@dzhechkov/harness-cli 0.7.8 → 0.8.1

package/.dz-manifest.json

@@ -1,6 +1,6 @@
 {
   "manifest": {
-    "version": 1,
+    "version": 3,
     "pack": "harness-cli",
     "files": [
       {
@@ -9,7 +9,7 @@
       },
       {
         "path": "README.md",
-        "sha256": "a4000a6a9a99f570f9f8955b135fe4742ca74ab9e8c12e7feee0d859c6ab0576"
+        "sha256": "346b65ccfd61e78f8988622475fe0389248cad80f3347eb1cd83656ff6a7dc1c"
       },
       {
         "path": "dist/bin.d.ts",
@@ -49,15 +49,15 @@
       },
       {
         "path": "dist/cli.d.ts.map",
-        "sha256": "c7856b79fdf6683fe855268191805ed07b1c68f2ff7ac544d46ac3d93e4c94ef"
+        "sha256": "890a0f9a6650d531045820ecd5501c26e69178f3123d54c6ff2afae8fd339348"
       },
       {
         "path": "dist/cli.js",
-        "sha256": "27741d68ac996a060df7161b49e372f68e31b990a406f0792c79c474ff17eeca"
+        "sha256": "c4cd799f718714e3c1cf835e7f5f6e533e819dd7348e04a5134fe62fe09efdbb"
       },
       {
         "path": "dist/cli.js.map",
-        "sha256": "bea844c256e8d947464a4690d2224e4f28d61f433d6e50e5fe26bed3b415ae26"
+        "sha256": "af1ec69d7191440d499321ffb7f0ab3fc77749422b0cca233f8af2b3fb69315e"
       },
       {
         "path": "dist/core-compat.d.ts",
@@ -113,15 +113,15 @@
       },
       {
         "path": "dist/known-flags.d.ts.map",
-        "sha256": "1e6f9fd92734216f3cc392fba9e2ec7899492a6892e5891197bc582c886a38fc"
+        "sha256": "e142475e7ead4abd8773d6e83bc3a1ebd693ef2c5a3418e2ad896ab9711cff51"
       },
       {
         "path": "dist/known-flags.js",
-        "sha256": "fea029550cb557c73eea2d53d94ef09ec99ba353126a5090a658dc219e8ae5df"
+        "sha256": "302026471c90d6f6e99374b3735933bdae6dbcd0fd405fdac0950f6a161b575d"
       },
       {
         "path": "dist/known-flags.js.map",
-        "sha256": "1b46a6093d0ff5713c870b5b7566623c98a33bb212c7f1ba0c56f336620961a3"
+        "sha256": "87e001a15b8203a3ccc6dcaf12b5a2270217972109f3e357238a02f232fbfe28"
       },
       {
         "path": "keys/README.md",
@@ -133,7 +133,7 @@
       },
       {
         "path": "package.json",
-        "sha256": "1b1e7ae1af22dd91a6bc92fe1070a5b1d1710e50434abbd8e707f95bbb8f3b14"
+        "sha256": "8ee638e6241900c1da48901ea5b1e763044986d11459314fd0296f9e7c9ce169"
       },
       {
         "path": "src/bin.ts",
@@ -145,7 +145,7 @@
       },
       {
         "path": "src/cli.ts",
-        "sha256": "d8288240b5420ddca2cabdb7b358c7c18ba59724defda951d0dbc61439b6fc4c"
+        "sha256": "3c0c9e454344058a7802ec54eb3aaaea0ec8fed72f6c10038ea2fdb6d2ed3a3a"
       },
       {
         "path": "src/core-compat.ts",
@@ -161,9 +161,9 @@
       },
       {
         "path": "src/known-flags.ts",
-        "sha256": "d123f4f88f51a6b6d283a4fe6d2502bb297ad0de4eb1ef6f99f01b86a7da98a0"
+        "sha256": "4a3f93b484a5a0d89baefdb68aa85b92d5c630e48774e6ee302078fce065e60f"
       }
     ]
   },
-  "signature": "PVgkr7G4wCORcFU6EDG7gNQv8GiaqhZNJ9PNiM13CEjtWBuRyGmidP523RVPSGzXGbYrVdo/8g6Z0tpu6tE8Dg=="
+  "signature": "qnB7A5EXO4tlWiQK4Vrc+4OYP/3QeR0JSwZaXuTdONL6IyjqNGE0CHiNXelA0z1EkLcFre02G96zq33an+rgDg=="
 }

package/README.md

@@ -266,12 +266,63 @@ you know exactly which file is at fault, and you know whose defect it is.
 
 ## User Journey — from install to mastery
 
-All 77 commands (MEASURED — reproducer: `grep -c "^      case '" src/cli.ts`, the dispatch cases) mapped to a real workflow:
+All 79 commands (MEASURED — reproducer: `grep -c "^      case '" packages/@dzhechkov/harness-cli/src/cli.ts`, the dispatch cases — which is also what the bounded `## All Commands` list enumerates) mapped to a real workflow:
 
 ```
 DISCOVER → INSTALL → USE → CREATE → MAINTAIN → SHARE
 ```
 
+### `dz profile` — say once who you are, and stop being explained the wrong things
+
+The failure this closes is measured, not hypothetical. On 2026-08-28 an OS pipe buffer was explained
+to this repository's owner across three paragraphs of kernel mechanics — he holds a **CCIE**, and
+*"tail drop on a full queue with no backpressure signal"* would have landed in one line. In the same
+session `ADR` and `vitest worker` went by unexplained, in a domain where he had said plainly he is not
+a professional. Neither failure was ignorance. Both were not knowing who was listening.
+
+```bash
+dz profile init
+# 1/5 Dialogue language (ru, en, …) [ru]: ru
+# 2/5 Default register — pro / pro-lite / plain (профи / профи лайт / просто) [pro-lite]: профи лайт
+# 3/5 Назовите 2–4 области, где вам НЕ нужно пояснять термины … : networking (CCIE; NSX), cloud architecture
+# 4/5 Где наоборот — терминам нужна одна поясняющая фраза? : software architecture, testing internals
+# 5/5 Do you teach — must explanations be re-tellable? y/n [y]: y
+#
+# wrote ~/.dz/profile.json (0600) — register pro-lite (профи лайт), language ru, teaches yes
+#   deep: networking (CCIE; NSX), cloud-architecture · weak: software-architecture, testing-internals
+# synced block into ~/.claude/CLAUDE.md
+```
+
+That block now loads in **every project on the machine**, including projects where dz is not installed
+— because `~/.claude/CLAUDE.md` is read by the runtime itself, not by a hook.
+
+```bash
+dz profile show          # store path, age in days, drift verdict, the rendered block
+dz profile set weak add build-toolchains
+dz profile set register профи        # RU aliases accepted; stored as the neutral `pro`
+dz profile sync          # after a hand-edit: repairs the block, timestamped backup, foreign content untouched
+```
+
+**When to use it:** once, at onboarding — and again whenever you correct the register twice in one
+session, which is the signal the profile is wrong rather than the moment to absorb it silently.
+
+**What it deliberately does not do.** It never changes the FACTS — numbers, caveats, risks and bad
+results survive every register, or "simpler please" becomes a hole in the honesty rules. It never
+touches artifacts written for future readers: ADRs, commit messages, code comments, QE reports and npm
+READMEs keep their own conventions, because their audience is not the current operator. And it is
+redacted from training-pair capture, because `.dz/fa-training/` records the full prompt and is
+deliberately not gitignored — without that, "never write personal data into a project" would be
+defeated one path over.
+
+**What no test can prove.** That the explanation actually landed is a judgement only the reader makes.
+The acceptance step is human by design and recorded as such
+(`features/operator-profile/08_acceptance_cf7.md`): the same passage rendered at two registers, and
+the owner says which one works. That run found a real defect — a term glossed in one breath and
+another assumed in the next — and produced the rule the block now carries: **an explanation is
+self-contained; every term gets its gloss at first use in THIS passage, because the earlier text has
+scrolled away and a new session never had it.**
+
+
 ### Phase 1: Discover (what's available?)
 
 ```bash
@@ -281,9 +332,7 @@ dz help                                   # see all commands
 dz pretrain                                # analyze project files → recommend by tech stack
 dz recommend "build API and deploy to K8s" # keyword match → skills + toolkits
 dz recommend "work on this project"        # generic? → auto-runs pretrain → recommends by stack
-dz stats                                  # 54 packages, 200 skills, 10 targets, 11 presets
-#   NB: the preset figure is stats' own, and it UNDER-reports — the registry has 14
-#   (reasoning, news and pm are missing from stats). Backlog 6e6ae88d7f7660f6.
+dz stats                                  # 54 packages, 201 skills, 10 targets, 14 presets
 dz dashboard                              # visual panel — packages, adapters, skill packs
 dz registry                               # browse all 179 skills by category
 dz registry search kubernetes             # find specific skills
@@ -298,7 +347,7 @@ dz downloads                              # npm weekly download stats
 dz setup --target claude-code --preset devops  # pretrain + hooks + memory + installs the preset skills
 
 # With AgentDB vector memory (semantic search + self-learning):
-dz setup --target claude-code --preset devops --memory agentdb  # .rvf + 41 MCP tools
+dz setup --target claude-code --preset devops --memory agentdb  # vector memory + agentdb MCP server
 
 # Or just install skills (no learning):
 dz init --target claude-code --preset devops   # 30 DevOps skills
@@ -443,9 +492,9 @@ dz sign --init --out ~/.dz/keys/dz.key
 # Sign a pack. The private key MUST live outside the repo — dz refuses otherwise.
 dz sign --pack packages/@dzhechkov/skills-qe --key ~/.dz/keys/dz.key
 
-# Verify. The public key comes from the REPO (keys/dz.pub), never from the pack itself:
-# whoever replaced the pack would have replaced a key shipped inside it.
-dz verify-pack --pack packages/@dzhechkov/skills-qe          # exit 0 = unmodified
+# Verify an unpacked artifact. The public key comes from the REPO (keys/dz.pub), never from the pack:
+# whoever replaced the artifact would have replaced a key shipped inside it.
+dz verify-pack --pack ./unpacked-tarball/package             # exit 0 = artifact unmodified
 dz verify-pack --pack ./downloaded-pack --pubkey keys/dz.pub # explicit trust root
 
 # The SBOM on its own (CycloneDX 1.5, a file-level bill of materials for the pack):
@@ -453,9 +502,24 @@ dz sbom --pack packages/@dzhechkov/skills-qe                 # print to stdout
 dz sbom --pack packages/@dzhechkov/skills-qe --out sbom.json # write to a file
 ```
 
-A single flipped byte, a deleted file, or an **added** file all fail verification and the offending
-path is named. `node_modules`/`.git` are unsigned territory by design (npm ships neither) — the sign and
-verify walks share those exclusions, while a symlink smuggled anywhere ELSE in the pack still fails loudly.
+A single flipped byte, a deleted file, or an **added** file inside the authenticated npm shipment set
+fails verification and names the path. Directory segments `node_modules`, `.git`, `.agentic-qe`, and
+`.dz` are unsigned local/dependency/VCS state by design and are absent from both manifest and SBOM; an OK
+verdict makes no claim about bytes placed there. A symlink smuggled anywhere else still fails loudly.
+`sbom.json` is required even though it is not self-hashed: after the signature is valid, `verify-pack`
+derives the canonical CycloneDX bytes from the signed manifest and rejects a missing, malformed, duplicated,
+renamed, re-hashed, or metadata-modified SBOM. This keeps the trust chain acyclic without leaving the SBOM
+as unauthenticated decoration.
+CycloneDX `SHA-256` fields describe raw bytes only. Because packers may reorder ordinary
+`package.json` metadata, format v3 publishes its semantic canonical digest through explicit
+`dz:canonical-json-sha256-v2` and `dz:digest-basis=package-json-ordered-conditions-v2` properties.
+Canonicalisation still sorts packer-noise keys, but preserves every object key order under `exports`,
+`imports`, and `typesVersions`; changing first-match condition order therefore changes the signed digest.
+Current/v3 signing and verification refuse malformed, duplicate-key, or precision-losing JSON.
+Verification retains compatibility-only readers for existing v1/v2 manifests; new evidence emits v3.
+`dz sign` hashes the pnpm tarball because pnpm rewrites `package.json` and may synthesize or omit files;
+the authoring tree is therefore not the signed object. `dz publish` rebuilds and verifies that exact
+artifact, while direct `verify-pack` is for an already unpacked artifact or installed package.
 Re-sign after ANY pack change (the manifest hashes `package.json` too) — sign is the LAST step before publish. Every degenerate input (no manifest, empty file list, empty signature, no public key)
 fails **closed** — absence never reads as success. `dz doctor` **and** `dz drift-check` run this check
 over the installed packs: a **tampered** pack is fatal (blocks); an **unsigned** pack or a missing trust
@@ -1768,16 +1832,16 @@ runs a command that MEASURES the declared artifacts itself. It refuses a null re
 never recorded as done), an absent or partially-present artifact set, and a stage that declares nothing
 to witness — so a stage that did not happen can no longer be recorded, which the old mechanism allowed.
 
-## All Commands (77)
+## All Commands (79)
 
-*(73 MEASURED — reproducer: `grep -c "^      case '" src/cli.ts`, the dispatch cases.)*
+*(79 MEASURED — reproducer: `grep -c "^      case '" packages/@dzhechkov/harness-cli/src/cli.ts`, the dispatch cases — which is also what the bounded `## All Commands` list enumerates.)*
 
 ```
 dz setup             --target <name> [--preset <name>] [--select id,id,...] [--skills-dir <dir>] [--memory agentdb] [--no-memory] [--no-hooks] [--install-driver] [--force]
 dz init              --target <name> [--preset <name>] [--select id,id,...] [--force]
 dz install           <npm-pkg> [--target <name>] [--project <dir>] [--force]
 dz bundle            [--preset <name> | --select id,...] [--out <dir>] [--skills-dir <dir>] [--force]
-dz teach             "<pattern>" [--reward <0-1>] [--domain <name>] [--type rule|success-pattern|lesson-learned] [--project <dir>] [--no-mirror] [--guard]   # --project pins the learned store to <dir>/.dz (not the cwd) — pin to a canonical brain
+dz teach             "<pattern>" [--reward <0-1>] [--domain <name>] [--type rule|success-pattern|lesson-learned] [--project <dir>] [--to project|global] [--no-mirror] [--guard]   # --project pins the learned store to <dir>/.dz (not the cwd) — pin to a canonical brain; --to picks WHICH store (global = ~/.dz, shared across projects). Session default: export DZ_LEARN=global. Project default: .dz/config.json -> learning.teachTo. An unknown value is REFUSED, never defaulted. Every write prints the path AND what chose it.
 dz teach --reinforce "<dzId-or-exact-text>" [--project <dir>] # bump an existing learned pattern instead of writing a near-duplicate
 dz teach --from-json <file> [--project <dir>] [--no-mirror] [--harmonize]   # bulk-import a `dz recall --all --json` export; prints a harmonize dry-run advisory
 dz consolidate       [--sessions-dir <dir>] [--project <dir>] [--no-mirror]
@@ -1818,7 +1882,7 @@ dz registry          [search <query>] [--category <cat>]
 dz benchmark         <skill-dir> [--compare <dir>] [--all]
 dz mcp-scan          [path] [--json]   (static agent-permission audit; exit 0/1/2 = clean/medium/high)
 dz architecture      [--json] [--revise] [--check --slug <s> --desc "<text>" [--cmd a,b] [--subsystem <id>]]   # product map (subsystems = the README jobs + foundation/arsenal/ops); --revise = drift check (exit 1); --check = forward-looking сverka of a proposed feature vs map+vision (exit 2 on a hard-stop dup)
-dz project-skills    [--json] [--stages-json]   # polymorphic feature-adr: resolve architecture/project-skills.json (fixed roles product-vision/critic/brand/impl-bar + open extra[]) into per-stage guidance; absent = generic run (byte-identical); feature-adr Step 0 reads it
+dz project-skills    [--json] [--stages-json] [--project <dir>]   # polymorphic feature-adr: resolve architecture/project-skills.json (fixed roles product-vision/critic/brand/impl-bar + open extra[]) into per-stage guidance; absent = generic run (byte-identical); feature-adr Step 0 reads it
 dz mr-rakes          [--json] [--candidate N --confirmed N] [--teach] [--gen-critic <path> [--apply]]   # mine review artifacts (features' QE reports + REVIEW files) for RECURRING mistakes; anti-noise (≥2/≥3 distinct sources); close into dz teach + a project-critic skill (R2 critic role)
 dz retro             [transcript] [--json] [--threshold N] [--no-teach] [--install-hook]   # per-session retro: mine the current session for recurring PROCESS rakes (claimed-done-without-verify, committed-without-verify, n-fix-cycles, ignored-correction), drill the user (socratic + checklist) AND teach the agent — co-learning via the dz teach store
 dz feature-adr-setup [--plan] [--from-spec <f>] [--apply]   # guided project onboarding engine (behind the `configure-feature-adr` skill): --plan shows which docs exist/missing; --from-spec scaffolds vision/map/testing/project-skills (propose; --apply writes; augment-never-clobber)
@@ -1839,6 +1903,8 @@ dz epoch-replay --score <judgments.json> --work-order <file> [--slice <name>] [-
 dz score             --slug <feature> [--project <dir>] [--json]   # process scorecard for ONE feature-adr run, from its artifacts: ADR confirmation, discrimination proof, cross-model QE grade, live verification, README-first, learning loop, amendments — DESCRIPTIVE-ONLY (a low score exits 0); evidence lines are shown so the reader judges the heuristics
 dz recap             [--day|--week|--month] [--at <ISO date>] [--refresh-publishes] [--project <dir>] [--json]   # what was done over a window, from records only. `--refresh-publishes` fills the third-party publish-times cache first (the ONLY place this command touches the network — 51 packages in ~7s, batches of 8); the report itself always reads the cache, prints its AGE, and names any package the registry did not answer for: those are MISSING from the numbers, not zero. Deliveries carry the grade an independent review STATED — a report naming two different grades is reported AMBIGUOUS, never guessed; registry publishes come from a cache (51 packages cost 18.3s over the network, MEASURED — never inside a report); gate verdicts and knowledge reuse come from the local stores. --quarter/--half-year/--year are RECOGNISED and REFUSED with the real span in days: there is exactly ONE complete quarter and the longest record is 174 days, so a quarter-over-quarter comparison is arithmetically impossible and a year would be fabrication. Every section carries its own data-start date, and "the source was not read" never prints as a zero. Contaminated measures are NOT computed and the report says so: commit count (this project mandates a commit per logical change), lines changed (352 of 1318 commits are docs), token spend (self-declared an estimate, once wrong sixfold), learning-event volume (the curve tracks when hooks were installed), inventory counts (monotonic — they can only flatter), lesson count (54% of the pool has never been read). exit 0 reported / 2 refused
 dz cadence           [--window day|week|month|quarter|halfyear|year] [--json]   # the RHYTHM view of what shipped: graded-shipment counts bucketed by ISO week, npm-publish cadence (reads `dz recap`'s publish-times cache — run `dz recap --refresh-publishes` to warm it), guard repeat DECAY on the FIXED rule set (a rule joins only with pre-window history, so a newborn rule's zero is youth, not virtue — the no-stubs false-zero class excluded by construction), and recall reuse per week. A window deeper than 2× the record is REFUSED with the measured depth and the largest honest window named (a cadence from under two full windows is scale forgery). Sibling of `dz recap`: recap is the narrative what-was-done report over one window; cadence is the week-by-week rhythm across the window. exit 0 / 2 refused-window / 1 usage
+dz profile           init | show | set <field> <value> | sync [--target claude]   # WHO is being talked to. Per-USER store ~/.dz/profile.json (0600, never under a project root), delivered as a marked block in ~/.claude/CLAUDE.md so it loads in EVERY project on the machine, dz installed or not. Two axes: default register (pro | pro-lite | plain; RU aliases профи / профи лайт / просто) and named domains that move it — `deep` = full pro no scaffolding, `weak` = one plain sentence EVERY time unprompted, MANDATORY there. Three fixed rules ride along and the register cannot override them: an explanation is SELF-CONTAINED (every term glossed at first use in THIS passage), the register governs dialogue and owner-facing surfaces but NEVER ADRs / commits / QE reports / npm READMEs, and it changes FORM not FACTS. `show` always prints the store path and the profile's age; an unknown register value is REFUSED naming the accepted set, never silently defaulted; a hand-edited block is reported as drift and `sync` repairs it with a timestamped backup, foreign content preserved byte-for-byte. Redacted from training-pair capture (.dz/fa-training/ records the full prompt and is deliberately not gitignored)
+dz qe-rounds          (--slug <feature> | --feature-dir <abs>) [--ceiling <n>] [--project <dir>] [--json]   # how many Step-8 review rounds has this feature ALREADY had? The rule "Max iterations: 3" lived only as a sentence in a prose module, so every restart of the agent forgot it — MEASURED, one real slug reached 38 graded rounds. Reads what `dz qe-bridge` already wrote (signoff-<runId>.json / failed-*.json under features/<slug>/.fa-state/qe-bridge) and writes NOTHING itself, so it answers for runs already past. A round is a runId, not a file; an attempt with no verdict is counted separately and never merged; ONE directory, never a union across checkouts. FAILS CLOSED: if any record cannot be counted the verdict is NOT ESTABLISHED, never a smaller number presented as the answer. exit 0 under the ceiling / 1 at-or-over — the owner decides, this never judges whether the rounds were warranted / 2 NOT ESTABLISHED, which is never "zero rounds"
 dz provenance-check   --manifest <sources.json> [--project <dir>] [--json]   # nothing goes out citing a source that may not leave this machine. Checks PROVENANCE, not words: every claim in a draft names its source, and a source is cleared only when it is a KNOWN kind that resolves safely. Repo paths are classified by `git -C <root> check-ignore` over the RESOLVED path — so a symlink into an ignored directory is refused, not cleared (MEASURED: git classifies the string and never dereferences), and the verdict does not change with your working directory. Store records need naming in the git-TRACKED `provenance-public.json`, so declaring one public is a reviewable commit rather than a field inside an ignored store. Anything else is refused: an undeclared kind is never inferred from the path's shape. exit 0 allowed / 1 blocked / 3 NOT ESTABLISHED — an empty manifest, an unreadable one, or an oracle that did not run is never a pass. **What it cannot do, said on the passing path too:** it proves what was CITED. It cannot see a paraphrase with no citation, nor confidential text pasted by hand into an allowed file. Read the draft.
 dz name-check         [--command <n>] [--module <basename>] [--export <a,b>] [--project <dir>] [--json]   # is this name free, BEFORE a line of code? Twice in one day a collision broke the build outright — `dz retro` was already a command, `decideProvenance` already an export — and both were answerable in advance. Scans workspace SOURCE and never `dist`, because a stale build answers 'free' confidently (MEASURED: half an hour of convincing live runs against a previous build while tsc was red). Checks a command name against the dispatcher AND the help block, a module basename against every package's src/, and exported identifiers against every declaration — naming the DECLARING file, not the barrel. exit 0 all free / 1 at least one taken / 2 nothing asked or the scan read nothing — an empty sweep is never a clean bill. **Honest limit, printed on the passing path:** it reads declarations, so a re-export under a different name stays the build's job.
 dz tg-post            --draft <file.html> [--manifest <sources.json>] [--channel <@name>] [--send --yes] [--night] [--max-per-day <n>] [--json]   # the sender for an APPROVED genai-tweets-channel post, held to the channel's own accepted ADRs: HTML mode only (never MarkdownV2 — 18 escapes against 3, one miss is a 400); link preview OFF by default (x.com previews in Telegram are broken since 2022); the 00:00-06:00 MSK quiet window refuses without an explicit --night. THE DEFAULT RUN IS A DRY-RUN: tag balance and allowed-tag checks, bare &/< detection, the 4096 visible-character limit with the overshoot counted — every issue named in one pass, not just the first. The provenance gate runs IN-PROCESS over --manifest, and a draft with no manifest is refused as unchecked when a send is asked. A real send needs --send AND --yes — ADR-004's standing order that publishing stays manual, stated out loud each time. Three autopublish guards run FAIL-CLOSED, in a fixed order: the **stop-cord** (`.dz/tg-post/HALT` exists ⇒ nothing publishes, checked FIRST so no bug in a later gate can route around it), **dedup** by the sha256 of the post's VISIBLE text (what the reader sees, not the bytes — a whitespace-different draft is the same post), and the **daily limit** (10 by default, `--max-per-day <n>` to change it), counted over the trailing 24h. The journal is two-phase: a `pending` row is written BEFORE the network call and a `sent` row after Telegram accepts, so a crash between the two is caught by dedup on the next run instead of double-publishing; only `sent` rows eat the daily ceiling. An UNREADABLE journal REFUSES — an unreadable counter does not prove the ceiling is unreached. The provenance gate also clears `kind: url`: a well-formed http(s) URL is public by construction so there is nothing local to protect, while a `file://`, a bare path or a non-URL is refused, never inferred. The bot token (TELEGRAM_BOT_TOKEN or telegram.tokenFile) is never printed, and the gates run BEFORE any secret is read. exit 0 sent or clean dry-run / 1 refused / 2 usage
@@ -2962,7 +3028,7 @@ dz setup --target claude-code --preset devops --memory agentdb   # AgentDB (vect
 | Capability | JSONL (default) | AgentDB (`--memory agentdb`) |
 |------------|----------------|------------------------------|
 | **Session tracking** | Append-only JSONL log | **Real rows in the shared `.dz/agentdb.db`** (`dz_session_events` telemetry, written by session hooks) |
-| **Pattern storage** | `dz teach` → patterns.jsonl | `dz teach` (lexical) + `agentdb_pattern_store` / session-hook writes → `.dz/agentdb.db` |
+| **Pattern storage** | `dz teach` → patterns.jsonl | `dz teach` (lexical) + session-hook writes → `.dz/agentdb.db`; `agentdb_pattern_store` → `.dz/agentdb-mcp.db` (separate stores — see below) |
 | **Search** | Keyword (grep) | **Semantic** (HNSW nearest-neighbor, cosine similarity) |
 | **Retrieval** | Sequential scan | **O(log n)** approximate nearest neighbor |
 | **Self-learning** | Frequency-based | **9 RL algorithms** + Thompson Sampling bandit |
@@ -2972,7 +3038,7 @@ dz setup --target claude-code --preset devops --memory agentdb   # AgentDB (vect
 | **Skill composition** | Manual (presets) | **Bandit-picked** skill chains (A→B→C) |
 | **Audit trail** | No | **Cryptographic attestation log** |
 | **Size** | ~0 KB | 4.6 MB (agentdb) |
-| **MCP tools** | 0 | **41 tools** (pattern, reflexion, causal, skill, hierarchy) |
+| **MCP tools** | 0 | pattern, reflexion, causal, skill, hierarchy (whatever the pinned `agentdb` build exposes — `dz` hardcodes no count) |
 | **Dependencies** | None | agentdb (optional, via npx) |
 
 ### AgentDB self-learning algorithms
@@ -3012,6 +3078,50 @@ Two surfaces:
   { "memory": { "learning": { "deltaRerank": true } } }
   ```
 
+### Bandit payoff re-rank — "did this lesson ever actually help?"
+
+Similarity answers *is this lesson **about** the topic*. SAFLA delta answers *is its payoff **rising***.
+Neither answers *has it ever **resolved** anything* — three lessons can all be about Codex while only one
+has ever closed a real defect. The bandit adds that axis: a Beta posterior per `(context, lesson)` fed by
+your **confirmations** (`dz teach --reinforce`), turned into a **bounded** re-rank term.
+
+```jsonc
+// .dz/config.json
+{ "memory": { "learning": {
+    "banditRerank": false,       // arm the payoff term (default false)
+    "banditExploration": false   // allow unproven lessons a trial lift (default false)
+} } }
+```
+
+What arming each one costs, plainly:
+
+- **`banditRerank`** — recall gains a payoff term capped at the same constant the reinforcement and
+  SAFLA-delta terms use, so it reorders near-ties and can never overturn a decisive relevance gap.
+  Similarity still decides WHICH lessons are candidates; the bandit only reorders WITHIN them, and it
+  never adds a lesson similarity did not select. Deterministic (posterior mean, no sampling), so two
+  identical queries give identical order. A lesson with no confirmations yet contributes exactly `0` —
+  on day one the feature changes nothing, which is the deliberate price of refusing a random lift.
+- **`banditExploration`** — grants *unproven* lessons a bounded trial lift so they can accumulate
+  evidence. This **weakens the view-does-not-promote posture** the store relies on, which is why it is a
+  separate flag and ships off. Quarantined lessons are excluded from exploration in **every**
+  configuration, and the auto-inject hook is untouched in all of them. `banditExploration` without
+  `banditRerank` is a warned no-op.
+
+An **exposure is not a reward**: merely seeing a lesson in a recall result is counted in its own channel
+and never moves the posterior. State lives in `.dz/lesson-bandit/state.json` behind a named lock, is pure
+derived data, and can be deleted at any time — you lose the learned posteriors, never a lesson.
+
+```bash
+dz recall "codex" --json     # armed ⇒ a `{"bandit": …}` line on stderr: contextKey, armsConsidered
+                             # (the POST-cut list), quarantinedExcluded, unknownArms, moved, reason
+dz compounding               # a bandit-health section: arms with measured payoff, reward events vs
+                             # exposure events, write errors, movedRate — INSUFFICIENT_DATA when empty
+```
+
+`moved` is the honest headline. `moved: 0` over many queries means the feature is armed and doing
+nothing — and none of these numbers claims the re-ranking is *better*: `moved` counts change, not
+improvement.
+
 ### How to enable AgentDB
 
 ```bash
@@ -3019,9 +3129,11 @@ Two surfaces:
 dz setup --target claude-code --preset devops --memory agentdb
 ```
 
-This installs `agentdb` + `better-sqlite3` locally (prebuilt, no build tools), writes `.dz/agentdb-writer.mjs`, registers the agentdb MCP server (41 tools) **with `AGENTDB_PATH` pinned to `.dz/agentdb.db`**, and configures session hooks. The agent can immediately use `agentdb_pattern_store`, `agentdb_reflexion_recall`, etc.
+This installs `agentdb` + `better-sqlite3` locally (prebuilt, no build tools), writes `.dz/agentdb-writer.mjs`, registers the agentdb MCP server in `.mcp.json` **pinned to the exact installed version (never `@latest`) with `AGENTDB_PATH` = `.dz/agentdb-mcp.db`**, and configures session hooks. The agent can immediately use `agentdb_pattern_store`, `agentdb_reflexion_recall`, etc.
 
-**Session hooks make real writes into the shared store.** On every session start/end the hook runs the generated writer, which inserts a **metadata-only telemetry row** into the `dz_session_events` table of `.dz/agentdb.db` — **the same file the `agentdb_*` MCP tools are pinned to** via `AGENTDB_PATH`. Deliberately *not* an embedding write: markers carry no semantic content, so they stay out of the HNSW index and cost ~milliseconds (no model load, nothing blocks your session). Real learnings enter the vector index in-session via `agentdb_pattern_store` / `agentdb_reflexion_store`. If `better-sqlite3` isn't installed yet, the writer degrades to an honestly-labelled `.dz/sessions.jsonl` line and self-heals once the deps exist. *(Restart Claude Code after setup so the MCP server + hooks load.)*
+**Two stores, never one file.** The session hooks write into `.dz/agentdb.db`; the MCP server reads and writes `.dz/agentdb-mcp.db`. This split is deliberate: the hook writer opens SQLite natively via better-sqlite3, while the MCP server silently falls back to **sql.js** when better-sqlite3 has no usable binary for your Node version — and sql.js persists by rewriting the **whole file** from memory, discarding pages the other engine just committed. Measured in the dz repo on 2026-07-09 under exactly that arrangement: of 20 samples, **5 were zero bytes and 4 were torn**. So `dz setup` refuses to point both at one file, `dz doctor` reports a shared store as `agentdb store separation: ok:false`, and a pre-existing shared-store install is re-pointed on your next plain `dz setup --memory agentdb` (no `--force` needed). The rows already written by the MCP server into the old shared file are **not** copied into the new store — copying out of a file two engines may have torn would launder unknown bytes; the MCP store starts empty.
+
+**Session hooks make real writes into the writer's own store.** On every session start/end the hook runs the generated writer, which inserts a **metadata-only telemetry row** into the `dz_session_events` table of `.dz/agentdb.db`. Deliberately *not* an embedding write: markers carry no semantic content, so they stay out of the HNSW index and cost ~milliseconds (no model load, nothing blocks your session). Real learnings enter the vector index in-session via `agentdb_pattern_store` / `agentdb_reflexion_store`, in `.dz/agentdb-mcp.db`. If `better-sqlite3` isn't installed yet, the writer degrades to an honestly-labelled `.dz/sessions.jsonl` line and self-heals once the deps exist. *(Restart Claude Code after setup so the MCP server + hooks load.)*
 
 | Command | When to use |
 |---------|-------------|
@@ -3118,12 +3230,18 @@ Drop an `architecture/project-skills.json` (no pipeline edits needed):
   "extra": [ { "skill": ".dz-skills/security-checklist/SKILL.md", "phase": "qe", "as": "guidance" } ] }
 ```
 ```bash
-dz project-skills            # who-injected report (which skill feeds which stage)
-dz project-skills --json     # the plan feature-adr Step 0 reads
+dz project-skills                    # who-injected report (which skill feeds which stage)
+dz project-skills --json             # the plan feature-adr Step 0 reads
+dz project-skills --project /some/repo   # read THAT repo's manifest, whatever your cwd is
 ```
 No manifest ⇒ a normal generic run (byte-identical). With one, feature-adr folds each skill into its stage as guidance
 (`product-vision`→design+QE, `critic`→QE, `brand`→code).
 
+`--project <dir>` names the root explicitly. Until harness-cli 0.7.9 the command read the manifest from **cwd only**,
+so a feature-adr run whose target repo is a separate checkout probed the wrong place, found nothing, and quietly fell
+back to a generic run — no error, just missing project guidance in every stage. Step 0 now probes the target repo first
+and falls back to the workspace, so a manifest is found wherever it actually lives.
+
 ### `dz mr-rakes` — when you want to learn what mistakes this project keeps repeating
 
 Run it once you have a few reviews (feature-adr QE reports / MR reviews) to mine the **recurring** rakes:
@@ -4096,6 +4214,22 @@ npx @dzhechkov/p-replicator init
 
 ## Status
 
+`v0.8.1` — **`dz profile` (the 79th command), hardened by four cross-family review rounds until one came back clean.** Say once who you
+are — register, language, deep and weak domains — and every Claude session on the machine loads it from a marked block in
+`~/.claude/CLAUDE.md`; the store lives at `~/.dz/profile.json` (0600, never inside a project, redacted from training-pair capture).
+The review ladder did what it exists to do, each round finding a hole in the previous round's fix: a marker literal could enter the
+profile through `set` and poison every later sync (refused at the one validation seam all write paths cross); the CLI echoed
+`language: <value>` BEFORE a refused write exited 2 — a success-looking confirmation of a mutation never applied (echo now deferred
+until the write lands); the validation boundary itself could throw (`JSON.stringify(2n)` is a TypeError) through the documented
+never-throws contract of `syncProfileBlock` (the validator is now total); and the catch path formatting the thrown value could throw
+too — conversion hooks run on the thrown value, so a hostile getter throwing `Object.create(null)` blew up the catch itself (coercion
+now sits under its own try with a fixed fallback). Round 8 reviewed the final state and returned no findings, executing the tests
+(22/22, MEASURED — reproducer `npx vitest run test/profile.test.ts` in `packages/@dzhechkov/harness-core`) and typecheck itself.
+Release gates: tests / syntax / smoke green across 54 packages (MEASURED — reproducer `dz release --filter harness`, verdict
+2026-08-28: tests 32 passed, syntax 215 passed, smoke 19 passed); the audit gate is red on advisories
+that live ONLY in workspace dev tooling — the published pair's runtime deps are workspace siblings plus `proper-lockfile` and `yaml`,
+none affected — taken through the gate's own documented fallback with the scoping fix filed.
+
 `v0.7.8` — **the observability pass, one new verb, and a publisher that stops rewriting history.** `dz feature-adr-record --backfill` fills the
 run-cost ledger from the host's own workflow record — dry-run by default, `--yes` writes atomically.
 A derived number is MARKED (`filledFrom`/`filledBy`), a number you typed is never overwritten and any

package/dist/cli.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"cli.d.ts","sourceRoot":"","sources":["../src/cli.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AASH,OAAO,EAAoC,KAAK,EAAa,KAAK,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAK3G,OAAO,EA4CL,iBAAiB,EAmBjB,KAAK,oBAAoB,EAoVzB,KAAK,YAAY,EAyClB,MAAM,yBAAyB,CAAC;AAgJjC,2EAA2E;AAC3E,MAAM,WAAW,KAAK;IACpB,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;IACxC;;;;;;;;;;OAUG;IACH,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;IAC3C;;;;OAIG;IACH,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC;IACxB;;;;;OAKG;IACH,QAAQ,CAAC,aAAa,CAAC,EAAE,iBAAiB,CAAC;IAC3C;;;;;OAKG;IACH,QAAQ,CAAC,aAAa,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,KAAK,IAAI,CAAC;CACjE;AAED,yFAAyF;AACzF,MAAM,MAAM,iBAAiB,GAAG,CAC9B,GAAG,EAAE,MAAM,EACX,IAAI,EAAE;IAAE,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAA;CAAE,KACvD;IAAE,QAAQ,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,EAAE,OAAO,CAAA;CAAE,CAAC;AAilF9E;;;;;;;GAOG;AACH,wBAAsB,yBAAyB,CAAC,CAAC,EAAE,EAAE,EAAE,MAAM,OAAO,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC,CA0BnF;AA64GD,MAAM,WAAW,mBAAmB;IAClC,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACxC,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACtC,QAAQ,CAAC,KAAK,CAAC,EAAE,OAAO,CAAC;IACzB,QAAQ,CAAC,MAAM,CAAC,EAAE,OAAO,CAAC;IAC1B,6EAA6E;IAC7E,QAAQ,CAAC,MAAM,CAAC,EAAE,OAAO,CAAC;CAC3B;AAED;;;;;;;;GAQG;AACH,wBAAgB,qBAAqB,CAAC,KAAK,EAAE,mBAAmB,GAAG,UAAU,CAAC,OAAO,iBAAiB,CAAC,CAAC,CAAC,CAAC,CAQzG;AAED,MAAM,WAAW,iBAAiB;IAChC,QAAQ,CAAC,EAAE,EAAE,OAAO,CAAC;IACrB,QAAQ,CAAC,MAAM,EAAE,SAAS,MAAM,EAAE,CAAC;IACnC,QAAQ,CAAC,MAAM,EAAE,SAAS,MAAM,EAAE,CAAC;CACpC;AAED;;;;;;GAMG;AACH,wBAAgB,iBAAiB,CAAC,MAAM,EAAE,oBAAoB,EAAE,KAAK,SAAkB,GAAG,iBAAiB,CAoB1G;AAwGD,wBAAgB,iBAAiB,CAC/B,KAAK,EAAE,mBAAmB,EAC1B,IAAI,GAAE,CAAC,OAAO,EAAE,UAAU,CAAC,OAAO,iBAAiB,CAAC,CAAC,CAAC,CAAC,KAAK,oBAA+C,EAC3G,KAAK,SAAa,GACjB,iBAAiB,GAAG;IAAE,QAAQ,CAAC,MAAM,EAAE,oBAAoB,CAAA;CAAE,CAK/D;AAsiED,wFAAwF;AACxF,wBAAgB,uBAAuB,CAAC,KAAK,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,OAAO,GAAG,OAAO,CAElG;AA4BD,gFAAgF;AAChF,wBAAgB,qBAAqB,IAAI;IAAE,QAAQ,EAAE,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,YAAY,KAAK,IAAI,CAAC;IAAC,OAAO,EAAE,MAAM,MAAM,EAAE,CAAC;IAAC,IAAI,EAAE,MAAM,MAAM,CAAA;CAAE,CAM7I;AAo8DD,MAAM,WAAW,eAAe;IAC9B,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;IACxB,QAAQ,EAAE,OAAO,CAAC;IAClB,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;CAC3B;AAED;;;;;;;;;GASG;AACH,wBAAsB,eAAe,CACnC,GAAG,EAAE,MAAM,EACX,IAAI,EAAE,MAAM,EAAE,EACd,WAAW,EAAE,MAAM,EACnB,SAAS,EAAE,MAAM,EACjB,GAAG,GAAE,MAAsB,EAC3B,SAAS,GAAE,OAAO,KAAa,GAC9B,OAAO,CAAC,eAAe,CAAC,CAI1B;AA8CD,gFAAgF;AAChF,wBAAgB,oBAAoB,CAAC,MAAM,EAAE,YAAY,EAAE,MAAM,EAAE,MAAM,CAAC,UAAU,GAAG,MAAM,CAAC,UAAU,CAEvG;AAED;;;;;;;;;;;;;;;GAeG;AACH,wBAAsB,cAAc,CAClC,GAAG,EAAE,MAAM,EACX,IAAI,EAAE,MAAM,EAAE,EACd,IAAI,EAAE;IACJ,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,SAAS,EAAE,MAAM,CAAC;IAClB,GAAG,EAAE,MAAM,CAAC;IACZ,QAAQ,EAAE,OAAO,CAAC;IAClB,SAAS,CAAC,EAAE,OAAO,KAAK,CAAC;IACzB,OAAO,CAAC,EAAE,CAAC,KAAK,EAAE,YAAY,KAAK,IAAI,CAAC;IACxC;;;;;;OAMG;IACH,OAAO,CAAC,EAAE,OAAO,GAAG,WAAW,CAAC;IAChC,kGAAkG;IAClG,QAAQ,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;CAC9B,GACA,OAAO,CAAC,eAAe,CAAC,CA8D1B;AAutED,wBAAsB,MAAM,CAAC,IAAI,EAAE,MAAM,EAAE,EAAE,EAAE,GAAE,KAAU,GAAG,OAAO,CAAC,MAAM,CAAC,CA8N5E"}
+{"version":3,"file":"cli.d.ts","sourceRoot":"","sources":["../src/cli.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AASH,OAAO,EAAoC,KAAK,EAAa,KAAK,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAK3G,OAAO,EA4CL,iBAAiB,EAmBjB,KAAK,oBAAoB,EAuVzB,KAAK,YAAY,EAoElB,MAAM,yBAAyB,CAAC;AAwJjC,2EAA2E;AAC3E,MAAM,WAAW,KAAK;IACpB,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;IACxC;;;;;;;;;;OAUG;IACH,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;IAC3C;;;;OAIG;IACH,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC;IACxB;;;;;OAKG;IACH,QAAQ,CAAC,aAAa,CAAC,EAAE,iBAAiB,CAAC;IAC3C;;;;;OAKG;IACH,QAAQ,CAAC,aAAa,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,KAAK,IAAI,CAAC;CACjE;AAED,yFAAyF;AACzF,MAAM,MAAM,iBAAiB,GAAG,CAC9B,GAAG,EAAE,MAAM,EACX,IAAI,EAAE;IAAE,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAA;CAAE,KACvD;IAAE,QAAQ,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,EAAE,OAAO,CAAA;CAAE,CAAC;AAwuF9E;;;;;;;GAOG;AACH,wBAAsB,yBAAyB,CAAC,CAAC,EAAE,EAAE,EAAE,MAAM,OAAO,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC,CA0BnF;AAu+GD,MAAM,WAAW,mBAAmB;IAClC,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACxC,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACtC,QAAQ,CAAC,KAAK,CAAC,EAAE,OAAO,CAAC;IACzB,QAAQ,CAAC,MAAM,CAAC,EAAE,OAAO,CAAC;IAC1B,6EAA6E;IAC7E,QAAQ,CAAC,MAAM,CAAC,EAAE,OAAO,CAAC;CAC3B;AAED;;;;;;;;GAQG;AACH,wBAAgB,qBAAqB,CAAC,KAAK,EAAE,mBAAmB,GAAG,UAAU,CAAC,OAAO,iBAAiB,CAAC,CAAC,CAAC,CAAC,CAQzG;AAED,MAAM,WAAW,iBAAiB;IAChC,QAAQ,CAAC,EAAE,EAAE,OAAO,CAAC;IACrB,QAAQ,CAAC,MAAM,EAAE,SAAS,MAAM,EAAE,CAAC;IACnC,QAAQ,CAAC,MAAM,EAAE,SAAS,MAAM,EAAE,CAAC;CACpC;AAED;;;;;;GAMG;AACH,wBAAgB,iBAAiB,CAAC,MAAM,EAAE,oBAAoB,EAAE,KAAK,SAAkB,GAAG,iBAAiB,CAoB1G;AAwGD,wBAAgB,iBAAiB,CAC/B,KAAK,EAAE,mBAAmB,EAC1B,IAAI,GAAE,CAAC,OAAO,EAAE,UAAU,CAAC,OAAO,iBAAiB,CAAC,CAAC,CAAC,CAAC,KAAK,oBAA+C,EAC3G,KAAK,SAAa,GACjB,iBAAiB,GAAG;IAAE,QAAQ,CAAC,MAAM,EAAE,oBAAoB,CAAA;CAAE,CAK/D;AA2mED,wFAAwF;AACxF,wBAAgB,uBAAuB,CAAC,KAAK,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,OAAO,GAAG,OAAO,CAElG;AA4BD,gFAAgF;AAChF,wBAAgB,qBAAqB,IAAI;IAAE,QAAQ,EAAE,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,YAAY,KAAK,IAAI,CAAC;IAAC,OAAO,EAAE,MAAM,MAAM,EAAE,CAAC;IAAC,IAAI,EAAE,MAAM,MAAM,CAAA;CAAE,CAM7I;AAo8DD,MAAM,WAAW,eAAe;IAC9B,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;IACxB,QAAQ,EAAE,OAAO,CAAC;IAClB,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;CAC3B;AAED;;;;;;;;;GASG;AACH,wBAAsB,eAAe,CACnC,GAAG,EAAE,MAAM,EACX,IAAI,EAAE,MAAM,EAAE,EACd,WAAW,EAAE,MAAM,EACnB,SAAS,EAAE,MAAM,EACjB,GAAG,GAAE,MAAsB,EAC3B,SAAS,GAAE,OAAO,KAAa,GAC9B,OAAO,CAAC,eAAe,CAAC,CAI1B;AA8CD,gFAAgF;AAChF,wBAAgB,oBAAoB,CAAC,MAAM,EAAE,YAAY,EAAE,MAAM,EAAE,MAAM,CAAC,UAAU,GAAG,MAAM,CAAC,UAAU,CAEvG;AAED;;;;;;;;;;;;;;;GAeG;AACH,wBAAsB,cAAc,CAClC,GAAG,EAAE,MAAM,EACX,IAAI,EAAE,MAAM,EAAE,EACd,IAAI,EAAE;IACJ,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,SAAS,EAAE,MAAM,CAAC;IAClB,GAAG,EAAE,MAAM,CAAC;IACZ,QAAQ,EAAE,OAAO,CAAC;IAClB,SAAS,CAAC,EAAE,OAAO,KAAK,CAAC;IACzB,OAAO,CAAC,EAAE,CAAC,KAAK,EAAE,YAAY,KAAK,IAAI,CAAC;IACxC;;;;;;OAMG;IACH,OAAO,CAAC,EAAE,OAAO,GAAG,WAAW,CAAC;IAChC,kGAAkG;IAClG,QAAQ,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;CAC9B,GACA,OAAO,CAAC,eAAe,CAAC,CA8D1B;AAm/ED,wBAAsB,MAAM,CAAC,IAAI,EAAE,MAAM,EAAE,EAAE,EAAE,GAAE,KAAU,GAAG,OAAO,CAAC,MAAM,CAAC,CAkO5E"}