@cratylus/canon 0.1.0

package/dist/hooks/praxis-continuity.js

@@ -0,0 +1,131 @@
+// praxis-continuity — the repo-level post-commit reminder. A scope-activated source
+// cell on the GIT substrate: `vcs.commit.post` is an ordinary member of this
+// corpus's `CANONICAL_EVENTS` carrying `substrate: 'git'`, so it is routed rather
+// than refused — the `.husky/post-commit` dispatcher runs the committed worker
+// directly and nothing reaches `settings.json`. Its `workers[].content` are the
+// byte-anchors the committed `targets/continuity/` workers regenerate from
+// (byte-locked).
+//
+// THE REVIEW THIS CELL WAS FLAGGED FOR IS CLOSED. The note read "not in FORGE's
+// `CanonicalEvent` taxonomy" — stale by one package before it was stale by two, and
+// it asked for either an addition to the taxonomy or a named exception. Neither was
+// owed: the event was never exceptional, only unliterable, because the taxonomy was
+// a closed union in `schema` that a git moment had no member to be. The vocabulary
+// now lives where signification lives, `EventName` is open, and this cell names its
+// moment exactly as a harness cell names its own.
+export const praxisContinuity = {
+    id: 'praxis-continuity',
+    residue: 'post-commit detector ⟨task-file crosses state-folder ⇒ plan-mirror stale⟩ · nudge re-mirror · ¬edit · opt-in ↾ clone · exit-0 ⟨reminder ¬fail-commit⟩',
+    substrate: 'git',
+    events: ['vcs.commit.post'],
+    // git substrate: the entry is still named, never spelled as a path. Which
+    // directory git invokes it from is git's projection to make, not this cell's.
+    entry: 'praxis-advance-nudge.sh',
+    refs: [],
+    workers: [
+        {
+            filename: 'continuity-hook.sh',
+            targetPath: 'packages/canon/targets/continuity/continuity-hook.sh',
+            executable: true,
+            content: `#!/usr/bin/env sh
+# continuity-hook — opt this repo in/out of the post-commit continuity ritual.
+#
+# The opt-in flag is a per-repo git config (agentfactory.continuity) living in .git/config,
+# which is NOT checked in — so opting in is local to your clone and a fresh clone is
+# opted out by default. The .husky/post-commit dispatcher reads this flag.
+#
+#   pnpm run continuity:install     → set agentfactory.continuity true
+#   pnpm run continuity:uninstall   → unset (back to default off)
+#   pnpm run continuity:status      → show current state
+#
+# Usage:  continuity-hook.sh {install|uninstall|status}
+
+set -e
+
+cmd="\${1:-status}"
+
+case "$cmd" in
+install | on | true)
+	git config --bool agentfactory.continuity true
+	printf 'continuity: ENABLED for this repo (agentfactory.continuity=true).\\n'
+	printf '  Commits touching plans/**/{pending,ready,active,completed}/ now print a /praxis re-mirror reminder.\\n'
+	;;
+uninstall | off | false)
+	git config --unset agentfactory.continuity 2>/dev/null || true
+	printf 'continuity: DISABLED for this repo (agentfactory.continuity unset → default off).\\n'
+	;;
+status)
+	state=$(git config --bool agentfactory.continuity 2>/dev/null || echo "false")
+	printf 'continuity: %s (agentfactory.continuity=%s)\\n' \\
+		"$([ "$state" = "true" ] && echo ENABLED || echo "disabled (default)")" "$state"
+	;;
+*)
+	printf 'usage: continuity-hook.sh {install|uninstall|status}\\n' >&2
+	exit 2
+	;;
+esac
+`,
+        },
+        {
+            filename: 'praxis-advance-nudge.sh',
+            targetPath: 'packages/canon/targets/continuity/praxis-advance-nudge.sh',
+            executable: true,
+            content: `#!/usr/bin/env sh
+# praxis-advance-nudge — the repo-level continuity ritual, as a post-commit reminder.
+#
+# WHAT IT DOES (and deliberately does NOT do):
+#   When a commit moves plan task-files between their state folders
+#   (plans/**/{pending,ready,active,completed}/), PLAN.md — the hand-authored
+#   mirror of that folder-state — may now be stale. This script DETECTS that and
+#   PRINTS A REMINDER to re-mirror via /praxis. It never edits PLAN.md: the mirror
+#   is hand-authored prose; auto-rewriting it is out of scope (a future "mechanized
+#   PLAN.md generation" task). Detect → remind, never edit. (doc-mirrors-runtime-truth:
+#   the folders are the truth; this only flags that the mirror lagged.)
+#
+# SCOPE: praxis-advance is the ONE repo-level continuity ritual. encode/dream are
+#   per-AGENT sidecar-memory operations (~/.claude/agents/<name>/*) — not repo state,
+#   a git hook can't meaningfully fire them — so they are out of this hook's scope.
+#
+# OPT-IN: this runs only when \`git config --bool agentfactory.continuity\` is true. A fresh
+#   clone is opted out, so default commit behavior is unchanged. See continuity-hook.sh.
+#
+# POSIX sh; no deps beyond git. Exits 0 always — a reminder must never fail a commit.
+
+set -e
+
+# The commit just made (post-commit runs after HEAD has advanced).
+git rev-parse HEAD >/dev/null 2>&1 || exit 0
+
+# Files changed by HEAD. For a root commit (no parent) diff against the root.
+if git rev-parse --verify --quiet HEAD^ >/dev/null 2>&1; then
+	changed=$(git diff-tree --no-commit-id --name-only -r HEAD 2>/dev/null) || exit 0
+else
+	changed=$(git diff-tree --no-commit-id --name-only -r --root HEAD 2>/dev/null) || exit 0
+fi
+
+# Did this commit touch any plan state-folder? Match the four canonical states under
+# any plans/ subtree (works whether or not a tasks/ or {concern} wrapper is present).
+touched=$(printf '%s\\n' "$changed" \\
+	| grep -E '^plans/.*/(pending|ready|active|completed)/' || true)
+
+[ -z "$touched" ] && exit 0
+
+# Which plan dirs were touched (dedup to the plan root: plans/<plan>/).
+plans=$(printf '%s\\n' "$touched" \\
+	| sed -E 's#^(plans/[^/]+)/.*#\\1#' | sort -u)
+
+printf '\\n'
+printf 'continuity · praxis-advance — plan state changed in this commit:\\n'
+printf '%s\\n' "$plans" | sed 's/^/    /'
+printf '\\n'
+printf '  PLAN.md mirrors the task-folder state; it may now be stale.\\n'
+printf '  Re-mirror with /praxis (advance the task, re-sync PLAN.md), then amend or follow-up commit.\\n'
+printf '  (This is a reminder only — nothing was edited. Disable: pnpm run continuity:uninstall)\\n'
+printf '\\n'
+
+exit 0
+`,
+        },
+    ],
+};
+//# sourceMappingURL=praxis-continuity.js.map

package/dist/hooks/praxis-continuity.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"praxis-continuity.js","sourceRoot":"","sources":["../../src/hooks/praxis-continuity.ts"],"names":[],"mappings":"AAEA,oFAAoF;AACpF,6EAA6E;AAC7E,kFAAkF;AAClF,+EAA+E;AAC/E,gFAAgF;AAChF,2EAA2E;AAC3E,iBAAiB;AACjB,EAAE;AACF,gFAAgF;AAChF,oFAAoF;AACpF,oFAAoF;AACpF,oFAAoF;AACpF,mFAAmF;AACnF,oFAAoF;AACpF,kDAAkD;AAElD,MAAM,CAAC,MAAM,gBAAgB,GAAa;IACxC,EAAE,EAAE,mBAAmB;IACvB,OAAO,EACL,uJAAuJ;IACzJ,SAAS,EAAE,KAAK;IAChB,MAAM,EAAE,CAAC,iBAAiB,CAAC;IAC3B,0EAA0E;IAC1E,8EAA8E;IAC9E,KAAK,EAAE,yBAAyB;IAChC,IAAI,EAAE,EAAE;IACR,OAAO,EAAE;QACP;YACE,QAAQ,EAAE,oBAAoB;YAC9B,UAAU,EAAE,sDAAsD;YAClE,UAAU,EAAE,IAAI;YAChB,OAAO,EAAE;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAqCd;SACI;QACD;YACE,QAAQ,EAAE,yBAAyB;YACnC,UAAU,EAAE,2DAA2D;YACvE,UAAU,EAAE,IAAI;YAChB,OAAO,EAAE;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAsDd;SACI;KACF;CACF,CAAC"}

package/dist/hooks/resume-availability-notice.d.ts

@@ -0,0 +1,2 @@
+import type { HookCell } from '../manifest.js';
+export declare const resumeAvailabilityNotice: HookCell;

package/dist/hooks/resume-availability-notice.js

@@ -0,0 +1,50 @@
+// resume-availability-notice — the SessionStart note. It tells the agent that
+// memory exists and that `/wake` reconstitutes it, and does nothing else.
+//
+// WHY A NOTE AND NOT AN ACTION: reconstitution is the operator's call, not the
+// harness's. The agent may already have been woken, may deliberately be wanted
+// cold, or may simply have been started without it. A hook cannot tell which,
+// so it must not decide — it makes the option visible and leaves the choice
+// where it belongs.
+//
+// THE VERB-FREE LAW IS LOAD-BEARING, not tidiness. Every memory verb that
+// touches the registry REGISTERS the session, and registration is exactly what
+// distinguishes a woken session from an encode-only one (`SessionEntry.origin`).
+// A note that called any such verb would register the session itself and make
+// every session look woken — destroying the very signal that lets the agent
+// notice it was NOT woken. So: no `session begin`, no `register`, no `read`, no
+// `encode`. It reads nothing, writes nothing, and needs no home.
+export const resumeAvailabilityNotice = {
+    id: 'resume-availability-notice',
+    residue: 'emit ↾ session.start · fixed-text · ¬verb ⟨any registry touch ⇒ every session reads woken ∴ origin destroyed⟩ · ¬read · ¬write · ¬home-derivation · reconstitution ↦ operator ⟨may have run it · may refuse it · may have forgotten⟩ · exit-0 ∀error',
+    substrate: 'harness',
+    events: ['session.start'],
+    entry: 'resume-availability-notice.sh',
+    timeout: 5,
+    refs: [],
+    workers: [
+        {
+            filename: 'resume-availability-notice.sh',
+            targetPath: 'packages/canon/targets/guardrail/resume-availability-notice.sh',
+            executable: true,
+            content: `#!/usr/bin/env sh
+# resume-availability-notice — a SessionStart note. Emits ONE fixed line telling
+# the agent that memory skills exist and that /wake reconstitutes it.
+#
+# It calls NO memory verb. That is a hard requirement, not a style choice: every
+# registry-touching verb registers the session, and registration is what marks a
+# session as woken. A note that registered would make every session look woken
+# and destroy the signal it exists to support.
+#
+# Reads nothing, writes nothing, derives no home. Always exits 0.
+
+set -eu
+trap 'exit 0' EXIT
+
+printf 'MEMORY — this agent has persistent memory. /wake reconstitutes it (prior state, standing plan, continuity); /dream consolidates it. Neither runs automatically.\\n'
+exit 0
+`,
+        },
+    ],
+};
+//# sourceMappingURL=resume-availability-notice.js.map

package/dist/hooks/resume-availability-notice.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"resume-availability-notice.js","sourceRoot":"","sources":["../../src/hooks/resume-availability-notice.ts"],"names":[],"mappings":"AAEA,8EAA8E;AAC9E,0EAA0E;AAC1E,EAAE;AACF,+EAA+E;AAC/E,+EAA+E;AAC/E,8EAA8E;AAC9E,4EAA4E;AAC5E,oBAAoB;AACpB,EAAE;AACF,0EAA0E;AAC1E,+EAA+E;AAC/E,iFAAiF;AACjF,8EAA8E;AAC9E,4EAA4E;AAC5E,gFAAgF;AAChF,iEAAiE;AAEjE,MAAM,CAAC,MAAM,wBAAwB,GAAa;IAChD,EAAE,EAAE,4BAA4B;IAChC,OAAO,EACL,sPAAsP;IACxP,SAAS,EAAE,SAAS;IACpB,MAAM,EAAE,CAAC,eAAe,CAAC;IACzB,KAAK,EAAE,+BAA+B;IACtC,OAAO,EAAE,CAAC;IACV,IAAI,EAAE,EAAE;IACR,OAAO,EAAE;QACP;YACE,QAAQ,EAAE,+BAA+B;YACzC,UAAU,EACR,gEAAgE;YAClE,UAAU,EAAE,IAAI;YAChB,OAAO,EAAE;;;;;;;;;;;;;;;;CAgBd;SACI;KACF;CACF,CAAC"}

package/dist/hooks/stance-guardrail-pre.d.ts

@@ -0,0 +1,2 @@
+import type { HookCell } from '../manifest.js';
+export declare const stanceGuardrailPre: HookCell;

package/dist/hooks/stance-guardrail-pre.js

@@ -0,0 +1,170 @@
+// stance-guardrail-pre — the BEFORE-THE-CALL twin of `stance-guardrail` (the turn-end
+// cell). It STRUCTURALLY REFUSES, BEFORE the call fires, a mid-turn tool call that
+// collapses out of the intent-driven-expert stance. Two acts, and the acts are what it
+// binds:
+//   - operator.consult.pre  : a permission / option-menu on an in-remit reversible call
+//   - subagent.dispatch.pre : a dispatch that transcribes literal words w/o extracted intent
+// Neither act fires turn-end, so the Stop guard is blind to them (the closed blind spot).
+// It SHARES the deployed judge backend + rubric of the sibling `stance-guardrail` hook
+// (one rubric, one judge — no duplication); only this worker is new.
+//
+// IT BINDS TWO ACTS, NOT ONE EVENT PLUS A REGEX. This cell used to read
+// `events: ['tool.use.pre']` + `matcher: 'AskUserQuestion|Agent|SendMessage'` — three
+// claude tool names on a harness-agnostic shape, which the codex adapter dropped
+// without a word, so the hook there fired on EVERY tool call and only the worker's
+// own `*) allow ;;` branch kept it correct. The two acts below were already latent in
+// the residue (`permission-menu` · `dispatch-echo`); naming them moves the narrowing
+// to the adapter, which alone knows which of its tools performs the act. Each adapter
+// computes its own ⟨native event, native selector⟩ pair, and one that can fire an act
+// but not narrow it now SAYS SO through the projection's warnings.
+// `test/hook-rule-boundary.test.ts` byte-locks the worker;
+// `test/hook-act-selector.test.ts` holds the seam.
+export const stanceGuardrailPre = {
+    id: 'stance-guardrail-pre',
+    residue: 'structural-refusal ↾ mid-turn tool-call · deny-before-fire ⟨intent-driven-expert-collapse⟩ ⟨permission-menu · dispatch-echo ⟨literal-transcription ∄ extracted-intent⟩⟩ · pass ⟨reserved · irreversible-outward-consent · substantive-dispatch · intent-ambiguity ↦ elicit⟩ · shared judge-backend ⟨sibling⟩ · loop-safe ⟨re-entry-cap : ¬deny identical twice⟩',
+    substrate: 'harness',
+    order: 1,
+    events: ['operator.consult.pre', 'subagent.dispatch.pre'],
+    entry: 'stance-guardrail-pre.sh',
+    timeout: 60,
+    refs: [],
+    workers: [
+        {
+            filename: 'stance-guardrail-pre.sh',
+            targetPath: 'packages/canon/targets/guardrail/stance-guardrail-pre.sh',
+            executable: true,
+            content: `#!/usr/bin/env sh
+# stance-guardrail-pre — a PreToolUse hook that STRUCTURALLY REFUSES a mid-turn tool
+# call that collapses out of the intent-driven-expert (fiduciary-agent) stance BEFORE
+# it fires. The pre-hoc twin of stance-guardrail (Stop): AskUserQuestion menus and
+# Agent/SendMessage dispatch-echo never fire Stop, so the Stop guard cannot see them.
+#
+# WHAT IT DENIES (see stance-judge-prompt.md — the SHARED rubric):
+#   - AskUserQuestion : a permission / option-menu on an in-remit reversible call
+#   - Agent/SendMessage : a dispatch transcribing literal words without extracted intent
+# WHAT IT DOES NOT DENY (reserved): an irreversible-outward consent menu, a true INTENT
+#   ambiguity, a substantive intent-extracted dispatch.
+#
+# SAFETY MODEL (mirrors stance-guardrail):
+#   - OFF BY DEFAULT (git config agentfactory.stanceGuard true).
+#   - AGENT-SCOPED (agent_type in the allowlist; default: nico mav). agent_type is
+#     present only for subagents / --agent mode; a top-level session call fails open.
+#   - FAILS OPEN. Any error (no jq, judge failure, bad input) -> exit 0 (allow the call).
+#   - LOOP-SAFE. A re-entry cap: never deny an identical tool_input twice (there is no
+#     stop_hook_active analog for PreToolUse), so it can never wedge a call.
+#   - OBSERVABLE. Judge failures/timeouts are logged (fails open, but a miss is visible).
+#
+# INPUT  : Claude Code PreToolUse hook JSON on stdin (tool_name, tool_input, agent_type
+#          [subagents], session_id, cwd, ...).
+# OUTPUT : on collapse -> stdout
+#          {"hookSpecificOutput":{"hookEventName":"PreToolUse","permissionDecision":"deny",
+#           "permissionDecisionReason":"..."}} + exit 0.
+#          otherwise -> no stdout + exit 0 (allow the call).
+#
+# POSIX sh. Depends on: jq. Missing jq -> fail open.
+
+set -eu
+
+# The sibling Stop hook's deployed dir owns the SHARED judge + rubric (deployed together).
+JUDGE_DIR="\${STANCE_GUARD_DIR:-$HOME/.claude/hooks/stance-guardrail}"
+RUBRIC="\${STANCE_RUBRIC:-$JUDGE_DIR/stance-judge-prompt.md}"
+JUDGE_CMD="\${STANCE_JUDGE_CMD:-sh $JUDGE_DIR/stance-judge.sh}"
+LOG="\${STANCE_GUARD_LOG:-$HOME/.claude/hooks/stance-guardrail-pre/misses.log}"
+
+# A PreToolUse hook must never break a session. Trap any unexpected error -> allow.
+trap 'exit 0' EXIT
+
+allow() { exit 0; }  # emit nothing; the tool call proceeds.
+note() { printf '%s\\n' "$1" >> "$LOG" 2>/dev/null || true; }
+
+# --- read hook input ------------------------------------------------------------------------
+input="$(cat)"
+[ -n "$input" ] || allow
+command -v jq >/dev/null 2>&1 || allow  # no jq -> cannot parse -> fail open
+
+# --- opt-in gate (off by default) -----------------------------------------------------------
+# Per-repo, lives in .git/config, never checked in. Resolve relative to the hook's cwd.
+cwd="$(printf '%s' "$input" | jq -r '.cwd // empty' 2>/dev/null || true)"
+[ -n "$cwd" ] && cd "$cwd" 2>/dev/null || true
+enabled="$(git config --bool agentfactory.stanceGuard 2>/dev/null || echo false)"
+[ "$enabled" = "true" ] || allow
+
+# --- agent-scope gate -----------------------------------------------------------------------
+# Only enforce for the configured agents (default: the principal-ic-intrinsic agents).
+# agent_type is present only for a subagent / --agent tool call; absent for the top-level
+# session -> fail open (unless STANCE_GUARD_AGENTS=*), exactly like the Stop guard.
+agent_type="$(printf '%s' "$input" | jq -r '.agent_type // empty' 2>/dev/null || true)"
+allowlist="\${STANCE_GUARD_AGENTS:-$(git config agentfactory.stanceGuardAgents 2>/dev/null || echo 'nico mav')}"
+if [ "$allowlist" != "*" ]; then
+	[ -n "$agent_type" ] || allow  # cannot identify the agent -> fail open
+	in_scope=false
+	for a in $allowlist; do
+		[ "$a" = "$agent_type" ] && in_scope=true && break
+	done
+	[ "$in_scope" = true ] || allow
+fi
+
+# --- extract the judged payload, branched by tool -------------------------------------------
+tool_name="$(printf '%s' "$input" | jq -r '.tool_name // empty' 2>/dev/null || true)"
+[ -n "$tool_name" ] || allow
+
+case "$tool_name" in
+	AskUserQuestion)
+		# the questions + their option menus — the permission-menu class
+		body="$(printf '%s' "$input" | jq -r '
+			(.tool_input.questions // [])
+			| map("Q: " + (.question // "")
+			      + "  OPTIONS: " + ((.options // []) | map(.label // "") | join(" | ")))
+			| join("  ;;  ")
+		' 2>/dev/null || true)"
+		payload="AskUserQuestion menu (a question/option menu handed to the operator): $body" ;;
+	Agent|SendMessage)
+		# the dispatch prompt/message — the dispatch-echo class
+		body="$(printf '%s' "$input" | jq -r '.tool_input.prompt // .tool_input.message // .tool_input.description // ""' 2>/dev/null || true)"
+		payload="$tool_name dispatch (the delegate prompt/message): $body" ;;
+	*)
+		allow ;;  # DEFENCE IN DEPTH, and on some harnesses the only narrowing there is:
+		          # claude's adapter computes a selector from the act and this never fires;
+		          # codex has no subject selector, so its projection WARNS and this branch
+		          # is what keeps the guard off every other tool call.
+esac
+
+[ -n "\${body:-}" ] || allow  # nothing judgeable -> allow
+
+# --- loop-safety: never deny an identical tool_input twice ----------------------------------
+# No stop_hook_active analog exists for PreToolUse; a per-(session,input) marker caps re-deny.
+session_id="$(printf '%s' "$input" | jq -r '.session_id // "nosession"' 2>/dev/null || echo nosession)"
+sig="$(printf '%s' "$input" | jq -c '.tool_input' 2>/dev/null | cksum | cut -d' ' -f1 2>/dev/null || echo 0)"
+seen="\${TMPDIR:-/tmp}/.stance-pre-$session_id-$sig"
+[ -f "$seen" ] && allow  # already denied this exact input once -> let it through
+
+# --- judge (SHARED backend + rubric) --------------------------------------------------------
+verdict="$(printf '%s' "$payload" | $JUDGE_CMD "$RUBRIC" 2>/dev/null)" || {
+	note "$(date -u +%Y-%m-%dT%H:%M:%SZ) judge-fail tool=$tool_name agent=\${agent_type:-?}"
+	allow
+}
+
+decision="$(printf '%s\\n' "$verdict" | sed -n 's/^VERDICT:[[:space:]]*//p' | head -1)"
+[ "$decision" = "BLOCK" ] || allow  # PASS, empty, or anything but BLOCK -> allow
+
+reason="$(printf '%s\\n' "$verdict" | sed -n 's/^REASON:[[:space:]]*//p' | head -1)"
+[ -n "$reason" ] || reason="This tool call collapsed out of the intent-driven-expert stance."
+
+# mark this exact input as denied-once (the cap) before emitting the deny
+: > "$seen" 2>/dev/null || true
+
+# --- DENY -----------------------------------------------------------------------------------
+feedback="STANCE GUARDRAIL (pre) — denied this $tool_name call: it collapses out of the \\
+intent-driven-expert stance. $reason  Own the in-remit reversible call yourself instead of handing the \\
+operator a menu; extract and serve the underlying INTENT instead of transcribing literal words into a \\
+dispatch. Decide, note the call for review, and proceed. (Legitimate exceptions that should NOT be a menu \\
+here: a genuine irreversible-outward consent choice, a true INTENT ambiguity for /elicit, or a substantive \\
+intent-extracted dispatch.)"
+
+jq -cn --arg r "$feedback" '{hookSpecificOutput:{hookEventName:"PreToolUse",permissionDecision:"deny",permissionDecisionReason:$r}}'
+exit 0
+`,
+        },
+    ],
+};
+//# sourceMappingURL=stance-guardrail-pre.js.map

package/dist/hooks/stance-guardrail-pre.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"stance-guardrail-pre.js","sourceRoot":"","sources":["../../src/hooks/stance-guardrail-pre.ts"],"names":[],"mappings":"AAEA,sFAAsF;AACtF,mFAAmF;AACnF,uFAAuF;AACvF,SAAS;AACT,wFAAwF;AACxF,6FAA6F;AAC7F,0FAA0F;AAC1F,uFAAuF;AACvF,qEAAqE;AACrE,EAAE;AACF,wEAAwE;AACxE,sFAAsF;AACtF,iFAAiF;AACjF,mFAAmF;AACnF,sFAAsF;AACtF,qFAAqF;AACrF,sFAAsF;AACtF,sFAAsF;AACtF,mEAAmE;AACnE,2DAA2D;AAC3D,mDAAmD;AAEnD,MAAM,CAAC,MAAM,kBAAkB,GAAa;IAC1C,EAAE,EAAE,sBAAsB;IAC1B,OAAO,EACL,iWAAiW;IACnW,SAAS,EAAE,SAAS;IACpB,KAAK,EAAE,CAAC;IACR,MAAM,EAAE,CAAC,sBAAsB,EAAE,uBAAuB,CAAC;IACzD,KAAK,EAAE,yBAAyB;IAChC,OAAO,EAAE,EAAE;IACX,IAAI,EAAE,EAAE;IACR,OAAO,EAAE;QACP;YACE,QAAQ,EAAE,yBAAyB;YACnC,UAAU,EAAE,0DAA0D;YACtE,UAAU,EAAE,IAAI;YAChB,OAAO,EAAE;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAkId;SACI;KACF;CACF,CAAC"}

package/dist/hooks/stance-guardrail.d.ts

@@ -0,0 +1,2 @@
+import type { HookCell } from '../manifest.js';
+export declare const stanceGuardrail: HookCell;