fraim 2.0.248 → 2.0.249

package/dist/src/cli/utils/manager-publish.js

@@ -6,32 +6,23 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.managerPackRelativePathFor = managerPackRelativePathFor;
 exports.publishManagerArtifacts = publishManagerArtifacts;
 /**
- * Publish manager context/rules/learnings to the configured manager backend
- * (issue #580).
+ * Publish manager context, rules, learnings, capabilities, and employees to the
+ * configured manager backend (issue #580; capability and employee support and
+ * pull-request creation added in issue #1043).
  */
 const axios_1 = __importDefault(require("axios"));
-const child_process_1 = require("child_process");
-const fs_1 = __importDefault(require("fs"));
-const os_1 = __importDefault(require("os"));
 const path_1 = __importDefault(require("path"));
 const manager_pack_1 = require("../../core/manager-pack");
 const user_config_1 = require("./user-config");
 const local_folder_sync_1 = require("./local-folder-sync");
-const ALLOWED_GIT_URL = /^(https?:\/\/|ssh:\/\/|git:\/\/|file:\/\/|[\w.-]+@[\w.-]+:)/;
+const pack_git_publish_1 = require("./pack-git-publish");
+const pack_home_1 = require("./pack-home");
 function managerPackRelativePathFor(filePath) {
     const relativePath = (0, manager_pack_1.managerPackRelativePathForFileName)(filePath);
     if (relativePath)
         return relativePath;
-    // Capability files (jobs/skills/rules/templates/scripts) carry their pack-relative
-    // path verbatim — the caller supplies the full relative path, not just a basename.
     const base = path_1.default.basename(filePath);
-    throw new Error(`Cannot infer manager-pack location for '${base}' (expected manager_context.md, manager_rules.md, a personal learning file, or a full capability path like jobs/<cat>/<name>.md)`);
-}
-function gitCompareUrl(gitUrl, branch) {
-    const httpUrl = gitUrl.replace(/\.git$/, '').replace(/^git@([^:]+):/, 'https://$1/');
-    if (/^https?:\/\//.test(httpUrl))
-        return `${httpUrl}/compare/${branch}?expand=1`;
-    return undefined;
+    throw new Error(`Cannot infer manager-pack location for '${base}' (expected manager_context.md, manager_rules.md, a personal learning file, or a full capability path like jobs/<cat>/<name>.md or employees/<slug>.json)`);
 }
 async function publishManagerArtifacts(artifacts, opts) {
     const managerStorage = (0, user_config_1.getManagerStorageConfig)();
@@ -42,7 +33,13 @@ async function publishManagerArtifacts(artifacts, opts) {
         throw new Error('No artifacts to publish.');
     for (const artifact of artifacts) {
         if (!(0, manager_pack_1.isManagerPackRelativePath)(artifact.relativePath)) {
-            throw new Error(`Invalid manager-pack path '${artifact.relativePath}' (must be context/manager_context.md, rules/manager_rules.md, or learnings/<user>-*.md).`);
+            throw new Error(`Invalid manager-pack path '${artifact.relativePath}' (must be context/manager_context.md, rules/manager_rules.md, learnings/<user>-*.md, or a capability path like jobs/<cat>/<name>.md or employees/<slug>.json).`);
+        }
+    }
+    const deletions = opts?.deletions ?? [];
+    for (const relativePath of deletions) {
+        if (!(0, manager_pack_1.isManagerPackRelativePath)(relativePath)) {
+            throw new Error(`Invalid manager-pack deletion path '${relativePath}'.`);
         }
     }
     if (managerStorage.backend === 'local-folder') {
@@ -55,7 +52,8 @@ async function publishManagerArtifacts(artifacts, opts) {
             }
             writtenPaths.push(path_1.default.join(localPath, artifact.relativePath));
         }
-        return { backend: 'local-folder', writtenPaths };
+        const deletedPaths = (0, local_folder_sync_1.removeLocalFolderFiles)(localPath, deletions, artifacts.map((a) => a.relativePath));
+        return { backend: 'local-folder', writtenPaths, deletedPaths };
     }
     if (managerStorage.backend === 'fraim-cloud') {
         const remoteUrl = opts?.remoteUrl || process.env.FRAIM_REMOTE_URL || 'https://fraim.wellnessatwork.me';
@@ -65,27 +63,27 @@ async function publishManagerArtifacts(artifacts, opts) {
         const res = await axios_1.default.post(`${remoteUrl.replace(/\/$/, '')}/api/manager/publish`, { artifacts }, { headers: { 'x-api-key': apiKey }, timeout: 30_000 });
         return { backend: 'fraim-cloud', version: String(res.data?.version ?? '') };
     }
-    const gitUrl = managerStorage.gitUrl;
-    if (!ALLOWED_GIT_URL.test(gitUrl))
-        throw new Error(`Manager repo URL has an unsupported scheme: ${gitUrl}`);
-    const dir = fs_1.default.mkdtempSync(path_1.default.join(os_1.default.tmpdir(), 'fraim-manager-pub-'));
-    try {
-        (0, child_process_1.execFileSync)('git', ['clone', '--depth=1', '--quiet', '--', gitUrl, '.'], {
-            cwd: dir, stdio: ['ignore', 'pipe', 'pipe'], timeout: 60_000
-        });
-        const branch = `fraim-manager-update-${opts?.branchSuffix || `${process.pid}-${Date.now()}`}`;
-        (0, child_process_1.execFileSync)('git', ['checkout', '-b', branch], { cwd: dir, stdio: ['ignore', 'pipe', 'pipe'] });
-        for (const artifact of artifacts) {
-            const dest = path_1.default.join(dir, artifact.relativePath);
-            fs_1.default.mkdirSync(path_1.default.dirname(dest), { recursive: true });
-            fs_1.default.writeFileSync(dest, artifact.content);
-        }
-        (0, child_process_1.execFileSync)('git', ['add', '-A'], { cwd: dir, stdio: ['ignore', 'pipe', 'pipe'] });
-        (0, child_process_1.execFileSync)('git', ['commit', '-m', 'Update manager context'], { cwd: dir, stdio: ['ignore', 'pipe', 'pipe'] });
-        (0, child_process_1.execFileSync)('git', ['push', '--quiet', 'origin', branch], { cwd: dir, stdio: ['ignore', 'pipe', 'pipe'], timeout: 60_000 });
-        return { backend: 'git', branch, prUrl: gitCompareUrl(gitUrl, branch) };
-    }
-    finally {
-        fs_1.default.rmSync(dir, { recursive: true, force: true });
-    }
+    const change = (0, pack_git_publish_1.describePackChange)('manager', artifacts, deletions);
+    const published = await (0, pack_git_publish_1.publishPackToGitRepo)({
+        gitUrl: managerStorage.gitUrl,
+        artifacts,
+        deletions,
+        branchSuffix: opts?.branchSuffix,
+        branchPrefix: 'fraim-manager-update-',
+        commitMessage: change.title,
+        prTitle: change.title,
+        prBody: change.body,
+        openPullRequest: opts?.openPullRequest,
+        // Publish from the durable pack home, not a throwaway clone.
+        cloneDir: (0, pack_home_1.resolvePackHome)('manager').root,
+    });
+    return {
+        backend: 'git',
+        branch: published.branch,
+        prUrl: published.prUrl,
+        prCreated: published.prCreated,
+        prBlockedReason: published.prBlockedReason,
+        credentialWarning: published.credentialWarning,
+        deletedPaths: deletions,
+    };
 }

package/dist/src/cli/utils/org-pack-sync.js

@@ -3,12 +3,12 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
     return (mod && mod.__esModule) ? mod : { "default": mod };
 };
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.ORG_CACHE_MANAGED_HEADER = exports.ORG_SYNC_METADATA_FILE = exports.ORG_CACHE_DIRNAME = exports.shouldDecorateAsMarkdown = void 0;
+exports.ORG_MANAGED_HEADER = exports.ORG_SYNC_METADATA_FILE = exports.ORG_HOME_DIRNAME = exports.shouldDecorateAsMarkdown = void 0;
 exports.isSafePackPath = isSafePackPath;
 exports.isSafeOrgCapabilityPackPath = isSafeOrgCapabilityPackPath;
-exports.getOrgCacheDir = getOrgCacheDir;
-exports.readOrgCacheMetadata = readOrgCacheMetadata;
-exports.getOrgCacheAgeHours = getOrgCacheAgeHours;
+exports.getOrgHomeDir = getOrgHomeDir;
+exports.readOrgSyncMetadata = readOrgSyncMetadata;
+exports.getOrgSyncAgeHours = getOrgSyncAgeHours;
 exports.syncOrgCache = syncOrgCache;
 /**
  * Org cache sync (issue #563).
@@ -27,16 +27,20 @@ const fs_1 = __importDefault(require("fs"));
 const path_1 = __importDefault(require("path"));
 const project_fraim_paths_1 = require("../../core/utils/project-fraim-paths");
 const user_config_1 = require("./user-config");
-const git_org_sync_1 = require("./git-org-sync");
+const pack_home_1 = require("./pack-home");
 const local_folder_sync_1 = require("./local-folder-sync");
 const capability_pack_1 = require("../../core/capability-pack");
 var capability_pack_2 = require("../../core/capability-pack");
 Object.defineProperty(exports, "shouldDecorateAsMarkdown", { enumerable: true, get: function () { return capability_pack_2.shouldDecorateAsMarkdown; } });
-exports.ORG_CACHE_DIRNAME = 'org';
+exports.ORG_HOME_DIRNAME = 'org';
 exports.ORG_SYNC_METADATA_FILE = '.org-sync-metadata.json';
-exports.ORG_CACHE_MANAGED_HEADER = '<!-- FRAIM_ORG_SYNC_MANAGED_CONTENT -->';
-/** Subdirectories of the org pack that sync into the cache (spec R7.1). */
-const ORG_PACK_DIRS = ['context', 'rules', 'learnings', 'jobs', 'skills', 'templates'];
+exports.ORG_MANAGED_HEADER = '<!-- FRAIM_ORG_SYNC_MANAGED_CONTENT -->';
+/**
+ * Subdirectories of the org pack that sync into the cache (spec R7.1).
+ * Issue #1043 adds 'employees' so an org-shared employee record reaches the
+ * cache that custom-employees.ts reads.
+ */
+const ORG_PACK_DIRS = ['context', 'rules', 'learnings', 'jobs', 'skills', 'templates', 'employees'];
 /**
  * Pack files must stay inside the three org pack directories. Applied to
  * every relativePath before it touches the filesystem, so a compromised
@@ -70,22 +74,51 @@ function isSafeOrgCapabilityPackPath(relativePath) {
         return false;
     return true;
 }
-function getOrgCacheDir() {
-    return path_1.default.join((0, project_fraim_paths_1.getUserFraimDirPath)(), exports.ORG_CACHE_DIRNAME);
+/**
+ * The layer's single home. Named `getOrgHomeDir` for backward compatibility with
+ * existing callers; issue #1043 round 2 removed the separate cache it used to
+ * point at, so this now resolves the one place the layer lives.
+ */
+function getOrgHomeDir() {
+    return (0, pack_home_1.resolvePackHome)('org').root;
+}
+/**
+ * Where sync provenance is recorded.
+ *
+ * Deliberately NOT inside the home. The home is the user's own content: for a
+ * git backend it is a real working tree, so a metadata file there shows up as
+ * an untracked change in their pack repo, and for a synced folder it would
+ * replicate machine-local bookkeeping to every other machine. Provenance is
+ * local state, so it belongs in ~/.fraim beside the config.
+ */
+function syncMetadataPath() {
+    return path_1.default.join((0, project_fraim_paths_1.getUserFraimDirPath)(), exports.ORG_SYNC_METADATA_FILE);
+}
+/** Record when and from where this machine last synced. Never touches the home. */
+function writeHomeMetadata(metadata) {
+    try {
+        fs_1.default.mkdirSync((0, project_fraim_paths_1.getUserFraimDirPath)(), { recursive: true });
+        fs_1.default.writeFileSync(syncMetadataPath(), JSON.stringify(metadata, null, 2));
+    }
+    catch { /* provenance is best-effort; never fail a sync over it */ }
 }
-function readOrgCacheMetadata() {
+function readOrgSyncMetadata() {
     try {
-        const metadataPath = path_1.default.join(getOrgCacheDir(), exports.ORG_SYNC_METADATA_FILE);
-        if (!fs_1.default.existsSync(metadataPath))
+        const metadataPath = syncMetadataPath();
+        if (fs_1.default.existsSync(metadataPath))
+            return JSON.parse(fs_1.default.readFileSync(metadataPath, 'utf8'));
+        // A machine that last synced before provenance moved out of the home.
+        const legacy = path_1.default.join(getOrgHomeDir(), exports.ORG_SYNC_METADATA_FILE);
+        if (!fs_1.default.existsSync(legacy))
             return null;
-        return JSON.parse(fs_1.default.readFileSync(metadataPath, 'utf8'));
+        return JSON.parse(fs_1.default.readFileSync(legacy, 'utf8'));
     }
     catch {
         return null;
     }
 }
-function getOrgCacheAgeHours() {
-    const metadata = readOrgCacheMetadata();
+function getOrgSyncAgeHours() {
+    const metadata = readOrgSyncMetadata();
     if (!metadata?.syncedAt)
         return null;
     const syncedAt = Date.parse(metadata.syncedAt);
@@ -95,7 +128,7 @@ function getOrgCacheAgeHours() {
 }
 function decorateManagedOrgFile(content, backend) {
     const normalized = content.replace(/^/, '');
-    if (normalized.startsWith(exports.ORG_CACHE_MANAGED_HEADER))
+    if (normalized.startsWith(exports.ORG_MANAGED_HEADER))
         return normalized;
     const writePath = backend === 'git'
         ? 'open a pull request against your organization repo'
@@ -103,7 +136,7 @@ function decorateManagedOrgFile(content, backend) {
             ? 'edit the file in your synced folder and let the sync client upload it'
             : 'update it through the organization-onboarding flow';
     const marker = [
-        exports.ORG_CACHE_MANAGED_HEADER,
+        exports.ORG_MANAGED_HEADER,
         '> [!IMPORTANT]',
         '> Synced from your organization\'s shared context. Local edits are overwritten on the next sync.',
         `> To change this content, ${writePath}.`,
@@ -145,8 +178,8 @@ async function fetchCloudPack(remoteUrl, apiKey) {
     };
 }
 /** Replace the cache contents atomically: stage fully, then swap. */
-function materializeCache(files, metadata) {
-    const cacheDir = getOrgCacheDir();
+function materializeCloudHome(files, metadata) {
+    const cacheDir = getOrgHomeDir();
     const stagingDir = `${cacheDir}.staging-${process.pid}`;
     fs_1.default.rmSync(stagingDir, { recursive: true, force: true });
     fs_1.default.mkdirSync(stagingDir, { recursive: true });
@@ -162,7 +195,7 @@ function materializeCache(files, metadata) {
             : file.content;
         fs_1.default.writeFileSync(destination, content);
     }
-    fs_1.default.writeFileSync(path_1.default.join(stagingDir, exports.ORG_SYNC_METADATA_FILE), JSON.stringify(metadata, null, 2));
+    // Provenance is written outside the home by writeHomeMetadata.
     fs_1.default.rmSync(cacheDir, { recursive: true, force: true });
     fs_1.default.renameSync(stagingDir, cacheDir);
 }
@@ -191,12 +224,12 @@ async function discoverCloudOrganization(options) {
 }
 function failureOutcome(error) {
     const message = error instanceof Error ? error.message : String(error);
-    const existing = readOrgCacheMetadata();
+    const existing = readOrgSyncMetadata();
     if (existing) {
         return {
             status: 'stale',
             metadata: existing,
-            ageHours: getOrgCacheAgeHours() ?? 0,
+            ageHours: getOrgSyncAgeHours() ?? 0,
             error: message
         };
     }
@@ -221,32 +254,35 @@ async function syncOrgCache(options) {
     }
     try {
         if (organization.backend === 'local-folder') {
+            // Issue #1043 round 2: the configured folder IS the home. There is
+            // no cache to materialize into; the OS sync client is the transport
+            // and the files are already the single place FRAIM reads.
             const localPath = organization.localPath;
-            const files = (0, local_folder_sync_1.collectLocalFolderFiles)(localPath, (rel) => isSafePackPath(rel) || isSafeOrgCapabilityPackPath(rel));
             const metadata = {
                 version: (0, local_folder_sync_1.localFolderVersion)(localPath),
                 backend: 'local-folder',
                 source: localPath,
                 syncedAt: new Date().toISOString(),
             };
-            materializeCache(files, metadata);
+            writeHomeMetadata(metadata);
             return { status: 'synced', metadata };
         }
         if (organization.backend === 'git') {
-            const snapshot = (0, git_org_sync_1.fetchOrgRepoSnapshot)(organization.gitUrl);
-            try {
-                const metadata = {
-                    version: snapshot.sha,
-                    backend: 'git',
-                    source: organization.gitUrl,
-                    syncedAt: new Date().toISOString()
-                };
-                materializeCache(collectGitPackFiles(snapshot.dir), metadata);
-                return { status: 'synced', metadata };
-            }
-            finally {
-                snapshot.cleanup();
-            }
+            // Issue #1043 round 2: the durable clone IS the home. ensurePackClone
+            // already fast-forwarded it, so syncing is that pull, not a copy into
+            // a second location.
+            const home = (0, pack_home_1.resolvePackHome)('org');
+            const clone = (0, pack_home_1.ensurePackClone)(organization.gitUrl, home.root);
+            if (clone.sha === null)
+                throw new Error(clone.offlineReason ?? 'Pack clone unavailable.');
+            const metadata = {
+                version: clone.sha,
+                backend: 'git',
+                source: organization.gitUrl,
+                syncedAt: new Date().toISOString()
+            };
+            writeHomeMetadata(metadata);
+            return { status: 'synced', metadata };
         }
         const remoteUrl = options?.remoteUrl || process.env.FRAIM_REMOTE_URL || 'https://fraim.wellnessatwork.me';
         const apiKey = options?.apiKey || (0, user_config_1.readUserFraimConfig)().apiKey;
@@ -259,7 +295,10 @@ async function syncOrgCache(options) {
             source: remoteUrl,
             syncedAt: new Date().toISOString()
         };
-        materializeCache(pack.files, metadata);
+        // The cloud has no user-visible folder, so this managed directory is the
+        // home for that backend, not a cache beside one.
+        materializeCloudHome(pack.files, metadata);
+        writeHomeMetadata(metadata);
         return { status: 'synced', metadata };
     }
     catch (error) {

package/dist/src/cli/utils/org-publish.js

@@ -13,24 +13,22 @@ exports.publishOrgArtifacts = publishOrgArtifacts;
  * call: the read side is the synced `~/.fraim/org/` cache, the write side is
  * here. Supports both backends:
  *   - fraim-cloud: POST /api/org/publish (authenticated by the user's API key)
- *   - git: shallow-clone the org repo, write the files on a branch, push it,
- *     and return the PR compare URL for the team to merge.
+ *   - git: shallow-clone the org repo, apply the writes and deletions on a
+ *     branch as one commit, push it, and open the pull request for the team.
  */
 const axios_1 = __importDefault(require("axios"));
-const child_process_1 = require("child_process");
-const fs_1 = __importDefault(require("fs"));
-const os_1 = __importDefault(require("os"));
 const path_1 = __importDefault(require("path"));
 const user_config_1 = require("./user-config");
 const local_folder_sync_1 = require("./local-folder-sync");
 const capability_pack_1 = require("../../core/capability-pack");
+const pack_git_publish_1 = require("./pack-git-publish");
+const pack_home_1 = require("./pack-home");
 const PACK_RELATIVE_PATH = /^(context|rules|learnings)\/[\w.-]+\.md$/;
 // #868: the company brand descriptor is JSON stored beside org_context.md. It
 // publishes through the same backends as org markdown but is delivered verbatim
 // (no managed-content header — that decoration is markdown-only, added on sync).
 // Mirrors org-pack-sync.isSafePackPath and fraim-mcp-server.isOrgPackPublishRelativePath.
 const ORG_BRAND_PACK_PATH = 'context/org_brand.json';
-const ALLOWED_GIT_URL = /^(https?:\/\/|ssh:\/\/|git:\/\/|file:\/\/|[\w.-]+@[\w.-]+:)/;
 /**
  * Infer the org-pack location for a local file by its name or path:
  *   org_context.md -> context/org_context.md
@@ -56,12 +54,6 @@ function packRelativePathFor(filePath) {
         return `learnings/${base}`;
     throw new Error(`Cannot infer org-pack location for '${base}' (expected org_context.md, org_rules.md, org_brand.json, org-*.md, or a capability path like jobs/<cat>/<name>.md)`);
 }
-function gitCompareUrl(gitUrl, branch) {
-    const httpUrl = gitUrl.replace(/\.git$/, '').replace(/^git@([^:]+):/, 'https://$1/');
-    if (/^https?:\/\//.test(httpUrl))
-        return `${httpUrl}/compare/${branch}?expand=1`;
-    return undefined;
-}
 /**
  * Publish a set of org artifacts to the configured backend. Throws with a clear
  * message when no backend is configured, a path is outside the pack layout, or
@@ -74,13 +66,17 @@ async function publishOrgArtifacts(artifacts, opts) {
     }
     if (artifacts.length === 0)
         throw new Error('No artifacts to publish.');
+    const isValidOrgPackPath = (rel) => PACK_RELATIVE_PATH.test(rel) || rel === ORG_BRAND_PACK_PATH || (0, capability_pack_1.isCapabilityPackPath)(rel);
     for (const a of artifacts) {
-        const isLegacyPath = PACK_RELATIVE_PATH.test(a.relativePath) || a.relativePath === ORG_BRAND_PACK_PATH;
-        const isCapabilityPath = (0, capability_pack_1.isCapabilityPackPath)(a.relativePath);
-        if (!isLegacyPath && !isCapabilityPath) {
-            throw new Error(`Invalid org-pack path '${a.relativePath}' (must be context|rules|learnings/<name>.md, context/org_brand.json, or a capability path like jobs/<cat>/<name>.md).`);
+        if (!isValidOrgPackPath(a.relativePath)) {
+            throw new Error(`Invalid org-pack path '${a.relativePath}' (must be context|rules|learnings/<name>.md, context/org_brand.json, or a capability path like jobs/<cat>/<name>.md or employees/<slug>.json).`);
         }
     }
+    const deletions = opts?.deletions ?? [];
+    for (const rel of deletions) {
+        if (!isValidOrgPackPath(rel))
+            throw new Error(`Invalid org-pack deletion path '${rel}'.`);
+    }
     if (organization.backend === 'local-folder') {
         const localPath = organization.localPath;
         const writtenPaths = [];
@@ -91,7 +87,8 @@ async function publishOrgArtifacts(artifacts, opts) {
             }
             writtenPaths.push(path_1.default.join(localPath, a.relativePath));
         }
-        return { backend: 'local-folder', writtenPaths };
+        const deletedPaths = (0, local_folder_sync_1.removeLocalFolderFiles)(localPath, deletions, artifacts.map((a) => a.relativePath));
+        return { backend: 'local-folder', writtenPaths, deletedPaths };
     }
     if (organization.backend === 'fraim-cloud') {
         const remoteUrl = opts?.remoteUrl || process.env.FRAIM_REMOTE_URL || 'https://fraim.wellnessatwork.me';
@@ -102,27 +99,27 @@ async function publishOrgArtifacts(artifacts, opts) {
         return { backend: 'fraim-cloud', version: String(res.data?.version ?? '') };
     }
     // git backend
-    const gitUrl = organization.gitUrl;
-    if (!ALLOWED_GIT_URL.test(gitUrl))
-        throw new Error(`Org repo URL has an unsupported scheme: ${gitUrl}`);
-    const dir = fs_1.default.mkdtempSync(path_1.default.join(os_1.default.tmpdir(), 'fraim-org-pub-'));
-    try {
-        (0, child_process_1.execFileSync)('git', ['clone', '--depth=1', '--quiet', '--', gitUrl, '.'], {
-            cwd: dir, stdio: ['ignore', 'pipe', 'pipe'], timeout: 60_000
-        });
-        const branch = `fraim-org-update-${opts?.branchSuffix || `${process.pid}-${Date.now()}`}`;
-        (0, child_process_1.execFileSync)('git', ['checkout', '-b', branch], { cwd: dir, stdio: ['ignore', 'pipe', 'pipe'] });
-        for (const a of artifacts) {
-            const dest = path_1.default.join(dir, a.relativePath);
-            fs_1.default.mkdirSync(path_1.default.dirname(dest), { recursive: true });
-            fs_1.default.writeFileSync(dest, a.content);
-        }
-        (0, child_process_1.execFileSync)('git', ['add', '-A'], { cwd: dir, stdio: ['ignore', 'pipe', 'pipe'] });
-        (0, child_process_1.execFileSync)('git', ['commit', '-m', 'Update organization context'], { cwd: dir, stdio: ['ignore', 'pipe', 'pipe'] });
-        (0, child_process_1.execFileSync)('git', ['push', '--quiet', 'origin', branch], { cwd: dir, stdio: ['ignore', 'pipe', 'pipe'], timeout: 60_000 });
-        return { backend: 'git', branch, prUrl: gitCompareUrl(gitUrl, branch) };
-    }
-    finally {
-        fs_1.default.rmSync(dir, { recursive: true, force: true });
-    }
+    const change = (0, pack_git_publish_1.describePackChange)('organization', artifacts, deletions);
+    const published = await (0, pack_git_publish_1.publishPackToGitRepo)({
+        gitUrl: organization.gitUrl,
+        artifacts,
+        deletions,
+        branchSuffix: opts?.branchSuffix,
+        branchPrefix: 'fraim-org-update-',
+        commitMessage: change.title,
+        prTitle: change.title,
+        prBody: change.body,
+        openPullRequest: opts?.openPullRequest,
+        // Publish from the durable pack home, not a throwaway clone.
+        cloneDir: (0, pack_home_1.resolvePackHome)('org').root,
+    });
+    return {
+        backend: 'git',
+        branch: published.branch,
+        prUrl: published.prUrl,
+        prCreated: published.prCreated,
+        prBlockedReason: published.prBlockedReason,
+        credentialWarning: published.credentialWarning,
+        deletedPaths: deletions,
+    };
 }