@openrig/cli 0.4.8 → 0.5.1

package/node_modules/@openrig/daemon/dist/domain/runtime-verifier.js

@@ -0,0 +1,186 @@
+import { ulid } from "ulid";
+// OPR.0.4.6.PI1 — Pi's documented Node engine floor (package.json engines).
+export const PI_NODE_ENGINE_FLOOR = "22.19.0";
+export function meetsPiNodeEngineFloor(version) {
+    const parts = version.replace(/^v/, "").split(".").map((p) => parseInt(p, 10));
+    const floor = PI_NODE_ENGINE_FLOOR.split(".").map((p) => parseInt(p, 10));
+    for (let i = 0; i < floor.length; i++) {
+        const have = parts[i] ?? 0;
+        const need = floor[i];
+        if (have > need)
+            return true;
+        if (have < need)
+            return false;
+    }
+    return true;
+}
+/**
+ * Verifies runtimes are usable — not just present on PATH.
+ * Persists results to runtime_verifications table automatically.
+ */
+export class RuntimeVerifier {
+    db;
+    exec;
+    constructor(deps) {
+        this.db = deps.db;
+        this.exec = deps.exec;
+    }
+    /** Verify tmux: `tmux -V`, parse version from output. */
+    async verifyTmux() {
+        const result = await this.runProbe("tmux", async () => {
+            const output = await this.exec("tmux -V");
+            const version = this.parseVersion(output);
+            if (!version) {
+                return { status: "error", version: null, capabilitiesJson: null, error: "unparseable version output" };
+            }
+            return { status: "verified", version, capabilitiesJson: null, error: null };
+        });
+        this.persist(result);
+        return result;
+    }
+    /** Verify cmux: `cmux capabilities --json`, parse capabilities. */
+    async verifyCmux() {
+        const result = await this.runProbe("cmux", async () => {
+            const output = await this.exec("cmux capabilities --json");
+            const trimmed = output.trim();
+            try {
+                const parsed = JSON.parse(trimmed);
+                const capsJson = JSON.stringify(parsed);
+                return { status: "verified", version: null, capabilitiesJson: capsJson, error: null };
+            }
+            catch {
+                return { status: "error", version: null, capabilitiesJson: null, error: "invalid capabilities JSON" };
+            }
+        }, "degraded");
+        this.persist(result);
+        return result;
+    }
+    /** Verify Claude Code: `claude --version`, fallback to `claude --help`. */
+    async verifyClaude() {
+        const result = await this.verifyVersionOrHelp("claude", "claude-code");
+        this.persist(result);
+        return result;
+    }
+    /** Verify Codex: `codex --version`, fallback to `codex --help`. */
+    async verifyCodex() {
+        const result = await this.verifyVersionOrHelp("codex", "codex");
+        this.persist(result);
+        return result;
+    }
+    /** OPR.0.4.6.PI1 FR-1 — Verify Pi: `pi --version` (fallback `pi --help`)
+     *  plus the Node engine floor Pi requires (>= 22.19.0). Provider/model
+     *  resolvability is member-scoped and verified at launch, not here. */
+    async verifyPi() {
+        let result = await this.verifyVersionOrHelp("pi", "pi");
+        if (result.status === "verified") {
+            try {
+                const nodeVersion = this.parseVersion(await this.exec("node --version"));
+                if (nodeVersion && !meetsPiNodeEngineFloor(nodeVersion)) {
+                    result = this.buildVerification("pi", "error", result.version, null, `Pi requires Node >= ${PI_NODE_ENGINE_FLOOR}; found ${nodeVersion}. Upgrade Node to run pi seats.`);
+                }
+            }
+            catch {
+                // `node` unresolvable from the daemon's exec context — leave the
+                // binary verification standing; the engine floor re-checks at launch.
+            }
+        }
+        this.persist(result);
+        return result;
+    }
+    /**
+     * Verify multiple runtimes. Returns results in input order.
+     * @param runtimes - canonical runtime names: 'tmux', 'cmux', 'claude-code', 'codex', 'pi'
+     */
+    async verifyAll(runtimes) {
+        const results = [];
+        for (const runtime of runtimes) {
+            switch (runtime) {
+                case "tmux":
+                    results.push(await this.verifyTmux());
+                    break;
+                case "cmux":
+                    results.push(await this.verifyCmux());
+                    break;
+                case "claude-code":
+                    results.push(await this.verifyClaude());
+                    break;
+                case "codex":
+                    results.push(await this.verifyCodex());
+                    break;
+                case "pi":
+                    results.push(await this.verifyPi());
+                    break;
+                default: {
+                    const v = this.buildVerification(runtime, "not_found", null, null, `unknown runtime: ${runtime}`);
+                    this.persist(v);
+                    results.push(v);
+                }
+            }
+        }
+        return results;
+    }
+    /**
+     * Shared helper: try `{binary} --version`, fall back to `{binary} --help`.
+     * Used by verifyClaude and verifyCodex.
+     */
+    async verifyVersionOrHelp(binary, canonicalName) {
+        // Try --version first
+        try {
+            const output = await this.exec(`${binary} --version`);
+            const version = this.parseVersion(output);
+            return this.buildVerification(canonicalName, "verified", version ?? null, null, null);
+        }
+        catch {
+            // Fall back to --help
+            try {
+                await this.exec(`${binary} --help`);
+                return this.buildVerification(canonicalName, "verified", null, null, null);
+            }
+            catch {
+                return this.buildVerification(canonicalName, "not_found", null, null, `${binary} not found`);
+            }
+        }
+    }
+    /**
+     * Run a probe with error handling. On exec failure, returns failStatus (default: not_found).
+     */
+    async runProbe(runtime, fn, failStatus = "not_found") {
+        try {
+            const { status, version, capabilitiesJson, error } = await fn();
+            return this.buildVerification(runtime, status, version, capabilitiesJson, error);
+        }
+        catch (err) {
+            return this.buildVerification(runtime, failStatus, null, null, err.message);
+        }
+    }
+    buildVerification(runtime, status, version, capabilitiesJson, error) {
+        return {
+            id: ulid(),
+            runtime,
+            version,
+            capabilitiesJson,
+            verifiedAt: new Date().toISOString(),
+            status,
+            error,
+        };
+    }
+    /** Parse a semver-like version from output (e.g. "tmux 3.4" -> "3.4"). */
+    parseVersion(output) {
+        const match = output.match(/(\d+\.\d+(?:\.\d+)?(?:[a-z])?)/);
+        return match?.[1];
+    }
+    /** Persist verification to runtime_verifications table. Upserts by runtime name. */
+    persist(v) {
+        const existing = this.db
+            .prepare("SELECT id FROM runtime_verifications WHERE runtime = ?")
+            .get(v.runtime);
+        if (existing) {
+            this.db.prepare("UPDATE runtime_verifications SET version = ?, capabilities_json = ?, verified_at = ?, status = ?, error = ? WHERE runtime = ?").run(v.version, v.capabilitiesJson, v.verifiedAt, v.status, v.error, v.runtime);
+            v.id = existing.id;
+        }
+        else {
+            this.db.prepare("INSERT INTO runtime_verifications (id, runtime, version, capabilities_json, verified_at, status, error) VALUES (?, ?, ?, ?, ?, ?, ?)").run(v.id, v.runtime, v.version, v.capabilitiesJson, v.verifiedAt, v.status, v.error);
+        }
+    }
+}
+//# sourceMappingURL=runtime-verifier.js.map

package/node_modules/@openrig/daemon/dist/domain/runtime-verifier.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"runtime-verifier.js","sourceRoot":"","sources":["../../src/domain/runtime-verifier.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAS5B,4EAA4E;AAC5E,MAAM,CAAC,MAAM,oBAAoB,GAAG,SAAS,CAAC;AAE9C,MAAM,UAAU,sBAAsB,CAAC,OAAe;IACpD,MAAM,KAAK,GAAG,OAAO,CAAC,OAAO,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,QAAQ,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC;IAC/E,MAAM,KAAK,GAAG,oBAAoB,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,QAAQ,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC;IAC1E,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACtC,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;QAC3B,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,CAAE,CAAC;QACvB,IAAI,IAAI,GAAG,IAAI;YAAE,OAAO,IAAI,CAAC;QAC7B,IAAI,IAAI,GAAG,IAAI;YAAE,OAAO,KAAK,CAAC;IAChC,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;GAGG;AACH,MAAM,OAAO,eAAe;IACjB,EAAE,CAAoB;IACvB,IAAI,CAAS;IAErB,YAAY,IAAyB;QACnC,IAAI,CAAC,EAAE,GAAG,IAAI,CAAC,EAAE,CAAC;QAClB,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC;IACxB,CAAC;IAED,yDAAyD;IACzD,KAAK,CAAC,UAAU;QACd,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,MAAM,EAAE,KAAK,IAAI,EAAE;YACpD,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;YAC1C,MAAM,OAAO,GAAG,IAAI,CAAC,YAAY,CAAC,MAAM,CAAC,CAAC;YAC1C,IAAI,CAAC,OAAO,EAAE,CAAC;gBACb,OAAO,EAAE,MAAM,EAAE,OAAwB,EAAE,OAAO,EAAE,IAAI,EAAE,gBAAgB,EAAE,IAAI,EAAE,KAAK,EAAE,4BAA4B,EAAE,CAAC;YAC1H,CAAC;YACD,OAAO,EAAE,MAAM,EAAE,UAA2B,EAAE,OAAO,EAAE,gBAAgB,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC;QAC/F,CAAC,CAAC,CAAC;QACH,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;QACrB,OAAO,MAAM,CAAC;IAChB,CAAC;IAED,mEAAmE;IACnE,KAAK,CAAC,UAAU;QACd,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,MAAM,EAAE,KAAK,IAAI,EAAE;YACpD,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,0BAA0B,CAAC,CAAC;YAC3D,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,EAAE,CAAC;YAC9B,IAAI,CAAC;gBACH,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;gBACnC,MAAM,QAAQ,GAAG,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC;gBACxC,OAAO,EAAE,MAAM,EAAE,UAA2B,EAAE,OAAO,EAAE,IAAI,EAAE,gBAAgB,EAAE,QAAQ,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC;YACzG,CAAC;YAAC,MAAM,CAAC;gBACP,OAAO,EAAE,MAAM,EAAE,OAAwB,EAAE,OAAO,EAAE,IAAI,EAAE,gBAAgB,EAAE,IAAI,EAAE,KAAK,EAAE,2BAA2B,EAAE,CAAC;YACzH,CAAC;QACH,CAAC,EAAE,UAAU,CAAC,CAAC;QACf,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;QACrB,OAAO,MAAM,CAAC;IAChB,CAAC;IAED,2EAA2E;IAC3E,KAAK,CAAC,YAAY;QAChB,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,mBAAmB,CAAC,QAAQ,EAAE,aAAa,CAAC,CAAC;QACvE,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;QACrB,OAAO,MAAM,CAAC;IAChB,CAAC;IAED,mEAAmE;IACnE,KAAK,CAAC,WAAW;QACf,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,mBAAmB,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;QAChE,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;QACrB,OAAO,MAAM,CAAC;IAChB,CAAC;IAED;;2EAEuE;IACvE,KAAK,CAAC,QAAQ;QACZ,IAAI,MAAM,GAAG,MAAM,IAAI,CAAC,mBAAmB,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;QACxD,IAAI,MAAM,CAAC,MAAM,KAAK,UAAU,EAAE,CAAC;YACjC,IAAI,CAAC;gBACH,MAAM,WAAW,GAAG,IAAI,CAAC,YAAY,CAAC,MAAM,IAAI,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAC,CAAC;gBACzE,IAAI,WAAW,IAAI,CAAC,sBAAsB,CAAC,WAAW,CAAC,EAAE,CAAC;oBACxD,MAAM,GAAG,IAAI,CAAC,iBAAiB,CAC7B,IAAI,EACJ,OAAO,EACP,MAAM,CAAC,OAAO,EACd,IAAI,EACJ,uBAAuB,oBAAoB,WAAW,WAAW,iCAAiC,CACnG,CAAC;gBACJ,CAAC;YACH,CAAC;YAAC,MAAM,CAAC;gBACP,iEAAiE;gBACjE,sEAAsE;YACxE,CAAC;QACH,CAAC;QACD,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;QACrB,OAAO,MAAM,CAAC;IAChB,CAAC;IAED;;;OAGG;IACH,KAAK,CAAC,SAAS,CAAC,QAAkB;QAChC,MAAM,OAAO,GAA0B,EAAE,CAAC;QAC1C,KAAK,MAAM,OAAO,IAAI,QAAQ,EAAE,CAAC;YAC/B,QAAQ,OAAO,EAAE,CAAC;gBAChB,KAAK,MAAM;oBAAE,OAAO,CAAC,IAAI,CAAC,MAAM,IAAI,CAAC,UAAU,EAAE,CAAC,CAAC;oBAAC,MAAM;gBAC1D,KAAK,MAAM;oBAAE,OAAO,CAAC,IAAI,CAAC,MAAM,IAAI,CAAC,UAAU,EAAE,CAAC,CAAC;oBAAC,MAAM;gBAC1D,KAAK,aAAa;oBAAE,OAAO,CAAC,IAAI,CAAC,MAAM,IAAI,CAAC,YAAY,EAAE,CAAC,CAAC;oBAAC,MAAM;gBACnE,KAAK,OAAO;oBAAE,OAAO,CAAC,IAAI,CAAC,MAAM,IAAI,CAAC,WAAW,EAAE,CAAC,CAAC;oBAAC,MAAM;gBAC5D,KAAK,IAAI;oBAAE,OAAO,CAAC,IAAI,CAAC,MAAM,IAAI,CAAC,QAAQ,EAAE,CAAC,CAAC;oBAAC,MAAM;gBACtD,OAAO,CAAC,CAAC,CAAC;oBACR,MAAM,CAAC,GAAG,IAAI,CAAC,iBAAiB,CAAC,OAAO,EAAE,WAAW,EAAE,IAAI,EAAE,IAAI,EAAE,oBAAoB,OAAO,EAAE,CAAC,CAAC;oBAClG,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;oBAChB,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;gBAClB,CAAC;YACH,CAAC;QACH,CAAC;QACD,OAAO,OAAO,CAAC;IACjB,CAAC;IAED;;;OAGG;IACK,KAAK,CAAC,mBAAmB,CAAC,MAAc,EAAE,aAAqB;QACrE,sBAAsB;QACtB,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,GAAG,MAAM,YAAY,CAAC,CAAC;YACtD,MAAM,OAAO,GAAG,IAAI,CAAC,YAAY,CAAC,MAAM,CAAC,CAAC;YAC1C,OAAO,IAAI,CAAC,iBAAiB,CAAC,aAAa,EAAE,UAAU,EAAE,OAAO,IAAI,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC;QACxF,CAAC;QAAC,MAAM,CAAC;YACP,sBAAsB;YACtB,IAAI,CAAC;gBACH,MAAM,IAAI,CAAC,IAAI,CAAC,GAAG,MAAM,SAAS,CAAC,CAAC;gBACpC,OAAO,IAAI,CAAC,iBAAiB,CAAC,aAAa,EAAE,UAAU,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC;YAC7E,CAAC;YAAC,MAAM,CAAC;gBACP,OAAO,IAAI,CAAC,iBAAiB,CAAC,aAAa,EAAE,WAAW,EAAE,IAAI,EAAE,IAAI,EAAE,GAAG,MAAM,YAAY,CAAC,CAAC;YAC/F,CAAC;QACH,CAAC;IACH,CAAC;IAED;;OAEG;IACK,KAAK,CAAC,QAAQ,CACpB,OAAe,EACf,EAA2H,EAC3H,aAA4B,WAAW;QAEvC,IAAI,CAAC;YACH,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,gBAAgB,EAAE,KAAK,EAAE,GAAG,MAAM,EAAE,EAAE,CAAC;YAChE,OAAO,IAAI,CAAC,iBAAiB,CAAC,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,gBAAgB,EAAE,KAAK,CAAC,CAAC;QACnF,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,OAAO,IAAI,CAAC,iBAAiB,CAAC,OAAO,EAAE,UAAU,EAAE,IAAI,EAAE,IAAI,EAAG,GAAa,CAAC,OAAO,CAAC,CAAC;QACzF,CAAC;IACH,CAAC;IAEO,iBAAiB,CACvB,OAAe,EACf,MAAqB,EACrB,OAAsB,EACtB,gBAA+B,EAC/B,KAAoB;QAEpB,OAAO;YACL,EAAE,EAAE,IAAI,EAAE;YACV,OAAO;YACP,OAAO;YACP,gBAAgB;YAChB,UAAU,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;YACpC,MAAM;YACN,KAAK;SACN,CAAC;IACJ,CAAC;IAED,0EAA0E;IAClE,YAAY,CAAC,MAAc;QACjC,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC,gCAAgC,CAAC,CAAC;QAC7D,OAAO,KAAK,EAAE,CAAC,CAAC,CAAC,CAAC;IACpB,CAAC;IAED,oFAAoF;IAC5E,OAAO,CAAC,CAAsB;QACpC,MAAM,QAAQ,GAAG,IAAI,CAAC,EAAE;aACrB,OAAO,CAAC,wDAAwD,CAAC;aACjE,GAAG,CAAC,CAAC,CAAC,OAAO,CAA+B,CAAC;QAEhD,IAAI,QAAQ,EAAE,CAAC;YACb,IAAI,CAAC,EAAE,CAAC,OAAO,CACb,+HAA+H,CAChI,CAAC,GAAG,CAAC,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,gBAAgB,EAAE,CAAC,CAAC,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC;YACjF,CAAC,CAAC,EAAE,GAAG,QAAQ,CAAC,EAAE,CAAC;QACrB,CAAC;aAAM,CAAC;YACN,IAAI,CAAC,EAAE,CAAC,OAAO,CACb,sIAAsI,CACvI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,gBAAgB,EAAE,CAAC,CAAC,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC;QACzF,CAAC;IACH,CAAC;CACF"}

package/node_modules/@openrig/daemon/dist/domain/scope/attestation-lineage.generated.d.ts

@@ -0,0 +1,14 @@
+export interface AttestationLineage {
+    spec?: {
+        by: string;
+        at: string;
+        priors: number;
+    };
+    delivery?: {
+        by: string;
+        at: string;
+        priors: number;
+    };
+}
+export declare function attestationLineage(frontmatterRaw: string | null): AttestationLineage | undefined;
+//# sourceMappingURL=attestation-lineage.generated.d.ts.map

package/node_modules/@openrig/daemon/dist/domain/scope/attestation-lineage.generated.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"attestation-lineage.generated.d.ts","sourceRoot":"","sources":["../../../src/domain/scope/attestation-lineage.generated.ts"],"names":[],"mappings":"AAoBA,MAAM,WAAW,kBAAkB;IACjC,IAAI,CAAC,EAAE;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,EAAE,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE,CAAC;IAClD,QAAQ,CAAC,EAAE;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,EAAE,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE,CAAC;CACvD;AAED,wBAAgB,kBAAkB,CAAC,cAAc,EAAE,MAAM,GAAG,IAAI,GAAG,kBAAkB,GAAG,SAAS,CAkBhG"}

package/node_modules/@openrig/daemon/dist/domain/scope/attestation-lineage.generated.js

@@ -0,0 +1,26 @@
+// GENERATED FILE — DO NOT EDIT.
+// Emitted by scripts/sync-scope-lineage.mjs from the canonical source:
+//   packages/cli/src/lib/scope/attestation-lineage.ts
+// Edit the canonical file, then run: node scripts/sync-scope-lineage.mjs
+// The scope-lineage-parity vitest pin fails if this mirror drifts.
+export function attestationLineage(frontmatterRaw) {
+    if (!frontmatterRaw)
+        return undefined;
+    const read = (key) => {
+        const m = new RegExp(`^${key}\\s*:\\s*(.+)$`, "m").exec(frontmatterRaw);
+        return m ? m[1].trim().replace(/^["']|["']$/g, "") : null;
+    };
+    const lineage = {};
+    for (const [scope, fields] of [
+        ["spec", { by: "approved-spec-by", at: "approved-spec-at", priors: "approved-spec-priors" }],
+        ["delivery", { by: "approved-by", at: "approved-at", priors: "approved-priors" }],
+    ]) {
+        const priorsRaw = read(fields.priors);
+        const priors = priorsRaw !== null ? Number(priorsRaw) : NaN;
+        if (Number.isFinite(priors) && priors > 0) {
+            lineage[scope] = { by: read(fields.by) ?? "?", at: read(fields.at) ?? "?", priors };
+        }
+    }
+    return Object.keys(lineage).length > 0 ? lineage : undefined;
+}
+//# sourceMappingURL=attestation-lineage.generated.js.map

package/node_modules/@openrig/daemon/dist/domain/scope/attestation-lineage.generated.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"attestation-lineage.generated.js","sourceRoot":"","sources":["../../../src/domain/scope/attestation-lineage.generated.ts"],"names":[],"mappings":"AAAA,gCAAgC;AAChC,uEAAuE;AACvE,sDAAsD;AACtD,yEAAyE;AACzE,mEAAmE;AAqBnE,MAAM,UAAU,kBAAkB,CAAC,cAA6B;IAC9D,IAAI,CAAC,cAAc;QAAE,OAAO,SAAS,CAAC;IACtC,MAAM,IAAI,GAAG,CAAC,GAAW,EAAiB,EAAE;QAC1C,MAAM,CAAC,GAAG,IAAI,MAAM,CAAC,IAAI,GAAG,gBAAgB,EAAE,GAAG,CAAC,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC;QACxE,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAE,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,cAAc,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IAC7D,CAAC,CAAC;IACF,MAAM,OAAO,GAAuB,EAAE,CAAC;IACvC,KAAK,MAAM,CAAC,KAAK,EAAE,MAAM,CAAC,IAAI;QAC5B,CAAC,MAAM,EAAE,EAAE,EAAE,EAAE,kBAAkB,EAAE,EAAE,EAAE,kBAAkB,EAAE,MAAM,EAAE,sBAAsB,EAAE,CAAC;QAC5F,CAAC,UAAU,EAAE,EAAE,EAAE,EAAE,aAAa,EAAE,EAAE,EAAE,aAAa,EAAE,MAAM,EAAE,iBAAiB,EAAE,CAAC;KACzE,EAAE,CAAC;QACX,MAAM,SAAS,GAAG,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;QACtC,MAAM,MAAM,GAAG,SAAS,KAAK,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC;QAC5D,IAAI,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,MAAM,GAAG,CAAC,EAAE,CAAC;YAC1C,OAAO,CAAC,KAAK,CAAC,GAAG,EAAE,EAAE,EAAE,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC,IAAI,GAAG,EAAE,EAAE,EAAE,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC,IAAI,GAAG,EAAE,MAAM,EAAE,CAAC;QACtF,CAAC;IACH,CAAC;IACD,OAAO,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC;AAC/D,CAAC"}

package/node_modules/@openrig/daemon/dist/domain/scope/dot-id.d.ts

@@ -0,0 +1,43 @@
+import type { DotId } from "./types.js";
+/** Default project prefix for the OpenRig single-project workspace.
+ *  Multi-project work waits for a real second project (convention §1). */
+export declare const DEFAULT_PROJECT_PREFIX = "OPR";
+/** Parse a dot-ID string into structured parts; returns null when the
+ *  string doesn't conform to the §1 positional grammar. When `tier`
+ *  is supplied, the trailing segments are peeled off into `n` (slice)
+ *  or `n` + `m` (sub-slice). With no tier, all numeric segments are
+ *  returned as `version` for backwards compatibility. */
+export declare function parseDotId(raw: string, tier?: "mission" | "slice" | "sub-slice"): DotId | null;
+/** Depth-based tier discriminator. Per §1 the positional grammar
+ *  is fixed:
+ *    mission   = <PFX>.<ver>           (ver = 2-3 numeric segments;
+ *                                       escape band is exactly 99.0.n)
+ *    slice     = <PFX>.<ver>.<n>       (3-4 numeric segments)
+ *    sub-slice = <PFX>.<ver>.<n>.<m>   (4-5 numeric segments)
+ *  Where a mission shape OVERLAPS with a slice shape (e.g. release
+ *  X.Y mission has 2 segments; release X.Y.Z mission has 3 segments
+ *  which is also the slice shape for release X.Y missions) the tier
+ *  is resolved by depth: mission caps at 3 numeric segments; slice
+ *  always has 3-4; sub-slice has 4-5. Escape band is fully unambiguous
+ *  because §1 fixes both the 99 marker AND the 0 segment that follows. */
+export declare function isMissionDotId(raw: unknown): boolean;
+export declare function isSliceDotId(raw: unknown): boolean;
+/** Render a DotId back to its canonical dot-string. */
+export declare function formatDotId(id: DotId): string;
+/** Compose a slice ID by appending an ordinal to a parent mission ID. */
+export declare function sliceIdFromMission(missionId: string, n: number): string;
+/** Infer the (project, version) pair from a mission folder name when
+ *  no explicit id is supplied. Release missions use their semver; any
+ *  other name falls into the escape band where the caller supplies the
+ *  next ordinal via the second arg. */
+export declare function inferMissionDotId(missionFolderName: string, escapeBandOrdinal: number | null, projectPrefix?: string): string;
+/** Pick the next escape-band ordinal by scanning peer mission IDs.
+ *  Looks for `<PFX>.99.0.<m>` shapes and returns max(m)+1, starting
+ *  at 1 when no peer exists. */
+export declare function nextEscapeBandOrdinal(existingIds: ReadonlyArray<string | null>, projectPrefix?: string): number;
+/** Does this candidate string parse as a valid §1 dot-ID at ANY
+ *  tier? Prefer the tier-specific isMissionDotId/isSliceDotId at use
+ *  sites where the tier is known — depth alone doesn't disambiguate
+ *  mission vs slice for release IDs with overlapping shapes. */
+export declare function isConformantDotId(raw: unknown): boolean;
+//# sourceMappingURL=dot-id.d.ts.map

package/node_modules/@openrig/daemon/dist/domain/scope/dot-id.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"dot-id.d.ts","sourceRoot":"","sources":["../../../src/domain/scope/dot-id.ts"],"names":[],"mappings":"AAiBA,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,YAAY,CAAC;AAGxC;0EAC0E;AAC1E,eAAO,MAAM,sBAAsB,QAAQ,CAAC;AAS5C;;;;yDAIyD;AACzD,wBAAgB,UAAU,CACxB,GAAG,EAAE,MAAM,EACX,IAAI,CAAC,EAAE,SAAS,GAAG,OAAO,GAAG,WAAW,GACvC,KAAK,GAAG,IAAI,CAyBd;AAkBD;;;;;;;;;;;0EAW0E;AAC1E,wBAAgB,cAAc,CAAC,GAAG,EAAE,OAAO,GAAG,OAAO,CAKpD;AAED,wBAAgB,YAAY,CAAC,GAAG,EAAE,OAAO,GAAG,OAAO,CAQlD;AAED,uDAAuD;AACvD,wBAAgB,WAAW,CAAC,EAAE,EAAE,KAAK,GAAG,MAAM,CAK7C;AAED,yEAAyE;AACzE,wBAAgB,kBAAkB,CAAC,SAAS,EAAE,MAAM,EAAE,CAAC,EAAE,MAAM,GAAG,MAAM,CAEvE;AAED;;;uCAGuC;AACvC,wBAAgB,iBAAiB,CAC/B,iBAAiB,EAAE,MAAM,EACzB,iBAAiB,EAAE,MAAM,GAAG,IAAI,EAChC,aAAa,GAAE,MAA+B,GAC7C,MAAM,CAaR;AAED;;gCAEgC;AAChC,wBAAgB,qBAAqB,CACnC,WAAW,EAAE,aAAa,CAAC,MAAM,GAAG,IAAI,CAAC,EACzC,aAAa,GAAE,MAA+B,GAC7C,MAAM,CAWR;AAED;;;gEAGgE;AAChE,wBAAgB,iBAAiB,CAAC,GAAG,EAAE,OAAO,GAAG,OAAO,CAEvD"}

package/node_modules/@openrig/daemon/dist/domain/scope/dot-id.js

@@ -0,0 +1,165 @@
+// release-0.3.2 slice 12 — dot-ID grammar per
+// `openrig-work/conventions/scope-and-versioning/README.md` §1.
+//
+// Grammar (v0 single-project):
+//   project  = <PFX>            (2-3 letter; v0 hardcodes "OPR")
+//   mission  = <PFX>.<ver>
+//   slice    = <PFX>.<ver>.<n>
+//   sub      = <PFX>.<ver>.<n>.<m>
+//
+// Version inference from mission folder name:
+//   release-X.Y[.Z]     → "X.Y[.Z]"         (release train)
+//   anything else       → "99.0.<m>" escape band (uniform-numeric;
+//                          NO alpha — convention §1 explicit)
+//
+// The escape-band <m> is assigned by scanning peer non-release missions
+// for an existing id and picking max+1. Releases keep their semver.
+import { ScopeCliError } from "./types.js";
+/** Default project prefix for the OpenRig single-project workspace.
+ *  Multi-project work waits for a real second project (convention §1). */
+export const DEFAULT_PROJECT_PREFIX = "OPR";
+const RELEASE_NAME_RE = /^release-(\d+\.\d+(?:\.\d+)?)$/;
+// Strict positional grammar: every segment is a number except for the
+// 2-3 letter project prefix at position 0. Accepts 2-5 numeric
+// segments after the prefix (mission has 2-3, slice has 3-4, sub-slice
+// has 4-5). Tier-aware parse helpers below split version/n/m correctly.
+const DOT_ID_RE = /^([A-Z]{2,3})\.(\d+(?:\.\d+){1,4})$/;
+/** Parse a dot-ID string into structured parts; returns null when the
+ *  string doesn't conform to the §1 positional grammar. When `tier`
+ *  is supplied, the trailing segments are peeled off into `n` (slice)
+ *  or `n` + `m` (sub-slice). With no tier, all numeric segments are
+ *  returned as `version` for backwards compatibility. */
+export function parseDotId(raw, tier) {
+    if (typeof raw !== "string")
+        return null;
+    const trimmed = raw.trim();
+    const m = DOT_ID_RE.exec(trimmed);
+    if (!m)
+        return null;
+    const project = m[1];
+    const segments = m[2].split(".");
+    if (!tier) {
+        return { project, version: segments.join("."), n: undefined, m: undefined };
+    }
+    if (tier === "mission") {
+        return { project, version: segments.join("."), n: undefined, m: undefined };
+    }
+    if (tier === "slice") {
+        if (segments.length < 3)
+            return null; // slice = ver(>=2) + n
+        const verSegs = segments.slice(0, -1);
+        const nSeg = segments[segments.length - 1];
+        return { project, version: verSegs.join("."), n: Number(nSeg), m: undefined };
+    }
+    // sub-slice
+    if (segments.length < 4)
+        return null;
+    const verSegs = segments.slice(0, -2);
+    const nSeg = segments[segments.length - 2];
+    const mSeg = segments[segments.length - 1];
+    return { project, version: verSegs.join("."), n: Number(nSeg), m: Number(mSeg) };
+}
+/** Validate a mission-ver segments array against the §1 escape-band
+ *  rule. The convention defines the non-release escape band as
+ *  `<PFX>.99.0.<n>` — the `0` after `99` is FIXED. A version like
+ *  `99.7.8` does NOT conform. Shared between isMissionDotId and the
+ *  parent-version check inside isSliceDotId so both surfaces stay in
+ *  lockstep. */
+function isValidMissionVerSegments(segs) {
+    if (segs.length < 2 || segs.length > 3)
+        return false;
+    if (segs[0] === "99") {
+        // Escape band: exactly [99, "0", "<ordinal>"]. The `0` segment is
+        // fixed; `<ordinal>` must be a non-empty numeric string.
+        return segs.length === 3 && segs[1] === "0" && /^\d+$/.test(segs[2] ?? "");
+    }
+    return true;
+}
+/** Depth-based tier discriminator. Per §1 the positional grammar
+ *  is fixed:
+ *    mission   = <PFX>.<ver>           (ver = 2-3 numeric segments;
+ *                                       escape band is exactly 99.0.n)
+ *    slice     = <PFX>.<ver>.<n>       (3-4 numeric segments)
+ *    sub-slice = <PFX>.<ver>.<n>.<m>   (4-5 numeric segments)
+ *  Where a mission shape OVERLAPS with a slice shape (e.g. release
+ *  X.Y mission has 2 segments; release X.Y.Z mission has 3 segments
+ *  which is also the slice shape for release X.Y missions) the tier
+ *  is resolved by depth: mission caps at 3 numeric segments; slice
+ *  always has 3-4; sub-slice has 4-5. Escape band is fully unambiguous
+ *  because §1 fixes both the 99 marker AND the 0 segment that follows. */
+export function isMissionDotId(raw) {
+    if (typeof raw !== "string")
+        return false;
+    const parsed = parseDotId(raw, "mission");
+    if (!parsed)
+        return false;
+    return isValidMissionVerSegments(parsed.version.split("."));
+}
+export function isSliceDotId(raw) {
+    if (typeof raw !== "string")
+        return false;
+    const parsed = parseDotId(raw, "slice");
+    if (!parsed)
+        return false;
+    // Slice = mission-ver + 1 ordinal. Parent ver must itself be a
+    // valid mission shape (including the escape-band exact-[99.0.n]
+    // rule — a parent like 99.7.8 is not a real mission).
+    return isValidMissionVerSegments(parsed.version.split("."));
+}
+/** Render a DotId back to its canonical dot-string. */
+export function formatDotId(id) {
+    const parts = [id.project, id.version];
+    if (id.n !== undefined)
+        parts.push(String(id.n));
+    if (id.m !== undefined)
+        parts.push(String(id.m));
+    return parts.join(".");
+}
+/** Compose a slice ID by appending an ordinal to a parent mission ID. */
+export function sliceIdFromMission(missionId, n) {
+    return `${missionId}.${n}`;
+}
+/** Infer the (project, version) pair from a mission folder name when
+ *  no explicit id is supplied. Release missions use their semver; any
+ *  other name falls into the escape band where the caller supplies the
+ *  next ordinal via the second arg. */
+export function inferMissionDotId(missionFolderName, escapeBandOrdinal, projectPrefix = DEFAULT_PROJECT_PREFIX) {
+    const releaseMatch = RELEASE_NAME_RE.exec(missionFolderName);
+    if (releaseMatch) {
+        return `${projectPrefix}.${releaseMatch[1]}`;
+    }
+    if (escapeBandOrdinal === null) {
+        throw new ScopeCliError({
+            fact: `Mission "${missionFolderName}" doesn't match the release-X.Y[.Z] pattern and no escape-band ordinal was supplied.`,
+            consequence: "No dot-ID could be inferred for this mission.",
+            action: "Pass an explicit ordinal, or rename the mission to release-X.Y.Z, or supply --id on the CLI.",
+        });
+    }
+    return `${projectPrefix}.99.0.${escapeBandOrdinal}`;
+}
+/** Pick the next escape-band ordinal by scanning peer mission IDs.
+ *  Looks for `<PFX>.99.0.<m>` shapes and returns max(m)+1, starting
+ *  at 1 when no peer exists. */
+export function nextEscapeBandOrdinal(existingIds, projectPrefix = DEFAULT_PROJECT_PREFIX) {
+    let max = 0;
+    const re = new RegExp(`^${projectPrefix}\\.99\\.0\\.(\\d+)$`);
+    for (const id of existingIds) {
+        if (!id)
+            continue;
+        const m = re.exec(id);
+        if (!m)
+            continue;
+        const n = Number(m[1]);
+        if (Number.isFinite(n) && n > max)
+            max = n;
+    }
+    return max + 1;
+}
+/** Does this candidate string parse as a valid §1 dot-ID at ANY
+ *  tier? Prefer the tier-specific isMissionDotId/isSliceDotId at use
+ *  sites where the tier is known — depth alone doesn't disambiguate
+ *  mission vs slice for release IDs with overlapping shapes. */
+export function isConformantDotId(raw) {
+    return typeof raw === "string" && parseDotId(raw) !== null;
+}
+//# sourceMappingURL=dot-id.js.map

package/node_modules/@openrig/daemon/dist/domain/scope/dot-id.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"dot-id.js","sourceRoot":"","sources":["../../../src/domain/scope/dot-id.ts"],"names":[],"mappings":"AAAA,8CAA8C;AAC9C,gEAAgE;AAChE,EAAE;AACF,+BAA+B;AAC/B,iEAAiE;AACjE,2BAA2B;AAC3B,+BAA+B;AAC/B,mCAAmC;AACnC,EAAE;AACF,8CAA8C;AAC9C,4DAA4D;AAC5D,mEAAmE;AACnE,8DAA8D;AAC9D,EAAE;AACF,wEAAwE;AACxE,oEAAoE;AAGpE,OAAO,EAAE,aAAa,EAAE,MAAM,YAAY,CAAC;AAE3C;0EAC0E;AAC1E,MAAM,CAAC,MAAM,sBAAsB,GAAG,KAAK,CAAC;AAE5C,MAAM,eAAe,GAAG,gCAAgC,CAAC;AACzD,sEAAsE;AACtE,+DAA+D;AAC/D,uEAAuE;AACvE,wEAAwE;AACxE,MAAM,SAAS,GAAG,qCAAqC,CAAC;AAExD;;;;yDAIyD;AACzD,MAAM,UAAU,UAAU,CACxB,GAAW,EACX,IAAwC;IAExC,IAAI,OAAO,GAAG,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAC;IACzC,MAAM,OAAO,GAAG,GAAG,CAAC,IAAI,EAAE,CAAC;IAC3B,MAAM,CAAC,GAAG,SAAS,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IAClC,IAAI,CAAC,CAAC;QAAE,OAAO,IAAI,CAAC;IACpB,MAAM,OAAO,GAAG,CAAC,CAAC,CAAC,CAAE,CAAC;IACtB,MAAM,QAAQ,GAAG,CAAC,CAAC,CAAC,CAAE,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAClC,IAAI,CAAC,IAAI,EAAE,CAAC;QACV,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE,SAAS,EAAE,CAAC,EAAE,SAAS,EAAE,CAAC;IAC9E,CAAC;IACD,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;QACvB,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE,SAAS,EAAE,CAAC,EAAE,SAAS,EAAE,CAAC;IAC9E,CAAC;IACD,IAAI,IAAI,KAAK,OAAO,EAAE,CAAC;QACrB,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC;YAAE,OAAO,IAAI,CAAC,CAAC,uBAAuB;QAC7D,MAAM,OAAO,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;QACtC,MAAM,IAAI,GAAG,QAAQ,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC,CAAE,CAAC;QAC5C,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,SAAS,EAAE,CAAC;IAChF,CAAC;IACD,YAAY;IACZ,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC;QAAE,OAAO,IAAI,CAAC;IACrC,MAAM,OAAO,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;IACtC,MAAM,IAAI,GAAG,QAAQ,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC,CAAE,CAAC;IAC5C,MAAM,IAAI,GAAG,QAAQ,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC,CAAE,CAAC;IAC5C,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC;AACnF,CAAC;AAED;;;;;gBAKgB;AAChB,SAAS,yBAAyB,CAAC,IAAc;IAC/C,IAAI,IAAI,CAAC,MAAM,GAAG,CAAC,IAAI,IAAI,CAAC,MAAM,GAAG,CAAC;QAAE,OAAO,KAAK,CAAC;IACrD,IAAI,IAAI,CAAC,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC;QACrB,kEAAkE;QAClE,yDAAyD;QACzD,OAAO,IAAI,CAAC,MAAM,KAAK,CAAC,IAAI,IAAI,CAAC,CAAC,CAAC,KAAK,GAAG,IAAI,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;IAC7E,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;;;;;;;;0EAW0E;AAC1E,MAAM,UAAU,cAAc,CAAC,GAAY;IACzC,IAAI,OAAO,GAAG,KAAK,QAAQ;QAAE,OAAO,KAAK,CAAC;IAC1C,MAAM,MAAM,GAAG,UAAU,CAAC,GAAG,EAAE,SAAS,CAAC,CAAC;IAC1C,IAAI,CAAC,MAAM;QAAE,OAAO,KAAK,CAAC;IAC1B,OAAO,yBAAyB,CAAC,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC;AAC9D,CAAC;AAED,MAAM,UAAU,YAAY,CAAC,GAAY;IACvC,IAAI,OAAO,GAAG,KAAK,QAAQ;QAAE,OAAO,KAAK,CAAC;IAC1C,MAAM,MAAM,GAAG,UAAU,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;IACxC,IAAI,CAAC,MAAM;QAAE,OAAO,KAAK,CAAC;IAC1B,+DAA+D;IAC/D,gEAAgE;IAChE,sDAAsD;IACtD,OAAO,yBAAyB,CAAC,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC;AAC9D,CAAC;AAED,uDAAuD;AACvD,MAAM,UAAU,WAAW,CAAC,EAAS;IACnC,MAAM,KAAK,GAAG,CAAC,EAAE,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,CAAC;IACvC,IAAI,EAAE,CAAC,CAAC,KAAK,SAAS;QAAE,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;IACjD,IAAI,EAAE,CAAC,CAAC,KAAK,SAAS;QAAE,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;IACjD,OAAO,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AACzB,CAAC;AAED,yEAAyE;AACzE,MAAM,UAAU,kBAAkB,CAAC,SAAiB,EAAE,CAAS;IAC7D,OAAO,GAAG,SAAS,IAAI,CAAC,EAAE,CAAC;AAC7B,CAAC;AAED;;;uCAGuC;AACvC,MAAM,UAAU,iBAAiB,CAC/B,iBAAyB,EACzB,iBAAgC,EAChC,gBAAwB,sBAAsB;IAE9C,MAAM,YAAY,GAAG,eAAe,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAC;IAC7D,IAAI,YAAY,EAAE,CAAC;QACjB,OAAO,GAAG,aAAa,IAAI,YAAY,CAAC,CAAC,CAAC,EAAE,CAAC;IAC/C,CAAC;IACD,IAAI,iBAAiB,KAAK,IAAI,EAAE,CAAC;QAC/B,MAAM,IAAI,aAAa,CAAC;YACtB,IAAI,EAAE,YAAY,iBAAiB,sFAAsF;YACzH,WAAW,EAAE,+CAA+C;YAC5D,MAAM,EAAE,8FAA8F;SACvG,CAAC,CAAC;IACL,CAAC;IACD,OAAO,GAAG,aAAa,SAAS,iBAAiB,EAAE,CAAC;AACtD,CAAC;AAED;;gCAEgC;AAChC,MAAM,UAAU,qBAAqB,CACnC,WAAyC,EACzC,gBAAwB,sBAAsB;IAE9C,IAAI,GAAG,GAAG,CAAC,CAAC;IACZ,MAAM,EAAE,GAAG,IAAI,MAAM,CAAC,IAAI,aAAa,qBAAqB,CAAC,CAAC;IAC9D,KAAK,MAAM,EAAE,IAAI,WAAW,EAAE,CAAC;QAC7B,IAAI,CAAC,EAAE;YAAE,SAAS;QAClB,MAAM,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QACtB,IAAI,CAAC,CAAC;YAAE,SAAS;QACjB,MAAM,CAAC,GAAG,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QACvB,IAAI,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,GAAG;YAAE,GAAG,GAAG,CAAC,CAAC;IAC7C,CAAC;IACD,OAAO,GAAG,GAAG,CAAC,CAAC;AACjB,CAAC;AAED;;;gEAGgE;AAChE,MAAM,UAAU,iBAAiB,CAAC,GAAY;IAC5C,OAAO,OAAO,GAAG,KAAK,QAAQ,IAAI,UAAU,CAAC,GAAG,CAAC,KAAK,IAAI,CAAC;AAC7D,CAAC"}

package/node_modules/@openrig/daemon/dist/domain/scope/plan-lock-artifacts.d.ts

@@ -0,0 +1,8 @@
+import type { LockedArtifact } from "../review/types.js";
+/**
+ * Derive the ordered, deduped `locked-artifacts` set for a slice plan-lock.
+ * @param readme slice README content (the approve read shell's originalBytes); null if absent.
+ * @param prd slice IMPLEMENTATION-PRD content; null when missing/unreadable (fail-open).
+ */
+export declare function derivePlanLockArtifacts(readme: string | null, prd: string | null): LockedArtifact[];
+//# sourceMappingURL=plan-lock-artifacts.d.ts.map

package/node_modules/@openrig/daemon/dist/domain/scope/plan-lock-artifacts.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"plan-lock-artifacts.d.ts","sourceRoot":"","sources":["../../../src/domain/scope/plan-lock-artifacts.ts"],"names":[],"mappings":"AAUA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,oBAAoB,CAAC;AAQzD;;;;GAIG;AACH,wBAAgB,uBAAuB,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI,EAAE,GAAG,EAAE,MAAM,GAAG,IAAI,GAAG,cAAc,EAAE,CAyCnG"}

package/node_modules/@openrig/daemon/dist/domain/scope/plan-lock-artifacts.js

@@ -0,0 +1,57 @@
+// OPR.0.4.7 slice-04 Stage-3 Lever A — plan-lock snapshot derivation.
+//
+// PURE derivation of a slice's `locked-artifacts` plan set from its README +
+// IMPLEMENTATION-PRD content strings — NO fs here; the scope-approve read shell
+// supplies both (readme = the approve originalBytes, prd = tryReadPRD or null).
+// Reuses the EXPORTED Review helpers directly (D1 — no shared extraction) so the
+// derived plan has source-selection/extraction parity with Review (no byte-equality
+// claim). Determinism: stable order (PRD -> selected proof-contract plannedRefs ->
+// intent visuals), normalized-path dedup, first source wins.
+import { extractProofContractSelected, extractSection, extractMediaRefs, sliceRelativeMediaPath, } from "../review/compose.js";
+/**
+ * Derive the ordered, deduped `locked-artifacts` set for a slice plan-lock.
+ * @param readme slice README content (the approve read shell's originalBytes); null if absent.
+ * @param prd slice IMPLEMENTATION-PRD content; null when missing/unreadable (fail-open).
+ */
+export function derivePlanLockArtifacts(readme, prd) {
+    const out = [];
+    const seen = new Set(); // dedup by NORMALIZED path; first source wins
+    // Slice-relative + posix-normalize: reject absolute `/…` and `../`-escape, and
+    // collapse `mockups/./d.png` and `mockups/d.png` to one entry (first wins).
+    // nameFromPath: D4 — an intent-visual entry's name is its EMITTED (normalized)
+    // path, so the name never carries a pre-normalization raw ref (e.g. `mockups/./x.png`).
+    const add = (name, ref, kind, nameFromPath = false) => {
+        // Reject any URI-scheme ref (http/https/data/...) BEFORE normalization: every
+        // locked-artifact path is slice-relative. Intent refs are http-filtered by
+        // extractMediaRefs, but proof-contract plannedRefs are not — enforce it here.
+        if (/^[a-z][a-z0-9+.-]*:/i.test(ref))
+            return; // RFC-3986 scheme syntax
+        const norm = sliceRelativeMediaPath(ref, "");
+        if (norm === null)
+            return; // absolute / escape — never a locked artifact
+        if (seen.has(norm))
+            return; // first source wins
+        seen.add(norm);
+        out.push({ name: nameFromPath ? norm : name, path: norm, kind });
+    };
+    // 1. PRD — always pinned first: the EXPECTED spec path, even when the PRD file
+    //    is missing/unreadable (Guard #4). A missing PRD simply adds no plannedRefs.
+    add("Implementation PRD", "IMPLEMENTATION-PRD.md", "spec");
+    // 2. Selected proof-contract plannedRefs — an authored README section wins over
+    //    a pristine-scaffold PRD section (extractProofContractSelected, README-wins).
+    for (const item of extractProofContractSelected(prd, readme).items) {
+        if (!item.plannedRef)
+            continue;
+        add(item.text || item.plannedRef, item.plannedRef, "mockup"); // name = item text, path fallback
+    }
+    // 3. Intent visuals — README `## Intent visual` media refs, UNLESS the section
+    //    is N/A (the section-suppression semantics the scope audit uses).
+    const visual = extractSection(readme, "Intent visual");
+    if (visual !== null && !/\bN\/A\b/i.test(visual)) {
+        for (const ref of extractMediaRefs(visual)) {
+            add(ref, ref, "mockup", true); // deterministic name = the emitted (normalized) path (D4)
+        }
+    }
+    return out;
+}
+//# sourceMappingURL=plan-lock-artifacts.js.map

package/node_modules/@openrig/daemon/dist/domain/scope/plan-lock-artifacts.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"plan-lock-artifacts.js","sourceRoot":"","sources":["../../../src/domain/scope/plan-lock-artifacts.ts"],"names":[],"mappings":"AAAA,sEAAsE;AACtE,EAAE;AACF,6EAA6E;AAC7E,gFAAgF;AAChF,gFAAgF;AAChF,iFAAiF;AACjF,oFAAoF;AACpF,mFAAmF;AACnF,6DAA6D;AAG7D,OAAO,EACL,4BAA4B,EAC5B,cAAc,EACd,gBAAgB,EAChB,sBAAsB,GACvB,MAAM,sBAAsB,CAAC;AAE9B;;;;GAIG;AACH,MAAM,UAAU,uBAAuB,CAAC,MAAqB,EAAE,GAAkB;IAC/E,MAAM,GAAG,GAAqB,EAAE,CAAC;IACjC,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC,CAAC,8CAA8C;IAE9E,+EAA+E;IAC/E,4EAA4E;IAC5E,+EAA+E;IAC/E,wFAAwF;IACxF,MAAM,GAAG,GAAG,CAAC,IAAY,EAAE,GAAW,EAAE,IAAY,EAAE,YAAY,GAAG,KAAK,EAAQ,EAAE;QAClF,8EAA8E;QAC9E,2EAA2E;QAC3E,8EAA8E;QAC9E,IAAI,sBAAsB,CAAC,IAAI,CAAC,GAAG,CAAC;YAAE,OAAO,CAAC,yBAAyB;QACvE,MAAM,IAAI,GAAG,sBAAsB,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;QAC7C,IAAI,IAAI,KAAK,IAAI;YAAE,OAAO,CAAC,8CAA8C;QACzE,IAAI,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC;YAAE,OAAO,CAAC,oBAAoB;QAChD,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QACf,GAAG,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,YAAY,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;IACnE,CAAC,CAAC;IAEF,+EAA+E;IAC/E,iFAAiF;IACjF,GAAG,CAAC,oBAAoB,EAAE,uBAAuB,EAAE,MAAM,CAAC,CAAC;IAE3D,gFAAgF;IAChF,kFAAkF;IAClF,KAAK,MAAM,IAAI,IAAI,4BAA4B,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC,KAAK,EAAE,CAAC;QACnE,IAAI,CAAC,IAAI,CAAC,UAAU;YAAE,SAAS;QAC/B,GAAG,CAAC,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,UAAU,EAAE,IAAI,CAAC,UAAU,EAAE,QAAQ,CAAC,CAAC,CAAC,kCAAkC;IAClG,CAAC;IAED,+EAA+E;IAC/E,sEAAsE;IACtE,MAAM,MAAM,GAAG,cAAc,CAAC,MAAM,EAAE,eAAe,CAAC,CAAC;IACvD,IAAI,MAAM,KAAK,IAAI,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC;QACjD,KAAK,MAAM,GAAG,IAAI,gBAAgB,CAAC,MAAM,CAAC,EAAE,CAAC;YAC3C,GAAG,CAAC,GAAG,EAAE,GAAG,EAAE,QAAQ,EAAE,IAAI,CAAC,CAAC,CAAC,0DAA0D;QAC3F,CAAC;IACH,CAAC;IAED,OAAO,GAAG,CAAC;AACb,CAAC"}

package/node_modules/@openrig/daemon/dist/domain/scope/scaffold-placeholder.d.ts

@@ -0,0 +1,38 @@
+/** True when `text`, trimmed, is fully bracket-wrapped (`[...]`) — the
+ *  shipped scaffold-template placeholder marker, i.e. NOT authored content. */
+export declare function isScaffoldPlaceholderText(text: string): boolean;
+/** release-0.4.7 placeholder-suppression completeness — true when `body`
+ *  carries at least one numbered item (`1.` OR `1)` form) whose text is NOT a
+ *  scaffold placeholder: the ONE authored-numbered-item grammar. Consumers:
+ *  review compose `hasAuthoredMiniReqs` + BOTH scope-audit mini-reqs arms —
+ *  one predicate heals the IF-3 dot/paren grammar divergence and the audit
+ *  arm's placeholder-blindness together (arch MB-AR-1 primary shape).
+ *  Prose-only or bullet-only bodies are deliberately NOT authored — the
+ *  numbered tier is where approval starts (reviewer-L1 ruling 2026-07-11,
+ *  intent-stage gate). `null` → false. */
+export declare function hasAuthoredNumberedItem(body: string | null): boolean;
+/** release-0.4.7 placeholder-suppression completeness — true when EVERY
+ *  non-blank line of `block` is a scaffold placeholder: the section-level
+ *  "nothing authored here" test. Per-LINE deliberately, not a whole-string
+ *  trim — a two-line `[a]\n[b]` body is placeholder-only per line but would
+ *  fail the single-line regex (the multi-line honest case, arch MB-AR-2).
+ *  `null`/empty/blank-only → false: absence is its own state; callers keep
+ *  their existing null handling. */
+export declare function isPlaceholderOnlyBlock(block: string | null): boolean;
+/** PM dogfood #1 (qitem-20260720015700-630eef64) — true when `body` is a
+ *  PRESENT section whose EVERY non-blank line is scaffold-placeholder
+ *  content: either a bare placeholder line, or a structural list row
+ *  (numbered `1.`/`1)`, checkbox `- [ ]`, or bullet `-`/`*`) whose text is a
+ *  placeholder — i.e. exactly what the shipped templates scaffold, nothing
+ *  authored. This is the SECTION-level pristine test behind per-section
+ *  source selection: only a pristine PRD section may yield to an authored
+ *  README section; authored/prose/mixed content is NOT pristine and stays
+ *  canonical wherever it lives. `null`/blank-only → false (absence is its
+ *  own state; a missing section never triggers fallback). */
+export declare function isPristineScaffoldSection(body: string | null): boolean;
+/** The generic acceptance triple scaffolded by
+ *  `packages/cli/src/lib/scope-templates/slice-progress.md` — exact trimmed
+ *  literals, sync-tested against the shipped template so constant/template
+ *  drift fails CI instead of silently reviving the bogus pristine count. */
+export declare const GENERIC_SCAFFOLD_ACCEPTANCE: readonly string[];
+//# sourceMappingURL=scaffold-placeholder.d.ts.map

package/node_modules/@openrig/daemon/dist/domain/scope/scaffold-placeholder.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"scaffold-placeholder.d.ts","sourceRoot":"","sources":["../../../src/domain/scope/scaffold-placeholder.ts"],"names":[],"mappings":"AAuBA;+EAC+E;AAC/E,wBAAgB,yBAAyB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAE/D;AAED;;;;;;;;0CAQ0C;AAC1C,wBAAgB,uBAAuB,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,GAAG,OAAO,CAOpE;AAED;;;;;;oCAMoC;AACpC,wBAAgB,sBAAsB,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI,GAAG,OAAO,CAQpE;AAED;;;;;;;;;6DAS6D;AAC7D,wBAAgB,yBAAyB,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,GAAG,OAAO,CAWtE;AAED;;;4EAG4E;AAC5E,eAAO,MAAM,2BAA2B,EAAE,SAAS,MAAM,EAIxD,CAAC"}