intentdna 1.7.4 → 1.8.0

package/dist/cli/commands/templates.js

@@ -2,10 +2,19 @@
  * dna templates — template catalog and deployment commands.
  */
 import { readdirSync, copyFileSync, existsSync, readFileSync, mkdirSync } from "node:fs";
-import { resolve, join } from "node:path";
+import { mkdir, readdir, writeFile } from "node:fs/promises";
+import { homedir } from "node:os";
+import { resolve, join, basename, dirname } from "node:path";
 import { execSync } from "node:child_process";
 import { readFile } from "node:fs/promises";
 import { findTemplateCatalogEntry, listTemplateCatalog } from "../../templates/catalog.js";
+import { buildTemplateMarketplaceCatalog, getTemplateMarketplaceMetadata, } from "../../templates/marketplace.js";
+import { parseYAML } from "../../schema/yaml-parser.js";
+import { findWorkflowAsset } from "../../assets/catalog.js";
+import { resolveAuthToken } from "./auth.js";
+import { missingCliApiTokenReason } from "./cloud-auth-guidance.js";
+import { createWorkflowDraft, workflowDraftToTemplateYaml, } from "../../workflow/index.js";
+import { WORKFLOW_ASSET_IDS } from "../../templates/metadata.js";
 /**
  * Resolve the global intentdna templates directory.
  * Strategy: npm root -g + /intentdna/dist/templates
@@ -54,12 +63,18 @@ export async function runTemplatesList(opts = {}) {
         return 1;
     }
     process.stderr.write(`Available templates (${templates.length}):\n`);
+    writeTemplateSourceSummary(templates);
     for (const template of templates) {
+        const marketplace = await getTemplateMarketplaceMetadata(template);
         const ns = template.namespace ? ` ns=${template.namespace}` : "";
         const version = template.version ? ` v${template.version}` : "";
         process.stderr.write(`  - ${template.name} [${template.source}]${ns}${version}`);
         if (template.displayName)
             process.stderr.write(` — ${template.displayName}`);
+        process.stderr.write(`\n    marketplace=${marketplace.visibility} harnesses=${marketplace.supportedHarnesses.join(",")} sync=${marketplace.syncSurfaces.join(",")}`);
+        process.stderr.write(`\n    purpose=${marketplace.purpose}`);
+        process.stderr.write(`\n    evidence=${marketplace.evidencePosture} maturity=${marketplace.maturity}`);
+        process.stderr.write(`\n    review=${marketplace.review.inspectCommand} -> ${marketplace.review.adoptionCommand}`);
         process.stderr.write("\n");
     }
     return 0;
@@ -75,6 +90,50 @@ export async function runTemplatesShow(opts) {
         return 2;
     }
     const content = await readFile(template.path, "utf-8");
+    const marketplace = await getTemplateMarketplaceMetadata(template, { content });
+    if (opts.json) {
+        const data = parseYAML(content);
+        const selected = buildTemplateManagementItem(template, content, data, marketplace);
+        const result = {
+            schema_version: "intentdna.template_show.v1",
+            mode: "template_show",
+            selected: {
+                ...selected,
+                path: template.path,
+                nextCommands: [
+                    selected.commands.init,
+                    ...marketplace.install.syncCommands,
+                    selected.commands.assetInspect,
+                    selected.commands.assetAdoption,
+                    selected.commands.orgBind,
+                    selected.commands.orgReview,
+                    selected.commands.orgRollout,
+                ],
+            },
+            commandEffects: {
+                mutation_performed: false,
+                network_performed: false,
+                runtime_authority: false,
+                online_required: false,
+                cloud_required: false,
+                syncs_harness: false,
+                executes_workflow: false,
+            },
+            boundaries: [
+                "dna templates show is local asset selection and inspection only; it does not initialize, sync, install, approve, or execute workflows.",
+                "Template marketplace metadata distributes workflow assets; it does not make runtime allow/warn/block/validate decisions.",
+                "Online and Supabase are not required for local template selection.",
+            ],
+            document: {
+                path: template.path,
+                language: "yaml",
+                lineCount: content.split(/\r?\n/).length,
+                content,
+            },
+        };
+        process.stdout.write(JSON.stringify(result, null, 2) + "\n");
+        return 0;
+    }
     process.stderr.write(`Template: ${template.name}\n`);
     process.stderr.write(`Source: ${template.source}\n`);
     process.stderr.write(`Path: ${template.path}\n`);
@@ -88,12 +147,2103 @@ export async function runTemplatesShow(opts) {
     if (template.keywords.length > 0) {
         process.stderr.write(`Match keywords: ${template.keywords.join(", ")}\n`);
     }
+    process.stderr.write(`Marketplace visibility: ${marketplace.visibility}\n`);
+    process.stderr.write(`Purpose: ${marketplace.purpose}\n`);
+    process.stderr.write(`Fit:\n`);
+    for (const item of marketplace.fit)
+        process.stderr.write(`  - ${item}\n`);
+    process.stderr.write(`Inputs:\n`);
+    for (const item of marketplace.inputs)
+        process.stderr.write(`  - ${item}\n`);
+    process.stderr.write(`Outputs:\n`);
+    for (const item of marketplace.outputs)
+        process.stderr.write(`  - ${item}\n`);
+    process.stderr.write(`Evidence posture: ${marketplace.evidencePosture}\n`);
+    writeMarketplaceEvidenceGap(marketplace);
+    process.stderr.write(`Maturity: ${marketplace.maturity}\n`);
+    process.stderr.write("Lifecycle:\n");
+    process.stderr.write(`  state: ${marketplace.lifecycleGuide.state}\n`);
+    process.stderr.write(`  meaning: ${marketplace.lifecycleGuide.meaning}\n`);
+    process.stderr.write(`  available now:\n`);
+    for (const item of marketplace.lifecycleGuide.availableNow)
+        process.stderr.write(`    - ${item}\n`);
+    process.stderr.write(`  next: ${marketplace.lifecycleGuide.nextStep}\n`);
+    process.stderr.write(`  must not imply:\n`);
+    for (const item of marketplace.lifecycleGuide.notAllowedToImply)
+        process.stderr.write(`    - ${item}\n`);
+    process.stderr.write(`Supported harnesses: ${marketplace.supportedHarnesses.join(", ")}\n`);
+    process.stderr.write(`Required DNA version: ${marketplace.requiredDnaVersion}\n`);
+    process.stderr.write(`Sync surfaces: ${marketplace.syncSurfaces.join(", ")}\n`);
+    process.stderr.write(`Install: ${marketplace.install.command}\n`);
+    process.stderr.write("Sync route:\n");
+    for (const command of marketplace.install.syncCommands)
+        process.stderr.write(`  - ${command}\n`);
+    process.stderr.write("Review route:\n");
+    process.stderr.write(`  - ${marketplace.review.inspectCommand}\n`);
+    process.stderr.write(`  - ${marketplace.review.adoptionCommand}\n`);
+    process.stderr.write(`  - ${marketplace.review.orgBindCommand}\n`);
+    process.stderr.write(`  - ${marketplace.review.orgReviewCommand}\n`);
+    process.stderr.write(`  - ${marketplace.review.rolloutCommand}\n`);
+    process.stderr.write(`Review boundary: ${marketplace.review.boundary}\n`);
+    writeMarketplaceAssetRelations(marketplace);
+    if (marketplace.evidenceExamples.length > 0) {
+        process.stderr.write("Evidence examples:\n");
+        for (const example of marketplace.evidenceExamples) {
+            process.stderr.write(`  - [${example.kind}] ${example.label}: ${example.path}\n`);
+        }
+    }
     process.stderr.write("\n---\n");
     process.stdout.write(content);
     if (!content.endsWith("\n"))
         process.stdout.write("\n");
     return 0;
 }
+export async function runTemplatesMarketplace(opts = {}) {
+    const catalog = await buildTemplateMarketplaceCatalog({ projectDir: opts.projectDir });
+    if (opts.output) {
+        await mkdir(dirname(opts.output), { recursive: true });
+        await writeFile(opts.output, JSON.stringify(catalog, null, 2) + "\n", "utf-8");
+    }
+    if (opts.json) {
+        process.stdout.write(JSON.stringify(catalog, null, 2) + "\n");
+        return 0;
+    }
+    process.stderr.write("Template marketplace catalog\n");
+    process.stderr.write(`Schema: ${catalog.schema_version}\n`);
+    process.stderr.write(`Templates: ${catalog.totals.templates} public=${catalog.totals.public} personal=${catalog.totals.personal} internal_ready=${catalog.totals.internal_ready}\n`);
+    writeTemplateCatalogSourceSummary(catalog.totals);
+    process.stderr.write(`Harness support: claude_code=${catalog.totals.claude_code} codex_cli=${catalog.totals.codex_cli}\n`);
+    if (opts.output)
+        process.stderr.write(`Wrote: ${opts.output}\n`);
+    process.stderr.write("Installable templates:\n");
+    for (const item of catalog.items.slice(0, 20)) {
+        process.stderr.write(`  - ${item.name} [${item.marketplace.visibility}/${item.marketplace.maturity}] harnesses=${item.marketplace.supportedHarnesses.join(",")} install="${item.marketplace.install.command}"\n`);
+        process.stderr.write(`    ${item.marketplace.purpose}\n`);
+        process.stderr.write(`    review="${item.marketplace.review.inspectCommand}" adoption="${item.marketplace.review.adoptionCommand}"\n`);
+        writeMarketplaceAssetRelations(item.marketplace, "    ");
+    }
+    if (catalog.items.length > 20)
+        process.stderr.write(`  ... ${catalog.items.length - 20} more\n`);
+    const personalDrafts = catalog.items.filter((item) => item.marketplace.visibility === "personal");
+    if (personalDrafts.length > 0) {
+        process.stderr.write("Personal drafts from .dna/templates:\n");
+        for (const item of personalDrafts) {
+            process.stderr.write(`  - ${item.name} [personal/${item.marketplace.maturity}] review="${item.marketplace.review.inspectCommand}" adoption="${item.marketplace.review.adoptionCommand}"\n`);
+        }
+    }
+    const internalReady = catalog.items.filter((item) => item.marketplace.visibility === "internal_ready");
+    if (internalReady.length > 0) {
+        process.stderr.write("Internal-ready adoption candidates:\n");
+        for (const item of internalReady) {
+            process.stderr.write(`  - ${item.name} [internal_ready/${item.marketplace.maturity}] review="${item.marketplace.review.inspectCommand}" org="${item.marketplace.review.orgBindCommand}"\n`);
+        }
+    }
+    process.stderr.write(`Boundary: ${catalog.boundaries[0]}\n`);
+    return 0;
+}
+function writeTemplateSourceSummary(templates) {
+    const builtin = templates.filter((template) => template.source === "builtin").length;
+    const project = templates.filter((template) => template.source === "project").length;
+    process.stderr.write(`Source split: builtin=${builtin} project=${project}\n`);
+    process.stderr.write("Count boundary: builtin templates are public assets from src/templates; project templates are personal drafts from .dna/templates.\n");
+    process.stderr.write("Lifecycle boundary: internal_ready is an adoption candidate, not org_private SaaS visibility; marketplace metadata does not install, approve, or execute workflows.\n");
+}
+function writeTemplateCatalogSourceSummary(totals) {
+    process.stderr.write("Source split: public=built-in marketplace assets, personal=project .dna/templates drafts, internal_ready=local adoption candidates.\n");
+    process.stderr.write(`Count boundary: this local catalog includes ${totals.public} public built-ins and ${totals.personal} project-local personal drafts; Online static projection may show only built-ins.\n`);
+    process.stderr.write("Lifecycle boundary: internal_ready is not org_private; org_private requires Supabase auth/RLS/storage/permissions/audit and publication receipts.\n");
+}
+function writeMarketplaceAssetRelations(marketplace, indent = "") {
+    if (marketplace.assetRelations.length === 0)
+        return;
+    process.stderr.write(`${indent}Related workflow assets:\n`);
+    for (const relation of marketplace.assetRelations) {
+        process.stderr.write(`${indent}  - ${relation.relatedTemplate} [${relation.relation}]\n`);
+        process.stderr.write(`${indent}    purpose=${relation.purpose}\n`);
+        for (const preserved of relation.preserves.slice(0, 3)) {
+            process.stderr.write(`${indent}    preserves=${preserved}\n`);
+        }
+        for (const command of relation.nextCommands.slice(0, 3)) {
+            process.stderr.write(`${indent}    next=${command}\n`);
+        }
+        for (const boundary of relation.notAllowedToImply.slice(0, 4)) {
+            process.stderr.write(`${indent}    not_allowed=${boundary}\n`);
+        }
+    }
+}
+function writeMarketplaceEvidenceGap(marketplace, indent = "") {
+    const gap = marketplace.evidenceGap;
+    process.stderr.write(`${indent}Evidence route: ${gap.status}\n`);
+    process.stderr.write(`${indent}  ${gap.summary}\n`);
+    process.stderr.write(`${indent}  next commands:\n`);
+    for (const command of gap.nextCommands)
+        process.stderr.write(`${indent}    - ${command}\n`);
+    process.stderr.write(`${indent}  acceptance:\n`);
+    for (const criterion of gap.acceptanceCriteria)
+        process.stderr.write(`${indent}    - ${criterion}\n`);
+    process.stderr.write(`${indent}  not evidence:\n`);
+    for (const item of gap.notEvidence)
+        process.stderr.write(`${indent}    - ${item}\n`);
+}
+function templatePublishBoundaries() {
+    return [
+        "Template publish uses CLI API token auth; it is not MCP authorization.",
+        "Org-private template publication is SaaS persistence and audit metadata only; it does not execute workflows.",
+        "Published templates remain workflow assets for local dna init/sync; dna-hook and local runtime evidence remain runtime truth.",
+        "runtime_authority is always false for template publish requests and receipts.",
+        "Source receipts are evidence references only and do not grant allow/warn/block/validate authority.",
+        "Dry-run performs no network request and creates no backend, auth, storage, or org-private SaaS state.",
+    ];
+}
+function templatePublicationsBoundaries() {
+    return [
+        "Template publication listing uses CLI API token auth; it is not MCP authorization.",
+        "Org-private template publication listing is a read-only SaaS projection; it does not execute workflows.",
+        "Listed templates remain workflow assets for local dna init/sync; dna-hook and local runtime evidence remain runtime truth.",
+        "runtime_authority is always false for template publication listing requests and receipts.",
+        "Org-private visibility is backed by Supabase organization membership, RLS, and audit metadata; it is not static catalog visibility.",
+        "Dry-run performs no network request and reads no backend, auth, storage, or org-private SaaS state.",
+    ];
+}
+function templateRevokeBoundaries() {
+    return [
+        "Template publication revoke uses CLI API token auth; it is not MCP authorization.",
+        "Org-private template publication revoke is SaaS metadata only; it does not execute workflows.",
+        "Revoked publications do not remove local template files or synced harness artifacts; local dna commands own local changes.",
+        "runtime_authority is always false for template publication revoke requests and receipts.",
+        "Org-private visibility is backed by Supabase organization membership, RLS, and audit metadata; it is not static catalog visibility.",
+        "Dry-run performs no network request and mutates no backend, auth, storage, org-private SaaS, or local runtime state.",
+    ];
+}
+function missingTemplateCloudEndpointReason(action) {
+    return `rejected: missing ${action} endpoint; set INTENTDNA_CLOUD_URL, SUPABASE_URL, or pass --endpoint`;
+}
+function templatePublicationLifecycle(params) {
+    const org = params.org?.trim() || "<org>";
+    const project = params.project?.trim() || "<project>";
+    const template = params.template?.trim() || "<template>";
+    const publicationId = params.publicationId?.trim() || "<publication-id>";
+    const endpointPresent = Boolean(params.endpoint);
+    const networkPerformed = params.networkPerformed ?? false;
+    const cloudRefs = asRecord(params.receipt?.cloud_refs);
+    const auditEvidencePresent = typeof cloudRefs?.audit_event_id === "string" && cloudRefs.audit_event_id.trim().length > 0;
+    const auditExpected = params.action === "publish" || params.action === "revoke";
+    const readyForLiveRequest = params.status === "dry_run" && endpointPresent && params.tokenPresent && !networkPerformed;
+    const actionReceiptComplete = (params.action === "publish" && params.status === "published" && auditEvidencePresent)
+        || (params.action === "list" && params.status === "ready")
+        || (params.action === "revoke" && params.status === "revoked" && auditEvidencePresent);
+    const lifecycleComplete = false;
+    const commandFor = (action, dryRun) => {
+        const dry = dryRun ? " --dry-run" : "";
+        if (action === "publish")
+            return `dna templates publish --org ${org} --project ${project} --template ${template} --receipt .dna/reports/org-review-receipt.json${dry} --json`;
+        if (action === "list")
+            return `dna templates publications --org ${org} --project ${project} --template ${template}${dry} --json`;
+        return `dna templates revoke --org ${org} --project ${project} --publication-id ${publicationId}${dry} --json`;
+    };
+    let nextAction = "Resolve the rejection reason, then rerun the dry-run before any live publication request.";
+    let nextCommands = [commandFor(params.action, true)];
+    if (!params.tokenPresent) {
+        nextAction = "Issue or store an IntentDNA CLI API token before org-private publication lifecycle requests.";
+        nextCommands = ["dna auth onboard --project-id <id> --json"];
+    }
+    else if (!endpointPresent) {
+        nextAction = "Set the Supabase project URL or pass an explicit Edge Function endpoint before live publication lifecycle requests.";
+        nextCommands = ["INTENTDNA_CLOUD_URL=https://<project-ref>.supabase.co " + commandFor(params.action, true)];
+    }
+    else if (readyForLiveRequest) {
+        nextAction = "Dry run is ready. Run the live request only after Supabase auth/RLS/audit functions are deployed and the source receipt is reviewed.";
+        nextCommands = [commandFor(params.action, false)];
+    }
+    else if (params.action === "publish" && params.status === "published" && !auditEvidencePresent) {
+        nextAction = "Publication was accepted, but audit_event_id is missing. Keep the receipt as incomplete lifecycle evidence and rerun function health/list checks before claiming org-private publication completion.";
+        nextCommands = [commandFor("list", false), "dna cloud function-health --json"];
+    }
+    else if (params.action === "publish" && params.status === "published") {
+        nextAction = "Publication receipt has audit evidence for this SaaS action. List org-private publications and keep RLS/member-role smoke evidence before claiming full lifecycle completion.";
+        nextCommands = [commandFor("list", false), commandFor("revoke", true)];
+    }
+    else if (params.action === "list" && params.status === "ready") {
+        nextAction = "Publication listing is available as read-only SaaS projection evidence. Full lifecycle completion still requires RLS denial proof, audit-backed publish/revoke receipts, and local dna gates.";
+        nextCommands = [commandFor("revoke", true), "dna org rollout"];
+    }
+    else if (params.action === "revoke" && params.status === "revoked" && !auditEvidencePresent) {
+        nextAction = "Publication revoke was accepted, but audit_event_id is missing. Keep the receipt as incomplete lifecycle evidence and rerun function health/list checks before claiming revoke completion.";
+        nextCommands = [commandFor("list", false), "dna cloud function-health --json"];
+    }
+    else if (params.action === "revoke" && params.status === "revoked") {
+        nextAction = "Publication revoke receipt has audit evidence for this SaaS action. List publications again and keep role/RLS smoke evidence before claiming full lifecycle completion.";
+        nextCommands = [commandFor("list", false)];
+    }
+    else if (networkPerformed) {
+        nextAction = "Inspect the returned SaaS receipt and audit metadata, fix the rejection, then rerun the matching dry-run.";
+    }
+    return {
+        visibility: "org_private",
+        authority: "supabase_auth_rls_audit_required",
+        local_runtime_authority: false,
+        action: params.action,
+        endpoint_present: endpointPresent,
+        auth_token_present: params.tokenPresent,
+        network_performed: networkPerformed,
+        ready_for_live_request: readyForLiveRequest,
+        action_receipt_complete: actionReceiptComplete,
+        lifecycle_complete: lifecycleComplete,
+        audit_expected: auditExpected,
+        audit_evidence_required: auditExpected,
+        audit_evidence_present: auditExpected ? auditEvidencePresent : false,
+        next_action: nextAction,
+        next_commands: nextCommands,
+        local_followup_gates: [
+            "dna org review",
+            "dna org rollout",
+            "dna sync --dry-run",
+            "dna sync",
+            "dna report package --json",
+        ],
+        receipt_authority_boundary: "Publication lifecycle receipts prove SaaS org-private metadata/audit state only; they do not prove local install, workflow approval, harness execution, or runtime policy authority.",
+        verification_gates: [
+            "dna org receipt --json produces a ready local source receipt for the asset.",
+            "dna templates publish dry-run succeeds before live publish.",
+            "Live publish/list/revoke receipts keep runtime_authority=false and visibility=org_private.",
+            "list-template-publications returns read-only org-private projection metadata.",
+            "Supabase RLS and Edge Function role checks reject unauthorized users before claiming org-private lifecycle completion.",
+            "Full lifecycle completion needs deployed Supabase evidence across publish, list, revoke, RLS denial, audit refs, and local dna follow-up gates.",
+        ],
+        boundaries: [
+            "This lifecycle block is explanatory readiness metadata; it does not publish, list, revoke, install, approve, or execute workflows.",
+            "Org-private visibility is SaaS-backed metadata only after Supabase auth/RLS/audit succeeds; static marketplace catalog must not claim org_private.",
+            "Local runtime truth remains dna/dna-hook plus local evidence; publication lifecycle receipts never grant allow/warn/block/validate authority.",
+        ],
+    };
+}
+function buildTemplateCloudEndpoint(opts, functionName) {
+    if (opts.endpoint?.trim())
+        return opts.endpoint.trim();
+    const env = opts.env ?? process.env;
+    const cloudUrl = env.INTENTDNA_CLOUD_URL?.trim()
+        || env.SUPABASE_URL?.trim()
+        || linkedSupabaseProjectUrl(env);
+    if (!cloudUrl)
+        return undefined;
+    return `${cloudUrl.replace(/\/+$/, "")}/functions/v1/${functionName}`;
+}
+function linkedSupabaseProjectUrl(env = process.env, readLinkedFiles = env === process.env) {
+    if (env.INTENTDNA_SUPABASE_DISABLE_LINKED_PROJECT === "1")
+        return undefined;
+    if (env.INTENTDNA_SUPABASE_LINKED_PROJECT_REF?.trim()) {
+        return `https://${env.INTENTDNA_SUPABASE_LINKED_PROJECT_REF.trim()}.supabase.co`;
+    }
+    if (!readLinkedFiles)
+        return undefined;
+    const directRef = existsSync("supabase/.temp/project-ref")
+        ? readFileSync("supabase/.temp/project-ref", "utf-8").trim()
+        : "";
+    if (directRef)
+        return `https://${directRef}.supabase.co`;
+    if (!existsSync("supabase/.temp/linked-project.json"))
+        return undefined;
+    try {
+        const linked = JSON.parse(readFileSync("supabase/.temp/linked-project.json", "utf-8"));
+        return typeof linked.ref === "string" && linked.ref.trim()
+            ? `https://${linked.ref.trim()}.supabase.co`
+            : undefined;
+    }
+    catch {
+        return undefined;
+    }
+}
+function buildPublishEndpoint(opts) {
+    return buildTemplateCloudEndpoint(opts, "publish-template");
+}
+function buildPublicationsEndpoint(opts) {
+    return buildTemplateCloudEndpoint(opts, "list-template-publications");
+}
+function buildRevokeEndpoint(opts) {
+    return buildTemplateCloudEndpoint(opts, "revoke-template-publication");
+}
+function receiptReference(value, schema) {
+    const record = asRecord(value);
+    if (!record)
+        return schema;
+    if (schema === "intentdna.org_review_receipt.v1") {
+        const organization = asRecord(record.organization);
+        const orgId = typeof organization?.id === "string" ? organization.id : undefined;
+        const generatedAt = typeof record.generated_at === "string" ? record.generated_at : undefined;
+        return [schema, orgId, generatedAt].filter(Boolean).join(":");
+    }
+    const envelopeRef = asRecord(record.envelope_ref);
+    const keyId = typeof envelopeRef?.key_id === "string" ? envelopeRef.key_id : undefined;
+    const sha = typeof envelopeRef?.sha256 === "string" ? envelopeRef.sha256 : undefined;
+    return [schema, sha, keyId].filter(Boolean).join(":");
+}
+function receiptOrgProjectMatches(candidate, org, project) {
+    const organization = asRecord(candidate.organization);
+    const candidateProject = asRecord(candidate.project);
+    const orgCandidates = [
+        candidate.organization_id,
+        organization?.id,
+        organization?.name,
+    ].filter((value) => typeof value === "string");
+    const projectCandidates = [
+        candidate.project_id,
+        candidate.project,
+        candidateProject?.id,
+        candidateProject?.name,
+    ].filter((value) => typeof value === "string");
+    return orgCandidates.includes(org) && projectCandidates.includes(project);
+}
+function receiptCandidatePublishReady(value) {
+    const candidate = asRecord(value);
+    return candidate?.publish_ready === true;
+}
+function receiptCandidateTemplate(value) {
+    const candidate = asRecord(value);
+    return typeof candidate?.asset === "string" ? candidate.asset : undefined;
+}
+function receiptCandidateContentHash(value) {
+    const candidate = asRecord(value);
+    return typeof candidate?.content_hash === "string" ? candidate.content_hash : undefined;
+}
+function receiptCandidateAssetVersion(value) {
+    const candidate = asRecord(value);
+    return typeof candidate?.asset_version === "string" ? candidate.asset_version : undefined;
+}
+function receiptCandidateReviewEvidence(value) {
+    const candidate = asRecord(value);
+    const evidence = Array.isArray(candidate?.review_evidence)
+        ? candidate.review_evidence
+        : Array.isArray(candidate?.reviewEvidence)
+            ? candidate.reviewEvidence
+            : [];
+    return evidence
+        .map((entry) => asRecord(entry))
+        .filter((entry) => Boolean(entry));
+}
+function receiptCandidateHasManagerReviewHandoff(value) {
+    return receiptCandidateReviewEvidence(value).some((evidence) => evidence.authority === "manager_review_handoff_only"
+        && (evidence.mode === "local_org_review_receipt"
+            || evidence.mode === "local_asset_diff_review_evidence")
+        && (typeof evidence.receipt_command === "string" || typeof evidence.receiptCommand === "string"));
+}
+function orgReceiptPublishCandidateReasons(record, params) {
+    const publicationPlan = asRecord(record.org_private_publication_plan);
+    const publicationPlanCandidates = Array.isArray(publicationPlan?.candidates)
+        ? publicationPlan.candidates
+        : [];
+    const rawCandidates = [
+        ...(Array.isArray(record.internal_ready_candidates) ? record.internal_ready_candidates : []),
+        ...publicationPlanCandidates,
+    ];
+    const candidates = rawCandidates
+        .map((candidate) => asRecord(candidate))
+        .filter((candidate) => Boolean(candidate));
+    const matching = candidates.filter((candidate) => receiptCandidateTemplate(candidate) === params.template
+        && receiptOrgProjectMatches(candidate, params.org, params.project));
+    if (matching.length === 0) {
+        return [`rejected: org review receipt does not include a matching internal-ready publication candidate for ${params.org}/${params.project}/${params.template}`];
+    }
+    if (!matching.some(receiptCandidatePublishReady)) {
+        return [`rejected: org review receipt candidate for ${params.org}/${params.project}/${params.template} is not publish_ready`];
+    }
+    if (params.contentHash && !matching.some((candidate) => receiptCandidateContentHash(candidate) === params.contentHash)) {
+        return [`rejected: org review receipt candidate for ${params.org}/${params.project}/${params.template} does not match template content_hash ${params.contentHash}`];
+    }
+    if (params.version && !matching.some((candidate) => {
+        const candidateVersion = receiptCandidateAssetVersion(candidate);
+        return !candidateVersion || candidateVersion === params.version;
+    })) {
+        return [`rejected: org review receipt candidate for ${params.org}/${params.project}/${params.template} does not match template version ${params.version}`];
+    }
+    if (!matching.some(receiptCandidateHasManagerReviewHandoff)) {
+        return [`rejected: org review receipt candidate for ${params.org}/${params.project}/${params.template} must include manager_review_handoff_only review evidence before publication`];
+    }
+    return [];
+}
+async function readTemplatePublishReceipt(path, options) {
+    let raw;
+    try {
+        raw = await readFile(path, "utf-8");
+    }
+    catch {
+        return { reasons: ["rejected: receipt file is missing"] };
+    }
+    let parsed;
+    try {
+        parsed = JSON.parse(raw);
+    }
+    catch {
+        return { reasons: ["rejected: receipt file is not valid JSON"] };
+    }
+    const record = asRecord(parsed);
+    if (!record)
+        return { reasons: ["rejected: receipt JSON must be an object"] };
+    const schema = record.schema_version;
+    if (schema !== "intentdna.org_review_receipt.v1" && schema !== "intentdna.report_ingest_receipt.v1") {
+        return { receipt: record, reasons: ["rejected: receipt schema must be intentdna.org_review_receipt.v1 or intentdna.report_ingest_receipt.v1"] };
+    }
+    const reasons = [];
+    if (schema === "intentdna.org_review_receipt.v1") {
+        if (record.cloud_authority !== false)
+            reasons.push("rejected: org review receipt must declare cloud_authority=false");
+        if (record.status !== "ready")
+            reasons.push("rejected: org review receipt must be ready before template publication");
+        if (options?.org && options.project && options.template) {
+            reasons.push(...orgReceiptPublishCandidateReasons(record, {
+                org: options.org,
+                project: options.project,
+                template: options.template,
+                contentHash: options.contentHash,
+                version: options.version,
+            }));
+        }
+    }
+    if (schema === "intentdna.report_ingest_receipt.v1") {
+        if (record.runtime_authority !== false)
+            reasons.push("rejected: report ingest receipt must declare runtime_authority=false");
+        if (record.trusted_cloud_ingestion !== true)
+            reasons.push("rejected: report ingest receipt must declare trusted_cloud_ingestion=true before template publication");
+        if (record.status !== "verified")
+            reasons.push("rejected: report ingest receipt must be verified before template publication");
+    }
+    return {
+        schema,
+        receipt: record,
+        ref: receiptReference(record, schema),
+        reasons,
+    };
+}
+function buildTemplatePublishResult(params) {
+    const fallbackTemplate = {
+        name: params.opts.template,
+        displayName: undefined,
+        version: "0.0.0",
+        contentHash: "unknown",
+        requiredDnaVersion: "unknown",
+        supportedHarnesses: [],
+        source: "project",
+        path: "",
+    };
+    const template = params.templateEntry && params.marketplace
+        ? {
+            name: params.templateEntry.name,
+            displayName: params.templateEntry.displayName,
+            version: params.templateEntry.version ?? "0.0.0",
+            contentHash: params.templateEntry.contentHash,
+            requiredDnaVersion: params.marketplace.requiredDnaVersion,
+            supportedHarnesses: params.marketplace.supportedHarnesses,
+            source: params.templateEntry.source,
+            path: params.templateEntry.path,
+        }
+        : fallbackTemplate;
+    const receipt = params.sourceReceipt;
+    return {
+        schema_version: "intentdna.template_publish_result.v1",
+        generated_at: new Date().toISOString(),
+        status: params.status,
+        endpoint: params.endpoint,
+        network_performed: params.networkPerformed ?? false,
+        runtime_authority: false,
+        request: {
+            schema_version: "intentdna.template_publish_request.v1",
+            organization: params.opts.org,
+            project: params.opts.project,
+            template: {
+                name: template.name,
+                display_name: template.displayName,
+                version: template.version,
+                content_hash: template.contentHash,
+                required_dna_version: template.requiredDnaVersion,
+                supported_harnesses: template.supportedHarnesses,
+                source: template.source,
+                path: template.path,
+            },
+            source_receipt: {
+                schema_version: params.receiptSchema ?? "intentdna.org_review_receipt.v1",
+                path: params.opts.receipt,
+                ref: params.receiptRef ?? params.opts.receipt,
+                status: typeof receipt?.status === "string" ? receipt.status : undefined,
+                cloud_authority: typeof receipt?.cloud_authority === "boolean" ? receipt.cloud_authority : undefined,
+                trusted_cloud_ingestion: typeof receipt?.trusted_cloud_ingestion === "boolean" ? receipt.trusted_cloud_ingestion : undefined,
+                runtime_authority: typeof receipt?.runtime_authority === "boolean" ? receipt.runtime_authority : undefined,
+            },
+            visibility: "org_private",
+            runtime_authority: false,
+        },
+        auth: {
+            token_present: params.tokenPresent,
+            source: params.authSource,
+        },
+        transport: {
+            network_performed: params.networkPerformed ?? false,
+            hidden_transport: false,
+            product_surface: "cli_to_supabase_edge_function",
+            mcp_visible: false,
+        },
+        publication_receipt: params.publicationReceipt,
+        publication_lifecycle: templatePublicationLifecycle({
+            action: "publish",
+            status: params.status,
+            endpoint: params.endpoint,
+            tokenPresent: params.tokenPresent,
+            networkPerformed: params.networkPerformed,
+            receipt: params.publicationReceipt,
+            org: params.opts.org,
+            project: params.opts.project,
+            template: params.opts.template,
+        }),
+        reasons: params.reasons,
+        boundaries: templatePublishBoundaries(),
+    };
+}
+function writeTemplatePublishSummary(result) {
+    process.stderr.write([
+        `Template publish: ${result.status}`,
+        `Template: ${result.request.template.name}`,
+        `Organization: ${result.request.organization}`,
+        `Project: ${result.request.project}`,
+        `Receipt: ${result.request.source_receipt.schema_version}`,
+        `Network performed: ${String(result.transport.network_performed)}`,
+        ...result.reasons.map((reason) => `Reason: ${reason}`),
+        ...result.boundaries.map((boundary) => `Boundary: ${boundary}`),
+    ].join("\n") + "\n");
+}
+function buildTemplatePublicationsResult(params) {
+    const publicationsValue = params.listingReceipt?.publications;
+    return {
+        schema_version: "intentdna.template_publications_result.v1",
+        generated_at: new Date().toISOString(),
+        status: params.status,
+        endpoint: params.endpoint,
+        network_performed: params.networkPerformed ?? false,
+        runtime_authority: false,
+        request: {
+            schema_version: "intentdna.template_publications_request.v1",
+            organization: params.opts.org?.trim() || undefined,
+            project: params.opts.project?.trim() || undefined,
+            template: params.opts.template?.trim() || undefined,
+            visibility: "org_private",
+            runtime_authority: false,
+        },
+        auth: {
+            token_present: params.tokenPresent,
+            source: params.authSource,
+        },
+        transport: {
+            network_performed: params.networkPerformed ?? false,
+            hidden_transport: false,
+            product_surface: "cli_to_supabase_edge_function",
+            mcp_visible: false,
+        },
+        publications: Array.isArray(publicationsValue)
+            ? publicationsValue.filter((item) => Boolean(asRecord(item)))
+            : [],
+        listing_receipt: params.listingReceipt,
+        publication_lifecycle: templatePublicationLifecycle({
+            action: "list",
+            status: params.status,
+            endpoint: params.endpoint,
+            tokenPresent: params.tokenPresent,
+            networkPerformed: params.networkPerformed,
+            receipt: params.listingReceipt,
+            org: params.opts.org,
+            project: params.opts.project,
+            template: params.opts.template,
+        }),
+        reasons: params.reasons,
+        boundaries: templatePublicationsBoundaries(),
+    };
+}
+function writeTemplatePublicationsSummary(result) {
+    process.stderr.write([
+        `Template publications: ${result.status}`,
+        `Organization: ${result.request.organization ?? "(token scope)"}`,
+        `Project: ${result.request.project ?? "(token scope)"}`,
+        `Template: ${result.request.template ?? "(all)"}`,
+        `Publications: ${result.publications.length}`,
+        `Network performed: ${String(result.transport.network_performed)}`,
+        ...result.reasons.map((reason) => `Reason: ${reason}`),
+        ...result.boundaries.map((boundary) => `Boundary: ${boundary}`),
+    ].join("\n") + "\n");
+}
+function buildTemplateRevokeResult(params) {
+    return {
+        schema_version: "intentdna.template_publication_revoke_result.v1",
+        generated_at: new Date().toISOString(),
+        status: params.status,
+        endpoint: params.endpoint,
+        network_performed: params.networkPerformed ?? false,
+        runtime_authority: false,
+        request: {
+            schema_version: "intentdna.template_publication_revoke_request.v1",
+            organization: params.opts.org?.trim() ?? "",
+            project: params.opts.project?.trim() ?? "",
+            publication_id: params.opts.publicationId?.trim() ?? "",
+            visibility: "org_private",
+            runtime_authority: false,
+            reason: params.opts.reason?.trim() || undefined,
+        },
+        auth: {
+            token_present: params.tokenPresent,
+            source: params.authSource,
+        },
+        transport: {
+            network_performed: params.networkPerformed ?? false,
+            hidden_transport: false,
+            product_surface: "cli_to_supabase_edge_function",
+            mcp_visible: false,
+        },
+        revoke_receipt: params.revokeReceipt,
+        publication_lifecycle: templatePublicationLifecycle({
+            action: "revoke",
+            status: params.status,
+            endpoint: params.endpoint,
+            tokenPresent: params.tokenPresent,
+            networkPerformed: params.networkPerformed,
+            receipt: params.revokeReceipt,
+            org: params.opts.org,
+            project: params.opts.project,
+            publicationId: params.opts.publicationId,
+        }),
+        reasons: params.reasons,
+        boundaries: templateRevokeBoundaries(),
+    };
+}
+function validateTemplateRemoteReceipt(params) {
+    const { functionName, receipt } = params;
+    if (!receipt)
+        return [`rejected: ${functionName} response body is not valid JSON receipt`];
+    const reasons = [];
+    if (receipt.schema_version !== params.expectedSchema) {
+        reasons.push(`rejected: ${functionName} receipt schema must be ${params.expectedSchema}`);
+    }
+    if (typeof receipt.status !== "string" || !params.allowedStatuses.includes(receipt.status)) {
+        reasons.push(`rejected: ${functionName} receipt status must be ${params.allowedStatuses.join(" or ")}`);
+    }
+    if (receipt.runtime_authority !== false) {
+        reasons.push(`rejected: ${functionName} receipt must declare runtime_authority=false`);
+    }
+    if (params.requireOrgPrivateVisibility && receipt.visibility !== "org_private") {
+        reasons.push(`rejected: ${functionName} receipt visibility must be org_private`);
+    }
+    if (params.requireUntrustedIngestion && receipt.trusted_cloud_ingestion !== false) {
+        reasons.push(`rejected: ${functionName} receipt must declare trusted_cloud_ingestion=false`);
+    }
+    if (params.requireLifecycleBoundary) {
+        if (typeof receipt.receipt_authority_boundary !== "string" || receipt.receipt_authority_boundary.trim().length === 0) {
+            reasons.push(`rejected: ${functionName} receipt must include receipt_authority_boundary`);
+        }
+        const gates = receipt.post_publication_local_gates;
+        const requiredGates = ["dna org review", "dna org rollout", "dna sync --dry-run", "dna sync", "dna report package --json"];
+        if (!Array.isArray(gates) || !requiredGates.every((gate) => gates.includes(gate))) {
+            reasons.push(`rejected: ${functionName} receipt must include post_publication_local_gates for local review, rollout, sync, and evidence`);
+        }
+    }
+    return reasons;
+}
+function reasonsFromRemoteReceipt(receipt, fallback) {
+    const reasons = receipt?.reasons;
+    if (!Array.isArray(reasons))
+        return fallback;
+    const normalized = reasons.map(String).filter(Boolean);
+    return normalized.length > 0 ? normalized : fallback;
+}
+function writeTemplateRevokeSummary(result) {
+    process.stderr.write([
+        `Template publication revoke: ${result.status}`,
+        `Organization: ${result.request.organization}`,
+        `Project: ${result.request.project}`,
+        `Publication: ${result.request.publication_id}`,
+        `Network performed: ${String(result.transport.network_performed)}`,
+        ...result.reasons.map((reason) => `Reason: ${reason}`),
+        ...result.boundaries.map((boundary) => `Boundary: ${boundary}`),
+    ].join("\n") + "\n");
+}
+export async function runTemplatesPublish(opts) {
+    const projectDir = resolve(opts.projectDir ?? process.cwd());
+    const missing = [
+        !opts.org?.trim() ? "--org" : undefined,
+        !opts.project?.trim() ? "--project" : undefined,
+        !opts.template?.trim() ? "--template" : undefined,
+        !opts.receipt?.trim() ? "--receipt" : undefined,
+    ].filter((item) => Boolean(item));
+    const auth = await resolveAuthToken({ env: opts.env, configDir: opts.configDir });
+    const endpoint = buildPublishEndpoint(opts);
+    const normalizedOpts = {
+        ...opts,
+        org: opts.org?.trim() ?? "",
+        project: opts.project?.trim() ?? "",
+        template: opts.template?.trim() ?? "",
+        receipt: opts.receipt?.trim() ?? "",
+    };
+    if (missing.length > 0) {
+        const result = buildTemplatePublishResult({
+            status: "rejected",
+            opts: normalizedOpts,
+            endpoint,
+            tokenPresent: Boolean(auth.token),
+            authSource: auth.source,
+            reasons: [`rejected: missing required option(s): ${missing.join(", ")}`],
+        });
+        if (opts.json)
+            process.stdout.write(JSON.stringify(result, null, 2) + "\n");
+        else
+            writeTemplatePublishSummary(result);
+        return 2;
+    }
+    if (!auth.token) {
+        const result = buildTemplatePublishResult({
+            status: "rejected",
+            opts: normalizedOpts,
+            endpoint,
+            tokenPresent: false,
+            authSource: auth.source,
+            reasons: [missingCliApiTokenReason()],
+        });
+        if (opts.json)
+            process.stdout.write(JSON.stringify(result, null, 2) + "\n");
+        else
+            writeTemplatePublishSummary(result);
+        return 2;
+    }
+    const templateEntry = await findTemplateCatalogEntry(normalizedOpts.template, { projectDir });
+    const marketplace = templateEntry ? await getTemplateMarketplaceMetadata(templateEntry) : undefined;
+    const asset = await findWorkflowAsset(normalizedOpts.template, { projectDir });
+    const receiptPath = resolve(projectDir, normalizedOpts.receipt);
+    const sourceReceipt = await readTemplatePublishReceipt(receiptPath, {
+        org: normalizedOpts.org,
+        project: normalizedOpts.project,
+        template: normalizedOpts.template,
+        contentHash: templateEntry?.contentHash,
+        version: templateEntry?.version,
+    });
+    const reasons = [
+        !templateEntry ? `rejected: unknown template ${normalizedOpts.template}` : undefined,
+        !asset ? `rejected: template ${normalizedOpts.template} is not a workflow asset candidate` : undefined,
+        ...sourceReceipt.reasons,
+    ].filter((item) => Boolean(item));
+    if (reasons.length > 0) {
+        const result = buildTemplatePublishResult({
+            status: "rejected",
+            opts: normalizedOpts,
+            endpoint,
+            tokenPresent: true,
+            authSource: auth.source,
+            templateEntry,
+            marketplace,
+            receiptSchema: sourceReceipt.schema,
+            receiptRef: sourceReceipt.ref,
+            sourceReceipt: sourceReceipt.receipt,
+            reasons,
+        });
+        if (opts.json)
+            process.stdout.write(JSON.stringify(result, null, 2) + "\n");
+        else
+            writeTemplatePublishSummary(result);
+        return 1;
+    }
+    if (opts.dryRun) {
+        const result = buildTemplatePublishResult({
+            status: "dry_run",
+            opts: normalizedOpts,
+            endpoint,
+            tokenPresent: true,
+            authSource: auth.source,
+            templateEntry,
+            marketplace,
+            receiptSchema: sourceReceipt.schema,
+            receiptRef: sourceReceipt.ref,
+            sourceReceipt: sourceReceipt.receipt,
+            reasons: ["dry_run: template publish request is ready but no network request was performed"],
+        });
+        if (opts.json)
+            process.stdout.write(JSON.stringify(result, null, 2) + "\n");
+        else
+            writeTemplatePublishSummary(result);
+        return 0;
+    }
+    if (!endpoint) {
+        const result = buildTemplatePublishResult({
+            status: "rejected",
+            opts: normalizedOpts,
+            tokenPresent: true,
+            authSource: auth.source,
+            templateEntry,
+            marketplace,
+            receiptSchema: sourceReceipt.schema,
+            receiptRef: sourceReceipt.ref,
+            sourceReceipt: sourceReceipt.receipt,
+            reasons: [missingTemplateCloudEndpointReason("publish")],
+        });
+        if (opts.json)
+            process.stdout.write(JSON.stringify(result, null, 2) + "\n");
+        else
+            writeTemplatePublishSummary(result);
+        return 2;
+    }
+    const ready = buildTemplatePublishResult({
+        status: "pending",
+        opts: normalizedOpts,
+        endpoint,
+        tokenPresent: true,
+        authSource: auth.source,
+        templateEntry,
+        marketplace,
+        receiptSchema: sourceReceipt.schema,
+        receiptRef: sourceReceipt.ref,
+        sourceReceipt: sourceReceipt.receipt,
+        reasons: ["pending: template publish request prepared for Supabase Edge Function"],
+    });
+    const fetchImpl = opts.fetch ?? globalThis.fetch;
+    const response = await fetchImpl(endpoint, {
+        method: "POST",
+        headers: {
+            "content-type": "application/json",
+            authorization: `Bearer ${auth.token}`,
+            "x-intentdna-cli": "dna templates publish",
+        },
+        body: JSON.stringify({
+            ...ready.request,
+            source_receipt_json: sourceReceipt.receipt,
+        }),
+    });
+    const text = await response.text();
+    let parsed;
+    try {
+        const value = JSON.parse(text);
+        parsed = sanitizeRecord(value);
+    }
+    catch {
+        parsed = undefined;
+    }
+    const receiptReasons = validateTemplateRemoteReceipt({
+        functionName: "publish-template",
+        receipt: parsed,
+        allowedStatuses: ["published", "pending", "rejected"],
+        expectedSchema: "intentdna.template_publication_receipt.v1",
+        requireOrgPrivateVisibility: true,
+        requireUntrustedIngestion: true,
+        requireLifecycleBoundary: true,
+    });
+    const publishedStatus = receiptReasons.length === 0 && parsed?.status === "published"
+        ? "published"
+        : receiptReasons.length === 0 && parsed?.status === "pending"
+            ? "pending"
+            : "rejected";
+    const result = buildTemplatePublishResult({
+        status: response.ok && receiptReasons.length === 0 ? publishedStatus : "rejected",
+        opts: normalizedOpts,
+        endpoint,
+        tokenPresent: true,
+        authSource: auth.source,
+        templateEntry,
+        marketplace,
+        receiptSchema: sourceReceipt.schema,
+        receiptRef: sourceReceipt.ref,
+        sourceReceipt: sourceReceipt.receipt,
+        networkPerformed: true,
+        publicationReceipt: parsed,
+        reasons: response.ok && parsed && receiptReasons.length === 0
+            ? publishedStatus === "rejected"
+                ? reasonsFromRemoteReceipt(parsed, ["rejected: publish-template returned a rejected receipt"])
+                : [`${publishedStatus}: publish-template returned ${parsed.schema_version ?? "unknown schema"}`]
+            : response.ok
+                ? receiptReasons
+                : [`rejected: publish-template endpoint returned HTTP ${response.status}`],
+    });
+    if (opts.json)
+        process.stdout.write(JSON.stringify(result, null, 2) + "\n");
+    else
+        writeTemplatePublishSummary(result);
+    return result.status === "published" || result.status === "pending" ? 0 : 1;
+}
+export async function runTemplatesRevoke(opts = {}) {
+    const auth = await resolveAuthToken({ env: opts.env, configDir: opts.configDir });
+    const endpoint = buildRevokeEndpoint(opts);
+    const missing = [
+        !opts.org?.trim() ? "--org" : undefined,
+        !opts.project?.trim() ? "--project" : undefined,
+        !opts.publicationId?.trim() ? "--publication-id" : undefined,
+    ].filter((item) => Boolean(item));
+    if (missing.length > 0) {
+        const result = buildTemplateRevokeResult({
+            status: "rejected",
+            opts,
+            endpoint,
+            tokenPresent: Boolean(auth.token),
+            authSource: auth.source,
+            reasons: [`rejected: missing required option(s): ${missing.join(", ")}`],
+        });
+        if (opts.json)
+            process.stdout.write(JSON.stringify(result, null, 2) + "\n");
+        else
+            writeTemplateRevokeSummary(result);
+        return 2;
+    }
+    if (!auth.token) {
+        const result = buildTemplateRevokeResult({
+            status: "rejected",
+            opts,
+            endpoint,
+            tokenPresent: false,
+            authSource: auth.source,
+            reasons: [missingCliApiTokenReason()],
+        });
+        if (opts.json)
+            process.stdout.write(JSON.stringify(result, null, 2) + "\n");
+        else
+            writeTemplateRevokeSummary(result);
+        return 2;
+    }
+    if (opts.dryRun) {
+        const result = buildTemplateRevokeResult({
+            status: "dry_run",
+            opts,
+            endpoint,
+            tokenPresent: true,
+            authSource: auth.source,
+            reasons: ["dry_run: template publication revoke request is ready but no network request was performed"],
+        });
+        if (opts.json)
+            process.stdout.write(JSON.stringify(result, null, 2) + "\n");
+        else
+            writeTemplateRevokeSummary(result);
+        return 0;
+    }
+    if (!endpoint) {
+        const result = buildTemplateRevokeResult({
+            status: "rejected",
+            opts,
+            tokenPresent: true,
+            authSource: auth.source,
+            reasons: [missingTemplateCloudEndpointReason("revoke")],
+        });
+        if (opts.json)
+            process.stdout.write(JSON.stringify(result, null, 2) + "\n");
+        else
+            writeTemplateRevokeSummary(result);
+        return 2;
+    }
+    const request = buildTemplateRevokeResult({
+        status: "pending",
+        opts,
+        endpoint,
+        tokenPresent: true,
+        authSource: auth.source,
+        reasons: ["pending: template publication revoke request prepared for Supabase Edge Function"],
+    }).request;
+    const fetchImpl = opts.fetch ?? globalThis.fetch;
+    const response = await fetchImpl(endpoint, {
+        method: "POST",
+        headers: {
+            "content-type": "application/json",
+            authorization: `Bearer ${auth.token}`,
+            "x-intentdna-cli": "dna templates revoke",
+        },
+        body: JSON.stringify(request),
+    });
+    const text = await response.text();
+    let parsed;
+    try {
+        const value = JSON.parse(text);
+        parsed = sanitizeRecord(value);
+    }
+    catch {
+        parsed = undefined;
+    }
+    const receiptReasons = validateTemplateRemoteReceipt({
+        functionName: "revoke-template-publication",
+        receipt: parsed,
+        allowedStatuses: ["revoked", "pending", "rejected"],
+        expectedSchema: "intentdna.template_publication_revoke_receipt.v1",
+        requireOrgPrivateVisibility: true,
+        requireUntrustedIngestion: true,
+        requireLifecycleBoundary: true,
+    });
+    const remoteStatus = receiptReasons.length === 0 && parsed?.status === "revoked"
+        ? "revoked"
+        : receiptReasons.length === 0 && parsed?.status === "pending"
+            ? "pending"
+            : "rejected";
+    const result = buildTemplateRevokeResult({
+        status: response.ok && receiptReasons.length === 0 ? remoteStatus : "rejected",
+        opts,
+        endpoint,
+        tokenPresent: true,
+        authSource: auth.source,
+        networkPerformed: true,
+        revokeReceipt: parsed,
+        reasons: response.ok && parsed && receiptReasons.length === 0
+            ? remoteStatus === "rejected"
+                ? reasonsFromRemoteReceipt(parsed, ["rejected: revoke-template-publication returned a rejected receipt"])
+                : [`${remoteStatus}: revoke-template-publication returned ${parsed.schema_version ?? "unknown schema"}`]
+            : response.ok
+                ? receiptReasons
+                : [`rejected: revoke-template-publication endpoint returned HTTP ${response.status}`],
+    });
+    if (opts.json)
+        process.stdout.write(JSON.stringify(result, null, 2) + "\n");
+    else
+        writeTemplateRevokeSummary(result);
+    return result.status === "revoked" || result.status === "pending" ? 0 : 1;
+}
+export async function runTemplatesPublications(opts = {}) {
+    const auth = await resolveAuthToken({ env: opts.env, configDir: opts.configDir });
+    const endpoint = buildPublicationsEndpoint(opts);
+    if (!auth.token) {
+        const result = buildTemplatePublicationsResult({
+            status: "rejected",
+            opts,
+            endpoint,
+            tokenPresent: false,
+            authSource: auth.source,
+            reasons: [missingCliApiTokenReason()],
+        });
+        if (opts.json)
+            process.stdout.write(JSON.stringify(result, null, 2) + "\n");
+        else
+            writeTemplatePublicationsSummary(result);
+        return 2;
+    }
+    if (opts.dryRun) {
+        const result = buildTemplatePublicationsResult({
+            status: "dry_run",
+            opts,
+            endpoint,
+            tokenPresent: true,
+            authSource: auth.source,
+            reasons: ["dry_run: template publications request is ready but no network request was performed"],
+        });
+        if (opts.json)
+            process.stdout.write(JSON.stringify(result, null, 2) + "\n");
+        else
+            writeTemplatePublicationsSummary(result);
+        return 0;
+    }
+    if (!endpoint) {
+        const result = buildTemplatePublicationsResult({
+            status: "rejected",
+            opts,
+            tokenPresent: true,
+            authSource: auth.source,
+            reasons: [missingTemplateCloudEndpointReason("publications")],
+        });
+        if (opts.json)
+            process.stdout.write(JSON.stringify(result, null, 2) + "\n");
+        else
+            writeTemplatePublicationsSummary(result);
+        return 2;
+    }
+    const request = buildTemplatePublicationsResult({
+        status: "pending",
+        opts,
+        endpoint,
+        tokenPresent: true,
+        authSource: auth.source,
+        reasons: ["pending: template publications request prepared for Supabase Edge Function"],
+    }).request;
+    const fetchImpl = opts.fetch ?? globalThis.fetch;
+    const response = await fetchImpl(endpoint, {
+        method: "POST",
+        headers: {
+            "content-type": "application/json",
+            authorization: `Bearer ${auth.token}`,
+            "x-intentdna-cli": "dna templates publications",
+        },
+        body: JSON.stringify(request),
+    });
+    const text = await response.text();
+    let parsed;
+    try {
+        const value = JSON.parse(text);
+        parsed = sanitizeRecord(value);
+    }
+    catch {
+        parsed = undefined;
+    }
+    const receiptReasons = validateTemplateRemoteReceipt({
+        functionName: "list-template-publications",
+        receipt: parsed,
+        allowedStatuses: ["ready", "pending", "rejected"],
+        expectedSchema: "intentdna.template_publications_list.v1",
+        requireUntrustedIngestion: true,
+        requireLifecycleBoundary: true,
+    });
+    const remoteStatus = receiptReasons.length === 0 && parsed?.status === "ready"
+        ? "ready"
+        : receiptReasons.length === 0 && parsed?.status === "pending"
+            ? "pending"
+            : "rejected";
+    const result = buildTemplatePublicationsResult({
+        status: response.ok && receiptReasons.length === 0 ? remoteStatus : "rejected",
+        opts,
+        endpoint,
+        tokenPresent: true,
+        authSource: auth.source,
+        networkPerformed: true,
+        listingReceipt: parsed,
+        reasons: response.ok && parsed && receiptReasons.length === 0
+            ? remoteStatus === "rejected"
+                ? reasonsFromRemoteReceipt(parsed, ["rejected: list-template-publications returned a rejected receipt"])
+                : [`${remoteStatus}: list-template-publications returned ${parsed.schema_version ?? "unknown schema"}`]
+            : response.ok
+                ? receiptReasons
+                : [`rejected: list-template-publications endpoint returned HTTP ${response.status}`],
+    });
+    if (opts.json)
+        process.stdout.write(JSON.stringify(result, null, 2) + "\n");
+    else
+        writeTemplatePublicationsSummary(result);
+    return result.status === "ready" || result.status === "pending" ? 0 : 1;
+}
+function asRecord(value) {
+    return value && typeof value === "object" && !Array.isArray(value) ? value : undefined;
+}
+function removeSensitiveFields(value) {
+    if (Array.isArray(value))
+        return value.map((item) => removeSensitiveFields(item));
+    if (!value || typeof value !== "object")
+        return value;
+    const output = {};
+    for (const [key, item] of Object.entries(value)) {
+        const normalized = key.toLowerCase();
+        if (normalized === "raw_token"
+            || normalized === "token_hash"
+            || normalized === "hash"
+            || normalized === "supabase_user_jwt"
+            || normalized === "user_jwt"
+            || normalized === "service_role_key"
+            || normalized === "secret_key"
+            || normalized === "token_pepper") {
+            continue;
+        }
+        output[key] = removeSensitiveFields(item);
+    }
+    return output;
+}
+function sanitizeRecord(value) {
+    const sanitized = removeSensitiveFields(value);
+    return asRecord(sanitized);
+}
+function recordSize(value) {
+    return Object.keys(asRecord(value) ?? {}).length;
+}
+function workflowStepCount(value) {
+    const workflows = asRecord(value);
+    if (!workflows)
+        return 0;
+    let count = 0;
+    for (const workflow of Object.values(workflows)) {
+        const steps = asRecord(workflow)?.steps;
+        if (Array.isArray(steps))
+            count += steps.length;
+    }
+    return count;
+}
+function unique(values) {
+    return [...new Set(values.filter(Boolean))];
+}
+function isExternalReferenceTagged(content) {
+    return /\b(OMC|OMX|oh-my-codex|Superpowers|SKILL\.md|\.codex\/skills)\b/i.test(content);
+}
+function deriveTemplateTags(entry, content, data) {
+    const tags = [
+        entry.source,
+        entry.namespace ? `ns:${entry.namespace}` : "",
+        recordSize(data.genes) > 0 ? "genes" : "",
+        recordSize(data.roles) > 0 ? "roles" : "",
+        recordSize(data.workflows) > 0 ? "workflow" : "",
+        recordSize(data.controllers) > 0 ? "controller" : "",
+        Array.isArray(data.evidence) ? "evidence-linked" : "",
+        isExternalReferenceTagged(content) ? "external-reference" : "",
+        ...entry.keywords.slice(0, 6).map((keyword) => `kw:${keyword}`),
+    ];
+    return unique(tags);
+}
+function buildTemplateCommands(name) {
+    return {
+        manage: `dna templates manage ${name}`,
+        show: `dna templates show ${name}`,
+        init: `dna init --template ${name}`,
+        assetInspect: `dna assets inspect ${name} --evidence`,
+        assetAdoption: `dna assets adoption ${name}`,
+        orgBind: `dna org bind --asset ${name} --status active --sync-target codex`,
+        orgReview: "dna org review",
+        orgRollout: "dna org rollout",
+    };
+}
+function buildTemplateManagementItem(entry, content, data, marketplace) {
+    return {
+        name: entry.name,
+        displayName: entry.displayName,
+        source: entry.source,
+        namespace: entry.namespace,
+        version: entry.version,
+        contentHash: entry.contentHash,
+        marketplace,
+        tags: deriveTemplateTags(entry, content, data),
+        stats: {
+            genes: recordSize(data.genes),
+            roles: recordSize(data.roles),
+            workflows: recordSize(data.workflows),
+            controllers: recordSize(data.controllers),
+            workflowSteps: workflowStepCount(data.workflows),
+        },
+        commands: buildTemplateCommands(entry.name),
+    };
+}
+function customTemplateRoutes(templateName) {
+    return [
+        {
+            id: "blank_draft",
+            label: "Author new workflow",
+            command: "dna workflow authoring-packet \"Describe the workflow intent\" --json",
+            writes: false,
+            purpose: "Give an external agent the self-contained C3 contract for interview, YAML authoring, deterministic validation, and explicit human save.",
+            nextCommands: [
+                "dna workflow draft \"Describe the workflow intent\" --save-template <draft-name>",
+                "dna assets inspect <draft-name> --evidence",
+                "dna assets adoption <draft-name>",
+            ],
+            boundary: "Packet generation is read-only. Saved assets remain local candidates until validation and explicit human review; they are not organization-approved, synced, published, or executed.",
+            scaffoldFallback: {
+                command: "dna workflow draft \"Describe the workflow intent\" --save-template <draft-name>",
+                writes: true,
+                positioning: "Example-clone scaffold only; its structure is not derived from the goal.",
+            },
+        },
+        {
+            id: "adapt_existing",
+            label: "Adapt existing",
+            command: `dna workflow edit-plan "Describe the reviewed workflow change" --from-template ${templateName} --save-template ${templateName}-v2`,
+            writes: true,
+            purpose: "Change variables, steps, boundaries, or verification gates from an existing governed asset through a reviewable version.",
+            nextCommands: [
+                `dna assets diff ${templateName} ${templateName}-v2`,
+                `dna assets adoption ${templateName}-v2`,
+            ],
+            boundary: "Adaptation does not replace or delete the source template; rollout still requires diff, adoption, org binding, and local sync gates.",
+        },
+        {
+            id: "import_metadata",
+            label: "Import metadata",
+            command: "dna templates sources --focus gaps --json",
+            writes: false,
+            purpose: "Scan external skill/workflow references as metadata and coverage signals before drafting any IntentDNA asset.",
+            nextCommands: [
+                "dna templates sources <reference>",
+                "dna templates sources <reference> --candidate",
+            ],
+            boundary: "External references are source material only; marketplace metadata must not treat raw runtime docs as policy truth.",
+        },
+        {
+            id: "review_packet",
+            label: "Review packet",
+            command: "dna templates sources <reference>",
+            writes: false,
+            purpose: "Open the reference review packet or candidate preview before saving any project-local draft.",
+            nextCommands: [
+                "dna templates sources <reference> --candidate",
+                "dna templates sources <reference> --candidate --save-template <draft-name>",
+            ],
+            boundary: "Review packets are read-only until an explicit --candidate --save-template command writes a project-local draft.",
+        },
+    ];
+}
+function topLevelSectionAnchors(lines) {
+    const topLevelKeys = lines
+        .map((line, index) => {
+        const match = /^([A-Za-z_][A-Za-z0-9_-]*):/.exec(line);
+        return match ? { key: match[1], line: index + 1 } : undefined;
+    })
+        .filter((item) => Boolean(item));
+    const interesting = new Set(["variables", "evidence", "genes", "contexts", "context_files", "roles", "controllers", "workflows"]);
+    return topLevelKeys
+        .filter((item) => interesting.has(item.key))
+        .map((item) => {
+        const next = topLevelKeys.find((candidate) => candidate.line > item.line);
+        return {
+            id: `section:${item.key}`,
+            label: item.key,
+            kind: "section",
+            startLine: item.line,
+            endLine: (next?.line ?? lines.length + 1) - 1,
+        };
+    });
+}
+function workflowStepAnchors(lines) {
+    const workflowSection = topLevelSectionAnchors(lines).find((anchor) => anchor.label === "workflows");
+    if (!workflowSection)
+        return [];
+    const starts = [];
+    for (let index = workflowSection.startLine - 1; index < workflowSection.endLine; index++) {
+        const match = /^\s+- id:\s*["']?([^"'\s#]+)["']?/.exec(lines[index]);
+        if (match)
+            starts.push({ id: match[1], line: index + 1 });
+    }
+    return starts.map((start, index) => ({
+        id: `step:${start.id}`,
+        label: start.id,
+        kind: "workflow_step",
+        startLine: start.line,
+        endLine: (starts[index + 1]?.line ?? workflowSection.endLine + 1) - 1,
+    }));
+}
+function templateAnchors(content) {
+    const lines = content.split("\n");
+    return [...topLevelSectionAnchors(lines), ...workflowStepAnchors(lines)].sort((a, b) => a.startLine - b.startLine);
+}
+function defaultSourceDirs() {
+    const home = homedir();
+    return [
+        join(home, ".codex", "skills"),
+        join(home, ".agents", "skills"),
+    ];
+}
+async function discoverSkillMarkdown(sourceDirs) {
+    const discovered = new Map();
+    const sourceRank = {
+        codex_skill: 0,
+        custom_skill: 1,
+        agents_skill: 2,
+    };
+    for (const sourceRoot of sourceDirs) {
+        let entries;
+        try {
+            entries = await readdir(sourceRoot);
+        }
+        catch {
+            continue;
+        }
+        const sourceType = sourceRoot.includes(".codex")
+            ? "codex_skill"
+            : sourceRoot.includes(".agents")
+                ? "agents_skill"
+                : "custom_skill";
+        for (const entry of entries.sort()) {
+            const skillPath = join(sourceRoot, entry, "SKILL.md");
+            if (!existsSync(skillPath))
+                continue;
+            const existing = discovered.get(entry);
+            if (!existing || sourceRank[sourceType] < sourceRank[existing.sourceType]) {
+                discovered.set(entry, { path: skillPath, sourceRoot, sourceType });
+            }
+        }
+    }
+    return [...discovered.values()];
+}
+function normalizeWords(value) {
+    return unique(value
+        .toLowerCase()
+        .replace(/[^a-z0-9\u4e00-\u9fa5]+/g, " ")
+        .split(/\s+/)
+        .filter((word) => word.length >= 3));
+}
+function firstHeading(content, fallback) {
+    const heading = content.split("\n").find((line) => /^#\s+/.test(line));
+    return heading?.replace(/^#\s+/, "").trim() || fallback;
+}
+function sourceSummary(content) {
+    const line = content
+        .split("\n")
+        .map((item) => item.trim())
+        .find((item) => item.length > 0 && !item.startsWith("#") && !item.startsWith("<!--"));
+    return line ? line.slice(0, 180) : "No summary line found in source document.";
+}
+function sourceSignals(id, title, content) {
+    const text = `${id}\n${title}\n${content}`.toLowerCase();
+    const checks = [
+        ["workflow", /\bworkflow|工作流|流程\b/],
+        ["verification", /\bverify|verification|test|qa|验证|测试\b/],
+        ["planning", /\bplan|planning|prd|路线|计划\b/],
+        ["review", /\breview|audit|critic|审查|评审\b/],
+        ["parallel", /\bteam|parallel|subagent|worker|swarm|并行|团队\b/],
+        ["browser", /\bbrowser|playwright|screenshot|visual|页面|截图\b/],
+        ["deploy", /\bdeploy|vercel|release|发布|部署\b/],
+        ["refactor", /\brefactor|cleanup|deslop|rewrite|重构|改写\b/],
+        ["knowledge", /\bwiki|doc|knowledge|memory|知识|文档\b/],
+        ["runtime", /\bcodex|claude|omx|omc|harness|runtime\b/],
+    ];
+    return checks.filter(([, pattern]) => pattern.test(text)).map(([signal]) => signal);
+}
+function sourcePriority(id, signals) {
+    const weights = {
+        workflow: 4,
+        refactor: 4,
+        verification: 3,
+        planning: 3,
+        review: 3,
+        parallel: 3,
+        deploy: 3,
+        browser: 2,
+        runtime: 2,
+        knowledge: 1,
+    };
+    const signalScore = signals.reduce((sum, signal) => sum + (weights[signal] ?? 0), 0);
+    const workflowSourceBoost = /^(ai-slop-cleaner|autopilot|code-review|deep-interview|frontend-design|frontend-skill|gh-|plan|playwright|ralph|ralplan|security-review|team|ultrawork|vercel-deploy|visual-verdict|web-clone|webapp-testing)$/.test(id)
+        || id.startsWith("lark-workflow-")
+        ? 5
+        : 0;
+    const apiWrapperPenalty = id.startsWith("lark-") && !id.startsWith("lark-workflow-") ? -4 : 0;
+    const score = signalScore + workflowSourceBoost + apiWrapperPenalty;
+    const reason = [
+        signals.length > 0 ? `signals=${signals.join(",")}` : "signals=none",
+        workflowSourceBoost > 0 ? "workflow-source-boost" : "",
+        apiWrapperPenalty < 0 ? "api-wrapper-penalty" : "",
+    ].filter(Boolean).join("; ");
+    return { score, reason };
+}
+function scoreTemplateCoverage(sourceId, title, summary, signals, templates) {
+    const sourceWords = new Set(normalizeWords(`${sourceId} ${title} ${summary} ${signals.join(" ")}`));
+    const matches = templates
+        .map((template) => {
+        const templateWords = new Set(normalizeWords([
+            template.name,
+            template.displayName ?? "",
+            template.namespace ?? "",
+            ...template.keywords,
+        ].join(" ")));
+        const overlap = [...sourceWords].filter((word) => templateWords.has(word));
+        const directNameHit = sourceId.includes(template.name) || template.name.includes(sourceId);
+        const score = overlap.length + (directNameHit ? 4 : 0);
+        return {
+            name: template.name,
+            score,
+            reason: directNameHit ? "name overlap" : `keyword overlap: ${overlap.slice(0, 5).join(", ") || "none"}`,
+        };
+    })
+        .filter((match) => match.score > 0)
+        .sort((a, b) => b.score - a.score)
+        .slice(0, 3);
+    const best = matches[0]?.score ?? 0;
+    const status = best >= 4 ? "covered" : best >= 2 ? "partial" : "candidate";
+    const explanation = status === "covered"
+        ? "A current template appears to cover this source; review only if the source changed materially."
+        : status === "partial"
+            ? "A related template exists, but this source may contain workflow details worth extracting."
+            : "No strong template match was found; review this as a possible new workflow asset.";
+    return { status, matchedTemplates: matches, explanation };
+}
+function sourceCandidateCommands(candidate) {
+    const primaryTemplate = candidate.coverage.matchedTemplates[0]?.name;
+    const commands = [
+        {
+            id: "review_source",
+            command: `dna templates sources ${candidate.id}`,
+            writes: false,
+            purpose: "Open the reference review packet before deciding whether to refresh or draft a template.",
+        },
+        {
+            id: "read_source",
+            command: `sed -n '1,220p' ${candidate.path}`,
+            writes: false,
+            purpose: "Read the reference workflow/skill before extracting any template change.",
+        },
+    ];
+    if (primaryTemplate) {
+        commands.push({
+            id: "manage_existing",
+            command: `dna templates manage ${primaryTemplate}`,
+            writes: false,
+            purpose: "Compare the source against the closest current governed template.",
+        });
+        commands.push({
+            id: "review_asset",
+            command: `dna assets adoption ${primaryTemplate}`,
+            writes: false,
+            purpose: "Review whether the existing asset should be adopted as-is before drafting changes.",
+        });
+    }
+    commands.push({
+        id: "draft_candidate",
+        command: `dna workflow authoring-packet "Extract ${candidate.id} as governed workflow asset" --json`,
+        writes: false,
+        purpose: "Only after source review, emit the C3 packet for external-agent candidate authoring and deterministic validation.",
+    });
+    commands.push({
+        id: "scaffold_candidate",
+        command: `dna workflow draft "Extract ${candidate.id} as governed workflow asset" --save-template ${candidate.id}-candidate`,
+        writes: true,
+        purpose: "Optional example-clone scaffold fallback; structure is not derived from the source intent.",
+        deprecated: true,
+        replacement: "draft_candidate",
+    });
+    return commands;
+}
+function buildSourceCandidate(source, content, templates) {
+    const id = basename(source.path.replace(/\/SKILL\.md$/, ""));
+    const title = firstHeading(content, id);
+    const summary = sourceSummary(content);
+    const signals = sourceSignals(id, title, content);
+    const priority = sourcePriority(id, signals);
+    const coverage = scoreTemplateCoverage(id, title, summary, signals, templates);
+    const base = {
+        id,
+        title,
+        path: source.path,
+        sourceRoot: source.sourceRoot,
+        sourceType: source.sourceType,
+        summary,
+        signals,
+        priority,
+        coverage,
+    };
+    return {
+        ...base,
+        recommendedCommands: sourceCandidateCommands(base),
+    };
+}
+async function loadTemplateSourceCandidates(opts) {
+    const sourceDirs = opts.sourceDirs?.length ? opts.sourceDirs : defaultSourceDirs();
+    const templates = await listTemplateCatalog({ projectDir: opts.projectDir });
+    const sources = await discoverSkillMarkdown(sourceDirs);
+    const allCandidates = (await Promise.all(sources.map(async (source) => {
+        const content = await readFile(source.path, "utf-8");
+        return buildSourceCandidate(source, content, templates);
+    }))).sort((a, b) => {
+        const byPriority = b.priority.score - a.priority.score;
+        if (byPriority !== 0)
+            return byPriority;
+        const rank = { candidate: 0, partial: 1, covered: 2 };
+        const byStatus = rank[a.coverage.status] - rank[b.coverage.status];
+        if (byStatus !== 0)
+            return byStatus;
+        return a.id.localeCompare(b.id);
+    });
+    return { sourceDirs, allCandidates };
+}
+function sourceReviewDecision(candidate) {
+    const primaryTemplate = candidate.coverage.matchedTemplates[0]?.name;
+    if (candidate.coverage.status === "covered" && primaryTemplate) {
+        return {
+            status: "refresh_existing_template",
+            reason: "A governed template already appears to cover this source. Review source changes against that template before drafting any mutation.",
+            primaryCommand: `dna templates manage ${primaryTemplate}`,
+            requiresHumanReview: true,
+        };
+    }
+    if (candidate.coverage.status === "partial" && primaryTemplate) {
+        return {
+            status: "review_partial_overlap",
+            reason: "A related template exists, but the source may contain workflow details that should become a reviewed template update or variant.",
+            primaryCommand: `dna templates manage ${primaryTemplate}`,
+            requiresHumanReview: true,
+        };
+    }
+    return {
+        status: "draft_new_template_candidate",
+        reason: "No strong template coverage was found. Treat this source as a possible new workflow asset and use the external-agent authoring packet after review.",
+        primaryCommand: `dna workflow authoring-packet "Extract ${candidate.id} as governed workflow asset" --json`,
+        requiresHumanReview: true,
+        scaffoldFallback: `dna workflow draft "Extract ${candidate.id} as governed workflow asset" --save-template ${candidate.id}-candidate`,
+    };
+}
+async function buildTemplateSourceReviewPacket(candidate) {
+    const content = await readFile(candidate.path, "utf-8");
+    const decision = sourceReviewDecision(candidate);
+    return {
+        mode: "template_source_review_packet",
+        source: "external_workflow_references",
+        candidate,
+        decision,
+        sourceDocument: {
+            path: candidate.path,
+            lineCount: content.split("\n").length,
+            content,
+        },
+        reviewChecklist: [
+            "Read the reference workflow/skill and identify actual reusable workflow behavior, not runtime-specific instructions.",
+            "Compare against the closest governed template when one exists.",
+            "Preserve IntentDNA boundaries: templates encode governed workflow assets, not raw external runtime docs.",
+            "Author new candidate templates through the C3 packet and dna validate loop; use workflow draft only as an explicitly labeled scaffold fallback.",
+            "Do not sync, deploy, or mutate evolution markers from a reference packet alone.",
+        ],
+        route: unique([
+            candidate.recommendedCommands.find((command) => command.id === "read_source")?.command ?? `sed -n '1,220p' ${candidate.path}`,
+            decision.primaryCommand,
+            candidate.recommendedCommands.find((command) => command.id === "scaffold_candidate")?.command ?? `dna workflow draft "Extract ${candidate.id} as governed workflow asset" --save-template ${candidate.id}-candidate`,
+            `dna assets diff <current-template> ${candidate.id}-candidate`,
+            `dna assets adoption ${candidate.id}-candidate`,
+        ]),
+        boundary: "Read-only reference review packet. External workflow/skill sources are references only; IntentDNA templates change only through reviewed workflow drafts, diffs, and asset adoption.",
+    };
+}
+function candidateTemplateName(sourceId) {
+    return `${sourceId}-candidate`;
+}
+function normalizeTemplateSaveName(name) {
+    return name.toLowerCase().replace(/[^a-z0-9]+/g, "-").replace(/^-|-$/g, "") || "source-candidate";
+}
+function workflowFromSourceCandidate(candidate) {
+    const closestTemplate = candidate.coverage.matchedTemplates[0]?.name;
+    const comparePrompt = closestTemplate
+        ? `Compare ${candidate.id} against governed template ${closestTemplate}. Extract only reusable workflow behavior and mark runtime-specific instructions as reference-only.`
+        : `Extract reusable workflow behavior from ${candidate.id}. Keep runtime-specific instructions as source references, not template truth.`;
+    return {
+        name: `source-${candidate.id}-candidate`,
+        description: `Reviewable candidate workflow extracted from ${candidate.title}.`,
+        steps: [
+            {
+                id: "read-source",
+                role: "explore",
+                description: "Read the source skill/workflow and identify reusable behavior.",
+                prompt: `Read ${candidate.path}. Identify reusable workflow behavior, verification gates, handoff artifacts, and runtime-specific instructions.`,
+                handoff: {
+                    produces: [{ type: "summary", name: "source_behavior_index", description: "Reusable behavior and runtime-only source notes." }],
+                },
+            },
+            {
+                id: "compare-governance",
+                role: "architect",
+                depends_on: ["read-source"],
+                description: "Compare the source against existing governed templates and IntentDNA boundaries.",
+                prompt: comparePrompt,
+                handoff: {
+                    consumes: [{ type: "summary", name: "source_behavior_index", from: "read-source", description: "Source behavior index." }],
+                    produces: [{ type: "summary", name: "candidate_governance_decision", description: "Refresh, variant, or new-template decision with rationale." }],
+                },
+            },
+            {
+                id: "shape-candidate",
+                role: "planner",
+                depends_on: ["compare-governance"],
+                description: "Shape a minimal workflow asset candidate for human review.",
+                prompt: `Shape ${candidate.id} as a minimal IntentDNA workflow asset candidate. Preserve review, evidence, sync, deploy, and evolution boundaries.`,
+                handoff: {
+                    consumes: [{ type: "summary", name: "candidate_governance_decision", from: "compare-governance", description: "Governance decision." }],
+                    produces: [{ type: "summary", name: "candidate_template_plan", description: "Candidate template plan and open questions." }],
+                },
+            },
+            {
+                id: "review-candidate",
+                role: "reviewer",
+                depends_on: ["shape-candidate"],
+                description: "Review the candidate before diff, adoption, organization binding, sync, or deploy.",
+                prompt: `Review ${candidate.id}-candidate for source fidelity, governance boundaries, missing verification, and whether it should update an existing template.`,
+                handoff: {
+                    consumes: [{ type: "summary", name: "candidate_template_plan", from: "shape-candidate", description: "Candidate template plan." }],
+                    produces: [{ type: "summary", name: "candidate_review_verdict", description: "APPROVE, REQUEST_CHANGES, or REJECT with evidence." }],
+                },
+            },
+        ],
+        retry_policy: {
+            max_retries: 1,
+            retry_from: "shape-candidate",
+            backoff: "none",
+        },
+    };
+}
+function sourceCandidateEvidence(candidate) {
+    return [
+        {
+            label: `${candidate.id} source skill`,
+            kind: "reference",
+            path: candidate.path,
+            description: "Source skill/workflow used as reference material for this candidate. It is not product truth until reviewed and adopted.",
+        },
+    ];
+}
+function buildSourceCandidatePreview(candidate, requestedTemplateName) {
+    const templateName = normalizeTemplateSaveName(requestedTemplateName ?? candidateTemplateName(candidate.id));
+    const workflow = workflowFromSourceCandidate(candidate);
+    const goal = `Extract ${candidate.id} as governed workflow asset`;
+    const draft = createWorkflowDraft({
+        exampleId: "dev_pipeline",
+        goal,
+        strictness: "high",
+    });
+    const templateYaml = workflowDraftToTemplateYaml({
+        templateName,
+        workflow,
+        generatedAt: draft.generated_at,
+        lineage: {
+            generatedFrom: "template_source_review_packet",
+            sourceCandidate: candidate.id,
+            sourceEvidence: candidate.path,
+        },
+        evidence: sourceCandidateEvidence(candidate),
+    });
+    const closestTemplate = candidate.coverage.matchedTemplates[0]?.name;
+    const decision = sourceReviewDecision(candidate);
+    return {
+        mode: "template_source_candidate_preview",
+        source: "external_workflow_references",
+        candidate,
+        templateName,
+        decision,
+        draft: {
+            ...draft,
+            workflow,
+            design_packet: {
+                ...draft.design_packet,
+                workflow: workflow.name,
+                goal,
+                stepCount: workflow.steps.length,
+                reviewCommands: [
+                    `dna templates sources ${candidate.id}`,
+                    `dna templates sources ${candidate.id} --candidate`,
+                    `dna assets diff ${closestTemplate ?? "<current-template>"} ${templateName}`,
+                    `dna assets adoption ${templateName}`,
+                ],
+                adoptionCommands: [
+                    `dna org bind --asset ${templateName} --status planned --sync-target codex`,
+                    "dna org rollout",
+                    "dna sync --codex",
+                ],
+            },
+            yaml: templateYaml,
+            validation: {
+                ...draft.validation,
+                preview: {
+                    ...draft.validation.preview,
+                    step_count: workflow.steps.length,
+                    parallel_groups: [
+                        ["read-source"],
+                        ["compare-governance"],
+                        ["shape-candidate"],
+                        ["review-candidate"],
+                    ],
+                    retry_max: workflow.retry_policy?.max_retries ?? 0,
+                },
+            },
+        },
+        templateYaml,
+        reviewCommands: [
+            `dna templates sources ${candidate.id}`,
+            `dna templates manage ${closestTemplate ?? templateName}`,
+            `dna assets diff ${closestTemplate ?? "<current-template>"} ${templateName}`,
+            `dna assets adoption ${templateName}`,
+        ],
+        blockedUntilReview: [
+            "Do not write this candidate into src/templates or .dna/templates without human review.",
+            "Do not bind, rollout, sync, deploy, or mutate evolution markers from this preview alone.",
+            "Do not treat raw external workflow instructions as IntentDNA policy truth.",
+        ],
+        boundary: "Read-only candidate preview. It prints a reviewable template YAML draft but does not write files, configure projects, sync runtimes, deploy, or mutate evolution markers.",
+    };
+}
+function writeSourceCandidatePreview(preview) {
+    process.stderr.write("Template reference candidate preview\n");
+    process.stderr.write(`Reference: ${preview.candidate.id}\n`);
+    process.stderr.write(`Template: ${preview.templateName}\n`);
+    process.stderr.write(`Decision: ${preview.decision.status}\n`);
+    process.stderr.write(`Workflow: ${preview.draft.workflow.name}\n`);
+    process.stderr.write(`Steps: ${preview.draft.workflow.steps.length}\n`);
+    process.stderr.write("\nReview commands\n");
+    for (const command of preview.reviewCommands)
+        process.stderr.write(`  - ${command}\n`);
+    process.stderr.write("\nBlocked until review\n");
+    for (const blocker of preview.blockedUntilReview)
+        process.stderr.write(`  - ${blocker}\n`);
+    process.stderr.write(`Boundary: ${preview.boundary}\n`);
+    process.stderr.write("\n--- YAML preview is written to stdout ---\n");
+    process.stdout.write(preview.templateYaml);
+    if (!preview.templateYaml.endsWith("\n"))
+        process.stdout.write("\n");
+}
+async function saveSourceCandidatePreview(params) {
+    const projectDir = params.projectDir ?? process.cwd();
+    const templateDir = join(projectDir, ".dna", "templates");
+    const path = join(templateDir, `${params.preview.templateName}.dna.yaml`);
+    if (existsSync(path)) {
+        return {
+            error: `Workflow asset draft already exists: ${params.preview.templateName}`,
+            path,
+        };
+    }
+    await mkdir(templateDir, { recursive: true });
+    await writeFile(path, params.preview.templateYaml, "utf-8");
+    const closestTemplate = params.preview.candidate.coverage.matchedTemplates[0]?.name ?? "<current-template>";
+    return {
+        mode: "saved_template_source_candidate",
+        source: "external_workflow_references",
+        templateName: params.preview.templateName,
+        path,
+        candidate: params.preview.candidate,
+        decision: params.preview.decision,
+        reviewCommands: params.preview.reviewCommands,
+        nextCommands: [
+            `dna assets inspect ${params.preview.templateName} --evidence`,
+            `dna assets diff ${closestTemplate} ${params.preview.templateName}`,
+            `dna assets adoption ${params.preview.templateName}`,
+            `dna org bind --asset ${params.preview.templateName} --status planned --sync-target codex`,
+            "dna org rollout",
+            "dna sync --codex --dry-run",
+        ],
+        blockedUntilReview: [
+            "Runtime sync remains blocked until asset diff/adoption and organization rollout review pass.",
+            "Vercel deployment is unrelated unless a web/public surface changes.",
+            "Evolution marker mutation remains blocked until evidence-backed suggestions are reviewed.",
+        ],
+        boundary: "Saved reference candidate as a project-local draft only. It is not adopted, organization-bound, synced, deployed, or evolved.",
+    };
+}
+function writeSavedSourceCandidate(result) {
+    process.stderr.write("Saved template reference candidate\n");
+    process.stderr.write(`Template: ${result.templateName}\n`);
+    process.stderr.write(`Path: ${result.path}\n`);
+    process.stderr.write(`Decision: ${result.decision.status}\n`);
+    process.stderr.write("\nNext commands\n");
+    for (const command of result.nextCommands)
+        process.stderr.write(`  - ${command}\n`);
+    process.stderr.write("\nBlocked until review\n");
+    for (const blocker of result.blockedUntilReview)
+        process.stderr.write(`  - ${blocker}\n`);
+    process.stderr.write(`Boundary: ${result.boundary}\n`);
+}
+function writeTemplateSourceReviewPacket(packet) {
+    process.stderr.write("Template reference review packet\n");
+    process.stderr.write(`Reference: ${packet.candidate.id}\n`);
+    process.stderr.write(`Title: ${packet.candidate.title}\n`);
+    process.stderr.write(`Path: ${packet.candidate.path}\n`);
+    process.stderr.write(`Decision: ${packet.decision.status}\n`);
+    process.stderr.write(`Reason: ${packet.decision.reason}\n`);
+    process.stderr.write(`Primary: ${packet.decision.primaryCommand}\n`);
+    if (packet.decision.scaffoldFallback)
+        process.stderr.write(`Scaffold fallback: ${packet.decision.scaffoldFallback}\n`);
+    process.stderr.write(`Coverage: ${packet.candidate.coverage.status}\n`);
+    const matched = packet.candidate.coverage.matchedTemplates.map((match) => `${match.name}(${match.score})`).join(", ") || "none";
+    process.stderr.write(`Matched: ${matched}\n`);
+    process.stderr.write(`Signals: ${packet.candidate.signals.join(", ") || "none"}\n`);
+    process.stderr.write(`Priority: ${packet.candidate.priority.score} (${packet.candidate.priority.reason})\n`);
+    process.stderr.write("\nChecklist\n");
+    for (const item of packet.reviewChecklist)
+        process.stderr.write(`  - ${item}\n`);
+    process.stderr.write("\nRoute\n");
+    for (const step of packet.route)
+        process.stderr.write(`  - ${step}\n`);
+    process.stderr.write(`Boundary: ${packet.boundary}\n`);
+}
+export async function runTemplatesSources(opts = {}) {
+    const focus = opts.focus ?? "all";
+    const { sourceDirs, allCandidates } = await loadTemplateSourceCandidates(opts);
+    if (opts.sourceId) {
+        const candidate = allCandidates.find((item) => item.id === opts.sourceId);
+        if (!candidate) {
+            process.stderr.write(`Unknown template reference: ${opts.sourceId}\n`);
+            process.stderr.write("Run `dna templates sources` to list available references.\n");
+            return 2;
+        }
+        if (opts.saveTemplate && !opts.candidate) {
+            process.stderr.write("Error: --save-template requires --candidate for reference candidates.\n");
+            return 2;
+        }
+        if (opts.candidate) {
+            const preview = buildSourceCandidatePreview(candidate, opts.saveTemplate);
+            if (opts.saveTemplate) {
+                const saved = await saveSourceCandidatePreview({ preview, projectDir: opts.projectDir });
+                if ("error" in saved) {
+                    process.stderr.write(`${saved.error}\n`);
+                    process.stderr.write(`Path: ${saved.path}\n`);
+                    process.stderr.write("Review the existing draft before overwriting it.\n");
+                    return 2;
+                }
+                if (opts.json) {
+                    process.stdout.write(`${JSON.stringify(saved, null, 2)}\n`);
+                    return 0;
+                }
+                writeSavedSourceCandidate(saved);
+                return 0;
+            }
+            if (opts.json) {
+                process.stdout.write(`${JSON.stringify(preview, null, 2)}\n`);
+                return 0;
+            }
+            writeSourceCandidatePreview(preview);
+            return 0;
+        }
+        const packet = await buildTemplateSourceReviewPacket(candidate);
+        if (opts.json) {
+            process.stdout.write(`${JSON.stringify(packet, null, 2)}\n`);
+            return 0;
+        }
+        writeTemplateSourceReviewPacket(packet);
+        return 0;
+    }
+    const candidates = allCandidates.filter((candidate) => {
+        if (focus === "refresh")
+            return candidate.coverage.status === "covered" || candidate.coverage.status === "partial";
+        if (focus === "gaps")
+            return candidate.coverage.status === "candidate";
+        return true;
+    });
+    const review = {
+        mode: "template_source_candidates",
+        source: "external_workflow_references",
+        focus,
+        totals: {
+            sourceDirs: sourceDirs.length,
+            sourcesScanned: allCandidates.length,
+            sourcesVisible: candidates.length,
+            covered: allCandidates.filter((candidate) => candidate.coverage.status === "covered").length,
+            partial: allCandidates.filter((candidate) => candidate.coverage.status === "partial").length,
+            candidates: allCandidates.filter((candidate) => candidate.coverage.status === "candidate").length,
+        },
+        sourceDirs,
+        candidates,
+        route: [
+            focus === "refresh"
+                ? "Review covered and partial sources first to decide whether existing templates need updates."
+                : focus === "gaps"
+                    ? "Review uncovered sources first to decide whether a new workflow asset is worth drafting."
+                    : "Review high-priority sources first, then choose refresh or gaps focus when the queue is too broad.",
+            "Compare the closest existing template with dna templates manage <template>.",
+            "Draft candidate templates only after reference review, then use asset diff/adoption before promotion.",
+        ],
+        boundary: "This command is read-only. External workflow/skill sources are references only; IntentDNA templates change only through reviewed workflow drafts and asset adoption.",
+    };
+    if (opts.json) {
+        process.stdout.write(`${JSON.stringify(review, null, 2)}\n`);
+        return 0;
+    }
+    process.stderr.write("Template reference candidates\n");
+    process.stderr.write(`Focus: ${review.focus}\n`);
+    process.stderr.write(`Sources scanned: ${review.totals.sourcesScanned}\n`);
+    process.stderr.write(`Visible: ${review.totals.sourcesVisible}\n`);
+    process.stderr.write(`Covered: ${review.totals.covered}\n`);
+    process.stderr.write(`Partial: ${review.totals.partial}\n`);
+    process.stderr.write(`Candidates: ${review.totals.candidates}\n`);
+    process.stderr.write("\nSource directories\n");
+    for (const dir of review.sourceDirs)
+        process.stderr.write(`  - ${dir}\n`);
+    process.stderr.write("\nReview queue\n");
+    for (const candidate of review.candidates.slice(0, 12)) {
+        const matched = candidate.coverage.matchedTemplates.map((match) => `${match.name}(${match.score})`).join(", ") || "none";
+        process.stderr.write(`  - [${candidate.coverage.status}] ${candidate.id}: ${candidate.title}\n`);
+        process.stderr.write(`    priority: ${candidate.priority.score} (${candidate.priority.reason})\n`);
+        process.stderr.write(`    signals: ${candidate.signals.join(", ") || "none"}\n`);
+        process.stderr.write(`    matched: ${matched}\n`);
+        process.stderr.write(`    why: ${candidate.coverage.explanation}\n`);
+        for (const command of candidate.recommendedCommands) {
+            process.stderr.write(`    next: ${command.command}\n`);
+        }
+    }
+    process.stderr.write("\nRoute\n");
+    for (const step of review.route)
+        process.stderr.write(`  - ${step}\n`);
+    process.stderr.write(`Boundary: ${review.boundary}\n`);
+    return 0;
+}
+export async function runTemplatesManage(opts = {}) {
+    const templates = await listTemplateCatalog({ projectDir: opts.projectDir });
+    if (templates.length === 0) {
+        process.stderr.write("No templates found.\n");
+        return 1;
+    }
+    const selectedEntry = opts.name
+        ? templates.find((entry) => entry.name === opts.name || entry.displayName === opts.name || entry.namespace === opts.name)
+        : templates.find((entry) => entry.name === WORKFLOW_ASSET_IDS.default) ?? templates[0];
+    if (!selectedEntry) {
+        process.stderr.write(`Unknown template: ${opts.name}\n`);
+        return 2;
+    }
+    const loaded = await Promise.all(templates.map(async (entry) => {
+        const content = await readFile(entry.path, "utf-8");
+        const data = asRecord(parseYAML(content)) ?? {};
+        const marketplace = await getTemplateMarketplaceMetadata(entry, { content });
+        return {
+            entry,
+            content,
+            data,
+            item: buildTemplateManagementItem(entry, content, data, marketplace),
+        };
+    }));
+    const selected = loaded.find((item) => item.entry.name === selectedEntry.name) ?? loaded[0];
+    const lineCount = selected.content.split("\n").length;
+    const anchors = templateAnchors(selected.content);
+    const allTags = unique(loaded.flatMap((item) => item.item.tags)).sort();
+    const view = {
+        mode: "template_management_view",
+        layout: {
+            left: ["tags", "source", "stats", "steps", "commands"],
+            right: "full_yaml_file",
+            followSelection: "Use anchor startLine/endLine to keep the YAML editor synced with the selected tag, section, or workflow step.",
+        },
+        selected: {
+            ...selected.item,
+            path: selected.entry.path,
+            anchors,
+            nextCommands: [
+                selected.item.commands.show,
+                selected.item.commands.assetInspect,
+                selected.item.commands.assetAdoption,
+            ],
+        },
+        catalog: {
+            totals: {
+                templates: loaded.length,
+                builtin: loaded.filter((item) => item.entry.source === "builtin").length,
+                project: loaded.filter((item) => item.entry.source === "project").length,
+                externalReferenceTagged: loaded.filter((item) => item.item.tags.includes("external-reference")).length,
+            },
+            tags: allTags,
+            items: loaded.map((item) => item.item),
+        },
+        customTemplateRoutes: customTemplateRoutes(selected.item.name),
+        referenceReview: {
+            status: "planned_import_path",
+            source: "external_workflow_references",
+            route: [
+                "Read external workflow/skill references as source material.",
+                "Extract role, step, verification, state, and evidence conventions into candidate workflow assets.",
+                "Review candidate diff before promoting it into src/templates or .dna/templates.",
+            ],
+            boundary: "Do not copy external runtime docs directly into templates; IntentDNA stores governed workflow assets and keeps source systems as references only.",
+        },
+        document: {
+            path: selected.entry.path,
+            language: "yaml",
+            lineCount,
+            content: selected.content,
+        },
+    };
+    if (opts.json) {
+        process.stdout.write(`${JSON.stringify(view, null, 2)}\n`);
+        return 0;
+    }
+    process.stderr.write("Template management view\n");
+    process.stderr.write(`Selected: ${view.selected.name}`);
+    if (view.selected.displayName)
+        process.stderr.write(` — ${view.selected.displayName}`);
+    process.stderr.write(`\nSource: ${view.selected.source}\n`);
+    process.stderr.write(`Path: ${view.selected.path}\n`);
+    process.stderr.write(`Tags: ${view.selected.tags.join(", ")}\n`);
+    process.stderr.write(`Marketplace: ${view.selected.marketplace.visibility}; harnesses=${view.selected.marketplace.supportedHarnesses.join(", ")}; sync=${view.selected.marketplace.syncSurfaces.join(", ")}\n`);
+    process.stderr.write(`Stats: genes=${view.selected.stats.genes}, roles=${view.selected.stats.roles}, workflows=${view.selected.stats.workflows}, steps=${view.selected.stats.workflowSteps}, controllers=${view.selected.stats.controllers}\n`);
+    process.stderr.write("\nLayout\n");
+    process.stderr.write("  left: tags + details + step index + commands\n");
+    process.stderr.write("  right: full YAML file\n");
+    process.stderr.write(`  follow: ${view.layout.followSelection}\n`);
+    process.stderr.write("\nStep/section index\n");
+    for (const anchor of view.selected.anchors) {
+        process.stderr.write(`  - ${anchor.kind} ${anchor.label}: lines ${anchor.startLine}-${anchor.endLine}\n`);
+    }
+    process.stderr.write("\nCommands\n");
+    for (const command of view.selected.nextCommands)
+        process.stderr.write(`  - ${command}\n`);
+    process.stderr.write("\nCustom template routes\n");
+    for (const route of view.customTemplateRoutes) {
+        process.stderr.write(`  ${route.id}. ${route.label}\n`);
+        process.stderr.write(`     command: ${route.command}\n`);
+        process.stderr.write(`     writes=${route.writes ? "yes" : "no"}\n`);
+        process.stderr.write(`     purpose: ${route.purpose}\n`);
+        if (route.scaffoldFallback) {
+            process.stderr.write(`     scaffold fallback: ${route.scaffoldFallback.command}\n`);
+            process.stderr.write(`     scaffold positioning: ${route.scaffoldFallback.positioning}\n`);
+        }
+        process.stderr.write(`     next: ${route.nextCommands.join(" | ")}\n`);
+        process.stderr.write(`     boundary: ${route.boundary}\n`);
+    }
+    process.stderr.write("\nExternal reference review\n");
+    for (const step of view.referenceReview.route)
+        process.stderr.write(`  - ${step}\n`);
+    process.stderr.write(`  boundary: ${view.referenceReview.boundary}\n`);
+    process.stderr.write("\n--- YAML is written to stdout ---\n");
+    process.stdout.write(view.document.content);
+    if (!view.document.content.endsWith("\n"))
+        process.stdout.write("\n");
+    return 0;
+}
 export async function runTemplatesDeploy(opts = {}) {
     try {
         const cwd = process.cwd();