mdkg 0.3.3 → 0.3.5

package/CHANGELOG.md

@@ -12,6 +12,86 @@ mdkg is pre-v1 public alpha software. Command, graph, cache, bundle, and DAL con
 
 - No changes yet.
 
+## 0.3.5 - 2026-06-17
+
+### Added
+
+- Added `mdkg graph clone <source> --target <path>` to create a complete
+  authored mdkg graph in a separate contained target directory while preserving
+  source IDs.
+- Added `mdkg graph fork <source> --target <path> --start-goal <goal-id>` to
+  preserve IDs in a separate target graph and optionally select the demo or
+  bootstrap start goal in that target.
+- Added `mdkg graph import-template <source> --dry-run|--apply` for same-repo
+  template graph imports with deterministic canonical ID rewrites, structured
+  reference rewrites, safe body ID/qid rewrites, and optional selected-goal
+  setup.
+- Added packed `smoke:graph-clone` coverage that installs mdkg from a tarball
+  in a temp prefix and validates clone, fork, import-template dry-run/apply,
+  source non-mutation, help text, search, pack, and validation behavior.
+
+### Changed
+
+- Updated README, seeded init README, command matrix, help snapshots,
+  prepublish gates, and publish-readiness assertions to document the
+  distinction between authored graph creation through `mdkg graph ...` and
+  read-only orchestration context through `mdkg subgraph ...`.
+- Added `smoke:graph-clone` to `prepublishOnly` before the existing subgraph
+  smoke so graph template import behavior is proven before release.
+- Consolidated website-template-mdkg dogfood planning under the 0.3.5 graph
+  clone/import goal without mutating downstream repositories or starting
+  website implementation.
+
+### Security
+
+- Clone/fork targets must be empty or absent, root-contained, and not nested
+  inside live directory sources.
+- Same-repo template imports default to dry-run, require `--apply` to write,
+  run under the mdkg mutation lock, rebuild generated indexes, and validate the
+  resulting graph before selecting a start goal.
+- Semantic ID collisions during template import require an explicit
+  `--id-prefix`; numeric canonical IDs are rewritten to the next unused ID so
+  links remain deterministic.
+
+## 0.3.4 - 2026-06-17
+
+### Added
+
+- Added IDs-family repair apply support with `mdkg fix apply --family ids`
+  and the focused `mdkg fix ids [--apply]` convenience command.
+- Added `--base-ref` support for duplicate-ID repair planning so mainline IDs
+  can be preserved while incoming duplicate nodes receive the next unused
+  canonical numeric ID.
+- Added unresolved Git add/add conflict-stage repair for mdkg Markdown files:
+  stage 2 remains at the conflicted path, stage 3 is rewritten to a new
+  canonical ID/path, and the Git index conflict stages are resolved with a
+  receipt.
+- Added packed `smoke:id-repair` coverage that installs mdkg from a tarball in
+  a temp prefix, validates clean duplicate repair, base-ref link preservation,
+  unresolved Git conflict-stage repair, and final graph validation.
+
+### Changed
+
+- Updated `mdkg fix plan` receipts so duplicate-ID findings advertise
+  `apply_supported: true` with an explicit `apply_kind`, while index/cache and
+  graph-reference findings remain review-only.
+- Updated command help, README, init assets, command matrix, generated command
+  contract metadata, and publish-readiness assertions to document the new
+  IDs-only apply boundary.
+- Updated branch-conflict and fix-plan smokes to distinguish non-mutating plan
+  behavior from the newly apply-capable duplicate-ID repair family.
+
+### Security
+
+- `fix apply` refuses unsupported families, blocked plans, and non-IDs repair
+  findings instead of silently applying partial graph/reference/index repairs.
+- Duplicate-ID apply writes Markdown atomically under the mdkg mutation lock,
+  rebuilds derived indexes, and emits receipt evidence with touched paths,
+  source plan hash, and ambiguous reference notes.
+- Base-ref link rewriting is conservative: references in files absent from the
+  base ref can be rewritten to the repaired incoming ID, while base-existing
+  references remain on the mainline ID and ambiguous references are reported.
+
 ## 0.3.3 - 2026-06-16
 
 ### Added

package/CLI_COMMAND_MATRIX.md

@@ -1,7 +1,7 @@
 # CLI Command Matrix
 
-as_of: 2026-06-06
-package_version_in_source: 0.3.1
+as_of: 2026-06-17
+package_version_in_source: 0.3.5
 source: live help from `src/cli.ts`, runtime command handlers, and `dec-15`..`dec-18`
 status: canonical single-source command and flag reference for mdkg
 
@@ -28,6 +28,7 @@ Primary commands:
 - `spec`
 - `archive`
 - `bundle`
+- `graph`
 - `subgraph`
 - `work`
 - `goal`
@@ -55,13 +56,14 @@ Capability cache discovery is read-only and accessed through `mdkg capability ..
 Optional reusable SPEC capability records are accessed through `mdkg spec ...`.
 Archive sidecars are accessed through `mdkg archive ...`.
 Full graph snapshot bundles are accessed through `mdkg bundle ...`.
+Whole-graph clone, fork, and same-repo template import workflows are accessed through `mdkg graph ...`.
 Read-only child graph orchestration is accessed through `mdkg subgraph ...`.
 Work contract/order/receipt semantic mirrors are accessed through `mdkg work ...`.
 Recursive long-running objective contracts are accessed through `mdkg goal ...`.
 Fresh init workspaces default to the SQLite access cache backend; existing migrated configs stay on JSON until opted in.
 Project application database foundation commands are accessed through `mdkg db ...`; `mdkg index` remains the compatibility shortcut for graph index rebuilds.
 Operator health summaries are accessed through read-only `mdkg status ...`; deeper diagnostics remain under `mdkg doctor ...`.
-Repair planning is accessed through read-only `mdkg fix plan ...`; apply behavior is intentionally deferred.
+Repair planning is accessed through read-only `mdkg fix plan ...`; duplicate-ID graph repairs can be applied through `mdkg fix apply --family ids ...` or the convenience `mdkg fix ids --apply ...`. Index/cache and graph-reference findings remain plan/manual-review only.
 
 ## Global usage
 
@@ -615,6 +617,44 @@ JSON receipts:
 - `show`: `{ action: "show", bundle, manifest }`
 - `list`: `{ action: "list", count, items }`
 
+### `mdkg graph`
+
+When to use:
+- clone or fork a complete mdkg graph into a separate target directory while preserving IDs
+- import a template graph into the current repo with deterministic ID/link rewrites
+- prepare selected-goal demo handoffs from reusable graph templates
+
+Usage:
+- `mdkg graph clone <source-bundle-or-mdkg-dir> --target <path> [--json]`
+- `mdkg graph fork <source-bundle-or-mdkg-dir> --target <path> [--start-goal <goal-id>] [--json]`
+- `mdkg graph import-template <source-bundle-or-mdkg-dir> [--start-goal <goal-id>] [--select-goal] [--id-prefix <prefix>] [--dry-run] [--apply] [--json]`
+
+Flags:
+- `--target <path>`
+- `--start-goal <goal-id>`
+- `--select-goal`
+- `--id-prefix <prefix>`
+- `--dry-run`
+- `--apply`
+- `--json`
+
+Notes:
+- `graph clone` and `graph fork` preserve IDs because the target is a separate graph namespace
+- clone/fork targets must be empty or absent and stay under the current mdkg root
+- live directory sources are never mutated; clone/fork refuses targets nested inside a live source directory
+- `graph fork --start-goal <goal-id>` writes selected-goal state in the target graph after validation
+- `graph import-template` imports authored `.mdkg/work/*.md` template nodes into the current repo and skips config, generated indexes, archive payloads, bundles, and materialized subgraph views
+- `graph import-template` defaults to dry-run unless `--apply` is supplied
+- same-repo template import rewrites canonical numeric IDs to the next unused ID by type prefix and rewrites structured refs plus safe body-local id/qid mentions
+- colliding semantic template IDs require `--id-prefix`
+- `--select-goal` requires `--start-goal` and writes selected-goal state only after apply validation
+- subgraphs remain read-only bundle projections for orchestration context; use `graph clone|fork|import-template` when authored graph state should be created
+
+JSON receipts:
+- `clone`: `{ action: "graph.clone", ok, mode, source, target, source_hash, preserved_ids, files_written, skipped_paths, index, validation, warnings }`
+- `fork`: `{ action: "graph.fork", ok, mode, source, target, source_hash, preserved_ids, files_written, skipped_paths, start_goal?, selected_goal?, index, validation, warnings }`
+- `import-template`: `{ action: "graph.import_template", ok, mode, source, source_hash, preserved_ids: false, rewritten_ids, rewritten_refs, planned_paths, files_written, skipped_paths, start_goal?, selected_goal?, index?, validation?, warnings }`
+
 ### `mdkg subgraph`
 
 When to use:
@@ -1049,27 +1089,38 @@ JSON receipt shape:
 ### `mdkg fix`
 
 When to use:
-- plan reviewable graph/index repairs before any apply command exists
+- plan reviewable graph/index repairs before applying supported duplicate-ID rewrites
 - get a receipt-shaped JSON plan for automation and agent review
+- repair branch-merge duplicate IDs while preserving main/base IDs where possible
 
 Usage:
-- `mdkg fix plan [--family index|refs|ids|all] [--target <id-or-qid>] [--json]`
+- `mdkg fix plan [--family index|refs|ids|all] [--target <id-or-qid>] [--base-ref <ref>] [--json]`
+- `mdkg fix apply [--family ids] [--target <id-or-qid>] [--base-ref <ref>] [--json]`
+- `mdkg fix ids [--target <id-or-qid>] [--base-ref <ref>] [--apply] [--json]`
 
 Flags:
 - `--family <family>`
 - `--target <id-or-qid>`
+- `--base-ref <ref>`
+- `--apply`
 - `--json`
 
 Boundaries:
-- dry-run only and writes nothing
-- does not rebuild indexes, edit graph files, rename ids, or update references
-- `fix apply` is intentionally not available in the first repair-planning slice
+- `fix plan` is dry-run only and writes nothing
+- `fix apply` currently supports only IDs-family duplicate-ID graph rewrites
+- `fix ids` without `--apply` is equivalent to `fix plan --family ids`
+- `fix ids --apply` is equivalent to `fix apply --family ids`
+- apply rewrites graph Markdown atomically, rebuilds derived indexes, and emits a receipt
+- unresolved Git add/add conflict stages are handled by keeping stage 2 at the conflicted path and writing stage 3 to a new canonical ID/path
+- graph-reference and index/cache findings remain review-only guidance
 - initial families are index/cache, graph refs, and duplicate ids
 
 JSON receipt:
 - `{ action: "fix.plan", ok, schema_version, plan_id, plan_hash, generated_at, root, family, target, dirty, families, risk_counts, proposed_changes, blocked_changes, summary }`
-- each proposed change includes family, risk, status, reason, paths, refs, optional before/after values, command hint, and `apply_supported: false`
-- `summary.apply_deferred` remains true until a future apply design is approved
+- each proposed change includes family, risk, status, reason, paths, refs, optional before/after values, command hint, and `apply_supported`
+- duplicate-ID changes include candidate ID/path details and `apply_kind`
+- `{ action: "fix.apply", ok, schema_version, receipt_hash, root, family, target, base_ref, plan_id, plan_hash, applied_changes, touched_paths, ambiguous_reference_rewrites, index, summary }`
+- `summary.apply_deferred` remains true when the selected plan includes index/cache, graph-ref, blocked, or otherwise unsupported findings
 
 ### `mdkg doctor`
 

package/README.md

@@ -14,7 +14,7 @@ mdkg stays deliberately boring:
 - first-class rebuildable SQLite cache through built-in `node:sqlite`
 - no daemon, hosted index, or vector DB
 
-Current package version in source: `0.3.1`
+Current package version in source: `0.3.5`
 
 mdkg is still pre-v1 public alpha software. The public package is usable, but graph, cache, bundle, and DAL contracts may continue to change quickly while the project converges on a stable v1 surface.
 
@@ -150,6 +150,27 @@ mdkg bundle list --json
 
 Bundles are explicit graph transport artifacts, separate from task context packs. Before a commit in repos that track archives or bundles, refresh compressed archive caches first, then create the private bundle so the committed graph state is self-consistent. Private bundles are the default and may be committed in private repos when configured. Public bundles require at least one selected workspace with `visibility: public` and include only public workspace content and public archive sidecars; bundle creation fails if public content points at private graph, archive, or subgraph records.
 
+Clone or fork a reusable graph template into a separate target when the target
+should preserve IDs as its own graph namespace:
+
+```bash
+mdkg graph clone .mdkg/bundles/private/all.mdkg.zip --target demos/demo-1 --json
+mdkg graph fork templates/website-template-mdkg --target demos/live-build --start-goal goal-1 --json
+```
+
+Import a template graph into the current repo only through the rewritten-ID
+path. Review the dry-run receipt first, then apply explicitly:
+
+```bash
+mdkg graph import-template templates/website-template-mdkg --start-goal goal-1 --select-goal --dry-run --json
+mdkg graph import-template templates/website-template-mdkg --start-goal goal-1 --select-goal --apply --json
+```
+
+`graph clone` and `graph fork` preserve IDs; `graph import-template` rewrites
+canonical numeric IDs and internal links to avoid same-repo collisions. Subgraphs
+remain read-only planning views; use `mdkg graph ...` when authored graph state
+should be created.
+
 Register a child repo bundle as a read-only subgraph planning view:
 
 ```bash
@@ -341,9 +362,13 @@ warnings unless their underlying check fails.
 Use `mdkg fix plan --json` when you want repair guidance without mutation. It
 emits a receipt-shaped plan for generated index/cache repair, missing graph
 references, and duplicate local ids. Planned changes include affected paths,
-risk, reason codes, command hints, and `apply_supported: false`. `fix apply` is
-not exposed; apply behavior is deferred until the dry-run plan contract has
-enough evidence.
+risk, reason codes, command hints, and per-change `apply_supported` metadata.
+Duplicate-ID graph repairs can be applied with
+`mdkg fix apply --family ids --json` or `mdkg fix ids --apply --json`; use
+`--base-ref main` when mainline IDs should win. Index/cache and graph-reference
+findings remain review-only. For unresolved Git add/add conflicts, `fix ids`
+keeps stage 2 at the conflicted path, rewrites stage 3 to the next unused
+canonical ID/path, and records a receipt.
 
 ## Skills
 

package/dist/cli.js

@@ -25,6 +25,7 @@ const capability_1 = require("./commands/capability");
 const spec_1 = require("./commands/spec");
 const archive_1 = require("./commands/archive");
 const bundle_1 = require("./commands/bundle");
+const graph_1 = require("./commands/graph");
 const subgraph_1 = require("./commands/subgraph");
 const checkpoint_1 = require("./commands/checkpoint");
 const init_1 = require("./commands/init");
@@ -69,6 +70,7 @@ function printUsage(log) {
     log("  spec        List, show, and validate optional SPEC.md capability records");
     log("  archive     Add, list, show, verify, and compress archive sidecars");
     log("  bundle      Create, list, show, and verify full graph snapshot bundles");
+    log("  graph       Clone and fork whole mdkg graphs");
     log("  subgraph    Register, audit, plan, sync, materialize, and verify read-only child graph snapshots");
     log("  work        Create and update work contracts, orders, receipts, and artifacts");
     log("  goal        Inspect and advance recursive goal nodes");
@@ -554,6 +556,45 @@ function printBundleHelp(log, subcommand) {
     }
     printGlobalOptions(log);
 }
+function printGraphHelp(log, subcommand) {
+    switch ((subcommand ?? "").toLowerCase()) {
+        case "clone":
+            log("Usage:");
+            log("  mdkg graph clone <source-bundle-or-mdkg-dir> --target <path> [--json]");
+            log("\nNotes:");
+            log("  - clones a complete graph into an empty contained target directory");
+            log("  - preserves IDs because the target is a separate graph namespace");
+            log("  - source bundle or source directory is never mutated");
+            break;
+        case "fork":
+            log("Usage:");
+            log("  mdkg graph fork <source-bundle-or-mdkg-dir> --target <path> [--start-goal <goal-id>] [--json]");
+            log("\nNotes:");
+            log("  - forks a complete graph into an empty contained target directory");
+            log("  - preserves IDs and can select a start goal in the target graph");
+            log("  - source bundle or source directory is never mutated");
+            break;
+        case "import-template":
+            log("Usage:");
+            log("  mdkg graph import-template <source-bundle-or-mdkg-dir> [--start-goal <goal-id>] [--select-goal] [--id-prefix <prefix>] [--dry-run] [--apply] [--json]");
+            log("\nNotes:");
+            log("  - imports authored .mdkg/work template nodes into the current graph");
+            log("  - defaults to dry-run unless --apply is supplied");
+            log("  - rewrites canonical numeric IDs and structured graph links deterministically");
+            log("  - --select-goal requires --start-goal and writes selected-goal state only after apply validation");
+            break;
+        default:
+            log("Usage:");
+            log("  mdkg graph clone <source-bundle-or-mdkg-dir> --target <path> [--json]");
+            log("  mdkg graph fork <source-bundle-or-mdkg-dir> --target <path> [--start-goal <goal-id>] [--json]");
+            log("  mdkg graph import-template <source-bundle-or-mdkg-dir> [--start-goal <goal-id>] [--select-goal] [--id-prefix <prefix>] [--dry-run] [--apply] [--json]");
+            log("\nNotes:");
+            log("  - graph clone/fork create authored graph state in separate target directories and preserve IDs");
+            log("  - graph import-template imports template work nodes into the current graph with rewritten IDs");
+            log("  - subgraphs remain read-only bundle projections for orchestration context");
+    }
+    printGlobalOptions(log);
+}
 function printSubgraphHelp(log, subcommand) {
     switch ((subcommand ?? "").toLowerCase()) {
         case "add":
@@ -886,24 +927,58 @@ function printFixHelp(log, subcommand) {
     switch ((subcommand ?? "").toLowerCase()) {
         case "plan":
             log("Usage:");
-            log("  mdkg fix plan [--family index|refs|ids|all] [--target <id-or-qid>] [--json]");
+            log("  mdkg fix plan [--family index|refs|ids|all] [--target <id-or-qid>] [--base-ref <ref>] [--json]");
             log("\nBoundaries:");
             log("  - read-only repair planning; writes no files and does not rebuild indexes");
             log("  - emits a deterministic receipt-shaped JSON plan with paths, risks, and reason codes");
             log("  - initial families are index/cache, graph refs, and duplicate ids");
-            log("  - `fix apply` is intentionally not available in this release slice");
+            log("  - ids-family duplicate-id repairs can be applied with `mdkg fix apply --family ids`");
+            log("  - index/cache and graph-ref findings remain review-only guidance");
             log("\nOptions:");
             log("  --family <family>     Select index, refs, ids, or all (default all)");
             log("  --target <id-or-qid>  Optional node target for family planners");
+            log("  --base-ref <ref>      Prefer IDs that already exist at a Git base ref");
+            log("  --json                Emit machine-readable JSON output");
+            printGlobalOptions(log);
+            return;
+        case "apply":
+            log("Usage:");
+            log("  mdkg fix apply [--family ids] [--target <id-or-qid>] [--base-ref <ref>] [--json]");
+            log("\nBoundaries:");
+            log("  - applies only supported ids-family duplicate-ID rewrites");
+            log("  - refuses index/cache, graph-ref, all-family, blocked, and unsupported repairs");
+            log("  - writes graph Markdown atomically and rebuilds derived indexes");
+            log("  - emits a receipt with plan hash, touched paths, and manual-review reference notes");
+            log("\nOptions:");
+            log("  --family ids          Explicit apply family; ids is the only supported apply family");
+            log("  --target <id-or-qid>  Optional duplicate ID target");
+            log("  --base-ref <ref>      Prefer IDs that already exist at a Git base ref");
+            log("  --json                Emit machine-readable JSON output");
+            printGlobalOptions(log);
+            return;
+        case "ids":
+            log("Usage:");
+            log("  mdkg fix ids [--target <id-or-qid>] [--base-ref <ref>] [--apply] [--json]");
+            log("\nBoundaries:");
+            log("  - convenience command for duplicate-ID planning and application");
+            log("  - without --apply it is equivalent to `mdkg fix plan --family ids`");
+            log("  - with --apply it is equivalent to `mdkg fix apply --family ids`");
+            log("\nOptions:");
+            log("  --target <id-or-qid>  Optional duplicate ID target");
+            log("  --base-ref <ref>      Prefer IDs that already exist at a Git base ref");
+            log("  --apply               Apply supported duplicate-ID rewrites");
             log("  --json                Emit machine-readable JSON output");
             printGlobalOptions(log);
             return;
         default:
             log("Usage:");
-            log("  mdkg fix plan [--family index|refs|ids|all] [--target <id-or-qid>] [--json]");
+            log("  mdkg fix plan [--family index|refs|ids|all] [--target <id-or-qid>] [--base-ref <ref>] [--json]");
+            log("  mdkg fix apply [--family ids] [--target <id-or-qid>] [--base-ref <ref>] [--json]");
+            log("  mdkg fix ids [--target <id-or-qid>] [--base-ref <ref>] [--apply] [--json]");
             log("\nNotes:");
-            log("  - fix planning is dry-run only and writes nothing");
-            log("  - apply behavior is deferred until the receipt contract is proven");
+            log("  - fix plan is dry-run only and writes nothing");
+            log("  - fix apply is limited to duplicate-ID graph repairs with receipt evidence");
+            log("  - index/cache and graph-ref repairs remain plan/manual-review only");
             printGlobalOptions(log);
     }
 }
@@ -986,6 +1061,9 @@ function printCommandHelp(log, command, subcommand) {
         case "bundle":
             printBundleHelp(log, subcommand);
             return;
+        case "graph":
+            printGraphHelp(log, subcommand);
+            return;
         case "subgraph":
             printSubgraphHelp(log, subcommand);
             return;
@@ -1653,6 +1731,49 @@ function runBundleSubcommand(parsed, root) {
             throw new errors_1.UsageError("bundle requires create/list/show/verify");
     }
 }
+function runGraphSubcommand(parsed, root) {
+    const subcommand = (parsed.positionals[1] ?? "").toLowerCase();
+    const source = parsed.positionals[2];
+    const target = requireFlagValue("--target", parsed.flags["--target"]);
+    const json = parseBooleanFlag("--json", parsed.flags["--json"]);
+    switch (subcommand) {
+        case "clone": {
+            if (!source || parsed.positionals.length > 3) {
+                throw new errors_1.UsageError("graph clone requires <source-bundle-or-mdkg-dir>");
+            }
+            if (!target) {
+                throw new errors_1.UsageError("graph clone requires --target <path>");
+            }
+            (0, graph_1.runGraphCloneCommand)({ root, source, target, json });
+            return 0;
+        }
+        case "fork": {
+            if (!source || parsed.positionals.length > 3) {
+                throw new errors_1.UsageError("graph fork requires <source-bundle-or-mdkg-dir>");
+            }
+            if (!target) {
+                throw new errors_1.UsageError("graph fork requires --target <path>");
+            }
+            const startGoal = requireFlagValue("--start-goal", parsed.flags["--start-goal"]);
+            (0, graph_1.runGraphForkCommand)({ root, source, target, startGoal, json });
+            return 0;
+        }
+        case "import-template": {
+            if (!source || parsed.positionals.length > 3) {
+                throw new errors_1.UsageError("graph import-template requires <source-bundle-or-mdkg-dir>");
+            }
+            const startGoal = requireFlagValue("--start-goal", parsed.flags["--start-goal"]);
+            const idPrefix = requireFlagValue("--id-prefix", parsed.flags["--id-prefix"]);
+            const dryRun = parseBooleanFlag("--dry-run", parsed.flags["--dry-run"]);
+            const apply = parseBooleanFlag("--apply", parsed.flags["--apply"]);
+            const selectGoal = parseBooleanFlag("--select-goal", parsed.flags["--select-goal"]);
+            (0, graph_1.runGraphImportTemplateCommand)({ root, source, startGoal, idPrefix, dryRun, apply, selectGoal, json });
+            return 0;
+        }
+        default:
+            throw new errors_1.UsageError("graph requires clone/fork/import-template");
+    }
+}
 function runSubgraphSubcommand(parsed, root) {
     const subcommand = (parsed.positionals[1] ?? "").toLowerCase();
     const json = parseBooleanFlag("--json", parsed.flags["--json"]);
@@ -2445,6 +2566,8 @@ function runCommand(parsed, root, runtime) {
             return runArchiveSubcommand(parsed, root);
         case "bundle":
             return runBundleSubcommand(parsed, root);
+        case "graph":
+            return runGraphSubcommand(parsed, root);
         case "subgraph":
             return runSubgraphSubcommand(parsed, root);
         case "work":
@@ -2670,16 +2793,26 @@ function runCommand(parsed, root, runtime) {
             if (!sub) {
                 throw new errors_1.UsageError("fix requires a subcommand");
             }
-            if (sub !== "plan") {
+            if (!["plan", "apply", "ids"].includes(sub)) {
                 throw new errors_1.UsageError(`unknown fix subcommand: ${sub}`);
             }
             if (parsed.positionals.length > 2) {
-                throw new errors_1.UsageError("fix plan does not accept positional arguments");
+                throw new errors_1.UsageError(`fix ${sub} does not accept positional arguments`);
             }
             const family = requireFlagValue("--family", parsed.flags["--family"]);
             const target = requireFlagValue("--target", parsed.flags["--target"]);
+            const baseRef = requireFlagValue("--base-ref", parsed.flags["--base-ref"]);
             const json = parseBooleanFlag("--json", parsed.flags["--json"]);
-            (0, fix_1.runFixPlanCommand)({ root, family, target, json });
+            if (sub === "plan") {
+                (0, fix_1.runFixPlanCommand)({ root, family, target, baseRef, json });
+                return 0;
+            }
+            if (sub === "apply") {
+                (0, fix_1.runFixApplyCommand)({ root, family, target, baseRef, json });
+                return 0;
+            }
+            const apply = parseBooleanFlag("--apply", parsed.flags["--apply"]);
+            (0, fix_1.runFixIdsCommand)({ root, target, baseRef, json, apply });
             return 0;
         }
         case "format":