@openrig/cli 0.4.8 → 0.5.1

package/node_modules/@openrig/daemon/dist/domain/startup-proof.d.ts

@@ -0,0 +1,67 @@
+import type Database from "better-sqlite3";
+import type { EventBus } from "./event-bus.js";
+import type { AgentActivityStore } from "./agent-activity-store.js";
+import type { NodeOriented } from "./types.js";
+export type { NodeOriented } from "./types.js";
+/** Per-reason reject code (append-only audit; never collapses into ready). */
+export type ProofRejectReason = "identity_unbound" | "identity_mismatch" | "challenge_stale" | "contract_mismatch" | "bare_ack";
+export interface IssuedChallenge {
+    challengeId: string;
+    contractHash: string;
+    /** Recomputable; handed to the prompt so the agent can answer. Not persisted. */
+    expectedAnswer: string;
+    /** The block appended to / delivered as the startup prompt. */
+    promptBlock: string;
+}
+export declare function computeContractHash(contractSource: string): string;
+export declare function computeExpectedAnswer(challengeId: string, contractHash: string): string;
+/**
+ * Derive + persist (append-only event) a per-launch challenge and return the
+ * prompt block. Call at fresh/fresh-fallback managed launch, BEFORE the
+ * startup prompt is delivered, so the ground truth exists before any proof.
+ */
+export declare function issueStartupChallenge(eventBus: EventBus, input: {
+    rigId: string;
+    nodeId: string;
+    contractSource: string;
+}): IssuedChallenge;
+export interface StartupProofInput {
+    sessionName?: string | null;
+    nodeId?: string | null;
+    runtime?: string | null;
+    challengeId?: string | null;
+    answer?: string | null;
+}
+export type StartupProofResult = {
+    ok: true;
+    nodeId: string;
+    rigId: string;
+    challengeId: string;
+} | {
+    ok: false;
+    code: ProofRejectReason;
+    error: string;
+};
+/**
+ * Verify an agent-emitted startup proof against the persisted per-launch
+ * challenge. Identity-bound + anti-replay + content-correct, or an
+ * append-only rejection with a per-reason code. Never sets `ready`; never
+ * routes through updateStartupStatus.
+ */
+export declare function verifyStartupProof(deps: {
+    store: AgentActivityStore;
+    eventBus: EventBus;
+}, input: StartupProofInput): StartupProofResult;
+export declare function deriveOriented(db: Database.Database, nodeId: string): NodeOriented;
+/**
+ * FS-1 W1.3 S2 — batch `deriveOriented` for the whole fleet in ONE query
+ * instead of one query per node (the ~175-query-per-poll residual). Fetches all
+ * proof events, groups by `node_id` (ORDER BY node_id, seq DESC preserves each
+ * node's seq-DESC order exactly), and runs the SAME `orientedFromRows` fold per
+ * node. Byte-identical to per-node `deriveOriented`: `deriveOriented` is
+ * node-scoped, so the per-node subset of rows + the identical fold yield the
+ * identical verdict. Nodes with no proof events are simply absent (caller
+ * defaults to "n-a", matching the no-challenge branch).
+ */
+export declare function buildOrientedMap(db: Database.Database): Map<string, NodeOriented>;
+//# sourceMappingURL=startup-proof.d.ts.map

package/node_modules/@openrig/daemon/dist/domain/startup-proof.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"startup-proof.d.ts","sourceRoot":"","sources":["../../src/domain/startup-proof.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,QAAQ,MAAM,gBAAgB,CAAC;AAC3C,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,gBAAgB,CAAC;AAC/C,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,2BAA2B,CAAC;AACpE,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,YAAY,CAAC;AAsB/C,YAAY,EAAE,YAAY,EAAE,MAAM,YAAY,CAAC;AAE/C,8EAA8E;AAC9E,MAAM,MAAM,iBAAiB,GACzB,kBAAkB,GAClB,mBAAmB,GACnB,iBAAiB,GACjB,mBAAmB,GACnB,UAAU,CAAC;AAEf,MAAM,WAAW,eAAe;IAC9B,WAAW,EAAE,MAAM,CAAC;IACpB,YAAY,EAAE,MAAM,CAAC;IACrB,iFAAiF;IACjF,cAAc,EAAE,MAAM,CAAC;IACvB,+DAA+D;IAC/D,WAAW,EAAE,MAAM,CAAC;CACrB;AAKD,wBAAgB,mBAAmB,CAAC,cAAc,EAAE,MAAM,GAAG,MAAM,CAElE;AAED,wBAAgB,qBAAqB,CAAC,WAAW,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,GAAG,MAAM,CAEvF;AAqBD;;;;GAIG;AACH,wBAAgB,qBAAqB,CACnC,QAAQ,EAAE,QAAQ,EAClB,KAAK,EAAE;IAAE,KAAK,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,cAAc,EAAE,MAAM,CAAA;CAAE,GAC/D,eAAe,CAcjB;AAED,MAAM,WAAW,iBAAiB;IAChC,WAAW,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5B,MAAM,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACvB,OAAO,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACxB,WAAW,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5B,MAAM,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CACxB;AAED,MAAM,MAAM,kBAAkB,GAC1B;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAC;IAAC,WAAW,EAAE,MAAM,CAAA;CAAE,GAChE;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,IAAI,EAAE,iBAAiB,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,CAAC;AAO1D;;;;;GAKG;AACH,wBAAgB,kBAAkB,CAChC,IAAI,EAAE;IAAE,KAAK,EAAE,kBAAkB,CAAC;IAAC,QAAQ,EAAE,QAAQ,CAAA;CAAE,EACvD,KAAK,EAAE,iBAAiB,GACvB,kBAAkB,CAsFpB;AAwCD,wBAAgB,cAAc,CAAC,EAAE,EAAE,QAAQ,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,GAAG,YAAY,CAKlF;AAED;;;;;;;;;GASG;AACH,wBAAgB,gBAAgB,CAAC,EAAE,EAAE,QAAQ,CAAC,QAAQ,GAAG,GAAG,CAAC,MAAM,EAAE,YAAY,CAAC,CAajF"}

package/node_modules/@openrig/daemon/dist/domain/startup-proof.js

@@ -0,0 +1,193 @@
+import { createHash, randomBytes } from "node:crypto";
+/** A presence-floor ACK is never proof (business rule 2). */
+const BARE_ACK_TOKENS = new Set(["", "ack", "ok", "ready", "done", "oriented", "acknowledged"]);
+export function computeContractHash(contractSource) {
+    return createHash("sha256").update(contractSource).digest("hex");
+}
+export function computeExpectedAnswer(challengeId, contractHash) {
+    return createHash("sha256").update(`${challengeId}:${contractHash}`).digest("hex").slice(0, 32);
+}
+function buildProofSubmissionCommand(challengeId, expectedAnswer) {
+    return `rig startup-proof submit --challenge-id ${challengeId} --answer ${expectedAnswer}`;
+}
+function buildPromptBlock(challengeId, expectedAnswer) {
+    return [
+        "--- OpenRig startup orientation challenge ---",
+        `challengeId: ${challengeId}`,
+        "After you have read your startup contract (all the files/identity above),",
+        "prove you oriented by submitting an authenticated startup_proof with EXACTLY:",
+        `  answer: ${expectedAnswer}`,
+        "",
+        "Run this command from your shell/tools after reading the contract:",
+        buildProofSubmissionCommand(challengeId, expectedAnswer),
+        "A bare acknowledgement (\"ack\"/\"ready\") is presence only, NEVER proof.",
+        "--------------------------------------------",
+    ].join("\n");
+}
+/**
+ * Derive + persist (append-only event) a per-launch challenge and return the
+ * prompt block. Call at fresh/fresh-fallback managed launch, BEFORE the
+ * startup prompt is delivered, so the ground truth exists before any proof.
+ */
+export function issueStartupChallenge(eventBus, input) {
+    const challengeId = randomBytes(16).toString("hex");
+    const contractHash = computeContractHash(input.contractSource);
+    const expectedAnswer = computeExpectedAnswer(challengeId, contractHash);
+    eventBus.emit({
+        type: "node.startup_challenged",
+        rigId: input.rigId,
+        nodeId: input.nodeId,
+        challengeId,
+        contractHash,
+    });
+    return { challengeId, contractHash, expectedAnswer, promptBlock: buildPromptBlock(challengeId, expectedAnswer) };
+}
+/**
+ * Verify an agent-emitted startup proof against the persisted per-launch
+ * challenge. Identity-bound + anti-replay + content-correct, or an
+ * append-only rejection with a per-reason code. Never sets `ready`; never
+ * routes through updateStartupStatus.
+ */
+export function verifyStartupProof(deps, input) {
+    const { store, eventBus } = deps;
+    const db = store.db;
+    // (a) IDENTITY — resolve {sessionId,nodeId,rigId}; an unknown identity is
+    // rejected and NO node-scoped state is projected (we cannot attribute an
+    // event to an unknown node).
+    const resolved = store.resolveSession({ sessionName: input.sessionName, nodeId: input.nodeId, runtime: input.runtime });
+    if (!resolved) {
+        return { ok: false, code: "identity_unbound", error: "startup_proof did not resolve to a managed session/node" };
+    }
+    // (a2) IDENTITY BINDING — the proof must bind to BOTH nodeId AND sessionName.
+    // `resolveSession` prioritizes nodeId and does NOT cross-check a supplied
+    // sessionName, so a proof carrying nodeId=node-a + sessionName=node-b would
+    // otherwise resolve to (and false-verify) node-a while claiming node-b's
+    // identity. Reject any conflict. We do NOT emit a node-scoped rejection for
+    // the resolved node here (mirroring identity_unbound): a mismatched /
+    // cross-seat / malformed proof must not touch the resolved node's projection
+    // at all — never verify it, and never downgrade it to `rejected` either.
+    // (runtime is a non-authoritative hint used for hook classification, not an
+    // identity key — the seat identity is the nodeId<->sessionName binding.)
+    if (input.sessionName && input.sessionName !== resolved.sessionName) {
+        return { ok: false, code: "identity_mismatch", error: "startup_proof nodeId and sessionName resolve to different seats" };
+    }
+    // Ground truth: the latest challenge issued for THIS node.
+    const challengeRow = db.prepare("SELECT payload, seq FROM events WHERE node_id = ? AND type = 'node.startup_challenged' ORDER BY seq DESC LIMIT 1").get(resolved.nodeId);
+    if (!challengeRow) {
+        // Never challenged (e.g. a resumed restore, or a non-agent path). A proof
+        // has nothing to verify against — reject as stale WITHOUT appending an
+        // event, so the node's oriented projection stays honest (`n-a`).
+        return { ok: false, code: "challenge_stale", error: "no active startup challenge for this node" };
+    }
+    let current;
+    try {
+        current = JSON.parse(challengeRow.payload);
+    }
+    catch {
+        return { ok: false, code: "challenge_stale", error: "startup challenge payload unreadable" };
+    }
+    const answer = (input.answer ?? "").trim();
+    const emitRejected = (reason) => {
+        eventBus.emit({
+            type: "node.startup_proof_rejected",
+            rigId: resolved.rigId,
+            nodeId: resolved.nodeId,
+            challengeId: input.challengeId ?? null,
+            reason,
+        });
+    };
+    // (b) THIS-LAUNCH — the answered challenge must be the current one. A
+    // replayed prior-launch answer carries a stale challengeId.
+    if (!input.challengeId || input.challengeId !== current.challengeId) {
+        emitRejected("challenge_stale");
+        return { ok: false, code: "challenge_stale", error: "challengeId does not match this launch's challenge (replay/stale)" };
+    }
+    // (d) bare-ACK / empty / presence-floor is never proof.
+    if (BARE_ACK_TOKENS.has(answer.toLowerCase())) {
+        emitRejected("bare_ack");
+        return { ok: false, code: "bare_ack", error: "a bare acknowledgement is presence only, never proof" };
+    }
+    // (c) CONTRACT — recompute the expected answer from the persisted contract
+    // hash. A plausible-but-content-wrong answer is rejected.
+    const expected = computeExpectedAnswer(current.challengeId, current.contractHash);
+    if (answer !== expected) {
+        emitRejected("contract_mismatch");
+        return { ok: false, code: "contract_mismatch", error: "proof answer does not match the delivered startup contract" };
+    }
+    eventBus.emit({
+        type: "node.startup_proof_verified",
+        rigId: resolved.rigId,
+        nodeId: resolved.nodeId,
+        sessionId: resolved.sessionId,
+        challengeId: current.challengeId,
+        contractHash: current.contractHash,
+    });
+    return { ok: true, nodeId: resolved.nodeId, rigId: resolved.rigId, challengeId: current.challengeId };
+}
+/**
+ * The pure oriented fold over ONE node's proof events (seq DESC). Extracted
+ * verbatim from the prior inline `deriveOriented` body so the per-node reader
+ * and the FS-1 W1.3 S2 batched builder (`buildOrientedMap`) share ONE
+ * implementation — same verdicts by construction, no drift.
+ */
+function orientedFromRows(rows) {
+    // Latest challenge governs.
+    const challengeRow = rows.find((r) => r.type === "node.startup_challenged");
+    if (!challengeRow)
+        return "n-a";
+    let currentChallengeId;
+    try {
+        currentChallengeId = JSON.parse(challengeRow.payload).challengeId;
+    }
+    catch {
+        return "n-a";
+    }
+    // The most-recent proof event referencing the current challenge decides
+    // verified-vs-rejected (a later verify overrides an earlier reject).
+    for (const row of rows) {
+        if (row.type === "node.startup_challenged")
+            continue;
+        let cid = null;
+        try {
+            cid = JSON.parse(row.payload).challengeId;
+        }
+        catch {
+            continue;
+        }
+        if (cid !== currentChallengeId)
+            continue;
+        return row.type === "node.startup_proof_verified" ? "verified" : "rejected";
+    }
+    return "missing";
+}
+export function deriveOriented(db, nodeId) {
+    const rows = db.prepare("SELECT type, payload, seq FROM events WHERE node_id = ? AND type IN ('node.startup_challenged','node.startup_proof_verified','node.startup_proof_rejected') ORDER BY seq DESC").all(nodeId);
+    return orientedFromRows(rows);
+}
+/**
+ * FS-1 W1.3 S2 — batch `deriveOriented` for the whole fleet in ONE query
+ * instead of one query per node (the ~175-query-per-poll residual). Fetches all
+ * proof events, groups by `node_id` (ORDER BY node_id, seq DESC preserves each
+ * node's seq-DESC order exactly), and runs the SAME `orientedFromRows` fold per
+ * node. Byte-identical to per-node `deriveOriented`: `deriveOriented` is
+ * node-scoped, so the per-node subset of rows + the identical fold yield the
+ * identical verdict. Nodes with no proof events are simply absent (caller
+ * defaults to "n-a", matching the no-challenge branch).
+ */
+export function buildOrientedMap(db) {
+    const rows = db.prepare("SELECT node_id, type, payload, seq FROM events WHERE type IN ('node.startup_challenged','node.startup_proof_verified','node.startup_proof_rejected') ORDER BY node_id, seq DESC").all();
+    const byNode = new Map();
+    for (const r of rows) {
+        let list = byNode.get(r.node_id);
+        if (!list) {
+            list = [];
+            byNode.set(r.node_id, list);
+        }
+        list.push({ type: r.type, payload: r.payload, seq: r.seq });
+    }
+    const out = new Map();
+    for (const [nodeId, nodeRows] of byNode)
+        out.set(nodeId, orientedFromRows(nodeRows));
+    return out;
+}
+//# sourceMappingURL=startup-proof.js.map

package/node_modules/@openrig/daemon/dist/domain/startup-proof.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"startup-proof.js","sourceRoot":"","sources":["../../src/domain/startup-proof.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AA6CtD,6DAA6D;AAC7D,MAAM,eAAe,GAAG,IAAI,GAAG,CAAC,CAAC,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,EAAE,UAAU,EAAE,cAAc,CAAC,CAAC,CAAC;AAEhG,MAAM,UAAU,mBAAmB,CAAC,cAAsB;IACxD,OAAO,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,cAAc,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AACnE,CAAC;AAED,MAAM,UAAU,qBAAqB,CAAC,WAAmB,EAAE,YAAoB;IAC7E,OAAO,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,GAAG,WAAW,IAAI,YAAY,EAAE,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;AAClG,CAAC;AAED,SAAS,2BAA2B,CAAC,WAAmB,EAAE,cAAsB;IAC9E,OAAO,2CAA2C,WAAW,aAAa,cAAc,EAAE,CAAC;AAC7F,CAAC;AAED,SAAS,gBAAgB,CAAC,WAAmB,EAAE,cAAsB;IACnE,OAAO;QACL,+CAA+C;QAC/C,gBAAgB,WAAW,EAAE;QAC7B,2EAA2E;QAC3E,+EAA+E;QAC/E,aAAa,cAAc,EAAE;QAC7B,EAAE;QACF,oEAAoE;QACpE,2BAA2B,CAAC,WAAW,EAAE,cAAc,CAAC;QACxD,2EAA2E;QAC3E,8CAA8C;KAC/C,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AACf,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,qBAAqB,CACnC,QAAkB,EAClB,KAAgE;IAEhE,MAAM,WAAW,GAAG,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;IACpD,MAAM,YAAY,GAAG,mBAAmB,CAAC,KAAK,CAAC,cAAc,CAAC,CAAC;IAC/D,MAAM,cAAc,GAAG,qBAAqB,CAAC,WAAW,EAAE,YAAY,CAAC,CAAC;IAExE,QAAQ,CAAC,IAAI,CAAC;QACZ,IAAI,EAAE,yBAAyB;QAC/B,KAAK,EAAE,KAAK,CAAC,KAAK;QAClB,MAAM,EAAE,KAAK,CAAC,MAAM;QACpB,WAAW;QACX,YAAY;KACb,CAAC,CAAC;IAEH,OAAO,EAAE,WAAW,EAAE,YAAY,EAAE,cAAc,EAAE,WAAW,EAAE,gBAAgB,CAAC,WAAW,EAAE,cAAc,CAAC,EAAE,CAAC;AACnH,CAAC;AAmBD;;;;;GAKG;AACH,MAAM,UAAU,kBAAkB,CAChC,IAAuD,EACvD,KAAwB;IAExB,MAAM,EAAE,KAAK,EAAE,QAAQ,EAAE,GAAG,IAAI,CAAC;IACjC,MAAM,EAAE,GAAG,KAAK,CAAC,EAAE,CAAC;IAEpB,0EAA0E;IAC1E,yEAAyE;IACzE,6BAA6B;IAC7B,MAAM,QAAQ,GAAG,KAAK,CAAC,cAAc,CAAC,EAAE,WAAW,EAAE,KAAK,CAAC,WAAW,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC;IACxH,IAAI,CAAC,QAAQ,EAAE,CAAC;QACd,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,kBAAkB,EAAE,KAAK,EAAE,yDAAyD,EAAE,CAAC;IACnH,CAAC;IAED,8EAA8E;IAC9E,0EAA0E;IAC1E,4EAA4E;IAC5E,yEAAyE;IACzE,4EAA4E;IAC5E,sEAAsE;IACtE,6EAA6E;IAC7E,yEAAyE;IACzE,4EAA4E;IAC5E,yEAAyE;IACzE,IAAI,KAAK,CAAC,WAAW,IAAI,KAAK,CAAC,WAAW,KAAK,QAAQ,CAAC,WAAW,EAAE,CAAC;QACpE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,mBAAmB,EAAE,KAAK,EAAE,iEAAiE,EAAE,CAAC;IAC5H,CAAC;IAED,2DAA2D;IAC3D,MAAM,YAAY,GAAG,EAAE,CAAC,OAAO,CAC7B,kHAAkH,CACnH,CAAC,GAAG,CAAC,QAAQ,CAAC,MAAM,CAA6B,CAAC;IACnD,IAAI,CAAC,YAAY,EAAE,CAAC;QAClB,0EAA0E;QAC1E,uEAAuE;QACvE,iEAAiE;QACjE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,iBAAiB,EAAE,KAAK,EAAE,2CAA2C,EAAE,CAAC;IACpG,CAAC;IAED,IAAI,OAAsD,CAAC;IAC3D,IAAI,CAAC;QACH,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,OAAO,CAAkD,CAAC;IAC9F,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,iBAAiB,EAAE,KAAK,EAAE,sCAAsC,EAAE,CAAC;IAC/F,CAAC;IAED,MAAM,MAAM,GAAG,CAAC,KAAK,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;IAC3C,MAAM,YAAY,GAAG,CAAC,MAAyB,EAAE,EAAE;QACjD,QAAQ,CAAC,IAAI,CAAC;YACZ,IAAI,EAAE,6BAA6B;YACnC,KAAK,EAAE,QAAQ,CAAC,KAAK;YACrB,MAAM,EAAE,QAAQ,CAAC,MAAM;YACvB,WAAW,EAAE,KAAK,CAAC,WAAW,IAAI,IAAI;YACtC,MAAM;SACP,CAAC,CAAC;IACL,CAAC,CAAC;IAEF,sEAAsE;IACtE,4DAA4D;IAC5D,IAAI,CAAC,KAAK,CAAC,WAAW,IAAI,KAAK,CAAC,WAAW,KAAK,OAAO,CAAC,WAAW,EAAE,CAAC;QACpE,YAAY,CAAC,iBAAiB,CAAC,CAAC;QAChC,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,iBAAiB,EAAE,KAAK,EAAE,mEAAmE,EAAE,CAAC;IAC5H,CAAC;IAED,wDAAwD;IACxD,IAAI,eAAe,CAAC,GAAG,CAAC,MAAM,CAAC,WAAW,EAAE,CAAC,EAAE,CAAC;QAC9C,YAAY,CAAC,UAAU,CAAC,CAAC;QACzB,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,UAAU,EAAE,KAAK,EAAE,sDAAsD,EAAE,CAAC;IACxG,CAAC;IAED,2EAA2E;IAC3E,0DAA0D;IAC1D,MAAM,QAAQ,GAAG,qBAAqB,CAAC,OAAO,CAAC,WAAW,EAAE,OAAO,CAAC,YAAY,CAAC,CAAC;IAClF,IAAI,MAAM,KAAK,QAAQ,EAAE,CAAC;QACxB,YAAY,CAAC,mBAAmB,CAAC,CAAC;QAClC,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,mBAAmB,EAAE,KAAK,EAAE,4DAA4D,EAAE,CAAC;IACvH,CAAC;IAED,QAAQ,CAAC,IAAI,CAAC;QACZ,IAAI,EAAE,6BAA6B;QACnC,KAAK,EAAE,QAAQ,CAAC,KAAK;QACrB,MAAM,EAAE,QAAQ,CAAC,MAAM;QACvB,SAAS,EAAE,QAAQ,CAAC,SAAS;QAC7B,WAAW,EAAE,OAAO,CAAC,WAAW;QAChC,YAAY,EAAE,OAAO,CAAC,YAAY;KACnC,CAAC,CAAC;IAEH,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,QAAQ,CAAC,MAAM,EAAE,KAAK,EAAE,QAAQ,CAAC,KAAK,EAAE,WAAW,EAAE,OAAO,CAAC,WAAW,EAAE,CAAC;AACxG,CAAC;AAWD;;;;;GAKG;AACH,SAAS,gBAAgB,CAAC,IAAwB;IAChD,4BAA4B;IAC5B,MAAM,YAAY,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,yBAAyB,CAAC,CAAC;IAC5E,IAAI,CAAC,YAAY;QAAE,OAAO,KAAK,CAAC;IAChC,IAAI,kBAA0B,CAAC;IAC/B,IAAI,CAAC;QACH,kBAAkB,GAAI,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,OAAO,CAA6B,CAAC,WAAW,CAAC;IACjG,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;IAED,wEAAwE;IACxE,qEAAqE;IACrE,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;QACvB,IAAI,GAAG,CAAC,IAAI,KAAK,yBAAyB;YAAE,SAAS;QACrD,IAAI,GAAG,GAAkB,IAAI,CAAC;QAC9B,IAAI,CAAC;YAAC,GAAG,GAAI,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,OAAO,CAAoC,CAAC,WAAW,CAAC;QAAC,CAAC;QAAC,MAAM,CAAC;YAAC,SAAS;QAAC,CAAC;QAC1G,IAAI,GAAG,KAAK,kBAAkB;YAAE,SAAS;QACzC,OAAO,GAAG,CAAC,IAAI,KAAK,6BAA6B,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,UAAU,CAAC;IAC9E,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,MAAM,UAAU,cAAc,CAAC,EAAqB,EAAE,MAAc;IAClE,MAAM,IAAI,GAAG,EAAE,CAAC,OAAO,CACrB,+KAA+K,CAChL,CAAC,GAAG,CAAC,MAAM,CAAuB,CAAC;IACpC,OAAO,gBAAgB,CAAC,IAAI,CAAC,CAAC;AAChC,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,gBAAgB,CAAC,EAAqB;IACpD,MAAM,IAAI,GAAG,EAAE,CAAC,OAAO,CACrB,iLAAiL,CAClL,CAAC,GAAG,EAA4E,CAAC;IAClF,MAAM,MAAM,GAAG,IAAI,GAAG,EAA8B,CAAC;IACrD,KAAK,MAAM,CAAC,IAAI,IAAI,EAAE,CAAC;QACrB,IAAI,IAAI,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC;QACjC,IAAI,CAAC,IAAI,EAAE,CAAC;YAAC,IAAI,GAAG,EAAE,CAAC;YAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;QAAC,CAAC;QACtD,IAAI,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC;IAC9D,CAAC;IACD,MAAM,GAAG,GAAG,IAAI,GAAG,EAAwB,CAAC;IAC5C,KAAK,MAAM,CAAC,MAAM,EAAE,QAAQ,CAAC,IAAI,MAAM;QAAE,GAAG,CAAC,GAAG,CAAC,MAAM,EAAE,gBAAgB,CAAC,QAAQ,CAAC,CAAC,CAAC;IACrF,OAAO,GAAG,CAAC;AACb,CAAC"}

package/node_modules/@openrig/daemon/dist/domain/startup-resolver.d.ts

@@ -0,0 +1,28 @@
+import type { StartupBlock } from "./types.js";
+export interface StartupLayerInputs {
+    specStartup: StartupBlock;
+    profileStartup?: StartupBlock;
+    rigCultureFile?: string;
+    rigStartup?: StartupBlock;
+    podStartup?: StartupBlock;
+    memberStartup?: StartupBlock;
+    operatorStartup?: StartupBlock;
+}
+/**
+ * Build effective startup in fixed additive order:
+ * 1. Agent base startup
+ * 2. Profile startup
+ * 3. Rig culture file (synthetic StartupFile)
+ * 4. Rig startup overlays
+ * 5. Pod shared startup
+ * 6. Member startup overlays
+ * 7. Operator debug append (always last)
+ *
+ * Files and actions are concatenated in order. No deduplication —
+ * adapters handle replay tolerance per the startup contract.
+ *
+ * @param inputs - all startup sources
+ * @returns merged StartupBlock
+ */
+export declare function resolveStartup(inputs: StartupLayerInputs): StartupBlock;
+//# sourceMappingURL=startup-resolver.d.ts.map

package/node_modules/@openrig/daemon/dist/domain/startup-resolver.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"startup-resolver.d.ts","sourceRoot":"","sources":["../../src/domain/startup-resolver.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,YAAY,EAA8B,MAAM,YAAY,CAAC;AAE3E,MAAM,WAAW,kBAAkB;IACjC,WAAW,EAAE,YAAY,CAAC;IAC1B,cAAc,CAAC,EAAE,YAAY,CAAC;IAC9B,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,UAAU,CAAC,EAAE,YAAY,CAAC;IAC1B,UAAU,CAAC,EAAE,YAAY,CAAC;IAC1B,aAAa,CAAC,EAAE,YAAY,CAAC;IAC7B,eAAe,CAAC,EAAE,YAAY,CAAC;CAChC;AAED;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,cAAc,CAAC,MAAM,EAAE,kBAAkB,GAAG,YAAY,CA2CvE"}

package/node_modules/@openrig/daemon/dist/domain/startup-resolver.js

@@ -0,0 +1,57 @@
+/**
+ * Build effective startup in fixed additive order:
+ * 1. Agent base startup
+ * 2. Profile startup
+ * 3. Rig culture file (synthetic StartupFile)
+ * 4. Rig startup overlays
+ * 5. Pod shared startup
+ * 6. Member startup overlays
+ * 7. Operator debug append (always last)
+ *
+ * Files and actions are concatenated in order. No deduplication —
+ * adapters handle replay tolerance per the startup contract.
+ *
+ * @param inputs - all startup sources
+ * @returns merged StartupBlock
+ */
+export function resolveStartup(inputs) {
+    const files = [];
+    const actions = [];
+    // 1. Agent base startup
+    appendBlock(inputs.specStartup, files, actions);
+    // 2. Profile startup
+    if (inputs.profileStartup) {
+        appendBlock(inputs.profileStartup, files, actions);
+    }
+    // 3. Rig culture file (synthetic file entry)
+    if (inputs.rigCultureFile) {
+        files.push({
+            path: inputs.rigCultureFile,
+            deliveryHint: "auto",
+            required: true,
+            appliesOn: ["fresh_start", "restore"],
+        });
+    }
+    // 4. Rig startup overlays
+    if (inputs.rigStartup) {
+        appendBlock(inputs.rigStartup, files, actions);
+    }
+    // 5. Pod shared startup
+    if (inputs.podStartup) {
+        appendBlock(inputs.podStartup, files, actions);
+    }
+    // 6. Member startup overlays
+    if (inputs.memberStartup) {
+        appendBlock(inputs.memberStartup, files, actions);
+    }
+    // 7. Operator debug append (always last)
+    if (inputs.operatorStartup) {
+        appendBlock(inputs.operatorStartup, files, actions);
+    }
+    return { files, actions };
+}
+function appendBlock(block, files, actions) {
+    files.push(...block.files);
+    actions.push(...block.actions);
+}
+//# sourceMappingURL=startup-resolver.js.map

package/node_modules/@openrig/daemon/dist/domain/startup-resolver.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"startup-resolver.js","sourceRoot":"","sources":["../../src/domain/startup-resolver.ts"],"names":[],"mappings":"AAYA;;;;;;;;;;;;;;;GAeG;AACH,MAAM,UAAU,cAAc,CAAC,MAA0B;IACvD,MAAM,KAAK,GAAkB,EAAE,CAAC;IAChC,MAAM,OAAO,GAAoB,EAAE,CAAC;IAEpC,wBAAwB;IACxB,WAAW,CAAC,MAAM,CAAC,WAAW,EAAE,KAAK,EAAE,OAAO,CAAC,CAAC;IAEhD,qBAAqB;IACrB,IAAI,MAAM,CAAC,cAAc,EAAE,CAAC;QAC1B,WAAW,CAAC,MAAM,CAAC,cAAc,EAAE,KAAK,EAAE,OAAO,CAAC,CAAC;IACrD,CAAC;IAED,6CAA6C;IAC7C,IAAI,MAAM,CAAC,cAAc,EAAE,CAAC;QAC1B,KAAK,CAAC,IAAI,CAAC;YACT,IAAI,EAAE,MAAM,CAAC,cAAc;YAC3B,YAAY,EAAE,MAAM;YACpB,QAAQ,EAAE,IAAI;YACd,SAAS,EAAE,CAAC,aAAa,EAAE,SAAS,CAAC;SACtC,CAAC,CAAC;IACL,CAAC;IAED,0BAA0B;IAC1B,IAAI,MAAM,CAAC,UAAU,EAAE,CAAC;QACtB,WAAW,CAAC,MAAM,CAAC,UAAU,EAAE,KAAK,EAAE,OAAO,CAAC,CAAC;IACjD,CAAC;IAED,wBAAwB;IACxB,IAAI,MAAM,CAAC,UAAU,EAAE,CAAC;QACtB,WAAW,CAAC,MAAM,CAAC,UAAU,EAAE,KAAK,EAAE,OAAO,CAAC,CAAC;IACjD,CAAC;IAED,6BAA6B;IAC7B,IAAI,MAAM,CAAC,aAAa,EAAE,CAAC;QACzB,WAAW,CAAC,MAAM,CAAC,aAAa,EAAE,KAAK,EAAE,OAAO,CAAC,CAAC;IACpD,CAAC;IAED,yCAAyC;IACzC,IAAI,MAAM,CAAC,eAAe,EAAE,CAAC;QAC3B,WAAW,CAAC,MAAM,CAAC,eAAe,EAAE,KAAK,EAAE,OAAO,CAAC,CAAC;IACtD,CAAC;IAED,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC;AAC5B,CAAC;AAED,SAAS,WAAW,CAAC,KAAmB,EAAE,KAAoB,EAAE,OAAwB;IACtF,KAAK,CAAC,IAAI,CAAC,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC;IAC3B,OAAO,CAAC,IAAI,CAAC,GAAG,KAAK,CAAC,OAAO,CAAC,CAAC;AACjC,CAAC"}

package/node_modules/@openrig/daemon/dist/domain/startup-validation.d.ts

@@ -0,0 +1,31 @@
+import type { StartupBlock } from "./types.js";
+/**
+ * Validate a startup file entry.
+ * @param raw - parsed file object
+ * @param index - position in files array
+ * @param prefix - error message prefix
+ * @returns array of error strings
+ */
+export declare function validateStartupFile(raw: Record<string, unknown>, index: number, prefix: string): string[];
+/**
+ * Validate a startup action entry.
+ * @param raw - parsed action object
+ * @param index - position in actions array
+ * @param prefix - error message prefix
+ * @returns array of error strings
+ */
+export declare function validateStartupAction(raw: Record<string, unknown>, index: number, prefix: string): string[];
+/**
+ * Validate a startup block (files + actions).
+ * @param raw - parsed startup object
+ * @param prefix - error message prefix
+ * @returns array of error strings
+ */
+export declare function validateStartupBlock(raw: unknown, prefix: string): string[];
+/**
+ * Normalize a startup block into the canonical typed shape with defaults.
+ * @param raw - parsed startup object
+ * @returns normalized StartupBlock
+ */
+export declare function normalizeStartupBlock(raw: unknown): StartupBlock;
+//# sourceMappingURL=startup-validation.d.ts.map

package/node_modules/@openrig/daemon/dist/domain/startup-validation.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"startup-validation.d.ts","sourceRoot":"","sources":["../../src/domain/startup-validation.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,YAAY,EAA8B,MAAM,YAAY,CAAC;AAW3E;;;;;;GAMG;AACH,wBAAgB,mBAAmB,CAAC,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,MAAM,EAAE,CA2BzG;AAED;;;;;;GAMG;AACH,wBAAgB,qBAAqB,CAAC,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,MAAM,EAAE,CAuC3G;AAED;;;;;GAKG;AACH,wBAAgB,oBAAoB,CAAC,GAAG,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,GAAG,MAAM,EAAE,CAwB3E;AAID;;;;GAIG;AACH,wBAAgB,qBAAqB,CAAC,GAAG,EAAE,OAAO,GAAG,YAAY,CA6BhE"}

package/node_modules/@openrig/daemon/dist/domain/startup-validation.js

@@ -0,0 +1,165 @@
+import { validateSafePath } from "./path-safety.js";
+// -- Constants --
+const VALID_DELIVERY_HINTS = new Set(["auto", "guidance_merge", "skill_install", "send_text"]);
+const VALID_ACTION_TYPES = new Set(["slash_command", "send_text"]);
+const VALID_PHASES = new Set(["after_files", "after_ready"]);
+const VALID_APPLIES_ON = new Set(["fresh_start", "restore"]);
+// -- Validation --
+/**
+ * Validate a startup file entry.
+ * @param raw - parsed file object
+ * @param index - position in files array
+ * @param prefix - error message prefix
+ * @returns array of error strings
+ */
+export function validateStartupFile(raw, index, prefix) {
+    const errors = [];
+    // Slice-03 V3: startup artifacts are files only. Context packs are composed
+    // by `rig context` and delivered only through dedicated delivery verbs.
+    const kind = raw["kind"] ?? "file";
+    if (kind === "context_pack") {
+        errors.push(`${prefix}files[${index}]: compose context packs with 'rig context compose' and use a dedicated delivery verb; startup context-pack entries are not supported`);
+        return errors;
+    }
+    if (kind !== "file")
+        errors.push(`${prefix}files[${index}].kind: must be file (got "${kind}")`);
+    const pathErr = validateSafePath(raw["path"], `${prefix}files[${index}].path`);
+    if (pathErr)
+        errors.push(pathErr);
+    if (raw["delivery_hint"] !== undefined && !VALID_DELIVERY_HINTS.has(raw["delivery_hint"])) {
+        errors.push(`${prefix}files[${index}].delivery_hint: must be one of ${[...VALID_DELIVERY_HINTS].join(", ")} (got "${raw["delivery_hint"]}")`);
+    }
+    if (raw["applies_on"] !== undefined) {
+        if (!Array.isArray(raw["applies_on"])) {
+            errors.push(`${prefix}files[${index}].applies_on: must be an array`);
+        }
+        else {
+            for (const v of raw["applies_on"]) {
+                if (!VALID_APPLIES_ON.has(v)) {
+                    errors.push(`${prefix}files[${index}].applies_on: invalid value "${v}"; must be one of ${[...VALID_APPLIES_ON].join(", ")}`);
+                }
+            }
+        }
+    }
+    return errors;
+}
+/**
+ * Validate a startup action entry.
+ * @param raw - parsed action object
+ * @param index - position in actions array
+ * @param prefix - error message prefix
+ * @returns array of error strings
+ */
+export function validateStartupAction(raw, index, prefix) {
+    const errors = [];
+    const type = raw["type"];
+    if (type === "shell") {
+        errors.push(`${prefix}actions[${index}].type: "shell" startup actions are not supported in v1; use "slash_command" or "send_text"`);
+    }
+    else if (!VALID_ACTION_TYPES.has(type)) {
+        errors.push(`${prefix}actions[${index}].type: must be one of ${[...VALID_ACTION_TYPES].join(", ")} (got "${type}")`);
+    }
+    if (!raw["value"] || typeof raw["value"] !== "string") {
+        errors.push(`${prefix}actions[${index}].value: must be a non-empty string`);
+    }
+    if (raw["phase"] !== undefined && !VALID_PHASES.has(raw["phase"])) {
+        errors.push(`${prefix}actions[${index}].phase: must be one of ${[...VALID_PHASES].join(", ")} (got "${raw["phase"]}")`);
+    }
+    if (raw["idempotent"] === undefined || raw["idempotent"] === null) {
+        errors.push(`${prefix}actions[${index}].idempotent: required field`);
+    }
+    else if (typeof raw["idempotent"] !== "boolean") {
+        errors.push(`${prefix}actions[${index}].idempotent: must be a boolean`);
+    }
+    if (raw["applies_on"] !== undefined) {
+        if (!Array.isArray(raw["applies_on"])) {
+            errors.push(`${prefix}actions[${index}].applies_on: must be an array`);
+        }
+        else {
+            for (const v of raw["applies_on"]) {
+                if (!VALID_APPLIES_ON.has(v)) {
+                    errors.push(`${prefix}actions[${index}].applies_on: invalid value "${v}"; must be one of ${[...VALID_APPLIES_ON].join(", ")}`);
+                }
+            }
+        }
+    }
+    // Restore-safety: non-idempotent actions must not apply on restore
+    // This covers both explicit idempotent=false AND missing idempotent with default applies_on
+    if (raw["idempotent"] === false || raw["idempotent"] === undefined) {
+        const appliesOn = Array.isArray(raw["applies_on"]) ? raw["applies_on"] : ["fresh_start", "restore"];
+        if (appliesOn.includes("restore")) {
+            errors.push(`${prefix}actions[${index}]: non-idempotent action must not apply on restore`);
+        }
+    }
+    return errors;
+}
+/**
+ * Validate a startup block (files + actions).
+ * @param raw - parsed startup object
+ * @param prefix - error message prefix
+ * @returns array of error strings
+ */
+export function validateStartupBlock(raw, prefix) {
+    if (raw === undefined || raw === null)
+        return [];
+    if (typeof raw !== "object")
+        return [`${prefix}: must be an object`];
+    const obj = raw;
+    const errors = [];
+    if (obj["files"] !== undefined) {
+        if (!Array.isArray(obj["files"])) {
+            errors.push(`${prefix}.files: must be an array`);
+        }
+        else {
+            for (let i = 0; i < obj["files"].length; i++) {
+                errors.push(...validateStartupFile(obj["files"][i], i, `${prefix}.`));
+            }
+        }
+    }
+    if (obj["actions"] !== undefined) {
+        if (!Array.isArray(obj["actions"])) {
+            errors.push(`${prefix}.actions: must be an array`);
+        }
+        else {
+            for (let i = 0; i < obj["actions"].length; i++) {
+                errors.push(...validateStartupAction(obj["actions"][i], i, `${prefix}.`));
+            }
+        }
+    }
+    return errors;
+}
+// -- Normalization --
+/**
+ * Normalize a startup block into the canonical typed shape with defaults.
+ * @param raw - parsed startup object
+ * @returns normalized StartupBlock
+ */
+export function normalizeStartupBlock(raw) {
+    if (!raw || typeof raw !== "object")
+        return { files: [], actions: [] };
+    const obj = raw;
+    const files = Array.isArray(obj["files"])
+        ? obj["files"].map((f) => ({
+            kind: "file",
+            path: f["path"],
+            deliveryHint: f["delivery_hint"] ?? "auto",
+            required: f["required"] !== false,
+            appliesOn: Array.isArray(f["applies_on"])
+                ? f["applies_on"]
+                : ["fresh_start", "restore"],
+        }))
+        : [];
+    const actions = Array.isArray(obj["actions"])
+        ? obj["actions"].map((a) => ({
+            type: a["type"],
+            value: a["value"],
+            phase: a["phase"] ?? "after_files",
+            appliesOn: Array.isArray(a["applies_on"])
+                ? a["applies_on"]
+                : ["fresh_start", "restore"],
+            idempotent: a["idempotent"],
+        }))
+        : [];
+    return { files, actions };
+}
+//# sourceMappingURL=startup-validation.js.map

package/node_modules/@openrig/daemon/dist/domain/startup-validation.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"startup-validation.js","sourceRoot":"","sources":["../../src/domain/startup-validation.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,gBAAgB,EAAE,MAAM,kBAAkB,CAAC;AAGpD,kBAAkB;AAElB,MAAM,oBAAoB,GAAG,IAAI,GAAG,CAAC,CAAC,MAAM,EAAE,gBAAgB,EAAE,eAAe,EAAE,WAAW,CAAC,CAAC,CAAC;AAC/F,MAAM,kBAAkB,GAAG,IAAI,GAAG,CAAC,CAAC,eAAe,EAAE,WAAW,CAAC,CAAC,CAAC;AACnE,MAAM,YAAY,GAAG,IAAI,GAAG,CAAC,CAAC,aAAa,EAAE,aAAa,CAAC,CAAC,CAAC;AAC7D,MAAM,gBAAgB,GAAG,IAAI,GAAG,CAAC,CAAC,aAAa,EAAE,SAAS,CAAC,CAAC,CAAC;AAE7D,mBAAmB;AAEnB;;;;;;GAMG;AACH,MAAM,UAAU,mBAAmB,CAAC,GAA4B,EAAE,KAAa,EAAE,MAAc;IAC7F,MAAM,MAAM,GAAa,EAAE,CAAC;IAC5B,4EAA4E;IAC5E,wEAAwE;IACxE,MAAM,IAAI,GAAI,GAAG,CAAC,MAAM,CAAwB,IAAI,MAAM,CAAC;IAC3D,IAAI,IAAI,KAAK,cAAc,EAAE,CAAC;QAC5B,MAAM,CAAC,IAAI,CAAC,GAAG,MAAM,SAAS,KAAK,uIAAuI,CAAC,CAAC;QAC5K,OAAO,MAAM,CAAC;IAChB,CAAC;IACD,IAAI,IAAI,KAAK,MAAM;QAAE,MAAM,CAAC,IAAI,CAAC,GAAG,MAAM,SAAS,KAAK,8BAA8B,IAAI,IAAI,CAAC,CAAC;IAChG,MAAM,OAAO,GAAG,gBAAgB,CAAC,GAAG,CAAC,MAAM,CAAW,EAAE,GAAG,MAAM,SAAS,KAAK,QAAQ,CAAC,CAAC;IACzF,IAAI,OAAO;QAAE,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IAClC,IAAI,GAAG,CAAC,eAAe,CAAC,KAAK,SAAS,IAAI,CAAC,oBAAoB,CAAC,GAAG,CAAC,GAAG,CAAC,eAAe,CAAW,CAAC,EAAE,CAAC;QACpG,MAAM,CAAC,IAAI,CAAC,GAAG,MAAM,SAAS,KAAK,mCAAmC,CAAC,GAAG,oBAAoB,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,UAAU,GAAG,CAAC,eAAe,CAAC,IAAI,CAAC,CAAC;IAChJ,CAAC;IACD,IAAI,GAAG,CAAC,YAAY,CAAC,KAAK,SAAS,EAAE,CAAC;QACpC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC,EAAE,CAAC;YACtC,MAAM,CAAC,IAAI,CAAC,GAAG,MAAM,SAAS,KAAK,gCAAgC,CAAC,CAAC;QACvE,CAAC;aAAM,CAAC;YACN,KAAK,MAAM,CAAC,IAAI,GAAG,CAAC,YAAY,CAAC,EAAE,CAAC;gBAClC,IAAI,CAAC,gBAAgB,CAAC,GAAG,CAAC,CAAW,CAAC,EAAE,CAAC;oBACvC,MAAM,CAAC,IAAI,CAAC,GAAG,MAAM,SAAS,KAAK,gCAAgC,CAAC,qBAAqB,CAAC,GAAG,gBAAgB,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;gBAC/H,CAAC;YACH,CAAC;QACH,CAAC;IACH,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,qBAAqB,CAAC,GAA4B,EAAE,KAAa,EAAE,MAAc;IAC/F,MAAM,MAAM,GAAa,EAAE,CAAC;IAC5B,MAAM,IAAI,GAAG,GAAG,CAAC,MAAM,CAAW,CAAC;IACnC,IAAI,IAAI,KAAK,OAAO,EAAE,CAAC;QACrB,MAAM,CAAC,IAAI,CAAC,GAAG,MAAM,WAAW,KAAK,6FAA6F,CAAC,CAAC;IACtI,CAAC;SAAM,IAAI,CAAC,kBAAkB,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;QACzC,MAAM,CAAC,IAAI,CAAC,GAAG,MAAM,WAAW,KAAK,0BAA0B,CAAC,GAAG,kBAAkB,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,UAAU,IAAI,IAAI,CAAC,CAAC;IACvH,CAAC;IACD,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,OAAO,GAAG,CAAC,OAAO,CAAC,KAAK,QAAQ,EAAE,CAAC;QACtD,MAAM,CAAC,IAAI,CAAC,GAAG,MAAM,WAAW,KAAK,qCAAqC,CAAC,CAAC;IAC9E,CAAC;IACD,IAAI,GAAG,CAAC,OAAO,CAAC,KAAK,SAAS,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,GAAG,CAAC,OAAO,CAAW,CAAC,EAAE,CAAC;QAC5E,MAAM,CAAC,IAAI,CAAC,GAAG,MAAM,WAAW,KAAK,2BAA2B,CAAC,GAAG,YAAY,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,UAAU,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;IAC1H,CAAC;IACD,IAAI,GAAG,CAAC,YAAY,CAAC,KAAK,SAAS,IAAI,GAAG,CAAC,YAAY,CAAC,KAAK,IAAI,EAAE,CAAC;QAClE,MAAM,CAAC,IAAI,CAAC,GAAG,MAAM,WAAW,KAAK,8BAA8B,CAAC,CAAC;IACvE,CAAC;SAAM,IAAI,OAAO,GAAG,CAAC,YAAY,CAAC,KAAK,SAAS,EAAE,CAAC;QAClD,MAAM,CAAC,IAAI,CAAC,GAAG,MAAM,WAAW,KAAK,iCAAiC,CAAC,CAAC;IAC1E,CAAC;IACD,IAAI,GAAG,CAAC,YAAY,CAAC,KAAK,SAAS,EAAE,CAAC;QACpC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC,EAAE,CAAC;YACtC,MAAM,CAAC,IAAI,CAAC,GAAG,MAAM,WAAW,KAAK,gCAAgC,CAAC,CAAC;QACzE,CAAC;aAAM,CAAC;YACN,KAAK,MAAM,CAAC,IAAI,GAAG,CAAC,YAAY,CAAC,EAAE,CAAC;gBAClC,IAAI,CAAC,gBAAgB,CAAC,GAAG,CAAC,CAAW,CAAC,EAAE,CAAC;oBACvC,MAAM,CAAC,IAAI,CAAC,GAAG,MAAM,WAAW,KAAK,gCAAgC,CAAC,qBAAqB,CAAC,GAAG,gBAAgB,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;gBACjI,CAAC;YACH,CAAC;QACH,CAAC;IACH,CAAC;IACD,mEAAmE;IACnE,4FAA4F;IAC5F,IAAI,GAAG,CAAC,YAAY,CAAC,KAAK,KAAK,IAAI,GAAG,CAAC,YAAY,CAAC,KAAK,SAAS,EAAE,CAAC;QACnE,MAAM,SAAS,GAAG,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,YAAY,CAAa,CAAC,CAAC,CAAC,CAAC,aAAa,EAAE,SAAS,CAAC,CAAC;QAChH,IAAI,SAAS,CAAC,QAAQ,CAAC,SAAS,CAAC,EAAE,CAAC;YAClC,MAAM,CAAC,IAAI,CAAC,GAAG,MAAM,WAAW,KAAK,oDAAoD,CAAC,CAAC;QAC7F,CAAC;IACH,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,oBAAoB,CAAC,GAAY,EAAE,MAAc;IAC/D,IAAI,GAAG,KAAK,SAAS,IAAI,GAAG,KAAK,IAAI;QAAE,OAAO,EAAE,CAAC;IACjD,IAAI,OAAO,GAAG,KAAK,QAAQ;QAAE,OAAO,CAAC,GAAG,MAAM,qBAAqB,CAAC,CAAC;IACrE,MAAM,GAAG,GAAG,GAA8B,CAAC;IAC3C,MAAM,MAAM,GAAa,EAAE,CAAC;IAC5B,IAAI,GAAG,CAAC,OAAO,CAAC,KAAK,SAAS,EAAE,CAAC;QAC/B,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,EAAE,CAAC;YACjC,MAAM,CAAC,IAAI,CAAC,GAAG,MAAM,0BAA0B,CAAC,CAAC;QACnD,CAAC;aAAM,CAAC;YACN,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAI,GAAG,CAAC,OAAO,CAAe,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;gBAC5D,MAAM,CAAC,IAAI,CAAC,GAAG,mBAAmB,CAAE,GAAG,CAAC,OAAO,CAA+B,CAAC,CAAC,CAAE,EAAE,CAAC,EAAE,GAAG,MAAM,GAAG,CAAC,CAAC,CAAC;YACxG,CAAC;QACH,CAAC;IACH,CAAC;IACD,IAAI,GAAG,CAAC,SAAS,CAAC,KAAK,SAAS,EAAE,CAAC;QACjC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC,EAAE,CAAC;YACnC,MAAM,CAAC,IAAI,CAAC,GAAG,MAAM,4BAA4B,CAAC,CAAC;QACrD,CAAC;aAAM,CAAC;YACN,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAI,GAAG,CAAC,SAAS,CAAe,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;gBAC9D,MAAM,CAAC,IAAI,CAAC,GAAG,qBAAqB,CAAE,GAAG,CAAC,SAAS,CAA+B,CAAC,CAAC,CAAE,EAAE,CAAC,EAAE,GAAG,MAAM,GAAG,CAAC,CAAC,CAAC;YAC5G,CAAC;QACH,CAAC;IACH,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,sBAAsB;AAEtB;;;;GAIG;AACH,MAAM,UAAU,qBAAqB,CAAC,GAAY;IAChD,IAAI,CAAC,GAAG,IAAI,OAAO,GAAG,KAAK,QAAQ;QAAE,OAAO,EAAE,KAAK,EAAE,EAAE,EAAE,OAAO,EAAE,EAAE,EAAE,CAAC;IACvE,MAAM,GAAG,GAAG,GAA8B,CAAC;IAE3C,MAAM,KAAK,GAAkB,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;QACtD,CAAC,CAAE,GAAG,CAAC,OAAO,CAA+B,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;YACpD,IAAI,EAAE,MAAe;YACrB,IAAI,EAAE,CAAC,CAAC,MAAM,CAAW;YACzB,YAAY,EAAG,CAAC,CAAC,eAAe,CAAiC,IAAI,MAAM;YAC3E,QAAQ,EAAE,CAAC,CAAC,UAAU,CAAC,KAAK,KAAK;YACjC,SAAS,EAAE,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC;gBACvC,CAAC,CAAE,CAAC,CAAC,YAAY,CAA8B;gBAC/C,CAAC,CAAC,CAAC,aAAa,EAAE,SAAS,CAAC;SAC/B,CAAC,CAAC;QACP,CAAC,CAAC,EAAE,CAAC;IAEP,MAAM,OAAO,GAAoB,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;QAC5D,CAAC,CAAE,GAAG,CAAC,SAAS,CAA+B,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;YACxD,IAAI,EAAE,CAAC,CAAC,MAAM,CAA0B;YACxC,KAAK,EAAE,CAAC,CAAC,OAAO,CAAW;YAC3B,KAAK,EAAG,CAAC,CAAC,OAAO,CAA4B,IAAI,aAAa;YAC9D,SAAS,EAAE,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC;gBACvC,CAAC,CAAE,CAAC,CAAC,YAAY,CAAgC;gBACjD,CAAC,CAAC,CAAC,aAAa,EAAE,SAAS,CAAC;YAC9B,UAAU,EAAE,CAAC,CAAC,YAAY,CAAY;SACvC,CAAC,CAAC;QACL,CAAC,CAAC,EAAE,CAAC;IAEP,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC;AAC5B,CAAC"}

package/node_modules/@openrig/daemon/dist/domain/steering/health-summary.d.ts

@@ -0,0 +1,39 @@
+import type Database from "better-sqlite3";
+import type { RigRepository } from "../rig-repository.js";
+export interface NodeHealthSummary {
+    /** Total nodes across all rigs. */
+    total: number;
+    /** Counts grouped by node.sessionStatus (running / detached / exited / unknown). */
+    bySessionStatus: Record<string, number>;
+    /** Counts grouped by lifecycleState (running / recoverable / detached / attention_required). */
+    byLifecycle: Record<string, number>;
+    /** Convenience tally for the steering surface's headline number. */
+    attentionRequired: number;
+}
+export interface ContextHealthSummary {
+    /** Total nodes that the context store knows about. */
+    total: number;
+    /** Counts grouped by context urgency (critical / warning / low / unknown). */
+    byUrgency: Record<string, number>;
+    /** Counts grouped by freshness of the last sample (fresh / stale / none). */
+    byFreshness: Record<string, number>;
+    /** Convenience tallies the steering surface foregrounds. */
+    critical: number;
+    warning: number;
+    stale: number;
+}
+export declare function computeNodeHealthSummary(deps: {
+    db: Database.Database;
+    rigRepo: RigRepository;
+}): NodeHealthSummary;
+/** Reduces context_usage rows into the steering health summary.
+ *  Urgency derived from usedPercentage thresholds (≥80 critical, ≥60
+ *  warning, otherwise low). Freshness derived from sampledAt age vs
+ *  FRESHNESS_THRESHOLD_S (300s). Reads context_usage directly because
+ *  ContextUsageStore intentionally exposes per-node accessors only;
+ *  listing all rows is a steering-surface concern, not a per-node
+ *  concern. */
+export declare function computeContextHealthSummary(deps: {
+    db: Database.Database;
+}): ContextHealthSummary;
+//# sourceMappingURL=health-summary.d.ts.map

package/node_modules/@openrig/daemon/dist/domain/steering/health-summary.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"health-summary.d.ts","sourceRoot":"","sources":["../../../src/domain/steering/health-summary.ts"],"names":[],"mappings":"AAeA,OAAO,KAAK,QAAQ,MAAM,gBAAgB,CAAC;AAC3C,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAC;AAG1D,MAAM,WAAW,iBAAiB;IAChC,mCAAmC;IACnC,KAAK,EAAE,MAAM,CAAC;IACd,oFAAoF;IACpF,eAAe,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACxC,gGAAgG;IAChG,WAAW,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACpC,oEAAoE;IACpE,iBAAiB,EAAE,MAAM,CAAC;CAC3B;AAED,MAAM,WAAW,oBAAoB;IACnC,sDAAsD;IACtD,KAAK,EAAE,MAAM,CAAC;IACd,8EAA8E;IAC9E,SAAS,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAClC,6EAA6E;IAC7E,WAAW,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACpC,4DAA4D;IAC5D,QAAQ,EAAE,MAAM,CAAC;IACjB,OAAO,EAAE,MAAM,CAAC;IAChB,KAAK,EAAE,MAAM,CAAC;CACf;AAMD,wBAAgB,wBAAwB,CAAC,IAAI,EAAE;IAAE,EAAE,EAAE,QAAQ,CAAC,QAAQ,CAAC;IAAC,OAAO,EAAE,aAAa,CAAA;CAAE,GAAG,iBAAiB,CAkBnH;AAED;;;;;;eAMe;AACf,wBAAgB,2BAA2B,CAAC,IAAI,EAAE;IAAE,EAAE,EAAE,QAAQ,CAAC,QAAQ,CAAA;CAAE,GAAG,oBAAoB,CA0CjG"}