@fitlab-ai/agent-infra 0.9.13 → 0.9.15

package/dist/lib/internal/cli-route-inventory.js

@@ -0,0 +1,154 @@
+export const PUBLIC_CLI_COMMAND_ALIASES = Object.freeze({
+    '': 'help',
+    s: 'sandbox',
+    t: 'task',
+    '--version': 'version',
+    '-v': 'version'
+});
+export const PUBLIC_CLI_SELECTOR_ALIASES = Object.freeze({
+    task: Object.freeze({ d: 'decisions' })
+});
+export const PUBLIC_CLI_ROUTE_SELECTORS = Object.freeze({
+    'agent-client': ['list', 'status', 'enable', 'disable', 'configure'],
+    cp: ['cp'],
+    data: ['capture', 'verify', 'audit', 'repair', 'export'],
+    decide: ['decide'],
+    help: ['help'],
+    init: ['init'],
+    merge: ['merge'],
+    run: ['create-task', 'task-skill', 'recreate'],
+    sandbox: ['create', 'exec', 'ls', 'show', 'prune', 'rebuild', 'refresh', 'rm', 'start', 'vm'],
+    server: ['start', 'stop', 'status', 'logs', '__daemon'],
+    task: ['cat', 'decisions', 'files', 'grep', 'issue-body', 'log', 'ls', 'show', 'status'],
+    sync: ['sync'],
+    update: ['update'],
+    version: ['version']
+});
+/**
+ * The selector definitions consumed by every internal handler. Keep this
+ * module free of handler imports so the pre-import task-view guard remains
+ * effective.
+ */
+export const INTERNAL_HANDLER_ROUTE_SELECTORS = Object.freeze({
+    'task-create': ['input'],
+    'task-qualification': ['proposal', 'confirm', 'supersede', 'revoke'],
+    'sandbox-control': ['serve', 'execute', 'recover', 'client'],
+    'host-control': ['serve', 'status', 'install', 'uninstall'],
+    'agent-client': ['next-steps', 'model-selection'],
+    'codex-lifecycle': ['preflight', 'capability-arm', 'hook-event', 'resolve-start', 'resolve-stop', 'consume'],
+    'codex-sandbox-controller': ['verify-context', 'run'],
+    'git-workflow': ['inspect', 'preview-tree', 'snapshot', 'compare-trees', 'commit', 'push-rebased'],
+    'task-delivery': ['deliver'],
+    'release-workflow': ['inspect', 'prepare', 'publish', 'post-prepare', 'post-publish'],
+    'platform-release-notes': ['context', 'stage', 'publish'],
+    'platform-security': ['read', 'dismiss'],
+    'platform-metadata': ['init-labels', 'init-milestones'],
+    'platform-context': ['resolve'],
+    'platform-comment': ['list', 'owner', 'backfill', 'sync'],
+    'platform-issue': ['inspect', 'create', 'bind', 'sync'],
+    'platform-pr': ['inspect', 'summary-context', 'resolve-external', 'create', 'bind', 'skip', 'sync', 'change-report', 'summary-sync', 'sync-in-labels'],
+    'platform-pr-review': ['inspect', 'list', 'publish-pr', 'publish-task'],
+    'pr-review-grade': ['decide', 'resolve-host', 'verify-artifact'],
+    'platform-checks': ['inspect', 'watch', 'resolve-run', 'logs'],
+    'task-context': ['resolve'],
+    'task-ledger': ['decision-next-id', 'stage-status', 'finding-upsert', 'finding-respond', 'finding-review', 'decision-upsert', 'rework-intent-upsert'],
+    'task-warning': ['list', 'add', 'set-status'],
+    'task-activity': ['pr-review-inspect', 'pr-review-start', 'pr-review-complete', 'pr-review-terminate'],
+    'task-artifact': ['inspect', 'init', 'repair', 'finalize-local'],
+    'task-orchestration': ['status', 'progress'],
+    'task-review': ['finalize-summary'],
+    'task-event': ['event'],
+    'task-invalidation': ['reconcile'],
+    'task-override': ['diagnose', 'issue', 'consume'],
+    'task-lifecycle': ['intent'],
+    'task-finalization': ['complete'],
+    'task-short-id': ['list', 'list-verify', 'alloc', 'release', 'resolve'],
+    'task-snapshot': ['snapshot'],
+    'task-verify': ['event'],
+    'task-validate': ['snapshot', 'inplace'],
+    'manual-validation': ['transaction']
+});
+export const INTERNAL_CLI_ROUTE_SELECTORS = INTERNAL_HANDLER_ROUTE_SELECTORS;
+function first(args) {
+    return args[0] ?? '';
+}
+function optionValue(args, name) {
+    const index = args.indexOf(name);
+    if (index >= 0)
+        return args[index + 1];
+    const prefix = `${name}=`;
+    return args.find((arg) => arg.startsWith(prefix))?.slice(prefix.length);
+}
+export function internalRouteSelector(command, args) {
+    if (command === 'sandbox-control')
+        return first(args);
+    if (command === 'task-create')
+        return 'input';
+    if (command === 'task-qualification')
+        return args[1] ?? '';
+    if (command === 'task-lifecycle')
+        return args[1] ? 'intent' : '';
+    if (command === 'task-finalization')
+        return args[1] === 'complete' ? 'complete' : '';
+    if (command === 'task-event')
+        return args[1] ? 'event' : '';
+    if (command === 'task-verify')
+        return args[0] && args[1] ? 'event' : '';
+    if (command === 'task-snapshot')
+        return 'snapshot';
+    if (command === 'task-validate')
+        return optionValue(args, '--scope') ?? 'snapshot';
+    if (command === 'task-short-id')
+        return first(args) === 'list' && args.includes('--verify') ? 'list-verify' : first(args);
+    if (command === 'task-orchestration')
+        return args[1] === 'status' ? 'status' : args[1] ? 'progress' : '';
+    if (command === 'task-review')
+        return args[1] ?? '';
+    if (command === 'task-invalidation')
+        return args[1] ?? '';
+    if (command === 'task-override')
+        return args[1] ?? '';
+    if (command === 'task-artifact')
+        return args[1] ?? '';
+    if (command === 'platform-pr-review' && first(args) === 'publish') {
+        const scope = optionValue(args, '--scope') ?? '';
+        return /^TASK-\d{8}-\d{6}$/u.test(scope) ? 'publish-task' : /^pr\d+$/u.test(scope) ? 'publish-pr' : '';
+    }
+    if (['task-ledger', 'task-warning', 'task-activity'].includes(command))
+        return args[1] ?? '';
+    if (command === 'task-delivery')
+        return args[1] ?? '';
+    if (command === 'task-context')
+        return first(args);
+    return first(args);
+}
+export function isInternalHandlerRoute(command, args) {
+    if (args[0] === '--help' || args[0] === '-h')
+        return true;
+    const selector = internalRouteSelector(command, args);
+    const selectors = INTERNAL_HANDLER_ROUTE_SELECTORS[command];
+    return Boolean(selector && selectors?.some((candidate) => candidate === selector));
+}
+/**
+ * Marks a selector at the handler's actual dispatch branch.
+ *
+ * The call is intentionally side-effect free so the top-level task-view guard
+ * can still run before a handler module is imported. Route coverage tests read
+ * these branch markers independently from the pre-import inventory.
+ */
+export function internalHandlerRoute(command, selector, actualSelector) {
+    return command.length > 0 && selector === actualSelector;
+}
+export function ensureInternalHandlerRoute(command, args) {
+    if (isInternalHandlerRoute(command, args))
+        return true;
+    const selector = internalRouteSelector(command, args);
+    process.stdout.write(`${JSON.stringify({
+        status: 'failed',
+        changed: false,
+        error: { code: 'INTERNAL_ROUTE_UNREGISTERED', message: `operation '${command} ${selector || first(args)}' is not registered` }
+    })}\n`);
+    process.exitCode = 1;
+    return false;
+}
+//# sourceMappingURL=cli-route-inventory.js.map

package/dist/lib/internal/codex-lifecycle.js

@@ -10,6 +10,7 @@ import { verifyCodexSandboxControllerContextWithWarnings } from '../agent-client
 import { resolveTaskRef } from '../task/resolve-ref.js';
 import { hasSealableOrchestrationDelegation } from '../task/orchestration.js';
 import { activateCodexOrchestrationDelegation, activateCodexSpawnDelegation, reconcileCodexOrchestrationDelegation, sealCodexOrchestrationDelegation, sealCodexParentDelegation } from '../task/codex-orchestration.js';
+import { ensureInternalHandlerRoute, internalHandlerRoute } from './cli-route-inventory.js';
 const USAGE = 'Usage: agent-infra-internal codex-lifecycle <capability-arm|hook-event|resolve-start|resolve-stop|preflight|consume> [options]\n';
 const MANAGED_AGENT = /^agent-infra-lifecycle-(executor|reviewer)$/;
 function output(value) {
@@ -144,11 +145,13 @@ function payloadText(payload, key) {
         : '';
 }
 async function codexLifecycle(args = []) {
+    if (!ensureInternalHandlerRoute('codex-lifecycle', args))
+        return;
     const parsed = parse(args);
     if (!parsed || process.exitCode)
         return;
     try {
-        if (parsed.operation === 'preflight') {
+        if (internalHandlerRoute('codex-lifecycle', 'preflight', parsed.operation)) {
             const format = parsed.values['--format'] ?? 'json';
             if (!['text', 'json'].includes(format))
                 throw new Error("format must be 'text' or 'json'");
@@ -173,7 +176,7 @@ async function codexLifecycle(args = []) {
                 output({ status: 'ready', changed: false, evidence: result, diagnostics: result.diagnostics, error: null });
             return;
         }
-        if (parsed.operation === 'capability-arm') {
+        if (internalHandlerRoute('codex-lifecycle', 'capability-arm', parsed.operation)) {
             const taskId = parsed.values['--task-id'];
             if (!taskId)
                 throw new Error('capability-arm requires --task-id');
@@ -188,7 +191,7 @@ async function codexLifecycle(args = []) {
             output({
                 status: 'armed',
                 changed: true,
-                capabilityToken: armed.token,
+                capabilityRef: armed.capabilityRef,
                 marker: armed.marker,
                 expiresAt: armed.expiresAt,
                 buildIdentity: armed.buildIdentity,
@@ -197,7 +200,7 @@ async function codexLifecycle(args = []) {
             return;
         }
         const store = createCodexLifecycleStore({ cliVersion: cliVersion() });
-        if (parsed.operation === 'hook-event') {
+        if (internalHandlerRoute('codex-lifecycle', 'hook-event', parsed.operation)) {
             const phase = parsed.values['--event'];
             if (!phase || !['pre-tool', 'subagent-start', 'post-tool', 'subagent-stop'].includes(phase)) {
                 throw new Error('hook-event requires a known --event');
@@ -207,12 +210,12 @@ async function codexLifecycle(args = []) {
             }
             const payload = await readStdin();
             if (phase === 'post-tool') {
-                const capabilityToken = payloadText(payload, 'capabilityToken');
-                if (capabilityToken) {
+                const capabilityRef = payloadText(payload, 'capabilityRef');
+                if (capabilityRef) {
                     const capabilityStore = createCodexCapabilityStore();
-                    const armed = capabilityStore.inspect(capabilityToken);
-                    const capability = createCodexCapabilityStore().attest({
-                        token: capabilityToken,
+                    const armed = capabilityStore.inspectReference(capabilityRef);
+                    const capability = capabilityStore.attestByReference({
+                        capabilityRef,
                         sessionId: payloadText(payload, 'sessionId'),
                         turnId: payloadText(payload, 'turnId'),
                         toolUseId: payloadText(payload, 'toolUseId'),
@@ -337,7 +340,7 @@ async function codexLifecycle(args = []) {
         const childThreadId = parsed.values['--child-id'];
         if (!childThreadId)
             throw new Error(`operation '${parsed.operation}' requires --child-id`);
-        if (parsed.operation === 'resolve-start') {
+        if (internalHandlerRoute('codex-lifecycle', 'resolve-start', parsed.operation)) {
             if (store.read(childThreadId).state.spawn?.hookDefinitionHash !== hookDefinitionHash()) {
                 throw new Error('Codex lifecycle hook definition hash is stale');
             }
@@ -351,7 +354,7 @@ async function codexLifecycle(args = []) {
                 process.exitCode = 1;
             return;
         }
-        if (parsed.operation === 'resolve-stop') {
+        if (internalHandlerRoute('codex-lifecycle', 'resolve-stop', parsed.operation)) {
             const stopTurnId = store.read(childThreadId).state.stop?.turnId;
             if (!stopTurnId)
                 throw new Error('Codex lifecycle stop hook is not available');
@@ -363,7 +366,7 @@ async function codexLifecycle(args = []) {
             output({ status: latest.state.status, changed: true, evidence: latest.state.stopEvidence, diagnostics: [], error: latest.state.error });
             return;
         }
-        if (parsed.operation === 'consume') {
+        if (internalHandlerRoute('codex-lifecycle', 'consume', parsed.operation)) {
             const consumer = parsed.values['--consumer'];
             if (!consumer)
                 throw new Error('consume requires --consumer');

package/dist/lib/internal/codex-sandbox-controller.js

@@ -1,4 +1,5 @@
 import { runCodexSandboxController, verifyCodexSandboxControllerContextWithWarnings } from '../agent-clients/adapters/codex-lifecycle/sandbox-controller.js';
+import { ensureInternalHandlerRoute, internalHandlerRoute } from './cli-route-inventory.js';
 const USAGE = 'Usage: agent-infra-internal codex-sandbox-controller <run|verify-context> [options]\n';
 function fail(code, message, exitCode = 1) {
     process.stdout.write(`${JSON.stringify({
@@ -14,7 +15,10 @@ function parse(args) {
         return null;
     }
     const operation = args[0];
-    if (!operation || !['run', 'verify-context'].includes(operation)) {
+    if (!operation || ![
+        internalHandlerRoute('codex-sandbox-controller', 'run', operation),
+        internalHandlerRoute('codex-sandbox-controller', 'verify-context', operation)
+    ].some(Boolean)) {
         process.stderr.write(USAGE);
         fail('CODEX_SANDBOX_CONTROLLER_PAYLOAD_INVALID', 'operation must be run or verify-context', 2);
         return null;
@@ -44,11 +48,13 @@ function parse(args) {
     return { operation, values };
 }
 async function codexSandboxController(args = []) {
+    if (!ensureInternalHandlerRoute('codex-sandbox-controller', args))
+        return;
     const parsed = parse(args);
     if (!parsed || process.exitCode)
         return;
     try {
-        if (parsed.operation === 'verify-context') {
+        if (internalHandlerRoute('codex-sandbox-controller', 'verify-context', parsed.operation)) {
             const contextPath = parsed.values['--context']
                 ?? process.env.AGENT_INFRA_CODEX_CONTROLLER_CONTEXT;
             if (!contextPath)

package/dist/lib/internal/demo-promotion.js

@@ -0,0 +1,322 @@
+import crypto from 'node:crypto';
+import fs from 'node:fs';
+import path from 'node:path';
+const DEMO_ASSET_NAMES = ['gif', 'transcript', 'sha256'];
+const JOURNAL_RELATIVE_PATH = 'assets/.demo-init.promotion.json';
+const PROMOTION_DIR_PREFIX = '.demo-init.promotion-';
+function sha256Bytes(value) {
+    return crypto.createHash('sha256').update(value).digest('hex');
+}
+function sha256File(filePath, io = fs) {
+    return sha256Bytes(io.readFileSync(filePath));
+}
+function assetTargets(cwd) {
+    return {
+        gif: path.join(cwd, 'assets', 'demo-init.gif'),
+        transcript: path.join(cwd, 'assets', 'demo-init.transcript'),
+        sha256: path.join(cwd, 'assets', 'demo-init.transcript.sha256')
+    };
+}
+function journalPath(cwd) {
+    return path.join(cwd, JOURNAL_RELATIVE_PATH);
+}
+function isUnsupportedFsyncError(error) {
+    const code = error.code;
+    return code === 'EINVAL' || code === 'ENOSYS' || code === 'ENOTSUP' || code === 'EPERM';
+}
+function syncFile(filePath, io) {
+    if (!io.openSync || !io.closeSync || !io.fsyncSync)
+        return;
+    const descriptor = io.openSync(filePath, 'r');
+    try {
+        try {
+            io.fsyncSync(descriptor);
+        }
+        catch (error) {
+            if (!isUnsupportedFsyncError(error))
+                throw error;
+        }
+    }
+    finally {
+        io.closeSync(descriptor);
+    }
+}
+function writeJournal(cwd, journal, io) {
+    const target = journalPath(cwd);
+    const temporary = `${target}.tmp-${process.pid}`;
+    io.writeFileSync(temporary, `${JSON.stringify(journal, null, 2)}\n`);
+    syncFile(temporary, io);
+    try {
+        io.renameSync(temporary, target);
+    }
+    catch (error) {
+        try {
+            io.unlinkSync(temporary);
+        }
+        catch { /* preserve primary error */ }
+        throw error;
+    }
+}
+function existingRegularFile(filePath, io) {
+    if (!io.existsSync(filePath))
+        return false;
+    const stat = io.lstatSync(filePath);
+    if (!stat.isFile() || stat.isSymbolicLink())
+        throw new Error(`promotion target is not a regular file: ${filePath}`);
+    return true;
+}
+function removeIfPresent(filePath, io) {
+    if (io.existsSync(filePath))
+        io.unlinkSync(filePath);
+}
+function samePath(left, right) {
+    return path.normalize(path.resolve(left)) === path.normalize(path.resolve(right));
+}
+function pathIsInside(root, candidate) {
+    const relative = path.relative(root, candidate);
+    return relative !== '' && !path.isAbsolute(relative) && relative !== '..' && !relative.startsWith(`..${path.sep}`);
+}
+function existingStat(filePath, io) {
+    try {
+        return io.lstatSync(filePath);
+    }
+    catch (error) {
+        if (error.code === 'ENOENT')
+            return null;
+        throw error;
+    }
+}
+function validatePromotionJournal(cwd, journal, io) {
+    if (!journal || typeof journal !== 'object')
+        throw new Error('promotion journal is invalid');
+    if (journal.version !== 1 || !['prepared', 'promoting', 'committed'].includes(journal.phase)) {
+        throw new Error('promotion journal is invalid');
+    }
+    if (typeof journal.generation !== 'string' || !journal.generation || /[\r\n]/u.test(journal.generation)) {
+        throw new Error('promotion journal generation is invalid');
+    }
+    if (!Array.isArray(journal.entries) || journal.entries.length !== DEMO_ASSET_NAMES.length) {
+        throw new Error('promotion journal entries are invalid');
+    }
+    if (!Number.isInteger(journal.currentIndex) || journal.currentIndex < -1 || journal.currentIndex >= journal.entries.length) {
+        throw new Error('promotion journal index is invalid');
+    }
+    const assets = path.join(cwd, 'assets');
+    const assetsStat = existingStat(assets, io);
+    if (!assetsStat || assetsStat.isSymbolicLink() || !assetsStat.isDirectory()) {
+        throw new Error('promotion assets directory is invalid');
+    }
+    if (typeof journal.directory !== 'string' || path.isAbsolute(journal.directory)) {
+        throw new Error('promotion journal directory is invalid');
+    }
+    const directory = path.resolve(cwd, journal.directory);
+    const directoryName = path.basename(directory);
+    if (!directoryName.startsWith(PROMOTION_DIR_PREFIX) || directoryName === PROMOTION_DIR_PREFIX
+        || journal.directory !== path.relative(cwd, directory)
+        || !samePath(directory, path.join(assets, directoryName))) {
+        throw new Error('promotion journal directory is invalid');
+    }
+    const directoryStat = existingStat(directory, io);
+    if (directoryStat && (directoryStat.isSymbolicLink() || !directoryStat.isDirectory())) {
+        throw new Error('promotion journal directory is invalid');
+    }
+    const targets = assetTargets(cwd);
+    for (const [index, name] of DEMO_ASSET_NAMES.entries()) {
+        const entry = journal.entries[index];
+        if (!entry || entry.name !== name || typeof entry.target !== 'string' || typeof entry.staging !== 'string'
+            || typeof entry.backup !== 'string' || typeof entry.existed !== 'boolean'
+            || (entry.oldSha256 !== null && typeof entry.oldSha256 !== 'string')
+            || typeof entry.newSha256 !== 'string') {
+            throw new Error('promotion journal entry is invalid');
+        }
+        const target = targets[name];
+        const staging = path.join(directory, path.basename(target));
+        const backup = path.join(directory, `old-${name}`);
+        if (!samePath(entry.target, target) || !samePath(entry.staging, staging) || !samePath(entry.backup, backup)) {
+            throw new Error(`promotion journal path is invalid: ${name}`);
+        }
+        for (const [label, filePath] of [['target', target], ['staging', staging], ['backup', backup]]) {
+            if (!pathIsInside(assets, filePath))
+                throw new Error(`promotion journal path is invalid: ${name}.${label}`);
+            const stat = existingStat(filePath, io);
+            if (stat && (stat.isSymbolicLink() || !stat.isFile())) {
+                throw new Error(`promotion journal path is invalid: ${name}.${label}`);
+            }
+        }
+        if (entry.existed !== (entry.oldSha256 !== null)) {
+            throw new Error(`promotion journal entry is invalid: ${name}`);
+        }
+    }
+    return journal;
+}
+function cleanupJournal(journal, cwd, io) {
+    for (const entry of journal.entries) {
+        removeIfPresent(entry.staging, io);
+        removeIfPresent(entry.backup, io);
+    }
+    io.rmSync(path.join(cwd, journal.directory), { recursive: true, force: true });
+    removeIfPresent(journalPath(cwd), io);
+}
+function verifyTargets(entries, io, expected) {
+    for (const entry of entries) {
+        if (!entry.existed && expected === 'old') {
+            if (io.existsSync(entry.target))
+                throw new Error(`old promotion target unexpectedly exists: ${entry.target}`);
+            continue;
+        }
+        if (!io.existsSync(entry.target))
+            throw new Error(`promotion target is missing: ${entry.target}`);
+        const actual = sha256File(entry.target, io);
+        const wanted = expected === 'old' ? entry.oldSha256 : entry.newSha256;
+        if (!wanted || actual !== wanted)
+            throw new Error(`promotion target has unexpected content: ${entry.target}`);
+    }
+}
+function restoreOld(journal, io) {
+    for (const entry of [...journal.entries].reverse()) {
+        if (!entry.existed) {
+            removeIfPresent(entry.target, io);
+            continue;
+        }
+        if (!io.existsSync(entry.backup) || sha256File(entry.backup, io) !== entry.oldSha256) {
+            throw new Error(`promotion backup is missing or corrupt: ${entry.backup}`);
+        }
+        const restore = `${entry.target}.restore-${process.pid}`;
+        io.copyFileSync(entry.backup, restore);
+        removeIfPresent(entry.target, io);
+        io.renameSync(restore, entry.target);
+    }
+    verifyTargets(journal.entries, io, 'old');
+}
+function recoveryFailure(error) {
+    return {
+        status: 'failed',
+        code: 'DEMO_PROMOTION_RECOVERY_REQUIRED',
+        message: error instanceof Error ? error.message : String(error)
+    };
+}
+function recoverDemoPromotion(cwd, io = fs) {
+    const target = journalPath(cwd);
+    if (!io.existsSync(target))
+        return null;
+    let journal;
+    try {
+        const journalStat = io.lstatSync(target);
+        if (journalStat.isSymbolicLink() || !journalStat.isFile())
+            throw new Error('promotion journal is invalid');
+        journal = JSON.parse(io.readFileSync(target, 'utf8'));
+        journal = validatePromotionJournal(cwd, journal, io);
+        if (journal.phase === 'committed') {
+            try {
+                verifyTargets(journal.entries, io, 'new');
+            }
+            catch {
+                restoreOld(journal, io);
+            }
+        }
+        else {
+            restoreOld(journal, io);
+        }
+        cleanupJournal(journal, cwd, io);
+        return { status: 'committed', code: null, message: null };
+    }
+    catch (error) {
+        return recoveryFailure(error);
+    }
+}
+function createDemoPromotion(cwd, transcript) {
+    const assets = path.join(cwd, 'assets');
+    const directory = fs.mkdtempSync(path.join(assets, PROMOTION_DIR_PREFIX));
+    const staging = {
+        gif: path.join(directory, 'demo-init.gif'),
+        transcript: path.join(directory, 'demo-init.transcript'),
+        sha256: path.join(directory, 'demo-init.transcript.sha256')
+    };
+    const sha256 = sha256Bytes(Buffer.from(transcript, 'utf8'));
+    fs.writeFileSync(staging.transcript, transcript);
+    fs.writeFileSync(staging.sha256, `${sha256}\n`);
+    return { directory, staging, sha256 };
+}
+function promoteDemoAssets(cwd, staging, generation, io = fs) {
+    const targets = assetTargets(cwd);
+    const directory = path.relative(cwd, path.dirname(staging.gif));
+    const journal = {
+        version: 1,
+        generation,
+        phase: 'prepared',
+        currentIndex: -1,
+        directory,
+        entries: []
+    };
+    try {
+        for (const name of DEMO_ASSET_NAMES) {
+            if (!io.existsSync(staging[name]))
+                throw new Error(`staged demo asset is missing: ${staging[name]}`);
+            const target = targets[name];
+            const backup = path.join(path.dirname(staging[name]), `old-${name}`);
+            const existed = existingRegularFile(target, io);
+            const oldSha256 = existed ? sha256File(target, io) : null;
+            if (existed) {
+                io.copyFileSync(target, backup);
+                if (sha256File(backup, io) !== oldSha256)
+                    throw new Error(`promotion backup verification failed: ${target}`);
+            }
+            journal.entries.push({
+                name, target, staging: staging[name], backup, existed, oldSha256,
+                newSha256: sha256File(staging[name], io)
+            });
+        }
+        writeJournal(cwd, journal, io);
+        for (let index = 0; index < journal.entries.length; index += 1) {
+            journal.phase = 'promoting';
+            journal.currentIndex = index;
+            writeJournal(cwd, journal, io);
+            const entry = journal.entries[index];
+            removeIfPresent(entry.target, io);
+            io.renameSync(entry.staging, entry.target);
+            if (sha256File(entry.target, io) !== entry.newSha256)
+                throw new Error(`promoted asset verification failed: ${entry.target}`);
+            writeJournal(cwd, journal, io);
+        }
+        verifyTargets(journal.entries, io, 'new');
+        journal.phase = 'committed';
+        writeJournal(cwd, journal, io);
+        try {
+            cleanupJournal(journal, cwd, io);
+        }
+        catch (error) {
+            return {
+                status: 'failed',
+                code: 'DEMO_PROMOTION_CLEANUP_FAILED',
+                message: error instanceof Error ? error.message : String(error)
+            };
+        }
+        return { status: 'committed', code: null, message: null };
+    }
+    catch (error) {
+        try {
+            if (io.existsSync(journalPath(cwd))) {
+                const persisted = validatePromotionJournal(cwd, JSON.parse(io.readFileSync(journalPath(cwd), 'utf8')), io);
+                if (persisted.phase === 'committed') {
+                    verifyTargets(persisted.entries, io, 'new');
+                    return {
+                        status: 'failed',
+                        code: 'DEMO_PROMOTION_CLEANUP_FAILED',
+                        message: error instanceof Error ? error.message : String(error)
+                    };
+                }
+                restoreOld(persisted, io);
+                cleanupJournal(persisted, cwd, io);
+            }
+            else {
+                io.rmSync(path.dirname(staging.gif), { recursive: true, force: true });
+            }
+            return { status: 'failed', code: 'DEMO_PROMOTION_FAILED', message: error instanceof Error ? error.message : String(error) };
+        }
+        catch (rollbackError) {
+            return recoveryFailure(rollbackError);
+        }
+    }
+}
+export { DEMO_ASSET_NAMES, JOURNAL_RELATIVE_PATH, assetTargets, createDemoPromotion, journalPath, promoteDemoAssets, recoverDemoPromotion, sha256Bytes };
+//# sourceMappingURL=demo-promotion.js.map