create-egregore 0.20.1 → 0.21.0-runtime-mvp.1

package/bin/cli.js

@@ -30,6 +30,11 @@ const {
   installCodexRuntime,
   reportCodexRuntimeSummary,
 } = require("../lib/codex-runtime");
+const {
+  hasClaudeRuntimeSupport,
+  installClaudeRuntime,
+  reportClaudeRuntimeSummary,
+} = require("../lib/claude-runtime");
 const {
   hasPiRuntimeSupport,
   installPiRuntime,
@@ -131,6 +136,12 @@ async function upgradePortableRuntimesForExisting(instances) {
       const connectPack = eligibility.eligible
         ? await fetchConnectRuntimePack(inst.path)
         : null;
+      const claudeSummary = installClaudeRuntime(inst.path);
+      const claudeReady = hasClaudeRuntimeSupport(inst.path);
+      reportClaudeRuntimeSummary(claudeSummary, ui, {
+        label: `Claude Code runtime for ${inst.slug || inst.name || path.basename(inst.path)}`,
+        includeConflicts: !claudeReady,
+      });
       const summary = installCodexRuntime(inst.path);
       const ready = hasCodexRuntimeSupport(inst.path);
       reportCodexRuntimeSummary(summary, ui, {

package/lib/claude-runtime.js

@@ -0,0 +1,192 @@
+"use strict";
+
+const crypto = require("node:crypto");
+const { execFileSync } = require("node:child_process");
+const fs = require("node:fs");
+const path = require("node:path");
+
+const PACKAGE = require("../package.json");
+const BUNDLE_DIR = path.join(__dirname, "..", "runtime", "claude");
+const BUNDLE_MANIFEST = path.join(BUNDLE_DIR, "manifest.json");
+const LOCAL_MANIFEST = path.join(".egregore", "claude-runtime-manifest.json");
+
+const REQUIRED_RUNTIME_PATHS = [
+  "CLAUDE.md",
+  ".claude/settings.json",
+  ".claude/hooks/boundary-check.sh",
+  ".claude/hooks/branch-guard.sh",
+  ".claude/skills/activity/SKILL.md",
+  "bin/session-start.sh",
+  "bin/observe-context.sh",
+  "egregore_runtime/harness_cli.py",
+  "egregore_runtime/runtime.py",
+];
+
+const readJson = (file, fallback) => {
+  try { return JSON.parse(fs.readFileSync(file, "utf8")); } catch { return fallback; }
+};
+const hashBuffer = (buffer) => crypto.createHash("sha256").update(buffer).digest("hex");
+const pathExists = (file) => { try { fs.lstatSync(file); return true; } catch { return false; } };
+
+function listFiles(dir, prefix = "") {
+  if (!fs.existsSync(dir)) return [];
+  const result = [];
+  for (const entry of fs.readdirSync(dir, { withFileTypes: true })) {
+    const rel = prefix ? path.join(prefix, entry.name) : entry.name;
+    const full = path.join(dir, entry.name);
+    if (entry.isDirectory()) result.push(...listFiles(full, rel));
+    else if (entry.isFile()) result.push(rel);
+  }
+  return result.sort();
+}
+
+function bundleManifest() { return readJson(BUNDLE_MANIFEST, { files: [], skills: [], skillCount: 0 }); }
+function bundleFiles() { return listFiles(BUNDLE_DIR).filter((rel) => rel !== "manifest.json"); }
+
+function installManifestPath(egregoreDir) {
+  const gitPath = path.join(egregoreDir, ".git");
+  try {
+    const stat = fs.lstatSync(gitPath);
+    if (stat.isDirectory()) return path.join(gitPath, "info", "egregore-claude-runtime.json");
+    if (stat.isFile()) {
+      const match = fs.readFileSync(gitPath, "utf8").trim().match(/^gitdir:\s*(.+)$/);
+      if (match) {
+        const gitDir = path.isAbsolute(match[1]) ? match[1] : path.resolve(egregoreDir, match[1]);
+        return path.join(gitDir, "info", "egregore-claude-runtime.json");
+      }
+    }
+  } catch {}
+  return path.join(egregoreDir, LOCAL_MANIFEST);
+}
+
+function ownedSkills(egregoreDir) {
+  const configured = readJson(path.join(egregoreDir, "egregore.json"), {}).owned_skills;
+  if (!Array.isArray(configured)) return new Set();
+  return new Set(configured.filter((name) => typeof name === "string" && /^[a-z0-9][a-z0-9-]*$/.test(name)));
+}
+
+function ownedSkillPath(rel, owned) {
+  const match = rel.replaceAll("\\", "/").match(/^\.claude\/skills\/([^/]+)(?:\/|$)/);
+  return Boolean(match && owned.has(match[1]));
+}
+
+function copyFile(src, dest) {
+  fs.mkdirSync(path.dirname(dest), { recursive: true });
+  fs.copyFileSync(src, dest);
+  try { fs.chmodSync(dest, fs.statSync(src).mode & 0o777); } catch {}
+}
+
+// One-time ownership migration for pre-bundle Claude installs. A clean,
+// tracked path is part of the cloned framework template and may be adopted by
+// the package. Dirty/untracked paths are user work and remain untouched.
+function isCleanTrackedFrameworkFile(egregoreDir, rel) {
+  try {
+    execFileSync("git", ["ls-files", "--error-unmatch", "--", rel], {
+      cwd: egregoreDir, stdio: "ignore",
+    });
+    execFileSync("git", ["diff", "--quiet", "HEAD", "--", rel], {
+      cwd: egregoreDir, stdio: "ignore",
+    });
+    execFileSync("git", ["diff", "--cached", "--quiet", "HEAD", "--", rel], {
+      cwd: egregoreDir, stdio: "ignore",
+    });
+    return true;
+  } catch {
+    return false;
+  }
+}
+
+function installClaudeRuntime(egregoreDir) {
+  if (!fs.existsSync(BUNDLE_DIR)) throw new Error(`Claude runtime bundle missing: ${BUNDLE_DIR}`);
+  const manifestPath = installManifestPath(egregoreDir);
+  const previous = readJson(manifestPath, { files: {} });
+  const previousFiles = previous.files || {};
+  const owned = ownedSkills(egregoreDir);
+  const next = { package: PACKAGE.name, version: PACKAGE.version, installedAt: new Date().toISOString(), files: {} };
+  const summary = {
+    installed: 0, updated: 0, removed: 0, skipped: 0, conflicted: 0,
+    conflicts: [], files: [], ownedSkills: [...owned].sort(),
+    bundleSkills: bundleManifest().skills || [], bundleSkillCount: bundleManifest().skillCount || 0,
+  };
+  const files = bundleFiles();
+  const current = new Set(files);
+
+  for (const [rel, record] of Object.entries(previousFiles)) {
+    if (ownedSkillPath(rel, owned)) { summary.skipped += 1; continue; }
+    if (current.has(rel)) continue;
+    const dest = path.join(egregoreDir, rel);
+    if (!pathExists(dest)) continue;
+    let stat;
+    try { stat = fs.lstatSync(dest); } catch { continue; }
+    if (stat.isFile() && hashBuffer(fs.readFileSync(dest)) === record.hash) {
+      fs.unlinkSync(dest);
+      try { fs.rmdirSync(path.dirname(dest)); } catch {}
+      summary.removed += 1;
+    } else {
+      summary.conflicted += 1;
+      summary.conflicts.push(rel);
+      next.files[rel] = { hash: record.hash };
+    }
+  }
+
+  for (const rel of files) {
+    if (ownedSkillPath(rel, owned)) { summary.skipped += 1; continue; }
+    const src = path.join(BUNDLE_DIR, rel);
+    const dest = path.join(egregoreDir, rel);
+    const sourceHash = hashBuffer(fs.readFileSync(src));
+    const previousHash = previousFiles[rel]?.hash;
+    const record = () => { next.files[rel] = { hash: sourceHash }; summary.files.push(rel); };
+
+    if (!pathExists(dest)) {
+      copyFile(src, dest); summary.installed += 1; record(); continue;
+    }
+    let stat;
+    try { stat = fs.lstatSync(dest); } catch {}
+    if (!stat?.isFile()) {
+      summary.conflicted += 1; summary.conflicts.push(rel);
+      if (previousHash) next.files[rel] = { hash: previousHash };
+      continue;
+    }
+    const currentHash = hashBuffer(fs.readFileSync(dest));
+    if (currentHash === sourceHash) {
+      try { fs.chmodSync(dest, fs.statSync(src).mode & 0o777); } catch {}
+      summary.skipped += 1; record();
+    } else if (previousHash && currentHash === previousHash) {
+      copyFile(src, dest); summary.updated += 1; record();
+    } else if (!previousHash && isCleanTrackedFrameworkFile(egregoreDir, rel)) {
+      copyFile(src, dest); summary.updated += 1; record();
+    } else {
+      summary.conflicted += 1; summary.conflicts.push(rel);
+      if (previousHash) next.files[rel] = { hash: previousHash };
+    }
+  }
+
+  fs.mkdirSync(path.dirname(manifestPath), { recursive: true });
+  fs.writeFileSync(manifestPath, JSON.stringify(next, null, 2) + "\n");
+  return summary;
+}
+
+function hasClaudeRuntimeSupport(egregoreDir) {
+  return REQUIRED_RUNTIME_PATHS.every((rel) => fs.existsSync(path.join(egregoreDir, rel)));
+}
+
+function reportClaudeRuntimeSummary(summary, ui, opts = {}) {
+  if (!summary || !ui) return;
+  const label = opts.label || "Claude Code runtime";
+  const changed = summary.installed + summary.updated + (summary.removed || 0);
+  if (changed > 0) ui.success(`${label} ready (${summary.installed} installed, ${summary.updated} updated, ${summary.removed || 0} removed, ${summary.skipped} unchanged)`);
+  if (opts.includeConflicts !== false && summary.conflicted > 0) {
+    const count = summary.conflicted;
+    ui.info(ui.dim ? ui.dim(`${label}: kept ${count} locally managed framework file${count === 1 ? "" : "s"}.`) : `${label}: kept ${count} locally managed framework file${count === 1 ? "" : "s"}.`);
+  }
+}
+
+module.exports = {
+  BUNDLE_DIR,
+  bundleFiles,
+  bundleManifest,
+  hasClaudeRuntimeSupport,
+  installClaudeRuntime,
+  installManifestPath,
+  reportClaudeRuntimeSummary,
+};

package/lib/local.js

@@ -16,6 +16,7 @@ const {
   tryGhAuthOrLogin,
 } = require("./auth");
 const { installCodexRuntime, reportCodexRuntimeSummary } = require("./codex-runtime");
+const { installClaudeRuntime, reportClaudeRuntimeSummary } = require("./claude-runtime");
 const { installPiRuntime, reportPiRuntimeSummary } = require("./pi-runtime");
 const { installPrimeRuntime, reportPrimeRuntimeSummary } = require("./prime-runtime");
 const {
@@ -31,7 +32,9 @@ const {
   configureGitCredentials,
   gitCloneEnv,
   initMemoryDirs,
-  ensureDevelop,
+  buildOnboardingState,
+  initializeOrganizationConfig,
+  organizationIdentityDocument,
   ensurePersonOnboardingWitness,
   ensureInstallerMemberRole,
   run,
@@ -1031,7 +1034,6 @@ async function localFounderFlow(ui, ctx = {}) {
 
   const githubOrg = st.githubOrg;
   const isOrg = st.isOrg;
-  const isNewProject = st.isNewProject;
   const orgName = st.orgName;
   const description = st.description;
   let newProjectRepo = st.newProjectRepo;
@@ -1156,13 +1158,14 @@ async function localFounderFlow(ui, ctx = {}) {
     const s3 = ui.spinner(`Creating ${newProjectRepo}...`);
     const projExists = await repoExists(githubToken, githubOrg, newProjectRepo);
     if (projExists) {
-      selectedRepos.push({ name: newProjectRepo });
+      const branchInfo = await detectRepoBranches(githubToken, githubOrg, newProjectRepo).catch(() => null);
+      selectedRepos.push({ name: newProjectRepo, base_branch: branchInfo?.defaultBranch || "main" });
       s3.stop(`${newProjectRepo} already exists — added to managed repos`);
     } else {
       try {
         await createRepo(githubToken, githubOrg, newProjectRepo, isOrg, description || "");
         if (await waitForRepo(githubToken, githubOrg, newProjectRepo)) {
-          selectedRepos.push({ name: newProjectRepo });
+          selectedRepos.push({ name: newProjectRepo, base_branch: "main" });
           s3.stop(`Created ${newProjectRepo}`);
         } else {
           s3.fail(`${newProjectRepo} creation timed out`);
@@ -1174,18 +1177,19 @@ async function localFounderFlow(ui, ctx = {}) {
   }
 
   // 8. Write egregore.json to remote repo (so joiners can read it)
-  const egreConfig = {
+  const egreConfig = initializeOrganizationConfig({
     mode: "local",
     org_name: orgName,
     github_org: githubOrg,
     memory_repo: `https://github.com/${githubOrg}/${memoryRepoName}.git`,
     slug: slug,
     repo_name: repoName,
+    base_branch: "main",
     repos: selectedRepos,
     upstream_url: "https://github.com/egregore-labs/egregore.git",
     report_url: "https://xgksfrirtdumacvmfkzj.supabase.co",
     report_key: "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpc3MiOiJzdXBhYmFzZSIsInJlZiI6Inhna3NmcmlydGR1bWFjdm1ma3pqIiwicm9sZSI6ImFub24iLCJpYXQiOjE3NzA5OTA1ODksImV4cCI6MjA4NjU2NjU4OX0.1UWNgER6nQazrayly1KDrswClURUkGKxeirZg5L8uk4",
-  };
+  });
   // Joiners resolve the org by reading egregore.json from the remote — if
   // this push silently fails (observed: transient failure right after
   // template generation), the org is unjoinable and the founder never knows.
@@ -1219,12 +1223,22 @@ async function localFounderFlow(ui, ctx = {}) {
   }
 
   // 9. Init memory dirs on remote (so joiners get the structure)
-  const memDirs = ["people", "invites", "handoffs", "knowledge/questions", "knowledge/decisions", "knowledge/patterns", "knowledge/findings", "quests", "wraps"];
+  const memDirs = ["people", "identity", "invites", "handoffs", "knowledge/questions", "knowledge/decisions", "knowledge/patterns", "knowledge/findings", "quests", "wraps"];
   for (const d of memDirs) {
     try {
       await putFileContent(githubToken, githubOrg, memoryRepoName, `${d}/.gitkeep`, "", `Initialize ${d}`);
     } catch {}
   }
+  try {
+    await putFileContent(
+      githubToken,
+      githubOrg,
+      memoryRepoName,
+      "identity/EGREGORE.md",
+      organizationIdentityDocument(egreConfig),
+      `Declare organizational identity for ${orgName}`,
+    );
+  } catch {}
 
   // 10. Clone locally
   const base = ctx.targetDir || process.cwd();
@@ -1241,18 +1255,6 @@ async function localFounderFlow(ui, ctx = {}) {
   ui.step(1, totalSteps, "Cloning egregore...");
   cloneRepo(forkUrl, egregoreDir, githubToken, ui, "egregore");
   setGitIdentity(egregoreDir, user);
-  ensureDevelop(egregoreDir);
-  // ensureDevelop only creates develop on the REMOTE (git branch, no checkout),
-  // so the clone is still on main. The egregore operates on develop, so switch
-  // to it now — otherwise local overlays (the codex runtime) get committed to
-  // main and are orphaned when session-start later checks out develop.
-  try {
-    execFileSync("git", ["-C", egregoreDir, "checkout", "develop"], { stdio: "pipe" });
-  } catch {
-    try {
-      execFileSync("git", ["-C", egregoreDir, "checkout", "-b", "develop", "origin/develop"], { stdio: "pipe" });
-    } catch {}
-  }
 
   ui.step(2, totalSteps, "Cloning shared memory...");
   cloneRepo(memoryUrl, memoryDir, githubToken, ui, "memory");
@@ -1290,34 +1292,22 @@ async function localFounderFlow(ui, ctx = {}) {
   //      and ran the invite flow). See .claude/skills/onboarding/SKILL.md
   //      "Pre-captured check" blocks.
   const slugifiedName = (displayName || user.login).toLowerCase().replace(/\s+/g, "-");
-  const state = {
+  const state = buildOnboardingState({}, {
     github_username: user.login,
     github_id: user.id,
-    person_id: user.id ? `github:${user.id}` : `github-login:${user.login.toLowerCase()}`,
     github_name: user.name,
     display_name: displayName || user.login,
-    name: slugifiedName,
     member_role: memberRole,
     email: user.email,
-    emails: user.email ? [user.email.toLowerCase()] : [],
-    onboarding_complete: false,
     usage_type: "founder_group",
-    org_setup: true,
-    github_configured: true,
-    workspace_ready: true,
-    preferred_runtime: preferredRuntime,
-    // Pre-captured onboarding signals. Invite flag is set later in step 18
-    // after the user's answer; default to undefined here so the skill knows
-    // to wait, then the installer mutates this block on invite completion.
-    onboarding: {
-      phase: "orient",
-      started_at: new Date().toISOString(),
-      installer_captured: true,
-      role: "founder",
-      member_role: memberRole,
-    },
-    profile_fields_collected: ["name", "role"],
-  };
+    onboarding_role: "founder",
+    org_id: egreConfig.org_id,
+  }, {
+    runtime: preferredRuntime,
+    onboardingComplete: false,
+  });
+  state.name = slugifiedName;
+  state.emails = user.email ? [user.email.toLowerCase()] : [];
   fs.writeFileSync(path.join(egregoreDir, ".egregore-state.json"), JSON.stringify(state, null, 2) + "\n");
 
   // 15. Create founder's person file in memory
@@ -1356,22 +1346,13 @@ async function localFounderFlow(ui, ctx = {}) {
       const repoUrl = `https://github.com/${githubOrg}/${mrName}.git`;
       cloneRepo(repoUrl, repoDir, githubToken, ui, mrName);
       setGitIdentity(repoDir, user);
-      // New repos get develop branch (our workflow). Existing repos keep their default.
-      if (isNewProject) {
-        ensureDevelop(repoDir);
-      }
     } catch {
       ui.warn(`Could not clone ${mrName} — you may not have access.`);
     }
   }
 
-  // 16. Runtime overlay. Codex and Pi installs commit their derived runtime
-  //     so it's TRACKED (symmetric with .claude/). Claude installs do the
-  //     opposite: Claude Code reads CLAUDE.md, not AGENTS.md, so we strip the
-  //     Codex AGENTS.md/.codex the template ships — otherwise a fresh Claude
-  //     agent (e.g. when onboarding suppresses the greeting) wanders into
-  //     AGENTS.md's startup steps. A Codex teammate who joins later regenerates
-  //     AGENTS.md via /update.
+  // 16. Runtime overlay. Every selected harness now comes from the same
+  //     package-owned, capability-filtered Runtime distribution.
   if (preferredRuntime === "codex") {
     const codexRuntime = installCodexRuntime(egregoreDir);
     reportCodexRuntimeSummary(codexRuntime, ui);
@@ -1411,6 +1392,16 @@ async function localFounderFlow(ui, ctx = {}) {
       }
     } catch {}
   } else {
+    const claudeRuntime = installClaudeRuntime(egregoreDir);
+    reportClaudeRuntimeSummary(claudeRuntime, ui);
+    try {
+      const toCommit = Array.isArray(claudeRuntime.files) ? [...claudeRuntime.files] : [];
+      if (toCommit.length) {
+        execFileSync("git", ["add", "--", ...toCommit], { cwd: egregoreDir, stdio: "pipe" });
+        run('git commit -m "Add Claude Code Runtime adapter"', { cwd: egregoreDir });
+        run("git push", { cwd: egregoreDir });
+      }
+    } catch {}
     stripCodexRuntimeForClaude(egregoreDir, ui);
   }
 

package/lib/pi-runtime.js

@@ -18,6 +18,7 @@ const REQUIRED_RUNTIME_PATHS = [
   ".codex/skills",
   "bin/agent.sh",
   "bin/pi-branch-policy.mjs",
+  "bin/pi-observe-context.mjs",
   "bin/pi-session-start.sh",
   "bin/codex-session-start.sh",
   "bin/codex-skill-render.mjs",

package/lib/prime-runtime.js

@@ -19,6 +19,7 @@ const REQUIRED_RUNTIME_PATHS = [
   ".codex/skills",
   "bin/agent.sh",
   "bin/pi-branch-policy.mjs",
+  "bin/pi-observe-context.mjs",
   "bin/pi-product-workflows.mjs",
   "bin/prime-session-start.sh",
   "bin/codex-session-start.sh",

package/lib/runtime-identity.js

@@ -0,0 +1,146 @@
+/**
+ * Provider-independent identity/config scaffolding for the installer.
+ *
+ * GitHub remains the current repository transport and a linked provider. Its
+ * login and numeric id are compatibility fields, never Egregore domain ids.
+ */
+
+const { randomUUID } = require("node:crypto");
+
+const CONFIG_SCHEMA = "egregore-config/v1";
+const PROFILE_SCHEMA = "egregore-profile/v1";
+const IDENTITY_SCHEMA = "egregore-identity/v2";
+const ONBOARDING_SCHEMA = "egregore-onboarding/v1";
+
+function opaqueId(prefix, idFactory = randomUUID) {
+  return `${prefix}_${String(idFactory()).replaceAll("-", "")}`;
+}
+
+function initializeOrganizationConfig(config = {}, opts = {}) {
+  const next = { ...config };
+  next.schema_version = next.schema_version || CONFIG_SCHEMA;
+  next.org_id = next.org_id || opts.orgId || opaqueId("org", opts.idFactory);
+  next.profile = {
+    schema_version: PROFILE_SCHEMA,
+    revision: "profile/v1",
+    identity_path: "memory/identity/EGREGORE.md",
+    purpose_path: "memory/identity/EGREGORE.md",
+    principles_path: "memory/identity/EGREGORE.md",
+    conventions_path: "memory/identity/EGREGORE.md",
+    declared_sections: ["essence", "values", "domains", "voice", "decision-grammar"],
+    default_policy: "all-access-v1",
+    default_context_budget: 8000,
+    ...(next.profile || {}),
+  };
+  return next;
+}
+
+function organizationIdentityDocument(config = {}, opts = {}) {
+  const name = config.org_name || "Our organization";
+  const orgType = opts.orgType || "team";
+  const intent = opts.intent || "collaborate and accumulate organizational knowledge";
+  const founded = opts.founded || new Date().toISOString().slice(0, 10);
+  return [
+    `# ${name}`,
+    "",
+    "## Essence",
+    "",
+    `${name} is a ${orgType} using Egregore to ${intent}.`,
+    "This declaration is versioned organizational identity; refine it through normal review.",
+    "",
+    "## Values",
+    "",
+    "- Preserve provenance and make consequential reasoning inspectable.",
+    "- Leave canonical organizational state more useful than you found it.",
+    "- Keep human and agent authority explicit.",
+    "",
+    "## Domains",
+    "",
+    "- Add the fields this organization works in and the boundaries it respects.",
+    "",
+    "## Voice",
+    "",
+    "Direct, specific, and honest about uncertainty.",
+    "",
+    "## Decision Grammar",
+    "",
+    "- Record decisions that affect more than one session.",
+    "- Bias toward action for reversible choices.",
+    "- Seek another perspective before irreversible choices.",
+    "",
+    "## Lineage",
+    "",
+    `Founded: ${founded}`,
+    "",
+  ].join("\n");
+}
+
+function initializeIdentityState(state = {}, data = {}, opts = {}) {
+  const next = { ...state };
+  const accountId = data.account_id || next.account_id || opaqueId("acct", opts.idFactory);
+  const actorId = data.actor_id || next.actor_id || opaqueId("actor", opts.idFactory);
+  const membershipId = data.membership_id || next.membership_id || opaqueId("membership", opts.idFactory);
+  const providerIdentities = { ...(next.provider_identities || {}) };
+  const githubUsername = data.github_username || next.github_username;
+  const githubId = data.github_id || next.github_id;
+  if (githubUsername || githubId) {
+    providerIdentities.github = {
+      ...(providerIdentities.github || {}),
+      ...(githubId ? { subject: String(githubId) } : {}),
+      ...(githubUsername ? { username: githubUsername } : {}),
+    };
+  }
+  const email = data.github_email || data.email || next.email;
+  if (email) {
+    providerIdentities.email = {
+      ...(providerIdentities.email || {}),
+      subject: String(email).toLowerCase(),
+    };
+  }
+
+  next.account_id = accountId;
+  next.actor_id = actorId;
+  next.membership_id = membershipId;
+  next.provider_identities = providerIdentities;
+  next.identity_version = 2;
+  next.identity = {
+    ...(next.identity || {}),
+    schema_version: IDENTITY_SCHEMA,
+    account_id: accountId,
+    actor_id: actorId,
+    actor_kind: "person",
+    membership_id: membershipId,
+    org_id: data.org_id || next.identity?.org_id || null,
+    provider_identities: providerIdentities,
+  };
+  return next;
+}
+
+function initializeOnboardingState(state = {}, data = {}) {
+  const next = { ...state, onboarding: { ...(state.onboarding || {}) } };
+  const onboarding = next.onboarding;
+  onboarding.schema_version = ONBOARDING_SCHEMA;
+  onboarding.intent = data.org_intent || onboarding.intent || "collaborate";
+  onboarding.org_type = data.org_type || onboarding.org_type || "team";
+  onboarding.path = Array.isArray(onboarding.path) ? onboarding.path : [];
+  onboarding.answers = {
+    ...(onboarding.answers || {}),
+    ...(data.display_name ? { display_name: data.display_name } : {}),
+    ...(data.member_role ? { member_role: data.member_role } : {}),
+  };
+  onboarding.next_step = onboarding.phase === "complete" ? null : onboarding.next_step || "orient";
+  next.onboarding = onboarding;
+  return next;
+}
+
+module.exports = {
+  CONFIG_SCHEMA,
+  PROFILE_SCHEMA,
+  IDENTITY_SCHEMA,
+  ONBOARDING_SCHEMA,
+  opaqueId,
+  initializeOrganizationConfig,
+  organizationIdentityDocument,
+  initializeIdentityState,
+  initializeOnboardingState,
+};