@moldea.ai/core 7.1.0 → 9.0.0

package/dist/chunks/{scope-DoNl6LhC.js → scope-CNg6Gnpi.js}

@@ -1,50 +1,137 @@
-import { C as isSimpleGlob, D as parseManifestPath, S as isRuntimeGuidancePath, T as isVariableId, _ as isDecisionPath, a as escapeJsonPointerSegment, b as isRepositorySymbol, c as freezeRecursively, d as hasNonWhitespace, f as hasUnsupportedGlobMetacharacter, g as isContextPath, h as isCapabilityDescription, i as createCoreDiagnosticCollector, j as RECOGNIZED_RUNTIME_IDS, k as ACCEPTABLE_WARNING_CODES, l as compareExactStrings, m as isCanonicalMoldeaPath, p as isCanonicalManifestPath, s as createNullPrototypeRecord, t as createCoreOperationOptionsSnapshot, u as countUnicodeScalars$1, v as isMirrorPath, w as isStableId, x as isReservedId, y as isNonEmptySingleLine } from "./options-BVF3DQHm.js";
-import { n as CoreOperationException } from "./exceptions-CYf1pCKf.js";
-import { parseRepositoryPath } from "@moldea.ai/repository";
+import { a as escapeJsonPointerSegment, c as ACCEPTABLE_WARNING_CODES, i as createCoreDiagnosticCollector, s as createNullPrototypeRecord, t as createCoreOperationOptionsSnapshot, u as RECOGNIZED_RUNTIME_IDS } from "./options-C5360E_N.js";
+import { n as CoreOperationException } from "./exceptions-AT654xUL.js";
+import { compareCodePoints, countUtf8Bytes, deepFreeze, isObjectValid } from "jg-utilities";
+import { isRepositoryPath, parseRepositoryPath } from "@moldea.ai/repository";
 import { Parser, isAlias, isMap, isScalar, isSeq, parseAllDocuments } from "yaml";
+//#region src/format-validation/index.ts
+var STABLE_ID_PATTERN = /^[a-z0-9]+(?:-[a-z0-9]+)*$/u;
+var VARIABLE_ID_PATTERN = /^[A-Z][A-Z0-9_]*$/u;
+var WINDOWS_RESERVED_ID_PATTERN = /^(?:con|prn|aux|nul|com[1-9]|lpt[1-9])$/u;
+var LINE_BREAK_CHARACTERS = [
+	"\n",
+	"\r",
+	"…",
+	"\u2028",
+	"\u2029"
+];
+var UNSUPPORTED_GLOB_PATTERN = /[!?[\]{}]/u;
+var hasLineBreak = (value) => {
+	return LINE_BREAK_CHARACTERS.some((lineBreak) => value.includes(lineBreak));
+};
+/** Determines whether a code point belongs to the Repository Format version 1 whitespace set. */
+var isRepositoryFormatWhitespace = (codePoint) => {
+	return codePoint >= 9 && codePoint <= 13 || codePoint === 32 || codePoint === 133 || codePoint === 160 || codePoint === 5760 || codePoint >= 8192 && codePoint <= 8202 || codePoint === 8232 || codePoint === 8233 || codePoint === 8239 || codePoint === 8287 || codePoint === 12288;
+};
+/** Counts Unicode scalar values in valid JavaScript text. */
+var countUnicodeScalars = (value) => {
+	const scalars = value[Symbol.iterator]();
+	let count = 0;
+	while (scalars.next().done !== true) count += 1;
+	return count;
+};
+/** Determines whether a value contains at least one non-whitespace scalar. */
+var hasNonWhitespace = (value) => {
+	for (const scalar of value) if (!isRepositoryFormatWhitespace(scalar.codePointAt(0) ?? 0)) return true;
+	return false;
+};
+/** Determines whether a value begins or ends with version 1 whitespace. */
+var hasSurroundingWhitespace = (value) => {
+	const firstCodePoint = value.codePointAt(0);
+	const lastCodePoint = value.codePointAt(value.length - 1);
+	return firstCodePoint !== void 0 && isRepositoryFormatWhitespace(firstCodePoint) || lastCodePoint !== void 0 && isRepositoryFormatWhitespace(lastCodePoint);
+};
+/** Removes only Repository Format version 1 whitespace from both edges. */
+var trimRepositoryFormatWhitespace = (value) => {
+	let start = 0;
+	let end = value.length;
+	while (start < end) {
+		const codePoint = value.codePointAt(start);
+		if (codePoint === void 0 || !isRepositoryFormatWhitespace(codePoint)) break;
+		start += codePoint > 65535 ? 2 : 1;
+	}
+	while (end > start) {
+		const codePoint = value.codePointAt(end - 1);
+		if (codePoint === void 0 || !isRepositoryFormatWhitespace(codePoint)) break;
+		end -= 1;
+	}
+	return value.slice(start, end);
+};
+/** Determines whether a string is non-empty and contains no line break. */
+var isNonEmptySingleLine = (value) => {
+	return value.length > 0 && !hasLineBreak(value);
+};
+/** Determines whether a value satisfies stable moldea ID syntax. */
+var isStableId = (value) => {
+	return value.length <= 64 && STABLE_ID_PATTERN.test(value);
+};
+/** Determines whether an otherwise valid stable ID is filesystem-reserved. */
+var isReservedId = (value) => WINDOWS_RESERVED_ID_PATTERN.test(value);
+/** Determines whether a value satisfies runtime-variable ID syntax. */
+var isVariableId = (value) => {
+	return value.length <= 64 && VARIABLE_ID_PATTERN.test(value);
+};
+/** Determines whether a parsed capability description satisfies version 1 limits. */
+var isCapabilityDescription = (value) => {
+	const scalarLength = countUnicodeScalars(value);
+	return scalarLength >= 1 && scalarLength <= 1e3 && !hasSurroundingWhitespace(value) && !hasLineBreak(value) && !value.includes("\0") && !value.includes("{{") && !value.includes("}}");
+};
+/** Parses a non-root repository-format logical path without throwing. */
+var parseManifestPath = (value) => {
+	return value !== "/" && isRepositoryPath(value) ? parseRepositoryPath(value) : null;
+};
+/** Determines whether a path is the canonical manifest path. */
+var isCanonicalManifestPath = (path) => {
+	return path === "/moldea/moldea.yaml";
+};
+/** Extracts the stable millisecond ID from one canonical immediate decision path. */
+var parseDecisionIdFromPath = (path) => {
+	const match = /^\/moldea\/decisions\/(\d{13})-([a-z0-9]+(?:-[a-z0-9]+)*)\.md$/u.exec(path);
+	const id = match?.[1];
+	const slug = match?.[2];
+	return id !== void 0 && slug !== void 0 && isStableId(slug) ? id : null;
+};
+/** Determines whether a path is an allowed focused-context relationship key. */
+var isContextPath = (path, allowProject) => {
+	if (allowProject && path === "/moldea/project.md") return true;
+	return path.startsWith("/moldea/context/") && path.endsWith(".md");
+};
+/** Determines whether a path has the canonical immediate decision filename shape. */
+var isDecisionPath = (path) => {
+	return parseDecisionIdFromPath(path) !== null;
+};
+/** Determines whether a path is canonical runtime guidance. */
+var isRuntimeGuidancePath = (path) => {
+	return path.startsWith("/moldea/runtimes/") && path.endsWith(".md");
+};
+/** Determines whether a mirror path is outside canonical moldea content. */
+var isMirrorPath = (path) => {
+	return path !== "/moldea" && !path.startsWith("/moldea/");
+};
+/** Determines whether an impact path contains prohibited glob metacharacters. */
+var hasUnsupportedGlobMetacharacter = (value) => {
+	return UNSUPPORTED_GLOB_PATTERN.test(value);
+};
+/** Determines whether a string satisfies the version 1 simple-glob grammar. */
+var isSimpleGlob = (value) => {
+	if (hasUnsupportedGlobMetacharacter(value) || value.includes("***")) return false;
+	if (value.slice(1).split("/").some((segment) => segment.includes("**") && segment !== "**")) return false;
+	return value.includes("*") && isRepositoryPath(value.replaceAll("*", "x"));
+};
+/** Determines whether a repository-reference symbol has the common safe shape. */
+var isRepositorySymbol = (value) => {
+	return isNonEmptySingleLine(value) && !value.includes("\0");
+};
+/** Determines whether a canonical moldea reference incorrectly carries a symbol. */
+var isCanonicalMoldeaPath = (path) => {
+	return path === "/moldea" || path.startsWith("/moldea/");
+};
+//#endregion
 //#region src/text/index.ts
 var encoder = new TextEncoder();
 var decoder = new TextDecoder("utf-8", {
 	fatal: true,
 	ignoreBOM: true
 });
-var isRecord$1 = (value) => {
-	return typeof value === "object" && value !== null && !Array.isArray(value);
-};
-/**
-* Measures valid scalar UTF-8 bytes and stops once the operation budget is exceeded.
-* @param value The decoded string to measure without lossy replacement.
-* @param maximumByteLength The threshold after which measurement may stop early.
-* @returns The measured bytes, a value above the threshold, or `null` for invalid Unicode.
-*/
-var measureScalarUtf8ByteLength = (value, maximumByteLength) => {
-	let byteLength = 0;
-	for (let index = 0; index < value.length; index += 1) {
-		const codeUnit = value.charCodeAt(index);
-		if (codeUnit >= 55296 && codeUnit <= 56319) {
-			if (index + 1 >= value.length) return null;
-			const nextCodeUnit = value.charCodeAt(index + 1);
-			if (nextCodeUnit < 56320 || nextCodeUnit > 57343) return null;
-			byteLength += 4;
-			if (byteLength > maximumByteLength) return byteLength;
-			index += 1;
-			continue;
-		}
-		if (codeUnit >= 56320 && codeUnit <= 57343) return null;
-		byteLength += codeUnit <= 127 ? 1 : codeUnit <= 2047 ? 2 : 3;
-		if (byteLength > maximumByteLength) return byteLength;
-	}
-	return byteLength;
-};
-var countUnicodeScalars = (value) => {
-	let count = 0;
-	for (let index = 0; index < value.length; count += 1) {
-		const codePoint = value.codePointAt(index);
-		if (codePoint === void 0) break;
-		index += codePoint > 65535 ? 2 : 1;
-	}
-	return count;
-};
 /**
 * Collects every normalized NUL location or rejects when the diagnostic budget is exhausted.
 * @param value The normalized scalar text to inspect.
@@ -99,7 +186,7 @@ var enforceFileLimit = (byteLength, limits, operation, limit) => {
 	});
 };
 var invalidResult = (diagnostics) => {
-	return freezeRecursively({
+	return deepFreeze({
 		diagnostics: [...diagnostics],
 		text: null,
 		valid: false
@@ -119,21 +206,20 @@ var invalidResult = (diagnostics) => {
 * - RESOURCE_LIMIT_EXCEEDED: A Core resource limit was exceeded.
 */
 var readInput = (input, limits, operation, limit, diagnostics) => {
-	if (!isRecord$1(input)) return invalidArgument$1(operation);
+	if (!isObjectValid(input, true)) return invalidArgument$1(operation);
 	const pathCandidate = input["path"];
 	const content = input["content"];
 	if (typeof pathCandidate !== "string" || typeof content !== "string" && !(content instanceof Uint8Array)) return invalidArgument$1(operation);
 	const path = parseRepositoryPath(pathCandidate);
 	if (typeof content === "string") {
-		const byteLength = measureScalarUtf8ByteLength(content, limits[limit]);
-		if (byteLength === null) {
+		enforceFileLimit(countUtf8Bytes(content, limits[limit]), limits, operation, limit);
+		if (!content.isWellFormed()) {
 			diagnostics.add({
 				code: "MOLDEA_TEXT_INVALID_UNICODE",
 				path
 			});
 			return invalidResult(diagnostics.finalize());
 		}
-		enforceFileLimit(byteLength, limits, operation, limit);
 		return {
 			path,
 			value: content
@@ -173,12 +259,12 @@ var normalizeTextDocument = (input, limits, operation, limit = "maxFileBytes") =
 	const value = (decoded.value.startsWith("") ? decoded.value.slice(1) : decoded.value).replace(/\r\n?/gu, "\n");
 	collectNulDiagnostics(value, decoded.path, diagnostics);
 	if (diagnostics.size > 0) return invalidResult(diagnostics.finalize());
-	const text = freezeRecursively({
+	const text = deepFreeze({
 		scalarLength: countUnicodeScalars(value),
-		utf8ByteLength: encoder.encode(value).byteLength,
+		utf8ByteLength: countUtf8Bytes(value),
 		value
 	});
-	return freezeRecursively({
+	return deepFreeze({
 		diagnostics: [],
 		text,
 		valid: true
@@ -210,14 +296,14 @@ var calculateNormalizedTextDigest = async (text) => {
 */
 var calculateContentDigest = async (input, limits) => {
 	const normalized = normalizeTextDocument(input, limits, "calculate-content-digest");
-	if (!normalized.valid || normalized.text === null) return freezeRecursively({
+	if (!normalized.valid || normalized.text === null) return deepFreeze({
 		diagnostics: normalized.diagnostics,
 		digest: null,
 		text: null,
 		valid: false
 	});
 	const digest = await calculateNormalizedTextDigest(normalized.text);
-	return freezeRecursively({
+	return deepFreeze({
 		diagnostics: [],
 		digest,
 		text: normalized.text,
@@ -225,68 +311,6 @@ var calculateContentDigest = async (input, limits) => {
 	});
 };
 //#endregion
-//#region src/scope-matching/validations.ts
-var isRecord = (value) => {
-	return typeof value === "object" && value !== null && !Array.isArray(value);
-};
-/** Throws the stable invalid-argument failure for malformed scope input. */
-var invalidArgument = () => {
-	throw new CoreOperationException({
-		code: "INVALID_ARGUMENT",
-		operation: "match-manifest-scope"
-	});
-};
-/** Throws the stable resource failure for an exhausted scope-input budget. */
-var resourceLimitExceeded = (limit, limitMaximum, observedUsage) => {
-	throw new CoreOperationException({
-		code: "RESOURCE_LIMIT_EXCEEDED",
-		limit,
-		limitMaximum,
-		nextAction: "reduce-input-or-increase-limit",
-		observedUsage,
-		operation: "match-manifest-scope"
-	});
-};
-/** Measures scalar UTF-8 bytes without allocating an encoded copy. */
-var measureUtf8ByteLength = (value) => {
-	let byteLength = 0;
-	for (const scalar of value) {
-		const codePoint = scalar.codePointAt(0) ?? 0;
-		byteLength += codePoint <= 127 ? 1 : codePoint <= 2047 ? 2 : codePoint <= 65535 ? 3 : 4;
-	}
-	return byteLength;
-};
-/**
-* Validates and snapshots one public manifest-scope input.
-* @param input The untrusted manifest document and changed logical paths.
-* @param limits The immutable Core resource limits.
-* @returns The detached manifest input and sorted unique repository paths.
-* @throws
-* - INVALID_REPOSITORY_PATH: A changed repository path is invalid.
-* - INVALID_ARGUMENT: The scope operation received an invalid argument.
-* - RESOURCE_LIMIT_EXCEEDED: The changed-path count or byte budget was exceeded.
-*/
-var normalizeManifestScopeInput = (input, limits) => {
-	if (!isRecord(input)) return invalidArgument();
-	const manifest = input["manifest"];
-	const pathCandidates = input["paths"];
-	if (!isRecord(manifest) || !Array.isArray(pathCandidates)) return invalidArgument();
-	if (pathCandidates.length > limits.maxEntries) return resourceLimitExceeded("maxEntries", limits.maxEntries, pathCandidates.length);
-	const uniquePaths = /* @__PURE__ */ new Set();
-	let totalBytes = 0;
-	for (const [index, candidate] of pathCandidates.entries()) {
-		if (typeof candidate !== "string") return invalidArgument();
-		const path = parseRepositoryPath(candidate);
-		totalBytes += measureUtf8ByteLength(path) + (index === 0 ? 0 : 1);
-		if (totalBytes > limits.maxTotalBytesRead) return resourceLimitExceeded("maxTotalBytesRead", limits.maxTotalBytesRead, totalBytes);
-		uniquePaths.add(path);
-	}
-	return {
-		manifest,
-		paths: [...uniquePaths].sort(compareExactStrings)
-	};
-};
-//#endregion
 //#region src/scope-matching/patterns.ts
 /** Tests a single-segment wildcard without regular-expression interpretation. */
 var matchesSegment = (pattern, value) => {
@@ -343,13 +367,13 @@ var createOwner = (kind, id, agentId = null) => ({
 	kind
 });
 var compareOwners = (left, right) => {
-	return compareExactStrings(left.kind, right.kind) || compareExactStrings(left.agentId ?? "", right.agentId ?? "") || compareExactStrings(left.id, right.id);
+	return compareCodePoints(left.kind, right.kind) || compareCodePoints(left.agentId ?? "", right.agentId ?? "") || compareCodePoints(left.id, right.id);
 };
 var getDeclarationValue = (declaration) => {
 	return declaration.kind === "exact" ? declaration.path : declaration.pattern;
 };
 var compareDeclarations = (left, right) => {
-	return compareOwners(left.owner, right.owner) || compareExactStrings(left.field, right.field) || compareExactStrings(getDeclarationValue(left.declaration), getDeclarationValue(right.declaration)) || compareExactStrings(left.pointer, right.pointer);
+	return compareOwners(left.owner, right.owner) || compareCodePoints(left.field, right.field) || compareCodePoints(getDeclarationValue(left.declaration), getDeclarationValue(right.declaration)) || compareCodePoints(left.pointer, right.pointer);
 };
 /** Adds one exact repository relationship to the normalized declaration collection. */
 var addExactDeclaration = (declarations, owner, field, pointer, reference) => {
@@ -390,7 +414,7 @@ var addAffectedByDeclarations = (declarations, affectedBy, owner, pointer) => {
 };
 /** Adds project-level or agent-level unresolved requirement references. */
 var addUnresolvedDeclarations = (declarations, requirements, pointer, agentId) => {
-	for (const requirementId of Object.keys(requirements ?? {}).sort(compareExactStrings)) {
+	for (const requirementId of Object.keys(requirements ?? {}).sort(compareCodePoints)) {
 		const requirement = requirements?.[requirementId];
 		if (requirement === void 0) continue;
 		const owner = createOwner("unresolved", requirementId, agentId);
@@ -422,19 +446,19 @@ var addAgentDeclarations = (declarations, agentId, agent) => {
 		const reference = agent.bindings?.[field];
 		if (reference !== void 0) addExactDeclaration(declarations, owner, field, childPointer$1(bindingsPointer, field), reference);
 	}
-	for (const variableId of Object.keys(agent.bindings?.variableProviders ?? {}).sort(compareExactStrings)) {
+	for (const variableId of Object.keys(agent.bindings?.variableProviders ?? {}).sort(compareCodePoints)) {
 		const reference = agent.bindings?.variableProviders?.[variableId];
 		if (reference !== void 0) addExactDeclaration(declarations, owner, "variableProvider", childPointer$1(childPointer$1(bindingsPointer, "variableProviders"), variableId), reference);
 	}
 	addAffectedByDeclarations(declarations, agent.affectedBy, owner, childPointer$1(pointer, "affectedBy"));
-	for (const capabilityId of Object.keys(agent.tools ?? {}).sort(compareExactStrings)) {
+	for (const capabilityId of Object.keys(agent.tools ?? {}).sort(compareCodePoints)) {
 		const tool = agent.tools?.[capabilityId];
 		if (tool !== void 0) addCapabilityDeclarations(declarations, capabilityId, {
 			kind: "tool",
 			value: tool
 		}, agentId, childPointer$1(childPointer$1(pointer, "tools"), capabilityId));
 	}
-	for (const capabilityId of Object.keys(agent.skills ?? {}).sort(compareExactStrings)) {
+	for (const capabilityId of Object.keys(agent.skills ?? {}).sort(compareCodePoints)) {
 		const skill = agent.skills?.[capabilityId];
 		if (skill !== void 0) addCapabilityDeclarations(declarations, capabilityId, {
 			kind: "skill",
@@ -449,7 +473,7 @@ var collectManifestScopeDeclarations = (manifest) => {
 	const declarations = [];
 	for (const kind of ["context", "decision"]) {
 		const relationships = kind === "context" ? manifest.context : manifest.decisions;
-		for (const ownerId of Object.keys(relationships ?? {}).sort(compareExactStrings)) {
+		for (const ownerId of Object.keys(relationships ?? {}).sort(compareCodePoints)) {
 			const relationship = relationships?.[ownerId];
 			if (relationship === void 0) continue;
 			const owner = createOwner(kind, ownerId);
@@ -459,7 +483,7 @@ var collectManifestScopeDeclarations = (manifest) => {
 		}
 	}
 	addUnresolvedDeclarations(declarations, manifest.unresolved, "/unresolved", null);
-	for (const agentId of Object.keys(manifest.agents ?? {}).sort(compareExactStrings)) {
+	for (const agentId of Object.keys(manifest.agents ?? {}).sort(compareCodePoints)) {
 		const agent = manifest.agents?.[agentId];
 		if (agent !== void 0) addAgentDeclarations(declarations, agentId, agent);
 	}
@@ -507,7 +531,7 @@ var compileManifestScope = (manifest, limits) => {
 	};
 };
 var compareMatches = (left, right) => {
-	return compareOwners(left.owner, right.owner) || compareExactStrings(left.field, right.field) || compareExactStrings(getDeclarationValue(left.declaration), getDeclarationValue(right.declaration)) || compareExactStrings(left.inputPath, right.inputPath) || compareExactStrings(left.pointer, right.pointer);
+	return compareOwners(left.owner, right.owner) || compareCodePoints(left.field, right.field) || compareCodePoints(getDeclarationValue(left.declaration), getDeclarationValue(right.declaration)) || compareCodePoints(left.inputPath, right.inputPath) || compareCodePoints(left.pointer, right.pointer);
 };
 var createMatch = (inputPath, relationship) => ({
 	declaration: relationship.declaration,
@@ -536,8 +560,8 @@ var addGlobMatches = (matches, inputPath, declarations, limits) => {
 var calculateManifestScopeInputDigest = async (paths) => {
 	const value = paths.join("\0");
 	return calculateNormalizedTextDigest({
-		scalarLength: countUnicodeScalars$1(value),
-		utf8ByteLength: measureUtf8ByteLength(value),
+		scalarLength: countUnicodeScalars(value),
+		utf8ByteLength: countUtf8Bytes(value),
 		value
 	});
 };
@@ -567,7 +591,7 @@ var matchParsedManifestScope = (manifest, paths, limits) => {
 		matchedOwners.add(`${match.owner.kind}\0${match.owner.agentId ?? ""}\0${match.owner.id}`);
 		matchedPaths.add(match.inputPath);
 	}
-	return freezeRecursively({
+	return deepFreeze({
 		counts: {
 			declarations: compiled.declarations.length,
 			inputPaths: paths.length,
@@ -799,7 +823,7 @@ var readRelationshipRecord = (node, pointer, kind, context) => {
 	const entries = readMapping(node, pointer, null, context);
 	if (entries === null) return null;
 	const normalized = [];
-	for (const [key, entry] of [...entries].sort(([left], [right]) => compareExactStrings(left, right))) {
+	for (const [key, entry] of [...entries].sort(([left], [right]) => compareCodePoints(left, right))) {
 		const path = parseManifestPath(key);
 		if (!(path !== null && (kind === "context" ? isContextPath(path, true) : isDecisionPath(path)))) {
 			context.diagnostics.add({
@@ -921,7 +945,7 @@ var readVariables = (node, pointer, context, agentId) => {
 	const entries = readMapping(node, pointer, null, context, { agentId });
 	if (entries === null) return null;
 	const normalized = [];
-	for (const [variableId, entry] of [...entries].sort(([left], [right]) => compareExactStrings(left, right))) {
+	for (const [variableId, entry] of [...entries].sort(([left], [right]) => compareCodePoints(left, right))) {
 		const entity = {
 			agentId,
 			variableId
@@ -968,7 +992,7 @@ var readBindings = (node, pointer, context, agentId, declaredVariables) => {
 		const providers = readMapping(providersEntry.value, childPointer(pointer, "variableProviders"), null, context, entity);
 		if (providers !== null) {
 			const normalized = [];
-			for (const [variableId, providerEntry] of [...providers].sort(([left], [right]) => compareExactStrings(left, right))) {
+			for (const [variableId, providerEntry] of [...providers].sort(([left], [right]) => compareCodePoints(left, right))) {
 				const variableEntity = {
 					agentId,
 					variableId
@@ -1078,7 +1102,7 @@ var readCapabilities = (node, pointer, context, agentId, kind) => {
 	const entries = readMapping(node, pointer, null, context, { agentId });
 	if (entries === null) return null;
 	const normalized = [];
-	for (const [capabilityId, entry] of [...entries].sort(([left], [right]) => compareExactStrings(left, right))) {
+	for (const [capabilityId, entry] of [...entries].sort(([left], [right]) => compareCodePoints(left, right))) {
 		const entity = {
 			agentId,
 			capabilityId,
@@ -1095,7 +1119,7 @@ var readUnresolved = (node, pointer, context, agentId) => {
 	const entries = readMapping(node, pointer, null, context, agentId === void 0 ? null : { agentId });
 	if (entries === null) return null;
 	const normalized = [];
-	for (const [requirementId, entry] of [...entries].sort(([left], [right]) => compareExactStrings(left, right))) {
+	for (const [requirementId, entry] of [...entries].sort(([left], [right]) => compareCodePoints(left, right))) {
 		const entity = agentId === void 0 ? null : { agentId };
 		const requirementPointer = childPointer(pointer, requirementId);
 		validateStableId(requirementId, entry.key.range, requirementPointer, context, entity);
@@ -1242,7 +1266,7 @@ var readAgents = (node, pointer, context) => {
 	const entries = readMapping(node, pointer, null, context);
 	if (entries === null) return null;
 	const normalized = [];
-	for (const [agentId, entry] of [...entries].sort(([left], [right]) => compareExactStrings(left, right))) {
+	for (const [agentId, entry] of [...entries].sort(([left], [right]) => compareCodePoints(left, right))) {
 		const agentPointer = childPointer(pointer, agentId);
 		validateStableId(agentId, entry.key.range, agentPointer, context, { agentId });
 		const agent = readAgent(entry.value, agentPointer, context, agentId);
@@ -1331,7 +1355,7 @@ var readAcceptedWarnings = (node, context) => {
 			report(index, "subject", fields.get("subject").range, "repository-path-required");
 			isValid = false;
 		}
-		if (reason !== null && countUnicodeScalars$1(reason) > 256) {
+		if (reason !== null && countUnicodeScalars(reason) > 256) {
 			report(index, "reason", fields.get("reason").range, "maximum-256-characters");
 			isValid = false;
 		}
@@ -1506,17 +1530,6 @@ var addUnsupportedFeature = (diagnostics, path, range, reason) => {
 		range
 	});
 };
-var isUnicodeScalarString = (value) => {
-	for (let index = 0; index < value.length; index += 1) {
-		const codeUnit = value.charCodeAt(index);
-		if (codeUnit >= 55296 && codeUnit <= 56319) {
-			const nextCodeUnit = value.charCodeAt(index + 1);
-			if (!(nextCodeUnit >= 56320 && nextCodeUnit <= 57343)) return false;
-			index += 1;
-		} else if (codeUnit >= 56320 && codeUnit <= 57343) return false;
-	}
-	return true;
-};
 var isCoreTagCompatible = (node) => {
 	switch (node.tag) {
 		case "tag:yaml.org,2002:bool": return isScalar(node) && typeof node.value === "boolean";
@@ -1562,7 +1575,7 @@ var convertNode = (node, path, locator, diagnostics) => {
 			});
 			return null;
 		}
-		if (typeof value === "string" && !isUnicodeScalarString(value)) {
+		if (typeof value === "string" && !value.isWellFormed()) {
 			diagnostics.add({
 				code: "MOLDEA_YAML_MALFORMED",
 				details: { reason: "invalid-unicode" },
@@ -1726,7 +1739,7 @@ var inspectManifestDocument = async (input, options, operation = "parse-manifest
 		path
 	});
 	for (const diagnostic of normalized.diagnostics) diagnostics.merge(diagnostic);
-	if (!normalized.valid || normalized.text === null) return freezeRecursively({
+	if (!normalized.valid || normalized.text === null) return deepFreeze({
 		asset: null,
 		diagnostics: diagnostics.finalize(),
 		formatVersion: null,
@@ -1737,7 +1750,7 @@ var inspectManifestDocument = async (input, options, operation = "parse-manifest
 	const parsed = parseStrictYaml(normalized.text.value, path, locator, diagnostics);
 	const formatVersion = parsed.value === null ? null : detectSupportedManifestVersion(parsed.value);
 	const manifest = parsed.valid && parsed.value !== null ? validateManifest(parsed.value, path, diagnostics, options.limits, operation) : null;
-	if (manifest === null || diagnostics.size > 0) return freezeRecursively({
+	if (manifest === null || diagnostics.size > 0) return deepFreeze({
 		asset: null,
 		diagnostics: diagnostics.finalize(),
 		formatVersion,
@@ -1752,7 +1765,7 @@ var inspectManifestDocument = async (input, options, operation = "parse-manifest
 		scalarLength: normalized.text.scalarLength,
 		utf8ByteLength: normalized.text.utf8ByteLength
 	};
-	return freezeRecursively({
+	return deepFreeze({
 		asset,
 		diagnostics: diagnostics.finalize(),
 		formatVersion,
@@ -1772,7 +1785,7 @@ var inspectManifestDocument = async (input, options, operation = "parse-manifest
 */
 var parseManifestDocument = async (input, options, operation = "parse-manifest") => {
 	const inspection = await inspectManifestDocument(input, options, operation);
-	return freezeRecursively({
+	return deepFreeze({
 		asset: inspection.asset,
 		diagnostics: inspection.diagnostics,
 		manifest: inspection.manifest,
@@ -1780,6 +1793,56 @@ var parseManifestDocument = async (input, options, operation = "parse-manifest")
 	});
 };
 //#endregion
+//#region src/scope-matching/validations.ts
+/** Throws the stable invalid-argument failure for malformed scope input. */
+var invalidArgument = () => {
+	throw new CoreOperationException({
+		code: "INVALID_ARGUMENT",
+		operation: "match-manifest-scope"
+	});
+};
+/** Throws the stable resource failure for an exhausted scope-input budget. */
+var resourceLimitExceeded = (limit, limitMaximum, observedUsage) => {
+	throw new CoreOperationException({
+		code: "RESOURCE_LIMIT_EXCEEDED",
+		limit,
+		limitMaximum,
+		nextAction: "reduce-input-or-increase-limit",
+		observedUsage,
+		operation: "match-manifest-scope"
+	});
+};
+/**
+* Validates and snapshots one public manifest-scope input.
+* @param input The untrusted manifest document and changed logical paths.
+* @param limits The immutable Core resource limits.
+* @returns The detached manifest input and sorted unique repository paths.
+* @throws
+* - INVALID_REPOSITORY_PATH: A changed repository path is invalid.
+* - INVALID_ARGUMENT: The scope operation received an invalid argument.
+* - RESOURCE_LIMIT_EXCEEDED: The changed-path count or byte budget was exceeded.
+*/
+var normalizeManifestScopeInput = (input, limits) => {
+	if (!isObjectValid(input, true)) return invalidArgument();
+	const manifest = input["manifest"];
+	const pathCandidates = input["paths"];
+	if (!isObjectValid(manifest, true) || !Array.isArray(pathCandidates)) return invalidArgument();
+	if (pathCandidates.length > limits.maxEntries) return resourceLimitExceeded("maxEntries", limits.maxEntries, pathCandidates.length);
+	const uniquePaths = /* @__PURE__ */ new Set();
+	let totalBytes = 0;
+	for (const [index, candidate] of pathCandidates.entries()) {
+		if (typeof candidate !== "string") return invalidArgument();
+		const path = parseRepositoryPath(candidate);
+		totalBytes += countUtf8Bytes(path) + (index === 0 ? 0 : 1);
+		if (totalBytes > limits.maxTotalBytesRead) return resourceLimitExceeded("maxTotalBytesRead", limits.maxTotalBytesRead, totalBytes);
+		uniquePaths.add(path);
+	}
+	return {
+		manifest,
+		paths: [...uniquePaths].sort(compareCodePoints)
+	};
+};
+//#endregion
 //#region src/scope-matching/scope.ts
 /**
 * Parses a manifest and matches its repository relationships against changed logical paths.
@@ -1795,7 +1858,7 @@ var matchManifestScope = async (input, options) => {
 	const normalized = normalizeManifestScopeInput(input, options.limits);
 	const inputDigest = await calculateManifestScopeInputDigest(normalized.paths);
 	const parsed = await parseManifestDocument(normalized.manifest, options, "match-manifest-scope");
-	if (!parsed.valid || parsed.asset === null || parsed.manifest === null) return freezeRecursively({
+	if (!parsed.valid || parsed.asset === null || parsed.manifest === null) return deepFreeze({
 		counts: {
 			declarations: 0,
 			inputPaths: normalized.paths.length,
@@ -1811,7 +1874,7 @@ var matchManifestScope = async (input, options) => {
 		valid: false
 	});
 	const matched = matchParsedManifestScope(parsed.manifest, normalized.paths, options.limits);
-	return freezeRecursively({
+	return deepFreeze({
 		counts: matched.counts,
 		diagnostics: [],
 		inputDigest,
@@ -1822,6 +1885,6 @@ var matchManifestScope = async (input, options) => {
 	});
 };
 //#endregion
-export { createSourceLocator as a, calculateContentDigest as c, parseStrictYaml as i, calculateNormalizedTextDigest as l, inspectManifestDocument as n, collectManifestScopeDeclarations as o, parseManifestDocument as r, matchesRepositoryGlob as s, matchManifestScope as t, normalizeTextDocument as u };
+export { trimRepositoryFormatWhitespace as _, createSourceLocator as a, calculateContentDigest as c, countUnicodeScalars as d, hasNonWhitespace as f, parseDecisionIdFromPath as g, isVariableId as h, parseStrictYaml as i, calculateNormalizedTextDigest as l, isRuntimeGuidancePath as m, inspectManifestDocument as n, collectManifestScopeDeclarations as o, isContextPath as p, parseManifestDocument as r, matchesRepositoryGlob as s, matchManifestScope as t, normalizeTextDocument as u };
 
-//# sourceMappingURL=scope-DoNl6LhC.js.map
+//# sourceMappingURL=scope-CNg6Gnpi.js.map