opensip-cli 0.1.2 → 0.1.3

package/dist/bootstrap/pre-action-bootstrap-phases.js

@@ -0,0 +1,25 @@
+/**
+ * Canonical bootstrap phase names (ADR-0052). The hook is the Commander
+ * adapter; business rules live behind the planner and post-bailout executor.
+ */
+export const PRE_ACTION_PHASES = {
+    readCommandOptions: 'read-command-options',
+    mergeCliDefaults: 'merge-cli-defaults',
+    resolveProject: 'resolve-project',
+    bailoutWindow: 'bailout-window',
+    projectSideEffects: 'project-side-effects',
+    buildScope: 'build-scope',
+    enterScope: 'enter-scope',
+    hostStartEffects: 'host-start-effects',
+    toolPreflight: 'tool-preflight',
+    dispose: 'dispose',
+};
+/** Post-bailout phases in load-bearing order (phases 5–9 of ADR-0052). */
+export const POST_BAILOUT_PHASE_ORDER = [
+    PRE_ACTION_PHASES.projectSideEffects,
+    PRE_ACTION_PHASES.buildScope,
+    PRE_ACTION_PHASES.enterScope,
+    PRE_ACTION_PHASES.hostStartEffects,
+    PRE_ACTION_PHASES.toolPreflight,
+];
+//# sourceMappingURL=pre-action-bootstrap-phases.js.map

package/dist/bootstrap/pre-action-bootstrap-phases.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"pre-action-bootstrap-phases.js","sourceRoot":"","sources":["../../src/bootstrap/pre-action-bootstrap-phases.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,MAAM,CAAC,MAAM,iBAAiB,GAAG;IAC/B,kBAAkB,EAAE,sBAAsB;IAC1C,gBAAgB,EAAE,oBAAoB;IACtC,cAAc,EAAE,iBAAiB;IACjC,aAAa,EAAE,gBAAgB;IAC/B,kBAAkB,EAAE,sBAAsB;IAC1C,UAAU,EAAE,aAAa;IACzB,UAAU,EAAE,aAAa;IACzB,gBAAgB,EAAE,oBAAoB;IACtC,aAAa,EAAE,gBAAgB;IAC/B,OAAO,EAAE,SAAS;CACV,CAAC;AAIX,0EAA0E;AAC1E,MAAM,CAAC,MAAM,wBAAwB,GAA8B;IACjE,iBAAiB,CAAC,kBAAkB;IACpC,iBAAiB,CAAC,UAAU;IAC5B,iBAAiB,CAAC,UAAU;IAC5B,iBAAiB,CAAC,gBAAgB;IAClC,iBAAiB,CAAC,aAAa;CACvB,CAAC"}

package/dist/bootstrap/pre-action-hook.d.ts

@@ -1,74 +1,14 @@
 /**
- * pre-action-hook — Commander `preAction` body.
+ * pre-action-hook — Commander `preAction` adapter (ADR-0052).
  *
- * Runs before every subcommand's action. Centralises run-id generation,
- * config-merge, project-context resolution, schema-version bailout, and
- * (only when the run will proceed) log file initialisation. Datastore is
- * NOT opened here — that's a lazy getter on ToolCliContext (Task 1.3).
- *
- * Ordering is load-bearing: side effects only fire AFTER all bailout
- * decisions. Sequence:
- *
- *   1. generate runId
- *   2. read opts; resolve project context (pure; may throw on strict --config)
- *   3. expose context on opts.projectContext (collision-free name)
- *   4. bailout window — schema check (Phase 6.3), phantom warn (Phase 7)
- *   5. side-effect setup — configureLogger({ logDir }) + setProjectContextForRun
- *      gated on project.scope === 'project' && existsSync(projectRoot)
- *   6. Project: header (Phase 2.2)
- *   7. cli.start log line
- *   8. lazy Tool.initialize() — run the owning tool's optional one-time
- *      init exactly once per process, after the scope is entered and just
- *      before the action body (P1a). CLI-only commands have no owner and
- *      skip it; a failing init is fatal.
- *
- * Strict --config: when `--config <path>` doesn't resolve, the
- * underlying ValidationError surfaces with exit 2 — no silent walk-up.
+ * Business rules live in {@link planPreActionBootstrap} (phases 1–4) and
+ * {@link executePostBailoutBootstrap} (phases 5–9). This module wires those
+ * to Commander's preAction/postAction hooks.
  */
-import { type LanguageRegistry, type ToolPluginManifest, type ToolProvenance, type ToolRegistry } from '@opensip-cli/core';
+import type { PreActionRuntime } from './pre-action-runtime.js';
 import type { Command } from 'commander';
 export { resolveOwningTool } from './owning-tool-init.js';
-/**
- * The `scope.configDocument` slot value (ADR-0023 one-reader): the validated
- * document rides the scope so tools project their shapes from it instead of
- * re-reading the file — but ONLY when a real config file was read. A
- * config-less run stays document-less so tools that hard-error on a missing
- * config (fitness) stay loud instead of silently validating `{}`.
- */
-/**
- * The per-invocation bootstrap result the hook needs to BUILD the scope —
- * the populated registries plus the admitted-tool manifests/provenance. These
- * are created in `main()` BEFORE the scope can be constructed (the registries
- * are inputs to `RunScope`; you can't read them off a scope that doesn't exist
- * yet), so the composition root captures them in this closure and hands them to
- * `installPreActionHook`. After the hook calls `enterScope`, every per-run read
- * (project, datastore, manifests, provenance, …) goes through `currentScope()`
- * — there is NO module-global handoff bag (the former `currentRuntimeContext`).
- */
-export interface PreActionRuntime {
-    readonly languages: LanguageRegistry;
-    readonly tools: ToolRegistry;
-    readonly manifests: readonly ToolPluginManifest[];
-    readonly provenance: readonly ToolProvenance[];
-}
-/**
- * Mount the bootstrap `preAction` hook on the supplied program.
- *
- * @param program The root Commander program.
- * @param version The CLI version (from `readPackageVersion` at the entry
- *   point). Threaded in rather than re-read here so the `mini` banner shows
- *   the SAME version `--version` reports — and so the kernel-adjacent hook
- *   doesn't resolve cli-ui's or its own package version by mistake.
- * @param runtime The bootstrap result (registries + admitted manifests/
- *   provenance). Captured in the hook closure instead of read from a module
- *   global — the composition root installs the hook AFTER `bootstrapCli`
- *   populates the registries (see {@link PreActionRuntime}).
- */
+export type { PreActionRuntime } from './pre-action-runtime.js';
 export declare function installPreActionHook(program: Command, version: string, runtime: PreActionRuntime): void;
-/**
- * Extracted seam (Task 3) for postAction disposal + error-path coverage.
- * Narrow, testable, no Commander dep. Called from the hook; can be called
- * explicitly in tests or future finally blocks on thrown handler paths.
- */
 export declare function disposeCurrentScope(): void;
 //# sourceMappingURL=pre-action-hook.d.ts.map

package/dist/bootstrap/pre-action-hook.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"pre-action-hook.d.ts","sourceRoot":"","sources":["../../src/bootstrap/pre-action-hook.ts"],"names":[],"mappings":"AACA;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AAIH,OAAO,EASL,KAAK,gBAAgB,EAErB,KAAK,kBAAkB,EACvB,KAAK,cAAc,EACnB,KAAK,YAAY,EAClB,MAAM,mBAAmB,CAAC;AAiB3B,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAWzC,OAAO,EAAE,iBAAiB,EAAE,MAAM,uBAAuB,CAAC;AAE1D;;;;;;GAMG;AAEH;;;;;;;;;GASG;AACH,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,CAAC,SAAS,EAAE,gBAAgB,CAAC;IACrC,QAAQ,CAAC,KAAK,EAAE,YAAY,CAAC;IAC7B,QAAQ,CAAC,SAAS,EAAE,SAAS,kBAAkB,EAAE,CAAC;IAClD,QAAQ,CAAC,UAAU,EAAE,SAAS,cAAc,EAAE,CAAC;CAChD;AAED;;;;;;;;;;;;GAYG;AAUH,wBAAgB,oBAAoB,CAClC,OAAO,EAAE,OAAO,EAChB,OAAO,EAAE,MAAM,EACf,OAAO,EAAE,gBAAgB,GACxB,IAAI,CA4ON;AAED;;;;GAIG;AACH,wBAAgB,mBAAmB,IAAI,IAAI,CAS1C"}
+{"version":3,"file":"pre-action-hook.d.ts","sourceRoot":"","sources":["../../src/bootstrap/pre-action-hook.ts"],"names":[],"mappings":"AACA;;;;;;GAMG;AAOH,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,yBAAyB,CAAC;AAChE,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAEzC,OAAO,EAAE,iBAAiB,EAAE,MAAM,uBAAuB,CAAC;AAC1D,YAAY,EAAE,gBAAgB,EAAE,MAAM,yBAAyB,CAAC;AAEhE,wBAAgB,oBAAoB,CAClC,OAAO,EAAE,OAAO,EAChB,OAAO,EAAE,MAAM,EACf,OAAO,EAAE,gBAAgB,GACxB,IAAI,CAiCN;AAED,wBAAgB,mBAAmB,IAAI,IAAI,CAS1C"}

package/dist/bootstrap/pre-action-hook.js

@@ -1,285 +1,42 @@
-// @fitness-ignore-file detached-promises -- the preAction hook is a composition root: its body invokes synchronous bootstrap helpers (mergeConfigDefaults, configureLogger, the checkSchemaVersion/checkNoProject/warnAboutPhantom bailout guards, enterScope) that the name-based heuristic mistakes for promise-returning calls. The one genuine async call (maybeInitializeOwningTool) is awaited. Matches the same suppression on index.ts and bootstrap/index.ts.
+// @fitness-ignore-file detached-promises -- the preAction hook is a composition root: its body awaits maybeInitializeOwningTool inside executePostBailoutBootstrap. Matches the same suppression on index.ts and bootstrap/index.ts.
 /**
- * pre-action-hook — Commander `preAction` body.
+ * pre-action-hook — Commander `preAction` adapter (ADR-0052).
  *
- * Runs before every subcommand's action. Centralises run-id generation,
- * config-merge, project-context resolution, schema-version bailout, and
- * (only when the run will proceed) log file initialisation. Datastore is
- * NOT opened here — that's a lazy getter on ToolCliContext (Task 1.3).
- *
- * Ordering is load-bearing: side effects only fire AFTER all bailout
- * decisions. Sequence:
- *
- *   1. generate runId
- *   2. read opts; resolve project context (pure; may throw on strict --config)
- *   3. expose context on opts.projectContext (collision-free name)
- *   4. bailout window — schema check (Phase 6.3), phantom warn (Phase 7)
- *   5. side-effect setup — configureLogger({ logDir }) + setProjectContextForRun
- *      gated on project.scope === 'project' && existsSync(projectRoot)
- *   6. Project: header (Phase 2.2)
- *   7. cli.start log line
- *   8. lazy Tool.initialize() — run the owning tool's optional one-time
- *      init exactly once per process, after the scope is entered and just
- *      before the action body (P1a). CLI-only commands have no owner and
- *      skip it; a failing init is fatal.
- *
- * Strict --config: when `--config <path>` doesn't resolve, the
- * underlying ValidationError surfaces with exit 2 — no silent walk-up.
+ * Business rules live in {@link planPreActionBootstrap} (phases 1–4) and
+ * {@link executePostBailoutBootstrap} (phases 5–9). This module wires those
+ * to Commander's preAction/postAction hooks.
  */
-import { existsSync } from 'node:fs';
-import { configureLogger, currentScope, enterScope, generatePrefixedId, logger, resolveProjectContext, resolveProjectPaths, SystemError, } from '@opensip-cli/core';
-import { getMeter } from '@opensip-cli/core';
-import { startProfiling } from '../telemetry/profiling.js';
-import { checkForUpdate, formatUpdateNag } from '../update-notifier.js';
-import { BootstrapError } from './bootstrap-error.js';
-import { buildPerRunScope } from './build-per-run-scope.js';
-import { loadCliDefaults, mergeConfigDefaults } from './cli-defaults.js';
-import { loadOwningToolCapabilities } from './load-tool-capabilities.js';
-import { maybeInitializeOwningTool, resolveOwningTool } from './owning-tool-init.js';
-import { checkNoProjectAndBailout, checkSchemaVersionAndBailout, warnAboutPhantomRuntimes, } from './pre-action-guards.js';
-/** npm package whose version the update check compares against. */
-const CLI_PACKAGE_NAME = 'opensip-cli';
-const MODULE_TAG = 'cli:bootstrap';
-// Owning-tool resolution + lazy `Tool.initialize()` live in `owning-tool-init.ts`
-// (also imported below for local use). `resolveOwningTool` is re-exported so
-// existing importers (e.g. the lifecycle test) keep their stable
-// `pre-action-hook.js` entry point.
+import { currentScope, generatePrefixedId } from '@opensip-cli/core';
+import { executePostBailoutBootstrap } from './execute-post-bailout-bootstrap.js';
+import { planPreActionBootstrap } from './plan-pre-action-bootstrap.js';
 export { resolveOwningTool } from './owning-tool-init.js';
-/**
- * Mount the bootstrap `preAction` hook on the supplied program.
- *
- * @param program The root Commander program.
- * @param version The CLI version (from `readPackageVersion` at the entry
- *   point). Threaded in rather than re-read here so the `mini` banner shows
- *   the SAME version `--version` reports — and so the kernel-adjacent hook
- *   doesn't resolve cli-ui's or its own package version by mistake.
- * @param runtime The bootstrap result (registries + admitted manifests/
- *   provenance). Captured in the hook closure instead of read from a module
- *   global — the composition root installs the hook AFTER `bootstrapCli`
- *   populates the registries (see {@link PreActionRuntime}).
- */
-// The body (including the preAction hook arrow it registers) sequences the full
-// per-invocation bootstrap: runId, defaults merge, project resolve + bailouts,
-// scope construction/enter, metrics, profiling start, lazy tool init, capability
-// drive. It has many explicit early-exit paths by design (the documented contract
-// for "only side effects after all bailouts"). Cognitive complexity exceeds 15
-// because it is the single source of truth for ordering; splitting would obscure
-// the load-bearing sequence and duplicate the guard/enter wiring. Acceptable for
-// this composition root (see similar disables on other bootstrap entry points).
-/* eslint-disable sonarjs/cognitive-complexity -- single source of truth for scope construction/enter ordering; splitting would obscure the load-bearing sequence (rationale above) */
 export function installPreActionHook(program, version, runtime) {
     program.hook('preAction', async (_thisCommand, actionCommand) => {
         const runId = generatePrefixedId('run');
         const opts = actionCommand.opts();
         const cwd = opts.cwd ?? process.cwd();
         const cwdExplicit = actionCommand.getOptionValueSource('cwd') === 'cli';
-        // Keep the loaded defaults around: `mergeConfigDefaults` only copies the
-        // flag-shaped fields onto opts, but `ui.banner` has no flag — we read it
-        // straight off the config object below to build the UiContext.
-        const cliDefaults = loadCliDefaults(cwd, opts.config);
-        mergeConfigDefaults(opts, cliDefaults);
-        // Single bootstrap-time configuration of the process-wide logger
-        // singleton. Replaces the four prior free mutators (`setSilent`,
-        // `setDebugMode`, `setRunId`, `initLogFile`). `logDir` is wired in
-        // below once the project context is resolved — at that point the
-        // logsDir is known and we apply a second `configureLogger` to fill
-        // it in. The two-call sequence is intentional: silencing stderr
-        // before the project-resolve step is what makes Ink renders clean
-        // even when the project is missing.
-        configureLogger({
-            silent: true,
-            debugMode: Boolean(opts.debug),
-            runId,
-        });
-        // 2. Resolve the project context — pure, no side effects.
-        //    Strict --config: throws ValidationError when explicit path misses.
-        let project;
-        try {
-            project = resolveProjectContext({
-                cwd,
-                cwdExplicit,
-                explicitConfigPath: opts.config,
-            });
-        }
-        catch (error) {
-            // §4.7: a config-resolve failure (e.g. strict --config miss) becomes a typed
-            // BootstrapError the top-level boundary renders — human stderr / structured
-            // --json — instead of an inline stderr write + process.exit.
-            const msg = error instanceof Error ? error.message : String(error);
-            throw new BootstrapError({
-                message: msg,
-                humanMessage: `✗ ${msg}`,
-                suggestion: 'Check opensip-cli.config.yml (or your --config path).',
-                exitCode: 2,
-            });
-        }
-        // 3. Stash the context on opts under the COLLISION-FREE name.
-        //    `opts.project` is reserved for Commander's --project [path] flag
-        //    in uninstall.ts; we never use that name here.
-        opts.projectContext = project;
-        // Stash the resolved "was --cwd typed on the CLI?" signal alongside it,
-        // so the `init` command-spec handler (launch Phase 6) reads ONE
-        // source instead of recomputing `getOptionValueSource('cwd')` on its own
-        // Commander command. `actionCommand` IS the init command here, so this is
-        // byte-identical to the former register-init computation.
-        opts.cwdExplicit = cwdExplicit;
-        // 4. Bailout window — each may THROW a BootstrapError (rendered by the
-        //    top-level boundary) before any side effects. Phantom warn is non-fatal;
-        //    warns then continues.
-        checkSchemaVersionAndBailout(project, runId);
-        // Build the effective set of project-agnostic command names from the base list
-        // PLUS any tool CommandSpecs that declare scope: 'none'. This makes the
-        // declared `CommandSpec.scope` drive enforcement (previously the hardcoded
-        // name list made the field dead for tools and third-party commands).
-        const extraAgnostic = new Set();
-        for (const tool of runtime.tools.list()) {
-            for (const c of tool.commands || []) {
-                if (c.scope === 'none') {
-                    extraAgnostic.add(c.name);
-                    (c.aliases ?? []).forEach((a) => extraAgnostic.add(a));
-                }
-            }
-        }
-        checkNoProjectAndBailout(project, cwd, actionCommand.name(), runId, extraAgnostic);
-        warnAboutPhantomRuntimes(project, opts.json === true);
-        // 5. Side-effect setup, gated on a real project being present.
-        if (project.scope === 'project' && existsSync(project.projectRoot)) {
-            const projectPaths = resolveProjectPaths(project.projectRoot);
-            // Second configureLogger call — fills in the project-scoped logDir
-            // now that the project context is resolved. Leaves silent/debugMode/runId
-            // untouched (configureLogger only writes fields present in the bag).
-            configureLogger({ logDir: projectPaths.logsDir });
-        }
-        // Build the per-run RunScope and enter it via AsyncLocalStorage so
-        // library functions deep in the call tree (currentScope() readers)
-        // see the bound logger/registries/project + a lazy datastore thunk.
-        // enterWith propagates forward through the same async chain, so the
-        // action body invoked after this hook sees the same scope without
-        // needing a callback wrapper — which Commander does not expose.
-        // (Phase 5 deferred Task 5.2 / T1 Item D close-out.)
-        // Resolve presentation + update state once, before the scope is built.
-        // bannerSize: explicit `cli.ui.banner`, else the product default `mini`.
-        // update: the cached newer-version string (best-effort; undefined when
-        // up-to-date / opted-out / non-TTY). The `mini` banner shows it inline;
-        // other sizes — and the banner-less `--json` path — fall back to the
-        // stderr nag so the signal is never silently lost.
-        const bannerSize = cliDefaults.ui?.banner ?? 'mini';
-        const update = checkForUpdate({ name: CLI_PACKAGE_NAME, version });
-        if (update && (bannerSize !== 'mini' || opts.json === true)) {
-            process.stderr.write(formatUpdateNag(version, update));
-        }
-        // ADR-0008: select the cloud signal sink for this run. Sync + cheap —
-        // keyless / `cloud.sync:false` / `--no-cloud` / non-https → no-op with no
-        // IO; the entitlement check is deferred to first emit so non-signal
-        // commands pay nothing. `opts.cloud === false` comes from `--no-cloud`.
-        //
-        // `cloud` layers the user-level opt-out (~/.opensip-cli/config.yml#cloud)
-        // over the project's `cli.cloud:` block (audit P0-2): a user `sync: false`
-        // disables sync for every project on this machine.
-        const { languages, tools, manifests, provenance } = runtime;
-        // Extracted to thin the composition root (GA architectural blocker #2).
-        // All scope construction + wiring now lives in a dedicated small builder
-        // with explicit inputs. The hook remains the high-level sequencer. The
-        // registries + admitted-tool manifests/provenance come from the closure
-        // the composition root captured (no module-global handoff bag); the
-        // builder stamps manifests/provenance onto the scope for host commands.
-        const scope = buildPerRunScope({
-            project,
-            runId,
+        const plan = planPreActionBootstrap({
+            opts: opts,
             cwd,
-            cliDefaults,
-            registries: { languages, tools },
-            manifests,
-            provenance,
-            apiKey: opts.apiKey,
-            // @fitness-ignore-next-line null-safety -- Commander's optsWithGlobals() always returns an OptionValues object (never null/undefined); the heuristic misreads the method-call-then-property access. `.cloud` is an absent-or-boolean flag, compared with `=== false`.
-            noCloud: actionCommand.optsWithGlobals().cloud === false,
-            logger,
-            ui: { version, update },
-        });
-        enterScope(scope);
-        // Phase 3 hygiene: scope entry via ALS (enterScope) is now the single source of truth
-        // for per-run state. No holder mirror or mark dance. All subsequent readers (including
-        // host command bodies) must see a valid currentScope().
-        if (!currentScope()) {
-            throw new SystemError('Scope was not entered before command dispatch', {
-                code: 'SYSTEM.SCOPE.NOT_ENTERED',
-            });
-        }
-        // Lifecycle diagnostics (§5.10): record key construction facts on the per-run bus.
-        // These (plus the per-domain events emitted from loadCapabilityDomain and the
-        // wiring events from buildPerRunScope) ride on every CommandOutcome so --json
-        // consumers see the full uniform lifecycle (tools loaded, subscopes contributed,
-        // capability domains wired + driven, config validated, etc.). This directly
-        // improves observability of the blast-radius bootstrap paths (architecture review).
-        scope.diagnostics.event('load', 'debug', `${tools.list().length} tool(s) loaded`);
-        scope.diagnostics.counter('tools.loaded', tools.list().length);
-        // Phase 2 metrics (low cardinality)
-        getMeter('opensip-cli').createCounter('opensip_cli.commands.started').add(1, {
-            command: actionCommand.name(),
-        });
-        scope.diagnostics.event('validate', 'debug', `project config resolved (scope: ${project.scope})`);
-        // The `ℹ Project:` location line is rendered once, under the banner,
-        // by cli-ui's ProjectHeader — mounted by the App shell (static
-        // commands, via render.ts reading currentScope().project) and by each
-        // live view (fit/graph). No imperative pre-action print.
-        // Structured start log.
-        logger.info({
-            evt: 'cli.run.start',
-            module: MODULE_TAG,
+            cwdExplicit,
             runId,
-            command: actionCommand.name(),
-            cwd,
-            projectRoot: project.projectRoot,
-            scope: project.scope,
+            commandName: actionCommand.name(),
+            explicitConfigPath: opts.config,
+            tools: runtime.tools,
         });
-        if (project.walkedUp > 0) {
-            logger.info({
-                evt: 'cli.project.discovered',
-                module: MODULE_TAG,
-                runId,
-                cwd,
-                projectRoot: project.projectRoot,
-                walkedUp: project.walkedUp,
-            });
-        }
-        // Optional profiling (Phase 3, severable). Start after scope (runId available).
-        // Respects the dual-gate (OPENSIP_PROFILING + OTEL) or OTEL-only fallback.
-        startProfiling(scope, actionCommand.name());
-        // 8. Lazy, memoized Tool.initialize() — runs the owning tool's
-        //    optional one-time init here, AFTER enterScope (so eager setup that
-        //    registers packs / reads currentScope() sees the bound scope) and
-        //    immediately before Commander invokes the action body. See the
-        //    helper for the once-per-process + fail-fast semantics.
-        await maybeInitializeOwningTool(tools, actionCommand.name(), runId);
-        // 9. §5.3/§4.5: drive the generic capability loader for the invoked tool's
-        //    declared domains (e.g. graph-adapter). Lazy per command — only the
-        //    owning tool's domains load, routed through the host's capability
-        //    registry to each owner's registrar. Replaces the host-coupled,
-        //    eager register-graph-adapters.ts.
-        const driven = await loadOwningToolCapabilities({
-            owningTool: resolveOwningTool(tools, actionCommand.name()),
-            projectDir: project.projectRoot,
-            configPath: project.scope === 'project' ? project.configPath : undefined,
+        const { scope } = await executePostBailoutBootstrap({
+            plan,
+            runtime,
+            version,
+            // @fitness-ignore-next-line null-safety -- Commander optsWithGlobals always returns OptionValues; `.cloud` is absent-or-boolean.
+            noCloud: actionCommand.optsWithGlobals().cloud === false,
+            apiKey: opts.apiKey,
         });
-        if (driven > 0) {
-            scope.diagnostics.event('load', 'debug', `drove ${String(driven)} owning-tool capability domain(s) (see per-domain 'capability ... loaded' events for contribution counts + errors)`);
-            scope.diagnostics.counter('capabilities.driven', driven);
-        }
+        scope.diagnostics.event('load', 'debug', `preAction bootstrap completed for '${actionCommand.name()}'`);
     });
-    // Resilience: best-effort release of per-run resources (parseCache, recipe config slot,
-    // contributed sub-scopes, diagnostics bus) after the action body completes for every
-    // command. Complements the narrow dispose() impl and the current lack of finally in
-    // many paths. postAction fires for normal completion; error paths are covered by
-    // handleParseError + handleFatalBootstrapError (which may also dispose in future passes).
-    // Idempotent: dispose is cheap and safe to call more than once.
     program.hook('postAction', disposeCurrentScope);
 }
-/**
- * Extracted seam (Task 3) for postAction disposal + error-path coverage.
- * Narrow, testable, no Commander dep. Called from the hook; can be called
- * explicitly in tests or future finally blocks on thrown handler paths.
- */
 export function disposeCurrentScope() {
     try {
         const s = currentScope();
@@ -291,5 +48,4 @@ export function disposeCurrentScope() {
         // @swallow-ok dispose errors on shutdown; the run has already produced its outcome.
     }
 }
-/* eslint-enable sonarjs/cognitive-complexity */
 //# sourceMappingURL=pre-action-hook.js.map

package/dist/bootstrap/pre-action-hook.js.map

@@ -1 +1 @@
-{"version":3,"file":"pre-action-hook.js","sourceRoot":"","sources":["../../src/bootstrap/pre-action-hook.ts"],"names":[],"mappings":"AAAA,ucAAuc;AACvc;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AAEH,OAAO,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AAErC,OAAO,EACL,eAAe,EACf,YAAY,EACZ,UAAU,EACV,kBAAkB,EAClB,MAAM,EACN,qBAAqB,EACrB,mBAAmB,EACnB,WAAW,GAMZ,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EAAE,QAAQ,EAAE,MAAM,mBAAmB,CAAC;AAE7C,OAAO,EAAE,cAAc,EAAE,MAAM,2BAA2B,CAAC;AAC3D,OAAO,EAAE,cAAc,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAC;AAExE,OAAO,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AACtD,OAAO,EAAE,gBAAgB,EAAE,MAAM,0BAA0B,CAAC;AAC5D,OAAO,EAAE,eAAe,EAAE,mBAAmB,EAAE,MAAM,mBAAmB,CAAC;AACzE,OAAO,EAAE,0BAA0B,EAAE,MAAM,6BAA6B,CAAC;AACzE,OAAO,EAAE,yBAAyB,EAAE,iBAAiB,EAAE,MAAM,uBAAuB,CAAC;AACrF,OAAO,EACL,wBAAwB,EACxB,4BAA4B,EAC5B,wBAAwB,GACzB,MAAM,wBAAwB,CAAC;AAIhC,mEAAmE;AACnE,MAAM,gBAAgB,GAAG,aAAa,CAAC;AAEvC,MAAM,UAAU,GAAG,eAAe,CAAC;AAEnC,kFAAkF;AAClF,6EAA6E;AAC7E,iEAAiE;AACjE,oCAAoC;AACpC,OAAO,EAAE,iBAAiB,EAAE,MAAM,uBAAuB,CAAC;AA2B1D;;;;;;;;;;;;GAYG;AACH,gFAAgF;AAChF,+EAA+E;AAC/E,iFAAiF;AACjF,kFAAkF;AAClF,+EAA+E;AAC/E,iFAAiF;AACjF,iFAAiF;AACjF,gFAAgF;AAChF,sLAAsL;AACtL,MAAM,UAAU,oBAAoB,CAClC,OAAgB,EAChB,OAAe,EACf,OAAyB;IAEzB,OAAO,CAAC,IAAI,CAAC,WAAW,EAAE,KAAK,EAAE,YAAY,EAAE,aAAa,EAAE,EAAE;QAC9D,MAAM,KAAK,GAAG,kBAAkB,CAAC,KAAK,CAAC,CAAC;QAExC,MAAM,IAAI,GAAG,aAAa,CAAC,IAAI,EAAE,CAAC;QAClC,MAAM,GAAG,GAAI,IAAI,CAAC,GAAc,IAAI,OAAO,CAAC,GAAG,EAAE,CAAC;QAClD,MAAM,WAAW,GAAG,aAAa,CAAC,oBAAoB,CAAC,KAAK,CAAC,KAAK,KAAK,CAAC;QAExE,yEAAyE;QACzE,yEAAyE;QACzE,+DAA+D;QAC/D,MAAM,WAAW,GAAG,eAAe,CAAC,GAAG,EAAE,IAAI,CAAC,MAA4B,CAAC,CAAC;QAC5E,mBAAmB,CAAC,IAAI,EAAE,WAAW,CAAC,CAAC;QAEvC,iEAAiE;QACjE,iEAAiE;QACjE,mEAAmE;QACnE,iEAAiE;QACjE,mEAAmE;QACnE,gEAAgE;QAChE,kEAAkE;QAClE,oCAAoC;QACpC,eAAe,CAAC;YACd,MAAM,EAAE,IAAI;YACZ,SAAS,EAAE,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC;YAC9B,KAAK;SACN,CAAC,CAAC;QAEH,0DAA0D;QAC1D,wEAAwE;QACxE,IAAI,OAAuB,CAAC;QAC5B,IAAI,CAAC;YACH,OAAO,GAAG,qBAAqB,CAAC;gBAC9B,GAAG;gBACH,WAAW;gBACX,kBAAkB,EAAE,IAAI,CAAC,MAA4B;aACtD,CAAC,CAAC;QACL,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,6EAA6E;YAC7E,4EAA4E;YAC5E,6DAA6D;YAC7D,MAAM,GAAG,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;YACnE,MAAM,IAAI,cAAc,CAAC;gBACvB,OAAO,EAAE,GAAG;gBACZ,YAAY,EAAE,KAAK,GAAG,EAAE;gBACxB,UAAU,EAAE,uDAAuD;gBACnE,QAAQ,EAAE,CAAC;aACZ,CAAC,CAAC;QACL,CAAC;QAED,8DAA8D;QAC9D,sEAAsE;QACtE,mDAAmD;QAClD,IAAgC,CAAC,cAAc,GAAG,OAAO,CAAC;QAC3D,wEAAwE;QACxE,gEAAgE;QAChE,yEAAyE;QACzE,0EAA0E;QAC1E,0DAA0D;QACzD,IAAgC,CAAC,WAAW,GAAG,WAAW,CAAC;QAE5D,uEAAuE;QACvE,6EAA6E;QAC7E,2BAA2B;QAC3B,4BAA4B,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;QAE7C,+EAA+E;QAC/E,wEAAwE;QACxE,2EAA2E;QAC3E,qEAAqE;QACrE,MAAM,aAAa,GAAG,IAAI,GAAG,EAAU,CAAC;QACxC,KAAK,MAAM,IAAI,IAAI,OAAO,CAAC,KAAK,CAAC,IAAI,EAAE,EAAE,CAAC;YACxC,KAAK,MAAM,CAAC,IAAI,IAAI,CAAC,QAAQ,IAAI,EAAE,EAAE,CAAC;gBACpC,IAAI,CAAC,CAAC,KAAK,KAAK,MAAM,EAAE,CAAC;oBACvB,aAAa,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;oBAC1B,CAAC,CAAC,CAAC,OAAO,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,CAAS,EAAE,EAAE,CAAC,aAAa,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;gBACjE,CAAC;YACH,CAAC;QACH,CAAC;QACD,wBAAwB,CAAC,OAAO,EAAE,GAAG,EAAE,aAAa,CAAC,IAAI,EAAE,EAAE,KAAK,EAAE,aAAa,CAAC,CAAC;QACnF,wBAAwB,CAAC,OAAO,EAAE,IAAI,CAAC,IAAI,KAAK,IAAI,CAAC,CAAC;QAEtD,+DAA+D;QAC/D,IAAI,OAAO,CAAC,KAAK,KAAK,SAAS,IAAI,UAAU,CAAC,OAAO,CAAC,WAAW,CAAC,EAAE,CAAC;YACnE,MAAM,YAAY,GAAG,mBAAmB,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC;YAC9D,mEAAmE;YACnE,0EAA0E;YAC1E,qEAAqE;YACrE,eAAe,CAAC,EAAE,MAAM,EAAE,YAAY,CAAC,OAAO,EAAE,CAAC,CAAC;QACpD,CAAC;QAED,mEAAmE;QACnE,mEAAmE;QACnE,oEAAoE;QACpE,oEAAoE;QACpE,kEAAkE;QAClE,gEAAgE;QAChE,qDAAqD;QACrD,uEAAuE;QACvE,yEAAyE;QACzE,uEAAuE;QACvE,wEAAwE;QACxE,qEAAqE;QACrE,mDAAmD;QACnD,MAAM,UAAU,GAAG,WAAW,CAAC,EAAE,EAAE,MAAM,IAAI,MAAM,CAAC;QACpD,MAAM,MAAM,GAAG,cAAc,CAAC,EAAE,IAAI,EAAE,gBAAgB,EAAE,OAAO,EAAE,CAAC,CAAC;QACnE,IAAI,MAAM,IAAI,CAAC,UAAU,KAAK,MAAM,IAAI,IAAI,CAAC,IAAI,KAAK,IAAI,CAAC,EAAE,CAAC;YAC5D,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,eAAe,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC,CAAC;QACzD,CAAC;QAED,sEAAsE;QACtE,0EAA0E;QAC1E,oEAAoE;QACpE,wEAAwE;QACxE,EAAE;QACF,0EAA0E;QAC1E,2EAA2E;QAC3E,mDAAmD;QACnD,MAAM,EAAE,SAAS,EAAE,KAAK,EAAE,SAAS,EAAE,UAAU,EAAE,GAAG,OAAO,CAAC;QAE5D,wEAAwE;QACxE,yEAAyE;QACzE,uEAAuE;QACvE,wEAAwE;QACxE,oEAAoE;QACpE,wEAAwE;QACxE,MAAM,KAAK,GAAG,gBAAgB,CAAC;YAC7B,OAAO;YACP,KAAK;YACL,GAAG;YACH,WAAW;YACX,UAAU,EAAE,EAAE,SAAS,EAAE,KAAK,EAAE;YAChC,SAAS;YACT,UAAU;YACV,MAAM,EAAE,IAAI,CAAC,MAA4B;YACzC,sQAAsQ;YACtQ,OAAO,EAAE,aAAa,CAAC,eAAe,EAAE,CAAC,KAAK,KAAK,KAAK;YACxD,MAAM;YACN,EAAE,EAAE,EAAE,OAAO,EAAE,MAAM,EAAE;SACxB,CAAC,CAAC;QAEH,UAAU,CAAC,KAAK,CAAC,CAAC;QAElB,sFAAsF;QACtF,uFAAuF;QACvF,wDAAwD;QACxD,IAAI,CAAC,YAAY,EAAE,EAAE,CAAC;YACpB,MAAM,IAAI,WAAW,CAAC,+CAA+C,EAAE;gBACrE,IAAI,EAAE,0BAA0B;aACjC,CAAC,CAAC;QACL,CAAC;QAED,mFAAmF;QACnF,8EAA8E;QAC9E,8EAA8E;QAC9E,iFAAiF;QACjF,4EAA4E;QAC5E,oFAAoF;QACpF,KAAK,CAAC,WAAW,CAAC,KAAK,CAAC,MAAM,EAAE,OAAO,EAAE,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC,MAAM,iBAAiB,CAAC,CAAC;QAClF,KAAK,CAAC,WAAW,CAAC,OAAO,CAAC,cAAc,EAAE,KAAK,CAAC,IAAI,EAAE,CAAC,MAAM,CAAC,CAAC;QAE/D,oCAAoC;QACpC,QAAQ,CAAC,aAAa,CAAC,CAAC,aAAa,CAAC,8BAA8B,CAAC,CAAC,GAAG,CAAC,CAAC,EAAE;YAC3E,OAAO,EAAE,aAAa,CAAC,IAAI,EAAE;SAC9B,CAAC,CAAC;QACH,KAAK,CAAC,WAAW,CAAC,KAAK,CACrB,UAAU,EACV,OAAO,EACP,mCAAmC,OAAO,CAAC,KAAK,GAAG,CACpD,CAAC;QAEF,qEAAqE;QACrE,+DAA+D;QAC/D,sEAAsE;QACtE,yDAAyD;QAEzD,wBAAwB;QACxB,MAAM,CAAC,IAAI,CAAC;YACV,GAAG,EAAE,eAAe;YACpB,MAAM,EAAE,UAAU;YAClB,KAAK;YACL,OAAO,EAAE,aAAa,CAAC,IAAI,EAAE;YAC7B,GAAG;YACH,WAAW,EAAE,OAAO,CAAC,WAAW;YAChC,KAAK,EAAE,OAAO,CAAC,KAAK;SACrB,CAAC,CAAC;QAEH,IAAI,OAAO,CAAC,QAAQ,GAAG,CAAC,EAAE,CAAC;YACzB,MAAM,CAAC,IAAI,CAAC;gBACV,GAAG,EAAE,wBAAwB;gBAC7B,MAAM,EAAE,UAAU;gBAClB,KAAK;gBACL,GAAG;gBACH,WAAW,EAAE,OAAO,CAAC,WAAW;gBAChC,QAAQ,EAAE,OAAO,CAAC,QAAQ;aAC3B,CAAC,CAAC;QACL,CAAC;QAED,gFAAgF;QAChF,2EAA2E;QAC3E,cAAc,CAAC,KAAK,EAAE,aAAa,CAAC,IAAI,EAAE,CAAC,CAAC;QAE5C,+DAA+D;QAC/D,wEAAwE;QACxE,sEAAsE;QACtE,mEAAmE;QACnE,4DAA4D;QAC5D,MAAM,yBAAyB,CAAC,KAAK,EAAE,aAAa,CAAC,IAAI,EAAE,EAAE,KAAK,CAAC,CAAC;QAEpE,2EAA2E;QAC3E,wEAAwE;QACxE,sEAAsE;QACtE,oEAAoE;QACpE,uCAAuC;QACvC,MAAM,MAAM,GAAG,MAAM,0BAA0B,CAAC;YAC9C,UAAU,EAAE,iBAAiB,CAAC,KAAK,EAAE,aAAa,CAAC,IAAI,EAAE,CAAC;YAC1D,UAAU,EAAE,OAAO,CAAC,WAAW;YAC/B,UAAU,EAAE,OAAO,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC,CAAC,SAAS;SACzE,CAAC,CAAC;QACH,IAAI,MAAM,GAAG,CAAC,EAAE,CAAC;YACf,KAAK,CAAC,WAAW,CAAC,KAAK,CACrB,MAAM,EACN,OAAO,EACP,SAAS,MAAM,CAAC,MAAM,CAAC,oHAAoH,CAC5I,CAAC;YACF,KAAK,CAAC,WAAW,CAAC,OAAO,CAAC,qBAAqB,EAAE,MAAM,CAAC,CAAC;QAC3D,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,wFAAwF;IACxF,qFAAqF;IACrF,oFAAoF;IACpF,iFAAiF;IACjF,0FAA0F;IAC1F,gEAAgE;IAChE,OAAO,CAAC,IAAI,CAAC,YAAY,EAAE,mBAAmB,CAAC,CAAC;AAClD,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,mBAAmB;IACjC,IAAI,CAAC;QACH,MAAM,CAAC,GAAG,YAAY,EAAE,CAAC;QACzB,IAAI,CAAC,IAAI,OAAO,CAAC,CAAC,OAAO,KAAK,UAAU,EAAE,CAAC;YACzC,CAAC,CAAC,OAAO,EAAE,CAAC;QACd,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACP,oFAAoF;IACtF,CAAC;AACH,CAAC;AAED,gDAAgD"}
+{"version":3,"file":"pre-action-hook.js","sourceRoot":"","sources":["../../src/bootstrap/pre-action-hook.ts"],"names":[],"mappings":"AAAA,qOAAqO;AACrO;;;;;;GAMG;AAEH,OAAO,EAAE,YAAY,EAAE,kBAAkB,EAAE,MAAM,mBAAmB,CAAC;AAErE,OAAO,EAAE,2BAA2B,EAAE,MAAM,qCAAqC,CAAC;AAClF,OAAO,EAAE,sBAAsB,EAAE,MAAM,gCAAgC,CAAC;AAKxE,OAAO,EAAE,iBAAiB,EAAE,MAAM,uBAAuB,CAAC;AAG1D,MAAM,UAAU,oBAAoB,CAClC,OAAgB,EAChB,OAAe,EACf,OAAyB;IAEzB,OAAO,CAAC,IAAI,CAAC,WAAW,EAAE,KAAK,EAAE,YAAY,EAAE,aAAa,EAAE,EAAE;QAC9D,MAAM,KAAK,GAAG,kBAAkB,CAAC,KAAK,CAAC,CAAC;QACxC,MAAM,IAAI,GAAG,aAAa,CAAC,IAAI,EAAE,CAAC;QAClC,MAAM,GAAG,GAAI,IAAI,CAAC,GAAc,IAAI,OAAO,CAAC,GAAG,EAAE,CAAC;QAClD,MAAM,WAAW,GAAG,aAAa,CAAC,oBAAoB,CAAC,KAAK,CAAC,KAAK,KAAK,CAAC;QAExE,MAAM,IAAI,GAAG,sBAAsB,CAAC;YAClC,IAAI,EAAE,IAAI;YACV,GAAG;YACH,WAAW;YACX,KAAK;YACL,WAAW,EAAE,aAAa,CAAC,IAAI,EAAE;YACjC,kBAAkB,EAAE,IAAI,CAAC,MAA4B;YACrD,KAAK,EAAE,OAAO,CAAC,KAAK;SACrB,CAAC,CAAC;QAEH,MAAM,EAAE,KAAK,EAAE,GAAG,MAAM,2BAA2B,CAAC;YAClD,IAAI;YACJ,OAAO;YACP,OAAO;YACP,iIAAiI;YACjI,OAAO,EAAE,aAAa,CAAC,eAAe,EAAE,CAAC,KAAK,KAAK,KAAK;YACxD,MAAM,EAAE,IAAI,CAAC,MAA4B;SAC1C,CAAC,CAAC;QACH,KAAK,CAAC,WAAW,CAAC,KAAK,CACrB,MAAM,EACN,OAAO,EACP,sCAAsC,aAAa,CAAC,IAAI,EAAE,GAAG,CAC9D,CAAC;IACJ,CAAC,CAAC,CAAC;IAEH,OAAO,CAAC,IAAI,CAAC,YAAY,EAAE,mBAAmB,CAAC,CAAC;AAClD,CAAC;AAED,MAAM,UAAU,mBAAmB;IACjC,IAAI,CAAC;QACH,MAAM,CAAC,GAAG,YAAY,EAAE,CAAC;QACzB,IAAI,CAAC,IAAI,OAAO,CAAC,CAAC,OAAO,KAAK,UAAU,EAAE,CAAC;YACzC,CAAC,CAAC,OAAO,EAAE,CAAC;QACd,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACP,oFAAoF;IACtF,CAAC;AACH,CAAC"}

package/dist/bootstrap/pre-action-runtime.d.ts

@@ -0,0 +1,9 @@
+import type { LanguageRegistry, ToolPluginManifest, ToolProvenance, ToolRegistry } from '@opensip-cli/core';
+/** Per-invocation bootstrap inputs captured in the pre-action hook closure. */
+export interface PreActionRuntime {
+    readonly languages: LanguageRegistry;
+    readonly tools: ToolRegistry;
+    readonly manifests: readonly ToolPluginManifest[];
+    readonly provenance: readonly ToolProvenance[];
+}
+//# sourceMappingURL=pre-action-runtime.d.ts.map

package/dist/bootstrap/pre-action-runtime.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"pre-action-runtime.d.ts","sourceRoot":"","sources":["../../src/bootstrap/pre-action-runtime.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EACV,gBAAgB,EAChB,kBAAkB,EAClB,cAAc,EACd,YAAY,EACb,MAAM,mBAAmB,CAAC;AAE3B,+EAA+E;AAC/E,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,CAAC,SAAS,EAAE,gBAAgB,CAAC;IACrC,QAAQ,CAAC,KAAK,EAAE,YAAY,CAAC;IAC7B,QAAQ,CAAC,SAAS,EAAE,SAAS,kBAAkB,EAAE,CAAC;IAClD,QAAQ,CAAC,UAAU,EAAE,SAAS,cAAc,EAAE,CAAC;CAChD"}

package/dist/bootstrap/pre-action-runtime.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=pre-action-runtime.js.map

package/dist/bootstrap/pre-action-runtime.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"pre-action-runtime.js","sourceRoot":"","sources":["../../src/bootstrap/pre-action-runtime.ts"],"names":[],"mappings":""}

package/dist/bootstrap/register-tools-bundled.d.ts

@@ -0,0 +1,28 @@
+import { type ToolPluginManifest, type ToolProvenance, type ToolRegistry } from '@opensip-cli/core';
+/**
+ * Register the bundled first-party tools into the supplied registry, each one
+ * flowing through the SAME admit → dynamic-import → register path the external
+ * path uses (launch cutover — replaces the static-import + gate path).
+ *
+ * Per package name: `resolveBundledPackageDir` → `loadToolManifest('bundled')`
+ * → `admitTool({ source: 'bundled', explicitlyRequested: true })` →
+ * `importToolRuntime` (dynamic import + shape validation) → drift guard →
+ * `registry.register`. A bundled tool ships with the CLI, so it is always
+ * explicitly present: a missing/incompatible manifest or a runtime that fails
+ * to load is FAIL-CLOSED (never a silent skip). The recorded `ToolProvenance`
+ * (source `'bundled'`, trusted-by-shipping) and manifest are pushed onto the
+ * optional collectors so the composition root can surface provenance
+ * (`plugin list`) and seed the per-run capability registry (§5.3).
+ *
+ * @param registry The per-invocation tool registry to populate.
+ * @param provenance Optional sink for the admitted tools' provenance records.
+ * @param manifests Optional sink for the admitted tools' manifests (§5.3).
+ * @param packages The bundled package names to load (defaults to
+ *   {@link BUNDLED_TOOL_PACKAGES}; injectable so the fail-closed paths are
+ *   testable with fixture packages).
+ * @throws {PluginIncompatibleError} when a bundled tool cannot be resolved,
+ *   has no conformant manifest, is out of range, or its runtime fails to load
+ *   — mapped to `EXIT_CODES.PLUGIN_INCOMPATIBLE` (exit 5) by the CLI boundary.
+ */
+export declare function registerFirstPartyTools(registry: ToolRegistry, provenance?: ToolProvenance[], manifests?: ToolPluginManifest[], packages?: readonly string[]): Promise<void>;
+//# sourceMappingURL=register-tools-bundled.d.ts.map

package/dist/bootstrap/register-tools-bundled.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"register-tools-bundled.d.ts","sourceRoot":"","sources":["../../src/bootstrap/register-tools-bundled.ts"],"names":[],"mappings":"AAAA,OAAO,EAEL,KAAK,kBAAkB,EACvB,KAAK,cAAc,EACnB,KAAK,YAAY,EAClB,MAAM,mBAAmB,CAAC;AAc3B;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,wBAAsB,uBAAuB,CAC3C,QAAQ,EAAE,YAAY,EACtB,UAAU,GAAE,cAAc,EAAO,EACjC,SAAS,GAAE,kBAAkB,EAAO,EACpC,QAAQ,GAAE,SAAS,MAAM,EAA0B,GAClD,OAAO,CAAC,IAAI,CAAC,CAwCf"}

package/dist/bootstrap/register-tools-bundled.js

@@ -0,0 +1,107 @@
+import { PluginIncompatibleError, } from '@opensip-cli/core';
+import { admitToolPackage } from './admit-tool-package.js';
+import { BUNDLED_TOOL_PACKAGES, resolveRequiredBundledPackageDir, } from './register-tools-shared.js';
+// The runtime-load primitive (`importToolRuntime` + `ToolRuntimeLoad`) and the
+// full admission SEQUENCE (`admitToolPackage`) live in `admit-tool-package.ts`
+// (ADR-0041: one validator, four consumers). This file keeps the per-source
+// POLICY: bundled fails closed below; the installed/authored legs skip with
+// diagnostics.
+/**
+ * Register the bundled first-party tools into the supplied registry, each one
+ * flowing through the SAME admit → dynamic-import → register path the external
+ * path uses (launch cutover — replaces the static-import + gate path).
+ *
+ * Per package name: `resolveBundledPackageDir` → `loadToolManifest('bundled')`
+ * → `admitTool({ source: 'bundled', explicitlyRequested: true })` →
+ * `importToolRuntime` (dynamic import + shape validation) → drift guard →
+ * `registry.register`. A bundled tool ships with the CLI, so it is always
+ * explicitly present: a missing/incompatible manifest or a runtime that fails
+ * to load is FAIL-CLOSED (never a silent skip). The recorded `ToolProvenance`
+ * (source `'bundled'`, trusted-by-shipping) and manifest are pushed onto the
+ * optional collectors so the composition root can surface provenance
+ * (`plugin list`) and seed the per-run capability registry (§5.3).
+ *
+ * @param registry The per-invocation tool registry to populate.
+ * @param provenance Optional sink for the admitted tools' provenance records.
+ * @param manifests Optional sink for the admitted tools' manifests (§5.3).
+ * @param packages The bundled package names to load (defaults to
+ *   {@link BUNDLED_TOOL_PACKAGES}; injectable so the fail-closed paths are
+ *   testable with fixture packages).
+ * @throws {PluginIncompatibleError} when a bundled tool cannot be resolved,
+ *   has no conformant manifest, is out of range, or its runtime fails to load
+ *   — mapped to `EXIT_CODES.PLUGIN_INCOMPATIBLE` (exit 5) by the CLI boundary.
+ */
+export async function registerFirstPartyTools(registry, provenance = [], manifests = [], packages = BUNDLED_TOOL_PACKAGES) {
+    for (const packageName of packages) {
+        const dir = resolveRequiredBundledPackageDir(packageName);
+        // The shared admission SEQUENCE (ADR-0041). The bundled POLICY below maps
+        // each failed section to the exact fail-closed error this path always
+        // threw — a bundled tool ships with the CLI, so every failure is a
+        // packaging fault, never a silent skip.
+        const report = await admitToolPackage({
+            dir,
+            source: 'bundled',
+            packageName,
+            // A bundled tool ships with the CLI; it is always explicitly present,
+            // so an incompatible manifest fails the run rather than skipping.
+            explicitlyRequested: true,
+        });
+        if (!report.ok) {
+            // @fitness-ignore-next-line detached-promises -- synchronous never-returning thrower; the heuristic mistakes the bare call for an unawaited promise
+            throwBundledAdmissionFailure(packageName, report);
+        }
+        /* v8 ignore next 3 -- throwBundledAdmissionFailure never returns on a failed report; this guard narrows types */
+        if (report.tool === undefined ||
+            report.provenance === undefined ||
+            report.manifest === undefined) {
+            throw new PluginIncompatibleError(`bundled tool '${packageName}' produced an incomplete admission report`, { diagnostic: 'incomplete admission report' });
+        }
+        registry.register(report.tool);
+        provenance.push(report.provenance);
+        // Record the manifest so the pre-action-hook can register this tool's
+        // declared capability domains into the per-run capability registry
+        // (launch, §5.3).
+        manifests.push(report.manifest);
+    }
+}
+/**
+ * The bundled FAIL-CLOSED policy: convert a failed {@link AdmissionReport}
+ * into the same `PluginIncompatibleError` (message + diagnostic) the inline
+ * pipeline threw before the ADR-0041 factoring. Never returns.
+ *
+ * @throws {PluginIncompatibleError} always (or rethrows the original
+ *   coherence error from `assertManifestMatchesTool`, preserving its type).
+ */
+function throwBundledAdmissionFailure(packageName, report) {
+    const failed = report.sections.find((s) => !s.ok);
+    const failedSection = failed?.section;
+    if (failedSection === 'manifest') {
+        throw new PluginIncompatibleError(`bundled tool '${packageName}' has no conformant package.json#opensipTools manifest`, { diagnostic: 'manifest missing or malformed' });
+    }
+    const id = report.manifest?.id ?? packageName;
+    if (failedSection === 'compatibility') {
+        if (report.compatibilityDecision === 'fail-closed') {
+            throw new PluginIncompatibleError(`bundled tool '${id}' is incompatible: ${failed?.diagnostic ?? 'compatibility gate rejected it'}`, { diagnostic: failed?.diagnostic });
+        }
+        if (report.compatibilityDecision === 'skip') {
+            // Should not happen for an in-range bundled tool, but never silently
+            // drop a bundled tool — surface it loudly.
+            throw new PluginIncompatibleError(`bundled tool '${id}' was skipped by the compatibility gate: ${failed?.diagnostic ?? 'unknown reason'}`, { diagnostic: failed?.diagnostic });
+        }
+        throw new PluginIncompatibleError(`bundled tool '${id}' reached an unknown admission decision`, { diagnostic: 'unknown admission decision' });
+    }
+    if (failedSection === 'runtime-load' || failedSection === 'tool-shape') {
+        const reason = report.runtimeLoadReason ?? 'import-failed';
+        const detailSuffix = report.runtimeLoadDetail ? `: ${report.runtimeLoadDetail}` : '';
+        throw new PluginIncompatibleError(`bundled tool '${id}' failed to load via the plugin path (${reason}${detailSuffix})`, { diagnostic: `bundled tool runtime load failed: ${reason}` });
+    }
+    if (failedSection === 'manifest-runtime-coherence' && report.coherenceError instanceof Error) {
+        // Preserve the original drift-guard error type + message untouched.
+        // (assertManifestMatchesTool always throws Error subclasses; the
+        // instanceof narrowing satisfies only-throw-error without a cast.)
+        throw report.coherenceError;
+    }
+    /* v8 ignore next 4 -- defensive: a failed report always carries a failed section */
+    throw new PluginIncompatibleError(`bundled tool '${packageName}' failed admission for an unknown reason`, { diagnostic: 'unknown admission failure' });
+}
+//# sourceMappingURL=register-tools-bundled.js.map

package/dist/bootstrap/register-tools-bundled.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"register-tools-bundled.js","sourceRoot":"","sources":["../../src/bootstrap/register-tools-bundled.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,uBAAuB,GAIxB,MAAM,mBAAmB,CAAC;AAE3B,OAAO,EAAE,gBAAgB,EAAwB,MAAM,yBAAyB,CAAC;AACjF,OAAO,EACL,qBAAqB,EACrB,gCAAgC,GACjC,MAAM,4BAA4B,CAAC;AAEpC,+EAA+E;AAC/E,+EAA+E;AAC/E,4EAA4E;AAC5E,4EAA4E;AAC5E,eAAe;AAEf;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,MAAM,CAAC,KAAK,UAAU,uBAAuB,CAC3C,QAAsB,EACtB,aAA+B,EAAE,EACjC,YAAkC,EAAE,EACpC,WAA8B,qBAAqB;IAEnD,KAAK,MAAM,WAAW,IAAI,QAAQ,EAAE,CAAC;QACnC,MAAM,GAAG,GAAG,gCAAgC,CAAC,WAAW,CAAC,CAAC;QAE1D,0EAA0E;QAC1E,sEAAsE;QACtE,mEAAmE;QACnE,wCAAwC;QACxC,MAAM,MAAM,GAAG,MAAM,gBAAgB,CAAC;YACpC,GAAG;YACH,MAAM,EAAE,SAAS;YACjB,WAAW;YACX,sEAAsE;YACtE,kEAAkE;YAClE,mBAAmB,EAAE,IAAI;SAC1B,CAAC,CAAC;QAEH,IAAI,CAAC,MAAM,CAAC,EAAE,EAAE,CAAC;YACf,oJAAoJ;YACpJ,4BAA4B,CAAC,WAAW,EAAE,MAAM,CAAC,CAAC;QACpD,CAAC;QACD,iHAAiH;QACjH,IACE,MAAM,CAAC,IAAI,KAAK,SAAS;YACzB,MAAM,CAAC,UAAU,KAAK,SAAS;YAC/B,MAAM,CAAC,QAAQ,KAAK,SAAS,EAC7B,CAAC;YACD,MAAM,IAAI,uBAAuB,CAC/B,iBAAiB,WAAW,2CAA2C,EACvE,EAAE,UAAU,EAAE,6BAA6B,EAAE,CAC9C,CAAC;QACJ,CAAC;QAED,QAAQ,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;QAC/B,UAAU,CAAC,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC;QACnC,sEAAsE;QACtE,mEAAmE;QACnE,kBAAkB;QAClB,SAAS,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;IAClC,CAAC;AACH,CAAC;AAED;;;;;;;GAOG;AACH,SAAS,4BAA4B,CAAC,WAAmB,EAAE,MAAuB;IAChF,MAAM,MAAM,GAAG,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;IAClD,MAAM,aAAa,GAAG,MAAM,EAAE,OAAO,CAAC;IAEtC,IAAI,aAAa,KAAK,UAAU,EAAE,CAAC;QACjC,MAAM,IAAI,uBAAuB,CAC/B,iBAAiB,WAAW,wDAAwD,EACpF,EAAE,UAAU,EAAE,+BAA+B,EAAE,CAChD,CAAC;IACJ,CAAC;IACD,MAAM,EAAE,GAAG,MAAM,CAAC,QAAQ,EAAE,EAAE,IAAI,WAAW,CAAC;IAC9C,IAAI,aAAa,KAAK,eAAe,EAAE,CAAC;QACtC,IAAI,MAAM,CAAC,qBAAqB,KAAK,aAAa,EAAE,CAAC;YACnD,MAAM,IAAI,uBAAuB,CAC/B,iBAAiB,EAAE,sBAAsB,MAAM,EAAE,UAAU,IAAI,gCAAgC,EAAE,EACjG,EAAE,UAAU,EAAE,MAAM,EAAE,UAAU,EAAE,CACnC,CAAC;QACJ,CAAC;QACD,IAAI,MAAM,CAAC,qBAAqB,KAAK,MAAM,EAAE,CAAC;YAC5C,qEAAqE;YACrE,2CAA2C;YAC3C,MAAM,IAAI,uBAAuB,CAC/B,iBAAiB,EAAE,4CAA4C,MAAM,EAAE,UAAU,IAAI,gBAAgB,EAAE,EACvG,EAAE,UAAU,EAAE,MAAM,EAAE,UAAU,EAAE,CACnC,CAAC;QACJ,CAAC;QACD,MAAM,IAAI,uBAAuB,CAC/B,iBAAiB,EAAE,yCAAyC,EAC5D,EAAE,UAAU,EAAE,4BAA4B,EAAE,CAC7C,CAAC;IACJ,CAAC;IACD,IAAI,aAAa,KAAK,cAAc,IAAI,aAAa,KAAK,YAAY,EAAE,CAAC;QACvE,MAAM,MAAM,GAAG,MAAM,CAAC,iBAAiB,IAAI,eAAe,CAAC;QAC3D,MAAM,YAAY,GAAG,MAAM,CAAC,iBAAiB,CAAC,CAAC,CAAC,KAAK,MAAM,CAAC,iBAAiB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACrF,MAAM,IAAI,uBAAuB,CAC/B,iBAAiB,EAAE,yCAAyC,MAAM,GAAG,YAAY,GAAG,EACpF,EAAE,UAAU,EAAE,qCAAqC,MAAM,EAAE,EAAE,CAC9D,CAAC;IACJ,CAAC;IACD,IAAI,aAAa,KAAK,4BAA4B,IAAI,MAAM,CAAC,cAAc,YAAY,KAAK,EAAE,CAAC;QAC7F,oEAAoE;QACpE,iEAAiE;QACjE,mEAAmE;QACnE,MAAM,MAAM,CAAC,cAAc,CAAC;IAC9B,CAAC;IACD,oFAAoF;IACpF,MAAM,IAAI,uBAAuB,CAC/B,iBAAiB,WAAW,0CAA0C,EACtE,EAAE,UAAU,EAAE,2BAA2B,EAAE,CAC5C,CAAC;AACJ,CAAC"}