@sentropic/track 0.85.15 → 0.85.17

package/dist/report/ai-report.js

@@ -0,0 +1,720 @@
+import { spawnSync } from 'node:child_process';
+import { createHash } from 'node:crypto';
+import { closeSync, existsSync, lstatSync, mkdtempSync, openSync, readFileSync, readSync, realpathSync, rmSync, } from 'node:fs';
+import { homedir, tmpdir } from 'node:os';
+import { basename, isAbsolute, join, relative, resolve, sep } from 'node:path';
+import { canonicalize } from '../events/canonical.js';
+import { ordinalCompare } from './snapshot.js';
+const CONTEXT_LIMIT = 512 * 1024;
+const SNAPSHOT_LIMIT = 256 * 1024;
+const GIT_LIMIT = 100 * 1024;
+const H2A_LIMIT = 128 * 1024;
+const DOCUMENT_LIMIT = 64 * 1024;
+const DOCUMENT_FILE_LIMIT = 32 * 1024;
+const RESULT_LIMIT = 128 * 1024;
+const ADAPTER_STDOUT_LIMIT = 256 * 1024;
+const ADAPTER_STDERR_LIMIT = 16 * 1024;
+const GIT_COMMIT_LIMIT = 50;
+const GIT_PATH_LIMIT = 500;
+export const REPORTER_TIMEOUT_DEFAULT_MS = 90_000;
+export const REPORTER_TIMEOUT_MIN_MS = 1_000;
+export const REPORTER_TIMEOUT_MAX_MS = 15 * 60_000;
+const SOURCE_STATUSES = ['ok', 'timeout', 'unavailable', 'invalid', 'truncated'];
+export const AI_SECTION_NAMES = [
+    'summary', 'facts', 'changes', 'activeWork', 'blockers', 'ownerDecisions', 'suggestions', 'uncertainty',
+];
+export class AiReportError extends Error {
+    constructor(reason) {
+        super(`AI report unavailable (${reason}) — use \`track snapshot\` or \`track report --raw\` for factual state`);
+        this.name = 'AiReportError';
+    }
+}
+function byteLength(value) {
+    return Buffer.byteLength(value, 'utf8');
+}
+function cleanOneLine(value) {
+    return normalizeAiText(value).replace(/\s+/gu, ' ').trim();
+}
+function truncateUtf8(value, max) {
+    if (byteLength(value) <= max)
+        return { text: value, truncated: false };
+    let out = '';
+    for (const scalar of value) {
+        if (byteLength(out + scalar) > max)
+            break;
+        out += scalar;
+    }
+    return { text: out, truncated: true };
+}
+const SECRET_PATTERNS = [
+    [/-----BEGIN [^-\r\n]*PRIVATE KEY-----[\s\S]*?-----END [^-\r\n]*PRIVATE KEY-----/giu, '[REDACTED_PRIVATE_KEY]'],
+    [/\b(?:sk|ghp|github_pat|xox[baprs])[-_][A-Za-z0-9_-]{12,}\b/gu, '[REDACTED_TOKEN]'],
+    [/\b(?:api[_-]?key|token|secret|password)\s*[:=]\s*[^\s,;]+/giu, '$1=[REDACTED]'],
+    [/\bBearer\s+[A-Za-z0-9._~+\/-]+=*\b/giu, 'Bearer [REDACTED]'],
+];
+export function redactText(value) {
+    let out = value;
+    for (const [pattern, replacement] of SECRET_PATTERNS)
+        out = out.replace(pattern, replacement);
+    return out;
+}
+function redactValue(value) {
+    if (typeof value === 'string')
+        return redactText(value);
+    if (Array.isArray(value))
+        return value.map((entry) => redactValue(entry));
+    if (value !== null && typeof value === 'object') {
+        const out = {};
+        for (const [key, child] of Object.entries(value))
+            out[key] = redactValue(child);
+        return out;
+    }
+    return value;
+}
+const ENV_ALLOWLIST = [
+    'PATH', 'HOME', 'XDG_CONFIG_HOME', 'XDG_DATA_HOME', 'XDG_CACHE_HOME', 'TMPDIR', 'LANG', 'LC_ALL',
+    'SSL_CERT_FILE', 'SSL_CERT_DIR', 'HTTPS_PROXY', 'HTTP_PROXY', 'NO_PROXY', 'H2A_ROOT',
+];
+export function reporterEnvironment(source) {
+    const env = { TRACK_REPORT_AI_DEPTH: '1' };
+    for (const key of ENV_ALLOWLIST)
+        if (source[key] !== undefined)
+            env[key] = source[key];
+    return env;
+}
+function privateCwd(run) {
+    const dir = mkdtempSync(join(tmpdir(), 'track-report-'));
+    try {
+        return run(dir);
+    }
+    finally {
+        rmSync(dir, { recursive: true, force: true });
+    }
+}
+function spawnText(spawn, command, args, options) {
+    return spawn(command, [...args], {
+        cwd: options.cwd,
+        env: options.env,
+        encoding: 'utf8',
+        shell: false,
+        timeout: options.timeout,
+        maxBuffer: options.maxBuffer,
+        ...(options.input !== undefined ? { input: options.input } : {}),
+        stdio: ['pipe', 'pipe', 'pipe'],
+    });
+}
+function within(root, candidate) {
+    const rel = relative(root, candidate);
+    return rel === '' || (!rel.startsWith(`..${sep}`) && rel !== '..' && !isAbsolute(rel));
+}
+function sourceFailure(status, detail) {
+    return { status, entries: [], omitted: 0, detail };
+}
+function gitRun(spawn, cwd, env, args) {
+    return spawnText(spawn, 'git', args, { cwd, env: { ...env, GIT_OPTIONAL_LOCKS: '0' }, timeout: 5_000, maxBuffer: 1024 * 1024 });
+}
+function repositoryRoot(spawn, cwd, env) {
+    const result = gitRun(spawn, cwd, env, ['rev-parse', '--show-toplevel']);
+    if (result.status === 0 && typeof result.stdout === 'string' && result.stdout.trim() !== '') {
+        return realpathSync(result.stdout.trim());
+    }
+    return realpathSync(cwd);
+}
+function pathRef(path) {
+    return `git:path:${path.replaceAll('\\', '/')}`;
+}
+function collectGit(spawn, root, env) {
+    const entries = [];
+    let omitted = 0;
+    let used = 0;
+    let truncated = false;
+    let pathCount = 0;
+    let unavailableDetail;
+    const add = (entry) => {
+        const clean = redactValue(entry);
+        const bytes = byteLength(canonicalize(clean));
+        if (used + bytes > GIT_LIMIT) {
+            omitted++;
+            truncated = true;
+            return;
+        }
+        entries.push(clean);
+        used += bytes;
+    };
+    const addPath = (entry) => {
+        if (pathCount >= GIT_PATH_LIMIT) {
+            omitted++;
+            truncated = true;
+            return;
+        }
+        pathCount++;
+        add(entry);
+    };
+    const markUnavailable = (detail) => {
+        unavailableDetail ??= detail;
+    };
+    const log = gitRun(spawn, root, env, ['log', '-n', String(GIT_COMMIT_LIMIT), '--pretty=format:%H%x09%s']);
+    if (log.status !== 0)
+        return sourceFailure('unavailable', 'git-log-unavailable');
+    const commits = log.stdout.split('\n').filter(Boolean);
+    const overReturnedCommits = Math.max(0, commits.length - GIT_COMMIT_LIMIT);
+    for (const [index, line] of commits.entries()) {
+        if (index >= GIT_COMMIT_LIMIT) {
+            truncated = true;
+            continue;
+        }
+        const tab = line.indexOf('\t');
+        const sha = tab >= 0 ? line.slice(0, tab) : line;
+        const text = tab >= 0 ? line.slice(tab + 1) : '';
+        add({ ref: `git:commit:${sha}`, kind: 'commit', sha, text });
+    }
+    // `git log -n 50` is the exact content cap; count separately so `omitted` remains an exact number,
+    // rather than a sentinel that could conceal a history with thousands of omitted commits.
+    const commitCount = gitRun(spawn, root, env, ['rev-list', '--count', 'HEAD']);
+    if (commitCount.status !== 0 || !/^\d+\s*$/u.test(commitCount.stdout)) {
+        omitted += overReturnedCommits;
+        markUnavailable('git-count-unavailable');
+    }
+    else {
+        const omittedCommits = Math.max(overReturnedCommits, Number(commitCount.stdout.trim()) - GIT_COMMIT_LIMIT);
+        omitted += omittedCommits;
+        if (omittedCommits > 0)
+            truncated = true;
+    }
+    // Disable rename pairing so porcelain -z remains exactly one NUL-delimited record per path; otherwise
+    // the second rename path is a bare record and can be miscounted as an independent status entry.
+    const status = gitRun(spawn, root, env, ['status', '--porcelain=v1', '-z', '--untracked-files=normal', '--no-renames']);
+    if (status.status !== 0) {
+        markUnavailable('git-status-unavailable');
+    }
+    else {
+        for (const record of status.stdout.split('\0').filter(Boolean)) {
+            const path = record.length > 3 ? record.slice(3) : record;
+            addPath({ ref: pathRef(path), kind: 'status', path, text: record.slice(0, 2) });
+        }
+    }
+    const changed = gitRun(spawn, root, env, ['diff', '--name-only', '-z', '--no-ext-diff', 'HEAD']);
+    if (changed.status === 0) {
+        for (const path of changed.stdout.split('\0').filter(Boolean)) {
+            addPath({ ref: pathRef(path), kind: 'changed-path', path, text: 'worktree-change' });
+        }
+    }
+    else {
+        markUnavailable('git-diff-unavailable');
+    }
+    const stat = gitRun(spawn, root, env, ['diff', '--stat', '--no-ext-diff', 'HEAD']);
+    if (stat.status === 0 && stat.stdout.trim() !== '') {
+        add({ ref: 'git:diff-stat:worktree', kind: 'diff-stat', text: stat.stdout.trim() });
+    }
+    else if (stat.status !== 0) {
+        markUnavailable('git-diff-stat-unavailable');
+    }
+    if (unavailableDetail !== undefined)
+        return { status: 'unavailable', entries, omitted, detail: unavailableDetail };
+    return { status: truncated ? 'truncated' : 'ok', entries, omitted, ...(truncated ? { detail: 'git-cap' } : {}) };
+}
+function readPrefix(path, limit) {
+    const fd = openSync(path, 'r');
+    try {
+        const buffer = Buffer.alloc(limit + 1);
+        const count = readSync(fd, buffer, 0, buffer.length, 0);
+        return { text: buffer.subarray(0, Math.min(count, limit)).toString('utf8'), truncated: count > limit };
+    }
+    finally {
+        closeSync(fd);
+    }
+}
+function collectDocuments(root) {
+    const candidates = [
+        ['README.md', 'readme'], ['README', 'readme'], ['AGENTS.md', 'agents'], ['BRANCH.md', 'branch'],
+    ];
+    const entries = [];
+    let used = 0;
+    let omitted = 0;
+    let truncated = false;
+    for (const [name, kind] of candidates) {
+        const path = join(root, name);
+        if (!existsSync(path))
+            continue;
+        const stat = lstatSync(path);
+        if (!stat.isFile() || stat.isSymbolicLink())
+            return sourceFailure('invalid', 'document-not-regular');
+        const real = realpathSync(path);
+        if (!within(root, real))
+            return sourceFailure('invalid', 'document-outside-repository');
+        const read = readPrefix(real, DOCUMENT_FILE_LIMIT);
+        const clipped = truncateUtf8(redactText(read.text), Math.max(0, DOCUMENT_LIMIT - used));
+        if (clipped.text === '' && read.text !== '') {
+            omitted++;
+            truncated = true;
+            continue;
+        }
+        const entry = {
+            ref: `doc:${name}:chunk:1`, kind, path: name, chunk: 1, text: clipped.text, untrusted: true,
+        };
+        entries.push(entry);
+        used += byteLength(clipped.text);
+        if (read.truncated || clipped.truncated)
+            truncated = true;
+    }
+    return { status: truncated ? 'truncated' : 'ok', entries, omitted, ...(truncated ? { detail: 'document-cap' } : {}) };
+}
+function collectH2a(spawn, root, env) {
+    return privateCwd((cwd) => {
+        const result = spawnText(spawn, 'h2a', ['report-context', '--workspace-root', root], {
+            cwd, env, timeout: 5_000, maxBuffer: H2A_LIMIT,
+        });
+        if (result.error !== undefined) {
+            const timedOut = result.error.code === 'ETIMEDOUT';
+            return sourceFailure(timedOut ? 'timeout' : 'unavailable', timedOut ? 'h2a-timeout' : 'h2a-unavailable');
+        }
+        if (byteLength(result.stderr) > 16 * 1024)
+            return sourceFailure('invalid', 'h2a-stderr-cap');
+        if (result.status !== 0)
+            return sourceFailure('unavailable', 'h2a-nonzero');
+        try {
+            const decoded = JSON.parse(result.stdout);
+            if (!isRecord(decoded) || Object.keys(decoded).sort(ordinalCompare).join(',') !== 'entries,omitted,schema,storeRoot,workspaceRoot' ||
+                decoded['schema'] !== 'h2a.report-context/v1' || typeof decoded['storeRoot'] !== 'string' ||
+                typeof decoded['workspaceRoot'] !== 'string' || !Array.isArray(decoded['entries']) ||
+                !Number.isInteger(decoded['omitted']) || Number(decoded['omitted']) < 0) {
+                return sourceFailure('invalid', 'h2a-invalid-envelope');
+            }
+            if (!isAbsolute(decoded['storeRoot']) || !isAbsolute(decoded['workspaceRoot'])) {
+                return sourceFailure('invalid', 'h2a-root-not-absolute');
+            }
+            let storeRoot;
+            let envelopeRoot;
+            try {
+                storeRoot = realpathSync(decoded['storeRoot']);
+                envelopeRoot = realpathSync(decoded['workspaceRoot']);
+            }
+            catch {
+                return sourceFailure('invalid', 'h2a-root-invalid');
+            }
+            if (envelopeRoot !== root)
+                return sourceFailure('invalid', 'h2a-workspace-root-mismatch');
+            const expectedStorePath = env['H2A_ROOT'] ?? join(env['HOME'] ?? homedir(), 'h2a-workspace', '.h2a');
+            let expectedStoreRoot;
+            try {
+                expectedStoreRoot = realpathSync(expectedStorePath);
+            }
+            catch {
+                return sourceFailure('invalid', 'h2a-expected-store-root-invalid');
+            }
+            if (storeRoot !== expectedStoreRoot)
+                return sourceFailure('invalid', 'h2a-store-root-mismatch');
+            const raw = decoded['entries'];
+            const entries = [];
+            let used = 0;
+            let omitted = Number(decoded['omitted']);
+            const refs = new Set();
+            for (const value of raw) {
+                if (!isRecord(value) || Object.keys(value).sort(ordinalCompare).join(',') !== 'kind,ref,text,workspace') {
+                    return sourceFailure('invalid', 'h2a-invalid-entry');
+                }
+                const ref = value['ref'];
+                const kind = value['kind'];
+                const workspace = value['workspace'];
+                const text = value['text'];
+                if (typeof ref !== 'string' || !ref.startsWith('h2a:') || typeof workspace !== 'string' || typeof text !== 'string' ||
+                    !['loop', 'session', 'blockage', 'inbox-metadata'].includes(String(kind))) {
+                    return sourceFailure('invalid', 'h2a-invalid-entry');
+                }
+                if (refs.has(ref))
+                    return sourceFailure('invalid', 'h2a-duplicate-ref');
+                refs.add(ref);
+                if (!isAbsolute(workspace))
+                    return sourceFailure('invalid', 'h2a-workspace-not-absolute');
+                let workspaceReal;
+                try {
+                    workspaceReal = realpathSync(workspace);
+                }
+                catch {
+                    return sourceFailure('invalid', 'h2a-workspace-invalid');
+                }
+                if (!within(root, workspaceReal))
+                    return sourceFailure('invalid', 'h2a-cross-workspace');
+                const entry = { ref, kind: kind, workspace: workspaceReal, text: redactText(text) };
+                const bytes = byteLength(canonicalize(entry));
+                if (entries.length >= 100 || used + bytes > H2A_LIMIT) {
+                    omitted++;
+                    continue;
+                }
+                entries.push(entry);
+                used += bytes;
+            }
+            entries.sort((a, b) => ordinalCompare(a.ref, b.ref));
+            return { status: omitted > 0 ? 'truncated' : 'ok', entries, omitted, ...(omitted > 0 ? { detail: 'h2a-cap' } : {}) };
+        }
+        catch {
+            return sourceFailure('invalid', 'h2a-invalid-json');
+        }
+    });
+}
+function wpRefs(nodes, out) {
+    for (const node of nodes) {
+        out.push({ ref: `track:wp:${node.id}`, kind: 'workpackage', state: 'fact' });
+        wpRefs(node.children, out);
+    }
+}
+function referencesOf(snapshot, git, h2a, documents) {
+    const refs = [];
+    for (const bucket of Object.values(snapshot.report.buckets)) {
+        for (const row of bucket)
+            refs.push({ ref: `track:item:${row.id}`, kind: 'item', state: 'fact' });
+    }
+    for (const decision of snapshot.report.decisions ?? []) {
+        refs.push({
+            ref: `track:decision:${decision.id}`,
+            kind: 'decision',
+            state: decision.outcome === 'pending' ? 'open' : 'closed',
+        });
+    }
+    wpRefs(snapshot.report.wpTree ?? [], refs);
+    for (const event of snapshot.recentEvents) {
+        refs.push({ ref: `track:event:${event.position}`, kind: 'event', state: 'fact' });
+        // SnapshotV1 intentionally carries no separate blocker table. The allowlisted recent-event projection
+        // still exposes stable blocker refs for blocker events inside its 200-event window; older blockers remain
+        // citeable through their affected item/decision, never through a fabricated blocker ref.
+        if (event.kind === 'blocker.opened' || event.kind === 'blocker.resolved') {
+            refs.push({ ref: `track:blocker:${event.aggregateId}`, kind: 'blocker', state: 'fact' });
+        }
+    }
+    for (const entry of git.entries)
+        refs.push({ ref: entry.ref, kind: entry.kind, state: 'fact' });
+    for (const entry of h2a.entries)
+        refs.push({ ref: entry.ref, kind: entry.kind, state: 'fact' });
+    for (const entry of documents.entries)
+        refs.push({ ref: entry.ref, kind: entry.kind, state: 'fact' });
+    for (const [name, source] of [['git', git], ['h2a', h2a], ['documents', documents]]) {
+        refs.push({ ref: `source:${name}`, kind: 'source-status', state: source.status === 'ok' ? 'fact' : 'degraded' });
+    }
+    const unique = new Map();
+    for (const ref of refs)
+        if (!unique.has(ref.ref))
+            unique.set(ref.ref, ref);
+    return [...unique.values()].sort((a, b) => ordinalCompare(a.ref, b.ref));
+}
+export function buildReportContext(options, deps = {}) {
+    const spawn = deps.spawn ?? spawnSync;
+    const sourceEnv = options.env ?? process.env;
+    const childEnv = reporterEnvironment(sourceEnv);
+    const root = repositoryRoot(spawn, options.cwd, childEnv);
+    const snapshot = redactValue(options.reader.snapshot({
+        baselineInput: options.request.baselineInput,
+        resolvedCommit: options.request.baselineCommit,
+        requireAccepted: options.request.requireAccepted,
+    }));
+    if (byteLength(canonicalize(snapshot)) > SNAPSHOT_LIMIT)
+        throw new AiReportError('snapshot-cap');
+    const git = collectGit(spawn, root, childEnv);
+    const h2a = collectH2a(spawn, root, childEnv);
+    const documents = collectDocuments(root);
+    const body = {
+        schema: 'track.ai-report.context-body/v1',
+        request: options.request,
+        workspace: { repoRoot: root },
+        track: { snapshot },
+        git,
+        h2a,
+        documents,
+        references: referencesOf(snapshot, git, h2a, documents),
+    };
+    const contextBytes = canonicalize(body);
+    if (byteLength(contextBytes) > CONTEXT_LIMIT)
+        throw new AiReportError('context-cap');
+    const contextDigest = createHash('sha256').update(contextBytes, 'utf8').digest('hex');
+    return { schema: 'track.ai-report.context-envelope/v1', context: body, contextDigest };
+}
+function configPath(env) {
+    const xdg = env['XDG_CONFIG_HOME'];
+    const home = env['HOME'];
+    const base = xdg !== undefined && xdg.length > 0 && isAbsolute(xdg)
+        ? xdg
+        : join(home !== undefined && home.length > 0 && isAbsolute(home) ? home : homedir(), '.config');
+    return join(base, 'track', 'report-ai.json');
+}
+export function resolveReporterConfig(env = process.env) {
+    if (env['TRACK_REPORT_AI_DEPTH'] !== undefined && env['TRACK_REPORT_AI_DEPTH'] !== '0') {
+        throw new AiReportError('recursive-adapter');
+    }
+    const envRaw = env['TRACK_REPORT_AI_ARGV'];
+    const path = configPath(env);
+    let raw;
+    let fromEnvironment = false;
+    if (envRaw !== undefined) {
+        raw = envRaw;
+        fromEnvironment = true;
+    }
+    else if (existsSync(path)) {
+        try {
+            raw = readFileSync(path, 'utf8');
+        }
+        catch {
+            throw new AiReportError('unreadable-configuration');
+        }
+    }
+    if (raw === undefined)
+        throw new AiReportError('missing-configuration');
+    let value;
+    try {
+        value = JSON.parse(raw);
+    }
+    catch {
+        throw new AiReportError('invalid-configuration-json');
+    }
+    if (fromEnvironment && !Array.isArray(value))
+        throw new AiReportError('invalid-configuration-env-shape');
+    if (!fromEnvironment && (!isRecord(value) || !Object.hasOwn(value, 'argv') ||
+        !['argv', 'argv,timeoutMs'].includes(Object.keys(value).sort().join(',')))) {
+        throw new AiReportError('invalid-configuration-file-shape');
+    }
+    const argv = fromEnvironment ? value : value['argv'];
+    if (!Array.isArray(argv) || argv.length === 0 || argv.some((entry) => typeof entry !== 'string' || entry.length === 0)) {
+        throw new AiReportError('invalid-configuration-argv');
+    }
+    const configuredTimeout = !fromEnvironment && isRecord(value) && Object.hasOwn(value, 'timeoutMs')
+        ? value['timeoutMs']
+        : REPORTER_TIMEOUT_DEFAULT_MS;
+    if (!Number.isInteger(configuredTimeout) || Number(configuredTimeout) < REPORTER_TIMEOUT_MIN_MS ||
+        Number(configuredTimeout) > REPORTER_TIMEOUT_MAX_MS) {
+        throw new AiReportError('invalid-configuration-timeout');
+    }
+    return { argv: argv, timeoutMs: Number(configuredTimeout) };
+}
+export function resolveReporterArgv(env = process.env) {
+    return resolveReporterConfig(env).argv;
+}
+function isRecord(value) {
+    return value !== null && typeof value === 'object' && !Array.isArray(value);
+}
+function exactKeys(value, allowed, label) {
+    const actual = Object.keys(value).sort();
+    const expected = [...allowed].sort();
+    if (actual.length !== expected.length || actual.some((key, index) => key !== expected[index])) {
+        throw new AiReportError(`invalid-${label}-shape`);
+    }
+}
+function assertMaxDepth(value, depth = 0) {
+    if (depth > 16)
+        throw new AiReportError('result-depth-cap');
+    if (Array.isArray(value)) {
+        for (const child of value)
+            assertMaxDepth(child, depth + 1);
+    }
+    else if (isRecord(value)) {
+        for (const child of Object.values(value))
+            assertMaxDepth(child, depth + 1);
+    }
+}
+function stringField(value, label, optional = false) {
+    if (value === undefined && optional)
+        return undefined;
+    if (typeof value !== 'string' || value.length === 0 || value.includes('\uFFFD'))
+        throw new AiReportError(`invalid-${label}`);
+    return value;
+}
+function adapterMetadataField(value, label, optional = false) {
+    const raw = stringField(value, label, optional);
+    if (raw === undefined)
+        return undefined;
+    if ([...raw].length > 128)
+        throw new AiReportError(`invalid-${label}-cap`);
+    const normalized = cleanOneLine(raw);
+    if (normalized.length === 0)
+        throw new AiReportError(`invalid-${label}-normalized`);
+    return normalized;
+}
+export function normalizeAiText(value) {
+    const ansi = value.replace(/\u001b(?:\[[0-?]*[ -\/]*[@-~]|\][^\u0007]*(?:\u0007|\u001b\\))/gu, '');
+    return ansi
+        .replace(/\r\n?/gu, '\n')
+        .replace(/[\u0000-\u0009\u000b-\u001f\u007f-\u009f\u202a-\u202e\u2066-\u2069]/gu, '')
+        .replace(/\n{3,}/gu, '\n\n')
+        .trim();
+}
+function validateResult(raw, envelope) {
+    if (byteLength(raw) > RESULT_LIMIT)
+        throw new AiReportError('result-cap');
+    if (raw.includes('\uFFFD'))
+        throw new AiReportError('invalid-result-utf8');
+    let decoded;
+    try {
+        decoded = JSON.parse(raw);
+    }
+    catch {
+        throw new AiReportError('invalid-result-json');
+    }
+    assertMaxDepth(decoded);
+    if (!isRecord(decoded))
+        throw new AiReportError('invalid-result-object');
+    exactKeys(decoded, ['schema', 'adapter', 'sections'], 'result');
+    if (decoded['schema'] !== 'track.ai-report.result/v1')
+        throw new AiReportError('invalid-result-schema');
+    if (!isRecord(decoded['adapter']))
+        throw new AiReportError('invalid-adapter');
+    const adapterRaw = decoded['adapter'];
+    const adapterKeys = Object.keys(adapterRaw);
+    if (!adapterKeys.every((key) => ['provider', 'model', 'effort', 'resolvedModel', 'identity'].includes(key)) ||
+        !['provider', 'model', 'identity'].every((key) => adapterKeys.includes(key))) {
+        throw new AiReportError('invalid-adapter-shape');
+    }
+    if (adapterRaw['identity'] !== 'adapter-reported')
+        throw new AiReportError('invalid-adapter-identity');
+    const provider = adapterMetadataField(adapterRaw['provider'], 'adapter-provider');
+    const model = adapterMetadataField(adapterRaw['model'], 'adapter-model');
+    const effort = adapterMetadataField(adapterRaw['effort'], 'adapter-effort', true);
+    const resolvedModel = adapterMetadataField(adapterRaw['resolvedModel'], 'adapter-resolved-model', true);
+    if (!isRecord(decoded['sections']))
+        throw new AiReportError('invalid-sections');
+    exactKeys(decoded['sections'], AI_SECTION_NAMES, 'sections');
+    const refs = new Map(envelope.context.references.map((ref) => [ref.ref, ref]));
+    const seenIds = new Set();
+    const sections = {};
+    for (const name of AI_SECTION_NAMES) {
+        const values = decoded['sections'][name];
+        if (!Array.isArray(values) || values.length > 20)
+            throw new AiReportError(`invalid-section-${name}`);
+        sections[name] = values.map((value) => {
+            if (!isRecord(value))
+                throw new AiReportError(`invalid-entry-${name}`);
+            exactKeys(value, ['id', 'text', 'citations'], `entry-${name}`);
+            const id = stringField(value['id'], 'entry-id');
+            if (seenIds.has(id))
+                throw new AiReportError('duplicate-entry-id');
+            seenIds.add(id);
+            const rawText = stringField(value['text'], 'entry-text');
+            if ([...rawText].length > 1_000)
+                throw new AiReportError('entry-text-cap');
+            if (!Array.isArray(value['citations']) || value['citations'].length < 1 || value['citations'].length > 8) {
+                throw new AiReportError('invalid-entry-citations');
+            }
+            const citations = value['citations'].map((citation) => {
+                if (!isRecord(citation))
+                    throw new AiReportError('invalid-citation');
+                exactKeys(citation, ['ref'], 'citation');
+                const ref = stringField(citation['ref'], 'citation-ref');
+                if (!refs.has(ref))
+                    throw new AiReportError('forged-citation');
+                return { ref };
+            });
+            if (name === 'ownerDecisions') {
+                const decisionCitations = citations.filter((citation) => refs.get(citation.ref)?.kind === 'decision');
+                if (decisionCitations.length === 0 || decisionCitations.some((citation) => refs.get(citation.ref)?.state !== 'open')) {
+                    throw new AiReportError('closed-owner-decision-citation');
+                }
+            }
+            const text = normalizeAiText(rawText);
+            if (text.length === 0)
+                throw new AiReportError('empty-normalized-entry-text');
+            return { id, text, citations };
+        });
+    }
+    return {
+        schema: 'track.ai-report.result/v1',
+        adapter: {
+            provider,
+            model,
+            ...(effort !== undefined ? { effort } : {}),
+            ...(resolvedModel !== undefined ? { resolvedModel } : {}),
+            identity: 'adapter-reported',
+        },
+        sections,
+    };
+}
+const SECTION_LABELS = {
+    summary: 'SUMMARY', facts: 'FACTS', changes: 'RECENT CHANGES', activeWork: 'ACTIVE WORK', blockers: 'BLOCKERS',
+    ownerDecisions: 'OWNER DECISIONS', suggestions: 'AI SUGGESTIONS', uncertainty: 'UNCERTAINTY',
+};
+function markdownEscape(value) {
+    return cleanOneLine(value).replace(/([\\`*_{}\[\]()#+\-.!|<>~])/gu, '\\$1');
+}
+function htmlEscape(value) {
+    return value.replace(/&/gu, '&amp;').replace(/</gu, '&lt;').replace(/>/gu, '&gt;').replace(/"/gu, '&quot;').replace(/'/gu, '&#39;');
+}
+function citations(entry, escape) {
+    return entry.citations.map((citation) => escape(citation.ref)).join(', ');
+}
+function metadata(result, envelope) {
+    const adapter = result.adapter;
+    const degraded = ['git', 'h2a', 'documents']
+        .filter((key) => envelope.context[key].status !== 'ok')
+        .map((key) => `${key}:${envelope.context[key].status}`);
+    return [
+        `adapter-reported: ${adapter.provider}/${adapter.model}${adapter.resolvedModel !== undefined ? ` -> ${adapter.resolvedModel}` : ''}${adapter.effort !== undefined ? ` (${adapter.effort})` : ''}`,
+        `contextDigest: ${envelope.contextDigest}`,
+        `degraded sources: ${degraded.length > 0 ? degraded.join(', ') : 'none'}`,
+    ];
+}
+export function renderAiReport(result, envelope, format, width = 100) {
+    if (format === 'html') {
+        const sections = AI_SECTION_NAMES.map((name) => {
+            const items = result.sections[name].map((entry) => `<li><span class="track-ai-text">${htmlEscape(cleanOneLine(entry.text))}</span> ` +
+                `<cite>[${htmlEscape(citations(entry, cleanOneLine))}]</cite></li>`).join('');
+            return `<section class="track-ai-section" data-section="${htmlEscape(name)}"><h2>${htmlEscape(SECTION_LABELS[name])}</h2><ul>${items}</ul></section>`;
+        }).join('');
+        const meta = metadata(result, envelope).map((line) => `<li>${htmlEscape(line)}</li>`).join('');
+        return `<article class="track-ai-report" data-kind="ai-report"><header><h1>Track AI report</h1><p>AI-prepared interpretation</p><ul>${meta}</ul></header>${sections}</article>\n`;
+    }
+    if (format === 'inline') {
+        const cap = Math.min(240, Math.max(40, width));
+        const truncate = (line) => line.length <= cap ? line : `${line.slice(0, Math.max(0, cap - 1))}…`;
+        const lines = ['TRACK AI REPORT', ...metadata(result, envelope).map(truncate)];
+        for (const name of AI_SECTION_NAMES) {
+            const entries = result.sections[name];
+            if (entries.length === 0)
+                continue;
+            lines.push(truncate(`${SECTION_LABELS[name]}:`));
+            for (const entry of entries.slice(0, 2))
+                lines.push(truncate(`- ${cleanOneLine(entry.text)} [${citations(entry, cleanOneLine)}]`));
+            if (entries.length > 2)
+                lines.push(truncate(`- +${entries.length - 2} omitted`));
+        }
+        return `${lines.join('\n')}\n`;
+    }
+    const md = format === 'md';
+    const escape = md ? markdownEscape : cleanOneLine;
+    const lines = [md ? '# Track AI report' : 'TRACK AI REPORT', 'AI-prepared interpretation', ...metadata(result, envelope).map(escape), ''];
+    for (const name of AI_SECTION_NAMES) {
+        lines.push(md ? `## ${SECTION_LABELS[name]}` : SECTION_LABELS[name]);
+        const entries = result.sections[name];
+        if (entries.length === 0)
+            lines.push('- none');
+        for (const entry of entries)
+            lines.push(`- ${escape(entry.text)} [${citations(entry, escape)}]`);
+        lines.push('');
+    }
+    return `${lines.join('\n').trimEnd()}\n`;
+}
+export function generateAiReport(options, deps = {}) {
+    const spawn = deps.spawn ?? spawnSync;
+    const sourceEnv = options.env ?? process.env;
+    const reporter = resolveReporterConfig(sourceEnv);
+    const argv = reporter.argv;
+    const envelope = buildReportContext(options, { spawn });
+    const input = canonicalize(envelope);
+    const childEnv = reporterEnvironment(sourceEnv);
+    const result = privateCwd((cwd) => spawnText(spawn, argv[0], argv.slice(1), {
+        cwd,
+        env: childEnv,
+        timeout: reporter.timeoutMs,
+        maxBuffer: ADAPTER_STDOUT_LIMIT,
+        input,
+    }));
+    if (byteLength(result.stderr) > ADAPTER_STDERR_LIMIT)
+        throw new AiReportError('adapter-stderr-cap');
+    if (result.error !== undefined) {
+        const code = result.error.code;
+        throw new AiReportError(code === 'ETIMEDOUT' ? 'adapter-timeout' : code === 'ENOBUFS' ? 'adapter-output-cap' : 'adapter-spawn');
+    }
+    if (result.status !== 0)
+        throw new AiReportError('adapter-nonzero');
+    const validated = validateResult(result.stdout, envelope);
+    return {
+        output: renderAiReport(validated, envelope, options.request.format, options.width),
+        envelope,
+        result: validated,
+    };
+}
+//# sourceMappingURL=ai-report.js.map