdio.stdout.write(`${status.provider}: ${status.state}\n`);
+			return statuses.every((status) => status.state !== "unknown-transient") ? 0 : 1;
+		}
+		for (const provider of PROVIDERS) ctx.stdio.stdout.write(`${provider}\n`);
+		return 0;
+	}
+};
+//#endregion
+export { providers as default };
+
+//# sourceMappingURL=providers-Dx78imKj.mjs.map

package/dist/chunks/providers-Dx78imKj.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"providers-Dx78imKj.mjs","names":[],"sources":["../../../../apps/cli/src/commands/providers/index.ts"],"sourcesContent":["// apps/cli/src/commands/providers/index.ts — DESIGN §9 verb `providers` (PLAN §3 rule 3 \"later units fill\n// stub files that lie inside their owned paths; they never edit ... the registry\"). Wave-0 stub: exits with the\n// documented not-available error (spec 24 `configuration/phase-not-available`); filled by the Wave-4/5\n// unit that owns `apps/cli/src/commands/providers/**`.\nimport type { CommandModule } from '../../contract/index.ts';\n\nconst PROVIDERS = ['openai-codex', 'anthropic'] as const;\n\nconst providers: CommandModule = {\n  verb: 'providers',\n  async run(ctx, args) {\n    if (args.subVerb !== 'list' && args.subVerb !== 'test' && args.subVerb !== undefined) return 10;\n    const statuses = await ctx.runtime.resolve().authStatus([...PROVIDERS]);\n    if (args.subVerb === 'test') {\n      for (const status of statuses) ctx.stdio.stdout.write(`${status.provider}: ${status.state}\\n`);\n      return statuses.every((status) => status.state !== 'unknown-transient') ? 0 : 1;\n    }\n    for (const provider of PROVIDERS) ctx.stdio.stdout.write(`${provider}\\n`);\n    return 0;\n  },\n};\n\nexport default providers;\n"],"mappings":";AAMA,MAAM,YAAY,CAAC,gBAAgB,WAAW;AAE9C,MAAM,YAA2B;CAC/B,MAAM;CACN,MAAM,IAAI,KAAK,MAAM;EACnB,IAAI,KAAK,YAAY,UAAU,KAAK,YAAY,UAAU,KAAK,YAAY,KAAA,GAAW,OAAO;EAC7F,MAAM,WAAW,MAAM,IAAI,QAAQ,QAAQ,CAAC,CAAC,WAAW,CAAC,GAAG,SAAS,CAAC;EACtE,IAAI,KAAK,YAAY,QAAQ;GAC3B,KAAK,MAAM,UAAU,UAAU,IAAI,MAAM,OAAO,MAAM,GAAG,OAAO,SAAS,IAAI,OAAO,MAAM,GAAG;GAC7F,OAAO,SAAS,OAAO,WAAW,OAAO,UAAU,mBAAmB,IAAI,IAAI;EAChF;EACA,KAAK,MAAM,YAAY,WAAW,IAAI,MAAM,OAAO,MAAM,GAAG,SAAS,GAAG;EACxE,OAAO;CACT;AACF"}

package/dist/chunks/reconcile-BfD785gd.mjs

@@ -0,0 +1,26 @@
+import { N as errorOf, j as CohorteError } from "./src-Cu3TxNob.mjs";
+import { n as planReconcile, t as scanRepository } from "./src-JxawBQBn.mjs";
+//#region src/commands/reconcile/index.ts
+const reconcile = {
+	verb: "reconcile",
+	async run(ctx, args) {
+		if (args.positionals.includes("--apply")) throw new CohorteError(errorOf("configuration/phase-not-available", "reconcile --apply is not available in V3.0"));
+		if (!args.positionals.includes("--plan")) return 2;
+		const plan = await planReconcile({
+			root: ctx.cwd,
+			scan: (root) => scanRepository(root, {
+				clock: ctx.clock,
+				toolVersion: "3.0.0"
+			}),
+			cohorteVersion: "3.0.0",
+			clock: ctx.clock
+		});
+		if (args.json) ctx.stdio.stdout.write(`${JSON.stringify(plan)}\n`);
+		else ctx.stdio.stdout.write(`${plan.operations.length} operation(s) planned\n`);
+		return 0;
+	}
+};
+//#endregion
+export { reconcile as default };
+
+//# sourceMappingURL=reconcile-BfD785gd.mjs.map

package/dist/chunks/reconcile-BfD785gd.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"reconcile-BfD785gd.mjs","names":[],"sources":["../../../../apps/cli/src/commands/reconcile/index.ts"],"sourcesContent":["import { CohorteError, errorOf } from '@cohorte/base';\nimport { planReconcile, scanRepository } from '@cohorte/project-model';\nimport type { CommandModule } from '../../contract/index.ts';\n\nconst reconcile: CommandModule = {\n  verb: 'reconcile',\n  async run(ctx, args) {\n    if (args.positionals.includes('--apply')) {\n      throw new CohorteError(\n        errorOf('configuration/phase-not-available', 'reconcile --apply is not available in V3.0'),\n      );\n    }\n    if (!args.positionals.includes('--plan')) return 2;\n    const plan = await planReconcile({\n      root: ctx.cwd,\n      scan: (root) => scanRepository(root, { clock: ctx.clock, toolVersion: '3.0.0' }),\n      cohorteVersion: '3.0.0',\n      clock: ctx.clock,\n    });\n    if (args.json) ctx.stdio.stdout.write(`${JSON.stringify(plan)}\\n`);\n    else ctx.stdio.stdout.write(`${plan.operations.length} operation(s) planned\\n`);\n    return 0;\n  },\n};\n\nexport default reconcile;\n"],"mappings":";;;AAIA,MAAM,YAA2B;CAC/B,MAAM;CACN,MAAM,IAAI,KAAK,MAAM;EACnB,IAAI,KAAK,YAAY,SAAS,SAAS,GACrC,MAAM,IAAI,aACR,QAAQ,qCAAqC,4CAA4C,CAC3F;EAEF,IAAI,CAAC,KAAK,YAAY,SAAS,QAAQ,GAAG,OAAO;EACjD,MAAM,OAAO,MAAM,cAAc;GAC/B,MAAM,IAAI;GACV,OAAO,SAAS,eAAe,MAAM;IAAE,OAAO,IAAI;IAAO,aAAa;GAAQ,CAAC;GAC/E,gBAAgB;GAChB,OAAO,IAAI;EACb,CAAC;EACD,IAAI,KAAK,MAAM,IAAI,MAAM,OAAO,MAAM,GAAG,KAAK,UAAU,IAAI,EAAE,GAAG;OAC5D,IAAI,MAAM,OAAO,MAAM,GAAG,KAAK,WAAW,OAAO,wBAAwB;EAC9E,OAAO;CACT;AACF"}

package/dist/chunks/render-DyZr5Lgi.mjs

@@ -0,0 +1,53 @@
+//#region src/panels/index.ts
+const PANELS = Object.freeze({ status: async (ctx) => {
+	const store = await ctx.openStore();
+	try {
+		const runs = await store.listRuns({
+			limit: 20,
+			offset: 0
+		});
+		for (const run of runs) ctx.stdio.stdout.write(`${run.runId} ${run.state}\n`);
+		return 0;
+	} finally {
+		await store.close();
+	}
+} });
+function resolvePanel(kind) {
+	const panel = PANELS[kind];
+	if (!panel) throw new RangeError(`unknown panel kind: ${kind}`);
+	return panel;
+}
+//#endregion
+//#region src/render/sanitize.ts
+/** Escape terminal control bytes for human-facing output. JSON is never passed here. */
+function sanitizeHuman(value) {
+	let result = "";
+	for (const char of value) {
+		const code = char.codePointAt(0) ?? 0;
+		if (char === "\n" || char === "	" || code >= 32 && code !== 127 && !(code >= 128 && code <= 159)) result += char;
+		else result += `\\x${code.toString(16).padStart(2, "0").toUpperCase()}`;
+	}
+	return result;
+}
+//#endregion
+//#region src/render/index.ts
+function createRenderer() {
+	return {
+		json(value) {
+			process.stdout.write(`${JSON.stringify(value)}\n`);
+		},
+		line(text) {
+			process.stdout.write(`${sanitizeHuman(text)}\n`);
+		},
+		async panel(kind, ctx) {
+			return resolvePanel(kind)(ctx);
+		}
+	};
+}
+function writeHuman(ctx, text) {
+	ctx.stdio.stdout.write(`${sanitizeHuman(text)}\n`);
+}
+//#endregion
+export { writeHuman as n, createRenderer as t };
+
+//# sourceMappingURL=render-DyZr5Lgi.mjs.map

package/dist/chunks/render-DyZr5Lgi.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"render-DyZr5Lgi.mjs","names":[],"sources":["../../../../apps/cli/src/panels/index.ts","../../../../apps/cli/src/render/sanitize.ts","../../../../apps/cli/src/render/index.ts"],"sourcesContent":["// apps/cli/src/panels/index.ts — AREA barrel: the `--panel` interactive views (francois.md), one function per\n// panel kind, looked up by `render/index.ts`. Wave-0 stub: filled by `U4.04`, which owns `apps/cli/src/panels/**`.\nimport type { CliContext } from '../contract/index.ts';\n\nexport type Panel = (ctx: CliContext) => Promise<number>;\n\nexport const PANELS: Readonly<Record<string, Panel>> = Object.freeze({\n  status: async (ctx) => {\n    const store = await ctx.openStore();\n    try {\n      const runs = await store.listRuns({ limit: 20, offset: 0 });\n      for (const run of runs) ctx.stdio.stdout.write(`${run.runId} ${run.state}\\n`);\n      return 0;\n    } finally {\n      await store.close();\n    }\n  },\n});\n\nexport function resolvePanel(kind: string): Panel {\n  const panel = PANELS[kind];\n  if (!panel) throw new RangeError(`unknown panel kind: ${kind}`);\n  return panel;\n}\n","/** Escape terminal control bytes for human-facing output. JSON is never passed here. */\nexport function sanitizeHuman(value: string): string {\n  let result = '';\n  for (const char of value) {\n    const code = char.codePointAt(0) ?? 0;\n    if (char === '\\n' || char === '\\t' || (code >= 0x20 && code !== 0x7f && !(code >= 0x80 && code <= 0x9f))) {\n      result += char;\n    } else {\n      result += `\\\\x${code.toString(16).padStart(2, '0').toUpperCase()}`;\n    }\n  }\n  return result;\n}\n","// apps/cli/src/render/index.ts — AREA barrel: the `Renderer` port (document / NDJSON-line / `--panel` output,\n// francois.md \"10 s / 4 MiB\" one-shot budget). Wave-0 stub: filled by `U4.04`, which owns `apps/cli/src/render/**`.\nimport type { Renderer } from '../contract/index.ts';\nimport { resolvePanel } from '../panels/index.ts';\nimport { sanitizeHuman } from './sanitize.ts';\n\nexport function createRenderer(): Renderer {\n  return {\n    json(value) {\n      process.stdout.write(`${JSON.stringify(value)}\\n`);\n    },\n    line(text) {\n      process.stdout.write(`${sanitizeHuman(text)}\\n`);\n    },\n    async panel(kind, ctx) {\n      return resolvePanel(kind)(ctx);\n    },\n  };\n}\n\nexport function writeHuman(ctx: { readonly stdio: { readonly stdout: NodeJS.WritableStream } }, text: string): void {\n  ctx.stdio.stdout.write(`${sanitizeHuman(text)}\\n`);\n}\n"],"mappings":";AAMA,MAAa,SAA0C,OAAO,OAAO,EACnE,QAAQ,OAAO,QAAQ;CACrB,MAAM,QAAQ,MAAM,IAAI,UAAU;CAClC,IAAI;EACF,MAAM,OAAO,MAAM,MAAM,SAAS;GAAE,OAAO;GAAI,QAAQ;EAAE,CAAC;EAC1D,KAAK,MAAM,OAAO,MAAM,IAAI,MAAM,OAAO,MAAM,GAAG,IAAI,MAAM,GAAG,IAAI,MAAM,GAAG;EAC5E,OAAO;CACT,UAAU;EACR,MAAM,MAAM,MAAM;CACpB;AACF,EACF,CAAC;AAED,SAAgB,aAAa,MAAqB;CAChD,MAAM,QAAQ,OAAO;CACrB,IAAI,CAAC,OAAO,MAAM,IAAI,WAAW,uBAAuB,MAAM;CAC9D,OAAO;AACT;;;;ACtBA,SAAgB,cAAc,OAAuB;CACnD,IAAI,SAAS;CACb,KAAK,MAAM,QAAQ,OAAO;EACxB,MAAM,OAAO,KAAK,YAAY,CAAC,KAAK;EACpC,IAAI,SAAS,QAAQ,SAAS,OAAS,QAAQ,MAAQ,SAAS,OAAQ,EAAE,QAAQ,OAAQ,QAAQ,MAChG,UAAU;OAEV,UAAU,MAAM,KAAK,SAAS,EAAE,CAAC,CAAC,SAAS,GAAG,GAAG,CAAC,CAAC,YAAY;CAEnE;CACA,OAAO;AACT;;;ACNA,SAAgB,iBAA2B;CACzC,OAAO;EACL,KAAK,OAAO;GACV,QAAQ,OAAO,MAAM,GAAG,KAAK,UAAU,KAAK,EAAE,GAAG;EACnD;EACA,KAAK,MAAM;GACT,QAAQ,OAAO,MAAM,GAAG,cAAc,IAAI,EAAE,GAAG;EACjD;EACA,MAAM,MAAM,MAAM,KAAK;GACrB,OAAO,aAAa,IAAI,CAAC,CAAC,GAAG;EAC/B;CACF;AACF;AAEA,SAAgB,WAAW,KAAqE,MAAoB;CAClH,IAAI,MAAM,OAAO,MAAM,GAAG,cAAc,IAAI,EAAE,GAAG;AACnD"}

package/dist/chunks/resume-GJQRb2Eb.mjs

@@ -0,0 +1,15 @@
+//#region src/commands/resume/index.ts
+const resume = {
+	verb: "resume",
+	async run(ctx, args) {
+		const runId = args.positionals[0];
+		if (!runId) return 2;
+		const result = await ctx.controller.send("resume", {}, { runId });
+		ctx.stdio.stdout.write(`${JSON.stringify(result)}\n`);
+		return result.status === "rejected" ? 3 : result.status === "pending" ? 4 : 0;
+	}
+};
+//#endregion
+export { resume as default };
+
+//# sourceMappingURL=resume-GJQRb2Eb.mjs.map

package/dist/chunks/resume-GJQRb2Eb.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"resume-GJQRb2Eb.mjs","names":[],"sources":["../../../../apps/cli/src/commands/resume/index.ts"],"sourcesContent":["// apps/cli/src/commands/resume/index.ts — DESIGN §9 verb `resume` (PLAN §3 rule 3 \"later units fill\n// stub files that lie inside their owned paths; they never edit ... the registry\"). Wave-0 stub: exits with the\n// documented not-available error (spec 24 `configuration/phase-not-available`); filled by the Wave-4/5\n// unit that owns `apps/cli/src/commands/resume/**`.\nimport type { CommandModule } from '../../contract/index.ts';\n\nconst resume: CommandModule = {\n  verb: 'resume',\n  async run(ctx, args) {\n    const runId = args.positionals[0];\n    if (!runId) return 2;\n    const result = await ctx.controller.send('resume', {}, { runId });\n    ctx.stdio.stdout.write(`${JSON.stringify(result)}\\n`);\n    return result.status === 'rejected' ? 3 : result.status === 'pending' ? 4 : 0;\n  },\n};\n\nexport default resume;\n"],"mappings":";AAMA,MAAM,SAAwB;CAC5B,MAAM;CACN,MAAM,IAAI,KAAK,MAAM;EACnB,MAAM,QAAQ,KAAK,YAAY;EAC/B,IAAI,CAAC,OAAO,OAAO;EACnB,MAAM,SAAS,MAAM,IAAI,WAAW,KAAK,UAAU,CAAC,GAAG,EAAE,MAAM,CAAC;EAChE,IAAI,MAAM,OAAO,MAAM,GAAG,KAAK,UAAU,MAAM,EAAE,GAAG;EACpD,OAAO,OAAO,WAAW,aAAa,IAAI,OAAO,WAAW,YAAY,IAAI;CAC9E;AACF"}

package/dist/chunks/retry-CLrUem1H.mjs

@@ -0,0 +1,15 @@
+//#region src/commands/retry/index.ts
+const retry = {
+	verb: "retry",
+	async run(ctx, args) {
+		const runId = args.positionals[0];
+		if (!runId) return 2;
+		const result = await ctx.controller.send("retry", { target: { kind: "phase" } }, { runId });
+		ctx.stdio.stdout.write(`${JSON.stringify(result)}\n`);
+		return result.status === "rejected" ? 3 : result.status === "pending" ? 4 : 0;
+	}
+};
+//#endregion
+export { retry as default };
+
+//# sourceMappingURL=retry-CLrUem1H.mjs.map

package/dist/chunks/retry-CLrUem1H.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"retry-CLrUem1H.mjs","names":[],"sources":["../../../../apps/cli/src/commands/retry/index.ts"],"sourcesContent":["// apps/cli/src/commands/retry/index.ts — DESIGN §9 verb `retry` (PLAN §3 rule 3 \"later units fill\n// stub files that lie inside their owned paths; they never edit ... the registry\"). Wave-0 stub: exits with the\n// documented not-available error (spec 24 `configuration/phase-not-available`); filled by the Wave-4/5\n// unit that owns `apps/cli/src/commands/retry/**`.\nimport type { CommandModule } from '../../contract/index.ts';\n\nconst retry: CommandModule = {\n  verb: 'retry',\n  async run(ctx, args) {\n    const runId = args.positionals[0];\n    if (!runId) return 2;\n    const result = await ctx.controller.send('retry', { target: { kind: 'phase' } }, { runId });\n    ctx.stdio.stdout.write(`${JSON.stringify(result)}\\n`);\n    return result.status === 'rejected' ? 3 : result.status === 'pending' ? 4 : 0;\n  },\n};\n\nexport default retry;\n"],"mappings":";AAMA,MAAM,QAAuB;CAC3B,MAAM;CACN,MAAM,IAAI,KAAK,MAAM;EACnB,MAAM,QAAQ,KAAK,YAAY;EAC/B,IAAI,CAAC,OAAO,OAAO;EACnB,MAAM,SAAS,MAAM,IAAI,WAAW,KAAK,SAAS,EAAE,QAAQ,EAAE,MAAM,QAAQ,EAAE,GAAG,EAAE,MAAM,CAAC;EAC1F,IAAI,MAAM,OAAO,MAAM,GAAG,KAAK,UAAU,MAAM,EAAE,GAAG;EACpD,OAAO,OAAO,WAAW,aAAa,IAAI,OAAO,WAAW,YAAY,IAAI;CAC9E;AACF"}

package/dist/chunks/review-BDdjb6kB.mjs

@@ -0,0 +1,17 @@
+//#region src/commands/review/index.ts
+const review = {
+	verb: "review",
+	async run(ctx, args) {
+		const result = await ctx.controller.send("start", {
+			profile: "review",
+			unattended: false,
+			...args.positionals[0] ? { reviewTarget: { ref: args.positionals[0] } } : {}
+		});
+		ctx.stdio.stdout.write(`${JSON.stringify(result)}\n`);
+		return result.status === "rejected" ? 3 : result.status === "pending" ? 4 : 0;
+	}
+};
+//#endregion
+export { review as default };
+
+//# sourceMappingURL=review-BDdjb6kB.mjs.map

package/dist/chunks/review-BDdjb6kB.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"review-BDdjb6kB.mjs","names":[],"sources":["../../../../apps/cli/src/commands/review/index.ts"],"sourcesContent":["// apps/cli/src/commands/review/index.ts — DESIGN §9 verb `review` (PLAN §3 rule 3 \"later units fill\n// stub files that lie inside their owned paths; they never edit ... the registry\"). Wave-0 stub: exits with the\n// documented not-available error (spec 24 `configuration/phase-not-available`); filled by the Wave-4/5\n// unit that owns `apps/cli/src/commands/review/**`.\nimport type { CommandModule } from '../../contract/index.ts';\n\nconst review: CommandModule = {\n  verb: 'review',\n  async run(ctx, args) {\n    const result = await ctx.controller.send('start', {\n      profile: 'review',\n      unattended: false,\n      ...(args.positionals[0] ? { reviewTarget: { ref: args.positionals[0] } } : {}),\n    });\n    ctx.stdio.stdout.write(`${JSON.stringify(result)}\\n`);\n    return result.status === 'rejected' ? 3 : result.status === 'pending' ? 4 : 0;\n  },\n};\n\nexport default review;\n"],"mappings":";AAMA,MAAM,SAAwB;CAC5B,MAAM;CACN,MAAM,IAAI,KAAK,MAAM;EACnB,MAAM,SAAS,MAAM,IAAI,WAAW,KAAK,SAAS;GAChD,SAAS;GACT,YAAY;GACZ,GAAI,KAAK,YAAY,KAAK,EAAE,cAAc,EAAE,KAAK,KAAK,YAAY,GAAG,EAAE,IAAI,CAAC;EAC9E,CAAC;EACD,IAAI,MAAM,OAAO,MAAM,GAAG,KAAK,UAAU,MAAM,EAAE,GAAG;EACpD,OAAO,OAAO,WAAW,aAAa,IAAI,OAAO,WAAW,YAAY,IAAI;CAC9E;AACF"}

package/dist/chunks/run-CgTWYlcd.mjs

@@ -0,0 +1,82 @@
+import { n as sha256Hex } from "./canonical-C8UxeEmB.mjs";
+import { N as errorOf, j as CohorteError } from "./src-Cu3TxNob.mjs";
+import { n as createKeyStore, r as createTrustStore } from "./auth-BT5oVp76.mjs";
+import { i as resolveConfig, n as loadConfig } from "./src-DcU4IXMe.mjs";
+import { join } from "node:path";
+import { existsSync } from "node:fs";
+//#region src/commands/run/index.ts
+const run = {
+	verb: "run",
+	async run(ctx, args) {
+		const valueAfter = (flag) => {
+			const index = args.positionals.indexOf(flag);
+			return index >= 0 ? args.positionals[index + 1] : void 0;
+		};
+		const profile = valueAfter("--profile") ?? args.positionals.find((value) => [
+			"feature",
+			"bugfix",
+			"review"
+		].includes(value)) ?? "feature";
+		if (![
+			"feature",
+			"bugfix",
+			"review"
+		].includes(profile)) return 2;
+		const spec = args.positionals.find((value, index) => !value.startsWith("--") && args.positionals[index - 1] !== "--profile" && args.positionals[index - 1] !== "--runtime" && args.positionals[index - 1] !== "--script" && args.positionals[index - 1] !== "--model" && ![
+			"feature",
+			"bugfix",
+			"review"
+		].includes(value));
+		const model = valueAfter("--model");
+		const waitValue = valueAfter("--wait");
+		const waitMs = waitValue === void 0 ? void 0 : Number(waitValue) * 1e3;
+		if (waitValue !== void 0 && (!Number.isFinite(waitMs) || waitMs < 0)) return 2;
+		const trustProjectConfig = args.positionals.includes("--trust-project-config");
+		let consent;
+		if (ctx.env.HOME && existsSync(join(ctx.cwd, ".cohorte", "config.yaml"))) {
+			const home = ctx.env.HOME ?? ctx.cwd;
+			const loaded = await loadConfig({
+				cwd: ctx.cwd,
+				home
+			});
+			const keys = createKeyStore({ directory: join(home, ".cohorte", "keys") });
+			const trustStore = createTrustStore({
+				directory: join(home, ".cohorte", "trust"),
+				keys
+			});
+			const resolved = await resolveConfig(loaded, {
+				trustStore,
+				projectKeyId: sha256Hex(loaded.projectRoot).slice(0, 24)
+			});
+			if (resolved.status === "untrusted" && !trustProjectConfig) throw new CohorteError(errorOf("security/project-policy-untrusted", `project policy is untrusted (${resolved.loosenedKeys.join(", ") || "unknown key"})`));
+			if (resolved.status === "untrusted") consent = {
+				policySha256: resolved.policySha256,
+				via: "cli-flag"
+			};
+		}
+		const payload = {
+			profile,
+			unattended: false,
+			...spec ? { spec: { path: spec } } : {},
+			...valueAfter("--runtime") ? { runtime: valueAfter("--runtime") } : {},
+			...valueAfter("--script") ? { fakeScript: valueAfter("--script") } : {},
+			...model ? { modelOverrides: { implementer: {
+				provider: "default",
+				model
+			} } } : {},
+			...consent ? { consent } : {}
+		};
+		const result = waitMs === void 0 ? await ctx.controller.send("start", payload) : await ctx.controller.send("start", payload, { waitMs });
+		if (result.status === "pending" && result.result && typeof result.result === "object" && "runId" in result.result) {
+			const runId = result.result.runId;
+			if (runId) await ctx.hostSpawner.spawnDetached(runId);
+		}
+		if (args.json) ctx.stdio.stdout.write(`${JSON.stringify(result)}\n`);
+		else ctx.stdio.stdout.write(`${result.status}\n`);
+		return result.status === "rejected" ? 3 : result.status === "pending" ? 4 : 0;
+	}
+};
+//#endregion
+export { run as default };
+
+//# sourceMappingURL=run-CgTWYlcd.mjs.map

package/dist/chunks/run-CgTWYlcd.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"run-CgTWYlcd.mjs","names":[],"sources":["../../../../apps/cli/src/commands/run/index.ts"],"sourcesContent":["// apps/cli/src/commands/run/index.ts — DESIGN §9 verb `run` (PLAN §3 rule 3 \"later units fill\n// stub files that lie inside their owned paths; they never edit ... the registry\"). Wave-0 stub: exits with the\n// documented not-available error (spec 24 `configuration/phase-not-available`); filled by the Wave-4/5\n// unit that owns `apps/cli/src/commands/run/**`.\nimport { existsSync } from 'node:fs';\nimport { join } from 'node:path';\nimport { CohorteError, errorOf, type Sha256, sha256Hex } from '@cohorte/base';\nimport { loadConfig, resolveConfig } from '@cohorte/config';\nimport { createKeyStore, createTrustStore } from '@cohorte/security/auth';\nimport type { CommandModule } from '../../contract/index.ts';\n\nconst run: CommandModule = {\n  verb: 'run',\n  async run(ctx, args) {\n    const valueAfter = (flag: string): string | undefined => {\n      const index = args.positionals.indexOf(flag);\n      return index >= 0 ? args.positionals[index + 1] : undefined;\n    };\n    const profile = (valueAfter('--profile') ??\n      args.positionals.find((value) => ['feature', 'bugfix', 'review'].includes(value)) ??\n      'feature') as 'feature' | 'bugfix' | 'review';\n    if (!['feature', 'bugfix', 'review'].includes(profile)) return 2;\n    const spec = args.positionals.find(\n      (value, index) =>\n        !value.startsWith('--') &&\n        args.positionals[index - 1] !== '--profile' &&\n        args.positionals[index - 1] !== '--runtime' &&\n        args.positionals[index - 1] !== '--script' &&\n        args.positionals[index - 1] !== '--model' &&\n        !['feature', 'bugfix', 'review'].includes(value),\n    );\n    const model = valueAfter('--model');\n    const waitValue = valueAfter('--wait');\n    const waitMs = waitValue === undefined ? undefined : Number(waitValue) * 1000;\n    if (waitValue !== undefined && (!Number.isFinite(waitMs) || (waitMs as number) < 0)) return 2;\n    const trustProjectConfig = args.positionals.includes('--trust-project-config');\n    let consent: { policySha256: Sha256; via: 'cli-flag' } | undefined;\n    // Test/fake contexts intentionally omit HOME; a real CLI invocation always\n    // supplies it and is the only context allowed to resolve project trust.\n    if (ctx.env.HOME && existsSync(join(ctx.cwd, '.cohorte', 'config.yaml'))) {\n      const home = ctx.env.HOME ?? ctx.cwd;\n      const loaded = await loadConfig({ cwd: ctx.cwd, home });\n      const keys = createKeyStore({ directory: join(home, '.cohorte', 'keys') });\n      const trustStore = createTrustStore({ directory: join(home, '.cohorte', 'trust'), keys });\n      const resolved = await resolveConfig(loaded, {\n        trustStore,\n        projectKeyId: sha256Hex(loaded.projectRoot).slice(0, 24),\n      });\n      if (resolved.status === 'untrusted' && !trustProjectConfig) {\n        throw new CohorteError(\n          errorOf(\n            'security/project-policy-untrusted',\n            `project policy is untrusted (${resolved.loosenedKeys.join(', ') || 'unknown key'})`,\n          ),\n        );\n      }\n      if (resolved.status === 'untrusted') consent = { policySha256: resolved.policySha256, via: 'cli-flag' };\n    }\n    const payload = {\n      profile,\n      unattended: false,\n      ...(spec ? { spec: { path: spec } } : {}),\n      ...(valueAfter('--runtime') ? { runtime: valueAfter('--runtime') as string } : {}),\n      ...(valueAfter('--script') ? { fakeScript: valueAfter('--script') as string } : {}),\n      ...(model ? { modelOverrides: { implementer: { provider: 'default', model } } } : {}),\n      ...(consent ? { consent } : {}),\n    };\n    const result =\n      waitMs === undefined\n        ? await ctx.controller.send('start', payload)\n        : await ctx.controller.send('start', payload, { waitMs });\n    if (result.status === 'pending' && result.result && typeof result.result === 'object' && 'runId' in result.result) {\n      const runId = (result.result as { runId?: string }).runId;\n      if (runId) await ctx.hostSpawner.spawnDetached(runId);\n    }\n    if (args.json) ctx.stdio.stdout.write(`${JSON.stringify(result)}\\n`);\n    else ctx.stdio.stdout.write(`${result.status}\\n`);\n    return result.status === 'rejected' ? 3 : result.status === 'pending' ? 4 : 0;\n  },\n};\n\nexport default run;\n"],"mappings":";;;;;;;AAWA,MAAM,MAAqB;CACzB,MAAM;CACN,MAAM,IAAI,KAAK,MAAM;EACnB,MAAM,cAAc,SAAqC;GACvD,MAAM,QAAQ,KAAK,YAAY,QAAQ,IAAI;GAC3C,OAAO,SAAS,IAAI,KAAK,YAAY,QAAQ,KAAK,KAAA;EACpD;EACA,MAAM,UAAW,WAAW,WAAW,KACrC,KAAK,YAAY,MAAM,UAAU;GAAC;GAAW;GAAU;EAAQ,CAAC,CAAC,SAAS,KAAK,CAAC,KAChF;EACF,IAAI,CAAC;GAAC;GAAW;GAAU;EAAQ,CAAC,CAAC,SAAS,OAAO,GAAG,OAAO;EAC/D,MAAM,OAAO,KAAK,YAAY,MAC3B,OAAO,UACN,CAAC,MAAM,WAAW,IAAI,KACtB,KAAK,YAAY,QAAQ,OAAO,eAChC,KAAK,YAAY,QAAQ,OAAO,eAChC,KAAK,YAAY,QAAQ,OAAO,cAChC,KAAK,YAAY,QAAQ,OAAO,aAChC,CAAC;GAAC;GAAW;GAAU;EAAQ,CAAC,CAAC,SAAS,KAAK,CACnD;EACA,MAAM,QAAQ,WAAW,SAAS;EAClC,MAAM,YAAY,WAAW,QAAQ;EACrC,MAAM,SAAS,cAAc,KAAA,IAAY,KAAA,IAAY,OAAO,SAAS,IAAI;EACzE,IAAI,cAAc,KAAA,MAAc,CAAC,OAAO,SAAS,MAAM,KAAM,SAAoB,IAAI,OAAO;EAC5F,MAAM,qBAAqB,KAAK,YAAY,SAAS,wBAAwB;EAC7E,IAAI;EAGJ,IAAI,IAAI,IAAI,QAAQ,WAAW,KAAK,IAAI,KAAK,YAAY,aAAa,CAAC,GAAG;GACxE,MAAM,OAAO,IAAI,IAAI,QAAQ,IAAI;GACjC,MAAM,SAAS,MAAM,WAAW;IAAE,KAAK,IAAI;IAAK;GAAK,CAAC;GACtD,MAAM,OAAO,eAAe,EAAE,WAAW,KAAK,MAAM,YAAY,MAAM,EAAE,CAAC;GACzE,MAAM,aAAa,iBAAiB;IAAE,WAAW,KAAK,MAAM,YAAY,OAAO;IAAG;GAAK,CAAC;GACxF,MAAM,WAAW,MAAM,cAAc,QAAQ;IAC3C;IACA,cAAc,UAAU,OAAO,WAAW,CAAC,CAAC,MAAM,GAAG,EAAE;GACzD,CAAC;GACD,IAAI,SAAS,WAAW,eAAe,CAAC,oBACtC,MAAM,IAAI,aACR,QACE,qCACA,gCAAgC,SAAS,aAAa,KAAK,IAAI,KAAK,cAAc,EACpF,CACF;GAEF,IAAI,SAAS,WAAW,aAAa,UAAU;IAAE,cAAc,SAAS;IAAc,KAAK;GAAW;EACxG;EACA,MAAM,UAAU;GACd;GACA,YAAY;GACZ,GAAI,OAAO,EAAE,MAAM,EAAE,MAAM,KAAK,EAAE,IAAI,CAAC;GACvC,GAAI,WAAW,WAAW,IAAI,EAAE,SAAS,WAAW,WAAW,EAAY,IAAI,CAAC;GAChF,GAAI,WAAW,UAAU,IAAI,EAAE,YAAY,WAAW,UAAU,EAAY,IAAI,CAAC;GACjF,GAAI,QAAQ,EAAE,gBAAgB,EAAE,aAAa;IAAE,UAAU;IAAW;GAAM,EAAE,EAAE,IAAI,CAAC;GACnF,GAAI,UAAU,EAAE,QAAQ,IAAI,CAAC;EAC/B;EACA,MAAM,SACJ,WAAW,KAAA,IACP,MAAM,IAAI,WAAW,KAAK,SAAS,OAAO,IAC1C,MAAM,IAAI,WAAW,KAAK,SAAS,SAAS,EAAE,OAAO,CAAC;EAC5D,IAAI,OAAO,WAAW,aAAa,OAAO,UAAU,OAAO,OAAO,WAAW,YAAY,WAAW,OAAO,QAAQ;GACjH,MAAM,QAAS,OAAO,OAA8B;GACpD,IAAI,OAAO,MAAM,IAAI,YAAY,cAAc,KAAK;EACtD;EACA,IAAI,KAAK,MAAM,IAAI,MAAM,OAAO,MAAM,GAAG,KAAK,UAAU,MAAM,EAAE,GAAG;OAC9D,IAAI,MAAM,OAAO,MAAM,GAAG,OAAO,OAAO,GAAG;EAChD,OAAO,OAAO,WAAW,aAAa,IAAI,OAAO,WAAW,YAAY,IAAI;CAC9E;AACF"}

package/dist/chunks/run-tool-C3rAv4XF.mjs

@@ -0,0 +1,26 @@
+//#region src/commands/run-tool/index.ts
+const runTool = {
+	verb: "run-tool",
+	async run(ctx, args) {
+		const [runId, tool, inputText, ...justificationParts] = args.positionals;
+		if (!runId || !tool || !inputText || justificationParts.length === 0) return 2;
+		let input;
+		try {
+			input = JSON.parse(inputText);
+		} catch {
+			return 2;
+		}
+		const result = await ctx.controller.send("run-tool", {
+			tool,
+			input,
+			justification: justificationParts.join(" ")
+		}, { runId });
+		if (args.json) ctx.stdio.stdout.write(`${JSON.stringify(result)}\n`);
+		else ctx.stdio.stdout.write(`${result.status}\n`);
+		return result.status === "rejected" ? 3 : result.status === "pending" ? 4 : 0;
+	}
+};
+//#endregion
+export { runTool as default };
+
+//# sourceMappingURL=run-tool-C3rAv4XF.mjs.map

package/dist/chunks/run-tool-C3rAv4XF.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"run-tool-C3rAv4XF.mjs","names":[],"sources":["../../../../apps/cli/src/commands/run-tool/index.ts"],"sourcesContent":["import type { CommandModule } from '../../contract/index.ts';\n\nconst runTool: CommandModule = {\n  verb: 'run-tool',\n  async run(ctx, args) {\n    const [runId, tool, inputText, ...justificationParts] = args.positionals;\n    if (!runId || !tool || !inputText || justificationParts.length === 0) return 2;\n    let input: unknown;\n    try {\n      input = JSON.parse(inputText);\n    } catch {\n      return 2;\n    }\n    const result = await ctx.controller.send(\n      'run-tool',\n      { tool, input: input as never, justification: justificationParts.join(' ') },\n      { runId },\n    );\n    if (args.json) ctx.stdio.stdout.write(`${JSON.stringify(result)}\\n`);\n    else ctx.stdio.stdout.write(`${result.status}\\n`);\n    return result.status === 'rejected' ? 3 : result.status === 'pending' ? 4 : 0;\n  },\n};\n\nexport default runTool;\n"],"mappings":";AAEA,MAAM,UAAyB;CAC7B,MAAM;CACN,MAAM,IAAI,KAAK,MAAM;EACnB,MAAM,CAAC,OAAO,MAAM,WAAW,GAAG,sBAAsB,KAAK;EAC7D,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,aAAa,mBAAmB,WAAW,GAAG,OAAO;EAC7E,IAAI;EACJ,IAAI;GACF,QAAQ,KAAK,MAAM,SAAS;EAC9B,QAAQ;GACN,OAAO;EACT;EACA,MAAM,SAAS,MAAM,IAAI,WAAW,KAClC,YACA;GAAE;GAAa;GAAgB,eAAe,mBAAmB,KAAK,GAAG;EAAE,GAC3E,EAAE,MAAM,CACV;EACA,IAAI,KAAK,MAAM,IAAI,MAAM,OAAO,MAAM,GAAG,KAAK,UAAU,MAAM,EAAE,GAAG;OAC9D,IAAI,MAAM,OAAO,MAAM,GAAG,OAAO,OAAO,GAAG;EAChD,OAAO,OAAO,WAAW,aAAa,IAAI,OAAO,WAAW,YAAY,IAAI;CAC9E;AACF"}