@openrig/cli 0.5.15 → 0.5.17

package/node_modules/@openrig/daemon/dist/domain/permission-policy/policy-ref.js

@@ -1,171 +0,0 @@
-// Slice-03 (OPR.0.4.8.3) Seam B — permission_policy REF resolution + precedence + launch-posture.
-// The `permission_policy` value attached to a rig or a seat is a REF (not a policy body). Semantics
-// are grounded in Slice03 README v4 (sha256-8 d65afe67), rulings A1/A2/A3 + the Policy/YOLO framing:
-//   - `builtin:<name>`, <name> ∈ {locked, standard, open, yolo} (A1): resolves into the packaged
-//     read-only built-in set (origin=builtin). Unknown name = STRUCTURED error listing the known
-//     set. The `builtin:` prefix is MANDATORY — bare canonical names never resolve (no shadowing).
-//   - a RELATIVE custom path (A2), resolved relative to the DECLARING RigSpec dir (origin=custom);
-//     absolute / `..` traversal / empty segments = STRUCTURED error (a spec defect, NOT a floor
-//     fallback). Reuses the established safe-path discipline (path-safety.validateSafePath).
-//   - `none` = the RECORDED DELIBERATE choice (RULED-FORM-deliberate-none-2026-08-04,
-//     sha256 5f37e40f — the A3 reservation ACTIVATED by its own amendment): third origin
-//     deliberate_none, never resolves to any file, posture identical to absent (floor).
-//   - ABSENT (no value) = the floor (honest absence) — the CALLER passes undefined; not an error.
-// Built-in ASSET packaging is a LATER leg: builtin resolution here is REF-SEMANTICS (prefix→origin),
-// it does NOT read or require the asset file to exist.
-import * as path from "node:path";
-import { validateSafePath } from "../path-safety.js";
-import { parsePolicySpec, validatePolicySpec } from "./policy-spec.js";
-/** The packaged read-only built-in policy set (README v4: 3 Policy-Mode specs + Operator/YOLO). */
-export const BUILTIN_POLICY_NAMES = ["locked", "standard", "open", "yolo"];
-const BUILTIN_PREFIX = "builtin:";
-function isBuiltinName(name) {
-    return BUILTIN_POLICY_NAMES.includes(name);
-}
-/**
- * Validate + classify a permission_policy REF. Returns a STRUCTURED error string for an invalid ref
- * (an invalid ref is a spec DEFECT, never a silent floor fallback), or null when valid. ABSENT is the
- * caller's concern (only pass a present value here). `label` prefixes the error for the surfacing
- * layer (matches the RigSpec validate convention, e.g. "permission_policy" / "pods[0].members[1].
- * permission_policy").
- */
-export function validatePermissionPolicyRef(value, label) {
-    if (typeof value !== "string" || value.trim().length === 0) {
-        return `${label}: permission_policy must be a non-empty string ref`;
-    }
-    if (value === "none") {
-        // RULED amendment (5f37e40f): the A3-reserved literal IS the recorded
-        // deliberate choice — valid; classification/resolution handle it below.
-        return null;
-    }
-    if (value.startsWith(BUILTIN_PREFIX)) {
-        const name = value.slice(BUILTIN_PREFIX.length);
-        if (!isBuiltinName(name)) {
-            return `${label}: unknown built-in policy '${name}' (known: ${BUILTIN_POLICY_NAMES.join(", ")})`;
-        }
-        return null;
-    }
-    // Anti-shadowing (A1: "no canonical-name shadowing, ever"): a BARE canonical name must NOT
-    // masquerade as a custom ref — that would silently mis-resolve origin (and, for `yolo`, silently
-    // downgrade full_bypass→floor). Require the explicit builtin: prefix.
-    if (isBuiltinName(value)) {
-        return `${label}: '${value}' is a built-in policy name — use 'builtin:${value}' (the builtin: prefix is mandatory; bare names never resolve, no shadowing)`;
-    }
-    // Custom relative ref — the established safe-path discipline (absolute / .. rejected)…
-    const pathErr = validateSafePath(value, label);
-    if (pathErr)
-        return pathErr;
-    // …plus the explicit empty-segment rejection (README v4 A2) that validateSafePath does not cover.
-    const segments = value.replace(/\\/g, "/").split("/");
-    if (segments.some((seg) => seg.length === 0)) {
-        return `${label}: empty path segments are not allowed (got "${value}")`;
-    }
-    // README v4 A2 per-segment charset (the established ref discipline — same class as the
-    // rig-context day-one contract): every segment is a single safe path component.
-    for (const seg of segments) {
-        if (!/^[A-Za-z0-9][A-Za-z0-9._-]*$/.test(seg)) {
-            return `${label}: path segment "${seg}" violates the ref charset (each segment must match [A-Za-z0-9][A-Za-z0-9._-]*)`;
-        }
-    }
-    return null;
-}
-/**
- * Classify a VALID ref (call validatePermissionPolicyRef first). Preserves + surfaces origin, never
- * silently reclassifies (origin honesty). Never throws on a validated ref.
- */
-export function classifyPermissionPolicyRef(value) {
-    if (value.startsWith(BUILTIN_PREFIX)) {
-        return { ref: value, origin: "builtin", builtinName: value.slice(BUILTIN_PREFIX.length) };
-    }
-    return { ref: value, origin: "custom" };
-}
-/**
- * The SINGLE mapping point for the built-in policies' canonical shipped package-copy path —
- * PM-RULED (inline ruling via dev-guard NOT-CLEAR at 9e94c274, lane c76c7153):
- *   repo source (future):   packages/daemon/policies/builtin/<name>.policy.md
- *   provenance target:      policies/builtin/<name>.policy.md  (package-relative;
- *                           module-relative at runtime)
- * The raw `builtin:<name>` ref stays separate (export truth); this target is the restart-
- * stable provenance. Built-in CONTENT stays a later leg — no asset read or copy here.
- */
-export function builtinPackageTarget(name) {
-    return `policies/builtin/${name}.policy.md`;
-}
-/**
- * Resolve a VALIDATED, present ref (call validatePermissionPolicyRef first) into a restart-stable
- * attachment. `declaringDir` is the canonical directory of the RigSpec that declared the ref (custom
- * refs resolve relative to it — README v4 A2). Flag-surface CONTENT resolution is CORE-owned (guard
- * ruling): a custom `surface: flag` policy's `launch_posture` (floor|full_bypass) is read here.
- *   - built-in: name-derived posture bounded to the locked set (yolo → full_bypass, else floor);
- *     origin + canonical `builtin:<name>` target preserved. Package ASSET existence is a later leg.
- *   - custom: resolve relative to declaringDir, read + parse (Seam A), derive surface; flag →
- *     its launch_posture; config → floor (config-surface CONTENT application is deferred to the
- *     skill; no config write here). Unreadable/invalid → advisory floor, provenance still preserved.
- */
-export function resolvePermissionPolicyAttachment(ref, declaringDir, deps) {
-    if (ref === "none") {
-        // RULED amendment (5f37e40f): recorded deliberate choice. NEVER resolves to
-        // any file (no resolvedTarget/declaringDir — the A3 no-squatting fence
-        // holds because 'none' stays unreferenceable); posture IDENTICAL to absent
-        // (zero privilege delta — the entire change is record/provenance).
-        return {
-            ref,
-            origin: "deliberate_none",
-            launchPosture: "floor",
-            contentResolved: true, // semantics fully known by construction (like builtins)
-        };
-    }
-    if (ref.startsWith(BUILTIN_PREFIX)) {
-        const builtinName = ref.slice(BUILTIN_PREFIX.length);
-        return {
-            ref,
-            origin: "builtin",
-            builtinName,
-            resolvedTarget: builtinPackageTarget(builtinName),
-            surface: builtinName === "yolo" ? "flag" : undefined,
-            launchPosture: builtinName === "yolo" ? "full_bypass" : "floor",
-            contentResolved: true,
-        };
-    }
-    // Custom ref: resolve relative to the declaring RigSpec directory (never cwd/workspace root).
-    const resolvedTarget = path.resolve(declaringDir, ref);
-    let surface;
-    let launchPosture = "floor";
-    let contentResolved = false;
-    try {
-        const parsed = parsePolicySpec(deps.readFile(resolvedTarget));
-        if (!("error" in parsed)) {
-            const s = parsed.frontmatter["surface"];
-            if (s === "flag" || s === "config")
-                surface = s;
-            // R2 HIGH-2: content is RESOLVED only when the COMPLETE sealed Seam-A frontmatter
-            // contract validates (validatePolicySpec: surface-appropriate required fields,
-            // action-list shapes, schema version, description, …) — parseable-but-invalid
-            // content must NOT be trusted over persisted posture. Advisory read only.
-            const contract = validatePolicySpec(parsed.frontmatter);
-            if (contract.ok && surface === "flag") {
-                const lp = parsed.frontmatter["launch_posture"];
-                if (lp === "floor" || lp === "full_bypass") {
-                    launchPosture = lp;
-                    contentResolved = true;
-                }
-            }
-            else if (contract.ok && surface === "config") {
-                contentResolved = true; // valid config semantics; posture floor is genuine
-            }
-            // invalid contract or unknown surface → NOT resolved (advisory floor, provenance kept)
-        }
-    }
-    catch {
-        // Unreadable/unresolvable at resolve time → advisory floor; ref + provenance still preserved.
-    }
-    return { ref, origin: "custom", resolvedTarget, declaringDir, surface, launchPosture, contentResolved };
-}
-/**
- * Precedence: a per-member ref overrides the rig-level ref; absence at both is undefined (= floor).
- * member > rig > floor (README v4 + IMPL-PLAN). No pod level exists in the spec surface.
- */
-export function resolvePermissionPolicyRefValue(memberRef, rigRef) {
-    return (memberRef ?? undefined) ?? (rigRef ?? undefined);
-}
-//# sourceMappingURL=policy-ref.js.map

package/node_modules/@openrig/daemon/dist/domain/permission-policy/policy-ref.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"policy-ref.js","sourceRoot":"","sources":["../../../src/domain/permission-policy/policy-ref.ts"],"names":[],"mappings":"AAAA,kGAAkG;AAClG,oGAAoG;AACpG,qGAAqG;AACrG,iGAAiG;AACjG,iGAAiG;AACjG,mGAAmG;AACnG,mGAAmG;AACnG,gGAAgG;AAChG,6FAA6F;AAC7F,sFAAsF;AACtF,yFAAyF;AACzF,wFAAwF;AACxF,kGAAkG;AAClG,qGAAqG;AACrG,uDAAuD;AAEvD,OAAO,KAAK,IAAI,MAAM,WAAW,CAAC;AAClC,OAAO,EAAE,gBAAgB,EAAE,MAAM,mBAAmB,CAAC;AACrD,OAAO,EAAE,eAAe,EAAE,kBAAkB,EAAE,MAAM,kBAAkB,CAAC;AAGvE,mGAAmG;AACnG,MAAM,CAAC,MAAM,oBAAoB,GAAG,CAAC,QAAQ,EAAE,UAAU,EAAE,MAAM,EAAE,MAAM,CAAU,CAAC;AAKpF,MAAM,cAAc,GAAG,UAAU,CAAC;AAUlC,SAAS,aAAa,CAAC,IAAY;IACjC,OAAQ,oBAA0C,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;AACpE,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,2BAA2B,CAAC,KAAc,EAAE,KAAa;IACvE,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,IAAI,EAAE,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC3D,OAAO,GAAG,KAAK,oDAAoD,CAAC;IACtE,CAAC;IACD,IAAI,KAAK,KAAK,MAAM,EAAE,CAAC;QACrB,sEAAsE;QACtE,wEAAwE;QACxE,OAAO,IAAI,CAAC;IACd,CAAC;IACD,IAAI,KAAK,CAAC,UAAU,CAAC,cAAc,CAAC,EAAE,CAAC;QACrC,MAAM,IAAI,GAAG,KAAK,CAAC,KAAK,CAAC,cAAc,CAAC,MAAM,CAAC,CAAC;QAChD,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC,EAAE,CAAC;YACzB,OAAO,GAAG,KAAK,8BAA8B,IAAI,aAAa,oBAAoB,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC;QACnG,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IACD,2FAA2F;IAC3F,iGAAiG;IACjG,sEAAsE;IACtE,IAAI,aAAa,CAAC,KAAK,CAAC,EAAE,CAAC;QACzB,OAAO,GAAG,KAAK,MAAM,KAAK,8CAA8C,KAAK,8EAA8E,CAAC;IAC9J,CAAC;IACD,uFAAuF;IACvF,MAAM,OAAO,GAAG,gBAAgB,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;IAC/C,IAAI,OAAO;QAAE,OAAO,OAAO,CAAC;IAC5B,kGAAkG;IAClG,MAAM,QAAQ,GAAG,KAAK,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IACtD,IAAI,QAAQ,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,MAAM,KAAK,CAAC,CAAC,EAAE,CAAC;QAC7C,OAAO,GAAG,KAAK,+CAA+C,KAAK,IAAI,CAAC;IAC1E,CAAC;IACD,uFAAuF;IACvF,gFAAgF;IAChF,KAAK,MAAM,GAAG,IAAI,QAAQ,EAAE,CAAC;QAC3B,IAAI,CAAC,8BAA8B,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;YAC9C,OAAO,GAAG,KAAK,mBAAmB,GAAG,iFAAiF,CAAC;QACzH,CAAC;IACH,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,2BAA2B,CAAC,KAAa;IACvD,IAAI,KAAK,CAAC,UAAU,CAAC,cAAc,CAAC,EAAE,CAAC;QACrC,OAAO,EAAE,GAAG,EAAE,KAAK,EAAE,MAAM,EAAE,SAAS,EAAE,WAAW,EAAE,KAAK,CAAC,KAAK,CAAC,cAAc,CAAC,MAAM,CAAsB,EAAE,CAAC;IACjH,CAAC;IACD,OAAO,EAAE,GAAG,EAAE,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC;AAC1C,CAAC;AAuCD;;;;;;;;GAQG;AACH,MAAM,UAAU,oBAAoB,CAAC,IAAuB;IAC1D,OAAO,oBAAoB,IAAI,YAAY,CAAC;AAC9C,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,UAAU,iCAAiC,CAC/C,GAAW,EACX,YAAoB,EACpB,IAAuB;IAEvB,IAAI,GAAG,KAAK,MAAM,EAAE,CAAC;QACnB,4EAA4E;QAC5E,uEAAuE;QACvE,2EAA2E;QAC3E,mEAAmE;QACnE,OAAO;YACL,GAAG;YACH,MAAM,EAAE,iBAAiB;YACzB,aAAa,EAAE,OAAO;YACtB,eAAe,EAAE,IAAI,EAAE,wDAAwD;SAChF,CAAC;IACJ,CAAC;IACD,IAAI,GAAG,CAAC,UAAU,CAAC,cAAc,CAAC,EAAE,CAAC;QACnC,MAAM,WAAW,GAAG,GAAG,CAAC,KAAK,CAAC,cAAc,CAAC,MAAM,CAAsB,CAAC;QAC1E,OAAO;YACL,GAAG;YACH,MAAM,EAAE,SAAS;YACjB,WAAW;YACX,cAAc,EAAE,oBAAoB,CAAC,WAAW,CAAC;YACjD,OAAO,EAAE,WAAW,KAAK,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS;YACpD,aAAa,EAAE,WAAW,KAAK,MAAM,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,OAAO;YAC/D,eAAe,EAAE,IAAI;SACtB,CAAC;IACJ,CAAC;IACD,8FAA8F;IAC9F,MAAM,cAAc,GAAG,IAAI,CAAC,OAAO,CAAC,YAAY,EAAE,GAAG,CAAC,CAAC;IACvD,IAAI,OAAkC,CAAC;IACvC,IAAI,aAAa,GAAkB,OAAO,CAAC;IAC3C,IAAI,eAAe,GAAG,KAAK,CAAC;IAC5B,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,eAAe,CAAC,IAAI,CAAC,QAAQ,CAAC,cAAc,CAAC,CAAC,CAAC;QAC9D,IAAI,CAAC,CAAC,OAAO,IAAI,MAAM,CAAC,EAAE,CAAC;YACzB,MAAM,CAAC,GAAG,MAAM,CAAC,WAAW,CAAC,SAAS,CAAC,CAAC;YACxC,IAAI,CAAC,KAAK,MAAM,IAAI,CAAC,KAAK,QAAQ;gBAAE,OAAO,GAAG,CAAC,CAAC;YAChD,kFAAkF;YAClF,+EAA+E;YAC/E,8EAA8E;YAC9E,0EAA0E;YAC1E,MAAM,QAAQ,GAAG,kBAAkB,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;YACxD,IAAI,QAAQ,CAAC,EAAE,IAAI,OAAO,KAAK,MAAM,EAAE,CAAC;gBACtC,MAAM,EAAE,GAAG,MAAM,CAAC,WAAW,CAAC,gBAAgB,CAAC,CAAC;gBAChD,IAAI,EAAE,KAAK,OAAO,IAAI,EAAE,KAAK,aAAa,EAAE,CAAC;oBAC3C,aAAa,GAAG,EAAE,CAAC;oBACnB,eAAe,GAAG,IAAI,CAAC;gBACzB,CAAC;YACH,CAAC;iBAAM,IAAI,QAAQ,CAAC,EAAE,IAAI,OAAO,KAAK,QAAQ,EAAE,CAAC;gBAC/C,eAAe,GAAG,IAAI,CAAC,CAAC,mDAAmD;YAC7E,CAAC;YACD,uFAAuF;QACzF,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACP,8FAA8F;IAChG,CAAC;IACD,OAAO,EAAE,GAAG,EAAE,MAAM,EAAE,QAAQ,EAAE,cAAc,EAAE,YAAY,EAAE,OAAO,EAAE,aAAa,EAAE,eAAe,EAAE,CAAC;AAC1G,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,+BAA+B,CAC7C,SAAoC,EACpC,MAAiC;IAEjC,OAAO,CAAC,SAAS,IAAI,SAAS,CAAC,IAAI,CAAC,MAAM,IAAI,SAAS,CAAC,CAAC;AAC3D,CAAC"}

package/node_modules/@openrig/daemon/dist/domain/permission-policy/policy-spec.d.ts

@@ -1,34 +0,0 @@
-export type PolicySurface = "flag" | "config";
-export type PolicySource = "builtin" | "custom";
-export type LaunchPosture = "floor" | "full_bypass";
-export type DefaultPosture = "allow" | "ask" | "deny";
-/** A parsed policy spec: the raw frontmatter object + the preserved Markdown body. */
-export interface ParsedPolicySpec {
-    frontmatter: Record<string, unknown>;
-    /** The Markdown body after the frontmatter block — preserved verbatim (human prose, not contract). */
-    body: string;
-}
-export interface ParseError {
-    error: string;
-}
-/** Parse a policy spec into its frontmatter contract + preserved body. Never throws. */
-export declare function parsePolicySpec(raw: string): ParsedPolicySpec | ParseError;
-export interface ValidationResult {
-    ok: boolean;
-    errors: string[];
-}
-/**
- * Validate-by-convention: required scalars, enum membership, surface-appropriate EXCLUSIVITY, and
- * scalar/list SHAPES. ADVISORY + fail-open — returns {ok, errors[]}, never throws, never enforces.
- * Does NOT validate the semantic-action vocabulary (taxonomy 668bb0d2 owns it) nor resolve to any
- * harness format.
- */
-export declare function validatePolicySpec(fm: Record<string, unknown>): ValidationResult;
-/**
- * Deterministic CANONICAL serialization: frontmatter re-emitted in canonical field order (unknown
- * keys preserved, appended stably) + the body verbatim. Round-trip contract = serialize is STABLE
- * (serialize∘parse is idempotent) + SEMANTIC equality (frontmatter deep-equal) + BODY preserved —
- * NOT original-input byte identity.
- */
-export declare function serializePolicySpec(parsed: ParsedPolicySpec): string;
-//# sourceMappingURL=policy-spec.d.ts.map

package/node_modules/@openrig/daemon/dist/domain/permission-policy/policy-spec.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"policy-spec.d.ts","sourceRoot":"","sources":["../../../src/domain/permission-policy/policy-spec.ts"],"names":[],"mappings":"AAUA,MAAM,MAAM,aAAa,GAAG,MAAM,GAAG,QAAQ,CAAC;AAC9C,MAAM,MAAM,YAAY,GAAG,SAAS,GAAG,QAAQ,CAAC;AAChD,MAAM,MAAM,aAAa,GAAG,OAAO,GAAG,aAAa,CAAC;AACpD,MAAM,MAAM,cAAc,GAAG,OAAO,GAAG,KAAK,GAAG,MAAM,CAAC;AAEtD,sFAAsF;AACtF,MAAM,WAAW,gBAAgB;IAC/B,WAAW,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACrC,sGAAsG;IACtG,IAAI,EAAE,MAAM,CAAC;CACd;AAED,MAAM,WAAW,UAAU;IACzB,KAAK,EAAE,MAAM,CAAC;CACf;AAMD,wFAAwF;AACxF,wBAAgB,eAAe,CAAC,GAAG,EAAE,MAAM,GAAG,gBAAgB,GAAG,UAAU,CAa1E;AAED,MAAM,WAAW,gBAAgB;IAC/B,EAAE,EAAE,OAAO,CAAC;IACZ,MAAM,EAAE,MAAM,EAAE,CAAC;CAClB;AAYD;;;;;GAKG;AACH,wBAAgB,kBAAkB,CAAC,EAAE,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,gBAAgB,CA8BhF;AAQD;;;;;GAKG;AACH,wBAAgB,mBAAmB,CAAC,MAAM,EAAE,gBAAgB,GAAG,MAAM,CAOpE"}

package/node_modules/@openrig/daemon/dist/domain/permission-policy/policy-spec.js

@@ -1,106 +0,0 @@
-// Slice-03 (OPR.0.4.8.3) Seam A — the permission-policy SPEC primitive: parse + validate-by-convention.
-// A policy spec is a Markdown file with a leading YAML FRONTMATTER contract + an explanatory body.
-// This module PARSES the whole contract from frontmatter (preserving the body verbatim) and
-// VALIDATES it by convention — ADVISORY + fail-open (mirrors `rig scope audit`), never enforcement.
-// It NEVER validates the semantic-action vocabulary (the taxonomy 668bb0d2 owns that) and NEVER
-// resolves intent to a harness format (flag surface = deterministic code elsewhere; config surface =
-// the skill). Schema authority: ARCH-POLICY-SPEC-SCHEMA sha256-8 92409094.
-import { parse as parseYaml, stringify as stringifyYaml } from "yaml";
-// Leading `---\n<yaml>\n---\n<body>` frontmatter block. Non-greedy YAML capture so the FIRST closing
-// `---` ends the frontmatter; everything after is the body (preserved exactly).
-const FRONTMATTER_RE = /^---\n([\s\S]*?)\n---\n?([\s\S]*)$/;
-/** Parse a policy spec into its frontmatter contract + preserved body. Never throws. */
-export function parsePolicySpec(raw) {
-    const m = FRONTMATTER_RE.exec(raw);
-    if (!m)
-        return { error: "policy spec must open with a '---' YAML frontmatter block" };
-    let frontmatter;
-    try {
-        frontmatter = parseYaml(m[1]);
-    }
-    catch (e) {
-        return { error: `frontmatter is not valid YAML: ${e.message}` };
-    }
-    if (!frontmatter || typeof frontmatter !== "object" || Array.isArray(frontmatter)) {
-        return { error: "frontmatter must be a YAML object at the root" };
-    }
-    return { frontmatter: frontmatter, body: m[2] ?? "" };
-}
-const SOURCES = new Set(["builtin", "custom"]);
-const SURFACES = new Set(["flag", "config"]);
-const LAUNCH_POSTURES = new Set(["floor", "full_bypass"]);
-const DEFAULT_POSTURES = new Set(["allow", "ask", "deny"]);
-const ACTION_LIST_FIELDS = ["allow", "ask", "deny", "destructive_class"];
-function isStringList(v) {
-    return Array.isArray(v) && v.every((x) => typeof x === "string");
-}
-/**
- * Validate-by-convention: required scalars, enum membership, surface-appropriate EXCLUSIVITY, and
- * scalar/list SHAPES. ADVISORY + fail-open — returns {ok, errors[]}, never throws, never enforces.
- * Does NOT validate the semantic-action vocabulary (taxonomy 668bb0d2 owns it) nor resolve to any
- * harness format.
- */
-export function validatePolicySpec(fm) {
-    const errors = [];
-    if (fm["policy_schema_version"] !== 1)
-        errors.push("policy_schema_version must be the number 1");
-    if (typeof fm["name"] !== "string" || fm["name"].length === 0)
-        errors.push("name must be a non-empty string");
-    if (typeof fm["source"] !== "string" || !SOURCES.has(fm["source"]))
-        errors.push("source must be 'builtin' or 'custom'");
-    if (typeof fm["description"] !== "string" || fm["description"].length === 0)
-        errors.push("description must be a non-empty string");
-    const surface = fm["surface"];
-    if (typeof surface !== "string" || !SURFACES.has(surface)) {
-        errors.push("surface must be 'flag' or 'config'");
-        return { ok: errors.length === 0, errors }; // can't check surface-appropriate fields without a valid surface
-    }
-    if (surface === "flag") {
-        if (!LAUNCH_POSTURES.has(fm["launch_posture"]))
-            errors.push("flag-surface policy requires launch_posture ('floor' or 'full_bypass')");
-        if (fm["default_posture"] !== undefined)
-            errors.push("flag-surface policy must NOT carry default_posture (config-surface field)");
-        for (const f of ACTION_LIST_FIELDS)
-            if (fm[f] !== undefined)
-                errors.push(`flag-surface policy must NOT carry '${f}' (config-surface field)`);
-    }
-    else {
-        // config
-        if (fm["launch_posture"] !== undefined)
-            errors.push("config-surface policy must NOT carry launch_posture (flag-surface field)");
-        if (!DEFAULT_POSTURES.has(fm["default_posture"]))
-            errors.push("config-surface policy requires default_posture ('allow', 'ask' or 'deny')");
-        // The schema requires all four action-list fields present (use [] for none) — not optional.
-        for (const f of ACTION_LIST_FIELDS) {
-            if (fm[f] === undefined)
-                errors.push(`config-surface policy requires '${f}' (a list of strings; use [] for none)`);
-            else if (!isStringList(fm[f]))
-                errors.push(`${f} must be a list of strings`);
-        }
-    }
-    return { ok: errors.length === 0, errors };
-}
-// Canonical field order for deterministic serialization (unknown keys appended stably after).
-const CANONICAL_ORDER = [
-    "source", "name", "surface", "launch_posture", "policy_schema_version", "description",
-    "default_posture", "allow", "ask", "deny", "destructive_class",
-];
-/**
- * Deterministic CANONICAL serialization: frontmatter re-emitted in canonical field order (unknown
- * keys preserved, appended stably) + the body verbatim. Round-trip contract = serialize is STABLE
- * (serialize∘parse is idempotent) + SEMANTIC equality (frontmatter deep-equal) + BODY preserved —
- * NOT original-input byte identity.
- */
-export function serializePolicySpec(parsed) {
-    const fm = parsed.frontmatter;
-    const ordered = {};
-    for (const k of CANONICAL_ORDER)
-        if (fm[k] !== undefined)
-            ordered[k] = fm[k];
-    for (const k of Object.keys(fm))
-        if (!(k in ordered))
-            ordered[k] = fm[k];
-    const yamlBlock = stringifyYaml(ordered).replace(/\n+$/, "");
-    return `---\n${yamlBlock}\n---\n${parsed.body}`;
-}
-//# sourceMappingURL=policy-spec.js.map

package/node_modules/@openrig/daemon/dist/domain/permission-policy/policy-spec.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"policy-spec.js","sourceRoot":"","sources":["../../../src/domain/permission-policy/policy-spec.ts"],"names":[],"mappings":"AAAA,wGAAwG;AACxG,mGAAmG;AACnG,4FAA4F;AAC5F,oGAAoG;AACpG,gGAAgG;AAChG,qGAAqG;AACrG,2EAA2E;AAE3E,OAAO,EAAE,KAAK,IAAI,SAAS,EAAE,SAAS,IAAI,aAAa,EAAE,MAAM,MAAM,CAAC;AAkBtE,qGAAqG;AACrG,gFAAgF;AAChF,MAAM,cAAc,GAAG,oCAAoC,CAAC;AAE5D,wFAAwF;AACxF,MAAM,UAAU,eAAe,CAAC,GAAW;IACzC,MAAM,CAAC,GAAG,cAAc,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IACnC,IAAI,CAAC,CAAC;QAAE,OAAO,EAAE,KAAK,EAAE,2DAA2D,EAAE,CAAC;IACtF,IAAI,WAAoB,CAAC;IACzB,IAAI,CAAC;QACH,WAAW,GAAG,SAAS,CAAC,CAAC,CAAC,CAAC,CAAE,CAAC,CAAC;IACjC,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,OAAO,EAAE,KAAK,EAAE,kCAAmC,CAAW,CAAC,OAAO,EAAE,EAAE,CAAC;IAC7E,CAAC;IACD,IAAI,CAAC,WAAW,IAAI,OAAO,WAAW,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,WAAW,CAAC,EAAE,CAAC;QAClF,OAAO,EAAE,KAAK,EAAE,+CAA+C,EAAE,CAAC;IACpE,CAAC;IACD,OAAO,EAAE,WAAW,EAAE,WAAsC,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC;AACnF,CAAC;AAOD,MAAM,OAAO,GAAG,IAAI,GAAG,CAAC,CAAC,SAAS,EAAE,QAAQ,CAAC,CAAC,CAAC;AAC/C,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC,CAAC;AAC7C,MAAM,eAAe,GAAG,IAAI,GAAG,CAAC,CAAC,OAAO,EAAE,aAAa,CAAC,CAAC,CAAC;AAC1D,MAAM,gBAAgB,GAAG,IAAI,GAAG,CAAC,CAAC,OAAO,EAAE,KAAK,EAAE,MAAM,CAAC,CAAC,CAAC;AAC3D,MAAM,kBAAkB,GAAG,CAAC,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,mBAAmB,CAAU,CAAC;AAElF,SAAS,YAAY,CAAC,CAAU;IAC9B,OAAO,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC,CAAC;AACnE,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,kBAAkB,CAAC,EAA2B;IAC5D,MAAM,MAAM,GAAa,EAAE,CAAC;IAE5B,IAAI,EAAE,CAAC,uBAAuB,CAAC,KAAK,CAAC;QAAE,MAAM,CAAC,IAAI,CAAC,4CAA4C,CAAC,CAAC;IACjG,IAAI,OAAO,EAAE,CAAC,MAAM,CAAC,KAAK,QAAQ,IAAK,EAAE,CAAC,MAAM,CAAY,CAAC,MAAM,KAAK,CAAC;QAAE,MAAM,CAAC,IAAI,CAAC,iCAAiC,CAAC,CAAC;IAC1H,IAAI,OAAO,EAAE,CAAC,QAAQ,CAAC,KAAK,QAAQ,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,QAAQ,CAAW,CAAC;QAAE,MAAM,CAAC,IAAI,CAAC,sCAAsC,CAAC,CAAC;IAClI,IAAI,OAAO,EAAE,CAAC,aAAa,CAAC,KAAK,QAAQ,IAAK,EAAE,CAAC,aAAa,CAAY,CAAC,MAAM,KAAK,CAAC;QAAE,MAAM,CAAC,IAAI,CAAC,wCAAwC,CAAC,CAAC;IAE/I,MAAM,OAAO,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;IAC9B,IAAI,OAAO,OAAO,KAAK,QAAQ,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC;QAC1D,MAAM,CAAC,IAAI,CAAC,oCAAoC,CAAC,CAAC;QAClD,OAAO,EAAE,EAAE,EAAE,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,iEAAiE;IAC/G,CAAC;IAED,IAAI,OAAO,KAAK,MAAM,EAAE,CAAC;QACvB,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,EAAE,CAAC,gBAAgB,CAAW,CAAC;YAAE,MAAM,CAAC,IAAI,CAAC,wEAAwE,CAAC,CAAC;QAChJ,IAAI,EAAE,CAAC,iBAAiB,CAAC,KAAK,SAAS;YAAE,MAAM,CAAC,IAAI,CAAC,2EAA2E,CAAC,CAAC;QAClI,KAAK,MAAM,CAAC,IAAI,kBAAkB;YAAE,IAAI,EAAE,CAAC,CAAC,CAAC,KAAK,SAAS;gBAAE,MAAM,CAAC,IAAI,CAAC,uCAAuC,CAAC,0BAA0B,CAAC,CAAC;IAC/I,CAAC;SAAM,CAAC;QACN,SAAS;QACT,IAAI,EAAE,CAAC,gBAAgB,CAAC,KAAK,SAAS;YAAE,MAAM,CAAC,IAAI,CAAC,0EAA0E,CAAC,CAAC;QAChI,IAAI,CAAC,gBAAgB,CAAC,GAAG,CAAC,EAAE,CAAC,iBAAiB,CAAW,CAAC;YAAE,MAAM,CAAC,IAAI,CAAC,2EAA2E,CAAC,CAAC;QACrJ,4FAA4F;QAC5F,KAAK,MAAM,CAAC,IAAI,kBAAkB,EAAE,CAAC;YACnC,IAAI,EAAE,CAAC,CAAC,CAAC,KAAK,SAAS;gBAAE,MAAM,CAAC,IAAI,CAAC,mCAAmC,CAAC,wCAAwC,CAAC,CAAC;iBAC9G,IAAI,CAAC,YAAY,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;gBAAE,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,4BAA4B,CAAC,CAAC;QAC/E,CAAC;IACH,CAAC;IAED,OAAO,EAAE,EAAE,EAAE,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,MAAM,EAAE,CAAC;AAC7C,CAAC;AAED,8FAA8F;AAC9F,MAAM,eAAe,GAAG;IACtB,QAAQ,EAAE,MAAM,EAAE,SAAS,EAAE,gBAAgB,EAAE,uBAAuB,EAAE,aAAa;IACrF,iBAAiB,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,mBAAmB;CAC/D,CAAC;AAEF;;;;;GAKG;AACH,MAAM,UAAU,mBAAmB,CAAC,MAAwB;IAC1D,MAAM,EAAE,GAAG,MAAM,CAAC,WAAW,CAAC;IAC9B,MAAM,OAAO,GAA4B,EAAE,CAAC;IAC5C,KAAK,MAAM,CAAC,IAAI,eAAe;QAAE,IAAI,EAAE,CAAC,CAAC,CAAC,KAAK,SAAS;YAAE,OAAO,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC;IAC7E,KAAK,MAAM,CAAC,IAAI,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC;QAAE,IAAI,CAAC,CAAC,CAAC,IAAI,OAAO,CAAC;YAAE,OAAO,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC;IACzE,MAAM,SAAS,GAAG,aAAa,CAAC,OAAO,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;IAC7D,OAAO,QAAQ,SAAS,UAAU,MAAM,CAAC,IAAI,EAAE,CAAC;AAClD,CAAC"}

package/node_modules/@openrig/daemon/dist/domain/plugin-discovery-service.d.ts

@@ -1,166 +0,0 @@
-export type PluginRuntime = "claude" | "codex";
-export type PluginSourceKind = "vendored" | "claude-cache" | "codex-cache" | "rig-cwd";
-export interface PluginEntry {
-    /** Stable id for routing (`openrig-core`, `<marketplace>:<plugin>:<version>`). */
-    id: string;
-    /** Plugin's declared name from manifest. */
-    name: string;
-    /** Plugin's declared version. */
-    version: string;
-    /** Optional description from manifest. */
-    description: string | null;
-    /** Source root where this plugin was discovered. */
-    source: PluginSourceKind;
-    /**
-     * Human-readable provenance label per DESIGN.md §5.4 + IMPL-PRD §3.2:
-     *   - `vendored:<plugin>`
-     *   - `claude-cache:<marketplace>/<plugin>/<version>`
-     *   - `codex-cache:<marketplace>/<plugin>/<version>`
-     */
-    sourceLabel: string;
-    /** Which runtimes this plugin supports (presence of manifest dirs). */
-    runtimes: PluginRuntime[];
-    /** Filesystem path to the plugin root. */
-    path: string;
-    /**
-     * mtime of the manifest file (used as a soft "last loaded" approximation
-     * for the UI list view; exact "loaded by runtime" timestamp is out of
-     * scope at v0).
-     */
-    lastSeenAt: string | null;
-    /**
-     * Slice 28 — number of skill folders shipped under `<plugin>/skills/`.
-     * Surfaced in the list response so the PluginsIndexPage can render a
-     * skill-count column without an N+1 detail fetch per plugin row.
-     * Counted at detectPlugin time (one readdir of skills/).
-     *
-     * SC-29 EXCEPTION #11 (slice 28 library-explorer-finishing):
-     * adds skillCount field to PluginEntry — additive shape change to
-     * the plugin discovery API contract. Per banked inline-ledger
-     * discipline; declared verbatim in routes/plugins.ts header.
-     */
-    skillCount: number;
-}
-export interface PluginManifestSummary {
-    /** Original manifest object from `<plugin>/.claude-plugin/plugin.json`. */
-    raw: Record<string, unknown>;
-    /** Convenience-extracted fields (best-effort; null if missing). */
-    name: string | null;
-    version: string | null;
-    description: string | null;
-    homepage: string | null;
-    repository: string | null;
-    license: string | null;
-}
-export interface PluginSkillSummary {
-    /** Skill folder name. */
-    name: string;
-    /** Path relative to plugin root. */
-    relativePath: string;
-}
-export interface PluginHookSummary {
-    /** Which runtime this hook config targets. */
-    runtime: PluginRuntime;
-    /** Path relative to plugin root. */
-    relativePath: string;
-    /** Hook event names declared (best-effort parse). */
-    events: string[];
-}
-export interface PluginMcpServerSummary {
-    /** Which runtime manifest declared this MCP server. */
-    runtime: PluginRuntime;
-    /** Server name (object key in the manifest's mcpServers map). */
-    name: string;
-    /** Declared command if the entry is a stdio-style spec. */
-    command: string | null;
-    /** Declared transport (stdio/http/etc) if the entry exposes it. */
-    transport: string | null;
-}
-export interface PluginDetail {
-    /** The list-view entry. */
-    entry: PluginEntry;
-    /** Parsed `.claude-plugin/plugin.json` if present. */
-    claudeManifest: PluginManifestSummary | null;
-    /** Parsed `.codex-plugin/plugin.json` if present. */
-    codexManifest: PluginManifestSummary | null;
-    /** Skill folders shipped under `<plugin>/skills/`. */
-    skills: PluginSkillSummary[];
-    /** Hook configs shipped under `<plugin>/hooks/`. */
-    hooks: PluginHookSummary[];
-    /**
-     * MCP server declarations from claude/codex manifest's `mcpServers`
-     * field. Slice 3.3 fix-A — velocity-qa VM verify failure #1.
-     */
-    mcpServers: PluginMcpServerSummary[];
-}
-export interface AgentReference {
-    /** agent name (from agent.yaml `name` field). */
-    agentName: string;
-    /** absolute path to agent.yaml. */
-    sourcePath: string;
-    /** profile names that include this plugin in their uses.plugins[]. */
-    profiles: string[];
-}
-export interface PluginDiscoveryServiceOpts {
-    /** Root directory for vendored OpenRig plugins (typically ~/.openrig/plugins). */
-    openrigPluginsDir: string;
-    /** Root directory for Claude Code plugin cache (typically ~/.claude/plugins/cache). */
-    claudeCacheDir: string;
-    /** Root directory for Codex plugin cache (typically ~/.codex/plugins/cache). */
-    codexCacheDir: string;
-    /**
-     * Spec library directory containing agent.yaml files (recursively scanned).
-     * Typically the daemon's resolved spec library root. May be a single root
-     * for v0; expand to multi-root in a later slice if the spec library hooks
-     * its full root list through.
-     */
-    specLibraryDir: string;
-    /**
-     * Slice 3.3 fix-C — optional rig cwd roots whose `.claude/plugins/*` +
-     * `.codex/plugins/*` subdirectories get scanned for rig-bundled
-     * plugins (the projection target from IMPL-PRD §1.2). Default empty.
-     * Population at v0 is per-call via listPlugins({ cwdScanRoots }) from
-     * the API layer (?cwd=<path>); future slices may add automatic
-     * enumeration from running-rig state.
-     */
-    cwdScanRoots?: string[];
-}
-export interface ListPluginsOpts {
-    /** Filter to plugins supporting a specific runtime. */
-    runtimeFilter?: PluginRuntime;
-    /** Filter to plugins from a specific source root. */
-    sourceFilter?: PluginSourceKind;
-    /**
-     * Slice 3.3 fix-C — per-call rig cwd roots; overrides constructor option.
-     * Each cwd contributes `<cwd>/.claude/plugins/*` + `<cwd>/.codex/plugins/*`
-     * discoveries labeled `rig-cwd:<plugin>`. The API layer passes a single
-     * `?cwd=<path>` query param down here.
-     */
-    cwdScanRoots?: string[];
-}
-export declare class PluginDiscoveryService {
-    private readonly opts;
-    constructor(opts: PluginDiscoveryServiceOpts);
-    listPlugins(filterOpts?: ListPluginsOpts): PluginEntry[];
-    private scanCwdBundledPlugins;
-    getPlugin(id: string): PluginDetail | null;
-    findUsedBy(pluginId: string): AgentReference[];
-    /**
-     * Before openrig-core became the sole refocus provider, openrig-lab shipped
-     * the same registrations. Upgrade installs can retain that old lab plugin,
-     * so remove only its refocus commands before validating unknown conflicts.
-     * The hook registry is written first: an interrupted migration therefore
-     * leaves the obsolete provider disabled even if its manifest still points
-     * at the now-empty registry.
-     */
-    private retireObsoleteLabRefocusHooks;
-    /**
-     * Runtime plugin loaders activate every vendored manifest, so the same hook
-     * registered by two plugins fires twice. Reject that load shape before the
-     * discovery service can describe it as healthy. Cache entries are excluded:
-     * multiple cached versions are inventory, not simultaneous providers.
-     */
-    private assertNoDuplicateVendoredHooks;
-    private detectPlugin;
-}
-//# sourceMappingURL=plugin-discovery-service.d.ts.map

package/node_modules/@openrig/daemon/dist/domain/plugin-discovery-service.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"plugin-discovery-service.d.ts","sourceRoot":"","sources":["../../src/domain/plugin-discovery-service.ts"],"names":[],"mappings":"AAkCA,MAAM,MAAM,aAAa,GAAG,QAAQ,GAAG,OAAO,CAAC;AAI/C,MAAM,MAAM,gBAAgB,GAAG,UAAU,GAAG,cAAc,GAAG,aAAa,GAAG,SAAS,CAAC;AAEvF,MAAM,WAAW,WAAW;IAC1B,kFAAkF;IAClF,EAAE,EAAE,MAAM,CAAC;IACX,4CAA4C;IAC5C,IAAI,EAAE,MAAM,CAAC;IACb,iCAAiC;IACjC,OAAO,EAAE,MAAM,CAAC;IAChB,0CAA0C;IAC1C,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,oDAAoD;IACpD,MAAM,EAAE,gBAAgB,CAAC;IACzB;;;;;OAKG;IACH,WAAW,EAAE,MAAM,CAAC;IACpB,uEAAuE;IACvE,QAAQ,EAAE,aAAa,EAAE,CAAC;IAC1B,0CAA0C;IAC1C,IAAI,EAAE,MAAM,CAAC;IACb;;;;OAIG;IACH,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B;;;;;;;;;;OAUG;IACH,UAAU,EAAE,MAAM,CAAC;CACpB;AAED,MAAM,WAAW,qBAAqB;IACpC,2EAA2E;IAC3E,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAC7B,mEAAmE;IACnE,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;IACpB,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;IACvB,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;IACxB,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;CACxB;AAED,MAAM,WAAW,kBAAkB;IACjC,yBAAyB;IACzB,IAAI,EAAE,MAAM,CAAC;IACb,oCAAoC;IACpC,YAAY,EAAE,MAAM,CAAC;CACtB;AAED,MAAM,WAAW,iBAAiB;IAChC,8CAA8C;IAC9C,OAAO,EAAE,aAAa,CAAC;IACvB,oCAAoC;IACpC,YAAY,EAAE,MAAM,CAAC;IACrB,qDAAqD;IACrD,MAAM,EAAE,MAAM,EAAE,CAAC;CAClB;AASD,MAAM,WAAW,sBAAsB;IACrC,uDAAuD;IACvD,OAAO,EAAE,aAAa,CAAC;IACvB,iEAAiE;IACjE,IAAI,EAAE,MAAM,CAAC;IACb,2DAA2D;IAC3D,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;IACvB,mEAAmE;IACnE,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;CAC1B;AAED,MAAM,WAAW,YAAY;IAC3B,2BAA2B;IAC3B,KAAK,EAAE,WAAW,CAAC;IACnB,sDAAsD;IACtD,cAAc,EAAE,qBAAqB,GAAG,IAAI,CAAC;IAC7C,qDAAqD;IACrD,aAAa,EAAE,qBAAqB,GAAG,IAAI,CAAC;IAC5C,sDAAsD;IACtD,MAAM,EAAE,kBAAkB,EAAE,CAAC;IAC7B,oDAAoD;IACpD,KAAK,EAAE,iBAAiB,EAAE,CAAC;IAC3B;;;OAGG;IACH,UAAU,EAAE,sBAAsB,EAAE,CAAC;CACtC;AAED,MAAM,WAAW,cAAc;IAC7B,iDAAiD;IACjD,SAAS,EAAE,MAAM,CAAC;IAClB,mCAAmC;IACnC,UAAU,EAAE,MAAM,CAAC;IACnB,sEAAsE;IACtE,QAAQ,EAAE,MAAM,EAAE,CAAC;CACpB;AAED,MAAM,WAAW,0BAA0B;IACzC,kFAAkF;IAClF,iBAAiB,EAAE,MAAM,CAAC;IAC1B,uFAAuF;IACvF,cAAc,EAAE,MAAM,CAAC;IACvB,gFAAgF;IAChF,aAAa,EAAE,MAAM,CAAC;IACtB;;;;;OAKG;IACH,cAAc,EAAE,MAAM,CAAC;IACvB;;;;;;;OAOG;IACH,YAAY,CAAC,EAAE,MAAM,EAAE,CAAC;CACzB;AAED,MAAM,WAAW,eAAe;IAC9B,uDAAuD;IACvD,aAAa,CAAC,EAAE,aAAa,CAAC;IAC9B,qDAAqD;IACrD,YAAY,CAAC,EAAE,gBAAgB,CAAC;IAChC;;;;;OAKG;IACH,YAAY,CAAC,EAAE,MAAM,EAAE,CAAC;CACzB;AAMD,qBAAa,sBAAsB;IACjC,OAAO,CAAC,QAAQ,CAAC,IAAI,CAA6B;gBAEtC,IAAI,EAAE,0BAA0B;IAM5C,WAAW,CAAC,UAAU,GAAE,eAAoB,GAAG,WAAW,EAAE;IA8E5D,OAAO,CAAC,qBAAqB;IA0B7B,SAAS,CAAC,EAAE,EAAE,MAAM,GAAG,YAAY,GAAG,IAAI;IA8D1C,UAAU,CAAC,QAAQ,EAAE,MAAM,GAAG,cAAc,EAAE;IAsB9C;;;;;;;OAOG;IACH,OAAO,CAAC,6BAA6B;IAwBrC;;;;;OAKG;IACH,OAAO,CAAC,8BAA8B;IA+BtC,OAAO,CAAC,YAAY;CA6DrB"}