@shrkcrft/inspector 0.1.0-alpha.21 → 0.1.0-alpha.23

package/dist/onboarding.js

@@ -11,7 +11,6 @@ export function buildOnboardingPlan(inspection, options = {}) {
     const subDirs = listSubDirs(ws.projectRoot);
     const inferredPathConventions = inferPathConventions(ws, subDirs);
     const inferredVerificationCommands = inferVerificationCommands(ws);
-    const inferredBoundaryRules = inferBoundaryRules(ws, subDirs);
     const inferredTemplateCandidates = inferTemplateCandidates(ws, {
         scaffoldTemplates: options.scaffoldTemplates === true,
     });
@@ -19,6 +18,12 @@ export function buildOnboardingPlan(inspection, options = {}) {
     const inferredPipelines = inferPipelines(ws, inferredVerificationCommands);
     const detectedInstructionFiles = detectInstructionFiles(ws.projectRoot);
     const monorepoSummary = buildMonorepoSummary(ws, subDirs);
+    // Boundary rules: the non-monorepo guess intentionally returns [] (SharkCraft
+    // does not invent boundaries from folder structure). Monorepo layouts, by
+    // contrast, surface real enforceable candidates (e.g. packages/* must not
+    // import apps/*) — merge them in so they reach the boundaries draft and
+    // `init --infer`.
+    const inferredBoundaryRules = mergeMonorepoBoundaryRules(inferBoundaryRules(ws, subDirs), monorepoSummary);
     // RecommendPresets now applies a miss penalty (-3 per missing
     // appliesTo profile), so a preferred preset that previously ranked just
     // inside the top 5 can drop out on minor profile changes. Use a wider
@@ -221,11 +226,40 @@ function packageManagerRunPrefix(manager) {
 }
 // ─── Boundary rule candidates ────────────────────────────────────────────────
 export function inferBoundaryRules(_ws, _subDirs) {
-    // SharkCraft does not guess your boundary rules. Author them
-    // explicitly in `sharkcraft/boundaries.ts` once the repo's actual
-    // import directions are known.
+    // SharkCraft does not guess your boundary rules from folder structure.
+    // Author them explicitly in `sharkcraft/boundaries.ts` once the repo's
+    // actual import directions are known. Monorepo-derived candidates are
+    // merged in separately via `mergeMonorepoBoundaryRules`.
     return [];
 }
+/**
+ * Merge the monorepo summary's computed boundary candidates into the
+ * inferred boundary-rule list. These candidates are derived from the actual
+ * workspace layout (apps / packages / libs), so they are enforceable and
+ * should reach the boundaries draft + `init --infer`. Deduped by id;
+ * existing entries win.
+ */
+function mergeMonorepoBoundaryRules(base, monorepoSummary) {
+    const out = [...base];
+    if (!monorepoSummary)
+        return out;
+    const seen = new Set(out.map((b) => b.id));
+    for (const c of monorepoSummary.boundaryCandidates) {
+        if (seen.has(c.id))
+            continue;
+        seen.add(c.id);
+        out.push({
+            id: c.id,
+            title: c.title,
+            severity: 'warning',
+            from: c.from,
+            forbiddenImports: c.forbiddenImports,
+            suggestedFix: `Author this boundary in sharkcraft/boundaries.ts: ${c.from.join(', ')} must not import ${c.forbiddenImports.join(', ')}.`,
+            reason: c.reason,
+        });
+    }
+    return out;
+}
 const TEMPLATE_PATTERNS = [
     {
         id: 'inferred.service',
@@ -319,21 +353,48 @@ export function inferRules(ws) {
             reason: evidence,
         });
     }
-    // TypeScript.
+    // TypeScript. Resolve strict as a tri-state: confirmed-on, confirmed-off,
+    // or unknown (the tsconfig extends a base we cannot resolve — e.g. an npm
+    // package — so we must NOT assert that strict is off and bake a wrong rule).
     if (ws.hasTypeScript) {
-        const strict = !!ws.tsConfig?.strict;
-        out.push({
-            id: 'typescript.strict-mode',
-            title: strict
-                ? 'TypeScript strict mode enabled'
-                : 'Enable TypeScript strict mode',
-            content: strict
-                ? 'TypeScript strict mode is enabled. Keep it that way — do not weaken `strict` to land code.'
-                : 'TypeScript strict mode is OFF. Turning it on is a one-line tsconfig change and significantly improves type safety. Plan a separate task for the cleanup.',
-            priority: strict ? 'high' : 'medium',
-            source: 'tsconfig',
-            reason: `tsconfig strict=${strict}`,
-        });
+        const ts = ws.tsConfig;
+        const strictState = ts && ts.strictResolvable
+            ? ts.strict === true
+                ? 'on'
+                : 'off'
+            : 'unknown';
+        if (strictState === 'on') {
+            out.push({
+                id: 'typescript.strict-mode',
+                title: 'TypeScript strict mode enabled',
+                content: 'TypeScript strict mode is enabled. Keep it that way — do not weaken `strict` to land code.',
+                priority: 'high',
+                source: 'tsconfig',
+                reason: 'tsconfig strict=true',
+            });
+        }
+        else if (strictState === 'off') {
+            out.push({
+                id: 'typescript.strict-mode',
+                title: 'Enable TypeScript strict mode',
+                content: 'TypeScript strict mode is OFF. Turning it on is a one-line tsconfig change and significantly improves type safety. Plan a separate task for the cleanup.',
+                priority: 'medium',
+                source: 'tsconfig',
+                reason: 'tsconfig strict=false',
+            });
+        }
+        else {
+            // Unknown: advisory only — do NOT emit the imperative "turn it on"
+            // rule (low priority keeps it out of high-confidence auto-adoption).
+            out.push({
+                id: 'typescript.strict-mode-unconfirmed',
+                title: 'Could not confirm TypeScript strict mode — verify manually',
+                content: 'TypeScript `strict` is not set directly and the extended base config could not be resolved (it may be an npm package such as `@tsconfig/strictest`). Confirm whether strict is enabled before relying on it; do not assume it is off.',
+                priority: 'low',
+                source: 'tsconfig',
+                reason: 'tsconfig strict unresolved (extends a non-relative / missing base)',
+            });
+        }
     }
     // Test runner.
     if (ws.profiles.includes(WorkspaceProfile.HasBunTest)) {

package/dist/pack-doctor.d.ts

@@ -3,7 +3,7 @@ import { type IPackReleaseCheck } from './pack-release-check.js';
 export interface IPackDoctorIssue {
     severity: 'error' | 'warning' | 'info';
     packageName: string;
-    code: 'invalid-manifest' | 'missing-contribution-file' | 'empty-resolved-contributions' | 'duplicate-id-local' | 'duplicate-id-pack-internal' | 'template-no-description' | 'pipeline-no-steps' | 'critical-rule-no-hints' | 'docs-file-missing' | 'unsigned-pack' | 'tampered-pack' | 'preset-composition-cycle' | 'preset-composed-not-found' | 'preset-missing-ref' | 'preset-no-includes' | 'release-manifest-issue' | 'release-contribution-issue' | 'release-signature-issue' | 'release-files-issue' | 'release-readiness-issue';
+    code: 'invalid-manifest' | 'missing-contribution-file' | 'empty-resolved-contributions' | 'duplicate-id-local' | 'duplicate-id-pack-internal' | 'template-no-description' | 'pipeline-no-steps' | 'critical-rule-no-hints' | 'docs-file-missing' | 'unsigned-pack' | 'tampered-pack' | 'signature-unverifiable' | 'dev-signature-not-trusted' | 'preset-composition-cycle' | 'preset-composed-not-found' | 'preset-missing-ref' | 'preset-no-includes' | 'pack-verification-pm-mismatch' | 'release-manifest-issue' | 'release-contribution-issue' | 'release-signature-issue' | 'release-files-issue' | 'release-readiness-issue';
     message: string;
     /** Free-form suggestion. */
     suggestion?: string;
@@ -25,6 +25,13 @@ export interface IPackDoctorReport {
 export interface IPackDoctorOptions {
     /** When true, unsigned packs surface as `unsigned-pack` warnings. */
     requireSignatures?: boolean;
+    /**
+     * Opt in to trusting dev signatures. By default a dev-signed pack fails
+     * `--require-signatures` with `dev-signature-not-trusted`; when true, dev
+     * signatures are re-verified against the well-known dev secret and accepted
+     * (a tampered dev signature still surfaces as `tampered-pack`).
+     */
+    allowDevSignatures?: boolean;
     /** When true, also run pack-release-check per pack and fold findings into issues. */
     release?: boolean;
     /** When true, release-check warnings escalate to errors. */

package/dist/pack-doctor.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"pack-doctor.d.ts","sourceRoot":"","sources":["../src/pack-doctor.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,2BAA2B,CAAC;AAIvE,OAAO,EAAuB,KAAK,iBAAiB,EAAE,MAAM,yBAAyB,CAAC;AAEtF,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,EAAE,OAAO,GAAG,SAAS,GAAG,MAAM,CAAC;IACvC,WAAW,EAAE,MAAM,CAAC;IACpB,IAAI,EACA,kBAAkB,GAClB,2BAA2B,GAC3B,8BAA8B,GAC9B,oBAAoB,GACpB,4BAA4B,GAC5B,yBAAyB,GACzB,mBAAmB,GACnB,wBAAwB,GACxB,mBAAmB,GACnB,eAAe,GACf,eAAe,GACf,0BAA0B,GAC1B,2BAA2B,GAC3B,oBAAoB,GACpB,oBAAoB,GACpB,wBAAwB,GACxB,4BAA4B,GAC5B,yBAAyB,GACzB,qBAAqB,GACrB,yBAAyB,CAAC;IAC9B,OAAO,EAAE,MAAM,CAAC;IAChB,4BAA4B;IAC5B,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,oEAAoE;IACpE,gBAAgB,CAAC,EAAE,MAAM,CAAC;CAC3B;AAED,MAAM,WAAW,iBAAiB;IAChC,MAAM,EAAE,OAAO,CAAC;IAChB,YAAY,EAAE,MAAM,CAAC;IACrB,MAAM,EAAE,gBAAgB,EAAE,CAAC;IAC3B,OAAO,EAAE;QACP,MAAM,EAAE,MAAM,CAAC;QACf,QAAQ,EAAE,MAAM,CAAC;QACjB,IAAI,EAAE,MAAM,CAAC;KACd,CAAC;IACF,qFAAqF;IACrF,aAAa,CAAC,EAAE,SAAS,iBAAiB,EAAE,CAAC;CAC9C;AAED,MAAM,WAAW,kBAAkB;IACjC,qEAAqE;IACrE,iBAAiB,CAAC,EAAE,OAAO,CAAC;IAC5B,qFAAqF;IACrF,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,4DAA4D;IAC5D,MAAM,CAAC,EAAE,OAAO,CAAC;CAClB;AAeD;;;;;;;GAOG;AACH,wBAAgB,qBAAqB,CACnC,UAAU,EAAE,qBAAqB,EACjC,OAAO,GAAE,kBAAuB,GAC/B,iBAAiB,CAqNnB;AAgBD;wEACwE;AACxE,wBAAsB,6BAA6B,CACjD,UAAU,EAAE,qBAAqB,GAChC,OAAO,CAAC,iBAAiB,EAAE,CAAC,CAa9B;AAED;8CAC8C;AAC9C,wBAAgB,sBAAsB,CACpC,UAAU,EAAE,qBAAqB,EACjC,MAAM,EAAE,iBAAiB,EACzB,aAAa,EAAE,SAAS,iBAAiB,EAAE,EAC3C,OAAO,GAAE;IAAE,MAAM,CAAC,EAAE,OAAO,CAAA;CAAO,GACjC,iBAAiB,CAoCnB"}
+{"version":3,"file":"pack-doctor.d.ts","sourceRoot":"","sources":["../src/pack-doctor.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,2BAA2B,CAAC;AAWvE,OAAO,EAAuB,KAAK,iBAAiB,EAAE,MAAM,yBAAyB,CAAC;AAEtF,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,EAAE,OAAO,GAAG,SAAS,GAAG,MAAM,CAAC;IACvC,WAAW,EAAE,MAAM,CAAC;IACpB,IAAI,EACA,kBAAkB,GAClB,2BAA2B,GAC3B,8BAA8B,GAC9B,oBAAoB,GACpB,4BAA4B,GAC5B,yBAAyB,GACzB,mBAAmB,GACnB,wBAAwB,GACxB,mBAAmB,GACnB,eAAe,GACf,eAAe,GACf,wBAAwB,GACxB,2BAA2B,GAC3B,0BAA0B,GAC1B,2BAA2B,GAC3B,oBAAoB,GACpB,oBAAoB,GACpB,+BAA+B,GAC/B,wBAAwB,GACxB,4BAA4B,GAC5B,yBAAyB,GACzB,qBAAqB,GACrB,yBAAyB,CAAC;IAC9B,OAAO,EAAE,MAAM,CAAC;IAChB,4BAA4B;IAC5B,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,oEAAoE;IACpE,gBAAgB,CAAC,EAAE,MAAM,CAAC;CAC3B;AAED,MAAM,WAAW,iBAAiB;IAChC,MAAM,EAAE,OAAO,CAAC;IAChB,YAAY,EAAE,MAAM,CAAC;IACrB,MAAM,EAAE,gBAAgB,EAAE,CAAC;IAC3B,OAAO,EAAE;QACP,MAAM,EAAE,MAAM,CAAC;QACf,QAAQ,EAAE,MAAM,CAAC;QACjB,IAAI,EAAE,MAAM,CAAC;KACd,CAAC;IACF,qFAAqF;IACrF,aAAa,CAAC,EAAE,SAAS,iBAAiB,EAAE,CAAC;CAC9C;AAED,MAAM,WAAW,kBAAkB;IACjC,qEAAqE;IACrE,iBAAiB,CAAC,EAAE,OAAO,CAAC;IAC5B;;;;;OAKG;IACH,kBAAkB,CAAC,EAAE,OAAO,CAAC;IAC7B,qFAAqF;IACrF,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,4DAA4D;IAC5D,MAAM,CAAC,EAAE,OAAO,CAAC;CAClB;AAmED;;;;;;;GAOG;AACH,wBAAgB,qBAAqB,CACnC,UAAU,EAAE,qBAAqB,EACjC,OAAO,GAAE,kBAAuB,GAC/B,iBAAiB,CAoRnB;AAgBD;wEACwE;AACxE,wBAAsB,6BAA6B,CACjD,UAAU,EAAE,qBAAqB,GAChC,OAAO,CAAC,iBAAiB,EAAE,CAAC,CAa9B;AAED;8CAC8C;AAC9C,wBAAgB,sBAAsB,CACpC,UAAU,EAAE,qBAAqB,EACjC,MAAM,EAAE,iBAAiB,EACzB,aAAa,EAAE,SAAS,iBAAiB,EAAE,EAC3C,OAAO,GAAE;IAAE,MAAM,CAAC,EAAE,OAAO,CAAA;CAAO,GACjC,iBAAiB,CAoCnB"}

package/dist/pack-doctor.js

@@ -1,5 +1,8 @@
 import { hasActionHints } from '@shrkcrft/knowledge';
+import { PackageManager, WorkspaceProfile, } from '@shrkcrft/workspace';
+import { PipelineStepType } from '@shrkcrft/pipelines';
 import { resolvePreset, resolvePresetReferences } from '@shrkcrft/presets';
+import { PACK_SECRET_ENV, verifyPackManifest } from '@shrkcrft/plugin-api';
 import { inspectionReferenceLookup } from "./reference-lookup.js";
 import { runPackReleaseCheck } from "./pack-release-check.js";
 const GEN_KEYWORDS = ['generate', 'create', 'add', 'refactor', 'test', 'review'];
@@ -15,6 +18,52 @@ function isCriticalOrHigh(e) {
     const p = String(e.priority);
     return p === 'critical' || p === 'high';
 }
+/** A leading package-manager / runner literal a pack verification command may
+ *  bake in. Order longest-first is not required — these tokens are disjoint. */
+const PM_LITERAL_MANAGERS = [
+    ['bun ', PackageManager.Bun],
+    ['pnpm ', PackageManager.Pnpm],
+    ['yarn ', PackageManager.Yarn],
+    ['npm ', PackageManager.Npm],
+];
+/** The package manager a command hard-codes as its leading runner, or null when
+ *  it uses none (e.g. `make test`, a `<pm-run> test` placeholder, `shrk ...`). */
+function literalPackageManager(command) {
+    const c = command.trim();
+    for (const [literal, manager] of PM_LITERAL_MANAGERS) {
+        if (c.startsWith(literal))
+            return manager;
+    }
+    return null;
+}
+/** The project's detected package manager (concrete only). Returns Unknown when
+ *  no lockfile / packageManager field / bun profile signal is present — in that
+ *  case we cannot claim a mismatch, so the lint stays silent. */
+function detectedProjectManager(ws) {
+    const m = ws?.packageManager?.manager;
+    if (m && m !== PackageManager.Unknown)
+        return m;
+    if (ws?.profiles?.includes(WorkspaceProfile.HasBun))
+        return PackageManager.Bun;
+    return PackageManager.Unknown;
+}
+/** Push a warning when `command` bakes in a runner that disagrees with the
+ *  project's detected toolchain. No-op when the command is templated, runner-
+ *  agnostic, or already agrees with the detected manager. */
+function pushPmMismatch(issues, packageName, origin, command, detected) {
+    if (detected === PackageManager.Unknown)
+        return;
+    const literal = literalPackageManager(command);
+    if (!literal || literal === detected)
+        return;
+    issues.push({
+        severity: 'warning',
+        packageName,
+        code: 'pack-verification-pm-mismatch',
+        message: `Verification command in ${origin} hard-codes \`${literal}\` but this project uses \`${detected}\`: "${command}".`,
+        suggestion: 'Use the `<pm-run>`/`<pm>` placeholder (resolved to the detected package manager at consume time) instead of a hard-coded runner.',
+    });
+}
 /**
  * Full structural + quality audit of every discovered pack. Returns a list of
  * issues (error / warning / info) plus an aggregated pass flag.
@@ -28,6 +77,7 @@ export function buildPackDoctorReport(inspection, options = {}) {
     const localKnowledgeIds = new Set(inspection.knowledgeEntries
         .filter((e) => inspection.entrySources.get(e.id)?.type === 'local')
         .map((e) => e.id));
+    const detectedPm = detectedProjectManager(inspection.workspace);
     for (const pack of inspection.packs.invalidPacks) {
         issues.push({
             severity: 'error',
@@ -116,6 +166,30 @@ export function buildPackDoctorReport(inspection, options = {}) {
                 });
             }
         }
+        // Verification commands that bake in a *foreign* package manager / runner.
+        // A pack playbook that ships `bun test` contradicts an npm/pnpm/yarn target;
+        // prefer the `<pm-run>`/`<pm>` placeholder. Warning, never a hard fail.
+        for (const entry of inspection.knowledgeEntries) {
+            const src = inspection.entrySources.get(entry.id);
+            if (src?.type !== 'pack' || src.packageName !== pack.packageName)
+                continue;
+            const hints = entry.actionHints;
+            for (const cmd of hints?.verificationCommands ?? []) {
+                pushPmMismatch(issues, pack.packageName, `knowledge "${entry.id}"`, cmd, detectedPm);
+            }
+        }
+        for (const p of inspection.pipelines) {
+            const src = inspection.pipelineSources.get(p.id);
+            if (src?.type !== 'pack' || src.packageName !== pack.packageName)
+                continue;
+            for (const step of p.steps ?? []) {
+                if (step.type !== PipelineStepType.Command)
+                    continue;
+                for (const cmd of step.cliCommands ?? []) {
+                    pushPmMismatch(issues, pack.packageName, `pipeline "${p.id}" step "${step.id}"`, cmd, detectedPm);
+                }
+            }
+        }
         // Local-vs-pack duplicate ids.
         for (const entry of inspection.knowledgeEntries) {
             const src = inspection.entrySources.get(entry.id);
@@ -131,9 +205,18 @@ export function buildPackDoctorReport(inspection, options = {}) {
             }
         }
         // Signature gating.
+        //
+        // The inspector verifies with dev signatures DISALLOWED, so a dev-signed
+        // pack arrives here as `dev-signature`. With --allow-dev-signature we
+        // re-run the HMAC against the well-known dev secret so a *tampered* dev
+        // signature still surfaces as invalid rather than being blindly trusted.
+        let sigStatus = pack.signatureStatus;
+        if (sigStatus === 'dev-signature' && options.allowDevSignatures && pack.manifest) {
+            const v = verifyPackManifest(pack.manifest, { allowDev: true });
+            sigStatus = v.ok ? 'verified' : v.status;
+        }
         if (options.requireSignatures) {
-            const status = pack.signatureStatus;
-            if (!status || status === 'missing-signature' || status === 'not-checked') {
+            if (!sigStatus || sigStatus === 'missing-signature' || sigStatus === 'not-checked') {
                 issues.push({
                     severity: 'warning',
                     packageName: pack.packageName,
@@ -142,8 +225,32 @@ export function buildPackDoctorReport(inspection, options = {}) {
                     suggestion: 'Run `shrk packs sign <pack-dir>` and ship the signed manifest.',
                 });
             }
+            else if (sigStatus === 'missing-secret') {
+                // S3-2: required verification that COULD NOT RUN is a failure, not a
+                // pass. A signed pack whose secret is unavailable is unverifiable —
+                // never report it as OK.
+                issues.push({
+                    severity: 'error',
+                    packageName: pack.packageName,
+                    code: 'signature-unverifiable',
+                    message: `Pack is signed but ${PACK_SECRET_ENV} is not set, so the signature could not be verified — required verification failed.`,
+                    suggestion: `Set ${PACK_SECRET_ENV} (or pass --secret) and re-run with --require-signatures.`,
+                    suggestedCommand: `${PACK_SECRET_ENV}=<secret> shrk packs doctor --require-signatures`,
+                });
+            }
+            else if (sigStatus === 'dev-signature') {
+                // S3-1: a dev signature is verified only against the public dev secret
+                // and is NOT release-trusted; under --require-signatures it must fail.
+                issues.push({
+                    severity: 'error',
+                    packageName: pack.packageName,
+                    code: 'dev-signature-not-trusted',
+                    message: 'Pack carries a dev signature (not release-trusted) and --require-signatures was set.',
+                    suggestion: 'Re-sign with the release secret (`shrk packs sign <pack-dir>`), or pass --allow-dev-signature to accept dev signatures for local-only flows.',
+                });
+            }
         }
-        if (pack.signatureStatus === 'invalid-signature') {
+        if (sigStatus === 'invalid-signature') {
             issues.push({
                 severity: 'error',
                 packageName: pack.packageName,

package/dist/pack-quality-score.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"pack-quality-score.d.ts","sourceRoot":"","sources":["../src/pack-quality-score.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,iBAAiB,CAAC;AACvD,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,2BAA2B,CAAC;AAIvE,eAAO,MAAM,mBAAmB,qCAAqC,CAAC;AACtE,eAAO,MAAM,wBAAwB,oCAAoC,CAAC;AAE1E,MAAM,WAAW,gBAAgB;IAC/B,MAAM,EAAE,OAAO,wBAAwB,CAAC;IACxC,WAAW,EAAE,MAAM,CAAC;IACpB,UAAU,EAAE,MAAM,CAAC;IACnB,UAAU,EAAE,MAAM,CAAC;IACnB,KAAK,EAAE,MAAM,CAAC;IACd,eAAe,EAAE,SAAS;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,EAAE,CAAC;IAC9F,KAAK,EAAE,SAAS,MAAM,EAAE,CAAC;IACzB,OAAO,EAAE,SAAS,MAAM,EAAE,CAAC;IAC3B,eAAe,CAAC,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,EAAE,EAAE,MAAM,CAAA;KAAE,CAAC;CAChD;AAED,wBAAgB,eAAe,CAC7B,QAAQ,EAAE,iBAAiB,EAC3B,QAAQ,EAAE,iBAAiB,GAC1B,gBAAgB,CA2BlB;AAED,MAAM,WAAW,qBAAqB;IACpC,EAAE,EAAE,MAAM,CAAC;IACX,KAAK,EAAE,MAAM,CAAC;IACd,aAAa;IACb,KAAK,EAAE,MAAM,CAAC;IACd,MAAM,EAAE,MAAM,CAAC;IACf,KAAK,EAAE,SAAS,MAAM,EAAE,CAAC;CAC1B;AAED,MAAM,WAAW,iBAAiB;IAChC,MAAM,EAAE,OAAO,mBAAmB,CAAC;IACnC,WAAW,EAAE,MAAM,CAAC;IACpB,cAAc,EAAE,MAAM,CAAC;IACvB,sCAAsC;IACtC,OAAO,EAAE,MAAM,CAAC;IAChB,UAAU,EAAE,SAAS,qBAAqB,EAAE,CAAC;IAC7C,QAAQ,EAAE,SAAS,MAAM,EAAE,CAAC;CAC7B;AAMD,wBAAgB,SAAS,CACvB,UAAU,EAAE,qBAAqB,EACjC,IAAI,EAAE,eAAe,GACpB,iBAAiB,CAmInB;AAED,wBAAgB,aAAa,CAAC,UAAU,EAAE,qBAAqB,GAAG,iBAAiB,EAAE,CAEpF"}
+{"version":3,"file":"pack-quality-score.d.ts","sourceRoot":"","sources":["../src/pack-quality-score.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,iBAAiB,CAAC;AACvD,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,2BAA2B,CAAC;AAIvE,eAAO,MAAM,mBAAmB,qCAAqC,CAAC;AACtE,eAAO,MAAM,wBAAwB,oCAAoC,CAAC;AAE1E,MAAM,WAAW,gBAAgB;IAC/B,MAAM,EAAE,OAAO,wBAAwB,CAAC;IACxC,WAAW,EAAE,MAAM,CAAC;IACpB,UAAU,EAAE,MAAM,CAAC;IACnB,UAAU,EAAE,MAAM,CAAC;IACnB,KAAK,EAAE,MAAM,CAAC;IACd,eAAe,EAAE,SAAS;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,EAAE,CAAC;IAC9F,KAAK,EAAE,SAAS,MAAM,EAAE,CAAC;IACzB,OAAO,EAAE,SAAS,MAAM,EAAE,CAAC;IAC3B,eAAe,CAAC,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,EAAE,EAAE,MAAM,CAAA;KAAE,CAAC;CAChD;AAED,wBAAgB,eAAe,CAC7B,QAAQ,EAAE,iBAAiB,EAC3B,QAAQ,EAAE,iBAAiB,GAC1B,gBAAgB,CA2BlB;AAED,MAAM,WAAW,qBAAqB;IACpC,EAAE,EAAE,MAAM,CAAC;IACX,KAAK,EAAE,MAAM,CAAC;IACd,aAAa;IACb,KAAK,EAAE,MAAM,CAAC;IACd,MAAM,EAAE,MAAM,CAAC;IACf,KAAK,EAAE,SAAS,MAAM,EAAE,CAAC;CAC1B;AAED,MAAM,WAAW,iBAAiB;IAChC,MAAM,EAAE,OAAO,mBAAmB,CAAC;IACnC,WAAW,EAAE,MAAM,CAAC;IACpB,cAAc,EAAE,MAAM,CAAC;IACvB,sCAAsC;IACtC,OAAO,EAAE,MAAM,CAAC;IAChB,UAAU,EAAE,SAAS,qBAAqB,EAAE,CAAC;IAC7C,QAAQ,EAAE,SAAS,MAAM,EAAE,CAAC;CAC7B;AAMD,wBAAgB,SAAS,CACvB,UAAU,EAAE,qBAAqB,EACjC,IAAI,EAAE,eAAe,GACpB,iBAAiB,CAmInB;AAED,wBAAgB,aAAa,CAAC,UAAU,EAAE,qBAAqB,GAAG,iBAAiB,EAAE,CAEpF"}

package/dist/pack-quality-score.js

@@ -1,3 +1,4 @@
+import { CONTRIBUTION_FILE_KEYS } from '@shrkcrft/plugin-api';
 import { lintTemplates } from "./template-lint.js";
 import { lintPipelines } from "./pipeline-lint.js";
 export const PACK_QUALITY_SCHEMA = 'sharkcraft.pack-quality-score/v1';
@@ -68,14 +69,12 @@ export function scorePack(inspection, pack) {
         scaffoldPatterns: 0,
         policyChecks: 0,
     };
-    const totalDeclared = pack.contributionCounts.knowledgeFiles +
-        pack.contributionCounts.ruleFiles +
-        pack.contributionCounts.pathFiles +
-        pack.contributionCounts.templateFiles +
-        pack.contributionCounts.pipelineFiles +
-        pack.contributionCounts.docsFiles +
-        pack.contributionCounts.presetFiles +
-        pack.contributionCounts.scaffoldPatternFiles;
+    // Sum EVERY canonical contribution kind (not just the original 8) so a pack
+    // that contributes only "extended" kinds (conventions / helpers / framework
+    // extractors / …) is recognised as declaring contributions instead of being
+    // scored as "Pack declares no contributions".
+    const declaredCounts = pack.contributionCounts;
+    const totalDeclared = CONTRIBUTION_FILE_KEYS.reduce((sum, key) => sum + (declaredCounts[key] ?? 0), 0);
     const totalResolved = resolved.knowledgeEntries +
         resolved.rules +
         resolved.pathConventions +

package/dist/pack-release-check.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"pack-release-check.d.ts","sourceRoot":"","sources":["../src/pack-release-check.ts"],"names":[],"mappings":"AAKA,eAAO,MAAM,yBAAyB,qCAAqC,CAAC;AAE5E,MAAM,MAAM,aAAa,GAAG,MAAM,GAAG,SAAS,GAAG,OAAO,CAAC;AAEzD,MAAM,WAAW,mBAAmB;IAClC,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,EAAE,aAAa,CAAC;IACxB,OAAO,EAAE,MAAM,CAAC;IAChB,iDAAiD;IACjD,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,oEAAoE;IACpE,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,oDAAoD;IACpD,IAAI,CAAC,EAAE,MAAM,CAAC;CACf;AAED,MAAM,WAAW,iBAAiB;IAChC,MAAM,EAAE,OAAO,yBAAyB,CAAC;IACzC,QAAQ,EAAE,MAAM,CAAC;IACjB,YAAY,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5B,eAAe,EAAE,MAAM,GAAG,IAAI,CAAC;IAC/B,kBAAkB,EAAE,MAAM,CAAC;IAC3B,QAAQ,EAAE,SAAS,mBAAmB,EAAE,CAAC;IACzC,MAAM,EAAE,OAAO,CAAC;CACjB;AA6ED,wBAAsB,mBAAmB,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,iBAAiB,CAAC,CAgLtF"}
+{"version":3,"file":"pack-release-check.d.ts","sourceRoot":"","sources":["../src/pack-release-check.ts"],"names":[],"mappings":"AASA,eAAO,MAAM,yBAAyB,qCAAqC,CAAC;AAE5E,MAAM,MAAM,aAAa,GAAG,MAAM,GAAG,SAAS,GAAG,OAAO,CAAC;AAEzD,MAAM,WAAW,mBAAmB;IAClC,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,EAAE,aAAa,CAAC;IACxB,OAAO,EAAE,MAAM,CAAC;IAChB,iDAAiD;IACjD,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,oEAAoE;IACpE,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,oDAAoD;IACpD,IAAI,CAAC,EAAE,MAAM,CAAC;CACf;AAED,MAAM,WAAW,iBAAiB;IAChC,MAAM,EAAE,OAAO,yBAAyB,CAAC;IACzC,QAAQ,EAAE,MAAM,CAAC;IACjB,YAAY,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5B,eAAe,EAAE,MAAM,GAAG,IAAI,CAAC;IAC/B,kBAAkB,EAAE,MAAM,CAAC;IAC3B,QAAQ,EAAE,SAAS,mBAAmB,EAAE,CAAC;IACzC,MAAM,EAAE,OAAO,CAAC;CACjB;AA6ED,wBAAsB,mBAAmB,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,iBAAiB,CAAC,CAoLtF"}

package/dist/pack-release-check.js

@@ -1,6 +1,6 @@
 import { existsSync, readFileSync } from 'node:fs';
 import * as nodePath from 'node:path';
-import { validatePackManifest } from '@shrkcrft/plugin-api';
+import { CONTRIBUTION_FILE_KEYS, validatePackManifest, } from '@shrkcrft/plugin-api';
 import { importModuleViaLoader } from '@shrkcrft/core';
 export const PACK_RELEASE_CHECK_SCHEMA = 'sharkcraft.pack-release-check/v1';
 function findManifest(packPath) {
@@ -158,27 +158,17 @@ export async function runPackReleaseCheck(packPath) {
         }
     }
     // Contribution file existence + load.
+    //
+    // Iterate the canonical CONTRIBUTION_FILE_KEYS (single source of truth in
+    // @shrkcrft/plugin-api) so EVERY consuming contribution slot is verified — a
+    // pack shipping a broken framework extractor / convention / helper / decision
+    // / etc. now fails the gate instead of slipping through. The two `Future`
+    // no-op slots (mcpToolFiles / aiProviderFiles) are intentionally excluded via
+    // FUTURE_CONTRIBUTION_FILE_KEYS: nothing loads them yet, so verifying them
+    // would be dishonest.
     let contributionsFound = 0;
     const c = manifest.contributions ?? {};
-    const allBuckets = [
-        'knowledgeFiles',
-        'ruleFiles',
-        'pathFiles',
-        'templateFiles',
-        'pipelineFiles',
-        'docsFiles',
-        'presetFiles',
-        'boundaryFiles',
-        'contextTestFiles',
-        'agentTestFiles',
-        'scaffoldPatternFiles',
-        'policyCheckFiles',
-        'constructFiles',
-        'constructFacetFiles',
-        'playbookFiles',
-        'searchTuningFiles',
-    ];
-    for (const key of allBuckets) {
+    for (const key of CONTRIBUTION_FILE_KEYS) {
         const list = c[key];
         if (!list || list.length === 0)
             continue;
@@ -234,6 +224,19 @@ export async function runPackReleaseCheck(packPath) {
             file: manifestFile,
         });
     }
+    else if (manifest.signature.dev === true) {
+        // Dev signatures verify only against the well-known public dev secret and
+        // are NOT release-trusted — shipping one in a release is almost certainly a
+        // mistake. Warn (not a hard error) so the author re-signs before tagging.
+        findings.push({
+            code: 'dev-signature',
+            severity: 'warning',
+            message: 'Manifest carries a dev signature (sig.dev = true) — verified only against the public dev secret and NOT release-trusted. Re-sign with the release secret before publishing.',
+            suggestedFix: 'Run `shrk packs sign <manifest.ts>` with SHARKCRAFT_PACK_SECRET set (no --dev) and ship the re-signed manifest.',
+            suggestedCommand: 'shrk packs sign ' + manifestFile + ' --verify-after-sign',
+            file: manifestFile,
+        });
+    }
     // Files whitelist sanity.
     const filesFinding = checkFilesWhitelist(pkgFile, manifestFile);
     if (filesFinding)

package/dist/pack-signature-status.d.ts

@@ -42,14 +42,20 @@ export interface IPackSignatureStatusReport {
 export declare function buildPackSignatureStatusReport(inspection: ISharkcraftInspection): IPackSignatureStatusReport;
 /**
  * Pack signature explanation. Surfaces the distinct lifecycle
- * states (`unsigned`, `stale`, `invalid`, `valid`, `secret-missing`,
- * `not-required`) per pack with a one-line "why this matters".
+ * states (`unsigned`, `stale`, `invalid`, `valid`, `present-unverified`,
+ * `dev-signature`, `secret-missing`, `not-required`) per pack with a one-line
+ * "why this matters".
  *
  * Read-only. Reads `inspection.packs.discoveredPacks[i].signatureStatus`
  * which already reflects the verifier's outcome when the inspector was
  * constructed with `verifyPackSignatures: true`.
+ *
+ * `valid` is reserved STRICTLY for a real HMAC pass (verifier === 'verified').
+ * A pack whose signature timestamp is merely fresher than its contribution
+ * files — but whose HMAC was not checked this run — is `present-unverified`,
+ * never `valid`: freshness is not verification.
  */
-export type PackSignatureExplainState = 'valid' | 'unsigned' | 'stale' | 'invalid' | 'secret-missing' | 'not-required' | 'unknown';
+export type PackSignatureExplainState = 'valid' | 'unsigned' | 'stale' | 'invalid' | 'present-unverified' | 'dev-signature' | 'secret-missing' | 'not-required' | 'unknown';
 export interface IPackSignatureExplainEntry {
     readonly packageName: string;
     readonly packageVersion: string;

package/dist/pack-signature-status.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"pack-signature-status.d.ts","sourceRoot":"","sources":["../src/pack-signature-status.ts"],"names":[],"mappings":"AAiBA,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,2BAA2B,CAAC;AAEvE,eAAO,MAAM,4BAA4B,wCAAwC,CAAC;AAElF,oBAAY,uBAAuB;IACjC,OAAO,YAAY;IACnB,KAAK,UAAU;IACf,OAAO,YAAY;CACpB;AAED,MAAM,WAAW,mBAAmB;IAClC,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAC;IAChC,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,MAAM,EAAE,uBAAuB,CAAC;IACzC,QAAQ,CAAC,iBAAiB,CAAC,EAAE,MAAM,CAAC;IACpC,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,qBAAqB,CAAC,EAAE,MAAM,CAAC;IACxC,QAAQ,CAAC,sBAAsB,CAAC,EAAE,MAAM,CAAC;IACzC,QAAQ,CAAC,eAAe,EAAE,OAAO,CAAC;IAClC,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;IAC9B;;;;;OAKG;IACH,QAAQ,CAAC,GAAG,CAAC,EAAE,OAAO,CAAC;CACxB;AAED,MAAM,WAAW,0BAA0B;IACzC,QAAQ,CAAC,MAAM,EAAE,OAAO,4BAA4B,CAAC;IACrD,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,KAAK,EAAE,SAAS,mBAAmB,EAAE,CAAC;IAC/C,QAAQ,CAAC,OAAO,EAAE;QAChB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;QACvB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;QACzB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;QACvB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;QACzB,sEAAsE;QACtE,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;KACtB,CAAC;IACF,QAAQ,CAAC,eAAe,EAAE,OAAO,CAAC;IAClC,QAAQ,CAAC,YAAY,EAAE,SAAS,MAAM,EAAE,CAAC;CAC1C;AA+BD,wBAAgB,8BAA8B,CAC5C,UAAU,EAAE,qBAAqB,GAChC,0BAA0B,CA6G5B;AAED;;;;;;;;GAQG;AACH,MAAM,MAAM,yBAAyB,GACjC,OAAO,GACP,UAAU,GACV,OAAO,GACP,SAAS,GACT,gBAAgB,GAChB,cAAc,GACd,SAAS,CAAC;AAEd,MAAM,WAAW,0BAA0B;IACzC,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAC;IAChC,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,KAAK,EAAE,yBAAyB,CAAC;IAC1C,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;CAC/B;AAED,MAAM,WAAW,2BAA2B;IAC1C,QAAQ,CAAC,MAAM,EAAE,sCAAsC,CAAC;IACxD,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,eAAe,EAAE,OAAO,CAAC;IAClC,QAAQ,CAAC,IAAI,EAAE,UAAU,GAAG,UAAU,CAAC;IACvC,QAAQ,CAAC,KAAK,EAAE,SAAS,0BAA0B,EAAE,CAAC;CACvD;AAED,MAAM,WAAW,kCAAkC;IACjD,iBAAiB,CAAC,EAAE,OAAO,CAAC;CAC7B;AAED,wBAAgB,0BAA0B,CACxC,UAAU,EAAE,qBAAqB,EACjC,OAAO,GAAE,kCAAuC,GAC/C,2BAA2B,CA6D7B"}
+{"version":3,"file":"pack-signature-status.d.ts","sourceRoot":"","sources":["../src/pack-signature-status.ts"],"names":[],"mappings":"AAiBA,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,2BAA2B,CAAC;AAEvE,eAAO,MAAM,4BAA4B,wCAAwC,CAAC;AAElF,oBAAY,uBAAuB;IACjC,OAAO,YAAY;IACnB,KAAK,UAAU;IACf,OAAO,YAAY;CACpB;AAED,MAAM,WAAW,mBAAmB;IAClC,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAC;IAChC,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,MAAM,EAAE,uBAAuB,CAAC;IACzC,QAAQ,CAAC,iBAAiB,CAAC,EAAE,MAAM,CAAC;IACpC,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,qBAAqB,CAAC,EAAE,MAAM,CAAC;IACxC,QAAQ,CAAC,sBAAsB,CAAC,EAAE,MAAM,CAAC;IACzC,QAAQ,CAAC,eAAe,EAAE,OAAO,CAAC;IAClC,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;IAC9B;;;;;OAKG;IACH,QAAQ,CAAC,GAAG,CAAC,EAAE,OAAO,CAAC;CACxB;AAED,MAAM,WAAW,0BAA0B;IACzC,QAAQ,CAAC,MAAM,EAAE,OAAO,4BAA4B,CAAC;IACrD,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,KAAK,EAAE,SAAS,mBAAmB,EAAE,CAAC;IAC/C,QAAQ,CAAC,OAAO,EAAE;QAChB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;QACvB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;QACzB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;QACvB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;QACzB,sEAAsE;QACtE,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;KACtB,CAAC;IACF,QAAQ,CAAC,eAAe,EAAE,OAAO,CAAC;IAClC,QAAQ,CAAC,YAAY,EAAE,SAAS,MAAM,EAAE,CAAC;CAC1C;AA+BD,wBAAgB,8BAA8B,CAC5C,UAAU,EAAE,qBAAqB,GAChC,0BAA0B,CA6G5B;AAED;;;;;;;;;;;;;;GAcG;AACH,MAAM,MAAM,yBAAyB,GACjC,OAAO,GACP,UAAU,GACV,OAAO,GACP,SAAS,GACT,oBAAoB,GACpB,eAAe,GACf,gBAAgB,GAChB,cAAc,GACd,SAAS,CAAC;AAEd,MAAM,WAAW,0BAA0B;IACzC,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAC;IAChC,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,KAAK,EAAE,yBAAyB,CAAC;IAC1C,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;CAC/B;AAED,MAAM,WAAW,2BAA2B;IAC1C,QAAQ,CAAC,MAAM,EAAE,sCAAsC,CAAC;IACxD,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,eAAe,EAAE,OAAO,CAAC;IAClC,QAAQ,CAAC,IAAI,EAAE,UAAU,GAAG,UAAU,CAAC;IACvC,QAAQ,CAAC,KAAK,EAAE,SAAS,0BAA0B,EAAE,CAAC;CACvD;AAED,MAAM,WAAW,kCAAkC;IACjD,iBAAiB,CAAC,EAAE,OAAO,CAAC;CAC7B;AAED,wBAAgB,0BAA0B,CACxC,UAAU,EAAE,qBAAqB,EACjC,OAAO,GAAE,kCAAuC,GAC/C,2BAA2B,CAuE7B"}

package/dist/pack-signature-status.js

@@ -191,6 +191,12 @@ export function explainPackSignatureStatus(inspection, options = {}) {
             explanation = 'Manifest signature failed HMAC verification — pack contents may have been tampered with.';
             nextCommand = 'shrk packs verify --required';
         }
+        else if (verifier === 'dev-signature') {
+            state = 'dev-signature';
+            explanation =
+                'Manifest carries a dev signature — verified only against the well-known public dev secret, NOT release-trusted. Re-sign with the release secret before publishing.';
+            nextCommand = secretAvailable ? signCmd : 'shrk packs verify --required --allow-dev-signature';
+        }
         else if (verifier === 'missing-signature' || (!verifier && fresh?.status === 'missing')) {
             state = 'unsigned';
             explanation = 'Manifest has no signature block.';
@@ -207,8 +213,13 @@ export function explainPackSignatureStatus(inspection, options = {}) {
             nextCommand = signCmd;
         }
         else if (fresh?.status === 'present') {
-            state = 'valid';
-            explanation = 'Signature timestamp is newer than every contribution file.';
+            // Freshness only — the HMAC was NOT checked this run. Reserve `valid`
+            // strictly for a real verifier pass so a bogus-HMAC-but-fresh-timestamp
+            // pack is never mislabelled as verified.
+            state = 'present-unverified';
+            explanation =
+                'Signature present and newer than every contribution file, but the HMAC was NOT checked this run.';
+            nextCommand = 'shrk packs verify --required';
         }
         else {
             state = mode === 'required' ? 'unknown' : 'not-required';

package/dist/plan-simulation.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"plan-simulation.d.ts","sourceRoot":"","sources":["../src/plan-simulation.ts"],"names":[],"mappings":"AAwBA,OAAO,EAAmB,KAAK,iBAAiB,EAAE,MAAM,kBAAkB,CAAC;AAK3E,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,2BAA2B,CAAC;AAEvE,eAAO,MAAM,sBAAsB,kCAAkC,CAAC;AAEtE,oBAAY,8BAA8B;IACxC,KAAK,UAAU;IACf,cAAc,oBAAoB;IAClC,QAAQ,aAAa;IACrB,gBAAgB,sBAAsB;IACtC,UAAU,gBAAgB;CAC3B;AAED,oBAAY,kBAAkB;IAC5B,KAAK,UAAU;IACf,eAAe,sBAAsB;IACrC,gBAAgB,sBAAsB;IACtC,aAAa,mBAAmB;IAChC,eAAe,qBAAqB;IACpC,gBAAgB,sBAAsB;IACtC,oBAAoB,2BAA2B;CAChD;AAED,MAAM,WAAW,mBAAmB;IAClC,YAAY,EAAE,MAAM,CAAC;IACrB,UAAU,EAAE,MAAM,CAAC;IACnB,OAAO,EAAE,8BAA8B,CAAC;IACxC,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,SAAS,EAAE,MAAM,CAAC;IAClB;;qCAEiC;IACjC,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB;gCAC4B;IAC5B,gBAAgB,EAAE,OAAO,CAAC;IAC1B,mBAAmB,EAAE,OAAO,CAAC;IAC7B,iBAAiB,EAAE,OAAO,CAAC;IAC3B,oBAAoB,EAAE,OAAO,CAAC;IAC9B,oBAAoB,EAAE,OAAO,CAAC;IAC9B,cAAc,EAAE,OAAO,CAAC;IACxB,8CAA8C;IAC9C,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,qDAAqD;IACrD,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,yCAAyC;IACzC,aAAa,CAAC,EAAE,OAAO,CAAC;IACxB,gDAAgD;IAChD,eAAe,CAAC,EAAE,MAAM,CAAC;CAC1B;AAED,MAAM,WAAW,0BAA0B;IACzC,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,MAAM,CAAC;IACf,eAAe,EAAE,MAAM,CAAC;IACxB,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,EAAE,MAAM,CAAC;IACjB,OAAO,EAAE,MAAM,CAAC;CACjB;AAED,MAAM,WAAW,qBAAqB;IACpC,MAAM,EAAE,OAAO,sBAAsB,CAAC;IACtC,WAAW,EAAE,MAAM,CAAC;IACpB,MAAM,EAAE,MAAM,CAAC;IACf,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,UAAU,EAAE,MAAM,CAAC;IACnB,SAAS,EAAE,QAAQ,GAAG,SAAS,GAAG,SAAS,CAAC;IAC5C,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,KAAK,EAAE,SAAS,mBAAmB,EAAE,CAAC;IACtC,aAAa,EAAE,SAAS,MAAM,EAAE,CAAC;IACjC,uBAAuB,EAAE,SAAS,MAAM,EAAE,CAAC;IAC3C,gBAAgB,EAAE,OAAO,CAAC;IAC1B,mBAAmB,EAAE,OAAO,CAAC;IAC7B,iBAAiB,EAAE,OAAO,CAAC;IAC3B,oBAAoB,EAAE,OAAO,CAAC;IAC9B,oBAAoB,EAAE,OAAO,CAAC;IAC9B,sBAAsB,EAAE,OAAO,CAAC;IAChC,sBAAsB,EAAE,OAAO,CAAC;IAChC,uBAAuB,EAAE,OAAO,CAAC;IACjC,oBAAoB,EAAE,SAAS,MAAM,EAAE,CAAC;IACxC,WAAW,EAAE,SAAS,MAAM,EAAE,CAAC;IAC/B,mBAAmB,EAAE,SAAS,MAAM,EAAE,CAAC;IACvC,kBAAkB,EAAE,SAAS,MAAM,EAAE,CAAC;IACtC,iBAAiB,EAAE,SAAS,MAAM,EAAE,CAAC;IACrC,yBAAyB,EAAE,SAAS,0BAA0B,EAAE,CAAC;IACjE,8BAA8B,EAAE,SAAS,0BAA0B,EAAE,CAAC;IACtE,cAAc,EAAE,SAAS,MAAM,EAAE,CAAC;IAClC,cAAc,EAAE,kBAAkB,CAAC;IACnC,qBAAqB,EAAE,SAAS,MAAM,EAAE,CAAC;IACzC,qBAAqB,EAAE,MAAM,CAAC;IAC9B,WAAW,EAAE,SAAS,MAAM,EAAE,CAAC;IAC/B,YAAY,CAAC,EAAE,iBAAiB,CAAC;IACjC,WAAW,EAAE,SAAS,MAAM,EAAE,CAAC;CAChC;AAED,MAAM,WAAW,sBAAsB;IACrC,iEAAiE;IACjE,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,iBAAiB,CAAC,EAAE,OAAO,CAAC;IAC5B,aAAa,CAAC,EAAE,OAAO,CAAC;IACxB,YAAY,CAAC,EAAE,OAAO,CAAC;IACvB,eAAe,CAAC,EAAE,OAAO,CAAC;IAC1B,gBAAgB,CAAC,EAAE,OAAO,CAAC;IAC3B,aAAa,CAAC,EAAE,OAAO,CAAC;IACxB,mDAAmD;IACnD,IAAI,CAAC,EAAE,OAAO,CAAC;IACf,mDAAmD;IACnD,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB;AAYD;;;;GAIG;AACH,wBAAgB,WAAW,CAAC,UAAU,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,IAAI,EAAE;IAAE,OAAO,CAAC,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAAC,YAAY,EAAE,MAAM,CAAA;CAAE,GAAG;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,SAAS,EAAE,OAAO,CAAA;CAAE,CAoG5K;AA+GD,wBAAsB,YAAY,CAChC,UAAU,EAAE,qBAAqB,EACjC,QAAQ,EAAE,MAAM,EAChB,OAAO,GAAE,sBAA2B,GACnC,OAAO,CAAC,qBAAqB,CAAC,CAkUhC;AAOD,wBAAgB,wBAAwB,CAAC,CAAC,EAAE,qBAAqB,GAAG,MAAM,CAwDzE;AAOD,wBAAgB,4BAA4B,CAAC,CAAC,EAAE,qBAAqB,GAAG,MAAM,CAkD7E;AAWD,wBAAgB,wBAAwB,CAAC,CAAC,EAAE,qBAAqB,GAAG,MAAM,CAWzE"}
+{"version":3,"file":"plan-simulation.d.ts","sourceRoot":"","sources":["../src/plan-simulation.ts"],"names":[],"mappings":"AAwBA,OAAO,EAAmB,KAAK,iBAAiB,EAAE,MAAM,kBAAkB,CAAC;AAK3E,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,2BAA2B,CAAC;AAEvE,eAAO,MAAM,sBAAsB,kCAAkC,CAAC;AAEtE,oBAAY,8BAA8B;IACxC,KAAK,UAAU;IACf,cAAc,oBAAoB;IAClC,QAAQ,aAAa;IACrB,gBAAgB,sBAAsB;IACtC,UAAU,gBAAgB;CAC3B;AAED,oBAAY,kBAAkB;IAC5B,KAAK,UAAU;IACf,eAAe,sBAAsB;IACrC,gBAAgB,sBAAsB;IACtC,aAAa,mBAAmB;IAChC,eAAe,qBAAqB;IACpC,gBAAgB,sBAAsB;IACtC,oBAAoB,2BAA2B;CAChD;AAED,MAAM,WAAW,mBAAmB;IAClC,YAAY,EAAE,MAAM,CAAC;IACrB,UAAU,EAAE,MAAM,CAAC;IACnB,OAAO,EAAE,8BAA8B,CAAC;IACxC,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,SAAS,EAAE,MAAM,CAAC;IAClB;;qCAEiC;IACjC,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB;gCAC4B;IAC5B,gBAAgB,EAAE,OAAO,CAAC;IAC1B,mBAAmB,EAAE,OAAO,CAAC;IAC7B,iBAAiB,EAAE,OAAO,CAAC;IAC3B,oBAAoB,EAAE,OAAO,CAAC;IAC9B,oBAAoB,EAAE,OAAO,CAAC;IAC9B,cAAc,EAAE,OAAO,CAAC;IACxB,8CAA8C;IAC9C,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,qDAAqD;IACrD,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,yCAAyC;IACzC,aAAa,CAAC,EAAE,OAAO,CAAC;IACxB,gDAAgD;IAChD,eAAe,CAAC,EAAE,MAAM,CAAC;CAC1B;AAED,MAAM,WAAW,0BAA0B;IACzC,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,MAAM,CAAC;IACf,eAAe,EAAE,MAAM,CAAC;IACxB,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,EAAE,MAAM,CAAC;IACjB,OAAO,EAAE,MAAM,CAAC;CACjB;AAED,MAAM,WAAW,qBAAqB;IACpC,MAAM,EAAE,OAAO,sBAAsB,CAAC;IACtC,WAAW,EAAE,MAAM,CAAC;IACpB,MAAM,EAAE,MAAM,CAAC;IACf,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,UAAU,EAAE,MAAM,CAAC;IACnB,SAAS,EAAE,QAAQ,GAAG,SAAS,GAAG,SAAS,CAAC;IAC5C,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,KAAK,EAAE,SAAS,mBAAmB,EAAE,CAAC;IACtC,aAAa,EAAE,SAAS,MAAM,EAAE,CAAC;IACjC,uBAAuB,EAAE,SAAS,MAAM,EAAE,CAAC;IAC3C,gBAAgB,EAAE,OAAO,CAAC;IAC1B,mBAAmB,EAAE,OAAO,CAAC;IAC7B,iBAAiB,EAAE,OAAO,CAAC;IAC3B,oBAAoB,EAAE,OAAO,CAAC;IAC9B,oBAAoB,EAAE,OAAO,CAAC;IAC9B,sBAAsB,EAAE,OAAO,CAAC;IAChC,sBAAsB,EAAE,OAAO,CAAC;IAChC,uBAAuB,EAAE,OAAO,CAAC;IACjC,oBAAoB,EAAE,SAAS,MAAM,EAAE,CAAC;IACxC,WAAW,EAAE,SAAS,MAAM,EAAE,CAAC;IAC/B,mBAAmB,EAAE,SAAS,MAAM,EAAE,CAAC;IACvC,kBAAkB,EAAE,SAAS,MAAM,EAAE,CAAC;IACtC,iBAAiB,EAAE,SAAS,MAAM,EAAE,CAAC;IACrC,yBAAyB,EAAE,SAAS,0BAA0B,EAAE,CAAC;IACjE,8BAA8B,EAAE,SAAS,0BAA0B,EAAE,CAAC;IACtE,cAAc,EAAE,SAAS,MAAM,EAAE,CAAC;IAClC,cAAc,EAAE,kBAAkB,CAAC;IACnC,qBAAqB,EAAE,SAAS,MAAM,EAAE,CAAC;IACzC,qBAAqB,EAAE,MAAM,CAAC;IAC9B,WAAW,EAAE,SAAS,MAAM,EAAE,CAAC;IAC/B,YAAY,CAAC,EAAE,iBAAiB,CAAC;IACjC,WAAW,EAAE,SAAS,MAAM,EAAE,CAAC;CAChC;AAED,MAAM,WAAW,sBAAsB;IACrC,iEAAiE;IACjE,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,iBAAiB,CAAC,EAAE,OAAO,CAAC;IAC5B,aAAa,CAAC,EAAE,OAAO,CAAC;IACxB,YAAY,CAAC,EAAE,OAAO,CAAC;IACvB,eAAe,CAAC,EAAE,OAAO,CAAC;IAC1B,gBAAgB,CAAC,EAAE,OAAO,CAAC;IAC3B,aAAa,CAAC,EAAE,OAAO,CAAC;IACxB,mDAAmD;IACnD,IAAI,CAAC,EAAE,OAAO,CAAC;IACf,mDAAmD;IACnD,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB;AAYD;;;;GAIG;AACH,wBAAgB,WAAW,CAAC,UAAU,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,IAAI,EAAE;IAAE,OAAO,CAAC,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAAC,YAAY,EAAE,MAAM,CAAA;CAAE,GAAG;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,SAAS,EAAE,OAAO,CAAA;CAAE,CAoG5K;AA+GD,wBAAsB,YAAY,CAChC,UAAU,EAAE,qBAAqB,EACjC,QAAQ,EAAE,MAAM,EAChB,OAAO,GAAE,sBAA2B,GACnC,OAAO,CAAC,qBAAqB,CAAC,CA6UhC;AAOD,wBAAgB,wBAAwB,CAAC,CAAC,EAAE,qBAAqB,GAAG,MAAM,CAwDzE;AAOD,wBAAgB,4BAA4B,CAAC,CAAC,EAAE,qBAAqB,GAAG,MAAM,CAkD7E;AAWD,wBAAgB,wBAAwB,CAAC,CAAC,EAAE,qBAAqB,GAAG,MAAM,CAWzE"}

package/dist/plan-simulation.js

@@ -282,9 +282,11 @@ export async function simulatePlan(inspection, planPath, options = {}) {
     }
     // Re-render the template to recover virtual contents (when available).
     let liveChanges = [];
+    let templateRequiredValidations = [];
     if (plan.templateId) {
         const template = inspection.templateRegistry.get(plan.templateId);
         if (template) {
+            templateRequiredValidations = template.metadata?.requiredValidations ?? [];
             try {
                 const dry = planGeneration(template, {
                     templateId: plan.templateId,
@@ -485,20 +487,32 @@ export async function simulatePlan(inspection, planPath, options = {}) {
                 likelyTests.push(`${f.relativePath} → expected ${candidate}`);
         }
     }
-    // Required validations. Prefer the project's OWN configured verification
-    // commands (config.verificationCommands), so on e.g. an Nx repo that lists
-    // `nx build <app>` plan-simulate emits that instead of misleading generic
-    // gates. Falls back to the engine defaults only when nothing is configured.
+    // Required validations. The template's OWN declared validations come first
+    // (so an Nx lib template can surface `nx build <app>` rather than the generic
+    // boilerplate, and two templates can show different lists). We then add the
+    // project's authoritative gate set — its configured verificationCommands —
+    // via resolveVerificationCommands. The engine's generic defaults are used
+    // ONLY as a fallback when the template declared nothing of its own.
     // No pipelineIds are passed: a saved plan carries no task query to rank
     // pipelines against, so resolution is config-driven, not pipeline-matched.
-    const requiredValidations = new Set(resolveVerificationCommands(inspection, {
-        knowledgeDefaults: [
-            'bun x tsc -p tsconfig.base.json --noEmit',
-            'bun test',
-            'shrk doctor',
-            'shrk check boundaries',
-        ],
-    }));
+    const requiredValidations = new Set();
+    for (const v of templateRequiredValidations) {
+        const cmd = v.trim();
+        if (cmd.length > 0)
+            requiredValidations.add(cmd);
+    }
+    const resolvedValidations = resolveVerificationCommands(inspection, {
+        knowledgeDefaults: templateRequiredValidations.length > 0
+            ? []
+            : [
+                'bun x tsc -p tsconfig.base.json --noEmit',
+                'bun test',
+                'shrk doctor',
+                'shrk check boundaries',
+            ],
+    });
+    for (const cmd of resolvedValidations)
+        requiredValidations.add(cmd);
     if (publicApiTouched || barrelExportTouched)
         requiredValidations.add('shrk api report --all --public-only');
     if (pluginKeysTouched)

package/dist/registry-lifecycle.d.ts

@@ -33,6 +33,12 @@ export interface IRegistryIgnored {
 export interface IRegistryLifecycleReport {
     schema: 'sharkcraft.registry-lifecycle/v1';
     filesScanned: number;
+    /** Total candidate files found before the cap (>= filesScanned). */
+    totalFiles: number;
+    /** True when the scan hit the file cap and did NOT see every candidate file. */
+    truncated: boolean;
+    /** Project-relative subtree the scan was scoped to, when `--scope` was used. */
+    scope?: string;
     registersFound: number;
     matchedPairs: ReadonlyArray<IRegistryPair>;
     missingRemovers: ReadonlyArray<IRegistryMissingRemover>;
@@ -48,6 +54,8 @@ export interface IRegistryLifecycleReport {
 export declare function buildRegistryLifecycleReport(input: {
     projectRoot: string;
     limit?: number;
+    /** Project-relative subtree to scope the scan to (sub-second on a subtree). */
+    scope?: string;
 }): IRegistryLifecycleReport;
 export declare function renderRegistryLifecycleReportText(report: IRegistryLifecycleReport): string;
 //# sourceMappingURL=registry-lifecycle.d.ts.map

package/dist/registry-lifecycle.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"registry-lifecycle.d.ts","sourceRoot":"","sources":["../src/registry-lifecycle.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAKH,MAAM,WAAW,aAAa;IAC5B,YAAY,EAAE,MAAM,CAAC;IACrB,WAAW,EAAE,MAAM,CAAC;IACpB,IAAI,EAAE,MAAM,CAAC;IACb,YAAY,EAAE,MAAM,CAAC;IACrB,WAAW,EAAE,MAAM,CAAC;CACrB;AAED,MAAM,WAAW,uBAAuB;IACtC,YAAY,EAAE,MAAM,CAAC;IACrB,oBAAoB,EAAE,aAAa,CAAC,MAAM,CAAC,CAAC;IAC5C,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,UAAU,EAAE,MAAM,CAAC;CACpB;AAED,MAAM,WAAW,gBAAgB;IAC/B,YAAY,EAAE,MAAM,CAAC;IACrB,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,MAAM,CAAC;IACf,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED,MAAM,WAAW,wBAAwB;IACvC,MAAM,EAAE,kCAAkC,CAAC;IAC3C,YAAY,EAAE,MAAM,CAAC;IACrB,cAAc,EAAE,MAAM,CAAC;IACvB,YAAY,EAAE,aAAa,CAAC,aAAa,CAAC,CAAC;IAC3C,eAAe,EAAE,aAAa,CAAC,uBAAuB,CAAC,CAAC;IACxD;;;;OAIG;IACH,gBAAgB,EAAE,aAAa,CAAC,gBAAgB,CAAC,CAAC;IAClD,OAAO,EAAE,aAAa,CAAC,gBAAgB,CAAC,CAAC;IACzC,eAAe,EAAE,aAAa,CAAC,MAAM,CAAC,CAAC;CACxC;AAuLD,wBAAgB,4BAA4B,CAAC,KAAK,EAAE;IAClD,WAAW,EAAE,MAAM,CAAC;IACpB,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB,GAAG,wBAAwB,CAsF3B;AAED,wBAAgB,iCAAiC,CAAC,MAAM,EAAE,wBAAwB,GAAG,MAAM,CA8B1F"}
+{"version":3,"file":"registry-lifecycle.d.ts","sourceRoot":"","sources":["../src/registry-lifecycle.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAKH,MAAM,WAAW,aAAa;IAC5B,YAAY,EAAE,MAAM,CAAC;IACrB,WAAW,EAAE,MAAM,CAAC;IACpB,IAAI,EAAE,MAAM,CAAC;IACb,YAAY,EAAE,MAAM,CAAC;IACrB,WAAW,EAAE,MAAM,CAAC;CACrB;AAED,MAAM,WAAW,uBAAuB;IACtC,YAAY,EAAE,MAAM,CAAC;IACrB,oBAAoB,EAAE,aAAa,CAAC,MAAM,CAAC,CAAC;IAC5C,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,UAAU,EAAE,MAAM,CAAC;CACpB;AAED,MAAM,WAAW,gBAAgB;IAC/B,YAAY,EAAE,MAAM,CAAC;IACrB,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,MAAM,CAAC;IACf,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED,MAAM,WAAW,wBAAwB;IACvC,MAAM,EAAE,kCAAkC,CAAC;IAC3C,YAAY,EAAE,MAAM,CAAC;IACrB,oEAAoE;IACpE,UAAU,EAAE,MAAM,CAAC;IACnB,gFAAgF;IAChF,SAAS,EAAE,OAAO,CAAC;IACnB,gFAAgF;IAChF,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,cAAc,EAAE,MAAM,CAAC;IACvB,YAAY,EAAE,aAAa,CAAC,aAAa,CAAC,CAAC;IAC3C,eAAe,EAAE,aAAa,CAAC,uBAAuB,CAAC,CAAC;IACxD;;;;OAIG;IACH,gBAAgB,EAAE,aAAa,CAAC,gBAAgB,CAAC,CAAC;IAClD,OAAO,EAAE,aAAa,CAAC,gBAAgB,CAAC,CAAC;IACzC,eAAe,EAAE,aAAa,CAAC,MAAM,CAAC,CAAC;CACxC;AAiMD,wBAAgB,4BAA4B,CAAC,KAAK,EAAE;IAClD,WAAW,EAAE,MAAM,CAAC;IACpB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,+EAA+E;IAC/E,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB,GAAG,wBAAwB,CA2F3B;AAED,wBAAgB,iCAAiC,CAAC,MAAM,EAAE,wBAAwB,GAAG,MAAM,CAkC1F"}