narai-primitives 2.1.3 → 2.3.0

package/dist/toolkit/agent_resolver.d.ts

@@ -9,8 +9,10 @@
  *      `<narai-primitives root>/dist/connectors/<name>/cli.js`. The
  *      resolver derives that root from its own file path via
  *      `import.meta.url`, so the lookup works regardless of install layout.
- *   3. `~/.claude/plugins/cache/<name>-agent-plugin*` — populated by Claude
- *      Code's plugin manager.
+ *   3. `~/.claude/plugins/cache/<name>-connector-plugin*` or
+ *      `<name>-agent-plugin*` — populated by Claude Code's plugin manager.
+ *      Both the post-rename and pre-rename forms are checked so users with
+ *      mixed plugin caches resolve correctly during migration.
  *   4. `${CLAUDE_PLUGIN_DATA}/node_modules/<package>/<cliRelativePath>` —
  *      where the connector's `SessionStart` hook installs it.
  *   5. `~/src/connectors/<name>-agent-connector/<cliRelativePath>` — the
@@ -19,14 +21,22 @@
  *
  * Returns null if no candidate exists, so callers can fail with a clear
  * message instead of crashing on `spawn`.
+ *
+ * Set `NARAI_DEBUG_RESOLVER=1` to emit a one-line stderr breadcrumb for each
+ * resolution attempt — off by default; intended for diagnosing silent CLI
+ * misses in the field.
  */
 export interface ResolveAgentCliOptions {
     /** Connector short name (e.g. `"confluence"`, `"db"`, `"aws"`). */
     name: string;
     /** Override env-var name. Default: `<NAME>_AGENT_CLI` (uppercased + underscores for hyphens). */
     envVar?: string;
-    /** Substring matched against entries in `~/.claude/plugins/cache/`. Default: `<name>-agent-plugin`. */
-    pluginNameContains?: string;
+    /**
+     * Substring(s) matched against entries in `~/.claude/plugins/cache/`.
+     * Default: `["<name>-connector-plugin", "<name>-agent-plugin"]` (both
+     * post-rename and pre-rename forms).
+     */
+    pluginNameContains?: string | string[];
     /** npm package the connector is published as. Default: `@narai/<name>-agent-connector`. */
     packageName?: string;
     /** CLI path within the package. Default: `dist/cli.js`. */

package/dist/toolkit/agent_resolver.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"agent_resolver.d.ts","sourceRoot":"","sources":["../../src/toolkit/agent_resolver.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;AAOH,MAAM,WAAW,sBAAsB;IACrC,mEAAmE;IACnE,IAAI,EAAE,MAAM,CAAC;IACb,iGAAiG;IACjG,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,uGAAuG;IACvG,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAC5B,2FAA2F;IAC3F,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,2DAA2D;IAC3D,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,uDAAuD;IACvD,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB;;;;;;;OAOG;IACH,eAAe,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAChC,oFAAoF;IACpF,WAAW,CAAC,EAAE,MAAM,CAAC,UAAU,CAAC;IAChC,kDAAkD;IAClD,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB;AAED,MAAM,MAAM,gBAAgB,GACxB,KAAK,GACL,cAAc,GACd,cAAc,GACd,oBAAoB,GACpB,cAAc,CAAC;AAEnB,MAAM,WAAW,gBAAgB;IAC/B,wEAAwE;IACxE,OAAO,EAAE,MAAM,CAAC;IAChB,6FAA6F;IAC7F,IAAI,EAAE,MAAM,EAAE,CAAC;IACf,2EAA2E;IAC3E,MAAM,EAAE,gBAAgB,CAAC;IACzB,4CAA4C;IAC5C,YAAY,EAAE,MAAM,CAAC;CACtB;AAqCD,wBAAgB,eAAe,CAAC,IAAI,EAAE,sBAAsB,GAAG,gBAAgB,GAAG,IAAI,CA2ErF"}
+{"version":3,"file":"agent_resolver.d.ts","sourceRoot":"","sources":["../../src/toolkit/agent_resolver.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AAOH,MAAM,WAAW,sBAAsB;IACrC,mEAAmE;IACnE,IAAI,EAAE,MAAM,CAAC;IACb,iGAAiG;IACjG,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB;;;;OAIG;IACH,kBAAkB,CAAC,EAAE,MAAM,GAAG,MAAM,EAAE,CAAC;IACvC,2FAA2F;IAC3F,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,2DAA2D;IAC3D,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,uDAAuD;IACvD,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB;;;;;;;OAOG;IACH,eAAe,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAChC,oFAAoF;IACpF,WAAW,CAAC,EAAE,MAAM,CAAC,UAAU,CAAC;IAChC,kDAAkD;IAClD,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB;AAED,MAAM,MAAM,gBAAgB,GACxB,KAAK,GACL,cAAc,GACd,cAAc,GACd,oBAAoB,GACpB,cAAc,CAAC;AAEnB,MAAM,WAAW,gBAAgB;IAC/B,wEAAwE;IACxE,OAAO,EAAE,MAAM,CAAC;IAChB,6FAA6F;IAC7F,IAAI,EAAE,MAAM,EAAE,CAAC;IACf,2EAA2E;IAC3E,MAAM,EAAE,gBAAgB,CAAC;IACzB,4CAA4C;IAC5C,YAAY,EAAE,MAAM,CAAC;CACtB;AAsDD,wBAAgB,eAAe,CAAC,IAAI,EAAE,sBAAsB,GAAG,gBAAgB,GAAG,IAAI,CAqFrF"}

package/dist/toolkit/agent_resolver.js

@@ -9,8 +9,10 @@
  *      `<narai-primitives root>/dist/connectors/<name>/cli.js`. The
  *      resolver derives that root from its own file path via
  *      `import.meta.url`, so the lookup works regardless of install layout.
- *   3. `~/.claude/plugins/cache/<name>-agent-plugin*` — populated by Claude
- *      Code's plugin manager.
+ *   3. `~/.claude/plugins/cache/<name>-connector-plugin*` or
+ *      `<name>-agent-plugin*` — populated by Claude Code's plugin manager.
+ *      Both the post-rename and pre-rename forms are checked so users with
+ *      mixed plugin caches resolve correctly during migration.
  *   4. `${CLAUDE_PLUGIN_DATA}/node_modules/<package>/<cliRelativePath>` —
  *      where the connector's `SessionStart` hook installs it.
  *   5. `~/src/connectors/<name>-agent-connector/<cliRelativePath>` — the
@@ -19,6 +21,10 @@
  *
  * Returns null if no candidate exists, so callers can fail with a clear
  * message instead of crashing on `spawn`.
+ *
+ * Set `NARAI_DEBUG_RESOLVER=1` to emit a one-line stderr breadcrumb for each
+ * resolution attempt — off by default; intended for diagnosing silent CLI
+ * misses in the field.
  */
 import * as fs from "node:fs";
 import * as os from "node:os";
@@ -27,8 +33,13 @@ import { fileURLToPath } from "node:url";
 function defaultEnvVar(name) {
     return `${name.toUpperCase().replace(/-/g, "_")}_AGENT_CLI`;
 }
-function defaultPluginNameContains(name) {
-    return `${name}-agent-plugin`;
+/**
+ * Default substrings matched against entries in ~/.claude/plugins/cache/.
+ * Returns both the post-rename and pre-rename forms so users with mixed
+ * plugin caches resolve correctly during migration.
+ */
+function defaultPluginNameSubstrings(name) {
+    return [`${name}-connector-plugin`, `${name}-agent-plugin`];
 }
 function defaultPackageName(name) {
     return `@narai/${name}-agent-connector`;
@@ -55,11 +66,26 @@ function defaultBundledSelfRoot() {
         return null;
     }
 }
+/**
+ * Emit a one-line breadcrumb to stderr when `NARAI_DEBUG_RESOLVER=1` is set.
+ *
+ * Off by default — operators opt in when diagnosing silent CLI-not-found or
+ * unexpected-fallback failures (the class of bug that drove 2.1.1/2.1.2).
+ */
+function debugLog(env, msg) {
+    if (env["NARAI_DEBUG_RESOLVER"] === "1") {
+        process.stderr.write(`[narai-primitives:resolver] ${msg}\n`);
+    }
+}
 export function resolveAgentCli(opts) {
     const env = opts.envOverride ?? process.env;
     const home = opts.homeOverride ?? os.homedir();
     const envVar = opts.envVar ?? defaultEnvVar(opts.name);
-    const pluginContains = opts.pluginNameContains ?? defaultPluginNameContains(opts.name);
+    const pluginContainsList = Array.isArray(opts.pluginNameContains)
+        ? opts.pluginNameContains
+        : opts.pluginNameContains !== undefined
+            ? [opts.pluginNameContains]
+            : defaultPluginNameSubstrings(opts.name);
     const packageName = opts.packageName ?? defaultPackageName(opts.name);
     const cliRelative = opts.cliRelativePath ?? "dist/cli.js";
     const devRoot = opts.devRoot ?? defaultDevRoot(home);
@@ -69,6 +95,7 @@ export function resolveAgentCli(opts) {
     // 1. Explicit env-var override.
     const envPath = env[envVar];
     if (typeof envPath === "string" && envPath !== "" && fs.existsSync(envPath)) {
+        debugLog(env, `'${opts.name}' resolved via env (${envVar}): ${envPath}`);
         return { command: "node", args: [envPath], source: "env", resolvedPath: envPath };
     }
     // 2. Bundled-self: the canonical 2.x layout ships every connector CLI at
@@ -78,6 +105,7 @@ export function resolveAgentCli(opts) {
     if (bundledSelfRoot !== null) {
         const bundledCli = path.join(bundledSelfRoot, "dist", "connectors", opts.name, "cli.js");
         if (fs.existsSync(bundledCli)) {
+            debugLog(env, `'${opts.name}' resolved via bundled-self: ${bundledCli}`);
             return {
                 command: "node",
                 args: [bundledCli],
@@ -97,10 +125,11 @@ export function resolveAgentCli(opts) {
             entries = [];
         }
         for (const entry of entries) {
-            if (!entry.includes(pluginContains))
+            if (!pluginContainsList.some((sub) => entry.includes(sub)))
                 continue;
             const candidate = path.join(pluginCache, entry, "node_modules", packageName, cliRelative);
             if (fs.existsSync(candidate)) {
+                debugLog(env, `'${opts.name}' resolved via plugin-cache: ${candidate}`);
                 return { command: "node", args: [candidate], source: "plugin-cache", resolvedPath: candidate };
             }
         }
@@ -110,14 +139,17 @@ export function resolveAgentCli(opts) {
     if (typeof pluginData === "string" && pluginData !== "") {
         const candidate = path.join(pluginData, "node_modules", packageName, cliRelative);
         if (fs.existsSync(candidate)) {
+            debugLog(env, `'${opts.name}' resolved via claude-plugin-data: ${candidate}`);
             return { command: "node", args: [candidate], source: "claude-plugin-data", resolvedPath: candidate };
         }
     }
     // 5. Dev fallback (legacy ~/src/connectors/<name>-agent-connector layout).
     const devCandidate = path.join(devRoot, `${opts.name}-agent-connector`, cliRelative);
     if (fs.existsSync(devCandidate)) {
+        debugLog(env, `'${opts.name}' resolved via dev-fallback: ${devCandidate}`);
         return { command: "node", args: [devCandidate], source: "dev-fallback", resolvedPath: devCandidate };
     }
+    debugLog(env, `'${opts.name}' not resolved (no candidate found in any of: env, bundled-self, plugin-cache, claude-plugin-data, dev-fallback)`);
     return null;
 }
 //# sourceMappingURL=agent_resolver.js.map

package/dist/toolkit/agent_resolver.js.map

@@ -1 +1 @@
-{"version":3,"file":"agent_resolver.js","sourceRoot":"","sources":["../../src/toolkit/agent_resolver.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;AAEH,OAAO,KAAK,EAAE,MAAM,SAAS,CAAC;AAC9B,OAAO,KAAK,EAAE,MAAM,SAAS,CAAC;AAC9B,OAAO,KAAK,IAAI,MAAM,WAAW,CAAC;AAClC,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AAgDzC,SAAS,aAAa,CAAC,IAAY;IACjC,OAAO,GAAG,IAAI,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,YAAY,CAAC;AAC9D,CAAC;AAED,SAAS,yBAAyB,CAAC,IAAY;IAC7C,OAAO,GAAG,IAAI,eAAe,CAAC;AAChC,CAAC;AAED,SAAS,kBAAkB,CAAC,IAAY;IACtC,OAAO,UAAU,IAAI,kBAAkB,CAAC;AAC1C,CAAC;AAED,SAAS,cAAc,CAAC,IAAY;IAClC,OAAO,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,KAAK,EAAE,YAAY,CAAC,CAAC;AAC9C,CAAC;AAED;;;;;;;;;GASG;AACH,SAAS,sBAAsB;IAC7B,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAC5C,OAAO,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC;IACtD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,MAAM,UAAU,eAAe,CAAC,IAA4B;IAC1D,MAAM,GAAG,GAAG,IAAI,CAAC,WAAW,IAAI,OAAO,CAAC,GAAG,CAAC;IAC5C,MAAM,IAAI,GAAG,IAAI,CAAC,YAAY,IAAI,EAAE,CAAC,OAAO,EAAE,CAAC;IAC/C,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,IAAI,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACvD,MAAM,cAAc,GAAG,IAAI,CAAC,kBAAkB,IAAI,yBAAyB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACvF,MAAM,WAAW,GAAG,IAAI,CAAC,WAAW,IAAI,kBAAkB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACtE,MAAM,WAAW,GAAG,IAAI,CAAC,eAAe,IAAI,aAAa,CAAC;IAC1D,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,IAAI,cAAc,CAAC,IAAI,CAAC,CAAC;IACrD,MAAM,eAAe,GACnB,IAAI,CAAC,eAAe,KAAK,IAAI;QAC3B,CAAC,CAAC,IAAI;QACN,CAAC,CAAC,CAAC,IAAI,CAAC,eAAe,IAAI,sBAAsB,EAAE,CAAC,CAAC;IAEzD,gCAAgC;IAChC,MAAM,OAAO,GAAG,GAAG,CAAC,MAAM,CAAC,CAAC;IAC5B,IAAI,OAAO,OAAO,KAAK,QAAQ,IAAI,OAAO,KAAK,EAAE,IAAI,EAAE,CAAC,UAAU,CAAC,OAAO,CAAC,EAAE,CAAC;QAC5E,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,YAAY,EAAE,OAAO,EAAE,CAAC;IACpF,CAAC;IAED,yEAAyE;IACzE,0EAA0E;IAC1E,uEAAuE;IACvE,wEAAwE;IACxE,IAAI,eAAe,KAAK,IAAI,EAAE,CAAC;QAC7B,MAAM,UAAU,GAAG,IAAI,CAAC,IAAI,CAC1B,eAAe,EACf,MAAM,EACN,YAAY,EACZ,IAAI,CAAC,IAAI,EACT,QAAQ,CACT,CAAC;QACF,IAAI,EAAE,CAAC,UAAU,CAAC,UAAU,CAAC,EAAE,CAAC;YAC9B,OAAO;gBACL,OAAO,EAAE,MAAM;gBACf,IAAI,EAAE,CAAC,UAAU,CAAC;gBAClB,MAAM,EAAE,cAAc;gBACtB,YAAY,EAAE,UAAU;aACzB,CAAC;QACJ,CAAC;IACH,CAAC;IAED,0BAA0B;IAC1B,MAAM,WAAW,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,SAAS,EAAE,SAAS,EAAE,OAAO,CAAC,CAAC;IACnE,IAAI,EAAE,CAAC,UAAU,CAAC,WAAW,CAAC,EAAE,CAAC;QAC/B,IAAI,OAAiB,CAAC;QACtB,IAAI,CAAC;YACH,OAAO,GAAG,EAAE,CAAC,WAAW,CAAC,WAAW,CAAC,CAAC;QACxC,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,GAAG,EAAE,CAAC;QACf,CAAC;QACD,KAAK,MAAM,KAAK,IAAI,OAAO,EAAE,CAAC;YAC5B,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,cAAc,CAAC;gBAAE,SAAS;YAC9C,MAAM,SAAS,GAAG,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,KAAK,EAAE,cAAc,EAAE,WAAW,EAAE,WAAW,CAAC,CAAC;YAC1F,IAAI,EAAE,CAAC,UAAU,CAAC,SAAS,CAAC,EAAE,CAAC;gBAC7B,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,SAAS,CAAC,EAAE,MAAM,EAAE,cAAc,EAAE,YAAY,EAAE,SAAS,EAAE,CAAC;YACjG,CAAC;QACH,CAAC;IACH,CAAC;IAED,0CAA0C;IAC1C,MAAM,UAAU,GAAG,GAAG,CAAC,oBAAoB,CAAC,CAAC;IAC7C,IAAI,OAAO,UAAU,KAAK,QAAQ,IAAI,UAAU,KAAK,EAAE,EAAE,CAAC;QACxD,MAAM,SAAS,GAAG,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,cAAc,EAAE,WAAW,EAAE,WAAW,CAAC,CAAC;QAClF,IAAI,EAAE,CAAC,UAAU,CAAC,SAAS,CAAC,EAAE,CAAC;YAC7B,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,SAAS,CAAC,EAAE,MAAM,EAAE,oBAAoB,EAAE,YAAY,EAAE,SAAS,EAAE,CAAC;QACvG,CAAC;IACH,CAAC;IAED,2EAA2E;IAC3E,MAAM,YAAY,GAAG,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,GAAG,IAAI,CAAC,IAAI,kBAAkB,EAAE,WAAW,CAAC,CAAC;IACrF,IAAI,EAAE,CAAC,UAAU,CAAC,YAAY,CAAC,EAAE,CAAC;QAChC,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,YAAY,CAAC,EAAE,MAAM,EAAE,cAAc,EAAE,YAAY,EAAE,YAAY,EAAE,CAAC;IACvG,CAAC;IAED,OAAO,IAAI,CAAC;AACd,CAAC"}
+{"version":3,"file":"agent_resolver.js","sourceRoot":"","sources":["../../src/toolkit/agent_resolver.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AAEH,OAAO,KAAK,EAAE,MAAM,SAAS,CAAC;AAC9B,OAAO,KAAK,EAAE,MAAM,SAAS,CAAC;AAC9B,OAAO,KAAK,IAAI,MAAM,WAAW,CAAC;AAClC,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AAoDzC,SAAS,aAAa,CAAC,IAAY;IACjC,OAAO,GAAG,IAAI,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,YAAY,CAAC;AAC9D,CAAC;AAED;;;;GAIG;AACH,SAAS,2BAA2B,CAAC,IAAY;IAC/C,OAAO,CAAC,GAAG,IAAI,mBAAmB,EAAE,GAAG,IAAI,eAAe,CAAC,CAAC;AAC9D,CAAC;AAED,SAAS,kBAAkB,CAAC,IAAY;IACtC,OAAO,UAAU,IAAI,kBAAkB,CAAC;AAC1C,CAAC;AAED,SAAS,cAAc,CAAC,IAAY;IAClC,OAAO,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,KAAK,EAAE,YAAY,CAAC,CAAC;AAC9C,CAAC;AAED;;;;;;;;;GASG;AACH,SAAS,sBAAsB;IAC7B,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAC5C,OAAO,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC;IACtD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED;;;;;GAKG;AACH,SAAS,QAAQ,CAAC,GAAsB,EAAE,GAAW;IACnD,IAAI,GAAG,CAAC,sBAAsB,CAAC,KAAK,GAAG,EAAE,CAAC;QACxC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,+BAA+B,GAAG,IAAI,CAAC,CAAC;IAC/D,CAAC;AACH,CAAC;AAED,MAAM,UAAU,eAAe,CAAC,IAA4B;IAC1D,MAAM,GAAG,GAAG,IAAI,CAAC,WAAW,IAAI,OAAO,CAAC,GAAG,CAAC;IAC5C,MAAM,IAAI,GAAG,IAAI,CAAC,YAAY,IAAI,EAAE,CAAC,OAAO,EAAE,CAAC;IAC/C,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,IAAI,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACvD,MAAM,kBAAkB,GAAa,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,kBAAkB,CAAC;QACzE,CAAC,CAAC,IAAI,CAAC,kBAAkB;QACzB,CAAC,CAAC,IAAI,CAAC,kBAAkB,KAAK,SAAS;YACrC,CAAC,CAAC,CAAC,IAAI,CAAC,kBAAkB,CAAC;YAC3B,CAAC,CAAC,2BAA2B,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC7C,MAAM,WAAW,GAAG,IAAI,CAAC,WAAW,IAAI,kBAAkB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACtE,MAAM,WAAW,GAAG,IAAI,CAAC,eAAe,IAAI,aAAa,CAAC;IAC1D,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,IAAI,cAAc,CAAC,IAAI,CAAC,CAAC;IACrD,MAAM,eAAe,GACnB,IAAI,CAAC,eAAe,KAAK,IAAI;QAC3B,CAAC,CAAC,IAAI;QACN,CAAC,CAAC,CAAC,IAAI,CAAC,eAAe,IAAI,sBAAsB,EAAE,CAAC,CAAC;IAEzD,gCAAgC;IAChC,MAAM,OAAO,GAAG,GAAG,CAAC,MAAM,CAAC,CAAC;IAC5B,IAAI,OAAO,OAAO,KAAK,QAAQ,IAAI,OAAO,KAAK,EAAE,IAAI,EAAE,CAAC,UAAU,CAAC,OAAO,CAAC,EAAE,CAAC;QAC5E,QAAQ,CAAC,GAAG,EAAE,IAAI,IAAI,CAAC,IAAI,uBAAuB,MAAM,MAAM,OAAO,EAAE,CAAC,CAAC;QACzE,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,YAAY,EAAE,OAAO,EAAE,CAAC;IACpF,CAAC;IAED,yEAAyE;IACzE,0EAA0E;IAC1E,uEAAuE;IACvE,wEAAwE;IACxE,IAAI,eAAe,KAAK,IAAI,EAAE,CAAC;QAC7B,MAAM,UAAU,GAAG,IAAI,CAAC,IAAI,CAC1B,eAAe,EACf,MAAM,EACN,YAAY,EACZ,IAAI,CAAC,IAAI,EACT,QAAQ,CACT,CAAC;QACF,IAAI,EAAE,CAAC,UAAU,CAAC,UAAU,CAAC,EAAE,CAAC;YAC9B,QAAQ,CAAC,GAAG,EAAE,IAAI,IAAI,CAAC,IAAI,gCAAgC,UAAU,EAAE,CAAC,CAAC;YACzE,OAAO;gBACL,OAAO,EAAE,MAAM;gBACf,IAAI,EAAE,CAAC,UAAU,CAAC;gBAClB,MAAM,EAAE,cAAc;gBACtB,YAAY,EAAE,UAAU;aACzB,CAAC;QACJ,CAAC;IACH,CAAC;IAED,0BAA0B;IAC1B,MAAM,WAAW,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,SAAS,EAAE,SAAS,EAAE,OAAO,CAAC,CAAC;IACnE,IAAI,EAAE,CAAC,UAAU,CAAC,WAAW,CAAC,EAAE,CAAC;QAC/B,IAAI,OAAiB,CAAC;QACtB,IAAI,CAAC;YACH,OAAO,GAAG,EAAE,CAAC,WAAW,CAAC,WAAW,CAAC,CAAC;QACxC,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,GAAG,EAAE,CAAC;QACf,CAAC;QACD,KAAK,MAAM,KAAK,IAAI,OAAO,EAAE,CAAC;YAC5B,IAAI,CAAC,kBAAkB,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;gBAAE,SAAS;YACrE,MAAM,SAAS,GAAG,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,KAAK,EAAE,cAAc,EAAE,WAAW,EAAE,WAAW,CAAC,CAAC;YAC1F,IAAI,EAAE,CAAC,UAAU,CAAC,SAAS,CAAC,EAAE,CAAC;gBAC7B,QAAQ,CAAC,GAAG,EAAE,IAAI,IAAI,CAAC,IAAI,gCAAgC,SAAS,EAAE,CAAC,CAAC;gBACxE,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,SAAS,CAAC,EAAE,MAAM,EAAE,cAAc,EAAE,YAAY,EAAE,SAAS,EAAE,CAAC;YACjG,CAAC;QACH,CAAC;IACH,CAAC;IAED,0CAA0C;IAC1C,MAAM,UAAU,GAAG,GAAG,CAAC,oBAAoB,CAAC,CAAC;IAC7C,IAAI,OAAO,UAAU,KAAK,QAAQ,IAAI,UAAU,KAAK,EAAE,EAAE,CAAC;QACxD,MAAM,SAAS,GAAG,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,cAAc,EAAE,WAAW,EAAE,WAAW,CAAC,CAAC;QAClF,IAAI,EAAE,CAAC,UAAU,CAAC,SAAS,CAAC,EAAE,CAAC;YAC7B,QAAQ,CAAC,GAAG,EAAE,IAAI,IAAI,CAAC,IAAI,sCAAsC,SAAS,EAAE,CAAC,CAAC;YAC9E,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,SAAS,CAAC,EAAE,MAAM,EAAE,oBAAoB,EAAE,YAAY,EAAE,SAAS,EAAE,CAAC;QACvG,CAAC;IACH,CAAC;IAED,2EAA2E;IAC3E,MAAM,YAAY,GAAG,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,GAAG,IAAI,CAAC,IAAI,kBAAkB,EAAE,WAAW,CAAC,CAAC;IACrF,IAAI,EAAE,CAAC,UAAU,CAAC,YAAY,CAAC,EAAE,CAAC;QAChC,QAAQ,CAAC,GAAG,EAAE,IAAI,IAAI,CAAC,IAAI,gCAAgC,YAAY,EAAE,CAAC,CAAC;QAC3E,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,YAAY,CAAC,EAAE,MAAM,EAAE,cAAc,EAAE,YAAY,EAAE,YAAY,EAAE,CAAC;IACvG,CAAC;IAED,QAAQ,CAAC,GAAG,EAAE,IAAI,IAAI,CAAC,IAAI,kHAAkH,CAAC,CAAC;IAC/I,OAAO,IAAI,CAAC;AACd,CAAC"}

package/dist/toolkit/atlassian/adf_validator.d.ts

@@ -0,0 +1,45 @@
+/**
+ * Structural validator for Atlassian Document Format (ADF) documents.
+ *
+ * Strict on the root: must be `{type: "doc", version: 1, content: array}`.
+ * Permissive on leaf nodes: any string `type` is accepted, since Atlassian
+ * extends ADF over time. Unknown leaf types surface as warnings rather than
+ * errors so the validator does not have to chase the schema; callers decide
+ * whether to allow them.
+ *
+ * No schema dependency. The 25-or-so node types whitelisted below cover the
+ * common surface needed for issue/comment bodies, page content, and panels
+ * — extending this list is additive and does not break callers.
+ */
+export interface ADFNode {
+    type: string;
+    content?: ADFNode[];
+    marks?: Array<{
+        type: string;
+        attrs?: Record<string, unknown>;
+    }>;
+    attrs?: Record<string, unknown>;
+    text?: string;
+    [key: string]: unknown;
+}
+export interface ADFDocument {
+    type: "doc";
+    version: 1;
+    content: ADFNode[];
+}
+export type ValidateResult = {
+    ok: true;
+    warnings: string[];
+} | {
+    ok: false;
+    errors: string[];
+    warnings: string[];
+};
+export declare function validateAdf(input: unknown): ValidateResult;
+/**
+ * Convenience wrapper: throw a single VALIDATION_ERROR-shaped Error if the
+ * document is invalid. Use at the connector boundary where errors are mapped
+ * to the toolkit's error envelope.
+ */
+export declare function assertValidAdf(input: unknown): asserts input is ADFDocument;
+//# sourceMappingURL=adf_validator.d.ts.map

package/dist/toolkit/atlassian/adf_validator.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"adf_validator.d.ts","sourceRoot":"","sources":["../../../src/toolkit/atlassian/adf_validator.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH,MAAM,WAAW,OAAO;IACtB,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,CAAC,EAAE,OAAO,EAAE,CAAC;IACpB,KAAK,CAAC,EAAE,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;KAAE,CAAC,CAAC;IACjE,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAChC,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;CACxB;AAED,MAAM,WAAW,WAAW;IAC1B,IAAI,EAAE,KAAK,CAAC;IACZ,OAAO,EAAE,CAAC,CAAC;IACX,OAAO,EAAE,OAAO,EAAE,CAAC;CACpB;AAED,MAAM,MAAM,cAAc,GACtB;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,QAAQ,EAAE,MAAM,EAAE,CAAA;CAAE,GAChC;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,MAAM,EAAE,MAAM,EAAE,CAAC;IAAC,QAAQ,EAAE,MAAM,EAAE,CAAA;CAAE,CAAC;AAaxD,wBAAgB,WAAW,CAAC,KAAK,EAAE,OAAO,GAAG,cAAc,CA0B1D;AAkCD;;;;GAIG;AACH,wBAAgB,cAAc,CAAC,KAAK,EAAE,OAAO,GAAG,OAAO,CAAC,KAAK,IAAI,WAAW,CAK3E"}

package/dist/toolkit/atlassian/adf_validator.js

@@ -0,0 +1,83 @@
+/**
+ * Structural validator for Atlassian Document Format (ADF) documents.
+ *
+ * Strict on the root: must be `{type: "doc", version: 1, content: array}`.
+ * Permissive on leaf nodes: any string `type` is accepted, since Atlassian
+ * extends ADF over time. Unknown leaf types surface as warnings rather than
+ * errors so the validator does not have to chase the schema; callers decide
+ * whether to allow them.
+ *
+ * No schema dependency. The 25-or-so node types whitelisted below cover the
+ * common surface needed for issue/comment bodies, page content, and panels
+ * — extending this list is additive and does not break callers.
+ */
+const KNOWN_NODE_TYPES = new Set([
+    "doc",
+    "paragraph", "heading", "blockquote", "codeBlock", "rule", "panel",
+    "bulletList", "orderedList", "listItem",
+    "text", "hardBreak", "mention", "emoji", "inlineCard", "link",
+    "table", "tableRow", "tableCell", "tableHeader",
+    "media", "mediaSingle", "mediaGroup",
+    "expand", "nestedExpand",
+    "decisionList", "decisionItem", "taskList", "taskItem",
+]);
+export function validateAdf(input) {
+    const errors = [];
+    const warnings = [];
+    if (typeof input !== "object" || input === null || Array.isArray(input)) {
+        return { ok: false, errors: ["root: expected an object"], warnings };
+    }
+    const doc = input;
+    if (doc["type"] !== "doc") {
+        errors.push(`root.type: expected "doc", got ${JSON.stringify(doc["type"])}`);
+    }
+    if (doc["version"] !== 1) {
+        errors.push(`root.version: expected 1, got ${JSON.stringify(doc["version"])}`);
+    }
+    if (!Array.isArray(doc["content"])) {
+        errors.push(`root.content: expected an array, got ${typeof doc["content"]}`);
+        return { ok: false, errors, warnings };
+    }
+    for (let i = 0; i < doc["content"].length; i++) {
+        walkNode(doc["content"][i], `root.content[${i}]`, errors, warnings);
+    }
+    if (errors.length > 0)
+        return { ok: false, errors, warnings };
+    return { ok: true, warnings };
+}
+function walkNode(node, path, errors, warnings) {
+    if (typeof node !== "object" || node === null || Array.isArray(node)) {
+        errors.push(`${path}: expected an object, got ${typeof node}`);
+        return;
+    }
+    const n = node;
+    if (typeof n["type"] !== "string") {
+        errors.push(`${path}.type: expected string, got ${typeof n["type"]}`);
+        return;
+    }
+    if (!KNOWN_NODE_TYPES.has(n["type"])) {
+        warnings.push(`${path}.type: unknown ADF node type "${n["type"]}" (allowed)`);
+    }
+    const content = n["content"];
+    if (content !== undefined) {
+        if (!Array.isArray(content)) {
+            errors.push(`${path}.content: expected an array, got ${typeof content}`);
+            return;
+        }
+        for (let i = 0; i < content.length; i++) {
+            walkNode(content[i], `${path}.content[${i}]`, errors, warnings);
+        }
+    }
+}
+/**
+ * Convenience wrapper: throw a single VALIDATION_ERROR-shaped Error if the
+ * document is invalid. Use at the connector boundary where errors are mapped
+ * to the toolkit's error envelope.
+ */
+export function assertValidAdf(input) {
+    const result = validateAdf(input);
+    if (!result.ok) {
+        throw new Error(`Invalid ADF document: ${result.errors.join("; ")}`);
+    }
+}
+//# sourceMappingURL=adf_validator.js.map

package/dist/toolkit/atlassian/adf_validator.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"adf_validator.js","sourceRoot":"","sources":["../../../src/toolkit/atlassian/adf_validator.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAqBH,MAAM,gBAAgB,GAAwB,IAAI,GAAG,CAAC;IACpD,KAAK;IACL,WAAW,EAAE,SAAS,EAAE,YAAY,EAAE,WAAW,EAAE,MAAM,EAAE,OAAO;IAClE,YAAY,EAAE,aAAa,EAAE,UAAU;IACvC,MAAM,EAAE,WAAW,EAAE,SAAS,EAAE,OAAO,EAAE,YAAY,EAAE,MAAM;IAC7D,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,aAAa;IAC/C,OAAO,EAAE,aAAa,EAAE,YAAY;IACpC,QAAQ,EAAE,cAAc;IACxB,cAAc,EAAE,cAAc,EAAE,UAAU,EAAE,UAAU;CACvD,CAAC,CAAC;AAEH,MAAM,UAAU,WAAW,CAAC,KAAc;IACxC,MAAM,MAAM,GAAa,EAAE,CAAC;IAC5B,MAAM,QAAQ,GAAa,EAAE,CAAC;IAE9B,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QACxE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,0BAA0B,CAAC,EAAE,QAAQ,EAAE,CAAC;IACvE,CAAC;IAED,MAAM,GAAG,GAAG,KAAgC,CAAC;IAC7C,IAAI,GAAG,CAAC,MAAM,CAAC,KAAK,KAAK,EAAE,CAAC;QAC1B,MAAM,CAAC,IAAI,CAAC,kCAAkC,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC;IAC/E,CAAC;IACD,IAAI,GAAG,CAAC,SAAS,CAAC,KAAK,CAAC,EAAE,CAAC;QACzB,MAAM,CAAC,IAAI,CAAC,iCAAiC,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC,EAAE,CAAC,CAAC;IACjF,CAAC;IACD,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC,EAAE,CAAC;QACnC,MAAM,CAAC,IAAI,CAAC,wCAAwC,OAAO,GAAG,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC;QAC7E,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC;IACzC,CAAC;IAED,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,GAAG,CAAC,SAAS,CAAC,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QAC/C,QAAQ,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,EAAE,gBAAgB,CAAC,GAAG,EAAE,MAAM,EAAE,QAAQ,CAAC,CAAC;IACtE,CAAC;IAED,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC;IAC9D,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC;AAChC,CAAC;AAED,SAAS,QAAQ,CACf,IAAa,EACb,IAAY,EACZ,MAAgB,EAChB,QAAkB;IAElB,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,IAAI,KAAK,IAAI,IAAI,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;QACrE,MAAM,CAAC,IAAI,CAAC,GAAG,IAAI,6BAA6B,OAAO,IAAI,EAAE,CAAC,CAAC;QAC/D,OAAO;IACT,CAAC;IACD,MAAM,CAAC,GAAG,IAA+B,CAAC;IAC1C,IAAI,OAAO,CAAC,CAAC,MAAM,CAAC,KAAK,QAAQ,EAAE,CAAC;QAClC,MAAM,CAAC,IAAI,CAAC,GAAG,IAAI,+BAA+B,OAAO,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;QACtE,OAAO;IACT,CAAC;IACD,IAAI,CAAC,gBAAgB,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,CAAW,CAAC,EAAE,CAAC;QAC/C,QAAQ,CAAC,IAAI,CACX,GAAG,IAAI,iCAAiC,CAAC,CAAC,MAAM,CAAW,aAAa,CACzE,CAAC;IACJ,CAAC;IACD,MAAM,OAAO,GAAG,CAAC,CAAC,SAAS,CAAC,CAAC;IAC7B,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;QAC1B,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;YAC5B,MAAM,CAAC,IAAI,CAAC,GAAG,IAAI,oCAAoC,OAAO,OAAO,EAAE,CAAC,CAAC;YACzE,OAAO;QACT,CAAC;QACD,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;YACxC,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,GAAG,IAAI,YAAY,CAAC,GAAG,EAAE,MAAM,EAAE,QAAQ,CAAC,CAAC;QAClE,CAAC;IACH,CAAC;AACH,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,cAAc,CAAC,KAAc;IAC3C,MAAM,MAAM,GAAG,WAAW,CAAC,KAAK,CAAC,CAAC;IAClC,IAAI,CAAC,MAAM,CAAC,EAAE,EAAE,CAAC;QACf,MAAM,IAAI,KAAK,CAAC,yBAAyB,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACvE,CAAC;AACH,CAAC"}

package/dist/toolkit/atlassian/index.d.ts

@@ -0,0 +1,5 @@
+/**
+ * Atlassian-specific helpers shared between the jira and confluence connectors.
+ */
+export { validateAdf, assertValidAdf, type ADFNode, type ADFDocument, type ValidateResult, } from "./adf_validator.js";
+//# sourceMappingURL=index.d.ts.map

package/dist/toolkit/atlassian/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/toolkit/atlassian/index.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,OAAO,EACL,WAAW,EACX,cAAc,EACd,KAAK,OAAO,EACZ,KAAK,WAAW,EAChB,KAAK,cAAc,GACpB,MAAM,oBAAoB,CAAC"}

package/dist/toolkit/atlassian/index.js

@@ -0,0 +1,5 @@
+/**
+ * Atlassian-specific helpers shared between the jira and confluence connectors.
+ */
+export { validateAdf, assertValidAdf, } from "./adf_validator.js";
+//# sourceMappingURL=index.js.map

package/dist/toolkit/atlassian/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/toolkit/atlassian/index.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,OAAO,EACL,WAAW,EACX,cAAc,GAIf,MAAM,oBAAoB,CAAC"}

package/dist/toolkit/audit/writer.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"writer.d.ts","sourceRoot":"","sources":["../../../src/toolkit/audit/writer.ts"],"names":[],"mappings":"AAaA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAE9C,MAAM,WAAW,kBAAkB;IACjC,OAAO,EAAE,OAAO,CAAC;IACjB,wEAAwE;IACxE,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,+EAA+E;IAC/E,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAQD,wBAAgB,YAAY,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAIjD;AAOD,MAAM,WAAW,WAAW;IAC1B,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC;IAC1B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CACN,KAAK,EAAE,IAAI,CAAC,UAAU,EAAE,WAAW,GAAG,YAAY,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAC5E,IAAI,CAAC;CACT;AA+CD,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,kBAAkB,GAAG,WAAW,CAQvE"}
+{"version":3,"file":"writer.d.ts","sourceRoot":"","sources":["../../../src/toolkit/audit/writer.ts"],"names":[],"mappings":"AAaA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAE9C,MAAM,WAAW,kBAAkB;IACjC,OAAO,EAAE,OAAO,CAAC;IACjB,wEAAwE;IACxE,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,+EAA+E;IAC/E,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AA+CD,wBAAgB,YAAY,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAgCjD;AAOD,MAAM,WAAW,WAAW;IAC1B,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC;IAC1B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CACN,KAAK,EAAE,IAAI,CAAC,UAAU,EAAE,WAAW,GAAG,YAAY,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAC5E,IAAI,CAAC;CACT;AA+CD,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,kBAAkB,GAAG,WAAW,CAQvE"}

package/dist/toolkit/audit/writer.js

@@ -11,13 +11,53 @@
 import * as crypto from "node:crypto";
 import * as fs from "node:fs";
 import * as path from "node:path";
-/** Redact common credential-bearing `key='value'` literals in a string. */
-const SENSITIVE_SQUOTE_RE = /\b(password|passwd|pwd|token|api[_-]?key|secret|access[_-]?key|auth)\s*=\s*'[^']*'/gi;
-const SENSITIVE_DQUOTE_RE = /\b(password|passwd|pwd|token|api[_-]?key|secret|access[_-]?key|auth)\s*=\s*"[^"]*"/gi;
+/**
+ * Redact common credential-bearing `key='value'` literals in a string.
+ *
+ * Key/separator are captured as distinct groups so the original separator
+ * (e.g. `:` for JSON payloads, `=` for SQL or env-style) is preserved
+ * verbatim — hard-coding `=` would mangle `{"password":"x"}` into
+ * `{"password"='[REDACTED]'}` and break downstream JSON-per-line parsers.
+ *
+ * The `\b` boundaries ensure we only match the sensitive keyword as a
+ * complete word (or wrapped in JSON quotes), so `mytoken='x'` and
+ * `notpassword='x'` don't get spuriously redacted.
+ *
+ * Value classes use `(?:\\.|[^Q\\])*` (Q = the active quote) so escape
+ * sequences like `\"` inside JSON-encoded values are skipped rather than
+ * treated as the closing quote.
+ *
+ * AUTH redaction uses two anchored patterns instead of one unanchored one:
+ *
+ *   QUOTED_RE — preceded by `"` or `'` (JSON key OR string-value context).
+ *     Value class is `[^"'\r\n]+` so the unquoted branch can't consume
+ *     past the JSON value's closing quote and mangle the outer payload.
+ *
+ *   LINE_RE — anchored to `^` or `\r\n` (HTTP-header / env form). Value
+ *     class is `[^\r\n]+` so Digest parameters with embedded quotes
+ *     (`Digest username="u", response="…"`) are fully consumed.
+ *
+ * Anchoring to a field boundary avoids the regression from a single
+ * unanchored pattern, where `{"message":"authorization: Bearer abc"}`
+ * matched mid-string and the greedy unquoted value class swallowed the
+ * trailing `"}`, producing unterminated JSON.
+ */
+const SENSITIVE_KEYS = "password|passwd|pwd|token|api[_-]?key|secret|access[_-]?key|auth";
+const SENSITIVE_SQUOTE_RE = new RegExp(`("?\\b(?:${SENSITIVE_KEYS})\\b"?)(\\s*[:=]\\s*)'(?:[^'\\\\]|\\\\.)*'`, "gi");
+const SENSITIVE_DQUOTE_RE = new RegExp(`("?\\b(?:${SENSITIVE_KEYS})\\b"?)(\\s*[:=]\\s*)"(?:[^"\\\\]|\\\\.)*"`, "gi");
+const SENSITIVE_AUTH_QUOTED_RE = /(?<=["'])(\bauthorization\b)("?)(\s*[:=]\s*)(?:(["'])((?:bearer|basic)\s+)?(?:\\.|[^\r\n\\])*?\4|((?:bearer|basic)\s+)?[^"'\r\n]+)/gi;
+const SENSITIVE_AUTH_LINE_RE = /(?:^|(?<=[\r\n]))(\bauthorization\b)(\s*[:=]\s*)((?:bearer|basic)\s+)?[^\r\n]+/gi;
 export function scrubSecrets(text) {
     return text
-        .replace(SENSITIVE_SQUOTE_RE, (_m, key) => `${key}='[REDACTED]'`)
-        .replace(SENSITIVE_DQUOTE_RE, (_m, key) => `${key}="[REDACTED]"`);
+        .replace(SENSITIVE_SQUOTE_RE, (_m, key, sep) => `${key}${sep}'[REDACTED]'`)
+        .replace(SENSITIVE_DQUOTE_RE, (_m, key, sep) => `${key}${sep}"[REDACTED]"`)
+        .replace(SENSITIVE_AUTH_QUOTED_RE, (_m, kw, keyQuote, sep, valQuote, schemeQ, schemeU) => {
+        if (valQuote !== undefined) {
+            return `${kw}${keyQuote}${sep}${valQuote}${schemeQ || ""}[REDACTED]${valQuote}`;
+        }
+        return `${kw}${keyQuote}${sep}${schemeU || ""}[REDACTED]`;
+    })
+        .replace(SENSITIVE_AUTH_LINE_RE, (_m, kw, sep, scheme) => `${kw}${sep}${scheme || ""}[REDACTED]`);
 }
 function isoTimestamp() {
     const iso = new Date().toISOString();

package/dist/toolkit/audit/writer.js.map

@@ -1 +1 @@
-{"version":3,"file":"writer.js","sourceRoot":"","sources":["../../../src/toolkit/audit/writer.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AACH,OAAO,KAAK,MAAM,MAAM,aAAa,CAAC;AACtC,OAAO,KAAK,EAAE,MAAM,SAAS,CAAC;AAC9B,OAAO,KAAK,IAAI,MAAM,WAAW,CAAC;AAWlC,2EAA2E;AAC3E,MAAM,mBAAmB,GACvB,sFAAsF,CAAC;AACzF,MAAM,mBAAmB,GACvB,sFAAsF,CAAC;AAEzF,MAAM,UAAU,YAAY,CAAC,IAAY;IACvC,OAAO,IAAI;SACR,OAAO,CAAC,mBAAmB,EAAE,CAAC,EAAE,EAAE,GAAW,EAAE,EAAE,CAAC,GAAG,GAAG,eAAe,CAAC;SACxE,OAAO,CAAC,mBAAmB,EAAE,CAAC,EAAE,EAAE,GAAW,EAAE,EAAE,CAAC,GAAG,GAAG,eAAe,CAAC,CAAC;AAC9E,CAAC;AAED,SAAS,YAAY;IACnB,MAAM,GAAG,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IACrC,OAAO,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,GAAG,GAAG,CAAC;AAC7C,CAAC;AAUD,MAAM,eAAe;IACV,OAAO,CAAU;IACjB,SAAS,CAAS;IACV,KAAK,CAAgB;IAEtC,YAAY,IAAwB;QAClC,IAAI,CAAC,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC;QAC5B,IAAI,CAAC,SAAS,GAAG,IAAI,CAAC,SAAS,IAAI,MAAM,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;QACzE,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,OAAO,IAAI,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC;IAC5D,CAAC;IAED,QAAQ,CACN,KAA6E;QAE7E,IAAI,CAAC,IAAI,CAAC,OAAO,IAAI,IAAI,CAAC,KAAK,KAAK,IAAI;YAAE,OAAO;QACjD,MAAM,MAAM,GAA4B;YACtC,GAAG,KAAK;YACR,SAAS,EAAE,YAAY,EAAE;YACzB,UAAU,EAAE,IAAI,CAAC,SAAS;SAC3B,CAAC;QACF,IAAI,CAAC;YACH,sEAAsE;YACtE,oCAAoC;YACpC,EAAE,CAAC,SAAS,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;YAC5D,EAAE,CAAC,cAAc,CAAC,IAAI,CAAC,KAAK,EAAE,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,GAAG,IAAI,EAAE,OAAO,CAAC,CAAC;QACxE,CAAC;QAAC,MAAM,CAAC;YACP,4CAA4C;QAC9C,CAAC;IACH,CAAC;CACF;AAED,kDAAkD;AAClD,MAAM,eAAe;IACV,OAAO,GAAG,KAAK,CAAC;IAChB,SAAS,CAAS;IAE3B,YAAY,SAAkB;QAC5B,IAAI,CAAC,SAAS,GAAG,SAAS,IAAI,MAAM,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;IACtE,CAAC;IAED,QAAQ;QACN,WAAW;IACb,CAAC;CACF;AAED,MAAM,UAAU,iBAAiB,CAAC,IAAwB;IACxD,IAAI,CAAC,IAAI,CAAC,OAAO;QAAE,OAAO,IAAI,eAAe,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;IAC9D,IAAI,IAAI,CAAC,IAAI,KAAK,SAAS,IAAI,IAAI,CAAC,IAAI,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACtD,MAAM,IAAI,KAAK,CACb,kDAAkD,CACnD,CAAC;IACJ,CAAC;IACD,OAAO,IAAI,eAAe,CAAC,IAAI,CAAC,CAAC;AACnC,CAAC"}
+{"version":3,"file":"writer.js","sourceRoot":"","sources":["../../../src/toolkit/audit/writer.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AACH,OAAO,KAAK,MAAM,MAAM,aAAa,CAAC;AACtC,OAAO,KAAK,EAAE,MAAM,SAAS,CAAC;AAC9B,OAAO,KAAK,IAAI,MAAM,WAAW,CAAC;AAWlC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8BG;AACH,MAAM,cAAc,GAAG,kEAAkE,CAAC;AAC1F,MAAM,mBAAmB,GAAG,IAAI,MAAM,CACpC,YAAY,cAAc,4CAA4C,EACtE,IAAI,CACL,CAAC;AACF,MAAM,mBAAmB,GAAG,IAAI,MAAM,CACpC,YAAY,cAAc,4CAA4C,EACtE,IAAI,CACL,CAAC;AACF,MAAM,wBAAwB,GAC5B,sIAAsI,CAAC;AACzI,MAAM,sBAAsB,GAC1B,kFAAkF,CAAC;AAErF,MAAM,UAAU,YAAY,CAAC,IAAY;IACvC,OAAO,IAAI;SACR,OAAO,CACN,mBAAmB,EACnB,CAAC,EAAE,EAAE,GAAW,EAAE,GAAW,EAAE,EAAE,CAAC,GAAG,GAAG,GAAG,GAAG,cAAc,CAC7D;SACA,OAAO,CACN,mBAAmB,EACnB,CAAC,EAAE,EAAE,GAAW,EAAE,GAAW,EAAE,EAAE,CAAC,GAAG,GAAG,GAAG,GAAG,cAAc,CAC7D;SACA,OAAO,CACN,wBAAwB,EACxB,CACE,EAAE,EACF,EAAU,EACV,QAAgB,EAChB,GAAW,EACX,QAA4B,EAC5B,OAA2B,EAC3B,OAA2B,EAC3B,EAAE;QACF,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;YAC3B,OAAO,GAAG,EAAE,GAAG,QAAQ,GAAG,GAAG,GAAG,QAAQ,GAAG,OAAO,IAAI,EAAE,aAAa,QAAQ,EAAE,CAAC;QAClF,CAAC;QACD,OAAO,GAAG,EAAE,GAAG,QAAQ,GAAG,GAAG,GAAG,OAAO,IAAI,EAAE,YAAY,CAAC;IAC5D,CAAC,CACF;SACA,OAAO,CACN,sBAAsB,EACtB,CAAC,EAAE,EAAE,EAAU,EAAE,GAAW,EAAE,MAA0B,EAAE,EAAE,CAC1D,GAAG,EAAE,GAAG,GAAG,GAAG,MAAM,IAAI,EAAE,YAAY,CACzC,CAAC;AACN,CAAC;AAED,SAAS,YAAY;IACnB,MAAM,GAAG,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IACrC,OAAO,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,GAAG,GAAG,CAAC;AAC7C,CAAC;AAUD,MAAM,eAAe;IACV,OAAO,CAAU;IACjB,SAAS,CAAS;IACV,KAAK,CAAgB;IAEtC,YAAY,IAAwB;QAClC,IAAI,CAAC,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC;QAC5B,IAAI,CAAC,SAAS,GAAG,IAAI,CAAC,SAAS,IAAI,MAAM,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;QACzE,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,OAAO,IAAI,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC;IAC5D,CAAC;IAED,QAAQ,CACN,KAA6E;QAE7E,IAAI,CAAC,IAAI,CAAC,OAAO,IAAI,IAAI,CAAC,KAAK,KAAK,IAAI;YAAE,OAAO;QACjD,MAAM,MAAM,GAA4B;YACtC,GAAG,KAAK;YACR,SAAS,EAAE,YAAY,EAAE;YACzB,UAAU,EAAE,IAAI,CAAC,SAAS;SAC3B,CAAC;QACF,IAAI,CAAC;YACH,sEAAsE;YACtE,oCAAoC;YACpC,EAAE,CAAC,SAAS,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;YAC5D,EAAE,CAAC,cAAc,CAAC,IAAI,CAAC,KAAK,EAAE,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,GAAG,IAAI,EAAE,OAAO,CAAC,CAAC;QACxE,CAAC;QAAC,MAAM,CAAC;YACP,4CAA4C;QAC9C,CAAC;IACH,CAAC;CACF;AAED,kDAAkD;AAClD,MAAM,eAAe;IACV,OAAO,GAAG,KAAK,CAAC;IAChB,SAAS,CAAS;IAE3B,YAAY,SAAkB;QAC5B,IAAI,CAAC,SAAS,GAAG,SAAS,IAAI,MAAM,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;IACtE,CAAC;IAED,QAAQ;QACN,WAAW;IACb,CAAC;CACF;AAED,MAAM,UAAU,iBAAiB,CAAC,IAAwB;IACxD,IAAI,CAAC,IAAI,CAAC,OAAO;QAAE,OAAO,IAAI,eAAe,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;IAC9D,IAAI,IAAI,CAAC,IAAI,KAAK,SAAS,IAAI,IAAI,CAAC,IAAI,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACtD,MAAM,IAAI,KAAK,CACb,kDAAkD,CACnD,CAAC;IACJ,CAAC;IACD,OAAO,IAAI,eAAe,CAAC,IAAI,CAAC,CAAC;AACnC,CAAC"}

package/dist/toolkit/connector_error.d.ts

@@ -0,0 +1,12 @@
+/**
+ * Bridges an HTTP/SDK client's `{ok: false, code, ...}` result shape to the
+ * handler-throws-an-Error contract expected by `createConnector`. One class
+ * replaces the per-connector error classes that all had the same shape.
+ */
+export declare class ConnectorError extends Error {
+    readonly code: string;
+    readonly retriable: boolean;
+    readonly httpStatus: number | undefined;
+    constructor(code: string, message: string, retriable: boolean, httpStatus?: number);
+}
+//# sourceMappingURL=connector_error.d.ts.map

package/dist/toolkit/connector_error.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"connector_error.d.ts","sourceRoot":"","sources":["../../src/toolkit/connector_error.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AACH,qBAAa,cAAe,SAAQ,KAAK;IACvC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,SAAS,EAAE,OAAO,CAAC;IAC5B,QAAQ,CAAC,UAAU,EAAE,MAAM,GAAG,SAAS,CAAC;gBAGtC,IAAI,EAAE,MAAM,EACZ,OAAO,EAAE,MAAM,EACf,SAAS,EAAE,OAAO,EAClB,UAAU,CAAC,EAAE,MAAM;CAQtB"}

package/dist/toolkit/connector_error.js

@@ -0,0 +1,18 @@
+/**
+ * Bridges an HTTP/SDK client's `{ok: false, code, ...}` result shape to the
+ * handler-throws-an-Error contract expected by `createConnector`. One class
+ * replaces the per-connector error classes that all had the same shape.
+ */
+export class ConnectorError extends Error {
+    code;
+    retriable;
+    httpStatus;
+    constructor(code, message, retriable, httpStatus) {
+        super(message);
+        this.name = "ConnectorError";
+        this.code = code;
+        this.retriable = retriable;
+        this.httpStatus = httpStatus;
+    }
+}
+//# sourceMappingURL=connector_error.js.map

package/dist/toolkit/connector_error.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"connector_error.js","sourceRoot":"","sources":["../../src/toolkit/connector_error.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AACH,MAAM,OAAO,cAAe,SAAQ,KAAK;IAC9B,IAAI,CAAS;IACb,SAAS,CAAU;IACnB,UAAU,CAAqB;IAExC,YACE,IAAY,EACZ,OAAe,EACf,SAAkB,EAClB,UAAmB;QAEnB,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,gBAAgB,CAAC;QAC7B,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC;QACjB,IAAI,CAAC,SAAS,GAAG,SAAS,CAAC;QAC3B,IAAI,CAAC,UAAU,GAAG,UAAU,CAAC;IAC/B,CAAC;CACF"}

package/dist/toolkit/guardrail.d.ts

@@ -10,8 +10,11 @@
  *     so every consumer (the per-connector hooks AND the hub's unified hook)
  *     evaluates the same way.
  *
- * Best-effort, not a security boundary. The engine fails open on parse
- * errors; callers are expected to handle missing/invalid manifests gracefully.
+ * Best-effort by default: the engine fails open on parse errors, so the
+ * default posture is not a security boundary. An opt-in fail-closed mode
+ * (the NARAI_GATE_ENFORCEMENT env var / a manifest `enforcement` field,
+ * applied by the PreToolUse dispatcher) turns parse and compile failures
+ * into hard denies. Callers still handle missing/invalid manifests.
  */
 export interface GuardrailRule {
     /**
@@ -37,6 +40,13 @@ export interface GuardrailManifest {
     /** Source connector name; surfaces in deny messages. */
     name: string;
     rules: GuardrailRule[];
+    /**
+     * Optional opt-in enforcement posture for evaluating this manifest. When
+     * "fail_closed", failures to evaluate a rule become hard denies. Defaults
+     * to fail-open (best-effort) when absent. Applied by the PreToolUse
+     * dispatcher together with the NARAI_GATE_ENFORCEMENT env var.
+     */
+    enforcement?: "fail_open" | "fail_closed";
 }
 export interface BlockMatch {
     manifest: GuardrailManifest;

package/dist/toolkit/guardrail.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"guardrail.d.ts","sourceRoot":"","sources":["../../src/toolkit/guardrail.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAIH,MAAM,WAAW,aAAa;IAC5B;;;OAGG;IACH,0BAA0B,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAC/C;;;;;OAKG;IACH,uBAAuB,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAC5C,0EAA0E;IAC1E,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,sGAAsG;IACtG,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB;AAED,MAAM,WAAW,iBAAiB;IAChC,0CAA0C;IAC1C,OAAO,EAAE,CAAC,CAAC;IACX,wDAAwD;IACxD,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,aAAa,EAAE,CAAC;CACxB;AAED,MAAM,WAAW,UAAU;IACzB,QAAQ,EAAE,iBAAiB,CAAC;IAC5B,IAAI,EAAE,aAAa,CAAC;IACpB,2DAA2D;IAC3D,YAAY,EAAE,MAAM,CAAC;IACrB,kEAAkE;IAClE,OAAO,EAAE,MAAM,CAAC;CACjB;AAID;;;;GAIG;AACH,wBAAgB,qBAAqB,CAAC,QAAQ,EAAE,MAAM,GAAG,iBAAiB,CASzE;AAyBD;;;;GAIG;AACH,wBAAgB,gBAAgB,CAC9B,OAAO,EAAE,MAAM,EACf,SAAS,EAAE,SAAS,iBAAiB,EAAE,EACvC,KAAK,SAAI,GACR,UAAU,GAAG,IAAI,CAwCnB;AAED,uFAAuF;AACvF,wBAAgB,kBAAkB,CAAC,KAAK,EAAE,UAAU,GAAG,MAAM,CAW5D"}
+{"version":3,"file":"guardrail.d.ts","sourceRoot":"","sources":["../../src/toolkit/guardrail.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AAIH,MAAM,WAAW,aAAa;IAC5B;;;OAGG;IACH,0BAA0B,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAC/C;;;;;OAKG;IACH,uBAAuB,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAC5C,0EAA0E;IAC1E,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,sGAAsG;IACtG,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB;AAED,MAAM,WAAW,iBAAiB;IAChC,0CAA0C;IAC1C,OAAO,EAAE,CAAC,CAAC;IACX,wDAAwD;IACxD,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,aAAa,EAAE,CAAC;IACvB;;;;;OAKG;IACH,WAAW,CAAC,EAAE,WAAW,GAAG,aAAa,CAAC;CAC3C;AAED,MAAM,WAAW,UAAU;IACzB,QAAQ,EAAE,iBAAiB,CAAC;IAC5B,IAAI,EAAE,aAAa,CAAC;IACpB,2DAA2D;IAC3D,YAAY,EAAE,MAAM,CAAC;IACrB,kEAAkE;IAClE,OAAO,EAAE,MAAM,CAAC;CACjB;AAID;;;;GAIG;AACH,wBAAgB,qBAAqB,CAAC,QAAQ,EAAE,MAAM,GAAG,iBAAiB,CASzE;AAsCD;;;;GAIG;AACH,wBAAgB,gBAAgB,CAC9B,OAAO,EAAE,MAAM,EACf,SAAS,EAAE,SAAS,iBAAiB,EAAE,EACvC,KAAK,SAAI,GACR,UAAU,GAAG,IAAI,CAwCnB;AAED,uFAAuF;AACvF,wBAAgB,kBAAkB,CAAC,KAAK,EAAE,UAAU,GAAG,MAAM,CAW5D"}

package/dist/toolkit/guardrail.js

@@ -10,8 +10,11 @@
  *     so every consumer (the per-connector hooks AND the hub's unified hook)
  *     evaluates the same way.
  *
- * Best-effort, not a security boundary. The engine fails open on parse
- * errors; callers are expected to handle missing/invalid manifests gracefully.
+ * Best-effort by default: the engine fails open on parse errors, so the
+ * default posture is not a security boundary. An opt-in fail-closed mode
+ * (the NARAI_GATE_ENFORCEMENT env var / a manifest `enforcement` field,
+ * applied by the PreToolUse dispatcher) turns parse and compile failures
+ * into hard denies. Callers still handle missing/invalid manifests.
  */
 import * as fs from "node:fs";
 const SHELLS = new Set(["bash", "sh", "zsh", "ksh", "dash"]);
@@ -51,7 +54,18 @@ function validateManifest(value, filePath) {
         }
         return r;
     });
-    return { version: 1, name: obj["name"], rules };
+    const manifest = {
+        version: 1,
+        name: obj["name"],
+        rules,
+    };
+    if (obj["enforcement"] !== undefined) {
+        if (obj["enforcement"] !== "fail_open" && obj["enforcement"] !== "fail_closed") {
+            throw new Error(`Guardrail manifest at ${filePath}: 'enforcement' must be "fail_open" or "fail_closed".`);
+        }
+        manifest.enforcement = obj["enforcement"];
+    }
+    return manifest;
 }
 /**
  * Walk a Bash command, including `&&`/`||`/`;`/`|` segments and nested

package/dist/toolkit/guardrail.js.map

@@ -1 +1 @@
-{"version":3,"file":"guardrail.js","sourceRoot":"","sources":["../../src/toolkit/guardrail.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAEH,OAAO,KAAK,EAAE,MAAM,SAAS,CAAC;AAsC9B,MAAM,MAAM,GAAG,IAAI,GAAG,CAAS,CAAC,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,CAAC,CAAC,CAAC;AAErE;;;;GAIG;AACH,MAAM,UAAU,qBAAqB,CAAC,QAAgB;IACpD,MAAM,GAAG,GAAG,EAAE,CAAC,YAAY,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;IAC/C,IAAI,MAAe,CAAC;IACpB,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC3B,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,IAAI,KAAK,CAAC,yCAAyC,QAAQ,KAAM,GAAa,CAAC,OAAO,EAAE,CAAC,CAAC;IAClG,CAAC;IACD,OAAO,gBAAgB,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;AAC5C,CAAC;AAED,SAAS,gBAAgB,CAAC,KAAc,EAAE,QAAgB;IACxD,IAAI,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QACxE,MAAM,IAAI,KAAK,CAAC,yBAAyB,QAAQ,yBAAyB,CAAC,CAAC;IAC9E,CAAC;IACD,MAAM,GAAG,GAAG,KAAgC,CAAC;IAC7C,IAAI,GAAG,CAAC,SAAS,CAAC,KAAK,CAAC,EAAE,CAAC;QACzB,MAAM,IAAI,KAAK,CAAC,yBAAyB,QAAQ,wBAAwB,CAAC,CAAC;IAC7E,CAAC;IACD,IAAI,OAAO,GAAG,CAAC,MAAM,CAAC,KAAK,QAAQ,IAAI,GAAG,CAAC,MAAM,CAAC,KAAK,EAAE,EAAE,CAAC;QAC1D,MAAM,IAAI,KAAK,CAAC,yBAAyB,QAAQ,gCAAgC,CAAC,CAAC;IACrF,CAAC;IACD,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,EAAE,CAAC;QACjC,MAAM,IAAI,KAAK,CAAC,yBAAyB,QAAQ,6BAA6B,CAAC,CAAC;IAClF,CAAC;IACD,MAAM,KAAK,GAAoB,GAAG,CAAC,OAAO,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE;QACvD,IAAI,CAAC,KAAK,IAAI,IAAI,OAAO,CAAC,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC;YAC5D,MAAM,IAAI,KAAK,CAAC,yBAAyB,QAAQ,WAAW,CAAC,sBAAsB,CAAC,CAAC;QACvF,CAAC;QACD,OAAO,CAAkB,CAAC;IAC5B,CAAC,CAAC,CAAC;IACH,OAAO,EAAE,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,GAAG,CAAC,MAAM,CAAW,EAAE,KAAK,EAAE,CAAC;AAC5D,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,gBAAgB,CAC9B,OAAe,EACf,SAAuC,EACvC,KAAK,GAAG,CAAC;IAET,IAAI,KAAK,GAAG,CAAC;QAAE,OAAO,IAAI,CAAC;IAC3B,MAAM,QAAQ,GAAG,aAAa,CAAC,OAAO,CAAC,CAAC;IACxC,KAAK,MAAM,GAAG,IAAI,QAAQ,EAAE,CAAC;QAC3B,MAAM,OAAO,GAAG,YAAY,CAAC,cAAc,CAAC,GAAG,CAAC,CAAC,CAAC;QAClD,IAAI,OAAO,KAAK,EAAE;YAAE,SAAS;QAC7B,MAAM,MAAM,GAAG,QAAQ,CAAC,OAAO,CAAC,CAAC;QACjC,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC;YAAE,SAAS;QAClC,MAAM,IAAI,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;QAEvC,2CAA2C;QAC3C,MAAM,MAAM,GAAG,gBAAgB,CAAC,MAAM,CAAC,CAAC;QACxC,IAAI,MAAM,KAAK,IAAI,EAAE,CAAC;YACpB,MAAM,KAAK,GAAG,gBAAgB,CAAC,MAAM,EAAE,SAAS,EAAE,KAAK,GAAG,CAAC,CAAC,CAAC;YAC7D,IAAI,KAAK,KAAK,IAAI;gBAAE,OAAO,KAAK,CAAC;YACjC,SAAS;QACX,CAAC;QAED,iDAAiD;QACjD,IAAI,MAAM,CAAC,MAAM,IAAI,CAAC,EAAE,CAAC;YACvB,MAAM,QAAQ,GAAG,GAAG,IAAI,IAAI,MAAM,CAAC,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC;YAC9C,KAAK,MAAM,CAAC,IAAI,SAAS,EAAE,CAAC;gBAC1B,KAAK,MAAM,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,CAAC;oBACxB,IAAI,CAAC,CAAC,uBAAuB,EAAE,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC;wBAClD,OAAO,EAAE,QAAQ,EAAE,CAAC,EAAE,IAAI,EAAE,CAAC,EAAE,YAAY,EAAE,QAAQ,EAAE,OAAO,EAAE,CAAC;oBACnE,CAAC;gBACH,CAAC;YACH,CAAC;QACH,CAAC;QAED,8BAA8B;QAC9B,KAAK,MAAM,CAAC,IAAI,SAAS,EAAE,CAAC;YAC1B,KAAK,MAAM,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,CAAC;gBACxB,IAAI,CAAC,CAAC,0BAA0B,EAAE,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;oBACjD,OAAO,EAAE,QAAQ,EAAE,CAAC,EAAE,IAAI,EAAE,CAAC,EAAE,YAAY,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC;gBAC/D,CAAC;YACH,CAAC;QACH,CAAC;IACH,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,uFAAuF;AACvF,MAAM,UAAU,kBAAkB,CAAC,KAAiB;IAClD,IAAI,OAAO,KAAK,CAAC,IAAI,CAAC,YAAY,KAAK,QAAQ,IAAI,KAAK,CAAC,IAAI,CAAC,YAAY,KAAK,EAAE,EAAE,CAAC;QAClF,OAAO,KAAK,CAAC,IAAI,CAAC,YAAY,CAAC,OAAO,CAAC,gBAAgB,EAAE,KAAK,CAAC,YAAY,CAAC,CAAC;IAC/E,CAAC;IACD,MAAM,QAAQ,GAAG,KAAK,CAAC,IAAI,CAAC,QAAQ,KAAK,SAAS,IAAI,KAAK,CAAC,IAAI,CAAC,QAAQ,KAAK,EAAE;QAC9E,CAAC,CAAC,IAAI,KAAK,CAAC,IAAI,CAAC,QAAQ,EAAE;QAC3B,CAAC,CAAC,EAAE,CAAC;IACP,OAAO,CACL,GAAG,KAAK,CAAC,QAAQ,CAAC,IAAI,wBAAwB,KAAK,CAAC,YAAY,wBAAwB;QACxF,GAAG,QAAQ,uFAAuF,CACnG,CAAC;AACJ,CAAC;AAED,4EAA4E;AAE5E,SAAS,aAAa,CAAC,GAAW;IAChC,OAAO,GAAG;SACP,KAAK,CAAC,cAAc,CAAC;SACrB,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;SACpB,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC;AAC7B,CAAC;AAED,SAAS,QAAQ,CAAC,CAAS;IACzB,OAAO,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC;AAChD,CAAC;AAED,SAAS,QAAQ,CAAC,GAAW;IAC3B,MAAM,CAAC,GAAG,GAAG,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC;IAC/B,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;AAC3C,CAAC;AAED,SAAS,cAAc,CAAC,OAAe;IACrC,IAAI,CAAC,GAAG,OAAO,CAAC,SAAS,EAAE,CAAC;IAC5B,IAAI,CAAC,CAAC,UAAU,CAAC,MAAM,CAAC;QAAE,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,SAAS,EAAE,CAAC;IACrD,OAAO,0BAA0B,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC;QAC1C,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;QAC7B,IAAI,CAAC,KAAK,IAAI;YAAE,MAAM;QACtB,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC;IAC3B,CAAC;IACD,OAAO,CAAC,CAAC;AACX,CAAC;AAED,SAAS,YAAY,CAAC,OAAe;IACnC,IAAI,CAAC,GAAG,OAAO,CAAC,SAAS,EAAE,CAAC;IAC5B,OAAO,CAAC,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACpB,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;QACf,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,GAAG,EAAE,CAAC;YACrD,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,SAAS,EAAE,CAAC;QAC7B,CAAC;aAAM,CAAC;YACN,MAAM;QACR,CAAC;IACH,CAAC;IACD,OAAO,CAAC,CAAC;AACX,CAAC;AAED,SAAS,gBAAgB,CAAC,MAAyB;IACjD,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC;QAAE,OAAO,IAAI,CAAC;IACnC,MAAM,KAAK,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;IACxC,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IACpC,MAAM,EAAE,GAAG,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;IAChC,IAAI,EAAE,KAAK,CAAC,CAAC,IAAI,EAAE,GAAG,CAAC,IAAI,MAAM,CAAC,MAAM;QAAE,OAAO,IAAI,CAAC;IACtD,IAAI,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC;IAClD,KAAK,GAAG,KAAK,CAAC,OAAO,CAAC,qBAAqB,EAAE,IAAI,CAAC,CAAC;IACnD,OAAO,KAAK,CAAC;AACf,CAAC"}
+{"version":3,"file":"guardrail.js","sourceRoot":"","sources":["../../src/toolkit/guardrail.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AAEH,OAAO,KAAK,EAAE,MAAM,SAAS,CAAC;AA6C9B,MAAM,MAAM,GAAG,IAAI,GAAG,CAAS,CAAC,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,CAAC,CAAC,CAAC;AAErE;;;;GAIG;AACH,MAAM,UAAU,qBAAqB,CAAC,QAAgB;IACpD,MAAM,GAAG,GAAG,EAAE,CAAC,YAAY,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;IAC/C,IAAI,MAAe,CAAC;IACpB,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC3B,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,IAAI,KAAK,CAAC,yCAAyC,QAAQ,KAAM,GAAa,CAAC,OAAO,EAAE,CAAC,CAAC;IAClG,CAAC;IACD,OAAO,gBAAgB,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;AAC5C,CAAC;AAED,SAAS,gBAAgB,CAAC,KAAc,EAAE,QAAgB;IACxD,IAAI,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QACxE,MAAM,IAAI,KAAK,CAAC,yBAAyB,QAAQ,yBAAyB,CAAC,CAAC;IAC9E,CAAC;IACD,MAAM,GAAG,GAAG,KAAgC,CAAC;IAC7C,IAAI,GAAG,CAAC,SAAS,CAAC,KAAK,CAAC,EAAE,CAAC;QACzB,MAAM,IAAI,KAAK,CAAC,yBAAyB,QAAQ,wBAAwB,CAAC,CAAC;IAC7E,CAAC;IACD,IAAI,OAAO,GAAG,CAAC,MAAM,CAAC,KAAK,QAAQ,IAAI,GAAG,CAAC,MAAM,CAAC,KAAK,EAAE,EAAE,CAAC;QAC1D,MAAM,IAAI,KAAK,CAAC,yBAAyB,QAAQ,gCAAgC,CAAC,CAAC;IACrF,CAAC;IACD,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,EAAE,CAAC;QACjC,MAAM,IAAI,KAAK,CAAC,yBAAyB,QAAQ,6BAA6B,CAAC,CAAC;IAClF,CAAC;IACD,MAAM,KAAK,GAAoB,GAAG,CAAC,OAAO,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE;QACvD,IAAI,CAAC,KAAK,IAAI,IAAI,OAAO,CAAC,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC;YAC5D,MAAM,IAAI,KAAK,CAAC,yBAAyB,QAAQ,WAAW,CAAC,sBAAsB,CAAC,CAAC;QACvF,CAAC;QACD,OAAO,CAAkB,CAAC;IAC5B,CAAC,CAAC,CAAC;IACH,MAAM,QAAQ,GAAsB;QAClC,OAAO,EAAE,CAAC;QACV,IAAI,EAAE,GAAG,CAAC,MAAM,CAAW;QAC3B,KAAK;KACN,CAAC;IACF,IAAI,GAAG,CAAC,aAAa,CAAC,KAAK,SAAS,EAAE,CAAC;QACrC,IAAI,GAAG,CAAC,aAAa,CAAC,KAAK,WAAW,IAAI,GAAG,CAAC,aAAa,CAAC,KAAK,aAAa,EAAE,CAAC;YAC/E,MAAM,IAAI,KAAK,CACb,yBAAyB,QAAQ,uDAAuD,CACzF,CAAC;QACJ,CAAC;QACD,QAAQ,CAAC,WAAW,GAAG,GAAG,CAAC,aAAa,CAAC,CAAC;IAC5C,CAAC;IACD,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,gBAAgB,CAC9B,OAAe,EACf,SAAuC,EACvC,KAAK,GAAG,CAAC;IAET,IAAI,KAAK,GAAG,CAAC;QAAE,OAAO,IAAI,CAAC;IAC3B,MAAM,QAAQ,GAAG,aAAa,CAAC,OAAO,CAAC,CAAC;IACxC,KAAK,MAAM,GAAG,IAAI,QAAQ,EAAE,CAAC;QAC3B,MAAM,OAAO,GAAG,YAAY,CAAC,cAAc,CAAC,GAAG,CAAC,CAAC,CAAC;QAClD,IAAI,OAAO,KAAK,EAAE;YAAE,SAAS;QAC7B,MAAM,MAAM,GAAG,QAAQ,CAAC,OAAO,CAAC,CAAC;QACjC,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC;YAAE,SAAS;QAClC,MAAM,IAAI,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;QAEvC,2CAA2C;QAC3C,MAAM,MAAM,GAAG,gBAAgB,CAAC,MAAM,CAAC,CAAC;QACxC,IAAI,MAAM,KAAK,IAAI,EAAE,CAAC;YACpB,MAAM,KAAK,GAAG,gBAAgB,CAAC,MAAM,EAAE,SAAS,EAAE,KAAK,GAAG,CAAC,CAAC,CAAC;YAC7D,IAAI,KAAK,KAAK,IAAI;gBAAE,OAAO,KAAK,CAAC;YACjC,SAAS;QACX,CAAC;QAED,iDAAiD;QACjD,IAAI,MAAM,CAAC,MAAM,IAAI,CAAC,EAAE,CAAC;YACvB,MAAM,QAAQ,GAAG,GAAG,IAAI,IAAI,MAAM,CAAC,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC;YAC9C,KAAK,MAAM,CAAC,IAAI,SAAS,EAAE,CAAC;gBAC1B,KAAK,MAAM,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,CAAC;oBACxB,IAAI,CAAC,CAAC,uBAAuB,EAAE,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC;wBAClD,OAAO,EAAE,QAAQ,EAAE,CAAC,EAAE,IAAI,EAAE,CAAC,EAAE,YAAY,EAAE,QAAQ,EAAE,OAAO,EAAE,CAAC;oBACnE,CAAC;gBACH,CAAC;YACH,CAAC;QACH,CAAC;QAED,8BAA8B;QAC9B,KAAK,MAAM,CAAC,IAAI,SAAS,EAAE,CAAC;YAC1B,KAAK,MAAM,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,CAAC;gBACxB,IAAI,CAAC,CAAC,0BAA0B,EAAE,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;oBACjD,OAAO,EAAE,QAAQ,EAAE,CAAC,EAAE,IAAI,EAAE,CAAC,EAAE,YAAY,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC;gBAC/D,CAAC;YACH,CAAC;QACH,CAAC;IACH,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,uFAAuF;AACvF,MAAM,UAAU,kBAAkB,CAAC,KAAiB;IAClD,IAAI,OAAO,KAAK,CAAC,IAAI,CAAC,YAAY,KAAK,QAAQ,IAAI,KAAK,CAAC,IAAI,CAAC,YAAY,KAAK,EAAE,EAAE,CAAC;QAClF,OAAO,KAAK,CAAC,IAAI,CAAC,YAAY,CAAC,OAAO,CAAC,gBAAgB,EAAE,KAAK,CAAC,YAAY,CAAC,CAAC;IAC/E,CAAC;IACD,MAAM,QAAQ,GAAG,KAAK,CAAC,IAAI,CAAC,QAAQ,KAAK,SAAS,IAAI,KAAK,CAAC,IAAI,CAAC,QAAQ,KAAK,EAAE;QAC9E,CAAC,CAAC,IAAI,KAAK,CAAC,IAAI,CAAC,QAAQ,EAAE;QAC3B,CAAC,CAAC,EAAE,CAAC;IACP,OAAO,CACL,GAAG,KAAK,CAAC,QAAQ,CAAC,IAAI,wBAAwB,KAAK,CAAC,YAAY,wBAAwB;QACxF,GAAG,QAAQ,uFAAuF,CACnG,CAAC;AACJ,CAAC;AAED,4EAA4E;AAE5E,SAAS,aAAa,CAAC,GAAW;IAChC,OAAO,GAAG;SACP,KAAK,CAAC,cAAc,CAAC;SACrB,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;SACpB,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC;AAC7B,CAAC;AAED,SAAS,QAAQ,CAAC,CAAS;IACzB,OAAO,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC;AAChD,CAAC;AAED,SAAS,QAAQ,CAAC,GAAW;IAC3B,MAAM,CAAC,GAAG,GAAG,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC;IAC/B,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;AAC3C,CAAC;AAED,SAAS,cAAc,CAAC,OAAe;IACrC,IAAI,CAAC,GAAG,OAAO,CAAC,SAAS,EAAE,CAAC;IAC5B,IAAI,CAAC,CAAC,UAAU,CAAC,MAAM,CAAC;QAAE,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,SAAS,EAAE,CAAC;IACrD,OAAO,0BAA0B,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC;QAC1C,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;QAC7B,IAAI,CAAC,KAAK,IAAI;YAAE,MAAM;QACtB,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC;IAC3B,CAAC;IACD,OAAO,CAAC,CAAC;AACX,CAAC;AAED,SAAS,YAAY,CAAC,OAAe;IACnC,IAAI,CAAC,GAAG,OAAO,CAAC,SAAS,EAAE,CAAC;IAC5B,OAAO,CAAC,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACpB,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;QACf,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,GAAG,EAAE,CAAC;YACrD,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,SAAS,EAAE,CAAC;QAC7B,CAAC;aAAM,CAAC;YACN,MAAM;QACR,CAAC;IACH,CAAC;IACD,OAAO,CAAC,CAAC;AACX,CAAC;AAED,SAAS,gBAAgB,CAAC,MAAyB;IACjD,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC;QAAE,OAAO,IAAI,CAAC;IACnC,MAAM,KAAK,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;IACxC,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IACpC,MAAM,EAAE,GAAG,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;IAChC,IAAI,EAAE,KAAK,CAAC,CAAC,IAAI,EAAE,GAAG,CAAC,IAAI,MAAM,CAAC,MAAM;QAAE,OAAO,IAAI,CAAC;IACtD,IAAI,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC;IAClD,KAAK,GAAG,KAAK,CAAC,OAAO,CAAC,qBAAqB,EAAE,IAAI,CAAC,CAAC;IACnD,OAAO,KAAK,CAAC;AACf,CAAC"}