@openrig/cli 0.5.0 → 0.5.2

package/node_modules/@openrig/daemon/dist/domain/kernel-boot.js

@@ -0,0 +1,147 @@
+// V0.3.1 slice 05 kernel-rig-as-default — kernel auto-boot path.
+//
+// Composes into rig daemon start per IMPL-PRD §6.1: probes runtime
+// auth state, selects a variant (dual / claude-only / codex-only),
+// and fires the in-process bootstrap pipeline IN THE BACKGROUND.
+// Short-circuits cleanly when:
+//   - OPENRIG_NO_KERNEL=1 is set (operator opt-out / test fixture)
+//   - A managed rig named `kernel` already exists in the DB
+//   - Both runtimes are unauthenticated (auth_blocked terminal state)
+//   - The selected variant's spec file is missing
+//
+// Forward-fix #3 architectural amendment (IMPL-PRD §16 amended):
+// The bootstrap promise is NOT awaited. KernelBootTracker is returned
+// immediately so createDaemon can finish + server.ts can bind healthz.
+// A broken kernel agent therefore can no longer keep the daemon's HTTP
+// surface from starting — operators see "daemon ready; kernel <state>"
+// rather than "daemon failed to start".
+import nodePath from "node:path";
+import { existsSync } from "node:fs";
+import { KernelBootTracker } from "./kernel-boot-tracker.js";
+/** Entry point. Idempotent: safe to call on every daemon startup.
+ *  Returns the tracker immediately; bootstrap (if fired) runs in the
+ *  background. Callers should NOT await the tracker's internal
+ *  bootstrap promise — that's the whole point of the architectural
+ *  decoupling. Tracker state is observable via getStatus() and the
+ *  /api/kernel/status route. */
+export async function bootKernelIfNeeded(deps) {
+    const log = deps.log ?? defaultLog;
+    const tracker = new KernelBootTracker({
+        eventBus: deps.eventBus,
+        sessionRegistry: deps.sessionRegistry,
+        rigRepo: deps.rigRepo,
+        degradedTimeoutMs: deps.degradedTimeoutMs,
+    });
+    // 1. --no-kernel opt-out (CLI flag projected via OPENRIG_NO_KERNEL).
+    // VITEST env additionally short-circuits the live runtime probe
+    // path so daemon-composition tests don't block 5s+ on shelled-out
+    // claude/codex CLI calls — real production probes complete in
+    // ~100ms; this is an explicit test-fast escape hatch so individual
+    // test files don't each have to remember to set OPENRIG_NO_KERNEL=1.
+    // The auto-skip is suppressed when deps.probeRuntimes is injected:
+    // kernel-boot's own unit tests inject a fast deterministic probe
+    // and explicitly want to exercise the full logic.
+    const probeInjected = typeof deps.probeRuntimes === "function";
+    if (process.env["OPENRIG_NO_KERNEL"] === "1" || (process.env["VITEST"] === "true" && !probeInjected)) {
+        const reason = process.env["OPENRIG_NO_KERNEL"] === "1" ? "OPENRIG_NO_KERNEL=1" : "VITEST=true";
+        log("info", `kernel-boot: ${reason} — skipping kernel auto-boot`);
+        tracker.setSkipped(reason);
+        return tracker;
+    }
+    // 2. Already-managed short-circuit. If a rig named `kernel` exists
+    // (e.g., from a prior boot or operator-migrated substrate kernel),
+    // the builtin path stays out of the way.
+    if (kernelAlreadyManaged(deps.rigRepo)) {
+        log("info", "kernel-boot: kernel rig already managed; skipping builtin boot");
+        tracker.setSkipped("kernel rig already managed");
+        return tracker;
+    }
+    // 3. Probe runtime auth state to pick a variant.
+    const probe = await (deps.probeRuntimes ?? defaultProbeRuntimes)();
+    if (probe.claudeCode === "unavailable" && probe.codex === "unavailable") {
+        const msg = authBlockMessage();
+        log("error", msg);
+        tracker.setAuthBlocked(msg);
+        return tracker;
+    }
+    const variant = selectVariant(probe);
+    const specPath = nodePath.join(deps.specsDir, "rigs/launch/kernel", variant);
+    if (!existsSync(specPath)) {
+        log("warn", `kernel-boot: spec missing at ${specPath} — skipping`);
+        tracker.setSpecMissing(specPath);
+        return tracker;
+    }
+    // 4. Cold boot via the in-process bootstrap pipeline — FIRED, not awaited.
+    log("info", `kernel-boot: booting kernel rig from ${variant}`);
+    const bootstrapPromise = deps.bootstrapOrchestrator.bootstrap({
+        mode: "apply",
+        sourceRef: specPath,
+        sourceKind: "rig_spec",
+        autoApprove: true,
+        cwdOverride: deps.cwdOverride,
+    });
+    tracker.startBooting(variant, bootstrapPromise);
+    return tracker;
+}
+/** True when a rig named `kernel` already exists in the DB. */
+export function kernelAlreadyManaged(rigRepo) {
+    const rigs = rigRepo.listRigs();
+    return rigs.some((r) => r.name === "kernel");
+}
+/** Choose a rig variant from the auth probe. */
+export function selectVariant(probe) {
+    if (probe.claudeCode === "ok" && probe.codex === "ok")
+        return "rig.yaml";
+    if (probe.claudeCode === "ok")
+        return "rig-claude-only.yaml";
+    if (probe.codex === "ok")
+        return "rig-codex-only.yaml";
+    // Caller is expected to short-circuit before reaching here on the
+    // both-unavailable path; defensive default keeps the type narrow.
+    return "rig.yaml";
+}
+/** Default auth probe — shells out to the runtime CLIs. */
+async function defaultProbeRuntimes() {
+    const { exec } = await import("node:child_process");
+    const { promisify } = await import("node:util");
+    const execAsync = promisify(exec);
+    async function tryProbe(cmd) {
+        try {
+            const { stdout, stderr } = await execAsync(cmd, { timeout: 5000 });
+            const out = `${stdout}\n${stderr}`.toLowerCase();
+            // Conservative parse: any indicator the CLI considers itself
+            // unauthenticated marks the runtime unavailable. Tighter parsing
+            // can land in a follow-up.
+            if (out.includes("not logged") || out.includes("not authenticated") || out.includes("login required")) {
+                return "unavailable";
+            }
+            return "ok";
+        }
+        catch {
+            return "unavailable";
+        }
+    }
+    const [claudeCode, codex] = await Promise.all([
+        tryProbe("claude auth status"),
+        tryProbe("codex login status"),
+    ]);
+    return { claudeCode, codex };
+}
+/** Honest 3-part-error message for the auth-block path. Per IMPL-PRD
+ *  §6.3 + the building-agent-software skill discipline. */
+export function authBlockMessage() {
+    return [
+        "Error: Kernel rig cannot boot — no AI runtime is authenticated.",
+        "Reason: Kernel rig requires at least one of Claude Code or Codex authenticated. Both are unavailable.",
+        "Fix: Run `claude auth login` to authenticate Claude Code, OR `codex login` to authenticate Codex. Then run `rig daemon start` (or `rig setup`) again.",
+    ].join("\n");
+}
+function defaultLog(level, message) {
+    if (level === "error")
+        console.error(message);
+    else if (level === "warn")
+        console.warn(message);
+    else
+        console.log(message);
+}
+//# sourceMappingURL=kernel-boot.js.map

package/node_modules/@openrig/daemon/dist/domain/kernel-boot.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"kernel-boot.js","sourceRoot":"","sources":["../../src/domain/kernel-boot.ts"],"names":[],"mappings":"AAAA,iEAAiE;AACjE,EAAE;AACF,mEAAmE;AACnE,mEAAmE;AACnE,iEAAiE;AACjE,+BAA+B;AAC/B,mEAAmE;AACnE,4DAA4D;AAC5D,sEAAsE;AACtE,kDAAkD;AAClD,EAAE;AACF,iEAAiE;AACjE,sEAAsE;AACtE,uEAAuE;AACvE,uEAAuE;AACvE,uEAAuE;AACvE,wCAAwC;AAExC,OAAO,QAAQ,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AAKrC,OAAO,EAAE,iBAAiB,EAAE,MAAM,0BAA0B,CAAC;AAmC7D;;;;;gCAKgC;AAChC,MAAM,CAAC,KAAK,UAAU,kBAAkB,CAAC,IAAoB;IAC3D,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,IAAI,UAAU,CAAC;IACnC,MAAM,OAAO,GAAG,IAAI,iBAAiB,CAAC;QACpC,QAAQ,EAAE,IAAI,CAAC,QAAQ;QACvB,eAAe,EAAE,IAAI,CAAC,eAAe;QACrC,OAAO,EAAE,IAAI,CAAC,OAAO;QACrB,iBAAiB,EAAE,IAAI,CAAC,iBAAiB;KAC1C,CAAC,CAAC;IAEH,qEAAqE;IACrE,gEAAgE;IAChE,kEAAkE;IAClE,8DAA8D;IAC9D,mEAAmE;IACnE,qEAAqE;IACrE,mEAAmE;IACnE,iEAAiE;IACjE,kDAAkD;IAClD,MAAM,aAAa,GAAG,OAAO,IAAI,CAAC,aAAa,KAAK,UAAU,CAAC;IAC/D,IAAI,OAAO,CAAC,GAAG,CAAC,mBAAmB,CAAC,KAAK,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,KAAK,MAAM,IAAI,CAAC,aAAa,CAAC,EAAE,CAAC;QACrG,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,mBAAmB,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC,qBAAqB,CAAC,CAAC,CAAC,aAAa,CAAC;QAChG,GAAG,CAAC,MAAM,EAAE,gBAAgB,MAAM,8BAA8B,CAAC,CAAC;QAClE,OAAO,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC;QAC3B,OAAO,OAAO,CAAC;IACjB,CAAC;IAED,mEAAmE;IACnE,mEAAmE;IACnE,yCAAyC;IACzC,IAAI,oBAAoB,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;QACvC,GAAG,CAAC,MAAM,EAAE,gEAAgE,CAAC,CAAC;QAC9E,OAAO,CAAC,UAAU,CAAC,4BAA4B,CAAC,CAAC;QACjD,OAAO,OAAO,CAAC;IACjB,CAAC;IAED,iDAAiD;IACjD,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,CAAC,aAAa,IAAI,oBAAoB,CAAC,EAAE,CAAC;IAEnE,IAAI,KAAK,CAAC,UAAU,KAAK,aAAa,IAAI,KAAK,CAAC,KAAK,KAAK,aAAa,EAAE,CAAC;QACxE,MAAM,GAAG,GAAG,gBAAgB,EAAE,CAAC;QAC/B,GAAG,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC;QAClB,OAAO,CAAC,cAAc,CAAC,GAAG,CAAC,CAAC;QAC5B,OAAO,OAAO,CAAC;IACjB,CAAC;IAED,MAAM,OAAO,GAAG,aAAa,CAAC,KAAK,CAAC,CAAC;IACrC,MAAM,QAAQ,GAAG,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,oBAAoB,EAAE,OAAO,CAAC,CAAC;IAE7E,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,EAAE,CAAC;QAC1B,GAAG,CAAC,MAAM,EAAE,gCAAgC,QAAQ,aAAa,CAAC,CAAC;QACnE,OAAO,CAAC,cAAc,CAAC,QAAQ,CAAC,CAAC;QACjC,OAAO,OAAO,CAAC;IACjB,CAAC;IAED,2EAA2E;IAC3E,GAAG,CAAC,MAAM,EAAE,wCAAwC,OAAO,EAAE,CAAC,CAAC;IAC/D,MAAM,gBAAgB,GAAG,IAAI,CAAC,qBAAqB,CAAC,SAAS,CAAC;QAC5D,IAAI,EAAE,OAAO;QACb,SAAS,EAAE,QAAQ;QACnB,UAAU,EAAE,UAAU;QACtB,WAAW,EAAE,IAAI;QACjB,WAAW,EAAE,IAAI,CAAC,WAAW;KAC9B,CAAC,CAAC;IACH,OAAO,CAAC,YAAY,CAAC,OAAO,EAAE,gBAAgB,CAAC,CAAC;IAChD,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,+DAA+D;AAC/D,MAAM,UAAU,oBAAoB,CAAC,OAAsB;IACzD,MAAM,IAAI,GAAG,OAAO,CAAC,QAAQ,EAAE,CAAC;IAChC,OAAO,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC;AAC/C,CAAC;AAED,gDAAgD;AAChD,MAAM,UAAU,aAAa,CAAC,KAAyB;IACrD,IAAI,KAAK,CAAC,UAAU,KAAK,IAAI,IAAI,KAAK,CAAC,KAAK,KAAK,IAAI;QAAE,OAAO,UAAU,CAAC;IACzE,IAAI,KAAK,CAAC,UAAU,KAAK,IAAI;QAAE,OAAO,sBAAsB,CAAC;IAC7D,IAAI,KAAK,CAAC,KAAK,KAAK,IAAI;QAAE,OAAO,qBAAqB,CAAC;IACvD,kEAAkE;IAClE,kEAAkE;IAClE,OAAO,UAAU,CAAC;AACpB,CAAC;AAED,2DAA2D;AAC3D,KAAK,UAAU,oBAAoB;IACjC,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,MAAM,CAAC,oBAAoB,CAAC,CAAC;IACpD,MAAM,EAAE,SAAS,EAAE,GAAG,MAAM,MAAM,CAAC,WAAW,CAAC,CAAC;IAChD,MAAM,SAAS,GAAG,SAAS,CAAC,IAAI,CAAC,CAAC;IAElC,KAAK,UAAU,QAAQ,CAAC,GAAW;QACjC,IAAI,CAAC;YACH,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,SAAS,CAAC,GAAG,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC;YACnE,MAAM,GAAG,GAAG,GAAG,MAAM,KAAK,MAAM,EAAE,CAAC,WAAW,EAAE,CAAC;YACjD,6DAA6D;YAC7D,iEAAiE;YACjE,2BAA2B;YAC3B,IAAI,GAAG,CAAC,QAAQ,CAAC,YAAY,CAAC,IAAI,GAAG,CAAC,QAAQ,CAAC,mBAAmB,CAAC,IAAI,GAAG,CAAC,QAAQ,CAAC,gBAAgB,CAAC,EAAE,CAAC;gBACtG,OAAO,aAAa,CAAC;YACvB,CAAC;YACD,OAAO,IAAI,CAAC;QACd,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,aAAa,CAAC;QACvB,CAAC;IACH,CAAC;IAED,MAAM,CAAC,UAAU,EAAE,KAAK,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;QAC5C,QAAQ,CAAC,oBAAoB,CAAC;QAC9B,QAAQ,CAAC,oBAAoB,CAAC;KAC/B,CAAC,CAAC;IAEH,OAAO,EAAE,UAAU,EAAE,KAAK,EAAE,CAAC;AAC/B,CAAC;AAED;2DAC2D;AAC3D,MAAM,UAAU,gBAAgB;IAC9B,OAAO;QACL,iEAAiE;QACjE,uGAAuG;QACvG,uJAAuJ;KACxJ,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AACf,CAAC;AAED,SAAS,UAAU,CAAC,KAAgC,EAAE,OAAe;IACnE,IAAI,KAAK,KAAK,OAAO;QAAE,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;SACzC,IAAI,KAAK,KAAK,MAAM;QAAE,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;;QAC5C,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;AAC5B,CAAC"}

package/node_modules/@openrig/daemon/dist/domain/managed-blocks.d.ts

@@ -0,0 +1,18 @@
+export declare const MANAGED_BLOCK_START: (id: string) => string;
+export declare const MANAGED_BLOCK_END: (id: string) => string;
+export interface ManagedBlockMergeFsOps {
+    exists(path: string): boolean;
+    readFile(path: string): string;
+    writeFile(path: string, content: string): void;
+    mkdirp?(path: string): void;
+}
+export interface ManagedBlockCleanupFsOps extends ManagedBlockMergeFsOps {
+    deleteFile(path: string): void;
+}
+export interface MergeManagedBlockOptions {
+    replaceBlockIds?: string[];
+}
+export declare function mergeManagedBlock(fs: ManagedBlockMergeFsOps, targetPath: string, blockId: string, content: string, options?: MergeManagedBlockOptions): void;
+export declare function removeManagedBlocksFromFile(fs: ManagedBlockCleanupFsOps, targetPath: string): boolean;
+export declare function stripManagedBlocks(content: string): string;
+//# sourceMappingURL=managed-blocks.d.ts.map

package/node_modules/@openrig/daemon/dist/domain/managed-blocks.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"managed-blocks.d.ts","sourceRoot":"","sources":["../../src/domain/managed-blocks.ts"],"names":[],"mappings":"AAMA,eAAO,MAAM,mBAAmB,GAAI,IAAI,MAAM,WAAkD,CAAC;AACjG,eAAO,MAAM,iBAAiB,GAAI,IAAI,MAAM,WAAgD,CAAC;AAI7F,MAAM,WAAW,sBAAsB;IACrC,MAAM,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC;IAC9B,QAAQ,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAAC;IAC/B,SAAS,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;IAC/C,MAAM,CAAC,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;CAC7B;AAED,MAAM,WAAW,wBAAyB,SAAQ,sBAAsB;IACtE,UAAU,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;CAChC;AAED,MAAM,WAAW,wBAAwB;IACvC,eAAe,CAAC,EAAE,MAAM,EAAE,CAAC;CAC5B;AAED,wBAAgB,iBAAiB,CAC/B,EAAE,EAAE,sBAAsB,EAC1B,UAAU,EAAE,MAAM,EAClB,OAAO,EAAE,MAAM,EACf,OAAO,EAAE,MAAM,EACf,OAAO,CAAC,EAAE,wBAAwB,GACjC,IAAI,CA8CN;AAED,wBAAgB,2BAA2B,CAAC,EAAE,EAAE,wBAAwB,EAAE,UAAU,EAAE,MAAM,GAAG,OAAO,CAkBrG;AAED,wBAAgB,kBAAkB,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,CAS1D"}

package/node_modules/@openrig/daemon/dist/domain/managed-blocks.js

@@ -0,0 +1,80 @@
+import nodePath from "node:path";
+// Pre-release: projection markers that land in user-managed files
+// (CLAUDE.md / AGENTS.md) carry the canonical product name. New writes
+// emit the OpenRig form; legacy "RIGGED" markers from prior installs
+// are still recognized by stripManagedBlocks below for clean uninstall.
+export const MANAGED_BLOCK_START = (id) => `<!-- BEGIN OpenRig MANAGED BLOCK: ${id} -->`;
+export const MANAGED_BLOCK_END = (id) => `<!-- END OpenRig MANAGED BLOCK: ${id} -->`;
+const LEGACY_BLOCK_START = (id) => `<!-- BEGIN RIGGED MANAGED BLOCK: ${id} -->`;
+const LEGACY_BLOCK_END = (id) => `<!-- END RIGGED MANAGED BLOCK: ${id} -->`;
+export function mergeManagedBlock(fs, targetPath, blockId, content, options) {
+    const begin = MANAGED_BLOCK_START(blockId);
+    const end = MANAGED_BLOCK_END(blockId);
+    const block = `${begin}\n${content}\n${end}`;
+    if (!fs.exists(targetPath)) {
+        fs.mkdirp?.(nodePath.dirname(targetPath));
+        fs.writeFile(targetPath, block);
+        return;
+    }
+    const existing = fs.readFile(targetPath);
+    const allReplaceIds = Array.from(new Set([blockId, ...(options?.replaceBlockIds ?? [])]));
+    const replaceableIds = allReplaceIds.filter((id) => {
+        const candidateBegin = MANAGED_BLOCK_START(id);
+        const candidateEnd = MANAGED_BLOCK_END(id);
+        const legacyBegin = LEGACY_BLOCK_START(id);
+        const legacyEnd = LEGACY_BLOCK_END(id);
+        return ((existing.includes(candidateBegin) && existing.includes(candidateEnd)) ||
+            (existing.includes(legacyBegin) && existing.includes(legacyEnd)));
+    });
+    if (replaceableIds.length > 0) {
+        let updated = existing;
+        for (const id of replaceableIds) {
+            const candidateBegin = MANAGED_BLOCK_START(id);
+            const candidateEnd = MANAGED_BLOCK_END(id);
+            const regex = new RegExp(`${escapeRegex(candidateBegin)}[\\s\\S]*?${escapeRegex(candidateEnd)}`, "g");
+            updated = updated.replace(regex, id === blockId ? block : "");
+            // Legacy marker variant from prior installs — replace with the
+            // OpenRig form (or strip when not the active block id).
+            const legacyBegin = LEGACY_BLOCK_START(id);
+            const legacyEnd = LEGACY_BLOCK_END(id);
+            const legacyRegex = new RegExp(`${escapeRegex(legacyBegin)}[\\s\\S]*?${escapeRegex(legacyEnd)}`, "g");
+            updated = updated.replace(legacyRegex, id === blockId ? block : "");
+        }
+        if (!updated.includes(begin) || !updated.includes(end)) {
+            updated = `${updated.trim()}\n\n${block}`.trim();
+        }
+        fs.writeFile(targetPath, `${updated}\n`);
+        return;
+    }
+    fs.writeFile(targetPath, `${existing}\n\n${block}`);
+}
+export function removeManagedBlocksFromFile(fs, targetPath) {
+    if (!fs.exists(targetPath)) {
+        return false;
+    }
+    const original = fs.readFile(targetPath);
+    const cleaned = stripManagedBlocks(original);
+    if (cleaned.length === 0) {
+        fs.deleteFile(targetPath);
+        return true;
+    }
+    if (cleaned !== original.trim()) {
+        fs.writeFile(targetPath, `${cleaned}\n`);
+        return true;
+    }
+    return false;
+}
+export function stripManagedBlocks(content) {
+    // Recognize both the OpenRig form (current writes) and the legacy
+    // RIGGED form (existing user files written by prior installs) so
+    // uninstall + cleanup paths handle both transitional states.
+    return content
+        .replace(/(?:\n|^)\s*<!-- BEGIN OpenRig MANAGED BLOCK: [\s\S]*?<!-- END OpenRig MANAGED BLOCK: [^>]+ -->\s*(?=\n|$)/g, "\n")
+        .replace(/(?:\n|^)\s*<!-- BEGIN RIGGED MANAGED BLOCK: [\s\S]*?<!-- END RIGGED MANAGED BLOCK: [^>]+ -->\s*(?=\n|$)/g, "\n")
+        .replace(/\n{3,}/g, "\n\n")
+        .trim();
+}
+function escapeRegex(value) {
+    return value.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+}
+//# sourceMappingURL=managed-blocks.js.map

package/node_modules/@openrig/daemon/dist/domain/managed-blocks.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"managed-blocks.js","sourceRoot":"","sources":["../../src/domain/managed-blocks.ts"],"names":[],"mappings":"AAAA,OAAO,QAAQ,MAAM,WAAW,CAAC;AAEjC,kEAAkE;AAClE,uEAAuE;AACvE,qEAAqE;AACrE,wEAAwE;AACxE,MAAM,CAAC,MAAM,mBAAmB,GAAG,CAAC,EAAU,EAAE,EAAE,CAAC,qCAAqC,EAAE,MAAM,CAAC;AACjG,MAAM,CAAC,MAAM,iBAAiB,GAAG,CAAC,EAAU,EAAE,EAAE,CAAC,mCAAmC,EAAE,MAAM,CAAC;AAC7F,MAAM,kBAAkB,GAAG,CAAC,EAAU,EAAE,EAAE,CAAC,oCAAoC,EAAE,MAAM,CAAC;AACxF,MAAM,gBAAgB,GAAG,CAAC,EAAU,EAAE,EAAE,CAAC,kCAAkC,EAAE,MAAM,CAAC;AAiBpF,MAAM,UAAU,iBAAiB,CAC/B,EAA0B,EAC1B,UAAkB,EAClB,OAAe,EACf,OAAe,EACf,OAAkC;IAElC,MAAM,KAAK,GAAG,mBAAmB,CAAC,OAAO,CAAC,CAAC;IAC3C,MAAM,GAAG,GAAG,iBAAiB,CAAC,OAAO,CAAC,CAAC;IACvC,MAAM,KAAK,GAAG,GAAG,KAAK,KAAK,OAAO,KAAK,GAAG,EAAE,CAAC;IAE7C,IAAI,CAAC,EAAE,CAAC,MAAM,CAAC,UAAU,CAAC,EAAE,CAAC;QAC3B,EAAE,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC,CAAC;QAC1C,EAAE,CAAC,SAAS,CAAC,UAAU,EAAE,KAAK,CAAC,CAAC;QAChC,OAAO;IACT,CAAC;IAED,MAAM,QAAQ,GAAG,EAAE,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC;IACzC,MAAM,aAAa,GAAG,KAAK,CAAC,IAAI,CAAC,IAAI,GAAG,CAAC,CAAC,OAAO,EAAE,GAAG,CAAC,OAAO,EAAE,eAAe,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;IAC1F,MAAM,cAAc,GAAG,aAAa,CAAC,MAAM,CAAC,CAAC,EAAE,EAAE,EAAE;QACjD,MAAM,cAAc,GAAG,mBAAmB,CAAC,EAAE,CAAC,CAAC;QAC/C,MAAM,YAAY,GAAG,iBAAiB,CAAC,EAAE,CAAC,CAAC;QAC3C,MAAM,WAAW,GAAG,kBAAkB,CAAC,EAAE,CAAC,CAAC;QAC3C,MAAM,SAAS,GAAG,gBAAgB,CAAC,EAAE,CAAC,CAAC;QACvC,OAAO,CACL,CAAC,QAAQ,CAAC,QAAQ,CAAC,cAAc,CAAC,IAAI,QAAQ,CAAC,QAAQ,CAAC,YAAY,CAAC,CAAC;YACtE,CAAC,QAAQ,CAAC,QAAQ,CAAC,WAAW,CAAC,IAAI,QAAQ,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC,CACjE,CAAC;IACJ,CAAC,CAAC,CAAC;IAEH,IAAI,cAAc,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC9B,IAAI,OAAO,GAAG,QAAQ,CAAC;QACvB,KAAK,MAAM,EAAE,IAAI,cAAc,EAAE,CAAC;YAChC,MAAM,cAAc,GAAG,mBAAmB,CAAC,EAAE,CAAC,CAAC;YAC/C,MAAM,YAAY,GAAG,iBAAiB,CAAC,EAAE,CAAC,CAAC;YAC3C,MAAM,KAAK,GAAG,IAAI,MAAM,CAAC,GAAG,WAAW,CAAC,cAAc,CAAC,aAAa,WAAW,CAAC,YAAY,CAAC,EAAE,EAAE,GAAG,CAAC,CAAC;YACtG,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,KAAK,OAAO,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;YAC9D,+DAA+D;YAC/D,wDAAwD;YACxD,MAAM,WAAW,GAAG,kBAAkB,CAAC,EAAE,CAAC,CAAC;YAC3C,MAAM,SAAS,GAAG,gBAAgB,CAAC,EAAE,CAAC,CAAC;YACvC,MAAM,WAAW,GAAG,IAAI,MAAM,CAAC,GAAG,WAAW,CAAC,WAAW,CAAC,aAAa,WAAW,CAAC,SAAS,CAAC,EAAE,EAAE,GAAG,CAAC,CAAC;YACtG,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,WAAW,EAAE,EAAE,KAAK,OAAO,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;QACtE,CAAC;QACD,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;YACvD,OAAO,GAAG,GAAG,OAAO,CAAC,IAAI,EAAE,OAAO,KAAK,EAAE,CAAC,IAAI,EAAE,CAAC;QACnD,CAAC;QACD,EAAE,CAAC,SAAS,CAAC,UAAU,EAAE,GAAG,OAAO,IAAI,CAAC,CAAC;QACzC,OAAO;IACT,CAAC;IAED,EAAE,CAAC,SAAS,CAAC,UAAU,EAAE,GAAG,QAAQ,OAAO,KAAK,EAAE,CAAC,CAAC;AACtD,CAAC;AAED,MAAM,UAAU,2BAA2B,CAAC,EAA4B,EAAE,UAAkB;IAC1F,IAAI,CAAC,EAAE,CAAC,MAAM,CAAC,UAAU,CAAC,EAAE,CAAC;QAC3B,OAAO,KAAK,CAAC;IACf,CAAC;IAED,MAAM,QAAQ,GAAG,EAAE,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC;IACzC,MAAM,OAAO,GAAG,kBAAkB,CAAC,QAAQ,CAAC,CAAC;IAC7C,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACzB,EAAE,CAAC,UAAU,CAAC,UAAU,CAAC,CAAC;QAC1B,OAAO,IAAI,CAAC;IACd,CAAC;IAED,IAAI,OAAO,KAAK,QAAQ,CAAC,IAAI,EAAE,EAAE,CAAC;QAChC,EAAE,CAAC,SAAS,CAAC,UAAU,EAAE,GAAG,OAAO,IAAI,CAAC,CAAC;QACzC,OAAO,IAAI,CAAC;IACd,CAAC;IAED,OAAO,KAAK,CAAC;AACf,CAAC;AAED,MAAM,UAAU,kBAAkB,CAAC,OAAe;IAChD,kEAAkE;IAClE,iEAAiE;IACjE,6DAA6D;IAC7D,OAAO,OAAO;SACX,OAAO,CAAC,4GAA4G,EAAE,IAAI,CAAC;SAC3H,OAAO,CAAC,0GAA0G,EAAE,IAAI,CAAC;SACzH,OAAO,CAAC,SAAS,EAAE,MAAM,CAAC;SAC1B,IAAI,EAAE,CAAC;AACZ,CAAC;AAED,SAAS,WAAW,CAAC,KAAa;IAChC,OAAO,KAAK,CAAC,OAAO,CAAC,qBAAqB,EAAE,MAAM,CAAC,CAAC;AACtD,CAAC"}

package/node_modules/@openrig/daemon/dist/domain/mission-control/audit-browse.d.ts

@@ -0,0 +1,34 @@
+import type Database from "better-sqlite3";
+import { type MissionControlActionEntry } from "./mission-control-action-log.js";
+export interface AuditQueryInput {
+    qitemId?: string;
+    actionVerb?: string;
+    actorSession?: string;
+    /** ISO timestamp; rows with acted_at >= since are included. */
+    since?: string;
+    /** ISO timestamp; rows with acted_at <= until are included. */
+    until?: string;
+    /** Default 50; capped at 200. */
+    limit?: number;
+    /** Pagination cursor: returns rows whose action_id < beforeId. */
+    beforeId?: string;
+    /** OPR.0.4.4.19 FR-9 — the scope-approval target filters (the pinned
+     *  audit_notes_json shape's read path). These make Packet 2's one-query
+     *  UNVERIFIED-stamp cross-check real: filter by the stable scope target
+     *  (tier + dot-ID + canonical path) and/or approval scope. */
+    scopeTier?: string;
+    scopeId?: string;
+    scopePath?: string;
+    approvalScope?: string;
+}
+export interface AuditQueryResult {
+    rows: MissionControlActionEntry[];
+    hasMore: boolean;
+    nextBeforeId: string | null;
+}
+export declare class MissionControlAuditBrowse {
+    private readonly db;
+    constructor(db: Database.Database);
+    query(input: AuditQueryInput): AuditQueryResult;
+}
+//# sourceMappingURL=audit-browse.d.ts.map

package/node_modules/@openrig/daemon/dist/domain/mission-control/audit-browse.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"audit-browse.d.ts","sourceRoot":"","sources":["../../../src/domain/mission-control/audit-browse.ts"],"names":[],"mappings":"AASA,OAAO,KAAK,QAAQ,MAAM,gBAAgB,CAAC;AAC3C,OAAO,EACL,KAAK,yBAAyB,EAG/B,MAAM,iCAAiC,CAAC;AAEzC,MAAM,WAAW,eAAe;IAC9B,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,+DAA+D;IAC/D,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,+DAA+D;IAC/D,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,iCAAiC;IACjC,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,kEAAkE;IAClE,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB;;;kEAG8D;IAC9D,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,aAAa,CAAC,EAAE,MAAM,CAAC;CACxB;AAED,MAAM,WAAW,gBAAgB;IAC/B,IAAI,EAAE,yBAAyB,EAAE,CAAC;IAClC,OAAO,EAAE,OAAO,CAAC;IACjB,YAAY,EAAE,MAAM,GAAG,IAAI,CAAC;CAC7B;AAqBD,qBAAa,yBAAyB;IACxB,OAAO,CAAC,QAAQ,CAAC,EAAE;gBAAF,EAAE,EAAE,QAAQ,CAAC,QAAQ;IAElD,KAAK,CAAC,KAAK,EAAE,eAAe,GAAG,gBAAgB;CAyEhD"}

package/node_modules/@openrig/daemon/dist/domain/mission-control/audit-browse.js

@@ -0,0 +1,121 @@
+// PL-005 Phase B: read-only audit-history browse over mission_control_actions.
+//
+// Filters: qitem_id (exact), action_verb (exact), actor_session (exact),
+// since/until (acted_at range). Pagination via before_id + limit.
+// Returns {rows, has_more, next_before_id} shape so the UI can paginate.
+//
+// Read-only: no writers, no UPDATE/DELETE methods. Phase A's
+// MissionControlActionLog is the only writer; this layer only queries.
+import { MISSION_CONTROL_VERBS, } from "./mission-control-action-log.js";
+const DEFAULT_LIMIT = 50;
+const MAX_LIMIT = 200;
+export class MissionControlAuditBrowse {
+    db;
+    constructor(db) {
+        this.db = db;
+    }
+    query(input) {
+        if (input.actionVerb && !MISSION_CONTROL_VERBS.includes(input.actionVerb)) {
+            throw new Error(`unknown action_verb '${input.actionVerb}'; supported: ${MISSION_CONTROL_VERBS.join(", ")}`);
+        }
+        const limit = clampLimit(input.limit);
+        const where = [];
+        const params = [];
+        if (input.qitemId) {
+            where.push("qitem_id = ?");
+            params.push(input.qitemId);
+        }
+        if (input.actionVerb) {
+            where.push("action_verb = ?");
+            params.push(input.actionVerb);
+        }
+        if (input.actorSession) {
+            where.push("actor_session = ?");
+            params.push(input.actorSession);
+        }
+        // OPR.0.4.4.19 FR-9 — filter on the pinned audit_notes_json shape via
+        // SQLite JSON1 (ships with better-sqlite3). NULL audit_notes_json rows
+        // simply don't match.
+        if (input.scopeTier) {
+            where.push("json_extract(audit_notes_json, '$.scope_tier') = ?");
+            params.push(input.scopeTier);
+        }
+        if (input.scopeId) {
+            where.push("json_extract(audit_notes_json, '$.scope_id') = ?");
+            params.push(input.scopeId);
+        }
+        if (input.scopePath) {
+            where.push("json_extract(audit_notes_json, '$.scope_path') = ?");
+            params.push(input.scopePath);
+        }
+        if (input.approvalScope) {
+            where.push("json_extract(audit_notes_json, '$.approval_scope') = ?");
+            params.push(input.approvalScope);
+        }
+        if (input.since) {
+            where.push("acted_at >= ?");
+            params.push(input.since);
+        }
+        if (input.until) {
+            where.push("acted_at <= ?");
+            params.push(input.until);
+        }
+        if (input.beforeId) {
+            // Look up the cursor row's rowid so pagination uses SQLite's
+            // monotonic insertion order (deterministic) rather than ULID
+            // action_id (whose same-ms tail is random; non-deterministic
+            // for tiebreaks). Filed lesson:
+            // feedback_ulid_tiebreaker_nondeterministic.md.
+            where.push("rowid < (SELECT rowid FROM mission_control_actions WHERE action_id = ?)");
+            params.push(input.beforeId);
+        }
+        const whereClause = where.length > 0 ? `WHERE ${where.join(" AND ")}` : "";
+        // Fetch limit+1 to detect hasMore without a separate count query.
+        // ORDER BY acted_at DESC primary; rowid DESC tiebreak (deterministic
+        // insertion order; safer than ULID action_id for same-ms ties).
+        const sql = `SELECT * FROM mission_control_actions ${whereClause}
+       ORDER BY acted_at DESC, rowid DESC LIMIT ?`;
+        const rows = this.db.prepare(sql).all(...params, limit + 1);
+        const hasMore = rows.length > limit;
+        const trimmed = hasMore ? rows.slice(0, limit) : rows;
+        const nextBeforeId = hasMore && trimmed.length > 0 ? trimmed[trimmed.length - 1].action_id : null;
+        return {
+            rows: trimmed.map(rowToEntry),
+            hasMore,
+            nextBeforeId,
+        };
+    }
+}
+function clampLimit(input) {
+    if (input === undefined || !Number.isFinite(input))
+        return DEFAULT_LIMIT;
+    if (input < 1)
+        return 1;
+    if (input > MAX_LIMIT)
+        return MAX_LIMIT;
+    return Math.floor(input);
+}
+function rowToEntry(row) {
+    return {
+        actionId: row.action_id,
+        actionVerb: row.action_verb,
+        qitemId: row.qitem_id,
+        actorSession: row.actor_session,
+        actedAt: row.acted_at,
+        beforeState: row.before_state_json
+            ? JSON.parse(row.before_state_json)
+            : null,
+        afterState: row.after_state_json
+            ? JSON.parse(row.after_state_json)
+            : null,
+        reason: row.reason,
+        annotation: row.annotation,
+        notifyAttempted: row.notify_attempted !== 0,
+        notifyResult: row.notify_result,
+        auditNotes: row.audit_notes_json
+            ? JSON.parse(row.audit_notes_json)
+            : null,
+        identityProvenance: row.identity_provenance ?? null,
+    };
+}
+//# sourceMappingURL=audit-browse.js.map

package/node_modules/@openrig/daemon/dist/domain/mission-control/audit-browse.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"audit-browse.js","sourceRoot":"","sources":["../../../src/domain/mission-control/audit-browse.ts"],"names":[],"mappings":"AAAA,+EAA+E;AAC/E,EAAE;AACF,yEAAyE;AACzE,kEAAkE;AAClE,yEAAyE;AACzE,EAAE;AACF,6DAA6D;AAC7D,uEAAuE;AAGvE,OAAO,EAGL,qBAAqB,GACtB,MAAM,iCAAiC,CAAC;AA8CzC,MAAM,aAAa,GAAG,EAAE,CAAC;AACzB,MAAM,SAAS,GAAG,GAAG,CAAC;AAEtB,MAAM,OAAO,yBAAyB;IACP;IAA7B,YAA6B,EAAqB;QAArB,OAAE,GAAF,EAAE,CAAmB;IAAG,CAAC;IAEtD,KAAK,CAAC,KAAsB;QAC1B,IAAI,KAAK,CAAC,UAAU,IAAI,CAAC,qBAAqB,CAAC,QAAQ,CAAC,KAAK,CAAC,UAAgC,CAAC,EAAE,CAAC;YAChG,MAAM,IAAI,KAAK,CACb,wBAAwB,KAAK,CAAC,UAAU,iBAAiB,qBAAqB,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAC5F,CAAC;QACJ,CAAC;QACD,MAAM,KAAK,GAAG,UAAU,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;QACtC,MAAM,KAAK,GAAa,EAAE,CAAC;QAC3B,MAAM,MAAM,GAA2B,EAAE,CAAC;QAC1C,IAAI,KAAK,CAAC,OAAO,EAAE,CAAC;YAClB,KAAK,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC;YAC3B,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;QAC7B,CAAC;QACD,IAAI,KAAK,CAAC,UAAU,EAAE,CAAC;YACrB,KAAK,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAC;YAC9B,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC;QAChC,CAAC;QACD,IAAI,KAAK,CAAC,YAAY,EAAE,CAAC;YACvB,KAAK,CAAC,IAAI,CAAC,mBAAmB,CAAC,CAAC;YAChC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC;QAClC,CAAC;QACD,sEAAsE;QACtE,uEAAuE;QACvE,sBAAsB;QACtB,IAAI,KAAK,CAAC,SAAS,EAAE,CAAC;YACpB,KAAK,CAAC,IAAI,CAAC,oDAAoD,CAAC,CAAC;YACjE,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;QAC/B,CAAC;QACD,IAAI,KAAK,CAAC,OAAO,EAAE,CAAC;YAClB,KAAK,CAAC,IAAI,CAAC,kDAAkD,CAAC,CAAC;YAC/D,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;QAC7B,CAAC;QACD,IAAI,KAAK,CAAC,SAAS,EAAE,CAAC;YACpB,KAAK,CAAC,IAAI,CAAC,oDAAoD,CAAC,CAAC;YACjE,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;QAC/B,CAAC;QACD,IAAI,KAAK,CAAC,aAAa,EAAE,CAAC;YACxB,KAAK,CAAC,IAAI,CAAC,wDAAwD,CAAC,CAAC;YACrE,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,aAAa,CAAC,CAAC;QACnC,CAAC;QACD,IAAI,KAAK,CAAC,KAAK,EAAE,CAAC;YAChB,KAAK,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC;YAC5B,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;QAC3B,CAAC;QACD,IAAI,KAAK,CAAC,KAAK,EAAE,CAAC;YAChB,KAAK,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC;YAC5B,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;QAC3B,CAAC;QACD,IAAI,KAAK,CAAC,QAAQ,EAAE,CAAC;YACnB,6DAA6D;YAC7D,6DAA6D;YAC7D,6DAA6D;YAC7D,gCAAgC;YAChC,gDAAgD;YAChD,KAAK,CAAC,IAAI,CAAC,yEAAyE,CAAC,CAAC;YACtF,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;QAC9B,CAAC;QACD,MAAM,WAAW,GAAG,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC3E,kEAAkE;QAClE,qEAAqE;QACrE,gEAAgE;QAChE,MAAM,GAAG,GAAG,yCAAyC,WAAW;kDAClB,CAAC;QAC/C,MAAM,IAAI,GAAG,IAAI,CAAC,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,GAAG,MAAM,EAAE,KAAK,GAAG,CAAC,CAAgB,CAAC;QAC3E,MAAM,OAAO,GAAG,IAAI,CAAC,MAAM,GAAG,KAAK,CAAC;QACpC,MAAM,OAAO,GAAG,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;QACtD,MAAM,YAAY,GAAG,OAAO,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC,CAAE,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC;QACnG,OAAO;YACL,IAAI,EAAE,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC;YAC7B,OAAO;YACP,YAAY;SACb,CAAC;IACJ,CAAC;CACF;AAED,SAAS,UAAU,CAAC,KAAyB;IAC3C,IAAI,KAAK,KAAK,SAAS,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC;QAAE,OAAO,aAAa,CAAC;IACzE,IAAI,KAAK,GAAG,CAAC;QAAE,OAAO,CAAC,CAAC;IACxB,IAAI,KAAK,GAAG,SAAS;QAAE,OAAO,SAAS,CAAC;IACxC,OAAO,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;AAC3B,CAAC;AAED,SAAS,UAAU,CAAC,GAAc;IAChC,OAAO;QACL,QAAQ,EAAE,GAAG,CAAC,SAAS;QACvB,UAAU,EAAE,GAAG,CAAC,WAAiC;QACjD,OAAO,EAAE,GAAG,CAAC,QAAQ;QACrB,YAAY,EAAE,GAAG,CAAC,aAAa;QAC/B,OAAO,EAAE,GAAG,CAAC,QAAQ;QACrB,WAAW,EAAE,GAAG,CAAC,iBAAiB;YAChC,CAAC,CAAE,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,iBAAiB,CAA6B;YAChE,CAAC,CAAC,IAAI;QACR,UAAU,EAAE,GAAG,CAAC,gBAAgB;YAC9B,CAAC,CAAE,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,gBAAgB,CAA6B;YAC/D,CAAC,CAAC,IAAI;QACR,MAAM,EAAE,GAAG,CAAC,MAAM;QAClB,UAAU,EAAE,GAAG,CAAC,UAAU;QAC1B,eAAe,EAAE,GAAG,CAAC,gBAAgB,KAAK,CAAC;QAC3C,YAAY,EAAE,GAAG,CAAC,aAAa;QAC/B,UAAU,EAAE,GAAG,CAAC,gBAAgB;YAC9B,CAAC,CAAE,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,gBAAgB,CAA6B;YAC/D,CAAC,CAAC,IAAI;QACR,kBAAkB,EAAE,GAAG,CAAC,mBAAmB,IAAI,IAAI;KACpD,CAAC;AACJ,CAAC"}

package/node_modules/@openrig/daemon/dist/domain/mission-control/mission-control-action-log.d.ts

@@ -0,0 +1,56 @@
+import type Database from "better-sqlite3";
+export declare const MISSION_CONTROL_VERBS: readonly ["approve", "deny", "route", "annotate", "hold", "drop", "handoff", "resolve"];
+export type MissionControlVerb = (typeof MISSION_CONTROL_VERBS)[number];
+export interface MissionControlActionRecordInput {
+    actionVerb: MissionControlVerb;
+    qitemId: string | null;
+    actorSession: string;
+    actedAt: string;
+    beforeState?: Record<string, unknown> | null;
+    afterState?: Record<string, unknown> | null;
+    reason?: string | null;
+    annotation?: string | null;
+    notifyAttempted?: boolean;
+    notifyResult?: string | null;
+    auditNotes?: Record<string, unknown> | null;
+    /** P21 era-stamp: the identity provenance of `actorSession`. The transport chokepoint writes
+     *  `transport:v1`; absent/null = claimed-era (pre-verification), never re-labeled. */
+    identityProvenance?: string | null;
+}
+export interface MissionControlActionEntry {
+    actionId: string;
+    actionVerb: MissionControlVerb;
+    qitemId: string | null;
+    actorSession: string;
+    actedAt: string;
+    beforeState: Record<string, unknown> | null;
+    afterState: Record<string, unknown> | null;
+    reason: string | null;
+    annotation: string | null;
+    notifyAttempted: boolean;
+    notifyResult: string | null;
+    auditNotes: Record<string, unknown> | null;
+    identityProvenance: string | null;
+}
+export declare class MissionControlActionLogError extends Error {
+    readonly code: string;
+    readonly details?: Record<string, unknown> | undefined;
+    constructor(code: string, message: string, details?: Record<string, unknown> | undefined);
+}
+export declare class MissionControlActionLog {
+    private readonly db;
+    private readonly hasProvenanceCol;
+    constructor(db: Database.Database);
+    /**
+     * Append an action record. Validates verb-specific required fields
+     * (annotate → annotation; hold/drop → reason). Designed to compose
+     * inside an outer caller-managed transaction (used by the
+     * write-contract for the atomic 4-step handoff).
+     */
+    record(input: MissionControlActionRecordInput): MissionControlActionEntry;
+    listRecent(limit?: number): MissionControlActionEntry[];
+    listForQitem(qitemId: string, limit?: number): MissionControlActionEntry[];
+    listForActor(actorSession: string, limit?: number): MissionControlActionEntry[];
+    countAll(): number;
+}
+//# sourceMappingURL=mission-control-action-log.d.ts.map

package/node_modules/@openrig/daemon/dist/domain/mission-control/mission-control-action-log.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"mission-control-action-log.d.ts","sourceRoot":"","sources":["../../../src/domain/mission-control/mission-control-action-log.ts"],"names":[],"mappings":"AAUA,OAAO,KAAK,QAAQ,MAAM,gBAAgB,CAAC;AAG3C,eAAO,MAAM,qBAAqB,yFAYxB,CAAC;AAEX,MAAM,MAAM,kBAAkB,GAAG,CAAC,OAAO,qBAAqB,CAAC,CAAC,MAAM,CAAC,CAAC;AAExE,MAAM,WAAW,+BAA+B;IAC9C,UAAU,EAAE,kBAAkB,CAAC;IAC/B,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;IACvB,YAAY,EAAE,MAAM,CAAC;IACrB,OAAO,EAAE,MAAM,CAAC;IAChB,WAAW,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,CAAC;IAC7C,UAAU,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,CAAC;IAC5C,MAAM,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACvB,UAAU,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,eAAe,CAAC,EAAE,OAAO,CAAC;IAC1B,YAAY,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC7B,UAAU,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,CAAC;IAC5C;0FACsF;IACtF,kBAAkB,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CACpC;AAED,MAAM,WAAW,yBAAyB;IACxC,QAAQ,EAAE,MAAM,CAAC;IACjB,UAAU,EAAE,kBAAkB,CAAC;IAC/B,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;IACvB,YAAY,EAAE,MAAM,CAAC;IACrB,OAAO,EAAE,MAAM,CAAC;IAChB,WAAW,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,CAAC;IAC5C,UAAU,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,CAAC;IAC3C,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;IACtB,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,eAAe,EAAE,OAAO,CAAC;IACzB,YAAY,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5B,UAAU,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,CAAC;IAC3C,kBAAkB,EAAE,MAAM,GAAG,IAAI,CAAC;CACnC;AAkBD,qBAAa,4BAA6B,SAAQ,KAAK;aAEnC,IAAI,EAAE,MAAM;aAEZ,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC;gBAFjC,IAAI,EAAE,MAAM,EAC5B,OAAO,EAAE,MAAM,EACC,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,YAAA;CAKpD;AAaD,qBAAa,uBAAuB;IAEtB,OAAO,CAAC,QAAQ,CAAC,EAAE;IAD/B,OAAO,CAAC,QAAQ,CAAC,gBAAgB,CAAU;gBACd,EAAE,EAAE,QAAQ,CAAC,QAAQ;IAIlD;;;;;OAKG;IACH,MAAM,CAAC,KAAK,EAAE,+BAA+B,GAAG,yBAAyB;IA2EzE,UAAU,CAAC,KAAK,SAAK,GAAG,yBAAyB,EAAE;IAUnD,YAAY,CAAC,OAAO,EAAE,MAAM,EAAE,KAAK,SAAK,GAAG,yBAAyB,EAAE;IAUtE,YAAY,CAAC,YAAY,EAAE,MAAM,EAAE,KAAK,SAAK,GAAG,yBAAyB,EAAE;IAU3E,QAAQ,IAAI,MAAM;CAMnB"}