wingfoil 0.2.2 → 0.3.0

package/dist/core/builtin-asset.d.ts

@@ -1,12 +1,16 @@
 /**
  * Immutable built-in assets pre-flight check (REQ-SEC-07 — task-042-immutable-builtin-assets).
  *
- * **The rule is REQ-SEC-07's, the layout is spec-011's.** REQ-SEC-07 states that built-in directives
- * and built-in workflow templates cannot be removed; `spec-011-storage-layout` supplies the structure
+ * **The rule is REQ-SEC-07's, the layout is spec-011's.** REQ-SEC-07 states that built-in directives,
+ * built-in workflow templates and (since task-196) built-in agent adapters cannot be removed. This
+ * module checks the first two only: no operation removes an adapter (`spec-016` §2.1), and
+ * `test/core/builtin-adapter-writers.test.ts` keeps it so. `spec-011-storage-layout` supplies the structure
  * that rule is expressed over — the `directives/{built-in,custom}/` and `workflows/{built-in,custom}/`
- * split, where `built-in/` is "reserved for the official … templates shipped by the `wingfoil` npm
- * package" (empty today, `.gitkeep` only) and `custom/` holds every asset that exists right now. Only
- * the removability rule comes from REQ-SEC-07; spec-011 never speaks about removal or protection.
+ * split, where `built-in/` holds the official templates shipped by the `wingfoil` npm package (the P3.8
+ * directive templates `wingfoil init` installs, task-057; no workflow templates ship yet) and `custom/`
+ * holds the project's own assets. This repository's own `directives/built-in/` holds only `.gitkeep`:
+ * its hand-authored configuration predates the templates. Only the removability rule comes from
+ * REQ-SEC-07; spec-011 never speaks about removal or protection.
  *
  * Classification is **structural** (which subdirectory holds the file), not the directive
  * frontmatter's `kind:` field — and that is the one point spec-011 does settle: the six P3.8 template
@@ -32,20 +36,19 @@
  * This lives in `src/core` (not `src/directives`/`src/workflow`) because REQ-SEC-07 crosscuts both
  * pillars identically and both the CLI and MCP surfaces must enforce it the same way (REQ-SYS-05) —
  * the same reasoning `requireGitIdentity` (REQ-SEC-01, task-014) already established for a
- * cross-cutting mutating-op pre-flight. Neither `directive remove` nor `workflow remove` exists yet in
- * `CORE_MODULES` (spec-006 §3 reserves both as future `mutates: true` operations); per the same
- * precedent (task-014, task-016), this task delivers the shared, fully-tested primitive now and defers
- * wiring it into the actual mutating op to the dependent task (task-052-directive-remove for
- * `directive.remove`; a future task for `workflow.remove`).
+ * cross-cutting mutating-op pre-flight. It shipped (task-042) before either remove operation; both now
+ * call it: `directive remove` (task-052-directive-remove) and `workflow remove` (task-211,
+ * `./workflow-create-remove.ts`).
  *
  * **Scope:** this module delivers REQ-SEC-07's *first* clause only. The second — "removal of a
- * still-referenced custom asset is rejected naming the referrer" — is deliberately not implemented
- * here; per `dl-030-req-sec-07-referenced-asset-ownership` (`ready`) the directive half belongs to
- * `task-052-directive-remove` and the workflow half (P4.9) is carried to the next `release-planning`
- * run. `requireCustomAsset` is therefore the FIRST of two checks a remove op runs, never the only one.
+ * still-referenced custom asset is rejected naming the referrer" — is each remove operation's own, per
+ * `dl-030-req-sec-07-referenced-asset-ownership` (`ready`): the directive half is `checkUnreferenced`
+ * (`./directive-assign.ts`, task-052), the workflow half `workflow remove`'s include and open-instance
+ * refusals (task-211). `requireCustomAsset` is therefore the FIRST of two checks a remove op runs, never
+ * the only one.
  */
 import { type CoreResult } from './types';
-/** The two pillars REQ-SEC-07 protects — `built-in/` is immutable in both. */
+/** The two pillars whose removal this check guards — `built-in/` is immutable in both (REQ-SEC-07 also names built-in agent adapters, which no operation removes). */
 export type AssetKind = 'directive' | 'workflow';
 /**
  * The allow-list: true only when `relativePath` is positively recognised as a removable `custom/`

package/dist/core/builtin-asset.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"builtin-asset.d.ts","sourceRoot":"","sources":["../../src/core/builtin-asset.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6CG;AACH,OAAO,EAAmB,KAAK,UAAU,EAAE,MAAM,SAAS,CAAC;AAE3D,8EAA8E;AAC9E,MAAM,MAAM,SAAS,GAAG,WAAW,GAAG,UAAU,CAAC;AAiDjD;;;;;;;;GAQG;AACH,wBAAgB,0BAA0B,CAAC,IAAI,EAAE,SAAS,EAAE,YAAY,EAAE,MAAM,GAAG,OAAO,CAEzF;AAcD;;;;;;;;;GASG;AACH,wBAAgB,kBAAkB,CAAC,IAAI,EAAE,SAAS,EAAE,YAAY,EAAE,MAAM,GAAG,UAAU,CAAC,IAAI,CAAC,CAQ1F"}
+{"version":3,"file":"builtin-asset.d.ts","sourceRoot":"","sources":["../../src/core/builtin-asset.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgDG;AACH,OAAO,EAAmB,KAAK,UAAU,EAAE,MAAM,SAAS,CAAC;AAE3D,sKAAsK;AACtK,MAAM,MAAM,SAAS,GAAG,WAAW,GAAG,UAAU,CAAC;AAiDjD;;;;;;;;GAQG;AACH,wBAAgB,0BAA0B,CAAC,IAAI,EAAE,SAAS,EAAE,YAAY,EAAE,MAAM,GAAG,OAAO,CAEzF;AAcD;;;;;;;;;GASG;AACH,wBAAgB,kBAAkB,CAAC,IAAI,EAAE,SAAS,EAAE,YAAY,EAAE,MAAM,GAAG,UAAU,CAAC,IAAI,CAAC,CAQ1F"}

package/dist/core/builtin-asset.js

@@ -5,12 +5,16 @@ exports.requireCustomAsset = requireCustomAsset;
 /**
  * Immutable built-in assets pre-flight check (REQ-SEC-07 — task-042-immutable-builtin-assets).
  *
- * **The rule is REQ-SEC-07's, the layout is spec-011's.** REQ-SEC-07 states that built-in directives
- * and built-in workflow templates cannot be removed; `spec-011-storage-layout` supplies the structure
+ * **The rule is REQ-SEC-07's, the layout is spec-011's.** REQ-SEC-07 states that built-in directives,
+ * built-in workflow templates and (since task-196) built-in agent adapters cannot be removed. This
+ * module checks the first two only: no operation removes an adapter (`spec-016` §2.1), and
+ * `test/core/builtin-adapter-writers.test.ts` keeps it so. `spec-011-storage-layout` supplies the structure
  * that rule is expressed over — the `directives/{built-in,custom}/` and `workflows/{built-in,custom}/`
- * split, where `built-in/` is "reserved for the official … templates shipped by the `wingfoil` npm
- * package" (empty today, `.gitkeep` only) and `custom/` holds every asset that exists right now. Only
- * the removability rule comes from REQ-SEC-07; spec-011 never speaks about removal or protection.
+ * split, where `built-in/` holds the official templates shipped by the `wingfoil` npm package (the P3.8
+ * directive templates `wingfoil init` installs, task-057; no workflow templates ship yet) and `custom/`
+ * holds the project's own assets. This repository's own `directives/built-in/` holds only `.gitkeep`:
+ * its hand-authored configuration predates the templates. Only the removability rule comes from
+ * REQ-SEC-07; spec-011 never speaks about removal or protection.
  *
  * Classification is **structural** (which subdirectory holds the file), not the directive
  * frontmatter's `kind:` field — and that is the one point spec-011 does settle: the six P3.8 template
@@ -36,17 +40,16 @@ exports.requireCustomAsset = requireCustomAsset;
  * This lives in `src/core` (not `src/directives`/`src/workflow`) because REQ-SEC-07 crosscuts both
  * pillars identically and both the CLI and MCP surfaces must enforce it the same way (REQ-SYS-05) —
  * the same reasoning `requireGitIdentity` (REQ-SEC-01, task-014) already established for a
- * cross-cutting mutating-op pre-flight. Neither `directive remove` nor `workflow remove` exists yet in
- * `CORE_MODULES` (spec-006 §3 reserves both as future `mutates: true` operations); per the same
- * precedent (task-014, task-016), this task delivers the shared, fully-tested primitive now and defers
- * wiring it into the actual mutating op to the dependent task (task-052-directive-remove for
- * `directive.remove`; a future task for `workflow.remove`).
+ * cross-cutting mutating-op pre-flight. It shipped (task-042) before either remove operation; both now
+ * call it: `directive remove` (task-052-directive-remove) and `workflow remove` (task-211,
+ * `./workflow-create-remove.ts`).
  *
  * **Scope:** this module delivers REQ-SEC-07's *first* clause only. The second — "removal of a
- * still-referenced custom asset is rejected naming the referrer" — is deliberately not implemented
- * here; per `dl-030-req-sec-07-referenced-asset-ownership` (`ready`) the directive half belongs to
- * `task-052-directive-remove` and the workflow half (P4.9) is carried to the next `release-planning`
- * run. `requireCustomAsset` is therefore the FIRST of two checks a remove op runs, never the only one.
+ * still-referenced custom asset is rejected naming the referrer" — is each remove operation's own, per
+ * `dl-030-req-sec-07-referenced-asset-ownership` (`ready`): the directive half is `checkUnreferenced`
+ * (`./directive-assign.ts`, task-052), the workflow half `workflow remove`'s include and open-instance
+ * refusals (task-211). `requireCustomAsset` is therefore the FIRST of two checks a remove op runs, never
+ * the only one.
  */
 const types_1 = require("./types");
 /** The `.wingfoil/` top-level directory that holds each pillar's assets (spec-011 layout). */

package/dist/core/builtin-asset.js.map

@@ -1 +1 @@
-{"version":3,"file":"builtin-asset.js","sourceRoot":"","sources":["../../src/core/builtin-asset.ts"],"names":[],"mappings":";;AA2GA,gEAEC;AAwBD,gDAQC;AA7ID;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6CG;AACH,mCAA2D;AAK3D,8FAA8F;AAC9F,MAAM,kBAAkB,GAA8B;IACpD,SAAS,EAAE,YAAY;IACvB,QAAQ,EAAE,WAAW;CACtB,CAAC;AAEF,oGAAoG;AACpG,MAAM,cAAc,GAAG,QAAQ,CAAC;AAEhC,8EAA8E;AAC9E,MAAM,gBAAgB,GAAG,UAAU,CAAC;AAEpC;;;;;;;GAOG;AACH,MAAM,sBAAsB,GAA8B;IACxD,SAAS,EAAE,uCAAuC;IAClD,QAAQ,EAAE,sCAAsC;CACjD,CAAC;AAEF;;;;GAIG;AACH,SAAS,UAAU,CAAC,YAAoB;IACtC,OAAO,YAAY,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;AACrC,CAAC;AAED;;;;;GAKG;AACH,SAAS,iBAAiB,CAAC,IAAe,EAAE,YAAoB,EAAE,YAAoB;IACpF,MAAM,QAAQ,GAAG,UAAU,CAAC,YAAY,CAAC,CAAC;IAC1C,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC;QAAE,OAAO,KAAK,CAAC;IACtC,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,KAAK,EAAE,IAAI,OAAO,KAAK,GAAG,IAAI,OAAO,KAAK,IAAI,CAAC;QAAE,OAAO,KAAK,CAAC;IACtG,OAAO,QAAQ,CAAC,CAAC,CAAC,KAAK,kBAAkB,CAAC,IAAI,CAAC,IAAI,QAAQ,CAAC,CAAC,CAAC,KAAK,YAAY,CAAC;AAClF,CAAC;AAED;;;;;;;;GAQG;AACH,SAAgB,0BAA0B,CAAC,IAAe,EAAE,YAAoB;IAC9E,OAAO,iBAAiB,CAAC,IAAI,EAAE,YAAY,EAAE,cAAc,CAAC,CAAC;AAC/D,CAAC;AAED;;;;;;;GAOG;AACH,SAAS,mBAAmB,CAAC,IAAe,EAAE,YAAoB;IAChE,OAAO,iBAAiB,CAAC,IAAI,EAAE,YAAY,EAAE,gBAAgB,CAAC,CAAC;AACjE,CAAC;AAED;;;;;;;;;GASG;AACH,SAAgB,kBAAkB,CAAC,IAAe,EAAE,YAAoB;IACtE,IAAI,0BAA0B,CAAC,IAAI,EAAE,YAAY,CAAC,EAAE,CAAC;QACnD,OAAO,IAAA,cAAM,EAAO,SAAS,CAAC,CAAC;IACjC,CAAC;IACD,MAAM,OAAO,GAAG,mBAAmB,CAAC,IAAI,EAAE,YAAY,CAAC;QACrD,CAAC,CAAC,sBAAsB,CAAC,IAAI,CAAC;QAC9B,CAAC,CAAC,kBAAkB,YAAY,YAAY,IAAI,WAAW,kBAAkB,CAAC,IAAI,CAAC,IAAI,cAAc,IAAI,CAAC;IAC5G,OAAO,IAAA,eAAO,EAAC,EAAE,IAAI,EAAE,YAAY,EAAE,OAAO,EAAE,CAAC,CAAC;AAClD,CAAC"}
+{"version":3,"file":"builtin-asset.js","sourceRoot":"","sources":["../../src/core/builtin-asset.ts"],"names":[],"mappings":";;AA8GA,gEAEC;AAwBD,gDAQC;AAhJD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgDG;AACH,mCAA2D;AAK3D,8FAA8F;AAC9F,MAAM,kBAAkB,GAA8B;IACpD,SAAS,EAAE,YAAY;IACvB,QAAQ,EAAE,WAAW;CACtB,CAAC;AAEF,oGAAoG;AACpG,MAAM,cAAc,GAAG,QAAQ,CAAC;AAEhC,8EAA8E;AAC9E,MAAM,gBAAgB,GAAG,UAAU,CAAC;AAEpC;;;;;;;GAOG;AACH,MAAM,sBAAsB,GAA8B;IACxD,SAAS,EAAE,uCAAuC;IAClD,QAAQ,EAAE,sCAAsC;CACjD,CAAC;AAEF;;;;GAIG;AACH,SAAS,UAAU,CAAC,YAAoB;IACtC,OAAO,YAAY,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;AACrC,CAAC;AAED;;;;;GAKG;AACH,SAAS,iBAAiB,CAAC,IAAe,EAAE,YAAoB,EAAE,YAAoB;IACpF,MAAM,QAAQ,GAAG,UAAU,CAAC,YAAY,CAAC,CAAC;IAC1C,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC;QAAE,OAAO,KAAK,CAAC;IACtC,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,KAAK,EAAE,IAAI,OAAO,KAAK,GAAG,IAAI,OAAO,KAAK,IAAI,CAAC;QAAE,OAAO,KAAK,CAAC;IACtG,OAAO,QAAQ,CAAC,CAAC,CAAC,KAAK,kBAAkB,CAAC,IAAI,CAAC,IAAI,QAAQ,CAAC,CAAC,CAAC,KAAK,YAAY,CAAC;AAClF,CAAC;AAED;;;;;;;;GAQG;AACH,SAAgB,0BAA0B,CAAC,IAAe,EAAE,YAAoB;IAC9E,OAAO,iBAAiB,CAAC,IAAI,EAAE,YAAY,EAAE,cAAc,CAAC,CAAC;AAC/D,CAAC;AAED;;;;;;;GAOG;AACH,SAAS,mBAAmB,CAAC,IAAe,EAAE,YAAoB;IAChE,OAAO,iBAAiB,CAAC,IAAI,EAAE,YAAY,EAAE,gBAAgB,CAAC,CAAC;AACjE,CAAC;AAED;;;;;;;;;GASG;AACH,SAAgB,kBAAkB,CAAC,IAAe,EAAE,YAAoB;IACtE,IAAI,0BAA0B,CAAC,IAAI,EAAE,YAAY,CAAC,EAAE,CAAC;QACnD,OAAO,IAAA,cAAM,EAAO,SAAS,CAAC,CAAC;IACjC,CAAC;IACD,MAAM,OAAO,GAAG,mBAAmB,CAAC,IAAI,EAAE,YAAY,CAAC;QACrD,CAAC,CAAC,sBAAsB,CAAC,IAAI,CAAC;QAC9B,CAAC,CAAC,kBAAkB,YAAY,YAAY,IAAI,WAAW,kBAAkB,CAAC,IAAI,CAAC,IAAI,cAAc,IAAI,CAAC;IAC5G,OAAO,IAAA,eAAO,EAAC,EAAE,IAAI,EAAE,YAAY,EAAE,OAAO,EAAE,CAAC,CAAC;AAClD,CAAC"}

package/dist/core/builtin-integrity.d.ts

@@ -9,10 +9,15 @@ export interface BuiltinIntegrityFailure {
     readonly name: string;
     readonly kind: BuiltinTemplateKind;
     readonly message: string;
+    /**
+     * The spec-007 §2 `pattern_id` of the blocking finding, present only when the source failed the
+     * secret scan ({@link secretScanFailure}) rather than its schema check.
+     */
+    readonly patternId?: string;
 }
 /**
- * Schema-check every `sources` entry, in list order (REQ-SYS-07: deterministic, no unordered
- * iteration), and return the FIRST one that fails — or `null` when every source is valid (including
+ * Schema-check, then secret-scan, every `sources` entry, in list order (REQ-SYS-07: deterministic,
+ * no unordered iteration), and return the FIRST one that fails — or `null` when every source is valid (including
  * the trivial, always-passing case of an empty list, which is what `src/storage/templates.ts`'s
  * `builtinTemplateSources` derives from the P1.1 minimal skeleton, whose built-in directory holds only
  * a `.gitkeep`; `templateScaffold` yields the six P3.8 built-in directives since
@@ -22,6 +27,11 @@ export interface BuiltinIntegrityFailure {
  * reported as a failure ({@link unknownKindMessage}) rather than skipped or thrown on — it cannot be
  * checked, so it must not be installed.
  *
+ * The secret scan ({@link secretScanFailure}) is spec-007 §4 step 5's "additional integrity gate run
+ * in the same pre-write pass" (task-135, `bug-038`): a source that passes its schema check but
+ * carries a `blocking` spec-007 §2 finding fails too, naming the template and the `pattern_id`. A
+ * source is scanned only once its schema check has passed, so each source reports one failure.
+ *
  * Callers — `initWingfoilProject` AND `initWingfoilStorage`, both in `src/core/init.ts`; every
  * `initStorage` write path there is one — MUST run this before writing any file: REQ-SEC-10's fit
  * criterion requires the abort to happen "before writing partial assets". This function itself never

package/dist/core/builtin-integrity.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"builtin-integrity.d.ts","sourceRoot":"","sources":["../../src/core/builtin-integrity.ts"],"names":[],"mappings":"AA8BA,OAAO,EAAsB,KAAK,mBAAmB,EAAE,KAAK,qBAAqB,EAAE,MAAM,YAAY,CAAC;AAItG,YAAY,EAAE,mBAAmB,EAAE,qBAAqB,EAAE,MAAM,YAAY,CAAC;AAE7E;;;;GAIG;AACH,MAAM,WAAW,uBAAuB;IACtC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,IAAI,EAAE,mBAAmB,CAAC;IACnC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;CAC1B;AAuFD;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAgB,sBAAsB,CACpC,OAAO,EAAE,SAAS,qBAAqB,EAAE,GACxC,uBAAuB,GAAG,IAAI,CAehC"}
+{"version":3,"file":"builtin-integrity.d.ts","sourceRoot":"","sources":["../../src/core/builtin-integrity.ts"],"names":[],"mappings":"AAuCA,OAAO,EAA4C,KAAK,mBAAmB,EAAE,KAAK,qBAAqB,EAAE,MAAM,YAAY,CAAC;AAM5H,YAAY,EAAE,mBAAmB,EAAE,qBAAqB,EAAE,MAAM,YAAY,CAAC;AAE7E;;;;GAIG;AACH,MAAM,WAAW,uBAAuB;IACtC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,IAAI,EAAE,mBAAmB,CAAC;IACnC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB;;;OAGG;IACH,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;CAC7B;AAkJD;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,wBAAgB,sBAAsB,CACpC,OAAO,EAAE,SAAS,qBAAqB,EAAE,GACxC,uBAAuB,GAAG,IAAI,CAiBhC"}

package/dist/core/builtin-integrity.js

@@ -16,9 +16,17 @@ exports.verifyBuiltinTemplates = verifyBuiltinTemplates;
  * ordering determinism surface against REQ-SYS-07. Distribution-channel assurance lives in `adr-009`
  * / `spec-015` (npm provenance) instead. Do not "strengthen" this module with hashing.
  *
+ * The same pre-write pass also runs the spec-007 §4 step 5 secret scan over each source (task-135,
+ * `bug-038`), which is a separate gate from the REQ-SEC-10 schema check, serving REQ-SEC-08: a
+ * secret in a shipped template would be installed into every new project. It is a regex scan of
+ * the content, not a digest, so the paragraph above still holds.
+ *
+ * Since task-196 it also checks the built-in agent adapter manifests `init` installs under
+ * `.wingfoil/agents/built-in/` (kind `adapter`, `spec-016` §2.1), against the task-177 manifest schema.
+ *
  * A cross-pillar concern by construction — checking a directive source needs the Directives pillar's
  * `DirectiveFrontmatter` schema, checking a workflow source needs the Workflow pillar's `Workflow`
- * schema — so, per `src/core/loaders.ts`'s own precedent ("Cross-file concerns ... need the caller to
+ * schema and its loader rules, an adapter source the `agent` module's manifest parser — so, per `src/core/loaders.ts`'s own precedent ("Cross-file concerns ... need the caller to
  * have actually loaded the referenced files ... live in the loader, not [a pillar] schema module"),
  * this lives in `core`, not in either pillar module or in `storage` (which only carries the raw
  * {@link BuiltinTemplateSource} shape — see `src/storage/templates.ts`). Reuses the exact same
@@ -30,10 +38,12 @@ exports.verifyBuiltinTemplates = verifyBuiltinTemplates;
  * randomness) — the same corrupted input always yields the same failure, and callers may pass a
  * fixture list in tests via {@link BuiltinTemplateSource} without touching disk.
  */
+const manifest_1 = require("../agent/manifest");
 const schema_1 = require("../directives/schema");
 const storage_1 = require("../storage");
 const validation_1 = require("../validation");
 const schema_2 = require("../workflow/schema");
+const workflow_diagnostics_1 = require("./workflow-diagnostics");
 /**
  * `true` iff `source.content` parses as a `.md` document with a frontmatter block that validates
  * against `DirectiveFrontmatter` (the same schema `core/loaders.ts`'s `loadDirectives` runs custom
@@ -55,13 +65,41 @@ function isValidDirectiveSource(source) {
     }
 }
 /**
- * `true` iff `source.content` parses as YAML and validates against the `Workflow` schema (the same
- * schema `core/loaders.ts`'s `loadWorkflowsYaml` runs every included workflow file through).
+ * `true` iff `source.content` parses as YAML, validates against the `Workflow` schema (the same
+ * schema `core/loaders.ts`'s `loadWorkflowsYaml` runs every included workflow file through), and
+ * raises no error under the loader's per-file rules (`workflowFileDiagnostics`, spec-003 §
+ * "Diagnostics") — so a template that passes integrity also loads (task-196, `bug-183`: a template
+ * with neither `kind` nor `startable`/`includable` used to pass here and be refused by the loader).
+ *
+ * The template is checked as the only file of a registry whose names are NOT complete: a rule that
+ * needs another file (an `include` naming a workflow outside the template) is undecidable here, and
+ * the loader's own rule is to report nothing it cannot decide. Warnings never fail it, as they never
+ * fail a load.
  */
 function isValidWorkflowSource(source) {
+    let workflow;
     try {
-        const data = (0, validation_1.parseYaml)(source.content, source.name);
-        (0, validation_1.runValidation)(schema_2.Workflow, data, source.name);
+        workflow = (0, validation_1.runValidation)(schema_2.Workflow, (0, validation_1.parseYaml)(source.content, source.name), source.name);
+    }
+    catch {
+        return false;
+    }
+    const index = { byName: new Map([[workflow.name, 0]]), namesComplete: false };
+    const loaded = [{ file: source.name, workflow, rawName: workflow.name }];
+    return !(0, workflow_diagnostics_1.workflowFileDiagnostics)(loaded, index, 0).some((diagnostic) => diagnostic.severity === 'error');
+}
+/**
+ * `true` iff `source.content` is a valid BUILT-IN adapter manifest (`spec-016` §2.2–§2.3, task-196):
+ * the task-177 parser `loadAdapter` runs, with kind `built-in` (so `verified_with` is required) and
+ * the source's name as the file basename the manifest's `name` must equal.
+ */
+function isValidAdapterSource(source) {
+    try {
+        (0, manifest_1.parseAdapterManifest)(source.content, {
+            name: source.name,
+            kind: 'built-in',
+            file: `${storage_1.BUILTIN_ADAPTERS_DIR}/${source.name}.yaml`,
+        });
         return true;
     }
     catch {
@@ -72,8 +110,9 @@ function isValidWorkflowSource(source) {
  * Per-kind schema-check policy: the `isValid` predicate to apply and the exact REQ-SEC-10 abort-message
  * builder to use when it fails. Keyed by {@link BuiltinTemplateKind} so each kind's validator and its
  * BDD wording live together and `verifyBuiltinTemplates` branches on `kind` exactly once. The message
- * strings are verbatim BDD contracts — P3.8 "Error - a built-in template fails its integrity check"
- * and P4.17 "Error - a built-in workflow template is structurally invalid" — do not reword.
+ * strings of the first two kinds are verbatim BDD contracts — P3.8 "Error - a built-in template fails
+ * its integrity check" and P4.17 "Error - a built-in workflow template is structurally invalid" — do
+ * not reword. The `adapter` kind (task-196) follows the directive message's shape.
  *
  * Declared as an EXHAUSTIVE `Record` so widening {@link BuiltinTemplateKind} is a compile error until
  * the new kind gets a policy; look it up only through {@link policyFor}, never by bare indexing.
@@ -87,6 +126,11 @@ const INTEGRITY_POLICY = {
         isValid: isValidWorkflowSource,
         message: (name) => `built-in workflow template invalid: ${name}`,
     },
+    // task-196: the built-in directive's message shape; no BDD scenario pins this wording yet.
+    adapter: {
+        isValid: isValidAdapterSource,
+        message: (name) => `built-in adapter template integrity check failed: ${name}`,
+    },
 };
 /**
  * The REQ-SEC-10 message for a source whose `kind` has no policy — the fail-closed branch. Not a BDD
@@ -112,8 +156,32 @@ function policyFor(kind) {
     return Object.prototype.hasOwnProperty.call(INTEGRITY_POLICY, kind) ? INTEGRITY_POLICY[kind] : undefined;
 }
 /**
- * Schema-check every `sources` entry, in list order (REQ-SYS-07: deterministic, no unordered
- * iteration), and return the FIRST one that fails — or `null` when every source is valid (including
+ * The spec-007 §4 step 5 secret scan of one built-in source (task-135, `bug-038`): `null` when the
+ * content carries no `blocking` finding, otherwise a failure naming the template and the FIRST
+ * blocking finding's `pattern_id` and line (`scanText` reports findings in line order, then in the
+ * declared pattern order, so the choice is deterministic, REQ-SYS-07).
+ *
+ * The scan runs on the source's content exactly as it would be written, with the §3 exclusions
+ * `scanText` applies (fenced examples, placeholder values) and no `security-ignore` list: an ignore
+ * file belongs to the project being initialized, which does not exist yet. `warn` findings never
+ * fail it (§4 step 6), and they are not surfaced: `init` has no warning channel, and a built-in
+ * template is not the operator's to review.
+ */
+function secretScanFailure(source) {
+    const [finding] = (0, validation_1.scanText)(source.content, source.name).blocking;
+    if (finding === undefined)
+        return null;
+    return {
+        name: source.name,
+        kind: source.kind,
+        patternId: finding.patternId,
+        message: `built-in ${source.kind} template secret scan failed: ${source.name} ` +
+            `(${finding.patternId}, line ${finding.line})`,
+    };
+}
+/**
+ * Schema-check, then secret-scan, every `sources` entry, in list order (REQ-SYS-07: deterministic,
+ * no unordered iteration), and return the FIRST one that fails — or `null` when every source is valid (including
  * the trivial, always-passing case of an empty list, which is what `src/storage/templates.ts`'s
  * `builtinTemplateSources` derives from the P1.1 minimal skeleton, whose built-in directory holds only
  * a `.gitkeep`; `templateScaffold` yields the six P3.8 built-in directives since
@@ -123,6 +191,11 @@ function policyFor(kind) {
  * reported as a failure ({@link unknownKindMessage}) rather than skipped or thrown on — it cannot be
  * checked, so it must not be installed.
  *
+ * The secret scan ({@link secretScanFailure}) is spec-007 §4 step 5's "additional integrity gate run
+ * in the same pre-write pass" (task-135, `bug-038`): a source that passes its schema check but
+ * carries a `blocking` spec-007 §2 finding fails too, naming the template and the `pattern_id`. A
+ * source is scanned only once its schema check has passed, so each source reports one failure.
+ *
  * Callers — `initWingfoilProject` AND `initWingfoilStorage`, both in `src/core/init.ts`; every
  * `initStorage` write path there is one — MUST run this before writing any file: REQ-SEC-10's fit
  * criterion requires the abort to happen "before writing partial assets". This function itself never
@@ -142,6 +215,9 @@ function verifyBuiltinTemplates(sources) {
         if (!policy.isValid(source)) {
             return { name: source.name, kind: source.kind, message: policy.message(source.name) };
         }
+        const secret = secretScanFailure(source);
+        if (secret !== null)
+            return secret;
     }
     return null;
 }

package/dist/core/builtin-integrity.js.map

@@ -1 +1 @@
-{"version":3,"file":"builtin-integrity.js","sourceRoot":"","sources":["../../src/core/builtin-integrity.ts"],"names":[],"mappings":";;AAsJA,wDAiBC;AAvKD;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AACH,iDAA4D;AAC5D,wCAAsG;AACtG,8CAAyD;AACzD,+CAA8C;AAe9C;;;;;;GAMG;AACH,SAAS,sBAAsB,CAAC,MAA6B;IAC3D,MAAM,eAAe,GAAG,IAAA,4BAAkB,EAAC,MAAM,CAAC,OAAO,CAAC,CAAC;IAC3D,IAAI,eAAe,KAAK,IAAI;QAAE,OAAO,KAAK,CAAC;IAC3C,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,IAAA,sBAAS,EAAC,eAAe,EAAE,MAAM,CAAC,IAAI,CAAC,CAAC;QACrD,IAAA,0BAAa,EAAC,6BAAoB,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,CAAC,CAAC;QACvD,OAAO,IAAI,CAAC;IACd,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED;;;GAGG;AACH,SAAS,qBAAqB,CAAC,MAA6B;IAC1D,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,IAAA,sBAAS,EAAC,MAAM,CAAC,OAAO,EAAE,MAAM,CAAC,IAAI,CAAC,CAAC;QACpD,IAAA,0BAAa,EAAC,iBAAQ,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,CAAC,CAAC;QAC3C,OAAO,IAAI,CAAC;IACd,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAQD;;;;;;;;;GASG;AACH,MAAM,gBAAgB,GAA2D;IAC/E,SAAS,EAAE;QACT,OAAO,EAAE,sBAAsB;QAC/B,OAAO,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,uDAAuD,IAAI,EAAE;KACjF;IACD,QAAQ,EAAE;QACR,OAAO,EAAE,qBAAqB;QAC9B,OAAO,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,uCAAuC,IAAI,EAAE;KACjE;CACF,CAAC;AAEF;;;;;GAKG;AACH,SAAS,kBAAkB,CAAC,IAAY,EAAE,IAAY;IACpD,OAAO,6CAA6C,IAAI,wBAAwB,IAAI,IAAI,CAAC;AAC3F,CAAC;AAED;;;;;;;;;;GAUG;AACH,SAAS,SAAS,CAAC,IAAyB;IAC1C,OAAO,MAAM,CAAC,SAAS,CAAC,cAAc,CAAC,IAAI,CAAC,gBAAgB,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC,gBAAgB,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;AAC3G,CAAC;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,SAAgB,sBAAsB,CACpC,OAAyC;IAEzC,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;QAC7B,MAAM,MAAM,GAAG,SAAS,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;QACtC,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;YACzB,OAAO;gBACL,IAAI,EAAE,MAAM,CAAC,IAAI;gBACjB,IAAI,EAAE,MAAM,CAAC,IAAI;gBACjB,OAAO,EAAE,kBAAkB,CAAC,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;aAC9D,CAAC;QACJ,CAAC;QACD,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;YAC5B,OAAO,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,OAAO,EAAE,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC;QACxF,CAAC;IACH,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC"}
+{"version":3,"file":"builtin-integrity.js","sourceRoot":"","sources":["../../src/core/builtin-integrity.ts"],"names":[],"mappings":";;AAsOA,wDAmBC;AAzPD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAoCG;AACH,gDAAyD;AACzD,iDAA4D;AAC5D,wCAA4H;AAC5H,8CAAmE;AACnE,+CAA8C;AAE9C,iEAAiE;AAoBjE;;;;;;GAMG;AACH,SAAS,sBAAsB,CAAC,MAA6B;IAC3D,MAAM,eAAe,GAAG,IAAA,4BAAkB,EAAC,MAAM,CAAC,OAAO,CAAC,CAAC;IAC3D,IAAI,eAAe,KAAK,IAAI;QAAE,OAAO,KAAK,CAAC;IAC3C,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,IAAA,sBAAS,EAAC,eAAe,EAAE,MAAM,CAAC,IAAI,CAAC,CAAC;QACrD,IAAA,0BAAa,EAAC,6BAAoB,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,CAAC,CAAC;QACvD,OAAO,IAAI,CAAC;IACd,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED;;;;;;;;;;;GAWG;AACH,SAAS,qBAAqB,CAAC,MAA6B;IAC1D,IAAI,QAAkB,CAAC;IACvB,IAAI,CAAC;QACH,QAAQ,GAAG,IAAA,0BAAa,EAAC,iBAAQ,EAAE,IAAA,sBAAS,EAAC,MAAM,CAAC,OAAO,EAAE,MAAM,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC,IAAI,CAAC,CAAC;IAC1F,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;IACD,MAAM,KAAK,GAAG,EAAE,MAAM,EAAE,IAAI,GAAG,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,KAAK,EAAE,CAAC;IAC9E,MAAM,MAAM,GAAG,CAAC,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,QAAQ,CAAC,IAAI,EAAE,CAAC,CAAC;IACzE,OAAO,CAAC,IAAA,8CAAuB,EAAC,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,UAAU,EAAE,EAAE,CAAC,UAAU,CAAC,QAAQ,KAAK,OAAO,CAAC,CAAC;AAC1G,CAAC;AAED;;;;GAIG;AACH,SAAS,oBAAoB,CAAC,MAA6B;IACzD,IAAI,CAAC;QACH,IAAA,+BAAoB,EAAC,MAAM,CAAC,OAAO,EAAE;YACnC,IAAI,EAAE,MAAM,CAAC,IAAI;YACjB,IAAI,EAAE,UAAU;YAChB,IAAI,EAAE,GAAG,8BAAoB,IAAI,MAAM,CAAC,IAAI,OAAO;SACpD,CAAC,CAAC;QACH,OAAO,IAAI,CAAC;IACd,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAQD;;;;;;;;;;GAUG;AACH,MAAM,gBAAgB,GAA2D;IAC/E,SAAS,EAAE;QACT,OAAO,EAAE,sBAAsB;QAC/B,OAAO,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,uDAAuD,IAAI,EAAE;KACjF;IACD,QAAQ,EAAE;QACR,OAAO,EAAE,qBAAqB;QAC9B,OAAO,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,uCAAuC,IAAI,EAAE;KACjE;IACD,2FAA2F;IAC3F,OAAO,EAAE;QACP,OAAO,EAAE,oBAAoB;QAC7B,OAAO,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,qDAAqD,IAAI,EAAE;KAC/E;CACF,CAAC;AAEF;;;;;GAKG;AACH,SAAS,kBAAkB,CAAC,IAAY,EAAE,IAAY;IACpD,OAAO,6CAA6C,IAAI,wBAAwB,IAAI,IAAI,CAAC;AAC3F,CAAC;AAED;;;;;;;;;;GAUG;AACH,SAAS,SAAS,CAAC,IAAyB;IAC1C,OAAO,MAAM,CAAC,SAAS,CAAC,cAAc,CAAC,IAAI,CAAC,gBAAgB,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC,gBAAgB,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;AAC3G,CAAC;AAED;;;;;;;;;;;GAWG;AACH,SAAS,iBAAiB,CAAC,MAA6B;IACtD,MAAM,CAAC,OAAO,CAAC,GAAG,IAAA,qBAAQ,EAAC,MAAM,CAAC,OAAO,EAAE,MAAM,CAAC,IAAI,CAAC,CAAC,QAAQ,CAAC;IACjE,IAAI,OAAO,KAAK,SAAS;QAAE,OAAO,IAAI,CAAC;IACvC,OAAO;QACL,IAAI,EAAE,MAAM,CAAC,IAAI;QACjB,IAAI,EAAE,MAAM,CAAC,IAAI;QACjB,SAAS,EAAE,OAAO,CAAC,SAAS;QAC5B,OAAO,EACL,YAAY,MAAM,CAAC,IAAI,iCAAiC,MAAM,CAAC,IAAI,GAAG;YACtE,IAAI,OAAO,CAAC,SAAS,UAAU,OAAO,CAAC,IAAI,GAAG;KACjD,CAAC;AACJ,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,SAAgB,sBAAsB,CACpC,OAAyC;IAEzC,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;QAC7B,MAAM,MAAM,GAAG,SAAS,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;QACtC,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;YACzB,OAAO;gBACL,IAAI,EAAE,MAAM,CAAC,IAAI;gBACjB,IAAI,EAAE,MAAM,CAAC,IAAI;gBACjB,OAAO,EAAE,kBAAkB,CAAC,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;aAC9D,CAAC;QACJ,CAAC;QACD,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;YAC5B,OAAO,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,OAAO,EAAE,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC;QACxF,CAAC;QACD,MAAM,MAAM,GAAG,iBAAiB,CAAC,MAAM,CAAC,CAAC;QACzC,IAAI,MAAM,KAAK,IAAI;YAAE,OAAO,MAAM,CAAC;IACrC,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC"}

package/dist/core/confinement.d.ts

@@ -22,7 +22,9 @@ import { type CoreResult } from './types';
  * does not ask.
  *
  * @param root - Project root.
- * @param relativePath - Root-relative POSIX path of the file the operation is about to touch.
+ * @param relativePath - The path of the file the operation is about to touch, as the refusal should
+ *   name it: root-relative POSIX, or absolute (resolved as is) — the run log passes its configured
+ *   `paths.runs` spelling, so a refusal names `/etc/<id>.jsonl` rather than a `../` climb (bug-288).
  * @param action - The verb for the refusal's first clause, e.g. `'remove'` → `cannot remove '<path>'`
  *   (P3.3's own message shape, shared with `requireCustomAsset`).
  */

package/dist/core/confinement.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"confinement.d.ts","sourceRoot":"","sources":["../../src/core/confinement.ts"],"names":[],"mappings":"AAgCA,OAAO,EAAmB,KAAK,UAAU,EAAE,MAAM,SAAS,CAAC;AAE3D;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AACH,wBAAgB,qBAAqB,CACnC,IAAI,EAAE,MAAM,EACZ,YAAY,EAAE,MAAM,EACpB,MAAM,EAAE,MAAM,GACb,UAAU,CAAC,IAAI,CAAC,CAUlB;AAED;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,wBAAgB,0BAA0B,CACxC,IAAI,EAAE,MAAM,EACZ,YAAY,EAAE,MAAM,EACpB,MAAM,EAAE,MAAM,GACb,UAAU,CAAC,IAAI,CAAC,CAKlB"}
+{"version":3,"file":"confinement.d.ts","sourceRoot":"","sources":["../../src/core/confinement.ts"],"names":[],"mappings":"AAiCA,OAAO,EAAmB,KAAK,UAAU,EAAE,MAAM,SAAS,CAAC;AAE3D;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AACH,wBAAgB,qBAAqB,CACnC,IAAI,EAAE,MAAM,EACZ,YAAY,EAAE,MAAM,EACpB,MAAM,EAAE,MAAM,GACb,UAAU,CAAC,IAAI,CAAC,CAUlB;AAED;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,wBAAgB,0BAA0B,CACxC,IAAI,EAAE,MAAM,EACZ,YAAY,EAAE,MAAM,EACpB,MAAM,EAAE,MAAM,GACb,UAAU,CAAC,IAAI,CAAC,CAKlB"}

package/dist/core/confinement.js

@@ -24,9 +24,10 @@ exports.requireConfinedWriteTarget = requireConfinedWriteTarget;
  * have prevented; the refusal has to land before the filesystem is touched at all.
  *
  * **Baseline.** This guard resolves against the **working tree**, not `HEAD`, and that is deliberate
- * — a departure from the `command-baseline` directive's read half, argued (as that directive
- * requires) in `task-102`'s Execution Notes and in the decision-log filed from them, never settled
- * here. The one-line reason: what this predicts is where `unlinkSync` — or, on the write path,
+ * — the filesystem-effect read the `command-baseline` directive and `spec-006-core-domain-api` §6
+ * declare, argued in `task-102`'s Execution Notes and ratified in
+ * `dl-086-a-guard-over-a-filesystem-effect-resolves-on-the-filesystem`, never settled here. The
+ * one-line reason: what this predicts is where `unlinkSync` — or, on the write path,
  * `writeFileSync` — will land, and both follow the symlinks that are on disk, not the ones a commit
  * records.
  */
@@ -56,7 +57,9 @@ const types_1 = require("./types");
  * does not ask.
  *
  * @param root - Project root.
- * @param relativePath - Root-relative POSIX path of the file the operation is about to touch.
+ * @param relativePath - The path of the file the operation is about to touch, as the refusal should
+ *   name it: root-relative POSIX, or absolute (resolved as is) — the run log passes its configured
+ *   `paths.runs` spelling, so a refusal names `/etc/<id>.jsonl` rather than a `../` climb (bug-288).
  * @param action - The verb for the refusal's first clause, e.g. `'remove'` → `cannot remove '<path>'`
  *   (P3.3's own message shape, shared with `requireCustomAsset`).
  */

package/dist/core/confinement.js.map

@@ -1 +1 @@
-{"version":3,"file":"confinement.js","sourceRoot":"","sources":["../../src/core/confinement.ts"],"names":[],"mappings":";;AA6DA,sDAcC;AA4BD,gEASC;AAhHD;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AACH,yCAAiC;AAEjC,wDAAsG;AAEtG,mCAA2D;AAE3D;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AACH,SAAgB,qBAAqB,CACnC,IAAY,EACZ,YAAoB,EACpB,MAAc;IAEd,MAAM,QAAQ,GAAG,IAAA,mCAAqB,EAAC,IAAI,EAAE,YAAY,CAAC,CAAC;IAC3D,IAAI,QAAQ,CAAC,MAAM;QAAE,OAAO,IAAA,cAAM,EAAO,SAAS,CAAC,CAAC;IACpD,OAAO,IAAA,eAAO,EAAC;QACb,IAAI,EAAE,YAAY;QAClB,OAAO,EACL,UAAU,MAAM,KAAK,YAAY,sBAAsB,QAAQ,CAAC,IAAI,+BAA+B;YACnG,qGAAqG;YACrG,0DAA0D;KAC7D,CAAC,CAAC;AACL,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,SAAgB,0BAA0B,CACxC,IAAY,EACZ,YAAoB,EACpB,MAAc;IAEd,MAAM,QAAQ,GAAG,qBAAqB,CAAC,IAAI,EAAE,YAAY,EAAE,MAAM,CAAC,CAAC;IACnE,IAAI,CAAC,QAAQ,CAAC,EAAE;QAAE,OAAO,QAAQ,CAAC;IAClC,IAAI,CAAC,IAAA,6BAAe,EAAC,IAAA,gBAAI,EAAC,IAAI,EAAE,YAAY,CAAC,CAAC;QAAE,OAAO,IAAA,cAAM,EAAO,SAAS,CAAC,CAAC;IAC/E,OAAO,IAAA,eAAO,EAAC,EAAE,IAAI,EAAE,YAAY,EAAE,OAAO,EAAE,IAAA,kCAAoB,EAAC,MAAM,EAAE,YAAY,CAAC,EAAE,CAAC,CAAC;AAC9F,CAAC"}
+{"version":3,"file":"confinement.js","sourceRoot":"","sources":["../../src/core/confinement.ts"],"names":[],"mappings":";;AAgEA,sDAcC;AA4BD,gEASC;AAnHD;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AACH,yCAAiC;AAEjC,wDAAsG;AAEtG,mCAA2D;AAE3D;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AACH,SAAgB,qBAAqB,CACnC,IAAY,EACZ,YAAoB,EACpB,MAAc;IAEd,MAAM,QAAQ,GAAG,IAAA,mCAAqB,EAAC,IAAI,EAAE,YAAY,CAAC,CAAC;IAC3D,IAAI,QAAQ,CAAC,MAAM;QAAE,OAAO,IAAA,cAAM,EAAO,SAAS,CAAC,CAAC;IACpD,OAAO,IAAA,eAAO,EAAC;QACb,IAAI,EAAE,YAAY;QAClB,OAAO,EACL,UAAU,MAAM,KAAK,YAAY,sBAAsB,QAAQ,CAAC,IAAI,+BAA+B;YACnG,qGAAqG;YACrG,0DAA0D;KAC7D,CAAC,CAAC;AACL,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,SAAgB,0BAA0B,CACxC,IAAY,EACZ,YAAoB,EACpB,MAAc;IAEd,MAAM,QAAQ,GAAG,qBAAqB,CAAC,IAAI,EAAE,YAAY,EAAE,MAAM,CAAC,CAAC;IACnE,IAAI,CAAC,QAAQ,CAAC,EAAE;QAAE,OAAO,QAAQ,CAAC;IAClC,IAAI,CAAC,IAAA,6BAAe,EAAC,IAAA,gBAAI,EAAC,IAAI,EAAE,YAAY,CAAC,CAAC;QAAE,OAAO,IAAA,cAAM,EAAO,SAAS,CAAC,CAAC;IAC/E,OAAO,IAAA,eAAO,EAAC,EAAE,IAAI,EAAE,YAAY,EAAE,OAAO,EAAE,IAAA,kCAAoB,EAAC,MAAM,EAAE,YAAY,CAAC,EAAE,CAAC,CAAC;AAC9F,CAAC"}