spidersan 0.10.0 → 0.20.2

package/dist/lib/notify.d.ts

@@ -0,0 +1,68 @@
+/**
+ * notify — the delivery seam for git-watch alerts.
+ *
+ * Every alert in git-events-subscriber.ts used to inline its own transport:
+ * `execFile('envoak', ['hive','signal',...], cb)` with the callback discarding
+ * the result. When `envoak hive signal` was removed (Envoak#148, ADR-0002) all
+ * five sites died at once, and because no site inspected its own result the
+ * daemon went on logging success for a month (sp-8iqm).
+ *
+ * So the transport lives behind one interface, and that interface returns a
+ * RESULT rather than swallowing it. A caller cannot accidentally claim success:
+ * there is a value it has to look at.
+ *
+ * Adapters are selected by env, so swapping transports is config, not code:
+ *   SPIDERSAN_ROOM_TOKEN — post to a toak.me room (POST /api/chat/send).
+ *                          Name matches the vault secret toak/SPIDERSAN_ROOM_TOKEN,
+ *                          so `envoak vault inject` supplies it directly.
+ *   unset            — nullNotifier: reports undelivered, never pretends
+ */
+export type Delivered = {
+    ok: true;
+} | {
+    ok: false;
+    reason: string;
+};
+export interface NotifyEvent {
+    repo: string;
+    branch: string;
+    /** Conflict tier. Callers gate on this themselves — policy is not ours. */
+    tier: number;
+    /** Human-readable line. May be LLM-generated — never key off this. */
+    message: string;
+    /**
+     * Stable identity of the underlying event, for deduplication. MUST be
+     * built only from deterministic facts (repo, branch, sha, action) — the
+     * tier>=2 path escalates to an LLM, so `message` differs between two
+     * deliveries of the same event and cannot be used here.
+     */
+    dedupe: string;
+    /** GitHub login or agent that triggered it, when known. */
+    agent?: string;
+    files?: string[];
+    /** Extra fields passed through to the room as structured metadata. */
+    details?: Record<string, unknown>;
+}
+/**
+ * A transport. One function — nothing here needs a class.
+ *
+ * CONTRACT: a Notifier MUST NOT throw. It reports failure by returning
+ * `{ok:false, reason}`. Call sites sit inside `catch` blocks that swallow
+ * AI-layer errors, so a thrown transport error would be misread as an AI
+ * failure and vanish — the same silence this module exists to remove.
+ */
+export type Notifier = (event: NotifyEvent) => Promise<Delivered>;
+/** Post to a toak.me room. The room join token is a read+write secret. */
+export declare function toakRoomNotifier(token: string, fetchImpl?: typeof fetch): Notifier;
+/**
+ * No transport configured. Reports undelivered rather than pretending — the
+ * whole point of sp-8iqm is that a severed channel must be visible.
+ */
+export declare const nullNotifier: Notifier;
+export declare function createNotifier(): Notifier;
+/**
+ * Deliver, then log the real outcome. This is the ONLY place allowed to say a
+ * notification was sent, and it says so only after looking at the result.
+ */
+export declare function deliver(notifier: Notifier, event: NotifyEvent, log: (m: string) => void): Promise<Delivered>;
+//# sourceMappingURL=notify.d.ts.map

package/dist/lib/notify.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"notify.d.ts","sourceRoot":"","sources":["../../src/lib/notify.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAKH,MAAM,MAAM,SAAS,GAAG;IAAE,EAAE,EAAE,IAAI,CAAA;CAAE,GAAG;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAAC;AAErE,MAAM,WAAW,WAAW;IACxB,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,MAAM,CAAC;IACf,2EAA2E;IAC3E,IAAI,EAAE,MAAM,CAAC;IACb,sEAAsE;IACtE,OAAO,EAAE,MAAM,CAAC;IAChB;;;;;OAKG;IACH,MAAM,EAAE,MAAM,CAAC;IACf,2DAA2D;IAC3D,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,KAAK,CAAC,EAAE,MAAM,EAAE,CAAC;IACjB,sEAAsE;IACtE,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACrC;AAED;;;;;;;GAOG;AACH,MAAM,MAAM,QAAQ,GAAG,CAAC,KAAK,EAAE,WAAW,KAAK,OAAO,CAAC,SAAS,CAAC,CAAC;AAmClE,0EAA0E;AAC1E,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,MAAM,EAAE,SAAS,GAAE,OAAO,KAAa,GAAG,QAAQ,CAiCzF;AAED;;;GAGG;AACH,eAAO,MAAM,YAAY,EAAE,QAGzB,CAAC;AAEH,wBAAgB,cAAc,IAAI,QAAQ,CAGzC;AAED;;;GAGG;AACH,wBAAsB,OAAO,CACzB,QAAQ,EAAE,QAAQ,EAClB,KAAK,EAAE,WAAW,EAClB,GAAG,EAAE,CAAC,CAAC,EAAE,MAAM,KAAK,IAAI,GACzB,OAAO,CAAC,SAAS,CAAC,CAKpB"}

package/dist/lib/notify.js

@@ -0,0 +1,111 @@
+/**
+ * notify — the delivery seam for git-watch alerts.
+ *
+ * Every alert in git-events-subscriber.ts used to inline its own transport:
+ * `execFile('envoak', ['hive','signal',...], cb)` with the callback discarding
+ * the result. When `envoak hive signal` was removed (Envoak#148, ADR-0002) all
+ * five sites died at once, and because no site inspected its own result the
+ * daemon went on logging success for a month (sp-8iqm).
+ *
+ * So the transport lives behind one interface, and that interface returns a
+ * RESULT rather than swallowing it. A caller cannot accidentally claim success:
+ * there is a value it has to look at.
+ *
+ * Adapters are selected by env, so swapping transports is config, not code:
+ *   SPIDERSAN_ROOM_TOKEN — post to a toak.me room (POST /api/chat/send).
+ *                          Name matches the vault secret toak/SPIDERSAN_ROOM_TOKEN,
+ *                          so `envoak vault inject` supplies it directly.
+ *   unset            — nullNotifier: reports undelivered, never pretends
+ */
+import { createHash } from 'crypto';
+import { hostname } from 'os';
+const TOAK_URL = process.env.TOAK_CHAT_URL || 'https://toak.me/api/chat/send';
+// Bare name, no `agent:` prefix. Room allowlists match the sender string
+// EXACTLY — the `agent:<id>` form in toak's send route governs verification
+// upgrade, not allowlist matching, and conflating the two means an approved
+// `spidersan` would not admit a sender of `agent:spidersan`. The machine goes
+// in metadata instead, so one approval covers every host.
+const SENDER = process.env.SPIDERSAN_AGENT || 'spidersan';
+const MACHINE = process.env.TREEBIRD_MACHINE || hostname();
+/**
+ * Stable per event, so a catch-up poll that replays an event minutes later
+ * does not post it twice. The server's own default is a ~5s time bucket, far
+ * shorter than our reconnect window.
+ */
+function idempotencyKey(e) {
+    return createHash('sha256')
+        .update([e.repo, e.branch, e.tier, e.dedupe].join(' '))
+        .digest('hex');
+}
+/**
+ * The original emits were fire-and-forget with `{ timeout: 10000 }`. These are
+ * awaited inside the event handlers, so an unbounded fetch would stall the
+ * handler and queue every event behind it. Same budget as before.
+ */
+const TIMEOUT_MS = 10_000;
+function format(e) {
+    const who = e.agent ? ` by ${e.agent}` : '';
+    const files = e.files?.length ? `\nfiles: ${e.files.slice(0, 10).join(', ')}` : '';
+    return `TIER ${e.tier} conflict - ${e.repo}/${e.branch}${who}\n${e.message}${files}`;
+}
+/** Post to a toak.me room. The room join token is a read+write secret. */
+export function toakRoomNotifier(token, fetchImpl = fetch) {
+    return async (event) => {
+        try {
+            const res = await fetchImpl(TOAK_URL, {
+                method: 'POST',
+                headers: { 'Content-Type': 'application/json' },
+                signal: AbortSignal.timeout(TIMEOUT_MS),
+                body: JSON.stringify({
+                    token,
+                    sender: SENDER,
+                    content: format(event),
+                    idempotency_key: idempotencyKey(event),
+                    metadata: {
+                        machine: MACHINE,
+                        repo: event.repo,
+                        branch: event.branch,
+                        tier: event.tier,
+                        agent: event.agent,
+                        files: event.files,
+                        ...event.details,
+                    },
+                }),
+            });
+            // The POST response IS the call-time liveness check — no probe needed.
+            if (!res.ok) {
+                const body = await res.text().catch(() => '');
+                return { ok: false, reason: `${res.status} ${body.slice(0, 120)}`.trim() };
+            }
+            return { ok: true };
+        }
+        catch (err) {
+            return { ok: false, reason: err instanceof Error ? err.message : String(err) };
+        }
+    };
+}
+/**
+ * No transport configured. Reports undelivered rather than pretending — the
+ * whole point of sp-8iqm is that a severed channel must be visible.
+ */
+export const nullNotifier = async () => ({
+    ok: false,
+    reason: 'no transport configured (set SPIDERSAN_ROOM_TOKEN)',
+});
+export function createNotifier() {
+    const token = process.env.SPIDERSAN_ROOM_TOKEN;
+    return token ? toakRoomNotifier(token) : nullNotifier;
+}
+/**
+ * Deliver, then log the real outcome. This is the ONLY place allowed to say a
+ * notification was sent, and it says so only after looking at the result.
+ */
+export async function deliver(notifier, event, log) {
+    const result = await notifier(event);
+    if (result.ok)
+        log(`notified: TIER ${event.tier} ${event.repo}/${event.branch}`);
+    else
+        log(`NOT NOTIFIED (TIER ${event.tier} ${event.repo}/${event.branch}): ${result.reason}`);
+    return result;
+}
+//# sourceMappingURL=notify.js.map

package/dist/lib/notify.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"notify.js","sourceRoot":"","sources":["../../src/lib/notify.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAEH,OAAO,EAAE,UAAU,EAAE,MAAM,QAAQ,CAAC;AACpC,OAAO,EAAE,QAAQ,EAAE,MAAM,IAAI,CAAC;AAmC9B,MAAM,QAAQ,GAAG,OAAO,CAAC,GAAG,CAAC,aAAa,IAAI,+BAA+B,CAAC;AAC9E,yEAAyE;AACzE,4EAA4E;AAC5E,4EAA4E;AAC5E,8EAA8E;AAC9E,0DAA0D;AAC1D,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,eAAe,IAAI,WAAW,CAAC;AAC1D,MAAM,OAAO,GAAG,OAAO,CAAC,GAAG,CAAC,gBAAgB,IAAI,QAAQ,EAAE,CAAC;AAE3D;;;;GAIG;AACH,SAAS,cAAc,CAAC,CAAc;IAClC,OAAO,UAAU,CAAC,QAAQ,CAAC;SACtB,MAAM,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;SACtD,MAAM,CAAC,KAAK,CAAC,CAAC;AACvB,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,GAAG,MAAM,CAAC;AAE1B,SAAS,MAAM,CAAC,CAAc;IAC1B,MAAM,GAAG,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;IAC5C,MAAM,KAAK,GAAG,CAAC,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;IACnF,OAAO,QAAQ,CAAC,CAAC,IAAI,eAAe,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC,MAAM,GAAG,GAAG,KAAK,CAAC,CAAC,OAAO,GAAG,KAAK,EAAE,CAAC;AACzF,CAAC;AAED,0EAA0E;AAC1E,MAAM,UAAU,gBAAgB,CAAC,KAAa,EAAE,YAA0B,KAAK;IAC3E,OAAO,KAAK,EAAE,KAAK,EAAE,EAAE;QACnB,IAAI,CAAC;YACD,MAAM,GAAG,GAAG,MAAM,SAAS,CAAC,QAAQ,EAAE;gBAClC,MAAM,EAAE,MAAM;gBACd,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;gBAC/C,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,UAAU,CAAC;gBACvC,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC;oBACjB,KAAK;oBACL,MAAM,EAAE,MAAM;oBACd,OAAO,EAAE,MAAM,CAAC,KAAK,CAAC;oBACtB,eAAe,EAAE,cAAc,CAAC,KAAK,CAAC;oBACtC,QAAQ,EAAE;wBACN,OAAO,EAAE,OAAO;wBAChB,IAAI,EAAE,KAAK,CAAC,IAAI;wBAChB,MAAM,EAAE,KAAK,CAAC,MAAM;wBACpB,IAAI,EAAE,KAAK,CAAC,IAAI;wBAChB,KAAK,EAAE,KAAK,CAAC,KAAK;wBAClB,KAAK,EAAE,KAAK,CAAC,KAAK;wBAClB,GAAG,KAAK,CAAC,OAAO;qBACnB;iBACJ,CAAC;aACL,CAAC,CAAC;YACH,uEAAuE;YACvE,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;gBACV,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC,CAAC;gBAC9C,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,GAAG,CAAC,MAAM,IAAI,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC;YAC/E,CAAC;YACD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC;QACxB,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACX,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC;QACnF,CAAC;IACL,CAAC,CAAC;AACN,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,MAAM,YAAY,GAAa,KAAK,IAAI,EAAE,CAAC,CAAC;IAC/C,EAAE,EAAE,KAAK;IACT,MAAM,EAAE,oDAAoD;CAC/D,CAAC,CAAC;AAEH,MAAM,UAAU,cAAc;IAC1B,MAAM,KAAK,GAAG,OAAO,CAAC,GAAG,CAAC,oBAAoB,CAAC;IAC/C,OAAO,KAAK,CAAC,CAAC,CAAC,gBAAgB,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,YAAY,CAAC;AAC1D,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,OAAO,CACzB,QAAkB,EAClB,KAAkB,EAClB,GAAwB;IAExB,MAAM,MAAM,GAAG,MAAM,QAAQ,CAAC,KAAK,CAAC,CAAC;IACrC,IAAI,MAAM,CAAC,EAAE;QAAE,GAAG,CAAC,kBAAkB,KAAK,CAAC,IAAI,IAAI,KAAK,CAAC,IAAI,IAAI,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC;;QAC5E,GAAG,CAAC,sBAAsB,KAAK,CAAC,IAAI,IAAI,KAAK,CAAC,IAAI,IAAI,KAAK,CAAC,MAAM,MAAM,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC;IAC9F,OAAO,MAAM,CAAC;AAClB,CAAC"}

package/dist/lib/outline.d.ts

@@ -0,0 +1,6 @@
+import { type SymbolConflict, type SymbolInfo } from './ast.js';
+/** ext includes the dot, e.g. '.py'. Only function/class/method symbols are kept. */
+export declare function outlineSymbols(content: string, ext: string): SymbolInfo[] | null;
+/** Same contract as ASTParser.findSymbolConflicts, for any language ast-grep outlines. null = unavailable. */
+export declare function findOutlineConflicts(ext: string, contentA: string, labelA: string, contentB: string, labelB: string, baseContent?: string): SymbolConflict[] | null;
+//# sourceMappingURL=outline.d.ts.map

package/dist/lib/outline.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"outline.d.ts","sourceRoot":"","sources":["../../src/lib/outline.ts"],"names":[],"mappings":"AAUA,OAAO,EAAkB,KAAK,cAAc,EAAE,KAAK,UAAU,EAAE,MAAM,UAAU,CAAC;AAShF,qFAAqF;AACrF,wBAAgB,cAAc,CAAC,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,UAAU,EAAE,GAAG,IAAI,CAiChF;AAED,8GAA8G;AAC9G,wBAAgB,oBAAoB,CAChC,GAAG,EAAE,MAAM,EACX,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAChC,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAChC,WAAW,CAAC,EAAE,MAAM,GACrB,cAAc,EAAE,GAAG,IAAI,CAMzB"}

package/dist/lib/outline.js

@@ -0,0 +1,60 @@
+/**
+ * outline.ts — spike: symbol extraction for non-TS languages via `ast-grep outline`.
+ *
+ * Optional: needs the `ast-grep` binary on PATH. Returns null when it is missing
+ * or fails, so callers can skip (never conclude "no conflicts" from null).
+ */
+import { execFileSync } from 'child_process';
+import { mkdtempSync, writeFileSync, rmSync } from 'fs';
+import { tmpdir } from 'os';
+import { join } from 'path';
+import { compareSymbols } from './ast.js';
+/** ext includes the dot, e.g. '.py'. Only function/class/method symbols are kept. */
+export function outlineSymbols(content, ext) {
+    const dir = mkdtempSync(join(tmpdir(), 'spidersan-outline-'));
+    try {
+        const file = join(dir, `f${ext}`);
+        writeFileSync(file, content);
+        const out = execFileSync('ast-grep', ['outline', '--json=compact', file], {
+            encoding: 'utf-8', stdio: ['ignore', 'pipe', 'ignore'],
+        });
+        const files = JSON.parse(out);
+        // `[]` = ast-grep doesn't know this file type; that is "unknown", not "no symbols"
+        if (!Array.isArray(files) || files.length === 0)
+            return null;
+        const items = files[0].items ?? [];
+        const bytes = Buffer.from(content);
+        const symbols = [];
+        const add = (it, parent) => {
+            const type = it.symbolType;
+            if (type !== 'function' && type !== 'class' && type !== 'method')
+                return;
+            symbols.push({
+                name: it.name, type,
+                startLine: it.range.start.line + 1, endLine: it.range.end.line + 1,
+                ...(parent ? { parent } : {}),
+                // byteOffset, not line slicing: exact text of the symbol
+                content: bytes.subarray(it.range.byteOffset.start, it.range.byteOffset.end).toString('utf-8'),
+            });
+            it.members?.forEach(m => add(m, it.name));
+        };
+        items.forEach(it => add(it));
+        return symbols;
+    }
+    catch {
+        return null;
+    }
+    finally {
+        rmSync(dir, { recursive: true, force: true });
+    }
+}
+/** Same contract as ASTParser.findSymbolConflicts, for any language ast-grep outlines. null = unavailable. */
+export function findOutlineConflicts(ext, contentA, labelA, contentB, labelB, baseContent) {
+    const a = outlineSymbols(contentA, ext);
+    const b = outlineSymbols(contentB, ext);
+    const base = baseContent === undefined ? undefined : outlineSymbols(baseContent, ext);
+    if (!a || !b || base === null)
+        return null;
+    return compareSymbols(a, labelA, b, labelB, base);
+}
+//# sourceMappingURL=outline.js.map

package/dist/lib/outline.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"outline.js","sourceRoot":"","sources":["../../src/lib/outline.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AACH,OAAO,EAAE,YAAY,EAAE,MAAM,eAAe,CAAC;AAC7C,OAAO,EAAE,WAAW,EAAE,aAAa,EAAE,MAAM,EAAE,MAAM,IAAI,CAAC;AACxD,OAAO,EAAE,MAAM,EAAE,MAAM,IAAI,CAAC;AAC5B,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAC5B,OAAO,EAAE,cAAc,EAAwC,MAAM,UAAU,CAAC;AAShF,qFAAqF;AACrF,MAAM,UAAU,cAAc,CAAC,OAAe,EAAE,GAAW;IACvD,MAAM,GAAG,GAAG,WAAW,CAAC,IAAI,CAAC,MAAM,EAAE,EAAE,oBAAoB,CAAC,CAAC,CAAC;IAC9D,IAAI,CAAC;QACD,MAAM,IAAI,GAAG,IAAI,CAAC,GAAG,EAAE,IAAI,GAAG,EAAE,CAAC,CAAC;QAClC,aAAa,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;QAC7B,MAAM,GAAG,GAAG,YAAY,CAAC,UAAU,EAAE,CAAC,SAAS,EAAE,gBAAgB,EAAE,IAAI,CAAC,EAAE;YACtE,QAAQ,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,QAAQ,CAAC;SACzD,CAAC,CAAC;QACH,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QAC9B,mFAAmF;QACnF,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,IAAI,CAAC;QAC7D,MAAM,KAAK,GAAkB,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC;QAClD,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QACnC,MAAM,OAAO,GAAiB,EAAE,CAAC;QACjC,MAAM,GAAG,GAAG,CAAC,EAAe,EAAE,MAAe,EAAE,EAAE;YAC7C,MAAM,IAAI,GAAG,EAAE,CAAC,UAAgC,CAAC;YACjD,IAAI,IAAI,KAAK,UAAU,IAAI,IAAI,KAAK,OAAO,IAAI,IAAI,KAAK,QAAQ;gBAAE,OAAO;YACzE,OAAO,CAAC,IAAI,CAAC;gBACT,IAAI,EAAE,EAAE,CAAC,IAAI,EAAE,IAAI;gBACnB,SAAS,EAAE,EAAE,CAAC,KAAK,CAAC,KAAK,CAAC,IAAI,GAAG,CAAC,EAAE,OAAO,EAAE,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,GAAG,CAAC;gBAClE,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBAC7B,yDAAyD;gBACzD,OAAO,EAAE,KAAK,CAAC,QAAQ,CAAC,EAAE,CAAC,KAAK,CAAC,UAAU,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC;aAChG,CAAC,CAAC;YACH,EAAE,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC,GAAG,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC;QAC9C,CAAC,CAAC;QACF,KAAK,CAAC,OAAO,CAAC,EAAE,CAAC,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC;QAC7B,OAAO,OAAO,CAAC;IACnB,CAAC;IAAC,MAAM,CAAC;QACL,OAAO,IAAI,CAAC;IAChB,CAAC;YAAS,CAAC;QACP,MAAM,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;IAClD,CAAC;AACL,CAAC;AAED,8GAA8G;AAC9G,MAAM,UAAU,oBAAoB,CAChC,GAAW,EACX,QAAgB,EAAE,MAAc,EAChC,QAAgB,EAAE,MAAc,EAChC,WAAoB;IAEpB,MAAM,CAAC,GAAG,cAAc,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAC;IACxC,MAAM,CAAC,GAAG,cAAc,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAC;IACxC,MAAM,IAAI,GAAG,WAAW,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,cAAc,CAAC,WAAW,EAAE,GAAG,CAAC,CAAC;IACtF,IAAI,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,IAAI,KAAK,IAAI;QAAE,OAAO,IAAI,CAAC;IAC3C,OAAO,cAAc,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,MAAM,EAAE,IAAI,CAAC,CAAC;AACtD,CAAC"}

package/dist/lib/push-registry.d.ts

@@ -0,0 +1,22 @@
+/**
+ * Pushed-branch rows in spider_registries — the reader side.
+ *
+ * The `spidersan-webhook` edge function (treebird repo) registers every branch pushed
+ * to a watched repo, whoever pushed it (Codex, Copilot, a cloud agent, the web editor,
+ * a person), under one virtual machine, `github-push`. The write stays server-side:
+ * GitHub's HMAC proves the event and the service key never leaves Supabase.
+ *
+ * Such a row is shadowed — dropped on read — whenever a real machine has the same
+ * branch, so a branch registered by the machine that pushed it never shows twice or
+ * conflicts with itself (see dropShadowedPushRows).
+ */
+import type { MachineRegistryView } from '../types/cloud.js';
+export declare const PUSH_MACHINE_ID = "github-push";
+/**
+ * Drop pushed-branch rows a real registration already covers. Applied on every read
+ * (pull) BEFORE the caller's own machine is excluded, so a branch the caller itself
+ * registered doesn't come back as "github/<branch>" and conflict with itself.
+ * `ownBranches` covers the race where the webhook beats the pusher's own registry-sync.
+ */
+export declare function dropShadowedPushRows(views: MachineRegistryView[], ownBranches?: Iterable<string>): MachineRegistryView[];
+//# sourceMappingURL=push-registry.d.ts.map

package/dist/lib/push-registry.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"push-registry.d.ts","sourceRoot":"","sources":["../../src/lib/push-registry.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AACH,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,mBAAmB,CAAC;AAE7D,eAAO,MAAM,eAAe,gBAAgB,CAAC;AAE7C;;;;;GAKG;AACH,wBAAgB,oBAAoB,CAAC,KAAK,EAAE,mBAAmB,EAAE,EAAE,WAAW,GAAE,QAAQ,CAAC,MAAM,CAAM,GAAG,mBAAmB,EAAE,CAS5H"}

package/dist/lib/push-registry.js

@@ -0,0 +1,21 @@
+export const PUSH_MACHINE_ID = 'github-push';
+/**
+ * Drop pushed-branch rows a real registration already covers. Applied on every read
+ * (pull) BEFORE the caller's own machine is excluded, so a branch the caller itself
+ * registered doesn't come back as "github/<branch>" and conflict with itself.
+ * `ownBranches` covers the race where the webhook beats the pusher's own registry-sync.
+ */
+export function dropShadowedPushRows(views, ownBranches = []) {
+    const covered = new Set(ownBranches);
+    for (const v of views) {
+        if (v.machine_id === PUSH_MACHINE_ID)
+            continue;
+        for (const b of v.branches)
+            if (b.status === 'active')
+                covered.add(b.name);
+    }
+    return views
+        .map(v => v.machine_id !== PUSH_MACHINE_ID ? v : { ...v, branches: v.branches.filter(b => !covered.has(b.name)) })
+        .filter(v => v.machine_id !== PUSH_MACHINE_ID || v.branches.length > 0);
+}
+//# sourceMappingURL=push-registry.js.map

package/dist/lib/push-registry.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"push-registry.js","sourceRoot":"","sources":["../../src/lib/push-registry.ts"],"names":[],"mappings":"AAcA,MAAM,CAAC,MAAM,eAAe,GAAG,aAAa,CAAC;AAE7C;;;;;GAKG;AACH,MAAM,UAAU,oBAAoB,CAAC,KAA4B,EAAE,cAAgC,EAAE;IACjG,MAAM,OAAO,GAAG,IAAI,GAAG,CAAS,WAAW,CAAC,CAAC;IAC7C,KAAK,MAAM,CAAC,IAAI,KAAK,EAAE,CAAC;QACpB,IAAI,CAAC,CAAC,UAAU,KAAK,eAAe;YAAE,SAAS;QAC/C,KAAK,MAAM,CAAC,IAAI,CAAC,CAAC,QAAQ;YAAE,IAAI,CAAC,CAAC,MAAM,KAAK,QAAQ;gBAAE,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;IAC/E,CAAC;IACD,OAAO,KAAK;SACP,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,UAAU,KAAK,eAAe,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,EAAE,CAAC;SACjH,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,UAAU,KAAK,eAAe,IAAI,CAAC,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;AAChF,CAAC"}

package/dist/lib/reconcile.d.ts

@@ -0,0 +1,100 @@
+/**
+ * Reconcile-on-read (tb-8sa.1 step 2)
+ *
+ * The registry's `status` field is only as fresh as the last `spidersan merged`
+ * / `sync` call — and a committed registry snapshot can carry an `active` entry
+ * for a branch that has since merged. Trusting that stale status is what
+ * produced the phantom-conflict incident (a fully-merged branch still flagged
+ * as conflicting from a stale worktree).
+ *
+ * Reconcile-on-read folds git truth in BEFORE conflicts / ready-check /
+ * merge-order answer:
+ *   - ref gone from local AND remote           → orphaned (drop)
+ *   - tip is an ancestor of trunk              → merged   (drop)
+ *   - trunk has a patch-id-equivalent squash   → merged   (drop, tb-tr1z)
+ *   - otherwise                                 → live    (keep)
+ *
+ * It only consults git for entries the registry still calls `active`; entries
+ * already marked `completed` / `abandoned` are honoured without a git probe.
+ */
+import type { Branch } from '../storage/adapter.js';
+export interface ReconcileResult {
+    /** Branches still genuinely in flight — the set readers should act on. */
+    live: Branch[];
+    /** Names detected as merged into trunk (by status or by is-ancestor). */
+    merged: string[];
+    /** Names whose ref is gone from both local and remote. */
+    orphaned: string[];
+}
+/**
+ * Injectable git probes so reconcile is unit-testable without a real repo.
+ * Defaults wire to the real `git.ts` helpers via {@link defaultReconcileDeps}.
+ */
+export interface ReconcileDeps {
+    /** Resolve a branch name to a usable ref, or `null` if no ref exists. */
+    resolveRef: (name: string) => string | null;
+    /**
+     * Resolve the LOCAL ref (`refs/heads/<name>`), or `null` if none. When the
+     * primary ref is the remote-tracking one, a stale `origin/<name>` can be an
+     * ancestor of trunk while fresh unpushed local commits are not — both must
+     * be merged before the branch is reconciled away. Optional for injectors.
+     */
+    resolveLocalRef?: (name: string) => string | null;
+    /** True if `ref` is fully merged into `trunkRef`. */
+    isMerged: (ref: string, trunkRef: string) => boolean;
+    /**
+     * True if `ref`'s content landed in trunk via a SQUASH merge (tb-tr1z) —
+     * consulted only when `isMerged` says no, since squash merges never make
+     * the tip an ancestor. Optional for injectors.
+     */
+    isSquashMerged?: (ref: string, trunkRef: string) => boolean;
+    /**
+     * Branch names that exist on the remote now, or `null` if it can't be asked.
+     * {@link activeBranches} drops an orphan only when this confirms it is gone.
+     * Absent (injectors) behaves like `null`: orphans are kept.
+     */
+    remoteHeads?: () => Set<string> | null;
+    /** Bare trunk branch name (e.g. `main`) — never reconciled away. */
+    trunkName: string;
+    /** Ref used as the merge target for is-ancestor (prefers `origin/main`). */
+    trunkRef: string;
+}
+export declare function defaultReconcileDeps(): ReconcileDeps;
+/**
+ * Partition registered branches into live / merged / orphaned using git truth.
+ *
+ * @param branches  the raw registry entries (e.g. `await storage.list()`)
+ * @param deps      git probes; defaults to the real repo
+ */
+export declare function reconcileBranches(branches: Branch[], deps?: ReconcileDeps): ReconcileResult;
+/**
+ * Read-path convenience for conflict detection: registered `active` branches
+ * minus those PROVEN merged into trunk (is-ancestor / squash-equivalent, or
+ * status `completed`) and those PROVEN deleted.
+ *
+ * An orphan (no local or tracking ref) is ambiguous: deleted, or live on
+ * another machine and never fetched here. A squash-merged, deleted branch is
+ * never an ancestor of trunk, so it only ever reads as orphaned — keeping every
+ * orphan made those phantom-conflict forever. So an orphan is dropped only when
+ * `git ls-remote` confirms the branch is gone from the remote; if the remote
+ * can't be asked, orphans are kept (a phantom beats a missed conflict). This
+ * matters most for ready-check, which gets no cross-machine registry pull.
+ *
+ * Read-side filter only — nothing is deleted. This is what conflicts /
+ * ready-check / merge-order should call; `sync` uses {@link reconcileBranches}
+ * directly to actually prune merged and orphaned entries.
+ */
+export declare function activeBranches(branches: Branch[], deps?: ReconcileDeps): Branch[];
+/**
+ * Split orphans (no local or tracking ref) into those the remote confirms are
+ * `gone` and those to `kept` — still on the remote (unfetched here), or every
+ * one of them when the remote can't be asked (`remoteChecked: false`). Shared by
+ * {@link activeBranches} (read side) and `sync` (which deletes `gone` only, sp-slemub).
+ * Only hits the network when there is an orphan to decide.
+ */
+export declare function splitOrphans(orphaned: string[], deps?: Pick<ReconcileDeps, 'remoteHeads'>): {
+    gone: string[];
+    kept: string[];
+    remoteChecked: boolean;
+};
+//# sourceMappingURL=reconcile.d.ts.map

package/dist/lib/reconcile.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"reconcile.d.ts","sourceRoot":"","sources":["../../src/lib/reconcile.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAIH,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,uBAAuB,CAAC;AAEpD,MAAM,WAAW,eAAe;IAC5B,0EAA0E;IAC1E,IAAI,EAAE,MAAM,EAAE,CAAC;IACf,yEAAyE;IACzE,MAAM,EAAE,MAAM,EAAE,CAAC;IACjB,0DAA0D;IAC1D,QAAQ,EAAE,MAAM,EAAE,CAAC;CACtB;AAED;;;GAGG;AACH,MAAM,WAAW,aAAa;IAC1B,yEAAyE;IACzE,UAAU,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,MAAM,GAAG,IAAI,CAAC;IAC5C;;;;;OAKG;IACH,eAAe,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,MAAM,GAAG,IAAI,CAAC;IAClD,qDAAqD;IACrD,QAAQ,EAAE,CAAC,GAAG,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,KAAK,OAAO,CAAC;IACrD;;;;OAIG;IACH,cAAc,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,KAAK,OAAO,CAAC;IAC5D;;;;OAIG;IACH,WAAW,CAAC,EAAE,MAAM,GAAG,CAAC,MAAM,CAAC,GAAG,IAAI,CAAC;IACvC,oEAAoE;IACpE,SAAS,EAAE,MAAM,CAAC;IAClB,4EAA4E;IAC5E,QAAQ,EAAE,MAAM,CAAC;CACpB;AAED,wBAAgB,oBAAoB,IAAI,aAAa,CAapD;AAED;;;;;GAKG;AACH,wBAAgB,iBAAiB,CAC7B,QAAQ,EAAE,MAAM,EAAE,EAClB,IAAI,GAAE,aAAsC,GAC7C,eAAe,CA+CjB;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAgB,cAAc,CAAC,QAAQ,EAAE,MAAM,EAAE,EAAE,IAAI,GAAE,aAAsC,GAAG,MAAM,EAAE,CAIzG;AAED;;;;;;GAMG;AACH,wBAAgB,YAAY,CACxB,QAAQ,EAAE,MAAM,EAAE,EAClB,IAAI,GAAE,IAAI,CAAC,aAAa,EAAE,aAAa,CAA4C,GACpF;IAAE,IAAI,EAAE,MAAM,EAAE,CAAC;IAAC,IAAI,EAAE,MAAM,EAAE,CAAC;IAAC,aAAa,EAAE,OAAO,CAAA;CAAE,CAK5D"}

package/dist/lib/reconcile.js

@@ -0,0 +1,121 @@
+/**
+ * Reconcile-on-read (tb-8sa.1 step 2)
+ *
+ * The registry's `status` field is only as fresh as the last `spidersan merged`
+ * / `sync` call — and a committed registry snapshot can carry an `active` entry
+ * for a branch that has since merged. Trusting that stale status is what
+ * produced the phantom-conflict incident (a fully-merged branch still flagged
+ * as conflicting from a stale worktree).
+ *
+ * Reconcile-on-read folds git truth in BEFORE conflicts / ready-check /
+ * merge-order answer:
+ *   - ref gone from local AND remote           → orphaned (drop)
+ *   - tip is an ancestor of trunk              → merged   (drop)
+ *   - trunk has a patch-id-equivalent squash   → merged   (drop, tb-tr1z)
+ *   - otherwise                                 → live    (keep)
+ *
+ * It only consults git for entries the registry still calls `active`; entries
+ * already marked `completed` / `abandoned` are honoured without a git probe.
+ */
+import { resolveBranchRef, resolveLocalBranchRef, isMergedInto, isSquashMergedInto, listRemoteHeads } from './git.js';
+import { getTrunkBranch } from './trunk.js';
+export function defaultReconcileDeps() {
+    const trunkName = getTrunkBranch();
+    // Prefer the remote trunk ref so a stale local `main` can't mask merges.
+    const trunkRef = resolveBranchRef(trunkName) ?? trunkName;
+    return {
+        resolveRef: (name) => resolveBranchRef(name),
+        resolveLocalRef: (name) => resolveLocalBranchRef(name),
+        isMerged: (ref, trunk) => isMergedInto(ref, trunk),
+        isSquashMerged: (ref, trunk) => isSquashMergedInto(ref, trunk),
+        remoteHeads: () => listRemoteHeads(),
+        trunkName,
+        trunkRef,
+    };
+}
+/**
+ * Partition registered branches into live / merged / orphaned using git truth.
+ *
+ * @param branches  the raw registry entries (e.g. `await storage.list()`)
+ * @param deps      git probes; defaults to the real repo
+ */
+export function reconcileBranches(branches, deps = defaultReconcileDeps()) {
+    const live = [];
+    const merged = [];
+    const orphaned = [];
+    for (const branch of branches) {
+        // The trunk itself is never "in flight" but also never reconciled away —
+        // pass it through unchanged so readers keep their existing handling.
+        if (branch.name === deps.trunkName) {
+            live.push(branch);
+            continue;
+        }
+        // Honour terminal registry status without a git probe.
+        if (branch.status === 'completed') {
+            merged.push(branch.name);
+            continue;
+        }
+        if (branch.status === 'abandoned') {
+            orphaned.push(branch.name);
+            continue;
+        }
+        // status === 'active' — fold in git truth. Squash merges never make
+        // the tip an ancestor, so fall back to patch-id equivalence (tb-tr1z).
+        const provenMerged = (r) => deps.isMerged(r, deps.trunkRef) || (deps.isSquashMerged?.(r, deps.trunkRef) ?? false);
+        const ref = deps.resolveRef(branch.name);
+        if (ref === null) {
+            orphaned.push(branch.name);
+            continue;
+        }
+        if (provenMerged(ref)) {
+            // The primary ref may be a stale origin/<name> while unpushed local
+            // commits exist — only reconcile away if the local tip (when it
+            // exists and differs) is merged too.
+            const localRef = deps.resolveLocalRef?.(branch.name) ?? null;
+            if (localRef === null || localRef === ref || provenMerged(localRef)) {
+                merged.push(branch.name);
+                continue;
+            }
+        }
+        live.push(branch);
+    }
+    return { live, merged, orphaned };
+}
+/**
+ * Read-path convenience for conflict detection: registered `active` branches
+ * minus those PROVEN merged into trunk (is-ancestor / squash-equivalent, or
+ * status `completed`) and those PROVEN deleted.
+ *
+ * An orphan (no local or tracking ref) is ambiguous: deleted, or live on
+ * another machine and never fetched here. A squash-merged, deleted branch is
+ * never an ancestor of trunk, so it only ever reads as orphaned — keeping every
+ * orphan made those phantom-conflict forever. So an orphan is dropped only when
+ * `git ls-remote` confirms the branch is gone from the remote; if the remote
+ * can't be asked, orphans are kept (a phantom beats a missed conflict). This
+ * matters most for ready-check, which gets no cross-machine registry pull.
+ *
+ * Read-side filter only — nothing is deleted. This is what conflicts /
+ * ready-check / merge-order should call; `sync` uses {@link reconcileBranches}
+ * directly to actually prune merged and orphaned entries.
+ */
+export function activeBranches(branches, deps = defaultReconcileDeps()) {
+    const { live, orphaned } = reconcileBranches(branches, deps);
+    const keep = new Set([...live.map(b => b.name), ...splitOrphans(orphaned, deps).kept]);
+    return branches.filter(b => b.status === 'active' && keep.has(b.name));
+}
+/**
+ * Split orphans (no local or tracking ref) into those the remote confirms are
+ * `gone` and those to `kept` — still on the remote (unfetched here), or every
+ * one of them when the remote can't be asked (`remoteChecked: false`). Shared by
+ * {@link activeBranches} (read side) and `sync` (which deletes `gone` only, sp-slemub).
+ * Only hits the network when there is an orphan to decide.
+ */
+export function splitOrphans(orphaned, deps = { remoteHeads: () => listRemoteHeads() }) {
+    if (orphaned.length === 0)
+        return { gone: [], kept: [], remoteChecked: true };
+    const heads = deps.remoteHeads?.() ?? null;
+    if (heads === null)
+        return { gone: [], kept: orphaned, remoteChecked: false };
+    return { gone: orphaned.filter(n => !heads.has(n)), kept: orphaned.filter(n => heads.has(n)), remoteChecked: true };
+}
+//# sourceMappingURL=reconcile.js.map

package/dist/lib/reconcile.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"reconcile.js","sourceRoot":"","sources":["../../src/lib/reconcile.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAEH,OAAO,EAAE,gBAAgB,EAAE,qBAAqB,EAAE,YAAY,EAAE,kBAAkB,EAAE,eAAe,EAAE,MAAM,UAAU,CAAC;AACtH,OAAO,EAAE,cAAc,EAAE,MAAM,YAAY,CAAC;AA8C5C,MAAM,UAAU,oBAAoB;IAChC,MAAM,SAAS,GAAG,cAAc,EAAE,CAAC;IACnC,yEAAyE;IACzE,MAAM,QAAQ,GAAG,gBAAgB,CAAC,SAAS,CAAC,IAAI,SAAS,CAAC;IAC1D,OAAO;QACH,UAAU,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,gBAAgB,CAAC,IAAI,CAAC;QAC5C,eAAe,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,qBAAqB,CAAC,IAAI,CAAC;QACtD,QAAQ,EAAE,CAAC,GAAG,EAAE,KAAK,EAAE,EAAE,CAAC,YAAY,CAAC,GAAG,EAAE,KAAK,CAAC;QAClD,cAAc,EAAE,CAAC,GAAG,EAAE,KAAK,EAAE,EAAE,CAAC,kBAAkB,CAAC,GAAG,EAAE,KAAK,CAAC;QAC9D,WAAW,EAAE,GAAG,EAAE,CAAC,eAAe,EAAE;QACpC,SAAS;QACT,QAAQ;KACX,CAAC;AACN,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,iBAAiB,CAC7B,QAAkB,EAClB,OAAsB,oBAAoB,EAAE;IAE5C,MAAM,IAAI,GAAa,EAAE,CAAC;IAC1B,MAAM,MAAM,GAAa,EAAE,CAAC;IAC5B,MAAM,QAAQ,GAAa,EAAE,CAAC;IAE9B,KAAK,MAAM,MAAM,IAAI,QAAQ,EAAE,CAAC;QAC5B,yEAAyE;QACzE,qEAAqE;QACrE,IAAI,MAAM,CAAC,IAAI,KAAK,IAAI,CAAC,SAAS,EAAE,CAAC;YACjC,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;YAClB,SAAS;QACb,CAAC;QAED,uDAAuD;QACvD,IAAI,MAAM,CAAC,MAAM,KAAK,WAAW,EAAE,CAAC;YAChC,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;YACzB,SAAS;QACb,CAAC;QACD,IAAI,MAAM,CAAC,MAAM,KAAK,WAAW,EAAE,CAAC;YAChC,QAAQ,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;YAC3B,SAAS;QACb,CAAC;QAED,oEAAoE;QACpE,uEAAuE;QACvE,MAAM,YAAY,GAAG,CAAC,CAAS,EAAE,EAAE,CAC/B,IAAI,CAAC,QAAQ,CAAC,CAAC,EAAE,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,cAAc,EAAE,CAAC,CAAC,EAAE,IAAI,CAAC,QAAQ,CAAC,IAAI,KAAK,CAAC,CAAC;QAE1F,MAAM,GAAG,GAAG,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;QACzC,IAAI,GAAG,KAAK,IAAI,EAAE,CAAC;YACf,QAAQ,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;YAC3B,SAAS;QACb,CAAC;QACD,IAAI,YAAY,CAAC,GAAG,CAAC,EAAE,CAAC;YACpB,oEAAoE;YACpE,gEAAgE;YAChE,qCAAqC;YACrC,MAAM,QAAQ,GAAG,IAAI,CAAC,eAAe,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC;YAC7D,IAAI,QAAQ,KAAK,IAAI,IAAI,QAAQ,KAAK,GAAG,IAAI,YAAY,CAAC,QAAQ,CAAC,EAAE,CAAC;gBAClE,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;gBACzB,SAAS;YACb,CAAC;QACL,CAAC;QACD,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IACtB,CAAC;IAED,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC;AACtC,CAAC;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,UAAU,cAAc,CAAC,QAAkB,EAAE,OAAsB,oBAAoB,EAAE;IAC3F,MAAM,EAAE,IAAI,EAAE,QAAQ,EAAE,GAAG,iBAAiB,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC;IAC7D,MAAM,IAAI,GAAG,IAAI,GAAG,CAAC,CAAC,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,GAAG,YAAY,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC;IACvF,OAAO,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,QAAQ,IAAI,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC;AAC3E,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,YAAY,CACxB,QAAkB,EAClB,OAA2C,EAAE,WAAW,EAAE,GAAG,EAAE,CAAC,eAAe,EAAE,EAAE;IAEnF,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,EAAE,IAAI,EAAE,EAAE,EAAE,IAAI,EAAE,EAAE,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC;IAC9E,MAAM,KAAK,GAAG,IAAI,CAAC,WAAW,EAAE,EAAE,IAAI,IAAI,CAAC;IAC3C,IAAI,KAAK,KAAK,IAAI;QAAE,OAAO,EAAE,IAAI,EAAE,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,aAAa,EAAE,KAAK,EAAE,CAAC;IAC9E,OAAO,EAAE,IAAI,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC;AACxH,CAAC"}

package/dist/lib/security.d.ts

@@ -1,5 +1,5 @@
 /**
- * Validate agent ID (e.g., "sherlocksan", "watsan-1", "agent_01")
+ * Validate agent ID (e.g., "sherlock", "watsan-1", "agent_01")
  * @throws Error if invalid
  */
 export declare function validateAgentId(agentId: string): string;
@@ -64,11 +64,6 @@ export declare function isValidMessageId(messageId: string): boolean;
  * @throws Error if path is outside rootDir
  */
 export declare function validateRepoPath(filePath: string, rootDir?: string): string;
-/**
- * Escape text for blessed TUI to prevent markup injection.
- * Replaces '{' with '{open}' and '}' with '{close}'.
- */
-export declare function escapeBlessed(text: string): string;
 /**
  * Safely resolves the CLI entry point path.
  * Replaces insecure usage of process.argv[1] which can be manipulated.

package/dist/lib/security.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"security.d.ts","sourceRoot":"","sources":["../../src/lib/security.ts"],"names":[],"mappings":"AAsBA;;;GAGG;AACH,wBAAgB,eAAe,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,CAQvD;AAED;;;GAGG;AACH,wBAAgB,kBAAkB,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,CAQzD;AAED;;;GAGG;AACH,wBAAgB,gBAAgB,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,GAAG,MAAM,CAMlE;AAED;;;GAGG;AACH,wBAAgB,cAAc,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,CAQrD;AAED;;;GAGG;AACH,wBAAgB,gBAAgB,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,CAYzD;AAED;;;GAGG;AACH,wBAAgB,YAAY,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAKjD;AAED;;GAEG;AACH,wBAAgB,iBAAiB,CAAC,KAAK,EAAE,MAAM,EAAE,GAAG,MAAM,EAAE,CAU3D;AAED;;GAEG;AACH,wBAAgB,YAAY,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAIhD;AAED;;;;GAIG;AACH,wBAAgB,iBAAiB,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAGrD;AAGD,eAAO,MAAM,QAAQ;;;;;;CAMpB,CAAA;AAGD,eAAO,MAAM,eAAe,wBAAkB,CAAC;AAC/C,eAAO,MAAM,kBAAkB,2BAAqB,CAAC;AACrD,eAAO,MAAM,gBAAgB,yBAAmB,CAAC;AACjD,eAAO,MAAM,gBAAgB,yBAAmB,CAAC;AAIjD,wBAAgB,gBAAgB,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAE3D;AAED;;;;;;;;GAQG;AACH,wBAAgB,gBAAgB,CAAC,QAAQ,EAAE,MAAM,EAAE,OAAO,GAAE,MAAsB,GAAG,MAAM,CAgB1F;AAED;;;GAGG;AACH,wBAAgB,aAAa,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAKlD;AAED;;;GAGG;AACH,wBAAgB,UAAU,IAAI,MAAM,CAKnC"}
+{"version":3,"file":"security.d.ts","sourceRoot":"","sources":["../../src/lib/security.ts"],"names":[],"mappings":"AAsBA;;;GAGG;AACH,wBAAgB,eAAe,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,CAQvD;AAED;;;GAGG;AACH,wBAAgB,kBAAkB,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,CAQzD;AAED;;;GAGG;AACH,wBAAgB,gBAAgB,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,GAAG,MAAM,CAMlE;AAED;;;GAGG;AACH,wBAAgB,cAAc,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,CAQrD;AAED;;;GAGG;AACH,wBAAgB,gBAAgB,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,CAYzD;AAED;;;GAGG;AACH,wBAAgB,YAAY,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAKjD;AAED;;GAEG;AACH,wBAAgB,iBAAiB,CAAC,KAAK,EAAE,MAAM,EAAE,GAAG,MAAM,EAAE,CAU3D;AAED;;GAEG;AACH,wBAAgB,YAAY,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAIhD;AAED;;;;GAIG;AACH,wBAAgB,iBAAiB,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAGrD;AAGD,eAAO,MAAM,QAAQ;;;;;;CAMpB,CAAA;AAGD,eAAO,MAAM,eAAe,wBAAkB,CAAC;AAC/C,eAAO,MAAM,kBAAkB,2BAAqB,CAAC;AACrD,eAAO,MAAM,gBAAgB,yBAAmB,CAAC;AACjD,eAAO,MAAM,gBAAgB,yBAAmB,CAAC;AAIjD,wBAAgB,gBAAgB,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAE3D;AAED;;;;;;;;GAQG;AACH,wBAAgB,gBAAgB,CAAC,QAAQ,EAAE,MAAM,EAAE,OAAO,GAAE,MAAsB,GAAG,MAAM,CAgB1F;AAED;;;GAGG;AACH,wBAAgB,UAAU,IAAI,MAAM,CAKnC"}

package/dist/lib/security.js

@@ -17,7 +17,7 @@ const VALID_FILE_PATH = /^[./a-zA-Z0-9][a-zA-Z0-9/_.@\- ]{0,200}$/;
 // Shell metacharacters to remove from text
 const SHELL_METACHARACTERS = /[`$(){}[\]|;&<>\\]/g;
 /**
- * Validate agent ID (e.g., "sherlocksan", "watsan-1", "agent_01")
+ * Validate agent ID (e.g., "sherlock", "watsan-1", "agent_01")
  * @throws Error if invalid
  */
 export function validateAgentId(agentId) {
@@ -167,16 +167,6 @@ export function validateRepoPath(filePath, rootDir = process.cwd()) {
     }
     return resolved;
 }
-/**
- * Escape text for blessed TUI to prevent markup injection.
- * Replaces '{' with '{open}' and '}' with '{close}'.
- */
-export function escapeBlessed(text) {
-    if (!text || typeof text !== 'string') {
-        return '';
-    }
-    return text.replace(/[{}]/g, (char) => char === '{' ? '{open}' : '{close}');
-}
 /**
  * Safely resolves the CLI entry point path.
  * Replaces insecure usage of process.argv[1] which can be manipulated.

package/dist/lib/security.js.map

@@ -1 +1 @@
-{"version":3,"file":"security.js","sourceRoot":"","sources":["../../src/lib/security.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,UAAU,EAAE,OAAO,EAAE,MAAM,MAAM,CAAC;AAC9D,OAAO,EAAE,aAAa,EAAE,MAAM,KAAK,CAAC;AAEpC;;;;;;;GAOG;AAEH,sBAAsB;AACtB,MAAM,cAAc,GAAG,6BAA6B,CAAC;AACrD,MAAM,iBAAiB,GAAG,oCAAoC,CAAC;AAC/D,MAAM,aAAa,GAAG,6BAA6B,CAAC;AACpD,6BAA6B;AAC7B,MAAM,eAAe,GAAG,0CAA0C,CAAC;AAEnE,2CAA2C;AAC3C,MAAM,oBAAoB,GAAG,qBAAqB,CAAC;AAEnD;;;GAGG;AACH,MAAM,UAAU,eAAe,CAAC,OAAe;IAC3C,IAAI,CAAC,OAAO,IAAI,OAAO,OAAO,KAAK,QAAQ,EAAE,CAAC;QAC1C,MAAM,IAAI,KAAK,CAAC,sBAAsB,CAAC,CAAC;IAC5C,CAAC;IACD,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;QAChC,MAAM,IAAI,KAAK,CAAC,sBAAsB,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,yCAAyC,CAAC,CAAC;IACzG,CAAC;IACD,OAAO,OAAO,CAAC;AACnB,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,kBAAkB,CAAC,MAAc;IAC7C,IAAI,CAAC,MAAM,IAAI,OAAO,MAAM,KAAK,QAAQ,EAAE,CAAC;QACxC,MAAM,IAAI,KAAK,CAAC,yBAAyB,CAAC,CAAC;IAC/C,CAAC;IACD,IAAI,CAAC,iBAAiB,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC;QAClC,MAAM,IAAI,KAAK,CAAC,yBAAyB,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,CAAC;IACxE,CAAC;IACD,OAAO,MAAM,CAAC;AAClB,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,gBAAgB,CAAC,QAAyB;IACtD,MAAM,GAAG,GAAG,OAAO,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC;IAC7E,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,GAAG,CAAC,IAAI,GAAG,IAAI,CAAC,EAAE,CAAC;QACrC,MAAM,IAAI,KAAK,CAAC,sBAAsB,QAAQ,EAAE,CAAC,CAAC;IACtD,CAAC;IACD,OAAO,GAAG,CAAC;AACf,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,cAAc,CAAC,MAAc;IACzC,IAAI,CAAC,MAAM,IAAI,OAAO,MAAM,KAAK,QAAQ,EAAE,CAAC;QACxC,MAAM,IAAI,KAAK,CAAC,qBAAqB,CAAC,CAAC;IAC3C,CAAC;IACD,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC;QAC9B,MAAM,IAAI,KAAK,CAAC,qBAAqB,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,yCAAyC,CAAC,CAAC;IACvG,CAAC;IACD,OAAO,MAAM,CAAC;AAClB,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,gBAAgB,CAAC,QAAgB;IAC7C,IAAI,CAAC,QAAQ,IAAI,OAAO,QAAQ,KAAK,QAAQ,EAAE,CAAC;QAC5C,MAAM,IAAI,KAAK,CAAC,uBAAuB,CAAC,CAAC;IAC7C,CAAC;IACD,uBAAuB;IACvB,IAAI,QAAQ,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;QAC1B,MAAM,IAAI,KAAK,CAAC,4BAA4B,CAAC,CAAC;IAClD,CAAC;IACD,IAAI,CAAC,eAAe,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC;QAClC,MAAM,IAAI,KAAK,CAAC,uBAAuB,QAAQ,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,CAAC;IACxE,CAAC;IACD,OAAO,QAAQ,CAAC;AACpB,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,YAAY,CAAC,IAAY;IACrC,IAAI,CAAC,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ,EAAE,CAAC;QACpC,OAAO,EAAE,CAAC;IACd,CAAC;IACD,OAAO,IAAI,CAAC,OAAO,CAAC,oBAAoB,EAAE,EAAE,CAAC,CAAC;AAClD,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,iBAAiB,CAAC,KAAe;IAC7C,OAAO,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE;QACpB,IAAI,CAAC;YACD,gBAAgB,CAAC,CAAC,CAAC,CAAC;YACpB,OAAO,IAAI,CAAC;QAChB,CAAC;QAAC,MAAM,CAAC;YACL,OAAO,CAAC,IAAI,CAAC,kCAAkC,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,KAAK,CAAC,CAAC;YACpE,OAAO,KAAK,CAAC;QACjB,CAAC;IACL,CAAC,CAAC,CAAC;AACP,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,YAAY,CAAC,GAAW;IACpC,sDAAsD;IACtD,4CAA4C;IAC5C,OAAO,GAAG,CAAC;AACf,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,iBAAiB,CAAC,GAAW;IACzC,IAAI,GAAG,KAAK,IAAI,IAAI,GAAG,KAAK,SAAS;QAAE,OAAO,IAAI,CAAC;IACnD,OAAO,IAAI,MAAM,CAAC,GAAG,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,OAAO,CAAC,GAAG,CAAC;AACrD,CAAC;AAED,yCAAyC;AACzC,MAAM,CAAC,MAAM,QAAQ,GAAG;IACpB,cAAc;IACd,iBAAiB;IACjB,aAAa;IACb,eAAe;IACf,oBAAoB;CACvB,CAAA;AAED,oDAAoD;AACpD,MAAM,CAAC,MAAM,eAAe,GAAG,eAAe,CAAC;AAC/C,MAAM,CAAC,MAAM,kBAAkB,GAAG,kBAAkB,CAAC;AACrD,MAAM,CAAC,MAAM,gBAAgB,GAAG,gBAAgB,CAAC;AACjD,MAAM,CAAC,MAAM,gBAAgB,GAAG,gBAAgB,CAAC;AAEjD,+CAA+C;AAC/C,MAAM,gBAAgB,GAAG,6BAA6B,CAAC;AACvD,MAAM,UAAU,gBAAgB,CAAC,SAAiB;IAC9C,OAAO,OAAO,SAAS,KAAK,QAAQ,IAAI,gBAAgB,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;AAC7E,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,gBAAgB,CAAC,QAAgB,EAAE,UAAkB,OAAO,CAAC,GAAG,EAAE;IAC9E,IAAI,CAAC,QAAQ,IAAI,OAAO,QAAQ,KAAK,QAAQ,EAAE,CAAC;QAC5C,MAAM,IAAI,KAAK,CAAC,uBAAuB,CAAC,CAAC;IAC7C,CAAC;IAED,MAAM,QAAQ,GAAG,OAAO,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC;IAC5C,MAAM,GAAG,GAAG,QAAQ,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC;IAExC,gGAAgG;IAChG,2GAA2G;IAC3G,6DAA6D;IAC7D,IAAI,GAAG,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;QAC1C,MAAM,IAAI,KAAK,CAAC,yBAAyB,QAAQ,oCAAoC,CAAC,CAAC;IAC3F,CAAC;IAED,OAAO,QAAQ,CAAC;AACpB,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,aAAa,CAAC,IAAY;IACtC,IAAI,CAAC,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ,EAAE,CAAC;QACpC,OAAO,EAAE,CAAC;IACd,CAAC;IACD,OAAO,IAAI,CAAC,OAAO,CAAC,OAAO,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,KAAK,GAAG,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;AAChF,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,UAAU;IACtB,MAAM,UAAU,GAAG,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAClD,MAAM,SAAS,GAAG,OAAO,CAAC,UAAU,CAAC,CAAC;IACtC,MAAM,GAAG,GAAG,UAAU,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC;IACvD,OAAO,OAAO,CAAC,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,YAAY,GAAG,EAAE,CAAC,CAAC;AAC9D,CAAC"}
+{"version":3,"file":"security.js","sourceRoot":"","sources":["../../src/lib/security.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,UAAU,EAAE,OAAO,EAAE,MAAM,MAAM,CAAC;AAC9D,OAAO,EAAE,aAAa,EAAE,MAAM,KAAK,CAAC;AAEpC;;;;;;;GAOG;AAEH,sBAAsB;AACtB,MAAM,cAAc,GAAG,6BAA6B,CAAC;AACrD,MAAM,iBAAiB,GAAG,oCAAoC,CAAC;AAC/D,MAAM,aAAa,GAAG,6BAA6B,CAAC;AACpD,6BAA6B;AAC7B,MAAM,eAAe,GAAG,0CAA0C,CAAC;AAEnE,2CAA2C;AAC3C,MAAM,oBAAoB,GAAG,qBAAqB,CAAC;AAEnD;;;GAGG;AACH,MAAM,UAAU,eAAe,CAAC,OAAe;IAC3C,IAAI,CAAC,OAAO,IAAI,OAAO,OAAO,KAAK,QAAQ,EAAE,CAAC;QAC1C,MAAM,IAAI,KAAK,CAAC,sBAAsB,CAAC,CAAC;IAC5C,CAAC;IACD,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;QAChC,MAAM,IAAI,KAAK,CAAC,sBAAsB,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,yCAAyC,CAAC,CAAC;IACzG,CAAC;IACD,OAAO,OAAO,CAAC;AACnB,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,kBAAkB,CAAC,MAAc;IAC7C,IAAI,CAAC,MAAM,IAAI,OAAO,MAAM,KAAK,QAAQ,EAAE,CAAC;QACxC,MAAM,IAAI,KAAK,CAAC,yBAAyB,CAAC,CAAC;IAC/C,CAAC;IACD,IAAI,CAAC,iBAAiB,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC;QAClC,MAAM,IAAI,KAAK,CAAC,yBAAyB,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,CAAC;IACxE,CAAC;IACD,OAAO,MAAM,CAAC;AAClB,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,gBAAgB,CAAC,QAAyB;IACtD,MAAM,GAAG,GAAG,OAAO,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC;IAC7E,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,GAAG,CAAC,IAAI,GAAG,IAAI,CAAC,EAAE,CAAC;QACrC,MAAM,IAAI,KAAK,CAAC,sBAAsB,QAAQ,EAAE,CAAC,CAAC;IACtD,CAAC;IACD,OAAO,GAAG,CAAC;AACf,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,cAAc,CAAC,MAAc;IACzC,IAAI,CAAC,MAAM,IAAI,OAAO,MAAM,KAAK,QAAQ,EAAE,CAAC;QACxC,MAAM,IAAI,KAAK,CAAC,qBAAqB,CAAC,CAAC;IAC3C,CAAC;IACD,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC;QAC9B,MAAM,IAAI,KAAK,CAAC,qBAAqB,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,yCAAyC,CAAC,CAAC;IACvG,CAAC;IACD,OAAO,MAAM,CAAC;AAClB,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,gBAAgB,CAAC,QAAgB;IAC7C,IAAI,CAAC,QAAQ,IAAI,OAAO,QAAQ,KAAK,QAAQ,EAAE,CAAC;QAC5C,MAAM,IAAI,KAAK,CAAC,uBAAuB,CAAC,CAAC;IAC7C,CAAC;IACD,uBAAuB;IACvB,IAAI,QAAQ,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;QAC1B,MAAM,IAAI,KAAK,CAAC,4BAA4B,CAAC,CAAC;IAClD,CAAC;IACD,IAAI,CAAC,eAAe,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC;QAClC,MAAM,IAAI,KAAK,CAAC,uBAAuB,QAAQ,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,CAAC;IACxE,CAAC;IACD,OAAO,QAAQ,CAAC;AACpB,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,YAAY,CAAC,IAAY;IACrC,IAAI,CAAC,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ,EAAE,CAAC;QACpC,OAAO,EAAE,CAAC;IACd,CAAC;IACD,OAAO,IAAI,CAAC,OAAO,CAAC,oBAAoB,EAAE,EAAE,CAAC,CAAC;AAClD,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,iBAAiB,CAAC,KAAe;IAC7C,OAAO,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE;QACpB,IAAI,CAAC;YACD,gBAAgB,CAAC,CAAC,CAAC,CAAC;YACpB,OAAO,IAAI,CAAC;QAChB,CAAC;QAAC,MAAM,CAAC;YACL,OAAO,CAAC,IAAI,CAAC,kCAAkC,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,KAAK,CAAC,CAAC;YACpE,OAAO,KAAK,CAAC;QACjB,CAAC;IACL,CAAC,CAAC,CAAC;AACP,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,YAAY,CAAC,GAAW;IACpC,sDAAsD;IACtD,4CAA4C;IAC5C,OAAO,GAAG,CAAC;AACf,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,iBAAiB,CAAC,GAAW;IACzC,IAAI,GAAG,KAAK,IAAI,IAAI,GAAG,KAAK,SAAS;QAAE,OAAO,IAAI,CAAC;IACnD,OAAO,IAAI,MAAM,CAAC,GAAG,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,OAAO,CAAC,GAAG,CAAC;AACrD,CAAC;AAED,yCAAyC;AACzC,MAAM,CAAC,MAAM,QAAQ,GAAG;IACpB,cAAc;IACd,iBAAiB;IACjB,aAAa;IACb,eAAe;IACf,oBAAoB;CACvB,CAAA;AAED,oDAAoD;AACpD,MAAM,CAAC,MAAM,eAAe,GAAG,eAAe,CAAC;AAC/C,MAAM,CAAC,MAAM,kBAAkB,GAAG,kBAAkB,CAAC;AACrD,MAAM,CAAC,MAAM,gBAAgB,GAAG,gBAAgB,CAAC;AACjD,MAAM,CAAC,MAAM,gBAAgB,GAAG,gBAAgB,CAAC;AAEjD,+CAA+C;AAC/C,MAAM,gBAAgB,GAAG,6BAA6B,CAAC;AACvD,MAAM,UAAU,gBAAgB,CAAC,SAAiB;IAC9C,OAAO,OAAO,SAAS,KAAK,QAAQ,IAAI,gBAAgB,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;AAC7E,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,gBAAgB,CAAC,QAAgB,EAAE,UAAkB,OAAO,CAAC,GAAG,EAAE;IAC9E,IAAI,CAAC,QAAQ,IAAI,OAAO,QAAQ,KAAK,QAAQ,EAAE,CAAC;QAC5C,MAAM,IAAI,KAAK,CAAC,uBAAuB,CAAC,CAAC;IAC7C,CAAC;IAED,MAAM,QAAQ,GAAG,OAAO,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC;IAC5C,MAAM,GAAG,GAAG,QAAQ,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC;IAExC,gGAAgG;IAChG,2GAA2G;IAC3G,6DAA6D;IAC7D,IAAI,GAAG,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;QAC1C,MAAM,IAAI,KAAK,CAAC,yBAAyB,QAAQ,oCAAoC,CAAC,CAAC;IAC3F,CAAC;IAED,OAAO,QAAQ,CAAC;AACpB,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,UAAU;IACtB,MAAM,UAAU,GAAG,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAClD,MAAM,SAAS,GAAG,OAAO,CAAC,UAAU,CAAC,CAAC;IACtC,MAAM,GAAG,GAAG,UAAU,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC;IACvD,OAAO,OAAO,CAAC,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,YAAY,GAAG,EAAE,CAAC,CAAC;AAC9D,CAAC"}