@momentiq/dark-factory-cli 2.18.0 → 3.0.0

package/dist/mode/context.js

@@ -0,0 +1,127 @@
+// Cycle 27 Phase B — `df mode context --hook`: build the SessionStart
+// additionalContext for an operator-mode session. Persona (baseline tier,
+// shipped as a dist asset with the DF-PROFILE sentinel) + live mode summary
+// + the repo's DESIGN.md as design doctrine.
+import { readFileSync, realpathSync, statSync } from "node:fs";
+import { dirname, isAbsolute, relative, resolve, sep } from "node:path";
+import { fileURLToPath } from "node:url";
+const HERE = dirname(fileURLToPath(import.meta.url));
+/**
+ * Load the baseline persona asset. Lives alongside this module in both src
+ * (tests) and dist (runtime — the build's copy-assets step ships it), so an
+ * import.meta.url-relative read works in both.
+ */
+export function loadBaselinePersona() {
+    return readFileSync(resolve(HERE, "prompts", "designer-baseline.md"), "utf8");
+}
+const STRICT_REL_PATH = /^[A-Za-z0-9._\/-]+$/;
+/**
+ * The strict repo-relative path predicate used for the DISPLAY path only —
+ * pure lexical, no filesystem access. `buildModeContext` echoes the configured
+ * `designMd` into the LLM-consumed SessionStart note, so it gates on this and
+ * shows a neutral placeholder for anything that is not a genuine strict
+ * repo-relative path. True only for a non-empty, length-bounded value built
+ * from safe path characters (letters, digits, `.` `_` `-` `/`) that is NOT
+ * absolute and contains NO empty/current/parent (`.`/`..`) segments. The
+ * character grammar keeps the value free of spaces, newlines, backticks, and
+ * markdown metacharacters, so a hostile catalog value cannot express multi-word
+ * instructions or open a new markdown block in the injected context.
+ *
+ * This is deliberately STRICTER than what `safeDesignMdPath` accepts for reads:
+ * read-safety asks "is this a real file inside the repo?" (spaces are fine);
+ * display-safety asks "is this safe to echo into model context?" (they are not).
+ * Keeping them separate avoids narrowing the public `designSystem.designMd`
+ * string contract while still hardening the injected note.
+ */
+export function isStrictRepoRelativePath(p) {
+    if (p.length === 0 || p.length > 200)
+        return false;
+    if (!STRICT_REL_PATH.test(p))
+        return false;
+    if (isAbsolute(p))
+        return false;
+    for (const segment of p.split("/")) {
+        if (segment === "" || segment === "." || segment === "..")
+            return false;
+    }
+    return true;
+}
+/**
+ * Resolve the catalog's `designSystem.designMd` value safely: it is a
+ * REPO-RELATIVE path by contract, and this hook injects the file's contents
+ * into session context — so the check must hold against the REAL filesystem,
+ * not just lexically. Returns the resolved path only when:
+ *   - the value is relative and its lexical resolution stays under repoRoot,
+ *   - the file exists and is a regular file, and
+ *   - its realpath (symlinks followed) still lives under the repo's realpath
+ *     (a repo-local DESIGN.md symlinked to ~/.ssh/id_rsa returns null).
+ * A missing file also returns null — "unseeded" is a normal state the
+ * caller narrates; it must never be distinguishable from "blocked" in ways
+ * that leak what exists outside the repo.
+ *
+ * This accepts ANY real repo-relative file (paths with spaces included): it
+ * enforces filesystem safety, NOT the stricter display grammar, so it does not
+ * narrow the public `designSystem.designMd` string contract.
+ */
+export function safeDesignMdPath(repoRoot, designMd) {
+    if (isAbsolute(designMd))
+        return null;
+    const resolved = resolve(repoRoot, designMd);
+    const rel = relative(repoRoot, resolved);
+    // Reject only TRUE parent-traversal: the bare `..`, or a path whose first
+    // segment is `..` (`../x`). `rel.startsWith("..")` alone would also reject a
+    // legitimate repo-local path whose first segment merely BEGINS with `..`
+    // (e.g. `..docs/DESIGN.md`), so key on the separator — matching the realpath
+    // check below.
+    if (rel === "" || rel === ".." || rel.startsWith(`..${sep}`))
+        return null;
+    try {
+        if (!statSync(resolved).isFile())
+            return null;
+        const realTarget = realpathSync(resolved);
+        const realRoot = realpathSync(repoRoot);
+        const realRel = relative(realRoot, realTarget);
+        if (realRel === "" || realRel === ".." || realRel.startsWith(`..${sep}`))
+            return null;
+        return resolved;
+    }
+    catch {
+        return null; // missing, unreadable, or unresolvable — treat as unseeded
+    }
+}
+export function buildModeContext(resolved, designMdContent) {
+    const { modeName, mode } = resolved;
+    const persona = loadBaselinePersona();
+    const summary = [
+        `## Active operator mode: ${modeName}`,
+        "",
+        `- Editable areas (writeScopes): ${(mode.writeScopes ?? []).join(", ") || "(none configured)"}`,
+        `- Protected areas (always off-limits, they win on overlap): ${(mode.protectedPaths ?? []).join(", ") || "(none)"}`,
+        `- Dependency policy: ${mode.dependencyPolicy ?? "(unset)"} — dependency changes ${mode.dependencyPolicy === "none" ? "always escalate via handoff" : "may escalate"}`,
+        mode.devServer?.command
+            ? `- Dev server for visual verification: \`${mode.devServer.command}\`${mode.devServer.url ? ` → ${mode.devServer.url}` : ""}`
+            : `- Dev server: not configured — ask an engineer to set modes.${modeName}.devServer before visual work`,
+        `- Visual evidence: ${mode.evidence?.visual ?? "(unset)"}`,
+    ].join("\n");
+    // designSystem.designMd is a repo-relative path that may be nested (not
+    // necessarily the repo root), so the "unseeded" note names the configured
+    // location rather than hardcoding "the repo root". This value is echoed into
+    // the LLM-consumed SessionStart context, where markdown fencing is NOT a
+    // prompt-injection boundary — so echo it only when it is a strict
+    // repo-relative path (isStrictRepoRelativePath); anything else (absolute,
+    // `.`/`..` traversal, or containing spaces/newlines/markdown metachars) is
+    // shown as a neutral placeholder rather than echoed, so it can neither leak a
+    // non-repo-relative path nor inject text. This display gate is intentionally
+    // stricter than the read resolver, which accepts any real repo-relative file.
+    const rawDesignMd = mode.designSystem?.designMd ?? "DESIGN.md";
+    const designMdRel = isStrictRepoRelativePath(rawDesignMd)
+        ? rawDesignMd
+        : "(configured path omitted: unsafe characters)";
+    const designDoc = designMdContent
+        ? `## DESIGN.md (design source of truth)\n\n${designMdContent}`
+        : `## DESIGN.md\n\nNo DESIGN.md was found at \`${designMdRel}\` — it has not been seeded yet. ` +
+            `Follow the repo's existing visual patterns strictly, and suggest running ` +
+            `\`df onboard\` to an engineer so design doctrine gets a home.`;
+    return [persona, summary, designDoc].join("\n\n---\n\n");
+}
+//# sourceMappingURL=context.js.map

package/dist/mode/context.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"context.js","sourceRoot":"","sources":["../../src/mode/context.ts"],"names":[],"mappings":"AAAA,sEAAsE;AACtE,0EAA0E;AAC1E,4EAA4E;AAC5E,6CAA6C;AAE7C,OAAO,EAAE,YAAY,EAAE,YAAY,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AAC/D,OAAO,EAAE,OAAO,EAAE,UAAU,EAAE,QAAQ,EAAE,OAAO,EAAE,GAAG,EAAE,MAAM,WAAW,CAAC;AACxE,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AAIzC,MAAM,IAAI,GAAG,OAAO,CAAC,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;AAErD;;;;GAIG;AACH,MAAM,UAAU,mBAAmB;IACjC,OAAO,YAAY,CAAC,OAAO,CAAC,IAAI,EAAE,SAAS,EAAE,sBAAsB,CAAC,EAAE,MAAM,CAAC,CAAC;AAChF,CAAC;AAOD,MAAM,eAAe,GAAG,qBAAqB,CAAC;AAE9C;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,UAAU,wBAAwB,CAAC,CAAS;IAChD,IAAI,CAAC,CAAC,MAAM,KAAK,CAAC,IAAI,CAAC,CAAC,MAAM,GAAG,GAAG;QAAE,OAAO,KAAK,CAAC;IACnD,IAAI,CAAC,eAAe,CAAC,IAAI,CAAC,CAAC,CAAC;QAAE,OAAO,KAAK,CAAC;IAC3C,IAAI,UAAU,CAAC,CAAC,CAAC;QAAE,OAAO,KAAK,CAAC;IAChC,KAAK,MAAM,OAAO,IAAI,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC;QACnC,IAAI,OAAO,KAAK,EAAE,IAAI,OAAO,KAAK,GAAG,IAAI,OAAO,KAAK,IAAI;YAAE,OAAO,KAAK,CAAC;IAC1E,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,UAAU,gBAAgB,CAAC,QAAgB,EAAE,QAAgB;IACjE,IAAI,UAAU,CAAC,QAAQ,CAAC;QAAE,OAAO,IAAI,CAAC;IACtC,MAAM,QAAQ,GAAG,OAAO,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC;IAC7C,MAAM,GAAG,GAAG,QAAQ,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC;IACzC,0EAA0E;IAC1E,6EAA6E;IAC7E,yEAAyE;IACzE,6EAA6E;IAC7E,eAAe;IACf,IAAI,GAAG,KAAK,EAAE,IAAI,GAAG,KAAK,IAAI,IAAI,GAAG,CAAC,UAAU,CAAC,KAAK,GAAG,EAAE,CAAC;QAAE,OAAO,IAAI,CAAC;IAC1E,IAAI,CAAC;QACH,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,MAAM,EAAE;YAAE,OAAO,IAAI,CAAC;QAC9C,MAAM,UAAU,GAAG,YAAY,CAAC,QAAQ,CAAC,CAAC;QAC1C,MAAM,QAAQ,GAAG,YAAY,CAAC,QAAQ,CAAC,CAAC;QACxC,MAAM,OAAO,GAAG,QAAQ,CAAC,QAAQ,EAAE,UAAU,CAAC,CAAC;QAC/C,IAAI,OAAO,KAAK,EAAE,IAAI,OAAO,KAAK,IAAI,IAAI,OAAO,CAAC,UAAU,CAAC,KAAK,GAAG,EAAE,CAAC;YAAE,OAAO,IAAI,CAAC;QACtF,OAAO,QAAQ,CAAC;IAClB,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC,CAAC,2DAA2D;IAC1E,CAAC;AACH,CAAC;AAED,MAAM,UAAU,gBAAgB,CAC9B,QAA0B,EAC1B,eAAmC;IAEnC,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,GAAG,QAAQ,CAAC;IACpC,MAAM,OAAO,GAAG,mBAAmB,EAAE,CAAC;IAEtC,MAAM,OAAO,GAAG;QACd,4BAA4B,QAAQ,EAAE;QACtC,EAAE;QACF,mCAAmC,CAAC,IAAI,CAAC,WAAW,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,mBAAmB,EAAE;QAC/F,+DAA+D,CAAC,IAAI,CAAC,cAAc,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,QAAQ,EAAE;QACnH,wBAAwB,IAAI,CAAC,gBAAgB,IAAI,SAAS,yBAAyB,IAAI,CAAC,gBAAgB,KAAK,MAAM,CAAC,CAAC,CAAC,6BAA6B,CAAC,CAAC,CAAC,cAAc,EAAE;QACtK,IAAI,CAAC,SAAS,EAAE,OAAO;YACrB,CAAC,CAAC,2CAA2C,IAAI,CAAC,SAAS,CAAC,OAAO,KAAK,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,IAAI,CAAC,SAAS,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE;YAC9H,CAAC,CAAC,+DAA+D,QAAQ,+BAA+B;QAC1G,sBAAsB,IAAI,CAAC,QAAQ,EAAE,MAAM,IAAI,SAAS,EAAE;KAC3D,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAEb,wEAAwE;IACxE,0EAA0E;IAC1E,6EAA6E;IAC7E,yEAAyE;IACzE,kEAAkE;IAClE,0EAA0E;IAC1E,2EAA2E;IAC3E,8EAA8E;IAC9E,6EAA6E;IAC7E,8EAA8E;IAC9E,MAAM,WAAW,GAAG,IAAI,CAAC,YAAY,EAAE,QAAQ,IAAI,WAAW,CAAC;IAC/D,MAAM,WAAW,GAAG,wBAAwB,CAAC,WAAW,CAAC;QACvD,CAAC,CAAC,WAAW;QACb,CAAC,CAAC,8CAA8C,CAAC;IACnD,MAAM,SAAS,GAAG,eAAe;QAC/B,CAAC,CAAC,4CAA4C,eAAe,EAAE;QAC/D,CAAC,CAAC,+CAA+C,WAAW,mCAAmC;YAC7F,2EAA2E;YAC3E,+DAA+D,CAAC;IAEpE,OAAO,CAAC,OAAO,EAAE,OAAO,EAAE,SAAS,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC;AAC3D,CAAC"}

package/dist/mode/critic-registration.d.ts

@@ -0,0 +1,66 @@
+/** The critic id used for the ModeScope critic in `.agent-review/config.json`. */
+export declare const MODE_SCOPE_CRITIC_ID = "mode-scope-critic";
+export interface ModeScopeRegistrationResult {
+    /** Whether the config was modified (false = already registered / idempotent). */
+    changed: boolean;
+    /** Human-readable descriptions of each mutation, for `df mode init` output. */
+    changes: string[];
+}
+/**
+ * The critic entry appended to `critics[]`. Deterministic critic: no auth,
+ * no vendor SDK. `required: true` — the scope critic is a HARD GATE, so its
+ * blockers must block under EVERY aggregation policy. Under `block-if-any`
+ * the gate demotes `required: false` critics' findings to warnings (report.ts
+ * / gate.ts key on `config.critics.filter(c => c.required)`), so a
+ * `required: false` scope critic would NOT block an out-of-scope `Mode:` PR
+ * there. `required: true` is also safe under `min-complete-quorum`: that path
+ * (`quorumAggregateVerdict`) never consults the `required` flag, and because
+ * the adapter ALWAYS completes it never trips the "required critic errored →
+ * block" rule — so it only ever adds the veto its blocker already carries, and
+ * the per-path quorum bumps below stay exact. `runtime: "local"` is metadata —
+ * the same deterministic entry is referenced by both the local and cloud
+ * profiles (mirrors how `cursor-*` is shared across profiles).
+ */
+export declare function buildModeScopeCriticEntry(): Record<string, unknown>;
+/**
+ * Register the ModeScope critic into a raw parsed `.agent-review/config.json`
+ * object. Mutates `raw` in place AND returns a change report. The caller
+ * validates the mutated object through `parseAgentReviewConfig` before
+ * persisting it.
+ *
+ * "Present" is NOT "safe". A pre-existing mode-scope entry can itself be
+ * UNSAFE — an older CLI (or a hand edit) may have added it `required: false`
+ * (its blockers are demoted to warnings under block-if-any) or left it out of a
+ * profile (it does not run at all under profile-filtered runs). So rather than
+ * no-op the instant an entry is present, we CONVERGE it to the required shape:
+ * promote `required: true`, repair a missing id, and ensure the id is in every
+ * profile. Only a FULLY compliant entry is a true no-op (`changed: false`).
+ *
+ * Quorum is preserved EXACTLY ONCE per scope, keyed on the absent→present
+ * transition (`bumpRootQuorum` for the root fleet, `ensureCriticInEveryProfile`
+ * per profile), so a converge re-run never double-counts.
+ */
+export declare function registerModeScopeCritic(raw: unknown): ModeScopeRegistrationResult;
+export interface CriticRegistrationOutcome {
+    /** Resolved path to `.agent-review/config.json`. */
+    configPath: string;
+    status: "registered" | "already-registered" | "absent" | "error";
+    /** Change descriptions when status === "registered". */
+    changes: string[];
+    /** Present when status === "error". */
+    error?: string;
+}
+/**
+ * Register the ModeScope critic into `<repoRoot>/.agent-review/config.json`.
+ *
+ *  - `absent`: no config.json — the consumer hasn't run `df onboard`. Skipped
+ *    (not an error): the catalog seed still stands and re-running init after
+ *    onboarding completes registration.
+ *  - `already-registered`: the critic is already present — idempotent no-op.
+ *  - `registered`: patched + written.
+ *  - `error`: the config is malformed OR the patched config fails canonical
+ *    validation. The on-disk file is left UNTOUCHED (fail-closed); the error
+ *    is reported, not thrown, so `df mode init` degrades gracefully.
+ */
+export declare function applyModeScopeCriticRegistration(repoRoot: string): CriticRegistrationOutcome;
+//# sourceMappingURL=critic-registration.d.ts.map

package/dist/mode/critic-registration.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"critic-registration.d.ts","sourceRoot":"","sources":["../../src/mode/critic-registration.ts"],"names":[],"mappings":"AAwCA,kFAAkF;AAClF,eAAO,MAAM,oBAAoB,sBAAsB,CAAC;AAExD,MAAM,WAAW,2BAA2B;IAC1C,iFAAiF;IACjF,OAAO,EAAE,OAAO,CAAC;IACjB,+EAA+E;IAC/E,OAAO,EAAE,MAAM,EAAE,CAAC;CACnB;AAMD;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,yBAAyB,IAAI,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CASnE;AAqED;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAgB,uBAAuB,CAAC,GAAG,EAAE,OAAO,GAAG,2BAA2B,CA4FjF;AAKD,MAAM,WAAW,yBAAyB;IACxC,oDAAoD;IACpD,UAAU,EAAE,MAAM,CAAC;IACnB,MAAM,EAAE,YAAY,GAAG,oBAAoB,GAAG,QAAQ,GAAG,OAAO,CAAC;IACjE,wDAAwD;IACxD,OAAO,EAAE,MAAM,EAAE,CAAC;IAClB,uCAAuC;IACvC,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,gCAAgC,CAAC,QAAQ,EAAE,MAAM,GAAG,yBAAyB,CA4C5F"}

package/dist/mode/critic-registration.js

@@ -0,0 +1,279 @@
+// Cycle 27 Phase C — register the deterministic ModeScope critic into a
+// consumer's `.agent-review/config.json`.
+//
+// `df mode init` calls this after seeding the `modes` catalog so the scope
+// critic RUNS in local `df review` / `df gate-push` AND in CI `agent-critic`
+// (inside the existing required check — no consumer ruleset/workflow
+// changes). The mirror of static-schema-lint's posture: the adapter ships
+// available-but-off in `ADAPTER_LOADERS`; a config reference is what turns
+// it on for a repo.
+//
+// QUORUM SAFETY (the subtle part). The scope critic is a deterministic,
+// veto-only critic that ALWAYS completes. Under `min-complete-quorum`, the
+// gate needs `quorum` critics to COMPLETE. Naively appending an
+// always-completing critic to the fleet WITHOUT touching quorum would let
+// it substitute for an LLM completion — silently LOWERING the number of LLM
+// chief-engineers that must complete. `df critic` aggregates on TWO paths
+// and the scope critic (added to `critics[]`) runs on BOTH, so BOTH quorums
+// are bumped by exactly 1:
+//   - the root `aggregation.quorum`, which governs the PROFILE-LESS run the
+//     reusable workflow's CONSUMER path uses (`df critic` with no
+//     `AGENT_REVIEW_PROFILE` → `resolveCriticProfile` → undefined → whole
+//     `critics[]` fleet under the root aggregation); AND
+//   - every `profile.quorum`, for EXPLICIT-profile runs like dark-factory's
+//     own `AGENT_REVIEW_PROFILE=cloud` CI (filters to `profile.criticIds`).
+// The bumps are independent — a single run uses exactly one aggregation
+// config (root OR one profile) — so they never double-count. The engineer
+// reviewing the init PR sees each bump reported in `df mode init`'s output.
+//
+// Operates on the RAW parsed JSON (not the normalized AgentReviewConfig) so
+// consumer customizations are preserved byte-for-byte except the fields we
+// touch. The caller re-validates the mutated object through
+// `parseAgentReviewConfig` (fail-closed) before writing.
+import { existsSync, readFileSync, writeFileSync } from "node:fs";
+import { join } from "node:path";
+import { parseAgentReviewConfig } from "@momentiq/dark-factory-schemas";
+import { MODE_SCOPE_ADAPTER_ID } from "../adapters/mode-scope.js";
+/** The critic id used for the ModeScope critic in `.agent-review/config.json`. */
+export const MODE_SCOPE_CRITIC_ID = "mode-scope-critic";
+function isRecord(v) {
+    return typeof v === "object" && v !== null && !Array.isArray(v);
+}
+/**
+ * The critic entry appended to `critics[]`. Deterministic critic: no auth,
+ * no vendor SDK. `required: true` — the scope critic is a HARD GATE, so its
+ * blockers must block under EVERY aggregation policy. Under `block-if-any`
+ * the gate demotes `required: false` critics' findings to warnings (report.ts
+ * / gate.ts key on `config.critics.filter(c => c.required)`), so a
+ * `required: false` scope critic would NOT block an out-of-scope `Mode:` PR
+ * there. `required: true` is also safe under `min-complete-quorum`: that path
+ * (`quorumAggregateVerdict`) never consults the `required` flag, and because
+ * the adapter ALWAYS completes it never trips the "required critic errored →
+ * block" rule — so it only ever adds the veto its blocker already carries, and
+ * the per-path quorum bumps below stay exact. `runtime: "local"` is metadata —
+ * the same deterministic entry is referenced by both the local and cloud
+ * profiles (mirrors how `cursor-*` is shared across profiles).
+ */
+export function buildModeScopeCriticEntry() {
+    return {
+        id: MODE_SCOPE_CRITIC_ID,
+        name: "Mode Scope Critic — deterministic operator-mode scope enforcement",
+        adapter: MODE_SCOPE_ADAPTER_ID,
+        required: true,
+        runtime: "local",
+        model: { id: "deterministic", params: [] },
+    };
+}
+/**
+ * Bump the ROOT `aggregation.quorum` by 1 (min-complete-quorum only). Governs
+ * the PROFILE-LESS run: the reusable workflow's consumer path invokes
+ * `df critic` with no `AGENT_REVIEW_PROFILE`, so the whole `critics[]` fleet —
+ * now including the always-completing scope critic — is aggregated under the
+ * root policy, and its LLM completion floor must be preserved. Under
+ * block-if-any there is no quorum to preserve (a blocker vetoes directly), so
+ * nothing is bumped.
+ *
+ * Called EXACTLY ONCE, at the moment the scope critic is first ADDED to
+ * `critics[]` (a fresh registration) — never on a converge re-run. Quorum is a
+ * bare integer, so "already bumped to N" is indistinguishable from "should be
+ * N+1 but wasn't"; a converge that re-bumped would inflate the floor without
+ * bound. Presence of the entry in `critics[]` means the root fleet already
+ * accounts for it. (This is the exact-once transition key.)
+ */
+function bumpRootQuorum(raw, changes) {
+    const aggregation = raw["aggregation"];
+    if (isRecord(aggregation) &&
+        aggregation["policy"] === "min-complete-quorum" &&
+        typeof aggregation["quorum"] === "number") {
+        const prev = aggregation["quorum"];
+        aggregation["quorum"] = prev + 1;
+        changes.push(`aggregation.quorum bumped ${prev}→${prev + 1} (governs profile-less runs incl. the reusable workflow's consumer path; preserves the LLM completion floor)`);
+    }
+}
+/**
+ * Ensure `criticId` is listed in EVERY profile's `criticIds`, bumping the
+ * quorum by 1 ONLY for each profile it was newly ADDED to. The add and the
+ * bump are coupled and keyed on the absent→present transition: a profile that
+ * already lists the critic is left untouched (no double-bump). This is what
+ * makes both fresh registration and the converge path idempotent — re-running
+ * `df mode init` never inflates a profile that already accounts for the scope
+ * critic, and it repairs a profile that a partial migration left it out of.
+ */
+function ensureCriticInEveryProfile(raw, criticId, changes) {
+    const profiles = raw["profiles"];
+    if (!isRecord(profiles))
+        return;
+    for (const [name, profileRaw] of Object.entries(profiles)) {
+        if (!isRecord(profileRaw))
+            continue;
+        const ids = Array.isArray(profileRaw["criticIds"])
+            ? profileRaw["criticIds"]
+            : [];
+        if (ids.includes(criticId))
+            continue; // already accounted for — no re-bump.
+        ids.push(criticId);
+        profileRaw["criticIds"] = ids;
+        if (typeof profileRaw["quorum"] === "number") {
+            const prev = profileRaw["quorum"];
+            profileRaw["quorum"] = prev + 1;
+            changes.push(`profile "${name}": added scope critic + bumped quorum ${prev}→${prev + 1} (preserves the LLM completion floor)`);
+        }
+        else {
+            changes.push(`profile "${name}": added scope critic`);
+        }
+    }
+}
+/**
+ * Register the ModeScope critic into a raw parsed `.agent-review/config.json`
+ * object. Mutates `raw` in place AND returns a change report. The caller
+ * validates the mutated object through `parseAgentReviewConfig` before
+ * persisting it.
+ *
+ * "Present" is NOT "safe". A pre-existing mode-scope entry can itself be
+ * UNSAFE — an older CLI (or a hand edit) may have added it `required: false`
+ * (its blockers are demoted to warnings under block-if-any) or left it out of a
+ * profile (it does not run at all under profile-filtered runs). So rather than
+ * no-op the instant an entry is present, we CONVERGE it to the required shape:
+ * promote `required: true`, repair a missing id, and ensure the id is in every
+ * profile. Only a FULLY compliant entry is a true no-op (`changed: false`).
+ *
+ * Quorum is preserved EXACTLY ONCE per scope, keyed on the absent→present
+ * transition (`bumpRootQuorum` for the root fleet, `ensureCriticInEveryProfile`
+ * per profile), so a converge re-run never double-counts.
+ */
+export function registerModeScopeCritic(raw) {
+    if (!isRecord(raw)) {
+        throw new Error("`.agent-review/config.json` is not a JSON object");
+    }
+    const critics = Array.isArray(raw["critics"])
+        ? raw["critics"]
+        : [];
+    raw["critics"] = critics;
+    const existing = critics.filter((c) => isRecord(c) && c["adapter"] === MODE_SCOPE_ADAPTER_ID);
+    if (existing.length > 1) {
+        // Ambiguous / corrupt: two always-completing scope critics double-count the
+        // quorum floor and there is no single canonical entry to converge. Fail
+        // CLOSED — the caller surfaces this as `error` and `df mode init` fails loud
+        // (never a silent "already-registered"). Judgment call: we throw rather than
+        // auto-dedup, because choosing which duplicate to keep and reconciling their
+        // differing required/id/profile state is not safely inferable.
+        throw new Error(`\`.agent-review/config.json\` has ${existing.length} critics with adapter ` +
+            `"${MODE_SCOPE_ADAPTER_ID}"; expected at most one. Remove the duplicate ` +
+            `entries and re-run \`df mode init\`.`);
+    }
+    const changes = [];
+    if (existing.length === 0) {
+        // FRESH registration: add the entry, then preserve the floor once on each
+        // scope it newly enters (the root fleet + every profile).
+        critics.push(buildModeScopeCriticEntry());
+        changes.push(`added critic "${MODE_SCOPE_CRITIC_ID}" (adapter: ${MODE_SCOPE_ADAPTER_ID}, required: true, deterministic hard gate)`);
+        bumpRootQuorum(raw, changes);
+        ensureCriticInEveryProfile(raw, MODE_SCOPE_CRITIC_ID, changes);
+        return { changed: true, changes };
+    }
+    // CONVERGE the single pre-existing entry to the required shape.
+    const entry = existing[0];
+    // 1. Canonical id. Profiles reference critics BY id, so keep an existing
+    //    non-empty string id (forcing a new one would orphan those references)
+    //    and only repair a missing / non-string one. Judgment call: we do NOT
+    //    rename a differing existing id — it is the consumer's chosen id and
+    //    renaming is not safely reversible; we converge profiles to whatever id
+    //    the entry actually uses.
+    let criticId;
+    if (typeof entry["id"] === "string" && entry["id"].length > 0) {
+        criticId = entry["id"];
+    }
+    else {
+        entry["id"] = MODE_SCOPE_CRITIC_ID;
+        criticId = MODE_SCOPE_CRITIC_ID;
+        changes.push(`set the missing id on the existing mode-scope critic to "${MODE_SCOPE_CRITIC_ID}"`);
+    }
+    // 2. Promote to required: true — the hard-gate invariant. A required: false
+    //    scope critic's blockers are demoted to warnings under block-if-any.
+    if (entry["required"] !== true) {
+        const was = entry["required"];
+        entry["required"] = true;
+        changes.push(`promoted the existing mode-scope critic "${criticId}" to required: true ` +
+            `(hard-gate invariant; was ${JSON.stringify(was)})`);
+    }
+    // 3. Ensure the id is in every profile (adds + bumps only the profiles that
+    //    were missing it). Already-listing profiles are left alone — their
+    //    presence means they already account for the critic.
+    //
+    //    WONTFIX (documented, #311): the ROOT `aggregation.quorum` is likewise
+    //    NOT re-bumped on converge. A hand-corrupted config where `mode-scope` is
+    //    in `critics[]` but the root quorum was never bumped is OUTSIDE this
+    //    converge contract's repair scope, for two reasons: (1) the CLI never
+    //    produces that state — the fresh path bumps root atomically with the add
+    //    (the caller writes the fully-mutated object or nothing), and no released
+    //    CLI registers `mode-scope` at all, so it is reachable only by hand-edit;
+    //    (2) root-bump status is UNOBSERVABLE from a bare integer — `N` cannot be
+    //    told apart from `(N+1) minus one` — so any in-registration "repair" is a
+    //    blind guess that either over-inflates the already-correct case or runs
+    //    away on re-runs (breaking idempotency). Detection of this hand-edit-only
+    //    drift is deferred to a read-only `df doctor` check (#333); registration
+    //    stays idempotent.
+    ensureCriticInEveryProfile(raw, criticId, changes);
+    return { changed: changes.length > 0, changes };
+}
+/**
+ * Register the ModeScope critic into `<repoRoot>/.agent-review/config.json`.
+ *
+ *  - `absent`: no config.json — the consumer hasn't run `df onboard`. Skipped
+ *    (not an error): the catalog seed still stands and re-running init after
+ *    onboarding completes registration.
+ *  - `already-registered`: the critic is already present — idempotent no-op.
+ *  - `registered`: patched + written.
+ *  - `error`: the config is malformed OR the patched config fails canonical
+ *    validation. The on-disk file is left UNTOUCHED (fail-closed); the error
+ *    is reported, not thrown, so `df mode init` degrades gracefully.
+ */
+export function applyModeScopeCriticRegistration(repoRoot) {
+    const configPath = join(repoRoot, ".agent-review", "config.json");
+    if (!existsSync(configPath)) {
+        return { configPath, status: "absent", changes: [] };
+    }
+    let raw;
+    try {
+        raw = JSON.parse(readFileSync(configPath, "utf8"));
+    }
+    catch (e) {
+        return {
+            configPath,
+            status: "error",
+            changes: [],
+            error: `not valid JSON: ${e instanceof Error ? e.message : String(e)}`,
+        };
+    }
+    let result;
+    try {
+        result = registerModeScopeCritic(raw); // mutates `raw` in place
+    }
+    catch (e) {
+        return {
+            configPath,
+            status: "error",
+            changes: [],
+            error: e instanceof Error ? e.message : String(e),
+        };
+    }
+    if (!result.changed) {
+        return { configPath, status: "already-registered", changes: [] };
+    }
+    // Fail closed: the mutated object MUST parse canonically before we persist
+    // it. On failure the on-disk file is never rewritten.
+    try {
+        parseAgentReviewConfig(raw);
+    }
+    catch (e) {
+        return {
+            configPath,
+            status: "error",
+            changes: [],
+            error: `patched config failed validation (not written): ${e instanceof Error ? e.message : String(e)}`,
+        };
+    }
+    writeFileSync(configPath, `${JSON.stringify(raw, null, 2)}\n`);
+    return { configPath, status: "registered", changes: result.changes };
+}
+//# sourceMappingURL=critic-registration.js.map

package/dist/mode/critic-registration.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"critic-registration.js","sourceRoot":"","sources":["../../src/mode/critic-registration.ts"],"names":[],"mappings":"AAAA,wEAAwE;AACxE,0CAA0C;AAC1C,EAAE;AACF,2EAA2E;AAC3E,6EAA6E;AAC7E,qEAAqE;AACrE,0EAA0E;AAC1E,2EAA2E;AAC3E,oBAAoB;AACpB,EAAE;AACF,wEAAwE;AACxE,2EAA2E;AAC3E,gEAAgE;AAChE,0EAA0E;AAC1E,4EAA4E;AAC5E,0EAA0E;AAC1E,4EAA4E;AAC5E,2BAA2B;AAC3B,4EAA4E;AAC5E,kEAAkE;AAClE,0EAA0E;AAC1E,yDAAyD;AACzD,4EAA4E;AAC5E,4EAA4E;AAC5E,wEAAwE;AACxE,0EAA0E;AAC1E,4EAA4E;AAC5E,EAAE;AACF,4EAA4E;AAC5E,2EAA2E;AAC3E,4DAA4D;AAC5D,yDAAyD;AAEzD,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,aAAa,EAAE,MAAM,SAAS,CAAC;AAClE,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAEjC,OAAO,EAAE,sBAAsB,EAAE,MAAM,gCAAgC,CAAC;AAExE,OAAO,EAAE,qBAAqB,EAAE,MAAM,2BAA2B,CAAC;AAElE,kFAAkF;AAClF,MAAM,CAAC,MAAM,oBAAoB,GAAG,mBAAmB,CAAC;AASxD,SAAS,QAAQ,CAAC,CAAU;IAC1B,OAAO,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;AAClE,CAAC;AAED;;;;;;;;;;;;;;GAcG;AACH,MAAM,UAAU,yBAAyB;IACvC,OAAO;QACL,EAAE,EAAE,oBAAoB;QACxB,IAAI,EAAE,mEAAmE;QACzE,OAAO,EAAE,qBAAqB;QAC9B,QAAQ,EAAE,IAAI;QACd,OAAO,EAAE,OAAO;QAChB,KAAK,EAAE,EAAE,EAAE,EAAE,eAAe,EAAE,MAAM,EAAE,EAAE,EAAE;KAC3C,CAAC;AACJ,CAAC;AAED;;;;;;;;;;;;;;;GAeG;AACH,SAAS,cAAc,CAAC,GAA4B,EAAE,OAAiB;IACrE,MAAM,WAAW,GAAG,GAAG,CAAC,aAAa,CAAC,CAAC;IACvC,IACE,QAAQ,CAAC,WAAW,CAAC;QACrB,WAAW,CAAC,QAAQ,CAAC,KAAK,qBAAqB;QAC/C,OAAO,WAAW,CAAC,QAAQ,CAAC,KAAK,QAAQ,EACzC,CAAC;QACD,MAAM,IAAI,GAAG,WAAW,CAAC,QAAQ,CAAW,CAAC;QAC7C,WAAW,CAAC,QAAQ,CAAC,GAAG,IAAI,GAAG,CAAC,CAAC;QACjC,OAAO,CAAC,IAAI,CACV,6BAA6B,IAAI,IAAI,IAAI,GAAG,CAAC,8GAA8G,CAC5J,CAAC;IACJ,CAAC;AACH,CAAC;AAED;;;;;;;;GAQG;AACH,SAAS,0BAA0B,CACjC,GAA4B,EAC5B,QAAgB,EAChB,OAAiB;IAEjB,MAAM,QAAQ,GAAG,GAAG,CAAC,UAAU,CAAC,CAAC;IACjC,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC;QAAE,OAAO;IAChC,KAAK,MAAM,CAAC,IAAI,EAAE,UAAU,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAC;QAC1D,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC;YAAE,SAAS;QACpC,MAAM,GAAG,GAAG,KAAK,CAAC,OAAO,CAAC,UAAU,CAAC,WAAW,CAAC,CAAC;YAChD,CAAC,CAAE,UAAU,CAAC,WAAW,CAAe;YACxC,CAAC,CAAC,EAAE,CAAC;QACP,IAAI,GAAG,CAAC,QAAQ,CAAC,QAAQ,CAAC;YAAE,SAAS,CAAC,sCAAsC;QAC5E,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QACnB,UAAU,CAAC,WAAW,CAAC,GAAG,GAAG,CAAC;QAC9B,IAAI,OAAO,UAAU,CAAC,QAAQ,CAAC,KAAK,QAAQ,EAAE,CAAC;YAC7C,MAAM,IAAI,GAAG,UAAU,CAAC,QAAQ,CAAW,CAAC;YAC5C,UAAU,CAAC,QAAQ,CAAC,GAAG,IAAI,GAAG,CAAC,CAAC;YAChC,OAAO,CAAC,IAAI,CACV,YAAY,IAAI,yCAAyC,IAAI,IAAI,IAAI,GAAG,CAAC,uCAAuC,CACjH,CAAC;QACJ,CAAC;aAAM,CAAC;YACN,OAAO,CAAC,IAAI,CAAC,YAAY,IAAI,uBAAuB,CAAC,CAAC;QACxD,CAAC;IACH,CAAC;AACH,CAAC;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,UAAU,uBAAuB,CAAC,GAAY;IAClD,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;QACnB,MAAM,IAAI,KAAK,CAAC,kDAAkD,CAAC,CAAC;IACtE,CAAC;IACD,MAAM,OAAO,GAAG,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;QAC3C,CAAC,CAAE,GAAG,CAAC,SAAS,CAAe;QAC/B,CAAC,CAAC,EAAE,CAAC;IACP,GAAG,CAAC,SAAS,CAAC,GAAG,OAAO,CAAC;IAEzB,MAAM,QAAQ,GAAG,OAAO,CAAC,MAAM,CAC7B,CAAC,CAAC,EAAgC,EAAE,CAClC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,SAAS,CAAC,KAAK,qBAAqB,CACxD,CAAC;IACF,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACxB,4EAA4E;QAC5E,wEAAwE;QACxE,6EAA6E;QAC7E,6EAA6E;QAC7E,6EAA6E;QAC7E,+DAA+D;QAC/D,MAAM,IAAI,KAAK,CACb,qCAAqC,QAAQ,CAAC,MAAM,wBAAwB;YAC1E,IAAI,qBAAqB,gDAAgD;YACzE,sCAAsC,CACzC,CAAC;IACJ,CAAC;IAED,MAAM,OAAO,GAAa,EAAE,CAAC;IAE7B,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC1B,0EAA0E;QAC1E,0DAA0D;QAC1D,OAAO,CAAC,IAAI,CAAC,yBAAyB,EAAE,CAAC,CAAC;QAC1C,OAAO,CAAC,IAAI,CACV,iBAAiB,oBAAoB,eAAe,qBAAqB,4CAA4C,CACtH,CAAC;QACF,cAAc,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;QAC7B,0BAA0B,CAAC,GAAG,EAAE,oBAAoB,EAAE,OAAO,CAAC,CAAC;QAC/D,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC;IACpC,CAAC;IAED,gEAAgE;IAChE,MAAM,KAAK,GAAG,QAAQ,CAAC,CAAC,CAAE,CAAC;IAE3B,yEAAyE;IACzE,2EAA2E;IAC3E,0EAA0E;IAC1E,yEAAyE;IACzE,4EAA4E;IAC5E,8BAA8B;IAC9B,IAAI,QAAgB,CAAC;IACrB,IAAI,OAAO,KAAK,CAAC,IAAI,CAAC,KAAK,QAAQ,IAAI,KAAK,CAAC,IAAI,CAAC,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC9D,QAAQ,GAAG,KAAK,CAAC,IAAI,CAAC,CAAC;IACzB,CAAC;SAAM,CAAC;QACN,KAAK,CAAC,IAAI,CAAC,GAAG,oBAAoB,CAAC;QACnC,QAAQ,GAAG,oBAAoB,CAAC;QAChC,OAAO,CAAC,IAAI,CACV,4DAA4D,oBAAoB,GAAG,CACpF,CAAC;IACJ,CAAC;IAED,4EAA4E;IAC5E,yEAAyE;IACzE,IAAI,KAAK,CAAC,UAAU,CAAC,KAAK,IAAI,EAAE,CAAC;QAC/B,MAAM,GAAG,GAAG,KAAK,CAAC,UAAU,CAAC,CAAC;QAC9B,KAAK,CAAC,UAAU,CAAC,GAAG,IAAI,CAAC;QACzB,OAAO,CAAC,IAAI,CACV,4CAA4C,QAAQ,sBAAsB;YACxE,6BAA6B,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,GAAG,CACtD,CAAC;IACJ,CAAC;IAED,4EAA4E;IAC5E,uEAAuE;IACvE,yDAAyD;IACzD,EAAE;IACF,2EAA2E;IAC3E,8EAA8E;IAC9E,yEAAyE;IACzE,0EAA0E;IAC1E,6EAA6E;IAC7E,8EAA8E;IAC9E,8EAA8E;IAC9E,8EAA8E;IAC9E,8EAA8E;IAC9E,4EAA4E;IAC5E,8EAA8E;IAC9E,6EAA6E;IAC7E,uBAAuB;IACvB,0BAA0B,CAAC,GAAG,EAAE,QAAQ,EAAE,OAAO,CAAC,CAAC;IAEnD,OAAO,EAAE,OAAO,EAAE,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,OAAO,EAAE,CAAC;AAClD,CAAC;AAeD;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,gCAAgC,CAAC,QAAgB;IAC/D,MAAM,UAAU,GAAG,IAAI,CAAC,QAAQ,EAAE,eAAe,EAAE,aAAa,CAAC,CAAC;IAClE,IAAI,CAAC,UAAU,CAAC,UAAU,CAAC,EAAE,CAAC;QAC5B,OAAO,EAAE,UAAU,EAAE,MAAM,EAAE,QAAQ,EAAE,OAAO,EAAE,EAAE,EAAE,CAAC;IACvD,CAAC;IACD,IAAI,GAAY,CAAC;IACjB,IAAI,CAAC;QACH,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,UAAU,EAAE,MAAM,CAAC,CAAC,CAAC;IACrD,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,OAAO;YACL,UAAU;YACV,MAAM,EAAE,OAAO;YACf,OAAO,EAAE,EAAE;YACX,KAAK,EAAE,mBAAmB,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE;SACvE,CAAC;IACJ,CAAC;IACD,IAAI,MAAmC,CAAC;IACxC,IAAI,CAAC;QACH,MAAM,GAAG,uBAAuB,CAAC,GAAG,CAAC,CAAC,CAAC,yBAAyB;IAClE,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,OAAO;YACL,UAAU;YACV,MAAM,EAAE,OAAO;YACf,OAAO,EAAE,EAAE;YACX,KAAK,EAAE,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC;SAClD,CAAC;IACJ,CAAC;IACD,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;QACpB,OAAO,EAAE,UAAU,EAAE,MAAM,EAAE,oBAAoB,EAAE,OAAO,EAAE,EAAE,EAAE,CAAC;IACnE,CAAC;IACD,2EAA2E;IAC3E,sDAAsD;IACtD,IAAI,CAAC;QACH,sBAAsB,CAAC,GAAG,CAAC,CAAC;IAC9B,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,OAAO;YACL,UAAU;YACV,MAAM,EAAE,OAAO;YACf,OAAO,EAAE,EAAE;YACX,KAAK,EAAE,mDAAmD,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE;SACvG,CAAC;IACJ,CAAC;IACD,aAAa,CAAC,UAAU,EAAE,GAAG,IAAI,CAAC,SAAS,CAAC,GAAG,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC;IAC/D,OAAO,EAAE,UAAU,EAAE,MAAM,EAAE,YAAY,EAAE,OAAO,EAAE,MAAM,CAAC,OAAO,EAAE,CAAC;AACvE,CAAC"}

package/dist/mode/guard.d.ts

@@ -0,0 +1,15 @@
+import type { ModeConfig } from "@momentiq/dark-factory-schemas";
+export { globMatch } from "./scope-policy.js";
+export interface ResolvedModeLike {
+    modeName: string;
+    mode: ModeConfig;
+}
+export type GuardDecision = {
+    decision: "allow";
+} | {
+    decision: "deny";
+    plain: string;
+    hint: string;
+};
+export declare function decideGuard(input: unknown, resolved: ResolvedModeLike | undefined): GuardDecision;
+//# sourceMappingURL=guard.d.ts.map

package/dist/mode/guard.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"guard.d.ts","sourceRoot":"","sources":["../../src/mode/guard.ts"],"names":[],"mappings":"AAyBA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,gCAAgC,CAAC;AAQjE,OAAO,EAAE,SAAS,EAAE,MAAM,mBAAmB,CAAC;AAE9C,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,EAAE,MAAM,CAAC;IACjB,IAAI,EAAE,UAAU,CAAC;CAClB;AAED,MAAM,MAAM,aAAa,GACrB;IAAE,QAAQ,EAAE,OAAO,CAAA;CAAE,GACrB;IAAE,QAAQ,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,CAAC;AAuItD,wBAAgB,WAAW,CACzB,KAAK,EAAE,OAAO,EACd,QAAQ,EAAE,gBAAgB,GAAG,SAAS,GACrC,aAAa,CAwCf"}