cohorte 2.10.1 → 3.0.0-dev.1

package/dist/chunks/diff-Qw0II0sj.mjs

@@ -0,0 +1,101 @@
+import { n as sha256Hex } from "./canonical-C8UxeEmB.mjs";
+import "./src-Cu3TxNob.mjs";
+import { mkdir, writeFile } from "node:fs/promises";
+import { execFile } from "node:child_process";
+import { promisify } from "node:util";
+//#region src/commands/diff/index.ts
+const exec = promisify(execFile);
+async function git(cwd, args) {
+	return (await exec("git", args, {
+		cwd,
+		maxBuffer: 4194304
+	})).stdout;
+}
+function parseNumstat(text) {
+	return text.split("\n").filter(Boolean).map((line) => {
+		const [addedText, removedText, ...pathParts] = line.split("	");
+		const path = pathParts.join("	");
+		const added = addedText === "-" ? 0 : Number(addedText);
+		const removed = removedText === "-" ? 0 : Number(removedText);
+		return {
+			path,
+			op: added === 0 && removed > 0 ? "delete" : added > 0 && removed === 0 ? "create" : "modify",
+			added,
+			removed
+		};
+	});
+}
+const diff = {
+	verb: "diff",
+	async run(ctx, args) {
+		const runId = args.positionals[0];
+		if (!runId) return 2;
+		const store = await ctx.openStore();
+		try {
+			const tree = await store.readRunTree(runId);
+			const run = tree.run;
+			const worktree = tree.worktrees.find((item) => item.slot === (args.positionals[1] ?? "_integration")) ?? tree.worktrees[0];
+			if (!worktree || !run.baseSha) return 3;
+			const base = run.baseSha;
+			const head = run.integrationHead ?? (await git(worktree.path, ["rev-parse", "HEAD"])).trim();
+			const rows = parseNumstat(await git(worktree.path, [
+				"diff",
+				"--numstat",
+				`${base}..${head}`
+			]));
+			const patch = await git(worktree.path, [
+				"diff",
+				"--binary",
+				`${base}..${head}`
+			]);
+			const artifactId = ctx.ids.next("art");
+			const artifactDir = `${ctx.cwd}/.cohorte/runs/${runId}/artifacts`;
+			const relativePatch = `.cohorte/runs/${runId}/artifacts/${artifactId}.patch`;
+			await mkdir(artifactDir, {
+				recursive: true,
+				mode: 448
+			});
+			await writeFile(`${ctx.cwd}/${relativePatch}`, patch, "utf8");
+			const document = {
+				documentVersion: 1,
+				runId,
+				base: {
+					branch: run.baseBranch,
+					sha: base
+				},
+				head: {
+					branch: run.integrationBranch ?? worktree.branch ?? "HEAD",
+					sha: head,
+					treeDigest: (await git(worktree.path, ["rev-parse", `${head}^{tree}`])).trim()
+				},
+				surfaces: [{
+					surface: args.positionals[1] ?? "shared",
+					files: rows.map((row) => ({
+						path: row.path,
+						op: row.op
+					})),
+					stat: {
+						added: rows.reduce((sum, row) => sum + row.added, 0),
+						removed: rows.reduce((sum, row) => sum + row.removed, 0)
+					},
+					patch: {
+						artifactId,
+						kind: "patch",
+						path: relativePatch,
+						sha256: sha256Hex(patch),
+						bytes: Buffer.byteLength(patch)
+					}
+				}]
+			};
+			if (args.json) ctx.stdio.stdout.write(`${JSON.stringify(document)}\n`);
+			else ctx.stdio.stdout.write(patch);
+			return 0;
+		} finally {
+			await store.close();
+		}
+	}
+};
+//#endregion
+export { diff as default };
+
+//# sourceMappingURL=diff-Qw0II0sj.mjs.map

package/dist/chunks/diff-Qw0II0sj.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"diff-Qw0II0sj.mjs","names":[],"sources":["../../../../apps/cli/src/commands/diff/index.ts"],"sourcesContent":["import { execFile } from 'node:child_process';\nimport { mkdir, writeFile } from 'node:fs/promises';\nimport { promisify } from 'node:util';\nimport { sha256Hex } from '@cohorte/base';\nimport type { CommandModule } from '../../contract/index.ts';\n\nconst exec = promisify(execFile);\ntype GitRow = { path: string; op: 'create' | 'modify' | 'delete'; added: number; removed: number };\n\nasync function git(cwd: string, args: string[]): Promise<string> {\n  const result = await exec('git', args, { cwd, maxBuffer: 4 * 1024 * 1024 });\n  return result.stdout;\n}\n\nfunction parseNumstat(text: string): GitRow[] {\n  return text\n    .split('\\n')\n    .filter(Boolean)\n    .map((line) => {\n      const [addedText, removedText, ...pathParts] = line.split('\\t');\n      const path = pathParts.join('\\t');\n      const added = addedText === '-' ? 0 : Number(addedText);\n      const removed = removedText === '-' ? 0 : Number(removedText);\n      return {\n        path,\n        op: added === 0 && removed > 0 ? 'delete' : added > 0 && removed === 0 ? 'create' : 'modify',\n        added,\n        removed,\n      };\n    });\n}\n\nconst diff: CommandModule = {\n  verb: 'diff',\n  async run(ctx, args) {\n    const runId = args.positionals[0];\n    if (!runId) return 2;\n    const store = await ctx.openStore();\n    try {\n      const tree = await store.readRunTree(runId as never);\n      const run = tree.run;\n      const worktree =\n        tree.worktrees.find((item) => item.slot === (args.positionals[1] ?? '_integration')) ?? tree.worktrees[0];\n      if (!worktree || !run.baseSha) return 3;\n      const base = run.baseSha;\n      const head = run.integrationHead ?? (await git(worktree.path, ['rev-parse', 'HEAD'])).trim();\n      const rows = parseNumstat(await git(worktree.path, ['diff', '--numstat', `${base}..${head}`]));\n      const patch = await git(worktree.path, ['diff', '--binary', `${base}..${head}`]);\n      const artifactId = ctx.ids.next<'ArtifactId'>('art');\n      const artifactDir = `${ctx.cwd}/.cohorte/runs/${runId}/artifacts`;\n      const relativePatch = `.cohorte/runs/${runId}/artifacts/${artifactId}.patch`;\n      await mkdir(artifactDir, { recursive: true, mode: 0o700 });\n      await writeFile(`${ctx.cwd}/${relativePatch}`, patch, 'utf8');\n      const document = {\n        documentVersion: 1,\n        runId,\n        base: { branch: run.baseBranch, sha: base },\n        head: {\n          branch: run.integrationBranch ?? worktree.branch ?? 'HEAD',\n          sha: head,\n          treeDigest: (await git(worktree.path, ['rev-parse', `${head}^{tree}`])).trim(),\n        },\n        surfaces: [\n          {\n            surface: args.positionals[1] ?? 'shared',\n            files: rows.map((row) => ({ path: row.path, op: row.op })),\n            stat: {\n              added: rows.reduce((sum, row) => sum + row.added, 0),\n              removed: rows.reduce((sum, row) => sum + row.removed, 0),\n            },\n            patch: {\n              artifactId,\n              kind: 'patch',\n              path: relativePatch,\n              sha256: sha256Hex(patch),\n              bytes: Buffer.byteLength(patch),\n            },\n          },\n        ],\n      };\n      if (args.json) ctx.stdio.stdout.write(`${JSON.stringify(document)}\\n`);\n      else ctx.stdio.stdout.write(patch);\n      return 0;\n    } finally {\n      await store.close();\n    }\n  },\n};\n\nexport default diff;\n"],"mappings":";;;;;;AAMA,MAAM,OAAO,UAAU,QAAQ;AAG/B,eAAe,IAAI,KAAa,MAAiC;CAE/D,QAAO,MADc,KAAK,OAAO,MAAM;EAAE;EAAK,WAAW;CAAgB,CAAC,EAAA,CAC5D;AAChB;AAEA,SAAS,aAAa,MAAwB;CAC5C,OAAO,KACJ,MAAM,IAAI,CAAC,CACX,OAAO,OAAO,CAAC,CACf,KAAK,SAAS;EACb,MAAM,CAAC,WAAW,aAAa,GAAG,aAAa,KAAK,MAAM,GAAI;EAC9D,MAAM,OAAO,UAAU,KAAK,GAAI;EAChC,MAAM,QAAQ,cAAc,MAAM,IAAI,OAAO,SAAS;EACtD,MAAM,UAAU,gBAAgB,MAAM,IAAI,OAAO,WAAW;EAC5D,OAAO;GACL;GACA,IAAI,UAAU,KAAK,UAAU,IAAI,WAAW,QAAQ,KAAK,YAAY,IAAI,WAAW;GACpF;GACA;EACF;CACF,CAAC;AACL;AAEA,MAAM,OAAsB;CAC1B,MAAM;CACN,MAAM,IAAI,KAAK,MAAM;EACnB,MAAM,QAAQ,KAAK,YAAY;EAC/B,IAAI,CAAC,OAAO,OAAO;EACnB,MAAM,QAAQ,MAAM,IAAI,UAAU;EAClC,IAAI;GACF,MAAM,OAAO,MAAM,MAAM,YAAY,KAAc;GACnD,MAAM,MAAM,KAAK;GACjB,MAAM,WACJ,KAAK,UAAU,MAAM,SAAS,KAAK,UAAU,KAAK,YAAY,MAAM,eAAe,KAAK,KAAK,UAAU;GACzG,IAAI,CAAC,YAAY,CAAC,IAAI,SAAS,OAAO;GACtC,MAAM,OAAO,IAAI;GACjB,MAAM,OAAO,IAAI,oBAAoB,MAAM,IAAI,SAAS,MAAM,CAAC,aAAa,MAAM,CAAC,EAAA,CAAG,KAAK;GAC3F,MAAM,OAAO,aAAa,MAAM,IAAI,SAAS,MAAM;IAAC;IAAQ;IAAa,GAAG,KAAK,IAAI;GAAM,CAAC,CAAC;GAC7F,MAAM,QAAQ,MAAM,IAAI,SAAS,MAAM;IAAC;IAAQ;IAAY,GAAG,KAAK,IAAI;GAAM,CAAC;GAC/E,MAAM,aAAa,IAAI,IAAI,KAAmB,KAAK;GACnD,MAAM,cAAc,GAAG,IAAI,IAAI,iBAAiB,MAAM;GACtD,MAAM,gBAAgB,iBAAiB,MAAM,aAAa,WAAW;GACrE,MAAM,MAAM,aAAa;IAAE,WAAW;IAAM,MAAM;GAAM,CAAC;GACzD,MAAM,UAAU,GAAG,IAAI,IAAI,GAAG,iBAAiB,OAAO,MAAM;GAC5D,MAAM,WAAW;IACf,iBAAiB;IACjB;IACA,MAAM;KAAE,QAAQ,IAAI;KAAY,KAAK;IAAK;IAC1C,MAAM;KACJ,QAAQ,IAAI,qBAAqB,SAAS,UAAU;KACpD,KAAK;KACL,aAAa,MAAM,IAAI,SAAS,MAAM,CAAC,aAAa,GAAG,KAAK,QAAQ,CAAC,EAAA,CAAG,KAAK;IAC/E;IACA,UAAU,CACR;KACE,SAAS,KAAK,YAAY,MAAM;KAChC,OAAO,KAAK,KAAK,SAAS;MAAE,MAAM,IAAI;MAAM,IAAI,IAAI;KAAG,EAAE;KACzD,MAAM;MACJ,OAAO,KAAK,QAAQ,KAAK,QAAQ,MAAM,IAAI,OAAO,CAAC;MACnD,SAAS,KAAK,QAAQ,KAAK,QAAQ,MAAM,IAAI,SAAS,CAAC;KACzD;KACA,OAAO;MACL;MACA,MAAM;MACN,MAAM;MACN,QAAQ,UAAU,KAAK;MACvB,OAAO,OAAO,WAAW,KAAK;KAChC;IACF,CACF;GACF;GACA,IAAI,KAAK,MAAM,IAAI,MAAM,OAAO,MAAM,GAAG,KAAK,UAAU,QAAQ,EAAE,GAAG;QAChE,IAAI,MAAM,OAAO,MAAM,KAAK;GACjC,OAAO;EACT,UAAU;GACR,MAAM,MAAM,MAAM;EACpB;CACF;AACF"}

package/dist/chunks/discover-eS01-me1.mjs

@@ -0,0 +1,21 @@
+import { N as errorOf, j as CohorteError } from "./src-Cu3TxNob.mjs";
+import "./src-CmFjh4M0.mjs";
+import { t as scanRepository } from "./scan-8Gy_B6kI.mjs";
+//#region src/commands/discover/index.ts
+const discover = {
+	verb: "discover",
+	async run(ctx, args) {
+		if (args.positionals.includes("--semantic")) throw new CohorteError(errorOf("configuration/phase-not-available", "semantic discovery is not available in V3.0"));
+		const model = await scanRepository(ctx.cwd, {
+			clock: ctx.clock,
+			toolVersion: "3.0.0"
+		});
+		if (args.json) ctx.stdio.stdout.write(`${JSON.stringify(model)}\n`);
+		else ctx.stdio.stdout.write(`${JSON.stringify(model, null, 2)}\n`);
+		return 0;
+	}
+};
+//#endregion
+export { discover as default };
+
+//# sourceMappingURL=discover-eS01-me1.mjs.map

package/dist/chunks/discover-eS01-me1.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"discover-eS01-me1.mjs","names":[],"sources":["../../../../apps/cli/src/commands/discover/index.ts"],"sourcesContent":["import { CohorteError, errorOf } from '@cohorte/base';\nimport { scanRepository } from '@cohorte/project-model';\nimport type { CommandModule } from '../../contract/index.ts';\n\nconst discover: CommandModule = {\n  verb: 'discover',\n  async run(ctx, args) {\n    if (args.positionals.includes('--semantic')) {\n      throw new CohorteError(\n        errorOf('configuration/phase-not-available', 'semantic discovery is not available in V3.0'),\n      );\n    }\n    const model = await scanRepository(ctx.cwd, { clock: ctx.clock, toolVersion: '3.0.0' });\n    if (args.json) ctx.stdio.stdout.write(`${JSON.stringify(model)}\\n`);\n    else ctx.stdio.stdout.write(`${JSON.stringify(model, null, 2)}\\n`);\n    return 0;\n  },\n};\n\nexport default discover;\n"],"mappings":";;;;AAIA,MAAM,WAA0B;CAC9B,MAAM;CACN,MAAM,IAAI,KAAK,MAAM;EACnB,IAAI,KAAK,YAAY,SAAS,YAAY,GACxC,MAAM,IAAI,aACR,QAAQ,qCAAqC,6CAA6C,CAC5F;EAEF,MAAM,QAAQ,MAAM,eAAe,IAAI,KAAK;GAAE,OAAO,IAAI;GAAO,aAAa;EAAQ,CAAC;EACtF,IAAI,KAAK,MAAM,IAAI,MAAM,OAAO,MAAM,GAAG,KAAK,UAAU,KAAK,EAAE,GAAG;OAC7D,IAAI,MAAM,OAAO,MAAM,GAAG,KAAK,UAAU,OAAO,MAAM,CAAC,EAAE,GAAG;EACjE,OAAO;CACT;AACF"}

package/dist/chunks/doctor-B-H2UK5e.mjs

@@ -0,0 +1,222 @@
+import { n as sha256Hex } from "./canonical-C8UxeEmB.mjs";
+import "./src-Cu3TxNob.mjs";
+import { n as createKeyStore, r as createTrustStore } from "./auth-BT5oVp76.mjs";
+import "./contract-BkMjU1kR.mjs";
+import { i as resolveConfig, n as loadConfig } from "./src-DcU4IXMe.mjs";
+import { _ as probeSandbox } from "./src-CId6kMsY.mjs";
+import { l as verifyProjectionAgainstEvents } from "./src-CfAOde7C.mjs";
+import { join } from "node:path";
+import { execFile } from "node:child_process";
+import { promisify } from "node:util";
+//#region src/contract/doctor.ts
+/** DESIGN §9 doctor capabilities + F-1 (ripgrep backend) + F-3 (sandbox availability) + 6.3 (protected roots). */
+const DOCTOR_CHECK_IDS = [
+	"node-version",
+	"git",
+	"sqlite",
+	"search-backend",
+	"sandbox",
+	"auth",
+	"install",
+	"config",
+	"worktree-root"
+];
+//#endregion
+//#region src/doctor/checks/auth/index.ts
+const authDoctorCheck = {
+	id: "auth",
+	description: "Checks that the configured provider's authentication is usable, without reading the token.",
+	async run(ctx) {
+		try {
+			const statuses = await ctx.runtime.resolve().authStatus([]);
+			const usable = statuses.every((status) => status.state !== "absent" && status.state !== "unknown-transient");
+			const accountNote = statuses.some((status) => status.accountLabel === void 0) ? "; account: not exposed by the engine" : "";
+			return {
+				id: "auth",
+				status: usable ? "ok" : "warning",
+				summary: `${usable ? "runtime authentication is available" : "runtime authentication needs attention"}${accountNote}`
+			};
+		} catch (error) {
+			return {
+				id: "auth",
+				status: "error",
+				summary: `authentication status unavailable: ${String(error)}`
+			};
+		}
+	}
+};
+//#endregion
+//#region src/doctor/index.ts
+const exec = promisify(execFile);
+const result = (id, summary, status = "ok") => ({
+	id,
+	summary,
+	status
+});
+function versionAtLeast(value, required) {
+	const [major = 0, minor = 0] = value.split(".").map((part) => Number.parseInt(part, 10));
+	return major > required[0] || major === required[0] && minor >= required[1];
+}
+async function runDoctor(ctx, options = {}) {
+	const checks = [
+		{
+			id: "node-version",
+			description: "Node",
+			run: async () => versionAtLeast(process.versions.node, [24, 16]) ? result("node-version", `Node ${process.versions.node}`) : result("node-version", `Node ${process.versions.node} is below 24.16`, "error")
+		},
+		{
+			id: "git",
+			description: "Git",
+			run: async () => {
+				try {
+					const { stdout } = await exec("git", ["--version"]);
+					const version = stdout.match(/(\d+\.\d+(?:\.\d+)?)/)?.[1] ?? "0.0.0";
+					return versionAtLeast(version, [2, 38]) ? result("git", `Git ${version}`) : result("git", `Git ${version} is below 2.38`, "error");
+				} catch (error) {
+					return result("git", `git unavailable: ${String(error)}`, "error");
+				}
+			}
+		},
+		{
+			id: "sqlite",
+			description: "SQLite",
+			run: async () => {
+				try {
+					const store = await ctx.openStore();
+					const info = await store.open();
+					const migration = await store.migrate("check");
+					await store.close();
+					return migration.pending.length === 0 ? result("sqlite", `${info.kind} schema ${info.schemaVersion}`) : result("sqlite", `${migration.pending.length} migration(s) pending`, "warning");
+				} catch (error) {
+					return result("sqlite", `state store unavailable: ${String(error)}`, "error");
+				}
+			}
+		},
+		{
+			id: "search-backend",
+			description: "Search",
+			run: async () => {
+				try {
+					const { stdout } = await exec("rg", ["--version"]);
+					return result("search-backend", `ripgrep ${stdout.split(/\s+/u)[1] ?? "available"}`);
+				} catch {
+					try {
+						await exec("git", ["grep", "--version"]);
+						return result("search-backend", "git grep fallback");
+					} catch {
+						return result("search-backend", "neither rg nor git grep is available", "error");
+					}
+				}
+			}
+		},
+		{
+			id: "sandbox",
+			description: "Sandbox",
+			run: async () => {
+				const capabilities = await probeSandbox();
+				return result("sandbox", `level=${capabilities.level}, backend=${capabilities.backend}, filesystem=${capabilities.filesystem}, network=${capabilities.network}`, capabilities.level === "L0-process" ? "warning" : "ok");
+			}
+		},
+		authDoctorCheck,
+		{
+			id: "install",
+			description: "Install",
+			run: async () => {
+				try {
+					const verified = await ctx.assets.verify();
+					return verified.ok ? result("install", `${ctx.install.installDir()} (assets verified)`) : result("install", `asset verification failed: ${verified.error.message}`, "error");
+				} catch (error) {
+					return result("install", `asset verification unavailable: ${String(error)}`, "warning");
+				}
+			}
+		},
+		{
+			id: "config",
+			description: "Config",
+			run: async () => {
+				try {
+					const home = ctx.env.HOME ?? ctx.cwd;
+					const keys = createKeyStore({ directory: join(home, ".cohorte", "keys") });
+					const trustStore = createTrustStore({
+						directory: join(home, ".cohorte", "trust"),
+						keys
+					});
+					const loaded = await loadConfig({
+						cwd: ctx.cwd,
+						home
+					});
+					const resolved = await resolveConfig(loaded, {
+						trustStore,
+						projectKeyId: sha256Hex(loaded.projectRoot).slice(0, 24)
+					});
+					return resolved.status === "resolved" ? result("config", `project configuration resolved at ${loaded.projectRoot}`) : result("config", `project policy requires trust: ${resolved.loosenedKeys.join(", ")}`, "warning");
+				} catch (error) {
+					return result("config", `configuration unavailable: ${String(error)}`, "error");
+				}
+			}
+		},
+		{
+			id: "worktree-root",
+			description: "Worktree",
+			run: async () => typeof process.getuid === "function" && process.getuid() === 0 ? result("worktree-root", "refusing to operate as uid 0", "error") : result("worktree-root", ctx.cwd)
+		}
+	];
+	if (options.verifyState) checks.push({
+		id: "verify-state",
+		description: "State verification",
+		run: async () => {
+			const store = await ctx.openStore();
+			try {
+				const runs = await store.listRuns({
+					limit: 1e5,
+					offset: 0
+				});
+				for (const run of runs) {
+					if (!(await store.verifyChain(run.runId)).ok) return result("verify-state", `run ${run.runId}: event chain is broken`, "error");
+					try {
+						await verifyProjectionAgainstEvents(store, run);
+					} catch (error) {
+						return result("verify-state", `run ${run.runId}: projection mismatch (${String(error)})`, "error");
+					}
+				}
+				return result("verify-state", `verified ${runs.length} run(s)`);
+			} finally {
+				await store.close();
+			}
+		}
+	});
+	const byId = new Map(checks.map((check) => [check.id, check]));
+	return Promise.all(DOCTOR_CHECK_IDS.map(async (id) => byId.get(id)?.run(ctx) ?? result(id, "check unavailable", "skipped")));
+}
+//#endregion
+//#region src/commands/doctor/index.ts
+const doctor = {
+	verb: "doctor",
+	async run(ctx, args) {
+		const checks = await runDoctor(ctx, { verifyState: args.positionals.includes("--verify-state") });
+		if (args.json) {
+			let sandbox = {};
+			let runtimeCapabilities = {};
+			try {
+				sandbox = await probeSandbox();
+			} catch {}
+			try {
+				runtimeCapabilities = ctx.runtime.capabilities?.() ?? { provider: ctx.runtime.resolve().id };
+			} catch {}
+			ctx.stdio.stdout.write(`${JSON.stringify({
+				documentVersion: 1,
+				cohorteVersion: "3.0.0",
+				generatedAt: ctx.clock.now(),
+				ok: checks.every((check) => check.status === "ok" || check.status === "skipped"),
+				checks,
+				sandbox,
+				runtimeCapabilities
+			})}\n`);
+		} else for (const check of checks) ctx.stdio.stdout.write(`${check.status.padEnd(7)} ${check.id}: ${check.summary}\n`);
+		return checks.some((check) => check.status === "error") ? 1 : 0;
+	}
+};
+//#endregion
+export { doctor as default };
+
+//# sourceMappingURL=doctor-B-H2UK5e.mjs.map

package/dist/chunks/doctor-B-H2UK5e.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"doctor-B-H2UK5e.mjs","names":[],"sources":["../../../../apps/cli/src/contract/doctor.ts","../../../../apps/cli/src/doctor/checks/auth/index.ts","../../../../apps/cli/src/doctor/index.ts","../../../../apps/cli/src/commands/doctor/index.ts"],"sourcesContent":["// apps/cli/src/contract/doctor.ts — the frozen list of doctor check modules (PLAN PC-4 \"DoctorCheck + the frozen\n// list of doctor check modules\"). `doctor/index.ts` (area barrel, U4.05) runs every id of `DOCTOR_CHECK_IDS`\n// through `doctor/checks/<id>/index.ts`; only `auth` is a Wave-0 owned stub (`apps/cli/src/doctor/checks/auth`,\n// filled by U5.05) — the rest are created, under the same shape, by U4.05.\nimport type { DOCTOR_CHECK_STATUSES } from '@cohorte/protocol';\nimport type { CliContext } from './context.ts';\n\nexport type DoctorCheckStatus = (typeof DOCTOR_CHECK_STATUSES)[number];\n\nexport interface DoctorCheckResult {\n  readonly id: string;\n  readonly status: DoctorCheckStatus;\n  readonly summary: string;\n  readonly remediation?: string;\n}\n\nexport interface DoctorCheck {\n  readonly id: string;\n  readonly description: string;\n  run(ctx: CliContext): Promise<DoctorCheckResult>;\n}\n\n/** DESIGN §9 doctor capabilities + F-1 (ripgrep backend) + F-3 (sandbox availability) + 6.3 (protected roots). */\nexport const DOCTOR_CHECK_IDS = [\n  'node-version',\n  'git',\n  'sqlite',\n  'search-backend',\n  'sandbox',\n  'auth',\n  'install',\n  'config',\n  'worktree-root',\n] as const;\nexport type DoctorCheckId = (typeof DOCTOR_CHECK_IDS)[number];\n","// apps/cli/src/doctor/checks/auth/index.ts — the `auth` doctor check (spec 10 \"auth status\"). Wave-0 typed stub:\n// filled by `U5.05`, which owns `apps/cli/src/doctor/checks/auth/**`.\nimport type { DoctorCheck } from '../../../contract/index.ts';\n\nconst authDoctorCheck: DoctorCheck = {\n  id: 'auth',\n  description: \"Checks that the configured provider's authentication is usable, without reading the token.\",\n  async run(ctx) {\n    try {\n      const statuses = await ctx.runtime.resolve().authStatus([]);\n      const usable = statuses.every((status) => status.state !== 'absent' && status.state !== 'unknown-transient');\n      const accountNote = statuses.some((status) => status.accountLabel === undefined)\n        ? '; account: not exposed by the engine'\n        : '';\n      return {\n        id: 'auth',\n        status: usable ? 'ok' : 'warning',\n        summary: `${usable ? 'runtime authentication is available' : 'runtime authentication needs attention'}${accountNote}`,\n      };\n    } catch (error) {\n      return { id: 'auth', status: 'error', summary: `authentication status unavailable: ${String(error)}` };\n    }\n  },\n};\n\nexport default authDoctorCheck;\n","// apps/cli/src/doctor/index.ts — AREA barrel: runs every `DOCTOR_CHECK_IDS` entry (contract/doctor.ts) through\n// `doctor/checks/<id>/index.ts` and assembles a `DoctorReport`. Wave-0 stub: filled by `U4.05`, which owns\n// `apps/cli/src/doctor/**` (this file included); only `checks/auth/**` is carved out to `U5.05`.\nimport { execFile } from 'node:child_process';\nimport { join } from 'node:path';\nimport { promisify } from 'node:util';\nimport { sha256Hex } from '@cohorte/base';\nimport { loadConfig, resolveConfig } from '@cohorte/config';\nimport { verifyProjectionAgainstEvents } from '@cohorte/core';\nimport { createKeyStore, createTrustStore } from '@cohorte/security/auth';\nimport { probeSandbox } from '@cohorte/security/exec';\nimport { type CliContext, DOCTOR_CHECK_IDS, type DoctorCheck, type DoctorCheckResult } from '../contract/index.ts';\nimport authDoctorCheck from './checks/auth/index.ts';\n\nconst exec = promisify(execFile);\nconst result = (id: string, summary: string, status: DoctorCheckResult['status'] = 'ok'): DoctorCheckResult => ({\n  id,\n  summary,\n  status,\n});\n\nfunction versionAtLeast(value: string, required: [number, number]): boolean {\n  const [major = 0, minor = 0] = value.split('.').map((part) => Number.parseInt(part, 10));\n  return major > required[0] || (major === required[0] && minor >= required[1]);\n}\n\nexport async function runDoctor(\n  ctx: CliContext,\n  options: { readonly verifyState?: boolean } = {},\n): Promise<readonly DoctorCheckResult[]> {\n  const checks: DoctorCheck[] = [\n    {\n      id: 'node-version',\n      description: 'Node',\n      run: async () =>\n        versionAtLeast(process.versions.node, [24, 16])\n          ? result('node-version', `Node ${process.versions.node}`)\n          : result('node-version', `Node ${process.versions.node} is below 24.16`, 'error'),\n    },\n    {\n      id: 'git',\n      description: 'Git',\n      run: async () => {\n        try {\n          const { stdout } = await exec('git', ['--version']);\n          const version = stdout.match(/(\\d+\\.\\d+(?:\\.\\d+)?)/)?.[1] ?? '0.0.0';\n          return versionAtLeast(version, [2, 38])\n            ? result('git', `Git ${version}`)\n            : result('git', `Git ${version} is below 2.38`, 'error');\n        } catch (error) {\n          return result('git', `git unavailable: ${String(error)}`, 'error');\n        }\n      },\n    },\n    {\n      id: 'sqlite',\n      description: 'SQLite',\n      run: async () => {\n        try {\n          const store = await ctx.openStore();\n          const info = await store.open();\n          const migration = await store.migrate('check');\n          await store.close();\n          return migration.pending.length === 0\n            ? result('sqlite', `${info.kind} schema ${info.schemaVersion}`)\n            : result('sqlite', `${migration.pending.length} migration(s) pending`, 'warning');\n        } catch (error) {\n          return result('sqlite', `state store unavailable: ${String(error)}`, 'error');\n        }\n      },\n    },\n    {\n      id: 'search-backend',\n      description: 'Search',\n      run: async () => {\n        try {\n          const { stdout } = await exec('rg', ['--version']);\n          return result('search-backend', `ripgrep ${stdout.split(/\\s+/u)[1] ?? 'available'}`);\n        } catch {\n          try {\n            await exec('git', ['grep', '--version']);\n            return result('search-backend', 'git grep fallback');\n          } catch {\n            return result('search-backend', 'neither rg nor git grep is available', 'error');\n          }\n        }\n      },\n    },\n    {\n      id: 'sandbox',\n      description: 'Sandbox',\n      run: async () => {\n        const capabilities = await probeSandbox();\n        return result(\n          'sandbox',\n          `level=${capabilities.level}, backend=${capabilities.backend}, filesystem=${capabilities.filesystem}, network=${capabilities.network}`,\n          capabilities.level === 'L0-process' ? 'warning' : 'ok',\n        );\n      },\n    },\n    authDoctorCheck,\n    {\n      id: 'install',\n      description: 'Install',\n      run: async () => {\n        try {\n          const verified = await ctx.assets.verify();\n          return verified.ok\n            ? result('install', `${ctx.install.installDir()} (assets verified)`)\n            : result('install', `asset verification failed: ${verified.error.message}`, 'error');\n        } catch (error) {\n          return result('install', `asset verification unavailable: ${String(error)}`, 'warning');\n        }\n      },\n    },\n    {\n      id: 'config',\n      description: 'Config',\n      run: async () => {\n        try {\n          const home = ctx.env.HOME ?? ctx.cwd;\n          const keys = createKeyStore({ directory: join(home, '.cohorte', 'keys') });\n          const trustStore = createTrustStore({ directory: join(home, '.cohorte', 'trust'), keys });\n          const loaded = await loadConfig({ cwd: ctx.cwd, home });\n          const resolved = await resolveConfig(loaded, {\n            trustStore,\n            projectKeyId: sha256Hex(loaded.projectRoot).slice(0, 24),\n          });\n          return resolved.status === 'resolved'\n            ? result('config', `project configuration resolved at ${loaded.projectRoot}`)\n            : result('config', `project policy requires trust: ${resolved.loosenedKeys.join(', ')}`, 'warning');\n        } catch (error) {\n          return result('config', `configuration unavailable: ${String(error)}`, 'error');\n        }\n      },\n    },\n    {\n      id: 'worktree-root',\n      description: 'Worktree',\n      run: async () =>\n        typeof process.getuid === 'function' && process.getuid() === 0\n          ? result('worktree-root', 'refusing to operate as uid 0', 'error')\n          : result('worktree-root', ctx.cwd),\n    },\n  ];\n  if (options.verifyState) {\n    checks.push({\n      id: 'verify-state',\n      description: 'State verification',\n      run: async () => {\n        const store = await ctx.openStore();\n        try {\n          const runs = await store.listRuns({ limit: 100_000, offset: 0 });\n          for (const run of runs) {\n            const chain = await store.verifyChain(run.runId);\n            if (!chain.ok) return result('verify-state', `run ${run.runId}: event chain is broken`, 'error');\n            try {\n              await verifyProjectionAgainstEvents(store, run);\n            } catch (error) {\n              return result('verify-state', `run ${run.runId}: projection mismatch (${String(error)})`, 'error');\n            }\n          }\n          return result('verify-state', `verified ${runs.length} run(s)`);\n        } finally {\n          await store.close();\n        }\n      },\n    });\n  }\n  const byId = new Map(checks.map((check) => [check.id, check]));\n  return Promise.all(\n    DOCTOR_CHECK_IDS.map(async (id) => byId.get(id)?.run(ctx) ?? result(id, 'check unavailable', 'skipped')),\n  );\n}\n","// apps/cli/src/commands/doctor/index.ts — DESIGN §9 verb `doctor` (PLAN §3 rule 3 \"later units fill\n// stub files that lie inside their owned paths; they never edit ... the registry\"). Wave-0 stub: exits with the\n// documented not-available error (spec 24 `configuration/phase-not-available`); filled by the Wave-4/5\n// unit that owns `apps/cli/src/commands/doctor/**`.\nimport { probeSandbox } from '@cohorte/security/exec';\nimport type { CommandModule } from '../../contract/index.ts';\nimport { runDoctor } from '../../doctor/index.ts';\n\nconst doctor: CommandModule = {\n  verb: 'doctor',\n  async run(ctx, args) {\n    const checks = await runDoctor(ctx, { verifyState: args.positionals.includes('--verify-state') });\n    if (args.json) {\n      let sandbox: unknown = {};\n      let runtimeCapabilities: unknown = {};\n      try {\n        sandbox = await probeSandbox();\n      } catch {\n        // The corresponding check already reports the diagnostic; keep JSON stable.\n      }\n      try {\n        runtimeCapabilities = ctx.runtime.capabilities?.() ?? { provider: ctx.runtime.resolve().id };\n      } catch {\n        // A provider may be unavailable while the rest of doctor remains useful.\n      }\n      ctx.stdio.stdout.write(\n        `${JSON.stringify({ documentVersion: 1, cohorteVersion: '3.0.0', generatedAt: ctx.clock.now(), ok: checks.every((check) => check.status === 'ok' || check.status === 'skipped'), checks, sandbox, runtimeCapabilities })}\\n`,\n      );\n    } else\n      for (const check of checks) ctx.stdio.stdout.write(`${check.status.padEnd(7)} ${check.id}: ${check.summary}\\n`);\n    return checks.some((check) => check.status === 'error') ? 1 : 0;\n  },\n};\n\nexport default doctor;\n"],"mappings":";;;;;;;;;;;;AAuBA,MAAa,mBAAmB;CAC9B;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;AACF;;;AC7BA,MAAM,kBAA+B;CACnC,IAAI;CACJ,aAAa;CACb,MAAM,IAAI,KAAK;EACb,IAAI;GACF,MAAM,WAAW,MAAM,IAAI,QAAQ,QAAQ,CAAC,CAAC,WAAW,CAAC,CAAC;GAC1D,MAAM,SAAS,SAAS,OAAO,WAAW,OAAO,UAAU,YAAY,OAAO,UAAU,mBAAmB;GAC3G,MAAM,cAAc,SAAS,MAAM,WAAW,OAAO,iBAAiB,KAAA,CAAS,IAC3E,yCACA;GACJ,OAAO;IACL,IAAI;IACJ,QAAQ,SAAS,OAAO;IACxB,SAAS,GAAG,SAAS,wCAAwC,2CAA2C;GAC1G;EACF,SAAS,OAAO;GACd,OAAO;IAAE,IAAI;IAAQ,QAAQ;IAAS,SAAS,sCAAsC,OAAO,KAAK;GAAI;EACvG;CACF;AACF;;;ACTA,MAAM,OAAO,UAAU,QAAQ;AAC/B,MAAM,UAAU,IAAY,SAAiB,SAAsC,UAA6B;CAC9G;CACA;CACA;AACF;AAEA,SAAS,eAAe,OAAe,UAAqC;CAC1E,MAAM,CAAC,QAAQ,GAAG,QAAQ,KAAK,MAAM,MAAM,GAAG,CAAC,CAAC,KAAK,SAAS,OAAO,SAAS,MAAM,EAAE,CAAC;CACvF,OAAO,QAAQ,SAAS,MAAO,UAAU,SAAS,MAAM,SAAS,SAAS;AAC5E;AAEA,eAAsB,UACpB,KACA,UAA8C,CAAC,GACR;CACvC,MAAM,SAAwB;EAC5B;GACE,IAAI;GACJ,aAAa;GACb,KAAK,YACH,eAAe,QAAQ,SAAS,MAAM,CAAC,IAAI,EAAE,CAAC,IAC1C,OAAO,gBAAgB,QAAQ,QAAQ,SAAS,MAAM,IACtD,OAAO,gBAAgB,QAAQ,QAAQ,SAAS,KAAK,kBAAkB,OAAO;EACtF;EACA;GACE,IAAI;GACJ,aAAa;GACb,KAAK,YAAY;IACf,IAAI;KACF,MAAM,EAAE,WAAW,MAAM,KAAK,OAAO,CAAC,WAAW,CAAC;KAClD,MAAM,UAAU,OAAO,MAAM,sBAAsB,CAAC,GAAG,MAAM;KAC7D,OAAO,eAAe,SAAS,CAAC,GAAG,EAAE,CAAC,IAClC,OAAO,OAAO,OAAO,SAAS,IAC9B,OAAO,OAAO,OAAO,QAAQ,iBAAiB,OAAO;IAC3D,SAAS,OAAO;KACd,OAAO,OAAO,OAAO,oBAAoB,OAAO,KAAK,KAAK,OAAO;IACnE;GACF;EACF;EACA;GACE,IAAI;GACJ,aAAa;GACb,KAAK,YAAY;IACf,IAAI;KACF,MAAM,QAAQ,MAAM,IAAI,UAAU;KAClC,MAAM,OAAO,MAAM,MAAM,KAAK;KAC9B,MAAM,YAAY,MAAM,MAAM,QAAQ,OAAO;KAC7C,MAAM,MAAM,MAAM;KAClB,OAAO,UAAU,QAAQ,WAAW,IAChC,OAAO,UAAU,GAAG,KAAK,KAAK,UAAU,KAAK,eAAe,IAC5D,OAAO,UAAU,GAAG,UAAU,QAAQ,OAAO,wBAAwB,SAAS;IACpF,SAAS,OAAO;KACd,OAAO,OAAO,UAAU,4BAA4B,OAAO,KAAK,KAAK,OAAO;IAC9E;GACF;EACF;EACA;GACE,IAAI;GACJ,aAAa;GACb,KAAK,YAAY;IACf,IAAI;KACF,MAAM,EAAE,WAAW,MAAM,KAAK,MAAM,CAAC,WAAW,CAAC;KACjD,OAAO,OAAO,kBAAkB,WAAW,OAAO,MAAM,MAAM,CAAC,CAAC,MAAM,aAAa;IACrF,QAAQ;KACN,IAAI;MACF,MAAM,KAAK,OAAO,CAAC,QAAQ,WAAW,CAAC;MACvC,OAAO,OAAO,kBAAkB,mBAAmB;KACrD,QAAQ;MACN,OAAO,OAAO,kBAAkB,wCAAwC,OAAO;KACjF;IACF;GACF;EACF;EACA;GACE,IAAI;GACJ,aAAa;GACb,KAAK,YAAY;IACf,MAAM,eAAe,MAAM,aAAa;IACxC,OAAO,OACL,WACA,SAAS,aAAa,MAAM,YAAY,aAAa,QAAQ,eAAe,aAAa,WAAW,YAAY,aAAa,WAC7H,aAAa,UAAU,eAAe,YAAY,IACpD;GACF;EACF;EACA;EACA;GACE,IAAI;GACJ,aAAa;GACb,KAAK,YAAY;IACf,IAAI;KACF,MAAM,WAAW,MAAM,IAAI,OAAO,OAAO;KACzC,OAAO,SAAS,KACZ,OAAO,WAAW,GAAG,IAAI,QAAQ,WAAW,EAAE,mBAAmB,IACjE,OAAO,WAAW,8BAA8B,SAAS,MAAM,WAAW,OAAO;IACvF,SAAS,OAAO;KACd,OAAO,OAAO,WAAW,mCAAmC,OAAO,KAAK,KAAK,SAAS;IACxF;GACF;EACF;EACA;GACE,IAAI;GACJ,aAAa;GACb,KAAK,YAAY;IACf,IAAI;KACF,MAAM,OAAO,IAAI,IAAI,QAAQ,IAAI;KACjC,MAAM,OAAO,eAAe,EAAE,WAAW,KAAK,MAAM,YAAY,MAAM,EAAE,CAAC;KACzE,MAAM,aAAa,iBAAiB;MAAE,WAAW,KAAK,MAAM,YAAY,OAAO;MAAG;KAAK,CAAC;KACxF,MAAM,SAAS,MAAM,WAAW;MAAE,KAAK,IAAI;MAAK;KAAK,CAAC;KACtD,MAAM,WAAW,MAAM,cAAc,QAAQ;MAC3C;MACA,cAAc,UAAU,OAAO,WAAW,CAAC,CAAC,MAAM,GAAG,EAAE;KACzD,CAAC;KACD,OAAO,SAAS,WAAW,aACvB,OAAO,UAAU,qCAAqC,OAAO,aAAa,IAC1E,OAAO,UAAU,kCAAkC,SAAS,aAAa,KAAK,IAAI,KAAK,SAAS;IACtG,SAAS,OAAO;KACd,OAAO,OAAO,UAAU,8BAA8B,OAAO,KAAK,KAAK,OAAO;IAChF;GACF;EACF;EACA;GACE,IAAI;GACJ,aAAa;GACb,KAAK,YACH,OAAO,QAAQ,WAAW,cAAc,QAAQ,OAAO,MAAM,IACzD,OAAO,iBAAiB,gCAAgC,OAAO,IAC/D,OAAO,iBAAiB,IAAI,GAAG;EACvC;CACF;CACA,IAAI,QAAQ,aACV,OAAO,KAAK;EACV,IAAI;EACJ,aAAa;EACb,KAAK,YAAY;GACf,MAAM,QAAQ,MAAM,IAAI,UAAU;GAClC,IAAI;IACF,MAAM,OAAO,MAAM,MAAM,SAAS;KAAE,OAAO;KAAS,QAAQ;IAAE,CAAC;IAC/D,KAAK,MAAM,OAAO,MAAM;KAEtB,IAAI,EAAC,MADe,MAAM,YAAY,IAAI,KAAK,EAAA,CACpC,IAAI,OAAO,OAAO,gBAAgB,OAAO,IAAI,MAAM,0BAA0B,OAAO;KAC/F,IAAI;MACF,MAAM,8BAA8B,OAAO,GAAG;KAChD,SAAS,OAAO;MACd,OAAO,OAAO,gBAAgB,OAAO,IAAI,MAAM,yBAAyB,OAAO,KAAK,EAAE,IAAI,OAAO;KACnG;IACF;IACA,OAAO,OAAO,gBAAgB,YAAY,KAAK,OAAO,QAAQ;GAChE,UAAU;IACR,MAAM,MAAM,MAAM;GACpB;EACF;CACF,CAAC;CAEH,MAAM,OAAO,IAAI,IAAI,OAAO,KAAK,UAAU,CAAC,MAAM,IAAI,KAAK,CAAC,CAAC;CAC7D,OAAO,QAAQ,IACb,iBAAiB,IAAI,OAAO,OAAO,KAAK,IAAI,EAAE,CAAC,EAAE,IAAI,GAAG,KAAK,OAAO,IAAI,qBAAqB,SAAS,CAAC,CACzG;AACF;;;ACrKA,MAAM,SAAwB;CAC5B,MAAM;CACN,MAAM,IAAI,KAAK,MAAM;EACnB,MAAM,SAAS,MAAM,UAAU,KAAK,EAAE,aAAa,KAAK,YAAY,SAAS,gBAAgB,EAAE,CAAC;EAChG,IAAI,KAAK,MAAM;GACb,IAAI,UAAmB,CAAC;GACxB,IAAI,sBAA+B,CAAC;GACpC,IAAI;IACF,UAAU,MAAM,aAAa;GAC/B,QAAQ,CAER;GACA,IAAI;IACF,sBAAsB,IAAI,QAAQ,eAAe,KAAK,EAAE,UAAU,IAAI,QAAQ,QAAQ,CAAC,CAAC,GAAG;GAC7F,QAAQ,CAER;GACA,IAAI,MAAM,OAAO,MACf,GAAG,KAAK,UAAU;IAAE,iBAAiB;IAAG,gBAAgB;IAAS,aAAa,IAAI,MAAM,IAAI;IAAG,IAAI,OAAO,OAAO,UAAU,MAAM,WAAW,QAAQ,MAAM,WAAW,SAAS;IAAG;IAAQ;IAAS;GAAoB,CAAC,EAAE,GAC3N;EACF,OACE,KAAK,MAAM,SAAS,QAAQ,IAAI,MAAM,OAAO,MAAM,GAAG,MAAM,OAAO,OAAO,CAAC,EAAE,GAAG,MAAM,GAAG,IAAI,MAAM,QAAQ,GAAG;EAChH,OAAO,OAAO,MAAM,UAAU,MAAM,WAAW,OAAO,IAAI,IAAI;CAChE;AACF"}

package/dist/chunks/fix-D4Tj8RVA.mjs

@@ -0,0 +1,18 @@
+//#region src/commands/fix/index.ts
+const fix = {
+	verb: "fix",
+	async run(ctx, args) {
+		const runId = args.positionals[0];
+		if (!runId) return 2;
+		const result = await ctx.controller.send("retry", { target: {
+			kind: "phase",
+			state: "FIX"
+		} }, { runId });
+		ctx.stdio.stdout.write(`${JSON.stringify(result)}\n`);
+		return result.status === "rejected" ? 3 : result.status === "pending" ? 4 : 0;
+	}
+};
+//#endregion
+export { fix as default };
+
+//# sourceMappingURL=fix-D4Tj8RVA.mjs.map

package/dist/chunks/fix-D4Tj8RVA.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"fix-D4Tj8RVA.mjs","names":[],"sources":["../../../../apps/cli/src/commands/fix/index.ts"],"sourcesContent":["// apps/cli/src/commands/fix/index.ts — DESIGN §9 verb `fix` (PLAN §3 rule 3 \"later units fill\n// stub files that lie inside their owned paths; they never edit ... the registry\"). Wave-0 stub: exits with the\n// documented not-available error (spec 24 `configuration/phase-not-available`); filled by the Wave-4/5\n// unit that owns `apps/cli/src/commands/fix/**`.\nimport type { CommandModule } from '../../contract/index.ts';\n\nconst fix: CommandModule = {\n  verb: 'fix',\n  async run(ctx, args) {\n    const runId = args.positionals[0];\n    if (!runId) return 2;\n    const result = await ctx.controller.send('retry', { target: { kind: 'phase', state: 'FIX' } }, { runId });\n    ctx.stdio.stdout.write(`${JSON.stringify(result)}\\n`);\n    return result.status === 'rejected' ? 3 : result.status === 'pending' ? 4 : 0;\n  },\n};\n\nexport default fix;\n"],"mappings":";AAMA,MAAM,MAAqB;CACzB,MAAM;CACN,MAAM,IAAI,KAAK,MAAM;EACnB,MAAM,QAAQ,KAAK,YAAY;EAC/B,IAAI,CAAC,OAAO,OAAO;EACnB,MAAM,SAAS,MAAM,IAAI,WAAW,KAAK,SAAS,EAAE,QAAQ;GAAE,MAAM;GAAS,OAAO;EAAM,EAAE,GAAG,EAAE,MAAM,CAAC;EACxG,IAAI,MAAM,OAAO,MAAM,GAAG,KAAK,UAAU,MAAM,EAAE,GAAG;EACpD,OAAO,OAAO,WAAW,aAAa,IAAI,OAAO,WAAW,YAAY,IAAI;CAC9E;AACF"}

package/dist/chunks/gc-BBXlBF5w.mjs

@@ -0,0 +1,161 @@
+import { readFile, readdir, rm, stat, writeFile } from "node:fs/promises";
+import { join } from "node:path";
+import { parse } from "yaml";
+import { promisify } from "node:util";
+import { gzip } from "node:zlib";
+//#region src/commands/gc/index.ts
+const gzipAsync = promisify(gzip);
+const TERMINAL = /* @__PURE__ */ new Set(["COMPLETED", "CANCELLED"]);
+const DEFAULT_RETENTION = {
+	transcriptsDays: 30,
+	artifactsDays: 90,
+	compressAfterDays: 7
+};
+async function filesUnder(root) {
+	const result = [];
+	async function visit(directory) {
+		let entries;
+		try {
+			entries = await readdir(directory, { withFileTypes: true });
+		} catch (error) {
+			if (error.code === "ENOENT") return;
+			throw error;
+		}
+		for (const entry of entries) {
+			const path = join(directory, entry.name);
+			if (entry.isDirectory()) await visit(path);
+			else if (entry.isFile()) result.push(path);
+		}
+	}
+	await visit(root);
+	return result;
+}
+function classify(path) {
+	const normalized = path.replaceAll("\\", "/").toLowerCase();
+	if (normalized.endsWith(".gz")) return void 0;
+	if (normalized.includes("/sensitive/") || normalized.endsWith(".sensitive") || normalized.endsWith(".sensitive.json")) return "sensitive";
+	if (normalized.includes("/transcripts/") || normalized.includes("/wire/") || normalized.includes("/logs/")) return "transcript";
+	if (normalized.includes("/artifacts/")) return "artifact";
+	if (normalized.includes("/spool/") || normalized.includes("/stream/")) return "spool";
+}
+async function readRetention(cwd) {
+	try {
+		const value = parse(await readFile(join(cwd, ".cohorte", "config.yaml"), "utf8"));
+		return {
+			...DEFAULT_RETENTION,
+			...value.retention ?? {}
+		};
+	} catch {
+		return DEFAULT_RETENTION;
+	}
+}
+const CAS_ADDRESS = /^[a-f0-9]{64}$/;
+async function referencedCasAddresses(runs, casRoot) {
+	const retained = /* @__PURE__ */ new Set();
+	for (const run of runs) {
+		const digest = run.snapshotDigest;
+		if (!digest || !CAS_ADDRESS.test(digest)) continue;
+		retained.add(digest);
+		const path = join(casRoot, digest.slice(0, 2), digest);
+		try {
+			const text = (await readFile(path, "utf8")).toString();
+			for (const address of text.match(/[a-f0-9]{64}/g) ?? []) retained.add(address);
+		} catch {}
+	}
+	return retained;
+}
+async function planGc(ctx) {
+	const store = await ctx.openStore();
+	try {
+		const runs = await store.listRuns({
+			limit: 1e5,
+			offset: 0
+		});
+		const retention = await readRetention(ctx.cwd);
+		const root = join(ctx.cwd, ".cohorte", "state", "runs");
+		const casRoot = join(ctx.cwd, ".cohorte", "state", "cas");
+		const now = Date.parse(ctx.clock.now());
+		const actions = [];
+		for (const run of runs) {
+			if (!TERMINAL.has(run.state)) continue;
+			if (run.purgeable && typeof store.purgeEvents === "function") actions.push({
+				kind: "purge-events",
+				path: `.cohorte/state/events/${run.runId}`,
+				runId: run.runId
+			});
+			for (const path of await filesUnder(join(root, run.runId))) {
+				const kind = classify(path);
+				if (!kind) continue;
+				const age = Math.max(0, now - (await stat(path)).mtimeMs);
+				if (kind === "sensitive" && age >= retention.compressAfterDays * 864e5) actions.push({
+					kind: "compress",
+					path,
+					runId: run.runId
+				});
+				else if (kind === "transcript" && age >= retention.transcriptsDays * 864e5) actions.push({
+					kind: "delete",
+					path,
+					runId: run.runId
+				});
+				else if (kind === "artifact" && age >= retention.artifactsDays * 864e5) actions.push({
+					kind: "delete",
+					path,
+					runId: run.runId
+				});
+				else if (kind === "spool" && age >= 864e5) actions.push({
+					kind: "delete",
+					path,
+					runId: run.runId
+				});
+			}
+		}
+		const retainedCas = await referencedCasAddresses(runs, casRoot);
+		for (const path of await filesUnder(casRoot)) {
+			const address = path.split("/").at(-1) ?? "";
+			if (CAS_ADDRESS.test(address) && !retainedCas.has(address)) actions.push({
+				kind: "delete-cas",
+				path,
+				runId: "cas"
+			});
+		}
+		return actions.sort((a, b) => a.path.localeCompare(b.path));
+	} finally {
+		await store.close();
+	}
+}
+async function applyAction(action, store) {
+	if (action.kind === "purge-events") {
+		await store.purgeEvents?.(action.runId);
+		return;
+	}
+	if (action.kind === "delete" || action.kind === "delete-cas") return rm(action.path, { force: true });
+	const compressed = await gzipAsync(await readFile(action.path));
+	await writeFile(`${action.path}.gz`, compressed, { mode: 384 });
+	await rm(action.path, { force: true });
+}
+const gc = {
+	verb: "gc",
+	async run(ctx, args) {
+		const dryRun = args.positionals.includes("--dry-run");
+		const apply = args.positionals.includes("--apply");
+		if (dryRun === apply) return 2;
+		const actions = await planGc(ctx);
+		if (apply) {
+			const store = await ctx.openStore();
+			try {
+				for (const action of actions) await applyAction(action, store);
+			} finally {
+				await store.close();
+			}
+		}
+		ctx.stdio.stdout.write(`${JSON.stringify({
+			mode: dryRun ? "dry-run" : "apply",
+			actions
+		})}\n`);
+		return 0;
+	}
+};
+//#endregion
+export { gc as default };
+
+//# sourceMappingURL=gc-BBXlBF5w.mjs.map

package/dist/chunks/gc-BBXlBF5w.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"gc-BBXlBF5w.mjs","names":[],"sources":["../../../../apps/cli/src/commands/gc/index.ts"],"sourcesContent":["// apps/cli/src/commands/gc/index.ts — DESIGN §9 verb `gc` (PLAN §3 rule 3 \"later units fill\n// stub files that lie inside their owned paths; they never edit ... the registry\"). Wave-0 stub: exits with the\n// documented not-available error (spec 24 `configuration/phase-not-available`); filled by the Wave-4/5\n// unit that owns `apps/cli/src/commands/gc/**`.\nimport type { Dirent } from 'node:fs';\nimport { readdir, readFile, rm, stat, writeFile } from 'node:fs/promises';\nimport { join } from 'node:path';\nimport { promisify } from 'node:util';\nimport { gzip } from 'node:zlib';\nimport type { PipelineState } from '@cohorte/protocol';\nimport { parse } from 'yaml';\nimport type { CommandModule } from '../../contract/index.ts';\n\nconst gzipAsync = promisify(gzip);\nconst TERMINAL = new Set<PipelineState>(['COMPLETED', 'CANCELLED']);\nconst DEFAULT_RETENTION = { transcriptsDays: 30, artifactsDays: 90, compressAfterDays: 7 };\ntype Action =\n  | { kind: 'compress' | 'delete' | 'delete-cas'; path: string; runId: string }\n  | { kind: 'purge-events'; path: string; runId: string };\n\ntype RetentionStore = Awaited<ReturnType<Parameters<CommandModule['run']>[0]['openStore']>> & {\n  purgeEvents?: (runId: string) => Promise<number>;\n};\n\nasync function filesUnder(root: string): Promise<string[]> {\n  const result: string[] = [];\n  async function visit(directory: string): Promise<void> {\n    let entries: Dirent[];\n    try {\n      entries = await readdir(directory, { withFileTypes: true });\n    } catch (error) {\n      if ((error as NodeJS.ErrnoException).code === 'ENOENT') return;\n      throw error;\n    }\n    for (const entry of entries) {\n      const path = join(directory, entry.name);\n      if (entry.isDirectory()) await visit(path);\n      else if (entry.isFile()) result.push(path);\n    }\n  }\n  await visit(root);\n  return result;\n}\n\nfunction classify(path: string): 'sensitive' | 'transcript' | 'artifact' | 'spool' | undefined {\n  const normalized = path.replaceAll('\\\\', '/').toLowerCase();\n  if (normalized.endsWith('.gz')) return undefined;\n  if (normalized.includes('/sensitive/') || normalized.endsWith('.sensitive') || normalized.endsWith('.sensitive.json'))\n    return 'sensitive';\n  if (normalized.includes('/transcripts/') || normalized.includes('/wire/') || normalized.includes('/logs/'))\n    return 'transcript';\n  if (normalized.includes('/artifacts/')) return 'artifact';\n  if (normalized.includes('/spool/') || normalized.includes('/stream/')) return 'spool';\n  return undefined;\n}\n\nasync function readRetention(cwd: string): Promise<typeof DEFAULT_RETENTION> {\n  try {\n    const value = parse(await readFile(join(cwd, '.cohorte', 'config.yaml'), 'utf8')) as {\n      retention?: Partial<typeof DEFAULT_RETENTION>;\n    };\n    return { ...DEFAULT_RETENTION, ...(value.retention ?? {}) };\n  } catch {\n    return DEFAULT_RETENTION;\n  }\n}\n\nconst CAS_ADDRESS = /^[a-f0-9]{64}$/;\n\nasync function referencedCasAddresses(\n  runs: Awaited<ReturnType<RetentionStore['listRuns']>>,\n  casRoot: string,\n): Promise<Set<string>> {\n  const retained = new Set<string>();\n  for (const run of runs) {\n    const digest = run.snapshotDigest;\n    if (!digest || !CAS_ADDRESS.test(digest)) continue;\n    retained.add(digest);\n    const path = join(casRoot, digest.slice(0, 2), digest);\n    try {\n      const text = (await readFile(path, 'utf8')).toString();\n      for (const address of text.match(/[a-f0-9]{64}/g) ?? []) retained.add(address);\n    } catch {\n      // A missing snapshot is reported by resume/doctor; GC must not fail or invent a reference.\n    }\n  }\n  return retained;\n}\n\nasync function planGc(ctx: Parameters<CommandModule['run']>[0]): Promise<Action[]> {\n  const store = (await ctx.openStore()) as RetentionStore;\n  try {\n    const runs = await store.listRuns({ limit: 100_000, offset: 0 });\n    const retention = await readRetention(ctx.cwd);\n    const root = join(ctx.cwd, '.cohorte', 'state', 'runs');\n    const casRoot = join(ctx.cwd, '.cohorte', 'state', 'cas');\n    const now = Date.parse(ctx.clock.now());\n    const actions: Action[] = [];\n    for (const run of runs) {\n      if (!TERMINAL.has(run.state)) continue;\n      if (run.purgeable && typeof store.purgeEvents === 'function') {\n        actions.push({ kind: 'purge-events', path: `.cohorte/state/events/${run.runId}`, runId: run.runId });\n      }\n      for (const path of await filesUnder(join(root, run.runId))) {\n        const kind = classify(path);\n        if (!kind) continue;\n        const age = Math.max(0, now - (await stat(path)).mtimeMs);\n        if (kind === 'sensitive' && age >= retention.compressAfterDays * 86_400_000)\n          actions.push({ kind: 'compress', path, runId: run.runId });\n        else if (kind === 'transcript' && age >= retention.transcriptsDays * 86_400_000)\n          actions.push({ kind: 'delete', path, runId: run.runId });\n        else if (kind === 'artifact' && age >= retention.artifactsDays * 86_400_000)\n          actions.push({ kind: 'delete', path, runId: run.runId });\n        else if (kind === 'spool' && age >= 86_400_000) actions.push({ kind: 'delete', path, runId: run.runId });\n      }\n    }\n    const retainedCas = await referencedCasAddresses(runs, casRoot);\n    for (const path of await filesUnder(casRoot)) {\n      const address = path.split('/').at(-1) ?? '';\n      if (CAS_ADDRESS.test(address) && !retainedCas.has(address))\n        actions.push({ kind: 'delete-cas', path, runId: 'cas' });\n    }\n    return actions.sort((a, b) => a.path.localeCompare(b.path));\n  } finally {\n    await store.close();\n  }\n}\n\nasync function applyAction(action: Action, store: RetentionStore): Promise<void> {\n  if (action.kind === 'purge-events') {\n    await store.purgeEvents?.(action.runId);\n    return;\n  }\n  if (action.kind === 'delete' || action.kind === 'delete-cas') return rm(action.path, { force: true });\n  const compressed = await gzipAsync(await readFile(action.path));\n  await writeFile(`${action.path}.gz`, compressed, { mode: 0o600 });\n  await rm(action.path, { force: true });\n}\n\nconst gc: CommandModule = {\n  verb: 'gc',\n  async run(ctx, args) {\n    const dryRun = args.positionals.includes('--dry-run');\n    const apply = args.positionals.includes('--apply');\n    if (dryRun === apply) return 2;\n    const actions = await planGc(ctx);\n    if (apply) {\n      const store = (await ctx.openStore()) as RetentionStore;\n      try {\n        for (const action of actions) await applyAction(action, store);\n      } finally {\n        await store.close();\n      }\n    }\n    ctx.stdio.stdout.write(`${JSON.stringify({ mode: dryRun ? 'dry-run' : 'apply', actions })}\\n`);\n    return 0;\n  },\n};\n\nexport default gc;\n"],"mappings":";;;;;;AAaA,MAAM,YAAY,UAAU,IAAI;AAChC,MAAM,2BAAW,IAAI,IAAmB,CAAC,aAAa,WAAW,CAAC;AAClE,MAAM,oBAAoB;CAAE,iBAAiB;CAAI,eAAe;CAAI,mBAAmB;AAAE;AASzF,eAAe,WAAW,MAAiC;CACzD,MAAM,SAAmB,CAAC;CAC1B,eAAe,MAAM,WAAkC;EACrD,IAAI;EACJ,IAAI;GACF,UAAU,MAAM,QAAQ,WAAW,EAAE,eAAe,KAAK,CAAC;EAC5D,SAAS,OAAO;GACd,IAAK,MAAgC,SAAS,UAAU;GACxD,MAAM;EACR;EACA,KAAK,MAAM,SAAS,SAAS;GAC3B,MAAM,OAAO,KAAK,WAAW,MAAM,IAAI;GACvC,IAAI,MAAM,YAAY,GAAG,MAAM,MAAM,IAAI;QACpC,IAAI,MAAM,OAAO,GAAG,OAAO,KAAK,IAAI;EAC3C;CACF;CACA,MAAM,MAAM,IAAI;CAChB,OAAO;AACT;AAEA,SAAS,SAAS,MAA6E;CAC7F,MAAM,aAAa,KAAK,WAAW,MAAM,GAAG,CAAC,CAAC,YAAY;CAC1D,IAAI,WAAW,SAAS,KAAK,GAAG,OAAO,KAAA;CACvC,IAAI,WAAW,SAAS,aAAa,KAAK,WAAW,SAAS,YAAY,KAAK,WAAW,SAAS,iBAAiB,GAClH,OAAO;CACT,IAAI,WAAW,SAAS,eAAe,KAAK,WAAW,SAAS,QAAQ,KAAK,WAAW,SAAS,QAAQ,GACvG,OAAO;CACT,IAAI,WAAW,SAAS,aAAa,GAAG,OAAO;CAC/C,IAAI,WAAW,SAAS,SAAS,KAAK,WAAW,SAAS,UAAU,GAAG,OAAO;AAEhF;AAEA,eAAe,cAAc,KAAgD;CAC3E,IAAI;EACF,MAAM,QAAQ,MAAM,MAAM,SAAS,KAAK,KAAK,YAAY,aAAa,GAAG,MAAM,CAAC;EAGhF,OAAO;GAAE,GAAG;GAAmB,GAAI,MAAM,aAAa,CAAC;EAAG;CAC5D,QAAQ;EACN,OAAO;CACT;AACF;AAEA,MAAM,cAAc;AAEpB,eAAe,uBACb,MACA,SACsB;CACtB,MAAM,2BAAW,IAAI,IAAY;CACjC,KAAK,MAAM,OAAO,MAAM;EACtB,MAAM,SAAS,IAAI;EACnB,IAAI,CAAC,UAAU,CAAC,YAAY,KAAK,MAAM,GAAG;EAC1C,SAAS,IAAI,MAAM;EACnB,MAAM,OAAO,KAAK,SAAS,OAAO,MAAM,GAAG,CAAC,GAAG,MAAM;EACrD,IAAI;GACF,MAAM,QAAQ,MAAM,SAAS,MAAM,MAAM,EAAA,CAAG,SAAS;GACrD,KAAK,MAAM,WAAW,KAAK,MAAM,eAAe,KAAK,CAAC,GAAG,SAAS,IAAI,OAAO;EAC/E,QAAQ,CAER;CACF;CACA,OAAO;AACT;AAEA,eAAe,OAAO,KAA6D;CACjF,MAAM,QAAS,MAAM,IAAI,UAAU;CACnC,IAAI;EACF,MAAM,OAAO,MAAM,MAAM,SAAS;GAAE,OAAO;GAAS,QAAQ;EAAE,CAAC;EAC/D,MAAM,YAAY,MAAM,cAAc,IAAI,GAAG;EAC7C,MAAM,OAAO,KAAK,IAAI,KAAK,YAAY,SAAS,MAAM;EACtD,MAAM,UAAU,KAAK,IAAI,KAAK,YAAY,SAAS,KAAK;EACxD,MAAM,MAAM,KAAK,MAAM,IAAI,MAAM,IAAI,CAAC;EACtC,MAAM,UAAoB,CAAC;EAC3B,KAAK,MAAM,OAAO,MAAM;GACtB,IAAI,CAAC,SAAS,IAAI,IAAI,KAAK,GAAG;GAC9B,IAAI,IAAI,aAAa,OAAO,MAAM,gBAAgB,YAChD,QAAQ,KAAK;IAAE,MAAM;IAAgB,MAAM,yBAAyB,IAAI;IAAS,OAAO,IAAI;GAAM,CAAC;GAErG,KAAK,MAAM,QAAQ,MAAM,WAAW,KAAK,MAAM,IAAI,KAAK,CAAC,GAAG;IAC1D,MAAM,OAAO,SAAS,IAAI;IAC1B,IAAI,CAAC,MAAM;IACX,MAAM,MAAM,KAAK,IAAI,GAAG,OAAO,MAAM,KAAK,IAAI,EAAA,CAAG,OAAO;IACxD,IAAI,SAAS,eAAe,OAAO,UAAU,oBAAoB,OAC/D,QAAQ,KAAK;KAAE,MAAM;KAAY;KAAM,OAAO,IAAI;IAAM,CAAC;SACtD,IAAI,SAAS,gBAAgB,OAAO,UAAU,kBAAkB,OACnE,QAAQ,KAAK;KAAE,MAAM;KAAU;KAAM,OAAO,IAAI;IAAM,CAAC;SACpD,IAAI,SAAS,cAAc,OAAO,UAAU,gBAAgB,OAC/D,QAAQ,KAAK;KAAE,MAAM;KAAU;KAAM,OAAO,IAAI;IAAM,CAAC;SACpD,IAAI,SAAS,WAAW,OAAO,OAAY,QAAQ,KAAK;KAAE,MAAM;KAAU;KAAM,OAAO,IAAI;IAAM,CAAC;GACzG;EACF;EACA,MAAM,cAAc,MAAM,uBAAuB,MAAM,OAAO;EAC9D,KAAK,MAAM,QAAQ,MAAM,WAAW,OAAO,GAAG;GAC5C,MAAM,UAAU,KAAK,MAAM,GAAG,CAAC,CAAC,GAAG,EAAE,KAAK;GAC1C,IAAI,YAAY,KAAK,OAAO,KAAK,CAAC,YAAY,IAAI,OAAO,GACvD,QAAQ,KAAK;IAAE,MAAM;IAAc;IAAM,OAAO;GAAM,CAAC;EAC3D;EACA,OAAO,QAAQ,MAAM,GAAG,MAAM,EAAE,KAAK,cAAc,EAAE,IAAI,CAAC;CAC5D,UAAU;EACR,MAAM,MAAM,MAAM;CACpB;AACF;AAEA,eAAe,YAAY,QAAgB,OAAsC;CAC/E,IAAI,OAAO,SAAS,gBAAgB;EAClC,MAAM,MAAM,cAAc,OAAO,KAAK;EACtC;CACF;CACA,IAAI,OAAO,SAAS,YAAY,OAAO,SAAS,cAAc,OAAO,GAAG,OAAO,MAAM,EAAE,OAAO,KAAK,CAAC;CACpG,MAAM,aAAa,MAAM,UAAU,MAAM,SAAS,OAAO,IAAI,CAAC;CAC9D,MAAM,UAAU,GAAG,OAAO,KAAK,MAAM,YAAY,EAAE,MAAM,IAAM,CAAC;CAChE,MAAM,GAAG,OAAO,MAAM,EAAE,OAAO,KAAK,CAAC;AACvC;AAEA,MAAM,KAAoB;CACxB,MAAM;CACN,MAAM,IAAI,KAAK,MAAM;EACnB,MAAM,SAAS,KAAK,YAAY,SAAS,WAAW;EACpD,MAAM,QAAQ,KAAK,YAAY,SAAS,SAAS;EACjD,IAAI,WAAW,OAAO,OAAO;EAC7B,MAAM,UAAU,MAAM,OAAO,GAAG;EAChC,IAAI,OAAO;GACT,MAAM,QAAS,MAAM,IAAI,UAAU;GACnC,IAAI;IACF,KAAK,MAAM,UAAU,SAAS,MAAM,YAAY,QAAQ,KAAK;GAC/D,UAAU;IACR,MAAM,MAAM,MAAM;GACpB;EACF;EACA,IAAI,MAAM,OAAO,MAAM,GAAG,KAAK,UAAU;GAAE,MAAM,SAAS,YAAY;GAAS;EAAQ,CAAC,EAAE,GAAG;EAC7F,OAAO;CACT;AACF"}