fullstackgtm 0.49.0 → 0.50.1

package/dist/hostedPatchPlan.js

@@ -0,0 +1,275 @@
+/** Broker-authenticated mirror for locally governed patch plans. */
+import { createHash } from "node:crypto";
+import { getCredential } from "./credentials.js";
+const ENDPOINT = "/api/cli/patch-plan";
+const TIMEOUT_MS = 5000;
+function broker() {
+    const value = getCredential("broker");
+    if (!value?.baseUrl || !value.accessToken)
+        return null;
+    try {
+        const url = new URL(value.baseUrl);
+        const local = ["localhost", "127.0.0.1", "[::1]"].includes(url.hostname);
+        if (url.protocol !== "https:" && !(url.protocol === "http:" && local))
+            return null;
+        return { baseUrl: url.href.replace(/\/+$/, ""), token: value.accessToken };
+    }
+    catch {
+        return null;
+    }
+}
+/** Review document intentionally omits evidence/findings and all mutable store security state. */
+export function hostedReviewDocument(plan) {
+    return {
+        id: plan.id,
+        title: plan.title,
+        createdAt: plan.createdAt,
+        status: "needs_approval",
+        dryRun: true,
+        summary: plan.summary,
+        operations: plan.operations,
+        ...(plan.filter ? { filter: plan.filter } : {}),
+        ...(plan.guards ? { guards: plan.guards } : {}),
+    };
+}
+export function hostedPlanDigest(plan) {
+    return createHash("sha256").update(JSON.stringify(hostedReviewDocument(plan))).digest("hex");
+}
+function mapOperation(op) {
+    return {
+        packageOpId: op.id,
+        objectType: op.objectType,
+        ...(op.objectId ? { objectId: op.objectId } : {}),
+        fieldOrAction: op.field ?? op.operation,
+        beforeValue: op.beforeValue ?? null,
+        afterValue: op.afterValue ?? null,
+        ...(op.reason ? { reason: op.reason } : {}),
+        ...(op.sourceRuleOrPolicy ? { sourceRuleOrPolicy: op.sourceRuleOrPolicy } : {}),
+        riskLevel: op.riskLevel,
+        approvalRequired: op.approvalRequired,
+        ...(op.rollback ? { rollback: op.rollback } : {}),
+    };
+}
+function parseState(value, baseUrl) {
+    if (!value || typeof value !== "object")
+        return null;
+    const row = value;
+    const id = typeof row.patchPlanId === "string" ? row.patchPlanId : null;
+    if (!id)
+        return null;
+    const approvedOperationIds = Array.isArray(row.approvedOperationIds) ? row.approvedOperationIds.filter((id) => typeof id === "string") : [];
+    const runRecord = parseRunRecord(row.runRecord, row.operationReceipts, row.externalPlanId, row.updatedAt);
+    return {
+        patchPlanId: id,
+        externalPlanId: typeof row.externalPlanId === "string" ? row.externalPlanId : "",
+        documentSha256: typeof row.documentSha256 === "string" ? row.documentSha256 : "",
+        status: typeof row.status === "string" ? row.status : "pending_approval",
+        approvedOperationIds,
+        valueOverrides: row.valueOverrides && typeof row.valueOverrides === "object" && !Array.isArray(row.valueOverrides) ? row.valueOverrides : {},
+        updatedAt: typeof row.updatedAt === "number" ? row.updatedAt : Date.now(),
+        ...(runRecord ? { runRecord } : {}),
+        url: `${baseUrl}/dashboard/patch-plans?plan=${encodeURIComponent(id)}`,
+    };
+}
+function parseRunRecord(value, receiptsValue, externalPlanId, updatedAt) {
+    const row = value && typeof value === "object" && !Array.isArray(value) ? value : undefined;
+    const planId = typeof row?.planId === "string" ? row.planId : typeof externalPlanId === "string" ? externalPlanId : undefined;
+    if (!planId)
+        return undefined;
+    const rawResults = Array.isArray(row?.results) ? row.results : Array.isArray(receiptsValue) ? receiptsValue : [];
+    const results = rawResults.flatMap((entry) => {
+        if (!entry || typeof entry !== "object")
+            return [];
+        const receipt = entry;
+        const operationId = typeof receipt.operationId === "string" ? receipt.operationId : typeof receipt.packageOpId === "string" ? receipt.packageOpId : undefined;
+        const rawStatus = receipt.status;
+        const status = rawStatus === "applied" || rawStatus === "failed" || rawStatus === "skipped" || rawStatus === "conflict" ? rawStatus : undefined;
+        if (!operationId || !status)
+            return [];
+        return [{ operationId, status, ...(typeof receipt.detail === "string" ? { detail: receipt.detail } : typeof receipt.error === "string" ? { detail: receipt.error } : {}), ...(receipt.providerData !== undefined ? { providerData: receipt.providerData } : {}) }];
+    });
+    if (results.length === 0)
+        return undefined;
+    const timestamp = typeof updatedAt === "number" ? new Date(updatedAt).toISOString() : new Date().toISOString();
+    const provider = typeof row?.provider === "string" ? row.provider : "mock";
+    const status = row?.status === "applied" || row?.status === "partial" || row?.status === "failed" || row?.status === "rejected"
+        ? row.status : results.every((result) => result.status === "applied" || result.status === "skipped") ? "applied" : "partial";
+    return {
+        planId, provider,
+        startedAt: typeof row?.startedAt === "string" ? row.startedAt : timestamp,
+        finishedAt: typeof row?.finishedAt === "string" ? row.finishedAt : timestamp,
+        status,
+        results,
+    };
+}
+function failure(status) {
+    if (status === 409)
+        return { status: "conflict", reason: "hosted mirror has different immutable content" };
+    if (status === 401 || status === 403)
+        return { status: "unavailable", reason: "hosted authentication was rejected; pair the CLI again" };
+    return { status: "unavailable", reason: `hosted plan request failed (HTTP ${status})` };
+}
+export async function uploadHostedPatchPlan(stored, options = {}) {
+    const paired = broker();
+    if (!paired)
+        return { status: "unpaired" };
+    const document = hostedReviewDocument(stored.plan);
+    const digest = hostedPlanDigest(stored.plan);
+    const riskOrder = { low: 0, medium: 1, high: 2 };
+    const riskLevel = stored.plan.operations.reduce((risk, op) => riskOrder[op.riskLevel] > riskOrder[risk] ? op.riskLevel : risk, "low");
+    try {
+        const response = await (options.fetchImpl ?? fetch)(`${paired.baseUrl}${ENDPOINT}`, {
+            method: "POST",
+            headers: { Authorization: `Bearer ${paired.token}`, "Content-Type": "application/json" },
+            body: JSON.stringify({
+                externalPlanId: stored.plan.id, documentSha256: digest, externalRevision: stored.revision,
+                title: stored.plan.title, summary: stored.plan.summary, riskLevel, document,
+                operations: stored.plan.operations.map(mapOperation), createdAt: Date.parse(stored.plan.createdAt),
+            }),
+            signal: AbortSignal.timeout(options.timeoutMs ?? TIMEOUT_MS),
+        });
+        if (!response.ok)
+            return failure(response.status);
+        const raw = await response.json();
+        const state = parseState({ ...raw, externalPlanId: stored.plan.id, documentSha256: digest, approvedOperationIds: [], valueOverrides: {}, updatedAt: Date.now() }, paired.baseUrl);
+        return state ? { status: "saved", state } : { status: "unavailable", reason: "hosted plan response was invalid" };
+    }
+    catch {
+        return { status: "unavailable", reason: "hosted plan request was unavailable" };
+    }
+}
+export async function readHostedPatchPlan(planId, options = {}) {
+    const paired = broker();
+    if (!paired)
+        return { status: "unpaired" };
+    try {
+        const response = await (options.fetchImpl ?? fetch)(`${paired.baseUrl}${ENDPOINT}?externalPlanId=${encodeURIComponent(planId)}`, {
+            headers: { Authorization: `Bearer ${paired.token}`, Accept: "application/json" },
+            signal: AbortSignal.timeout(options.timeoutMs ?? TIMEOUT_MS),
+        });
+        if (response.status === 404)
+            return { status: "missing" };
+        if (!response.ok)
+            return failure(response.status);
+        const state = parseState(await response.json(), paired.baseUrl);
+        return state ? { status: "found", state } : { status: "unavailable", reason: "hosted plan response was invalid" };
+    }
+    catch {
+        return { status: "unavailable", reason: "hosted plan request was unavailable" };
+    }
+}
+/** Pull a peer's newer lifecycle into the local replica without weakening local integrity gates. */
+export async function reconcileHostedPatchPlan(store, stored, options = {}) {
+    const hosted = await readHostedPatchPlan(stored.plan.id, options);
+    if (hosted.status === "unpaired" || hosted.status === "missing")
+        return { status: hosted.status };
+    if (hosted.status === "unavailable" || hosted.status === "conflict")
+        return hosted;
+    if (hosted.state.documentSha256 !== hostedPlanDigest(stored.plan)) {
+        return { status: "conflict", reason: "hosted review content does not match the immutable local plan" };
+    }
+    if (!["approved", "rejected", "applied"].includes(hosted.state.status))
+        return { status: "unchanged" };
+    try {
+        const reconciled = await store.reconcileReplica(stored.plan.id, {
+            status: hosted.state.status,
+            approvedOperationIds: hosted.state.approvedOperationIds,
+            valueOverrides: hosted.state.valueOverrides,
+            ...(hosted.state.runRecord ? { run: hosted.state.runRecord } : {}),
+        });
+        return reconciled.changed
+            ? { status: "updated", stored: reconciled.stored, remoteStatus: hosted.state.status }
+            : { status: "unchanged" };
+    }
+    catch (error) {
+        return { status: "conflict", reason: error instanceof Error ? error.message : "replica reconciliation failed" };
+    }
+}
+export async function reportHostedPlanLifecycle(stored, options = {}) {
+    const paired = broker();
+    if (!paired)
+        return { status: "unpaired" };
+    const status = stored.status === "applied" ? "applied" : stored.status === "rejected" ? "rejected" : "approved";
+    const runRecord = status === "applied" ? stored.runs.at(-1) : undefined;
+    // The hosted terminal transition is authority-bound to the exact approved
+    // subset. Local runs also record excluded operations as `skipped` for a
+    // complete human audit trail; those are not execution receipts and must not
+    // be echoed as though they were authorized provider work.
+    const approved = new Set(stored.approvedOperationIds);
+    const operationReceipts = runRecord?.results.filter((result) => approved.has(result.operationId)).map((result) => ({
+        packageOpId: result.operationId,
+        status: result.status,
+        ...(result.detail ? { error: result.detail.slice(0, 1000) } : {}),
+        ...(result.providerData !== undefined ? { providerData: result.providerData } : {}),
+        updatedAt: Date.parse(runRecord.finishedAt),
+    }));
+    try {
+        const response = await (options.fetchImpl ?? fetch)(`${paired.baseUrl}${ENDPOINT}`, {
+            method: "POST", headers: { Authorization: `Bearer ${paired.token}`, "Content-Type": "application/json" },
+            body: JSON.stringify({ action: "lifecycle", externalPlanId: stored.plan.id, documentSha256: hostedPlanDigest(stored.plan), status, approvedOperationIds: stored.approvedOperationIds, ...(options.claimId ? { claimId: options.claimId } : {}), ...(runRecord ? { runRecord, operationReceipts } : {}) }),
+            signal: AbortSignal.timeout(options.timeoutMs ?? TIMEOUT_MS),
+        });
+        if (!response.ok)
+            return failure(response.status);
+        const raw = await response.json();
+        const state = parseState({ ...raw, externalPlanId: stored.plan.id, documentSha256: hostedPlanDigest(stored.plan), approvedOperationIds: stored.approvedOperationIds, valueOverrides: stored.valueOverrides, updatedAt: Date.now() }, paired.baseUrl);
+        return state ? { status: "saved", state } : { status: "unavailable", reason: "hosted lifecycle response was invalid" };
+    }
+    catch {
+        return { status: "unavailable", reason: "hosted lifecycle request was unavailable" };
+    }
+}
+/** Coordinate online replicas before provider I/O; provider idempotency remains the offline fallback. */
+export async function claimHostedPlanApply(stored, options = {}) {
+    const paired = broker();
+    if (!paired)
+        return { status: "unpaired" };
+    try {
+        const response = await (options.fetchImpl ?? fetch)(`${paired.baseUrl}${ENDPOINT}`, {
+            method: "POST", headers: { Authorization: `Bearer ${paired.token}`, "Content-Type": "application/json" },
+            body: JSON.stringify({ action: "claim", externalPlanId: stored.plan.id, documentSha256: hostedPlanDigest(stored.plan) }),
+            signal: AbortSignal.timeout(options.timeoutMs ?? TIMEOUT_MS),
+        });
+        if (!response.ok)
+            return failure(response.status);
+        const row = await response.json();
+        if (row.alreadyApplied === true || row.status === "applied")
+            return { status: "applied" };
+        if (row.status === "claimed" && typeof row.claimId === "string") {
+            return { status: "claimed", claimId: row.claimId, ...(typeof row.expiresAt === "number" ? { expiresAt: row.expiresAt } : {}) };
+        }
+        return { status: "unavailable", reason: "hosted apply claim response was invalid" };
+    }
+    catch {
+        return { status: "unavailable", reason: "hosted apply claim request was unavailable" };
+    }
+}
+/** Release a shared CLI claim only when preflight aborts before provider I/O. */
+export async function releaseHostedPlanApply(stored, claimId, reason, options = {}) {
+    const paired = broker();
+    if (!paired)
+        return { status: "unpaired" };
+    try {
+        const response = await (options.fetchImpl ?? fetch)(`${paired.baseUrl}${ENDPOINT}`, {
+            method: "POST",
+            headers: { Authorization: `Bearer ${paired.token}`, "Content-Type": "application/json" },
+            body: JSON.stringify({
+                action: "release_claim",
+                externalPlanId: stored.plan.id,
+                documentSha256: hostedPlanDigest(stored.plan),
+                claimId,
+                reason,
+            }),
+            signal: AbortSignal.timeout(options.timeoutMs ?? TIMEOUT_MS),
+        });
+        if (!response.ok)
+            return failure(response.status);
+        const row = await response.json();
+        return row.released === true
+            ? { status: "released" }
+            : { status: "unavailable", reason: "hosted apply claim release response was invalid" };
+    }
+    catch {
+        return { status: "unavailable", reason: "hosted apply claim release was unavailable" };
+    }
+}

package/dist/icp.js

@@ -158,6 +158,14 @@ const CRUSTDATA_INDUSTRY = {
     fintech: ["Financial Services"],
     "financial services": ["Financial Services"],
 };
+// Common NAICS groups translated into Crustdata's LinkedIn industry vocabulary.
+// This keeps an ICP authored with provider-neutral NAICS codes from silently
+// dropping its industry constraint on the Pipe0 path.
+const NAICS_CRUSTDATA_INDUSTRY = {
+    "5112": ["Software Development", "Computer Software"],
+    "5182": ["IT Services and IT Consulting", "Information Technology & Services"],
+    "5415": ["IT Services and IT Consulting", "Information Technology & Services"],
+};
 /**
  * pipe0 Crustdata people-search config.filters from the ICP. `current_job_titles`
  * matches real LinkedIn title strings (case-sensitive), so keywords are Title
@@ -185,9 +193,12 @@ export function icpToCrustdataFilters(icp) {
     if (icp.firmographics.geos?.length) {
         f.locations = icp.firmographics.geos.map((g) => COUNTRY_NAMES[g.toLowerCase()] ?? g);
     }
-    if (icp.firmographics.industries?.length) {
+    if (icp.firmographics.industries?.length || icp.firmographics.naics?.length) {
         const inds = [
-            ...new Set(icp.firmographics.industries.flatMap((i) => CRUSTDATA_INDUSTRY[i.toLowerCase()] ?? [titleCase(i)])),
+            ...new Set([
+                ...(icp.firmographics.industries ?? []).flatMap((i) => CRUSTDATA_INDUSTRY[i.toLowerCase()] ?? [titleCase(i)]),
+                ...(icp.firmographics.naics ?? []).flatMap((code) => NAICS_CRUSTDATA_INDUSTRY[code] ?? []),
+            ]),
         ];
         if (inds.length)
             f.current_employers_linkedin_industries = inds;

package/dist/index.d.ts

@@ -1,4 +1,5 @@
 export { auditSnapshot, defaultPolicy } from "./audit.ts";
+export { acquireCheckpointId, acquireCheckpointsDir, createFileAcquireCheckpointStore, validateAcquireCheckpoint, validateAcquireCheckpointKey, type AcquireCheckpoint, type AcquireCheckpointKey, type AcquireCheckpointStore, type AcquireContinuation, } from "./acquireCheckpoint.ts";
 export { matchesTerritory, parseAssignmentPolicy, resolveAssignment, type AssignmentContext, type AssignmentPolicy, type AssignmentResult, type AssignmentStrategy, type TerritoryRule, } from "./assign.ts";
 export { buildBulkUpdatePlan, isFilterableField, parseWhere, type BulkUpdateOptions } from "./bulkUpdate.ts";
 export { buildDedupePlan, dedupeKey, type DedupeOptions } from "./dedupe.ts";
@@ -17,7 +18,9 @@ export { createStripeConnector, fetchStripePaidInvoices, type StripeConnectorOpt
 export { buildStripeBackfillPlan, DEFAULT_BACKFILL_MATCH_PROPERTY, type StripeBackfillCounts, type StripeBackfillOptions, type StripeBackfillResult, type StripeBackfillUnmatched, } from "./backfill.ts";
 export { activeProfile, credentialsDir, credentialsPath, DEFAULT_PROFILE, deleteCredential, getCredential, listProfiles, resolveHubspotAccessToken, resolveHubspotConnection, setActiveProfile, storeCredential, type HubspotConnection, type StoredCredential, } from "./credentials.ts";
 export { generateDemoSnapshot, type DemoSnapshotOptions } from "./demo.ts";
-export { buildEnrichPlan, createFileEnrichRunStore, DEFAULT_STALE_DAYS, ENRICH_CONFIG_FILE_NAME, enrichRunId, inferIngestObjectType, ingestKeyValue, latestStamps, loadEnrichConfig, matchSourceRecord, parseCsv, parseEnrichConfig, resolveCrmField, selectStaleWork, sourceValueAt, stagedSourceRecords, staleDaysFor, type BuildEnrichPlanOptions, type EnrichAmbiguity, type EnrichConfig, type EnrichCounts, type EnrichFieldConfig, type EnrichMatchConfig, type EnrichMode, type EnrichObjectType, type EnrichPlanResult, type EnrichRun, type EnrichRunStore, type EnrichSourceConfig, type EnrichSourceRecord, type EnrichStamp, type EnrichWorkItem, type MatchOutcome, } from "./enrich.ts";
+export { buildEnrichPlan, createFileEnrichRunStore, DEFAULT_STALE_DAYS, ENRICH_CONFIG_FILE_NAME, enrichRunId, inferIngestObjectType, ingestKeyValue, latestStamps, loadEnrichConfig, matchSourceRecord, parseCsv, parseEnrichConfig, resolveCrmField, selectStaleWork, sourceValueAt, stagedSourceRecords, staleDaysFor, type BuildEnrichPlanOptions, type AcquireDiscoveryCheckpoint, type EnrichAmbiguity, type EnrichConfig, type EnrichCounts, type EnrichFieldConfig, type EnrichMatchConfig, type EnrichMode, type EnrichObjectType, type EnrichPlanResult, type EnrichRun, type EnrichRunStore, type EnrichSourceConfig, type EnrichSourceRecord, type EnrichStamp, type EnrichWorkItem, type MatchOutcome, } from "./enrich.ts";
+export { readHostedAcquireCheckpoint, writeHostedAcquireCheckpoint, type HostedAcquireCheckpoint, type HostedCheckpointReadResult, type HostedCheckpointWriteResult, } from "./hostedAcquireCheckpoint.ts";
+export { claimHostedPlanApply, hostedPlanDigest, hostedReviewDocument, readHostedPatchPlan, reconcileHostedPatchPlan, releaseHostedPlanApply, reportHostedPlanLifecycle, uploadHostedPatchPlan } from "./hostedPatchPlan.ts";
 export { scaffoldWorkspace, starterEnrichConfig, starterIcp, starterPlaybook, type InitProvider, type InitSource, type ScaffoldFile, type ScaffoldOptions, } from "./init.ts";
 export { appendCoverage, classifyAccount, classifyCoverage, computeCoverage, coverageCountsFromSnapshot, coveredAccounts, coverageToText, crmCheckableCriteria, deriveAcvFromClosedWon, deriveBuyersPerAccount, estimateTam, loadTamModel, projectEta, readCoverageTimeline, saveTamModel, tamDir, tamReportToMarkdown, type AccountTamClass, type AcvBasis, type DerivedAcv, type DerivedBuyers, type EstimateTamInput, type TamClassified, type TamCoverage, type TamCoverageCounts, type TamCrossCheck, type TamEta, type TamModel, type TamTargeting, type TamUniverse, } from "./tam.ts";
 export { apolloPullKeysForAppend, apolloPullKeysForRefresh, createApolloClient, pullApolloRecords, type ApolloClient, type ApolloClientOptions, type ApolloPullKey, type ApolloPullResult, } from "./enrichApollo.ts";

package/dist/index.js

@@ -1,4 +1,5 @@
 export { auditSnapshot, defaultPolicy } from "./audit.js";
+export { acquireCheckpointId, acquireCheckpointsDir, createFileAcquireCheckpointStore, validateAcquireCheckpoint, validateAcquireCheckpointKey, } from "./acquireCheckpoint.js";
 export { matchesTerritory, parseAssignmentPolicy, resolveAssignment, } from "./assign.js";
 export { buildBulkUpdatePlan, isFilterableField, parseWhere } from "./bulkUpdate.js";
 export { buildDedupePlan, dedupeKey } from "./dedupe.js";
@@ -18,6 +19,8 @@ export { buildStripeBackfillPlan, DEFAULT_BACKFILL_MATCH_PROPERTY, } from "./bac
 export { activeProfile, credentialsDir, credentialsPath, DEFAULT_PROFILE, deleteCredential, getCredential, listProfiles, resolveHubspotAccessToken, resolveHubspotConnection, setActiveProfile, storeCredential, } from "./credentials.js";
 export { generateDemoSnapshot } from "./demo.js";
 export { buildEnrichPlan, createFileEnrichRunStore, DEFAULT_STALE_DAYS, ENRICH_CONFIG_FILE_NAME, enrichRunId, inferIngestObjectType, ingestKeyValue, latestStamps, loadEnrichConfig, matchSourceRecord, parseCsv, parseEnrichConfig, resolveCrmField, selectStaleWork, sourceValueAt, stagedSourceRecords, staleDaysFor, } from "./enrich.js";
+export { readHostedAcquireCheckpoint, writeHostedAcquireCheckpoint, } from "./hostedAcquireCheckpoint.js";
+export { claimHostedPlanApply, hostedPlanDigest, hostedReviewDocument, readHostedPatchPlan, reconcileHostedPatchPlan, releaseHostedPlanApply, reportHostedPlanLifecycle, uploadHostedPatchPlan } from "./hostedPatchPlan.js";
 export { scaffoldWorkspace, starterEnrichConfig, starterIcp, starterPlaybook, } from "./init.js";
 export { appendCoverage, classifyAccount, classifyCoverage, computeCoverage, coverageCountsFromSnapshot, coveredAccounts, coverageToText, crmCheckableCriteria, deriveAcvFromClosedWon, deriveBuyersPerAccount, estimateTam, loadTamModel, projectEta, readCoverageTimeline, saveTamModel, tamDir, tamReportToMarkdown, } from "./tam.js";
 export { apolloPullKeysForAppend, apolloPullKeysForRefresh, createApolloClient, pullApolloRecords, } from "./enrichApollo.js";

package/dist/planStore.d.ts

@@ -24,6 +24,7 @@ export type StoredPlan = {
         id: string;
         claimedAt: string;
         revision: number;
+        hostedClaimId?: string;
     };
     /** Durable journal of apply ownership. An unresolved entry must never be replayed automatically. */
     applyAttempts?: ApplyAttempt[];
@@ -40,6 +41,7 @@ export type ApplyAttempt = {
     resolvedAt?: string;
     /** Deliberately generic: provider errors can contain CRM data or credentials. */
     note?: string;
+    hostedClaimId?: string;
 };
 export interface PlanStore {
     save(plan: PatchPlan): Promise<StoredPlan>;
@@ -51,11 +53,23 @@ export interface PlanStore {
         stored: StoredPlan;
         claimId: string;
     }>;
+    recordHostedClaim(planId: string, claimId: string, hostedClaimId: string): Promise<StoredPlan>;
     recordRun(planId: string, run: PatchPlanRun, claimId: string): Promise<StoredPlan>;
     abortApplyPreflight(planId: string, claimId: string, note: string): Promise<StoredPlan>;
     markApplyUncertain(planId: string, claimId: string): Promise<StoredPlan>;
     recoverApply(planId: string): Promise<StoredPlan>;
+    reconcileReplica(planId: string, remote: ReplicaPlanState): Promise<{
+        stored: StoredPlan;
+        changed: boolean;
+    }>;
 }
+/** A validated lifecycle snapshot received from another plan replica. */
+export type ReplicaPlanState = {
+    status: "approved" | "rejected" | "applied";
+    approvedOperationIds: string[];
+    valueOverrides?: Record<string, unknown>;
+    run?: PatchPlanRun;
+};
 /**
  * Plans as JSON files in a directory (default `$FSGTM_HOME/plans`), one file
  * per plan id. Filesystem-shaped on purpose: greppable, diffable, and any

package/dist/planStore.js

@@ -216,6 +216,19 @@ export function createFilePlanStore(directory) {
                 });
             });
         },
+        async recordHostedClaim(planId, claimId, hostedClaimId) {
+            return withPlanLock(planId, () => {
+                const stored = mustRead(planId);
+                if (stored.status !== "applying" || stored.applyClaim?.id !== claimId) {
+                    throw new Error(`Refusing to attach hosted claim for plan ${planId}: local apply claim does not match.`);
+                }
+                return write({
+                    ...stored,
+                    applyClaim: { ...stored.applyClaim, hostedClaimId },
+                    applyAttempts: (stored.applyAttempts ?? []).map((attempt) => attempt.id === claimId ? { ...attempt, hostedClaimId } : attempt),
+                });
+            });
+        },
         async abortApplyPreflight(planId, claimId, note) {
             return withPlanLock(planId, () => {
                 const stored = mustRead(planId);
@@ -266,5 +279,65 @@ export function createFilePlanStore(directory) {
                 });
             });
         },
+        async reconcileReplica(planId, remote) {
+            return withPlanLock(planId, () => {
+                const stored = mustRead(planId);
+                if (stored.status === "applying" || stored.applyClaim) {
+                    throw new Error(`Plan ${planId} is applying locally; replica reconciliation will retry after it finishes.`);
+                }
+                const known = new Set(stored.plan.operations.map((operation) => operation.id));
+                const approvedOperationIds = Array.from(new Set(remote.approvedOperationIds));
+                if (approvedOperationIds.some((id) => !known.has(id))) {
+                    throw new Error(`Replica state for ${planId} contains an unknown operation.`);
+                }
+                // Terminal receipts are monotonic. A delayed approval or rejection can
+                // never roll an already-applied local replica backwards.
+                if (stored.status === "applied" && remote.status !== "applied") {
+                    return { stored, changed: false };
+                }
+                if (remote.status === "rejected") {
+                    if (stored.status === "rejected")
+                        return { stored, changed: false };
+                    return { stored: write({
+                            ...stored, status: "rejected", approvedOperationIds: [], valueOverrides: {},
+                            approvalDigests: undefined, applyClaim: undefined,
+                        }), changed: true };
+                }
+                if (approvedOperationIds.length === 0) {
+                    throw new Error(`Replica ${remote.status} state for ${planId} has no approved operations.`);
+                }
+                const valueOverrides = remote.valueOverrides ?? {};
+                const approvalDigests = computeApprovalDigests(stored.plan.operations, approvedOperationIds, valueOverrides, loadOrCreateSigningKey());
+                if (remote.status === "approved") {
+                    const unchanged = stored.status === "approved"
+                        && JSON.stringify(stored.approvedOperationIds) === JSON.stringify(approvedOperationIds)
+                        && JSON.stringify(stored.valueOverrides) === JSON.stringify(valueOverrides);
+                    if (unchanged)
+                        return { stored, changed: false };
+                    return { stored: write({
+                            ...stored, status: "approved", approvedOperationIds, valueOverrides, approvalDigests,
+                        }), changed: true };
+                }
+                if (!remote.run || remote.run.planId !== planId) {
+                    throw new Error(`Replica applied state for ${planId} is missing a matching execution receipt.`);
+                }
+                if (remote.run.results.some((result) => !known.has(result.operationId))) {
+                    throw new Error(`Replica execution receipt for ${planId} contains an unknown operation.`);
+                }
+                const runKey = (run) => `${run.startedAt}\0${run.finishedAt}\0${run.provider}`;
+                const alreadyRecorded = stored.runs.some((run) => runKey(run) === runKey(remote.run));
+                if (stored.status === "applied" && alreadyRecorded)
+                    return { stored, changed: false };
+                return { stored: write({
+                        ...stored,
+                        status: "applied",
+                        approvedOperationIds,
+                        valueOverrides,
+                        approvalDigests,
+                        applyClaim: undefined,
+                        runs: alreadyRecorded ? stored.runs : [...stored.runs, remote.run],
+                    }), changed: true };
+            });
+        },
     };
 }

package/dist/progress.d.ts

@@ -89,8 +89,8 @@ export declare const BACKFILL_STRIPE_STAGES: readonly ["invoices", "snapshot", "
 /** `backfill runs` — replaying local plan runs + health history to the broker. */
 export declare const RUNS_REPLAY_STAGES: readonly ["runs", "health"];
 export declare const APPLY_STAGES: readonly ["preflight", "operations", "results"];
-/** `enrich acquire` — routing sourced candidate rows into a create plan. */
-export declare const ACQUIRE_STAGES: readonly ["candidates"];
+/** `enrich acquire` — discovery through a governed create plan. */
+export declare const ACQUIRE_STAGES: readonly ["discovery", "resolution", "plan"];
 export declare const MARKET_CAPTURE_STAGES: readonly ["sources", "capture", "classify", "persist"];
 /** No-op emitter for callers that don't care (keeps signatures simple). */
 export declare function nullProgressEmitter(): ProgressEmitter;

package/dist/progress.js

@@ -133,8 +133,8 @@ export const BACKFILL_STRIPE_STAGES = ["invoices", "snapshot", "matching", "plan
 /** `backfill runs` — replaying local plan runs + health history to the broker. */
 export const RUNS_REPLAY_STAGES = ["runs", "health"];
 export const APPLY_STAGES = ["preflight", "operations", "results"];
-/** `enrich acquire` — routing sourced candidate rows into a create plan. */
-export const ACQUIRE_STAGES = ["candidates"];
+/** `enrich acquire` — discovery through a governed create plan. */
+export const ACQUIRE_STAGES = ["discovery", "resolution", "plan"];
 export const MARKET_CAPTURE_STAGES = ["sources", "capture", "classify", "persist"];
 /** No-op emitter for callers that don't care (keeps signatures simple). */
 export function nullProgressEmitter() {

package/docs/api.md

@@ -229,6 +229,15 @@ webhook landing-zone format (docs/signal-spool-format.md).
 
 ## Acquire (net-new lead generation)
 
+API discovery is continuation-aware. Completed acquire runs persist a
+provider/source/list/query-keyed Pipe0 cursor, Explorium page, or HeyReach list
+offset, plus the discovered → qualified → deduped → resolved → proposed funnel.
+Each list progresses independently. If a broker credential exists, GET/POST
+`/api/cli/acquisition-checkpoint` synchronizes the opaque checkpoint inside the
+token's organization using numeric compare-and-swap revisions; unpaired and
+offline CLIs remain local-first. A changed ICP/list starts a new traversal. CLI
+`--max` sets desired new leads while `--scan-limit` bounds raw candidates.
+
 `buildAcquirePlan` turns sourced-but-unmatched prospects into `create_record`
 operations (matched / ambiguous are skipped — resolve-first never creates over
 a possible dup), capped by the meter's headroom. `builtinAcquirePreset` is the
@@ -308,6 +317,21 @@ operator reconciliation remains necessary after a timeout or crash.
 
 ## Schedule
 
+## Hosted patch-plan mirror
+
+`uploadHostedPatchPlan(stored)` mirrors a bounded review document when the
+active profile has a secure broker pairing. `readHostedPatchPlan(planId)` reads
+the org-scoped hosted decision, and `reportHostedPlanLifecycle(stored)` reflects
+local approval/rejection/application. Upload is local-first and best-effort;
+immutable hash conflicts fail closed. Hosted approval does not carry local
+signing material: `apply --plan-id` verifies the hash and operation set before
+`PlanStore.approveOperations` generates machine-local approval digests.
+
+The hosted transport intentionally excludes findings, evidence, signing
+digests/keys, apply claims and attempt notes, provider results, and raw run
+errors. Operation before/after values are included because the paired
+organization needs them to review the proposed CRM changes.
+
 The horizontal scheduler: a declarative schedule-entry store, a
 dependency-free 5-field cron parser, and the read/plan-side `SCHEDULABLE`
 allowlist. `validateSchedulableArgv` enforces the allowlist at `schedule add`

package/docs/architecture.md

@@ -94,6 +94,15 @@ replays automatically: reconcile provider state, then `plans recover ...
   translation, prospect fit scoring, and the agent-driven interview spec.
 - `acquireMeter.ts` — per-profile windowed budget (records + spend) for acquire.
 - `acquireSeen.ts` — cross-run "seen" cache so re-runs don't re-pay for dupes.
+- `acquireCheckpoint.ts` — secure profile-scoped, provider/source/list/query-keyed
+  continuation store; each audience advances independently.
+- `hostedAcquireCheckpoint.ts` — optional broker-authenticated checkpoint
+  transport. Organization identity is resolved server-side; numeric CAS
+  revisions prevent stale workers from overwriting newer continuation.
+- `hostedPatchPlan.ts` — best-effort paired-CLI plan mirroring and decision
+  reconciliation. Review documents are immutable/hash-bound; hosted approval
+  becomes executable only after the CLI verifies it and generates local HMAC
+  signatures. Hosted never owns the apply lease for CLI-origin plans.
 - `assign.ts` — `AssignmentPolicy` (fixed / round-robin / territory /
   account-owner): the pure owner-routing rule `buildAcquirePlan` stamps onto new
   leads (never born ownerless) and `reassign --assign-unowned` reuses to backfill.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "fullstackgtm",
-  "version": "0.49.0",
+  "version": "0.50.1",
   "description": "Open-source agentic GTM ops framework: canonical GTM data model, pluggable deterministic audits, reviewable dry-run patch plans, approval-gated write-back with conflict detection, and cross-system entity resolution. HubSpot, Salesforce, and Stripe connectors included.",
   "license": "Apache-2.0",
   "author": "Full Stack GTM LLC <ryan@fullstackgtm.com> (https://fullstackgtm.com)",

package/skills/fullstackgtm/SKILL.md

@@ -63,7 +63,7 @@ credentials AND stored plans per client org.
 | `backfill stripe\|runs [--since <iso>] [--pipeline <id\|label>]` | Paid Stripe invoices → proposed closed-won deals (amount = invoice total, close date = paid date, company matched by billing-email domain then name); deduped by a `stripe_invoice_id` deal property re-resolved at apply, so re-running never double-creates; a customer the CRM doesn't know gets a proposed account create in the same plan (freemail domains never used; `--skip-unmatched` = report-only); `--save` → approve → `apply`. `backfill runs` replays LOCAL run history + health timeline to the paired hosted app (idempotent; `--dry-run` to preview) |
 | `call parse\|score\|link\|plan` | Transcripts → evidence-quoted insights, rubric scorecards, deal linking, governed next-step writes |
 | `enrich append\|refresh\|ingest\|status` | Governed enrichment (Apollo pull / Clay ingest), fill-blanks-only plans |
-| `enrich acquire [--source explorium\|pipe0\|linkedin]` | Net-new ICP-targeted lead gen: resolve-first deduped `create_record` plans, capped by a per-profile windowed meter (records + spend); owner-stamped via `acquire.assign`/`--assign-owner` (never born ownerless); links each lead to a domain-stamped, signal-watchable account; `acquire.create.company` acquires accounts (ABM); `--source linkedin --list <id>` reads a HeyReach lead list (Phase 1 discovery, read-only — never sends); never auto-writes |
+| `enrich acquire [--source explorium\|pipe0\|linkedin] [--max <new>] [--scan-limit <raw>]` | Net-new ICP-targeted lead gen: independent per-provider/list/query checkpoints traverse full audiences instead of rereading page one; paired CLIs CAS-sync opaque, non-PII continuation to the hosted org; resolve-first deduped `create_record` plans, meter-capped and owner-stamped; `enrich status --runs` exposes funnel + continuation; never auto-writes |
 | `signals fetch\|list\|outcome\|weights` | Detect-side timing layer: capture fresh buying triggers into a profile-scoped ledger (free Greenhouse/Lever/Ashby ATS in the box; `--from` staged files; `--connector file\|serpapi-news\|hubspot-forms` to pull connected platforms / read the webhook spool `<home>/signals/spool`, secrets via the credential ladder), ranked by learned weights. Writes NOTHING to the CRM; `outcome --account <domain> --contact <id> --result …` re-weights which triggers earn a touch |
 | `icp interview\|set\|show\|judge\|eval` | Build the ICP, then `judge` ranks fresh signals into send/nurture/skip — pass a snapshot (`--provider`/`--input`) and each decision resolves its CRM target (`accountId` + the `contact`/`contacts` to reach). `eval` is the calibration gate (exit 2 below the bar) |
 | `draft [--from-judge latest] [--channel email\|linkedin\|task]` | One trigger-grounded opener per hot account → a governed `create_task` targeting the resolved `contact.id` (or `accountId`); rejects a domain-only decision ("acquire it first"). **Never sends** — after `plans approve`, `apply --provider <crm>` logs it as a CRM task, or `apply --channel outbox` renders it to `<home>/signals/outbox/<channel>.jsonl` for a downstream sender to drain; the CLI transmits nothing |