@askdkc/kiokuko 0.1.0

package/dist/repository/binding.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"binding.d.ts","sourceRoot":"","sources":["../../src/repository/binding.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,kBAAkB,CAAC;AAEvD,MAAM,WAAW,sBAAsB;IACrC,YAAY,EAAE,MAAM,CAAC;IACrB,SAAS,EAAE,MAAM,CAAC;IAClB,WAAW,EAAE,MAAM,CAAC;IACpB,aAAa,EAAE,MAAM,CAAC;IACtB,iBAAiB,EAAE,MAAM,GAAG,IAAI,CAAC;IACjC,oBAAoB,EAAE,MAAM,CAAC;IAC7B,oBAAoB,EAAE,MAAM,CAAC;IAC7B,GAAG,CAAC,EAAE,MAAM,CAAC;CACd;AAED,MAAM,WAAW,kBAAkB;IACjC,OAAO,EAAE,OAAO,CAAC;IACjB,YAAY,EAAE,MAAM,CAAC;IACrB,SAAS,EAAE,MAAM,CAAC;IAClB,aAAa,EAAE,MAAM,CAAC;CACvB;AAMD,wBAAgB,6BAA6B,CAC3C,QAAQ,EAAE,cAAc,EACxB,YAAY,EAAE,sBAAsB,GACnC,kBAAkB,CAiFpB"}

package/dist/repository/binding.js

@@ -0,0 +1,78 @@
+import { KiokukoError } from '../errors.js';
+function conflict(message) {
+    throw new KiokukoError('CONFLICT', message);
+}
+export function registerRepositoryAndLocation(database, registration) {
+    const now = registration.now ?? new Date().toISOString();
+    if (registration.remoteFingerprint !== null && !/^sha256:[a-f0-9]{64}$/.test(registration.remoteFingerprint)) {
+        throw new KiokukoError('VALIDATION_ERROR', 'remoteFingerprint must be a SHA-256 fingerprint');
+    }
+    database.exec('BEGIN IMMEDIATE');
+    try {
+        const location = database
+            .prepare('SELECT repository_id FROM repository_locations WHERE canonical_root = ?')
+            .get(registration.canonicalRoot);
+        if (location && location.repository_id !== registration.repositoryId) {
+            conflict('Repository root is already bound to another repository ID; rebind is required');
+        }
+        const repository = database
+            .prepare('SELECT workspace FROM repositories WHERE repository_id = ?')
+            .get(registration.repositoryId);
+        if (repository && repository.workspace !== registration.workspace) {
+            conflict('Repository ID is already bound to another workspace');
+        }
+        const workspace = database
+            .prepare('SELECT repository_id FROM repositories WHERE workspace = ?')
+            .get(registration.workspace);
+        if (workspace && workspace.repository_id !== registration.repositoryId) {
+            conflict('Workspace is already bound to another repository ID');
+        }
+        const created = !repository;
+        if (created) {
+            database
+                .prepare(`
+          INSERT INTO repositories (
+            repository_id, workspace, display_name, remote_fingerprint,
+            binding_schema_version, agent_template_version, created_at, last_used_at
+          ) VALUES (?, ?, ?, ?, ?, ?, ?, ?)
+        `)
+                .run(registration.repositoryId, registration.workspace, registration.displayName, registration.remoteFingerprint, registration.bindingSchemaVersion, registration.agentTemplateVersion, now, now);
+        }
+        else {
+            database
+                .prepare('UPDATE repositories SET last_used_at = ?, display_name = ?, agent_template_version = MAX(agent_template_version, ?) WHERE repository_id = ?')
+                .run(now, registration.displayName, registration.agentTemplateVersion, registration.repositoryId);
+        }
+        if (!location) {
+            database
+                .prepare(`
+          INSERT INTO repository_locations (
+            repository_id, canonical_root, first_seen_at, last_seen_at
+          ) VALUES (?, ?, ?, ?)
+        `)
+                .run(registration.repositoryId, registration.canonicalRoot, now, now);
+        }
+        else {
+            database
+                .prepare('UPDATE repository_locations SET last_seen_at = ? WHERE repository_id = ? AND canonical_root = ?')
+                .run(now, registration.repositoryId, registration.canonicalRoot);
+        }
+        database.exec('COMMIT');
+        return {
+            created,
+            repositoryId: registration.repositoryId,
+            workspace: registration.workspace,
+            canonicalRoot: registration.canonicalRoot,
+        };
+    }
+    catch (error) {
+        try {
+            database.exec('ROLLBACK');
+        }
+        catch {
+            // Preserve the original conflict or SQLite error.
+        }
+        throw error;
+    }
+}
+//# sourceMappingURL=binding.js.map

package/dist/repository/binding.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"binding.js","sourceRoot":"","sources":["../../src/repository/binding.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,MAAM,cAAc,CAAC;AAqB5C,SAAS,QAAQ,CAAC,OAAe;IAC/B,MAAM,IAAI,YAAY,CAAC,UAAU,EAAE,OAAO,CAAC,CAAC;AAC9C,CAAC;AAED,MAAM,UAAU,6BAA6B,CAC3C,QAAwB,EACxB,YAAoC;IAEpC,MAAM,GAAG,GAAG,YAAY,CAAC,GAAG,IAAI,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IACzD,IAAI,YAAY,CAAC,iBAAiB,KAAK,IAAI,IAAI,CAAC,uBAAuB,CAAC,IAAI,CAAC,YAAY,CAAC,iBAAiB,CAAC,EAAE,CAAC;QAC7G,MAAM,IAAI,YAAY,CAAC,kBAAkB,EAAE,iDAAiD,CAAC,CAAC;IAChG,CAAC;IACD,QAAQ,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAC;IACjC,IAAI,CAAC;QACH,MAAM,QAAQ,GAAG,QAAQ;aACtB,OAAO,CAAC,yEAAyE,CAAC;aAClF,GAAG,CAA4B,YAAY,CAAC,aAAa,CAAC,CAAC;QAC9D,IAAI,QAAQ,IAAI,QAAQ,CAAC,aAAa,KAAK,YAAY,CAAC,YAAY,EAAE,CAAC;YACrE,QAAQ,CAAC,+EAA+E,CAAC,CAAC;QAC5F,CAAC;QAED,MAAM,UAAU,GAAG,QAAQ;aACxB,OAAO,CAAC,4DAA4D,CAAC;aACrE,GAAG,CAAwB,YAAY,CAAC,YAAY,CAAC,CAAC;QACzD,IAAI,UAAU,IAAI,UAAU,CAAC,SAAS,KAAK,YAAY,CAAC,SAAS,EAAE,CAAC;YAClE,QAAQ,CAAC,qDAAqD,CAAC,CAAC;QAClE,CAAC;QAED,MAAM,SAAS,GAAG,QAAQ;aACvB,OAAO,CAAC,4DAA4D,CAAC;aACrE,GAAG,CAA4B,YAAY,CAAC,SAAS,CAAC,CAAC;QAC1D,IAAI,SAAS,IAAI,SAAS,CAAC,aAAa,KAAK,YAAY,CAAC,YAAY,EAAE,CAAC;YACvE,QAAQ,CAAC,qDAAqD,CAAC,CAAC;QAClE,CAAC;QAED,MAAM,OAAO,GAAG,CAAC,UAAU,CAAC;QAC5B,IAAI,OAAO,EAAE,CAAC;YACZ,QAAQ;iBACL,OAAO,CAAC;;;;;SAKR,CAAC;iBACD,GAAG,CACF,YAAY,CAAC,YAAY,EACzB,YAAY,CAAC,SAAS,EACtB,YAAY,CAAC,WAAW,EACxB,YAAY,CAAC,iBAAiB,EAC9B,YAAY,CAAC,oBAAoB,EACjC,YAAY,CAAC,oBAAoB,EACjC,GAAG,EACH,GAAG,CACJ,CAAC;QACN,CAAC;aAAM,CAAC;YACN,QAAQ;iBACL,OAAO,CAAC,6IAA6I,CAAC;iBACtJ,GAAG,CAAC,GAAG,EAAE,YAAY,CAAC,WAAW,EAAE,YAAY,CAAC,oBAAoB,EAAE,YAAY,CAAC,YAAY,CAAC,CAAC;QACtG,CAAC;QAED,IAAI,CAAC,QAAQ,EAAE,CAAC;YACd,QAAQ;iBACL,OAAO,CAAC;;;;SAIR,CAAC;iBACD,GAAG,CAAC,YAAY,CAAC,YAAY,EAAE,YAAY,CAAC,aAAa,EAAE,GAAG,EAAE,GAAG,CAAC,CAAC;QAC1E,CAAC;aAAM,CAAC;YACN,QAAQ;iBACL,OAAO,CAAC,iGAAiG,CAAC;iBAC1G,GAAG,CAAC,GAAG,EAAE,YAAY,CAAC,YAAY,EAAE,YAAY,CAAC,aAAa,CAAC,CAAC;QACrE,CAAC;QACD,QAAQ,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QACxB,OAAO;YACL,OAAO;YACP,YAAY,EAAE,YAAY,CAAC,YAAY;YACvC,SAAS,EAAE,YAAY,CAAC,SAAS;YACjC,aAAa,EAAE,YAAY,CAAC,aAAa;SAC1C,CAAC;IACJ,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,CAAC;YACH,QAAQ,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;QAC5B,CAAC;QAAC,MAAM,CAAC;YACP,kDAAkD;QACpD,CAAC;QACD,MAAM,KAAK,CAAC;IACd,CAAC;AACH,CAAC"}

package/dist/repository/detect-root.d.ts

@@ -0,0 +1,12 @@
+export type RootSource = 'explicit' | 'binding' | 'git' | 'git-marker' | 'directory';
+export interface DetectedRepositoryRoot {
+    root: string;
+    source: RootSource;
+}
+export interface DetectRepositoryRootOptions {
+    cwd?: string;
+    root?: string;
+    allowDirectory?: boolean;
+}
+export declare function detectRepositoryRoot(options?: DetectRepositoryRootOptions): DetectedRepositoryRoot;
+//# sourceMappingURL=detect-root.d.ts.map

package/dist/repository/detect-root.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"detect-root.d.ts","sourceRoot":"","sources":["../../src/repository/detect-root.ts"],"names":[],"mappings":"AAKA,MAAM,MAAM,UAAU,GAAG,UAAU,GAAG,SAAS,GAAG,KAAK,GAAG,YAAY,GAAG,WAAW,CAAC;AAErF,MAAM,WAAW,sBAAsB;IACrC,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,UAAU,CAAC;CACpB;AAED,MAAM,WAAW,2BAA2B;IAC1C,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,cAAc,CAAC,EAAE,OAAO,CAAC;CAC1B;AAgCD,wBAAgB,oBAAoB,CAAC,OAAO,GAAE,2BAAgC,GAAG,sBAAsB,CAuBtG"}

package/dist/repository/detect-root.js

@@ -0,0 +1,57 @@
+import { execFileSync } from 'node:child_process';
+import { existsSync, realpathSync, statSync } from 'node:fs';
+import path from 'node:path';
+import { KiokukoError } from '../errors.js';
+function canonicalDirectory(directory) {
+    const resolved = realpathSync(directory);
+    if (!statSync(resolved).isDirectory())
+        throw new KiokukoError('VALIDATION_ERROR', 'Repository root must be a directory');
+    return resolved;
+}
+function ancestorDirectories(start) {
+    const directories = [];
+    let current = canonicalDirectory(start);
+    for (;;) {
+        directories.push(current);
+        const parent = path.dirname(current);
+        if (parent === current)
+            return directories;
+        current = parent;
+    }
+}
+function gitRoot(cwd) {
+    try {
+        const output = execFileSync('git', ['rev-parse', '--show-toplevel'], {
+            cwd,
+            encoding: 'utf8',
+            stdio: ['ignore', 'pipe', 'ignore'],
+        }).trim();
+        return output ? canonicalDirectory(output) : undefined;
+    }
+    catch {
+        return undefined;
+    }
+}
+export function detectRepositoryRoot(options = {}) {
+    const cwd = canonicalDirectory(options.cwd ?? process.cwd());
+    if (options.root !== undefined) {
+        return { root: canonicalDirectory(options.root), source: 'explicit' };
+    }
+    for (const directory of ancestorDirectories(cwd)) {
+        if (existsSync(path.join(directory, '.kiokuko.json'))) {
+            return { root: directory, source: 'binding' };
+        }
+    }
+    const discoveredGitRoot = gitRoot(cwd);
+    if (discoveredGitRoot)
+        return { root: discoveredGitRoot, source: 'git' };
+    for (const directory of ancestorDirectories(cwd)) {
+        if (existsSync(path.join(directory, '.git'))) {
+            return { root: directory, source: 'git-marker' };
+        }
+    }
+    if (options.allowDirectory)
+        return { root: cwd, source: 'directory' };
+    throw new KiokukoError('NOT_FOUND', 'No repository root found; pass --root or --allow-directory');
+}
+//# sourceMappingURL=detect-root.js.map

package/dist/repository/detect-root.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"detect-root.js","sourceRoot":"","sources":["../../src/repository/detect-root.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAClD,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AAC7D,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,YAAY,EAAE,MAAM,cAAc,CAAC;AAe5C,SAAS,kBAAkB,CAAC,SAAiB;IAC3C,MAAM,QAAQ,GAAG,YAAY,CAAC,SAAS,CAAC,CAAC;IACzC,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,WAAW,EAAE;QAAE,MAAM,IAAI,YAAY,CAAC,kBAAkB,EAAE,qCAAqC,CAAC,CAAC;IACzH,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,SAAS,mBAAmB,CAAC,KAAa;IACxC,MAAM,WAAW,GAAa,EAAE,CAAC;IACjC,IAAI,OAAO,GAAG,kBAAkB,CAAC,KAAK,CAAC,CAAC;IACxC,SAAS,CAAC;QACR,WAAW,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QAC1B,MAAM,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;QACrC,IAAI,MAAM,KAAK,OAAO;YAAE,OAAO,WAAW,CAAC;QAC3C,OAAO,GAAG,MAAM,CAAC;IACnB,CAAC;AACH,CAAC;AAED,SAAS,OAAO,CAAC,GAAW;IAC1B,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,YAAY,CAAC,KAAK,EAAE,CAAC,WAAW,EAAE,iBAAiB,CAAC,EAAE;YACnE,GAAG;YACH,QAAQ,EAAE,MAAM;YAChB,KAAK,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,QAAQ,CAAC;SACpC,CAAC,CAAC,IAAI,EAAE,CAAC;QACV,OAAO,MAAM,CAAC,CAAC,CAAC,kBAAkB,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IACzD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;AACH,CAAC;AAED,MAAM,UAAU,oBAAoB,CAAC,UAAuC,EAAE;IAC5E,MAAM,GAAG,GAAG,kBAAkB,CAAC,OAAO,CAAC,GAAG,IAAI,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC;IAC7D,IAAI,OAAO,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;QAC/B,OAAO,EAAE,IAAI,EAAE,kBAAkB,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,UAAU,EAAE,CAAC;IACxE,CAAC;IAED,KAAK,MAAM,SAAS,IAAI,mBAAmB,CAAC,GAAG,CAAC,EAAE,CAAC;QACjD,IAAI,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,eAAe,CAAC,CAAC,EAAE,CAAC;YACtD,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC;QAChD,CAAC;IACH,CAAC;IAED,MAAM,iBAAiB,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC;IACvC,IAAI,iBAAiB;QAAE,OAAO,EAAE,IAAI,EAAE,iBAAiB,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC;IAEzE,KAAK,MAAM,SAAS,IAAI,mBAAmB,CAAC,GAAG,CAAC,EAAE,CAAC;QACjD,IAAI,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC,EAAE,CAAC;YAC7C,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,MAAM,EAAE,YAAY,EAAE,CAAC;QACnD,CAAC;IACH,CAAC;IAED,IAAI,OAAO,CAAC,cAAc;QAAE,OAAO,EAAE,IAAI,EAAE,GAAG,EAAE,MAAM,EAAE,WAAW,EAAE,CAAC;IACtE,MAAM,IAAI,YAAY,CAAC,WAAW,EAAE,4DAA4D,CAAC,CAAC;AACpG,CAAC"}

package/dist/repository/git-origin.d.ts

@@ -0,0 +1,2 @@
+export declare function readGitOrigin(repositoryRoot: string): string | undefined;
+//# sourceMappingURL=git-origin.d.ts.map

package/dist/repository/git-origin.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"git-origin.d.ts","sourceRoot":"","sources":["../../src/repository/git-origin.ts"],"names":[],"mappings":"AAEA,wBAAgB,aAAa,CAAC,cAAc,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAWxE"}

package/dist/repository/git-origin.js

@@ -0,0 +1,15 @@
+import { execFileSync } from 'node:child_process';
+export function readGitOrigin(repositoryRoot) {
+    try {
+        const value = execFileSync('git', ['config', '--get', 'remote.origin.url'], {
+            cwd: repositoryRoot,
+            encoding: 'utf8',
+            stdio: ['ignore', 'pipe', 'ignore'],
+        }).trim();
+        return value || undefined;
+    }
+    catch {
+        return undefined;
+    }
+}
+//# sourceMappingURL=git-origin.js.map

package/dist/repository/git-origin.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"git-origin.js","sourceRoot":"","sources":["../../src/repository/git-origin.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAElD,MAAM,UAAU,aAAa,CAAC,cAAsB;IAClD,IAAI,CAAC;QACH,MAAM,KAAK,GAAG,YAAY,CAAC,KAAK,EAAE,CAAC,QAAQ,EAAE,OAAO,EAAE,mBAAmB,CAAC,EAAE;YAC1E,GAAG,EAAE,cAAc;YACnB,QAAQ,EAAE,MAAM;YAChB,KAAK,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,QAAQ,CAAC;SACpC,CAAC,CAAC,IAAI,EAAE,CAAC;QACV,OAAO,KAAK,IAAI,SAAS,CAAC;IAC5B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;AACH,CAAC"}

package/dist/repository/identity.d.ts

@@ -0,0 +1,19 @@
+export interface ExistingBindingIdentity {
+    repositoryId: string;
+    workspace: string;
+}
+export interface RepositoryIdentityOptions {
+    repositoryRoot: string;
+    remoteUrl?: string;
+    repositoryId?: string;
+    workspace?: string;
+    existingBinding?: ExistingBindingIdentity;
+}
+export interface RepositoryIdentity {
+    repositoryId: string;
+    workspace: string;
+    displayName: string;
+    remoteFingerprint: string | null;
+}
+export declare function createRepositoryIdentity(options: RepositoryIdentityOptions): RepositoryIdentity;
+//# sourceMappingURL=identity.d.ts.map

package/dist/repository/identity.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"identity.d.ts","sourceRoot":"","sources":["../../src/repository/identity.ts"],"names":[],"mappings":"AAIA,MAAM,WAAW,uBAAuB;IACtC,YAAY,EAAE,MAAM,CAAC;IACrB,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,yBAAyB;IACxC,cAAc,EAAE,MAAM,CAAC;IACvB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,eAAe,CAAC,EAAE,uBAAuB,CAAC;CAC3C;AAED,MAAM,WAAW,kBAAkB;IACjC,YAAY,EAAE,MAAM,CAAC;IACrB,SAAS,EAAE,MAAM,CAAC;IAClB,WAAW,EAAE,MAAM,CAAC;IACpB,iBAAiB,EAAE,MAAM,GAAG,IAAI,CAAC;CAClC;AAWD,wBAAgB,wBAAwB,CAAC,OAAO,EAAE,yBAAyB,GAAG,kBAAkB,CAW/F"}

package/dist/repository/identity.js

@@ -0,0 +1,23 @@
+import { createHash, randomUUID } from 'node:crypto';
+import path from 'node:path';
+import { fingerprintRemoteUrl } from './remote-url.js';
+function slugForRoot(repositoryRoot) {
+    const base = path.basename(repositoryRoot) || 'repository';
+    return base.toLowerCase().replace(/[^a-z0-9]+/g, '-').replace(/^-+|-+$/g, '') || 'repository';
+}
+function shortIdentityHash(value) {
+    return createHash('sha256').update(value).digest('hex').slice(0, 12);
+}
+export function createRepositoryIdentity(options) {
+    const displayName = slugForRoot(options.repositoryRoot);
+    const remoteFingerprint = options.remoteUrl ? fingerprintRemoteUrl(options.remoteUrl) : null;
+    const remoteHash = remoteFingerprint?.slice('sha256:'.length);
+    const repositoryId = options.existingBinding?.repositoryId
+        ?? options.repositoryId
+        ?? (remoteHash ? `repo_${remoteHash.slice(0, 12)}` : `repo_${randomUUID()}`);
+    const workspace = options.existingBinding?.workspace
+        ?? options.workspace
+        ?? `project:${displayName}-${shortIdentityHash(repositoryId)}`;
+    return { repositoryId, workspace, displayName, remoteFingerprint };
+}
+//# sourceMappingURL=identity.js.map

package/dist/repository/identity.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"identity.js","sourceRoot":"","sources":["../../src/repository/identity.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACrD,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,oBAAoB,EAAE,MAAM,iBAAiB,CAAC;AAsBvD,SAAS,WAAW,CAAC,cAAsB;IACzC,MAAM,IAAI,GAAG,IAAI,CAAC,QAAQ,CAAC,cAAc,CAAC,IAAI,YAAY,CAAC;IAC3D,OAAO,IAAI,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,aAAa,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,UAAU,EAAE,EAAE,CAAC,IAAI,YAAY,CAAC;AAChG,CAAC;AAED,SAAS,iBAAiB,CAAC,KAAa;IACtC,OAAO,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;AACvE,CAAC;AAED,MAAM,UAAU,wBAAwB,CAAC,OAAkC;IACzE,MAAM,WAAW,GAAG,WAAW,CAAC,OAAO,CAAC,cAAc,CAAC,CAAC;IACxD,MAAM,iBAAiB,GAAG,OAAO,CAAC,SAAS,CAAC,CAAC,CAAC,oBAAoB,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IAC7F,MAAM,UAAU,GAAG,iBAAiB,EAAE,KAAK,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC;IAC9D,MAAM,YAAY,GAAG,OAAO,CAAC,eAAe,EAAE,YAAY;WACrD,OAAO,CAAC,YAAY;WACpB,CAAC,UAAU,CAAC,CAAC,CAAC,QAAQ,UAAU,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC,QAAQ,UAAU,EAAE,EAAE,CAAC,CAAC;IAC/E,MAAM,SAAS,GAAG,OAAO,CAAC,eAAe,EAAE,SAAS;WAC/C,OAAO,CAAC,SAAS;WACjB,WAAW,WAAW,IAAI,iBAAiB,CAAC,YAAY,CAAC,EAAE,CAAC;IACjE,OAAO,EAAE,YAAY,EAAE,SAAS,EAAE,WAAW,EAAE,iBAAiB,EAAE,CAAC;AACrE,CAAC"}

package/dist/repository/remote-url.d.ts

@@ -0,0 +1,4 @@
+export declare function normalizeRemoteUrl(remoteUrl: string): string;
+export declare function fingerprintRemoteUrl(remoteUrl: string): string;
+export declare const sanitizeRemoteUrl: typeof normalizeRemoteUrl;
+//# sourceMappingURL=remote-url.d.ts.map

package/dist/repository/remote-url.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"remote-url.d.ts","sourceRoot":"","sources":["../../src/repository/remote-url.ts"],"names":[],"mappings":"AASA,wBAAgB,kBAAkB,CAAC,SAAS,EAAE,MAAM,GAAG,MAAM,CAuB5D;AAED,wBAAgB,oBAAoB,CAAC,SAAS,EAAE,MAAM,GAAG,MAAM,CAG9D;AAED,eAAO,MAAM,iBAAiB,2BAAqB,CAAC"}

package/dist/repository/remote-url.js

@@ -0,0 +1,36 @@
+import { createHash } from 'node:crypto';
+import { URL } from 'node:url';
+import { KiokukoError } from '../errors.js';
+function cleanPath(value) {
+    return value.replace(/^\/+/, '').replace(/\.git$/i, '').replace(/\/+$/, '');
+}
+export function normalizeRemoteUrl(remoteUrl) {
+    if (typeof remoteUrl !== 'string' || remoteUrl.trim().length === 0) {
+        throw new KiokukoError('VALIDATION_ERROR', 'Git remote URL must be a non-empty string');
+    }
+    const raw = remoteUrl.trim();
+    const scp = /^(?:[^@/]+@)?([^/:]+):(.+)$/.exec(raw);
+    if (scp && !raw.includes('://')) {
+        return `${scp[1].toLowerCase()}/${cleanPath(scp[2])}`;
+    }
+    let parsed;
+    try {
+        parsed = new URL(raw);
+    }
+    catch {
+        throw new KiokukoError('VALIDATION_ERROR', 'Git remote URL is invalid');
+    }
+    const protocol = parsed.protocol.toLowerCase();
+    if (!['http:', 'https:', 'ssh:', 'git:', 'git+ssh:'].includes(protocol)) {
+        throw new KiokukoError('VALIDATION_ERROR', 'Git remote URL scheme is unsupported');
+    }
+    const defaultPort = (protocol === 'https:' && parsed.port === '443') || (protocol === 'ssh:' && parsed.port === '22');
+    const host = `${parsed.hostname.toLowerCase()}${parsed.port && !defaultPort ? `:${parsed.port}` : ''}`;
+    return `${host}/${cleanPath(parsed.pathname)}`;
+}
+export function fingerprintRemoteUrl(remoteUrl) {
+    const normalized = normalizeRemoteUrl(remoteUrl);
+    return `sha256:${createHash('sha256').update(normalized).digest('hex')}`;
+}
+export const sanitizeRemoteUrl = normalizeRemoteUrl;
+//# sourceMappingURL=remote-url.js.map

package/dist/repository/remote-url.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"remote-url.js","sourceRoot":"","sources":["../../src/repository/remote-url.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,GAAG,EAAE,MAAM,UAAU,CAAC;AAE/B,OAAO,EAAE,YAAY,EAAE,MAAM,cAAc,CAAC;AAE5C,SAAS,SAAS,CAAC,KAAa;IAC9B,OAAO,KAAK,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,SAAS,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;AAC9E,CAAC;AAED,MAAM,UAAU,kBAAkB,CAAC,SAAiB;IAClD,IAAI,OAAO,SAAS,KAAK,QAAQ,IAAI,SAAS,CAAC,IAAI,EAAE,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACnE,MAAM,IAAI,YAAY,CAAC,kBAAkB,EAAE,2CAA2C,CAAC,CAAC;IAC1F,CAAC;IACD,MAAM,GAAG,GAAG,SAAS,CAAC,IAAI,EAAE,CAAC;IAC7B,MAAM,GAAG,GAAG,6BAA6B,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IACpD,IAAI,GAAG,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;QAChC,OAAO,GAAG,GAAG,CAAC,CAAC,CAAE,CAAC,WAAW,EAAE,IAAI,SAAS,CAAC,GAAG,CAAC,CAAC,CAAE,CAAC,EAAE,CAAC;IAC1D,CAAC;IAED,IAAI,MAAW,CAAC;IAChB,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC;IACxB,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,YAAY,CAAC,kBAAkB,EAAE,2BAA2B,CAAC,CAAC;IAC1E,CAAC;IACD,MAAM,QAAQ,GAAG,MAAM,CAAC,QAAQ,CAAC,WAAW,EAAE,CAAC;IAC/C,IAAI,CAAC,CAAC,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,UAAU,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC;QACxE,MAAM,IAAI,YAAY,CAAC,kBAAkB,EAAE,sCAAsC,CAAC,CAAC;IACrF,CAAC;IACD,MAAM,WAAW,GAAG,CAAC,QAAQ,KAAK,QAAQ,IAAI,MAAM,CAAC,IAAI,KAAK,KAAK,CAAC,IAAI,CAAC,QAAQ,KAAK,MAAM,IAAI,MAAM,CAAC,IAAI,KAAK,IAAI,CAAC,CAAC;IACtH,MAAM,IAAI,GAAG,GAAG,MAAM,CAAC,QAAQ,CAAC,WAAW,EAAE,GAAG,MAAM,CAAC,IAAI,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC,IAAI,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC;IACvG,OAAO,GAAG,IAAI,IAAI,SAAS,CAAC,MAAM,CAAC,QAAQ,CAAC,EAAE,CAAC;AACjD,CAAC;AAED,MAAM,UAAU,oBAAoB,CAAC,SAAiB;IACpD,MAAM,UAAU,GAAG,kBAAkB,CAAC,SAAS,CAAC,CAAC;IACjD,OAAO,UAAU,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC;AAC3E,CAAC;AAED,MAAM,CAAC,MAAM,iBAAiB,GAAG,kBAAkB,CAAC"}

package/dist/security/sanitize.d.ts

@@ -0,0 +1,4 @@
+import { type JsonValue, type SanitizationOptions, type Sanitized } from '../ledger/types.js';
+export declare const HARMLESS_ENV_KEYS: Set<string>;
+export declare function sanitizeJson(value: unknown, options?: SanitizationOptions): Sanitized<JsonValue>;
+//# sourceMappingURL=sanitize.d.ts.map

package/dist/security/sanitize.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sanitize.d.ts","sourceRoot":"","sources":["../../src/security/sanitize.ts"],"names":[],"mappings":"AAGA,OAAO,EAAqB,KAAK,SAAS,EAAkB,KAAK,mBAAmB,EAAE,KAAK,SAAS,EAAE,MAAM,oBAAoB,CAAC;AAEjI,eAAO,MAAM,iBAAiB,aAAoE,CAAC;AAqJnG,wBAAgB,YAAY,CAAC,KAAK,EAAE,OAAO,EAAE,OAAO,GAAE,mBAAwB,GAAG,SAAS,CAAC,SAAS,CAAC,CAYpG"}

package/dist/security/sanitize.js

@@ -0,0 +1,174 @@
+import path from 'node:path';
+import { findSecret } from '../memory/secrets.js';
+import { KiokukoError } from '../errors.js';
+import { MAX_PREVIEW_BYTES } from '../ledger/types.js';
+export const HARMLESS_ENV_KEYS = new Set(['CI', 'NODE_ENV', 'TERM', 'LANG', 'LC_ALL', 'LC_CTYPE']);
+const SENSITIVE_KEY = /(?:password|passwd|secret|token|apikey|api[-_]?key|authorization|cookie|credential|private[-_]?key|client[-_]?secret|refresh[-_]?token|access[-_]?token)/i;
+const SENSITIVE_CONTAINER_KEY = /^(?:credentials|headers)$/i;
+const HIDDEN_REASONING_KEY = /(?:chain[-_]?of[-_]?thought|hidden[-_]?reasoning|private[-_]?reasoning|internal[-_]?monologue)/i;
+const PREVIEW_KEY = /^(?:stdout|stderr|output|preview|excerpt|diff)$/i;
+const PATH_KEY = /(?:^|[-_])(path|file|filename|locator|cwd|directory|workspace|target)$/i;
+function security(message) {
+    throw new KiokukoError('VALIDATION_ERROR', message);
+}
+function secretKey() {
+    throw new KiokukoError('SECURITY_REJECTION', 'JSON object key contains secret material');
+}
+function isPlainObject(value) {
+    if (typeof value !== 'object' || value === null || Array.isArray(value))
+        return false;
+    const prototype = Object.getPrototypeOf(value);
+    return prototype === Object.prototype || prototype === null;
+}
+function jsonValue(value) {
+    if (value === null || typeof value === 'boolean' || typeof value === 'string')
+        return true;
+    if (typeof value === 'number')
+        return Number.isFinite(value);
+    if (Array.isArray(value))
+        return value.every(jsonValue);
+    return isPlainObject(value) && Object.values(value).every(jsonValue);
+}
+function pathLabel(segments) {
+    return segments.length === 0 ? '$' : `$${segments.map((segment) => `[${JSON.stringify(segment)}]`).join('')}`;
+}
+function boundaryPrefix(root, candidate) {
+    const relative = path.relative(root, candidate);
+    return relative === '' || (!relative.startsWith('..') && !path.isAbsolute(relative));
+}
+function normalizeAbsolutePath(value, options) {
+    if (!path.isAbsolute(value))
+        return undefined;
+    const absolute = path.normalize(value);
+    if (options.workspace) {
+        const workspace = path.resolve(options.workspace);
+        if (boundaryPrefix(workspace, absolute)) {
+            const relative = path.relative(workspace, absolute).split(path.sep).join('/');
+            return { value: relative || '.', kind: 'home_path' };
+        }
+    }
+    if (options.home) {
+        const home = path.resolve(options.home);
+        if (boundaryPrefix(home, absolute)) {
+            const relative = path.relative(home, absolute).split(path.sep).join('/');
+            return { value: relative ? `<HOME>/${relative}` : '<HOME>', kind: 'home_path' };
+        }
+    }
+    return undefined;
+}
+function normalizeUrl(value) {
+    if (!/^[a-z][a-z\d+.-]*:\/\//i.test(value))
+        return undefined;
+    try {
+        const url = new URL(value);
+        return `${url.protocol}//${url.host}${url.pathname}`;
+    }
+    catch {
+        return undefined;
+    }
+}
+function truncateUtf8(value, maxBytes) {
+    if (Buffer.byteLength(value, 'utf8') <= maxBytes)
+        return value;
+    let result = '';
+    for (const character of value) {
+        const next = result + character;
+        if (Buffer.byteLength(`${next}…`, 'utf8') > maxBytes)
+            break;
+        result = next;
+    }
+    return `${result}…`;
+}
+function sanitizeNode(value, segments, options, redactions, truncated, keyHint) {
+    if (value === null || typeof value === 'boolean')
+        return value;
+    if (typeof value === 'number') {
+        if (!Number.isFinite(value))
+            security('Value must contain only finite JSON numbers');
+        return value;
+    }
+    if (typeof value === 'string') {
+        let text = value;
+        const label = pathLabel(segments);
+        const secret = findSecret(text);
+        if (secret) {
+            redactions.push({ path: label, kind: 'secret_pattern' });
+            return `[REDACTED:${secret.kind}]`;
+        }
+        const url = normalizeUrl(text);
+        if (url !== undefined) {
+            if (url !== text)
+                redactions.push({ path: label, kind: 'url' });
+            text = url;
+        }
+        else if (PATH_KEY.test(keyHint ?? '') || path.isAbsolute(text)) {
+            const normalized = normalizeAbsolutePath(text, options);
+            if (normalized) {
+                if (normalized.value !== text)
+                    redactions.push({ path: label, kind: normalized.kind });
+                text = normalized.value;
+            }
+        }
+        if (keyHint && PREVIEW_KEY.test(keyHint) && Buffer.byteLength(text, 'utf8') > MAX_PREVIEW_BYTES) {
+            text = truncateUtf8(text, MAX_PREVIEW_BYTES);
+            redactions.push({ path: label, kind: 'preview_truncated' });
+            truncated.push(label);
+        }
+        return text;
+    }
+    if (Array.isArray(value))
+        return value.map((child, index) => sanitizeNode(child, [...segments, String(index)], options, redactions, truncated, keyHint));
+    if (!isPlainObject(value))
+        security('Value must be JSON-compatible');
+    const result = {};
+    for (const [key, child] of Object.entries(value)) {
+        if (findSecret(key))
+            secretKey();
+        const childPath = [...segments, key];
+        const label = pathLabel(childPath);
+        if (HIDDEN_REASONING_KEY.test(key)) {
+            redactions.push({ path: label, kind: 'hidden_reasoning' });
+            continue;
+        }
+        if (/^(?:env|environment)$/i.test(key)) {
+            if (!isPlainObject(child)) {
+                redactions.push({ path: label, kind: 'environment_value' });
+                continue;
+            }
+            const environment = {};
+            for (const [envKey, envValue] of Object.entries(child)) {
+                if (!HARMLESS_ENV_KEYS.has(envKey)) {
+                    redactions.push({ path: pathLabel([...childPath, envKey]), kind: 'environment_value' });
+                    continue;
+                }
+                environment[envKey] = sanitizeNode(envValue, [...childPath, envKey], options, redactions, truncated, envKey);
+            }
+            result[key] = environment;
+            continue;
+        }
+        if (SENSITIVE_KEY.test(key) && !SENSITIVE_CONTAINER_KEY.test(key)) {
+            redactions.push({ path: label, kind: 'sensitive_key' });
+            result[key] = '[REDACTED]';
+            continue;
+        }
+        result[key] = sanitizeNode(child, childPath, options, redactions, truncated, key);
+    }
+    return result;
+}
+export function sanitizeJson(value, options = {}) {
+    if (!jsonValue(value))
+        security('Value must be JSON-compatible');
+    const effectiveOptions = {};
+    if (options.workspace !== undefined)
+        effectiveOptions.workspace = options.workspace;
+    const home = options.home ?? process.env.HOME;
+    if (home !== undefined)
+        effectiveOptions.home = home;
+    const redactions = [];
+    const truncated = [];
+    const sanitized = sanitizeNode(value, [], effectiveOptions, redactions, truncated);
+    redactions.sort((left, right) => left.path < right.path ? -1 : left.path > right.path ? 1 : left.kind < right.kind ? -1 : left.kind > right.kind ? 1 : 0);
+    truncated.sort();
+    return { value: sanitized, redactions, truncated };
+}
+//# sourceMappingURL=sanitize.js.map

package/dist/security/sanitize.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sanitize.js","sourceRoot":"","sources":["../../src/security/sanitize.ts"],"names":[],"mappings":"AAAA,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,UAAU,EAAE,MAAM,sBAAsB,CAAC;AAClD,OAAO,EAAE,YAAY,EAAE,MAAM,cAAc,CAAC;AAC5C,OAAO,EAAE,iBAAiB,EAA4E,MAAM,oBAAoB,CAAC;AAEjI,MAAM,CAAC,MAAM,iBAAiB,GAAG,IAAI,GAAG,CAAC,CAAC,IAAI,EAAE,UAAU,EAAE,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,UAAU,CAAC,CAAC,CAAC;AAEnG,MAAM,aAAa,GAAG,2JAA2J,CAAC;AAClL,MAAM,uBAAuB,GAAG,4BAA4B,CAAC;AAC7D,MAAM,oBAAoB,GAAG,iGAAiG,CAAC;AAC/H,MAAM,WAAW,GAAG,kDAAkD,CAAC;AACvE,MAAM,QAAQ,GAAG,yEAAyE,CAAC;AAE3F,SAAS,QAAQ,CAAC,OAAe;IAC/B,MAAM,IAAI,YAAY,CAAC,kBAAkB,EAAE,OAAO,CAAC,CAAC;AACtD,CAAC;AAED,SAAS,SAAS;IAChB,MAAM,IAAI,YAAY,CAAC,oBAAoB,EAAE,0CAA0C,CAAC,CAAC;AAC3F,CAAC;AAED,SAAS,aAAa,CAAC,KAAc;IACnC,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IACtF,MAAM,SAAS,GAAG,MAAM,CAAC,cAAc,CAAC,KAAK,CAAC,CAAC;IAC/C,OAAO,SAAS,KAAK,MAAM,CAAC,SAAS,IAAI,SAAS,KAAK,IAAI,CAAC;AAC9D,CAAC;AAED,SAAS,SAAS,CAAC,KAAc;IAC/B,IAAI,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,SAAS,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAC;IAC3F,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;IAC7D,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;IACxD,OAAO,aAAa,CAAC,KAAK,CAAC,IAAI,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;AACvE,CAAC;AAED,SAAS,SAAS,CAAC,QAAkB;IACnC,OAAO,QAAQ,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,QAAQ,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,IAAI,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,CAAC;AAChH,CAAC;AAED,SAAS,cAAc,CAAC,IAAY,EAAE,SAAiB;IACrD,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,CAAC,IAAI,EAAE,SAAS,CAAC,CAAC;IAChD,OAAO,QAAQ,KAAK,EAAE,IAAI,CAAC,CAAC,QAAQ,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,CAAC;AACvF,CAAC;AAED,SAAS,qBAAqB,CAAC,KAAa,EAAE,OAA4B;IACxE,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC;QAAE,OAAO,SAAS,CAAC;IAC9C,MAAM,QAAQ,GAAG,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;IACvC,IAAI,OAAO,CAAC,SAAS,EAAE,CAAC;QACtB,MAAM,SAAS,GAAG,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;QAClD,IAAI,cAAc,CAAC,SAAS,EAAE,QAAQ,CAAC,EAAE,CAAC;YACxC,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,CAAC,SAAS,EAAE,QAAQ,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;YAC9E,OAAO,EAAE,KAAK,EAAE,QAAQ,IAAI,GAAG,EAAE,IAAI,EAAE,WAAW,EAAE,CAAC;QACvD,CAAC;IACH,CAAC;IACD,IAAI,OAAO,CAAC,IAAI,EAAE,CAAC;QACjB,MAAM,IAAI,GAAG,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;QACxC,IAAI,cAAc,CAAC,IAAI,EAAE,QAAQ,CAAC,EAAE,CAAC;YACnC,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;YACzE,OAAO,EAAE,KAAK,EAAE,QAAQ,CAAC,CAAC,CAAC,UAAU,QAAQ,EAAE,CAAC,CAAC,CAAC,QAAQ,EAAE,IAAI,EAAE,WAAW,EAAE,CAAC;QAClF,CAAC;IACH,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,SAAS,YAAY,CAAC,KAAa;IACjC,IAAI,CAAC,yBAAyB,CAAC,IAAI,CAAC,KAAK,CAAC;QAAE,OAAO,SAAS,CAAC;IAC7D,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC;QAC3B,OAAO,GAAG,GAAG,CAAC,QAAQ,KAAK,GAAG,CAAC,IAAI,GAAG,GAAG,CAAC,QAAQ,EAAE,CAAC;IACvD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;AACH,CAAC;AAED,SAAS,YAAY,CAAC,KAAa,EAAE,QAAgB;IACnD,IAAI,MAAM,CAAC,UAAU,CAAC,KAAK,EAAE,MAAM,CAAC,IAAI,QAAQ;QAAE,OAAO,KAAK,CAAC;IAC/D,IAAI,MAAM,GAAG,EAAE,CAAC;IAChB,KAAK,MAAM,SAAS,IAAI,KAAK,EAAE,CAAC;QAC9B,MAAM,IAAI,GAAG,MAAM,GAAG,SAAS,CAAC;QAChC,IAAI,MAAM,CAAC,UAAU,CAAC,GAAG,IAAI,GAAG,EAAE,MAAM,CAAC,GAAG,QAAQ;YAAE,MAAM;QAC5D,MAAM,GAAG,IAAI,CAAC;IAChB,CAAC;IACD,OAAO,GAAG,MAAM,GAAG,CAAC;AACtB,CAAC;AAED,SAAS,YAAY,CAAC,KAAc,EAAE,QAAkB,EAAE,OAA4B,EAAE,UAAuB,EAAE,SAAmB,EAAE,OAAgB;IACpJ,IAAI,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,SAAS;QAAE,OAAO,KAAK,CAAC;IAC/D,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QAC9B,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC;YAAE,QAAQ,CAAC,6CAA6C,CAAC,CAAC;QACrF,OAAO,KAAK,CAAC;IACf,CAAC;IACD,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QAC9B,IAAI,IAAI,GAAG,KAAK,CAAC;QACjB,MAAM,KAAK,GAAG,SAAS,CAAC,QAAQ,CAAC,CAAC;QAClC,MAAM,MAAM,GAAG,UAAU,CAAC,IAAI,CAAC,CAAC;QAChC,IAAI,MAAM,EAAE,CAAC;YACX,UAAU,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,gBAAgB,EAAE,CAAC,CAAC;YACzD,OAAO,aAAa,MAAM,CAAC,IAAI,GAAG,CAAC;QACrC,CAAC;QACD,MAAM,GAAG,GAAG,YAAY,CAAC,IAAI,CAAC,CAAC;QAC/B,IAAI,GAAG,KAAK,SAAS,EAAE,CAAC;YACtB,IAAI,GAAG,KAAK,IAAI;gBAAE,UAAU,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;YAChE,IAAI,GAAG,GAAG,CAAC;QACb,CAAC;aAAM,IAAI,QAAQ,CAAC,IAAI,CAAC,OAAO,IAAI,EAAE,CAAC,IAAI,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;YACjE,MAAM,UAAU,GAAG,qBAAqB,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;YACxD,IAAI,UAAU,EAAE,CAAC;gBACf,IAAI,UAAU,CAAC,KAAK,KAAK,IAAI;oBAAE,UAAU,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,UAAU,CAAC,IAAI,EAAE,CAAC,CAAC;gBACvF,IAAI,GAAG,UAAU,CAAC,KAAK,CAAC;YAC1B,CAAC;QACH,CAAC;QACD,IAAI,OAAO,IAAI,WAAW,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,MAAM,CAAC,UAAU,CAAC,IAAI,EAAE,MAAM,CAAC,GAAG,iBAAiB,EAAE,CAAC;YAChG,IAAI,GAAG,YAAY,CAAC,IAAI,EAAE,iBAAiB,CAAC,CAAC;YAC7C,UAAU,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,mBAAmB,EAAE,CAAC,CAAC;YAC5D,SAAS,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACxB,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IACD,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,KAAK,EAAE,EAAE,CAAC,YAAY,CAAC,KAAK,EAAE,CAAC,GAAG,QAAQ,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,OAAO,EAAE,UAAU,EAAE,SAAS,EAAE,OAAO,CAAC,CAAC,CAAC;IACzJ,IAAI,CAAC,aAAa,CAAC,KAAK,CAAC;QAAE,QAAQ,CAAC,+BAA+B,CAAC,CAAC;IAErE,MAAM,MAAM,GAA8B,EAAE,CAAC;IAC7C,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QACjD,IAAI,UAAU,CAAC,GAAG,CAAC;YAAE,SAAS,EAAE,CAAC;QACjC,MAAM,SAAS,GAAG,CAAC,GAAG,QAAQ,EAAE,GAAG,CAAC,CAAC;QACrC,MAAM,KAAK,GAAG,SAAS,CAAC,SAAS,CAAC,CAAC;QACnC,IAAI,oBAAoB,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;YACnC,UAAU,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,kBAAkB,EAAE,CAAC,CAAC;YAC3D,SAAS;QACX,CAAC;QACD,IAAI,wBAAwB,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;YACvC,IAAI,CAAC,aAAa,CAAC,KAAK,CAAC,EAAE,CAAC;gBAC1B,UAAU,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,mBAAmB,EAAE,CAAC,CAAC;gBAC5D,SAAS;YACX,CAAC;YACD,MAAM,WAAW,GAA8B,EAAE,CAAC;YAClD,KAAK,MAAM,CAAC,MAAM,EAAE,QAAQ,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;gBACvD,IAAI,CAAC,iBAAiB,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC;oBACnC,UAAU,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,SAAS,CAAC,CAAC,GAAG,SAAS,EAAE,MAAM,CAAC,CAAC,EAAE,IAAI,EAAE,mBAAmB,EAAE,CAAC,CAAC;oBACxF,SAAS;gBACX,CAAC;gBACD,WAAW,CAAC,MAAM,CAAC,GAAG,YAAY,CAAC,QAAQ,EAAE,CAAC,GAAG,SAAS,EAAE,MAAM,CAAC,EAAE,OAAO,EAAE,UAAU,EAAE,SAAS,EAAE,MAAM,CAAC,CAAC;YAC/G,CAAC;YACD,MAAM,CAAC,GAAG,CAAC,GAAG,WAAW,CAAC;YAC1B,SAAS;QACX,CAAC;QACD,IAAI,aAAa,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,uBAAuB,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;YAClE,UAAU,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,eAAe,EAAE,CAAC,CAAC;YACxD,MAAM,CAAC,GAAG,CAAC,GAAG,YAAY,CAAC;YAC3B,SAAS;QACX,CAAC;QACD,MAAM,CAAC,GAAG,CAAC,GAAG,YAAY,CAAC,KAAK,EAAE,SAAS,EAAE,OAAO,EAAE,UAAU,EAAE,SAAS,EAAE,GAAG,CAAC,CAAC;IACpF,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,MAAM,UAAU,YAAY,CAAC,KAAc,EAAE,UAA+B,EAAE;IAC5E,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC;QAAE,QAAQ,CAAC,+BAA+B,CAAC,CAAC;IACjE,MAAM,gBAAgB,GAAwB,EAAE,CAAC;IACjD,IAAI,OAAO,CAAC,SAAS,KAAK,SAAS;QAAE,gBAAgB,CAAC,SAAS,GAAG,OAAO,CAAC,SAAS,CAAC;IACpF,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,IAAI,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC;IAC9C,IAAI,IAAI,KAAK,SAAS;QAAE,gBAAgB,CAAC,IAAI,GAAG,IAAI,CAAC;IACrD,MAAM,UAAU,GAAgB,EAAE,CAAC;IACnC,MAAM,SAAS,GAAa,EAAE,CAAC;IAC/B,MAAM,SAAS,GAAG,YAAY,CAAC,KAAK,EAAE,EAAE,EAAE,gBAAgB,EAAE,UAAU,EAAE,SAAS,CAAC,CAAC;IACnF,UAAU,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,GAAG,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,GAAG,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,GAAG,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,GAAG,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IAC1J,SAAS,CAAC,IAAI,EAAE,CAAC;IACjB,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,UAAU,EAAE,SAAS,EAAE,CAAC;AACrD,CAAC"}

package/dist/serialization/envelope.d.ts

@@ -0,0 +1,20 @@
+export interface SuccessEnvelope<T = unknown> {
+    apiVersion: '1';
+    ok: true;
+    operation: string;
+    data: T;
+    meta?: Record<string, unknown>;
+}
+export interface ErrorEnvelope {
+    apiVersion: '1';
+    ok: false;
+    operation: string;
+    error: {
+        code: string;
+        message: string;
+        details: Record<string, unknown>;
+    };
+}
+export declare function successEnvelope<T>(operation: string, data: T, meta?: Record<string, unknown>): SuccessEnvelope<T>;
+export declare function errorEnvelope(operation: string, error: unknown): ErrorEnvelope;
+//# sourceMappingURL=envelope.d.ts.map

package/dist/serialization/envelope.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"envelope.d.ts","sourceRoot":"","sources":["../../src/serialization/envelope.ts"],"names":[],"mappings":"AAEA,MAAM,WAAW,eAAe,CAAC,CAAC,GAAG,OAAO;IAC1C,UAAU,EAAE,GAAG,CAAC;IAChB,EAAE,EAAE,IAAI,CAAC;IACT,SAAS,EAAE,MAAM,CAAC;IAClB,IAAI,EAAE,CAAC,CAAC;IACR,IAAI,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CAChC;AAED,MAAM,WAAW,aAAa;IAC5B,UAAU,EAAE,GAAG,CAAC;IAChB,EAAE,EAAE,KAAK,CAAC;IACV,SAAS,EAAE,MAAM,CAAC;IAClB,KAAK,EAAE;QACL,IAAI,EAAE,MAAM,CAAC;QACb,OAAO,EAAE,MAAM,CAAC;QAChB,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;KAClC,CAAC;CACH;AAED,wBAAgB,eAAe,CAAC,CAAC,EAAE,SAAS,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,EAAE,IAAI,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,eAAe,CAAC,CAAC,CAAC,CAEjH;AAED,wBAAgB,aAAa,CAAC,SAAS,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,GAAG,aAAa,CAK9E"}

package/dist/serialization/envelope.js

@@ -0,0 +1,11 @@
+import { KiokukoError } from '../errors.js';
+export function successEnvelope(operation, data, meta) {
+    return { apiVersion: '1', ok: true, operation, data, ...(meta === undefined ? {} : { meta }) };
+}
+export function errorEnvelope(operation, error) {
+    if (error instanceof KiokukoError) {
+        return { apiVersion: '1', ok: false, operation, error: { code: error.code, message: error.message, details: error.details } };
+    }
+    return { apiVersion: '1', ok: false, operation, error: { code: 'DATABASE_ERROR', message: error instanceof Error ? error.message : String(error), details: {} } };
+}
+//# sourceMappingURL=envelope.js.map

package/dist/serialization/envelope.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"envelope.js","sourceRoot":"","sources":["../../src/serialization/envelope.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,MAAM,cAAc,CAAC;AAqB5C,MAAM,UAAU,eAAe,CAAI,SAAiB,EAAE,IAAO,EAAE,IAA8B;IAC3F,OAAO,EAAE,UAAU,EAAE,GAAG,EAAE,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,GAAG,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,EAAE,CAAC;AACjG,CAAC;AAED,MAAM,UAAU,aAAa,CAAC,SAAiB,EAAE,KAAc;IAC7D,IAAI,KAAK,YAAY,YAAY,EAAE,CAAC;QAClC,OAAO,EAAE,UAAU,EAAE,GAAG,EAAE,EAAE,EAAE,KAAK,EAAE,SAAS,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,EAAE,CAAC;IAChI,CAAC;IACD,OAAO,EAAE,UAAU,EAAE,GAAG,EAAE,EAAE,EAAE,KAAK,EAAE,SAAS,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,gBAAgB,EAAE,OAAO,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,OAAO,EAAE,EAAE,EAAE,EAAE,CAAC;AACpK,CAAC"}

package/dist/serialization/validate.d.ts

@@ -0,0 +1,31 @@
+export declare const ENTRY_KINDS: readonly ["fact", "decision", "lesson", "preference", "reference"];
+export declare const ENTRY_STATUSES: readonly ["candidate", "verified", "superseded"];
+export declare const TRUST_LEVELS: readonly ["untrusted", "user_asserted", "source_verified", "system_verified"];
+export type EntryKind = (typeof ENTRY_KINDS)[number];
+export type EntryStatus = (typeof ENTRY_STATUSES)[number];
+export type TrustLevel = (typeof TRUST_LEVELS)[number];
+export type JsonObject = {
+    [key: string]: JsonValue;
+};
+export type JsonValue = null | boolean | number | string | JsonValue[] | JsonObject;
+export interface ValidatedRecordInput {
+    workspace: string;
+    kind: EntryKind;
+    status: EntryStatus;
+    title: string;
+    body: string;
+    summary: string | null;
+    scope: JsonObject;
+    provenance: JsonObject;
+    trustLevel: TrustLevel;
+    confidence: number;
+    tags: string[];
+    createdBy: string;
+    actor: string;
+}
+/** Serialize JSON values with recursively sorted object keys and no insignificant whitespace. */
+export declare function canonicalJson(value: unknown): string;
+export declare function canonicalContentHash(value: unknown): string;
+export declare function requireWorkspace(value: unknown): string;
+export declare function validateRecordInput(value: unknown): ValidatedRecordInput;
+//# sourceMappingURL=validate.d.ts.map

package/dist/serialization/validate.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"validate.d.ts","sourceRoot":"","sources":["../../src/serialization/validate.ts"],"names":[],"mappings":"AAGA,eAAO,MAAM,WAAW,oEAAqE,CAAC;AAC9F,eAAO,MAAM,cAAc,kDAAmD,CAAC;AAC/E,eAAO,MAAM,YAAY,+EAAgF,CAAC;AAE1G,MAAM,MAAM,SAAS,GAAG,CAAC,OAAO,WAAW,CAAC,CAAC,MAAM,CAAC,CAAC;AACrD,MAAM,MAAM,WAAW,GAAG,CAAC,OAAO,cAAc,CAAC,CAAC,MAAM,CAAC,CAAC;AAC1D,MAAM,MAAM,UAAU,GAAG,CAAC,OAAO,YAAY,CAAC,CAAC,MAAM,CAAC,CAAC;AACvD,MAAM,MAAM,UAAU,GAAG;IAAE,CAAC,GAAG,EAAE,MAAM,GAAG,SAAS,CAAA;CAAE,CAAC;AACtD,MAAM,MAAM,SAAS,GAAG,IAAI,GAAG,OAAO,GAAG,MAAM,GAAG,MAAM,GAAG,SAAS,EAAE,GAAG,UAAU,CAAC;AAEpF,MAAM,WAAW,oBAAoB;IACnC,SAAS,EAAE,MAAM,CAAC;IAClB,IAAI,EAAE,SAAS,CAAC;IAChB,MAAM,EAAE,WAAW,CAAC;IACpB,KAAK,EAAE,MAAM,CAAC;IACd,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;IACvB,KAAK,EAAE,UAAU,CAAC;IAClB,UAAU,EAAE,UAAU,CAAC;IACvB,UAAU,EAAE,UAAU,CAAC;IACvB,UAAU,EAAE,MAAM,CAAC;IACnB,IAAI,EAAE,MAAM,EAAE,CAAC;IACf,SAAS,EAAE,MAAM,CAAC;IAClB,KAAK,EAAE,MAAM,CAAC;CACf;AA+ED,iGAAiG;AACjG,wBAAgB,aAAa,CAAC,KAAK,EAAE,OAAO,GAAG,MAAM,CAGpD;AAED,wBAAgB,oBAAoB,CAAC,KAAK,EAAE,OAAO,GAAG,MAAM,CAE3D;AAED,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,OAAO,GAAG,MAAM,CAGvD;AA4BD,wBAAgB,mBAAmB,CAAC,KAAK,EAAE,OAAO,GAAG,oBAAoB,CA6CxE"}