fullstackgtm 0.49.0 → 0.50.1

package/src/hostedAcquireCheckpoint.ts

@@ -0,0 +1,156 @@
+/**
+ * Authenticated acquisition-checkpoint transport for paired CLI installs.
+ *
+ * The local checkpoint remains authoritative for running a job. This module
+ * only mirrors/query-scoped continuation state to the paired hosted app so a
+ * different authenticated worker can resume it. Writes use compare-and-swap:
+ * a stale client receives a conflict and must explicitly reconcile instead of
+ * silently moving a provider cursor backwards or overwriting another worker.
+ */
+import { getCredential } from "./credentials.ts";
+import type { AcquireDiscoveryCheckpoint } from "./enrich.ts";
+
+const ENDPOINT = "/api/cli/acquisition-checkpoint";
+const DEFAULT_TIMEOUT_MS = 4000;
+const CHECKPOINT_KEY = /^[A-Za-z0-9][A-Za-z0-9._:-]{0,255}$/;
+
+export type HostedAcquireCheckpoint = {
+  checkpoint: AcquireDiscoveryCheckpoint;
+  /** Opaque server revision used only for compare-and-swap. */
+  version: number;
+  updatedAt: number;
+};
+
+export type HostedCheckpointReadResult =
+  | { status: "unpaired" }
+  | { status: "missing" }
+  | { status: "found"; record: HostedAcquireCheckpoint }
+  | { status: "unavailable"; reason: string };
+
+export type HostedCheckpointWriteResult =
+  | { status: "unpaired" }
+  | { status: "saved"; record: HostedAcquireCheckpoint }
+  | { status: "conflict"; current: HostedAcquireCheckpoint | null }
+  | { status: "unavailable"; reason: string };
+
+type Options = { fetchImpl?: typeof fetch; timeoutMs?: number };
+
+function validKey(key: string): string {
+  if (!CHECKPOINT_KEY.test(key)) {
+    throw new Error("Acquisition checkpoint key must be 1-256 URL-safe characters.");
+  }
+  return key;
+}
+
+function broker(): { baseUrl: string; accessToken: string } | null {
+  const credential = getCredential("broker");
+  if (!credential?.baseUrl || !credential.accessToken) return null;
+  let url: URL;
+  try {
+    url = new URL(credential.baseUrl);
+  } catch {
+    return null;
+  }
+  const local = url.hostname === "localhost" || url.hostname === "127.0.0.1" || url.hostname === "[::1]";
+  if (url.protocol !== "https:" && !(url.protocol === "http:" && local)) return null;
+  return { baseUrl: url.href.replace(/\/+$/, ""), accessToken: credential.accessToken };
+}
+
+function isCheckpoint(value: unknown): value is AcquireDiscoveryCheckpoint {
+  if (!value || typeof value !== "object") return false;
+  const item = value as Record<string, unknown>;
+  return (
+    typeof item.queryFingerprint === "string" &&
+    item.queryFingerprint.length > 0 &&
+    typeof item.exhausted === "boolean" &&
+    (item.cursor === undefined || item.cursor === null || typeof item.cursor === "string") &&
+    (item.offset === undefined || item.offset === null ||
+      (typeof item.offset === "number" && Number.isSafeInteger(item.offset) && item.offset >= 0))
+  );
+}
+
+function parseRecord(value: unknown): HostedAcquireCheckpoint | null {
+  if (!value || typeof value !== "object") return null;
+  const body = value as Record<string, unknown>;
+  if (!isCheckpoint(body.checkpoint) || !Number.isSafeInteger(body.version) || (body.version as number) < 1) return null;
+  if (!Number.isSafeInteger(body.updatedAt) || (body.updatedAt as number) < 0) return null;
+  return {
+    checkpoint: body.checkpoint,
+    version: body.version as number,
+    updatedAt: body.updatedAt as number,
+  };
+}
+
+function reasonFor(status: number): string {
+  if (status === 401 || status === 403) return "hosted authentication was rejected; pair the CLI again";
+  return `hosted checkpoint request failed (HTTP ${status})`;
+}
+
+/** Read a query/list checkpoint. Inert unless this profile is paired. */
+export async function readHostedAcquireCheckpoint(
+  key: string,
+  options: Options = {},
+): Promise<HostedCheckpointReadResult> {
+  validKey(key);
+  const paired = broker();
+  if (!paired) return { status: "unpaired" };
+  try {
+    const response = await (options.fetchImpl ?? fetch)(
+      `${paired.baseUrl}${ENDPOINT}?key=${encodeURIComponent(key)}`,
+      {
+        headers: { Authorization: `Bearer ${paired.accessToken}`, Accept: "application/json" },
+        signal: AbortSignal.timeout(options.timeoutMs ?? DEFAULT_TIMEOUT_MS),
+      },
+    );
+    if (response.status === 404) return { status: "missing" };
+    if (!response.ok) return { status: "unavailable", reason: reasonFor(response.status) };
+    const record = parseRecord(await response.json());
+    return record
+      ? { status: "found", record }
+      : { status: "unavailable", reason: "hosted checkpoint response was invalid" };
+  } catch {
+    return { status: "unavailable", reason: "hosted checkpoint request was unavailable" };
+  }
+}
+
+/**
+ * Mirror a local checkpoint using compare-and-swap. Pass null only when the
+ * caller observed no hosted record (sent as version zero); pass the exact
+ * positive version returned by read for an update.
+ */
+export async function writeHostedAcquireCheckpoint(
+  key: string,
+  checkpoint: AcquireDiscoveryCheckpoint,
+  expectedVersion: number | null,
+  options: Options = {},
+): Promise<HostedCheckpointWriteResult> {
+  validKey(key);
+  if (!isCheckpoint(checkpoint)) throw new Error("Refusing to sync an invalid acquisition checkpoint.");
+  if (expectedVersion !== null && (!Number.isSafeInteger(expectedVersion) || expectedVersion < 1)) {
+    throw new Error("expectedVersion must be null or a positive integer.");
+  }
+  const paired = broker();
+  if (!paired) return { status: "unpaired" };
+  try {
+    const response = await (options.fetchImpl ?? fetch)(`${paired.baseUrl}${ENDPOINT}`, {
+      method: "POST",
+      headers: { Authorization: `Bearer ${paired.accessToken}`, "Content-Type": "application/json" },
+      body: JSON.stringify({ key, checkpoint, expectedVersion: expectedVersion ?? 0 }),
+      signal: AbortSignal.timeout(options.timeoutMs ?? DEFAULT_TIMEOUT_MS),
+    });
+    if (response.status === 409) {
+      const body: unknown = await response.json().catch(() => null);
+      const current = body && typeof body === "object"
+        ? parseRecord((body as Record<string, unknown>).current)
+        : null;
+      return { status: "conflict", current };
+    }
+    if (!response.ok) return { status: "unavailable", reason: reasonFor(response.status) };
+    const record = parseRecord(await response.json());
+    return record
+      ? { status: "saved", record }
+      : { status: "unavailable", reason: "hosted checkpoint response was invalid" };
+  } catch {
+    return { status: "unavailable", reason: "hosted checkpoint request was unavailable" };
+  }
+}

package/src/hostedPatchPlan.ts

@@ -0,0 +1,291 @@
+/** Broker-authenticated mirror for locally governed patch plans. */
+import { createHash } from "node:crypto";
+import { getCredential } from "./credentials.ts";
+import type { PlanStore, StoredPlan } from "./planStore.ts";
+import type { CrmProvider, PatchOperation, PatchOperationResult, PatchPlan, PatchPlanRun } from "./types.ts";
+
+const ENDPOINT = "/api/cli/patch-plan";
+const TIMEOUT_MS = 5000;
+
+type Options = { fetchImpl?: typeof fetch; timeoutMs?: number };
+export type HostedPlanState = {
+  patchPlanId: string;
+  externalPlanId: string;
+  documentSha256: string;
+  status: string;
+  approvedOperationIds: string[];
+  valueOverrides: Record<string, unknown>;
+  updatedAt: number;
+  runRecord?: PatchPlanRun;
+  url: string;
+};
+export type HostedPlanResult =
+  | { status: "unpaired" }
+  | { status: "missing" }
+  | { status: "found" | "saved"; state: HostedPlanState }
+  | { status: "conflict"; reason: string }
+  | { status: "unavailable"; reason: string };
+
+function broker(): { baseUrl: string; token: string } | null {
+  const value = getCredential("broker");
+  if (!value?.baseUrl || !value.accessToken) return null;
+  try {
+    const url = new URL(value.baseUrl);
+    const local = ["localhost", "127.0.0.1", "[::1]"].includes(url.hostname);
+    if (url.protocol !== "https:" && !(url.protocol === "http:" && local)) return null;
+    return { baseUrl: url.href.replace(/\/+$/, ""), token: value.accessToken };
+  } catch { return null; }
+}
+
+/** Review document intentionally omits evidence/findings and all mutable store security state. */
+export function hostedReviewDocument(plan: PatchPlan) {
+  return {
+    id: plan.id,
+    title: plan.title,
+    createdAt: plan.createdAt,
+    status: "needs_approval",
+    dryRun: true,
+    summary: plan.summary,
+    operations: plan.operations,
+    ...(plan.filter ? { filter: plan.filter } : {}),
+    ...(plan.guards ? { guards: plan.guards } : {}),
+  };
+}
+
+export function hostedPlanDigest(plan: PatchPlan): string {
+  return createHash("sha256").update(JSON.stringify(hostedReviewDocument(plan))).digest("hex");
+}
+
+function mapOperation(op: PatchOperation) {
+  return {
+    packageOpId: op.id,
+    objectType: op.objectType,
+    ...(op.objectId ? { objectId: op.objectId } : {}),
+    fieldOrAction: op.field ?? op.operation,
+    beforeValue: op.beforeValue ?? null,
+    afterValue: op.afterValue ?? null,
+    ...(op.reason ? { reason: op.reason } : {}),
+    ...(op.sourceRuleOrPolicy ? { sourceRuleOrPolicy: op.sourceRuleOrPolicy } : {}),
+    riskLevel: op.riskLevel,
+    approvalRequired: op.approvalRequired,
+    ...(op.rollback ? { rollback: op.rollback } : {}),
+  };
+}
+
+function parseState(value: unknown, baseUrl: string): HostedPlanState | null {
+  if (!value || typeof value !== "object") return null;
+  const row = value as Record<string, unknown>;
+  const id = typeof row.patchPlanId === "string" ? row.patchPlanId : null;
+  if (!id) return null;
+  const approvedOperationIds = Array.isArray(row.approvedOperationIds) ? row.approvedOperationIds.filter((id): id is string => typeof id === "string") : [];
+  const runRecord = parseRunRecord(row.runRecord, row.operationReceipts, row.externalPlanId, row.updatedAt);
+  return {
+    patchPlanId: id,
+    externalPlanId: typeof row.externalPlanId === "string" ? row.externalPlanId : "",
+    documentSha256: typeof row.documentSha256 === "string" ? row.documentSha256 : "",
+    status: typeof row.status === "string" ? row.status : "pending_approval",
+    approvedOperationIds,
+    valueOverrides: row.valueOverrides && typeof row.valueOverrides === "object" && !Array.isArray(row.valueOverrides) ? row.valueOverrides as Record<string, unknown> : {},
+    updatedAt: typeof row.updatedAt === "number" ? row.updatedAt : Date.now(),
+    ...(runRecord ? { runRecord } : {}),
+    url: `${baseUrl}/dashboard/patch-plans?plan=${encodeURIComponent(id)}`,
+  };
+}
+
+function parseRunRecord(value: unknown, receiptsValue: unknown, externalPlanId: unknown, updatedAt: unknown): PatchPlanRun | undefined {
+  const row = value && typeof value === "object" && !Array.isArray(value) ? value as Record<string, unknown> : undefined;
+  const planId = typeof row?.planId === "string" ? row.planId : typeof externalPlanId === "string" ? externalPlanId : undefined;
+  if (!planId) return undefined;
+  const rawResults = Array.isArray(row?.results) ? row.results : Array.isArray(receiptsValue) ? receiptsValue : [];
+  const results = rawResults.flatMap((entry): PatchOperationResult[] => {
+    if (!entry || typeof entry !== "object") return [];
+    const receipt = entry as Record<string, unknown>;
+    const operationId = typeof receipt.operationId === "string" ? receipt.operationId : typeof receipt.packageOpId === "string" ? receipt.packageOpId : undefined;
+    const rawStatus = receipt.status;
+    const status = rawStatus === "applied" || rawStatus === "failed" || rawStatus === "skipped" || rawStatus === "conflict" ? rawStatus : undefined;
+    if (!operationId || !status) return [];
+    return [{ operationId, status, ...(typeof receipt.detail === "string" ? { detail: receipt.detail } : typeof receipt.error === "string" ? { detail: receipt.error } : {}), ...(receipt.providerData !== undefined ? { providerData: receipt.providerData } : {}) }];
+  });
+  if (results.length === 0) return undefined;
+  const timestamp = typeof updatedAt === "number" ? new Date(updatedAt).toISOString() : new Date().toISOString();
+  const provider = typeof row?.provider === "string" ? row.provider as CrmProvider : "mock";
+  const status = row?.status === "applied" || row?.status === "partial" || row?.status === "failed" || row?.status === "rejected"
+    ? row.status : results.every((result) => result.status === "applied" || result.status === "skipped") ? "applied" : "partial";
+  return {
+    planId, provider,
+    startedAt: typeof row?.startedAt === "string" ? row.startedAt : timestamp,
+    finishedAt: typeof row?.finishedAt === "string" ? row.finishedAt : timestamp,
+    status,
+    results,
+  };
+}
+
+function failure(status: number): HostedPlanResult {
+  if (status === 409) return { status: "conflict", reason: "hosted mirror has different immutable content" };
+  if (status === 401 || status === 403) return { status: "unavailable", reason: "hosted authentication was rejected; pair the CLI again" };
+  return { status: "unavailable", reason: `hosted plan request failed (HTTP ${status})` };
+}
+
+export async function uploadHostedPatchPlan(stored: StoredPlan, options: Options = {}): Promise<HostedPlanResult> {
+  const paired = broker();
+  if (!paired) return { status: "unpaired" };
+  const document = hostedReviewDocument(stored.plan);
+  const digest = hostedPlanDigest(stored.plan);
+  const riskOrder = { low: 0, medium: 1, high: 2 } as const;
+  const riskLevel = stored.plan.operations.reduce<"low" | "medium" | "high">(
+    (risk, op) => riskOrder[op.riskLevel] > riskOrder[risk] ? op.riskLevel : risk,
+    "low",
+  );
+  try {
+    const response = await (options.fetchImpl ?? fetch)(`${paired.baseUrl}${ENDPOINT}`, {
+      method: "POST",
+      headers: { Authorization: `Bearer ${paired.token}`, "Content-Type": "application/json" },
+      body: JSON.stringify({
+        externalPlanId: stored.plan.id, documentSha256: digest, externalRevision: stored.revision,
+        title: stored.plan.title, summary: stored.plan.summary, riskLevel, document,
+        operations: stored.plan.operations.map(mapOperation), createdAt: Date.parse(stored.plan.createdAt),
+      }),
+      signal: AbortSignal.timeout(options.timeoutMs ?? TIMEOUT_MS),
+    });
+    if (!response.ok) return failure(response.status);
+    const raw = await response.json() as Record<string, unknown>;
+    const state = parseState({ ...raw, externalPlanId: stored.plan.id, documentSha256: digest, approvedOperationIds: [], valueOverrides: {}, updatedAt: Date.now() }, paired.baseUrl);
+    return state ? { status: "saved", state } : { status: "unavailable", reason: "hosted plan response was invalid" };
+  } catch { return { status: "unavailable", reason: "hosted plan request was unavailable" }; }
+}
+
+export async function readHostedPatchPlan(planId: string, options: Options = {}): Promise<HostedPlanResult> {
+  const paired = broker();
+  if (!paired) return { status: "unpaired" };
+  try {
+    const response = await (options.fetchImpl ?? fetch)(`${paired.baseUrl}${ENDPOINT}?externalPlanId=${encodeURIComponent(planId)}`, {
+      headers: { Authorization: `Bearer ${paired.token}`, Accept: "application/json" },
+      signal: AbortSignal.timeout(options.timeoutMs ?? TIMEOUT_MS),
+    });
+    if (response.status === 404) return { status: "missing" };
+    if (!response.ok) return failure(response.status);
+    const state = parseState(await response.json(), paired.baseUrl);
+    return state ? { status: "found", state } : { status: "unavailable", reason: "hosted plan response was invalid" };
+  } catch { return { status: "unavailable", reason: "hosted plan request was unavailable" }; }
+}
+
+export type HostedReconcileResult =
+  | { status: "unchanged" | "unpaired" | "missing" }
+  | { status: "updated"; stored: StoredPlan; remoteStatus: string }
+  | { status: "conflict" | "unavailable"; reason: string };
+
+/** Pull a peer's newer lifecycle into the local replica without weakening local integrity gates. */
+export async function reconcileHostedPatchPlan(
+  store: PlanStore,
+  stored: StoredPlan,
+  options: Options = {},
+): Promise<HostedReconcileResult> {
+  const hosted = await readHostedPatchPlan(stored.plan.id, options);
+  if (hosted.status === "unpaired" || hosted.status === "missing") return { status: hosted.status };
+  if (hosted.status === "unavailable" || hosted.status === "conflict") return hosted;
+  if (hosted.state.documentSha256 !== hostedPlanDigest(stored.plan)) {
+    return { status: "conflict", reason: "hosted review content does not match the immutable local plan" };
+  }
+  if (!(["approved", "rejected", "applied"] as string[]).includes(hosted.state.status)) return { status: "unchanged" };
+  try {
+    const reconciled = await store.reconcileReplica(stored.plan.id, {
+      status: hosted.state.status as "approved" | "rejected" | "applied",
+      approvedOperationIds: hosted.state.approvedOperationIds,
+      valueOverrides: hosted.state.valueOverrides,
+      ...(hosted.state.runRecord ? { run: hosted.state.runRecord } : {}),
+    });
+    return reconciled.changed
+      ? { status: "updated", stored: reconciled.stored, remoteStatus: hosted.state.status }
+      : { status: "unchanged" };
+  } catch (error) {
+    return { status: "conflict", reason: error instanceof Error ? error.message : "replica reconciliation failed" };
+  }
+}
+
+export async function reportHostedPlanLifecycle(stored: StoredPlan, options: Options & { claimId?: string } = {}): Promise<HostedPlanResult> {
+  const paired = broker();
+  if (!paired) return { status: "unpaired" };
+  const status = stored.status === "applied" ? "applied" : stored.status === "rejected" ? "rejected" : "approved";
+  const runRecord = status === "applied" ? stored.runs.at(-1) : undefined;
+  // The hosted terminal transition is authority-bound to the exact approved
+  // subset. Local runs also record excluded operations as `skipped` for a
+  // complete human audit trail; those are not execution receipts and must not
+  // be echoed as though they were authorized provider work.
+  const approved = new Set(stored.approvedOperationIds);
+  const operationReceipts = runRecord?.results.filter((result) => approved.has(result.operationId)).map((result) => ({
+    packageOpId: result.operationId,
+    status: result.status,
+    ...(result.detail ? { error: result.detail.slice(0, 1000) } : {}),
+    ...(result.providerData !== undefined ? { providerData: result.providerData } : {}),
+    updatedAt: Date.parse(runRecord.finishedAt),
+  }));
+  try {
+    const response = await (options.fetchImpl ?? fetch)(`${paired.baseUrl}${ENDPOINT}`, {
+      method: "POST", headers: { Authorization: `Bearer ${paired.token}`, "Content-Type": "application/json" },
+      body: JSON.stringify({ action: "lifecycle", externalPlanId: stored.plan.id, documentSha256: hostedPlanDigest(stored.plan), status, approvedOperationIds: stored.approvedOperationIds, ...(options.claimId ? { claimId: options.claimId } : {}), ...(runRecord ? { runRecord, operationReceipts } : {}) }),
+      signal: AbortSignal.timeout(options.timeoutMs ?? TIMEOUT_MS),
+    });
+    if (!response.ok) return failure(response.status);
+    const raw = await response.json() as Record<string, unknown>;
+    const state = parseState({ ...raw, externalPlanId: stored.plan.id, documentSha256: hostedPlanDigest(stored.plan), approvedOperationIds: stored.approvedOperationIds, valueOverrides: stored.valueOverrides, updatedAt: Date.now() }, paired.baseUrl);
+    return state ? { status: "saved", state } : { status: "unavailable", reason: "hosted lifecycle response was invalid" };
+  } catch { return { status: "unavailable", reason: "hosted lifecycle request was unavailable" }; }
+}
+
+export type HostedApplyClaimResult =
+  | { status: "unpaired" }
+  | { status: "claimed"; claimId: string; expiresAt?: number }
+  | { status: "applied" }
+  | { status: "conflict" | "unavailable"; reason: string };
+
+/** Coordinate online replicas before provider I/O; provider idempotency remains the offline fallback. */
+export async function claimHostedPlanApply(stored: StoredPlan, options: Options = {}): Promise<HostedApplyClaimResult> {
+  const paired = broker();
+  if (!paired) return { status: "unpaired" };
+  try {
+    const response = await (options.fetchImpl ?? fetch)(`${paired.baseUrl}${ENDPOINT}`, {
+      method: "POST", headers: { Authorization: `Bearer ${paired.token}`, "Content-Type": "application/json" },
+      body: JSON.stringify({ action: "claim", externalPlanId: stored.plan.id, documentSha256: hostedPlanDigest(stored.plan) }),
+      signal: AbortSignal.timeout(options.timeoutMs ?? TIMEOUT_MS),
+    });
+    if (!response.ok) return failure(response.status) as HostedApplyClaimResult;
+    const row = await response.json() as Record<string, unknown>;
+    if (row.alreadyApplied === true || row.status === "applied") return { status: "applied" };
+    if (row.status === "claimed" && typeof row.claimId === "string") {
+      return { status: "claimed", claimId: row.claimId, ...(typeof row.expiresAt === "number" ? { expiresAt: row.expiresAt } : {}) };
+    }
+    return { status: "unavailable", reason: "hosted apply claim response was invalid" };
+  } catch { return { status: "unavailable", reason: "hosted apply claim request was unavailable" }; }
+}
+
+/** Release a shared CLI claim only when preflight aborts before provider I/O. */
+export async function releaseHostedPlanApply(
+  stored: StoredPlan,
+  claimId: string,
+  reason: string,
+  options: Options = {},
+): Promise<{ status: "released" | "unpaired" } | { status: "conflict" | "unavailable"; reason: string }> {
+  const paired = broker();
+  if (!paired) return { status: "unpaired" };
+  try {
+    const response = await (options.fetchImpl ?? fetch)(`${paired.baseUrl}${ENDPOINT}`, {
+      method: "POST",
+      headers: { Authorization: `Bearer ${paired.token}`, "Content-Type": "application/json" },
+      body: JSON.stringify({
+        action: "release_claim",
+        externalPlanId: stored.plan.id,
+        documentSha256: hostedPlanDigest(stored.plan),
+        claimId,
+        reason,
+      }),
+      signal: AbortSignal.timeout(options.timeoutMs ?? TIMEOUT_MS),
+    });
+    if (!response.ok) return failure(response.status) as { status: "conflict" | "unavailable"; reason: string };
+    const row = await response.json() as Record<string, unknown>;
+    return row.released === true
+      ? { status: "released" }
+      : { status: "unavailable", reason: "hosted apply claim release response was invalid" };
+  } catch {
+    return { status: "unavailable", reason: "hosted apply claim release was unavailable" };
+  }
+}

package/src/icp.ts

@@ -193,6 +193,15 @@ const CRUSTDATA_INDUSTRY: Record<string, string[]> = {
   "financial services": ["Financial Services"],
 };
 
+// Common NAICS groups translated into Crustdata's LinkedIn industry vocabulary.
+// This keeps an ICP authored with provider-neutral NAICS codes from silently
+// dropping its industry constraint on the Pipe0 path.
+const NAICS_CRUSTDATA_INDUSTRY: Record<string, string[]> = {
+  "5112": ["Software Development", "Computer Software"],
+  "5182": ["IT Services and IT Consulting", "Information Technology & Services"],
+  "5415": ["IT Services and IT Consulting", "Information Technology & Services"],
+};
+
 /**
  * pipe0 Crustdata people-search config.filters from the ICP. `current_job_titles`
  * matches real LinkedIn title strings (case-sensitive), so keywords are Title
@@ -219,9 +228,12 @@ export function icpToCrustdataFilters(icp: Icp): Record<string, unknown> {
   if (icp.firmographics.geos?.length) {
     f.locations = icp.firmographics.geos.map((g) => COUNTRY_NAMES[g.toLowerCase()] ?? g);
   }
-  if (icp.firmographics.industries?.length) {
+  if (icp.firmographics.industries?.length || icp.firmographics.naics?.length) {
     const inds = [
-      ...new Set(icp.firmographics.industries.flatMap((i) => CRUSTDATA_INDUSTRY[i.toLowerCase()] ?? [titleCase(i)])),
+      ...new Set([
+        ...(icp.firmographics.industries ?? []).flatMap((i) => CRUSTDATA_INDUSTRY[i.toLowerCase()] ?? [titleCase(i)]),
+        ...(icp.firmographics.naics ?? []).flatMap((code) => NAICS_CRUSTDATA_INDUSTRY[code] ?? []),
+      ]),
     ];
     if (inds.length) f.current_employers_linkedin_industries = inds;
   }

package/src/index.ts

@@ -1,4 +1,15 @@
 export { auditSnapshot, defaultPolicy } from "./audit.ts";
+export {
+  acquireCheckpointId,
+  acquireCheckpointsDir,
+  createFileAcquireCheckpointStore,
+  validateAcquireCheckpoint,
+  validateAcquireCheckpointKey,
+  type AcquireCheckpoint,
+  type AcquireCheckpointKey,
+  type AcquireCheckpointStore,
+  type AcquireContinuation,
+} from "./acquireCheckpoint.ts";
 export {
   matchesTerritory,
   parseAssignmentPolicy,
@@ -132,6 +143,7 @@ export {
   stagedSourceRecords,
   staleDaysFor,
   type BuildEnrichPlanOptions,
+  type AcquireDiscoveryCheckpoint,
   type EnrichAmbiguity,
   type EnrichConfig,
   type EnrichCounts,
@@ -148,6 +160,14 @@ export {
   type EnrichWorkItem,
   type MatchOutcome,
 } from "./enrich.ts";
+export {
+  readHostedAcquireCheckpoint,
+  writeHostedAcquireCheckpoint,
+  type HostedAcquireCheckpoint,
+  type HostedCheckpointReadResult,
+  type HostedCheckpointWriteResult,
+} from "./hostedAcquireCheckpoint.ts";
+export { claimHostedPlanApply, hostedPlanDigest, hostedReviewDocument, readHostedPatchPlan, reconcileHostedPatchPlan, releaseHostedPlanApply, reportHostedPlanLifecycle, uploadHostedPatchPlan } from "./hostedPatchPlan.ts";
 export {
   scaffoldWorkspace,
   starterEnrichConfig,

package/src/planStore.ts

@@ -32,6 +32,7 @@ export type StoredPlan = {
     id: string;
     claimedAt: string;
     revision: number;
+    hostedClaimId?: string;
   };
   /** Durable journal of apply ownership. An unresolved entry must never be replayed automatically. */
   applyAttempts?: ApplyAttempt[];
@@ -49,6 +50,7 @@ export type ApplyAttempt = {
   resolvedAt?: string;
   /** Deliberately generic: provider errors can contain CRM data or credentials. */
   note?: string;
+  hostedClaimId?: string;
 };
 
 export interface PlanStore {
@@ -62,12 +64,22 @@ export interface PlanStore {
   ): Promise<StoredPlan>;
   reject(planId: string): Promise<StoredPlan>;
   claimApply(planId: string, metadata?: Pick<ApplyAttempt, "provider" | "source">): Promise<{ stored: StoredPlan; claimId: string }>;
+  recordHostedClaim(planId: string, claimId: string, hostedClaimId: string): Promise<StoredPlan>;
   recordRun(planId: string, run: PatchPlanRun, claimId: string): Promise<StoredPlan>;
   abortApplyPreflight(planId: string, claimId: string, note: string): Promise<StoredPlan>;
   markApplyUncertain(planId: string, claimId: string): Promise<StoredPlan>;
   recoverApply(planId: string): Promise<StoredPlan>;
+  reconcileReplica(planId: string, remote: ReplicaPlanState): Promise<{ stored: StoredPlan; changed: boolean }>;
 }
 
+/** A validated lifecycle snapshot received from another plan replica. */
+export type ReplicaPlanState = {
+  status: "approved" | "rejected" | "applied";
+  approvedOperationIds: string[];
+  valueOverrides?: Record<string, unknown>;
+  run?: PatchPlanRun;
+};
+
 /**
  * Plans as JSON files in a directory (default `$FSGTM_HOME/plans`), one file
  * per plan id. Filesystem-shaped on purpose: greppable, diffable, and any
@@ -294,6 +306,21 @@ export function createFilePlanStore(directory?: string): PlanStore {
       });
     },
 
+    async recordHostedClaim(planId, claimId, hostedClaimId) {
+      return withPlanLock(planId, () => {
+        const stored = mustRead(planId);
+        if (stored.status !== "applying" || stored.applyClaim?.id !== claimId) {
+          throw new Error(`Refusing to attach hosted claim for plan ${planId}: local apply claim does not match.`);
+        }
+        return write({
+          ...stored,
+          applyClaim: { ...stored.applyClaim, hostedClaimId },
+          applyAttempts: (stored.applyAttempts ?? []).map((attempt) =>
+            attempt.id === claimId ? { ...attempt, hostedClaimId } : attempt),
+        });
+      });
+    },
+
     async abortApplyPreflight(planId, claimId, note) {
       return withPlanLock(planId, () => {
         const stored = mustRead(planId);
@@ -348,5 +375,65 @@ export function createFilePlanStore(directory?: string): PlanStore {
         });
       });
     },
+
+    async reconcileReplica(planId, remote) {
+      return withPlanLock(planId, () => {
+        const stored = mustRead(planId);
+        if (stored.status === "applying" || stored.applyClaim) {
+          throw new Error(`Plan ${planId} is applying locally; replica reconciliation will retry after it finishes.`);
+        }
+        const known = new Set(stored.plan.operations.map((operation) => operation.id));
+        const approvedOperationIds = Array.from(new Set(remote.approvedOperationIds));
+        if (approvedOperationIds.some((id) => !known.has(id))) {
+          throw new Error(`Replica state for ${planId} contains an unknown operation.`);
+        }
+        // Terminal receipts are monotonic. A delayed approval or rejection can
+        // never roll an already-applied local replica backwards.
+        if (stored.status === "applied" && remote.status !== "applied") {
+          return { stored, changed: false };
+        }
+        if (remote.status === "rejected") {
+          if (stored.status === "rejected") return { stored, changed: false };
+          return { stored: write({
+            ...stored, status: "rejected", approvedOperationIds: [], valueOverrides: {},
+            approvalDigests: undefined, applyClaim: undefined,
+          }), changed: true };
+        }
+        if (approvedOperationIds.length === 0) {
+          throw new Error(`Replica ${remote.status} state for ${planId} has no approved operations.`);
+        }
+        const valueOverrides = remote.valueOverrides ?? {};
+        const approvalDigests = computeApprovalDigests(
+          stored.plan.operations, approvedOperationIds, valueOverrides, loadOrCreateSigningKey(),
+        );
+        if (remote.status === "approved") {
+          const unchanged = stored.status === "approved"
+            && JSON.stringify(stored.approvedOperationIds) === JSON.stringify(approvedOperationIds)
+            && JSON.stringify(stored.valueOverrides) === JSON.stringify(valueOverrides);
+          if (unchanged) return { stored, changed: false };
+          return { stored: write({
+            ...stored, status: "approved", approvedOperationIds, valueOverrides, approvalDigests,
+          }), changed: true };
+        }
+        if (!remote.run || remote.run.planId !== planId) {
+          throw new Error(`Replica applied state for ${planId} is missing a matching execution receipt.`);
+        }
+        if (remote.run.results.some((result) => !known.has(result.operationId))) {
+          throw new Error(`Replica execution receipt for ${planId} contains an unknown operation.`);
+        }
+        const runKey = (run: PatchPlanRun) => `${run.startedAt}\0${run.finishedAt}\0${run.provider}`;
+        const alreadyRecorded = stored.runs.some((run) => runKey(run) === runKey(remote.run!));
+        if (stored.status === "applied" && alreadyRecorded) return { stored, changed: false };
+        return { stored: write({
+          ...stored,
+          status: "applied",
+          approvedOperationIds,
+          valueOverrides,
+          approvalDigests,
+          applyClaim: undefined,
+          runs: alreadyRecorded ? stored.runs : [...stored.runs, remote.run],
+        }), changed: true };
+      });
+    },
   };
 }

package/src/progress.ts

@@ -186,8 +186,8 @@ export const RUNS_REPLAY_STAGES = ["runs", "health"] as const;
 
 export const APPLY_STAGES = ["preflight", "operations", "results"] as const;
 
-/** `enrich acquire` — routing sourced candidate rows into a create plan. */
-export const ACQUIRE_STAGES = ["candidates"] as const;
+/** `enrich acquire` — discovery through a governed create plan. */
+export const ACQUIRE_STAGES = ["discovery", "resolution", "plan"] as const;
 
 export const MARKET_CAPTURE_STAGES = ["sources", "capture", "classify", "persist"] as const;