filegrc 0.7.0 → 0.8.0

package/src/external-reviewer.js

@@ -1,3 +1,4 @@
+import { modelSupports } from "../model/index.js";
 import { applyResourceBatch } from "./files.js";
 import { createResourceId } from "./id.js";
 import { currentCalendarDate } from "./time.js";
@@ -5,8 +6,8 @@ import { loadWorkspace } from "./workspace.js";
 
 export async function scaffoldExternalReviewerGovernance(input = process.cwd()) {
   const loaded = await loadWorkspace(input);
-  if (!["3", "4"].includes(String(loaded.model.modelVersion))) {
-    throw new Error("External reviewer setup requires a model v3 or v4 workspace.");
+  if (!modelSupports(loaded.model, "guided-workflow")) {
+    throw new Error("External reviewer setup requires a model v3 or newer workspace.");
   }
   return {
     reviewerName: null,
@@ -22,8 +23,8 @@ export async function scaffoldExternalReviewerGovernance(input = process.cwd())
 
 export async function planExternalReviewerGovernance(input = process.cwd(), options = {}) {
   const loaded = await loadWorkspace(input);
-  if (!["3", "4"].includes(String(loaded.model.modelVersion))) {
-    throw new Error("External reviewer setup requires a model v3 or v4 workspace.");
+  if (!modelSupports(loaded.model, "guided-workflow")) {
+    throw new Error("External reviewer setup requires a model v3 or newer workspace.");
   }
   const name = required(options.reviewerName, "External reviewer name");
   const startsOn = required(options.startsOn, "Appointment start date");

package/src/files.js

@@ -1,10 +1,11 @@
 import { createHash, randomUUID } from "node:crypto";
 import { constants, link, lstat, mkdir, open, readFile, rename, rm, stat } from "node:fs/promises";
 import { basename, dirname, join, resolve } from "node:path";
-import { getResourceDefinition, loadModel } from "../model/index.js";
+import { getResourceDefinition, loadModel, modelSupports } from "../model/index.js";
 import { openPlaceholderCount } from "./content-readiness.js";
 import { serializeWorkspaceMutation, workspaceValidationDeferred } from "./mutation.js";
 import { isCanonicalDataPath, resolveDataPath, resolveWorkspaceRoot } from "./paths.js";
+import { documentIsAuditSpecific } from "./program-lifecycle.js";
 import { markdownEntries } from "./resource-markdown.js";
 import { measureTiming } from "./timing.js";
 import { loadWorkspace } from "./workspace.js";
@@ -204,17 +205,42 @@ export async function applyResourceBatch(input, changes) {
   return serializeWorkspaceMutation(input, (root) => applyResourceBatchUnlocked(root, changes));
 }
 
-async function applyResourceBatchUnlocked(input, changes = {}) {
+export async function applyDocumentActivationBatch(input, changes) {
+  return serializeWorkspaceMutation(input, (root) => (
+    applyResourceBatchUnlocked(root, changes, "document-activation")
+  ));
+}
+
+export async function applyModelMigrationBatch(input, changes) {
+  return serializeWorkspaceMutation(input, (root) => (
+    applyResourceBatchUnlocked(root, changes, "model-migration")
+  ));
+}
+
+async function applyResourceBatchUnlocked(input, changes = {}, lifecycleOperation = null) {
   const creates = changes.create || [];
   const updates = changes.update || [];
   const moves = changes.movePaths || [];
+  const contentUpdates = changes.contentUpdates || {};
   const expectedRevisions = changes.expectedRevisions || {};
-  if (!Array.isArray(creates) || !Array.isArray(updates) || !Array.isArray(moves) || (!creates.length && !updates.length && !moves.length)) {
-    throw new Error("A resource batch needs at least one create or update.");
+  if (
+    !Array.isArray(creates)
+    || !Array.isArray(updates)
+    || !Array.isArray(moves)
+    || (!creates.length && !updates.length && !moves.length && !Object.keys(contentUpdates).length)
+  ) {
+    throw new Error("A resource batch needs at least one create, update, or content update.");
   }
   if (Array.isArray(expectedRevisions) || typeof expectedRevisions !== "object") {
     throw new Error("Batch expected revisions must be keyed by resource ID.");
   }
+  if (Array.isArray(contentUpdates) || typeof contentUpdates !== "object") {
+    throw new Error("Batch content updates must be keyed by resource ID.");
+  }
+  const expectedContentRevisions = changes.expectedContentRevisions || {};
+  if (Array.isArray(expectedContentRevisions) || typeof expectedContentRevisions !== "object") {
+    throw new Error("Batch expected content revisions must be keyed by resource ID.");
+  }
   const loaded = await loadWorkspace(input);
   const workspaceUpdate = updates.find((record) => (
     record.type === "workspace" && record.id === loaded.workspace?.id
@@ -240,14 +266,35 @@ async function applyResourceBatchUnlocked(input, changes = {}) {
       "A cross-model resource batch must validate the whole workspace and update its dataModelVersion to the target model."
     );
   }
+  if (lifecycleOperation === "model-migration" && !targetModelVersion) {
+    throw new Error("The model-migration lifecycle operation requires a cross-model resource batch.");
+  }
+  if (
+    lifecycleOperation === "document-activation"
+    && (targetModelVersion || changes.validateWholeWorkspace !== true)
+  ) {
+    throw new Error("The document-activation lifecycle operation requires same-model whole-workspace validation.");
+  }
   const writeModel = targetModelVersion ? loadModel(targetModelVersion) : loaded.model;
   const deferValidation = workspaceValidationDeferred();
   const before = deferValidation || changes.validateWholeWorkspace
     ? null
     : await validateWorkspace(loaded);
   const existingById = new Map(loaded.entries.map((entry) => [entry.record.id, entry]));
+  for (const record of updates) {
+    if (!record || Array.isArray(record) || typeof record !== "object" || typeof record.id !== "string") continue;
+    const existing = existingById.get(record.id);
+    if (!existing) continue;
+    assertRevision(
+      existing.source,
+      expectedRevisions[record.id] || existing.revision,
+      `Resource "${record.id}"`
+    );
+  }
   const ids = new Set();
   const writes = [];
+  const contentWrites = [];
+  const preparedContentIds = new Set();
   const allowedPathMoves = new Set();
   for (const record of creates) {
     validateBatchRecord(record, ids);
@@ -290,7 +337,30 @@ async function applyResourceBatchUnlocked(input, changes = {}) {
         if (error.code !== "ENOENT") throw error;
       }
     }
-    writes.push({ operation: path === previousPath ? "update" : "move-update", path, previousPath, record, previous, fileMode: mode });
+    const hasContentUpdate = Object.hasOwn(contentUpdates, record.id);
+    const recordContentWrites = await prepareContentWrites(loaded, record, contentUpdates[record.id], {
+      expectedRevisions: expectedContentRevisions[record.id],
+      requireExpectedRevisions: hasContentUpdate
+    });
+    if (hasContentUpdate) preparedContentIds.add(record.id);
+    contentWrites.push(...recordContentWrites);
+    const nextRecord = hasContentUpdate
+      ? await prepareApprovalBinding(loaded, record, recordContentWrites, existing.record)
+      : record;
+    assertDocumentLifecycleMutation(existing.record, nextRecord, loaded.model, lifecycleOperation);
+    writes.push({ operation: path === previousPath ? "update" : "move-update", path, previousPath, record: nextRecord, previous, fileMode: mode });
+  }
+  for (const resourceId of Object.keys(contentUpdates)) {
+    if (preparedContentIds.has(resourceId)) continue;
+    const existing = existingById.get(resourceId);
+    if (!existing) throw new Error(`Resource "${resourceId}" was not found.`);
+    if (approvalBound(existing.record)) {
+      throw new Error(`Batch content for approved or active resource "${resourceId}" needs a matching resource update and validation of its approval binding.`);
+    }
+    contentWrites.push(...await prepareContentWrites(loaded, existing.record, contentUpdates[resourceId], {
+      expectedRevisions: expectedContentRevisions[resourceId],
+      requireExpectedRevisions: true
+    }));
   }
   const pathMoves = [];
   const seenMovePaths = new Set();
@@ -317,8 +387,13 @@ async function applyResourceBatchUnlocked(input, changes = {}) {
     pathMoves.push({ from, to, mode });
   }
   const written = [];
+  const writtenContent = [];
   const moved = [];
   try {
+    for (const item of contentWrites) {
+      await writeTextAtomic(item.path, item.source);
+      writtenContent.push(item);
+    }
     for (const item of writes) {
       await writeAtomic(item.path, item.record, { exclusive: item.operation === "create" });
       written.push(item);
@@ -363,6 +438,14 @@ async function applyResourceBatchUnlocked(input, changes = {}) {
         rollbackErrors.push(rollbackError.message);
       }
     }
+    for (const item of writtenContent.reverse()) {
+      try {
+        if (item.previous === null) await rm(item.path, { force: true });
+        else await writeTextAtomic(item.path, item.previous);
+      } catch (rollbackError) {
+        rollbackErrors.push(rollbackError.message);
+      }
+    }
     if (rollbackErrors.length) {
       throw new Error(`${error.message} FileGRC could not restore every file in the resource batch: ${rollbackErrors.join(" ")}`);
     }
@@ -524,6 +607,7 @@ async function updateResourceUnlocked(input, type, id, record, options) {
   });
   const existing = loaded.entries.find(({ record: candidate }) => candidate.id === id)?.record;
   const nextRecord = await prepareApprovalBinding(loaded, record, contentWrites, existing);
+  assertDocumentLifecycleMutation(existing, nextRecord, loaded.model, null);
   try {
     for (const item of contentWrites) await writeTextAtomic(item.path, item.source);
     await writeAtomic(path, nextRecord);
@@ -733,39 +817,97 @@ async function prepareApprovalBinding(loaded, record, contentWrites, previousRec
   if (record.type === "attestation") {
     return prepareAttestationBinding(loaded, record, previousRecord);
   }
-  const bindingField = approvalBindingField(record, loaded.model);
-  if (!bindingField) return record;
-  const nextRecord = structuredClone(record);
-  if (!approvalBound(record)) {
-    delete nextRecord[bindingField];
-    return nextRecord;
-  }
-  if (approvalBound(previousRecord) && previousRecord[bindingField]) {
-    nextRecord[bindingField] = structuredClone(previousRecord[bindingField]);
-    return nextRecord;
+  const bindingFields = contentBindingFields(record, loaded.model);
+  if (!bindingFields.length) return record;
+  if (
+    record.type === "document"
+    && modelSupports(loaded.model, "governed-document-activation")
+    && record.status === "active"
+    && previousRecord?.status !== "active"
+  ) {
+    const step = documentIsAuditSpecific(record, loaded.model) ? "Step 5" : "Step 3";
+    throw new Error(`Document "${record.id}" must use the dedicated ${step} Document activation operation after approval.`);
   }
+  const nextRecord = structuredClone(record);
   const proposed = new Map(contentWrites.map((item) => [item.dataRelativePath, item.source]));
-  const revisions = {};
-  for (const item of markdownEntries(loaded.model, nextRecord)) {
-    let source = proposed.get(item.path);
-    if (source === undefined) {
-      try {
-        source = await readFile(resolveDataPath(loaded.root, item.path), "utf8");
-      } catch (error) {
-        if (error.code === "ENOENT") continue;
-        throw error;
-      }
+  for (const { field, bound, label } of bindingFields) {
+    if (!bound(record)) {
+      delete nextRecord[field];
+      continue;
     }
-    const placeholders = openPlaceholderCount(source);
-    if (placeholders) {
-      throw new Error(`Cannot approve or activate ${record.title} while its ${item.label} Markdown contains ${placeholders} open ${placeholders === 1 ? "placeholder" : "placeholders"}. Complete the facts and review the exact content first.`);
+    if (bound(previousRecord) && previousRecord[field]) {
+      nextRecord[field] = structuredClone(previousRecord[field]);
+      continue;
+    }
+    const revisions = {};
+    for (const item of markdownEntries(loaded.model, nextRecord)) {
+      let source = proposed.get(item.path);
+      if (source === undefined) {
+        try {
+          source = await readFile(resolveDataPath(loaded.root, item.path), "utf8");
+        } catch (error) {
+          if (error.code === "ENOENT") continue;
+          throw error;
+        }
+      }
+      const placeholders = openPlaceholderCount(source);
+      if (placeholders) {
+        throw new Error(`Cannot ${label} ${record.title} while its ${item.label} Markdown contains ${placeholders} open ${placeholders === 1 ? "placeholder" : "placeholders"}. Complete the facts and review the exact content first.`);
+      }
+      revisions[item.path] = contentRevision(source);
     }
-    revisions[item.path] = contentRevision(source);
+    nextRecord[field] = revisions;
   }
-  nextRecord[bindingField] = revisions;
   return nextRecord;
 }
 
+function assertDocumentLifecycleMutation(previousRecord, nextRecord, model, lifecycleOperation) {
+  if (lifecycleOperation === "model-migration") return;
+  if (
+    !previousRecord
+    || previousRecord.type !== "document"
+    || nextRecord?.type !== "document"
+    || !modelSupports(model, "governed-document-activation")
+  ) return;
+  const approvedStatuses = new Set(["approved", "active", "superseded", "retired"]);
+  const activatedStatuses = new Set(["active", "superseded", "retired"]);
+  if (approvedStatuses.has(previousRecord.status) && approvedStatuses.has(nextRecord.status)) {
+    assertLifecycleFieldsUnchanged(previousRecord, nextRecord, [
+      "approverIds",
+      "approvedOn",
+      "approvedContentRevisions"
+    ], "approval");
+  }
+  if (activatedStatuses.has(previousRecord.status) && activatedStatuses.has(nextRecord.status)) {
+    assertLifecycleFieldsUnchanged(previousRecord, nextRecord, [
+      "activationBasis",
+      "activatedByIds",
+      "activatedOn",
+      "activatedContentRevisions",
+      "effectiveOn"
+    ], "activation");
+  }
+  if (
+    nextRecord.status === "active"
+    && previousRecord.status !== "active"
+    && lifecycleOperation !== "document-activation"
+  ) {
+    const step = documentIsAuditSpecific(nextRecord, model) ? "Step 5" : "Step 3";
+    throw new Error(`Document "${nextRecord.id}" must use the dedicated ${step} Document activation operation after approval.`);
+  }
+}
+
+function assertLifecycleFieldsUnchanged(previousRecord, nextRecord, fields, eventLabel) {
+  const changed = fields.filter((field) => (
+    JSON.stringify(previousRecord[field] ?? null) !== JSON.stringify(nextRecord[field] ?? null)
+  ));
+  if (!changed.length) return;
+  throw new Error(
+    `Document "${nextRecord.id}" ${eventLabel} facts are immutable after the event: ${changed.join(", ")}. `
+    + `Move the Document back to ${eventLabel === "approval" ? "draft" : "approved"} and record a new lifecycle event.`
+  );
+}
+
 async function prepareAttestationBinding(loaded, record, previousRecord = null) {
   const nextRecord = structuredClone(record);
   const bound = record.status === "completed" && record.attestationMethod === "git-approval";
@@ -803,17 +945,34 @@ function approvalBound(record) {
   const statuses = record.type === "policy"
     ? ["approved", "active", "superseded", "retired"]
     : record.type === "document"
-      ? ["active", "superseded", "retired"]
+      ? ["approved", "active", "superseded", "retired"]
       : ["active", "retired"];
   return statuses.includes(record.status);
 }
 
-function approvalBindingField(record, model) {
-  if (["policy", "document"].includes(record?.type)) return "approvedContentRevisions";
+function contentBindingFields(record, model) {
+  const fields = [];
+  if (["policy", "document"].includes(record?.type)) {
+    fields.push({
+      field: "approvedContentRevisions",
+      bound: approvalBound,
+      label: record.type === "policy" ? "approve or activate" : "approve"
+    });
+  }
+  if (record?.type === "document" && model.resources.document?.fields?.activatedContentRevisions) {
+    fields.push({
+      field: "activatedContentRevisions",
+      bound: (candidate) => (
+        ["active", "superseded", "retired"].includes(candidate?.status)
+        && candidate.activationBasis === "recorded"
+      ),
+      label: "activate"
+    });
+  }
   if (record?.type === "training" && model.resources.training?.fields?.effectiveContentRevisions) {
-    return "effectiveContentRevisions";
+    fields.push({ field: "effectiveContentRevisions", bound: approvalBound, label: "approve or activate" });
   }
-  return null;
+  return fields;
 }
 
 async function exclusiveContentFiles(loaded, record) {

package/src/git.js

@@ -6,7 +6,7 @@ import { relative, resolve, sep } from "node:path";
 import { performance } from "node:perf_hooks";
 import { isSafeGitName } from "./git-name.js";
 import { serializeWorkspaceMutation, withDeferredWorkspaceValidation } from "./mutation.js";
-import { resolveWorkspaceRoot } from "./paths.js";
+import { isCanonicalDataPath, resolveWorkspaceRoot } from "./paths.js";
 import { measureTiming, measureTimingSync, recordTiming, timingEnabled } from "./timing.js";
 import { fingerprintWorkspace, validateWorkspace } from "./validate.js";
 import { loadWorkspace } from "./workspace.js";
@@ -75,6 +75,7 @@ export function getGitSummary(input = process.cwd()) {
 
 export function getFileHistory(input, relativePath, limit = 50) {
   const root = resolveWorkspaceRoot(input);
+  if (!isSafeDataGitPath(relativePath)) return null;
   try {
     const output = git(root, [
       "log",
@@ -87,11 +88,11 @@ export function getFileHistory(input, relativePath, limit = 50) {
     if (!output) return [];
     return output.split("\n").map(parseLogLine);
   } catch {
-    return [];
+    return null;
   }
 }
 
-export function getWorkspaceHistories(input, relativePaths, limitPerFile = 12) {
+export function getWorkspaceHistories(input, relativePaths, limitPerFile = 12, options = {}) {
   const root = resolveWorkspaceRoot(input);
   const wanted = new Set(relativePaths);
   const histories = new Map([...wanted].map((path) => [path, []]));
@@ -99,10 +100,14 @@ export function getWorkspaceHistories(input, relativePaths, limitPerFile = 12) {
   const head = tryGit(root, ["rev-parse", "HEAD"]) || null;
   const cached = workspaceHistoryCache.get(root);
   if (cached?.head === head && cached.limitPerFile === limitPerFile) {
+    if (options.strict === true && cached.available === false) {
+      throw new Error("Git history is unavailable for the requested workspace files.");
+    }
     for (const path of wanted) histories.set(path, cached.histories.get(path) ?? []);
     return histories;
   }
   const allHistories = new Map();
+  let available = true;
   try {
     const output = git(root, ["log", "--relative", "--format=%x1e%H%x1f%aI%x1f%an%x1f%s", "--name-only", "--", "data"]);
     for (const block of output.split("\x1e")) {
@@ -116,26 +121,112 @@ export function getWorkspaceHistories(input, relativePaths, limitPerFile = 12) {
       }
     }
   } catch {
-    // An uncommitted workspace has no history yet.
+    available = false;
+    if (options.strict === true) {
+      throw new Error("Git history is unavailable for the requested workspace files.");
+    }
+    // Browser and workflow views tolerate an uncommitted workspace with no history yet.
   }
-  workspaceHistoryCache.set(root, { head, limitPerFile, histories: allHistories });
+  workspaceHistoryCache.set(root, { head, limitPerFile, histories: allHistories, available });
   for (const path of wanted) histories.set(path, allHistories.get(path) ?? []);
   return histories;
 }
 
 export function getFileAtRevision(input, revision, relativePath) {
+  return getFilesAtRevisions(input, [{ revision, relativePath }])[0];
+}
+
+export function getFilesAtRevisions(input, requests) {
   const root = resolveWorkspaceRoot(input);
-  if (!/^[a-f0-9]{40}$/i.test(String(revision)) || typeof relativePath !== "string" || !relativePath.startsWith("data/")) {
+  const invalid = Array.isArray(requests) && requests.find(({ revision, relativePath } = {}) => (
+    !/^[a-f0-9]{40}$/i.test(String(revision)) || !isSafeDataGitPath(relativePath)
+  ));
+  if (!Array.isArray(requests) || invalid) {
     throw new Error("Historical file exports require a Git commit and a data/ path.");
   }
+  if (!requests.length) return [];
+  try {
+    const topLevel = git(root, ["rev-parse", "--show-toplevel"]);
+    const workspacePrefix = relative(topLevel, root).split(sep).join("/");
+    if (workspacePrefix === ".." || workspacePrefix.startsWith("../")) return requests.map(() => null);
+    const results = [];
+    for (let offset = 0; offset < requests.length; offset += 4) {
+      const batch = requests.slice(offset, offset + 4);
+      const specifications = batch.map(({ revision, relativePath }) => {
+        const repositoryPath = workspacePrefix ? `${workspacePrefix}/${relativePath}` : relativePath;
+        return `${revision}:${repositoryPath}`;
+      });
+      try {
+        const output = measureTimingSync("git-history-export", () => execFileSync("git", ["cat-file", "--batch"], {
+          cwd: root,
+          input: `${specifications.join("\n")}\n`,
+          stdio: ["pipe", "pipe", "ignore"],
+          timeout: 10_000,
+          maxBuffer: 80_000_000
+        }));
+        results.push(...parseBatchObjects(output, batch.length));
+      } catch {
+        results.push(...specifications.map((specification) => readHistoricalFile(root, specification)));
+      }
+    }
+    return results;
+  } catch {
+    return requests.map(() => null);
+  }
+}
+
+function readHistoricalFile(root, specification) {
   try {
-    return execFileSync("git", ["show", `${revision}:${relativePath}`], {
+    return measureTimingSync("git-history-export", () => execFileSync("git", ["show", specification], {
       cwd: root,
       encoding: "utf8",
       stdio: ["ignore", "pipe", "ignore"],
       timeout: 10_000,
       maxBuffer: 20_000_000
-    });
+    }));
+  } catch {
+    return null;
+  }
+}
+
+function parseBatchObjects(output, expected) {
+  const results = [];
+  let offset = 0;
+  for (let index = 0; index < expected; index += 1) {
+    const headerEnd = output.indexOf(10, offset);
+    if (headerEnd < 0) throw new Error("Git returned an incomplete historical object header.");
+    const header = output.subarray(offset, headerEnd).toString("utf8");
+    offset = headerEnd + 1;
+    if (header.endsWith(" missing")) {
+      results.push(null);
+      continue;
+    }
+    const size = Number(header.split(" ").at(-1));
+    if (!Number.isSafeInteger(size) || size < 0 || offset + size >= output.length) {
+      throw new Error("Git returned an invalid historical object size.");
+    }
+    results.push(output.subarray(offset, offset + size).toString("utf8"));
+    offset += size;
+    if (output[offset++] !== 10) throw new Error("Git returned an incomplete historical object.");
+  }
+  return results;
+}
+
+function isSafeDataGitPath(value) {
+  return isCanonicalDataPath(value)
+    && !/[\r\n]/.test(value)
+    && value.startsWith("data/")
+    && value !== "data/";
+}
+
+export function getChangedDataPathsSinceRevision(input, revision) {
+  if (!/^[a-f0-9]{40}$/i.test(String(revision))) return null;
+  const root = resolveWorkspaceRoot(input);
+  try {
+    return [...new Set([
+      ...lines(git(root, ["diff", "--name-only", "--relative", revision, "--", "data"])),
+      ...lines(git(root, ["ls-files", "--others", "--exclude-standard", "--", "data"]))
+    ])].filter((path) => path.startsWith("data/"));
   } catch {
     return null;
   }
@@ -198,6 +289,7 @@ export async function getWorkspaceRevisionSnapshot(input = process.cwd()) {
       available: true,
       commit: parsed.commit,
       shortCommit: parsed.commit?.slice(0, 8) ?? "no commits",
+      branch: parsed.branch,
       clean: parsed.changePaths.length === 0,
       changes: parsed.changePaths,
       workspaceChangePaths: parsed.changePaths
@@ -1089,11 +1181,14 @@ function parsePorcelainV2(source, topLevel, root) {
 function parseWorkspaceRevision(source) {
   const fields = source.split("\0").filter(Boolean);
   let commit = null;
+  let branch = null;
   const changePaths = [];
   for (let index = 0; index < fields.length; index += 1) {
     const field = fields[index];
     if (field.startsWith("# branch.oid ")) {
       commit = field.slice(13) === "(initial)" ? null : field.slice(13);
+    } else if (field.startsWith("# branch.head ")) {
+      branch = field.slice(14) === "(detached)" ? null : field.slice(14);
     } else if (/^[12u?!] /.test(field)) {
       changePaths.push(porcelainV2Path(field));
       if (field.startsWith("2 ")) {
@@ -1103,6 +1198,7 @@ function parseWorkspaceRevision(source) {
   }
   return {
     commit,
+    branch,
     changePaths: [...new Set(changePaths.filter(Boolean))].sort()
   };
 }
@@ -1258,13 +1354,13 @@ async function tryGitAsync(cwd, args, operation) {
 }
 
 function git(cwd, args) {
-  return execFileSync("git", args, {
+  return measureTimingSync("git-command-sync", () => execFileSync("git", args, {
     cwd,
     encoding: "utf8",
     stdio: ["ignore", "pipe", "ignore"],
     timeout: 10_000,
     maxBuffer: 20_000_000
-  }).trim();
+  }).trim());
 }
 
 function tryGit(cwd, args) {

package/src/index.js

@@ -2,10 +2,12 @@ export {
   ACTIVE_MODEL_VERSION,
   getResourceDefinition,
   loadModel,
+  MODEL_CAPABILITY_VERSIONS,
+  modelSupports,
   SUPPORTED_MODEL_VERSIONS
 } from "../model/index.js";
 export { buildAgentGuide, findResourceReferences, listResourceTypes, scaffoldResourceMutation } from "./agent.js";
-export { assessAuditPreparation, prepareAuditWorkspace } from "./audit-preparation.js";
+export { assessAuditDocumentActivations, assessAuditPreparation, prepareAuditWorkspace } from "./audit-preparation.js";
 export { createNextAuditCycle, planNextAuditCycle } from "./audit-transition.js";
 export {
   applyApplicabilityReview,
@@ -52,6 +54,13 @@ export { generateModelDocumentation } from "./model-docs.js";
 export { renderMarkdown } from "./markdown.js";
 export { migrateModel, planModelMigration } from "./model-migration.js";
 export { activatePolicies, planPolicyActivation, scaffoldPolicyActivation } from "./policy-activation.js";
+export { activateDocuments, planDocumentActivation, scaffoldDocumentActivation } from "./document-activation.js";
+export {
+  applyPolicyLibraryUpgrade,
+  assessPolicyLibraryUpgrades,
+  INFORMATION_SECURITY_LIBRARY_PROPOSAL_ID,
+  STRONG_AUTHENTICATION_LIBRARY_PROPOSAL_ID
+} from "./policy-library.js";
 export {
   completeObligationAction,
   completeObligationEvent,