@fitlab-ai/agent-infra 0.9.3 → 0.9.4

package/dist/lib/internal/task-ledger.js

@@ -6,9 +6,10 @@ const USAGE = `Usage: agent-infra-internal task-ledger <task-ref> <intent> [inte
 const FLAGS = {
     '--stage': 'stage', '--review-artifact': 'reviewArtifact', '--ordinal': 'ordinal',
     '--severity': 'severity', '--evidence': 'evidence', '--id': 'id', '--round': 'round',
-    '--status': 'status', '--artifact': 'artifact'
+    '--status': 'status', '--artifact': 'artifact', '--needs-implementation': 'needsImplementation'
 };
 const NUMERIC = new Set(['ordinal', 'round']);
+const BOOLEAN = new Set(['needsImplementation']);
 function usageFailure(message) {
     process.stdout.write(`${JSON.stringify({ status: 'failed', changed: false, error: { code: 'LEDGER_PAYLOAD_INVALID', message } })}\n`);
     process.stderr.write(USAGE);
@@ -55,8 +56,12 @@ function taskLedger(args = []) {
             usageFailure(`option '${flag}' requires a value`);
             return;
         }
+        if (BOOLEAN.has(key) && value !== 'true' && value !== 'false') {
+            usageFailure(`option '${flag}' must be true or false`);
+            return;
+        }
         seen.add(flag);
-        values[key] = NUMERIC.has(key) ? Number(value) : value;
+        values[key] = NUMERIC.has(key) ? Number(value) : BOOLEAN.has(key) ? value === 'true' : value;
     }
     const required = {
         'finding-upsert': ['stage', 'reviewArtifact', 'ordinal', 'severity', 'evidence'],
@@ -66,7 +71,11 @@ function taskLedger(args = []) {
         'decision-upsert': ['id', 'stage', 'artifact'],
         'stage-status': ['stage']
     };
-    const allowed = new Set(['kind', 'taskRef', 'dryRun', ...required[kind]]);
+    const optional = {
+        'finding-review': ['needsImplementation'],
+        'decision-upsert': ['needsImplementation']
+    };
+    const allowed = new Set(['kind', 'taskRef', 'dryRun', ...required[kind], ...(optional[kind] ?? [])]);
     const unexpected = Object.keys(values).find((key) => !allowed.has(key));
     const missing = required[kind].find((key) => values[key] === undefined);
     if (unexpected) {

package/dist/lib/internal/task-lifecycle.js

@@ -1,5 +1,7 @@
 import { normalizeAgentToken, AGENT_USAGE_HINT } from '../agent-clients/tokens.js';
 import { applyTaskLifecycle, lifecycleIntentCatalog } from '../task/lifecycle.js';
+import { resolveTaskRef } from '../task/resolve-ref.js';
+import { TaskExecutionLockError, withTaskExecutionLock } from '../task/task-execution-lock.js';
 const USAGE = `Usage: agent-infra-internal task-lifecycle <N | TASK-id> <intent> --agent <agent> [intent flags] [--dry-run]\n\nIntents: ${lifecycleIntentCatalog.join(', ')}\n`;
 const FLAGS = {
     '--agent': 'agent', '--reason': 'reason', '--unblock-condition': 'unblockCondition',
@@ -56,7 +58,23 @@ function taskLifecycle(args = []) {
         return;
     }
     values.agent = agent;
-    const result = applyTaskLifecycle(values);
+    const resolved = resolveTaskRef(String(values.taskRef));
+    if (!resolved.ok) {
+        process.stdout.write(`${JSON.stringify({ status: 'failed', changed: false, error: { code: resolved.code, message: resolved.message } })}\n`);
+        process.exitCode = 1;
+        return;
+    }
+    let result;
+    try {
+        result = withTaskExecutionLock(resolved.repoRoot, resolved.taskId, `task-lifecycle.${String(values.intent)}`, () => applyTaskLifecycle(values));
+    }
+    catch (error) {
+        if (!(error instanceof TaskExecutionLockError))
+            throw error;
+        process.stdout.write(`${JSON.stringify({ status: 'failed', changed: false, error: { code: error.code, message: error.message } })}\n`);
+        process.exitCode = 1;
+        return;
+    }
     process.stdout.write(`${JSON.stringify(result)}\n`);
     if (result.status === 'failed')
         process.exitCode = 1;

package/dist/lib/internal/task-orchestration.js

@@ -1,7 +1,7 @@
 import { normalizeAgentToken, AGENT_USAGE_HINT } from '../agent-clients/tokens.js';
-import { activateMatchingOrchestrationDelegation, activateOrchestrationDelegation, advanceOrchestration, beginOrResumeOrchestration, completeCommitOrchestrationStage, pauseOrchestration, prepareOrchestrationDelegation, routeOrchestration, sealMatchingOrchestrationDelegation, sealOrchestrationDelegation, statusOrchestration } from '../task/orchestration.js';
+import { abortCommitIntent, activateMatchingOrchestrationDelegation, activateOrchestrationDelegation, advanceOrchestration, beginCommitIntent, beginOrResumeOrchestration, checkpointCommitIntent, completeCommitIntent, pauseOrchestration, prepareOrchestrationDelegation, recoverCommitIntent, routeOrchestration, sealMatchingOrchestrationDelegation, sealOrchestrationDelegation, statusCommitIntent, statusOrchestration } from '../task/orchestration.js';
 import { isAgentClientId } from '../agent-clients/types.js';
-const USAGE = 'Usage: agent-infra-internal task-orchestration <task-ref|auto> <begin-or-resume|route|prepare|hook-start|stage-completed|hook-stop|advance|pause|status> [options]\n';
+const USAGE = 'Usage: agent-infra-internal task-orchestration <task-ref|auto> <begin-or-resume|route|prepare|hook-start|hook-stop|advance|pause|status|commit-begin|commit-checkpoint|commit-complete|commit-recover|commit-abort|commit-status> [options]\n';
 function usageFailure(message) {
     process.stdout.write(`${JSON.stringify({
         status: 'failed', changed: false,
@@ -20,21 +20,35 @@ function taskOrchestration(args = []) {
         return;
     }
     const [taskRef, intent] = args;
-    if (!['begin-or-resume', 'route', 'prepare', 'hook-start', 'stage-completed', 'hook-stop', 'advance', 'pause', 'status'].includes(intent)) {
+    if (![
+        'begin-or-resume', 'route', 'prepare', 'hook-start', 'hook-stop', 'advance', 'pause', 'status',
+        'commit-begin', 'commit-checkpoint', 'commit-complete', 'commit-recover', 'commit-abort', 'commit-status'
+    ].includes(intent)) {
         usageFailure(`unknown intent '${intent}'`);
         return;
     }
     const values = {};
     const seen = new Set();
+    let orchestrated = false;
     for (let index = 2; index < args.length; index += 1) {
         const flag = args[index];
+        if (flag === '--orchestrated') {
+            if (seen.has(flag)) {
+                usageFailure(`duplicate option '${flag}'`);
+                return;
+            }
+            seen.add(flag);
+            orchestrated = true;
+            continue;
+        }
         if (![
             '--max-steps', '--executor-model', '--executor-reasoning-effort',
             '--reviewer-model', '--reviewer-reasoning-effort',
             '--client', '--requested-model', '--requested-reasoning-effort', '--parent-id', '--before-fingerprint',
             '--native-agent', '--child-id', '--spawn-mode', '--actual-model', '--actual-reasoning-effort',
             '--model-fallback-reason', '--reasoning-effort-fallback-reason',
-            '--exit-code', '--after-fingerprint', '--changed-paths', '--code', '--message', '--recoverable', '--agent'
+            '--exit-code', '--after-fingerprint', '--changed-paths', '--code', '--message', '--recoverable', '--agent',
+            '--baseline-head', '--token', '--kind', '--head', '--remote', '--ref', '--expected-head'
         ].includes(flag)) {
             usageFailure(`unknown option '${flag}'`);
             return;
@@ -51,13 +65,116 @@ function taskOrchestration(args = []) {
         }
         values[flag] = value;
     }
+    const commitIntentFlags = {
+        'commit-begin': ['--agent', '--baseline-head', '--orchestrated'],
+        'commit-checkpoint': ['--token', '--kind', '--head', '--remote', '--ref'],
+        'commit-complete': ['--token', '--agent'],
+        'commit-recover': ['--agent'],
+        'commit-abort': ['--token', '--expected-head'],
+        'commit-status': []
+    };
+    if (intent in commitIntentFlags) {
+        const allowed = commitIntentFlags[intent];
+        const invalid = [...seen].find((flag) => !allowed.includes(flag));
+        if (invalid) {
+            usageFailure(`intent '${intent}' does not accept '${invalid}'`);
+            return;
+        }
+    }
+    else {
+        const commitOnly = [...seen].find((flag) => [
+            '--orchestrated', '--baseline-head', '--token', '--kind', '--head', '--remote', '--ref', '--expected-head'
+        ].includes(flag));
+        if (commitOnly) {
+            usageFailure(`intent '${intent}' does not accept '${commitOnly}'`);
+            return;
+        }
+    }
     const requireValues = (flags) => flags.find((flag) => values[flag] === undefined);
     if (values['--client'] !== undefined && !isAgentClientId(values['--client'])) {
         usageFailure(`unknown client '${values['--client']}'`);
         return;
     }
     let result;
-    if (intent === 'begin-or-resume') {
+    if (intent === 'commit-begin') {
+        const missing = requireValues(['--agent', '--baseline-head']);
+        if (missing) {
+            usageFailure(`intent 'commit-begin' requires '${missing}'`);
+            return;
+        }
+        const agent = normalizeAgentToken(values['--agent']);
+        if (!agent) {
+            usageFailure(`invalid --agent '${values['--agent']}': ${AGENT_USAGE_HINT}`);
+            return;
+        }
+        result = beginCommitIntent(taskRef, {
+            agent, orchestrated, baselineHead: values['--baseline-head']
+        });
+    }
+    else if (intent === 'commit-checkpoint') {
+        const missing = requireValues(['--token', '--kind', '--head']);
+        if (missing) {
+            usageFailure(`intent 'commit-checkpoint' requires '${missing}'`);
+            return;
+        }
+        if (!['committed', 'pushed'].includes(values['--kind'])) {
+            usageFailure('--kind must be committed or pushed');
+            return;
+        }
+        if (values['--kind'] === 'pushed') {
+            const pushedMissing = requireValues(['--remote', '--ref']);
+            if (pushedMissing) {
+                usageFailure(`pushed checkpoint requires '${pushedMissing}'`);
+                return;
+            }
+        }
+        else if (values['--remote'] !== undefined || values['--ref'] !== undefined) {
+            usageFailure('committed checkpoint does not accept --remote or --ref');
+            return;
+        }
+        result = checkpointCommitIntent(taskRef, {
+            token: values['--token'], kind: values['--kind'],
+            head: values['--head'], remote: values['--remote'], ref: values['--ref']
+        });
+    }
+    else if (intent === 'commit-complete') {
+        const missing = requireValues(['--token', '--agent']);
+        if (missing) {
+            usageFailure(`intent 'commit-complete' requires '${missing}'`);
+            return;
+        }
+        const agent = normalizeAgentToken(values['--agent']);
+        if (!agent) {
+            usageFailure(`invalid --agent '${values['--agent']}': ${AGENT_USAGE_HINT}`);
+            return;
+        }
+        result = completeCommitIntent(taskRef, { token: values['--token'], agent });
+    }
+    else if (intent === 'commit-recover') {
+        const missing = requireValues(['--agent']);
+        if (missing) {
+            usageFailure(`intent 'commit-recover' requires '${missing}'`);
+            return;
+        }
+        const agent = normalizeAgentToken(values['--agent']);
+        if (!agent) {
+            usageFailure(`invalid --agent '${values['--agent']}': ${AGENT_USAGE_HINT}`);
+            return;
+        }
+        result = recoverCommitIntent(taskRef, { agent });
+    }
+    else if (intent === 'commit-abort') {
+        const missing = requireValues(['--token', '--expected-head']);
+        if (missing) {
+            usageFailure(`intent 'commit-abort' requires '${missing}'`);
+            return;
+        }
+        result = abortCommitIntent(taskRef, { token: values['--token'], expectedHead: values['--expected-head'] });
+    }
+    else if (intent === 'commit-status') {
+        result = statusCommitIntent(taskRef);
+    }
+    else if (intent === 'begin-or-resume') {
         const missing = requireValues(['--client']);
         if (missing) {
             usageFailure(`intent 'begin-or-resume' requires '${missing}'`);
@@ -160,19 +277,6 @@ function taskOrchestration(args = []) {
             });
         }
     }
-    else if (intent === 'stage-completed') {
-        const missing = requireValues(['--agent']);
-        if (missing) {
-            usageFailure(`intent 'stage-completed' requires '${missing}'`);
-            return;
-        }
-        const agent = normalizeAgentToken(values['--agent']);
-        if (!agent) {
-            usageFailure(`invalid --agent '${values['--agent']}': ${AGENT_USAGE_HINT}`);
-            return;
-        }
-        result = completeCommitOrchestrationStage(taskRef, agent);
-    }
     else if (intent === 'advance') {
         result = advanceOrchestration(taskRef);
     }

package/dist/lib/platform/github-client.js

@@ -2,6 +2,14 @@ import process from 'node:process';
 import spawn from 'cross-spawn';
 import semver from 'semver';
 const MINIMUM_GITHUB_CLI_VERSION = '2.16.0';
+const GITHUB_CLI_MAX_BUFFER = 64 * 1024 * 1024;
+const ERROR_DETAIL_LIMIT = 4096;
+function boundedFailureDetail(result) {
+    const diagnostic = `${result.stderr}\n${result.error?.message || ''}`.trim() || result.stdout.trim();
+    return diagnostic.length <= ERROR_DETAIL_LIMIT
+        ? diagnostic
+        : `${diagnostic.slice(0, ERROR_DETAIL_LIMIT)}… [truncated]`;
+}
 function defaultRunner(args, options) {
     const command = process.env.AGENT_INFRA_GH_BIN || 'gh';
     let prefix = [];
@@ -16,6 +24,7 @@ function defaultRunner(args, options) {
         encoding: 'utf8',
         env: process.env,
         input: options.input,
+        maxBuffer: GITHUB_CLI_MAX_BUFFER,
         shell: false
     });
     return {
@@ -37,7 +46,15 @@ function defaultSleep(delayMs) {
     Atomics.wait(new Int32Array(new SharedArrayBuffer(4)), 0, 0, delayMs);
 }
 function classifyGitHubFailure(result) {
-    const detail = `${result.stderr}\n${result.stdout}\n${result.error?.message || ''}`.trim();
+    const errorCode = result.error && 'code' in result.error ? result.error.code : undefined;
+    if (errorCode === 'ENOBUFS') {
+        return {
+            code: 'PLATFORM_OUTPUT_TOO_LARGE',
+            message: 'GitHub CLI output exceeded the configured limit',
+            retryable: false
+        };
+    }
+    const detail = boundedFailureDetail(result);
     const lower = detail.toLowerCase();
     if (/\b401\b|bad credentials|authentication required|not logged into/.test(lower)) {
         return { code: 'AUTH_REQUIRED', message: detail || 'GitHub authentication is required', retryable: false };
@@ -54,7 +71,7 @@ function classifyGitHubFailure(result) {
     if (/\b422\b|validation failed/.test(lower)) {
         return { code: 'PLATFORM_REQUEST_INVALID', message: detail || 'GitHub rejected the request', retryable: false };
     }
-    if (result.error && 'code' in result.error && result.error.code === 'ENOENT') {
+    if (errorCode === 'ENOENT') {
         return { code: 'PLATFORM_DEPENDENCY_MISSING', message: detail || 'GitHub CLI is unavailable', retryable: false };
     }
     return { code: 'PLATFORM_REQUEST_FAILED', message: detail || 'GitHub request failed', retryable: false };

package/dist/lib/platform/pr-checks.js

@@ -85,7 +85,7 @@ registerPlatformCapabilities('github', {
     inspectRequiredChecks({ client, repository, number, cwd }) {
         const github = client || createGitHubClient();
         const inspected = github.json([
-            'pr', 'checks', String(number), '--repo', repository, '--required',
+            'pr', 'checks', String(number), '--repo', repository,
             '--json', 'name,state,bucket,link,workflow,startedAt,completedAt'
         ], { cwd });
         return inspected.ok

package/dist/lib/platform/pull-requests.js

@@ -11,6 +11,8 @@ import { inspectPlatformIssue } from './issues.js';
 import { planPullRequestMetadata } from './pull-request-metadata.js';
 import { platformResult } from './types.js';
 import { inspectCompletionArtifacts } from '../task/finalization-artifacts.js';
+import { inspectCreatePrCommitGate } from '../task/commit-finalization.js';
+import { TaskExecutionLockError, withTaskExecutionLock } from '../task/task-execution-lock.js';
 function result(status, taskId, issueNumber, prNumber, overrides = {}) {
     return {
         ...platformResult(status),
@@ -612,7 +614,7 @@ function resolveExternalPullRequest(taskRef, options) {
         error: null
     }), { mode: 'external', authorization: selected.source, candidates: selected.candidates, eligible: selected.eligible, selected: selected.selected });
 }
-function createPlatformPullRequest(taskRef, options) {
+function createPlatformPullRequestUnlocked(taskRef, options) {
     const base = resolvedContext(taskRef, options);
     if (!base.ok)
         return base.output;
@@ -622,6 +624,17 @@ function createPlatformPullRequest(taskRef, options) {
         });
     if (base.prNumber)
         return inspectPlatformPullRequest(taskRef, options);
+    const gate = inspectCreatePrCommitGate(base.resolved.taskDir, base.resolved.repoRoot, base.resolved.taskId);
+    if (!gate.allowed)
+        return result('blocked', base.resolved.taskId, base.issueNumber, null, {
+            platform: base.context.platform,
+            capabilities: base.context.capabilities,
+            error: {
+                code: gate.code,
+                message: `${gate.message}; action=${gate.action}`,
+                retryable: gate.action === 'rerun-commit' || gate.action === 'rerun-review-code'
+            }
+        });
     const located = locatePullRequest(base, options.head, options.base);
     if (!located.ok && located.error.code === 'PR_IDENTITY_AMBIGUOUS')
         return result('failed', base.resolved.taskId, base.issueNumber, null, {
@@ -689,6 +702,39 @@ function createPlatformPullRequest(taskRef, options) {
         operations: [{ name: created ? 'pr:create' : 'pr:reuse', status: created ? 'applied' : 'no-op', reasonCode: null }, { name: 'task:bind-pr', status: 'applied', reasonCode: null }], error: null
     });
 }
+function createPlatformPullRequest(taskRef, options) {
+    const base = resolvedContext(taskRef, options);
+    if (!base.ok)
+        return base.output;
+    if (!options.base || !options.head || !options.title.trim() || !options.body.trim()) {
+        return result('failed', base.resolved.taskId, base.issueNumber, base.prNumber, {
+            error: { code: 'PR_PAYLOAD_INVALID', message: 'base, head, title and body are required', retryable: false }
+        });
+    }
+    if (base.prNumber)
+        return inspectPlatformPullRequest(taskRef, options);
+    try {
+        return withTaskExecutionLock(base.resolved.repoRoot, base.resolved.taskId, 'platform-pr.create', () => createPlatformPullRequestUnlocked(taskRef, options));
+    }
+    catch (error) {
+        if (error instanceof TaskExecutionLockError) {
+            return result('blocked', base.resolved.taskId, base.issueNumber, null, {
+                platform: base.context.platform,
+                capabilities: base.context.capabilities,
+                error: { code: error.code, message: error.message, retryable: true }
+            });
+        }
+        return result('failed', base.resolved.taskId, base.issueNumber, null, {
+            platform: base.context.platform,
+            capabilities: base.context.capabilities,
+            error: {
+                code: 'PR_CREATE_FAILED',
+                message: error instanceof Error ? error.message : String(error),
+                retryable: false
+            }
+        });
+    }
+}
 function syncPlatformPullRequest(taskRef, options) {
     const base = resolvedContext(taskRef, options);
     if (!base.ok)

package/dist/lib/platform/releases.js

@@ -55,9 +55,17 @@ function reconcileReleaseMilestones(version, options = {}) {
     const major = Number(match[1]);
     const minor = Number(match[2]);
     const patch = Number(match[3]);
-    const ensure = [`${major}.${minor}.${patch + 1}`, `${major}.${minor}.x`];
-    if (patch === 0)
-        ensure.push(`${major}.${minor + 1}.0`, `${major}.${minor + 1}.x`);
+    const nextPatch = `${major}.${minor}.${patch + 1}`;
+    const currentLine = `${major}.${minor}.x`;
+    const ensure = [
+        { title: nextPatch, description: `Issues that we want to release in v${nextPatch}.` },
+        { title: currentLine, description: `Issues that we want to resolve in ${major}.${minor} line.` }
+    ];
+    if (patch === 0) {
+        const nextMinor = `${major}.${minor + 1}.0`;
+        const nextLine = `${major}.${minor + 1}.x`;
+        ensure.push({ title: nextMinor, description: `Issues that we want to release in v${nextMinor}.` }, { title: nextLine, description: `Issues that we want to resolve in ${major}.${minor + 1} line.` });
+    }
     const operations = [];
     const current = milestones.find((item) => item.title === version);
     if (current && current.state !== 'closed') {
@@ -66,11 +74,11 @@ function reconcileReleaseMilestones(version, options = {}) {
     }
     else
         operations.push({ name: 'close-milestone', title: version, status: 'no-op' });
-    for (const title of ensure) {
+    for (const { title, description } of ensure) {
         if (milestones.some((item) => item.title === title))
             operations.push({ name: 'ensure-milestone', title, status: 'no-op' });
         else {
-            const created = client.json(['api', '--method', 'POST', `repos/${context.platform.repository}/milestones`, '-f', `title=${title}`], { cwd: options.cwd });
+            const created = client.json(['api', '--method', 'POST', `repos/${context.platform.repository}/milestones`, '-f', `title=${title}`, '-f', `description=${description}`], { cwd: options.cwd });
             operations.push({ name: 'ensure-milestone', title, status: created.ok ? 'applied' : 'failed' });
         }
     }

package/dist/lib/process-data/index.js

@@ -0,0 +1,239 @@
+import fs from 'node:fs';
+import path from 'node:path';
+import { execFileSync } from 'node:child_process';
+import { detectRepoRoot } from '../task/resolve-ref.js';
+import { normalizeObjects } from './normalize.js';
+import { reconcileRecords } from './reconcile.js';
+import { readAppliedOverlays, repairSnapshot } from './repair.js';
+import { collectGitHubObjects, collectLocalObjects } from './sources.js';
+import { canonicalJsonBytes, createObjectStore, publishSnapshot, verifySnapshot } from './store.js';
+const USAGE = `Usage: ai data <command> [options]
+
+Commands:
+  capture [--source all|local|github] [--root <dir>] [--include-excerpts]
+  verify <snapshot-id> [--root <dir>]
+  audit <snapshot-id> [--root <dir>] [--format json|text]
+  repair <snapshot-id> [--root <dir>] [--apply]
+  export <snapshot-id> [--root <dir>] [--repairs none|applied] [--output <file|->]
+`;
+function parseArgs(args, valueOptions, booleanOptions) {
+    const positionals = [];
+    const options = new Map();
+    for (let index = 0; index < args.length; index += 1) {
+        const arg = args[index];
+        if (!arg.startsWith('--')) {
+            positionals.push(arg);
+            continue;
+        }
+        if (booleanOptions.has(arg)) {
+            if (options.has(arg))
+                throw new Error(`duplicate option: ${arg}`);
+            options.set(arg, true);
+            continue;
+        }
+        if (!valueOptions.has(arg))
+            throw new Error(`unknown option: ${arg}`);
+        const value = args[index + 1];
+        if (!value || value.startsWith('--'))
+            throw new Error(`missing value for ${arg}`);
+        if (options.has(arg))
+            throw new Error(`duplicate option: ${arg}`);
+        options.set(arg, value);
+        index += 1;
+    }
+    return { positionals, options };
+}
+function dataRoot(repoRoot, requested) {
+    const workspace = path.resolve(repoRoot, '.agents', 'workspace');
+    const resolved = path.resolve(repoRoot, requested ?? path.join('.agents', 'workspace', 'process-data'));
+    const relative = path.relative(repoRoot, resolved);
+    if (!relative || relative.startsWith('..') || path.isAbsolute(relative))
+        throw new Error('data root must be inside the repository');
+    const taskRoots = ['active', 'blocked', 'completed', 'archive'].map((state) => path.join(workspace, state));
+    if (resolved === workspace || taskRoots.some((taskRoot) => resolved === taskRoot || resolved.startsWith(`${taskRoot}${path.sep}`))) {
+        throw new Error('data root cannot be the workspace root or a task directory');
+    }
+    let current = resolved;
+    while (current !== repoRoot) {
+        if (fs.existsSync(current) && fs.lstatSync(current).isSymbolicLink())
+            throw new Error('data root cannot traverse a symlink');
+        current = path.dirname(current);
+    }
+    return resolved;
+}
+function repositoryIdentity(repoRoot) {
+    try {
+        return execFileSync('git', ['config', '--get', 'remote.origin.url'], { cwd: repoRoot, encoding: 'utf8' }).trim() || path.basename(repoRoot);
+    }
+    catch {
+        return path.basename(repoRoot);
+    }
+}
+function writeJson(value) {
+    process.stdout.write(`${JSON.stringify(value)}\n`);
+}
+function optionString(parsed, name) {
+    const value = parsed.options.get(name);
+    return typeof value === 'string' ? value : undefined;
+}
+function capture(args) {
+    const parsed = parseArgs(args, new Set(['--source', '--root']), new Set(['--include-excerpts']));
+    if (parsed.positionals.length > 0)
+        throw new Error('capture does not accept positional arguments');
+    const scope = optionString(parsed, '--source') ?? 'all';
+    if (!['all', 'local', 'github'].includes(scope))
+        throw new Error('--source must be all, local, or github');
+    const repoRoot = detectRepoRoot();
+    const root = dataRoot(repoRoot, optionString(parsed, '--root'));
+    const observedFrom = new Date().toISOString();
+    const objects = [];
+    const endpoints = [];
+    let repository = repositoryIdentity(repoRoot);
+    if (scope === 'all' || scope === 'local') {
+        const local = collectLocalObjects(repoRoot, { includeExcerpts: parsed.options.has('--include-excerpts') });
+        if (!local.ok) {
+            writeJson({ ok: false, error: local.error });
+            return 2;
+        }
+        objects.push(...local.value);
+    }
+    if (scope === 'all' || scope === 'github') {
+        const github = collectGitHubObjects(repoRoot);
+        if (!github.ok) {
+            writeJson({ ok: false, error: github.error });
+            return 2;
+        }
+        objects.push(...github.value.objects);
+        endpoints.push(...github.value.endpoints);
+        repository = github.value.repository;
+    }
+    const store = createObjectStore(root);
+    for (const object of objects) {
+        if (object.content !== undefined && object.disposition?.state === 'included') {
+            const stored = store.put(Buffer.from(object.content, 'utf8'));
+            if (stored.sha256 !== object.sha256)
+                throw new Error(`source hash mismatch: ${object.sourceIdentity}`);
+        }
+    }
+    const records = normalizeObjects(objects);
+    const reconciliation = reconcileRecords(records, scope);
+    const observedTo = new Date().toISOString();
+    const published = publishSnapshot(root, {
+        scope: scope,
+        repository,
+        observedFrom,
+        observedTo,
+        objects: objects.map(({ content: _content, ...object }) => object),
+        endpoints,
+        excerptsEnabled: parsed.options.has('--include-excerpts'),
+        records,
+        quality: reconciliation.findings,
+        repairs: reconciliation.repairs
+    });
+    writeJson({ ok: true, snapshotId: published.snapshotId, scope, created: published.created, objects: objects.length, records: records.length });
+    return 0;
+}
+function verify(args) {
+    const parsed = parseArgs(args, new Set(['--root']), new Set());
+    if (parsed.positionals.length !== 1)
+        throw new Error('verify requires one snapshot id');
+    const repoRoot = detectRepoRoot();
+    const result = verifySnapshot(dataRoot(repoRoot, optionString(parsed, '--root')), parsed.positionals[0]);
+    writeJson(result);
+    return result.ok ? 0 : 1;
+}
+function audit(args) {
+    const parsed = parseArgs(args, new Set(['--root', '--format']), new Set());
+    if (parsed.positionals.length !== 1)
+        throw new Error('audit requires one snapshot id');
+    const format = optionString(parsed, '--format') ?? 'text';
+    if (!['json', 'text'].includes(format))
+        throw new Error('--format must be json or text');
+    const repoRoot = detectRepoRoot();
+    const root = dataRoot(repoRoot, optionString(parsed, '--root'));
+    const verified = verifySnapshot(root, parsed.positionals[0]);
+    if (!verified.ok || !verified.snapshotPath || !verified.manifest) {
+        writeJson(verified);
+        return 1;
+    }
+    const quality = JSON.parse(fs.readFileSync(path.join(verified.snapshotPath, 'quality.json'), 'utf8'));
+    const records = fs.readFileSync(path.join(verified.snapshotPath, 'normalized.jsonl'), 'utf8').split('\n').filter(Boolean).map((line) => {
+        const { schema: _schema, ...record } = JSON.parse(line);
+        return record;
+    });
+    const recomputed = reconcileRecords(records, verified.manifest.scope);
+    if (!canonicalJsonBytes(recomputed.findings).equals(canonicalJsonBytes(quality.findings))) {
+        writeJson({ ok: false, error: { code: 'QUALITY_MISMATCH', message: 'stored quality baseline does not match recomputed findings' } });
+        return 1;
+    }
+    if (format === 'json')
+        writeJson({ ok: true, snapshotId: parsed.positionals[0], findings: recomputed.findings });
+    else
+        process.stdout.write(`Snapshot ${parsed.positionals[0]}: ${quality.findings.length} findings\n`);
+    return 0;
+}
+function repair(args) {
+    const parsed = parseArgs(args, new Set(['--root']), new Set(['--apply']));
+    if (parsed.positionals.length !== 1)
+        throw new Error('repair requires one snapshot id');
+    const repoRoot = detectRepoRoot();
+    const result = repairSnapshot(dataRoot(repoRoot, optionString(parsed, '--root')), parsed.positionals[0], parsed.options.has('--apply'));
+    writeJson({ ok: true, ...result });
+    return 0;
+}
+function exportSnapshot(args) {
+    const parsed = parseArgs(args, new Set(['--root', '--repairs', '--output']), new Set());
+    if (parsed.positionals.length !== 1)
+        throw new Error('export requires one snapshot id');
+    const repairMode = optionString(parsed, '--repairs') ?? 'none';
+    if (!['none', 'applied'].includes(repairMode))
+        throw new Error('--repairs must be none or applied');
+    const output = optionString(parsed, '--output') ?? '-';
+    const repoRoot = detectRepoRoot();
+    const root = dataRoot(repoRoot, optionString(parsed, '--root'));
+    const verified = verifySnapshot(root, parsed.positionals[0]);
+    if (!verified.ok || !verified.snapshotPath) {
+        writeJson(verified);
+        return 1;
+    }
+    let content = fs.readFileSync(path.join(verified.snapshotPath, 'normalized.jsonl'), 'utf8');
+    if (repairMode === 'applied')
+        content += readAppliedOverlays(root, parsed.positionals[0]);
+    if (output === '-')
+        process.stdout.write(content);
+    else {
+        const destination = path.resolve(repoRoot, output);
+        const relative = path.relative(repoRoot, destination);
+        if (!relative || relative.startsWith('..') || path.isAbsolute(relative))
+            throw new Error('export output must be inside the repository');
+        fs.writeFileSync(destination, content, { flag: 'wx', mode: 0o600 });
+        writeJson({ ok: true, snapshotId: parsed.positionals[0], output: relative });
+    }
+    return 0;
+}
+async function cmdData(args) {
+    const [command, ...rest] = args;
+    if (!command || command === '--help' || command === '-h' || command === 'help') {
+        process.stdout.write(USAGE);
+        return command ? 0 : 1;
+    }
+    try {
+        switch (command) {
+            case 'capture': return capture(rest);
+            case 'verify': return verify(rest);
+            case 'audit': return audit(rest);
+            case 'repair': return repair(rest);
+            case 'export': return exportSnapshot(rest);
+            default:
+                process.stderr.write(`Unknown data command: ${command}\n`);
+                process.stdout.write(USAGE);
+                return 1;
+        }
+    }
+    catch (error) {
+        writeJson({ ok: false, error: { code: 'DATA_COMMAND_FAILED', message: error instanceof Error ? error.message : String(error) } });
+        return 1;
+    }
+}
+export { cmdData, dataRoot };
+//# sourceMappingURL=index.js.map