skillscript-runtime 0.19.16 → 0.20.1

package/dist/dashboard/server.d.ts

@@ -78,6 +78,19 @@ export interface DashboardServerConfig {
      * the typical adopter wires both).
      */
     scheduler?: Scheduler;
+    /**
+     * v0.20.1 — optional shared-secret gate for the dashboard surface (SPA + the
+     * `/rpc` it uses). When set, every request must present the token via
+     * `?token=<x>` (browser entry — a cookie is then set so follow-up requests
+     * pass), a `skillscript_dash` cookie, or `Authorization: Bearer <x>` (for
+     * programmatic `/rpc` callers); 401 otherwise. Default unset → open (localhost
+     * bind is the only gate, as before). `/event` keeps its own bearer token.
+     *
+     * This is NETWORK/CASUAL hygiene (keep network parties out when binding beyond
+     * localhost), NOT an agent-forgery boundary — the dashboard holds no signing
+     * key. Falls back to `SKILLSCRIPT_DASHBOARD_AUTH_TOKEN`.
+     */
+    authToken?: string;
 }
 export declare class DashboardServer {
     private readonly mcpServer;
@@ -89,12 +102,25 @@ export declare class DashboardServer {
     private readonly eventIngressEnabled;
     private readonly eventIngressAuthToken;
     private readonly scheduler;
+    private readonly authToken;
     private httpServer;
     constructor(config: DashboardServerConfig);
     start(): Promise<void>;
+    /** The actual bound port after `start()` — read this when constructed with
+     *  port 0 (OS-assigned ephemeral port). Falls back to the configured port. */
+    boundPort(): number;
     stop(): Promise<void>;
     /** Exposed for direct testing — doesn't go through the network stack. */
     handle(req: IncomingMessage, res: ServerResponse): Promise<void>;
+    /**
+     * v0.20.1 — dashboard auth gate. Returns true when the request may proceed
+     * (no token configured, or a valid token presented); false when it already
+     * sent a 401. On a browser `?token=` entry it sets a cookie so the SPA's
+     * follow-up asset + `/rpc` requests carry the token without re-tokening.
+     */
+    private checkDashboardAuth;
+    /** Token from `?token=` query, the `skillscript_dash` cookie, or a Bearer header. */
+    private extractDashboardToken;
     /**
      * v0.19.0 — POST /event handler (memory `ceaf4579`).
      *

package/dist/dashboard/server.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"server.d.ts","sourceRoot":"","sources":["../../src/dashboard/server.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,eAAe,EAAE,cAAc,EAAU,MAAM,WAAW,CAAC;AAKzE,OAAO,KAAK,EAAE,SAAS,EAAkB,MAAM,kBAAkB,CAAC;AAClE,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,iBAAiB,CAAC;AAIjD;;;;;;;;;;;;;;;GAeG;AAEH,MAAM,WAAW,qBAAqB;IACpC,SAAS,EAAE,SAAS,CAAC;IACrB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,8GAA8G;IAC9G,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB;;;;;OAKG;IACH,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB;;;;;;;;;;;;;;;;;;OAkBG;IACH,uBAAuB,CAAC,EAAE,MAAM,CAAC;IACjC;;;;;;;;;OASG;IACH,mBAAmB,CAAC,EAAE,OAAO,CAAC;IAC9B;;;;;;;OAOG;IACH,qBAAqB,CAAC,EAAE,MAAM,CAAC;IAC/B;;;;;;OAMG;IACH,SAAS,CAAC,EAAE,SAAS,CAAC;CACvB;AASD,qBAAa,eAAe;IAC1B,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAY;IACtC,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAS;IAC9B,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAS;IACrC,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAS;IACnC,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAU;IACnC,OAAO,CAAC,QAAQ,CAAC,oBAAoB,CAAqB;IAC1D,OAAO,CAAC,QAAQ,CAAC,mBAAmB,CAAU;IAC9C,OAAO,CAAC,QAAQ,CAAC,qBAAqB,CAAqB;IAC3D,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAwB;IAClD,OAAO,CAAC,UAAU,CAAuB;gBAE7B,MAAM,EAAE,qBAAqB;IAoCnC,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC;IAStB,IAAI,IAAI,OAAO,CAAC,IAAI,CAAC;IAO3B,yEAAyE;IACnE,MAAM,CAAC,GAAG,EAAE,eAAe,EAAE,GAAG,EAAE,cAAc,GAAG,OAAO,CAAC,IAAI,CAAC;IAiDtE;;;;;;;;;;;;;;;OAeG;YACW,WAAW;YA8DX,SAAS;YAkCT,YAAY;CAkB3B"}
+{"version":3,"file":"server.d.ts","sourceRoot":"","sources":["../../src/dashboard/server.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,eAAe,EAAE,cAAc,EAAU,MAAM,WAAW,CAAC;AAKzE,OAAO,KAAK,EAAE,SAAS,EAAkB,MAAM,kBAAkB,CAAC;AAClE,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,iBAAiB,CAAC;AAIjD;;;;;;;;;;;;;;;GAeG;AAEH,MAAM,WAAW,qBAAqB;IACpC,SAAS,EAAE,SAAS,CAAC;IACrB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,8GAA8G;IAC9G,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB;;;;;OAKG;IACH,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB;;;;;;;;;;;;;;;;;;OAkBG;IACH,uBAAuB,CAAC,EAAE,MAAM,CAAC;IACjC;;;;;;;;;OASG;IACH,mBAAmB,CAAC,EAAE,OAAO,CAAC;IAC9B;;;;;;;OAOG;IACH,qBAAqB,CAAC,EAAE,MAAM,CAAC;IAC/B;;;;;;OAMG;IACH,SAAS,CAAC,EAAE,SAAS,CAAC;IACtB;;;;;;;;;;;OAWG;IACH,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAiBD,qBAAa,eAAe;IAC1B,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAY;IACtC,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAS;IAC9B,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAS;IACrC,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAS;IACnC,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAU;IACnC,OAAO,CAAC,QAAQ,CAAC,oBAAoB,CAAqB;IAC1D,OAAO,CAAC,QAAQ,CAAC,mBAAmB,CAAU;IAC9C,OAAO,CAAC,QAAQ,CAAC,qBAAqB,CAAqB;IAC3D,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAwB;IAClD,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAqB;IAC/C,OAAO,CAAC,UAAU,CAAuB;gBAE7B,MAAM,EAAE,qBAAqB;IAsCnC,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC;IAgB5B;kFAC8E;IAC9E,SAAS,IAAI,MAAM;IAKb,IAAI,IAAI,OAAO,CAAC,IAAI,CAAC;IAO3B,yEAAyE;IACnE,MAAM,CAAC,GAAG,EAAE,eAAe,EAAE,GAAG,EAAE,cAAc,GAAG,OAAO,CAAC,IAAI,CAAC;IAsDtE;;;;;OAKG;IACH,OAAO,CAAC,kBAAkB;IAgB1B,qFAAqF;IACrF,OAAO,CAAC,qBAAqB;IAa7B;;;;;;;;;;;;;;;OAeG;YACW,WAAW;YA8DX,SAAS;YAkCT,YAAY;CAkB3B"}

package/dist/dashboard/server.js

@@ -1,10 +1,19 @@
 import { createServer } from "node:http";
+import { timingSafeEqual } from "node:crypto";
 import { readFile } from "node:fs/promises";
 import { existsSync } from "node:fs";
 import { extname, join, resolve, dirname } from "node:path";
 import { fileURLToPath } from "node:url";
 import { EventNotFoundError, EventParamMismatchError } from "../errors.js";
 import { resolveRuntimeConfigFromEnv, pickEnvOptionalOption } from "../runtime-env-resolver.js";
+/** Constant-time token comparison (length-guarded so timingSafeEqual won't throw). */
+function tokensEqual(a, b) {
+    const ab = Buffer.from(a);
+    const bb = Buffer.from(b);
+    if (ab.length !== bb.length)
+        return false;
+    return timingSafeEqual(ab, bb);
+}
 const MIME = {
     ".html": "text/html; charset=utf-8",
     ".js": "application/javascript; charset=utf-8",
@@ -21,6 +30,7 @@ export class DashboardServer {
     eventIngressEnabled;
     eventIngressAuthToken;
     scheduler;
+    authToken;
     httpServer = null;
     constructor(config) {
         this.mcpServer = config.mcpServer;
@@ -56,15 +66,30 @@ export class DashboardServer {
         if (this.eventIngressEnabled && this.scheduler === undefined) {
             throw new Error("DashboardServer: eventIngressEnabled requires a scheduler reference");
         }
+        // v0.20.1 — dashboard auth gate. Empty string treated as unset.
+        this.authToken = config.authToken ?? (process.env["SKILLSCRIPT_DASHBOARD_AUTH_TOKEN"] || undefined);
     }
     async start() {
         this.httpServer = createServer((req, res) => {
             void this.handle(req, res);
         });
-        return new Promise((resolve) => {
-            this.httpServer.listen(this.port, this.bindAddress, () => resolve());
+        return new Promise((resolve, reject) => {
+            const server = this.httpServer;
+            // Reject (don't hang) on bind errors — e.g. EADDRINUSE — so callers fail
+            // fast instead of waiting on a promise that never resolves.
+            const onError = (err) => { server.off("listening", onListening); reject(err); };
+            const onListening = () => { server.off("error", onError); resolve(); };
+            server.once("error", onError);
+            server.once("listening", onListening);
+            server.listen(this.port, this.bindAddress);
         });
     }
+    /** The actual bound port after `start()` — read this when constructed with
+     *  port 0 (OS-assigned ephemeral port). Falls back to the configured port. */
+    boundPort() {
+        const addr = this.httpServer?.address();
+        return typeof addr === "object" && addr !== null ? addr.port : this.port;
+    }
     async stop() {
         if (this.httpServer === null)
             return;
@@ -76,6 +101,11 @@ export class DashboardServer {
     async handle(req, res) {
         try {
             const url = new URL(req.url ?? "/", `http://${this.bindAddress}:${this.port}`);
+            // v0.20.1 — dashboard auth gate (SPA + /rpc). `/event` self-authenticates
+            // with its own bearer token, so it's exempt here.
+            if (url.pathname !== "/event" && !this.checkDashboardAuth(req, url, res)) {
+                return;
+            }
             // /rpc is POST-only — any other method on /rpc is 405 (not falling
             // through to the static handler, which would 404 with misleading
             // semantics).
@@ -122,6 +152,44 @@ export class DashboardServer {
             res.end(`Internal server error: ${err.message}`);
         }
     }
+    /**
+     * v0.20.1 — dashboard auth gate. Returns true when the request may proceed
+     * (no token configured, or a valid token presented); false when it already
+     * sent a 401. On a browser `?token=` entry it sets a cookie so the SPA's
+     * follow-up asset + `/rpc` requests carry the token without re-tokening.
+     */
+    checkDashboardAuth(req, url, res) {
+        if (this.authToken === undefined)
+            return true; // gate disabled (default)
+        const presented = this.extractDashboardToken(req, url);
+        if (presented !== undefined && tokensEqual(presented, this.authToken)) {
+            if (url.searchParams.has("token")) {
+                // Persist for the browser session so assets + /rpc don't need ?token=.
+                res.setHeader("Set-Cookie", `skillscript_dash=${encodeURIComponent(this.authToken)}; HttpOnly; SameSite=Strict; Path=/`);
+            }
+            return true;
+        }
+        res.statusCode = 401;
+        res.setHeader("content-type", "text/plain; charset=utf-8");
+        res.end("401 Unauthorized — append ?token=<SKILLSCRIPT_DASHBOARD_AUTH_TOKEN> to the URL (or send it as a Bearer token).");
+        return false;
+    }
+    /** Token from `?token=` query, the `skillscript_dash` cookie, or a Bearer header. */
+    extractDashboardToken(req, url) {
+        const q = url.searchParams.get("token");
+        if (q)
+            return q;
+        const cookie = req.headers["cookie"];
+        if (typeof cookie === "string") {
+            const m = /(?:^|;\s*)skillscript_dash=([^;]+)/.exec(cookie);
+            if (m && m[1] !== undefined)
+                return decodeURIComponent(m[1]);
+        }
+        const auth = req.headers["authorization"];
+        if (typeof auth === "string" && auth.startsWith("Bearer "))
+            return auth.slice(7);
+        return undefined;
+    }
     /**
      * v0.19.0 — POST /event handler (memory `ceaf4579`).
      *

package/dist/dashboard/server.js.map

@@ -1 +1 @@
-{"version":3,"file":"server.js","sourceRoot":"","sources":["../../src/dashboard/server.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,MAAM,WAAW,CAAC;AAEzC,OAAO,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AAC5C,OAAO,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AACrC,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAC5D,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AAGzC,OAAO,EAAE,kBAAkB,EAAE,uBAAuB,EAAE,MAAM,cAAc,CAAC;AAC3E,OAAO,EAAE,2BAA2B,EAAE,qBAAqB,EAAE,MAAM,4BAA4B,CAAC;AAkFhG,MAAM,IAAI,GAA2B;IACnC,OAAO,EAAE,0BAA0B;IACnC,KAAK,EAAE,uCAAuC;IAC9C,MAAM,EAAE,yBAAyB;IACjC,OAAO,EAAE,iCAAiC;CAC3C,CAAC;AAEF,MAAM,OAAO,eAAe;IACT,SAAS,CAAY;IACrB,IAAI,CAAS;IACb,WAAW,CAAS;IACpB,SAAS,CAAS;IAClB,QAAQ,CAAU;IAClB,oBAAoB,CAAqB;IACzC,mBAAmB,CAAU;IAC7B,qBAAqB,CAAqB;IAC1C,SAAS,CAAwB;IAC1C,UAAU,GAAkB,IAAI,CAAC;IAEzC,YAAY,MAA6B;QACvC,IAAI,CAAC,SAAS,GAAG,MAAM,CAAC,SAAS,CAAC;QAClC,gEAAgE;QAChE,iEAAiE;QACjE,4DAA4D;QAC5D,6DAA6D;QAC7D,sDAAsD;QACtD,8DAA8D;QAC9D,8CAA8C;QAC9C,EAAE;QACF,8DAA8D;QAC9D,wDAAwD;QACxD,iCAAiC;QACjC,MAAM,MAAM,GAAG,2BAA2B,EAAE,CAAC;QAC7C,IAAI,CAAC,IAAI,GAAG,qBAAqB,CAAC,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC;QACpE,IAAI,CAAC,WAAW,GAAG,qBAAqB,CAAC,MAAM,CAAC,WAAW,EAAE,MAAM,CAAC,IAAI,CAAC,IAAI,WAAW,CAAC;QACzF,IAAI,CAAC,SAAS,GAAG,MAAM,CAAC,SAAS,IAAI,eAAe,EAAE,CAAC;QACvD,IAAI,CAAC,QAAQ,GAAG,MAAM,CAAC,QAAQ,IAAI,IAAI,CAAC;QACxC,gEAAgE;QAChE,oEAAoE;QACpE,wDAAwD;QACxD,MAAM,SAAS,GAAG,qBAAqB,CAAC,MAAM,CAAC,uBAAuB,EAAE,MAAM,CAAC,uBAAuB,CAAC,CAAC;QACxG,IAAI,CAAC,oBAAoB,GAAG,SAAS,EAAE,WAAW,EAAE,CAAC;QACrD,kEAAkE;QAClE,2DAA2D;QAC3D,iCAAiC;QACjC,IAAI,CAAC,mBAAmB,GAAG,MAAM,CAAC,mBAAmB,KAAK,SAAS;YACjE,CAAC,CAAC,MAAM,CAAC,mBAAmB;YAC5B,CAAC,CAAC,MAAM,CAAC,mBAAmB,IAAI,KAAK,CAAC;QACxC,IAAI,CAAC,qBAAqB,GAAG,qBAAqB,CAAC,MAAM,CAAC,qBAAqB,EAAE,MAAM,CAAC,qBAAqB,CAAC,CAAC;QAC/G,IAAI,CAAC,SAAS,GAAG,MAAM,CAAC,SAAS,CAAC;QAClC,IAAI,IAAI,CAAC,mBAAmB,IAAI,IAAI,CAAC,SAAS,KAAK,SAAS,EAAE,CAAC;YAC7D,MAAM,IAAI,KAAK,CAAC,qEAAqE,CAAC,CAAC;QACzF,CAAC;IACH,CAAC;IAED,KAAK,CAAC,KAAK;QACT,IAAI,CAAC,UAAU,GAAG,YAAY,CAAC,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE;YAC1C,KAAK,IAAI,CAAC,MAAM,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;QAC7B,CAAC,CAAC,CAAC;QACH,OAAO,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,EAAE;YACnC,IAAI,CAAC,UAAW,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,WAAW,EAAE,GAAG,EAAE,CAAC,OAAO,EAAE,CAAC,CAAC;QACxE,CAAC,CAAC,CAAC;IACL,CAAC;IAED,KAAK,CAAC,IAAI;QACR,IAAI,IAAI,CAAC,UAAU,KAAK,IAAI;YAAE,OAAO;QACrC,OAAO,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;YAC3C,IAAI,CAAC,UAAW,CAAC,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC;QACnE,CAAC,CAAC,CAAC;IACL,CAAC;IAED,yEAAyE;IACzE,KAAK,CAAC,MAAM,CAAC,GAAoB,EAAE,GAAmB;QACpD,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,GAAG,IAAI,GAAG,EAAE,UAAU,IAAI,CAAC,WAAW,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC;YAC/E,mEAAmE;YACnE,iEAAiE;YACjE,cAAc;YACd,IAAI,GAAG,CAAC,QAAQ,KAAK,MAAM,EAAE,CAAC;gBAC5B,IAAI,GAAG,CAAC,MAAM,KAAK,MAAM,EAAE,CAAC;oBAC1B,GAAG,CAAC,UAAU,GAAG,GAAG,CAAC;oBACrB,GAAG,CAAC,GAAG,CAAC,oBAAoB,CAAC,CAAC;oBAC9B,OAAO;gBACT,CAAC;gBACD,MAAM,IAAI,CAAC,SAAS,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;gBAC/B,OAAO;YACT,CAAC;YACD,4DAA4D;YAC5D,6DAA6D;YAC7D,sCAAsC;YACtC,IAAI,GAAG,CAAC,QAAQ,KAAK,QAAQ,EAAE,CAAC;gBAC9B,IAAI,CAAC,IAAI,CAAC,mBAAmB,EAAE,CAAC;oBAC9B,GAAG,CAAC,UAAU,GAAG,GAAG,CAAC;oBACrB,GAAG,CAAC,GAAG,CAAC,oCAAoC,CAAC,CAAC;oBAC9C,OAAO;gBACT,CAAC;gBACD,IAAI,GAAG,CAAC,MAAM,KAAK,MAAM,EAAE,CAAC;oBAC1B,GAAG,CAAC,UAAU,GAAG,GAAG,CAAC;oBACrB,GAAG,CAAC,GAAG,CAAC,oBAAoB,CAAC,CAAC;oBAC9B,OAAO;gBACT,CAAC;gBACD,MAAM,IAAI,CAAC,WAAW,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;gBACjC,OAAO;YACT,CAAC;YACD,IAAI,GAAG,CAAC,MAAM,KAAK,KAAK,EAAE,CAAC;gBACzB,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,CAAC;oBACnB,GAAG,CAAC,UAAU,GAAG,GAAG,CAAC;oBACrB,GAAG,CAAC,GAAG,CAAC,oDAAoD,CAAC,CAAC;oBAC9D,OAAO;gBACT,CAAC;gBACD,MAAM,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAC;gBAC3C,OAAO;YACT,CAAC;YACD,GAAG,CAAC,UAAU,GAAG,GAAG,CAAC;YACrB,GAAG,CAAC,GAAG,CAAC,oBAAoB,CAAC,CAAC;QAChC,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,GAAG,CAAC,UAAU,GAAG,GAAG,CAAC;YACrB,GAAG,CAAC,GAAG,CAAC,0BAA2B,GAAa,CAAC,OAAO,EAAE,CAAC,CAAC;QAC9D,CAAC;IACH,CAAC;IAED;;;;;;;;;;;;;;;OAeG;IACK,KAAK,CAAC,WAAW,CAAC,GAAoB,EAAE,GAAmB;QACjE,uEAAuE;QACvE,sDAAsD;QACtD,IAAI,IAAI,CAAC,qBAAqB,KAAK,SAAS,EAAE,CAAC;YAC7C,MAAM,IAAI,GAAG,GAAG,CAAC,OAAO,CAAC,eAAe,CAAC,CAAC;YAC1C,MAAM,QAAQ,GAAG,UAAU,IAAI,CAAC,qBAAqB,EAAE,CAAC;YACxD,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,IAAI,KAAK,QAAQ,EAAE,CAAC;gBAClD,GAAG,CAAC,UAAU,GAAG,GAAG,CAAC;gBACrB,GAAG,CAAC,SAAS,CAAC,cAAc,EAAE,IAAI,CAAC,OAAO,CAAE,CAAC,CAAC;gBAC9C,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,cAAc,EAAE,MAAM,EAAE,iCAAiC,EAAE,CAAC,CAAC,CAAC;gBAC9F,OAAO;YACT,CAAC;QACH,CAAC;QACD,MAAM,MAAM,GAAa,EAAE,CAAC;QAC5B,IAAI,KAAK,EAAE,MAAM,KAAK,IAAI,GAAG;YAAE,MAAM,CAAC,IAAI,CAAC,KAAe,CAAC,CAAC;QAC5D,MAAM,IAAI,GAAG,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;QACpD,IAAI,MAAkD,CAAC;QACvD,IAAI,CAAC;YACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAA+C,CAAC;QAC1E,CAAC;QAAC,MAAM,CAAC;YACP,GAAG,CAAC,UAAU,GAAG,GAAG,CAAC;YACrB,GAAG,CAAC,SAAS,CAAC,cAAc,EAAE,IAAI,CAAC,OAAO,CAAE,CAAC,CAAC;YAC9C,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,aAAa,EAAE,MAAM,EAAE,wBAAwB,EAAE,CAAC,CAAC,CAAC;YACpF,OAAO;QACT,CAAC;QACD,IAAI,OAAO,MAAM,CAAC,UAAU,KAAK,QAAQ,IAAI,MAAM,CAAC,UAAU,KAAK,EAAE,EAAE,CAAC;YACtE,GAAG,CAAC,UAAU,GAAG,GAAG,CAAC;YACrB,GAAG,CAAC,SAAS,CAAC,cAAc,EAAE,IAAI,CAAC,OAAO,CAAE,CAAC,CAAC;YAC9C,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,aAAa,EAAE,MAAM,EAAE,iDAAiD,EAAE,CAAC,CAAC,CAAC;YAC7G,OAAO;QACT,CAAC;QACD,MAAM,MAAM,GAAG,CAAC,OAAO,MAAM,CAAC,MAAM,KAAK,QAAQ,IAAI,MAAM,CAAC,MAAM,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;YAC3G,CAAC,CAAC,MAAM,CAAC,MAAiC;YAC1C,CAAC,CAAC,EAAE,CAAC;QACP,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,IAAI,CAAC,SAAU,CAAC,SAAS,CAAC,MAAM,CAAC,UAAU,EAAE,MAAM,CAAC,CAAC;YACpE,GAAG,CAAC,UAAU,GAAG,GAAG,CAAC;YACrB,GAAG,CAAC,SAAS,CAAC,cAAc,EAAE,IAAI,CAAC,OAAO,CAAE,CAAC,CAAC;YAC9C,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,GAAG,MAAM,EAAE,UAAU,EAAE,YAAY,EAAE,CAAC,CAAC,CAAC;QACnE,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,GAAG,YAAY,kBAAkB,EAAE,CAAC;gBACtC,GAAG,CAAC,UAAU,GAAG,GAAG,CAAC;gBACrB,GAAG,CAAC,SAAS,CAAC,cAAc,EAAE,IAAI,CAAC,OAAO,CAAE,CAAC,CAAC;gBAC9C,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,WAAW,EAAE,MAAM,EAAE,GAAG,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC;gBACrE,OAAO;YACT,CAAC;YACD,IAAI,GAAG,YAAY,uBAAuB,EAAE,CAAC;gBAC3C,GAAG,CAAC,UAAU,GAAG,GAAG,CAAC;gBACrB,GAAG,CAAC,SAAS,CAAC,cAAc,EAAE,IAAI,CAAC,OAAO,CAAE,CAAC,CAAC;gBAC9C,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC;oBACrB,KAAK,EAAE,aAAa;oBACpB,MAAM,EAAE,GAAG,CAAC,OAAO;oBACnB,QAAQ,EAAE,GAAG,CAAC,QAAQ;oBACtB,OAAO,EAAE,GAAG,CAAC,OAAO;oBACpB,KAAK,EAAE,GAAG,CAAC,KAAK;iBACjB,CAAC,CAAC,CAAC;gBACJ,OAAO;YACT,CAAC;YACD,MAAM,GAAG,CAAC;QACZ,CAAC;IACH,CAAC;IAEO,KAAK,CAAC,SAAS,CAAC,GAAoB,EAAE,GAAmB;QAC/D,MAAM,MAAM,GAAa,EAAE,CAAC;QAC5B,IAAI,KAAK,EAAE,MAAM,KAAK,IAAI,GAAG;YAAE,MAAM,CAAC,IAAI,CAAC,KAAe,CAAC,CAAC;QAC5D,MAAM,IAAI,GAAG,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;QACpD,IAAI,MAAsB,CAAC;QAC3B,IAAI,CAAC;YACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAmB,CAAC;QAC9C,CAAC;QAAC,MAAM,CAAC;YACP,GAAG,CAAC,UAAU,GAAG,GAAG,CAAC;YACrB,GAAG,CAAC,SAAS,CAAC,cAAc,EAAE,IAAI,CAAC,OAAO,CAAE,CAAC,CAAC;YAC9C,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,CAAC,KAAK,EAAE,OAAO,EAAE,aAAa,EAAE,EAAE,CAAC,CAAC,CAAC;YACvG,OAAO;QACT,CAAC;QACD,oEAAoE;QACpE,8DAA8D;QAC9D,mEAAmE;QACnE,sEAAsE;QACtE,sEAAsE;QACtE,2BAA2B;QAC3B,IAAI,cAAkC,CAAC;QACvC,IAAI,IAAI,CAAC,oBAAoB,KAAK,SAAS,EAAE,CAAC;YAC5C,MAAM,GAAG,GAAG,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,oBAAoB,CAAC,CAAC;YACnD,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,GAAG,KAAK,EAAE,EAAE,CAAC;gBAC1C,cAAc,GAAG,GAAG,CAAC;YACvB,CAAC;iBAAM,IAAI,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,GAAG,CAAC,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC;gBACjE,cAAc,GAAG,GAAG,CAAC,CAAC,CAAC,CAAC;YAC1B,CAAC;QACH,CAAC;QACD,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,MAAM,EAAE,EAAE,cAAc,EAAE,CAAC,CAAC;QACzE,GAAG,CAAC,UAAU,GAAG,GAAG,CAAC;QACrB,GAAG,CAAC,SAAS,CAAC,cAAc,EAAE,IAAI,CAAC,OAAO,CAAE,CAAC,CAAC;QAC9C,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC,CAAC;IACpC,CAAC;IAEO,KAAK,CAAC,YAAY,CAAC,QAAgB,EAAE,GAAmB;QAC9D,MAAM,SAAS,GAAG,QAAQ,KAAK,GAAG,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,QAAQ,CAAC;QAC9D,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,SAAS,CAAC,CAAC;QAC7C,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC;YACrC,GAAG,CAAC,UAAU,GAAG,GAAG,CAAC;YACrB,GAAG,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;YACrB,OAAO;QACT,CAAC;QACD,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;YACtB,GAAG,CAAC,UAAU,GAAG,GAAG,CAAC;YACrB,GAAG,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;YACrB,OAAO;QACT,CAAC;QACD,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,IAAI,CAAC,CAAC;QAClC,GAAG,CAAC,UAAU,GAAG,GAAG,CAAC;QACrB,GAAG,CAAC,SAAS,CAAC,cAAc,EAAE,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,IAAI,0BAA0B,CAAC,CAAC;QACjF,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IAChB,CAAC;CACF;AAED,oFAAoF;AACpF,SAAS,eAAe;IACtB,MAAM,IAAI,GAAG,OAAO,CAAC,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;IACrD,kEAAkE;IAClE,0EAA0E;IAC1E,MAAM,UAAU,GAAG;QACjB,OAAO,CAAC,IAAI,EAAE,KAAK,CAAC;QACpB,OAAO,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,WAAW,EAAE,KAAK,CAAC;KACrD,CAAC;IACF,KAAK,MAAM,CAAC,IAAI,UAAU,EAAE,CAAC;QAC3B,IAAI,UAAU,CAAC,CAAC,CAAC;YAAE,OAAO,CAAC,CAAC;IAC9B,CAAC;IACD,sEAAsE;IACtE,OAAO,UAAU,CAAC,CAAC,CAAE,CAAC;AACxB,CAAC"}
+{"version":3,"file":"server.js","sourceRoot":"","sources":["../../src/dashboard/server.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,MAAM,WAAW,CAAC;AACzC,OAAO,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAE9C,OAAO,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AAC5C,OAAO,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AACrC,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAC5D,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AAGzC,OAAO,EAAE,kBAAkB,EAAE,uBAAuB,EAAE,MAAM,cAAc,CAAC;AAC3E,OAAO,EAAE,2BAA2B,EAAE,qBAAqB,EAAE,MAAM,4BAA4B,CAAC;AA+FhG,sFAAsF;AACtF,SAAS,WAAW,CAAC,CAAS,EAAE,CAAS;IACvC,MAAM,EAAE,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAC1B,MAAM,EAAE,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAC1B,IAAI,EAAE,CAAC,MAAM,KAAK,EAAE,CAAC,MAAM;QAAE,OAAO,KAAK,CAAC;IAC1C,OAAO,eAAe,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC;AACjC,CAAC;AAED,MAAM,IAAI,GAA2B;IACnC,OAAO,EAAE,0BAA0B;IACnC,KAAK,EAAE,uCAAuC;IAC9C,MAAM,EAAE,yBAAyB;IACjC,OAAO,EAAE,iCAAiC;CAC3C,CAAC;AAEF,MAAM,OAAO,eAAe;IACT,SAAS,CAAY;IACrB,IAAI,CAAS;IACb,WAAW,CAAS;IACpB,SAAS,CAAS;IAClB,QAAQ,CAAU;IAClB,oBAAoB,CAAqB;IACzC,mBAAmB,CAAU;IAC7B,qBAAqB,CAAqB;IAC1C,SAAS,CAAwB;IACjC,SAAS,CAAqB;IACvC,UAAU,GAAkB,IAAI,CAAC;IAEzC,YAAY,MAA6B;QACvC,IAAI,CAAC,SAAS,GAAG,MAAM,CAAC,SAAS,CAAC;QAClC,gEAAgE;QAChE,iEAAiE;QACjE,4DAA4D;QAC5D,6DAA6D;QAC7D,sDAAsD;QACtD,8DAA8D;QAC9D,8CAA8C;QAC9C,EAAE;QACF,8DAA8D;QAC9D,wDAAwD;QACxD,iCAAiC;QACjC,MAAM,MAAM,GAAG,2BAA2B,EAAE,CAAC;QAC7C,IAAI,CAAC,IAAI,GAAG,qBAAqB,CAAC,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC;QACpE,IAAI,CAAC,WAAW,GAAG,qBAAqB,CAAC,MAAM,CAAC,WAAW,EAAE,MAAM,CAAC,IAAI,CAAC,IAAI,WAAW,CAAC;QACzF,IAAI,CAAC,SAAS,GAAG,MAAM,CAAC,SAAS,IAAI,eAAe,EAAE,CAAC;QACvD,IAAI,CAAC,QAAQ,GAAG,MAAM,CAAC,QAAQ,IAAI,IAAI,CAAC;QACxC,gEAAgE;QAChE,oEAAoE;QACpE,wDAAwD;QACxD,MAAM,SAAS,GAAG,qBAAqB,CAAC,MAAM,CAAC,uBAAuB,EAAE,MAAM,CAAC,uBAAuB,CAAC,CAAC;QACxG,IAAI,CAAC,oBAAoB,GAAG,SAAS,EAAE,WAAW,EAAE,CAAC;QACrD,kEAAkE;QAClE,2DAA2D;QAC3D,iCAAiC;QACjC,IAAI,CAAC,mBAAmB,GAAG,MAAM,CAAC,mBAAmB,KAAK,SAAS;YACjE,CAAC,CAAC,MAAM,CAAC,mBAAmB;YAC5B,CAAC,CAAC,MAAM,CAAC,mBAAmB,IAAI,KAAK,CAAC;QACxC,IAAI,CAAC,qBAAqB,GAAG,qBAAqB,CAAC,MAAM,CAAC,qBAAqB,EAAE,MAAM,CAAC,qBAAqB,CAAC,CAAC;QAC/G,IAAI,CAAC,SAAS,GAAG,MAAM,CAAC,SAAS,CAAC;QAClC,IAAI,IAAI,CAAC,mBAAmB,IAAI,IAAI,CAAC,SAAS,KAAK,SAAS,EAAE,CAAC;YAC7D,MAAM,IAAI,KAAK,CAAC,qEAAqE,CAAC,CAAC;QACzF,CAAC;QACD,gEAAgE;QAChE,IAAI,CAAC,SAAS,GAAG,MAAM,CAAC,SAAS,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,kCAAkC,CAAC,IAAI,SAAS,CAAC,CAAC;IACtG,CAAC;IAED,KAAK,CAAC,KAAK;QACT,IAAI,CAAC,UAAU,GAAG,YAAY,CAAC,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE;YAC1C,KAAK,IAAI,CAAC,MAAM,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;QAC7B,CAAC,CAAC,CAAC;QACH,OAAO,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;YAC3C,MAAM,MAAM,GAAG,IAAI,CAAC,UAAW,CAAC;YAChC,yEAAyE;YACzE,4DAA4D;YAC5D,MAAM,OAAO,GAAG,CAAC,GAAU,EAAQ,EAAE,GAAG,MAAM,CAAC,GAAG,CAAC,WAAW,EAAE,WAAW,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;YAC7F,MAAM,WAAW,GAAG,GAAS,EAAE,GAAG,MAAM,CAAC,GAAG,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,CAAC;YAC7E,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;YAC9B,MAAM,CAAC,IAAI,CAAC,WAAW,EAAE,WAAW,CAAC,CAAC;YACtC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,WAAW,CAAC,CAAC;QAC7C,CAAC,CAAC,CAAC;IACL,CAAC;IAED;kFAC8E;IAC9E,SAAS;QACP,MAAM,IAAI,GAAG,IAAI,CAAC,UAAU,EAAE,OAAO,EAAE,CAAC;QACxC,OAAO,OAAO,IAAI,KAAK,QAAQ,IAAI,IAAI,KAAK,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC;IAC3E,CAAC;IAED,KAAK,CAAC,IAAI;QACR,IAAI,IAAI,CAAC,UAAU,KAAK,IAAI;YAAE,OAAO;QACrC,OAAO,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;YAC3C,IAAI,CAAC,UAAW,CAAC,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC;QACnE,CAAC,CAAC,CAAC;IACL,CAAC;IAED,yEAAyE;IACzE,KAAK,CAAC,MAAM,CAAC,GAAoB,EAAE,GAAmB;QACpD,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,GAAG,IAAI,GAAG,EAAE,UAAU,IAAI,CAAC,WAAW,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC;YAC/E,0EAA0E;YAC1E,kDAAkD;YAClD,IAAI,GAAG,CAAC,QAAQ,KAAK,QAAQ,IAAI,CAAC,IAAI,CAAC,kBAAkB,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,CAAC,EAAE,CAAC;gBACzE,OAAO;YACT,CAAC;YACD,mEAAmE;YACnE,iEAAiE;YACjE,cAAc;YACd,IAAI,GAAG,CAAC,QAAQ,KAAK,MAAM,EAAE,CAAC;gBAC5B,IAAI,GAAG,CAAC,MAAM,KAAK,MAAM,EAAE,CAAC;oBAC1B,GAAG,CAAC,UAAU,GAAG,GAAG,CAAC;oBACrB,GAAG,CAAC,GAAG,CAAC,oBAAoB,CAAC,CAAC;oBAC9B,OAAO;gBACT,CAAC;gBACD,MAAM,IAAI,CAAC,SAAS,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;gBAC/B,OAAO;YACT,CAAC;YACD,4DAA4D;YAC5D,6DAA6D;YAC7D,sCAAsC;YACtC,IAAI,GAAG,CAAC,QAAQ,KAAK,QAAQ,EAAE,CAAC;gBAC9B,IAAI,CAAC,IAAI,CAAC,mBAAmB,EAAE,CAAC;oBAC9B,GAAG,CAAC,UAAU,GAAG,GAAG,CAAC;oBACrB,GAAG,CAAC,GAAG,CAAC,oCAAoC,CAAC,CAAC;oBAC9C,OAAO;gBACT,CAAC;gBACD,IAAI,GAAG,CAAC,MAAM,KAAK,MAAM,EAAE,CAAC;oBAC1B,GAAG,CAAC,UAAU,GAAG,GAAG,CAAC;oBACrB,GAAG,CAAC,GAAG,CAAC,oBAAoB,CAAC,CAAC;oBAC9B,OAAO;gBACT,CAAC;gBACD,MAAM,IAAI,CAAC,WAAW,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;gBACjC,OAAO;YACT,CAAC;YACD,IAAI,GAAG,CAAC,MAAM,KAAK,KAAK,EAAE,CAAC;gBACzB,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,CAAC;oBACnB,GAAG,CAAC,UAAU,GAAG,GAAG,CAAC;oBACrB,GAAG,CAAC,GAAG,CAAC,oDAAoD,CAAC,CAAC;oBAC9D,OAAO;gBACT,CAAC;gBACD,MAAM,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAC;gBAC3C,OAAO;YACT,CAAC;YACD,GAAG,CAAC,UAAU,GAAG,GAAG,CAAC;YACrB,GAAG,CAAC,GAAG,CAAC,oBAAoB,CAAC,CAAC;QAChC,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,GAAG,CAAC,UAAU,GAAG,GAAG,CAAC;YACrB,GAAG,CAAC,GAAG,CAAC,0BAA2B,GAAa,CAAC,OAAO,EAAE,CAAC,CAAC;QAC9D,CAAC;IACH,CAAC;IAED;;;;;OAKG;IACK,kBAAkB,CAAC,GAAoB,EAAE,GAAQ,EAAE,GAAmB;QAC5E,IAAI,IAAI,CAAC,SAAS,KAAK,SAAS;YAAE,OAAO,IAAI,CAAC,CAAC,0BAA0B;QACzE,MAAM,SAAS,GAAG,IAAI,CAAC,qBAAqB,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;QACvD,IAAI,SAAS,KAAK,SAAS,IAAI,WAAW,CAAC,SAAS,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC;YACtE,IAAI,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC;gBAClC,uEAAuE;gBACvE,GAAG,CAAC,SAAS,CAAC,YAAY,EAAE,oBAAoB,kBAAkB,CAAC,IAAI,CAAC,SAAS,CAAC,qCAAqC,CAAC,CAAC;YAC3H,CAAC;YACD,OAAO,IAAI,CAAC;QACd,CAAC;QACD,GAAG,CAAC,UAAU,GAAG,GAAG,CAAC;QACrB,GAAG,CAAC,SAAS,CAAC,cAAc,EAAE,2BAA2B,CAAC,CAAC;QAC3D,GAAG,CAAC,GAAG,CAAC,gHAAgH,CAAC,CAAC;QAC1H,OAAO,KAAK,CAAC;IACf,CAAC;IAED,qFAAqF;IAC7E,qBAAqB,CAAC,GAAoB,EAAE,GAAQ;QAC1D,MAAM,CAAC,GAAG,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;QACxC,IAAI,CAAC;YAAE,OAAO,CAAC,CAAC;QAChB,MAAM,MAAM,GAAG,GAAG,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;QACrC,IAAI,OAAO,MAAM,KAAK,QAAQ,EAAE,CAAC;YAC/B,MAAM,CAAC,GAAG,oCAAoC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;YAC5D,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,SAAS;gBAAE,OAAO,kBAAkB,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QAC/D,CAAC;QACD,MAAM,IAAI,GAAG,GAAG,CAAC,OAAO,CAAC,eAAe,CAAC,CAAC;QAC1C,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,IAAI,CAAC,UAAU,CAAC,SAAS,CAAC;YAAE,OAAO,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;QACjF,OAAO,SAAS,CAAC;IACnB,CAAC;IAED;;;;;;;;;;;;;;;OAeG;IACK,KAAK,CAAC,WAAW,CAAC,GAAoB,EAAE,GAAmB;QACjE,uEAAuE;QACvE,sDAAsD;QACtD,IAAI,IAAI,CAAC,qBAAqB,KAAK,SAAS,EAAE,CAAC;YAC7C,MAAM,IAAI,GAAG,GAAG,CAAC,OAAO,CAAC,eAAe,CAAC,CAAC;YAC1C,MAAM,QAAQ,GAAG,UAAU,IAAI,CAAC,qBAAqB,EAAE,CAAC;YACxD,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,IAAI,KAAK,QAAQ,EAAE,CAAC;gBAClD,GAAG,CAAC,UAAU,GAAG,GAAG,CAAC;gBACrB,GAAG,CAAC,SAAS,CAAC,cAAc,EAAE,IAAI,CAAC,OAAO,CAAE,CAAC,CAAC;gBAC9C,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,cAAc,EAAE,MAAM,EAAE,iCAAiC,EAAE,CAAC,CAAC,CAAC;gBAC9F,OAAO;YACT,CAAC;QACH,CAAC;QACD,MAAM,MAAM,GAAa,EAAE,CAAC;QAC5B,IAAI,KAAK,EAAE,MAAM,KAAK,IAAI,GAAG;YAAE,MAAM,CAAC,IAAI,CAAC,KAAe,CAAC,CAAC;QAC5D,MAAM,IAAI,GAAG,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;QACpD,IAAI,MAAkD,CAAC;QACvD,IAAI,CAAC;YACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAA+C,CAAC;QAC1E,CAAC;QAAC,MAAM,CAAC;YACP,GAAG,CAAC,UAAU,GAAG,GAAG,CAAC;YACrB,GAAG,CAAC,SAAS,CAAC,cAAc,EAAE,IAAI,CAAC,OAAO,CAAE,CAAC,CAAC;YAC9C,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,aAAa,EAAE,MAAM,EAAE,wBAAwB,EAAE,CAAC,CAAC,CAAC;YACpF,OAAO;QACT,CAAC;QACD,IAAI,OAAO,MAAM,CAAC,UAAU,KAAK,QAAQ,IAAI,MAAM,CAAC,UAAU,KAAK,EAAE,EAAE,CAAC;YACtE,GAAG,CAAC,UAAU,GAAG,GAAG,CAAC;YACrB,GAAG,CAAC,SAAS,CAAC,cAAc,EAAE,IAAI,CAAC,OAAO,CAAE,CAAC,CAAC;YAC9C,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,aAAa,EAAE,MAAM,EAAE,iDAAiD,EAAE,CAAC,CAAC,CAAC;YAC7G,OAAO;QACT,CAAC;QACD,MAAM,MAAM,GAAG,CAAC,OAAO,MAAM,CAAC,MAAM,KAAK,QAAQ,IAAI,MAAM,CAAC,MAAM,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;YAC3G,CAAC,CAAC,MAAM,CAAC,MAAiC;YAC1C,CAAC,CAAC,EAAE,CAAC;QACP,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,IAAI,CAAC,SAAU,CAAC,SAAS,CAAC,MAAM,CAAC,UAAU,EAAE,MAAM,CAAC,CAAC;YACpE,GAAG,CAAC,UAAU,GAAG,GAAG,CAAC;YACrB,GAAG,CAAC,SAAS,CAAC,cAAc,EAAE,IAAI,CAAC,OAAO,CAAE,CAAC,CAAC;YAC9C,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,GAAG,MAAM,EAAE,UAAU,EAAE,YAAY,EAAE,CAAC,CAAC,CAAC;QACnE,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,GAAG,YAAY,kBAAkB,EAAE,CAAC;gBACtC,GAAG,CAAC,UAAU,GAAG,GAAG,CAAC;gBACrB,GAAG,CAAC,SAAS,CAAC,cAAc,EAAE,IAAI,CAAC,OAAO,CAAE,CAAC,CAAC;gBAC9C,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,WAAW,EAAE,MAAM,EAAE,GAAG,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC;gBACrE,OAAO;YACT,CAAC;YACD,IAAI,GAAG,YAAY,uBAAuB,EAAE,CAAC;gBAC3C,GAAG,CAAC,UAAU,GAAG,GAAG,CAAC;gBACrB,GAAG,CAAC,SAAS,CAAC,cAAc,EAAE,IAAI,CAAC,OAAO,CAAE,CAAC,CAAC;gBAC9C,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC;oBACrB,KAAK,EAAE,aAAa;oBACpB,MAAM,EAAE,GAAG,CAAC,OAAO;oBACnB,QAAQ,EAAE,GAAG,CAAC,QAAQ;oBACtB,OAAO,EAAE,GAAG,CAAC,OAAO;oBACpB,KAAK,EAAE,GAAG,CAAC,KAAK;iBACjB,CAAC,CAAC,CAAC;gBACJ,OAAO;YACT,CAAC;YACD,MAAM,GAAG,CAAC;QACZ,CAAC;IACH,CAAC;IAEO,KAAK,CAAC,SAAS,CAAC,GAAoB,EAAE,GAAmB;QAC/D,MAAM,MAAM,GAAa,EAAE,CAAC;QAC5B,IAAI,KAAK,EAAE,MAAM,KAAK,IAAI,GAAG;YAAE,MAAM,CAAC,IAAI,CAAC,KAAe,CAAC,CAAC;QAC5D,MAAM,IAAI,GAAG,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;QACpD,IAAI,MAAsB,CAAC;QAC3B,IAAI,CAAC;YACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAmB,CAAC;QAC9C,CAAC;QAAC,MAAM,CAAC;YACP,GAAG,CAAC,UAAU,GAAG,GAAG,CAAC;YACrB,GAAG,CAAC,SAAS,CAAC,cAAc,EAAE,IAAI,CAAC,OAAO,CAAE,CAAC,CAAC;YAC9C,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,CAAC,KAAK,EAAE,OAAO,EAAE,aAAa,EAAE,EAAE,CAAC,CAAC,CAAC;YACvG,OAAO;QACT,CAAC;QACD,oEAAoE;QACpE,8DAA8D;QAC9D,mEAAmE;QACnE,sEAAsE;QACtE,sEAAsE;QACtE,2BAA2B;QAC3B,IAAI,cAAkC,CAAC;QACvC,IAAI,IAAI,CAAC,oBAAoB,KAAK,SAAS,EAAE,CAAC;YAC5C,MAAM,GAAG,GAAG,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,oBAAoB,CAAC,CAAC;YACnD,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,GAAG,KAAK,EAAE,EAAE,CAAC;gBAC1C,cAAc,GAAG,GAAG,CAAC;YACvB,CAAC;iBAAM,IAAI,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,GAAG,CAAC,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC;gBACjE,cAAc,GAAG,GAAG,CAAC,CAAC,CAAC,CAAC;YAC1B,CAAC;QACH,CAAC;QACD,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,MAAM,EAAE,EAAE,cAAc,EAAE,CAAC,CAAC;QACzE,GAAG,CAAC,UAAU,GAAG,GAAG,CAAC;QACrB,GAAG,CAAC,SAAS,CAAC,cAAc,EAAE,IAAI,CAAC,OAAO,CAAE,CAAC,CAAC;QAC9C,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC,CAAC;IACpC,CAAC;IAEO,KAAK,CAAC,YAAY,CAAC,QAAgB,EAAE,GAAmB;QAC9D,MAAM,SAAS,GAAG,QAAQ,KAAK,GAAG,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,QAAQ,CAAC;QAC9D,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,SAAS,CAAC,CAAC;QAC7C,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC;YACrC,GAAG,CAAC,UAAU,GAAG,GAAG,CAAC;YACrB,GAAG,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;YACrB,OAAO;QACT,CAAC;QACD,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;YACtB,GAAG,CAAC,UAAU,GAAG,GAAG,CAAC;YACrB,GAAG,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;YACrB,OAAO;QACT,CAAC;QACD,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,IAAI,CAAC,CAAC;QAClC,GAAG,CAAC,UAAU,GAAG,GAAG,CAAC;QACrB,GAAG,CAAC,SAAS,CAAC,cAAc,EAAE,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,IAAI,0BAA0B,CAAC,CAAC;QACjF,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IAChB,CAAC;CACF;AAED,oFAAoF;AACpF,SAAS,eAAe;IACtB,MAAM,IAAI,GAAG,OAAO,CAAC,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;IACrD,kEAAkE;IAClE,0EAA0E;IAC1E,MAAM,UAAU,GAAG;QACjB,OAAO,CAAC,IAAI,EAAE,KAAK,CAAC;QACpB,OAAO,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,WAAW,EAAE,KAAK,CAAC;KACrD,CAAC;IACF,KAAK,MAAM,CAAC,IAAI,UAAU,EAAE,CAAC;QAC3B,IAAI,UAAU,CAAC,CAAC,CAAC;YAAE,OAAO,CAAC,CAAC;IAC9B,CAAC;IACD,sEAAsE;IACtE,OAAO,UAAU,CAAC,CAAC,CAAE,CAAC;AACxB,CAAC"}

package/dist/dashboard/spa/app.js

@@ -13,6 +13,8 @@ const state = {
   metrics: null,
   capabilities: null,
   blockedShellAttempts: null,
+  // v1.0 Gate #7 — { enabled, public_key_present } or null (pre-Gate-#7 server).
+  securedApproval: null,
   lastUpdate: null,
 };
 
@@ -50,7 +52,7 @@ async function refresh() {
       callTool("skill_list", { filter: { audience: "all" } }),
       callTool("list_triggers", {}),
       callTool("health_metrics", {}),
-      callTool("runtime_capabilities", { include: ["mcpConnectors", "mcpConnectorClasses", "localModels", "dataStores", "skillStores", "agentConnectors", "runtimeVersion"] }),
+      callTool("runtime_capabilities", { include: ["mcpConnectors", "mcpConnectorClasses", "localModels", "dataStores", "skillStores", "agentConnectors", "securedApproval", "runtimeVersion"] }),
       // v0.18.9 — blocked shell attempts for the Security view's
       // observe→promote loop. Graceful: pre-v0.18.9 servers don't have
       // this tool; catch returns null and the Security view degrades.
@@ -64,8 +66,11 @@ async function refresh() {
     state.triggers = triggers;
     state.metrics = metrics;
     state.capabilities = capabilities;
+    // v0.9.0+ servers may omit securedApproval (pre-Gate-#7) → null = "unsecured".
+    state.securedApproval = capabilities?.securedApproval ?? null;
     state.blockedShellAttempts = blocked;
     state.lastUpdate = ts;
+    renderSecuredBanner();
     document.getElementById("poll-status").textContent = `last updated ${ts.toLocaleTimeString()}`;
     renderCurrentView();
   } catch (err) {
@@ -78,8 +83,156 @@ function startPolling() {
   pollTimer = setInterval(refresh, POLL_INTERVAL_MS);
 }
 
+// ─── Secured mode (v1.0 Gate #7) ────────────────────────────────────────────
+// When the runtime runs in secured mode it holds no approval private key — it
+// can VERIFY approvals (public key) but cannot GRANT them. Approval is an
+// out-of-band operator action: `skillfile approve <name>` reads the operator's
+// private key at the terminal and signs. The dashboard is a REVIEW surface, not
+// a SIGNING surface (privilege separation keeps the key off this process).
+
+function securedModeOn() {
+  return state.securedApproval?.enabled === true;
+}
+
+// The exact command an operator runs to approve a skill. Kept in one place so
+// the queue and the detail view stay consistent.
+function approveCommand(name) {
+  return `skillfile approve ${shellQuote(name)}`;
+}
+function shellQuote(s) {
+  return /^[A-Za-z0-9._-]+$/.test(s) ? s : `'${String(s).replace(/'/g, "'\\''")}'`;
+}
+
+function renderSecuredBanner() {
+  const el = document.getElementById("secured-banner");
+  if (!el) return;
+  const sa = state.securedApproval;
+  if (sa?.enabled !== true) { el.innerHTML = ""; return; }
+  if (sa.public_key_present === false) {
+    // Secured but no verifier wired — a misconfiguration: every effectful op is
+    // refused and no approval can verify. Loud, because nothing will run.
+    el.innerHTML = `<div class="banner banner-error">
+      <strong>Secured mode is ON but no approval public key is wired.</strong>
+      Every effectful op is refused and no skill can be approved. Set
+      <code>SKILLSCRIPT_APPROVAL_PUBLIC_KEY_FILE</code> (and provision a keypair)
+      then restart the runtime.
+    </div>`;
+    return;
+  }
+  el.innerHTML = `<div class="banner banner-secured">
+    <strong>🔒 Secured mode</strong> — unapproved skills cannot execute any
+    effectful op. Approval requires the operator's key:
+    <code>skillfile approve &lt;name&gt;</code> at the terminal. The dashboard
+    reviews; it does not sign.
+  </div>`;
+}
+
 // ─── Views ──────────────────────────────────────────────────────────────────
 
+// v1.0 Gate #7 — the approval queue. Surfaces every Draft skill awaiting
+// operator approval, each with a glance of its security signals so the operator
+// can triage WHAT to review before opening the body. The "approve" action is
+// deliberately a copyable command, not a button: signing happens at the
+// terminal where the operator's private key lives, never on this process.
+async function renderApprovals() {
+  const secured = securedModeOn();
+  // The "needs approval" set = every skill the gate refuses (gate_ok === false),
+  // excluding intentionally-retired Disabled skills. That's two cases:
+  //   • Draft skills — never approved.
+  //   • Approved-but-stale — Approved status with a body the gate rejects
+  //     (in secured mode: no/legacy/invalid signature — the v1-migration corpus).
+  // The 30s poll only sees Approved, so the queue queries Draft + Approved
+  // explicitly and filters Approved by gate_ok (now on every skill_list entry).
+  let pending = [];
+  try {
+    const [draftCat, apprCat] = await Promise.all([
+      callTool("skill_list", { filter: { audience: "all", status: "Draft" } }),
+      callTool("skill_list", { filter: { audience: "all", status: "Approved" } }),
+    ]);
+    const flat = (c) => [...(c.receives ?? []), ...(c.skills ?? []), ...(c.headless ?? [])];
+    const drafts = flat(draftCat).map((s) => ({ ...s, _why: "draft" }));
+    const stale = flat(apprCat).filter((s) => s.gate_ok === false).map((s) => ({ ...s, _why: "stale" }));
+    pending = [...drafts, ...stale];
+  } catch (err) {
+    return `<h2>Approvals</h2><section><div class="empty">Failed to load the approval queue: ${esc(err.message)}</div></section>`;
+  }
+  const staleCount = pending.filter((s) => s._why === "stale").length;
+  const intro = secured
+    ? `<p>Secured mode is <strong>ON</strong>. Each skill below is inert — no
+       effectful op will run until it is approved. ${staleCount > 0 ? `${staleCount} carry a stale/legacy approval (e.g. a pre-secured v1 stamp) and need re-signing — the fastest path is <code>skillfile reapprove --apply</code> at a terminal.` : ""}
+       Review the source, then sign at a terminal that can read your approval key.</p>`
+    : `<p>Secured mode is <strong>OFF</strong> — Draft skills can be approved
+       in-page from their detail view (the runtime self-stamps). Turn on secured
+       mode (<code>SKILLSCRIPT_SECURED_MODE=true</code>) to require key-signed
+       approval. The queue below still shows what's pending review.</p>`;
+  if (pending.length === 0) {
+    return `<h2>Approvals</h2><section>${intro}<div class="empty">Nothing awaiting approval — every skill is Approved (and valid) or Disabled.</div></section>`;
+  }
+  // Fetch each skill's source so we can show its security-signal summary inline.
+  // skill_read may fail (load() throws) — degrade that row to "source N/A".
+  const sources = await Promise.all(
+    pending.map((s) => callTool("skill_read", { name: s.name }).then((r) => r?.source ?? null).catch(() => null)),
+  );
+  const rows = pending.map((s, i) => {
+    const src = sources[i];
+    const sig = src ? collectSecuritySignals(src) : null;
+    const sigBadges = sig ? approvalSignalBadges(sig) : `<span class="empty">source N/A</span>`;
+    const whyBadge = s._why === "stale"
+      ? `<span class="badge error" title="Approved status, but the body lacks a valid signature">re-approval needed</span>`
+      : `<span class="badge Draft">Draft</span>`;
+    const cmd = approveCommand(s.name);
+    return `
+      <tr>
+        <td><a href="#skill/${encodeURIComponent(s.name)}"><strong>${esc(s.name)}</strong></a> ${whyBadge}<br>
+            <span style="color:#6c757d;font-size:0.85em;">${esc(s.description ?? "—")}</span></td>
+        <td>${sigBadges}</td>
+        <td>
+          <a href="#skill/${encodeURIComponent(s.name)}">Review →</a>
+          ${secured ? `<div class="approve-cmd"><code>${esc(cmd)}</code><button class="copy-btn" onclick="copyText('${esc(cmd).replace(/'/g, "\\'")}', this)">copy</button></div>` : ""}
+        </td>
+      </tr>`;
+  }).join("");
+  return `
+    <h2>Approvals (${pending.length})</h2>
+    <section>
+      ${intro}
+      <table>
+        <thead><tr><th>Skill</th><th>Security signals</th><th>Action</th></tr></thead>
+        <tbody>${rows}</tbody>
+      </table>
+    </section>
+  `;
+}
+
+// Compact security-signal badges for the queue triage column.
+function approvalSignalBadges(sig) {
+  const b = [];
+  if (sig.writeOps > 0) b.push(`<span class="badge error" title="mutation ops">${sig.writeOps} write</span>`);
+  if (sig.unsafeShell > 0) b.push(`<span class="badge error" title="unsafe bash">${sig.unsafeShell} unsafe</span>`);
+  if (sig.approvedOps > 0) b.push(`<span class="badge error" title="per-op author authorization">${sig.approvedOps} approved=</span>`);
+  if (sig.autonomous) b.push(`<span class="badge error" title="bypasses human-in-loop"># Autonomous</span>`);
+  if (sig.shellOps > 0) b.push(`<span class="badge Draft" title="shell ops${sig.shellBinaries.length ? `: ${sig.shellBinaries.join(", ")}` : ""}">${sig.shellOps} shell</span>`);
+  if (sig.wakeAddresses > 0) b.push(`<span class="badge Draft" title="@session wake">${sig.wakeAddresses} wake</span>`);
+  if (sig.cronTriggers > 0) b.push(`<span class="badge" title="autonomous cron fire">${sig.cronTriggers} cron</span>`);
+  return b.length ? b.join(" ") : `<span class="badge ok">no signals</span>`;
+}
+
+window.copyText = function (text, btn) {
+  const done = () => { if (btn) { const o = btn.textContent; btn.textContent = "copied"; setTimeout(() => { btn.textContent = o; }, 1200); } };
+  if (navigator.clipboard?.writeText) {
+    navigator.clipboard.writeText(text).then(done).catch(() => fallbackCopy(text, done));
+  } else {
+    fallbackCopy(text, done);
+  }
+};
+function fallbackCopy(text, done) {
+  const ta = document.createElement("textarea");
+  ta.value = text; ta.style.position = "fixed"; ta.style.opacity = "0";
+  document.body.appendChild(ta); ta.select();
+  try { document.execCommand("copy"); done(); } catch { /* no-op */ }
+  document.body.removeChild(ta);
+}
+
 function renderOverview() {
   const m = state.metrics;
   const totalFires = m?.totalFires ?? 0;
@@ -198,13 +351,7 @@ async function renderSkillDetail(name) {
         <h2>Status</h2>
         <p>${esc(metadata.description ?? "(no description)")}</p>
         ${approvalBanner}
-        <div style="margin-top: 12px; display: flex; gap: 8px;">
-          ${["Draft", "Approved", "Disabled"].filter((s) => s !== metadata.status || (s === "Approved" && approval && !approval.gate_ok)).map((s) => `
-            <button class="${s === "Disabled" ? "danger" : ""}" onclick="updateStatus('${esc(name)}','${s}')">
-              ${s === "Approved" && metadata.status === "Approved" ? "Re-approve (refresh token)" : `Transition to ${s}`}
-            </button>
-          `).join("")}
-        </div>
+        ${renderStatusActions(name, metadata, approval)}
       </section>
 
       ${source ? renderSecuritySignalsPanel(source) : ""}
@@ -295,6 +442,46 @@ async function renderSkillDetail(name) {
   }
 }
 
+// Status-transition controls for the skill detail view. The subtlety is
+// Approved: in SECURED mode the runtime can't self-stamp (skill_status →
+// Approved throws ApprovalRejectedError — the key lives at the operator's
+// terminal, not on this process), so we surface the `skillfile approve`
+// command instead of a button that would only error. Draft/Disabled never
+// grant effects, so they stay one-click in both modes.
+function renderStatusActions(name, metadata, approval) {
+  const secured = securedModeOn();
+  const status = metadata.status;
+  const staleApproved = status === "Approved" && approval && !approval.gate_ok;
+
+  // Non-approval transitions (revoke / demote) — always plain buttons.
+  const buttons = ["Draft", "Disabled"]
+    .filter((s) => s !== status)
+    .map((s) => `<button class="${s === "Disabled" ? "danger" : ""}" onclick="updateStatus('${esc(name)}','${esc(s)}')">Transition to ${s}</button>`)
+    .join("");
+
+  // The Approved action. Shown when not-yet-Approved OR stale (needs re-stamp).
+  const needsApprove = status !== "Approved" || staleApproved;
+  let approveBlock = "";
+  if (needsApprove) {
+    if (secured) {
+      const cmd = approveCommand(name);
+      approveBlock = `
+        <div class="approve-panel">
+          <div class="approve-panel-head">${staleApproved ? "Re-approve (body changed since signing)" : "Approve this skill"}</div>
+          <p>Secured mode: approval is signed with the operator's key at a terminal — not from this dashboard. Review the source below, then run:</p>
+          <div class="approve-cmd"><code>${esc(cmd)}</code><button class="copy-btn" onclick="copyText('${esc(cmd).replace(/'/g, "\\'")}', this)">copy</button></div>
+        </div>`;
+    } else {
+      approveBlock = `<button onclick="updateStatus('${esc(name)}','Approved')">${staleApproved ? "Re-approve (refresh token)" : "Transition to Approved"}</button>`;
+    }
+  }
+
+  return `<div style="margin-top: 12px; display: flex; gap: 8px; flex-wrap: wrap; align-items: flex-start;">
+    ${buttons}
+    ${!secured ? approveBlock : ""}
+  </div>${secured ? approveBlock : ""}`;
+}
+
 function renderTriggers() {
   return `
     <h2>Triggers</h2>
@@ -787,6 +974,11 @@ async function renderCurrentView() {
   }
 
   currentView = hash;
+  if (hash === "approvals") {
+    main.innerHTML = "Loading…";
+    main.innerHTML = await renderApprovals();
+    return;
+  }
   switch (hash) {
     case "overview":   main.innerHTML = renderOverview(); break;
     case "skills":     main.innerHTML = renderSkills(); break;

package/dist/dashboard/spa/index.html

@@ -12,12 +12,14 @@
       <nav id="nav">
         <a href="#overview">Overview</a>
         <a href="#skills">Skills</a>
+        <a href="#approvals">Approvals</a>
         <a href="#triggers">Triggers</a>
         <a href="#connectors">Connectors</a>
         <a href="#security">Security</a>
       </nav>
       <div id="poll-status" aria-live="polite"></div>
     </header>
+    <div id="secured-banner"></div>
     <main id="main"></main>
     <footer>
       <small>Polling every 30s · localhost-only</small>

package/dist/dashboard/spa/styles.css

@@ -136,3 +136,45 @@ pre.skill-source { white-space: pre-wrap; word-break: break-word; }
   border-left-color: #c4cad0;
 }
 .security-signals small { color: #6c757d; }
+
+/* v1.0 Gate #7 — secured-mode banner + approval queue */
+#secured-banner:empty { display: none; }
+.banner {
+  margin: 0 24px 16px;
+  padding: 10px 14px;
+  border-radius: 6px;
+  font-size: 13px;
+  line-height: 1.5;
+}
+.banner code { background: rgba(0,0,0,0.06); padding: 1px 5px; border-radius: 3px; }
+.banner-secured { background: #eef4ff; border: 1px solid #b9ccf0; color: #1a3a6b; }
+.banner-error   { background: #fdecea; border: 1px solid #f0b4ad; color: #8b1d1d; }
+
+.approve-panel {
+  background: #f6f8fa;
+  border: 1px solid #e6e8eb;
+  border-radius: 6px;
+  padding: 12px 14px;
+  margin-top: 4px;
+  max-width: 640px;
+}
+.approve-panel-head { font-weight: 600; margin-bottom: 4px; }
+.approve-panel p { margin: 4px 0 8px; color: #4a5158; font-size: 0.92em; }
+.approve-cmd {
+  display: flex;
+  align-items: center;
+  gap: 8px;
+  margin-top: 4px;
+}
+.approve-cmd code {
+  background: #1a1d21;
+  color: #e6e8eb;
+  padding: 6px 10px;
+  border-radius: 4px;
+  font-size: 12px;
+  flex: 0 1 auto;
+}
+.copy-btn {
+  font-size: 11px;
+  padding: 4px 8px;
+}

package/dist/errors.d.ts

@@ -35,6 +35,18 @@ export declare class ApprovalRejectedError extends ConnectorError {
     readonly reason: string;
     constructor(skill_name: string, reason: string, implementation: string);
 }
+/**
+ * v1.0 Gate #7 — an effectful op (or output-routing delivery) was reached in
+ * secured mode without an authorized approval. Complete-mediation refusal at
+ * the dispatch choke: the body never passed signature verification (source-mode,
+ * Draft, forged, or unapproved), so it cannot egress or mutate.
+ */
+export declare class SecuredModeEffectError extends Error {
+    readonly opKind: string;
+    readonly target?: string | undefined;
+    readonly remediation: string;
+    constructor(opKind: string, target?: string | undefined, remediation?: string);
+}
 export declare class VersionNotFoundError extends ConnectorError {
     readonly skill_name: string;
     readonly version: string;
@@ -133,6 +145,19 @@ export declare class ShellBinaryNotAllowedError extends OpError {
     readonly allowlist: string[] | undefined;
     constructor(binary: string, allowlist: string[] | undefined, target?: string);
 }
+/**
+ * v1.0 Gate #7 — a file_read/file_write op targeted a path outside the operator's
+ * filesystem allowlist (the third allowlist; mirrors ShellBinaryNotAllowedError).
+ * DEFAULT-DENY: an unset allowlist refuses all file ops. The path is canonicalized
+ * (symlinks + `..` resolved) before the check, so the rejected path is the REAL
+ * resolved one — `allowed/../../etc/key` can't sneak through.
+ */
+export declare class FilePathNotAllowedError extends OpError {
+    readonly opName: "file_read" | "file_write";
+    readonly path: string;
+    readonly allowlist: string[] | undefined;
+    constructor(opName: "file_read" | "file_write", path: string, allowlist: string[] | undefined, target?: string);
+}
 /**
  * A composition reference (`&` data-skill inline, `$ execute_skill`, or
  * `# Templates:` delivery) couldn't be resolved at execute time because

package/dist/errors.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"errors.d.ts","sourceRoot":"","sources":["../src/errors.ts"],"names":[],"mappings":"AAQA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,uBAAuB,CAAC;AAE3D,MAAM,WAAW,cAAc;IAC7B,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;IAChB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,yHAAyH;IACzH,QAAQ,CAAC,EAAE,OAAO,GAAG,SAAS,GAAG,MAAM,CAAC;IACxC,4CAA4C;IAC5C,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,uCAAuC;IACvC,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CAClC;AAED;;;;GAIG;AACH,qBAAa,cAAe,SAAQ,KAAK;aAGrB,cAAc,EAAE,aAAa;aAC7B,cAAc,EAAE,MAAM;gBAFtC,OAAO,EAAE,MAAM,EACC,cAAc,EAAE,aAAa,EAC7B,cAAc,EAAE,MAAM;CAKzC;AAED,qBAAa,kBAAmB,SAAQ,cAAc;aAElC,UAAU,EAAE,MAAM;gBAAlB,UAAU,EAAE,MAAM,EAClC,cAAc,EAAE,MAAM;CAKzB;AAED;;;;;GAKG;AACH,qBAAa,qBAAsB,SAAQ,cAAc;aAErC,UAAU,EAAE,MAAM;aAClB,MAAM,EAAE,MAAM;gBADd,UAAU,EAAE,MAAM,EAClB,MAAM,EAAE,MAAM,EAC9B,cAAc,EAAE,MAAM;CAKzB;AAED,qBAAa,oBAAqB,SAAQ,cAAc;aAEpC,UAAU,EAAE,MAAM;aAClB,OAAO,EAAE,MAAM;gBADf,UAAU,EAAE,MAAM,EAClB,OAAO,EAAE,MAAM,EAC/B,cAAc,EAAE,MAAM;CAKzB;AAED,qBAAa,gBAAiB,SAAQ,cAAc;aAEhC,WAAW,EAAE,cAAc,EAAE;gBAA7B,WAAW,EAAE,cAAc,EAAE,EAC7C,cAAc,EAAE,MAAM;CAMzB;AAED,qBAAa,oBAAqB,SAAQ,cAAc;aAEpC,UAAU,EAAE,MAAM;aAClB,MAAM,EAAE,MAAM;gBADd,UAAU,EAAE,MAAM,EAClB,MAAM,EAAE,MAAM,EAC9B,cAAc,EAAE,MAAM;CAKzB;AAED,qBAAa,UAAW,SAAQ,cAAc;aAK1B,IAAI,CAAC,EAAE,MAAM;gBAH7B,OAAO,EAAE,MAAM,EACf,cAAc,EAAE,aAAa,EAC7B,cAAc,EAAE,MAAM,EACN,IAAI,CAAC,EAAE,MAAM,YAAA;CAKhC;AAED,qBAAa,aAAc,SAAQ,cAAc;aAI7B,IAAI,CAAC,EAAE,MAAM;gBAF7B,OAAO,EAAE,MAAM,EACf,cAAc,EAAE,MAAM,EACN,IAAI,CAAC,EAAE,MAAM,YAAA;CAKhC;AAED,qBAAa,UAAW,SAAQ,cAAc;aAI1B,KAAK,CAAC,EAAE,MAAM;gBAF9B,OAAO,EAAE,MAAM,EACf,cAAc,EAAE,MAAM,EACN,KAAK,CAAC,EAAE,MAAM,YAAA;CAKjC;AAED,qBAAa,YAAa,SAAQ,cAAc;aAI5B,UAAU,EAAE,MAAM;gBAFlC,cAAc,EAAE,aAAa,EAC7B,cAAc,EAAE,MAAM,EACN,UAAU,EAAE,MAAM;CAKrC;AAUD;;;;GAIG;AACH,wBAAgB,SAAS,CAAC,GAAG,EAAE,OAAO,GAAG,MAAM,CAE9C;AAED;;;;;GAKG;AACH,qBAAa,OAAQ,SAAQ,KAAK;aAGd,MAAM,EAAE,MAAM;aACd,WAAW,EAAE,MAAM;aACnB,MAAM,CAAC,EAAE,MAAM;aACf,UAAU,CAAC,EAAE,MAAM;gBAJnC,OAAO,EAAE,MAAM,EACC,MAAM,EAAE,MAAM,EACd,WAAW,EAAE,MAAM,EACnB,MAAM,CAAC,EAAE,MAAM,YAAA,EACf,UAAU,CAAC,EAAE,MAAM,YAAA;CAKtC;AAED,wFAAwF;AACxF,qBAAa,sBAAuB,SAAQ,OAAO;aAE/B,aAAa,EAAE,MAAM;aACrB,aAAa,EAAE,aAAa;gBAD5B,aAAa,EAAE,MAAM,EACrB,aAAa,EAAE,aAAa,EAC5C,MAAM,EAAE,MAAM,EACd,MAAM,CAAC,EAAE,MAAM;IACf;;;;;;OAMG;IACH,cAAc,CAAC,EAAE,MAAM;CAqB1B;AAgBD,uEAAuE;AACvE,qBAAa,cAAe,SAAQ,OAAO;aAEvB,SAAS,EAAE,MAAM;gBAAjB,SAAS,EAAE,MAAM,EACjC,MAAM,EAAE,MAAM,EACd,MAAM,CAAC,EAAE,MAAM;CAUlB;AAGD;;;;;GAKG;AACH,qBAAa,gBAAiB,SAAQ,KAAK;aAEvB,YAAY,EAAE,MAAM;aACpB,MAAM,EAAE,MAAM;gBADd,YAAY,EAAE,MAAM,EACpB,MAAM,EAAE,MAAM;CAUjC;AAED,mHAAmH;AACnH,qBAAa,wBAAyB,SAAQ,OAAO;aAEjC,OAAO,EAAE,MAAM;gBAAf,OAAO,EAAE,MAAM,EAC/B,MAAM,CAAC,EAAE,MAAM;CAWlB;AAED;;;;;;;;GAQG;AACH,qBAAa,0BAA2B,SAAQ,OAAO;aAEnC,MAAM,EAAE,MAAM;aACd,SAAS,EAAE,MAAM,EAAE,GAAG,SAAS;gBAD/B,MAAM,EAAE,MAAM,EACd,SAAS,EAAE,MAAM,EAAE,GAAG,SAAS,EAC/C,MAAM,CAAC,EAAE,MAAM;CAoBlB;AAED;;;;;;;;;;;;;GAaG;AACH,qBAAa,0BAA2B,SAAQ,OAAO;aAEnC,gBAAgB,EAAE,MAAM;aAExB,KAAK,EAAE,QAAQ,GAAG,iBAAiB,GAAG,aAAa;gBAFnD,gBAAgB,EAAE,MAAM,EACxC,MAAM,EAAE,MAAM,EACE,KAAK,EAAE,QAAQ,GAAG,iBAAiB,GAAG,aAAa,EACnE,MAAM,CAAC,EAAE,MAAM;CAclB;AAED,4DAA4D;AAC5D,qBAAa,uBAAwB,SAAQ,OAAO;aAEhC,MAAM,EAAE,MAAM;gBAAd,MAAM,EAAE,MAAM,EAC9B,MAAM,EAAE,MAAM,EACd,MAAM,CAAC,EAAE,MAAM;CAUlB;AAED;;;;;GAKG;AACH,qBAAa,iBAAkB,SAAQ,OAAO;aAE1B,OAAO,EAAE,MAAM;aACf,QAAQ,EAAE,MAAM;aAChB,GAAG,EAAE,MAAM;aACX,GAAG,EAAE,MAAM;gBAHX,OAAO,EAAE,MAAM,EACf,QAAQ,EAAE,MAAM,EAChB,GAAG,EAAE,MAAM,EACX,GAAG,EAAE,MAAM,EAC3B,MAAM,CAAC,EAAE,MAAM;CAclB;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,qBAAa,wBAAyB,SAAQ,OAAO;aAEjC,OAAO,EAAE,YAAY,GAAG,eAAe,GAAG,YAAY;aACtD,MAAM,EAAE,MAAM;aACd,eAAe,EAAE,MAAM,EAAE;gBAFzB,OAAO,EAAE,YAAY,GAAG,eAAe,GAAG,YAAY,EACtD,MAAM,EAAE,MAAM,EACd,eAAe,EAAE,MAAM,EAAE,EACzC,UAAU,EAAE,MAAM,EAClB,MAAM,EAAE,MAAM,EACd,MAAM,CAAC,EAAE,MAAM;CAWlB;AAED;;;;;;;;;;;;GAYG;AACH,qBAAa,sBAAuB,SAAQ,OAAO;aAE/B,eAAe,EAAE,MAAM,EAAE;aACzB,aAAa,EAAE,MAAM,EAAE;aACvB,SAAS,EAAE,MAAM;gBAFjB,eAAe,EAAE,MAAM,EAAE,EACzB,aAAa,EAAE,MAAM,EAAE,EACvB,SAAS,EAAE,MAAM,EACjC,MAAM,CAAC,EAAE,MAAM;CAelB;AAED;;;GAGG;AACH,MAAM,WAAW,eAAe;IAC9B,KAAK,EAAE,MAAM,CAAC;IACd,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,EAAE,MAAM,CAAC;IAChB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB;AAED;;;;;GAKG;AACH,qBAAa,kBAAmB,SAAQ,KAAK;aACf,SAAS,EAAE,MAAM;gBAAjB,SAAS,EAAE,MAAM;CAI9C;AAED;;;;;;GAMG;AACH,qBAAa,uBAAwB,SAAQ,KAAK;aAE9B,SAAS,EAAE,MAAM;aACjB,QAAQ,EAAE,MAAM,EAAE;aAClB,QAAQ,EAAE,MAAM,EAAE;aAClB,OAAO,EAAE,MAAM,EAAE;aACjB,KAAK,EAAE,MAAM,EAAE;gBAJf,SAAS,EAAE,MAAM,EACjB,QAAQ,EAAE,MAAM,EAAE,EAClB,QAAQ,EAAE,MAAM,EAAE,EAClB,OAAO,EAAE,MAAM,EAAE,EACjB,KAAK,EAAE,MAAM,EAAE;CAQlC"}
+{"version":3,"file":"errors.d.ts","sourceRoot":"","sources":["../src/errors.ts"],"names":[],"mappings":"AAQA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,uBAAuB,CAAC;AAE3D,MAAM,WAAW,cAAc;IAC7B,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;IAChB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,yHAAyH;IACzH,QAAQ,CAAC,EAAE,OAAO,GAAG,SAAS,GAAG,MAAM,CAAC;IACxC,4CAA4C;IAC5C,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,uCAAuC;IACvC,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CAClC;AAED;;;;GAIG;AACH,qBAAa,cAAe,SAAQ,KAAK;aAGrB,cAAc,EAAE,aAAa;aAC7B,cAAc,EAAE,MAAM;gBAFtC,OAAO,EAAE,MAAM,EACC,cAAc,EAAE,aAAa,EAC7B,cAAc,EAAE,MAAM;CAKzC;AAED,qBAAa,kBAAmB,SAAQ,cAAc;aAElC,UAAU,EAAE,MAAM;gBAAlB,UAAU,EAAE,MAAM,EAClC,cAAc,EAAE,MAAM;CAKzB;AAED;;;;;GAKG;AACH,qBAAa,qBAAsB,SAAQ,cAAc;aAErC,UAAU,EAAE,MAAM;aAClB,MAAM,EAAE,MAAM;gBADd,UAAU,EAAE,MAAM,EAClB,MAAM,EAAE,MAAM,EAC9B,cAAc,EAAE,MAAM;CAKzB;AAED;;;;;GAKG;AACH,qBAAa,sBAAuB,SAAQ,KAAK;aAE7B,MAAM,EAAE,MAAM;aACd,MAAM,CAAC,EAAE,MAAM;aACf,WAAW,EAAE,MAAM;gBAFnB,MAAM,EAAE,MAAM,EACd,MAAM,CAAC,EAAE,MAAM,YAAA,EACf,WAAW,GAAE,MAA0K;CAO1M;AAED,qBAAa,oBAAqB,SAAQ,cAAc;aAEpC,UAAU,EAAE,MAAM;aAClB,OAAO,EAAE,MAAM;gBADf,UAAU,EAAE,MAAM,EAClB,OAAO,EAAE,MAAM,EAC/B,cAAc,EAAE,MAAM;CAKzB;AAED,qBAAa,gBAAiB,SAAQ,cAAc;aAEhC,WAAW,EAAE,cAAc,EAAE;gBAA7B,WAAW,EAAE,cAAc,EAAE,EAC7C,cAAc,EAAE,MAAM;CAMzB;AAED,qBAAa,oBAAqB,SAAQ,cAAc;aAEpC,UAAU,EAAE,MAAM;aAClB,MAAM,EAAE,MAAM;gBADd,UAAU,EAAE,MAAM,EAClB,MAAM,EAAE,MAAM,EAC9B,cAAc,EAAE,MAAM;CAKzB;AAED,qBAAa,UAAW,SAAQ,cAAc;aAK1B,IAAI,CAAC,EAAE,MAAM;gBAH7B,OAAO,EAAE,MAAM,EACf,cAAc,EAAE,aAAa,EAC7B,cAAc,EAAE,MAAM,EACN,IAAI,CAAC,EAAE,MAAM,YAAA;CAKhC;AAED,qBAAa,aAAc,SAAQ,cAAc;aAI7B,IAAI,CAAC,EAAE,MAAM;gBAF7B,OAAO,EAAE,MAAM,EACf,cAAc,EAAE,MAAM,EACN,IAAI,CAAC,EAAE,MAAM,YAAA;CAKhC;AAED,qBAAa,UAAW,SAAQ,cAAc;aAI1B,KAAK,CAAC,EAAE,MAAM;gBAF9B,OAAO,EAAE,MAAM,EACf,cAAc,EAAE,MAAM,EACN,KAAK,CAAC,EAAE,MAAM,YAAA;CAKjC;AAED,qBAAa,YAAa,SAAQ,cAAc;aAI5B,UAAU,EAAE,MAAM;gBAFlC,cAAc,EAAE,aAAa,EAC7B,cAAc,EAAE,MAAM,EACN,UAAU,EAAE,MAAM;CAKrC;AAUD;;;;GAIG;AACH,wBAAgB,SAAS,CAAC,GAAG,EAAE,OAAO,GAAG,MAAM,CAE9C;AAED;;;;;GAKG;AACH,qBAAa,OAAQ,SAAQ,KAAK;aAGd,MAAM,EAAE,MAAM;aACd,WAAW,EAAE,MAAM;aACnB,MAAM,CAAC,EAAE,MAAM;aACf,UAAU,CAAC,EAAE,MAAM;gBAJnC,OAAO,EAAE,MAAM,EACC,MAAM,EAAE,MAAM,EACd,WAAW,EAAE,MAAM,EACnB,MAAM,CAAC,EAAE,MAAM,YAAA,EACf,UAAU,CAAC,EAAE,MAAM,YAAA;CAKtC;AAED,wFAAwF;AACxF,qBAAa,sBAAuB,SAAQ,OAAO;aAE/B,aAAa,EAAE,MAAM;aACrB,aAAa,EAAE,aAAa;gBAD5B,aAAa,EAAE,MAAM,EACrB,aAAa,EAAE,aAAa,EAC5C,MAAM,EAAE,MAAM,EACd,MAAM,CAAC,EAAE,MAAM;IACf;;;;;;OAMG;IACH,cAAc,CAAC,EAAE,MAAM;CAqB1B;AAgBD,uEAAuE;AACvE,qBAAa,cAAe,SAAQ,OAAO;aAEvB,SAAS,EAAE,MAAM;gBAAjB,SAAS,EAAE,MAAM,EACjC,MAAM,EAAE,MAAM,EACd,MAAM,CAAC,EAAE,MAAM;CAUlB;AAGD;;;;;GAKG;AACH,qBAAa,gBAAiB,SAAQ,KAAK;aAEvB,YAAY,EAAE,MAAM;aACpB,MAAM,EAAE,MAAM;gBADd,YAAY,EAAE,MAAM,EACpB,MAAM,EAAE,MAAM;CAUjC;AAED,mHAAmH;AACnH,qBAAa,wBAAyB,SAAQ,OAAO;aAEjC,OAAO,EAAE,MAAM;gBAAf,OAAO,EAAE,MAAM,EAC/B,MAAM,CAAC,EAAE,MAAM;CAWlB;AAED;;;;;;;;GAQG;AACH,qBAAa,0BAA2B,SAAQ,OAAO;aAEnC,MAAM,EAAE,MAAM;aACd,SAAS,EAAE,MAAM,EAAE,GAAG,SAAS;gBAD/B,MAAM,EAAE,MAAM,EACd,SAAS,EAAE,MAAM,EAAE,GAAG,SAAS,EAC/C,MAAM,CAAC,EAAE,MAAM;CAoBlB;AAED;;;;;;GAMG;AACH,qBAAa,uBAAwB,SAAQ,OAAO;aAEhC,MAAM,EAAE,WAAW,GAAG,YAAY;aAClC,IAAI,EAAE,MAAM;aACZ,SAAS,EAAE,MAAM,EAAE,GAAG,SAAS;gBAF/B,MAAM,EAAE,WAAW,GAAG,YAAY,EAClC,IAAI,EAAE,MAAM,EACZ,SAAS,EAAE,MAAM,EAAE,GAAG,SAAS,EAC/C,MAAM,CAAC,EAAE,MAAM;CAkBlB;AAED;;;;;;;;;;;;;GAaG;AACH,qBAAa,0BAA2B,SAAQ,OAAO;aAEnC,gBAAgB,EAAE,MAAM;aAExB,KAAK,EAAE,QAAQ,GAAG,iBAAiB,GAAG,aAAa;gBAFnD,gBAAgB,EAAE,MAAM,EACxC,MAAM,EAAE,MAAM,EACE,KAAK,EAAE,QAAQ,GAAG,iBAAiB,GAAG,aAAa,EACnE,MAAM,CAAC,EAAE,MAAM;CAclB;AAED,4DAA4D;AAC5D,qBAAa,uBAAwB,SAAQ,OAAO;aAEhC,MAAM,EAAE,MAAM;gBAAd,MAAM,EAAE,MAAM,EAC9B,MAAM,EAAE,MAAM,EACd,MAAM,CAAC,EAAE,MAAM;CAUlB;AAED;;;;;GAKG;AACH,qBAAa,iBAAkB,SAAQ,OAAO;aAE1B,OAAO,EAAE,MAAM;aACf,QAAQ,EAAE,MAAM;aAChB,GAAG,EAAE,MAAM;aACX,GAAG,EAAE,MAAM;gBAHX,OAAO,EAAE,MAAM,EACf,QAAQ,EAAE,MAAM,EAChB,GAAG,EAAE,MAAM,EACX,GAAG,EAAE,MAAM,EAC3B,MAAM,CAAC,EAAE,MAAM;CAclB;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,qBAAa,wBAAyB,SAAQ,OAAO;aAEjC,OAAO,EAAE,YAAY,GAAG,eAAe,GAAG,YAAY;aACtD,MAAM,EAAE,MAAM;aACd,eAAe,EAAE,MAAM,EAAE;gBAFzB,OAAO,EAAE,YAAY,GAAG,eAAe,GAAG,YAAY,EACtD,MAAM,EAAE,MAAM,EACd,eAAe,EAAE,MAAM,EAAE,EACzC,UAAU,EAAE,MAAM,EAClB,MAAM,EAAE,MAAM,EACd,MAAM,CAAC,EAAE,MAAM;CAWlB;AAED;;;;;;;;;;;;GAYG;AACH,qBAAa,sBAAuB,SAAQ,OAAO;aAE/B,eAAe,EAAE,MAAM,EAAE;aACzB,aAAa,EAAE,MAAM,EAAE;aACvB,SAAS,EAAE,MAAM;gBAFjB,eAAe,EAAE,MAAM,EAAE,EACzB,aAAa,EAAE,MAAM,EAAE,EACvB,SAAS,EAAE,MAAM,EACjC,MAAM,CAAC,EAAE,MAAM;CAelB;AAED;;;GAGG;AACH,MAAM,WAAW,eAAe;IAC9B,KAAK,EAAE,MAAM,CAAC;IACd,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,EAAE,MAAM,CAAC;IAChB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB;AAED;;;;;GAKG;AACH,qBAAa,kBAAmB,SAAQ,KAAK;aACf,SAAS,EAAE,MAAM;gBAAjB,SAAS,EAAE,MAAM;CAI9C;AAED;;;;;;GAMG;AACH,qBAAa,uBAAwB,SAAQ,KAAK;aAE9B,SAAS,EAAE,MAAM;aACjB,QAAQ,EAAE,MAAM,EAAE;aAClB,QAAQ,EAAE,MAAM,EAAE;aAClB,OAAO,EAAE,MAAM,EAAE;aACjB,KAAK,EAAE,MAAM,EAAE;gBAJf,SAAS,EAAE,MAAM,EACjB,QAAQ,EAAE,MAAM,EAAE,EAClB,QAAQ,EAAE,MAAM,EAAE,EAClB,OAAO,EAAE,MAAM,EAAE,EACjB,KAAK,EAAE,MAAM,EAAE;CAQlC"}