dorfl 0.14.0 → 0.14.2

package/dist/slug-safety.js

@@ -0,0 +1,76 @@
+/**
+ * The SAFE-SLUG character set, and the one sanitiser every slug-producing path
+ * shares.
+ *
+ * A slug is not just a label: it becomes a file name (`work/<folder>/<slug>.md`),
+ * part of a git ref (`work/<slug>`, `work/intake-task-<slug>`), a command-line
+ * argument (`dorfl advance "task:<slug>"`, one per CI matrix leg) and text in
+ * commit messages. Several producers draft slugs from content an outsider can
+ * influence: `intake` from an issue's title and thread, the triage and apply
+ * rungs from an agent verdict. Before this module the only transform was
+ * `paramCase`, which keeps `$(`, backticks, quotes, `;`, `|` and `/`, and the
+ * triage/ADR paths only `trim()`med, so a drafted `../x` escaped its folder.
+ *
+ * Two functions, two jobs:
+ *
+ *   - {@link toSafeSlug} is for PRODUCERS: it turns any drafted text into a slug
+ *     made only of ASCII letters, digits and single hyphens. Its output always
+ *     passes {@link isSafeSlug}.
+ *   - {@link isSafeSlug} is for CONSUMERS: the slug resolvers refuse any slug
+ *     outside the safe set, which covers slugs no producer here minted (a
+ *     frontmatter `slug:` a human or agent wrote by hand). It is deliberately a
+ *     little wider than what {@link toSafeSlug} emits (it also allows `.` and
+ *     `_` and mixed case) so every slug already in use in a real `work/` tree
+ *     keeps resolving: those characters are inert in a file name, a ref and a
+ *     quoted shell word. `..` is still refused (path traversal), as is a leading
+ *     `-` (it would read as a command-line option) or `.` (a hidden file), and so
+ *     is a `.lock` suffix (git refuses it in a ref component).
+ */
+/**
+ * The longest slug either function accepts. Real slugs in this repo top out
+ * around 105 characters; 120 leaves room without letting a drafted essay become
+ * a file name or ref component.
+ */
+export const MAX_SLUG_LENGTH = 120;
+/** Letters, digits, `.`, `_`, `-`; starts and ends with a letter or digit. */
+const SAFE_SLUG_RE = /^[A-Za-z0-9](?:[A-Za-z0-9._-]*[A-Za-z0-9])?$/;
+/** Git refuses a ref component ending in `.lock` (its lock-file suffix). */
+const GIT_LOCK_SUFFIX_RE = /\.lock$/i;
+/**
+ * Whether `slug` is safe to use as a file name, a git ref component and a
+ * command-line argument (see the module doc for the exact set).
+ */
+export function isSafeSlug(slug) {
+    return (slug.length > 0 &&
+        slug.length <= MAX_SLUG_LENGTH &&
+        SAFE_SLUG_RE.test(slug) &&
+        !slug.includes('..') &&
+        !GIT_LOCK_SUFFIX_RE.test(slug));
+}
+/**
+ * Turn drafted text into a safe slug: accents are folded to their base letter,
+ * every run of anything other than an ASCII letter or digit becomes ONE hyphen,
+ * leading/trailing hyphens are dropped, and the result is capped at
+ * {@link MAX_SLUG_LENGTH}. Case is preserved (callers that want lower case, like
+ * `intake`, `paramCase` first). Returns `''` when nothing usable is left, so the
+ * caller's existing "no slug to derive" refusal fires instead of a junk name.
+ */
+export function toSafeSlug(input) {
+    return input
+        .normalize('NFKD')
+        .replace(/[\u0300-\u036f]/g, '')
+        .replace(/[^A-Za-z0-9]+/g, '-')
+        .replace(/^-+|-+$/g, '')
+        .slice(0, MAX_SLUG_LENGTH)
+        .replace(/-+$/, '');
+}
+/**
+ * Keep a slug that is already safe EXACTLY as it is, and sanitise one that is
+ * not. The producers use this so every input that worked before still yields
+ * the same slug, and only an unsafe one changes.
+ */
+export function ensureSafeSlug(input) {
+    const trimmed = input.trim();
+    return isSafeSlug(trimmed) ? trimmed : toSafeSlug(trimmed);
+}
+//# sourceMappingURL=slug-safety.js.map

package/dist/slug-safety.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"slug-safety.js","sourceRoot":"","sources":["../src/slug-safety.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AAEH;;;;GAIG;AACH,MAAM,CAAC,MAAM,eAAe,GAAG,GAAG,CAAC;AAEnC,8EAA8E;AAC9E,MAAM,YAAY,GAAG,8CAA8C,CAAC;AAEpE,4EAA4E;AAC5E,MAAM,kBAAkB,GAAG,UAAU,CAAC;AAEtC;;;GAGG;AACH,MAAM,UAAU,UAAU,CAAC,IAAY;IACtC,OAAO,CACN,IAAI,CAAC,MAAM,GAAG,CAAC;QACf,IAAI,CAAC,MAAM,IAAI,eAAe;QAC9B,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC;QACvB,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC;QACpB,CAAC,kBAAkB,CAAC,IAAI,CAAC,IAAI,CAAC,CAC9B,CAAC;AACH,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,UAAU,CAAC,KAAa;IACvC,OAAO,KAAK;SACV,SAAS,CAAC,MAAM,CAAC;SACjB,OAAO,CAAC,kBAAkB,EAAE,EAAE,CAAC;SAC/B,OAAO,CAAC,gBAAgB,EAAE,GAAG,CAAC;SAC9B,OAAO,CAAC,UAAU,EAAE,EAAE,CAAC;SACvB,KAAK,CAAC,CAAC,EAAE,eAAe,CAAC;SACzB,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;AACtB,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,cAAc,CAAC,KAAa;IAC3C,MAAM,OAAO,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC;IAC7B,OAAO,UAAU,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC;AAC5D,CAAC"}

package/dist/triage-persist.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"triage-persist.d.ts","sourceRoot":"","sources":["../src/triage-persist.ts"],"names":[],"mappings":"AAIA,OAAO,EAEN,KAAK,mBAAmB,EAExB,MAAM,qBAAqB,CAAC;AAE7B,OAAO,KAAK,EAAC,cAAc,EAAC,MAAM,kBAAkB,CAAC;AA2GrD,2EAA2E;AAC3E,qBAAa,kBAAmB,SAAQ,KAAK;gBAChC,OAAO,EAAE,MAAM;CAI3B;AAID,MAAM,WAAW,yBAAyB;IACzC,mDAAmD;IACnD,GAAG,EAAE,MAAM,CAAC;IACZ,kEAAkE;IAClE,IAAI,EAAE,MAAM,CAAC;IACb,mDAAmD;IACnD,QAAQ,EAAE,MAAM,CAAC;IACjB,4EAA4E;IAC5E,KAAK,EAAE,MAAM,CAAC;IACd,qEAAqE;IACrE,MAAM,EAAE,MAAM,CAAC;IACf,+EAA+E;IAC/E,EAAE,CAAC,EAAE,MAAM,CAAC;IACZ,2CAA2C;IAC3C,GAAG,CAAC,EAAE,MAAM,CAAC,UAAU,CAAC;IACxB,8CAA8C;IAC9C,IAAI,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,IAAI,CAAC;CACjC;AAED,MAAM,WAAW,wBAAwB;IACxC,0FAA0F;IAC1F,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,gCAAgC;IAChC,OAAO,EAAE,MAAM,CAAC;CAChB;AAED;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,wBAAgB,kBAAkB,CACjC,OAAO,EAAE,yBAAyB,GAChC,wBAAwB,CAyC1B;AAID,MAAM,WAAW,sBAAsB;IACtC,yDAAyD;IACzD,GAAG,EAAE,MAAM,CAAC;IACZ,kEAAkE;IAClE,IAAI,EAAE,MAAM,CAAC;IACb,2FAA2F;IAC3F,QAAQ,EAAE,MAAM,CAAC;IACjB,kDAAkD;IAClD,IAAI,EAAE,cAAc,CAAC;IACrB,4EAA4E;IAC5E,QAAQ,EAAE,MAAM,CAAC;IACjB,oDAAoD;IACpD,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,+EAA+E;IAC/E,EAAE,CAAC,EAAE,MAAM,CAAC;IACZ,2CAA2C;IAC3C,GAAG,CAAC,EAAE,MAAM,CAAC,UAAU,CAAC;IACxB,8CAA8C;IAC9C,IAAI,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,IAAI,CAAC;CACjC;AAED,MAAM,WAAW,qBAAqB;IACrC;;;;;;;;;;OAUG;IACH,OAAO,EAAE,SAAS,CAAC;IACnB,+CAA+C;IAC/C,MAAM,EAAE,MAAM,CAAC;IACf,4FAA4F;IAC5F,QAAQ,EAAE,MAAM,CAAC;IACjB,gCAAgC;IAChC,OAAO,EAAE,MAAM,CAAC;CAChB;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,wBAAgB,0BAA0B,CACzC,OAAO,EAAE,sBAAsB,GAC7B,qBAAqB,CA8BvB;AAID,MAAM,WAAW,yBAAyB;IACzC,kDAAkD;IAClD,GAAG,EAAE,MAAM,CAAC;IACZ,kEAAkE;IAClE,IAAI,EAAE,MAAM,CAAC;IACb,2FAA2F;IAC3F,QAAQ,EAAE,MAAM,CAAC;IACjB;;;;;;;;;;;OAWG;IACH,QAAQ,CAAC,EAAE,MAAM,GAAG,MAAM,CAAC;IAC3B;;;;OAIG;IACH,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB;;;;;OAKG;IACH,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,sEAAsE;IACtE,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,+EAA+E;IAC/E,EAAE,CAAC,EAAE,MAAM,CAAC;IACZ,2CAA2C;IAC3C,GAAG,CAAC,EAAE,MAAM,CAAC,UAAU,CAAC;IACxB,6EAA6E;IAC7E,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB;;;;;;;OAOG;IACH,UAAU,CAAC,EAAE,mBAAmB,CAAC;IACjC,8CAA8C;IAC9C,IAAI,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,IAAI,CAAC;CACjC;AAED,MAAM,WAAW,wBAAwB;IACxC;;;;;;;;;OASG;IACH,OAAO,EACJ,UAAU,GACV,iBAAiB,GACjB,MAAM,GACN,WAAW,GACX,aAAa,CAAC;IACjB,QAAQ,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IACxB,4DAA4D;IAC5D,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,gCAAgC;IAChC,OAAO,EAAE,MAAM,CAAC;CAChB;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AACH,wBAAsB,kBAAkB,CACvC,OAAO,EAAE,yBAAyB,GAChC,OAAO,CAAC,wBAAwB,CAAC,CAwGnC"}
+{"version":3,"file":"triage-persist.d.ts","sourceRoot":"","sources":["../src/triage-persist.ts"],"names":[],"mappings":"AAIA,OAAO,EAEN,KAAK,mBAAmB,EAExB,MAAM,qBAAqB,CAAC;AAE7B,OAAO,KAAK,EAAC,cAAc,EAAC,MAAM,kBAAkB,CAAC;AA4GrD,2EAA2E;AAC3E,qBAAa,kBAAmB,SAAQ,KAAK;gBAChC,OAAO,EAAE,MAAM;CAI3B;AAID,MAAM,WAAW,yBAAyB;IACzC,mDAAmD;IACnD,GAAG,EAAE,MAAM,CAAC;IACZ,kEAAkE;IAClE,IAAI,EAAE,MAAM,CAAC;IACb,mDAAmD;IACnD,QAAQ,EAAE,MAAM,CAAC;IACjB,4EAA4E;IAC5E,KAAK,EAAE,MAAM,CAAC;IACd,qEAAqE;IACrE,MAAM,EAAE,MAAM,CAAC;IACf,+EAA+E;IAC/E,EAAE,CAAC,EAAE,MAAM,CAAC;IACZ,2CAA2C;IAC3C,GAAG,CAAC,EAAE,MAAM,CAAC,UAAU,CAAC;IACxB,8CAA8C;IAC9C,IAAI,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,IAAI,CAAC;CACjC;AAED,MAAM,WAAW,wBAAwB;IACxC,0FAA0F;IAC1F,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,gCAAgC;IAChC,OAAO,EAAE,MAAM,CAAC;CAChB;AAED;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,wBAAgB,kBAAkB,CACjC,OAAO,EAAE,yBAAyB,GAChC,wBAAwB,CAyC1B;AAID,MAAM,WAAW,sBAAsB;IACtC,yDAAyD;IACzD,GAAG,EAAE,MAAM,CAAC;IACZ,kEAAkE;IAClE,IAAI,EAAE,MAAM,CAAC;IACb,2FAA2F;IAC3F,QAAQ,EAAE,MAAM,CAAC;IACjB,kDAAkD;IAClD,IAAI,EAAE,cAAc,CAAC;IACrB,4EAA4E;IAC5E,QAAQ,EAAE,MAAM,CAAC;IACjB,oDAAoD;IACpD,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,+EAA+E;IAC/E,EAAE,CAAC,EAAE,MAAM,CAAC;IACZ,2CAA2C;IAC3C,GAAG,CAAC,EAAE,MAAM,CAAC,UAAU,CAAC;IACxB,8CAA8C;IAC9C,IAAI,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,IAAI,CAAC;CACjC;AAED,MAAM,WAAW,qBAAqB;IACrC;;;;;;;;;;OAUG;IACH,OAAO,EAAE,SAAS,CAAC;IACnB,+CAA+C;IAC/C,MAAM,EAAE,MAAM,CAAC;IACf,4FAA4F;IAC5F,QAAQ,EAAE,MAAM,CAAC;IACjB,gCAAgC;IAChC,OAAO,EAAE,MAAM,CAAC;CAChB;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,wBAAgB,0BAA0B,CACzC,OAAO,EAAE,sBAAsB,GAC7B,qBAAqB,CA8BvB;AAID,MAAM,WAAW,yBAAyB;IACzC,kDAAkD;IAClD,GAAG,EAAE,MAAM,CAAC;IACZ,kEAAkE;IAClE,IAAI,EAAE,MAAM,CAAC;IACb,2FAA2F;IAC3F,QAAQ,EAAE,MAAM,CAAC;IACjB;;;;;;;;;;;OAWG;IACH,QAAQ,CAAC,EAAE,MAAM,GAAG,MAAM,CAAC;IAC3B;;;;OAIG;IACH,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB;;;;;OAKG;IACH,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,sEAAsE;IACtE,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,+EAA+E;IAC/E,EAAE,CAAC,EAAE,MAAM,CAAC;IACZ,2CAA2C;IAC3C,GAAG,CAAC,EAAE,MAAM,CAAC,UAAU,CAAC;IACxB,6EAA6E;IAC7E,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB;;;;;;;OAOG;IACH,UAAU,CAAC,EAAE,mBAAmB,CAAC;IACjC,8CAA8C;IAC9C,IAAI,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,IAAI,CAAC;CACjC;AAED,MAAM,WAAW,wBAAwB;IACxC;;;;;;;;;OASG;IACH,OAAO,EACJ,UAAU,GACV,iBAAiB,GACjB,MAAM,GACN,WAAW,GACX,aAAa,CAAC;IACjB,QAAQ,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IACxB,4DAA4D;IAC5D,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,gCAAgC;IAChC,OAAO,EAAE,MAAM,CAAC;CAChB;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AACH,wBAAsB,kBAAkB,CACvC,OAAO,EAAE,yBAAyB,GAChC,OAAO,CAAC,wBAAwB,CAAC,CA6GnC"}

package/dist/triage-persist.js

@@ -6,6 +6,7 @@ import { createItemThroughCas, } from './advancing-lock.js';
 import { resolveSidecarIdentity, sidecarPathFor } from './sidecar.js';
 import { renderTaskBody, renderSpecBody } from './buildable-body.js';
 import { setFrontmatterMarker } from './frontmatter.js';
+import { ensureSafeSlug } from './slug-safety.js';
 /**
  * The engine-owned TRIAGE PERSIST (spec `advance-loop`, task `advance-rung-triage`,
  * US #16/17/24/30) — the half of the observation-triage rung the ENGINE owns (the
@@ -232,7 +233,9 @@ export async function promoteObservation(options) {
     const { cwd, item, itemPath, env } = options;
     const note = options.note ?? (() => { });
     const { slug: obsSlug } = resolveSidecarIdentity(item);
-    const newSlug = (options.newSlug ?? obsSlug).trim();
+    // The drafted slug comes from an agent verdict: an unsafe one (a `/`, `..`,
+    // shell metacharacters) is sanitised, a safe one is kept exactly as drafted.
+    const newSlug = ensureSafeSlug(options.newSlug ?? obsSlug);
     const artifact = options.artifact ?? 'task';
     if (newSlug === '') {
         return {
@@ -256,8 +259,14 @@ export async function promoteObservation(options) {
     // review-nits back-pointer); this is the triage-promote lineage. Matching on this
     // explicit field — not the slug — is what keeps an unrelated same-slug task from
     // false-positiving into a benign skip.
-    const content = setFrontmatterMarker(ensureTaskDispatchable(artifact, newSlug, options.stubContent ??
-        buildPromotedBody(artifact, newSlug, readItem(cwd, itemPath, env))), 'promotedFrom', item);
+    // A drafted `stubContent` carries its own frontmatter, and the ledger reads
+    // `slug:` before the file name, so stamp the SAFE slug over whatever the
+    // draft said: otherwise a drafted `slug: ../x` would become the item's
+    // identity even though the file name was sanitised.
+    const drafted = options.stubContent !== undefined
+        ? setFrontmatterMarker(options.stubContent, 'slug', newSlug)
+        : buildPromotedBody(artifact, newSlug, readItem(cwd, itemPath, env));
+    const content = setFrontmatterMarker(ensureTaskDispatchable(artifact, newSlug, drafted), 'promotedFrom', item);
     // The note + its answered sidecar `git rm` IN THE SAME create commit (promote =
     // ONE atomic commit). A CAS LOSER never reaches the commit, so it leaves both
     // INTACT for a retry (today's loser-backs-off guarantee, now over deletion).

package/dist/triage-persist.js.map

@@ -1 +1 @@
-{"version":3,"file":"triage-persist.js","sourceRoot":"","sources":["../src/triage-persist.ts"],"names":[],"mappings":"AAAA,OAAO,EAAC,YAAY,EAAE,aAAa,EAAC,MAAM,SAAS,CAAC;AACpD,OAAO,EAAC,IAAI,EAAC,MAAM,WAAW,CAAC;AAC/B,OAAO,EAAC,GAAG,EAAiB,MAAM,UAAU,CAAC;AAC7C,OAAO,EAAC,WAAW,EAAC,MAAM,kBAAkB,CAAC;AAC7C,OAAO,EACN,oBAAoB,GAGpB,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EAAC,sBAAsB,EAAE,cAAc,EAAC,MAAM,cAAc,CAAC;AAEpE,OAAO,EAAC,cAAc,EAAE,cAAc,EAAC,MAAM,qBAAqB,CAAC;AACnE,OAAO,EAAC,oBAAoB,EAAC,MAAM,kBAAkB,CAAC;AAEtD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAmDG;AAEH,SAAS,OAAO,CACf,IAAc,EACd,GAAW,EACX,GAAkC;IAElC,OAAO,GAAG,CAAC,KAAK,EAAE,IAAI,EAAE,GAAG,EAAE,EAAC,GAAG,EAAC,CAAC,CAAC;AACrC,CAAC;AAED,SAAS,OAAO,CACf,IAAc,EACd,GAAW,EACX,GAAkC;IAElC,MAAM,MAAM,GAAG,GAAG,CAAC,KAAK,EAAE,IAAI,EAAE,GAAG,EAAE,EAAC,GAAG,EAAC,CAAC,CAAC;IAC5C,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACzB,MAAM,IAAI,kBAAkB,CAC3B,OAAO,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,iBAAiB,MAAM,CAAC,MAAM,MAAM,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,EAAE,CAC/E,CAAC;IACH,CAAC;IACD,OAAO,MAAM,CAAC;AACf,CAAC;AAED,SAAS,SAAS,CAAC,GAAW,EAAE,GAAkC;IACjE,MAAM,IAAI,GAAG,OAAO,CAAC,CAAC,QAAQ,EAAE,WAAW,CAAC,EAAE,GAAG,EAAE,GAAG,CAAC,CAAC;IACxD,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,IAAI,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC;QACpD,OAAO,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC;IAC3B,CAAC;IACD,MAAM,CAAC,GAAG,GAAG,IAAI,OAAO,CAAC,GAAG,CAAC;IAC7B,OAAO,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC,QAAQ,IAAI,EAAE,CAAC;AACnC,CAAC;AAED,iFAAiF;AACjF,SAAS,QAAQ,CAChB,GAAW,EACX,QAAgB,EAChB,GAAkC;IAElC,MAAM,IAAI,GAAG,OAAO,CAAC,CAAC,MAAM,EAAE,IAAI,QAAQ,EAAE,CAAC,EAAE,GAAG,EAAE,GAAG,CAAC,CAAC;IACzD,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACvB,OAAO,IAAI,CAAC,MAAM,CAAC;IACpB,CAAC;IACD,IAAI,CAAC;QACJ,OAAO,YAAY,CAAC,IAAI,CAAC,GAAG,EAAE,QAAQ,CAAC,EAAE,MAAM,CAAC,CAAC;IAClD,CAAC;IAAC,MAAM,CAAC;QACR,MAAM,IAAI,kBAAkB,CAC3B,qCAAqC,QAAQ,yCAAyC,CACtF,CAAC;IACH,CAAC;AACF,CAAC;AAED,2EAA2E;AAC3E,MAAM,OAAO,kBAAmB,SAAQ,KAAK;IAC5C,YAAY,OAAe;QAC1B,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,oBAAoB,CAAC;IAClC,CAAC;CACD;AA8BD;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,MAAM,UAAU,kBAAkB,CACjC,OAAkC;IAElC,MAAM,EAAC,GAAG,EAAE,IAAI,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,EAAC,GAAG,OAAO,CAAC;IAC1D,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,IAAI,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;IAExC,IAAI,OAAO,CAAC,CAAC,WAAW,EAAE,WAAW,CAAC,EAAE,GAAG,EAAE,GAAG,CAAC,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAChE,MAAM,IAAI,kBAAkB,CAAC,6BAA6B,CAAC,CAAC;IAC7D,CAAC;IAED,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC;IAChC,MAAM,MAAM,GAAG,YAAY,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;IACzC,MAAM,KAAK,GAAG,oBAAoB,CAAC,MAAM,EAAE,SAAS,EAAE,KAAK,CAAC,CAAC;IAC7D,IAAI,KAAK,KAAK,MAAM,EAAE,CAAC;QACtB,yEAAyE;QACzE,+DAA+D;QAC/D,MAAM,OAAO,GAAG,UAAU,IAAI,6BAA6B,KAAK,qBAAqB,CAAC;QACtF,IAAI,CAAC,OAAO,CAAC,CAAC;QACd,OAAO,EAAC,OAAO,EAAC,CAAC;IAClB,CAAC;IACD,aAAa,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;IAC1B,MAAM,EAAE,GAAG,OAAO,CAAC,EAAE,IAAI,SAAS,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;IAC7C,OAAO,CAAC,CAAC,KAAK,EAAE,IAAI,EAAE,QAAQ,CAAC,EAAE,GAAG,EAAE,GAAG,CAAC,CAAC;IAC3C,MAAM,OAAO,GAAG,mBAAmB,IAAI,kBAAkB,EAAE,GAAG,CAAC;IAC/D,OAAO,CACN;QACC,QAAQ;QACR,SAAS;QACT,IAAI;QACJ,OAAO;QACP,IAAI;QACJ,YAAY,KAAK,OAAO,MAAM,EAAE;KAChC,EACD,GAAG,EACH,GAAG,CACH,CAAC;IACF,MAAM,MAAM,GAAG,OAAO,CAAC,CAAC,WAAW,EAAE,MAAM,CAAC,EAAE,GAAG,EAAE,GAAG,CAAC,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC;IACtE,MAAM,OAAO,GACZ,UAAU,IAAI,0BAA0B,KAAK,yBAAyB;QACtE,2EAA2E;QAC3E,0DAA0D,CAAC;IAC5D,IAAI,CAAC,OAAO,CAAC,CAAC;IACd,OAAO,EAAC,MAAM,EAAE,OAAO,EAAC,CAAC;AAC1B,CAAC;AA8CD;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAM,UAAU,0BAA0B,CACzC,OAA+B;IAE/B,MAAM,EAAC,GAAG,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,QAAQ,EAAE,GAAG,EAAC,GAAG,OAAO,CAAC;IAC3D,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,IAAI,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;IAExC,IAAI,OAAO,CAAC,CAAC,WAAW,EAAE,WAAW,CAAC,EAAE,GAAG,EAAE,GAAG,CAAC,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAChE,MAAM,IAAI,kBAAkB,CAAC,6BAA6B,CAAC,CAAC;IAC7D,CAAC;IAED,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;IAC5C,MAAM,EAAE,GAAG,OAAO,CAAC,EAAE,IAAI,SAAS,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;IAE7C,kFAAkF;IAClF,iFAAiF;IACjF,mFAAmF;IACnF,OAAO,CAAC,CAAC,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,QAAQ,CAAC,EAAE,GAAG,EAAE,GAAG,CAAC,CAAC;IACrD,MAAM,YAAY,GACjB,IAAI,KAAK,WAAW;QACnB,CAAC,CAAC,yBAAyB,QAAQ,qDAAqD;QACxF,CAAC,CAAC,6BAA6B,QAAQ,+DAA+D,CAAC;IACzG,MAAM,OAAO,GAAG,mBAAmB,IAAI,MAAM,IAAI,QAAQ,EAAE,GAAG,CAAC;IAC/D,MAAM,WAAW,GAChB,2BAA2B,YAAY,gCAAgC;QACvE,CAAC,MAAM,KAAK,EAAE,CAAC,CAAC,CAAC,eAAe,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;IAChD,OAAO,CAAC,CAAC,QAAQ,EAAE,SAAS,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,WAAW,CAAC,EAAE,GAAG,EAAE,GAAG,CAAC,CAAC;IAC3E,MAAM,MAAM,GAAG,OAAO,CAAC,CAAC,WAAW,EAAE,MAAM,CAAC,EAAE,GAAG,EAAE,GAAG,CAAC,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC;IACtE,MAAM,OAAO,GACZ,gBAAgB,IAAI,MAAM,IAAI,OAAO,QAAQ,0BAA0B;QACvE,8FAA8F,CAAC;IAChG,IAAI,CAAC,OAAO,CAAC,CAAC;IACd,OAAO,EAAC,OAAO,EAAE,SAAS,EAAE,MAAM,EAAE,QAAQ,EAAE,OAAO,EAAC,CAAC;AACxD,CAAC;AAkFD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AACH,MAAM,CAAC,KAAK,UAAU,kBAAkB,CACvC,OAAkC;IAElC,MAAM,EAAC,GAAG,EAAE,IAAI,EAAE,QAAQ,EAAE,GAAG,EAAC,GAAG,OAAO,CAAC;IAC3C,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,IAAI,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;IAExC,MAAM,EAAC,IAAI,EAAE,OAAO,EAAC,GAAG,sBAAsB,CAAC,IAAI,CAAC,CAAC;IACrD,MAAM,OAAO,GAAG,CAAC,OAAO,CAAC,OAAO,IAAI,OAAO,CAAC,CAAC,IAAI,EAAE,CAAC;IACpD,MAAM,QAAQ,GAAG,OAAO,CAAC,QAAQ,IAAI,MAAM,CAAC;IAC5C,IAAI,OAAO,KAAK,EAAE,EAAE,CAAC;QACpB,OAAO;YACN,OAAO,EAAE,aAAa;YACtB,QAAQ,EAAE,CAAC;YACX,OAAO,EAAE,WAAW,IAAI,qCAAqC,QAAQ,EAAE;SACvE,CAAC;IACH,CAAC;IACD,+EAA+E;IAC/E,mFAAmF;IACnF,4EAA4E;IAC5E,kEAAkE;IAClE,MAAM,WAAW,GAAG,WAAW,CAC9B,QAAQ,KAAK,MAAM,CAAC,CAAC,CAAC,gBAAgB,CAAC,CAAC,CAAC,aAAa,EACtD,GAAG,OAAO,KAAK,CACf,CAAC;IACF,MAAM,EAAE,GAAG,OAAO,CAAC,EAAE,IAAI,SAAS,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;IAC7C,mFAAmF;IACnF,iFAAiF;IACjF,gFAAgF;IAChF,kFAAkF;IAClF,mFAAmF;IACnF,gFAAgF;IAChF,kFAAkF;IAClF,iFAAiF;IACjF,uCAAuC;IACvC,MAAM,OAAO,GAAG,oBAAoB,CACnC,sBAAsB,CACrB,QAAQ,EACR,OAAO,EACP,OAAO,CAAC,WAAW;QAClB,iBAAiB,CAAC,QAAQ,EAAE,OAAO,EAAE,QAAQ,CAAC,GAAG,EAAE,QAAQ,EAAE,GAAG,CAAC,CAAC,CACnE,EACD,cAAc,EACd,IAAI,CACJ,CAAC;IAEF,gFAAgF;IAChF,8EAA8E;IAC9E,6EAA6E;IAC7E,MAAM,WAAW,GAAG,cAAc,CAAC,IAAI,CAAC,CAAC;IAEzC,2EAA2E;IAC3E,2EAA2E;IAC3E,8CAA8C;IAC9C,MAAM,OAAO,GAA+B,MAAM,oBAAoB,CAAC;QACtE,IAAI,EAAE,WAAW;QACjB,OAAO;QACP,WAAW,EAAE,CAAC,QAAQ,EAAE,WAAW,CAAC;QACpC,yEAAyE;QACzE,+EAA+E;QAC/E,sEAAsE;QACtE,UAAU,EAAE,IAAI;QAChB,GAAG;QACH,OAAO,EAAE,OAAO,CAAC,OAAO;QACxB,EAAE;QACF,MAAM,EAAE,OAAO,CAAC,MAAM;QACtB,GAAG;QACH,IAAI;QACJ,GAAG,CAAC,OAAO,CAAC,UAAU,KAAK,SAAS;YACnC,CAAC,CAAC,EAAC,UAAU,EAAE,OAAO,CAAC,UAAU,EAAC;YAClC,CAAC,CAAC,EAAE,CAAC;KACN,CAAC,CAAC;IACH,4EAA4E;IAC5E,iFAAiF;IACjF,mFAAmF;IACnF,wEAAwE;IACxE,0EAA0E;IAC1E,IAAI,OAAO,CAAC,OAAO,KAAK,4BAA4B,EAAE,CAAC;QACtD,MAAM,OAAO,GACZ,WAAW,IAAI,KAAK,WAAW,4CAA4C;YAC3E,mBAAmB,OAAO,CAAC,OAAO,6CAA6C,CAAC;QACjF,IAAI,CAAC,OAAO,CAAC,CAAC;QACd,OAAO;YACN,OAAO,EAAE,iBAAiB;YAC1B,QAAQ,EAAE,CAAC;YACX,WAAW;YACX,OAAO;SACP,CAAC;IACH,CAAC;IACD,IAAI,OAAO,CAAC,QAAQ,KAAK,CAAC,EAAE,CAAC;QAC5B,MAAM,OAAO,GACZ,WAAW,IAAI,kBAAkB,WAAW,IAAI,OAAO,CAAC,OAAO,OAAO;YACtE,eAAe,OAAO,CAAC,OAAO,2CAA2C;YACzE,qBAAqB,CAAC;QACvB,IAAI,CAAC,OAAO,CAAC,CAAC;QACd,OAAO;YACN,OAAO,EAAE,OAAO,CAAC,OAAO,KAAK,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,WAAW;YAC1D,QAAQ,EAAE,OAAO,CAAC,QAAQ;YAC1B,OAAO;SACP,CAAC;IACH,CAAC;IAED,MAAM,OAAO,GACZ,YAAY,IAAI,cAAc,WAAW,+BAA+B;QACxE,+CAA+C,CAAC;IACjD,IAAI,CAAC,OAAO,CAAC,CAAC;IACd,OAAO,EAAC,OAAO,EAAE,UAAU,EAAE,QAAQ,EAAE,CAAC,EAAE,WAAW,EAAE,OAAO,EAAC,CAAC;AACjE,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAkCG;AACH;;;;;;;;;;;;;GAaG;AACH,SAAS,sBAAsB,CAC9B,QAAyB,EACzB,IAAY,EACZ,IAAY;IAEZ,IAAI,QAAQ,KAAK,MAAM,EAAE,CAAC;QACzB,OAAO,IAAI,CAAC;IACb,CAAC;IACD,iFAAiF;IACjF,oDAAoD;IACpD,IAAI,kBAAkB,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;QACnC,OAAO,IAAI,CAAC;IACb,CAAC;IACD,4EAA4E;IAC5E,6EAA6E;IAC7E,+DAA+D;IAC/D,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;IACzC,MAAM,IAAI,GAAG,mBAAmB,IAAI,qBAAqB,CAAC;IAC1D,MAAM,WAAW,GAAG,kBAAkB,IAAI,IAAI,CAAC;IAC/C,OAAO,GAAG,OAAO,OAAO,WAAW,EAAE,CAAC;AACvC,CAAC;AAED,SAAS,iBAAiB,CACzB,QAAyB,EACzB,IAAY,EACZ,WAAmB;IAEnB,MAAM,EAAC,SAAS,EAAE,aAAa,EAAC,GAAG,oBAAoB,CAAC,WAAW,CAAC,CAAC;IACrE,MAAM,YAAY,GAAG,aAAa,CAAC,IAAI,EAAE,KAAK,EAAE,CAAC;IACjD,MAAM,WAAW,GAAa;QAC7B,KAAK;QACL,UAAU,IAAI,EAAE;QAChB,SAAS,IAAI,EAAE;QACf,iBAAiB,YAAY,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,OAAO,EAAE;QAClD,iFAAiF;QACjF,eAAe;QACf,GAAG,CAAC,QAAQ,KAAK,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,eAAe,CAAC,CAAC;QACjD,KAAK;KACL,CAAC;IACF,2EAA2E;IAC3E,kFAAkF;IAClF,+EAA+E;IAC/E,8EAA8E;IAC9E,gFAAgF;IAChF,wEAAwE;IACxE,wFAAwF;IACxF,+EAA+E;IAC/E,iEAAiE;IACjE,MAAM,WAAW,GAAG,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,MAAM,CAAC;IACpD,+EAA+E;IAC/E,+CAA+C;IAC/C,+EAA+E;IAC/E,iEAAiE;IACjE,2CAA2C;IAC3C,IAAI,QAAQ,KAAK,MAAM,EAAE,CAAC;QACzB,OAAO,CACN,WAAW;YACX,cAAc,CAAC;gBACd,gBAAgB,EAAE,SAAS;gBAC3B,aAAa;aACb,CAAC,CACF,CAAC;IACH,CAAC;IACD,gFAAgF;IAChF,gFAAgF;IAChF,8EAA8E;IAC9E,6EAA6E;IAC7E,+EAA+E;IAC/E,0DAA0D;IAC1D,MAAM,UAAU,GACf,SAAS,CAAC,IAAI,EAAE,KAAK,EAAE;QACtB,CAAC,CAAC,mBAAmB,IAAI,qBAAqB;QAC9C,CAAC,CAAC,SAAS,CAAC;IACd,OAAO,CACN,WAAW;QACX,cAAc,CAAC;YACd,WAAW,EAAE,SAAS;YACtB,aAAa;YACb,MAAM,EAAE,UAAU;SAClB,CAAC,CACF,CAAC;AACH,CAAC;AAED;;;;;;GAMG;AACH,SAAS,oBAAoB,CAAC,WAAmB;IAIhD,MAAM,IAAI,GAAG,gBAAgB,CAAC,WAAW,CAAC,CAAC;IAC3C,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IAC/B,wDAAwD;IACxD,qEAAqE;IACrE,MAAM,QAAQ,GAAG,KAAK,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,yBAAyB,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;IAC3E,IAAI,QAAQ,KAAK,CAAC,CAAC,EAAE,CAAC;QACrB,OAAO,EAAC,SAAS,EAAE,IAAI,EAAE,aAAa,EAAE,EAAE,EAAC,CAAC;IAC7C,CAAC;IACD,IAAI,MAAM,GAAG,KAAK,CAAC,MAAM,CAAC;IAC1B,KAAK,IAAI,CAAC,GAAG,QAAQ,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QAClD,IAAI,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;YAC7B,MAAM,GAAG,CAAC,CAAC;YACX,MAAM;QACP,CAAC;IACF,CAAC;IACD,MAAM,SAAS,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,QAAQ,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACtD,MAAM,aAAa,GAAG,KAAK,CAAC,KAAK,CAAC,QAAQ,GAAG,CAAC,EAAE,MAAM,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACnE,OAAO,EAAC,SAAS,EAAE,aAAa,EAAC,CAAC;AACnC,CAAC;AAED,2EAA2E;AAC3E,SAAS,gBAAgB,CAAC,OAAe;IACxC,MAAM,UAAU,GAAG,OAAO,CAAC,OAAO,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC,OAAO,CAAC,SAAS,EAAE,EAAE,CAAC,CAAC;IACzE,IAAI,CAAC,UAAU,CAAC,UAAU,CAAC,OAAO,CAAC,EAAE,CAAC;QACrC,OAAO,UAAU,CAAC;IACnB,CAAC;IACD,MAAM,KAAK,GAAG,UAAU,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IACrC,MAAM,OAAO,GAAG,KAAK,CAAC,OAAO,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC;IACxC,IAAI,OAAO,KAAK,CAAC,CAAC,EAAE,CAAC;QACpB,OAAO,UAAU,CAAC;IACnB,CAAC;IACD,OAAO,KAAK;SACV,KAAK,CAAC,OAAO,GAAG,CAAC,CAAC;SAClB,IAAI,CAAC,IAAI,CAAC;SACV,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;AACvB,CAAC"}
+{"version":3,"file":"triage-persist.js","sourceRoot":"","sources":["../src/triage-persist.ts"],"names":[],"mappings":"AAAA,OAAO,EAAC,YAAY,EAAE,aAAa,EAAC,MAAM,SAAS,CAAC;AACpD,OAAO,EAAC,IAAI,EAAC,MAAM,WAAW,CAAC;AAC/B,OAAO,EAAC,GAAG,EAAiB,MAAM,UAAU,CAAC;AAC7C,OAAO,EAAC,WAAW,EAAC,MAAM,kBAAkB,CAAC;AAC7C,OAAO,EACN,oBAAoB,GAGpB,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EAAC,sBAAsB,EAAE,cAAc,EAAC,MAAM,cAAc,CAAC;AAEpE,OAAO,EAAC,cAAc,EAAE,cAAc,EAAC,MAAM,qBAAqB,CAAC;AACnE,OAAO,EAAC,oBAAoB,EAAC,MAAM,kBAAkB,CAAC;AACtD,OAAO,EAAC,cAAc,EAAC,MAAM,kBAAkB,CAAC;AAEhD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAmDG;AAEH,SAAS,OAAO,CACf,IAAc,EACd,GAAW,EACX,GAAkC;IAElC,OAAO,GAAG,CAAC,KAAK,EAAE,IAAI,EAAE,GAAG,EAAE,EAAC,GAAG,EAAC,CAAC,CAAC;AACrC,CAAC;AAED,SAAS,OAAO,CACf,IAAc,EACd,GAAW,EACX,GAAkC;IAElC,MAAM,MAAM,GAAG,GAAG,CAAC,KAAK,EAAE,IAAI,EAAE,GAAG,EAAE,EAAC,GAAG,EAAC,CAAC,CAAC;IAC5C,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACzB,MAAM,IAAI,kBAAkB,CAC3B,OAAO,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,iBAAiB,MAAM,CAAC,MAAM,MAAM,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,EAAE,CAC/E,CAAC;IACH,CAAC;IACD,OAAO,MAAM,CAAC;AACf,CAAC;AAED,SAAS,SAAS,CAAC,GAAW,EAAE,GAAkC;IACjE,MAAM,IAAI,GAAG,OAAO,CAAC,CAAC,QAAQ,EAAE,WAAW,CAAC,EAAE,GAAG,EAAE,GAAG,CAAC,CAAC;IACxD,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,IAAI,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC;QACpD,OAAO,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC;IAC3B,CAAC;IACD,MAAM,CAAC,GAAG,GAAG,IAAI,OAAO,CAAC,GAAG,CAAC;IAC7B,OAAO,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC,QAAQ,IAAI,EAAE,CAAC;AACnC,CAAC;AAED,iFAAiF;AACjF,SAAS,QAAQ,CAChB,GAAW,EACX,QAAgB,EAChB,GAAkC;IAElC,MAAM,IAAI,GAAG,OAAO,CAAC,CAAC,MAAM,EAAE,IAAI,QAAQ,EAAE,CAAC,EAAE,GAAG,EAAE,GAAG,CAAC,CAAC;IACzD,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACvB,OAAO,IAAI,CAAC,MAAM,CAAC;IACpB,CAAC;IACD,IAAI,CAAC;QACJ,OAAO,YAAY,CAAC,IAAI,CAAC,GAAG,EAAE,QAAQ,CAAC,EAAE,MAAM,CAAC,CAAC;IAClD,CAAC;IAAC,MAAM,CAAC;QACR,MAAM,IAAI,kBAAkB,CAC3B,qCAAqC,QAAQ,yCAAyC,CACtF,CAAC;IACH,CAAC;AACF,CAAC;AAED,2EAA2E;AAC3E,MAAM,OAAO,kBAAmB,SAAQ,KAAK;IAC5C,YAAY,OAAe;QAC1B,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,oBAAoB,CAAC;IAClC,CAAC;CACD;AA8BD;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,MAAM,UAAU,kBAAkB,CACjC,OAAkC;IAElC,MAAM,EAAC,GAAG,EAAE,IAAI,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,EAAC,GAAG,OAAO,CAAC;IAC1D,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,IAAI,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;IAExC,IAAI,OAAO,CAAC,CAAC,WAAW,EAAE,WAAW,CAAC,EAAE,GAAG,EAAE,GAAG,CAAC,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAChE,MAAM,IAAI,kBAAkB,CAAC,6BAA6B,CAAC,CAAC;IAC7D,CAAC;IAED,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC;IAChC,MAAM,MAAM,GAAG,YAAY,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;IACzC,MAAM,KAAK,GAAG,oBAAoB,CAAC,MAAM,EAAE,SAAS,EAAE,KAAK,CAAC,CAAC;IAC7D,IAAI,KAAK,KAAK,MAAM,EAAE,CAAC;QACtB,yEAAyE;QACzE,+DAA+D;QAC/D,MAAM,OAAO,GAAG,UAAU,IAAI,6BAA6B,KAAK,qBAAqB,CAAC;QACtF,IAAI,CAAC,OAAO,CAAC,CAAC;QACd,OAAO,EAAC,OAAO,EAAC,CAAC;IAClB,CAAC;IACD,aAAa,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;IAC1B,MAAM,EAAE,GAAG,OAAO,CAAC,EAAE,IAAI,SAAS,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;IAC7C,OAAO,CAAC,CAAC,KAAK,EAAE,IAAI,EAAE,QAAQ,CAAC,EAAE,GAAG,EAAE,GAAG,CAAC,CAAC;IAC3C,MAAM,OAAO,GAAG,mBAAmB,IAAI,kBAAkB,EAAE,GAAG,CAAC;IAC/D,OAAO,CACN;QACC,QAAQ;QACR,SAAS;QACT,IAAI;QACJ,OAAO;QACP,IAAI;QACJ,YAAY,KAAK,OAAO,MAAM,EAAE;KAChC,EACD,GAAG,EACH,GAAG,CACH,CAAC;IACF,MAAM,MAAM,GAAG,OAAO,CAAC,CAAC,WAAW,EAAE,MAAM,CAAC,EAAE,GAAG,EAAE,GAAG,CAAC,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC;IACtE,MAAM,OAAO,GACZ,UAAU,IAAI,0BAA0B,KAAK,yBAAyB;QACtE,2EAA2E;QAC3E,0DAA0D,CAAC;IAC5D,IAAI,CAAC,OAAO,CAAC,CAAC;IACd,OAAO,EAAC,MAAM,EAAE,OAAO,EAAC,CAAC;AAC1B,CAAC;AA8CD;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAM,UAAU,0BAA0B,CACzC,OAA+B;IAE/B,MAAM,EAAC,GAAG,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,QAAQ,EAAE,GAAG,EAAC,GAAG,OAAO,CAAC;IAC3D,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,IAAI,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;IAExC,IAAI,OAAO,CAAC,CAAC,WAAW,EAAE,WAAW,CAAC,EAAE,GAAG,EAAE,GAAG,CAAC,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAChE,MAAM,IAAI,kBAAkB,CAAC,6BAA6B,CAAC,CAAC;IAC7D,CAAC;IAED,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;IAC5C,MAAM,EAAE,GAAG,OAAO,CAAC,EAAE,IAAI,SAAS,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;IAE7C,kFAAkF;IAClF,iFAAiF;IACjF,mFAAmF;IACnF,OAAO,CAAC,CAAC,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,QAAQ,CAAC,EAAE,GAAG,EAAE,GAAG,CAAC,CAAC;IACrD,MAAM,YAAY,GACjB,IAAI,KAAK,WAAW;QACnB,CAAC,CAAC,yBAAyB,QAAQ,qDAAqD;QACxF,CAAC,CAAC,6BAA6B,QAAQ,+DAA+D,CAAC;IACzG,MAAM,OAAO,GAAG,mBAAmB,IAAI,MAAM,IAAI,QAAQ,EAAE,GAAG,CAAC;IAC/D,MAAM,WAAW,GAChB,2BAA2B,YAAY,gCAAgC;QACvE,CAAC,MAAM,KAAK,EAAE,CAAC,CAAC,CAAC,eAAe,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;IAChD,OAAO,CAAC,CAAC,QAAQ,EAAE,SAAS,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,WAAW,CAAC,EAAE,GAAG,EAAE,GAAG,CAAC,CAAC;IAC3E,MAAM,MAAM,GAAG,OAAO,CAAC,CAAC,WAAW,EAAE,MAAM,CAAC,EAAE,GAAG,EAAE,GAAG,CAAC,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC;IACtE,MAAM,OAAO,GACZ,gBAAgB,IAAI,MAAM,IAAI,OAAO,QAAQ,0BAA0B;QACvE,8FAA8F,CAAC;IAChG,IAAI,CAAC,OAAO,CAAC,CAAC;IACd,OAAO,EAAC,OAAO,EAAE,SAAS,EAAE,MAAM,EAAE,QAAQ,EAAE,OAAO,EAAC,CAAC;AACxD,CAAC;AAkFD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AACH,MAAM,CAAC,KAAK,UAAU,kBAAkB,CACvC,OAAkC;IAElC,MAAM,EAAC,GAAG,EAAE,IAAI,EAAE,QAAQ,EAAE,GAAG,EAAC,GAAG,OAAO,CAAC;IAC3C,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,IAAI,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;IAExC,MAAM,EAAC,IAAI,EAAE,OAAO,EAAC,GAAG,sBAAsB,CAAC,IAAI,CAAC,CAAC;IACrD,4EAA4E;IAC5E,6EAA6E;IAC7E,MAAM,OAAO,GAAG,cAAc,CAAC,OAAO,CAAC,OAAO,IAAI,OAAO,CAAC,CAAC;IAC3D,MAAM,QAAQ,GAAG,OAAO,CAAC,QAAQ,IAAI,MAAM,CAAC;IAC5C,IAAI,OAAO,KAAK,EAAE,EAAE,CAAC;QACpB,OAAO;YACN,OAAO,EAAE,aAAa;YACtB,QAAQ,EAAE,CAAC;YACX,OAAO,EAAE,WAAW,IAAI,qCAAqC,QAAQ,EAAE;SACvE,CAAC;IACH,CAAC;IACD,+EAA+E;IAC/E,mFAAmF;IACnF,4EAA4E;IAC5E,kEAAkE;IAClE,MAAM,WAAW,GAAG,WAAW,CAC9B,QAAQ,KAAK,MAAM,CAAC,CAAC,CAAC,gBAAgB,CAAC,CAAC,CAAC,aAAa,EACtD,GAAG,OAAO,KAAK,CACf,CAAC;IACF,MAAM,EAAE,GAAG,OAAO,CAAC,EAAE,IAAI,SAAS,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;IAC7C,mFAAmF;IACnF,iFAAiF;IACjF,gFAAgF;IAChF,kFAAkF;IAClF,mFAAmF;IACnF,gFAAgF;IAChF,kFAAkF;IAClF,iFAAiF;IACjF,uCAAuC;IACvC,4EAA4E;IAC5E,yEAAyE;IACzE,uEAAuE;IACvE,oDAAoD;IACpD,MAAM,OAAO,GACZ,OAAO,CAAC,WAAW,KAAK,SAAS;QAChC,CAAC,CAAC,oBAAoB,CAAC,OAAO,CAAC,WAAW,EAAE,MAAM,EAAE,OAAO,CAAC;QAC5D,CAAC,CAAC,iBAAiB,CAAC,QAAQ,EAAE,OAAO,EAAE,QAAQ,CAAC,GAAG,EAAE,QAAQ,EAAE,GAAG,CAAC,CAAC,CAAC;IACvE,MAAM,OAAO,GAAG,oBAAoB,CACnC,sBAAsB,CAAC,QAAQ,EAAE,OAAO,EAAE,OAAO,CAAC,EAClD,cAAc,EACd,IAAI,CACJ,CAAC;IAEF,gFAAgF;IAChF,8EAA8E;IAC9E,6EAA6E;IAC7E,MAAM,WAAW,GAAG,cAAc,CAAC,IAAI,CAAC,CAAC;IAEzC,2EAA2E;IAC3E,2EAA2E;IAC3E,8CAA8C;IAC9C,MAAM,OAAO,GAA+B,MAAM,oBAAoB,CAAC;QACtE,IAAI,EAAE,WAAW;QACjB,OAAO;QACP,WAAW,EAAE,CAAC,QAAQ,EAAE,WAAW,CAAC;QACpC,yEAAyE;QACzE,+EAA+E;QAC/E,sEAAsE;QACtE,UAAU,EAAE,IAAI;QAChB,GAAG;QACH,OAAO,EAAE,OAAO,CAAC,OAAO;QACxB,EAAE;QACF,MAAM,EAAE,OAAO,CAAC,MAAM;QACtB,GAAG;QACH,IAAI;QACJ,GAAG,CAAC,OAAO,CAAC,UAAU,KAAK,SAAS;YACnC,CAAC,CAAC,EAAC,UAAU,EAAE,OAAO,CAAC,UAAU,EAAC;YAClC,CAAC,CAAC,EAAE,CAAC;KACN,CAAC,CAAC;IACH,4EAA4E;IAC5E,iFAAiF;IACjF,mFAAmF;IACnF,wEAAwE;IACxE,0EAA0E;IAC1E,IAAI,OAAO,CAAC,OAAO,KAAK,4BAA4B,EAAE,CAAC;QACtD,MAAM,OAAO,GACZ,WAAW,IAAI,KAAK,WAAW,4CAA4C;YAC3E,mBAAmB,OAAO,CAAC,OAAO,6CAA6C,CAAC;QACjF,IAAI,CAAC,OAAO,CAAC,CAAC;QACd,OAAO;YACN,OAAO,EAAE,iBAAiB;YAC1B,QAAQ,EAAE,CAAC;YACX,WAAW;YACX,OAAO;SACP,CAAC;IACH,CAAC;IACD,IAAI,OAAO,CAAC,QAAQ,KAAK,CAAC,EAAE,CAAC;QAC5B,MAAM,OAAO,GACZ,WAAW,IAAI,kBAAkB,WAAW,IAAI,OAAO,CAAC,OAAO,OAAO;YACtE,eAAe,OAAO,CAAC,OAAO,2CAA2C;YACzE,qBAAqB,CAAC;QACvB,IAAI,CAAC,OAAO,CAAC,CAAC;QACd,OAAO;YACN,OAAO,EAAE,OAAO,CAAC,OAAO,KAAK,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,WAAW;YAC1D,QAAQ,EAAE,OAAO,CAAC,QAAQ;YAC1B,OAAO;SACP,CAAC;IACH,CAAC;IAED,MAAM,OAAO,GACZ,YAAY,IAAI,cAAc,WAAW,+BAA+B;QACxE,+CAA+C,CAAC;IACjD,IAAI,CAAC,OAAO,CAAC,CAAC;IACd,OAAO,EAAC,OAAO,EAAE,UAAU,EAAE,QAAQ,EAAE,CAAC,EAAE,WAAW,EAAE,OAAO,EAAC,CAAC;AACjE,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAkCG;AACH;;;;;;;;;;;;;GAaG;AACH,SAAS,sBAAsB,CAC9B,QAAyB,EACzB,IAAY,EACZ,IAAY;IAEZ,IAAI,QAAQ,KAAK,MAAM,EAAE,CAAC;QACzB,OAAO,IAAI,CAAC;IACb,CAAC;IACD,iFAAiF;IACjF,oDAAoD;IACpD,IAAI,kBAAkB,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;QACnC,OAAO,IAAI,CAAC;IACb,CAAC;IACD,4EAA4E;IAC5E,6EAA6E;IAC7E,+DAA+D;IAC/D,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;IACzC,MAAM,IAAI,GAAG,mBAAmB,IAAI,qBAAqB,CAAC;IAC1D,MAAM,WAAW,GAAG,kBAAkB,IAAI,IAAI,CAAC;IAC/C,OAAO,GAAG,OAAO,OAAO,WAAW,EAAE,CAAC;AACvC,CAAC;AAED,SAAS,iBAAiB,CACzB,QAAyB,EACzB,IAAY,EACZ,WAAmB;IAEnB,MAAM,EAAC,SAAS,EAAE,aAAa,EAAC,GAAG,oBAAoB,CAAC,WAAW,CAAC,CAAC;IACrE,MAAM,YAAY,GAAG,aAAa,CAAC,IAAI,EAAE,KAAK,EAAE,CAAC;IACjD,MAAM,WAAW,GAAa;QAC7B,KAAK;QACL,UAAU,IAAI,EAAE;QAChB,SAAS,IAAI,EAAE;QACf,iBAAiB,YAAY,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,OAAO,EAAE;QAClD,iFAAiF;QACjF,eAAe;QACf,GAAG,CAAC,QAAQ,KAAK,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,eAAe,CAAC,CAAC;QACjD,KAAK;KACL,CAAC;IACF,2EAA2E;IAC3E,kFAAkF;IAClF,+EAA+E;IAC/E,8EAA8E;IAC9E,gFAAgF;IAChF,wEAAwE;IACxE,wFAAwF;IACxF,+EAA+E;IAC/E,iEAAiE;IACjE,MAAM,WAAW,GAAG,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,MAAM,CAAC;IACpD,+EAA+E;IAC/E,+CAA+C;IAC/C,+EAA+E;IAC/E,iEAAiE;IACjE,2CAA2C;IAC3C,IAAI,QAAQ,KAAK,MAAM,EAAE,CAAC;QACzB,OAAO,CACN,WAAW;YACX,cAAc,CAAC;gBACd,gBAAgB,EAAE,SAAS;gBAC3B,aAAa;aACb,CAAC,CACF,CAAC;IACH,CAAC;IACD,gFAAgF;IAChF,gFAAgF;IAChF,8EAA8E;IAC9E,6EAA6E;IAC7E,+EAA+E;IAC/E,0DAA0D;IAC1D,MAAM,UAAU,GACf,SAAS,CAAC,IAAI,EAAE,KAAK,EAAE;QACtB,CAAC,CAAC,mBAAmB,IAAI,qBAAqB;QAC9C,CAAC,CAAC,SAAS,CAAC;IACd,OAAO,CACN,WAAW;QACX,cAAc,CAAC;YACd,WAAW,EAAE,SAAS;YACtB,aAAa;YACb,MAAM,EAAE,UAAU;SAClB,CAAC,CACF,CAAC;AACH,CAAC;AAED;;;;;;GAMG;AACH,SAAS,oBAAoB,CAAC,WAAmB;IAIhD,MAAM,IAAI,GAAG,gBAAgB,CAAC,WAAW,CAAC,CAAC;IAC3C,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IAC/B,wDAAwD;IACxD,qEAAqE;IACrE,MAAM,QAAQ,GAAG,KAAK,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,yBAAyB,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;IAC3E,IAAI,QAAQ,KAAK,CAAC,CAAC,EAAE,CAAC;QACrB,OAAO,EAAC,SAAS,EAAE,IAAI,EAAE,aAAa,EAAE,EAAE,EAAC,CAAC;IAC7C,CAAC;IACD,IAAI,MAAM,GAAG,KAAK,CAAC,MAAM,CAAC;IAC1B,KAAK,IAAI,CAAC,GAAG,QAAQ,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QAClD,IAAI,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;YAC7B,MAAM,GAAG,CAAC,CAAC;YACX,MAAM;QACP,CAAC;IACF,CAAC;IACD,MAAM,SAAS,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,QAAQ,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACtD,MAAM,aAAa,GAAG,KAAK,CAAC,KAAK,CAAC,QAAQ,GAAG,CAAC,EAAE,MAAM,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACnE,OAAO,EAAC,SAAS,EAAE,aAAa,EAAC,CAAC;AACnC,CAAC;AAED,2EAA2E;AAC3E,SAAS,gBAAgB,CAAC,OAAe;IACxC,MAAM,UAAU,GAAG,OAAO,CAAC,OAAO,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC,OAAO,CAAC,SAAS,EAAE,EAAE,CAAC,CAAC;IACzE,IAAI,CAAC,UAAU,CAAC,UAAU,CAAC,OAAO,CAAC,EAAE,CAAC;QACrC,OAAO,UAAU,CAAC;IACnB,CAAC;IACD,MAAM,KAAK,GAAG,UAAU,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IACrC,MAAM,OAAO,GAAG,KAAK,CAAC,OAAO,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC;IACxC,IAAI,OAAO,KAAK,CAAC,CAAC,EAAE,CAAC;QACpB,OAAO,UAAU,CAAC;IACnB,CAAC;IACD,OAAO,KAAK;SACV,KAAK,CAAC,OAAO,GAAG,CAAC,CAAC;SAClB,IAAI,CAAC,IAAI,CAAC;SACV,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;AACvB,CAAC"}

package/dist/verify-workflow-template.d.ts

@@ -40,7 +40,7 @@ export declare const VERIFY_WORKFLOW_PATH = "workflows/verify.yml";
  * so the GitHub check it produces matches the required-status `context` install-ci
  * configures on `main` — by construction, not by hand-typed agreement.
  */
-export declare function generateVerifyWorkflow(_config: ResolvedCIConfig): string;
+export declare function generateVerifyWorkflow(config: ResolvedCIConfig): string;
 /** A single structural problem found in the generated verify workflow. */
 export interface VerifyWorkflowProblem {
     id: string;

package/dist/verify-workflow-template.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"verify-workflow-template.d.ts","sourceRoot":"","sources":["../src/verify-workflow-template.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;AAEH,OAAO,KAAK,EAAC,gBAAgB,EAAC,MAAM,sBAAsB,CAAC;AAE3D;;;;;GAKG;AACH,eAAO,MAAM,oBAAoB,WAAW,CAAC;AAE7C,6EAA6E;AAC7E,eAAO,MAAM,oBAAoB,WAAW,CAAC;AAE7C,yDAAyD;AACzD,eAAO,MAAM,uBAAuB,oJAC8G,CAAC;AAEnJ,8EAA8E;AAC9E,eAAO,MAAM,oBAAoB,yBAAyB,CAAC;AAE3D;;;;;GAKG;AACH,wBAAgB,sBAAsB,CAAC,OAAO,EAAE,gBAAgB,GAAG,MAAM,CA4DxE;AAED,0EAA0E;AAC1E,MAAM,WAAW,qBAAqB;IACrC,EAAE,EAAE,MAAM,CAAC;IACX,OAAO,EAAE,MAAM,CAAC;CAChB;AAED,gDAAgD;AAChD,MAAM,WAAW,wBAAwB;IACxC,EAAE,EAAE,OAAO,CAAC;IACZ,QAAQ,EAAE,qBAAqB,EAAE,CAAC;CAClC;AAED;;;;GAIG;AACH,wBAAgB,sBAAsB,CAAC,IAAI,EAAE,MAAM,GAAG,wBAAwB,CA8B7E"}
+{"version":3,"file":"verify-workflow-template.d.ts","sourceRoot":"","sources":["../src/verify-workflow-template.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;AAEH,OAAO,KAAK,EAAC,gBAAgB,EAAC,MAAM,sBAAsB,CAAC;AAG3D;;;;;GAKG;AACH,eAAO,MAAM,oBAAoB,WAAW,CAAC;AAE7C,6EAA6E;AAC7E,eAAO,MAAM,oBAAoB,WAAW,CAAC;AAE7C,yDAAyD;AACzD,eAAO,MAAM,uBAAuB,oJAC8G,CAAC;AAEnJ,8EAA8E;AAC9E,eAAO,MAAM,oBAAoB,yBAAyB,CAAC;AAE3D;;;;;GAKG;AACH,wBAAgB,sBAAsB,CAAC,MAAM,EAAE,gBAAgB,GAAG,MAAM,CAuEvE;AAED,0EAA0E;AAC1E,MAAM,WAAW,qBAAqB;IACrC,EAAE,EAAE,MAAM,CAAC;IACX,OAAO,EAAE,MAAM,CAAC;CAChB;AAED,gDAAgD;AAChD,MAAM,WAAW,wBAAwB;IACxC,EAAE,EAAE,OAAO,CAAC;IACZ,QAAQ,EAAE,qBAAqB,EAAE,CAAC;CAClC;AAED;;;;GAIG;AACH,wBAAgB,sBAAsB,CAAC,IAAI,EAAE,MAAM,GAAG,wBAAwB,CA8B7E"}

package/dist/verify-workflow-template.js

@@ -20,6 +20,7 @@
  * (GitHub Merge Queue) can flip the ruleset on without changing this workflow's
  * trigger surface — the forward seam the spec's Applied Answers q3 names.
  */
+import { shouldDropCheckoutCredentials } from './install-ci-core.js';
 /**
  * The required-status-check CONTEXT install-ci sets via branch protection AND the
  * job/check name the emitted verify workflow produces. ONE source of truth so
@@ -39,7 +40,18 @@ export const VERIFY_WORKFLOW_PATH = 'workflows/verify.yml';
  * so the GitHub check it produces matches the required-status `context` install-ci
  * configures on `main` — by construction, not by hand-typed agreement.
  */
-export function generateVerifyWorkflow(_config) {
+export function generateVerifyWorkflow(config) {
+    // `persist-credentials: false` ONLY on a repo KNOWN to be public (see
+    // {@link shouldDropCheckoutCredentials}): this job has `contents: read`, so
+    // the persisted token can only ever read, and on a public repo reads need
+    // no token. Unknown / private / internal ⇒ today's checkout, unchanged.
+    const checkoutCredentials = shouldDropCheckoutCredentials(config)
+        ? `
+          # Public repository: every git read works without a token, and this
+          # job cannot push, so do not leave the token in .git/config for later
+          # steps (the project-setup hook's installs, the gate) to read.
+          persist-credentials: false`
+        : '';
     return `\
 # dorfl — the VERIFY workflow (Tier-1 GitHub ceiling; spec
 # land-time-reverify-and-parallel-merge-ceiling, task
@@ -94,7 +106,7 @@ jobs:
     steps:
       - uses: actions/checkout@v5
         with:
-          fetch-depth: 0
+          fetch-depth: 0${checkoutCredentials}
       - uses: ./.github/actions/dorfl-setup
       - name: run the repo verify gate
         run: dorfl verify

package/dist/verify-workflow-template.js.map

@@ -1 +1 @@
-{"version":3,"file":"verify-workflow-template.js","sourceRoot":"","sources":["../src/verify-workflow-template.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;AAIH;;;;;GAKG;AACH,MAAM,CAAC,MAAM,oBAAoB,GAAG,QAAQ,CAAC;AAE7C,6EAA6E;AAC7E,MAAM,CAAC,MAAM,oBAAoB,GAAG,QAAQ,CAAC;AAE7C,yDAAyD;AACzD,MAAM,CAAC,MAAM,uBAAuB,GACnC,iJAAiJ,CAAC;AAEnJ,8EAA8E;AAC9E,MAAM,CAAC,MAAM,oBAAoB,GAAG,sBAAsB,CAAC;AAE3D;;;;;GAKG;AACH,MAAM,UAAU,sBAAsB,CAAC,OAAyB;IAC/D,OAAO;;;;;;kEAM0D,oBAAoB;;4DAE1B,oBAAoB;yEACP,oBAAoB;;;;;;;;gDAQ7C,oBAAoB;;;;;;;;;;QAU5D,oBAAoB;;;;;;;;;;;WAWjB,oBAAoB;;;;;;;;;SAStB,oBAAoB;;IAEzB,oBAAoB;;;;;;;;;CASvB,CAAC;AACF,CAAC;AAcD;;;;GAIG;AACH,MAAM,UAAU,sBAAsB,CAAC,IAAY;IAClD,MAAM,QAAQ,GAA4B,EAAE,CAAC;IAC7C,MAAM,OAAO,GAAG,CAAC,EAAU,EAAE,OAAgB,EAAE,OAAe,EAAQ,EAAE;QACvE,IAAI,CAAC,OAAO;YAAE,QAAQ,CAAC,IAAI,CAAC,EAAC,EAAE,EAAE,OAAO,EAAC,CAAC,CAAC;IAC5C,CAAC,CAAC;IACF,MAAM,SAAS,GAAG,IAAI;SACpB,KAAK,CAAC,IAAI,CAAC;SACX,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;SACrC,IAAI,CAAC,IAAI,CAAC,CAAC;IAEb,OAAO,CAAC,0BAA0B,EAAE,IAAI,MAAM,CAC7C,UAAU,oBAAoB,QAAQ,EACtC,GAAG,CACH,CAAC,IAAI,CACL,SAAS,CACT,EAAE,mDAAmD,oBAAoB,KAAK;QAC9E,6DAA6D,CAAC,CAAC;IAChE,OAAO,CAAC,sBAAsB,EAAE,oCAAoC,CAAC,IAAI,CACxE,SAAS,CACT,EAAE,kEAAkE,CAAC,CAAC;IACvE,OAAO,CAAC,0BAA0B,EAAE,mBAAmB,CAAC,IAAI,CAC3D,SAAS,CACT,EAAE,oFAAoF,CAAC,CAAC;IACzF,OAAO,CAAC,yBAAyB,EAAE,CAAC,2BAA2B,CAAC,IAAI,CACnE,SAAS,CACT,EAAE,iDAAiD,CAAC,CAAC;IACtD,OAAO,CAAC,mBAAmB,EAAE,gBAAgB,CAAC,IAAI,CACjD,SAAS,CACT,EAAE,mFAAmF,CAAC,CAAC;IACxF,OAAO,EAAC,EAAE,EAAE,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE,QAAQ,EAAC,CAAC;AAC9C,CAAC"}
+{"version":3,"file":"verify-workflow-template.js","sourceRoot":"","sources":["../src/verify-workflow-template.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;AAGH,OAAO,EAAC,6BAA6B,EAAC,MAAM,sBAAsB,CAAC;AAEnE;;;;;GAKG;AACH,MAAM,CAAC,MAAM,oBAAoB,GAAG,QAAQ,CAAC;AAE7C,6EAA6E;AAC7E,MAAM,CAAC,MAAM,oBAAoB,GAAG,QAAQ,CAAC;AAE7C,yDAAyD;AACzD,MAAM,CAAC,MAAM,uBAAuB,GACnC,iJAAiJ,CAAC;AAEnJ,8EAA8E;AAC9E,MAAM,CAAC,MAAM,oBAAoB,GAAG,sBAAsB,CAAC;AAE3D;;;;;GAKG;AACH,MAAM,UAAU,sBAAsB,CAAC,MAAwB;IAC9D,sEAAsE;IACtE,4EAA4E;IAC5E,0EAA0E;IAC1E,wEAAwE;IACxE,MAAM,mBAAmB,GAAG,6BAA6B,CAAC,MAAM,CAAC;QAChE,CAAC,CAAC;;;;qCAIiC;QACnC,CAAC,CAAC,EAAE,CAAC;IACN,OAAO;;;;;;kEAM0D,oBAAoB;;4DAE1B,oBAAoB;yEACP,oBAAoB;;;;;;;;gDAQ7C,oBAAoB;;;;;;;;;;QAU5D,oBAAoB;;;;;;;;;;;WAWjB,oBAAoB;;;;;;;;;SAStB,oBAAoB;;IAEzB,oBAAoB;;;;;0BAKE,mBAAmB;;;;CAI5C,CAAC;AACF,CAAC;AAcD;;;;GAIG;AACH,MAAM,UAAU,sBAAsB,CAAC,IAAY;IAClD,MAAM,QAAQ,GAA4B,EAAE,CAAC;IAC7C,MAAM,OAAO,GAAG,CAAC,EAAU,EAAE,OAAgB,EAAE,OAAe,EAAQ,EAAE;QACvE,IAAI,CAAC,OAAO;YAAE,QAAQ,CAAC,IAAI,CAAC,EAAC,EAAE,EAAE,OAAO,EAAC,CAAC,CAAC;IAC5C,CAAC,CAAC;IACF,MAAM,SAAS,GAAG,IAAI;SACpB,KAAK,CAAC,IAAI,CAAC;SACX,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;SACrC,IAAI,CAAC,IAAI,CAAC,CAAC;IAEb,OAAO,CAAC,0BAA0B,EAAE,IAAI,MAAM,CAC7C,UAAU,oBAAoB,QAAQ,EACtC,GAAG,CACH,CAAC,IAAI,CACL,SAAS,CACT,EAAE,mDAAmD,oBAAoB,KAAK;QAC9E,6DAA6D,CAAC,CAAC;IAChE,OAAO,CAAC,sBAAsB,EAAE,oCAAoC,CAAC,IAAI,CACxE,SAAS,CACT,EAAE,kEAAkE,CAAC,CAAC;IACvE,OAAO,CAAC,0BAA0B,EAAE,mBAAmB,CAAC,IAAI,CAC3D,SAAS,CACT,EAAE,oFAAoF,CAAC,CAAC;IACzF,OAAO,CAAC,yBAAyB,EAAE,CAAC,2BAA2B,CAAC,IAAI,CACnE,SAAS,CACT,EAAE,iDAAiD,CAAC,CAAC;IACtD,OAAO,CAAC,mBAAmB,EAAE,gBAAgB,CAAC,IAAI,CACjD,SAAS,CACT,EAAE,mFAAmF,CAAC,CAAC;IACxF,OAAO,EAAC,EAAE,EAAE,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE,QAAQ,EAAC,CAAC;AAC9C,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "dorfl",
-  "version": "0.14.0",
+  "version": "0.14.2",
   "repository": {
     "type": "git",
     "url": "git+https://github.com/wighawag/dorfl.git",
@@ -36,7 +36,8 @@
     "as-soon": "^0.1.5",
     "tsx": "^4.21.0",
     "typescript": "^5.3.3",
-    "vitest": "^4.0.18"
+    "vitest": "^4.0.18",
+    "yaml": "^2.9.1"
   },
   "scripts": {
     "build": "tsc && node scripts/vendor-protocol.mjs && node scripts/vendor-skills.mjs",

package/src/advance-ci-template.ts

@@ -147,15 +147,23 @@ export function validateAdvanceCiTemplate(
 		'+ `cwd.repo.specs[]` pools), so a ready ungated SPEC becomes one auto-task ' +
 		'matrix leg alongside the eligible-task legs ' +
 		'(`ci-propose-matrix-must-enumerate-sliceable-prds-not-only-slices`).');
-	require('propose-one-advance-per-item', /dorfl advance "?\$\{\{\s*matrix\./.test(
+	require('propose-one-advance-per-item', /WORK_ITEM:\s*\$\{\{\s*matrix\.item\s*\}\}[\s\S]*?dorfl advance "\$\{WORK_ITEM\}"/.test(
 		text,
 	), 'each matrix leg must run one `dorfl advance <matrix item>` ' +
-		'(one PR per item).');
+		'(one PR per item), reading the item from the step env (`WORK_ITEM`).');
+	// The item id is a slug that may be hand-written, so it must reach the shell
+	// as DATA through `env:`, never as `${{ }}` text spliced into the `run:` script
+	// (GitHub Actions script injection).
+	require('matrix-item-not-spliced-into-run', !/dorfl advance "?\$\{\{/.test(
+		text,
+	), 'the matrix item must NOT be interpolated into the `run:` script as ' +
+		'`${{ matrix.item }}` (script injection): pass it through the step `env:` ' +
+		'as `WORK_ITEM` and quote it as `"${WORK_ITEM}"`.');
 	// The matrix leg must carry `--propose` so the integration mode is TIED to the
 	// matrix shape (it cannot desync from the dispatch `integrationMode` input nor
 	// fall back to a repo config default of `merge`). Scoped to the `advance-propose`
 	// job so it is the LEG that carries it, not merely the file somewhere.
-	require('propose-leg-carries-propose-flag', /advance-propose:[\s\S]*?dorfl advance "?\$\{\{\s*matrix\.[\s\S]*?--propose\b/.test(
+	require('propose-leg-carries-propose-flag', /advance-propose:[\s\S]*?dorfl advance "\$\{WORK_ITEM\}"[^\n]*--propose\b/.test(
 		text,
 	), 'each `propose` matrix leg must pass `--propose` so the integration mode is ' +
 		'TIED to the matrix shape (a leg can never merge to main / desync from the ' +
@@ -176,7 +184,7 @@ export function validateAdvanceCiTemplate(
 	// scoped to the `advance-merge:` job so the `--merge` flag is TIED to its leg
 	// (cannot desync from the dispatch `integrationMode` input nor fall back to a
 	// repo config default of `propose`).
-	require('merge-leg-carries-merge-flag', /advance-merge:[\s\S]*?dorfl advance "?\$\{\{\s*matrix\.[\s\S]*?--merge\b/.test(
+	require('merge-leg-carries-merge-flag', /advance-merge:[\s\S]*?dorfl advance "\$\{WORK_ITEM\}"[^\n]*--merge\b/.test(
 		text,
 	), 'each `merge` matrix leg must pass `--merge` so the integration mode is ' +
 		'TIED to the matrix shape (a leg can never propose-only / desync from the ' +

package/src/advance-lifecycle-template.ts

@@ -306,13 +306,26 @@ jobs:
         # surfaceBlockers), so an override that does not reach this job produces an
         # empty matrix and is silently inert. \`if:\` + the inner \`[ -n ... ]\` guard
         # keep schedule/push (and a blank dispatch field) exporting NOTHING — an
-        # empty DORFL_* would make env-config coercion throw.
+        # empty DORFL_* would make env-config coercion throw. The inputs reach the
+        # shell through \`env:\` as DATA, never as \`\${{ }}\` text spliced into the
+        # script (GitHub's script-injection guidance), and the \`case\` guard stops a
+        # value from appending its own lines to $GITHUB_ENV. Both only matter if an
+        # input ever stops being a fixed \`type: choice\`; for the choices below the
+        # step writes exactly what it always did.
         if: \${{ github.event_name == 'workflow_dispatch' }}
+        env:
+          DISPATCH_AUTO_BUILD: \${{ github.event.inputs.autoBuild }}
+          DISPATCH_AUTO_TASK: \${{ github.event.inputs.autoTask }}
+          DISPATCH_OBSERVATION_TRIAGE: \${{ github.event.inputs.observationTriage }}
+          DISPATCH_SURFACE_BLOCKERS: \${{ github.event.inputs.surfaceBlockers }}
         run: |
-          [ -n "\${{ github.event.inputs.autoBuild }}" ] && echo "DORFL_AUTO_BUILD=\${{ github.event.inputs.autoBuild }}" >> "$GITHUB_ENV"
-          [ -n "\${{ github.event.inputs.autoTask }}" ] && echo "DORFL_AUTO_TASK=\${{ github.event.inputs.autoTask }}" >> "$GITHUB_ENV"
-          [ -n "\${{ github.event.inputs.observationTriage }}" ] && echo "DORFL_OBSERVATION_TRIAGE=\${{ github.event.inputs.observationTriage }}" >> "$GITHUB_ENV"
-          [ -n "\${{ github.event.inputs.surfaceBlockers }}" ] && echo "DORFL_SURFACE_BLOCKERS=\${{ github.event.inputs.surfaceBlockers }}" >> "$GITHUB_ENV"
+          case "\${DISPATCH_AUTO_BUILD}\${DISPATCH_AUTO_TASK}\${DISPATCH_OBSERVATION_TRIAGE}\${DISPATCH_SURFACE_BLOCKERS}" in
+            *$'\\n'*|*$'\\r'*) echo "::error::a dispatch gate override contains a line break"; exit 1 ;;
+          esac
+          [ -n "\${DISPATCH_AUTO_BUILD}" ] && echo "DORFL_AUTO_BUILD=\${DISPATCH_AUTO_BUILD}" >> "$GITHUB_ENV"
+          [ -n "\${DISPATCH_AUTO_TASK}" ] && echo "DORFL_AUTO_TASK=\${DISPATCH_AUTO_TASK}" >> "$GITHUB_ENV"
+          [ -n "\${DISPATCH_OBSERVATION_TRIAGE}" ] && echo "DORFL_OBSERVATION_TRIAGE=\${DISPATCH_OBSERVATION_TRIAGE}" >> "$GITHUB_ENV"
+          [ -n "\${DISPATCH_SURFACE_BLOCKERS}" ] && echo "DORFL_SURFACE_BLOCKERS=\${DISPATCH_SURFACE_BLOCKERS}" >> "$GITHUB_ENV"
           true
       - id: scan
         # Enumerate eligible items as namespaced ids, one matrix leg per id. CI
@@ -402,11 +415,19 @@ jobs:
         # DORFL_* ONLY on a workflow_dispatch with a non-blank input, so the
         # one-shot override also reaches the \`advance\` leg that builds the item.
         if: \${{ github.event_name == 'workflow_dispatch' }}
+        env:
+          DISPATCH_AUTO_BUILD: \${{ github.event.inputs.autoBuild }}
+          DISPATCH_AUTO_TASK: \${{ github.event.inputs.autoTask }}
+          DISPATCH_OBSERVATION_TRIAGE: \${{ github.event.inputs.observationTriage }}
+          DISPATCH_SURFACE_BLOCKERS: \${{ github.event.inputs.surfaceBlockers }}
         run: |
-          [ -n "\${{ github.event.inputs.autoBuild }}" ] && echo "DORFL_AUTO_BUILD=\${{ github.event.inputs.autoBuild }}" >> "$GITHUB_ENV"
-          [ -n "\${{ github.event.inputs.autoTask }}" ] && echo "DORFL_AUTO_TASK=\${{ github.event.inputs.autoTask }}" >> "$GITHUB_ENV"
-          [ -n "\${{ github.event.inputs.observationTriage }}" ] && echo "DORFL_OBSERVATION_TRIAGE=\${{ github.event.inputs.observationTriage }}" >> "$GITHUB_ENV"
-          [ -n "\${{ github.event.inputs.surfaceBlockers }}" ] && echo "DORFL_SURFACE_BLOCKERS=\${{ github.event.inputs.surfaceBlockers }}" >> "$GITHUB_ENV"
+          case "\${DISPATCH_AUTO_BUILD}\${DISPATCH_AUTO_TASK}\${DISPATCH_OBSERVATION_TRIAGE}\${DISPATCH_SURFACE_BLOCKERS}" in
+            *$'\\n'*|*$'\\r'*) echo "::error::a dispatch gate override contains a line break"; exit 1 ;;
+          esac
+          [ -n "\${DISPATCH_AUTO_BUILD}" ] && echo "DORFL_AUTO_BUILD=\${DISPATCH_AUTO_BUILD}" >> "$GITHUB_ENV"
+          [ -n "\${DISPATCH_AUTO_TASK}" ] && echo "DORFL_AUTO_TASK=\${DISPATCH_AUTO_TASK}" >> "$GITHUB_ENV"
+          [ -n "\${DISPATCH_OBSERVATION_TRIAGE}" ] && echo "DORFL_OBSERVATION_TRIAGE=\${DISPATCH_OBSERVATION_TRIAGE}" >> "$GITHUB_ENV"
+          [ -n "\${DISPATCH_SURFACE_BLOCKERS}" ] && echo "DORFL_SURFACE_BLOCKERS=\${DISPATCH_SURFACE_BLOCKERS}" >> "$GITHUB_ENV"
           true
       - name: advance one item in-place (propose ⇒ opens a PR)
         # In-place in this checkout (no --isolated/--remote): the CI container IS
@@ -421,13 +442,19 @@ jobs:
         # works zero-config; the job's \`pull-requests: write\` scopes that token.
         env:
           GH_TOKEN: \${{ secrets.DORFL_GH_TOKEN || secrets.GITHUB_TOKEN }}
+          # The item id is a slug read from work/ (frontmatter \`slug:\` or the
+          # file name). dorfl sanitises the slugs it mints, but a hand-written
+          # one is only checked when \`advance\` resolves it, so it reaches the
+          # shell as DATA through env, never as \`\${{ matrix.item }}\` text
+          # spliced into the script.
+          WORK_ITEM: \${{ matrix.item }}
         # \`--watch\` streams the build agent's high-signal turns (assistant text,
         # tool calls, finish) into THIS job log live, so the run shows the agent
         # working instead of freezing after "Start work". A read-only observer (no
         # outcome/gate/git effect). It fits because each matrix leg names ONE item
         # (one pi session to tail) — the merge job is now a per-item matrix too
         # (see below) and streams the same way.
-        run: dorfl advance "\${{ matrix.item }}" --propose --watch --arbiter origin
+        run: dorfl advance "\${WORK_ITEM}" --propose --watch --arbiter origin
 
   # ── MERGE: a MATRIX of independent jobs (parallel build/gate/review, serialised land) ──
   # SPEC \`land-time-reverify-and-parallel-merge-ceiling\` (stories 4 + 6): each item
@@ -468,11 +495,19 @@ jobs:
         # merge job re-scans the pool inside \`advance -n\`, so it needs the override
         # too for the lifecycle/task pools to reflect it.
         if: \${{ github.event_name == 'workflow_dispatch' }}
+        env:
+          DISPATCH_AUTO_BUILD: \${{ github.event.inputs.autoBuild }}
+          DISPATCH_AUTO_TASK: \${{ github.event.inputs.autoTask }}
+          DISPATCH_OBSERVATION_TRIAGE: \${{ github.event.inputs.observationTriage }}
+          DISPATCH_SURFACE_BLOCKERS: \${{ github.event.inputs.surfaceBlockers }}
         run: |
-          [ -n "\${{ github.event.inputs.autoBuild }}" ] && echo "DORFL_AUTO_BUILD=\${{ github.event.inputs.autoBuild }}" >> "$GITHUB_ENV"
-          [ -n "\${{ github.event.inputs.autoTask }}" ] && echo "DORFL_AUTO_TASK=\${{ github.event.inputs.autoTask }}" >> "$GITHUB_ENV"
-          [ -n "\${{ github.event.inputs.observationTriage }}" ] && echo "DORFL_OBSERVATION_TRIAGE=\${{ github.event.inputs.observationTriage }}" >> "$GITHUB_ENV"
-          [ -n "\${{ github.event.inputs.surfaceBlockers }}" ] && echo "DORFL_SURFACE_BLOCKERS=\${{ github.event.inputs.surfaceBlockers }}" >> "$GITHUB_ENV"
+          case "\${DISPATCH_AUTO_BUILD}\${DISPATCH_AUTO_TASK}\${DISPATCH_OBSERVATION_TRIAGE}\${DISPATCH_SURFACE_BLOCKERS}" in
+            *$'\\n'*|*$'\\r'*) echo "::error::a dispatch gate override contains a line break"; exit 1 ;;
+          esac
+          [ -n "\${DISPATCH_AUTO_BUILD}" ] && echo "DORFL_AUTO_BUILD=\${DISPATCH_AUTO_BUILD}" >> "$GITHUB_ENV"
+          [ -n "\${DISPATCH_AUTO_TASK}" ] && echo "DORFL_AUTO_TASK=\${DISPATCH_AUTO_TASK}" >> "$GITHUB_ENV"
+          [ -n "\${DISPATCH_OBSERVATION_TRIAGE}" ] && echo "DORFL_OBSERVATION_TRIAGE=\${DISPATCH_OBSERVATION_TRIAGE}" >> "$GITHUB_ENV"
+          [ -n "\${DISPATCH_SURFACE_BLOCKERS}" ] && echo "DORFL_SURFACE_BLOCKERS=\${DISPATCH_SURFACE_BLOCKERS}" >> "$GITHUB_ENV"
           true
       - name: advance one item in-place (merge ⇒ rebase + CAS land on main)
         # In-place (no --isolated/--remote). \`--merge\` ties the integration mode
@@ -483,10 +518,16 @@ jobs:
         # \`GH_TOKEN\` from the env.
         env:
           GH_TOKEN: \${{ secrets.DORFL_GH_TOKEN || secrets.GITHUB_TOKEN }}
+          # The item id is a slug read from work/ (frontmatter \`slug:\` or the
+          # file name). dorfl sanitises the slugs it mints, but a hand-written
+          # one is only checked when \`advance\` resolves it, so it reaches the
+          # shell as DATA through env, never as \`\${{ matrix.item }}\` text
+          # spliced into the script.
+          WORK_ITEM: \${{ matrix.item }}
         # \`--watch\` streams the build agent's high-signal turns into THIS job
         # log live; each leg names ONE item, so it fits the same way it does on
         # the propose legs.
-        run: dorfl advance "\${{ matrix.item }}" --merge --watch --arbiter origin
+        run: dorfl advance "\${WORK_ITEM}" --merge --watch --arbiter origin
 
   # ── REAP merged remote work/* branches (capability F, the hygiene sweep) ─────
   # PRESERVED from the seed (NOT a separate gc-sweep workflow): the provider-
@@ -607,11 +648,19 @@ export function validateAdvanceLifecycleWorkflow(
 		text,
 	), 'the matrix items must be ENUMERATED via the eligible-pool scan ' +
 		'(`dorfl scan --json`).');
-	require('propose-one-advance-per-item', /dorfl advance "?\$\{\{\s*matrix\./.test(
+	require('propose-one-advance-per-item', /WORK_ITEM:\s*\$\{\{\s*matrix\.item\s*\}\}[\s\S]*?dorfl advance "\$\{WORK_ITEM\}"/.test(
 		text,
 	), 'each matrix leg must run one `dorfl advance <matrix item>` ' +
-		'(one PR per item).');
-	require('propose-leg-carries-propose-flag', /advance-propose:[\s\S]*?dorfl advance "?\$\{\{\s*matrix\.[\s\S]*?--propose\b/.test(
+		'(one PR per item), reading the item from the step env (`WORK_ITEM`).');
+	// The item id is a slug that may be hand-written (only minted slugs are
+	// sanitised), so it must reach the shell as DATA through `env:`, never as `${{ }}` text
+	// spliced into the `run:` script (GitHub Actions script injection).
+	require('matrix-item-not-spliced-into-run', !/dorfl advance "?\$\{\{/.test(
+		operative,
+	), 'the matrix item must NOT be interpolated into the `run:` script as ' +
+		'`${{ matrix.item }}` (script injection): pass it through the step `env:` ' +
+		'as `WORK_ITEM` and quote it as `"${WORK_ITEM}"`.');
+	require('propose-leg-carries-propose-flag', /advance-propose:[\s\S]*?dorfl advance "\$\{WORK_ITEM\}"[^\n]*--propose\b/.test(
 		text,
 	), 'each `propose` matrix leg must pass `--propose` so the integration mode is ' +
 		'TIED to the matrix shape (a leg can never merge to main / desync from the ' +
@@ -626,7 +675,7 @@ export function validateAdvanceLifecycleWorkflow(
 	), 'the `merge` job must use a MATRIX (parallel build/gate/review per item; ' +
 		"the land tail is serialised by the engine's `mergeRetries` CAS-retry " +
 		"loop, not by the workflow's job shape).");
-	require('merge-leg-carries-merge-flag', /advance-merge:[\s\S]*?dorfl advance "?\$\{\{\s*matrix\.[\s\S]*?--merge\b/.test(
+	require('merge-leg-carries-merge-flag', /advance-merge:[\s\S]*?dorfl advance "\$\{WORK_ITEM\}"[^\n]*--merge\b/.test(
 		text,
 	), 'each `merge` matrix leg must pass `--merge` so the integration mode is ' +
 		'TIED to the matrix shape (a leg can never propose-only / desync from the ' +
@@ -692,9 +741,14 @@ export function validateAdvanceLifecycleWorkflow(
 		['observationTriage', 'DORFL_OBSERVATION_TRIAGE'],
 		['surfaceBlockers', 'DORFL_SURFACE_BLOCKERS'],
 	] as const) {
-		// The override is a guarded shell write: `[ -n <input> ] && echo <ENV>=<input> >> $GITHUB_ENV`.
+		// The override is a guarded shell write of a step-env copy of the input:
+		// `env: DISPATCH_<X>: ${{ inputs.<x> }}` then
+		// `[ -n "${DISPATCH_<X>}" ] && echo "<ENV>=${DISPATCH_<X>}" >> $GITHUB_ENV`.
+		// The input never appears as `${{ }}` text inside the `run:` script.
+		const dispatchVar = envVar.replace(/^DORFL_/, 'DISPATCH_');
 		const guardedWrite = new RegExp(
-			`\\[ -n "\\$\\{\\{ github\\.event\\.inputs\\.${input} \\}\\}" \\][\\s\\S]*?${envVar}=`,
+			`${dispatchVar}:\\s*\\$\\{\\{ github\\.event\\.inputs\\.${input} \\}\\}` +
+				`[\\s\\S]*?\\[ -n "\\$\\{${dispatchVar}\\}" \\] && echo "${envVar}=\\$\\{${dispatchVar}\\}"`,
 		);
 		require(`dispatch-${input}-guarded-write`, guardedWrite.test(
 			text,

package/src/cli.ts

@@ -1108,8 +1108,8 @@ interface CloseMergedIssuesFlags {
  * it prints the error to stderr and exits 1 (the task-only commands never act on
  * a spec). An OMITTED slug (`start`/`complete`/`prompt` infer it from the branch)
  * passes through untouched. (The legacy ''prd:'' prefix is a DEAD namespace token
- * after the hard cutover — it is neither special-cased nor rejected here; a
- * ''prd:<slug>'' arg resolves as a bare literal task slug.)
+ * after the hard cutover: it is not special-cased here; a ''prd:<slug>'' arg
+ * is refused by the shared safe-slug check, since `:` is not a slug character.)
  *
  * `do` is the ONE command that spans both namespaces; it consumes the full
  * `resolveSlug` (with the cross-namespace collision check) in the `do-in-place`

package/src/close-job-template.ts

@@ -34,6 +34,7 @@
  */
 
 import type {ResolvedCIConfig} from './install-ci-core.js';
+import {shouldDropCheckoutCredentials} from './install-ci-core.js';
 
 /** The capability id (the registry key + the emitted workflow file stem). */
 export const CLOSE_JOB_CAPABILITY_ID = 'close-job';
@@ -52,7 +53,19 @@ export const CLOSE_JOB_WORKFLOW_PATH = 'workflows/close-job.yml';
  * and future per-config wiring, but the close-job shape itself is
  * config-independent.
  */
-export function generateCloseJobWorkflow(_config: ResolvedCIConfig): string {
+export function generateCloseJobWorkflow(config: ResolvedCIConfig): string {
+	// `persist-credentials: false` ONLY on a repo KNOWN to be public (see
+	// {@link shouldDropCheckoutCredentials}): this job has `contents: read`, so
+	// the persisted token can only ever read, and on a public repo reads need
+	// no token. Unknown / private / internal ⇒ today's checkout, unchanged.
+	const checkoutCredentials = shouldDropCheckoutCredentials(config)
+		? `
+          # Public repository: every git read works without a token, and this
+          # job cannot push, so do not leave the token in .git/config for later
+          # steps (the setup action, including any project-setup hook, and
+          # close-merged-issues) to read.
+          persist-credentials: false`
+		: '';
 	return `\
 # dorfl — the ISSUE CLOSE-JOB in CI (capability E, spec runner-in-ci).
 # EMITTED by \`dorfl install-ci\`; the human commits it. DO NOT hand-edit a
@@ -112,7 +125,7 @@ jobs:
     steps:
       - uses: actions/checkout@v5
         with:
-          fetch-depth: 0
+          fetch-depth: 0${checkoutCredentials}
       - uses: ./.github/actions/dorfl-setup
       - name: close issues whose work has landed on main
         # In-place in this checkout (no --isolated/--remote): the CI container IS