agent-nuvira 1.59.6 → 1.59.7

package/README.md

@@ -2026,6 +2026,7 @@ npx tsc --noEmit
 | **v1.55.0** | Aug 2026 | `buff models unblock <provider>` escape hatch — manually release a registry-blocked provider (demote unavailable→unverified, clear quota parks + ledger cooldown, live re-probe with honest `stillBlocked`); also fixed the pre-existing `models status --json` / `refresh --json` flag-shadowing bug; 3,011 tests |
 | **v1.59.4** | Aug 2026 | P6 M6.6 Software Bill of Materials: `buff sbom` (CycloneDX 1.5 from lockfile, `--reproducible` pins), `sbom verify` (drift/tamper), `sbom licenses` (copyleft/unknown audit), `doctor --enterprise` Supply Chain check; 3,313 tests |
 | **v1.59.5** | Aug 2026 | Dashboard surfaces mid-stream flakiness end-to-end: violet `⏸ flaky N%` chips on registry rows (mirroring the CLI's `model explain` chip), `⏸ N flaky` provider badges, and a **Flaky mid-stream** stats card — the exact signal `routing.partialFlakiness` uses to deprioritize providers; 3,313 root tests |
+| **v1.59.7** | Aug 2026 | P6 M6.1 **RBAC** — `buff admin role add/remove/list` + `whoami` (admin/operator/viewer permission matrix over the admin surface; OIDC adapter interface; legacy single-user stays permissive until roles assigned) + dashboard **governance policy card** (live `routing.governance.*`) + CLI **flakiness trend tags** (`healing`/`worsening` in `models status`); 3,348 root tests |
 | **v1.59.6** | Aug 2026 | P6 M6.5 **Admin governance API** (`buff admin policy/allow/deny/allow-model/deny-model/max-cost/pii-min/unblock/clear` over the M2.4 policy) + dashboard **flakiness healing sparklines** (per-entry `partialHistory` trajectory, never hard-wiped) + Requests panel `⏸ N` partial chips (partials excluded from error rate); 3,328 root tests |
 | **v1.59.3** | Aug 2026 | `config set routing.<gate>` now accepts the boolean soft-signal keys (`capabilityFit`, `contextFit`, `partialFlakiness`); 3,286 tests |
 | **v1.59.2** | Aug 2026 | P4 M4.4 partial flakiness now feeds the ROUTER: registry `partialRate` EMA (bumped by mid-stream interruptions, healed by clean successes, never flips status) → reliability penalty (capped 40%) gated by `routing.partialFlakiness` (default ON) + transparent `⏸ flaky` chip in `models explain`; 3,284 tests |

package/dist/cli/admin.d.ts

@@ -24,6 +24,15 @@
 import { Command } from 'commander';
 import { BaseCommand } from './commands.js';
 export declare class AdminCommand extends BaseCommand {
+    /** P6 M6.1 RBAC — local role file + OIDC adapter seam (see enterprise/rbac.ts). */
+    private rbac;
+    /**
+     * Enforce an RBAC action for the current identity; returns false (after
+     * logging) when denied. Legacy single-user mode (no role file) stays fully
+     * permissive — enabling RBAC never locks you out; once roles are assigned,
+     * policy writes require `admin`. Callers abort on false.
+     */
+    private guard;
     create(): Command;
     private policyCommand;
     private showPolicy;
@@ -37,5 +46,7 @@ export declare class AdminCommand extends BaseCommand {
     private piiMinCommand;
     private unblockCommand;
     private clearCommand;
+    private roleCommand;
+    private whoamiCommand;
 }
 //# sourceMappingURL=admin.d.ts.map

package/dist/cli/admin.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"admin.d.ts","sourceRoot":"","sources":["../../src/cli/admin.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;GAsBG;AAEH,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACpC,OAAO,EAAE,WAAW,EAAE,MAAM,eAAe,CAAC;AAe5C,qBAAa,YAAa,SAAQ,WAAW;IAC3C,MAAM,IAAI,OAAO;IAmBjB,OAAO,CAAC,aAAa;IASrB,OAAO,CAAC,UAAU;IA0ClB,OAAO,CAAC,mBAAmB;IAiB3B,OAAO,CAAC,YAAY;IASpB,OAAO,CAAC,WAAW;IAWnB,OAAO,CAAC,iBAAiB;IASzB,OAAO,CAAC,gBAAgB;IASxB,OAAO,CAAC,YAAY;IAWpB,OAAO,CAAC,cAAc;IAoBtB,OAAO,CAAC,aAAa;IAoBrB,OAAO,CAAC,cAAc;IAoBtB,OAAO,CAAC,YAAY;CAiBrB"}
+{"version":3,"file":"admin.d.ts","sourceRoot":"","sources":["../../src/cli/admin.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;GAsBG;AAEH,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACpC,OAAO,EAAE,WAAW,EAAE,MAAM,eAAe,CAAC;AAiB5C,qBAAa,YAAa,SAAQ,WAAW;IAC3C,mFAAmF;IACnF,OAAO,CAAC,IAAI,CAAqB;IAEjC;;;;;OAKG;IACH,OAAO,CAAC,KAAK;IAcb,MAAM,IAAI,OAAO;IAqBjB,OAAO,CAAC,aAAa;IASrB,OAAO,CAAC,UAAU;IA0ClB,OAAO,CAAC,mBAAmB;IAiB3B,OAAO,CAAC,YAAY;IAUpB,OAAO,CAAC,WAAW;IAYnB,OAAO,CAAC,iBAAiB;IAUzB,OAAO,CAAC,gBAAgB;IAUxB,OAAO,CAAC,YAAY;IAWpB,OAAO,CAAC,cAAc;IAqBtB,OAAO,CAAC,aAAa;IAqBrB,OAAO,CAAC,cAAc;IAqBtB,OAAO,CAAC,YAAY;IAqBpB,OAAO,CAAC,WAAW;IA6CnB,OAAO,CAAC,aAAa;CAqBtB"}

package/dist/cli/admin.js

@@ -24,6 +24,7 @@
 import { Command } from 'commander';
 import { BaseCommand } from './commands.js';
 import { logger } from '../utils/logger.js';
+import { RbacManager, RbacError, ROLES } from '../enterprise/rbac.js';
 /** The governance fields `buff admin clear` accepts. */
 const GOVERNANCE_FIELDS = [
     'allowProviders', 'denyProviders', 'allowModels', 'denyModels',
@@ -34,6 +35,29 @@ function appendUnique(current, additions) {
     return [...new Set([...(current || []), ...additions])];
 }
 export class AdminCommand extends BaseCommand {
+    /** P6 M6.1 RBAC — local role file + OIDC adapter seam (see enterprise/rbac.ts). */
+    rbac = new RbacManager();
+    /**
+     * Enforce an RBAC action for the current identity; returns false (after
+     * logging) when denied. Legacy single-user mode (no role file) stays fully
+     * permissive — enabling RBAC never locks you out; once roles are assigned,
+     * policy writes require `admin`. Callers abort on false.
+     */
+    guard(action) {
+        if (this.rbac.isLegacyMode())
+            return true;
+        try {
+            this.rbac.requireCan(action);
+            return true;
+        }
+        catch (err) {
+            if (err instanceof RbacError) {
+                logger.error(`⛔ ${err.message}`);
+                logger.error('   Run `buff admin role add <you> admin` once as the initial admin.');
+            }
+            return false;
+        }
+    }
     create() {
         return new Command('admin')
             .description('Admin governance policy for Auto routing (P6 M6.5) — allow/deny providers & models, hard cost cap, PII privacy, unblock control')
@@ -46,6 +70,8 @@ export class AdminCommand extends BaseCommand {
             .addCommand(this.piiMinCommand())
             .addCommand(this.unblockCommand())
             .addCommand(this.clearCommand())
+            .addCommand(this.roleCommand())
+            .addCommand(this.whoamiCommand())
             .action(() => {
             this.showPolicy(false);
         });
@@ -131,6 +157,8 @@ export class AdminCommand extends BaseCommand {
             .description('Add providers to the allow-list (empty = all providers allowed)')
             .argument('<providers...>', 'Provider ids (e.g. groq local)')
             .action((providers) => {
+            if (!this.guard('policy.write'))
+                return;
             this.setListField('allowProviders', providers);
         });
     }
@@ -139,6 +167,8 @@ export class AdminCommand extends BaseCommand {
             .description('Add providers to the deny-list (wins over the allow-list)')
             .argument('<providers...>', 'Provider ids (e.g. gemini openrouter)')
             .action((providers) => {
+            if (!this.guard('policy.write'))
+                return;
             this.setListField('denyProviders', providers);
         });
     }
@@ -148,6 +178,8 @@ export class AdminCommand extends BaseCommand {
             .description('Add models to the allow-list — a provider survives only if one of its candidate models is listed')
             .argument('<models...>', 'Model ids (e.g. llama-3.3-70b-versatile)')
             .action((models) => {
+            if (!this.guard('policy.write'))
+                return;
             this.setListField('allowModels', models);
         });
     }
@@ -156,6 +188,8 @@ export class AdminCommand extends BaseCommand {
             .description('Add models to the deny-list (wins over the allow-list)')
             .argument('<models...>', 'Model ids')
             .action((models) => {
+            if (!this.guard('policy.write'))
+                return;
             this.setListField('denyModels', models);
         });
     }
@@ -173,6 +207,8 @@ export class AdminCommand extends BaseCommand {
             .description('Set the admin hard max cost per call (USD); joins routing.maxCostUsd (stricter wins)')
             .argument('<usd>', 'Max cost per call in USD (e.g. 0.01)')
             .action((usd) => {
+            if (!this.guard('policy.write'))
+                return;
             const num = Number(usd);
             if (isNaN(num) || num < 0) {
                 logger.error(`Invalid max-cost "${usd}". Must be a non-negative number (USD).`);
@@ -191,6 +227,8 @@ export class AdminCommand extends BaseCommand {
             .description('Set the minimum privacy score (0-1) required when a task matches a PII pattern (default 1.0 = local-only)')
             .argument('<score>', '0 to 1 (1.0 = only fully-local providers may serve PII)')
             .action((score) => {
+            if (!this.guard('policy.write'))
+                return;
             const num = Number(score);
             if (isNaN(num) || num < 0 || num > 1) {
                 logger.error(`Invalid pii-min "${score}". Must be between 0 and 1.`);
@@ -209,6 +247,8 @@ export class AdminCommand extends BaseCommand {
             .description('Control whether `buff models unblock` may override REGISTRY-learned blocks (false = admin-hard)')
             .argument('<on|off>', 'on (escape hatch open, default) or off (admin-hard)')
             .action((mode) => {
+            if (!this.guard('policy.write'))
+                return;
             const lower = mode.trim().toLowerCase();
             if (lower !== 'on' && lower !== 'off') {
                 logger.error(`Invalid unblock "${mode}". Use "on" or "off".`);
@@ -227,6 +267,8 @@ export class AdminCommand extends BaseCommand {
             .description('Remove one governance rule (the policy becomes permissive on that field)')
             .argument('<field>', `Field to clear: ${GOVERNANCE_FIELDS.join(', ')}`)
             .action((field) => {
+            if (!this.guard('policy.write'))
+                return;
             if (!GOVERNANCE_FIELDS.includes(field)) {
                 logger.error(`Unknown governance field "${field}". Valid: ${GOVERNANCE_FIELDS.join(', ')}`);
                 return;
@@ -239,5 +281,81 @@ export class AdminCommand extends BaseCommand {
             logger.success(`Cleared governance.${field}`);
         });
     }
+    // ─── role add / remove / list (P6 M6.1 RBAC — admin only) ────────────────
+    roleCommand() {
+        return new Command('role')
+            .description('Manage RBAC roles over the admin surface (P6 M6.1 — requires admin role)')
+            .addCommand(new Command('add')
+            .description('Assign a role to a user (first assignment exits legacy single-user mode)')
+            .argument('<user>', 'Username (OS user, or the OIDC subject for token mode)')
+            .argument('<role>', `Role: ${ROLES.join(' | ')}`)
+            .action((user, role) => {
+            if (!this.guard('role.manage'))
+                return;
+            try {
+                const r = this.rbac.assignRole(user, role, 'local');
+                logger.success(`${user} → ${r.role}`);
+                logger.info('Policy writes now require the admin role. Run `buff admin whoami` to confirm yours.');
+            }
+            catch (err) {
+                if (err instanceof RbacError)
+                    logger.error(`⛔ ${err.message}`);
+                else
+                    throw err;
+            }
+        }))
+            .addCommand(new Command('remove')
+            .description('Remove a user\'s role assignment (if none remain, legacy permissive mode resumes)')
+            .argument('<user>', 'Username')
+            .action((user) => {
+            if (!this.guard('role.manage'))
+                return;
+            if (this.rbac.removeUser(user))
+                logger.success(`Removed role for ${user}`);
+            else
+                logger.error(`No role assignment found for ${user}`);
+        }))
+            .addCommand(new Command('list')
+            .description('List all role assignments')
+            .action(() => {
+            if (!this.guard('role.manage'))
+                return;
+            const users = this.rbac.listUsers();
+            logger.highlight('\n  ── RBAC Role Assignments (P6 M6.1) ──\n');
+            if (users.length === 0) {
+                console.log('  Legacy single-user mode — no roles assigned, everything allowed.');
+            }
+            else {
+                for (const u of users) {
+                    console.log(`  ${u.user.padEnd(22)} ${u.role.padEnd(9)} via ${u.via || 'local'} · added ${new Date(u.addedAt).toLocaleString()}`);
+                }
+            }
+            console.log('');
+        }));
+    }
+    // ─── whoami ──────────────────────────────────────────────────────────────
+    whoamiCommand() {
+        return new Command('whoami')
+            .description('Show the current identity and its effective RBAC permissions')
+            .action(() => {
+            const user = RbacManager.currentIdentity();
+            const role = this.rbac.getRole(user);
+            logger.highlight('\n  ── RBAC Identity (P6 M6.1) ──\n');
+            console.log(`  User: ${user}`);
+            if (role) {
+                console.log(`  Role: ${role}`);
+                console.log(`  Can:  ${this.rbac.permissionsFor(role).join(', ')}`);
+            }
+            else if (this.rbac.isLegacyMode()) {
+                console.log('  Role: none (legacy single-user mode — full access)');
+                console.log('  Can:  everything (until roles are assigned)');
+            }
+            else {
+                console.log('  Role: unassigned (viewer-equivalent — read-only)');
+                console.log('  Can:  policy.read');
+            }
+            console.log('');
+        });
+    }
 }
 //# sourceMappingURL=admin.js.map

package/dist/cli/admin.js.map

@@ -1 +1 @@
-{"version":3,"file":"admin.js","sourceRoot":"","sources":["../../src/cli/admin.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;GAsBG;AAEH,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACpC,OAAO,EAAE,WAAW,EAAE,MAAM,eAAe,CAAC;AAC5C,OAAO,EAAE,MAAM,EAAE,MAAM,oBAAoB,CAAC;AAG5C,wDAAwD;AACxD,MAAM,iBAAiB,GAA0C;IAC/D,gBAAgB,EAAE,eAAe,EAAE,aAAa,EAAE,YAAY;IAC9D,YAAY,EAAE,kBAAkB,EAAE,aAAa,EAAE,cAAc;CAChE,CAAC;AAEF,2EAA2E;AAC3E,SAAS,YAAY,CAAC,OAA6B,EAAE,SAAmB;IACtE,OAAO,CAAC,GAAG,IAAI,GAAG,CAAC,CAAC,GAAG,CAAC,OAAO,IAAI,EAAE,CAAC,EAAE,GAAG,SAAS,CAAC,CAAC,CAAC,CAAC;AAC1D,CAAC;AAED,MAAM,OAAO,YAAa,SAAQ,WAAW;IAC3C,MAAM;QACJ,OAAO,IAAI,OAAO,CAAC,OAAO,CAAC;aACxB,WAAW,CAAC,iIAAiI,CAAC;aAC9I,UAAU,CAAC,IAAI,CAAC,aAAa,EAAE,CAAC;aAChC,UAAU,CAAC,IAAI,CAAC,YAAY,EAAE,CAAC;aAC/B,UAAU,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC;aAC9B,UAAU,CAAC,IAAI,CAAC,iBAAiB,EAAE,CAAC;aACpC,UAAU,CAAC,IAAI,CAAC,gBAAgB,EAAE,CAAC;aACnC,UAAU,CAAC,IAAI,CAAC,cAAc,EAAE,CAAC;aACjC,UAAU,CAAC,IAAI,CAAC,aAAa,EAAE,CAAC;aAChC,UAAU,CAAC,IAAI,CAAC,cAAc,EAAE,CAAC;aACjC,UAAU,CAAC,IAAI,CAAC,YAAY,EAAE,CAAC;aAC/B,MAAM,CAAC,GAAG,EAAE;YACX,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC;QACzB,CAAC,CAAC,CAAC;IACP,CAAC;IAED,2EAA2E;IAEnE,aAAa;QACnB,OAAO,IAAI,OAAO,CAAC,QAAQ,CAAC;aACzB,WAAW,CAAC,yDAAyD,CAAC;aACtE,MAAM,CAAC,QAAQ,EAAE,8BAA8B,CAAC;aAChD,MAAM,CAAC,CAAC,OAA4B,EAAE,EAAE;YACvC,IAAI,CAAC,UAAU,CAAC,OAAO,EAAE,IAAI,KAAK,IAAI,CAAC,CAAC;QAC1C,CAAC,CAAC,CAAC;IACP,CAAC;IAEO,UAAU,CAAC,IAAa;QAC9B,MAAM,GAAG,GAAG,IAAI,CAAC,aAAa,CAAC,MAAM,EAAE,CAAC,OAAO,EAAE,UAAU,IAAI,EAAE,CAAC;QAClE,IAAI,IAAI,EAAE,CAAC;YACT,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,UAAU,EAAE,GAAG,EAAE,QAAQ,EAAE,IAAI,CAAC,mBAAmB,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;YAChG,OAAO;QACT,CAAC;QACD,MAAM,MAAM,GAAG,iBAAiB,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,KAAK,SAAS,CAAC,CAAC;QACnE,MAAM,CAAC,SAAS,CAAC,+CAA+C,CAAC,CAAC;QAClE,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,OAAO,CAAC,GAAG,CAAC,sFAAsF,CAAC,CAAC;YACpG,OAAO,CAAC,GAAG,CAAC,iFAAiF,CAAC,CAAC;YAC/F,OAAO,CAAC,GAAG,CAAC,kFAAkF,CAAC,CAAC;QAClG,CAAC;aAAM,CAAC;YACN,MAAM,GAAG,GAAG,CAAC,KAAa,EAAE,KAAc,EAAQ,EAAE;gBAClD,MAAM,QAAQ,GAAG,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;oBACnC,CAAC,CAAE,KAAkB,CAAC,IAAI,CAAC,IAAI,CAAC;oBAChC,CAAC,CAAC,OAAO,KAAK,KAAK,QAAQ;wBACzB,CAAC,CAAC,KAAK,CAAC,WAAW,EAAE,CAAC,QAAQ,CAAC,MAAM,CAAC;4BACpC,CAAC,CAAC,IAAI,KAAK,EAAE;4BACb,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC;wBACjB,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;gBACpB,OAAO,CAAC,GAAG,CAAC,KAAK,KAAK,KAAK,QAAQ,IAAI,QAAQ,EAAE,CAAC,CAAC;YACrD,CAAC,CAAC;YACF,IAAI,GAAG,CAAC,cAAc,EAAE,MAAM;gBAAE,GAAG,CAAC,gBAAgB,EAAE,GAAG,CAAC,cAAc,CAAC,CAAC;;gBACrE,OAAO,CAAC,GAAG,CAAC,kDAAkD,CAAC,CAAC;YACrE,IAAI,GAAG,CAAC,aAAa,EAAE,MAAM;gBAAE,GAAG,CAAC,eAAe,EAAE,GAAG,CAAC,aAAa,CAAC,CAAC;;gBAClE,OAAO,CAAC,GAAG,CAAC,0BAA0B,CAAC,CAAC;YAC7C,IAAI,GAAG,CAAC,WAAW,EAAE,MAAM;gBAAE,GAAG,CAAC,aAAa,EAAE,GAAG,CAAC,WAAW,CAAC,CAAC;;gBAC5D,OAAO,CAAC,GAAG,CAAC,+CAA+C,CAAC,CAAC;YAClE,IAAI,GAAG,CAAC,UAAU,EAAE,MAAM;gBAAE,GAAG,CAAC,YAAY,EAAE,GAAG,CAAC,UAAU,CAAC,CAAC;;gBACzD,OAAO,CAAC,GAAG,CAAC,0BAA0B,CAAC,CAAC;YAC7C,GAAG,CAAC,YAAY,EAAE,GAAG,CAAC,UAAU,IAAI,4BAA4B,CAAC,CAAC;YAClE,GAAG,CAAC,kBAAkB,EAAE,GAAG,CAAC,gBAAgB,IAAI,0BAA0B,CAAC,CAAC;YAC5E,IAAI,GAAG,CAAC,WAAW,EAAE,MAAM;gBAAE,GAAG,CAAC,aAAa,EAAE,GAAG,CAAC,WAAW,CAAC,CAAC;;gBAC5D,OAAO,CAAC,GAAG,CAAC,gDAAgD,CAAC,CAAC;YACnE,GAAG,CAAC,cAAc,EAAE,GAAG,CAAC,YAAY,IAAI,kCAAkC,CAAC,CAAC;QAC9E,CAAC;QACD,OAAO,CAAC,GAAG,CAAC,OAAO,IAAI,CAAC,mBAAmB,EAAE,EAAE,CAAC,CAAC;QACjD,OAAO,CAAC,GAAG,CAAC,sFAAsF,CAAC,CAAC;QACpG,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IAClB,CAAC;IAEO,mBAAmB;QACzB,MAAM,GAAG,GAAG,IAAI,CAAC,aAAa,CAAC,MAAM,EAAE,CAAC,OAAO,EAAE,UAAU,CAAC;QAC5D,MAAM,KAAK,GAAG;YACZ,GAAG,EAAE,cAAc,EAAE,MAAM,CAAC,CAAC,CAAC,qBAAqB,CAAC,CAAC,CAAC,IAAI;YAC1D,GAAG,EAAE,aAAa,EAAE,MAAM,CAAC,CAAC,CAAC,oBAAoB,CAAC,CAAC,CAAC,IAAI;YACxD,GAAG,EAAE,WAAW,EAAE,MAAM,CAAC,CAAC,CAAC,kBAAkB,CAAC,CAAC,CAAC,IAAI;YACpD,GAAG,EAAE,UAAU,EAAE,MAAM,CAAC,CAAC,CAAC,iBAAiB,CAAC,CAAC,CAAC,IAAI;YAClD,GAAG,EAAE,UAAU,KAAK,SAAS,CAAC,CAAC,CAAC,gBAAgB,CAAC,CAAC,CAAC,IAAI;YACvD,GAAG,EAAE,WAAW,EAAE,MAAM,CAAC,CAAC,CAAC,mBAAmB,CAAC,CAAC,CAAC,IAAI;SACtD,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;QAClB,OAAO,KAAK,CAAC,MAAM,GAAG,CAAC;YACrB,CAAC,CAAC,gCAAgC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG;YACrD,CAAC,CAAC,sDAAsD,CAAC;IAC7D,CAAC;IAED,4EAA4E;IAEpE,YAAY;QAClB,OAAO,IAAI,OAAO,CAAC,OAAO,CAAC;aACxB,WAAW,CAAC,iEAAiE,CAAC;aAC9E,QAAQ,CAAC,gBAAgB,EAAE,gCAAgC,CAAC;aAC5D,MAAM,CAAC,CAAC,SAAmB,EAAE,EAAE;YAC9B,IAAI,CAAC,YAAY,CAAC,gBAAgB,EAAE,SAAS,CAAC,CAAC;QACjD,CAAC,CAAC,CAAC;IACP,CAAC;IAEO,WAAW;QACjB,OAAO,IAAI,OAAO,CAAC,MAAM,CAAC;aACvB,WAAW,CAAC,2DAA2D,CAAC;aACxE,QAAQ,CAAC,gBAAgB,EAAE,uCAAuC,CAAC;aACnE,MAAM,CAAC,CAAC,SAAmB,EAAE,EAAE;YAC9B,IAAI,CAAC,YAAY,CAAC,eAAe,EAAE,SAAS,CAAC,CAAC;QAChD,CAAC,CAAC,CAAC;IACP,CAAC;IAED,4EAA4E;IAEpE,iBAAiB;QACvB,OAAO,IAAI,OAAO,CAAC,aAAa,CAAC;aAC9B,WAAW,CAAC,kGAAkG,CAAC;aAC/G,QAAQ,CAAC,aAAa,EAAE,0CAA0C,CAAC;aACnE,MAAM,CAAC,CAAC,MAAgB,EAAE,EAAE;YAC3B,IAAI,CAAC,YAAY,CAAC,aAAa,EAAE,MAAM,CAAC,CAAC;QAC3C,CAAC,CAAC,CAAC;IACP,CAAC;IAEO,gBAAgB;QACtB,OAAO,IAAI,OAAO,CAAC,YAAY,CAAC;aAC7B,WAAW,CAAC,wDAAwD,CAAC;aACrE,QAAQ,CAAC,aAAa,EAAE,WAAW,CAAC;aACpC,MAAM,CAAC,CAAC,MAAgB,EAAE,EAAE;YAC3B,IAAI,CAAC,YAAY,CAAC,YAAY,EAAE,MAAM,CAAC,CAAC;QAC1C,CAAC,CAAC,CAAC;IACP,CAAC;IAEO,YAAY,CAAC,KAAwE,EAAE,MAAgB;QAC7G,MAAM,GAAG,GAAG,IAAI,CAAC,aAAa,CAAC,MAAM,EAAE,CAAC,OAAO,EAAE,UAAU,IAAI,EAAE,CAAC;QAClE,MAAM,MAAM,GAAG,YAAY,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC,CAAC;QAChD,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC;YACtB,OAAO,EAAE,EAAE,UAAU,EAAE,EAAE,GAAG,GAAG,EAAE,CAAC,KAAK,CAAC,EAAE,MAAM,EAAE,EAAE;SAC9B,CAAC,CAAC;QAC1B,MAAM,CAAC,OAAO,CAAC,GAAG,KAAK,MAAM,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACpD,CAAC;IAED,4EAA4E;IAEpE,cAAc;QACpB,OAAO,IAAI,OAAO,CAAC,UAAU,CAAC;aAC3B,WAAW,CAAC,sFAAsF,CAAC;aACnG,QAAQ,CAAC,OAAO,EAAE,sCAAsC,CAAC;aACzD,MAAM,CAAC,CAAC,GAAW,EAAE,EAAE;YACtB,MAAM,GAAG,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC;YACxB,IAAI,KAAK,CAAC,GAAG,CAAC,IAAI,GAAG,GAAG,CAAC,EAAE,CAAC;gBAC1B,MAAM,CAAC,KAAK,CAAC,qBAAqB,GAAG,yCAAyC,CAAC,CAAC;gBAChF,OAAO;YACT,CAAC;YACD,MAAM,GAAG,GAAG,IAAI,CAAC,aAAa,CAAC,MAAM,EAAE,CAAC,OAAO,EAAE,UAAU,IAAI,EAAE,CAAC;YAClE,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC;gBACtB,OAAO,EAAE,EAAE,UAAU,EAAE,EAAE,GAAG,GAAG,EAAE,UAAU,EAAE,GAAG,EAAE,EAAE;aAC9B,CAAC,CAAC;YAC1B,MAAM,CAAC,OAAO,CAAC,2BAA2B,GAAG,EAAE,CAAC,CAAC;QACnD,CAAC,CAAC,CAAC;IACP,CAAC;IAED,4EAA4E;IAEpE,aAAa;QACnB,OAAO,IAAI,OAAO,CAAC,SAAS,CAAC;aAC1B,WAAW,CAAC,2GAA2G,CAAC;aACxH,QAAQ,CAAC,SAAS,EAAE,yDAAyD,CAAC;aAC9E,MAAM,CAAC,CAAC,KAAa,EAAE,EAAE;YACxB,MAAM,GAAG,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC;YAC1B,IAAI,KAAK,CAAC,GAAG,CAAC,IAAI,GAAG,GAAG,CAAC,IAAI,GAAG,GAAG,CAAC,EAAE,CAAC;gBACrC,MAAM,CAAC,KAAK,CAAC,oBAAoB,KAAK,6BAA6B,CAAC,CAAC;gBACrE,OAAO;YACT,CAAC;YACD,MAAM,GAAG,GAAG,IAAI,CAAC,aAAa,CAAC,MAAM,EAAE,CAAC,OAAO,EAAE,UAAU,IAAI,EAAE,CAAC;YAClE,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC;gBACtB,OAAO,EAAE,EAAE,UAAU,EAAE,EAAE,GAAG,GAAG,EAAE,gBAAgB,EAAE,GAAG,EAAE,EAAE;aACpC,CAAC,CAAC;YAC1B,MAAM,CAAC,OAAO,CAAC,iCAAiC,GAAG,EAAE,CAAC,CAAC;QACzD,CAAC,CAAC,CAAC;IACP,CAAC;IAED,4EAA4E;IAEpE,cAAc;QACpB,OAAO,IAAI,OAAO,CAAC,SAAS,CAAC;aAC1B,WAAW,CAAC,iGAAiG,CAAC;aAC9G,QAAQ,CAAC,UAAU,EAAE,qDAAqD,CAAC;aAC3E,MAAM,CAAC,CAAC,IAAY,EAAE,EAAE;YACvB,MAAM,KAAK,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;YACxC,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,KAAK,KAAK,EAAE,CAAC;gBACtC,MAAM,CAAC,KAAK,CAAC,oBAAoB,IAAI,uBAAuB,CAAC,CAAC;gBAC9D,OAAO;YACT,CAAC;YACD,MAAM,GAAG,GAAG,IAAI,CAAC,aAAa,CAAC,MAAM,EAAE,CAAC,OAAO,EAAE,UAAU,IAAI,EAAE,CAAC;YAClE,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC;gBACtB,OAAO,EAAE,EAAE,UAAU,EAAE,EAAE,GAAG,GAAG,EAAE,YAAY,EAAE,KAAK,KAAK,IAAI,EAAE,EAAE;aAC3C,CAAC,CAAC;YAC1B,MAAM,CAAC,OAAO,CAAC,6BAA6B,KAAK,KAAK,IAAI,KAAK,KAAK,KAAK,IAAI,CAAC,CAAC,CAAC,iBAAiB,CAAC,CAAC,CAAC,gCAAgC,GAAG,CAAC,CAAC;QAC3I,CAAC,CAAC,CAAC;IACP,CAAC;IAED,4EAA4E;IAEpE,YAAY;QAClB,OAAO,IAAI,OAAO,CAAC,OAAO,CAAC;aACxB,WAAW,CAAC,0EAA0E,CAAC;aACvF,QAAQ,CAAC,SAAS,EAAE,mBAAmB,iBAAiB,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;aACtE,MAAM,CAAC,CAAC,KAAa,EAAE,EAAE;YACxB,IAAI,CAAE,iBAA2C,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;gBAClE,MAAM,CAAC,KAAK,CAAC,6BAA6B,KAAK,aAAa,iBAAiB,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;gBAC5F,OAAO;YACT,CAAC;YACD,MAAM,GAAG,GAAG,IAAI,CAAC,aAAa,CAAC,MAAM,EAAE,CAAC,OAAO,EAAE,UAAU,IAAI,EAAE,CAAC;YAClE,MAAM,EAAE,CAAC,KAA+B,CAAC,EAAE,QAAQ,EAAE,GAAG,IAAI,EAAE,GAAG,GAAG,CAAC;YACrE,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC;gBACtB,OAAO,EAAE,EAAE,UAAU,EAAE,IAAI,EAAE;aACP,CAAC,CAAC;YAC1B,MAAM,CAAC,OAAO,CAAC,sBAAsB,KAAK,EAAE,CAAC,CAAC;QAChD,CAAC,CAAC,CAAC;IACP,CAAC;CACF"}
+{"version":3,"file":"admin.js","sourceRoot":"","sources":["../../src/cli/admin.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;GAsBG;AAEH,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACpC,OAAO,EAAE,WAAW,EAAE,MAAM,eAAe,CAAC;AAC5C,OAAO,EAAE,MAAM,EAAE,MAAM,oBAAoB,CAAC;AAC5C,OAAO,EAAE,WAAW,EAAE,SAAS,EAAE,KAAK,EAAE,MAAM,uBAAuB,CAAC;AAItE,wDAAwD;AACxD,MAAM,iBAAiB,GAA0C;IAC/D,gBAAgB,EAAE,eAAe,EAAE,aAAa,EAAE,YAAY;IAC9D,YAAY,EAAE,kBAAkB,EAAE,aAAa,EAAE,cAAc;CAChE,CAAC;AAEF,2EAA2E;AAC3E,SAAS,YAAY,CAAC,OAA6B,EAAE,SAAmB;IACtE,OAAO,CAAC,GAAG,IAAI,GAAG,CAAC,CAAC,GAAG,CAAC,OAAO,IAAI,EAAE,CAAC,EAAE,GAAG,SAAS,CAAC,CAAC,CAAC,CAAC;AAC1D,CAAC;AAED,MAAM,OAAO,YAAa,SAAQ,WAAW;IAC3C,mFAAmF;IAC3E,IAAI,GAAG,IAAI,WAAW,EAAE,CAAC;IAEjC;;;;;OAKG;IACK,KAAK,CAAC,MAAmB;QAC/B,IAAI,IAAI,CAAC,IAAI,CAAC,YAAY,EAAE;YAAE,OAAO,IAAI,CAAC;QAC1C,IAAI,CAAC;YACH,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC;YAC7B,OAAO,IAAI,CAAC;QACd,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,GAAG,YAAY,SAAS,EAAE,CAAC;gBAC7B,MAAM,CAAC,KAAK,CAAC,KAAK,GAAG,CAAC,OAAO,EAAE,CAAC,CAAC;gBACjC,MAAM,CAAC,KAAK,CAAC,qEAAqE,CAAC,CAAC;YACtF,CAAC;YACD,OAAO,KAAK,CAAC;QACf,CAAC;IACH,CAAC;IAED,MAAM;QACJ,OAAO,IAAI,OAAO,CAAC,OAAO,CAAC;aACxB,WAAW,CAAC,iIAAiI,CAAC;aAC9I,UAAU,CAAC,IAAI,CAAC,aAAa,EAAE,CAAC;aAChC,UAAU,CAAC,IAAI,CAAC,YAAY,EAAE,CAAC;aAC/B,UAAU,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC;aAC9B,UAAU,CAAC,IAAI,CAAC,iBAAiB,EAAE,CAAC;aACpC,UAAU,CAAC,IAAI,CAAC,gBAAgB,EAAE,CAAC;aACnC,UAAU,CAAC,IAAI,CAAC,cAAc,EAAE,CAAC;aACjC,UAAU,CAAC,IAAI,CAAC,aAAa,EAAE,CAAC;aAChC,UAAU,CAAC,IAAI,CAAC,cAAc,EAAE,CAAC;aACjC,UAAU,CAAC,IAAI,CAAC,YAAY,EAAE,CAAC;aAC/B,UAAU,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC;aAC9B,UAAU,CAAC,IAAI,CAAC,aAAa,EAAE,CAAC;aAChC,MAAM,CAAC,GAAG,EAAE;YACX,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC;QACzB,CAAC,CAAC,CAAC;IACP,CAAC;IAED,2EAA2E;IAEnE,aAAa;QACnB,OAAO,IAAI,OAAO,CAAC,QAAQ,CAAC;aACzB,WAAW,CAAC,yDAAyD,CAAC;aACtE,MAAM,CAAC,QAAQ,EAAE,8BAA8B,CAAC;aAChD,MAAM,CAAC,CAAC,OAA4B,EAAE,EAAE;YACvC,IAAI,CAAC,UAAU,CAAC,OAAO,EAAE,IAAI,KAAK,IAAI,CAAC,CAAC;QAC1C,CAAC,CAAC,CAAC;IACP,CAAC;IAEO,UAAU,CAAC,IAAa;QAC9B,MAAM,GAAG,GAAG,IAAI,CAAC,aAAa,CAAC,MAAM,EAAE,CAAC,OAAO,EAAE,UAAU,IAAI,EAAE,CAAC;QAClE,IAAI,IAAI,EAAE,CAAC;YACT,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,UAAU,EAAE,GAAG,EAAE,QAAQ,EAAE,IAAI,CAAC,mBAAmB,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;YAChG,OAAO;QACT,CAAC;QACD,MAAM,MAAM,GAAG,iBAAiB,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,KAAK,SAAS,CAAC,CAAC;QACnE,MAAM,CAAC,SAAS,CAAC,+CAA+C,CAAC,CAAC;QAClE,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,OAAO,CAAC,GAAG,CAAC,sFAAsF,CAAC,CAAC;YACpG,OAAO,CAAC,GAAG,CAAC,iFAAiF,CAAC,CAAC;YAC/F,OAAO,CAAC,GAAG,CAAC,kFAAkF,CAAC,CAAC;QAClG,CAAC;aAAM,CAAC;YACN,MAAM,GAAG,GAAG,CAAC,KAAa,EAAE,KAAc,EAAQ,EAAE;gBAClD,MAAM,QAAQ,GAAG,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;oBACnC,CAAC,CAAE,KAAkB,CAAC,IAAI,CAAC,IAAI,CAAC;oBAChC,CAAC,CAAC,OAAO,KAAK,KAAK,QAAQ;wBACzB,CAAC,CAAC,KAAK,CAAC,WAAW,EAAE,CAAC,QAAQ,CAAC,MAAM,CAAC;4BACpC,CAAC,CAAC,IAAI,KAAK,EAAE;4BACb,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC;wBACjB,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;gBACpB,OAAO,CAAC,GAAG,CAAC,KAAK,KAAK,KAAK,QAAQ,IAAI,QAAQ,EAAE,CAAC,CAAC;YACrD,CAAC,CAAC;YACF,IAAI,GAAG,CAAC,cAAc,EAAE,MAAM;gBAAE,GAAG,CAAC,gBAAgB,EAAE,GAAG,CAAC,cAAc,CAAC,CAAC;;gBACrE,OAAO,CAAC,GAAG,CAAC,kDAAkD,CAAC,CAAC;YACrE,IAAI,GAAG,CAAC,aAAa,EAAE,MAAM;gBAAE,GAAG,CAAC,eAAe,EAAE,GAAG,CAAC,aAAa,CAAC,CAAC;;gBAClE,OAAO,CAAC,GAAG,CAAC,0BAA0B,CAAC,CAAC;YAC7C,IAAI,GAAG,CAAC,WAAW,EAAE,MAAM;gBAAE,GAAG,CAAC,aAAa,EAAE,GAAG,CAAC,WAAW,CAAC,CAAC;;gBAC5D,OAAO,CAAC,GAAG,CAAC,+CAA+C,CAAC,CAAC;YAClE,IAAI,GAAG,CAAC,UAAU,EAAE,MAAM;gBAAE,GAAG,CAAC,YAAY,EAAE,GAAG,CAAC,UAAU,CAAC,CAAC;;gBACzD,OAAO,CAAC,GAAG,CAAC,0BAA0B,CAAC,CAAC;YAC7C,GAAG,CAAC,YAAY,EAAE,GAAG,CAAC,UAAU,IAAI,4BAA4B,CAAC,CAAC;YAClE,GAAG,CAAC,kBAAkB,EAAE,GAAG,CAAC,gBAAgB,IAAI,0BAA0B,CAAC,CAAC;YAC5E,IAAI,GAAG,CAAC,WAAW,EAAE,MAAM;gBAAE,GAAG,CAAC,aAAa,EAAE,GAAG,CAAC,WAAW,CAAC,CAAC;;gBAC5D,OAAO,CAAC,GAAG,CAAC,gDAAgD,CAAC,CAAC;YACnE,GAAG,CAAC,cAAc,EAAE,GAAG,CAAC,YAAY,IAAI,kCAAkC,CAAC,CAAC;QAC9E,CAAC;QACD,OAAO,CAAC,GAAG,CAAC,OAAO,IAAI,CAAC,mBAAmB,EAAE,EAAE,CAAC,CAAC;QACjD,OAAO,CAAC,GAAG,CAAC,sFAAsF,CAAC,CAAC;QACpG,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IAClB,CAAC;IAEO,mBAAmB;QACzB,MAAM,GAAG,GAAG,IAAI,CAAC,aAAa,CAAC,MAAM,EAAE,CAAC,OAAO,EAAE,UAAU,CAAC;QAC5D,MAAM,KAAK,GAAG;YACZ,GAAG,EAAE,cAAc,EAAE,MAAM,CAAC,CAAC,CAAC,qBAAqB,CAAC,CAAC,CAAC,IAAI;YAC1D,GAAG,EAAE,aAAa,EAAE,MAAM,CAAC,CAAC,CAAC,oBAAoB,CAAC,CAAC,CAAC,IAAI;YACxD,GAAG,EAAE,WAAW,EAAE,MAAM,CAAC,CAAC,CAAC,kBAAkB,CAAC,CAAC,CAAC,IAAI;YACpD,GAAG,EAAE,UAAU,EAAE,MAAM,CAAC,CAAC,CAAC,iBAAiB,CAAC,CAAC,CAAC,IAAI;YAClD,GAAG,EAAE,UAAU,KAAK,SAAS,CAAC,CAAC,CAAC,gBAAgB,CAAC,CAAC,CAAC,IAAI;YACvD,GAAG,EAAE,WAAW,EAAE,MAAM,CAAC,CAAC,CAAC,mBAAmB,CAAC,CAAC,CAAC,IAAI;SACtD,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;QAClB,OAAO,KAAK,CAAC,MAAM,GAAG,CAAC;YACrB,CAAC,CAAC,gCAAgC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG;YACrD,CAAC,CAAC,sDAAsD,CAAC;IAC7D,CAAC;IAED,4EAA4E;IAEpE,YAAY;QAClB,OAAO,IAAI,OAAO,CAAC,OAAO,CAAC;aACxB,WAAW,CAAC,iEAAiE,CAAC;aAC9E,QAAQ,CAAC,gBAAgB,EAAE,gCAAgC,CAAC;aAC5D,MAAM,CAAC,CAAC,SAAmB,EAAE,EAAE;YAC9B,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,cAAc,CAAC;gBAAE,OAAO;YACxC,IAAI,CAAC,YAAY,CAAC,gBAAgB,EAAE,SAAS,CAAC,CAAC;QACjD,CAAC,CAAC,CAAC;IACP,CAAC;IAEO,WAAW;QACjB,OAAO,IAAI,OAAO,CAAC,MAAM,CAAC;aACvB,WAAW,CAAC,2DAA2D,CAAC;aACxE,QAAQ,CAAC,gBAAgB,EAAE,uCAAuC,CAAC;aACnE,MAAM,CAAC,CAAC,SAAmB,EAAE,EAAE;YAC9B,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,cAAc,CAAC;gBAAE,OAAO;YACxC,IAAI,CAAC,YAAY,CAAC,eAAe,EAAE,SAAS,CAAC,CAAC;QAChD,CAAC,CAAC,CAAC;IACP,CAAC;IAED,4EAA4E;IAEpE,iBAAiB;QACvB,OAAO,IAAI,OAAO,CAAC,aAAa,CAAC;aAC9B,WAAW,CAAC,kGAAkG,CAAC;aAC/G,QAAQ,CAAC,aAAa,EAAE,0CAA0C,CAAC;aACnE,MAAM,CAAC,CAAC,MAAgB,EAAE,EAAE;YAC3B,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,cAAc,CAAC;gBAAE,OAAO;YACxC,IAAI,CAAC,YAAY,CAAC,aAAa,EAAE,MAAM,CAAC,CAAC;QAC3C,CAAC,CAAC,CAAC;IACP,CAAC;IAEO,gBAAgB;QACtB,OAAO,IAAI,OAAO,CAAC,YAAY,CAAC;aAC7B,WAAW,CAAC,wDAAwD,CAAC;aACrE,QAAQ,CAAC,aAAa,EAAE,WAAW,CAAC;aACpC,MAAM,CAAC,CAAC,MAAgB,EAAE,EAAE;YAC3B,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,cAAc,CAAC;gBAAE,OAAO;YACxC,IAAI,CAAC,YAAY,CAAC,YAAY,EAAE,MAAM,CAAC,CAAC;QAC1C,CAAC,CAAC,CAAC;IACP,CAAC;IAEO,YAAY,CAAC,KAAwE,EAAE,MAAgB;QAC7G,MAAM,GAAG,GAAG,IAAI,CAAC,aAAa,CAAC,MAAM,EAAE,CAAC,OAAO,EAAE,UAAU,IAAI,EAAE,CAAC;QAClE,MAAM,MAAM,GAAG,YAAY,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC,CAAC;QAChD,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC;YACtB,OAAO,EAAE,EAAE,UAAU,EAAE,EAAE,GAAG,GAAG,EAAE,CAAC,KAAK,CAAC,EAAE,MAAM,EAAE,EAAE;SAC9B,CAAC,CAAC;QAC1B,MAAM,CAAC,OAAO,CAAC,GAAG,KAAK,MAAM,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACpD,CAAC;IAED,4EAA4E;IAEpE,cAAc;QACpB,OAAO,IAAI,OAAO,CAAC,UAAU,CAAC;aAC3B,WAAW,CAAC,sFAAsF,CAAC;aACnG,QAAQ,CAAC,OAAO,EAAE,sCAAsC,CAAC;aACzD,MAAM,CAAC,CAAC,GAAW,EAAE,EAAE;YACtB,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,cAAc,CAAC;gBAAE,OAAO;YACxC,MAAM,GAAG,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC;YACxB,IAAI,KAAK,CAAC,GAAG,CAAC,IAAI,GAAG,GAAG,CAAC,EAAE,CAAC;gBAC1B,MAAM,CAAC,KAAK,CAAC,qBAAqB,GAAG,yCAAyC,CAAC,CAAC;gBAChF,OAAO;YACT,CAAC;YACD,MAAM,GAAG,GAAG,IAAI,CAAC,aAAa,CAAC,MAAM,EAAE,CAAC,OAAO,EAAE,UAAU,IAAI,EAAE,CAAC;YAClE,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC;gBACtB,OAAO,EAAE,EAAE,UAAU,EAAE,EAAE,GAAG,GAAG,EAAE,UAAU,EAAE,GAAG,EAAE,EAAE;aAC9B,CAAC,CAAC;YAC1B,MAAM,CAAC,OAAO,CAAC,2BAA2B,GAAG,EAAE,CAAC,CAAC;QACnD,CAAC,CAAC,CAAC;IACP,CAAC;IAED,4EAA4E;IAEpE,aAAa;QACnB,OAAO,IAAI,OAAO,CAAC,SAAS,CAAC;aAC1B,WAAW,CAAC,2GAA2G,CAAC;aACxH,QAAQ,CAAC,SAAS,EAAE,yDAAyD,CAAC;aAC9E,MAAM,CAAC,CAAC,KAAa,EAAE,EAAE;YACxB,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,cAAc,CAAC;gBAAE,OAAO;YACxC,MAAM,GAAG,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC;YAC1B,IAAI,KAAK,CAAC,GAAG,CAAC,IAAI,GAAG,GAAG,CAAC,IAAI,GAAG,GAAG,CAAC,EAAE,CAAC;gBACrC,MAAM,CAAC,KAAK,CAAC,oBAAoB,KAAK,6BAA6B,CAAC,CAAC;gBACrE,OAAO;YACT,CAAC;YACD,MAAM,GAAG,GAAG,IAAI,CAAC,aAAa,CAAC,MAAM,EAAE,CAAC,OAAO,EAAE,UAAU,IAAI,EAAE,CAAC;YAClE,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC;gBACtB,OAAO,EAAE,EAAE,UAAU,EAAE,EAAE,GAAG,GAAG,EAAE,gBAAgB,EAAE,GAAG,EAAE,EAAE;aACpC,CAAC,CAAC;YAC1B,MAAM,CAAC,OAAO,CAAC,iCAAiC,GAAG,EAAE,CAAC,CAAC;QACzD,CAAC,CAAC,CAAC;IACP,CAAC;IAED,4EAA4E;IAEpE,cAAc;QACpB,OAAO,IAAI,OAAO,CAAC,SAAS,CAAC;aAC1B,WAAW,CAAC,iGAAiG,CAAC;aAC9G,QAAQ,CAAC,UAAU,EAAE,qDAAqD,CAAC;aAC3E,MAAM,CAAC,CAAC,IAAY,EAAE,EAAE;YACvB,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,cAAc,CAAC;gBAAE,OAAO;YACxC,MAAM,KAAK,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;YACxC,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,KAAK,KAAK,EAAE,CAAC;gBACtC,MAAM,CAAC,KAAK,CAAC,oBAAoB,IAAI,uBAAuB,CAAC,CAAC;gBAC9D,OAAO;YACT,CAAC;YACD,MAAM,GAAG,GAAG,IAAI,CAAC,aAAa,CAAC,MAAM,EAAE,CAAC,OAAO,EAAE,UAAU,IAAI,EAAE,CAAC;YAClE,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC;gBACtB,OAAO,EAAE,EAAE,UAAU,EAAE,EAAE,GAAG,GAAG,EAAE,YAAY,EAAE,KAAK,KAAK,IAAI,EAAE,EAAE;aAC3C,CAAC,CAAC;YAC1B,MAAM,CAAC,OAAO,CAAC,6BAA6B,KAAK,KAAK,IAAI,KAAK,KAAK,KAAK,IAAI,CAAC,CAAC,CAAC,iBAAiB,CAAC,CAAC,CAAC,gCAAgC,GAAG,CAAC,CAAC;QAC3I,CAAC,CAAC,CAAC;IACP,CAAC;IAED,4EAA4E;IAEpE,YAAY;QAClB,OAAO,IAAI,OAAO,CAAC,OAAO,CAAC;aACxB,WAAW,CAAC,0EAA0E,CAAC;aACvF,QAAQ,CAAC,SAAS,EAAE,mBAAmB,iBAAiB,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;aACtE,MAAM,CAAC,CAAC,KAAa,EAAE,EAAE;YACxB,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,cAAc,CAAC;gBAAE,OAAO;YACxC,IAAI,CAAE,iBAA2C,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;gBAClE,MAAM,CAAC,KAAK,CAAC,6BAA6B,KAAK,aAAa,iBAAiB,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;gBAC5F,OAAO;YACT,CAAC;YACD,MAAM,GAAG,GAAG,IAAI,CAAC,aAAa,CAAC,MAAM,EAAE,CAAC,OAAO,EAAE,UAAU,IAAI,EAAE,CAAC;YAClE,MAAM,EAAE,CAAC,KAA+B,CAAC,EAAE,QAAQ,EAAE,GAAG,IAAI,EAAE,GAAG,GAAG,CAAC;YACrE,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC;gBACtB,OAAO,EAAE,EAAE,UAAU,EAAE,IAAI,EAAE;aACP,CAAC,CAAC;YAC1B,MAAM,CAAC,OAAO,CAAC,sBAAsB,KAAK,EAAE,CAAC,CAAC;QAChD,CAAC,CAAC,CAAC;IACP,CAAC;IAED,4EAA4E;IAEpE,WAAW;QACjB,OAAO,IAAI,OAAO,CAAC,MAAM,CAAC;aACvB,WAAW,CAAC,0EAA0E,CAAC;aACvF,UAAU,CAAC,IAAI,OAAO,CAAC,KAAK,CAAC;aAC3B,WAAW,CAAC,0EAA0E,CAAC;aACvF,QAAQ,CAAC,QAAQ,EAAE,wDAAwD,CAAC;aAC5E,QAAQ,CAAC,QAAQ,EAAE,SAAS,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;aAChD,MAAM,CAAC,CAAC,IAAY,EAAE,IAAY,EAAE,EAAE;YACrC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,aAAa,CAAC;gBAAE,OAAO;YACvC,IAAI,CAAC;gBACH,MAAM,CAAC,GAAG,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,IAAI,EAAE,IAAY,EAAE,OAAO,CAAC,CAAC;gBAC5D,MAAM,CAAC,OAAO,CAAC,GAAG,IAAI,MAAM,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;gBACtC,MAAM,CAAC,IAAI,CAAC,qFAAqF,CAAC,CAAC;YACrG,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,IAAI,GAAG,YAAY,SAAS;oBAAE,MAAM,CAAC,KAAK,CAAC,KAAK,GAAG,CAAC,OAAO,EAAE,CAAC,CAAC;;oBAC1D,MAAM,GAAG,CAAC;YACjB,CAAC;QACH,CAAC,CAAC,CAAC;aACJ,UAAU,CAAC,IAAI,OAAO,CAAC,QAAQ,CAAC;aAC9B,WAAW,CAAC,mFAAmF,CAAC;aAChG,QAAQ,CAAC,QAAQ,EAAE,UAAU,CAAC;aAC9B,MAAM,CAAC,CAAC,IAAY,EAAE,EAAE;YACvB,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,aAAa,CAAC;gBAAE,OAAO;YACvC,IAAI,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC;gBAAE,MAAM,CAAC,OAAO,CAAC,oBAAoB,IAAI,EAAE,CAAC,CAAC;;gBACtE,MAAM,CAAC,KAAK,CAAC,gCAAgC,IAAI,EAAE,CAAC,CAAC;QAC5D,CAAC,CAAC,CAAC;aACJ,UAAU,CAAC,IAAI,OAAO,CAAC,MAAM,CAAC;aAC5B,WAAW,CAAC,2BAA2B,CAAC;aACxC,MAAM,CAAC,GAAG,EAAE;YACX,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,aAAa,CAAC;gBAAE,OAAO;YACvC,MAAM,KAAK,GAAG,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,CAAC;YACpC,MAAM,CAAC,SAAS,CAAC,6CAA6C,CAAC,CAAC;YAChE,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;gBACvB,OAAO,CAAC,GAAG,CAAC,oEAAoE,CAAC,CAAC;YACpF,CAAC;iBAAM,CAAC;gBACN,KAAK,MAAM,CAAC,IAAI,KAAK,EAAE,CAAC;oBACtB,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,GAAG,IAAI,OAAO,YAAY,IAAI,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,cAAc,EAAE,EAAE,CAAC,CAAC;gBACpI,CAAC;YACH,CAAC;YACD,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAClB,CAAC,CAAC,CAAC,CAAC;IACV,CAAC;IAED,4EAA4E;IAEpE,aAAa;QACnB,OAAO,IAAI,OAAO,CAAC,QAAQ,CAAC;aACzB,WAAW,CAAC,8DAA8D,CAAC;aAC3E,MAAM,CAAC,GAAG,EAAE;YACX,MAAM,IAAI,GAAG,WAAW,CAAC,eAAe,EAAE,CAAC;YAC3C,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;YACrC,MAAM,CAAC,SAAS,CAAC,qCAAqC,CAAC,CAAC;YACxD,OAAO,CAAC,GAAG,CAAC,WAAW,IAAI,EAAE,CAAC,CAAC;YAC/B,IAAI,IAAI,EAAE,CAAC;gBACT,OAAO,CAAC,GAAG,CAAC,WAAW,IAAI,EAAE,CAAC,CAAC;gBAC/B,OAAO,CAAC,GAAG,CAAC,WAAW,IAAI,CAAC,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;YACtE,CAAC;iBAAM,IAAI,IAAI,CAAC,IAAI,CAAC,YAAY,EAAE,EAAE,CAAC;gBACpC,OAAO,CAAC,GAAG,CAAC,sDAAsD,CAAC,CAAC;gBACpE,OAAO,CAAC,GAAG,CAAC,+CAA+C,CAAC,CAAC;YAC/D,CAAC;iBAAM,CAAC;gBACN,OAAO,CAAC,GAAG,CAAC,oDAAoD,CAAC,CAAC;gBAClE,OAAO,CAAC,GAAG,CAAC,qBAAqB,CAAC,CAAC;YACrC,CAAC;YACD,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAClB,CAAC,CAAC,CAAC;IACP,CAAC;CACF"}

package/dist/enterprise/rbac.d.ts

@@ -0,0 +1,86 @@
+/**
+ * RbacManager — P6 M6.1 role-based access control over the admin/governance
+ * surface.
+ *
+ * Minimal first milestone, deliberately:
+ * - A local role file (`~/.buff/rbac.json`, or BUFF_CONFIG_DIR override) maps
+ *   OS user → role. **Legacy single-user mode**: when the file has no users,
+ *   everything stays allowed — enabling RBAC can never lock you out.
+ * - A permission matrix (admin / operator / viewer) gates the `buff admin`
+ *   surface: policy *writes* and role management require `admin`; policy
+ *   *reads* are open to every role; `operator` may run routing/models.
+ * - An **OIDC adapter interface** is the seam for token-backed identity: a
+ *   future gateway can implement `OidcAdapter.verify(token)` and swap in
+ *   verified identities without touching the enforcement paths.
+ *
+ * The identity for local mode is the OS username (`process.env.USER`), with
+ * `BUFF_ACT_AS` as an override for CI/tests/multi-tenant tooling.
+ */
+/** Built-in roles — least privilege by default (viewer is read-only). */
+export type Role = 'admin' | 'operator' | 'viewer';
+export declare const ROLES: readonly Role[];
+/** One user's role assignment in the local role file. */
+export interface RbacUser {
+    role: Role;
+    /** Epoch ms the assignment was written. */
+    addedAt: number;
+    /** How the identity was established: 'local' (OS user) or 'oidc'. */
+    via?: 'local' | 'oidc';
+}
+/** Actions on the admin/enterprise surface that roles gate. */
+export type AdminAction = 'policy.read' | 'policy.write' | 'role.manage' | 'credential.write' | 'routing.operate';
+/** Thrown when the current identity lacks permission for an action. */
+export declare class RbacError extends Error {
+    constructor(message: string);
+}
+/**
+ * OIDC adapter interface — the seam for token-backed identity. Implement this
+ * to verify a bearer token into a verified identity; the gateway milestone
+ * (M6.4) will wire it in. `groups` may map to roles downstream.
+ */
+export interface OidcAdapter {
+    /** Verify a bearer token → identity, or null when invalid/expired. */
+    verify(token: string): Promise<{
+        sub: string;
+        email?: string;
+        groups?: string[];
+    } | null>;
+}
+/** Default adapter: no token mode — identity is always the local OS user. */
+export declare class NoOidcAdapter implements OidcAdapter {
+    verify(): Promise<null>;
+}
+export declare class RbacManager {
+    private users;
+    private path;
+    constructor(path?: string);
+    /** The acting identity — OS user, overridable via BUFF_ACT_AS (CI/tests). */
+    static currentIdentity(): string;
+    /** Single-user legacy mode: no role file / no users → fully permissive. */
+    isLegacyMode(): boolean;
+    /** Role assigned to a user, or undefined when unassigned. */
+    getRole(user: string): Role | undefined;
+    /** May `user` perform `action`? Unassigned users have no permissions. */
+    can(user: string, action: AdminAction): boolean;
+    /** Permissions granted to a role (for `whoami` / diagnostics). */
+    permissionsFor(role: Role): AdminAction[];
+    /**
+     * Enforce `action` for the current identity. Throws RbacError when denied.
+     * Callers SHOULD check `isLegacyMode()` first (legacy = permissive), unless
+     * they intend to be strict even before RBAC is configured.
+     */
+    requireCan(action: AdminAction, user?: string): void;
+    /** Assign (or re-assign) a role. Persists. */
+    assignRole(user: string, role: Role, via?: 'local' | 'oidc'): RbacUser;
+    /** Remove a user's role assignment. Returns true when one existed. */
+    removeUser(user: string): boolean;
+    /** All assigned users, sorted by name. */
+    listUsers(): Array<{
+        user: string;
+    } & RbacUser>;
+    /** Reset to legacy mode (tests / recovery). */
+    reset(): void;
+    private load;
+    private persist;
+}
+//# sourceMappingURL=rbac.d.ts.map

package/dist/enterprise/rbac.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"rbac.d.ts","sourceRoot":"","sources":["../../src/enterprise/rbac.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AASH,yEAAyE;AACzE,MAAM,MAAM,IAAI,GAAG,OAAO,GAAG,UAAU,GAAG,QAAQ,CAAC;AACnD,eAAO,MAAM,KAAK,EAAE,SAAS,IAAI,EAAoC,CAAC;AAEtE,yDAAyD;AACzD,MAAM,WAAW,QAAQ;IACvB,IAAI,EAAE,IAAI,CAAC;IACX,2CAA2C;IAC3C,OAAO,EAAE,MAAM,CAAC;IAChB,qEAAqE;IACrE,GAAG,CAAC,EAAE,OAAO,GAAG,MAAM,CAAC;CACxB;AAED,+DAA+D;AAC/D,MAAM,MAAM,WAAW,GACnB,aAAa,GACb,cAAc,GACd,aAAa,GACb,kBAAkB,GAClB,iBAAiB,CAAC;AAgBtB,uEAAuE;AACvE,qBAAa,SAAU,SAAQ,KAAK;gBACtB,OAAO,EAAE,MAAM;CAI5B;AAED;;;;GAIG;AACH,MAAM,WAAW,WAAW;IAC1B,sEAAsE;IACtE,MAAM,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC;QAAE,GAAG,EAAE,MAAM,CAAC;QAAC,KAAK,CAAC,EAAE,MAAM,CAAC;QAAC,MAAM,CAAC,EAAE,MAAM,EAAE,CAAA;KAAE,GAAG,IAAI,CAAC,CAAC;CAC3F;AAED,6EAA6E;AAC7E,qBAAa,aAAc,YAAW,WAAW;IACzC,MAAM,IAAI,OAAO,CAAC,IAAI,CAAC;CAG9B;AAcD,qBAAa,WAAW;IACtB,OAAO,CAAC,KAAK,CAA2B;IACxC,OAAO,CAAC,IAAI,CAAS;gBAET,IAAI,CAAC,EAAE,MAAM;IAKzB,6EAA6E;IAC7E,MAAM,CAAC,eAAe,IAAI,MAAM;IAIhC,2EAA2E;IAC3E,YAAY,IAAI,OAAO;IAIvB,6DAA6D;IAC7D,OAAO,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS;IAIvC,yEAAyE;IACzE,GAAG,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,WAAW,GAAG,OAAO;IAM/C,kEAAkE;IAClE,cAAc,CAAC,IAAI,EAAE,IAAI,GAAG,WAAW,EAAE;IAIzC;;;;OAIG;IACH,UAAU,CAAC,MAAM,EAAE,WAAW,EAAE,IAAI,GAAE,MAAsC,GAAG,IAAI;IAQnF,8CAA8C;IAC9C,UAAU,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,GAAG,GAAE,OAAO,GAAG,MAAgB,GAAG,QAAQ;IAa/E,sEAAsE;IACtE,UAAU,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO;IAOjC,0CAA0C;IAC1C,SAAS,IAAI,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAA;KAAE,GAAG,QAAQ,CAAC;IAM/C,+CAA+C;IAC/C,KAAK,IAAI,IAAI;IAOb,OAAO,CAAC,IAAI;IAmBZ,OAAO,CAAC,OAAO;CAShB"}

package/dist/enterprise/rbac.js

@@ -0,0 +1,165 @@
+/**
+ * RbacManager — P6 M6.1 role-based access control over the admin/governance
+ * surface.
+ *
+ * Minimal first milestone, deliberately:
+ * - A local role file (`~/.buff/rbac.json`, or BUFF_CONFIG_DIR override) maps
+ *   OS user → role. **Legacy single-user mode**: when the file has no users,
+ *   everything stays allowed — enabling RBAC can never lock you out.
+ * - A permission matrix (admin / operator / viewer) gates the `buff admin`
+ *   surface: policy *writes* and role management require `admin`; policy
+ *   *reads* are open to every role; `operator` may run routing/models.
+ * - An **OIDC adapter interface** is the seam for token-backed identity: a
+ *   future gateway can implement `OidcAdapter.verify(token)` and swap in
+ *   verified identities without touching the enforcement paths.
+ *
+ * The identity for local mode is the OS username (`process.env.USER`), with
+ * `BUFF_ACT_AS` as an override for CI/tests/multi-tenant tooling.
+ */
+import { existsSync, mkdirSync, readFileSync, writeFileSync } from 'node:fs';
+import { join } from 'node:path';
+import { homedir } from 'node:os';
+import { logger } from '../utils/logger.js';
+export const ROLES = ['admin', 'operator', 'viewer'];
+const PERMISSION_MATRIX = {
+    admin: new Set(['policy.read', 'policy.write', 'role.manage', 'credential.write', 'routing.operate']),
+    operator: new Set(['policy.read', 'routing.operate']),
+    viewer: new Set(['policy.read']),
+};
+const REQUIRED_ROLE_HINT = {
+    'policy.read': 'any role',
+    'policy.write': 'admin',
+    'role.manage': 'admin',
+    'credential.write': 'admin',
+    'routing.operate': 'admin or operator',
+};
+/** Thrown when the current identity lacks permission for an action. */
+export class RbacError extends Error {
+    constructor(message) {
+        super(message);
+        this.name = 'RbacError';
+    }
+}
+/** Default adapter: no token mode — identity is always the local OS user. */
+export class NoOidcAdapter {
+    async verify() {
+        return null;
+    }
+}
+// ─── Manager ────────────────────────────────────────────────────────────────
+function rbacPath() {
+    const dir = process.env.BUFF_CONFIG_DIR || join(homedir(), '.buff');
+    return join(dir, 'rbac.json');
+}
+export class RbacManager {
+    users;
+    path;
+    constructor(path) {
+        this.path = path || rbacPath();
+        this.users = this.load();
+    }
+    /** The acting identity — OS user, overridable via BUFF_ACT_AS (CI/tests). */
+    static currentIdentity() {
+        return process.env.BUFF_ACT_AS || process.env.USER || 'local';
+    }
+    /** Single-user legacy mode: no role file / no users → fully permissive. */
+    isLegacyMode() {
+        return Object.keys(this.users).length === 0;
+    }
+    /** Role assigned to a user, or undefined when unassigned. */
+    getRole(user) {
+        return this.users[user]?.role;
+    }
+    /** May `user` perform `action`? Unassigned users have no permissions. */
+    can(user, action) {
+        const role = this.getRole(user);
+        if (!role)
+            return false;
+        return PERMISSION_MATRIX[role].has(action);
+    }
+    /** Permissions granted to a role (for `whoami` / diagnostics). */
+    permissionsFor(role) {
+        return [...PERMISSION_MATRIX[role]];
+    }
+    /**
+     * Enforce `action` for the current identity. Throws RbacError when denied.
+     * Callers SHOULD check `isLegacyMode()` first (legacy = permissive), unless
+     * they intend to be strict even before RBAC is configured.
+     */
+    requireCan(action, user = RbacManager.currentIdentity()) {
+        if (this.can(user, action))
+            return;
+        const role = this.getRole(user) || 'unassigned';
+        throw new RbacError(`Access denied — role '${role}' cannot '${action}' (requires ${REQUIRED_ROLE_HINT[action]}). User: ${user}`);
+    }
+    /** Assign (or re-assign) a role. Persists. */
+    assignRole(user, role, via = 'local') {
+        if (!ROLES.includes(role)) {
+            throw new RbacError(`Invalid role "${role}". Valid: ${ROLES.join(', ')}`);
+        }
+        if (!user || !user.trim()) {
+            throw new RbacError('A non-empty username is required.');
+        }
+        const record = { role, addedAt: Date.now(), via };
+        this.users[user] = record;
+        this.persist();
+        return record;
+    }
+    /** Remove a user's role assignment. Returns true when one existed. */
+    removeUser(user) {
+        if (!(user in this.users))
+            return false;
+        delete this.users[user];
+        this.persist();
+        return true;
+    }
+    /** All assigned users, sorted by name. */
+    listUsers() {
+        return Object.entries(this.users)
+            .map(([user, u]) => ({ user, ...u }))
+            .sort((a, b) => a.user.localeCompare(b.user));
+    }
+    /** Reset to legacy mode (tests / recovery). */
+    reset() {
+        this.users = {};
+        try {
+            writeFileSync(this.path, JSON.stringify({ version: 1, users: {} }, null, 2), 'utf-8');
+        }
+        catch { /* best-effort */ }
+    }
+    // ─── Persistence ──────────────────────────────────────────────────────────
+    load() {
+        try {
+            if (!existsSync(this.path))
+                return {};
+            const raw = readFileSync(this.path, 'utf-8');
+            const data = JSON.parse(raw);
+            if (!data || typeof data !== 'object' || !data.users)
+                return {};
+            const users = {};
+            for (const [user, u] of Object.entries(data.users)) {
+                if (u && typeof u === 'object' && ROLES.includes(u.role))
+                    users[user] = u;
+            }
+            return users;
+        }
+        catch (err) {
+            // A misconfigured role file must not silently downgrade to permissive —
+            // surface it so an operator notices, then fall back safely (legacy mode).
+            logger.warn(`rbac.json unreadable (${err instanceof Error ? err.message : String(err)}) — falling back to legacy permissive mode`);
+            return {};
+        }
+    }
+    persist() {
+        try {
+            const dir = process.env.BUFF_CONFIG_DIR || join(homedir(), '.buff');
+            if (!existsSync(dir))
+                mkdirSync(dir, { recursive: true });
+            writeFileSync(this.path, JSON.stringify({ version: 1, users: this.users }, null, 2), 'utf-8');
+        }
+        catch {
+            // Best-effort — a failed RBAC write must never break the command.
+        }
+    }
+}
+//# sourceMappingURL=rbac.js.map

package/dist/enterprise/rbac.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"rbac.js","sourceRoot":"","sources":["../../src/enterprise/rbac.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AAEH,OAAO,EAAE,UAAU,EAAE,SAAS,EAAE,YAAY,EAAE,aAAa,EAAE,MAAM,SAAS,CAAC;AAC7E,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,OAAO,EAAE,MAAM,SAAS,CAAC;AAClC,OAAO,EAAE,MAAM,EAAE,MAAM,oBAAoB,CAAC;AAM5C,MAAM,CAAC,MAAM,KAAK,GAAoB,CAAC,OAAO,EAAE,UAAU,EAAE,QAAQ,CAAC,CAAC;AAmBtE,MAAM,iBAAiB,GAA2C;IAChE,KAAK,EAAE,IAAI,GAAG,CAAC,CAAC,aAAa,EAAE,cAAc,EAAE,aAAa,EAAE,kBAAkB,EAAE,iBAAiB,CAAC,CAAC;IACrG,QAAQ,EAAE,IAAI,GAAG,CAAC,CAAC,aAAa,EAAE,iBAAiB,CAAC,CAAC;IACrD,MAAM,EAAE,IAAI,GAAG,CAAC,CAAC,aAAa,CAAC,CAAC;CACjC,CAAC;AAEF,MAAM,kBAAkB,GAAgC;IACtD,aAAa,EAAE,UAAU;IACzB,cAAc,EAAE,OAAO;IACvB,aAAa,EAAE,OAAO;IACtB,kBAAkB,EAAE,OAAO;IAC3B,iBAAiB,EAAE,mBAAmB;CACvC,CAAC;AAEF,uEAAuE;AACvE,MAAM,OAAO,SAAU,SAAQ,KAAK;IAClC,YAAY,OAAe;QACzB,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,WAAW,CAAC;IAC1B,CAAC;CACF;AAYD,6EAA6E;AAC7E,MAAM,OAAO,aAAa;IACxB,KAAK,CAAC,MAAM;QACV,OAAO,IAAI,CAAC;IACd,CAAC;CACF;AAOD,+EAA+E;AAE/E,SAAS,QAAQ;IACf,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC,eAAe,IAAI,IAAI,CAAC,OAAO,EAAE,EAAE,OAAO,CAAC,CAAC;IACpE,OAAO,IAAI,CAAC,GAAG,EAAE,WAAW,CAAC,CAAC;AAChC,CAAC;AAED,MAAM,OAAO,WAAW;IACd,KAAK,CAA2B;IAChC,IAAI,CAAS;IAErB,YAAY,IAAa;QACvB,IAAI,CAAC,IAAI,GAAG,IAAI,IAAI,QAAQ,EAAE,CAAC;QAC/B,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;IAC3B,CAAC;IAED,6EAA6E;IAC7E,MAAM,CAAC,eAAe;QACpB,OAAO,OAAO,CAAC,GAAG,CAAC,WAAW,IAAI,OAAO,CAAC,GAAG,CAAC,IAAI,IAAI,OAAO,CAAC;IAChE,CAAC;IAED,2EAA2E;IAC3E,YAAY;QACV,OAAO,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,MAAM,KAAK,CAAC,CAAC;IAC9C,CAAC;IAED,6DAA6D;IAC7D,OAAO,CAAC,IAAY;QAClB,OAAO,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,IAAI,CAAC;IAChC,CAAC;IAED,yEAAyE;IACzE,GAAG,CAAC,IAAY,EAAE,MAAmB;QACnC,MAAM,IAAI,GAAG,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;QAChC,IAAI,CAAC,IAAI;YAAE,OAAO,KAAK,CAAC;QACxB,OAAO,iBAAiB,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;IAC7C,CAAC;IAED,kEAAkE;IAClE,cAAc,CAAC,IAAU;QACvB,OAAO,CAAC,GAAG,iBAAiB,CAAC,IAAI,CAAC,CAAC,CAAC;IACtC,CAAC;IAED;;;;OAIG;IACH,UAAU,CAAC,MAAmB,EAAE,OAAe,WAAW,CAAC,eAAe,EAAE;QAC1E,IAAI,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE,MAAM,CAAC;YAAE,OAAO;QACnC,MAAM,IAAI,GAAG,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,YAAY,CAAC;QAChD,MAAM,IAAI,SAAS,CACjB,yBAAyB,IAAI,aAAa,MAAM,eAAe,kBAAkB,CAAC,MAAM,CAAC,YAAY,IAAI,EAAE,CAC5G,CAAC;IACJ,CAAC;IAED,8CAA8C;IAC9C,UAAU,CAAC,IAAY,EAAE,IAAU,EAAE,MAAwB,OAAO;QAClE,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;YAC1B,MAAM,IAAI,SAAS,CAAC,iBAAiB,IAAI,aAAa,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QAC5E,CAAC;QACD,IAAI,CAAC,IAAI,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,EAAE,CAAC;YAC1B,MAAM,IAAI,SAAS,CAAC,mCAAmC,CAAC,CAAC;QAC3D,CAAC;QACD,MAAM,MAAM,GAAa,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,CAAC,GAAG,EAAE,EAAE,GAAG,EAAE,CAAC;QAC5D,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,MAAM,CAAC;QAC1B,IAAI,CAAC,OAAO,EAAE,CAAC;QACf,OAAO,MAAM,CAAC;IAChB,CAAC;IAED,sEAAsE;IACtE,UAAU,CAAC,IAAY;QACrB,IAAI,CAAC,CAAC,IAAI,IAAI,IAAI,CAAC,KAAK,CAAC;YAAE,OAAO,KAAK,CAAC;QACxC,OAAO,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QACxB,IAAI,CAAC,OAAO,EAAE,CAAC;QACf,OAAO,IAAI,CAAC;IACd,CAAC;IAED,0CAA0C;IAC1C,SAAS;QACP,OAAO,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC;aAC9B,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,GAAG,CAAC,EAAE,CAAC,CAAC;aACpC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC;IAClD,CAAC;IAED,+CAA+C;IAC/C,KAAK;QACH,IAAI,CAAC,KAAK,GAAG,EAAE,CAAC;QAChB,IAAI,CAAC;YAAC,aAAa,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,OAAO,EAAE,CAAC,EAAE,KAAK,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,EAAE,OAAO,CAAC,CAAC;QAAC,CAAC;QAAC,MAAM,CAAC,CAAC,iBAAiB,CAAC,CAAC;IAC5H,CAAC;IAED,6EAA6E;IAErE,IAAI;QACV,IAAI,CAAC;YACH,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC;gBAAE,OAAO,EAAE,CAAC;YACtC,MAAM,GAAG,GAAG,YAAY,CAAC,IAAI,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;YAC7C,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAe,CAAC;YAC3C,IAAI,CAAC,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,CAAC,IAAI,CAAC,KAAK;gBAAE,OAAO,EAAE,CAAC;YAChE,MAAM,KAAK,GAA6B,EAAE,CAAC;YAC3C,KAAK,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;gBACnD,IAAI,CAAC,IAAI,OAAO,CAAC,KAAK,QAAQ,IAAI,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC;oBAAE,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;YAC5E,CAAC;YACD,OAAO,KAAK,CAAC;QACf,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,wEAAwE;YACxE,0EAA0E;YAC1E,MAAM,CAAC,IAAI,CAAC,yBAAyB,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,4CAA4C,CAAC,CAAC;YACnI,OAAO,EAAE,CAAC;QACZ,CAAC;IACH,CAAC;IAEO,OAAO;QACb,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC,eAAe,IAAI,IAAI,CAAC,OAAO,EAAE,EAAE,OAAO,CAAC,CAAC;YACpE,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC;gBAAE,SAAS,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;YAC1D,aAAa,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,OAAO,EAAE,CAAC,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,EAAE,OAAO,CAAC,CAAC;QAChG,CAAC;QAAC,MAAM,CAAC;YACP,kEAAkE;QACpE,CAAC;IACH,CAAC;CACF"}

package/dist/learning/model-registry.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"model-registry.d.ts","sourceRoot":"","sources":["../../src/learning/model-registry.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAkCG;AASH,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAC;AAU1D,6CAA6C;AAC7C,MAAM,MAAM,mBAAmB,GAAG,OAAO,GAAG,YAAY,GAAG,WAAW,CAAC;AAEvE,yDAAyD;AACzD,MAAM,MAAM,uBAAuB,GAAG,UAAU,GAAG,YAAY,GAAG,aAAa,CAAC;AAEhF,yEAAyE;AACzE,MAAM,WAAW,kBAAkB;IACjC,QAAQ,EAAE,MAAM,CAAC;IACjB,KAAK,EAAE,MAAM,CAAC;IACd,MAAM,EAAE,uBAAuB,CAAC;IAChC,8EAA8E;IAC9E,cAAc,EAAE,MAAM,CAAC;IACvB,+DAA+D;IAC/D,YAAY,EAAE,MAAM,CAAC;IACrB,uCAAuC;IACvC,UAAU,EAAE,MAAM,CAAC;IACnB,8DAA8D;IAC9D,SAAS,CAAC,EAAE,MAAM,CAAC;IAEnB,0EAA0E;IAC1E,mBAAmB,CAAC,EAAE,MAAM,CAAC;IAC7B,2EAA2E;IAC3E,oBAAoB,CAAC,EAAE,MAAM,CAAC;IAC9B,6DAA6D;IAC7D,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,2DAA2D;IAC3D,SAAS,EAAE,MAAM,CAAC;IAClB;;;;;;;OAOG;IACH,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB;;;;;OAKG;IACH,cAAc,CAAC,EAAE,KAAK,CAAC;QAAE,CAAC,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IACpD,uEAAuE;IACvE,gBAAgB,EAAE,MAAM,CAAC;IACzB,0CAA0C;IAC1C,MAAM,EAAE,mBAAmB,CAAC;IAC5B,qEAAqE;IACrE,SAAS,CAAC,EAAE,MAAM,CAAC;IAEnB,2EAA2E;IAC3E,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,iDAAiD;IACjD,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,wEAAwE;IACxE,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,6EAA6E;IAC7E,eAAe,CAAC,EAAE,MAAM,CAAC;CAC1B;AAED,sEAAsE;AACtE,MAAM,WAAW,iBAAiB;IAChC,OAAO,EAAE,MAAM,CAAC;IAChB,SAAS,EAAE,MAAM,CAAC;IAClB,kCAAkC;IAClC,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,kBAAkB,CAAC,CAAC;CAC7C;AAED,wDAAwD;AACxD,MAAM,WAAW,mBAAmB;IAClC,OAAO,EAAE,MAAM,CAAC;IAChB,cAAc,EAAE,OAAO,CAAC;IACxB,KAAK,EAAE,MAAM,CAAC;IACd,QAAQ,EAAE,MAAM,CAAC;IACjB,UAAU,EAAE,MAAM,CAAC;IACnB,WAAW,EAAE,MAAM,CAAC;IACpB,MAAM,EAAE,MAAM,CAAC;IACf,SAAS,EAAE,MAAM,CAAC;IAClB,8BAA8B;IAC9B,SAAS,EAAE,KAAK,CAAC;QACf,QAAQ,EAAE,MAAM,CAAC;QACjB,KAAK,EAAE,MAAM,CAAC;QACd,QAAQ,EAAE,MAAM,CAAC;QACjB,WAAW,EAAE,MAAM,CAAC;QACpB,MAAM,EAAE,MAAM,CAAC;QACf,MAAM,EAAE,kBAAkB,EAAE,CAAC;KAC9B,CAAC,CAAC;CACJ;AAED;;;;;GAKG;AACH,MAAM,WAAW,oBAAoB;IACnC,6BAA6B;IAC7B,SAAS,EAAE,MAAM,CAAC;IAClB,8EAA8E;IAC9E,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,MAAM,CAAC;IACjB,KAAK,EAAE,MAAM,CAAC;IACd,gGAAgG;IAChG,OAAO,EAAE,UAAU,GAAG,aAAa,GAAG,OAAO,GAAG,SAAS,CAAC;IAC1D,uGAAuG;IACvG,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,qGAAqG;IACrG,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,6GAA6G;IAC7G,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,yEAAyE;IACzE,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB;;;;OAIG;IACH,cAAc,CAAC,EAAE,MAAM,CAAC;CACzB;AAED,gFAAgF;AAChF,MAAM,WAAW,uBAAuB;IACtC,OAAO,EAAE,OAAO,CAAC;IACjB,8DAA8D;IAC9D,KAAK,EAAE,MAAM,CAAC;IACd,SAAS,EAAE,MAAM,CAAC;IAClB,+EAA+E;IAC/E,OAAO,EAAE,KAAK,CAAC;QACb,MAAM,EAAE,MAAM,CAAC;QACf,2DAA2D;QAC3D,QAAQ,EAAE,MAAM,CAAC;QACjB,uFAAuF;QACvF,MAAM,EAAE,MAAM,CAAC;QACf,iEAAiE;QACjE,SAAS,EAAE,MAAM,CAAC;QAClB;;;;;;WAMG;QACH,OAAO,EAAE,MAAM,CAAC;QAChB,wEAAwE;QACxE,cAAc,EAAE,KAAK,CAAC;YAAE,QAAQ,EAAE,MAAM,CAAC;YAAC,KAAK,EAAE,MAAM,CAAC;YAAC,EAAE,EAAE,MAAM,CAAA;SAAE,CAAC,CAAC;QACvE,sEAAsE;QACtE,YAAY,EAAE,KAAK,CAAC;YAAE,QAAQ,EAAE,MAAM,CAAC;YAAC,KAAK,EAAE,MAAM,CAAC;YAAC,MAAM,CAAC,EAAE,MAAM,CAAC;YAAC,EAAE,EAAE,MAAM,CAAA;SAAE,CAAC,CAAC;QACtF;;;;;WAKG;QACH,aAAa,EAAE,KAAK,CAAC;YAAE,QAAQ,EAAE,MAAM,CAAC;YAAC,KAAK,EAAE,MAAM,CAAC;YAAC,MAAM,CAAC,EAAE,MAAM,CAAC;YAAC,EAAE,EAAE,MAAM,CAAC;YAAC,cAAc,CAAC,EAAE,MAAM,CAAA;SAAE,CAAC,CAAC;QAChH;;;;;;;WAOG;QACH,QAAQ,EAAE,KAAK,CAAC;YACd,8CAA8C;YAC9C,GAAG,EAAE,MAAM,CAAC;YACZ,QAAQ,EAAE,MAAM,CAAC;YACjB,MAAM,EAAE,MAAM,CAAC;YACf,SAAS,EAAE,MAAM,CAAC;YAClB,iEAAiE;YACjE,OAAO,EAAE,MAAM,CAAC;YAChB,0EAA0E;YAC1E,MAAM,EAAE,KAAK,CAAC;gBACZ,QAAQ,EAAE,MAAM,CAAC;gBACjB,KAAK,EAAE,MAAM,CAAC;gBACd,OAAO,EAAE,UAAU,GAAG,aAAa,GAAG,OAAO,GAAG,SAAS,CAAC;gBAC1D,SAAS,CAAC,EAAE,MAAM,CAAC;gBACnB,6BAA6B;gBAC7B,EAAE,EAAE,MAAM,CAAC;gBACX,qFAAqF;gBACrF,cAAc,CAAC,EAAE,MAAM,CAAC;aACzB,CAAC,CAAC;SACJ,CAAC,CAAC;KACJ,CAAC,CAAC;CACJ;AAMD,wFAAwF;AACxF,eAAO,MAAM,mBAAmB,iCAAiC,CAAC;AAClE,sEAAsE;AACtE,eAAO,MAAM,sBAAsB,OAAO,CAAC;AAC3C,2EAA2E;AAC3E,eAAO,MAAM,aAAa,KAAK,CAAC;AAGhC,iFAAiF;AACjF,eAAO,MAAM,mBAAmB,KAAK,CAAC;AAGtC,6EAA6E;AAC7E,eAAO,MAAM,gBAAgB,QAA0B,CAAC;AAsBxD;;;;;;GAMG;AACH;;;;GAIG;AACH,wBAAgB,uBAAuB,CAAC,IAAI,EAAE,MAAM,GAAG,oBAAoB,EAAE,CAiB5E;AAED;;;;GAIG;AACH,wBAAgB,mBAAmB,CACjC,OAAO,EAAE,oBAAoB,EAAE,EAC/B,IAAI,GAAE,MAAsB,EAC5B,GAAG,GAAE,MAAmB,GACvB,uBAAuB,CAAC,SAAS,CAAC,CAAC,MAAM,CAAC,CAAC,UAAU,CAAC,CAgDxD;AAED,wBAAgB,wBAAwB,CAAC,OAAO,EAAE,oBAAoB,EAAE,GAAG,uBAAuB,CAsCjG;AAID;;;;;;;GAOG;AACH,qBAAa,aAAa;IACxB,OAAO,CAAC,IAAI,CAAoB;IAChC,8EAA8E;IAC9E,OAAO,CAAC,WAAW,CAA4B;IAC/C,2DAA2D;IAC3D,OAAO,CAAC,cAAc,CAAS;IAC/B,sEAAsE;IACtE,OAAO,CAAC,cAAc,CAAM;;IAQ5B;;;;OAIG;IACH,QAAQ,CAAC,QAAQ,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,GAAE,MAAmB,GAAG,OAAO;IAS5E;;;OAGG;IACH,iBAAiB,CAAC,QAAQ,EAAE,MAAM,EAAE,GAAG,GAAE,MAAmB,GAAG,MAAM,EAAE;IAOvE,+EAA+E;IAC/E,kBAAkB,CAAC,GAAG,GAAE,MAAmB,GAAG,MAAM,EAAE;IAQtD;;;;;;;;;;OAUG;IACH,mBAAmB,CAAC,GAAG,GAAE,MAAmB,GAAG,MAAM,EAAE;IAkBvD,iDAAiD;IACjD,QAAQ,CAAC,QAAQ,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,kBAAkB,GAAG,SAAS;IAIzE;;;;;;OAMG;IACH,oBAAoB,CAAC,QAAQ,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,EAAE,GAAG,GAAE,MAAmB,GAAG,MAAM,GAAG,SAAS;IAWzG;;;;OAIG;IACH,OAAO,CAAC,kBAAkB;IAO1B;;;OAGG;IACH,UAAU,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,GAAG,IAAI;IA8BpD;;;;;;;;;;;;;;;;;;OAkBG;IACH,YAAY,CACV,QAAQ,EAAE,MAAM,EAChB,KAAK,EAAE,MAAM,EACb,MAAM,EAAE,mBAAmB,EAC3B,SAAS,CAAC,EAAE,MAAM,EAClB,MAAM,CAAC,EAAE,MAAM,EACf,OAAO,CAAC,EAAE,MAAM,EAChB,MAAM,CAAC,EAAE,MAAM,GACd,IAAI;IAmDP;;;;;OAKG;IACH,mBAAmB,CAAC,QAAQ,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,GAAG,IAAI;IA6BrG;;;;;OAKG;IACH,gBAAgB,CACd,QAAQ,EAAE,MAAM,GACf;QAAE,WAAW,EAAE,MAAM,CAAC;QAAC,YAAY,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAA;KAAE,GAAG,SAAS;IAkB7E;;;OAGG;IACH,eAAe,CACb,QAAQ,EAAE,MAAM,EAChB,KAAK,EAAE,MAAM,EACb,MAAM,EAAE,MAAM,EACd,MAAM,EAAE,mBAAmB,EAC3B,gBAAgB,GAAE,MAAU,EAC5B,MAAM,CAAC,EAAE,MAAM,GACd,IAAI;IAwCP,sFAAsF;IACtF,YAAY,CAAC,QAAQ,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,IAAI;IAenD,2EAA2E;IAC3E,eAAe,CAAC,QAAQ,EAAE,MAAM,GAAG,IAAI;IAcvC;;;;;;;;;;;;;;;;;OAiBG;IACH,eAAe,CAAC,QAAQ,EAAE,MAAM,GAAG;QAAE,OAAO,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAA;KAAE;IA2BxE;;;;;;;OAOG;IACH,UAAU,CACR,QAAQ,EAAE,MAAM,EAChB,KAAK,EAAE,MAAM,EACb,EAAE,EAAE,OAAO,EACX,SAAS,CAAC,EAAE,MAAM,EAClB,MAAM,CAAC,EAAE,MAAM,EACf,SAAS,CAAC,EAAE,MAAM,EAClB,OAAO,CAAC,EAAE,MAAM,EAChB,MAAM,CAAC,EAAE,MAAM,GACd,IAAI;IAqEP;;;;;;;;;;;;;;;;;;OAkBG;IACH,aAAa,CACX,QAAQ,EAAE,MAAM,EAChB,KAAK,EAAE,MAAM,EACb,MAAM,EAAE,MAAM,EACd,SAAS,CAAC,EAAE,MAAM,EAClB,cAAc,CAAC,EAAE,MAAM,GACtB,IAAI;IA6BP;;;;OAIG;IACH,oBAAoB,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM;IAU9C;;;;;OAKG;IACH,OAAO,CAAC,eAAe;IAyBvB,OAAO,CAAC,mBAAmB;IAS3B,oFAAoF;IACpF,kBAAkB,IAAI,uBAAuB;IAI7C;;;;;;;;;;;OAWG;IACH,SAAS,CAAC,aAAa,CAAC,EAAE,aAAa,GAAG,IAAI;IAwD9C;;;;;;;;;OASG;IACH,oBAAoB,CAAC,aAAa,CAAC,EAAE,aAAa,GAAG,KAAK,CAAC;QAAE,QAAQ,EAAE,MAAM,CAAC;QAAC,iBAAiB,EAAE,MAAM,CAAA;KAAE,CAAC;IA6B3G;;;;;;;;;;OAUG;IACH,OAAO,CAAC,WAAW;IAcnB;;;;OAIG;IACH,UAAU,CAAC,QAAQ,GAAE,MAAyB,GAAG,MAAM;IAgBvD,yDAAyD;IACzD,OAAO,CAAC,UAAU;IAYlB;;;;OAIG;IACH,OAAO,CAAC,OAAO;IAYf;;;;;;;;;;;OAWG;IACH,OAAO,CAAC,cAAc;IA8BtB,iFAAiF;IAC3E,iBAAiB,IAAI,OAAO,CAAC,OAAO,CAAC;IAoB3C,iGAAiG;IAC3F,iBAAiB,IAAI,OAAO,CAAC,MAAM,CAAC;IAS1C,8DAA8D;IACxD,SAAS,IAAI,OAAO,CAAC,mBAAmB,CAAC;IAmC/C,yFAAyF;IACnF,YAAY,IAAI,OAAO,CAAC,MAAM,CAAC;IA8BrC,qDAAqD;IACrD,OAAO,CAAC,QAAQ;IAShB,wCAAwC;IACxC,KAAK,IAAI,IAAI;CAId;AAMD,iDAAiD;AACjD,wBAAgB,gBAAgB,IAAI,aAAa,CAKhD;AAED,kEAAkE;AAClE,wBAAgB,kBAAkB,IAAI,IAAI,CAEzC"}
+{"version":3,"file":"model-registry.d.ts","sourceRoot":"","sources":["../../src/learning/model-registry.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAkCG;AASH,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAC;AAU1D,6CAA6C;AAC7C,MAAM,MAAM,mBAAmB,GAAG,OAAO,GAAG,YAAY,GAAG,WAAW,CAAC;AAEvE,yDAAyD;AACzD,MAAM,MAAM,uBAAuB,GAAG,UAAU,GAAG,YAAY,GAAG,aAAa,CAAC;AAEhF,yEAAyE;AACzE,MAAM,WAAW,kBAAkB;IACjC,QAAQ,EAAE,MAAM,CAAC;IACjB,KAAK,EAAE,MAAM,CAAC;IACd,MAAM,EAAE,uBAAuB,CAAC;IAChC,8EAA8E;IAC9E,cAAc,EAAE,MAAM,CAAC;IACvB,+DAA+D;IAC/D,YAAY,EAAE,MAAM,CAAC;IACrB,uCAAuC;IACvC,UAAU,EAAE,MAAM,CAAC;IACnB,8DAA8D;IAC9D,SAAS,CAAC,EAAE,MAAM,CAAC;IAEnB,0EAA0E;IAC1E,mBAAmB,CAAC,EAAE,MAAM,CAAC;IAC7B,2EAA2E;IAC3E,oBAAoB,CAAC,EAAE,MAAM,CAAC;IAC9B,6DAA6D;IAC7D,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,2DAA2D;IAC3D,SAAS,EAAE,MAAM,CAAC;IAClB;;;;;;;OAOG;IACH,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB;;;;;OAKG;IACH,cAAc,CAAC,EAAE,KAAK,CAAC;QAAE,CAAC,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IACpD,uEAAuE;IACvE,gBAAgB,EAAE,MAAM,CAAC;IACzB,0CAA0C;IAC1C,MAAM,EAAE,mBAAmB,CAAC;IAC5B,qEAAqE;IACrE,SAAS,CAAC,EAAE,MAAM,CAAC;IAEnB,2EAA2E;IAC3E,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,iDAAiD;IACjD,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,wEAAwE;IACxE,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,6EAA6E;IAC7E,eAAe,CAAC,EAAE,MAAM,CAAC;CAC1B;AAED,sEAAsE;AACtE,MAAM,WAAW,iBAAiB;IAChC,OAAO,EAAE,MAAM,CAAC;IAChB,SAAS,EAAE,MAAM,CAAC;IAClB,kCAAkC;IAClC,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,kBAAkB,CAAC,CAAC;CAC7C;AAED,wDAAwD;AACxD,MAAM,WAAW,mBAAmB;IAClC,OAAO,EAAE,MAAM,CAAC;IAChB,cAAc,EAAE,OAAO,CAAC;IACxB,KAAK,EAAE,MAAM,CAAC;IACd,QAAQ,EAAE,MAAM,CAAC;IACjB,UAAU,EAAE,MAAM,CAAC;IACnB,WAAW,EAAE,MAAM,CAAC;IACpB,MAAM,EAAE,MAAM,CAAC;IACf,SAAS,EAAE,MAAM,CAAC;IAClB,8BAA8B;IAC9B,SAAS,EAAE,KAAK,CAAC;QACf,QAAQ,EAAE,MAAM,CAAC;QACjB,KAAK,EAAE,MAAM,CAAC;QACd,QAAQ,EAAE,MAAM,CAAC;QACjB,WAAW,EAAE,MAAM,CAAC;QACpB,MAAM,EAAE,MAAM,CAAC;QACf,MAAM,EAAE,kBAAkB,EAAE,CAAC;KAC9B,CAAC,CAAC;CACJ;AAED;;;;;GAKG;AACH,MAAM,WAAW,oBAAoB;IACnC,6BAA6B;IAC7B,SAAS,EAAE,MAAM,CAAC;IAClB,8EAA8E;IAC9E,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,MAAM,CAAC;IACjB,KAAK,EAAE,MAAM,CAAC;IACd,gGAAgG;IAChG,OAAO,EAAE,UAAU,GAAG,aAAa,GAAG,OAAO,GAAG,SAAS,CAAC;IAC1D,uGAAuG;IACvG,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,qGAAqG;IACrG,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,6GAA6G;IAC7G,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,yEAAyE;IACzE,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB;;;;OAIG;IACH,cAAc,CAAC,EAAE,MAAM,CAAC;CACzB;AAED,gFAAgF;AAChF,MAAM,WAAW,uBAAuB;IACtC,OAAO,EAAE,OAAO,CAAC;IACjB,8DAA8D;IAC9D,KAAK,EAAE,MAAM,CAAC;IACd,SAAS,EAAE,MAAM,CAAC;IAClB,+EAA+E;IAC/E,OAAO,EAAE,KAAK,CAAC;QACb,MAAM,EAAE,MAAM,CAAC;QACf,2DAA2D;QAC3D,QAAQ,EAAE,MAAM,CAAC;QACjB,uFAAuF;QACvF,MAAM,EAAE,MAAM,CAAC;QACf,iEAAiE;QACjE,SAAS,EAAE,MAAM,CAAC;QAClB;;;;;;WAMG;QACH,OAAO,EAAE,MAAM,CAAC;QAChB,wEAAwE;QACxE,cAAc,EAAE,KAAK,CAAC;YAAE,QAAQ,EAAE,MAAM,CAAC;YAAC,KAAK,EAAE,MAAM,CAAC;YAAC,EAAE,EAAE,MAAM,CAAA;SAAE,CAAC,CAAC;QACvE,sEAAsE;QACtE,YAAY,EAAE,KAAK,CAAC;YAAE,QAAQ,EAAE,MAAM,CAAC;YAAC,KAAK,EAAE,MAAM,CAAC;YAAC,MAAM,CAAC,EAAE,MAAM,CAAC;YAAC,EAAE,EAAE,MAAM,CAAA;SAAE,CAAC,CAAC;QACtF;;;;;WAKG;QACH,aAAa,EAAE,KAAK,CAAC;YAAE,QAAQ,EAAE,MAAM,CAAC;YAAC,KAAK,EAAE,MAAM,CAAC;YAAC,MAAM,CAAC,EAAE,MAAM,CAAC;YAAC,EAAE,EAAE,MAAM,CAAC;YAAC,cAAc,CAAC,EAAE,MAAM,CAAA;SAAE,CAAC,CAAC;QAChH;;;;;;;WAOG;QACH,QAAQ,EAAE,KAAK,CAAC;YACd,8CAA8C;YAC9C,GAAG,EAAE,MAAM,CAAC;YACZ,QAAQ,EAAE,MAAM,CAAC;YACjB,MAAM,EAAE,MAAM,CAAC;YACf,SAAS,EAAE,MAAM,CAAC;YAClB,iEAAiE;YACjE,OAAO,EAAE,MAAM,CAAC;YAChB,0EAA0E;YAC1E,MAAM,EAAE,KAAK,CAAC;gBACZ,QAAQ,EAAE,MAAM,CAAC;gBACjB,KAAK,EAAE,MAAM,CAAC;gBACd,OAAO,EAAE,UAAU,GAAG,aAAa,GAAG,OAAO,GAAG,SAAS,CAAC;gBAC1D,SAAS,CAAC,EAAE,MAAM,CAAC;gBACnB,6BAA6B;gBAC7B,EAAE,EAAE,MAAM,CAAC;gBACX,qFAAqF;gBACrF,cAAc,CAAC,EAAE,MAAM,CAAC;aACzB,CAAC,CAAC;SACJ,CAAC,CAAC;KACJ,CAAC,CAAC;CACJ;AAMD,wFAAwF;AACxF,eAAO,MAAM,mBAAmB,iCAAiC,CAAC;AAClE,sEAAsE;AACtE,eAAO,MAAM,sBAAsB,OAAO,CAAC;AAC3C,2EAA2E;AAC3E,eAAO,MAAM,aAAa,KAAK,CAAC;AAGhC,iFAAiF;AACjF,eAAO,MAAM,mBAAmB,KAAK,CAAC;AAGtC,6EAA6E;AAC7E,eAAO,MAAM,gBAAgB,QAA0B,CAAC;AAsBxD;;;;;;GAMG;AACH;;;;GAIG;AACH,wBAAgB,uBAAuB,CAAC,IAAI,EAAE,MAAM,GAAG,oBAAoB,EAAE,CAiB5E;AAED;;;;GAIG;AACH,wBAAgB,mBAAmB,CACjC,OAAO,EAAE,oBAAoB,EAAE,EAC/B,IAAI,GAAE,MAAsB,EAC5B,GAAG,GAAE,MAAmB,GACvB,uBAAuB,CAAC,SAAS,CAAC,CAAC,MAAM,CAAC,CAAC,UAAU,CAAC,CAgDxD;AAED,wBAAgB,wBAAwB,CAAC,OAAO,EAAE,oBAAoB,EAAE,GAAG,uBAAuB,CAsCjG;AAID;;;;;;;GAOG;AACH,qBAAa,aAAa;IACxB,OAAO,CAAC,IAAI,CAAoB;IAChC,8EAA8E;IAC9E,OAAO,CAAC,WAAW,CAA4B;IAC/C,2DAA2D;IAC3D,OAAO,CAAC,cAAc,CAAS;IAC/B,sEAAsE;IACtE,OAAO,CAAC,cAAc,CAAM;;IAQ5B;;;;OAIG;IACH,QAAQ,CAAC,QAAQ,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,GAAE,MAAmB,GAAG,OAAO;IAS5E;;;OAGG;IACH,iBAAiB,CAAC,QAAQ,EAAE,MAAM,EAAE,GAAG,GAAE,MAAmB,GAAG,MAAM,EAAE;IAOvE,+EAA+E;IAC/E,kBAAkB,CAAC,GAAG,GAAE,MAAmB,GAAG,MAAM,EAAE;IAQtD;;;;;;;;;;OAUG;IACH,mBAAmB,CAAC,GAAG,GAAE,MAAmB,GAAG,MAAM,EAAE;IAkBvD,iDAAiD;IACjD,QAAQ,CAAC,QAAQ,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,kBAAkB,GAAG,SAAS;IAIzE;;;;;;OAMG;IACH,oBAAoB,CAAC,QAAQ,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,EAAE,GAAG,GAAE,MAAmB,GAAG,MAAM,GAAG,SAAS;IAWzG;;;;OAIG;IACH,OAAO,CAAC,kBAAkB;IAO1B;;;OAGG;IACH,UAAU,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,GAAG,IAAI;IA8BpD;;;;;;;;;;;;;;;;;;OAkBG;IACH,YAAY,CACV,QAAQ,EAAE,MAAM,EAChB,KAAK,EAAE,MAAM,EACb,MAAM,EAAE,mBAAmB,EAC3B,SAAS,CAAC,EAAE,MAAM,EAClB,MAAM,CAAC,EAAE,MAAM,EACf,OAAO,CAAC,EAAE,MAAM,EAChB,MAAM,CAAC,EAAE,MAAM,GACd,IAAI;IAmDP;;;;;OAKG;IACH,mBAAmB,CAAC,QAAQ,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,GAAG,IAAI;IA6BrG;;;;;OAKG;IACH,gBAAgB,CACd,QAAQ,EAAE,MAAM,GACf;QAAE,WAAW,EAAE,MAAM,CAAC;QAAC,YAAY,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAA;KAAE,GAAG,SAAS;IAkB7E;;;OAGG;IACH,eAAe,CACb,QAAQ,EAAE,MAAM,EAChB,KAAK,EAAE,MAAM,EACb,MAAM,EAAE,MAAM,EACd,MAAM,EAAE,mBAAmB,EAC3B,gBAAgB,GAAE,MAAU,EAC5B,MAAM,CAAC,EAAE,MAAM,GACd,IAAI;IAwCP,sFAAsF;IACtF,YAAY,CAAC,QAAQ,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,IAAI;IAenD,2EAA2E;IAC3E,eAAe,CAAC,QAAQ,EAAE,MAAM,GAAG,IAAI;IAcvC;;;;;;;;;;;;;;;;;OAiBG;IACH,eAAe,CAAC,QAAQ,EAAE,MAAM,GAAG;QAAE,OAAO,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAA;KAAE;IA2BxE;;;;;;;OAOG;IACH,UAAU,CACR,QAAQ,EAAE,MAAM,EAChB,KAAK,EAAE,MAAM,EACb,EAAE,EAAE,OAAO,EACX,SAAS,CAAC,EAAE,MAAM,EAClB,MAAM,CAAC,EAAE,MAAM,EACf,SAAS,CAAC,EAAE,MAAM,EAClB,OAAO,CAAC,EAAE,MAAM,EAChB,MAAM,CAAC,EAAE,MAAM,GACd,IAAI;IAqEP;;;;;;;;;;;;;;;;;;OAkBG;IACH,aAAa,CACX,QAAQ,EAAE,MAAM,EAChB,KAAK,EAAE,MAAM,EACb,MAAM,EAAE,MAAM,EACd,SAAS,CAAC,EAAE,MAAM,EAClB,cAAc,CAAC,EAAE,MAAM,GACtB,IAAI;IA6BP;;;;OAIG;IACH,oBAAoB,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM;IAU9C;;;;;OAKG;IACH,OAAO,CAAC,eAAe;IAyBvB,OAAO,CAAC,mBAAmB;IAS3B,oFAAoF;IACpF,kBAAkB,IAAI,uBAAuB;IAI7C;;;;;;;;;;;OAWG;IACH,SAAS,CAAC,aAAa,CAAC,EAAE,aAAa,GAAG,IAAI;IAwD9C;;;;;;;;;OASG;IACH,oBAAoB,CAAC,aAAa,CAAC,EAAE,aAAa,GAAG,KAAK,CAAC;QAAE,QAAQ,EAAE,MAAM,CAAC;QAAC,iBAAiB,EAAE,MAAM,CAAA;KAAE,CAAC;IA6B3G;;;;;;;;;;OAUG;IACH,OAAO,CAAC,WAAW;IAcnB;;;;OAIG;IACH,UAAU,CAAC,QAAQ,GAAE,MAAyB,GAAG,MAAM;IAgBvD,yDAAyD;IACzD,OAAO,CAAC,UAAU;IAYlB;;;;OAIG;IACH,OAAO,CAAC,OAAO;IAYf;;;;;;;;;;;OAWG;IACH,OAAO,CAAC,cAAc;IA8BtB,iFAAiF;IAC3E,iBAAiB,IAAI,OAAO,CAAC,OAAO,CAAC;IAoB3C,iGAAiG;IAC3F,iBAAiB,IAAI,OAAO,CAAC,MAAM,CAAC;IAS1C,8DAA8D;IACxD,SAAS,IAAI,OAAO,CAAC,mBAAmB,CAAC;IAmC/C,yFAAyF;IACnF,YAAY,IAAI,OAAO,CAAC,MAAM,CAAC;IA+CrC,qDAAqD;IACrD,OAAO,CAAC,QAAQ;IAShB,wCAAwC;IACxC,KAAK,IAAI,IAAI;CAId;AAMD,iDAAiD;AACjD,wBAAgB,gBAAgB,IAAI,aAAa,CAKhD;AAED,kEAAkE;AAClE,wBAAgB,kBAAkB,IAAI,IAAI,CAEzC"}

package/dist/learning/model-registry.js

@@ -1093,6 +1093,27 @@ export class ModelRegistry {
             lines.push(`   ${p.provider}: ${p.verified} verified · ${p.unavailable} unavailable${p.parked ? ` · ${p.parked} parked` : ''}`);
             for (const m of verified) {
                 const lat = m.latencyMs !== undefined ? ` · ${m.latencyMs}ms` : '';
+                // P4 M4.4 flakiness trend: when a trajectory exists, surface whether
+                // the model is HEALING (clean successes decay the EMA) or WORSENING
+                // (more mid-stream interruptions) — one glance at `models status`.
+                let flaky = '';
+                if (m.partialRate !== undefined && m.partialRate > 0) {
+                    const pct = Math.round(m.partialRate * 100);
+                    const h = m.partialHistory;
+                    if (h && h.length >= 2) {
+                        const first = h[0].rate;
+                        const last = h[h.length - 1].rate;
+                        if (last < first)
+                            flaky = ` · ⏸ flaky ${pct}% healing`;
+                        else if (last > first)
+                            flaky = ` · ⏸ flaky ${pct}% worsening`;
+                        else
+                            flaky = ` · ⏸ flaky ${pct}%`;
+                    }
+                    else {
+                        flaky = ` · ⏸ flaky ${pct}%`;
+                    }
+                }
                 // Unified-store quota telemetry: remaining tokens + time-to-wait (resets
                 // in) come from the same sub-ms FAISS/JSON snapshot routing reads.
                 const tokens = m.remainingTokens !== undefined && m.remainingTokens >= 0
@@ -1101,7 +1122,7 @@ export class ModelRegistry {
                 const resets = m.resetsInMs !== undefined && m.resetsInMs > 0
                     ? ` · resets in ${this.formatMs(m.resetsInMs)}`
                     : '';
-                lines.push(`     ✅ ${m.model}${lat}${tokens}${resets}`);
+                lines.push(`     ✅ ${m.model}${lat}${flaky}${tokens}${resets}`);
             }
             for (const m of unavailable.slice(0, 3)) {
                 const wait = m.quotaParkedUntil > now ? ` · retry in ${this.formatMs(m.quotaParkedUntil - now)}` : '';