statelyai 0.14.3 → 0.15.1

package/dist/{cli-D8zy3z4n.mjs → cli-CE7KhcOJ.mjs}

@@ -1,20 +1,21 @@
-import { Args, Command, Flags, flush, handle, run } from "@oclif/core";
-import fsPromises from "node:fs/promises";
+import fsPromises, { mkdir, readFile, realpath, stat, writeFile } from "node:fs/promises";
 import * as path$1 from "node:path";
-import path from "node:path";
-import { changeSet, createFileStore, createLoop, parseModelGraph, proposalOutline, verdictLines, verify } from "@statelyai/mcp/loop";
-import { z, z as z$1 } from "zod";
+import path, { dirname, resolve } from "node:path";
+import * as crypto from "node:crypto";
+import { createHash, randomUUID } from "node:crypto";
 import { execFile, execFileSync, spawn } from "node:child_process";
 import { promisify } from "node:util";
-import * as crypto from "node:crypto";
-import { randomUUID } from "node:crypto";
+import { fileURLToPath, pathToFileURL } from "node:url";
+import { z, z as z$1 } from "zod";
+import { Args, Command, Flags, flush, handle, run } from "@oclif/core";
+import { changeSet, createFileStore, createLoop, editorGraphRevision, graphPathGenerationId, graphPathNextCursor, graphPathsPageSchema, parseModelGraph, proposalOutline, stableJson, verdictLines, verify } from "@statelyai/mcp/loop";
+import { campaignExitCode, modelTestReplaySchema, reportReplays, runCampaignFile } from "@statelyai/model-testing";
 import { StudioApiError, buildAuthorizeUrl, createPkcePair, createStatelyClient, discoverAuthorizationServer, discoverProtectedResource, exchangeCodeForToken, refreshToken, registerOAuthClient } from "@statelyai/sdk";
 import * as ts$1 from "typescript";
 import ts from "typescript";
 import fs, { promises, statSync, watch } from "node:fs";
 import { createInterface } from "node:readline/promises";
 import { Writable } from "node:stream";
-import { fileURLToPath, pathToFileURL } from "node:url";
 import * as http from "node:http";
 import * as fs$1 from "fs";
 import * as path$2 from "path";
@@ -28,6 +29,1327 @@ import os from "node:os";
 //#region \0rolldown/runtime.js
 var __commonJSMin$1 = (cb, mod) => () => (mod || cb((mod = { exports: {} }).exports, mod), mod.exports);
 
+//#endregion
+//#region src/version.ts
+const CLI_VERSION = "0.15.1";
+
+//#endregion
+//#region src/behaviorCi.ts
+const exec = promisify(execFile);
+const digest = z.string().regex(/^[a-f0-9]{64}$/);
+const relative = z.string().min(1).max(1e3).refine((s) => !path.isAbsolute(s) && !s.includes("\\") && s.split("/").every((p) => p !== ".." && p !== ""), "Expected repository-relative path");
+const reference = z.strictObject({
+	machineId: z.string().regex(/^[a-z0-9][a-z0-9-]{0,79}$/),
+	versionId: z.string().regex(/^v\d{4,9}$/),
+	sha256: digest
+});
+const id = z.string().regex(/^[A-Za-z0-9][A-Za-z0-9_.:-]{0,99}$/);
+const text = z.string().trim().min(1).max(4e3);
+const configFields = {
+	name: text,
+	spec: relative,
+	model: relative,
+	adapter: relative,
+	stateRoot: relative,
+	baseline: reference.nullable(),
+	command: z.strictObject({
+		executable: z.string().min(1),
+		args: z.array(z.string()).max(100),
+		cwd: relative
+	}),
+	inputs: z.array(relative).min(1).max(100),
+	checks: z.array(z.strictObject({
+		id,
+		file: relative,
+		fullName: text
+	})).min(1).max(500),
+	timeoutMs: z.number().int().min(100).max(6e5)
+};
+const behaviorCiConfigSchema = z.discriminatedUnion("schemaVersion", [z.strictObject({
+	schemaVersion: z.literal(1),
+	...configFields
+}), z.strictObject({
+	schemaVersion: z.literal(2),
+	...configFields,
+	assurance: z.strictObject({
+		plan: relative,
+		calibration: relative
+	})
+})]);
+const specSchema = z.strictObject({
+	requirements: z.array(z.strictObject({
+		id,
+		text,
+		source: z.strictObject({
+			authority: z.enum([
+				"cited-requirement",
+				"observation",
+				"inference",
+				"assumption"
+			]),
+			citation: text
+		}),
+		entityIds: z.array(text).max(100).default([]),
+		checks: z.array(z.strictObject({
+			id,
+			acceptance: text
+		})).max(100)
+	})).max(100),
+	retire: z.array(z.strictObject({
+		kind: z.enum(["requirement", "check"]),
+		id,
+		reason: text
+	})).max(500).default([])
+});
+const behaviorCiResultsSchema = z.array(z.strictObject({
+	file: relative,
+	fullName: text,
+	outcome: z.enum([
+		"passed",
+		"failed",
+		"skipped",
+		"error"
+	]),
+	detail: text
+})).max(1e4);
+const fileHash = z.strictObject({
+	path: relative,
+	sha256: digest
+});
+const manifestSchema = z.strictObject({
+	revision: z.string().regex(/^[a-f0-9]{40,64}$/),
+	dirty: z.boolean(),
+	files: z.array(fileHash).min(1).max(200),
+	runner: z.strictObject({
+		executable: z.string(),
+		version: z.string(),
+		node: z.string(),
+		cli: z.strictObject({
+			version: z.string(),
+			moduleSha256: digest
+		}),
+		platform: z.string(),
+		arch: z.string()
+	}),
+	declaredGithub: z.strictObject({
+		runId: z.string().nullable(),
+		attempt: z.string().nullable(),
+		repository: z.string().nullable(),
+		sha: z.string().nullable()
+	})
+});
+const processSchema = z.strictObject({
+	executable: z.string(),
+	args: z.array(z.string()),
+	cwd: z.string(),
+	exitCode: z.number().nullable(),
+	signal: z.string().nullable(),
+	timedOut: z.boolean()
+});
+const runSchema = z.strictObject({
+	schemaVersion: z.literal(1),
+	runId: id,
+	status: z.enum([
+		"PASS",
+		"FAIL",
+		"ERROR"
+	]),
+	errors: z.array(z.string()),
+	configPath: relative,
+	root: z.string().min(1).optional(),
+	config: behaviorCiConfigSchema,
+	manifest: manifestSchema,
+	parent: reference.nullable(),
+	next: reference,
+	prepared: reference,
+	model: reference,
+	process: processSchema,
+	current: z.array(z.strictObject({
+		checkId: id,
+		outcome: z.enum([
+			"passed",
+			"failed",
+			"skipped",
+			"error"
+		]),
+		detail: text
+	})),
+	missing: z.array(id),
+	changes: z.array(z.string()),
+	artifacts: z.array(fileHash).max(1e3),
+	assurance: z.enum([
+		"unavailable",
+		"calibration",
+		"calibrated"
+	]).default("unavailable"),
+	assuranceGaps: z.array(text).default([]),
+	coverage: z.strictObject({
+		kind: z.enum(["selected-checks", "bounded-paths"]),
+		generatedPaths: z.number().int().nonnegative(),
+		nativeCases: z.number().int().nonnegative(),
+		generatorCompleteness: z.enum(["not-requested", "reported"])
+	}).default({
+		kind: "selected-checks",
+		generatedPaths: 0,
+		nativeCases: 0,
+		generatorCompleteness: "not-requested"
+	})
+});
+const hash = (data) => createHash("sha256").update(data).digest("hex");
+const equal = (a, b) => stableJson(a) === stableJson(b);
+const readJson = async (file) => {
+	const stat = await fsPromises.stat(file);
+	if (!stat.isFile() || stat.size > 16 * 1024 * 1024) throw new Error(`Invalid or oversized JSON file: ${file}`);
+	return JSON.parse(await fsPromises.readFile(file, "utf8"));
+};
+async function writeArtifact(file, value) {
+	const parent = path.dirname(file);
+	if ((await fsPromises.lstat(parent)).isSymbolicLink()) throw new Error("Artifact parent is a symlink");
+	const tmp = `${file}.${randomUUID()}.tmp`;
+	await fsPromises.writeFile(tmp, value, { flag: "wx" });
+	await fsPromises.rename(tmp, file);
+}
+const writeJson = (file, value) => writeArtifact(file, stableJson(value));
+function unique(values, label) {
+	if (new Set(values).size !== values.length) throw new Error(`Duplicate ${label}`);
+}
+function overlaps$2(first, second) {
+	const a = path.posix.normalize(first);
+	const b = path.posix.normalize(second);
+	return a === "." || b === "." || a === b || a.startsWith(`${b}/`) || b.startsWith(`${a}/`);
+}
+function inside(root, file) {
+	const rel = path.relative(root, file);
+	if (rel === ".." || rel.startsWith(`..${path.sep}`) || path.isAbsolute(rel)) throw new Error(`Outside root: ${file}`);
+	return rel.split(path.sep).join("/");
+}
+async function safe(root, rel, missing = false) {
+	relative.parse(rel);
+	try {
+		if ((await fsPromises.lstat(root)).isSymbolicLink()) throw new Error(`Symlink forbidden: ${root}`);
+	} catch (e) {
+		if (!(missing && e instanceof Error && "code" in e && e.code === "ENOENT")) throw e;
+	}
+	const target = path.resolve(root, rel);
+	inside(root, target);
+	let current = root;
+	for (const part of path.relative(root, target).split(path.sep).filter(Boolean)) {
+		current = path.join(current, part);
+		try {
+			if ((await fsPromises.lstat(current)).isSymbolicLink()) throw new Error(`Symlink forbidden: ${current}`);
+		} catch (e) {
+			if (missing && e instanceof Error && "code" in e && e.code === "ENOENT") continue;
+			throw e;
+		}
+	}
+	return target;
+}
+async function filesUnder(root, rel) {
+	const file = await safe(root, rel);
+	const stat = await fsPromises.stat(file);
+	if (stat.isFile()) {
+		if (stat.size > 16 * 1024 * 1024) throw new Error(`File too large: ${rel}`);
+		return [rel];
+	}
+	if (!stat.isDirectory()) throw new Error(`Not a regular file/directory: ${rel}`);
+	const entries = await fsPromises.readdir(file);
+	const result = [];
+	for (const entry of entries.sort()) {
+		if (entry === ".git" || entry === "node_modules") throw new Error(`Select bounded inputs, excluding ${entry}`);
+		result.push(...await filesUnder(root, `${rel}/${entry}`));
+		if (result.length > 1e3) throw new Error("Too many files");
+	}
+	return result;
+}
+async function traceArtifacts(root) {
+	try {
+		await fsPromises.lstat(path.join(root, "traces"));
+	} catch (error) {
+		if (error instanceof Error && "code" in error && error.code === "ENOENT") return [];
+		throw error;
+	}
+	return filesUnder(root, "traces");
+}
+async function hashes(root, files) {
+	return Promise.all([...new Set(files)].sort().map(async (p) => ({
+		path: p,
+		sha256: hash(await fsPromises.readFile(await safe(root, p)))
+	})));
+}
+async function git(root, ...args) {
+	return (await exec("git", [
+		"-C",
+		root,
+		...args
+	], { maxBuffer: 8 * 1024 * 1024 })).stdout.trim();
+}
+async function machineFiles(root, machineId) {
+	const prefix = `.statelyai/machines/${machineId}`;
+	const versions = await filesUnder(root, `${prefix}/versions`);
+	for (const file of versions) if (!new RegExp(`^${prefix.replaceAll(".", "\\.")}\/versions\/v[0-9]{4,9}\\.json$`).test(file)) throw new Error(`Unexpected store file: ${file}`);
+	return [`${prefix}.json`, ...versions];
+}
+async function copyFiles(from, to, files, immutable = false) {
+	for (const rel of files) {
+		const source = await safe(from, rel);
+		const dest = await safe(to, rel, true);
+		const bytes = await fsPromises.readFile(source);
+		await fsPromises.mkdir(path.dirname(dest), { recursive: true });
+		try {
+			await fsPromises.writeFile(dest, bytes, { flag: "wx" });
+		} catch (e) {
+			if (!(e instanceof Error && "code" in e && e.code === "EEXIST")) throw e;
+			if (!immutable || !bytes.equals(await fsPromises.readFile(dest))) throw new Error(`Conflicting immutable file: ${rel}`);
+		}
+	}
+}
+async function loadConfig(configFile) {
+	const configAbsolute = path.resolve(configFile);
+	const root = await git(path.dirname(configAbsolute), "rev-parse", "--show-toplevel");
+	const configPath = inside(root, configAbsolute);
+	const config = behaviorCiConfigSchema.parse(await readJson(await safe(root, configPath)));
+	unique(config.checks.map((c) => c.id), "check IDs");
+	unique(config.checks.map((c) => `${c.file}\0${c.fullName}`), "test mappings");
+	if (config.command.args.reduce((n, a) => n + a.split("{report}").length - 1, 0) !== 1) throw new Error("Command args require exactly one {report} placeholder");
+	if (!config.adapter.endsWith(".mjs")) throw new Error("Adapter must be a self-contained .mjs module");
+	if (config.schemaVersion === 2) {
+		if ([
+			configPath,
+			config.spec,
+			config.model,
+			config.adapter,
+			config.stateRoot,
+			...config.inputs,
+			...config.checks.map((c) => c.file),
+			...await assuranceInputs(root, config),
+			...(await selectedInputs(root, configPath, config)).map((file) => file.path)
+		].some((input) => overlaps$2(config.assurance.calibration, input))) throw new Error("Calibration receipt must be isolated from every bound input and checked state");
+	}
+	if (config.stateRoot === "." || config.inputs.includes(".")) throw new Error("Select bounded inputs and a dedicated stateRoot");
+	return {
+		root,
+		configPath,
+		config
+	};
+}
+async function selectedInputs(root, configPath, config) {
+	const selected = [
+		configPath,
+		config.spec,
+		config.model,
+		config.adapter,
+		...config.checks.map((c) => c.file),
+		...config.schemaVersion === 2 ? await assuranceInputs(root, config) : []
+	];
+	for (const input of config.inputs) selected.push(...await filesUnder(root, input));
+	for (const dir of new Set([".", config.command.cwd])) for (const name of [
+		"package.json",
+		"pnpm-lock.yaml",
+		"package-lock.json",
+		"yarn.lock"
+	]) {
+		const rel = dir === "." ? name : `${dir}/${name}`;
+		try {
+			await fsPromises.access(path.join(root, rel));
+			selected.push(rel);
+		} catch {}
+	}
+	if (config.baseline) {
+		const state = await safe(root, config.stateRoot);
+		selected.push(...(await machineFiles(state, config.baseline.machineId)).map((p) => `${config.stateRoot}/${p}`));
+	}
+	return hashes(root, selected);
+}
+async function capture(root, configPath, config) {
+	const files = await selectedInputs(root, configPath, config);
+	if (files.length > 200) throw new Error("Input scope exceeds core limit of 200 files");
+	const tracked = new Set((await git(root, "ls-files", "-z")).split("\0"));
+	for (const file of files) if (!tracked.has(file.path)) throw new Error(`Input must be tracked (git add first): ${file.path}`);
+	const revision = await git(root, "rev-parse", "HEAD");
+	const dirty = !!await git(root, "status", "--porcelain", "--", ...files.map((f) => f.path));
+	if (process.env.CI === "true" || process.env.GITHUB_ACTIONS === "true") {
+		if (!process.env.GITHUB_SHA || process.env.GITHUB_SHA !== revision) throw new Error("CI requires GITHUB_SHA matching actual HEAD");
+		if (dirty) throw new Error("CI bound inputs must be clean");
+	}
+	const cwd = await safe(root, config.command.cwd);
+	const version = (await exec(config.command.executable, ["--version"], {
+		cwd,
+		timeout: 1e4,
+		maxBuffer: 64 * 1024
+	})).stdout.trim();
+	return {
+		revision,
+		dirty,
+		files,
+		runner: {
+			executable: config.command.executable,
+			version,
+			node: process.version,
+			cli: {
+				version: CLI_VERSION,
+				moduleSha256: hash(await fsPromises.readFile(fileURLToPath(import.meta.url)))
+			},
+			platform: process.platform,
+			arch: process.arch
+		},
+		declaredGithub: {
+			runId: process.env.GITHUB_RUN_ID ?? null,
+			attempt: process.env.GITHUB_RUN_ATTEMPT ?? null,
+			repository: process.env.GITHUB_REPOSITORY ?? null,
+			sha: process.env.GITHUB_SHA ?? null
+		}
+	};
+}
+async function execute(config, root, output) {
+	const cwd = await safe(root, config.command.cwd);
+	const args = config.command.args.map((a) => a.replace("{report}", path.join(output, "report.json")));
+	const stdout = await fsPromises.open(path.join(output, "stdout.log"), "wx");
+	const stderr = await fsPromises.open(path.join(output, "stderr.log"), "wx");
+	try {
+		return await new Promise((resolve, reject) => {
+			const child = spawn(config.command.executable, args, {
+				cwd,
+				shell: false,
+				env: {
+					...process.env,
+					STATELY_BEHAVIOR_OUTPUT: output
+				},
+				detached: process.platform !== "win32",
+				stdio: [
+					"ignore",
+					stdout.fd,
+					stderr.fd
+				]
+			});
+			let timedOut = false;
+			const stop = () => {
+				if (child.pid) try {
+					if (process.platform !== "win32") process.kill(-child.pid, "SIGKILL");
+					else child.kill("SIGKILL");
+				} catch {}
+			};
+			const timer = setTimeout(() => {
+				timedOut = true;
+				stop();
+			}, config.timeoutMs);
+			child.once("error", (e) => {
+				clearTimeout(timer);
+				reject(e);
+			});
+			child.once("close", (exitCode, signal) => {
+				clearTimeout(timer);
+				stop();
+				resolve({
+					executable: config.command.executable,
+					args,
+					cwd,
+					exitCode,
+					signal,
+					timedOut
+				});
+			});
+		});
+	} finally {
+		await stdout.close();
+		await stderr.close();
+	}
+}
+async function exactRecord(loop, ref) {
+	const view = await loop.getBehaviorRecord({
+		machineId: ref.machineId,
+		versionId: ref.versionId
+	});
+	if (view.kind !== "behavior-record" || !equal(view.reference, ref)) throw new Error("Exact record digest mismatch");
+	return view;
+}
+function active(record) {
+	return record.requirements.filter((r) => !r.retired).flatMap((r) => r.checks.filter((c) => !c.retired));
+}
+const base = (ref) => ({
+	versionId: ref.versionId,
+	recordSha256: ref.sha256
+});
+function summary(run, view) {
+	return [
+		`# ${run.status}: ${run.config.name}`,
+		`Git ${run.manifest.revision}; bound inputs ${run.manifest.dirty ? "dirty local bytes" : "clean"}. Run ${run.runId}.`,
+		"Execution is reported, not attested. Review identity unavailable. GitHub environment is declared metadata; authenticate remote run/artifact evidence separately.",
+		`Model ${stableJson(run.model).trim()}`,
+		`Specification ${view.record.specificationSha256}`,
+		...run.changes,
+		`Exact parent ${stableJson(run.parent).trim()}`,
+		`Exact next ${stableJson(run.next).trim()}`,
+		`Current failures/gaps: ${[
+			...run.errors,
+			...run.missing.map((c) => `Missing check ${c}`),
+			...run.current.filter((c) => c.outcome !== "passed").map((c) => `${c.checkId}: ${c.outcome}: ${c.detail}`)
+		].join("; ") || "none"}`,
+		`Historical/core aggregate gaps (not this run verdict): ${view.gaps.map((g) => g.checkId).join(", ") || "none"}`,
+		`Setup assurance: ${run.assurance}. Discovery gaps: ${run.assuranceGaps.join("; ") || "none declared"}.`,
+		`Coverage: ${run.coverage.kind}; archived generated paths ${run.coverage.generatedPaths}; native passed/failed cases ${run.coverage.nativeCases}; generator completeness ${run.coverage.generatorCompleteness}.`,
+		...run.coverage.kind === "bounded-paths" ? ["Complete retrieval of the declared bounded generator result covers only the modeled scope, not every feature input. Generator completeness is reported, not independently recomputed or attested. Archive checksums cannot authenticate a malicious trusted producer."] : [],
+		"Input scope is selected, not a complete transitive dependency proof. Generated paths and executed native cases are separate evidence.",
+		view.display
+	].join("\n\n") + "\n";
+}
+const inputCategories = [
+	"user",
+	"host-update",
+	"async-result",
+	"cancellation",
+	"timer",
+	"server-event",
+	"lifecycle"
+];
+const discoverySource = z.strictObject({
+	authority: z.enum([
+		"cited-requirement",
+		"observation",
+		"inference",
+		"assumption"
+	]),
+	citation: text
+});
+const planInput = z.discriminatedUnion("kind", [
+	z.strictObject({
+		kind: z.literal("mapped"),
+		category: z.enum(inputCategories),
+		source: discoverySource,
+		requirementIds: z.array(id).min(1),
+		checkIds: z.array(id).min(1),
+		entityIds: z.array(text).min(1)
+	}),
+	z.strictObject({
+		kind: z.literal("gap"),
+		category: z.enum(inputCategories),
+		source: discoverySource,
+		reason: text
+	}),
+	z.strictObject({
+		kind: z.literal("not-applicable"),
+		category: z.enum(inputCategories),
+		source: discoverySource,
+		reason: text
+	})
+]);
+const planSchema = z.strictObject({
+	schemaVersion: z.literal(1),
+	inputs: z.array(planInput).min(7).max(100),
+	runnerInputs: z.array(relative).min(1).max(100),
+	authorityInputs: z.array(relative).min(1).max(100),
+	dispositions: z.array(z.strictObject({
+		checkId: id,
+		kind: z.literal("implementation-defect"),
+		reason: text,
+		source: z.strictObject({
+			authority: z.literal("cited-requirement"),
+			citation: text
+		})
+	})).max(500).default([]),
+	coverage: z.discriminatedUnion("kind", [z.strictObject({ kind: z.literal("selected-checks") }), z.strictObject({
+		kind: z.literal("bounded-paths"),
+		artifact: relative,
+		caseMappings: z.array(z.strictObject({
+			pathId: text,
+			checkIds: z.array(id).min(1)
+		})).min(1).max(1e3)
+	})])
+});
+const calibrationReceiptSchema = z.strictObject({
+	schemaVersion: z.literal(1),
+	kind: z.literal("native-calibration"),
+	contractSha256: digest,
+	config: behaviorCiConfigSchema,
+	manifest: manifestSchema,
+	process: processSchema,
+	root: z.string().min(1),
+	report: z.unknown(),
+	results: behaviorCiResultsSchema,
+	dispositions: planSchema.shape.dispositions,
+	snapshots: z.array(z.strictObject({
+		path: relative,
+		base64: z.string()
+	})).max(200)
+});
+const calibrationEnvelopeSchema = z.strictObject({
+	receipt: calibrationReceiptSchema,
+	sha256: digest
+});
+const sealCalibration = (receipt) => ({
+	receipt,
+	sha256: hash(stableJson(receipt))
+});
+async function assuranceInputs(root, config) {
+	if (config.schemaVersion !== 2) return [];
+	const plan = planSchema.parse(await readJson(await safe(root, config.assurance.plan)));
+	return [
+		config.assurance.plan,
+		...plan.runnerInputs,
+		...plan.authorityInputs,
+		...plan.coverage.kind === "bounded-paths" ? [plan.coverage.artifact] : []
+	];
+}
+async function loadAssurancePlan(root, config, spec, graph) {
+	if (config.schemaVersion !== 2) throw new Error("Setup assurance requires schema 2");
+	const plan = planSchema.parse(await readJson(await safe(root, config.assurance.plan)));
+	unique(plan.runnerInputs, "runner inputs");
+	unique(plan.authorityInputs, "authority inputs");
+	unique(plan.dispositions.map((d) => d.checkId), "calibration dispositions");
+	unique(plan.inputs.map((i) => stableJson(i)), "discovery entries");
+	for (const category of inputCategories) if (!plan.inputs.some((i) => i.category === category)) throw new Error(`Discovery inventory missing input category: ${category}`);
+	const requirements = new Map(spec.requirements.map((r) => [r.id, r]));
+	const checkIds = new Set(spec.requirements.flatMap((r) => r.checks.map((c) => c.id)));
+	const selected = new Set(config.checks.map((c) => c.id));
+	const entities = new Set([...graph.nodes.map((n) => n.id), ...graph.edges.map((e) => e.id)]);
+	for (const entry of plan.inputs) if (entry.kind === "mapped") {
+		unique(entry.requirementIds, "discovery requirement references");
+		unique(entry.checkIds, "discovery check references");
+		unique(entry.entityIds, "discovery entity references");
+		if (entry.requirementIds.some((r) => !requirements.has(r)) || entry.checkIds.some((c) => !checkIds.has(c) || !selected.has(c)) || entry.entityIds.some((e) => !entities.has(e))) throw new Error(`Unknown discovery reference: ${entry.category}`);
+		const related = new Set(entry.requirementIds.flatMap((r) => requirements.get(r)?.checks.map((c) => c.id) ?? []));
+		if (entry.checkIds.some((c) => !related.has(c))) throw new Error(`Discovery checks do not belong to referenced requirements: ${entry.category}`);
+	}
+	for (const disposition of plan.dispositions) if (!selected.has(disposition.checkId)) throw new Error(`Unknown calibration disposition: ${disposition.checkId}`);
+	if (plan.coverage.kind === "bounded-paths") await validatePathCoverage(root, config, plan.coverage, graph);
+	return plan;
+}
+const runnerContract = ({ platform: _platform, arch: _arch, ...runner }) => runner;
+async function contractDigest(root, config, plan, manifest) {
+	return hash(stableJson({
+		files: await hashes(root, [
+			config.spec,
+			config.model,
+			config.adapter,
+			...config.schemaVersion === 2 ? [config.assurance.plan] : [],
+			...config.checks.map((c) => c.file),
+			...plan.runnerInputs,
+			...plan.authorityInputs,
+			...plan.coverage.kind === "bounded-paths" ? [plan.coverage.artifact] : []
+		]),
+		command: config.command,
+		checks: config.checks,
+		timeoutMs: config.timeoutMs,
+		runner: runnerContract(manifest.runner)
+	}));
+}
+async function normalizeReport(root, config, report, originalRoot = root) {
+	const module = await import(`${pathToFileURL(await safe(root, config.adapter)).href}?validation=${randomUUID()}`);
+	if (!module || typeof module !== "object" || !("default" in module) || typeof module.default !== "function") throw new Error("Adapter must export a default function");
+	return behaviorCiResultsSchema.parse(await module.default(report, {
+		root: originalRoot,
+		cwd: (path.win32.isAbsolute(originalRoot) && !path.posix.isAbsolute(originalRoot) ? path.win32 : path.posix).resolve(originalRoot, config.command.cwd)
+	}));
+}
+async function validateCalibration(root, config, contract, supplied) {
+	if (config.schemaVersion !== 2) throw new Error("Calibration requires config schemaVersion 2");
+	const envelope = calibrationEnvelopeSchema.parse(supplied ?? await readJson(await safe(root, config.assurance.calibration)));
+	const { receipt } = envelope;
+	if (envelope.sha256 !== hash(stableJson(receipt))) throw new Error("Calibration receipt checksum mismatch");
+	if (!contract || receipt.contractSha256 !== contract) throw new Error("Calibration stale: model, specification, discovery plan, mapping, adapter or runner changed; recalibrate explicitly");
+	unique(receipt.snapshots.map((s) => s.path), "calibration snapshots");
+	if (!equal(receipt.manifest.files.map((f) => f.path).sort(), receipt.snapshots.map((s) => s.path).sort())) throw new Error("Calibration snapshots do not match original manifest");
+	for (const file of receipt.manifest.files) {
+		const snapshot = receipt.snapshots.find((s) => s.path === file.path);
+		if (!snapshot || hash(Buffer.from(snapshot.base64, "base64")) !== file.sha256) throw new Error(`Calibration original input checksum mismatch: ${file.path}`);
+	}
+	if (!equal({
+		...receipt.config,
+		baseline: null
+	}, {
+		...config,
+		baseline: null
+	})) throw new Error("Calibration config differs from selected contract");
+	const plan = planSchema.parse(await readJson(await safe(root, config.assurance.plan)));
+	if (!equal(receipt.dispositions, plan.dispositions)) throw new Error("Calibration dispositions differ from reviewed discovery plan");
+	const contractPaths = new Set([
+		config.spec,
+		config.model,
+		config.adapter,
+		config.assurance.plan,
+		...config.checks.map((c) => c.file),
+		...plan.runnerInputs,
+		...plan.authorityInputs,
+		...plan.coverage.kind === "bounded-paths" ? [plan.coverage.artifact] : []
+	]);
+	const originalFiles = receipt.manifest.files.filter((f) => contractPaths.has(f.path));
+	if (!equal([...contractPaths].sort(), originalFiles.map((f) => f.path).sort()) || receipt.contractSha256 !== hash(stableJson({
+		files: originalFiles,
+		command: receipt.config.command,
+		checks: receipt.config.checks,
+		timeoutMs: receipt.config.timeoutMs,
+		runner: runnerContract(receipt.manifest.runner)
+	}))) throw new Error("Calibration original contract binding mismatch");
+	if (path.posix.join(receipt.root.replaceAll("\\", "/"), receipt.config.command.cwd) !== receipt.process.cwd.replaceAll("\\", "/")) throw new Error("Calibration original checkout/cwd binding mismatch");
+	if (receipt.process.executable !== receipt.config.command.executable || receipt.process.args.length !== receipt.config.command.args.length || receipt.config.command.args.some((arg, i) => {
+		const actual = receipt.process.args[i];
+		if (!arg.includes("{report}")) return actual !== arg;
+		const [prefix, suffix] = arg.split("{report}");
+		return !actual?.startsWith(prefix) || !actual.endsWith(suffix ?? "") || !actual.includes("report.json");
+	})) throw new Error("Calibration process differs from bound native command");
+	const before = await hashes(root, [...contractPaths]);
+	const normalized = await normalizeReport(root, config, receipt.report, receipt.root);
+	if (!equal(before, await hashes(root, [...contractPaths]))) throw new Error("Calibration adapter changed bound contract during validation");
+	if (!equal(normalized, receipt.results)) throw new Error("Calibration native report differs from normalized results");
+	unique(normalized.map((r) => `${r.file}\0${r.fullName}`), "calibration tests");
+	if (!equal(normalized.map((r) => `${r.file}\0${r.fullName}`).sort(), config.checks.map((r) => `${r.file}\0${r.fullName}`).sort())) throw new Error("Calibration native inventory differs from selected mappings");
+	const failures = normalized.filter((r) => r.outcome === "failed");
+	if (receipt.process.timedOut || receipt.process.signal || receipt.process.exitCode !== (failures.length ? 1 : 0) || normalized.some((r) => !["passed", "failed"].includes(r.outcome))) throw new Error("Calibration native process/report is invalid or incomplete");
+	for (const failed of failures) {
+		const check = config.checks.find((c) => c.file === failed.file && c.fullName === failed.fullName);
+		if (!check || !receipt.dispositions.some((d) => d.checkId === check.id)) throw new Error(`Unresolved calibration mismatch: ${check?.id ?? failed.fullName}; resolve requirements or cite an implementation-defect disposition`);
+	}
+	return envelope;
+}
+async function validatePathCoverage(root, config, coverage, graph) {
+	const archive = z.strictObject({
+		schemaVersion: z.literal(1),
+		source: z.strictObject({
+			graph: z.unknown(),
+			kind: z.enum(["shortest", "simple"])
+		}),
+		pages: z.array(graphPathsPageSchema).min(1).max(1e3)
+	}).parse(await readJson(await safe(root, coverage.artifact)));
+	const source = parseModelGraph(archive.source.graph);
+	if (editorGraphRevision(source) !== editorGraphRevision(graph)) throw new Error("Generated path archive belongs to a different model");
+	const first = archive.pages[0];
+	const last = archive.pages.at(-1);
+	if (!first || !last) throw new Error("Missing generated path pages");
+	let offset = 0;
+	for (let i = 0; i < archive.pages.length; i++) {
+		const page = archive.pages[i];
+		if (!page) throw new Error("Missing generated path page");
+		const p = page.pagination;
+		if (p.offset !== offset || p.modelRevision !== editorGraphRevision(graph) || p.generationId !== first.pagination.generationId || p.budget !== first.pagination.budget || p.availablePaths !== first.pagination.availablePaths || p.generationComplete !== first.pagination.generationComplete || page.totalPaths !== first.totalPaths || !equal(page.coverage, first.coverage) || !equal(page.execution, first.execution) || page.coverageScope !== "generation-budget" || page.paths.length > p.appliedLimit || p.availablePaths > p.budget || p.generationComplete !== (p.availablePaths === page.totalPaths) || p.status !== (!p.retrievalComplete ? "more-pages" : p.generationComplete ? "complete" : "budget-exhausted")) throw new Error("Generated path pages are not one contiguous model-bound generation");
+		offset += page.paths.length;
+		const nextPage = archive.pages[i + 1];
+		if (nextPage && !p.nextCursor) throw new Error("Generated path cursor chain ends before next page");
+		if (p.retrievalComplete !== (offset === p.availablePaths) || page.truncated !== page.paths.length < page.totalPaths) throw new Error("Generated path completion metadata disagrees with archived paths");
+		const expectedCursor = offset < p.availablePaths ? graphPathNextCursor({
+			generationId: p.generationId,
+			offset
+		}) : null;
+		if (p.nextCursor !== expectedCursor || nextPage && offset !== nextPage.pagination.offset) throw new Error("Generated path continuation cursor does not bind next page");
+	}
+	if (!first.pagination.generationComplete || !last.pagination.retrievalComplete || last.pagination.nextCursor !== null || last.pagination.status !== "complete" || offset !== first.pagination.availablePaths || offset !== first.totalPaths) throw new Error("Incomplete bounded-path generation or retrieval cannot claim complete coverage");
+	const paths = archive.pages.flatMap((p) => p.paths);
+	unique(paths.map((p) => p.id), "generated path IDs");
+	if (graphPathGenerationId({
+		input: { graph: source },
+		kind: archive.source.kind,
+		budget: first.pagination.budget
+	}, {
+		paths,
+		coverage: first.coverage,
+		totalPaths: first.totalPaths,
+		truncated: false,
+		execution: first.execution
+	}) !== first.pagination.generationId) throw new Error("Generated path archive digest mismatch");
+	const nodes = new Map(graph.nodes.map((n) => [n.id, n]));
+	const edges = new Map(graph.edges.map((e) => [e.id, e]));
+	const includesAncestor = (stateIds, ancestor) => stateIds.some((stateId) => {
+		let current = stateId;
+		const seen = /* @__PURE__ */ new Set();
+		while (current && !seen.has(current)) {
+			if (current === ancestor) return true;
+			seen.add(current);
+			current = nodes.get(current)?.parentId;
+		}
+		return false;
+	});
+	for (const generated of paths) {
+		const lastStep = generated.steps.at(-1);
+		if (!lastStep || !equal(generated.finalStateIds, lastStep.stateIds) || generated.finalStatePath !== lastStep.statePath) throw new Error(`Generated path final state mismatch: ${generated.id}`);
+		for (let i = 0; i < generated.steps.length; i++) {
+			const step = generated.steps[i];
+			if (!step || !step.stateIds.length || step.stateIds.some((stateId) => !nodes.has(stateId))) throw new Error(`Generated path contains unknown states: ${generated.id}`);
+			if (i === 0) {
+				if (step.edgeId !== null || step.eventType !== "xstate.init") throw new Error("Generated path does not begin at initialization");
+			} else {
+				const edge = step.edgeId ? edges.get(step.edgeId) : void 0;
+				const previous = generated.steps[i - 1];
+				if (!edge || !previous || !includesAncestor(previous.stateIds, edge.sourceId) || edge.targetId && !includesAncestor(step.stateIds, edge.targetId) || (z.object({ eventType: z.string().nullish() }).parse(edge.data ?? {}).eventType ?? null) !== step.eventType) throw new Error(`Generated path transition is not in bound model: ${generated.id}`);
+			}
+		}
+	}
+	unique(coverage.caseMappings.map((m) => m.pathId), "generated path mappings");
+	if (!equal(paths.map((p) => p.id).sort(), coverage.caseMappings.map((m) => m.pathId).sort()) || coverage.caseMappings.some((m) => m.checkIds.some((checkId) => !config.checks.some((c) => c.id === checkId)))) throw new Error("Every generated path requires exact selected native check mappings");
+}
+async function checkBehavior(options) {
+	return runBehavior(options, false);
+}
+async function calibrateBehavior(options) {
+	return runBehavior(options, true);
+}
+async function runBehavior(options, calibration) {
+	const output = path.resolve(options.output);
+	let ready = false;
+	let processResult;
+	try {
+		await safe(path.parse(output).root, inside(path.parse(output).root, output), true);
+		await fsPromises.mkdir(output, { recursive: true });
+		if ((await fsPromises.readdir(output)).length) throw new Error("Output must be empty and unique");
+		ready = true;
+		const { root, configPath, config } = await loadConfig(options.config);
+		const outputRel = inside(root, output);
+		if (overlaps$2(outputRel, config.stateRoot)) throw new Error("Output and checked state must be isolated");
+		for (const input of [
+			...config.inputs,
+			config.spec,
+			config.model,
+			config.adapter,
+			configPath,
+			...config.schemaVersion === 2 ? [...await assuranceInputs(root, config), config.assurance.calibration] : []
+		]) if (overlaps$2(outputRel, input)) throw new Error("Output overlaps bound inputs");
+		const manifest = await capture(root, configPath, config);
+		await writeJson(path.join(output, "manifest.json"), manifest);
+		await writeArtifact(path.join(output, "config.json"), await fsPromises.readFile(await safe(root, configPath), "utf8"));
+		const spec = specSchema.parse(await readJson(await safe(root, config.spec)));
+		const graph = parseModelGraph(await readJson(await safe(root, config.model)));
+		if (calibration && config.schemaVersion !== 2) throw new Error("Calibration requires config schemaVersion 2");
+		const plan = config.schemaVersion === 2 ? await loadAssurancePlan(root, config, spec, graph) : null;
+		const contract = plan ? await contractDigest(root, config, plan, manifest) : null;
+		let calibrationEnvelope = null;
+		if (config.schemaVersion === 2 && !calibration) {
+			calibrationEnvelope = await validateCalibration(root, config, contract);
+			await writeJson(path.join(output, "calibration.json"), calibrationEnvelope);
+		}
+		const storeRoot = path.join(output, "store");
+		await fsPromises.mkdir(storeRoot);
+		if (config.baseline) {
+			const checked = await safe(root, config.stateRoot);
+			await copyFiles(checked, storeRoot, await machineFiles(checked, config.baseline.machineId));
+		}
+		const store = createFileStore(storeRoot);
+		const loop = createLoop({ store });
+		const implementation = {
+			revision: `git:${manifest.revision}${manifest.dirty ? ":dirty" : ""}`,
+			environment: stableJson(manifest.runner).trim(),
+			files: manifest.files
+		};
+		let prepared;
+		if (config.baseline) {
+			const prior = await exactRecord(loop, config.baseline);
+			if (!equal(prior.reference, config.baseline)) throw new Error("Checked baseline digest mismatch");
+			const model = editorGraphRevision(graph) === prior.record.model.sha256 ? prior.record.model : {
+				machineId: config.baseline.machineId,
+				versionId: (await store.createProposal(config.baseline.machineId, config.name, graph)).machineVersionId,
+				sha256: editorGraphRevision(graph)
+			};
+			prepared = await loop.saveBehaviorRecord({
+				machineId: config.baseline.machineId,
+				base: base(config.baseline),
+				change: {
+					kind: "revise",
+					upsert: spec.requirements,
+					retire: spec.retire.filter((retirement) => {
+						const target = retirement.kind === "requirement" ? prior.record.requirements.find((r) => r.id === retirement.id) : prior.record.requirements.flatMap((r) => r.checks).find((c) => c.id === retirement.id);
+						if (target?.retired && target.retired !== retirement.reason) throw new Error(`Retirement reason changed: ${retirement.id}`);
+						return !target?.retired;
+					}),
+					implementation,
+					model
+				}
+			});
+		} else {
+			if (spec.retire.length) throw new Error("Cannot retire before creating a baseline");
+			const machine = await store.createMachine(await store.getDraftsProject(), config.name, graph);
+			prepared = await loop.saveBehaviorRecord({
+				machineId: machine.machineId,
+				change: {
+					kind: "create",
+					expectedModelRevision: (await loop.openModel(machine.machineId)).model.revision,
+					title: config.name,
+					implementation,
+					requirements: spec.requirements
+				}
+			});
+		}
+		const obligations = active(prepared.record);
+		const ids = new Set(obligations.map((c) => c.id));
+		if (config.checks.some((c) => !ids.has(c.id))) throw new Error("Mapping references unknown or retired checks");
+		processResult = {
+			executable: config.command.executable,
+			args: config.command.args.map((a) => a.replace("{report}", path.join(output, "report.json"))),
+			cwd: path.resolve(root, config.command.cwd),
+			exitCode: null,
+			signal: null,
+			timedOut: false
+		};
+		await writeJson(path.join(output, "process.json"), processResult);
+		processResult = await execute(config, root, output);
+		await writeJson(path.join(output, "process.json"), processResult);
+		if (!equal(manifest.files, await selectedInputs(root, configPath, config)) || await git(root, "rev-parse", "HEAD") !== manifest.revision) throw new Error("Bound inputs changed during execution");
+		if (processResult.timedOut || processResult.signal || processResult.exitCode === null || ![0, 1].includes(processResult.exitCode)) throw new Error("Runner timed out, signalled, or returned an unsupported exit code");
+		const raw = await readJson(await safe(output, "report.json"));
+		const module = await import(`${pathToFileURL(await safe(root, config.adapter)).href}?run=${randomUUID()}`);
+		if (!module || typeof module !== "object" || !("default" in module) || typeof module.default !== "function") throw new Error("Adapter must export a default function");
+		const results = behaviorCiResultsSchema.parse(await module.default(raw, {
+			root,
+			cwd: path.resolve(root, config.command.cwd)
+		}));
+		unique(results.map((r) => `${r.file}\0${r.fullName}`), "reported tests");
+		const current = [];
+		const missing = obligations.filter((c) => !config.checks.some((m) => m.id === c.id)).map((c) => c.id);
+		for (const mapping of config.checks) {
+			const result = results.find((r) => r.file === mapping.file && r.fullName === mapping.fullName);
+			if (!result) missing.push(mapping.id);
+			else current.push({
+				checkId: mapping.id,
+				outcome: result.outcome,
+				detail: result.detail
+			});
+		}
+		const errors = [];
+		if (config.schemaVersion === 2 && results.some((r) => !config.checks.some((m) => m.file === r.file && m.fullName === r.fullName))) errors.push("Native test inventory differs from exact selected mappings");
+		if (results.some((r) => r.outcome === "error")) errors.push("Reporter contains error outcomes");
+		if (results.some((r) => r.outcome === "failed" && !config.checks.some((m) => m.file === r.file && m.fullName === r.fullName))) errors.push("Failure outside mapped tests");
+		const hasFailure = results.some((r) => r.outcome === "failed" || r.outcome === "error");
+		if (processResult.exitCode === 1 !== hasFailure) errors.push("Process exit disagrees with report");
+		if (!equal(manifest.files, await selectedInputs(root, configPath, config)) || await git(root, "rev-parse", "HEAD") !== manifest.revision || hash(await fsPromises.readFile(fileURLToPath(import.meta.url))) !== manifest.runner.cli.moduleSha256) errors.push("Bound inputs or CLI changed during adapter execution");
+		const reportResults = [...current, ...missing.map((checkId) => ({
+			checkId,
+			outcome: "skipped",
+			detail: "Required check omitted or missing from this run"
+		}))];
+		await exactRecord(loop, prepared.reference);
+		const runId = `ci-${randomUUID()}`;
+		const next = await loop.saveBehaviorRecord({
+			machineId: prepared.reference.machineId,
+			base: base(prepared.reference),
+			change: {
+				kind: "attach-report",
+				report: {
+					runId,
+					binding: prepared.reportBinding,
+					results: reportResults
+				}
+			}
+		});
+		const status = errors.length ? "ERROR" : missing.length || current.some((r) => r.outcome !== "passed") ? "FAIL" : "PASS";
+		if (calibration && plan && contract) {
+			calibrationEnvelope = sealCalibration({
+				schemaVersion: 1,
+				kind: "native-calibration",
+				root,
+				contractSha256: contract,
+				config,
+				manifest,
+				process: processResult,
+				report: raw,
+				results,
+				dispositions: plan.dispositions,
+				snapshots: await Promise.all(manifest.files.map(async (f) => ({
+					path: f.path,
+					base64: (await fsPromises.readFile(await safe(root, f.path))).toString("base64")
+				})))
+			});
+			await writeJson(path.join(output, "calibration.json"), calibrationEnvelope);
+		}
+		const run = {
+			schemaVersion: 1,
+			assurance: config.schemaVersion === 1 ? "unavailable" : calibration ? "calibration" : "calibrated",
+			coverage: {
+				kind: plan?.coverage.kind ?? "selected-checks",
+				generatedPaths: plan?.coverage.kind === "bounded-paths" ? plan.coverage.caseMappings.length : 0,
+				nativeCases: results.filter((r) => r.outcome === "passed" || r.outcome === "failed").length,
+				generatorCompleteness: plan?.coverage.kind === "bounded-paths" ? "reported" : "not-requested"
+			},
+			assuranceGaps: plan ? plan.inputs.filter((i) => i.kind === "gap").map((i) => `${i.category}: ${i.reason}`) : ["Legacy schema 1 has no calibrated discovery plan"],
+			runId,
+			status,
+			errors,
+			configPath,
+			root,
+			config,
+			manifest,
+			parent: config.baseline,
+			next: next.reference,
+			prepared: prepared.reference,
+			model: next.record.model,
+			process: processResult,
+			current,
+			missing,
+			changes: ["requirements", "checks"].flatMap((kind) => Object.entries(prepared.changeImpact[kind]).map(([change, ids]) => `${kind} ${change}: ${ids.join(", ") || "none"}`))
+		};
+		await writeArtifact(path.join(output, "summary.md"), summary(run, next));
+		const artifactFiles = [
+			"config.json",
+			"manifest.json",
+			"process.json",
+			"stdout.log",
+			"stderr.log",
+			"report.json",
+			"summary.md",
+			...calibrationEnvelope ? ["calibration.json"] : [],
+			...await traceArtifacts(output),
+			...(await machineFiles(storeRoot, next.reference.machineId)).map((p) => `store/${p}`)
+		];
+		if (artifactFiles.length > 1e3) throw new Error("Artifact scope exceeds 1000 files");
+		await writeJson(path.join(output, "run.json"), {
+			...run,
+			artifacts: await hashes(output, artifactFiles)
+		});
+		return {
+			exitCode: status === "PASS" ? 0 : status === "FAIL" ? 1 : 2,
+			output
+		};
+	} catch (error) {
+		const message = error instanceof Error ? error.message : String(error);
+		if (ready) {
+			await writeJson(path.join(output, "run.json"), {
+				schemaVersion: 1,
+				status: "ERROR",
+				errors: [message],
+				process: processResult ?? null
+			});
+			await writeArtifact(path.join(output, "summary.md"), `# ERROR\n\n${message}\n\nNo valid adoptable record.\n`);
+		}
+		return {
+			exitCode: 2,
+			output
+		};
+	}
+}
+async function adoptBehavior(options) {
+	const loaded = await loadConfig(options.config);
+	const lockFile = await safe(loaded.root, `${loaded.configPath}.adopt.lock`, true);
+	const lock = await fsPromises.open(lockFile, "wx");
+	try {
+		return await adoptLocked(options, loaded);
+	} finally {
+		await lock.close();
+		await fsPromises.unlink(lockFile);
+	}
+}
+async function adoptLocked(options, { root, configPath, config }) {
+	let calibrationToInstall = null;
+	const artifact = path.resolve(options.artifact);
+	await safe(path.parse(artifact).root, inside(path.parse(artifact).root, artifact));
+	const run = runSchema.parse(await readJson(await safe(artifact, "run.json")));
+	if (run.status === "ERROR") throw new Error("Error artifacts cannot advance the baseline");
+	if (configPath !== run.configPath || !equal({
+		...config,
+		baseline: null
+	}, {
+		...run.config,
+		baseline: null
+	})) throw new Error("Config differs from inspected run");
+	if (!equal(config.baseline, run.parent) && !equal(config.baseline, run.next)) throw new Error(`Divergent parent: checked ${stableJson(config.baseline)} artifact ${stableJson(run.parent)}`);
+	unique(run.artifacts.map((f) => f.path), "artifact files");
+	if (!equal(run.artifacts, await hashes(artifact, run.artifacts.map((f) => f.path)))) throw new Error("Artifact checksum mismatch");
+	const state = await safe(root, config.stateRoot, true);
+	const sourceRoot = await safe(artifact, "store");
+	const sourceFiles = await machineFiles(sourceRoot, run.next.machineId);
+	if (!equal([
+		"config.json",
+		"manifest.json",
+		"process.json",
+		"stdout.log",
+		"stderr.log",
+		"report.json",
+		"summary.md",
+		...run.config.schemaVersion === 2 ? ["calibration.json"] : [],
+		...await traceArtifacts(artifact),
+		...sourceFiles.map((p) => `store/${p}`)
+	].sort(), run.artifacts.map((f) => f.path).sort())) throw new Error("Unexpected or missing artifact files");
+	if (!equal(run.manifest, manifestSchema.parse(await readJson(await safe(artifact, "manifest.json")))) || !equal(run.process, await readJson(await safe(artifact, "process.json")))) throw new Error("Artifact metadata mismatch");
+	const capturedConfig = await fsPromises.readFile(await safe(artifact, "config.json"));
+	const configInput = run.manifest.files.find((file) => file.path === run.configPath);
+	if (!configInput || hash(capturedConfig) !== configInput.sha256 || !equal(behaviorCiConfigSchema.parse(JSON.parse(capturedConfig.toString("utf8"))), run.config) || !equal(run.config.baseline, run.parent)) throw new Error("Recorded config binding mismatch");
+	const available = run.manifest.dirty ? (await git(root, "ls-files", "-z")).split("\0") : (await git(root, "ls-tree", "-r", "--name-only", "-z", run.manifest.revision)).split("\0");
+	const required = new Set([
+		run.configPath,
+		config.spec,
+		config.model,
+		config.adapter,
+		...config.checks.map((c) => c.file),
+		...config.schemaVersion === 2 ? await assuranceInputs(root, config) : []
+	]);
+	for (const input of config.inputs) {
+		const matches = available.filter((p) => p === input || p.startsWith(`${input}/`));
+		if (!matches.length) throw new Error(`Missing recorded input scope: ${input}`);
+		matches.forEach((p) => required.add(p));
+	}
+	for (const dir of new Set([".", config.command.cwd])) for (const name of [
+		"package.json",
+		"pnpm-lock.yaml",
+		"package-lock.json",
+		"yarn.lock"
+	]) {
+		const p = dir === "." ? name : `${dir}/${name}`;
+		if (available.includes(p)) required.add(p);
+	}
+	if (run.parent) {
+		const prefix = `${config.stateRoot}/.statelyai/machines/${run.parent.machineId}`;
+		const recordedParentPaths = run.manifest.files.map((f) => f.path).filter((p) => p === `${prefix}.json` || p.startsWith(`${prefix}/versions/`));
+		if (!recordedParentPaths.includes(`${prefix}.json`) || !recordedParentPaths.includes(`${prefix}/versions/${run.parent.versionId}.json`)) throw new Error("Missing checked parent files");
+		recordedParentPaths.forEach((p) => required.add(p));
+	}
+	if (!equal([...required].sort(), run.manifest.files.map((f) => f.path).sort())) throw new Error("Recorded manifest does not match selected scope");
+	for (const file of run.manifest.files) if (run.manifest.dirty) {
+		if (file.path === configPath && equal(config.baseline, run.next)) continue;
+		if (hash(await fsPromises.readFile(await safe(root, file.path))) !== file.sha256) throw new Error(`Dirty run inputs no longer match: ${file.path}`);
+	} else if (hash((await exec("git", [
+		"-C",
+		root,
+		"show",
+		`${run.manifest.revision}:${file.path}`
+	], {
+		encoding: "buffer",
+		maxBuffer: 16 * 1024 * 1024
+	})).stdout) !== file.sha256) throw new Error(`Recorded Git input mismatch: ${file.path}`);
+	const loop = createLoop({ store: createFileStore(sourceRoot) });
+	const next = await exactRecord(loop, run.next);
+	const prepared = await exactRecord(loop, run.prepared);
+	if (!equal(next.reference, run.next) || !equal(next.record.parent, run.prepared) || !equal(prepared.reference, run.prepared) || !equal(prepared.record.parent, run.parent) || !equal(next.record.model, run.model)) throw new Error("Record ancestry/digest mismatch");
+	if (editorGraphRevision(parseModelGraph((await createFileStore(sourceRoot).getProposal(run.model.machineId, run.model.versionId)).definition)) !== run.model.sha256) throw new Error("Model digest mismatch");
+	const implementation = {
+		revision: `git:${run.manifest.revision}${run.manifest.dirty ? ":dirty" : ""}`,
+		environment: stableJson(run.manifest.runner).trim(),
+		files: run.manifest.files
+	};
+	if (!equal(next.record.implementation, implementation) || !equal(prepared.record.implementation, implementation)) throw new Error("Implementation manifest binding mismatch");
+	const report = next.record.reports.find((r) => r.report.runId === run.runId);
+	if (!report || !equal(report.report.binding, next.reportBinding)) throw new Error("Current report binding missing");
+	const expectedResults = [...run.current, ...run.missing.map((checkId) => ({
+		checkId,
+		outcome: "skipped",
+		detail: "Required check omitted or missing from this run"
+	}))];
+	if (!equal(report.report.results.map(({ replayRefs: _refs, ...result }) => result), expectedResults)) throw new Error("Current report mismatch");
+	if (!equal(active(next.record).map((c) => c.id).sort(), expectedResults.map((r) => r.checkId).sort()) || run.status === "PASS" !== expectedResults.every((r) => r.outcome === "passed") || run.errors.length) throw new Error("Current verdict mismatch");
+	if (config.schemaVersion === 2) {
+		const plan = await loadAssurancePlan(root, config, specSchema.parse(await readJson(await safe(root, config.spec))), parseModelGraph(await readJson(await safe(root, config.model))));
+		const currentManifest = await capture(root, configPath, config);
+		const contract = await contractDigest(root, config, plan, currentManifest);
+		const envelope = await validateCalibration(root, config, contract, await readJson(await safe(artifact, "calibration.json")));
+		if (!run.root) throw new Error("Schema 2 artifact is missing original checkout root");
+		const normalized = await normalizeReport(root, config, await readJson(await safe(artifact, "report.json")), run.root);
+		if (!equal(config.checks.flatMap((mapping) => {
+			const result = normalized.find((r) => r.file === mapping.file && r.fullName === mapping.fullName);
+			return result ? [{
+				checkId: mapping.id,
+				outcome: result.outcome,
+				detail: result.detail
+			}] : [];
+		}), run.current) || normalized.some((r) => !config.checks.some((m) => m.file === r.file && m.fullName === r.fullName))) throw new Error("Adopted current native report differs from recorded results or exact selected inventory");
+		const expectedCoverage = {
+			kind: plan.coverage.kind,
+			generatedPaths: plan.coverage.kind === "bounded-paths" ? plan.coverage.caseMappings.length : 0,
+			nativeCases: normalized.filter((r) => r.outcome === "passed" || r.outcome === "failed").length,
+			generatorCompleteness: plan.coverage.kind === "bounded-paths" ? "reported" : "not-requested"
+		};
+		if (!equal(run.coverage, expectedCoverage)) throw new Error("Coverage claim differs from bound plan and native report");
+		if (contract !== await contractDigest(root, config, plan, currentManifest)) throw new Error("Bound contract changed during adoption validation");
+		if (run.assurance === "calibration") {
+			if (!equal(envelope.receipt.manifest, run.manifest) || !equal(envelope.receipt.process, run.process) || !equal(envelope.receipt.report, await readJson(await safe(artifact, "report.json")))) throw new Error("Calibration receipt differs from actual native run");
+		} else if (run.assurance !== "calibrated") throw new Error("Schema 2 run missing setup assurance");
+		calibrationToInstall = {
+			file: await safe(root, config.assurance.calibration, true),
+			envelope
+		};
+	}
+	const files = sourceFiles.filter((p) => p.includes("/versions/"));
+	const sourceStore = createFileStore(sourceRoot);
+	for (const file of files) {
+		const versionId = path.basename(file, ".json");
+		const saved = await sourceStore.getProposal(run.next.machineId, versionId);
+		if (saved.machineId !== run.next.machineId || saved.machineVersionId !== versionId) throw new Error("Stored version identity mismatch");
+		parseModelGraph(saved.definition);
+	}
+	await fsPromises.mkdir(state, { recursive: true });
+	if (config.baseline) {
+		if (!equal((await exactRecord(createLoop({ store: createFileStore(state) }), config.baseline)).reference, config.baseline)) throw new Error("Checked parent digest mismatch");
+	}
+	await copyFiles(sourceRoot, state, files, true);
+	const head = `.statelyai/machines/${run.next.machineId}.json`;
+	try {
+		await fsPromises.access(await safe(state, head, true));
+	} catch {
+		await copyFiles(sourceRoot, state, [head]);
+	}
+	if (!equal(behaviorCiConfigSchema.parse(await readJson(await safe(root, configPath))), config)) throw new Error("Config changed during adoption; copied versions remain unselected");
+	if (calibrationToInstall) {
+		await fsPromises.mkdir(path.dirname(calibrationToInstall.file), { recursive: true });
+		await writeJson(calibrationToInstall.file, calibrationToInstall.envelope);
+	}
+	const configFile = await safe(root, configPath);
+	const temporary = `${configFile}.${randomUUID()}.tmp`;
+	await fsPromises.writeFile(temporary, stableJson({
+		...config,
+		baseline: run.next
+	}), { flag: "wx" });
+	await fsPromises.rename(temporary, configFile);
+	return run.next;
+}
+var BehaviorCheckCommand = class BehaviorCheckCommand extends Command {
+	static summary = "Run checked tests and save an immutable behavior evidence artifact.";
+	static flags = {
+		config: Flags.string({ required: true }),
+		output: Flags.string({ required: true }),
+		help: Flags.help({ char: "h" })
+	};
+	async run() {
+		const { flags } = await this.parse(BehaviorCheckCommand);
+		const result = await checkBehavior(flags);
+		this.log(result.output);
+		if (result.exitCode) this.exit(result.exitCode);
+	}
+};
+var BehaviorAdoptCommand = class BehaviorAdoptCommand extends Command {
+	static summary = "Adopt an inspected behavior run into the checked baseline.";
+	static args = { artifact: Args.string({ required: true }) };
+	static flags = {
+		config: Flags.string({ required: true }),
+		help: Flags.help({ char: "h" })
+	};
+	async run() {
+		const { flags, args } = await this.parse(BehaviorAdoptCommand);
+		try {
+			this.log(stableJson(await adoptBehavior({
+				config: flags.config,
+				artifact: args.artifact
+			})));
+		} catch (error) {
+			this.error(error instanceof Error ? error.message : String(error), { exit: 2 });
+		}
+	}
+};
+var BehaviorCalibrateCommand = class BehaviorCalibrateCommand extends Command {
+	static summary = "Execute native checks to calibrate a reviewed behavior contract.";
+	static flags = {
+		config: Flags.string({ required: true }),
+		output: Flags.string({ required: true }),
+		help: Flags.help({ char: "h" })
+	};
+	async run() {
+		const { flags } = await this.parse(BehaviorCalibrateCommand);
+		const result = await calibrateBehavior(flags);
+		this.log(result.output);
+		if (result.exitCode) this.exit(result.exitCode);
+	}
+};
+
+//#endregion
+//#region src/testOutputs.ts
+async function identity(filename) {
+	const path = resolve(filename);
+	try {
+		const info = await stat(path);
+		if (!info.isFile()) throw new Error(`Expected a file path: ${path}`);
+		return {
+			path: await realpath(path),
+			inode: `${info.dev}:${info.ino}`
+		};
+	} catch (error) {
+		if (!(error instanceof Error) || !("code" in error) || error.code !== "ENOENT") throw error;
+		let ancestor = dirname(path);
+		const segments = [path.slice(ancestor.length + 1)];
+		for (;;) try {
+			return { path: resolve(await realpath(ancestor), ...segments) };
+		} catch (error) {
+			if (!(error instanceof Error) || !("code" in error) || error.code !== "ENOENT") throw error;
+			const parent = dirname(ancestor);
+			if (parent === ancestor) throw error;
+			segments.unshift(ancestor.slice(parent.length + 1));
+			ancestor = parent;
+		}
+	}
+}
+async function prepareTestOutputs(options) {
+	const inputs = [options.campaign, ...options.replay ? [options.replay] : []];
+	const outputs = [...options.report === "-" ? [] : [options.report], ...options.fixture ? [options.fixture] : []];
+	const seen = [];
+	for (const filename of [...inputs, ...outputs]) {
+		const id = await identity(filename);
+		if (seen.some((other) => other.path === id.path || id.inode && id.inode === other.inode)) throw new Error("Campaign, replay input, report and fixture must use distinct file paths.");
+		seen.push(id);
+	}
+	for (const filename of outputs) await mkdir(dirname(resolve(filename)), { recursive: true });
+}
+
+//#endregion
+//#region src/testCommand.ts
+var TestCommand = class TestCommand extends Command {
+	static enableJsonFlag = false;
+	static summary = "Run a trusted local model-based testing campaign.";
+	static description = "Imports and executes a trusted .mjs campaign with ordinary local permissions. This is not a sandbox. Install @statelyai/model-testing in the campaign project. Runs graph paths and property tests; --replay checks a saved counterexample as a regression. Exit 0 passes, 1 is a model/app discrepancy, 2 is inconclusive or an infrastructure failure.";
+	static args = { campaign: Args.string({
+		required: true,
+		description: "Trusted local .mjs campaign module"
+	}) };
+	static flags = {
+		report: Flags.string({
+			default: "statelyai-test-report.json",
+			description: "JSON report destination, or - for stdout"
+		}),
+		replay: Flags.string({ description: "JSON replay fixture from a previous campaign" }),
+		fixture: Flags.string({ description: "Write the property counterexample, or first available path counterexample, to this JSON file" }),
+		seed: Flags.integer({
+			description: "Generator seed",
+			default: 1
+		}),
+		runs: Flags.integer({
+			description: "Property trial budget",
+			default: 100
+		}),
+		"max-commands": Flags.integer({
+			description: "Maximum generated commands per trial",
+			default: 30
+		}),
+		"path-limit": Flags.integer({
+			description: "Maximum graph traversal steps",
+			default: 1e3
+		}),
+		timeout: Flags.integer({
+			description: "Whole worker deadline in milliseconds",
+			default: 12e4
+		})
+	};
+	async run() {
+		const { args, flags } = await this.parse(TestCommand);
+		try {
+			await prepareTestOutputs({
+				campaign: args.campaign,
+				replay: flags.replay,
+				report: flags.report,
+				fixture: flags.fixture
+			});
+			const replay = flags.replay ? modelTestReplaySchema.parse(JSON.parse(await readFile(flags.replay, "utf8"))) : void 0;
+			const report = await runCampaignFile(args.campaign, {
+				replay,
+				budget: {
+					seed: flags.seed,
+					numRuns: flags.runs,
+					maxCommands: flags["max-commands"],
+					pathLimit: flags["path-limit"],
+					timeoutMs: flags.timeout
+				},
+				onLog: (text) => process.stderr.write(text)
+			});
+			const json = `${JSON.stringify(report, null, 2)}\n`;
+			if (flags.report === "-") this.log(json.trimEnd());
+			else {
+				await writeFile(flags.report, json);
+				this.log(`${report.status}: ${report.phases.map((p) => `${p.phase}=${p.status}`).join(", ")}. Report ${flags.report}`);
+			}
+			if (flags.fixture) {
+				const fixture = reportReplays(report).at(-1);
+				if (fixture) await writeFile(flags.fixture, `${JSON.stringify(fixture, null, 2)}\n`);
+				else {
+					const existing = await readFile(flags.fixture).then(() => true, () => false);
+					process.stderr.write(existing ? "No new counterexample available. Existing fixture preserved; it does not belong to this run.\n" : "No portable counterexample available; fixture file was not written.\n");
+				}
+			}
+			const exit = campaignExitCode(report);
+			if (exit) this.exit(exit);
+		} catch (error) {
+			if (error instanceof Error && "oclif" in error) throw error;
+			this.error(error instanceof Error ? error.message : String(error), { exit: 2 });
+		}
+	}
+};
+
 //#endregion
 //#region src/loopCommands.ts
 /** An XGraph file, or a `.statelyai` head or version file (its `graph`). */
@@ -4279,7 +5601,185 @@ function createMachine(config, implementations) {
 }
 
 //#endregion
-//#region ../graph-tools/dist/validation-Ci3ri12U.mjs
+//#region ../graph-tools/dist/validation-D8ipdyfF.mjs
+function resolveProfileData(data, namespace) {
+	const prefix = `${namespace}.`;
+	return Object.fromEntries(Object.entries(data).filter(([key]) => key.startsWith(prefix)).map(([key, value]) => [key.slice(prefix.length), value]));
+}
+const ARCHITECTURE_PROFILE = "@statelyai/architecture@1.0.0";
+const ARCHITECTURE_NAMESPACE = "@statelyai.architecture";
+const architectureTargetSchema = z.discriminatedUnion("kind", [z.object({
+	kind: z.literal("machine"),
+	machineId: z.string().min(1),
+	projectId: z.string().min(1).optional()
+}), z.object({
+	kind: z.literal("view"),
+	viewId: z.string().min(1)
+})]);
+const architectureViewSchema = z.object({
+	id: z.string().min(1),
+	name: z.string().min(1),
+	kind: z.enum([
+		"system-context",
+		"container",
+		"component",
+		"custom"
+	]),
+	nodeIds: z.array(z.string()),
+	edgeIds: z.array(z.string())
+});
+const architectureGraphDataSchema = z.object({
+	version: z.literal(1),
+	views: z.array(architectureViewSchema),
+	activeViewId: z.string().optional(),
+	projectOverview: z.boolean().optional()
+});
+const architectureNodeDataSchema = z.object({
+	kind: z.string().optional(),
+	externalId: z.string().optional(),
+	technology: z.string().optional(),
+	target: architectureTargetSchema.optional()
+});
+const architectureEdgeDataSchema = z.object({
+	kind: z.string().optional(),
+	externalId: z.string().optional(),
+	technology: z.string().optional()
+});
+function architectureData(data) {
+	return resolveProfileData(Object.fromEntries(Object.entries(data)), ARCHITECTURE_NAMESPACE);
+}
+function getArchitectureNodeData(node) {
+	const data = architectureData(node.data);
+	if (!Object.keys(data).length) return void 0;
+	const parsed = architectureNodeDataSchema.safeParse(data);
+	return parsed.success ? parsed.data : void 0;
+}
+const jsonSchema7Schema = z.lazy(() => z.object({
+	$schema: z.string().optional(),
+	type: z.enum([
+		"object",
+		"array",
+		"string",
+		"number",
+		"integer",
+		"boolean",
+		"null"
+	]).optional(),
+	properties: z.record(z.string(), jsonSchema7Schema).optional(),
+	items: jsonSchema7Schema.optional(),
+	additionalProperties: z.union([z.boolean(), jsonSchema7Schema]).optional(),
+	required: z.array(z.string()).optional(),
+	anyOf: z.array(jsonSchema7Schema).optional(),
+	oneOf: z.array(jsonSchema7Schema).optional(),
+	enum: z.array(z.union([
+		z.string(),
+		z.number(),
+		z.boolean(),
+		z.null()
+	])).optional(),
+	const: z.union([
+		z.string(),
+		z.number(),
+		z.boolean(),
+		z.null()
+	]).optional(),
+	minLength: z.number().optional()
+}).strict());
+function draft7Schema(schema) {
+	return jsonSchema7Schema.parse(z.toJSONSchema(schema, { target: "draft-7" }));
+}
+const ARCHITECTURE_PROFILE_MANIFEST = {
+	profile: ARCHITECTURE_PROFILE,
+	namespace: ARCHITECTURE_NAMESPACE,
+	lineage: "@statelyai/architecture",
+	projection: {
+		readOnlyPaths: [
+			"initialNodeId",
+			"nodes.*.initialNodeId",
+			"nodes.*.data.initialId",
+			"nodes.*.data.entry",
+			"nodes.*.data.exit",
+			"nodes.*.data.invokes",
+			"nodes.*.data.history",
+			"edges.*.data.guard",
+			"edges.*.data.actions",
+			"edges.*.data.transitionType"
+		],
+		adapt: (graph) => ({ data: {
+			nodes: Object.fromEntries(graph.nodes.map((node) => [node.id, { kind: getArchitectureNodeData(node)?.kind ?? "component" }])),
+			edges: Object.fromEntries(graph.edges.map((edge) => [edge.id, { kind: "relationship" }]))
+		} }),
+		analyzeCompatibility: (graph) => graph.nodes.some((node) => node.data.initialId || Array.isArray(node.data.entry) && node.data.entry.length || Array.isArray(node.data.exit) && node.data.exit.length || Array.isArray(node.data.invokes) && node.data.invokes.length) || graph.edges.some((edge) => edge.data.guard || Array.isArray(edge.data.actions) && edge.data.actions.length || edge.data.transitionType && edge.data.transitionType !== "normal") ? [{
+			level: "warning",
+			message: "State-machine initial states, effects, guards and transition behavior are retained but read-only in Architecture. Relationships describe structure; architecture simulation is unavailable."
+		}] : []
+	},
+	name: "Architecture",
+	description: "Components, relationships, and navigable system views.",
+	selectable: true,
+	restrictFormatsToListed: true,
+	defaultFormat: "xgraph",
+	graph: { dataSchema: draft7Schema(architectureGraphDataSchema) },
+	authoring: {
+		terminology: {
+			node: "component",
+			edge: "relationship",
+			graph: "architecture"
+		},
+		nodeTypes: [
+			"element",
+			"actor",
+			"person",
+			"system",
+			"container",
+			"component",
+			"service",
+			"database",
+			"queue",
+			"group",
+			"junction"
+		].map((kind) => ({
+			kind,
+			label: kind.charAt(0).toUpperCase() + kind.slice(1),
+			authorable: true,
+			canContain: true,
+			dataSchema: draft7Schema(architectureNodeDataSchema)
+		})),
+		edgeTypes: [{
+			kind: "relationship",
+			label: "Relationship",
+			authorable: true,
+			dataSchema: draft7Schema(architectureEdgeDataSchema)
+		}],
+		attachments: {
+			actions: false,
+			guards: false,
+			invokes: false,
+			tags: false
+		},
+		supportsInitialNode: false,
+		supportsTargetlessEdges: false,
+		supportsReenterEdges: false
+	},
+	operations: {
+		simulate: false,
+		validate: true,
+		export: true
+	},
+	formats: [{
+		format: "xgraph",
+		import: true,
+		export: true
+	}, ...[
+		"structurizr-json",
+		"d2",
+		"mermaid"
+	].map((format) => ({
+		format,
+		import: true,
+		export: false
+	}))]
+};
 const XSTATE_V5_PROFILE = "@statelyai/xstate@5.30.0";
 const XSTATE_V6_PROFILE = "@statelyai/xstate@6.0.0-alpha.51";
 const XSTATE_V6_BRANCH_DESCRIPTION_META = "@statelyai.branchDescription";
@@ -5535,7 +7035,11 @@ const XSTATE_PROFILE_MANIFESTS = [{
 		export: true
 	}
 }];
-const PROFILE_MANIFESTS = new Map([...XSTATE_PROFILE_MANIFESTS, LANGGRAPH_PROFILE_MANIFEST].map((manifest) => [manifest.profile, manifest]));
+const PROFILE_MANIFESTS = new Map([
+	...XSTATE_PROFILE_MANIFESTS,
+	LANGGRAPH_PROFILE_MANIFEST,
+	ARCHITECTURE_PROFILE_MANIFEST
+].map((manifest) => [manifest.profile, manifest]));
 function getProfileManifest(profile) {
 	return PROFILE_MANIFESTS.get(profile);
 }
@@ -11905,6 +13409,14 @@ function builtInActionFromCall(call, bindings, context, depth) {
 				...options(2)
 			}
 		};
+		case "sendParent": return {
+			type: "xstate.sendTo",
+			params: {
+				to: "#_parent",
+				event: value(0),
+				...options(1)
+			}
+		};
 		case "emit": return {
 			type: "xstate.emit",
 			params: { event: value(0) }
@@ -21347,10 +22859,6 @@ function sourceLocationUris(sourceLocations) {
 	].filter((uri) => Boolean(uri)))];
 }
 
-//#endregion
-//#region src/version.ts
-const CLI_VERSION = "0.14.3";
-
 //#endregion
 //#region src/cliHost.ts
 const DEFAULT_SYNC_MAX_FILES = 1e3;
@@ -24809,6 +26317,10 @@ var WhoamiCommand = class extends Command {
 	}
 };
 const COMMANDS = {
+	"behavior:calibrate": BehaviorCalibrateCommand,
+	"behavior:check": BehaviorCheckCommand,
+	"behavior:adopt": BehaviorAdoptCommand,
+	test: TestCommand,
 	verify: VerifyCommand,
 	plan: PlanCommand,
 	diff: DiffCommand,
@@ -24848,4 +26360,4 @@ function isDirectExecution() {
 if (isDirectExecution()) run$1();
 
 //#endregion
-export { formatVerificationJUnit as A, run$1 as C, resourceId as D, linkProject as E, readGraphFile as F, verifyReport as I, briefReport as M, changesReport as N, resolveVerificationRequest as O, pendingReport as P, resolveProjectStatus as S, scanProjectSources as T, isFileGitDirty as _, discoverMachinesInSource as a, resolveCredentialStatus as b, formatDiscoveredMachines as c, formatProjectStatus as d, formatStoredCredentialSource as f, initProject as g, inferInitProjectName as h, discoverLinkedPullTargets as i, createStatelyProjectConfig as j, verifyProject as k, formatMissingNewMachineDirMessage as l, getEnvCredential as m, buildOAuthLoginStart as n, discoverOAuthLogin as o, getEnvApiKey as p, classifyPushCandidates as r, discoverRemoteProjectMachineTargets as s, COMMANDS as t, formatPlanSummary as u, resolveApiKey as v, scanProjectMachines as w, resolveOpenRootDir as x, resolveConfiguredPullTargets as y };
+export { formatVerificationJUnit as A, calibrateBehavior as B, run$1 as C, resourceId as D, linkProject as E, readGraphFile as F, verifyReport as I, adoptBehavior as L, briefReport as M, changesReport as N, resolveVerificationRequest as O, pendingReport as P, behaviorCiConfigSchema as R, resolveProjectStatus as S, scanProjectSources as T, checkBehavior as V, isFileGitDirty as _, discoverMachinesInSource as a, resolveCredentialStatus as b, formatDiscoveredMachines as c, formatProjectStatus as d, formatStoredCredentialSource as f, initProject as g, inferInitProjectName as h, discoverLinkedPullTargets as i, createStatelyProjectConfig as j, verifyProject as k, formatMissingNewMachineDirMessage as l, getEnvCredential as m, buildOAuthLoginStart as n, discoverOAuthLogin as o, getEnvApiKey as p, classifyPushCandidates as r, discoverRemoteProjectMachineTargets as s, COMMANDS as t, formatPlanSummary as u, resolveApiKey as v, scanProjectMachines as w, resolveOpenRootDir as x, resolveConfiguredPullTargets as y, behaviorCiResultsSchema as z };