create-principles-disciple 1.134.9 → 1.135.1

package/plugin/dist/templates/langs/en/skills/pd-mentor/SKILL.md

@@ -28,7 +28,6 @@ I'm your intelligent mentor, helping you understand and use all features of Prin
 | `/pd-init` | Initialize strategy | New project startup |
 | `/pd-bootstrap` | Environment tool scan and upgrade | Tool upgrade |
 | `/pd-research` | Initiate tool upgrade research | Deep research |
-| `/pd-evolution-status` | View trust score and security stage | Permission check |
 | `/pd-status` | View system status (GFI and Pain Dictionary) | Health check |
 | `/pd-help` | Get interactive command guidance | This skill |
 
@@ -55,7 +54,6 @@ I'm your intelligent mentor, helping you understand and use all features of Prin
 
 **Recommended Flow**:
 1. `/pd-status` - Check system status (GFI and Pain Dictionary)
-2. `/pd-evolution-status` - View EP tier and evolution status
 
 **Script**: "Problems are the fuel of evolution. Let me help you diagnose and fix systematically."
 
@@ -66,8 +64,7 @@ I'm your intelligent mentor, helping you understand and use all features of Prin
 **Trigger**: The user explicitly asks for a Principles Disciple progress or health review (mentioning PD, EP, GFI, or system status)
 
 **Recommended Flow**:
-1. `/pd-evolution-status` - View current trust score
-2. `/pd-status` - Check GFI and Pain Dictionary status
+1. `/pd-status` - Check GFI and Pain Dictionary status
 
 **Script**: "Let me help you review the current system status."
 
@@ -78,7 +75,7 @@ I'm your intelligent mentor, helping you understand and use all features of Prin
 **Trigger**: The user asks about Principles Disciple permissions, blocks, or security stages
 
 **Recommended Flow**:
-1. `/pd-evolution-status` - View trust score and security stage
+1. `/pd-status` - Check system status
 2. Explain current stage's capability boundaries
 
 **Script**: "Trust is earned, not given. Let me help you understand your current security level."

package/plugin/dist/templates/langs/zh/skills/pd-mentor/SKILL.md

@@ -28,7 +28,6 @@ disable-model-invocation: true
 | `/pd-init` | 初始化战略 | 新项目启动 |
 | `/pd-bootstrap` | 环境工具扫描与升级 | 装备升级 |
 | `/pd-research` | 发起工具升级研究 | 深度调研 |
-| `/pd-evolution-status` | 查看EP等级与安全状态 | 状态查询 |
 | `/pd-status` | 查看系统状态（GFI和痛苦词典） | 健康检查 |
 | `/pd-help` | 获取交互式命令引导 | 本技能 |
 
@@ -55,7 +54,6 @@ disable-model-invocation: true
 
 **推荐流程**:
 1. `/pd-status` - 检查系统状态（GFI 和痛苦词典）
-2. `/pd-evolution-status` - 查看 EP 等级和进化状态
 
 **话术**: "问题就是进化的燃料。让我帮你系统化地诊断和修复。"
 
@@ -66,8 +64,7 @@ disable-model-invocation: true
 **触发条件**: 用户明确要求 Principles Disciple 的进度或健康回顾（提及 PD、EP、GFI、系统状态）
 
 **推荐流程**:
-1. `/pd-evolution-status` - 查看当前信任积分
-2. `/pd-status` - 查看 GFI 和痛苦词典状态
+1. `/pd-status` - 查看 GFI 和痛苦词典状态
 
 **话术**: "让我帮你回顾一下系统状态。"
 
@@ -78,7 +75,7 @@ disable-model-invocation: true
 **触发条件**: 用户询问 Principles Disciple 的权限、拦截或安全等级
 
 **推荐流程**:
-1. `/pd-evolution-status` - 查看信任积分和安全等级
+1. `/pd-status` - 查看系统状态
 2. 解释当前等级的能力边界
 
 **话术**: "信任是挣来的，不是给的。让我帮你了解当前的安全等级。"

package/plugin/dist/utils/workspace-resolver.d.ts

@@ -59,7 +59,7 @@ export declare function resolveCommandWorkspaceDir(api: OpenClawPluginApi, ctx:
  * the wrong workspace.
  *
  * @param ctx - Plugin command context (has workspaceDir + config properties)
- * @param source - Source label for error messages (e.g. 'evolution-status', 'pain')
+ * @param source - Source label for error messages (e.g. 'pain', 'pd-status')
  * @param logger - Optional logger for divergence warnings (the plugin API logger)
  */
 export declare function resolvePluginCommandWorkspaceDir(ctx: PluginCommandContext, source: string, logger?: {

package/plugin/docs/COMMAND_REFERENCE.md

@@ -1,7 +1,7 @@
 # Principles Disciple Command Reference
 
 > 当前版本重点：EP (Evolution Points) 系统已接替 trust score 成为唯一门控机制。  
-> `rollback` 只回滚 `user_empathy` slice，`/pd-evolution-status` 读的是运行时 summary。
+> `rollback` 只回滚 `user_empathy` slice。
 
 ---
 
@@ -9,32 +9,12 @@
 
 | 命令 | 用途 | 当前口径 |
 |---|---|---|
-| `/pd-evolution-status` | 查看控制面与进化面的当前状态 | 读取 `RuntimeSummaryService` 的 canonical state |
 | `/pd-status empathy` | 查看情绪/共情事件统计 | 用于观察 `user_empathy` 与 `system_infer` 事件是否稳定落日志 |
 | `/pd-rollback last` | 回滚最近一次情绪惩罚 | 只回滚 `user_empathy` 对应的 GFI slice |
 | `/pd-help` | 显示帮助 | |
 
 ---
 
-## `/pd-evolution-status`
-
-### 它现在显示什么
-
-- `EP Tier`: 当前 EP 等级 (Seed → Sprout → Sapling → Tree → Forest)
-- `Session GFI`: 当前会话 GFI 与峰值
-- `GFI Sources`: 当前 summary 能解释出来的 friction 来源
-- `Pain Flag`: pain flag 是否激活
-- `Gate Events`: 最近的 block / bypass
-- `Queue / Directive`: evolution queue 与 directive 的当前状态
-
-### 重要说明
-
-- 这是当前控制面的权威读模型入口。
-- 它优先读取 canonical `.state`，并尽量合并 live session / buffered events。
-- 如果数据不完整，会显示 `partial` 或 warning，而不是静默显示 `0`。
-
----
-
 ## `/pd-rollback`
 
 ### 当前行为

package/plugin/docs/COMMAND_REFERENCE_EN.md

@@ -8,31 +8,11 @@
 
 | Command | Purpose |
 |---|---|
-| `/pd-evolution-status` | View EP tier, GFI, pain flag, and gate events |
 | `/pd-status empathy` | Inspect empathy/frustration event statistics |
 | `/pd-rollback last` | Roll back the latest empathy penalty |
 
 ---
 
-## `/pd-evolution-status`
-
-### What it shows
-
-- `EP Tier`: Current evolution tier (Seed → Sprout → Sapling → Tree → Forest)
-- `Session GFI`: Current session GFI and peak
-- `GFI Sources`: Currently attributable friction sources
-- `Pain Flag`: Whether a pain flag is active
-- `Gate Events`: Recent block / bypass counts
-- `Queue / Directive`: Evolution queue and directive state
-
-### Important notes
-
-- This is the main operator entry point into the control plane.
-- It reads canonical `.state` and tries to merge live session state and buffered events when available.
-- When data is incomplete, it surfaces `partial` or warnings instead of silently printing `0`.
-
----
-
 ## `/pd-rollback`
 
 ### Current behavior

package/plugin/openclaw.plugin.json

@@ -2,7 +2,7 @@
   "id": "principles-disciple",
   "name": "Principles Disciple",
   "description": "Principles Disciple is an AI Agent Governance System. Stop correcting the same AI behavior across sessions. Turn repeated Agent corrections into Owner-approved, observable, reversible behavior principles.",
-  "version": "1.233.1",
+  "version": "1.234.0",
   "activation": {
     "onStartup": true,
     "onCapabilities": [

package/plugin/package.json

@@ -1,6 +1,6 @@
 {
   "name": "principles-disciple",
-  "version": "1.233.1",
+  "version": "1.234.0",
   "description": "Principles Disciple is an AI Agent Governance System. Stop correcting the same AI behavior across sessions. Turn repeated Agent corrections into Owner-approved, observable, reversible behavior principles.",
   "type": "module",
   "main": "./dist/index.js",

package/plugin/templates/langs/en/skills/pd-mentor/SKILL.md

@@ -28,7 +28,6 @@ I'm your intelligent mentor, helping you understand and use all features of Prin
 | `/pd-init` | Initialize strategy | New project startup |
 | `/pd-bootstrap` | Environment tool scan and upgrade | Tool upgrade |
 | `/pd-research` | Initiate tool upgrade research | Deep research |
-| `/pd-evolution-status` | View trust score and security stage | Permission check |
 | `/pd-status` | View system status (GFI and Pain Dictionary) | Health check |
 | `/pd-help` | Get interactive command guidance | This skill |
 
@@ -55,7 +54,6 @@ I'm your intelligent mentor, helping you understand and use all features of Prin
 
 **Recommended Flow**:
 1. `/pd-status` - Check system status (GFI and Pain Dictionary)
-2. `/pd-evolution-status` - View EP tier and evolution status
 
 **Script**: "Problems are the fuel of evolution. Let me help you diagnose and fix systematically."
 
@@ -66,8 +64,7 @@ I'm your intelligent mentor, helping you understand and use all features of Prin
 **Trigger**: The user explicitly asks for a Principles Disciple progress or health review (mentioning PD, EP, GFI, or system status)
 
 **Recommended Flow**:
-1. `/pd-evolution-status` - View current trust score
-2. `/pd-status` - Check GFI and Pain Dictionary status
+1. `/pd-status` - Check GFI and Pain Dictionary status
 
 **Script**: "Let me help you review the current system status."
 
@@ -78,7 +75,7 @@ I'm your intelligent mentor, helping you understand and use all features of Prin
 **Trigger**: The user asks about Principles Disciple permissions, blocks, or security stages
 
 **Recommended Flow**:
-1. `/pd-evolution-status` - View trust score and security stage
+1. `/pd-status` - Check system status
 2. Explain current stage's capability boundaries
 
 **Script**: "Trust is earned, not given. Let me help you understand your current security level."

package/plugin/templates/langs/zh/skills/pd-mentor/SKILL.md

@@ -28,7 +28,6 @@ disable-model-invocation: true
 | `/pd-init` | 初始化战略 | 新项目启动 |
 | `/pd-bootstrap` | 环境工具扫描与升级 | 装备升级 |
 | `/pd-research` | 发起工具升级研究 | 深度调研 |
-| `/pd-evolution-status` | 查看EP等级与安全状态 | 状态查询 |
 | `/pd-status` | 查看系统状态（GFI和痛苦词典） | 健康检查 |
 | `/pd-help` | 获取交互式命令引导 | 本技能 |
 
@@ -55,7 +54,6 @@ disable-model-invocation: true
 
 **推荐流程**:
 1. `/pd-status` - 检查系统状态（GFI 和痛苦词典）
-2. `/pd-evolution-status` - 查看 EP 等级和进化状态
 
 **话术**: "问题就是进化的燃料。让我帮你系统化地诊断和修复。"
 
@@ -66,8 +64,7 @@ disable-model-invocation: true
 **触发条件**: 用户明确要求 Principles Disciple 的进度或健康回顾（提及 PD、EP、GFI、系统状态）
 
 **推荐流程**:
-1. `/pd-evolution-status` - 查看当前信任积分
-2. `/pd-status` - 查看 GFI 和痛苦词典状态
+1. `/pd-status` - 查看 GFI 和痛苦词典状态
 
 **话术**: "让我帮你回顾一下系统状态。"
 
@@ -78,7 +75,7 @@ disable-model-invocation: true
 **触发条件**: 用户询问 Principles Disciple 的权限、拦截或安全等级
 
 **推荐流程**:
-1. `/pd-evolution-status` - 查看信任积分和安全等级
+1. `/pd-status` - 查看系统状态
 2. 解释当前等级的能力边界
 
 **话术**: "信任是挣来的，不是给的。让我帮你了解当前的安全等级。"

package/release-manager/dist/update/release-manager-authority.d.ts

@@ -27,26 +27,29 @@
  * decision that must stay explicit (see the analysis doc §4.3); it can never
  * be relaxed for apply/apply-full/rollback.
  *
- * apply/apply-full/rollback stay structurally not-ready until the Phase 4
- * activation rollout opens the `shadow_mode_read_only` gate (its own go/no-go);
- * until then these kinds explicitly fall back to the legacy console updater —
- * TEMPORARY migration debt per ADR-0024 D-1, not a supported long-term state.
+ * `apply` and `rollback` stay structurally not-ready until their own work
+ * lands; until then these kinds explicitly fall back to the legacy console
+ * updater — TEMPORARY migration debt per ADR-0024 D-1, not a supported
+ * long-term state. The two gaps are independent (PRI-729 audit §4):
+ * `rollback` waits on the Phase 2 same-version restore (`ROLLBACK_AVAILABLE`),
+ * while `apply` is the plugin-diff mechanism, which the ReleaseManager does not
+ * implement at all — no signed whole-payload release can express it.
  *
  * PRI-698 Phase 1: `apply-full` (full-runtime update) is served by the real
  * ReleaseManager.apply() orchestration (installer + journal) and reports the
  * same base readiness as `check`. The CONSOLE additionally gates the routing
- * behind the `release_manager_write_authority` flag (default off) — flag-off
- * dispatches fall back explicitly with `release_manager_write_disabled`.
- * `apply` (the plugin-diff mechanism, which the ReleaseManager does not
- * implement) and `rollback` (Phase 2 — must prove same-version restore first)
- * stay structurally not-ready with explicit reasons.
+ * behind the `release_manager_write_authority` flag (default ON since the
+ * 2026-09-07 graduation) — flag-off dispatches fall back explicitly with
+ * `release_manager_write_disabled`.
  */
 import { ReleaseManager, type InstallStatus, type LegacyUpdaterDecision } from './release-manager.js';
 import { type ReleaseMetadataSource } from './release-metadata-source.js';
 /** Mutation kinds the console MutationController routes (PRI-659 contract). */
 export declare const RELEASE_MANAGER_AUTHORITY_KINDS: readonly ['check', 'apply', 'apply-full', 'rollback'];
 export type ReleaseManagerAuthorityKind = (typeof RELEASE_MANAGER_AUTHORITY_KINDS)[number];
-export type ReleaseManagerAuthorityReason = 'metadata_source_unconfigured' | 'bootstrap_not_installed' | 'install_state_corrupt' | 'journal_not_supported' | 'rollback_not_available';
+/** Why a capability is structurally absent from the ReleaseManager (not a mere precondition). */
+export type ReleaseManagerStructuralGap = 'rollback_not_available' | 'plugin_diff_not_supported';
+export type ReleaseManagerAuthorityReason = 'metadata_source_unconfigured' | 'bootstrap_not_installed' | 'install_state_corrupt' | 'journal_not_supported' | ReleaseManagerStructuralGap;
 export interface ReleaseManagerAuthorityReadiness {
     readonly ready: boolean;
     readonly reasons: readonly ReleaseManagerAuthorityReason[];

package/release-manager/dist/update/release-manager-authority.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"release-manager-authority.d.ts","sourceRoot":"","sources":["../../src/update/release-manager-authority.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA0CG;AAGH,OAAO,EACL,cAAc,EAEd,KAAK,aAAa,EAClB,KAAK,qBAAqB,EAC3B,MAAM,sBAAsB,CAAC;AAE9B,OAAO,EAAgC,KAAK,qBAAqB,EAAE,MAAM,8BAA8B,CAAC;AAExG,+EAA+E;AAC/E,eAAO,MAAM,+BAA+B,YAAI,OAAO,EAAE,OAAO,EAAE,YAAY,EAAE,UAAU,CAAU,CAAC;AACrG,MAAM,MAAM,2BAA2B,GAAG,CAAC,OAAO,+BAA+B,CAAC,CAAC,MAAM,CAAC,CAAC;AAE3F,MAAM,MAAM,6BAA6B,GACrC,8BAA8B,GAC9B,yBAAyB,GACzB,uBAAuB,GACvB,uBAAuB,GACvB,wBAAwB,CAAC;AAE7B,MAAM,WAAW,gCAAgC;IAC/C,QAAQ,CAAC,KAAK,EAAE,OAAO,CAAC;IACxB,QAAQ,CAAC,OAAO,EAAE,SAAS,6BAA6B,EAAE,CAAC;CAC5D;AAUD,MAAM,WAAW,8BAA8B;IAC7C,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,qFAAqF;IACrF,QAAQ,CAAC,eAAe,EAAE,MAAM,GAAG,SAAS,CAAC;IAC7C,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,CAAC;IAC/B,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,IAAI,CAAC;IAC1B,mFAAmF;IACnF,QAAQ,CAAC,WAAW,CAAC,EAAE,CAAC,cAAc,EAAE,MAAM,KAAK,OAAO,CAAC,qBAAqB,GAAG,IAAI,CAAC,CAAC;CAC1F;AAED,MAAM,WAAW,uBAAuB;IACtC,QAAQ,CAAC,OAAO,EAAE,cAAc,CAAC;IACjC,mFAAmF;IACnF,QAAQ,CAAC,aAAa,EAAE,aAAa,GAAG,IAAI,CAAC;IAC7C,QAAQ,CAAC,KAAK,EAAE,QAAQ,CAAC,MAAM,CAAC,2BAA2B,EAAE,gCAAgC,CAAC,CAAC,CAAC;IAChG;;;;;OAKG;IACH,QAAQ,CAAC,cAAc,EAAE,qBAAqB,CAAC;CAChD;AAkBD,wBAAgB,6BAA6B,CAC3C,OAAO,EAAE,8BAA8B,GACtC,uBAAuB,CA8EzB;AAED;;;;;;;;GAQG;AACH,wBAAgB,gCAAgC,CAAC,KAAK,EAAE,OAAO,GAAG;IAChE,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,EAAE,MAAM,CAAC;IAChB,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,iBAAiB,EAAE,OAAO,CAAC;CAC5B,CAeA"}
+{"version":3,"file":"release-manager-authority.d.ts","sourceRoot":"","sources":["../../src/update/release-manager-authority.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2CG;AAGH,OAAO,EACL,cAAc,EAEd,KAAK,aAAa,EAClB,KAAK,qBAAqB,EAC3B,MAAM,sBAAsB,CAAC;AAE9B,OAAO,EAAgC,KAAK,qBAAqB,EAAE,MAAM,8BAA8B,CAAC;AAExG,+EAA+E;AAC/E,eAAO,MAAM,+BAA+B,YAAI,OAAO,EAAE,OAAO,EAAE,YAAY,EAAE,UAAU,CAAU,CAAC;AACrG,MAAM,MAAM,2BAA2B,GAAG,CAAC,OAAO,+BAA+B,CAAC,CAAC,MAAM,CAAC,CAAC;AAE3F,iGAAiG;AACjG,MAAM,MAAM,2BAA2B,GAAG,wBAAwB,GAAG,2BAA2B,CAAC;AAEjG,MAAM,MAAM,6BAA6B,GACrC,8BAA8B,GAC9B,yBAAyB,GACzB,uBAAuB,GACvB,uBAAuB,GACvB,2BAA2B,CAAC;AAEhC,MAAM,WAAW,gCAAgC;IAC/C,QAAQ,CAAC,KAAK,EAAE,OAAO,CAAC;IACxB,QAAQ,CAAC,OAAO,EAAE,SAAS,6BAA6B,EAAE,CAAC;CAC5D;AAeD,MAAM,WAAW,8BAA8B;IAC7C,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,qFAAqF;IACrF,QAAQ,CAAC,eAAe,EAAE,MAAM,GAAG,SAAS,CAAC;IAC7C,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,CAAC;IAC/B,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,IAAI,CAAC;IAC1B,mFAAmF;IACnF,QAAQ,CAAC,WAAW,CAAC,EAAE,CAAC,cAAc,EAAE,MAAM,KAAK,OAAO,CAAC,qBAAqB,GAAG,IAAI,CAAC,CAAC;CAC1F;AAED,MAAM,WAAW,uBAAuB;IACtC,QAAQ,CAAC,OAAO,EAAE,cAAc,CAAC;IACjC,mFAAmF;IACnF,QAAQ,CAAC,aAAa,EAAE,aAAa,GAAG,IAAI,CAAC;IAC7C,QAAQ,CAAC,KAAK,EAAE,QAAQ,CAAC,MAAM,CAAC,2BAA2B,EAAE,gCAAgC,CAAC,CAAC,CAAC;IAChG;;;;;OAKG;IACH,QAAQ,CAAC,cAAc,EAAE,qBAAqB,CAAC;CAChD;AAkBD,wBAAgB,6BAA6B,CAC3C,OAAO,EAAE,8BAA8B,GACtC,uBAAuB,CAkFzB;AAED;;;;;;;;GAQG;AACH,wBAAgB,gCAAgC,CAAC,KAAK,EAAE,OAAO,GAAG;IAChE,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,EAAE,MAAM,CAAC;IAChB,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,iBAAiB,EAAE,OAAO,CAAC;CAC5B,CAeA"}

package/release-manager/dist/update/release-manager-authority.js

@@ -27,19 +27,20 @@
  * decision that must stay explicit (see the analysis doc §4.3); it can never
  * be relaxed for apply/apply-full/rollback.
  *
- * apply/apply-full/rollback stay structurally not-ready until the Phase 4
- * activation rollout opens the `shadow_mode_read_only` gate (its own go/no-go);
- * until then these kinds explicitly fall back to the legacy console updater —
- * TEMPORARY migration debt per ADR-0024 D-1, not a supported long-term state.
+ * `apply` and `rollback` stay structurally not-ready until their own work
+ * lands; until then these kinds explicitly fall back to the legacy console
+ * updater — TEMPORARY migration debt per ADR-0024 D-1, not a supported
+ * long-term state. The two gaps are independent (PRI-729 audit §4):
+ * `rollback` waits on the Phase 2 same-version restore (`ROLLBACK_AVAILABLE`),
+ * while `apply` is the plugin-diff mechanism, which the ReleaseManager does not
+ * implement at all — no signed whole-payload release can express it.
  *
  * PRI-698 Phase 1: `apply-full` (full-runtime update) is served by the real
  * ReleaseManager.apply() orchestration (installer + journal) and reports the
  * same base readiness as `check`. The CONSOLE additionally gates the routing
- * behind the `release_manager_write_authority` flag (default off) — flag-off
- * dispatches fall back explicitly with `release_manager_write_disabled`.
- * `apply` (the plugin-diff mechanism, which the ReleaseManager does not
- * implement) and `rollback` (Phase 2 — must prove same-version restore first)
- * stay structurally not-ready with explicit reasons.
+ * behind the `release_manager_write_authority` flag (default ON since the
+ * 2026-09-07 graduation) — flag-off dispatches fall back explicitly with
+ * `release_manager_write_disabled`.
  */
 import * as fs from 'node:fs';
 import { ReleaseManager, ReleaseManagerError, } from './release-manager.js';
@@ -49,9 +50,14 @@ import { resolveReleaseMetadataSource } from './release-metadata-source.js';
 export const RELEASE_MANAGER_AUTHORITY_KINDS = ['check', 'apply', 'apply-full', 'rollback'];
 /**
  * Structural gate for the kinds whose write path does not exist yet:
- * `rollback` arrives with the Phase 2 restore migration; `apply` (plugin
- * diff) is not a ReleaseManager mechanism at all. `apply-full` left this
- * gate in PRI-698 Phase 1.
+ * `rollback` arrives with the Phase 2 restore migration. `apply-full` left
+ * this gate in PRI-698 Phase 1.
+ *
+ * `apply` (plugin diff) is NOT gated here: it is not a ReleaseManager
+ * mechanism at all (see the `apply` kind below), so its reason is a separate
+ * structural gap — a plugin-diff update needs a "current deployment → target
+ * deployment" comparison that signed whole-payload releases cannot express.
+ * Conflating the two made the fallback reason inaccurate (PRI-729 audit §4 B3).
  */
 const ROLLBACK_AVAILABLE = false;
 /**
@@ -131,11 +137,15 @@ export function createReleaseManagerAuthority(options) {
         },
         apply: {
             ready: false,
-            reasons: ROLLBACK_AVAILABLE ? baseReasons : [...baseReasons, 'rollback_not_available'],
+            // Structural, and independent of rollback: the plugin-diff mechanism is
+            // not a ReleaseManager mechanism, so this kind stays not-ready even once
+            // rollback lands (PRI-729 audit §4 B3).
+            reasons: [...baseReasons, 'plugin_diff_not_supported'],
         },
         // PRI-698 Phase 1: the full-runtime write path exists (ReleaseManager.apply
         // → installer → journal). Console routing is additionally flag-gated
-        // (`release_manager_write_authority`, default off).
+        // (`release_manager_write_authority`, registry default ON since the
+        // 2026-09-07 graduation — only an explicit `enabled: false` disables it).
         'apply-full': {
             ready: baseReady,
             reasons: baseReasons,

package/release-manager/dist/update/release-manager-authority.js.map

@@ -1 +1 @@
-{"version":3,"file":"release-manager-authority.js","sourceRoot":"","sources":["../../src/update/release-manager-authority.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA0CG;AAEH,OAAO,KAAK,EAAE,MAAM,SAAS,CAAC;AAC9B,OAAO,EACL,cAAc,EACd,mBAAmB,GAGpB,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EAAE,kBAAkB,EAAE,iBAAiB,EAAE,kBAAkB,EAAsB,MAAM,qBAAqB,CAAC;AACpH,OAAO,EAAE,4BAA4B,EAA8B,MAAM,8BAA8B,CAAC;AAExG,+EAA+E;AAC/E,MAAM,CAAC,MAAM,+BAA+B,GAAG,CAAC,OAAO,EAAE,OAAO,EAAE,YAAY,EAAE,UAAU,CAAU,CAAC;AAerG;;;;;GAKG;AACH,MAAM,kBAAkB,GAAG,KAAK,CAAC;AA0BjC;;;;;GAKG;AACH,SAAS,0BAA0B,CAAC,MAAc;IAChD,MAAM,EAAE,eAAe,EAAE,GAAG,kBAAkB,CAAC,MAAM,CAAC,CAAC;IACvD,IAAI,CAAC;QACH,EAAE,CAAC,UAAU,CAAC,eAAe,EAAE,EAAE,CAAC,SAAS,CAAC,IAAI,GAAG,EAAE,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;QACtE,OAAO,IAAI,CAAC;IACd,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED,MAAM,UAAU,6BAA6B,CAC3C,OAAuC;IAEvC,MAAM,OAAO,GAAG,IAAI,GAAG,EAAiC,CAAC;IAEzD,6EAA6E;IAC7E,4EAA4E;IAC5E,0EAA0E;IAC1E,0EAA0E;IAC1E,yEAAyE;IACzE,IAAI,aAAa,GAAyB,IAAI,CAAC;IAC/C,IAAI,CAAC;QACH,aAAa,GAAG,iBAAiB,CAAC,kBAAkB,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC;IACxE,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,KAAK,YAAY,kBAAkB,EAAE,CAAC;YACxC,OAAO,CAAC,GAAG,CAAC,uBAAuB,CAAC,CAAC;QACvC,CAAC;aAAM,CAAC;YACN,MAAM,KAAK,CAAC;QACd,CAAC;IACH,CAAC;IAED,MAAM,cAAc,GAAG,4BAA4B,CAAC;QAClD,QAAQ,EAAE,OAAO,CAAC,eAAe;QACjC,aAAa;KACd,CAAC,CAAC;IACH,IAAI,cAAc,CAAC,eAAe,KAAK,SAAS,EAAE,CAAC;QACjD,OAAO,CAAC,GAAG,CAAC,8BAA8B,CAAC,CAAC;IAC9C,CAAC;IAED,MAAM,OAAO,GAAG,IAAI,cAAc,CAAC;QACjC,MAAM,EAAE,OAAO,CAAC,MAAM;QACtB,eAAe,EAAE,cAAc,CAAC,eAAe,IAAI,EAAE;QACrD,GAAG,CAAC,OAAO,CAAC,YAAY,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,OAAO,CAAC,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACrF,GAAG,CAAC,OAAO,CAAC,GAAG,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC1D,GAAG,CAAC,OAAO,CAAC,WAAW,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,OAAO,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KACnF,CAAC,CAAC;IAEH,IAAI,aAAa,GAAyB,IAAI,CAAC;IAC/C,IAAI,CAAC;QACH,aAAa,GAAG,OAAO,CAAC,OAAO,EAAE,CAAC;IACpC,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,wEAAwE;QACxE,IAAI,KAAK,YAAY,kBAAkB,IAAI,KAAK,YAAY,mBAAmB,EAAE,CAAC;YAChF,OAAO,CAAC,GAAG,CAAC,uBAAuB,CAAC,CAAC;QACvC,CAAC;aAAM,CAAC;YACN,MAAM,KAAK,CAAC;QACd,CAAC;IACH,CAAC;IACD,IAAI,aAAa,KAAK,IAAI,IAAI,aAAa,CAAC,MAAM,KAAK,MAAM,EAAE,CAAC;QAC9D,OAAO,CAAC,GAAG,CAAC,yBAAyB,CAAC,CAAC;IACzC,CAAC;IACD,IAAI,CAAC,0BAA0B,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;QAChD,OAAO,CAAC,GAAG,CAAC,uBAAuB,CAAC,CAAC;IACvC,CAAC;IAED,MAAM,SAAS,GAAG,OAAO,CAAC,IAAI,KAAK,CAAC,CAAC;IACrC,MAAM,WAAW,GAAG,CAAC,GAAG,OAAO,CAAU,CAAC;IAC1C,MAAM,KAAK,GAAG;QACZ,KAAK,EAAE;YACL,KAAK,EAAE,SAAS;YAChB,OAAO,EAAE,WAAW;SACrB;QACD,KAAK,EAAE;YACL,KAAK,EAAE,KAAK;YACZ,OAAO,EAAE,kBAAkB,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAE,CAAC,GAAG,WAAW,EAAE,wBAAwB,CAAW;SAClG;QACD,4EAA4E;QAC5E,qEAAqE;QACrE,oDAAoD;QACpD,YAAY,EAAE;YACZ,KAAK,EAAE,SAAS;YAChB,OAAO,EAAE,WAAW;SACrB;QACD,QAAQ,EAAE;YACR,KAAK,EAAE,KAAK;YACZ,OAAO,EAAE,kBAAkB,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAE,CAAC,GAAG,WAAW,EAAE,wBAAwB,CAAW;SAClG;KACwF,CAAC;IAE5F,OAAO,EAAE,OAAO,EAAE,aAAa,EAAE,KAAK,EAAE,cAAc,EAAE,CAAC;AAC3D,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,gCAAgC,CAAC,KAAc;IAM7D,IAAI,KAAK,YAAY,mBAAmB,EAAE,CAAC;QACzC,OAAO;YACL,MAAM,EAAE,KAAK,CAAC,MAAM;YACpB,OAAO,EAAE,KAAK,CAAC,OAAO;YACtB,UAAU,EAAE,KAAK,CAAC,UAAU;YAC5B,iBAAiB,EAAE,KAAK,CAAC,iBAAiB;SAC3C,CAAC;IACJ,CAAC;IACD,OAAO;QACL,MAAM,EAAE,8BAA8B;QACtC,OAAO,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC;QAC/D,UAAU,EAAE,IAAI;QAChB,iBAAiB,EAAE,KAAK;KACzB,CAAC;AACJ,CAAC"}
+{"version":3,"file":"release-manager-authority.js","sourceRoot":"","sources":["../../src/update/release-manager-authority.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2CG;AAEH,OAAO,KAAK,EAAE,MAAM,SAAS,CAAC;AAC9B,OAAO,EACL,cAAc,EACd,mBAAmB,GAGpB,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EAAE,kBAAkB,EAAE,iBAAiB,EAAE,kBAAkB,EAAsB,MAAM,qBAAqB,CAAC;AACpH,OAAO,EAAE,4BAA4B,EAA8B,MAAM,8BAA8B,CAAC;AAExG,+EAA+E;AAC/E,MAAM,CAAC,MAAM,+BAA+B,GAAG,CAAC,OAAO,EAAE,OAAO,EAAE,YAAY,EAAE,UAAU,CAAU,CAAC;AAkBrG;;;;;;;;;;GAUG;AACH,MAAM,kBAAkB,GAAG,KAAK,CAAC;AA0BjC;;;;;GAKG;AACH,SAAS,0BAA0B,CAAC,MAAc;IAChD,MAAM,EAAE,eAAe,EAAE,GAAG,kBAAkB,CAAC,MAAM,CAAC,CAAC;IACvD,IAAI,CAAC;QACH,EAAE,CAAC,UAAU,CAAC,eAAe,EAAE,EAAE,CAAC,SAAS,CAAC,IAAI,GAAG,EAAE,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;QACtE,OAAO,IAAI,CAAC;IACd,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED,MAAM,UAAU,6BAA6B,CAC3C,OAAuC;IAEvC,MAAM,OAAO,GAAG,IAAI,GAAG,EAAiC,CAAC;IAEzD,6EAA6E;IAC7E,4EAA4E;IAC5E,0EAA0E;IAC1E,0EAA0E;IAC1E,yEAAyE;IACzE,IAAI,aAAa,GAAyB,IAAI,CAAC;IAC/C,IAAI,CAAC;QACH,aAAa,GAAG,iBAAiB,CAAC,kBAAkB,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC;IACxE,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,KAAK,YAAY,kBAAkB,EAAE,CAAC;YACxC,OAAO,CAAC,GAAG,CAAC,uBAAuB,CAAC,CAAC;QACvC,CAAC;aAAM,CAAC;YACN,MAAM,KAAK,CAAC;QACd,CAAC;IACH,CAAC;IAED,MAAM,cAAc,GAAG,4BAA4B,CAAC;QAClD,QAAQ,EAAE,OAAO,CAAC,eAAe;QACjC,aAAa;KACd,CAAC,CAAC;IACH,IAAI,cAAc,CAAC,eAAe,KAAK,SAAS,EAAE,CAAC;QACjD,OAAO,CAAC,GAAG,CAAC,8BAA8B,CAAC,CAAC;IAC9C,CAAC;IAED,MAAM,OAAO,GAAG,IAAI,cAAc,CAAC;QACjC,MAAM,EAAE,OAAO,CAAC,MAAM;QACtB,eAAe,EAAE,cAAc,CAAC,eAAe,IAAI,EAAE;QACrD,GAAG,CAAC,OAAO,CAAC,YAAY,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,OAAO,CAAC,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACrF,GAAG,CAAC,OAAO,CAAC,GAAG,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC1D,GAAG,CAAC,OAAO,CAAC,WAAW,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,OAAO,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KACnF,CAAC,CAAC;IAEH,IAAI,aAAa,GAAyB,IAAI,CAAC;IAC/C,IAAI,CAAC;QACH,aAAa,GAAG,OAAO,CAAC,OAAO,EAAE,CAAC;IACpC,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,wEAAwE;QACxE,IAAI,KAAK,YAAY,kBAAkB,IAAI,KAAK,YAAY,mBAAmB,EAAE,CAAC;YAChF,OAAO,CAAC,GAAG,CAAC,uBAAuB,CAAC,CAAC;QACvC,CAAC;aAAM,CAAC;YACN,MAAM,KAAK,CAAC;QACd,CAAC;IACH,CAAC;IACD,IAAI,aAAa,KAAK,IAAI,IAAI,aAAa,CAAC,MAAM,KAAK,MAAM,EAAE,CAAC;QAC9D,OAAO,CAAC,GAAG,CAAC,yBAAyB,CAAC,CAAC;IACzC,CAAC;IACD,IAAI,CAAC,0BAA0B,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;QAChD,OAAO,CAAC,GAAG,CAAC,uBAAuB,CAAC,CAAC;IACvC,CAAC;IAED,MAAM,SAAS,GAAG,OAAO,CAAC,IAAI,KAAK,CAAC,CAAC;IACrC,MAAM,WAAW,GAAG,CAAC,GAAG,OAAO,CAAU,CAAC;IAC1C,MAAM,KAAK,GAAG;QACZ,KAAK,EAAE;YACL,KAAK,EAAE,SAAS;YAChB,OAAO,EAAE,WAAW;SACrB;QACD,KAAK,EAAE;YACL,KAAK,EAAE,KAAK;YACZ,wEAAwE;YACxE,yEAAyE;YACzE,wCAAwC;YACxC,OAAO,EAAE,CAAC,GAAG,WAAW,EAAE,2BAA2B,CAAU;SAChE;QACD,4EAA4E;QAC5E,qEAAqE;QACrE,oEAAoE;QACpE,0EAA0E;QAC1E,YAAY,EAAE;YACZ,KAAK,EAAE,SAAS;YAChB,OAAO,EAAE,WAAW;SACrB;QACD,QAAQ,EAAE;YACR,KAAK,EAAE,KAAK;YACZ,OAAO,EAAE,kBAAkB,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAE,CAAC,GAAG,WAAW,EAAE,wBAAwB,CAAW;SAClG;KACwF,CAAC;IAE5F,OAAO,EAAE,OAAO,EAAE,aAAa,EAAE,KAAK,EAAE,cAAc,EAAE,CAAC;AAC3D,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,gCAAgC,CAAC,KAAc;IAM7D,IAAI,KAAK,YAAY,mBAAmB,EAAE,CAAC;QACzC,OAAO;YACL,MAAM,EAAE,KAAK,CAAC,MAAM;YACpB,OAAO,EAAE,KAAK,CAAC,OAAO;YACtB,UAAU,EAAE,KAAK,CAAC,UAAU;YAC5B,iBAAiB,EAAE,KAAK,CAAC,iBAAiB;SAC3C,CAAC;IACJ,CAAC;IACD,OAAO;QACL,MAAM,EAAE,8BAA8B;QACtC,OAAO,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC;QAC/D,UAAU,EAAE,IAAI;QAChB,iBAAiB,EAAE,KAAK;KACzB,CAAC;AACJ,CAAC"}

package/release-manager/dist/update/release-metadata-publisher.d.ts

@@ -0,0 +1,142 @@
+/**
+ * Release metadata publisher (PRI-727) — the production supply side of the
+ * read contracts in release-metadata-source.ts / trust-metadata.ts.
+ *
+ * For one release this module emits EXACTLY the byte set ReleaseManager
+ * already consumes (see apply-payload.ts and release-manager.ts):
+ *
+ *   root.json / timestamp.json / snapshot.json / targets.json       TUF chain
+ *   targets/channels/<channel>.json                                 signed channel pointer payload
+ *   targets/releases/<releaseId>/metadata.json                      release metadata payload
+ *   targets/releases/<releaseId>/release-asset-<platform>-<arch>.tar.gz
+ *
+ * No second release identity: releaseId and the canonical digests come from
+ * deriveReleaseId/buildReleaseMetadata, and both produced documents are
+ * re-validated with the SAME strict parsers the ReleaseManager uses, so a
+ * publisher-side defect fails here instead of at an install. Publication is
+ * byte-deterministic: the same identity inputs, the same signing key and the
+ * same previous-state TUF versions re-emit identical files (idempotent
+ * re-publish of one release is a no-op, not a mutation).
+ *
+ * Advance discipline: the channel pointer is only produced together with the
+ * artifact target whose sha256 is bound into the release metadata — there is
+ * no API shape that advances the pointer without the verifiable artifact
+ * existing in the same file set. Monotonicity against the currently
+ * published channel pointer (`previous`) is enforced here, fail-loud, before
+ * any bytes are emitted.
+ *
+ * Trust material: one ed25519 key signs all four TUF roles — the same
+ * single-key shape the ReleaseManager test suite verifies against. The
+ * install side pins root.json at install time, so this module never rotates
+ * the root (root version stays 1; rotation is separate governance work).
+ */
+import { type ChannelMetadata } from './channel-metadata.js';
+import { type ReleaseMetadata } from './release-metadata.js';
+import { type ReleaseChannelName } from './product-identity.js';
+export declare const RELEASE_PUBLICATION_TUF_SPEC_VERSION = "1.0.31";
+export type ReleasePublicationErrorCode = 'invalid_input' | 'expires_not_future' | 'publication_not_monotonic' | 'publication_conflict' | 'signing_key_invalid';
+export declare class ReleasePublicationError extends Error {
+    readonly code: ReleasePublicationErrorCode;
+    readonly field: string;
+    readonly nextAction: string;
+    constructor(code: ReleasePublicationErrorCode, field: string, message: string, nextAction: string);
+}
+/**
+ * The release-asset archive that will be published as the artifact target.
+ * `bytes` are the EXACT bytes served at the target path — the sha256 bound
+ * into the release metadata is computed over them.
+ */
+export interface PublicationArchive {
+    readonly platform: string;
+    readonly arch: string;
+    readonly nodeAbi: string;
+    readonly bytes: Buffer;
+}
+/** Previously published state of the metadata repository, when one exists. */
+export interface PreviousPublication {
+    /** The currently published `targets/channels/<channel>.json` payload. */
+    readonly channelPayload: unknown;
+    /** TUF metadata versions of the currently published repository. Absent roles start at 1. */
+    readonly tufVersions?: {
+        readonly root?: number;
+        readonly timestamp?: number;
+        readonly snapshot?: number;
+        readonly targets?: number;
+    };
+}
+export interface ReleasePublicationInput {
+    readonly productVersion: string;
+    readonly sourceCommit: string;
+    readonly channel: ReleaseChannelName;
+    /** Monotonic channel pointer version — must strictly increase per advance. */
+    readonly channelVersion: number;
+    /** Monotonic publication sequence — must strictly increase per advance. */
+    readonly publicationSequence: number;
+    /** RFC3339 UTC (`...Z`) expiry for the channel, release metadata and TUF roles. */
+    readonly expiresAt: string;
+    readonly minBootstrapVersion: string;
+    readonly dataSchemaForwardReadableFrom: string;
+    readonly archive: PublicationArchive;
+    /** PEM-encoded ed25519 PRIVATE key signing the whole repository. */
+    readonly signingKeyPem: string;
+    readonly previous?: PreviousPublication | null;
+}
+export interface PublicationFile {
+    /** Repository-relative path as served at the metadata base URL. */
+    readonly path: string;
+    readonly bytes: Buffer;
+}
+export interface ReleasePublicationManifest {
+    readonly releaseId: string;
+    readonly productVersion: string;
+    readonly channel: ReleaseChannelName;
+    readonly platform: string;
+    readonly arch: string;
+    readonly nodeAbi: string;
+    readonly sourceCommit: string;
+    readonly artifactSha256: string;
+    readonly artifactSizeBytes: number;
+    readonly artifactTargetPath: string;
+    readonly keyId: string;
+    readonly signingScheme: 'ed25519';
+    readonly publicationSequence: number;
+    readonly channelVersion: number;
+    readonly expiresAt: string;
+    readonly files: readonly {
+        readonly path: string;
+        readonly sha256: string;
+        readonly sizeBytes: number;
+    }[];
+}
+export interface ReleasePublication {
+    readonly manifest: ReleasePublicationManifest;
+    readonly releaseMetadata: ReleaseMetadata;
+    readonly channelPayload: ChannelMetadata;
+    /** The complete served-repository content, ready to publish as-is. */
+    readonly files: readonly PublicationFile[];
+}
+/**
+ * Gzip wrapper for a built release archive. Node's zlib emits a deterministic
+ * gzip header (no embedded mtime or file name), so the same archive bytes
+ * always produce the same published artifact bytes — the CLI `gzip` would not
+ * (it stores name + mtime in the header).
+ */
+export declare function gzipReleaseArchive(archiveBytes: Buffer): Buffer;
+/**
+ * Parses a `sha256sum`-style digest file (`<hex>` or `<hex>  <name>`) into
+ * the lowercase hex digest, failing loud on anything else.
+ */
+export declare function parseSha256DigestFile(content: string): string;
+/**
+ * True when the input is a syntactically valid RFC3339 UTC timestamp
+ * (`...Z`). Exported for CLI argument validation before any IO happens.
+ */
+export declare function isRfc3339UtcTimestamp(value: unknown): value is string;
+/**
+ * Builds the complete signed release publication. Pure: no filesystem or
+ * network IO — callers (the publish script / CI) own byte transport.
+ */
+export declare function buildReleasePublication(input: ReleasePublicationInput): ReleasePublication;
+/** Ephemeral ed25519 key PEM for dry-run pipelines without configured trust material. */
+export declare function generateEphemeralSigningKeyPem(): string;
+//# sourceMappingURL=release-metadata-publisher.d.ts.map

package/release-manager/dist/update/release-metadata-publisher.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"release-metadata-publisher.d.ts","sourceRoot":"","sources":["../../src/update/release-metadata-publisher.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+BG;AAeH,OAAO,EAAwB,KAAK,eAAe,EAAE,MAAM,uBAAuB,CAAC;AACnF,OAAO,EAEL,KAAK,eAAe,EACrB,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EAEL,KAAK,kBAAkB,EACxB,MAAM,uBAAuB,CAAC;AAG/B,eAAO,MAAM,oCAAoC,WAAW,CAAC;AAE7D,MAAM,MAAM,2BAA2B,GACnC,eAAe,GACf,oBAAoB,GACpB,2BAA2B,GAC3B,sBAAsB,GACtB,qBAAqB,CAAC;AAE1B,qBAAa,uBAAwB,SAAQ,KAAK;IAChD,QAAQ,CAAC,IAAI,EAAE,2BAA2B,CAAC;IAC3C,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAG5B,YAAY,IAAI,EAAE,2BAA2B,EAAE,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,EAMhG;CACF;AAQD;;;;GAIG;AACH,MAAM,WAAW,kBAAkB;IACjC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;CACxB;AAED,8EAA8E;AAC9E,MAAM,WAAW,mBAAmB;IAClC,yEAAyE;IACzE,QAAQ,CAAC,cAAc,EAAE,OAAO,CAAC;IACjC,4FAA4F;IAC5F,QAAQ,CAAC,WAAW,CAAC,EAAE;QACrB,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC;QACvB,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;QAC5B,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;QAC3B,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC;KAC3B,CAAC;CACH;AAED,MAAM,WAAW,uBAAuB;IACtC,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAC;IAChC,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,OAAO,EAAE,kBAAkB,CAAC;IACrC,8EAA8E;IAC9E,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAC;IAChC,2EAA2E;IAC3E,QAAQ,CAAC,mBAAmB,EAAE,MAAM,CAAC;IACrC,mFAAmF;IACnF,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,mBAAmB,EAAE,MAAM,CAAC;IACrC,QAAQ,CAAC,6BAA6B,EAAE,MAAM,CAAC;IAC/C,QAAQ,CAAC,OAAO,EAAE,kBAAkB,CAAC;IACrC,oEAAoE;IACpE,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;IAC/B,QAAQ,CAAC,QAAQ,CAAC,EAAE,mBAAmB,GAAG,IAAI,CAAC;CAChD;AAED,MAAM,WAAW,eAAe;IAC9B,mEAAmE;IACnE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;CACxB;AAED,MAAM,WAAW,0BAA0B;IACzC,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAC;IAChC,QAAQ,CAAC,OAAO,EAAE,kBAAkB,CAAC;IACrC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAC;IAChC,QAAQ,CAAC,iBAAiB,EAAE,MAAM,CAAC;IACnC,QAAQ,CAAC,kBAAkB,EAAE,MAAM,CAAC;IACpC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,aAAa,EAAE,SAAS,CAAC;IAClC,QAAQ,CAAC,mBAAmB,EAAE,MAAM,CAAC;IACrC,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAC;IAChC,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,KAAK,EAAE,SAAS;QAAE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAA;KAAE,EAAE,CAAC;CAC3G;AAED,MAAM,WAAW,kBAAkB;IACjC,QAAQ,CAAC,QAAQ,EAAE,0BAA0B,CAAC;IAC9C,QAAQ,CAAC,eAAe,EAAE,eAAe,CAAC;IAC1C,QAAQ,CAAC,cAAc,EAAE,eAAe,CAAC;IACzC,sEAAsE;IACtE,QAAQ,CAAC,KAAK,EAAE,SAAS,eAAe,EAAE,CAAC;CAC5C;AAgGD;;;;;GAKG;AACH,wBAAgB,kBAAkB,CAAC,YAAY,EAAE,MAAM,GAAG,MAAM,CAE/D;AAED;;;GAGG;AACH,wBAAgB,qBAAqB,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,CAW7D;AAED;;;GAGG;AACH,wBAAgB,qBAAqB,CAAC,KAAK,EAAE,OAAO,GAAG,KAAK,IAAI,MAAM,CAErE;AAiGD;;;GAGG;AACH,wBAAgB,uBAAuB,CAAC,KAAK,EAAE,uBAAuB,GAAG,kBAAkB,CAsJ1F;AAED,yFAAyF;AACzF,wBAAgB,8BAA8B,IAAI,MAAM,CAKvD"}