@sdd-method/sdd-cli 0.61.1 → 0.63.0

package/dist/lib/pack/publish-transform.js

@@ -0,0 +1,243 @@
+import { readFile, rename, rm, writeFile } from "node:fs/promises";
+import { join } from "node:path";
+/**
+ * Publish transform (sdd-method ADR 0183 / 0184). Produces the point-in-time,
+ * producer-agnostic *published* form of method markdown by subtraction from the
+ * canon, and gates the result with a fail-closed deny-class lint.
+ *
+ * The strip is a pure structural transform — it removes marked structures and
+ * never reads meaning, so it cannot misinterpret. The lint runs on the produced
+ * output and proves nothing leaked; it never decides what to strip. Authors
+ * carry the burden of placing evolution / producer content in the structured
+ * places (lineage regions, stripped fields), enforced at author/CI time.
+ *
+ * Enabled only for method-baseline builds (BuildOptions.publishTransform);
+ * adopter-pack builds are unaffected.
+ */
+// Header fields stripped on publish (ADR 0184 — adr-metadata-schema.md).
+const STRIPPED_FIELDS = [
+    "Status History",
+    "Acceptance Rationale",
+    "Supersedes",
+    "Superseded By",
+    "Amends",
+    "Source",
+    "Grounding",
+    "Introduced In",
+];
+const STRIPPED_FIELD_RE = new RegExp(`^\\* \\*\\*(${STRIPPED_FIELDS.join("|")}):\\*\\*`);
+const LINEAGE_START = "<!-- lineage:start -->";
+const LINEAGE_END = "<!-- lineage:end -->";
+// Published-surface deny-classes. Kept in lock-step with the reference gate in
+// sdd-method orchestration/scripts/validate-adr-structure.sh (--publish-lint).
+// A line carrying `pit-ok` is exempt; a file carrying `pit-ok-file` is exempt
+// wholesale (a meta/versioning ADR whose deny-vocabulary IS its subject).
+const DENY_TEMPORAL = [
+    /since retired/i,
+    /previously/i,
+    /formerly/i,
+    /supersed/i,
+    /no longer/i,
+    /pre-federation/i,
+    /used to/i,
+    /bumps? to/i,
+    /sdd-cli [0-9]/i,
+    /\bv[0-9]+\.[0-9]+\.[0-9]+/i,
+];
+const DENY_PRODUCER = [
+    /sdd-method#/i,
+    /sdd-method-gov/i,
+    /sdd-method repo/i,
+    /the method repo/i,
+    /governance repo/i,
+    /synced from (sdd-method|the method)/i,
+    /bootstrap.?procedure/i,
+];
+/** True when the markdown is an ADR with `Status: Accepted`. */
+export function isAccepted(content) {
+    const m = content.match(/^\*\s+\*\*Status:\*\*\s*([A-Za-z]+)/m);
+    return m?.[1] === "Accepted";
+}
+/** Path is an ADR file (under an `adr/` or `platform-adr/` dir). */
+export function isAdrPath(relPath) {
+    return /adr\/ADR \d/i.test(relPath);
+}
+/** Remove lineage regions + stripped-class header fields. Deterministic. */
+export function stripStructures(content) {
+    const out = [];
+    let inLineage = false;
+    for (const line of content.split("\n")) {
+        if (line.includes(LINEAGE_START)) {
+            inLineage = true;
+            continue;
+        }
+        if (line.includes(LINEAGE_END)) {
+            inLineage = false;
+            continue;
+        }
+        if (inLineage)
+            continue;
+        if (STRIPPED_FIELD_RE.test(line))
+            continue;
+        out.push(line);
+    }
+    return out.join("\n");
+}
+/**
+ * Flatten cross-repo references to the bare in-namespace form: the published
+ * method is one namespace, so `<repo>#<id>` becomes `ADR <id>` (ADR 0184 §4.3).
+ */
+export function flattenCrossRefs(content) {
+    return content.replace(/\bsdd-method#(\d{3,4})\b/g, "ADR $1");
+}
+/**
+ * Prefix bare in-namespace `ADR NNNN` refs with the `M-ADR` origin prefix
+ * (ADR 0140 §4.1). The `(?<![\w-])` guard means a ref already prefixed
+ * (`M-ADR`, `RA-ADR`) is left untouched — the `-` before `ADR` fails the
+ * lookbehind — so the rewrite is idempotent and never disturbs another
+ * origin's namespace.
+ */
+/**
+ * The origin prefix for an ADR number, by band (ADR 0140 §4.1): `0001–0999`
+ * is the method (`M-ADR`), `9000–9999` is the reference architecture
+ * (`RA-ADR`). Adopter-authored numbers (`1000–8999`) keep the bare `ADR` and
+ * are returned null. Range-aware prefixing is what lets a ref-arch document
+ * cite a method ADR — a flattened `sdd-method#0174` becomes `M-ADR 0174`, not
+ * `RA-ADR 0174` — and keeps the method correct should it ever cite a `9NNN`.
+ */
+export function originPrefixForNumber(num) {
+    if (/^0\d{3}$/.test(num))
+        return "M-ADR";
+    if (/^9\d{3}$/.test(num))
+        return "RA-ADR";
+    return null;
+}
+/**
+ * Rewrite bare in-namespace `ADR NNNN` refs to their origin prefix, by number
+ * band. Matches both the prose form ("ADR 0140") and the URL-encoded
+ * link-target form ("ADR%200140"), separator preserved, so renamed files and
+ * the hrefs that point to them stay in lock-step. The lookbehind leaves an
+ * already-prefixed `M-ADR` / `RA-ADR` untouched (idempotent).
+ */
+export function applyOriginPrefix(content) {
+    return content.replace(/(?<![\w-])ADR(%20| )(\d{3,4})(?!\d)/g, (m, sep, num) => {
+        const p = originPrefixForNumber(num);
+        return p ? `${p}${sep}${num}` : m;
+    });
+}
+/** @deprecated Back-compat alias — origin prefixing is now range-aware. */
+export const applyMAdrPrefix = applyOriginPrefix;
+/**
+ * The published filename for an ADR under the M-ADR rename: the *basename*
+ * `ADR NNNN…` becomes `M-ADR NNNN…`. The containing directory (e.g.
+ * `docs/method/adr/`, `platform-adr/`) is never touched — only the leading
+ * `ADR ` of the filename. Returns the path unchanged when it is not an
+ * `ADR NNNN` file. Idempotent: an already-`M-ADR`/`RA-ADR` name is left alone.
+ */
+export function mAdrFilename(relPath) {
+    return relPath.replace(/(^|\/)ADR (\d{3,4})/, (m, pre, num) => {
+        const p = originPrefixForNumber(num);
+        return p ? `${pre}${p} ${num}` : m;
+    });
+}
+/** The full published form of a markdown document. */
+export function transformPublished(content, opts = {}) {
+    let c = stripStructures(content);
+    c = flattenCrossRefs(c);
+    if (opts.mAdrPrefix)
+        c = applyMAdrPrefix(c);
+    return c;
+}
+/** Scan already-published content for deny-class leaks. */
+export function lintPublished(published, relPath) {
+    if (published.includes("pit-ok-file"))
+        return [];
+    const violations = [];
+    const lines = published.split("\n");
+    lines.forEach((line, i) => {
+        if (line.includes("pit-ok"))
+            return;
+        for (const re of DENY_TEMPORAL) {
+            if (re.test(line)) {
+                violations.push({
+                    path: relPath,
+                    cls: "temporal",
+                    pattern: re.source,
+                    line: i + 1,
+                    text: line.slice(0, 140),
+                });
+            }
+        }
+        for (const re of DENY_PRODUCER) {
+            if (re.test(line)) {
+                violations.push({
+                    path: relPath,
+                    cls: "producer",
+                    pattern: re.source,
+                    line: i + 1,
+                    text: line.slice(0, 140),
+                });
+            }
+        }
+    });
+    return violations;
+}
+/**
+ * Apply the publish transform to a staged payload in place: drop non-Accepted
+ * ADRs, transform every markdown file to its published form, and lint the
+ * result. Returns the retained paths + any violations (caller fails closed).
+ */
+export async function applyPublishTransform(payloadRoot, paths, opts = {}) {
+    const keptPaths = [];
+    const droppedPaths = [];
+    const violations = [];
+    for (const p of paths) {
+        if (!p.endsWith(".md")) {
+            // Non-Markdown config/data (registry.yaml, seed lists, schemas): flatten
+            // cross-repo refs so the published config surface is producer-agnostic,
+            // and — under the origin-prefix rename — range-prefix bare in-namespace
+            // ADR refs so the config matches the renamed decision files. No lineage
+            // strip / Accepted filter / file rename applies here. Mirrors the method
+            // baseline builder's yaml/yml/txt handling.
+            if (/\.(ya?ml|txt)$/.test(p)) {
+                const abs = join(payloadRoot, p);
+                const content = await readFile(abs, "utf8");
+                let rewritten = flattenCrossRefs(content);
+                if (opts.mAdrPrefix)
+                    rewritten = applyOriginPrefix(rewritten);
+                if (rewritten !== content)
+                    await writeFile(abs, rewritten);
+            }
+            keptPaths.push(p);
+            continue;
+        }
+        const abs = join(payloadRoot, p);
+        const content = await readFile(abs, "utf8");
+        // Accepted-only: a non-Accepted ADR is not part of "what the method is".
+        if (isAdrPath(p) && !isAccepted(content)) {
+            await rm(abs, { force: true });
+            droppedPaths.push(p);
+            continue;
+        }
+        const published = transformPublished(content, opts);
+        violations.push(...lintPublished(published, p));
+        if (published !== content) {
+            await writeFile(abs, published);
+        }
+        // Under the M-ADR rename, the published *file* is renamed too so the
+        // filename matches its (rewritten) heading. Canon filenames stay `ADR`;
+        // this is published-output only. The renamed path is what flows into
+        // MANAGED_PATHS + checksums, so the lock + sync stay self-consistent.
+        let outPath = p;
+        if (opts.mAdrPrefix && isAdrPath(p)) {
+            const renamed = mAdrFilename(p);
+            if (renamed !== p) {
+                await rename(abs, join(payloadRoot, renamed));
+                outPath = renamed;
+            }
+        }
+        keptPaths.push(outPath);
+    }
+    return { keptPaths, droppedPaths, violations };
+}
+//# sourceMappingURL=publish-transform.js.map

package/dist/lib/pack/publish-transform.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"publish-transform.js","sourceRoot":"","sources":["../../../src/lib/pack/publish-transform.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AACnE,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAEjC;;;;;;;;;;;;;GAaG;AAEH,yEAAyE;AACzE,MAAM,eAAe,GAAG;IACtB,gBAAgB;IAChB,sBAAsB;IACtB,YAAY;IACZ,eAAe;IACf,QAAQ;IACR,QAAQ;IACR,WAAW;IACX,eAAe;CAChB,CAAC;AACF,MAAM,iBAAiB,GAAG,IAAI,MAAM,CAClC,eAAe,eAAe,CAAC,IAAI,CAAC,GAAG,CAAC,UAAU,CACnD,CAAC;AAEF,MAAM,aAAa,GAAG,wBAAwB,CAAC;AAC/C,MAAM,WAAW,GAAG,sBAAsB,CAAC;AAE3C,+EAA+E;AAC/E,+EAA+E;AAC/E,8EAA8E;AAC9E,0EAA0E;AAC1E,MAAM,aAAa,GAAG;IACpB,gBAAgB;IAChB,aAAa;IACb,WAAW;IACX,WAAW;IACX,YAAY;IACZ,iBAAiB;IACjB,UAAU;IACV,YAAY;IACZ,gBAAgB;IAChB,4BAA4B;CAC7B,CAAC;AACF,MAAM,aAAa,GAAG;IACpB,cAAc;IACd,iBAAiB;IACjB,kBAAkB;IAClB,kBAAkB;IAClB,kBAAkB;IAClB,sCAAsC;IACtC,uBAAuB;CACxB,CAAC;AA6BF,gEAAgE;AAChE,MAAM,UAAU,UAAU,CAAC,OAAe;IACxC,MAAM,CAAC,GAAG,OAAO,CAAC,KAAK,CAAC,sCAAsC,CAAC,CAAC;IAChE,OAAO,CAAC,EAAE,CAAC,CAAC,CAAC,KAAK,UAAU,CAAC;AAC/B,CAAC;AAED,oEAAoE;AACpE,MAAM,UAAU,SAAS,CAAC,OAAe;IACvC,OAAO,cAAc,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;AACtC,CAAC;AAED,4EAA4E;AAC5E,MAAM,UAAU,eAAe,CAAC,OAAe;IAC7C,MAAM,GAAG,GAAa,EAAE,CAAC;IACzB,IAAI,SAAS,GAAG,KAAK,CAAC;IACtB,KAAK,MAAM,IAAI,IAAI,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;QACvC,IAAI,IAAI,CAAC,QAAQ,CAAC,aAAa,CAAC,EAAE,CAAC;YACjC,SAAS,GAAG,IAAI,CAAC;YACjB,SAAS;QACX,CAAC;QACD,IAAI,IAAI,CAAC,QAAQ,CAAC,WAAW,CAAC,EAAE,CAAC;YAC/B,SAAS,GAAG,KAAK,CAAC;YAClB,SAAS;QACX,CAAC;QACD,IAAI,SAAS;YAAE,SAAS;QACxB,IAAI,iBAAiB,CAAC,IAAI,CAAC,IAAI,CAAC;YAAE,SAAS;QAC3C,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACjB,CAAC;IACD,OAAO,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AACxB,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,gBAAgB,CAAC,OAAe;IAC9C,OAAO,OAAO,CAAC,OAAO,CAAC,2BAA2B,EAAE,QAAQ,CAAC,CAAC;AAChE,CAAC;AAED;;;;;;GAMG;AACH;;;;;;;GAOG;AACH,MAAM,UAAU,qBAAqB,CAAC,GAAW;IAC/C,IAAI,UAAU,CAAC,IAAI,CAAC,GAAG,CAAC;QAAE,OAAO,OAAO,CAAC;IACzC,IAAI,UAAU,CAAC,IAAI,CAAC,GAAG,CAAC;QAAE,OAAO,QAAQ,CAAC;IAC1C,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,iBAAiB,CAAC,OAAe;IAC/C,OAAO,OAAO,CAAC,OAAO,CACpB,sCAAsC,EACtC,CAAC,CAAC,EAAE,GAAW,EAAE,GAAW,EAAE,EAAE;QAC9B,MAAM,CAAC,GAAG,qBAAqB,CAAC,GAAG,CAAC,CAAC;QACrC,OAAO,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,GAAG,GAAG,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;IACpC,CAAC,CACF,CAAC;AACJ,CAAC;AAED,2EAA2E;AAC3E,MAAM,CAAC,MAAM,eAAe,GAAG,iBAAiB,CAAC;AAEjD;;;;;;GAMG;AACH,MAAM,UAAU,YAAY,CAAC,OAAe;IAC1C,OAAO,OAAO,CAAC,OAAO,CAAC,qBAAqB,EAAE,CAAC,CAAC,EAAE,GAAW,EAAE,GAAW,EAAE,EAAE;QAC5E,MAAM,CAAC,GAAG,qBAAqB,CAAC,GAAG,CAAC,CAAC;QACrC,OAAO,CAAC,CAAC,CAAC,CAAC,GAAG,GAAG,GAAG,CAAC,IAAI,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;IACrC,CAAC,CAAC,CAAC;AACL,CAAC;AAED,sDAAsD;AACtD,MAAM,UAAU,kBAAkB,CAChC,OAAe,EACf,OAAyB,EAAE;IAE3B,IAAI,CAAC,GAAG,eAAe,CAAC,OAAO,CAAC,CAAC;IACjC,CAAC,GAAG,gBAAgB,CAAC,CAAC,CAAC,CAAC;IACxB,IAAI,IAAI,CAAC,UAAU;QAAE,CAAC,GAAG,eAAe,CAAC,CAAC,CAAC,CAAC;IAC5C,OAAO,CAAC,CAAC;AACX,CAAC;AAED,2DAA2D;AAC3D,MAAM,UAAU,aAAa,CAC3B,SAAiB,EACjB,OAAe;IAEf,IAAI,SAAS,CAAC,QAAQ,CAAC,aAAa,CAAC;QAAE,OAAO,EAAE,CAAC;IACjD,MAAM,UAAU,GAAuB,EAAE,CAAC;IAC1C,MAAM,KAAK,GAAG,SAAS,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IACpC,KAAK,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,CAAC,EAAE,EAAE;QACxB,IAAI,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC;YAAE,OAAO;QACpC,KAAK,MAAM,EAAE,IAAI,aAAa,EAAE,CAAC;YAC/B,IAAI,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;gBAClB,UAAU,CAAC,IAAI,CAAC;oBACd,IAAI,EAAE,OAAO;oBACb,GAAG,EAAE,UAAU;oBACf,OAAO,EAAE,EAAE,CAAC,MAAM;oBAClB,IAAI,EAAE,CAAC,GAAG,CAAC;oBACX,IAAI,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC;iBACzB,CAAC,CAAC;YACL,CAAC;QACH,CAAC;QACD,KAAK,MAAM,EAAE,IAAI,aAAa,EAAE,CAAC;YAC/B,IAAI,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;gBAClB,UAAU,CAAC,IAAI,CAAC;oBACd,IAAI,EAAE,OAAO;oBACb,GAAG,EAAE,UAAU;oBACf,OAAO,EAAE,EAAE,CAAC,MAAM;oBAClB,IAAI,EAAE,CAAC,GAAG,CAAC;oBACX,IAAI,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC;iBACzB,CAAC,CAAC;YACL,CAAC;QACH,CAAC;IACH,CAAC,CAAC,CAAC;IACH,OAAO,UAAU,CAAC;AACpB,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,qBAAqB,CACzC,WAAmB,EACnB,KAAe,EACf,OAAyB,EAAE;IAE3B,MAAM,SAAS,GAAa,EAAE,CAAC;IAC/B,MAAM,YAAY,GAAa,EAAE,CAAC;IAClC,MAAM,UAAU,GAAuB,EAAE,CAAC;IAE1C,KAAK,MAAM,CAAC,IAAI,KAAK,EAAE,CAAC;QACtB,IAAI,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;YACvB,yEAAyE;YACzE,wEAAwE;YACxE,wEAAwE;YACxE,wEAAwE;YACxE,yEAAyE;YACzE,4CAA4C;YAC5C,IAAI,gBAAgB,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC;gBAC7B,MAAM,GAAG,GAAG,IAAI,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC;gBACjC,MAAM,OAAO,GAAG,MAAM,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;gBAC5C,IAAI,SAAS,GAAG,gBAAgB,CAAC,OAAO,CAAC,CAAC;gBAC1C,IAAI,IAAI,CAAC,UAAU;oBAAE,SAAS,GAAG,iBAAiB,CAAC,SAAS,CAAC,CAAC;gBAC9D,IAAI,SAAS,KAAK,OAAO;oBAAE,MAAM,SAAS,CAAC,GAAG,EAAE,SAAS,CAAC,CAAC;YAC7D,CAAC;YACD,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;YAClB,SAAS;QACX,CAAC;QACD,MAAM,GAAG,GAAG,IAAI,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC;QACjC,MAAM,OAAO,GAAG,MAAM,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;QAE5C,yEAAyE;QACzE,IAAI,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC,EAAE,CAAC;YACzC,MAAM,EAAE,CAAC,GAAG,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;YAC/B,YAAY,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;YACrB,SAAS;QACX,CAAC;QAED,MAAM,SAAS,GAAG,kBAAkB,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;QACpD,UAAU,CAAC,IAAI,CAAC,GAAG,aAAa,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,CAAC;QAChD,IAAI,SAAS,KAAK,OAAO,EAAE,CAAC;YAC1B,MAAM,SAAS,CAAC,GAAG,EAAE,SAAS,CAAC,CAAC;QAClC,CAAC;QAED,qEAAqE;QACrE,wEAAwE;QACxE,qEAAqE;QACrE,sEAAsE;QACtE,IAAI,OAAO,GAAG,CAAC,CAAC;QAChB,IAAI,IAAI,CAAC,UAAU,IAAI,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC;YACpC,MAAM,OAAO,GAAG,YAAY,CAAC,CAAC,CAAC,CAAC;YAChC,IAAI,OAAO,KAAK,CAAC,EAAE,CAAC;gBAClB,MAAM,MAAM,CAAC,GAAG,EAAE,IAAI,CAAC,WAAW,EAAE,OAAO,CAAC,CAAC,CAAC;gBAC9C,OAAO,GAAG,OAAO,CAAC;YACpB,CAAC;QACH,CAAC;QACD,SAAS,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IAC1B,CAAC;IAED,OAAO,EAAE,SAAS,EAAE,YAAY,EAAE,UAAU,EAAE,CAAC;AACjD,CAAC"}

package/dist/lib/sync/bundle-source.d.ts

@@ -0,0 +1,34 @@
+import type { SyncConfigBundle } from "./config.js";
+/**
+ * Resolve a config bundle entry (sdd-method Cut-2 WS-B) to a local tarball
+ * path the single-bundle sync engine can apply, regardless of where the
+ * bundle lives. A local `source` is used in place; an `https://` source is
+ * fetched to a temp file. When the entry carries a `sha256` integrity pin,
+ * the materialised tarball is verified against it before it is handed on —
+ * the source-agnostic integrity invariant (ADR 0185): the same pin holds
+ * across a local tarball, an internal HTTPS mirror, or (later) an OCI
+ * registry, so moving the source is configuration, not rework.
+ *
+ * NOTE: signature verification (cosign) and OCI/GHCR transport are the
+ * deferred Phase B of WS-B — they need registry infrastructure that does
+ * not exist yet. They slot in here behind the same `source` contract.
+ */
+export interface MaterialisedBundle {
+    /** Absolute local path to the tarball, ready for the sync engine. */
+    localPath: string;
+    /** Release any temp resources (deletes a fetched file; no-op for local). */
+    cleanup: () => Promise<void>;
+}
+/** Verify a tarball's sha256 against a pin; throw on mismatch. */
+export declare function verifySha256(localPath: string, expected: string): Promise<void>;
+/**
+ * Fetch a remote bundle to a temp file. Uses the global `fetch` (Node 18+).
+ * Exported for tests that stub the fetcher.
+ */
+export declare function fetchToTemp(url: string, fetchImpl?: typeof fetch): Promise<string>;
+/**
+ * Materialise a config bundle entry to a verified local tarball path.
+ * Callers MUST invoke the returned `cleanup` after the sync completes.
+ */
+export declare function materialiseBundle(entry: SyncConfigBundle, fetchImpl?: typeof fetch): Promise<MaterialisedBundle>;
+//# sourceMappingURL=bundle-source.d.ts.map

package/dist/lib/sync/bundle-source.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"bundle-source.d.ts","sourceRoot":"","sources":["../../../src/lib/sync/bundle-source.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,aAAa,CAAC;AAEpD;;;;;;;;;;;;;GAaG;AAEH,MAAM,WAAW,kBAAkB;IACjC,qEAAqE;IACrE,SAAS,EAAE,MAAM,CAAC;IAClB,4EAA4E;IAC5E,OAAO,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC;CAC9B;AAWD,kEAAkE;AAClE,wBAAsB,YAAY,CAChC,SAAS,EAAE,MAAM,EACjB,QAAQ,EAAE,MAAM,GACf,OAAO,CAAC,IAAI,CAAC,CAQf;AAED;;;GAGG;AACH,wBAAsB,WAAW,CAC/B,GAAG,EAAE,MAAM,EACX,SAAS,GAAE,OAAO,KAAa,GAC9B,OAAO,CAAC,MAAM,CAAC,CAUjB;AAED;;;GAGG;AACH,wBAAsB,iBAAiB,CACrC,KAAK,EAAE,gBAAgB,EACvB,SAAS,GAAE,OAAO,KAAa,GAC9B,OAAO,CAAC,kBAAkB,CAAC,CAmB7B"}

package/dist/lib/sync/bundle-source.js

@@ -0,0 +1,61 @@
+import { createHash } from "node:crypto";
+import { mkdtemp, readFile, rm, writeFile } from "node:fs/promises";
+import { tmpdir } from "node:os";
+import { basename, join } from "node:path";
+function isUrl(s) {
+    return /^https?:\/\//i.test(s);
+}
+async function sha256File(path) {
+    const buf = await readFile(path);
+    return createHash("sha256").update(buf).digest("hex");
+}
+/** Verify a tarball's sha256 against a pin; throw on mismatch. */
+export async function verifySha256(localPath, expected) {
+    const actual = await sha256File(localPath);
+    if (actual.toLowerCase() !== expected.toLowerCase()) {
+        throw new Error(`bundle_sha256 mismatch for ${basename(localPath)}: ` +
+            `expected ${expected}, got ${actual}`);
+    }
+}
+/**
+ * Fetch a remote bundle to a temp file. Uses the global `fetch` (Node 18+).
+ * Exported for tests that stub the fetcher.
+ */
+export async function fetchToTemp(url, fetchImpl = fetch) {
+    const res = await fetchImpl(url);
+    if (!res.ok) {
+        throw new Error(`Failed to fetch bundle ${url}: HTTP ${res.status}`);
+    }
+    const buf = Buffer.from(await res.arrayBuffer());
+    const dir = await mkdtemp(join(tmpdir(), "sdd-cli-bundle-src-"));
+    const dest = join(dir, basename(new URL(url).pathname) || "bundle.tar.gz");
+    await writeFile(dest, buf);
+    return dest;
+}
+/**
+ * Materialise a config bundle entry to a verified local tarball path.
+ * Callers MUST invoke the returned `cleanup` after the sync completes.
+ */
+export async function materialiseBundle(entry, fetchImpl = fetch) {
+    if (isUrl(entry.source)) {
+        const localPath = await fetchToTemp(entry.source, fetchImpl);
+        const cleanup = async () => {
+            await rm(localPath, { force: true });
+            await rm(join(localPath, ".."), { recursive: true, force: true });
+        };
+        try {
+            if (entry.sha256)
+                await verifySha256(localPath, entry.sha256);
+        }
+        catch (err) {
+            await cleanup();
+            throw err;
+        }
+        return { localPath, cleanup };
+    }
+    // Local source: verify in place, no temp resources to release.
+    if (entry.sha256)
+        await verifySha256(entry.source, entry.sha256);
+    return { localPath: entry.source, cleanup: async () => { } };
+}
+//# sourceMappingURL=bundle-source.js.map

package/dist/lib/sync/bundle-source.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"bundle-source.js","sourceRoot":"","sources":["../../../src/lib/sync/bundle-source.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,EAAE,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AACpE,OAAO,EAAE,MAAM,EAAE,MAAM,SAAS,CAAC;AACjC,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAyB3C,SAAS,KAAK,CAAC,CAAS;IACtB,OAAO,eAAe,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AACjC,CAAC;AAED,KAAK,UAAU,UAAU,CAAC,IAAY;IACpC,MAAM,GAAG,GAAG,MAAM,QAAQ,CAAC,IAAI,CAAC,CAAC;IACjC,OAAO,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AACxD,CAAC;AAED,kEAAkE;AAClE,MAAM,CAAC,KAAK,UAAU,YAAY,CAChC,SAAiB,EACjB,QAAgB;IAEhB,MAAM,MAAM,GAAG,MAAM,UAAU,CAAC,SAAS,CAAC,CAAC;IAC3C,IAAI,MAAM,CAAC,WAAW,EAAE,KAAK,QAAQ,CAAC,WAAW,EAAE,EAAE,CAAC;QACpD,MAAM,IAAI,KAAK,CACb,8BAA8B,QAAQ,CAAC,SAAS,CAAC,IAAI;YACnD,YAAY,QAAQ,SAAS,MAAM,EAAE,CACxC,CAAC;IACJ,CAAC;AACH,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,WAAW,CAC/B,GAAW,EACX,YAA0B,KAAK;IAE/B,MAAM,GAAG,GAAG,MAAM,SAAS,CAAC,GAAG,CAAC,CAAC;IACjC,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;QACZ,MAAM,IAAI,KAAK,CAAC,0BAA0B,GAAG,UAAU,GAAG,CAAC,MAAM,EAAE,CAAC,CAAC;IACvE,CAAC;IACD,MAAM,GAAG,GAAG,MAAM,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,WAAW,EAAE,CAAC,CAAC;IACjD,MAAM,GAAG,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC,MAAM,EAAE,EAAE,qBAAqB,CAAC,CAAC,CAAC;IACjE,MAAM,IAAI,GAAG,IAAI,CAAC,GAAG,EAAE,QAAQ,CAAC,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,CAAC,IAAI,eAAe,CAAC,CAAC;IAC3E,MAAM,SAAS,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;IAC3B,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,iBAAiB,CACrC,KAAuB,EACvB,YAA0B,KAAK;IAE/B,IAAI,KAAK,CAAC,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC;QACxB,MAAM,SAAS,GAAG,MAAM,WAAW,CAAC,KAAK,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC;QAC7D,MAAM,OAAO,GAAG,KAAK,IAAI,EAAE;YACzB,MAAM,EAAE,CAAC,SAAS,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;YACrC,MAAM,EAAE,CAAC,IAAI,CAAC,SAAS,EAAE,IAAI,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;QACpE,CAAC,CAAC;QACF,IAAI,CAAC;YACH,IAAI,KAAK,CAAC,MAAM;gBAAE,MAAM,YAAY,CAAC,SAAS,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;QAChE,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,OAAO,EAAE,CAAC;YAChB,MAAM,GAAG,CAAC;QACZ,CAAC;QACD,OAAO,EAAE,SAAS,EAAE,OAAO,EAAE,CAAC;IAChC,CAAC;IAED,+DAA+D;IAC/D,IAAI,KAAK,CAAC,MAAM;QAAE,MAAM,YAAY,CAAC,KAAK,CAAC,MAAM,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;IACjE,OAAO,EAAE,SAAS,EAAE,KAAK,CAAC,MAAM,EAAE,OAAO,EAAE,KAAK,IAAI,EAAE,GAAE,CAAC,EAAE,CAAC;AAC9D,CAAC"}

package/dist/lib/sync/config.d.ts

@@ -1,33 +1,63 @@
 /**
- * Multi-bundle sync config file. Per ADR 0151 + companion plan Phase 3b.
+ * Multi-bundle sync config file. Per ADR 0151 + companion plan Phase 3b,
+ * extended for the Cut-2 bundle_source resolver (sdd-method Cut-2 WS-B).
  *
  * Lives at `method-baseline.config.yaml` (or any path passed via
  * `sdd-cli sync --config <path>`). Declares an ordered list of bundle
  * sources to sync in sequence.
  *
- * Shape:
+ * Two ways to name a bundle:
+ *
+ * 1. Explicit `source` (path or URL) — unchanged:
  *
  * ```yaml
  * version: "1.0"
  * bundles:
- *   - source: "./dist/method-baseline/method-baseline-v0.9.0.tar.gz"
- *   - source: "./dist/example-app-context-pack/example-app-context-pack-v0.1.0.tar.gz"
+ *   - source: "./dist/platform-baseline/platform-baseline-v1.2.0.tar.gz"
  * ```
  *
- * `source` may be:
- *   - Absolute path
- *   - Path relative to the config file's directory
+ * 2. `name` + `version` resolved against a shared `bundle_source` base —
+ *    no explicit paths, source-agnostic (local dir today, internal HTTPS
+ *    base next, an OCI registry later — all behind the same key):
+ *
+ * ```yaml
+ * version: "1.0"
+ * bundle_source: "./dist"            # local dir, or https://host/method-bundles
+ * bundles:
+ *   - name: platform-baseline
+ *     version: v1.2.0
+ *     sha256: "<hex>"                # optional integrity pin (verified on apply)
+ *   - name: reverse-extension-baseline
+ *     version: v1.2.0
+ * ```
  *
- * Remote URL support is reserved for a future minor (consumers fetch
- * to a temp file and pass the local path on for now).
+ * Resolution computes `<base>/<name>/<name>-<version>.tar.gz` — the same
+ * layout `build-method-baseline-bundle.sh --output-dir dist/<name>` emits.
+ * A `source` is resolved relative to the config file's directory (or kept
+ * as-is when absolute / a URL). The `bundle_sha256` pin is the
+ * source-agnostic integrity invariant (ADR 0185): it is verified against
+ * the materialised tarball regardless of where it came from.
  */
 export interface SyncConfig {
     version: string;
+    /**
+     * Optional base location resolved bundles are fetched from: a local
+     * directory (absolute, or relative to the config file) or an
+     * `https://`/`http://` base URL. Required only when a bundle entry uses
+     * `name`+`version` rather than an explicit `source`.
+     */
+    bundleSource?: string;
     bundles: SyncConfigBundle[];
 }
 export interface SyncConfigBundle {
-    /** Resolved absolute path to the tarball. */
+    /**
+     * Resolved tarball location: an absolute local path, or an
+     * `https://`/`http://` URL. The sync verb materialises this to a local
+     * file before applying (see `bundle-source.ts`).
+     */
     source: string;
+    /** Optional hex sha256 integrity pin, verified before the bundle applies. */
+    sha256?: string;
 }
 export declare function loadSyncConfig(configPath: string): Promise<SyncConfig>;
 //# sourceMappingURL=config.d.ts.map

package/dist/lib/sync/config.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"config.d.ts","sourceRoot":"","sources":["../../../src/lib/sync/config.ts"],"names":[],"mappings":"AAIA;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,MAAM,WAAW,UAAU;IACzB,OAAO,EAAE,MAAM,CAAC;IAChB,OAAO,EAAE,gBAAgB,EAAE,CAAC;CAC7B;AAED,MAAM,WAAW,gBAAgB;IAC/B,6CAA6C;IAC7C,MAAM,EAAE,MAAM,CAAC;CAChB;AAWD,wBAAsB,cAAc,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,UAAU,CAAC,CA2C5E"}
+{"version":3,"file":"config.d.ts","sourceRoot":"","sources":["../../../src/lib/sync/config.ts"],"names":[],"mappings":"AAIA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAuCG;AACH,MAAM,WAAW,UAAU;IACzB,OAAO,EAAE,MAAM,CAAC;IAChB;;;;;OAKG;IACH,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,OAAO,EAAE,gBAAgB,EAAE,CAAC;CAC7B;AAED,MAAM,WAAW,gBAAgB;IAC/B;;;;OAIG;IACH,MAAM,EAAE,MAAM,CAAC;IACf,6EAA6E;IAC7E,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAmBD,wBAAsB,cAAc,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,UAAU,CAAC,CAgF5E"}

package/dist/lib/sync/config.js

@@ -1,6 +1,9 @@
 import { readFile } from "node:fs/promises";
 import { dirname, isAbsolute, resolve } from "node:path";
 import { parse as parseYaml } from "yaml";
+function isUrl(s) {
+    return /^https?:\/\//i.test(s);
+}
 export async function loadSyncConfig(configPath) {
     const absPath = isAbsolute(configPath) ? configPath : resolve(configPath);
     let raw;
@@ -25,16 +28,45 @@ export async function loadSyncConfig(configPath) {
         throw new Error(`Sync config ${absPath} field "bundles" must not be empty`);
     }
     const configDir = dirname(absPath);
+    const bundleSource = typeof parsed.bundle_source === "string" ? parsed.bundle_source : undefined;
+    // Pre-resolve the base for name/version resolution: a URL stays as-is;
+    // a local dir is resolved relative to the config file.
+    const resolvedBase = bundleSource === undefined
+        ? undefined
+        : isUrl(bundleSource) || isAbsolute(bundleSource)
+            ? bundleSource
+            : resolve(configDir, bundleSource);
     const bundles = [];
     for (const [i, entry] of parsed.bundles.entries()) {
-        const raw = entry;
-        const src = typeof raw.source === "string" ? raw.source : undefined;
-        if (!src) {
-            throw new Error(`Sync config ${absPath} bundles[${i}] missing required field: source`);
+        const rawBundle = entry;
+        const src = typeof rawBundle.source === "string" ? rawBundle.source : undefined;
+        const name = typeof rawBundle.name === "string" ? rawBundle.name : undefined;
+        const ver = typeof rawBundle.version === "string" ? rawBundle.version : undefined;
+        const sha256 = typeof rawBundle.sha256 === "string" ? rawBundle.sha256 : undefined;
+        let source;
+        if (src) {
+            // Explicit source: a URL stays as-is; a path is resolved against the
+            // config dir (absolute paths pass through).
+            source = isUrl(src) || isAbsolute(src) ? src : resolve(configDir, src);
+        }
+        else if (name && ver) {
+            if (resolvedBase === undefined) {
+                throw new Error(`Sync config ${absPath} bundles[${i}] uses name+version but no ` +
+                    `top-level "bundle_source" base is set to resolve it against.`);
+            }
+            const rel = `${name}/${name}-${ver}.tar.gz`;
+            source = isUrl(resolvedBase)
+                ? `${resolvedBase.replace(/\/$/, "")}/${rel}`
+                : resolve(resolvedBase, name, `${name}-${ver}.tar.gz`);
+        }
+        else {
+            throw new Error(`Sync config ${absPath} bundles[${i}] missing required field: source ` +
+                `(or a name+version pair resolved against bundle_source)`);
         }
-        const resolved = isAbsolute(src) ? src : resolve(configDir, src);
-        bundles.push({ source: resolved });
+        bundles.push(sha256 === undefined ? { source } : { source, sha256 });
     }
-    return { version, bundles };
+    return bundleSource === undefined
+        ? { version, bundles }
+        : { version, bundleSource, bundles };
 }
 //# sourceMappingURL=config.js.map

package/dist/lib/sync/config.js.map

@@ -1 +1 @@
-{"version":3,"file":"config.js","sourceRoot":"","sources":["../../../src/lib/sync/config.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AAC5C,OAAO,EAAE,OAAO,EAAE,UAAU,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACzD,OAAO,EAAE,KAAK,IAAI,SAAS,EAAE,MAAM,MAAM,CAAC;AA4C1C,MAAM,CAAC,KAAK,UAAU,cAAc,CAAC,UAAkB;IACrD,MAAM,OAAO,GAAG,UAAU,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC;IAC1E,IAAI,GAAW,CAAC;IAChB,IAAI,CAAC;QACH,GAAG,GAAG,MAAM,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;IACxC,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,IAAI,KAAK,CACb,2BAA2B,OAAO,KAAM,GAAa,CAAC,OAAO,EAAE,CAChE,CAAC;IACJ,CAAC;IACD,MAAM,MAAM,GAAG,SAAS,CAAC,GAAG,CAAc,CAAC;IAC3C,IAAI,MAAM,KAAK,IAAI,IAAI,OAAO,MAAM,KAAK,QAAQ,EAAE,CAAC;QAClD,MAAM,IAAI,KAAK,CAAC,eAAe,OAAO,uBAAuB,CAAC,CAAC;IACjE,CAAC;IAED,MAAM,OAAO,GACX,OAAO,MAAM,CAAC,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC;IAClE,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,MAAM,IAAI,KAAK,CAAC,eAAe,OAAO,kCAAkC,CAAC,CAAC;IAC5E,CAAC;IAED,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE,CAAC;QACnC,MAAM,IAAI,KAAK,CAAC,eAAe,OAAO,iCAAiC,CAAC,CAAC;IAC3E,CAAC;IACD,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAChC,MAAM,IAAI,KAAK,CAAC,eAAe,OAAO,oCAAoC,CAAC,CAAC;IAC9E,CAAC;IAED,MAAM,SAAS,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IACnC,MAAM,OAAO,GAAuB,EAAE,CAAC;IACvC,KAAK,MAAM,CAAC,CAAC,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,OAAO,EAAE,EAAE,CAAC;QAClD,MAAM,GAAG,GAAG,KAAkB,CAAC;QAC/B,MAAM,GAAG,GAAG,OAAO,GAAG,CAAC,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC;QACpE,IAAI,CAAC,GAAG,EAAE,CAAC;YACT,MAAM,IAAI,KAAK,CACb,eAAe,OAAO,YAAY,CAAC,kCAAkC,CACtE,CAAC;QACJ,CAAC;QACD,MAAM,QAAQ,GAAG,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,OAAO,CAAC,SAAS,EAAE,GAAG,CAAC,CAAC;QACjE,OAAO,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC,CAAC;IACrC,CAAC;IAED,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC;AAC9B,CAAC"}
+{"version":3,"file":"config.js","sourceRoot":"","sources":["../../../src/lib/sync/config.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AAC5C,OAAO,EAAE,OAAO,EAAE,UAAU,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACzD,OAAO,EAAE,KAAK,IAAI,SAAS,EAAE,MAAM,MAAM,CAAC;AA8E1C,SAAS,KAAK,CAAC,CAAS;IACtB,OAAO,eAAe,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AACjC,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,cAAc,CAAC,UAAkB;IACrD,MAAM,OAAO,GAAG,UAAU,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC;IAC1E,IAAI,GAAW,CAAC;IAChB,IAAI,CAAC;QACH,GAAG,GAAG,MAAM,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;IACxC,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,IAAI,KAAK,CACb,2BAA2B,OAAO,KAAM,GAAa,CAAC,OAAO,EAAE,CAChE,CAAC;IACJ,CAAC;IACD,MAAM,MAAM,GAAG,SAAS,CAAC,GAAG,CAAc,CAAC;IAC3C,IAAI,MAAM,KAAK,IAAI,IAAI,OAAO,MAAM,KAAK,QAAQ,EAAE,CAAC;QAClD,MAAM,IAAI,KAAK,CAAC,eAAe,OAAO,uBAAuB,CAAC,CAAC;IACjE,CAAC;IAED,MAAM,OAAO,GACX,OAAO,MAAM,CAAC,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC;IAClE,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,MAAM,IAAI,KAAK,CAAC,eAAe,OAAO,kCAAkC,CAAC,CAAC;IAC5E,CAAC;IAED,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE,CAAC;QACnC,MAAM,IAAI,KAAK,CAAC,eAAe,OAAO,iCAAiC,CAAC,CAAC;IAC3E,CAAC;IACD,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAChC,MAAM,IAAI,KAAK,CAAC,eAAe,OAAO,oCAAoC,CAAC,CAAC;IAC9E,CAAC;IAED,MAAM,SAAS,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IACnC,MAAM,YAAY,GAChB,OAAO,MAAM,CAAC,aAAa,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC,CAAC,SAAS,CAAC;IAE9E,uEAAuE;IACvE,uDAAuD;IACvD,MAAM,YAAY,GAChB,YAAY,KAAK,SAAS;QACxB,CAAC,CAAC,SAAS;QACX,CAAC,CAAC,KAAK,CAAC,YAAY,CAAC,IAAI,UAAU,CAAC,YAAY,CAAC;YAC/C,CAAC,CAAC,YAAY;YACd,CAAC,CAAC,OAAO,CAAC,SAAS,EAAE,YAAY,CAAC,CAAC;IAEzC,MAAM,OAAO,GAAuB,EAAE,CAAC;IACvC,KAAK,MAAM,CAAC,CAAC,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,OAAO,EAAE,EAAE,CAAC;QAClD,MAAM,SAAS,GAAG,KAAkB,CAAC;QACrC,MAAM,GAAG,GAAG,OAAO,SAAS,CAAC,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC;QAChF,MAAM,IAAI,GAAG,OAAO,SAAS,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC;QAC7E,MAAM,GAAG,GACP,OAAO,SAAS,CAAC,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC;QACxE,MAAM,MAAM,GACV,OAAO,SAAS,CAAC,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC;QAEtE,IAAI,MAAc,CAAC;QACnB,IAAI,GAAG,EAAE,CAAC;YACR,qEAAqE;YACrE,4CAA4C;YAC5C,MAAM,GAAG,KAAK,CAAC,GAAG,CAAC,IAAI,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,OAAO,CAAC,SAAS,EAAE,GAAG,CAAC,CAAC;QACzE,CAAC;aAAM,IAAI,IAAI,IAAI,GAAG,EAAE,CAAC;YACvB,IAAI,YAAY,KAAK,SAAS,EAAE,CAAC;gBAC/B,MAAM,IAAI,KAAK,CACb,eAAe,OAAO,YAAY,CAAC,6BAA6B;oBAC9D,8DAA8D,CACjE,CAAC;YACJ,CAAC;YACD,MAAM,GAAG,GAAG,GAAG,IAAI,IAAI,IAAI,IAAI,GAAG,SAAS,CAAC;YAC5C,MAAM,GAAG,KAAK,CAAC,YAAY,CAAC;gBAC1B,CAAC,CAAC,GAAG,YAAY,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,IAAI,GAAG,EAAE;gBAC7C,CAAC,CAAC,OAAO,CAAC,YAAY,EAAE,IAAI,EAAE,GAAG,IAAI,IAAI,GAAG,SAAS,CAAC,CAAC;QAC3D,CAAC;aAAM,CAAC;YACN,MAAM,IAAI,KAAK,CACb,eAAe,OAAO,YAAY,CAAC,mCAAmC;gBACpE,yDAAyD,CAC5D,CAAC;QACJ,CAAC;QAED,OAAO,CAAC,IAAI,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC;IACvE,CAAC;IAED,OAAO,YAAY,KAAK,SAAS;QAC/B,CAAC,CAAC,EAAE,OAAO,EAAE,OAAO,EAAE;QACtB,CAAC,CAAC,EAAE,OAAO,EAAE,YAAY,EAAE,OAAO,EAAE,CAAC;AACzC,CAAC"}

package/dist/verbs/pack.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"pack.d.ts","sourceRoot":"","sources":["../../src/verbs/pack.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAczC,wBAAgB,YAAY,CAAC,OAAO,EAAE,OAAO,GAAG,IAAI,CAsDnD"}
+{"version":3,"file":"pack.d.ts","sourceRoot":"","sources":["../../src/verbs/pack.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAgBzC,wBAAgB,YAAY,CAAC,OAAO,EAAE,OAAO,GAAG,IAAI,CAgEnD"}

package/dist/verbs/pack.js

@@ -10,6 +10,8 @@ export function registerPack(program) {
         .option("--producer-repo <dir>", "adopter repo root (managed_paths are resolved relative to this; defaults to cwd)", process.cwd())
         .option("--out-dir <dir>", "output directory for the tarball (defaults to <producer-repo>/dist/<pack-name>/)")
         .option("--forward-base-managed-paths <path>", "path to forward-base MANAGED_PATHS.txt for the leakage check (defaults to extracting from method-baseline.lock)")
+        .option("--publish-transform", "apply the point-in-time / producer-agnostic publish transform (ADR 0183/0184): drop non-Accepted ADRs, strip lineage + stripped-class fields, flatten cross-repo refs, fail closed on leaks. For producer-published bundles.")
+        .option("--origin-prefix", "with the publish transform, apply the range-aware origin prefix (ADR 0140 §4.1): 0NNN→M-ADR, 9NNN→RA-ADR, adopter 1NNN stays ADR; ADR files renamed to match. Implies --publish-transform. The RA-ADR bundle cutover switch.")
         .action(async (opts) => {
         const { exitCode } = await runPackBuild({
             seedPath: opts.seed,
@@ -18,6 +20,8 @@ export function registerPack(program) {
             ...(opts.forwardBaseManagedPaths && {
                 forwardBaseManagedPathsFile: opts.forwardBaseManagedPaths,
             }),
+            ...(opts.publishTransform && { publishTransform: true }),
+            ...(opts.originPrefix && { originPrefix: true }),
         });
         if (exitCode !== 0)
             process.exit(exitCode);

package/dist/verbs/pack.js.map

@@ -1 +1 @@
-{"version":3,"file":"pack.js","sourceRoot":"","sources":["../../src/verbs/pack.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,YAAY,EAAE,eAAe,EAAE,MAAM,sBAAsB,CAAC;AAarE,MAAM,UAAU,YAAY,CAAC,OAAgB;IAC3C,MAAM,IAAI,GAAG,OAAO;SACjB,OAAO,CAAC,MAAM,CAAC;SACf,WAAW,CACV,wEAAwE,CACzE,CAAC;IAEJ,IAAI;SACD,OAAO,CAAC,OAAO,CAAC;SAChB,WAAW,CACV,8FAA8F,CAC/F;SACA,cAAc,CACb,eAAe,EACf,qEAAqE,CACtE;SACA,MAAM,CACL,uBAAuB,EACvB,kFAAkF,EAClF,OAAO,CAAC,GAAG,EAAE,CACd;SACA,MAAM,CACL,iBAAiB,EACjB,kFAAkF,CACnF;SACA,MAAM,CACL,qCAAqC,EACrC,iHAAiH,CAClH;SACA,MAAM,CAAC,KAAK,EAAE,IAAkB,EAAE,EAAE;QACnC,MAAM,EAAE,QAAQ,EAAE,GAAG,MAAM,YAAY,CAAC;YACtC,QAAQ,EAAE,IAAI,CAAC,IAAI;YACnB,YAAY,EAAE,IAAI,CAAC,YAAY,IAAI,OAAO,CAAC,GAAG,EAAE;YAChD,GAAG,CAAC,IAAI,CAAC,MAAM,IAAI,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,CAAC;YAC3C,GAAG,CAAC,IAAI,CAAC,uBAAuB,IAAI;gBAClC,2BAA2B,EAAE,IAAI,CAAC,uBAAuB;aAC1D,CAAC;SACH,CAAC,CAAC;QACH,IAAI,QAAQ,KAAK,CAAC;YAAE,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IAC7C,CAAC,CAAC,CAAC;IAEL,IAAI;SACD,OAAO,CAAC,UAAU,CAAC;SACnB,WAAW,CACV,8FAA8F,CAC/F;SACA,cAAc,CACb,eAAe,EACf,qEAAqE,CACtE;SACA,MAAM,CAAC,KAAK,EAAE,IAAqB,EAAE,EAAE;QACtC,MAAM,EAAE,QAAQ,EAAE,GAAG,MAAM,eAAe,CAAC,EAAE,QAAQ,EAAE,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC;QACpE,IAAI,QAAQ,KAAK,CAAC;YAAE,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IAC7C,CAAC,CAAC,CAAC;AACP,CAAC"}
+{"version":3,"file":"pack.js","sourceRoot":"","sources":["../../src/verbs/pack.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,YAAY,EAAE,eAAe,EAAE,MAAM,sBAAsB,CAAC;AAerE,MAAM,UAAU,YAAY,CAAC,OAAgB;IAC3C,MAAM,IAAI,GAAG,OAAO;SACjB,OAAO,CAAC,MAAM,CAAC;SACf,WAAW,CACV,wEAAwE,CACzE,CAAC;IAEJ,IAAI;SACD,OAAO,CAAC,OAAO,CAAC;SAChB,WAAW,CACV,8FAA8F,CAC/F;SACA,cAAc,CACb,eAAe,EACf,qEAAqE,CACtE;SACA,MAAM,CACL,uBAAuB,EACvB,kFAAkF,EAClF,OAAO,CAAC,GAAG,EAAE,CACd;SACA,MAAM,CACL,iBAAiB,EACjB,kFAAkF,CACnF;SACA,MAAM,CACL,qCAAqC,EACrC,iHAAiH,CAClH;SACA,MAAM,CACL,qBAAqB,EACrB,8NAA8N,CAC/N;SACA,MAAM,CACL,iBAAiB,EACjB,8NAA8N,CAC/N;SACA,MAAM,CAAC,KAAK,EAAE,IAAkB,EAAE,EAAE;QACnC,MAAM,EAAE,QAAQ,EAAE,GAAG,MAAM,YAAY,CAAC;YACtC,QAAQ,EAAE,IAAI,CAAC,IAAI;YACnB,YAAY,EAAE,IAAI,CAAC,YAAY,IAAI,OAAO,CAAC,GAAG,EAAE;YAChD,GAAG,CAAC,IAAI,CAAC,MAAM,IAAI,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,CAAC;YAC3C,GAAG,CAAC,IAAI,CAAC,uBAAuB,IAAI;gBAClC,2BAA2B,EAAE,IAAI,CAAC,uBAAuB;aAC1D,CAAC;YACF,GAAG,CAAC,IAAI,CAAC,gBAAgB,IAAI,EAAE,gBAAgB,EAAE,IAAI,EAAE,CAAC;YACxD,GAAG,CAAC,IAAI,CAAC,YAAY,IAAI,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC;SACjD,CAAC,CAAC;QACH,IAAI,QAAQ,KAAK,CAAC;YAAE,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IAC7C,CAAC,CAAC,CAAC;IAEL,IAAI;SACD,OAAO,CAAC,UAAU,CAAC;SACnB,WAAW,CACV,8FAA8F,CAC/F;SACA,cAAc,CACb,eAAe,EACf,qEAAqE,CACtE;SACA,MAAM,CAAC,KAAK,EAAE,IAAqB,EAAE,EAAE;QACtC,MAAM,EAAE,QAAQ,EAAE,GAAG,MAAM,eAAe,CAAC,EAAE,QAAQ,EAAE,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC;QACpE,IAAI,QAAQ,KAAK,CAAC;YAAE,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IAC7C,CAAC,CAAC,CAAC;AACP,CAAC"}

package/dist/verbs/sync.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"sync.d.ts","sourceRoot":"","sources":["../../src/verbs/sync.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAkBzC,wBAAgB,YAAY,CAAC,OAAO,EAAE,OAAO,GAAG,IAAI,CA6EnD"}
+{"version":3,"file":"sync.d.ts","sourceRoot":"","sources":["../../src/verbs/sync.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAmBzC,wBAAgB,YAAY,CAAC,OAAO,EAAE,OAAO,GAAG,IAAI,CAwFnD"}

package/dist/verbs/sync.js

@@ -1,5 +1,6 @@
 import { AGENT_HARNESSES, resolveAgentHarness, } from "../lib/agent-harness.js";
 import { loadSyncConfig } from "../lib/sync/config.js";
+import { materialiseBundle } from "../lib/sync/bundle-source.js";
 import { runSync } from "../lib/sync/index.js";
 export function registerSync(program) {
     program
@@ -47,16 +48,27 @@ export function registerSync(program) {
         try {
             const config = await loadSyncConfig(opts.config);
             for (const entry of config.bundles) {
-                const { exitCode } = await runSync({
-                    bundle: entry.source,
-                    targetRepo: opts.targetRepo,
-                    dryRun: opts.dryRun === true,
-                    allowOverwrite: opts.allowOverwrite === true,
-                    delete: opts.delete,
-                    agentHarness,
-                });
-                if (exitCode !== 0)
-                    process.exit(exitCode);
+                // Resolve the entry to a verified local tarball (local path used
+                // in place; an internal-HTTPS source fetched to a temp file; the
+                // sha256 pin checked when present), then apply + release.
+                const resolved = await materialiseBundle(entry);
+                try {
+                    const { exitCode } = await runSync({
+                        bundle: resolved.localPath,
+                        targetRepo: opts.targetRepo,
+                        dryRun: opts.dryRun === true,
+                        allowOverwrite: opts.allowOverwrite === true,
+                        delete: opts.delete,
+                        agentHarness,
+                    });
+                    if (exitCode !== 0) {
+                        await resolved.cleanup();
+                        process.exit(exitCode);
+                    }
+                }
+                finally {
+                    await resolved.cleanup();
+                }
             }
         }
         catch (err) {

package/dist/verbs/sync.js.map

@@ -1 +1 @@
-{"version":3,"file":"sync.js","sourceRoot":"","sources":["../../src/verbs/sync.ts"],"names":[],"mappings":"AACA,OAAO,EACL,eAAe,EACf,mBAAmB,GACpB,MAAM,yBAAyB,CAAC;AACjC,OAAO,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAC;AACvD,OAAO,EAAE,OAAO,EAAE,MAAM,sBAAsB,CAAC;AAY/C,MAAM,UAAU,YAAY,CAAC,OAAgB;IAC3C,OAAO;SACJ,OAAO,CAAC,MAAM,CAAC;SACf,WAAW,CACV,yEAAyE,CAC1E;SACA,MAAM,CAAC,iBAAiB,EAAE,oEAAoE,CAAC;SAC/F,MAAM,CACL,iBAAiB,EACjB,0HAA0H,CAC3H;SACA,MAAM,CAAC,qBAAqB,EAAE,iBAAiB,EAAE,OAAO,CAAC,GAAG,EAAE,CAAC;SAC/D,MAAM,CAAC,WAAW,EAAE,wCAAwC,CAAC;SAC7D,MAAM,CACL,mBAAmB,EACnB,sDAAsD,CACvD;SACA,MAAM,CAAC,aAAa,EAAE,iCAAiC,CAAC;SACxD,MAAM,CACL,wBAAwB,EACxB,+EAA+E,eAAe,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAC5G;SACA,MAAM,CAAC,KAAK,EAAE,IAA0B,EAAE,EAAE;QAC3C,IAAI,YAAY,CAAC;QACjB,IAAI,CAAC;YACH,YAAY,GAAG,mBAAmB,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;QACxD,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,UAAW,GAAa,CAAC,OAAO,IAAI,CAAC,CAAC;YAC3D,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,CAAC;QAED,IAAI,IAAI,CAAC,MAAM,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC;YAC/B,OAAO,CAAC,MAAM,CAAC,KAAK,CAClB,uDAAuD,CACxD,CAAC;YACF,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,CAAC;QAED,4CAA4C;QAC5C,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC;YAChB,MAAM,EAAE,QAAQ,EAAE,GAAG,MAAM,OAAO,CAAC;gBACjC,MAAM,EAAE,IAAI,CAAC,MAAM;gBACnB,UAAU,EAAE,IAAI,CAAC,UAAU;gBAC3B,MAAM,EAAE,IAAI,CAAC,MAAM,KAAK,IAAI;gBAC5B,cAAc,EAAE,IAAI,CAAC,cAAc,KAAK,IAAI;gBAC5C,MAAM,EAAE,IAAI,CAAC,MAAM;gBACnB,YAAY;aACb,CAAC,CAAC;YACH,IAAI,QAAQ,KAAK,CAAC;gBAAE,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;YAC3C,OAAO;QACT,CAAC;QAED,kCAAkC;QAClC,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC;YACjB,OAAO,CAAC,MAAM,CAAC,KAAK,CAClB,kDAAkD,CACnD,CAAC;YACF,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,CAAC;QACD,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,MAAM,cAAc,CAAC,IAAI,CAAC,MAAO,CAAC,CAAC;YAClD,KAAK,MAAM,KAAK,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC;gBACnC,MAAM,EAAE,QAAQ,EAAE,GAAG,MAAM,OAAO,CAAC;oBACjC,MAAM,EAAE,KAAK,CAAC,MAAM;oBACpB,UAAU,EAAE,IAAI,CAAC,UAAU;oBAC3B,MAAM,EAAE,IAAI,CAAC,MAAM,KAAK,IAAI;oBAC5B,cAAc,EAAE,IAAI,CAAC,cAAc,KAAK,IAAI;oBAC5C,MAAM,EAAE,IAAI,CAAC,MAAM;oBACnB,YAAY;iBACb,CAAC,CAAC;gBACH,IAAI,QAAQ,KAAK,CAAC;oBAAE,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;YAC7C,CAAC;QACH,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,UAAW,GAAa,CAAC,OAAO,IAAI,CAAC,CAAC;YAC3D,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,CAAC;IACH,CAAC,CAAC,CAAC;AACP,CAAC"}
+{"version":3,"file":"sync.js","sourceRoot":"","sources":["../../src/verbs/sync.ts"],"names":[],"mappings":"AACA,OAAO,EACL,eAAe,EACf,mBAAmB,GACpB,MAAM,yBAAyB,CAAC;AACjC,OAAO,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAC;AACvD,OAAO,EAAE,iBAAiB,EAAE,MAAM,8BAA8B,CAAC;AACjE,OAAO,EAAE,OAAO,EAAE,MAAM,sBAAsB,CAAC;AAY/C,MAAM,UAAU,YAAY,CAAC,OAAgB;IAC3C,OAAO;SACJ,OAAO,CAAC,MAAM,CAAC;SACf,WAAW,CACV,yEAAyE,CAC1E;SACA,MAAM,CAAC,iBAAiB,EAAE,oEAAoE,CAAC;SAC/F,MAAM,CACL,iBAAiB,EACjB,0HAA0H,CAC3H;SACA,MAAM,CAAC,qBAAqB,EAAE,iBAAiB,EAAE,OAAO,CAAC,GAAG,EAAE,CAAC;SAC/D,MAAM,CAAC,WAAW,EAAE,wCAAwC,CAAC;SAC7D,MAAM,CACL,mBAAmB,EACnB,sDAAsD,CACvD;SACA,MAAM,CAAC,aAAa,EAAE,iCAAiC,CAAC;SACxD,MAAM,CACL,wBAAwB,EACxB,+EAA+E,eAAe,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAC5G;SACA,MAAM,CAAC,KAAK,EAAE,IAA0B,EAAE,EAAE;QAC3C,IAAI,YAAY,CAAC;QACjB,IAAI,CAAC;YACH,YAAY,GAAG,mBAAmB,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;QACxD,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,UAAW,GAAa,CAAC,OAAO,IAAI,CAAC,CAAC;YAC3D,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,CAAC;QAED,IAAI,IAAI,CAAC,MAAM,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC;YAC/B,OAAO,CAAC,MAAM,CAAC,KAAK,CAClB,uDAAuD,CACxD,CAAC;YACF,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,CAAC;QAED,4CAA4C;QAC5C,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC;YAChB,MAAM,EAAE,QAAQ,EAAE,GAAG,MAAM,OAAO,CAAC;gBACjC,MAAM,EAAE,IAAI,CAAC,MAAM;gBACnB,UAAU,EAAE,IAAI,CAAC,UAAU;gBAC3B,MAAM,EAAE,IAAI,CAAC,MAAM,KAAK,IAAI;gBAC5B,cAAc,EAAE,IAAI,CAAC,cAAc,KAAK,IAAI;gBAC5C,MAAM,EAAE,IAAI,CAAC,MAAM;gBACnB,YAAY;aACb,CAAC,CAAC;YACH,IAAI,QAAQ,KAAK,CAAC;gBAAE,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;YAC3C,OAAO;QACT,CAAC;QAED,kCAAkC;QAClC,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC;YACjB,OAAO,CAAC,MAAM,CAAC,KAAK,CAClB,kDAAkD,CACnD,CAAC;YACF,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,CAAC;QACD,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,MAAM,cAAc,CAAC,IAAI,CAAC,MAAO,CAAC,CAAC;YAClD,KAAK,MAAM,KAAK,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC;gBACnC,iEAAiE;gBACjE,iEAAiE;gBACjE,0DAA0D;gBAC1D,MAAM,QAAQ,GAAG,MAAM,iBAAiB,CAAC,KAAK,CAAC,CAAC;gBAChD,IAAI,CAAC;oBACH,MAAM,EAAE,QAAQ,EAAE,GAAG,MAAM,OAAO,CAAC;wBACjC,MAAM,EAAE,QAAQ,CAAC,SAAS;wBAC1B,UAAU,EAAE,IAAI,CAAC,UAAU;wBAC3B,MAAM,EAAE,IAAI,CAAC,MAAM,KAAK,IAAI;wBAC5B,cAAc,EAAE,IAAI,CAAC,cAAc,KAAK,IAAI;wBAC5C,MAAM,EAAE,IAAI,CAAC,MAAM;wBACnB,YAAY;qBACb,CAAC,CAAC;oBACH,IAAI,QAAQ,KAAK,CAAC,EAAE,CAAC;wBACnB,MAAM,QAAQ,CAAC,OAAO,EAAE,CAAC;wBACzB,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;oBACzB,CAAC;gBACH,CAAC;wBAAS,CAAC;oBACT,MAAM,QAAQ,CAAC,OAAO,EAAE,CAAC;gBAC3B,CAAC;YACH,CAAC;QACH,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,UAAW,GAAa,CAAC,OAAO,IAAI,CAAC,CAAC;YAC3D,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,CAAC;IACH,CAAC,CAAC,CAAC;AACP,CAAC"}