@aligndottech/cli 0.48.0 → 0.50.0

package/dist/lib/share/secret-patterns.json

@@ -0,0 +1,100 @@
+{
+    "case_insensitive": [
+        [
+            "([a-zA-Z][a-zA-Z0-9+.\\-]{0,31}://)[^/\\s:@]+:[^/\\s:@]+@",
+            "\\1<URL_CREDENTIALS>@"
+        ],
+        [
+            "(?<![\\w@.:/])[A-Za-z][\\w.\\-]{1,30}:(?![/\\s])(?!v?\\d[\\d.]*(?:-[a-z0-9][a-z0-9.\\-]*)?(?![^\\s:@/]))(?=[^\\s:@/]*[A-Za-z])(?=[^\\s:@/]*\\d)[^\\s:@/]{8,}",
+            "<CREDENTIALS>"
+        ],
+        [
+            "AKIA[0-9A-Z]{16}",
+            "<AWS_ACCESS_KEY>"
+        ],
+        [
+            "ghp_[a-zA-Z0-9]{36}",
+            "<GITHUB_TOKEN>"
+        ],
+        [
+            "github_pat_[a-zA-Z0-9]{22}_[a-zA-Z0-9]{59}",
+            "<GITHUB_TOKEN>"
+        ],
+        [
+            "sk-[a-zA-Z0-9]{48}",
+            "<OPENAI_KEY>"
+        ],
+        [
+            "sk-ant-[a-zA-Z0-9\\-]{95,}",
+            "<ANTHROPIC_KEY>"
+        ],
+        [
+            "(?<![A-Za-z0-9])eyJ(?:[A-Za-z0-9_\\-]|\\r?\\n){10,}(?:\\s*(?:\\.|%2E)\\s*(?:[A-Za-z0-9_\\-]|\\r?\\n){10,}){2}",
+            "<JWT>"
+        ],
+        [
+            "(?<![A-Za-z0-9])sk-(?=[A-Za-z0-9_\\-]*\\d)[A-Za-z0-9_\\-]{20,}",
+            "<OPENAI_KEY>"
+        ],
+        [
+            "(?<![A-Za-z0-9])[sr]k_(?:live|test)_[A-Za-z0-9]{16,}",
+            "<STRIPE_KEY>"
+        ],
+        [
+            "(?<![A-Za-z0-9])AIza[0-9A-Za-z_\\-]{35}",
+            "<GOOGLE_API_KEY>"
+        ],
+        [
+            "((?:aws[_\\-\\s]*secret(?:[_\\-\\s]*access)?(?:[_\\-\\s]*key)?|secret[_\\-\\s]*access[_\\-\\s]*key)[\\\"'\\s:=]+)[A-Za-z0-9/+]{40}(?![A-Za-z0-9/+])",
+            "\\1<AWS_SECRET_KEY>"
+        ],
+        [
+            "xox[baprs]-[0-9]{10,13}-[0-9]{10,13}-[a-zA-Z0-9]{24,}",
+            "<SLACK_TOKEN>"
+        ],
+        [
+            "(?<![A-Za-z0-9])xox[a-z](?:\\.xox[a-z])?-[A-Za-z0-9\\-]{20,}",
+            "<SLACK_TOKEN>"
+        ],
+        [
+            "(?<![A-Za-z0-9])lin_api_[A-Za-z0-9]{32,}",
+            "<LINEAR_KEY>"
+        ],
+        [
+            "(?<![A-Za-z0-9])gh[ousr]_[A-Za-z0-9]{36}",
+            "<GITHUB_TOKEN>"
+        ],
+        [
+            "(?<![A-Za-z0-9])glpat-[A-Za-z0-9_\\-]{20,}",
+            "<GITLAB_TOKEN>"
+        ],
+        [
+            "api[_-]?key[\"\\s:=]+[\"\\']?([a-zA-Z0-9_\\-]{20,})[\"\\']?",
+            "<API_KEY>"
+        ],
+        [
+            "bearer\\s+[a-zA-Z0-9\\-._~+/]{20,}=*",
+            "<BEARER_TOKEN>"
+        ],
+        [
+            "-----BEGIN ((?:[A-Z0-9]{1,20} ){0,4})PRIVATE KEY(?: BLOCK)?-----(?:[A-Za-z0-9+/=\\s:,.]{0,16384}-----END \\1PRIVATE KEY(?: BLOCK)?-----)?",
+            "<PRIVATE_KEY>"
+        ],
+        [
+            "([?&](?:token|access_token|id_token|refresh_token|api_key|apikey|secret|client_secret|password|passwd|pwd|passcode|sig|signature|x-amz-signature|x-amz-credential)=)(?=[^&\\s\\\"'<>#]{0,100}\\d)[^&\\s\\\"'<>#]{8,}",
+            "\\1<URL_SECRET_PARAM>"
+        ],
+        [
+            "((?<![A-Za-z0-9])(?<!page_)(?<!page-)(?:password|passwd|secret|token)[\\\"']?[ \\t]*[:=][ \\t]*[\\\"']?)(?!\\$|\\{\\{|%\\(|v?\\d+\\.\\d|[a-z_]+=\\d|[A-Za-z_][\\w.]*\\()(?![^\\s\\\"'<>,;&]{0,64}\\d{4}-\\d\\d-\\d\\d)(?=[^\\s\\\"'<>,;&]{0,100}[A-Za-z])(?=[^\\s\\\"'<>,;&]{0,100}(?:[!@#$%^*]|\\d[^\\s\\\"'<>,;&]{0,100}\\d))[^\\s\\\"'<>,;&]{8,}",
+            "\\1<SECRET_VALUE>"
+        ]
+    ],
+    "case_sensitive": [
+        [
+            "(\\b[A-Z0-9_]*(?:PASSWORD|PASSWD|SECRET|TOKEN)[A-Z0-9_]*\\s*=\\s*[\\\"']?)(?!(?<!')(?:\\$\\([^)\\\"'<>\\n]*\\)|\\$\\{[A-Z_][A-Z0-9_]*\\}|\\$[A-Z_][A-Z0-9_]*)(?![^\\s\\\"'<>]))(?=[^\\s\\\"']*[A-Za-z])[^\\s\\\"'<>]{6,}",
+            "\\1<SECRET_VALUE>"
+        ]
+    ],
+    "aws_bare_secret": "(?<![A-Za-z0-9/+])(?=[A-Za-z0-9/+]*[A-Z])(?=[A-Za-z0-9/+]*[a-z])(?=[A-Za-z0-9/+]*\\d)[A-Za-z0-9/+]{40}(?![A-Za-z0-9/+])",
+    "aws_context_chars": 100
+}

package/dist/lib/share/secret-scan.d.ts

@@ -0,0 +1,19 @@
+export interface SecretFinding {
+    /** Which field of the share held it: `title`, `summary`, `source_url`, `note`. */
+    field: string;
+    /** The placeholder the redactor would write, for example `<GITHUB_TOKEN>`. Never the match. */
+    placeholder: string;
+}
+/** Placeholder names found in `text`, each once, in pattern order. */
+export declare function secretsIn(text: string): string[];
+/** Scan every named field; one finding per (field, placeholder). */
+export declare function scanForSecrets(fields: Array<{
+    field: string;
+    text: string | null | undefined;
+}>): SecretFinding[];
+export declare function scanSourceUrl(url: string): SecretFinding[];
+export declare function scanHiddenText(fields: Array<{
+    field: string;
+    text: string | null | undefined;
+}>): SecretFinding[];
+//# sourceMappingURL=secret-scan.d.ts.map

package/dist/lib/share/secret-scan.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"secret-scan.d.ts","sourceRoot":"","sources":["../../../src/lib/share/secret-scan.ts"],"names":[],"mappings":"AAaA,MAAM,WAAW,aAAa;IAC5B,kFAAkF;IAClF,KAAK,EAAE,MAAM,CAAC;IACd,+FAA+F;IAC/F,WAAW,EAAE,MAAM,CAAC;CACrB;AAYD,sEAAsE;AACtE,wBAAgB,SAAS,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,EAAE,CAUhD;AAED,oEAAoE;AACpE,wBAAgB,cAAc,CAAC,MAAM,EAAE,KAAK,CAAC;IAAE,KAAK,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,CAAA;CAAE,CAAC,GAAG,aAAa,EAAE,CAOjH;AASD,wBAAgB,aAAa,CAAC,GAAG,EAAE,MAAM,GAAG,aAAa,EAAE,CAM1D;AASD,wBAAgB,cAAc,CAAC,MAAM,EAAE,KAAK,CAAC;IAAE,KAAK,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,CAAA;CAAE,CAAC,GAAG,aAAa,EAAE,CAEjH"}

package/dist/lib/share/secret-scan.js

@@ -0,0 +1,75 @@
+/**
+ * L9: the client-side secret scan for `align share`. Refuse and SHOW which kind of secret was found,
+ * never the secret itself: the match is not printed, logged or returned, only its placeholder name.
+ *
+ * `secret-patterns.json` is vendored byte for byte from align-stack `config/secret-patterns.json`
+ * (last changed in align-stack commit 292e07017). It is the same list brain redacts with and the
+ * gateway refuses on at POST /ingest/batch, so a share that passes here is not refused there for a
+ * credential shape. `share-secret-patterns.test.ts` pins the file's sha256 and one positive and one
+ * near-miss per newer shape; a pattern added server-side but not copied here only means the SERVER
+ * refuses a share this scan let through, so re-vendor the file and update that pin together.
+ */
+import patterns from './secret-patterns.json' with { type: 'json' };
+const placeholderOf = (replacement) => /<[A-Z0-9_]+>/.exec(replacement)?.[0] ?? '<SECRET>';
+const COMPILED = [
+    ...patterns.case_insensitive.map(([p, r]) => ({ re: new RegExp(p, 'i'), placeholder: placeholderOf(r) })),
+    ...patterns.case_sensitive.map(([p, r]) => ({ re: new RegExp(p), placeholder: placeholderOf(r) })),
+];
+const AWS_BARE = new RegExp(patterns.aws_bare_secret, 'g');
+const AWS_CONTEXT = patterns.aws_context_chars;
+/** Placeholder names found in `text`, each once, in pattern order. */
+export function secretsIn(text) {
+    const found = [];
+    for (const c of COMPILED)
+        if (c.re.test(text) && !found.includes(c.placeholder))
+            found.push(c.placeholder);
+    // The bare AWS secret shape is only a secret near the word "aws", exactly as the server decides.
+    AWS_BARE.lastIndex = 0;
+    for (let m = AWS_BARE.exec(text); m; m = AWS_BARE.exec(text)) {
+        const near = text.slice(Math.max(0, m.index - AWS_CONTEXT), m.index + m[0].length + AWS_CONTEXT).toLowerCase();
+        if (near.includes('aws') && !found.includes('<AWS_SECRET_KEY>'))
+            found.push('<AWS_SECRET_KEY>');
+    }
+    return found;
+}
+/** Scan every named field; one finding per (field, placeholder). */
+export function scanForSecrets(fields) {
+    const out = [];
+    for (const f of fields) {
+        if (!f.text)
+            continue;
+        for (const placeholder of secretsIn(f.text))
+            out.push({ field: f.field, placeholder });
+    }
+    return out;
+}
+/**
+ * Query parameters that carry a secret in the URL itself (a Zoom `pwd`, a signed link's signature, a token).
+ * The decision's URL is sent and shown, so one of these is refused like a token in the text, never stripped:
+ * stripping would change which item the URL names. The VALUE is never reported, only the parameter name.
+ */
+const SECRET_PARAMS = /^(?:token|access[_-]?token|id[_-]?token|refresh[_-]?token|api[_-]?key|apikey|secret|client[_-]?secret|password|passwd|pwd|passcode|sig|signature|x-amz-signature|x-amz-credential|auth|authorization)$/i;
+export function scanSourceUrl(url) {
+    let parsed;
+    try {
+        parsed = new URL(url);
+    }
+    catch {
+        return [];
+    }
+    const names = new Set();
+    for (const [k, v] of parsed.searchParams)
+        if (v !== '' && SECRET_PARAMS.test(k))
+            names.add(k.toLowerCase());
+    return [...names].map((n) => ({ field: `source_url (parameter ${n})`, placeholder: '<URL_SECRET_PARAM>' }));
+}
+/**
+ * Tag characters (U+E0000-E007F) render as nothing but a model reads them as text, so they can hide an
+ * instruction inside a title or note. The secret scan cannot see them and a person cannot either, so a share
+ * containing one is refused (naming the field) rather than sent.
+ */
+const HIDDEN = /[\u{E0000}-\u{E007F}]/u;
+export function scanHiddenText(fields) {
+    return fields.filter((f) => f.text && HIDDEN.test(f.text)).map((f) => ({ field: f.field, placeholder: '<HIDDEN_TEXT>' }));
+}
+//# sourceMappingURL=secret-scan.js.map

package/dist/lib/share/secret-scan.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"secret-scan.js","sourceRoot":"","sources":["../../../src/lib/share/secret-scan.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AACH,OAAO,QAAQ,MAAM,wBAAwB,CAAC,OAAO,IAAI,EAAE,MAAM,EAAE,CAAC;AASpE,MAAM,aAAa,GAAG,CAAC,WAAmB,EAAU,EAAE,CAAC,cAAc,CAAC,IAAI,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,UAAU,CAAC;AAG3G,MAAM,QAAQ,GAAe;IAC3B,GAAG,QAAQ,CAAC,gBAAgB,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,EAAE,EAAE,IAAI,MAAM,CAAC,CAAW,EAAE,GAAG,CAAC,EAAE,WAAW,EAAE,aAAa,CAAC,CAAW,CAAC,EAAE,CAAC,CAAC;IAC7H,GAAG,QAAQ,CAAC,cAAc,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,EAAE,EAAE,IAAI,MAAM,CAAC,CAAW,CAAC,EAAE,WAAW,EAAE,aAAa,CAAC,CAAW,CAAC,EAAE,CAAC,CAAC;CACvH,CAAC;AACF,MAAM,QAAQ,GAAG,IAAI,MAAM,CAAC,QAAQ,CAAC,eAAe,EAAE,GAAG,CAAC,CAAC;AAC3D,MAAM,WAAW,GAAG,QAAQ,CAAC,iBAAiB,CAAC;AAE/C,sEAAsE;AACtE,MAAM,UAAU,SAAS,CAAC,IAAY;IACpC,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,KAAK,MAAM,CAAC,IAAI,QAAQ;QAAE,IAAI,CAAC,CAAC,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC,WAAW,CAAC;YAAE,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC;IAC3G,iGAAiG;IACjG,QAAQ,CAAC,SAAS,GAAG,CAAC,CAAC;IACvB,KAAK,IAAI,CAAC,GAAG,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,CAAC,GAAG,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;QAC7D,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC,CAAC,KAAK,GAAG,WAAW,CAAC,EAAE,CAAC,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,GAAG,WAAW,CAAC,CAAC,WAAW,EAAE,CAAC;QAC/G,IAAI,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,kBAAkB,CAAC;YAAE,KAAK,CAAC,IAAI,CAAC,kBAAkB,CAAC,CAAC;IAClG,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,oEAAoE;AACpE,MAAM,UAAU,cAAc,CAAC,MAAiE;IAC9F,MAAM,GAAG,GAAoB,EAAE,CAAC;IAChC,KAAK,MAAM,CAAC,IAAI,MAAM,EAAE,CAAC;QACvB,IAAI,CAAC,CAAC,CAAC,IAAI;YAAE,SAAS;QACtB,KAAK,MAAM,WAAW,IAAI,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC;YAAE,GAAG,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,KAAK,EAAE,WAAW,EAAE,CAAC,CAAC;IACzF,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED;;;;GAIG;AACH,MAAM,aAAa,GAAG,yMAAyM,CAAC;AAEhO,MAAM,UAAU,aAAa,CAAC,GAAW;IACvC,IAAI,MAAW,CAAC;IAChB,IAAI,CAAC;QAAC,MAAM,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC;IAAC,CAAC;IAAC,MAAM,CAAC;QAAC,OAAO,EAAE,CAAC;IAAC,CAAC;IACnD,MAAM,KAAK,GAAG,IAAI,GAAG,EAAU,CAAC;IAChC,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,MAAM,CAAC,YAAY;QAAE,IAAI,CAAC,KAAK,EAAE,IAAI,aAAa,CAAC,IAAI,CAAC,CAAC,CAAC;YAAE,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC;IAC5G,OAAO,CAAC,GAAG,KAAK,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,KAAK,EAAE,yBAAyB,CAAC,GAAG,EAAE,WAAW,EAAE,oBAAoB,EAAE,CAAC,CAAC,CAAC;AAC9G,CAAC;AAED;;;;GAIG;AACH,MAAM,MAAM,GAAG,wBAAwB,CAAC;AAExC,MAAM,UAAU,cAAc,CAAC,MAAiE;IAC9F,OAAO,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,IAAI,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,KAAK,EAAE,WAAW,EAAE,eAAe,EAAE,CAAC,CAAC,CAAC;AAC5H,CAAC"}

package/dist/lib/share/tty.d.ts

@@ -0,0 +1,4 @@
+export type TtyPaths = readonly [input: string, output: string];
+export declare const TTY_PATHS: TtyPaths;
+export declare function ttyConfirm(shown: string, question: string, paths?: TtyPaths): Promise<boolean | null>;
+//# sourceMappingURL=tty.d.ts.map

package/dist/lib/share/tty.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"tty.d.ts","sourceRoot":"","sources":["../../../src/lib/share/tty.ts"],"names":[],"mappings":"AAkBA,MAAM,MAAM,QAAQ,GAAG,SAAS,CAAC,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,CAAC;AAChE,eAAO,MAAM,SAAS,EAAE,QAA0F,CAAC;AAEnH,wBAAsB,UAAU,CAAC,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,KAAK,GAAE,QAAoB,GAAG,OAAO,CAAC,OAAO,GAAG,IAAI,CAAC,CA4BtH"}

package/dist/lib/share/tty.js

@@ -0,0 +1,57 @@
+/**
+ * L9: ask a person a yes/no question on their CONTROLLING terminal, and prove it is one.
+ *
+ * Why not stdin: an agent's shell tool, a hook and a pipe all own stdin, so a "yes" read there proves
+ * nothing. `/dev/tty` (`CONIN$`/`CONOUT$` on Windows) is the terminal the process was started from; a
+ * process with no controlling terminal (a daemon, a `setsid` child, most agent shells) cannot open it.
+ * The handle must also pass `tty.isatty`: on Windows an open of CONIN$ can succeed against something
+ * that is not an interactive console, and "cannot prove it" means refuse, never block.
+ *
+ * The text a person must read is written to the SAME terminal just before the question, so it is the
+ * thing they see even when stdout is a pipe or a file. Returns true/false for y/n (default No, and end
+ * of input is No), or null when there is no interactive terminal. Honest limit, stated in SECURITY.md:
+ * a caller that allocates its own pseudo-terminal can type the answer; no local CLI can stop that.
+ */
+import fs from 'node:fs';
+import readline from 'node:readline';
+import tty from 'node:tty';
+export const TTY_PATHS = process.platform === 'win32' ? ['CONIN$', 'CONOUT$'] : ['/dev/tty', '/dev/tty'];
+export async function ttyConfirm(shown, question, paths = TTY_PATHS) {
+    let inFd = -1;
+    let outFd = -1;
+    try {
+        inFd = fs.openSync(paths[0], 'r');
+        outFd = fs.openSync(paths[1], 'w');
+        if (!tty.isatty(inFd) || !tty.isatty(outFd))
+            throw new Error('not an interactive terminal');
+    }
+    catch {
+        for (const fd of [inFd, outFd])
+            if (fd >= 0) {
+                try {
+                    fs.closeSync(fd);
+                }
+                catch { /* already closed */ }
+            }
+        return null;
+    }
+    // The tty streams own their descriptors from here: destroying them closes the fds, so no
+    // fs.closeSync of ours can race a readline that is still reading (the EBADF the review found).
+    const input = new tty.ReadStream(inFd);
+    const output = new tty.WriteStream(outFd);
+    const rl = readline.createInterface({ input, output, terminal: true });
+    try {
+        output.write(`${shown}\n\n`);
+        const answer = await new Promise((resolve) => {
+            rl.once('close', () => resolve(''));
+            rl.question(`${question} [y/N] `, resolve);
+        });
+        return /^y(es)?$/i.test(answer.trim());
+    }
+    finally {
+        rl.close();
+        input.destroy();
+        output.destroy();
+    }
+}
+//# sourceMappingURL=tty.js.map

package/dist/lib/share/tty.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"tty.js","sourceRoot":"","sources":["../../../src/lib/share/tty.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AACH,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,QAAQ,MAAM,eAAe,CAAC;AACrC,OAAO,GAAG,MAAM,UAAU,CAAC;AAG3B,MAAM,CAAC,MAAM,SAAS,GAAa,OAAO,CAAC,QAAQ,KAAK,OAAO,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,UAAU,EAAE,UAAU,CAAC,CAAC;AAEnH,MAAM,CAAC,KAAK,UAAU,UAAU,CAAC,KAAa,EAAE,QAAgB,EAAE,QAAkB,SAAS;IAC3F,IAAI,IAAI,GAAG,CAAC,CAAC,CAAC;IACd,IAAI,KAAK,GAAG,CAAC,CAAC,CAAC;IACf,IAAI,CAAC;QACH,IAAI,GAAG,EAAE,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;QAClC,KAAK,GAAG,EAAE,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;QACnC,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,KAAK,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,6BAA6B,CAAC,CAAC;IAC9F,CAAC;IAAC,MAAM,CAAC;QACP,KAAK,MAAM,EAAE,IAAI,CAAC,IAAI,EAAE,KAAK,CAAC;YAAE,IAAI,EAAE,IAAI,CAAC,EAAE,CAAC;gBAAC,IAAI,CAAC;oBAAC,EAAE,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC;gBAAC,CAAC;gBAAC,MAAM,CAAC,CAAC,oBAAoB,CAAC,CAAC;YAAC,CAAC;QACzG,OAAO,IAAI,CAAC;IACd,CAAC;IACD,yFAAyF;IACzF,+FAA+F;IAC/F,MAAM,KAAK,GAAG,IAAI,GAAG,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC;IACvC,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC;IAC1C,MAAM,EAAE,GAAG,QAAQ,CAAC,eAAe,CAAC,EAAE,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC;IACvE,IAAI,CAAC;QACH,MAAM,CAAC,KAAK,CAAC,GAAG,KAAK,MAAM,CAAC,CAAC;QAC7B,MAAM,MAAM,GAAG,MAAM,IAAI,OAAO,CAAS,CAAC,OAAO,EAAE,EAAE;YACnD,EAAE,CAAC,IAAI,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,CAAC;YACpC,EAAE,CAAC,QAAQ,CAAC,GAAG,QAAQ,SAAS,EAAE,OAAO,CAAC,CAAC;QAC7C,CAAC,CAAC,CAAC;QACH,OAAO,WAAW,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC;IACzC,CAAC;YAAS,CAAC;QACT,EAAE,CAAC,KAAK,EAAE,CAAC;QACX,KAAK,CAAC,OAAO,EAAE,CAAC;QAChB,MAAM,CAAC,OAAO,EAAE,CAAC;IACnB,CAAC;AACH,CAAC"}

package/dist/lib/share/visible.d.ts

@@ -0,0 +1,4 @@
+export declare function visible(text: string, opts?: {
+    keepNewline?: boolean;
+}): string;
+//# sourceMappingURL=visible.d.ts.map

package/dist/lib/share/visible.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"visible.d.ts","sourceRoot":"","sources":["../../../src/lib/share/visible.ts"],"names":[],"mappings":"AAoBA,wBAAgB,OAAO,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,GAAE;IAAE,WAAW,CAAC,EAAE,OAAO,CAAA;CAAO,GAAG,MAAM,CAOlF"}

package/dist/lib/share/visible.js

@@ -0,0 +1,30 @@
+/**
+ * L9: make every untrusted string safe to print on a terminal a person is about to answer.
+ *
+ * A decision's title, text, URL and notes come from sources other people write (a PR title, a Slack
+ * thread). Raw, they can carry ESC sequences that rewrite or clear the screen, a bare CR that overwrites
+ * the line above, or bidi overrides that reorder what is read, so the preview would show something other
+ * than what is sent. Each such character is replaced by a visible escape (`\x1b`, `‮`), never
+ * dropped: dropping would also hide that it was there.
+ *
+ * Covered, by Unicode category: controls (ESC, CR, tab, NUL, DEL, C1), every format character (bidi
+ * overrides and isolates, zero-width, soft hyphen, U+061C, the tag characters U+E0000-E007F), line and
+ * paragraph separators, default-ignorable code points (U+034F, U+180E, U+3164, U+FFF9-FFFB) and lone surrogates.
+ * `\n` is kept only when the caller asks (the indented body), because it cannot overwrite earlier text.
+ */
+// Unicode categories rather than hand-listed ranges (a hand-written list is guessing at published data):
+// Cc controls (ESC, CR, NUL, C1), Cf format (bidi marks and overrides, zero-width, soft hyphen, ALM, tag
+// characters U+E0000-E007F), Zl/Zp line and paragraph separators, Default_Ignorable_Code_Point (Hangul
+// fillers, U+034F, U+180E, interlinear annotation marks) and Cs, a lone surrogate (needs the u flag).
+const UNSAFE = /[\p{Cc}\p{Cf}\p{Zl}\p{Zp}\p{Default_Ignorable_Code_Point}]|\p{Cs}/gu;
+export function visible(text, opts = {}) {
+    return text.replace(UNSAFE, (c) => {
+        if (c === '\n' && opts.keepNewline)
+            return c;
+        const code = c.codePointAt(0);
+        if (code <= 0xff)
+            return `\\x${code.toString(16).padStart(2, '0')}`;
+        return code <= 0xffff ? `\\u${code.toString(16).padStart(4, '0')}` : `\\u{${code.toString(16)}}`;
+    });
+}
+//# sourceMappingURL=visible.js.map

package/dist/lib/share/visible.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"visible.js","sourceRoot":"","sources":["../../../src/lib/share/visible.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AACH,yGAAyG;AACzG,yGAAyG;AACzG,uGAAuG;AACvG,sGAAsG;AACtG,MAAM,MAAM,GAAG,qEAAqE,CAAC;AAErF,MAAM,UAAU,OAAO,CAAC,IAAY,EAAE,OAAkC,EAAE;IACxE,OAAO,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC,EAAE,EAAE;QAChC,IAAI,CAAC,KAAK,IAAI,IAAI,IAAI,CAAC,WAAW;YAAE,OAAO,CAAC,CAAC;QAC7C,MAAM,IAAI,GAAG,CAAC,CAAC,WAAW,CAAC,CAAC,CAAE,CAAC;QAC/B,IAAI,IAAI,IAAI,IAAI;YAAE,OAAO,MAAM,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,CAAC;QACpE,OAAO,IAAI,IAAI,MAAM,CAAC,CAAC,CAAC,MAAM,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,OAAO,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC,GAAG,CAAC;IACnG,CAAC,CAAC,CAAC;AACL,CAAC"}

package/dist/lib/share/wire.d.ts

@@ -0,0 +1,98 @@
+/**
+ * L9: the shape POST /ingest/batch answers a SHARE with, read without trusting it.
+ *
+ * The response is not one snapshot per request item. It carries `snapshots` for what was WRITTEN
+ * (each with `request_index`, its position in the request), and the rest by index: `matched`
+ * (attached to a decision the team already held, nothing created), `skipped` (a re-share left alone),
+ * `refused` (the identity belongs to a decision the caller cannot see), `match_ambiguous` (several
+ * team decisions share the source key, so the item was created as new) and `judgements` (one report
+ * per target, one result per judgement). Reading `snapshots[0]` as "the decision I shared" is wrong
+ * whenever any of those is present. This module turns the response into exactly one outcome per
+ * request item, and an item the response never mentions is `unknown`, never "created".
+ */
+export interface JudgementResult {
+    ok: boolean;
+    stored?: boolean;
+    error?: string;
+}
+export interface BatchResponse {
+    snapshots?: Array<{
+        id: string;
+        title?: string;
+        summary?: string;
+        request_index?: number;
+        is_new?: boolean;
+    }>;
+    skipped?: Array<{
+        index: number;
+        reason: string;
+        existing_id: string;
+    }>;
+    matched?: Array<{
+        request_index: number;
+        existing_id: string;
+        status?: string;
+        team_text_hash?: string;
+        needs_confirmation?: Array<{
+            kind: string;
+            judgement_index: number;
+        }>;
+    }>;
+    match_ambiguous?: number[];
+    refused?: Array<{
+        request_index: number;
+        reason: string;
+    }>;
+    judgements?: Array<{
+        request_index: number;
+        decision_id: string;
+        results: JudgementResult[];
+    }>;
+}
+export interface JudgementFailure {
+    index: number;
+    error: string;
+}
+interface Common {
+    index: number;
+    /** One result per judgement sent, or null when the gateway reported none (an older gateway ignores the field). */
+    judgements: JudgementResult[] | null;
+}
+export type ItemOutcome = (Common & {
+    kind: 'created';
+    remoteId: string;
+    ambiguous: boolean;
+    uncertain: boolean;
+}) | (Common & {
+    kind: 'updated';
+    remoteId: string;
+}) | (Common & {
+    kind: 'matched';
+    remoteId: string;
+    status: string;
+    teamTextHash: string | null;
+    needsConfirmation: Array<{
+        kind: string;
+        judgement_index: number;
+    }>;
+}) | (Common & {
+    kind: 'skipped';
+    remoteId: string;
+    reason: string;
+}) | {
+    kind: 'refused';
+    index: number;
+    reason: string;
+} | {
+    kind: 'unknown';
+    index: number;
+};
+export declare function failedJudgements(results: JudgementResult[] | null): JudgementFailure[];
+/**
+ * One outcome per request item. `sent` is how many items the request carried. A response whose
+ * snapshots carry no `request_index` (a gateway before the field) is index-aligned ONLY when nothing
+ * was matched, skipped or refused and the counts agree; otherwise those items are `unknown`.
+ */
+export declare function readOutcomes(sent: number, res: BatchResponse): ItemOutcome[];
+export {};
+//# sourceMappingURL=wire.d.ts.map

package/dist/lib/share/wire.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"wire.d.ts","sourceRoot":"","sources":["../../../src/lib/share/wire.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AACH,MAAM,WAAW,eAAe;IAAG,EAAE,EAAE,OAAO,CAAC;IAAC,MAAM,CAAC,EAAE,OAAO,CAAC;IAAC,KAAK,CAAC,EAAE,MAAM,CAAA;CAAE;AAElF,MAAM,WAAW,aAAa;IAC5B,SAAS,CAAC,EAAE,KAAK,CAAC;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,KAAK,CAAC,EAAE,MAAM,CAAC;QAAC,OAAO,CAAC,EAAE,MAAM,CAAC;QAAC,aAAa,CAAC,EAAE,MAAM,CAAC;QAAC,MAAM,CAAC,EAAE,OAAO,CAAA;KAAE,CAAC,CAAC;IAC9G,OAAO,CAAC,EAAE,KAAK,CAAC;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAC;QAAC,WAAW,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IACxE,OAAO,CAAC,EAAE,KAAK,CAAC;QACd,aAAa,EAAE,MAAM,CAAC;QAAC,WAAW,EAAE,MAAM,CAAC;QAAC,MAAM,CAAC,EAAE,MAAM,CAAC;QAAC,cAAc,CAAC,EAAE,MAAM,CAAC;QACrF,kBAAkB,CAAC,EAAE,KAAK,CAAC;YAAE,IAAI,EAAE,MAAM,CAAC;YAAC,eAAe,EAAE,MAAM,CAAA;SAAE,CAAC,CAAC;KACvE,CAAC,CAAC;IACH,eAAe,CAAC,EAAE,MAAM,EAAE,CAAC;IAC3B,OAAO,CAAC,EAAE,KAAK,CAAC;QAAE,aAAa,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAC3D,UAAU,CAAC,EAAE,KAAK,CAAC;QAAE,aAAa,EAAE,MAAM,CAAC;QAAC,WAAW,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,eAAe,EAAE,CAAA;KAAE,CAAC,CAAC;CAChG;AAED,MAAM,WAAW,gBAAgB;IAAG,KAAK,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE;AAElE,UAAU,MAAM;IACd,KAAK,EAAE,MAAM,CAAC;IACd,kHAAkH;IAClH,UAAU,EAAE,eAAe,EAAE,GAAG,IAAI,CAAC;CACtC;AAED,MAAM,MAAM,WAAW,GACnB,CAAC,MAAM,GAAG;IAAE,IAAI,EAAE,SAAS,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAC;IAAC,SAAS,EAAE,OAAO,CAAC;IAAC,SAAS,EAAE,OAAO,CAAA;CAAE,CAAC,GACxF,CAAC,MAAM,GAAG;IAAE,IAAI,EAAE,SAAS,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAA;CAAE,CAAC,GAChD,CAAC,MAAM,GAAG;IAAE,IAAI,EAAE,SAAS,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,YAAY,EAAE,MAAM,GAAG,IAAI,CAAC;IAAC,iBAAiB,EAAE,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,eAAe,EAAE,MAAM,CAAA;KAAE,CAAC,CAAA;CAAE,CAAC,GAClK,CAAC,MAAM,GAAG;IAAE,IAAI,EAAE,SAAS,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAAC,GAChE;IAAE,IAAI,EAAE,SAAS,CAAC;IAAC,KAAK,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,GAClD;IAAE,IAAI,EAAE,SAAS,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,CAAC;AAEvC,wBAAgB,gBAAgB,CAAC,OAAO,EAAE,eAAe,EAAE,GAAG,IAAI,GAAG,gBAAgB,EAAE,CAEtF;AAED;;;;GAIG;AACH,wBAAgB,YAAY,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,EAAE,aAAa,GAAG,WAAW,EAAE,CAgC5E"}

package/dist/lib/share/wire.js

@@ -0,0 +1,43 @@
+export function failedJudgements(results) {
+    return (results ?? []).flatMap((r, index) => (r.ok ? [] : [{ index, error: r.error ?? 'failed' }]));
+}
+/**
+ * One outcome per request item. `sent` is how many items the request carried. A response whose
+ * snapshots carry no `request_index` (a gateway before the field) is index-aligned ONLY when nothing
+ * was matched, skipped or refused and the counts agree; otherwise those items are `unknown`.
+ */
+export function readOutcomes(sent, res) {
+    const snapshots = res.snapshots ?? [];
+    const judged = new Map((res.judgements ?? []).map((j) => [j.request_index, j.results]));
+    const reportFor = (index) => judged.get(index) ?? null;
+    const ambiguous = new Set(res.match_ambiguous ?? []);
+    const out = new Map();
+    for (const r of res.refused ?? [])
+        out.set(r.request_index, { kind: 'refused', index: r.request_index, reason: r.reason });
+    for (const m of res.matched ?? []) {
+        out.set(m.request_index, {
+            kind: 'matched', index: m.request_index, remoteId: m.existing_id, status: m.status ?? 'unknown',
+            teamTextHash: m.team_text_hash ?? null, needsConfirmation: m.needs_confirmation ?? [], judgements: reportFor(m.request_index),
+        });
+    }
+    for (const s of res.skipped ?? []) {
+        out.set(s.index, { kind: 'skipped', index: s.index, remoteId: s.existing_id, reason: s.reason, judgements: reportFor(s.index) });
+    }
+    const untagged = snapshots.some((s) => s.request_index === undefined);
+    const aligned = untagged && snapshots.length === sent && out.size === 0;
+    snapshots.forEach((s, k) => {
+        const index = s.request_index ?? (aligned ? k : undefined);
+        if (index === undefined || out.has(index))
+            return;
+        // `created` is only believed when the gateway said so in so many words: a request_index AND is_new === true.
+        // A gateway before share matching (self-host older than 0.46.0) sends neither, so a row it REUSED at that
+        // source looks identical to a new one. Retracting it would archive somebody else's decision, so it is
+        // `uncertain` and recorded as not ours.
+        const sure = s.request_index !== undefined && s.is_new === true;
+        out.set(index, s.is_new === false
+            ? { kind: 'updated', index, remoteId: s.id, judgements: reportFor(index) }
+            : { kind: 'created', index, remoteId: s.id, ambiguous: ambiguous.has(index), uncertain: !sure, judgements: reportFor(index) });
+    });
+    return Array.from({ length: sent }, (_, index) => out.get(index) ?? { kind: 'unknown', index });
+}
+//# sourceMappingURL=wire.js.map

package/dist/lib/share/wire.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"wire.js","sourceRoot":"","sources":["../../../src/lib/share/wire.ts"],"names":[],"mappings":"AA0CA,MAAM,UAAU,gBAAgB,CAAC,OAAiC;IAChE,OAAO,CAAC,OAAO,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,CAAC,KAAK,IAAI,QAAQ,EAAE,CAAC,CAAC,CAAC,CAAC;AACtG,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,YAAY,CAAC,IAAY,EAAE,GAAkB;IAC3D,MAAM,SAAS,GAAG,GAAG,CAAC,SAAS,IAAI,EAAE,CAAC;IACtC,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,CAAC,GAAG,CAAC,UAAU,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,aAAa,EAAE,CAAC,CAAC,OAAO,CAAU,CAAC,CAAC,CAAC;IACjG,MAAM,SAAS,GAAG,CAAC,KAAa,EAA4B,EAAE,CAAC,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,IAAI,CAAC;IACzF,MAAM,SAAS,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,eAAe,IAAI,EAAE,CAAC,CAAC;IACrD,MAAM,GAAG,GAAG,IAAI,GAAG,EAAuB,CAAC;IAE3C,KAAK,MAAM,CAAC,IAAI,GAAG,CAAC,OAAO,IAAI,EAAE;QAAE,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,aAAa,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC,CAAC,aAAa,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC;IAC3H,KAAK,MAAM,CAAC,IAAI,GAAG,CAAC,OAAO,IAAI,EAAE,EAAE,CAAC;QAClC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,aAAa,EAAE;YACvB,IAAI,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC,CAAC,aAAa,EAAE,QAAQ,EAAE,CAAC,CAAC,WAAW,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,IAAI,SAAS;YAC/F,YAAY,EAAE,CAAC,CAAC,cAAc,IAAI,IAAI,EAAE,iBAAiB,EAAE,CAAC,CAAC,kBAAkB,IAAI,EAAE,EAAE,UAAU,EAAE,SAAS,CAAC,CAAC,CAAC,aAAa,CAAC;SAC9H,CAAC,CAAC;IACL,CAAC;IACD,KAAK,MAAM,CAAC,IAAI,GAAG,CAAC,OAAO,IAAI,EAAE,EAAE,CAAC;QAClC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,KAAK,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC,CAAC,KAAK,EAAE,QAAQ,EAAE,CAAC,CAAC,WAAW,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,UAAU,EAAE,SAAS,CAAC,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;IACnI,CAAC;IACD,MAAM,QAAQ,GAAG,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,aAAa,KAAK,SAAS,CAAC,CAAC;IACtE,MAAM,OAAO,GAAG,QAAQ,IAAI,SAAS,CAAC,MAAM,KAAK,IAAI,IAAI,GAAG,CAAC,IAAI,KAAK,CAAC,CAAC;IACxE,SAAS,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE;QACzB,MAAM,KAAK,GAAG,CAAC,CAAC,aAAa,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;QAC3D,IAAI,KAAK,KAAK,SAAS,IAAI,GAAG,CAAC,GAAG,CAAC,KAAK,CAAC;YAAE,OAAO;QAClD,6GAA6G;QAC7G,0GAA0G;QAC1G,sGAAsG;QACtG,wCAAwC;QACxC,MAAM,IAAI,GAAG,CAAC,CAAC,aAAa,KAAK,SAAS,IAAI,CAAC,CAAC,MAAM,KAAK,IAAI,CAAC;QAChE,GAAG,CAAC,GAAG,CAAC,KAAK,EAAE,CAAC,CAAC,MAAM,KAAK,KAAK;YAC/B,CAAC,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,KAAK,EAAE,QAAQ,EAAE,CAAC,CAAC,EAAE,EAAE,UAAU,EAAE,SAAS,CAAC,KAAK,CAAC,EAAE;YAC1E,CAAC,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,KAAK,EAAE,QAAQ,EAAE,CAAC,CAAC,EAAE,EAAE,SAAS,EAAE,SAAS,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,SAAS,EAAE,CAAC,IAAI,EAAE,UAAU,EAAE,SAAS,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;IACnI,CAAC,CAAC,CAAC;IACH,OAAO,KAAK,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,EAAE,CAAC,CAAC,EAAE,KAAK,EAAE,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,EAAE,IAAI,EAAE,SAAkB,EAAE,KAAK,EAAE,CAAC,CAAC;AAC3G,CAAC"}

package/dist/lib/similarity/embedding-matrix.d.ts

@@ -0,0 +1,64 @@
+/**
+ * An in-memory copy of every stored embedding, held as ONE contiguous Float32Array, with an
+ * exhaustive top-K scan over it (plan LB, decision 26).
+ *
+ * Why it exists: ingest ranked each new item against the whole graph by re-reading every
+ * stored vector out of SQLite, decoding it, and cosine-scoring it, once per item. Measured
+ * (profile at 5,000 rows): read and decode 5.7 ms, cosine 1.9 ms, sort 0.4 ms per item, and
+ * the read grows with the graph, so a batch was quadratic. Loading once per run and appending
+ * as items land removes the read; scoring against precomputed norms removes two thirds of the
+ * arithmetic. The scan stays EXHAUSTIVE - narrowing candidates would drop the cross-tool links
+ * the product exists for - so results must equal the old scan exactly. They do: the dot
+ * product accumulates in the same order as cosineSimilarity and divides by the same
+ * sqrt(normQuery) * sqrt(normRow), so every score is bit-identical, not merely close.
+ *
+ * Pure: no database, no model. The caller decides which rows go in.
+ */
+export interface Scored {
+    decisionId: string;
+    score: number;
+}
+/** Anything that can rank the graph against a query: the matrix, or the streaming scan that
+ *  stands in for it on a graph too large to hold in memory. */
+export interface Ranker {
+    topK(query: Float32Array, k: number, opts?: {
+        excludeId?: string;
+        threshold?: number;
+    }): Scored[] | Promise<Scored[]>;
+}
+/**
+ * Above this many stored embeddings ingest does not build a matrix and ranks by streaming the
+ * table per item, as it did before the matrix existed. Memory: a 384-dim row is 1,536 bytes of
+ * Float32 plus its id and norm, so about 1.5 KB per row, i.e. roughly 230 MB at 150,000 rows.
+ * Building reads every row out of SQLite first, so the transient peak is about 2.5x the
+ * matrix (the decoded rows, the contiguous copy, and growth headroom) until the rows are
+ * released. The cap keeps that peak near 600 MB. Measured graphs are in the thousands of rows;
+ * this is a guard for the pathological case, not a tuning knob.
+ */
+export declare const MATRIX_MAX_ROWS = 150000;
+/** The one writer of the "different model" error, shared with cosineSimilarity. */
+export declare function embeddingLengthMismatch(a: number, b: number): Error;
+export declare class EmbeddingMatrix implements Ranker {
+    private dim;
+    private data;
+    private sqrtNorms;
+    private ids;
+    private index;
+    static fromRows(rows: Array<{
+        decisionId: string;
+        embedding: Float32Array;
+    }>): EmbeddingMatrix;
+    get size(): number;
+    /** Adds a row, or replaces the vector of an id already held (setEmbedding is INSERT OR
+     *  REPLACE, so the matrix must never hold two vectors for one decision). */
+    add(decisionId: string, embedding: Float32Array): void;
+    /** The `k` best rows by cosine, best first; equal scores order by id in code-unit order.
+     *  Rows scoring below `threshold` are dropped (default: none are; findSimilar passed 0). */
+    topK(query: Float32Array, k: number, opts?: {
+        excludeId?: string;
+        threshold?: number;
+    }): Scored[];
+    private outranks;
+    private grow;
+}
+//# sourceMappingURL=embedding-matrix.d.ts.map

package/dist/lib/similarity/embedding-matrix.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"embedding-matrix.d.ts","sourceRoot":"","sources":["../../../src/lib/similarity/embedding-matrix.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAEH,MAAM,WAAW,MAAM;IAAG,UAAU,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE;AAE7D;+DAC+D;AAC/D,MAAM,WAAW,MAAM;IACrB,IAAI,CAAC,KAAK,EAAE,YAAY,EAAE,CAAC,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE;QAAE,SAAS,CAAC,EAAE,MAAM,CAAC;QAAC,SAAS,CAAC,EAAE,MAAM,CAAA;KAAE,GAAG,MAAM,EAAE,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC;CACvH;AAED;;;;;;;;GAQG;AACH,eAAO,MAAM,eAAe,SAAU,CAAC;AAEvC,mFAAmF;AACnF,wBAAgB,uBAAuB,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,MAAM,GAAG,KAAK,CAKnE;AAID,qBAAa,eAAgB,YAAW,MAAM;IAC5C,OAAO,CAAC,GAAG,CAAM;IACjB,OAAO,CAAC,IAAI,CAAuB;IACnC,OAAO,CAAC,SAAS,CAAuB;IACxC,OAAO,CAAC,GAAG,CAAgB;IAC3B,OAAO,CAAC,KAAK,CAA6B;IAE1C,MAAM,CAAC,QAAQ,CAAC,IAAI,EAAE,KAAK,CAAC;QAAE,UAAU,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,YAAY,CAAA;KAAE,CAAC,GAAG,eAAe;IAM9F,IAAI,IAAI,IAAI,MAAM,CAA4B;IAE9C;gFAC4E;IAC5E,GAAG,CAAC,UAAU,EAAE,MAAM,EAAE,SAAS,EAAE,YAAY,GAAG,IAAI;IAgBtD;gGAC4F;IAC5F,IAAI,CAAC,KAAK,EAAE,YAAY,EAAE,CAAC,EAAE,MAAM,EAAE,IAAI,GAAE;QAAE,SAAS,CAAC,EAAE,MAAM,CAAC;QAAC,SAAS,CAAC,EAAE,MAAM,CAAA;KAAO,GAAG,MAAM,EAAE;IAgCrG,OAAO,CAAC,QAAQ;IAIhB,OAAO,CAAC,IAAI;CAQb"}