@openrig/cli 0.5.0 → 0.5.1

package/node_modules/@openrig/daemon/dist/domain/agent-resolver.js

@@ -0,0 +1,193 @@
+import nodePath from "node:path";
+import { createHash } from "node:crypto";
+import { parseAgentSpec, validateAgentSpec, normalizeAgentSpec } from "./agent-manifest.js";
+// -- Resource category keys --
+const RESOURCE_CATEGORIES = [
+    "skills", "guidance", "subagents", "plugins", "runtimeResources",
+];
+// -- Public API --
+/**
+ * Resolve an agent_ref to a concrete AgentSpec, including flat imports.
+ * @param ref - agent_ref string (e.g. "local:agents/impl" or "path:/abs/agents/impl")
+ * @param rigRoot - absolute path to rig root directory
+ * @param fsOps - injectable filesystem operations
+ * @returns structured resolve result
+ */
+export function resolveAgentRef(ref, rigRoot, fsOps) {
+    const dirPath = resolveRefToAbsPath(ref, rigRoot);
+    if (!dirPath) {
+        return { ok: false, code: "not_found", error: `Cannot resolve agent_ref "${ref}"` };
+    }
+    const baseResult = loadSpec(dirPath, fsOps);
+    if (!baseResult.ok)
+        return baseResult;
+    // Resolve flat imports — import local: refs resolve relative to the base spec's directory
+    return resolveWithImports(baseResult.resolved, baseResult.resolved.sourcePath, fsOps, new Set([baseResult.resolved.sourcePath]));
+}
+/**
+ * Resolve imports for an already-loaded AgentSpec.
+ * Import local: refs resolve relative to the spec's own directory.
+ * @param resolved - already-resolved base spec
+ * @param fsOps - injectable filesystem operations
+ * @returns structured resolve result with imports and collisions
+ */
+export function resolveImports(resolved, fsOps) {
+    return resolveWithImports(resolved, resolved.sourcePath, fsOps, new Set([resolved.sourcePath]));
+}
+/**
+ * Resolve a single agent_ref without following imports. Used for import targets.
+ * @param ref - import ref string
+ * @param basePath - directory to resolve local: refs relative to
+ * @param fsOps - filesystem ops
+ * @returns resolved spec or error
+ */
+function loadSpec(dirPath, fsOps) {
+    const manifestPath = nodePath.join(dirPath, "agent.yaml");
+    if (!fsOps.exists(manifestPath)) {
+        return { ok: false, code: "not_found", error: `No agent.yaml found at ${manifestPath}` };
+    }
+    let rawYaml;
+    try {
+        rawYaml = fsOps.readFile(manifestPath);
+    }
+    catch (err) {
+        return { ok: false, code: "parse_error", error: `Cannot read ${manifestPath}: ${err.message}` };
+    }
+    let raw;
+    try {
+        raw = parseAgentSpec(rawYaml);
+    }
+    catch (err) {
+        return { ok: false, code: "parse_error", error: `Cannot parse ${manifestPath}: ${err.message}` };
+    }
+    const validation = validateAgentSpec(raw);
+    if (!validation.valid) {
+        return { ok: false, code: "validation_failed", errors: validation.errors };
+    }
+    const spec = normalizeAgentSpec(raw);
+    const hash = createHash("sha256").update(rawYaml).digest("hex");
+    return {
+        ok: true,
+        resolved: { spec, sourcePath: dirPath, hash },
+    };
+}
+/**
+ * Resolve base spec + flat imports, detect collisions, enforce v1 constraints.
+ */
+/**
+ * Resolve base spec + flat imports. Import local: refs resolve relative to specDir
+ * (the importing spec's own directory), not the rig root.
+ */
+function resolveWithImports(base, specDir, fsOps, visitedPaths) {
+    const resolvedImports = [];
+    const importNames = new Set();
+    for (const imp of base.spec.imports) {
+        // Remote sources already rejected by AS-T01 validation, but double-check at resolve time
+        if (!imp.ref.startsWith("local:") && !imp.ref.startsWith("path:")) {
+            return { ok: false, code: "import_error", error: `Remote import source not supported in v1: "${imp.ref}"`, importRef: imp.ref };
+        }
+        const importDir = resolveRefToAbsPath(imp.ref, specDir);
+        if (!importDir) {
+            return { ok: false, code: "import_error", error: `Cannot resolve import ref "${imp.ref}"`, importRef: imp.ref };
+        }
+        // Cycle detection
+        if (visitedPaths.has(importDir)) {
+            return { ok: false, code: "cycle_detected", error: `Import cycle detected: "${imp.ref}" resolves to already-visited path ${importDir}` };
+        }
+        const importResult = loadSpec(importDir, fsOps);
+        if (!importResult.ok) {
+            if (importResult.code === "not_found") {
+                return { ok: false, code: "import_error", error: importResult.error, importRef: imp.ref };
+            }
+            if (importResult.code === "validation_failed") {
+                return { ok: false, code: "import_error", error: `Imported spec at "${imp.ref}" has validation errors: ${importResult.errors.join("; ")}`, importRef: imp.ref };
+            }
+            return { ok: false, code: "import_error", error: importResult.error, importRef: imp.ref };
+        }
+        const importedSpec = importResult.resolved;
+        // Version check
+        if (imp.version && importedSpec.spec.version !== imp.version) {
+            return {
+                ok: false, code: "version_mismatch",
+                error: `Import "${imp.ref}" requires version "${imp.version}" but spec declares "${importedSpec.spec.version}"`,
+            };
+        }
+        // v1: imported specs must not declare their own imports (no transitive)
+        if (importedSpec.spec.imports.length > 0) {
+            return {
+                ok: false, code: "import_error",
+                error: `Imported spec "${importedSpec.spec.name}" declares nested imports, which are not supported in v1`,
+                importRef: imp.ref,
+            };
+        }
+        // Imported spec name must not contain colon (conflicts with qualified ref syntax)
+        if (importedSpec.spec.name.includes(":")) {
+            return {
+                ok: false, code: "import_error",
+                error: `Imported spec name "${importedSpec.spec.name}" contains colon, which conflicts with qualified ref syntax (namespace:id)`,
+                importRef: imp.ref,
+            };
+        }
+        // Duplicate import names
+        if (importNames.has(importedSpec.spec.name)) {
+            return {
+                ok: false, code: "import_error",
+                error: `Duplicate import name: two imports resolve to specs both named "${importedSpec.spec.name}"`,
+                importRef: imp.ref,
+            };
+        }
+        importNames.add(importedSpec.spec.name);
+        resolvedImports.push(importedSpec);
+    }
+    // Detect resource collisions
+    const collisions = detectCollisions(base, resolvedImports);
+    return { ok: true, resolved: base, imports: resolvedImports, collisions };
+}
+// -- Collision detection --
+function detectCollisions(base, imports) {
+    const collisions = [];
+    for (const category of RESOURCE_CATEGORIES) {
+        // Build a map of resourceId -> sources
+        const idSources = new Map();
+        // Base spec resources (unqualified id)
+        const baseResources = base.spec.resources[category];
+        for (const r of baseResources) {
+            const sources = idSources.get(r.id) ?? [];
+            sources.push({ specName: base.spec.name, qualifiedId: r.id });
+            idSources.set(r.id, sources);
+        }
+        // Imported spec resources (qualified id)
+        for (const imp of imports) {
+            const importResources = imp.spec.resources[category];
+            for (const r of importResources) {
+                const sources = idSources.get(r.id) ?? [];
+                sources.push({ specName: imp.spec.name, qualifiedId: `${imp.spec.name}:${r.id}` });
+                idSources.set(r.id, sources);
+            }
+        }
+        // Record collisions (any id with 2+ sources)
+        for (const [resourceId, sources] of idSources) {
+            if (sources.length >= 2) {
+                collisions.push({ category, resourceId, sources });
+            }
+        }
+    }
+    return collisions;
+}
+// -- Path resolution --
+function resolveRefToAbsPath(ref, baseDir) {
+    if (ref.startsWith("local:")) {
+        const relPath = ref.slice("local:".length);
+        if (!relPath)
+            return null;
+        return nodePath.resolve(baseDir, relPath);
+    }
+    if (ref.startsWith("path:")) {
+        const absPath = ref.slice("path:".length);
+        if (!absPath)
+            return null;
+        return absPath;
+    }
+    return null;
+}
+//# sourceMappingURL=agent-resolver.js.map

package/node_modules/@openrig/daemon/dist/domain/agent-resolver.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"agent-resolver.js","sourceRoot":"","sources":["../../src/domain/agent-resolver.ts"],"names":[],"mappings":"AAAA,OAAO,QAAQ,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,cAAc,EAAE,iBAAiB,EAAE,kBAAkB,EAAE,MAAM,qBAAqB,CAAC;AA+B5F,+BAA+B;AAE/B,MAAM,mBAAmB,GAA6B;IACpD,QAAQ,EAAE,UAAU,EAAE,WAAW,EAAE,SAAS,EAAE,kBAAkB;CACjE,CAAC;AAEF,mBAAmB;AAEnB;;;;;;GAMG;AACH,MAAM,UAAU,eAAe,CAC7B,GAAW,EACX,OAAe,EACf,KAAyB;IAEzB,MAAM,OAAO,GAAG,mBAAmB,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;IAClD,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,WAAW,EAAE,KAAK,EAAE,6BAA6B,GAAG,GAAG,EAAE,CAAC;IACtF,CAAC;IAED,MAAM,UAAU,GAAG,QAAQ,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;IAC5C,IAAI,CAAC,UAAU,CAAC,EAAE;QAAE,OAAO,UAAU,CAAC;IAEtC,0FAA0F;IAC1F,OAAO,kBAAkB,CAAC,UAAU,CAAC,QAAQ,EAAE,UAAU,CAAC,QAAQ,CAAC,UAAU,EAAE,KAAK,EAAE,IAAI,GAAG,CAAC,CAAC,UAAU,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC;AACnI,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,cAAc,CAC5B,QAA2B,EAC3B,KAAyB;IAEzB,OAAO,kBAAkB,CAAC,QAAQ,EAAE,QAAQ,CAAC,UAAU,EAAE,KAAK,EAAE,IAAI,GAAG,CAAC,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC;AAClG,CAAC;AAED;;;;;;GAMG;AACH,SAAS,QAAQ,CACf,OAAe,EACf,KAAyB;IAEzB,MAAM,YAAY,GAAG,QAAQ,CAAC,IAAI,CAAC,OAAO,EAAE,YAAY,CAAC,CAAC;IAE1D,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,YAAY,CAAC,EAAE,CAAC;QAChC,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,WAAW,EAAE,KAAK,EAAE,0BAA0B,YAAY,EAAE,EAAE,CAAC;IAC3F,CAAC;IAED,IAAI,OAAe,CAAC;IACpB,IAAI,CAAC;QACH,OAAO,GAAG,KAAK,CAAC,QAAQ,CAAC,YAAY,CAAC,CAAC;IACzC,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,aAAa,EAAE,KAAK,EAAE,eAAe,YAAY,KAAM,GAAa,CAAC,OAAO,EAAE,EAAE,CAAC;IAC7G,CAAC;IAED,IAAI,GAA4B,CAAC;IACjC,IAAI,CAAC;QACH,GAAG,GAAG,cAAc,CAAC,OAAO,CAAC,CAAC;IAChC,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,aAAa,EAAE,KAAK,EAAE,gBAAgB,YAAY,KAAM,GAAa,CAAC,OAAO,EAAE,EAAE,CAAC;IAC9G,CAAC;IAED,MAAM,UAAU,GAAG,iBAAiB,CAAC,GAAG,CAAC,CAAC;IAC1C,IAAI,CAAC,UAAU,CAAC,KAAK,EAAE,CAAC;QACtB,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,mBAAmB,EAAE,MAAM,EAAE,UAAU,CAAC,MAAM,EAAE,CAAC;IAC7E,CAAC;IAED,MAAM,IAAI,GAAG,kBAAkB,CAAC,GAAG,CAAC,CAAC;IACrC,MAAM,IAAI,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IAEhE,OAAO;QACL,EAAE,EAAE,IAAI;QACR,QAAQ,EAAE,EAAE,IAAI,EAAE,UAAU,EAAE,OAAO,EAAE,IAAI,EAAE;KAC9C,CAAC;AACJ,CAAC;AAED;;GAEG;AACH;;;GAGG;AACH,SAAS,kBAAkB,CACzB,IAAuB,EACvB,OAAe,EACf,KAAyB,EACzB,YAAyB;IAEzB,MAAM,eAAe,GAAwB,EAAE,CAAC;IAChD,MAAM,WAAW,GAAG,IAAI,GAAG,EAAU,CAAC;IAEtC,KAAK,MAAM,GAAG,IAAI,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC;QACpC,yFAAyF;QACzF,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,UAAU,CAAC,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,UAAU,CAAC,OAAO,CAAC,EAAE,CAAC;YAClE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,cAAc,EAAE,KAAK,EAAE,8CAA8C,GAAG,CAAC,GAAG,GAAG,EAAE,SAAS,EAAE,GAAG,CAAC,GAAG,EAAE,CAAC;QAClI,CAAC;QAED,MAAM,SAAS,GAAG,mBAAmB,CAAC,GAAG,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;QACxD,IAAI,CAAC,SAAS,EAAE,CAAC;YACf,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,cAAc,EAAE,KAAK,EAAE,8BAA8B,GAAG,CAAC,GAAG,GAAG,EAAE,SAAS,EAAE,GAAG,CAAC,GAAG,EAAE,CAAC;QAClH,CAAC;QAED,kBAAkB;QAClB,IAAI,YAAY,CAAC,GAAG,CAAC,SAAS,CAAC,EAAE,CAAC;YAChC,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,gBAAgB,EAAE,KAAK,EAAE,2BAA2B,GAAG,CAAC,GAAG,sCAAsC,SAAS,EAAE,EAAE,CAAC;QAC3I,CAAC;QAED,MAAM,YAAY,GAAG,QAAQ,CAAC,SAAS,EAAE,KAAK,CAAC,CAAC;QAChD,IAAI,CAAC,YAAY,CAAC,EAAE,EAAE,CAAC;YACrB,IAAI,YAAY,CAAC,IAAI,KAAK,WAAW,EAAE,CAAC;gBACtC,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,cAAc,EAAE,KAAK,EAAE,YAAY,CAAC,KAAK,EAAE,SAAS,EAAE,GAAG,CAAC,GAAG,EAAE,CAAC;YAC5F,CAAC;YACD,IAAI,YAAY,CAAC,IAAI,KAAK,mBAAmB,EAAE,CAAC;gBAC9C,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,cAAc,EAAE,KAAK,EAAE,qBAAqB,GAAG,CAAC,GAAG,4BAA4B,YAAY,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE,SAAS,EAAE,GAAG,CAAC,GAAG,EAAE,CAAC;YAClK,CAAC;YACD,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,cAAc,EAAE,KAAK,EAAE,YAAY,CAAC,KAAK,EAAE,SAAS,EAAE,GAAG,CAAC,GAAG,EAAE,CAAC;QAC5F,CAAC;QAED,MAAM,YAAY,GAAG,YAAY,CAAC,QAAQ,CAAC;QAE3C,gBAAgB;QAChB,IAAI,GAAG,CAAC,OAAO,IAAI,YAAY,CAAC,IAAI,CAAC,OAAO,KAAK,GAAG,CAAC,OAAO,EAAE,CAAC;YAC7D,OAAO;gBACL,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,kBAAkB;gBACnC,KAAK,EAAE,WAAW,GAAG,CAAC,GAAG,uBAAuB,GAAG,CAAC,OAAO,wBAAwB,YAAY,CAAC,IAAI,CAAC,OAAO,GAAG;aAChH,CAAC;QACJ,CAAC;QAED,wEAAwE;QACxE,IAAI,YAAY,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACzC,OAAO;gBACL,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,cAAc;gBAC/B,KAAK,EAAE,kBAAkB,YAAY,CAAC,IAAI,CAAC,IAAI,0DAA0D;gBACzG,SAAS,EAAE,GAAG,CAAC,GAAG;aACnB,CAAC;QACJ,CAAC;QAED,kFAAkF;QAClF,IAAI,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;YACzC,OAAO;gBACL,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,cAAc;gBAC/B,KAAK,EAAE,uBAAuB,YAAY,CAAC,IAAI,CAAC,IAAI,4EAA4E;gBAChI,SAAS,EAAE,GAAG,CAAC,GAAG;aACnB,CAAC;QACJ,CAAC;QAED,yBAAyB;QACzB,IAAI,WAAW,CAAC,GAAG,CAAC,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;YAC5C,OAAO;gBACL,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,cAAc;gBAC/B,KAAK,EAAE,mEAAmE,YAAY,CAAC,IAAI,CAAC,IAAI,GAAG;gBACnG,SAAS,EAAE,GAAG,CAAC,GAAG;aACnB,CAAC;QACJ,CAAC;QACD,WAAW,CAAC,GAAG,CAAC,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAExC,eAAe,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;IACrC,CAAC;IAED,6BAA6B;IAC7B,MAAM,UAAU,GAAG,gBAAgB,CAAC,IAAI,EAAE,eAAe,CAAC,CAAC;IAE3D,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,OAAO,EAAE,eAAe,EAAE,UAAU,EAAE,CAAC;AAC5E,CAAC;AAED,4BAA4B;AAE5B,SAAS,gBAAgB,CAAC,IAAuB,EAAE,OAA4B;IAC7E,MAAM,UAAU,GAAwB,EAAE,CAAC;IAE3C,KAAK,MAAM,QAAQ,IAAI,mBAAmB,EAAE,CAAC;QAC3C,uCAAuC;QACvC,MAAM,SAAS,GAAG,IAAI,GAAG,EAA4D,CAAC;QAEtF,uCAAuC;QACvC,MAAM,aAAa,GAAG,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,QAAQ,CAA0B,CAAC;QAC7E,KAAK,MAAM,CAAC,IAAI,aAAa,EAAE,CAAC;YAC9B,MAAM,OAAO,GAAG,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,IAAI,EAAE,CAAC;YAC1C,OAAO,CAAC,IAAI,CAAC,EAAE,QAAQ,EAAE,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,WAAW,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;YAC9D,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,OAAO,CAAC,CAAC;QAC/B,CAAC;QAED,yCAAyC;QACzC,KAAK,MAAM,GAAG,IAAI,OAAO,EAAE,CAAC;YAC1B,MAAM,eAAe,GAAG,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,QAAQ,CAA0B,CAAC;YAC9E,KAAK,MAAM,CAAC,IAAI,eAAe,EAAE,CAAC;gBAChC,MAAM,OAAO,GAAG,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,IAAI,EAAE,CAAC;gBAC1C,OAAO,CAAC,IAAI,CAAC,EAAE,QAAQ,EAAE,GAAG,CAAC,IAAI,CAAC,IAAI,EAAE,WAAW,EAAE,GAAG,GAAG,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC;gBACnF,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,OAAO,CAAC,CAAC;YAC/B,CAAC;QACH,CAAC;QAED,6CAA6C;QAC7C,KAAK,MAAM,CAAC,UAAU,EAAE,OAAO,CAAC,IAAI,SAAS,EAAE,CAAC;YAC9C,IAAI,OAAO,CAAC,MAAM,IAAI,CAAC,EAAE,CAAC;gBACxB,UAAU,CAAC,IAAI,CAAC,EAAE,QAAQ,EAAE,UAAU,EAAE,OAAO,EAAE,CAAC,CAAC;YACrD,CAAC;QACH,CAAC;IACH,CAAC;IAED,OAAO,UAAU,CAAC;AACpB,CAAC;AAED,wBAAwB;AAExB,SAAS,mBAAmB,CAAC,GAAW,EAAE,OAAe;IACvD,IAAI,GAAG,CAAC,UAAU,CAAC,QAAQ,CAAC,EAAE,CAAC;QAC7B,MAAM,OAAO,GAAG,GAAG,CAAC,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;QAC3C,IAAI,CAAC,OAAO;YAAE,OAAO,IAAI,CAAC;QAC1B,OAAO,QAAQ,CAAC,OAAO,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;IAC5C,CAAC;IACD,IAAI,GAAG,CAAC,UAAU,CAAC,OAAO,CAAC,EAAE,CAAC;QAC5B,MAAM,OAAO,GAAG,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;QAC1C,IAAI,CAAC,OAAO;YAAE,OAAO,IAAI,CAAC;QAC1B,OAAO,OAAO,CAAC;IACjB,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC"}

package/node_modules/@openrig/daemon/dist/domain/agent-starter-resolver.d.ts

@@ -0,0 +1,94 @@
+import type { ResolvedStartupFile } from "./runtime-adapter.js";
+/**
+ * Daemon-side productized resolver for the Agent Starter v1 vertical (M1).
+ * Mirrors the v0 wrapper-tier `bin/agent-starter-resolve` semantics:
+ * read the named registry entry; run the path-aware no-credentials scan;
+ * THROW on a failed scan (the orchestrator MUST treat any throw as a
+ * hard launch failure); on a clean scan, emit a `ResolvedStartupFile[]` rooted at the
+ * registry directory.
+ *
+ * v0 wrapper references:
+ * - Schema spec: `specs/agent-starters/SCHEMA.md` § No-Credentials Proof
+ *   (path-aware + content-aware; allowlist for transcript_path under
+ *   ~/.claude/projects/ or ~/.openrig/transcripts/).
+ * - Refusal verb: `specs/agent-starters/bin/agent-starter-resolve` lines
+ *   22-31 (preflights via `scan_starter_file`; refuses with
+ *   credential_path_disallowed / credential_content_disallowed).
+ *
+ * Pattern reference for the resolver shape:
+ * `session-source-rebuild-resolver.ts:31-90`.
+ */
+export type ExistsFn = (path: string) => boolean;
+export type ReadFileFn = (path: string) => string;
+export interface AgentStarterResolverOpts {
+    /** Optional absolute override; bypasses the lookup chain. */
+    registryRoot?: string;
+    /**
+     * Env var consulted second in the lookup chain. Defaults to
+     * `OPENRIG_AGENT_STARTER_ROOT`.
+     */
+    envVarName?: string;
+    /**
+     * Home-directory root consulted third. Defaults to
+     * `~/.openrig/agent-starters/` (resolved against `process.env.HOME` or
+     * `os.homedir()`).
+     */
+    homeDirRoot?: string;
+    /** Optional fallback consulted last when the home registry is absent. */
+    fallbackRoot?: string;
+    exists?: ExistsFn;
+    readFile?: ReadFileFn;
+    /** Test seam: lets unit tests inject a controlled env map. */
+    env?: Record<string, string | undefined>;
+}
+export interface AgentStarterResolveResult {
+    files: ResolvedStartupFile[];
+    registryPath: string;
+}
+/**
+ * Thrown by `resolveStarter` when the no-credentials scan fails. The
+ * resolver MUST throw rather than
+ * return a structured "ok: false" result the orchestrator could ignore;
+ * a failed scan is a hard refusal point that aborts the launch.
+ */
+export declare class AgentStarterCredentialScanFailedError extends Error {
+    readonly starterName: string;
+    readonly reason: string;
+    constructor(starterName: string, reason: string);
+}
+export declare class AgentStarterResolver {
+    private readonly registryRoot;
+    private readonly exists;
+    private readonly readFile;
+    constructor(opts?: AgentStarterResolverOpts);
+    /** Exposed for tests + diagnostics. */
+    getRegistryRoot(): string;
+    /**
+     * Look up the registry root via the documented chain:
+     *   opts.registryRoot > env[envVarName] > homeDirRoot (if exists) > fallbackRoot
+     *
+     * The fallback returns even if the path doesn't exist. `resolveStarter`
+     * throws a missing-entry error when the selected root is dead. This keeps
+     * the constructor side-effect-free; the file-existence check lives inside
+     * `resolveStarter`.
+     */
+    static resolveRegistryRoot(opts: AgentStarterResolverOpts, exists: ExistsFn): string;
+    /**
+     * Resolve a starter by registry name. THROWS on:
+     * - missing registry entry (no `<root>/<name>.yaml`);
+     * - malformed YAML (best-effort detection — empty file, unparseable
+     *   front-matter shape — driver does not pull in a YAML parser at
+     *   M1 to keep the dependency surface narrow);
+     * - failed no-credentials scan (`AgentStarterCredentialScanFailedError`).
+     *
+     * On a clean scan, emits `ResolvedStartupFile[]`. v1 M1 scaffolding
+     * shape: one entry per registry-relative file the starter declares
+     * (currently the registry entry YAML itself, treated as guidance_merge
+     * content; later milestones can extend the resolver to walk the
+     * priming-pack manifest's `read_full` paths once M2/M3 wiring is in
+     * place). All emitted files are tagged `appliesOn: ["fresh_start"]`
+     * because starter context seeds a fresh-launch conversation.
+     */
+    resolveStarter(name: string): AgentStarterResolveResult;
+}
+//# sourceMappingURL=agent-starter-resolver.d.ts.map

package/node_modules/@openrig/daemon/dist/domain/agent-starter-resolver.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"agent-starter-resolver.d.ts","sourceRoot":"","sources":["../../src/domain/agent-starter-resolver.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,sBAAsB,CAAC;AAEhE;;;;;;;;;;;;;;;;;;GAkBG;AAEH,MAAM,MAAM,QAAQ,GAAG,CAAC,IAAI,EAAE,MAAM,KAAK,OAAO,CAAC;AACjD,MAAM,MAAM,UAAU,GAAG,CAAC,IAAI,EAAE,MAAM,KAAK,MAAM,CAAC;AAElD,MAAM,WAAW,wBAAwB;IACvC,6DAA6D;IAC7D,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB;;;OAGG;IACH,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB;;;;OAIG;IACH,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,yEAAyE;IACzE,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,MAAM,CAAC,EAAE,QAAQ,CAAC;IAClB,QAAQ,CAAC,EAAE,UAAU,CAAC;IACtB,8DAA8D;IAC9D,GAAG,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC,CAAC;CAC1C;AAED,MAAM,WAAW,yBAAyB;IACxC,KAAK,EAAE,mBAAmB,EAAE,CAAC;IAC7B,YAAY,EAAE,MAAM,CAAC;CACtB;AAED;;;;;GAKG;AACH,qBAAa,qCAAsC,SAAQ,KAAK;IAC9D,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;gBACZ,WAAW,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM;CAMhD;AAID,qBAAa,oBAAoB;IAC/B,OAAO,CAAC,QAAQ,CAAC,YAAY,CAAS;IACtC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAW;IAClC,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAa;gBAE1B,IAAI,GAAE,wBAA6B;IAM/C,uCAAuC;IACvC,eAAe,IAAI,MAAM;IAIzB;;;;;;;;OAQG;IACH,MAAM,CAAC,mBAAmB,CACxB,IAAI,EAAE,wBAAwB,EAC9B,MAAM,EAAE,QAAQ,GACf,MAAM;IAkBT;;;;;;;;;;;;;;;OAeG;IACH,cAAc,CAAC,IAAI,EAAE,MAAM,GAAG,yBAAyB;CAgExD"}

package/node_modules/@openrig/daemon/dist/domain/agent-starter-resolver.js

@@ -0,0 +1,198 @@
+import { existsSync, readFileSync } from "node:fs";
+import { join, basename } from "node:path";
+import os from "node:os";
+/**
+ * Thrown by `resolveStarter` when the no-credentials scan fails. The
+ * resolver MUST throw rather than
+ * return a structured "ok: false" result the orchestrator could ignore;
+ * a failed scan is a hard refusal point that aborts the launch.
+ */
+export class AgentStarterCredentialScanFailedError extends Error {
+    starterName;
+    reason;
+    constructor(starterName, reason) {
+        super(`Agent Starter "${starterName}" credential scan failed: ${reason}`);
+        this.name = "AgentStarterCredentialScanFailedError";
+        this.starterName = starterName;
+        this.reason = reason;
+    }
+}
+const DEFAULT_ENV_VAR = "OPENRIG_AGENT_STARTER_ROOT";
+const DEFAULT_HOME_SUBPATH = ".openrig/agent-starters";
+export class AgentStarterResolver {
+    registryRoot;
+    exists;
+    readFile;
+    constructor(opts = {}) {
+        this.exists = opts.exists ?? existsSync;
+        this.readFile = opts.readFile ?? ((p) => readFileSync(p, "utf-8"));
+        this.registryRoot = AgentStarterResolver.resolveRegistryRoot(opts, this.exists);
+    }
+    /** Exposed for tests + diagnostics. */
+    getRegistryRoot() {
+        return this.registryRoot;
+    }
+    /**
+     * Look up the registry root via the documented chain:
+     *   opts.registryRoot > env[envVarName] > homeDirRoot (if exists) > fallbackRoot
+     *
+     * The fallback returns even if the path doesn't exist. `resolveStarter`
+     * throws a missing-entry error when the selected root is dead. This keeps
+     * the constructor side-effect-free; the file-existence check lives inside
+     * `resolveStarter`.
+     */
+    static resolveRegistryRoot(opts, exists) {
+        if (typeof opts.registryRoot === "string" && opts.registryRoot !== "") {
+            return opts.registryRoot;
+        }
+        const env = opts.env ?? process.env;
+        const envVarName = opts.envVarName ?? DEFAULT_ENV_VAR;
+        const fromEnv = env[envVarName];
+        if (typeof fromEnv === "string" && fromEnv !== "") {
+            return fromEnv;
+        }
+        const homeBase = opts.homeDirRoot
+            ?? join(env.HOME ?? os.homedir(), DEFAULT_HOME_SUBPATH);
+        if (exists(homeBase)) {
+            return homeBase;
+        }
+        return opts.fallbackRoot ?? homeBase;
+    }
+    /**
+     * Resolve a starter by registry name. THROWS on:
+     * - missing registry entry (no `<root>/<name>.yaml`);
+     * - malformed YAML (best-effort detection — empty file, unparseable
+     *   front-matter shape — driver does not pull in a YAML parser at
+     *   M1 to keep the dependency surface narrow);
+     * - failed no-credentials scan (`AgentStarterCredentialScanFailedError`).
+     *
+     * On a clean scan, emits `ResolvedStartupFile[]`. v1 M1 scaffolding
+     * shape: one entry per registry-relative file the starter declares
+     * (currently the registry entry YAML itself, treated as guidance_merge
+     * content; later milestones can extend the resolver to walk the
+     * priming-pack manifest's `read_full` paths once M2/M3 wiring is in
+     * place). All emitted files are tagged `appliesOn: ["fresh_start"]`
+     * because starter context seeds a fresh-launch conversation.
+     */
+    resolveStarter(name) {
+        if (!/^[a-zA-Z0-9][a-zA-Z0-9_-]*$/.test(name)) {
+            throw new Error(`Agent Starter resolver: invalid name ${JSON.stringify(name)} (must be alphanumeric with optional "_" or "-")`);
+        }
+        const registryPath = join(this.registryRoot, `${name}.yaml`);
+        if (!this.exists(registryPath)) {
+            throw new Error(`Agent Starter resolver: no registry entry found at ${registryPath}`);
+        }
+        let content;
+        try {
+            content = this.readFile(registryPath);
+        }
+        catch (err) {
+            throw new Error(`Agent Starter resolver: failed to read ${registryPath}: ${err.message}`);
+        }
+        if (typeof content !== "string" || content.trim() === "") {
+            throw new Error(`Agent Starter resolver: ${registryPath} is empty or unreadable`);
+        }
+        // Smoke check that the file parses as YAML front-matter shape: it must
+        // contain `starter_id:` line. Keeps M1 dependency surface narrow (no
+        // yaml parser pulled in); M2 can swap in a real parser when it walks
+        // the priming-pack manifest.
+        if (!/^starter_id:\s*\S+/m.test(content)) {
+            throw new Error(`Agent Starter resolver: ${registryPath} does not match registry-entry shape (missing "starter_id:" field)`);
+        }
+        // Path-aware + content-aware credential scan. Mirrors the v0 wrapper
+        // helper at `specs/agent-starters/lib/agent-starter-helpers.sh`
+        // `scan_starter_file`. THROWS on match instead of returning a
+        // recoverable result.
+        const scanResult = scanForCredentials(content, registryPath);
+        if (!scanResult.ok) {
+            throw new AgentStarterCredentialScanFailedError(name, scanResult.reason);
+        }
+        // M1 scaffolding shape: one ResolvedStartupFile pointing at the
+        // registry entry itself. The orchestrator's `deliverStartup` seam
+        // already accepts `deliveryHint: "guidance_merge"`. Later milestones
+        // (M2 instantiator integration; M3 Claude e2e; M4 Codex parity) can
+        // extend the resolver to walk the priming-pack manifest's `read_full`
+        // paths if the e2e proof requires richer per-layer artifacts. The
+        // type contract and refusal semantics are what M1 is locking in.
+        const files = [
+            {
+                path: basename(registryPath),
+                absolutePath: registryPath,
+                ownerRoot: this.registryRoot,
+                deliveryHint: "guidance_merge",
+                required: true,
+                appliesOn: ["fresh_start"],
+            },
+        ];
+        return { files, registryPath };
+    }
+}
+// --- No-credentials scan (mirrors `lib/agent-starter-helpers.sh::scan_starter_file`) ---
+const CRED_PATH_LITERALS = [
+    ".claude/.credentials.json",
+    ".codex/auth.json",
+    ".aws/credentials",
+    ".ssh/",
+];
+const CRED_PATH_RE = /(credentials|auth\.json|secrets|tokens?\.json)([^a-zA-Z0-9._-]|$)/;
+const CRED_STRING_RE = /(api[_-]?key|secret[_-]?key|bearer[_-]?token|sk-[A-Za-z0-9]{20,}|gh[ps]_[A-Za-z0-9]{20,}|password[\s]*[:=])/i;
+function scanForCredentials(content, filePath) {
+    // Allowlist exception: `transcript_path` field values under
+    // `~/.claude/projects/` or `~/.openrig/transcripts/` are accepted
+    // (mirrors the v0 wrapper); same paths under any other field/key/comment
+    // are rejected as suspicious copying.
+    const transcriptPath = extractFieldValue(content, "transcript_path");
+    let lineNo = 0;
+    for (const rawLine of content.split("\n")) {
+        lineNo += 1;
+        const line = rawLine;
+        // Allowlist check for transcript_path's own line.
+        const stripped = line.replace(/^\s+/, "");
+        let isAllowlistedTranscript = false;
+        if (transcriptPath && stripped.startsWith("transcript_path:")) {
+            if (transcriptPath.includes("/.claude/projects/")
+                || transcriptPath.includes("/.openrig/transcripts/")) {
+                isAllowlistedTranscript = true;
+            }
+        }
+        // 1. Literal credential paths.
+        // Refusal reason intentionally REDACTS the matched line content. The
+        // daemon-tier resolver flows error messages into logs/API responses;
+        // echoing the matched line would leak the credential-bearing content
+        // the deny-list is meant to catch. Operators see refusal code + line
+        // number + file path; that's enough to triage. Closes the v0 wrapper
+        // diagnostic-`match`-field caveat at the daemon-tier productization
+        // layer.
+        for (const literal of CRED_PATH_LITERALS) {
+            if (line.includes(literal)) {
+                return {
+                    ok: false,
+                    reason: `credential_path_disallowed: line ${lineNo} of ${filePath} matches a deny-list literal credential path (content redacted)`,
+                };
+            }
+        }
+        // 2. Path regex (credentials|auth.json|secrets|tokens.json).
+        if (!isAllowlistedTranscript && CRED_PATH_RE.test(line)) {
+            return {
+                ok: false,
+                reason: `credential_path_disallowed: line ${lineNo} of ${filePath} matches credential path pattern (content redacted)`,
+            };
+        }
+        // 3. Credential string regex (case-insensitive).
+        if (CRED_STRING_RE.test(line)) {
+            return {
+                ok: false,
+                reason: `credential_content_disallowed: line ${lineNo} of ${filePath} matches credential content pattern (content redacted)`,
+            };
+        }
+    }
+    return { ok: true };
+}
+function extractFieldValue(content, field) {
+    const re = new RegExp(`^\\s*${field}:\\s*(.*?)\\s*$`, "m");
+    const match = content.match(re);
+    if (!match || !match[1])
+        return "";
+    return match[1].replace(/^['"]|['"]$/g, "").trim();
+}
+//# sourceMappingURL=agent-starter-resolver.js.map

package/node_modules/@openrig/daemon/dist/domain/agent-starter-resolver.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"agent-starter-resolver.js","sourceRoot":"","sources":["../../src/domain/agent-starter-resolver.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AACnD,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,WAAW,CAAC;AAC3C,OAAO,EAAE,MAAM,SAAS,CAAC;AAqDzB;;;;;GAKG;AACH,MAAM,OAAO,qCAAsC,SAAQ,KAAK;IACrD,WAAW,CAAS;IACpB,MAAM,CAAS;IACxB,YAAY,WAAmB,EAAE,MAAc;QAC7C,KAAK,CAAC,kBAAkB,WAAW,6BAA6B,MAAM,EAAE,CAAC,CAAC;QAC1E,IAAI,CAAC,IAAI,GAAG,uCAAuC,CAAC;QACpD,IAAI,CAAC,WAAW,GAAG,WAAW,CAAC;QAC/B,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;IACvB,CAAC;CACF;AAED,MAAM,eAAe,GAAG,4BAA4B,CAAC;AACrD,MAAM,oBAAoB,GAAG,yBAAyB,CAAC;AACvD,MAAM,OAAO,oBAAoB;IACd,YAAY,CAAS;IACrB,MAAM,CAAW;IACjB,QAAQ,CAAa;IAEtC,YAAY,OAAiC,EAAE;QAC7C,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC,MAAM,IAAI,UAAU,CAAC;QACxC,IAAI,CAAC,QAAQ,GAAG,IAAI,CAAC,QAAQ,IAAI,CAAC,CAAC,CAAS,EAAE,EAAE,CAAC,YAAY,CAAC,CAAC,EAAE,OAAO,CAAC,CAAC,CAAC;QAC3E,IAAI,CAAC,YAAY,GAAG,oBAAoB,CAAC,mBAAmB,CAAC,IAAI,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC;IAClF,CAAC;IAED,uCAAuC;IACvC,eAAe;QACb,OAAO,IAAI,CAAC,YAAY,CAAC;IAC3B,CAAC;IAED;;;;;;;;OAQG;IACH,MAAM,CAAC,mBAAmB,CACxB,IAA8B,EAC9B,MAAgB;QAEhB,IAAI,OAAO,IAAI,CAAC,YAAY,KAAK,QAAQ,IAAI,IAAI,CAAC,YAAY,KAAK,EAAE,EAAE,CAAC;YACtE,OAAO,IAAI,CAAC,YAAY,CAAC;QAC3B,CAAC;QACD,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,IAAI,OAAO,CAAC,GAAG,CAAC;QACpC,MAAM,UAAU,GAAG,IAAI,CAAC,UAAU,IAAI,eAAe,CAAC;QACtD,MAAM,OAAO,GAAG,GAAG,CAAC,UAAU,CAAC,CAAC;QAChC,IAAI,OAAO,OAAO,KAAK,QAAQ,IAAI,OAAO,KAAK,EAAE,EAAE,CAAC;YAClD,OAAO,OAAO,CAAC;QACjB,CAAC;QACD,MAAM,QAAQ,GAAG,IAAI,CAAC,WAAW;eAC5B,IAAI,CAAC,GAAG,CAAC,IAAI,IAAI,EAAE,CAAC,OAAO,EAAE,EAAE,oBAAoB,CAAC,CAAC;QAC1D,IAAI,MAAM,CAAC,QAAQ,CAAC,EAAE,CAAC;YACrB,OAAO,QAAQ,CAAC;QAClB,CAAC;QACD,OAAO,IAAI,CAAC,YAAY,IAAI,QAAQ,CAAC;IACvC,CAAC;IAED;;;;;;;;;;;;;;;OAeG;IACH,cAAc,CAAC,IAAY;QACzB,IAAI,CAAC,6BAA6B,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;YAC9C,MAAM,IAAI,KAAK,CACb,wCAAwC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,kDAAkD,CAC/G,CAAC;QACJ,CAAC;QACD,MAAM,YAAY,GAAG,IAAI,CAAC,IAAI,CAAC,YAAY,EAAE,GAAG,IAAI,OAAO,CAAC,CAAC;QAC7D,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,YAAY,CAAC,EAAE,CAAC;YAC/B,MAAM,IAAI,KAAK,CACb,sDAAsD,YAAY,EAAE,CACrE,CAAC;QACJ,CAAC;QACD,IAAI,OAAe,CAAC;QACpB,IAAI,CAAC;YACH,OAAO,GAAG,IAAI,CAAC,QAAQ,CAAC,YAAY,CAAC,CAAC;QACxC,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,IAAI,KAAK,CACb,0CAA0C,YAAY,KAAM,GAAa,CAAC,OAAO,EAAE,CACpF,CAAC;QACJ,CAAC;QACD,IAAI,OAAO,OAAO,KAAK,QAAQ,IAAI,OAAO,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC;YACzD,MAAM,IAAI,KAAK,CACb,2BAA2B,YAAY,yBAAyB,CACjE,CAAC;QACJ,CAAC;QACD,uEAAuE;QACvE,qEAAqE;QACrE,qEAAqE;QACrE,6BAA6B;QAC7B,IAAI,CAAC,qBAAqB,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;YACzC,MAAM,IAAI,KAAK,CACb,2BAA2B,YAAY,oEAAoE,CAC5G,CAAC;QACJ,CAAC;QAED,qEAAqE;QACrE,gEAAgE;QAChE,8DAA8D;QAC9D,sBAAsB;QACtB,MAAM,UAAU,GAAG,kBAAkB,CAAC,OAAO,EAAE,YAAY,CAAC,CAAC;QAC7D,IAAI,CAAC,UAAU,CAAC,EAAE,EAAE,CAAC;YACnB,MAAM,IAAI,qCAAqC,CAAC,IAAI,EAAE,UAAU,CAAC,MAAM,CAAC,CAAC;QAC3E,CAAC;QAED,gEAAgE;QAChE,kEAAkE;QAClE,qEAAqE;QACrE,oEAAoE;QACpE,sEAAsE;QACtE,kEAAkE;QAClE,iEAAiE;QACjE,MAAM,KAAK,GAA0B;YACnC;gBACE,IAAI,EAAE,QAAQ,CAAC,YAAY,CAAC;gBAC5B,YAAY,EAAE,YAAY;gBAC1B,SAAS,EAAE,IAAI,CAAC,YAAY;gBAC5B,YAAY,EAAE,gBAAgB;gBAC9B,QAAQ,EAAE,IAAI;gBACd,SAAS,EAAE,CAAC,aAAa,CAAC;aAC3B;SACF,CAAC;QAEF,OAAO,EAAE,KAAK,EAAE,YAAY,EAAE,CAAC;IACjC,CAAC;CACF;AAED,0FAA0F;AAE1F,MAAM,kBAAkB,GAAG;IACzB,2BAA2B;IAC3B,kBAAkB;IAClB,kBAAkB;IAClB,OAAO;CACR,CAAC;AAEF,MAAM,YAAY,GAAG,mEAAmE,CAAC;AACzF,MAAM,cAAc,GAAG,8GAA8G,CAAC;AAEtI,SAAS,kBAAkB,CACzB,OAAe,EACf,QAAgB;IAEhB,4DAA4D;IAC5D,kEAAkE;IAClE,yEAAyE;IACzE,sCAAsC;IACtC,MAAM,cAAc,GAAG,iBAAiB,CAAC,OAAO,EAAE,iBAAiB,CAAC,CAAC;IAErE,IAAI,MAAM,GAAG,CAAC,CAAC;IACf,KAAK,MAAM,OAAO,IAAI,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;QAC1C,MAAM,IAAI,CAAC,CAAC;QACZ,MAAM,IAAI,GAAG,OAAO,CAAC;QAErB,kDAAkD;QAClD,MAAM,QAAQ,GAAG,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;QAC1C,IAAI,uBAAuB,GAAG,KAAK,CAAC;QACpC,IAAI,cAAc,IAAI,QAAQ,CAAC,UAAU,CAAC,kBAAkB,CAAC,EAAE,CAAC;YAC9D,IACE,cAAc,CAAC,QAAQ,CAAC,oBAAoB,CAAC;mBAC1C,cAAc,CAAC,QAAQ,CAAC,wBAAwB,CAAC,EACpD,CAAC;gBACD,uBAAuB,GAAG,IAAI,CAAC;YACjC,CAAC;QACH,CAAC;QAED,+BAA+B;QAC/B,qEAAqE;QACrE,qEAAqE;QACrE,qEAAqE;QACrE,qEAAqE;QACrE,qEAAqE;QACrE,oEAAoE;QACpE,SAAS;QACT,KAAK,MAAM,OAAO,IAAI,kBAAkB,EAAE,CAAC;YACzC,IAAI,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC;gBAC3B,OAAO;oBACL,EAAE,EAAE,KAAK;oBACT,MAAM,EAAE,oCAAoC,MAAM,OAAO,QAAQ,iEAAiE;iBACnI,CAAC;YACJ,CAAC;QACH,CAAC;QAED,6DAA6D;QAC7D,IAAI,CAAC,uBAAuB,IAAI,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;YACxD,OAAO;gBACL,EAAE,EAAE,KAAK;gBACT,MAAM,EAAE,oCAAoC,MAAM,OAAO,QAAQ,qDAAqD;aACvH,CAAC;QACJ,CAAC;QAED,iDAAiD;QACjD,IAAI,cAAc,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;YAC9B,OAAO;gBACL,EAAE,EAAE,KAAK;gBACT,MAAM,EAAE,uCAAuC,MAAM,OAAO,QAAQ,wDAAwD;aAC7H,CAAC;QACJ,CAAC;IACH,CAAC;IAED,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC;AACtB,CAAC;AAED,SAAS,iBAAiB,CAAC,OAAe,EAAE,KAAa;IACvD,MAAM,EAAE,GAAG,IAAI,MAAM,CAAC,QAAQ,KAAK,iBAAiB,EAAE,GAAG,CAAC,CAAC;IAC3D,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;IAChC,IAAI,CAAC,KAAK,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC;QAAE,OAAO,EAAE,CAAC;IACnC,OAAO,KAAK,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,cAAc,EAAE,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;AACrD,CAAC"}

package/node_modules/@openrig/daemon/dist/domain/applied-launch-observation-store.d.ts

@@ -0,0 +1,20 @@
+import type Database from "better-sqlite3";
+import type { AppliedLaunchObservation } from "./permission-drift.js";
+export interface StoredAppliedLaunchObservation extends AppliedLaunchObservation {
+    generationUuid: string;
+    observedAt: string;
+}
+/**
+ * Best-effort, generation-scoped persistence for the exact enforcing value
+ * returned by a successful managed launch. Missing migrations and DB failures
+ * degrade to UNKNOWN; they never turn a successful provider launch into a
+ * failed launch.
+ */
+export declare class AppliedLaunchObservationStore {
+    private readonly db;
+    constructor(db: Database.Database);
+    recordGeneration(generationUuid: string, observation: AppliedLaunchObservation): boolean;
+    invalidateGeneration(generationUuid: string): boolean;
+    readCurrent(nodeId: string): StoredAppliedLaunchObservation | null;
+}
+//# sourceMappingURL=applied-launch-observation-store.d.ts.map

package/node_modules/@openrig/daemon/dist/domain/applied-launch-observation-store.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"applied-launch-observation-store.d.ts","sourceRoot":"","sources":["../../src/domain/applied-launch-observation-store.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,QAAQ,MAAM,gBAAgB,CAAC;AAC3C,OAAO,KAAK,EAAqB,wBAAwB,EAAsB,MAAM,uBAAuB,CAAC;AAE7G,MAAM,WAAW,8BAA+B,SAAQ,wBAAwB;IAC9E,cAAc,EAAE,MAAM,CAAC;IACvB,UAAU,EAAE,MAAM,CAAC;CACpB;AAYD;;;;;GAKG;AACH,qBAAa,6BAA6B;IAC5B,OAAO,CAAC,QAAQ,CAAC,EAAE;gBAAF,EAAE,EAAE,QAAQ,CAAC,QAAQ;IAElD,gBAAgB,CAAC,cAAc,EAAE,MAAM,EAAE,WAAW,EAAE,wBAAwB,GAAG,OAAO;IAkCxF,oBAAoB,CAAC,cAAc,EAAE,MAAM,GAAG,OAAO;IAmBrD,WAAW,CAAC,MAAM,EAAE,MAAM,GAAG,8BAA8B,GAAG,IAAI;CA+BnE"}

package/node_modules/@openrig/daemon/dist/domain/applied-launch-observation-store.js

@@ -0,0 +1,90 @@
+/**
+ * Best-effort, generation-scoped persistence for the exact enforcing value
+ * returned by a successful managed launch. Missing migrations and DB failures
+ * degrade to UNKNOWN; they never turn a successful provider launch into a
+ * failed launch.
+ */
+export class AppliedLaunchObservationStore {
+    db;
+    constructor(db) {
+        this.db = db;
+    }
+    recordGeneration(generationUuid, observation) {
+        try {
+            const result = this.db.prepare(`
+        INSERT INTO applied_launch_observations (
+          generation_uuid, runtime, axis, observation_state, value, reason, observed_at
+        )
+        SELECT ?, ?, ?, ?, ?, ?, datetime('now')
+         WHERE NOT EXISTS (
+           SELECT 1
+             FROM applied_launch_observation_invalidations
+            WHERE generation_uuid = ?
+         )
+        ON CONFLICT(generation_uuid) DO UPDATE SET
+          runtime = excluded.runtime,
+          axis = excluded.axis,
+          observation_state = excluded.observation_state,
+          value = excluded.value,
+          reason = excluded.reason,
+          observed_at = excluded.observed_at
+      `).run(generationUuid, observation.runtime, observation.axis, observation.state, observation.value, observation.reason ?? null, generationUuid);
+            return result.changes > 0;
+        }
+        catch {
+            return false;
+        }
+    }
+    invalidateGeneration(generationUuid) {
+        try {
+            return this.db.transaction(() => {
+                const exists = this.db.prepare("SELECT 1 FROM occupant_tenures WHERE generation_uuid = ?").get(generationUuid);
+                if (!exists)
+                    return false;
+                this.db.prepare(`
+          INSERT OR IGNORE INTO applied_launch_observation_invalidations (generation_uuid)
+          VALUES (?)
+        `).run(generationUuid);
+                this.db.prepare("DELETE FROM applied_launch_observations WHERE generation_uuid = ?").run(generationUuid);
+                return true;
+            })();
+        }
+        catch {
+            return false;
+        }
+    }
+    readCurrent(nodeId) {
+        try {
+            const row = this.db.prepare(`
+        SELECT o.*
+          FROM (
+            SELECT generation_uuid
+              FROM occupant_tenures
+             WHERE node_id = ?
+             ORDER BY generation_ordinal DESC
+             LIMIT 1
+          ) current_tenure
+          JOIN applied_launch_observations o
+            ON o.generation_uuid = current_tenure.generation_uuid
+          LEFT JOIN applied_launch_observation_invalidations invalidated
+            ON invalidated.generation_uuid = current_tenure.generation_uuid
+         WHERE invalidated.generation_uuid IS NULL
+      `).get(nodeId);
+            if (!row)
+                return null;
+            return {
+                generationUuid: row.generation_uuid,
+                runtime: row.runtime,
+                axis: row.axis,
+                state: row.observation_state,
+                value: row.value,
+                ...(row.reason ? { reason: row.reason } : {}),
+                observedAt: row.observed_at,
+            };
+        }
+        catch {
+            return null;
+        }
+    }
+}
+//# sourceMappingURL=applied-launch-observation-store.js.map

package/node_modules/@openrig/daemon/dist/domain/applied-launch-observation-store.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"applied-launch-observation-store.js","sourceRoot":"","sources":["../../src/domain/applied-launch-observation-store.ts"],"names":[],"mappings":"AAkBA;;;;;GAKG;AACH,MAAM,OAAO,6BAA6B;IACX;IAA7B,YAA6B,EAAqB;QAArB,OAAE,GAAF,EAAE,CAAmB;IAAG,CAAC;IAEtD,gBAAgB,CAAC,cAAsB,EAAE,WAAqC;QAC5E,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,IAAI,CAAC,EAAE,CAAC,OAAO,CAAC;;;;;;;;;;;;;;;;;OAiB9B,CAAC,CAAC,GAAG,CACJ,cAAc,EACd,WAAW,CAAC,OAAO,EACnB,WAAW,CAAC,IAAI,EAChB,WAAW,CAAC,KAAK,EACjB,WAAW,CAAC,KAAK,EACjB,WAAW,CAAC,MAAM,IAAI,IAAI,EAC1B,cAAc,CACf,CAAC;YACF,OAAO,MAAM,CAAC,OAAO,GAAG,CAAC,CAAC;QAC5B,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,KAAK,CAAC;QACf,CAAC;IACH,CAAC;IAED,oBAAoB,CAAC,cAAsB;QACzC,IAAI,CAAC;YACH,OAAO,IAAI,CAAC,EAAE,CAAC,WAAW,CAAC,GAAG,EAAE;gBAC9B,MAAM,MAAM,GAAG,IAAI,CAAC,EAAE,CAAC,OAAO,CAC5B,0DAA0D,CAC3D,CAAC,GAAG,CAAC,cAAc,CAAC,CAAC;gBACtB,IAAI,CAAC,MAAM;oBAAE,OAAO,KAAK,CAAC;gBAC1B,IAAI,CAAC,EAAE,CAAC,OAAO,CAAC;;;SAGf,CAAC,CAAC,GAAG,CAAC,cAAc,CAAC,CAAC;gBACvB,IAAI,CAAC,EAAE,CAAC,OAAO,CAAC,mEAAmE,CAAC,CAAC,GAAG,CAAC,cAAc,CAAC,CAAC;gBACzG,OAAO,IAAI,CAAC;YACd,CAAC,CAAC,EAAE,CAAC;QACP,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,KAAK,CAAC;QACf,CAAC;IACH,CAAC;IAED,WAAW,CAAC,MAAc;QACxB,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,IAAI,CAAC,EAAE,CAAC,OAAO,CAAC;;;;;;;;;;;;;;OAc3B,CAAC,CAAC,GAAG,CAAC,MAAM,CAA+B,CAAC;YAC7C,IAAI,CAAC,GAAG;gBAAE,OAAO,IAAI,CAAC;YACtB,OAAO;gBACL,cAAc,EAAE,GAAG,CAAC,eAAe;gBACnC,OAAO,EAAE,GAAG,CAAC,OAAO;gBACpB,IAAI,EAAE,GAAG,CAAC,IAAyB;gBACnC,KAAK,EAAE,GAAG,CAAC,iBAAuC;gBAClD,KAAK,EAAE,GAAG,CAAC,KAAK;gBAChB,GAAG,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBAC7C,UAAU,EAAE,GAAG,CAAC,WAAW;aAC5B,CAAC;QACJ,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC;CACF"}