workspai 0.52.0 → 0.52.2

package/dist/{pipeline-NT6AYYWM.js → pipeline-FOZ46ELQ.js}

@@ -1,4 +1,4 @@
-import {a as a$3}from'./chunk-HPWLSLMC.js';import {c}from'./chunk-FRJYAJH6.js';import {q}from'./chunk-6AXRIAP2.js';import {c as c$1}from'./chunk-FPJNWPKU.js';import {a as a$4}from'./chunk-KHEJO3JU.js';import {f,e}from'./chunk-T3GJ7YVG.js';import {a}from'./chunk-2OIBHUVH.js';import {g}from'./chunk-MZFSINY7.js';import {d,a as a$2,e as e$1}from'./chunk-MBRU3VWJ.js';import {a as a$1}from'./chunk-62K2H72S.js';import c$2 from'chalk';import p from'path';function G(a){return a===0?"pass":a===2?"warn":"fail"}function I(a){return a.some(r=>r.status==="fail")?"blocked":a.some(r=>r.status==="warn")?"needs-attention":"ready"}function j(a,r){if(r)return 3;let i=a.some(o=>o.status==="fail"),t=a.some(o=>o.status==="warn");return i?1:t?2:0}function N(a,r){return a===2&&!r?0:a}async function O(a){let r=await g(a,true),i=false;try{let{syncWorkspaceContract:t}=await import('./workspace-contract-AZFISDLS.js');await t({workspacePath:a}),i=true;}catch{i=false;}return {sync:r,contractSynced:i}}async function V(a$5={}){let r=p.resolve(a$5.workspacePath??process.cwd()),i=a(r);if(!i)throw new Error("No Workspai workspace found in current directory or parents");let t=[],o=[],l=false,d$1,f$1,m,y=Date.now();try{let{sync:e,contractSynced:s}=await O(i),n=e.workspaceFound&&(e.added.length>0||e.skipped>=0)||e.workspaceFound?"pass":"warn";t.push({name:"sync",status:n,durationMs:Date.now()-y,summary:e.workspaceFound?`registry sync complete (${e.added.length} added, ${e.skipped} existing)${s?", contract synced":""}`:"workspace not registered in global registry; contract sync attempted"}),e.workspaceFound||o.push("workspace registry entry missing \u2014 run workspai create workspace or register manually");}catch(e){l=true,t.push({name:"sync",status:"fail",durationMs:Date.now()-y,summary:`sync failed: ${e instanceof Error?e.message:String(e)}`}),o.push("workspace sync stage failed");}let w=Date.now();try{let e=await q({workspace:true,json:true,quiet:true,strict:a$5.strict===true,ci:a$5.strict!==true}),s=G(e),n=await d(i,a$1.doctor)??a$2(i,a$1.doctor);t.push({name:"doctor",status:s,durationMs:Date.now()-w,summary:s==="pass"?"doctor workspace passed":s==="warn"?"doctor workspace reported warnings":"doctor workspace did not pass",exitCode:e,evidencePath:n}),s==="fail"?o.push("doctor workspace gate failed"):s==="warn"&&o.push("doctor workspace reported warnings");}catch(e){l=true,t.push({name:"doctor",status:"fail",durationMs:Date.now()-w,summary:`doctor failed: ${e instanceof Error?e.message:String(e)}`}),o.push("doctor workspace stage failed");}if(a$5.skipAnalyze)t.push({name:"analyze",status:"skipped",durationMs:0,summary:"analyze stage skipped"});else {let e=Date.now();try{let s=await a$3({workspacePath:i,json:true,strict:a$5.strict===true});d$1=p.isAbsolute(s.enterpriseControls.evidencePath)?s.enterpriseControls.evidencePath:p.join(i,s.enterpriseControls.evidencePath);let n=s.summary.verdict==="blocked"?"fail":s.summary.verdict==="needs-attention"?"warn":"pass";t.push({name:"analyze",status:n,durationMs:Date.now()-e,summary:`analyze verdict: ${s.summary.verdict} (score ${s.summary.score}/100)`,evidencePath:d$1}),n==="fail"?o.push("analyze reported blocked verdict"):n==="warn"&&o.push("analyze reported needs-attention verdict");}catch(s){l=true,t.push({name:"analyze",status:"fail",durationMs:Date.now()-e,summary:`analyze failed: ${s instanceof Error?s.message:String(s)}`}),o.push("analyze stage failed");}}let h=Date.now();try{let e=await a$4({startPath:i,writeReport:true,skipVerify:a$5.skipVerify===true});f$1=e.evidencePath;let s=e.overallStatus==="pass"?"pass":e.overallStatus==="warn"?"warn":"fail";t.push({name:"readiness",status:s,durationMs:Date.now()-h,summary:`readiness overall: ${e.overallStatus}`,evidencePath:e.evidencePath}),s==="fail"?o.push(...e.blockingReasons.map(n=>`readiness: ${n}`)):s==="warn"&&o.push(...e.gates.filter(n=>n.status==="warn").map(n=>`readiness warn: ${n.gate}: ${n.summary}`));}catch(e){l=true,t.push({name:"readiness",status:"fail",durationMs:Date.now()-h,summary:`readiness failed: ${e instanceof Error?e.message:String(e)}`}),o.push("readiness stage failed");}if(a$5.skipAutopilot)t.push({name:"autopilot",status:"skipped",durationMs:0,summary:"autopilot stage skipped"});else {let e=Date.now(),s=a$5.autopilotMode??"audit";try{let n=await c({workspacePath:i,mode:s,json:true,skipPipelineStages:true});m=n.artifacts.reportPath;let P=n.summary.verdict==="approved"?"pass":n.summary.verdict==="partial"?"warn":"fail";t.push({name:"autopilot",status:P,durationMs:Date.now()-e,summary:`autopilot ${s}: ${n.summary.verdict}`,exitCode:n.summary.exitCode,evidencePath:m}),P!=="pass"&&o.push(...n.blockingReasons.slice(0,5));}catch(n){l=true,t.push({name:"autopilot",status:"fail",durationMs:Date.now()-e,summary:`autopilot failed: ${n instanceof Error?n.message:String(n)}`}),o.push("autopilot release stage failed");}}let M=I(t),k=j(t,l),F=p.join(i,".workspai","reports","pipeline-last-run.json"),u={schemaVersion:"rapidkit-pipeline-v1",generatedAt:new Date().toISOString(),workspacePath:i,summary:{verdict:M,exitCode:k,stagesPassed:t.filter(e=>e.status==="pass").length,stagesWarn:t.filter(e=>e.status==="warn").length,stagesFailed:t.filter(e=>e.status==="fail").length},stages:t,blockingReasons:[...new Set(o)],artifacts:{reportPath:F,analyzeEvidencePath:d$1,readinessEvidencePath:f$1,autopilotEvidencePath:m}};if(a$5.writeReport!==false){let e$2=f(u,{commandId:"workspacePipeline",exitCode:k,generatedAt:u.generatedAt,blockers:u.blockingReasons,runId:e()});await e$1(i,".workspai/reports/pipeline-last-run.json",e$2);}if(a$5.writeReport!==false&&a$5.noAgentSync!==true&&process.env.RAPIDKIT_NO_AGENT_SYNC!=="1"&&a$5.agentSync!==false)try{let{syncWorkspaceAgentGrounding:e}=await import('./workspace-agent-sync-RZBQXCNJ.js'),s=await e({workspacePath:i,write:true,refreshContext:true,strict:false});u.agentGrounding={indexPath:s.indexPath,writtenFiles:s.writtenFiles,blockers:s.blockers};}catch{}return u}async function ae(a){let r;try{r=await V(a);}catch(t){let o=t instanceof Error?t.message:String(t);a.json?console.log(JSON.stringify(c$1({operation:"pipeline",code:"pipeline.failed",message:o}),null,2)):console.log(c$2.red(`Pipeline failed: ${o}`)),process.exit(1);}if(a.json)console.log(JSON.stringify(r,null,2));else {console.log(c$2.bold.cyan(`
+import {a as a$3}from'./chunk-HPWLSLMC.js';import {c}from'./chunk-AYHNNPPH.js';import {q}from'./chunk-23JDMHSD.js';import {c as c$1}from'./chunk-FPJNWPKU.js';import {a as a$4}from'./chunk-KHEJO3JU.js';import {f,e}from'./chunk-T3GJ7YVG.js';import {a}from'./chunk-2OIBHUVH.js';import {g}from'./chunk-MZFSINY7.js';import {d,a as a$2,e as e$1}from'./chunk-MBRU3VWJ.js';import {a as a$1}from'./chunk-62K2H72S.js';import c$2 from'chalk';import p from'path';function G(a){return a===0?"pass":a===2?"warn":"fail"}function I(a){return a.some(r=>r.status==="fail")?"blocked":a.some(r=>r.status==="warn")?"needs-attention":"ready"}function j(a,r){if(r)return 3;let i=a.some(o=>o.status==="fail"),t=a.some(o=>o.status==="warn");return i?1:t?2:0}function N(a,r){return a===2&&!r?0:a}async function O(a){let r=await g(a,true),i=false;try{let{syncWorkspaceContract:t}=await import('./workspace-contract-AZFISDLS.js');await t({workspacePath:a}),i=true;}catch{i=false;}return {sync:r,contractSynced:i}}async function V(a$5={}){let r=p.resolve(a$5.workspacePath??process.cwd()),i=a(r);if(!i)throw new Error("No Workspai workspace found in current directory or parents");let t=[],o=[],l=false,d$1,f$1,m,y=Date.now();try{let{sync:e,contractSynced:s}=await O(i),n=e.workspaceFound&&(e.added.length>0||e.skipped>=0)||e.workspaceFound?"pass":"warn";t.push({name:"sync",status:n,durationMs:Date.now()-y,summary:e.workspaceFound?`registry sync complete (${e.added.length} added, ${e.skipped} existing)${s?", contract synced":""}`:"workspace not registered in global registry; contract sync attempted"}),e.workspaceFound||o.push("workspace registry entry missing \u2014 run workspai create workspace or register manually");}catch(e){l=true,t.push({name:"sync",status:"fail",durationMs:Date.now()-y,summary:`sync failed: ${e instanceof Error?e.message:String(e)}`}),o.push("workspace sync stage failed");}let w=Date.now();try{let e=await q({workspace:true,json:true,quiet:true,strict:a$5.strict===true,ci:a$5.strict!==true}),s=G(e),n=await d(i,a$1.doctor)??a$2(i,a$1.doctor);t.push({name:"doctor",status:s,durationMs:Date.now()-w,summary:s==="pass"?"doctor workspace passed":s==="warn"?"doctor workspace reported warnings":"doctor workspace did not pass",exitCode:e,evidencePath:n}),s==="fail"?o.push("doctor workspace gate failed"):s==="warn"&&o.push("doctor workspace reported warnings");}catch(e){l=true,t.push({name:"doctor",status:"fail",durationMs:Date.now()-w,summary:`doctor failed: ${e instanceof Error?e.message:String(e)}`}),o.push("doctor workspace stage failed");}if(a$5.skipAnalyze)t.push({name:"analyze",status:"skipped",durationMs:0,summary:"analyze stage skipped"});else {let e=Date.now();try{let s=await a$3({workspacePath:i,json:true,strict:a$5.strict===true});d$1=p.isAbsolute(s.enterpriseControls.evidencePath)?s.enterpriseControls.evidencePath:p.join(i,s.enterpriseControls.evidencePath);let n=s.summary.verdict==="blocked"?"fail":s.summary.verdict==="needs-attention"?"warn":"pass";t.push({name:"analyze",status:n,durationMs:Date.now()-e,summary:`analyze verdict: ${s.summary.verdict} (score ${s.summary.score}/100)`,evidencePath:d$1}),n==="fail"?o.push("analyze reported blocked verdict"):n==="warn"&&o.push("analyze reported needs-attention verdict");}catch(s){l=true,t.push({name:"analyze",status:"fail",durationMs:Date.now()-e,summary:`analyze failed: ${s instanceof Error?s.message:String(s)}`}),o.push("analyze stage failed");}}let h=Date.now();try{let e=await a$4({startPath:i,writeReport:true,skipVerify:a$5.skipVerify===true});f$1=e.evidencePath;let s=e.overallStatus==="pass"?"pass":e.overallStatus==="warn"?"warn":"fail";t.push({name:"readiness",status:s,durationMs:Date.now()-h,summary:`readiness overall: ${e.overallStatus}`,evidencePath:e.evidencePath}),s==="fail"?o.push(...e.blockingReasons.map(n=>`readiness: ${n}`)):s==="warn"&&o.push(...e.gates.filter(n=>n.status==="warn").map(n=>`readiness warn: ${n.gate}: ${n.summary}`));}catch(e){l=true,t.push({name:"readiness",status:"fail",durationMs:Date.now()-h,summary:`readiness failed: ${e instanceof Error?e.message:String(e)}`}),o.push("readiness stage failed");}if(a$5.skipAutopilot)t.push({name:"autopilot",status:"skipped",durationMs:0,summary:"autopilot stage skipped"});else {let e=Date.now(),s=a$5.autopilotMode??"audit";try{let n=await c({workspacePath:i,mode:s,json:true,skipPipelineStages:true});m=n.artifacts.reportPath;let P=n.summary.verdict==="approved"?"pass":n.summary.verdict==="partial"?"warn":"fail";t.push({name:"autopilot",status:P,durationMs:Date.now()-e,summary:`autopilot ${s}: ${n.summary.verdict}`,exitCode:n.summary.exitCode,evidencePath:m}),P!=="pass"&&o.push(...n.blockingReasons.slice(0,5));}catch(n){l=true,t.push({name:"autopilot",status:"fail",durationMs:Date.now()-e,summary:`autopilot failed: ${n instanceof Error?n.message:String(n)}`}),o.push("autopilot release stage failed");}}let M=I(t),k=j(t,l),F=p.join(i,".workspai","reports","pipeline-last-run.json"),u={schemaVersion:"rapidkit-pipeline-v1",generatedAt:new Date().toISOString(),workspacePath:i,summary:{verdict:M,exitCode:k,stagesPassed:t.filter(e=>e.status==="pass").length,stagesWarn:t.filter(e=>e.status==="warn").length,stagesFailed:t.filter(e=>e.status==="fail").length},stages:t,blockingReasons:[...new Set(o)],artifacts:{reportPath:F,analyzeEvidencePath:d$1,readinessEvidencePath:f$1,autopilotEvidencePath:m}};if(a$5.writeReport!==false){let e$2=f(u,{commandId:"workspacePipeline",exitCode:k,generatedAt:u.generatedAt,blockers:u.blockingReasons,runId:e()});await e$1(i,".workspai/reports/pipeline-last-run.json",e$2);}if(a$5.writeReport!==false&&a$5.noAgentSync!==true&&process.env.RAPIDKIT_NO_AGENT_SYNC!=="1"&&a$5.agentSync!==false)try{let{syncWorkspaceAgentGrounding:e}=await import('./workspace-agent-sync-RZBQXCNJ.js'),s=await e({workspacePath:i,write:true,refreshContext:true,strict:false});u.agentGrounding={indexPath:s.indexPath,writtenFiles:s.writtenFiles,blockers:s.blockers};}catch{}return u}async function ae(a){let r;try{r=await V(a);}catch(t){let o=t instanceof Error?t.message:String(t);a.json?console.log(JSON.stringify(c$1({operation:"pipeline",code:"pipeline.failed",message:o}),null,2)):console.log(c$2.red(`Pipeline failed: ${o}`)),process.exit(1);}if(a.json)console.log(JSON.stringify(r,null,2));else {console.log(c$2.bold.cyan(`
 \u{1F517} Workspai Governance Pipeline
 `)),console.log(c$2.bold(`Workspace: ${c$2.cyan(p.basename(r.workspacePath))}`)),console.log(c$2.gray(`Path: ${r.workspacePath}`)),console.log(c$2.white(`Verdict: ${r.summary.verdict}  Exit: ${r.summary.exitCode}  (${r.summary.stagesPassed} pass / ${r.summary.stagesWarn} warn / ${r.summary.stagesFailed} fail)`));for(let t of r.stages){let o=t.status==="pass"?c$2.green("PASS"):t.status==="warn"?c$2.yellow("WARN"):t.status==="skipped"?c$2.gray("SKIP"):c$2.red("FAIL");console.log(` - ${t.name}: ${o} ${t.summary}`);}if(r.blockingReasons.length>0){console.log(c$2.bold(`
 Blocking reasons:`));for(let t of r.blockingReasons.slice(0,8))console.log(c$2.gray(`  \u2022 ${t}`));}console.log(c$2.gray(`

package/dist/{verified-goal-MJNZROS5.js → verified-goal-23HZPMRK.js}

@@ -1 +1 @@
-import {c}from'./chunk-7RLGOEWV.js';import {a as a$3}from'./chunk-F4KBYFZ5.js';import {c as c$1}from'./chunk-4D7DIGAB.js';import {a as a$2}from'./chunk-KHEJO3JU.js';import {p}from'./chunk-FUPHQOJB.js';import {a as a$4}from'./chunk-GR6442P7.js';import {e,d}from'./chunk-MBRU3VWJ.js';import {a as a$1}from'./chunk-AFIFZTOY.js';import {a,b}from'./chunk-62K2H72S.js';import {createHash}from'crypto';import l from'path';import y from'fs-extra';var W="workspai.verified-goal.v1",x=b.verifiedGoalStatus,C=a.verifiedGoalStatus,J="contracts/workspace-intelligence/verified-goal.v1.json",G="contracts/workspace-intelligence/verified-goal-status.v1.json";function A(e){return Array.isArray(e)?`[${e.map(A).join(",")}]`:e&&typeof e=="object"?`{${Object.entries(e).sort(([t],[a])=>t.localeCompare(a)).map(([t,a])=>`${JSON.stringify(t)}:${A(a)}`).join(",")}}`:JSON.stringify(e)}function H(e){return createHash("sha256").update(A(e)).digest("hex")}var te=["package.json","package-lock.json","npm-shrinkwrap.json","pnpm-lock.yaml","yarn.lock","bun.lock","bun.lockb","pyproject.toml","requirements.txt","Pipfile","Pipfile.lock","poetry.lock","uv.lock","go.mod","go.sum","Cargo.toml","Cargo.lock","pom.xml","build.gradle","build.gradle.kts","gradle.lockfile","packages.lock.json","Directory.Packages.props","composer.json","composer.lock","Gemfile","Gemfile.lock","mix.exs","mix.lock","deps.edn","project.clj","build.sbt"],ae=new Set(te.map(e=>e.toLowerCase())),se=new Set([".git",".hg",".svn",".workspai",".venv","venv",".tox",".mypy_cache",".pytest_cache","__pycache__","node_modules","vendor","pods","dist","build","out","target","bin","obj","coverage",".coverage",".next",".nuxt",".svelte-kit"]),F=1e5;function ne(e){return ae.has(e.toLowerCase())||/\.(?:csproj|fsproj|vbproj)$/i.test(e)}async function re(e){let t=[e],a=[],s=0;for(;t.length>0;){let o=t.shift();if(o===void 0)break;let i=await y.readdir(o,{withFileTypes:true});if(i.sort((n,r)=>n.name.localeCompare(r.name)),s+=i.length,s>F)throw new Error(`Dependency safety baseline exceeded ${F} filesystem entries under ${e}. Narrow the project boundary before creating this goal.`);for(let n of i){let r=l.join(o,n.name);if(n.isDirectory()){!se.has(n.name.toLowerCase())&&!a$4(n.name)&&t.push(r);continue}n.isFile()&&ne(n.name)&&a.push(r);}}return a}function ie(e){return /^(?:package\.json|package-lock\.json|npm-shrinkwrap\.json|pnpm-lock\.yaml|yarn\.lock|bun\.lockb?)$/i.test(e)?"node":/^(?:pyproject\.toml|requirements\.txt|Pipfile(?:\.lock)?|poetry\.lock|uv\.lock)$/i.test(e)?"python":/^go\.(?:mod|sum)$/i.test(e)?"go":/^Cargo\.(?:toml|lock)$/i.test(e)?"rust":/^(?:pom\.xml|build\.gradle(?:\.kts)?|gradle\.lockfile)$/i.test(e)?"jvm":/^(?:Directory\.Packages\.props|packages\.lock\.json)$/i.test(e)?"dotnet":/^composer\.(?:json|lock)$/i.test(e)?"php":/^Gemfile(?:\.lock)?$/i.test(e)?"ruby":/^mix\.(?:exs|lock)$/i.test(e)?"elixir":/^(?:deps\.edn|project\.clj)$/i.test(e)?"clojure":/^build\.sbt$/i.test(e)?"scala":/\.(?:csproj|fsproj|vbproj)$/i.test(e)?"dotnet":"unknown"}function K(e){try{let t=JSON.parse(e),a={};for(let s of ["dependencies","devDependencies","peerDependencies","optionalDependencies"]){let o=t[s];if(!(!o||typeof o!="object"||Array.isArray(o)))for(let[i,n]of Object.entries(o))typeof n=="string"&&(a[`${s}:${i}`]=n);}return a}catch{return}}async function U(e,t){let s=(await p({workspacePath:e,includeAbsolutePaths:true})).projects.filter(i=>t.kind==="workspace"||i.name===t.projectName||l.resolve(e,i.path)===l.resolve(t.projectPath??"")),o=new Map;for(let i of s){let n=l.resolve(e,i.path),r=await re(n);for(let c of r){let p=l.basename(c),f=await y.readFile(c,"utf8"),d=l.relative(e,c).split(l.sep).join("/");o.set(d,{path:d,ecosystem:ie(p),sha256:createHash("sha256").update(f).digest("hex"),...p==="package.json"?{dependencies:K(f)??{}}:{}});}}return {manifests:[...o.values()].sort((i,n)=>i.path.localeCompare(n.path))}}function O(e){let a=e.replace(/^(?:workspace:|npm:[^@]+@)/,"").match(/(?:^|[^\d])(\d+)(?:\.\d+)?(?:\.\d+)?/);return a?Number(a[1]):null}function S(e){return /(?:^|\/)(?:package-lock\.json|npm-shrinkwrap\.json|pnpm-lock\.yaml|yarn\.lock|bun\.lockb?|poetry\.lock|uv\.lock|Pipfile\.lock|go\.sum|Cargo\.lock|gradle\.lockfile|packages\.lock\.json|composer\.lock|Gemfile\.lock|mix\.lock)$/i.test(e)}async function oe(e){let t=e.dependencySafetyBaseline;if(!t)return k({id:"change-policy",label:"Change safety policy",status:"missing",expected:"dependency manifest safety baseline",actual:"baseline unavailable"});let a=[],s=await U(e.workspace.path,e.scope),o=new Map(s.manifests.map(r=>[r.path,r])),i=new Map(t.manifests.map(r=>[r.path,r])),n=new Set;for(let r of t.manifests){let c=o.get(r.path);(!c||c.sha256!==r.sha256)&&n.add(r.path);}for(let r of s.manifests)i.has(r.path)||n.add(r.path);for(let r of s.manifests)!i.has(r.path)&&!S(r.path)&&a.push(`${r.path} was added after the safety baseline`);for(let r of t.manifests){let c=o.get(r.path);if(!c){a.push(`${r.path} was removed`);continue}if(c.sha256===r.sha256)continue;if(r.dependencies){let d=await y.readFile(l.join(e.workspace.path,r.path),"utf8"),m=K(d);if(!m){a.push(`${r.path} is not valid dependency JSON`);continue}for(let[u,g]of Object.entries(r.dependencies)){let h=m[u];if(!h){a.push(`${u.replace(/^[^:]+:/,"")} was removed`);continue}if(h===g)continue;let $=O(g),R=O(h);($===null||R===null||$!==R||/(?:latest|\*)/i.test(h))&&a.push(`${u.replace(/^[^:]+:/,"")} changed outside its proven major range (${g} \u2192 ${h})`);}continue}if(S(r.path))continue;let p=l.posix.dirname(r.path);[...o.values()].some(d=>{let m=l.posix.dirname(d.path);return d.ecosystem===r.ecosystem&&(m===p||p.startsWith(`${m}/`))&&S(d.path)&&n.has(d.path)})||a.push(`${r.path} changed without a matching reconciled ${r.ecosystem} lockfile`);}return k({id:"change-policy",label:"Change safety policy",status:a.length===0?"passed":"blocked",expected:"no force, removal, unbounded, or major dependency changes",actual:a.length===0?"manifest changes are within proven bounds":a.join("; ")})}function E(e,t){if(!/^[a-z0-9][a-z0-9._-]{7,95}$/i.test(t))throw new Error(`Invalid verified goal id: ${t}`);let a=l.join(e,".workspai","goals",t);return {directory:a,goal:l.join(a,"goal.json"),status:l.join(a,"status.json"),latestReport:l.join(e,C)}}function ce(e){return {workspacePath:l.resolve(e.workspace.path),kind:e.kind,scope:e.scope,target:e.criteria.kind==="test-coverage"?e.criteria.minimumPercent:null,constraints:e.constraints}}async function V(e,t){await y.ensureDir(l.dirname(e));let a=`${e}.${process.pid}.${Date.now()}.tmp`;await y.writeJson(a,t,{spaces:2}),await y.rename(a,e);}async function le(e,t){let a=t?.trim();if(!a||a==="workspace")return {scope:{kind:"workspace"}};let s=a.startsWith("project:")?a.slice(8).trim():a;if(!s)throw new Error("Project goal scope must name a project.");let i=(await p({workspacePath:e,includeAbsolutePaths:true})).projects.filter(c=>{let p=l.resolve(e,c.path);return c.name===s||c.path===s||p===l.resolve(s)});if(i.length!==1)throw new Error(i.length===0?`Project goal scope was not found: ${s}`:`Project goal scope is ambiguous: ${s}`);let n=i[0],r=l.resolve(e,n.path);return {project:n,scope:{kind:"project",projectName:n.name,projectPath:r}}}function z(e,t,a){return e===null?"unavailable":a==="minimum"?e>=t?"satisfied":"unsatisfied":e<=t?"satisfied":"unsatisfied"}async function Y(e){if(!e)return null;try{let t=await y.readJson(e);return t&&typeof t=="object"&&!Array.isArray(t)?t:null}catch{return null}}function de(e){return Array.isArray(e.projects)?e.projects.filter(t=>!!t&&typeof t=="object"&&!Array.isArray(t)):e.project&&typeof e.project=="object"&&!Array.isArray(e.project)?[e.project]:[]}function ue(e){let t=e.dependencyAudit;return t&&typeof t=="object"&&!Array.isArray(t)?t:null}async function X(e,t){let a$1=await d(e,a.doctor),s=await Y(a$1);if(!s)return {measuredAt:new Date().toISOString(),value:null,target:0,unit:"blocking-vulnerabilities",status:"unavailable",evidencePaths:[],message:"Fresh Doctor dependency evidence is not available."};let o=de(s).filter(c=>{if(t.kind==="workspace")return  true;let p=typeof c.name=="string"?c.name:typeof c.projectName=="string"?c.projectName:"",f=typeof c.path=="string"?l.resolve(c.path):typeof c.projectPath=="string"?l.resolve(c.projectPath):"";return p===t.projectName||t.projectPath!==void 0&&f===l.resolve(t.projectPath)}),i=o.map(ue).filter(c=>c!==null),n=i.map(c=>c.blockingFindingCount).filter(c=>Number.isInteger(c)&&Number(c)>=0),r=o.length>0&&n.length===o.length?n.reduce((c,p)=>c+p,0):null;return {measuredAt:(()=>{let c=i.map(p=>p.generatedAt).filter(p=>typeof p=="string").sort();return c[c.length-1]??new Date().toISOString()})(),value:r,target:0,unit:"blocking-vulnerabilities",status:z(r,0,"maximum"),evidencePaths:a$1?[a$1]:[],message:r===null?"Doctor did not publish complete dependency audit counts for the selected scope.":`${r} blocking dependency vulnerability finding(s) remain.`}}async function Q(e){let t=await a$2({startPath:e,writeReport:false}),a=t.gates.filter(o=>o.status==="pass").length,s=t.gates.length;return {measuredAt:t.generatedAt,value:a,target:s,unit:"gates",status:t.overallStatus==="pass"?"satisfied":"unsatisfied",evidencePaths:[...new Set(t.gates.map(o=>o.evidencePath).filter(o=>typeof o=="string"))],message:t.overallStatus==="pass"?"All release readiness gates pass.":`${s-a} release readiness gate(s) still require work.`}}async function B(e){let t=await c$1({projectPath:e.projectPath,target:e.target,run:e.run}),s=t.metrics[t.target.metric]?.percent??null;return {executionStatus:t.status,measurement:{measuredAt:t.generatedAt,value:s,target:e.target,unit:"percent",status:z(s,e.target,"minimum"),evidencePaths:[t.artifactPaths.project],message:t.status==="failed"?"The runtime-native coverage test command failed.":s===null?"Machine-readable coverage evidence is unavailable.":`${t.target.metric} coverage is ${s}% (target ${e.target}%).`}}}async function Z(e){if(e.scope.kind==="project"){if(!e.scope.projectPath)throw new Error("Coverage goal project scope does not have a project path.");return B({projectPath:e.scope.projectPath,target:e.target,run:e.run})}let t=await p({workspacePath:e.workspacePath,includeAbsolutePaths:true});if(t.projects.length===0)return {executionStatus:"unavailable",measurement:{measuredAt:new Date().toISOString(),value:null,target:e.target,unit:"percent",status:"unavailable",evidencePaths:[],message:"The workspace does not contain a registered project to measure."}};let a=[];for(let d of t.projects)a.push({projectName:d.name,result:await B({projectPath:l.resolve(e.workspacePath,d.path),target:e.target,run:e.run})});let s=a.filter(d=>d.result.executionStatus==="failed"),o=a.filter(d=>d.result.measurement.status==="unavailable"),i=a.filter(d=>d.result.measurement.status==="unsatisfied"),n=a.map(d=>d.result.measurement.value).filter(d=>d!==null),r=n.length===a.length&&n.length>0?Math.min(...n):null,c=s.length>0?"failed":o.length>0?"unavailable":i.length>0?"below-target":"passed",p$1=a.map(d=>d.result.measurement.measuredAt).sort(),f=[...s.map(d=>`${d.projectName}: coverage command failed`),...o.map(d=>`${d.projectName}: coverage unavailable`),...i.map(d=>`${d.projectName}: ${d.result.measurement.value??"unknown"}%`)];return {executionStatus:c,measurement:{measuredAt:p$1[p$1.length-1]??new Date().toISOString(),value:r,target:e.target,unit:"percent",status:c==="passed"?"satisfied":c==="below-target"?"unsatisfied":"unavailable",evidencePaths:[...new Set(a.flatMap(d=>d.result.measurement.evidencePaths))],message:c==="passed"?`Every registered project has at least ${e.target}% test coverage.`:`Workspace coverage is not verified: ${f.join("; ")}.`}}}function pe(e){let t=e.scope.kind==="project"?`project ${e.scope.projectName??"selected project"}`:"workspace";return e.kind==="release-readiness"?`Prepare the ${t} for release.`:e.kind==="dependency-security"?`Resolve blocking dependency vulnerabilities in the ${t} without unsafe changes.`:`Raise ${t} test coverage to ${e.target??80}% without breaking its build.`}function ge(e,t){return e==="release-readiness"?{kind:e,readiness:"pass",workspaceVerify:"ready"}:e==="dependency-security"?{kind:e,maximumBlockingVulnerabilities:0,requireFreshAudit:true}:{kind:e,metric:"auto",minimumPercent:t}}async function fe(e){return e.kind==="release-readiness"?Q(e.workspacePath):e.kind==="dependency-security"?X(e.workspacePath,e.scope):(await Z({workspacePath:e.workspacePath,scope:e.scope,target:e.target,run:false})).measurement}async function Ge(e$1){let t=l.resolve(e$1.workspacePath),a=Math.max(0,Math.min(100,Math.round(e$1.target??80))),{scope:s}=await le(t,e$1.scope),o={workspacePath:l.resolve(t),kind:e$1.kind,scope:s,target:e$1.kind==="test-coverage"?a:null,constraints:{allowBreakingChanges:e$1.allowBreakingChanges===true,allowForce:e$1.allowForce===true,requireBuild:e$1.requireBuild!==false,requireTests:e$1.requireTests!==false}},i=H(o),n=`goal-${e$1.kind}-${i.slice(0,16)}`,r=E(t,n);if(await y.pathExists(r.goal)){let{goal:m,status:u}=await ee(t,n);if(m.fingerprint===i)return {goal:m,status:u,resumed:u.state!=="verified"}}let c=new Date().toISOString(),p=await fe({workspacePath:t,kind:e$1.kind,scope:s,target:a}),f={schemaVersion:W,id:n,fingerprint:i,createdAt:c,updatedAt:c,workspace:{name:l.basename(t),path:t},scope:s,kind:e$1.kind,summary:pe({kind:e$1.kind,scope:s,target:a}),constraints:o.constraints,criteria:ge(e$1.kind,a),baseline:p,...e$1.kind==="dependency-security"?{dependencySafetyBaseline:await U(t,s)}:{},artifactPaths:{goal:r.goal,status:r.status,latestReport:r.latestReport}},d={schemaVersion:x,goalId:n,goalFingerprint:i,workspacePath:t,updatedAt:c,state:"planned",attempt:0,progress:p,checks:[],blockingReasons:[],evidencePaths:p.evidencePaths,nextActions:e$1.kind==="test-coverage"?["Add focused tests for the lowest-coverage source paths.","Run verified goal checks."]:e$1.kind==="dependency-security"?["Inspect the fresh project dependency audit.","Apply only compatible non-force dependency repairs.","Reconcile the lockfile, test, build, and verify again."]:["Inspect the current remediation plan and failing release gates.","Repair the next causal blocker, then verify again."],artifactPath:r.status};return a$1(f,J,"Verified goal"),a$1(d,G,"Verified goal status"),await V(r.goal,f),await V(r.status,d),await e(t,C,d),{goal:f,status:d,resumed:false}}async function ee(e,t){let a=E(l.resolve(e),t),s=await y.readJson(a.goal),o=await y.readJson(a.status);a$1(s,J,"Verified goal"),a$1(o,G,"Verified goal status");let i=l.resolve(e),n=l.resolve(s.artifactPaths.goal)===l.resolve(a.goal)&&l.resolve(s.artifactPaths.status)===l.resolve(a.status)&&l.resolve(s.artifactPaths.latestReport)===l.resolve(a.latestReport);if(s.schemaVersion!==W||o.schemaVersion!==x||s.id!==o.goalId||s.fingerprint!==o.goalFingerprint||s.fingerprint!==H(ce(s))||l.resolve(s.workspace.path)!==i||l.resolve(o.workspacePath)!==i||!n)throw new Error(`Verified goal artifacts are inconsistent: ${t}`);return {goal:s,status:o}}function k(e){return {...e,message:e.message??`${e.label}: ${e.actual}; expected ${e.expected}.`}}async function q(e){let t=[],a=e.goal.scope.kind==="project"&&e.goal.scope.projectName?`project:${e.goal.scope.projectName}`:void 0;for(let s of ["test","build"]){if(s==="test"&&e.includeTests===false)continue;if(!(s==="test"?e.goal.constraints.requireTests:e.goal.constraints.requireBuild)){t.push(k({id:s,label:`${s} validation`,status:"skipped",expected:"not required",actual:"skipped by goal contract"}));continue}if(!e.run){t.push(k({id:s,label:`${s} validation`,status:"missing",expected:"fresh passed evidence",actual:"execution disabled"}));continue}let i=await a$3({workspacePath:e.goal.workspace.path,stage:s,scope:a,parallel:false,continueOnError:false,strict:true,json:true,enforceGates:false});if(t.push(k({id:s,label:`${s} validation`,status:i.summary.exitCode===0?"passed":"failed",expected:"exit 0",actual:`exit ${i.summary.exitCode}`,evidencePath:l.join(e.goal.workspace.path,".workspai","reports","workspace-run-last.json")})),i.summary.exitCode!==0)break}return t}async function Ee(e$1){let t=l.resolve(e$1.workspacePath),{goal:a$2,status:s}=await ee(t,e$1.goalId),o=e$1.run!==false,i=[],n;if(o&&e$1.runIntelligence!==false){let u=await c({workspacePath:t,strict:true,agent:"generic"}),g=u.exitCode===0||u.exitCode===2,h=a$2.kind==="release-readiness";i.push(k({id:"workspace-intelligence-chain",label:"Workspace Intelligence chain",status:u.exitCode===0||u.exitCode===2&&!h?"passed":u.exitCode===2?"blocked":"failed",expected:"passed",actual:u.exitCode===2&&g&&!h?`${u.status}; canonical evidence refreshed for goal-scoped verification`:u.status,evidencePath:l.join(t,a.intelligenceRun)}));}if(a$2.kind==="release-readiness"){n=await Q(t),i.push(k({id:"release-readiness",label:"Release readiness",status:n.status==="satisfied"?"passed":"blocked",expected:"all gates pass",actual:n.message,evidencePath:l.join(t,a.readiness)}));let u=await d(t,a.verify),g=await Y(u),h=g?.summary&&typeof g.summary=="object"&&!Array.isArray(g.summary)?String(g.summary.verdict??"missing"):"missing";i.push(k({id:"workspace-verify",label:"Workspace verification",status:h==="ready"?"passed":h==="missing"?"missing":"blocked",expected:"ready",actual:h,evidencePath:l.join(t,a.verify)}));}else if(a$2.kind==="dependency-security")n=await X(t,a$2.scope),i.push(k({id:"dependency-audit",label:"Dependency security audit",status:n.status==="satisfied"?"passed":n.status==="unavailable"?"missing":"blocked",expected:"0 blocking vulnerabilities",actual:n.message,evidencePath:n.evidencePaths[0]})),i.push(a$2.constraints.allowBreakingChanges||a$2.constraints.allowForce?k({id:"change-policy",label:"Change safety policy",status:"blocked",expected:"breaking and force changes disabled",actual:`allowBreakingChanges=${a$2.constraints.allowBreakingChanges}, allowForce=${a$2.constraints.allowForce}`}):await oe(a$2)),n.status==="satisfied"&&i.push(...await q({goal:a$2,run:o}));else {let u=a$2.criteria.kind==="test-coverage"?a$2.criteria.minimumPercent:a$2.baseline.target;if(u===null)throw new Error("Coverage goal does not have a valid target.");let g=await Z({workspacePath:t,scope:a$2.scope,target:u,run:o});n=g.measurement,i.push(k({id:"coverage",label:"Test coverage",status:n.status==="satisfied"?"passed":n.status==="unavailable"?"missing":"blocked",expected:`at least ${u}%`,actual:n.message,evidencePath:n.evidencePaths[0]})),i.push(k({id:"test",label:"Coverage test execution",status:g.executionStatus==="failed"?"failed":g.executionStatus==="unavailable"?"missing":"passed",expected:"runtime-native coverage test command completed",actual:g.executionStatus==="failed"?"coverage test command failed":g.executionStatus==="unavailable"?"coverage execution evidence unavailable":"coverage evidence produced by the test runner",evidencePath:n.evidencePaths[0]})),n.status==="satisfied"&&i.push(...await q({goal:a$2,run:o,includeTests:false}));}let r=i.filter(u=>u.status==="blocked"||u.status==="failed"||u.status==="missing").map(u=>u.message),c$1=[...new Set([...n.evidencePaths,...i.map(u=>u.evidencePath).filter(u=>typeof u=="string")])],p=n.status==="satisfied"&&i.every(u=>u.status==="passed"||u.status==="skipped"),f=E(t,a$2.id),d$1=p?[]:a$2.kind==="test-coverage"?["Inspect low-coverage files from the coverage artifact.","Add focused tests and verify again."]:a$2.kind==="dependency-security"?["Use fresh audit candidates and compatible package-manager repairs.","Reconcile lockfiles before running verified goal checks again."]:["Repair the first blocking readiness gate and verify the goal again."],m={schemaVersion:x,goalId:a$2.id,goalFingerprint:a$2.fingerprint,workspacePath:t,updatedAt:new Date().toISOString(),state:p?"verified":i.some(u=>u.status==="failed")?"failed":"blocked",attempt:s.attempt+1,progress:n,checks:i,blockingReasons:r,evidencePaths:c$1,nextActions:d$1,artifactPath:f.status};return a$1(m,G,"Verified goal status"),await V(f.status,m),await e(t,C,m),m}export{C as VERIFIED_GOAL_LAST_RUN_REPORT_PATH,W as VERIFIED_GOAL_SCHEMA_VERSION,x as VERIFIED_GOAL_STATUS_SCHEMA_VERSION,Ge as planVerifiedGoal,ee as readVerifiedGoal,Ee as verifyVerifiedGoal};
+import {c}from'./chunk-JIUWK4ML.js';import {a as a$3}from'./chunk-SQTV2OYU.js';import {c as c$1}from'./chunk-4D7DIGAB.js';import {a as a$2}from'./chunk-KHEJO3JU.js';import {p}from'./chunk-FUPHQOJB.js';import {a as a$4}from'./chunk-GR6442P7.js';import {e,d}from'./chunk-MBRU3VWJ.js';import {a as a$1}from'./chunk-AFIFZTOY.js';import {a,b}from'./chunk-62K2H72S.js';import {createHash}from'crypto';import l from'path';import y from'fs-extra';var W="workspai.verified-goal.v1",x=b.verifiedGoalStatus,C=a.verifiedGoalStatus,J="contracts/workspace-intelligence/verified-goal.v1.json",G="contracts/workspace-intelligence/verified-goal-status.v1.json";function A(e){return Array.isArray(e)?`[${e.map(A).join(",")}]`:e&&typeof e=="object"?`{${Object.entries(e).sort(([t],[a])=>t.localeCompare(a)).map(([t,a])=>`${JSON.stringify(t)}:${A(a)}`).join(",")}}`:JSON.stringify(e)}function H(e){return createHash("sha256").update(A(e)).digest("hex")}var te=["package.json","package-lock.json","npm-shrinkwrap.json","pnpm-lock.yaml","yarn.lock","bun.lock","bun.lockb","pyproject.toml","requirements.txt","Pipfile","Pipfile.lock","poetry.lock","uv.lock","go.mod","go.sum","Cargo.toml","Cargo.lock","pom.xml","build.gradle","build.gradle.kts","gradle.lockfile","packages.lock.json","Directory.Packages.props","composer.json","composer.lock","Gemfile","Gemfile.lock","mix.exs","mix.lock","deps.edn","project.clj","build.sbt"],ae=new Set(te.map(e=>e.toLowerCase())),se=new Set([".git",".hg",".svn",".workspai",".venv","venv",".tox",".mypy_cache",".pytest_cache","__pycache__","node_modules","vendor","pods","dist","build","out","target","bin","obj","coverage",".coverage",".next",".nuxt",".svelte-kit"]),F=1e5;function ne(e){return ae.has(e.toLowerCase())||/\.(?:csproj|fsproj|vbproj)$/i.test(e)}async function re(e){let t=[e],a=[],s=0;for(;t.length>0;){let o=t.shift();if(o===void 0)break;let i=await y.readdir(o,{withFileTypes:true});if(i.sort((n,r)=>n.name.localeCompare(r.name)),s+=i.length,s>F)throw new Error(`Dependency safety baseline exceeded ${F} filesystem entries under ${e}. Narrow the project boundary before creating this goal.`);for(let n of i){let r=l.join(o,n.name);if(n.isDirectory()){!se.has(n.name.toLowerCase())&&!a$4(n.name)&&t.push(r);continue}n.isFile()&&ne(n.name)&&a.push(r);}}return a}function ie(e){return /^(?:package\.json|package-lock\.json|npm-shrinkwrap\.json|pnpm-lock\.yaml|yarn\.lock|bun\.lockb?)$/i.test(e)?"node":/^(?:pyproject\.toml|requirements\.txt|Pipfile(?:\.lock)?|poetry\.lock|uv\.lock)$/i.test(e)?"python":/^go\.(?:mod|sum)$/i.test(e)?"go":/^Cargo\.(?:toml|lock)$/i.test(e)?"rust":/^(?:pom\.xml|build\.gradle(?:\.kts)?|gradle\.lockfile)$/i.test(e)?"jvm":/^(?:Directory\.Packages\.props|packages\.lock\.json)$/i.test(e)?"dotnet":/^composer\.(?:json|lock)$/i.test(e)?"php":/^Gemfile(?:\.lock)?$/i.test(e)?"ruby":/^mix\.(?:exs|lock)$/i.test(e)?"elixir":/^(?:deps\.edn|project\.clj)$/i.test(e)?"clojure":/^build\.sbt$/i.test(e)?"scala":/\.(?:csproj|fsproj|vbproj)$/i.test(e)?"dotnet":"unknown"}function K(e){try{let t=JSON.parse(e),a={};for(let s of ["dependencies","devDependencies","peerDependencies","optionalDependencies"]){let o=t[s];if(!(!o||typeof o!="object"||Array.isArray(o)))for(let[i,n]of Object.entries(o))typeof n=="string"&&(a[`${s}:${i}`]=n);}return a}catch{return}}async function U(e,t){let s=(await p({workspacePath:e,includeAbsolutePaths:true})).projects.filter(i=>t.kind==="workspace"||i.name===t.projectName||l.resolve(e,i.path)===l.resolve(t.projectPath??"")),o=new Map;for(let i of s){let n=l.resolve(e,i.path),r=await re(n);for(let c of r){let p=l.basename(c),f=await y.readFile(c,"utf8"),d=l.relative(e,c).split(l.sep).join("/");o.set(d,{path:d,ecosystem:ie(p),sha256:createHash("sha256").update(f).digest("hex"),...p==="package.json"?{dependencies:K(f)??{}}:{}});}}return {manifests:[...o.values()].sort((i,n)=>i.path.localeCompare(n.path))}}function O(e){let a=e.replace(/^(?:workspace:|npm:[^@]+@)/,"").match(/(?:^|[^\d])(\d+)(?:\.\d+)?(?:\.\d+)?/);return a?Number(a[1]):null}function S(e){return /(?:^|\/)(?:package-lock\.json|npm-shrinkwrap\.json|pnpm-lock\.yaml|yarn\.lock|bun\.lockb?|poetry\.lock|uv\.lock|Pipfile\.lock|go\.sum|Cargo\.lock|gradle\.lockfile|packages\.lock\.json|composer\.lock|Gemfile\.lock|mix\.lock)$/i.test(e)}async function oe(e){let t=e.dependencySafetyBaseline;if(!t)return k({id:"change-policy",label:"Change safety policy",status:"missing",expected:"dependency manifest safety baseline",actual:"baseline unavailable"});let a=[],s=await U(e.workspace.path,e.scope),o=new Map(s.manifests.map(r=>[r.path,r])),i=new Map(t.manifests.map(r=>[r.path,r])),n=new Set;for(let r of t.manifests){let c=o.get(r.path);(!c||c.sha256!==r.sha256)&&n.add(r.path);}for(let r of s.manifests)i.has(r.path)||n.add(r.path);for(let r of s.manifests)!i.has(r.path)&&!S(r.path)&&a.push(`${r.path} was added after the safety baseline`);for(let r of t.manifests){let c=o.get(r.path);if(!c){a.push(`${r.path} was removed`);continue}if(c.sha256===r.sha256)continue;if(r.dependencies){let d=await y.readFile(l.join(e.workspace.path,r.path),"utf8"),m=K(d);if(!m){a.push(`${r.path} is not valid dependency JSON`);continue}for(let[u,g]of Object.entries(r.dependencies)){let h=m[u];if(!h){a.push(`${u.replace(/^[^:]+:/,"")} was removed`);continue}if(h===g)continue;let $=O(g),R=O(h);($===null||R===null||$!==R||/(?:latest|\*)/i.test(h))&&a.push(`${u.replace(/^[^:]+:/,"")} changed outside its proven major range (${g} \u2192 ${h})`);}continue}if(S(r.path))continue;let p=l.posix.dirname(r.path);[...o.values()].some(d=>{let m=l.posix.dirname(d.path);return d.ecosystem===r.ecosystem&&(m===p||p.startsWith(`${m}/`))&&S(d.path)&&n.has(d.path)})||a.push(`${r.path} changed without a matching reconciled ${r.ecosystem} lockfile`);}return k({id:"change-policy",label:"Change safety policy",status:a.length===0?"passed":"blocked",expected:"no force, removal, unbounded, or major dependency changes",actual:a.length===0?"manifest changes are within proven bounds":a.join("; ")})}function E(e,t){if(!/^[a-z0-9][a-z0-9._-]{7,95}$/i.test(t))throw new Error(`Invalid verified goal id: ${t}`);let a=l.join(e,".workspai","goals",t);return {directory:a,goal:l.join(a,"goal.json"),status:l.join(a,"status.json"),latestReport:l.join(e,C)}}function ce(e){return {workspacePath:l.resolve(e.workspace.path),kind:e.kind,scope:e.scope,target:e.criteria.kind==="test-coverage"?e.criteria.minimumPercent:null,constraints:e.constraints}}async function V(e,t){await y.ensureDir(l.dirname(e));let a=`${e}.${process.pid}.${Date.now()}.tmp`;await y.writeJson(a,t,{spaces:2}),await y.rename(a,e);}async function le(e,t){let a=t?.trim();if(!a||a==="workspace")return {scope:{kind:"workspace"}};let s=a.startsWith("project:")?a.slice(8).trim():a;if(!s)throw new Error("Project goal scope must name a project.");let i=(await p({workspacePath:e,includeAbsolutePaths:true})).projects.filter(c=>{let p=l.resolve(e,c.path);return c.name===s||c.path===s||p===l.resolve(s)});if(i.length!==1)throw new Error(i.length===0?`Project goal scope was not found: ${s}`:`Project goal scope is ambiguous: ${s}`);let n=i[0],r=l.resolve(e,n.path);return {project:n,scope:{kind:"project",projectName:n.name,projectPath:r}}}function z(e,t,a){return e===null?"unavailable":a==="minimum"?e>=t?"satisfied":"unsatisfied":e<=t?"satisfied":"unsatisfied"}async function Y(e){if(!e)return null;try{let t=await y.readJson(e);return t&&typeof t=="object"&&!Array.isArray(t)?t:null}catch{return null}}function de(e){return Array.isArray(e.projects)?e.projects.filter(t=>!!t&&typeof t=="object"&&!Array.isArray(t)):e.project&&typeof e.project=="object"&&!Array.isArray(e.project)?[e.project]:[]}function ue(e){let t=e.dependencyAudit;return t&&typeof t=="object"&&!Array.isArray(t)?t:null}async function X(e,t){let a$1=await d(e,a.doctor),s=await Y(a$1);if(!s)return {measuredAt:new Date().toISOString(),value:null,target:0,unit:"blocking-vulnerabilities",status:"unavailable",evidencePaths:[],message:"Fresh Doctor dependency evidence is not available."};let o=de(s).filter(c=>{if(t.kind==="workspace")return  true;let p=typeof c.name=="string"?c.name:typeof c.projectName=="string"?c.projectName:"",f=typeof c.path=="string"?l.resolve(c.path):typeof c.projectPath=="string"?l.resolve(c.projectPath):"";return p===t.projectName||t.projectPath!==void 0&&f===l.resolve(t.projectPath)}),i=o.map(ue).filter(c=>c!==null),n=i.map(c=>c.blockingFindingCount).filter(c=>Number.isInteger(c)&&Number(c)>=0),r=o.length>0&&n.length===o.length?n.reduce((c,p)=>c+p,0):null;return {measuredAt:(()=>{let c=i.map(p=>p.generatedAt).filter(p=>typeof p=="string").sort();return c[c.length-1]??new Date().toISOString()})(),value:r,target:0,unit:"blocking-vulnerabilities",status:z(r,0,"maximum"),evidencePaths:a$1?[a$1]:[],message:r===null?"Doctor did not publish complete dependency audit counts for the selected scope.":`${r} blocking dependency vulnerability finding(s) remain.`}}async function Q(e){let t=await a$2({startPath:e,writeReport:false}),a=t.gates.filter(o=>o.status==="pass").length,s=t.gates.length;return {measuredAt:t.generatedAt,value:a,target:s,unit:"gates",status:t.overallStatus==="pass"?"satisfied":"unsatisfied",evidencePaths:[...new Set(t.gates.map(o=>o.evidencePath).filter(o=>typeof o=="string"))],message:t.overallStatus==="pass"?"All release readiness gates pass.":`${s-a} release readiness gate(s) still require work.`}}async function B(e){let t=await c$1({projectPath:e.projectPath,target:e.target,run:e.run}),s=t.metrics[t.target.metric]?.percent??null;return {executionStatus:t.status,measurement:{measuredAt:t.generatedAt,value:s,target:e.target,unit:"percent",status:z(s,e.target,"minimum"),evidencePaths:[t.artifactPaths.project],message:t.status==="failed"?"The runtime-native coverage test command failed.":s===null?"Machine-readable coverage evidence is unavailable.":`${t.target.metric} coverage is ${s}% (target ${e.target}%).`}}}async function Z(e){if(e.scope.kind==="project"){if(!e.scope.projectPath)throw new Error("Coverage goal project scope does not have a project path.");return B({projectPath:e.scope.projectPath,target:e.target,run:e.run})}let t=await p({workspacePath:e.workspacePath,includeAbsolutePaths:true});if(t.projects.length===0)return {executionStatus:"unavailable",measurement:{measuredAt:new Date().toISOString(),value:null,target:e.target,unit:"percent",status:"unavailable",evidencePaths:[],message:"The workspace does not contain a registered project to measure."}};let a=[];for(let d of t.projects)a.push({projectName:d.name,result:await B({projectPath:l.resolve(e.workspacePath,d.path),target:e.target,run:e.run})});let s=a.filter(d=>d.result.executionStatus==="failed"),o=a.filter(d=>d.result.measurement.status==="unavailable"),i=a.filter(d=>d.result.measurement.status==="unsatisfied"),n=a.map(d=>d.result.measurement.value).filter(d=>d!==null),r=n.length===a.length&&n.length>0?Math.min(...n):null,c=s.length>0?"failed":o.length>0?"unavailable":i.length>0?"below-target":"passed",p$1=a.map(d=>d.result.measurement.measuredAt).sort(),f=[...s.map(d=>`${d.projectName}: coverage command failed`),...o.map(d=>`${d.projectName}: coverage unavailable`),...i.map(d=>`${d.projectName}: ${d.result.measurement.value??"unknown"}%`)];return {executionStatus:c,measurement:{measuredAt:p$1[p$1.length-1]??new Date().toISOString(),value:r,target:e.target,unit:"percent",status:c==="passed"?"satisfied":c==="below-target"?"unsatisfied":"unavailable",evidencePaths:[...new Set(a.flatMap(d=>d.result.measurement.evidencePaths))],message:c==="passed"?`Every registered project has at least ${e.target}% test coverage.`:`Workspace coverage is not verified: ${f.join("; ")}.`}}}function pe(e){let t=e.scope.kind==="project"?`project ${e.scope.projectName??"selected project"}`:"workspace";return e.kind==="release-readiness"?`Prepare the ${t} for release.`:e.kind==="dependency-security"?`Resolve blocking dependency vulnerabilities in the ${t} without unsafe changes.`:`Raise ${t} test coverage to ${e.target??80}% without breaking its build.`}function ge(e,t){return e==="release-readiness"?{kind:e,readiness:"pass",workspaceVerify:"ready"}:e==="dependency-security"?{kind:e,maximumBlockingVulnerabilities:0,requireFreshAudit:true}:{kind:e,metric:"auto",minimumPercent:t}}async function fe(e){return e.kind==="release-readiness"?Q(e.workspacePath):e.kind==="dependency-security"?X(e.workspacePath,e.scope):(await Z({workspacePath:e.workspacePath,scope:e.scope,target:e.target,run:false})).measurement}async function Ge(e$1){let t=l.resolve(e$1.workspacePath),a=Math.max(0,Math.min(100,Math.round(e$1.target??80))),{scope:s}=await le(t,e$1.scope),o={workspacePath:l.resolve(t),kind:e$1.kind,scope:s,target:e$1.kind==="test-coverage"?a:null,constraints:{allowBreakingChanges:e$1.allowBreakingChanges===true,allowForce:e$1.allowForce===true,requireBuild:e$1.requireBuild!==false,requireTests:e$1.requireTests!==false}},i=H(o),n=`goal-${e$1.kind}-${i.slice(0,16)}`,r=E(t,n);if(await y.pathExists(r.goal)){let{goal:m,status:u}=await ee(t,n);if(m.fingerprint===i)return {goal:m,status:u,resumed:u.state!=="verified"}}let c=new Date().toISOString(),p=await fe({workspacePath:t,kind:e$1.kind,scope:s,target:a}),f={schemaVersion:W,id:n,fingerprint:i,createdAt:c,updatedAt:c,workspace:{name:l.basename(t),path:t},scope:s,kind:e$1.kind,summary:pe({kind:e$1.kind,scope:s,target:a}),constraints:o.constraints,criteria:ge(e$1.kind,a),baseline:p,...e$1.kind==="dependency-security"?{dependencySafetyBaseline:await U(t,s)}:{},artifactPaths:{goal:r.goal,status:r.status,latestReport:r.latestReport}},d={schemaVersion:x,goalId:n,goalFingerprint:i,workspacePath:t,updatedAt:c,state:"planned",attempt:0,progress:p,checks:[],blockingReasons:[],evidencePaths:p.evidencePaths,nextActions:e$1.kind==="test-coverage"?["Add focused tests for the lowest-coverage source paths.","Run verified goal checks."]:e$1.kind==="dependency-security"?["Inspect the fresh project dependency audit.","Apply only compatible non-force dependency repairs.","Reconcile the lockfile, test, build, and verify again."]:["Inspect the current remediation plan and failing release gates.","Repair the next causal blocker, then verify again."],artifactPath:r.status};return a$1(f,J,"Verified goal"),a$1(d,G,"Verified goal status"),await V(r.goal,f),await V(r.status,d),await e(t,C,d),{goal:f,status:d,resumed:false}}async function ee(e,t){let a=E(l.resolve(e),t),s=await y.readJson(a.goal),o=await y.readJson(a.status);a$1(s,J,"Verified goal"),a$1(o,G,"Verified goal status");let i=l.resolve(e),n=l.resolve(s.artifactPaths.goal)===l.resolve(a.goal)&&l.resolve(s.artifactPaths.status)===l.resolve(a.status)&&l.resolve(s.artifactPaths.latestReport)===l.resolve(a.latestReport);if(s.schemaVersion!==W||o.schemaVersion!==x||s.id!==o.goalId||s.fingerprint!==o.goalFingerprint||s.fingerprint!==H(ce(s))||l.resolve(s.workspace.path)!==i||l.resolve(o.workspacePath)!==i||!n)throw new Error(`Verified goal artifacts are inconsistent: ${t}`);return {goal:s,status:o}}function k(e){return {...e,message:e.message??`${e.label}: ${e.actual}; expected ${e.expected}.`}}async function q(e){let t=[],a=e.goal.scope.kind==="project"&&e.goal.scope.projectName?`project:${e.goal.scope.projectName}`:void 0;for(let s of ["test","build"]){if(s==="test"&&e.includeTests===false)continue;if(!(s==="test"?e.goal.constraints.requireTests:e.goal.constraints.requireBuild)){t.push(k({id:s,label:`${s} validation`,status:"skipped",expected:"not required",actual:"skipped by goal contract"}));continue}if(!e.run){t.push(k({id:s,label:`${s} validation`,status:"missing",expected:"fresh passed evidence",actual:"execution disabled"}));continue}let i=await a$3({workspacePath:e.goal.workspace.path,stage:s,scope:a,parallel:false,continueOnError:false,strict:true,json:true,enforceGates:false});if(t.push(k({id:s,label:`${s} validation`,status:i.summary.exitCode===0?"passed":"failed",expected:"exit 0",actual:`exit ${i.summary.exitCode}`,evidencePath:l.join(e.goal.workspace.path,".workspai","reports","workspace-run-last.json")})),i.summary.exitCode!==0)break}return t}async function Ee(e$1){let t=l.resolve(e$1.workspacePath),{goal:a$2,status:s}=await ee(t,e$1.goalId),o=e$1.run!==false,i=[],n;if(o&&e$1.runIntelligence!==false){let u=await c({workspacePath:t,strict:true,agent:"generic"}),g=u.exitCode===0||u.exitCode===2,h=a$2.kind==="release-readiness";i.push(k({id:"workspace-intelligence-chain",label:"Workspace Intelligence chain",status:u.exitCode===0||u.exitCode===2&&!h?"passed":u.exitCode===2?"blocked":"failed",expected:"passed",actual:u.exitCode===2&&g&&!h?`${u.status}; canonical evidence refreshed for goal-scoped verification`:u.status,evidencePath:l.join(t,a.intelligenceRun)}));}if(a$2.kind==="release-readiness"){n=await Q(t),i.push(k({id:"release-readiness",label:"Release readiness",status:n.status==="satisfied"?"passed":"blocked",expected:"all gates pass",actual:n.message,evidencePath:l.join(t,a.readiness)}));let u=await d(t,a.verify),g=await Y(u),h=g?.summary&&typeof g.summary=="object"&&!Array.isArray(g.summary)?String(g.summary.verdict??"missing"):"missing";i.push(k({id:"workspace-verify",label:"Workspace verification",status:h==="ready"?"passed":h==="missing"?"missing":"blocked",expected:"ready",actual:h,evidencePath:l.join(t,a.verify)}));}else if(a$2.kind==="dependency-security")n=await X(t,a$2.scope),i.push(k({id:"dependency-audit",label:"Dependency security audit",status:n.status==="satisfied"?"passed":n.status==="unavailable"?"missing":"blocked",expected:"0 blocking vulnerabilities",actual:n.message,evidencePath:n.evidencePaths[0]})),i.push(a$2.constraints.allowBreakingChanges||a$2.constraints.allowForce?k({id:"change-policy",label:"Change safety policy",status:"blocked",expected:"breaking and force changes disabled",actual:`allowBreakingChanges=${a$2.constraints.allowBreakingChanges}, allowForce=${a$2.constraints.allowForce}`}):await oe(a$2)),n.status==="satisfied"&&i.push(...await q({goal:a$2,run:o}));else {let u=a$2.criteria.kind==="test-coverage"?a$2.criteria.minimumPercent:a$2.baseline.target;if(u===null)throw new Error("Coverage goal does not have a valid target.");let g=await Z({workspacePath:t,scope:a$2.scope,target:u,run:o});n=g.measurement,i.push(k({id:"coverage",label:"Test coverage",status:n.status==="satisfied"?"passed":n.status==="unavailable"?"missing":"blocked",expected:`at least ${u}%`,actual:n.message,evidencePath:n.evidencePaths[0]})),i.push(k({id:"test",label:"Coverage test execution",status:g.executionStatus==="failed"?"failed":g.executionStatus==="unavailable"?"missing":"passed",expected:"runtime-native coverage test command completed",actual:g.executionStatus==="failed"?"coverage test command failed":g.executionStatus==="unavailable"?"coverage execution evidence unavailable":"coverage evidence produced by the test runner",evidencePath:n.evidencePaths[0]})),n.status==="satisfied"&&i.push(...await q({goal:a$2,run:o,includeTests:false}));}let r=i.filter(u=>u.status==="blocked"||u.status==="failed"||u.status==="missing").map(u=>u.message),c$1=[...new Set([...n.evidencePaths,...i.map(u=>u.evidencePath).filter(u=>typeof u=="string")])],p=n.status==="satisfied"&&i.every(u=>u.status==="passed"||u.status==="skipped"),f=E(t,a$2.id),d$1=p?[]:a$2.kind==="test-coverage"?["Inspect low-coverage files from the coverage artifact.","Add focused tests and verify again."]:a$2.kind==="dependency-security"?["Use fresh audit candidates and compatible package-manager repairs.","Reconcile lockfiles before running verified goal checks again."]:["Repair the first blocking readiness gate and verify the goal again."],m={schemaVersion:x,goalId:a$2.id,goalFingerprint:a$2.fingerprint,workspacePath:t,updatedAt:new Date().toISOString(),state:p?"verified":i.some(u=>u.status==="failed")?"failed":"blocked",attempt:s.attempt+1,progress:n,checks:i,blockingReasons:r,evidencePaths:c$1,nextActions:d$1,artifactPath:f.status};return a$1(m,G,"Verified goal status"),await V(f.status,m),await e(t,C,m),m}export{C as VERIFIED_GOAL_LAST_RUN_REPORT_PATH,W as VERIFIED_GOAL_SCHEMA_VERSION,x as VERIFIED_GOAL_STATUS_SCHEMA_VERSION,Ge as planVerifiedGoal,ee as readVerifiedGoal,Ee as verifyVerifiedGoal};

package/dist/{workspace-intelligence-runner-42QI5RYA.js → workspace-intelligence-runner-VYGSASDP.js}

@@ -1 +1 @@
-export{a as WORKSPACE_INTELLIGENCE_RUN_REPORT_PATH,b as WORKSPACE_INTELLIGENCE_RUN_SCHEMA_VERSION,c as runWorkspaceIntelligenceChain}from'./chunk-7RLGOEWV.js';
+export{a as WORKSPACE_INTELLIGENCE_RUN_REPORT_PATH,b as WORKSPACE_INTELLIGENCE_RUN_SCHEMA_VERSION,c as runWorkspaceIntelligenceChain}from'./chunk-JIUWK4ML.js';

package/dist/workspace-run-GUW4EOYB.js

@@ -0,0 +1 @@
+export{a as runWorkspaceStage}from'./chunk-SQTV2OYU.js';export{a as WORKSPACE_RUN_LAST_REPORT_FILENAME}from'./chunk-GHB6QMQH.js';

package/docs/doctor-command.md

@@ -153,7 +153,18 @@ Every result records the exact executable, arguments, ecosystem, severity
 counts, and limitations. A missing tool, timeout, registry failure,
 unparseable response, or unsupported zero-configuration workflow is explicit
 evidence—not a zero-vulnerability result. Compatible automatic fixes never use
-force; unresolved findings move to a targeted upgrade and verification plan.
+force.
+
+When a scanner has no direct automatic fix—or advertises a downgrade—Doctor
+does not conclude that the project has no compatible repair. It emits guarded
+`resolutionCandidates` for the affected direct or transitive dependency. Each
+candidate preserves the owning packages, current and vulnerable ranges when
+known, advisory identifiers, and the admissible next strategies: direct or
+owner upgrade, constraint/override investigation, replacement, time-bounded
+exception, or upstream wait. These are investigation inputs, not mutation
+permission. A repair is complete only after manifest/lock reconciliation,
+focused audit, declared tests, declared build, and canonical Workspace
+Intelligence verification all pass.
 
 ## Coverage goals that Doctor can verify
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "workspai",
-  "version": "0.52.0",
+  "version": "0.52.2",
   "type": "module",
   "description": "Open-source workspace intelligence CLI for software systems: create, adopt, govern, verify, and align polyglot workspaces for humans, CI, IDEs, and AI agents.",
   "keywords": [

package/dist/autopilot-release-UG23AWVH.js

@@ -1 +0,0 @@
-export{b as AUTOPILOT_RELEASE_ALIAS_FILENAME,a as AUTOPILOT_RELEASE_LAST_RUN_FILENAME,c as runAutopilotRelease}from'./chunk-FRJYAJH6.js';