workspai 0.46.0 → 0.47.0

package/docs/graph-benchmark-methodology.md

@@ -0,0 +1,121 @@
+# Graph Retrieval Benchmark Methodology
+
+This document defines what Workspai measures when it reports graph retrieval
+payload reduction, how to reproduce a result, and what the result does—and does
+not—prove.
+
+## The question being measured
+
+For one query, how much smaller is the bounded, proof-carrying graph response
+than the readable source corpus that supplied the graph's proofs?
+
+This is useful because AI agents do not need every indexed file for every
+question. It is deliberately narrower than “How many tokens will this model
+bill?” or “Will the model produce an equally good answer?”
+
+## Run it
+
+From a Workspai workspace:
+
+```bash
+npx workspai workspace model --write --json
+npx workspai workspace graph benchmark "authentication endpoint" --limit 12 --json
+```
+
+The result conforms to
+[`workspace-graph-token-efficiency.v1.json`](../contracts/workspace-intelligence/workspace-graph-token-efficiency.v1.json).
+It records:
+
+- the query and result limit;
+- the graph schema, entity/relation/proof counts, source artifact, and source
+  model SHA-256;
+- the number and size of readable, deduplicated proof-source artifacts;
+- the bounded retrieval size and match count;
+- unreadable artifacts rather than silently excluding them;
+- the estimate formula, reduction ratio, percentage, and claim boundary.
+
+## Baseline and formula
+
+The current methodology is `indexed-corpus-vs-bounded-retrieval.v1`.
+
+```text
+corpus characters    = sum(unique readable proof-source files)
+retrieval characters = compact JSON length of bounded search response
+estimated tokens     = ceil(characters / 4)
+reduction ratio      = corpus estimated tokens / retrieval estimated tokens
+reduction percent    = (corpus - retrieval) / corpus × 100
+```
+
+`characters / 4` is intentionally labelled as an estimate. It is portable and
+reproducible without downloading a tokenizer, but it is not exact for every
+language, model, or tokenizer.
+
+## Current fixture observation
+
+The 16-project development workspace produced the following result on
+2026-07-21 for `api endpoint --limit 8`:
+
+| Measure                         | Observed value |
+| ------------------------------- | -------------: |
+| Graph entities                  |          1,738 |
+| Graph relations                 |          2,244 |
+| Graph proofs                    |          2,106 |
+| Readable proof-source artifacts |            392 |
+| Corpus estimated tokens         |        134,105 |
+| Retrieval estimated tokens      |          2,812 |
+| Returned entities               |              8 |
+| Retrieval ratio                 |         47.69× |
+| Payload reduction               |          97.9% |
+
+Source-model SHA-256:
+`2b8abd415420cc421707c726e6f6c96641554594e84440bf2e539f04ba5836e8`.
+
+This row demonstrates that measurement is possible. It is not a representative
+cross-project benchmark and must not be marketed as a universal Workspai result.
+
+## What can be claimed today
+
+Safe wording:
+
+> Workspai can return bounded, proof-carrying workspace context instead of the
+> complete indexed corpus. On the current 16-project development fixture, one
+> `api endpoint` query reduced the estimated retrieval payload by 97.9%; results
+> vary by workspace and query.
+
+Unsafe wording:
+
+- “Workspai always reduces model tokens by 97.9%.”
+- “Agents are 47.69× cheaper with no quality loss.”
+- “Workspai beats another product” without a shared corpus and evaluation
+  harness.
+
+## Gate for a public headline benchmark
+
+Before publishing a general token-efficiency number, the benchmark suite must:
+
+1. pin public repositories and exact commit SHAs;
+2. publish fixed question sets and graph configuration;
+3. compare at least three baselines:
+   - entire readable corpus;
+   - a realistic grep/top-file retrieval strategy;
+   - bounded Workspai graph retrieval;
+4. count with at least one real, named tokenizer in addition to the portable
+   character estimate;
+5. measure answer relevance or task completion so smaller context is not treated
+   as automatically better context;
+6. repeat runs and publish variance, failures, unreadable files, hardware, and
+   software versions;
+7. publish raw machine-readable results and a one-command reproduction path;
+8. report median and range—not only the best repository.
+
+## Performance is a separate benchmark
+
+Payload size and graph speed answer different questions. Build time, incremental
+update time, peak memory, artifact size, and p50/p95 query latency must be
+measured separately. Do not infer runtime performance from the token-efficiency
+report.
+
+For normal interactive use, prefer `workspace graph search` or the MCP
+`searchWorkspaceGraph` tool. Use the complete graph artifact for interchange,
+offline analysis, audits, and consumers that explicitly require the entire
+workspace representation.

package/docs/workspace-knowledge-graph.md

@@ -0,0 +1,295 @@
+# Workspace Knowledge Graph
+
+Most code graphs answer questions about one repository. Workspai connects code,
+APIs, infrastructure, delivery, documentation, ownership, tests, and runtime
+configuration across a whole workspace—and records why every relationship is
+believed.
+
+The graph is local-first and deterministic. Building it does not require an
+LLM, a hosted service, embeddings, or a graph database.
+
+## Why this is useful
+
+A repository graph can tell you that function A calls function B. A workspace
+question is usually wider:
+
+> If we change this endpoint, which project consumes it, which deployment ships
+> it, which tests cover it, which document describes it, and which release gate
+> can stop it?
+
+Workspai keeps those domains in one proof-carrying representation. The graph is
+not the final product screen; it is the shared knowledge layer behind impact,
+verification, context, MCP, IDE, CI, and agent workflows.
+
+| If you are…          | The graph helps you…                                                                       |
+| -------------------- | ------------------------------------------------------------------------------------------ |
+| A developer          | find the implementation, nearby dependencies, tests, and evidence without repo-wide search |
+| A tech lead          | inspect cross-project boundaries, owners, contracts, and change paths                      |
+| An AI coding agent   | retrieve question-sized context and verify every returned claim                            |
+| A CI/release system  | consume versioned JSON, source hashes, quality diagnostics, and deterministic exits        |
+| An IDE or MCP client | offer the same system understanding without rebuilding a private index                     |
+
+## What makes it a workspace graph
+
+Workspai does not stop at files, imports, functions, and classes. Repository
+structure is one provider domain alongside APIs, containers, infrastructure,
+pipelines, documents, decisions, ownership, tests, environments, and authored
+workspace contracts.
+
+That distinction matters when the answer crosses repositories. The canonical
+Workspace Model remains the source of truth; the Knowledge Graph is its rich,
+queryable, evidence-backed representation. AI is a consumer, never a requirement
+for building the graph.
+
+## Try it in two minutes
+
+Run from a Workspai workspace:
+
+```bash
+npx workspai workspace model --write --json
+npx workspai workspace graph search "authentication endpoint" --limit 12 --json
+```
+
+Useful follow-up questions:
+
+```bash
+# What APIs and endpoints exist?
+npx workspai workspace graph entities endpoint --json
+
+# Why does Workspai believe this entity exists?
+npx workspai workspace graph evidence "GET /users" --json
+
+# How are two services, files, or APIs connected?
+npx workspai workspace graph path frontend-api "GET /users" --json
+
+# What changed since a saved graph revision?
+npx workspai workspace graph overlay --from previous-graph.json --json
+```
+
+For agents and MCP clients, prefer bounded search over loading the complete
+graph:
+
+```bash
+npx workspai workspace graph search "billing database" --limit 12 --json
+```
+
+A simplified response looks like this:
+
+```json
+{
+  "schemaVersion": "workspace-knowledge-search.v1",
+  "query": "billing database",
+  "totalMatches": 23,
+  "truncated": true,
+  "entities": [{ "kind": "database", "label": "billing-db", "proofIds": ["proof:..."] }],
+  "relations": [{ "kind": "reads-from", "from": "service:billing", "to": "database:billing-db" }],
+  "proofs": [{ "provider": "compose", "artifact": "infra/compose.yml", "trust": "authoritative" }]
+}
+```
+
+The response is intentionally bounded. `totalMatches` tells the consumer more
+results exist, `truncated` prevents silent omission, and every returned claim can
+be traced through `proofIds`.
+
+## Pick the command by question
+
+| You want to know…                                    | Use                                                    |
+| ---------------------------------------------------- | ------------------------------------------------------ |
+| What is relevant to a natural-language question?     | `workspace graph search <query> --limit <n> --json`    |
+| Which entities of one type exist?                    | `workspace graph entities <kind> --json`               |
+| Why does Workspai believe an item exists?            | `workspace graph evidence <entity-or-relation> --json` |
+| How are two things connected?                        | `workspace graph path <from> <to> --json`              |
+| What changed between graph revisions?                | `workspace graph overlay --from <graph.json> --json`   |
+| What is the full portable graph?                     | `workspace graph emit --json`                          |
+| How much retrieval payload did one query avoid?      | `workspace graph benchmark <query> --limit <n> --json` |
+| How should an MCP-compatible agent retrieve context? | `workspace mcp serve` → `searchWorkspaceGraph`         |
+
+## What it models
+
+The current graph can represent:
+
+- workspaces, projects, services, packages, modules, files, and symbols;
+- APIs, endpoints, schemas, events, queues, and databases;
+- containers, deployments, environments, pipelines, and infrastructure;
+- documentation, architecture decisions, tests, and owners.
+
+Relations include `contains`, `imports`, `depends-on`, `calls`, `exposes`,
+`implements`, `reads-from`, `writes-to`, `publishes`, `consumes`, `deploys`,
+`documents`, `decided-by`, `tests`, and `owns`.
+
+Every entity and relation carries portable proof references. A proof records its
+provider, source artifact, optional pointer/line, content hash, freshness,
+derivation, trust, and confidence. Secret values and machine-local absolute
+paths are excluded from the portable graph contract.
+
+## Model first, graph second
+
+The canonical direction is one-way:
+
+```text
+Workspace sources
+      ↓
+Canonical Workspace Model + project topology
+      ↓
+Evidence-backed Workspace Knowledge Graph
+      ↓
+CLI queries · Context · MCP · Agents · IDEs · CI
+```
+
+The graph does not rewrite or replace the canonical Workspace Model. It is a
+derived representation bound to an exact model revision by SHA-256. Context and
+MCP consumers reject a graph whose source hash no longer matches the model.
+
+The model also contains a smaller project dependency graph. That projection is
+used for impact, blast radius, verify, explain, watch, and affected fleet runs.
+The richer Knowledge Graph is used for proof-backed retrieval and cross-domain
+understanding.
+
+## Sources and providers
+
+The current CLI uses bounded providers for:
+
+- workspace/project foundations and service contracts;
+- language-neutral source structure and package manifests;
+- OpenAPI, GraphQL, Protobuf, and AsyncAPI interfaces;
+- Docker/Compose, Kubernetes, Terraform, and CI workflows;
+- README/docs, ADRs, tests, and CODEOWNERS.
+
+Providers emit facts and proofs. The graph engine owns stable identity,
+deduplication, typed relations, reconciliation, quality metrics, diagnostics,
+and deterministic ordering. Regex-backed source observations are explicitly
+marked as observed/medium-confidence; authored contracts remain authoritative.
+
+## Outputs and consumers
+
+`workspace model --write` publishes these two artifacts atomically:
+
+```text
+.workspai/reports/workspace-model.json
+.workspai/reports/workspace-knowledge-graph.json
+```
+
+The Knowledge Graph is consumed by:
+
+- `workspace graph search|entities|evidence|path|overlay`;
+- `workspace context`, which validates the model hash and publishes graph
+  availability and query commands;
+- `workspace agent-sync`, which places it in the evidence index and generated
+  agent/MCP instructions;
+- `workspace mcp serve`, through `getWorkspaceKnowledgeGraph`,
+  `searchWorkspaceGraph`, `queryWorkspaceEntities`,
+  `getWorkspaceGraphEvidence`, and `findWorkspaceGraphPath`;
+- `workspace contract graph`, which exposes the contract projection, project
+  topology, rich graph, and quality summary in one response.
+
+The complete graph is an interchange artifact, not a prompt. Agents should
+start with `INDEX.json`, use bounded search, then retrieve evidence or a path
+for the selected result.
+
+## AI tool output locations
+
+`workspace agent-sync --write --preset enterprise` generates native surfaces
+without changing project source:
+
+| Consumer               | Canonical output                                                                                                                                                   |
+| ---------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------ |
+| Cross-tool/Codex       | `AGENTS.md`, `.workspai/reports/INDEX.json`                                                                                                                        |
+| Claude Code            | `CLAUDE.md`, `.claude/rules/workspai-evidence.md`                                                                                                                  |
+| GitHub Copilot/VS Code | `.github/copilot-instructions.md`, `.github/instructions/workspai-*.instructions.md`, `.github/agents/workspai-*.agent.md`, `.github/prompts/workspai-*.prompt.md` |
+| Cursor                 | `.cursor/rules/workspai-grounding.mdc`                                                                                                                             |
+| MCP clients            | `.workspai/reports/workspai-mcp-design.json`, `workspace mcp serve`                                                                                                |
+
+Files named `rapidkit-*` are compatibility aliases for older consumers. They
+must stay narrowly scoped and must not duplicate an always-applied canonical
+rule.
+
+### Avoiding duplicate AI instructions
+
+Canonical Workspai rules are the only always-applied surfaces. Legacy RapidKit
+aliases point to the canonical files and apply only to `.rapidkit/**`. This
+prevents two equivalent instruction files from being injected into one prompt.
+
+The recommended read order is:
+
+1. `AGENTS.md` for stable workspace policy and navigation;
+2. `.workspai/reports/INDEX.json` for artifact discovery and freshness;
+3. `workspace graph search` or `searchWorkspaceGraph` for question-sized facts;
+4. `workspace graph evidence|path` when a claim needs proof;
+5. the complete model or graph only for export, audit, or whole-system analysis.
+
+## Performance and scale
+
+Graph construction inventories each project once per build and caps the number
+of scanned files. Providers reuse the same in-memory inventory and content
+hashes. Query indexes are cached per immutable graph object; replacing the graph
+is the invalidation boundary. `workspace model --cache` and `--incremental`
+avoid unnecessary model/project work when inputs are unchanged.
+
+Use full graph export for interchange or offline analysis. Use bounded search
+for interactive agents. The latter keeps response size proportional to the
+question instead of workspace size.
+
+## Measuring retrieval payload reduction
+
+Workspai does not publish an unqualified “N× fewer tokens” claim. Such a claim
+depends on the workspace, query, tokenizer, model, answer-quality target, and
+baseline.
+
+Measure the current workspace instead:
+
+```bash
+npx workspai workspace graph benchmark "authentication endpoint" --limit 12 --json
+```
+
+The report compares the readable, proof-indexed source corpus with the bounded
+search payload using a clearly labelled `characters / 4` token estimate. It
+reports corpus size, retrieval size, estimated ratio, percentage reduction,
+unreadable artifacts, query, limit, graph counts, and the exact source-model
+SHA-256 needed to reproduce the run.
+
+This proves **retrieval payload reduction**, not equivalent answer quality,
+model-specific billing savings, or universal token savings. A publishable
+cross-project claim additionally requires pinned source revisions, fixed
+queries, a real tokenizer, repeated runs, and answer-quality evaluation.
+
+In the current 16-project development fixture, the query `api endpoint` with
+`--limit 8` returned 8 entities and 9 proofs. The compact retrieval was 2,812
+estimated tokens versus 134,105 estimated tokens in 392 readable proof-source
+artifacts: an observed 47.69× / 97.9% payload reduction. This is a transparent
+fixture result, not a headline claim for every workspace.
+
+See [Graph Benchmark Methodology](./graph-benchmark-methodology.md) for formulas,
+reproduction rules, realistic baselines, and the gate required before publishing
+a general performance claim.
+
+## Current boundaries
+
+- The CLI graph is intentionally file-backed; a graph database is not required.
+- Text search is deterministic lexical retrieval, not embedding similarity.
+- Compiler/LSP-grade symbol resolution belongs in deeper language providers.
+- Missing project edges mean “relationship not proven,” not “projects are
+  independent.” Author service contracts or provide API/package/runtime
+  evidence to close that gap.
+- The standalone `@workspai/graph` package remains unpublished while its public
+  contracts and conformance gates are developed.
+
+## When the graph looks incomplete
+
+Workspai does not invent relationships. If projects appear as disconnected
+nodes, check the following in order:
+
+1. run `workspace sync --json` and regenerate the model;
+2. declare `dependsOn`, APIs, published events, and consumed events in the
+   workspace/project contracts;
+3. confirm package manifests, OpenAPI/AsyncAPI/GraphQL/Protobuf documents,
+   Compose/Kubernetes/Terraform files, and CI definitions are inside registered
+   project paths;
+4. inspect `graph.quality`, `providers`, and `diagnostics` before treating a
+   missing edge as proof of independence.
+
+An absent edge means “not proven by current evidence,” not “no dependency
+exists.”
+
+For schemas and machine contracts, see the
+[Artifact Catalog](./contracts/ARTIFACT_CATALOG.md). For the full command
+surface, see [Commands Reference](./commands-reference.md).

package/docs/workspace-operations.md

@@ -94,6 +94,55 @@ npx workspai workspace contract graph
 
 Contract file: `.workspai/workspace.contract.json`. Verification checks schema, duplicate slugs, port collisions, and unknown dependencies.
 
+`workspace contract graph --json` preserves its original `nodes`, `edges`, and
+summary fields for existing consumers, and now adds an evidence-backed
+`dependencyGraph` using the public `workspace-dependency-graph.v1` contract. It
+discovers package/workspace dependencies and supported cross-project imports,
+records relationship provenance and confidence, and reports graph coverage,
+orphans, hotspots, and cycles. Project nodes also expose safe package metadata,
+public environment-template keys, command capabilities, key manifests,
+entrypoints, API specifications, infrastructure, documentation, and an
+operational verification profile. Environment values are never emitted.
+
+The same response also exposes `knowledgeGraph` under the public
+`workspace-knowledge-graph.v1` contract. It is a provider-neutral,
+proof-carrying view spanning source structure, packages, service and API
+contracts, infrastructure, delivery pipelines, docs/ADRs, ownership, tests,
+runtime resources, and safe configuration keys. Use the dedicated query and
+change-overlay surfaces when the full document is larger than a human needs:
+
+```bash
+npx workspai workspace graph entities endpoint --json
+npx workspai workspace graph search "authentication endpoint" --limit 12 --json
+npx workspai workspace graph benchmark "authentication endpoint" --limit 12 --json
+npx workspai workspace graph evidence "GET /users" --json
+npx workspai workspace graph path frontend-api "GET /users" --json
+npx workspai workspace graph emit --json > .workspai/reports/knowledge-baseline.json
+npx workspai workspace graph overlay --from .workspai/reports/knowledge-baseline.json --json
+```
+
+The Model step persists the same projection to
+`.workspai/reports/workspace-knowledge-graph.json`. It is registered in the
+artifact contract registry and agent report index, required by the unified
+runner's Model stage, referenced from `workspace-context-agent.json`, and
+queryable through the read-mostly MCP server. This keeps CLI, CI, IDE and agent
+consumers on one contract revision without injecting the full graph into every
+agent prompt.
+
+The overlay follows
+`workspace-knowledge-graph-change-overlay.v1`: graph revisions are identified
+by content-derived fingerprints (timestamps do not create false changes), and
+changed artifacts are portable proof paths rather than machine-local absolute
+paths. Proof additions, removals, and content-hash changes are first-class
+overlay changes, so a source edit is visible even when the entity and relation
+shape remains stable. The builder performs one bounded inventory pass per project and reuses
+in-memory content hashes; query indexes live only for the immutable graph
+instance, so replacing the graph is the invalidation boundary.
+
+Direction is explicit: legacy `edges` remain producer-to-consumer for backward
+compatibility; `dependencyGraph.edges` use consumer-to-dependency semantics so
+impact and blast-radius consumers share one canonical interpretation.
+
 Workspai keeps the contract alive during `create project` and `workspace sync` without overwriting manual API/event/owner declarations.
 
 On a freshly cloned or moved workspace, `workspace sync` also repairs the

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "workspai",
-  "version": "0.46.0",
+  "version": "0.47.0",
   "type": "module",
   "description": "Open-source workspace intelligence CLI for software systems: create, adopt, govern, verify, and align polyglot workspaces for humans, CI, IDEs, and AI agents.",
   "keywords": [
@@ -158,6 +158,7 @@
     "openai": "^6.22.0",
     "ora": "^8.0.1",
     "validate-npm-package-name": "^5.0.1",
+    "yaml": "^2.9.0",
     "yauzl": "^3.4.0",
     "yazl": "^3.3.1"
   },

package/dist/analyze-BEBEZSZK.js

@@ -1 +0,0 @@
-export{b as printAnalyzeReport,a as runAnalyze}from'./chunk-RIEF2DDX.js';

package/dist/artifact-remediation-plan-FFQSESAM.js

@@ -1,3 +0,0 @@
-import {a}from'./chunk-2E6WGUN6.js';import {c,g,d}from'./chunk-HDURFXW5.js';import y from'path';import {existsSync}from'fs';import x from'fs-extra';var I=[{artifactKind:"bootstrap-compliance",cardId:"bootstrap",fileNames:["bootstrap-compliance.latest.json"]},{artifactKind:"doctor-workspace",cardId:"doctor",fileNames:["doctor-remediation-plan-last-run.json"]},{artifactKind:"analyze",cardId:"analyze",fileNames:["analyze-last-run.json"]},{artifactKind:"readiness",cardId:"readiness",fileNames:["release-readiness-last-run.json"]},{artifactKind:"pipeline",cardId:"pipeline",fileNames:["pipeline-last-run.json"]},{artifactKind:"workspace-run",cardId:"workspaceRun",fileNames:["workspace-run-last.json"]},{artifactKind:"workspace-verify",cardId:"workspaceVerify",fileNames:["workspace-verify-last-run.json"]}];function m(e){return e&&typeof e=="object"&&!Array.isArray(e)?e:void 0}function f(e){return Array.isArray(e)?e.filter(r=>typeof r=="string"&&r.trim().length>0):[]}function u(e){return [...new Set(e.map(r=>r.trim()).filter(Boolean))]}function K(e,r,t){return t?r:y.relative(e,r)}function C(e){let r=e?.trim()||"npx workspai bootstrap";if(!/(?:^|\s)--ci(?:\s|$)/.test(r)&&/(?:^|\s)--json(?:\s|$)/.test(r))return r.replace(/(?:^|\s)--json(?:\s|$)/,i=>{let n=i.startsWith(" ")?" ":"",c=i.endsWith(" ")?" ":"";return `${n}--ci --json${c}`}).trim();let t=/(?:^|\s)--ci(?:\s|$)/.test(r)?r:`${r} --ci`;return /(?:^|\s)--json(?:\s|$)/.test(t)?t:`${t} --json`}function M(e){return `${JSON.stringify({schemaVersion:"rapidkit.compatibility-matrix.v1",generatedAt:e,source:"workspai workspace remediation-plan",runtimes:{},notes:["Minimal enterprise baseline. Add runtime and toolchain entries as governance matures."]},null,2)}
-`}function N(e){return `${JSON.stringify({schema_version:"1.0",enabled:false,strategy:"on-demand",artifacts:[],created_at:e,note:"Minimal enterprise baseline. Set enabled: true and add artifact entries to activate mirroring."},null,2)}
-`}function P(e){let r=e.payload,t=f(r.blockers),i=f(r.blockingReasons),n=f(r.failures),c=f(r.reasons),d=f(r.policyViolations),a=m(r.summary),l=f(a?.blockers);if(e.artifactKind==="analyze"){let o=(Array.isArray(r.findings)?r.findings:[]).map(s=>m(s)).filter(s=>!!s).map(s=>String(s.message??s.title??s.id??"").trim()).filter(Boolean);return u([...t,...o,...i])}if(e.artifactKind==="workspace-run"){let g=m(r.stages),o=Object.entries(g??{}).flatMap(([s,b])=>{let A=m(b);return (Array.isArray(A?.projects)?A.projects:[]).map(p=>m(p)).filter(p=>!!p).filter(p=>p.status==="failed"||p.ok===false).map(p=>`${s}: ${String(p.project??p.name??"project")} failed`)});return u([...t,...o,...i])}return u([...t,...i,...n,...c,...d,...l])}function k(e){return {id:e.id,artifactKind:e.artifactKind,cardId:e.cardId,title:e.title,order:e.order,phase:e.phase,scope:"workspace",status:e.status??"ready",mode:e.mode,risk:e.risk,requiresApproval:true,blocker:e.blocker,summary:e.summary,...e.command?{command:e.command}:{},verifyCommand:e.verifyCommand,cwd:"workspace",files:e.files??[],...e.operation?{operation:e.operation}:{},rollback:{available:!!e.operation,strategy:e.operation?"idempotent":"none"},notes:e.notes??[]}}function S(e){let r=[],t=C("npx workspai bootstrap --json");for(let i of e.blockers)i.includes("profile.enterprise.ci")&&r.push(k({id:"bootstrap.enterprise-ci",artifactKind:"bootstrap-compliance",cardId:"bootstrap",title:"Run bootstrap in deterministic CI mode",order:10,phase:"bootstrap-preflight",blocker:i,summary:"Enterprise bootstrap compliance requires --ci for deterministic execution.",mode:"run-command",risk:"safe",command:t,verifyCommand:t})),i.includes("profile.enterprise.compatibility-matrix")&&r.push(k({id:"bootstrap.compatibility-matrix",artifactKind:"bootstrap-compliance",cardId:"bootstrap",title:"Create enterprise compatibility matrix baseline",order:20,phase:"bootstrap-config",blocker:i,summary:"Create the missing compatibility matrix baseline without overwriting user data.",mode:"edit-file",risk:"safe",verifyCommand:t,files:[".workspai/compatibility-matrix.json"],operation:{type:"file-create",path:".workspai/compatibility-matrix.json",content:M(e.generatedAt),overwrite:false}})),i.includes("profile.enterprise.mirror-config")&&r.push(k({id:"bootstrap.mirror-config",artifactKind:"bootstrap-compliance",cardId:"bootstrap",title:"Create enterprise mirror config baseline",order:30,phase:"bootstrap-config",blocker:i,summary:"Create the missing mirror configuration baseline without enabling mirroring.",mode:"edit-file",risk:"safe",verifyCommand:t,files:[".workspai/mirror-config.json"],operation:{type:"file-create",path:".workspai/mirror-config.json",content:N(e.generatedAt),overwrite:false}}));return r}function $(e){let t={analyze:{title:"Refresh analyze evidence",phase:"analysis",command:"npx workspai analyze --strict --json",verify:"npx workspai analyze --strict --json"},readiness:{title:"Refresh release readiness",phase:"release-readiness",command:e.ciMode?"npx workspai readiness --strict --json":"npx workspai readiness --json",verify:e.ciMode?"npx workspai readiness --strict --json":"npx workspai readiness --json"},pipeline:{title:"Rerun governance pipeline",phase:"governance-pipeline",command:"npx workspai pipeline --json --strict",verify:"npx workspai pipeline --json --strict"},"workspace-run":{title:"Rerun failed workspace stage",phase:"fleet-run",command:e.ciMode?"npx workspai workspace run test --strict --json":"npx workspai workspace run test --json",verify:e.ciMode?"npx workspai workspace run test --strict --json":"npx workspai workspace run test --json"},"workspace-verify":{title:"Refresh workspace verify gate",phase:"verification",command:e.ciMode?"npx workspai workspace verify --strict --json":"npx workspai workspace verify --json",verify:e.ciMode?"npx workspai workspace verify --strict --json":"npx workspai workspace verify --json"},"doctor-workspace":{title:"Use Doctor remediation plan",phase:"doctor-remediation",command:"npx workspai doctor workspace --plan --json",verify:"npx workspai doctor workspace --json"}}[e.report.artifactKind]??{title:"Refresh artifact evidence",phase:"evidence-refresh",command:"npx workspai pipeline --json --strict",verify:"npx workspai pipeline --json --strict"};return k({id:`${e.report.cardId}.refresh.${e.order}`,artifactKind:e.report.artifactKind,cardId:e.report.cardId,title:t.title,order:e.order,phase:t.phase,blocker:e.blocker,summary:"No deterministic file operation is available for this artifact yet; refresh the evidence and continue with the card-specific plan.",mode:e.report.artifactKind==="doctor-workspace"?"verify-before-fix":"run-command",risk:"guarded",status:e.report.artifactKind==="doctor-workspace"?"review-required":"ready",command:t.command,verifyCommand:t.verify,notes:e.report.artifactKind==="doctor-workspace"?["Read doctor-remediation-plan-last-run.json for ordered file-level steps."]:[]})}async function O(e){let r=[c(e,".workspai/reports"),d(e,".workspai/reports")],t=[],i=new Set;for(let n of I)for(let c of n.fileNames){let d=(await Promise.all(r.map(a=>y.join(a,c)))).find(a=>existsSync(a));if(!(!d||i.has(`${n.artifactKind}:${c}`))){i.add(`${n.artifactKind}:${c}`);try{let a=await x.readJSON(d),l=m(a);if(!l)continue;t.push({artifactKind:n.artifactKind,cardId:n.cardId,fileName:c,absolutePath:d,payload:l});}catch{t.push({artifactKind:n.artifactKind,cardId:n.cardId,fileName:c,absolutePath:d,payload:{blockers:[`${n.artifactKind}: report exists but could not be parsed.`]}});}}}return t}async function F(e){let r=y.resolve(e.workspacePath),t=e.includeAbsolutePaths===true,i=e.ciMode===true,n=new Date().toISOString(),c$1=c(r,".workspai/reports"),d=await O(r),a$1=[],l=1;for(let o of d){let s=P(o);if(s.length!==0){if(o.artifactKind==="bootstrap-compliance"){a$1.push(...S({blockers:s,generatedAt:n})),l=a$1.length+1;continue}for(let b of s.slice(0,8))a$1.push($({report:o,blocker:b,order:l,ciMode:i})),l+=1;}}let g={safe:a$1.filter(o=>o.risk==="safe").length,guarded:a$1.filter(o=>o.risk==="guarded").length,invasive:a$1.filter(o=>o.risk==="invasive").length};return {schemaVersion:a,generatedAt:n,workspace:{name:y.basename(r),...t?{path:r}:{}},source:{command:"workspace remediation-plan",reportsDir:K(r,c$1,t),includeAbsolutePaths:t,ciMode:i},summary:{artifactsScanned:d.length,cardsCovered:u(a$1.map(o=>o.cardId)).length,totalActions:a$1.length,executableActions:a$1.filter(o=>o.status==="ready").length,risk:g},actions:a$1}}async function W(e,r){return g(r,".workspai/reports/artifact-remediation-plan-last-run.json",e)}export{F as buildArtifactRemediationPlan,W as writeArtifactRemediationPlan};

package/dist/autopilot-release-WUR4CQIT.js

@@ -1 +0,0 @@
-export{b as AUTOPILOT_RELEASE_ALIAS_FILENAME,a as AUTOPILOT_RELEASE_LAST_RUN_FILENAME,c as runAutopilotRelease}from'./chunk-4EPHWD27.js';

package/dist/chunk-2G7FASAO.js

@@ -1,2 +0,0 @@
-import {b as b$1}from'./chunk-NHN4QXPP.js';import {i}from'./chunk-MER6ZBN2.js';import {c}from'./chunk-PRBVYW3T.js';import {a}from'./chunk-Y45WZR5N.js';import {f}from'./chunk-7YHK5NM3.js';import {b}from'./chunk-RO73VVHW.js';import {h,g as g$1}from'./chunk-5XATWNME.js';import {promises,constants}from'fs';import c$1 from'path';import T,{homedir}from'os';import {pathToFileURL}from'url';import g from'process';import E from'crypto';import s from'fs/promises';function q(t){let e=t.label.indexOf(" \u2014 ");return e>=0?t.label.slice(e+3).trim():t.label.trim()}function B(){let t=c().map(e=>({value:e.id,label:q(e),hint:e.description,name:e.label})),r=i().map(e=>({value:e.kitId,label:e.displayName,hint:e.commandDisplay("my-app"),name:`${e.displayName} \u2014 ${e.framework}`}));return [...t,...r]}var Q=".workspairc.json",z=".rapidkitrc.json",Z=["workspai.config.js","workspai.config.mjs","workspai.config.cjs","rapidkit.config.js","rapidkit.config.mjs","rapidkit.config.cjs"],ee=["workspai.config.json","rapidkit.config.json"];function I(t){return typeof t=="object"&&t!==null&&"code"in t&&t.code==="ENOENT"}function L(t,r){let e=r instanceof Error?r.message:String(r),i=t.endsWith(".js")&&/module is not defined in ES module scope/i.test(e)?' CommonJS syntax in a .js config is not valid when the project package uses "type": "module"; rename the file to .cjs or use export default.':"";return `Failed to load Workspai config at ${t}.${i} Cause: ${e}`}async function _e(){for(let t of [c$1.join(T.homedir(),Q),c$1.join(T.homedir(),z)])try{let r=await promises.readFile(t,"utf-8"),e=JSON.parse(r);return f.debug(`Loaded config from ${t}`),e}catch{}return f.debug("No user config found, using defaults"),{}}async function Ke(t=process.cwd(),r={}){let e=t,i=c$1.parse(e).root;for(;e!==i;){for(let o of ee){let n=c$1.join(e,o);try{let a=await promises.readFile(n,"utf-8"),l=JSON.parse(a);if(!l||typeof l!="object"||Array.isArray(l))throw new Error("configuration root must be a JSON object");return f.debug(`Loaded data-only Workspai config from ${o}`),l}catch(a){if(I(a))continue;throw new Error(L(n,a))}}for(let o of Z){let n=c$1.join(e,o);try{await promises.access(n);}catch(a){if(I(a))continue;throw new Error(L(n,a))}if(f.debug(`Found config file: ${n}`),!r.trustExecutableConfig)throw new Error(`Refusing to execute Workspai config at ${n} without explicit trust. Use a data-only workspai.config.json file, pass --trust-config, or set WORKSPAI_TRUST_CONFIG=1.`);try{let l=await import(pathToFileURL(n).href),f$1=l.default||l;return f.debug(`Loaded Workspai config from ${o}`),f$1}catch(a){throw new Error(L(n,a))}}e=c$1.dirname(e);}return f.debug("No Workspai config file found, using defaults"),{}}function Me(t,r,e){return {author:e.author||r.workspace?.defaultAuthor||t.author,pythonVersion:e.pythonVersion||r.workspace?.pythonVersion||t.pythonVersion,defaultInstallMethod:e.defaultInstallMethod||r.workspace?.installMethod||t.defaultInstallMethod,defaultKit:e.defaultKit||r.projects?.defaultKit||t.defaultKit,skipGit:e.skipGit??r.projects?.skipGit??t.skipGit,license:e.license||t.license,testRapidKitPath:e.testRapidKitPath||t.testRapidKitPath}}function Ge(t){return a("DEV_PATH")||t.testRapidKitPath||void 0}function re(t,r){let e=t.indexOf(r);if(e>=0&&e+1<t.length)return t[e+1];let i=t.find(o=>o.startsWith(`${r}=`));if(i)return i.slice(r.length+1)}function ie(t){return t.includes("--here")}function U(t,r=g.cwd()){if(ie(t))return c$1.resolve(r);let e=re(t,"--output");if(e)return c$1.resolve(e)}function Ze(t,r=g.cwd()){let e=c$1.resolve(t),i=c$1.resolve(r),o=c$1.relative(i,e);return o.length>0&&!o.startsWith("..")&&!c$1.isAbsolute(o)?`cd ${o}`:`cd ${e}`}function et(t,r={}){let e=r.argv??[],i=r.outputParent??U(e,g.cwd());return h(t.trim(),{homeDir:r.homeDir,outputDir:i})}function tt(t,r,e={}){return t?c$1.resolve(t)===c$1.resolve(r)?true:e.outputParent===void 0:false}async function rt(t,r={}){let e=r.cwd??g.cwd(),i=r.homeDir??homedir(),o=U(t,e);if(o!==void 0)return o;let n=r.hasYes??(t.includes("--yes")||t.includes("-y"));if(!(r.interactive??(!n&&!!g.stdin.isTTY&&!b())))return;let l=g$1(i),{location:f}=await b$1([{type:"rawlist",name:"location",message:"Where should the workspace be created?",choices:[{value:"managed",label:"Managed home",hint:l},{value:"here",label:"Current directory",hint:e}],default:0}]);if(f==="here")return c$1.resolve(e)}var W="workspai.lifecycle-transaction",J=1,N="manifest.json",_="lifecycle-transaction-";async function w(t){try{return await s.lstat(t)}catch(r){if(r.code==="ENOENT")return null;throw r}}function K(t){let r=t?.code;return process.platform==="win32"&&(r==="EPERM"||r==="EINVAL"||r==="ENOSYS")}async function D(t){try{await t.sync();}catch(r){if(!K(r))throw r}}function oe(t){if(typeof t!="string"||!c$1.isAbsolute(t))throw new Error("Lifecycle transaction journal contains a non-absolute target path.")}function ne(t){if(typeof t!="string"||t.length===0||c$1.basename(t)!==t||t==="."||t==="..")throw new Error("Lifecycle transaction journal contains an unsafe backup reference.")}function ae(t){if(!t||typeof t!="object")throw new Error("Lifecycle transaction journal is not an object.");let r=t;if(r.kind!==W||r.version!==J)throw new Error("Lifecycle transaction journal has an unsupported format.");if(!Number.isInteger(r.ownerPid)||r.ownerPid<=0)throw new Error("Lifecycle transaction journal has an invalid owner process.");if(!["active","committed","rolling-back"].includes(r.phase))throw new Error("Lifecycle transaction journal has an invalid phase.");if(!Array.isArray(r.operations))throw new Error("Lifecycle transaction journal has invalid operations.");for(let e of r.operations){if(!e||typeof e!="object")throw new Error("Lifecycle transaction journal contains an invalid operation.");let i=e;if(oe(i.path),i.type!=="tree"){if(i.type!=="file"||!["absent","regular"].includes(i.state))throw new Error("Lifecycle transaction journal contains an invalid operation.");if(i.state==="regular"){if(!Number.isInteger(i.mode)||i.mode<0||i.mode>4095)throw new Error("Lifecycle transaction journal contains an invalid file mode.");ne(i.backup);}}}return r}async function x(t){let r;try{r=await s.open(t,constants.O_RDONLY);}catch(e){if(K(e))return;throw e}try{await D(r);}finally{await r.close();}}async function M(t,r){let e=c$1.join(c$1.dirname(t),`.${c$1.basename(t)}.${process.pid}.${E.randomUUID()}.tmp`);try{let i=await s.open(e,constants.O_WRONLY|constants.O_CREAT|constants.O_EXCL,384);try{await i.writeFile(r),await D(i);}finally{await i.close();}await s.rename(e,t),await x(c$1.dirname(t));}catch(i){throw await s.rm(e,{force:true}).catch(()=>{}),i}}async function G(t,r){await M(c$1.join(t,N),Buffer.from(`${JSON.stringify(r,null,2)}
-`));}async function V(t,r){let e=await w(t.path);if(e?.isSymbolicLink()||e&&!e.isFile())throw new Error(`Refusing to restore over a non-regular file: ${t.path}`);if(t.state==="absent"){e&&await s.unlink(t.path);return}if(!r)throw new Error(`Missing durable backup for: ${t.path}`);if(!await w(c$1.dirname(t.path)))return;let i=c$1.join(r,t.backup),o=await s.lstat(i).catch(f=>{if(f.code==="ENOENT"&&e?.isFile())return e;throw f});if(o===e)return;if(!o.isFile()||o.isSymbolicLink())throw new Error(`Lifecycle transaction backup is not a regular file: ${i}`);let n=await s.readFile(i),a=c$1.join(c$1.dirname(t.path),`.${c$1.basename(t.path)}.${process.pid}.${E.randomUUID()}.rollback`),l=await s.open(a,constants.O_WRONLY|constants.O_CREAT|constants.O_EXCL,t.mode);try{await l.writeFile(n),await l.chmod(t.mode),await D(l);}finally{await l.close();}try{await s.rename(a,t.path),await x(c$1.dirname(t.path));}catch(f){throw await s.rm(a,{force:true}).catch(()=>{}),f}}async function Y(t){let r=await w(t.path);if(r){if(r.isSymbolicLink()||!r.isDirectory())throw new Error(`Refusing to remove a non-directory owned tree: ${t.path}`);await s.rm(t.path,{recursive:true});}}async function se(t,r){let e=[];for(let i of [...t].reverse())try{i.type==="file"?await V(i,r):await Y(i);}catch(o){e.push(o);}if(e.length>0)throw new AggregateError(e,"Lifecycle transaction rollback failed.")}var j=class t{constructor(r){this.transactionDirectory=r;this.journalPath=r?c$1.join(r,N):void 0;}transactionDirectory;journalPath;actions=[];durableOperations=[];phase="active";finished=false;static async create(r={}){if(!r.journalDirectory)return new t;let e=c$1.resolve(r.journalDirectory);await s.mkdir(e,{recursive:true});let i=await s.mkdtemp(c$1.join(e,_));await x(e);let o=new t(i);return await o.persist(),o}assertActive(){if(this.finished||this.phase!=="active")throw new Error("Lifecycle transaction is no longer active.")}async persist(r=this.durableOperations){this.transactionDirectory&&await G(this.transactionDirectory,{kind:W,version:J,ownerPid:process.pid,phase:this.phase,operations:r});}async addDurableOperation(r){let e=[...this.durableOperations,r];await this.persist(e),this.durableOperations.push(r),this.actions.push(r);}async captureFile(r){this.assertActive();let e=c$1.resolve(r),i=await w(e);if(!i){await this.addDurableOperation({type:"file",path:e,state:"absent"});return}if(i.isSymbolicLink()||!i.isFile())throw new Error(`Lifecycle transaction can only capture regular files: ${e}`);let o;try{o=await s.open(e,constants.O_RDONLY|(constants.O_NOFOLLOW??0));}catch(n){throw n.code==="ENOENT"?new Error(`File changed while being captured: ${e}`,{cause:n}):n}try{let n=await o.stat();if(!n.isFile())throw new Error(`Lifecycle transaction can only capture regular files: ${e}`);let a=await o.readFile(),l=n.mode&4095;if(this.transactionDirectory){let f=`file-${this.durableOperations.length}-${E.randomUUID()}.bin`;await M(c$1.join(this.transactionDirectory,f),a),await this.addDurableOperation({type:"file",path:e,state:"regular",mode:l,backup:f});}else {let f=`memory-${this.durableOperations.length}`,y={type:"file",path:e,state:"regular",mode:l,backup:f};this.durableOperations.push(y),this.actions.push({type:"compensation",run:async()=>{let d=await w(e);if(d?.isSymbolicLink()||d&&!d.isFile())throw new Error(`Refusing to restore over a non-regular file: ${e}`);let b=c$1.join(c$1.dirname(e),`.${c$1.basename(e)}.${process.pid}.${E.randomUUID()}.rollback`);await s.writeFile(b,a,{flag:"wx",mode:l}),await s.chmod(b,l);try{await s.rename(b,e);}catch(H){throw await s.rm(b,{force:true}).catch(()=>{}),H}}});}}finally{await o.close();}}async captureOwnedTree(r){this.assertActive();let e=c$1.resolve(r),i=await w(e);if(!i)return await this.addDurableOperation({type:"tree",path:e}),true;if(i.isSymbolicLink()||!i.isDirectory())throw new Error(`Lifecycle transaction tree must be absent or a directory: ${e}`);return  false}registerCompensation(r){this.assertActive(),this.actions.push({type:"compensation",run:async()=>r()});}async commit(){if(!this.finished){this.assertActive(),this.phase="committed";try{await this.persist(),this.finished=true,this.actions.length=0,this.transactionDirectory&&await s.rm(this.transactionDirectory,{recursive:true}).catch(()=>{});}catch(r){throw this.phase="active",r}}}async rollback(){if(this.finished||this.phase==="committed")return;this.assertActive(),this.phase="rolling-back";try{await this.persist();}catch(e){throw this.phase="active",e}let r=[];for(let e of [...this.actions].reverse())try{e.type==="compensation"?await e.run():e.type==="file"?await V(e,this.transactionDirectory):await Y(e);}catch(i){r.push(i);}if(r.length>0)throw new AggregateError(r,"Lifecycle transaction rollback failed.");this.finished=true,this.transactionDirectory&&await s.rm(this.transactionDirectory,{recursive:true});}};async function lt(t={}){return j.create(t)}async function ft(t){let r=c$1.resolve(t),e=await s.readdir(r,{withFileTypes:true}).catch(n=>{if(n.code==="ENOENT")return [];throw n}),i=[],o=[];for(let n of e){if(!n.isDirectory()||!n.name.startsWith(_))continue;let a=c$1.join(r,n.name);try{let l;try{l=await s.readFile(c$1.join(a,N),"utf8");}catch(d){if(d.code==="ENOENT")continue;throw d}let f=ae(JSON.parse(l));if(f.phase==="committed"){await s.rm(a,{recursive:true});continue}let y=false;try{process.kill(f.ownerPid,0),y=true;}catch(d){y=d.code==="EPERM";}if(y)continue;f.phase==="active"&&(f.phase="rolling-back",await G(a,f)),await se(f.operations,a),await s.rm(a,{recursive:true}),i.push(a);}catch(l){o.push(l);}}if(o.length>0)throw new AggregateError(o,"Lifecycle transaction recovery failed.");return i}export{B as a,_e as b,Ke as c,Me as d,Ge as e,Ze as f,et as g,tt as h,rt as i,lt as j,ft as k};

package/dist/chunk-4EPHWD27.js

@@ -1,8 +0,0 @@
-import {a as a$1}from'./chunk-QA5BGEQW.js';import {a as a$4}from'./chunk-22DT744Z.js';import {a as a$2,e}from'./chunk-WPEEC5BX.js';import {f,c,g}from'./chunk-HDURFXW5.js';import {a}from'./chunk-N7DV5L7C.js';import a$3 from'chalk';import se from'fs';import b from'path';import {execa}from'execa';var G="autopilot-release-last-run.json",V="autopilot-release.json";function j(r){try{return JSON.parse(r)}catch{return null}}function Re(r){let e=b.resolve(r),n=a$4(e);if(!n)throw new Error("No Workspai workspace found in current directory or parents");return n}async function S(r,e){let n=process.argv[1];if(!n)return {exitCode:1,stdout:"",stderr:"RapidKit entrypoint is unavailable for autopilot execution.",crashed:true};try{let o=await execa(process.execPath,[n,...r],{cwd:e,reject:false,env:{...process.env,RAPIDKIT_AUTOPILOT_CHILD:"1"}});return {exitCode:Number(o.exitCode??1),stdout:o.stdout,stderr:o.stderr,crashed:false}}catch(o){return {exitCode:1,stdout:"",stderr:o instanceof Error?o.message:String(o),crashed:true}}}function re(r){let e=r.toLowerCase();return e==="pass"?"pass":e==="warn"?"warn":e==="fail"?"fail":"warn"}function oe(r){return r.summary.failed>0||r.gates.results.some(e=>e.status==="fail")?"fail":r.gates.results.some(e=>e.status==="warn")?"warn":"pass"}function Se(r){let e=r.filter(o=>o.status!=="skipped");if(e.length===0)return 100;let n=e.reduce((o,t)=>t.status==="pass"?o+1:t.status==="warn"?o+.6:o,0);return Math.round(n/e.length*100)}function be(r){return r.executionError?["Re-run: npx workspai autopilot release --mode audit --json","Inspect .workspai/reports/autopilot-release-last-run.json for execution failure details"]:r.blockers.length>0?["Run: npx workspai doctor workspace --plan","Run: npx workspai readiness --json --strict","Run: npx workspai workspace run test --affected --strict"]:r.hasWarnings&&r.mode!=="enforce"?["Review warning-level findings in autopilot report","Optionally run: npx workspai autopilot release --mode safe-fix"]:["Workspace is release-ready based on current autopilot policy"]}async function xe(r,e){await se.promises.mkdir(b.dirname(r),{recursive:true}),await se.promises.writeFile(r,`${JSON.stringify(e,null,2)}
-`,"utf-8");}async function Me(r){let e$1=Re(r.workspacePath),n=r.mode,o=[],t=[],F,H,D,q,Q,X=0,f$1=false,T=0,L=0,N=-1,W=-1,c$1="skipped",d="skipped",ae=n==="enforce"?["doctor","workspace","--json","--strict"]:["doctor","workspace","--json","--ci"];if(r.skipPipelineStages)o.push({name:"doctor-workspace",status:"skipped",durationMs:0,summary:"doctor stage skipped (pipeline already executed)"},{name:"analyze",status:"skipped",durationMs:0,summary:"analyze stage skipped (pipeline already executed)"},{name:"readiness",status:"skipped",durationMs:0,summary:"readiness stage skipped (pipeline already executed)"});else {let s=Date.now(),l=await S([...ae],e$1),m=Date.now()-s;if(c$1="pass",l.crashed)c$1="fail",f$1=true,t.push(`doctor workspace execution error: ${l.stderr||"unknown error"}`);else if(l.exitCode===1)c$1="fail",t.push("doctor workspace command failed or reported errors");else if(l.exitCode===2)c$1="warn",t.push("doctor workspace reported warnings");else if(l.exitCode!==0)c$1="fail",t.push("doctor workspace command failed");else {let p=j(l.stdout),E=p&&p.healthScore&&typeof p.healthScore=="object"?p.healthScore:{},k=Number(E.errors??0),$=Number(E.warnings??0);Number.isFinite(k)&&k>0?(c$1="fail",t.push(`doctor workspace reports ${k} error(s)`)):Number.isFinite($)&&$>0&&(c$1="warn");}N=o.push({name:"doctor-workspace",status:c$1,durationMs:m,summary:c$1==="pass"?"doctor workspace passed":c$1==="warn"?"doctor workspace reported warnings":"doctor workspace reported errors"})-1,n==="enforce"&&c$1==="warn"&&t.push("doctor workspace reported warnings under enforce mode");let g=Date.now(),w=await S(["analyze","--json"],e$1),v=Date.now()-g;H=await f(e$1,a.analyze)??c(e$1,a.analyze);let i="pass";if(w.crashed)i="fail",f$1=true,t.push(`analyze execution error: ${w.stderr||"unknown error"}`);else if(w.exitCode!==0)i=w.exitCode===2?"warn":"fail",t.push(w.exitCode===2?"analyze reported needs-attention verdict":"analyze command failed or reported blocked verdict");else {let p=j(w.stdout),E=p&&p.summary&&typeof p.summary=="object"?p.summary:{},k=String(E.verdict??"ready");k==="blocked"?(i="fail",t.push("analyze reported blocked verdict")):k==="needs-attention"&&(i="warn");}o.push({name:"analyze",status:i,durationMs:v,summary:i==="pass"?"analyze passed":i==="warn"?"analyze reported needs-attention":"analyze reported blocked verdict"}),n==="enforce"&&i==="warn"&&t.push("analyze reported warnings under enforce mode");let P=Date.now(),h=await S(["readiness","--json"],e$1),y=Date.now()-P;if(d="fail",h.crashed)d="fail",f$1=true,t.push(`readiness execution error: ${h.stderr||"unknown error"}`);else if(h.exitCode!==0)d="fail",t.push("readiness command failed");else {let p=j(h.stdout),E=String(p?.overallStatus??"fail");if(d=re(E),typeof p?.evidencePath=="string"&&p.evidencePath.trim().length>0&&(F=p.evidencePath),d==="fail"){let k=Array.isArray(p?.blockingReasons)?p?.blockingReasons.filter($=>typeof $=="string"):[];k.length>0?t.push(...k.map($=>`readiness: ${$}`)):t.push("readiness overall status is fail");}}W=o.push({name:"readiness",status:d,durationMs:y,summary:`readiness overall status is ${d}`})-1,n==="enforce"&&d==="warn"&&t.push("readiness reported warnings under enforce mode");}let ne=Date.now(),z=await S(["doctor","workspace","--plan","--json"],e$1),ie=Date.now()-ne,R="warn";if(z.crashed)R="fail",f$1=true,t.push(`doctor remediation plan execution error: ${z.stderr||"unknown error"}`);else if(z.exitCode!==0)R="fail",t.push("doctor remediation plan command failed");else {let s=j(z.stdout),l=s&&s.remediationPlan&&typeof s.remediationPlan=="object"?s.remediationPlan:null,m=Number(l?.totalSteps??0),g=Number(l?.executableSteps??0);Number.isFinite(m)&&m>0&&(T=m),Number.isFinite(g)&&g>0&&(L=g),Number.isFinite(m)&&m===0?R="pass":R="warn";}if(o.push({name:"remediation-plan",status:R,durationMs:ie,summary:R==="pass"?"no remediation steps required":"remediation steps available"}),n==="enforce"&&R==="warn"&&t.push("remediation plan has pending steps under enforce mode"),n==="safe-fix"){let s=Date.now(),l=await S(["doctor","workspace","--apply"],e$1),m=Date.now()-s,g=l.crashed||l.exitCode!==0?"fail":"pass";if(l.crashed)f$1=true,t.push(`doctor remediation apply execution error: ${l.stderr||"unknown error"}`);else if(g==="fail")t.push("doctor remediation apply failed");else {X=L>0?L:T>0?T:1;let w=await S(["doctor","workspace","--json"],e$1);if(w.crashed)c$1="fail",f$1=true,t.push(`post-apply doctor execution error: ${w.stderr||"unknown error"}`);else if(w.exitCode!==0)c$1="fail",t.push("post-apply doctor workspace command failed");else {let i=j(w.stdout),P=i&&i.healthScore&&typeof i.healthScore=="object"?i.healthScore:{},h=Number(P.errors??0),y=Number(P.warnings??0);Number.isFinite(h)&&h>0?(c$1="fail",t.push(`post-apply doctor reports ${h} error(s)`)):Number.isFinite(y)&&y>0?c$1="warn":c$1="pass";}N>=0&&(o[N].status=c$1,o[N].summary=`doctor workspace post-apply status is ${c$1}`);let v=await S(["readiness","--json"],e$1);if(v.crashed)d="fail",f$1=true,t.push(`post-apply readiness execution error: ${v.stderr||"unknown error"}`);else if(v.exitCode!==0)d="fail",t.push("post-apply readiness command failed");else {let i=j(v.stdout),P=String(i?.overallStatus??"fail");if(d=re(P),typeof i?.evidencePath=="string"&&i.evidencePath.trim().length>0&&(F=i.evidencePath),d==="fail"){let h=Array.isArray(i?.blockingReasons)?i?.blockingReasons.filter(y=>typeof y=="string"):[];h.length>0?t.push(...h.map(y=>`post-apply readiness: ${y}`)):t.push("post-apply readiness overall status is fail");}}W>=0&&(o[W].status=d,o[W].summary=`readiness post-apply overall status is ${d}`);}o.push({name:"remediation-apply",status:g,durationMs:m,summary:g==="pass"?"safe remediation apply completed":"safe remediation apply failed"});}else o.push({name:"remediation-apply",status:"skipped",durationMs:0,summary:"remediation apply is skipped for this mode"});let le=Date.now(),x="pass",A="workspace test/build completed for selected projects";try{let s=await a$1({workspacePath:e$1,stage:"test",affected:true,since:r.since,parallel:r.parallel,maxWorkers:r.maxWorkers,strict:true,json:true,enforceGates:false});D=c(e$1,b.join(".workspai","reports",a$2)),await e(e$1,s),q=D;let l=oe(s);if(l==="fail")x="fail",A="workspace test stage failed for selected projects",t.push("workspace run test failed for selected projects");else {l==="warn"&&(x="warn",A="workspace test stage completed with warnings",n==="enforce"&&t.push("workspace run test reported warnings under enforce mode"));let m=await a$1({workspacePath:e$1,stage:"build",affected:true,since:r.since,parallel:r.parallel,maxWorkers:r.maxWorkers,strict:true,json:true,enforceGates:false});await e(e$1,m),Q=D;let g=oe(m);g==="fail"?(x="fail",A="workspace build stage failed for selected projects",t.push("workspace run build failed for selected projects")):g==="warn"&&(x="warn",A="workspace test/build completed with warnings",n==="enforce"&&t.push("workspace run test/build reported warnings under enforce mode"));}}catch(s){x="fail",A="workspace test/build orchestration failed",f$1=true,t.push(`workspace run orchestration error: ${s instanceof Error?s.message:String(s)}`);}let ce=Date.now()-le;o.push({name:"workspace-run-test-build",status:x,durationMs:ce,summary:A});let M=o.filter(s=>s.status==="warn").length,pe=o.filter(s=>s.status==="fail").length,_=n==="enforce"?o.some(s=>s.status==="warn"||s.status==="fail"):pe>0,C=[...new Set(t)],O=f$1||_?Math.max(1,C.length):0,ue=O>0?C:[],de=O===0?C:[],fe=Se(o),me=f$1||_?"blocked":M>0?"partial":"approved",ge=f$1?3:_?1:M>0?2:0,we=be({mode:n,executionError:f$1,blockers:C,hasWarnings:M>0}),Y=c(e$1,".workspai/reports"),he=b.join(Y,G),ke=b.join(Y,V),u={schemaVersion:"autopilot-release-v1",generatedAt:new Date().toISOString(),workspacePath:e$1,mode:n,summary:{releaseScore:fe,verdict:me,blockers:O,warnings:M,safeFixesApplied:X,manualActions:C.length,exitCode:ge},stages:o,blockingReasons:ue,warningReasons:de,nextActions:we,artifacts:{reportPath:he,aliasEvidencePath:ke,analyzeEvidencePath:H,readinessEvidencePath:F,workspaceRunEvidencePath:D,workspaceRunTestPath:q,workspaceRunBuildPath:Q},enterpriseControls:{jsonReady:true,evidencePath:`.workspai/reports/${G}`,aliasEvidencePath:`.workspai/reports/${V}`}};if(await g(e$1,`.workspai/reports/${G}`,u),await g(e$1,`.workspai/reports/${V}`,u),r.output&&await xe(b.resolve(r.output),u),!r.json){console.log(a$3.bold.cyan(`
-\u{1F680} Workspai Autopilot Release
-`)),console.log(a$3.bold(`Workspace: ${a$3.cyan(b.basename(e$1))}`)),console.log(a$3.gray(`Path: ${e$1}`)),console.log(a$3.white(`Mode: ${n}`)),console.log(a$3.white(`Verdict: ${u.summary.verdict==="approved"?a$3.green("approved"):u.summary.verdict==="partial"?a$3.yellow("partial"):a$3.red("blocked")}`)),console.log(a$3.white(`Release score: ${u.summary.releaseScore}`));for(let s of u.stages){let l=s.status==="pass"?a$3.green("PASS"):s.status==="warn"?a$3.yellow("WARN"):s.status==="skipped"?a$3.gray("SKIP"):a$3.red("FAIL");console.log(` - ${s.name}: ${l} ${s.summary} (${s.durationMs}ms)`);}if(u.blockingReasons.length>0){console.log(a$3.bold.red(`
-Blocking reasons:`));for(let s of u.blockingReasons)console.log(a$3.red(` - ${s}`));}if(u.warningReasons.length>0){console.log(a$3.bold.yellow(`
-Warning reasons:`));for(let s of u.warningReasons)console.log(a$3.yellow(` - ${s}`));}if(u.nextActions.length>0){console.log(a$3.bold(`
-Next actions:`));for(let s of u.nextActions)console.log(a$3.gray(` - ${s}`));}console.log(a$3.gray(`
-Report: ${u.artifacts.reportPath}`));}return u}export{G as a,V as b,Me as c};