clinkx 0.3.0 → 1.1.0

package/CHANGELOG.md

@@ -0,0 +1,119 @@
+# Changelog
+
+## Unreleased
+
+## 1.1.0 — 2026-10-03
+
+### Upgrade notes
+
+- Adapter files stay whole-file first-wins. An overlay in `~/.config/clinkx/adapters/` keeps its 1.0.0 argv and parser and does not get the shipped changes below, including `invocation_overrides` (required for per-call `model`/`effort`) and the agy stream-json parser. Re-copy from the packaged `conf/adapters/` or `conf/adapters/hapi/` to adopt them. (#26, #44)
+- Shipped `agy` now sends the prompt on stdin without `--print` and passes `--output-format stream-json`, which needs an agy build that emits stream-json (1.1.8+). (#26, #44)
+- Shipped `glm` and the `hapi/glm` template pin `--model glm-5.3[1m]`, Opus/Sonnet defaults `glm-5.3[1m]`, Haiku `glm-4.7`, and `CLAUDE_CODE_AUTO_COMPACT_WINDOW=1000000`. 1.0.0 used `glm-5`.
+- A finalizer `model`, `effort`, or explicit `min_score` on an effectively disabled finalizer (`finalizer.enabled` omitted under a profile that defaults it off) is now rejected `-32602` by `run_workflow` and `context_builder` before any state or spawn. 1.0.0 accepted and ignored it. Set `finalizer.enabled:true` or drop the knob. (#52)
+- The six `council-*` workflows default to `context_external_gap_policy: degrade`. When the finalizer reports evidence it could not obtain, the run proceeds with `context_quality:"degraded"`, health reason `context_external_gaps`, and a `## Known missing evidence` bundle block instead of failing. An explicit `cb_delegate` with `external_gap_policy:"fail"` keeps the failure. `plan-review-receipts` is unchanged. (#55)
+- `review_deep` delegate `timeout_seconds` defaults to 300 (was 180). (#55)
+- Context-builder default excludes add `.worktrees/**` and vendor trees (`Pods`, `.cxx`, `.gradle`, `DerivedData`). `exclude_globs:[]` / `cb_exclude_globs:[]` cannot remove them. (#45, #55)
+- The workflow context cache (`wfctx-*`) goes cold once: the delegate prompt and discovery algorithm versions changed. (#55)
+- Drain, finish, or abandon unfinished resumable workflow runs before upgrading. Child-config fingerprints now cover override declarations and the enabled curator/finalizer adapters, and shipped adapter JSON changed, so resume across the upgrade can be rejected. Runs that do resume replay their persisted snapshot and keep external-gap policy `fail`. (#26, #55)
+- `progress_report_start`, `progress_report_update`, `progress_report_get`, and `progress_report_list` are always advertised. (#51)
+- New flags, off by default. Only exact `true` enables `CLINKX_INVOCATION_AUDIT_V2_PERSISTENCE_ENABLED`, `CLINKX_OBSERVED_INVOCATION_PERSISTENCE_ENABLED`, and `CLINKX_SESSION_LOG_TOOL_ARGUMENTS_PERSISTENCE_ENABLED`; `CLINKX_SERVER_IDLE_TIMEOUT_SECONDS` defaults to `0`. Readers always accept the new formats, so enable writers only once every dashboard reading the same state runs 1.1.0. With the audit flag off, the dashboard shows model/effort as not recorded. (#24, #28, #40, #57)
+- New runtime dependency: `@letta-ai/trajectory`, pinned to `0.4.3`. (#57)
+
+### Added
+
+- Per-call `model` and `effort` on `clink`, generic workflow calls, council `members[]`, `chairman_model` / `chairman_effort`, and the `context_builder` / `cb_delegate` curator and finalizer, when the resolved adapter declares `invocation_overrides`. Every shipped subprocess adapter declares both; Codex effort renders as `-c model_reasoning_effort=<value>`. Unsupported values fail `-32602` before spawn. `plan-review-receipts`, the Codex app-server tools, and Elaris are unchanged. (#26)
+- Invocation evidence: a pre-dispatch audit (requested value, applied value, provenance) for workflow calls, direct `clink` activity, and context curator/finalizer calls, plus the model/effort a child reports (Claude `system/init`, app-server `thread/start`). The dashboard shows both in the call inspector and on run-detail stage rows. Persistence is behind the flags above. (#28, #40, #53)
+- `run_workflow.roster`: named council presets carrying members, chairman, and the context delegate. Discovery is first-wins across `CLINKX_ROSTERS_PATH`, `${XDG_CONFIG_HOME:-~/.config}/clinkx/rosters/`, and built-in `conf/rosters/` (ships `default-council`). A roster cannot be combined with `members`, `chairman`, `chairman_model`, `chairman_effort`, or a non-empty `cb_delegate`. (#52)
+- `list_workflows` adds `available_clis` (per-adapter model/effort support) and `available_rosters`. Council runs report `resolved_roster` on the async ack, the sync result, and `workflow_run_status`. (#52)
+- `workflow_run_status` adds `context.delegate.finalizer` `{effective_enabled, execution_status, score?}` and, while preflight is still scanning, a top-level `context_progress` block. (#52)
+- Progress-report tools `progress_report_start` / `_update` / `_get` / `_list`: patch-only writes, `expected_revision` compare-and-swap, `request_id` replay, server-owned ids and timestamps. Reports live under `<state dir>/progress-reports/` and show on the dashboard. (#51)
+- Delegate `external_gap_policy: "fail" | "degrade"` (default `fail`) on `context_builder` and `cb_delegate`. Finalizer-reported `external_gaps` are classified; rejected gaps fail under either policy, accepted ones carry provenance. (#55)
+- `CLINKX_SERVER_IDLE_TIMEOUT_SECONDS`: opt-in idle lifetime for both STDIO servers. Active tools, workflows, Codex turns, and response delivery hold it off. (#24)
+- Dashboard: prompt builder at `/prompt-builder` for `run_workflow` and chief-of-staff prompts, validated against live adapter capabilities. Its library persists in a private `prompt-builder-library.json` sidecar. Copy is its only action.
+- Dashboard: `CLINKX_WORKFLOWS_DASHBOARD_AUTH_MODE=none` for loopback-only testing. Host and origin checks stay enforced; remote and gateway modes reject it. (#47)
+- Dashboard: session-log conversations tail in place. Tool rows can show bounded, redacted tool arguments when `CLINKX_SESSION_LOG_TOOL_ARGUMENTS_PERSISTENCE_ENABLED=true`, and Find searches them. (#57)
+- Dashboard: `CLINKX_WORKFLOWS_PROGRESS_REPORT_OVERRIDE_DIR` moves the status-pin sidecar off a read-only state directory.
+- Automatic npm publishing after main CI passes. A PR that bumps the root
+  version (stable, ahead of the base and npm `latest`, with `CHANGELOG.md` in the
+  same diff) releases on merge; PRs and main pushes that leave the version
+  unchanged never publish or read the registry and ship with the next bump. A
+  failed or incomplete publication is recovered only by a manual run on main,
+  which rebuilds from current main and publishes that source under the version
+  if it is still unpublished. One tarball is verified across the Node matrix
+  and published with OIDC, a single `npm publish` write, bounded registry
+  reconciliation, and no rebuild in the publisher. The publisher parses the tarball itself instead of using system
+  `tar`, accepts only the ustar regular-file layout `npm pack` emits under
+  `package/` with exactly one `package/package.json` (name and prefix fields
+  NUL-padded to their ends, an empty linkname, a terminated checksum, no
+  base-256 numbers, no entry path that is also another entry's directory), and
+  rejects a manifest that declares `publishConfig` or a top-level `tag`; the
+  expected version comes from the dependency-free policy job, not the build. See
+  `docs/npm-releases.md` for the external GitHub and npm prerequisites, release
+  policy and recovery. (#58)
+
+### Changed
+
+- Shipped agy adapter uses `agy_stream_json` / `--output-format stream-json` so extract and dashboard session logs work; grok unchanged (still `claude_stream_json`). Failed extract records documented `result.error` as `metadata.agy_error` and invalid-path extract content (dashboard session log and `debug:true` `_debug.parse_metadata`; the default `clink` error body still reports only the rejection reason). An empty SUCCESS `response` remains a valid empty result. A present non-string `response` fails closed on the first result; a later malformed result does not discard an already-captured nonempty answer. Session-log Timeline shows the concatenated partial transcript when the stream ends without a terminal result. (#44)
+- Both STDIO servers shut down when their parent process disappears, including without a stdin EOF. (#24)
+- Council workflows: typed boundaries reject JSON salvaged from a mixed-content result file; wall-timeout retries are vetoed and calls get remaining-deadline guidance; abort/deadline exits persist terminal call state; succeeded runs with degraded health keep the longer failed-run retention. Caller context paths are validated at `run_workflow` admission (`-32602`) instead of after preflight. A parallel deadline abort reports `Stage <id> failed and on_failure=abort`. (#46)
+- Context-builder delegate failures are actionable. Finalizer rejections lead with the verdict, omissions, and levers. Required-focus infeasibility fails before the curator spawns and names the binding cap. Each delegate call gets one corrective JSON retry inside the same deadline, and timeout/provider-error labels are fixed. Delegate bundles state that provider-authored notes are data, not instructions. (#55)
+- The finalizer must keep required-focus ranges; budget reconstruction admits them first and fails with the binding cap instead of evicting them.
+- JSON-contract chairman calls get one corrective retry after an invalid-JSON failure under `retry.mode:"transport_only"`. (#55)
+- `review_deep_v1` links regression tests by search index or line containment, synthesizes a head slice for an unlinked nearest test, and reports doc/config targets as regression `unavailable`. (#55)
+- Dashboard: redesigned UI (#48). Freeze and pause controls are gone; updates stay live while the tab is visible (#54). Run-detail stage rows show model/effort in place of role (#53).
+
+### Fixed
+
+- Council citation checks keep evidence that cites files selected by the
+  context-builder preflight. The citation allowlist now reads the curated
+  bundle's `manifest.json` `selected_context` paths; previously only the
+  bundle and manifest files themselves were citable, so every reviewer
+  citation in a curated-context council was stripped. (#29)
+- `allow_secrets:false` context scans no longer hang in `scanning`. The sanitizer runs on linear indexes with a fail-closed work budget (`sanitize_budget_exhausted`), and discovery yields between files, honors abort, and has a 10-minute watchdog.
+- `hapi/glm` template enables the `RESULT.md` result contract, so overflowed stream-json council seats still extract. (#25)
+- Resume-preflight failures keep `failureClass:"transient"`, and resume preserves the run's original `startedAt`. (#46)
+- Session-log redaction covers credential headers of any scheme, cookies, URL userinfo, vendor tokens, JWTs, escaped embedded JSON, and credential flags; prose apostrophes no longer open a false shell quote. The producer backlog is bounded, and size loss is reported separately from redaction. (#57)
+- Dashboard: stale detail or errors from an earlier request no longer overwrite a newer selection (#45). The gateway reclaims a companion slot held by a dead socket instead of returning 409.
+
+### Docs
+
+- Deslop/unslop delivery evaluation report, with a 2026-09-27 revision. The
+  skill it evaluated now lives in the agent-skills repository and is not
+  shipped in this package. (#29)
+- `clinkx-workflows` README no longer claims side-effecting workflows are
+  rejected at load time; `validateNoSideEffects` is an empty placeholder. (#29)
+- `docs/configuration.md` documents the GLM 1M pin, STDIO server lifetime,
+  and per-call override templates (#24, #26). README documents roster
+  presets (#52).
+
+## 1.0.0 — 2026-08-17
+
+First npm release of the work that landed after `0.3.0`. The previous registry `latest` is still `clinkx@0.3.0` (published 2026-06-15).
+
+This package is proprietary. The `license` field is `UNLICENSED`.
+
+### Breaking vs npm 0.3.0
+
+Secrets are included by default. `context_builder` and workflow preflight keep API keys, private keys, tokens, and files such as `.env`, `.pem`, `id_rsa`, and `credentials.json` as written. 0.3.0 omitted that material. To restore omit/redact: `allow_secrets:false`, workflow `cb_allow_secrets:false`, or `CLINKX_CONTEXT_ALLOW_SECRETS=false`.
+
+Workflow context preflight is on by default. `createServer` exits unless the packaged `codex` adapter config is present and has a `json` role. That check is the JSON file, not a `codex` binary on `PATH`. The first `run_workflow` still needs the `codex` CLI. Full bypass: `CLINKX_WORKFLOWS_CONTEXT_PREFLIGHT_ENABLED=false`.
+
+`gemini` and the `gemini_json` parser are gone. Use `agy`.
+
+License is not MIT. Copyright (c) 2026 jim380. All rights reserved.
+
+### Added
+
+- Tools: `refine_context_run`, `workflow_run_status`, `cancel_workflow`
+- `run_workflow` accepts `async:true`. Default is still blocking.
+- Second bin: `clinkx-workflows-dashboard`
+- `grok` adapter
+- Codex app-server tools, only if `CLINKX_APP_SERVER_ENABLED=true`
+- Elaris tools, only if `CLINKX_ELARIS_ENABLED=true`
+- Workflows: `plan-review-receipts` and the generic `council-plan-review`
+
+### Docs
+
+- Adapter files load from the installed package, not from `process.cwd()`
+- README now says secrets are included by default
+- The recommended MCP snippet sets `CLINKX_ALLOWED_ROOTS` and `CLINKX_WORKFLOWS_WORKSPACE_ROOT`

package/LICENSE

@@ -0,0 +1,10 @@
+Copyright (c) 2026 jim380. All rights reserved.
+
+This software is proprietary and unlicensed. Permission is granted only to
+install and run the published npm package "clinkx" for your own use.
+
+No permission is granted to copy, modify, merge, publish, distribute,
+sublicense, and/or sell copies of the Software, except as required to install
+and run that published package.
+
+The package.json "license" field is UNLICENSED.

package/README.md

@@ -1,42 +1,164 @@
 # ClinkX
 
-An MCP server (STDIO) that exposes local tools for CLI delegation and workflow orchestration:
+An MCP STDIO server with local tools for CLI delegation and workflow orchestration.
 
-- `clink` runs a configured CLI adapter — Gemini, Codex, Claude, or anything else you configure — as a subprocess and returns the output.
-- `context_builder` creates a persisted, attachable context bundle from allowed local roots before you delegate to a CLI. It uses deterministic local selection by default and can run explicit curator/finalizer delegate adapters before local validation and materialization.
-- `list_workflows`, `resume_workflow`, and `run_workflow` support multi-stage workflow orchestration.
+- `clink` runs a configured CLI adapter (agy, Codex, Claude, Grok, or anything you add) as a subprocess and returns the output.
+- `context_builder` writes a persisted context bundle from allowed local roots. Selection is deterministic by default. You can also run explicit curator and finalizer adapters, then the server validates and materializes locally.
+- `list_workflows`, `resume_workflow`, and `run_workflow` run multi-stage workflows.
 
-Config-driven. No hardcoded CLI allowlist. PAL-compatible at the field level.
+Adapters come from config. There is no hardcoded CLI allowlist. Field-level PAL compatibility is intentional.
 
 ## Quick start
 
-Requires Node.js >= 24 and at least one CLI configured as an adapter.
+Node.js >= 24, plus at least one CLI adapter.
 
 ```bash
 npm install
-npm run build
+npm run build:all
 node dist/index.js
 ```
 
-stdout carries MCP JSON-RPC frames (one JSON object per line). Logs go to stderr.
+stdout is MCP JSON-RPC only (one JSON object per line). Logs go to stderr.
+
+Reviewed version bumps publish through CI after main checks pass. See
+[npm releases](docs/npm-releases.md) for trusted publisher setup, release policy,
+artifact verification, and recovery.
+
+Both STDIO servers detect parent death even when stdin never delivers EOF.
+Idle shutdown is separately opt-in: `CLINKX_SERVER_IDLE_TIMEOUT_SECONDS=1800`
+enables a 30-minute idle lifetime, while the default `0` preserves quiet
+sessions. Active work and response delivery prevent idle expiry. Enable it only
+for hosts that can reconnect; restart loses process-local session aliases and
+logs. See [STDIO server lifetime](docs/configuration.md#stdio-server-lifetime)
+for shutdown reasons and parent-wrapper limitations.
+
+## Local workflow dashboard
+
+After `npm run build:all`:
+
+```bash
+node dist/dashboard-cli.js --port 0
+```
+
+Passkey auth is the default. The process binds `127.0.0.1` and `::1` on the same port and prints `http://localhost:<port>`. An empty credential store also prints one enrollment code. Register a passkey with that code, then sign in as a separate step. Credentials live under `CLINKX_WORKFLOWS_DASHBOARD_CREDENTIAL_DIR` (default `${CLINKX_WORKFLOWS_STATE_DIR}/dashboard/webauthn`). Sessions die on restart.
+
+Screens: Runs, Single Calls, Context Runs, Workflows, Adapters, Artifacts. They show retained workflow state, direct-call lifecycle, standalone/refine context-builder lifecycle, persisted pre-dispatch workflow input, final outputs and errors, validated JSON artifacts, and the launch-time workflow/adapter catalogs. Runs, Single Calls, and Context Runs have their own path routes. The persisted-call inspector is an overlay that still shows up as a nested route in history.
+
+Workflow-call, activity, and context-run detail pages also have local session logs (observability only). Timeline and Conversation are chronological; order comes from the log sequence. Each lane is fenced to one immutable parent generation (run, activity, or context) plus the matching attempt, turn, or curator/finalizer execution. Pages are at most 500 events. A lane stops at 100,000 events. Events are normalized and pattern-redacted. They are not raw provider payloads, a session browser, or a live tail.
+
+Live tool arguments, sanitized argument-derived summaries, and `redaction.coverage: "pattern_best_effort"` require `CLINKX_SESSION_LOG_TOOL_ARGUMENTS_PERSISTENCE_ENABLED=true` (exact value, default off, read once per producer at creation). Disabled producers omit those additions; Claude keeps `"Tool invocation"` and Codex/agy keep legacy summaries. Deploy capable backend and browser readers first; readers always accept extended events. Rollback disables producers first and keeps capable readers until extended journals age out. Flag-off does not make existing gate-on journals old-reader-safe. Redaction hardening remains unconditional; coverage and match counts do not prove cleanliness. See [rollout configuration](docs/configuration.md#session-log-tool-arguments-rollout) and [detector scope](docs/security.md#dashboard-session-logs).
+
+The [native projection foundation](clinkx-workflows/src/dashboard/native-transcript/README.md) is unwired and persists nothing, independently of that gate. It handles JSON and text results, preserves source-file/component order, and scopes unverified synthesized identity to the affected call/result pair. Native capture, workers, storage, routes, and UI remain unfinished; #56 stays open.
+
+The dashboard has no SSE, filesystem watch, worker-health inference, cross-process cancellation, or run-creation form. Session logs cannot replay, approve, cancel, or otherwise control a run. Copied action objects are MCP tool handoffs, not JSON-RPC requests.
+
+Point the dashboard at the same `CLINKX_WORKFLOWS_STATE_DIR` as the workflow process or you will see a different (often empty) run set. Successful sync and async runs are kept for one day by default so you can inspect them. `CLINKX_WORKFLOWS_RETAIN_SUCCEEDED_DAYS=0` or `CLINKX_WORKFLOWS_RETAIN_ASYNC_DAYS=0` means keep that class forever, which can fill the disk.
+
+Workflow and activity session logs follow retention of that exact parent generation. Context session logs follow the parent context-run/manual lifecycle. There is no separate context-run pruner yet.
+
+Persisted inputs, outputs, errors, and artifact bytes can be sensitive. Access is loopback-only and passkey-gated. That is a shared-account boundary, not isolation from other processes as the same OS user. Redaction strips high-confidence credentials and user-home paths before write. Prompts, outputs, tool summaries, and reasoning can still be sensitive after that. Per-run state admission defaults to 16 MiB (configurable 1–64 MiB via `CLINKX_WORKFLOWS_DASHBOARD_MAX_STATE_BYTES`). Raw result/call reads use smaller fixed caps.
+
+For local Docker, `compose.dashboard-local.yml` runs the real UI + API over plain HTTP. Caddy publishes on `127.0.0.1` and `::1`. The browser uses `http://localhost:<port>`. Caddy shares the dashboard network namespace and proxies IPv4 to Node at `127.0.0.1:4180`. The same Node process also listens on `::1:4180`. See `docs/dashboard-local-compose.md`.
+
+Hosted passkey topology is one UI+API service behind Traefik on a private Docker network. See `deploy/dashboard-cloud/README.md`. The older gateway/companion and split-origin paths exist only as a temporary bearer rollback until local and live cloud passkey ceremonies pass the proof-gated cutover.
+
+To build the local CLI as one host-native executable, use an official Node 25.5+ runtime with SEA support:
+
+```bash
+npm run build:dashboard:standalone -- \
+  --node-executable /absolute/path/to/official-node \
+  --output ./artifacts/clinkx-dashboard
+```
+
+The binary embeds the dashboard UI, bundled configuration, workflows, and templates. At runtime it still reads state, context runs, and the inspected workspace from the usual environment paths.
 
 ## Configuration
 
-Adapters are JSON files discovered in this order:
+Adapter JSON is discovered in this order:
+
+1. `CLINKX_CONFIG_PATH` (file or directory). This replaces the whole search path. Shipped adapters are not loaded.
+2. `${XDG_CONFIG_HOME:-~/.config}/clinkx/adapters/*.json`. First-wins on `name`.
+3. Packaged `conf/adapters/*.json` next to the installed package (`import.meta.url`). Not `process.cwd()`.
+
+A `conf/adapters/*.json` file in the current working directory is ignored unless `CLINKX_CONFIG_PATH` points at it. Full reference: `docs/configuration.md`.
+
+Per-call model and effort are optional and require support declared by the resolved adapter:
+
+```json
+{"cli_name":"codex","prompt":"Summarize the module boundaries without editing files.","model":"gpt-5.4","effort":"low"}
+```
+
+Omit either field to retain that CLI setting. Unsupported overrides fail with MCP `-32602` before spawning; XDG adapter files must declare their own override support.
 
-1. `CLINKX_CONFIG_PATH` (file or directory)
-2. `${XDG_CONFIG_HOME:-~/.config}/clinkx/adapters/*.json`
-3. `conf/adapters/*.json` (relative to `process.cwd()`)
+Dashboard deployment controls:
 
-See `docs/configuration.md` for the full adapter reference.
+| Setting | Contract |
+|---|---|
+| `CLINKX_WORKFLOWS_DASHBOARD_CREDENTIAL_DIR` | Optional absolute, non-root credential directory. Host default: `${CLINKX_WORKFLOWS_STATE_DIR}/dashboard/webauthn`. Compose pins the writable `/data/dashboard-credentials` volume. |
+| `DASHBOARD_DEPLOYMENT_SLUG` | Required Compose identity, `^[a-z][a-z0-9-]{0,31}$`. Local and cloud names keep distinct stack-kind prefixes. |
+| `DASHBOARD_CREDENTIAL_BOOTSTRAP_MODE` | Required Compose state assertion. First start is `bootstrap`. Flip to `existing-enrolled` right after enrollment, before restart. |
+
+Passkey challenge capacity is 96 login slots and 32 registration/add-passkey slots, with 8 concurrent verifications. Saturation returns 503 `auth_busy` and `Retry-After: 1`. Live challenges are not evicted. Local session and challenge cookie names are port-scoped. WebAuthn still uses the shared bare `localhost` RP ID.
+
+On browser startup, a valid same-origin passkey status beats provisional bearer state. The only bearer fallback is the split-origin static server's exact no-store 404 `{"error":{"code":"not_found"}}`. Malformed or ambiguous status, and uncertain logout, fail closed. Bearer is the explicit tested rollback.
+
+Dashboard shutdown closes listeners first, then auth/gateway resources. Cleanup failures are aggregated across both.
+
+## Council roster presets
+
+`run_workflow.roster` names a JSON preset instead of passing `members`, `chairman`, or `cb_delegate`. Council workflows only. Combining `roster` with any of those fields (or a non-empty `cb_delegate`) is MCP `-32602` and creates no run.
+
+Discovery is first-wins by file stem, same as adapters:
+
+1. `CLINKX_ROSTERS_PATH` (file or directory). Replaces the rest when set.
+2. `${XDG_CONFIG_HOME:-~/.config}/clinkx/rosters/*.json`
+3. Packaged `conf/rosters/*.json` on the root server only. Standalone `createWorkflowServer` loads env/user only.
+
+Put a user preset at `~/.config/clinkx/rosters/<name>.json`. The file stem is the name (`^[a-z0-9][a-z0-9_-]{0,63}$`). Schema is Zod-strict `clinkx-roster-v1`; at least one of `members`, `chairman`, or `delegate` is required. Shipped `conf/rosters/default-council.json`:
+
+```json
+{
+  "schema_version": "clinkx-roster-v1",
+  "description": "Three-member council with a Codex chairman and an enabled curator/finalizer delegate.",
+  "members": [
+    { "cli_name": "codex" },
+    { "cli_name": "claude" },
+    { "cli_name": "glm" }
+  ],
+  "chairman": { "cli_name": "codex" },
+  "delegate": {
+    "enabled": true,
+    "curator": { "cli_name": "codex", "role": "json" },
+    "finalizer": {
+      "cli_name": "codex",
+      "role": "json-codereviewer",
+      "enabled": true,
+      "min_score": 8.5
+    },
+    "failure_policy": "fail"
+  }
+}
+```
+
+Call `run_workflow` with the preset name:
+
+```json
+{
+  "workflow": "council-default",
+  "roster": "default-council",
+  "variables": { "user_request": "Compare the three approaches and pick one." }
+}
+```
+
+`list_workflows` still returns `available_cli_names`. The root server also returns `available_clis` (per-adapter model/effort template support, not value validity; `app_server` excluded) and `available_rosters` (`{name, source}` with `source` `env` | `user` | `builtin`). A council run's requested seats and delegate appear as `resolved_roster` on the async ack, a trailing sync content block, and `workflow_run_status`. `provider_spawns` is `2N+1` (ranking is a reducer, not a spawn).
 
 ## Context bundles
 
-Use `context_builder` when a downstream `clink` call needs curated repository context without inlining source into the first tool response. The tool requires a bounded anchor: at least one bounded `focus_paths` entry or nonblank `search_terms` entry. `include_globs` can narrow scanning when combined with those anchors, but it does not select context alone. The tool writes a durable run directory with `manifest.json` and `artifacts/bundle.md`, then returns one minified JSON receipt.
+Use `context_builder` when a later `clink` call needs curated repo context and you do not want that source inlined in the first tool response. You must pass a bounded anchor: at least one `focus_paths` entry or a nonblank `search_terms` entry. `include_globs` only narrows the scan when those anchors exist. It does not select context by itself.
 
-The receipt includes `recommended_clink.absolute_file_paths`; pass those paths as the `absolute_file_paths` field in a later `clink` call. The handoff is fixed to the persisted `artifacts/bundle.md` and `manifest.json` files.
+The tool writes a durable run directory (`manifest.json`, `artifacts/bundle.md`) and returns one minified JSON receipt. The receipt includes `recommended_clink.absolute_file_paths`. Pass those as `absolute_file_paths` on a later `clink` call. The handoff files are the persisted `artifacts/bundle.md` and `manifest.json`.
 
-Delegate mode requires an explicit request shape and explicit providers:
+Delegate mode needs an explicit request shape and explicit providers:
 
 ```json
 {
@@ -61,11 +183,11 @@ Delegate mode requires an explicit request shape and explicit providers:
 }
 ```
 
-There are no built-in curator or finalizer provider defaults. Provider output is advisory: the server validates strict JSON, reconstructs accepted content from local candidates, reapplies budgets and secret checks, and does not persist raw provider output. `failure_policy:"fallback"` publishes deterministic local selection as a partial v2 run if delegate curation fails; `failure_policy:"fail"` returns an error and does not publish a manifest.
+There are no built-in curator or finalizer provider defaults. Provider output is advisory. The server checks strict JSON, rebuilds accepted content from local candidates, reapplies budgets and secret checks, and does not persist raw provider output. `failure_policy:"fallback"` publishes deterministic local selection as a partial v2 run if delegate curation fails. `failure_policy:"fail"` returns an error and does not publish a manifest.
 
 ### Adding an adapter
 
-Create `conf/adapters/echo.json`:
+Put the JSON in `${XDG_CONFIG_HOME:-~/.config}/clinkx/adapters/`. Or set `CLINKX_CONFIG_PATH` to a directory that also contains every shipped adapter you still need. That env var replaces the search path.
 
 ```json
 {
@@ -78,8 +200,6 @@ Create `conf/adapters/echo.json`:
 }
 ```
 
-Then start the server with `node dist/index.js`.
-
 ## MCP client config
 
 The exact shape depends on the client.
@@ -93,7 +213,8 @@ Via npx (recommended):
       "command": "npx",
       "args": ["-y", "clinkx@latest"],
       "env": {
-        "CLINKX_ALLOWED_ROOTS": "/path/to/your/workspace"
+        "CLINKX_ALLOWED_ROOTS": "/path/to/your/workspace",
+        "CLINKX_WORKFLOWS_WORKSPACE_ROOT": "/path/to/your/workspace"
       }
     }
   }
@@ -109,7 +230,8 @@ From a local clone:
       "command": "node",
       "args": ["/path/to/clink-mcp/dist/index.js"],
       "env": {
-        "CLINKX_ALLOWED_ROOTS": "/path/to/your/workspace"
+        "CLINKX_ALLOWED_ROOTS": "/path/to/your/workspace",
+        "CLINKX_WORKFLOWS_WORKSPACE_ROOT": "/path/to/your/workspace"
       }
     }
   }
@@ -118,10 +240,16 @@ From a local clone:
 
 ## Safety
 
-ClinkX validates what goes into the request: paths, environment variables, and argument policy. It does not sandbox the spawned process.
+ClinkX validates request paths, environment variables, and argument policy. It does not sandbox the spawned process.
+
+`CLINKX_ALLOWED_ROOTS` limits which file paths the tool accepts. Default is `process.cwd()`. It is required only if the MCP host starts ClinkX with cwd at `/`. Set it anyway so path admission does not depend on whatever cwd the host chose. The subprocess has the same permissions as whoever started ClinkX.
+
+Set `CLINKX_WORKFLOWS_WORKSPACE_ROOT` to the same workspace. If you omit it, workflows use `process.cwd()` and warn on stderr.
+
+`context_builder` validates roots and blocks symlink escapes. Secret material (API keys, private keys, tokens, `.env` / `.pem` / `id_rsa` / `credentials.json`) is included as written by default (`allow_secrets:true`) so delegates can probe. Opt out with `allow_secrets:false`, `cb_allow_secrets:false`, or `CLINKX_CONTEXT_ALLOW_SECRETS=false`. Bundle artifacts are not a sandbox and not an access-control boundary.
 
-`CLINKX_ALLOWED_ROOTS` constrains which file paths the tool accepts. The subprocess runs with the permissions of whoever started ClinkX.
+See `docs/security.md`.
 
-`context_builder` follows the same input-validation model. It validates roots, blocks symlink escapes, omits high-confidence secrets before writing previews, slices, bundles, or manifests, and persists artifacts for manual retention or cleanup. These artifacts are not a sandbox or an access-control boundary.
+## License
 
-See `docs/security.md` for details.
+Copyright (c) 2026 jim380. All rights reserved. Proprietary package (`license: UNLICENSED`). See `LICENSE`.

package/clinkx-workflows/dist/allowed-roots.d.ts

@@ -0,0 +1 @@
+export declare function artifactOnlyEnvEntry(root: string): string;

package/clinkx-workflows/dist/allowed-roots.js

@@ -0,0 +1,5 @@
+import { sep } from "node:path";
+export function artifactOnlyEnvEntry(root) {
+    return root.endsWith(sep) ? `${root}.` : `${root}${sep}.`;
+}
+//# sourceMappingURL=allowed-roots.js.map

package/clinkx-workflows/dist/allowed-roots.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"allowed-roots.js","sourceRoot":"","sources":["../src/allowed-roots.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,GAAG,EAAE,MAAM,WAAW,CAAC;AAEhC,MAAM,UAAU,oBAAoB,CAAC,IAAY;IAC/C,OAAO,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,IAAI,GAAG,CAAC,CAAC,CAAC,GAAG,IAAI,GAAG,GAAG,GAAG,CAAC;AAC5D,CAAC"}

package/clinkx-workflows/dist/artifacts.d.ts

@@ -2,8 +2,27 @@
  * Artifact storage and ordered context threading.
  */
 import type { NormalizedWorkflowDefinition, NormalizedStage, NormalizedCall } from "./definition-normalizer.js";
+import { WorkflowError } from "./errors.js";
 import type { PromptBudgetContributor } from "./prompt-budget.js";
 import type { ValidatorRegistry } from "./validators/index.js";
+/**
+ * JSON-contract parse/Zod failure only: the provider's output was not
+ * parseable JSON or did not match the declared validator schema. Size overflow
+ * is the SECOND correctable class (OutputSizeError). Unknown validator stays
+ * plain WorkflowError. This class marks parse/Zod failures a corrective
+ * re-prompt could plausibly fix, so the engine can append a bounded
+ * corrective suffix on an already-scheduled retry.
+ */
+export declare class SchemaValidationError extends WorkflowError {
+    constructor(message: string);
+}
+/**
+ * Thrown only after parse+Zod succeed and pretty-printed
+ * JSON.stringify(data, null, 2) + "\n" exceeds maxBytes.
+ */
+export declare class OutputSizeError extends WorkflowError {
+    constructor(message: string);
+}
 export interface ValidatedJsonOutput {
     readonly parsed: unknown;
     readonly serialized: string;
@@ -60,6 +79,6 @@ export declare class ArtifactStore {
     seedArtifact(record: ArtifactRecord): void;
     seedFailedCall(stageId: string, callId: string, reason: string): void;
     buildContext(definition: NormalizedWorkflowDefinition, refs: readonly string[] | undefined): ContextArtifacts;
-    buildAnonymizedContext(definition: NormalizedWorkflowDefinition, refs: readonly string[] | undefined, rotationIndex?: number): ContextArtifacts;
+    buildAnonymizedContext(definition: NormalizedWorkflowDefinition, refs: readonly string[] | undefined, rotationIndex?: number, projectArtifact?: (parsed: unknown) => unknown, namespace?: string, aliasesByReference?: Readonly<Record<string, string>>): ContextArtifacts;
     private collectReference;
 }

package/clinkx-workflows/dist/artifacts.js

@@ -6,6 +6,30 @@ import { join } from "node:path";
 import { WorkflowError } from "./errors.js";
 import { renderContextSummary } from "./template.js";
 import { createPathContributor } from "./prompt-budget.js";
+/**
+ * JSON-contract parse/Zod failure only: the provider's output was not
+ * parseable JSON or did not match the declared validator schema. Size overflow
+ * is the SECOND correctable class (OutputSizeError). Unknown validator stays
+ * plain WorkflowError. This class marks parse/Zod failures a corrective
+ * re-prompt could plausibly fix, so the engine can append a bounded
+ * corrective suffix on an already-scheduled retry.
+ */
+export class SchemaValidationError extends WorkflowError {
+    constructor(message) {
+        super(message);
+        this.name = "SchemaValidationError";
+    }
+}
+/**
+ * Thrown only after parse+Zod succeed and pretty-printed
+ * JSON.stringify(data, null, 2) + "\n" exceeds maxBytes.
+ */
+export class OutputSizeError extends WorkflowError {
+    constructor(message) {
+        super(message);
+        this.name = "OutputSizeError";
+    }
+}
 /**
  * Recursively strip keys ending in `_id` from a parsed JSON structure
  * to prevent identity leakage in anonymized context.
@@ -50,7 +74,7 @@ export class ArtifactStore {
             parsed = JSON.parse(outputText);
         }
         catch (error) {
-            throw new WorkflowError(`Invalid JSON output for ${stageId}.${callId}: ${error instanceof Error ? error.message : String(error)}`);
+            throw new SchemaValidationError(`Invalid JSON output for ${stageId}.${callId}: ${error instanceof Error ? error.message : String(error)}`);
         }
         const validator = this.validatorRegistry.get(validatorSchemaId);
         if (validator == null) {
@@ -58,13 +82,13 @@ export class ArtifactStore {
         }
         const result = validator.schema.safeParse(parsed);
         if (!result.success) {
-            throw new WorkflowError(`Validation failed for ${stageId}.${callId} against ${validatorSchemaId}: ` +
+            throw new SchemaValidationError(`Validation failed for ${stageId}.${callId} against ${validatorSchemaId}: ` +
                 result.error.issues.map((issue) => `${issue.path.join(".")}: ${issue.message}`).join("; "));
         }
         const serialized = `${JSON.stringify(result.data, null, 2)}\n`;
         const sizeBytes = Buffer.byteLength(serialized, "utf-8");
         if (validator.maxBytes != null && sizeBytes > validator.maxBytes) {
-            throw new WorkflowError(`Validated output for ${stageId}.${callId} exceeds ${String(validator.maxBytes)} bytes ` +
+            throw new OutputSizeError(`Validated output for ${stageId}.${callId} exceeds ${String(validator.maxBytes)} bytes ` +
                 `(got ${String(sizeBytes)} bytes)`);
         }
         return { parsed: result.data, serialized, sizeBytes };
@@ -174,7 +198,7 @@ export class ArtifactStore {
             omissions,
         };
     }
-    buildAnonymizedContext(definition, refs, rotationIndex = 0) {
+    buildAnonymizedContext(definition, refs, rotationIndex = 0, projectArtifact = stripIdentityFields, namespace, aliasesByReference) {
         const base = this.buildContext(definition, refs);
         if (base.artifacts.length === 0) {
             return base;
@@ -182,17 +206,22 @@ export class ArtifactStore {
         if (base.artifacts.length > 26) {
             throw new WorkflowError("Anonymous aliasing supports at most 26 artifacts (A-Z)");
         }
-        const anonDir = join(this.artifactRoot, "anonymous");
+        const anonDir = namespace === undefined
+            ? join(this.artifactRoot, "anonymous")
+            : join(this.artifactRoot, "anonymous", namespace);
         mkdirSync(anonDir, { recursive: true });
         const aliasedArtifacts = [];
         const aliasedPaths = [];
         const perStage = new Map();
         for (let i = 0; i < base.artifacts.length; i++) {
             const artifact = base.artifacts[i];
-            const letter = String.fromCharCode(65 + (i % 26));
-            const aliasFilename = `${letter}.json`;
+            const alias = aliasesByReference?.[artifact.reference] ?? String.fromCharCode(65 + (i % 26));
+            if (!/^[A-Za-z0-9_-]{1,64}$/.test(alias)) {
+                throw new WorkflowError(`Invalid anonymous alias for ${artifact.reference}`);
+            }
+            const aliasFilename = `${alias}.json`;
             const aliasPath = join(anonDir, aliasFilename);
-            const content = JSON.stringify(stripIdentityFields(artifact.parsed), null, 2) + "\n";
+            const content = JSON.stringify(projectArtifact(artifact.parsed), null, 2) + "\n";
             writeFileSync(aliasPath, content, "utf-8");
             aliasedPaths.push(aliasPath);
             aliasedArtifacts.push({
@@ -241,7 +270,7 @@ export class ArtifactStore {
         return {
             absoluteFilePaths: rotatedPaths,
             context: summaryParts.length > 0 ? summaryParts.join(" ") : undefined,
-            contributors: aliasedArtifacts.map((artifact, index) => createPathContributor(`context_from:answer_${String.fromCharCode(65 + index)}`, artifact.filePath, "context")),
+            contributors: aliasedArtifacts.map((artifact) => createPathContributor(`context_from:answer_${artifact.filename.replace(".json", "")}`, artifact.filePath, "context")),
             artifacts: aliasedArtifacts,
             omissions: base.omissions,
         };

package/clinkx-workflows/dist/artifacts.js.map

@@ -1 +1 @@
-{"version":3,"file":"artifacts.js","sourceRoot":"","sources":["../src/artifacts.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,OAAO,EAAE,SAAS,EAAE,aAAa,EAAE,MAAM,SAAS,CAAC;AACnD,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAEjC,OAAO,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAC5C,OAAO,EAAE,oBAAoB,EAAE,MAAM,eAAe,CAAC;AAErD,OAAO,EAAE,qBAAqB,EAAE,MAAM,oBAAoB,CAAC;AAkC3D;;;;;;GAMG;AACH,MAAM,UAAU,mBAAmB,CAAC,MAAe;IACjD,IAAI,MAAM,IAAI,IAAI,IAAI,OAAO,MAAM,KAAK,QAAQ,EAAE,CAAC;QACjD,OAAO,MAAM,CAAC;IAChB,CAAC;IACD,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;QAC1B,OAAO,MAAM,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,mBAAmB,CAAC,OAAO,CAAC,CAAC,CAAC;IAC/D,CAAC;IACD,MAAM,GAAG,GAAG,MAAiC,CAAC;IAC9C,MAAM,MAAM,GAA4B,EAAE,CAAC;IAC3C,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;QACnC,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;YACzB,MAAM,CAAC,GAAG,CAAC,GAAG,mBAAmB,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC;QAC9C,CAAC;IACH,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,MAAM,OAAO,aAAa;IAML;IACA;IANF,YAAY,CAAS;IACrB,oBAAoB,GAAG,IAAI,GAAG,EAA0B,CAAC;IACzD,oBAAoB,GAAG,IAAI,GAAG,EAAiC,CAAC;IAEjF,YACmB,MAAc,EACd,iBAAoC;QADpC,WAAM,GAAN,MAAM,CAAQ;QACd,sBAAiB,GAAjB,iBAAiB,CAAmB;QAErD,IAAI,CAAC,YAAY,GAAG,IAAI,CAAC,MAAM,EAAE,WAAW,CAAC,CAAC;QAC9C,SAAS,CAAC,IAAI,CAAC,YAAY,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IACpD,CAAC;IAED,IAAI,YAAY;QACd,OAAO,IAAI,CAAC,YAAY,CAAC;IAC3B,CAAC;IAED,kBAAkB,CAChB,OAAe,EACf,MAAc,EACd,iBAAyB,EACzB,UAAkB;QAElB,IAAI,MAAe,CAAC;QACpB,IAAI,CAAC;YACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC;QAClC,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,IAAI,aAAa,CACrB,2BAA2B,OAAO,IAAI,MAAM,KAC1C,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CACvD,EAAE,CACH,CAAC;QACJ,CAAC;QAED,MAAM,SAAS,GAAG,IAAI,CAAC,iBAAiB,CAAC,GAAG,CAAC,iBAAiB,CAAC,CAAC;QAChE,IAAI,SAAS,IAAI,IAAI,EAAE,CAAC;YACtB,MAAM,IAAI,aAAa,CACrB,6BAA6B,iBAAiB,SAAS,OAAO,IAAI,MAAM,EAAE,CAC3E,CAAC;QACJ,CAAC;QAED,MAAM,MAAM,GAAG,SAAS,CAAC,MAAM,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC;QAClD,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;YACpB,MAAM,IAAI,aAAa,CACrB,yBAAyB,OAAO,IAAI,MAAM,YAAY,iBAAiB,IAAI;gBACzE,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,GAAG,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAC7F,CAAC;QACJ,CAAC;QAED,MAAM,UAAU,GAAG,GAAG,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC;QAC/D,MAAM,SAAS,GAAG,MAAM,CAAC,UAAU,CAAC,UAAU,EAAE,OAAO,CAAC,CAAC;QACzD,IAAI,SAAS,CAAC,QAAQ,IAAI,IAAI,IAAI,SAAS,GAAG,SAAS,CAAC,QAAQ,EAAE,CAAC;YACjE,MAAM,IAAI,aAAa,CACrB,wBAAwB,OAAO,IAAI,MAAM,YAAY,MAAM,CAAC,SAAS,CAAC,QAAQ,CAAC,SAAS;gBACtF,QAAQ,MAAM,CAAC,SAAS,CAAC,SAAS,CACrC,CAAC;QACJ,CAAC;QAED,OAAO,EAAE,MAAM,EAAE,MAAM,CAAC,IAAI,EAAE,UAAU,EAAE,SAAS,EAAE,CAAC;IACxD,CAAC;IAED,iBAAiB,CAAC,OAMjB;QACC,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,YAAY,EAAE,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;QAC3D,SAAS,CAAC,QAAQ,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QAEzC,MAAM,QAAQ,GAAG,GAAG,OAAO,CAAC,OAAO,CAAC,SAAS,GAAG,CAAC,CAAC,IAAI,OAAO,CAAC,IAAI,CAAC,EAAE,OAAO,CAAC;QAC7E,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC;QAC1C,aAAa,CAAC,QAAQ,EAAE,OAAO,CAAC,SAAS,CAAC,UAAU,EAAE,OAAO,CAAC,CAAC;QAE/D,MAAM,MAAM,GAAmB;YAC7B,OAAO,EAAE,OAAO,CAAC,KAAK,CAAC,EAAE;YACzB,MAAM,EAAE,OAAO,CAAC,IAAI,CAAC,EAAE;YACvB,SAAS,EAAE,GAAG,OAAO,CAAC,KAAK,CAAC,EAAE,IAAI,OAAO,CAAC,IAAI,CAAC,EAAE,EAAE;YACnD,QAAQ;YACR,QAAQ;YACR,SAAS,EAAE,OAAO,CAAC,SAAS,CAAC,SAAS;YACtC,MAAM,EAAE,OAAO,CAAC,SAAS,CAAC,MAAM;SACjC,CAAC;QAEF,IAAI,CAAC,oBAAoB,CAAC,GAAG,CAAC,MAAM,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC;QACxD,OAAO,MAAM,CAAC;IAChB,CAAC;IAED,mBAAmB,CAAC,KAAsB,EAAE,UAAkB;QAC5D,MAAM,cAAc,GAAG,KAAK,CAAC,KAAK;aAC/B,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,oBAAoB,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC,EAAE,IAAI,IAAI,CAAC,EAAE,EAAE,CAAC,CAAC;aACtE,MAAM,CAAC,CAAC,QAAQ,EAA8B,EAAE,CAAC,QAAQ,IAAI,IAAI,CAAC,CAAC;QAEtE,IAAI,cAAc,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAChC,OAAO,SAAS,CAAC;QACnB,CAAC;QAED,MAAM,aAAa,GAAG,IAAI,CAAC,IAAI,CAAC,YAAY,EAAE,GAAG,OAAO,CAAC,UAAU,GAAG,CAAC,CAAC,IAAI,KAAK,CAAC,EAAE,OAAO,CAAC,CAAC;QAC7F,MAAM,OAAO,GAAG;YACd,QAAQ,EAAE,KAAK,CAAC,EAAE;YAClB,SAAS,EAAE,cAAc,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC;gBAC3C,OAAO,EAAE,QAAQ,CAAC,MAAM;gBACxB,IAAI,EAAE,QAAQ,CAAC,QAAQ;gBACvB,MAAM,EAAE,QAAQ,CAAC,MAAM;aACxB,CAAC,CAAC;SACJ,CAAC;QACF,aAAa,CAAC,aAAa,EAAE,GAAG,IAAI,CAAC,SAAS,CAAC,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;QAC/E,OAAO,aAAa,CAAC;IACvB,CAAC;IAED,cAAc,CAAC,OAAe,EAAE,MAAc,EAAE,MAAc;QAC5D,MAAM,SAAS,GAAG,GAAG,OAAO,IAAI,MAAM,EAAE,CAAC;QACzC,IAAI,CAAC,oBAAoB,CAAC,GAAG,CAAC,SAAS,EAAE;YACvC,OAAO;YACP,MAAM;YACN,SAAS;YACT,MAAM;SACP,CAAC,CAAC;IACL,CAAC;IAED,YAAY,CAAC,MAAsB;QACjC,IAAI,CAAC,oBAAoB,CAAC,GAAG,CAAC,MAAM,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC;IAC1D,CAAC;IAED,cAAc,CAAC,OAAe,EAAE,MAAc,EAAE,MAAc;QAC5D,IAAI,CAAC,cAAc,CAAC,OAAO,EAAE,MAAM,EAAE,MAAM,CAAC,CAAC;IAC/C,CAAC;IAED,YAAY,CACV,UAAwC,EACxC,IAAmC;QAEnC,IAAI,IAAI,IAAI,IAAI,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACtC,OAAO;gBACL,iBAAiB,EAAE,EAAE;gBACrB,OAAO,EAAE,SAAS;gBAClB,YAAY,EAAE,EAAE;gBAChB,SAAS,EAAE,EAAE;gBACb,SAAS,EAAE,EAAE;aACd,CAAC;QACJ,CAAC;QAED,MAAM,SAAS,GAAqB,EAAE,CAAC;QACvC,MAAM,SAAS,GAA4B,EAAE,CAAC;QAC9C,MAAM,aAAa,GAAG,IAAI,GAAG,EAAU,CAAC;QACxC,MAAM,aAAa,GAAG,IAAI,GAAG,EAAU,CAAC;QACxC,MAAM,QAAQ,GAAG,IAAI,GAAG,EAA4B,CAAC;QAErD,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;YACvB,MAAM,GAAG,GAAG,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;YAC7B,IAAI,GAAG,KAAK,CAAC,CAAC,EAAE,CAAC;gBACf,MAAM,KAAK,GAAG,UAAU,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,SAAS,CAAC,EAAE,KAAK,GAAG,CAAC,CAAC;gBAC1E,IAAI,KAAK,IAAI,IAAI,EAAE,CAAC;oBAClB,MAAM,IAAI,aAAa,CAAC,4BAA4B,GAAG,0BAA0B,CAAC,CAAC;gBACrF,CAAC;gBACD,KAAK,MAAM,IAAI,IAAI,KAAK,CAAC,KAAK,EAAE,CAAC;oBAC/B,IAAI,CAAC,gBAAgB,CAAC,GAAG,KAAK,CAAC,EAAE,IAAI,IAAI,CAAC,EAAE,EAAE,EAAE,SAAS,EAAE,SAAS,EAAE,aAAa,EAAE,aAAa,CAAC,CAAC;gBACtG,CAAC;YACH,CAAC;iBAAM,CAAC;gBACN,IAAI,CAAC,gBAAgB,CAAC,GAAG,EAAE,SAAS,EAAE,SAAS,EAAE,aAAa,EAAE,aAAa,CAAC,CAAC;YACjF,CAAC;QACH,CAAC;QAED,KAAK,MAAM,QAAQ,IAAI,SAAS,EAAE,CAAC;YACjC,MAAM,KAAK,GAAG,QAAQ,CAAC,GAAG,CAAC,QAAQ,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC;YACnD,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;YACrB,QAAQ,CAAC,GAAG,CAAC,QAAQ,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;QACxC,CAAC;QAED,MAAM,YAAY,GAAa,EAAE,CAAC;QAClC,KAAK,MAAM,CAAC,OAAO,EAAE,cAAc,CAAC,IAAI,QAAQ,EAAE,CAAC;YACjD,YAAY,CAAC,IAAI,CACf,oBAAoB,CAClB,OAAO,EACP,cAAc,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC;gBAChC,QAAQ,EAAE,QAAQ,CAAC,QAAQ;gBAC3B,SAAS,EAAE,QAAQ,CAAC,SAAS;aAC9B,CAAC,CAAC,CACJ,CACF,CAAC;QACJ,CAAC;QAED,IAAI,SAAS,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACzB,YAAY,CAAC,IAAI,CACf,2BAA2B,SAAS,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CACzF,CAAC;QACJ,CAAC;QAED,OAAO;YACL,iBAAiB,EAAE,SAAS,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,QAAQ,CAAC,QAAQ,CAAC;YACjE,OAAO,EAAE,YAAY,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,YAAY,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS;YACrE,YAAY,EAAE,SAAS,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE,EAAE,CACvC,qBAAqB,CAAC,gBAAgB,QAAQ,CAAC,SAAS,EAAE,EAAE,QAAQ,CAAC,QAAQ,EAAE,SAAS,CAAC,CAC1F;YACD,SAAS;YACT,SAAS;SACV,CAAC;IACJ,CAAC;IAED,sBAAsB,CACpB,UAAwC,EACxC,IAAmC,EACnC,aAAa,GAAG,CAAC;QAEjB,MAAM,IAAI,GAAG,IAAI,CAAC,YAAY,CAAC,UAAU,EAAE,IAAI,CAAC,CAAC;QACjD,IAAI,IAAI,CAAC,SAAS,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAChC,OAAO,IAAI,CAAC;QACd,CAAC;QAED,IAAI,IAAI,CAAC,SAAS,CAAC,MAAM,GAAG,EAAE,EAAE,CAAC;YAC/B,MAAM,IAAI,aAAa,CAAC,wDAAwD,CAAC,CAAC;QACpF,CAAC;QAED,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,CAAC,YAAY,EAAE,WAAW,CAAC,CAAC;QACrD,SAAS,CAAC,OAAO,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QAExC,MAAM,gBAAgB,GAAqB,EAAE,CAAC;QAC9C,MAAM,YAAY,GAAa,EAAE,CAAC;QAClC,MAAM,QAAQ,GAAG,IAAI,GAAG,EAA0D,CAAC;QAEnF,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;YAC/C,MAAM,QAAQ,GAAG,IAAI,CAAC,SAAS,CAAC,CAAC,CAAE,CAAC;YACpC,MAAM,MAAM,GAAG,MAAM,CAAC,YAAY,CAAC,EAAE,GAAG,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC;YAClD,MAAM,aAAa,GAAG,GAAG,MAAM,OAAO,CAAC;YACvC,MAAM,SAAS,GAAG,IAAI,CAAC,OAAO,EAAE,aAAa,CAAC,CAAC;YAC/C,MAAM,OAAO,GAAG,IAAI,CAAC,SAAS,CAAC,mBAAmB,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,GAAG,IAAI,CAAC;YACrF,aAAa,CAAC,SAAS,EAAE,OAAO,EAAE,OAAO,CAAC,CAAC;YAE3C,YAAY,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;YAC7B,gBAAgB,CAAC,IAAI,CAAC;gBACpB,GAAG,QAAQ;gBACX,QAAQ,EAAE,SAAS;gBACnB,QAAQ,EAAE,aAAa;aACxB,CAAC,CAAC;YAEH,MAAM,KAAK,GAAG,QAAQ,CAAC,GAAG,CAAC,QAAQ,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC;YACnD,KAAK,CAAC,IAAI,CAAC,EAAE,QAAQ,EAAE,aAAa,EAAE,SAAS,EAAE,QAAQ,CAAC,SAAS,EAAE,CAAC,CAAC;YACvE,QAAQ,CAAC,GAAG,CAAC,QAAQ,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;QACxC,CAAC;QAED,6EAA6E;QAC7E,iEAAiE;QACjE,MAAM,iBAAiB,GAAG,YAAY,CAAC,MAAM,GAAG,CAAC;YAC/C,CAAC,CAAC,CAAC,CAAC,aAAa,GAAG,YAAY,CAAC,MAAM,CAAC,GAAG,YAAY,CAAC,MAAM,CAAC,GAAG,YAAY,CAAC,MAAM;YACrF,CAAC,CAAC,CAAC,CAAC;QACN,MAAM,YAAY,GAAG,iBAAiB,KAAK,CAAC;YAC1C,CAAC,CAAC,YAAY;YACd,CAAC,CAAC,CAAC,GAAG,YAAY,CAAC,KAAK,CAAC,iBAAiB,CAAC,EAAE,GAAG,YAAY,CAAC,KAAK,CAAC,CAAC,EAAE,iBAAiB,CAAC,CAAC,CAAC;QAE5F,wEAAwE;QACxE,MAAM,gBAAgB,GAAG,iBAAiB,KAAK,CAAC;YAC9C,CAAC,CAAC,gBAAgB;YAClB,CAAC,CAAC,CAAC,GAAG,gBAAgB,CAAC,KAAK,CAAC,iBAAiB,CAAC,EAAE,GAAG,gBAAgB,CAAC,KAAK,CAAC,CAAC,EAAE,iBAAiB,CAAC,CAAC,CAAC;QAEpG,MAAM,eAAe,GAAG,IAAI,GAAG,EAA0D,CAAC;QAC1F,KAAK,MAAM,QAAQ,IAAI,gBAAgB,EAAE,CAAC;YACxC,MAAM,KAAK,GAAG,eAAe,CAAC,GAAG,CAAC,QAAQ,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC;YAC1D,KAAK,CAAC,IAAI,CAAC,EAAE,QAAQ,EAAE,QAAQ,CAAC,QAAQ,EAAE,SAAS,EAAE,QAAQ,CAAC,SAAS,EAAE,CAAC,CAAC;YAC3E,eAAe,CAAC,GAAG,CAAC,QAAQ,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;QAC/C,CAAC;QAED,MAAM,YAAY,GAAa,EAAE,CAAC;QAClC,KAAK,MAAM,CAAC,OAAO,EAAE,cAAc,CAAC,IAAI,eAAe,EAAE,CAAC;YACxD,MAAM,QAAQ,GAAG,cAAc;iBAC5B,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE;gBACT,MAAM,MAAM,GAAG,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC;gBAC/C,MAAM,MAAM,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,GAAG,IAAI,CAAC,CAAC;gBAC7C,OAAO,UAAU,MAAM,KAAK,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC;YAClD,CAAC,CAAC;iBACD,IAAI,CAAC,IAAI,CAAC,CAAC;YACd,YAAY,CAAC,IAAI,CACf,SAAS,OAAO,aAAa,QAAQ,IAAI;gBACvC,+CAA+C,CAClD,CAAC;QACJ,CAAC;QAED,IAAI,IAAI,CAAC,SAAS,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC9B,MAAM,mBAAmB,GAAG,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,EAAE,EAAE,GAAG,EAAE,EAAE,CAAC,WAAW,GAAG,GAAG,CAAC,EAAE,CAAC,CAAC;YAClF,YAAY,CAAC,IAAI,CACf,2BAA2B,mBAAmB,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAC7D,CAAC;QACJ,CAAC;QAED,OAAO;YACL,iBAAiB,EAAE,YAAY;YAC/B,OAAO,EAAE,YAAY,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,YAAY,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS;YACrE,YAAY,EAAE,gBAAgB,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE,KAAK,EAAE,EAAE,CACrD,qBAAqB,CACnB,uBAAuB,MAAM,CAAC,YAAY,CAAC,EAAE,GAAG,KAAK,CAAC,EAAE,EACxD,QAAQ,CAAC,QAAQ,EACjB,SAAS,CACV,CACF;YACD,SAAS,EAAE,gBAAgB;YAC3B,SAAS,EAAE,IAAI,CAAC,SAAS;SAC1B,CAAC;IACJ,CAAC;IAEO,gBAAgB,CACtB,SAAiB,EACjB,SAA2B,EAC3B,SAAkC,EAClC,aAA0B,EAC1B,aAA0B;QAE1B,MAAM,QAAQ,GAAG,IAAI,CAAC,oBAAoB,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;QAC1D,IAAI,QAAQ,IAAI,IAAI,EAAE,CAAC;YACrB,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,SAAS,CAAC,EAAE,CAAC;gBAClC,SAAS,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;gBACzB,aAAa,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;YAC/B,CAAC;YACD,OAAO;QACT,CAAC;QAED,MAAM,QAAQ,GAAG,IAAI,CAAC,oBAAoB,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;QAC1D,IAAI,QAAQ,IAAI,IAAI,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,SAAS,CAAC,EAAE,CAAC;YACtD,SAAS,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;YACzB,aAAa,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;QAC/B,CAAC;IACH,CAAC;CACF;AAED,SAAS,OAAO,CAAC,KAAa;IAC5B,OAAO,MAAM,CAAC,KAAK,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;AACxC,CAAC"}
+{"version":3,"file":"artifacts.js","sourceRoot":"","sources":["../src/artifacts.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,OAAO,EAAE,SAAS,EAAE,aAAa,EAAE,MAAM,SAAS,CAAC;AACnD,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAEjC,OAAO,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAC5C,OAAO,EAAE,oBAAoB,EAAE,MAAM,eAAe,CAAC;AAErD,OAAO,EAAE,qBAAqB,EAAE,MAAM,oBAAoB,CAAC;AAG3D;;;;;;;GAOG;AACH,MAAM,OAAO,qBAAsB,SAAQ,aAAa;IACtD,YAAY,OAAe;QACzB,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,uBAAuB,CAAC;IACtC,CAAC;CACF;AAED;;;GAGG;AACH,MAAM,OAAO,eAAgB,SAAQ,aAAa;IAChD,YAAY,OAAe;QACzB,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,iBAAiB,CAAC;IAChC,CAAC;CACF;AAiCD;;;;;;GAMG;AACH,MAAM,UAAU,mBAAmB,CAAC,MAAe;IACjD,IAAI,MAAM,IAAI,IAAI,IAAI,OAAO,MAAM,KAAK,QAAQ,EAAE,CAAC;QACjD,OAAO,MAAM,CAAC;IAChB,CAAC;IACD,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;QAC1B,OAAO,MAAM,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,mBAAmB,CAAC,OAAO,CAAC,CAAC,CAAC;IAC/D,CAAC;IACD,MAAM,GAAG,GAAG,MAAiC,CAAC;IAC9C,MAAM,MAAM,GAA4B,EAAE,CAAC;IAC3C,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;QACnC,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;YACzB,MAAM,CAAC,GAAG,CAAC,GAAG,mBAAmB,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC;QAC9C,CAAC;IACH,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,MAAM,OAAO,aAAa;IAML;IACA;IANF,YAAY,CAAS;IACrB,oBAAoB,GAAG,IAAI,GAAG,EAA0B,CAAC;IACzD,oBAAoB,GAAG,IAAI,GAAG,EAAiC,CAAC;IAEjF,YACmB,MAAc,EACd,iBAAoC;QADpC,WAAM,GAAN,MAAM,CAAQ;QACd,sBAAiB,GAAjB,iBAAiB,CAAmB;QAErD,IAAI,CAAC,YAAY,GAAG,IAAI,CAAC,MAAM,EAAE,WAAW,CAAC,CAAC;QAC9C,SAAS,CAAC,IAAI,CAAC,YAAY,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IACpD,CAAC;IAED,IAAI,YAAY;QACd,OAAO,IAAI,CAAC,YAAY,CAAC;IAC3B,CAAC;IAED,kBAAkB,CAChB,OAAe,EACf,MAAc,EACd,iBAAyB,EACzB,UAAkB;QAElB,IAAI,MAAe,CAAC;QACpB,IAAI,CAAC;YACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC;QAClC,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,IAAI,qBAAqB,CAC7B,2BAA2B,OAAO,IAAI,MAAM,KAC1C,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CACvD,EAAE,CACH,CAAC;QACJ,CAAC;QAED,MAAM,SAAS,GAAG,IAAI,CAAC,iBAAiB,CAAC,GAAG,CAAC,iBAAiB,CAAC,CAAC;QAChE,IAAI,SAAS,IAAI,IAAI,EAAE,CAAC;YACtB,MAAM,IAAI,aAAa,CACrB,6BAA6B,iBAAiB,SAAS,OAAO,IAAI,MAAM,EAAE,CAC3E,CAAC;QACJ,CAAC;QAED,MAAM,MAAM,GAAG,SAAS,CAAC,MAAM,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC;QAClD,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;YACpB,MAAM,IAAI,qBAAqB,CAC7B,yBAAyB,OAAO,IAAI,MAAM,YAAY,iBAAiB,IAAI;gBACzE,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,GAAG,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAC7F,CAAC;QACJ,CAAC;QAED,MAAM,UAAU,GAAG,GAAG,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC;QAC/D,MAAM,SAAS,GAAG,MAAM,CAAC,UAAU,CAAC,UAAU,EAAE,OAAO,CAAC,CAAC;QACzD,IAAI,SAAS,CAAC,QAAQ,IAAI,IAAI,IAAI,SAAS,GAAG,SAAS,CAAC,QAAQ,EAAE,CAAC;YACjE,MAAM,IAAI,eAAe,CACvB,wBAAwB,OAAO,IAAI,MAAM,YAAY,MAAM,CAAC,SAAS,CAAC,QAAQ,CAAC,SAAS;gBACtF,QAAQ,MAAM,CAAC,SAAS,CAAC,SAAS,CACrC,CAAC;QACJ,CAAC;QAED,OAAO,EAAE,MAAM,EAAE,MAAM,CAAC,IAAI,EAAE,UAAU,EAAE,SAAS,EAAE,CAAC;IACxD,CAAC;IAED,iBAAiB,CAAC,OAMjB;QACC,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,YAAY,EAAE,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;QAC3D,SAAS,CAAC,QAAQ,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QAEzC,MAAM,QAAQ,GAAG,GAAG,OAAO,CAAC,OAAO,CAAC,SAAS,GAAG,CAAC,CAAC,IAAI,OAAO,CAAC,IAAI,CAAC,EAAE,OAAO,CAAC;QAC7E,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC;QAC1C,aAAa,CAAC,QAAQ,EAAE,OAAO,CAAC,SAAS,CAAC,UAAU,EAAE,OAAO,CAAC,CAAC;QAE/D,MAAM,MAAM,GAAmB;YAC7B,OAAO,EAAE,OAAO,CAAC,KAAK,CAAC,EAAE;YACzB,MAAM,EAAE,OAAO,CAAC,IAAI,CAAC,EAAE;YACvB,SAAS,EAAE,GAAG,OAAO,CAAC,KAAK,CAAC,EAAE,IAAI,OAAO,CAAC,IAAI,CAAC,EAAE,EAAE;YACnD,QAAQ;YACR,QAAQ;YACR,SAAS,EAAE,OAAO,CAAC,SAAS,CAAC,SAAS;YACtC,MAAM,EAAE,OAAO,CAAC,SAAS,CAAC,MAAM;SACjC,CAAC;QAEF,IAAI,CAAC,oBAAoB,CAAC,GAAG,CAAC,MAAM,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC;QACxD,OAAO,MAAM,CAAC;IAChB,CAAC;IAED,mBAAmB,CAAC,KAAsB,EAAE,UAAkB;QAC5D,MAAM,cAAc,GAAG,KAAK,CAAC,KAAK;aAC/B,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,oBAAoB,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC,EAAE,IAAI,IAAI,CAAC,EAAE,EAAE,CAAC,CAAC;aACtE,MAAM,CAAC,CAAC,QAAQ,EAA8B,EAAE,CAAC,QAAQ,IAAI,IAAI,CAAC,CAAC;QAEtE,IAAI,cAAc,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAChC,OAAO,SAAS,CAAC;QACnB,CAAC;QAED,MAAM,aAAa,GAAG,IAAI,CAAC,IAAI,CAAC,YAAY,EAAE,GAAG,OAAO,CAAC,UAAU,GAAG,CAAC,CAAC,IAAI,KAAK,CAAC,EAAE,OAAO,CAAC,CAAC;QAC7F,MAAM,OAAO,GAAG;YACd,QAAQ,EAAE,KAAK,CAAC,EAAE;YAClB,SAAS,EAAE,cAAc,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC;gBAC3C,OAAO,EAAE,QAAQ,CAAC,MAAM;gBACxB,IAAI,EAAE,QAAQ,CAAC,QAAQ;gBACvB,MAAM,EAAE,QAAQ,CAAC,MAAM;aACxB,CAAC,CAAC;SACJ,CAAC;QACF,aAAa,CAAC,aAAa,EAAE,GAAG,IAAI,CAAC,SAAS,CAAC,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;QAC/E,OAAO,aAAa,CAAC;IACvB,CAAC;IAED,cAAc,CAAC,OAAe,EAAE,MAAc,EAAE,MAAc;QAC5D,MAAM,SAAS,GAAG,GAAG,OAAO,IAAI,MAAM,EAAE,CAAC;QACzC,IAAI,CAAC,oBAAoB,CAAC,GAAG,CAAC,SAAS,EAAE;YACvC,OAAO;YACP,MAAM;YACN,SAAS;YACT,MAAM;SACP,CAAC,CAAC;IACL,CAAC;IAED,YAAY,CAAC,MAAsB;QACjC,IAAI,CAAC,oBAAoB,CAAC,GAAG,CAAC,MAAM,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC;IAC1D,CAAC;IAED,cAAc,CAAC,OAAe,EAAE,MAAc,EAAE,MAAc;QAC5D,IAAI,CAAC,cAAc,CAAC,OAAO,EAAE,MAAM,EAAE,MAAM,CAAC,CAAC;IAC/C,CAAC;IAED,YAAY,CACV,UAAwC,EACxC,IAAmC;QAEnC,IAAI,IAAI,IAAI,IAAI,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACtC,OAAO;gBACL,iBAAiB,EAAE,EAAE;gBACrB,OAAO,EAAE,SAAS;gBAClB,YAAY,EAAE,EAAE;gBAChB,SAAS,EAAE,EAAE;gBACb,SAAS,EAAE,EAAE;aACd,CAAC;QACJ,CAAC;QAED,MAAM,SAAS,GAAqB,EAAE,CAAC;QACvC,MAAM,SAAS,GAA4B,EAAE,CAAC;QAC9C,MAAM,aAAa,GAAG,IAAI,GAAG,EAAU,CAAC;QACxC,MAAM,aAAa,GAAG,IAAI,GAAG,EAAU,CAAC;QACxC,MAAM,QAAQ,GAAG,IAAI,GAAG,EAA4B,CAAC;QAErD,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;YACvB,MAAM,GAAG,GAAG,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;YAC7B,IAAI,GAAG,KAAK,CAAC,CAAC,EAAE,CAAC;gBACf,MAAM,KAAK,GAAG,UAAU,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,SAAS,CAAC,EAAE,KAAK,GAAG,CAAC,CAAC;gBAC1E,IAAI,KAAK,IAAI,IAAI,EAAE,CAAC;oBAClB,MAAM,IAAI,aAAa,CAAC,4BAA4B,GAAG,0BAA0B,CAAC,CAAC;gBACrF,CAAC;gBACD,KAAK,MAAM,IAAI,IAAI,KAAK,CAAC,KAAK,EAAE,CAAC;oBAC/B,IAAI,CAAC,gBAAgB,CAAC,GAAG,KAAK,CAAC,EAAE,IAAI,IAAI,CAAC,EAAE,EAAE,EAAE,SAAS,EAAE,SAAS,EAAE,aAAa,EAAE,aAAa,CAAC,CAAC;gBACtG,CAAC;YACH,CAAC;iBAAM,CAAC;gBACN,IAAI,CAAC,gBAAgB,CAAC,GAAG,EAAE,SAAS,EAAE,SAAS,EAAE,aAAa,EAAE,aAAa,CAAC,CAAC;YACjF,CAAC;QACH,CAAC;QAED,KAAK,MAAM,QAAQ,IAAI,SAAS,EAAE,CAAC;YACjC,MAAM,KAAK,GAAG,QAAQ,CAAC,GAAG,CAAC,QAAQ,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC;YACnD,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;YACrB,QAAQ,CAAC,GAAG,CAAC,QAAQ,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;QACxC,CAAC;QAED,MAAM,YAAY,GAAa,EAAE,CAAC;QAClC,KAAK,MAAM,CAAC,OAAO,EAAE,cAAc,CAAC,IAAI,QAAQ,EAAE,CAAC;YACjD,YAAY,CAAC,IAAI,CACf,oBAAoB,CAClB,OAAO,EACP,cAAc,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC;gBAChC,QAAQ,EAAE,QAAQ,CAAC,QAAQ;gBAC3B,SAAS,EAAE,QAAQ,CAAC,SAAS;aAC9B,CAAC,CAAC,CACJ,CACF,CAAC;QACJ,CAAC;QAED,IAAI,SAAS,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACzB,YAAY,CAAC,IAAI,CACf,2BAA2B,SAAS,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CACzF,CAAC;QACJ,CAAC;QAED,OAAO;YACL,iBAAiB,EAAE,SAAS,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,QAAQ,CAAC,QAAQ,CAAC;YACjE,OAAO,EAAE,YAAY,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,YAAY,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS;YACrE,YAAY,EAAE,SAAS,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE,EAAE,CACvC,qBAAqB,CAAC,gBAAgB,QAAQ,CAAC,SAAS,EAAE,EAAE,QAAQ,CAAC,QAAQ,EAAE,SAAS,CAAC,CAC1F;YACD,SAAS;YACT,SAAS;SACV,CAAC;IACJ,CAAC;IAED,sBAAsB,CACpB,UAAwC,EACxC,IAAmC,EACnC,aAAa,GAAG,CAAC,EACjB,kBAAgD,mBAAmB,EACnE,SAAkB,EAClB,kBAAqD;QAErD,MAAM,IAAI,GAAG,IAAI,CAAC,YAAY,CAAC,UAAU,EAAE,IAAI,CAAC,CAAC;QACjD,IAAI,IAAI,CAAC,SAAS,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAChC,OAAO,IAAI,CAAC;QACd,CAAC;QAED,IAAI,IAAI,CAAC,SAAS,CAAC,MAAM,GAAG,EAAE,EAAE,CAAC;YAC/B,MAAM,IAAI,aAAa,CAAC,wDAAwD,CAAC,CAAC;QACpF,CAAC;QAED,MAAM,OAAO,GAAG,SAAS,KAAK,SAAS;YACrC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,YAAY,EAAE,WAAW,CAAC;YACtC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,YAAY,EAAE,WAAW,EAAE,SAAS,CAAC,CAAC;QACpD,SAAS,CAAC,OAAO,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QAExC,MAAM,gBAAgB,GAAqB,EAAE,CAAC;QAC9C,MAAM,YAAY,GAAa,EAAE,CAAC;QAClC,MAAM,QAAQ,GAAG,IAAI,GAAG,EAA0D,CAAC;QAEnF,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;YAC/C,MAAM,QAAQ,GAAG,IAAI,CAAC,SAAS,CAAC,CAAC,CAAE,CAAC;YACpC,MAAM,KAAK,GAAG,kBAAkB,EAAE,CAAC,QAAQ,CAAC,SAAS,CAAC,IAAI,MAAM,CAAC,YAAY,CAAC,EAAE,GAAG,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC;YAC7F,IAAI,CAAC,uBAAuB,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;gBACzC,MAAM,IAAI,aAAa,CAAC,+BAA+B,QAAQ,CAAC,SAAS,EAAE,CAAC,CAAC;YAC/E,CAAC;YACD,MAAM,aAAa,GAAG,GAAG,KAAK,OAAO,CAAC;YACtC,MAAM,SAAS,GAAG,IAAI,CAAC,OAAO,EAAE,aAAa,CAAC,CAAC;YAC/C,MAAM,OAAO,GAAG,IAAI,CAAC,SAAS,CAAC,eAAe,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,GAAG,IAAI,CAAC;YACjF,aAAa,CAAC,SAAS,EAAE,OAAO,EAAE,OAAO,CAAC,CAAC;YAE3C,YAAY,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;YAC7B,gBAAgB,CAAC,IAAI,CAAC;gBACpB,GAAG,QAAQ;gBACX,QAAQ,EAAE,SAAS;gBACnB,QAAQ,EAAE,aAAa;aACxB,CAAC,CAAC;YAEH,MAAM,KAAK,GAAG,QAAQ,CAAC,GAAG,CAAC,QAAQ,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC;YACnD,KAAK,CAAC,IAAI,CAAC,EAAE,QAAQ,EAAE,aAAa,EAAE,SAAS,EAAE,QAAQ,CAAC,SAAS,EAAE,CAAC,CAAC;YACvE,QAAQ,CAAC,GAAG,CAAC,QAAQ,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;QACxC,CAAC;QAED,6EAA6E;QAC7E,iEAAiE;QACjE,MAAM,iBAAiB,GAAG,YAAY,CAAC,MAAM,GAAG,CAAC;YAC/C,CAAC,CAAC,CAAC,CAAC,aAAa,GAAG,YAAY,CAAC,MAAM,CAAC,GAAG,YAAY,CAAC,MAAM,CAAC,GAAG,YAAY,CAAC,MAAM;YACrF,CAAC,CAAC,CAAC,CAAC;QACN,MAAM,YAAY,GAAG,iBAAiB,KAAK,CAAC;YAC1C,CAAC,CAAC,YAAY;YACd,CAAC,CAAC,CAAC,GAAG,YAAY,CAAC,KAAK,CAAC,iBAAiB,CAAC,EAAE,GAAG,YAAY,CAAC,KAAK,CAAC,CAAC,EAAE,iBAAiB,CAAC,CAAC,CAAC;QAE5F,wEAAwE;QACxE,MAAM,gBAAgB,GAAG,iBAAiB,KAAK,CAAC;YAC9C,CAAC,CAAC,gBAAgB;YAClB,CAAC,CAAC,CAAC,GAAG,gBAAgB,CAAC,KAAK,CAAC,iBAAiB,CAAC,EAAE,GAAG,gBAAgB,CAAC,KAAK,CAAC,CAAC,EAAE,iBAAiB,CAAC,CAAC,CAAC;QAEpG,MAAM,eAAe,GAAG,IAAI,GAAG,EAA0D,CAAC;QAC1F,KAAK,MAAM,QAAQ,IAAI,gBAAgB,EAAE,CAAC;YACxC,MAAM,KAAK,GAAG,eAAe,CAAC,GAAG,CAAC,QAAQ,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC;YAC1D,KAAK,CAAC,IAAI,CAAC,EAAE,QAAQ,EAAE,QAAQ,CAAC,QAAQ,EAAE,SAAS,EAAE,QAAQ,CAAC,SAAS,EAAE,CAAC,CAAC;YAC3E,eAAe,CAAC,GAAG,CAAC,QAAQ,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;QAC/C,CAAC;QAED,MAAM,YAAY,GAAa,EAAE,CAAC;QAClC,KAAK,MAAM,CAAC,OAAO,EAAE,cAAc,CAAC,IAAI,eAAe,EAAE,CAAC;YACxD,MAAM,QAAQ,GAAG,cAAc;iBAC5B,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE;gBACT,MAAM,MAAM,GAAG,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC;gBAC/C,MAAM,MAAM,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,GAAG,IAAI,CAAC,CAAC;gBAC7C,OAAO,UAAU,MAAM,KAAK,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC;YAClD,CAAC,CAAC;iBACD,IAAI,CAAC,IAAI,CAAC,CAAC;YACd,YAAY,CAAC,IAAI,CACf,SAAS,OAAO,aAAa,QAAQ,IAAI;gBACvC,+CAA+C,CAClD,CAAC;QACJ,CAAC;QAED,IAAI,IAAI,CAAC,SAAS,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC9B,MAAM,mBAAmB,GAAG,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,EAAE,EAAE,GAAG,EAAE,EAAE,CAAC,WAAW,GAAG,GAAG,CAAC,EAAE,CAAC,CAAC;YAClF,YAAY,CAAC,IAAI,CACf,2BAA2B,mBAAmB,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAC7D,CAAC;QACJ,CAAC;QAED,OAAO;YACL,iBAAiB,EAAE,YAAY;YAC/B,OAAO,EAAE,YAAY,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,YAAY,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS;YACrE,YAAY,EAAE,gBAAgB,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE,EAAE,CAC9C,qBAAqB,CACnB,uBAAuB,QAAQ,CAAC,QAAQ,CAAC,OAAO,CAAC,OAAO,EAAE,EAAE,CAAC,EAAE,EAC/D,QAAQ,CAAC,QAAQ,EACjB,SAAS,CACV,CACF;YACD,SAAS,EAAE,gBAAgB;YAC3B,SAAS,EAAE,IAAI,CAAC,SAAS;SAC1B,CAAC;IACJ,CAAC;IAEO,gBAAgB,CACtB,SAAiB,EACjB,SAA2B,EAC3B,SAAkC,EAClC,aAA0B,EAC1B,aAA0B;QAE1B,MAAM,QAAQ,GAAG,IAAI,CAAC,oBAAoB,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;QAC1D,IAAI,QAAQ,IAAI,IAAI,EAAE,CAAC;YACrB,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,SAAS,CAAC,EAAE,CAAC;gBAClC,SAAS,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;gBACzB,aAAa,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;YAC/B,CAAC;YACD,OAAO;QACT,CAAC;QAED,MAAM,QAAQ,GAAG,IAAI,CAAC,oBAAoB,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;QAC1D,IAAI,QAAQ,IAAI,IAAI,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,SAAS,CAAC,EAAE,CAAC;YACtD,SAAS,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;YACzB,aAAa,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;QAC/B,CAAC;IACH,CAAC;CACF;AAED,SAAS,OAAO,CAAC,KAAa;IAC5B,OAAO,MAAM,CAAC,KAAK,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;AACxC,CAAC"}

package/clinkx-workflows/dist/backend.d.ts

@@ -21,13 +21,17 @@ export interface ClinkBackend {
     readonly isTerminated: boolean;
     /** Whether the backend's child process died unexpectedly (only relevant for child-process backends). */
     readonly hasChildDied: boolean;
+    /** True only for an in-process backend that can carry trusted call metadata. */
+    readonly supportsSessionLogOwner?: boolean | undefined;
     /** Initialize the backend (connect to child, etc). No-op for in-process backends. */
     connect(): Promise<void>;
     /** Call the clink tool. */
     callTool(args: Record<string, unknown>, options?: {
         signal?: AbortSignal;
         timeoutMs?: number;
+        sessionLogOwner?: SessionLogOwnerV1;
     }): Promise<ToolCallResult>;
     /** Shut down the backend. */
     terminate(): Promise<void>;
 }
+import type { SessionLogOwnerV1 } from "./dashboard/session-log-contract.js";