borgmcp-shared 0.4.0 → 0.4.2

package/dist/templates.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"templates.d.ts","sourceRoot":"","sources":["../src/templates.ts"],"names":[],"mappings":"AA2BA,MAAM,WAAW,YAAY;IAC3B,IAAI,EAAE,MAAM,CAAC;IACb,iBAAiB,EAAE,MAAM,CAAC;IAC1B,oBAAoB,EAAE,MAAM,CAAC;IAC7B,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB,YAAY,CAAC,EAAE,OAAO,CAAC;IACvB,aAAa,CAAC,EAAE,OAAO,CAAC;IACxB,aAAa,CAAC,EAAE,OAAO,CAAC;IACxB,mBAAmB,CAAC,EAAE,OAAO,CAAC;CAI/B;AAED,MAAM,WAAW,oBAAoB;IACnC,KAAK,EAAE,MAAM,CAAC;IACd,QAAQ,CAAC,EAAE,MAAM,EAAE,CAAC;IACpB,OAAO,EAAE,WAAW,GAAG,UAAU,CAAC;IAClC,UAAU,CAAC,EAAE,MAAM,EAAE,CAAC;IACtB,SAAS,CAAC,EAAE,UAAU,GAAG,YAAY,CAAC;CACvC;AAED,MAAM,MAAM,eAAe,GAAG,oBAAoB,EAAE,CAAC;AA8ErD,eAAO,MAAM,qBAAqB,shDAQwM,CAAC;AAwB3O,eAAO,MAAM,gCAAgC,++VAsEkb,CAAC;AAEhe,eAAO,MAAM,oBAAoB,24GAyB+N,CAAC;AAuEjQ,eAAO,MAAM,kCAAkC,wzDASqV,CAAC;AAErY,eAAO,MAAM,sCAAsC,+mFAUgjB,CAAC;AAYpmB,eAAO,MAAM,4BAA4B,+kCAQ4P,CAAC;AAEtS,eAAO,MAAM,gCAAgC,k4CAQ0G,CAAC;AAExJ,eAAO,MAAM,2BAA2B,kwDASmS,CAAC;AAE5U,eAAO,MAAM,uBAAuB,siEAWsN,CAAC;AAE3P,eAAO,MAAM,4BAA4B,UAExC,CAAC;AAEF,eAAO,MAAM,8BAA8B,UAW1C,CAAC;AAEF,MAAM,WAAW,QAAQ;IACvB,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,EAAE,MAAM,CAAC;IACpB,KAAK,EAAE,YAAY,EAAE,CAAC;IAStB,cAAc,CAAC,EAAE,MAAM,CAAC;IAOxB,gBAAgB,CAAC,EAAE,eAAe,CAAC;CACpC;AAiCD,eAAO,MAAM,2BAA2B,2xBAEsuB,CAAC;AA6Z/wB,eAAO,MAAM,SAAS,EAAE,MAAM,CAAC,MAAM,EAAE,QAAQ,CAG9C,CAAC;AAEF,wBAAgB,WAAW,CAAC,IAAI,EAAE,MAAM,GAAG,QAAQ,GAAG,IAAI,CAEzD;AAED,wBAAgB,iBAAiB,IAAI,MAAM,EAAE,CAE5C;AAaD,wBAAgB,6BAA6B,CAC3C,gBAAgB,EAAE,MAAM,EACxB,QAAQ,EAAE,QAAQ,GAAG,IAAI,GACxB,MAAM,CAKR;AAaD,wBAAgB,4BAA4B,CAC1C,oBAAoB,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,EAC/C,QAAQ,EAAE,QAAQ,GACjB,MAAM,GAAG,IAAI,CAQf;AAED,wBAAgB,+BAA+B,CAC7C,gBAAgB,EAAE,eAAe,GAAG,IAAI,GAAG,SAAS,EACpD,QAAQ,EAAE,QAAQ,GAAG,IAAI,GACxB,eAAe,GAAG,IAAI,CAExB"}
+{"version":3,"file":"templates.d.ts","sourceRoot":"","sources":["../src/templates.ts"],"names":[],"mappings":"AA2BA,MAAM,WAAW,YAAY;IAC3B,IAAI,EAAE,MAAM,CAAC;IACb,iBAAiB,EAAE,MAAM,CAAC;IAC1B,oBAAoB,EAAE,MAAM,CAAC;IAC7B,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB,YAAY,CAAC,EAAE,OAAO,CAAC;IACvB,aAAa,CAAC,EAAE,OAAO,CAAC;IACxB,aAAa,CAAC,EAAE,OAAO,CAAC;IACxB,mBAAmB,CAAC,EAAE,OAAO,CAAC;CAI/B;AAED,MAAM,WAAW,oBAAoB;IACnC,KAAK,EAAE,MAAM,CAAC;IACd,QAAQ,CAAC,EAAE,MAAM,EAAE,CAAC;IACpB,OAAO,EAAE,WAAW,GAAG,UAAU,CAAC;IAClC,UAAU,CAAC,EAAE,MAAM,EAAE,CAAC;IACtB,SAAS,CAAC,EAAE,UAAU,GAAG,YAAY,CAAC;CACvC;AAED,MAAM,MAAM,eAAe,GAAG,oBAAoB,EAAE,CAAC;AA8ErD,eAAO,MAAM,qBAAqB,shDAQwM,CAAC;AAwB3O,eAAO,MAAM,gCAAgC,++VAsEkb,CAAC;AAEhe,eAAO,MAAM,oBAAoB,i4GAyB+N,CAAC;AAuEjQ,eAAO,MAAM,kCAAkC,wzDASqV,CAAC;AAErY,eAAO,MAAM,sCAAsC,+mFAUgjB,CAAC;AAYpmB,eAAO,MAAM,4BAA4B,+kCAQ4P,CAAC;AAEtS,eAAO,MAAM,gCAAgC,k4CAQ0G,CAAC;AAExJ,eAAO,MAAM,2BAA2B,kwDASmS,CAAC;AAE5U,eAAO,MAAM,uBAAuB,siEAWsN,CAAC;AAE3P,eAAO,MAAM,4BAA4B,UAExC,CAAC;AAEF,eAAO,MAAM,8BAA8B,UAW1C,CAAC;AAEF,MAAM,WAAW,QAAQ;IACvB,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,EAAE,MAAM,CAAC;IACpB,KAAK,EAAE,YAAY,EAAE,CAAC;IAStB,cAAc,CAAC,EAAE,MAAM,CAAC;IAOxB,gBAAgB,CAAC,EAAE,eAAe,CAAC;CACpC;AAiCD,eAAO,MAAM,2BAA2B,2xBAEsuB,CAAC;AA2Z/wB,eAAO,MAAM,SAAS,EAAE,MAAM,CAAC,MAAM,EAAE,QAAQ,CAG9C,CAAC;AAEF,wBAAgB,WAAW,CAAC,IAAI,EAAE,MAAM,GAAG,QAAQ,GAAG,IAAI,CAEzD;AAED,wBAAgB,iBAAiB,IAAI,MAAM,EAAE,CAE5C;AAaD,wBAAgB,6BAA6B,CAC3C,gBAAgB,EAAE,MAAM,EACxB,QAAQ,EAAE,QAAQ,GAAG,IAAI,GACxB,MAAM,CAKR;AAaD,wBAAgB,4BAA4B,CAC1C,oBAAoB,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,EAC/C,QAAQ,EAAE,QAAQ,GACjB,MAAM,GAAG,IAAI,CAQf;AAED,wBAAgB,+BAA+B,CAC7C,gBAAgB,EAAE,eAAe,GAAG,IAAI,GAAG,SAAS,EACpD,QAAQ,EAAE,QAAQ,GAAG,IAAI,GACxB,eAAe,GAAG,IAAI,CAExB"}

package/dist/templates.js

@@ -167,9 +167,9 @@ The cube's release-cycle discipline has three documented shapes; the seat-holder
 **Frontend/web-UI testing-track dispatch instruction:** for PRs touching user-facing web UI bundles, explicitly instruct Release Quality in the dispatch: "load the built page in a browser, capture console output, and include it in RQ-APPROVED [testing]." Diff-only review routinely misses client-side bundle errors.
 
 **SR-exclusion list (autonomous-mode shape NOT eligible — explicit SR gate required regardless):**
-- PRs introducing new auth-bypass call sites (RLS-equivalent gates, admin-mode helpers)
-- PRs changing auth-decision caching mechanisms (subscription/session cache backend swaps)
-- PRs modifying OAuth or other identity-token handling (refresh flows, consent parameters)
+- PRs introducing new auth-bypass call sites (scoped-store gates, admin-mode helpers)
+- PRs changing authorization-decision caching mechanisms (session cache storage swaps)
+- PRs modifying identity or session-token handling (verification, renewal, revocation)
 - PRs touching CORS allowlist matching, encryption key handling, or webhook signature verification
 
 These exclusions reflect the cube's documented threat model. Override requires explicit Queen authorization with the override condition documented in the merge trailer.
@@ -403,8 +403,7 @@ const SOFTWARE_DEV = {
                 'PD-APPROVED',
                 'PS-APPROVED',
             ],
-            routing: 'directed',
-            default_to: ['coordinator', 'queen'],
+            routing: 'broadcast',
             lifecycle: 'completion',
         },
         {
@@ -530,7 +529,7 @@ Workflow:
 - Verify correctness: does the code do what the commit message claims? Tests pass? Bundle size acceptable? Follows project conventions?
 - **Verify implementation quality + suggest refactors when appropriate.** Beyond "does it work," ask: is the code clean and readable? Specific things to call out — duplicated logic that could share a helper, dense or clever code that hides intent, unclear naming, missing abstractions for repeated non-trivial patterns, complex conditionals that would flatten, magic numbers, overly long functions, dead code, inconsistent in-file style. **Balance against "don't over-engineer"**: per the project's standing rule, three similar lines is better than a premature abstraction. Refactors should reduce real complexity, not add layers for hypothetical future cases. Refactor suggestions are typically NIT-class — post as \`REVIEW-FEEDBACK (nit: suggested refactor): <branch> <observation>\` and DO NOT block \`REVIEW-APPROVED\` on them; block only on patterns that compound technical debt or harm readability materially. Bigger refactors needing their own scope → file as a deferred-work issue rather than expanding the PR.
 - **Replaced-module behavioral diff.** If the PR deletes file X and introduces file Y (or replaces a module's role wholesale), explicitly enumerate "behaviors X had — present in Y?" before approval. Spec-only review misses invariants the deleted module had realized but the spec didn't surface. The canonical reason for the discipline: prior cutovers have lost load-bearing filters exactly this way (the new module faithfully implemented the spec; the deleted module had silently realized an invariant the spec didn't name). Checking the introduced module against the deleted one directly catches it pre-merge.
-- **Security review is Security Auditor's lane, not yours.** If the PR touches auth, auth-scoped data access (RLS wrappers / session-bound query helpers), encryption, secret handling, webhook signature verification, input validation, CORS, rate limits, OAuth flows, or customer-data paths, surface that to the cube (e.g., note in your \`REVIEW-FEEDBACK\` or \`REVIEW-APPROVED\` post) so Security Auditor picks it up for parallel review. Coordinator holds the merge until both \`REVIEW-APPROVED\` AND \`SECURITY-APPROVED\` for security-touching PRs. You may still flag obvious security regressions you happen to spot, but you are not the dedicated security-review gate.
+- **Security review is Security Auditor's lane, not yours.** If the PR touches auth, scoped data access (scoped-store wrappers / session-bound query helpers), encryption, secret handling, input validation, origin allowlists, rate limits, credential flows, or sensitive-data paths, surface that to the cube (e.g., note in your \`REVIEW-FEEDBACK\` or \`REVIEW-APPROVED\` post) so Security Auditor picks it up for parallel review. Coordinator holds the merge until both \`REVIEW-APPROVED\` AND \`SECURITY-APPROVED\` for security-touching PRs. You may still flag obvious security regressions you happen to spot, but you are not the dedicated security-review gate.
 - For each finding worth flagging, post \`REVIEW-FEEDBACK: <branch> <observation>\` — high-confidence issues only. Sort blockers from nits explicitly.
 - When done, post either \`REVIEW-APPROVED: <branch>\` (clean) or expect the Builder to address feedback and re-post \`REVIEW-READY:\`. Unaddressed refactor-NITs ride alongside \`REVIEW-APPROVED\` — they don't gate merge; the Coordinator merges on REVIEW-APPROVED regardless.
 
@@ -610,12 +609,12 @@ Boundaries:
             detailed_description: `You are the cube's security specialist — the dedicated owner of the security expectations the project documents but no other role enforces. Other drones check correctness, behavior, experience, and performance; you check exploitability. Autonomous — coordinate through the log.
 
 Your job:
-- Review security-touching code changes for vulnerability classes: OWASP top 10, command injection, XSS, SQL injection, auth bypass, data leaks, path traversal, SSRF, race conditions in auth/billing paths.
-- Audit security-critical surfaces: auth flows (JWT/OAuth verification, JWKS caching), auth-scoped data access (any function that gates user-data access by session identity — RLS wrappers, session-bound query helpers, equivalent boundary guards), encryption (algorithms, key handling, IV/nonce uniqueness, secret storage), webhook signature verification (HMAC), input validation at API boundaries (Zod schemas or equivalent), CORS / origin allowlists, rate limiters, dependency hygiene (CVE checks on dependency bumps), customer-data and billing paths.
+- Review security-touching code changes for vulnerability classes: OWASP top 10, command injection, XSS, SQL injection, auth bypass, data leaks, path traversal, SSRF, and races in authorization or session state.
+- Audit security-critical surfaces: bearer and session verification, scoped data access (any function that gates data by session identity — scoped-store wrappers, session-bound query helpers, equivalent boundary guards), encryption (algorithms, key handling, IV/nonce uniqueness, secret storage), input validation at API boundaries (Zod schemas or equivalent), origin allowlists, rate limiters, dependency hygiene (CVE checks on dependency bumps), and sensitive local data paths.
 - Run periodic full-codebase sweeps separate from per-pull-request review — walk the documented security expectations (project security instructions, threat-model docs, security checklists) and verify they still hold. Cadence: once per minor release or every ~2 weeks, whichever comes first. Catches the "we documented it but stopped enforcing it" failure mode.
 
 When you engage on a PR:
-- On regen, scan the log for \`REVIEW-READY:\` signals on branches touching security surface (auth, auth-scoped data access, encryption, webhooks, input validation, CORS, rate limits, OAuth, customer-data paths, dependency bumps).
+- On regen, scan the log for \`REVIEW-READY:\` signals on branches touching security surface (auth, scoped data access, encryption, input validation, origin allowlists, rate limits, credential flows, sensitive-data paths, dependency bumps).
 - For non-security-relevant changes (experience copy, version bumps, test infrastructure, internal refactors of non-security code), DON'T gate. Code Reviewer alone is the merge gate for those.
 - Post \`STARTING: security review of <branch>\` and pull the diff.
 
@@ -666,8 +665,7 @@ const STARTER = {
         {
             class: 'completion-gate',
             prefixes: ['APPROVED'],
-            routing: 'directed',
-            default_to: ['coordinator', 'queen'],
+            routing: 'broadcast',
             lifecycle: 'completion',
         },
         {

package/dist/templates.js.map

@@ -1 +1 @@
-{"version":3,"file":"templates.js","sourceRoot":"","sources":["../src/templates.ts"],"names":[],"mappings":"AAsEA,MAAM,8BAA8B,GAAG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;q6BA+B83B,CAAC;AAEt6B,MAAM,8BAA8B,GAAG;;;;;;;;;;;;;;;;;;;;;;8gBAsBue,CAAC;AAE/gB,MAAM,CAAC,MAAM,qBAAqB,GAAG;;;;;;;;0OAQqM,CAAC;AAE3O,MAAM,yBAAyB,GAAG;;;;;;;;;;;;;;;;;;;;mRAoBiP,CAAC;AAEpR,MAAM,CAAC,MAAM,gCAAgC,GAAG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;+dAsE+a,CAAC;AAEhe,MAAM,CAAC,MAAM,oBAAoB,GAAG;;;;;;;;;;;;;;;;;;;;;;;;;gQAyB4N,CAAC;AAEjQ,MAAM,gCAAgC,GAAG;;;;;;;;yWAQgU,CAAC;AAE1W,MAAM,wBAAwB,GAAG;;;;;;;;sLAQqJ,CAAC;AAEvL,MAAM,wBAAwB,GAAG;y5BACw3B,CAAC;AAE15B,MAAM,mCAAmC,GAAG;;;;;;;;;;EAU1C,wBAAwB,EAAE,CAAC;AAE7B,MAAM,0BAA0B,GAAG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAgCjC,wBAAwB,EAAE,CAAC;AAE7B,MAAM,CAAC,MAAM,kCAAkC,GAAG;;;;;;;;;oYASkV,CAAC;AAErY,MAAM,CAAC,MAAM,sCAAsC,GAAG;;;;;;;;;;mmBAU6iB,CAAC;AAEpmB,MAAM,sBAAsB,GAAG;;;;;;;;sTAQuR,CAAC;AAEvT,MAAM,CAAC,MAAM,4BAA4B,GAAG;;;;;;;;qSAQyP,CAAC;AAEtS,MAAM,CAAC,MAAM,gCAAgC,GAAG;;;;;;;;uJAQuG,CAAC;AAExJ,MAAM,CAAC,MAAM,2BAA2B,GAAG;;;;;;;;;2UASgS,CAAC;AAE5U,MAAM,CAAC,MAAM,uBAAuB,GAAG;;;;;;;;;;;0PAWmN,CAAC;AAE3P,MAAM,CAAC,MAAM,4BAA4B,GAAG;IAC1C,4BAA4B;CAC7B,CAAC;AAEF,MAAM,CAAC,MAAM,8BAA8B,GAAG;IAC5C,sCAAsC;IACtC,kCAAkC;IAClC,2BAA2B;IAC3B,uBAAuB;IAIvB,gCAAgC;IAChC,oBAAoB;IACpB,gCAAgC;CACjC,CAAC;AA6BF,MAAM,8CAA8C,GAAG;;;;;;;;;;;;;;;;;;;;;CAqBtD,CAAC;AAKF,MAAM,CAAC,MAAM,2BAA2B,GAAG;;8wBAEmuB,CAAC;AAE/wB,MAAM,YAAY,GAAa;IAC7B,IAAI,EAAE,cAAc;IACpB,WAAW,EACT,4RAA4R;IAC9R,cAAc,EAAE,8CAA8C;IAO9D,gBAAgB,EAAE;QAChB;YACE,KAAK,EAAE,cAAc;YACrB,QAAQ,EAAE,CAAC,UAAU,EAAE,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,SAAS,CAAC;YACzD,OAAO,EAAE,UAAU;YACnB,UAAU,EAAE,CAAC,aAAa,EAAE,OAAO,CAAC;SACrC;QACD;YACE,KAAK,EAAE,mBAAmB;YAC1B,QAAQ,EAAE,CAAC,MAAM,EAAE,SAAS,EAAE,YAAY,CAAC;YAC3C,OAAO,EAAE,UAAU;YACnB,UAAU,EAAE,CAAC,aAAa,EAAE,OAAO,CAAC;YACpC,SAAS,EAAE,YAAY;SACxB;QACD;YAGE,KAAK,EAAE,gBAAgB;YACvB,QAAQ,EAAE,CAAC,cAAc,CAAC;YAC1B,OAAO,EAAE,UAAU;YACnB,UAAU,EAAE;gBACV,aAAa;gBACb,OAAO;gBACP,eAAe;gBACf,kBAAkB;gBAClB,iBAAiB;gBACjB,gBAAgB;aACjB;SACF;QACD;YAEE,KAAK,EAAE,iBAAiB;YACxB,QAAQ,EAAE;gBACR,iBAAiB;gBACjB,aAAa;gBACb,mBAAmB;gBACnB,aAAa;gBACb,aAAa;aACd;YACD,OAAO,EAAE,UAAU;YACnB,UAAU,EAAE,CAAC,aAAa,EAAE,OAAO,CAAC;SACrC;QACD;YACE,KAAK,EAAE,iBAAiB;YACxB,QAAQ,EAAE;gBACR,iBAAiB;gBACjB,aAAa;gBACb,mBAAmB;gBACnB,aAAa;gBACb,aAAa;aACd;YACD,OAAO,EAAE,UAAU;YACnB,UAAU,EAAE,CAAC,aAAa,EAAE,OAAO,CAAC;YACpC,SAAS,EAAE,YAAY;SACxB;QACD;YACE,KAAK,EAAE,gBAAgB;YACvB,QAAQ,EAAE,CAAC,SAAS,CAAC;YACrB,OAAO,EAAE,UAAU;YACnB,UAAU,EAAE,CAAC,aAAa,EAAE,OAAO,CAAC;SACrC;QACD;YAGE,KAAK,EAAE,kBAAkB;YACzB,QAAQ,EAAE,CAAC,UAAU,EAAE,QAAQ,EAAE,SAAS,CAAC;YAC3C,OAAO,EAAE,UAAU;YACnB,UAAU,EAAE,CAAC,aAAa,EAAE,OAAO,CAAC;YACpC,SAAS,EAAE,UAAU;SACtB;QACD;YAEE,KAAK,EAAE,MAAM;YACb,QAAQ,EAAE,CAAC,MAAM,CAAC;YAClB,OAAO,EAAE,UAAU;YACnB,UAAU,EAAE,CAAC,aAAa,EAAE,OAAO,CAAC;SACrC;QACD;YACE,KAAK,EAAE,SAAS;YAChB,QAAQ,EAAE,CAAC,UAAU,EAAE,SAAS,EAAE,YAAY,EAAE,OAAO,EAAE,WAAW,EAAE,SAAS,CAAC;YAChF,OAAO,EAAE,UAAU;YACnB,UAAU,EAAE,CAAC,aAAa,EAAE,OAAO,CAAC;SACrC;QACD;YAEE,KAAK,EAAE,cAAc;YACrB,QAAQ,EAAE,CAAC,SAAS,EAAE,QAAQ,CAAC;YAC/B,OAAO,EAAE,UAAU;YACnB,UAAU,EAAE,CAAC,aAAa,EAAE,OAAO,CAAC;SACrC;QACD;YAEE,KAAK,EAAE,WAAW;YAClB,QAAQ,EAAE,CAAC,UAAU,EAAE,MAAM,CAAC;YAC9B,OAAO,EAAE,WAAW;SACrB;KACF;IACD,KAAK,EAAE;QACL;YACE,IAAI,EAAE,aAAa;YACnB,YAAY,EAAE,IAAI;YAClB,aAAa,EAAE,IAAI;YACnB,aAAa,EAAE,IAAI;YACnB,iBAAiB,EACf,oNAAoN;YACtN,oBAAoB,EAAE;;EAE1B,gCAAgC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;qxBAyCmvB,yBAAyB,GAAG,gCAAgC,GAAG,8BAA8B,GAAG,8BAA8B,GAAG,oBAAoB,GAAG,gCAAgC,GAAG,0BAA0B,GAAG,wBAAwB,GAAG,sCAAsC,GAAG,sBAAsB,GAAG,2BAA2B,GAAG,4BAA4B,GAAG,2BAA2B;;;+SAGn3B;SAC1S;QACD;YACE,IAAI,EAAE,SAAS;YACf,UAAU,EAAE,IAAI;YAChB,iBAAiB,EAAE,2FAA2F;YAC9G,oBAAoB,EAAE,wIAAwI,gCAAgC;;;;;;;;;;;;;kNAac,qBAAqB,GAAG,8BAA8B,GAAG,8BAA8B,GAAG,kCAAkC,GAAG,uBAAuB,GAAG,4BAA4B,EAAE;SACpY;QACD;YACE,IAAI,EAAE,eAAe;YACrB,aAAa,EAAE,IAAI;YACnB,iBAAiB,EAAE,iJAAiJ;YACpK,oBAAoB,EAAE,qGAAqG,gCAAgC;;;;;;;;;;;;kGAY/D,mCAAmC,GAAG,qBAAqB,GAAG,8BAA8B,GAAG,8BAA8B,GAAG,4BAA4B,EAAE;SAC3P;QACD;YACE,IAAI,EAAE,iBAAiB;YACvB,aAAa,EAAE,IAAI;YACnB,iBAAiB,EAAE,sIAAsI;YACzJ,oBAAoB,EAAE;;;;;;;;;;;;;;;;;2FAiB+D,qBAAqB,GAAG,8BAA8B,GAAG,8BAA8B,GAAG,4BAA4B,EAAE;SAC9M;QACD;YACE,IAAI,EAAE,gBAAgB;YACtB,aAAa,EAAE,IAAI;YACnB,iBAAiB,EAAE,mJAAmJ;YACtK,oBAAoB,EAAE;;;;;;;;;;;;;;;;uFAgB2D,qBAAqB,GAAG,8BAA8B,GAAG,8BAA8B,GAAG,4BAA4B,EAAE;SAC1M;QACD;YACE,IAAI,EAAE,kBAAkB;YACxB,aAAa,EAAE,IAAI;YACnB,mBAAmB,EAAE,IAAI;YACzB,iBAAiB,EAAE,uGAAuG;YAC1H,oBAAoB,EAAE;;;;;;;;;;;;;;qHAcyF,qBAAqB,GAAG,8BAA8B,GAAG,8BAA8B,GAAG,4BAA4B,EAAE;SACxO;QACD;YACE,IAAI,EAAE,kBAAkB;YACxB,aAAa,EAAE,IAAI;YACnB,mBAAmB,EAAE,IAAI;YACzB,iBAAiB,EAAE,2LAA2L;YAC9M,oBAAoB,EAAE;;;;;;;;;;;;;;;;;;;;;;;wSAuB4Q,qBAAqB,GAAG,8BAA8B,GAAG,8BAA8B,GAAG,4BAA4B,EAAE;SAC3Z;KACF;CACF,CAAC;AAEF,MAAM,OAAO,GAAa;IACxB,IAAI,EAAE,SAAS;IACf,WAAW,EACT,wKAAwK;IAI1K,gBAAgB,EAAE;QAChB;YACE,KAAK,EAAE,cAAc;YACrB,QAAQ,EAAE,CAAC,UAAU,EAAE,KAAK,EAAE,MAAM,EAAE,OAAO,CAAC;YAC9C,OAAO,EAAE,UAAU;YACnB,UAAU,EAAE,CAAC,aAAa,EAAE,OAAO,CAAC;SACrC;QACD;YACE,KAAK,EAAE,mBAAmB;YAC1B,QAAQ,EAAE,CAAC,MAAM,CAAC;YAClB,OAAO,EAAE,UAAU;YACnB,UAAU,EAAE,CAAC,aAAa,EAAE,OAAO,CAAC;YACpC,SAAS,EAAE,YAAY;SACxB;QACD;YACE,KAAK,EAAE,gBAAgB;YACvB,QAAQ,EAAE,CAAC,cAAc,CAAC;YAC1B,OAAO,EAAE,UAAU;YACnB,UAAU,EAAE,CAAC,aAAa,EAAE,OAAO,EAAE,UAAU,CAAC;SACjD;QACD;YACE,KAAK,EAAE,iBAAiB;YACxB,QAAQ,EAAE,CAAC,UAAU,CAAC;YACtB,OAAO,EAAE,UAAU;YACnB,UAAU,EAAE,CAAC,aAAa,EAAE,OAAO,CAAC;SACrC;QACD;YACE,KAAK,EAAE,iBAAiB;YACxB,QAAQ,EAAE,CAAC,UAAU,CAAC;YACtB,OAAO,EAAE,UAAU;YACnB,UAAU,EAAE,CAAC,aAAa,EAAE,OAAO,CAAC;YACpC,SAAS,EAAE,YAAY;SACxB;QACD;YACE,KAAK,EAAE,gBAAgB;YACvB,QAAQ,EAAE,CAAC,SAAS,CAAC;YACrB,OAAO,EAAE,UAAU;YACnB,UAAU,EAAE,CAAC,aAAa,EAAE,OAAO,CAAC;SACrC;QACD;YACE,KAAK,EAAE,kBAAkB;YACzB,QAAQ,EAAE,CAAC,UAAU,EAAE,QAAQ,CAAC;YAChC,OAAO,EAAE,UAAU;YACnB,UAAU,EAAE,CAAC,aAAa,EAAE,OAAO,CAAC;YACpC,SAAS,EAAE,UAAU;SACtB;QACD;YACE,KAAK,EAAE,MAAM;YACb,QAAQ,EAAE,CAAC,MAAM,CAAC;YAClB,OAAO,EAAE,UAAU;YACnB,UAAU,EAAE,CAAC,aAAa,EAAE,OAAO,CAAC;SACrC;QACD;YACE,KAAK,EAAE,WAAW;YAClB,QAAQ,EAAE,CAAC,UAAU,CAAC;YACtB,OAAO,EAAE,WAAW;SACrB;KACF;IACD,KAAK,EAAE;QACL;YACE,IAAI,EAAE,aAAa;YACnB,aAAa,EAAE,IAAI;YACnB,aAAa,EAAE,IAAI;YACnB,iBAAiB,EAAE,sCAAsC;YACzD,oBAAoB,EAAE;;;;;;;;qGAQyE,8BAA8B,GAAG,8BAA8B,GAAG,4BAA4B,EAAE;SAChM;QACD;YACE,IAAI,EAAE,QAAQ;YACd,UAAU,EAAE,IAAI;YAChB,iBAAiB,EAAE,+CAA+C;YAClE,oBAAoB,EAAE;;;;;;;;0CAQc,8BAA8B,GAAG,8BAA8B,GAAG,4BAA4B,EAAE;SACrI;QACD;YACE,IAAI,EAAE,UAAU;YAChB,aAAa,EAAE,IAAI;YACnB,iBAAiB,EAAE,yCAAyC;YAC5D,oBAAoB,EAAE;;;;;;;wEAO4C,8BAA8B,GAAG,8BAA8B,GAAG,4BAA4B,EAAE;SACnK;KACF;CACF,CAAC;AAEF,MAAM,CAAC,MAAM,SAAS,GAA6B;IACjD,SAAS,EAAE,OAAO;IAClB,cAAc,EAAE,YAAY;CAC7B,CAAC;AAEF,MAAM,UAAU,WAAW,CAAC,IAAY;IACtC,OAAO,SAAS,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC;AACjC,CAAC;AAED,MAAM,UAAU,iBAAiB;IAC/B,OAAO,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;AAChC,CAAC;AAaD,MAAM,UAAU,6BAA6B,CAC3C,gBAAwB,EACxB,QAAyB;IAEzB,IAAI,gBAAgB,IAAI,gBAAgB,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC;QACvD,OAAO,gBAAgB,CAAC;IAC1B,CAAC;IACD,OAAO,QAAQ,EAAE,cAAc,IAAI,gBAAgB,CAAC;AACtD,CAAC;AAaD,MAAM,UAAU,4BAA4B,CAC1C,oBAA+C,EAC/C,QAAkB;IAElB,IAAI,oBAAoB,IAAI,oBAAoB,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC;QAC/D,OAAO,IAAI,CAAC;IACd,CAAC;IACD,IAAI,CAAC,QAAQ,CAAC,cAAc,EAAE,CAAC;QAC7B,OAAO,IAAI,CAAC;IACd,CAAC;IACD,OAAO,QAAQ,CAAC,cAAc,CAAC;AACjC,CAAC;AAED,MAAM,UAAU,+BAA+B,CAC7C,gBAAoD,EACpD,QAAyB;IAEzB,OAAO,gBAAgB,KAAK,SAAS,CAAC,CAAC,CAAC,QAAQ,EAAE,gBAAgB,IAAI,IAAI,CAAC,CAAC,CAAC,gBAAgB,CAAC;AAChG,CAAC"}
+{"version":3,"file":"templates.js","sourceRoot":"","sources":["../src/templates.ts"],"names":[],"mappings":"AAsEA,MAAM,8BAA8B,GAAG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;q6BA+B83B,CAAC;AAEt6B,MAAM,8BAA8B,GAAG;;;;;;;;;;;;;;;;;;;;;;8gBAsBue,CAAC;AAE/gB,MAAM,CAAC,MAAM,qBAAqB,GAAG;;;;;;;;0OAQqM,CAAC;AAE3O,MAAM,yBAAyB,GAAG;;;;;;;;;;;;;;;;;;;;mRAoBiP,CAAC;AAEpR,MAAM,CAAC,MAAM,gCAAgC,GAAG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;+dAsE+a,CAAC;AAEhe,MAAM,CAAC,MAAM,oBAAoB,GAAG;;;;;;;;;;;;;;;;;;;;;;;;;gQAyB4N,CAAC;AAEjQ,MAAM,gCAAgC,GAAG;;;;;;;;yWAQgU,CAAC;AAE1W,MAAM,wBAAwB,GAAG;;;;;;;;sLAQqJ,CAAC;AAEvL,MAAM,wBAAwB,GAAG;y5BACw3B,CAAC;AAE15B,MAAM,mCAAmC,GAAG;;;;;;;;;;EAU1C,wBAAwB,EAAE,CAAC;AAE7B,MAAM,0BAA0B,GAAG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAgCjC,wBAAwB,EAAE,CAAC;AAE7B,MAAM,CAAC,MAAM,kCAAkC,GAAG;;;;;;;;;oYASkV,CAAC;AAErY,MAAM,CAAC,MAAM,sCAAsC,GAAG;;;;;;;;;;mmBAU6iB,CAAC;AAEpmB,MAAM,sBAAsB,GAAG;;;;;;;;sTAQuR,CAAC;AAEvT,MAAM,CAAC,MAAM,4BAA4B,GAAG;;;;;;;;qSAQyP,CAAC;AAEtS,MAAM,CAAC,MAAM,gCAAgC,GAAG;;;;;;;;uJAQuG,CAAC;AAExJ,MAAM,CAAC,MAAM,2BAA2B,GAAG;;;;;;;;;2UASgS,CAAC;AAE5U,MAAM,CAAC,MAAM,uBAAuB,GAAG;;;;;;;;;;;0PAWmN,CAAC;AAE3P,MAAM,CAAC,MAAM,4BAA4B,GAAG;IAC1C,4BAA4B;CAC7B,CAAC;AAEF,MAAM,CAAC,MAAM,8BAA8B,GAAG;IAC5C,sCAAsC;IACtC,kCAAkC;IAClC,2BAA2B;IAC3B,uBAAuB;IAIvB,gCAAgC;IAChC,oBAAoB;IACpB,gCAAgC;CACjC,CAAC;AA6BF,MAAM,8CAA8C,GAAG;;;;;;;;;;;;;;;;;;;;;CAqBtD,CAAC;AAKF,MAAM,CAAC,MAAM,2BAA2B,GAAG;;8wBAEmuB,CAAC;AAE/wB,MAAM,YAAY,GAAa;IAC7B,IAAI,EAAE,cAAc;IACpB,WAAW,EACT,4RAA4R;IAC9R,cAAc,EAAE,8CAA8C;IAO9D,gBAAgB,EAAE;QAChB;YACE,KAAK,EAAE,cAAc;YACrB,QAAQ,EAAE,CAAC,UAAU,EAAE,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,SAAS,CAAC;YACzD,OAAO,EAAE,UAAU;YACnB,UAAU,EAAE,CAAC,aAAa,EAAE,OAAO,CAAC;SACrC;QACD;YACE,KAAK,EAAE,mBAAmB;YAC1B,QAAQ,EAAE,CAAC,MAAM,EAAE,SAAS,EAAE,YAAY,CAAC;YAC3C,OAAO,EAAE,UAAU;YACnB,UAAU,EAAE,CAAC,aAAa,EAAE,OAAO,CAAC;YACpC,SAAS,EAAE,YAAY;SACxB;QACD;YAGE,KAAK,EAAE,gBAAgB;YACvB,QAAQ,EAAE,CAAC,cAAc,CAAC;YAC1B,OAAO,EAAE,UAAU;YACnB,UAAU,EAAE;gBACV,aAAa;gBACb,OAAO;gBACP,eAAe;gBACf,kBAAkB;gBAClB,iBAAiB;gBACjB,gBAAgB;aACjB;SACF;QACD;YAEE,KAAK,EAAE,iBAAiB;YACxB,QAAQ,EAAE;gBACR,iBAAiB;gBACjB,aAAa;gBACb,mBAAmB;gBACnB,aAAa;gBACb,aAAa;aACd;YACD,OAAO,EAAE,UAAU;YACnB,UAAU,EAAE,CAAC,aAAa,EAAE,OAAO,CAAC;SACrC;QACD;YACE,KAAK,EAAE,iBAAiB;YACxB,QAAQ,EAAE;gBACR,iBAAiB;gBACjB,aAAa;gBACb,mBAAmB;gBACnB,aAAa;gBACb,aAAa;aACd;YACD,OAAO,EAAE,WAAW;YACpB,SAAS,EAAE,YAAY;SACxB;QACD;YACE,KAAK,EAAE,gBAAgB;YACvB,QAAQ,EAAE,CAAC,SAAS,CAAC;YACrB,OAAO,EAAE,UAAU;YACnB,UAAU,EAAE,CAAC,aAAa,EAAE,OAAO,CAAC;SACrC;QACD;YAGE,KAAK,EAAE,kBAAkB;YACzB,QAAQ,EAAE,CAAC,UAAU,EAAE,QAAQ,EAAE,SAAS,CAAC;YAC3C,OAAO,EAAE,UAAU;YACnB,UAAU,EAAE,CAAC,aAAa,EAAE,OAAO,CAAC;YACpC,SAAS,EAAE,UAAU;SACtB;QACD;YAEE,KAAK,EAAE,MAAM;YACb,QAAQ,EAAE,CAAC,MAAM,CAAC;YAClB,OAAO,EAAE,UAAU;YACnB,UAAU,EAAE,CAAC,aAAa,EAAE,OAAO,CAAC;SACrC;QACD;YACE,KAAK,EAAE,SAAS;YAChB,QAAQ,EAAE,CAAC,UAAU,EAAE,SAAS,EAAE,YAAY,EAAE,OAAO,EAAE,WAAW,EAAE,SAAS,CAAC;YAChF,OAAO,EAAE,UAAU;YACnB,UAAU,EAAE,CAAC,aAAa,EAAE,OAAO,CAAC;SACrC;QACD;YAEE,KAAK,EAAE,cAAc;YACrB,QAAQ,EAAE,CAAC,SAAS,EAAE,QAAQ,CAAC;YAC/B,OAAO,EAAE,UAAU;YACnB,UAAU,EAAE,CAAC,aAAa,EAAE,OAAO,CAAC;SACrC;QACD;YAEE,KAAK,EAAE,WAAW;YAClB,QAAQ,EAAE,CAAC,UAAU,EAAE,MAAM,CAAC;YAC9B,OAAO,EAAE,WAAW;SACrB;KACF;IACD,KAAK,EAAE;QACL;YACE,IAAI,EAAE,aAAa;YACnB,YAAY,EAAE,IAAI;YAClB,aAAa,EAAE,IAAI;YACnB,aAAa,EAAE,IAAI;YACnB,iBAAiB,EACf,oNAAoN;YACtN,oBAAoB,EAAE;;EAE1B,gCAAgC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;qxBAyCmvB,yBAAyB,GAAG,gCAAgC,GAAG,8BAA8B,GAAG,8BAA8B,GAAG,oBAAoB,GAAG,gCAAgC,GAAG,0BAA0B,GAAG,wBAAwB,GAAG,sCAAsC,GAAG,sBAAsB,GAAG,2BAA2B,GAAG,4BAA4B,GAAG,2BAA2B;;;+SAGn3B;SAC1S;QACD;YACE,IAAI,EAAE,SAAS;YACf,UAAU,EAAE,IAAI;YAChB,iBAAiB,EAAE,2FAA2F;YAC9G,oBAAoB,EAAE,wIAAwI,gCAAgC;;;;;;;;;;;;;kNAac,qBAAqB,GAAG,8BAA8B,GAAG,8BAA8B,GAAG,kCAAkC,GAAG,uBAAuB,GAAG,4BAA4B,EAAE;SACpY;QACD;YACE,IAAI,EAAE,eAAe;YACrB,aAAa,EAAE,IAAI;YACnB,iBAAiB,EAAE,iJAAiJ;YACpK,oBAAoB,EAAE,qGAAqG,gCAAgC;;;;;;;;;;;;kGAY/D,mCAAmC,GAAG,qBAAqB,GAAG,8BAA8B,GAAG,8BAA8B,GAAG,4BAA4B,EAAE;SAC3P;QACD;YACE,IAAI,EAAE,iBAAiB;YACvB,aAAa,EAAE,IAAI;YACnB,iBAAiB,EAAE,sIAAsI;YACzJ,oBAAoB,EAAE;;;;;;;;;;;;;;;;;2FAiB+D,qBAAqB,GAAG,8BAA8B,GAAG,8BAA8B,GAAG,4BAA4B,EAAE;SAC9M;QACD;YACE,IAAI,EAAE,gBAAgB;YACtB,aAAa,EAAE,IAAI;YACnB,iBAAiB,EAAE,mJAAmJ;YACtK,oBAAoB,EAAE;;;;;;;;;;;;;;;;uFAgB2D,qBAAqB,GAAG,8BAA8B,GAAG,8BAA8B,GAAG,4BAA4B,EAAE;SAC1M;QACD;YACE,IAAI,EAAE,kBAAkB;YACxB,aAAa,EAAE,IAAI;YACnB,mBAAmB,EAAE,IAAI;YACzB,iBAAiB,EAAE,uGAAuG;YAC1H,oBAAoB,EAAE;;;;;;;;;;;;;;qHAcyF,qBAAqB,GAAG,8BAA8B,GAAG,8BAA8B,GAAG,4BAA4B,EAAE;SACxO;QACD;YACE,IAAI,EAAE,kBAAkB;YACxB,aAAa,EAAE,IAAI;YACnB,mBAAmB,EAAE,IAAI;YACzB,iBAAiB,EAAE,2LAA2L;YAC9M,oBAAoB,EAAE;;;;;;;;;;;;;;;;;;;;;;;wSAuB4Q,qBAAqB,GAAG,8BAA8B,GAAG,8BAA8B,GAAG,4BAA4B,EAAE;SAC3Z;KACF;CACF,CAAC;AAEF,MAAM,OAAO,GAAa;IACxB,IAAI,EAAE,SAAS;IACf,WAAW,EACT,wKAAwK;IAI1K,gBAAgB,EAAE;QAChB;YACE,KAAK,EAAE,cAAc;YACrB,QAAQ,EAAE,CAAC,UAAU,EAAE,KAAK,EAAE,MAAM,EAAE,OAAO,CAAC;YAC9C,OAAO,EAAE,UAAU;YACnB,UAAU,EAAE,CAAC,aAAa,EAAE,OAAO,CAAC;SACrC;QACD;YACE,KAAK,EAAE,mBAAmB;YAC1B,QAAQ,EAAE,CAAC,MAAM,CAAC;YAClB,OAAO,EAAE,UAAU;YACnB,UAAU,EAAE,CAAC,aAAa,EAAE,OAAO,CAAC;YACpC,SAAS,EAAE,YAAY;SACxB;QACD;YACE,KAAK,EAAE,gBAAgB;YACvB,QAAQ,EAAE,CAAC,cAAc,CAAC;YAC1B,OAAO,EAAE,UAAU;YACnB,UAAU,EAAE,CAAC,aAAa,EAAE,OAAO,EAAE,UAAU,CAAC;SACjD;QACD;YACE,KAAK,EAAE,iBAAiB;YACxB,QAAQ,EAAE,CAAC,UAAU,CAAC;YACtB,OAAO,EAAE,UAAU;YACnB,UAAU,EAAE,CAAC,aAAa,EAAE,OAAO,CAAC;SACrC;QACD;YACE,KAAK,EAAE,iBAAiB;YACxB,QAAQ,EAAE,CAAC,UAAU,CAAC;YACtB,OAAO,EAAE,WAAW;YACpB,SAAS,EAAE,YAAY;SACxB;QACD;YACE,KAAK,EAAE,gBAAgB;YACvB,QAAQ,EAAE,CAAC,SAAS,CAAC;YACrB,OAAO,EAAE,UAAU;YACnB,UAAU,EAAE,CAAC,aAAa,EAAE,OAAO,CAAC;SACrC;QACD;YACE,KAAK,EAAE,kBAAkB;YACzB,QAAQ,EAAE,CAAC,UAAU,EAAE,QAAQ,CAAC;YAChC,OAAO,EAAE,UAAU;YACnB,UAAU,EAAE,CAAC,aAAa,EAAE,OAAO,CAAC;YACpC,SAAS,EAAE,UAAU;SACtB;QACD;YACE,KAAK,EAAE,MAAM;YACb,QAAQ,EAAE,CAAC,MAAM,CAAC;YAClB,OAAO,EAAE,UAAU;YACnB,UAAU,EAAE,CAAC,aAAa,EAAE,OAAO,CAAC;SACrC;QACD;YACE,KAAK,EAAE,WAAW;YAClB,QAAQ,EAAE,CAAC,UAAU,CAAC;YACtB,OAAO,EAAE,WAAW;SACrB;KACF;IACD,KAAK,EAAE;QACL;YACE,IAAI,EAAE,aAAa;YACnB,aAAa,EAAE,IAAI;YACnB,aAAa,EAAE,IAAI;YACnB,iBAAiB,EAAE,sCAAsC;YACzD,oBAAoB,EAAE;;;;;;;;qGAQyE,8BAA8B,GAAG,8BAA8B,GAAG,4BAA4B,EAAE;SAChM;QACD;YACE,IAAI,EAAE,QAAQ;YACd,UAAU,EAAE,IAAI;YAChB,iBAAiB,EAAE,+CAA+C;YAClE,oBAAoB,EAAE;;;;;;;;0CAQc,8BAA8B,GAAG,8BAA8B,GAAG,4BAA4B,EAAE;SACrI;QACD;YACE,IAAI,EAAE,UAAU;YAChB,aAAa,EAAE,IAAI;YACnB,iBAAiB,EAAE,yCAAyC;YAC5D,oBAAoB,EAAE;;;;;;;wEAO4C,8BAA8B,GAAG,8BAA8B,GAAG,4BAA4B,EAAE;SACnK;KACF;CACF,CAAC;AAEF,MAAM,CAAC,MAAM,SAAS,GAA6B;IACjD,SAAS,EAAE,OAAO;IAClB,cAAc,EAAE,YAAY;CAC7B,CAAC;AAEF,MAAM,UAAU,WAAW,CAAC,IAAY;IACtC,OAAO,SAAS,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC;AACjC,CAAC;AAED,MAAM,UAAU,iBAAiB;IAC/B,OAAO,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;AAChC,CAAC;AAaD,MAAM,UAAU,6BAA6B,CAC3C,gBAAwB,EACxB,QAAyB;IAEzB,IAAI,gBAAgB,IAAI,gBAAgB,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC;QACvD,OAAO,gBAAgB,CAAC;IAC1B,CAAC;IACD,OAAO,QAAQ,EAAE,cAAc,IAAI,gBAAgB,CAAC;AACtD,CAAC;AAaD,MAAM,UAAU,4BAA4B,CAC1C,oBAA+C,EAC/C,QAAkB;IAElB,IAAI,oBAAoB,IAAI,oBAAoB,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC;QAC/D,OAAO,IAAI,CAAC;IACd,CAAC;IACD,IAAI,CAAC,QAAQ,CAAC,cAAc,EAAE,CAAC;QAC7B,OAAO,IAAI,CAAC;IACd,CAAC;IACD,OAAO,QAAQ,CAAC,cAAc,CAAC;AACjC,CAAC;AAED,MAAM,UAAU,+BAA+B,CAC7C,gBAAoD,EACpD,QAAyB;IAEzB,OAAO,gBAAgB,KAAK,SAAS,CAAC,CAAC,CAAC,QAAQ,EAAE,gBAAgB,IAAI,IAAI,CAAC,CAAC,CAAC,gBAAgB,CAAC;AAChG,CAAC"}

package/docs/enrollment.md

@@ -2,16 +2,18 @@
 
 This document defines the data-only enrollment and cube-creation boundaries
 shared by clients and servers. It does not define offline operator commands,
-database transactions, or keychain APIs, but implementations must preserve the
-security properties below.
-
-This contract replaces the server-generated bearer response used by the
-published `borgmcp-shared@0.3.0` v1 baseline. It is a breaking clean-slate v2
-wire change; this source now identifies the still-unpublished `0.4.0` candidate
-and requires a coordinated client/server release. The version bump grants no tag
-or publication authority — creating the `v0.4.0` tag and the registry
-publication remain separate, independently gated steps. There is no
-compatibility path that returns a bearer from the server.
+database transactions, or a client storage API, but implementations must
+preserve the security properties below.
+
+This contract replaced the server-generated bearer response used by the
+published `borgmcp-shared@0.3.0` v1 baseline and shipped in the immutable
+`0.4.0` clean-slate v2 release. The immutable `v0.4.1` verification artifact
+failed its cross-platform SBOM audit and must never be published or rerun.
+This source now identifies the still-unpublished `0.4.2` recovery release without
+changing the wire contract. The version bump grants no tag or publication
+authority: creating the `v0.4.2` tag and publishing the reviewed artifact remain
+separate, independently gated steps. There is no compatibility path that returns
+a bearer from the server.
 
 A client verifies the credential-free `GET /api/protocol` tag preflight before
 it creates or sends any enrollment secret; a peer that presents a different
@@ -30,11 +32,12 @@ Before network I/O, the client generates:
   unpadded base64url; and
 - a canonical UUID retry key.
 
-The client persists both values as a pending enrollment in the operating-system
-keychain before sending the request. It retains and reuses the exact pending
-tuple after an ambiguous timeout or connection loss. The wire contract never
-permits a file fallback, URL/argv/environment transport, or diagnostic output
-for these secrets.
+Before sending the request, the client persists both values in its single local
+seat-record file with mode `0600`, using an atomic replacement under the store's
+cross-process lock. The pending record is operation-scoped and cannot be loaded
+as an active seat. The client retains and reuses the exact pending tuple after an
+ambiguous timeout or connection loss. The wire contract never permits
+URL/argv/environment transport or diagnostic output for these secrets.
 
 ## Exchange Request
 

package/docs/releasing.md

@@ -6,8 +6,9 @@ published from that exact tarball. Local publication and publication from an
 unreviewed branch are not supported.
 
 The active release policy is governed by the ratified
-`shared-package-consumption` and `npm-publish-sole-operator-approval` decisions.
-This document describes the operator procedure; it does not authorize a release.
+`shared-package-consumption`, `borgmcp-shared-coordinator-autonomy`, and
+`npm-publish-sole-operator-approval` decisions. This document describes the
+operator procedure; it does not authorize a release.
 
 ## Permanent Repository Configuration
 
@@ -67,8 +68,9 @@ Configure these controls before creating a release tag:
    `SECURITY.md` directs reporters to the private reporting path, so disabled
    reporting is always a release-blocking documentation failure.
 
-The environment approval is the final technical control. Approval must remain
-pending while Security reviews the artifact produced by the `verify` job.
+The environment approval is the final technical control. It appears only on the
+`publish` job, after `validate` has verified the SR approval tuple. Approval must
+remain pending while Security reviews the artifact produced by the `verify` job.
 GitHub's ephemeral workflow token cannot read every repository-administration
 setting checked by `scripts/verify-release-configuration.mjs`. An authorized
 operator must run the guard with an administration-capable token before creating
@@ -88,7 +90,7 @@ before dependency installation, and includes the same values in the uploaded
 `RUN_EVIDENCE` file. Never use the Actions rerun controls to advance a failed
 immutable tag or proof run.
 
-Both jobs reject a repository-root `.npmrc` before their first npm command. The
+All three jobs reject a repository-root `.npmrc` before their first npm command. The
 exact npm bootstrap uses isolated runner-temp prefix, user config, and cache
 paths, forces `https://registry.npmjs.org`, disables scripts, and verifies both
 the installed npm version and registry before adding its bin directory to
@@ -191,15 +193,23 @@ first:
 - exercises npm's publish metadata in dry-run mode; and
 - installs the exact tarball with scripts disabled in a clean consumer, verifies
   its production tree, and imports every reviewed public export; and
-- uploads the tarball, verifier report, and SHA-512 checksum for seven days.
+- uploads the tarball, verifier report, SHA-512 checksum, SBOM, and
+  `RUN_EVIDENCE` for seven days.
 
 Security must download and audit that exact workflow artifact. After Security
 approves the tarball, Release Quality confirms the operator procedure, and the
-Queen explicitly authorizes the public flip, an authorized reviewer may approve
-the waiting `npm-publish` environment deployment. The publish job downloads and
-checksum-verifies the same artifact, repeats the artifact verifier, checks that
-`0.2.2` is absent and the name is unclaimed as expected, and publishes only the
-downloaded tarball with `--access public --provenance`.
+Queen explicitly authorizes the public flip, the Coordinator writes the SR
+approval tuple (`ARTIFACT_SR_SHA512`, `ARTIFACT_SR_RUN_ID`,
+`ARTIFACT_SR_RUN_ATTEMPT`) to environment variables and dispatches the
+`publish.yml` workflow with the tag. The `validate` job runs first (outside
+the `npm-publish` environment): it re-verifies the source, queries the source
+run's workflow path, tag, conclusion, and attempt via the GitHub API, downloads
+the artifact, binds the SR tuple to the exact tarball, and confirms run identity.
+Only after `validate` succeeds does the `publish` job run, which surfaces the
+`npm-publish` environment approval dialog. The `publish` job re-downloads and
+checksum-verifies the same artifact, re-binds the SR tuple, repeats the artifact
+verifier, checks that `0.2.2` is absent and the name is unclaimed as expected,
+and publishes only the downloaded tarball with `--access public --provenance`.
 
 Immediately after a successful first publish:
 
@@ -217,47 +227,59 @@ Immediately after a successful first publish:
 
 ## Later Releases
 
-### 0.4.0 Clean-Slate v2 Contract
+### 0.4.2 Cross-Platform SBOM Recovery
 
-The ratified `borgmcp-shared-enrollment-version` decision defined this breaking
-retry-safe enrollment and idempotent multi-cube contract. `borgmcp-shared@0.3.0`
-is now the published, immutable v1 baseline on the registry, so the clean-slate
-v2 contract — credential-free tag preflight included — is versioned as the
-still-unpublished `0.4.0` candidate (a breaking change on a `0.x` package bumps
-the minor). This source now identifies `0.4.0`. That reviewed version bump
-does not authorize creating `v0.4.0` or publishing the package, and the source
-branch must not republish `0.3.0`.
+`borgmcp-shared@0.4.0` is the published, immutable clean-slate v2 contract, but
+its registry artifact was built before the public package's local/self-hosted
+topology cleanup. The immutable `v0.4.1` run `29701429995` built the cleaned
+artifact, but independent macOS verification proved that the SBOM verifier used
+the auditor's installed optional-dependency tree instead of a deterministic
+release graph. The `v0.4.1` tag, run, and artifact are failed evidence: never
+publish, move, reuse, rerun, or substitute them.
 
-Before a separately authorized `v0.4.0` tag is created:
+Version `0.4.2` carries the reviewed cleanup with a lockfile-derived SBOM graph
+for the fixed release target `{os: linux, cpu: x64, libc: glibc}`. It does not
+change the protocol tag or runtime behavior. This source now identifies `0.4.2`.
+The reviewed recovery bump does not authorize creating `v0.4.2` or publishing
+the package.
 
-1. The exact `0.4.0` source commit must be merged to protected `main` after Code
+Before a separately authorized `v0.4.2` tag is created:
+
+1. The exact `0.4.2` source commit must be merged to protected `main` after Code
    Review, Security, and Release Quality approve the package identity, public
-   API, conformance behavior, generated output, and release documentation.
-2. The package and root lockfile, `SHARED_PACKAGE_VERSION`, the exact protocol
-   version tag, packed-artifact verifier, and version assertions all identify
-   `0.4.0` (done in this source bump).
+   API, generated output, and release documentation.
+2. The package and root lockfile, `SHARED_PACKAGE_VERSION`, packed-artifact and
+   SBOM verifiers, generated declarations, and version assertions must all
+   identify `0.4.2`. The protocol tag remains unchanged.
 3. The protected workflow must build one exact tarball and pass its full source,
    test, audit, public-export, source-map, install/import, dry-run, lock-derived
    CycloneDX SBOM, integrity, and provenance gates. Security must approve that
    exact workflow artifact.
-4. The `0.4.0` workflow must generate a CycloneDX SBOM, canonicalize npm's
+4. The `0.4.2` workflow must generate a CycloneDX SBOM, canonicalize npm's
    checkout-derived root display name to the already-verified manifest name,
    and validate every component's exact canonical registry tarball URL, single
    matching CycloneDX distribution reference, purl, and lock SHA-512 plus the
-   exact installed dependency graph and zero package runtime dependencies. The
-   tarball, SBOM, and SBOM validation report must be
-   checksummed and uploaded together for Security audit.
+   exact lockfile-derived release-target graph and zero package runtime
+   dependencies. The graph starts from root development dependencies, follows
+   required dependencies and peers, includes only target-compatible optional
+   dependencies, and includes optional peers only when another reachable edge
+   installs them. Root manifest and lock selectors must match and permit the
+   fixed target. Verification must not inspect the auditor's operating system,
+   installed dependency tree, or `node_modules`. The tarball, SBOM, and SBOM
+   validation report must be checksummed and uploaded together for Security
+   audit.
 5. The tag and publication each require their own explicit authorization. A
    source-version approval, merge, or successful verification run grants neither.
 
 After registry publication and independent integrity/provenance verification,
-the first borgmcp client and borgmcp-server releases may replace their temporary
-development dependency with the reviewed registry range `^0.4.0`. They must not
-ship a Git dependency or fall back to the incompatible published `0.3.0` v1
-enrollment response.
+the first borgmcp client and borgmcp-server releases must pin exact
+`borgmcp-shared@0.4.2` and commit their registry lockfiles. They must not ship a
+Git dependency, a version range that can resolve to the pre-cleanup artifact, or
+a fallback to the incompatible `0.3.0` v1 enrollment response.
 
 Later releases follow the same source gates, annotated protected tag, exact
-tarball audit, Queen authorization, and environment approval. The registry
+tarball audit, Coordinator authorization under the ratified shared release
+autonomy, and environment approval. The registry
 preflight requires the package to be owned by `NPM_EXPECTED_OWNER` and rejects
 an existing target version. It also fails if
 `ALLOW_UNCLAIMED_FIRST_PUBLISH` is not `false` or any `NPM_TOKEN` remains;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "borgmcp-shared",
-  "version": "0.4.0",
+  "version": "0.4.2",
   "description": "Shared protocol, domain, templates, and conformance contracts for Borg MCP implementations.",
   "type": "module",
   "main": "./dist/index.js",
@@ -68,7 +68,7 @@
   ],
   "author": "Byte Ventures IO AB",
   "license": "Apache-2.0",
-  "homepage": "https://borgmcp.ai",
+  "homepage": "https://github.com/Byte-Ventures/borg-mcp-shared",
   "repository": {
     "type": "git",
     "url": "git+https://github.com/Byte-Ventures/borg-mcp-shared.git"