@openrig/cli 0.5.0 → 0.5.2

package/node_modules/@openrig/daemon/dist/domain/files/path-safety.d.ts

@@ -0,0 +1,47 @@
+export interface AllowlistRoot {
+    /** Operator-supplied display name (e.g., "workspace"). */
+    name: string;
+    /** Canonical absolute path on disk. */
+    canonicalPath: string;
+}
+export declare class FilePathSafetyError extends Error {
+    readonly code: "root_unknown" | "path_escape" | "path_invalid" | "stat_failed" | "not_a_file" | "not_a_directory";
+    readonly details?: Record<string, unknown> | undefined;
+    constructor(code: "root_unknown" | "path_escape" | "path_invalid" | "stat_failed" | "not_a_file" | "not_a_directory", message: string, details?: Record<string, unknown> | undefined);
+}
+/**
+ * Decodes a raw `name:/abs/path,name:/abs/path` allowlist string into
+ * canonical AllowlistRoot[]. Whitespace around delimiters trimmed.
+ * Invalid pairs (no colon, empty name, non-absolute path) silently
+ * skipped. Duplicate names: last wins. Same shape both env-var and
+ * settings-file-resolved values produce.
+ */
+export declare function decodeAllowlist(raw: string): AllowlistRoot[];
+/**
+ * Reads the allowlist env var directly and returns the parsed root list.
+ * Preserved for backward-compat callers; v0 callers prefer the resolved
+ * settings-store path which honors env > settings-file > empty.
+ */
+export declare function readAllowlistFromEnv(env?: NodeJS.ProcessEnv): AllowlistRoot[];
+/**
+ * Resolves a relative path against an allowlist root. Throws
+ * FilePathSafetyError on any unsafe condition. Returns the
+ * canonical absolute path on success. Caller is expected to stat
+ * the result to distinguish file/directory.
+ *
+ * Path-safety algorithm:
+ *   1. Validate the root exists in the allowlist (reject "root_unknown").
+ *   2. Reject relative paths that look absolute or contain `..`
+ *      segments (reject "path_invalid" / "path_escape").
+ *   3. Resolve the relative path against the canonical root.
+ *   4. Resolve symlinks: if the realpath does not start with the
+ *      canonical root + path separator, reject "path_escape".
+ *   5. The base case `path = ""` resolves to the root itself (allowed
+ *      so callers can list the root directory).
+ */
+export declare function resolveAllowedPath(allowlist: AllowlistRoot[], rootName: string, relativePath: string): string;
+/** Convenience: resolve + assert the result is an existing regular file. */
+export declare function resolveAllowedFile(allowlist: AllowlistRoot[], rootName: string, relativePath: string): string;
+/** Convenience: resolve + assert the result is an existing directory. */
+export declare function resolveAllowedDirectory(allowlist: AllowlistRoot[], rootName: string, relativePath: string): string;
+//# sourceMappingURL=path-safety.d.ts.map

package/node_modules/@openrig/daemon/dist/domain/files/path-safety.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"path-safety.d.ts","sourceRoot":"","sources":["../../../src/domain/files/path-safety.ts"],"names":[],"mappings":"AA+BA,MAAM,WAAW,aAAa;IAC5B,0DAA0D;IAC1D,IAAI,EAAE,MAAM,CAAC;IACb,uCAAuC;IACvC,aAAa,EAAE,MAAM,CAAC;CACvB;AAED,qBAAa,mBAAoB,SAAQ,KAAK;aAE1B,IAAI,EAAE,cAAc,GAAG,aAAa,GAAG,cAAc,GAAG,aAAa,GAAG,YAAY,GAAG,iBAAiB;aAExG,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC;gBAFjC,IAAI,EAAE,cAAc,GAAG,aAAa,GAAG,cAAc,GAAG,aAAa,GAAG,YAAY,GAAG,iBAAiB,EACxH,OAAO,EAAE,MAAM,EACC,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,YAAA;CAKpD;AAKD;;;;;;GAMG;AACH,wBAAgB,eAAe,CAAC,GAAG,EAAE,MAAM,GAAG,aAAa,EAAE,CAqB5D;AAED;;;;GAIG;AACH,wBAAgB,oBAAoB,CAAC,GAAG,GAAE,MAAM,CAAC,UAAwB,GAAG,aAAa,EAAE,CAK1F;AAED;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,kBAAkB,CAChC,SAAS,EAAE,aAAa,EAAE,EAC1B,QAAQ,EAAE,MAAM,EAChB,YAAY,EAAE,MAAM,GACnB,MAAM,CAwDR;AAED,4EAA4E;AAC5E,wBAAgB,kBAAkB,CAChC,SAAS,EAAE,aAAa,EAAE,EAC1B,QAAQ,EAAE,MAAM,EAChB,YAAY,EAAE,MAAM,GACnB,MAAM,CAoBR;AAED,yEAAyE;AACzE,wBAAgB,uBAAuB,CACrC,SAAS,EAAE,aAAa,EAAE,EAC1B,QAAQ,EAAE,MAAM,EAChB,YAAY,EAAE,MAAM,GACnB,MAAM,CAoBR"}

package/node_modules/@openrig/daemon/dist/domain/files/path-safety.js

@@ -0,0 +1,176 @@
+// UI Enhancement Pack v0 — file allowlist + path-safety helpers.
+//
+// Daemon-enforced fail-closed path-safety for the operator-allowlisted
+// file browser surface (item 3 + item 4). Reused by all four
+// /api/files/* routes.
+//
+// Allowlist source (driver pivot from PRD's suggested ConfigStore key
+// family — see handoff): OPENRIG_FILES_ALLOWLIST env var, comma-
+// separated `<name>:<absolute-path>` pairs. Operator sets via shell
+// (or via `~/.openrig` env file). Empty / unset → no allowlist roots
+// → routes return empty roots list with a structured "configure
+// OPENRIG_FILES_ALLOWLIST" hint. Default after fresh install: nothing
+// (the safe default per PRD § Item 3).
+//
+// Path-safety contract:
+//   - Each request resolves <relativePath> against <rootName>'s
+//     canonical absolute path.
+//   - Any escape attempt (.., absolute-path passed as relativePath,
+//     symlink whose realpath escapes the root) is rejected with a
+//     structured error.
+//   - Symlinks INSIDE the allowlisted tree resolve normally; symlinks
+//     pointing OUTSIDE the tree are treated as escape attempts.
+//   - Reads/lists never return content from outside the resolved root.
+//
+// MVP single-host context: no per-rig overrides, no remote allowlist
+// management, no audit at allowlist-resolution time (allowlist
+// resolution is read-only). Audit applies to writes only (item 4).
+import * as fs from "node:fs";
+import * as path from "node:path";
+export class FilePathSafetyError extends Error {
+    code;
+    details;
+    constructor(code, message, details) {
+        super(message);
+        this.code = code;
+        this.details = details;
+        this.name = "FilePathSafetyError";
+    }
+}
+const ENV_VAR = "OPENRIG_FILES_ALLOWLIST";
+const LEGACY_ENV_VAR = "RIGGED_FILES_ALLOWLIST";
+/**
+ * Decodes a raw `name:/abs/path,name:/abs/path` allowlist string into
+ * canonical AllowlistRoot[]. Whitespace around delimiters trimmed.
+ * Invalid pairs (no colon, empty name, non-absolute path) silently
+ * skipped. Duplicate names: last wins. Same shape both env-var and
+ * settings-file-resolved values produce.
+ */
+export function decodeAllowlist(raw) {
+    if (!raw.trim())
+        return [];
+    const out = new Map();
+    for (const pair of raw.split(",")) {
+        const trimmed = pair.trim();
+        if (!trimmed)
+            continue;
+        const colon = trimmed.indexOf(":");
+        if (colon === -1)
+            continue;
+        const name = trimmed.slice(0, colon).trim();
+        const rawPath = trimmed.slice(colon + 1).trim();
+        if (!name || !rawPath)
+            continue;
+        if (!path.isAbsolute(rawPath))
+            continue;
+        let canonical;
+        try {
+            canonical = fs.realpathSync(rawPath);
+        }
+        catch {
+            canonical = path.resolve(rawPath);
+        }
+        out.set(name, canonical);
+    }
+    return Array.from(out.entries()).map(([name, canonicalPath]) => ({ name, canonicalPath }));
+}
+/**
+ * Reads the allowlist env var directly and returns the parsed root list.
+ * Preserved for backward-compat callers; v0 callers prefer the resolved
+ * settings-store path which honors env > settings-file > empty.
+ */
+export function readAllowlistFromEnv(env = process.env) {
+    // Use || (not ??) so an empty-string OPENRIG_FILES_ALLOWLIST falls
+    // back to the legacy var. ?? only handles null/undefined.
+    const raw = (env[ENV_VAR] || env[LEGACY_ENV_VAR] || "").toString();
+    return decodeAllowlist(raw);
+}
+/**
+ * Resolves a relative path against an allowlist root. Throws
+ * FilePathSafetyError on any unsafe condition. Returns the
+ * canonical absolute path on success. Caller is expected to stat
+ * the result to distinguish file/directory.
+ *
+ * Path-safety algorithm:
+ *   1. Validate the root exists in the allowlist (reject "root_unknown").
+ *   2. Reject relative paths that look absolute or contain `..`
+ *      segments (reject "path_invalid" / "path_escape").
+ *   3. Resolve the relative path against the canonical root.
+ *   4. Resolve symlinks: if the realpath does not start with the
+ *      canonical root + path separator, reject "path_escape".
+ *   5. The base case `path = ""` resolves to the root itself (allowed
+ *      so callers can list the root directory).
+ */
+export function resolveAllowedPath(allowlist, rootName, relativePath) {
+    const root = allowlist.find((r) => r.name === rootName);
+    if (!root) {
+        throw new FilePathSafetyError("root_unknown", `allowlist root '${rootName}' is not configured. Allowlist configured roots: ${allowlist.map((r) => r.name).join(", ") || "(none)"}.`, { rootName, configuredRoots: allowlist.map((r) => r.name) });
+    }
+    // Reject ../ escape attempts BEFORE filesystem resolution. Even
+    // though step 4 catches realpath escapes, this rejects the
+    // expressed-intent-to-escape with a clearer error code.
+    if (relativePath.includes("..")) {
+        // Distinguish a literal ".." segment from a filename like "foo..bar"
+        // — split on path.sep and `/` and inspect each segment.
+        const segments = relativePath.split(/[\\/]/).filter((s) => s.length > 0);
+        for (const seg of segments) {
+            if (seg === "..") {
+                throw new FilePathSafetyError("path_escape", `relative path '${relativePath}' contains a '..' segment; reject.`, { rootName, relativePath });
+            }
+        }
+    }
+    if (path.isAbsolute(relativePath)) {
+        throw new FilePathSafetyError("path_invalid", `relative path '${relativePath}' must not be absolute (reject).`, { rootName, relativePath });
+    }
+    const candidate = path.resolve(root.canonicalPath, relativePath);
+    let realpath;
+    try {
+        realpath = fs.realpathSync(candidate);
+    }
+    catch {
+        // If the candidate doesn't exist on disk yet, fall back to the
+        // unresolved candidate. Subsequent stat will surface the absence
+        // with a more specific error code.
+        realpath = candidate;
+    }
+    // Containment check with path.sep boundary to avoid the
+    // /foo/bar matching /foo/bar-other false-positive.
+    const rootWithSep = root.canonicalPath.endsWith(path.sep)
+        ? root.canonicalPath
+        : `${root.canonicalPath}${path.sep}`;
+    if (realpath !== root.canonicalPath && !realpath.startsWith(rootWithSep)) {
+        throw new FilePathSafetyError("path_escape", `resolved path '${realpath}' falls outside allowlist root '${rootName}' (${root.canonicalPath}).`, { rootName, relativePath, resolved: realpath, rootCanonical: root.canonicalPath });
+    }
+    return realpath;
+}
+/** Convenience: resolve + assert the result is an existing regular file. */
+export function resolveAllowedFile(allowlist, rootName, relativePath) {
+    const resolved = resolveAllowedPath(allowlist, rootName, relativePath);
+    let stat;
+    try {
+        stat = fs.statSync(resolved);
+    }
+    catch (err) {
+        throw new FilePathSafetyError("stat_failed", `failed to stat '${resolved}': ${err instanceof Error ? err.message : String(err)}`, { rootName, relativePath, resolved });
+    }
+    if (!stat.isFile()) {
+        throw new FilePathSafetyError("not_a_file", `resolved path '${resolved}' is not a regular file.`, { rootName, relativePath, resolved });
+    }
+    return resolved;
+}
+/** Convenience: resolve + assert the result is an existing directory. */
+export function resolveAllowedDirectory(allowlist, rootName, relativePath) {
+    const resolved = resolveAllowedPath(allowlist, rootName, relativePath);
+    let stat;
+    try {
+        stat = fs.statSync(resolved);
+    }
+    catch (err) {
+        throw new FilePathSafetyError("stat_failed", `failed to stat '${resolved}': ${err instanceof Error ? err.message : String(err)}`, { rootName, relativePath, resolved });
+    }
+    if (!stat.isDirectory()) {
+        throw new FilePathSafetyError("not_a_directory", `resolved path '${resolved}' is not a directory.`, { rootName, relativePath, resolved });
+    }
+    return resolved;
+}
+//# sourceMappingURL=path-safety.js.map

package/node_modules/@openrig/daemon/dist/domain/files/path-safety.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"path-safety.js","sourceRoot":"","sources":["../../../src/domain/files/path-safety.ts"],"names":[],"mappings":"AAAA,iEAAiE;AACjE,EAAE;AACF,uEAAuE;AACvE,6DAA6D;AAC7D,uBAAuB;AACvB,EAAE;AACF,sEAAsE;AACtE,iEAAiE;AACjE,oEAAoE;AACpE,qEAAqE;AACrE,gEAAgE;AAChE,sEAAsE;AACtE,uCAAuC;AACvC,EAAE;AACF,wBAAwB;AACxB,gEAAgE;AAChE,+BAA+B;AAC/B,oEAAoE;AACpE,kEAAkE;AAClE,wBAAwB;AACxB,sEAAsE;AACtE,gEAAgE;AAChE,uEAAuE;AACvE,EAAE;AACF,qEAAqE;AACrE,+DAA+D;AAC/D,mEAAmE;AAEnE,OAAO,KAAK,EAAE,MAAM,SAAS,CAAC;AAC9B,OAAO,KAAK,IAAI,MAAM,WAAW,CAAC;AASlC,MAAM,OAAO,mBAAoB,SAAQ,KAAK;IAE1B;IAEA;IAHlB,YACkB,IAAwG,EACxH,OAAe,EACC,OAAiC;QAEjD,KAAK,CAAC,OAAO,CAAC,CAAC;QAJC,SAAI,GAAJ,IAAI,CAAoG;QAExG,YAAO,GAAP,OAAO,CAA0B;QAGjD,IAAI,CAAC,IAAI,GAAG,qBAAqB,CAAC;IACpC,CAAC;CACF;AAED,MAAM,OAAO,GAAG,yBAAyB,CAAC;AAC1C,MAAM,cAAc,GAAG,wBAAwB,CAAC;AAEhD;;;;;;GAMG;AACH,MAAM,UAAU,eAAe,CAAC,GAAW;IACzC,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE;QAAE,OAAO,EAAE,CAAC;IAC3B,MAAM,GAAG,GAAG,IAAI,GAAG,EAAkB,CAAC;IACtC,KAAK,MAAM,IAAI,IAAI,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC;QAClC,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;QAC5B,IAAI,CAAC,OAAO;YAAE,SAAS;QACvB,MAAM,KAAK,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QACnC,IAAI,KAAK,KAAK,CAAC,CAAC;YAAE,SAAS;QAC3B,MAAM,IAAI,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC,IAAI,EAAE,CAAC;QAC5C,MAAM,OAAO,GAAG,OAAO,CAAC,KAAK,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;QAChD,IAAI,CAAC,IAAI,IAAI,CAAC,OAAO;YAAE,SAAS;QAChC,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC;YAAE,SAAS;QACxC,IAAI,SAAiB,CAAC;QACtB,IAAI,CAAC;YACH,SAAS,GAAG,EAAE,CAAC,YAAY,CAAC,OAAO,CAAC,CAAC;QACvC,CAAC;QAAC,MAAM,CAAC;YACP,SAAS,GAAG,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;QACpC,CAAC;QACD,GAAG,CAAC,GAAG,CAAC,IAAI,EAAE,SAAS,CAAC,CAAC;IAC3B,CAAC;IACD,OAAO,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,OAAO,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,aAAa,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,aAAa,EAAE,CAAC,CAAC,CAAC;AAC7F,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,oBAAoB,CAAC,MAAyB,OAAO,CAAC,GAAG;IACvE,mEAAmE;IACnE,0DAA0D;IAC1D,MAAM,GAAG,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,GAAG,CAAC,cAAc,CAAC,IAAI,EAAE,CAAC,CAAC,QAAQ,EAAE,CAAC;IACnE,OAAO,eAAe,CAAC,GAAG,CAAC,CAAC;AAC9B,CAAC;AAED;;;;;;;;;;;;;;;GAeG;AACH,MAAM,UAAU,kBAAkB,CAChC,SAA0B,EAC1B,QAAgB,EAChB,YAAoB;IAEpB,MAAM,IAAI,GAAG,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC;IACxD,IAAI,CAAC,IAAI,EAAE,CAAC;QACV,MAAM,IAAI,mBAAmB,CAC3B,cAAc,EACd,mBAAmB,QAAQ,oDAAoD,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,QAAQ,GAAG,EACrI,EAAE,QAAQ,EAAE,eAAe,EAAE,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAC5D,CAAC;IACJ,CAAC;IACD,gEAAgE;IAChE,2DAA2D;IAC3D,wDAAwD;IACxD,IAAI,YAAY,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;QAChC,qEAAqE;QACrE,wDAAwD;QACxD,MAAM,QAAQ,GAAG,YAAY,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;QACzE,KAAK,MAAM,GAAG,IAAI,QAAQ,EAAE,CAAC;YAC3B,IAAI,GAAG,KAAK,IAAI,EAAE,CAAC;gBACjB,MAAM,IAAI,mBAAmB,CAC3B,aAAa,EACb,kBAAkB,YAAY,oCAAoC,EAClE,EAAE,QAAQ,EAAE,YAAY,EAAE,CAC3B,CAAC;YACJ,CAAC;QACH,CAAC;IACH,CAAC;IACD,IAAI,IAAI,CAAC,UAAU,CAAC,YAAY,CAAC,EAAE,CAAC;QAClC,MAAM,IAAI,mBAAmB,CAC3B,cAAc,EACd,kBAAkB,YAAY,kCAAkC,EAChE,EAAE,QAAQ,EAAE,YAAY,EAAE,CAC3B,CAAC;IACJ,CAAC;IACD,MAAM,SAAS,GAAG,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,aAAa,EAAE,YAAY,CAAC,CAAC;IACjE,IAAI,QAAgB,CAAC;IACrB,IAAI,CAAC;QACH,QAAQ,GAAG,EAAE,CAAC,YAAY,CAAC,SAAS,CAAC,CAAC;IACxC,CAAC;IAAC,MAAM,CAAC;QACP,+DAA+D;QAC/D,iEAAiE;QACjE,mCAAmC;QACnC,QAAQ,GAAG,SAAS,CAAC;IACvB,CAAC;IACD,wDAAwD;IACxD,mDAAmD;IACnD,MAAM,WAAW,GAAG,IAAI,CAAC,aAAa,CAAC,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC;QACvD,CAAC,CAAC,IAAI,CAAC,aAAa;QACpB,CAAC,CAAC,GAAG,IAAI,CAAC,aAAa,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IACvC,IAAI,QAAQ,KAAK,IAAI,CAAC,aAAa,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC,WAAW,CAAC,EAAE,CAAC;QACzE,MAAM,IAAI,mBAAmB,CAC3B,aAAa,EACb,kBAAkB,QAAQ,mCAAmC,QAAQ,MAAM,IAAI,CAAC,aAAa,IAAI,EACjG,EAAE,QAAQ,EAAE,YAAY,EAAE,QAAQ,EAAE,QAAQ,EAAE,aAAa,EAAE,IAAI,CAAC,aAAa,EAAE,CAClF,CAAC;IACJ,CAAC;IACD,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,4EAA4E;AAC5E,MAAM,UAAU,kBAAkB,CAChC,SAA0B,EAC1B,QAAgB,EAChB,YAAoB;IAEpB,MAAM,QAAQ,GAAG,kBAAkB,CAAC,SAAS,EAAE,QAAQ,EAAE,YAAY,CAAC,CAAC;IACvE,IAAI,IAAc,CAAC;IACnB,IAAI,CAAC;QACH,IAAI,GAAG,EAAE,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;IAC/B,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,IAAI,mBAAmB,CAC3B,aAAa,EACb,mBAAmB,QAAQ,MAAM,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,EACnF,EAAE,QAAQ,EAAE,YAAY,EAAE,QAAQ,EAAE,CACrC,CAAC;IACJ,CAAC;IACD,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,EAAE,CAAC;QACnB,MAAM,IAAI,mBAAmB,CAC3B,YAAY,EACZ,kBAAkB,QAAQ,0BAA0B,EACpD,EAAE,QAAQ,EAAE,YAAY,EAAE,QAAQ,EAAE,CACrC,CAAC;IACJ,CAAC;IACD,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,yEAAyE;AACzE,MAAM,UAAU,uBAAuB,CACrC,SAA0B,EAC1B,QAAgB,EAChB,YAAoB;IAEpB,MAAM,QAAQ,GAAG,kBAAkB,CAAC,SAAS,EAAE,QAAQ,EAAE,YAAY,CAAC,CAAC;IACvE,IAAI,IAAc,CAAC;IACnB,IAAI,CAAC;QACH,IAAI,GAAG,EAAE,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;IAC/B,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,IAAI,mBAAmB,CAC3B,aAAa,EACb,mBAAmB,QAAQ,MAAM,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,EACnF,EAAE,QAAQ,EAAE,YAAY,EAAE,QAAQ,EAAE,CACrC,CAAC;IACJ,CAAC;IACD,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,EAAE,CAAC;QACxB,MAAM,IAAI,mBAAmB,CAC3B,iBAAiB,EACjB,kBAAkB,QAAQ,uBAAuB,EACjD,EAAE,QAAQ,EAAE,YAAY,EAAE,QAAQ,EAAE,CACrC,CAAC;IACJ,CAAC;IACD,OAAO,QAAQ,CAAC;AAClB,CAAC"}

package/node_modules/@openrig/daemon/dist/domain/gate-predicate.d.ts

@@ -0,0 +1,29 @@
+/** Tag namespace that marks gate work. */
+export declare const GATE_TAG_PREFIX = "gate:";
+/**
+ * Known gate roles. Guidance / documentation only — the predicate accepts
+ * ANY `gate:<role>` so new gate-holder roles need no code change.
+ */
+export declare const GATE_ROLES: readonly ["guard", "spec-review", "pm-lead", "review-r1", "review-r2", "qa", "human"];
+export type GateRole = (typeof GATE_ROLES)[number];
+/** The human-approval tier that maps to the `gate:human` role (fallback). */
+export declare const HUMAN_GATE_TIER = "human-gate";
+/** True if `tag` is a well-formed `gate:<role>` tag. */
+export declare function isGateTag(tag: string): boolean;
+/** Gate roles declared by a qitem's tags (order-preserving, de-duplicated). */
+export declare function gateRolesOf(tags: readonly string[] | null | undefined): string[];
+export interface GatePredicateInput {
+    tags: readonly string[] | null | undefined;
+    tier?: string | null;
+}
+/**
+ * THE predicate: is this qitem gate work?
+ * Primary: any `gate:<role>` tag. Secondary fallback: tier === "human-gate".
+ */
+export declare function qitemIsGated(input: GatePredicateInput): boolean;
+/**
+ * Effective gate roles for a qitem, including the human-gate tier fallback
+ * surfaced as the `human` role. Empty iff the qitem is not gate work.
+ */
+export declare function effectiveGateRoles(input: GatePredicateInput): string[];
+//# sourceMappingURL=gate-predicate.d.ts.map

package/node_modules/@openrig/daemon/dist/domain/gate-predicate.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"gate-predicate.d.ts","sourceRoot":"","sources":["../../src/domain/gate-predicate.ts"],"names":[],"mappings":"AAcA,0CAA0C;AAC1C,eAAO,MAAM,eAAe,UAAU,CAAC;AAEvC;;;GAGG;AACH,eAAO,MAAM,UAAU,uFAQb,CAAC;AACX,MAAM,MAAM,QAAQ,GAAG,CAAC,OAAO,UAAU,CAAC,CAAC,MAAM,CAAC,CAAC;AAEnD,6EAA6E;AAC7E,eAAO,MAAM,eAAe,eAAe,CAAC;AAE5C,wDAAwD;AACxD,wBAAgB,SAAS,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAE9C;AAED,+EAA+E;AAC/E,wBAAgB,WAAW,CAAC,IAAI,EAAE,SAAS,MAAM,EAAE,GAAG,IAAI,GAAG,SAAS,GAAG,MAAM,EAAE,CAchF;AAED,MAAM,WAAW,kBAAkB;IACjC,IAAI,EAAE,SAAS,MAAM,EAAE,GAAG,IAAI,GAAG,SAAS,CAAC;IAC3C,IAAI,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CACtB;AAED;;;GAGG;AACH,wBAAgB,YAAY,CAAC,KAAK,EAAE,kBAAkB,GAAG,OAAO,CAI/D;AAED;;;GAGG;AACH,wBAAgB,kBAAkB,CAAC,KAAK,EAAE,kBAAkB,GAAG,MAAM,EAAE,CAItE"}

package/node_modules/@openrig/daemon/dist/domain/gate-predicate.js

@@ -0,0 +1,73 @@
+// OPR.0.4.3.16 — centralized queue gate-predicate.
+//
+// Convention: conventions/queue-gate-predicate/README.md (frozen by
+// pm-lead 2026-07-03). This is the ONE config point that decides whether a
+// queue qitem is "gate work" — a review/approval step a specific role must
+// act on to clear, and which can STALL. Consumers (the idle-gate watchdog
+// policy) read the predicate from HERE; they never scatter tag-checks or
+// body-parse the qitem (slice-16 PRD Business Rule 4).
+//
+// Predicate = a qitem carrying ANY `gate:<role>` tag. SECONDARY fallback:
+// tier === "human-gate" maps to the `gate:human` role (subsumes the legacy
+// human-gate tier for the predicate; it is NOT sufficient on its own to
+// catch the guard / spec-review targets).
+/** Tag namespace that marks gate work. */
+export const GATE_TAG_PREFIX = "gate:";
+/**
+ * Known gate roles. Guidance / documentation only — the predicate accepts
+ * ANY `gate:<role>` so new gate-holder roles need no code change.
+ */
+export const GATE_ROLES = [
+    "guard",
+    "spec-review",
+    "pm-lead",
+    "review-r1",
+    "review-r2",
+    "qa",
+    "human",
+];
+/** The human-approval tier that maps to the `gate:human` role (fallback). */
+export const HUMAN_GATE_TIER = "human-gate";
+/** True if `tag` is a well-formed `gate:<role>` tag. */
+export function isGateTag(tag) {
+    return tag.startsWith(GATE_TAG_PREFIX) && tag.length > GATE_TAG_PREFIX.length;
+}
+/** Gate roles declared by a qitem's tags (order-preserving, de-duplicated). */
+export function gateRolesOf(tags) {
+    if (!tags)
+        return [];
+    const seen = new Set();
+    const roles = [];
+    for (const t of tags) {
+        if (isGateTag(t)) {
+            const role = t.slice(GATE_TAG_PREFIX.length);
+            if (!seen.has(role)) {
+                seen.add(role);
+                roles.push(role);
+            }
+        }
+    }
+    return roles;
+}
+/**
+ * THE predicate: is this qitem gate work?
+ * Primary: any `gate:<role>` tag. Secondary fallback: tier === "human-gate".
+ */
+export function qitemIsGated(input) {
+    if (gateRolesOf(input.tags).length > 0)
+        return true;
+    if (input.tier === HUMAN_GATE_TIER)
+        return true; // → gate:human
+    return false;
+}
+/**
+ * Effective gate roles for a qitem, including the human-gate tier fallback
+ * surfaced as the `human` role. Empty iff the qitem is not gate work.
+ */
+export function effectiveGateRoles(input) {
+    const roles = gateRolesOf(input.tags);
+    if (input.tier === HUMAN_GATE_TIER && !roles.includes("human"))
+        roles.push("human");
+    return roles;
+}
+//# sourceMappingURL=gate-predicate.js.map

package/node_modules/@openrig/daemon/dist/domain/gate-predicate.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"gate-predicate.js","sourceRoot":"","sources":["../../src/domain/gate-predicate.ts"],"names":[],"mappings":"AAAA,mDAAmD;AACnD,EAAE;AACF,oEAAoE;AACpE,2EAA2E;AAC3E,2EAA2E;AAC3E,0EAA0E;AAC1E,yEAAyE;AACzE,uDAAuD;AACvD,EAAE;AACF,0EAA0E;AAC1E,2EAA2E;AAC3E,wEAAwE;AACxE,0CAA0C;AAE1C,0CAA0C;AAC1C,MAAM,CAAC,MAAM,eAAe,GAAG,OAAO,CAAC;AAEvC;;;GAGG;AACH,MAAM,CAAC,MAAM,UAAU,GAAG;IACxB,OAAO;IACP,aAAa;IACb,SAAS;IACT,WAAW;IACX,WAAW;IACX,IAAI;IACJ,OAAO;CACC,CAAC;AAGX,6EAA6E;AAC7E,MAAM,CAAC,MAAM,eAAe,GAAG,YAAY,CAAC;AAE5C,wDAAwD;AACxD,MAAM,UAAU,SAAS,CAAC,GAAW;IACnC,OAAO,GAAG,CAAC,UAAU,CAAC,eAAe,CAAC,IAAI,GAAG,CAAC,MAAM,GAAG,eAAe,CAAC,MAAM,CAAC;AAChF,CAAC;AAED,+EAA+E;AAC/E,MAAM,UAAU,WAAW,CAAC,IAA0C;IACpE,IAAI,CAAC,IAAI;QAAE,OAAO,EAAE,CAAC;IACrB,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;IAC/B,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,KAAK,MAAM,CAAC,IAAI,IAAI,EAAE,CAAC;QACrB,IAAI,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC;YACjB,MAAM,IAAI,GAAG,CAAC,CAAC,KAAK,CAAC,eAAe,CAAC,MAAM,CAAC,CAAC;YAC7C,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;gBACpB,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;gBACf,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YACnB,CAAC;QACH,CAAC;IACH,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAOD;;;GAGG;AACH,MAAM,UAAU,YAAY,CAAC,KAAyB;IACpD,IAAI,WAAW,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,MAAM,GAAG,CAAC;QAAE,OAAO,IAAI,CAAC;IACpD,IAAI,KAAK,CAAC,IAAI,KAAK,eAAe;QAAE,OAAO,IAAI,CAAC,CAAC,eAAe;IAChE,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,kBAAkB,CAAC,KAAyB;IAC1D,MAAM,KAAK,GAAG,WAAW,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IACtC,IAAI,KAAK,CAAC,IAAI,KAAK,eAAe,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,OAAO,CAAC;QAAE,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IACpF,OAAO,KAAK,CAAC;AACf,CAAC"}

package/node_modules/@openrig/daemon/dist/domain/gateway/dispatch-buffer.d.ts

@@ -0,0 +1,15 @@
+import type { OutboundDecision } from "./protocol.js";
+export declare function dispatchBufferPath(home?: string): string;
+/** The durable gateway dispatch buffer. Restart-surviving: `pending()` reads from disk.
+ *  Idempotent on decisionId — enqueuing the same decisionId twice keeps ONE record. */
+export declare class DispatchBuffer {
+    private readonly path;
+    constructor(home?: string);
+    /** Persist a decision BEFORE dispatch (durable-first). Idempotent by decisionId. */
+    enqueue(decision: OutboundDecision): void;
+    /** Ack-gated DRAIN: remove a decision only once the connector has Acked it. */
+    ack(decisionId: string): void;
+    /** The un-Acked decisions (restart-surviving) — what a re-dispatch replays on recovery. */
+    pending(): OutboundDecision[];
+}
+//# sourceMappingURL=dispatch-buffer.d.ts.map

package/node_modules/@openrig/daemon/dist/domain/gateway/dispatch-buffer.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"dispatch-buffer.d.ts","sourceRoot":"","sources":["../../../src/domain/gateway/dispatch-buffer.ts"],"names":[],"mappings":"AAaA,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,eAAe,CAAC;AAEtD,wBAAgB,kBAAkB,CAAC,IAAI,GAAE,MAAyB,GAAG,MAAM,CAE1E;AA2BD;uFACuF;AACvF,qBAAa,cAAc;IACzB,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAS;gBAClB,IAAI,GAAE,MAAyB;IAI3C,oFAAoF;IACpF,OAAO,CAAC,QAAQ,EAAE,gBAAgB,GAAG,IAAI;IAOzC,+EAA+E;IAC/E,GAAG,CAAC,UAAU,EAAE,MAAM,GAAG,IAAI;IAM7B,2FAA2F;IAC3F,OAAO,IAAI,gBAAgB,EAAE;CAG9B"}

package/node_modules/@openrig/daemon/dist/domain/gateway/dispatch-buffer.js

@@ -0,0 +1,64 @@
+// M1 A4a — the gateway-side DISPATCH BUFFER: durable OutboundDecisions held until the
+// connector Acks (contract a305310d). This is what makes connector-outage -> no-loss ->
+// ack-gated drain PROVABLE (proof-9). It is a DISTINCT store from the connector-side
+// slice-11 delivery ledger (SeenStore/DeadLetterStore) — the two are NEVER merged
+// (conflating them re-creates the drift class the arch verdict called out).
+//
+// Durability = the slice-11 atomic pattern (write a temp sibling + rename): a decision is
+// persisted BEFORE it is dispatched, and removed ONLY after its Ack. decisionId is the
+// idempotency key — re-dispatching an un-Acked decision produces a byte-identical dup.
+import { existsSync, readFileSync, writeFileSync, renameSync, mkdirSync } from "node:fs";
+import { dirname, join } from "node:path";
+import { getOpenRigHome } from "../../openrig-compat.js";
+export function dispatchBufferPath(home = getOpenRigHome()) {
+    return join(home, "gateway", "dispatch-buffer.json");
+}
+function readState(path) {
+    if (!existsSync(path))
+        return { pending: [] };
+    try {
+        const raw = JSON.parse(readFileSync(path, "utf8"));
+        return { pending: Array.isArray(raw.pending) ? raw.pending : [] };
+    }
+    catch {
+        // A corrupt buffer fails CLOSED to empty rather than throwing — a dispatch buffer
+        // that can't be read must not wedge the gateway; the un-Acked decisions are lost
+        // only if the file itself is corrupt (a separate durability incident), never silently
+        // dropped on a clean read.
+        return { pending: [] };
+    }
+}
+function writeState(path, state) {
+    mkdirSync(dirname(path), { recursive: true });
+    const tmp = `${path}.tmp-${process.pid}`;
+    writeFileSync(tmp, JSON.stringify(state, null, 0), { mode: 0o600 });
+    renameSync(tmp, path);
+}
+/** The durable gateway dispatch buffer. Restart-surviving: `pending()` reads from disk.
+ *  Idempotent on decisionId — enqueuing the same decisionId twice keeps ONE record. */
+export class DispatchBuffer {
+    path;
+    constructor(home = getOpenRigHome()) {
+        this.path = dispatchBufferPath(home);
+    }
+    /** Persist a decision BEFORE dispatch (durable-first). Idempotent by decisionId. */
+    enqueue(decision) {
+        const state = readState(this.path);
+        if (state.pending.some((d) => d.decisionId === decision.decisionId))
+            return; // already durable
+        state.pending.push(decision);
+        writeState(this.path, state);
+    }
+    /** Ack-gated DRAIN: remove a decision only once the connector has Acked it. */
+    ack(decisionId) {
+        const state = readState(this.path);
+        const next = state.pending.filter((d) => d.decisionId !== decisionId);
+        if (next.length !== state.pending.length)
+            writeState(this.path, { pending: next });
+    }
+    /** The un-Acked decisions (restart-surviving) — what a re-dispatch replays on recovery. */
+    pending() {
+        return readState(this.path).pending;
+    }
+}
+//# sourceMappingURL=dispatch-buffer.js.map

package/node_modules/@openrig/daemon/dist/domain/gateway/dispatch-buffer.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"dispatch-buffer.js","sourceRoot":"","sources":["../../../src/domain/gateway/dispatch-buffer.ts"],"names":[],"mappings":"AAAA,sFAAsF;AACtF,wFAAwF;AACxF,qFAAqF;AACrF,kFAAkF;AAClF,4EAA4E;AAC5E,EAAE;AACF,0FAA0F;AAC1F,uFAAuF;AACvF,uFAAuF;AAEvF,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,aAAa,EAAE,UAAU,EAAE,SAAS,EAAE,MAAM,SAAS,CAAC;AACzF,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAC1C,OAAO,EAAE,cAAc,EAAE,MAAM,yBAAyB,CAAC;AAGzD,MAAM,UAAU,kBAAkB,CAAC,OAAe,cAAc,EAAE;IAChE,OAAO,IAAI,CAAC,IAAI,EAAE,SAAS,EAAE,sBAAsB,CAAC,CAAC;AACvD,CAAC;AAMD,SAAS,SAAS,CAAC,IAAY;IAC7B,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC;QAAE,OAAO,EAAE,OAAO,EAAE,EAAE,EAAE,CAAC;IAC9C,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,IAAI,EAAE,MAAM,CAAC,CAAyB,CAAC;QAC3E,OAAO,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC;IACpE,CAAC;IAAC,MAAM,CAAC;QACP,kFAAkF;QAClF,iFAAiF;QACjF,sFAAsF;QACtF,2BAA2B;QAC3B,OAAO,EAAE,OAAO,EAAE,EAAE,EAAE,CAAC;IACzB,CAAC;AACH,CAAC;AAED,SAAS,UAAU,CAAC,IAAY,EAAE,KAAkB;IAClD,SAAS,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAC9C,MAAM,GAAG,GAAG,GAAG,IAAI,QAAQ,OAAO,CAAC,GAAG,EAAE,CAAC;IACzC,aAAa,CAAC,GAAG,EAAE,IAAI,CAAC,SAAS,CAAC,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IACpE,UAAU,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;AACxB,CAAC;AAED;uFACuF;AACvF,MAAM,OAAO,cAAc;IACR,IAAI,CAAS;IAC9B,YAAY,OAAe,cAAc,EAAE;QACzC,IAAI,CAAC,IAAI,GAAG,kBAAkB,CAAC,IAAI,CAAC,CAAC;IACvC,CAAC;IAED,oFAAoF;IACpF,OAAO,CAAC,QAA0B;QAChC,MAAM,KAAK,GAAG,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACnC,IAAI,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,UAAU,KAAK,QAAQ,CAAC,UAAU,CAAC;YAAE,OAAO,CAAC,kBAAkB;QAC/F,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QAC7B,UAAU,CAAC,IAAI,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;IAC/B,CAAC;IAED,+EAA+E;IAC/E,GAAG,CAAC,UAAkB;QACpB,MAAM,KAAK,GAAG,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACnC,MAAM,IAAI,GAAG,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,UAAU,KAAK,UAAU,CAAC,CAAC;QACtE,IAAI,IAAI,CAAC,MAAM,KAAK,KAAK,CAAC,OAAO,CAAC,MAAM;YAAE,UAAU,CAAC,IAAI,CAAC,IAAI,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC;IACrF,CAAC;IAED,2FAA2F;IAC3F,OAAO;QACL,OAAO,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,OAAO,CAAC;IACtC,CAAC;CACF"}

package/node_modules/@openrig/daemon/dist/domain/gateway/dispatcher.d.ts

@@ -0,0 +1,32 @@
+import type { DispatchBuffer } from "./dispatch-buffer.js";
+import { type CapabilityDescriptor, type OutboundDecision } from "./protocol.js";
+export interface DispatcherDeps {
+    buffer: DispatchBuffer;
+    /** The transport write (a framed unix-socket send in prod; an in-memory sink in tests). */
+    send: (decision: OutboundDecision) => void;
+    /** Injectable id source (tests pin decisionIds; prod = a UUID). */
+    newDecisionId?: () => string;
+}
+export type DispatchResult = {
+    ok: true;
+    decisionId: string;
+} | {
+    ok: false;
+    error: string;
+};
+export declare class GatewayDispatcher {
+    private readonly deps;
+    private descriptor;
+    constructor(deps: DispatcherDeps);
+    /** Handshake — record the connector's advertised capabilities. */
+    onCapability(descriptor: CapabilityDescriptor): void;
+    get connectorId(): string | undefined;
+    /** Dispatch an outbound decision. proof-9: pre-handshake OR an unadvertised op is REFUSED,
+     *  never attempted. Durable-first: persisted to the buffer BEFORE the transport send. */
+    dispatch(op: string, entityBindingRef: string, payload: unknown): DispatchResult;
+    /** The connector Acked a decision — drain it from the durable buffer. */
+    onAck(decisionId: string): void;
+    /** On (re)connect: re-send every un-Acked decision (no-loss across a connector outage). */
+    replayPending(): void;
+}
+//# sourceMappingURL=dispatcher.d.ts.map

package/node_modules/@openrig/daemon/dist/domain/gateway/dispatcher.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"dispatcher.d.ts","sourceRoot":"","sources":["../../../src/domain/gateway/dispatcher.ts"],"names":[],"mappings":"AAWA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AAC3D,OAAO,EAAkB,KAAK,oBAAoB,EAAE,KAAK,gBAAgB,EAAE,MAAM,eAAe,CAAC;AAEjG,MAAM,WAAW,cAAc;IAC7B,MAAM,EAAE,cAAc,CAAC;IACvB,2FAA2F;IAC3F,IAAI,EAAE,CAAC,QAAQ,EAAE,gBAAgB,KAAK,IAAI,CAAC;IAC3C,mEAAmE;IACnE,aAAa,CAAC,EAAE,MAAM,MAAM,CAAC;CAC9B;AAED,MAAM,MAAM,cAAc,GACtB;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,UAAU,EAAE,MAAM,CAAA;CAAE,GAChC;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,CAAC;AAEjC,qBAAa,iBAAiB;IAEhB,OAAO,CAAC,QAAQ,CAAC,IAAI;IADjC,OAAO,CAAC,UAAU,CAAmC;gBACxB,IAAI,EAAE,cAAc;IAEjD,kEAAkE;IAClE,YAAY,CAAC,UAAU,EAAE,oBAAoB,GAAG,IAAI;IAIpD,IAAI,WAAW,IAAI,MAAM,GAAG,SAAS,CAEpC;IAED;6FACyF;IACzF,QAAQ,CAAC,EAAE,EAAE,MAAM,EAAE,gBAAgB,EAAE,MAAM,EAAE,OAAO,EAAE,OAAO,GAAG,cAAc;IAchF,yEAAyE;IACzE,KAAK,CAAC,UAAU,EAAE,MAAM,GAAG,IAAI;IAI/B,2FAA2F;IAC3F,aAAa,IAAI,IAAI;CAGtB"}

package/node_modules/@openrig/daemon/dist/domain/gateway/dispatcher.js

@@ -0,0 +1,50 @@
+// M1 A4a — the gateway MODULE's core logic (the OS process's brain), transport-injected so
+// it is unit-testable without a real socket. The thin spawn wrapper + the unix-socket
+// transport wire this to the connector; here is the ruled behavior (contract a305310d):
+//   - handshake: until a CapabilityDescriptor arrives, dispatch is refused.
+//   - dispatch: an op MUST be advertised (proof-9: unadvertised = refused, NOT attempted);
+//     durable-FIRST (enqueue to the dispatch buffer before send).
+//   - ack: drains the decision from the buffer (ack-gated drain).
+//   - replayPending: on (re)connect, re-send every un-Acked decision — connector-outage ->
+//     no-loss; decisionId keeps the re-send a byte-identical dup, never a second record.
+import { randomUUID } from "node:crypto";
+import { isAdvertisedOp } from "./protocol.js";
+export class GatewayDispatcher {
+    deps;
+    descriptor;
+    constructor(deps) {
+        this.deps = deps;
+    }
+    /** Handshake — record the connector's advertised capabilities. */
+    onCapability(descriptor) {
+        this.descriptor = descriptor;
+    }
+    get connectorId() {
+        return this.descriptor?.connectorId;
+    }
+    /** Dispatch an outbound decision. proof-9: pre-handshake OR an unadvertised op is REFUSED,
+     *  never attempted. Durable-first: persisted to the buffer BEFORE the transport send. */
+    dispatch(op, entityBindingRef, payload) {
+        if (!this.descriptor) {
+            return { ok: false, error: "dispatch refused: no capability descriptor yet (handshake incomplete)" };
+        }
+        if (!isAdvertisedOp(this.descriptor, op)) {
+            return { ok: false, error: `dispatch refused: op "${op}" is not advertised by connector ${this.descriptor.connectorId} (unadvertised ops are refused, not attempted)` };
+        }
+        const decisionId = (this.deps.newDecisionId ?? randomUUID)();
+        const decision = { kind: "outbound_decision", decisionId, op, entityBindingRef, payload };
+        this.deps.buffer.enqueue(decision); // durable BEFORE dispatch
+        this.deps.send(decision);
+        return { ok: true, decisionId };
+    }
+    /** The connector Acked a decision — drain it from the durable buffer. */
+    onAck(decisionId) {
+        this.deps.buffer.ack(decisionId);
+    }
+    /** On (re)connect: re-send every un-Acked decision (no-loss across a connector outage). */
+    replayPending() {
+        for (const decision of this.deps.buffer.pending())
+            this.deps.send(decision);
+    }
+}
+//# sourceMappingURL=dispatcher.js.map

package/node_modules/@openrig/daemon/dist/domain/gateway/dispatcher.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"dispatcher.js","sourceRoot":"","sources":["../../../src/domain/gateway/dispatcher.ts"],"names":[],"mappings":"AAAA,2FAA2F;AAC3F,sFAAsF;AACtF,wFAAwF;AACxF,4EAA4E;AAC5E,2FAA2F;AAC3F,kEAAkE;AAClE,kEAAkE;AAClE,2FAA2F;AAC3F,yFAAyF;AAEzF,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAEzC,OAAO,EAAE,cAAc,EAAoD,MAAM,eAAe,CAAC;AAcjG,MAAM,OAAO,iBAAiB;IAEC;IADrB,UAAU,CAAmC;IACrD,YAA6B,IAAoB;QAApB,SAAI,GAAJ,IAAI,CAAgB;IAAG,CAAC;IAErD,kEAAkE;IAClE,YAAY,CAAC,UAAgC;QAC3C,IAAI,CAAC,UAAU,GAAG,UAAU,CAAC;IAC/B,CAAC;IAED,IAAI,WAAW;QACb,OAAO,IAAI,CAAC,UAAU,EAAE,WAAW,CAAC;IACtC,CAAC;IAED;6FACyF;IACzF,QAAQ,CAAC,EAAU,EAAE,gBAAwB,EAAE,OAAgB;QAC7D,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,CAAC;YACrB,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,uEAAuE,EAAE,CAAC;QACvG,CAAC;QACD,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC,UAAU,EAAE,EAAE,CAAC,EAAE,CAAC;YACzC,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,yBAAyB,EAAE,oCAAoC,IAAI,CAAC,UAAU,CAAC,WAAW,gDAAgD,EAAE,CAAC;QAC1K,CAAC;QACD,MAAM,UAAU,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,aAAa,IAAI,UAAU,CAAC,EAAE,CAAC;QAC7D,MAAM,QAAQ,GAAqB,EAAE,IAAI,EAAE,mBAAmB,EAAE,UAAU,EAAE,EAAE,EAAE,gBAAgB,EAAE,OAAO,EAAE,CAAC;QAC5G,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC,0BAA0B;QAC9D,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QACzB,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,UAAU,EAAE,CAAC;IAClC,CAAC;IAED,yEAAyE;IACzE,KAAK,CAAC,UAAkB;QACtB,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;IACnC,CAAC;IAED,2FAA2F;IAC3F,aAAa;QACX,KAAK,MAAM,QAAQ,IAAI,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE;YAAE,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IAC9E,CAAC;CACF"}

package/node_modules/@openrig/daemon/dist/domain/gateway/external-admission.d.ts

@@ -0,0 +1,25 @@
+export { OPERATOR_HUMAN_DEFAULT_SLOT } from "./human-registry.js";
+/** The identity a registered human contributes to admission (a projection of the A3
+ *  fragment; the resolver only needs the key + address for admission). */
+export interface RegisteredEntity {
+    entityId: string;
+    address: string;
+}
+export type ExternalResolution = {
+    kind: "registered";
+    entityId: string;
+} | {
+    kind: "scheme";
+    scheme: string;
+    handle: string;
+} | {
+    kind: "unregistered";
+    local: string;
+    error: string;
+};
+/** Resolve the `local` part of a `<local>@external` ref against the registered entities.
+ *  A scheme form (`local` contains ':') is the literal-scheme mode — a one-off address,
+ *  never a registry lookup. Otherwise the registered mode: `local` is the entityId. An
+ *  absent entity is a LOUD structured teaching refusal, never a silent/agent-class fall. */
+export declare function resolveExternal(local: string, entities: readonly RegisteredEntity[]): ExternalResolution;
+//# sourceMappingURL=external-admission.d.ts.map

package/node_modules/@openrig/daemon/dist/domain/gateway/external-admission.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"external-admission.d.ts","sourceRoot":"","sources":["../../../src/domain/gateway/external-admission.ts"],"names":[],"mappings":"AAmBA,OAAO,EAAE,2BAA2B,EAAE,MAAM,qBAAqB,CAAC;AAElE;0EAC0E;AAC1E,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,EAAE,MAAM,CAAC;IACjB,OAAO,EAAE,MAAM,CAAC;CACjB;AAED,MAAM,MAAM,kBAAkB,GAC1B;IAAE,IAAI,EAAE,YAAY,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAA;CAAE,GACxC;IAAE,IAAI,EAAE,QAAQ,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,GAClD;IAAE,IAAI,EAAE,cAAc,CAAC;IAAC,KAAK,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,CAAC;AAG3D;;;4FAG4F;AAC5F,wBAAgB,eAAe,CAAC,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,SAAS,gBAAgB,EAAE,GAAG,kBAAkB,CAgBxG"}

package/node_modules/@openrig/daemon/dist/domain/gateway/external-admission.js

@@ -0,0 +1,41 @@
+// M1 A4b — @external entity-admission. Contract 2a57d099 (sealed): resolve a
+// <local>@external destination against the human registry (A3). Home = the daemon
+// gateway-path (topologyValidateRig / 4b, queue-side) + the A4 gateway (connector-side),
+// arch-ruled 8cd30094. This module is the RESOLVER; the daemon-side registry READER
+// (loads the projection entities) + the gate wiring consume it.
+//
+// The four ruled outcomes (never silent, NEVER an agent-class downgrade):
+//   registered   mike@external            -> entity found (prefs applied downstream)
+//   scheme        slack:U012AB3CD@external -> a one-off ADDRESS (never a registry entry;
+//                                            connector #1 delivers it directly)
+//   unregistered  stranger@external        -> LOUD structured teaching refusal
+//   (unresolved inbound with no target)    -> the default HUMAN slot human-operator@kernel
+//
+// proof-2 captures BOTH refusal texts: the DOMAIN-level bounce (a token NOT in the
+// closed set falls through to unknown_destination_rig, from A1/A2) AND the ENTITY-level
+// teaching refusal here (valid @external domain, entity absent).
+// The default HUMAN operator identity — re-exported from its canonical home in the
+// human-registry (ONE source, no dup). See there for the concept-1/concept-2 note.
+export { OPERATOR_HUMAN_DEFAULT_SLOT } from "./human-registry.js";
+/** Resolve the `local` part of a `<local>@external` ref against the registered entities.
+ *  A scheme form (`local` contains ':') is the literal-scheme mode — a one-off address,
+ *  never a registry lookup. Otherwise the registered mode: `local` is the entityId. An
+ *  absent entity is a LOUD structured teaching refusal, never a silent/agent-class fall. */
+export function resolveExternal(local, entities) {
+    const colon = local.indexOf(":");
+    if (colon > 0 && colon < local.length - 1) {
+        return { kind: "scheme", scheme: local.slice(0, colon), handle: local.slice(colon + 1) };
+    }
+    const found = entities.find((e) => e.entityId === local);
+    if (found)
+        return { kind: "registered", entityId: found.entityId };
+    return {
+        kind: "unregistered",
+        local,
+        error: `'${local}@external' names no registered human (no gateway/humans/${local}.yaml fragment). ` +
+            `Register the human first: rig gateway human add ${local} --display-name … --binding … --delivery-class …; ` +
+            `or address a human that is already registered. ` +
+            `(This is a virtual-domain reference — it was NOT downgraded to an agent seat.)`,
+    };
+}
+//# sourceMappingURL=external-admission.js.map

package/node_modules/@openrig/daemon/dist/domain/gateway/external-admission.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"external-admission.js","sourceRoot":"","sources":["../../../src/domain/gateway/external-admission.ts"],"names":[],"mappings":"AAAA,6EAA6E;AAC7E,kFAAkF;AAClF,yFAAyF;AACzF,oFAAoF;AACpF,gEAAgE;AAChE,EAAE;AACF,0EAA0E;AAC1E,qFAAqF;AACrF,yFAAyF;AACzF,gFAAgF;AAChF,+EAA+E;AAC/E,2FAA2F;AAC3F,EAAE;AACF,mFAAmF;AACnF,wFAAwF;AACxF,iEAAiE;AAEjE,mFAAmF;AACnF,mFAAmF;AACnF,OAAO,EAAE,2BAA2B,EAAE,MAAM,qBAAqB,CAAC;AAelE;;;4FAG4F;AAC5F,MAAM,UAAU,eAAe,CAAC,KAAa,EAAE,QAAqC;IAClF,MAAM,KAAK,GAAG,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IACjC,IAAI,KAAK,GAAG,CAAC,IAAI,KAAK,GAAG,KAAK,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC1C,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC,EAAE,MAAM,EAAE,KAAK,CAAC,KAAK,CAAC,KAAK,GAAG,CAAC,CAAC,EAAE,CAAC;IAC3F,CAAC;IACD,MAAM,KAAK,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,KAAK,CAAC,CAAC;IACzD,IAAI,KAAK;QAAE,OAAO,EAAE,IAAI,EAAE,YAAY,EAAE,QAAQ,EAAE,KAAK,CAAC,QAAQ,EAAE,CAAC;IACnE,OAAO;QACL,IAAI,EAAE,cAAc;QACpB,KAAK;QACL,KAAK,EACH,IAAI,KAAK,2DAA2D,KAAK,mBAAmB;YAC5F,mDAAmD,KAAK,oDAAoD;YAC5G,iDAAiD;YACjD,gFAAgF;KACnF,CAAC;AACJ,CAAC"}

package/node_modules/@openrig/daemon/dist/domain/gateway/gateway-process-main.d.ts

@@ -0,0 +1,7 @@
+import { type GatewayProcessHandle } from "./gateway-process.js";
+export declare const GATEWAY_SOCKET_ENV = "OPENRIG_GATEWAY_SOCKET";
+export declare const GATEWAY_RECONNECT_MS_ENV = "OPENRIG_GATEWAY_RECONNECT_MS";
+/** Start the gateway process from environment config. Returns the handle (undefined if the
+ *  required socket path is missing — the entry sets a non-zero exit code and returns). */
+export declare function mainFromEnv(env?: NodeJS.ProcessEnv): GatewayProcessHandle | undefined;
+//# sourceMappingURL=gateway-process-main.d.ts.map

package/node_modules/@openrig/daemon/dist/domain/gateway/gateway-process-main.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"gateway-process-main.d.ts","sourceRoot":"","sources":["../../../src/domain/gateway/gateway-process-main.ts"],"names":[],"mappings":"AAOA,OAAO,EAAqB,KAAK,oBAAoB,EAAE,MAAM,sBAAsB,CAAC;AAEpF,eAAO,MAAM,kBAAkB,2BAA2B,CAAC;AAC3D,eAAO,MAAM,wBAAwB,iCAAiC,CAAC;AAEvE;0FAC0F;AAC1F,wBAAgB,WAAW,CAAC,GAAG,GAAE,MAAM,CAAC,UAAwB,GAAG,oBAAoB,GAAG,SAAS,CAsBlG"}