cdalkit 0.0.0-stage → 0.1.4

package/dist/cli.js

@@ -0,0 +1,1391 @@
+// src/cli.ts
+import { createRequire } from "module";
+import { runMain as cittyRunMain, defineCommand as defineCommand14 } from "citty";
+
+// src/commands/audit.ts
+import { writeFileSync } from "fs";
+import { resolve } from "path";
+import { renderHtmlReport, renderTerminalReport, runAudit } from "@cdal/audit";
+import { defineCommand } from "citty";
+import pc from "picocolors";
+var auditCommand = defineCommand({
+  meta: {
+    name: "audit",
+    description: "Audit repository for AI agent hygiene, type silencing, test isolation and gates (100% offline)"
+  },
+  args: {
+    path: {
+      type: "positional",
+      description: "Path to repository root to audit",
+      required: false,
+      default: "."
+    },
+    html: {
+      type: "string",
+      description: "Path to save standalone single-file HTML report (e.g. audit-report.html)",
+      required: false
+    },
+    json: {
+      type: "boolean",
+      description: "Output machine-readable JSON report (schema: audit.v1)",
+      default: false
+    },
+    lang: {
+      type: "string",
+      description: "Report language (en or pl)",
+      default: "en"
+    },
+    failUnder: {
+      type: "string",
+      description: "Exit with code 1 if audit score is below this threshold (0-100)",
+      required: false
+    }
+  },
+  async run({ args }) {
+    const targetDir = resolve(args.path || ".");
+    const lang = args.lang === "pl" ? "pl" : "en";
+    if (!args.json) {
+      console.log(pc.bold(pc.cyan("\n\u{1F50D} Running CDAL Repository AI Hygiene Audit...\n")));
+    }
+    const report = await runAudit({
+      cwd: targetDir,
+      lang
+    });
+    if (args.html) {
+      const htmlContent = renderHtmlReport(report, lang);
+      const outPath = resolve(args.html);
+      writeFileSync(outPath, htmlContent, "utf8");
+      if (!args.json) {
+        console.log(pc.green(`  \u2714 Wygenerowano raport HTML: ${outPath}`));
+      }
+    }
+    if (args.json) {
+      console.log(JSON.stringify(report, null, 2));
+    } else {
+      console.log(renderTerminalReport(report, lang));
+    }
+    if (args.failUnder) {
+      const threshold = Number.parseInt(args.failUnder, 10);
+      if (!Number.isNaN(threshold) && report.score < threshold) {
+        console.error(
+          pc.red(
+            `
+\u274C Audit score ${report.score} is below threshold ${threshold}. Failing quality gate.`
+          )
+        );
+        process.exit(1);
+      }
+    }
+  }
+});
+
+// src/commands/codegen.ts
+import { runCodegen } from "@cdal/core";
+import { policies, requirements, stateMachine } from "@cdal/kinds";
+import { defineCommand as defineCommand2 } from "citty";
+import pc2 from "picocolors";
+var codegenCommand = defineCommand2({
+  meta: {
+    name: "codegen",
+    description: "Emit TypeScript types and documentation from contracts (with --check drift detection)"
+  },
+  args: {
+    check: {
+      type: "boolean",
+      description: "Check for drift between contracts and generated files without modifying disk",
+      default: false
+    },
+    dir: {
+      type: "string",
+      description: "Custom path to contracts directory"
+    }
+  },
+  async run({ args }) {
+    try {
+      const defaultKinds = [requirements(), stateMachine(), policies()];
+      const res = await runCodegen({
+        contractsDir: args.dir,
+        check: Boolean(args.check),
+        kinds: defaultKinds
+      });
+      if (args.check) {
+        if (!res.drift) {
+          console.log(pc2.green("\u2705 Codegen check: all generated files are in sync byte-for-byte."));
+        } else {
+          console.error(pc2.red("\u274C Codegen check failed: drift detected in generated files:"));
+          for (const f of res.files) {
+            if (f.status === "drift") {
+              console.error(pc2.red(`  - [DRIFT] ${f.path} (${f.fullPath})`));
+            } else if (f.status === "missing") {
+              console.error(pc2.red(`  - [MISSING] ${f.path} (${f.fullPath})`));
+            }
+          }
+          console.error(
+            pc2.yellow("\nRun `cdal codegen` to synchronize generated files with contracts.")
+          );
+          process.exit(1);
+        }
+      } else {
+        console.log(pc2.green(`\u2705 Emitted ${res.files.length} contract artifact(s):`));
+        for (const f of res.files) {
+          console.log(pc2.cyan(`  - ${f.path} -> ${f.fullPath}`));
+        }
+      }
+    } catch (err) {
+      const msg = err instanceof Error ? err.message : String(err);
+      console.error(pc2.red(`\u274C Fatal error during codegen: ${msg}`));
+      process.exit(1);
+    }
+  }
+});
+
+// src/commands/doctor.ts
+import { spawnSync } from "child_process";
+import { existsSync, readFileSync } from "fs";
+import { join } from "path";
+import { syncAdapters } from "@cdal/adapters";
+import { loadConfig, runCodegen as runCodegen2 } from "@cdal/core";
+import { defineCommand as defineCommand3 } from "citty";
+import pc3 from "picocolors";
+function inspectClaudeHooks(settings) {
+  const groups = settings.hooks?.PreToolUse;
+  if (!Array.isArray(groups)) return "missing";
+  let legacy = false;
+  for (const group of groups) {
+    if (typeof group.command === "string" && /cdal(kit)? hook/.test(group.command)) legacy = true;
+    const handlers = Array.isArray(group.hooks) ? group.hooks : [];
+    for (const handler of handlers) {
+      if (handler.type === "command" && typeof handler.command === "string" && /cdal(kit)? hook guard-paths/.test(handler.command)) {
+        return "ok";
+      }
+    }
+  }
+  return legacy ? "legacy-format" : "missing";
+}
+function runDoctorChecks(cwd, customConfig) {
+  const checks = [];
+  const nodeVer = process.version;
+  const match = /^v(\d+)\.(\d+)\./.exec(nodeVer);
+  const major = match?.[1] ? Number.parseInt(match[1], 10) : 0;
+  const minor = match?.[2] ? Number.parseInt(match[2], 10) : 0;
+  if (major > 20 || major === 20 && minor >= 9) {
+    checks.push({
+      name: "Node.js Runtime",
+      status: "ok",
+      message: `Node ${nodeVer} satisfies engines.node >= 20.9.0 LTS`
+    });
+  } else {
+    checks.push({
+      name: "Node.js Runtime",
+      status: "error",
+      message: `Current Node ${nodeVer} is below required >= 20.9.0`,
+      recommendation: "Upgrade Node.js to Node 22 LTS or Node 20.9+."
+    });
+  }
+  const gitVersionRes = spawnSync("git", ["--version"], { encoding: "utf8" });
+  if (gitVersionRes.status !== 0) {
+    checks.push({
+      name: "Git Binary",
+      status: "error",
+      message: "git binary is not available in PATH",
+      recommendation: "Install Git or add it to PATH."
+    });
+  } else {
+    checks.push({
+      name: "Git Binary",
+      status: "ok",
+      message: `Git is available (${gitVersionRes.stdout.trim()})`
+    });
+    const gitRepoRes = spawnSync("git", ["rev-parse", "--is-inside-work-tree"], {
+      cwd,
+      encoding: "utf8"
+    });
+    if (gitRepoRes.status !== 0) {
+      checks.push({
+        name: "Git Repository",
+        status: "error",
+        message: "Current directory is not inside a git working tree",
+        recommendation: "Initialize git with `git init`."
+      });
+    } else {
+      checks.push({
+        name: "Git Repository",
+        status: "ok",
+        message: "Inside active git working tree"
+      });
+    }
+  }
+  let configObj = null;
+  try {
+    const loaded = loadConfigSync(cwd, customConfig);
+    configObj = loaded.config;
+    checks.push({
+      name: "Configuration",
+      status: "ok",
+      message: `Configuration loaded cleanly (${loaded.filepath ? loaded.filepath : "default config"})`
+    });
+  } catch (err) {
+    const msg = err instanceof Error ? err.message : String(err);
+    checks.push({
+      name: "Configuration",
+      status: "error",
+      message: `Failed to load cdal.config.mjs: ${msg}`,
+      recommendation: "Run `cdal init` or fix configuration errors."
+    });
+  }
+  const settingsPath = join(cwd, ".claude/settings.json");
+  if (existsSync(settingsPath)) {
+    try {
+      const settings = JSON.parse(readFileSync(settingsPath, "utf8"));
+      const wiring = inspectClaudeHooks(settings);
+      if (wiring === "ok") {
+        checks.push({
+          name: "Claude Code Hooks",
+          status: "ok",
+          message: ".claude/settings.json correctly wires CDAL pre-tool hooks"
+        });
+      } else {
+        checks.push({
+          name: "Claude Code Hooks",
+          status: "warn",
+          message: wiring === "legacy-format" ? ".claude/settings.json uses a hook format Claude Code ignores, so the CDAL gates never run" : ".claude/settings.json exists but does not wire the CDAL guard-paths hook",
+          recommendation: "Run `npx cdalkit sync` to regenerate the hook wiring."
+        });
+      }
+    } catch {
+      checks.push({
+        name: "Claude Code Hooks",
+        status: "warn",
+        message: "Could not read .claude/settings.json"
+      });
+    }
+  } else {
+    checks.push({
+      name: "Claude Code Hooks",
+      status: "warn",
+      message: "No .claude/settings.json found in workspace",
+      recommendation: "Run `cdal init` or `cdal sync` to generate hook wiring."
+    });
+  }
+  if (configObj) {
+    try {
+      const syncRes = syncAdapters({ cwd, config: configObj, check: true });
+      if (syncRes.inSync) {
+        checks.push({
+          name: "Runtime Adapters Sync",
+          status: "ok",
+          message: `All ${syncRes.totalFiles} adapter file(s) are in sync without drift`
+        });
+      } else {
+        checks.push({
+          name: "Runtime Adapters Sync",
+          status: "error",
+          message: `${syncRes.driftedFiles.length} adapter file(s) drifted from configuration: ${syncRes.driftedFiles.join(", ")}`,
+          recommendation: "Run `cdal sync` to synchronize runtime files."
+        });
+      }
+    } catch (err) {
+      checks.push({
+        name: "Runtime Adapters Sync",
+        status: "warn",
+        message: `Could not check adapter sync: ${String(err)}`
+      });
+    }
+  }
+  const healthy = checks.every((c) => c.status !== "error");
+  return { checks, healthy };
+}
+function loadConfigSync(cwd, customConfig) {
+  const configPath = customConfig || join(cwd, "cdal.config.mjs");
+  if (existsSync(configPath)) {
+    return { config: null, filepath: configPath };
+  }
+  return { config: null, filepath: null };
+}
+var doctorCommand = defineCommand3({
+  meta: {
+    name: "doctor",
+    description: "Diagnose CDAL installation, environment health, hook wiring, and configuration drift"
+  },
+  args: {
+    config: {
+      type: "string",
+      description: "Path to cdal.config.mjs"
+    },
+    cwd: {
+      type: "string",
+      description: "Working directory path"
+    }
+  },
+  async run({ args }) {
+    const cwd = args.cwd || process.cwd();
+    console.log(pc3.bold(pc3.cyan("\n\u{1FA7A} Running CDAL Diagnostic Doctor...\n")));
+    let resolvedConfig = null;
+    try {
+      const loaded = await loadConfig(args.config || cwd);
+      resolvedConfig = loaded.config;
+    } catch (err) {
+      console.error(pc3.red(`\u26A0\uFE0F  Configuration error: ${String(err)}`));
+    }
+    const { checks, healthy } = runDoctorChecks(cwd, args.config);
+    if (resolvedConfig) {
+      try {
+        const codegenRes = await runCodegen2({
+          contractsDir: resolvedConfig.contractsDir,
+          kinds: resolvedConfig.kinds,
+          check: true
+        });
+        if (!codegenRes.drift) {
+          checks.push({
+            name: "Contract Codegen Sync",
+            status: "ok",
+            message: "Generated contract artifacts match contracts byte-for-byte"
+          });
+        } else {
+          checks.push({
+            name: "Contract Codegen Sync",
+            status: "error",
+            message: "Generated contract code drifted from contract sources",
+            recommendation: "Run `cdal codegen` to regenerate artifacts."
+          });
+        }
+      } catch {
+      }
+    }
+    for (const check of checks) {
+      if (check.status === "ok") {
+        console.log(pc3.green(`  \u2713 [OK] ${pc3.bold(check.name)}: ${check.message}`));
+      } else if (check.status === "warn") {
+        console.log(pc3.yellow(`  \u26A0\uFE0F  [WARN] ${pc3.bold(check.name)}: ${check.message}`));
+        if (check.recommendation) {
+          console.log(pc3.dim(`      Recommendation: ${check.recommendation}`));
+        }
+      } else {
+        console.log(pc3.red(`  \u274C [FAIL] ${pc3.bold(check.name)}: ${check.message}`));
+        if (check.recommendation) {
+          console.log(pc3.yellow(`      Recommendation: ${check.recommendation}`));
+        }
+      }
+    }
+    if (healthy) {
+      console.log(
+        pc3.bold(pc3.green("\n\u2705 Doctor report: Environment and CDAL quality gates are healthy!\n"))
+      );
+    } else {
+      console.log(pc3.bold(pc3.red("\n\u274C Doctor report: Some critical diagnostic checks failed.\n")));
+      process.exit(1);
+    }
+  }
+});
+
+// src/commands/hook.ts
+import fs from "fs";
+import { executeHook } from "@cdal/adapters";
+import { loadConfig as loadConfig2 } from "@cdal/core";
+import { defineCommand as defineCommand4 } from "citty";
+var VALID_HOOKS = /* @__PURE__ */ new Set([
+  "guard-paths",
+  "guard-forbidden",
+  "guard-bash",
+  "session-context",
+  "log-subagent"
+]);
+var hookCommand = defineCommand4({
+  meta: {
+    name: "hook",
+    description: "Entrypoint for agent runtime hooks (Claude Code, Antigravity, etc.)"
+  },
+  args: {
+    name: {
+      type: "positional",
+      description: "Hook name to execute: guard-paths, guard-forbidden, guard-bash, session-context, log-subagent",
+      required: true
+    },
+    role: {
+      type: "positional",
+      description: "Fallback agent role name if not specified in hook payload",
+      required: false
+    },
+    runtime: {
+      type: "string",
+      description: "Target runtime adapter (claude-code, antigravity)",
+      default: "claude-code"
+    },
+    config: {
+      type: "string",
+      description: "Path to cdal.config.mjs"
+    }
+  },
+  async run({ args }) {
+    const hookName = args.name;
+    if (!VALID_HOOKS.has(hookName)) {
+      process.stderr.write(
+        `Unknown hook name "${hookName}". Valid hooks: ${Array.from(VALID_HOOKS).join(", ")}
+`
+      );
+      process.exit(1);
+    }
+    let rawPayload = "";
+    try {
+      rawPayload = fs.readFileSync(0, "utf8");
+    } catch {
+    }
+    const cwd = process.cwd();
+    const { config } = await loadConfig2(args.config);
+    const result = await executeHook(hookName, rawPayload, {
+      cwd,
+      config,
+      fallbackRole: args.role,
+      runtime: args.runtime
+    });
+    if (result.stdout) {
+      process.stdout.write(`${result.stdout}
+`);
+    }
+    if (result.stderr) {
+      process.stderr.write(result.stderr);
+    }
+    process.exit(result.exitCode);
+  }
+});
+
+// src/commands/init.ts
+import { existsSync as existsSync2, mkdirSync, readFileSync as readFileSync2, writeFileSync as writeFileSync2 } from "fs";
+import { join as join2 } from "path";
+import { syncAdapters as syncAdapters2 } from "@cdal/adapters";
+import { resolveConfig } from "@cdal/core";
+import { defineCommand as defineCommand5 } from "citty";
+import pc4 from "picocolors";
+var initCommand = defineCommand5({
+  meta: {
+    name: "init",
+    description: "Initialize CDAL quality gates, starter contracts, and runtime adapters in the repository"
+  },
+  args: {
+    yes: {
+      type: "boolean",
+      description: "Accept default recommendations non-interactively",
+      alias: "y",
+      default: false
+    },
+    preset: {
+      type: "string",
+      description: "Preset configuration to apply (e.g. typescript-strict, nextjs, node-service)",
+      default: "typescript-strict"
+    },
+    runtime: {
+      type: "string",
+      description: "Comma-separated runtimes to enable (claude-code, agents-md, antigravity)",
+      default: "claude-code,agents-md"
+    },
+    cwd: {
+      type: "string",
+      description: "Target directory to initialize"
+    }
+  },
+  async run({ args }) {
+    const cwd = args.cwd || process.cwd();
+    console.log(pc4.bold(pc4.cyan("\n\u{1F680} Initializing Contract-Driven Agentic Loop (CDAL)...\n")));
+    const preset = args.preset || "typescript-strict";
+    const rawRuntimes = (args.runtime || "claude-code,agents-md").split(",").map((r) => r.trim()).filter(Boolean);
+    const contractsDir = join2(cwd, "contracts");
+    if (!existsSync2(contractsDir)) {
+      mkdirSync(contractsDir, { recursive: true });
+    }
+    const sampleContractPath = join2(contractsDir, "requirements.contract.mjs");
+    if (!existsSync2(sampleContractPath)) {
+      const sampleContractContent = `// @origin: cdal init
+export const REQUIREMENTS = [
+  {
+    id: 'REQ-CORE-INIT-1',
+    statement: 'System must initialize workspace with contract-driven quality gates.',
+    acceptance: [
+      'cdal validate succeeds without errors',
+      'Test cases are marked with @REQ tags',
+    ],
+    status: 'ACTIVE',
+    priority: 'CRITICAL',
+  },
+];
+`;
+      writeFileSync2(sampleContractPath, sampleContractContent, "utf8");
+      console.log(
+        pc4.green(`  \u2713 Created starter contract: ${pc4.bold("contracts/requirements.contract.mjs")}`)
+      );
+    }
+    const configPath = join2(cwd, "cdal.config.mjs");
+    if (!existsSync2(configPath)) {
+      const runtimesFormatted = rawRuntimes.map((r) => `'${r}'`).join(", ");
+      const configContent = `import { defineConfig } from '@cdal/core';
+import { policies, requirements, stateMachine } from '@cdal/kinds';
+
+export default defineConfig({
+  contractsDir: 'contracts',
+  generated: {
+    ts: 'src/generated/contracts',
+    docs: 'docs/generated',
+  },
+  kinds: [requirements(), stateMachine(), policies()],
+  presets: ['${preset}'],
+  runtimes: [${runtimesFormatted}],
+  verify: [
+    'cdal validate --strict',
+    'cdal codegen --check',
+    'cdal trace --enforce',
+    'cdal selftest',
+  ],
+});
+`;
+      writeFileSync2(configPath, configContent, "utf8");
+      console.log(pc4.green(`  \u2713 Created configuration: ${pc4.bold("cdal.config.mjs")}`));
+    } else {
+      console.log(
+        pc4.dim("  \u2139 cdal.config.mjs already exists (preserving existing configuration).")
+      );
+    }
+    const pkgPath = join2(cwd, "package.json");
+    if (existsSync2(pkgPath)) {
+      try {
+        const pkgRaw = readFileSync2(pkgPath, "utf8");
+        const pkg = JSON.parse(pkgRaw);
+        pkg.scripts = pkg.scripts || {};
+        let updated = false;
+        if (!pkg.scripts.verify) {
+          pkg.scripts.verify = "cdal verify";
+          updated = true;
+        }
+        if (!pkg.scripts.selftest) {
+          pkg.scripts.selftest = "cdal selftest";
+          updated = true;
+        }
+        if (!pkg.scripts.trace) {
+          pkg.scripts.trace = "cdal trace";
+          updated = true;
+        }
+        if (updated) {
+          writeFileSync2(pkgPath, `${JSON.stringify(pkg, null, 2)}
+`, "utf8");
+          console.log(
+            pc4.green(`  \u2713 Added verify/selftest/trace scripts to ${pc4.bold("package.json")}`)
+          );
+        }
+      } catch {
+        console.log(pc4.yellow("  \u26A0\uFE0F  Could not update package.json scripts automatically."));
+      }
+    }
+    const resolvedConfig = resolveConfig({
+      presets: [preset],
+      runtimes: rawRuntimes
+    });
+    const syncRes = syncAdapters2({
+      cwd,
+      config: resolvedConfig,
+      check: false
+    });
+    console.log(
+      pc4.green(
+        `  \u2713 Generated ${syncRes.updatedFiles.length} runtime adapter file(s) across [${rawRuntimes.join(", ")}].`
+      )
+    );
+    console.log(pc4.bold(pc4.green("\n\u{1F389} CDAL initialized successfully!")));
+    console.log(pc4.cyan("Next steps:"));
+    console.log(pc4.dim("  1. Review contracts in contracts/*.contract.mjs"));
+    console.log(pc4.dim("  2. Run `npx cdalkit doctor` to verify environment health"));
+    console.log(pc4.dim("  3. Run `npx cdalkit verify` to test the loop gate\n"));
+  }
+});
+
+// src/commands/phase.ts
+import { checkPhase, loadConfig as loadConfig3 } from "@cdal/core";
+import { defineCommand as defineCommand6 } from "citty";
+import pc5 from "picocolors";
+var phaseCommand = defineCommand6({
+  meta: {
+    name: "phase",
+    description: "Verify git diff against active loop phase (contract, red, green)"
+  },
+  args: {
+    phase: {
+      type: "positional",
+      description: "Phase to verify: contract, red, green",
+      required: true
+    },
+    base: {
+      type: "string",
+      description: "Base git reference to compare against (e.g. main or origin/main)"
+    },
+    json: {
+      type: "boolean",
+      description: "Output as JSON payload",
+      default: false
+    },
+    config: {
+      type: "string",
+      description: "Path to cdal.config.mjs"
+    }
+  },
+  async run({ args }) {
+    const rawPhase = (args.phase || "").toLowerCase();
+    if (!["contract", "red", "green"].includes(rawPhase)) {
+      console.error(pc5.red(`Invalid phase "${rawPhase}". Valid phases are: contract, red, green.`));
+      process.exit(2);
+    }
+    const phase = rawPhase;
+    const cwd = process.cwd();
+    const { config: resolvedConfig } = await loadConfig3(args.config);
+    const result = checkPhase(phase, {
+      cwd,
+      base: args.base,
+      protectedPaths: resolvedConfig?.protectedPaths
+    });
+    if (args.json) {
+      console.log(JSON.stringify(result, null, 2));
+      process.exit(result.ok ? 0 : 1);
+    }
+    console.log(pc5.bold(`
+  Phase: ${result.label}`));
+    console.log(`  Modified files in diff: ${result.files.length}
+`);
+    if (result.violations.length === 0) {
+      if (result.files.length === 0) {
+        if (phase === "red") {
+          console.log(
+            pc5.yellow(
+              "  \u26A0 No changes found in working tree. Phase RED requires at least one test."
+            )
+          );
+          process.exit(1);
+        }
+        console.log(pc5.dim("  No changes found in working tree."));
+        process.exit(0);
+      }
+      console.log(pc5.green("  \u2714 All changes are within active phase scopes."));
+      process.exit(0);
+    }
+    console.log(
+      pc5.red(`  \u2717 ${result.violations.length} file(s) outside of permitted phase scope:
+`)
+    );
+    for (const v of result.violations) {
+      console.log(`    - ${v}`);
+    }
+    console.log(pc5.dim(`
+  ${result.why}
+`));
+    process.exit(1);
+  }
+});
+
+// src/commands/pro.ts
+import { execFileSync } from "child_process";
+import { existsSync as existsSync4, mkdtempSync, rmSync } from "fs";
+import { tmpdir } from "os";
+import { join as join4, resolve as resolve3 } from "path";
+import { defineCommand as defineCommand7 } from "citty";
+import pc6 from "picocolors";
+
+// src/pro/install.ts
+import {
+  copyFileSync,
+  existsSync as existsSync3,
+  mkdirSync as mkdirSync2,
+  readFileSync as readFileSync3,
+  readdirSync,
+  statSync,
+  writeFileSync as writeFileSync3
+} from "fs";
+import { dirname, isAbsolute, join as join3, relative, resolve as resolve2, sep } from "path";
+var PRO_MANIFEST_FILE = "pro.manifest.json";
+var PRO_RECORD_FILE = ".cdal/pro.json";
+var GENERATED_MARKERS = ["CDAL GENERATED", "GENERATED by cdal sync"];
+function isGeneratedFile(path2) {
+  const content = readFileSync3(path2, "utf8");
+  return GENERATED_MARKERS.some((marker) => content.includes(marker));
+}
+var ProInstallError = class extends Error {
+  constructor(message) {
+    super(message);
+    this.name = "ProInstallError";
+  }
+};
+function toPosix(path2) {
+  return path2.split(sep).join("/");
+}
+function resolveInside(root, rel, label) {
+  if (typeof rel !== "string" || rel.length === 0 || isAbsolute(rel)) {
+    throw new ProInstallError(`Invalid ${label} path in ${PRO_MANIFEST_FILE}: "${rel}"`);
+  }
+  const full = resolve2(root, rel);
+  const fromRoot = relative(root, full);
+  if (fromRoot.startsWith("..") || isAbsolute(fromRoot)) {
+    throw new ProInstallError(`${label} path "${rel}" escapes its directory`);
+  }
+  return full;
+}
+function readProManifest(sourceDir) {
+  const manifestPath = join3(sourceDir, PRO_MANIFEST_FILE);
+  if (!existsSync3(manifestPath)) {
+    throw new ProInstallError(`No ${PRO_MANIFEST_FILE} found in ${sourceDir}`);
+  }
+  let manifest;
+  try {
+    manifest = JSON.parse(readFileSync3(manifestPath, "utf8"));
+  } catch (err) {
+    throw new ProInstallError(
+      `${PRO_MANIFEST_FILE} is not valid JSON: ${err instanceof Error ? err.message : String(err)}`
+    );
+  }
+  if (!manifest.name || !manifest.version || !Array.isArray(manifest.install)) {
+    throw new ProInstallError(`${PRO_MANIFEST_FILE} must define name, version and install[]`);
+  }
+  return manifest;
+}
+function listFiles(dir) {
+  const files = [];
+  for (const entry of readdirSync(dir, { withFileTypes: true })) {
+    const full = join3(dir, entry.name);
+    if (entry.isDirectory()) files.push(...listFiles(full));
+    else if (entry.isFile()) files.push(full);
+  }
+  return files;
+}
+function installPro(options) {
+  const sourceDir = resolve2(options.sourceDir);
+  const targetDir = resolve2(options.targetDir);
+  const manifest = readProManifest(sourceDir);
+  const plan = [];
+  for (const mapping of manifest.install) {
+    const from = resolveInside(sourceDir, mapping.from, "from");
+    const to = resolveInside(targetDir, mapping.to, "to");
+    if (!existsSync3(from)) {
+      throw new ProInstallError(`Manifest source "${mapping.from}" does not exist`);
+    }
+    const sources = statSync(from).isDirectory() ? listFiles(from) : [from];
+    for (const src of sources) {
+      const dest = statSync(from).isDirectory() ? join3(to, relative(from, src)) : to;
+      plan.push({ src, dest, rel: toPosix(relative(targetDir, dest)) });
+    }
+  }
+  const written = [];
+  const skipped = [];
+  for (const { src, dest, rel } of plan) {
+    if (existsSync3(dest) && !options.force && !isGeneratedFile(dest)) {
+      skipped.push(rel);
+      continue;
+    }
+    written.push(rel);
+    if (!options.dryRun) {
+      mkdirSync2(dirname(dest), { recursive: true });
+      copyFileSync(src, dest);
+    }
+  }
+  if (!options.dryRun) {
+    const recordPath = join3(targetDir, PRO_RECORD_FILE);
+    mkdirSync2(dirname(recordPath), { recursive: true });
+    writeFileSync3(
+      recordPath,
+      `${JSON.stringify(
+        {
+          name: manifest.name,
+          version: manifest.version,
+          installedAt: (/* @__PURE__ */ new Date()).toISOString(),
+          files: plan.map((p) => p.rel).sort()
+        },
+        null,
+        2
+      )}
+`,
+      "utf8"
+    );
+  }
+  return { name: manifest.name, version: manifest.version, written, skipped };
+}
+
+// src/commands/pro.ts
+var PRO_REPOSITORY_URL = "https://github.com/aiprojectmanagersznurowski-afk/cdal-pro.git";
+function resolveSource(from) {
+  const local = resolve3(from);
+  if (existsSync4(local)) return { dir: local, cleanup: () => {
+  } };
+  const dir = mkdtempSync(join4(tmpdir(), "cdal-pro-"));
+  const cleanup = () => rmSync(dir, { recursive: true, force: true });
+  try {
+    execFileSync("git", ["clone", "--depth", "1", "--quiet", from, dir], {
+      stdio: ["ignore", "ignore", "pipe"]
+    });
+  } catch {
+    cleanup();
+    throw new ProInstallError(
+      `Could not clone ${from}.
+  CDAL Pro is delivered as a private GitHub repository: accept the invitation sent after your purchase, make sure git can access GitHub as that account, then run this command again.`
+    );
+  }
+  return { dir, cleanup };
+}
+var installCommand = defineCommand7({
+  meta: {
+    name: "install",
+    description: "Install CDAL Pro content (agent roles, templates, presets) into this project"
+  },
+  args: {
+    from: {
+      type: "string",
+      description: "Local copy or git URL of the cdal-pro repository",
+      default: PRO_REPOSITORY_URL
+    },
+    cwd: {
+      type: "string",
+      description: "Project directory to install into",
+      default: "."
+    },
+    force: {
+      type: "boolean",
+      description: "Overwrite files that already exist in the project",
+      default: false
+    },
+    dryRun: {
+      type: "boolean",
+      description: "Show what would be installed without writing anything",
+      default: false
+    }
+  },
+  run({ args }) {
+    let source;
+    try {
+      source = resolveSource(args.from);
+      const result = installPro({
+        sourceDir: source.dir,
+        targetDir: resolve3(args.cwd),
+        force: args.force,
+        dryRun: args.dryRun
+      });
+      const verb = args.dryRun ? "Would install" : "Installed";
+      console.log(pc6.green(`\u2714 ${verb} ${result.name} ${result.version}`));
+      console.log(`  ${result.written.length} file(s) ${args.dryRun ? "to write" : "written"}`);
+      if (result.skipped.length > 0) {
+        console.log(
+          pc6.yellow(
+            `  ${result.skipped.length} existing file(s) kept \u2014 rerun with --force to overwrite:`
+          )
+        );
+        for (const file of result.skipped) console.log(pc6.dim(`    ${file}`));
+      }
+      if (!args.dryRun) {
+        console.log(pc6.dim("  Run `npx cdalkit sync` to wire the new roles into your runtimes."));
+      }
+    } catch (err) {
+      const message = err instanceof Error ? err.message : String(err);
+      console.error(pc6.red(`\u2716 ${message}`));
+      process.exit(1);
+    } finally {
+      source?.cleanup();
+    }
+  }
+});
+var proCommand = defineCommand7({
+  meta: {
+    name: "pro",
+    description: "CDAL Pro: install licensed agent roles, templates and presets"
+  },
+  subCommands: {
+    install: installCommand
+  }
+});
+
+// src/commands/selftest.ts
+import { loadConfig as loadConfig4, runSelftest } from "@cdal/core";
+import { defineCommand as defineCommand8 } from "citty";
+import pc7 from "picocolors";
+var selftestCommand = defineCommand8({
+  meta: {
+    name: "selftest",
+    description: "Run mutation testing on contract invariant rules and content guardrails"
+  },
+  args: {
+    json: {
+      type: "boolean",
+      description: "Output as JSON payload (selftest.v1)",
+      default: false
+    },
+    config: {
+      type: "string",
+      description: "Path to cdal.config.mjs"
+    }
+  },
+  async run({ args }) {
+    const cwd = process.cwd();
+    const { config: resolvedConfig } = await loadConfig4(args.config);
+    if (!args.json) {
+      console.log(pc7.bold(pc7.cyan("\n  cdal selftest \u2014 mutation testing of quality gates")));
+      console.log(
+        pc7.dim("  Testing whether validator and guardrails actually fire red when violated\n")
+      );
+    }
+    const report = await runSelftest({
+      cwd,
+      config: resolvedConfig
+    });
+    if (args.json) {
+      console.log(JSON.stringify(report, null, 2));
+      process.exit(report.ok ? 0 : 1);
+    }
+    if (report.mutationResults.length > 0) {
+      console.log(
+        pc7.bold(
+          `  Contract Invariant Mutations (${report.mutationsPassed}/${report.mutationsTotal}):`
+        )
+      );
+      for (const m of report.mutationResults) {
+        if (m.passed) {
+          console.log(
+            `  ${pc7.green("\u2714")} ${pc7.cyan(m.rule.padEnd(26))} detected in ${pc7.dim(m.file)}`
+          );
+        } else {
+          console.log(
+            `  ${pc7.red("\u2717")} ${pc7.red(m.rule.padEnd(26))} ${pc7.bold("MISSED")}: ${m.error ?? "rule dead"}`
+          );
+        }
+      }
+      console.log("");
+    }
+    if (report.probeResults.length > 0) {
+      console.log(
+        pc7.bold(`  Forbidden Content Probes (${report.probesPassed}/${report.probesTotal}):`)
+      );
+      for (const p of report.probeResults) {
+        const action = p.fires ? "detected" : "allowed";
+        if (p.passed) {
+          console.log(
+            `  ${pc7.green("\u2714")} ${pc7.cyan(p.rule.padEnd(30))} ${pc7.green(action)}: ${p.desc}`
+          );
+        } else {
+          console.log(
+            `  ${pc7.red("\u2717")} ${pc7.red(p.rule.padEnd(30))} ${pc7.bold("FAILED")}: ${p.error ?? "unexpected behavior"}`
+          );
+        }
+      }
+      console.log("");
+    }
+    console.log(
+      pc7.bold(
+        `  Summary: ${report.mutationsPassed}/${report.mutationsTotal} contract rules verified via mutation.`
+      )
+    );
+    console.log(
+      pc7.bold(
+        `           ${report.probesPassed}/${report.probesTotal} content guardrail probes verified.
+`
+      )
+    );
+    if (report.failures.length > 0) {
+      console.log(pc7.bold(pc7.red("  CRITICAL GATE FAILURES:")));
+      for (const f of report.failures) {
+        console.log(`    - ${pc7.red(f)}`);
+      }
+      console.log("");
+      process.exit(1);
+    }
+    console.log(pc7.green(pc7.bold("  \u2714 Every quality gate rule is verified active and firing.\n")));
+    process.exit(0);
+  }
+});
+
+// src/commands/sync.ts
+import { syncAdapters as syncAdapters3 } from "@cdal/adapters";
+import { loadConfig as loadConfig5 } from "@cdal/core";
+import { defineCommand as defineCommand9 } from "citty";
+import pc8 from "picocolors";
+var syncCommand = defineCommand9({
+  meta: {
+    name: "sync",
+    description: "Synchronize agent definitions, commands, hooks and rules across configured runtimes (with --check drift detection)"
+  },
+  args: {
+    check: {
+      type: "boolean",
+      description: "Check for drift between cdal.config.mjs and runtime files without modifying disk",
+      default: false
+    },
+    config: {
+      type: "string",
+      description: "Custom path to cdal.config.mjs"
+    },
+    cwd: {
+      type: "string",
+      description: "Working directory path"
+    }
+  },
+  async run({ args }) {
+    try {
+      const cwd = args.cwd || process.cwd();
+      const { config } = await loadConfig5(args.config || cwd);
+      const res = syncAdapters3({
+        cwd,
+        config,
+        check: Boolean(args.check)
+      });
+      if (args.check) {
+        if (res.inSync) {
+          console.log(
+            pc8.green(
+              `\u2705 Sync check passed: all ${res.totalFiles} adapter file(s) are in sync across [${config.runtimes.join(", ")}].`
+            )
+          );
+        } else {
+          console.error(
+            pc8.red(
+              `\u274C Sync check failed: ${res.driftedFiles.length} adapter file(s) drifted from configuration:`
+            )
+          );
+          for (const file of res.driftedFiles) {
+            console.error(pc8.red(`  - [DRIFT] ${file}`));
+          }
+          console.error(
+            pc8.yellow(
+              "\nRun `npx cdalkit sync` to synchronize runtime files with cdal.config.mjs."
+            )
+          );
+          process.exit(1);
+        }
+      } else {
+        console.log(
+          pc8.green(
+            `\u2705 Synchronized ${res.updatedFiles.length} adapter file(s) across [${config.runtimes.join(", ")}]:`
+          )
+        );
+        for (const file of res.updatedFiles) {
+          console.log(pc8.cyan(`  - ${file}`));
+        }
+        if (res.updatedFiles.length === 0) {
+          console.log(pc8.dim("  (All files were already up-to-date)"));
+        }
+      }
+      if (res.preservedFiles.length > 0) {
+        console.log(
+          pc8.dim(
+            `  ${res.preservedFiles.length} file(s) marked cdal:preserve were left untouched.`
+          )
+        );
+      }
+    } catch (err) {
+      const msg = err instanceof Error ? err.message : String(err);
+      console.error(pc8.red(`\u274C Fatal error during sync: ${msg}`));
+      process.exit(1);
+    }
+  }
+});
+
+// src/commands/trace.ts
+import path from "path";
+import { pathToFileURL } from "url";
+import {
+  formatTraceMarkdown,
+  formatTraceText,
+  loadConfig as loadConfig6,
+  scanTrace
+} from "@cdal/core";
+import { defineCommand as defineCommand10 } from "citty";
+import pc9 from "picocolors";
+var traceCommand = defineCommand10({
+  meta: {
+    name: "trace",
+    description: "Inspect requirement-to-test traceability matrix (@REQ tags)"
+  },
+  args: {
+    enforce: {
+      type: "boolean",
+      description: "Exit with code 1 if any implementing/done requirement lacks tests, tests fail, or unknown @REQ tags exist",
+      default: false
+    },
+    markdown: {
+      type: "boolean",
+      description: "Output as Markdown table ready for pull request description",
+      default: false
+    },
+    json: {
+      type: "boolean",
+      description: "Output as structured JSON (trace.v1)",
+      default: false
+    },
+    results: {
+      type: "string",
+      description: "Path to test execution JSON results file (vitest or playwright json reporter)"
+    },
+    config: {
+      type: "string",
+      description: "Path to cdal.config.mjs"
+    }
+  },
+  async run({ args }) {
+    const cwd = process.cwd();
+    const { config: resolvedConfig } = await loadConfig6(args.config);
+    const contractsDir = resolvedConfig?.contractsDir ?? "contracts";
+    const reqContractPath = path.resolve(cwd, contractsDir, "requirements.contract.mjs");
+    let requirements3 = [];
+    try {
+      const imported = await import(pathToFileURL(reqContractPath).href);
+      requirements3 = imported.REQUIREMENTS || imported.default?.REQUIREMENTS || imported.default || [];
+    } catch (err) {
+      const errorMsg = err instanceof Error ? err.message : String(err);
+      console.error(pc9.red(`Failed to load requirements from "${reqContractPath}": ${errorMsg}`));
+      process.exit(1);
+    }
+    if (!Array.isArray(requirements3) || requirements3.length === 0) {
+      console.warn(pc9.yellow(`No requirements found in "${reqContractPath}".`));
+      if (args.enforce) process.exit(1);
+      return;
+    }
+    const report = scanTrace(requirements3, {
+      cwd,
+      resultsFile: args.results
+    });
+    if (args.json) {
+      console.log(JSON.stringify(report, null, 2));
+    } else if (args.markdown) {
+      console.log(formatTraceMarkdown(report));
+    } else {
+      console.log(formatTraceText(report));
+    }
+    if (args.enforce && !report.ok) {
+      process.exit(1);
+    }
+  }
+});
+
+// src/commands/validate.ts
+import { formatFindingsText, runValidation } from "@cdal/core";
+import { policies as policies2, requirements as requirements2, stateMachine as stateMachine2 } from "@cdal/kinds";
+import { defineCommand as defineCommand11 } from "citty";
+import pc10 from "picocolors";
+var validateCommand = defineCommand11({
+  meta: {
+    name: "validate",
+    description: "Validate contract invariants across all registered contract kinds"
+  },
+  args: {
+    strict: {
+      type: "boolean",
+      description: "Treat warnings as failures (exit 1)",
+      default: false
+    },
+    json: {
+      type: "boolean",
+      description: "Output findings using machine-readable findings.v1 JSON schema",
+      default: false
+    },
+    dir: {
+      type: "string",
+      description: "Custom path to contracts directory"
+    }
+  },
+  async run({ args }) {
+    try {
+      const defaultKinds = [requirements2(), stateMachine2(), policies2()];
+      const report = await runValidation({
+        contractsDir: args.dir,
+        strict: Boolean(args.strict),
+        kinds: defaultKinds
+      });
+      if (args.json) {
+        console.log(JSON.stringify(report, null, 2));
+      } else {
+        const text = formatFindingsText(report, Boolean(args.strict));
+        if (report.valid) {
+          console.log(pc10.green(text));
+        } else {
+          console.error(pc10.red(text));
+        }
+      }
+      if (!report.valid) {
+        process.exit(1);
+      }
+    } catch (err) {
+      const msg = err instanceof Error ? err.message : String(err);
+      console.error(pc10.red(`\u274C Fatal error during contract validation: ${msg}`));
+      process.exit(1);
+    }
+  }
+});
+
+// src/commands/verify.ts
+import { spawnSync as spawnSync2 } from "child_process";
+import { loadConfig as loadConfig7 } from "@cdal/core";
+import { defineCommand as defineCommand12 } from "citty";
+import pc11 from "picocolors";
+var verifyCommand = defineCommand12({
+  meta: {
+    name: "verify",
+    description: "Run deterministic CDAL verification pipeline defined in configuration"
+  },
+  args: {
+    fast: {
+      type: "boolean",
+      description: "Run fast subset of verification steps (contract checks & selftest)",
+      default: false
+    },
+    full: {
+      type: "boolean",
+      description: "Force execution of all verification steps",
+      default: false
+    },
+    clean: {
+      type: "boolean",
+      description: "Clear temporary caches before running verification",
+      default: false
+    },
+    config: {
+      type: "string",
+      description: "Path to cdal.config.mjs"
+    },
+    cwd: {
+      type: "string",
+      description: "Working directory path"
+    }
+  },
+  async run({ args }) {
+    const cwd = args.cwd || process.cwd();
+    const { config } = await loadConfig7(args.config || cwd);
+    let steps = [...config.verify];
+    if (args.fast) {
+      steps = steps.filter(
+        (s) => s.includes("validate") || s.includes("codegen") || s.includes("selftest") || s.includes("typecheck")
+      );
+      if (steps.length === 0) {
+        steps = [config.verify[0] ?? "cdal validate --strict"];
+      }
+    }
+    console.log(
+      pc11.bold(pc11.cyan(`
+\u26A1 Running CDAL Verification Pipeline (${steps.length} step(s))...
+`))
+    );
+    for (let i = 0; i < steps.length; i++) {
+      const step = steps[i];
+      if (!step) continue;
+      console.log(pc11.bold(pc11.blue(`[${i + 1}/${steps.length}] \u25B6 ${step}`)));
+      const start = Date.now();
+      const res = spawnSync2(step, {
+        cwd,
+        shell: true,
+        stdio: "inherit"
+      });
+      const duration = Date.now() - start;
+      if (res.status !== 0) {
+        console.error(
+          pc11.bold(
+            pc11.red(
+              `
+\u274C Verification failed at step: "${step}" (exit code ${res.status ?? 1}, took ${duration}ms)`
+            )
+          )
+        );
+        process.exit(res.status ?? 1);
+      }
+      console.log(pc11.green(`  \u2713 Step passed in ${duration}ms
+`));
+    }
+    console.log(
+      pc11.bold(
+        pc11.green(`\u2705 Full verification pipeline succeeded (${steps.length} step(s) passed).`)
+      )
+    );
+  }
+});
+
+// src/commands/window.ts
+import { closeContractWindow, getContractWindowStatus, openContractWindow } from "@cdal/core";
+import { defineCommand as defineCommand13 } from "citty";
+import pc12 from "picocolors";
+var windowCommand = defineCommand13({
+  meta: {
+    name: "window",
+    description: "Manage contract window for protected path modifications"
+  },
+  args: {
+    action: {
+      type: "positional",
+      description: "Action to perform: open, close, status",
+      required: true
+    },
+    ticket: {
+      type: "positional",
+      description: "Ticket or reason ID (required for open)",
+      required: false
+    },
+    duration: {
+      type: "string",
+      description: "Window duration in minutes (default: 60)",
+      default: "60"
+    }
+  },
+  run({ args }) {
+    const action = args.action.toLowerCase();
+    if (action === "open") {
+      const ticket = args.ticket;
+      if (!ticket) {
+        console.error(
+          pc12.red(
+            'Error: "cdal window open" requires a ticket or work order argument. Example: cdal window open WO-123'
+          )
+        );
+        process.exit(1);
+      }
+      const durationMinutes = Number.parseInt(args.duration, 10) || 60;
+      const status = openContractWindow(ticket, { durationMinutes });
+      console.log(pc12.green(`\u2714 Contract window opened for ticket: ${pc12.bold(status.ticket)}`));
+      console.log(pc12.dim(`  Expires at: ${status.expiresAt}`));
+      return;
+    }
+    if (action === "close") {
+      closeContractWindow();
+      console.log(pc12.green("\u2714 Contract window closed. Protected paths are locked."));
+      return;
+    }
+    if (action === "status") {
+      const status = getContractWindowStatus();
+      if (status.open) {
+        console.log(pc12.green(`Contract window is ${pc12.bold("OPEN")}`));
+        console.log(`  Ticket:     ${status.ticket ?? "none"}`);
+        console.log(`  Opened at:  ${status.openedAt ?? "unknown"}`);
+        console.log(`  Expires at: ${status.expiresAt ?? "unknown"}`);
+      } else {
+        console.log(pc12.yellow(`Contract window is ${pc12.bold("CLOSED")}`));
+      }
+      return;
+    }
+    console.error(pc12.red(`Unknown action "${action}". Available actions: open, close, status`));
+    process.exit(1);
+  }
+});
+
+// src/cli.ts
+var { version } = createRequire(import.meta.url)("../package.json");
+var main = defineCommand14({
+  meta: {
+    name: "cdal",
+    version,
+    description: "Contract-Driven Agentic Loop (CDAL) Quality Gates & Audit CLI"
+  },
+  subCommands: {
+    init: initCommand,
+    validate: validateCommand,
+    codegen: codegenCommand,
+    window: windowCommand,
+    trace: traceCommand,
+    phase: phaseCommand,
+    selftest: selftestCommand,
+    sync: syncCommand,
+    verify: verifyCommand,
+    doctor: doctorCommand,
+    hook: hookCommand,
+    audit: auditCommand,
+    pro: proCommand
+  }
+});
+function runMain() {
+  cittyRunMain(main);
+}
+export {
+  runMain
+};
+//# sourceMappingURL=cli.js.map