ctxr-cli 0.2.2 → 0.3.0

package/templates/skills/ctxr-placement.md

@@ -0,0 +1,65 @@
+Decide where a note lives BEFORE writing it, and say why: the caller wants the reasoning (which layer, why
+this location over its sibling, which visibility, what would promote it) so they can push back — not a
+folder name. Answer the questions in order; stop early only when the content clearly resolves.
+
+__LAYER_STEP__
+
+## 2. Which location within the layer?
+
+- Match on what the content IS. When two sibling locations both seem to fit, name the distinction between
+  them (abstract vs concrete; outward-facing vs inward-facing; who-we-are vs how-it-runs) and pick by
+  altitude and audience, not by keyword.
+- Read one or two sibling notes in the chosen location and match their shape — frontmatter keys, heading
+  style, bullets vs prose — before writing.
+
+## 3. Sub-item under an existing location, or a new top-level one?
+
+Default to a sub-item until it earns promotion. A near-empty top-level location is its own kind of
+clutter — worse than a slightly crowded existing one. Starting small and promoting later is cheap;
+starting big and hollow is not. Make the promotion trigger a rule, not a vibe, and write it INTO the
+note: "Promote to its own top-level location the moment this holds 3+ distinct notes or topics."
+
+## 4. Which visibility?
+
+Visibility is a placement input, not an afterthought, because the location sets the visibility default
+(`ctxr note resolve <path>` shows the resolved value and where it came from):
+
+- Lean on the location's default; set the visibility field in frontmatter only when you must.
+- Content that bridges two contexts goes to the more restrictive one — this store fails closed to its
+  default context (AGENTS.md names it) whenever nothing more specific applies.
+- Visibility can override location: when the visibility the content requires differs from every location
+  that fits topically, the topical fit loses.
+- Credentials, full account numbers, and secrets never enter the store — last-4 only.
+
+## The collision test — "should A and B be one location?"
+
+Before merging two locations, compare their visibility defaults (the placement section shows them). If
+they differ, do NOT merge: a merged location has no safe default, every note in it needs a manual
+override, and the day one is forgotten the fail-closed protection is gone — a structural guard traded for
+human vigilance. If the two genuinely form one continuum with a fuzzy seam, place the boundary
+deliberately and give the overlap ONE bridge note with an explicit visibility value, not a merged drawer.
+A merge request often mis-detects that one side is itself mis-placed; the clean answer can be the
+opposite of merging — split the mis-placed piece out and re-home it. Say so when you see it.
+
+## Perishable vs durable
+
+One capture often mixes a durable fact with perishable specifics. The durable part (the reusable
+structure, mechanic, or trap) goes into the permanent note. The perishable part (this period's values,
+links, boilerplate) goes into a fenced `contexture:<region>` block you OVERWRITE on each refresh, never
+an accumulating pile of dead entries. Do not ingest a perishable item as source material — that
+manufactures an artifact for the graveyard; capture the durable slice by hand instead.
+
+## Wire it in
+
+Add a one-line wikilink from the relevant hub note so the new note is not an orphan; `ctxr lint` flags
+orphans and notes without a catalog entry.
+
+## Relocating an existing note
+
+`ctxr archive <path>` to retire it; a plain tracked `git mv` for an ordinary re-placement. Either way the
+frontmatter — including the visibility field — is left untouched.
+
+## Verify
+
+`ctxr note resolve <path>` for the visibility; `ctxr lint` for orphans and catalog gaps; `ctxr doctor` for
+anything that blocks a submit.

package/templates/skills/ctxr-rollup.md

@@ -0,0 +1,39 @@
+Regenerate the machine-synthesized current-state region of an entity note (a person, organization,
+product, initiative, or topic hub) from every note that references it. Hand-written content outside the
+fenced region is never touched.
+
+Run `ctxr rollup stale` (or `--for <entity>` for one) to find entities worth re-rolling — it lists every
+entity note whose backlinks have moved since its last synthesis, or which has never been rolled up at
+all; use it instead of guessing from memory which entities are out of date.
+
+1. Resolve, never create. `<entity>` is a path or a note name; several candidates → list them and ask.
+   When a location has more than one plausible hub, prefer the shorter-named, undated one. If no entity
+   note exists, STOP and say so — creating it is a separate task, not a side effect of a rollup.
+2. Refuse non-entities. Dated notes, journal entries, meeting notes, generated files, and store
+   infrastructure are INPUTS to rollups, not entities. If the name resolves to one of those, stop and ask
+   which entity was meant.
+3. Gather: `ctxr rollup gather <entity>` enumerates the candidate sources (notes linking to it). Fewer
+   than 3 accepted sources → push back ("only N notes reference this; a rollup would be thin — continue?")
+   and do not auto-continue.
+4. Read EVERY accepted source, not a sample — the value of a rollup is total recall over the entity's
+   corpus. Per source note its date (filename, frontmatter, then mtime as a last resort), its kind, and
+   what it says about THIS entity specifically. For a long source, grep for the entity first.
+5. Synthesize into a file, in this shape — bullets throughout, short clauses; skip any empty subsection
+   silently (never "N/A", "none", or "TBD"):
+
+   ```
+   ## Current state
+   ### Status            — one fact per line; what it is, what is happening now, headline problem or metric
+   ### Recent activity   — `YYYY-MM-DD — what happened [[Source]]`, most recent first
+   ### Open threads      — unresolved decisions, blockers, pending actions; each links where it was raised
+   ### Key people        — `[[Person]] — role in this entity's orbit`; only people present in the corpus
+   ### Sources           — every note consulted, sorted; the audit trail
+   ```
+
+   Provenance rules: every fact traceable to a source note — nothing from memory or earlier conversation;
+   no editorializing or recommendations; nothing dated later than today; inline `[[wikilinks]]` when one
+   claim has one clear source.
+6. Write: `ctxr rollup write <entity> --content-file <file>` — an idempotent fenced write (`changed: false`
+   and a byte-identical file when the content matches; mismatched markers abort with nothing written).
+7. Report: entity path, sources accepted, `changed` or unchanged, and notable findings (e.g. the oldest
+   unresolved thread). Anything outside the fence you want to fix is a separate, explicit edit.

package/templates/skills/ctxr-session-capture.md

@@ -0,0 +1,65 @@
+End-of-session capture: propose what the session produced that is durable, write only what is approved.
+The approval gate is what keeps the blast radius low — nothing is written without it.
+
+## When
+
+Fires on the user's own closing utterance ("done", "ship it", "that's all", a sign-off) or an explicit
+request. A request to open a pull request is also a wrap signal — finish the pull request first, then
+propose (after the LAST one of a batch, not once per request).
+
+Anti-triggers — stay silent when: an error, failed test, pending question, or requested follow-up is
+outstanding (the session is not over); the recent turns are dominated by tuning the store or this skill
+itself (nothing is capturable until that lands and gets used); the items would substantially repeat a
+proposal already made this session. The agent's own summary never counts as a signal, nor does a cue
+word inside quoted text, nor a request for a session summary. Zero durable items → silent; never emit
+"scanned, nothing to save".
+
+## What is durable
+
+Include: decisions with their rationale; net-new concepts; net-new people, organizations, or
+initiatives with context; reusable patterns and playbooks; resolved non-obvious problems worth future
+recall; durable preference or environment facts the user corrected you on.
+
+Exclude: tool output, command traces, transient debugging; read-only investigation with no conclusion;
+scratch work that landed on no decision.
+
+Unsure → propose (the user can decline).
+
+## Proposal — ONE message, empty proposal omitted
+
+```
+### Store notes
+- A1  path: <layer>/<location>/<Title>.md
+      visibility: <value> — <one-line rationale; `ctxr note resolve` on a sibling shows the default>
+      sketch: bullets
+```
+
+Secret-marker pass: any item whose content looks like a credential gets `⚠ suspected-secret:` on its
+own line with why (patterns worth checking: `sk-`, `ghp_`, `AKIA` + 16 chars, `Bearer …`, a JWT
+`eyJ…`, a URL with a token/key/secret parameter). The marker is a hint; the user is the gate.
+
+End with: "Approve by ID (e.g. `A1 A3`) or `skip`." An edit request → re-propose. An ambiguous
+answer → do not proceed.
+
+## Apply
+
+Write ONLY the approved items to a YAML proposal file, in the shape `ctxr session capture` reads:
+
+```yaml
+notes:
+  - id: A1
+    path: <layer>/<location>/<Title>.md
+    mode: create            # or: append
+    visibility: <value>     # optional; omit to take the location default
+    body: |
+      matching the frontmatter and style of the sibling notes (`ctxr-placement` decides the location)
+```
+
+Then run `ctxr session capture --proposal <file>`. It validates and writes every item independently —
+one bad path never blocks the rest. These note commits ride the session pull request
+(`ctxr-session-lifecycle`).
+
+## Report from actual writes
+
+Report exactly what the command reported — wrote / appended / refused (with reason) / skipped, by ID —
+never from the proposal itself. A refused item is surfaced prominently with its reason.

package/templates/skills/ctxr-session-lifecycle.md

@@ -0,0 +1,39 @@
+Every write lands via a session worktree and a reviewed pull request; nothing commits to the default
+branch (`__DEFAULT_BRANCH__`). This skill covers what surrounds a session — starting one, re-scanning before
+any plan, resolving conflicts, and sequencing several pull requests. `ctxr-submit` and `ctxr-land` are
+the two verbs at the seams; their steps are not repeated here.
+
+## Start
+
+`ctxr session start` creates a worktree on a fresh branch off the fetched default branch; work there.
+If you find yourself on the default branch or in the root checkout, stop — `ctxr session list` shows the
+active sessions to work in instead.
+
+## Re-scan before any plan
+
+Re-scan whenever state may have moved under you — before presenting a plan, before running `ctxr-submit`,
+after any gap in the conversation: `git fetch origin`, `git status --short`, `git diff --stat`,
+`git diff --cached --stat`, `git ls-files --others --exclude-standard`,
+`git log --oneline origin/__DEFAULT_BRANCH__..HEAD`. State moves under you while you work; a plan that grows
+between scans is normal. Name the delta from the previous scan rather than silently folding new work into
+old buckets.
+
+## Conflict playbook
+
+From the session worktree: `git fetch origin && git rebase origin/__DEFAULT_BRANCH__`. For each conflicting
+file inspect both sides (`git show`), understand what each represents, and produce a version that keeps
+both meanings — never take one side blindly. `git add <file>`, `GIT_EDITOR=true git rebase --continue`,
+then `git push --force-with-lease origin <branch>` (aborts if the remote moved underneath you). Never
+resolve on the default branch.
+
+## Multi-PR sequencing
+
+Parallel when the units are file-disjoint — one `ctxr session start` per unit. Sequential when files
+overlap: wait for the merge (`ctxr-land`), then start the next session off the updated default branch.
+Worktrees isolate directories, not logical writes: a hot file every session appends to collides at merge
+time regardless — sequence those.
+
+## Reclaiming
+
+`ctxr session reap` removes merged, clean worktrees (or use `ctxr-land`'s `--reap`); `ctxr session abandon
+<branch>` discards work and needs an explicit go. Never claim cleanup happened without having run one.

package/templates/skills/ctxr-submit.md

@@ -0,0 +1,26 @@
+The submit half of the session lifecycle — everything up to and including opening the pull request.
+`ctxr-land` is the other half, after review; `ctxr-session-lifecycle` covers what surrounds both (starting
+a session, the conflict playbook, sequencing several pull requests) and is not repeated here.
+
+1. Re-scan (mandatory — never replay a plan from an earlier snapshot): `git fetch origin`,
+   `git status --short`, `git diff --stat`, `git diff --cached --stat`,
+   `git ls-files --others --exclude-standard`, `git log --oneline origin/__DEFAULT_BRANCH__..HEAD`. State moves
+   under you while you work; name the delta from the previous scan rather than silently folding new work
+   into old buckets.
+2. Capture pass: run `ctxr-session-capture` exactly once here — closing a session is itself a capture
+   trigger; do not fire it again after submitting.
+3. Stage surgically: `git add <paths>`, never `git add -A`; confirm with `git status --short` that the
+   staged set matches the intended unit. Derived artifacts under the cache paths never stage.
+4. One coherent unit per pull request. If the session produced two disjoint units, say so and ask
+   whether to split.
+5. Fire gate: `ctxr session submit` commits, pushes, and opens the pull request — an external side
+   effect, and plan consent is not fire consent. Present the branch, the title, and what rides it; wait
+   for an explicit go before running it.
+6. Run: `ctxr session submit --branch "<name>" --title "<title>" --body "<why / what changed /
+   verification / follow-ups>"`. Name a real branch with `--branch` — never let a generated name reach
+   the forge. It runs the full store validation first; fix a failure, never bypass it. If no forge is
+   reachable it still pushes and prints the manual pull-request instructions.
+7. Verify before any retry: a transport error can arrive AFTER the push or the pull-request open already
+   succeeded. Before retrying anything, `git ls-remote origin <branch>` and the forge's pull-request list
+   for the branch — never replay a push or a pull-request open blindly.
+8. Hand off: report the pull request, then point at `ctxr-land` for after review.

package/dist/commands/identity.d.ts

@@ -1,24 +0,0 @@
-import type { CommandOutcome, CommandRequires } from '../core/command.js';
-import type { Store } from '../core/store.js';
-export declare const requires: CommandRequires;
-export interface IdentityEditData {
-    path: string;
-    entries: number;
-}
-export interface IdentityAddFlags {
-    file: string;
-    text: string;
-}
-export declare function executeAdd(store: Store, flags: IdentityAddFlags): Promise<CommandOutcome<IdentityEditData>>;
-export interface IdentityReplaceFlags {
-    file: string;
-    match: string;
-    text: string;
-}
-export declare function executeReplace(store: Store, flags: IdentityReplaceFlags): Promise<CommandOutcome<IdentityEditData>>;
-export interface IdentityRemoveFlags {
-    file: string;
-    match: string;
-}
-export declare function executeRemove(store: Store, flags: IdentityRemoveFlags): Promise<CommandOutcome<IdentityEditData>>;
-//# sourceMappingURL=identity.d.ts.map

package/dist/commands/identity.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"identity.d.ts","sourceRoot":"","sources":["../../src/commands/identity.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,cAAc,EAAE,eAAe,EAAE,MAAM,oBAAoB,CAAC;AAU1E,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,kBAAkB,CAAC;AAE9C,eAAO,MAAM,QAAQ,EAAE,eAAuC,CAAC;AAE/D,MAAM,WAAW,gBAAgB;IAC/B,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;CACjB;AAmBD,MAAM,WAAW,gBAAgB;IAC/B,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;CACd;AAED,wBAAsB,UAAU,CAAC,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,gBAAgB,GAAG,OAAO,CAAC,cAAc,CAAC,gBAAgB,CAAC,CAAC,CAIjH;AAED,MAAM,WAAW,oBAAoB;IACnC,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,MAAM,CAAC;IACd,IAAI,EAAE,MAAM,CAAC;CACd;AAED,wBAAsB,cAAc,CAAC,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,oBAAoB,GAAG,OAAO,CAAC,cAAc,CAAC,gBAAgB,CAAC,CAAC,CAIzH;AAED,MAAM,WAAW,mBAAmB;IAClC,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,MAAM,CAAC;CACf;AAED,wBAAsB,aAAa,CAAC,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,mBAAmB,GAAG,OAAO,CAAC,cAAc,CAAC,gBAAgB,CAAC,CAAC,CAIvH"}

package/dist/commands/identity.js

@@ -1,35 +0,0 @@
-import { ExitCode } from '../core/exit-codes.js';
-import { UnknownIdentityRoleError } from '../core/errors.js';
-import { addIdentityEntry, IDENTITY_ROLES, removeIdentityEntry, replaceIdentityEntry, } from '../core/identity.js';
-export const requires = { store: 'required' };
-function checkRole(role) {
-    if (!IDENTITY_ROLES.includes(role)) {
-        throw new UnknownIdentityRoleError(role, IDENTITY_ROLES);
-    }
-}
-function outcome(store, result, humanSummary) {
-    return {
-        exitCode: ExitCode.Ok,
-        data: result,
-        findings: [],
-        humanSummary,
-        storeRoot: store.root,
-        schemaVersion: store.config.schema_version,
-    };
-}
-export async function executeAdd(store, flags) {
-    checkRole(flags.file);
-    const result = await addIdentityEntry(store.root, store.config, flags.file, flags.text);
-    return outcome(store, result, `Added an entry to "${result.path}" (${result.entries} total).`);
-}
-export async function executeReplace(store, flags) {
-    checkRole(flags.file);
-    const result = await replaceIdentityEntry(store.root, store.config, flags.file, flags.match, flags.text);
-    return outcome(store, result, `Replaced the entry matching "${flags.match}" in "${result.path}" (${result.entries} total).`);
-}
-export async function executeRemove(store, flags) {
-    checkRole(flags.file);
-    const result = await removeIdentityEntry(store.root, store.config, flags.file, flags.match);
-    return outcome(store, result, `Removed the entry matching "${flags.match}" from "${result.path}" (${result.entries} total).`);
-}
-//# sourceMappingURL=identity.js.map

package/dist/commands/identity.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"identity.js","sourceRoot":"","sources":["../../src/commands/identity.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,QAAQ,EAAE,MAAM,uBAAuB,CAAC;AACjD,OAAO,EAAE,wBAAwB,EAAE,MAAM,mBAAmB,CAAC;AAC7D,OAAO,EACL,gBAAgB,EAChB,cAAc,EACd,mBAAmB,EACnB,oBAAoB,GAErB,MAAM,qBAAqB,CAAC;AAG7B,MAAM,CAAC,MAAM,QAAQ,GAAoB,EAAE,KAAK,EAAE,UAAU,EAAE,CAAC;AAO/D,SAAS,SAAS,CAAC,IAAY;IAC7B,IAAI,CAAE,cAAoC,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;QAC1D,MAAM,IAAI,wBAAwB,CAAC,IAAI,EAAE,cAAc,CAAC,CAAC;IAC3D,CAAC;AACH,CAAC;AAED,SAAS,OAAO,CAAC,KAAY,EAAE,MAAyC,EAAE,YAAoB;IAC5F,OAAO;QACL,QAAQ,EAAE,QAAQ,CAAC,EAAE;QACrB,IAAI,EAAE,MAAM;QACZ,QAAQ,EAAE,EAAE;QACZ,YAAY;QACZ,SAAS,EAAE,KAAK,CAAC,IAAI;QACrB,aAAa,EAAE,KAAK,CAAC,MAAM,CAAC,cAAc;KAC3C,CAAC;AACJ,CAAC;AAOD,MAAM,CAAC,KAAK,UAAU,UAAU,CAAC,KAAY,EAAE,KAAuB;IACpE,SAAS,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IACtB,MAAM,MAAM,GAAG,MAAM,gBAAgB,CAAC,KAAK,CAAC,IAAI,EAAE,KAAK,CAAC,MAAM,EAAE,KAAK,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC;IACxF,OAAO,OAAO,CAAC,KAAK,EAAE,MAAM,EAAE,sBAAsB,MAAM,CAAC,IAAI,MAAM,MAAM,CAAC,OAAO,UAAU,CAAC,CAAC;AACjG,CAAC;AAQD,MAAM,CAAC,KAAK,UAAU,cAAc,CAAC,KAAY,EAAE,KAA2B;IAC5E,SAAS,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IACtB,MAAM,MAAM,GAAG,MAAM,oBAAoB,CAAC,KAAK,CAAC,IAAI,EAAE,KAAK,CAAC,MAAM,EAAE,KAAK,CAAC,IAAI,EAAE,KAAK,CAAC,KAAK,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC;IACzG,OAAO,OAAO,CAAC,KAAK,EAAE,MAAM,EAAE,gCAAgC,KAAK,CAAC,KAAK,SAAS,MAAM,CAAC,IAAI,MAAM,MAAM,CAAC,OAAO,UAAU,CAAC,CAAC;AAC/H,CAAC;AAOD,MAAM,CAAC,KAAK,UAAU,aAAa,CAAC,KAAY,EAAE,KAA0B;IAC1E,SAAS,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IACtB,MAAM,MAAM,GAAG,MAAM,mBAAmB,CAAC,KAAK,CAAC,IAAI,EAAE,KAAK,CAAC,MAAM,EAAE,KAAK,CAAC,IAAI,EAAE,KAAK,CAAC,KAAK,CAAC,CAAC;IAC5F,OAAO,OAAO,CAAC,KAAK,EAAE,MAAM,EAAE,+BAA+B,KAAK,CAAC,KAAK,WAAW,MAAM,CAAC,IAAI,MAAM,MAAM,CAAC,OAAO,UAAU,CAAC,CAAC;AAChI,CAAC"}

package/dist/core/checks/identity-checks.d.ts

@@ -1,16 +0,0 @@
-/**
- * agent-identity spec: "Identity files... SHALL live under a path declared
- * in the store's retrieval exclusion configuration." Catalog and graph
- * already can't surface anything under an excluded prefix (they're both
- * built from listNotes()) — this check guards the one way that guarantee
- * could quietly break: an operator editing config.retrieval.exclude_paths
- * and dropping an identity path from it.
- *
- * session-capture-command spec (D3): checked against each ROLE'S RESOLVED
- * path — not the identity directory alone — so a role relocated outside
- * `identity.path` (e.g. into a directory a harness runtime links into)
- * still cannot leak into retrieval.
- */
-export declare const identityExclusionCheck: import("./types.js").CheckDefinition;
-export declare const IDENTITY_CHECKS: import("./types.js").CheckDefinition[];
-//# sourceMappingURL=identity-checks.d.ts.map

package/dist/core/checks/identity-checks.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"identity-checks.d.ts","sourceRoot":"","sources":["../../../src/core/checks/identity-checks.ts"],"names":[],"mappings":"AAIA;;;;;;;;;;;;GAYG;AACH,eAAO,MAAM,sBAAsB,sCAyBjC,CAAC;AAEH,eAAO,MAAM,eAAe,wCAA2B,CAAC"}

package/dist/core/checks/identity-checks.js

@@ -1,43 +0,0 @@
-import { IDENTITY_ROLES, identityFilePath } from '../identity.js';
-import { defineCheck } from './types.js';
-/**
- * agent-identity spec: "Identity files... SHALL live under a path declared
- * in the store's retrieval exclusion configuration." Catalog and graph
- * already can't surface anything under an excluded prefix (they're both
- * built from listNotes()) — this check guards the one way that guarantee
- * could quietly break: an operator editing config.retrieval.exclude_paths
- * and dropping an identity path from it.
- *
- * session-capture-command spec (D3): checked against each ROLE'S RESOLVED
- * path — not the identity directory alone — so a role relocated outside
- * `identity.path` (e.g. into a directory a harness runtime links into)
- * still cannot leak into retrieval.
- */
-export const identityExclusionCheck = defineCheck({
-    id: 'identity.excluded_from_retrieval',
-    title: 'Every identity role\'s resolved path is excluded from retrieval',
-    severity: 'invariant',
-    capability: 'agent-identity',
-    scopes: ['store'],
-    async run(ctx) {
-        const findings = [];
-        for (const role of IDENTITY_ROLES) {
-            const resolvedPath = identityFilePath(ctx.config, role);
-            const covered = ctx.config.retrieval.exclude_paths.some((prefix) => {
-                const trimmed = prefix.replace(/\/+$/, '');
-                return resolvedPath === trimmed || resolvedPath.startsWith(`${trimmed}/`);
-            });
-            if (!covered) {
-                findings.push({
-                    code: 'identity.not_excluded',
-                    severity: 'error',
-                    message: `The ${role} identity file "${resolvedPath}" is not covered by retrieval.exclude_paths — it could leak into the catalog or graph.`,
-                    subject: resolvedPath,
-                });
-            }
-        }
-        return { status: findings.length > 0 ? 'fail' : 'pass', findings };
-    },
-});
-export const IDENTITY_CHECKS = [identityExclusionCheck];
-//# sourceMappingURL=identity-checks.js.map

package/dist/core/checks/identity-checks.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"identity-checks.js","sourceRoot":"","sources":["../../../src/core/checks/identity-checks.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,cAAc,EAAE,gBAAgB,EAAE,MAAM,gBAAgB,CAAC;AAClE,OAAO,EAAE,WAAW,EAAE,MAAM,YAAY,CAAC;AAGzC;;;;;;;;;;;;GAYG;AACH,MAAM,CAAC,MAAM,sBAAsB,GAAG,WAAW,CAAC;IAChD,EAAE,EAAE,kCAAkC;IACtC,KAAK,EAAE,iEAAiE;IACxE,QAAQ,EAAE,WAAW;IACrB,UAAU,EAAE,gBAAgB;IAC5B,MAAM,EAAE,CAAC,OAAO,CAAC;IACjB,KAAK,CAAC,GAAG,CAAC,GAAG;QACX,MAAM,QAAQ,GAAc,EAAE,CAAC;QAC/B,KAAK,MAAM,IAAI,IAAI,cAAc,EAAE,CAAC;YAClC,MAAM,YAAY,GAAG,gBAAgB,CAAC,GAAG,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;YACxD,MAAM,OAAO,GAAG,GAAG,CAAC,MAAM,CAAC,SAAS,CAAC,aAAa,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,EAAE;gBACjE,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;gBAC3C,OAAO,YAAY,KAAK,OAAO,IAAI,YAAY,CAAC,UAAU,CAAC,GAAG,OAAO,GAAG,CAAC,CAAC;YAC5E,CAAC,CAAC,CAAC;YACH,IAAI,CAAC,OAAO,EAAE,CAAC;gBACb,QAAQ,CAAC,IAAI,CAAC;oBACZ,IAAI,EAAE,uBAAuB;oBAC7B,QAAQ,EAAE,OAAO;oBACjB,OAAO,EAAE,OAAO,IAAI,mBAAmB,YAAY,wFAAwF;oBAC3I,OAAO,EAAE,YAAY;iBACtB,CAAC,CAAC;YACL,CAAC;QACH,CAAC;QACD,OAAO,EAAE,MAAM,EAAE,QAAQ,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,QAAQ,EAAE,CAAC;IACrE,CAAC;CACF,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,eAAe,GAAG,CAAC,sBAAsB,CAAC,CAAC"}

package/dist/core/identity.d.ts

@@ -1,46 +0,0 @@
-import type { StoreConfig } from '../config/schema.js';
-/**
- * agent-identity spec: three canonical, harness-neutral roles — posture,
- * durable world facts, durable user facts — kept distinct from retrievable
- * knowledge (excluded from every retrieval leg via each resolved path being
- * covered by config.retrieval.exclude_paths). A harness's own
- * identity-injection adapter decides how these reach a running agent; core
- * never reads their content itself.
- *
- * session-capture-command spec (D3): a role's path is CONFIGURABLE
- * (`identity.files`) — a store whose runtime keeps its memory elsewhere
- * points the role there, and every consumer below resolves through
- * `identityFilePath`/`identityFilePaths` rather than assuming the canonical
- * layout, so the relocated file IS the mechanism, not a copy of it.
- */
-export declare const IDENTITY_ROLES: readonly ['posture', 'world-facts', 'user-facts'];
-export type IdentityRole = (typeof IDENTITY_ROLES)[number];
-/** The canonical filename each role resolves to under `identity.path` when no override is configured. */
-export declare const IDENTITY_FILES: Record<IdentityRole, string>;
-/** The store-relative path this role resolves to: its configured binding, or its canonical file under `identity.path`. */
-export declare function identityFilePath(config: StoreConfig, role: IdentityRole): string;
-export declare function identityFilePaths(config: StoreConfig): string[];
-/** Creates any of the three canonical identity files that don't exist yet — never overwrites an existing one. */
-export declare function ensureIdentityFiles(root: string, config: StoreConfig): Promise<string[]>;
-/**
- * session-capture-command spec (D4): an entry is the text between two
- * delimiter lines. The default delimiter ('') means an empty (blank) line,
- * so paragraphs are entries and a heading-sectioned file's headings simply
- * become part of the entry that follows them — no section vocabulary, no
- * format detection.
- */
-export declare function splitEntries(text: string, delimiter: string): string[];
-export declare function joinEntries(entries: readonly string[], delimiter: string): string;
-export interface IdentityEntryResult {
-    /** The role's resolved, store-relative path. */
-    path: string;
-    /** The entry count after the edit. */
-    entries: number;
-}
-/** Appends a new entry at the end of the role's file, creating it (with no other entries) if it doesn't exist yet. */
-export declare function addIdentityEntry(root: string, config: StoreConfig, role: IdentityRole, text: string): Promise<IdentityEntryResult>;
-/** Replaces the single entry containing `match`; refuses, writing nothing, when zero or several entries match. */
-export declare function replaceIdentityEntry(root: string, config: StoreConfig, role: IdentityRole, match: string, text: string): Promise<IdentityEntryResult>;
-/** Removes the single entry containing `match`; refuses, writing nothing, when zero or several entries match. */
-export declare function removeIdentityEntry(root: string, config: StoreConfig, role: IdentityRole, match: string): Promise<IdentityEntryResult>;
-//# sourceMappingURL=identity.d.ts.map

package/dist/core/identity.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"identity.d.ts","sourceRoot":"","sources":["../../src/core/identity.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,qBAAqB,CAAC;AAIvD;;;;;;;;;;;;;GAaG;AACH,eAAO,MAAM,cAAc,YAAI,SAAS,EAAE,aAAa,EAAE,YAAY,CAAU,CAAC;AAChF,MAAM,MAAM,YAAY,GAAG,CAAC,OAAO,cAAc,CAAC,CAAC,MAAM,CAAC,CAAC;AAE3D,yGAAyG;AACzG,eAAO,MAAM,cAAc,EAAE,MAAM,CAAC,YAAY,EAAE,MAAM,CAIvD,CAAC;AAQF,0HAA0H;AAC1H,wBAAgB,gBAAgB,CAAC,MAAM,EAAE,WAAW,EAAE,IAAI,EAAE,YAAY,GAAG,MAAM,CAIhF;AAED,wBAAgB,iBAAiB,CAAC,MAAM,EAAE,WAAW,GAAG,MAAM,EAAE,CAE/D;AAED,iHAAiH;AACjH,wBAAsB,mBAAmB,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,WAAW,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,CAY9F;AAED;;;;;;GAMG;AACH,wBAAgB,YAAY,CAAC,IAAI,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,MAAM,EAAE,CAmBtE;AAED,wBAAgB,WAAW,CAAC,OAAO,EAAE,SAAS,MAAM,EAAE,EAAE,SAAS,EAAE,MAAM,GAAG,MAAM,CAIjF;AAwBD,MAAM,WAAW,mBAAmB;IAClC,gDAAgD;IAChD,IAAI,EAAE,MAAM,CAAC;IACb,sCAAsC;IACtC,OAAO,EAAE,MAAM,CAAC;CACjB;AAED,sHAAsH;AACtH,wBAAsB,gBAAgB,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,WAAW,EAAE,IAAI,EAAE,YAAY,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,mBAAmB,CAAC,CAQxI;AAED,kHAAkH;AAClH,wBAAsB,oBAAoB,CACxC,IAAI,EAAE,MAAM,EACZ,MAAM,EAAE,WAAW,EACnB,IAAI,EAAE,YAAY,EAClB,KAAK,EAAE,MAAM,EACb,IAAI,EAAE,MAAM,GACX,OAAO,CAAC,mBAAmB,CAAC,CAQ9B;AAED,iHAAiH;AACjH,wBAAsB,mBAAmB,CACvC,IAAI,EAAE,MAAM,EACZ,MAAM,EAAE,WAAW,EACnB,IAAI,EAAE,YAAY,EAClB,KAAK,EAAE,MAAM,GACZ,OAAO,CAAC,mBAAmB,CAAC,CAQ9B"}

package/dist/core/identity.js

@@ -1,143 +0,0 @@
-import { existsSync } from 'node:fs';
-import { mkdir, readFile } from 'node:fs/promises';
-import path from 'node:path';
-import { IdentityEntryMatchError } from './errors.js';
-import { writeFileAtomic } from './fs/atomic.js';
-/**
- * agent-identity spec: three canonical, harness-neutral roles — posture,
- * durable world facts, durable user facts — kept distinct from retrievable
- * knowledge (excluded from every retrieval leg via each resolved path being
- * covered by config.retrieval.exclude_paths). A harness's own
- * identity-injection adapter decides how these reach a running agent; core
- * never reads their content itself.
- *
- * session-capture-command spec (D3): a role's path is CONFIGURABLE
- * (`identity.files`) — a store whose runtime keeps its memory elsewhere
- * points the role there, and every consumer below resolves through
- * `identityFilePath`/`identityFilePaths` rather than assuming the canonical
- * layout, so the relocated file IS the mechanism, not a copy of it.
- */
-export const IDENTITY_ROLES = ['posture', 'world-facts', 'user-facts'];
-/** The canonical filename each role resolves to under `identity.path` when no override is configured. */
-export const IDENTITY_FILES = {
-    posture: 'posture.md',
-    'world-facts': 'world-facts.md',
-    'user-facts': 'user-facts.md',
-};
-const TEMPLATES = {
-    posture: '# Agent posture\n\nHow an agent should approach work in this store: tone, defaults, things to always or never do.\n',
-    'world-facts': '# Durable world facts\n\nFacts about the world (not the user) worth carrying into every session.\n',
-    'user-facts': '# Durable user facts\n\nFacts about the user worth carrying into every session.\n',
-};
-/** The store-relative path this role resolves to: its configured binding, or its canonical file under `identity.path`. */
-export function identityFilePath(config, role) {
-    const bound = config.identity.files[role];
-    const relative = bound ?? path.join(config.identity.path, IDENTITY_FILES[role]);
-    return relative.split(path.sep).join('/');
-}
-export function identityFilePaths(config) {
-    return IDENTITY_ROLES.map((role) => identityFilePath(config, role));
-}
-/** Creates any of the three canonical identity files that don't exist yet — never overwrites an existing one. */
-export async function ensureIdentityFiles(root, config) {
-    const created = [];
-    for (const role of IDENTITY_ROLES) {
-        const relativePath = identityFilePath(config, role);
-        const absolutePath = path.join(root, relativePath);
-        if (!existsSync(absolutePath)) {
-            await mkdir(path.dirname(absolutePath), { recursive: true });
-            await writeFileAtomic(absolutePath, TEMPLATES[role]);
-            created.push(relativePath);
-        }
-    }
-    return created;
-}
-/**
- * session-capture-command spec (D4): an entry is the text between two
- * delimiter lines. The default delimiter ('') means an empty (blank) line,
- * so paragraphs are entries and a heading-sectioned file's headings simply
- * become part of the entry that follows them — no section vocabulary, no
- * format detection.
- */
-export function splitEntries(text, delimiter) {
-    const isDelimiterLine = (line) => (delimiter === '' ? line.trim() === '' : line === delimiter);
-    const entries = [];
-    let current = [];
-    // A single trailing newline is a file-formatting convention, not a blank final line — for a
-    // custom delimiter it would otherwise leak into the last entry as trailing junk.
-    const trimmed = text.endsWith('\n') ? text.slice(0, -1) : text;
-    for (const line of trimmed.split('\n')) {
-        if (isDelimiterLine(line)) {
-            if (current.length > 0) {
-                entries.push(current.join('\n'));
-                current = [];
-            }
-        }
-        else {
-            current.push(line);
-        }
-    }
-    if (current.length > 0)
-        entries.push(current.join('\n'));
-    return entries;
-}
-export function joinEntries(entries, delimiter) {
-    if (entries.length === 0)
-        return '';
-    const separator = delimiter === '' ? '\n\n' : `\n${delimiter}\n`;
-    return `${entries.join(separator)}\n`;
-}
-async function readEntries(absolutePath, delimiter) {
-    let text;
-    try {
-        text = await readFile(absolutePath, 'utf8');
-    }
-    catch (err) {
-        if (err.code === 'ENOENT')
-            return [];
-        throw err;
-    }
-    return splitEntries(text, delimiter);
-}
-function findUniqueMatch(entries, match, filePath) {
-    const indices = entries.reduce((acc, entry, index) => {
-        if (entry.includes(match))
-            acc.push(index);
-        return acc;
-    }, []);
-    if (indices.length !== 1) {
-        throw new IdentityEntryMatchError(filePath, match, indices.length);
-    }
-    return indices[0];
-}
-/** Appends a new entry at the end of the role's file, creating it (with no other entries) if it doesn't exist yet. */
-export async function addIdentityEntry(root, config, role, text) {
-    const relativePath = identityFilePath(config, role);
-    const absolutePath = path.join(root, relativePath);
-    const entries = await readEntries(absolutePath, config.identity.entry_delimiter);
-    entries.push(text);
-    await mkdir(path.dirname(absolutePath), { recursive: true });
-    await writeFileAtomic(absolutePath, joinEntries(entries, config.identity.entry_delimiter));
-    return { path: relativePath, entries: entries.length };
-}
-/** Replaces the single entry containing `match`; refuses, writing nothing, when zero or several entries match. */
-export async function replaceIdentityEntry(root, config, role, match, text) {
-    const relativePath = identityFilePath(config, role);
-    const absolutePath = path.join(root, relativePath);
-    const entries = await readEntries(absolutePath, config.identity.entry_delimiter);
-    const index = findUniqueMatch(entries, match, relativePath);
-    entries[index] = text;
-    await writeFileAtomic(absolutePath, joinEntries(entries, config.identity.entry_delimiter));
-    return { path: relativePath, entries: entries.length };
-}
-/** Removes the single entry containing `match`; refuses, writing nothing, when zero or several entries match. */
-export async function removeIdentityEntry(root, config, role, match) {
-    const relativePath = identityFilePath(config, role);
-    const absolutePath = path.join(root, relativePath);
-    const entries = await readEntries(absolutePath, config.identity.entry_delimiter);
-    const index = findUniqueMatch(entries, match, relativePath);
-    entries.splice(index, 1);
-    await writeFileAtomic(absolutePath, joinEntries(entries, config.identity.entry_delimiter));
-    return { path: relativePath, entries: entries.length };
-}
-//# sourceMappingURL=identity.js.map

package/dist/core/identity.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"identity.js","sourceRoot":"","sources":["../../src/core/identity.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AACrC,OAAO,EAAE,KAAK,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AACnD,OAAO,IAAI,MAAM,WAAW,CAAC;AAE7B,OAAO,EAAE,uBAAuB,EAAE,MAAM,aAAa,CAAC;AACtD,OAAO,EAAE,eAAe,EAAE,MAAM,gBAAgB,CAAC;AAEjD;;;;;;;;;;;;;GAaG;AACH,MAAM,CAAC,MAAM,cAAc,GAAG,CAAC,SAAS,EAAE,aAAa,EAAE,YAAY,CAAU,CAAC;AAGhF,yGAAyG;AACzG,MAAM,CAAC,MAAM,cAAc,GAAiC;IAC1D,OAAO,EAAE,YAAY;IACrB,aAAa,EAAE,gBAAgB;IAC/B,YAAY,EAAE,eAAe;CAC9B,CAAC;AAEF,MAAM,SAAS,GAAiC;IAC9C,OAAO,EAAE,qHAAqH;IAC9H,aAAa,EAAE,oGAAoG;IACnH,YAAY,EAAE,mFAAmF;CAClG,CAAC;AAEF,0HAA0H;AAC1H,MAAM,UAAU,gBAAgB,CAAC,MAAmB,EAAE,IAAkB;IACtE,MAAM,KAAK,GAAG,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IAC1C,MAAM,QAAQ,GAAG,KAAK,IAAI,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,EAAE,cAAc,CAAC,IAAI,CAAC,CAAC,CAAC;IAChF,OAAO,QAAQ,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AAC5C,CAAC;AAED,MAAM,UAAU,iBAAiB,CAAC,MAAmB;IACnD,OAAO,cAAc,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,gBAAgB,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC,CAAC;AACtE,CAAC;AAED,iHAAiH;AACjH,MAAM,CAAC,KAAK,UAAU,mBAAmB,CAAC,IAAY,EAAE,MAAmB;IACzE,MAAM,OAAO,GAAa,EAAE,CAAC;IAC7B,KAAK,MAAM,IAAI,IAAI,cAAc,EAAE,CAAC;QAClC,MAAM,YAAY,GAAG,gBAAgB,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;QACpD,MAAM,YAAY,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,YAAY,CAAC,CAAC;QACnD,IAAI,CAAC,UAAU,CAAC,YAAY,CAAC,EAAE,CAAC;YAC9B,MAAM,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,YAAY,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;YAC7D,MAAM,eAAe,CAAC,YAAY,EAAE,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC;YACrD,OAAO,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;QAC7B,CAAC;IACH,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,YAAY,CAAC,IAAY,EAAE,SAAiB;IAC1D,MAAM,eAAe,GAAG,CAAC,IAAY,EAAW,EAAE,CAAC,CAAC,SAAS,KAAK,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC;IAChH,MAAM,OAAO,GAAa,EAAE,CAAC;IAC7B,IAAI,OAAO,GAAa,EAAE,CAAC;IAC3B,4FAA4F;IAC5F,iFAAiF;IACjF,MAAM,OAAO,GAAG,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IAC/D,KAAK,MAAM,IAAI,IAAI,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;QACvC,IAAI,eAAe,CAAC,IAAI,CAAC,EAAE,CAAC;YAC1B,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBACvB,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;gBACjC,OAAO,GAAG,EAAE,CAAC;YACf,CAAC;QACH,CAAC;aAAM,CAAC;YACN,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACrB,CAAC;IACH,CAAC;IACD,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC;QAAE,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;IACzD,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,MAAM,UAAU,WAAW,CAAC,OAA0B,EAAE,SAAiB;IACvE,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,EAAE,CAAC;IACpC,MAAM,SAAS,GAAG,SAAS,KAAK,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,SAAS,IAAI,CAAC;IACjE,OAAO,GAAG,OAAO,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC;AACxC,CAAC;AAED,KAAK,UAAU,WAAW,CAAC,YAAoB,EAAE,SAAiB;IAChE,IAAI,IAAY,CAAC;IACjB,IAAI,CAAC;QACH,IAAI,GAAG,MAAM,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC,CAAC;IAC9C,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAK,GAA6B,CAAC,IAAI,KAAK,QAAQ;YAAE,OAAO,EAAE,CAAC;QAChE,MAAM,GAAG,CAAC;IACZ,CAAC;IACD,OAAO,YAAY,CAAC,IAAI,EAAE,SAAS,CAAC,CAAC;AACvC,CAAC;AAED,SAAS,eAAe,CAAC,OAA0B,EAAE,KAAa,EAAE,QAAgB;IAClF,MAAM,OAAO,GAAG,OAAO,CAAC,MAAM,CAAW,CAAC,GAAG,EAAE,KAAK,EAAE,KAAK,EAAE,EAAE;QAC7D,IAAI,KAAK,CAAC,QAAQ,CAAC,KAAK,CAAC;YAAE,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAC3C,OAAO,GAAG,CAAC;IACb,CAAC,EAAE,EAAE,CAAC,CAAC;IACP,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACzB,MAAM,IAAI,uBAAuB,CAAC,QAAQ,EAAE,KAAK,EAAE,OAAO,CAAC,MAAM,CAAC,CAAC;IACrE,CAAC;IACD,OAAO,OAAO,CAAC,CAAC,CAAE,CAAC;AACrB,CAAC;AASD,sHAAsH;AACtH,MAAM,CAAC,KAAK,UAAU,gBAAgB,CAAC,IAAY,EAAE,MAAmB,EAAE,IAAkB,EAAE,IAAY;IACxG,MAAM,YAAY,GAAG,gBAAgB,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;IACpD,MAAM,YAAY,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,YAAY,CAAC,CAAC;IACnD,MAAM,OAAO,GAAG,MAAM,WAAW,CAAC,YAAY,EAAE,MAAM,CAAC,QAAQ,CAAC,eAAe,CAAC,CAAC;IACjF,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACnB,MAAM,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,YAAY,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAC7D,MAAM,eAAe,CAAC,YAAY,EAAE,WAAW,CAAC,OAAO,EAAE,MAAM,CAAC,QAAQ,CAAC,eAAe,CAAC,CAAC,CAAC;IAC3F,OAAO,EAAE,IAAI,EAAE,YAAY,EAAE,OAAO,EAAE,OAAO,CAAC,MAAM,EAAE,CAAC;AACzD,CAAC;AAED,kHAAkH;AAClH,MAAM,CAAC,KAAK,UAAU,oBAAoB,CACxC,IAAY,EACZ,MAAmB,EACnB,IAAkB,EAClB,KAAa,EACb,IAAY;IAEZ,MAAM,YAAY,GAAG,gBAAgB,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;IACpD,MAAM,YAAY,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,YAAY,CAAC,CAAC;IACnD,MAAM,OAAO,GAAG,MAAM,WAAW,CAAC,YAAY,EAAE,MAAM,CAAC,QAAQ,CAAC,eAAe,CAAC,CAAC;IACjF,MAAM,KAAK,GAAG,eAAe,CAAC,OAAO,EAAE,KAAK,EAAE,YAAY,CAAC,CAAC;IAC5D,OAAO,CAAC,KAAK,CAAC,GAAG,IAAI,CAAC;IACtB,MAAM,eAAe,CAAC,YAAY,EAAE,WAAW,CAAC,OAAO,EAAE,MAAM,CAAC,QAAQ,CAAC,eAAe,CAAC,CAAC,CAAC;IAC3F,OAAO,EAAE,IAAI,EAAE,YAAY,EAAE,OAAO,EAAE,OAAO,CAAC,MAAM,EAAE,CAAC;AACzD,CAAC;AAED,iHAAiH;AACjH,MAAM,CAAC,KAAK,UAAU,mBAAmB,CACvC,IAAY,EACZ,MAAmB,EACnB,IAAkB,EAClB,KAAa;IAEb,MAAM,YAAY,GAAG,gBAAgB,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;IACpD,MAAM,YAAY,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,YAAY,CAAC,CAAC;IACnD,MAAM,OAAO,GAAG,MAAM,WAAW,CAAC,YAAY,EAAE,MAAM,CAAC,QAAQ,CAAC,eAAe,CAAC,CAAC;IACjF,MAAM,KAAK,GAAG,eAAe,CAAC,OAAO,EAAE,KAAK,EAAE,YAAY,CAAC,CAAC;IAC5D,OAAO,CAAC,MAAM,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC;IACzB,MAAM,eAAe,CAAC,YAAY,EAAE,WAAW,CAAC,OAAO,EAAE,MAAM,CAAC,QAAQ,CAAC,eAAe,CAAC,CAAC,CAAC;IAC3F,OAAO,EAAE,IAAI,EAAE,YAAY,EAAE,OAAO,EAAE,OAAO,CAAC,MAAM,EAAE,CAAC;AACzD,CAAC"}