mdkg 0.4.0 → 0.4.2

package/dist/commands/git.js

@@ -0,0 +1,593 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.runGitInspectCommand = runGitInspectCommand;
+exports.runGitCloneCommand = runGitCloneCommand;
+exports.runGitFetchCommand = runGitFetchCommand;
+exports.runGitCloseoutCommand = runGitCloseoutCommand;
+exports.runGitPushReadyCommand = runGitPushReadyCommand;
+exports.runGitPushCommand = runGitPushCommand;
+const crypto_1 = __importDefault(require("crypto"));
+const fs_1 = __importDefault(require("fs"));
+const path_1 = __importDefault(require("path"));
+const child_process_1 = require("child_process");
+const config_1 = require("../core/config");
+const project_db_1 = require("../core/project_db");
+const project_db_snapshot_1 = require("../core/project_db_snapshot");
+const validate_1 = require("./validate");
+const atomic_1 = require("../util/atomic");
+const lock_1 = require("../util/lock");
+const errors_1 = require("../util/errors");
+function toPosix(value) {
+    return value.split(path_1.default.sep).join("/");
+}
+function rel(root, filePath) {
+    return toPosix(path_1.default.relative(root, filePath));
+}
+function stableJson(value) {
+    return `${JSON.stringify(value, null, 2)}\n`;
+}
+function sha256Buffer(value) {
+    return `sha256:${crypto_1.default.createHash("sha256").update(value).digest("hex")}`;
+}
+function isInside(root, target) {
+    const relative = path_1.default.relative(root, target);
+    return relative === "" || (!relative.startsWith("..") && !path_1.default.isAbsolute(relative));
+}
+function containedPath(root, rawPath, label) {
+    if (rawPath.trim().length === 0) {
+        throw new errors_1.UsageError(`${label} requires a non-empty path`);
+    }
+    const resolved = path_1.default.resolve(root, rawPath);
+    if (!isInside(root, resolved)) {
+        throw new errors_1.UsageError(`${label} must stay inside the repo`);
+    }
+    return resolved;
+}
+function redactEmbeddedUrlUserinfo(value) {
+    return value.replace(/\b([a-z][a-z0-9+.-]*:\/\/)([^@\s/]+(?::[^@\s/]*)?@)/gi, "$1<redacted>@");
+}
+function redactRemoteRef(value) {
+    try {
+        const parsed = new URL(value);
+        if (parsed.username || parsed.password) {
+            return `${parsed.protocol}//<redacted>@${parsed.host}${parsed.pathname}${parsed.search}${parsed.hash}`;
+        }
+    }
+    catch {
+        // Non-URL Git remotes such as git@github.com:org/repo.git are normal and safe to leave.
+    }
+    return redactEmbeddedUrlUserinfo(value);
+}
+function hasEmbeddedUrlCredentials(value) {
+    try {
+        const parsed = new URL(value);
+        return Boolean(parsed.username || parsed.password);
+    }
+    catch {
+        return false;
+    }
+}
+function assertNoEmbeddedCredentials(label, value) {
+    if (hasEmbeddedUrlCredentials(value)) {
+        throw new errors_1.UsageError(`${label} must not contain embedded credentials; use SSH, credential helpers, gh auth, CI env, or shell-managed Git auth`);
+    }
+}
+function sanitizeOutput(value) {
+    return value
+        .split(/\r?\n/)
+        .map((line) => redactRemoteRef(line).trimEnd())
+        .filter((line) => line.length > 0)
+        .join("\n");
+}
+function git(cwd, args, allowFailure = false) {
+    const result = (0, child_process_1.spawnSync)("git", args, { cwd, encoding: "utf8", stdio: "pipe" });
+    const payload = {
+        status: result.status,
+        stdout: sanitizeOutput(result.stdout ?? ""),
+        stderr: sanitizeOutput(result.stderr ?? ""),
+    };
+    if (!allowFailure && result.status !== 0) {
+        const detail = payload.stderr || payload.stdout || `git ${args[0] ?? ""} failed`;
+        throw new errors_1.ValidationError(detail);
+    }
+    return payload;
+}
+function gitOptional(cwd, args) {
+    const result = git(cwd, args, true);
+    if (result.status !== 0) {
+        return null;
+    }
+    const output = result.stdout.trim();
+    return output.length > 0 ? output : null;
+}
+function requireGitWorkTree(root) {
+    const inside = gitOptional(root, ["rev-parse", "--is-inside-work-tree"]);
+    if (inside !== "true") {
+        throw new errors_1.ValidationError("mdkg git requires a Git work tree");
+    }
+}
+function parseStatusEntries(raw) {
+    if (!raw) {
+        return [];
+    }
+    return raw
+        .split(/\r?\n/)
+        .filter(Boolean)
+        .map((line) => ({
+        index: line.slice(0, 1),
+        worktree: line.slice(1, 2),
+        path: line.slice(3).replace(/^"|"$/g, ""),
+    }));
+}
+function currentBranch(root) {
+    return gitOptional(root, ["branch", "--show-current"]);
+}
+function currentHead(root) {
+    return gitOptional(root, ["rev-parse", "HEAD"]);
+}
+function currentTree(root) {
+    return gitOptional(root, ["rev-parse", "HEAD^{tree}"]);
+}
+function remoteUrl(root, remote) {
+    const value = gitOptional(root, ["remote", "get-url", remote]);
+    return value ? redactRemoteRef(value) : null;
+}
+function rawRemoteUrl(root, remote) {
+    return gitOptional(root, ["remote", "get-url", remote]);
+}
+function listRemotes(root) {
+    const output = gitOptional(root, ["remote"]);
+    if (!output) {
+        return [];
+    }
+    return output
+        .split(/\r?\n/)
+        .filter(Boolean)
+        .sort()
+        .map((name) => ({
+        name,
+        fetch_url: remoteUrl(root, name) ?? "",
+        push_url: redactRemoteRef(gitOptional(root, ["remote", "get-url", "--push", name]) ?? ""),
+    }));
+}
+function defaultRepositoryRef(inspect) {
+    const origin = inspect.remotes.find((remote) => remote.name === "origin");
+    return origin?.fetch_url ?? inspect.remotes[0]?.fetch_url ?? null;
+}
+function buildSourceDescriptor(inspect, remoteName = "origin") {
+    return {
+        kind: "git",
+        repository_ref: defaultRepositoryRef(inspect),
+        remote: remoteName,
+        branch: inspect.branch,
+        access_ref: "external-git-auth",
+    };
+}
+function buildAcceptedRevision(inspect) {
+    return {
+        commit_sha: inspect.head_sha,
+        tree_hash: inspect.tree_hash,
+        branch: inspect.branch,
+    };
+}
+function collectInspectReceipt(root) {
+    const inside = gitOptional(root, ["rev-parse", "--is-inside-work-tree"]) === "true";
+    const statusEntries = inside ? parseStatusEntries(gitOptional(root, ["status", "--porcelain=v1"])) : [];
+    const receipt = {
+        action: "git.inspect",
+        ok: true,
+        root,
+        inside_work_tree: inside,
+        branch: inside ? currentBranch(root) : null,
+        head_sha: inside ? currentHead(root) : null,
+        tree_hash: inside ? currentTree(root) : null,
+        remotes: inside ? listRemotes(root) : [],
+        status: {
+            clean: statusEntries.length === 0,
+            entry_count: statusEntries.length,
+            entries: statusEntries,
+        },
+        source_descriptor: {
+            kind: "git",
+            repository_ref: null,
+            remote: "origin",
+            branch: null,
+            access_ref: "external-git-auth",
+        },
+        accepted_revision: {
+            commit_sha: null,
+            tree_hash: null,
+            branch: null,
+        },
+        warnings: [],
+    };
+    receipt.source_descriptor = buildSourceDescriptor(receipt);
+    receipt.accepted_revision = buildAcceptedRevision(receipt);
+    if (!inside) {
+        receipt.warnings.push("not inside a Git work tree");
+    }
+    return receipt;
+}
+function printJson(value) {
+    console.log(JSON.stringify(value, null, 2));
+}
+function printInspect(receipt) {
+    console.log(`git work tree: ${receipt.inside_work_tree ? "yes" : "no"}`);
+    console.log(`branch: ${receipt.branch ?? "(detached or unknown)"}`);
+    console.log(`head: ${receipt.head_sha ?? "(none)"}`);
+    console.log(`tree: ${receipt.tree_hash ?? "(none)"}`);
+    console.log(`status: ${receipt.status.clean ? "clean" : `${receipt.status.entry_count} change(s)`}`);
+    for (const remote of receipt.remotes) {
+        console.log(`remote ${remote.name}: ${remote.fetch_url}`);
+    }
+}
+function runGitInspectCommand(options) {
+    const receipt = collectInspectReceipt(options.root);
+    if (options.json) {
+        printJson(receipt);
+        return;
+    }
+    printInspect(receipt);
+}
+function runGitCloneCommand(options) {
+    assertNoEmbeddedCredentials("repository", options.repository);
+    const target = containedPath(options.root, options.target, "--target");
+    if (fs_1.default.existsSync(target) && fs_1.default.readdirSync(target).length > 0) {
+        throw new errors_1.UsageError("--target must be empty or absent");
+    }
+    const args = ["clone"];
+    if (options.branch) {
+        args.push("--branch", options.branch);
+    }
+    args.push(options.repository, target);
+    git(options.root, args);
+    const inspect = collectInspectReceipt(target);
+    const receipt = {
+        action: "git.clone",
+        ok: true,
+        repository_ref: redactRemoteRef(options.repository),
+        target: rel(options.root, target),
+        branch: options.branch ?? inspect.branch,
+        source_descriptor: {
+            kind: "git",
+            repository_ref: redactRemoteRef(options.repository),
+            remote: "origin",
+            branch: options.branch ?? inspect.branch,
+            access_ref: "external-git-auth",
+        },
+        accepted_revision: buildAcceptedRevision(inspect),
+        inspect,
+        warnings: [],
+    };
+    if (options.json) {
+        printJson(receipt);
+        return;
+    }
+    console.log("git clone complete");
+    console.log(`target: ${receipt.target}`);
+    console.log(`head: ${receipt.accepted_revision.commit_sha ?? "(none)"}`);
+}
+function runGitFetchCommand(options) {
+    requireGitWorkTree(options.root);
+    const remote = options.remote ?? "origin";
+    assertNoEmbeddedCredentials("--remote", remote);
+    const configuredRemoteUrl = rawRemoteUrl(options.root, remote);
+    if (configuredRemoteUrl && hasEmbeddedUrlCredentials(configuredRemoteUrl)) {
+        throw new errors_1.UsageError(`remote ${remote} must not contain embedded credentials; use external Git auth`);
+    }
+    const args = ["fetch", remote];
+    if (options.branch) {
+        args.push(options.branch);
+    }
+    const result = git(options.root, args);
+    const inspect = collectInspectReceipt(options.root);
+    const receipt = {
+        action: "git.fetch",
+        ok: true,
+        remote,
+        branch: options.branch ?? null,
+        fetch_output: [...result.stdout.split(/\r?\n/), ...result.stderr.split(/\r?\n/)].filter(Boolean),
+        inspect,
+        warnings: [],
+    };
+    if (options.json) {
+        printJson(receipt);
+        return;
+    }
+    console.log("git fetch complete");
+    console.log(`remote: ${remote}`);
+    console.log(`head: ${inspect.head_sha ?? "(none)"}`);
+}
+function validateForCloseout(root) {
+    const validation = (0, validate_1.collectValidateReceipt)({ root, json: true });
+    if (!validation.ok) {
+        throw new errors_1.ValidationError(`closeout requires mdkg validation to pass; found ${validation.error_count} error(s)`);
+    }
+    return validation;
+}
+function dbRuntimeParticipated(root) {
+    const config = (0, config_1.loadConfig)(root);
+    if (!config.db.enabled) {
+        return false;
+    }
+    const layout = (0, project_db_1.resolveConfiguredProjectDbLayout)(root, config.db);
+    return fs_1.default.existsSync(layout.runtimeFile);
+}
+function closeoutOutputDir(root, output) {
+    if (output) {
+        return containedPath(root, output, "--output");
+    }
+    const stamp = new Date().toISOString().replace(/[:.]/g, "-");
+    return path_1.default.join(root, ".mdkg", "git", "closeouts", stamp);
+}
+function closeoutMarkdown(receipt) {
+    const lines = [
+        "# mdkg git closeout",
+        "",
+        `generated_at: ${receipt.generated_at}`,
+        `root: ${receipt.root}`,
+        `git_head: ${receipt.git.head_sha ?? "(none)"}`,
+        `git_tree: ${receipt.git.tree_hash ?? "(none)"}`,
+        `git_branch: ${receipt.git.branch ?? "(detached or unknown)"}`,
+        `validation_ok: ${receipt.validation.ok}`,
+        `validation_errors: ${receipt.validation.error_count}`,
+        `validation_warnings: ${receipt.validation.warning_count}`,
+        `db_participated: ${receipt.db_participated}`,
+    ];
+    if (receipt.db_snapshot_seal) {
+        lines.push(`db_snapshot: ${receipt.db_snapshot_seal.snapshot}`);
+        lines.push(`db_snapshot_sha256: ${receipt.db_snapshot_seal.new_snapshot_sha256}`);
+    }
+    if (receipt.db_snapshot_dump) {
+        lines.push(`db_dump: ${receipt.db_snapshot_dump.output ?? "(stdout)"}`);
+        lines.push(`db_dump_sha256: ${receipt.db_snapshot_dump.sha256}`);
+    }
+    if (receipt.warnings.length > 0) {
+        lines.push("", "## Warnings", "");
+        for (const warning of receipt.warnings) {
+            lines.push(`- ${warning}`);
+        }
+    }
+    lines.push("", "## Boundary", "");
+    lines.push("- Git authentication is external; no credentials are recorded.");
+    lines.push("- Remote push still requires an explicit mdkg git push command with remote and branch.");
+    return `${lines.join("\n")}\n`;
+}
+function collectCloseoutReceipt(options) {
+    requireGitWorkTree(options.root);
+    const config = (0, config_1.loadConfig)(options.root);
+    const validation = validateForCloseout(options.root);
+    const inspect = collectInspectReceipt(options.root);
+    const outputDir = closeoutOutputDir(options.root, options.output);
+    const outputRel = rel(options.root, outputDir);
+    const participated = dbRuntimeParticipated(options.root);
+    const warnings = [];
+    let dbSnapshotStatus = null;
+    let dbSnapshotSeal = null;
+    let dbSnapshotDump = null;
+    if (participated) {
+        dbSnapshotSeal = (0, project_db_snapshot_1.sealProjectDbSnapshot)(options.root, config, options.queuePolicy ?? "drain");
+        const dumpPath = toPosix(path_1.default.join(outputRel, "project-db.dump.md"));
+        const dumpResult = (0, project_db_snapshot_1.dumpProjectDbSnapshot)(options.root, config, undefined, dumpPath);
+        const { dump, ...dumpReceipt } = dumpResult;
+        dbSnapshotDump = { ...dumpReceipt, dump_sha256: sha256Buffer(dump) };
+        dbSnapshotStatus = (0, project_db_snapshot_1.projectDbSnapshotStatus)(options.root, config);
+        if (!dbSnapshotStatus.ok || dbSnapshotStatus.status !== "valid") {
+            throw new errors_1.ValidationError(`db snapshot status must be valid after closeout; got ${dbSnapshotStatus.status}`);
+        }
+    }
+    else {
+        warnings.push("project DB did not participate in this closeout; no DB snapshot was sealed");
+    }
+    fs_1.default.mkdirSync(outputDir, { recursive: true });
+    const baseReceipt = {
+        action: "git.closeout",
+        ok: true,
+        root: options.root,
+        output_dir: outputRel,
+        generated_at: new Date().toISOString(),
+        git: inspect,
+        validation,
+        db_participated: participated,
+        db_snapshot_status: dbSnapshotStatus,
+        db_snapshot_seal: dbSnapshotSeal,
+        db_snapshot_dump: dbSnapshotDump,
+        warnings,
+    };
+    const jsonPath = path_1.default.join(outputDir, "closeout.json");
+    const markdownPath = path_1.default.join(outputDir, "closeout.md");
+    const receipt = {
+        ...baseReceipt,
+        static_receipts: {
+            json: rel(options.root, jsonPath),
+            markdown: rel(options.root, markdownPath),
+        },
+    };
+    (0, atomic_1.atomicWriteFile)(jsonPath, stableJson(receipt));
+    (0, atomic_1.atomicWriteFile)(markdownPath, closeoutMarkdown(baseReceipt));
+    return receipt;
+}
+function runGitCloseoutCommand(options) {
+    const config = (0, config_1.loadConfig)(options.root);
+    const receipt = (0, lock_1.withMutationLock)(options.root, config.index.lock_timeout_ms, () => collectCloseoutReceipt(options));
+    if (options.json) {
+        printJson(receipt);
+        return;
+    }
+    console.log("git closeout written");
+    console.log(`json: ${receipt.static_receipts.json}`);
+    console.log(`markdown: ${receipt.static_receipts.markdown}`);
+    if (receipt.db_snapshot_seal) {
+        console.log(`db snapshot: ${receipt.db_snapshot_seal.snapshot}`);
+    }
+}
+function check(name, ok, detail, error = null, warning = null) {
+    return {
+        name,
+        ok,
+        level: ok ? (warning ? "warn" : "ok") : "fail",
+        detail,
+        errors: ok || !error ? [] : [error],
+        warnings: warning ? [warning] : [],
+    };
+}
+function collectPushReadyReceipt(options) {
+    const remote = options.remote;
+    const branch = options.branch;
+    if (!remote) {
+        throw new errors_1.UsageError("mdkg git push-ready requires --remote <name>");
+    }
+    if (!branch) {
+        throw new errors_1.UsageError("mdkg git push-ready requires --branch <name>");
+    }
+    assertNoEmbeddedCredentials("--remote", remote);
+    requireGitWorkTree(options.root);
+    const config = (0, config_1.loadConfig)(options.root);
+    const inspect = collectInspectReceipt(options.root);
+    const validation = (0, validate_1.collectValidateReceipt)({ root: options.root, json: true });
+    const rawUrl = rawRemoteUrl(options.root, remote);
+    const redactedRemoteUrl = rawUrl ? redactRemoteRef(rawUrl) : null;
+    const checks = [];
+    checks.push(check("remote-explicit", true, `remote target is ${remote}`));
+    checks.push(check("branch-explicit", true, `branch target is ${branch}`));
+    checks.push(check("remote-exists", rawUrl !== null, rawUrl ? `remote ${remote} exists` : `remote ${remote} missing`, `remote ${remote} is not configured`));
+    if (rawUrl) {
+        checks.push(check("remote-credential-boundary", !hasEmbeddedUrlCredentials(rawUrl), "remote URL does not embed credentials", "remote URL contains embedded credentials; use external Git auth"));
+    }
+    checks.push(check("worktree-clean", inspect.status.clean, inspect.status.clean ? "working tree is clean" : `${inspect.status.entry_count} changed path(s) present`, "working tree must be clean before push-ready"));
+    checks.push(check("validation", validation.ok, validation.ok ? "mdkg validate passes" : `mdkg validate has ${validation.error_count} error(s)`, "mdkg validation must pass before push"));
+    let snapshotStatus = null;
+    if (config.db.enabled) {
+        const layout = (0, project_db_1.resolveConfiguredProjectDbLayout)(options.root, config.db);
+        if (fs_1.default.existsSync(layout.runtimeFile)) {
+            snapshotStatus = (0, project_db_snapshot_1.projectDbSnapshotStatus)(options.root, config);
+            checks.push(check("db-snapshot", snapshotStatus.ok && snapshotStatus.status === "valid", `db snapshot status is ${snapshotStatus.status}`, "project DB participated; seal a valid snapshot before push"));
+        }
+        else {
+            checks.push(check("db-snapshot", true, "project DB is enabled but runtime DB is absent", null, "no runtime DB participated in this push"));
+        }
+    }
+    else {
+        checks.push(check("db-snapshot", true, "project DB disabled; no DB closeout required"));
+    }
+    const errors = checks.flatMap((item) => item.errors.map((error) => `${item.name}: ${error}`));
+    const warnings = checks.flatMap((item) => item.warnings.map((warning) => `${item.name}: ${warning}`));
+    return {
+        action: "git.push_ready",
+        ok: errors.length === 0,
+        root: options.root,
+        remote,
+        branch,
+        remote_url: redactedRemoteUrl,
+        git: inspect,
+        validation,
+        db_snapshot_status: snapshotStatus,
+        checks,
+        warning_count: warnings.length,
+        failure_count: errors.length,
+        warnings,
+        errors,
+    };
+}
+function runGitPushReadyCommand(options) {
+    const receipt = collectPushReadyReceipt(options);
+    if (options.json) {
+        printJson(receipt);
+    }
+    else {
+        for (const item of receipt.checks) {
+            console.log(`${item.level}: ${item.name} - ${item.detail}`);
+        }
+    }
+    if (!receipt.ok) {
+        throw new errors_1.ValidationError(`git push-ready failed with ${receipt.failure_count} issue(s)`);
+    }
+    if (!options.json) {
+        console.log("git push-ready ok");
+    }
+}
+function hasStagedChanges(root) {
+    const result = git(root, ["diff", "--cached", "--quiet"], true);
+    return result.status !== 0;
+}
+function ensureGitIdentity(root) {
+    const email = gitOptional(root, ["config", "user.email"]);
+    const name = gitOptional(root, ["config", "user.name"]);
+    if (!email || !name) {
+        throw new errors_1.ValidationError("git commit requires user.name and user.email to be configured");
+    }
+}
+function collectPushReceipt(options) {
+    const remote = options.remote;
+    const branch = options.branch;
+    if (!remote) {
+        throw new errors_1.UsageError("mdkg git push requires --remote <name>");
+    }
+    if (!branch) {
+        throw new errors_1.UsageError("mdkg git push requires --branch <name>");
+    }
+    assertNoEmbeddedCredentials("--remote", remote);
+    requireGitWorkTree(options.root);
+    let closeout = null;
+    let commitCreated = false;
+    let commitMessage = null;
+    if (options.stageAll) {
+        if (!options.message) {
+            throw new errors_1.UsageError("mdkg git push --stage-all requires --message <text>");
+        }
+        ensureGitIdentity(options.root);
+        const config = (0, config_1.loadConfig)(options.root);
+        closeout = (0, lock_1.withMutationLock)(options.root, config.index.lock_timeout_ms, () => collectCloseoutReceipt({
+            root: options.root,
+            queuePolicy: options.queuePolicy,
+            json: true,
+        }));
+        git(options.root, ["add", "-A"]);
+        if (hasStagedChanges(options.root)) {
+            git(options.root, ["commit", "-m", options.message]);
+            commitCreated = true;
+            commitMessage = options.message;
+        }
+    }
+    const pushReady = collectPushReadyReceipt({ root: options.root, remote, branch, json: true });
+    if (!pushReady.ok) {
+        throw new errors_1.ValidationError(`git push-ready failed with ${pushReady.failure_count} issue(s)`);
+    }
+    const push = git(options.root, ["push", remote, `HEAD:refs/heads/${branch}`]);
+    const inspect = collectInspectReceipt(options.root);
+    return {
+        action: "git.push",
+        ok: true,
+        remote,
+        branch,
+        head_sha: inspect.head_sha,
+        pushed_ref: `refs/heads/${branch}`,
+        stage_all: Boolean(options.stageAll),
+        closeout,
+        commit: {
+            created: commitCreated,
+            message: commitMessage,
+            sha: commitCreated ? inspect.head_sha : null,
+        },
+        push_ready: pushReady,
+        push_output: [...push.stdout.split(/\r?\n/), ...push.stderr.split(/\r?\n/)].filter(Boolean),
+        warnings: [],
+    };
+}
+function runGitPushCommand(options) {
+    const receipt = collectPushReceipt(options);
+    if (options.json) {
+        printJson(receipt);
+        return;
+    }
+    console.log("git push complete");
+    console.log(`remote: ${receipt.remote}`);
+    console.log(`branch: ${receipt.branch}`);
+    console.log(`head: ${receipt.head_sha ?? "(none)"}`);
+    if (receipt.commit.created) {
+        console.log(`commit: ${receipt.commit.sha}`);
+    }
+}

package/dist/commands/new.js

@@ -12,6 +12,7 @@ const node_1 = require("../graph/node");
 const agent_file_types_1 = require("../graph/agent_file_types");
 const indexer_1 = require("../graph/indexer");
 const loader_1 = require("../templates/loader");
+const frontmatter_1 = require("../graph/frontmatter");
 const date_1 = require("../util/date");
 const errors_1 = require("../util/errors");
 const qid_1 = require("../util/qid");
@@ -25,6 +26,7 @@ const event_support_1 = require("./event_support");
 const DEC_ID_RE = /^dec-[0-9]+$/;
 const DEC_STATUS = new Set(["proposed", "accepted", "rejected", "superseded"]);
 const SKILL_SLUG_RE = /^[a-z0-9]+(?:-[a-z0-9]+)*$/;
+const CONTRACT_METADATA_RE = /^[a-z][a-z0-9_]*(?:-[a-z0-9_]+)*$/;
 const CORE_TYPES = new Set(["rule"]);
 const DESIGN_TYPES = new Set(["prd", "edd", "dec", "prop"]);
 const LEGACY_NEW_SPEC_WARNING = "warning: mdkg new spec is legacy; use mdkg new manifest. This alias creates MANIFEST.md with type: manifest during the compatibility release.";
@@ -77,6 +79,16 @@ function normalizeRef(value, key) {
 function normalizeRefList(raw, key) {
     return parseCsvList(raw).map((value) => normalizeRef(value, key));
 }
+function normalizeContractMetadataToken(raw, key) {
+    if (raw === undefined) {
+        return undefined;
+    }
+    const normalized = raw.toLowerCase();
+    if (!CONTRACT_METADATA_RE.test(normalized)) {
+        throw new errors_1.UsageError(`${key} must be lowercase snake/kebab style`);
+    }
+    return normalized;
+}
 function normalizeIdRefList(raw, key) {
     return parseCsvList(raw).map((value) => normalizeIdRef(value, key));
 }
@@ -176,6 +188,18 @@ function ensureExists(index, value, ws, label) {
         throw new errors_1.UsageError(`${label} cannot target read-only subgraph node ${node.qid}`);
     }
 }
+function mergeRenderedFrontmatter(content, filePath, additions) {
+    const entries = Object.entries(additions).filter((entry) => entry[1] !== undefined);
+    if (entries.length === 0) {
+        return content;
+    }
+    const { frontmatter, body } = (0, frontmatter_1.parseFrontmatter)(content, filePath);
+    for (const [key, value] of entries) {
+        frontmatter[key] = value;
+    }
+    const lines = ["---", ...(0, frontmatter_1.formatFrontmatter)(frontmatter), "---", body.trimStart()];
+    return lines.join("\n").endsWith("\n") ? lines.join("\n") : `${lines.join("\n")}\n`;
+}
 function runNewCommandLocked(options) {
     const title = options.title.trim();
     if (!title) {
@@ -274,6 +298,24 @@ function runNewCommandLocked(options) {
     if (options.cases && type !== "test") {
         throw new errors_1.UsageError("--cases is only valid for test nodes");
     }
+    const contractProfile = normalizeContractMetadataToken(options.contractProfile, "--contract-profile");
+    const validationPolicyRef = options.validationPolicyRef
+        ? normalizeRef(options.validationPolicyRef, "--validation-policy-ref")
+        : undefined;
+    const evidencePolicyRef = options.evidencePolicyRef
+        ? normalizeRef(options.evidencePolicyRef, "--evidence-policy-ref")
+        : undefined;
+    const receiptKind = normalizeContractMetadataToken(options.receiptKind, "--receipt-kind");
+    const redactionClass = normalizeContractMetadataToken(options.redactionClass, "--redaction-class");
+    if (contractProfile && !["manifest", "work", "work_order", "receipt"].includes(type)) {
+        throw new errors_1.UsageError("--contract-profile is only valid for manifest, work, work_order, and receipt");
+    }
+    if ((validationPolicyRef || evidencePolicyRef) && !["manifest", "work_order", "receipt"].includes(type)) {
+        throw new errors_1.UsageError("--validation-policy-ref and --evidence-policy-ref are only valid for manifest, work_order, and receipt");
+    }
+    if ((receiptKind || redactionClass) && type !== "receipt") {
+        throw new errors_1.UsageError("--receipt-kind and --redaction-class are only valid for receipt");
+    }
     const epic = options.epic ? normalizeIdRef(options.epic, "--epic") : undefined;
     const parent = options.parent ? normalizeIdRef(options.parent, "--parent") : undefined;
     const prev = options.prev ? normalizeIdRef(options.prev, "--prev") : undefined;
@@ -331,7 +373,7 @@ function runNewCommandLocked(options) {
     if (template.source === "bundled") {
         console.error(`warning: using bundled template fallback for ${type}; run \`mdkg upgrade --apply\` to vendor missing local templates`);
     }
-    const content = (0, loader_1.renderTemplate)(template, {
+    const renderedContent = (0, loader_1.renderTemplate)(template, {
         id,
         type,
         title,
@@ -360,6 +402,13 @@ function runNewCommandLocked(options) {
         created: today,
         updated: today,
     });
+    const content = mergeRenderedFrontmatter(renderedContent, filePath, {
+        contract_profile: contractProfile,
+        validation_policy_ref: validationPolicyRef,
+        evidence_policy_ref: evidencePolicyRef,
+        receipt_kind: receiptKind,
+        redaction_class: redactionClass,
+    });
     try {
         (0, atomic_1.writeFileExclusive)(filePath, content);
     }