workspai 0.69.0 → 0.70.0

package/dist/chunk-WHR5SL33.js

@@ -1,4 +0,0 @@
-import {a}from'./chunk-FIK343LI.js';import {c as c$1}from'./chunk-ABMB6MJT.js';import {l,q as q$1}from'./chunk-BM2F5C4J.js';import {f,g as g$1,h as h$3}from'./chunk-W6WRT77T.js';import {a as a$2}from'./chunk-MBICKDYP.js';import {h as h$1,g,b as b$1,c as c$2,a as a$3,j as j$1}from'./chunk-OZXCNVGW.js';import {b as b$3}from'./chunk-K33JJVQZ.js';import {a as a$1}from'./chunk-AFIFZTOY.js';import {c,d}from'./chunk-EWZZUQBR.js';import {h as h$2,i,m,k,n,o,l as l$1,j,s,f as f$1,g as g$2,e}from'./chunk-ODK4LCEL.js';import {a as a$5}from'./chunk-FB7SCXAZ.js';import {b as b$2}from'./chunk-25AWHAB5.js';import {a as a$4}from'./chunk-XWKGZRHN.js';import {randomUUID,createHash}from'crypto';import C from'path';import L from'fs-extra';var Be=new Set(["committed","rejected","aborted","superseded"]);function h(e,a){if(!e)throw new Error(`Decision protocol violation: ${a}`)}function Je(e){return [...new Set(e)].sort()}function xe(e,a){return a.digestCanonical(e.effects.map(t=>({id:t.id,status:t.status,key:t.idempotencyKey})))}function He(e,a,t){h(!e.some(r=>r.id===a),`${t} receipt '${a}' already exists`);}function Fe(e,a){He(e.effects,a.id,"effect");let t=e.effects.find(r=>r.idempotencyKey===a.idempotencyKey);return h(!t,`effect idempotency key '${a.idempotencyKey}' was already recorded by '${t?.id}'`),[...e.effects,a]}function Ye(e,a,t){return He(e.verifications,a.id,"verification"),h(a.target.effectHeadDigest===xe(e,t),`verification '${a.id}' does not bind the current effect head`),[...e.verifications,a]}function Xe(e){return e.requiredCriteria.every(a=>{let t=e.verifications.filter(r=>r.criterionId===a);return t.length>0&&t.at(-1)?.status==="passed"})}function Qe(e$1,a,t){if(a.kind==="created"){h(e$1===null,"created must be the first event");let y=a.payload.references?.[0];h(y,"created must bind an intent artifact");let p=a.payload.references?.filter(g=>g.role==="success-criterion").map(g=>g.artifact)??[];return {schemaVersion:e,id:a.transactionId,purpose:"proof-carrying-change",createdAt:a.occurredAt,updatedAt:a.occurredAt,state:"draft",generation:1,eventCount:a.sequence,eventHeadDigest:a.digest,intent:y,requiredCriteria:Je(p),scope:null,evidence:[],plans:[],authorization:null,effects:[],verifications:[],blockers:[]}}h(e$1,`${a.kind} cannot occur before created`),h(!Be.has(e$1.state),`${a.kind} cannot follow terminal state ${e$1.state}`);let r=e$1.state,n=e$1.scope,i=e$1.evidence,s=e$1.plans,d=e$1.authorization,o=e$1.effects,c=e$1.verifications,l=e$1.blockers,m=e$1.terminalReason;switch(a.kind){case "scope-bound":h(e$1.state==="draft"||e$1.state==="scoped","scope-bound requires draft or scoped state"),h(a.payload.scope,"scope-bound requires scope"),n=a.payload.scope,r="scoped";break;case "evidence-attached":h(e$1.state==="scoped"||e$1.state==="evidence-ready","evidence-attached requires scoped state"),h((a.payload.references?.length??0)>0,"evidence-attached requires references"),i=[...i,...a.payload.references??[]],r="evidence-ready";break;case "plan-attached":h(e$1.state==="evidence-ready","plan-attached requires evidence-ready state"),h((a.payload.references?.length??0)>0,"plan-attached requires references"),s=[...s,...a.payload.references??[]];break;case "authorized":h(e$1.state==="evidence-ready","authorization requires evidence-ready state"),h(a.payload.authorization,"authorized requires a bounded authorization grant"),d=a.payload.authorization,r="authorized";break;case "effect-requested":h(e$1.state==="authorized"||e$1.state==="executing","effect-requested requires authorization"),r="executing";break;case "effect-recorded":h(e$1.state==="authorized"||e$1.state==="executing","effect-recorded requires authorization"),h(a.payload.effect,"effect-recorded requires a receipt"),h(d?.effectClasses.includes(a.payload.effect.effectClass),`effect class '${a.payload.effect.effectClass}' is outside the authorization grant`),o=Fe(e$1,a.payload.effect),r=a.payload.effect.status==="succeeded"?"executing":"blocked",a.payload.effect.status!=="succeeded"&&(l=[...l,{code:a.payload.effect.status==="uncertain"?"decision.effect.uncertain":"decision.effect.failed",actionable:true,details:a.payload.effect.summary}]);break;case "effect-uncertain":h(e$1.state==="authorized"||e$1.state==="executing","effect-uncertain requires an active execution"),r="blocked",l=[...l,a.payload.blocker??{code:"decision.effect.uncertain",actionable:true}];break;case "verification-started":h(e$1.state==="authorized"||e$1.state==="executing","verification-started requires authorized or executing state"),r="verifying";break;case "verification-recorded":{h(e$1.state==="verifying","verification-recorded requires verifying state"),h(a.payload.verification,"verification-recorded requires a receipt"),c=Ye(e$1,a.payload.verification,t),r=a.payload.verification.status==="failed"?"blocked":a.payload.verification.status==="inconclusive"?"awaiting-human":"verifying";break}case "human-required":r="awaiting-human";break;case "blocked":h(a.payload.blocker,"blocked requires a structured blocker"),l=[...l,a.payload.blocker],r="blocked";break;case "resumed":h(e$1.state==="blocked"||e$1.state==="awaiting-human","resumed requires a paused state"),h(a.payload.resumeTo,"resumed requires an explicit target state"),r=a.payload.resumeTo,l=[];break;case "committed":h(e$1.state==="verifying","commit requires verifying state"),h(Xe(e$1),"every required criterion needs a latest passing receipt"),h(!e$1.effects.some(y=>y.status!=="succeeded"),"all effects must be certainly successful"),r="committed",m=a.payload.reason??a.payload.summary;break;case "rejected":case "aborted":case "superseded":r=a.kind,m=a.payload.reason??a.payload.summary;break;default:throw new Error(`Decision protocol violation: unsupported event ${a.kind}`)}return {...e$1,updatedAt:a.occurredAt,state:r,generation:e$1.generation+1,eventCount:a.sequence,eventHeadDigest:a.digest,scope:n,evidence:i,plans:s,authorization:d,effects:o,verifications:c,blockers:l,...m?{terminalReason:m}:{}}}function Te(e,a,t,r){let n=(a?.sequence??0)+1,i={schemaVersion:f$1,transactionId:e,sequence:n,kind:t.kind,occurredAt:t.occurredAt,actor:t.actor,previousEventDigest:a?.digest??null,payload:t.payload};return {...i,digest:r.digestCanonical(i)}}function N(e,a){h(e.length>0,"at least one event is required");let t=null,r=null;for(let n of e){h(n.schemaVersion===f$1,`unsupported event schema ${n.schemaVersion}`),h(n.sequence===(r?.sequence??0)+1,`event sequence ${n.sequence} is not contiguous`),h(n.previousEventDigest===(r?.digest??null),`event ${n.sequence} has an invalid previous digest`);let{digest:i,...s}=n;h(n.digest===a.digestCanonical(s),`event ${n.sequence} digest is invalid`),h(!r||n.transactionId===r.transactionId,"events cross transaction boundaries"),t=Qe(t,n,a),r=n;}return t}function ae(e,a,t){return {schemaVersion:g$2,transactionId:e.id,generatedAt:a,generation:e.generation,eventCount:e.eventCount,eventHeadDigest:e.eventHeadDigest,state:e.state,transactionDigest:t.digestCanonical(e)}}function W(e,a){return xe(e,a)}var H={digestCanonical:c};function ea(e){let a=e.trim();if(!/^change-[a-z0-9][a-z0-9-]{7,95}$/.test(a))throw new Error(`Invalid decision transaction id: ${e}`);return a}function K(e){let t=`.workspai/decisions/${ea(e)}`;return {directory:t,transaction:`${t}/transaction.json`,checkpoint:`${t}/checkpoint.json`,events:`${t}/events.jsonl`,lock:`${t}.lock`}}function aa(e,a){return e.split(/\r?\n/).filter(r=>r.trim().length>0).map((r,n)=>{try{return JSON.parse(r)}catch(i){throw new Error(`Decision event log is corrupt at ${a}:${n+1}: ${i.message}`)}})}async function _e(e,a){let t=K(a),r=await b$1(e,t.events);return r?aa(await L.readFile(r,"utf8"),r):[]}function je(e,a){let t=K(a);return {directory:a$3(e,t.directory),transaction:a$3(e,t.transaction),checkpoint:a$3(e,t.checkpoint),events:a$3(e,t.events)}}async function ta(e,a,t,r){let n=K(a.id),i=ae(a,r,H);for(let[s,d]of t.entries())a$1(d,"contracts/workspace-intelligence/decision-event.v1.json",`Decision event ${s+1}`);return b$3(n.transaction,a),b$3(n.checkpoint,i),await j$1(e,n.events,`${t.map(s=>JSON.stringify(s)).join(`
-`)}
-`),await g(e,n.transaction,a),await g(e,n.checkpoint,i),{transaction:a,checkpoint:i,events:t,paths:je(e,a.id)}}async function Ke(e){let a=K(e.transactionId),t=a$3(e.workspacePath,a.lock);return a$4(t,async()=>{let r=await _e(e.workspacePath,e.transactionId),n=r.at(-1)??null;if((n?.digest??null)!==e.expectedHeadDigest)throw new Error(`Decision transaction head changed: expected ${e.expectedHeadDigest??"<empty>"}, observed ${n?.digest??"<empty>"}`);r.length>0&&N(r,H);let i=Te(e.transactionId,n,e.event,H),s=[...r,i],d=N(s,H);return ta(e.workspacePath,d,s,e.event.occurredAt)},{purpose:`decision:${e.transactionId}`,timeoutMs:3e4,staleMs:6e4})}async function qe(e,a){let t=await _e(e,a);if(t.length===0)throw new Error(`Decision transaction not found: ${a}`);let r=N(t,H),n=ae(r,r.updatedAt,H);return {transaction:r,checkpoint:n,events:t,paths:je(e,a)}}function q(e){return K(e).directory}var ne={digestCanonical:c};function ia(e){let a=e.trim();if(!/^change-[a-z0-9][a-z0-9-]{7,95}$/.test(a))throw new Error(`Invalid proof-carrying change id: ${e}`);return a}function b(e){let t=`.workspai/changes/${ia(e)}`;return {directory:t,lease:`${t}/lease.json`,prediction:`${t}/predicted-overlay.json`,actualOverlay:`${t}/actual-overlay.json`,surprises:`${t}/architecture-surprises.json`,capsule:`${t}/capsule.json`,privateBaselineGraph:`${t}/private/baseline-graph.json`}}function sa(e,a){return {kind:e,id:a}}function $(e){return {role:e.role,artifact:e.artifact,schemaVersion:e.schemaVersion,digest:{algorithm:"sha256",semantics:e.semantics??"canonical-json-v1",value:e.value}}}async function I(e,a){let t=await b$1(e,a);return t?await L.readJson(t):null}async function oa(e){let t=(await I(e,s.workspaceContract.artifactPath))?.workspace?.name;if(typeof t=="string"&&t.trim())return t.trim();let r=await I(e,".workspai/workspace.json"),n=r?.workspace_name??r?.name;return typeof n=="string"&&n.trim()?n.trim():C.basename(e)}async function ie(e,a){let t=await c$2(e,a.artifact);if(!t)return  false;if(a.digest.semantics==="raw-bytes-v1"){let i=await L.readFile(t);return createHash("sha256").update(i).digest("hex")===a.digest.value}let r=await L.readJson(t).catch(()=>null);return r?(a.digest.semantics==="workspace-model-structural-v1"?d(r):c(r))===a.digest.value:false}async function ca(e,a){let t=await I(e,b(a).lease);if(!t||t.schemaVersion!==h$2)throw new Error(`Architecture lease is missing or unsupported for ${a}.`);if(t.changeId!==a)throw new Error(`Architecture lease binding failed for ${a}.`);return t}async function U(e){let a=await a$2(e);if(a.status==="miss")throw new Error(`A current canonical Model and Graph are required (${a.reason}). Run workspai workspace intelligence run --for-agent generic --strict --json.`);return a}function da(e,a,t){return c({modelHash:e,graphHash:a,inputHash:t})}function B(e){let a=d(e.model),t=c(e.graph),r=e.graph.source.inputs?.hash;if(!r)throw new Error("The canonical Graph has no live input fingerprint.");return {modelHash:a,graphHash:t,inputHash:r,generation:da(a,t,r)}}async function ze(e,a){let t=await U(e),r=B(t);if(r.generation!==a.generation)throw new Error(`Architecture lease ${a.changeId} is stale. Expected generation ${a.generation}, observed ${r.generation}. Abort or begin a new change from current evidence.`);return t}function w(e,a,t,r,n=new Date().toISOString()){return {kind:e,payload:a,occurredAt:n,actor:sa(t,r)}}async function v(e,a,t,r){return Ke({workspacePath:e,transactionId:t,expectedHeadDigest:a?.transaction.eventHeadDigest??null,event:r})}function V(e,a,t){return `${e}\0${a}\0${t}`}function la(e){let a=[];for(let[t,r]of [["entity",e.entities],["relation",e.relations],["proof",e.proofs]])a.push(...r.added.map(n=>({operation:"add",targetKind:t,targetId:n.id}))),a.push(...r.removed.map(n=>({operation:"remove",targetKind:t,targetId:n.id}))),a.push(...r.changed.map(n=>({operation:"change",targetKind:t,targetId:n.id})));return a.push(...e.changedArtifacts.map(t=>({operation:"change",targetKind:"artifact",targetId:t}))),a.sort((t,r)=>V(t.operation,t.targetKind,t.targetId).localeCompare(V(r.operation,r.targetKind,r.targetId)))}function ga(e){let a=e.prediction?.operations.map(c=>({operation:c.operation,targetKind:c.targetKind,targetId:c.targetId}))??[],t=la(e.actual),r=new Set(a.map(c=>V(c.operation,c.targetKind,c.targetId))),n=new Set(t.map(c=>V(c.operation,c.targetKind,c.targetId))),i=t.filter(c=>r.has(V(c.operation,c.targetKind,c.targetId))),s=t.filter(c=>!r.has(V(c.operation,c.targetKind,c.targetId))),d=a.filter(c=>!n.has(V(c.operation,c.targetKind,c.targetId))),o=e.prediction?s.length===0&&d.length===0?"exact":s.length===0?"within-expectation":"surprising":"no-prediction";return {schemaVersion:j,changeId:e.changeId,generatedAt:e.generatedAt,prediction:e.predictionReference,actual:e.actualReference,matched:i,unpredicted:s,missing:d,summary:{predicted:a.length,actual:t.length,matched:i.length,unpredicted:s.length,missing:d.length,verdict:o}}}async function te(e){let a=await I(e.workspacePath,e.relativePath);return a?$({role:e.role,artifact:e.relativePath,schemaVersion:e.schemaVersion,value:c(a)}):null}function ha(e){let{integrity:a,...t}=e;return t}async function se(e){let a=b(e.lease.changeId),[t,r,n]=await Promise.all([te({workspacePath:e.workspacePath,relativePath:a.prediction,role:"prediction",schemaVersion:i}),te({workspacePath:e.workspacePath,relativePath:a.actualOverlay,role:"actual-architecture-overlay",schemaVersion:a$5}),te({workspacePath:e.workspacePath,relativePath:a.surprises,role:"architecture-surprises",schemaVersion:j})]),i$1=$({role:"decision-transaction",artifact:`${q(e.lease.changeId)}/transaction.json`,schemaVersion:e.record.transaction.schemaVersion,value:c(e.record.transaction)}),s=e.record.transaction.effects.flatMap(f=>f.artifacts),d=e.record.transaction.verifications.flatMap(f=>f.artifacts),o=await I(e.workspacePath,a.actualOverlay),c$1=o?!re(o):false,l=[{id:"intent-bound",status:"passed",summary:"The transaction is hash-bound to its immutable Goal Pack."},{id:"baseline-pinned",status:"passed",summary:"The architecture lease pins exact Model, Graph, and live-input identities."},{id:"effects-receipted",status:e.record.transaction.effects.length>0&&e.record.transaction.effects.every(f=>f.status==="succeeded")||e.record.transaction.effects.length===0&&c$1?"passed":e.record.transaction.effects.length===0?"pending":"failed",summary:e.record.transaction.effects.length===0&&c$1?"Fresh Graph observation proves this was a no-effect change.":`${e.record.transaction.effects.length} typed effect receipt(s) are bound to the transaction ledger.`},{id:"architecture-reobserved",status:r?"passed":"pending",summary:r?"The actual architecture delta was derived from a fresh canonical Graph.":"No post-effect architecture overlay has been observed yet."},{id:"independently-verified",status:e.record.transaction.state==="committed"?"passed":e.record.transaction.verifications.some(f=>f.status==="failed")?"failed":"pending",summary:`${e.record.transaction.verifications.length} independent verification receipt(s) are recorded.`}],m=await I(e.workspacePath,a.surprises),y=[...e.record.transaction.effects.length===0&&o&&re(o)?["No typed effect receipt explains the observed architecture generation."]:[],...m?.summary.unpredicted?[`${m.summary.unpredicted} actual architecture operation(s) were not predicted.`]:[],...e.record.transaction.blockers.map(f=>f.details??f.code)],p=e.record.transaction.state==="committed"?"sealed":e.record.transaction.state==="aborted"?"aborted":e.record.transaction.state==="blocked"||e.record.transaction.state==="awaiting-human"?"blocked":e.record.transaction.state==="verifying"&&e.record.transaction.verifications.some(f=>f.status==="passed")?"verified":"open",g={schemaVersion:k,changeId:e.lease.changeId,goalId:e.lease.goalId,generatedAt:e.record.transaction.updatedAt,status:p,workspace:e.lease.workspace,scope:e.lease.scope,decision:{transaction:i$1,eventHeadDigest:e.record.transaction.eventHeadDigest,effectHeadDigest:W(e.record.transaction,ne),state:e.record.transaction.state,generation:e.record.transaction.generation},intent:e.record.transaction.intent,baseline:e.lease.baseline,prediction:t,actualOverlay:r,surpriseReport:n,effects:s,verification:d,assurances:l,remainingUncertainty:[...new Set(y)]};return {...g,integrity:{algorithm:"sha256",semantics:"canonical-json-v1",capsuleDigest:c(g)}}}async function D(e,a,t){let r=await se({workspacePath:e,lease:a,record:t});return await g(e,b(a.changeId).capsule,r),r}function E(e){let a=b(e.lease.changeId),t={schemaVersion:l$1,operation:e.operation,changeId:e.lease.changeId,state:e.record.transaction.state,capsule:e.capsule,artifacts:{lease:a.lease,prediction:e.capsule.prediction?.artifact??null,actualOverlay:e.capsule.actualOverlay?.artifact??null,surpriseReport:e.capsule.surpriseReport?.artifact??null,transaction:`${q(e.lease.changeId)}/transaction.json`,events:`${q(e.lease.changeId)}/events.jsonl`,capsule:a.capsule},nextActions:e.nextActions};return a$1(t,"contracts/workspace-intelligence/change-operation-result.v1.json","Proof-Carrying Change operation result"),b$2({kind:"operation.completed",status:e.record.transaction.state==="blocked"||e.record.transaction.state==="awaiting-human"?"blocked":e.record.transaction.state==="aborted"?"cancelled":"succeeded",component:"proof-carrying-change",correlationId:e.lease.changeId,message:`${e.operation}: ${e.record.transaction.state}`,evidenceBindings:[{kind:"artifact",ref:a.capsule,role:"output",provenance:"authoritative"},{kind:"artifact",ref:`${q(e.lease.changeId)}/transaction.json`,role:"subject",provenance:"authoritative"}],attributes:{operation:e.operation,changeId:e.lease.changeId,goalId:e.lease.goalId,decisionState:e.record.transaction.state,assurancePassed:e.capsule.assurances.filter(r=>r.status==="passed").length,assuranceTotal:e.capsule.assurances.length}}),t}async function A(e,a){let t=await ca(e,a),r=await qe(e,a);return {lease:t,record:r}}async function Wa(e){let a=C.resolve(e.workspacePath),t=await l({workspacePath:a,goalId:e.goalId,validateBindings:true}),r=t.goalPack;if(!r||!t.active)throw new Error("No active Goal Pack is available, or the named Goal is not active.");if(r.state!=="ready-to-plan")throw new Error(`Goal ${r.id} cannot begin a change while its state is ${r.state}.`);let n=await U(a),i=B(n);if(i.modelHash!==r.sourceBinding.model.hash||(r.sourceBinding.graph.inputHash?i.inputHash!==r.sourceBinding.graph.inputHash:i.graphHash!==r.sourceBinding.graph.hash))throw new Error(`Goal ${r.id} is no longer bound to the current architecture generation.`);let s=`change-${r.intent.category}-${randomUUID().replace(/-/g,"").slice(0,16)}`,d=b(s),o=new Date().toISOString(),c$1=c(n.graph),l$1={schemaVersion:h$2,changeId:s,goalId:r.id,createdAt:o,workspace:r.workspace,scope:{kind:r.scope.kind,projects:[...r.scope.projects]},baseline:{model:$({role:"baseline-model",artifact:r.sourceBinding.model.artifact,schemaVersion:r.sourceBinding.model.schemaVersion,value:r.sourceBinding.model.hash,semantics:"workspace-model-structural-v1"}),graph:{...$({role:"baseline-graph",artifact:r.sourceBinding.graph.artifact,schemaVersion:r.sourceBinding.graph.schemaVersion,value:i.graphHash}),inputHash:i.inputHash}},generation:i.generation,semantics:"optimistic-generation-guard",privateMaterialization:{artifact:d.privateBaselineGraph,role:"hash-bound-baseline-cache",portable:false,authoritative:false,digest:{algorithm:"sha256",semantics:"canonical-json-v1",value:c$1}}};await h$1(a,d.lease,[{relativePath:d.privateBaselineGraph,payload:n.graph},{relativePath:d.lease,payload:l$1}]);let m=e.actorKind??"cli",y=e.actorId??"workspai-change",p=$({role:"intent",artifact:t.active.goalPack,schemaVersion:r.schemaVersion,value:c(r)}),g=r.successCriteria.map(T=>$({role:"success-criterion",artifact:T.id,schemaVersion:"workspai.goal-success-criterion.v1",value:c(T)})),f=await v(a,null,s,w("created",{summary:`Begin proof-carrying change for ${r.id}.`,references:[p,...g]},m,y,o));f=await v(a,f,s,w("scope-bound",{summary:"Bind immutable Goal scope.",scope:l$1.scope},m,y)),f=await v(a,f,s,w("evidence-attached",{summary:"Attach exact architecture generation and lease.",references:[l$1.baseline.model,{role:l$1.baseline.graph.role,artifact:l$1.baseline.graph.artifact,schemaVersion:l$1.baseline.graph.schemaVersion,digest:l$1.baseline.graph.digest},$({role:"architecture-lease",artifact:d.lease,schemaVersion:l$1.schemaVersion,value:c(l$1)})]},m,y)),await q$1({workspacePath:a,goalId:r.id,changeId:s});let P=await D(a,l$1,f);return E({operation:"begin",lease:l$1,record:f,capsule:P,nextActions:[`workspai change predict --change ${s} --file <prediction.json> --json`,`workspai change authorize --change ${s} --effects filesystem,command --json`]})}async function Ma(e){let{lease:a,record:t}=await A(e.workspacePath,e.changeId);if(await ze(e.workspacePath,a),t.transaction.state!=="evidence-ready")throw new Error(`Prediction requires evidence-ready state, observed ${t.transaction.state}.`);let r={...e.prediction,schemaVersion:i,changeId:e.changeId,goalId:a.goalId,baselineGeneration:a.generation,nonCanonical:true,proofEligible:false,operations:[...e.prediction.operations].sort((d,o)=>V(d.operation,d.targetKind,d.targetId).localeCompare(V(o.operation,o.targetKind,o.targetId)))};await g(e.workspacePath,b(e.changeId).prediction,r);let n=$({role:"noncanonical-prediction",artifact:b(e.changeId).prediction,schemaVersion:r.schemaVersion,value:c(r)}),i$1=await v(e.workspacePath,t,e.changeId,w("plan-attached",{summary:"Attach an explicitly noncanonical architecture prediction.",references:[n]},e.actorKind??"agent",e.actorId??"workspai-agent")),s=await D(e.workspacePath,a,i$1);return E({operation:"predict",lease:a,record:i$1,capsule:s,nextActions:[`workspai change authorize --change ${e.changeId} --effects filesystem,command --json`]})}async function La(e){let{lease:a,record:t}=await A(e.workspacePath,e.changeId);if(await ze(e.workspacePath,a),e.effectClasses.length===0)throw new Error("Authorization requires at least one effect class.");let r=await v(e.workspacePath,t,e.changeId,w("authorized",{summary:`Authorize bounded effect classes: ${e.effectClasses.join(", ")}.`,authorization:{grantedBy:e.grantedBy,grant:"bounded-effects",effectClasses:[...new Set(e.effectClasses)].sort()}},e.actorKind??"human",e.grantedBy)),n=await D(e.workspacePath,a,r);return E({operation:"authorize",lease:a,record:r,capsule:n,nextActions:[`workspai change effect record --change ${e.changeId} --file <effect-receipt.json> --json`,`workspai change verify --change ${e.changeId} --json`]})}async function Ua(e){let{lease:a,record:t}=await A(e.workspacePath,e.changeId);if(t.transaction.state!=="blocked"&&t.transaction.state!=="awaiting-human")throw new Error(`Resume requires blocked or awaiting-human state, observed ${t.transaction.state}.`);let r=await v(e.workspacePath,t,e.changeId,w("resumed",{summary:e.reason,reason:e.reason,resumeTo:e.resumeTo},"human",e.actorId)),n=await D(e.workspacePath,a,r);return E({operation:"resume",lease:a,record:r,capsule:n,nextActions:e.resumeTo==="verifying"?[`workspai change verification record --change ${e.changeId} --file <verification-receipt.json> --json`]:[`workspai change effect record --change ${e.changeId} --file <effect-receipt.json> --json`]})}async function Ba(e){let{lease:a,record:t}=await A(e.workspacePath,e.changeId);for(let i of e.receipt.artifacts)if(!await ie(e.workspacePath,i))throw new Error(`Effect artifact is missing or corrupt: ${i.artifact}`);let r=await v(e.workspacePath,t,e.changeId,w("effect-recorded",{summary:e.receipt.summary,effect:e.receipt},e.actorKind??"agent",e.actorId??"workspai-agent")),n=await D(e.workspacePath,a,r);return E({operation:"effect-record",lease:a,record:r,capsule:n,nextActions:r.transaction.state==="blocked"?[`workspai change status --change ${e.changeId} --json`]:[`workspai change verify --change ${e.changeId} --json`]})}async function Ja(e){let a=C.resolve(e.workspacePath),{lease:t,record:r}=await A(a,e.changeId);if(!r.transaction.requiredCriteria.includes(e.receipt.criterionId))throw new Error(`Verification criterion '${e.receipt.criterionId}' is outside the immutable Goal contract.`);let n=await U(a),i=b(e.changeId),[s,d]=await Promise.all([I(a,i.actualOverlay),I(a,i.surprises)]),o=r.transaction.verifications.some(f=>f.criterionId==="workspace-verify"&&f.status==="passed");if(!s||!d||!o)throw new Error("Domain verification can be admitted only after change verify re-observes the Graph and records a passing Workspace Verify receipt.");let c=B(n),l=W(r.transaction,ne);if(e.receipt.target.modelHash!==c.modelHash||e.receipt.target.graphHash!==c.graphHash||e.receipt.target.effectHeadDigest!==l)throw new Error("Verification receipt does not target the current Model, Graph, and effect head.");for(let f of e.receipt.artifacts)if(!await ie(a,f))throw new Error(`Verification artifact is missing or corrupt: ${f.artifact}`);let m=e.actorKind??"ci",y=e.actorId??"workspai-verifier",p=r;if(p.transaction.state==="blocked"){if(!p.transaction.blockers.every(P=>P.code==="change.verification.criteria_missing"))throw new Error("The change is blocked by a condition that a verification receipt cannot resume.");p=await v(a,p,e.changeId,w("resumed",{summary:"Resume to admit a missing verification receipt.",resumeTo:"verifying"},m,y));}else if(p.transaction.state!=="verifying")throw new Error(`Verification receipt requires verifying or criteria-blocked state; observed ${p.transaction.state}.`);p=await v(a,p,e.changeId,w("verification-recorded",{summary:e.receipt.summary,verification:e.receipt},m,y)),p.transaction.state==="verifying"&&p.transaction.requiredCriteria.every(P=>p.transaction.verifications.filter(G=>G.criterionId===P).at(-1)?.status==="passed")&&(p=await v(a,p,e.changeId,w("committed",{summary:"Seal the independently verified proof-carrying change."},m,y)));let g=await D(a,t,p);return E({operation:"verification-record",lease:t,record:p,capsule:g,nextActions:p.transaction.state==="committed"?[`workspai change capsule validate --change ${e.changeId} --json`]:[`workspai change status --change ${e.changeId} --json`]})}function M(e,a,t,r="verification"){return $({role:r,artifact:e,schemaVersion:a,value:c(t)})}function re(e){return e.summary.entityAdds+e.summary.entityRemovals+e.summary.entityChanges+e.summary.relationAdds+e.summary.relationRemovals+e.summary.relationChanges+e.summary.proofAdds+e.summary.proofRemovals+e.summary.proofChanges>0}function Ge(e){return e.replace(/\\/g,"/").replace(/^\.\//,"")}async function Fa(e){let a$1=C.resolve(e.workspacePath),{lease:t,record:r}=await A(a$1,e.changeId);if(r.transaction.state!=="authorized"&&r.transaction.state!=="executing")throw new Error(`Verification requires authorized or executing state, observed ${r.transaction.state}.`);e.refresh!==false&&await c$1({workspacePath:a$1,strict:false,agent:"generic"});let n=await U(a$1),i=await I(a$1,t.privateMaterialization.artifact);if(!i||c(i)!==t.privateMaterialization.digest.value)throw new Error(`The hash-bound baseline materialization is missing or corrupt for ${e.changeId}.`);let s=new Date().toISOString(),d=a(i,n.graph,new Date(s)),o=b(e.changeId);await g(a$1,o.actualOverlay,d);let c$2=M(o.actualOverlay,d.schemaVersion,d,"actual-architecture-overlay"),l=await I(a$1,o.prediction),m=l?M(o.prediction,l.schemaVersion,l,"noncanonical-prediction"):null,y=ga({changeId:e.changeId,generatedAt:s,prediction:l,predictionReference:m,actual:d,actualReference:c$2});await g(a$1,o.surprises,y);let p=M(o.surprises,y.schemaVersion,y,"architecture-surprises"),g$2=r,f$1=e.actorKind??"cli",P=e.actorId??"workspai-change-verify";if(re(d)&&g$2.transaction.effects.length===0){g$2=await v(a$1,g$2,e.changeId,w("blocked",{summary:"Observed architecture change has no typed effect receipt.",blocker:{code:"change.effect_receipt.missing",actionable:true,details:"Record the actual mutation effect before verification can claim causality."}},f$1,P));let k=await D(a$1,t,g$2);return E({operation:"verify",lease:t,record:g$2,capsule:k,nextActions:[`workspai change resume --change ${e.changeId} --to authorized --reason "Record missing effect receipt" --json`]})}let T=new Set(g$2.transaction.effects.filter(k=>k.status==="succeeded").flatMap(k=>k.artifacts).map(k=>Ge(k.artifact))),G=d.changedArtifacts.filter(k=>!T.has(Ge(k)));if(G.length>0){g$2=await v(a$1,g$2,e.changeId,w("blocked",{summary:"Observed architecture artifacts are not covered by typed effect receipts.",blocker:{code:"change.effect_receipt.coverage_missing",actionable:true,details:`Uncovered artifacts: ${G.slice(0,20).join(", ")}`}},f$1,P));let k=await D(a$1,t,g$2);return E({operation:"verify",lease:t,record:g$2,capsule:k,nextActions:[`workspai change resume --change ${e.changeId} --to authorized --reason "Cover observed artifacts" --json`]})}g$2=await v(a$1,g$2,e.changeId,w("verification-started",{summary:"Begin independent post-effect verification."},f$1,P));let Ne=await f({workspacePath:a$1}),We=await g$1(Ne,a$1),J=C.relative(a$1,We).split(C.sep).join("/"),_=await I(a$1,J);if(!_)throw new Error(`Workspace Verify evidence was not persisted at ${J}.`);let O=h$3(_,{strict:e.strict===true}),ce=B(n),de={id:`verify-workspace-${c({generatedAt:s,verify:_,gate:O}).slice(0,16)}`,criterionId:"workspace-verify",status:O.passed?"passed":"failed",summary:O.passed?`Workspace Verify passed in ${O.mode} mode.`:`Workspace Verify blocked in ${O.mode} mode: ${O.reasons.join("; ")}`,target:{modelHash:ce.modelHash,graphHash:ce.graphHash,effectHeadDigest:W(g$2.transaction,ne)},artifacts:[M(J,_.schemaVersion,_),c$2,p],observedAt:s};if(g$2=await v(a$1,g$2,e.changeId,w("verification-recorded",{summary:de.summary,verification:de},f$1,P)),g$2.transaction.state==="verifying"){let k=g$2.transaction.requiredCriteria.filter(Le=>g$2.transaction.verifications.filter(Ue=>Ue.criterionId===Le).at(-1)?.status!=="passed");k.length>0?g$2=await v(a$1,g$2,e.changeId,w("blocked",{summary:"Required outcome verification is incomplete.",blocker:{code:"change.verification.criteria_missing",actionable:true,details:`Missing passing receipts: ${k.join(", ")}`}},f$1,P)):g$2=await v(a$1,g$2,e.changeId,w("committed",{summary:"Seal the independently verified proof-carrying change."},f$1,P));}let Me=await D(a$1,t,g$2);return E({operation:"verify",lease:t,record:g$2,capsule:Me,nextActions:g$2.transaction.state==="committed"?[`workspai change capsule validate --change ${e.changeId} --json`]:[`workspai change status --change ${e.changeId} --json`]})}async function Ya(e){let{lease:a,record:t}=await A(e.workspacePath,e.changeId),r=await se({workspacePath:e.workspacePath,lease:a,record:t});return E({operation:e.operation??"status",lease:a,record:t,capsule:r,nextActions:t.transaction.state==="evidence-ready"?[`workspai change authorize --change ${e.changeId} --effects filesystem,command --json`]:t.transaction.state==="authorized"||t.transaction.state==="executing"?[`workspai change verify --change ${e.changeId} --json`]:[]})}async function Xa(e){let a=C.resolve(e.workspacePath),t=await b$1(a,".workspai/changes","directory"),n=(t?await L.readdir(t,{withFileTypes:true}):[]).filter(o=>o.isDirectory()&&/^change-[a-z0-9][a-z0-9-]{7,95}$/.test(o.name)).map(o=>o.name).sort(),i=[],s=null;for(let o of n)try{let{lease:c,record:l}=await A(a,o);s??=c.workspace.name;let m=await se({workspacePath:a,lease:c,record:l}),y=await oe({workspacePath:a,changeId:o});i.push({changeId:o,goalId:c.goalId,state:l.transaction.state,status:m.status,createdAt:l.transaction.createdAt,updatedAt:l.transaction.updatedAt,scope:c.scope,assurance:{passed:m.assurances.filter(p=>p.status==="passed").length,total:m.assurances.length},blockers:l.transaction.blockers.map(p=>p.details??p.code),capsuleArtifact:b(o).capsule,valid:y.valid,errors:y.errors});}catch(c){i.push({changeId:o,goalId:null,state:null,status:"invalid",createdAt:null,updatedAt:null,scope:null,assurance:{passed:0,total:5},blockers:[],capsuleArtifact:b(o).capsule,valid:false,errors:[c instanceof Error?c.message:String(c)]});}i.sort((o,c)=>(c.updatedAt??"").localeCompare(o.updatedAt??"")||o.changeId.localeCompare(c.changeId));let d={schemaVersion:m,generatedAt:new Date().toISOString(),workspace:{name:s??await oa(a)},changes:i,summary:{total:i.length,open:i.filter(o=>o.status==="open"||o.status==="verified").length,blocked:i.filter(o=>o.status==="blocked").length,sealed:i.filter(o=>o.status==="sealed").length,aborted:i.filter(o=>o.status==="aborted").length,invalid:i.filter(o=>!o.valid).length}};return a$1(d,"contracts/workspace-intelligence/proof-carrying-change-list.v1.json","Proof-Carrying Change list"),d}async function Qa(e){let{lease:a,record:t}=await A(e.workspacePath,e.changeId),r=await v(e.workspacePath,t,e.changeId,w("aborted",{summary:e.reason,reason:e.reason},"human",e.actorId)),n=await D(e.workspacePath,a,r);return E({operation:"abort",lease:a,record:r,capsule:n,nextActions:[]})}async function oe(e){let a=b(e.changeId),t=await I(e.workspacePath,a.capsule);if(!t)throw new Error(`Proof-carrying change capsule not found: ${e.changeId}`);let r=[];t.schemaVersion!==k&&r.push(`Unsupported capsule schema: ${t.schemaVersion}`),t.changeId!==e.changeId&&r.push("Capsule change binding does not match."),c(ha(t))!==t.integrity.capsuleDigest&&r.push("Capsule integrity digest does not match its canonical content.");let{lease:n$1,record:i}=await A(e.workspacePath,e.changeId),s=i.transaction.evidence.find(c=>c.role==="architecture-lease");(!s||s.digest.value!==c(n$1))&&r.push("Architecture lease does not match the decision-ledger evidence binding."),(n$1.goalId!==t.goalId||n$1.generation!==c({modelHash:n$1.baseline.model.digest.value,graphHash:n$1.baseline.graph.digest.value,inputHash:n$1.baseline.graph.inputHash}))&&r.push("Architecture lease identity or generation binding is invalid."),i.transaction.eventHeadDigest!==t.decision.eventHeadDigest&&r.push("Capsule does not bind the current decision event head."),c(i.transaction)!==t.decision.transaction.digest.value&&r.push("Decision transaction projection digest does not match the capsule.");let d=await I(e.workspacePath,n$1.privateMaterialization.artifact);(!d||c(d)!==n$1.privateMaterialization.digest.value)&&r.push("Hash-bound baseline materialization is missing or corrupt.");for(let c of [t.intent,t.decision.transaction,t.prediction,t.actualOverlay,t.surpriseReport,...t.effects,...t.verification].filter(l=>!!l))await ie(e.workspacePath,c)||r.push(`Referenced artifact is missing or corrupt: ${c.artifact}`);let o={schemaVersion:n,changeId:e.changeId,validatedAt:new Date().toISOString(),valid:r.length===0,errors:r,capsule:t};return a$1(o,"contracts/workspace-intelligence/proof-carrying-change-capsule-validation.v1.json","Proof-Carrying Change capsule validation"),o}async function Za(e){let a=await oe(e);if(!a.valid)throw new Error(`Cannot export an invalid capsule: ${a.errors.join("; ")}`);let t=C.resolve(e.workspacePath),r=C.resolve(t,e.outputPath),n=C.relative(t,r);if(n===".."||n.startsWith(`..${C.sep}`)||C.isAbsolute(n))throw new Error("Capsule export path must remain inside the workspace.");let i=n.split(C.sep).join("/"),s=await g(t,i,a.capsule),d={schemaVersion:o,changeId:e.changeId,outputPath:s,validation:a};return a$1(d,"contracts/workspace-intelligence/proof-carrying-change-capsule-export.v1.json","Proof-Carrying Change capsule export"),d}function et(e){if(!e||typeof e!="object"||Array.isArray(e))throw new Error("Prediction input must be a JSON object.");let a=e;if(!Array.isArray(a.operations)||!Array.isArray(a.assumptions))throw new Error("Prediction input requires operations[] and assumptions[].");let t=new Set(["add","remove","change"]),r=new Set(["entity","relation","proof","artifact"]),n=new Set(["high","medium","low"]);for(let s of a.operations)if(!s||!t.has(s.operation)||!r.has(s.targetKind)||typeof s.targetId!="string"||s.targetId.trim().length===0||typeof s.rationale!="string"||!n.has(s.confidence))throw new Error("Prediction contains an invalid operation.");let i$1=a.predictedRisk;if(!i$1||!["none","low","medium","high"].includes(i$1))throw new Error("Prediction requires predictedRisk: none, low, medium, or high.");return {schemaVersion:i,changeId:a.changeId??"change-placeholder",goalId:a.goalId??"goal-placeholder",generatedAt:a.generatedAt??new Date().toISOString(),baselineGeneration:a.baselineGeneration??"pending-binding",nonCanonical:true,proofEligible:false,operations:a.operations,assumptions:a.assumptions.filter(s=>typeof s=="string"),predictedRisk:i$1}}function at(e){if(!e||typeof e!="object"||Array.isArray(e))throw new Error("Effect receipt input must be a JSON object.");let a=e;if(typeof a.id!="string"||!["filesystem","command","configuration","dependency","external"].includes(String(a.effectClass))||!["succeeded","failed","uncertain"].includes(String(a.status))||typeof a.summary!="string"||typeof a.observedAt!="string"||typeof a.idempotencyKey!="string"||!Array.isArray(a.artifacts))throw new Error("Effect receipt is missing required typed fields.");return a}function tt(e){if(!e||typeof e!="object"||Array.isArray(e))throw new Error("Verification receipt input must be a JSON object.");let a=e;if(typeof a.id!="string"||typeof a.criterionId!="string"||!["passed","failed","inconclusive"].includes(String(a.status))||typeof a.summary!="string"||typeof a.observedAt!="string"||!a.target||typeof a.target.modelHash!="string"||typeof a.target.graphHash!="string"||typeof a.target.effectHeadDigest!="string"||!Array.isArray(a.artifacts))throw new Error("Verification receipt is missing required typed fields.");return a}function rt(e,a){return e.decision.eventHeadDigest===a.eventHeadDigest&&e.decision.transaction.digest.value===c(a)}async function nt(e){let a=await oe({workspacePath:e.workspacePath,changeId:e.changeId});if(!a.valid)throw new Error(`Proof-carrying change ${e.changeId} failed capsule validation.`);let{lease:t,record:r}=await A(e.workspacePath,e.changeId);if(t.goalId!==e.goalId||r.transaction.state!=="committed"||a.capsule.status!=="sealed")throw new Error(`Proof-carrying change ${e.changeId} is not a sealed change for ${e.goalId}.`);let n=[...r.transaction.verifications].reverse().find(i=>i.status==="passed");if(!n)throw new Error(`Proof-carrying change ${e.changeId} has no passing verification receipt.`);return {modelHash:n.target.modelHash,graphHash:n.target.graphHash}}
-export{Wa as a,Ma as b,La as c,Ua as d,Ba as e,Ja as f,Fa as g,Ya as h,Xa as i,Qa as j,oe as k,Za as l,et as m,at as n,tt as o,rt as p,nt as q};

package/dist/chunk-YWZBGSFE.js

@@ -1,9 +0,0 @@
-import {f,e,g as g$1}from'./chunk-NSH7TTSV.js';import {a as a$1,b}from'./chunk-MGL6DBOR.js';import {b as b$1,c}from'./chunk-V52R2W2Q.js';import {a as a$2}from'./chunk-NMXGSVMD.js';import {p,a as a$3}from'./chunk-UW4SESKD.js';import {k as k$1,m,l}from'./chunk-U5ENEDJA.js';import {g}from'./chunk-OZXCNVGW.js';import {p as p$1,q}from'./chunk-ODK4LCEL.js';import {k,t,u}from'./chunk-VQZ5PI5J.js';import j from'fs';import i from'path';import a from'chalk';var Z=new Set([".git",".workspai",".rapidkit",".venv","node_modules","dist","build","target","coverage","htmlcov",".next"]);async function I(e){try{return await j.promises.access(e,j.constants.F_OK),true}catch{return  false}}async function S(e){try{let n=JSON.parse(await j.promises.readFile(e,"utf-8"));return n&&typeof n=="object"&&!Array.isArray(n)?n:null}catch{return null}}async function v(e){try{return await j.promises.readFile(e,"utf-8")}catch{return ""}}function ee(e){return a$1(e)}async function ne(e,n){return await X([...u(e,"project.json"),...u(e,"context.json")])?true:b(e)?false:i.resolve(e)===i.resolve(n)?k$1(e).length>0:k$1(e).length>0}async function te(e){let n=await a$2(e,{skipDirs:Z,includeHiddenDirs:false,descendIntoMatchedProjects:false,isProjectDir:ne}),r=(await a$3(e)).filter(s=>s.relationship==="adopted"||s.source==="adopted-local").map(s=>i.resolve(s.path)).filter(s=>j.existsSync(s)),o=[...new Set([...n.map(s=>i.resolve(s)),...r])];return o.length>0?o:b(e)?[]:k$1(e).length>0?[e]:[]}function re(e,n){return i.relative(e,n).replace(/\\/g,"/")||"."}async function E(e,n){for(let t of n)if(await I(i.join(e,t)))return  true;return  false}async function X(e){for(let n of e)if(await I(n))return  true;return  false}async function Y(e){for(let n of e){let t=await S(n);if(t)return t}return null}async function oe(e){if(await E(e,["health","health.ts","health.js","health.py","health.go","health.kt","health.rb","health.php","healthcheck","health-check","src/health.ts","src/health.js","src/health.py","src/health.go","src/health.kt","src/health.rb","src/health.php","src/healthcheck.ts","src/healthcheck.js","src/liveness.ts","src/readiness.ts","src/ping.ts","app/controllers/health_controller.rb","app/controllers/health_check_controller.rb","config/initializers/health_check.rb"]))return  true;let t=await v(i.join(e,"config","routes.rb"));return /(?:health|readiness|liveness|readiness_check|health_check)/iu.test(t)}async function se(e,n){if(await E(e,[".env",".env.local"]))return  true;let t=n?.contracts&&typeof n.contracts=="object"?n.contracts:null;if(Array.isArray(t?.env)&&t.env.length>0)return  true;let r=await S(i.join(e,"package.json")),o={...r?.dependencies??{},...r?.devDependencies??{}};if(Object.keys(o).some(c=>/^(?:dotenv|dotenv-flow|env-cmd)$/iu.test(c)))return  true;let s=await v(i.join(e,"pyproject.toml"));if(/\b(?:python-dotenv|pydantic-settings)\b/iu.test(s))return  true;let p=[await v(i.join(e,"compose.yaml")),await v(i.join(e,"compose.yml")),await v(i.join(e,"docker-compose.yml")),await v(i.join(e,"docker-compose.yaml"))].join(`
-`);return /^\s*(?:env_file|environment)\s*:/imu.test(p)}async function ae(e){return (await g$1(e)).detected}async function ie(e){let n=await S(i.join(e,"package.json")),t=n?.scripts&&typeof n.scripts=="object"?n.scripts:{};return Object.keys(t).sort()}function y(e,n,t,r,o,s,p){return {id:e,severity:n,target:t,title:r,detail:o,remediation:s,...p&&p.length>0?{files:[...p]}:{}}}function ce(e){let n=e.reduce((t,r)=>r.severity==="fail"?t+28:r.severity==="warn"?t+12:t+3,0);return Math.max(0,100-n)}async function de(e,n,t){let r=await Y(u(n,"project.json")),o=m(n,r),s=l(n),p=o.runtime==="unknown"?s[0]||"unknown":o.runtime,c$1=[p,...s.filter(G=>G!==p)],g=await b$1(n,r,{runtime:p,framework:o.key}),w=["backend","service","worker"].includes(g),h=w&&/^(?:fastapi|django|flask|nestjs|express|fastify|springboot|gofiber|gogin|dotnet-webapi|laravel|rails|phoenix|axum|actix|rocket)$/u.test(o.key),k=re(e,n),u$1=k,b=await ie(n),C=await X([...u(n,"project.json"),...u(n,"context.json")]),P=await ae(n),x=await E(n,["Dockerfile","dockerfile"]),R=await E(n,[".env.example","env.example","config/env.example"]),F=await se(n,r),m$1=await c({projectPath:n,declaration:t?.governance}),d=m$1.ci.status==="repository",l$1=await oe(n),f=[];return o.key==="unknown"&&f.push(y("project.stack.unknown","fail",u$1,"Project stack is unknown","Workspai cannot confidently classify this backend project.","Add .workspai/project.json metadata or import the project with `workspai import`.")),C||f.push(y("project.marker.missing","warn",u$1,"Workspai marker is missing","The project can be detected by files, but it is not registered with Workspai metadata.","Run `workspai import <path>` from a workspace or create the project through Workspai.")),P||f.push(y("project.tests.missing","warn",u$1,"Test entrypoint is missing","No common test folder, config, or package test script was found.","Add a test command so `workspai workspace run test --affected` can gate changes.")),w&&F&&!R&&f.push(y("project.env.example.missing","info",u$1,"Environment example is missing","No .env.example or env.example file was found.","Add an env example for onboarding and CI secret documentation.",[".env.example"])),m$1.ci.status==="unknown"?f.push(y("project.ci.missing","warn",u$1,"CI governance is not proven","No repository CI surface or canonical external CI declaration was found for this project.","Add repository CI configuration or declare the external CI authority in the workspace contract.",[".github/workflows/ci.yml"])):m$1.ci.status==="external-observed"&&f.push(y("project.ci.external-observed","info",u$1,"Continuous integration appears externally managed",`Repository documentation references an external CI control plane (${m$1.ci.evidence.join(", ")}).`,"Declare the external CI provider in the canonical workspace contract when authoritative release gating depends on it.")),h&&!l$1&&f.push(y("project.health.missing","info",u$1,"Health or readiness probe is missing","The project has no obvious health or readiness endpoint to support automated deployment and runtime checks.","Add a simple health endpoint and document it for readiness gates and observability.")),w&&!x&&f.push(y("project.container.missing","info",u$1,"Container recipe is missing","No Dockerfile was found for this project.","Add a Dockerfile when the service is intended for containerized deployment.",["Dockerfile"])),{name:typeof r?.name=="string"&&r.name.trim()?r.name.trim():i.basename(n),path:n,relativePath:k,runtime:p,runtimeCandidates:c$1,framework:o.key,confidence:o.confidence,supportTier:o.supportTier,hasRapidKitMarker:C,hasTests:P,hasDockerfile:x,hasEnvExample:R,hasCiConfig:d,governance:m$1,hasHealthEndpoint:l$1,scripts:b,findings:f,score:ce(f)}}function le(e){return e.name.toLowerCase()}async function pe(e){let n=new Map(e.map(o=>[le(o),o])),t=[];for(let o of e){let s=await S(i.join(o.path,"package.json")),p={...s?.dependencies??{},...s?.devDependencies??{},...s?.peerDependencies??{}};for(let g of Object.keys(p)){let w=g.replace(/^@[^/]+\//,"").toLowerCase(),h=n.get(w);h&&h.relativePath!==o.relativePath&&t.push({from:o.relativePath,to:h.relativePath,kind:"package"});}let c=await v(i.join(o.path,"pyproject.toml"));for(let g of e)g.relativePath!==o.relativePath&&c.includes(g.name)&&t.push({from:o.relativePath,to:g.relativePath,kind:"workspace-reference"});}let r=new Set;return t.filter(o=>{let s=`${o.from}\0${o.to}\0${o.kind}`;return r.has(s)?false:(r.add(s),true)})}function ue(e,n){let t=new Map;for(let r of e)t.set(r.relativePath,{project:r.relativePath,directDependents:0,directDependencies:0});for(let r of n){let o=t.get(r.from),s=t.get(r.to);o&&(o.directDependencies+=1),s&&(s.directDependents+=1);}return Array.from(t.values()).sort((r,o)=>o.directDependents-r.directDependents||o.directDependencies-r.directDependencies)}async function me(e){let n=await Y(t(e,"workspace.json"));return typeof n?.profile=="string"?n.profile:null}function fe(e){return {fail:e.filter(n=>n.severity==="fail").length,warn:e.filter(n=>n.severity==="warn").length,info:e.filter(n=>n.severity==="info").length}}function ge(e){if(e.projectCount===0)return e.workspaceDetected?["Add your first project: npx workspai create project <name> --kit <kit>","Import an existing service: npx workspai import <path>"]:["Create a Workspai workspace: npx workspai create workspace my-workspace --profile polyglot","Import an existing service: npx workspai import ../service"];let n=[];return e.findings.some(t=>t.id==="workspace.marker.missing")&&n.push("Initialize workspace metadata with `workspai bootstrap --profile polyglot`."),e.findings.some(t=>t.id==="project.marker.missing")&&n.push("Register detected projects with `workspai import <path>` or recreate them via `workspai create project`."),e.findings.some(t=>t.id==="project.tests.missing")&&n.push("Add test entrypoints, then gate changes with `workspai workspace run test --affected --strict`."),e.findings.some(t=>t.id==="project.ci.missing")&&n.push("Add CI/CD configuration to catch regressions early and make workspace health checks actionable."),e.findings.some(t=>t.id==="project.health.missing")&&n.push("Add a health/readiness endpoint so runtime probes and deployment checks can verify service health."),e.hasCanonicalGraph||n.push("Generate canonical topology with `workspai workspace model --write --include-evidence`."),n.push("Run `workspai autopilot release --mode audit --json` before release."),Array.from(new Set(n))}async function Fe(e$1={}){let n=i.resolve(e$1.workspacePath||process.cwd());if(!await I(n))throw new Error(`Workspace path does not exist: ${n}`);let t=ee(n)??n,r=k(t),o=await me(t),s=await te(t),p$2;try{p$2=(await p({workspacePath:t})).contract;}catch{}let c=await Promise.all(s.map(d=>{let l=p$2?.projects.find(f=>{let G=f.externalPath??f.relativePath;return i.resolve(t,G)===i.resolve(d)});return de(t,d,l)})),g$1=await pe(c),w=ue(c,g$1),h=[];r||h.push(y("workspace.marker.missing","warn",".","Workspace metadata is missing","The directory can be analyzed, but it is not a registered Workspai workspace.","Run `workspai create workspace` or `workspai bootstrap --profile polyglot` in a workspace root.")),c.length===0&&h.push(y("workspace.projects.missing","warn",".","No backend projects detected","Workspai did not find runtime markers or project metadata under this root.","Create a project with `workspai create project` or import one with `workspai import <path>`."));let k$1=[...h,...c.flatMap(d=>d.findings)],u=fe(k$1),b={};for(let d of c)for(let l of d.runtimeCandidates)b[l]=(b[l]||0)+1;let C=c.length>0?Math.round(c.reduce((d,l)=>d+l.score,0)/c.length):0,P=h.reduce((d,l)=>d+(l.severity==="fail"?20:l.severity==="warn"?8:2),0),x=Math.max(0,C-P),R=c.length===0&&u.fail===0&&k$1.length>0&&k$1.every(d=>d.id==="workspace.projects.missing"&&d.severity==="warn"),F=u.fail>0||e$1.strict&&u.warn>0&&!R?"blocked":u.warn>0?"needs-attention":"ready",m={schemaVersion:q.analyze,generatedAt:new Date().toISOString(),workspacePath:t,workspaceDetected:r,profile:o,summary:{statusScope:"source-structure",releaseReadiness:"not-evaluated",score:x,verdict:F,projectCount:c.length,runtimeCount:Object.keys(b).length,findings:u},runtimes:b,projects:c,dependencyGraph:{status:g$1.length>0?"generated":"empty",edges:g$1,topImpactedProjects:w.slice(0,5)},findings:k$1,nextActions:ge({findings:k$1,projectCount:c.length,hasCanonicalGraph:await I(i.join(t,p$1.knowledgeGraph)),workspaceDetected:r}),enterpriseControls:{jsonReady:true,ciGateCommand:"workspai analyze --json --strict",releaseGateCommand:"workspai autopilot release --mode enforce --json",evidencePath:p$1.analyze}};if(e$1.output&&(await j.promises.mkdir(i.dirname(i.resolve(e$1.output)),{recursive:true}),await j.promises.writeFile(i.resolve(e$1.output),`${JSON.stringify(m,null,2)}
-`)),!e$1.output&&r){let d=f(m,{commandId:"workspaceAnalyze",exitCode:m.summary.verdict==="blocked"?2:m.summary.verdict==="needs-attention"?1:0,generatedAt:m.generatedAt,blockers:m.findings.filter(l=>l.severity==="fail").map(l=>l.title).slice(0,12),runId:e()});await g(t,p$1.analyze,d);}return m}function Ge(e){let n=e.summary.verdict==="ready"?a.green:e.summary.verdict==="needs-attention"?a.yellow:a.red;if(console.log(a.bold(`
-Workspai Workspace Analysis
-`)),console.log(a.cyan("Workspace:"),e.workspacePath),console.log(a.cyan("Profile:"),e.profile||"not configured"),console.log(a.cyan("Source score:"),`${e.summary.score}/100`),console.log(a.cyan("Source verdict:"),n(e.summary.verdict)),console.log(a.cyan("Release readiness:"),e.summary.releaseReadiness),console.log(a.gray(`Projects: ${e.summary.projectCount}, runtimes: ${e.summary.runtimeCount}, findings: ${e.summary.findings.fail} fail / ${e.summary.findings.warn} warn / ${e.summary.findings.info} info`)),e.projects.length>0){console.log(a.bold(`
-Projects`));for(let t of e.projects){let r=t.score>=85?a.green("pass"):t.score>=65?a.yellow("watch"):a.red("risk");console.log(`  ${t.relativePath}  ${a.gray(`${t.runtime}/${t.framework}`)}  ${r} ${t.score}/100`);}}if(e.dependencyGraph.status==="generated"&&(console.log(a.bold(`
-Dependency Graph`)),console.log(a.gray(`  edges: ${e.dependencyGraph.edges.length}`)),e.dependencyGraph.topImpactedProjects.length>0)){console.log(a.gray("  Top impacted projects:"));for(let t of e.dependencyGraph.topImpactedProjects.slice(0,3))console.log(`    ${t.project} (${t.directDependents} dependents, ${t.directDependencies} dependencies)`);}if(e.findings.length>0){console.log(a.bold(`
-Top Findings`));for(let t of e.findings.slice(0,8)){let r=t.severity==="fail"?a.red:t.severity==="warn"?a.yellow:a.gray;console.log(`  ${r(t.severity.toUpperCase())} ${t.target}: ${t.title}`),console.log(a.gray(`     ${t.remediation}`));}}console.log(a.bold(`
-Next Actions`));for(let t of e.nextActions.slice(0,5))console.log(a.gray(`  - ${t}`));console.log();}export{Fe as a,Ge as b};

package/dist/chunk-YZL7ZY7J.js

@@ -1,2 +0,0 @@
-import {b as b$1}from'./chunk-COICGD62.js';import {b}from'./chunk-AD4ZY3RF.js';import {q as q$1,f,g}from'./chunk-2LZWBUJD.js';import {d}from'./chunk-UW4SESKD.js';import {g as g$1,f as f$1}from'./chunk-OZXCNVGW.js';import {q,p}from'./chunk-ODK4LCEL.js';import E from'path';import A from'fs-extra';var re=q.agentContext,se=p.agentContext;function ne(e){if(typeof e!="string"||!e.trim()||e==="true")return "generic";let t=e.trim().toLowerCase();return t==="codex"||t==="claude"||t==="cursor"||t==="gemini"||t==="qwen"||t==="kimi"||t==="grok"||t==="copilot"||t==="windsurf"||t==="amazon-q"||t==="orca"?t:"generic"}function G(e){return `npx --yes --package workspai workspai ${e}`.trim()}function x(e){return `npx workspai ${e}`.trim()}async function C(e,t,i){let s=E.join(e,t);if(!await A.pathExists(s))return null;try{let n=await A.readJson(s);return typeof n!="object"||n===null||!("schemaVersion"in n)||n.schemaVersion!==i?null:n}catch{return null}}function m(e){return {id:e.id,scope:e.scope,display:x(e.args),execute:G(e.args),description:e.description,...e.project?{project:e.project}:{},freshness:f({id:`command.${e.id}`,label:`${e.id} command`,scope:"command",value:{display:x(e.args),execute:G(e.args)},...e.project?{project:e.project}:{},freshness:{kind:"derived",category:"structure",generatedAt:e.generatedAt,now:e.now,sourceArtifact:p.model,sourcePath:`safeCommands.${e.id}`,reason:"Safe command surfaces are derived from workspace model command capabilities."}}).freshness}}function L(e,t){return `workspace run ${t} --scope project:${e.name}`}function ae(e){return (e.startsWith("project:")?e.slice(8):e).trim().toLowerCase()}function oe(e){return [e.name,e.path,E.basename(e.path),e.absolutePath].filter(t=>typeof t=="string"&&t.trim().length>0).map(t=>t.trim().toLowerCase())}function ie(e,t,i){let s={generatedAt:e.generatedAt,now:i},n=[m({id:"workspace.model",scope:"workspace",args:"workspace model --json",description:"Read the canonical workspace intelligence model.",...s}),m({id:"workspace.graph.entities",scope:"workspace",args:"workspace graph entities --json",description:"Query proof-backed workspace entities without loading the full graph.",...s}),m({id:"workspace.graph.evidence",scope:"workspace",args:"workspace graph evidence <entity-or-relation> --json",description:"Resolve portable evidence for a graph entity or relation.",...s}),m({id:"workspace.graph.path",scope:"workspace",args:"workspace graph path <from> <to> --json",description:"Find a shortest proof-carrying path between workspace entities.",...s}),m({id:"workspace.doctor",scope:"workspace",args:"doctor workspace --json",description:"Check workspace health before claiming verification.",...s}),m({id:"workspace.pipeline",scope:"workspace",args:"pipeline --json",description:"Run the governed sync, doctor, analyze, readiness, and autopilot loop.",...s}),m({id:"workspace.contract.verify",scope:"workspace",args:"workspace contract verify --json",description:"Verify workspace contract and dependency edges.",...s}),m({id:"workspace.verify",scope:"workspace",args:"workspace verify --json",description:"Evaluate evidence freshness and verification gates before release decisions.",...s})],c=t?[t]:e.projects;for(let a of c)a.commands.fleetStages.includes("test")&&n.push(m({id:`project.${a.name}.test`,scope:"project",project:a.name,args:L(a,"test"),description:`Run tests for ${a.name} through workspace orchestration.`,...s})),a.commands.fleetStages.includes("build")&&n.push(m({id:`project.${a.name}.build`,scope:"project",project:a.name,args:L(a,"build"),description:`Build ${a.name} through workspace orchestration.`,...s}));return n}function ce(e){return e.commands.fleetStages.filter(t=>t==="test"||t==="build").map(t=>`workspace run ${t}`)}function pe(e,t){if(!t?.startsWith("project:"))return;let i=ae(t);if(i)return e.projects.find(s=>oe(s).includes(i))}function de(e,t,i){let s=[...e.validation?.issues??[]];t?.startsWith("project:")&&!i&&s.push({severity:"error",code:"context.scope.project.missing",message:`Requested project scope was not found: ${t}`,target:t});let n=s.filter(a=>a.severity==="error").length,c=s.filter(a=>a.severity==="warning").length;return {status:n>0?"failed":c>0?"warning":"passed",errors:n,warnings:c,issues:s}}async function me(e,t){let i=[],s=[];for(let[n,c]of Object.entries(e.evidence))c&&await f$1(t,c.path)!==null?i.push(`${n}: ${c.path}`):s.push(n);return {available:i.sort(),missing:s.sort()}}function le(e){let t=e.summary.projectCount,i=e.summary.runtimes.length?`${e.summary.runtimes.join(", ")} runtime coverage`:"no runtime coverage",s=e.identity.surfaces.length?e.identity.surfaces.join(", "):"no detected surfaces";return `${e.workspace.name} is a ${e.identity.workspaceType} with ${t} project${t===1?"":"s"}, ${i}, and ${s}.`}function ge(e){let t=["Do not claim a command passed unless a report or command output proves it.","Do not infer secrets or environment values from file names.","Do not change project scope without checking the selected project."];return e.contracts.exists||t.push("Workspace contract is missing; dependency and API edges may be incomplete."),((e.summary.extendedProjects??0)>0||e.summary.observedProjects>0)&&t.push("Some projects use extended or observed support tiers; command coverage may be partial."),t}async function We(e){let t=e.model??await q$1({workspacePath:e.workspacePath,includeEvidence:e.includeEvidence===true,observableScanDepth:e.observableScanDepth,now:e.now}),i=ne(e.agent),s=pe(t,e.scope),n=de(t,e.scope,s);if(e.strict===true&&n.status!=="passed"){let r=n.issues.map(g=>`${g.severity}:${g.code}:${g.target}`).join(", ");throw new Error(`Workspace context strict validation failed: ${r}`)}let c=e.now??new Date,a=t.facts??[],K=new Set((s?[s]:t.projects).map(r=>r.name)),R=a.filter(r=>r.project?K.has(r.project):true),H=(s?[s]:t.projects).map(r=>{let g=R.filter(p=>p.project===r.name);return {name:r.name,path:r.path,kind:r.kind,category:r.category,runtime:r.runtime,framework:r.frameworkDisplayName,...r.generator?{generator:r.generator}:{},createCapability:r.createCapability,supportTier:r.supportTier,...r.governance?{governance:r.governance}:{},safeCommands:ce(r),importantFiles:r.importantFiles,facts:g}}),S=await me(t,e.workspacePath),F=E.join(e.workspacePath,p.knowledgeGraph),u=await A.pathExists(F)?await A.readJson(F).catch(()=>null):null,N=false;if(u?.schemaVersion===q.knowledgeGraph)try{b(u,t),N=true;}catch{}let $=le(t),M=ie(t,s,c),b$2=await C(e.workspacePath,p.impact,q.impact),l=await C(e.workspacePath,p.doctor,q.doctor),v=await C(e.workspacePath,p.analyze,q.analyze),k=await C(e.workspacePath,p.readiness,q.readiness),h=await C(e.workspacePath,p.verify,q.verify),w=await C(e.workspacePath,p.explain,q.explain),f$1=await C(e.workspacePath,p.diff,q.diff),B=b$2?.summary?{changed:b$2.summary.changed,risk:b$2.summary.risk,affectedProjects:b$2.summary.affectedProjects,blastRadius:b$2.summary.blastRadius,recommendedCommands:b$2.summary.recommendedCommands}:void 0,U=l?.summary?{verdict:l.summary.verdict,totalIssues:l.summary.totalIssues,advisoryFindings:l.summary.advisoryFindings,blockingFindings:l.summary.blockingFindings,unknownFindings:l.summary.unknownFindings,hasSystemErrors:l.summary.hasSystemErrors,topSignals:(()=>{let r=Array.isArray(l.projects)?l.projects:[],g=[];for(let p of r.slice(0,6)){let te=Array.isArray(p.probes)?p.probes:[];for(let y of te.slice(0,10))(y?.status==="fail"||y?.severity==="error")&&g.push({label:y.label,scope:y.scope,issueClass:y.issueClass,status:y.status,severity:y.severity,recommendation:y.recommendation});}return g.slice(0,8)})()}:void 0,J=v?.summary?{score:v.summary.score,verdict:v.summary.verdict,findingCounts:v.summary.findings,topFindings:(Array.isArray(v.findings)?v.findings:[]).filter(p=>p?.severity==="fail"||p?.severity==="warn").slice(0,8).map(p=>({severity:p.severity,title:p.title,target:p.target,remediation:p.remediation}))}:void 0,X=k?{overallStatus:k.overallStatus,blocking:k.blocking,blockingReasons:k.blockingReasons,evidencePath:k.evidencePath,gates:Array.isArray(k.gates)?k.gates.slice(0,6).map(r=>({gate:r.gate,status:r.status,summary:r.summary})):void 0}:void 0,Q=h?.summary?{verdict:h.summary.verdict,exitCode:h.summary.exitCode,stepsFailed:h.summary.stepsFailed,stepsMissing:h.summary.stepsMissing,blockingReasons:h.blockingReasons,missingEvidence:h.missingEvidence}:void 0,Y=w?{summary:w.summary,blockingReasons:w.blockingReasons,releaseVerdict:w.releaseVerdict,evidenceFreshness:w.evidenceFreshness,sections:Array.isArray(w.sections)?w.sections.slice(0,4).map(r=>({id:r.id,title:r.title,body:r.body})):void 0}:void 0,Z=f$1?.summary?{changed:f$1.summary.changed,addedProjects:f$1.summary.addedProjects,removedProjects:f$1.summary.removedProjects,changedProjects:f$1.summary.changedProjects,workspaceChanges:f$1.summary.workspaceChanges,validationChanges:f$1.summary.validationChanges,gitChangedFiles:f$1.summary.gitChangedFiles}:void 0,ee=M.map(r=>f({id:`context.command.${r.id}`,label:`${r.id} safe command`,scope:"command",value:{display:r.display,execute:r.execute,scope:r.scope},...r.project?{project:r.project}:{},freshness:{kind:"derived",category:"structure",generatedAt:t.generatedAt,now:c,sourceArtifact:p.agentContext,sourcePath:`safeCommands.${r.id}`,reason:"Context safe commands are derived from workspace model command capabilities."}})),I=[...R,...ee],W=g({facts:I,generatedAt:c.toISOString(),now:c}),j=b$1();return {schemaVersion:re,generatedAt:c.toISOString(),agent:i,workspaceSummary:$,modelRef:p.model,knowledgeGraph:{artifact:p.knowledgeGraph,schemaVersion:q.knowledgeGraph,available:N,...typeof u?.quality?.entityCount=="number"?{entityCount:u.quality.entityCount}:{},...typeof u?.quality?.relationCount=="number"?{relationCount:u.quality.relationCount}:{},...typeof u?.quality?.proofCount=="number"?{proofCount:u.quality.proofCount}:{},queryCommands:[x("workspace graph search <query> --limit 12 --json"),x("workspace graph entities [kind] --json"),x("workspace graph evidence <entity-or-relation> --json"),x("workspace graph path <from> <to> --json")]},intelligenceChain:{schemaVersion:j.schemaVersion,contractPath:j.contractPath,currentStep:"context",canonicalReadOrder:[...j.consumers.agents.canonicalReadOrder]},workspace:{name:t.workspace.name,root:`workspace:${t.workspace.name}`,type:t.identity.workspaceType,...t.workspace.profile?{profile:t.workspace.profile}:{}},scope:{requested:e.scope??"workspace",...s?{activeProject:s.name}:{}},projects:H,safeCommands:M,facts:I,factFreshness:W,evidence:S,policies:{mode:t.policies.mode,source:t.policies.source},contracts:{exists:t.contracts.exists,path:t.contracts.workspaceContractPath},validation:n,agentInstructions:[`Read \`${p.agentIndex}\` first, then this context pack and linked evidence reports.`,"Use `workspace graph search <query> --limit 12 --json` for bounded, proof-backed retrieval before loading the full graph.",`Load \`${p.knowledgeGraph}\` only when a complete graph export is explicitly required.`,"Use this context as the workspace source of truth before inspecting random files.","Prefer workspace-level evidence over generic framework assumptions.","Use `display` commands when explaining steps to a human.","Use `execute` commands when launching commands from automation or tooling.","Treat `facts[].freshness.verifyBeforeUse` as a hard refresh requirement before using that fact in advice, fixes, or release decisions.","Do not carry extracted facts beyond their freshness contract; re-read or regenerate evidence when the contract says stale, unknown, live, or verify-before-use.","Keep project-scoped advice tied to the active project scope.","Regenerate stale grounding with `npx workspai workspace agent-sync --write --refresh-context`."],unsafeAssumptions:[...ge(t),...W.verifyBeforeUseFacts>0?[`${W.verifyBeforeUseFacts} fact(s) require verification before use; do not treat them as durable workspace structure.`]:[]],humanSummary:[$,`Evidence available: ${S.available.length}. Missing evidence groups: ${S.missing.join(", ")||"none"}.`,s?`Active project scope: ${s.name} (${s.frameworkDisplayName}).`:"Scope: whole workspace."].join(`
-`),impactSummary:B,doctorSummary:U,analyzeSummary:J,readinessSummary:X,verifySummary:Q,explainSummary:Y,diffSummary:Z}}async function je(e,t){return g$1(t,se,d(e))}export{re as a,se as b,We as c,je as d};

package/dist/pipeline-PGB5TEV3.js

@@ -1,5 +0,0 @@
-import {c}from'./chunk-VNKAISFE.js';import {c as c$1}from'./chunk-LPCWROQ3.js';import {a as a$3}from'./chunk-XPGCFVGC.js';import {g as g$1}from'./chunk-MAWHHHU3.js';import {u}from'./chunk-N2Q4MSSP.js';import {c as c$3}from'./chunk-X7FYEKLI.js';import {a as a$2}from'./chunk-YWZBGSFE.js';import {f as f$1,e}from'./chunk-NSH7TTSV.js';import {a}from'./chunk-MGL6DBOR.js';import {f,a as a$1,g}from'./chunk-OZXCNVGW.js';import {p,t,s}from'./chunk-ODK4LCEL.js';import c$2 from'chalk';import d from'path';import G from'fs-extra';function L(s){return s===0?"pass":s===2?"warn":"fail"}async function _(s){try{let a=G.readJsonSync(s),i=a.policyProfile,t=c$3(a).filter(n=>n.status==="blocking").map(n=>`${n.projectName}: ${n.message}`);return {policyProfile:typeof i?.name=="string"?i.name:void 0,blockers:[...new Set(t)].slice(0,12)}}catch{return {blockers:[]}}}function j(s){return s.some(a=>a.status==="fail")?"blocked":s.some(a=>a.status==="warn")?"needs-attention":"ready"}function V(s,a){if(a)return 3;let i=s.some(n=>n.status==="fail"),t=s.some(n=>n.status==="warn");return i?1:t?2:0}function K(s,a){return s===2&&!a?0:s}async function J(s){let a=await g$1(s,true),i=false;try{let{syncWorkspaceContract:t}=await import('./workspace-contract-VIUQT5SZ.js');await t({workspacePath:s}),i=true;}catch{i=false;}return {sync:a,contractSynced:i}}async function U(s$1={}){let a$4=d.resolve(s$1.workspacePath??process.cwd()),i=a(a$4);if(!i)throw new Error("No Workspai workspace found in current directory or parents");let t$1=[],n=[],u$1=false,m,w,g$1,h=Date.now();try{let{sync:e,contractSynced:r}=await J(i),o=e.workspaceFound&&(e.added.length>0||e.skipped>=0)||e.workspaceFound?"pass":"warn";t$1.push({name:"sync",status:o,durationMs:Date.now()-h,summary:e.workspaceFound?`registry sync complete (${e.added.length} added, ${e.skipped} existing)${r?", contract synced":""}`:"workspace not registered in global registry; contract sync attempted"}),e.workspaceFound||n.push("workspace registry entry missing \u2014 run workspai create workspace or register manually");}catch(e){u$1=true,t$1.push({name:"sync",status:"fail",durationMs:Date.now()-h,summary:`sync failed: ${e instanceof Error?e.message:String(e)}`}),n.push("workspace sync stage failed");}let P=Date.now();try{let e=await u({workspace:true,json:true,quiet:true,strict:s$1.strict===true,ci:s$1.strict!==true}),r=L(e),o=await f(i,p.doctor)??a$1(i,p.doctor),l=await _(o);t$1.push({name:"doctor",status:r,durationMs:Date.now()-P,summary:r==="pass"?"doctor workspace passed":r==="warn"?"doctor workspace reported warnings":"doctor workspace did not pass",exitCode:e,evidencePath:o,policyProfile:l.policyProfile,blockers:l.blockers}),r==="fail"?n.push(...l.blockers.length>0?l.blockers.map(O=>`doctor: ${O}`):["doctor workspace gate failed"]):r==="warn"&&n.push("doctor workspace reported warnings");}catch(e){u$1=true,t$1.push({name:"doctor",status:"fail",durationMs:Date.now()-P,summary:`doctor failed: ${e instanceof Error?e.message:String(e)}`}),n.push("doctor workspace stage failed");}if(s$1.skipAnalyze)t$1.push({name:"analyze",status:"skipped",durationMs:0,summary:"analyze stage skipped"});else {let e=Date.now();try{let r=await a$2({workspacePath:i,json:true,strict:s$1.strict===true});m=d.isAbsolute(r.enterpriseControls.evidencePath)?r.enterpriseControls.evidencePath:d.join(i,r.enterpriseControls.evidencePath);let o=r.summary.verdict==="blocked"?"fail":r.summary.verdict==="needs-attention"?"warn":"pass";t$1.push({name:"analyze",status:o,durationMs:Date.now()-e,summary:`analyze verdict: ${r.summary.verdict} (score ${r.summary.score}/100)`,evidencePath:m}),o==="fail"?n.push("analyze reported blocked verdict"):o==="warn"&&n.push("analyze reported needs-attention verdict");}catch(r){u$1=true,t$1.push({name:"analyze",status:"fail",durationMs:Date.now()-e,summary:`analyze failed: ${r instanceof Error?r.message:String(r)}`}),n.push("analyze stage failed");}}let k=Date.now();try{let e=await a$3({startPath:i,writeReport:true,skipVerify:s$1.skipVerify===true});w=e.evidencePath;let r=e.overallStatus==="pass"?"pass":e.overallStatus==="warn"?"warn":"fail";t$1.push({name:"readiness",status:r,durationMs:Date.now()-k,summary:`readiness overall: ${e.overallStatus}`,evidencePath:e.evidencePath}),r==="fail"?n.push(...e.blockingReasons.map(o=>`readiness: ${o}`)):r==="warn"&&n.push(...e.gates.filter(o=>o.status==="warn").map(o=>`readiness warn: ${o.gate}: ${o.summary}`));}catch(e){u$1=true,t$1.push({name:"readiness",status:"fail",durationMs:Date.now()-k,summary:`readiness failed: ${e instanceof Error?e.message:String(e)}`}),n.push("readiness stage failed");}if(s$1.skipAutopilot)t$1.push({name:"autopilot",status:"skipped",durationMs:0,summary:"autopilot stage skipped"});else {let e=Date.now(),r=s$1.autopilotMode??"audit";try{let o=await c({workspacePath:i,mode:r,json:true,skipPipelineStages:true});g$1=o.artifacts.reportPath;let l=o.summary.verdict==="approved"?"pass":o.summary.verdict==="partial"?"warn":"fail";t$1.push({name:"autopilot",status:l,durationMs:Date.now()-e,summary:`autopilot ${r}: ${o.summary.verdict}`,exitCode:o.summary.exitCode,evidencePath:g$1}),l!=="pass"&&n.push(...o.blockingReasons.slice(0,5));}catch(o){u$1=true,t$1.push({name:"autopilot",status:"fail",durationMs:Date.now()-e,summary:`autopilot failed: ${o instanceof Error?o.message:String(o)}`}),n.push("autopilot release stage failed");}}let N=j(t$1),S=V(t$1,u$1),I=d.join(i,t.pipelineLastRun),p$1={schemaVersion:s.pipelineLastRun.schemaVersion,generatedAt:new Date().toISOString(),workspacePath:i,summary:{verdict:N,exitCode:S,stagesPassed:t$1.filter(e=>e.status==="pass").length,stagesWarn:t$1.filter(e=>e.status==="warn").length,stagesFailed:t$1.filter(e=>e.status==="fail").length},stages:t$1,blockingReasons:[...new Set(n)],artifacts:{reportPath:I,analyzeEvidencePath:m,readinessEvidencePath:w,autopilotEvidencePath:g$1}};if(s$1.writeReport!==false){let e$1=f$1(p$1,{commandId:"workspacePipeline",exitCode:S,generatedAt:p$1.generatedAt,blockers:p$1.blockingReasons,runId:e()});await g(i,t.pipelineLastRun,e$1);}if(s$1.writeReport!==false&&s$1.noAgentSync!==true&&process.env.RAPIDKIT_NO_AGENT_SYNC!=="1"&&s$1.agentSync!==false)try{let{syncWorkspaceAgentGrounding:e}=await import('./workspace-agent-sync-Z35NTXCB.js'),r=await e({workspacePath:i,write:true,refreshContext:true,strict:false});p$1.agentGrounding={indexPath:r.indexPath,writtenFiles:r.writtenFiles,blockers:r.blockers};}catch{}return p$1}async function ue(s){let a;try{a=await U(s);}catch(t){let n=t instanceof Error?t.message:String(t);s.json?console.log(JSON.stringify(c$1({operation:"pipeline",code:"pipeline.failed",message:n}),null,2)):console.log(c$2.red(`Pipeline failed: ${n}`)),process.exit(1);}if(s.json)console.log(JSON.stringify(a,null,2));else {console.log(c$2.bold.cyan(`
-\u{1F517} Workspai Governance Pipeline
-`)),console.log(c$2.bold(`Workspace: ${c$2.cyan(d.basename(a.workspacePath))}`)),console.log(c$2.gray(`Path: ${a.workspacePath}`)),console.log(c$2.white(`Verdict: ${a.summary.verdict}  Exit: ${a.summary.exitCode}  (${a.summary.stagesPassed} pass / ${a.summary.stagesWarn} warn / ${a.summary.stagesFailed} fail)`));for(let t of a.stages){let n=t.status==="pass"?c$2.green("PASS"):t.status==="warn"?c$2.yellow("WARN"):t.status==="skipped"?c$2.gray("SKIP"):c$2.red("FAIL");console.log(` - ${t.name}: ${n} ${t.summary}`);}if(a.blockingReasons.length>0){console.log(c$2.bold(`
-Blocking reasons:`));for(let t of a.blockingReasons.slice(0,8))console.log(c$2.gray(`  \u2022 ${t}`));}console.log(c$2.gray(`
-Evidence: ${a.artifacts.reportPath}`)),a.agentGrounding?.writtenFiles.length&&console.log(c$2.gray(`Agent grounding: ${a.agentGrounding.writtenFiles.length} file(s) synced (INDEX + AGENTS.md + Copilot/Cursor/Claude hooks)`));}let i=K(a.summary.exitCode,s.strict===true);i!==0&&process.exit(i);}export{K as pipelineProcessExitCode,U as runPipeline,ue as runPipelineCommand};

package/dist/proof-carrying-change-QFH7WI2E.js

@@ -1 +0,0 @@
-export{j as abortProofCarryingChange,q as assertSealedProofCarryingChangeCurrent,c as authorizeProofCarryingChange,a as beginProofCarryingChange,p as decisionTransactionForCapsule,l as exportProofCarryingChangeCapsule,h as inspectProofCarryingChange,i as listProofCarryingChanges,e as recordProofCarryingChangeEffect,b as recordProofCarryingChangePrediction,f as recordProofCarryingChangeVerification,d as resumeProofCarryingChange,n as validateEffectReceiptInput,m as validatePredictedArchitectureChangeInput,k as validateProofCarryingChangeCapsule,o as validateVerificationReceiptInput,g as verifyProofCarryingChange}from'./chunk-WHR5SL33.js';

package/dist/workspace-knowledge-graph-snapshot-X347REDB.js

@@ -1 +0,0 @@
-export{a as readWorkspaceKnowledgeGraphSnapshot}from'./chunk-MBICKDYP.js';

package/dist/workspace-mcp-serve-NQ42PE2I.js

@@ -1,3 +0,0 @@
-import {k,h,i}from'./chunk-WHR5SL33.js';import {d,c as c$2,f as f$1,e as e$1}from'./chunk-EZPLMAW2.js';import {b}from'./chunk-37ZLNFV5.js';import {c as c$1,e}from'./chunk-IVYPC36J.js';import {c as c$3,b as b$3}from'./chunk-QYEQVNBF.js';import {b as b$2}from'./chunk-YZL7ZY7J.js';import {d as d$1}from'./chunk-W6WRT77T.js';import {b as b$1}from'./chunk-AD4ZY3RF.js';import {l}from'./chunk-2LZWBUJD.js';import {h as h$1}from'./chunk-UW4SESKD.js';import {f as f$2}from'./chunk-OZXCNVGW.js';import {a}from'./chunk-AFIFZTOY.js';import {p,r}from'./chunk-ODK4LCEL.js';import {w as w$1}from'./chunk-VQZ5PI5J.js';import y from'path';import z from'readline';import w from'fs-extra';var B=p.agentIndex,X=new Map(Object.keys(p).flatMap(e=>{let t=r[e];return t?[[p[e],t]]:[]}));function Y(e,t){return e.kind!==t.kind?false:e.kind==="project"&&t.kind==="project"?e.project.toLowerCase()===t.project.toLowerCase():e.kind==="blocker"&&t.kind==="blocker"?e.blockerId===t.blockerId:e.kind==="trace"&&t.kind==="trace"?e.diffRef===t.diffRef:true}var Z={type:"object",properties:{data:true,error:{type:"object",properties:{code:{type:"string"},message:{type:"string"}},required:["code","message"],additionalProperties:false}},oneOf:[{required:["data"]},{required:["error"]}],additionalProperties:false},Q={readOnlyHint:true,destructiveHint:false,idempotentHint:true,openWorldHint:false},V=[{name:"getWorkspaceModel",description:"Read workspace-model.json",inputSchema:{type:"object",properties:{}}},{name:"getWorkspaceKnowledgeGraph",description:"Read the current proof-backed workspace knowledge graph artifact",inputSchema:{type:"object",properties:{}}},{name:"getWorkspaceEvaluation",description:"Read the live or finalized provenance-aware model usage and verified-outcome report",inputSchema:{type:"object",properties:{live:{type:"boolean",description:"Read the live report instead of the finalized last-run report"}}}},{name:"queryWorkspaceEntities",description:"List workspace knowledge entities, optionally filtered by kind",inputSchema:{type:"object",properties:{kind:{type:"string",description:"Optional entity kind"}}}},{name:"searchWorkspaceGraph",description:"Return bounded, proof-carrying workspace context matching a text query",inputSchema:{type:"object",properties:{query:{type:"string",description:"Text, path, symbol, service, or concept to find"},kind:{type:"string",description:"Optional entity kind filter"},projectId:{type:"string",description:"Optional canonical project id filter"},limit:{type:"integer",minimum:1,maximum:100,default:12}},required:["query"]}},{name:"getWorkspaceGraphEvidence",description:"Resolve portable evidence for a knowledge graph entity or relation",inputSchema:{type:"object",properties:{query:{type:"string"}},required:["query"]}},{name:"findWorkspaceGraphPath",description:"Find a shortest proof-carrying path between two workspace entities",inputSchema:{type:"object",properties:{from:{type:"string"},to:{type:"string"}},required:["from","to"]}},{name:"getEvidenceIndex",description:"Read agent reports INDEX.json",inputSchema:{type:"object",properties:{}}},{name:"getBlockers",description:"Aggregate blocking reasons from verify, explain, and contract-verify reports",inputSchema:{type:"object",properties:{}}},{name:"getSafeCommands",description:"Read safe commands from workspace-context-agent.json",inputSchema:{type:"object",properties:{}}},{name:"getProjectContext",description:"Read scoped project context from workspace-context-agent.json",inputSchema:{type:"object",properties:{project:{type:"string",description:"Optional project name; defaults to active scope"}}}},{name:"getArtifact",description:"Read one workspace-relative artifact path",inputSchema:{type:"object",properties:{relativePath:{type:"string"}},required:["relativePath"]}},{name:"listOperationalSkills",description:"Read workspace-skills-index.json",inputSchema:{type:"object",properties:{}}},{name:"getWorkspaceExplain",description:"Build or read workspace explain report",inputSchema:{type:"object",properties:{target:{type:"string",description:"release-blocked | project:<name> | blocker:<id> | trace:<diffRef> | <project>"}}}},{name:"listProofCarryingChanges",description:"List proof-carrying changes with lifecycle, assurance, blockers, and integrity state",inputSchema:{type:"object",properties:{}}},{name:"getProofCarryingChange",description:"Read the ledger-derived state and architecture-aware assurance capsule for one change",inputSchema:{type:"object",properties:{changeId:{type:"string",description:"Canonical proof-carrying change id"}},required:["changeId"]}},{name:"validateProofCarryingChange",description:"Replay and validate one proof-carrying capsule and all hash-bound evidence references",inputSchema:{type:"object",properties:{changeId:{type:"string",description:"Canonical proof-carrying change id"}},required:["changeId"]}}].map(e=>({...e,title:e.name.replace(/([a-z])([A-Z])/g,"$1 $2"),inputSchema:{...e.inputSchema,additionalProperties:false},outputSchema:Z,annotations:Q}));function ee(e){let t=e.trim().replace(/\\/g,"/");return t.length>0&&!y.isAbsolute(t)&&!t.split("/").includes("..")&&(t.startsWith(".workspai/")||t.startsWith(".rapidkit/"))}async function c(e,t){if(!ee(t))throw new Error(`Unsafe artifact path: ${t}`);let n=await f$2(e,t)??y.join(e,t);if(!await w.pathExists(n))return null;let r=await w.readJson(n),o=w$1(t),p$1=X.get(o);if(p$1&&a(r,p$1,`MCP artifact ${o}`),o===p.knowledgeGraph){let a=y.join(e,l);if(!await w.pathExists(a))throw new Error("Workspace knowledge graph cannot be consumed without its source model.");let u=await w.readJson(a);b$1(r,u);}return r}async function te(e$1){let t=[],n=new Set,o=((await c(e$1,d$1))?.blockingReasons??[]).filter(i=>typeof i=="string"&&i.trim().length>0);if(o.length>0){t.push({artifact:d$1,reasons:o});for(let i of o)n.add(i);}let p=await c(e$1,c$3);if(e(p)){let i=(p.blockingReasons??[]).filter(l=>typeof l=="string"&&l.trim().length>0);if(i.length>0){t.push({artifact:c$3,reasons:i});for(let l of i)n.add(l);}}let a=await c(e$1,h$1),u=(a?.violations??[]).filter(i=>typeof i=="string"&&i.trim().length>0);if(u.length>0||String(a?.status??"").toLowerCase()==="failed"){let i=u.length>0?u:["Workspace contract verification failed"];t.push({artifact:h$1,reasons:i});for(let l of i)n.add(l);}return {blockingReasons:[...n],sources:t}}async function D(e$2,t,n){switch(t){case "getWorkspaceModel":return c(e$2,l);case "getWorkspaceKnowledgeGraph":return c(e$2,p.knowledgeGraph);case "getWorkspaceEvaluation":return c(e$2,n.live===true?p.evaluationLive:p.evaluationLastRun);case "queryWorkspaceEntities":{let r=await c(e$2,p.knowledgeGraph);if(!r)return null;let o=String(n.kind??"").trim();return {schemaVersion:r.schemaVersion,generatedAt:r.generatedAt,entities:e$1(r,o||void 0)}}case "searchWorkspaceGraph":{let r=await c(e$2,p.knowledgeGraph);if(!r)return null;let o=typeof n.limit=="number"?n.limit:Number(n.limit??12);return f$1(r,{query:String(n.query??""),...typeof n.kind=="string"&&n.kind.trim()?{kind:n.kind.trim()}:{},...typeof n.projectId=="string"&&n.projectId.trim()?{projectId:n.projectId.trim()}:{},limit:Number.isFinite(o)?o:12,projection:"agent"})}case "getWorkspaceGraphEvidence":{let r=await c(e$2,p.knowledgeGraph);return r?c$2(r,String(n.query??"")):null}case "findWorkspaceGraphPath":{let r=await c(e$2,p.knowledgeGraph);return r?d(r,String(n.from??""),String(n.to??"")):null}case "getEvidenceIndex":return c(e$2,B);case "getBlockers":return te(e$2);case "getSafeCommands":return {safeCommands:(await c(e$2,b$2))?.safeCommands??[]};case "getProjectContext":{let r=await c(e$2,b$2);if(!r)return null;let o=String(n.project??"").trim(),p=r.scope?.activeProject??void 0,a=o||p,u=Array.isArray(r.projects)?r.projects:[],i=a&&u.find(l=>typeof l.name=="string"&&l.name.toLowerCase()===a.toLowerCase());return {workspace:r.workspace??null,scope:r.scope??null,validation:r.validation??null,project:i??null,safeCommands:r.safeCommands??[]}}case "getArtifact":{let r=String(n.relativePath??"").trim();return c(e$2,r)}case "listOperationalSkills":return c(e$2,b$3);case "getWorkspaceExplain":{let r=String(n.target??"release-blocked").trim(),o=c$1(r);if(!o)throw new Error(`Invalid explain target: ${r}`);let p=await c(e$2,c$3);return e(p)&&Y(p.target,o)?p:b({workspacePath:e$2,target:o})}case "listProofCarryingChanges":return i({workspacePath:e$2});case "getProofCarryingChange":return h({workspacePath:e$2,changeId:String(n.changeId??"").trim(),operation:"status"});case "validateProofCarryingChange":return k({workspacePath:e$2,changeId:String(n.changeId??"").trim()});default:throw new Error(`Unknown tool: ${t}`)}}var J="2026-07-28",F=["2024-11-05","2025-03-26","2025-06-18","2025-11-25"],U={name:"workspai-workspace-mcp",version:"1.0.0"};function ne(e){let t=e.params?._meta;if(!t||typeof t!="object"||Array.isArray(t))return;let n=t["io.modelcontextprotocol/protocolVersion"];return typeof n=="string"?n:void 0}function re(e,t){return !t||!e||typeof e!="object"||Array.isArray(e)?e:{...e,_meta:{...e._meta??{},"io.modelcontextprotocol/serverInfo":U}}}function g(e,t,n=false){process.stdout.write(`${JSON.stringify({jsonrpc:"2.0",id:e??null,result:re(t,n)})}
-`);}function f(e,t,n=-32e3){process.stdout.write(`${JSON.stringify({jsonrpc:"2.0",id:e??null,error:{code:n,message:t}})}
-`);}function oe(e){let t={data:e};return {content:[{type:"text",text:JSON.stringify(t,null,2)}],structuredContent:t,isError:false}}function A(e,t){return {content:[{type:"text",text:t}],structuredContent:{error:{code:e,message:t}},isError:true}}function ie(e,t){for(let n of e.inputSchema.required??[])if(!(n in t))return `Missing required argument: ${n}`;for(let[n,r]of Object.entries(t)){let o=e.inputSchema.properties[n];if(!o)return `Unknown argument for ${e.name}: ${n}`;if(o.type==="string"&&typeof r!="string")return `Argument ${n} must be a string`;if(o.type==="boolean"&&typeof r!="boolean")return `Argument ${n} must be a boolean`;if(o.type==="integer"&&(!Number.isInteger(r)||typeof r!="number"))return `Argument ${n} must be an integer`;if(typeof r=="number"){if(typeof o.minimum=="number"&&r<o.minimum)return `Argument ${n} must be at least ${o.minimum}`;if(typeof o.maximum=="number"&&r>o.maximum)return `Argument ${n} must be at most ${o.maximum}`}}return null}async function Ae(e){let t=y.resolve(e.workspacePath),n=z.createInterface({input:process.stdin,terminal:false});for await(let r of n){let o=r.trim();if(!o)continue;let p;try{p=JSON.parse(o);}catch{f(null,"Invalid JSON-RPC request",-32700);continue}let{id:a,method:u,params:i}=p,l=ne(p)===J;try{if(u==="server/discover"){g(a,{resultType:"complete",supportedVersions:[J],capabilities:{tools:{listChanged:false}},instructions:"Use bounded Workspai graph search before requesting complete workspace artifacts."},true);continue}if(u==="initialize"){let s=typeof i?.protocolVersion=="string"?i.protocolVersion:void 0,k=F.includes(s)?s:F.at(-1);g(a,{protocolVersion:k,capabilities:{tools:{listChanged:false}},serverInfo:U});continue}if(u==="notifications/initialized")continue;if(u==="tools/list"){g(a,{tools:V.map(s=>({name:s.name,title:s.title,description:s.description,inputSchema:s.inputSchema,outputSchema:s.outputSchema,annotations:s.annotations}))},l);continue}if(u==="tools/call"){let s=String(i?.name??""),k=V.find(m=>m.name===s);if(!k){f(a,`Unknown tool: ${s}`,-32602);continue}if(i?.arguments!==void 0&&(!i.arguments||typeof i.arguments!="object"||Array.isArray(i.arguments))){f(a,"Tool arguments must be an object",-32602);continue}let j=i?.arguments&&typeof i.arguments=="object"?i.arguments:{},v=ie(k,j);if(v){g(a,A("invalid_arguments",v),l);continue}try{let m=await D(t,s,j);g(a,m==null?A("artifact_not_found",`${s} returned no current workspace data`):oe(m),l);}catch(m){g(a,A("tool_execution_failed",m instanceof Error?m.message:String(m)),l);}continue}f(a,`Unsupported method: ${u??"unknown"}`,-32601);}catch(s){f(a,s instanceof Error?s.message:String(s));}}}async function je(e,t,n={}){return D(y.resolve(e),t,n)}export{V as WORKSPACE_MCP_READ_TOOLS,je as invokeMcpToolForTest,Ae as runWorkspaceMcpServe};

package/dist/workspace-repair-engine-WMJCYWO4.js

@@ -1,3 +0,0 @@
-import {a as a$2}from'./chunk-A3MYO55A.js';import {a,c,h,b,e as e$1,j,g,d as d$2}from'./chunk-DWL3PPLA.js';import {c as c$1}from'./chunk-ABMB6MJT.js';import {m as m$1}from'./chunk-V6TIT6M3.js';import {l,p}from'./chunk-BM2F5C4J.js';import {g as g$1,l as l$1,m as m$2,n,k,p as p$3,q,r}from'./chunk-N2Q4MSSP.js';import {a as a$4}from'./chunk-AO2ZI42U.js';import {a as a$3}from'./chunk-MBICKDYP.js';import {p as p$2}from'./chunk-UW4SESKD.js';import {e}from'./chunk-OZXCNVGW.js';import {a as a$1}from'./chunk-AFIFZTOY.js';import {c as c$2,d as d$1}from'./chunk-EWZZUQBR.js';import {p as p$1}from'./chunk-ODK4LCEL.js';import {c as c$3,b as b$1}from'./chunk-25AWHAB5.js';import {randomUUID,createHash}from'crypto';import {hostname}from'os';import d from'path';import {execa}from'execa';import m from'fs-extra';var Le=".workspai/repair",Ma="transaction.json",_a="source-plan.json",ka="checkpoint",La="engine.lock",Ia=5*1024*1024,Ga=25*1024*1024,za=25*1024*1024,Aa=4*1024*1024,Ka=900*1e3,Va=new Set(["package.json","pyproject.toml","requirements.txt","go.mod","Cargo.toml","composer.json","Gemfile","mix.exs","deno.json","deno.jsonc","pom.xml","build.gradle","build.gradle.kts","deps.edn","project.clj","build.sbt"]),Ja=new Set(["package.json","package-lock.json","npm-shrinkwrap.json","pnpm-lock.yaml","yarn.lock","bun.lock","bun.lockb","pyproject.toml","requirements.txt","requirements-dev.txt","uv.lock","poetry.lock","go.mod","go.sum","Cargo.toml","Cargo.lock","composer.json","composer.lock","Gemfile","Gemfile.lock","mix.exs","mix.lock","deno.json","deno.jsonc","deno.lock","Directory.Packages.props","packages.lock.json","pom.xml","build.gradle","build.gradle.kts","gradle.lockfile","deps.edn","project.clj","build.sbt"]),G={safe:0,guarded:1,invasive:2},Ua=new Set(["node","npm","npx","pnpm","yarn","bun","deno","python","python3","py","pip","pip3","poetry","uv","pytest","pip-audit","govulncheck","go","cargo","composer","bundle","bundle-audit","dotnet","mvn","mvnw","gradle","gradlew","mix","clojure","lein","sbt","make"]);function Ya(e){return [e.kind,e.id,e.projectPath??"",e.adapterId??"",e.executable??""].join("\0")}function O(e,a,r={kind:"failed-precondition"}){return {reason:e,options:a,causes:[{...r,id:r.id??`runtime:${C(e).slice(0,16)}`,message:r.message??e}]}}function Ea(e){let a=new Map,r=t=>a.set(Ya(t),t);for(let t of e.adapters){(t.support==="unsupported"||t.status==="unsupported")&&r({kind:"unsupported-adapter",id:`adapter:${t.projectPath}:${t.adapterId}`,message:t.message,projectPath:t.projectPath,adapterId:t.adapterId});for(let o of t.missingExecutables)r({kind:"missing-executable",id:`tool:${t.projectPath}:${t.adapterId}:${o}`,message:`Required repair executable is unavailable: ${o} (${t.projectPath}).`,projectPath:t.projectPath,adapterId:t.adapterId,executable:o});}for(let t of e.actions??[]){let o=We(t);(t.status==="blocked"||t.status==="guidance-only"||!o&&!t.invocation)&&r({kind:"source-repair-required",id:`action:${t.id}`,message:t.blocker||`${t.id} requires a bounded source repair proposal.`,...t.projectPath?{projectPath:t.projectPath}:{}}),G[t.risk]>G[e.maxRisk]&&r({kind:"risk-approval",id:`risk:${t.id}`,message:`${t.id} exceeds the approved ${e.maxRisk} risk ceiling.`,...t.projectPath?{projectPath:t.projectPath}:{}});}for(let t of e.preconditions.filter(o=>o.status==="failed")){if(t.id==="structured-execution"){r({kind:"source-repair-required",id:`precondition:${t.id}`,message:t.message});continue}if(t.id.startsWith("tool:")){let o=e.stages.find(i=>i.invocation&&`tool:${i.invocation.cwd}:${i.invocation.executable}`===t.id);if(o?.invocation){r({kind:"missing-executable",id:t.id,message:t.message,projectPath:o.invocation.cwd,executable:o.invocation.executable});continue}}r({kind:"failed-precondition",id:`precondition:${t.id}`,message:t.message});}if(e.decisionOptions.has("allow-force")&&r({kind:"policy-exception",id:"policy:allow-force",message:"The proposed repair requires an explicit force-install policy exception."}),e.decisionOptions.has("allow-breaking")&&r({kind:"policy-exception",id:"policy:allow-breaking",message:"The proposed repair requires an explicit breaking-change policy exception."}),a.size===0){let t=e.fallbackReasons.find(o=>o.trim().length>0);t&&r({kind:"failed-precondition",id:`decision:${C(t).slice(0,16)}`,message:t});}return [...a.values()]}function H(e){return (e?.()??new Date).toISOString()}function C(e){return createHash("sha256").update(e).digest("hex")}function K(e){return Array.isArray(e)?`[${e.map(K).join(",")}]`:e&&typeof e=="object"?`{${Object.entries(e).filter(([,a])=>a!==void 0).sort(([a],[r])=>a.localeCompare(r)).map(([a,r])=>`${JSON.stringify(a)}:${K(r)}`).join(",")}}`:e===void 0?"null":JSON.stringify(e)}function wa(e){return C(K({target:e.target,policy:e.policy,preconditions:e.preconditions,adapterEvaluations:e.adapterEvaluations??[],checkpoint:{status:e.checkpoint.status,files:e.checkpoint.files.map(({backupRef:a,...r})=>r)},stages:e.stages.map(({startedAt:a,completedAt:r,...t})=>t),decision:e.decision}))}async function $a(e,a){if(a.state!=="decision-required"||a.checkpoint.status==="captured")return;let r=wa(a),t=(await jt(e)).find(o=>o.state==="decision-required"&&o.checkpoint.status!=="captured"&&wa(o)===r);if(t)return await re(d.join(e,b),t),t}var He="causal-action-integrity:";function Sa(e){return C(K([...e].sort((a,r)=>a.id.localeCompare(r.id)).map(a=>({id:a.id,artifactKind:a.artifactKind,cardId:a.cardId,title:a.title,phase:a.phase,scope:a.scope,projectName:a.projectName,projectPath:a.projectPath,sourceStepId:a.sourceStepId,findingId:a.findingId,findingStatus:a.findingStatus,causalKey:a.causalKey,dependsOn:a.dependsOn,strategy:a.strategy,transaction:a.transaction,status:a.status,mode:a.mode,risk:a.risk,requiresApproval:a.requiresApproval,blocker:a.blocker,summary:a.summary,command:a.command,invocation:a.invocation,verifyCommand:a.verifyCommand,cwd:a.cwd,files:a.files,operation:a.operation,rollback:a.rollback,notes:a.notes}))))}function Ca(e){if(e.length===0)return;let a=Sa(e);return {id:`${He}${a}`,status:"passed",message:`${e.length} causal action(s) are semantically pinned to this approval (${a.slice(0,12)}).`}}function Xa(e){return K({cardId:e.cardId,projectName:e.projectName??null,projectPath:e.projectPath??null,findingId:e.findingId,causalKey:e.causalKey})}function ba(e){return new Set(e.map(Xa))}function I(e,a){let r=d.relative(d.resolve(e),d.resolve(a));return r===""||!r.startsWith("..")&&!d.isAbsolute(r)}async function z(e,a){let r=await m.realpath(e).catch(()=>d.resolve(e)),t=d.resolve(a);for(;!await m.pathExists(t);){let i=d.dirname(t);if(i===t)return  false;t=i;}let o=await m.realpath(t).catch(()=>d.resolve(t));return I(r,o)}function te(e,a,r){let t=d.isAbsolute(a)?d.resolve(a):d.resolve(e,a);if(!I(e,t)&&!(r&&I(d.resolve(r),t)))throw new Error(`Repair path escapes workspace boundary: ${a}`);if(!I(e,t)&&r){let o=d.resolve(r),i=d.relative(o,t).split(d.sep).join("/"),n=`external/${d.basename(o)}`;return i&&i!=="."?`${n}/${i}`:n}return d.relative(e,t).split(d.sep).join("/")||"."}function X(e){let a=e.replaceAll("\\","/").replace(/^\.\//,""),r=/^external\/([^/]+)(?:\/(.*))?$/.exec(a);if(!r)return;let t=r[2]??"";if(!t.split("/").some(o=>o===".."))return {root:`external/${r[1]}`,suffix:t}}async function T(e){if(d.isAbsolute(e.value))return d.resolve(e.value);let a=X(e.value);if(!a)return d.resolve(e.workspacePath,e.value);if(e.projectBoundary)return d.resolve(e.projectBoundary,a.suffix||".");let{contract:r}=await p$2({workspacePath:e.workspacePath}),t=r.projects.find(o=>o.relativePath.replaceAll("\\","/")===a.root||o.externalPath!==void 0&&d.basename(d.resolve(o.externalPath))===a.root.slice(9)||e.projectName!==void 0&&o.slug===e.projectName);if(!t?.externalPath)throw new Error(`Portable external project reference is not canonically registered: ${a.root}`);return d.resolve(t.externalPath,a.suffix||".")}function je(e,a,r,t){let o=te(e,a,r),i=X(o);return !i||!t?o:i.suffix?`${t}/${i.suffix}`:t}async function Za(e){if(!e.proposal.projectName&&!e.proposal.projectPath)return;let a=e.proposal.projectPath?d.resolve(e.workspacePath,e.proposal.projectPath):void 0,r=e.proposal.projectPath?.replaceAll("\\","/").replace(/^\.\//,"");if(a&&I(e.workspacePath,a)&&!X(e.proposal.projectPath??""))return a;let{contract:t}=await p$2({workspacePath:e.workspacePath}),o=t.projects.find(i=>{let n=i.externalPath?d.resolve(i.externalPath):d.resolve(e.workspacePath,i.relativePath),s=!e.proposal.projectName||i.slug===e.proposal.projectName,u=!a||n===a||i.relativePath.replaceAll("\\","/")===r;return s&&u});if(!o)throw new Error("Repair proposal project must match one canonical registered project.");return o.externalPath?d.resolve(o.externalPath):d.resolve(e.workspacePath,o.relativePath)}function ce(e,a){if(!/^[A-Za-z0-9_-]{12,128}$/.test(a))throw new Error("Invalid repair transaction id.");return d.join(e,Le,"transactions",a)}async function ae(e,a){return a.target.projectPath?T({workspacePath:e,value:a.target.projectPath,projectName:a.target.projectName}):void 0}function Se(e,a){return d.join(ce(e,a),Ma)}function Ge(e,a){return d.join(ce(e,a),_a)}async function re(e,a){await m.ensureDir(d.dirname(e));let r=`${e}.${process.pid}.${randomUUID()}.tmp`;await m.writeJson(r,a,{spaces:2}),await m.move(r,e,{overwrite:true});}function E(e,a,r,t={}){let o={sequence:e.events.length+1,at:H(t.now),type:a,...t.stageId?{stageId:t.stageId}:{},...t.status?{status:t.status}:{},message:r};e.events.push(o);let i=t.status??a,n=a==="failed"||i==="failed"?"failed":a==="cancelled"?"cancelled":a==="closed"||i==="passed"||i==="completed"?"succeeded":a==="rollback"?"rolled-back":i==="blocked"?"blocked":"running";t.stageId?c$3({blockId:`repair.${t.stageId}`,status:n,message:r,component:"workspace-repair",attributes:{transactionId:e.transactionId,repairEventType:a}}):b$1({kind:n==="failed"?"operation.failed":n==="succeeded"||n==="rolled-back"?"operation.completed":"operation.started",status:n,component:"workspace-repair",message:r,correlationId:e.transactionId,attributes:{repairEventType:a}});}async function x(e,a,r){a.revision+=1,a.updatedAt=H(r),a$1(a,c,"Workspace repair transaction"),await re(Se(e,a.transactionId),a),await re(d.join(e,b),a);}async function le(e){let a$2=await m.readJson(Se(e.workspacePath,e.transactionId));if(a$2.schemaVersion!==a)throw new Error(`Unsupported repair transaction schema: ${a$2.schemaVersion}`);return a$1(a$2,c,"Workspace repair transaction"),a$2}async function Ce(e,a){return await m.readJson(Ge(e,a))}function ne(e){return e.schemaVersion===d$2}async function de(e,a,r){let t=a.scope==="project"&&a.projectPath?a.projectPath:".",o=await T({workspacePath:e,value:t,projectBoundary:r,projectName:a.projectName});if(!I(e,o)&&!X(t)&&!(r&&d.resolve(r)===o))throw new Error(`Repair project scope escapes workspace: ${t}`);return o}function v(e){return {cwd:te(e.workspacePath,e.projectPath,e.projectPath),executable:e.executable,args:[...e.args],purpose:e.purpose,timeoutMs:e.timeoutMs??6e5}}async function Oe(e){return m.readFile(e,"utf8").catch(()=>"")}async function Qa(e){return m.readJson(e).catch(()=>({}))}function va(e){let a=e.manager==="yarn"?[e.script]:["run",e.script];return v({...e,executable:e.manager,args:a,purpose:e.purpose})}function et(e){let a=process.platform==="win32"?(process.env.PATHEXT??".COM;.EXE;.BAT;.CMD").split(";").filter(Boolean).map(t=>t.toLowerCase()):[""],r=d.extname(e).length>0;return (process.env.PATH??"").split(d.delimiter).filter(Boolean).flatMap(t=>r?[d.join(t,e)]:a.map(o=>d.join(t,`${e}${o}`)))}function Pa(e){return e?.isFile()?process.platform==="win32"||(e.mode&73)!==0:false}async function ya(e,a){try{let r=await execa(e,["--version"],{cwd:a,shell:false,reject:false,timeout:5e3,maxBuffer:65536,stdin:"ignore"});return r.exitCode!==void 0&&r.exitCode!==null}catch{return  false}}async function Wa(e){let a=await T({workspacePath:e.workspacePath,value:e.invocation.cwd,projectBoundary:e.projectBoundary});if(e.toolAvailable)return e.toolAvailable(e.invocation.executable,a);let r=e.invocation.executable;if(d.isAbsolute(r)||/^\.{1,2}[\\/]/.test(r)){let t=d.isAbsolute(r)?r:d.resolve(a,r),o=await m.stat(t).catch(()=>{});return Pa(o)&&ya(t,a)}for(let t of et(r)){let o=await m.stat(t).catch(()=>{});if(Pa(o)&&await ya(t,a))return  true}return  false}async function ze(e){let a=new Set;for(let i of e.stages){if(i.kind!=="repair"||!i.invocation)continue;let n=Te(i.invocation.executable);if(!["python","python3","py"].includes(n)||!i.invocation.args.includes("venv")||!i.invocation.args.includes(".venv"))continue;let s=await T({workspacePath:e.workspacePath,value:i.invocation.cwd});a.add(d.normalize(d.join(s,".venv",process.platform==="win32"?"Scripts/python.exe":"bin/python")));}let r=e.stages.filter(i=>i.required&&i.status!=="skipped"&&i.invocation).map(i=>i.invocation),t=new Map;for(let i of r)t.set(`${i.cwd}\0${i.executable}`,i);let o=[];for(let i of t.values()){let n=await T({workspacePath:e.workspacePath,value:i.cwd}),s=d.isAbsolute(i.executable)?d.normalize(i.executable):d.normalize(d.resolve(n,i.executable));if(a.has(s)){o.push({id:`tool:${i.cwd}:${i.executable}`,status:"passed",message:`Repair stage will create the isolated executable before use: ${i.executable} (${i.cwd}).`});continue}let u=await Wa({workspacePath:e.workspacePath,invocation:i,toolAvailable:e.toolAvailable});o.push({id:`tool:${i.cwd}:${i.executable}`,status:u?"passed":"failed",message:u?`Required repair executable is available: ${i.executable} (${i.cwd}).`:`Required repair executable is unavailable: ${i.executable} (${i.cwd}). Install or configure it, then create a fresh plan.`});}return o}function oe(e,a,r){return {id:e,kind:a,status:"skipped",required:false,risk:"safe",summary:r}}function P(e){return {id:e.id,kind:e.kind,status:e.invocation?"pending":e.required===false?"skipped":"blocked",required:e.required??true,risk:e.risk??"safe",summary:e.summary,...e.invocation?{invocation:e.invocation}:{}}}function at(e,a,r){let t=r.strategy?.find(o=>o.kind==="verify"&&o.invocation)?.invocation;if(t)return v({workspacePath:e,projectPath:a,executable:t.executable,args:t.args,purpose:"audit"})}async function tt(e){let a=await de(e.workspacePath,e.action,e.authorizedProjectRoot),r=X(e.action.projectPath??"")?.root??te(e.workspacePath,a,a),t=async g=>m.pathExists(d.join(a,g)),o=new Set,i=[],n=[],s=g=>`${r}:${e.adapterId}:${g}`,u=g=>g.forEach(f=>o.add(te(e.workspacePath,d.join(a,f),a))),c=g=>{i.push(g),g.required&&g.status==="blocked"&&n.push(g.summary);},p=at(e.workspacePath,a,e.action),k=()=>{let g$1=g.find(f=>f.id===e.adapterId);if(!g$1)throw new Error(`Unknown workspace repair adapter: ${e.adapterId}`);return {stages:i,checkpointFiles:[...o],blockers:n,adapters:[{adapterId:g$1.id,ecosystem:g$1.ecosystem,projectPath:r,manifests:g$1.manifests,support:g$1.support,status:n.length>0?"partial":"ready",requiredExecutables:[...new Set(i.filter(f=>f.required&&f.invocation).map(f=>f.invocation.executable))],missingExecutables:[],message:n.length>0?[...new Set(n)].join(" "):`${g$1.ecosystem} repair stages are deterministically planned.`}]}};if(e.adapterId==="node"&&await t("package.json")){let g=await Qa(d.join(a,"package.json")),f=g.scripts&&typeof g.scripts=="object"&&!Array.isArray(g.scripts)?g.scripts:{},b=await t("bun.lock")||await t("bun.lockb")?"bun":await t("pnpm-lock.yaml")?"pnpm":await t("yarn.lock")?"yarn":"npm",B=b==="bun"?await t("bun.lock")?"bun.lock":"bun.lockb":b==="pnpm"?"pnpm-lock.yaml":b==="yarn"?"yarn.lock":await t("npm-shrinkwrap.json")?"npm-shrinkwrap.json":"package-lock.json";u(["package.json",B]),c(P({id:s("reconcile"),kind:"reconcile",risk:"guarded",summary:`Reconcile ${b} manifest, lockfile, and installed tree.`,invocation:v({workspacePath:e.workspacePath,projectPath:a,executable:b,args:["install"],purpose:"reconcile"})}));let V=v(b==="npm"?{workspacePath:e.workspacePath,projectPath:a,executable:"npm",args:["audit","--audit-level=moderate","--json"],purpose:"audit"}:b==="pnpm"?{workspacePath:e.workspacePath,projectPath:a,executable:"pnpm",args:["audit","--audit-level=moderate","--json"],purpose:"audit"}:b==="yarn"?{workspacePath:e.workspacePath,projectPath:a,executable:"yarn",args:["npm","audit","--json","--severity","moderate"],purpose:"audit"}:{workspacePath:e.workspacePath,projectPath:a,executable:"bun",args:["audit","--json"],purpose:"audit"});return c(P({id:s("audit"),kind:"audit",summary:"Prove the dependency advisory graph is clean.",invocation:p??V})),c(typeof f.test=="string"&&f.test.trim()?P({id:s("test"),kind:"test",summary:"Run the declared project test contract.",invocation:va({workspacePath:e.workspacePath,projectPath:a,manager:b,script:"test",purpose:"test"})}):oe(s("test"),"test","No test script is declared.")),c(typeof f.build=="string"&&f.build.trim()?P({id:s("build"),kind:"build",summary:"Run the declared project build contract.",invocation:va({workspacePath:e.workspacePath,projectPath:a,manager:b,script:"build",purpose:"build"})}):oe(s("build"),"build","No build script is declared.")),k()}if(e.adapterId==="python"&&(await t("pyproject.toml")||await t("requirements.txt"))){u(["pyproject.toml","requirements.txt","uv.lock","poetry.lock"]);let g=e.action.transaction?.ecosystem.toLowerCase(),f=d.basename(e.action.invocation?.executable??"").toLowerCase().replace(/\.(?:cmd|bat|exe)$/i,""),b=f==="uv"||g==="uv"||await t("uv.lock"),B=!b&&(f==="poetry"||g==="poetry"||await t("poetry.lock")),V=!b&&!B&&["python","python3","py"].includes(f)&&(e.action.invocation?.args??[]).some(M=>M==="venv")&&(e.action.invocation?.args??[]).some(M=>M===".venv"),W=process.platform==="win32"?"python":"python3",D=d.join(a,".venv",process.platform==="win32"?"Scripts/python.exe":"bin/python");(await m.pathExists(D)||V)&&(W=D);let _=b?v({workspacePath:e.workspacePath,projectPath:a,executable:"uv",args:["sync"],purpose:"reconcile"}):B?v({workspacePath:e.workspacePath,projectPath:a,executable:"poetry",args:["install","--no-interaction"],purpose:"reconcile"}):await t("requirements.txt")&&I(e.workspacePath,W)?v({workspacePath:e.workspacePath,projectPath:a,executable:W,args:["-m","pip","install","-r","requirements.txt"],purpose:"reconcile"}):await t("pyproject.toml")&&I(e.workspacePath,W)?v({workspacePath:e.workspacePath,projectPath:a,executable:W,args:["-m","pip","install","-e","."],purpose:"reconcile"}):void 0;c(P({id:s("reconcile"),kind:"reconcile",risk:"guarded",summary:"Reconcile the isolated Python dependency environment.",invocation:_})),c(P({id:s("audit"),kind:"audit",summary:"Prove the Python advisory graph is clean.",invocation:p}));let L=await Oe(d.join(a,"pyproject.toml")),pe=await t("tests")||/\[tool\.pytest/i.test(L),Z=v(B?{workspacePath:e.workspacePath,projectPath:a,executable:"poetry",args:["run","python","-m","pytest"],purpose:"test"}:b?{workspacePath:e.workspacePath,projectPath:a,executable:"uv",args:["run","python","-m","pytest"],purpose:"test"}:{workspacePath:e.workspacePath,projectPath:a,executable:W,args:["-m","pytest"],purpose:"test"}),se=v(B?{workspacePath:e.workspacePath,projectPath:a,executable:"poetry",args:["build"],purpose:"build"}:b?{workspacePath:e.workspacePath,projectPath:a,executable:"uv",args:["build"],purpose:"build"}:{workspacePath:e.workspacePath,projectPath:a,executable:W,args:["-m","build"],purpose:"build"});return c(pe?P({id:s("test"),kind:"test",summary:"Run the Python test contract.",invocation:Z}):oe(s("test"),"test","No Python test surface is declared.")),c(/\[build-system\]/i.test(L)?P({id:s("build"),kind:"build",summary:"Build the declared Python package.",invocation:se}):oe(s("build"),"build","No Python build contract is declared.")),k()}let w=[{adapterId:"go",manifest:"go.mod",files:["go.mod","go.sum"],reconcile:["go",["mod","tidy"]],audit:["govulncheck",["-json","./..."]],test:["go",["test","./..."]],build:["go",["build","./..."]]},{adapterId:"rust",manifest:"Cargo.toml",files:["Cargo.toml","Cargo.lock"],reconcile:["cargo",["check"]],audit:["cargo",["audit","--json"]],test:["cargo",["test"]],build:["cargo",["build"]]},{adapterId:"php-composer",manifest:"composer.json",files:["composer.json","composer.lock"],reconcile:["composer",["install","--no-interaction"]],audit:["composer",["audit","--format=json"]],test:["composer",["run-script","test"]],build:["composer",["run-script","build"]]},{adapterId:"ruby-bundler",manifest:"Gemfile",files:["Gemfile","Gemfile.lock"],reconcile:["bundle",["install"]],audit:["bundle-audit",["check","--format","json"]],test:["bundle",["exec","rake","test"]],build:["bundle",["exec","rake","build"]]},{adapterId:"elixir-mix",manifest:"mix.exs",files:["mix.exs","mix.lock"],reconcile:["mix",["deps.get"]],audit:["mix",["hex.audit"]],test:["mix",["test"]],build:["mix",["compile","--warnings-as-errors"]]},{adapterId:"deno",manifest:"deno.json",alternateManifest:"deno.jsonc",files:["deno.json","deno.lock"],reconcile:["deno",["install"]],audit:["deno",["audit"]],test:["deno",["task","test"]],build:["deno",["task","build"]]}];for(let g of w){if(g.adapterId!==e.adapterId)continue;let f=await t(g.manifest)?g.manifest:g.alternateManifest&&await t(g.alternateManifest)?g.alternateManifest:void 0;if(!f)continue;u(g.files),c(P({id:s("reconcile"),kind:"reconcile",risk:"guarded",summary:`Reconcile ${f} and its lock/baseline.`,invocation:v({workspacePath:e.workspacePath,projectPath:a,executable:g.reconcile[0],args:g.reconcile[1],purpose:"reconcile"})})),c(P({id:s("audit"),kind:"audit",summary:"Run the runtime-native dependency audit.",invocation:p??(g.audit?v({workspacePath:e.workspacePath,projectPath:a,executable:g.audit[0],args:g.audit[1],purpose:"audit"}):void 0)}));let b=await Oe(d.join(a,f)),B=g.manifest==="composer.json"||g.adapterId==="deno"?/["']test["']\s*:/.test(b):g.manifest==="Gemfile"?await t("Rakefile"):true,V=g.manifest==="composer.json"||g.manifest==="deno.json"?/["']build["']\s*:/.test(b):g.manifest==="Gemfile"?(await m.readdir(a)).some(W=>W.endsWith(".gemspec")):true;return c(B?P({id:s("test"),kind:"test",summary:"Run the runtime-native test contract.",invocation:v({workspacePath:e.workspacePath,projectPath:a,executable:g.test[0],args:g.test[1],purpose:"test"})}):oe(s("test"),"test","No test contract is declared.")),c(V?P({id:s("build"),kind:"build",summary:"Run the runtime-native build contract.",invocation:v({workspacePath:e.workspacePath,projectPath:a,executable:g.build[0],args:g.build[1],purpose:"build"})}):oe(s("build"),"build","No build contract is declared.")),k()}let j=await m.readdir(a).catch(()=>[]);if(e.adapterId==="dotnet"&&j.some(g=>/\.(?:cs|fs|vb)proj$|\.sln$/i.test(g)))return u(["Directory.Packages.props","packages.lock.json",...j.filter(g=>/\.(?:cs|fs|vb)proj$|\.sln$/i.test(g))]),c(P({id:s("reconcile"),kind:"reconcile",risk:"guarded",summary:"Restore the NuGet dependency graph.",invocation:v({workspacePath:e.workspacePath,projectPath:a,executable:"dotnet",args:["restore"],purpose:"reconcile"})})),c(P({id:s("audit"),kind:"audit",summary:"Prove the NuGet advisory graph is clean.",invocation:p??v({workspacePath:e.workspacePath,projectPath:a,executable:"dotnet",args:["package","list","--vulnerable","--include-transitive","--format","json"],purpose:"audit"})})),c(P({id:s("test"),kind:"test",summary:"Run .NET tests.",invocation:v({workspacePath:e.workspacePath,projectPath:a,executable:"dotnet",args:["test","--no-restore"],purpose:"test"})})),c(P({id:s("build"),kind:"build",summary:"Build the .NET project.",invocation:v({workspacePath:e.workspacePath,projectPath:a,executable:"dotnet",args:["build","--no-restore"],purpose:"build"})})),k();let y=await t("mvnw")?"./mvnw":await t("mvnw.cmd")?".\\mvnw.cmd":"mvn";if(e.adapterId==="jvm-maven"&&await t("pom.xml"))return u(["pom.xml"]),c(P({id:s("reconcile"),kind:"reconcile",risk:"guarded",summary:"Resolve the Maven dependency graph.",invocation:v({workspacePath:e.workspacePath,projectPath:a,executable:y,args:["dependency:resolve"],purpose:"reconcile"})})),c(P({id:s("audit"),kind:"audit",summary:"Run the declared JVM dependency audit.",invocation:p})),c(P({id:s("test"),kind:"test",summary:"Run Maven tests.",invocation:v({workspacePath:e.workspacePath,projectPath:a,executable:y,args:["test"],purpose:"test"})})),c(P({id:s("build"),kind:"build",summary:"Build the Maven artifact.",invocation:v({workspacePath:e.workspacePath,projectPath:a,executable:y,args:["package","-DskipTests"],purpose:"build"})})),k();let $=await t("build.gradle.kts")?"build.gradle.kts":await t("build.gradle")?"build.gradle":void 0;if(e.adapterId==="jvm-gradle"&&$){let g=await t("gradlew")?"./gradlew":await t("gradlew.bat")?".\\gradlew.bat":"gradle";return u([$,"gradle.lockfile","gradle/libs.versions.toml"]),c(P({id:s("reconcile"),kind:"reconcile",risk:"guarded",summary:"Resolve the Gradle dependency graph.",invocation:v({workspacePath:e.workspacePath,projectPath:a,executable:g,args:["dependencies"],purpose:"reconcile"})})),c(P({id:s("audit"),kind:"audit",summary:"Run the declared JVM dependency audit.",invocation:p})),c(P({id:s("test"),kind:"test",summary:"Run Gradle tests.",invocation:v({workspacePath:e.workspacePath,projectPath:a,executable:g,args:["test"],purpose:"test"})})),c(P({id:s("build"),kind:"build",summary:"Build the Gradle project.",invocation:v({workspacePath:e.workspacePath,projectPath:a,executable:g,args:["build","-x","test"],purpose:"build"})})),k()}let q=await t("deps.edn")?"deps.edn":await t("project.clj")?"project.clj":void 0;if(e.adapterId==="clojure"&&q){let g=q==="deps.edn",f=await Oe(d.join(a,q)),b=g?"clojure":"lein";u([q]),c(P({id:s("reconcile"),kind:"reconcile",risk:"guarded",summary:`Resolve the ${q} dependency graph.`,invocation:v({workspacePath:e.workspacePath,projectPath:a,executable:b,args:g?["-P"]:["deps"],purpose:"reconcile"})})),c(P({id:s("audit"),kind:"audit",summary:"Run the declared Clojure dependency audit.",invocation:p}));let B=!g||/:test\b/.test(f);return c(B?P({id:s("test"),kind:"test",summary:"Run the declared Clojure test contract.",invocation:v({workspacePath:e.workspacePath,projectPath:a,executable:b,args:g?["-M:test"]:["test"],purpose:"test"})}):oe(s("test"),"test","No Clojure :test alias is declared.")),c(g?oe(s("build"),"build","No portable Clojure CLI build entrypoint is declared."):P({id:s("build"),kind:"build",summary:"Build the Leiningen project artifact.",invocation:v({workspacePath:e.workspacePath,projectPath:a,executable:"lein",args:["uberjar"],purpose:"build"})})),k()}return e.adapterId==="scala-sbt"&&await t("build.sbt")?(u(["build.sbt"]),c(P({id:s("reconcile"),kind:"reconcile",risk:"guarded",summary:"Resolve and compile the sbt dependency graph.",invocation:v({workspacePath:e.workspacePath,projectPath:a,executable:"sbt",args:["compile"],purpose:"reconcile"})})),c(P({id:s("audit"),kind:"audit",summary:"Run the declared Scala dependency audit.",invocation:p})),c(P({id:s("test"),kind:"test",summary:"Run sbt tests.",invocation:v({workspacePath:e.workspacePath,projectPath:a,executable:"sbt",args:["test"],purpose:"test"})})),c(P({id:s("build"),kind:"build",summary:"Build the sbt project artifact.",invocation:v({workspacePath:e.workspacePath,projectPath:a,executable:"sbt",args:["package"],purpose:"build"})})),k()):(n.push(`The ${e.adapterId} repair adapter no longer matches the source at ${r}; refresh evidence and create a fresh plan.`),c(P({id:s("reconcile"),kind:"reconcile",required:true,summary:n[0]})),k())}async function Ta(e){let a=i=>m.pathExists(d.join(e,i)),r=await m.readdir(e).catch(()=>[]),t=[];await a("package.json")&&t.push("node"),(await a("pyproject.toml")||await a("requirements.txt"))&&t.push("python"),await a("go.mod")&&t.push("go"),await a("Cargo.toml")&&t.push("rust"),await a("composer.json")&&t.push("php-composer"),await a("Gemfile")&&t.push("ruby-bundler"),await a("mix.exs")&&t.push("elixir-mix"),(await a("deno.json")||await a("deno.jsonc"))&&t.push("deno"),r.some(i=>/\.(?:cs|fs|vb)proj$|\.slnx?$/i.test(i))&&t.push("dotnet"),await a("pom.xml")&&t.push("jvm-maven"),(await a("build.gradle.kts")||await a("build.gradle"))&&t.push("jvm-gradle"),(await a("deps.edn")||await a("project.clj"))&&t.push("clojure"),await a("build.sbt")&&t.push("scala-sbt");let o=new Map(g.map((i,n)=>[i.id,n]));return [...new Set(t)].sort((i,n)=>(o.get(i)??999)-(o.get(n)??999))}function rt(e){let a=e?.trim().toLowerCase();if(a){if(["npm","pnpm","yarn","bun","node","javascript","typescript"].includes(a))return "node";if(["python","pip","poetry","uv"].includes(a))return "python";if(["go","gomod","go-modules"].includes(a))return "go";if(["rust","cargo"].includes(a))return "rust";if(["php","composer"].includes(a))return "php-composer";if(["ruby","bundler","bundle"].includes(a))return "ruby-bundler";if(["elixir","mix"].includes(a))return "elixir-mix";if(a==="deno")return "deno";if(["dotnet",".net","nuget"].includes(a))return "dotnet";if(["maven","jvm-maven"].includes(a))return "jvm-maven";if(["gradle","jvm-gradle"].includes(a))return "jvm-gradle";if(["clojure","lein","leiningen"].includes(a))return "clojure";if(["scala","sbt","scala-sbt"].includes(a))return "scala-sbt"}}async function Na(e,a={}){let r=await de(e.workspacePath,e.action,e.authorizedProjectRoot),t=X(e.action.projectPath??"")?.root??te(e.workspacePath,r,r),o=await Ta(r),i=rt(e.action.transaction?.ecosystem),n=i?[i]:o;if(i&&!o.includes(i)){let c=`Doctor declared the ${i} repair adapter for ${t}, but its canonical manifest is not present. Refresh Doctor evidence before repair.`;return {stages:[P({id:`${t}:${i}:reconcile`,kind:"reconcile",required:true,summary:c})],checkpointFiles:[],blockers:[c],adapters:[{adapterId:i,ecosystem:g.find(p=>p.id===i)?.ecosystem??i,projectPath:t,manifests:[],support:"conditional",status:"partial",requiredExecutables:[],missingExecutables:[],message:c}]}}if(n.length===0){let c=`No deterministic dependency transaction adapter exists for ${t}.`;return {stages:[P({id:`${t}:unsupported:reconcile`,kind:"reconcile",required:true,summary:c})],checkpointFiles:[],blockers:[c],adapters:[{adapterId:"unsupported",ecosystem:"Unknown",projectPath:t,manifests:[],support:"unsupported",status:"unsupported",requiredExecutables:[],missingExecutables:[],message:c}]}}let s={stages:[],checkpointFiles:[],blockers:[],adapters:[]};for(let c of n){let p=await tt({...e,adapterId:c});s.stages.push(...p.stages),s.checkpointFiles.push(...p.checkpointFiles),s.blockers.push(...p.blockers),s.adapters.push(...p.adapters);}s.stages=[...new Map(s.stages.map(c=>[c.id,c])).values()],s.checkpointFiles=[...new Set(s.checkpointFiles)].sort(),s.blockers=[...new Set(s.blockers)];let u=new Set;if(e.action.transaction?.kind==="dependency-materialization"){let c=new Set(e.action.transaction.requiredStages),p=Te(e.action.invocation?.executable??""),k=e.action.invocation?.args??[],w=e.action.transaction.ecosystem==="python"&&["python","python3","py"].includes(p)&&k.includes("venv")&&k.includes(".venv");w&&u.add(d.normalize(d.join(r,".venv",process.platform==="win32"?"Scripts/python.exe":"bin/python"))),s.stages=s.stages.filter(j=>j.kind==="reconcile"?w&&c.has("reconcile"):c.has(j.kind)),s.blockers=s.stages.filter(j=>j.required&&j.status==="blocked").map(j=>j.summary);}for(let c of s.adapters){let p=s.stages.filter(w=>w.id.startsWith(`${c.projectPath}:${c.adapterId}:`)),k=[];c.requiredExecutables=[...new Set(p.filter(w=>w.required&&w.invocation).map(w=>w.invocation.executable))];for(let w of p){if(!w.required||!w.invocation)continue;let j=await T({workspacePath:e.workspacePath,value:w.invocation.cwd,projectBoundary:r}),y=d.isAbsolute(w.invocation.executable)?d.normalize(w.invocation.executable):d.normalize(d.resolve(j,w.invocation.executable));u.has(y)||await Wa({workspacePath:e.workspacePath,invocation:w.invocation,projectBoundary:r,toolAvailable:a.toolAvailable})||k.push(w.invocation.executable);}c.missingExecutables=[...new Set(k)],c.missingExecutables.length>0&&(c.status="partial",c.message=`Required executable(s) unavailable: ${c.missingExecutables.join(", ")}.`);}if(n.length===1){let c=`:${n[0]}:`;for(let p of s.stages)p.id=p.id.replace(c,":");}return s}async function Xt(e={}){let a=h();if(!e.workspacePath&&!e.projectPath&&!e.project)return a;let r=d.resolve(e.workspacePath??process.cwd()),t,o;if(e.project?.trim()){let i=e.project.trim(),n=await m$1(r),s=i.replace(/\\/g,"/").replace(/^\.\//,""),u=d.resolve(r,i),c=n.resolved.filter(p=>{let k=I(r,p.projectPath)?te(r,p.projectPath):void 0;return p.name===i||k===s||d.resolve(p.projectPath)===u});if(c.length===0){let p=n.skipped.find(k=>k.name===i);throw p?new Error(`Registered project is unavailable for repair capability inspection: ${i} (${p.reason}).`):new Error(`Registered project not found for repair capability inspection: ${i}.`)}if(c.length>1)throw new Error(`Project reference is ambiguous for repair capability inspection: ${i}.`);t=d.resolve(c[0].projectPath),o=c[0].name;}else {if(t=d.resolve(r,e.projectPath??"."),!I(r,t))throw new Error("Repair capability inspection project path escapes the workspace.");o=te(r,t);}return {...a,inspection:{projectPath:o,detectedAdapters:await Ta(t)}}}function We(e){if(e.command){let a=g$1(e.command);if(a)return a}return a$4(e.operation)??void 0}async function ot(e){let a=new Set,r=e.actions[0]?await de(e.workspacePath,e.actions[0]):void 0,t=X(e.actions[0]?.projectPath??"")?e.actions[0]?.projectPath:void 0;for(let o of e.dependencyFiles){let i=await T({workspacePath:e.workspacePath,value:o,projectBoundary:r,projectName:e.actions[0]?.projectName});a.add(je(e.workspacePath,i,r,t));}for(let o of e.actions){let i=await de(e.workspacePath,o),n=X(o.projectPath??"")?i:e.workspacePath;if(!await z(n,i))throw new Error(`Repair project scope escapes workspace through a symbolic link: ${i}`);let s=o.transaction?.kind==="dependency-materialization"&&o.transaction.sourceMutationRequired===false;for(let p of s?[]:o.files){let k=await T({workspacePath:e.workspacePath,value:p,projectBoundary:X(p)?i:void 0,projectName:o.projectName});if(!await z(n,k))throw new Error(`Repair checkpoint path escapes its canonical project boundary through a symbolic link: ${p}`);a.add(je(e.workspacePath,k,i,X(o.projectPath??"")?o.projectPath:void 0));}let u=We(o);if(!u)continue;let c="path"in u?u.path:void 0;if(c){let p=d.resolve(i,c);if(!await z(n,p))throw new Error(`Repair operation target escapes its canonical project boundary through a symbolic link: ${c}`);a.add(je(e.workspacePath,p,i,X(o.projectPath??"")?o.projectPath:void 0));}}return [...a].filter(o=>o!==".").sort()}async function st(e,a){if(!a.invocation)return;let r=await de(e,a);return v({workspacePath:e,projectPath:r,executable:a.invocation.executable,args:a.invocation.args,purpose:"repair"})}function Ke(e){return C(K({sourceEvidenceHash:e.sourceEvidenceHash,target:e.target,policy:e.policy,preconditions:e.preconditions,adapterEvaluations:e.adapterEvaluations??[],stages:e.stages.map(a=>({id:a.id,kind:a.kind,required:a.required,risk:a.risk,...a.invocation?{invocation:a.invocation}:{}})),checkpointFiles:e.checkpointFiles.map(a=>({path:a.path,existed:a.existed,beforeHash:a.beforeHash,...a.mode!==void 0?{mode:a.mode}:{}}))}))}function Ve(e){return Ke({sourceEvidenceHash:e.integrity.sourceEvidenceHash,target:e.target,policy:e.policy,preconditions:e.preconditions,adapterEvaluations:e.adapterEvaluations,stages:e.stages.filter(a=>a.kind!=="rollback"),checkpointFiles:e.checkpoint.files})}function qa(e){return C(K({transactionId:e.transactionId,state:e.state,planHash:e.integrity.planHash,sourceEvidenceHash:e.integrity.sourceEvidenceHash,approvedPlanHash:e.approval.approvedPlanHash,checkpoint:{status:e.checkpoint.status,files:e.checkpoint.files.map(a=>({path:a.path,existed:a.existed,beforeHash:a.beforeHash,afterHash:a.afterHash??null,...a.mode!==void 0?{mode:a.mode}:{}}))},verification:e.verification}))}async function Zt(e){let a=d.resolve(e.workspacePath),r=await le({workspacePath:a,transactionId:e.transactionId}),t=await Ce(a,e.transactionId);if(r.state!=="closed"||r.approval.status!=="approved"||r.approval.approvedPlanHash!==r.integrity.planHash||Ve(r)!==r.integrity.planHash||!r.integrity.closureHash||qa(r)!==r.integrity.closureHash||C(K(t))!==r.integrity.sourceEvidenceHash||!ne(t)||t.goalId!==e.goalId||r.verification?.status!=="passed"||r.verification.targetStatus!=="passed"||!r.verification.sourceBinding||r.checkpoint.status!=="captured")throw new Error(`Goal repair transaction is not a current, closed, integrity-bound source transition: ${e.transactionId}`);let o=await ae(a,r);for(let i of r.checkpoint.files){let n=await T({workspacePath:a,value:i.path,projectBoundary:o,projectName:r.target.projectName});if(!I(a,n)&&!(o&&I(o,n)))throw new Error(`Goal repair checkpoint escaped its canonical source boundary: ${i.path}`);let s=await m.lstat(n).catch(()=>{});if(!s){if(i.afterHash!==null)throw new Error(`Goal repair output is no longer current: ${i.path}`);continue}if(!s.isFile()||s.isSymbolicLink())throw new Error(`Goal repair output is no longer a regular source file: ${i.path}`);let u=await m.readFile(n);if(i.afterHash!==C(u))throw new Error(`Goal repair output changed after transaction closure: ${i.path}`);if(i.mode!==void 0&&s.mode!==i.mode)throw new Error(`Goal repair output mode changed after transaction closure: ${i.path}`)}return r.verification.sourceBinding}async function $e(e,a,r){let t=[],o=[],i=0;for(let n of a){let s=await T({workspacePath:e,value:n,projectBoundary:r}),u=r&&I(d.resolve(r),s)?d.resolve(r):e;if(!I(u,s)){o.push(`Checkpoint path escapes authorized workspace/project boundaries: ${n}`);continue}if(!await z(u,s)){o.push(`Checkpoint path resolves through a link outside its authorized boundary: ${n}`);continue}let c=await m.lstat(s).catch(()=>{});if(c?.isSymbolicLink()){o.push(`Checkpoint refuses symbolic link mutation: ${n}`);continue}if(c&&!c.isFile()){o.push(`Checkpoint target is not a regular file: ${n}`);continue}if(c&&c.size>Ia){o.push(`Checkpoint file exceeds 5 MiB: ${n}`);continue}if(i+=c?.size??0,i>Ga){o.push("Checkpoint exceeds the 25 MiB transaction limit.");break}let p=c?await m.readFile(s):void 0;t.push({path:n,existed:!!c,beforeHash:p?C(p):null,...c?{mode:c.mode}:{}});}return {entries:t,errors:o}}function Ba(e){let a=e.replaceAll("\\","/"),r=a.split("/"),t=r.at(-1)??a;if(a===".workspai-workspace"||a.startsWith(".workspai/"))return "Canonical workspace state and evidence cannot be edited through a model proposal.";if(a===".git"||a.startsWith(".git/"))return "Git internals cannot be edited through a model proposal.";if(r.includes("node_modules"))return "Installed dependency trees cannot be edited through a model proposal.";if(/^\.env(?:\.|$)/i.test(t)&&!/^\.env\.(?:example|sample|template)$/i.test(t))return "Secret-bearing environment files cannot be edited through a model proposal.";if(/\.(?:pem|key|p12|pfx|jks|keystore)$/i.test(t))return "Private key and credential containers cannot be edited through a model proposal."}function it(e,a){if(!(!/\.json$/i.test(e)||a===void 0))try{JSON.parse(a);return}catch{return `${e} must contain valid JSON; comments and trailing syntax are not allowed.`}}async function nt(e){let a=await m.readJson(d.join(e,".workspai-workspace")).catch(()=>{});return typeof a?.name=="string"&&a.name.trim()?a.name.trim():d.basename(e)}function ct(e){return Va.has(e)||/\.(?:cs|fs|vb)proj$|\.sln$/i.test(e)}async function dt(e,a){let r=d.resolve(e,a),t=d.dirname(r);for(;I(e,t);){if((await m.readdir(t).catch(()=>[])).some(ct))return t;if(d.resolve(t)===d.resolve(e))break;t=d.dirname(t);}return e}function lt(e,a,r){return r.some(t=>{let o=d.resolve(e,t.path);if(!I(a,o))return  false;let i=d.basename(o);return Ja.has(i)||/\.(?:cs|fs|vb)proj$|\.sln$/i.test(i)})}function pt(e){let a=!I(e.workspacePath,e.projectPath)&&e.proposal.projectName?`external/${e.proposal.projectName}`:te(e.workspacePath,e.projectPath,e.projectPath);return {id:`proposal:${e.proposal.cardId}:${a}`,artifactKind:"workspace-repair-proposal",cardId:e.proposal.cardId,findingId:e.proposal.targetActionIds?.[0]??e.proposal.blockerSignature??"proposal",findingStatus:"blocking",causalKey:[e.proposal.cardId,e.proposal.projectName??a,e.proposal.targetActionIds?.[0]??e.proposal.blockerSignature??"proposal"].map(r=>r.trim().toLowerCase()).join(":"),title:"Validate model-proposed repair",order:1,phase:"source-repair",scope:a==="."?"workspace":"project",...e.proposal.projectName?{projectName:e.proposal.projectName}:{},...a!=="."?{projectPath:a}:{},status:"ready",mode:"edit-file",risk:"guarded",requiresApproval:true,blocker:"",summary:e.proposal.rationale,verifyCommand:"workspai workspace intelligence run --for-agent generic --strict --json",cwd:a==="."?"workspace":"project",files:e.proposal.changes.map(r=>r.path),rollback:{available:true,strategy:"idempotent"},notes:["Source changes are applied only by the CLI Repair Engine after hash-bound approval."]}}function ut(e,a){let r=Te(a.executable),[t="",o=""]=a.args;if(a.args.some(s=>/^(?:-e|--eval|-c|--command|-command)$/i.test(s)))throw new Error(`Validation ${e.id} cannot execute inline program text.`);let i=["npm","pnpm","yarn","bun"].includes(r);if(!(i&&e.kind==="audit"&&a.args.some(s=>/audit/i.test(s))||i&&["test","build"].includes(e.kind)&&(t==="run"||t===e.kind||o===e.kind)||["pytest","pip-audit","govulncheck","bundle-audit"].includes(r)||["python","python3","py"].includes(r)&&t==="-m"&&["pytest","unittest","build","pip_audit"].includes(o.replaceAll("-","_"))||r==="poetry"&&["run","check"].includes(t)||r==="uv"&&t==="run"||r==="go"&&["test","build","vet"].includes(t)||r==="cargo"&&["test","build","check","audit"].includes(t)||r==="composer"&&["audit","run-script","validate"].includes(t)||r==="bundle"&&t==="exec"&&o==="rake"||r==="dotnet"&&["test","build"].includes(t)||["mvn","mvnw","gradle","gradlew"].includes(r)&&a.args.some(s=>/^(?:test|build|check|verify|package)$/i.test(s))||r==="mix"&&(t==="test"||t==="compile"||t==="hex.audit"&&e.kind==="audit")||r==="clojure"&&t==="-M:test"&&e.kind==="test"||r==="lein"&&(t==="test"&&e.kind==="test"||t==="uberjar"&&e.kind==="build")||r==="sbt"&&(t==="test"&&e.kind==="test"||t==="package"&&e.kind==="build")||r==="deno"&&(t==="test"||t==="task"&&["test","build"].includes(o))))throw new Error(`Validation ${e.id} must use a runtime-native audit, test, or build command; arbitrary executables are not accepted from a model.`)}async function ht(e){let a=[],r=new Set,t=[],o=[],i=new Set,n=e.proposal.projectPath?d.resolve(e.workspacePath,e.proposal.projectPath):void 0;for(let s of e.proposal.validation??[]){let u=d.resolve(e.workspacePath,s.cwd),c=te(e.workspacePath,u,n),p=await m.lstat(u).catch(()=>{});if(!p?.isDirectory()||p.isSymbolicLink()||!await z(n??e.workspacePath,u)){t.push(`Validation ${s.id} requires a real directory inside the workspace.`);continue}if(n&&!I(n,u)){t.push(`Validation ${s.id} escapes the declared project scope.`);continue}if(G[s.risk]>G[e.maxRisk]){t.push(`Validation ${s.id} exceeds the approved ${e.maxRisk} risk ceiling.`);continue}let k=v({workspacePath:e.workspacePath,projectPath:u,executable:s.executable,args:s.args,purpose:s.kind,timeoutMs:s.timeoutMs});try{Je(e.workspacePath,k,e.policy,e.projectRoots),ut(s,k);}catch(w){t.push(w instanceof Error?w.message:String(w));continue}a.push(P({id:`validation:${s.id}`,kind:s.kind,risk:s.risk,required:s.required,summary:s.summary,invocation:k})),i.add(`${c}:${s.kind}`);}for(let s of e.projectRoots){let u=pt({workspacePath:e.workspacePath,projectPath:s,proposal:e.proposal}),c=await Na({workspacePath:e.workspacePath,action:u,authorizedProjectRoot:s},e.dependencies);o.push(...c.adapters);let p=lt(e.workspacePath,s,e.proposal.changes);if(p){for(let w of c.checkpointFiles)r.add(w);t.push(...c.blockers);}let k=te(e.workspacePath,s,s);for(let w of c.stages)!p&&!["test","build"].includes(w.kind)||i.has(`${k}:${w.kind}`)||a.push(w);}return {stages:[...new Map(a.map(s=>[s.id,s])).values()],checkpointFiles:[...r],blockers:[...new Set(t)],adapters:[...new Map(o.map(s=>[`${s.projectPath}:${s.adapterId}`,s])).values()]}}async function gt(e,a$3={}){let r=d.resolve(e.workspacePath),t=await a$2({workspacePath:r,includeAbsolutePaths:false,ciMode:true}),o=t.actions.filter(h=>h.cardId===e.cardId).filter(h=>!e.projectName||!h.projectName||h.projectName===e.projectName).sort((h,R)=>h.order-R.order||h.id.localeCompare(R.id)),i=e.actionId?o.filter(h=>h.id===e.actionId):o,n=t.actions.filter(h=>!e.projectName||!h.projectName||h.projectName===e.projectName).sort((h,R)=>h.order-R.order||h.id.localeCompare(R.id)),s=new Map(n.map(h=>[h.id,h])),u=h=>{let R=new Set(h.map(J=>J.id)),F=[...h];for(;F.length>0;){let J=F.pop();for(let U of J?.dependsOn??[]){let Y=s.get(U);!Y||R.has(Y.id)||(R.add(Y.id),F.push(Y));}}return n.filter(J=>R.has(J.id))},c$1=i.filter(h=>h.findingStatus==="blocking"||h.notes.includes("Doctor finding status: blocking")),p=c$1.length>0?c$1:i.filter(h=>h.findingStatus!=="informational"),k=e.actionId?i.filter(h=>h.id===e.actionId):[],w=[...p].sort((h,R)=>{let F=h.status==="ready"||h.status==="review-required"?0:1,J=R.status==="ready"||R.status==="review-required"?0:1;return F-J||h.order-R.order||h.id.localeCompare(R.id)})[0],j=w?p.filter(h=>h.cardId===w.cardId&&h.findingId===w.findingId&&h.causalKey===w.causalKey&&h.projectName===w.projectName&&h.projectPath===w.projectPath):[],y=u(e.actionId?k:j),$=e.maxRisk??"guarded",q={maxRisk:$,allowForce:e.allowForce===true,allowBreaking:e.allowBreaking===true,autoRollback:e.autoRollback!==false,strictVerify:true},g=[{id:"workspace-root",status:await m.pathExists(d.join(r,".workspai-workspace"))||await m.pathExists(d.join(r,".workspai"))?"passed":"failed",message:"Workspace root markers must exist."},{id:"actions-selected",status:y.length>0?"passed":"failed",message:y.length>0?`${y.length} governed action(s) selected.`:"No governed remediation action matches this target."}],f=Ca(y);f&&g.push(f);let b$1=[],B=[],V=[],W=[],D=new Set(["replan","manual-repair","cancel"]);for(let h of y){let R=We(h),F=await st(r,h);if(G[h.risk]<=G[$]||(W.push(`${h.id} exceeds the approved ${$} risk ceiling.`),D.add(h.risk==="invasive"?"approve-invasive":"approve-guarded")),(h.status==="blocked"||h.status==="guidance-only")&&W.push(`${h.id} is ${h.status}: ${h.blocker}`),!R&&!F&&W.push(`${h.id} has no typed operation or structured invocation.`),F)try{Je(r,F,q);}catch(U){let Y=U instanceof Error?U.message:String(U);W.push(Y),/Force-based/.test(Y)&&D.add("allow-force"),/Breaking dependency/.test(Y)&&D.add("allow-breaking");}if(b$1.push({id:`action:${h.id}`,kind:"repair",status:R||F?"pending":"blocked",required:true,risk:h.risk,summary:h.summary,...F?{invocation:F}:{}}),h.transaction){let U=await Na({workspacePath:r,action:h},a$3);b$1.push(...U.stages),B.push(...U.checkpointFiles),W.push(...U.blockers),V.push(...U.adapters);}}let _=[...new Map(b$1.map(h=>[h.id,h])).values()];b$1.splice(0,b$1.length,..._),b$1.unshift({id:"target-precondition",kind:"verify",status:"pending",required:true,risk:"safe",summary:"Refresh the exact producer and prove the approved causal target is still current before mutation."}),b$1.push({id:"target-producer-verify",kind:"verify",status:"pending",required:true,risk:"safe",summary:"Refresh the exact producer that owns the selected repair card."}),b$1.push({id:"canonical-verify",kind:"verify",status:"pending",required:true,risk:"safe",summary:"Run the complete canonical Workspace Intelligence loop in strict mode."}),g.push(...await ze({workspacePath:r,stages:b$1,toolAvailable:a$3.toolAvailable}));let L=await ot({workspacePath:r,actions:y,dependencyFiles:B}),pe=y[0]?await de(r,y[0]):void 0,Z=await $e(r,L,pe);g.push({id:"rollback-coverage",status:y.some(h=>h.mode==="edit-file"||h.mode==="run-command")&&L.length===0?"failed":"passed",message:L.length>0?`${L.length} bounded rollback candidate(s) identified.`:"No source file mutation is declared."}),g.push({id:"structured-execution",status:b$1.some(h=>h.required&&h.status==="blocked")?"failed":"passed",message:"Every executable stage must use a typed operation or structured invocation."}),g.push({id:"checkpoint-boundary",status:Z.errors.length===0?"passed":"failed",message:Z.errors.length===0?"Every mutable path is bounded, regular, size-limited, and hash-pinned.":Z.errors.join(" ")});let se=C(K(t)),M=[...new Set(y.map(h=>h.projectPath).filter(Boolean))],xe=[...new Set(y.map(h=>h.projectName).filter(Boolean))],ue=xe.length===1?xe[0]:void 0,Ie=M.length===1&&xe.length<=1,ie={cardId:e.cardId,scope:Ie?"project":"workspace",...ue?{projectName:ue}:{},...M.length===1?{projectPath:M[0]}:{},actionIds:y.map(h=>h.id)},ke=H(a$3.now),he=`repair_${randomUUID().replaceAll("-","")}`,Q=g.some(h=>h.status==="failed")||W.length>0,we=[...W,...g.filter(h=>h.status==="failed").map(h=>h.message)],be=[...new Map(V.map(h=>[`${h.projectPath}:${h.adapterId}`,h])).values()],l=Ea({actions:y,adapters:be,preconditions:g,stages:b$1,decisionOptions:D,maxRisk:$,fallbackReasons:we}),S={schemaVersion:a,transactionId:he,revision:1,createdAt:ke,updatedAt:ke,workspace:{name:t.workspace.name,rootRef:"."},target:ie,state:Q?"decision-required":"awaiting-approval",policy:q,approval:{required:true,status:"pending"},preconditions:g,adapterEvaluations:be,checkpoint:{status:L.length>0?"pending":"unavailable",files:Z.entries},stages:b$1,...Q?{decision:{reason:[...new Set(we)].join(" "),options:[...D],causes:l}}:{},events:[],integrity:{sourceEvidenceHash:se,planHash:Ke({sourceEvidenceHash:se,target:ie,policy:q,preconditions:g,adapterEvaluations:be,stages:b$1,checkpointFiles:Z.entries})}};E(S,"planned",Q?"Repair plan requires an engineering decision.":"Repair plan is ready for explicit approval.",{now:a$3.now}),a$1(S,c,"Workspace repair transaction");let N=await $a(r,S);if(N)return N;let ge=ce(r,he);return await m.ensureDir(ge),await re(Ge(r,he),t),await re(Se(r,he),S),await re(d.join(r,b),S),S}async function ft(e$1,a={}){let r=e$1.proposal.goalId;if(!r)return Ra(e$1,a);let t=d.resolve(e$1.workspacePath);return e(t,`.workspai/goals/${r}/repair-proposal`,()=>Ra({...e$1,workspacePath:t},a))}async function Ra(e,a$3={}){a$1(e.proposal,e$1,"Workspace repair proposal");let r=d.resolve(e.workspacePath),t=JSON.parse(JSON.stringify(e.proposal));if(t.goalId){let l$1=await l({workspacePath:r,goalId:t.goalId});if(!l$1.active||l$1.index.activeGoalId!==t.goalId)throw new Error(`Repair proposal Goal Pack is not active: ${t.goalId}`);if(l$1.goalPack?.state!=="ready-to-plan")throw new Error(`Repair proposal Goal Pack is not ready for proposal execution: ${l$1.goalPack?.state??"missing"}`);if((l$1.active.repairTransactionIds??(l$1.active.repairTransactionId?[l$1.active.repairTransactionId]:[])).length>=l$1.goalPack.policy.maxAttempts)throw new Error(`Goal ${t.goalId} exhausted its repair proposal budget (${l$1.goalPack.policy.maxAttempts}). Review the latest evidence before creating another Goal Pack.`);if(l$1.goalPack.scope.kind==="project"||l$1.goalPack.scope.kind==="project-set"){let N=l$1.goalPack.scope.projects;if(!t.projectName||!N.includes(t.projectName))throw new Error(l$1.goalPack.scope.kind==="project"?`Goal-bound repair must declare the exact permitted projectName (${N[0]}).`:`Goal-bound repair must declare a projectName inside the permitted Goal scope (${N.join(", ")}).`)}}let o=e.maxRisk??"guarded",i={maxRisk:o,allowForce:e.allowForce===true,allowBreaking:e.allowBreaking===true,autoRollback:e.autoRollback!==false,strictVerify:true},n=[],s=[],u=new Set(["replan","manual-repair","cancel"]),c$1=await m.pathExists(d.join(r,".workspai-workspace"))||await m.pathExists(d.join(r,".workspai"));n.push({id:"workspace-root",status:c$1?"passed":"failed",message:c$1?"Canonical workspace root markers exist.":"Workspace root markers must exist."});let p$1;try{p$1=await Za({workspacePath:r,proposal:t});}catch(l){s.push(l instanceof Error?l.message:String(l));}let k=p$1&&!I(r,p$1)&&t.projectName?`external/${t.projectName}`:void 0;if(p$1&&(t.projectName||t.projectPath)&&(t.projectPath=k??d.relative(r,p$1).split(d.sep).join("/")),t.projectPath){let l=p$1??d.resolve(r,t.projectPath),S=await m.lstat(l).catch(()=>{});(!S?.isDirectory()||S.isSymbolicLink())&&s.push("The declared project path must be a real canonical registered project directory.");}t.validation=t.validation?.map(l=>({...l,cwd:je(r,l.cwd,p$1,k)}));let w=new Set,j=new Set,y=0;for(let l of t.changes){l.path=je(r,l.path,p$1,k),l.path==="."&&s.push(`${l.id} cannot replace the workspace root.`),w.has(l.id)&&s.push(`Duplicate proposal change id: ${l.id}.`),j.has(l.path)&&s.push(`Multiple proposal changes target ${l.path}.`),w.add(l.id),j.add(l.path),y+=Buffer.byteLength(l.content??"","utf8"),y>za&&s.push("The model proposal exceeds the 25 MiB source-change limit.");let S=Ba(l.path);if(S&&s.push(`${l.path}: ${S}`),l.operation==="write"){let N=it(l.path,l.content);N&&s.push(N);}if(G[l.risk]>G[o]&&(s.push(`${l.id} exceeds the approved ${o} risk ceiling.`),u.add(l.risk==="invasive"?"approve-invasive":"approve-guarded")),t.projectPath){let N=p$1??await T({workspacePath:r,value:t.projectPath,projectName:t.projectName}),ge=await T({workspacePath:r,value:l.path,projectBoundary:N,projectName:t.projectName});I(N,ge)||s.push(`${l.path} escapes the declared project scope.`);}}let $=[...j].sort(),q=await $e(r,$,p$1);s.push(...q.errors);let g=new Map(q.entries.map(l=>[l.path,l]));for(let l of t.changes){let S=g.get(l.path);if(!S||S.beforeHash!==l.expectedBeforeHash){s.push(`${l.path} no longer matches the model's expected source hash; refresh context and re-propose.`);continue}l.operation==="delete"&&!S.existed&&s.push(`${l.path} cannot be deleted because it does not exist.`),l.operation==="write"&&S.beforeHash!==null&&C(l.content??"")===S.beforeHash&&s.push(`${l.path} is a no-op and cannot prove source progress.`);}n.push({id:"proposal-boundary",status:s.length===0?"passed":"failed",message:s.length===0?`${t.changes.length} unique, bounded, hash-pinned source change(s) validated.`:[...new Set(s)].join(" ")});let f=new Set;if(t.projectPath)f.add(p$1??d.resolve(r,t.projectPath));else for(let l of t.changes)f.add(await dt(r,l.path));let b$1=await ht({workspacePath:r,proposal:t,projectRoots:[...f].sort(),maxRisk:o,policy:i,dependencies:a$3});s.push(...b$1.blockers);let B=b$1.stages,V=B.some(l=>l.status!=="skipped"&&["audit","test","build"].includes(l.kind));n.push({id:"validation-coverage",status:V?"passed":"unknown",message:V?"Runtime-native validation is included before canonical verification.":"No runtime-native test, build, or audit command was discovered; strict canonical verification remains mandatory."});let W=[...new Set([...$,...b$1.checkpointFiles])].sort(),D=await $e(r,W,p$1);s.push(...D.errors),n.push({id:"checkpoint-boundary",status:D.errors.length===0?"passed":"failed",message:D.errors.length===0?`${D.entries.length} mutable path(s) are bounded and hash-pinned for rollback.`:D.errors.join(" ")});let _=[{id:"target-precondition",kind:"verify",status:"pending",required:true,risk:"safe",summary:"Refresh the exact producer and prove the approved causal target is still current before mutation."},...t.changes.map(l=>({id:`proposal:${l.id}`,kind:"repair",status:G[l.risk]<=G[o]?"pending":"blocked",required:true,risk:l.risk,summary:l.summary,changedPaths:[l.path]})),...B,{id:"target-producer-verify",kind:"verify",status:"pending",required:true,risk:"safe",summary:"Refresh the exact producer that owns the selected repair card."},{id:"canonical-verify",kind:"verify",status:"pending",required:true,risk:"safe",summary:"Run the complete canonical Workspace Intelligence loop in strict mode."}];n.push(...await ze({workspacePath:r,stages:_,toolAvailable:a$3.toolAvailable}));let L=new Set(_.map(l=>l.id));L.size!==_.length&&s.push("Repair proposal stage ids must be unique."),n.push({id:"stage-identity",status:L.size===_.length?"passed":"failed",message:L.size===_.length?"Every repair and validation stage has a stable unique identity.":"Repair proposal stage ids collide."});try{let l=false,S=await a$2({workspacePath:r,includeAbsolutePaths:false,ciMode:true}),N=S.actions.filter(A=>A.cardId===t.cardId&&(!t.projectName||A.projectName===t.projectName)&&(!t.projectPath||A.projectPath===t.projectPath));if(!t.targetActionIds?.length){let A=ba(N);A.size===1?t.targetActionIds=N.map(Oa=>Oa.id).sort():A.size>1&&(l=true,s.push(`Repair proposal target is ambiguous: ${A.size} independent causal finding families match card ${t.cardId}. Select one canonical action set before proposing source changes.`));}let ge=[...new Set(t.targetActionIds??[])],h=new Set(ge),R=S.actions.filter(A=>h.has(A.id)),F=new Set(R.map(A=>A.id)),J=ge.filter(A=>!F.has(A));J.length>0&&(l=true,s.push(`Repair proposal references stale or unknown causal action ids: ${J.join(", ")}.`)),R.filter(A=>A.cardId!==t.cardId||t.projectName!==void 0&&A.projectName!==t.projectName||t.projectPath!==void 0&&A.projectPath!==t.projectPath).length>0&&(l=true,s.push("Repair proposal causal actions do not belong to the declared card and project scope."));let Y=ba(R);Y.size>1&&(l=true,s.push(`Repair proposal combines ${Y.size} independent causal finding families. Create one transaction per finding family.`)),R.length>0&&!t.blockerSignature&&(l=true,s.push("Repair proposal must include the blockerSignature generation inspected by the model.")),new Set(R.map(A=>A.projectName??A.projectPath).filter(A=>!!A)).size>0&&!t.projectName&&!t.projectPath&&(l=true,s.push("Project-scoped causal actions require an explicit canonical projectName or projectPath.")),R.length>0&&R.every(A=>A.mode==="run-command"&&A.transaction?.kind==="dependency-materialization"&&A.transaction.sourceMutationRequired===false)&&(l=true,s.push("The selected causal action is command-owned and declares that source mutation is not required. Execute the canonical action instead of submitting a model source proposal.")),n.push({id:"causal-target-binding",status:!l&&(R.length>0||N.length===0)?"passed":"failed",message:R.length>0?`${R.length} action(s) bind this proposal to one canonical causal target.`:N.length===0?"No canonical remediation action exists; the bounded source proposal remains the explicit target.":"A single canonical causal target is required before source mutation."});let Ue=Ca(R);Ue&&n.push(Ue);}catch{}let pe=C(K(t)),Z={cardId:t.cardId,scope:t.projectPath||t.projectName?"project":"workspace",...t.projectName?{projectName:t.projectName}:{},...t.projectPath?{projectPath:t.projectPath}:{},...t.blockerSignature?{blockerSignature:t.blockerSignature}:{},actionIds:t.targetActionIds&&t.targetActionIds.length>0?[...new Set(t.targetActionIds)].sort():t.changes.map(l=>`proposal:${l.id}`)},se=H(a$3.now),M=`repair_${randomUUID().replaceAll("-","")}`,ue=n.some(l=>l.status==="failed")||s.length>0,Ie=[...s,...n.filter(l=>l.status==="failed"&&l.id!=="proposal-boundary").map(l=>l.message)],ie=Ea({adapters:b$1.adapters,preconditions:n,stages:_,decisionOptions:u,maxRisk:o,fallbackReasons:Ie});for(let l of t.changes)G[l.risk]<=G[o]||ie.push({kind:"risk-approval",id:`risk:${l.id}`,message:`${l.id} exceeds the approved ${o} risk ceiling.`,...t.projectPath?{projectPath:t.projectPath}:{}});let ke=ie.length>0&&ie.every(l=>l.kind==="failed-precondition")&&n.some(l=>l.id==="proposal-boundary"&&l.status==="failed"),he=ke?["replan","cancel"]:[...u],Q={schemaVersion:a,transactionId:M,revision:1,createdAt:se,updatedAt:se,workspace:{name:await nt(r),rootRef:"."},target:Z,state:ue?"decision-required":"awaiting-approval",policy:i,approval:{required:true,status:"pending"},preconditions:n,adapterEvaluations:b$1.adapters,checkpoint:{status:"pending",files:D.entries},stages:_,...ue?{decision:{reason:[...new Set(Ie)].join(" "),options:he,causes:ie}}:{},events:[],integrity:{sourceEvidenceHash:pe,planHash:Ke({sourceEvidenceHash:pe,target:Z,policy:i,preconditions:n,adapterEvaluations:b$1.adapters,stages:_,checkpointFiles:D.entries})}};E(Q,"planned",ue?ke?"Model-proposed repair was rejected before mutation and requires causal replanning.":"Model-proposed repair requires an engineering decision.":"Model-proposed source repair is bounded and ready for explicit approval.",{now:a$3.now}),a$1(Q,c,"Workspace repair transaction");let we=await $a(r,Q);if(we)return we;let be=ce(r,M);return await m.ensureDir(be),await re(Ge(r,M),t),await re(Se(r,M),Q),await re(d.join(r,b),Q),t.goalId&&await p({workspacePath:r,goalId:t.goalId,transactionId:M}),Q}async function Qt(e,a={}){let r=await le(e);if(r.state!=="awaiting-approval")throw new Error(`Repair transaction is not awaiting approval: ${r.state}`);if(Ve(r)!==r.integrity.planHash)return r.approval.status="expired",r.state="decision-required",r.decision=O("The compiled repair plan changed after planning.",["cancel"]),await x(e.workspacePath,r,a.now),r;let t=await Ce(e.workspacePath,e.transactionId);return C(K(t))!==r.integrity.sourceEvidenceHash?(r.approval.status="expired",r.state="decision-required",r.decision=O("The persisted source plan changed after planning.",["cancel"]),await x(e.workspacePath,r,a.now),r):(r.approval={required:true,status:"approved",approvedAt:H(a.now),approvedBy:e.approvedBy?.trim()||"local-user",approvedPlanHash:r.integrity.planHash},r.state="approved",E(r,"approval","The immutable repair plan was explicitly approved.",{status:"approved",now:a.now}),await x(e.workspacePath,r,a.now),r)}async function Da(e,a){let r=d.join(e,Le,La);await m.ensureDir(d.dirname(r));try{let t=await m.stat(r),o=await m.readJson(r).catch(()=>({})),i=typeof o.host=="string"?o.host:void 0,n=typeof o.pid=="number"&&Number.isSafeInteger(o.pid)&&o.pid>0?o.pid:void 0,s=false;if((!i||i===hostname())&&n)try{process.kill(n,0),s=true;}catch(c){s=c!==null&&typeof c=="object"&&"code"in c&&c.code==="EPERM";}let u=!!(i&&i!==hostname());!s&&!u&&Date.now()-t.mtimeMs>Ka&&await m.remove(r);}catch{}try{await m.outputFile(r,`${JSON.stringify({transactionId:a,pid:process.pid,host:hostname(),acquiredAt:new Date().toISOString()})}
-`,{flag:"wx"});}catch{throw new Error("Another workspace repair transaction currently owns the engine lock.")}return async()=>{(await m.readJson(r).catch(async()=>{let o=await m.readFile(r,"utf8").catch(()=>"");try{return JSON.parse(o)}catch{return {}}})).transactionId===a&&await m.remove(r);}}async function Fa(e){let a=await ae(e.workspacePath,e.transaction),r=await $e(e.workspacePath,e.transaction.checkpoint.files.map(o=>o.path),a);if(r.errors.length>0)throw new Error(r.errors.join(" "));let t=new Map(r.entries.map(o=>[o.path,o]));for(let o of e.transaction.checkpoint.files){let i=t.get(o.path);if(!i||o.existed!==i.existed||o.beforeHash!==i.beforeHash||o.mode!==i.mode)throw new Error(`Checkpoint precondition changed after planning: ${o.path}. Create and approve a fresh plan.`)}}async function mt(e){if(e.transaction.checkpoint.status==="captured")return;await Fa(e);let a=d.join(ce(e.workspacePath,e.transaction.transactionId),ka);await m.ensureDir(a);for(let r=0;r<e.transaction.checkpoint.files.length;r+=1){let t=e.transaction.checkpoint.files[r],o=await ae(e.workspacePath,e.transaction),i=await T({workspacePath:e.workspacePath,value:t.path,projectBoundary:o,projectName:e.transaction.target.projectName}),n=t.existed?await m.readFile(i):void 0;if(n&&C(n)!==t.beforeHash)throw new Error(`Checkpoint source changed while it was being captured: ${t.path}. Create and approve a fresh plan.`);let s=`${ka}/${String(r).padStart(4,"0")}.bin`;if(n){let u=d.join(ce(e.workspacePath,e.transaction.transactionId),s),c=`${u}.${process.pid}.${randomUUID()}.tmp`;await m.writeFile(c,n,{flag:"wx"});let p=await m.readFile(c);if(C(p)!==t.beforeHash)throw await m.remove(c),new Error(`Checkpoint backup verification failed for ${t.path}.`);await m.move(c,u,{overwrite:true}),t.backupRef=s;}}e.transaction.checkpoint.status="captured",e.transaction.checkpoint.capturedAt=H(e.now),e.transaction.state="checkpointed",E(e.transaction,"checkpoint",`Captured ${e.transaction.checkpoint.files.length} bounded file checkpoint(s).`,{status:"captured",now:e.now});}async function ja(e,a){let r=await ae(e,a);for(let t of a.checkpoint.files){let o=await T({workspacePath:e,value:t.path,projectBoundary:r,projectName:a.target.projectName}),i=await m.readFile(o).catch(()=>{});t.afterHash=i?C(i):null;}}function Te(e){return d.posix.basename(e.replaceAll("\\","/")).toLowerCase().replace(/\.(?:bat|cmd|exe)$/i,"")}function Je(e,a,r,t=[]){let o=d.resolve(e,a.cwd);if(!(I(e,o)||t.some(c=>I(c,o))))throw new Error(`Invocation cwd escapes authorized repair boundaries: ${a.cwd}`);if(a.args.length>100||a.args.some(c=>!c||/[\0\r\n]/.test(c)))throw new Error("Invocation contains invalid arguments.");let n=Te(a.executable),s=d.isAbsolute(a.executable),u=/^\.{1,2}[\\/]/.test(a.executable);if(s&&!I(e,a.executable)&&!t.some(c=>I(c,a.executable)))throw new Error(`Invocation executable escapes authorized repair boundaries: ${a.executable}`);if(!s&&!u&&!Ua.has(n))throw new Error(`Invocation executable is not governed: ${a.executable}`);if(!r.allowForce&&a.args.some(c=>/^(?:--force|-f)$/i.test(c)))throw new Error("Force-based repair requires explicit allowForce policy approval.");if(!r.allowBreaking&&a.args.some(c=>/(?:breaking|legacy-peer-deps)/i.test(c)))throw new Error("Breaking dependency repair requires explicit allowBreaking policy approval.");if(["npx","pnpx","bunx"].includes(n)&&!a.args.includes("--no-install")&&!a.args.includes("--no"))throw new Error(`${n} cannot fetch an unreviewed package during autonomous repair.`);return {cwd:o,executable:a.executable}}async function Me(e){let a=e.projectBoundary?[d.resolve(e.projectBoundary)]:[],r=await T({workspacePath:e.workspacePath,value:e.invocation.cwd,projectBoundary:e.projectBoundary}),t=Je(e.workspacePath,{...e.invocation,cwd:r},e.policy,a),o=await m.lstat(t.cwd).catch(()=>{});if(!o?.isDirectory()||o.isSymbolicLink()||!await z(e.projectBoundary??e.workspacePath,t.cwd))throw new Error(`Invocation cwd is not a real workspace directory: ${e.invocation.cwd}`);if(d.isAbsolute(t.executable)||/^\.{1,2}[\\/]/.test(t.executable)){let s=d.isAbsolute(t.executable)?t.executable:d.resolve(t.cwd,t.executable);if(!await z(e.projectBoundary??e.workspacePath,s))throw new Error(`Invocation executable resolves outside the workspace: ${e.invocation.executable}`)}let i=Object.fromEntries(Object.entries(process.env).filter(([s])=>!/(?:TOKEN|SECRET|PASSWORD|PASSWD|API_KEY|PRIVATE_KEY|CREDENTIAL|COOKIE|AUTH)/i.test(s))),n=await execa(t.executable,e.invocation.args,{cwd:t.cwd,shell:false,reject:false,timeout:e.invocation.timeoutMs,maxBuffer:Aa,stdin:"ignore",extendEnv:false,env:{...i,NO_COLOR:"1",CI:process.env.CI??"1"}});return {exitCode:n.exitCode??null,stdout:n.stdout??"",stderr:n.stderr??""}}function kt(e){let a=j.find(t=>t.cardId===e);if(!a)throw new Error(`No canonical producer is registered for repair card ${e}.`);let r=a.verifyCommand.trim().split(/\s+/);if(r[0]!=="npx"||r[1]!=="workspai"||r.length<3)throw new Error(`Repair card ${e} publishes an invalid canonical producer command.`);return r.slice(2)}async function wt(e){let a=j.find(p=>p.cardId===e.transaction.target.cardId);if(!a)throw new Error(`No canonical producer is registered for repair card ${e.transaction.target.cardId}.`);let r=process.argv[1]?.trim();if(!r||!await m.pathExists(r))throw new Error("The running Workspai CLI entrypoint is unavailable for target verification.");let t=a.scope==="project"&&e.transaction.target.projectPath?await T({workspacePath:e.workspacePath,value:e.transaction.target.projectPath,projectName:e.transaction.target.projectName}):d.resolve(e.workspacePath);if(a.scope==="project"&&!e.transaction.target.projectPath)throw new Error(`Repair card ${a.cardId} requires an explicit project path for exact producer verification.`);let o=a.scope==="project"?t:e.workspacePath;if(!await z(o,t))throw new Error("The target producer working directory escapes the workspace boundary.");let i=d.resolve(t,a.producerArtifact);if(!I(t,i)||!await z(t,d.dirname(i)))throw new Error("The target producer artifact escapes its canonical scope.");let n=await m.stat(i).catch(()=>{}),s=Object.fromEntries(Object.entries(process.env).filter(([p])=>!/(?:TOKEN|SECRET|PASSWORD|PASSWD|API_KEY|PRIVATE_KEY|CREDENTIAL|COOKIE|AUTH)/i.test(p))),u=await execa(process.execPath,[r,...kt(a.cardId)],{cwd:t,shell:false,reject:false,timeout:15*6e4,maxBuffer:Aa,stdin:"ignore",extendEnv:false,env:{...s,NO_COLOR:"1",CI:process.env.CI??"1"}}),c=await m.stat(i).catch(()=>{});return {exitCode:u.exitCode??null,stdout:u.stdout??"",stderr:u.stderr??"",evidenceProduced:!!(c?.isFile()&&(!n||c.mtimeMs!==n.mtimeMs||c.ctimeMs!==n.ctimeMs||c.size!==n.size))}}async function bt(e){if(e.dependencies.targetVerify)return e.dependencies.targetVerify({workspacePath:e.workspacePath,transaction:e.transaction});if(e.dependencies.verify)return {status:e.workspaceStatus==="passed"?"passed":"failed",remainingActionIds:e.workspaceStatus==="passed"?[]:[...e.transaction.target.actionIds]};if(e.workspaceStatus==="failed")return {status:"unknown",remainingActionIds:[...e.transaction.target.actionIds]};try{let a=await a$2({workspacePath:e.workspacePath,includeAbsolutePaths:false,ciMode:true}),r=new Set(e.transaction.target.actionIds),t=ne(e.sourcePlan)&&Array.isArray(e.sourcePlan.targetActionIds)&&e.sourcePlan.targetActionIds.length>0,o=ne(e.sourcePlan)?a.actions.filter(i=>t?r.has(i.id):i.cardId===e.transaction.target.cardId&&(!e.transaction.target.projectName||i.projectName===e.transaction.target.projectName)&&(!e.transaction.target.projectPath||i.projectPath===e.transaction.target.projectPath)):a.actions.filter(i=>r.has(i.id));return {status:o.length===0?"passed":"failed",remainingActionIds:o.map(i=>i.id).sort()}}catch{return {status:"unknown",remainingActionIds:[...e.transaction.target.actionIds]}}}async function vt(e){if(e.dependencies.verify||e.dependencies.targetVerify)return {current:true,missingActionIds:[],semanticDrift:false};let a=e.transaction.target.actionIds.filter(u=>!u.startsWith("proposal:"));if(a.length===0)return {current:true,missingActionIds:[],semanticDrift:false};let r=await a$2({workspacePath:e.workspacePath,includeAbsolutePaths:false,ciMode:true}),t=new Set(r.actions.map(u=>u.id)),o=a.filter(u=>!t.has(u)),i=e.transaction.preconditions.map(u=>u.id).find(u=>u.startsWith(He))?.slice(He.length),n=r.actions.filter(u=>t.has(u.id)&&a.includes(u.id)),s=o.length===0&&!!i&&Sa(n)!==i;return {current:o.length===0&&!s,missingActionIds:o,semanticDrift:s}}function ee(e,a=8e3){return e.length<=a?e:`\u2026[truncated]\u2026
-${e.slice(-a)}`}async function Pt(e,a){if(a.type==="file-create")return l$1({projectPath:e,operation:a});if(a.type==="file-append")return m$2({projectPath:e,operation:a});if(a.type==="file-copy")return n({projectPath:e,operation:a});if(a.type==="package-json-script")return k({projectPath:e,packageJsonPath:a.path,scriptName:a.scriptName,scriptValue:a.scriptValue});if(a.type==="json-edit")return p$3({projectPath:e,operation:a});if(a.type==="env-key-add")return q({projectPath:e,operation:a});if(a.type==="makefile-target")return r({projectPath:e,operation:a})}async function yt(e){let a=await ae(e.workspacePath,e.transaction)??e.workspacePath,r=await T({workspacePath:e.workspacePath,value:e.change.path,projectBoundary:a,projectName:e.transaction.target.projectName});if(!I(a,r)||!await z(a,r))throw new Error(`Proposal target escaped the canonical repair boundary: ${e.change.path}`);let t=Ba(e.change.path);if(t)throw new Error(`${e.change.path}: ${t}`);let o=e.transaction.checkpoint.files.find(k=>k.path===e.change.path);if(!o)throw new Error(`Proposal target is missing from the checkpoint: ${e.change.path}`);let i=await m.readFile(r).catch(()=>{}),n=i?C(i):null;if(n!==o.beforeHash||n!==e.change.expectedBeforeHash)throw new Error(`Proposal target changed before execution: ${e.change.path}`);let s=await m.lstat(r).catch(()=>{});if(s?.isSymbolicLink()||s&&!s.isFile())throw new Error(`Proposal target must be a regular file: ${e.change.path}`);if(e.change.operation==="delete"){if(!s)throw new Error(`Proposal delete target does not exist: ${e.change.path}`);await m.remove(r);return}let u=e.change.content??"";if(Buffer.byteLength(u,"utf8")>Ia)throw new Error(`Proposal write exceeds the 5 MiB file limit: ${e.change.path}`);await m.ensureDir(d.dirname(r));let c=d.join(d.dirname(r),`.${d.basename(r)}.${process.pid}.${randomUUID()}.repair-tmp`);await m.writeFile(c,u,{encoding:"utf8",flag:"wx"}),await m.move(c,r,{overwrite:true});let p=await m.readFile(r);if(C(p)!==C(u))throw new Error(`Proposal write could not be verified: ${e.change.path}`)}async function xa(e){if(e.stage.status==="passed"||e.stage.status==="skipped")return  true;if(e.stage.status==="blocked")return  false;e.stage.status="running",e.stage.startedAt=H(e.dependencies.now),E(e.transaction,"stage",e.stage.summary,{stageId:e.stage.id,status:"running",now:e.dependencies.now}),await x(e.workspacePath,e.transaction,e.dependencies.now);try{if(e.stage.id==="target-precondition"||e.stage.id==="target-producer-verify"){let a=!!(e.dependencies.verify||e.dependencies.targetVerify||e.dependencies.runInvocation||e.dependencies.toolAvailable||e.dependencies.now),r=await(e.dependencies.runTargetProducer??(a?async()=>({exitCode:0,stdout:"",stderr:""}):wt))({workspacePath:e.workspacePath,transaction:e.transaction});e.stage.exitCode=r.exitCode,e.stage.stdoutTail=ee(r.stdout),e.stage.stderrTail=ee(r.stderr);let t=r.exitCode===2||r.exitCode===1&&"evidenceProduced"in r&&r.evidenceProduced===true;if(r.exitCode!==0&&!t){let o=ee(r.stderr||r.stdout,600).replace(/\s+/g," ").trim();throw new Error(o?`Exact card producer failed with exit ${String(r.exitCode)}: ${o}`:`Exact card producer failed with exit ${String(r.exitCode)} without refreshing its canonical artifact.`)}if(e.stage.id==="target-precondition"){let o=await vt({workspacePath:e.workspacePath,transaction:e.transaction,dependencies:e.dependencies});if(!o.current){let i=o.semanticDrift?"The selected action semantics changed after approval.":`Missing action(s): ${o.missingActionIds.join(", ")}.`;throw new Error(`The approved causal repair target changed before mutation. ${i} Create and approve a fresh plan.`)}}}else if(e.stage.kind==="repair"){let a=e.actions.get(e.stage.id);if(!a)throw new Error(`Persisted repair action is missing: ${e.stage.id}`);if(a.kind==="proposal")await yt({workspacePath:e.workspacePath,transaction:e.transaction,change:a.change});else {let r=We(a.action);if(r){let t=await de(e.workspacePath,a.action),o=await ae(e.workspacePath,e.transaction)??e.workspacePath;if(!await z(o,t))throw new Error(`Repair project scope escapes its approved canonical boundary through a symbolic link: ${a.action.projectPath??"."}`);await Pt(t,r);}else if(e.stage.invocation){let t=await(e.dependencies.runInvocation??Me)({workspacePath:e.workspacePath,invocation:e.stage.invocation,policy:e.transaction.policy,projectBoundary:await ae(e.workspacePath,e.transaction)});if(e.stage.exitCode=t.exitCode,e.stage.stdoutTail=ee(t.stdout),e.stage.stderrTail=ee(t.stderr),t.exitCode!==0)throw new Error(t.stderr||t.stdout||`Repair command exited with ${t.exitCode}.`)}else throw new Error("Repair stage has no typed operation or structured invocation.")}}else if(e.stage.invocation){let a=await(e.dependencies.runInvocation??Me)({workspacePath:e.workspacePath,invocation:e.stage.invocation,policy:e.transaction.policy,projectBoundary:await ae(e.workspacePath,e.transaction)});if(e.stage.exitCode=a.exitCode,e.stage.stdoutTail=ee(a.stdout),e.stage.stderrTail=ee(a.stderr),a.exitCode!==0)throw new Error(a.stderr||a.stdout||`${e.stage.kind} exited with ${a.exitCode}.`)}return e.stage.status="passed",e.stage.completedAt=H(e.dependencies.now),e.stage.summary=e.stage.id==="target-precondition"?`Exact ${e.transaction.target.cardId} target revalidated before mutation.`:e.stage.id==="target-producer-verify"?`Exact ${e.transaction.target.cardId} producer refreshed after mutation.`:`${e.stage.kind} completed.`,await ja(e.workspacePath,e.transaction),E(e.transaction,"stage",e.stage.summary,{stageId:e.stage.id,status:"passed",now:e.dependencies.now}),await x(e.workspacePath,e.transaction,e.dependencies.now),true}catch(a){return e.stage.status="failed",e.stage.completedAt=H(e.dependencies.now),e.stage.summary=a instanceof Error?a.message:String(a),await ja(e.workspacePath,e.transaction),E(e.transaction,"stage",e.stage.summary,{stageId:e.stage.id,status:"failed",now:e.dependencies.now}),await x(e.workspacePath,e.transaction,e.dependencies.now),false}}async function Re(e){let a=e.transaction.state==="rolling-back"||e.transaction.checkpoint.status==="restored";e.transaction.state="rolling-back",E(e.transaction,"rollback","Rollback started from the bounded transaction checkpoint.",{status:"running",now:e.dependencies.now}),await x(e.workspacePath,e.transaction,e.dependencies.now);let r=async n=>(e.transaction.checkpoint.status="conflicted",e.transaction.state="decision-required",e.transaction.decision=O(n,["manual-repair","cancel"]),E(e.transaction,"decision",n,{status:"conflicted",now:e.dependencies.now}),await x(e.workspacePath,e.transaction,e.dependencies.now),false),t=[],o=await ae(e.workspacePath,e.transaction)??e.workspacePath;for(let n of e.transaction.checkpoint.files){let s=await T({workspacePath:e.workspacePath,value:n.path,projectBoundary:o,projectName:e.transaction.target.projectName});if(!I(o,s)||!await z(o,s))return r(`Rollback refused because ${n.path} escaped the canonical repair boundary.`);let u=await m.lstat(s).catch(()=>{});if(u?.isSymbolicLink()||u&&!u.isFile())return r(`Rollback refused because ${n.path} is no longer a regular file.`);let c=u?await m.readFile(s):void 0,p=c?C(c):null,k=n.afterHash!==void 0&&p===n.afterHash,w=a&&p===n.beforeHash;if(!k&&!w)return r(`Rollback refused because ${n.path} changed outside this transaction.`);if(!n.existed){t.push({entry:n,absolute:s});continue}if(!n.backupRef)return r(`Rollback refused because the checkpoint backup is missing for ${n.path}.`);let j=d.join(ce(e.workspacePath,e.transaction.transactionId),n.backupRef),y=await m.lstat(j).catch(()=>{});if(!y?.isFile()||y.isSymbolicLink())return r(`Rollback refused because the checkpoint backup is invalid for ${n.path}.`);let $=await m.readFile(j);if(C($)!==n.beforeHash)return r(`Rollback refused because the checkpoint backup hash is invalid for ${n.path}.`);t.push({entry:n,absolute:s,backup:$});}for(let n of t){if(!n.entry.existed){await m.remove(n.absolute);continue}let s=n.backup;if(s===void 0)throw new Error(`Validated checkpoint backup disappeared for ${n.entry.path}.`);let u=d.join(d.dirname(n.absolute),`.${d.basename(n.absolute)}.${process.pid}.${randomUUID()}.rollback-tmp`);await m.ensureDir(d.dirname(n.absolute)),await m.writeFile(u,s,{flag:"wx"}),n.entry.mode!==void 0&&await m.chmod(u,n.entry.mode),await m.move(u,n.absolute,{overwrite:true});}e.transaction.checkpoint.status="restored",e.transaction.checkpoint.restoredAt=H(e.dependencies.now);let i=e.transaction.stages.filter(n=>n.kind==="reconcile"&&n.invocation);for(let n of i){let s=n.invocation;if(!s)continue;let u=`rollback:${n.id}`,c=e.transaction.stages.find(w=>w.id===u&&w.kind==="rollback"),p=c??{id:u,kind:"rollback",status:"pending",required:true,risk:n.risk,summary:"Reconcile the installed dependency tree with the restored manifest and lockfile.",invocation:s};c||e.transaction.stages.push(p),p.status="running",p.startedAt=H(e.dependencies.now),delete p.completedAt,delete p.exitCode,delete p.stdoutTail,delete p.stderrTail,E(e.transaction,"rollback",p.summary,{stageId:p.id,status:"running",now:e.dependencies.now}),await x(e.workspacePath,e.transaction,e.dependencies.now);let k;try{k=await(e.dependencies.runInvocation??Me)({workspacePath:e.workspacePath,invocation:s,policy:e.transaction.policy,projectBoundary:await ae(e.workspacePath,e.transaction)});}catch(w){k={exitCode:null,stdout:"",stderr:w instanceof Error?w.message:String(w)};}if(p.exitCode=k.exitCode,p.stdoutTail=ee(k.stdout),p.stderrTail=ee(k.stderr),p.completedAt=H(e.dependencies.now),k.exitCode!==0)return p.status="failed",p.summary=k.stderr||k.stdout||`Rollback reconciliation exited with ${k.exitCode}.`,e.transaction.state="decision-required",e.transaction.decision=O(`Source files were restored, but the installed dependency tree could not be reconciled: ${p.summary}`,["manual-repair","cancel"]),E(e.transaction,"decision",e.transaction.decision.reason,{stageId:p.id,status:"rollback-reconcile-failed",now:e.dependencies.now}),await x(e.workspacePath,e.transaction,e.dependencies.now),false;p.status="passed",p.summary="Installed dependency tree reconciled with the restored source state.",E(e.transaction,"rollback",p.summary,{stageId:p.id,status:"passed",now:e.dependencies.now});}return e.transaction.state="rolled-back",delete e.transaction.decision,E(e.transaction,"rollback","Rollback restored every bounded checkpoint file and reconciled dependency state.",{status:"passed",now:e.dependencies.now}),await x(e.workspacePath,e.transaction,e.dependencies.now),true}async function er(e,a={}){let r=d.resolve(e.workspacePath),t=await Da(r,e.transactionId);try{let o=await le({workspacePath:r,transactionId:e.transactionId});if(!["approved","checkpointed","executing","verifying","rollback-required","rolling-back"].includes(o.state))throw new Error(`Repair transaction cannot execute from state ${o.state}.`);if(o.approval.status!=="approved"||o.approval.approvedPlanHash!==o.integrity.planHash)throw new Error("Repair approval is missing, expired, or bound to another plan revision.");if(Ve(o)!==o.integrity.planHash)return o.approval.status="expired",o.state="decision-required",o.decision=O("The compiled repair plan changed after approval. Create and approve a fresh transaction.",["cancel"]),E(o,"decision",o.decision.reason,{status:"integrity-failed",now:a.now}),await x(r,o,a.now),o;let i=await Ce(r,e.transactionId);if(C(K(i))!==o.integrity.sourceEvidenceHash)return o.approval.status="expired",o.state="decision-required",o.decision=O("Persisted remediation evidence changed after approval. Create and approve a fresh transaction.",["cancel"]),E(o,"decision",o.decision.reason,{status:"integrity-failed",now:a.now}),await x(r,o,a.now),o;if(o.state==="approved"&&ne(i)&&i.goalId){let f=await l({workspacePath:r,goalId:i.goalId}),b=f.active?.repairTransactionIds??(f.active?.repairTransactionId?[f.active.repairTransactionId]:[]);if(f.index.activeGoalId!==i.goalId||!b.includes(o.transactionId))throw new Error(`Goal-bound repair transaction is not linked to the active Goal Pack: ${o.transactionId}`)}let s=(await ze({workspacePath:r,stages:o.stages,toolAvailable:a.toolAvailable})).find(f=>f.status==="failed");if(s){let f=o.stages.find(b=>b.invocation&&`tool:${b.invocation.cwd}:${b.invocation.executable}`===s.id)?.invocation?.executable;return o.approval.status="expired",o.state="decision-required",o.decision=O(`${s.message} The approved plan cannot execute against a changed toolchain.`,["manual-repair","cancel"],{kind:"missing-executable",id:s.id,message:s.message,...f?{executable:f}:{}}),E(o,"decision",o.decision.reason,{status:"tool-precondition-failed",now:a.now}),await x(r,o,a.now),o}if(o.state==="rollback-required"||o.state==="rolling-back"){if(!["captured","restored"].includes(o.checkpoint.status))throw new Error("A captured checkpoint is required to resume rollback.");return await Re({workspacePath:r,transaction:o,dependencies:a}),o}let u=new Map(ne(i)?i.changes.map(f=>[`proposal:${f.id}`,{kind:"proposal",change:f}]):i.actions.map(f=>[`action:${f.id}`,{kind:"canonical",action:f}]));try{await Fa({workspacePath:r,transaction:o});}catch(f){return o.approval.status="expired",o.state="decision-required",o.decision=O(f instanceof Error?f.message:String(f),["cancel"]),E(o,"decision",o.decision.reason,{status:"source-precondition-failed",now:a.now}),await x(r,o,a.now),o}let c=o.stages.find(f=>f.id==="target-precondition");if(!c)return o.approval.status="expired",o.state="decision-required",o.decision=O("The approved plan has no exact target precondition. Create and approve a fresh transaction.",["cancel"]),await x(r,o,a.now),o;if(!await xa({workspacePath:r,transaction:o,stage:c,actions:u,dependencies:a}))return o.approval.status="expired",o.state="decision-required",o.decision=O(`Target precondition failed before checkpoint: ${c.summary}`,["cancel"]),E(o,"decision",o.decision.reason,{status:"target-precondition-failed",now:a.now}),await x(r,o,a.now),o;try{await mt({workspacePath:r,transaction:o,now:a.now});}catch(f){return o.approval.status="expired",o.state="decision-required",o.decision=O(f instanceof Error?f.message:String(f),["cancel"]),E(o,"decision",o.decision.reason,{status:"precondition-failed",now:a.now}),await x(r,o,a.now),o}o.state="executing",await x(r,o,a.now);for(let f of o.stages.filter(b=>b.id!=="target-precondition"&&b.id!=="canonical-verify"&&b.kind!=="rollback"))if(!await xa({workspacePath:r,transaction:o,stage:f,actions:u,dependencies:a})&&f.required)return o.state=o.policy.autoRollback?"rollback-required":"decision-required",o.decision=O(`Required stage ${f.id} failed: ${f.summary}`,o.policy.autoRollback?["rollback","manual-repair","cancel"]:["manual-repair","rollback","cancel"]),await x(r,o,a.now),o.policy.autoRollback&&await Re({workspacePath:r,transaction:o,dependencies:a}),o;o.state="verifying";let k=o.stages.find(f=>f.id==="canonical-verify");if(!k)return o.state=o.policy.autoRollback?"rollback-required":"decision-required",o.decision=O("The approved plan has no canonical verification stage.",o.policy.autoRollback?["rollback","manual-repair","cancel"]:["manual-repair","rollback","cancel"]),await x(r,o,a.now),o.policy.autoRollback&&await Re({workspacePath:r,transaction:o,dependencies:a}),o;k.status="running",k.startedAt=H(a.now),E(o,"verification","Canonical Workspace Intelligence verification started.",{stageId:k.id,status:"running",now:a.now}),await x(r,o,a.now);let w;try{w=a.verify?await a.verify(r):await c$1({workspacePath:r,strict:true,agent:"generic"});}catch(f){w={status:"failed",exitCode:1,artifactPath:p$1.intelligenceRun},k.stderrTail=ee(f instanceof Error?f.message:String(f));}let j=w.status==="passed"&&w.exitCode===0?"passed":w.status==="failed"||w.exitCode===1?"failed":"blocked",y=await bt({workspacePath:r,transaction:o,sourcePlan:i,dependencies:a,workspaceStatus:j}),$=y.status==="passed"&&j!=="failed",q,g;if($&&ne(i)&&i.goalId){let f=await a$3(r);if(f.status==="miss")$=false,g=`Goal-bound repair could not seal its post-repair Model/Graph source state (${f.reason}).`;else {let b=f.graph.source.inputs?.hash;b?q={modelHash:d$1(f.model),modelHashSemantics:"workspace-model-structural-v1",graphHash:c$2(f.graph),graphHashSemantics:"canonical-json-v1",graphInputHash:b}:($=false,g="Goal-bound repair could not seal its post-repair Graph input fingerprint.");}}return k.status=$?"passed":"failed",k.completedAt=H(a.now),k.exitCode=w.exitCode,k.summary=$&&j==="passed"?"Selected repair target and canonical workspace verification passed.":$?"Selected repair target passed; canonical workspace verification remains blocked by other governed findings.":g||(y.status==="unknown"?"Canonical verification could not establish the selected repair target outcome.":`Selected repair target remains unresolved; canonical workspace verification is ${j}.`),o.verification={status:$?"passed":"failed",targetStatus:y.status,workspaceStatus:j,remainingActionIds:y.remainingActionIds,artifact:p$1.intelligenceRun,exitCode:w.exitCode,summary:k.summary,...q?{sourceBinding:q}:{}},E(o,"verification",k.summary,{stageId:k.id,status:k.status,now:a.now}),$?(o.state="closed",delete o.decision,E(o,"closed",k.summary,{status:"passed",now:a.now}),o.integrity.closureHash=qa(o),await x(r,o,a.now),o):(o.state=o.policy.autoRollback?"rollback-required":"decision-required",o.decision=O(k.summary,o.policy.autoRollback?["rollback","manual-repair","cancel"]:["manual-repair","rollback","cancel"]),await x(r,o,a.now),o.policy.autoRollback&&await Re({workspacePath:r,transaction:o,dependencies:a}),o)}finally{await t();}}async function Rt(e,a={}){let r=d.resolve(e.workspacePath),t=await Da(r,e.transactionId);try{let o=await le({workspacePath:r,transactionId:e.transactionId});if(!["checkpointed","executing","verifying","rollback-required","rolling-back","decision-required","failed"].includes(o.state))throw new Error(`Repair transaction cannot roll back from state ${o.state}.`);if(!["captured","restored"].includes(o.checkpoint.status))throw new Error("A captured checkpoint is required for rollback.");return await Re({workspacePath:r,transaction:o,dependencies:a}),o}finally{await t();}}async function ar(e,a={}){let r=await le(e);if(["closed","rolled-back","cancelled"].includes(r.state))return r;if(r.checkpoint.status==="captured")throw new Error("Rollback a mutated transaction before cancelling it.");return r.state="cancelled",r.approval.status=r.approval.status==="approved"?"expired":r.approval.status,E(r,"cancelled","Repair transaction cancelled before mutation.",{status:"cancelled",now:a.now}),await x(e.workspacePath,r,a.now),r}async function tr(e,a={}){let r=d.resolve(e.workspacePath),t=await le({workspacePath:r,transactionId:e.transactionId});if(t.state!=="decision-required"||!t.decision)throw new Error(`Repair transaction is not awaiting a decision: ${t.state}`);if(!t.decision.options.includes(e.decision))throw new Error(`Decision ${e.decision} is not available. Allowed: ${t.decision.options.join(", ")}.`);if(e.decision==="rollback")return Rt({workspacePath:r,transactionId:e.transactionId},a);if(e.decision==="cancel"||e.decision==="manual-repair"){if(t.checkpoint.status==="captured")throw new Error("A mutated transaction must be rolled back before control is released.");return t.state="cancelled",t.approval.status=t.approval.status==="approved"?"expired":t.approval.status,E(t,"decision",e.decision==="manual-repair"?"The user chose manual repair; this transaction released source ownership without mutation.":"The user cancelled the decision-required transaction.",{status:e.decision,now:a.now}),await x(r,t,a.now),t}if(t.checkpoint.status==="captured")throw new Error("Repair policy cannot change after a checkpoint has been captured. Roll back first.");let o=await Ce(r,e.transactionId);t.state="cancelled",t.approval.status=t.approval.status==="approved"?"expired":t.approval.status,E(t,"decision",`The user selected ${e.decision}; a fresh immutable plan and approval are required.`,{status:"superseded",now:a.now}),await x(r,t,a.now);let i={maxRisk:e.decision==="approve-invasive"?"invasive":e.decision==="approve-guarded"&&t.policy.maxRisk==="safe"?"guarded":t.policy.maxRisk,allowForce:t.policy.allowForce||e.decision==="allow-force",allowBreaking:t.policy.allowBreaking||e.decision==="allow-breaking",autoRollback:t.policy.autoRollback};if(ne(o))return ft({workspacePath:r,proposal:o,...i},a);let n=t.target.actionIds.map(s=>s.startsWith("action:")?s.slice(7):s);return gt({workspacePath:r,cardId:t.target.cardId,...n.length===1?{actionId:n[0]}:{},projectName:t.target.projectName,...i},a)}async function jt(e){let a=d.join(e,Le,"transactions"),r=await m.readdir(a).catch(()=>[]);return (await Promise.all(r.map(o=>le({workspacePath:e,transactionId:o}).catch(()=>{})))).filter(o=>!!o).sort((o,i)=>i.updatedAt.localeCompare(o.updatedAt))}export{Qt as approveWorkspaceRepair,Zt as assertClosedGoalRepairTransactionCurrent,ar as cancelWorkspaceRepair,tr as decideWorkspaceRepair,kt as exactCardProducerArgs,er as executeWorkspaceRepair,Xt as inspectWorkspaceRepairCapabilities,jt as listWorkspaceRepairTransactions,gt as planWorkspaceRepair,ft as planWorkspaceRepairProposal,le as readWorkspaceRepairTransaction,Rt as rollbackWorkspaceRepair};

package/dist/workspace-run-3S35MDX6.js

@@ -1 +0,0 @@
-export{a as runWorkspaceStage}from'./chunk-MHQHRMKU.js';export{a as WORKSPACE_RUN_LAST_REPORT_FILENAME}from'./chunk-ERVWW5HX.js';