@wrongstack/core 0.297.0 → 0.298.0

package/dist/utils/path-segment.d.ts

@@ -0,0 +1,29 @@
+/**
+ * Upper bound on one segment. Well past any generated id (ULID, UUID, nickname
+ * `<base>#<pid>`) and short enough to keep a crafted value from pushing the
+ * joined path past a filesystem limit.
+ */
+export declare const MAX_PATH_SEGMENT_LENGTH = 256;
+/**
+ * True when `value` is safe to use as a single path segment.
+ *
+ * Rejects the empty string, over-long input, the `.`/`..` traversal segments,
+ * both separators (Windows accepts `/` too, so checking only `path.sep` is a
+ * platform-specific hole), NUL (truncates the path in some syscalls), and `:`
+ * (Windows drive-relative paths and NTFS alternate data streams).
+ *
+ * IMPORTANT: when the segment arrives percent-encoded, validate AFTER decoding.
+ * `%2e%2e%2f` passes every check above and decodes to `../`.
+ */
+export declare function isSafePathSegment(value: string): boolean;
+/**
+ * Resolve `segments` under `root`, returning `null` unless every segment is
+ * safe AND the resolved path is still inside `root`.
+ *
+ * The containment check is deliberately redundant with
+ * {@link isSafePathSegment}: the segment rule is the guard, and this is the
+ * assertion that the guard actually held. A read or write reached only through
+ * this helper cannot leave `root` even if the segment rule is later loosened.
+ */
+export declare function resolveContainedPath(root: string, ...segments: string[]): string | null;
+//# sourceMappingURL=path-segment.d.ts.map

package/dist/utils/win32-cmd.d.ts

@@ -0,0 +1,25 @@
+/**
+ * Safe invocation of Windows `.cmd`/`.bat` shims.
+ *
+ * Node refuses to spawn a `.cmd` without a shell (CVE-2024-27980), and the
+ * obvious workaround — `spawn(line, { shell: true })` — hands the whole command
+ * line to `cmd.exe`, where `&`, `|`, `<`, `>` and newlines separate commands. An
+ * argument like `--flag=x&calc.exe` then runs a second program.
+ *
+ * This builds an explicit `cmd.exe /d /c call "<command>" "<arg>" …`
+ * invocation with `windowsVerbatimArguments`, so Node passes the line through
+ * untouched and every token stays quoted. Metacharacters are refused outright
+ * rather than escaped: inside `cmd.exe` double quotes, `%VAR%` still expands and
+ * caret escaping does not apply, so quoting alone is not a complete defence.
+ *
+ * This module is the single source for that construction. `@wrongstack/acp` and
+ * `@wrongstack/cli` re-export it; `@wrongstack/mcp` uses it directly for stdio
+ * MCP servers, whose `command`/`args` come from user or WebUI-supplied config.
+ */
+export interface Win32CmdShimInvocation {
+    command: string;
+    args: string[];
+    windowsVerbatimArguments: true;
+}
+export declare function buildWin32CmdShimInvocation(command: string, args?: readonly string[]): Win32CmdShimInvocation;
+//# sourceMappingURL=win32-cmd.d.ts.map

package/dist/worktree/index.js

@@ -47,6 +47,11 @@ var SECRET_NAME_PARTS = [
   "SECRET",
   "PASSWORD",
   "PASSWD",
+  // WRONGSTACK_VAULT_PASSPHRASE is the vault KEK. Without this entry it matched
+  // no rule here and fell through to the `WRONGSTACK_` prefix allow-rule, so the
+  // key that protects the credential vault was forwarded to every child process
+  // — including the agent's own exec/bash tools and MCP stdio servers (WS-033).
+  "PASSPHRASE",
   "AUTH",
   "CRED",
   "BEARER",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@wrongstack/core",
-  "version": "0.297.0",
+  "version": "0.298.0",
   "license": "MIT",
   "description": "WrongStack core: kernel, types, defaults, and shared utilities for the WrongStack CLI agent.",
   "repository": {
@@ -112,6 +112,10 @@
       "types": "./dist/hq/index.d.ts",
       "import": "./dist/hq/index.js"
     },
+    "./hq/protocol": {
+      "types": "./dist/hq/protocol.d.ts",
+      "import": "./dist/hq/protocol.js"
+    },
     "./notifications": {
       "types": "./dist/notifications/index.d.ts",
       "import": "./dist/notifications/index.js"
@@ -156,6 +160,7 @@
   },
   "files": [
     "dist",
+    "!dist/**/*.map",
     "skills",
     "design-kits",
     "instructions",
@@ -163,8 +168,8 @@
   ],
   "wrongstackApiVersion": "0.1.10",
   "dependencies": {
-    "@wrongstack/kanban": "0.297.0",
-    "@wrongstack/persistence": "0.297.0"
+    "@wrongstack/kanban": "0.298.0",
+    "@wrongstack/persistence": "0.298.0"
   },
   "devDependencies": {
     "@types/node": "^26.1.1",

package/skills/chimera/SKILL.md

@@ -163,9 +163,21 @@ The `cascadeOn` and `maxCascadeDepth` settings are owned by the runtime plugin
 to a different config path, this section will become stale — update it as part
 of the config migration.
 
-If the leader session has ended before cascade agents complete, their results
-are still captured in the session transcript and can be reviewed when the
-leader next resumes the session.
+If an actionable ordinary Chimera report finishes after the main leader turn,
+`autoFix: auto` resumes that same session leader through a serialized system
+follow-up before shutdown. An approved `ask` follows the same path. Review-only,
+denied, timed-out, failed, or session-switched work remains captured in the
+mailbox and transcript for a later explicit resume. Cascade agents continue to
+use their bounded fix-and-re-review lifecycle described below.
+
+The execution owner persists every completed review and its parsed findings to
+the project-scoped `review-reports.jsonl` and `review-findings.jsonl` stores
+before publishing `chimera.review_complete`. This durability contract is
+independent of whether the optional post-session `wstack-chimera` plugin is
+enabled; auto-review-only sessions must retain the same report history.
+Mutations and compaction use cross-process file locks. When the combined stores
+reach 8 MiB, retention compaction is checked at most once per 24 hours and uses
+atomic replacement so concurrent clients cannot lose appended review data.
 
 ---
 
@@ -281,4 +293,4 @@ files you were never shown is worse than an honest gap.
 - Chat history checked for prior discussion of each finding
 - Fix lines are patch instructions, standalone and context-free
 - Counts in Summary match the findings listed
-- `<nextsteps>` mirrors the findings in severity order
+- `<nextsteps>` mirrors the findings in severity order

package/skills/data-governance/SKILL.md

@@ -0,0 +1,92 @@
+---
+name: data-governance
+description: |
+  Use this skill when designing or reviewing data governance: schema ownership,
+  PII handling, retention, lineage, access policy, and migration safety for
+  WrongStack services and stores.
+  Triggers: user says "data governance", "PII", "schema ownership", "retention policy", "data lineage", "migration safety".
+trigger: Use when designing or reviewing schema ownership, PII handling, retention, data lineage, access policy, or migration safety.
+version: 1.0.0
+---
+
+# Data Governance — WrongStack
+
+Designs and reviews data governance for WrongStack services: schema ownership, PII handling, retention, lineage, access policy, and migration safety.
+
+## Overview
+
+Establishes who owns each data entity, how sensitive fields are classified and protected, how long data is retained, and how schema changes ship without losing or leaking data. Produces concrete policy plus code-level guardrails, not prose.
+
+## Rules
+
+1. Every persisted entity has exactly one owning service; cross-service access goes through that service's API, never a shared table.
+2. Classify every field: public, internal, sensitive, or restricted (PII/credentials). Restricted fields are encrypted at rest and redacted in logs.
+3. Never log or echo restricted fields — redact at the serialization boundary, not at each call site.
+4. Every schema change ships with a forward migration AND a documented rollback; destructive drops are two-phase (deprecate → drop) across releases.
+5. Retention is explicit per entity: define a TTL/purge cadence and honor deletion requests (right-to-erase) with a verifiable purge path.
+6. Lineage: a field's origin and transformations are traceable; derived data records its source columns/versions.
+
+## Patterns
+
+### Do
+
+```typescript
+// ✅ Classify + redact at the boundary
+interface UserRecord {
+  id: string; // internal
+  email: string; // restricted (PII) — encrypted at rest
+  createdAt: string; // internal
+}
+function toLog(u: UserRecord) {
+  return { id: u.id, email: '[redacted]', createdAt: u.createdAt };
+}
+```
+
+```sql
+-- ✅ Two-phase destructive change: deprecate first, drop next release
+ALTER TABLE sessions ADD COLUMN legacy_data_deprecated_at timestamptz; -- phase 1
+-- (next release, after backfill + verification)
+-- ALTER TABLE sessions DROP COLUMN legacy_data;                       -- phase 2
+```
+
+### Don't
+
+```typescript
+// ❌ Log the whole record — leaks PII into the log stream
+logger.info('user', user);
+
+// ❌ Shared-table cross-service read — bypasses the owning service's policy
+db.query('SELECT email FROM users WHERE ...'); // from a service that doesn't own users
+```
+
+## Workflow
+
+```
+1. Inventory:  List entities, owning service, and field classifications
+2. Policy:     Define retention/TTL, access rules, encryption-at-rest for restricted fields
+3. Guardrails: Redaction at the serialization boundary, audit log for restricted access
+4. Migration:  Forward + rollback plan; destructive changes two-phase
+5. Verify:     Purge-path test (right-to-erase), redaction test, migration dry-run
+```
+
+## What to look for
+
+- **Orphaned ownership**: a table no service claims, or two services writing the same table
+- **PII in logs/errors**: restricted fields appearing in log lines, stack traces, or error payloads
+- **Missing retention**: data kept forever with no TTL or purge path
+- **One-phase drops**: `DROP COLUMN`/`DROP TABLE` shipping without a deprecate-first phase
+- **Untraceable lineage**: derived tables with no record of source columns/versions
+
+## Anti-patterns
+
+- **Don't redact per-call-site** — centralize at the serialization boundary or a single field will leak
+- **Don't share tables across services** — it bypasses ownership and access policy
+- **Don't ship destructive migrations without rollback** — every change is reversible until proven otherwise
+- **Don't treat "internal" as "not sensitive"** — internal data still needs access policy and retention
+
+## Skills in scope
+
+- `security-scanner` — for encryption-at-rest, secret handling, and access-control review
+- `audit-log` — for verifying restricted-access audit trails and retention evidence
+- `api-design` — for owning-service API boundaries instead of shared tables
+- `testing` — for redaction, purge-path, and migration tests

package/skills/wrongstack-kanban/SKILL.md

@@ -1,68 +1,129 @@
 ---
 name: wrongstack-kanban
-description: Monitor and manage a WrongStack project's IPC-backed Kanban through the wrongstack-kanban MCP server. Use when an external coding agent needs to inspect boards or task details, find or claim ready work, update tasks and assignments, follow dependencies, attach notes/checks/evidence, verify completion, recover stale work, or wait for Kanban changes without directly reading Kanban files or SQLite.
+description: >-
+  Monitor and manage a WrongStack project's IPC-backed Kanban through the
+  dedicated tool actions. Enforces deterministic task lifecycle, prevents
+  fake-progress, and ensures every card carries verifiable evidence before
+  completion. Use this skill whenever working with Kanban boards, tasks,
+  dispatch, verification, or the kanban tool.
+triggers:
+  - user says "kanban", "board", "task dispatch", "kanban queue"
+  - working with the kanban tool or kanban_queue
+  - managing project work through boards
 ---
 
-# WrongStack Kanban
-
-Use the MCP tools as the only state boundary. Never open or edit
-`.wrongstack/kanbans/_kanban.sqlite`, board JSON, event JSONL, or HQ sync files directly.
-
-## Connect
-
-Expect a configured MCP server named `wrongstack-kanban`. If it is missing, ask the user to add:
-
-```json
-{
-  "mcpServers": {
-    "wrongstack-kanban": {
-      "command": "wstack-kanban-mcp",
-      "args": ["--project-root", "/absolute/project/path", "--destructive"]
-    }
-  }
-}
-```
-
-This full-management configuration exposes create, update, move, assignment, verification, delete,
-merge, and cross-board transfer operations. `--destructive` implies `--writable`. The bare server
-default remains read-only, so never try to bypass a narrower configuration through files or SQLite.
-
-## Work with a board
-
-1. Call `kanban_read` with `list_boards`, then `get_board`. Treat returned state and revision as
-   authoritative.
-2. Before selecting work, inspect `ready_tasks`, `queue_health`, or `snapshot`. Respect dependencies,
-   existing assignments, completion gates, and managed lifecycle rules.
-3. Before any material mutation, re-read the board. Another human or agent may have changed it.
-4. Use `kanban_manage` with `claim_task` before starting unassigned work. Record a stable actor by
-   configuring the server with `--actor` when possible.
-5. Keep task and assignment state current. Use `heartbeat_assignment` during long work,
-   `transition_task` for managed boards, and `release_task` if work cannot proceed.
-6. Add truthful notes, checks, links, goal metrics, and verification evidence as they become known.
-7. Before completion, re-read the task, run `verify_completion`, and satisfy the board's completion
-   gate. Do not mark a task done merely because implementation ended.
-
-On stale-write or policy errors, re-read the board and reassess. Do not retry the same mutation with
-cached inputs.
-
-## Observe changes
-
-Call `kanban_watch` with an optional `boardId` and a timeout no greater than 25 seconds. It returns
-the next daemon mutation event, timeout, or disconnect.
-
-Treat every watch result as a wake-up hint. After an event, timeout, or disconnect, call
-`kanban_read` again to reconcile authoritative state. A watch event is not a complete board snapshot
-and events can occur between long-poll calls.
-
-## Choose the permission tier
-
-- Use `kanban_read` for listing, board/task detail, search, ready work, events, queue health,
-  snapshots, exports, and chains.
-- Use `kanban_manage` for create/update/move, dependencies, assignments, heartbeats, recovery,
-  evidence, verification, atomicity assessment, decomposition, and lifecycle transitions.
-- Use `kanban_destructive` only when the user explicitly intends to delete state, merge tasks, or
-  transfer a task out of its source board. Re-read both source and destination immediately before
-  the call.
-
-If a tool is not advertised, report the missing server permission tier. Do not bypass it through
-files, SQLite, shell commands, or another API.
+# WrongStack Kanban — Deterministic Enforcement Skill
+
+## Core contract
+
+The Kanban board is the **single source of truth** for tracked work. Chat
+messages, session logs, and agent self-reports are **not** completion evidence.
+Only persisted board mutations with verifiable evidence count.
+
+## Anti-fake-progress rules
+
+1. **Never claim a task is "done" in chat without a board mutation.**
+   If you completed work, you must call `kanban` with `action: "mark_assignment"`
+   or `action: "transition_task"` to persist the result. A chat-only claim of
+   completion is fake progress.
+
+2. **Never mark a task "completed" without verification.**
+   On managed boards, `mark_assignment(completed)` parks the card in Review —
+   it does not complete it. Only `verifyTaskCompletion` passing (or reviewer
+   acceptance) moves a card to Done.
+
+3. **Never skip lifecycle stages.**
+   Managed cards move exactly one stage at a time: Backlog → Todo → Running →
+   Review → Done. Jumping stages is a deterministic violation that the lifecycle
+   guard rejects.
+
+4. **Never create empty tasks on managed boards.**
+   Every managed-board task must have at minimum a `description`. A title-only
+   card is rejected at creation time.
+
+5. **Never report work as "in progress" without a board assignment.**
+   If work is being done, the card must have an active assignment with lease
+   metadata. Chat claims of "working on X" without a board assignment are not
+   tracked work.
+
+## Task detail requirements
+
+Before a managed card can leave Backlog (transition to Todo), it must have:
+
+| Field | Required | Why |
+|-------|----------|-----|
+| `description` | **Yes** | A title alone is not actionable scope |
+| `assignee` | **Yes** | Work without an owner is untracked |
+| `dueDate` | **Yes** | Work without a deadline drifts indefinitely |
+| `labels` | **Yes** (≥1) | Tags categorize and filter work |
+| `childTaskIds` | **Yes** (≥1) | Every task is decomposed into subtasks |
+| `successCriteria` | **Yes** | Acceptance criteria define "done" before work starts |
+
+The lifecycle guard enforces these mechanically. Do not attempt to bypass them.
+
+## Dispatch contract
+
+1. **Dispatch is deterministic.** The system selects tasks by priority, column,
+   order, and creation time — not randomly. Do not attempt to influence dispatch
+   order by shuffling tasks or boards.
+
+2. **Claim before working.** Call `kanban_queue` or `claim_task` before starting
+   work. Working on an unclaimed card means another agent may also be working on
+   it.
+
+3. **Heartbeat or lose the lease.** If you hold a lease, you must call
+   `heartbeat_assignment` before it expires. Expired leases are recovered by the
+   system and the task is reassigned.
+
+4. **Fence your writes.** Include `expectedLeaseId` in every `mark_assignment`
+   and `heartbeat_assignment` call. If your lease was recovered, your write
+   becomes a safe no-op instead of corrupting the successor's state.
+
+## Completion contract
+
+1. **"Done" means verified.** The completion gate runs `verifyTaskCompletion()`,
+   which executes success criteria checks deterministically. A passed gate is
+   the only path to Done on managed boards.
+
+2. **Chat evidence is not board evidence.** Saying "tests pass" in chat does not
+   verify a task. The verifier runs the actual test command and records the
+   result.
+
+3. **File-scope is checked.** If `expectedFileChanges` is set, the verifier
+   compares the actual git diff against the expected paths. Unexpected changes
+   fail the scope check.
+
+4. **Review is mandatory.** Even after verification passes, a reviewer must
+   accept the card (transition Review → Done with action text and an attachment).
+   Worker completion alone never reaches Done.
+
+## Event tracking
+
+Every material action must produce a board mutation:
+
+| Action | Required board mutation |
+|--------|------------------------|
+| Start work | `mark_assignment(running)` + `transition_task(running)` |
+| Complete work | `mark_assignment(completed)` + `transition_task(review)` |
+| Fail work | `mark_assignment(failed)` with error |
+| Split scope | `split_task` or `split_atomic` |
+| Add evidence | `add_note` or `add_link` |
+| Change plan | `update_task` or `add_dependency` |
+
+## Prohibited patterns
+
+| Anti-pattern | Why it's prohibited |
+|--------------|---------------------|
+| Creating title-only tasks on managed boards | Rejected at creation; no description = not actionable |
+| Reporting "done" without board evidence | Fake progress; board is source of truth |
+| Randomizing task selection | Dispatch is deterministic by design |
+| Skipping Review | Reviewer acceptance is mandatory before Done |
+| Working without a lease | Untracked; may conflict with another agent |
+| Soft-completing on managed boards | Gate enforcement is strict; soft is not honored |
+
+## Skills in scope
+
+- `sdd` — Spec-driven development creates boards from task graphs
+- `bug-hunter` — Findings can be tracked as Kanban cards
+- `chimera` — Post-session review updates board cards
+- `multi-agent` — Parallel dispatch through kanban_queue

package/dist/agent-status-helpers.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"agent-status-helpers.d.ts","sourceRoot":"","sources":["../src/agent-status-helpers.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AACH,OAAO,KAAK,EACV,mBAAmB,EACnB,eAAe,EACf,eAAe,EACf,aAAa,EACd,MAAM,uBAAuB,CAAC;AAQ/B,MAAM,WAAW,WAAW;IAC1B,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,CAAC,EAAE,OAAO,GAAG,SAAS,CAAC;IAC5B,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,oBAAoB;IACnC,EAAE,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACxB,IAAI,EAAE,MAAM,CAAC;IACb,UAAU,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAChC,EAAE,CAAC,EAAE,OAAO,GAAG,SAAS,CAAC;IACzB,KAAK,CAAC,EAAE,OAAO,GAAG,SAAS,CAAC;IAC5B,MAAM,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC5B,WAAW,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACjC,WAAW,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACjC,YAAY,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;CACnC;AAuBD,wBAAgB,WAAW,CAAC,KAAK,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,MAAM,CAG9D;AAED,wBAAgB,YAAY,CAAC,KAAK,EAAE,OAAO,GAAG,aAAa,EAAE,GAAG,SAAS,CAyBxE;AAmED,wBAAgB,oBAAoB,CAClC,OAAO,EAAE,oBAAoB,EAC7B,OAAO,CAAC,EAAE,WAAW,GACpB,eAAe,CAoBjB;AAED,wBAAgB,mBAAmB,IAAI,mBAAmB,CAiBzD;AAED,wBAAgB,YAAY,CAC1B,OAAO,EAAE,mBAAmB,GAAG,SAAS,EACxC,SAAS,EAAE,eAAe,CAAC,WAAW,CAAC,GACtC,mBAAmB,CAKrB;AA2BD,wBAAgB,eAAe,CAC7B,OAAO,EAAE,mBAAmB,GAAG,SAAS,EACxC,OAAO,EAAE,eAAe,GACvB,mBAAmB,CA8BrB;AAED,wBAAgB,QAAQ,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAG5C"}

package/dist/agent-status-tracker.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"agent-status-tracker.d.ts","sourceRoot":"","sources":["../src/agent-status-tracker.ts"],"names":[],"mappings":"AAuBA,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,oBAAoB,CAAC;AACnD,OAAO,KAAK,EACV,UAAU,EAKV,eAAe,EAChB,MAAM,uBAAuB,CAAC;AAyB/B,MAAM,WAAW,yBAAyB;IACxC,MAAM,EAAE,QAAQ,CAAC;IACjB,QAAQ,EAAE,eAAe,CAAC;IAC1B,qEAAqE;IACrE,SAAS,CAAC,EAAE,MAAM,GAAG,CAAC,MAAM,MAAM,GAAG,SAAS,CAAC,GAAG,SAAS,CAAC;IAC5D,kEAAkE;IAClE,UAAU,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAChC;;;;OAIG;IACH,QAAQ,CAAC,EAAE,CAAC,MAAM,IAAI,CAAC,GAAG,SAAS,CAAC;CACrC;AAED,qBAAa,kBAAkB;IAC7B,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAW;IAClC,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAkB;IAC3C,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAkD;IAC5E,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAS;IAGpC,OAAO,CAAC,MAAM,CAAiC;IAG/C,OAAO,CAAC,UAAU,CAAoB;IAGtC,OAAO,CAAC,YAAY,CAA2B;IAC/C,OAAO,CAAC,iBAAiB,CAAqB;IAC9C,OAAO,CAAC,iBAAiB,CAAqB;IAC9C,OAAO,CAAC,gBAAgB,CAAK;IAC7B,OAAO,CAAC,eAAe,CAAK;IAC5B,OAAO,CAAC,aAAa,CAAK;IAC1B,OAAO,CAAC,cAAc,CAAK;IAC3B,OAAO,CAAC,eAAe,CAAK;IAC5B,OAAO,CAAC,YAAY,CAAqB;IACzC,OAAO,CAAC,WAAW,CAAqB;IACxC,OAAO,CAAC,iBAAiB,CAAM;IAC/B,OAAO,CAAC,eAAe,CAAqB;IAC5C,OAAO,CAAC,iBAAiB,CAAyB;IAClD,OAAO,CAAC,gBAAgB,CAAyB;IACjD,OAAO,CAAC,WAAW,CAAuB;IAC1C,OAAO,CAAC,kBAAkB,CAAqB;IAC/C,OAAO,CAAC,oBAAoB,CAAqB;IACjD,OAAO,CAAC,cAAc,CAAyB;IAC/C,OAAO,CAAC,kBAAkB,CAAkC;IAC5D,OAAO,CAAC,oBAAoB,CAAkC;IAC9D,OAAO,CAAC,gBAAgB,CAAqB;IAC7C,OAAO,CAAC,gBAAgB,CAAqB;IAC7C,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,eAAe,CAAU;IAEjD,OAAO,CAAC,cAAc;IAUtB,OAAO,CAAC,aAAa,CAAyB;IAC9C,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAA2B;IACpD,OAAO,CAAC,UAAU,CAA+C;IACjE,OAAO,CAAC,YAAY,CAA8C;IAClE,wEAAwE;IACxE,OAAO,CAAC,YAAY,CAA8B;IAElD,YAAY,IAAI,EAAE,yBAAyB,EAM1C;IAED,yEAAyE;IACzE,SAAS,IAAI,UAAU,EAAE,CAExB;IAED,KAAK,IAAI,IAAI,CAqaZ;IAED,IAAI,IAAI,IAAI,CAmBX;IAED;;;;OAIG;IACH,OAAO,CAAC,oBAAoB;IAS5B;;;;;;;;OAQG;IACH,OAAO,CAAC,KAAK;IAiBb;;;;;;OAMG;IACH,OAAO,CAAC,gBAAgB;IAOxB,OAAO,CAAC,KAAK;IAmEb,OAAO,CAAC,gBAAgB;IAIxB,OAAO,CAAC,cAAc;IAQtB,OAAO,CAAC,iBAAiB;IAYzB,OAAO,CAAC,oBAAoB;CA6B7B"}

package/dist/boot.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"boot.d.ts","sourceRoot":"","sources":["../src/boot.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,aAAa,EAAc,MAAM,4BAA4B,CAAC;AACvE,OAAO,EAAE,mBAAmB,EAAE,MAAM,mCAAmC,CAAC;AAExE,OAAO,EAAE,kBAAkB,EAA2B,MAAM,4BAA4B,CAAC;AAEzF,OAAO,EAAE,KAAK,MAAM,EAA4B,MAAM,mBAAmB,CAAC;AAU1E,OAAO,EAIL,KAAK,WAAW,EACjB,MAAM,yBAAyB,CAAC;AAEjC;;;;GAIG;AACH,MAAM,WAAW,iBAAiB;IAChC;;;;;OAKG;IACH,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,CAAC;IACzC;;;;;OAKG;IACH,QAAQ,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC9B;;;OAGG;IACH,cAAc,CAAC,EAAE,OAAO,GAAG,SAAS,CAAC;IACrC;;;;;;OAMG;IACH,sBAAsB,CAAC,EAAE,OAAO,GAAG,SAAS,CAAC;CAC9C;AAED;;;;GAIG;AACH,MAAM,WAAW,gBAAgB;IAC/B,GAAG,EAAE,MAAM,CAAC;IACZ,WAAW,EAAE,MAAM,CAAC;IACpB,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,EAAE,WAAW,CAAC;IACpB,YAAY,EAAE,mBAAmB,CAAC;IAClC,MAAM,EAAE,MAAM,CAAC;IACf,KAAK,EAAE,kBAAkB,CAAC;IAC1B,MAAM,EAAE,aAAa,CAAC;IACtB,mDAAmD;IACnD,gBAAgB,EAAE,MAAM,CAAC;CAC1B;AAED;;;;;;;;;GASG;AACH,wBAAsB,UAAU,CAAC,OAAO,GAAE,iBAAsB,GAAG,OAAO,CAAC,gBAAgB,CAAC,CAqN3F;AASD;;;GAGG;AACH,wBAAgB,kBAAkB,CAAC,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,GAAG,OAAO,CAAC,MAAM,CAAC,CAkD3F;AA+MD;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,wBAAgB,gCAAgC,CAAC,WAAW,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,GAAG,IAAI,CAc9F;AAiID;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,wBAAsB,oBAAoB,CAAC,MAAM,EAAE,WAAW,GAAG,OAAO,CAAC,IAAI,CAAC,CAmC7E"}

package/dist/chronicle/context.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"context.d.ts","sourceRoot":"","sources":["../../src/chronicle/context.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,oBAAoB,EAAE,cAAc,EAAE,MAAM,YAAY,CAAC;AAEvE,MAAM,WAAW,gBAAgB;IAC/B,KAAK,EAAE,cAAc,CAAC;IACtB,WAAW,EAAE,oBAAoB,CAAC;CACnC;AAED,kFAAkF;AAClF,wBAAgB,sBAAsB,CACpC,KAAK,EAAE,cAAc,EACrB,OAAO,GAAE,MAAqB,GAC7B,gBAAgB,CAKlB;AAED,2EAA2E;AAC3E,wBAAgB,qBAAqB,CACnC,MAAM,EAAE,gBAAgB,EACxB,SAAS,GAAE;IACT,KAAK,CAAC,EAAE,OAAO,CAAC,cAAc,CAAC,GAAG,SAAS,CAAC;IAC5C,WAAW,CAAC,EAAE,OAAO,CAAC,IAAI,CAAC,oBAAoB,EAAE,SAAS,CAAC,CAAC,GAAG,SAAS,CAAC;CACrE,GACL,gBAAgB,CAWlB"}

package/dist/chronicle/decision-adapter.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"decision-adapter.d.ts","sourceRoot":"","sources":["../../src/chronicle/decision-adapter.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,qBAAqB,CAAC;AACpD,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AACrD,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,WAAW,CAAC;AACpD,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,YAAY,CAAC;AAEtD,MAAM,WAAW,+BAA+B;IAC9C,MAAM,EAAE,QAAQ,CAAC;IAAC,OAAO,EAAE,kBAAkB,CAAC;IAAC,OAAO,EAAE,gBAAgB,GAAG,CAAC,MAAM,gBAAgB,CAAC,CAAC;IACpG,cAAc,CAAC,EAAE,CAAC,CAAC,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,mBAAmB,KAAK,IAAI,CAAC,GAAG,SAAS,CAAC;CACrF;AAED,kFAAkF;AAClF,wBAAgB,wBAAwB,CAAC,OAAO,EAAE,+BAA+B,GAAG,MAAM,IAAI,CA4B7F"}

package/dist/chronicle/domain-adapter.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"domain-adapter.d.ts","sourceRoot":"","sources":["../../src/chronicle/domain-adapter.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,qBAAqB,CAAC;AACpD,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AACrD,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,WAAW,CAAC;AACpD,OAAO,KAAK,EAAE,mBAAmB,EAA0C,MAAM,YAAY,CAAC;AAE9F,MAAM,WAAW,6BAA6B;IAC5C,MAAM,EAAE,QAAQ,CAAC;IAAC,OAAO,EAAE,kBAAkB,CAAC;IAAC,OAAO,EAAE,gBAAgB,GAAG,CAAC,MAAM,gBAAgB,CAAC,CAAC;IACpG,cAAc,CAAC,EAAE,CAAC,CAAC,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,mBAAmB,KAAK,IAAI,CAAC,GAAG,SAAS,CAAC;CACrF;AAyBD,kFAAkF;AAClF,wBAAgB,2BAA2B,CAAC,OAAO,EAAE,6BAA6B,GAAG,MAAM,IAAI,CA2C9F"}

package/dist/chronicle/event-hash.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"event-hash.d.ts","sourceRoot":"","sources":["../../src/chronicle/event-hash.ts"],"names":[],"mappings":"AAcA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,YAAY,CAAC;AAEjD,oDAAoD;AACpD,eAAO,MAAM,YAAY,QAAiB,CAAC;AAE3C;;;;;;;GAOG;AACH,wBAAgB,eAAe,CAAC,KAAK,EAAE,OAAO,GAAG,MAAM,CAWtD;AAED,wBAAgB,SAAS,CAAC,KAAK,EAAE,OAAO,GAAG,MAAM,CAEhD;AAED;;;;;GAKG;AACH,wBAAgB,kBAAkB,CAAC,KAAK,EAAE,cAAc,GAAG,MAAM,CAGhE"}

package/dist/chronicle/file-observer.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"file-observer.d.ts","sourceRoot":"","sources":["../../src/chronicle/file-observer.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,qBAAqB,CAAC;AAIpD,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AACrD,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,WAAW,CAAC;AAiBpD,MAAM,WAAW,yBAAyB;IACxC,IAAI,EAAE,MAAM,CAAC;IACb,SAAS,EAAE,MAAM,CAAC;IAClB,QAAQ,EAAE,MAAM,CAAC;IACjB,OAAO,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC7B,SAAS,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC/B,EAAE,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;CACzB;AAED,MAAM,WAAW,4BAA4B;IAC3C,WAAW,EAAE,MAAM,CAAC;IACpB,OAAO,EAAE,kBAAkB,CAAC;IAC5B,OAAO,EAAE,gBAAgB,GAAG,CAAC,MAAM,gBAAgB,CAAC,CAAC;IACrD,MAAM,CAAC,EAAE,QAAQ,GAAG,SAAS,CAAC;IAC9B,UAAU,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAChC,YAAY,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAClC,mBAAmB,CAAC,EAAE,SAAS,MAAM,EAAE,GAAG,SAAS,CAAC;IACpD,8EAA8E;IAC9E,aAAa,CAAC,EAAE,SAAS,MAAM,EAAE,GAAG,SAAS,CAAC;IAC9C,8EAA8E;IAC9E,uBAAuB,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC7C,OAAO,CAAC,EAAE,CAAC,CAAC,KAAK,EAAE,OAAO,KAAK,IAAI,CAAC,GAAG,SAAS,CAAC;CAClD;AAED,MAAM,WAAW,qBAAqB;IACpC,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;IACvB,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B,gBAAgB,CAAC,IAAI,EAAE,yBAAyB,GAAG,IAAI,CAAC;CACzD;AA8BD,mFAAmF;AACnF,wBAAsB,0BAA0B,CAC9C,OAAO,EAAE,4BAA4B,GACpC,OAAO,CAAC,qBAAqB,CAAC,CAiRhC"}

package/dist/chronicle/health-monitor.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"health-monitor.d.ts","sourceRoot":"","sources":["../../src/chronicle/health-monitor.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,qBAAqB,CAAC;AACpD,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AACrD,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,WAAW,CAAC;AAEpD,MAAM,WAAW,6BAA6B;IAC5C,MAAM,EAAE,QAAQ,CAAC;IACjB,OAAO,EAAE,kBAAkB,CAAC;IAC5B,OAAO,EAAE,gBAAgB,GAAG,CAAC,MAAM,gBAAgB,CAAC,CAAC;IACrD,UAAU,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAChC,cAAc,CAAC,EAAE,CAAC,CAAC,KAAK,EAAE,OAAO,KAAK,IAAI,CAAC,GAAG,SAAS,CAAC;CACzD;AAED;;;;;GAKG;AACH,wBAAgB,2BAA2B,CAAC,OAAO,EAAE,6BAA6B,GAAG,MAAM,IAAI,CAoC9F"}

package/dist/chronicle/identity.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"identity.d.ts","sourceRoot":"","sources":["../../src/chronicle/identity.ts"],"names":[],"mappings":"AAIA,MAAM,WAAW,6BAA6B;IAC5C,UAAU,EAAE,MAAM,CAAC;IACnB,SAAS,EAAE,MAAM,CAAC;IAClB,UAAU,EAAE,MAAM,CAAC;IACnB,GAAG,CAAC,EAAE,IAAI,GAAG,SAAS,CAAC;CACxB;AAED,MAAM,WAAW,wBAAwB;IACvC,cAAc,EAAE,MAAM,CAAC;IACvB,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC;IAClB,+EAA+E;IAC/E,kBAAkB,EAAE,MAAM,CAAC;IAC3B;;;;;;OAMG;IACH,GAAG,EAAE,MAAM,CAAC;CACb;AAED;;;GAGG;AACH,wBAAgB,+BAA+B,CAC7C,KAAK,EAAE,6BAA6B,GACnC,wBAAwB,CAS1B"}

package/dist/chronicle/index.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/chronicle/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,qBAAqB,EAAE,sBAAsB,EAAE,KAAK,gBAAgB,EAAE,MAAM,cAAc,CAAC;AACpG,OAAO,EACL,+BAA+B,EAC/B,KAAK,6BAA6B,EAClC,KAAK,wBAAwB,GAC9B,MAAM,eAAe,CAAC;AACvB,OAAO,EACL,0BAA0B,EAC1B,KAAK,qBAAqB,EAC1B,KAAK,4BAA4B,EACjC,KAAK,yBAAyB,GAC/B,MAAM,oBAAoB,CAAC;AAC5B,YAAY,EAAE,kBAAkB,EAAE,MAAM,WAAW,CAAC;AACpD,OAAO,EACL,2BAA2B,EAC3B,4BAA4B,EAC5B,oCAAoC,EACpC,KAAK,2BAA2B,EAChC,KAAK,sBAAsB,EAC3B,KAAK,6BAA6B,GACnC,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EACL,4BAA4B,EAC5B,sBAAsB,EACtB,iCAAiC,EACjC,KAAK,iCAAiC,EACtC,KAAK,mCAAmC,GACzC,MAAM,4BAA4B,CAAC;AACpC,OAAO,EACL,8BAA8B,EAC9B,yBAAyB,EACzB,kCAAkC,GACnC,MAAM,8BAA8B,CAAC;AACtC,OAAO,EACL,wCAAwC,EACxC,yCAAyC,EACzC,KAAK,uBAAuB,EAC5B,KAAK,wBAAwB,EAC7B,KAAK,oBAAoB,EACzB,KAAK,4BAA4B,EACjC,KAAK,0BAA0B,EAC/B,KAAK,4BAA4B,EACjC,KAAK,yBAAyB,GAC/B,MAAM,8BAA8B,CAAC;AACtC,OAAO,EAAE,gBAAgB,EAAE,YAAY,EAAE,KAAK,uBAAuB,EAAE,KAAK,qBAAqB,EAAE,KAAK,qBAAqB,EAAE,KAAK,oBAAoB,EAAE,MAAM,cAAc,CAAC;AAC/K,OAAO,EACL,+BAA+B,EAC/B,KAAK,+BAA+B,GACrC,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EAAE,oBAAoB,EAAE,KAAK,2BAA2B,EAAE,MAAM,mBAAmB,CAAC;AAC3F,OAAO,EACL,wBAAwB,EACxB,KAAK,8BAA8B,GACpC,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EAAE,2BAA2B,EAAE,KAAK,6BAA6B,EAAE,MAAM,qBAAqB,CAAC;AACtG,OAAO,EAAE,wBAAwB,EAAE,KAAK,+BAA+B,EAAE,MAAM,uBAAuB,CAAC;AACvG,OAAO,EAAE,2BAA2B,EAAE,KAAK,6BAA6B,EAAE,MAAM,qBAAqB,CAAC;AACtG,OAAO,EAAE,8BAA8B,EAAE,KAAK,6BAA6B,EAAE,MAAM,qBAAqB,CAAC;AACzG,OAAO,EAAE,6BAA6B,EAAE,KAAK,uBAAuB,EAAE,MAAM,sBAAsB,CAAC;AACnG,OAAO,EAAE,6BAA6B,EAAE,KAAK,6BAA6B,EAAE,MAAM,qBAAqB,CAAC;AACxG,OAAO,EAAE,sBAAsB,EAAE,KAAK,6BAA6B,EAAE,MAAM,qBAAqB,CAAC;AACjG,OAAO,EACL,qBAAqB,EACrB,2BAA2B,EAC3B,KAAK,6BAA6B,EAClC,KAAK,uBAAuB,EAC5B,KAAK,yBAAyB,EAC9B,KAAK,uBAAuB,EAC5B,KAAK,uBAAuB,GAC7B,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EACL,sBAAsB,EACtB,uBAAuB,EACvB,oBAAoB,EACpB,KAAK,2BAA2B,EAChC,KAAK,gBAAgB,EACrB,KAAK,qBAAqB,EAC1B,KAAK,cAAc,EACnB,KAAK,mBAAmB,EACxB,KAAK,cAAc,EACnB,KAAK,oBAAoB,EACzB,KAAK,kBAAkB,EACvB,KAAK,oBAAoB,EACzB,KAAK,qBAAqB,GAC3B,MAAM,YAAY,CAAC;AACpB,OAAO,EACL,4BAA4B,EAC5B,KAAK,uBAAuB,GAC7B,MAAM,4BAA4B,CAAC;AACpC,OAAO,EACL,wBAAwB,EACxB,KAAK,oBAAoB,EACzB,KAAK,cAAc,EACnB,KAAK,mBAAmB,EACxB,KAAK,gBAAgB,EACrB,KAAK,oBAAoB,EACzB,KAAK,wBAAwB,EAC7B,KAAK,cAAc,EACnB,KAAK,qBAAqB,GAC3B,MAAM,YAAY,CAAC"}