@lannguyensi/harness 0.63.0 → 1.0.0

package/CHANGELOG.md

@@ -7,6 +7,96 @@ and this project adheres to [Semantic Versioning](https://semver.org/).
 
 ## [Unreleased]
 
+## [1.0.0] - 2026-10-25
+
+1.0.0 is the removal release. harness is cut back to what it was always meant to be: one YAML manifest that wires MCP servers, skills, memory and hooks into Claude Code, Codex and (slimly) opencode, plus the `branch-protection` gate and its `harness gate disable` / `harness gate enable` kill switch. Everything else (the understanding gate, solution-acceptance, post-merge-gate, the Risk Gate, the policy engine, pause and approvals, the evidence-ledger client, smoke, session-start producers) is gone. A manifest or hook that still carries removed configuration keeps loading: removed keys, packs and commands warn and are ignored (`harness validate --strict` fails on them), so the branch-protection hook keeps deciding.
+
+### Upgrade notes
+
+- Install and re-generate right away, because hooks generated by an older release may call removed commands such as `harness session-start`: `npm i -g @lannguyensi/harness@1.0.0`, then re-run apply once for each runtime you use: `harness apply --target ~/.claude/settings.json --merge` for Claude Code (or your usual apply; `--merge` replaces the `hooks` key, drops `mcpServers` entries an earlier apply wrote and keeps every other key) and `harness apply --runtime codex --install` for Codex. A plain `harness apply` reuses the runtime of the last apply, so run the Claude Code apply last if that is the runtime your plain applies should target. Restart running agent sessions afterwards.
+- Run `harness pack reseed branch-protection` to pick up the current deny wording, and make sure `git` is on the PATH the hooks run with: the branch-protection hook asks git for the branch and refuses when git cannot answer.
+- Run `harness validate` and `harness doctor` (and `harness validate --project <name>` for each project override layer, which plain `validate` does not read): they print every removed manifest key, pack and hook command still in your manifest, and `harness validate --strict` fails on them. Delete them by hand, then re-run apply for each runtime you use; the full list and the way forward for each are in `docs/CLI.md` ("Removed keys, packs and commands").
+- Scripts and CI that call a removed verb (`harness smoke`, `harness audit`, `harness pause`, `harness record`, `harness policy intercept`, and the others listed under Removed) must drop the call; there is no replacement except where the entry below names one. The operator off switch is `harness gate disable` / `harness gate enable`, for Codex with `--runtime codex`.
+- The library entry (`src/index.ts`) stays exported and is the remaining API: the manifest schema, the loader, `validate`, `doctor`, `list`, `diff`, `describe`, the override engine and the MCP and memory probes. The exports of removed components are gone (named under Removed), and `ManifestParseError.issues` has a new type (see Changed, zod 4).
+- A `.understanding-gate/` directory of an old install is leftover state that nothing reads: delete it by hand (`rm -rf ~/.harness/.understanding-gate`); `harness uninstall` also removes it as part of a full teardown.
+
+### Added
+
+- `harness doctor` checks that the hooks `harness apply` generates are present in the live runtime config, so a gate that exists only in the generated artefact no longer goes unnoticed (task 305ef207, #721). For the runtime a plain apply selects (`claude-code`: `settings.json`, under `CLAUDE_CONFIG_DIR` when set; `codex`: `~/.codex/config.toml`) every generated hook is compared by event, matcher and command. A missing hook or one with another command is an error naming all three; a hook taken out by `harness gate disable` is a warning naming the command that puts it back, with `--force` and a short reason exactly when `harness gate enable` would refuse without it, and the refusing snapshot named when an older snapshot removed the hook (tasks f4e9a6d6, 85c9296c; #726, #728); a live hook harness did not generate is an info line; an unreadable live file or gate snapshot is one error finding. The report carries it as `hookLiveness` in `--json`.
+- New package-root exports for the removed-surface warnings: `findRemovedCommandUses`, `invokesRemovedCommand`, `REMOVED_COMMANDS`, `RemovedCommand`, `REMOVED_HOOK_FIELDS`, `REMOVED_LIST_CATEGORIES`, `REMOVED_DESCRIBE_PILLARS`, `removedInspectNameMessage`, `mergeLayersStrippingRemovedPaths`, `stripRemovedManifestPaths`, `stripRemovedHookFields` and `remapDiagnosticPath`, so a library consumer that runs `runAssetChecks` on a manifest from `parseManifestWithWarnings` maps a diagnostic path back to the index as written, using the result's `indexMaps` (tasks 3cddd42e, 785c555e; #688, #714).
+- `tests/cli/apply/apply-codex-toml-parser-pins.test.ts` pins two smol-toml 1.9.0 behaviours through `planCodexConfigInstall`: a malformed `[[hooks.Stop]` header is refused with the parser's line, column and reason, and a leading byte order mark is accepted (task f73524e0, #648).
+
+### Removed
+
+- Understanding gate (tasks 95826160, e2d5e87e, 7890cd34, 9fce2cdc, 9389707f, c7e604fc, eb7e9c5c, 68dca91f; #663 to #666, #668 to #670, #748): the `understanding-before-execution` pack, its hook verbs (`harness pack hook pre-tool-use`, `post-tool-use`, `track-active-claim`, `stay-in-scope`, `subagent-start`, `subagent-stop` and the four `codex-*` verbs), `harness delegate`, `harness approve understanding`, `harness gc`, `harness pack upgrade`, the `permission_profiles` manifest key, the doctor and audit readers of gate state (with the `--recent-sessions` option and the doctor report fields `ug*`, `settingsDrift`, `codexConfigDrift`), the pack machinery only it used (`harness pack add --mode`, the `mode` column of `harness pack list`, `policyPackHookVersions` in `doctor --json`, floor probes for a pack `min_version`), the install offers (the `solo`, `team` and `full` templates, the wizard composer and the dependency installer no longer offer it; the wizard also no longer offers orchestrator-workflow setup, which served solution-acceptance, or shows the disabled `opencode` entry, so `RunInteractiveOptions` drops `repoDir` and `owInitSpawn`), its documentation, dogfood material and fixtures, and the runtime dependency `@lannguyensi/understanding-gate`. Do instead: delete the pack entry and `permission_profiles` from the manifest, re-run apply per runtime, run `harness pack remove --force understanding-before-execution` to drop the generated instructions file, and delete by hand any `permissions` block that an `apply --target` file received while a `permission_profile` was selected. Understanding-gate fixes made earlier in this cycle (tasks 6e001bfc, f1bacdd8; #650, #651) went with it.
+- `solution-acceptance` pack and its verbs (`harness pack hook solution-acceptance`, `solution-acceptance-writeguard`; task cc5a4152, #662), with the checks that only served it (validate's producer and knob diagnostics, doctor's `policyPacks.solutionAcceptance` field, `DoctorOptions.gitIgnoreProbe`, the `SOLUTION_VERDICT_DIR` projection) and the fixes made earlier in this cycle around it (tasks b56d95d3, 9dba07a4, 1497d501; #638, #644, #653). Do instead: `harness pack remove solution-acceptance --force`.
+- `post-merge-gate` pack and its verbs (`harness pack hook post-merge-gate`, `post-merge-gate-record`; task 2ce6933f, #660). Do instead: `harness pack remove post-merge-gate --force`.
+- Risk Gate (tasks 65807a1b, 3a655f4e, 6e52c044, 39c112e0, 2bf09e41; #678 to #682): the debug verbs `harness explain-action`, `test-risk`, `resolve-env` and `explain-policy`, the risk and environment evaluation, the `risk` and `environments` manifest keys, `policies[].when`, `harness approve risk` (and with it the whole `harness approve` group), the shipped policies and doctor and validate sections, and `docs/risk-gate.md`. A policy that carried `when:` is dropped whole with a warning, never reduced to its trigger, because a trigger-only copy of a scoped gate would match every call. The Risk Gate schema exports (`RiskSchema`, `EnvironmentsSchema`, `PolicyWhenSchema`, `DEFAULT_SAFE_DELETION_ROOTS` and their types) left the package root. Do instead: run `harness validate`, delete the listed keys and policies from the manifest and its override layers.
+- Policy engine, shell command model and the `policies`, `workflows`, `review_templates` and `doctor` manifest keys (tasks bfe5efb4, e62f03ea, af5c3d60, bcdcde36, 10e2ff0a; #692 to #696): `harness policy intercept` and the `policy` group, `harness record`, `harness dry-run`, `harness explain`, the `workflows[]` policy derivation, the action envelope, the producer runner, the shell model and read-only Bash classifier, the policy checks of validate, doctor and apply, `harness list policies|workflows`, `harness describe --pillar policies|workflows|review_templates` (each now exits 64), `harness remove --force`, the hook fields `bash_match` and `path_match` (stripped per hook with a warning, the hook stays), the policies and intercept hooks of every init template and of `docs/examples/full-manifest.yaml`, the kill-switch deny policies, and the `measure:*` scripts. A non-empty removed key warns, an empty value is stripped silently, and removed keys are stripped from the base and from every override layer before the layers merge. The package root no longer exports `intercept`, `evaluateRequires`, the extract grammar, the policy, requires, workflow and doctor schemas and their types. A manifest that relied on `workflows:` to enforce review before merge no longer has that gate. The shell-model hardening of this cycle (tasks 9238cc27, e927e903, cfb6b390, 7d4abf84, 25c56a0f, b647da7f, 699aafd8; #642, #645 to #647, #649, #654, #656) and the invisible-character sanitiser (task d9ab2d36, #637) left with their code.
+- Pause, approvals and signing (tasks 973163a4, 21a2c508, 2ef35911; #705 to #707): `harness pause` and `harness resume`, the pause sentinel and hook-side pause check, the approval-signing key projection (`SOLUTION_VERDICT_SIGNING_KEY` is no longer projected onto the `grounding-mcp` entry; an operator-declared `env` value still passes through), pending-approval staging, and the operator-state-isolation integration suite with its CI step. The runbook is now `docs/okf/gate-kill-switch.md`. A leftover `harness.generated/.harness-paused` file is ignored. A `grounding-mcp` registration made by an earlier release still carries the signing variable; that is harmless for the default harness home, and `claude mcp remove --scope user grounding-mcp` followed by the `claude mcp add-json` line `harness doctor` prints clears it.
+- Ledger client, git-context, audit and session-export (tasks b5321c53, 8ad81de7, 0231f90f, 82169840, 804007ef; #736 to #740): `harness audit`, `harness session-export`, the `audit` manifest key, the ledger client and `src/runtime/git-context.ts`, and the doctor scan for rogue evidence-ledger directories with `--rm-rogue-ledgers`, `--yes` and `rogueLedgerDbs` (the grounding ledger path is expanded to an absolute path and `harness apply` warns on a literal-tilde env value; remove a leftover `<dir>/~` by hand with `rm -rf`). harness only projects the ledger path onto the `grounding-mcp` entry and reads no ledger rows; read old `policy_decision:` rows with the evidence-ledger CLI or the grounding-mcp `ledger_summary` tool. Package-root exports removed: `encodeLedgerContent`, `decodeLedgerContent`, `PolicyDecisionPayload`, `parseDurationSeconds`, `InvalidDurationError`, `queryLedgerByTag`, the ledger types, `AuditSchema`, `RedactRuleSchema` and their types. The git-context fixes made earlier in this cycle (tasks 51bfba5a, b56d95d3, 323bd5b9; #641, #653, #655) went with the module, except the bounded reads that stay (see Security).
+- `harness smoke` (task 488b108d, #700), with `--claude-bin` and the `CLAUDE_BIN` variable; there is no replacement.
+- Session-start producers and branch-protection producers (tasks f3f15290, a4d8adc5; #658, #661): the `harness session-start` group (`preflight`, `toolchain-parity`, `stale-base-check`, `branch-check`), the top-level `harness preflight`, `harness approve branch-protection`, the manifest keys `session_start_preflight`, `toolchain_parity`, `stale_base_check`, `grounding.evidence_ledger.retention_days` and `grounding.policies_source`, the generated `git-preflight` and `require-preflight-*` hooks, the doctor toolchain-parity comparison, the `branch:non-protected` ledger tag, the branch-protection override marker and the hook's session-id requirement. `ToolchainParitySchema` and its type left the package root. Do instead: delete those hooks, policies and blocks from your manifest and run `harness pack reseed branch-protection`.
+- The runtime-reality hook (`harness pack hook runtime-reality`; task d30564d2, #747), its dependency `@lannguyensi/runtime-reality-checker`, `scripts/runtime-reality-docker-probe.mjs` and the unused `chalk` and `execa` dependencies. A manifest hook that still calls it loads; `harness validate` warns only for the plain `KEY=value ... harness pack hook runtime-reality` form, and any other form (quoted values, a binary path, `npx`, a chain) loads without a warning and fails at run time with "unknown command" (exit 64, non-blocking). Delete such hooks by hand and re-run apply.
+- Dead code and orphan modules (tasks 6f91e68e, 3b5f6992; #746, #750): unused Codex and opencode adapter helpers (`extractShellCommand`, `SHELL_ALIASES`, the ignored `cwd` option of `RunCodexCheckOptions`, which narrows `DoctorOptions.codexCheckOptions`), the re-exports of `CODEX_MANAGED_SOURCE_PREFIX` and `validateCodexManagedConfig` from `dist/cli/apply/index.js` (their definitions stay in `install-codex-config.ts`), and the modules `src/io/display-path.ts`, `src/io/invisible-characters.ts` and `src/runtime/index.ts`. The package has no `exports` map, so the `dist/` paths `dist/io/display-path.js`, `dist/io/invisible-characters.js` and `dist/runtime/index.js` are gone; the package root never re-exported them. Generated output is byte-identical.
+
+### Changed
+
+- The kill switch covers both runtimes (tasks 1f6ec6c9, d8e55ad8, d7606c82, 7ae7e49f, 9bbd9ed8, 0b4ef8ca, c580d289, d88fa968, e2089759; #704, #710, #712, #715, #719, #723, #724, #727, #730). `harness gate disable` and `harness gate enable` take `--runtime claude|codex` (default `claude`) and `--config <path>`. With `--runtime codex`, `disable --matcher <pattern>` neutralises in place the harness-owned hook units of the managed block in `~/.codex/config.toml` whose `matcher` contains the pattern (the `hooks = [...]` line becomes `hooks = []`, so Codex keeps every other hook at the position its trust was recorded for), after a backup and a snapshot `harness.gate-disable-codex.<ISO>.json` beside the config. `enable --runtime codex` restores the units byte-identically (sha-checked), exits non-zero while a unit stays disabled or missing, and retires a spent snapshot (`*.restored.json`, or `*.superseded.json` once a later install re-rendered the block). There is one live snapshot per config: a second disable merges into it, a config edited since needs `--force` unless skipping the units that are back rebuilds the pre-disable bytes, and a snapshot that cannot be restored refuses with the ways out. `harness apply --runtime codex --install` retires every live snapshot of the config it rewrites and writes a `# harness block generation: <sha256>` comment under the BEGIN fence, which `gate enable`, `gate disable` and `harness doctor` use to supersede a snapshot taken before a re-render, whatever link it sits beside. Snapshot ownership is by directory entry (a case variant of the config on a case-folding volume is the same entry, a hard link or second name is foreign and named with its restore command); `..` after a directory link in a config path or link text resolves the way the kernel resolves it (`--config`, `--codex-config` and symlinked configs, also with `~` spellings); and every command a Codex message prints is shell-quoted and repeats the `--config` or `--codex-config` the call named. The Codex escape hatch in the branch-protection pack text names `harness gate disable --runtime codex`.
+- branch-protection asks git for the branch (task a4d8adc5, #658). Every target (`Write`, `Edit`, `MultiEdit`, `NotebookEdit`, and the paths of a Codex `apply_patch` header; the event cwd otherwise) is judged twice, as written and as the operating system resolves it (symlinks followed), and the hook refuses when either judgment refuses or cannot answer. For the nearest existing directory it runs `git -C <dir> symbolic-ref -q HEAD` (no shell, `GIT_*` variables removed, 2000 ms per call, 3000 ms overall) and refuses when git names a protected branch (compared case-insensitively) or cannot answer, naming git's first stderr line; outside every repository and on a detached HEAD it allows. The generated Codex command carries `--runtime codex` and a Codex refusal exits 2 with the reason on stderr. The hook no longer yields to a pause, refuses a malformed event, and its hook budget drops from 15000 to 5000 ms.
+- A manifest that still carries a removed key or pack name loads with a warning instead of failing (task a4d8adc5, #658): `harness validate`, `harness doctor`, `harness apply` and `harness export` print the warnings (the last on stderr, one `warning:` line each, YAML or JSON on stdout unchanged; task f45dd0a0, #684), `harness validate --strict` fails on them, and a key that was never valid still fails the load. The `policy_packs` error of `harness apply` and the asset errors of `harness add` name the index as written after a removed pack was dropped (task 4ee45b99, #689).
+- Init templates and wizard: the `solo` and `team` templates now ship the `branch-protection` pack, so every profile except `minimal` carries it, and no template writes policies, `harness policy intercept` hooks or `harness record` remedies (tasks e2d5e87e, bcdcde36; #664, #695). The custom composer no longer wires grounding-mcp for policies. Docs lead with the `minimal` manifest plus branch-protection (#659).
+- `harness apply --runtime opencode` words its hook warning around the consequence: it names the hooks that are not projected (the first three, then a count), says they do not run under opencode, and says edits on protected branches are NOT blocked when the branch-protection hook is among them; the `memory.router` warning is gone (task 1297978a, #749).
+- Generated text and docs no longer name removed gates (tasks acb0698d, 666f9cda, 7adc3fd7, 2ef35911, 852cbdc5; #690, #707, #745, #751, #752, #753): the `minimal` template header, the generated `opencode.json` header, the `docs/examples/full-manifest.yaml` comments and the help of `harness init --probe`, `harness apply --merge` and `harness uninstall` describe what the code does, and `harness uninstall` and `harness migrate-home` call `.understanding-gate/` leftover state. `harness init --interactive` no longer prints a wrong multi-runtime note about `harness.lock`.
+- Loader wording (tasks 33fe3b24, 8026fe0b; #725, #733): an override layer whose value is `null` is skipped with a warning that it "has no value to merge", the removed hook-field warning says the field is ignored, and an override layer whose root is a scalar or a list fails through a new `OverrideLayerShapeError` (a subclass of `OverrideMergeError`, mapped by the CLI to the same exit 66 and message), so `harness diff --since <ref>` names the layer file on the git-ref side. A symlink chain whose link text ends in `/` no longer walks a same-named file as the target.
+- Internal: one shell-quoting helper (`src/cli/shell-quote.ts`), one Claude settings `hooks`-shape parser (`parseSettingsHooks`) and one `goldenEnvelope` test helper (task 507c58e0, #731); the project-name helpers are imported from `src/io/project-name.ts` (task 2f4fbd61, #735); the command groups moved out of `src/cli/index.ts` into per-group registration files, completing the split begun in task 32d84940 (task 87b419dc, #652), with help output byte-identical; and the claude-mcp doctor tests are hermetic (task e345db80, #703).
+- `zod` moves from 3.25.76 to 4.6.7 (`^4.6.7`, the dependency itself; #744). The manifest accept-set is unchanged and `parseManifest` output is byte-identical, but `ManifestParseError.issues` is now `ManifestIssue[]`, a new exported type (`path: (string | number)[]`, `message: string`, `code: string`) that replaces `z.ZodIssue` for library consumers, `PolicyPackConfigIssue.code` is now `z.core.$ZodIssue["code"]`, zod-default issue codes and texts change where zod 4 renamed them (for example `invalid_enum_value` becomes `invalid_value` and "Required" becomes "Invalid input: expected <type>, received undefined"), and `hooks[].budget_ms`, `tools.mcp[].health.timeout_ms` and `memory.retention.staleness_days` reject values past `Number.MAX_SAFE_INTEGER`. `harness validate` diagnostics, `--json` reports and exit codes are unchanged.
+
+### Fixed
+
+- `harness gate enable` and `harness gate disable` (Claude): one live `harness.gate-disable.*.json` snapshot per settings file, so a repeated disable merges into it, one enable restores everything and no longer answers "already matches the pre-disable state" with exit 0 while a group is still missing, and `--force` never splices a group in twice (task 0a4debd1, #711). A symlinked `settings.json` is followed to its file hop by hop the way the kernel does and written through, with the backup and snapshot beside the file (task 289c6c69, #717).
+- An empty or comment-only override layer file is skipped with a warning instead of erasing the manifest and making every hook refuse every edit (task 1692a14d, #699), and removed hook fields are stripped from the base and from each layer before the override merge, so a list-shaped `bash_match` in one source no longer fails the load (task 785c555e, #714).
+- branch-protection delivers its refusal whole: a large manifest load error no longer cuts the Claude Code deny envelope at the pipe buffer (every block detail is cut at 4096 UTF-8 bytes with a `[truncated N bytes]` marker and the entry point waits at most 500 ms for stdout and stderr to drain; task 9f70909d, #701), a closed stderr or stdout reader no longer turns a block into exit 1 (task 3ea8f02e, #702), and a Claude Code block exits 2 with the reason on stderr when its envelope cannot be written (task 32f0f5ae, #718).
+- `harness uninstall --restore-from` refuses an `harness.uninstall.<TS>.json` snapshot record and any hand-edited or partial copy of one, while a settings backup restores as before (tasks 852cbdc5, bb7f4c07; #690, #713).
+- `harness doctor --target codex` warns on a hook command that calls a removed verb (counted once when a manifest warning already counts it; task 8159fc94, #675); the hint under a `policy_packs[].min_version` warning says a builtin pack's floor cannot be enforced (task c09c8c38, #673); and the "not registered with the claude CLI" hint leads with the exact `claude mcp add-json --scope user <name> '<json>'` line (task 114961db, #708).
+
+### Security
+
+- `vite` (dev) 8.0.16 to 8.3.5 with `rolldown`, lockfile only, closing GHSA-587h-7wmj-h5pm, GHSA-r825-w8mm-5pxw and GHSA-698v-4r3x-3vcv (#734).
+- `vitest` (dev) and its `@vitest/*` packages 4.1.11 to 4.1.12, lockfile only, closing GHSA-qxg6-89mg-rqv8 and GHSA-xp26-3454-mjgp (#741).
+- `smol-toml` 1.8.0 to 1.9.0 (pin `~1.9.0`) closes GHSA-r4xh-jqrq-34v2 (quadratic-time `parse()`), and `source-map-js` (dev) 1.2.1 to 1.2.2 closes GHSA-68fv-2mgg-jv7q; the new parser refuses a malformed `[[table]` header that 1.8.0 read and accepts a leading BOM (#643).
+- `zod` 3.25.76 to 4.6.7 closes GHSA-mrhx-c7xc-m3w5 (memory exhaustion validating oversized constrained collections), see Changed (#744).
+- Every by-path read on a hook path is one bounded, non-blocking descriptor read (`O_NONBLOCK`, type and size from `fstat`, 1 MiB cap for a manifest or layer, 32 MiB for `~/.claude.json`), so a FIFO, device, directory or oversized file planted where a hook reads no longer holds the hook past its budget, which the runtime reads as an allow (tasks 46434fbf, 323bd5b9; #639, #641).
+- Hook-path writes open non-blocking and check the descriptor (`src/io/write-regular-file.ts`), so a FIFO with no reader no longer holds a write past the hook budget, and the create-only lock target no longer writes through a dangling symlink (task b56d95d3, #653).
+
+PRs with fix or feature commits in this release: #637, #639, #641, #642, #643, #644, #645, #646, #647, #649, #650, #651, #653, #654, #655, #656, #658, #660, #661, #662, #663, #664, #665, #666, #668, #669, #673, #675, #678, #679, #680, #681, #684, #688, #689, #690, #691, #692, #693, #694, #695, #696, #699, #700, #701, #702, #704, #705, #706, #708, #711, #712, #713, #714, #715, #717, #718, #719, #721, #723, #724, #725, #726, #727, #728, #730, #734, #741, #744, #749, #752.
+
+## [0.64.0] - 2026-10-05
+
+### Upgrade notes
+
+- Installs whose understanding-before-execution pack has no `approval_lifecycle.expire_on_tool_match` now re-lock the gate after `task_merge`, `task_finish` to done, `task_abandon`, `pull_requests_merge` and `tasks_transition` to done, as the generator always promised; expect more re-approval prompts. To keep the old one-approval-per-session behaviour set `approval_lifecycle: { mode: session }`; to expire on no tool set `expire_on_tool_match: []`. If the hooks were last generated by `harness apply` before v0.59.0, re-run `harness apply` so the emitted PostToolUse matcher includes `task_merge`.
+- `harness explain-policy` output gains `parity.kubectl_target_present` (a boolean, always present); consumers that validate the projection strictly should allow the new key.
+- `harness explain-action` accepts `--config` and `--project`; the manifest is read only for a command with a leading `git switch|checkout`. With no manifest at the default location and no `--config` it uses an empty manifest (the branch-switch upgrade is then a no-op, exit 0 as before); an explicit `--config` that is missing, or an invalid manifest, still exits 66.
+- The understanding gate's hash scan now fails closed when the reports directory holds more than 8192 `*.json` entries, or more than 16384 entries of any name, even when the approved report is among the newest; until 0.63.0 it read the newest 8192 and allowed (task aa6f6570, see Fixed). Remove non-report or stale `*.json` entries from that directory by hand; `harness gc` removes only aged approved or expired reports.
+
+### Changed
+
+- Internal: the `remove`, `delegate`, `audit` / `session-export` / `dry-run`, `uninstall` and `migrate-home` / `pause` / `resume` command wiring moved out of `src/cli/index.ts` into per-group registration files under `src/cli/` (task 32d84940). No behaviour change; `harness --help` and every subcommand's help are byte-identical. `scripts/help-snapshot.mjs` snapshots the help of the whole command tree from the built `dist/` for before/after comparison.
+
+### Fixed
+
+- The solution-acceptance write-guard no longer blocks a pipeline of pure reads (task 95a3712d). `grep -n 'x*y' solution-notes.md | head -20`, `cat docs/solution-design.md | grep -n 'a*b' | wc -l`, `rg 'a{2}' solution-x | head` and `cat <verdict-dir>/a.json | head` were blocked, while the same commands without the `| head` were allowed: the guard's read-only fast path used the strict single-command classifier, which refuses any `|`, so the command fell through to the verdict-dir reference check, whose glob/brace-plus-"solution" fallback fired on the pattern or the path. The fast path now also accepts a single-`|` pipeline when every stage passes the shared read-only classifier (`isReadOnlyBashPipeline`, reused unchanged, no second pipeline definition), under three added conditions: every `|` is a real stage boundary (a `|` inside quotes or backslash-escaped, an unterminated quote, an unquoted parenthesis, and a `$` not followed by a plain variable name, which covers `${...}`, `$[...]`, `$'...'` and `$"..."`, keep the old route; so a read written with `${VAR}` is not fast-pathed), no stage is a `cd` (or a `command`/`env` wrapper, which the classifier recurses through), and the existing `cd` pre-checks still run first. The first condition is load-bearing: the shared pipeline classifier splits the text at every `|` without modelling quotes, so with only the classifier `find <verdict-dir> -name 'a|cat -x' -delete` split into two fragments that each look read-only while the real command deletes (measured: blocked on master, allowed with the classifier alone; the same split happens for `${x//a|cat -x}`, `$[1|cat -x]` and an extglob group). `;`, `&&`, `||`, `&`, `|&`, redirects, command substitution, backticks and subshells are unchanged and stay blocked when they reach the dir. Deliberate departure: the header of `src/runtime/read-only-bash.ts` says this guard must treat no chaining as read-only; that no longer holds for a pure `|` pipeline (the header is not edited here, the classifier file is untouched). Not decided here: the glob/brace "subword" heuristic in `bashReferencesVerdictDir` is NOT relaxed or removed for commands outside the read-only arms (pure reads such as `grep 'a|b*' solution-notes.md | head` with a quoted `|` still hit it and stay blocked, a recorded over-block); revising that accepted cost needs its own risk review. Tests: `tests/cli/pack-hook-solution-acceptance-writeguard.test.ts` (read cases, a write-stage negative-control matrix with the write as first, middle and last stage, subshell, substitution, backticks, unparsable pipelines, quoted-pipe and `cd`-stage cases, and a monotonicity check) over the fixture table `tests/_helpers/writeguard-pipeline-matrix.ts`; `npx tsx scripts/measure-writeguard-baseline.mjs` replays the table against a `git archive origin/master` extraction and fails if a write blocked there is allowed now.
+- The envelope sanitiser now also neutralises C1 controls, line and paragraph separators and bidi controls in model-visible text derived from paths, repository and branch names, and degraded-ledger reasons (task 6c278e7a). `sanitizeEnvelopeReason` used to strip only C0 and DEL, so a directory reached through a vendored tree or symlink could carry U+0085, U+2028, U+2029, the bidi embedding, override and isolate controls (U+202A-U+202E, U+2066-U+2069) and the bidi marks (U+200E, U+200F, U+061C) verbatim into the block text. Each is now replaced by a visible `\u{XXXX}` escape (C0 and DEL keep collapsing to one space); printable non-ASCII such as umlauts, CJK and emoji is kept. The 200-character bound counts the expanded escape and never cuts an escape sequence or a surrogate pair in half. Callers are unchanged. Tests: `tests/runtime/sanitize-envelope-reason.test.ts` (per class, boundary) and a symlink fixture through `runInterceptCli` in `tests/runtime/intercept-foreign-target-message.test.ts`.
+- The understanding gate now applies the default boundary tools at runtime when `approval_lifecycle` configures no explicit `expire_on_tool_match` (task 0c6b2cb9). The generator already registered the PostToolUse hook for that case and documented default-on expiry, but `parseApprovalLifecycle` returned an empty tool list, so both the Claude and the Codex hook skipped and a `task_merge` (or a `task_finish` to done) never re-armed the gate on an install without the block. An absent or null block, a non-object block and a block without a usable `expire_on_tool_match` now expire on `DEFAULT_BOUNDARY_TOOL_NAMES` (`task_finish`, `task_abandon`, `pull_requests_merge`, `tasks_transition`, `task_merge`); a `task_finish` that lands in `review` still keeps the marker. An explicit list (including `[]`) and `mode: session` are unchanged, and `expire_on_bash_match` and `max_age` parse as before. `harness doctor` gains an advisory warning for an explicit `expire_on_tool_match` that lists `task_finish` but not `task_merge`. Tests: `tests/cli/pack-hook-post-tool-use.test.ts`, `tests/cli/pack-hook-codex-post-tool-use.test.ts`, `tests/policy-packs/understanding-before-execution-lifecycle.test.ts`, `tests/cli/doctor-expire-on-tool-match.test.ts`.
+- A block caused by a foreign attributed target now names that target (task bb202fb9). When a command names a nested or vendored work tree (`git -C vendor/libfoo log`, `cd vendor/libfoo && git log`) and the blocking decision belongs to that repository's context, the agent-facing block message ends with a policy-neutral sentence naming the repository and its resolved directory and saying the required evidence is missing for that repository, not for the working directory. Before, the message only pointed at the policy's producer (for example `harness preflight`), which runs for the working directory and records a tag that is already on record, so the agent had no way to see which tag was missing. The gate is unchanged: same decisions, outcomes and ledger tags, and a block from the working directory's own context renders byte-for-byte as before. The directory and repository name are sanitised like every other model-visible text derived from the command. The sentence names no command, because a producer other than `harness preflight` has not been shown to work from the target directory; for `harness preflight` itself, a test shows that run from the target directory with `ready:true` it records `preflight:<target repo>`. The `ux:` texts are untouched. The in-memory `PolicyDecision` gains an additive optional `foreignTarget` field (`{ repo, dir }`, never written to the audit row), and the `ForeignTarget` type is exported next to `PolicyDecision`. Tests: `tests/runtime/intercept-foreign-target-message.test.ts`.
+- `harness dry-run` now predicts the same additive ledger demands `harness policy intercept` makes for a command that names another repository (task 53dd08b4). Each matching policy gains `ledgerQueries`, the list of every predicted demand: for `git -C <B> log` run from repository A it lists `preflight:<A>` and `preflight:<B>` (it listed only the cwd tag before), and a command naming more than three foreign targets beside the cwd repository (the cwd counts as one of the 4 contexts, the runtime bound) yields one ambiguity text instead of tags. dry-run calls the runtime's own attribution (`resolveAttributedContexts` is now exported, behaviour unchanged) rather than a copy; `ledgerQuery` keeps its cwd value, so `--json` consumers are unaffected.
+- `harness resolve-env`, `harness test-risk` and `harness explain-action` now route through the same Bash-prefix enrichment helper as `harness policy intercept` and `harness explain-policy` (task 8b891e83), instead of reading only the ambient environment. Observable effect per verb: `resolve-env` merges inline `VAR=value` assignments, a leading `cd <path> &&` and a leading `git switch|checkout <branch> &&`, so `DATABASE_URL=postgres://u@prod-db/app psql ...` resolves `production` like the hook instead of `unknown`; `explain-action` prints the git context from a leading `cd` or `git switch|checkout` only (inline env is not part of its envelope); `test-risk` output is unchanged (the classifier reads the raw command) and it routes through the helper for consistency. The `kubectl --context`/`--namespace` merge stays hook-only: `resolve-env` reports the ambient kube context for such a command (see `parity.kubectl_target_present` in `explain-policy`). All four verbs call one shared module (`src/cli/enriched-event.ts`); none reads the ledger, and the hook path is unchanged. A divergence test runs each verb over the explain-policy fixture corpus against the hook and pins the kubectl limit.
+- `harness explain-policy` now says per event when it skipped a kubectl target: `parity.kubectl_target_present` is `true` when the command (after a leading `cd`/`VAR=value`/`git switch` prefix) is a `kubectl` invocation with an explicit `--context`/`--namespace`/`-n`, so `kubectl --context prod-cluster delete ns a` no longer reads as a plain `applies: false`. The static `not_evaluated` list is unchanged.
+- The `harness init --template solo` scaffold comment on `approval_lifecycle` now says that the runtime applies the default agent-tasks tool list when `expire_on_tool_match` is absent, and that this default is inert in solo because solo wires no agent-tasks MCP (task 0d04b2ce). The emitted YAML is unchanged.
+- The envelope sanitiser now escapes every invisible format or default-ignorable character (General_Category Cf or Default_Ignorable_Code_Point: tag characters, variation selectors, U+FEFF, U+200B, U+00AD, U+2060-U+2064 and more) as `\u{XXXX}` in model-visible text derived from paths, repository and branch names, and in degraded-ledger reasons in the deny-degraded envelope and the operator stderr hint (task d9a6d818). The zero width joiner stays; emoji presentation selectors (U+FE0F), tag-sequence flags, the zero width non-joiner and the visible Arabic prepended marks now show up escaped. A literal backslash is escaped as `\u{005c}`, so a name that spells an escape can no longer pass for one; each backslash then counts 8 characters toward the 200-character bound.
+- **The last two uncharged directory reads on the PreToolUse hook path are bounded: the hash scan lists through the early-stopping listing and fails closed past it, and the in-flight record check looks up its one entry instead of listing the session directory** (task `aa6f6570`, follow-up to `169e6286`). The two residuals the 0.63.0 entry for `169e6286` names were the hash scan's `readdir` plus full name sort of the reports directory (when a signed marker is present; 8.7 to 9.1 s warm at 3M planted entries in review, past 15 s at roughly 5 to 6M or on a cold cache) and `verifyInflightRecord`'s `readdirSync` of `.inflight/<session>/` on a Claude Code subagent call that missed the marker (8.3 s at 3M planted entries in review), either of which could take the hook past the 15 s PreToolUse budget the runtime treats as an allow. (1) `scanReportHashes` now reads the reports directory through `listDirNamesBounded`, the listing the four other readers share: one entry at a time, stopping at the first of more than 8192 `*.json` names (`MAX_HOOK_LISTING_ENTRIES`) or more than 16384 entries of any name. Within those bounds nothing changes: every `*.json` name, newest first (descending byte order, the order the scan always used for report names that start with a timestamp), charged at least 4 KiB against the 32 MiB budget. Past either bound the scan opens nothing and the check denies, fail closed, with a new reason that names the bound and the remedy (`no report in the reports directory could be checked against the content the <kind> approval marker was signed for (the reports directory <path> holds more than 8192 *.json entries, or more than 16384 entries of any name, more than the gate reads; remove non-report or stale *.json entries from it by hand ...)`); it does not say the approved report was changed or removed, and it is checked before the "no report file" allow, so a directory too large to list is never read as an empty one. Behaviour change, deliberate: a reports directory with more than 8192 `*.json` entries now denies at the hash scan even when the approved report is among the newest of them (before, the scan read the newest 8192 entries and allowed when the report was within them; a directory of 8193 to about 5M entries cost one whole-directory sort first); the operator removes non-report or stale entries by hand (`harness gc` removes only aged approved or expired reports). Planted late names (names that sort after the timestamped report names): up to 8191 of them beside the report the real report is still found and the call allowed (they are read first, each charged 4 KiB, and 8191 of them stay under the 32 MiB budget); from 8192 of them (8193 entries in all) the scan does not start and the check denies in the documented way, and the denial persists until the operator removes them, as before. (2) `verifyInflightRecord` no longer lists `.inflight/<session>/`: after the existing `lstat` of the root and the session directory it `lstat`s the entry `<agentId>` (missing, or any error, reads as no record, fail closed; the `agentId` allowlist that keeps it from traversing is unchanged) and, for a non-symlink entry, compares `path.basename(fs.realpathSync.native(entry))` with the requested id, so a case-variant id on a case-insensitive filesystem is still no record (not `forged`), as before. A symlink entry skips that comparison and is refused by the read as a symlink; on a filesystem whose `realpath` does not report the stored case a case-variant id reaches the signature check and fails there as `forged`, still never a match. The cost no longer depends on how many entries the session directory holds. Measured with an in-process harness on the built hook entry points (3,000,000 planted entries on one machine, APFS, one session, two runs each): hash scan with a signed marker present and 3,000,000 planted `*.json` names sorting after the report, 53.4 to 61.4 ms on both the Claude Code and the Codex hook (denied with the new reason); subagent call with a record beside 3,000,000 planted entries, 0.4 to 1.2 ms (allowed), and without a record 10.2 to 12.3 ms (blocked, the whole call including the evidence read). The before figures are the review measurements quoted above, not re-run here. Pinned by `tests/cli/pack-hook-bounded-dir-reads.test.ts` (open, stat, bytes-read, `opendir`, `Dir.readSync` and `readdirSync` counts on the fs layer, never wall time): the hash scan on both runtimes past the entry bound (BOUND + 1 listing reads, nothing opened or stat-ed, handle closed), under it with planted late names (report found), exactly at it, and past twice the bound of non-matching names; the in-flight check on the Claude Code hook (the Codex hook has no subagent path) with a session directory of 16484 planted entries (no `readdirSync`, no `opendir`, four stats whatever the count). `tests/cli/pack-hook-persisted-report-evidence.test.ts`'s three planted-entry cases that expected the byte-budget wording at 8193 entries now expect the bound wording, since the listing stops first. Residual that remains: the evidence-ledger query the hook makes shares the same 15 s budget (a subprocess, not bounded here). The docs that named the two reads as uncharged are updated (`docs/policy-packs/understanding-before-execution.md` residuals (4) and (5), `docs/okf/gate-fail-posture-matrix.md`, `docs/okf/understanding-gate-lockout-recovery.md`).
+
 ## [0.63.0] - 2026-10-04
 
 ### Upgrade notes

package/README.md

@@ -10,78 +10,84 @@ hook scripts, per-project overrides. No single file answers "what can
 this agent do right now, and why is it set up that way?" `harness`
 puts all of it in one zod-validated YAML manifest you read, validate,
 and diff; generates the config the agent runtime loads from it; and at
-runtime blocks tool calls that violate the declared rules while
-recording every decision to an evidence ledger. Most config tools
-describe what an agent is configured to use; `harness` decides what it
-is allowed to do, under the exact context, and records why.
+runtime blocks tool calls through one enforcing gate, branch-protection.
+The branch-protection gate asks git and records nothing. Most config
+tools describe what an agent is configured to use; `harness` decides what
+it is allowed to do, under the exact context.
 
 ## Key concepts
 
 | Term | What it is |
 |------|-----------|
-| **manifest** | The one YAML file (`harness.yaml`) where you declare everything: tools, hooks, policies, memory. |
+| **manifest** | The one YAML file (`harness.yaml`) where you declare everything: grounding, tools, memory, hooks, policy packs. |
 | **apply** | `harness apply` renders the manifest into the config files the agent runtime actually reads. |
-| **policy** | A rule of the form *when the agent does X, require evidence Y*. Evaluated at runtime; can block the call. |
-| **evidence ledger** | An append-only log of facts an agent records during a session. Policies check it; `audit` / `explain` replay it. |
-| **hook** | A script the agent runtime runs at a lifecycle event (session start, before every tool call, ...). How policies get enforced. |
-| **policy pack** | A reusable bundle of policies, hooks, and templates shipped under one name and enabled with a single manifest key. |
+| **gate switch** | `harness gate disable` / `harness gate enable`: the operator kill switch. Disable removes the hook groups whose `matcher` substring-matches `--matcher <substring>` from `~/.claude/settings.json` (with `--runtime codex`, neutralises the matching units of the managed block in `~/.codex/config.toml`) and keeps a snapshot; enable restores them. |
+| **hook** | A script the agent runtime runs at a lifecycle event (session start, before every tool call, ...). How gates get wired in. |
+| **policy pack** | A bundle of hooks and instructions shipped under one name and enabled with a single manifest key (`policy_packs[]`, via `harness pack add <name>`). |
 
 ## Quick start
 
 ```bash
-npm i -g @lannguyensi/harness   # Node 20 or newer
-harness init --interactive      # guided wizard, or: --template solo|team|full
+npm i -g @lannguyensi/harness                            # Node 20 or newer
+harness init                                             # minimal manifest, no policies
+harness pack add branch-protection                       # the one recommended pack
+harness validate
+harness apply --target ~/.claude/settings.json --merge   # Claude Code; then restart it
+harness apply --runtime codex --install                  # Codex, if you use it; then restart it
 ```
 
-The wizard detects your `~/.claude/` and `~/.codex/` setup, MCP
-servers already wired in `settings.json`, and the harness binary
-version, then writes a starting `harness.yaml`. Full operator
-walkthrough: [`docs/for-humans.md`](docs/for-humans.md); a five-minute
-non-interactive path plus a profile comparison table:
-[`docs/quickstart.md`](docs/quickstart.md).
+From then on, while an agent works in a repository on `master`, `main`
+or `develop`, its edits there through the file-editing tools (`Write`
+and `Edit` under Claude Code, `apply_patch` under Codex) are refused
+until it cuts a feature branch (`git checkout -b <feature>`). Codex runs
+the new hooks only once you trust them in its startup hook review. The
+step-by-step version, with what each command writes:
+[`docs/quickstart.md`](docs/quickstart.md). Full operator walkthrough:
+[`docs/for-humans.md`](docs/for-humans.md) (it starts from the wizard
+and the `solo` template).
+
+Upgrading? A manifest that still names a pack or key removed in 1.0.0
+loads with a warning and the entry is ignored; see
+[`docs/CLI.md#removed-keys-packs-and-commands`](docs/CLI.md#removed-keys-packs-and-commands).
 
 ## Usage
 
-Preview which policies would fire for a tool call, before any ledger
-I/O or file write:
+See the gate decide without starting an agent: from inside a
+repository, pipe a sample `Write` event into the hook Claude Code runs
+before every `Write` or `Edit`.
 
 ```bash
-harness dry-run "merge PR 42" \
-  --tool mcp__agent-tasks__pull_requests_merge \
-  --tool-args '{"prNumber":42}'
+echo '{"session_id":"demo","tool_name":"Write","tool_input":{"file_path":"README.md"}}' \
+  | harness pack hook branch-protection
 ```
 
-Once a manifest is applied, the same shape runs live as
-`harness policy intercept` (invoked by the runtime's PreToolUse hook),
-and `harness explain <policy> --trace` / `harness audit --since 1h`
-replay what actually fired and why. The full install-to-audit
-walkthrough is in [`docs/quickstart.md`](docs/quickstart.md).
+On a protected branch it prints a deny decision naming the branch and
+the protected list; on a feature branch it allows the edit and says why
+on stderr. The protected-branch list, the agent-facing message and the
+operator controls are documented in
+[`docs/policy-packs/branch-protection.md`](docs/policy-packs/branch-protection.md).
 
 ## Documentation
 
-- [`docs/for-humans.md`](docs/for-humans.md): operator path, install through first real policy, diagnostics cheat sheet.
+- [`docs/for-humans.md`](docs/for-humans.md): operator path, install through the first refusing gate, diagnostics cheat sheet.
 - [`docs/for-agents.md`](docs/for-agents.md): agent integration contract, workflow lifecycle, CLI cheat sheet by side-effect class.
-- [`docs/quickstart.md`](docs/quickstart.md): five-minute bare-command path and profile comparison.
+- [`docs/quickstart.md`](docs/quickstart.md): five-minute bare-command path to the `branch-protection` gate.
 - [`docs/init-interactive.md`](docs/init-interactive.md): the `harness init --interactive` wizard, walkthrough and limitations.
 - [`docs/CLI.md`](docs/CLI.md): every CLI verb, grouped by purpose.
-- [`docs/risk-gate.md`](docs/risk-gate.md): the four-way `allow / warn / require_approval / deny` Risk Gate.
-- [`docs/writing-custom-policies.md`](docs/writing-custom-policies.md): tripwires, worked recipes, and the policy field reference.
-- [`docs/runtime-reality-hook.md`](docs/runtime-reality-hook.md): blocking destructive runtime commands when live process state has drifted from what the docs expect.
-- [`docs/policy-packs/README.md`](docs/policy-packs/README.md): the built-in policy packs (`understanding-before-execution`, `branch-protection`, `solution-acceptance`, `post-merge-gate`).
+- [`docs/policy-packs/README.md`](docs/policy-packs/README.md): the built-in policy pack (`branch-protection`).
 - [`docs/uninstall.md`](docs/uninstall.md): the single-command teardown, dry-run by default.
 - [`docs/examples/full-manifest.yaml`](docs/examples/full-manifest.yaml): a schema-coverage reference (not a runnable config; its header explains why).
-- [`docs/ARCHITECTURE.md`](docs/ARCHITECTURE.md): manifest schema, file layout, CLI surface (historical design intent; see its own note for the current shape).
+- [`docs/ARCHITECTURE.md`](docs/ARCHITECTURE.md): the architecture reference: manifest schema, file layout, CLI surface.
 - [`docs/VISION.md`](docs/VISION.md): why a declarative control plane, not more individual tools.
-- [`docs/ROADMAP.md`](docs/ROADMAP.md): the phase-by-phase plan and the acceptance criteria each phase shipped against.
 - [`CHANGELOG.md`](CHANGELOG.md): what shipped in each version.
 
 ### Related projects
 
-- [`agent-grounding`](https://github.com/LanNguyenSi/agent-grounding): evidence-ledger, claim-gate, review-claim-gate; `grounding-mcp` is the canonical client surface harness queries.
+- [`agent-grounding`](https://github.com/LanNguyenSi/agent-grounding): evidence-ledger and claim surfaces outside harness; `grounding-mcp` is the MCP server harness can register and point at the ledger path (`EVIDENCE_LEDGER_DB`), and harness itself queries nothing there.
 - [`agent-memory`](https://github.com/LanNguyenSi/agent-memory): the memory surfaces the control plane inventories.
 - [`agent-tasks`](https://github.com/LanNguyenSi/agent-tasks): MCP-registered task platform whose registration and health appear in `harness describe`.
-- [`agent-preflight`](https://github.com/LanNguyenSi/agent-preflight): local preflight validator; the canonical implementation of preflight-hook content harness wires.
-- [`codebase-oracle`](https://github.com/LanNguyenSi/codebase-oracle): opt-in MCP for multi-repo RAG search; wire via `harness add mcp codebase-oracle --command codebase-oracle,mcp`.
+- [`agent-preflight`](https://github.com/LanNguyenSi/agent-preflight): a standalone local preflight validator an operator can call directly or from a custom hook.
+- [`codebase-oracle`](https://github.com/LanNguyenSi/codebase-oracle): opt-in MCP for multi-repo RAG search; declare it with `harness add mcp codebase-oracle --command codebase-oracle,mcp`, then register it with Claude Code using the `claude mcp add-json` command `harness doctor` prints.
 - [`agent-dx`](https://github.com/LanNguyenSi/agent-dx): ships `git-batch-cli`, a day-to-day tool whose inventory appears in `harness describe`.
 
 ## Development and contributing
@@ -98,10 +104,8 @@ steps).
 
 ## Status
 
-The current release is `v0.63.0`. All seven planned phases have
-shipped; phase acceptance criteria are in
-[`docs/ROADMAP.md`](docs/ROADMAP.md), and what shipped in each version
-is in [`CHANGELOG.md`](CHANGELOG.md).
+The current release is `v1.0.0`. What shipped in each version is in
+[`CHANGELOG.md`](CHANGELOG.md).
 
 ## License
 

package/dist/cli/add/index.js

@@ -6,8 +6,8 @@ import { resolveHomeDir } from "../../runtime/home-dir.js";
 import { withFileLock } from "../../io/lock.js";
 import { unifiedDiff } from "../../io/patch.js";
 import { formatValidationErrors, validateBeforeWrite, } from "../../io/validate-before-write.js";
-import { parseManifest } from "../../schema/index.js";
-import { withDerivedPolicies } from "../../runtime/workflow-policies.js";
+import { parseManifestWithWarnings } from "../../schema/index.js";
+import { remapDiagnosticPath } from "../../schema/removed-keys.js";
 import { runAssetChecks } from "../validate/checks.js";
 import { fmtDiagnostic } from "../validate/types.js";
 import { EX_FAIL, EX_NOINPUT, HarnessExitError } from "../exit-codes.js";
@@ -44,35 +44,31 @@ export async function add(action, opts = {}) {
     // Asset gate — surfaces hook +x failures, missing required CLIs, etc.
     // We use parseManifest (not the result of validateBeforeWrite) so we have a
     // typed Manifest for runAssetChecks. defaults flow through. Both this and
-    // the baseline below take the DERIVED view (workflows[]-derived policies
-    // folded in), the same view `harness validate` checks, so the gate here
-    // and validate cannot disagree about what "declared" means (review round
-    // 3, 99f47307 Slice 1); the derived entries cancel out in the baseline
-    // comparison unless the add itself changes what is derived. This is
-    // consistency-only, not a behavioral difference today: no error-severity
-    // check in runAssetChecks reads manifest.policies, so no fixture that
-    // parseManifest alone would pass and withDerivedPolicies would fail is
-    // known to exist right now (review round 3, F2). The derived view is
-    // kept as a parity pin against validate, and to stay correct the moment
-    // a future check does read manifest.policies at error severity.
-    const manifest = withDerivedPolicies(parseManifest(parseYaml(proposed)));
-    // gitIgnoreProbe stays null: the knob-ignored check is warning-only and
-    // this gate consumes errors, so the git spawn would be wasted work.
+    // the baseline below take the manifest exactly as the operator wrote it,
+    // the same view `harness validate` checks, so the gate here and validate
+    // cannot disagree about what "declared" means.
+    const proposedParsed = parseManifestWithWarnings(parseYaml(proposed));
+    const manifest = proposedParsed.manifest;
+    // Diagnostics index the parsed manifest, where a dropped pack no
+    // longer holds its slot: name the index as written, like `harness validate`.
     const proposedErrors = runAssetChecks(manifest, {
         homeDir: opts.homeDir,
-        gitIgnoreProbe: () => null,
-    }).filter((d) => d.severity === "error");
+    })
+        .filter((d) => d.severity === "error")
+        .map((d) => ({ ...d, path: remapDiagnosticPath(d.path, proposedParsed.indexMaps) }));
     // Compute a baseline error set from the original manifest so that
     // pre-existing asset problems unrelated to this add do not block it.
     // If the original manifest cannot be parsed (broken base), fall back to
     // blocking on all proposed errors so the gate never weakens on a broken base.
     let baselineKeys = new Set();
     try {
-        const baselineManifest = withDerivedPolicies(parseManifest(parseYaml(original)));
+        const baselineParsed = parseManifestWithWarnings(parseYaml(original));
+        const baselineManifest = baselineParsed.manifest;
         const baselineErrors = runAssetChecks(baselineManifest, {
             homeDir: opts.homeDir,
-            gitIgnoreProbe: () => null,
-        }).filter((d) => d.severity === "error");
+        })
+            .filter((d) => d.severity === "error")
+            .map((d) => ({ ...d, path: remapDiagnosticPath(d.path, baselineParsed.indexMaps) }));
         baselineKeys = new Set(baselineErrors.map((d) => `${d.severity}|${d.path}|${d.message}`));
     }
     catch {

package/dist/cli/add/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/cli/add/index.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,MAAM,SAAS,CAAC;AAC9B,OAAO,KAAK,IAAI,MAAM,WAAW,CAAC;AAClC,OAAO,EAAE,KAAK,IAAI,SAAS,EAAE,MAAM,MAAM,CAAC;AAC1C,OAAO,EAAE,eAAe,EAAE,MAAM,0BAA0B,CAAC;AAC3D,OAAO,EAAE,cAAc,EAAE,MAAM,2BAA2B,CAAC;AAC3D,OAAO,EAAE,YAAY,EAAE,MAAM,kBAAkB,CAAC;AAChD,OAAO,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAChD,OAAO,EACL,sBAAsB,EACtB,mBAAmB,GACpB,MAAM,mCAAmC,CAAC;AAC3C,OAAO,EAAE,aAAa,EAAE,MAAM,uBAAuB,CAAC;AACtD,OAAO,EAAE,mBAAmB,EAAE,MAAM,oCAAoC,CAAC;AACzE,OAAO,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAC;AACvD,OAAO,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAC;AACrD,OAAO,EAAE,OAAO,EAAE,UAAU,EAAE,gBAAgB,EAAE,MAAM,kBAAkB,CAAC;AACzE,OAAO,EAAE,QAAQ,EAAiB,MAAM,aAAa,CAAC;AAiBtD,MAAM,gBAAgB,GAAG,cAAc,CAAC;AACxC,MAAM,aAAa,GAAG,eAAe,CAAC;AAEtC,SAAS,iBAAiB,CAAC,IAAgB;IACzC,IAAI,IAAI,CAAC,UAAU;QAAE,OAAO,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;IAC1D,OAAO,IAAI,CAAC,IAAI,CACd,cAAc,CAAC,EAAE,GAAG,CAAC,IAAI,CAAC,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,IAAI,EACzF,gBAAgB,CACjB,CAAC;AACJ,CAAC;AAED,SAAS,SAAS,CAAC,MAAgB;IACjC,OAAO,MAAM,CAAC,IAAI,KAAK,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC;AACpE,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,GAAG,CAAC,MAAgB,EAAE,OAAmB,EAAE;IAC/D,MAAM,MAAM,GAAG,iBAAiB,CAAC,IAAI,CAAC,CAAC;IACvC,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,MAAM,CAAC,EAAE,CAAC;QAC3B,MAAM,IAAI,gBAAgB,CACxB,iCAAiC,MAAM,8BAA8B,EACrE,UAAU,CACX,CAAC;IACJ,CAAC;IAED,MAAM,QAAQ,GAAG,EAAE,CAAC,YAAY,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACjD,MAAM,QAAQ,GAAG,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;IAC5C,MAAM,IAAI,GAAG,WAAW,CAAC;QACvB,QAAQ,EAAE,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC;QAC/B,OAAO,EAAE,QAAQ;QACjB,OAAO,EAAE,QAAQ;QACjB,SAAS,EAAE,SAAS;QACpB,SAAS,EAAE,UAAU;KACtB,CAAC,CAAC;IAEH,eAAe;IACf,MAAM,YAAY,GAAG,mBAAmB,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC,CAAC;IAC9D,IAAI,CAAC,YAAY,CAAC,EAAE,EAAE,CAAC;QACrB,MAAM,IAAI,gBAAgB,CACxB,+CAA+C,sBAAsB,CAAC,YAAY,CAAC,MAAM,CAAC,EAAE,EAC5F,OAAO,CACR,CAAC;IACJ,CAAC;IAED,sEAAsE;IACtE,4EAA4E;IAC5E,0EAA0E;IAC1E,yEAAyE;IACzE,wEAAwE;IACxE,yEAAyE;IACzE,uEAAuE;IACvE,oEAAoE;IACpE,yEAAyE;IACzE,sEAAsE;IACtE,uEAAuE;IACvE,qEAAqE;IACrE,wEAAwE;IACxE,gEAAgE;IAChE,MAAM,QAAQ,GAAG,mBAAmB,CAAC,aAAa,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC;IACzE,wEAAwE;IACxE,oEAAoE;IACpE,MAAM,cAAc,GAAG,cAAc,CAAC,QAAQ,EAAE;QAC9C,OAAO,EAAE,IAAI,CAAC,OAAO;QACrB,cAAc,EAAE,GAAG,EAAE,CAAC,IAAI;KAC3B,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,OAAO,CAAC,CAAC;IAEzC,kEAAkE;IAClE,qEAAqE;IACrE,wEAAwE;IACxE,8EAA8E;IAC9E,IAAI,YAAY,GAAG,IAAI,GAAG,EAAU,CAAC;IACrC,IAAI,CAAC;QACH,MAAM,gBAAgB,GAAG,mBAAmB,CAAC,aAAa,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC;QACjF,MAAM,cAAc,GAAG,cAAc,CAAC,gBAAgB,EAAE;YACtD,OAAO,EAAE,IAAI,CAAC,OAAO;YACrB,cAAc,EAAE,GAAG,EAAE,CAAC,IAAI;SAC3B,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,OAAO,CAAC,CAAC;QACzC,YAAY,GAAG,IAAI,GAAG,CAAC,cAAc,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,CAAC,QAAQ,IAAI,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC;IAC5F,CAAC;IAAC,MAAM,CAAC;QACP,wEAAwE;QACxE,4EAA4E;QAC5E,yEAAyE;QACzE,gEAAgE;IAClE,CAAC;IAED,MAAM,SAAS,GAAG,cAAc,CAAC,MAAM,CACrC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,YAAY,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,IAAI,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC,OAAO,EAAE,CAAC,CACjE,CAAC;IACF,MAAM,iBAAiB,GAAG,cAAc,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CACpD,YAAY,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,IAAI,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC,OAAO,EAAE,CAAC,CACzD,CAAC;IAEF,IAAI,SAAS,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACzB,MAAM,KAAK,GAAG,SAAS,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACtD,MAAM,IAAI,gBAAgB,CACxB,8CAA8C,KAAK,EAAE,EACrD,OAAO,CACR,CAAC;IACJ,CAAC;IAED,MAAM,QAAQ,GAAa,EAAE,CAAC;IAC9B,IAAI,iBAAiB,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACjC,MAAM,KAAK,GAAG,iBAAiB,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC9D,QAAQ,CAAC,IAAI,CACX,wBAAwB,iBAAiB,CAAC,MAAM,8FAA8F,KAAK,EAAE,CACtJ,CAAC;IACJ,CAAC;IAED,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC;QAChB,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,IAAI,EAAE,SAAS,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,QAAQ,EAAE,CAAC;IACtG,CAAC;IAED,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,aAAa,CAAC,CAAC;IAChE,MAAM,YAAY,CAAC,QAAQ,EAAE,GAAG,EAAE;QAChC,uEAAuE;QACvE,sEAAsE;QACtE,2EAA2E;QAC3E,6EAA6E;QAC7E,MAAM,OAAO,GAAG,EAAE,CAAC,YAAY,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;QAChD,MAAM,IAAI,GAAG,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;QACvC,MAAM,OAAO,GAAG,mBAAmB,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC;QACrD,IAAI,CAAC,OAAO,CAAC,EAAE,EAAE,CAAC;YAChB,MAAM,IAAI,gBAAgB,CACxB,sEAAsE,sBAAsB,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,EAC9G,OAAO,CACR,CAAC;QACJ,CAAC;QACD,eAAe,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;IAChC,CAAC,CAAC,CAAC;IAEH,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,IAAI,EAAE,SAAS,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC;AACrG,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/cli/add/index.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,MAAM,SAAS,CAAC;AAC9B,OAAO,KAAK,IAAI,MAAM,WAAW,CAAC;AAClC,OAAO,EAAE,KAAK,IAAI,SAAS,EAAE,MAAM,MAAM,CAAC;AAC1C,OAAO,EAAE,eAAe,EAAE,MAAM,0BAA0B,CAAC;AAC3D,OAAO,EAAE,cAAc,EAAE,MAAM,2BAA2B,CAAC;AAC3D,OAAO,EAAE,YAAY,EAAE,MAAM,kBAAkB,CAAC;AAChD,OAAO,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAChD,OAAO,EACL,sBAAsB,EACtB,mBAAmB,GACpB,MAAM,mCAAmC,CAAC;AAC3C,OAAO,EAAE,yBAAyB,EAAE,MAAM,uBAAuB,CAAC;AAClE,OAAO,EAAE,mBAAmB,EAAE,MAAM,8BAA8B,CAAC;AACnE,OAAO,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAC;AACvD,OAAO,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAC;AACrD,OAAO,EAAE,OAAO,EAAE,UAAU,EAAE,gBAAgB,EAAE,MAAM,kBAAkB,CAAC;AACzE,OAAO,EAAE,QAAQ,EAAiB,MAAM,aAAa,CAAC;AAiBtD,MAAM,gBAAgB,GAAG,cAAc,CAAC;AACxC,MAAM,aAAa,GAAG,eAAe,CAAC;AAEtC,SAAS,iBAAiB,CAAC,IAAgB;IACzC,IAAI,IAAI,CAAC,UAAU;QAAE,OAAO,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;IAC1D,OAAO,IAAI,CAAC,IAAI,CACd,cAAc,CAAC,EAAE,GAAG,CAAC,IAAI,CAAC,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,IAAI,EACzF,gBAAgB,CACjB,CAAC;AACJ,CAAC;AAED,SAAS,SAAS,CAAC,MAAgB;IACjC,OAAO,MAAM,CAAC,IAAI,KAAK,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC;AACpE,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,GAAG,CAAC,MAAgB,EAAE,OAAmB,EAAE;IAC/D,MAAM,MAAM,GAAG,iBAAiB,CAAC,IAAI,CAAC,CAAC;IACvC,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,MAAM,CAAC,EAAE,CAAC;QAC3B,MAAM,IAAI,gBAAgB,CACxB,iCAAiC,MAAM,8BAA8B,EACrE,UAAU,CACX,CAAC;IACJ,CAAC;IAED,MAAM,QAAQ,GAAG,EAAE,CAAC,YAAY,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACjD,MAAM,QAAQ,GAAG,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;IAC5C,MAAM,IAAI,GAAG,WAAW,CAAC;QACvB,QAAQ,EAAE,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC;QAC/B,OAAO,EAAE,QAAQ;QACjB,OAAO,EAAE,QAAQ;QACjB,SAAS,EAAE,SAAS;QACpB,SAAS,EAAE,UAAU;KACtB,CAAC,CAAC;IAEH,eAAe;IACf,MAAM,YAAY,GAAG,mBAAmB,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC,CAAC;IAC9D,IAAI,CAAC,YAAY,CAAC,EAAE,EAAE,CAAC;QACrB,MAAM,IAAI,gBAAgB,CACxB,+CAA+C,sBAAsB,CAAC,YAAY,CAAC,MAAM,CAAC,EAAE,EAC5F,OAAO,CACR,CAAC;IACJ,CAAC;IAED,sEAAsE;IACtE,4EAA4E;IAC5E,0EAA0E;IAC1E,yEAAyE;IACzE,yEAAyE;IACzE,+CAA+C;IAC/C,MAAM,cAAc,GAAG,yBAAyB,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC,CAAC;IACtE,MAAM,QAAQ,GAAG,cAAc,CAAC,QAAQ,CAAC;IACzC,iEAAiE;IACjE,6EAA6E;IAC7E,MAAM,cAAc,GAAG,cAAc,CAAC,QAAQ,EAAE;QAC9C,OAAO,EAAE,IAAI,CAAC,OAAO;KACtB,CAAC;SACC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,OAAO,CAAC;SACrC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,IAAI,EAAE,mBAAmB,CAAC,CAAC,CAAC,IAAI,EAAE,cAAc,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC,CAAC;IAEvF,kEAAkE;IAClE,qEAAqE;IACrE,wEAAwE;IACxE,8EAA8E;IAC9E,IAAI,YAAY,GAAG,IAAI,GAAG,EAAU,CAAC;IACrC,IAAI,CAAC;QACH,MAAM,cAAc,GAAG,yBAAyB,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC,CAAC;QACtE,MAAM,gBAAgB,GAAG,cAAc,CAAC,QAAQ,CAAC;QACjD,MAAM,cAAc,GAAG,cAAc,CAAC,gBAAgB,EAAE;YACtD,OAAO,EAAE,IAAI,CAAC,OAAO;SACtB,CAAC;aACC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,OAAO,CAAC;aACrC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,IAAI,EAAE,mBAAmB,CAAC,CAAC,CAAC,IAAI,EAAE,cAAc,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC,CAAC;QACvF,YAAY,GAAG,IAAI,GAAG,CAAC,cAAc,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,CAAC,QAAQ,IAAI,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC;IAC5F,CAAC;IAAC,MAAM,CAAC;QACP,wEAAwE;QACxE,4EAA4E;QAC5E,yEAAyE;QACzE,gEAAgE;IAClE,CAAC;IAED,MAAM,SAAS,GAAG,cAAc,CAAC,MAAM,CACrC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,YAAY,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,IAAI,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC,OAAO,EAAE,CAAC,CACjE,CAAC;IACF,MAAM,iBAAiB,GAAG,cAAc,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CACpD,YAAY,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,IAAI,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC,OAAO,EAAE,CAAC,CACzD,CAAC;IAEF,IAAI,SAAS,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACzB,MAAM,KAAK,GAAG,SAAS,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACtD,MAAM,IAAI,gBAAgB,CACxB,8CAA8C,KAAK,EAAE,EACrD,OAAO,CACR,CAAC;IACJ,CAAC;IAED,MAAM,QAAQ,GAAa,EAAE,CAAC;IAC9B,IAAI,iBAAiB,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACjC,MAAM,KAAK,GAAG,iBAAiB,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC9D,QAAQ,CAAC,IAAI,CACX,wBAAwB,iBAAiB,CAAC,MAAM,8FAA8F,KAAK,EAAE,CACtJ,CAAC;IACJ,CAAC;IAED,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC;QAChB,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,IAAI,EAAE,SAAS,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,QAAQ,EAAE,CAAC;IACtG,CAAC;IAED,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,aAAa,CAAC,CAAC;IAChE,MAAM,YAAY,CAAC,QAAQ,EAAE,GAAG,EAAE;QAChC,uEAAuE;QACvE,sEAAsE;QACtE,2EAA2E;QAC3E,6EAA6E;QAC7E,MAAM,OAAO,GAAG,EAAE,CAAC,YAAY,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;QAChD,MAAM,IAAI,GAAG,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;QACvC,MAAM,OAAO,GAAG,mBAAmB,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC;QACrD,IAAI,CAAC,OAAO,CAAC,EAAE,EAAE,CAAC;YAChB,MAAM,IAAI,gBAAgB,CACxB,sEAAsE,sBAAsB,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,EAC9G,OAAO,CACR,CAAC;QACJ,CAAC;QACD,eAAe,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;IAChC,CAAC,CAAC,CAAC;IAEH,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,IAAI,EAAE,SAAS,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC;AACrG,CAAC"}

package/dist/cli/adopt/derive.d.ts

@@ -9,7 +9,7 @@ export interface DerivedHook {
      * settings.json `timeout` is documented in seconds, NOT milliseconds
      * like the manifest's `budget_ms`). apply's `hookTimeoutSeconds`
      * (generate-settings.ts) converts `budget_ms` -> seconds via
-     * `Math.ceil(budget_ms / 1000)` (with a policy-intercept floor); the
+     * `Math.ceil(budget_ms / 1000)` (with a 1s floor); the
      * consumer of this field (`buildHookEntry` in ./index.ts) applies the
      * inverse `* 1000` when writing it back into `budget_ms`, so the
      * adopt→apply round-trip stays drift-free by construction for any
@@ -84,7 +84,7 @@ export declare function parseSettingsMcpServers(raw: unknown): DerivedMcp[];
  * dead at runtime and is surfaced only as a warning, never as drift.
  */
 export declare function projectRegistryMcpServers(servers: Record<string, unknown>): DerivedMcp[];
-export declare function manifestMcpProjection(manifest: Manifest, homeDir?: string, generatedDir?: string): DerivedMcp[];
+export declare function manifestMcpProjection(manifest: Manifest, homeDir?: string): DerivedMcp[];
 export type McpDriftReason = "new" | "modified";
 export interface McpDriftEntry {
     entry: DerivedMcp;

package/dist/cli/adopt/derive.js

@@ -1,4 +1,4 @@
-import { EVIDENCE_LEDGER_DB_ENV, GROUNDING_MCP_SERVER_NAME, SOLUTION_VERDICT_SIGNING_KEY_ENV, groundingLedgerEnvValue, signingKeyEnvValue, } from "../apply/generate-settings.js";
+import { EVIDENCE_LEDGER_DB_ENV, GROUNDING_MCP_SERVER_NAME, groundingLedgerEnvValue, } from "../apply/generate-settings.js";
 const KNOWN_EVENTS = new Set([
     "SessionStart",
     "UserPromptSubmit",
@@ -158,7 +158,7 @@ export function parseSettingsMcpServers(raw) {
 export function projectRegistryMcpServers(servers) {
     return projectMcpServersRecord(servers);
 }
-export function manifestMcpProjection(manifest, homeDir, generatedDir) {
+export function manifestMcpProjection(manifest, homeDir) {
     const out = manifest.tools.mcp.map(toDerivedMcp);
     // Mirror apply's grounding projection (generate-settings.ts,
     // projectGroundingEnv): apply synthesizes EVIDENCE_LEDGER_DB onto the
@@ -177,23 +177,6 @@ export function manifestMcpProjection(manifest, homeDir, generatedDir) {
             [EVIDENCE_LEDGER_DB_ENV]: groundingLedgerEnvValue(manifest, homeDir),
         };
     }
-    // Exact same mirror for apply's SOLUTION_VERDICT_SIGNING_KEY projection
-    // (generate-settings.ts, projectSigningKeyEnv; task 03a917fd/H1b) so an
-    // adopt after an apply does not report phantom drift on grounding-mcp
-    // for this key either. Same operator-override semantics as the
-    // EVIDENCE_LEDGER_DB mirror above (only fill in when absent), plus
-    // `projectSigningKeyEnv`'s own extra rule: no `generatedDir` passed in
-    // -> no projection, since there is nothing correct to derive without
-    // it (see GenerateSettingsExtras.generatedDir's doc comment).
-    if (grounding !== undefined &&
-        groundingManifestEntry?.enabled !== false &&
-        generatedDir !== undefined &&
-        !grounding.env?.[SOLUTION_VERDICT_SIGNING_KEY_ENV]) {
-        grounding.env = {
-            ...(grounding.env ?? {}),
-            [SOLUTION_VERDICT_SIGNING_KEY_ENV]: signingKeyEnvValue(generatedDir),
-        };
-    }
     return out;
 }
 function toDerivedMcp(m) {

package/dist/cli/adopt/derive.js.map

@@ -1 +1 @@
-{"version":3,"file":"derive.js","sourceRoot":"","sources":["../../../src/cli/adopt/derive.ts"],"names":[],"mappings":"AACA,OAAO,EACL,sBAAsB,EACtB,yBAAyB,EACzB,gCAAgC,EAChC,uBAAuB,EACvB,kBAAkB,GACnB,MAAM,+BAA+B,CAAC;AAEvC,MAAM,YAAY,GAAG,IAAI,GAAG,CAAC;IAC3B,cAAc;IACd,kBAAkB;IAClB,YAAY;IACZ,aAAa;IACb,MAAM;IACN,eAAe;IACf,cAAc;IACd,YAAY;CACb,CAAC,CAAC;AAmCH;;;GAGG;AACH,MAAM,UAAU,kBAAkB,CAAC,GAAY;IAC7C,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC;QAAE,OAAO,EAAE,CAAC;IAC9B,MAAM,IAAI,GAAG,GAAmB,CAAC;IACjC,IAAI,CAAC,IAAI,CAAC,KAAK,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC;QAAE,OAAO,EAAE,CAAC;IACpD,MAAM,GAAG,GAAkB,EAAE,CAAC;IAC9B,KAAK,MAAM,CAAC,KAAK,EAAE,MAAM,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;QACzD,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,KAAK,CAAC;YAAE,SAAS;QACvC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC;YAAE,SAAS;QACrC,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;YAC3B,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC;gBAAE,SAAS;YAC/B,MAAM,OAAO,GACX,OAAO,KAAK,CAAC,OAAO,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC;gBAC3D,CAAC,CAAC,KAAK,CAAC,OAAO;gBACf,CAAC,CAAC,SAAS,CAAC;YAChB,MAAM,KAAK,GAAI,KAA2B,CAAC,KAAK,CAAC;YACjD,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;gBAAE,SAAS;YACpC,KAAK,MAAM,CAAC,IAAI,KAAK,EAAE,CAAC;gBACtB,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC;oBAAE,SAAS;gBAC3B,IAAI,OAAO,CAAC,CAAC,OAAO,KAAK,QAAQ,IAAI,CAAC,CAAC,OAAO,CAAC,MAAM,KAAK,CAAC;oBAAE,SAAS;gBACtE,uDAAuD;gBACvD,+DAA+D;gBAC/D,2DAA2D;gBAC3D,MAAM,OAAO,GACX,OAAO,CAAC,CAAC,OAAO,KAAK,QAAQ,IAAI,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,OAAO,GAAG,CAAC;oBAC3E,CAAC,CAAC,CAAC,CAAC,OAAO;oBACX,CAAC,CAAC,SAAS,CAAC;gBAChB,GAAG,CAAC,IAAI,CAAC;oBACP,KAAK;oBACL,OAAO,EAAE,CAAC,CAAC,OAAO;oBAClB,GAAG,CAAC,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;oBACpD,GAAG,CAAC,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;iBAC9C,CAAC,CAAC;YACL,CAAC;QACH,CAAC;IACH,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,kBAAkB,CAAC,QAAkB;IACnD,OAAO,QAAQ,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE;QAC9B,MAAM,GAAG,GAAgB,EAAE,KAAK,EAAE,CAAC,CAAC,KAAK,EAAE,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC;QAChE,IAAI,CAAC,CAAC,KAAK,KAAK,SAAS;YAAE,GAAG,CAAC,KAAK,GAAG,CAAC,CAAC,KAAK,CAAC;QAC/C,OAAO,GAAG,CAAC;IACb,CAAC,CAAC,CAAC;AACL,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,YAAY,CAC1B,aAA4B,EAC5B,aAA4B;IAE5B,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,aAAa,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC;IACnD,OAAO,aAAa,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AAC9D,CAAC;AAED,SAAS,KAAK,CAAC,CAAc;IAC3B,OAAO,GAAG,CAAC,CAAC,KAAK,OAAO,CAAC,CAAC,OAAO,OAAO,CAAC,CAAC,KAAK,IAAI,EAAE,EAAE,CAAC;AAC1D,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,cAAc,CAC5B,CAAc,EACd,KAAkB;IAElB,MAAM,UAAU,GAAG,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;IAC1D,MAAM,IAAI,GAAG,UAAU,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,IAAI,EAAE,CAAC;IAC/C,MAAM,IAAI,GAAG,IAAI,CAAC,OAAO,CAAC,UAAU,EAAE,EAAE,CAAC,CAAC;IAC1C,MAAM,IAAI,GAAG,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,cAAc,CAAC;IACrD,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC;QAAE,OAAO,IAAI,CAAC;IAClC,IAAI,CAAC,GAAG,CAAC,CAAC;IACV,OAAO,KAAK,CAAC,GAAG,CAAC,GAAG,IAAI,IAAI,CAAC,EAAE,CAAC;QAAE,CAAC,EAAE,CAAC;IACtC,OAAO,GAAG,IAAI,IAAI,CAAC,EAAE,CAAC;AACxB,CAAC;AAED,SAAS,QAAQ,CAAC,CAAU;IAC1B,OAAO,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;AAClE,CAAC;AA0BD;;;;;;GAMG;AACH,SAAS,uBAAuB,CAAC,OAAgC;IAC/D,MAAM,GAAG,GAAiB,EAAE,CAAC;IAC7B,KAAK,MAAM,CAAC,IAAI,EAAE,OAAO,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;QACtD,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC;YAAE,SAAS;QACjC,MAAM,IAAI,GAAG,OAA0B,CAAC;QACxC,IAAI,OAAO,IAAI,CAAC,OAAO,KAAK,QAAQ,IAAI,IAAI,CAAC,OAAO,CAAC,MAAM,KAAK,CAAC;YAAE,SAAS;QAC5E,MAAM,IAAI,GAAG,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC;YACnC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,EAAe,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC;YAC7D,CAAC,CAAC,EAAE,CAAC;QACP,MAAM,OAAO,GAAG,CAAC,IAAI,CAAC,OAAO,EAAE,GAAG,IAAI,CAAC,CAAC;QACxC,MAAM,KAAK,GAAe,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC;QAC5C,IAAI,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;YACvB,MAAM,GAAG,GAA2B,EAAE,CAAC;YACvC,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;gBAC9C,IAAI,OAAO,CAAC,KAAK,QAAQ;oBAAE,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;YACxC,CAAC;YACD,IAAI,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,MAAM,GAAG,CAAC;gBAAE,KAAK,CAAC,GAAG,GAAG,GAAG,CAAC;QACnD,CAAC;QACD,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IAClB,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,MAAM,UAAU,uBAAuB,CAAC,GAAY;IAClD,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC;QAAE,OAAO,EAAE,CAAC;IAC9B,MAAM,IAAI,GAAG,GAA0B,CAAC;IACxC,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,UAAU,CAAC;QAAE,OAAO,EAAE,CAAC;IAC1C,OAAO,uBAAuB,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;AAClD,CAAC;AAED;;;;;;;;;;;;;GAaG;AACH,MAAM,UAAU,yBAAyB,CAAC,OAAgC;IACxE,OAAO,uBAAuB,CAAC,OAAO,CAAC,CAAC;AAC1C,CAAC;AAED,MAAM,UAAU,qBAAqB,CACnC,QAAkB,EAClB,OAAgB,EAChB,YAAqB;IAErB,MAAM,GAAG,GAAG,QAAQ,CAAC,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC;IACjD,6DAA6D;IAC7D,sEAAsE;IACtE,oEAAoE;IACpE,oEAAoE;IACpE,uEAAuE;IACvE,gEAAgE;IAChE,iCAAiC;IACjC,MAAM,sBAAsB,GAAG,QAAQ,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,CACpD,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,yBAAyB,CAC5C,CAAC;IACF,MAAM,SAAS,GAAG,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,yBAAyB,CAAC,CAAC;IACxE,IACE,SAAS,KAAK,SAAS;QACvB,sBAAsB,EAAE,OAAO,KAAK,KAAK;QACzC,CAAC,SAAS,CAAC,GAAG,EAAE,CAAC,sBAAsB,CAAC,EACxC,CAAC;QACD,SAAS,CAAC,GAAG,GAAG;YACd,GAAG,CAAC,SAAS,CAAC,GAAG,IAAI,EAAE,CAAC;YACxB,CAAC,sBAAsB,CAAC,EAAE,uBAAuB,CAAC,QAAQ,EAAE,OAAO,CAAC;SACrE,CAAC;IACJ,CAAC;IACD,wEAAwE;IACxE,wEAAwE;IACxE,sEAAsE;IACtE,+DAA+D;IAC/D,mEAAmE;IACnE,uEAAuE;IACvE,qEAAqE;IACrE,8DAA8D;IAC9D,IACE,SAAS,KAAK,SAAS;QACvB,sBAAsB,EAAE,OAAO,KAAK,KAAK;QACzC,YAAY,KAAK,SAAS;QAC1B,CAAC,SAAS,CAAC,GAAG,EAAE,CAAC,gCAAgC,CAAC,EAClD,CAAC;QACD,SAAS,CAAC,GAAG,GAAG;YACd,GAAG,CAAC,SAAS,CAAC,GAAG,IAAI,EAAE,CAAC;YACxB,CAAC,gCAAgC,CAAC,EAAE,kBAAkB,CAAC,YAAY,CAAC;SACrE,CAAC;IACJ,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,SAAS,YAAY,CAAC,CAAY;IAChC,MAAM,OAAO,GAAG,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC;QACtC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,OAAO,CAAC;QAChB,CAAC,CAAC,CAAC,CAAC,OAAO;aACN,IAAI,EAAE;aACN,KAAK,CAAC,KAAK,CAAC;aACZ,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;IACnC,MAAM,GAAG,GAAe,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,OAAO,EAAE,CAAC;IAClD,IAAI,CAAC,CAAC,GAAG,IAAI,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,MAAM,GAAG,CAAC;QAAE,GAAG,CAAC,GAAG,GAAG,EAAE,GAAG,CAAC,CAAC,GAAG,EAAE,CAAC;IACnE,OAAO,GAAG,CAAC;AACb,CAAC;AASD,MAAM,UAAU,eAAe,CAC7B,WAAyB,EACzB,WAAyB;IAEzB,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;IAC5D,MAAM,GAAG,GAAoB,EAAE,CAAC;IAChC,KAAK,MAAM,CAAC,IAAI,WAAW,EAAE,CAAC;QAC5B,MAAM,QAAQ,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;QACpC,IAAI,CAAC,QAAQ,EAAE,CAAC;YACd,GAAG,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC;YACtC,SAAS;QACX,CAAC;QACD,IAAI,QAAQ,CAAC,QAAQ,EAAE,CAAC,CAAC;YAAE,SAAS;QACpC,GAAG,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,CAAC,EAAE,MAAM,EAAE,UAAU,EAAE,CAAC,CAAC;IAC7C,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,OAAO,EAAE,QAAQ,EAAE,CAAC;AAEpB,SAAS,QAAQ,CAAC,CAAa,EAAE,CAAa;IAC5C,IAAI,CAAC,CAAC,OAAO,CAAC,MAAM,KAAK,CAAC,CAAC,OAAO,CAAC,MAAM;QAAE,OAAO,KAAK,CAAC;IACxD,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QAC1C,IAAI,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC;YAAE,OAAO,KAAK,CAAC;IAClD,CAAC;IACD,MAAM,IAAI,GAAG,CAAC,CAAC,GAAG,IAAI,EAAE,CAAC;IACzB,MAAM,IAAI,GAAG,CAAC,CAAC,GAAG,IAAI,EAAE,CAAC;IACzB,MAAM,EAAE,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,CAAC;IACpC,MAAM,EAAE,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,CAAC;IACpC,IAAI,EAAE,CAAC,MAAM,KAAK,EAAE,CAAC,MAAM;QAAE,OAAO,KAAK,CAAC;IAC1C,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,EAAE,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACnC,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC,CAAE,CAAC;QAClB,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC,CAAE,CAAC;QAClB,IAAI,EAAE,KAAK,EAAE;YAAE,OAAO,KAAK,CAAC;QAC5B,IAAI,IAAI,CAAC,EAAE,CAAC,KAAK,IAAI,CAAC,EAAE,CAAC;YAAE,OAAO,KAAK,CAAC;IAC1C,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC"}
+{"version":3,"file":"derive.js","sourceRoot":"","sources":["../../../src/cli/adopt/derive.ts"],"names":[],"mappings":"AACA,OAAO,EACL,sBAAsB,EACtB,yBAAyB,EACzB,uBAAuB,GACxB,MAAM,+BAA+B,CAAC;AAEvC,MAAM,YAAY,GAAG,IAAI,GAAG,CAAC;IAC3B,cAAc;IACd,kBAAkB;IAClB,YAAY;IACZ,aAAa;IACb,MAAM;IACN,eAAe;IACf,cAAc;IACd,YAAY;CACb,CAAC,CAAC;AAmCH;;;GAGG;AACH,MAAM,UAAU,kBAAkB,CAAC,GAAY;IAC7C,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC;QAAE,OAAO,EAAE,CAAC;IAC9B,MAAM,IAAI,GAAG,GAAmB,CAAC;IACjC,IAAI,CAAC,IAAI,CAAC,KAAK,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC;QAAE,OAAO,EAAE,CAAC;IACpD,MAAM,GAAG,GAAkB,EAAE,CAAC;IAC9B,KAAK,MAAM,CAAC,KAAK,EAAE,MAAM,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;QACzD,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,KAAK,CAAC;YAAE,SAAS;QACvC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC;YAAE,SAAS;QACrC,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;YAC3B,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC;gBAAE,SAAS;YAC/B,MAAM,OAAO,GACX,OAAO,KAAK,CAAC,OAAO,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC;gBAC3D,CAAC,CAAC,KAAK,CAAC,OAAO;gBACf,CAAC,CAAC,SAAS,CAAC;YAChB,MAAM,KAAK,GAAI,KAA2B,CAAC,KAAK,CAAC;YACjD,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;gBAAE,SAAS;YACpC,KAAK,MAAM,CAAC,IAAI,KAAK,EAAE,CAAC;gBACtB,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC;oBAAE,SAAS;gBAC3B,IAAI,OAAO,CAAC,CAAC,OAAO,KAAK,QAAQ,IAAI,CAAC,CAAC,OAAO,CAAC,MAAM,KAAK,CAAC;oBAAE,SAAS;gBACtE,uDAAuD;gBACvD,+DAA+D;gBAC/D,2DAA2D;gBAC3D,MAAM,OAAO,GACX,OAAO,CAAC,CAAC,OAAO,KAAK,QAAQ,IAAI,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,OAAO,GAAG,CAAC;oBAC3E,CAAC,CAAC,CAAC,CAAC,OAAO;oBACX,CAAC,CAAC,SAAS,CAAC;gBAChB,GAAG,CAAC,IAAI,CAAC;oBACP,KAAK;oBACL,OAAO,EAAE,CAAC,CAAC,OAAO;oBAClB,GAAG,CAAC,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;oBACpD,GAAG,CAAC,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;iBAC9C,CAAC,CAAC;YACL,CAAC;QACH,CAAC;IACH,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,kBAAkB,CAAC,QAAkB;IACnD,OAAO,QAAQ,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE;QAC9B,MAAM,GAAG,GAAgB,EAAE,KAAK,EAAE,CAAC,CAAC,KAAK,EAAE,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC;QAChE,IAAI,CAAC,CAAC,KAAK,KAAK,SAAS;YAAE,GAAG,CAAC,KAAK,GAAG,CAAC,CAAC,KAAK,CAAC;QAC/C,OAAO,GAAG,CAAC;IACb,CAAC,CAAC,CAAC;AACL,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,YAAY,CAC1B,aAA4B,EAC5B,aAA4B;IAE5B,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,aAAa,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC;IACnD,OAAO,aAAa,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AAC9D,CAAC;AAED,SAAS,KAAK,CAAC,CAAc;IAC3B,OAAO,GAAG,CAAC,CAAC,KAAK,OAAO,CAAC,CAAC,OAAO,OAAO,CAAC,CAAC,KAAK,IAAI,EAAE,EAAE,CAAC;AAC1D,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,cAAc,CAC5B,CAAc,EACd,KAAkB;IAElB,MAAM,UAAU,GAAG,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;IAC1D,MAAM,IAAI,GAAG,UAAU,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,IAAI,EAAE,CAAC;IAC/C,MAAM,IAAI,GAAG,IAAI,CAAC,OAAO,CAAC,UAAU,EAAE,EAAE,CAAC,CAAC;IAC1C,MAAM,IAAI,GAAG,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,cAAc,CAAC;IACrD,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC;QAAE,OAAO,IAAI,CAAC;IAClC,IAAI,CAAC,GAAG,CAAC,CAAC;IACV,OAAO,KAAK,CAAC,GAAG,CAAC,GAAG,IAAI,IAAI,CAAC,EAAE,CAAC;QAAE,CAAC,EAAE,CAAC;IACtC,OAAO,GAAG,IAAI,IAAI,CAAC,EAAE,CAAC;AACxB,CAAC;AAED,SAAS,QAAQ,CAAC,CAAU;IAC1B,OAAO,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;AAClE,CAAC;AA0BD;;;;;;GAMG;AACH,SAAS,uBAAuB,CAAC,OAAgC;IAC/D,MAAM,GAAG,GAAiB,EAAE,CAAC;IAC7B,KAAK,MAAM,CAAC,IAAI,EAAE,OAAO,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;QACtD,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC;YAAE,SAAS;QACjC,MAAM,IAAI,GAAG,OAA0B,CAAC;QACxC,IAAI,OAAO,IAAI,CAAC,OAAO,KAAK,QAAQ,IAAI,IAAI,CAAC,OAAO,CAAC,MAAM,KAAK,CAAC;YAAE,SAAS;QAC5E,MAAM,IAAI,GAAG,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC;YACnC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,EAAe,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC;YAC7D,CAAC,CAAC,EAAE,CAAC;QACP,MAAM,OAAO,GAAG,CAAC,IAAI,CAAC,OAAO,EAAE,GAAG,IAAI,CAAC,CAAC;QACxC,MAAM,KAAK,GAAe,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC;QAC5C,IAAI,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;YACvB,MAAM,GAAG,GAA2B,EAAE,CAAC;YACvC,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;gBAC9C,IAAI,OAAO,CAAC,KAAK,QAAQ;oBAAE,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;YACxC,CAAC;YACD,IAAI,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,MAAM,GAAG,CAAC;gBAAE,KAAK,CAAC,GAAG,GAAG,GAAG,CAAC;QACnD,CAAC;QACD,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IAClB,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,MAAM,UAAU,uBAAuB,CAAC,GAAY;IAClD,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC;QAAE,OAAO,EAAE,CAAC;IAC9B,MAAM,IAAI,GAAG,GAA0B,CAAC;IACxC,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,UAAU,CAAC;QAAE,OAAO,EAAE,CAAC;IAC1C,OAAO,uBAAuB,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;AAClD,CAAC;AAED;;;;;;;;;;;;;GAaG;AACH,MAAM,UAAU,yBAAyB,CAAC,OAAgC;IACxE,OAAO,uBAAuB,CAAC,OAAO,CAAC,CAAC;AAC1C,CAAC;AAED,MAAM,UAAU,qBAAqB,CAAC,QAAkB,EAAE,OAAgB;IACxE,MAAM,GAAG,GAAG,QAAQ,CAAC,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC;IACjD,6DAA6D;IAC7D,sEAAsE;IACtE,oEAAoE;IACpE,oEAAoE;IACpE,uEAAuE;IACvE,gEAAgE;IAChE,iCAAiC;IACjC,MAAM,sBAAsB,GAAG,QAAQ,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,CACpD,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,yBAAyB,CAC5C,CAAC;IACF,MAAM,SAAS,GAAG,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,yBAAyB,CAAC,CAAC;IACxE,IACE,SAAS,KAAK,SAAS;QACvB,sBAAsB,EAAE,OAAO,KAAK,KAAK;QACzC,CAAC,SAAS,CAAC,GAAG,EAAE,CAAC,sBAAsB,CAAC,EACxC,CAAC;QACD,SAAS,CAAC,GAAG,GAAG;YACd,GAAG,CAAC,SAAS,CAAC,GAAG,IAAI,EAAE,CAAC;YACxB,CAAC,sBAAsB,CAAC,EAAE,uBAAuB,CAAC,QAAQ,EAAE,OAAO,CAAC;SACrE,CAAC;IACJ,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,SAAS,YAAY,CAAC,CAAY;IAChC,MAAM,OAAO,GAAG,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC;QACtC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,OAAO,CAAC;QAChB,CAAC,CAAC,CAAC,CAAC,OAAO;aACN,IAAI,EAAE;aACN,KAAK,CAAC,KAAK,CAAC;aACZ,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;IACnC,MAAM,GAAG,GAAe,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,OAAO,EAAE,CAAC;IAClD,IAAI,CAAC,CAAC,GAAG,IAAI,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,MAAM,GAAG,CAAC;QAAE,GAAG,CAAC,GAAG,GAAG,EAAE,GAAG,CAAC,CAAC,GAAG,EAAE,CAAC;IACnE,OAAO,GAAG,CAAC;AACb,CAAC;AASD,MAAM,UAAU,eAAe,CAC7B,WAAyB,EACzB,WAAyB;IAEzB,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;IAC5D,MAAM,GAAG,GAAoB,EAAE,CAAC;IAChC,KAAK,MAAM,CAAC,IAAI,WAAW,EAAE,CAAC;QAC5B,MAAM,QAAQ,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;QACpC,IAAI,CAAC,QAAQ,EAAE,CAAC;YACd,GAAG,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC;YACtC,SAAS;QACX,CAAC;QACD,IAAI,QAAQ,CAAC,QAAQ,EAAE,CAAC,CAAC;YAAE,SAAS;QACpC,GAAG,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,CAAC,EAAE,MAAM,EAAE,UAAU,EAAE,CAAC,CAAC;IAC7C,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,OAAO,EAAE,QAAQ,EAAE,CAAC;AAEpB,SAAS,QAAQ,CAAC,CAAa,EAAE,CAAa;IAC5C,IAAI,CAAC,CAAC,OAAO,CAAC,MAAM,KAAK,CAAC,CAAC,OAAO,CAAC,MAAM;QAAE,OAAO,KAAK,CAAC;IACxD,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QAC1C,IAAI,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC;YAAE,OAAO,KAAK,CAAC;IAClD,CAAC;IACD,MAAM,IAAI,GAAG,CAAC,CAAC,GAAG,IAAI,EAAE,CAAC;IACzB,MAAM,IAAI,GAAG,CAAC,CAAC,GAAG,IAAI,EAAE,CAAC;IACzB,MAAM,EAAE,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,CAAC;IACpC,MAAM,EAAE,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,CAAC;IACpC,IAAI,EAAE,CAAC,MAAM,KAAK,EAAE,CAAC,MAAM;QAAE,OAAO,KAAK,CAAC;IAC1C,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,EAAE,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACnC,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC,CAAE,CAAC;QAClB,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC,CAAE,CAAC;QAClB,IAAI,EAAE,KAAK,EAAE;YAAE,OAAO,KAAK,CAAC;QAC5B,IAAI,IAAI,CAAC,EAAE,CAAC,KAAK,IAAI,CAAC,EAAE,CAAC;YAAE,OAAO,KAAK,CAAC;IAC1C,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC"}

package/dist/cli/adopt/index.d.ts

@@ -5,7 +5,7 @@ export interface AdoptOptions {
     /** Optional injection point for tests; defaults to readline against stdin. */
     prompt?: (message: string) => Promise<string>;
     /**
-     * Test seam mirroring `approve risk` / `pause`: overrides the
+     * Test seam: overrides the
      * `process.stdin.isTTY` read that decides whether the default
      * confirmation prompt may run, so the non-TTY refusal can be
      * exercised hermetically.

package/dist/cli/adopt/index.js

@@ -11,7 +11,6 @@ import { parseManifest } from "../../schema/index.js";
 import { applyAdd } from "../add/mutate.js";
 import { EX_FAIL, EX_NOINPUT, HarnessExitError } from "../exit-codes.js";
 import { readTopLevelMcpServers, resolveClaudeUserRegistryPath } from "../../io/claude-mcp.js";
-import { resolveGeneratedDir } from "../../io/generated-dir.js";
 import { computeDrift, computeMcpDrift, manifestMcpProjection, manifestProjection, parseSettingsHooks, parseSettingsMcpServers, projectRegistryMcpServers, synthesizeName, } from "./derive.js";
 const DEFAULT_BASENAME = "harness.yaml";
 const LOCK_BASENAME = ".harness.lock";
@@ -66,17 +65,7 @@ export async function adopt(settingsPath, opts = {}) {
     const registryPath = opts.registryPath ?? resolveClaudeUserRegistryPath({ env: opts.env });
     const { servers: registryServers, error: registryReadError } = readTopLevelMcpServers(registryPath);
     const registryMcp = projectRegistryMcpServers(registryServers);
-    // task 03a917fd/H1b: generatedDir resolved the same way apply.ts and
-    // interactive.ts resolve it, so manifestMcpProjection's
-    // SOLUTION_VERDICT_SIGNING_KEY mirror (derive.ts) compares against the
-    // real key path. homeDir is left as-is (not previously threaded through
-    // here for the EVIDENCE_LEDGER_DB mirror either -- out of this task's
-    // scope to change).
-    const generatedDir = resolveGeneratedDir({
-        ...(opts.homeDir !== undefined ? { homeDir: opts.homeDir } : {}),
-        manifestPath,
-    });
-    const mcpProjection = manifestMcpProjection(manifest, undefined, generatedDir);
+    const mcpProjection = manifestMcpProjection(manifest);
     const mcpDrift = computeMcpDrift(registryMcp, mcpProjection);
     if (drift.length === 0 && mcpDrift.length === 0) {
         return {

package/dist/cli/adopt/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/cli/adopt/index.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,MAAM,SAAS,CAAC;AAC9B,OAAO,KAAK,IAAI,MAAM,WAAW,CAAC;AAClC,OAAO,KAAK,QAAQ,MAAM,wBAAwB,CAAC;AACnD,OAAO,EAAE,KAAK,IAAI,SAAS,EAAE,MAAM,MAAM,CAAC;AAC1C,OAAO,EAAE,eAAe,EAAE,MAAM,0BAA0B,CAAC;AAC3D,OAAO,EAAE,cAAc,EAAE,MAAM,2BAA2B,CAAC;AAC3D,OAAO,EAAE,YAAY,EAAE,MAAM,kBAAkB,CAAC;AAChD,OAAO,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAChD,OAAO,EACL,sBAAsB,EACtB,mBAAmB,GACpB,MAAM,mCAAmC,CAAC;AAC3C,OAAO,EAAE,aAAa,EAAkB,MAAM,uBAAuB,CAAC;AACtE,OAAO,EAAE,QAAQ,EAAgC,MAAM,kBAAkB,CAAC;AAC1E,OAAO,EAAE,OAAO,EAAE,UAAU,EAAE,gBAAgB,EAAE,MAAM,kBAAkB,CAAC;AACzE,OAAO,EAAE,sBAAsB,EAAE,6BAA6B,EAAE,MAAM,wBAAwB,CAAC;AAC/F,OAAO,EAAE,mBAAmB,EAAE,MAAM,2BAA2B,CAAC;AAChE,OAAO,EACL,YAAY,EACZ,eAAe,EACf,qBAAqB,EACrB,kBAAkB,EAClB,kBAAkB,EAClB,uBAAuB,EACvB,yBAAyB,EACzB,cAAc,GAGf,MAAM,aAAa,CAAC;AAoErB,MAAM,gBAAgB,GAAG,cAAc,CAAC;AACxC,MAAM,aAAa,GAAG,eAAe,CAAC;AAEtC,SAAS,mBAAmB,CAAC,IAAkB;IAC7C,IAAI,IAAI,CAAC,UAAU;QAAE,OAAO,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;IAC1D,OAAO,IAAI,CAAC,IAAI,CACd,cAAc,CAAC,EAAE,GAAG,CAAC,IAAI,CAAC,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,IAAI,EACzF,gBAAgB,CACjB,CAAC;AACJ,CAAC;AAED,iEAAiE;AACjE,qEAAqE;AACrE,8CAA8C;AAC9C,KAAK,UAAU,aAAa,CAAC,OAAe;IAC1C,MAAM,EAAE,GAAG,QAAQ,CAAC,eAAe,CAAC,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC;IACtF,IAAI,CAAC;QACH,OAAO,MAAM,EAAE,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;IACpC,CAAC;YAAS,CAAC;QACT,EAAE,CAAC,KAAK,EAAE,CAAC;IACb,CAAC;AACH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,KAAK,CACzB,YAAoB,EACpB,OAAqB,EAAE;IAEvB,MAAM,YAAY,GAAG,mBAAmB,CAAC,IAAI,CAAC,CAAC;IAC/C,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,YAAY,CAAC,EAAE,CAAC;QACjC,MAAM,IAAI,gBAAgB,CACxB,iCAAiC,YAAY,8BAA8B,EAC3E,UAAU,CACX,CAAC;IACJ,CAAC;IACD,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,YAAY,CAAC,EAAE,CAAC;QACjC,MAAM,IAAI,gBAAgB,CACxB,sCAAsC,YAAY,EAAE,EACpD,UAAU,CACX,CAAC;IACJ,CAAC;IAED,MAAM,YAAY,GAAG,EAAE,CAAC,YAAY,CAAC,YAAY,EAAE,MAAM,CAAC,CAAC;IAC3D,MAAM,QAAQ,GAAG,aAAa,CAAC,SAAS,CAAC,YAAY,CAAC,CAAC,CAAC;IACxD,MAAM,UAAU,GAAG,kBAAkB,CAAC,QAAQ,CAAC,CAAC;IAEhD,IAAI,WAAoB,CAAC;IACzB,IAAI,CAAC;QACH,WAAW,GAAG,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,YAAY,CAAC,YAAY,EAAE,MAAM,CAAC,CAAC,CAAC;IAClE,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,MAAM,IAAI,gBAAgB,CACxB,iBAAiB,YAAY,uBAAwB,CAAW,CAAC,OAAO,EAAE,EAC1E,OAAO,CACR,CAAC;IACJ,CAAC;IAED,MAAM,aAAa,GAAG,kBAAkB,CAAC,WAAW,CAAC,CAAC;IACtD,MAAM,KAAK,GAAG,YAAY,CAAC,aAAa,EAAE,UAAU,CAAC,CAAC;IAEtD,wEAAwE;IACxE,2DAA2D;IAC3D,mEAAmE;IACnE,gEAAgE;IAChE,uEAAuE;IACvE,wEAAwE;IACxE,4EAA4E;IAC5E,gDAAgD;IAChD,MAAM,oBAAoB,GAAG,uBAAuB,CAAC,WAAW,CAAC;SAC9D,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;SAClB,IAAI,EAAE,CAAC;IAEV,MAAM,YAAY,GAAG,IAAI,CAAC,YAAY,IAAI,6BAA6B,CAAC,EAAE,GAAG,EAAE,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC;IAC3F,MAAM,EAAE,OAAO,EAAE,eAAe,EAAE,KAAK,EAAE,iBAAiB,EAAE,GAC1D,sBAAsB,CAAC,YAAY,CAAC,CAAC;IACvC,MAAM,WAAW,GAAG,yBAAyB,CAAC,eAAe,CAAC,CAAC;IAC/D,qEAAqE;IACrE,wDAAwD;IACxD,uEAAuE;IACvE,wEAAwE;IACxE,sEAAsE;IACtE,oBAAoB;IACpB,MAAM,YAAY,GAAG,mBAAmB,CAAC;QACvC,GAAG,CAAC,IAAI,CAAC,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAChE,YAAY;KACb,CAAC,CAAC;IACH,MAAM,aAAa,GAAG,qBAAqB,CAAC,QAAQ,EAAE,SAAS,EAAE,YAAY,CAAC,CAAC;IAC/E,MAAM,QAAQ,GAAG,eAAe,CAAC,WAAW,EAAE,aAAa,CAAC,CAAC;IAE7D,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAChD,OAAO;YACL,YAAY;YACZ,YAAY;YACZ,UAAU,EAAE,CAAC;YACb,cAAc,EAAE,CAAC;YACjB,aAAa,EAAE,CAAC;YAChB,IAAI,EAAE,EAAE;YACR,OAAO,EAAE,KAAK;YACd,YAAY,EAAE,EAAE;YAChB,eAAe,EAAE,EAAE;YACnB,gBAAgB,EAAE,EAAE;YACpB,OAAO,EAAE,UAAU;YACnB,oBAAoB;YACpB,GAAG,CAAC,iBAAiB,KAAK,IAAI,CAAC,CAAC,CAAC,EAAE,iBAAiB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAC7D,CAAC;IACJ,CAAC;IAED,MAAM,KAAK,GAAG,IAAI,GAAG,CAAC,QAAQ,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC;IACzD,MAAM,YAAY,GAAa,EAAE,CAAC;IAClC,IAAI,YAAY,GAAG,YAAY,CAAC;IAChC,KAAK,MAAM,CAAC,IAAI,KAAK,EAAE,CAAC;QACtB,MAAM,IAAI,GAAG,cAAc,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC;QACtC,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QAChB,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACxB,YAAY,GAAG,QAAQ,CAAC,YAAY,EAAE;YACpC,IAAI,EAAE,MAAM;YACZ,KAAK,EAAE,cAAc,CAAC,IAAI,EAAE,CAAC,CAAC;SAC/B,CAAC,CAAC;IACL,CAAC;IAED,MAAM,eAAe,GAAa,EAAE,CAAC;IACrC,MAAM,gBAAgB,GAAa,EAAE,CAAC;IACtC,mEAAmE;IACnE,kEAAkE;IAClE,sCAAsC;IACtC,MAAM,cAAc,GAAG,IAAI,GAAG,CAAC,QAAQ,CAAC,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;IAC3E,KAAK,MAAM,CAAC,IAAI,QAAQ,EAAE,CAAC;QACzB,IAAI,CAAC,CAAC,MAAM,KAAK,UAAU;YAAE,gBAAgB,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QACjE,eAAe,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QACnC,YAAY,GAAG,QAAQ,CAAC,YAAY,EAAE;YACpC,IAAI,EAAE,aAAa;YACnB,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,IAAI;YAClB,KAAK,EAAE,aAAa,CAAC,CAAC,CAAC,KAAK,EAAE,cAAc,CAAC,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;SAChE,CAAC,CAAC;IACL,CAAC;IAED,MAAM,IAAI,GAAG,WAAW,CAAC;QACvB,QAAQ,EAAE,IAAI,CAAC,QAAQ,CAAC,YAAY,CAAC;QACrC,OAAO,EAAE,YAAY;QACrB,OAAO,EAAE,YAAY;QACrB,SAAS,EAAE,SAAS;QACpB,SAAS,EAAE,UAAU;KACtB,CAAC,CAAC;IAEH,+EAA+E;IAC/E,qEAAqE;IACrE,4EAA4E;IAC5E,4EAA4E;IAC5E,6EAA6E;IAC7E,MAAM,UAAU,GAAG,mBAAmB,CAAC,SAAS,CAAC,YAAY,CAAC,CAAC,CAAC;IAChE,IAAI,CAAC,UAAU,CAAC,EAAE,EAAE,CAAC;QACnB,MAAM,IAAI,gBAAgB,CACxB,+CAA+C,sBAAsB,CAAC,UAAU,CAAC,MAAM,CAAC,EAAE,EAC1F,OAAO,CACR,CAAC;IACJ,CAAC;IAED,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC;QACd,oEAAoE;QACpE,mEAAmE;QACnE,mEAAmE;QACnE,qCAAqC;QACrC,IAAI,IAAI,CAAC,MAAM,KAAK,SAAS,IAAI,CAAC,CAAC,IAAI,CAAC,UAAU,IAAI,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,EAAE,CAAC;YAC3E,MAAM,IAAI,gBAAgB,CACxB,8FAA8F,EAC9F,OAAO,CACR,CAAC;QACJ,CAAC;QACD,MAAM,QAAQ,GAAG,IAAI,CAAC,MAAM,IAAI,aAAa,CAAC;QAC9C,MAAM,MAAM,GAAG,CAAC,MAAM,QAAQ,CAAC,GAAG,IAAI,iBAAiB,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;QAC/E,IAAI,MAAM,KAAK,GAAG,IAAI,MAAM,KAAK,KAAK,EAAE,CAAC;YACvC,OAAO;gBACL,YAAY;gBACZ,YAAY;gBACZ,UAAU,EAAE,KAAK,CAAC,MAAM,GAAG,QAAQ,CAAC,MAAM;gBAC1C,cAAc,EAAE,KAAK,CAAC,MAAM;gBAC5B,aAAa,EAAE,QAAQ,CAAC,MAAM;gBAC9B,IAAI;gBACJ,OAAO,EAAE,KAAK;gBACd,YAAY;gBACZ,eAAe;gBACf,gBAAgB;gBAChB,OAAO,EAAE,UAAU;gBACnB,oBAAoB;gBACpB,GAAG,CAAC,iBAAiB,KAAK,IAAI,CAAC,CAAC,CAAC,EAAE,iBAAiB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aAC7D,CAAC;QACJ,CAAC;IACH,CAAC;IAED,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,YAAY,CAAC,EAAE,aAAa,CAAC,CAAC;IACtE,MAAM,YAAY,CAAC,QAAQ,EAAE,GAAG,EAAE;QAChC,MAAM,OAAO,GAAG,EAAE,CAAC,YAAY,CAAC,YAAY,EAAE,MAAM,CAAC,CAAC;QACtD,IAAI,IAAI,GAAG,OAAO,CAAC;QACnB,MAAM,eAAe,GAAG,aAAa,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC,CAAC;QAC1D,MAAM,SAAS,GAAG,IAAI,GAAG,CAAC,eAAe,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC;QACpE,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;YACtC,MAAM,CAAC,GAAG,KAAK,CAAC,CAAC,CAAE,CAAC;YACpB,MAAM,IAAI,GAAG,YAAY,CAAC,CAAC,CAAE,CAAC;YAC9B,yEAAyE;YACzE,iEAAiE;YACjE,kEAAkE;YAClE,yEAAyE;YACzE,wEAAwE;YACxE,wEAAwE;YACxE,uEAAuE;YACvE,2EAA2E;YAC3E,IAAI,SAAS,CAAC,GAAG,CAAC,IAAI,CAAC;gBAAE,SAAS;YAClC,IAAI,GAAG,QAAQ,CAAC,IAAI,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,cAAc,CAAC,IAAI,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC;YACxE,SAAS,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QACtB,CAAC;QACD,yEAAyE;QACzE,uEAAuE;QACvE,qEAAqE;QACrE,qEAAqE;QACrE,8CAA8C;QAC9C,MAAM,eAAe,GAAG,IAAI,GAAG,CAAC,eAAe,CAAC,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;QACnF,KAAK,MAAM,CAAC,IAAI,QAAQ,EAAE,CAAC;YACzB,IAAI,GAAG,QAAQ,CAAC,IAAI,EAAE;gBACpB,IAAI,EAAE,aAAa;gBACnB,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,IAAI;gBAClB,KAAK,EAAE,aAAa,CAAC,CAAC,CAAC,KAAK,EAAE,eAAe,CAAC,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;aACjE,CAAC,CAAC;QACL,CAAC;QACD,MAAM,OAAO,GAAG,mBAAmB,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC;QACrD,IAAI,CAAC,OAAO,CAAC,EAAE,EAAE,CAAC;YAChB,MAAM,IAAI,gBAAgB,CACxB,sEAAsE,sBAAsB,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,EAC9G,OAAO,CACR,CAAC;QACJ,CAAC;QACD,eAAe,CAAC,YAAY,EAAE,IAAI,CAAC,CAAC;IACtC,CAAC,CAAC,CAAC;IAEH,OAAO;QACL,YAAY;QACZ,YAAY;QACZ,UAAU,EAAE,KAAK,CAAC,MAAM,GAAG,QAAQ,CAAC,MAAM;QAC1C,cAAc,EAAE,KAAK,CAAC,MAAM;QAC5B,aAAa,EAAE,QAAQ,CAAC,MAAM;QAC9B,IAAI;QACJ,OAAO,EAAE,IAAI;QACb,YAAY;QACZ,eAAe;QACf,gBAAgB;QAChB,OAAO,EAAE,SAAS;QAClB,oBAAoB;QACpB,GAAG,CAAC,iBAAiB,KAAK,IAAI,CAAC,CAAC,CAAC,EAAE,iBAAiB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAC7D,CAAC;AACJ,CAAC;AAED,SAAS,aAAa,CACpB,CAAa,EACb,QAA+B;IAE/B,MAAM,KAAK,GAAgB;QACzB,IAAI,EAAE,CAAC,CAAC,IAAI;QACZ,OAAO,EAAE,CAAC,GAAG,CAAC,CAAC,OAAO,CAAC;KACxB,CAAC;IACF,IAAI,CAAC,CAAC,GAAG,IAAI,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,MAAM,GAAG,CAAC;QAAE,KAAK,CAAC,GAAG,GAAG,EAAE,GAAG,CAAC,CAAC,GAAG,EAAE,CAAC;IACrE,+DAA+D;IAC/D,uEAAuE;IACvE,kEAAkE;IAClE,uEAAuE;IACvE,mEAAmE;IACnE,gEAAgE;IAChE,4DAA4D;IAC5D,IAAI,QAAQ,EAAE,CAAC;QACb,IAAI,QAAQ,CAAC,MAAM;YAAE,KAAK,CAAC,MAAM,GAAG,EAAE,GAAG,QAAQ,CAAC,MAAM,EAAE,CAAC;QAC3D,IAAI,QAAQ,CAAC,OAAO,KAAK,KAAK;YAAE,KAAK,CAAC,OAAO,GAAG,KAAK,CAAC;QACtD,IAAI,QAAQ,CAAC,WAAW,KAAK,SAAS;YAAE,KAAK,CAAC,WAAW,GAAG,QAAQ,CAAC,WAAW,CAAC;QACjF,IAAI,QAAQ,CAAC,eAAe,KAAK,SAAS,EAAE,CAAC;YAC3C,KAAK,CAAC,eAAe,GAAG,CAAC,GAAG,QAAQ,CAAC,eAAe,CAAC,CAAC;QACxD,CAAC;IACH,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,cAAc,CACrB,IAAY,EACZ,CAAc;IASd,sEAAsE;IACtE,0EAA0E;IAC1E,uEAAuE;IACvE,iEAAiE;IACjE,uEAAuE;IACvE,oEAAoE;IACpE,yEAAyE;IACzE,iEAAiE;IACjE,uEAAuE;IACvE,yBAAyB;IACzB,MAAM,KAAK,GAOP;QACF,IAAI;QACJ,KAAK,EAAE,CAAC,CAAC,KAAK;QACd,OAAO,EAAE,CAAC,CAAC,OAAO;QAClB,QAAQ,EAAE,KAAK;KAChB,CAAC;IACF,IAAI,CAAC,CAAC,KAAK,KAAK,SAAS;QAAE,KAAK,CAAC,KAAK,GAAG,CAAC,CAAC,KAAK,CAAC;IACjD,IAAI,CAAC,CAAC,OAAO,KAAK,SAAS;QAAE,KAAK,CAAC,SAAS,GAAG,CAAC,CAAC,OAAO,GAAG,IAAI,CAAC;IAChE,OAAO,KAAK,CAAC;AACf,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/cli/adopt/index.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,MAAM,SAAS,CAAC;AAC9B,OAAO,KAAK,IAAI,MAAM,WAAW,CAAC;AAClC,OAAO,KAAK,QAAQ,MAAM,wBAAwB,CAAC;AACnD,OAAO,EAAE,KAAK,IAAI,SAAS,EAAE,MAAM,MAAM,CAAC;AAC1C,OAAO,EAAE,eAAe,EAAE,MAAM,0BAA0B,CAAC;AAC3D,OAAO,EAAE,cAAc,EAAE,MAAM,2BAA2B,CAAC;AAC3D,OAAO,EAAE,YAAY,EAAE,MAAM,kBAAkB,CAAC;AAChD,OAAO,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAChD,OAAO,EACL,sBAAsB,EACtB,mBAAmB,GACpB,MAAM,mCAAmC,CAAC;AAC3C,OAAO,EAAE,aAAa,EAAkB,MAAM,uBAAuB,CAAC;AACtE,OAAO,EAAE,QAAQ,EAAgC,MAAM,kBAAkB,CAAC;AAC1E,OAAO,EAAE,OAAO,EAAE,UAAU,EAAE,gBAAgB,EAAE,MAAM,kBAAkB,CAAC;AACzE,OAAO,EAAE,sBAAsB,EAAE,6BAA6B,EAAE,MAAM,wBAAwB,CAAC;AAC/F,OAAO,EACL,YAAY,EACZ,eAAe,EACf,qBAAqB,EACrB,kBAAkB,EAClB,kBAAkB,EAClB,uBAAuB,EACvB,yBAAyB,EACzB,cAAc,GAGf,MAAM,aAAa,CAAC;AAoErB,MAAM,gBAAgB,GAAG,cAAc,CAAC;AACxC,MAAM,aAAa,GAAG,eAAe,CAAC;AAEtC,SAAS,mBAAmB,CAAC,IAAkB;IAC7C,IAAI,IAAI,CAAC,UAAU;QAAE,OAAO,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;IAC1D,OAAO,IAAI,CAAC,IAAI,CACd,cAAc,CAAC,EAAE,GAAG,CAAC,IAAI,CAAC,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,IAAI,EACzF,gBAAgB,CACjB,CAAC;AACJ,CAAC;AAED,iEAAiE;AACjE,qEAAqE;AACrE,8CAA8C;AAC9C,KAAK,UAAU,aAAa,CAAC,OAAe;IAC1C,MAAM,EAAE,GAAG,QAAQ,CAAC,eAAe,CAAC,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC;IACtF,IAAI,CAAC;QACH,OAAO,MAAM,EAAE,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;IACpC,CAAC;YAAS,CAAC;QACT,EAAE,CAAC,KAAK,EAAE,CAAC;IACb,CAAC;AACH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,KAAK,CACzB,YAAoB,EACpB,OAAqB,EAAE;IAEvB,MAAM,YAAY,GAAG,mBAAmB,CAAC,IAAI,CAAC,CAAC;IAC/C,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,YAAY,CAAC,EAAE,CAAC;QACjC,MAAM,IAAI,gBAAgB,CACxB,iCAAiC,YAAY,8BAA8B,EAC3E,UAAU,CACX,CAAC;IACJ,CAAC;IACD,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,YAAY,CAAC,EAAE,CAAC;QACjC,MAAM,IAAI,gBAAgB,CACxB,sCAAsC,YAAY,EAAE,EACpD,UAAU,CACX,CAAC;IACJ,CAAC;IAED,MAAM,YAAY,GAAG,EAAE,CAAC,YAAY,CAAC,YAAY,EAAE,MAAM,CAAC,CAAC;IAC3D,MAAM,QAAQ,GAAG,aAAa,CAAC,SAAS,CAAC,YAAY,CAAC,CAAC,CAAC;IACxD,MAAM,UAAU,GAAG,kBAAkB,CAAC,QAAQ,CAAC,CAAC;IAEhD,IAAI,WAAoB,CAAC;IACzB,IAAI,CAAC;QACH,WAAW,GAAG,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,YAAY,CAAC,YAAY,EAAE,MAAM,CAAC,CAAC,CAAC;IAClE,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,MAAM,IAAI,gBAAgB,CACxB,iBAAiB,YAAY,uBAAwB,CAAW,CAAC,OAAO,EAAE,EAC1E,OAAO,CACR,CAAC;IACJ,CAAC;IAED,MAAM,aAAa,GAAG,kBAAkB,CAAC,WAAW,CAAC,CAAC;IACtD,MAAM,KAAK,GAAG,YAAY,CAAC,aAAa,EAAE,UAAU,CAAC,CAAC;IAEtD,wEAAwE;IACxE,2DAA2D;IAC3D,mEAAmE;IACnE,gEAAgE;IAChE,uEAAuE;IACvE,wEAAwE;IACxE,4EAA4E;IAC5E,gDAAgD;IAChD,MAAM,oBAAoB,GAAG,uBAAuB,CAAC,WAAW,CAAC;SAC9D,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;SAClB,IAAI,EAAE,CAAC;IAEV,MAAM,YAAY,GAAG,IAAI,CAAC,YAAY,IAAI,6BAA6B,CAAC,EAAE,GAAG,EAAE,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC;IAC3F,MAAM,EAAE,OAAO,EAAE,eAAe,EAAE,KAAK,EAAE,iBAAiB,EAAE,GAC1D,sBAAsB,CAAC,YAAY,CAAC,CAAC;IACvC,MAAM,WAAW,GAAG,yBAAyB,CAAC,eAAe,CAAC,CAAC;IAC/D,MAAM,aAAa,GAAG,qBAAqB,CAAC,QAAQ,CAAC,CAAC;IACtD,MAAM,QAAQ,GAAG,eAAe,CAAC,WAAW,EAAE,aAAa,CAAC,CAAC;IAE7D,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAChD,OAAO;YACL,YAAY;YACZ,YAAY;YACZ,UAAU,EAAE,CAAC;YACb,cAAc,EAAE,CAAC;YACjB,aAAa,EAAE,CAAC;YAChB,IAAI,EAAE,EAAE;YACR,OAAO,EAAE,KAAK;YACd,YAAY,EAAE,EAAE;YAChB,eAAe,EAAE,EAAE;YACnB,gBAAgB,EAAE,EAAE;YACpB,OAAO,EAAE,UAAU;YACnB,oBAAoB;YACpB,GAAG,CAAC,iBAAiB,KAAK,IAAI,CAAC,CAAC,CAAC,EAAE,iBAAiB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAC7D,CAAC;IACJ,CAAC;IAED,MAAM,KAAK,GAAG,IAAI,GAAG,CAAC,QAAQ,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC;IACzD,MAAM,YAAY,GAAa,EAAE,CAAC;IAClC,IAAI,YAAY,GAAG,YAAY,CAAC;IAChC,KAAK,MAAM,CAAC,IAAI,KAAK,EAAE,CAAC;QACtB,MAAM,IAAI,GAAG,cAAc,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC;QACtC,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QAChB,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACxB,YAAY,GAAG,QAAQ,CAAC,YAAY,EAAE;YACpC,IAAI,EAAE,MAAM;YACZ,KAAK,EAAE,cAAc,CAAC,IAAI,EAAE,CAAC,CAAC;SAC/B,CAAC,CAAC;IACL,CAAC;IAED,MAAM,eAAe,GAAa,EAAE,CAAC;IACrC,MAAM,gBAAgB,GAAa,EAAE,CAAC;IACtC,mEAAmE;IACnE,kEAAkE;IAClE,sCAAsC;IACtC,MAAM,cAAc,GAAG,IAAI,GAAG,CAAC,QAAQ,CAAC,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;IAC3E,KAAK,MAAM,CAAC,IAAI,QAAQ,EAAE,CAAC;QACzB,IAAI,CAAC,CAAC,MAAM,KAAK,UAAU;YAAE,gBAAgB,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QACjE,eAAe,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QACnC,YAAY,GAAG,QAAQ,CAAC,YAAY,EAAE;YACpC,IAAI,EAAE,aAAa;YACnB,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,IAAI;YAClB,KAAK,EAAE,aAAa,CAAC,CAAC,CAAC,KAAK,EAAE,cAAc,CAAC,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;SAChE,CAAC,CAAC;IACL,CAAC;IAED,MAAM,IAAI,GAAG,WAAW,CAAC;QACvB,QAAQ,EAAE,IAAI,CAAC,QAAQ,CAAC,YAAY,CAAC;QACrC,OAAO,EAAE,YAAY;QACrB,OAAO,EAAE,YAAY;QACrB,SAAS,EAAE,SAAS;QACpB,SAAS,EAAE,UAAU;KACtB,CAAC,CAAC;IAEH,+EAA+E;IAC/E,qEAAqE;IACrE,4EAA4E;IAC5E,4EAA4E;IAC5E,6EAA6E;IAC7E,MAAM,UAAU,GAAG,mBAAmB,CAAC,SAAS,CAAC,YAAY,CAAC,CAAC,CAAC;IAChE,IAAI,CAAC,UAAU,CAAC,EAAE,EAAE,CAAC;QACnB,MAAM,IAAI,gBAAgB,CACxB,+CAA+C,sBAAsB,CAAC,UAAU,CAAC,MAAM,CAAC,EAAE,EAC1F,OAAO,CACR,CAAC;IACJ,CAAC;IAED,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC;QACd,oEAAoE;QACpE,mEAAmE;QACnE,mEAAmE;QACnE,qCAAqC;QACrC,IAAI,IAAI,CAAC,MAAM,KAAK,SAAS,IAAI,CAAC,CAAC,IAAI,CAAC,UAAU,IAAI,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,EAAE,CAAC;YAC3E,MAAM,IAAI,gBAAgB,CACxB,8FAA8F,EAC9F,OAAO,CACR,CAAC;QACJ,CAAC;QACD,MAAM,QAAQ,GAAG,IAAI,CAAC,MAAM,IAAI,aAAa,CAAC;QAC9C,MAAM,MAAM,GAAG,CAAC,MAAM,QAAQ,CAAC,GAAG,IAAI,iBAAiB,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;QAC/E,IAAI,MAAM,KAAK,GAAG,IAAI,MAAM,KAAK,KAAK,EAAE,CAAC;YACvC,OAAO;gBACL,YAAY;gBACZ,YAAY;gBACZ,UAAU,EAAE,KAAK,CAAC,MAAM,GAAG,QAAQ,CAAC,MAAM;gBAC1C,cAAc,EAAE,KAAK,CAAC,MAAM;gBAC5B,aAAa,EAAE,QAAQ,CAAC,MAAM;gBAC9B,IAAI;gBACJ,OAAO,EAAE,KAAK;gBACd,YAAY;gBACZ,eAAe;gBACf,gBAAgB;gBAChB,OAAO,EAAE,UAAU;gBACnB,oBAAoB;gBACpB,GAAG,CAAC,iBAAiB,KAAK,IAAI,CAAC,CAAC,CAAC,EAAE,iBAAiB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aAC7D,CAAC;QACJ,CAAC;IACH,CAAC;IAED,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,YAAY,CAAC,EAAE,aAAa,CAAC,CAAC;IACtE,MAAM,YAAY,CAAC,QAAQ,EAAE,GAAG,EAAE;QAChC,MAAM,OAAO,GAAG,EAAE,CAAC,YAAY,CAAC,YAAY,EAAE,MAAM,CAAC,CAAC;QACtD,IAAI,IAAI,GAAG,OAAO,CAAC;QACnB,MAAM,eAAe,GAAG,aAAa,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC,CAAC;QAC1D,MAAM,SAAS,GAAG,IAAI,GAAG,CAAC,eAAe,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC;QACpE,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;YACtC,MAAM,CAAC,GAAG,KAAK,CAAC,CAAC,CAAE,CAAC;YACpB,MAAM,IAAI,GAAG,YAAY,CAAC,CAAC,CAAE,CAAC;YAC9B,yEAAyE;YACzE,iEAAiE;YACjE,kEAAkE;YAClE,yEAAyE;YACzE,wEAAwE;YACxE,wEAAwE;YACxE,uEAAuE;YACvE,2EAA2E;YAC3E,IAAI,SAAS,CAAC,GAAG,CAAC,IAAI,CAAC;gBAAE,SAAS;YAClC,IAAI,GAAG,QAAQ,CAAC,IAAI,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,cAAc,CAAC,IAAI,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC;YACxE,SAAS,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QACtB,CAAC;QACD,yEAAyE;QACzE,uEAAuE;QACvE,qEAAqE;QACrE,qEAAqE;QACrE,8CAA8C;QAC9C,MAAM,eAAe,GAAG,IAAI,GAAG,CAAC,eAAe,CAAC,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;QACnF,KAAK,MAAM,CAAC,IAAI,QAAQ,EAAE,CAAC;YACzB,IAAI,GAAG,QAAQ,CAAC,IAAI,EAAE;gBACpB,IAAI,EAAE,aAAa;gBACnB,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,IAAI;gBAClB,KAAK,EAAE,aAAa,CAAC,CAAC,CAAC,KAAK,EAAE,eAAe,CAAC,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;aACjE,CAAC,CAAC;QACL,CAAC;QACD,MAAM,OAAO,GAAG,mBAAmB,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC;QACrD,IAAI,CAAC,OAAO,CAAC,EAAE,EAAE,CAAC;YAChB,MAAM,IAAI,gBAAgB,CACxB,sEAAsE,sBAAsB,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,EAC9G,OAAO,CACR,CAAC;QACJ,CAAC;QACD,eAAe,CAAC,YAAY,EAAE,IAAI,CAAC,CAAC;IACtC,CAAC,CAAC,CAAC;IAEH,OAAO;QACL,YAAY;QACZ,YAAY;QACZ,UAAU,EAAE,KAAK,CAAC,MAAM,GAAG,QAAQ,CAAC,MAAM;QAC1C,cAAc,EAAE,KAAK,CAAC,MAAM;QAC5B,aAAa,EAAE,QAAQ,CAAC,MAAM;QAC9B,IAAI;QACJ,OAAO,EAAE,IAAI;QACb,YAAY;QACZ,eAAe;QACf,gBAAgB;QAChB,OAAO,EAAE,SAAS;QAClB,oBAAoB;QACpB,GAAG,CAAC,iBAAiB,KAAK,IAAI,CAAC,CAAC,CAAC,EAAE,iBAAiB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAC7D,CAAC;AACJ,CAAC;AAED,SAAS,aAAa,CACpB,CAAa,EACb,QAA+B;IAE/B,MAAM,KAAK,GAAgB;QACzB,IAAI,EAAE,CAAC,CAAC,IAAI;QACZ,OAAO,EAAE,CAAC,GAAG,CAAC,CAAC,OAAO,CAAC;KACxB,CAAC;IACF,IAAI,CAAC,CAAC,GAAG,IAAI,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,MAAM,GAAG,CAAC;QAAE,KAAK,CAAC,GAAG,GAAG,EAAE,GAAG,CAAC,CAAC,GAAG,EAAE,CAAC;IACrE,+DAA+D;IAC/D,uEAAuE;IACvE,kEAAkE;IAClE,uEAAuE;IACvE,mEAAmE;IACnE,gEAAgE;IAChE,4DAA4D;IAC5D,IAAI,QAAQ,EAAE,CAAC;QACb,IAAI,QAAQ,CAAC,MAAM;YAAE,KAAK,CAAC,MAAM,GAAG,EAAE,GAAG,QAAQ,CAAC,MAAM,EAAE,CAAC;QAC3D,IAAI,QAAQ,CAAC,OAAO,KAAK,KAAK;YAAE,KAAK,CAAC,OAAO,GAAG,KAAK,CAAC;QACtD,IAAI,QAAQ,CAAC,WAAW,KAAK,SAAS;YAAE,KAAK,CAAC,WAAW,GAAG,QAAQ,CAAC,WAAW,CAAC;QACjF,IAAI,QAAQ,CAAC,eAAe,KAAK,SAAS,EAAE,CAAC;YAC3C,KAAK,CAAC,eAAe,GAAG,CAAC,GAAG,QAAQ,CAAC,eAAe,CAAC,CAAC;QACxD,CAAC;IACH,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,cAAc,CACrB,IAAY,EACZ,CAAc;IASd,sEAAsE;IACtE,0EAA0E;IAC1E,uEAAuE;IACvE,iEAAiE;IACjE,uEAAuE;IACvE,oEAAoE;IACpE,yEAAyE;IACzE,iEAAiE;IACjE,uEAAuE;IACvE,yBAAyB;IACzB,MAAM,KAAK,GAOP;QACF,IAAI;QACJ,KAAK,EAAE,CAAC,CAAC,KAAK;QACd,OAAO,EAAE,CAAC,CAAC,OAAO;QAClB,QAAQ,EAAE,KAAK;KAChB,CAAC;IACF,IAAI,CAAC,CAAC,KAAK,KAAK,SAAS;QAAE,KAAK,CAAC,KAAK,GAAG,CAAC,CAAC,KAAK,CAAC;IACjD,IAAI,CAAC,CAAC,OAAO,KAAK,SAAS;QAAE,KAAK,CAAC,SAAS,GAAG,CAAC,CAAC,OAAO,GAAG,IAAI,CAAC;IAChE,OAAO,KAAK,CAAC;AACf,CAAC"}