@nxuss/lemma 1.11.0 → 1.14.0

package/dist/cjs/proxy/Gatekeeper.d.ts

@@ -17,6 +17,18 @@ export interface GatekeeperStatus {
     isPro: boolean;
     licenseKey: string | null;
 }
+export type InferenceMode = 'cloud' | 'hybrid' | 'airgapped';
+export interface EgressDecision {
+    allowed: boolean;
+    mode: InferenceMode;
+    host: string;
+    reason: string;
+}
+export declare class EgressBlockedError extends Error {
+    readonly decision: EgressDecision;
+    code: "EGRESS_BLOCKED";
+    constructor(decision: EgressDecision);
+}
 export interface CacheBackend {
     set(key: string, input: string, data: any, ttl: number): Promise<void>;
     findSimilar(input: string, threshold: number): Promise<{
@@ -32,7 +44,24 @@ export declare class Gatekeeper extends EventEmitter {
     private memBackend;
     private semBackend;
     private semInitialized;
+    private inferenceMode;
+    private allowedEndpoints;
     constructor(keyManager: KeyManager);
+    private loadInferencePolicy;
+    getInferenceStatus(): {
+        mode: InferenceMode;
+        allowedEndpoints: string[];
+    };
+    /**
+     * Central egress decision. Called once per outbound provider request from
+     * lemma-proxy.ts — no call site talks to a provider without going through this.
+     */
+    checkEgress(urlOrHost: string): EgressDecision;
+    /**
+     * Throws EgressBlockedError on denial, and emits 'egress-blocked' so callers
+     * (e.g. the audit/token_receipt log) can record the attempt for compliance.
+     */
+    assertEgressAllowed(urlOrHost: string): void;
     getBackend(): Promise<CacheBackend>;
     getMode(): CacheMode;
     getStatus(): GatekeeperStatus;

package/dist/cjs/proxy/Gatekeeper.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"Gatekeeper.d.ts","sourceRoot":"","sources":["../../../src/proxy/Gatekeeper.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,OAAO,EAAE,YAAY,EAAE,MAAM,QAAQ,CAAC;AACtC,OAAO,EAAE,UAAU,EAAE,MAAM,cAAc,CAAC;AAE1C,MAAM,MAAM,SAAS,GAAG,UAAU,GAAG,KAAK,CAAC;AAE3C,MAAM,WAAW,gBAAgB;IAC/B,IAAI,EAAE,SAAS,CAAC;IAChB,eAAe,EAAE,OAAO,CAAC;IACzB,KAAK,EAAE,OAAO,CAAC;IACf,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;CAC3B;AAED,MAAM,WAAW,YAAY;IAC3B,GAAG,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,GAAG,EAAE,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACvE,WAAW,CAAC,KAAK,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC;QAAE,IAAI,EAAE,GAAG,CAAC;QAAC,UAAU,EAAE,MAAM,CAAA;KAAE,GAAG,IAAI,CAAC,CAAC;IACjG,IAAI,IAAI,MAAM,CAAC;IACf,KAAK,IAAI,IAAI,CAAC;CACf;AAED,qBAAa,UAAW,SAAQ,YAAY;IAC1C,OAAO,CAAC,UAAU,CAAa;IAC/B,OAAO,CAAC,QAAQ,CAA0B;IAC1C,OAAO,CAAC,UAAU,CAA6B;IAC/C,OAAO,CAAC,UAAU,CAA6B;IAC/C,OAAO,CAAC,cAAc,CAAS;gBAEnB,UAAU,EAAE,UAAU;IAK5B,UAAU,IAAI,OAAO,CAAC,YAAY,CAAC;IAazC,OAAO,IAAI,SAAS;IAIpB,SAAS,IAAI,gBAAgB;IAK7B,MAAM,IAAI,IAAI;IAId,OAAO,CAAC,gBAAgB;YAKV,kBAAkB;CAejC"}
+{"version":3,"file":"Gatekeeper.d.ts","sourceRoot":"","sources":["../../../src/proxy/Gatekeeper.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,OAAO,EAAE,YAAY,EAAE,MAAM,QAAQ,CAAC;AACtC,OAAO,EAAE,UAAU,EAAE,MAAM,cAAc,CAAC;AAE1C,MAAM,MAAM,SAAS,GAAG,UAAU,GAAG,KAAK,CAAC;AAE3C,MAAM,WAAW,gBAAgB;IAC/B,IAAI,EAAE,SAAS,CAAC;IAChB,eAAe,EAAE,OAAO,CAAC;IACzB,KAAK,EAAE,OAAO,CAAC;IACf,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;CAC3B;AAmBD,MAAM,MAAM,aAAa,GAAG,OAAO,GAAG,QAAQ,GAAG,WAAW,CAAC;AAE7D,MAAM,WAAW,cAAc;IAC7B,OAAO,EAAE,OAAO,CAAC;IACjB,IAAI,EAAE,aAAa,CAAC;IACpB,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,MAAM,CAAC;CAChB;AAED,qBAAa,kBAAmB,SAAQ,KAAK;aAEf,QAAQ,EAAE,cAAc;IADpD,IAAI,EAAG,gBAAgB,CAAU;gBACL,QAAQ,EAAE,cAAc;CAOrD;AA0CD,MAAM,WAAW,YAAY;IAC3B,GAAG,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,GAAG,EAAE,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACvE,WAAW,CAAC,KAAK,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC;QAAE,IAAI,EAAE,GAAG,CAAC;QAAC,UAAU,EAAE,MAAM,CAAA;KAAE,GAAG,IAAI,CAAC,CAAC;IACjG,IAAI,IAAI,MAAM,CAAC;IACf,KAAK,IAAI,IAAI,CAAC;CACf;AAED,qBAAa,UAAW,SAAQ,YAAY;IAC1C,OAAO,CAAC,UAAU,CAAa;IAC/B,OAAO,CAAC,QAAQ,CAA0B;IAC1C,OAAO,CAAC,UAAU,CAA6B;IAC/C,OAAO,CAAC,UAAU,CAA6B;IAC/C,OAAO,CAAC,cAAc,CAAS;IAE/B,OAAO,CAAC,aAAa,CAA0B;IAC/C,OAAO,CAAC,gBAAgB,CAA0B;gBAEtC,UAAU,EAAE,UAAU;IAMlC,OAAO,CAAC,mBAAmB;IAsB3B,kBAAkB;;;;IAOlB;;;OAGG;IACH,WAAW,CAAC,SAAS,EAAE,MAAM,GAAG,cAAc;IAgC9C;;;OAGG;IACH,mBAAmB,CAAC,SAAS,EAAE,MAAM,GAAG,IAAI;IAStC,UAAU,IAAI,OAAO,CAAC,YAAY,CAAC;IAazC,OAAO,IAAI,SAAS;IAIpB,SAAS,IAAI,gBAAgB;IAK7B,MAAM,IAAI,IAAI;IAKd,OAAO,CAAC,gBAAgB;YAKV,kBAAkB;CAejC"}

package/dist/cjs/proxy/Gatekeeper.js

@@ -43,8 +43,60 @@ var __importStar = (this && this.__importStar) || (function () {
     };
 })();
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.Gatekeeper = void 0;
+exports.Gatekeeper = exports.EgressBlockedError = void 0;
 const events_1 = require("events");
+class EgressBlockedError extends Error {
+    constructor(decision) {
+        super(`[Gatekeeper] Blocked outbound request to "${decision.host}" ` +
+            `(LEMMA_INFERENCE_MODE=${decision.mode}): ${decision.reason}`);
+        this.decision = decision;
+        this.code = 'EGRESS_BLOCKED';
+        this.name = 'EgressBlockedError';
+    }
+}
+exports.EgressBlockedError = EgressBlockedError;
+// Public LLM provider hosts we recognize by default. Not exhaustive — enterprises
+// extend this via LEMMA_ALLOWED_ENDPOINTS (allow) rather than us maintaining a
+// perfect blocklist (deny-lists always miss something; this list only needs to
+// cover the hosts Lemma itself dials directly, see lemma-proxy.ts callUpstream).
+const KNOWN_PUBLIC_LLM_HOSTS = [
+    'api.openai.com',
+    'api.anthropic.com',
+    'generativelanguage.googleapis.com',
+    'api.mistral.ai',
+    'api.cohere.ai',
+];
+function parseAllowedEndpoints(raw) {
+    if (!raw)
+        return new Set();
+    return new Set(raw.split(',').map(h => h.trim().toLowerCase()).filter(Boolean));
+}
+function hostOf(urlOrHost) {
+    try {
+        return new URL(urlOrHost).hostname.toLowerCase();
+    }
+    catch {
+        // Already a bare hostname (e.g. from a config value, not a full URL)
+        return urlOrHost.toLowerCase().replace(/:\d+$/, '');
+    }
+}
+function isPrivateHost(host) {
+    if (host === 'localhost' || host === '127.0.0.1' || host === '::1')
+        return true;
+    if (host.endsWith('.local') || host.endsWith('.internal'))
+        return true;
+    const m = host.match(/^(\d{1,3})\.(\d{1,3})\.(\d{1,3})\.(\d{1,3})$/);
+    if (!m)
+        return false;
+    const [a, b] = [parseInt(m[1], 10), parseInt(m[2], 10)];
+    if (a === 10)
+        return true; // 10.0.0.0/8
+    if (a === 172 && b >= 16 && b <= 31)
+        return true; // 172.16.0.0/12
+    if (a === 192 && b === 168)
+        return true; // 192.168.0.0/16
+    return false;
+}
 class Gatekeeper extends events_1.EventEmitter {
     constructor(keyManager) {
         super();
@@ -52,7 +104,75 @@ class Gatekeeper extends events_1.EventEmitter {
         this.memBackend = null;
         this.semBackend = null;
         this.semInitialized = false;
+        this.inferenceMode = 'cloud';
+        this.allowedEndpoints = new Set();
         this.keyManager = keyManager;
+        this.loadInferencePolicy();
+    }
+    loadInferencePolicy() {
+        const envValue = process.env.LEMMA_INFERENCE_MODE;
+        const raw = (envValue || 'cloud').toLowerCase();
+        this.allowedEndpoints = parseAllowedEndpoints(process.env.LEMMA_ALLOWED_ENDPOINTS);
+        if (raw === 'cloud' || raw === 'hybrid' || raw === 'airgapped') {
+            this.inferenceMode = raw;
+            return;
+        }
+        // LEMMA_INFERENCE_MODE was set to something we don't recognize (typo, stale
+        // value, etc). Unset defaults to "cloud" for backward compatibility, but a
+        // *garbled* value must not silently fall back to the unrestricted mode — that
+        // would let a typo quietly disable the one thing enterprises deploy this for.
+        // Fail closed to the strictest mode instead.
+        this.inferenceMode = 'airgapped';
+        console.error(`[Gatekeeper] Unknown LEMMA_INFERENCE_MODE="${envValue}". Failing closed to "airgapped" ` +
+            `(only private hosts + LEMMA_ALLOWED_ENDPOINTS) until this is fixed to one of: cloud, hybrid, airgapped.`);
+    }
+    getInferenceStatus() {
+        return {
+            mode: this.inferenceMode,
+            allowedEndpoints: Array.from(this.allowedEndpoints),
+        };
+    }
+    /**
+     * Central egress decision. Called once per outbound provider request from
+     * lemma-proxy.ts — no call site talks to a provider without going through this.
+     */
+    checkEgress(urlOrHost) {
+        const host = hostOf(urlOrHost);
+        const mode = this.inferenceMode;
+        if (mode === 'cloud') {
+            return { allowed: true, mode, host, reason: 'LEMMA_INFERENCE_MODE=cloud (unrestricted)' };
+        }
+        if (this.allowedEndpoints.has(host)) {
+            return { allowed: true, mode, host, reason: 'host is in LEMMA_ALLOWED_ENDPOINTS' };
+        }
+        if (isPrivateHost(host)) {
+            return { allowed: true, mode, host, reason: 'private/local host' };
+        }
+        if (mode === 'hybrid' && !KNOWN_PUBLIC_LLM_HOSTS.includes(host)) {
+            // hybrid only blocks recognized public LLM providers; unknown hosts (e.g. a
+            // customer's own SaaS endpoint) pass through unless they opt into airgapped.
+            return { allowed: true, mode, host, reason: 'not a recognized public LLM provider host' };
+        }
+        return {
+            allowed: false,
+            mode,
+            host,
+            reason: mode === 'airgapped'
+                ? 'airgapped mode blocks all non-private hosts not in LEMMA_ALLOWED_ENDPOINTS'
+                : 'hybrid mode blocks known public LLM provider hosts not in LEMMA_ALLOWED_ENDPOINTS',
+        };
+    }
+    /**
+     * Throws EgressBlockedError on denial, and emits 'egress-blocked' so callers
+     * (e.g. the audit/token_receipt log) can record the attempt for compliance.
+     */
+    assertEgressAllowed(urlOrHost) {
+        const decision = this.checkEgress(urlOrHost);
+        if (!decision.allowed) {
+            this.emit('egress-blocked', { ...decision, timestamp: Date.now() });
+            console.warn(`[Gatekeeper] BLOCKED egress to ${decision.host} (mode=${decision.mode}): ${decision.reason}`);
+            throw new EgressBlockedError(decision);
+        }
     }
     async getBackend() {
         const mode = this.getMode();
@@ -75,6 +195,7 @@ class Gatekeeper extends events_1.EventEmitter {
     }
     reload() {
         this.keyManager.reload();
+        this.loadInferencePolicy();
     }
     getMemoryBackend() {
         if (!this.memBackend)

package/dist/cjs/proxy/Gatekeeper.js.map

@@ -1 +1 @@
-{"version":3,"file":"Gatekeeper.js","sourceRoot":"","sources":["../../../src/proxy/Gatekeeper.ts"],"names":[],"mappings":";AAAA;;;;;;;;;GASG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAEH,mCAAsC;AAmBtC,MAAa,UAAW,SAAQ,qBAAY;IAO1C,YAAY,UAAsB;QAChC,KAAK,EAAE,CAAC;QANF,aAAQ,GAAqB,IAAI,CAAC;QAClC,eAAU,GAAwB,IAAI,CAAC;QACvC,eAAU,GAAwB,IAAI,CAAC;QACvC,mBAAc,GAAG,KAAK,CAAC;QAI7B,IAAI,CAAC,UAAU,GAAG,UAAU,CAAC;IAC/B,CAAC;IAED,KAAK,CAAC,UAAU;QACd,MAAM,IAAI,GAAG,IAAI,CAAC,OAAO,EAAE,CAAC;QAC5B,IAAI,IAAI,KAAK,IAAI,CAAC,QAAQ,EAAE,CAAC;YAC3B,MAAM,IAAI,GAAG,IAAI,CAAC,QAAQ,CAAC;YAC3B,IAAI,CAAC,QAAQ,GAAG,IAAI,CAAC;YACrB,IAAI,IAAI,KAAK,IAAI,EAAE,CAAC;gBAClB,IAAI,CAAC,IAAI,CAAC,cAAc,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC;gBACpD,OAAO,CAAC,GAAG,CAAC,sBAAsB,IAAI,MAAM,IAAI,EAAE,CAAC,CAAC;YACtD,CAAC;QACH,CAAC;QACD,OAAO,IAAI,KAAK,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,kBAAkB,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,gBAAgB,EAAE,CAAC;IAC9E,CAAC;IAED,OAAO;QACL,OAAO,IAAI,CAAC,UAAU,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,UAAU,CAAC;IACtD,CAAC;IAED,SAAS;QACP,MAAM,IAAI,GAAG,IAAI,CAAC,OAAO,EAAE,CAAC;QAC5B,OAAO,EAAE,IAAI,EAAE,eAAe,EAAE,IAAI,KAAK,KAAK,EAAE,KAAK,EAAE,IAAI,KAAK,KAAK,EAAE,UAAU,EAAE,IAAI,CAAC,UAAU,CAAC,aAAa,EAAE,EAAE,CAAC;IACvH,CAAC;IAED,MAAM;QACJ,IAAI,CAAC,UAAU,CAAC,MAAM,EAAE,CAAC;IAC3B,CAAC;IAEO,gBAAgB;QACtB,IAAI,CAAC,IAAI,CAAC,UAAU;YAAE,IAAI,CAAC,UAAU,GAAG,IAAI,oBAAoB,EAAE,CAAC;QACnE,OAAO,IAAI,CAAC,UAAU,CAAC;IACzB,CAAC;IAEO,KAAK,CAAC,kBAAkB;QAC9B,IAAI,CAAC,IAAI,CAAC,UAAU;YAAE,IAAI,CAAC,UAAU,GAAG,IAAI,sBAAsB,EAAE,CAAC;QACrE,IAAI,CAAC,IAAI,CAAC,cAAc,EAAE,CAAC;YACzB,IAAI,CAAC;gBACH,MAAO,IAAI,CAAC,UAAqC,CAAC,UAAU,EAAE,CAAC;gBAC/D,IAAI,CAAC,cAAc,GAAG,IAAI,CAAC;YAC7B,CAAC;YAAC,OAAO,GAAQ,EAAE,CAAC;gBAClB,OAAO,CAAC,IAAI,CAAC,8CAA8C,GAAG,CAAC,OAAO,EAAE,CAAC,CAAC;gBAC1E,OAAO,CAAC,IAAI,CAAC,kEAAkE,CAAC,CAAC;gBACjF,IAAI,CAAC,UAAU,GAAG,IAAI,CAAC,gBAAgB,EAAE,CAAC;gBAC1C,IAAI,CAAC,cAAc,GAAG,IAAI,CAAC;YAC7B,CAAC;QACH,CAAC;QACD,OAAO,IAAI,CAAC,UAAW,CAAC;IAC1B,CAAC;CACF;AA1DD,gCA0DC;AAED,iFAAiF;AAEjF,SAAS,IAAI,CAAC,CAAS,IAAI,OAAO,CAAC,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC;AAIhF,MAAM,oBAAoB;IAA1B;QACU,UAAK,GAAG,IAAI,GAAG,EAAoB,CAAC;QACpC,YAAO,GAAG,KAAK,CAAC;IAqB1B,CAAC;IAnBC,KAAK,CAAC,GAAG,CAAC,GAAW,EAAE,KAAa,EAAE,IAAS,EAAE,GAAW;QAC1D,IAAI,IAAI,CAAC,KAAK,CAAC,IAAI,IAAI,IAAI,CAAC,OAAO,EAAE,CAAC;YACpC,MAAM,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC;YACzC,IAAI,CAAC;gBAAE,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;QAC9B,CAAC;QACD,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,GAAG,EAAE,EAAE,GAAG,EAAE,KAAK,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,EAAE,GAAG,EAAE,CAAC,CAAC;IACxE,CAAC;IAED,KAAK,CAAC,WAAW,CAAC,KAAa,EAAE,UAAkB;QACjD,MAAM,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC;QACtB,KAAK,MAAM,CAAC,IAAI,IAAI,CAAC,KAAK,CAAC,MAAM,EAAE,EAAE,CAAC;YACpC,IAAI,CAAC,CAAC,GAAG,GAAG,CAAC,IAAI,IAAI,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC,SAAS,GAAG,CAAC,CAAC,GAAG,EAAE,CAAC;gBAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;gBAAC,SAAS;YAAC,CAAC;YAC1F,IAAI,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC;gBAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,UAAU,EAAE,GAAG,EAAE,CAAC;QACpE,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IAED,IAAI,KAAK,OAAO,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC;IAClC,KAAK,KAAK,IAAI,CAAC,KAAK,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC;CAChC;AAID,MAAM,sBAAsB;IAA5B;QACU,UAAK,GAAG,IAAI,GAAG,EAAoB,CAAC;QACpC,aAAQ,GAAQ,IAAI,CAAC;QACrB,aAAQ,GAAG,IAAI,GAAG,EAAoB,CAAC;QACvC,YAAO,GAAG,KAAK,CAAC;IA2C1B,CAAC;IAzCC,KAAK,CAAC,UAAU;QACd,IAAI,IAAI,CAAC,QAAQ;YAAE,OAAO;QAC1B,iCAAiC;QACjC,MAAM,EAAE,QAAQ,EAAE,GAAG,wDAAa,sBAAsB,GAAC,CAAC;QAC1D,IAAI,CAAC,QAAQ,GAAG,MAAM,QAAQ,CAAC,oBAAoB,EAAE,yBAAyB,CAAC,CAAC;IAClF,CAAC;IAED,KAAK,CAAC,GAAG,CAAC,GAAW,EAAE,KAAa,EAAE,IAAS,EAAE,GAAW;QAC1D,IAAI,IAAI,CAAC,KAAK,CAAC,IAAI,IAAI,IAAI,CAAC,OAAO,EAAE,CAAC;YACpC,MAAM,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC;YACzC,IAAI,CAAC;gBAAE,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;QAC9B,CAAC;QACD,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;QAC1C,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,GAAG,EAAE,EAAE,GAAG,EAAE,KAAK,EAAE,SAAS,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,EAAE,GAAG,EAAE,CAAC,CAAC;IACnF,CAAC;IAED,KAAK,CAAC,WAAW,CAAC,KAAa,EAAE,SAAiB;QAChD,IAAI,IAAI,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC;YAAE,OAAO,IAAI,CAAC;QACvC,MAAM,CAAC,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;QAClC,IAAI,IAAI,GAA6C,IAAI,CAAC;QAC1D,IAAI,SAAS,GAAG,CAAC,CAAC,CAAC;QACnB,KAAK,MAAM,CAAC,IAAI,IAAI,CAAC,KAAK,CAAC,MAAM,EAAE,EAAE,CAAC;YACpC,IAAI,CAAC,CAAC,GAAG,GAAG,CAAC,IAAI,IAAI,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC,SAAS,GAAG,CAAC,CAAC,GAAG,EAAE,CAAC;gBAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;gBAAC,SAAS;YAAC,CAAC;YAC1F,MAAM,GAAG,GAAG,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,SAAS,CAAC,CAAC;YACnC,IAAI,GAAG,GAAG,SAAS,IAAI,GAAG,IAAI,SAAS,EAAE,CAAC;gBAAC,SAAS,GAAG,GAAG,CAAC;gBAAC,IAAI,GAAG,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,UAAU,EAAE,GAAG,EAAE,CAAC;YAAC,CAAC;QACzG,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IAEO,KAAK,CAAC,KAAK,CAAC,IAAY;QAC9B,MAAM,CAAC,GAAG,IAAI,CAAC,WAAW,EAAE,CAAC,IAAI,EAAE,CAAC;QACpC,IAAI,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC;YAAE,OAAO,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAE,CAAC;QACvD,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,IAAI,EAAE,EAAE,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QAC5E,MAAM,GAAG,GAAG,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAa,CAAC;QAC7C,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;QAC1B,IAAI,IAAI,CAAC,QAAQ,CAAC,IAAI,GAAG,IAAI,CAAC,OAAO,EAAE,CAAC;YAAC,MAAM,CAAC,GAAG,IAAI,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC;YAAC,IAAI,CAAC;gBAAE,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;QAAC,CAAC;QACvH,OAAO,GAAG,CAAC;IACb,CAAC;IAED,IAAI,KAAK,OAAO,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC;IAClC,KAAK,KAAK,IAAI,CAAC,KAAK,CAAC,KAAK,EAAE,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC;CACvD;AAED,SAAS,MAAM,CAAC,CAAW,EAAE,CAAW;IACtC,IAAI,GAAG,GAAG,CAAC,EAAE,EAAE,GAAG,CAAC,EAAE,EAAE,GAAG,CAAC,CAAC;IAC5B,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QAAC,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC,GAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QAAC,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC,GAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QAAC,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC,GAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IAAC,CAAC;IAC1F,MAAM,CAAC,GAAG,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,GAAG,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACxC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,GAAG,CAAC,CAAC;AAC/B,CAAC"}
+{"version":3,"file":"Gatekeeper.js","sourceRoot":"","sources":["../../../src/proxy/Gatekeeper.ts"],"names":[],"mappings":";AAAA;;;;;;;;;GASG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAEH,mCAAsC;AAsCtC,MAAa,kBAAmB,SAAQ,KAAK;IAE3C,YAA4B,QAAwB;QAClD,KAAK,CACH,6CAA6C,QAAQ,CAAC,IAAI,IAAI;YAC9D,yBAAyB,QAAQ,CAAC,IAAI,MAAM,QAAQ,CAAC,MAAM,EAAE,CAC9D,CAAC;QAJwB,aAAQ,GAAR,QAAQ,CAAgB;QADpD,SAAI,GAAG,gBAAyB,CAAC;QAM/B,IAAI,CAAC,IAAI,GAAG,oBAAoB,CAAC;IACnC,CAAC;CACF;AATD,gDASC;AAED,kFAAkF;AAClF,+EAA+E;AAC/E,+EAA+E;AAC/E,iFAAiF;AACjF,MAAM,sBAAsB,GAAG;IAC7B,gBAAgB;IAChB,mBAAmB;IACnB,mCAAmC;IACnC,gBAAgB;IAChB,eAAe;CAChB,CAAC;AAEF,SAAS,qBAAqB,CAAC,GAAuB;IACpD,IAAI,CAAC,GAAG;QAAE,OAAO,IAAI,GAAG,EAAE,CAAC;IAC3B,OAAO,IAAI,GAAG,CACZ,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAChE,CAAC;AACJ,CAAC;AAED,SAAS,MAAM,CAAC,SAAiB;IAC/B,IAAI,CAAC;QACH,OAAO,IAAI,GAAG,CAAC,SAAS,CAAC,CAAC,QAAQ,CAAC,WAAW,EAAE,CAAC;IACnD,CAAC;IAAC,MAAM,CAAC;QACP,qEAAqE;QACrE,OAAO,SAAS,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC;IACtD,CAAC;AACH,CAAC;AAED,SAAS,aAAa,CAAC,IAAY;IACjC,IAAI,IAAI,KAAK,WAAW,IAAI,IAAI,KAAK,WAAW,IAAI,IAAI,KAAK,KAAK;QAAE,OAAO,IAAI,CAAC;IAChF,IAAI,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,WAAW,CAAC;QAAE,OAAO,IAAI,CAAC;IACvE,MAAM,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,8CAA8C,CAAC,CAAC;IACrE,IAAI,CAAC,CAAC;QAAE,OAAO,KAAK,CAAC;IACrB,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,EAAE,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC;IACxD,IAAI,CAAC,KAAK,EAAE;QAAE,OAAO,IAAI,CAAC,CAAC,aAAa;IACxC,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE;QAAE,OAAO,IAAI,CAAC,CAAC,gBAAgB;IAClE,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,GAAG;QAAE,OAAO,IAAI,CAAC,CAAC,iBAAiB;IAC1D,OAAO,KAAK,CAAC;AACf,CAAC;AASD,MAAa,UAAW,SAAQ,qBAAY;IAU1C,YAAY,UAAsB;QAChC,KAAK,EAAE,CAAC;QATF,aAAQ,GAAqB,IAAI,CAAC;QAClC,eAAU,GAAwB,IAAI,CAAC;QACvC,eAAU,GAAwB,IAAI,CAAC;QACvC,mBAAc,GAAG,KAAK,CAAC;QAEvB,kBAAa,GAAkB,OAAO,CAAC;QACvC,qBAAgB,GAAgB,IAAI,GAAG,EAAE,CAAC;QAIhD,IAAI,CAAC,UAAU,GAAG,UAAU,CAAC;QAC7B,IAAI,CAAC,mBAAmB,EAAE,CAAC;IAC7B,CAAC;IAEO,mBAAmB;QACzB,MAAM,QAAQ,GAAG,OAAO,CAAC,GAAG,CAAC,oBAAoB,CAAC;QAClD,MAAM,GAAG,GAAG,CAAC,QAAQ,IAAI,OAAO,CAAC,CAAC,WAAW,EAAE,CAAC;QAChD,IAAI,CAAC,gBAAgB,GAAG,qBAAqB,CAAC,OAAO,CAAC,GAAG,CAAC,uBAAuB,CAAC,CAAC;QAEnF,IAAI,GAAG,KAAK,OAAO,IAAI,GAAG,KAAK,QAAQ,IAAI,GAAG,KAAK,WAAW,EAAE,CAAC;YAC/D,IAAI,CAAC,aAAa,GAAG,GAAG,CAAC;YACzB,OAAO;QACT,CAAC;QAED,4EAA4E;QAC5E,2EAA2E;QAC3E,8EAA8E;QAC9E,8EAA8E;QAC9E,6CAA6C;QAC7C,IAAI,CAAC,aAAa,GAAG,WAAW,CAAC;QACjC,OAAO,CAAC,KAAK,CACX,8CAA8C,QAAQ,mCAAmC;YACzF,yGAAyG,CAC1G,CAAC;IACJ,CAAC;IAED,kBAAkB;QAChB,OAAO;YACL,IAAI,EAAE,IAAI,CAAC,aAAa;YACxB,gBAAgB,EAAE,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,gBAAgB,CAAC;SACpD,CAAC;IACJ,CAAC;IAED;;;OAGG;IACH,WAAW,CAAC,SAAiB;QAC3B,MAAM,IAAI,GAAG,MAAM,CAAC,SAAS,CAAC,CAAC;QAC/B,MAAM,IAAI,GAAG,IAAI,CAAC,aAAa,CAAC;QAEhC,IAAI,IAAI,KAAK,OAAO,EAAE,CAAC;YACrB,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,EAAE,2CAA2C,EAAE,CAAC;QAC5F,CAAC;QAED,IAAI,IAAI,CAAC,gBAAgB,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;YACpC,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,EAAE,oCAAoC,EAAE,CAAC;QACrF,CAAC;QAED,IAAI,aAAa,CAAC,IAAI,CAAC,EAAE,CAAC;YACxB,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,EAAE,oBAAoB,EAAE,CAAC;QACrE,CAAC;QAED,IAAI,IAAI,KAAK,QAAQ,IAAI,CAAC,sBAAsB,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;YAChE,4EAA4E;YAC5E,6EAA6E;YAC7E,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,EAAE,2CAA2C,EAAE,CAAC;QAC5F,CAAC;QAED,OAAO;YACL,OAAO,EAAE,KAAK;YACd,IAAI;YACJ,IAAI;YACJ,MAAM,EAAE,IAAI,KAAK,WAAW;gBAC1B,CAAC,CAAC,4EAA4E;gBAC9E,CAAC,CAAC,mFAAmF;SACxF,CAAC;IACJ,CAAC;IAED;;;OAGG;IACH,mBAAmB,CAAC,SAAiB;QACnC,MAAM,QAAQ,GAAG,IAAI,CAAC,WAAW,CAAC,SAAS,CAAC,CAAC;QAC7C,IAAI,CAAC,QAAQ,CAAC,OAAO,EAAE,CAAC;YACtB,IAAI,CAAC,IAAI,CAAC,gBAAgB,EAAE,EAAE,GAAG,QAAQ,EAAE,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;YACpE,OAAO,CAAC,IAAI,CAAC,kCAAkC,QAAQ,CAAC,IAAI,UAAU,QAAQ,CAAC,IAAI,MAAM,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAC;YAC5G,MAAM,IAAI,kBAAkB,CAAC,QAAQ,CAAC,CAAC;QACzC,CAAC;IACH,CAAC;IAED,KAAK,CAAC,UAAU;QACd,MAAM,IAAI,GAAG,IAAI,CAAC,OAAO,EAAE,CAAC;QAC5B,IAAI,IAAI,KAAK,IAAI,CAAC,QAAQ,EAAE,CAAC;YAC3B,MAAM,IAAI,GAAG,IAAI,CAAC,QAAQ,CAAC;YAC3B,IAAI,CAAC,QAAQ,GAAG,IAAI,CAAC;YACrB,IAAI,IAAI,KAAK,IAAI,EAAE,CAAC;gBAClB,IAAI,CAAC,IAAI,CAAC,cAAc,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC;gBACpD,OAAO,CAAC,GAAG,CAAC,sBAAsB,IAAI,MAAM,IAAI,EAAE,CAAC,CAAC;YACtD,CAAC;QACH,CAAC;QACD,OAAO,IAAI,KAAK,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,kBAAkB,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,gBAAgB,EAAE,CAAC;IAC9E,CAAC;IAED,OAAO;QACL,OAAO,IAAI,CAAC,UAAU,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,UAAU,CAAC;IACtD,CAAC;IAED,SAAS;QACP,MAAM,IAAI,GAAG,IAAI,CAAC,OAAO,EAAE,CAAC;QAC5B,OAAO,EAAE,IAAI,EAAE,eAAe,EAAE,IAAI,KAAK,KAAK,EAAE,KAAK,EAAE,IAAI,KAAK,KAAK,EAAE,UAAU,EAAE,IAAI,CAAC,UAAU,CAAC,aAAa,EAAE,EAAE,CAAC;IACvH,CAAC;IAED,MAAM;QACJ,IAAI,CAAC,UAAU,CAAC,MAAM,EAAE,CAAC;QACzB,IAAI,CAAC,mBAAmB,EAAE,CAAC;IAC7B,CAAC;IAEO,gBAAgB;QACtB,IAAI,CAAC,IAAI,CAAC,UAAU;YAAE,IAAI,CAAC,UAAU,GAAG,IAAI,oBAAoB,EAAE,CAAC;QACnE,OAAO,IAAI,CAAC,UAAU,CAAC;IACzB,CAAC;IAEO,KAAK,CAAC,kBAAkB;QAC9B,IAAI,CAAC,IAAI,CAAC,UAAU;YAAE,IAAI,CAAC,UAAU,GAAG,IAAI,sBAAsB,EAAE,CAAC;QACrE,IAAI,CAAC,IAAI,CAAC,cAAc,EAAE,CAAC;YACzB,IAAI,CAAC;gBACH,MAAO,IAAI,CAAC,UAAqC,CAAC,UAAU,EAAE,CAAC;gBAC/D,IAAI,CAAC,cAAc,GAAG,IAAI,CAAC;YAC7B,CAAC;YAAC,OAAO,GAAQ,EAAE,CAAC;gBAClB,OAAO,CAAC,IAAI,CAAC,8CAA8C,GAAG,CAAC,OAAO,EAAE,CAAC,CAAC;gBAC1E,OAAO,CAAC,IAAI,CAAC,kEAAkE,CAAC,CAAC;gBACjF,IAAI,CAAC,UAAU,GAAG,IAAI,CAAC,gBAAgB,EAAE,CAAC;gBAC1C,IAAI,CAAC,cAAc,GAAG,IAAI,CAAC;YAC7B,CAAC;QACH,CAAC;QACD,OAAO,IAAI,CAAC,UAAW,CAAC;IAC1B,CAAC;CACF;AA7ID,gCA6IC;AAED,iFAAiF;AAEjF,SAAS,IAAI,CAAC,CAAS,IAAI,OAAO,CAAC,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC;AAIhF,MAAM,oBAAoB;IAA1B;QACU,UAAK,GAAG,IAAI,GAAG,EAAoB,CAAC;QACpC,YAAO,GAAG,KAAK,CAAC;IAqB1B,CAAC;IAnBC,KAAK,CAAC,GAAG,CAAC,GAAW,EAAE,KAAa,EAAE,IAAS,EAAE,GAAW;QAC1D,IAAI,IAAI,CAAC,KAAK,CAAC,IAAI,IAAI,IAAI,CAAC,OAAO,EAAE,CAAC;YACpC,MAAM,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC;YACzC,IAAI,CAAC;gBAAE,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;QAC9B,CAAC;QACD,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,GAAG,EAAE,EAAE,GAAG,EAAE,KAAK,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,EAAE,GAAG,EAAE,CAAC,CAAC;IACxE,CAAC;IAED,KAAK,CAAC,WAAW,CAAC,KAAa,EAAE,UAAkB;QACjD,MAAM,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC;QACtB,KAAK,MAAM,CAAC,IAAI,IAAI,CAAC,KAAK,CAAC,MAAM,EAAE,EAAE,CAAC;YACpC,IAAI,CAAC,CAAC,GAAG,GAAG,CAAC,IAAI,IAAI,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC,SAAS,GAAG,CAAC,CAAC,GAAG,EAAE,CAAC;gBAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;gBAAC,SAAS;YAAC,CAAC;YAC1F,IAAI,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC;gBAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,UAAU,EAAE,GAAG,EAAE,CAAC;QACpE,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IAED,IAAI,KAAK,OAAO,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC;IAClC,KAAK,KAAK,IAAI,CAAC,KAAK,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC;CAChC;AAID,MAAM,sBAAsB;IAA5B;QACU,UAAK,GAAG,IAAI,GAAG,EAAoB,CAAC;QACpC,aAAQ,GAAQ,IAAI,CAAC;QACrB,aAAQ,GAAG,IAAI,GAAG,EAAoB,CAAC;QACvC,YAAO,GAAG,KAAK,CAAC;IA2C1B,CAAC;IAzCC,KAAK,CAAC,UAAU;QACd,IAAI,IAAI,CAAC,QAAQ;YAAE,OAAO;QAC1B,iCAAiC;QACjC,MAAM,EAAE,QAAQ,EAAE,GAAG,wDAAa,sBAAsB,GAAC,CAAC;QAC1D,IAAI,CAAC,QAAQ,GAAG,MAAM,QAAQ,CAAC,oBAAoB,EAAE,yBAAyB,CAAC,CAAC;IAClF,CAAC;IAED,KAAK,CAAC,GAAG,CAAC,GAAW,EAAE,KAAa,EAAE,IAAS,EAAE,GAAW;QAC1D,IAAI,IAAI,CAAC,KAAK,CAAC,IAAI,IAAI,IAAI,CAAC,OAAO,EAAE,CAAC;YACpC,MAAM,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC;YACzC,IAAI,CAAC;gBAAE,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;QAC9B,CAAC;QACD,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;QAC1C,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,GAAG,EAAE,EAAE,GAAG,EAAE,KAAK,EAAE,SAAS,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,EAAE,GAAG,EAAE,CAAC,CAAC;IACnF,CAAC;IAED,KAAK,CAAC,WAAW,CAAC,KAAa,EAAE,SAAiB;QAChD,IAAI,IAAI,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC;YAAE,OAAO,IAAI,CAAC;QACvC,MAAM,CAAC,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;QAClC,IAAI,IAAI,GAA6C,IAAI,CAAC;QAC1D,IAAI,SAAS,GAAG,CAAC,CAAC,CAAC;QACnB,KAAK,MAAM,CAAC,IAAI,IAAI,CAAC,KAAK,CAAC,MAAM,EAAE,EAAE,CAAC;YACpC,IAAI,CAAC,CAAC,GAAG,GAAG,CAAC,IAAI,IAAI,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC,SAAS,GAAG,CAAC,CAAC,GAAG,EAAE,CAAC;gBAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;gBAAC,SAAS;YAAC,CAAC;YAC1F,MAAM,GAAG,GAAG,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,SAAS,CAAC,CAAC;YACnC,IAAI,GAAG,GAAG,SAAS,IAAI,GAAG,IAAI,SAAS,EAAE,CAAC;gBAAC,SAAS,GAAG,GAAG,CAAC;gBAAC,IAAI,GAAG,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,UAAU,EAAE,GAAG,EAAE,CAAC;YAAC,CAAC;QACzG,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IAEO,KAAK,CAAC,KAAK,CAAC,IAAY;QAC9B,MAAM,CAAC,GAAG,IAAI,CAAC,WAAW,EAAE,CAAC,IAAI,EAAE,CAAC;QACpC,IAAI,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC;YAAE,OAAO,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAE,CAAC;QACvD,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,IAAI,EAAE,EAAE,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QAC5E,MAAM,GAAG,GAAG,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAa,CAAC;QAC7C,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;QAC1B,IAAI,IAAI,CAAC,QAAQ,CAAC,IAAI,GAAG,IAAI,CAAC,OAAO,EAAE,CAAC;YAAC,MAAM,CAAC,GAAG,IAAI,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC;YAAC,IAAI,CAAC;gBAAE,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;QAAC,CAAC;QACvH,OAAO,GAAG,CAAC;IACb,CAAC;IAED,IAAI,KAAK,OAAO,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC;IAClC,KAAK,KAAK,IAAI,CAAC,KAAK,CAAC,KAAK,EAAE,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC;CACvD;AAED,SAAS,MAAM,CAAC,CAAW,EAAE,CAAW;IACtC,IAAI,GAAG,GAAG,CAAC,EAAE,EAAE,GAAG,CAAC,EAAE,EAAE,GAAG,CAAC,CAAC;IAC5B,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QAAC,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC,GAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QAAC,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC,GAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QAAC,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC,GAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IAAC,CAAC;IAC1F,MAAM,CAAC,GAAG,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,GAAG,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACxC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,GAAG,CAAC,CAAC;AAC/B,CAAC"}

package/dist/cjs/subconscious/TheBrainV2.d.ts

@@ -38,6 +38,12 @@ export interface BrainEntry {
      * fix — the Brain can only ever suggest reuse, never warn "we already tried this."
      */
     outcome?: 'confirmed' | 'failed';
+    /**
+     * Free-text domain tag (e.g. "auth", "billing") lifted from cognitive_map's current
+     * context at store time. Absent means untagged — those entries stay visible to every
+     * domain-scoped search rather than disappearing, same rationale as projectId above.
+     */
+    domain?: string;
     /**
      * Absolute-path::symbolName -> sha256 of just that symbol's extracted source (via
      * SymbolSurgicalContext), not the whole file. When a file has an entry here, freshness
@@ -55,6 +61,12 @@ export interface BrainEntry {
      * still trustworthy instead of discarding (or blindly trusting) the whole thing.
      */
     claims?: Claim[];
+    /**
+     * Count of explicit "this memory led me astray" signals via downvote(). Distinct from
+     * hits: hits means "this surfaced and looked relevant enough to reuse," demerits means
+     * "reuse turned out to be wrong." Absent/0 means never downvoted.
+     */
+    demerits?: number;
 }
 export interface Claim {
     id: string;
@@ -89,6 +101,7 @@ export interface BrainSearchResult {
     staleFiles?: string[];
     outcome?: 'confirmed' | 'failed';
     claims?: ClaimFreshness[];
+    domain?: string;
 }
 export interface BrainSearchOptions {
     /**
@@ -99,6 +112,8 @@ export interface BrainSearchOptions {
     countStats?: boolean;
     /** Prefer memories from this project. See the scoping note in search(). */
     projectId?: string;
+    /** Prefer memories tagged with this domain. Same soft-fallback rule as projectId. */
+    domain?: string;
 }
 export interface BrainStats {
     totalEntries: number;
@@ -156,11 +171,33 @@ export declare class TheBrainV2 {
      * Store a query+response pair in the brain.
      * Returns false if detected as duplicate (>= dupThreshold similarity).
      */
-    store(query: string, response: string, provider?: string, dupThreshold?: number, filePaths?: string[], projectId?: string, outcome?: 'confirmed' | 'failed', symbolRefs?: SymbolRef[], claimInputs?: ClaimInput[]): {
+    store(query: string, response: string, provider?: string, dupThreshold?: number, filePaths?: string[], projectId?: string, outcome?: 'confirmed' | 'failed', symbolRefs?: SymbolRef[], claimInputs?: ClaimInput[], domain?: string): {
         stored: boolean;
         reason: string;
         duplicate?: BrainSearchResult;
+        conflicts?: Array<{
+            id: string;
+            query: string;
+            outcome: 'confirmed' | 'failed';
+        }>;
     };
+    /**
+     * Hard cap on entry count. Past this, the inverted index keeps growing and old, unused
+     * entries dilute every future BM25 IDF calculation (more docs sharing a term → lower
+     * signal) without ever being asked for again. Evicting keeps ranking quality from
+     * degrading as the Brain accumulates months of memories.
+     */
+    private static readonly MAX_ENTRIES;
+    /** How many entries to evict per pass once over MAX_ENTRIES — batched, not one-at-a-time. */
+    private static readonly EVICT_BATCH;
+    /**
+     * Evict the lowest-value entries once the Brain is over capacity. Value = hits (proven
+     * usefulness) with a mild recency tiebreak — never based on similarity to any one query,
+     * since an entry unrelated to today's search may still be exactly what tomorrow's needs.
+     * Failed-outcome entries are cheap to keep (they're short, deliberate warnings) so they're
+     * evicted last among equally-unused entries rather than first.
+     */
+    private evictIfOverCapacity;
     /**
      * Search brain using BM25 + Jaccard re-ranking.
      * Returns results with similarity scores normalized to 0-1.
@@ -180,6 +217,18 @@ export declare class TheBrainV2 {
         similarity: number;
         existing?: BrainSearchResult;
     };
+    /**
+     * Record that a specific memory turned out NOT to help — the caller acted on it and it
+     * was wrong, misleading, or irrelevant despite ranking well. Unlike `outcome: 'failed'`
+     * (set at store time, about the underlying approach), this is set after the fact, about
+     * the memory's usefulness as a search result. Lowers future ranking and eviction priority
+     * without deleting the entry — a bad-fit-today memory may still be exactly right for a
+     * differently-phrased query tomorrow.
+     */
+    downvote(id: string): {
+        ok: boolean;
+        message: string;
+    };
     getStats(): BrainStats;
     clear(): void;
 }

package/dist/cjs/subconscious/TheBrainV2.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"TheBrainV2.d.ts","sourceRoot":"","sources":["../../../src/subconscious/TheBrainV2.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAUH,MAAM,WAAW,UAAU;IACzB,EAAE,EAAE,MAAM,CAAC;IACX,KAAK,EAAE,MAAM,CAAC;IACd,QAAQ,EAAE,MAAM,CAAC;IACjB;;;;OAIG;IACH,KAAK,EAAE,MAAM,EAAE,CAAC;IAChB,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACjC,QAAQ,EAAE,MAAM,CAAC;IACjB,SAAS,EAAE,MAAM,CAAC;IAClB,IAAI,EAAE,MAAM,CAAC;IACb,SAAS,EAAE,MAAM,CAAC;IAClB;;;;OAIG;IACH,SAAS,CAAC,EAAE,MAAM,CAAC;IAInB,UAAU,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACpC;;;;;OAKG;IACH,OAAO,CAAC,EAAE,WAAW,GAAG,QAAQ,CAAC;IACjC;;;;;;;OAOG;IACH,YAAY,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACtC;;;;;;OAMG;IACH,MAAM,CAAC,EAAE,KAAK,EAAE,CAAC;CAClB;AAED,MAAM,WAAW,KAAK;IACpB,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,MAAM,CAAC;IACb,UAAU,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACpC,YAAY,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CACvC;AAED,MAAM,WAAW,UAAU;IACzB,IAAI,EAAE,MAAM,CAAC;IACb,SAAS,CAAC,EAAE,MAAM,EAAE,CAAC;IACrB,OAAO,CAAC,EAAE,SAAS,EAAE,CAAC;CACvB;AAED,MAAM,WAAW,cAAc;IAC7B,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,OAAO,CAAC;IACf,UAAU,CAAC,EAAE,MAAM,EAAE,CAAC;CACvB;AAED,MAAM,WAAW,SAAS;IACxB,sFAAsF;IACtF,QAAQ,EAAE,MAAM,CAAC;IACjB,UAAU,EAAE,MAAM,CAAC;CACpB;AAED,MAAM,WAAW,iBAAiB;IAChC,EAAE,EAAE,MAAM,CAAC;IACX,KAAK,EAAE,MAAM,CAAC;IACd,QAAQ,EAAE,MAAM,CAAC;IACjB,UAAU,EAAE,MAAM,CAAC;IACnB,QAAQ,EAAE,MAAM,CAAC;IACjB,SAAS,EAAE,MAAM,CAAC;IAClB,KAAK,EAAE,OAAO,CAAC;IACf,UAAU,CAAC,EAAE,MAAM,EAAE,CAAC;IACtB,OAAO,CAAC,EAAE,WAAW,GAAG,QAAQ,CAAC;IACjC,MAAM,CAAC,EAAE,cAAc,EAAE,CAAC;CAC3B;AAED,MAAM,WAAW,kBAAkB;IACjC;;;;OAIG;IACH,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB,2EAA2E;IAC3E,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED,MAAM,WAAW,UAAU;IACzB,YAAY,EAAE,MAAM,CAAC;IACrB,UAAU,EAAE,MAAM,CAAC;IACnB,YAAY,EAAE,MAAM,CAAC;IACrB,eAAe,EAAE,MAAM,CAAC;IACxB,SAAS,EAAE,MAAM,CAAC;IAClB,WAAW,EAAE,MAAM,CAAC;CACrB;AAqBD;;;;;;GAMG;AACH,wBAAgB,eAAe,CAAC,GAAG,GAAE,MAAsB,GAAG,MAAM,CAqCnE;AAID;;;GAGG;AACH,wBAAgB,QAAQ,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,EAAE,CAuD/C;AA4BD;;GAEG;AACH,wBAAgB,eAAe,CAAC,KAAK,EAAE,MAAM,EAAE,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAMvE;AAgBD,qBAAa,WAAW;IACtB,OAAO,CAAC,IAAI,CAAa;gBAEb,UAAU,CAAC,EAAE,MAAM;IAQ/B,GAAG,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI;IAOvB,GAAG,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO;IAQ1B,SAAS,IAAI,MAAM;CAGpB;AAID,wBAAgB,SAAS,CACvB,UAAU,EAAE,MAAM,EAAE,EACpB,WAAW,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,EACnC,SAAS,EAAE,MAAM,EACjB,YAAY,EAAE,MAAM,EACpB,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAC1B,MAAM,CAWR;AAED;;GAEG;AACH,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,GAAG,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,GAAG,CAAC,MAAM,CAAC,GAAG,MAAM,CAO9E;AA8ID,qBAAa,UAAU;IACrB,OAAO,CAAC,OAAO,CAAsC;IACrD,OAAO,CAAC,aAAa,CAAuC;IAC5D,OAAO,CAAC,KAAK,CAAkC;IAC/C,OAAO,CAAC,YAAY,CAAK;IACzB,OAAO,CAAC,WAAW,CAAK;IACxB,OAAO,CAAC,aAAa,CAAK;IAC1B,OAAO,CAAC,KAAK,CAAS;IACtB,OAAO,CAAC,UAAU,CAA8C;;IAShE,OAAO,CAAC,SAAS;IAMjB,OAAO,CAAC,IAAI;IA0CZ,OAAO,CAAC,kBAAkB;IAM1B,OAAO,CAAC,YAAY;IASpB,OAAO,CAAC,IAAI;IAiCZ;;;OAGG;IACH,KAAK,CACH,KAAK,EAAE,MAAM,EACb,QAAQ,EAAE,MAAM,EAChB,QAAQ,SAAY,EACpB,YAAY,SAAO,EACnB,SAAS,CAAC,EAAE,MAAM,EAAE,EACpB,SAAS,GAAE,MAA0B,EACrC,OAAO,CAAC,EAAE,WAAW,GAAG,QAAQ,EAChC,UAAU,CAAC,EAAE,SAAS,EAAE,EACxB,WAAW,CAAC,EAAE,UAAU,EAAE,GACzB;QAAE,MAAM,EAAE,OAAO,CAAC;QAAC,MAAM,EAAE,MAAM,CAAC;QAAC,SAAS,CAAC,EAAE,iBAAiB,CAAA;KAAE;IA6DrE;;;OAGG;IACH,MAAM,CACJ,KAAK,EAAE,MAAM,EACb,KAAK,SAAI,EACT,aAAa,SAAI,EACjB,OAAO,GAAE,kBAAuB,GAC/B,iBAAiB,EAAE;IAgItB;;;OAGG;IACH,oBAAoB,CAAC,SAAS,EAAE,MAAM,GAAG,UAAU,EAAE;IAQrD;;;OAGG;IACH,cAAc,CACZ,KAAK,EAAE,MAAM,EACb,QAAQ,EAAE,MAAM,EAChB,SAAS,SAAO,GACf;QAAE,WAAW,EAAE,OAAO,CAAC;QAAC,UAAU,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,EAAE,iBAAiB,CAAA;KAAE;IA6B7E,QAAQ,IAAI,UAAU;IAWtB,KAAK,IAAI,IAAI;CAad;AAMD,wBAAgB,QAAQ,IAAI,UAAU,CAGrC"}
+{"version":3,"file":"TheBrainV2.d.ts","sourceRoot":"","sources":["../../../src/subconscious/TheBrainV2.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAUH,MAAM,WAAW,UAAU;IACzB,EAAE,EAAE,MAAM,CAAC;IACX,KAAK,EAAE,MAAM,CAAC;IACd,QAAQ,EAAE,MAAM,CAAC;IACjB;;;;OAIG;IACH,KAAK,EAAE,MAAM,EAAE,CAAC;IAChB,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACjC,QAAQ,EAAE,MAAM,CAAC;IACjB,SAAS,EAAE,MAAM,CAAC;IAClB,IAAI,EAAE,MAAM,CAAC;IACb,SAAS,EAAE,MAAM,CAAC;IAClB;;;;OAIG;IACH,SAAS,CAAC,EAAE,MAAM,CAAC;IAInB,UAAU,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACpC;;;;;OAKG;IACH,OAAO,CAAC,EAAE,WAAW,GAAG,QAAQ,CAAC;IACjC;;;;OAIG;IACH,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB;;;;;;;OAOG;IACH,YAAY,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACtC;;;;;;OAMG;IACH,MAAM,CAAC,EAAE,KAAK,EAAE,CAAC;IACjB;;;;OAIG;IACH,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,KAAK;IACpB,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,MAAM,CAAC;IACb,UAAU,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACpC,YAAY,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CACvC;AAED,MAAM,WAAW,UAAU;IACzB,IAAI,EAAE,MAAM,CAAC;IACb,SAAS,CAAC,EAAE,MAAM,EAAE,CAAC;IACrB,OAAO,CAAC,EAAE,SAAS,EAAE,CAAC;CACvB;AAED,MAAM,WAAW,cAAc;IAC7B,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,OAAO,CAAC;IACf,UAAU,CAAC,EAAE,MAAM,EAAE,CAAC;CACvB;AAED,MAAM,WAAW,SAAS;IACxB,sFAAsF;IACtF,QAAQ,EAAE,MAAM,CAAC;IACjB,UAAU,EAAE,MAAM,CAAC;CACpB;AAED,MAAM,WAAW,iBAAiB;IAChC,EAAE,EAAE,MAAM,CAAC;IACX,KAAK,EAAE,MAAM,CAAC;IACd,QAAQ,EAAE,MAAM,CAAC;IACjB,UAAU,EAAE,MAAM,CAAC;IACnB,QAAQ,EAAE,MAAM,CAAC;IACjB,SAAS,EAAE,MAAM,CAAC;IAClB,KAAK,EAAE,OAAO,CAAC;IACf,UAAU,CAAC,EAAE,MAAM,EAAE,CAAC;IACtB,OAAO,CAAC,EAAE,WAAW,GAAG,QAAQ,CAAC;IACjC,MAAM,CAAC,EAAE,cAAc,EAAE,CAAC;IAC1B,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED,MAAM,WAAW,kBAAkB;IACjC;;;;OAIG;IACH,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB,2EAA2E;IAC3E,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,qFAAqF;IACrF,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED,MAAM,WAAW,UAAU;IACzB,YAAY,EAAE,MAAM,CAAC;IACrB,UAAU,EAAE,MAAM,CAAC;IACnB,YAAY,EAAE,MAAM,CAAC;IACrB,eAAe,EAAE,MAAM,CAAC;IACxB,SAAS,EAAE,MAAM,CAAC;IAClB,WAAW,EAAE,MAAM,CAAC;CACrB;AAqBD;;;;;;GAMG;AACH,wBAAgB,eAAe,CAAC,GAAG,GAAE,MAAsB,GAAG,MAAM,CAqCnE;AAID;;;GAGG;AACH,wBAAgB,QAAQ,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,EAAE,CA+D/C;AAoDD;;GAEG;AACH,wBAAgB,eAAe,CAAC,KAAK,EAAE,MAAM,EAAE,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAMvE;AAgBD,qBAAa,WAAW;IACtB,OAAO,CAAC,IAAI,CAAa;gBAEb,UAAU,CAAC,EAAE,MAAM;IAQ/B,GAAG,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI;IAOvB,GAAG,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO;IAQ1B,SAAS,IAAI,MAAM;CAGpB;AAID,wBAAgB,SAAS,CACvB,UAAU,EAAE,MAAM,EAAE,EACpB,WAAW,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,EACnC,SAAS,EAAE,MAAM,EACjB,YAAY,EAAE,MAAM,EACpB,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAC1B,MAAM,CAWR;AAED;;GAEG;AACH,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,GAAG,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,GAAG,CAAC,MAAM,CAAC,GAAG,MAAM,CAO9E;AA8ID,qBAAa,UAAU;IACrB,OAAO,CAAC,OAAO,CAAsC;IACrD,OAAO,CAAC,aAAa,CAAuC;IAC5D,OAAO,CAAC,KAAK,CAAkC;IAC/C,OAAO,CAAC,YAAY,CAAK;IACzB,OAAO,CAAC,WAAW,CAAK;IACxB,OAAO,CAAC,aAAa,CAAK;IAC1B,OAAO,CAAC,KAAK,CAAS;IACtB,OAAO,CAAC,UAAU,CAA8C;;IAShE,OAAO,CAAC,SAAS;IAMjB,OAAO,CAAC,IAAI;IA0CZ,OAAO,CAAC,kBAAkB;IAM1B,OAAO,CAAC,YAAY;IASpB,OAAO,CAAC,IAAI;IAiCZ;;;OAGG;IACH,KAAK,CACH,KAAK,EAAE,MAAM,EACb,QAAQ,EAAE,MAAM,EAChB,QAAQ,SAAY,EACpB,YAAY,SAAO,EACnB,SAAS,CAAC,EAAE,MAAM,EAAE,EACpB,SAAS,GAAE,MAA0B,EACrC,OAAO,CAAC,EAAE,WAAW,GAAG,QAAQ,EAChC,UAAU,CAAC,EAAE,SAAS,EAAE,EACxB,WAAW,CAAC,EAAE,UAAU,EAAE,EAC1B,MAAM,CAAC,EAAE,MAAM,GACd;QACD,MAAM,EAAE,OAAO,CAAC;QAChB,MAAM,EAAE,MAAM,CAAC;QACf,SAAS,CAAC,EAAE,iBAAiB,CAAC;QAC9B,SAAS,CAAC,EAAE,KAAK,CAAC;YAAE,EAAE,EAAE,MAAM,CAAC;YAAC,KAAK,EAAE,MAAM,CAAC;YAAC,OAAO,EAAE,WAAW,GAAG,QAAQ,CAAA;SAAE,CAAC,CAAC;KACnF;IAkFD;;;;;OAKG;IACH,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,WAAW,CAAQ;IAC3C,6FAA6F;IAC7F,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,WAAW,CAAO;IAE1C;;;;;;OAMG;IACH,OAAO,CAAC,mBAAmB;IA8B3B;;;OAGG;IACH,MAAM,CACJ,KAAK,EAAE,MAAM,EACb,KAAK,SAAI,EACT,aAAa,SAAI,EACjB,OAAO,GAAE,kBAAuB,GAC/B,iBAAiB,EAAE;IAyJtB;;;OAGG;IACH,oBAAoB,CAAC,SAAS,EAAE,MAAM,GAAG,UAAU,EAAE;IAQrD;;;OAGG;IACH,cAAc,CACZ,KAAK,EAAE,MAAM,EACb,QAAQ,EAAE,MAAM,EAChB,SAAS,SAAO,GACf;QAAE,WAAW,EAAE,OAAO,CAAC;QAAC,UAAU,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,EAAE,iBAAiB,CAAA;KAAE;IA6B7E;;;;;;;OAOG;IACH,QAAQ,CAAC,EAAE,EAAE,MAAM,GAAG;QAAE,EAAE,EAAE,OAAO,CAAC;QAAC,OAAO,EAAE,MAAM,CAAA;KAAE;IAUtD,QAAQ,IAAI,UAAU;IAWtB,KAAK,IAAI,IAAI;CAad;AAMD,wBAAgB,QAAQ,IAAI,UAAU,CAGrC"}

package/dist/cjs/subconscious/TheBrainV2.js

@@ -141,7 +141,37 @@ function tokenize(text) {
     // the same index bucket. Purely additive: old entries that predate this still match on
     // their original terms exactly as before, they just don't get the extra recall.
     const stems = terms.map(stem).filter(s => s !== undefined);
-    return [...new Set([...terms, ...bigrams, ...stems])];
+    // 7. Add a shared cluster tag for known dev-vocabulary synonyms (bilingual) so "jwt
+    // expiration" and "token timeout" land on a common term without needing embeddings.
+    // Purely additive, same rationale as stems — never replaces the surface form, so it
+    // can only add recall, never hide an existing exact match.
+    const synonymTags = terms
+        .map(t => SYNONYM_CLUSTERS.get(t))
+        .filter((c) => c !== undefined);
+    return [...new Set([...terms, ...bigrams, ...stems, ...synonymTags])];
+}
+// Groups of interchangeable dev-vocabulary terms (bilingual). Each member maps to a shared
+// `syn_<canonical>` token so any two synonyms in the same group become a shared index bucket
+// — a cheap substitute for embeddings when the gap is "different word, same concept" rather
+// than true paraphrase. Keep groups small and unambiguous; a bad merge can only add a false
+// candidate (never hide a real exact match), but it does dilute BM25 signal if overused.
+const SYNONYM_GROUPS = [
+    ['jwt', 'token', 'session', 'auth', 'login', 'autenticacion', 'sesion', 'autenticar'],
+    ['timeout', 'expiration', 'expiry', 'vencimiento', 'caducidad', 'expirar', 'vencer'],
+    ['bug', 'error', 'fallo', 'falla', 'issue', 'defect', 'defecto'],
+    ['fix', 'patch', 'solucion', 'solucionar', 'arreglar', 'corregir', 'hotfix'],
+    ['delete', 'remove', 'eliminar', 'borrar', 'quitar'],
+    ['config', 'configuration', 'configuracion', 'settings', 'ajustes'],
+    ['deploy', 'deployment', 'despliegue', 'desplegar', 'release'],
+    ['crash', 'exception', 'excepcion', 'throw', 'falla'],
+    ['slow', 'lento', 'lentitud', 'latency', 'latencia', 'performance', 'rendimiento'],
+    ['test', 'tests', 'testing', 'prueba', 'pruebas', 'spec'],
+];
+const SYNONYM_CLUSTERS = new Map();
+for (const group of SYNONYM_GROUPS) {
+    const canonical = `syn_${group[0]}`;
+    for (const member of group)
+        SYNONYM_CLUSTERS.set(member, canonical);
 }
 // Suffix-stripping rules, longest/most-specific match first. Additive expansion only —
 // this is not a correctness-critical stemmer, so mild over-stemming (merging two distinct
@@ -483,7 +513,7 @@ class TheBrainV2 {
      * Store a query+response pair in the brain.
      * Returns false if detected as duplicate (>= dupThreshold similarity).
      */
-    store(query, response, provider = 'generic', dupThreshold = 0.92, filePaths, projectId = deriveProjectId(), outcome, symbolRefs, claimInputs) {
+    store(query, response, provider = 'generic', dupThreshold = 0.92, filePaths, projectId = deriveProjectId(), outcome, symbolRefs, claimInputs, domain) {
         // Quick bloom check
         const queryKey = query.trim().toLowerCase().substring(0, 200);
         if (this.bloom.has(queryKey)) {
@@ -497,6 +527,28 @@ class TheBrainV2 {
                 };
             }
         }
+        // Conflict check: another entry about the exact same symbol, with the opposite
+        // outcome, is worth flagging before this one is even written — two memories about one
+        // function disagreeing on whether an approach works is a trap for whoever searches next.
+        // Not a block, just a warning: the newer entry may legitimately supersede the older one.
+        let conflicts;
+        if (symbolRefs && symbolRefs.length > 0) {
+            const newKeys = new Set(symbolRefs.map((r) => `${path_1.default.resolve(r.filePath)}::${r.symbolName}`));
+            const newOutcome = outcome === 'failed' ? 'failed' : 'confirmed';
+            const found = [];
+            for (const existingEntry of this.entries.values()) {
+                if (!existingEntry.symbolHashes)
+                    continue;
+                const existingOutcome = existingEntry.outcome === 'failed' ? 'failed' : 'confirmed';
+                if (existingOutcome === newOutcome)
+                    continue;
+                const sharesSymbol = Object.keys(existingEntry.symbolHashes).some((k) => newKeys.has(k));
+                if (sharesSymbol)
+                    found.push({ id: existingEntry.id, query: existingEntry.query, outcome: existingOutcome });
+            }
+            if (found.length > 0)
+                conflicts = found;
+        }
         const terms = tokenize(query + ' ' + response);
         const termFreq = termFrequencies(terms);
         const id = crypto_1.default
@@ -519,6 +571,7 @@ class TheBrainV2 {
             outcome,
             symbolHashes: symbolRefs && symbolRefs.length > 0 ? hashSymbolsForFreshness(symbolRefs) : undefined,
             claims: claimInputs && claimInputs.length > 0 ? buildClaims(claimInputs) : undefined,
+            domain,
         };
         this.entries.set(id, entry);
         // Update inverted index
@@ -531,8 +584,46 @@ class TheBrainV2 {
         // Update bloom
         this.bloom.add(queryKey);
         this.recalcAvgDocLength();
+        this.evictIfOverCapacity();
         this.scheduleSave();
-        return { stored: true, reason: 'Stored successfully' };
+        return { stored: true, reason: 'Stored successfully', conflicts };
+    }
+    /**
+     * Evict the lowest-value entries once the Brain is over capacity. Value = hits (proven
+     * usefulness) with a mild recency tiebreak — never based on similarity to any one query,
+     * since an entry unrelated to today's search may still be exactly what tomorrow's needs.
+     * Failed-outcome entries are cheap to keep (they're short, deliberate warnings) so they're
+     * evicted last among equally-unused entries rather than first.
+     */
+    evictIfOverCapacity() {
+        if (this.entries.size <= TheBrainV2.MAX_ENTRIES)
+            return;
+        const ranked = Array.from(this.entries.values()).sort((a, b) => {
+            // Net value = hits minus twice the demerits — a downvoted entry is worse than a
+            // merely-unused one, so it should be first out even if it has a few stale hits.
+            const aValue = a.hits - (a.demerits || 0) * 2;
+            const bValue = b.hits - (b.demerits || 0) * 2;
+            const aFailed = a.outcome === 'failed' ? 1 : 0;
+            const bFailed = b.outcome === 'failed' ? 1 : 0;
+            if (aValue !== bValue)
+                return aValue - bValue; // lower net value evicted first
+            if (aFailed !== bFailed)
+                return bFailed - aFailed; // confirmed evicted before failed, when tied on value
+            return new Date(a.timestamp).getTime() - new Date(b.timestamp).getTime(); // older evicted first
+        });
+        const toEvict = ranked.slice(0, TheBrainV2.EVICT_BATCH);
+        for (const entry of toEvict) {
+            this.entries.delete(entry.id);
+            for (const term of entry.terms) {
+                const ids = this.invertedIndex.get(term);
+                if (!ids)
+                    continue;
+                ids.delete(entry.id);
+                if (ids.size === 0)
+                    this.invertedIndex.delete(term);
+            }
+        }
+        this.recalcAvgDocLength();
     }
     // ─── Search ───────────────────────────────────────────────────────────────
     /**
@@ -607,11 +698,33 @@ class TheBrainV2 {
         }
         // 4. Normalize BM25 to 0-1 range
         const maxBm25 = Math.max(...scored.map(s => s.bm25), 1);
-        // 5. Combined score: 70% BM25 + 30% Jaccard
-        const combined = scored.map(s => ({
-            entry: s.entry,
-            similarity: (s.bm25 / maxBm25) * 0.7 + s.jaccard * 0.3,
-        }));
+        // 5. Combined score: 70% BM25 + 30% Jaccard, then adjust for signals BM25/Jaccard can't
+        // see on their own: a memory's own track record. Small and additive by design — none of
+        // these can turn an unrelated result into a top hit, they only reorder among already-
+        // relevant candidates.
+        const combined = scored.map(s => {
+            let similarity = (s.bm25 / maxBm25) * 0.7 + s.jaccard * 0.3;
+            // Popularity prior: entries other searches actually reused are more likely to be
+            // reused again. Log-scaled and capped at +0.08 so a handful of hits can't outrank a
+            // much better textual match.
+            similarity += Math.min(Math.log2(s.entry.hits + 1) * 0.02, 0.08);
+            // A documented dead end ranking above a working fix is actively harmful — it reads as
+            // a suggestion even with the "STALE"/"FAILED" label attached downstream. Demote, don't
+            // hide: the warning is still worth surfacing, just not first.
+            if (s.entry.outcome === 'failed')
+                similarity -= 0.15;
+            // Soft domain preference (see projectId scoping above for why this stays soft): an
+            // entry tagged with the requested domain is more likely relevant, but an untagged or
+            // cross-domain entry may still be the right answer.
+            if (options.domain && s.entry.domain === options.domain)
+                similarity += 0.05;
+            // Explicit negative feedback from downvote() — a caller saying "this was wrong" is a
+            // stronger, more deliberate signal than the absence of hits, so it outweighs the
+            // popularity prior above rather than just canceling it out.
+            if (s.entry.demerits)
+                similarity -= Math.min(s.entry.demerits * 0.06, 0.25);
+            return { entry: s.entry, similarity: Math.max(0, similarity) };
+        });
         // 6. Sort and filter
         combined.sort((a, b) => b.similarity - a.similarity);
         const results = combined
@@ -631,6 +744,7 @@ class TheBrainV2 {
                 ...(fresh ? {} : { staleFiles }),
                 ...(r.entry.outcome ? { outcome: r.entry.outcome } : {}),
                 ...(claims && claims.length > 0 ? { claims } : {}),
+                ...(r.entry.domain ? { domain: r.entry.domain } : {}),
             };
         });
         // 7. Update hit counters — only for searches a caller actually asked a question with.
@@ -684,6 +798,23 @@ class TheBrainV2 {
         }
         return { isDuplicate: false, similarity: sim };
     }
+    // ─── Feedback ─────────────────────────────────────────────────────────────
+    /**
+     * Record that a specific memory turned out NOT to help — the caller acted on it and it
+     * was wrong, misleading, or irrelevant despite ranking well. Unlike `outcome: 'failed'`
+     * (set at store time, about the underlying approach), this is set after the fact, about
+     * the memory's usefulness as a search result. Lowers future ranking and eviction priority
+     * without deleting the entry — a bad-fit-today memory may still be exactly right for a
+     * differently-phrased query tomorrow.
+     */
+    downvote(id) {
+        const entry = this.entries.get(id);
+        if (!entry)
+            return { ok: false, message: `No entry with id "${id}" in the Brain.` };
+        entry.demerits = (entry.demerits || 0) + 1;
+        this.scheduleSave();
+        return { ok: true, message: `Recorded negative feedback on entry "${id}" (demerits: ${entry.demerits}). It will rank lower and be evicted sooner.` };
+    }
     // ─── Stats ────────────────────────────────────────────────────────────────
     getStats() {
         return {
@@ -714,6 +845,16 @@ class TheBrainV2 {
     }
 }
 exports.TheBrainV2 = TheBrainV2;
+// ─── Capacity / Pruning ─────────────────────────────────────────────────────
+/**
+ * Hard cap on entry count. Past this, the inverted index keeps growing and old, unused
+ * entries dilute every future BM25 IDF calculation (more docs sharing a term → lower
+ * signal) without ever being asked for again. Evicting keeps ranking quality from
+ * degrading as the Brain accumulates months of memories.
+ */
+TheBrainV2.MAX_ENTRIES = 8000;
+/** How many entries to evict per pass once over MAX_ENTRIES — batched, not one-at-a-time. */
+TheBrainV2.EVICT_BATCH = 500;
 // ─── Global singleton ────────────────────────────────────────────────────────
 let _brain = null;
 function getBrain() {