cohorte 3.0.0-dev.0 → 3.0.0-dev.2

package/dist/chunks/src-CmFjh4M0.mjs

@@ -0,0 +1,928 @@
+import { n as sha256Hex, t as canonicalJson } from "./canonical-C8UxeEmB.mjs";
+import "./src-Cu3TxNob.mjs";
+import "./contract-bQ9FJl4N.mjs";
+import { r as specContentSha256, s as DEFAULT_CONFIG } from "./schema-C9QbUW4H.mjs";
+import { createHash } from "node:crypto";
+import { appendFile, copyFile, cp, lstat, mkdir, readFile, readdir, rename, rm, stat, unlink, writeFile } from "node:fs/promises";
+import { dirname, join, relative, resolve, sep } from "node:path";
+import { parse, stringify } from "yaml";
+//#region ../../packages/project-model/src/desired/index.ts
+function deriveDesiredState(input) {
+	const modelYaml = stringify(input.model);
+	const generatedArtifacts = /* @__PURE__ */ new Map();
+	for (const path of input.model.generatedArtifacts.value) {
+		const relative = path.replace(/^\.cohorte\//u, "");
+		if (relative === "manifest.yaml" || relative === "project.yaml") continue;
+		generatedArtifacts.set(relative, canonicalJson({
+			path: relative,
+			model: input.model,
+			config: input.config,
+			skills: input.skills
+		}));
+	}
+	const manifest = {
+		schemaVersion: 1,
+		cohorteVersion: input.cohorteVersion,
+		createdWith: input.cohorteVersion,
+		protocol: {
+			min: "3.0",
+			max: "3.x"
+		},
+		stateSchemaVersion: 1,
+		generated: [
+			{
+				path: "project.yaml",
+				templateId: "project-model/v1",
+				templateSha256: sha256Hex(modelYaml),
+				renderedSha256: sha256Hex(modelYaml)
+			},
+			{
+				path: ".gitignore",
+				templateId: "cohorte/gitignore/v1",
+				templateSha256: sha256Hex("state/\nruns/\n"),
+				renderedSha256: sha256Hex("state/\nruns/\n")
+			},
+			{
+				path: "generated/.gitkeep",
+				templateId: "cohorte/generated-dir/v1",
+				templateSha256: sha256Hex(""),
+				renderedSha256: sha256Hex("")
+			},
+			...[...generatedArtifacts.keys()].map((path) => ({
+				path,
+				templateId: path,
+				templateSha256: sha256Hex(generatedArtifacts.get(path)),
+				renderedSha256: sha256Hex(generatedArtifacts.get(path))
+			}))
+		]
+	};
+	const builtin = {
+		"manifest.yaml": stringify(manifest),
+		"project.yaml": modelYaml,
+		"config.yaml": "schemaVersion: 1\n",
+		"ownership.yaml": "surfaces: {}\n",
+		".gitignore": "state/\nruns/\n",
+		"generated/.gitkeep": ""
+	};
+	const stateFiles = [.../* @__PURE__ */ new Set([...Object.keys(builtin), ...generatedArtifacts.keys()])].sort().map((path) => ({
+		path,
+		class: path === "config.yaml" || path === "ownership.yaml" ? "human" : "generated",
+		sha256: sha256Hex(builtin[path] ?? generatedArtifacts.get(path) ?? ""),
+		content: builtin[path] ?? generatedArtifacts.get(path) ?? "",
+		...input.skills[path] === void 0 ? {} : { templateId: path }
+	}));
+	return {
+		cohorteVersion: input.cohorteVersion,
+		files: stateFiles
+	};
+}
+//#endregion
+//#region ../../packages/project-model/src/drift/index.ts
+async function readActualState(root) {
+	const stateRoot = join(root, ".cohorte");
+	let manifest = null;
+	try {
+		manifest = parse(await readFile(join(stateRoot, "manifest.yaml"), "utf8"));
+	} catch {
+		return {
+			manifest: null,
+			files: []
+		};
+	}
+	const files = [];
+	const visit = async (dir) => {
+		try {
+			const entries = await readdir(dir, { withFileTypes: true });
+			for (const entry of entries.sort((a, b) => a.name.localeCompare(b.name))) {
+				if (entry.name === "state" || entry.name === "runs") continue;
+				const path = join(dir, entry.name);
+				if (entry.isDirectory()) await visit(path);
+				else if (entry.isFile()) {
+					const bytes = await readFile(path);
+					const relativePath = relative(stateRoot, path).split("\\").join("/");
+					const generated = relativePath === "manifest.yaml" ? {
+						path: relativePath,
+						templateId: "cohorte/manifest/v1",
+						renderedSha256: sha256Hex(bytes)
+					} : manifest?.generated.find((item) => item.path === relativePath);
+					files.push({
+						path: relativePath,
+						class: generated ? "generated" : "human",
+						sha256: sha256Hex(bytes),
+						...generated?.templateId ? { templateId: generated.templateId } : {}
+					});
+				}
+			}
+		} catch {
+			return;
+		}
+	};
+	await visit(stateRoot);
+	return {
+		manifest,
+		files
+	};
+}
+function diffStates(desired, actual, clock) {
+	const desiredByPath = new Map(desired.files.map((file) => [file.path, file]));
+	const actualByPath = new Map(actual.files.map((file) => [file.path, file]));
+	const recorded = new Map((actual.manifest?.generated ?? []).map((file) => [file.path, file.renderedSha256]));
+	const entries = [.../* @__PURE__ */ new Set([...desiredByPath.keys(), ...actualByPath.keys()])].sort().flatMap((path) => {
+		const expected = desiredByPath.get(path);
+		const found = actualByPath.get(path);
+		const recordedSha256 = recorded.get(path);
+		if (!found && expected) return [{
+			target: path,
+			class: expected.class,
+			diff: "absent",
+			desiredSha256: expected.sha256,
+			...recordedSha256 ? { recordedSha256 } : {},
+			detail: "desired file is absent"
+		}];
+		if (found && !expected) return [{
+			target: path,
+			class: found.class,
+			diff: found.class === "generated" ? "potential-deletion" : "unknown",
+			actualSha256: found.sha256,
+			...recordedSha256 ? { recordedSha256 } : {},
+			detail: "file exists but is not desired"
+		}];
+		if (!found || !expected) throw new Error("unreachable drift entry");
+		if (found.sha256 === expected.sha256) return [];
+		if (found.class === "human") return [{
+			target: path,
+			class: found.class,
+			diff: "human-change",
+			desiredSha256: expected.sha256,
+			actualSha256: found.sha256,
+			...recordedSha256 ? { recordedSha256 } : {},
+			detail: "content changed in a human-owned file"
+		}];
+		if (recordedSha256 === void 0 || found.sha256 === recordedSha256) return [{
+			target: path,
+			class: expected.class,
+			diff: "expected-change",
+			desiredSha256: expected.sha256,
+			actualSha256: found.sha256,
+			...recordedSha256 ? { recordedSha256 } : {},
+			detail: "generated content differs from the previous render"
+		}];
+		return [{
+			target: path,
+			class: found.class,
+			diff: "conflict",
+			desiredSha256: expected.sha256,
+			actualSha256: found.sha256,
+			recordedSha256,
+			detail: "content changed since the recorded render"
+		}];
+	});
+	return {
+		schemaVersion: 1,
+		generatedAt: clock.now(),
+		entries
+	};
+}
+//#endregion
+//#region ../../packages/project-model/src/import-v2/index.ts
+const FORMAT = "cohorte-v2-export";
+const MAX_FILE_BYTES = 10485760;
+const SKIP_DIRS = /* @__PURE__ */ new Set([
+	".git",
+	"node_modules",
+	".build",
+	"dist",
+	"coverage",
+	".cohorte"
+]);
+const SECRET = /(^|[/\\])(?:\.env(?:\..*)?|credentials?(?:\..*)?|secrets?(?:\..*)?|.*token.*|.*password.*|.*api[-_]?key.*)$/iu;
+function normalisePath(value) {
+	const path = value.replaceAll("\\", "/");
+	if (!path || path.startsWith("/") || path.split("/").some((part) => part === ".." || part === "")) throw new Error(`configuration/import-invalid: unsafe relative path ${JSON.stringify(value)}`);
+	return path;
+}
+async function walk(root, current = root) {
+	const entries = await readdir(current, { withFileTypes: true });
+	const result = [];
+	for (const entry of entries.sort((a, b) => a.name.localeCompare(b.name))) {
+		if (entry.isDirectory() && SKIP_DIRS.has(entry.name)) continue;
+		const absolute = join(current, entry.name);
+		const rel = relative(root, absolute).split(sep).join("/");
+		if (entry.isSymbolicLink()) throw new Error(`configuration/import-symlink: refusing symbolic link ${rel}`);
+		if (entry.isDirectory()) result.push(...await walk(root, absolute));
+		else if (entry.isFile()) result.push(rel);
+	}
+	return result.sort();
+}
+function fileKind(path) {
+	if (path === "PIPELINE.md" || path === "cohorte.config.yaml" || path.startsWith("profile/")) return "config";
+	if (path.startsWith("specs/")) return path.startsWith("specs/reports/") ? "history" : "spec";
+	return "marker";
+}
+function warning(code, message, path, blocking = false) {
+	return {
+		code,
+		message,
+		...path === void 0 ? {} : { path },
+		blocking
+	};
+}
+async function digestFiles(root, files) {
+	const hash = createHash("sha256");
+	for (const path of files) {
+		hash.update(path);
+		hash.update(await readFile(join(root, path)));
+	}
+	return hash.digest("hex");
+}
+function sourceVersion(pipeline) {
+	return (pipeline?.match(/(?:version|core_version)\s*[:=]\s*["']?([0-9]+\.[0-9]+\.[0-9]+)/iu))?.[1] ?? null;
+}
+async function exportV2(options) {
+	const root = resolve(options.root);
+	const destination = resolve(options.destination);
+	const all = await walk(root);
+	const files = [];
+	const excluded = [];
+	const warnings = [];
+	for (const path of all) {
+		if (SECRET.test(path)) {
+			excluded.push({
+				path,
+				reason: "sensitive-path"
+			});
+			warnings.push(warning("sensitive-excluded", "sensitive file excluded from export", path));
+			continue;
+		}
+		if ((await stat(join(root, path))).size > MAX_FILE_BYTES) {
+			excluded.push({
+				path,
+				reason: "file-too-large"
+			});
+			warnings.push(warning("file-too-large", `file exceeds ${MAX_FILE_BYTES} bytes`, path, true));
+			continue;
+		}
+		const content = await readFile(join(root, path));
+		files.push({
+			path,
+			sha256: sha256Hex(content),
+			bytes: content.byteLength,
+			kind: fileKind(path)
+		});
+	}
+	const selected = files.map((file) => file.path);
+	const pipeline = all.includes("PIPELINE.md") ? await readFile(join(root, "PIPELINE.md"), "utf8") : void 0;
+	const manifest = {
+		format: FORMAT,
+		version: 1,
+		sourceVersion: sourceVersion(pipeline),
+		createdAt: options.now ?? (/* @__PURE__ */ new Date()).toISOString(),
+		projectRootDigest: await digestFiles(root, selected),
+		files,
+		excluded,
+		warnings
+	};
+	await rm(destination, {
+		recursive: true,
+		force: true
+	});
+	await mkdir(join(destination, "files"), {
+		recursive: true,
+		mode: 448
+	});
+	for (const file of files) {
+		const target = join(destination, "files", file.path);
+		await mkdir(dirname(target), {
+			recursive: true,
+			mode: 448
+		});
+		await writeFile(target, await readFile(join(root, file.path)), { mode: 384 });
+	}
+	await writeFile(join(destination, "manifest.json"), `${JSON.stringify(manifest, null, 2)}\n`, { mode: 384 });
+	const checksums = files.map((file) => `${file.sha256}  files/${file.path}`).concat(`${sha256Hex(canonicalJson(manifest))}  manifest.json`).join("\n");
+	const checksumsPath = join(destination, "checksums.sha256");
+	await writeFile(checksumsPath, `${checksums}\n`, { mode: 384 });
+	return {
+		bundleRoot: destination,
+		manifest,
+		checksumsPath
+	};
+}
+async function readBundle(bundleRoot) {
+	const root = resolve(bundleRoot);
+	const manifestPath = join(root, "manifest.json");
+	const manifestInfo = await lstat(manifestPath);
+	if (!manifestInfo.isFile() || manifestInfo.isSymbolicLink()) throw new Error("security/import-invalid: manifest must be a regular file");
+	const manifestText = await readFile(manifestPath, "utf8");
+	const manifest = JSON.parse(manifestText);
+	if (manifest.format !== FORMAT || manifest.version !== 1) throw new Error("configuration/import-invalid: unsupported V2 export format");
+	const files = /* @__PURE__ */ new Map();
+	const expectedChecksums = /* @__PURE__ */ new Map();
+	const checksums = await readFile(join(root, "checksums.sha256"), "utf8");
+	for (const line of checksums.split("\n").map((item) => item.trim()).filter(Boolean)) {
+		const match = line.match(/^([0-9a-f]{64}) {2}(.+)$/u);
+		if (!match?.[1] || !match[2]) throw new Error("security/import-invalid: malformed checksums file");
+		expectedChecksums.set(match[2], match[1]);
+	}
+	if (expectedChecksums.get("manifest.json") !== sha256Hex(canonicalJson(manifest))) throw new Error("security/import-checksum-mismatch: manifest.json");
+	for (const entry of manifest.files) {
+		const path = normalisePath(entry.path);
+		if (files.has(path)) throw new Error(`configuration/import-invalid: duplicate path ${path}`);
+		const filePath = join(root, "files", path);
+		const info = await lstat(filePath);
+		if (!info.isFile() || info.isSymbolicLink()) throw new Error(`security/import-invalid: symlink or non-file ${path}`);
+		const content = await readFile(filePath, "utf8");
+		if (sha256Hex(content) !== entry.sha256) throw new Error(`security/import-checksum-mismatch: ${path}`);
+		if (expectedChecksums.get(`files/${path}`) !== entry.sha256) throw new Error(`security/import-checksum-mismatch: files/${path}`);
+		files.set(path, content);
+	}
+	const sourceDigest = await digestFiles(join(root, "files"), [...files.keys()]);
+	if (sourceDigest !== manifest.projectRootDigest) throw new Error("security/import-checksum-mismatch: project root digest does not match manifest");
+	return {
+		manifest,
+		files,
+		sourceDigest
+	};
+}
+function pipelineBlock(input) {
+	const match = input?.match(/```ya?ml\s+pipeline-profile\s*\n([\s\S]*?)\n```/iu);
+	if (!match?.[1]) return {};
+	try {
+		const parsed = parse(match[1]);
+		return parsed && typeof parsed === "object" && !Array.isArray(parsed) ? parsed : {};
+	} catch {
+		return {};
+	}
+}
+function rule(id, program, decision) {
+	return {
+		id,
+		program,
+		decision,
+		replay: "idempotent",
+		network: false,
+		origin: "project-config"
+	};
+}
+function mapConfig(input, pipeline, model) {
+	const warnings = [];
+	let document = {};
+	if (input !== void 0) try {
+		const parsed = parse(input);
+		if (parsed && typeof parsed === "object") document = parsed;
+	} catch {
+		warnings.push(warning("config-invalid-yaml", "V2 configuration is not valid YAML", "cohorte.config.yaml", true));
+	}
+	const profile = pipelineBlock(pipeline);
+	if (profile.name === void 0) warnings.push(warning("config-project-id-missing", "project id needs human confirmation"));
+	if (document.kanban !== void 0) warnings.push(warning("kanban-not-imported", "Kanban links remain external and are not synchronized"));
+	const id = typeof profile.name === "string" ? profile.name : "imported-project";
+	const vcs = profile.vcs ?? {};
+	const commands = profile.commands ?? {};
+	const gate = profile.gate ?? {};
+	const defaultBranch = typeof vcs.default_branch === "string" ? vcs.default_branch : DEFAULT_CONFIG.project.defaultBranch;
+	const branchPrefix = typeof vcs.feature_branch_prefix === "string" ? vcs.feature_branch_prefix : DEFAULT_CONFIG.git.branchPrefix;
+	const migrated = structuredClone(DEFAULT_CONFIG);
+	migrated.project = {
+		...migrated.project,
+		id,
+		defaultBranch,
+		protectedBranches: [defaultBranch]
+	};
+	migrated.git = {
+		...migrated.git,
+		branchPrefix
+	};
+	migrated.checks = {
+		...migrated.checks,
+		...typeof commands.test === "string" ? { test: commands.test.split(/\s+/u) } : {},
+		...typeof commands.lint === "string" ? { lint: commands.lint.split(/\s+/u) } : {},
+		...typeof commands.typecheck === "string" ? { typecheck: commands.typecheck.split(/\s+/u) } : {}
+	};
+	const deny = Array.isArray(gate.deny) ? gate.deny.filter((v) => typeof v === "string") : [];
+	const ask = Array.isArray(gate.ask) ? gate.ask.filter((v) => typeof v === "string") : [];
+	migrated.policy.commands = {
+		allow: [],
+		ask: ask.map((value, index) => rule(`v2-ask-${index}`, value.split(/\s+/u)[0] ?? value, "ask")),
+		deny: deny.map((value, index) => rule(`v2-deny-${index}`, value.split(/\s+/u)[0] ?? value, "deny"))
+	};
+	warnings.push(warning("runtime-review-required", "V2 runtime adapters are not migrated; review the current runtime selection"));
+	const surfaces = Object.fromEntries(Object.entries(model?.surfaces ?? {}).map(([key, value]) => [key, {
+		paths: value.paths.value,
+		owners: ["implementer"],
+		reviewers: ["reviewer"]
+	}]));
+	return {
+		config: stringify(migrated),
+		ownership: stringify({ surfaces }),
+		warnings
+	};
+}
+function section(markdown, number, fallback) {
+	return markdown.match(new RegExp(`^##\\s+${number}\\.?.*?\\n([\\s\\S]*?)(?=^##\\s+|$)`, "imu"))?.[1]?.trim() ?? fallback;
+}
+function bullets(text) {
+	return text.split("\n").map((line) => line.match(/^\s*(?:[-*]|\d+[.)])\s+(.*)$/u)?.[1]?.trim()).filter((value) => Boolean(value));
+}
+function importedSpec(path, markdown) {
+	const front = markdown.match(/^---\s*\n([\s\S]*?)\n---/u);
+	const metadata = front?.[1] ? parse(front[1]) : {};
+	const filename = path.split("/").pop()?.replace(/\.md$/iu, "") ?? "imported-spec";
+	const id = String(metadata.feature_id ?? filename).toLowerCase().replace(/[^a-z0-9]+/gu, "-").replace(/^-|-$/gu, "").slice(0, 48) || "imported-spec";
+	const heading = markdown.match(/^#\s+(.+)$/mu)?.[1]?.trim();
+	const title = String(metadata.title ?? heading ?? id);
+	const rawStatus = String(metadata.status ?? "draft");
+	const status = rawStatus === "draft" ? "draft" : "frozen";
+	const acceptance = bullets(section(markdown, "9", ""));
+	const openQuestions = bullets(section(markdown, "10", ""));
+	const surfaces = {};
+	const surfaceSection = section(markdown, "6", "");
+	for (const match of surfaceSection.matchAll(/^###\s+([^\n]+)\n([\s\S]*?)(?=^###\s+|$)/gmu)) {
+		const key = match[1]?.trim().toLowerCase().replace(/[^a-z0-9]+/gu, "-").replace(/^-|-$/gu, "") || "shared";
+		surfaces[key] = { tasks: bullets(match[2] ?? "") };
+	}
+	if (Object.keys(surfaces).length === 0) surfaces.shared = { tasks: ["Review imported V2 specification and assign implementation tasks."] };
+	const body = {
+		id,
+		kind: "feature",
+		status,
+		title,
+		acceptance: acceptance.length ? acceptance : [`Review imported V2 specification: ${title}`],
+		surfaces,
+		openQuestions: [...openQuestions, ...rawStatus === "draft" ? [] : [`Original V2 status: ${rawStatus}`]]
+	};
+	if (status === "frozen") return {
+		id,
+		content: stringify({
+			...body,
+			sha256: specContentSha256(body)
+		})
+	};
+	return {
+		id,
+		content: stringify(body),
+		...rawStatus === "draft" ? {} : { warning: warning("spec-status-normalized", `V2 status ${rawStatus} was normalized to frozen`, path) }
+	};
+}
+async function planV2Import(bundleRoot, projectRoot, options = {}) {
+	const bundle = await readBundle(bundleRoot);
+	const modelSource = bundle.files.get("PIPELINE.md");
+	const mapped = mapConfig(bundle.files.get("cohorte.config.yaml"), modelSource, options.model);
+	const projectContent = options.model === void 0 ? void 0 : stringify(options.model);
+	const generated = projectContent === void 0 ? [] : [{
+		path: "project.yaml",
+		templateId: "project-model/v1",
+		templateSha256: sha256Hex(projectContent),
+		renderedSha256: sha256Hex(projectContent)
+	}];
+	const manifestContent = stringify({
+		schemaVersion: 1,
+		cohorteVersion: "3.0.0",
+		createdWith: "v2-import",
+		protocol: {
+			min: "3.0",
+			max: "3.x"
+		},
+		stateSchemaVersion: 1,
+		generated
+	});
+	const convertedSpecs = bundle.manifest.files.filter((entry) => entry.kind === "spec").map((entry) => ({
+		entry,
+		converted: importedSpec(entry.path, bundle.files.get(entry.path) ?? "")
+	}));
+	const specWarnings = convertedSpecs.flatMap(({ converted }) => converted.warning ? [converted.warning] : []);
+	const files = [
+		{
+			path: ".cohorte/manifest.yaml",
+			content: manifestContent,
+			action: "create",
+			reason: "V3 migration marker"
+		},
+		{
+			path: ".cohorte/.gitignore",
+			content: "state/\nruns/\n",
+			action: "create",
+			reason: "protect V3 local state"
+		},
+		{
+			path: ".cohorte/config.yaml",
+			content: mapped.config,
+			action: "create",
+			reason: "mapped V2 configuration"
+		},
+		{
+			path: ".cohorte/ownership.yaml",
+			content: mapped.ownership,
+			action: "create",
+			reason: "new V3 ownership document"
+		},
+		...options.model === void 0 ? [] : [{
+			path: ".cohorte/project.yaml",
+			content: projectContent ?? "",
+			action: "create",
+			reason: "deterministic V3 project model generated during import"
+		}],
+		...modelSource === void 0 ? [] : [{
+			path: ".cohorte/import-source/PIPELINE.md",
+			content: modelSource,
+			action: "create",
+			reason: "preserve V2 source"
+		}],
+		...convertedSpecs.map(({ entry, converted }) => ({
+			path: `.cohorte/specs/${converted.id}.yaml`,
+			content: converted.content,
+			action: "create",
+			reason: `convert V2 Markdown specification ${entry.path} to native schema`
+		})),
+		...bundle.manifest.files.filter((entry) => entry.kind === "history").map((entry) => ({
+			path: `.cohorte/artifacts/v2-history/${normalisePath(entry.path).replace(/^specs\/reports\//u, "")}`,
+			content: bundle.files.get(entry.path) ?? "",
+			action: "create",
+			reason: "import V2 historical artifact"
+		}))
+	];
+	const currentDigest = await digestProject(projectRoot);
+	const conflicts = [];
+	for (const file of files) try {
+		const currentPath = join(projectRoot, file.path);
+		if ((await lstat(currentPath)).isSymbolicLink()) {
+			file.action = "conflict";
+			file.reason = "target is a symbolic link";
+			conflicts.push(file.path);
+			continue;
+		}
+		if (await readFile(currentPath, "utf8") !== file.content) {
+			file.action = "conflict";
+			file.reason = "target exists with different content";
+			conflicts.push(file.path);
+		} else file.action = "keep";
+	} catch {}
+	return {
+		bundleRoot: resolve(bundleRoot),
+		projectRoot: resolve(projectRoot),
+		sourceVersion: bundle.manifest.sourceVersion,
+		files,
+		warnings: [
+			...bundle.manifest.warnings,
+			...mapped.warnings,
+			...specWarnings
+		],
+		conflicts,
+		sourceDigest: bundle.sourceDigest,
+		targetDigest: currentDigest
+	};
+}
+async function digestProject(root) {
+	return digestFiles(root, (await walk(root)).filter((path) => !path.startsWith(".cohorte/import-preview/")));
+}
+async function applyV2Import(plan, options) {
+	if (plan.conflicts.length) throw new Error(`configuration/import-conflict: ${plan.conflicts.join(", ")}`);
+	if (plan.warnings.some((item) => item.blocking)) throw new Error("configuration/import-blocked: resolve blocking warnings first");
+	if (!options.confirm) throw new Error("configuration/import-confirmation-required: rerun with explicit confirmation");
+	if (await digestProject(plan.projectRoot) !== plan.targetDigest) throw new Error("configuration/import-project-changed: project changed since preview");
+	const id = sha256Hex(`${plan.sourceDigest}:${plan.targetDigest}:${options.now ?? (/* @__PURE__ */ new Date()).toISOString()}`).slice(0, 16);
+	const backupRoot = resolve(options.backupRoot, `cohorte-v2-${id}`);
+	const stage = join(backupRoot, ".stage");
+	const reportPath = join(plan.projectRoot, ".cohorte", "import-reports", `${id}.json`);
+	const existing = [];
+	let mutated = false;
+	const restore = async () => {
+		await rm(stage, {
+			recursive: true,
+			force: true
+		});
+		await rm(reportPath, { force: true });
+		if (!mutated) return;
+		for (const file of plan.files) {
+			if (file.action === "keep") continue;
+			const target = join(plan.projectRoot, file.path);
+			const backup = join(backupRoot, file.path);
+			try {
+				await stat(backup);
+				await mkdir(dirname(target), {
+					recursive: true,
+					mode: 448
+				});
+				await cp(backup, target, {
+					recursive: true,
+					verbatimSymlinks: true
+				});
+			} catch {
+				await rm(target, {
+					recursive: true,
+					force: true
+				});
+			}
+		}
+	};
+	try {
+		options.fault?.("before-backup");
+		await mkdir(backupRoot, {
+			recursive: true,
+			mode: 448
+		});
+		for (const file of plan.files) try {
+			await lstat(join(plan.projectRoot, file.path));
+			existing.push(file.path);
+			await mkdir(dirname(join(backupRoot, file.path)), {
+				recursive: true,
+				mode: 448
+			});
+			await cp(join(plan.projectRoot, file.path), join(backupRoot, file.path), {
+				recursive: true,
+				verbatimSymlinks: true
+			});
+		} catch {}
+		options.fault?.("after-backup");
+		await mkdir(stage, {
+			recursive: true,
+			mode: 448
+		});
+		for (const file of plan.files) {
+			if (file.action === "keep") continue;
+			const target = join(stage, file.path);
+			await mkdir(dirname(target), {
+				recursive: true,
+				mode: 448
+			});
+			await writeFile(target, file.content, { mode: 384 });
+		}
+		options.fault?.("after-stage");
+		options.fault?.("before-rename");
+		for (const file of plan.files) {
+			if (file.action === "keep") continue;
+			const target = join(plan.projectRoot, file.path);
+			await mkdir(dirname(target), {
+				recursive: true,
+				mode: 448
+			});
+			mutated = true;
+			await rename(join(stage, file.path), target);
+		}
+		options.fault?.("after-rename");
+		await rm(stage, {
+			recursive: true,
+			force: true
+		});
+	} catch (error) {
+		await restore();
+		throw error;
+	}
+	const report = {
+		reportId: id,
+		status: "applied",
+		bundleRoot: plan.bundleRoot,
+		projectRoot: plan.projectRoot,
+		backupRoot,
+		sourceDigest: plan.sourceDigest,
+		targetDigest: plan.targetDigest,
+		files: plan.files.filter((file) => file.action !== "keep").map((file) => file.path),
+		warnings: plan.warnings,
+		createdAt: options.now ?? (/* @__PURE__ */ new Date()).toISOString()
+	};
+	try {
+		options.fault?.("before-report");
+		await mkdir(dirname(reportPath), {
+			recursive: true,
+			mode: 448
+		});
+		await writeFile(reportPath, `${JSON.stringify({
+			...report,
+			existing
+		}, null, 2)}\n`, { mode: 384 });
+	} catch (error) {
+		await restore();
+		throw error;
+	}
+	return report;
+}
+async function rollbackV2Import(report) {
+	for (const path of report.files) {
+		const backup = join(report.backupRoot, path);
+		try {
+			await stat(backup);
+			await mkdir(dirname(join(report.projectRoot, path)), {
+				recursive: true,
+				mode: 448
+			});
+			await cp(backup, join(report.projectRoot, path), {
+				recursive: true,
+				verbatimSymlinks: true
+			});
+		} catch {
+			await rm(join(report.projectRoot, path), {
+				recursive: true,
+				force: true
+			});
+		}
+	}
+	return {
+		...report,
+		status: "rolled-back"
+	};
+}
+//#endregion
+//#region ../../packages/project-model/src/init/index.ts
+async function planInit(options) {
+	if (options.semantic) throw new Error("configuration/phase-not-available: semantic init is not available in V3.0");
+	const root = options.root;
+	const files = [
+		{
+			path: "project.yaml",
+			class: "generated",
+			content: stringify(options.model),
+			templateId: "project-model/v1"
+		},
+		{
+			path: "config.yaml",
+			class: "human",
+			content: "schemaVersion: 1\n"
+		},
+		{
+			path: "ownership.yaml",
+			class: "human",
+			content: "surfaces: {}\n"
+		},
+		{
+			path: ".gitignore",
+			class: "generated",
+			content: "state/\nruns/\n",
+			templateId: "cohorte/gitignore/v1"
+		},
+		{
+			path: "generated/.gitkeep",
+			class: "generated",
+			content: "",
+			templateId: "cohorte/generated-dir/v1"
+		}
+	];
+	const initFiles = [];
+	for (const file of files) {
+		let exists = false;
+		try {
+			await readFile(join(root, ".cohorte", file.path));
+			exists = true;
+		} catch {}
+		const renderedSha256 = sha256Hex(file.content);
+		initFiles.push({
+			path: file.path,
+			action: exists ? "keep-existing" : "create",
+			class: file.class,
+			content: file.content,
+			...file.templateId === void 0 ? {} : { templateId: file.templateId },
+			...file.class === "generated" ? {
+				templateSha256: renderedSha256,
+				renderedSha256
+			} : {}
+		});
+	}
+	const generated = initFiles.filter((file) => file.class === "generated").map((file) => ({
+		path: file.path,
+		templateId: file.templateId ?? "builtin",
+		templateSha256: file.templateSha256 ?? sha256Hex(file.content),
+		renderedSha256: file.renderedSha256 ?? sha256Hex(file.content)
+	}));
+	return {
+		projectRoot: root,
+		model: options.model,
+		files: initFiles,
+		manifest: {
+			schemaVersion: 1,
+			cohorteVersion: options.cohorteVersion,
+			createdWith: options.cohorteVersion,
+			protocol: {
+				min: "3.0",
+				max: "3.x"
+			},
+			stateSchemaVersion: 1,
+			generated
+		},
+		warnings: []
+	};
+}
+async function applyInit(plan) {
+	await mkdir(join(plan.projectRoot, ".cohorte"), {
+		recursive: true,
+		mode: 448
+	});
+	const written = [];
+	const kept = [];
+	for (const file of plan.files) {
+		const target = join(plan.projectRoot, ".cohorte", file.path);
+		if (file.action === "keep-existing") {
+			kept.push(file.path);
+			continue;
+		}
+		await mkdir(join(target, ".."), {
+			recursive: true,
+			mode: 448
+		});
+		await writeFile(target, file.content, { mode: 384 });
+		written.push(file.path);
+	}
+	const manifestPath = join(plan.projectRoot, ".cohorte", "manifest.yaml");
+	try {
+		await readFile(manifestPath);
+		kept.push("manifest.yaml");
+	} catch {
+		await writeFile(manifestPath, stringify(plan.manifest), { mode: 384 });
+		written.push("manifest.yaml");
+	}
+	return {
+		written,
+		kept
+	};
+}
+//#endregion
+//#region ../../packages/project-model/src/reconcile/index.ts
+/** READ-ONLY. */
+async function planReconcile(options) {
+	const model = await options.scan(options.root);
+	let stableModel = model;
+	try {
+		const generatedAt = parse(await readFile(join(options.root, ".cohorte", "project.yaml"), "utf8")).provenance?.generatedAt;
+		const stableGeneratedAt = generatedAt instanceof Date ? generatedAt.toISOString() : typeof generatedAt === "string" ? generatedAt : void 0;
+		if (stableGeneratedAt !== void 0) stableModel = {
+			...model,
+			provenance: {
+				...model.provenance,
+				generatedAt: stableGeneratedAt
+			}
+		};
+	} catch {}
+	const drift = diffStates(deriveDesiredState({
+		model: stableModel,
+		config: DEFAULT_CONFIG,
+		cohorteVersion: options.cohorteVersion,
+		skills: {}
+	}), await readActualState(options.root), options.clock);
+	const operations = drift.entries.map((entry) => {
+		return {
+			op: entry.diff === "absent" ? "create" : entry.diff === "expected-change" ? "replace" : entry.diff === "potential-deletion" ? "delete" : entry.diff === "unknown" ? "keep" : "ask",
+			target: entry.target,
+			diff: entry.diff,
+			reason: entry.detail
+		};
+	});
+	return {
+		schemaVersion: 1,
+		cohorteVersion: options.cohorteVersion,
+		generatedAt: drift.generatedAt,
+		drift,
+		operations,
+		conflicts: drift.entries.filter((entry) => entry.diff === "conflict").map((entry) => entry.target),
+		applyAvailable: true
+	};
+}
+/** Apply only create/replace/delete operations authorized by a conflict-free plan. */
+async function applyReconcile(options) {
+	if (options.plan.conflicts.length > 0) throw new Error(`conflict/reconcile-human-edit: ${options.plan.conflicts.join(", ")}`);
+	const desiredByPath = new Map(options.desired.files.map((file) => [file.path, file]));
+	const backupDir = options.backup ? join(options.root, ".cohorte", "reconcile-backups", options.clock.now().replaceAll(":", "")) : void 0;
+	const journal = join(options.root, ".cohorte", "reconcile.log");
+	await mkdir(join(options.root, ".cohorte"), {
+		recursive: true,
+		mode: 448
+	});
+	const applied = [];
+	const skipped = [];
+	for (const operation of options.plan.operations) {
+		if (operation.op !== "create" && operation.op !== "replace" && operation.op !== "delete") {
+			skipped.push(operation.target);
+			continue;
+		}
+		const target = join(options.root, ".cohorte", operation.target);
+		if (!target.startsWith(`${join(options.root, ".cohorte")}/`)) throw new Error("security/path-outside-grant");
+		const existing = await readFile(target).catch(() => void 0);
+		const drift = options.plan.drift.entries.find((entry) => entry.target === operation.target);
+		if ((existing === void 0 ? void 0 : sha256Hex(existing)) !== drift?.actualSha256) throw new Error(`conflict/reconcile-race: ${operation.target} changed after the plan was generated`);
+		if (existing !== void 0 && backupDir) {
+			const backupPath = join(backupDir, operation.target);
+			await mkdir(dirname(backupPath), { recursive: true });
+			await copyFile(target, backupPath);
+		}
+		if (operation.op === "delete") await unlink(target).catch(() => void 0);
+		else {
+			const file = desiredByPath.get(operation.target);
+			if (file?.content === void 0) throw new Error(`configuration/reconcile-content-missing: ${operation.target}`);
+			await mkdir(dirname(target), { recursive: true });
+			await writeFile(target, file.content, "utf8");
+		}
+		applied.push(operation.target);
+		await appendFile(journal, `${JSON.stringify({
+			at: options.clock.now(),
+			op: operation.op,
+			target: operation.target
+		})}\n`);
+	}
+	return {
+		applied,
+		skipped,
+		...backupDir ? { backupDir } : {},
+		journal
+	};
+}
+//#endregion
+export { applyV2Import as a, rollbackV2Import as c, planInit as i, deriveDesiredState as l, planReconcile as n, exportV2 as o, applyInit as r, planV2Import as s, applyReconcile as t };
+
+//# sourceMappingURL=src-CmFjh4M0.mjs.map