dorfl 0.14.1 → 0.14.2

package/dist/triage-persist.js.map

@@ -1 +1 @@
-{"version":3,"file":"triage-persist.js","sourceRoot":"","sources":["../src/triage-persist.ts"],"names":[],"mappings":"AAAA,OAAO,EAAC,YAAY,EAAE,aAAa,EAAC,MAAM,SAAS,CAAC;AACpD,OAAO,EAAC,IAAI,EAAC,MAAM,WAAW,CAAC;AAC/B,OAAO,EAAC,GAAG,EAAiB,MAAM,UAAU,CAAC;AAC7C,OAAO,EAAC,WAAW,EAAC,MAAM,kBAAkB,CAAC;AAC7C,OAAO,EACN,oBAAoB,GAGpB,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EAAC,sBAAsB,EAAE,cAAc,EAAC,MAAM,cAAc,CAAC;AAEpE,OAAO,EAAC,cAAc,EAAE,cAAc,EAAC,MAAM,qBAAqB,CAAC;AACnE,OAAO,EAAC,oBAAoB,EAAC,MAAM,kBAAkB,CAAC;AAEtD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAmDG;AAEH,SAAS,OAAO,CACf,IAAc,EACd,GAAW,EACX,GAAkC;IAElC,OAAO,GAAG,CAAC,KAAK,EAAE,IAAI,EAAE,GAAG,EAAE,EAAC,GAAG,EAAC,CAAC,CAAC;AACrC,CAAC;AAED,SAAS,OAAO,CACf,IAAc,EACd,GAAW,EACX,GAAkC;IAElC,MAAM,MAAM,GAAG,GAAG,CAAC,KAAK,EAAE,IAAI,EAAE,GAAG,EAAE,EAAC,GAAG,EAAC,CAAC,CAAC;IAC5C,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACzB,MAAM,IAAI,kBAAkB,CAC3B,OAAO,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,iBAAiB,MAAM,CAAC,MAAM,MAAM,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,EAAE,CAC/E,CAAC;IACH,CAAC;IACD,OAAO,MAAM,CAAC;AACf,CAAC;AAED,SAAS,SAAS,CAAC,GAAW,EAAE,GAAkC;IACjE,MAAM,IAAI,GAAG,OAAO,CAAC,CAAC,QAAQ,EAAE,WAAW,CAAC,EAAE,GAAG,EAAE,GAAG,CAAC,CAAC;IACxD,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,IAAI,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC;QACpD,OAAO,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC;IAC3B,CAAC;IACD,MAAM,CAAC,GAAG,GAAG,IAAI,OAAO,CAAC,GAAG,CAAC;IAC7B,OAAO,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC,QAAQ,IAAI,EAAE,CAAC;AACnC,CAAC;AAED,iFAAiF;AACjF,SAAS,QAAQ,CAChB,GAAW,EACX,QAAgB,EAChB,GAAkC;IAElC,MAAM,IAAI,GAAG,OAAO,CAAC,CAAC,MAAM,EAAE,IAAI,QAAQ,EAAE,CAAC,EAAE,GAAG,EAAE,GAAG,CAAC,CAAC;IACzD,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACvB,OAAO,IAAI,CAAC,MAAM,CAAC;IACpB,CAAC;IACD,IAAI,CAAC;QACJ,OAAO,YAAY,CAAC,IAAI,CAAC,GAAG,EAAE,QAAQ,CAAC,EAAE,MAAM,CAAC,CAAC;IAClD,CAAC;IAAC,MAAM,CAAC;QACR,MAAM,IAAI,kBAAkB,CAC3B,qCAAqC,QAAQ,yCAAyC,CACtF,CAAC;IACH,CAAC;AACF,CAAC;AAED,2EAA2E;AAC3E,MAAM,OAAO,kBAAmB,SAAQ,KAAK;IAC5C,YAAY,OAAe;QAC1B,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,oBAAoB,CAAC;IAClC,CAAC;CACD;AA8BD;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,MAAM,UAAU,kBAAkB,CACjC,OAAkC;IAElC,MAAM,EAAC,GAAG,EAAE,IAAI,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,EAAC,GAAG,OAAO,CAAC;IAC1D,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,IAAI,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;IAExC,IAAI,OAAO,CAAC,CAAC,WAAW,EAAE,WAAW,CAAC,EAAE,GAAG,EAAE,GAAG,CAAC,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAChE,MAAM,IAAI,kBAAkB,CAAC,6BAA6B,CAAC,CAAC;IAC7D,CAAC;IAED,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC;IAChC,MAAM,MAAM,GAAG,YAAY,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;IACzC,MAAM,KAAK,GAAG,oBAAoB,CAAC,MAAM,EAAE,SAAS,EAAE,KAAK,CAAC,CAAC;IAC7D,IAAI,KAAK,KAAK,MAAM,EAAE,CAAC;QACtB,yEAAyE;QACzE,+DAA+D;QAC/D,MAAM,OAAO,GAAG,UAAU,IAAI,6BAA6B,KAAK,qBAAqB,CAAC;QACtF,IAAI,CAAC,OAAO,CAAC,CAAC;QACd,OAAO,EAAC,OAAO,EAAC,CAAC;IAClB,CAAC;IACD,aAAa,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;IAC1B,MAAM,EAAE,GAAG,OAAO,CAAC,EAAE,IAAI,SAAS,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;IAC7C,OAAO,CAAC,CAAC,KAAK,EAAE,IAAI,EAAE,QAAQ,CAAC,EAAE,GAAG,EAAE,GAAG,CAAC,CAAC;IAC3C,MAAM,OAAO,GAAG,mBAAmB,IAAI,kBAAkB,EAAE,GAAG,CAAC;IAC/D,OAAO,CACN;QACC,QAAQ;QACR,SAAS;QACT,IAAI;QACJ,OAAO;QACP,IAAI;QACJ,YAAY,KAAK,OAAO,MAAM,EAAE;KAChC,EACD,GAAG,EACH,GAAG,CACH,CAAC;IACF,MAAM,MAAM,GAAG,OAAO,CAAC,CAAC,WAAW,EAAE,MAAM,CAAC,EAAE,GAAG,EAAE,GAAG,CAAC,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC;IACtE,MAAM,OAAO,GACZ,UAAU,IAAI,0BAA0B,KAAK,yBAAyB;QACtE,2EAA2E;QAC3E,0DAA0D,CAAC;IAC5D,IAAI,CAAC,OAAO,CAAC,CAAC;IACd,OAAO,EAAC,MAAM,EAAE,OAAO,EAAC,CAAC;AAC1B,CAAC;AA8CD;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAM,UAAU,0BAA0B,CACzC,OAA+B;IAE/B,MAAM,EAAC,GAAG,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,QAAQ,EAAE,GAAG,EAAC,GAAG,OAAO,CAAC;IAC3D,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,IAAI,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;IAExC,IAAI,OAAO,CAAC,CAAC,WAAW,EAAE,WAAW,CAAC,EAAE,GAAG,EAAE,GAAG,CAAC,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAChE,MAAM,IAAI,kBAAkB,CAAC,6BAA6B,CAAC,CAAC;IAC7D,CAAC;IAED,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;IAC5C,MAAM,EAAE,GAAG,OAAO,CAAC,EAAE,IAAI,SAAS,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;IAE7C,kFAAkF;IAClF,iFAAiF;IACjF,mFAAmF;IACnF,OAAO,CAAC,CAAC,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,QAAQ,CAAC,EAAE,GAAG,EAAE,GAAG,CAAC,CAAC;IACrD,MAAM,YAAY,GACjB,IAAI,KAAK,WAAW;QACnB,CAAC,CAAC,yBAAyB,QAAQ,qDAAqD;QACxF,CAAC,CAAC,6BAA6B,QAAQ,+DAA+D,CAAC;IACzG,MAAM,OAAO,GAAG,mBAAmB,IAAI,MAAM,IAAI,QAAQ,EAAE,GAAG,CAAC;IAC/D,MAAM,WAAW,GAChB,2BAA2B,YAAY,gCAAgC;QACvE,CAAC,MAAM,KAAK,EAAE,CAAC,CAAC,CAAC,eAAe,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;IAChD,OAAO,CAAC,CAAC,QAAQ,EAAE,SAAS,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,WAAW,CAAC,EAAE,GAAG,EAAE,GAAG,CAAC,CAAC;IAC3E,MAAM,MAAM,GAAG,OAAO,CAAC,CAAC,WAAW,EAAE,MAAM,CAAC,EAAE,GAAG,EAAE,GAAG,CAAC,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC;IACtE,MAAM,OAAO,GACZ,gBAAgB,IAAI,MAAM,IAAI,OAAO,QAAQ,0BAA0B;QACvE,8FAA8F,CAAC;IAChG,IAAI,CAAC,OAAO,CAAC,CAAC;IACd,OAAO,EAAC,OAAO,EAAE,SAAS,EAAE,MAAM,EAAE,QAAQ,EAAE,OAAO,EAAC,CAAC;AACxD,CAAC;AAkFD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AACH,MAAM,CAAC,KAAK,UAAU,kBAAkB,CACvC,OAAkC;IAElC,MAAM,EAAC,GAAG,EAAE,IAAI,EAAE,QAAQ,EAAE,GAAG,EAAC,GAAG,OAAO,CAAC;IAC3C,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,IAAI,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;IAExC,MAAM,EAAC,IAAI,EAAE,OAAO,EAAC,GAAG,sBAAsB,CAAC,IAAI,CAAC,CAAC;IACrD,MAAM,OAAO,GAAG,CAAC,OAAO,CAAC,OAAO,IAAI,OAAO,CAAC,CAAC,IAAI,EAAE,CAAC;IACpD,MAAM,QAAQ,GAAG,OAAO,CAAC,QAAQ,IAAI,MAAM,CAAC;IAC5C,IAAI,OAAO,KAAK,EAAE,EAAE,CAAC;QACpB,OAAO;YACN,OAAO,EAAE,aAAa;YACtB,QAAQ,EAAE,CAAC;YACX,OAAO,EAAE,WAAW,IAAI,qCAAqC,QAAQ,EAAE;SACvE,CAAC;IACH,CAAC;IACD,+EAA+E;IAC/E,mFAAmF;IACnF,4EAA4E;IAC5E,kEAAkE;IAClE,MAAM,WAAW,GAAG,WAAW,CAC9B,QAAQ,KAAK,MAAM,CAAC,CAAC,CAAC,gBAAgB,CAAC,CAAC,CAAC,aAAa,EACtD,GAAG,OAAO,KAAK,CACf,CAAC;IACF,MAAM,EAAE,GAAG,OAAO,CAAC,EAAE,IAAI,SAAS,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;IAC7C,mFAAmF;IACnF,iFAAiF;IACjF,gFAAgF;IAChF,kFAAkF;IAClF,mFAAmF;IACnF,gFAAgF;IAChF,kFAAkF;IAClF,iFAAiF;IACjF,uCAAuC;IACvC,MAAM,OAAO,GAAG,oBAAoB,CACnC,sBAAsB,CACrB,QAAQ,EACR,OAAO,EACP,OAAO,CAAC,WAAW;QAClB,iBAAiB,CAAC,QAAQ,EAAE,OAAO,EAAE,QAAQ,CAAC,GAAG,EAAE,QAAQ,EAAE,GAAG,CAAC,CAAC,CACnE,EACD,cAAc,EACd,IAAI,CACJ,CAAC;IAEF,gFAAgF;IAChF,8EAA8E;IAC9E,6EAA6E;IAC7E,MAAM,WAAW,GAAG,cAAc,CAAC,IAAI,CAAC,CAAC;IAEzC,2EAA2E;IAC3E,2EAA2E;IAC3E,8CAA8C;IAC9C,MAAM,OAAO,GAA+B,MAAM,oBAAoB,CAAC;QACtE,IAAI,EAAE,WAAW;QACjB,OAAO;QACP,WAAW,EAAE,CAAC,QAAQ,EAAE,WAAW,CAAC;QACpC,yEAAyE;QACzE,+EAA+E;QAC/E,sEAAsE;QACtE,UAAU,EAAE,IAAI;QAChB,GAAG;QACH,OAAO,EAAE,OAAO,CAAC,OAAO;QACxB,EAAE;QACF,MAAM,EAAE,OAAO,CAAC,MAAM;QACtB,GAAG;QACH,IAAI;QACJ,GAAG,CAAC,OAAO,CAAC,UAAU,KAAK,SAAS;YACnC,CAAC,CAAC,EAAC,UAAU,EAAE,OAAO,CAAC,UAAU,EAAC;YAClC,CAAC,CAAC,EAAE,CAAC;KACN,CAAC,CAAC;IACH,4EAA4E;IAC5E,iFAAiF;IACjF,mFAAmF;IACnF,wEAAwE;IACxE,0EAA0E;IAC1E,IAAI,OAAO,CAAC,OAAO,KAAK,4BAA4B,EAAE,CAAC;QACtD,MAAM,OAAO,GACZ,WAAW,IAAI,KAAK,WAAW,4CAA4C;YAC3E,mBAAmB,OAAO,CAAC,OAAO,6CAA6C,CAAC;QACjF,IAAI,CAAC,OAAO,CAAC,CAAC;QACd,OAAO;YACN,OAAO,EAAE,iBAAiB;YAC1B,QAAQ,EAAE,CAAC;YACX,WAAW;YACX,OAAO;SACP,CAAC;IACH,CAAC;IACD,IAAI,OAAO,CAAC,QAAQ,KAAK,CAAC,EAAE,CAAC;QAC5B,MAAM,OAAO,GACZ,WAAW,IAAI,kBAAkB,WAAW,IAAI,OAAO,CAAC,OAAO,OAAO;YACtE,eAAe,OAAO,CAAC,OAAO,2CAA2C;YACzE,qBAAqB,CAAC;QACvB,IAAI,CAAC,OAAO,CAAC,CAAC;QACd,OAAO;YACN,OAAO,EAAE,OAAO,CAAC,OAAO,KAAK,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,WAAW;YAC1D,QAAQ,EAAE,OAAO,CAAC,QAAQ;YAC1B,OAAO;SACP,CAAC;IACH,CAAC;IAED,MAAM,OAAO,GACZ,YAAY,IAAI,cAAc,WAAW,+BAA+B;QACxE,+CAA+C,CAAC;IACjD,IAAI,CAAC,OAAO,CAAC,CAAC;IACd,OAAO,EAAC,OAAO,EAAE,UAAU,EAAE,QAAQ,EAAE,CAAC,EAAE,WAAW,EAAE,OAAO,EAAC,CAAC;AACjE,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAkCG;AACH;;;;;;;;;;;;;GAaG;AACH,SAAS,sBAAsB,CAC9B,QAAyB,EACzB,IAAY,EACZ,IAAY;IAEZ,IAAI,QAAQ,KAAK,MAAM,EAAE,CAAC;QACzB,OAAO,IAAI,CAAC;IACb,CAAC;IACD,iFAAiF;IACjF,oDAAoD;IACpD,IAAI,kBAAkB,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;QACnC,OAAO,IAAI,CAAC;IACb,CAAC;IACD,4EAA4E;IAC5E,6EAA6E;IAC7E,+DAA+D;IAC/D,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;IACzC,MAAM,IAAI,GAAG,mBAAmB,IAAI,qBAAqB,CAAC;IAC1D,MAAM,WAAW,GAAG,kBAAkB,IAAI,IAAI,CAAC;IAC/C,OAAO,GAAG,OAAO,OAAO,WAAW,EAAE,CAAC;AACvC,CAAC;AAED,SAAS,iBAAiB,CACzB,QAAyB,EACzB,IAAY,EACZ,WAAmB;IAEnB,MAAM,EAAC,SAAS,EAAE,aAAa,EAAC,GAAG,oBAAoB,CAAC,WAAW,CAAC,CAAC;IACrE,MAAM,YAAY,GAAG,aAAa,CAAC,IAAI,EAAE,KAAK,EAAE,CAAC;IACjD,MAAM,WAAW,GAAa;QAC7B,KAAK;QACL,UAAU,IAAI,EAAE;QAChB,SAAS,IAAI,EAAE;QACf,iBAAiB,YAAY,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,OAAO,EAAE;QAClD,iFAAiF;QACjF,eAAe;QACf,GAAG,CAAC,QAAQ,KAAK,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,eAAe,CAAC,CAAC;QACjD,KAAK;KACL,CAAC;IACF,2EAA2E;IAC3E,kFAAkF;IAClF,+EAA+E;IAC/E,8EAA8E;IAC9E,gFAAgF;IAChF,wEAAwE;IACxE,wFAAwF;IACxF,+EAA+E;IAC/E,iEAAiE;IACjE,MAAM,WAAW,GAAG,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,MAAM,CAAC;IACpD,+EAA+E;IAC/E,+CAA+C;IAC/C,+EAA+E;IAC/E,iEAAiE;IACjE,2CAA2C;IAC3C,IAAI,QAAQ,KAAK,MAAM,EAAE,CAAC;QACzB,OAAO,CACN,WAAW;YACX,cAAc,CAAC;gBACd,gBAAgB,EAAE,SAAS;gBAC3B,aAAa;aACb,CAAC,CACF,CAAC;IACH,CAAC;IACD,gFAAgF;IAChF,gFAAgF;IAChF,8EAA8E;IAC9E,6EAA6E;IAC7E,+EAA+E;IAC/E,0DAA0D;IAC1D,MAAM,UAAU,GACf,SAAS,CAAC,IAAI,EAAE,KAAK,EAAE;QACtB,CAAC,CAAC,mBAAmB,IAAI,qBAAqB;QAC9C,CAAC,CAAC,SAAS,CAAC;IACd,OAAO,CACN,WAAW;QACX,cAAc,CAAC;YACd,WAAW,EAAE,SAAS;YACtB,aAAa;YACb,MAAM,EAAE,UAAU;SAClB,CAAC,CACF,CAAC;AACH,CAAC;AAED;;;;;;GAMG;AACH,SAAS,oBAAoB,CAAC,WAAmB;IAIhD,MAAM,IAAI,GAAG,gBAAgB,CAAC,WAAW,CAAC,CAAC;IAC3C,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IAC/B,wDAAwD;IACxD,qEAAqE;IACrE,MAAM,QAAQ,GAAG,KAAK,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,yBAAyB,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;IAC3E,IAAI,QAAQ,KAAK,CAAC,CAAC,EAAE,CAAC;QACrB,OAAO,EAAC,SAAS,EAAE,IAAI,EAAE,aAAa,EAAE,EAAE,EAAC,CAAC;IAC7C,CAAC;IACD,IAAI,MAAM,GAAG,KAAK,CAAC,MAAM,CAAC;IAC1B,KAAK,IAAI,CAAC,GAAG,QAAQ,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QAClD,IAAI,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;YAC7B,MAAM,GAAG,CAAC,CAAC;YACX,MAAM;QACP,CAAC;IACF,CAAC;IACD,MAAM,SAAS,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,QAAQ,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACtD,MAAM,aAAa,GAAG,KAAK,CAAC,KAAK,CAAC,QAAQ,GAAG,CAAC,EAAE,MAAM,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACnE,OAAO,EAAC,SAAS,EAAE,aAAa,EAAC,CAAC;AACnC,CAAC;AAED,2EAA2E;AAC3E,SAAS,gBAAgB,CAAC,OAAe;IACxC,MAAM,UAAU,GAAG,OAAO,CAAC,OAAO,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC,OAAO,CAAC,SAAS,EAAE,EAAE,CAAC,CAAC;IACzE,IAAI,CAAC,UAAU,CAAC,UAAU,CAAC,OAAO,CAAC,EAAE,CAAC;QACrC,OAAO,UAAU,CAAC;IACnB,CAAC;IACD,MAAM,KAAK,GAAG,UAAU,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IACrC,MAAM,OAAO,GAAG,KAAK,CAAC,OAAO,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC;IACxC,IAAI,OAAO,KAAK,CAAC,CAAC,EAAE,CAAC;QACpB,OAAO,UAAU,CAAC;IACnB,CAAC;IACD,OAAO,KAAK;SACV,KAAK,CAAC,OAAO,GAAG,CAAC,CAAC;SAClB,IAAI,CAAC,IAAI,CAAC;SACV,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;AACvB,CAAC"}
+{"version":3,"file":"triage-persist.js","sourceRoot":"","sources":["../src/triage-persist.ts"],"names":[],"mappings":"AAAA,OAAO,EAAC,YAAY,EAAE,aAAa,EAAC,MAAM,SAAS,CAAC;AACpD,OAAO,EAAC,IAAI,EAAC,MAAM,WAAW,CAAC;AAC/B,OAAO,EAAC,GAAG,EAAiB,MAAM,UAAU,CAAC;AAC7C,OAAO,EAAC,WAAW,EAAC,MAAM,kBAAkB,CAAC;AAC7C,OAAO,EACN,oBAAoB,GAGpB,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EAAC,sBAAsB,EAAE,cAAc,EAAC,MAAM,cAAc,CAAC;AAEpE,OAAO,EAAC,cAAc,EAAE,cAAc,EAAC,MAAM,qBAAqB,CAAC;AACnE,OAAO,EAAC,oBAAoB,EAAC,MAAM,kBAAkB,CAAC;AACtD,OAAO,EAAC,cAAc,EAAC,MAAM,kBAAkB,CAAC;AAEhD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAmDG;AAEH,SAAS,OAAO,CACf,IAAc,EACd,GAAW,EACX,GAAkC;IAElC,OAAO,GAAG,CAAC,KAAK,EAAE,IAAI,EAAE,GAAG,EAAE,EAAC,GAAG,EAAC,CAAC,CAAC;AACrC,CAAC;AAED,SAAS,OAAO,CACf,IAAc,EACd,GAAW,EACX,GAAkC;IAElC,MAAM,MAAM,GAAG,GAAG,CAAC,KAAK,EAAE,IAAI,EAAE,GAAG,EAAE,EAAC,GAAG,EAAC,CAAC,CAAC;IAC5C,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACzB,MAAM,IAAI,kBAAkB,CAC3B,OAAO,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,iBAAiB,MAAM,CAAC,MAAM,MAAM,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,EAAE,CAC/E,CAAC;IACH,CAAC;IACD,OAAO,MAAM,CAAC;AACf,CAAC;AAED,SAAS,SAAS,CAAC,GAAW,EAAE,GAAkC;IACjE,MAAM,IAAI,GAAG,OAAO,CAAC,CAAC,QAAQ,EAAE,WAAW,CAAC,EAAE,GAAG,EAAE,GAAG,CAAC,CAAC;IACxD,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,IAAI,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC;QACpD,OAAO,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC;IAC3B,CAAC;IACD,MAAM,CAAC,GAAG,GAAG,IAAI,OAAO,CAAC,GAAG,CAAC;IAC7B,OAAO,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC,QAAQ,IAAI,EAAE,CAAC;AACnC,CAAC;AAED,iFAAiF;AACjF,SAAS,QAAQ,CAChB,GAAW,EACX,QAAgB,EAChB,GAAkC;IAElC,MAAM,IAAI,GAAG,OAAO,CAAC,CAAC,MAAM,EAAE,IAAI,QAAQ,EAAE,CAAC,EAAE,GAAG,EAAE,GAAG,CAAC,CAAC;IACzD,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACvB,OAAO,IAAI,CAAC,MAAM,CAAC;IACpB,CAAC;IACD,IAAI,CAAC;QACJ,OAAO,YAAY,CAAC,IAAI,CAAC,GAAG,EAAE,QAAQ,CAAC,EAAE,MAAM,CAAC,CAAC;IAClD,CAAC;IAAC,MAAM,CAAC;QACR,MAAM,IAAI,kBAAkB,CAC3B,qCAAqC,QAAQ,yCAAyC,CACtF,CAAC;IACH,CAAC;AACF,CAAC;AAED,2EAA2E;AAC3E,MAAM,OAAO,kBAAmB,SAAQ,KAAK;IAC5C,YAAY,OAAe;QAC1B,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,oBAAoB,CAAC;IAClC,CAAC;CACD;AA8BD;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,MAAM,UAAU,kBAAkB,CACjC,OAAkC;IAElC,MAAM,EAAC,GAAG,EAAE,IAAI,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,EAAC,GAAG,OAAO,CAAC;IAC1D,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,IAAI,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;IAExC,IAAI,OAAO,CAAC,CAAC,WAAW,EAAE,WAAW,CAAC,EAAE,GAAG,EAAE,GAAG,CAAC,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAChE,MAAM,IAAI,kBAAkB,CAAC,6BAA6B,CAAC,CAAC;IAC7D,CAAC;IAED,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC;IAChC,MAAM,MAAM,GAAG,YAAY,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;IACzC,MAAM,KAAK,GAAG,oBAAoB,CAAC,MAAM,EAAE,SAAS,EAAE,KAAK,CAAC,CAAC;IAC7D,IAAI,KAAK,KAAK,MAAM,EAAE,CAAC;QACtB,yEAAyE;QACzE,+DAA+D;QAC/D,MAAM,OAAO,GAAG,UAAU,IAAI,6BAA6B,KAAK,qBAAqB,CAAC;QACtF,IAAI,CAAC,OAAO,CAAC,CAAC;QACd,OAAO,EAAC,OAAO,EAAC,CAAC;IAClB,CAAC;IACD,aAAa,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;IAC1B,MAAM,EAAE,GAAG,OAAO,CAAC,EAAE,IAAI,SAAS,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;IAC7C,OAAO,CAAC,CAAC,KAAK,EAAE,IAAI,EAAE,QAAQ,CAAC,EAAE,GAAG,EAAE,GAAG,CAAC,CAAC;IAC3C,MAAM,OAAO,GAAG,mBAAmB,IAAI,kBAAkB,EAAE,GAAG,CAAC;IAC/D,OAAO,CACN;QACC,QAAQ;QACR,SAAS;QACT,IAAI;QACJ,OAAO;QACP,IAAI;QACJ,YAAY,KAAK,OAAO,MAAM,EAAE;KAChC,EACD,GAAG,EACH,GAAG,CACH,CAAC;IACF,MAAM,MAAM,GAAG,OAAO,CAAC,CAAC,WAAW,EAAE,MAAM,CAAC,EAAE,GAAG,EAAE,GAAG,CAAC,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC;IACtE,MAAM,OAAO,GACZ,UAAU,IAAI,0BAA0B,KAAK,yBAAyB;QACtE,2EAA2E;QAC3E,0DAA0D,CAAC;IAC5D,IAAI,CAAC,OAAO,CAAC,CAAC;IACd,OAAO,EAAC,MAAM,EAAE,OAAO,EAAC,CAAC;AAC1B,CAAC;AA8CD;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAM,UAAU,0BAA0B,CACzC,OAA+B;IAE/B,MAAM,EAAC,GAAG,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,QAAQ,EAAE,GAAG,EAAC,GAAG,OAAO,CAAC;IAC3D,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,IAAI,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;IAExC,IAAI,OAAO,CAAC,CAAC,WAAW,EAAE,WAAW,CAAC,EAAE,GAAG,EAAE,GAAG,CAAC,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAChE,MAAM,IAAI,kBAAkB,CAAC,6BAA6B,CAAC,CAAC;IAC7D,CAAC;IAED,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;IAC5C,MAAM,EAAE,GAAG,OAAO,CAAC,EAAE,IAAI,SAAS,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;IAE7C,kFAAkF;IAClF,iFAAiF;IACjF,mFAAmF;IACnF,OAAO,CAAC,CAAC,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,QAAQ,CAAC,EAAE,GAAG,EAAE,GAAG,CAAC,CAAC;IACrD,MAAM,YAAY,GACjB,IAAI,KAAK,WAAW;QACnB,CAAC,CAAC,yBAAyB,QAAQ,qDAAqD;QACxF,CAAC,CAAC,6BAA6B,QAAQ,+DAA+D,CAAC;IACzG,MAAM,OAAO,GAAG,mBAAmB,IAAI,MAAM,IAAI,QAAQ,EAAE,GAAG,CAAC;IAC/D,MAAM,WAAW,GAChB,2BAA2B,YAAY,gCAAgC;QACvE,CAAC,MAAM,KAAK,EAAE,CAAC,CAAC,CAAC,eAAe,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;IAChD,OAAO,CAAC,CAAC,QAAQ,EAAE,SAAS,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,WAAW,CAAC,EAAE,GAAG,EAAE,GAAG,CAAC,CAAC;IAC3E,MAAM,MAAM,GAAG,OAAO,CAAC,CAAC,WAAW,EAAE,MAAM,CAAC,EAAE,GAAG,EAAE,GAAG,CAAC,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC;IACtE,MAAM,OAAO,GACZ,gBAAgB,IAAI,MAAM,IAAI,OAAO,QAAQ,0BAA0B;QACvE,8FAA8F,CAAC;IAChG,IAAI,CAAC,OAAO,CAAC,CAAC;IACd,OAAO,EAAC,OAAO,EAAE,SAAS,EAAE,MAAM,EAAE,QAAQ,EAAE,OAAO,EAAC,CAAC;AACxD,CAAC;AAkFD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AACH,MAAM,CAAC,KAAK,UAAU,kBAAkB,CACvC,OAAkC;IAElC,MAAM,EAAC,GAAG,EAAE,IAAI,EAAE,QAAQ,EAAE,GAAG,EAAC,GAAG,OAAO,CAAC;IAC3C,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,IAAI,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;IAExC,MAAM,EAAC,IAAI,EAAE,OAAO,EAAC,GAAG,sBAAsB,CAAC,IAAI,CAAC,CAAC;IACrD,4EAA4E;IAC5E,6EAA6E;IAC7E,MAAM,OAAO,GAAG,cAAc,CAAC,OAAO,CAAC,OAAO,IAAI,OAAO,CAAC,CAAC;IAC3D,MAAM,QAAQ,GAAG,OAAO,CAAC,QAAQ,IAAI,MAAM,CAAC;IAC5C,IAAI,OAAO,KAAK,EAAE,EAAE,CAAC;QACpB,OAAO;YACN,OAAO,EAAE,aAAa;YACtB,QAAQ,EAAE,CAAC;YACX,OAAO,EAAE,WAAW,IAAI,qCAAqC,QAAQ,EAAE;SACvE,CAAC;IACH,CAAC;IACD,+EAA+E;IAC/E,mFAAmF;IACnF,4EAA4E;IAC5E,kEAAkE;IAClE,MAAM,WAAW,GAAG,WAAW,CAC9B,QAAQ,KAAK,MAAM,CAAC,CAAC,CAAC,gBAAgB,CAAC,CAAC,CAAC,aAAa,EACtD,GAAG,OAAO,KAAK,CACf,CAAC;IACF,MAAM,EAAE,GAAG,OAAO,CAAC,EAAE,IAAI,SAAS,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;IAC7C,mFAAmF;IACnF,iFAAiF;IACjF,gFAAgF;IAChF,kFAAkF;IAClF,mFAAmF;IACnF,gFAAgF;IAChF,kFAAkF;IAClF,iFAAiF;IACjF,uCAAuC;IACvC,4EAA4E;IAC5E,yEAAyE;IACzE,uEAAuE;IACvE,oDAAoD;IACpD,MAAM,OAAO,GACZ,OAAO,CAAC,WAAW,KAAK,SAAS;QAChC,CAAC,CAAC,oBAAoB,CAAC,OAAO,CAAC,WAAW,EAAE,MAAM,EAAE,OAAO,CAAC;QAC5D,CAAC,CAAC,iBAAiB,CAAC,QAAQ,EAAE,OAAO,EAAE,QAAQ,CAAC,GAAG,EAAE,QAAQ,EAAE,GAAG,CAAC,CAAC,CAAC;IACvE,MAAM,OAAO,GAAG,oBAAoB,CACnC,sBAAsB,CAAC,QAAQ,EAAE,OAAO,EAAE,OAAO,CAAC,EAClD,cAAc,EACd,IAAI,CACJ,CAAC;IAEF,gFAAgF;IAChF,8EAA8E;IAC9E,6EAA6E;IAC7E,MAAM,WAAW,GAAG,cAAc,CAAC,IAAI,CAAC,CAAC;IAEzC,2EAA2E;IAC3E,2EAA2E;IAC3E,8CAA8C;IAC9C,MAAM,OAAO,GAA+B,MAAM,oBAAoB,CAAC;QACtE,IAAI,EAAE,WAAW;QACjB,OAAO;QACP,WAAW,EAAE,CAAC,QAAQ,EAAE,WAAW,CAAC;QACpC,yEAAyE;QACzE,+EAA+E;QAC/E,sEAAsE;QACtE,UAAU,EAAE,IAAI;QAChB,GAAG;QACH,OAAO,EAAE,OAAO,CAAC,OAAO;QACxB,EAAE;QACF,MAAM,EAAE,OAAO,CAAC,MAAM;QACtB,GAAG;QACH,IAAI;QACJ,GAAG,CAAC,OAAO,CAAC,UAAU,KAAK,SAAS;YACnC,CAAC,CAAC,EAAC,UAAU,EAAE,OAAO,CAAC,UAAU,EAAC;YAClC,CAAC,CAAC,EAAE,CAAC;KACN,CAAC,CAAC;IACH,4EAA4E;IAC5E,iFAAiF;IACjF,mFAAmF;IACnF,wEAAwE;IACxE,0EAA0E;IAC1E,IAAI,OAAO,CAAC,OAAO,KAAK,4BAA4B,EAAE,CAAC;QACtD,MAAM,OAAO,GACZ,WAAW,IAAI,KAAK,WAAW,4CAA4C;YAC3E,mBAAmB,OAAO,CAAC,OAAO,6CAA6C,CAAC;QACjF,IAAI,CAAC,OAAO,CAAC,CAAC;QACd,OAAO;YACN,OAAO,EAAE,iBAAiB;YAC1B,QAAQ,EAAE,CAAC;YACX,WAAW;YACX,OAAO;SACP,CAAC;IACH,CAAC;IACD,IAAI,OAAO,CAAC,QAAQ,KAAK,CAAC,EAAE,CAAC;QAC5B,MAAM,OAAO,GACZ,WAAW,IAAI,kBAAkB,WAAW,IAAI,OAAO,CAAC,OAAO,OAAO;YACtE,eAAe,OAAO,CAAC,OAAO,2CAA2C;YACzE,qBAAqB,CAAC;QACvB,IAAI,CAAC,OAAO,CAAC,CAAC;QACd,OAAO;YACN,OAAO,EAAE,OAAO,CAAC,OAAO,KAAK,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,WAAW;YAC1D,QAAQ,EAAE,OAAO,CAAC,QAAQ;YAC1B,OAAO;SACP,CAAC;IACH,CAAC;IAED,MAAM,OAAO,GACZ,YAAY,IAAI,cAAc,WAAW,+BAA+B;QACxE,+CAA+C,CAAC;IACjD,IAAI,CAAC,OAAO,CAAC,CAAC;IACd,OAAO,EAAC,OAAO,EAAE,UAAU,EAAE,QAAQ,EAAE,CAAC,EAAE,WAAW,EAAE,OAAO,EAAC,CAAC;AACjE,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAkCG;AACH;;;;;;;;;;;;;GAaG;AACH,SAAS,sBAAsB,CAC9B,QAAyB,EACzB,IAAY,EACZ,IAAY;IAEZ,IAAI,QAAQ,KAAK,MAAM,EAAE,CAAC;QACzB,OAAO,IAAI,CAAC;IACb,CAAC;IACD,iFAAiF;IACjF,oDAAoD;IACpD,IAAI,kBAAkB,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;QACnC,OAAO,IAAI,CAAC;IACb,CAAC;IACD,4EAA4E;IAC5E,6EAA6E;IAC7E,+DAA+D;IAC/D,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;IACzC,MAAM,IAAI,GAAG,mBAAmB,IAAI,qBAAqB,CAAC;IAC1D,MAAM,WAAW,GAAG,kBAAkB,IAAI,IAAI,CAAC;IAC/C,OAAO,GAAG,OAAO,OAAO,WAAW,EAAE,CAAC;AACvC,CAAC;AAED,SAAS,iBAAiB,CACzB,QAAyB,EACzB,IAAY,EACZ,WAAmB;IAEnB,MAAM,EAAC,SAAS,EAAE,aAAa,EAAC,GAAG,oBAAoB,CAAC,WAAW,CAAC,CAAC;IACrE,MAAM,YAAY,GAAG,aAAa,CAAC,IAAI,EAAE,KAAK,EAAE,CAAC;IACjD,MAAM,WAAW,GAAa;QAC7B,KAAK;QACL,UAAU,IAAI,EAAE;QAChB,SAAS,IAAI,EAAE;QACf,iBAAiB,YAAY,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,OAAO,EAAE;QAClD,iFAAiF;QACjF,eAAe;QACf,GAAG,CAAC,QAAQ,KAAK,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,eAAe,CAAC,CAAC;QACjD,KAAK;KACL,CAAC;IACF,2EAA2E;IAC3E,kFAAkF;IAClF,+EAA+E;IAC/E,8EAA8E;IAC9E,gFAAgF;IAChF,wEAAwE;IACxE,wFAAwF;IACxF,+EAA+E;IAC/E,iEAAiE;IACjE,MAAM,WAAW,GAAG,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,MAAM,CAAC;IACpD,+EAA+E;IAC/E,+CAA+C;IAC/C,+EAA+E;IAC/E,iEAAiE;IACjE,2CAA2C;IAC3C,IAAI,QAAQ,KAAK,MAAM,EAAE,CAAC;QACzB,OAAO,CACN,WAAW;YACX,cAAc,CAAC;gBACd,gBAAgB,EAAE,SAAS;gBAC3B,aAAa;aACb,CAAC,CACF,CAAC;IACH,CAAC;IACD,gFAAgF;IAChF,gFAAgF;IAChF,8EAA8E;IAC9E,6EAA6E;IAC7E,+EAA+E;IAC/E,0DAA0D;IAC1D,MAAM,UAAU,GACf,SAAS,CAAC,IAAI,EAAE,KAAK,EAAE;QACtB,CAAC,CAAC,mBAAmB,IAAI,qBAAqB;QAC9C,CAAC,CAAC,SAAS,CAAC;IACd,OAAO,CACN,WAAW;QACX,cAAc,CAAC;YACd,WAAW,EAAE,SAAS;YACtB,aAAa;YACb,MAAM,EAAE,UAAU;SAClB,CAAC,CACF,CAAC;AACH,CAAC;AAED;;;;;;GAMG;AACH,SAAS,oBAAoB,CAAC,WAAmB;IAIhD,MAAM,IAAI,GAAG,gBAAgB,CAAC,WAAW,CAAC,CAAC;IAC3C,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IAC/B,wDAAwD;IACxD,qEAAqE;IACrE,MAAM,QAAQ,GAAG,KAAK,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,yBAAyB,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;IAC3E,IAAI,QAAQ,KAAK,CAAC,CAAC,EAAE,CAAC;QACrB,OAAO,EAAC,SAAS,EAAE,IAAI,EAAE,aAAa,EAAE,EAAE,EAAC,CAAC;IAC7C,CAAC;IACD,IAAI,MAAM,GAAG,KAAK,CAAC,MAAM,CAAC;IAC1B,KAAK,IAAI,CAAC,GAAG,QAAQ,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QAClD,IAAI,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;YAC7B,MAAM,GAAG,CAAC,CAAC;YACX,MAAM;QACP,CAAC;IACF,CAAC;IACD,MAAM,SAAS,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,QAAQ,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACtD,MAAM,aAAa,GAAG,KAAK,CAAC,KAAK,CAAC,QAAQ,GAAG,CAAC,EAAE,MAAM,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACnE,OAAO,EAAC,SAAS,EAAE,aAAa,EAAC,CAAC;AACnC,CAAC;AAED,2EAA2E;AAC3E,SAAS,gBAAgB,CAAC,OAAe;IACxC,MAAM,UAAU,GAAG,OAAO,CAAC,OAAO,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC,OAAO,CAAC,SAAS,EAAE,EAAE,CAAC,CAAC;IACzE,IAAI,CAAC,UAAU,CAAC,UAAU,CAAC,OAAO,CAAC,EAAE,CAAC;QACrC,OAAO,UAAU,CAAC;IACnB,CAAC;IACD,MAAM,KAAK,GAAG,UAAU,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IACrC,MAAM,OAAO,GAAG,KAAK,CAAC,OAAO,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC;IACxC,IAAI,OAAO,KAAK,CAAC,CAAC,EAAE,CAAC;QACpB,OAAO,UAAU,CAAC;IACnB,CAAC;IACD,OAAO,KAAK;SACV,KAAK,CAAC,OAAO,GAAG,CAAC,CAAC;SAClB,IAAI,CAAC,IAAI,CAAC;SACV,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;AACvB,CAAC"}

package/dist/verify-workflow-template.d.ts

@@ -40,7 +40,7 @@ export declare const VERIFY_WORKFLOW_PATH = "workflows/verify.yml";
  * so the GitHub check it produces matches the required-status `context` install-ci
  * configures on `main` — by construction, not by hand-typed agreement.
  */
-export declare function generateVerifyWorkflow(_config: ResolvedCIConfig): string;
+export declare function generateVerifyWorkflow(config: ResolvedCIConfig): string;
 /** A single structural problem found in the generated verify workflow. */
 export interface VerifyWorkflowProblem {
     id: string;

package/dist/verify-workflow-template.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"verify-workflow-template.d.ts","sourceRoot":"","sources":["../src/verify-workflow-template.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;AAEH,OAAO,KAAK,EAAC,gBAAgB,EAAC,MAAM,sBAAsB,CAAC;AAE3D;;;;;GAKG;AACH,eAAO,MAAM,oBAAoB,WAAW,CAAC;AAE7C,6EAA6E;AAC7E,eAAO,MAAM,oBAAoB,WAAW,CAAC;AAE7C,yDAAyD;AACzD,eAAO,MAAM,uBAAuB,oJAC8G,CAAC;AAEnJ,8EAA8E;AAC9E,eAAO,MAAM,oBAAoB,yBAAyB,CAAC;AAE3D;;;;;GAKG;AACH,wBAAgB,sBAAsB,CAAC,OAAO,EAAE,gBAAgB,GAAG,MAAM,CA4DxE;AAED,0EAA0E;AAC1E,MAAM,WAAW,qBAAqB;IACrC,EAAE,EAAE,MAAM,CAAC;IACX,OAAO,EAAE,MAAM,CAAC;CAChB;AAED,gDAAgD;AAChD,MAAM,WAAW,wBAAwB;IACxC,EAAE,EAAE,OAAO,CAAC;IACZ,QAAQ,EAAE,qBAAqB,EAAE,CAAC;CAClC;AAED;;;;GAIG;AACH,wBAAgB,sBAAsB,CAAC,IAAI,EAAE,MAAM,GAAG,wBAAwB,CA8B7E"}
+{"version":3,"file":"verify-workflow-template.d.ts","sourceRoot":"","sources":["../src/verify-workflow-template.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;AAEH,OAAO,KAAK,EAAC,gBAAgB,EAAC,MAAM,sBAAsB,CAAC;AAG3D;;;;;GAKG;AACH,eAAO,MAAM,oBAAoB,WAAW,CAAC;AAE7C,6EAA6E;AAC7E,eAAO,MAAM,oBAAoB,WAAW,CAAC;AAE7C,yDAAyD;AACzD,eAAO,MAAM,uBAAuB,oJAC8G,CAAC;AAEnJ,8EAA8E;AAC9E,eAAO,MAAM,oBAAoB,yBAAyB,CAAC;AAE3D;;;;;GAKG;AACH,wBAAgB,sBAAsB,CAAC,MAAM,EAAE,gBAAgB,GAAG,MAAM,CAuEvE;AAED,0EAA0E;AAC1E,MAAM,WAAW,qBAAqB;IACrC,EAAE,EAAE,MAAM,CAAC;IACX,OAAO,EAAE,MAAM,CAAC;CAChB;AAED,gDAAgD;AAChD,MAAM,WAAW,wBAAwB;IACxC,EAAE,EAAE,OAAO,CAAC;IACZ,QAAQ,EAAE,qBAAqB,EAAE,CAAC;CAClC;AAED;;;;GAIG;AACH,wBAAgB,sBAAsB,CAAC,IAAI,EAAE,MAAM,GAAG,wBAAwB,CA8B7E"}

package/dist/verify-workflow-template.js

@@ -20,6 +20,7 @@
  * (GitHub Merge Queue) can flip the ruleset on without changing this workflow's
  * trigger surface — the forward seam the spec's Applied Answers q3 names.
  */
+import { shouldDropCheckoutCredentials } from './install-ci-core.js';
 /**
  * The required-status-check CONTEXT install-ci sets via branch protection AND the
  * job/check name the emitted verify workflow produces. ONE source of truth so
@@ -39,7 +40,18 @@ export const VERIFY_WORKFLOW_PATH = 'workflows/verify.yml';
  * so the GitHub check it produces matches the required-status `context` install-ci
  * configures on `main` — by construction, not by hand-typed agreement.
  */
-export function generateVerifyWorkflow(_config) {
+export function generateVerifyWorkflow(config) {
+    // `persist-credentials: false` ONLY on a repo KNOWN to be public (see
+    // {@link shouldDropCheckoutCredentials}): this job has `contents: read`, so
+    // the persisted token can only ever read, and on a public repo reads need
+    // no token. Unknown / private / internal ⇒ today's checkout, unchanged.
+    const checkoutCredentials = shouldDropCheckoutCredentials(config)
+        ? `
+          # Public repository: every git read works without a token, and this
+          # job cannot push, so do not leave the token in .git/config for later
+          # steps (the project-setup hook's installs, the gate) to read.
+          persist-credentials: false`
+        : '';
     return `\
 # dorfl — the VERIFY workflow (Tier-1 GitHub ceiling; spec
 # land-time-reverify-and-parallel-merge-ceiling, task
@@ -94,7 +106,7 @@ jobs:
     steps:
       - uses: actions/checkout@v5
         with:
-          fetch-depth: 0
+          fetch-depth: 0${checkoutCredentials}
       - uses: ./.github/actions/dorfl-setup
       - name: run the repo verify gate
         run: dorfl verify

package/dist/verify-workflow-template.js.map

@@ -1 +1 @@
-{"version":3,"file":"verify-workflow-template.js","sourceRoot":"","sources":["../src/verify-workflow-template.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;AAIH;;;;;GAKG;AACH,MAAM,CAAC,MAAM,oBAAoB,GAAG,QAAQ,CAAC;AAE7C,6EAA6E;AAC7E,MAAM,CAAC,MAAM,oBAAoB,GAAG,QAAQ,CAAC;AAE7C,yDAAyD;AACzD,MAAM,CAAC,MAAM,uBAAuB,GACnC,iJAAiJ,CAAC;AAEnJ,8EAA8E;AAC9E,MAAM,CAAC,MAAM,oBAAoB,GAAG,sBAAsB,CAAC;AAE3D;;;;;GAKG;AACH,MAAM,UAAU,sBAAsB,CAAC,OAAyB;IAC/D,OAAO;;;;;;kEAM0D,oBAAoB;;4DAE1B,oBAAoB;yEACP,oBAAoB;;;;;;;;gDAQ7C,oBAAoB;;;;;;;;;;QAU5D,oBAAoB;;;;;;;;;;;WAWjB,oBAAoB;;;;;;;;;SAStB,oBAAoB;;IAEzB,oBAAoB;;;;;;;;;CASvB,CAAC;AACF,CAAC;AAcD;;;;GAIG;AACH,MAAM,UAAU,sBAAsB,CAAC,IAAY;IAClD,MAAM,QAAQ,GAA4B,EAAE,CAAC;IAC7C,MAAM,OAAO,GAAG,CAAC,EAAU,EAAE,OAAgB,EAAE,OAAe,EAAQ,EAAE;QACvE,IAAI,CAAC,OAAO;YAAE,QAAQ,CAAC,IAAI,CAAC,EAAC,EAAE,EAAE,OAAO,EAAC,CAAC,CAAC;IAC5C,CAAC,CAAC;IACF,MAAM,SAAS,GAAG,IAAI;SACpB,KAAK,CAAC,IAAI,CAAC;SACX,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;SACrC,IAAI,CAAC,IAAI,CAAC,CAAC;IAEb,OAAO,CAAC,0BAA0B,EAAE,IAAI,MAAM,CAC7C,UAAU,oBAAoB,QAAQ,EACtC,GAAG,CACH,CAAC,IAAI,CACL,SAAS,CACT,EAAE,mDAAmD,oBAAoB,KAAK;QAC9E,6DAA6D,CAAC,CAAC;IAChE,OAAO,CAAC,sBAAsB,EAAE,oCAAoC,CAAC,IAAI,CACxE,SAAS,CACT,EAAE,kEAAkE,CAAC,CAAC;IACvE,OAAO,CAAC,0BAA0B,EAAE,mBAAmB,CAAC,IAAI,CAC3D,SAAS,CACT,EAAE,oFAAoF,CAAC,CAAC;IACzF,OAAO,CAAC,yBAAyB,EAAE,CAAC,2BAA2B,CAAC,IAAI,CACnE,SAAS,CACT,EAAE,iDAAiD,CAAC,CAAC;IACtD,OAAO,CAAC,mBAAmB,EAAE,gBAAgB,CAAC,IAAI,CACjD,SAAS,CACT,EAAE,mFAAmF,CAAC,CAAC;IACxF,OAAO,EAAC,EAAE,EAAE,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE,QAAQ,EAAC,CAAC;AAC9C,CAAC"}
+{"version":3,"file":"verify-workflow-template.js","sourceRoot":"","sources":["../src/verify-workflow-template.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;AAGH,OAAO,EAAC,6BAA6B,EAAC,MAAM,sBAAsB,CAAC;AAEnE;;;;;GAKG;AACH,MAAM,CAAC,MAAM,oBAAoB,GAAG,QAAQ,CAAC;AAE7C,6EAA6E;AAC7E,MAAM,CAAC,MAAM,oBAAoB,GAAG,QAAQ,CAAC;AAE7C,yDAAyD;AACzD,MAAM,CAAC,MAAM,uBAAuB,GACnC,iJAAiJ,CAAC;AAEnJ,8EAA8E;AAC9E,MAAM,CAAC,MAAM,oBAAoB,GAAG,sBAAsB,CAAC;AAE3D;;;;;GAKG;AACH,MAAM,UAAU,sBAAsB,CAAC,MAAwB;IAC9D,sEAAsE;IACtE,4EAA4E;IAC5E,0EAA0E;IAC1E,wEAAwE;IACxE,MAAM,mBAAmB,GAAG,6BAA6B,CAAC,MAAM,CAAC;QAChE,CAAC,CAAC;;;;qCAIiC;QACnC,CAAC,CAAC,EAAE,CAAC;IACN,OAAO;;;;;;kEAM0D,oBAAoB;;4DAE1B,oBAAoB;yEACP,oBAAoB;;;;;;;;gDAQ7C,oBAAoB;;;;;;;;;;QAU5D,oBAAoB;;;;;;;;;;;WAWjB,oBAAoB;;;;;;;;;SAStB,oBAAoB;;IAEzB,oBAAoB;;;;;0BAKE,mBAAmB;;;;CAI5C,CAAC;AACF,CAAC;AAcD;;;;GAIG;AACH,MAAM,UAAU,sBAAsB,CAAC,IAAY;IAClD,MAAM,QAAQ,GAA4B,EAAE,CAAC;IAC7C,MAAM,OAAO,GAAG,CAAC,EAAU,EAAE,OAAgB,EAAE,OAAe,EAAQ,EAAE;QACvE,IAAI,CAAC,OAAO;YAAE,QAAQ,CAAC,IAAI,CAAC,EAAC,EAAE,EAAE,OAAO,EAAC,CAAC,CAAC;IAC5C,CAAC,CAAC;IACF,MAAM,SAAS,GAAG,IAAI;SACpB,KAAK,CAAC,IAAI,CAAC;SACX,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;SACrC,IAAI,CAAC,IAAI,CAAC,CAAC;IAEb,OAAO,CAAC,0BAA0B,EAAE,IAAI,MAAM,CAC7C,UAAU,oBAAoB,QAAQ,EACtC,GAAG,CACH,CAAC,IAAI,CACL,SAAS,CACT,EAAE,mDAAmD,oBAAoB,KAAK;QAC9E,6DAA6D,CAAC,CAAC;IAChE,OAAO,CAAC,sBAAsB,EAAE,oCAAoC,CAAC,IAAI,CACxE,SAAS,CACT,EAAE,kEAAkE,CAAC,CAAC;IACvE,OAAO,CAAC,0BAA0B,EAAE,mBAAmB,CAAC,IAAI,CAC3D,SAAS,CACT,EAAE,oFAAoF,CAAC,CAAC;IACzF,OAAO,CAAC,yBAAyB,EAAE,CAAC,2BAA2B,CAAC,IAAI,CACnE,SAAS,CACT,EAAE,iDAAiD,CAAC,CAAC;IACtD,OAAO,CAAC,mBAAmB,EAAE,gBAAgB,CAAC,IAAI,CACjD,SAAS,CACT,EAAE,mFAAmF,CAAC,CAAC;IACxF,OAAO,EAAC,EAAE,EAAE,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE,QAAQ,EAAC,CAAC;AAC9C,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "dorfl",
-  "version": "0.14.1",
+  "version": "0.14.2",
   "repository": {
     "type": "git",
     "url": "git+https://github.com/wighawag/dorfl.git",
@@ -36,7 +36,8 @@
     "as-soon": "^0.1.5",
     "tsx": "^4.21.0",
     "typescript": "^5.3.3",
-    "vitest": "^4.0.18"
+    "vitest": "^4.0.18",
+    "yaml": "^2.9.1"
   },
   "scripts": {
     "build": "tsc && node scripts/vendor-protocol.mjs && node scripts/vendor-skills.mjs",

package/src/advance-ci-template.ts

@@ -147,15 +147,23 @@ export function validateAdvanceCiTemplate(
 		'+ `cwd.repo.specs[]` pools), so a ready ungated SPEC becomes one auto-task ' +
 		'matrix leg alongside the eligible-task legs ' +
 		'(`ci-propose-matrix-must-enumerate-sliceable-prds-not-only-slices`).');
-	require('propose-one-advance-per-item', /dorfl advance "?\$\{\{\s*matrix\./.test(
+	require('propose-one-advance-per-item', /WORK_ITEM:\s*\$\{\{\s*matrix\.item\s*\}\}[\s\S]*?dorfl advance "\$\{WORK_ITEM\}"/.test(
 		text,
 	), 'each matrix leg must run one `dorfl advance <matrix item>` ' +
-		'(one PR per item).');
+		'(one PR per item), reading the item from the step env (`WORK_ITEM`).');
+	// The item id is a slug that may be hand-written, so it must reach the shell
+	// as DATA through `env:`, never as `${{ }}` text spliced into the `run:` script
+	// (GitHub Actions script injection).
+	require('matrix-item-not-spliced-into-run', !/dorfl advance "?\$\{\{/.test(
+		text,
+	), 'the matrix item must NOT be interpolated into the `run:` script as ' +
+		'`${{ matrix.item }}` (script injection): pass it through the step `env:` ' +
+		'as `WORK_ITEM` and quote it as `"${WORK_ITEM}"`.');
 	// The matrix leg must carry `--propose` so the integration mode is TIED to the
 	// matrix shape (it cannot desync from the dispatch `integrationMode` input nor
 	// fall back to a repo config default of `merge`). Scoped to the `advance-propose`
 	// job so it is the LEG that carries it, not merely the file somewhere.
-	require('propose-leg-carries-propose-flag', /advance-propose:[\s\S]*?dorfl advance "?\$\{\{\s*matrix\.[\s\S]*?--propose\b/.test(
+	require('propose-leg-carries-propose-flag', /advance-propose:[\s\S]*?dorfl advance "\$\{WORK_ITEM\}"[^\n]*--propose\b/.test(
 		text,
 	), 'each `propose` matrix leg must pass `--propose` so the integration mode is ' +
 		'TIED to the matrix shape (a leg can never merge to main / desync from the ' +
@@ -176,7 +184,7 @@ export function validateAdvanceCiTemplate(
 	// scoped to the `advance-merge:` job so the `--merge` flag is TIED to its leg
 	// (cannot desync from the dispatch `integrationMode` input nor fall back to a
 	// repo config default of `propose`).
-	require('merge-leg-carries-merge-flag', /advance-merge:[\s\S]*?dorfl advance "?\$\{\{\s*matrix\.[\s\S]*?--merge\b/.test(
+	require('merge-leg-carries-merge-flag', /advance-merge:[\s\S]*?dorfl advance "\$\{WORK_ITEM\}"[^\n]*--merge\b/.test(
 		text,
 	), 'each `merge` matrix leg must pass `--merge` so the integration mode is ' +
 		'TIED to the matrix shape (a leg can never propose-only / desync from the ' +

package/src/advance-lifecycle-template.ts

@@ -306,13 +306,26 @@ jobs:
         # surfaceBlockers), so an override that does not reach this job produces an
         # empty matrix and is silently inert. \`if:\` + the inner \`[ -n ... ]\` guard
         # keep schedule/push (and a blank dispatch field) exporting NOTHING — an
-        # empty DORFL_* would make env-config coercion throw.
+        # empty DORFL_* would make env-config coercion throw. The inputs reach the
+        # shell through \`env:\` as DATA, never as \`\${{ }}\` text spliced into the
+        # script (GitHub's script-injection guidance), and the \`case\` guard stops a
+        # value from appending its own lines to $GITHUB_ENV. Both only matter if an
+        # input ever stops being a fixed \`type: choice\`; for the choices below the
+        # step writes exactly what it always did.
         if: \${{ github.event_name == 'workflow_dispatch' }}
+        env:
+          DISPATCH_AUTO_BUILD: \${{ github.event.inputs.autoBuild }}
+          DISPATCH_AUTO_TASK: \${{ github.event.inputs.autoTask }}
+          DISPATCH_OBSERVATION_TRIAGE: \${{ github.event.inputs.observationTriage }}
+          DISPATCH_SURFACE_BLOCKERS: \${{ github.event.inputs.surfaceBlockers }}
         run: |
-          [ -n "\${{ github.event.inputs.autoBuild }}" ] && echo "DORFL_AUTO_BUILD=\${{ github.event.inputs.autoBuild }}" >> "$GITHUB_ENV"
-          [ -n "\${{ github.event.inputs.autoTask }}" ] && echo "DORFL_AUTO_TASK=\${{ github.event.inputs.autoTask }}" >> "$GITHUB_ENV"
-          [ -n "\${{ github.event.inputs.observationTriage }}" ] && echo "DORFL_OBSERVATION_TRIAGE=\${{ github.event.inputs.observationTriage }}" >> "$GITHUB_ENV"
-          [ -n "\${{ github.event.inputs.surfaceBlockers }}" ] && echo "DORFL_SURFACE_BLOCKERS=\${{ github.event.inputs.surfaceBlockers }}" >> "$GITHUB_ENV"
+          case "\${DISPATCH_AUTO_BUILD}\${DISPATCH_AUTO_TASK}\${DISPATCH_OBSERVATION_TRIAGE}\${DISPATCH_SURFACE_BLOCKERS}" in
+            *$'\\n'*|*$'\\r'*) echo "::error::a dispatch gate override contains a line break"; exit 1 ;;
+          esac
+          [ -n "\${DISPATCH_AUTO_BUILD}" ] && echo "DORFL_AUTO_BUILD=\${DISPATCH_AUTO_BUILD}" >> "$GITHUB_ENV"
+          [ -n "\${DISPATCH_AUTO_TASK}" ] && echo "DORFL_AUTO_TASK=\${DISPATCH_AUTO_TASK}" >> "$GITHUB_ENV"
+          [ -n "\${DISPATCH_OBSERVATION_TRIAGE}" ] && echo "DORFL_OBSERVATION_TRIAGE=\${DISPATCH_OBSERVATION_TRIAGE}" >> "$GITHUB_ENV"
+          [ -n "\${DISPATCH_SURFACE_BLOCKERS}" ] && echo "DORFL_SURFACE_BLOCKERS=\${DISPATCH_SURFACE_BLOCKERS}" >> "$GITHUB_ENV"
           true
       - id: scan
         # Enumerate eligible items as namespaced ids, one matrix leg per id. CI
@@ -402,11 +415,19 @@ jobs:
         # DORFL_* ONLY on a workflow_dispatch with a non-blank input, so the
         # one-shot override also reaches the \`advance\` leg that builds the item.
         if: \${{ github.event_name == 'workflow_dispatch' }}
+        env:
+          DISPATCH_AUTO_BUILD: \${{ github.event.inputs.autoBuild }}
+          DISPATCH_AUTO_TASK: \${{ github.event.inputs.autoTask }}
+          DISPATCH_OBSERVATION_TRIAGE: \${{ github.event.inputs.observationTriage }}
+          DISPATCH_SURFACE_BLOCKERS: \${{ github.event.inputs.surfaceBlockers }}
         run: |
-          [ -n "\${{ github.event.inputs.autoBuild }}" ] && echo "DORFL_AUTO_BUILD=\${{ github.event.inputs.autoBuild }}" >> "$GITHUB_ENV"
-          [ -n "\${{ github.event.inputs.autoTask }}" ] && echo "DORFL_AUTO_TASK=\${{ github.event.inputs.autoTask }}" >> "$GITHUB_ENV"
-          [ -n "\${{ github.event.inputs.observationTriage }}" ] && echo "DORFL_OBSERVATION_TRIAGE=\${{ github.event.inputs.observationTriage }}" >> "$GITHUB_ENV"
-          [ -n "\${{ github.event.inputs.surfaceBlockers }}" ] && echo "DORFL_SURFACE_BLOCKERS=\${{ github.event.inputs.surfaceBlockers }}" >> "$GITHUB_ENV"
+          case "\${DISPATCH_AUTO_BUILD}\${DISPATCH_AUTO_TASK}\${DISPATCH_OBSERVATION_TRIAGE}\${DISPATCH_SURFACE_BLOCKERS}" in
+            *$'\\n'*|*$'\\r'*) echo "::error::a dispatch gate override contains a line break"; exit 1 ;;
+          esac
+          [ -n "\${DISPATCH_AUTO_BUILD}" ] && echo "DORFL_AUTO_BUILD=\${DISPATCH_AUTO_BUILD}" >> "$GITHUB_ENV"
+          [ -n "\${DISPATCH_AUTO_TASK}" ] && echo "DORFL_AUTO_TASK=\${DISPATCH_AUTO_TASK}" >> "$GITHUB_ENV"
+          [ -n "\${DISPATCH_OBSERVATION_TRIAGE}" ] && echo "DORFL_OBSERVATION_TRIAGE=\${DISPATCH_OBSERVATION_TRIAGE}" >> "$GITHUB_ENV"
+          [ -n "\${DISPATCH_SURFACE_BLOCKERS}" ] && echo "DORFL_SURFACE_BLOCKERS=\${DISPATCH_SURFACE_BLOCKERS}" >> "$GITHUB_ENV"
           true
       - name: advance one item in-place (propose ⇒ opens a PR)
         # In-place in this checkout (no --isolated/--remote): the CI container IS
@@ -421,13 +442,19 @@ jobs:
         # works zero-config; the job's \`pull-requests: write\` scopes that token.
         env:
           GH_TOKEN: \${{ secrets.DORFL_GH_TOKEN || secrets.GITHUB_TOKEN }}
+          # The item id is a slug read from work/ (frontmatter \`slug:\` or the
+          # file name). dorfl sanitises the slugs it mints, but a hand-written
+          # one is only checked when \`advance\` resolves it, so it reaches the
+          # shell as DATA through env, never as \`\${{ matrix.item }}\` text
+          # spliced into the script.
+          WORK_ITEM: \${{ matrix.item }}
         # \`--watch\` streams the build agent's high-signal turns (assistant text,
         # tool calls, finish) into THIS job log live, so the run shows the agent
         # working instead of freezing after "Start work". A read-only observer (no
         # outcome/gate/git effect). It fits because each matrix leg names ONE item
         # (one pi session to tail) — the merge job is now a per-item matrix too
         # (see below) and streams the same way.
-        run: dorfl advance "\${{ matrix.item }}" --propose --watch --arbiter origin
+        run: dorfl advance "\${WORK_ITEM}" --propose --watch --arbiter origin
 
   # ── MERGE: a MATRIX of independent jobs (parallel build/gate/review, serialised land) ──
   # SPEC \`land-time-reverify-and-parallel-merge-ceiling\` (stories 4 + 6): each item
@@ -468,11 +495,19 @@ jobs:
         # merge job re-scans the pool inside \`advance -n\`, so it needs the override
         # too for the lifecycle/task pools to reflect it.
         if: \${{ github.event_name == 'workflow_dispatch' }}
+        env:
+          DISPATCH_AUTO_BUILD: \${{ github.event.inputs.autoBuild }}
+          DISPATCH_AUTO_TASK: \${{ github.event.inputs.autoTask }}
+          DISPATCH_OBSERVATION_TRIAGE: \${{ github.event.inputs.observationTriage }}
+          DISPATCH_SURFACE_BLOCKERS: \${{ github.event.inputs.surfaceBlockers }}
         run: |
-          [ -n "\${{ github.event.inputs.autoBuild }}" ] && echo "DORFL_AUTO_BUILD=\${{ github.event.inputs.autoBuild }}" >> "$GITHUB_ENV"
-          [ -n "\${{ github.event.inputs.autoTask }}" ] && echo "DORFL_AUTO_TASK=\${{ github.event.inputs.autoTask }}" >> "$GITHUB_ENV"
-          [ -n "\${{ github.event.inputs.observationTriage }}" ] && echo "DORFL_OBSERVATION_TRIAGE=\${{ github.event.inputs.observationTriage }}" >> "$GITHUB_ENV"
-          [ -n "\${{ github.event.inputs.surfaceBlockers }}" ] && echo "DORFL_SURFACE_BLOCKERS=\${{ github.event.inputs.surfaceBlockers }}" >> "$GITHUB_ENV"
+          case "\${DISPATCH_AUTO_BUILD}\${DISPATCH_AUTO_TASK}\${DISPATCH_OBSERVATION_TRIAGE}\${DISPATCH_SURFACE_BLOCKERS}" in
+            *$'\\n'*|*$'\\r'*) echo "::error::a dispatch gate override contains a line break"; exit 1 ;;
+          esac
+          [ -n "\${DISPATCH_AUTO_BUILD}" ] && echo "DORFL_AUTO_BUILD=\${DISPATCH_AUTO_BUILD}" >> "$GITHUB_ENV"
+          [ -n "\${DISPATCH_AUTO_TASK}" ] && echo "DORFL_AUTO_TASK=\${DISPATCH_AUTO_TASK}" >> "$GITHUB_ENV"
+          [ -n "\${DISPATCH_OBSERVATION_TRIAGE}" ] && echo "DORFL_OBSERVATION_TRIAGE=\${DISPATCH_OBSERVATION_TRIAGE}" >> "$GITHUB_ENV"
+          [ -n "\${DISPATCH_SURFACE_BLOCKERS}" ] && echo "DORFL_SURFACE_BLOCKERS=\${DISPATCH_SURFACE_BLOCKERS}" >> "$GITHUB_ENV"
           true
       - name: advance one item in-place (merge ⇒ rebase + CAS land on main)
         # In-place (no --isolated/--remote). \`--merge\` ties the integration mode
@@ -483,10 +518,16 @@ jobs:
         # \`GH_TOKEN\` from the env.
         env:
           GH_TOKEN: \${{ secrets.DORFL_GH_TOKEN || secrets.GITHUB_TOKEN }}
+          # The item id is a slug read from work/ (frontmatter \`slug:\` or the
+          # file name). dorfl sanitises the slugs it mints, but a hand-written
+          # one is only checked when \`advance\` resolves it, so it reaches the
+          # shell as DATA through env, never as \`\${{ matrix.item }}\` text
+          # spliced into the script.
+          WORK_ITEM: \${{ matrix.item }}
         # \`--watch\` streams the build agent's high-signal turns into THIS job
         # log live; each leg names ONE item, so it fits the same way it does on
         # the propose legs.
-        run: dorfl advance "\${{ matrix.item }}" --merge --watch --arbiter origin
+        run: dorfl advance "\${WORK_ITEM}" --merge --watch --arbiter origin
 
   # ── REAP merged remote work/* branches (capability F, the hygiene sweep) ─────
   # PRESERVED from the seed (NOT a separate gc-sweep workflow): the provider-
@@ -607,11 +648,19 @@ export function validateAdvanceLifecycleWorkflow(
 		text,
 	), 'the matrix items must be ENUMERATED via the eligible-pool scan ' +
 		'(`dorfl scan --json`).');
-	require('propose-one-advance-per-item', /dorfl advance "?\$\{\{\s*matrix\./.test(
+	require('propose-one-advance-per-item', /WORK_ITEM:\s*\$\{\{\s*matrix\.item\s*\}\}[\s\S]*?dorfl advance "\$\{WORK_ITEM\}"/.test(
 		text,
 	), 'each matrix leg must run one `dorfl advance <matrix item>` ' +
-		'(one PR per item).');
-	require('propose-leg-carries-propose-flag', /advance-propose:[\s\S]*?dorfl advance "?\$\{\{\s*matrix\.[\s\S]*?--propose\b/.test(
+		'(one PR per item), reading the item from the step env (`WORK_ITEM`).');
+	// The item id is a slug that may be hand-written (only minted slugs are
+	// sanitised), so it must reach the shell as DATA through `env:`, never as `${{ }}` text
+	// spliced into the `run:` script (GitHub Actions script injection).
+	require('matrix-item-not-spliced-into-run', !/dorfl advance "?\$\{\{/.test(
+		operative,
+	), 'the matrix item must NOT be interpolated into the `run:` script as ' +
+		'`${{ matrix.item }}` (script injection): pass it through the step `env:` ' +
+		'as `WORK_ITEM` and quote it as `"${WORK_ITEM}"`.');
+	require('propose-leg-carries-propose-flag', /advance-propose:[\s\S]*?dorfl advance "\$\{WORK_ITEM\}"[^\n]*--propose\b/.test(
 		text,
 	), 'each `propose` matrix leg must pass `--propose` so the integration mode is ' +
 		'TIED to the matrix shape (a leg can never merge to main / desync from the ' +
@@ -626,7 +675,7 @@ export function validateAdvanceLifecycleWorkflow(
 	), 'the `merge` job must use a MATRIX (parallel build/gate/review per item; ' +
 		"the land tail is serialised by the engine's `mergeRetries` CAS-retry " +
 		"loop, not by the workflow's job shape).");
-	require('merge-leg-carries-merge-flag', /advance-merge:[\s\S]*?dorfl advance "?\$\{\{\s*matrix\.[\s\S]*?--merge\b/.test(
+	require('merge-leg-carries-merge-flag', /advance-merge:[\s\S]*?dorfl advance "\$\{WORK_ITEM\}"[^\n]*--merge\b/.test(
 		text,
 	), 'each `merge` matrix leg must pass `--merge` so the integration mode is ' +
 		'TIED to the matrix shape (a leg can never propose-only / desync from the ' +
@@ -692,9 +741,14 @@ export function validateAdvanceLifecycleWorkflow(
 		['observationTriage', 'DORFL_OBSERVATION_TRIAGE'],
 		['surfaceBlockers', 'DORFL_SURFACE_BLOCKERS'],
 	] as const) {
-		// The override is a guarded shell write: `[ -n <input> ] && echo <ENV>=<input> >> $GITHUB_ENV`.
+		// The override is a guarded shell write of a step-env copy of the input:
+		// `env: DISPATCH_<X>: ${{ inputs.<x> }}` then
+		// `[ -n "${DISPATCH_<X>}" ] && echo "<ENV>=${DISPATCH_<X>}" >> $GITHUB_ENV`.
+		// The input never appears as `${{ }}` text inside the `run:` script.
+		const dispatchVar = envVar.replace(/^DORFL_/, 'DISPATCH_');
 		const guardedWrite = new RegExp(
-			`\\[ -n "\\$\\{\\{ github\\.event\\.inputs\\.${input} \\}\\}" \\][\\s\\S]*?${envVar}=`,
+			`${dispatchVar}:\\s*\\$\\{\\{ github\\.event\\.inputs\\.${input} \\}\\}` +
+				`[\\s\\S]*?\\[ -n "\\$\\{${dispatchVar}\\}" \\] && echo "${envVar}=\\$\\{${dispatchVar}\\}"`,
 		);
 		require(`dispatch-${input}-guarded-write`, guardedWrite.test(
 			text,

package/src/cli.ts

@@ -1108,8 +1108,8 @@ interface CloseMergedIssuesFlags {
  * it prints the error to stderr and exits 1 (the task-only commands never act on
  * a spec). An OMITTED slug (`start`/`complete`/`prompt` infer it from the branch)
  * passes through untouched. (The legacy ''prd:'' prefix is a DEAD namespace token
- * after the hard cutover — it is neither special-cased nor rejected here; a
- * ''prd:<slug>'' arg resolves as a bare literal task slug.)
+ * after the hard cutover: it is not special-cased here; a ''prd:<slug>'' arg
+ * is refused by the shared safe-slug check, since `:` is not a slug character.)
  *
  * `do` is the ONE command that spans both namespaces; it consumes the full
  * `resolveSlug` (with the cross-namespace collision check) in the `do-in-place`

package/src/close-job-template.ts

@@ -34,6 +34,7 @@
  */
 
 import type {ResolvedCIConfig} from './install-ci-core.js';
+import {shouldDropCheckoutCredentials} from './install-ci-core.js';
 
 /** The capability id (the registry key + the emitted workflow file stem). */
 export const CLOSE_JOB_CAPABILITY_ID = 'close-job';
@@ -52,7 +53,19 @@ export const CLOSE_JOB_WORKFLOW_PATH = 'workflows/close-job.yml';
  * and future per-config wiring, but the close-job shape itself is
  * config-independent.
  */
-export function generateCloseJobWorkflow(_config: ResolvedCIConfig): string {
+export function generateCloseJobWorkflow(config: ResolvedCIConfig): string {
+	// `persist-credentials: false` ONLY on a repo KNOWN to be public (see
+	// {@link shouldDropCheckoutCredentials}): this job has `contents: read`, so
+	// the persisted token can only ever read, and on a public repo reads need
+	// no token. Unknown / private / internal ⇒ today's checkout, unchanged.
+	const checkoutCredentials = shouldDropCheckoutCredentials(config)
+		? `
+          # Public repository: every git read works without a token, and this
+          # job cannot push, so do not leave the token in .git/config for later
+          # steps (the setup action, including any project-setup hook, and
+          # close-merged-issues) to read.
+          persist-credentials: false`
+		: '';
 	return `\
 # dorfl — the ISSUE CLOSE-JOB in CI (capability E, spec runner-in-ci).
 # EMITTED by \`dorfl install-ci\`; the human commits it. DO NOT hand-edit a
@@ -112,7 +125,7 @@ jobs:
     steps:
       - uses: actions/checkout@v5
         with:
-          fetch-depth: 0
+          fetch-depth: 0${checkoutCredentials}
       - uses: ./.github/actions/dorfl-setup
       - name: close issues whose work has landed on main
         # In-place in this checkout (no --isolated/--remote): the CI container IS

package/src/install-ci-core.ts

@@ -141,6 +141,44 @@ export interface ResolvedCIConfig {
 	projectSetup?: Record<string, unknown>;
 	/** See {@link CIConfigFile.maxParallel}. Always resolved (default applied). */
 	maxParallel: number;
+	/**
+	 * The repo's visibility, DETECTED at generation time through the provider
+	 * seam ({@link CIProviderContext.getRepoVisibility}); never read from or
+	 * written to a config file (it is a fact about the repo, not a choice).
+	 * `undefined` ⇒ unknown, which keeps the conservative output. See
+	 * {@link shouldDropCheckoutCredentials}.
+	 */
+	repoVisibility?: RepoVisibility;
+}
+
+/**
+ * A repository's visibility on its CI provider. Used ONLY to decide whether the
+ * read-only jobs (verify, close-job) may check out with
+ * `persist-credentials: false`: on a PUBLIC repo every git read works without a
+ * token, so dropping the persisted token cannot break a fetch; on a private or
+ * internal repo (or when visibility is unknown) a fetch may need it.
+ */
+export type RepoVisibility = 'public' | 'private' | 'internal';
+
+/** Parse a provider's visibility answer (`PUBLIC`, `private`, ...); unknown ⇒ `undefined`. */
+export function parseRepoVisibility(raw: string): RepoVisibility | undefined {
+	const v = raw.trim().toLowerCase();
+	return v === 'public' || v === 'private' || v === 'internal' ? v : undefined;
+}
+
+/**
+ * Whether the read-only jobs (verify, close-job) should check out with
+ * `persist-credentials: false`. True ONLY when the repo is KNOWN to be public:
+ * then the persisted token adds nothing a git read needs (those jobs have
+ * `contents: read`, so they cannot push either way), while leaving it in
+ * `.git/config` hands it to every later step, including the project-setup
+ * hook's dependency installs. Unknown or non-public ⇒ keep today's checkout, so
+ * a project gate that runs `git fetch` on a private repo keeps working.
+ */
+export function shouldDropCheckoutCredentials(
+	config: Pick<ResolvedCIConfig, 'repoVisibility'>,
+): boolean {
+	return config.repoVisibility === 'public';
 }
 
 /** The default harness the composite setup action installs. */
@@ -222,6 +260,13 @@ export interface CIProviderContext {
 	 * no default-branch concept.
 	 */
 	getDefaultBranch?(): Promise<string | undefined>;
+	/**
+	 * OPTIONALLY report the repo's VISIBILITY (GitHub:
+	 * `gh repo view --json visibility`). Read-only. Returns `undefined` when the
+	 * lookup fails; absent on a provider with no such concept. Drives
+	 * {@link shouldDropCheckoutCredentials}.
+	 */
+	getRepoVisibility?(): Promise<RepoVisibility | undefined>;
 	/**
 	 * OPTIONALLY create/replace a branch RULESET (GitHub:
 	 * `POST /repos/{owner}/{repo}/rulesets`) carrying the deadlock-guard
@@ -673,6 +718,75 @@ function indent(text: string, spaces: number): string {
 		.join('\n');
 }
 
+/**
+ * The npm package the composite setup action installs for the `pi` harness.
+ *
+ * Upstream moved the harness from `@mariozechner/pi-coding-agent` (deprecated,
+ * frozen at 0.73.1) to this name. The binary is still `pi` and it still reads
+ * `~/.pi/agent/` (models.json / auth.json), so nothing else in the generated
+ * action changes.
+ */
+export const PI_HARNESS_PACKAGE = '@earendil-works/pi-coding-agent';
+
+/**
+ * The EXACT `pi` harness version the composite setup action installs.
+ *
+ * Pinned because the install runs in jobs that hold `contents: write` and a
+ * provider API key: an unpinned `npm install -g` resolves whatever `latest` is
+ * at RUN time, so a compromised or broken release would reach those
+ * credentials with no review and no lockfile to catch it.
+ *
+ * It is a constant dorfl DECLARES (not an install-ci parameter) because the
+ * harness is coupled to dorfl, not to the consumer: dorfl drives `pi` through
+ * its CLI flags and reads its session files (`session-path.ts`,
+ * `watch-session.ts`), so the harness version that works is a property of the
+ * dorfl release. Bump it here, with a changeset, when a dorfl release needs a
+ * newer harness; every consumer picks it up on their next `install-ci` run.
+ *
+ * 0.80.6 is the version dorfl is exercised against day to day (the maintainer's
+ * installed `pi`), not the newest release: a harness upgrade should be a
+ * deliberate, tested bump. It requires Node >= 22.19.0, which the action's
+ * `node-version: '22'` satisfies (setup-node resolves the latest 22.x).
+ */
+export const PI_HARNESS_VERSION = '0.80.6';
+
+/**
+ * The version of THIS dorfl package, read at runtime from its own
+ * `package.json` (the single source changesets bumps on release). The composite
+ * setup action installs `dorfl@<this version>` so a consumer's CI runs the SAME
+ * CLI that generated its workflows, instead of whatever `latest` is at run time.
+ *
+ * Resolved relative to this module (`dist/install-ci-core.js` or
+ * `src/install-ci-core.ts` → `../package.json`), so it works from the built CLI
+ * and under tsx. Throws when the version cannot be read: silently falling back
+ * to an unpinned install would reintroduce exactly the risk the pin removes.
+ */
+export function dorflPackageVersion(): string {
+	const here = dirname(fileURLToPath(import.meta.url));
+	const pkgPath = join(here, '..', 'package.json');
+	let version: unknown;
+	try {
+		version = (JSON.parse(readFileSync(pkgPath, 'utf8')) as {version?: unknown})
+			.version;
+	} catch (err) {
+		throw new Error(
+			`install-ci: cannot read dorfl's own version from ${pkgPath} ` +
+				`(needed to pin \`npm install -g dorfl@<version>\`): ` +
+				(err instanceof Error ? err.message : String(err)),
+		);
+	}
+	if (
+		typeof version !== 'string' ||
+		!/^\d+\.\d+\.\d+(?:[-+][0-9A-Za-z.+-]+)?$/.test(version)
+	) {
+		throw new Error(
+			`install-ci: dorfl's package.json at ${pkgPath} has no usable semver ` +
+				`"version" (got ${JSON.stringify(version)}); cannot pin the CI install.`,
+		);
+	}
+	return version;
+}
+
 /**
  * The install step for the configured harness (the `pi` CLI; `''` ⇒ none).
  * `registry` mode installs via `npm install -g`; `workspace` mode installs via
@@ -684,11 +798,15 @@ function harnessInstallStep(
 	installSource: InstallSource,
 ): string {
 	if (harness === 'pi') {
+		const spec = `${PI_HARNESS_PACKAGE}@${PI_HARNESS_VERSION}`;
 		const run =
 			installSource === 'workspace'
-				? 'pnpm add -g @mariozechner/pi-coding-agent'
-				: 'npm install -g @mariozechner/pi-coding-agent';
+				? `pnpm add -g ${spec}`
+				: `npm install -g ${spec}`;
 		return `
+    # Pinned to the exact harness version this dorfl release declares
+    # (PI_HARNESS_VERSION): the job holds write access and a provider key, so the
+    # version must not move on its own. Re-run \`dorfl install-ci\` to upgrade.
     - name: Install agent harness (pi)
       shell: bash
       run: ${run}`;
@@ -815,17 +933,25 @@ ${indent(modelsJsonStr, 8)}
         pnpm setup
         echo "$HOME/.local/share/pnpm" >> "$GITHUB_PATH"
 
+    # \`--ignore-scripts\`: nothing here needs an install-time script. The build is
+    # explicit (\`pnpm -r build\` below; the root \`prepare\` would only repeat it),
+    # and verify runs on fork pull requests, where a lifecycle script would run
+    # the fork's code before any gate does.
     - name: Install dependencies and build dorfl
       shell: bash
       run: |
-        pnpm install
+        pnpm install --ignore-scripts
         pnpm -r build
         cd packages/dorfl && pnpm link --global${installHarness}`;
 	} else {
 		installSteps = `\
+    # Pinned to the dorfl version that generated this action, so CI runs the
+    # same CLI that wrote these workflows (and never an unreviewed \`latest\` in a
+    # job holding write access and a provider key). Re-run \`dorfl install-ci\`
+    # after upgrading dorfl to move the pin.
     - name: Install dorfl
       shell: bash
-      run: npm install -g dorfl${installHarness}`;
+      run: npm install -g dorfl@${dorflPackageVersion()}${installHarness}`;
 	}
 
 	// NO bespoke CI resolver shim (task install-ci-shim-converges-on-dorfl-cmd,