openplanr 1.25.3 → 2.0.1

package/dist/services/company-sync-service.js

@@ -0,0 +1,1299 @@
+import { createHash, randomUUID } from 'node:crypto';
+import { link, lstat, mkdir, open, readdir, readFile, realpath, rename, unlink, } from 'node:fs/promises';
+import path from 'node:path';
+import { pathToFileURL } from 'node:url';
+import { resolveCompanyAccessToken } from './company-auth-service.js';
+import { CompanySyncError, normalizeCompanyOrigin } from './company-common.js';
+import { resolvePipelinePackage } from './pipeline-package-service.js';
+export { CompanySyncError, DEFAULT_COMPANY_API_ORIGIN, normalizeCompanyOrigin, resolveCompanyOrigin, } from './company-common.js';
+const fail = (code, message, cause) => {
+    throw new CompanySyncError(code, message, cause === undefined ? undefined : { cause });
+};
+const hash = (text) => createHash('sha256').update(text).digest('hex');
+const id = (value) => typeof value === 'string' &&
+    value.trim() === value &&
+    /^[A-Za-z0-9][A-Za-z0-9_-]{0,127}$/.test(value)
+    ? value
+    : fail('E_COMPANY_ID', 'Invalid company resource identifier.');
+const MAX_BYTES = 1024 * 1024;
+const MAX_RESPONSE_BYTES = 2 * 1024 * 1024;
+// Reject C0 controls and DEL in externally supplied paths and element identifiers.
+function hasControlCharacters(value) {
+    return [...value].some((character) => character.charCodeAt(0) < 32 || character.charCodeAt(0) === 127);
+}
+const isDigest = (value) => typeof value === 'string' && value.length === 64 && /^[a-f0-9]+$/.test(value);
+function layoutDigest(layout) {
+    if (!layout || typeof layout !== 'object' || Array.isArray(layout))
+        return fail('E_COMPANY_STATE', 'Invalid company layout state.');
+    const entries = Object.entries(layout).sort(([left], [right]) => left < right ? -1 : left > right ? 1 : 0);
+    for (const [key, point] of entries) {
+        if (!key ||
+            key.length > 512 ||
+            /\s/u.test(key) ||
+            hasControlCharacters(key) ||
+            ['__proto__', 'constructor', 'prototype'].includes(key) ||
+            !point ||
+            typeof point !== 'object' ||
+            Array.isArray(point) ||
+            Object.keys(point).length !== 2 ||
+            !Number.isFinite(point.x) ||
+            !Number.isFinite(point.y) ||
+            Math.abs(point.x) > 1e7 ||
+            Math.abs(point.y) > 1e7)
+            return fail('E_COMPANY_STATE', 'Invalid company layout coordinates.');
+    }
+    return hash(JSON.stringify(entries));
+}
+function assertSafeRelativePath(relative) {
+    if (typeof relative !== 'string' ||
+        !relative ||
+        hasControlCharacters(relative) ||
+        /^[A-Za-z]:/u.test(relative) ||
+        path.isAbsolute(relative) ||
+        relative.includes('\\') ||
+        relative
+            .split('/')
+            .some((part) => ['.', '..', '.git', 'node_modules', '.ssh', '.local', ''].includes(part)) ||
+        /(?:^|\/)(?:\.env(?:\.|$)|credentials(?:\.|$)|id_rsa|id_ed25519)/i.test(relative))
+        fail('E_COMPANY_SCOPE', 'Select a repository-relative artifact file, excluding secrets and internal state.');
+}
+async function safeFile(root, relative) {
+    assertSafeRelativePath(relative);
+    const base = await realpath(root);
+    let current = base;
+    for (const part of relative.split('/')) {
+        current = path.join(current, part);
+        const info = await lstat(current);
+        if (info.isSymbolicLink())
+            return fail('E_COMPANY_SCOPE', 'Artifact paths must not contain symbolic links.');
+    }
+    const stat = await lstat(current);
+    if (!stat.isFile() || stat.size > MAX_BYTES)
+        return fail('E_COMPANY_SIZE', 'Select a regular artifact file no larger than 1 MiB.');
+    return current;
+}
+async function readArtifactFile(file) {
+    const bytes = await readFile(file);
+    if (bytes.byteLength > MAX_BYTES)
+        return fail('E_COMPANY_SIZE', 'Artifact exceeds the 1 MiB publication limit.');
+    try {
+        return new TextDecoder('utf-8', { fatal: true, ignoreBOM: true }).decode(bytes);
+    }
+    catch (cause) {
+        return fail('E_COMPANY_ENCODING', 'Artifact content must be valid UTF-8; no bytes were transformed or published.', cause);
+    }
+}
+const stateSizeLimit = (section) => ['layouts', 'applications', 'pending-applications', 'application-content', 'backups'].includes(section)
+    ? MAX_BYTES
+    : 65536;
+async function safeStateDirectory(root, section) {
+    const base = await realpath(root);
+    let current = base;
+    for (const part of ['.local', 'company', section]) {
+        current = path.join(current, part);
+        await mkdir(current, { mode: 0o700 }).catch((error) => {
+            if (error.code !== 'EEXIST')
+                throw error;
+        });
+        const stat = await lstat(current);
+        if (!stat.isDirectory() || stat.isSymbolicLink())
+            return fail('E_COMPANY_SCOPE', 'Company local state must not contain symbolic links.');
+    }
+    return current;
+}
+async function statePath(root, section, key) {
+    return path.join(await safeStateDirectory(root, section), `${id(key)}.json`);
+}
+async function syncDirectory(directory) {
+    // Windows does not support opening directories for FlushFileBuffers.
+    if (process.platform === 'win32')
+        return;
+    const handle = await open(directory, 'r');
+    try {
+        await handle.sync();
+    }
+    finally {
+        await handle.close();
+    }
+}
+async function replaceDurably(target, content, mode = 0o600, beforeRename) {
+    const temp = `${target}.${randomUUID()}.tmp`;
+    try {
+        const handle = await open(temp, 'wx', mode);
+        try {
+            await handle.writeFile(content, 'utf8');
+            await handle.sync();
+        }
+        finally {
+            await handle.close();
+        }
+        if (beforeRename)
+            await beforeRename();
+        await rename(temp, target);
+        await syncDirectory(path.dirname(target));
+    }
+    finally {
+        await unlink(temp).catch(() => { });
+    }
+}
+async function saveState(root, section, key, value) {
+    const target = await statePath(root, section, key);
+    const serialized = JSON.stringify(value, null, 2) + '\n';
+    if (Buffer.byteLength(serialized) > stateSizeLimit(section))
+        return fail('E_COMPANY_STATE', 'Company local state exceeds its supported size.');
+    await replaceDurably(target, serialized);
+}
+async function readStoredContent(root, section, key) {
+    const target = await statePath(root, section, key);
+    const info = await lstat(target);
+    if (!info.isFile() || info.isSymbolicLink() || info.size > MAX_BYTES)
+        return fail('E_COMPANY_STATE', 'Invalid staged company content.');
+    return readArtifactFile(target);
+}
+async function readState(root, section, key) {
+    const target = await statePath(root, section, key);
+    const info = await lstat(target);
+    if (!info.isFile() || info.isSymbolicLink() || info.size > stateSizeLimit(section))
+        return fail('E_COMPANY_STATE', 'Invalid company local state.');
+    try {
+        return JSON.parse(await readArtifactFile(target));
+    }
+    catch (cause) {
+        return fail('E_COMPANY_STATE', 'Company local state is not valid JSON.', cause);
+    }
+}
+async function loadState(root, section, key) {
+    const data = (await readState(root, section, key));
+    if (!data ||
+        typeof data !== 'object' ||
+        data.schemaVersion !== '1.0.0' ||
+        data.id !== key ||
+        typeof data.contentDigest !== 'string' ||
+        !/^[a-f0-9]{64}$/.test(data.contentDigest) ||
+        typeof data.filePath !== 'string' ||
+        typeof data.title !== 'string' ||
+        !data.title.trim() ||
+        data.title.length > 240 ||
+        !['diagram', 'design', 'plan', 'document'].includes(data.kind) ||
+        !['application/json', 'text/markdown', 'image/svg+xml', 'text/html'].includes(data.contentType) ||
+        !Number.isSafeInteger(data.byteLength) ||
+        data.byteLength < 0 ||
+        data.byteLength > MAX_BYTES ||
+        typeof data.createdAt !== 'string' ||
+        !Number.isFinite(Date.parse(data.createdAt)))
+        return fail('E_COMPANY_STATE', 'Invalid or unsupported publication preview.');
+    if (data.sourceType !== undefined) {
+        if (data.sourceType !== 'design-document' ||
+            data.kind !== 'design' ||
+            data.contentType !== 'application/json' ||
+            !Array.isArray(data.sourceFiles) ||
+            !data.sourceFiles.length ||
+            data.sourceFiles.length > 2048 ||
+            new Set(data.sourceFiles).size !== data.sourceFiles.length ||
+            !data.sourceFiles.includes(data.filePath) ||
+            !data.sourceDigests ||
+            typeof data.sourceDigests !== 'object' ||
+            Array.isArray(data.sourceDigests) ||
+            Object.keys(data.sourceDigests).length !== data.sourceFiles.length ||
+            data.sourceFiles.some((file) => !isDigest(data.sourceDigests?.[file])))
+            return fail('E_COMPANY_STATE', 'Invalid design publication source manifest.');
+        for (const file of data.sourceFiles)
+            assertSafeRelativePath(file);
+    }
+    else if (data.sourceFiles !== undefined || data.sourceDigests !== undefined) {
+        return fail('E_COMPANY_STATE', 'A source manifest requires an explicit publication source type.');
+    }
+    normalizeCompanyOrigin(data.apiUrl);
+    id(data.projectId);
+    if (data.artifactId !== undefined) {
+        id(data.artifactId);
+        id(data.organizationId);
+    }
+    if (data.revisionId !== undefined) {
+        id(data.revisionId);
+        if (!data.artifactId)
+            return fail('E_COMPANY_STATE', 'A revision requires an artifact binding.');
+    }
+    if (section === 'bindings' || section === 'push-previews') {
+        id(data.artifactId);
+        id(data.revisionId);
+        id(data.organizationId);
+    }
+    if (section === 'push-previews') {
+        id(data.operationId);
+        if (data.publishedRevisionId !== undefined)
+            id(data.publishedRevisionId);
+    }
+    return data;
+}
+async function withBindingLock(root, bindingId, action) {
+    const lockPath = (await statePath(root, 'bindings', bindingId)) + '.lock';
+    const owner = { pid: process.pid, nonce: randomUUID() };
+    const ownerPath = `${lockPath}.${owner.nonce}.owner`;
+    const serialized = JSON.stringify(owner);
+    await replaceDurably(ownerPath, serialized);
+    let acquired = false;
+    try {
+        for (let attempt = 0; attempt < 3 && !acquired; attempt++) {
+            try {
+                await link(ownerPath, lockPath);
+                acquired = true;
+            }
+            catch (error) {
+                if (error.code !== 'EEXIST')
+                    throw error;
+                const info = await lstat(lockPath);
+                if (!info.isFile() || info.isSymbolicLink() || info.size > 1024)
+                    return fail('E_COMPANY_STATE', 'Invalid company binding lock.');
+                const previous = await readFile(lockPath, 'utf8');
+                let stale;
+                try {
+                    stale = JSON.parse(previous);
+                }
+                catch (cause) {
+                    return fail('E_COMPANY_BUSY', 'An older binding lock needs inspection before recovery.', cause);
+                }
+                if (!Number.isSafeInteger(stale.pid) || stale.pid < 1)
+                    return fail('E_COMPANY_STATE', 'Invalid company lock owner.');
+                id(stale.nonce);
+                try {
+                    process.kill(stale.pid, 0);
+                    return fail('E_COMPANY_BUSY', 'Another operation is using this binding. Retry after it finishes.');
+                }
+                catch (check) {
+                    if (check.code !== 'ESRCH')
+                        throw check;
+                }
+                // Only one process may reclaim a particular dead owner. Recheck its nonce
+                // while holding that claim so an overlapping retry cannot remove a new lock.
+                const claimPath = `${lockPath}.recovery-${stale.nonce}`;
+                let claim;
+                try {
+                    claim = await open(claimPath, 'wx', 0o600);
+                }
+                catch (cause) {
+                    return fail('E_COMPANY_BUSY', 'This binding is being recovered. Retry after recovery finishes.', cause);
+                }
+                try {
+                    if ((await readFile(lockPath, 'utf8')) === previous)
+                        await unlink(lockPath);
+                }
+                catch (check) {
+                    if (check.code !== 'ENOENT')
+                        throw check;
+                }
+                finally {
+                    await claim.close();
+                    await unlink(claimPath);
+                }
+            }
+        }
+        if (!acquired)
+            return fail('E_COMPANY_BUSY', 'The binding lock changed during recovery. Retry shortly.');
+        return await action();
+    }
+    finally {
+        if (acquired) {
+            const current = await readFile(lockPath, 'utf8').catch(() => '');
+            if (current === serialized)
+                await unlink(lockPath);
+        }
+        await unlink(ownerPath).catch(() => { });
+    }
+}
+async function loadLayout(root, bindingId) {
+    let value;
+    try {
+        value = (await readState(root, 'layouts', bindingId));
+    }
+    catch (error) {
+        if (error.code === 'ENOENT')
+            return {};
+        throw error;
+    }
+    if (value?.schemaVersion !== '1.0.0' ||
+        value.bindingId !== bindingId ||
+        !value.layout ||
+        typeof value.layout !== 'object' ||
+        Array.isArray(value.layout))
+        return fail('E_COMPANY_STATE', 'Invalid company layout state.');
+    layoutDigest(value.layout);
+    return value.layout;
+}
+function checkContent(content) {
+    if (/-----BEGIN (?:RSA |EC |OPENSSH )?PRIVATE KEY-----|(?:sk_live_|ghp_)[A-Za-z0-9]{20,}|(?:authorization["']?\s*[:=]\s*["']?bearer\s+)[A-Za-z0-9._-]{20,}/i.test(content))
+        fail('E_COMPANY_SENSITIVE', 'This artifact appears to contain credentials. Remove them before sharing.');
+}
+async function prepareCompanyContent(root, source, detectDesign = false) {
+    const file = await safeFile(root, source.filePath);
+    const extension = path.extname(file).toLowerCase();
+    const contentType = {
+        '.json': 'application/json',
+        '.md': 'text/markdown',
+        '.svg': 'image/svg+xml',
+        '.html': 'text/html',
+    }[extension];
+    if (!contentType)
+        return fail('E_COMPANY_TYPE', 'Publish a JSON, Markdown, SVG, or HTML artifact.');
+    const original = await readArtifactFile(file);
+    checkContent(original);
+    let isDesignDocument = false;
+    if (source.kind === 'design' && extension === '.json') {
+        try {
+            isDesignDocument = JSON.parse(original).kind === 'openplanr-design-document';
+        }
+        catch {
+            /* Ordinary JSON validation belongs to its domain. */
+        }
+    }
+    if (source.sourceType === 'design-document' && !isDesignDocument)
+        return fail('E_COMPANY_CHANGED', 'The selected design document changed type. Create a new publication preview.');
+    if (source.sourceType !== 'design-document' && !(detectDesign && isDesignDocument))
+        return { content: original, contentType };
+    const pipeline = resolvePipelinePackage(true);
+    if (!pipeline)
+        return fail('E_COMPANY_DESIGN_RUNTIME', 'The design publication runtime is unavailable. Run planr doctor to inspect the installed runtime.');
+    let prepareDesign;
+    try {
+        ({ prepareCompanyDesignPublication: prepareDesign } = await import(pathToFileURL(path.join(pipeline.root, 'lib/design/company-publication.mjs')).href));
+    }
+    catch (cause) {
+        return fail('E_COMPANY_DESIGN_RUNTIME', 'The resolved pipeline does not provide design publication. Run planr doctor to inspect the installed runtime.', cause);
+    }
+    if (typeof prepareDesign !== 'function')
+        return fail('E_COMPANY_DESIGN_RUNTIME', 'The resolved pipeline does not provide design publication. Run planr doctor to inspect the installed runtime.');
+    const prepared = await prepareDesign(file, { maxBytes: MAX_BYTES });
+    if (typeof prepared.content !== 'string' ||
+        !Array.isArray(prepared.sourceFiles) ||
+        !prepared.sourceFiles.length ||
+        !prepared.sourceDigests ||
+        prepared.byteLength !== Buffer.byteLength(prepared.content) ||
+        prepared.byteLength > MAX_BYTES)
+        return fail('E_COMPANY_DESIGN_RUNTIME', 'The design publication runtime returned an invalid or oversized bundle.');
+    const sourceDigests = Object.create(null);
+    for (const relative of prepared.sourceFiles) {
+        assertSafeRelativePath(relative);
+        const repositoryPath = path.posix.join(path.posix.dirname(source.filePath), relative);
+        assertSafeRelativePath(repositoryPath);
+        const resolved = await safeFile(root, repositoryPath);
+        const bytes = await readFile(resolved);
+        const digest = createHash('sha256').update(bytes).digest('hex');
+        if (digest !== prepared.sourceDigests[relative])
+            return fail('E_COMPANY_CHANGED', 'A design source changed while preparing publication. Create a new preview.');
+        if (Object.hasOwn(sourceDigests, repositoryPath))
+            return fail('E_COMPANY_DESIGN_RUNTIME', 'The design publication contains duplicate source paths.');
+        sourceDigests[repositoryPath] = digest;
+    }
+    if (!Object.hasOwn(sourceDigests, source.filePath))
+        return fail('E_COMPANY_DESIGN_RUNTIME', 'The design publication omitted its selected source document.');
+    checkContent(prepared.content);
+    return {
+        content: prepared.content,
+        contentType: 'application/json',
+        sourceType: 'design-document',
+        sourceFiles: Object.keys(sourceDigests).sort(),
+        sourceDigests,
+        designSummary: {
+            designId: prepared.designId,
+            screenCount: prepared.screenCount,
+            frameCount: prepared.frameCount,
+            variantCount: prepared.variantCount,
+        },
+        warnings: prepared.warnings ?? [],
+    };
+}
+function sameSourceManifest(left, right) {
+    return (left.sourceType === right.sourceType &&
+        JSON.stringify([...(left.sourceFiles ?? [])].sort().map((file) => [file, left.sourceDigests?.[file]])) ===
+            JSON.stringify([...(right.sourceFiles ?? [])].sort().map((file) => [file, right.sourceDigests?.[file]])));
+}
+function publicationSourceDigest(contentDigest, source) {
+    return source.sourceType === 'design-document'
+        ? hash(JSON.stringify([
+            contentDigest,
+            [...(source.sourceFiles ?? [])]
+                .sort()
+                .map((file) => [file, source.sourceDigests?.[file]]),
+        ]))
+        : contentDigest;
+}
+function publicPreview(preview) {
+    const { sourceDigests: _privateDigests, ...visible } = preview;
+    return visible;
+}
+function requireApplicableSource(binding) {
+    if (binding.sourceType === 'design-document')
+        return fail('E_COMPANY_AUTHORING', 'Packaged design proposals cannot be applied over an authored design document. Review the handoff, edit its declared source files locally, then preview a company push.');
+}
+export async function previewCompanyPublication(root, options) {
+    const kind = options.kind ?? 'document';
+    const prepared = await prepareCompanyContent(root, { filePath: options.filePath, kind }, true);
+    const { content, warnings: _warnings, ...source } = prepared;
+    const preview = {
+        schemaVersion: '1.0.0',
+        id: randomUUID(),
+        apiUrl: normalizeCompanyOrigin(options.apiUrl),
+        projectId: id(options.projectId),
+        filePath: options.filePath,
+        title: options.title ?? path.basename(options.filePath),
+        kind,
+        ...source,
+        contentDigest: hash(content),
+        byteLength: Buffer.byteLength(content),
+        createdAt: new Date().toISOString(),
+    };
+    if (!['diagram', 'design', 'plan', 'document'].includes(preview.kind) ||
+        !preview.title.trim() ||
+        preview.title.length > 240)
+        return fail('E_COMPANY_INPUT', 'Supply a valid artifact kind and title.');
+    await saveState(root, 'previews', preview.id, preview);
+    return {
+        ok: true,
+        action: 'company.preview',
+        status: 'preview',
+        preview: publicPreview(preview),
+        selectedFiles: preview.sourceFiles ?? [preview.filePath],
+        content,
+        ...(prepared.warnings?.length ? { warnings: prepared.warnings } : {}),
+        notice: preview.sourceType === 'design-document'
+            ? 'Only the listed design document and its referenced files will be shared. Review this exact scope and content before invoking company publish.'
+            : 'Only this file will be shared. Review the content before invoking company publish.',
+    };
+}
+async function companyResponse(apiUrl, route, options = {}) {
+    const origin = normalizeCompanyOrigin(apiUrl);
+    if (!route.startsWith('/v1/') ||
+        route.includes('..') ||
+        route.includes('\\') ||
+        route.includes('#'))
+        return fail('E_COMPANY_ROUTE', 'Invalid company route.');
+    const token = options.token ?? (await resolveCompanyAccessToken(origin));
+    if (!token)
+        return fail('E_COMPANY_AUTH', 'Sign in using `planr company login`. Developer endpoint and token overrides remain available.');
+    const headers = {
+        Authorization: `Bearer ${token}`,
+        Accept: 'application/json',
+    };
+    if (options.body !== undefined)
+        headers['Content-Type'] = 'application/json';
+    if (options.idempotencyKey)
+        headers['Idempotency-Key'] = options.idempotencyKey;
+    let response;
+    try {
+        response = await fetch(origin + route, {
+            method: options.method ?? 'GET',
+            headers,
+            body: options.body === undefined ? undefined : JSON.stringify(options.body),
+            redirect: 'error',
+            signal: AbortSignal.timeout(15000),
+        });
+    }
+    catch (cause) {
+        return fail('E_COMPANY_UNAVAILABLE', 'The company service could not be reached. Local work is unchanged; retry later.', cause);
+    }
+    if (response.status === 401 && options.token === undefined) {
+        const renewed = await resolveCompanyAccessToken(origin, { rejectedAccessToken: token });
+        if (renewed) {
+            await response.body?.cancel();
+            headers.Authorization = `Bearer ${renewed}`;
+            try {
+                response = await fetch(origin + route, {
+                    method: options.method ?? 'GET',
+                    headers,
+                    body: options.body === undefined ? undefined : JSON.stringify(options.body),
+                    redirect: 'error',
+                    signal: AbortSignal.timeout(15000),
+                });
+            }
+            catch (cause) {
+                return fail('E_COMPANY_UNAVAILABLE', 'The company service could not be reached. Local work is unchanged; retry later.', cause);
+            }
+        }
+    }
+    if (!response.ok)
+        return fail(response.status === 409
+            ? 'E_COMPANY_CONFLICT'
+            : response.status === 401 || response.status === 403
+                ? 'E_COMPANY_AUTH'
+                : 'E_COMPANY_REQUEST', response.status === 409
+            ? 'The remote revision changed. Refresh and compare before publishing.'
+            : `Company request failed (${response.status}). No server response content was logged.`);
+    return response;
+}
+async function readCompanyBody(response, limit, preserveBom = false) {
+    if (Number(response.headers.get('content-length')) > limit) {
+        await response.body?.cancel();
+        return fail('E_COMPANY_RESPONSE', 'The company response exceeded its supported size.');
+    }
+    let received = 0;
+    let content = '';
+    try {
+        const reader = response.body?.getReader();
+        const decoder = new TextDecoder('utf-8', { fatal: true, ignoreBOM: preserveBom });
+        if (!reader)
+            return { content: '', byteLength: 0 };
+        try {
+            while (true) {
+                const chunk = await reader.read();
+                if (chunk.done)
+                    break;
+                received += chunk.value.byteLength;
+                if (received > limit)
+                    return fail('E_COMPANY_RESPONSE', 'The company response exceeded its supported size.');
+                content += decoder.decode(chunk.value, { stream: true });
+            }
+            content += decoder.decode();
+        }
+        catch (error) {
+            await reader.cancel().catch(() => { });
+            throw error;
+        }
+        return { content, byteLength: received };
+    }
+    catch (error) {
+        if (error instanceof CompanySyncError)
+            throw error;
+        return fail('E_COMPANY_RESPONSE', 'The company service returned an invalid response. No response content was logged.');
+    }
+}
+export async function companyApi(apiUrl, route, options = {}) {
+    const { content } = await readCompanyBody(await companyResponse(apiUrl, route, options), MAX_RESPONSE_BYTES);
+    try {
+        return JSON.parse(content);
+    }
+    catch (cause) {
+        return fail('E_COMPANY_RESPONSE', 'The company service returned an invalid response. No response content was logged.', cause);
+    }
+}
+export async function publishCompanyPreview(root, previewId) {
+    return withBindingLock(root, previewId, async () => {
+        const preview = await loadState(root, 'previews', previewId);
+        const replayed = Boolean(preview.revisionId);
+        const prepared = await prepareCompanyContent(root, preview);
+        const { content } = prepared;
+        if (hash(content) !== preview.contentDigest || !sameSourceManifest(preview, prepared))
+            return fail('E_COMPANY_CHANGED', 'The file or a referenced design source changed after preview. Create a new preview before sharing.');
+        checkContent(content);
+        const base = `/v1/projects/${id(preview.projectId)}/artifacts`;
+        if (!preview.artifactId) {
+            const result = await companyApi(preview.apiUrl, base, {
+                method: 'POST',
+                body: { title: preview.title, kind: preview.kind },
+                idempotencyKey: preview.id + '-create',
+            });
+            if (result?.artifact?.projectId !== preview.projectId)
+                return fail('E_COMPANY_RESPONSE', 'The returned artifact belongs to a different project.');
+            preview.artifactId = id(result.artifact.id);
+            preview.organizationId = id(result.artifact.organizationId);
+            await saveState(root, 'previews', preview.id, preview);
+        }
+        if (!preview.revisionId) {
+            const result = await companyApi(preview.apiUrl, `${base}/${id(preview.artifactId)}/revisions`, {
+                method: 'POST',
+                body: { baseRevisionId: null, content, contentType: preview.contentType },
+                idempotencyKey: preview.id + '-publish',
+            });
+            if (result?.revision?.organizationId !== preview.organizationId ||
+                result.revision.projectId !== preview.projectId ||
+                result.revision.artifactId !== preview.artifactId ||
+                result.revision.parentRevisionId !== null ||
+                result.revision.contentDigest !== preview.contentDigest)
+                return fail('E_COMPANY_RESPONSE', 'The returned revision does not match the reviewed publication.');
+            preview.revisionId = id(result.revision.id);
+            await saveState(root, 'previews', preview.id, preview);
+        }
+        let existing;
+        try {
+            existing = (await loadState(root, 'bindings', preview.id));
+        }
+        catch (error) {
+            if (error.code !== 'ENOENT')
+                throw error;
+        }
+        if (existing &&
+            (existing.artifactId !== preview.artifactId ||
+                existing.organizationId !== preview.organizationId))
+            return fail('E_COMPANY_STATE', 'This preview conflicts with its existing publication binding.');
+        if (!existing)
+            await saveState(root, 'bindings', preview.id, preview);
+        return {
+            ok: true,
+            action: 'company.publish',
+            status: replayed ? 'already-published' : 'synchronized',
+            bindingId: preview.id,
+            artifactId: preview.artifactId,
+            revisionId: existing?.revisionId ?? preview.revisionId,
+            ...(replayed
+                ? {
+                    publishedRevisionId: preview.revisionId,
+                    synchronization: 'not-checked',
+                    notice: 'This publication completed earlier. Its receipt was preserved; run company status to check current local and remote revisions.',
+                }
+                : {}),
+        };
+    });
+}
+export async function companyBindingStatus(root, bindingId) {
+    const binding = (await loadState(root, 'bindings', bindingId));
+    const prepared = await prepareCompanyContent(root, binding);
+    const current = prepared.content;
+    const remote = await companyApi(binding.apiUrl, `/v1/projects/${id(binding.projectId)}/artifacts/${id(binding.artifactId)}`);
+    if (remote?.artifact?.id !== binding.artifactId ||
+        remote.artifact.organizationId !== binding.organizationId ||
+        remote.artifact.projectId !== binding.projectId ||
+        remote.headRevisionId === null)
+        return fail('E_COMPANY_RESPONSE', 'The remote artifact does not match its local binding.');
+    id(remote.headRevisionId);
+    const localChanged = hash(current) !== binding.contentDigest || !sameSourceManifest(binding, prepared);
+    const remoteChanged = remote.headRevisionId !== binding.revisionId;
+    return {
+        ok: true,
+        action: 'company.status',
+        status: localChanged && remoteChanged
+            ? 'conflicted'
+            : localChanged
+                ? 'local-changes'
+                : remoteChanged
+                    ? 'remote-changes'
+                    : 'synchronized',
+        filePath: binding.filePath,
+        artifactId: binding.artifactId,
+        revisionId: binding.revisionId,
+        remoteRevisionId: remote.headRevisionId,
+    };
+}
+const companyArtifactRoute = (binding) => `/v1/projects/${id(binding.projectId)}/artifacts/${id(binding.artifactId)}`;
+async function boundLocalDigest(root, binding) {
+    try {
+        const prepared = await prepareCompanyContent(root, binding);
+        return publicationSourceDigest(hash(prepared.content), prepared);
+    }
+    catch (error) {
+        if (error.code === 'ENOENT')
+            return null;
+        throw error;
+    }
+}
+async function boundRemoteHead(binding) {
+    const result = await companyApi(binding.apiUrl, companyArtifactRoute(binding));
+    if (result?.artifact?.id !== binding.artifactId ||
+        result.artifact.organizationId !== binding.organizationId ||
+        result.artifact.projectId !== binding.projectId)
+        return fail('E_COMPANY_SCOPE', 'The remote artifact does not match its publication binding.');
+    if (result.headRevisionId === null)
+        return fail('E_COMPANY_REVISION', 'The remote artifact has no published revision.');
+    return id(result.headRevisionId);
+}
+async function assertRemoteRevision(binding, revision) {
+    const runtime = await enterpriseRuntime();
+    try {
+        runtime.assertEnterpriseRevision(revision);
+    }
+    catch (cause) {
+        return fail('E_COMPANY_RESPONSE', 'The remote revision metadata is invalid or unsupported.', cause);
+    }
+    const selected = revision;
+    if (selected.organizationId !== binding.organizationId ||
+        selected.projectId !== binding.projectId ||
+        selected.artifactId !== binding.artifactId)
+        return fail('E_COMPANY_SCOPE', 'The revision belongs to a different publication scope.');
+    if (selected.byteLength > MAX_BYTES)
+        return fail('E_COMPANY_SIZE', 'The remote revision exceeds the 1 MiB retrieval limit.');
+    return selected;
+}
+async function findRemoteRevision(binding, revisionId) {
+    id(revisionId);
+    let cursor = 0;
+    for (let page = 0; page < 200; page++) {
+        const result = await companyApi(binding.apiUrl, `${companyArtifactRoute(binding)}/revisions?cursor=${cursor}`);
+        if (!Array.isArray(result?.revisions) || result.revisions.length > 50)
+            return fail('E_COMPANY_RESPONSE', 'The remote revision page is invalid.');
+        let selected;
+        for (const value of result.revisions) {
+            const revision = await assertRemoteRevision(binding, value);
+            if (revision.id === revisionId) {
+                if (selected)
+                    return fail('E_COMPANY_RESPONSE', 'The revision page contains duplicate identities.');
+                selected = revision;
+            }
+        }
+        if (selected)
+            return selected;
+        if (result.nextCursor === null)
+            return fail('E_COMPANY_REVISION', 'The requested revision does not exist in this artifact.');
+        if (!Number.isSafeInteger(result.nextCursor) || result.nextCursor <= cursor)
+            return fail('E_COMPANY_RESPONSE', 'The remote revision cursor is invalid.');
+        cursor = result.nextCursor;
+    }
+    return fail('E_COMPANY_HISTORY_LIMIT', 'The revision history exceeds the supported retrieval window; no revision was selected.');
+}
+async function remoteRevisionContent(binding, revision) {
+    const response = await companyResponse(binding.apiUrl, `${companyArtifactRoute(binding)}/content?revisionId=${id(revision.id)}`);
+    const contentType = response.headers.get('content-type')?.split(';')[0].trim().toLowerCase();
+    const digestHeader = response.headers.get('x-openplanr-content-digest');
+    const etag = response.headers.get('etag');
+    const etagDigest = etag?.match(/^(?:W\/)?"([a-f0-9]{64})"$/)?.[1];
+    if (contentType !== revision.contentType ||
+        (digestHeader !== null && digestHeader !== revision.contentDigest) ||
+        (etag !== null && etagDigest !== revision.contentDigest)) {
+        await response.body?.cancel();
+        return fail('E_COMPANY_INTEGRITY', 'The downloaded content headers do not match the selected revision.');
+    }
+    const { content, byteLength } = await readCompanyBody(response, MAX_BYTES, true);
+    if (byteLength !== revision.byteLength || hash(content) !== revision.contentDigest)
+        return fail('E_COMPANY_INTEGRITY', 'The downloaded bytes do not match the selected revision digest and size.');
+    return content;
+}
+export async function previewCompanyPull(root, bindingId, options = {}) {
+    return withBindingLock(root, bindingId, async () => {
+        const binding = (await loadState(root, 'bindings', bindingId));
+        const localDigest = await boundLocalDigest(root, binding);
+        const remoteHeadRevisionId = await boundRemoteHead(binding);
+        const revision = await findRemoteRevision(binding, options.revisionId === undefined ? remoteHeadRevisionId : id(options.revisionId));
+        const content = await remoteRevisionContent(binding, revision);
+        if ((await boundLocalDigest(root, binding)) !== localDigest)
+            return fail('E_COMPANY_CHANGED', 'The local artifact changed during preview. Preview the remote revision again.');
+        const preview = {
+            schemaVersion: '1.0.0',
+            id: randomUUID(),
+            bindingId,
+            apiUrl: binding.apiUrl,
+            organizationId: binding.organizationId,
+            projectId: binding.projectId,
+            artifactId: binding.artifactId,
+            filePath: binding.filePath,
+            baseRevisionId: binding.revisionId,
+            baseDigest: binding.contentDigest,
+            localDigest,
+            selection: options.revisionId === undefined ? 'latest' : 'revision',
+            remoteHeadRevisionId,
+            revision,
+            createdAt: new Date().toISOString(),
+        };
+        await saveState(root, 'pull-previews', bindingId, preview);
+        return {
+            ok: true,
+            action: 'company.pull-preview',
+            status: 'preview',
+            readOnly: true,
+            contentTrust: 'untrusted',
+            bindingId,
+            preview,
+            content,
+            comparison: {
+                localChanged: localDigest !== publicationSourceDigest(binding.contentDigest, binding),
+                localMissing: localDigest === null,
+                remoteChanged: remoteHeadRevisionId !== binding.revisionId,
+            },
+            notice: 'Review these exact remote bytes, then invoke company pull without --preview to retrieve a private review copy. The repository file and accepted binding stay unchanged.',
+        };
+    });
+}
+export async function pullCompanyBinding(root, bindingId) {
+    return withBindingLock(root, bindingId, async () => {
+        const binding = (await loadState(root, 'bindings', bindingId));
+        let preview;
+        try {
+            preview = (await readState(root, 'pull-previews', bindingId));
+        }
+        catch (error) {
+            if (error.code === 'ENOENT')
+                return fail('E_COMPANY_PREVIEW', 'Review the remote revision with company pull --preview first.');
+            throw error;
+        }
+        if (!preview ||
+            preview.schemaVersion !== '1.0.0' ||
+            preview.bindingId !== bindingId ||
+            preview.apiUrl !== binding.apiUrl ||
+            preview.organizationId !== binding.organizationId ||
+            preview.projectId !== binding.projectId ||
+            preview.artifactId !== binding.artifactId ||
+            preview.filePath !== binding.filePath ||
+            preview.baseRevisionId !== binding.revisionId ||
+            preview.baseDigest !== binding.contentDigest ||
+            !['latest', 'revision'].includes(preview.selection) ||
+            (preview.localDigest !== null && !isDigest(preview.localDigest)) ||
+            typeof preview.createdAt !== 'string' ||
+            !Number.isFinite(Date.parse(preview.createdAt)))
+            return fail('E_COMPANY_STATE', 'The pull preview no longer matches this publication binding. Create a fresh preview.');
+        id(preview.id);
+        id(preview.remoteHeadRevisionId);
+        const revision = await assertRemoteRevision(binding, preview.revision);
+        if (preview.selection === 'latest' && revision.id !== preview.remoteHeadRevisionId)
+            return fail('E_COMPANY_STATE', 'The selected revision does not match the previewed remote head.');
+        if ((await boundLocalDigest(root, binding)) !== preview.localDigest)
+            return fail('E_COMPANY_CHANGED', 'The local artifact changed after preview. Review a fresh pull preview; no repository content was overwritten.');
+        const head = await boundRemoteHead(binding);
+        if (preview.selection === 'latest' && head !== preview.remoteHeadRevisionId)
+            return fail('E_COMPANY_CONFLICT', 'The remote head changed after preview. Review the latest revision again, or explicitly preview a historical revision.');
+        const content = await remoteRevisionContent(binding, revision);
+        if ((await boundLocalDigest(root, binding)) !== preview.localDigest)
+            return fail('E_COMPANY_CHANGED', 'The local artifact changed during retrieval. Review a fresh pull preview.');
+        const contentPath = path.join(await safeStateDirectory(root, 'remote-content'), `${preview.id}.txt`);
+        try {
+            const info = await lstat(contentPath);
+            if (!info.isFile() ||
+                info.isSymbolicLink() ||
+                info.size > MAX_BYTES ||
+                hash(await readArtifactFile(contentPath)) !== revision.contentDigest)
+                return fail('E_COMPANY_STATE', 'The previous review copy changed. Create a new pull preview to retrieve a separate copy.');
+        }
+        catch (error) {
+            if (error.code !== 'ENOENT')
+                throw error;
+            await replaceDurably(contentPath, content);
+        }
+        const receipt = {
+            schemaVersion: '1.0.0',
+            status: 'retrieved-for-review',
+            bindingId,
+            previewId: preview.id,
+            organizationId: binding.organizationId,
+            projectId: binding.projectId,
+            artifactId: binding.artifactId,
+            revisionId: revision.id,
+            contentDigest: revision.contentDigest,
+            contentType: revision.contentType,
+            byteLength: revision.byteLength,
+            contentPath: path.relative(await realpath(root), contentPath),
+            retrievedAt: new Date().toISOString(),
+            contentTrust: 'untrusted',
+            bindingAdvanced: false,
+            remoteAcknowledgement: 'not-sent',
+        };
+        await saveState(root, 'pulls', preview.id, receipt);
+        return {
+            ok: true,
+            action: 'company.pull',
+            ...receipt,
+            contentPath,
+            notice: 'Retrieved a private text copy for local inspection. Repository content and the accepted revision binding remain unchanged; no proposal or feedback was acknowledged.',
+        };
+    });
+}
+async function enterpriseRuntime() {
+    const resolved = resolvePipelinePackage(true);
+    if (!resolved)
+        return fail('E_COMPANY_RUNTIME', 'The OpenPlanr workflow package is unavailable.');
+    return await import(pathToFileURL(path.join(resolved.root, 'lib/protocol/enterprise-contracts.mjs')).href);
+}
+export async function previewCompanyProposal(root, bindingId, proposalId) {
+    const binding = (await loadState(root, 'bindings', bindingId));
+    requireApplicableSource(binding);
+    if (binding.contentType !== 'application/json')
+        return fail('E_COMPANY_AUTHORING', 'Reviewed semantic application currently supports canonical JSON diagrams only. Download other proposals for manual review.');
+    const route = `/v1/projects/${id(binding.projectId)}/artifacts/${id(binding.artifactId)}`;
+    id(proposalId);
+    let proposal;
+    let cursor = null;
+    const seenCursors = new Set();
+    for (let page = 0; page < 200; page++) {
+        const result = await companyApi(binding.apiUrl, route + '/proposals' + (cursor === null ? '' : `?cursor=${cursor}`));
+        if (!Array.isArray(result.proposals))
+            return fail('E_COMPANY_RESPONSE', 'The proposal list is invalid.');
+        proposal = result.proposals.find((item) => item?.id === proposalId);
+        if (proposal)
+            break;
+        if (result.nextCursor === null || result.nextCursor === undefined)
+            break;
+        if (!Number.isSafeInteger(result.nextCursor) ||
+            result.nextCursor < 1 ||
+            seenCursors.has(result.nextCursor))
+            return fail('E_COMPANY_RESPONSE', 'The proposal cursor is invalid.');
+        seenCursors.add(result.nextCursor);
+        cursor = result.nextCursor;
+    }
+    if (!proposal)
+        return fail('E_COMPANY_PROPOSAL', 'Proposal not found in this artifact.');
+    const runtime = await enterpriseRuntime();
+    runtime.assertEnterpriseProposal(proposal);
+    if (proposal.organizationId !== binding.organizationId ||
+        proposal.artifactId !== binding.artifactId ||
+        proposal.projectId !== binding.projectId ||
+        proposal.baseRevisionId !== binding.revisionId ||
+        !['proposed', 'accepted'].includes(String(proposal.status)))
+        return fail('E_COMPANY_CONFLICT', 'This proposal is not applicable to the bound revision.');
+    const status = await companyBindingStatus(root, bindingId);
+    if (status.status !== 'synchronized')
+        return fail('E_COMPANY_CONFLICT', 'Local or remote content changed. Compare revisions before applying.');
+    const content = await readArtifactFile(await safeFile(root, binding.filePath));
+    if (hash(content) !== binding.contentDigest)
+        return fail('E_COMPANY_CONFLICT', 'The local file changed while preparing the preview. Compare revisions before applying.');
+    const original = JSON.parse(content);
+    if (original.kind !== 'planr-diagram')
+        return fail('E_COMPANY_AUTHORING', 'This document type does not yet support validated semantic application.');
+    const baseLayout = await loadLayout(root, bindingId);
+    const transformed = runtime.applyEnterpriseOperations(original, proposal, { layout: baseLayout });
+    if (transformed.layoutChanged)
+        return fail('E_COMPANY_AUTHORING', 'Layout proposals cannot be applied until the local renderer and publication path consume stored layout state.');
+    const pipeline = resolvePipelinePackage(true);
+    if (!pipeline)
+        return fail('E_COMPANY_RUNTIME', 'The OpenPlanr workflow package is unavailable.');
+    const canonical = await import(pathToFileURL(path.join(pipeline.root, 'lib/protocol/canonical-json.mjs')).href);
+    const diagram = await import(pathToFileURL(path.join(pipeline.root, 'lib/artifact/diagram/index.mjs')).href);
+    if (transformed.document.diagramId !== original.diagramId)
+        return fail('E_COMPANY_SCOPE', 'A proposal cannot replace the bound diagram identity.');
+    const document = canonical.withDocumentDigest(transformed.document);
+    diagram.assertDiagramDocument(document);
+    const rendered = JSON.stringify(document, null, 2) + '\n';
+    if (Buffer.byteLength(rendered) > MAX_BYTES)
+        return fail('E_COMPANY_SIZE', 'The proposed document exceeds the 1 MiB company limit.');
+    checkContent(rendered);
+    return {
+        ok: true,
+        action: 'company.proposal-preview',
+        bindingId,
+        proposalId,
+        summary: proposal.summary,
+        filePath: binding.filePath,
+        baseRevisionId: binding.revisionId,
+        baseDigest: binding.contentDigest,
+        baseLayoutDigest: layoutDigest(baseLayout),
+        document,
+        layout: transformed.layout ?? {},
+        semanticChanged: transformed.semanticChanged,
+        layoutChanged: transformed.layoutChanged,
+        changes: transformed.changes,
+        before: original,
+    };
+}
+async function requireNoPendingApplication(root, bindingId) {
+    const directory = await safeStateDirectory(root, 'pending-applications');
+    for (const name of await readdir(directory)) {
+        if (!name.endsWith('.json'))
+            continue;
+        const proposalId = id(name.slice(0, -5));
+        const pending = (await readState(root, 'pending-applications', proposalId));
+        if (pending?.bindingId !== bindingId)
+            continue;
+        // A completed receipt can outlive best-effort journal cleanup.
+        let receipt;
+        try {
+            receipt = (await readState(root, 'applications', proposalId));
+        }
+        catch (error) {
+            if (error.code !== 'ENOENT')
+                throw error;
+        }
+        if (receipt?.bindingId === bindingId &&
+            receipt.proposalId === proposalId &&
+            receipt.status === 'applied-locally' &&
+            receipt.resultDigest === pending.resultDigest)
+            continue;
+        return fail('E_COMPANY_RECOVERY', `Finish pending recovery with company apply ${bindingId} ${proposalId} before starting another operation on this artifact.`);
+    }
+}
+async function resumePendingApplication(root, binding, pending) {
+    if (!pending ||
+        pending.schemaVersion !== '1.0.0' ||
+        pending.status !== 'pending-local-application' ||
+        pending.bindingId !== binding.id ||
+        pending.filePath !== binding.filePath ||
+        pending.apiUrl !== binding.apiUrl ||
+        pending.organizationId !== binding.organizationId ||
+        pending.projectId !== binding.projectId ||
+        pending.artifactId !== binding.artifactId ||
+        pending.baseRevisionId !== binding.revisionId ||
+        pending.baseDigest !== binding.contentDigest ||
+        !isDigest(pending.baseDigest) ||
+        !isDigest(pending.resultDigest) ||
+        !isDigest(pending.baseLayoutDigest) ||
+        !isDigest(pending.resultLayoutDigest) ||
+        typeof pending.semanticChanged !== 'boolean' ||
+        typeof pending.layoutChanged !== 'boolean' ||
+        typeof pending.preparedAt !== 'string' ||
+        !Number.isFinite(Date.parse(pending.preparedAt)))
+        return fail('E_COMPANY_STATE', 'The pending application does not match this publication binding.');
+    id(pending.proposalId);
+    id(pending.backupId);
+    if (layoutDigest(pending.layout) !== pending.resultLayoutDigest)
+        return fail('E_COMPANY_STATE', 'The pending layout digest does not match its contents.');
+    const staged = await readStoredContent(root, 'application-content', pending.proposalId);
+    const backup = await readStoredContent(root, 'backups', pending.backupId);
+    if (hash(staged) !== pending.resultDigest ||
+        hash(backup) !== pending.baseDigest ||
+        pending.semanticChanged !== (pending.baseDigest !== pending.resultDigest) ||
+        pending.layoutChanged !== (pending.baseLayoutDigest !== pending.resultLayoutDigest))
+        return fail('E_COMPANY_STATE', 'Pending application content failed its digest check.');
+    const inspect = async () => {
+        const sourceDigest = hash(await readArtifactFile(await safeFile(root, binding.filePath)));
+        const currentLayoutDigest = layoutDigest(await loadLayout(root, binding.id));
+        if (![pending.baseDigest, pending.resultDigest].includes(sourceDigest) ||
+            ![pending.baseLayoutDigest, pending.resultLayoutDigest].includes(currentLayoutDigest) ||
+            (pending.semanticChanged &&
+                pending.layoutChanged &&
+                sourceDigest === pending.baseDigest &&
+                currentLayoutDigest === pending.resultLayoutDigest))
+            return fail('E_COMPANY_CONFLICT', 'The file or layout changed after this application was prepared. Pending recovery and the backup were preserved; no unrelated edits were overwritten.');
+        return { sourceDigest, currentLayoutDigest };
+    };
+    let state = await inspect();
+    if (state.sourceDigest !== pending.resultDigest) {
+        const target = await safeFile(root, binding.filePath);
+        await replaceDurably(target, staged, (await lstat(target)).mode & 0o777, async () => {
+            const latest = await inspect();
+            if (latest.sourceDigest !== pending.baseDigest)
+                return fail('E_COMPANY_CONFLICT', 'The source changed during recovery. Retry after inspecting its pending application.');
+        });
+    }
+    state = await inspect();
+    if (state.currentLayoutDigest !== pending.resultLayoutDigest)
+        await saveState(root, 'layouts', binding.id, {
+            schemaVersion: '1.0.0',
+            bindingId: binding.id,
+            layout: pending.layout,
+        });
+    state = await inspect();
+    if (state.sourceDigest !== pending.resultDigest ||
+        state.currentLayoutDigest !== pending.resultLayoutDigest)
+        return fail('E_COMPANY_CONFLICT', 'The application result changed before it could be recorded. Its pending journal was preserved.');
+    const backupPath = await statePath(root, 'backups', pending.backupId);
+    await saveState(root, 'applications', pending.proposalId, {
+        schemaVersion: '1.0.0',
+        bindingId: binding.id,
+        proposalId: pending.proposalId,
+        baseRevisionId: pending.baseRevisionId,
+        filePath: binding.filePath,
+        backupPath: path.relative(await realpath(root), backupPath),
+        appliedAt: new Date().toISOString(),
+        status: 'applied-locally',
+        remoteAcknowledgement: 'pending',
+        resultDigest: pending.resultDigest,
+        resultLayoutDigest: pending.resultLayoutDigest,
+        layout: pending.layout,
+    });
+    // The durable receipt is authoritative after this point. Cleanup is best effort.
+    await unlink(await statePath(root, 'pending-applications', pending.proposalId)).catch(() => { });
+    await unlink(await statePath(root, 'application-content', pending.proposalId)).catch(() => { });
+    return {
+        ok: true,
+        action: 'company.apply',
+        status: 'applied-locally',
+        filePath: binding.filePath,
+        proposalId: pending.proposalId,
+        backupPath,
+        semanticChanged: pending.semanticChanged,
+        layoutChanged: pending.layoutChanged,
+        notice: 'Review and commit the local change. Use company push --preview to review its publication. Proposal acknowledgement remains pending; local application does not resolve hosted feedback.',
+    };
+}
+export async function applyCompanyProposal(root, bindingId, proposalId) {
+    id(proposalId);
+    return withBindingLock(root, bindingId, async () => {
+        const binding = (await loadState(root, 'bindings', bindingId));
+        requireApplicableSource(binding);
+        let applied;
+        try {
+            applied = (await readState(root, 'applications', proposalId));
+        }
+        catch (error) {
+            if (error.code !== 'ENOENT')
+                throw error;
+        }
+        if (applied) {
+            if (applied.schemaVersion !== '1.0.0' ||
+                applied.bindingId !== bindingId ||
+                applied.proposalId !== proposalId ||
+                !isDigest(applied.resultDigest) ||
+                (applied.resultLayoutDigest !== undefined && !isDigest(applied.resultLayoutDigest)))
+                return fail('E_COMPANY_STATE', 'Invalid previous proposal application.');
+            if (applied.filePath !== binding.filePath ||
+                hash(await readArtifactFile(await safeFile(root, binding.filePath))) !==
+                    applied.resultDigest ||
+                (applied.resultLayoutDigest !== undefined &&
+                    layoutDigest(await loadLayout(root, bindingId)) !== applied.resultLayoutDigest))
+                return fail('E_COMPANY_CONFLICT', 'This proposal was already applied and the local result has since changed. Review its application record before continuing.');
+            return {
+                ok: true,
+                action: 'company.apply',
+                status: 'already-applied-locally',
+                filePath: binding.filePath,
+                proposalId,
+                backupPath: applied.backupPath,
+                notice: 'This proposal was already applied locally. No additional repository changes or remote acknowledgements were made.',
+            };
+        }
+        let pending;
+        try {
+            pending = (await readState(root, 'pending-applications', proposalId));
+        }
+        catch (error) {
+            if (error.code !== 'ENOENT')
+                throw error;
+        }
+        if (pending) {
+            if (pending.proposalId !== proposalId)
+                return fail('E_COMPANY_STATE', 'The pending proposal identity does not match this request.');
+            return resumePendingApplication(root, binding, pending);
+        }
+        await requireNoPendingApplication(root, bindingId);
+        const preview = await previewCompanyProposal(root, bindingId, proposalId);
+        const current = await readArtifactFile(await safeFile(root, preview.filePath));
+        if (hash(current) !== preview.baseDigest)
+            return fail('E_COMPANY_CONFLICT', 'The local file changed while preparing the proposal. Nothing was applied.');
+        const baseLayout = await loadLayout(root, bindingId);
+        if (layoutDigest(baseLayout) !== preview.baseLayoutDigest)
+            return fail('E_COMPANY_CONFLICT', 'The layout changed while preparing the proposal. Nothing was applied.');
+        const staged = preview.semanticChanged
+            ? JSON.stringify(preview.document, null, 2) + '\n'
+            : current;
+        pending = {
+            schemaVersion: '1.0.0',
+            status: 'pending-local-application',
+            bindingId,
+            proposalId,
+            apiUrl: binding.apiUrl,
+            organizationId: binding.organizationId,
+            projectId: binding.projectId,
+            artifactId: binding.artifactId,
+            filePath: binding.filePath,
+            baseRevisionId: binding.revisionId,
+            baseDigest: preview.baseDigest,
+            resultDigest: hash(staged),
+            baseLayoutDigest: layoutDigest(baseLayout),
+            resultLayoutDigest: layoutDigest(preview.layout),
+            layout: preview.layout,
+            backupId: randomUUID(),
+            preparedAt: new Date().toISOString(),
+            semanticChanged: hash(staged) !== preview.baseDigest,
+            layoutChanged: layoutDigest(baseLayout) !== layoutDigest(preview.layout),
+        };
+        await replaceDurably(await statePath(root, 'backups', pending.backupId), current);
+        await replaceDurably(await statePath(root, 'application-content', proposalId), staged);
+        // No source or layout changes occur before all recovery inputs and this journal are durable.
+        await saveState(root, 'pending-applications', proposalId, pending);
+        return resumePendingApplication(root, binding, pending);
+    });
+}
+export async function previewCompanyPush(root, bindingId) {
+    return withBindingLock(root, bindingId, async () => {
+        await requireNoPendingApplication(root, bindingId);
+        const binding = (await loadState(root, 'bindings', bindingId));
+        const status = await companyBindingStatus(root, bindingId);
+        if (status.status === 'conflicted' || status.status === 'remote-changes')
+            return fail('E_COMPANY_CONFLICT', 'The remote revision changed. Compare revisions before creating an update preview; retry an existing publication without --preview if its response was interrupted.');
+        const prepared = await prepareCompanyContent(root, binding);
+        const { content, warnings: _warnings, ...source } = prepared;
+        checkContent(content);
+        if (Buffer.byteLength(content) > MAX_BYTES)
+            return fail('E_COMPANY_SIZE', 'Artifact exceeds the 1 MiB publication limit.');
+        const preview = {
+            ...binding,
+            ...source,
+            contentDigest: hash(content),
+            byteLength: Buffer.byteLength(content),
+            createdAt: new Date().toISOString(),
+            operationId: randomUUID(),
+        };
+        await saveState(root, 'push-previews', bindingId, preview);
+        return {
+            ok: true,
+            action: 'company.push-preview',
+            status: preview.contentDigest === binding.contentDigest && sameSourceManifest(binding, prepared)
+                ? 'unchanged'
+                : 'preview',
+            bindingId,
+            baseRevisionId: binding.revisionId,
+            preview: publicPreview(preview),
+            selectedFiles: preview.sourceFiles ?? [binding.filePath],
+            content,
+            ...(prepared.warnings?.length ? { warnings: prepared.warnings } : {}),
+            notice: preview.sourceType === 'design-document'
+                ? 'Only the listed design document and referenced files will be updated. Review this exact scope, then invoke company push without --preview.'
+                : 'Only this bound file will be updated. Review its content, then invoke company push without --preview.',
+        };
+    });
+}
+export async function pushCompanyBinding(root, bindingId) {
+    return withBindingLock(root, bindingId, async () => {
+        await requireNoPendingApplication(root, bindingId);
+        const binding = (await loadState(root, 'bindings', bindingId));
+        let preview;
+        try {
+            preview = (await loadState(root, 'push-previews', bindingId));
+        }
+        catch (error) {
+            if (error.code === 'ENOENT')
+                return fail('E_COMPANY_PREVIEW', 'Review this update with company push --preview first.');
+            throw error;
+        }
+        if (preview.filePath !== binding.filePath ||
+            preview.apiUrl !== binding.apiUrl ||
+            preview.projectId !== binding.projectId ||
+            preview.organizationId !== binding.organizationId ||
+            preview.artifactId !== binding.artifactId ||
+            preview.contentType !== binding.contentType ||
+            preview.sourceType !== binding.sourceType)
+            return fail('E_COMPANY_SCOPE', 'The update preview does not match its publication binding.');
+        const prepared = await prepareCompanyContent(root, binding);
+        const { content } = prepared;
+        if (hash(content) !== preview.contentDigest || !sameSourceManifest(preview, prepared))
+            return fail('E_COMPANY_CHANGED', 'The bound file or a referenced design source changed after preview. Review a new update preview before sharing.');
+        checkContent(content);
+        if (preview.publishedRevisionId === binding.revisionId &&
+            preview.contentDigest === binding.contentDigest)
+            return {
+                ok: true,
+                action: 'company.push',
+                status: 'already-published',
+                bindingId,
+                artifactId: binding.artifactId,
+                revisionId: binding.revisionId,
+                synchronization: 'not-checked',
+                notice: 'This update completed earlier. Its receipt was preserved; run company status to check current local and remote revisions.',
+            };
+        if (preview.revisionId !== binding.revisionId)
+            return fail('E_COMPANY_CONFLICT', 'The binding changed after this preview. Review a new update preview.');
+        if (preview.contentDigest === binding.contentDigest) {
+            // A reviewed source-only change (for example JSON whitespace) needs no new hosted
+            // revision, but its exact local source manifest becomes the accepted baseline.
+            await saveState(root, 'bindings', bindingId, {
+                ...binding,
+                sourceFiles: preview.sourceFiles,
+                sourceDigests: preview.sourceDigests,
+            });
+            return {
+                ok: true,
+                action: 'company.push',
+                status: 'unchanged',
+                bindingId,
+                artifactId: binding.artifactId,
+                revisionId: binding.revisionId,
+            };
+        }
+        const replayed = Boolean(preview.publishedRevisionId);
+        if (!preview.publishedRevisionId) {
+            const result = await companyApi(binding.apiUrl, `/v1/projects/${id(binding.projectId)}/artifacts/${id(binding.artifactId)}/revisions`, {
+                method: 'POST',
+                body: { baseRevisionId: preview.revisionId, content, contentType: binding.contentType },
+                idempotencyKey: preview.operationId,
+            });
+            const revision = result?.revision;
+            if (!revision ||
+                revision.organizationId !== binding.organizationId ||
+                revision.projectId !== binding.projectId ||
+                revision.artifactId !== binding.artifactId ||
+                revision.parentRevisionId !== preview.revisionId ||
+                revision.contentDigest !== preview.contentDigest ||
+                revision.id === preview.revisionId)
+                return fail('E_COMPANY_RESPONSE', 'The returned revision does not match the reviewed update.');
+            preview.publishedRevisionId = id(revision.id);
+            await saveState(root, 'push-previews', bindingId, preview);
+        }
+        const { operationId: _operationId, publishedRevisionId, ...published } = preview;
+        await saveState(root, 'bindings', bindingId, { ...published, revisionId: publishedRevisionId });
+        return {
+            ok: true,
+            action: 'company.push',
+            status: replayed ? 'already-published' : 'synchronized',
+            bindingId,
+            artifactId: binding.artifactId,
+            revisionId: publishedRevisionId,
+            ...(replayed ? { synchronization: 'not-checked' } : {}),
+            notice: replayed
+                ? 'This update completed earlier. Its receipt and local binding were recovered; run company status to check current local and remote revisions. Proposal acknowledgement remains separate.'
+                : 'The reviewed artifact revision is published. Proposal acknowledgement and feedback resolution remain separate actions.',
+        };
+    });
+}
+//# sourceMappingURL=company-sync-service.js.map