intentdna 1.8.7 → 1.9.0-rc.2

package/dist/cli/commands/templates.js

@@ -1,7 +1,7 @@
 /**
  * dna templates — template catalog and deployment commands.
  */
-import { readdirSync, copyFileSync, existsSync, readFileSync, mkdirSync } from "node:fs";
+import { readdirSync, copyFileSync, existsSync, readFileSync, mkdirSync, lstatSync, } from "node:fs";
 import { mkdir, readdir, writeFile } from "node:fs/promises";
 import { homedir } from "node:os";
 import { resolve, join, basename, dirname } from "node:path";
@@ -15,6 +15,7 @@ import { resolveAuthToken } from "./auth.js";
 import { missingCliApiTokenReason } from "./cloud-auth-guidance.js";
 import { createWorkflowDraft, workflowDraftToTemplateYaml, } from "../../workflow/index.js";
 import { WORKFLOW_ASSET_IDS } from "../../templates/metadata.js";
+import { buildSourceAuthoringPacket } from "../../sources/authoring-packet.js";
 /**
  * Resolve the global intentdna templates directory.
  * Strategy: npm root -g + /intentdna/dist/templates
@@ -1774,6 +1775,9 @@ function candidateTemplateName(sourceId) {
 function normalizeTemplateSaveName(name) {
     return name.toLowerCase().replace(/[^a-z0-9]+/g, "-").replace(/^-|-$/g, "") || "source-candidate";
 }
+function isSafeCandidateName(name) {
+    return /^[a-z][a-z0-9-]{1,62}$/.test(name);
+}
 function workflowFromSourceCandidate(candidate) {
     const closestTemplate = candidate.coverage.matchedTemplates[0]?.name;
     const comparePrompt = closestTemplate
@@ -1922,37 +1926,50 @@ function buildSourceCandidatePreview(candidate, requestedTemplateName) {
         boundary: "Read-only candidate preview. It prints a reviewable template YAML draft but does not write files, configure projects, sync runtimes, deploy, or mutate evolution markers.",
     };
 }
-function writeSourceCandidatePreview(preview) {
-    process.stderr.write("Template reference candidate preview\n");
-    process.stderr.write(`Reference: ${preview.candidate.id}\n`);
-    process.stderr.write(`Template: ${preview.templateName}\n`);
-    process.stderr.write(`Decision: ${preview.decision.status}\n`);
-    process.stderr.write(`Workflow: ${preview.draft.workflow.name}\n`);
-    process.stderr.write(`Steps: ${preview.draft.workflow.steps.length}\n`);
-    process.stderr.write("\nReview commands\n");
-    for (const command of preview.reviewCommands)
-        process.stderr.write(`  - ${command}\n`);
-    process.stderr.write("\nBlocked until review\n");
-    for (const blocker of preview.blockedUntilReview)
-        process.stderr.write(`  - ${blocker}\n`);
-    process.stderr.write(`Boundary: ${preview.boundary}\n`);
-    process.stderr.write("\n--- YAML preview is written to stdout ---\n");
-    process.stdout.write(preview.templateYaml);
-    if (!preview.templateYaml.endsWith("\n"))
-        process.stdout.write("\n");
-}
 async function saveSourceCandidatePreview(params) {
-    const projectDir = params.projectDir ?? process.cwd();
-    const templateDir = join(projectDir, ".dna", "templates");
-    const path = join(templateDir, `${params.preview.templateName}.dna.yaml`);
+    const projectDir = resolve(params.projectDir ?? process.cwd());
+    const dnaDir = join(projectDir, ".dna");
+    const authoringDir = join(dnaDir, "authoring");
+    const path = join(authoringDir, `${params.preview.templateName}.candidate.dna.yaml`);
+    for (const stagingParent of [dnaDir, authoringDir]) {
+        if (existsSync(stagingParent)
+            && lstatSync(stagingParent).isSymbolicLink()) {
+            return {
+                error: `Candidate staging path must not contain a symlink: ${stagingParent}`,
+                path,
+            };
+        }
+    }
     if (existsSync(path)) {
         return {
-            error: `Workflow asset draft already exists: ${params.preview.templateName}`,
+            error: `Candidate already exists: ${params.preview.templateName}`,
             path,
         };
     }
-    await mkdir(templateDir, { recursive: true });
-    await writeFile(path, params.preview.templateYaml, "utf-8");
+    await mkdir(authoringDir, { recursive: true });
+    for (const stagingParent of [dnaDir, authoringDir]) {
+        if (lstatSync(stagingParent).isSymbolicLink()) {
+            return {
+                error: `Candidate staging path must not contain a symlink: ${stagingParent}`,
+                path,
+            };
+        }
+    }
+    try {
+        await writeFile(path, params.preview.templateYaml, {
+            encoding: "utf-8",
+            flag: "wx",
+        });
+    }
+    catch (error) {
+        if (error.code === "EEXIST") {
+            return {
+                error: `Candidate already exists: ${params.preview.templateName}`,
+                path,
+            };
+        }
+        throw error;
+    }
     const closestTemplate = params.preview.candidate.coverage.matchedTemplates[0]?.name ?? "<current-template>";
     return {
         mode: "saved_template_source_candidate",
@@ -1963,19 +1980,18 @@ async function saveSourceCandidatePreview(params) {
         decision: params.preview.decision,
         reviewCommands: params.preview.reviewCommands,
         nextCommands: [
-            `dna assets inspect ${params.preview.templateName} --evidence`,
+            `dna validate ${path}`,
+            `dna workflow project-candidate ${path} --target claude --dry-run`,
+            `dna workflow project-candidate ${path} --target codex --dry-run`,
             `dna assets diff ${closestTemplate} ${params.preview.templateName}`,
             `dna assets adoption ${params.preview.templateName}`,
-            `dna org bind --asset ${params.preview.templateName} --status planned --sync-target codex`,
-            "dna org rollout",
-            "dna sync --codex --dry-run",
         ],
         blockedUntilReview: [
             "Runtime sync remains blocked until asset diff/adoption and organization rollout review pass.",
             "Vercel deployment is unrelated unless a web/public surface changes.",
             "Evolution marker mutation remains blocked until evidence-backed suggestions are reviewed.",
         ],
-        boundary: "Saved reference candidate as a project-local draft only. It is not adopted, organization-bound, synced, deployed, or evolved.",
+        boundary: "Saved an unreviewed candidate under .dna/authoring only. It is not promoted, adopted, organization-bound, synced, deployed, or evolved.",
     };
 }
 function writeSavedSourceCandidate(result) {
@@ -2029,8 +2045,12 @@ export async function runTemplatesSources(opts = {}) {
             return 2;
         }
         if (opts.candidate) {
-            const preview = buildSourceCandidatePreview(candidate, opts.saveTemplate);
             if (opts.saveTemplate) {
+                if (!isSafeCandidateName(opts.saveTemplate)) {
+                    process.stderr.write("Error: invalid candidate name; use 2-63 lowercase letters, digits, or hyphens, starting with a letter.\n");
+                    return 2;
+                }
+                const preview = buildSourceCandidatePreview(candidate, opts.saveTemplate);
                 const saved = await saveSourceCandidatePreview({ preview, projectDir: opts.projectDir });
                 if ("error" in saved) {
                     process.stderr.write(`${saved.error}\n`);
@@ -2045,11 +2065,13 @@ export async function runTemplatesSources(opts = {}) {
                 writeSavedSourceCandidate(saved);
                 return 0;
             }
-            if (opts.json) {
-                process.stdout.write(`${JSON.stringify(preview, null, 2)}\n`);
-                return 0;
-            }
-            writeSourceCandidatePreview(preview);
+            const packet = await buildSourceAuthoringPacket({
+                skillDir: dirname(candidate.path),
+                projectDir: opts.projectDir,
+                sourceId: candidate.id,
+            });
+            process.stderr.write("Warning: deprecated --candidate alias; use --packet for source authoring packets.\n");
+            process.stdout.write(`${JSON.stringify(packet, null, 2)}\n`);
             return 0;
         }
         const packet = await buildTemplateSourceReviewPacket(candidate);

package/dist/cli/index.js

@@ -12,9 +12,57 @@
  *   help       Show this help message
  */
 import { parseArgs } from "node:util";
+import { basename, isAbsolute, relative, resolve } from "node:path";
 import { getPackageVersion } from "./util/version.js";
 import { WORKFLOW_ASSET_IDS } from "../templates/metadata.js";
 const fallbackVersion = "unknown";
+const REFINERY_CANDIDATE_FILE_RE = /^([a-z][a-z0-9-]{1,62})\.candidate\.dna\.yaml$/;
+function normalizeAssetRefineryVariables(projectDir, variables) {
+    const authoringRoot = resolve(projectDir, ".dna", "authoring");
+    const normalizeAuthoringPath = (value, label) => {
+        const absolute = resolve(projectDir, value);
+        const fromAuthoring = relative(authoringRoot, absolute);
+        if (fromAuthoring === ""
+            || fromAuthoring === ".."
+            || fromAuthoring.startsWith("../")
+            || fromAuthoring.startsWith("..\\")
+            || isAbsolute(fromAuthoring)) {
+            return {
+                error: `${label} must resolve inside the selected project's .dna/authoring directory`,
+            };
+        }
+        return {
+            path: `.dna/authoring/${fromAuthoring.replaceAll("\\", "/")}`,
+            absolute,
+        };
+    };
+    const sourcePacket = normalizeAuthoringPath(variables.source_packet ?? ".dna/authoring/source-packet.json", "source_packet");
+    if (sourcePacket.error)
+        return sourcePacket.error;
+    const requestedCandidateName = variables.candidate_name;
+    const candidateValue = variables.candidate_path
+        ?? `.dna/authoring/${requestedCandidateName ?? "source"}.candidate.dna.yaml`;
+    const candidate = normalizeAuthoringPath(candidateValue, "candidate_path");
+    if (candidate.error)
+        return candidate.error;
+    const candidateFilename = basename(candidate.absolute);
+    const candidateMatch = REFINERY_CANDIDATE_FILE_RE.exec(candidateFilename);
+    if (!candidateMatch) {
+        return "candidate_path must end with <safe-name>.candidate.dna.yaml, using 2-63 lowercase letters, digits, or hyphens";
+    }
+    if (candidate.path.slice(".dna/authoring/".length) !== candidateFilename) {
+        return "candidate_path must be a direct child of .dna/authoring";
+    }
+    const candidateName = candidateMatch[1];
+    if (requestedCandidateName !== undefined
+        && requestedCandidateName !== candidateName) {
+        return "candidate_name must match the basename of candidate_path";
+    }
+    variables.source_packet = sourcePacket.path;
+    variables.candidate_name = candidateName;
+    variables.candidate_path = candidate.path;
+    return null;
+}
 function helpText(version) {
     return `Intent DNA CLI v${version}
 
@@ -223,9 +271,9 @@ Boundaries:
 `,
     sync: `Usage: dna sync [status|doctor|remove] [files...] [options]\n\nSubcommands:\n  status                   Show registry-tracked sync artifacts and drift posture\n  doctor                   Check whether registry-tracked artifacts still match last sync\n  remove                   Remove safe hash-matching IntentDNA-owned/diagnostic artifacts from the registry\n\nOptions:\n  --mode auto|plugin|bin   Sync mode (default: auto)\n  --dry-run                Print planned outputs without writing files; with remove, preview removals\n  --post-summary           Print registry-backed output summary after sync\n  --json                   Print status/doctor JSON to stdout\n  --project-dir <path>     Read/write local sync configs and artifacts in another project directory\n  --target <target>        Markdown target for injection\n  --inject <path>          File to inject markdown into\n  --agents <dir>           Generate agent files\n  --skills <dir>           Generate skill files\n  --workflow <dir>         Generate workflow shell scripts\n  --settings <path>        Write hook settings in bin mode\n  --codex                  Generate Codex CLI instruction, plugin, fallback hook, and evidence artifacts\n  --codex-install-mode <mode>  plugin_scoped|project_fallback|managed|none (default project_fallback)\n  --codex-dogfood          Probe codex exec --json and attach diagnostic evidence\n  --lock <path>            Write lock file (default .dna/lock)\n  --remove                 Legacy explicit-target removal; requires --inject/--agents/--skills/--workflow/--codex\n`,
     verify: `Usage: dna verify [--lock <path>] [--stats] [--health] [--strict]\n\nOptions:\n  --health                 Comprehensive installation health check\n  --stats                  Show hook call statistics\n  --strict                 Require valid RuntimeDecisionEvent enterprise evidence\n  --lock <path>            Lock file path (default .dna/lock)\n`,
-    templates: `Usage: dna templates <list|marketplace|manage|sources|show|publish|publications|revoke|deploy> [name] [--json] [--project-dir <path>]\n\nSubcommands:\n  list                     List built-in and project templates with marketplace visibility/harness metadata\n  marketplace              Export a shared intentdna.template_marketplace_catalog.v1 catalog\n  manage [name]            Show template management view: tags/details/marketplace/step index plus full YAML\n  sources [reference]      Review external workflow/skill references that may be translated into DNA templates\n  show <name>              Show template metadata, marketplace metadata, and YAML\n  publish                  Publish an org-private template through Supabase using a local receipt evidence file\n  publications             List org-private template publications through Supabase as read-only projection\n  revoke                   Mark one org-private template publication unpublished through Supabase metadata\n  deploy                   Copy local templates to global install\n\nOptions:\n  --json                   Print manage/sources/marketplace/publish/publications/revoke JSON to stdout\n  --project-dir <path>     Include project-local .dna/templates from another project directory\n  --output <path>          For marketplace: write catalog JSON for online/static import\n  --source-dir <path>      Scan a reference workflow/skill directory (repeatable)\n  --focus all|refresh|gaps For sources list: all references, existing-template refreshes, or uncovered gaps\n  --candidate              For sources <reference>: print a read-only candidate template YAML preview\n  --save-template <name>   With --candidate, save the preview as project-local .dna/templates/<name>.dna.yaml\n  --org <org>              For publish/publications/revoke: organization id/slug/name\n  --project <project>      For publish/publications/revoke: project id/slug/name\n  --template <name>        For publish/publications: template name filter\n  --publication-id <id>    For revoke: org-private template publication id from dna templates publications\n  --reason <text>          For revoke: optional human reason stored in request metadata\n  --receipt <path>         For publish: intentdna.org_review_receipt.v1 or intentdna.report_ingest_receipt.v1 evidence file\n  --endpoint <url>         For publish/publications/revoke: Supabase Edge Function endpoint override\n  --auth-config-dir <dir>  Read CLI API token config from a specific directory for isolated template publication checks\n  --dry-run                For publish/publications/revoke: validate request without network upload\n`,
+    templates: `Usage: dna templates <list|marketplace|manage|sources|show|publish|publications|revoke|deploy> [name] [--json] [--project-dir <path>]\n\nSubcommands:\n  list                     List built-in and project templates with marketplace visibility/harness metadata\n  marketplace              Export a shared intentdna.template_marketplace_catalog.v1 catalog\n  manage [name]            Show template management view: tags/details/marketplace/step index plus full YAML\n  sources [reference]      Review, snapshot, or packetize external workflow/skill references\n  show <name>              Show template metadata, marketplace metadata, and YAML\n  publish                  Publish an org-private template through Supabase using a local receipt evidence file\n  publications             List org-private template publications through Supabase as read-only projection\n  revoke                   Mark one org-private template publication unpublished through Supabase metadata\n  deploy                   Copy local templates to global install\n\nOptions:\n  --json                   Print manage/sources/marketplace/publish/publications/revoke JSON to stdout\n  --project-dir <path>     Include project-local .dna/templates from another project directory\n  --output <path>          For marketplace: write catalog JSON for online/static import\n  --source-dir <path>      Scan a reference workflow/skill directory (repeatable)\n  --focus all|refresh|gaps For sources list: all references, existing-template refreshes, or uncovered gaps\n  --snapshot               Emit deterministic source manifests and hashes\n  --packet                 Emit intentdna.source_authoring_packet.v1 for the selected source\n  --write <path>           Write a snapshot or packet under .dna/authoring without overwrite\n  --candidate              Deprecated read-only packet alias retained for one release\n  --save-template <name>   With --candidate, stage a compatibility candidate under .dna/authoring; never promote it\n  --org <org>              For publish/publications/revoke: organization id/slug/name\n  --project <project>      For publish/publications/revoke: project id/slug/name\n  --template <name>        For publish/publications: template name filter\n  --publication-id <id>    For revoke: org-private template publication id from dna templates publications\n  --reason <text>          For revoke: optional human reason stored in request metadata\n  --receipt <path>         For publish: intentdna.org_review_receipt.v1 or intentdna.report_ingest_receipt.v1 evidence file\n  --endpoint <url>         For publish/publications/revoke: Supabase Edge Function endpoint override\n  --auth-config-dir <dir>  Read CLI API token config from a specific directory for isolated template publication checks\n  --dry-run                For publish/publications/revoke: validate request without network upload\n`,
     assets: `Usage: dna assets <list|library|candidates|lineage|show|inspect|status|review|governance|lifecycle|adoption|suggestions|diff|evidence> [name] [--evidence] [--json]\n\nSubcommands:\n  list                     List template-backed workflow assets\n  library                  Browse workflow assets by readiness with evidence/governance next commands\n  candidates [name]        Find candidate workflow assets to extract or promote from dogfood evidence\n  lineage <name>           Explain origin, cascade, evidence, and human-reviewed evolution route\n  lifecycle <name>         Show cascade, evidence, suggestion, draft, review, adoption, bind, and sync lifecycle\n  show <name>              Show workflow asset summary\n  inspect <name>           Show workflows, controllers, roles, steps, and optional evidence links\n  status [name]            Show read-only management, evidence, and project configuration posture\n  review                   Show manager-facing asset health summary and next actions\n  governance <name>        Explain cascade inheritance and preview-first evolution for an asset\n  adoption <name>          Show adoption readiness checks and the safe adoption path\n  suggestions <name>       Suggest human-reviewed workflow improvements from evidence\n  diff <from> <to>         Compare two workflow assets for manager review before adoption\n  evidence <name>          Summarize registered dogfood progress JSON for a workflow asset\n\nOptions:\n  --evidence               Include registered evidence/reference links\n  --project-dir <path>     Read project-local workflow assets and configs from another project directory\n  --json                   Print JSON to stdout\n`,
-    workflow: `Usage: dna workflow <examples|authoring-packet|intake|route|suggestions|mine|draft|edit-plan|review-suggestion|improve-from-suggestions|from-candidate> [description] [--example <id>] [--strictness standard|high] [--json|--yaml]\n\nSubcommands:\n  examples                 List draft examples\n  authoring-packet [goal]  Emit the C3 packet for external-agent workflow authoring; no intent modeling or mutation\n  intake <description>     Review a workflow request and recommend reuse or authoring path\n  route <description>      Show the personal no-canvas route: describe, author, validate, run; use --org for organization rollout gates\n  suggestions <asset>      Suggest human-reviewed workflow improvements from evidence without mutation\n  mine [asset]             Find candidate workflow assets or follow-up drafts from real evidence\n  draft <description>      Clone a built-in example as a scaffold fallback; structure is not derived from the goal\n  edit-plan <instruction>  Preview a workflow edit without writing DNA or runtime files\n  review-suggestion        Persist accept/reject/defer for an evidence-backed suggestion\n  improve-from-suggestions Build a reviewable edit plan from an accepted asset suggestion\n  from-candidate <id>      Act on a dogfood-backed candidate without copying a long command\n\nOptions:\n  --name <org>             Organization name for --org route planning\n  --project <project>      Project name for --org route planning\n  --sync-target <target>   Runtime surface for --org route planning, such as codex or claude\n  --org                    Include organization binding, configure, rollout, sync, deploy, improve, and evolution gates\n  --from-template <name>   Source workflow asset for route/edit/candidate commands\n  --workflow <id>          Select a workflow inside a multi-workflow asset template such as fix or behavior-lock\n  --suggestion <id>        Suggestion id such as template-model-verifier or template-blocked-triage\n  --decision <decision>    For review-suggestion: accept|reject|defer\n  --save-template <name>   Save a draft/scaffold as .dna/templates/<name>.dna.yaml for human review and asset inspection\n  --project-dir <path>     Read/write workflow assets in another project directory\n  --force                  Overwrite an existing saved workflow asset draft\n  --operation <op>         Optional override; otherwise auto-chosen from the instruction\n  --target-step <id>       Optional override; otherwise auto-chosen from the edit\n  --role <role>            Optional override; otherwise auto-chosen/defaulted from the edit\n\nExamples:\n  dna workflow examples\n  dna workflow authoring-packet "Create a code review workflow" --json\n  dna workflow intake "Rewrite module with logic equivalence"\n  dna workflow route "Rewrite module with logic equivalence"\n  dna workflow route "Rewrite module with logic equivalence" --org --name "Project Admin" --project "Mobile Rewrite" --sync-target codex\n  dna workflow suggestions ${WORKFLOW_ASSET_IDS.default} --json\n  dna workflow mine ${WORKFLOW_ASSET_IDS.default} --json\n  dna workflow draft "Rewrite module with logic equivalence" --example rewrite_governance --strictness high  # scaffold fallback only\n  dna workflow draft "Rewrite module with logic equivalence" --save-template team-rewrite-flow  # scaffold fallback only\n  dna workflow edit-plan "Add equivalence verifier after rewrite" --from-template team-rewrite-flow --save-template team-rewrite-flow-v2\n  dna workflow review-suggestion --from-template ${WORKFLOW_ASSET_IDS.default} --workflow fix --suggestion template-model-verifier --decision accept\n  dna workflow improve-from-suggestions --from-template ${WORKFLOW_ASSET_IDS.default} --workflow fix --suggestion template-model-verifier --save-template ${WORKFLOW_ASSET_IDS.default}-v2\n  dna workflow from-candidate extract-diagnosis-review-${WORKFLOW_ASSET_IDS.default} --from-template ${WORKFLOW_ASSET_IDS.default} --save-template ${WORKFLOW_ASSET_IDS.rewriteDiagnosisReview}\n`,
+    workflow: `Usage: dna workflow <examples|authoring-packet|intake|route|suggestions|mine|draft|edit-plan|review-suggestion|improve-from-suggestions|from-candidate>\n       dna workflow promote-candidate <candidate-path> --save-template <name>\n       dna workflow project-candidate <candidate-path> --target claude|codex --dry-run\n\nSubcommands:\n  examples                 List draft examples\n  authoring-packet [goal]  Emit the C3 packet for external-agent workflow authoring; no intent modeling or mutation\n  intake <description>     Review a workflow request and recommend reuse or authoring path\n  route <description>      Show the personal no-canvas route: describe, author, validate, run; use --org for organization rollout gates\n  suggestions <asset>      Suggest human-reviewed workflow improvements from evidence without mutation\n  mine [asset]             Find candidate workflow assets or follow-up drafts from real evidence\n  draft <description>      Clone a built-in example as a scaffold fallback; structure is not derived from the goal\n  edit-plan <instruction>  Preview a workflow edit without writing DNA or runtime files\n  review-suggestion        Persist accept/reject/defer for an evidence-backed suggestion\n  improve-from-suggestions Build a reviewable edit plan from an accepted asset suggestion\n  from-candidate <id>      Act on a dogfood-backed candidate without copying a long command\n  promote-candidate <path> Revalidate and explicitly copy exact candidate bytes into .dna/templates\n  project-candidate <path> Dry-run an unpromoted candidate through Claude or Codex projection\n\nOptions:\n  --name <org>             Organization name for --org route planning\n  --project <project>      Project name for --org route planning\n  --sync-target <target>   Runtime surface for --org route planning, such as codex or claude\n  --target claude|codex    Projection target for project-candidate\n  --dry-run                Required for project-candidate; never writes project artifacts\n  --org                    Include organization binding, configure, rollout, sync, deploy, improve, and evolution gates\n  --from-template <name>   Source workflow asset for route/edit/candidate commands\n  --workflow <id>          Select a workflow inside a multi-workflow asset template such as fix or behavior-lock\n  --suggestion <id>        Suggestion id such as template-model-verifier or template-blocked-triage\n  --decision <decision>    For review-suggestion: accept|reject|defer\n  --save-template <name>   Promotion target name, or reviewed draft/scaffold name for legacy commands\n  --project-dir <path>     Read/write workflow assets in another project directory\n  --force                  Overwrite an existing saved workflow asset draft\n  --operation <op>         Optional override; otherwise auto-chosen from the instruction\n  --target-step <id>       Optional override; otherwise auto-chosen from the edit\n  --role <role>            Optional override; otherwise auto-chosen/defaulted from the edit\n\nExamples:\n  dna workflow examples\n  dna workflow authoring-packet "Create a code review workflow" --json\n  dna workflow intake "Rewrite module with logic equivalence"\n  dna workflow route "Rewrite module with logic equivalence"\n  dna workflow route "Rewrite module with logic equivalence" --org --name "Project Admin" --project "Mobile Rewrite" --sync-target codex\n  dna workflow project-candidate .dna/authoring/source.candidate.dna.yaml --target claude --dry-run\n  dna workflow promote-candidate .dna/authoring/source.candidate.dna.yaml --save-template source-reviewed\n  dna workflow suggestions ${WORKFLOW_ASSET_IDS.default} --json\n  dna workflow mine ${WORKFLOW_ASSET_IDS.default} --json\n  dna workflow draft "Rewrite module with logic equivalence" --example rewrite_governance --strictness high  # scaffold fallback only\n  dna workflow draft "Rewrite module with logic equivalence" --save-template team-rewrite-flow  # scaffold fallback only\n  dna workflow edit-plan "Add equivalence verifier after rewrite" --from-template team-rewrite-flow --save-template team-rewrite-flow-v2\n  dna workflow review-suggestion --from-template ${WORKFLOW_ASSET_IDS.default} --workflow fix --suggestion template-model-verifier --decision accept\n  dna workflow improve-from-suggestions --from-template ${WORKFLOW_ASSET_IDS.default} --workflow fix --suggestion template-model-verifier --save-template ${WORKFLOW_ASSET_IDS.default}-v2\n  dna workflow from-candidate extract-diagnosis-review-${WORKFLOW_ASSET_IDS.default} --from-template ${WORKFLOW_ASSET_IDS.default} --save-template ${WORKFLOW_ASSET_IDS.rewriteDiagnosisReview}\n`,
     org: `Usage: dna org <intake|configure-plan|route|rollout|init|bind|status|review|receipt> [description] [options]\n\nSubcommands:\n  intake [description]     Plan organization/project setup and asset binding without writing files\n  configure-plan           List explicit dna init commands for declared assets missing project config\n  route                    Show the organization operating route and rollout readiness without syncing\n  rollout                  Review sync/downstream rollout readiness without syncing (alias-compatible with route)\n  init                     Create local .dna/org.yaml with organization/project bindings\n  bind                     Add or update a workflow asset binding for a project\n  status                   Show local organization, projects, assets, sync targets, and evidence totals\n  review                   Show manager-facing gaps and next actions\n  receipt                  Emit intentdna.org_review_receipt.v1 from local org review and rollout data\n\nOptions:\n  --name <organization>    Organization name for intake or init\n  --project <project>      Project name/id for intake, init, or bind\n  --asset <asset>          Bind a workflow asset such as ${WORKFLOW_ASSET_IDS.default}\n  --status <status>        planned|active|paused for org bind (default planned)\n  --sync-target <target>   Declare a target such as codex or claude\n  --project-dir <path>     Read/write organization state in a different project directory\n  --apply                  For configure-plan only: create missing .dna/configs from declared assets\n  --json                   Print JSON to stdout\n\nBoundaries:\n  - org receipt is local projection evidence only; cloud_authority=false\n  - internal_ready candidates are adoption candidates, not org-private SaaS visibility\n  - No online org auth, permissions, backend persistence, or cloud storage is implied\n\nExamples:\n  dna org intake "Mobile rewrite team" --asset ${WORKFLOW_ASSET_IDS.default} --sync-target codex\n  dna org configure-plan\n  dna org configure-plan --apply\n  dna org route\n  dna org rollout\n  dna org receipt --json\n  dna org init --name "My Org" --project "Mobile Rewrite" --asset ${WORKFLOW_ASSET_IDS.default} --sync-target codex\n  dna org bind --asset team-rewrite-flow-v2 --status active --sync-target codex\n  dna org review\n`,
     release: `Usage: dna release <deploy-plan|evidence> [files...] [--json]\n\nSubcommands:\n  deploy-plan              Read changed files and decide whether Vercel and/or Supabase release verification is required\n  evidence                 Record deploy-plan, deployed URL, checked routes, and cloud checks as intentdna.release_evidence.v1\n\nOptions:\n  --json                   Print JSON to stdout\n  --output <path>          For evidence: write release evidence JSON (default .dna/release/latest-release-evidence.json)\n  --deployment-url <url>   For evidence: deployed URL captured from Vercel CLI stdout when web routes changed\n  --checked-route <route>  For evidence: route verified on the deployed URL (repeatable or comma-separated)\n  --checked-cloud-check <id> For evidence: cloud check completed, such as cloud-contract-check or cloud-edge-check (repeatable or comma-separated)\n  --dry-run                For evidence: do not write the evidence file\n\nBoundaries:\n  - CLI/core/runtime/docs/wiki changes do not require Vercel deployment by themselves\n  - Web/public surfaces require Vercel CLI deploy only when reviewers or users need a deployed URL\n  - Supabase SaaS surfaces require cloud contract, Edge Function, deploy-plan, remote secret-name presence, Vercel public env presence, function health, and live ingest-smoke evidence before production release claims\n  - Deployment is separate from org rollout and runtime sync\n  - A web deploy is not complete until the deployed URL is opened or fetched and verified\n  - A cloud deploy is not complete until Supabase migrations/functions/secrets, Vercel public env presence, and ingestion smoke evidence are recorded\n  - Release evidence records supplied checks; it does not run build, deploy, URL verification, Supabase commands, sync, or policy enforcement\n\nExamples:\n  dna release deploy-plan\n  dna release deploy-plan apps/online/src/main.ts\n  dna release deploy-plan src/cli/index.ts --json\n  dna release deploy-plan supabase/functions/ingest-report/index.ts --json\n  dna release evidence apps/online/src/main.ts --deployment-url https://intentdna.vercel.app --checked-route / --checked-route '/?mode=public' --checked-route '/?mode=public&embed=1' --checked-route /runtime --checked-route /templates --checked-route /readiness --json\n  dna release evidence supabase/functions/ingest-report/index.ts --checked-cloud-check cloud-contract-check --checked-cloud-check cloud-edge-check --checked-cloud-check cloud-deploy-plan --checked-cloud-check cloud-function-health --checked-cloud-check cloud-secrets-check --checked-cloud-check cloud-vercel-env-check --checked-cloud-check cloud-ingest-smoke --json\n`,
     auth: `Usage: dna auth status [--auth-config-dir <dir>] [--json]\n       dna auth token set <token> [--auth-config-dir <dir>] [--json]\n       dna auth token clear [--auth-config-dir <dir>] [--json]\n       dna auth user-jwt status [--auth-config-dir <dir>] [--json]\n       dna auth user-jwt set <jwt> [--auth-config-dir <dir>] [--json]\n       dna auth user-jwt clear [--auth-config-dir <dir>] [--json]\n       dna auth bootstrap-account [--org <name>] [--project <name>] [options]\n       dna auth onboard [--project-id <id>] [options]\n       dna auth issue-token --project-id <id> [options]\n       dna auth projects [options]\n       dna auth tokens list [options]\n       dna auth tokens revoke <token-id> [--yes] [options]\n\nSubcommands:\n  status                   Show local CLI API token status without network validation\n  token set <token>        Store a CLI API token in user config outside the project repository\n  token clear              Remove the stored CLI API token; idempotent if already absent\n  user-jwt status          Show local Supabase user JWT account bridge status without network validation\n  user-jwt set <jwt>       Store a Supabase user JWT for account onboarding commands outside the project repository\n  user-jwt clear           Remove the stored Supabase user JWT; idempotent if already absent\n  bootstrap-account        Create/reuse Supabase account org/project with a user JWT; token issuance remains dna auth onboard\n  onboard                  Discover account projects, select one safely, issue a CLI API token, and store it locally\n  issue-token              Call Supabase issue-api-token with a user JWT and store the issued CLI token\n  projects                 Call Supabase list-projects with a user JWT for account onboarding projection\n  tokens list              Call Supabase manage-api-tokens to list API token metadata only\n  tokens revoke <token-id> Revoke an API token after explicit --yes confirmation\n\nOptions:\n  --org <name>             Organization name for account bootstrap\n  --project <name>         Project name for account bootstrap\n  --org-slug <slug>        Optional organization slug for account bootstrap\n  --project-slug <slug>    Optional project slug for account bootstrap\n  --project-hint <path>    Optional local project hint stored as account bootstrap metadata\n  --project-id <id>        Supabase projects.id for issue-token or token filtering\n  --organization-id <id>   Optional organization id to cross-check or filter\n  --token-id <id>          API token id for revoke or filtering\n  --include-revoked        Include revoked API token metadata in tokens list\n  --limit <n>              Maximum token summaries to request, capped at 100\n  --user-jwt <jwt>         Supabase user access token override; env or dna auth user-jwt set can also supply it\n  --endpoint <url>         Edge Function URL; defaults from INTENTDNA_CLOUD_URL\n  --auth-config-dir <dir>  Read/write CLI API token and user JWT config in a specific directory for isolated local checks\n  --token-name <name>      Display name for the issued CLI token\n  --scope <scope>          Requested scope; repeatable or comma-separated, defaults to report:ingest\n  --expires-at <iso>       Optional token expiry timestamp\n  --dry-run                Build the request without making a network call or storing a token\n  --yes                    Required before live dna auth tokens revoke mutates account auth state\n  --json                   Print JSON to stdout\n\nBoundaries:\n  - CLI ingestion auth uses IntentDNA API tokens, not MCP authorization\n  - dna auth bootstrap-account is an onboarding mutation only; it does not issue CLI tokens, upload reports, publish templates, or run workflows\n  - dna auth onboard is a CLI onboarding convenience over projects plus issue-token; it does not guess between multiple projects\n  - Supabase user JWTs are account onboarding credentials for projects, issue-token, and token management; they are not CLI ingestion API tokens\n  - User JWTs are stored only by explicit dna auth user-jwt set and output uses masked previews only\n  - Token status is local until cloud token verification exists\n  - Raw tokens are not printed after set or issue-token; token list/revoke never prints raw tokens or token hashes\n  - Service role keys are server-only and rejected as CLI/user tokens when detected\n  - Auth state and account projections do not grant runtime allow/warn/block/validate authority\n\nExamples:\n  dna auth status --json\n  dna auth token set idna_example_token --json\n  dna auth token set idna_example_token --auth-config-dir /tmp/intentdna-auth --json\n  dna auth status --auth-config-dir /tmp/intentdna-auth --json\n  dna auth token clear --json\n  dna auth user-jwt status --json\n  dna auth user-jwt set eyJhbGciOi... --json\n  dna auth user-jwt clear --json\n  dna auth bootstrap-account --org "My Org" --project "IntentDNA" --dry-run --json\n  dna auth bootstrap-account --org "My Org" --project "IntentDNA" --json\n  dna auth onboard --dry-run --json\n  dna auth onboard --project-id 00000000-0000-4000-8000-000000000000 --json\n  dna auth issue-token --project-id 00000000-0000-4000-8000-000000000000 --dry-run --json\n  dna auth issue-token --project-id 00000000-0000-4000-8000-000000000000 --token-name "Laptop CLI" --json\n  dna auth projects --dry-run --json\n  dna auth tokens list --project-id 00000000-0000-4000-8000-000000000000 --dry-run --json\n  dna auth tokens revoke token_123 --yes --json\n`,
@@ -235,6 +283,7 @@ Boundaries:
     context: `Usage: dna context <index|search|doc> [query|id] [files...]\n\nSubcommands:\n  index                    List explicitly declared planning-only advisory context sources\n  search <query>           Search source metadata\n  doc <id>                 Read a local file/doc source body\n`,
     run: `Usage:
   dna run [start] --dna <file> --workflow <name> --task <id> [options]
+  dna run asset-refinery --var source_packet=<path> --var candidate_path=<path> [--dry-run]
   dna run status  <run-id> [--json] [--project-dir <path>]
   dna run inspect <run-id> [--json] [--project-dir <path>]
   dna run resume  <run-id> [--json] [--project-dir <path>]
@@ -249,6 +298,7 @@ Actions:
 
 Options:
   --run-id <id>            Explicit run id; lifecycle actions also accept a positional id
+  --var <key=value>        Set a workflow variable; repeat for multiple values
   --dry-run                Print the compiled Controller plan without starting a run
   --provider <name>        claude|codex (default: claude)
   --provider-executable <path> Override the selected provider executable
@@ -483,13 +533,49 @@ async function main() {
                     vars[v.slice(0, eqIdx)] = v.slice(eqIdx + 1);
                 }
             }
+            let dnaFiles = runValues.dna ?? runPositionals;
+            let workflowName = runValues.workflow;
+            let taskId = runValues.task;
+            if (runAction === "start"
+                && !runValues.dna
+                && runPositionals.length === 1) {
+                const templateName = runPositionals[0];
+                const projectDir = runValues["project-dir"];
+                const { findTemplateCatalogEntry } = await import("../templates/catalog.js");
+                const template = await findTemplateCatalogEntry(templateName, {
+                    projectDir,
+                });
+                if (template) {
+                    if (template.name === "asset-refinery") {
+                        const variableError = normalizeAssetRefineryVariables(resolve(projectDir ?? process.cwd()), vars);
+                        if (variableError) {
+                            process.stderr.write(`Error: ${variableError}\n`);
+                            return exitWith(2);
+                        }
+                    }
+                    dnaFiles = [template.path];
+                    taskId ??= template.name;
+                    if (!workflowName) {
+                        const { loadDNA } = await import("../compiler/index.js");
+                        const dna = await loadDNA(template.path);
+                        const workflowNames = Object.keys(dna.workflows ?? {});
+                        if (workflowNames.length !== 1) {
+                            process.stderr.write(`Error: template '${template.name}' has ${workflowNames.length} workflows; select one with --workflow.\n`);
+                            return exitWith(2);
+                        }
+                        workflowName = dna.namespace
+                            ? `${dna.namespace}_${workflowNames[0]}`
+                            : workflowNames[0];
+                    }
+                }
+            }
             const { runRun } = await import("./commands/run.js");
             const code = await runRun({
                 action: runAction,
                 runId: optionRunId ?? positionalRunId,
-                dnaFiles: runValues.dna ?? runPositionals,
-                workflowName: runValues.workflow,
-                taskId: runValues.task,
+                dnaFiles,
+                workflowName,
+                taskId,
                 context: runValues.context,
                 vars: Object.keys(vars).length > 0 ? vars : undefined,
                 dryRun: runValues["dry-run"],
@@ -869,6 +955,9 @@ async function main() {
                     "source-dir": { type: "string", multiple: true },
                     output: { type: "string", short: "o" },
                     focus: { type: "string", default: "all" },
+                    snapshot: { type: "boolean", default: false },
+                    packet: { type: "boolean", default: false },
+                    write: { type: "string" },
                     candidate: { type: "boolean", default: false },
                     "save-template": { type: "string" },
                     org: { type: "string" },
@@ -907,6 +996,21 @@ async function main() {
                 return exitWith(code);
             }
             if (subcommand === "sources") {
+                if (templateValues.snapshot
+                    || templateValues.packet
+                    || templateValues.write) {
+                    const { runSourceAssets } = await import("./commands/source-assets.js");
+                    const code = await runSourceAssets({
+                        projectDir: templateValues["project-dir"],
+                        sourceDirs: templateValues["source-dir"],
+                        sourceId: templatePositionals[0],
+                        snapshot: templateValues.snapshot,
+                        packet: templateValues.packet,
+                        write: templateValues.write,
+                        json: templateValues.json,
+                    });
+                    return exitWith(code);
+                }
                 const focus = templateValues.focus;
                 if (!["all", "refresh", "gaps"].includes(focus)) {
                     process.stderr.write("Error: --focus must be one of: all, refresh, gaps\n");
@@ -1024,7 +1128,9 @@ async function main() {
                     name: { type: "string" },
                     project: { type: "string" },
                     "sync-target": { type: "string" },
+                    target: { type: "string" },
                     "project-dir": { type: "string" },
+                    "dry-run": { type: "boolean", default: false },
                     force: { type: "boolean", default: false },
                     org: { type: "boolean", default: false },
                     json: { type: "boolean", default: false },
@@ -1033,6 +1139,56 @@ async function main() {
                 allowPositionals: true,
                 strict: false,
             });
+            const projectDir = workflowValues["project-dir"] ?? process.cwd();
+            if (subcommand === "promote-candidate") {
+                const candidatePath = workflowPositionals[0];
+                const templateName = workflowValues["save-template"];
+                if (!candidatePath || !templateName) {
+                    process.stderr.write("Error: promote-candidate requires <candidate-path> and --save-template <name>.\n");
+                    return exitWith(2);
+                }
+                try {
+                    const { promoteCandidate } = await import("./commands/candidate-promotion.js");
+                    const result = await promoteCandidate({
+                        projectDir,
+                        candidatePath,
+                        templateName,
+                    });
+                    process.stdout.write(`${JSON.stringify(result, null, 2)}\n`);
+                    return exitWith(0);
+                }
+                catch (error) {
+                    process.stderr.write(`Error: ${error instanceof Error ? error.message : String(error)}\n`);
+                    return exitWith(1);
+                }
+            }
+            if (subcommand === "project-candidate") {
+                const candidatePath = workflowPositionals[0];
+                const target = workflowValues.target;
+                if (!candidatePath || !["claude", "codex"].includes(target ?? "")) {
+                    process.stderr.write("Error: project-candidate requires <candidate-path> and --target claude|codex.\n");
+                    return exitWith(2);
+                }
+                if (!workflowValues["dry-run"]) {
+                    process.stderr.write("Error: project-candidate requires --dry-run.\n");
+                    return exitWith(2);
+                }
+                try {
+                    const { projectCandidateDryRun } = await import("../workflow/candidate-projection.js");
+                    const result = await projectCandidateDryRun({
+                        candidatePath,
+                        projectDir,
+                        target: target,
+                        packageVersion: version,
+                    });
+                    process.stdout.write(`${JSON.stringify(result, null, 2)}\n`);
+                    return exitWith(0);
+                }
+                catch (error) {
+                    process.stderr.write(`Error: ${error instanceof Error ? error.message : String(error)}\n`);
+                    return exitWith(1);
+                }
+            }
             const { runWorkflow } = await import("./commands/workflow.js");
             const code = await runWorkflow({
                 subcommand,

package/dist/compiler/cascade.js

@@ -251,7 +251,7 @@ export function cascadeDNA(layers) {
         const ns = dna.namespace;
         // Merge genes (cross-namespace: additive merge + warning)
         const origin = originForDNA(dna);
-        for (const [name, rawGene] of Object.entries(dna.genes)) {
+        for (const [name, rawGene] of Object.entries(dna.genes ?? {})) {
             const gene = withCodonOrigins(rawGene, origin);
             if (origin.protected_threshold && gene.codons.some((codon) => codon.type === "threshold")) {
                 protectedThresholdGenes.add(name);

package/dist/hooks/cli.d.ts

@@ -19,6 +19,11 @@ import type { HookEvent, HookOutput } from "./protocol.js";
 import { blockOutput } from "./protocol.js";
 import { readWorkflowState } from "./state.js";
 import type { VerifierResultEntry } from "./state.js";
+interface HookRuntimePaths {
+    projectDir: string;
+    irPath: string;
+}
+declare function resolveHookRuntimePaths(cwd: string, irPath?: string, explicitIRPath?: boolean): Promise<HookRuntimePaths>;
 export interface SessionSummary {
     total: number;
     blocks: number;
@@ -91,6 +96,7 @@ export declare const recordProducedArtifactsForTest: typeof recordProducedArtifa
 export declare const resolveWorkflowArtifactFactsForTest: typeof resolveWorkflowArtifactFacts;
 export declare const readWorkflowStateForHookTest: typeof readWorkflowStateForHook;
 export declare const runCodexHookWithLoadedIrForTest: typeof runCodexHookWithLoadedIr;
+export declare const resolveHookRuntimePathsForTest: typeof resolveHookRuntimePaths;
 export declare const inferWorkflowAssetFromIrForTest: typeof inferWorkflowAssetFromIr;
 export declare const resolveWorkflowArtifactFactsForHookTest: typeof resolveWorkflowArtifactFactsForHook;
 export declare const finalizeAndResolveArtifactsForHookTest: typeof finalizeAndResolveArtifactsForHook;