@cleocode/cleo 2026.4.10 → 2026.4.11

package/dist/dispatch/lib/job-manager-accessor.d.ts

@@ -0,0 +1,9 @@
+/**
+ * Singleton accessor for BackgroundJobManager.
+ *
+ * @task T4820
+ */
+import type { BackgroundJobManager } from './background-jobs.js';
+export declare function setJobManager(manager: BackgroundJobManager): void;
+export declare function getJobManager(): BackgroundJobManager | null;
+//# sourceMappingURL=job-manager-accessor.d.ts.map

package/dist/dispatch/lib/job-manager-accessor.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"job-manager-accessor.d.ts","sourceRoot":"","sources":["../../../src/dispatch/lib/job-manager-accessor.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,sBAAsB,CAAC;AAIjE,wBAAgB,aAAa,CAAC,OAAO,EAAE,oBAAoB,GAAG,IAAI,CAEjE;AAED,wBAAgB,aAAa,IAAI,oBAAoB,GAAG,IAAI,CAE3D"}

package/dist/dispatch/lib/job-manager-accessor.js

@@ -0,0 +1,13 @@
+/**
+ * Singleton accessor for BackgroundJobManager.
+ *
+ * @task T4820
+ */
+let _instance = null;
+export function setJobManager(manager) {
+    _instance = manager;
+}
+export function getJobManager() {
+    return _instance;
+}
+//# sourceMappingURL=job-manager-accessor.js.map

package/dist/dispatch/lib/job-manager-accessor.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"job-manager-accessor.js","sourceRoot":"","sources":["../../../src/dispatch/lib/job-manager-accessor.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAIH,IAAI,SAAS,GAAgC,IAAI,CAAC;AAElD,MAAM,UAAU,aAAa,CAAC,OAA6B;IACzD,SAAS,GAAG,OAAO,CAAC;AACtB,CAAC;AAED,MAAM,UAAU,aAAa;IAC3B,OAAO,SAAS,CAAC;AACnB,CAAC"}

package/dist/dispatch/lib/meta.d.ts

@@ -0,0 +1,26 @@
+/**
+ * Dispatch-local metadata factory.
+ *
+ * Generates LAFS-conformant metadata for dispatch layer responses.
+ * Generates LAFS-conformant metadata for dispatch responses.
+ *
+ * @task T4772
+ */
+import type { DispatchResponse, Source } from '../types.js';
+/**
+ * Create metadata for a dispatch response.
+ *
+ * @param gateway   - Gateway name (e.g., 'query', 'mutate')
+ * @param domain    - Domain name (e.g., 'tasks', 'session')
+ * @param operation - Operation name (e.g., 'show', 'list')
+ * @param startTime - Timestamp from Date.now() at start of request
+ * @param source    - Where the request originated
+ * @param requestId - Optional pre-generated request ID
+ * @param sessionId - Optional session ID to include in metadata
+ * @returns Metadata conforming to DispatchResponse['_meta']
+ *
+ * @task T4772
+ * @task T4959
+ */
+export declare function createDispatchMeta(gateway: string, domain: string, operation: string, startTime: number, source?: Source, requestId?: string, sessionId?: string | null): DispatchResponse['_meta'];
+//# sourceMappingURL=meta.d.ts.map

package/dist/dispatch/lib/meta.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"meta.d.ts","sourceRoot":"","sources":["../../../src/dispatch/lib/meta.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAGH,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AAE5D;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,kBAAkB,CAChC,OAAO,EAAE,MAAM,EACf,MAAM,EAAE,MAAM,EACd,SAAS,EAAE,MAAM,EACjB,SAAS,EAAE,MAAM,EACjB,MAAM,GAAE,MAAc,EACtB,SAAS,CAAC,EAAE,MAAM,EAClB,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,GACxB,gBAAgB,CAAC,OAAO,CAAC,CAW3B"}

package/dist/dispatch/lib/meta.js

@@ -0,0 +1,37 @@
+/**
+ * Dispatch-local metadata factory.
+ *
+ * Generates LAFS-conformant metadata for dispatch layer responses.
+ * Generates LAFS-conformant metadata for dispatch responses.
+ *
+ * @task T4772
+ */
+import { randomUUID } from 'node:crypto';
+/**
+ * Create metadata for a dispatch response.
+ *
+ * @param gateway   - Gateway name (e.g., 'query', 'mutate')
+ * @param domain    - Domain name (e.g., 'tasks', 'session')
+ * @param operation - Operation name (e.g., 'show', 'list')
+ * @param startTime - Timestamp from Date.now() at start of request
+ * @param source    - Where the request originated
+ * @param requestId - Optional pre-generated request ID
+ * @param sessionId - Optional session ID to include in metadata
+ * @returns Metadata conforming to DispatchResponse['_meta']
+ *
+ * @task T4772
+ * @task T4959
+ */
+export function createDispatchMeta(gateway, domain, operation, startTime, source = 'cli', requestId, sessionId) {
+    return {
+        gateway: gateway,
+        domain,
+        operation,
+        timestamp: new Date().toISOString(),
+        duration_ms: Date.now() - startTime,
+        source,
+        requestId: requestId ?? randomUUID(),
+        ...(sessionId != null && { sessionId }),
+    };
+}
+//# sourceMappingURL=meta.js.map

package/dist/dispatch/lib/meta.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"meta.js","sourceRoot":"","sources":["../../../src/dispatch/lib/meta.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAGzC;;;;;;;;;;;;;;GAcG;AACH,MAAM,UAAU,kBAAkB,CAChC,OAAe,EACf,MAAc,EACd,SAAiB,EACjB,SAAiB,EACjB,SAAiB,KAAK,EACtB,SAAkB,EAClB,SAAyB;IAEzB,OAAO;QACL,OAAO,EAAE,OAA+C;QACxD,MAAM;QACN,SAAS;QACT,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;QACnC,WAAW,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS;QACnC,MAAM;QACN,SAAS,EAAE,SAAS,IAAI,UAAU,EAAE;QACpC,GAAG,CAAC,SAAS,IAAI,IAAI,IAAI,EAAE,SAAS,EAAE,CAAC;KACxC,CAAC;AACJ,CAAC"}

package/dist/dispatch/lib/param-utils.d.ts

@@ -0,0 +1,11 @@
+/**
+ * Param derivation utilities (Backward-Compat Re-export)
+ *
+ * Thin wrapper that re-exports from the canonical location at
+ * src/core/validation/param-utils.ts.
+ *
+ * @task T5706
+ */
+export type { CommanderArgSplit, JSONSchemaObject, JsonSchemaProperty, JsonSchemaType, } from '@cleocode/core/internal';
+export { buildCommanderArgs, buildCommanderOptionString, buildMcpInputSchema, camelToKebab, validateRequiredParamsDef, } from '@cleocode/core/internal';
+//# sourceMappingURL=param-utils.d.ts.map

package/dist/dispatch/lib/param-utils.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"param-utils.d.ts","sourceRoot":"","sources":["../../../src/dispatch/lib/param-utils.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,YAAY,EACV,iBAAiB,EACjB,gBAAgB,EAChB,kBAAkB,EAClB,cAAc,GACf,MAAM,yBAAyB,CAAC;AACjC,OAAO,EACL,kBAAkB,EAClB,0BAA0B,EAC1B,mBAAmB,EACnB,YAAY,EACZ,yBAAyB,GAC1B,MAAM,yBAAyB,CAAC"}

package/dist/dispatch/lib/param-utils.js

@@ -0,0 +1,10 @@
+/**
+ * Param derivation utilities (Backward-Compat Re-export)
+ *
+ * Thin wrapper that re-exports from the canonical location at
+ * src/core/validation/param-utils.ts.
+ *
+ * @task T5706
+ */
+export { buildCommanderArgs, buildCommanderOptionString, buildMcpInputSchema, camelToKebab, validateRequiredParamsDef, } from '@cleocode/core/internal';
+//# sourceMappingURL=param-utils.js.map

package/dist/dispatch/lib/param-utils.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"param-utils.js","sourceRoot":"","sources":["../../../src/dispatch/lib/param-utils.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAQH,OAAO,EACL,kBAAkB,EAClB,0BAA0B,EAC1B,mBAAmB,EACnB,YAAY,EACZ,yBAAyB,GAC1B,MAAM,yBAAyB,CAAC"}

package/dist/dispatch/lib/projections.d.ts

@@ -0,0 +1,56 @@
+/**
+ * MVI (Minimum Viable Information) projection configurations.
+ * Maps disclosure tiers to operation access and field filtering rules.
+ *
+ * @epic T4820
+ * @task T5096
+ */
+/**
+ * Disclosure tier level for MVI (Minimum Viable Information) filtering.
+ *
+ * @remarks
+ * Controls how much data is exposed in dispatch responses:
+ * - `minimal`: Only tasks, session, and admin domains; shallow depth
+ * - `standard`: Adds memory, check, pipeline, tools, sticky; medium depth
+ * - `orchestrator`: Full access including orchestrate and nexus; deep nesting
+ */
+export type MviTier = 'minimal' | 'standard' | 'orchestrator';
+/**
+ * Configuration for a single MVI projection tier.
+ *
+ * @remarks
+ * Defines which domains are accessible, which fields to strip, and how
+ * deep nested objects may be traversed in responses at a given tier.
+ */
+export interface ProjectionConfig {
+    /** Operations allowed at this tier */
+    allowedDomains: string[];
+    /** Fields to exclude from responses */
+    excludeFields?: string[];
+    /** Maximum depth for nested objects */
+    maxDepth?: number;
+}
+export declare const PROJECTIONS: Record<MviTier, ProjectionConfig>;
+/**
+ * Resolve tier from request params, defaulting to 'standard'.
+ *
+ * @remarks
+ * Priority: explicit `_mviTier` param wins, then epic scope auto-maps
+ * to orchestrator, otherwise standard is returned.
+ *
+ * @param params - Request params that may contain a `_mviTier` field
+ * @param sessionScope - Current session scope for auto-tier detection
+ * @returns The resolved MVI tier
+ *
+ * @example
+ * ```typescript
+ * import { resolveTier } from './projections.js';
+ *
+ * const tier = resolveTier(req.params, currentSession?.scope);
+ * ```
+ */
+export declare function resolveTier(params?: Record<string, unknown>, sessionScope?: {
+    type: string;
+    epicId?: string;
+} | null): MviTier;
+//# sourceMappingURL=projections.d.ts.map

package/dist/dispatch/lib/projections.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"projections.d.ts","sourceRoot":"","sources":["../../../src/dispatch/lib/projections.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH;;;;;;;;GAQG;AACH,MAAM,MAAM,OAAO,GAAG,SAAS,GAAG,UAAU,GAAG,cAAc,CAAC;AAE9D;;;;;;GAMG;AACH,MAAM,WAAW,gBAAgB;IAC/B,sCAAsC;IACtC,cAAc,EAAE,MAAM,EAAE,CAAC;IACzB,uCAAuC;IACvC,aAAa,CAAC,EAAE,MAAM,EAAE,CAAC;IACzB,uCAAuC;IACvC,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB;AAED,eAAO,MAAM,WAAW,EAAE,MAAM,CAAC,OAAO,EAAE,gBAAgB,CA0BzD,CAAC;AAKF;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAgB,WAAW,CACzB,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAChC,YAAY,CAAC,EAAE;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,MAAM,CAAC,EAAE,MAAM,CAAA;CAAE,GAAG,IAAI,GACtD,OAAO,CAOT"}

package/dist/dispatch/lib/projections.js

@@ -0,0 +1,65 @@
+/**
+ * MVI (Minimum Viable Information) projection configurations.
+ * Maps disclosure tiers to operation access and field filtering rules.
+ *
+ * @epic T4820
+ * @task T5096
+ */
+export const PROJECTIONS = {
+    minimal: {
+        allowedDomains: ['tasks', 'session', 'admin'],
+        excludeFields: ['notes', 'history', 'metadata._internal', 'auditLog'],
+        maxDepth: 2,
+    },
+    standard: {
+        allowedDomains: ['tasks', 'session', 'admin', 'memory', 'check', 'pipeline', 'tools', 'sticky'],
+        excludeFields: ['metadata._internal', 'auditLog'],
+        maxDepth: 4,
+    },
+    orchestrator: {
+        allowedDomains: [
+            'tasks',
+            'session',
+            'admin',
+            'memory',
+            'check',
+            'pipeline',
+            'orchestrate',
+            'tools',
+            'nexus',
+            'sticky',
+        ],
+        maxDepth: 8,
+    },
+};
+/** Valid MVI tier values for runtime checking. */
+const VALID_TIERS = new Set(['minimal', 'standard', 'orchestrator']);
+/**
+ * Resolve tier from request params, defaulting to 'standard'.
+ *
+ * @remarks
+ * Priority: explicit `_mviTier` param wins, then epic scope auto-maps
+ * to orchestrator, otherwise standard is returned.
+ *
+ * @param params - Request params that may contain a `_mviTier` field
+ * @param sessionScope - Current session scope for auto-tier detection
+ * @returns The resolved MVI tier
+ *
+ * @example
+ * ```typescript
+ * import { resolveTier } from './projections.js';
+ *
+ * const tier = resolveTier(req.params, currentSession?.scope);
+ * ```
+ */
+export function resolveTier(params, sessionScope) {
+    // Explicit param always wins
+    const mvi = params?._mviTier;
+    if (typeof mvi === 'string' && VALID_TIERS.has(mvi))
+        return mvi;
+    // Auto-map epic scope to orchestrator tier
+    if (sessionScope?.type === 'epic')
+        return 'orchestrator';
+    return 'standard';
+}
+//# sourceMappingURL=projections.js.map

package/dist/dispatch/lib/projections.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"projections.js","sourceRoot":"","sources":["../../../src/dispatch/lib/projections.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AA6BH,MAAM,CAAC,MAAM,WAAW,GAAsC;IAC5D,OAAO,EAAE;QACP,cAAc,EAAE,CAAC,OAAO,EAAE,SAAS,EAAE,OAAO,CAAC;QAC7C,aAAa,EAAE,CAAC,OAAO,EAAE,SAAS,EAAE,oBAAoB,EAAE,UAAU,CAAC;QACrE,QAAQ,EAAE,CAAC;KACZ;IACD,QAAQ,EAAE;QACR,cAAc,EAAE,CAAC,OAAO,EAAE,SAAS,EAAE,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,UAAU,EAAE,OAAO,EAAE,QAAQ,CAAC;QAC/F,aAAa,EAAE,CAAC,oBAAoB,EAAE,UAAU,CAAC;QACjD,QAAQ,EAAE,CAAC;KACZ;IACD,YAAY,EAAE;QACZ,cAAc,EAAE;YACd,OAAO;YACP,SAAS;YACT,OAAO;YACP,QAAQ;YACR,OAAO;YACP,UAAU;YACV,aAAa;YACb,OAAO;YACP,OAAO;YACP,QAAQ;SACT;QACD,QAAQ,EAAE,CAAC;KACZ;CACF,CAAC;AAEF,kDAAkD;AAClD,MAAM,WAAW,GAAG,IAAI,GAAG,CAAS,CAAC,SAAS,EAAE,UAAU,EAAE,cAAc,CAAC,CAAC,CAAC;AAE7E;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,UAAU,WAAW,CACzB,MAAgC,EAChC,YAAuD;IAEvD,6BAA6B;IAC7B,MAAM,GAAG,GAAG,MAAM,EAAE,QAAQ,CAAC;IAC7B,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,WAAW,CAAC,GAAG,CAAC,GAAG,CAAC;QAAE,OAAO,GAAc,CAAC;IAC3E,2CAA2C;IAC3C,IAAI,YAAY,EAAE,IAAI,KAAK,MAAM;QAAE,OAAO,cAAc,CAAC;IACzD,OAAO,UAAU,CAAC;AACpB,CAAC"}

package/dist/dispatch/lib/schema-utils.d.ts

@@ -0,0 +1,39 @@
+/**
+ * Schema utilities for the CQRS dispatch layer.
+ *
+ * Provides getOperationSchema() — a convenience function that looks up an
+ * OperationDef from the OPERATIONS registry and returns a JSON Schema object
+ * suitable for tool introspection.
+ *
+ *  T4894
+ *  T4901
+ */
+import type { Gateway } from '../types.js';
+import type { JSONSchemaObject } from './param-utils.js';
+/**
+ * Look up an operation in the OPERATIONS registry and return a JSON Schema
+ * object suitable for use as `input_schema.properties.params` or as a
+ * stand-alone per-operation schema.
+ *
+ * @param domain    Canonical domain name (e.g. 'tasks', 'session')
+ * @param operation Operation name (e.g. 'show', 'add')
+ * @param gateway   Gateway ('query' or 'mutate')
+ * @returns JSONSchemaObject derived from ParamDef[], or permissive fallback
+ *
+ * @example
+ * // tasks.show → { type: 'object', properties: { taskId: {...} }, required: ['taskId'] }
+ * getOperationSchema('tasks', 'show', 'query');
+ *
+ * // tasks.current → { type: 'object', properties: {}, required: [] }
+ * getOperationSchema('tasks', 'current', 'query');
+ */
+export declare function getOperationSchema(domain: string, operation: string, gateway: Gateway): JSONSchemaObject;
+/**
+ * Return schemas for ALL operations of a given gateway.
+ *
+ * Useful for documentation generation and tool introspection endpoints.
+ *
+ * @returns Record keyed by "<domain>.<operation>" → JSONSchemaObject
+ */
+export declare function getAllOperationSchemas(gateway: Gateway): Record<string, JSONSchemaObject>;
+//# sourceMappingURL=schema-utils.d.ts.map

package/dist/dispatch/lib/schema-utils.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"schema-utils.d.ts","sourceRoot":"","sources":["../../../src/dispatch/lib/schema-utils.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAGH,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,aAAa,CAAC;AAC3C,OAAO,KAAK,EAAE,gBAAgB,EAAsC,MAAM,kBAAkB,CAAC;AAyC7F;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAgB,kBAAkB,CAChC,MAAM,EAAE,MAAM,EACd,SAAS,EAAE,MAAM,EACjB,OAAO,EAAE,OAAO,GACf,gBAAgB,CAUlB;AAED;;;;;;GAMG;AACH,wBAAgB,sBAAsB,CAAC,OAAO,EAAE,OAAO,GAAG,MAAM,CAAC,MAAM,EAAE,gBAAgB,CAAC,CAUzF"}

package/dist/dispatch/lib/schema-utils.js

@@ -0,0 +1,88 @@
+/**
+ * Schema utilities for the CQRS dispatch layer.
+ *
+ * Provides getOperationSchema() — a convenience function that looks up an
+ * OperationDef from the OPERATIONS registry and returns a JSON Schema object
+ * suitable for tool introspection.
+ *
+ *  T4894
+ *  T4901
+ */
+import { OPERATIONS } from '../registry.js';
+/**
+ * Build an input schema directly from cleo's OperationDef.
+ *
+ * Derives a JSON Schema object from the ParamDef array, filtering
+ * hidden params and applying enum constraints.
+ */
+function buildInputSchema(def) {
+    const properties = {};
+    const required = [];
+    for (const param of def.params ?? []) {
+        if (param.hidden)
+            continue;
+        const prop = {
+            type: param.type,
+            description: param.description,
+        };
+        if (param.enum)
+            prop.enum = [...param.enum];
+        properties[param.name] = prop;
+        if (param.required)
+            required.push(param.name);
+    }
+    return { type: 'object', properties, required };
+}
+/**
+ * Permissive fallback schema returned when an operation has no declared params.
+ *
+ * An empty params array means "no declared params" (not "no params accepted"),
+ * so we return an open object schema.
+ */
+const PERMISSIVE_SCHEMA = {
+    type: 'object',
+    properties: {},
+    required: [],
+};
+/**
+ * Look up an operation in the OPERATIONS registry and return a JSON Schema
+ * object suitable for use as `input_schema.properties.params` or as a
+ * stand-alone per-operation schema.
+ *
+ * @param domain    Canonical domain name (e.g. 'tasks', 'session')
+ * @param operation Operation name (e.g. 'show', 'add')
+ * @param gateway   Gateway ('query' or 'mutate')
+ * @returns JSONSchemaObject derived from ParamDef[], or permissive fallback
+ *
+ * @example
+ * // tasks.show → { type: 'object', properties: { taskId: {...} }, required: ['taskId'] }
+ * getOperationSchema('tasks', 'show', 'query');
+ *
+ * // tasks.current → { type: 'object', properties: {}, required: [] }
+ * getOperationSchema('tasks', 'current', 'query');
+ */
+export function getOperationSchema(domain, operation, gateway) {
+    const def = OPERATIONS.find((o) => o.domain === domain && o.operation === operation && o.gateway === gateway);
+    if (!def || (def.params ?? []).length === 0) {
+        return PERMISSIVE_SCHEMA;
+    }
+    return buildInputSchema(def);
+}
+/**
+ * Return schemas for ALL operations of a given gateway.
+ *
+ * Useful for documentation generation and tool introspection endpoints.
+ *
+ * @returns Record keyed by "<domain>.<operation>" → JSONSchemaObject
+ */
+export function getAllOperationSchemas(gateway) {
+    const result = {};
+    for (const def of OPERATIONS) {
+        if (def.gateway !== gateway)
+            continue;
+        const key = `${def.domain}.${def.operation}`;
+        result[key] = (def.params ?? []).length === 0 ? PERMISSIVE_SCHEMA : buildInputSchema(def);
+    }
+    return result;
+}
+//# sourceMappingURL=schema-utils.js.map

package/dist/dispatch/lib/schema-utils.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"schema-utils.js","sourceRoot":"","sources":["../../../src/dispatch/lib/schema-utils.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,OAAO,EAAE,UAAU,EAAqB,MAAM,gBAAgB,CAAC;AAI/D;;;;;GAKG;AACH,SAAS,gBAAgB,CAAC,GAAiB;IACzC,MAAM,UAAU,GAAuC,EAAE,CAAC;IAC1D,MAAM,QAAQ,GAAa,EAAE,CAAC;IAE9B,KAAK,MAAM,KAAK,IAAI,GAAG,CAAC,MAAM,IAAI,EAAE,EAAE,CAAC;QACrC,IAAI,KAAK,CAAC,MAAM;YAAE,SAAS;QAE3B,MAAM,IAAI,GAAuB;YAC/B,IAAI,EAAE,KAAK,CAAC,IAAsB;YAClC,WAAW,EAAE,KAAK,CAAC,WAAW;SAC/B,CAAC;QAEF,IAAI,KAAK,CAAC,IAAI;YAAE,IAAI,CAAC,IAAI,GAAG,CAAC,GAAG,KAAK,CAAC,IAAI,CAAC,CAAC;QAE5C,UAAU,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC;QAC9B,IAAI,KAAK,CAAC,QAAQ;YAAE,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IAChD,CAAC;IAED,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,UAAU,EAAE,QAAQ,EAAE,CAAC;AAClD,CAAC;AAED;;;;;GAKG;AACH,MAAM,iBAAiB,GAAqB;IAC1C,IAAI,EAAE,QAAQ;IACd,UAAU,EAAE,EAAE;IACd,QAAQ,EAAE,EAAE;CACb,CAAC;AAEF;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,UAAU,kBAAkB,CAChC,MAAc,EACd,SAAiB,EACjB,OAAgB;IAEhB,MAAM,GAAG,GAAG,UAAU,CAAC,IAAI,CACzB,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,MAAM,IAAI,CAAC,CAAC,SAAS,KAAK,SAAS,IAAI,CAAC,CAAC,OAAO,KAAK,OAAO,CACjF,CAAC;IAEF,IAAI,CAAC,GAAG,IAAI,CAAC,GAAG,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC5C,OAAO,iBAAiB,CAAC;IAC3B,CAAC;IAED,OAAO,gBAAgB,CAAC,GAAG,CAAC,CAAC;AAC/B,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,sBAAsB,CAAC,OAAgB;IACrD,MAAM,MAAM,GAAqC,EAAE,CAAC;IAEpD,KAAK,MAAM,GAAG,IAAI,UAAU,EAAE,CAAC;QAC7B,IAAI,GAAG,CAAC,OAAO,KAAK,OAAO;YAAE,SAAS;QACtC,MAAM,GAAG,GAAG,GAAG,GAAG,CAAC,MAAM,IAAI,GAAG,CAAC,SAAS,EAAE,CAAC;QAC7C,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,iBAAiB,CAAC,CAAC,CAAC,gBAAgB,CAAC,GAAG,CAAC,CAAC;IAC5F,CAAC;IAED,OAAO,MAAM,CAAC;AAChB,CAAC"}

package/dist/dispatch/lib/security.d.ts

@@ -0,0 +1,11 @@
+/**
+ * Security Hardening and Input Sanitization (Backward-Compat Re-export)
+ *
+ * Thin wrapper that re-exports from the canonical location at
+ * src/core/security/input-sanitization.ts.
+ *
+ * @task T5706
+ */
+export type { RateLimitConfig, RateLimitResult } from '@cleocode/core/internal';
+export { ALL_VALID_STATUSES, DEFAULT_RATE_LIMITS, ensureArray, RateLimiter, SecurityError, sanitizeContent, sanitizeParams, sanitizePath, sanitizeTaskId, VALID_DOMAINS, VALID_GATEWAYS, VALID_LIFECYCLE_STAGE_STATUSES, VALID_MANIFEST_STATUSES, VALID_PRIORITIES, validateEnum, } from '@cleocode/core/internal';
+//# sourceMappingURL=security.d.ts.map

package/dist/dispatch/lib/security.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"security.d.ts","sourceRoot":"","sources":["../../../src/dispatch/lib/security.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,YAAY,EAAE,eAAe,EAAE,eAAe,EAAE,MAAM,yBAAyB,CAAC;AAChF,OAAO,EACL,kBAAkB,EAClB,mBAAmB,EACnB,WAAW,EACX,WAAW,EACX,aAAa,EACb,eAAe,EACf,cAAc,EACd,YAAY,EACZ,cAAc,EACd,aAAa,EACb,cAAc,EACd,8BAA8B,EAC9B,uBAAuB,EACvB,gBAAgB,EAChB,YAAY,GACb,MAAM,yBAAyB,CAAC"}

package/dist/dispatch/lib/security.js

@@ -0,0 +1,10 @@
+/**
+ * Security Hardening and Input Sanitization (Backward-Compat Re-export)
+ *
+ * Thin wrapper that re-exports from the canonical location at
+ * src/core/security/input-sanitization.ts.
+ *
+ * @task T5706
+ */
+export { ALL_VALID_STATUSES, DEFAULT_RATE_LIMITS, ensureArray, RateLimiter, SecurityError, sanitizeContent, sanitizeParams, sanitizePath, sanitizeTaskId, VALID_DOMAINS, VALID_GATEWAYS, VALID_LIFECYCLE_STAGE_STATUSES, VALID_MANIFEST_STATUSES, VALID_PRIORITIES, validateEnum, } from '@cleocode/core/internal';
+//# sourceMappingURL=security.js.map

package/dist/dispatch/lib/security.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"security.js","sourceRoot":"","sources":["../../../src/dispatch/lib/security.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAGH,OAAO,EACL,kBAAkB,EAClB,mBAAmB,EACnB,WAAW,EACX,WAAW,EACX,aAAa,EACb,eAAe,EACf,cAAc,EACd,YAAY,EACZ,cAAc,EACd,aAAa,EACb,cAAc,EACd,8BAA8B,EAC9B,uBAAuB,EACvB,gBAAgB,EAChB,YAAY,GACb,MAAM,yBAAyB,CAAC"}

package/dist/dispatch/middleware/audit.d.ts

@@ -0,0 +1,23 @@
+/**
+ * Audit Trail Middleware for CQRS Dispatch Layer.
+ *
+ * Dual-writes every audited operation to:
+ *   1. Pino structured log (subsystem: 'audit') -> .cleo/logs/cleo.log
+ *   2. SQLite audit_log table -> .cleo/tasks.db
+ *
+ * Legacy JSON file logging (.cleo/audit-log.json + rotated audit-log-*.json)
+ * has been removed per ADR-019.
+ *
+ * @task T2920
+ * @task T2929
+ * @task T4844
+ */
+import type { Middleware } from '../types.js';
+export type { AuditEntry } from '@cleocode/core/internal';
+/**
+ * Creates an audit middleware that logs all mutate operations
+ * (and query operations during grade sessions) to Pino + SQLite.
+ */
+export declare function createAudit(): Middleware;
+export { queryAudit } from '@cleocode/core/internal';
+//# sourceMappingURL=audit.d.ts.map

package/dist/dispatch/middleware/audit.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"audit.d.ts","sourceRoot":"","sources":["../../../src/dispatch/middleware/audit.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAIH,OAAO,KAAK,EAAmD,UAAU,EAAE,MAAM,aAAa,CAAC;AAkB/F,YAAY,EAAE,UAAU,EAAE,MAAM,yBAAyB,CAAC;AAqF1D;;;GAGG;AACH,wBAAgB,WAAW,IAAI,UAAU,CAkExC;AAGD,OAAO,EAAE,UAAU,EAAE,MAAM,yBAAyB,CAAC"}

package/dist/dispatch/middleware/audit.js

@@ -0,0 +1,169 @@
+/**
+ * Audit Trail Middleware for CQRS Dispatch Layer.
+ *
+ * Dual-writes every audited operation to:
+ *   1. Pino structured log (subsystem: 'audit') -> .cleo/logs/cleo.log
+ *   2. SQLite audit_log table -> .cleo/tasks.db
+ *
+ * Legacy JSON file logging (.cleo/audit-log.json + rotated audit-log-*.json)
+ * has been removed per ADR-019.
+ *
+ * @task T2920
+ * @task T2929
+ * @task T4844
+ */
+import { getLogger, getProjectInfoSync } from '@cleocode/core/internal';
+import { getConfig } from '../lib/config.js';
+const log = getLogger('audit');
+/** Cached project hash — read once from project-info.json (immutable at runtime). */
+let cachedProjectHash;
+function resolveProjectHash() {
+    if (cachedProjectHash !== undefined)
+        return cachedProjectHash;
+    try {
+        const info = getProjectInfoSync();
+        cachedProjectHash = info?.projectHash ?? null;
+    }
+    catch {
+        cachedProjectHash = null;
+    }
+    return cachedProjectHash;
+}
+/**
+ * Check if the current context is a grade session.
+ *
+ * Now simplified: session-resolver middleware (T4959) populates request.sessionId
+ * before audit runs, so we only need to check grade mode flags.
+ */
+function isGradeMode() {
+    return process.env.CLEO_SESSION_GRADE === 'true';
+}
+/**
+ * Get active session info from SQLite or env vars.
+ *
+ * Session-resolver middleware (T4959) now populates request.sessionId.
+ * This function is retained as a fallback for edge cases where
+ * session-resolver is not in the pipeline (e.g., tests, legacy callers).
+ */
+async function getActiveSessionInfo() {
+    const gradeId = process.env.CLEO_SESSION_GRADE_ID;
+    if (gradeId && process.env.CLEO_SESSION_GRADE === 'true') {
+        return { id: gradeId, gradeMode: true };
+    }
+    const envId = process.env.CLEO_SESSION_ID;
+    if (envId) {
+        return { id: envId, gradeMode: false };
+    }
+    return null;
+}
+/**
+ * Write audit entry to SQLite audit_log table.
+ * Validates the payload with Zod before inserting.
+ * Fire-and-forget — errors are logged to Pino but never thrown.
+ *
+ * @task T4848
+ */
+async function writeToSqlite(entry, requestId) {
+    try {
+        const { getDb } = await import('@cleocode/core/internal');
+        const { auditLog } = await import('@cleocode/core/internal');
+        const { AuditLogInsertSchema } = await import('@cleocode/core/internal');
+        const { randomUUID } = await import('node:crypto');
+        const payload = {
+            id: randomUUID(),
+            timestamp: entry.timestamp,
+            action: entry.operation,
+            taskId: entry.metadata.taskId ?? 'system',
+            actor: entry.metadata.userId ?? 'agent',
+            detailsJson: JSON.stringify(entry.params),
+            // Dispatch-level columns (ADR-019)
+            domain: entry.domain,
+            operation: entry.operation,
+            sessionId: entry.sessionId,
+            requestId: requestId ?? null,
+            durationMs: entry.result.duration,
+            success: entry.result.success ? 1 : 0,
+            source: entry.metadata.source,
+            gateway: entry.metadata.gateway ?? null,
+            errorMessage: entry.error ?? null,
+            // Project correlation (T5337)
+            projectHash: resolveProjectHash(),
+        };
+        // Validate payload before insert (T4848)
+        const parsed = AuditLogInsertSchema.safeParse(payload);
+        if (!parsed.success) {
+            log.warn({ issues: parsed.error.issues }, 'Audit payload failed Zod validation; skipping insert');
+            return;
+        }
+        const db = await getDb(process.cwd());
+        await db.insert(auditLog).values(parsed.data).run();
+    }
+    catch (err) {
+        log.warn({ err }, 'Failed to write audit entry to SQLite');
+    }
+}
+/**
+ * Creates an audit middleware that logs all mutate operations
+ * (and query operations during grade sessions) to Pino + SQLite.
+ */
+export function createAudit() {
+    return async (req, next) => {
+        const startTime = Date.now();
+        // T4959: session-resolver middleware now populates req.sessionId before
+        // audit runs. Fall back to legacy lookup only if resolver missed it.
+        const currentSessionId = req.sessionId ?? (await getActiveSessionInfo())?.id ?? null;
+        const isGradeSession = isGradeMode();
+        const response = await next();
+        // Audit mutations always; audit queries only during grade sessions
+        const shouldAudit = req.gateway === 'mutate' || (req.gateway === 'query' && isGradeSession);
+        if (!shouldAudit)
+            return response;
+        // Check if audit logging is enabled
+        const config = getConfig();
+        if (!config.auditLog)
+            return response;
+        const entry = {
+            timestamp: new Date().toISOString(),
+            sessionId: currentSessionId,
+            domain: req.domain,
+            operation: req.operation,
+            params: req.params || {},
+            result: {
+                success: response.success,
+                exitCode: response.error?.exitCode || 0,
+                duration: Date.now() - startTime,
+            },
+            metadata: {
+                taskId: req.params?.taskId || req.params?.parent,
+                source: req.source,
+                gateway: req.gateway,
+            },
+            error: response.error?.message,
+        };
+        // Pino structured log (immediate, non-blocking)
+        log.info({
+            domain: entry.domain,
+            operation: entry.operation,
+            sessionId: entry.sessionId,
+            taskId: entry.metadata.taskId,
+            gateway: entry.metadata.gateway,
+            success: entry.result.success,
+            exitCode: entry.result.exitCode,
+            durationMs: entry.result.duration,
+        }, `${entry.metadata.gateway ?? 'dispatch'} ${entry.domain}.${entry.operation}`);
+        // SQLite write — await in grade mode to avoid race with grading query;
+        // fire-and-forget otherwise for performance.
+        if (isGradeSession) {
+            await writeToSqlite(entry, req.requestId);
+        }
+        else {
+            writeToSqlite(entry, req.requestId).catch((err) => {
+                log.error({ err }, 'Failed to persist audit entry to SQLite');
+            });
+        }
+        return response;
+    };
+}
+// queryAudit re-exported from core (canonical location)
+export { queryAudit } from '@cleocode/core/internal';
+//# sourceMappingURL=audit.js.map

package/dist/dispatch/middleware/audit.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"audit.js","sourceRoot":"","sources":["../../../src/dispatch/middleware/audit.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAEH,OAAO,EAAE,SAAS,EAAE,kBAAkB,EAAE,MAAM,yBAAyB,CAAC;AACxE,OAAO,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AAG7C,MAAM,GAAG,GAAG,SAAS,CAAC,OAAO,CAAC,CAAC;AAE/B,qFAAqF;AACrF,IAAI,iBAA4C,CAAC;AACjD,SAAS,kBAAkB;IACzB,IAAI,iBAAiB,KAAK,SAAS;QAAE,OAAO,iBAAiB,CAAC;IAC9D,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,kBAAkB,EAAE,CAAC;QAClC,iBAAiB,GAAG,IAAI,EAAE,WAAW,IAAI,IAAI,CAAC;IAChD,CAAC;IAAC,MAAM,CAAC;QACP,iBAAiB,GAAG,IAAI,CAAC;IAC3B,CAAC;IACD,OAAO,iBAAiB,CAAC;AAC3B,CAAC;AAOD;;;;;GAKG;AACH,SAAS,WAAW;IAClB,OAAO,OAAO,CAAC,GAAG,CAAC,kBAAkB,KAAK,MAAM,CAAC;AACnD,CAAC;AAED;;;;;;GAMG;AACH,KAAK,UAAU,oBAAoB;IACjC,MAAM,OAAO,GAAG,OAAO,CAAC,GAAG,CAAC,qBAAqB,CAAC;IAClD,IAAI,OAAO,IAAI,OAAO,CAAC,GAAG,CAAC,kBAAkB,KAAK,MAAM,EAAE,CAAC;QACzD,OAAO,EAAE,EAAE,EAAE,OAAO,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC;IAC1C,CAAC;IACD,MAAM,KAAK,GAAG,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC;IAC1C,IAAI,KAAK,EAAE,CAAC;QACV,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC;IACzC,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;;;GAMG;AACH,KAAK,UAAU,aAAa,CAAC,KAAiB,EAAE,SAAkB;IAChE,IAAI,CAAC;QACH,MAAM,EAAE,KAAK,EAAE,GAAG,MAAM,MAAM,CAAC,yBAAyB,CAAC,CAAC;QAC1D,MAAM,EAAE,QAAQ,EAAE,GAAG,MAAM,MAAM,CAAC,yBAAyB,CAAC,CAAC;QAC7D,MAAM,EAAE,oBAAoB,EAAE,GAAG,MAAM,MAAM,CAAC,yBAAyB,CAAC,CAAC;QACzE,MAAM,EAAE,UAAU,EAAE,GAAG,MAAM,MAAM,CAAC,aAAa,CAAC,CAAC;QAEnD,MAAM,OAAO,GAAG;YACd,EAAE,EAAE,UAAU,EAAE;YAChB,SAAS,EAAE,KAAK,CAAC,SAAS;YAC1B,MAAM,EAAE,KAAK,CAAC,SAAS;YACvB,MAAM,EAAE,KAAK,CAAC,QAAQ,CAAC,MAAM,IAAI,QAAQ;YACzC,KAAK,EAAE,KAAK,CAAC,QAAQ,CAAC,MAAM,IAAI,OAAO;YACvC,WAAW,EAAE,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,MAAM,CAAC;YACzC,mCAAmC;YACnC,MAAM,EAAE,KAAK,CAAC,MAAM;YACpB,SAAS,EAAE,KAAK,CAAC,SAAS;YAC1B,SAAS,EAAE,KAAK,CAAC,SAAS;YAC1B,SAAS,EAAE,SAAS,IAAI,IAAI;YAC5B,UAAU,EAAE,KAAK,CAAC,MAAM,CAAC,QAAQ;YACjC,OAAO,EAAE,KAAK,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;YACrC,MAAM,EAAE,KAAK,CAAC,QAAQ,CAAC,MAAM;YAC7B,OAAO,EAAE,KAAK,CAAC,QAAQ,CAAC,OAAO,IAAI,IAAI;YACvC,YAAY,EAAE,KAAK,CAAC,KAAK,IAAI,IAAI;YACjC,8BAA8B;YAC9B,WAAW,EAAE,kBAAkB,EAAE;SAClC,CAAC;QAEF,yCAAyC;QACzC,MAAM,MAAM,GAAG,oBAAoB,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC;QACvD,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;YACpB,GAAG,CAAC,IAAI,CACN,EAAE,MAAM,EAAE,MAAM,CAAC,KAAK,CAAC,MAAM,EAAE,EAC/B,sDAAsD,CACvD,CAAC;YACF,OAAO;QACT,CAAC;QAED,MAAM,EAAE,GAAG,MAAM,KAAK,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC;QACtC,MAAM,EAAE,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,CAAC;IACtD,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,GAAG,CAAC,IAAI,CAAC,EAAE,GAAG,EAAE,EAAE,uCAAuC,CAAC,CAAC;IAC7D,CAAC;AACH,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,WAAW;IACzB,OAAO,KAAK,EAAE,GAAoB,EAAE,IAAkB,EAA6B,EAAE;QACnF,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QAE7B,wEAAwE;QACxE,qEAAqE;QACrE,MAAM,gBAAgB,GACpB,GAAG,CAAC,SAAS,IAAI,CAAC,MAAM,oBAAoB,EAAE,CAAC,EAAE,EAAE,IAAI,IAAI,CAAC;QAC9D,MAAM,cAAc,GAAG,WAAW,EAAE,CAAC;QAErC,MAAM,QAAQ,GAAG,MAAM,IAAI,EAAE,CAAC;QAE9B,mEAAmE;QACnE,MAAM,WAAW,GAAG,GAAG,CAAC,OAAO,KAAK,QAAQ,IAAI,CAAC,GAAG,CAAC,OAAO,KAAK,OAAO,IAAI,cAAc,CAAC,CAAC;QAC5F,IAAI,CAAC,WAAW;YAAE,OAAO,QAAQ,CAAC;QAElC,oCAAoC;QACpC,MAAM,MAAM,GAAG,SAAS,EAAE,CAAC;QAC3B,IAAI,CAAC,MAAM,CAAC,QAAQ;YAAE,OAAO,QAAQ,CAAC;QAEtC,MAAM,KAAK,GAAe;YACxB,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;YACnC,SAAS,EAAE,gBAAgB;YAC3B,MAAM,EAAE,GAAG,CAAC,MAAM;YAClB,SAAS,EAAE,GAAG,CAAC,SAAS;YACxB,MAAM,EAAE,GAAG,CAAC,MAAM,IAAI,EAAE;YACxB,MAAM,EAAE;gBACN,OAAO,EAAE,QAAQ,CAAC,OAAO;gBACzB,QAAQ,EAAE,QAAQ,CAAC,KAAK,EAAE,QAAQ,IAAI,CAAC;gBACvC,QAAQ,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS;aACjC;YACD,QAAQ,EAAE;gBACR,MAAM,EAAG,GAAG,CAAC,MAAM,EAAE,MAAiB,IAAK,GAAG,CAAC,MAAM,EAAE,MAAiB;gBACxE,MAAM,EAAE,GAAG,CAAC,MAAM;gBAClB,OAAO,EAAE,GAAG,CAAC,OAA6B;aAC3C;YACD,KAAK,EAAE,QAAQ,CAAC,KAAK,EAAE,OAAO;SAC/B,CAAC;QAEF,gDAAgD;QAChD,GAAG,CAAC,IAAI,CACN;YACE,MAAM,EAAE,KAAK,CAAC,MAAM;YACpB,SAAS,EAAE,KAAK,CAAC,SAAS;YAC1B,SAAS,EAAE,KAAK,CAAC,SAAS;YAC1B,MAAM,EAAE,KAAK,CAAC,QAAQ,CAAC,MAAM;YAC7B,OAAO,EAAE,KAAK,CAAC,QAAQ,CAAC,OAAO;YAC/B,OAAO,EAAE,KAAK,CAAC,MAAM,CAAC,OAAO;YAC7B,QAAQ,EAAE,KAAK,CAAC,MAAM,CAAC,QAAQ;YAC/B,UAAU,EAAE,KAAK,CAAC,MAAM,CAAC,QAAQ;SAClC,EACD,GAAG,KAAK,CAAC,QAAQ,CAAC,OAAO,IAAI,UAAU,IAAI,KAAK,CAAC,MAAM,IAAI,KAAK,CAAC,SAAS,EAAE,CAC7E,CAAC;QAEF,uEAAuE;QACvE,6CAA6C;QAC7C,IAAI,cAAc,EAAE,CAAC;YACnB,MAAM,aAAa,CAAC,KAAK,EAAE,GAAG,CAAC,SAAS,CAAC,CAAC;QAC5C,CAAC;aAAM,CAAC;YACN,aAAa,CAAC,KAAK,EAAE,GAAG,CAAC,SAAS,CAAC,CAAC,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE;gBAChD,GAAG,CAAC,KAAK,CAAC,EAAE,GAAG,EAAE,EAAE,yCAAyC,CAAC,CAAC;YAChE,CAAC,CAAC,CAAC;QACL,CAAC;QAED,OAAO,QAAQ,CAAC;IAClB,CAAC,CAAC;AACJ,CAAC;AAED,wDAAwD;AACxD,OAAO,EAAE,UAAU,EAAE,MAAM,yBAAyB,CAAC"}