@utsu-ri/cli 0.1.0

package/README.md

@@ -0,0 +1,226 @@
+<!-- doc-language: en; canonical: true -->
+
+[English](https://github.com/hokupod/utsuri/blob/v0.1.0/README.md) | [日本語](https://github.com/hokupod/utsuri/blob/v0.1.0/README.ja.md) | [简体中文](https://github.com/hokupod/utsuri/blob/v0.1.0/README.zh-CN.md)
+
+# Utsuri
+
+> See what changed. Understand why.
+
+<a id="product-summary"></a><!-- section:product-summary -->
+
+## Product summary
+
+Utsuri transforms code changes into evidence-based, human-readable visual reviews. It connects Git hunks, intent, real-browser rendering, structural evidence, coverage, and human review state in one local report.
+
+The name joins the Japanese ideas of how a UI is reflected after a change and how it transitions from before to after.
+
+<a id="status"></a><!-- section:status -->
+
+## Status
+
+<!-- availability:phase-6-v0-1-0-release-ready -->
+
+The complete v1 source implementation is prepared for the `v0.1.0` release. Phase 6 provides capability-bound interactive review, Feedback Batch preview and storage, bounded Context Packs, Origin Session binding, Review Inbox CLI/MCP access, itemized answer writeback, and safe return-to-session fallback. A read-only Distribution Candidate workflow builds and verifies all release artifacts; a separate protected `v*` tag workflow performs OIDC publication only after its release gates pass. No direct same-session bridge is enabled because neither supported host exposes every required authenticated binding and correlation guarantee. The npm packages and Plugin remain unpublished until the one-time first-publication bootstrap and an explicitly authorized release.
+
+<a id="capabilities"></a><!-- section:capabilities -->
+
+## Capabilities
+
+Available now:
+
+- explicit patch, worktree, range, and merge-base collection modes;
+- stable structured hunks with rename, delete, binary, submodule, mode, and low-signal metadata;
+- deterministic initial change candidates with complete candidate-or-unclassified coverage;
+- schema-validated annotations and evidence references; and
+- a self-contained code review with summary, three-state queue, Focus mode, evidence drawer, unified/side-by-side diff, deep links, and keyboard focus restoration;
+- separate before/after Browser Contexts with identical viewport, DPR, locale, timezone, color scheme, and reduced-motion settings;
+- full-page and element screenshots plus normalized DOM, ARIA, computed-style, axe, console, network, metadata, and typed failure evidence; and
+- deterministic stabilization, an allowlisted action DSL, blocked external/mutation requests, digest-checked reuse, and partial `INCOMPLETE` reports;
+- prioritized explicit/Storybook/Playwright/route/import/selector/fallback target discovery with structured known, verified, unknown, planned, succeeded, and failed coverage;
+- Pixelmatch counts, ratios, content-addressed diff images, changed regions, and normalized DOM/ARIA/style fingerprints;
+- `new`, `resolved`, `unchanged`, and `incomplete` accessibility/runtime findings plus overflow and obstruction evidence; and
+- side-by-side, wipe, stoppable blink, pixel-diff, and after-only views with crop/full-page selection, synchronized scroll/zoom, region navigation, and code/finding cross-links.
+- separate static/interactive/iframe CSPs, bounded JSON, empty-sandbox sanitized previews, PNG-only visual evidence, expanded privacy declarations, and strict SHA-256 report validation;
+- fixed Docker/Podman isolation with digest-pinned local images, no network, a read-only root/project mount, dropped capabilities, a non-root user, and PID/CPU/memory/time/artifact limits; and
+- a single Node 22 ESM CLI bundle with source/schema/UI hashes plus deterministic SPDX 2.3 and dependency-license inventories;
+- independently persisted viewed progress, human judgment, and anchored comments with canonical export/import and explicit matched/stale/orphaned re-anchoring;
+- loopback-only static serving plus deterministic `report.zip`, `report.json`, and `ci-summary.json` packaging with policy exit code `10`; and
+- exact CLI/native package contracts, four architecture-matched helper candidates, aggregate Plugin verification, Node 22/24 isolated-tarball smoke tests, and shared Skill evaluations;
+- per-start capability-token interactive serving with exact Origin for mutations, same-origin Fetch Metadata for read-only GET requests, exact Referer validation when present, report-binding, and request-schema checks;
+- explicit Agent-attention selection, Feedback Batch preview, redacted and bounded Context Packs, immutable-generation Review Inbox sidecars, and unread answer state; and
+- fixed-run `feedback` CLI and Review Inbox MCP operations that require the originating host/session/project/report binding and write exactly one answer per item.
+
+Selecting “Ask the current Agent” only records intent; it does not send, create a Context Pack, or start a process. Static/unbound reports export only. Interactive reports can store a batch for the originating conversation, but Utsuri never creates another Agent or session. A complete capture remains `UNCOVERED` until discovery and comparison run. Missing or malformed evidence, a failed side, exceeded resource limits, or unavailable container capability remains `INCOMPLETE`; an unknown denominator remains explicit and is never presented as a percentage. Pixel differences alone do not establish `REGRESSION`.
+
+<a id="quick-start"></a><!-- section:quick-start -->
+
+## Quick Start
+
+Prerequisites: Nix, Safe-chain 1.5.14 at its standard user location, and an explicitly configured compatible Chrome/Chromium or an existing Playwright-managed browser for capture. The Nix shell supplies Node 24 and Bun; no absolute Safe-chain path is configured. Utsuri never downloads a browser automatically.
+
+<!-- sync-command:dev-shell -->
+
+```bash
+nix develop
+```
+
+<!-- sync-command:dev-env-check -->
+
+```bash
+node scripts/dev-env-check.mjs --json
+```
+
+<!-- sync-command:install -->
+
+```bash
+node scripts/safe-chain.mjs bun install --frozen-lockfile
+```
+
+No setup script, Skill, or CLI command installs dependencies or downloads a browser automatically.
+
+Create a non-overwriting capture proposal from read-only project inspection. Review and edit it before capture; `proposedCommands` are never executed.
+
+<!-- sync-command:init-capture-config -->
+
+```bash
+node skills/utsuri-review/scripts/utsuri.mjs init --output utsuri.yml --json
+```
+
+Create a fresh example run. The output directory must not already exist.
+
+<!-- sync-command:collect-patch -->
+
+```bash
+node skills/utsuri-review/scripts/utsuri.mjs collect --patch fixtures/code-only-review/changes.patch --output .artifacts/utsuri/readme-example --json
+```
+
+For the default `dual-url` mode, start the configured before and after URLs yourself, then capture. A trusted `worktree` configuration additionally requires `--allow-project-code`. `static-fragment` starts no project command and labels its JavaScript-disabled output synthetic.
+
+<!-- sync-command:capture-run -->
+
+```bash
+node skills/utsuri-review/scripts/utsuri.mjs capture --run .artifacts/utsuri/readme-example --config utsuri.yml --json
+```
+
+A capture exit code of 4 preserves successful sides and typed failure evidence. Finalize that partial run rather than treating it as no visual difference.
+
+Map changed code to the captured targets and preserve any unmapped change and unknown denominator.
+
+<!-- sync-command:discover-run -->
+
+```bash
+node skills/utsuri-review/scripts/utsuri.mjs discover --run .artifacts/utsuri/readme-example --config utsuri.yml --json
+```
+
+Compare pixels, structure, accessibility, runtime errors, network evidence, and overflow. Exit code 4 means the comparison is incomplete but its evidence is preserved.
+
+<!-- sync-command:compare-run -->
+
+```bash
+node skills/utsuri-review/scripts/utsuri.mjs compare --run .artifacts/utsuri/readme-example --json
+```
+
+<!-- sync-command:finalize-report -->
+
+```bash
+node skills/utsuri-review/scripts/utsuri.mjs finalize --run .artifacts/utsuri/readme-example --json
+```
+
+<!-- sync-command:validate-report -->
+
+```bash
+node skills/utsuri-review/scripts/utsuri.mjs validate .artifacts/utsuri/readme-example/report --strict --json
+```
+
+Export mutable review state without changing the immutable report. Import into another run only after reviewing the source identity; `--reanchor` keeps changed or missing anchors visibly stale or orphaned.
+
+```bash
+node skills/utsuri-review/scripts/utsuri.mjs review export --run .artifacts/utsuri/readme-example --output .artifacts/utsuri/review-bundle.json --json
+node skills/utsuri-review/scripts/utsuri.mjs review import --run .artifacts/utsuri/updated-run --input .artifacts/utsuri/review-bundle.json --reanchor --json
+```
+
+For an Origin Session-bound run, start the capability-protected viewer, preview selected items, and return the stored batch to this same conversation. Omit `--batch` only when exactly one eligible batch exists.
+
+```bash
+node skills/utsuri-review/scripts/utsuri.mjs serve .artifacts/utsuri/readme-example/report --interactive
+node skills/utsuri-review/scripts/utsuri.mjs feedback list --run .artifacts/utsuri/readme-example --status ready --json
+node skills/utsuri-review/scripts/utsuri.mjs feedback get --run .artifacts/utsuri/readme-example --batch fb_example --json
+node skills/utsuri-review/scripts/utsuri.mjs feedback answer --run .artifacts/utsuri/readme-example --batch fb_example --input answers.json --json
+```
+
+The current implementation intentionally uses `return-to-session`. If session binding is absent it uses `export-only`; it never invents a direct bridge or falls back to another conversation.
+
+Create local CI artifacts without uploading them:
+
+```bash
+node skills/utsuri-review/scripts/utsuri.mjs pack .artifacts/utsuri/readme-example/report --config utsuri.yml --output .artifacts/utsuri/ci-output --json
+```
+
+<a id="development"></a><!-- section:development -->
+
+## Development
+
+Run package-manager operations through the repository wrapper, which discovers Safe-chain 1.5.14 at its standard user location. Before its first execution, the wrapper verifies the platform-specific SHA-256 pinned in `toolchain-policy.json`; it then verifies the exact version. CI downloads the matching official release asset and verifies the same digest before execution.
+
+<!-- sync-command:check -->
+
+```bash
+node scripts/safe-chain.mjs bun run check
+```
+
+The bundled CLI protocol is verified natively so wrapper notices cannot corrupt JSON or NDJSON.
+
+The check and build gates compile the audited atomic-publication helper for the current macOS or Linux target. The manually dispatched `.github/workflows/distribution-candidate.yml` workflow builds all four supported OS/architecture helpers on matching runners, assembles an aggregate Plugin and exact npm tarballs, binds the release assets and checksums, and verifies isolated installs under Node 22 and 24. It has no registry-write permission. `.github/workflows/release.yml` runs only for an annotated `v*` tag at the exact `main` commit and confines OIDC publication to the protected `release` environment.
+
+<!-- sync-command:native-doctor -->
+
+```bash
+node skills/utsuri-review/scripts/utsuri.mjs doctor --json
+```
+
+<a id="security-privacy"></a><!-- section:security-privacy -->
+
+## Security and privacy
+
+Utsuri treats repository content, diffs, HTML, SVG, comments, Context Packs, and captured text as untrusted evidence.
+
+**Security warning:** never provide production credentials, production browser state, unrestricted external network access, inferred setup commands, or parent-process environment variables to a capture. Before and after use separate Browser Contexts; external requests and Service Workers are blocked by default. External HTTP redirects and WebSocket handshakes use the same origin policy, and persisted textual evidence removes credentials, queries, and fragments from absolute and relative URLs.
+
+`dual-url` never starts project code. `worktree` requires trusted input, explicit argv and separate working directories for both sides, plus the user's `--allow-project-code` opt-in. Child environments use only a minimal baseline and allowlisted non-secret names. `static-fragment` disables JavaScript and HTTP requests, sanitizes active markup, uses an empty-sandbox iframe, and is not equivalent to real-application rendering.
+
+`container` accepts only Docker/Podman images pinned by SHA-256 and already present locally; it never pulls an image. The image must provide Node 22 for the bounded request bridge. Its fixed server invocation uses no network, a read-only root and project mount, no new privileges, no Linux capabilities, a non-root user, and bounded PID/CPU/memory/tmpfs/time/artifact resources. Every request and removal operation is bound to the full container ID and an ephemeral authenticated loopback proxy. Connection refusal is retried only during bounded readiness; identity, response, or origin failure revokes the proxy. Cleanup succeeds only after a responsive engine proves the immutable ID is absent. Before untrusted content can reach Chromium, Linux must provide a writable delegated cgroup v2 so `memory.max` can constrain the complete browser process tree. macOS and Linux hosts without that delegation report a missing capability before starting project code. Host environment allowlists, secret mounts, and host sockets are forbidden.
+
+Every browser launch uses a random process token and must resolve to exactly one Chrome/Chromium parent. Failed launches and completed runs use bounded termination plus a global token rescan; unavailable tracking, ambiguous ownership, or any surviving process fails closed. Browser, cgroup, and server/container cleanup steps all run even when an earlier step fails. Each capture side applies `maxTimeMs` as a hard deadline to browser work and contained-file reads.
+
+Generated `report/` content is immutable. Referenced capture and comparison evidence is independently digest-checked, copied into the report, restricted to validated PNG bytes for images, and covered by the report asset manifest. The stored `index.html` always has the offline static CSP. A local interactive server may replace exactly that canonical CSP boundary with the interactive CSP; static-fragment previews have a separate no-script/no-connect CSP. Strict validation rejects active HTML, direct SVG, unsafe references, unlisted files, missing files, and hash drift. Manifests declare that absolute paths, cookies, raw environment, raw DOM, raw headers, and traces are excluded.
+
+Viewed progress, human judgment, comments, Agent attention, batch state, and answers are separate mutable records. Static mode uses Web Locks plus optimistic revisions, stores state per report in browser storage, and exports schema-validated, catalog-bound review and feedback documents; a stale tab never overwrites newer state. CLI state uses immutable generations and atomic hard-linked revision records under `run/review/`, including bounded inbox, batch, context, and answer sidecars. Import never rewrites `report/`, requires explicit re-anchoring for another report, never activates probable anchors automatically, and keeps changed or missing anchors explicitly stale or orphaned. Phase 5 pixel-coordinate visual anchors migrate to normalized anchors before persisted state, browser storage, or review bundles are validated; unmappable cross-report comments remain orphaned.
+
+Interactive mode binds only to loopback. Every API request requires the exact Host, same-origin Fetch Metadata, report ID, and per-start capability token. Mutations additionally require the exact Origin and exact request schema. A read-only GET may omit Origin under same-origin Fetch Metadata; if the browser sends Referer, its origin must match exactly. The token arrives only in the URL fragment and is removed from the address bar after capture; it is not written to report, review state, or events. Browser APIs accept no arbitrary destination, path, cwd, command, provider, or model. Every Review Inbox read and write checks the Origin Session and canonical project/report binding. Only a raw session ID supplied by the host integration is hashed as current-session input; the published opaque reference is never accepted for replay. A mismatch fails closed. The server, CLI, and MCP service never spawn Codex, Claude Code, or another Agent, and Agent answers never mark human judgment or thread resolution.
+
+Discovery and comparison manifests are bound to the collected diff/capture hashes; substituted or unlisted artifacts fail finalization. Finalization reconstructs the complete report from validated run artifacts and annotations, records the exact source-byte snapshot hash in the manifest, publishes only an immutable snapshot, and rejects source or evidence drift during staging or reuse. Utsuri requires regular non-symlink run inputs, canonical contained paths, safe archive inventories, a publication path protected from other local principals, strict staging validation, and the bundled OS no-replace helper. Missing or unsupported helpers fail closed; failed generation can leave a private staging directory for manual diagnosis and never deletes it automatically. Mutable human-review data is stored separately in `run/review/`. The static viewer does not contact external services.
+
+Code diff content is parsed into structured lines and rendered only as text. Repository-controlled diff text is never injected as HTML.
+
+Build output is one Node 22-compatible ESM file with no external JavaScript runtime import. It embeds the pinned Playwright package metadata and browser registry required for capture, and an unrelated-project smoke test proves that capture does not read `node_modules` or checkout-relative runtime files. Release verification rebuilds the bundle independently and checks every actual third-party bundle input against an explicitly regenerated, reviewed dependency baseline. Build-manifest 1.1 records those byte hashes; SPDX 2.3 records lockfile SHA-512 checksums and installed-package verification codes. Matching metadata is copied into the CLI and Skill artifacts.
+
+<a id="documentation"></a><!-- section:documentation -->
+
+## Documentation
+
+- [Canonical detailed design](https://github.com/hokupod/utsuri/blob/v0.1.0/docs/design.md)
+- [Phase 4 threat model](https://github.com/hokupod/utsuri/blob/v0.1.0/docs/threat-model.md)
+- [Release and distribution guide](https://github.com/hokupod/utsuri/blob/v0.1.0/docs/release.md)
+- [UI guidelines and HIG/WCAG traceability](https://github.com/hokupod/utsuri/blob/v0.1.0/docs/ui-guidelines.md)
+- [Capture modes and runtime boundary](https://github.com/hokupod/utsuri/blob/v0.1.0/skills/utsuri-review/references/capture-modes.md)
+- [CLI contract](https://github.com/hokupod/utsuri/blob/v0.1.0/skills/utsuri-review/references/cli-contract.md)
+- [Origin Session feedback workflow](https://github.com/hokupod/utsuri/blob/v0.1.0/skills/utsuri-review/references/feedback.md)
+- [v1 implementation plan](https://github.com/hokupod/utsuri/blob/v0.1.0/ai/plans/active/v1-%E5%AE%9F%E8%A3%85/README.md)
+
+The design is canonical in English. User-facing README changes update English, Japanese, and Simplified Chinese in the same change.
+
+<a id="license-status"></a><!-- section:license-status -->
+
+## License and publication status
+
+The publisher is `hokupod`, the npm maintainer is `hokupod-npm`, publication uses a manual exact-tarball `v0.1.0` bootstrap followed by GitHub Actions trusted publishing, and the SPDX license is `AGPL-3.0-or-later`. The source is release-ready for `v0.1.0`; the five npm packages and aggregate Plugin are still unpublished. Candidate generation performs no registry write. The tag workflow requires a protected `release` environment, exact release-asset integrity, native published-package smoke tests, and a draft GitHub Release that becomes public only after every asset upload succeeds. Because trusted publishing cannot create a new package, an authorized maintainer must manually publish the five exact initial versions; those writes do not carry GitHub Actions OIDC provenance, and the release guide requires non-secret source, candidate, tarball, publisher, time, and registry-integrity evidence. Later missing versions use the protected trusted-publisher path. No repository change alone creates a tag or publishes an artifact.

package/dist/build-manifest.json

@@ -0,0 +1,287 @@
+{
+  "schemaVersion": "1.1",
+  "toolVersion": "0.1.0",
+  "sourceHash": "854c79ca7263ef55825568e9b7b8a70bc24e6e1c5915fe5b89e28d29e109450e",
+  "sourceHashes": {
+    "packages/adapters/generic/src/index.ts": "0fb851c88f14187773d97373b9d848e831abb629bb4b1834c4393f29917c4169",
+    "packages/adapters/playwright/src/index.ts": "7714950f8fbcc160493e649a13e2c96d2843530307150357c30b9155c42b6081",
+    "packages/adapters/route-manifest/src/index.ts": "ad7e3b751daa21942efd95f2c8e98f8af975ac664e645941c6fa01d160c41590",
+    "packages/adapters/storybook/src/index.ts": "c585806d51e46dec7569d8f9b7ac587ca329c7c7ebd286d5c290edc3e85de767",
+    "packages/capture/src/actions.ts": "7778fcded209e74c8a5b32693bd844627e04290de235e5417fe15bdc9c1501cf",
+    "packages/capture/src/artifacts.ts": "7f234498939667750c17a33f71160e2f992af21acaacc3a3acc3145353ef15b7",
+    "packages/capture/src/browser-process.ts": "4c09c20596d13570831325d6a21206c364e88c26fd3090e7a5fe274293047d17",
+    "packages/capture/src/browser.ts": "720488c4b1de50756ff3b2ed5f671307e6c699d90263d022cdc608d2b25a686a",
+    "packages/capture/src/capabilities.ts": "e957490bfaf2018862b6c754abd3382793a94e8098639c81ccfc520292375df1",
+    "packages/capture/src/capture.ts": "bd23e90c9fc7094ae38cd437079a534a4d755cc73f5fbaae4840ec1a05b82c64",
+    "packages/capture/src/config.ts": "87b8576f6906976168c21b17bc21a406fb2d9a99858213764f1b1a71a888e5dc",
+    "packages/capture/src/failure-evidence.ts": "56ade21ffc963fddd2cbf0069d9748321b1891ca53ed6af5ea826d8de9a3511e",
+    "packages/capture/src/index.ts": "a313309ecc7a849f21779644e1ecc1bb366de2bb20023ff7babb5c6cd196bb4e",
+    "packages/capture/src/network-policy.ts": "0575d09b6ee3f44e691dc509b4c0e1c9984deebafd67d90ac259d10873b5edec",
+    "packages/capture/src/redaction.ts": "dcc93cdd6693c4f70156a07836d9d0be4e8940798dbc5757fff0ca421a7f3710",
+    "packages/capture/src/runtime/browser-memory.ts": "e1cc8bfeaf5d76bb8162c39330e6c193dc7a707fce5f9089fd0072de02d50483",
+    "packages/capture/src/runtime/cleanup.ts": "52db4074dd47a789cd08843c6291392a68837961d47a84804e199e6400698294",
+    "packages/capture/src/runtime/container.ts": "d6f53ec8d03dcf2f9774436c533fc0cd6dd72c85fe7f1d60f4f3daf5f3c18452",
+    "packages/capture/src/server-runtime.ts": "8b4055dad80efa008548c9efcd502f80ca29abcfae062c63fa3cf701a41a0472",
+    "packages/cli/src/arguments.ts": "0ab06574a833531cb6084b555d11847d6deca4fd082fa3035c5e2a72a8870005",
+    "packages/cli/src/cli.ts": "4a997a2454408d380a5867a42e306acadc62cc1913d10453be60dd1c80c58273",
+    "packages/cli/src/doctor.ts": "fdf26a40387b433878e257c3f857348e6bbe510e63b56a6a9623c1a5b6876287",
+    "packages/cli/src/feedback.ts": "471f35bc1e0b1ed51aaccd7e17732a34f60634756ec8641ad2a37d910fc71492",
+    "packages/cli/src/init.ts": "5250d75ae8de6a7471bce58ff4f1b27b830cbf090bc55a8ec16c9125376cfb65",
+    "packages/cli/src/main.ts": "e6beef0b206175e8bdf0f3b65b724dd4aa07e097d67847125fde1569b35370c5",
+    "packages/cli/src/pack.ts": "2e59a6fd8c28adaa34219eb1b7f2467d1f742f8fc3cf6c55925dc002cc2be2fc",
+    "packages/cli/src/review.ts": "6dd667da53cd5efae84899e23d2381ab3a04193b3ca0590a3c39802e69187709",
+    "packages/cli/src/serve.ts": "0a3a302b5b2630354464b3fc6c15ac838649879a820a3a4db0df09f033e4cf88",
+    "packages/clipboard-handoff/src/index.ts": "87e3bd52dee66181afadca1c36cd8cbb1472c2a21933a16b1a72721496aeca90",
+    "packages/compare/src/compare.ts": "5cb78949b536e37cbd588c90bd3ad10d28c26160224de1573650aa4c0bb82919",
+    "packages/compare/src/index.ts": "dd34a0987ceabe4eff6d08da1e03e56f306b71891488cbcaf88ab4421242de20",
+    "packages/compare/src/regions.ts": "e2cf7ed1a157176c4e621cd037bee028dcf4e508865ef321af5a565e7975d631",
+    "packages/context-pack/src/index.ts": "c4b42672a3b07a0e6b20e1f011aa0a65832e06174386329056d4dc191f462a28",
+    "packages/core/src/errors.ts": "05da8fd2b6ef9c7a09b17988f59aeb0cc51217d2e921c8fc9f58125e7e8f8d15",
+    "packages/core/src/git.ts": "707ad00f7f166238b83134debabaea9219ad026e6bccd3694e13017963b7aa64",
+    "packages/core/src/hash.ts": "58b6650d0dddc029596da9c349329a484b94c3cd6ef6bf01d0cc09fe0a648125",
+    "packages/core/src/index.ts": "732cfe3b6d7417e4bf20d0bdeee085dd6a467d767ab3b38695fb38cca5f90872",
+    "packages/core/src/ndjson.ts": "64fb9e0082767655dcde016ae40e3ebcfad8b9ca3af03fd041deaf612d29c937",
+    "packages/core/src/result.ts": "25166cef1f6792a928852749b543f2d702b19feca6720290fbfe84c55217a4b0",
+    "packages/core/src/semantic.ts": "ddf44325a984993038f4509db10c5da1a37df958dbd8d528a609888cb551f3a3",
+    "packages/core/src/status.ts": "df429264cdafb4ba27bed2f5f3ee07f22074909567a266c9ee32be1eb513e6ba",
+    "packages/discovery/src/discovery.ts": "49c6c2186339c39ac80cee874ab4abf89d30232a1c50eb8eb72a8d40337c173e",
+    "packages/discovery/src/index.ts": "b3748f8385fec4fbad5712dd4cb446e13c3e39db2cbe799b58dc68d72f124e33",
+    "packages/git-collector/src/git-command.ts": "c0be77faab759db9cfa8736d44a8a36cd6868c841cf90025ecf75118cf8ddeec",
+    "packages/git-collector/src/index.ts": "c8686ef8faa57f1fa17a105a57f7306ff8372de171f9469ae6e22aa1b278f86d",
+    "packages/git-collector/src/patch.ts": "2ad71151ca382bc5be3b9396e60aeb36394151e5ae5670687414f967fa893e96",
+    "packages/interactive-server/src/index.ts": "66bac04d327797d4d57a594f7032b87f0a32dd8ccd3c1ed1647bcf1b6a87b5b1",
+    "packages/report-builder/src/generated-ui-assets.ts": "7e0bc643e805e3d1e3af0438fd21e7bc6d8cba9e6fb93bedc9b54f9cc1d75fcf",
+    "packages/report-builder/src/index.ts": "9b3822c279dd29cbbf5fbda74f294d00f93ad0d7cc432ed06506a7eaae7fcc17",
+    "packages/report-builder/src/native-publish.ts": "1476a27dfbb7172caf656b996b7aa71ca8c7ec3ddf1d85ee0028d11a3029f222",
+    "packages/report-builder/src/schema-assets.ts": "ef080b08889e19f291d92f260fc4f731b1505552c5f3481734de9c6414d0c23a",
+    "packages/report-model/src/index.ts": "f93ea5cb121a43d8d85254f6da3a129b7c35cc32911523e263dabd9a13e33a66",
+    "packages/report-model/src/validator.ts": "2bed24889f93dd4cdf385cf96f5c7b27d745396aec357a3ddfb1095a6b3cfba7",
+    "packages/review-inbox/src/index.ts": "f05a3f004952c5752b842eb0c3b5cae5abcf7ad9c38c3d628a4a18ac42745832",
+    "packages/review-mcp-server/src/index.ts": "9f0c4e0db459a493bed31afd21590d9742b8b72c931b848fa73dee6d988562f2",
+    "packages/review-state/src/anchors.ts": "5e1488281d5fc2ce64bda08649f8fd14b9993ad0d48b667a07d2e1587b314a42",
+    "packages/review-state/src/canonical.ts": "844b47cee854771c920f55e24d25d1487551dd4edff80ce90b7914bb4b63c434",
+    "packages/review-state/src/index.ts": "f886a53f98cf9de1ab3b3172417c319f9edf8ca2dc37a5cbad78647acdb685d5",
+    "packages/review-state/src/model.ts": "523b4f5ab2cc1ead45e272285b93835b29846b74ae1ae9458d5149c4550c2926",
+    "packages/review-state/src/persistence.ts": "e825604b9cafac8d22137075e9846fea53d5ea924faaac2aeb6dfbe246f1520f",
+    "packages/security/src/index.ts": "a161e28fc3cc3e62f75fed63d3ad8eca363af6f255f27197882c2b2398e2ca50",
+    "packages/security/src/native-helper.ts": "37cad92c638993ccdb694466a35f5e16fd5cd47e918a4194e94347f6d51eb4bd",
+    "packages/security/src/report.ts": "61d67acfeb62d4b86fdd56c9f054fbeeba545a394cb683dfba47710ddfc83add",
+    "packages/session-binding/src/index.ts": "57221d67fcff2d6922287a1efbcef7074e7c1df847b09466a43e3310b075825b",
+    "schemas/annotations.schema.json": "463cd4ca0baeca7c17624d9b7a260471713c1f2e3a0380a1f21643c40ecc6061",
+    "schemas/capture-action.schema.json": "9639715c364b0ea8791523a3bc7206d0c5f67acb81380324f25ba22eed79fc05",
+    "schemas/config.schema.json": "4710b6e8018d8bc7fa272bc9bfcc87b65439908380f716e3df97bcf24f517ddd",
+    "schemas/context-pack.schema.json": "9e2b7f19ca6db78f72de6f4ce0acb287c8ed64b94e8dca32fee194e6f5e26fa3",
+    "schemas/diff.schema.json": "be0188f12c5b4ed65957d9ac1401007f8e31912a0f21ed2af8e33ce274e9ebef",
+    "schemas/evidence-index.schema.json": "2d907acba09f208673849354afc8cb5aa788b8b213658e04641b3ccdeafd7c4e",
+    "schemas/feedback-batch.schema.json": "1da68f409506fd1a1f999785f666f15883e7c8d51a57b7996ba73b61eb3c24ef",
+    "schemas/origin-session.schema.json": "39e49ff5cfa7fa033cca453048a1e8b0ae631ddc98ca10e9d1bcd8ecb9b33538",
+    "schemas/report.schema.json": "8eb9f70ea1ae6897bf48891d67ab1245f6ef3a3a177bb212633a6546f3fb12dd",
+    "schemas/review-answer.schema.json": "fd7765261d2c71c0cf9fcd604f0607beeff6d21d59402468cf2ff84a57b4c42b",
+    "schemas/review-bundle.schema.json": "5f445f745da093f565669ce13a3eb59e182eabe98c3df1b51f8b49e4b67b33d6",
+    "schemas/review-event.schema.json": "57c75a0383645435e20e752cb24de9517929381cf2d3b684575dd8d053e12ad3",
+    "schemas/review-plan.schema.json": "75a3cbc0cf5a29820f1dac4148e51c4f413c3b7fac7d8bcf7484347c7387437a",
+    "schemas/review-state.schema.json": "27f9f98344a2b94b75f84fef9bba73978bbacca1e102ed11e459d247fbed7552",
+    "schemas/review-thread.schema.json": "6c5957f14b964dfaf1601ac45870b7f3fae013209dd4964aa3831dd753f06fc1"
+  },
+  "dependencyBaselineSha256": "c97e2e60205f99e8e20e08cfed3fac552c9e5810dbbb79847e8b27664e54ee3a",
+  "dependencyHash": "597d8867ab9712efda0d971040c5841996fe059b15bef239b2a6f84303b3223c",
+  "dependencyHashes": {
+    "ajv-formats@3.0.1/dist/formats.js": "b61693a26869970a92cc1fe832c931ccd3afe8b6d66802b19c48306349e84880",
+    "ajv-formats@3.0.1/dist/index.js": "3f3014150293846086d11058bb8bf43e669e354a98b37adcf10281454d5e753b",
+    "ajv-formats@3.0.1/dist/limit.js": "ffc374031a55c3f6e39dc3fe69e663f8251b9d9d7ddb8f513a6807c985c18bb8",
+    "ajv@8.18.0/dist/ajv.js": "edaed56fc546f5551b0d6dc2ff2a9cc25c2d6c83318a086eaa8c3ad0b2479297",
+    "ajv@8.18.0/dist/compile/codegen/code.js": "1287153722f1fc3c5342647de7ae1d7b6fb68bdb3378a0776a937d273fc97e0d",
+    "ajv@8.18.0/dist/compile/codegen/index.js": "f03b2b72597ef86878d1d4030580c2d0964046efad4867f3d05aa91065ba034c",
+    "ajv@8.18.0/dist/compile/codegen/scope.js": "d2a0a97af2faa2cad88702314fe421e235ab17f11e0d62883d58d8d4dc734286",
+    "ajv@8.18.0/dist/compile/errors.js": "53990f8f2cc05922bba410ae68231d3f869de4f8343277ede5b4834fa564c6c2",
+    "ajv@8.18.0/dist/compile/index.js": "05b34da22814f3787bfa3ac68dad59c9047f56e55a607e0a20719ebf5afe69ac",
+    "ajv@8.18.0/dist/compile/names.js": "3cab37a2240b996b9bed92fe7a041d91689cfe3ad2e9ae4c0ab99e4146408493",
+    "ajv@8.18.0/dist/compile/ref_error.js": "81c98fdf34c3037c91bfcc02277ec32156c71e34048f36cfe4e084416e916cb7",
+    "ajv@8.18.0/dist/compile/resolve.js": "df75af0e0cf03fa1c6452e8dc61019f5aec645a8a5f6f494dc4e13cb5502d2d9",
+    "ajv@8.18.0/dist/compile/rules.js": "ec1d86500f497aa8e20f9f0c1695951159d9a909669d00a261ce1bb22b3cf0a9",
+    "ajv@8.18.0/dist/compile/util.js": "fa911f5631f29d4d6420adfe086cb693b94b08de2719475c78c54bcb82f831a5",
+    "ajv@8.18.0/dist/compile/validate/applicability.js": "50c5cba5894a7fb9874b3432355b46ec71b73c9368dafb1323ded8567cca8fc0",
+    "ajv@8.18.0/dist/compile/validate/boolSchema.js": "c08abdbdbd3d8b1dcc0552a20fbc7d837ed44f4ca6abb2e464985590ac94377f",
+    "ajv@8.18.0/dist/compile/validate/dataType.js": "697bd7005361ec7066a23c18830a10b0ef28aec1a33138b4e3098bf78c4fae52",
+    "ajv@8.18.0/dist/compile/validate/defaults.js": "05721971df94faa57b09c8cfd60c2eef81b6d14910a7dea5f539d693a029c428",
+    "ajv@8.18.0/dist/compile/validate/index.js": "cb2103e5f890e04592c10d24b45857dad91155bae9f9460138a2459bdaaea2cd",
+    "ajv@8.18.0/dist/compile/validate/keyword.js": "ab8f070c75c25eee9be5c837f364748909b58f5db66149a2beccbd2f66afeb76",
+    "ajv@8.18.0/dist/compile/validate/subschema.js": "ca783d6052af91e65ebb59a5b48b47fb459a2241d37ca6a042f767d4ce451bdc",
+    "ajv@8.18.0/dist/core.js": "7fdd03e949ecb3d020e560f669da71ce69a70f4bca28e5aff2ebc34d15bc2134",
+    "ajv@8.18.0/dist/refs/data.json": "d24ab8a97c18b3f5afdde7d7024a0e0ac1df0614a16a41cb88f81379edcc2db3",
+    "ajv@8.18.0/dist/refs/json-schema-draft-07.json": "f7e8b13cad4fecff9771f3626fef33e20e59027b90938a28fd9d2f6c17cd0773",
+    "ajv@8.18.0/dist/runtime/equal.js": "c94467da09ee94e5d194483a7ab821b9bb3bf1c04397270f2ab53dea9de59274",
+    "ajv@8.18.0/dist/runtime/ucs2length.js": "1df012dd3d23fced07255a7204798004509687cb1f431ae0ab976db436bbd890",
+    "ajv@8.18.0/dist/runtime/uri.js": "d1d61baf97ed87d7310df847a78ed73d19c8cc003207bf5aaec977500bdb1578",
+    "ajv@8.18.0/dist/runtime/validation_error.js": "11bf5b4affc8114e5e7cdf65b93006c2d997ab60ada1152c22e136f9b828b815",
+    "ajv@8.18.0/dist/vocabularies/applicator/additionalItems.js": "7beb0fbda5e349907067c8398bb8cc3260a6267b6e5dff9793a5ab2171934099",
+    "ajv@8.18.0/dist/vocabularies/applicator/additionalProperties.js": "e237cb180cd2e3f2e676feb714d7dcc6a42116640f9db2ad830cd20d9dfc540a",
+    "ajv@8.18.0/dist/vocabularies/applicator/allOf.js": "98f46a6434ebe5f851b406480e18b776dd7f1bcc275e28c16a13bfef3cc067c7",
+    "ajv@8.18.0/dist/vocabularies/applicator/anyOf.js": "8d7368d4aebad0514b713191b934993b4f0bf570e1bab93b07dc69712db2cec5",
+    "ajv@8.18.0/dist/vocabularies/applicator/contains.js": "56165dc93cd8b0b4611db50a97f1e7d7f9af6c5ffe95a7a5b054d6eeaa7f6a8c",
+    "ajv@8.18.0/dist/vocabularies/applicator/dependencies.js": "c1a83bf484b6fde4d268935f079ddba5e74a2f589dfc6d15ca2e20ba4d06ee5b",
+    "ajv@8.18.0/dist/vocabularies/applicator/if.js": "42374ee5dc681433579cc689b0c4ae5343f5bf78d4d6a561722b9277c5335ec4",
+    "ajv@8.18.0/dist/vocabularies/applicator/index.js": "5a61978f6d81bbabfa8b9ccb71d7de816ed6dd1fd7de5c72657439a76c2a7cb3",
+    "ajv@8.18.0/dist/vocabularies/applicator/items.js": "fa87f74adc3aac1f1b5e3e7dddf73294e6850e1dd49ed131fca4352e9645c54e",
+    "ajv@8.18.0/dist/vocabularies/applicator/items2020.js": "c449ef64aec16263c7935293ed450cfc2da3ba66f6df5f99c3198c05f169838f",
+    "ajv@8.18.0/dist/vocabularies/applicator/not.js": "ab2f2758d4ea97ac8763fe5540dd0f4d877859676fe5d6c750a18deca387f718",
+    "ajv@8.18.0/dist/vocabularies/applicator/oneOf.js": "e2aeb6c22d49fd5f348bedcf7f5c4d7b31f5a05dd7ff1a0c531374c6968792a2",
+    "ajv@8.18.0/dist/vocabularies/applicator/patternProperties.js": "0d43da49a82452c439ba990de7372ad5cedb663717918a5f6dae07025abff655",
+    "ajv@8.18.0/dist/vocabularies/applicator/prefixItems.js": "16264f7b3233a6dcb98b48700643efbd3ebc4d11e27b3eacffc83ccb5f44fb23",
+    "ajv@8.18.0/dist/vocabularies/applicator/properties.js": "c896873ae7251093a2c8880545b69b6e8cb55c44817a53ec830a49818d74104f",
+    "ajv@8.18.0/dist/vocabularies/applicator/propertyNames.js": "b3411cfeaff8efd5e6de12971bb5dc339e64b61fbe62d3b950794c077315c2e7",
+    "ajv@8.18.0/dist/vocabularies/applicator/thenElse.js": "9bc42eb8699d57188a7ec2a710d3f38052f92bd78c5d4d0442cf98cf2ebbe22d",
+    "ajv@8.18.0/dist/vocabularies/code.js": "9212ddf8bd0a4c3b1c4b44cdadd141183b2b36f561b91d13df53c83911e3bf63",
+    "ajv@8.18.0/dist/vocabularies/core/id.js": "49c8eff694ce4371450c1f9986e934fcbf4bd143311caef5332113f29175bc11",
+    "ajv@8.18.0/dist/vocabularies/core/index.js": "f420e1011b95e27b54c58323a7ed4ffbd0a88cdb4496f771bb6782c2aa22d23e",
+    "ajv@8.18.0/dist/vocabularies/core/ref.js": "1422c1454b3621d890066042048f37746fe1cf213088307099816199889bbfd1",
+    "ajv@8.18.0/dist/vocabularies/discriminator/index.js": "b58b58025d2dbe5a6967376faec9295b860a338664c47037e9a1035c1e8fb88e",
+    "ajv@8.18.0/dist/vocabularies/discriminator/types.js": "2365341d1f30dc72cece7703e908e47aacb8f904b9f66ec4019fe889ae1e57fa",
+    "ajv@8.18.0/dist/vocabularies/draft7.js": "8c62022c6c3aa302c3ea6f6709a697fc9eb6385d243fa7c2156dbe9f02228170",
+    "ajv@8.18.0/dist/vocabularies/format/format.js": "6fae0d5124fd821b1a9959492f7d6d7b528bee8830d49a7a4759fc9a9ab81d5f",
+    "ajv@8.18.0/dist/vocabularies/format/index.js": "d5dad5f95c9c5f48f8ca956cdbb927aafc7b56baabfca8c0b0403d92c5ebeb67",
+    "ajv@8.18.0/dist/vocabularies/metadata.js": "45c178744a7ec57e20c85ceeaea8d9f36b5663636ab7e495ea2c3c1bf4a58609",
+    "ajv@8.18.0/dist/vocabularies/validation/const.js": "ace994e9ab97a70899a9484794794f4be5ee03bfb3cf32242d3f091d77f0329a",
+    "ajv@8.18.0/dist/vocabularies/validation/enum.js": "61062b318a40eb52fc5a8283e7f4781db98349841744961ef4fe04a4722ebf22",
+    "ajv@8.18.0/dist/vocabularies/validation/index.js": "4a1839832de5f10ff423c1c0c6cb232b5b6e1b34980a28862cf56b2763136de4",
+    "ajv@8.18.0/dist/vocabularies/validation/limitItems.js": "49f0427d29b38aef2fa8aead26e68bda12deb9a2da22f7a7804ba0fed44e1fec",
+    "ajv@8.18.0/dist/vocabularies/validation/limitLength.js": "379c28317faaf7784680b6049c3562692d3df6d65cce33f48e6c6c723beeeec2",
+    "ajv@8.18.0/dist/vocabularies/validation/limitNumber.js": "3dd4bd41dbfc76c522078ff54b6479683485c4e97faa04cfcfaf2d8cb0fb8e65",
+    "ajv@8.18.0/dist/vocabularies/validation/limitProperties.js": "8523a3f7b36c34882ca32b0ec71a2157d7930907cb86b778a97c1514fa6258ac",
+    "ajv@8.18.0/dist/vocabularies/validation/multipleOf.js": "df128c2a6ca74ae57c65fbfe3aea8a101447a3ae8c41fd53cfc5693fa23cc8bd",
+    "ajv@8.18.0/dist/vocabularies/validation/pattern.js": "86e84206bfc6a66ef18bf1fe43fbc56ebe7f7f4d57841197b6d044c529e0c195",
+    "ajv@8.18.0/dist/vocabularies/validation/required.js": "b953bc18d94274bd73374dd5b4282d7a21159cec8c0e7a357e1eaf3f326b9054",
+    "ajv@8.18.0/dist/vocabularies/validation/uniqueItems.js": "666d1a2aa25c0dfe3cf41312d0f9d40e9f99eb2c19be7469134ad89005aadd52",
+    "axe-core@4.10.3/axe.js": "beeadb8d4043458482a8432dd227af926d1baf378ffbcd63888e91ec0ca8535d",
+    "fast-deep-equal@3.1.3/index.js": "eb469e206280321a3878f2335ec98aa2104a155079d8ed83a23029098dccd215",
+    "fast-uri@3.1.5/index.js": "79945eb0b513058251bd1c3b518b86c5c549bb73b8c37c77d717133d66277a97",
+    "fast-uri@3.1.5/lib/schemes.js": "0f9497f8e43c9b002d79c8a916709daa4ae8a6462735b1b5dc6ad587a28a5064",
+    "fast-uri@3.1.5/lib/utils.js": "3394986f9670b821493943faafe5d83ccc15109aba908f1b5dd017e27b0d0ea7",
+    "fflate@0.8.2/esm/index.mjs": "b71c2efc7bbd3379c883bc59223c53f5ddb47a6db4f01adb19675b213bed0e9c",
+    "json-schema-traverse@1.0.0/index.js": "024191b747afac01b28ff11d744e9f82720bbad5f716163ba5c962eb62aa2350",
+    "pixelmatch@7.1.0/index.js": "972e5a5387dde3b6d85ab77337d59ebafca988bf220145caa4b27dc742134dc5",
+    "playwright-core@1.61.1/browsers.json": "ee39bc924bc3d1bd895626c2910f1292d109bbfeeb5abd113acb45e1951cc942",
+    "playwright-core@1.61.1/index.js": "a58fb2cec4293e7dcf73c58a179898a4f3986666451a19da4e731fa3af63265b",
+    "playwright-core@1.61.1/index.mjs": "3d36e2132d3c8b62397d23f0bb4177336aaee503203ae2a2c90fbeb5bf3317dd",
+    "playwright-core@1.61.1/lib/bootstrap.js": "97ffe165e8e45f1b51a713b3f380d383e4e183727135fe9a5e045ec62e9310ab",
+    "playwright-core@1.61.1/lib/coreBundle.js": "6be5c2ea035554e9b184b1dbc7aa5e7f1fb428dd1b5c202022858dcfae9bee27",
+    "playwright-core@1.61.1/lib/utilsBundle.js": "1295945f0054d2504c9b751945b15aa3c672530ad5a340f3f9636e5e238f304a",
+    "playwright-core@1.61.1/package.json": "759e376f995bf39edd4810d699b99469bab1d7428b6fbc78d41912f367df7ba9",
+    "pngjs@7.0.0/lib/bitmapper.js": "3f2f720e3a2b4e41cdc03e9f58bb1794bec26dcd1b22568e41ce0b84ab20aeb5",
+    "pngjs@7.0.0/lib/bitpacker.js": "3f7bfabcbc82bedd0cc8551bc210b44dc1fb179fa2ce3b8b1d39fa307d8af204",
+    "pngjs@7.0.0/lib/chunkstream.js": "43c5507901554a29c5a29e555aaeb3c3987b84fb3aa8c681c1b30794a477aa85",
+    "pngjs@7.0.0/lib/constants.js": "9e3b4f994ac93751e9ccb4d453e85e4f25a0b086a9f24ec92c7dcb06995bdf6c",
+    "pngjs@7.0.0/lib/crc.js": "57e2328cfa361fb54f1f4b3a59e071c1ccc864095e4f3759a957cd15aa2a8b65",
+    "pngjs@7.0.0/lib/filter-pack.js": "500c1b3b34702c895e9e689143f44280687cac363447523679ec13d12bd564f6",
+    "pngjs@7.0.0/lib/filter-parse-async.js": "328b6173f1a2a4d91425220a0fa421699552f254006a57ede9f4018ced50a7ee",
+    "pngjs@7.0.0/lib/filter-parse-sync.js": "201a08dfab26a2903c0dabcbdfe0406b3fa33d60f59b591878329f590fac48ff",
+    "pngjs@7.0.0/lib/filter-parse.js": "b8aad6f29371f5b13b232643781a7c49f7d36d565136ddda1ed7fbaca987ce2c",
+    "pngjs@7.0.0/lib/format-normaliser.js": "c73989d85bef5d33ce571095bf0d96927261730d8b0f79c9d48f971fcbdd0be0",
+    "pngjs@7.0.0/lib/interlace.js": "3bb5d57153078ff586667e9a9d2c06db993c8ff1638e0521a9883cdeea6e1e3f",
+    "pngjs@7.0.0/lib/packer-async.js": "f50df0610749ce7b1a99abbe9e4596df7c16f96efd3848f12dd632b22cb02b45",
+    "pngjs@7.0.0/lib/packer-sync.js": "1b516238168a42704e62ba44528406188864a6ddda2ae92d1b91e5e078cdaa2d",
+    "pngjs@7.0.0/lib/packer.js": "b5f9956364c80d67c28d615ace639a5fb4d4d79d3acb235237f3050dca220e03",
+    "pngjs@7.0.0/lib/paeth-predictor.js": "48555b909af708593dade8e8df75d18ecdffdb6577e362eac01eae357ef1e0e9",
+    "pngjs@7.0.0/lib/parser-async.js": "a0299cad35220de62b7180b1f984b8f77b4c0f419a580fd3c86ea3b3e971ee30",
+    "pngjs@7.0.0/lib/parser-sync.js": "266c9fb230b90075022b3f54f5710a9cacb71ca565f83fce66e7cbd1b7e9b507",
+    "pngjs@7.0.0/lib/parser.js": "574e43fea28a28cc6feb7ab62a480a86bb75411ee4bfaba76a7e9d7310b6e94c",
+    "pngjs@7.0.0/lib/png-sync.js": "867b1a78dcd3e45458eb4f0af01acd48f38d3a31225bd7cb8dd8ee3966ab54be",
+    "pngjs@7.0.0/lib/png.js": "e02cecbd36327829758386dc3f0ca4a36a2339ccb5d5e824ca3556e2c3f89726",
+    "pngjs@7.0.0/lib/sync-inflate.js": "08cb8afb79a4c0ab58e94601dab22261daf6638382b211d6a7f6bfbc16d27a0b",
+    "pngjs@7.0.0/lib/sync-reader.js": "437a99bf1bf739202ae85c3018cd9174d411597cf55e7064c36976de493368f1",
+    "yaml@2.8.3/dist/compose/compose-collection.js": "a7db11a1a7987d6412df8adbbb85ccd4370171f82265703b2b6af2d13c45d646",
+    "yaml@2.8.3/dist/compose/compose-doc.js": "0f388537747b5c1a241639413f17fc2b5f831451b5017d6902e46db6842a5fe4",
+    "yaml@2.8.3/dist/compose/compose-node.js": "86562c85e4e5737d28b24aae2030b97bc9b672e1f2de5da9e4d25c4571e4345c",
+    "yaml@2.8.3/dist/compose/compose-scalar.js": "37920472755bdaa76399b6d33872f0015ae1fd9ba7faa031c03d501aa8c3e903",
+    "yaml@2.8.3/dist/compose/composer.js": "0b9628cf1fd700b8f7a23cadae49071cec7add35be023402e079f6e40305f131",
+    "yaml@2.8.3/dist/compose/resolve-block-map.js": "dcfada448c8fc532ebba96d6788a4b41bb015fc5e697a9544ff429b9c4e4c70a",
+    "yaml@2.8.3/dist/compose/resolve-block-scalar.js": "af562e2e3cd7ee7b3cb9342984177f6b5c77de73121e87695db3ff635e12d152",
+    "yaml@2.8.3/dist/compose/resolve-block-seq.js": "18f54a39d73b600ebbd74a343e6671d0d08423f125bd86963b72dc24d6261911",
+    "yaml@2.8.3/dist/compose/resolve-end.js": "532bf56299183e75bb7c20db75321367c28393b66ecb8ffd540faedd9817f116",
+    "yaml@2.8.3/dist/compose/resolve-flow-collection.js": "242470b54c0deba1507babba2e879f3005ed2ee3bd53a36affb6ecf82fddd375",
+    "yaml@2.8.3/dist/compose/resolve-flow-scalar.js": "2808392f0827e658ea2cb2fc5d973e78f29750c6f159db96bfdf261bceec131a",
+    "yaml@2.8.3/dist/compose/resolve-props.js": "0b49c6af0145c309883dbf24d1a00260c0c090412be10aaa301de126dad15983",
+    "yaml@2.8.3/dist/compose/util-contains-newline.js": "60182618fc9fa669e74ab74f4231c15b5d24bc52ab0a419684bb827a00d69be6",
+    "yaml@2.8.3/dist/compose/util-empty-scalar-position.js": "460516395ef7e961d5248e047ee6d52084f279b76e8af9f3c2bac92da1c7d656",
+    "yaml@2.8.3/dist/compose/util-flow-indent-check.js": "c7c0c9837a1f828de19eb3ee0947dff39c4f69222c762aed9fa2fe14fc46ee3e",
+    "yaml@2.8.3/dist/compose/util-map-includes.js": "0330dc34072cb499493176b293228631ca8ebaaaddcdc0e63b02bf24f6a25c2d",
+    "yaml@2.8.3/dist/doc/anchors.js": "ea9a479b1e98d88235ffa6736d0405e2119e9dde7b5249b72185488ab2527261",
+    "yaml@2.8.3/dist/doc/applyReviver.js": "7271668f41f264e4b9aeb184629cfd11c510b401c5a797fa7194d17a9652976e",
+    "yaml@2.8.3/dist/doc/createNode.js": "a39d14026d4cc6ff8d76d90db30c41facc26a146ebed30783bcf28e40b5caa65",
+    "yaml@2.8.3/dist/doc/directives.js": "8f02c3c03571e377e33680b68027d4336234d7a6da3d8c6a8b7f1183c1c428ff",
+    "yaml@2.8.3/dist/doc/Document.js": "9bc1c9a56de3902d554e77193125b6aadcfaec743073b3417b22c95a8f7d7923",
+    "yaml@2.8.3/dist/errors.js": "c389d9c448193ce1bcb9641f5eda62cbe56467b2104357d2fc8dd86df88cb07b",
+    "yaml@2.8.3/dist/index.js": "2d58984e0ae80de4acbd8f009fab332f5ce77d9e1a5f138a3058a0ada6567fb9",
+    "yaml@2.8.3/dist/log.js": "f6ccc3593357801851aa1023b202f842733043ac3b25773048d836f89de8108d",
+    "yaml@2.8.3/dist/nodes/addPairToJSMap.js": "e4977864d75c1fdbf7fc78c9f4329406e153deccfff090fd812dae2b27e6c2c2",
+    "yaml@2.8.3/dist/nodes/Alias.js": "fd372850c1ed8953261a74bf0a133bd2dc7e8ca91a67ddbf62600ab632c6d00e",
+    "yaml@2.8.3/dist/nodes/Collection.js": "e2d3ffdc9a997774602e72b296fba641558bc7355c9f12a3ee0502fb1e541306",
+    "yaml@2.8.3/dist/nodes/identity.js": "1a7cb042ae725ff68d05dc503efbbecbe65281f18b23dfc23f12d1749a440cfe",
+    "yaml@2.8.3/dist/nodes/Node.js": "b57b42071f7ebab633626858656ec5187617f2290c272e87edc57467ef591215",
+    "yaml@2.8.3/dist/nodes/Pair.js": "d5dad67916ba0e864a892da63265a062c45c15a191349ef50a540f2ddbae93e5",
+    "yaml@2.8.3/dist/nodes/Scalar.js": "616ac0f6a0a5a6565307a4bb4443691b0dd019c03d6bb8777353750bd3459487",
+    "yaml@2.8.3/dist/nodes/toJS.js": "34de93bb4e16abbf317210a7bd1b062ed20acb028cd8395b69b591f433e277b6",
+    "yaml@2.8.3/dist/nodes/YAMLMap.js": "d140cfc5aa8d28737bd3c993d977d5a10ab81efe221e36708ac45b3cf18f5dce",
+    "yaml@2.8.3/dist/nodes/YAMLSeq.js": "9f89417f3cba5f22a4436f67a9ff9dce627344b5874d2ed7957ff9acffb030e4",
+    "yaml@2.8.3/dist/parse/cst-scalar.js": "2f72b634348b04b395408ac427fb4f8ee67432244c327561d4b755a28a783b34",
+    "yaml@2.8.3/dist/parse/cst-stringify.js": "4d14a7a286cff9c1a578ab15839388ea76f77ae79293db25b235394bcc377b51",
+    "yaml@2.8.3/dist/parse/cst-visit.js": "525535fc05841407420be6505804c74d873eb3aaa9319679896f7a24a474ca01",
+    "yaml@2.8.3/dist/parse/cst.js": "acc25760d010068844f36f4aefc7fe6f5f6048fd7f8fcc29d4290e154819d1a4",
+    "yaml@2.8.3/dist/parse/lexer.js": "185b184087b4b45f553113e717748a90231c0778faacc4a56c05b27751c07de5",
+    "yaml@2.8.3/dist/parse/line-counter.js": "ddfd11ca2cdd42d36bc6c3090a31c21e6bbcc90bf3498bf6aacfbb30c5d79436",
+    "yaml@2.8.3/dist/parse/parser.js": "1c7de70dd09b752c653a4cf10b93891395d7f24f53f30af148bdcfa99547061a",
+    "yaml@2.8.3/dist/public-api.js": "9b318ac7b3a3751127c74f59dd1dd209230a70ca116000348b82faae189f72f0",
+    "yaml@2.8.3/dist/schema/common/map.js": "769207eaa56e34c113da10cdc22da845f92b4080ff2b921a72847a38d3ac03d8",
+    "yaml@2.8.3/dist/schema/common/null.js": "f5d5f694ea3a42ef136e0fbcc674dfd7aa0a3da2b8d62183fb750166a12e52bb",
+    "yaml@2.8.3/dist/schema/common/seq.js": "51fc0e8bfc63d1d9c7c66b0370a069bb33e0dad865080ff76802803597b9909a",
+    "yaml@2.8.3/dist/schema/common/string.js": "51d0b3aafab2ffa4ad9d86656a3b92c4b4824d0a8806423882ea5f92a1bf8d11",
+    "yaml@2.8.3/dist/schema/core/bool.js": "9fa696b1efc38cf8c73a398f30d9f9841658aa5afd0b7a6b0822947c3991ba7a",
+    "yaml@2.8.3/dist/schema/core/float.js": "139e3964f0e626ad3741500faf51d855ff98eafa2d9e7523cac06260e4515382",
+    "yaml@2.8.3/dist/schema/core/int.js": "f0e474254f6877d5dd23bb57017980931ab333a7eaa3d33872247a80d11f754d",
+    "yaml@2.8.3/dist/schema/core/schema.js": "481d7c64817b40090d519fb65bd83730dadd4c6baec1440b9bf85d29e52c046e",
+    "yaml@2.8.3/dist/schema/json/schema.js": "9efdd848455f6e0621feb13f3eb762453cb02b09d5e04b6501163cfb26af27ed",
+    "yaml@2.8.3/dist/schema/Schema.js": "d3b1bc956a766e2489c36114366f3b3f89762a257ae05ff6271ee3fc8c2a9bf5",
+    "yaml@2.8.3/dist/schema/tags.js": "dba2f42d4dbe8cc8b13f662fd97d253da2da5567e71c47115305efede5a888f2",
+    "yaml@2.8.3/dist/schema/yaml-1.1/binary.js": "15d7b0b8516c8190b191ec9a0adaab16808d09751ef534d7829512944072011f",
+    "yaml@2.8.3/dist/schema/yaml-1.1/bool.js": "80a0046224dac3437f22e3b27b0180e1aad82277ab2fee4769094c6d12d67b6f",
+    "yaml@2.8.3/dist/schema/yaml-1.1/float.js": "a90c44db83152e4d902d46f667737dac90aa86b401abdefe89371ac3bd03abfe",
+    "yaml@2.8.3/dist/schema/yaml-1.1/int.js": "5ff72b08fecc3a924d4a76658a304859db5edb4fadf8893ee837aa06bba60a52",
+    "yaml@2.8.3/dist/schema/yaml-1.1/merge.js": "6823a379d7682836d8ea04d864316ad2cfd4503f534f0873067d3398c65bda21",
+    "yaml@2.8.3/dist/schema/yaml-1.1/omap.js": "3174270cd59c0f0e3ffd73b3b44c4de679efd5c681325b7aac8e0935d547bee8",
+    "yaml@2.8.3/dist/schema/yaml-1.1/pairs.js": "46ba76da72ad65a6202358c486c6a3084ab7c48a8eb5be60d241d9e198c5a9b5",
+    "yaml@2.8.3/dist/schema/yaml-1.1/schema.js": "a7320808484dc6d04817b33b2d09b65ead7ffc1c672ab54e068a80972b17702e",
+    "yaml@2.8.3/dist/schema/yaml-1.1/set.js": "e4553b0cbde79090884908f44bb3b4afd04935fc23656a1b87ec1af87f24427a",
+    "yaml@2.8.3/dist/schema/yaml-1.1/timestamp.js": "b157c946dc1b8854aadc4e7994b268ec8afe6d916721cb3580e0752c7d15a5f7",
+    "yaml@2.8.3/dist/stringify/foldFlowLines.js": "7819679e80222b80c564ea4a9cf3145fa4d5e28a6cfbac248283ac55b0249761",
+    "yaml@2.8.3/dist/stringify/stringify.js": "38efb5bc5553e98fee58c825a88131c59184368d8689e3e6f43c652a06e9c167",
+    "yaml@2.8.3/dist/stringify/stringifyCollection.js": "b55fd3b6e3f1346bbcd1fcdc48a59c089b7a4b0e6fac2b46846f7828f9488600",
+    "yaml@2.8.3/dist/stringify/stringifyComment.js": "490bff57104b7cfdb1893f14528610bb4d0a63c29b314e122233cf308cf96662",
+    "yaml@2.8.3/dist/stringify/stringifyDocument.js": "dd5ba1813a16b62955c466bce8d1c16254e90b36d688f863c508dc8fe38f2afe",
+    "yaml@2.8.3/dist/stringify/stringifyNumber.js": "fcd753e621767ddd96719b306ac764c5218171518b0c2097ffbe49c88fc18f72",
+    "yaml@2.8.3/dist/stringify/stringifyPair.js": "bc03ae533d85bf9122e87c0a256c841ae7fbf063499bc3034d49fd9f7b200659",
+    "yaml@2.8.3/dist/stringify/stringifyString.js": "4113b71a9c4c087a197f71452794a6acb9929111f569c973ff4efe7caee8f777",
+    "yaml@2.8.3/dist/visit.js": "a757e3b924af184b25e2386d1678b1fe341805a516ebf9bccee219b47aebd5e7"
+  },
+  "schemaHashes": {
+    "annotations.schema.json": "463cd4ca0baeca7c17624d9b7a260471713c1f2e3a0380a1f21643c40ecc6061",
+    "capture-action.schema.json": "9639715c364b0ea8791523a3bc7206d0c5f67acb81380324f25ba22eed79fc05",
+    "config.schema.json": "4710b6e8018d8bc7fa272bc9bfcc87b65439908380f716e3df97bcf24f517ddd",
+    "context-pack.schema.json": "9e2b7f19ca6db78f72de6f4ce0acb287c8ed64b94e8dca32fee194e6f5e26fa3",
+    "diff.schema.json": "be0188f12c5b4ed65957d9ac1401007f8e31912a0f21ed2af8e33ce274e9ebef",
+    "evidence-index.schema.json": "2d907acba09f208673849354afc8cb5aa788b8b213658e04641b3ccdeafd7c4e",
+    "feedback-batch.schema.json": "1da68f409506fd1a1f999785f666f15883e7c8d51a57b7996ba73b61eb3c24ef",
+    "origin-session.schema.json": "39e49ff5cfa7fa033cca453048a1e8b0ae631ddc98ca10e9d1bcd8ecb9b33538",
+    "report.schema.json": "8eb9f70ea1ae6897bf48891d67ab1245f6ef3a3a177bb212633a6546f3fb12dd",
+    "review-answer.schema.json": "fd7765261d2c71c0cf9fcd604f0607beeff6d21d59402468cf2ff84a57b4c42b",
+    "review-bundle.schema.json": "5f445f745da093f565669ce13a3eb59e182eabe98c3df1b51f8b49e4b67b33d6",
+    "review-event.schema.json": "57c75a0383645435e20e752cb24de9517929381cf2d3b684575dd8d053e12ad3",
+    "review-plan.schema.json": "75a3cbc0cf5a29820f1dac4148e51c4f413c3b7fac7d8bcf7484347c7387437a",
+    "review-state.schema.json": "27f9f98344a2b94b75f84fef9bba73978bbacca1e102ed11e459d247fbed7552",
+    "review-thread.schema.json": "6c5957f14b964dfaf1601ac45870b7f3fae013209dd4964aa3831dd753f06fc1"
+  },
+  "uiAssetHashes": {
+    "app.css": "24367977f02573eef337192857d07e9cc3d237d7870a9607cd7c7d1ae9b71c92",
+    "app.js": "68aeb0d987d16e181dba7570570bf3a0409b09464401f6c11d0dde881e33f9bc"
+  },
+  "bundleSha256": "873611f23778fbbeee4e45dcec646bb3748e0bb8e7f9f4d6212c1576c5faa8c0"
+}