@primitive.ai/prim 0.1.0-alpha.7 → 0.1.0-alpha.70

package/dist/chunk-CUE2LKLR.js

@@ -0,0 +1,155 @@
+import {
+  decodeJwtPayload,
+  primConfigDirectory,
+  resolveAuthCredential
+} from "./chunk-3EEFL6NJ.js";
+
+// src/daemon/client.ts
+import { createConnection } from "net";
+import { join } from "path";
+
+// src/daemon/principal.ts
+import { createHash } from "crypto";
+var PRINCIPAL_COMPONENT_MAX_LENGTH = 512;
+function boundedClaim(value) {
+  return typeof value === "string" && value.length > 0 && value.length <= PRINCIPAL_COMPONENT_MAX_LENGTH ? value : void 0;
+}
+function sha256(value) {
+  return createHash("sha256").update(value).digest("hex");
+}
+function resolveDaemonPrincipal(token = resolveAuthCredential()?.token) {
+  if (!token) return void 0;
+  const payload = decodeJwtPayload(token);
+  const subject = boundedClaim(payload?.sub);
+  const organizationId = boundedClaim(payload?.org_id);
+  if (!(subject && organizationId)) return void 0;
+  const issuer = boundedClaim(payload?.iss) ?? "unknown-issuer";
+  return {
+    principalId: sha256(`${issuer}\0${subject}`),
+    organizationId,
+    credentialFingerprint: sha256(token)
+  };
+}
+function daemonPrincipalsMatch(caller, daemon) {
+  return caller !== void 0 && daemon !== void 0 && caller.principalId === daemon.principalId && caller.organizationId === daemon.organizationId && caller.credentialFingerprint === daemon.credentialFingerprint;
+}
+
+// src/daemon/protocol.ts
+var DAEMON_JSON_REQUEST_MAX_BYTES = 64 * 1024;
+var DAEMON_JSON_RESPONSE_MAX_BYTES = 8 * 1024 * 1024;
+function isRecord(value) {
+  return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function parseDaemonResponseEnvelope(value) {
+  if (!isRecord(value)) return void 0;
+  if (!(typeof value.id === "number" && Number.isSafeInteger(value.id) && value.id >= 0)) {
+    return void 0;
+  }
+  if (typeof value.ok !== "boolean") return void 0;
+  if (value.error !== void 0 && typeof value.error !== "string") return void 0;
+  return {
+    id: value.id,
+    ok: value.ok,
+    ...value.result === void 0 ? {} : { result: value.result },
+    ...value.error === void 0 ? {} : { error: value.error }
+  };
+}
+
+// src/daemon/client.ts
+var SOCK_PATH = join(primConfigDirectory(), "sock");
+var DEFAULT_TIMEOUT_MS = 250;
+var nextRequestId = 1;
+function daemonRequest(method, params = {}, opts = {}) {
+  const id = nextRequestId++;
+  const caller = resolveDaemonPrincipal();
+  const request = {
+    id,
+    method,
+    params,
+    ...caller ? { caller } : {}
+  };
+  const timeoutMs = opts.timeoutMs ?? DEFAULT_TIMEOUT_MS;
+  return new Promise((resolve) => {
+    let settled = false;
+    let socket;
+    let buffer = Buffer.alloc(0);
+    const settle = (value) => {
+      if (settled) {
+        return;
+      }
+      settled = true;
+      if (socket) {
+        try {
+          socket.destroy();
+        } catch {
+        }
+      }
+      resolve(value);
+    };
+    const timer = setTimeout(() => settle(null), timeoutMs);
+    timer.unref();
+    try {
+      socket = createConnection(SOCK_PATH);
+    } catch {
+      clearTimeout(timer);
+      settle(null);
+      return;
+    }
+    socket.on("error", () => {
+      clearTimeout(timer);
+      settle(null);
+    });
+    socket.on("connect", () => {
+      try {
+        socket?.write(`${JSON.stringify(request)}
+`);
+      } catch {
+        clearTimeout(timer);
+        settle(null);
+      }
+    });
+    socket.on("data", (chunk) => {
+      buffer = Buffer.concat([buffer, Buffer.from(chunk)]);
+      if (buffer.length > DAEMON_JSON_RESPONSE_MAX_BYTES) {
+        clearTimeout(timer);
+        settle(null);
+        return;
+      }
+      const newlineIdx = buffer.indexOf(10);
+      if (newlineIdx === -1) {
+        return;
+      }
+      const line = buffer.subarray(0, newlineIdx).toString("utf8");
+      try {
+        const res = parseDaemonResponseEnvelope(JSON.parse(line));
+        if (!res || res.id !== id) {
+          clearTimeout(timer);
+          settle(null);
+          return;
+        }
+        clearTimeout(timer);
+        settle(res.ok && res.result !== void 0 ? res.result : null);
+      } catch {
+        clearTimeout(timer);
+        settle(null);
+      }
+    });
+    socket.on("end", () => {
+      if (!settled) {
+        clearTimeout(timer);
+        settle(null);
+      }
+    });
+  });
+}
+async function daemonIsLive(timeoutMs = DEFAULT_TIMEOUT_MS) {
+  const result = await daemonRequest("ping", {}, { timeoutMs });
+  return result?.pong === true;
+}
+
+export {
+  resolveDaemonPrincipal,
+  daemonPrincipalsMatch,
+  daemonRequest,
+  daemonIsLive
+};

package/dist/chunk-FI3LIRCB.js

@@ -0,0 +1,262 @@
+import {
+  boundedHealthError
+} from "./chunk-LEMX3IOG.js";
+import {
+  terminalSafeLine
+} from "./chunk-Z7YPFWAZ.js";
+
+// src/hooks/redact.ts
+import { existsSync, readFileSync, statSync } from "fs";
+import { join } from "path";
+import { Worker } from "worker_threads";
+var USER_HOME_RULES = [
+  {
+    pattern: /\/Users\/[^/\\\s"'`]+/g,
+    reason: "user-home-path",
+    replacement: "/Users/__redacted_user__"
+  },
+  {
+    pattern: /\/home\/[^/\\\s"'`]+/g,
+    reason: "user-home-path",
+    replacement: "/home/__redacted_user__"
+  },
+  {
+    pattern: /([A-Za-z]:\\Users\\)[^/\\\s"'`]+/gi,
+    reason: "user-home-path",
+    replacement: "$1__redacted_user__"
+  },
+  {
+    pattern: /\/root(?=\/|$)/g,
+    reason: "user-home-path",
+    replacement: "/__redacted_user__"
+  }
+];
+var DEFAULT_RULES = [
+  { pattern: /Bearer\s+[A-Za-z0-9._~+/=-]+/gi, reason: "bearer-token" },
+  {
+    pattern: /\bsk-(?:(?:ant|proj)-)?[A-Za-z0-9_-]{16,}(?![A-Za-z0-9_-])/g,
+    reason: "sk-api-key"
+  },
+  {
+    pattern: /-----BEGIN [A-Z ]+PRIVATE KEY-----[\s\S]+?-----END [A-Z ]+PRIVATE KEY-----/g,
+    reason: "private-key"
+  },
+  { pattern: /xox[abprs]-[A-Za-z0-9-]{10,}/g, reason: "slack-token" },
+  {
+    pattern: /\b(?:gh[pousr]_[A-Za-z0-9]{36,}|github_pat_[A-Za-z0-9_]{50,})\b/g,
+    reason: "github-pat"
+  },
+  { pattern: /\b(?:AKIA|ASIA)[A-Z0-9]{16}\b/g, reason: "aws-access-key" },
+  {
+    pattern: /\bAWS_(?:SECRET_ACCESS_KEY|SESSION_TOKEN)"?\s*[:=]\s*["']?[A-Za-z0-9/+=]{20,}["']?/gi,
+    reason: "aws-secret"
+  },
+  { pattern: /\bAIza[0-9A-Za-z_-]{35}(?![0-9A-Za-z_-])/g, reason: "gcp-api-key" },
+  {
+    pattern: /\bya29\.[0-9A-Za-z_-]{20,}(?![0-9A-Za-z_-])/g,
+    reason: "gcp-oauth-token"
+  },
+  {
+    pattern: /\beyJ[A-Za-z0-9_-]*\.[A-Za-z0-9_-]+\.[A-Za-z0-9_-]*(?![A-Za-z0-9_-])/g,
+    reason: "jwt"
+  },
+  { pattern: /\bBasic\s+[A-Za-z0-9+/]+={0,2}/gi, reason: "basic-auth" },
+  { pattern: /\bhttps?:\/\/[^/\s:@]+:[^/\s@]+@/gi, reason: "basic-auth" },
+  ...USER_HOME_RULES
+];
+var MAX_SCRUB_LEN = 256e3;
+var MAX_WORKSPACE_CONFIG_BYTES = 64 * 1024;
+var MAX_WORKSPACE_RULES = 32;
+var MAX_WORKSPACE_PATTERN_LENGTH = 512;
+var MAX_WORKSPACE_REASON_LENGTH = 64;
+var WORKSPACE_RULE_TIMEOUT_MS = 250;
+var WORKSPACE_FILE = ".prim/redaction.json";
+var SAFE_REASON_RE = /^[A-Za-z0-9][A-Za-z0-9_-]*$/u;
+var SAFE_WORKSPACE_FLAGS_RE = /^[gimsu]*$/u;
+function debugRedaction(message) {
+  writeHookDebug(`redaction: ${message}`);
+}
+function normalizedWorkspaceFlags(value) {
+  if (value !== void 0 && typeof value !== "string") return null;
+  const requested = value ?? "";
+  if (!SAFE_WORKSPACE_FLAGS_RE.test(requested)) return null;
+  return [...new Set(`g${requested}`)].sort().join("");
+}
+function loadWorkspaceRules(cwd) {
+  const path = join(cwd, WORKSPACE_FILE);
+  if (!existsSync(path)) return [];
+  let cfg;
+  try {
+    if (statSync(path).size > MAX_WORKSPACE_CONFIG_BYTES) {
+      debugRedaction(`ignoring oversized ${WORKSPACE_FILE}`);
+      return [];
+    }
+    cfg = JSON.parse(readFileSync(path, "utf-8"));
+  } catch {
+    debugRedaction(`ignoring unparseable ${WORKSPACE_FILE}`);
+    return [];
+  }
+  if (!Array.isArray(cfg.rules)) return [];
+  const compiled = [];
+  for (const candidate of cfg.rules.slice(0, MAX_WORKSPACE_RULES)) {
+    if (!candidate || typeof candidate !== "object") continue;
+    const { pattern, reason } = candidate;
+    const flags = normalizedWorkspaceFlags(candidate.flags);
+    if (typeof pattern !== "string" || pattern.length === 0 || pattern.length > MAX_WORKSPACE_PATTERN_LENGTH || typeof reason !== "string" || reason.length === 0 || reason.length > MAX_WORKSPACE_REASON_LENGTH || !SAFE_REASON_RE.test(reason) || flags === null) {
+      debugRedaction("skipping invalid workspace rule metadata");
+      continue;
+    }
+    try {
+      compiled.push({ pattern: new RegExp(pattern, flags), reason });
+    } catch {
+      debugRedaction(`skipping invalid workspace rule ${reason}`);
+    }
+  }
+  return compiled;
+}
+function applyRules(input, rules) {
+  if (input.length > MAX_SCRUB_LEN) return "<REDACTED:oversized>";
+  let out = input;
+  for (const rule of rules) {
+    out = out.replace(rule.pattern, rule.replacement ?? `<REDACTED:${rule.reason}>`);
+  }
+  return out;
+}
+var REDACTED_OBJECT_KEY = "<REDACTED:object-key>";
+function redactedObjectKey(input, transform) {
+  return transform(input) === input ? input : REDACTED_OBJECT_KEY;
+}
+function uniqueObjectKey(output, key) {
+  let candidate = key;
+  let suffix = 2;
+  while (Object.hasOwn(output, candidate)) candidate = `${key}_${suffix++}`;
+  return candidate;
+}
+function mapStrings(value, transform) {
+  if (typeof value === "string") return transform(value);
+  if (Array.isArray(value)) return value.map((item) => mapStrings(item, transform));
+  if (value && typeof value === "object") {
+    const out = /* @__PURE__ */ Object.create(null);
+    for (const [key, item] of Object.entries(value)) {
+      out[uniqueObjectKey(out, redactedObjectKey(key, transform))] = mapStrings(item, transform);
+    }
+    return out;
+  }
+  return value;
+}
+function scrub(value, rules = DEFAULT_RULES) {
+  return mapStrings(value, (input) => applyRules(input, rules));
+}
+function debugDetail(value) {
+  try {
+    return String(value instanceof Error ? value.message : value);
+  } catch {
+    return "unprintable detail";
+  }
+}
+function writeHookDebug(context, ...details) {
+  if (!process.env.PRIM_HOOK_DEBUG) return;
+  const raw = details.length > 0 ? `${context}: ${details.map(debugDetail).join(": ")}` : context;
+  const normalized = terminalSafeLine(raw);
+  const message = boundedHealthError(scrub(normalized, DEFAULT_RULES)) ?? context;
+  process.stderr.write(`[prim-hook] ${message === `${context}:` ? context : message}
+`);
+}
+function redactEveryString(value, reason) {
+  return mapStrings(value, () => `<REDACTED:${reason}>`);
+}
+var WORKSPACE_REDACTION_WORKER = String.raw`
+  const { parentPort, workerData } = require("node:worker_threads");
+  const REDACTED_OBJECT_KEY = "<REDACTED:object-key>";
+  const rules = workerData.rules.map((rule) => ({
+    pattern: new RegExp(rule.source, rule.flags),
+    reason: rule.reason,
+  }));
+  function redact(input) {
+      let output = input;
+      for (const rule of rules) {
+        output = output.replace(rule.pattern, "<REDACTED:" + rule.reason + ">");
+      }
+      return output;
+  }
+  function objectKey(input) {
+    return redact(input) === input ? input : REDACTED_OBJECT_KEY;
+  }
+  function uniqueKey(output, key) {
+    let candidate = key;
+    let suffix = 2;
+    while (Object.hasOwn(output, candidate)) candidate = key + "_" + suffix++;
+    return candidate;
+  }
+  function walk(value) {
+    if (typeof value === "string") {
+      return redact(value);
+    }
+    if (Array.isArray(value)) return value.map(walk);
+    if (value && typeof value === "object") {
+      const output = Object.create(null);
+      for (const [key, item] of Object.entries(value)) {
+        output[uniqueKey(output, objectKey(key))] = walk(item);
+      }
+      return output;
+    }
+    return value;
+  }
+  parentPort.postMessage(walk(workerData.value));
+`;
+function applyWorkspaceRules(value, rules) {
+  const serialized = rules.map(({ pattern, reason }) => ({
+    source: pattern.source,
+    flags: pattern.flags,
+    reason
+  }));
+  return new Promise((resolve) => {
+    let worker;
+    try {
+      worker = new Worker(WORKSPACE_REDACTION_WORKER, {
+        eval: true,
+        workerData: { value, rules: serialized }
+      });
+    } catch {
+      resolve(redactEveryString(value, "workspace-rule-failed"));
+      return;
+    }
+    let settled = false;
+    const finish = (result) => {
+      if (settled) return;
+      settled = true;
+      clearTimeout(timer);
+      void worker.terminate();
+      resolve(result);
+    };
+    const failClosed = () => finish(redactEveryString(value, "workspace-rule-failed"));
+    const timer = setTimeout(failClosed, WORKSPACE_RULE_TIMEOUT_MS);
+    worker.once("message", finish);
+    worker.once("error", failClosed);
+    worker.once("exit", (code) => {
+      if (code !== 0) failClosed();
+    });
+  });
+}
+async function scrubFromCwd(value, cwd) {
+  const defaultScrubbed = scrub(value, DEFAULT_RULES);
+  const workspaceRules = loadWorkspaceRules(cwd);
+  return workspaceRules.length === 0 ? defaultScrubbed : await applyWorkspaceRules(defaultScrubbed, workspaceRules);
+}
+function scrubEnvironmentPaths(environment) {
+  const scrubPath = (value) => value === void 0 ? void 0 : applyRules(value, USER_HOME_RULES);
+  return {
+    ...environment,
+    cwd: scrubPath(environment.cwd) ?? environment.cwd,
+    ...environment.repoRoot === void 0 ? {} : { repoRoot: scrubPath(environment.repoRoot) },
+    ...environment.gitRoot === void 0 ? {} : { gitRoot: scrubPath(environment.gitRoot) }
+  };
+}
+
+export {
+  DEFAULT_RULES,
+  scrub,
+  writeHookDebug,
+  scrubFromCwd,
+  scrubEnvironmentPaths
+};

package/dist/chunk-H64F6QHV.js

@@ -0,0 +1,247 @@
+import {
+  isCanonicalWorkspaceId
+} from "./chunk-UVIWZWM6.js";
+import {
+  scrubEnvironmentPaths
+} from "./chunk-FI3LIRCB.js";
+import {
+  isValidRepoSyncId
+} from "./chunk-TJTVHDJ5.js";
+
+// src/hooks/prim-hook-core.ts
+import { createHash, randomUUID } from "crypto";
+import { platform } from "os";
+
+// src/protocol/move.ts
+var LEGACY_ENVELOPE_VERSION = 1;
+var AGENT_ENVELOPE_VERSION = 3;
+var ENVELOPE_VERSION = LEGACY_ENVELOPE_VERSION;
+
+// src/hooks/prim-hook-core.ts
+var CORRELATED_TOOL_EVENTS = /* @__PURE__ */ new Set([
+  "PostToolUse",
+  "PostToolUseFailure",
+  "post_tool_call",
+  "post_approval_response"
+]);
+function postToolInvocationId(parsed, agent) {
+  if (typeof parsed.hook_event_name !== "string" || !CORRELATED_TOOL_EVENTS.has(parsed.hook_event_name)) {
+    return void 0;
+  }
+  const raw = agent === "hermes" ? parsed.extra?.tool_call_id : parsed.tool_use_id;
+  return typeof raw === "string" && raw.length > 0 ? raw : void 0;
+}
+function lowerString(value) {
+  return typeof value === "string" ? value.toLowerCase() : void 0;
+}
+function toolOutcomeFor(parsed, agent) {
+  const event = parsed.hook_event_name;
+  if (agent === "claude_code") {
+    if (event === "PostToolUseFailure") {
+      return parsed.is_interrupt === true ? "interrupted" : "failed";
+    }
+    return event === "PostToolUse" ? "succeeded" : void 0;
+  }
+  if (agent === "codex") {
+    return event === "PostToolUse" ? "returned" : void 0;
+  }
+  const extra = parsed.extra;
+  if (event === "post_approval_response") {
+    const choice = lowerString(extra?.choice);
+    return (choice === "deny" || choice === "smart_deny" || choice === "timeout") && postToolInvocationId(parsed, agent) ? "prevented" : void 0;
+  }
+  if (event !== "PostToolUse" && event !== "post_tool_call") {
+    return void 0;
+  }
+  const status = lowerString(extra?.status);
+  if (status === "ok" || status === "success") {
+    return "succeeded";
+  }
+  if (status === "error" || status === "timeout") {
+    return "failed";
+  }
+  if (status === "cancelled") {
+    return "interrupted";
+  }
+  if (status === "blocked") {
+    return "prevented";
+  }
+  return "unknown";
+}
+function toMove(parsed, cliVersion, agent = "claude_code", workspaceId, repository, invocationId) {
+  const sessionId = parsed.session_id ?? "";
+  const eventType = parsed.hook_event_name ?? "unknown";
+  const toolOutcome = toolOutcomeFor(parsed, agent);
+  let moveId;
+  if (CORRELATED_TOOL_EVENTS.has(eventType) && sessionId && invocationId) {
+    moveId = `posttool:v1:${createHash("sha256").update(JSON.stringify([agent, sessionId, eventType, invocationId])).digest("hex")}`;
+  } else if (CORRELATED_TOOL_EVENTS.has(eventType) && sessionId) {
+    moveId = `posttool:fallback:v1:${createHash("sha256").update(
+      JSON.stringify([
+        agent,
+        sessionId,
+        eventType,
+        parsed.turn_id ?? null,
+        parsed.tool_name ?? null,
+        parsed.tool_input ?? null
+      ])
+    ).digest("hex")}`;
+  } else {
+    moveId = randomUUID();
+  }
+  return {
+    moveId,
+    capturedAt: Date.now(),
+    sessionId,
+    eventType,
+    payload: parsed,
+    env: scrubEnvironmentPaths({
+      cwd: parsed.cwd ?? process.cwd(),
+      cliVersion,
+      osPlatform: platform(),
+      ...repository ? {
+        repoRoot: repository.repoRoot,
+        repoKey: repository.repoKey,
+        gitRoot: repository.repoRoot,
+        repoFullName: repository.repoFullName,
+        repoSyncId: repository.repoSyncId
+      } : {},
+      ...workspaceId ? { workspaceId } : {}
+    }),
+    envelopeVersion: AGENT_ENVELOPE_VERSION,
+    producer: agent,
+    ...invocationId ? { invocationId } : {},
+    ...toolOutcome ? { toolOutcome } : {}
+  };
+}
+var MAX_REWRITE_PAIRS_PER_MOVE = 40;
+var MAX_REWRITE_PAIRS_PER_HOOK = 2e3;
+var FULL_SHA_RE = /^(?:[0-9a-f]{40}|[0-9a-f]{64})$/u;
+var MAX_CLASSIFIER_ID_CHARS = 256;
+var INVALID_CLASSIFIER_ID_RE = /[\u0000-\u001f\u007f\uD800-\uDFFF]/u;
+function validSessionHint(value) {
+  return typeof value === "string" && value.trim().length > 0 && value === value.trim() && value.length <= MAX_CLASSIFIER_ID_CHARS && !INVALID_CLASSIFIER_ID_RE.test(value);
+}
+function commitAttributionFromEnvironment(env, workspaceId) {
+  if (env.HERMES_INTERACTIVE) return void 0;
+  if (!workspaceId || !isCanonicalWorkspaceId(workspaceId)) return void 0;
+  const candidates = [
+    validSessionHint(env.CLAUDE_CODE_SESSION_ID) ? { sessionId: env.CLAUDE_CODE_SESSION_ID, producer: "claude_code" } : void 0,
+    validSessionHint(env.CODEX_THREAD_ID) ? { sessionId: env.CODEX_THREAD_ID, producer: "codex" } : void 0
+  ].filter((candidate) => candidate !== void 0);
+  return candidates.length === 1 ? candidates[0] : void 0;
+}
+function toCommitMove(commit, cliVersion, cwd, context = {}) {
+  const { repository, repoFullName, repoSyncId, workspaceId, attribution, capturedAt } = context;
+  const validatedRepoSyncId = isValidRepoSyncId(repoSyncId) ? repoSyncId : void 0;
+  const validatedWorkspaceId = workspaceId && isCanonicalWorkspaceId(workspaceId) ? workspaceId : void 0;
+  const validatedAttribution = validatedWorkspaceId ? attribution : void 0;
+  const validatedCapturedAt = typeof capturedAt === "number" && Number.isSafeInteger(capturedAt) && capturedAt > 0 ? capturedAt : Date.now();
+  const fullSha = /^(?:[0-9a-f]{40}|[0-9a-f]{64})$/u.test(commit.sha);
+  const moveId = validatedRepoSyncId && validatedWorkspaceId && fullSha ? `commit:v2:${createHash("sha256").update(
+    JSON.stringify(["commit:v2", validatedRepoSyncId, validatedWorkspaceId, commit.sha])
+  ).digest("hex")}` : `commit:v2:unscoped:${randomUUID()}`;
+  const base = {
+    moveId,
+    capturedAt: validatedCapturedAt,
+    sessionId: validatedAttribution?.sessionId ?? "",
+    eventType: "git.commit",
+    payload: {
+      kind: "git.commit",
+      sha: commit.sha,
+      parentSha: commit.parentSha,
+      branch: commit.branch,
+      changedFiles: commit.files,
+      changedFilesComplete: commit.filesComplete
+    },
+    env: scrubEnvironmentPaths({
+      cwd,
+      cliVersion,
+      osPlatform: platform(),
+      ...repository ? {
+        repoRoot: repository.repoRoot,
+        repoKey: repository.repoKey,
+        gitRoot: repository.repoRoot
+      } : {},
+      ...repoFullName ? { repoFullName } : {},
+      ...validatedRepoSyncId ? { repoSyncId: validatedRepoSyncId } : {},
+      ...validatedWorkspaceId ? { workspaceId: validatedWorkspaceId } : {}
+    })
+  };
+  return validatedAttribution ? {
+    ...base,
+    envelopeVersion: AGENT_ENVELOPE_VERSION,
+    producer: validatedAttribution.producer
+  } : { ...base, envelopeVersion: ENVELOPE_VERSION };
+}
+function canonicalRewritePairs(pairs) {
+  const unique = /* @__PURE__ */ new Map();
+  for (const pair of pairs) {
+    const oldSha = pair.oldSha.toLowerCase();
+    const newSha = pair.newSha.toLowerCase();
+    if (!FULL_SHA_RE.test(oldSha) || !FULL_SHA_RE.test(newSha)) return null;
+    if (oldSha === newSha) continue;
+    unique.set(`${oldSha}\0${newSha}`, { oldSha, newSha });
+  }
+  return [...unique.values()].sort((left, right) => {
+    const leftKey = `${left.oldSha}\0${left.newSha}`;
+    const rightKey = `${right.oldSha}\0${right.newSha}`;
+    return leftKey < rightKey ? -1 : leftKey > rightKey ? 1 : 0;
+  }).slice(0, MAX_REWRITE_PAIRS_PER_HOOK);
+}
+function toRewriteMove(rewrite, cliVersion, cwd, context) {
+  const { repository, repoFullName, repoSyncId, workspaceId, capturedAt } = context;
+  if (rewrite.source !== "amend" && rewrite.source !== "rebase" || !isValidRepoSyncId(repoSyncId) || !workspaceId || !isCanonicalWorkspaceId(workspaceId)) {
+    return [];
+  }
+  const pairs = canonicalRewritePairs(rewrite.pairs);
+  if (!pairs || pairs.length === 0) return [];
+  const branch = rewrite.branch && rewrite.branch === rewrite.branch.trim() && ![...rewrite.branch].some((char) => char < " " || char === "\x7F") ? rewrite.branch : void 0;
+  const observedAt = typeof capturedAt === "number" && Number.isSafeInteger(capturedAt) && capturedAt > 0 ? capturedAt : Date.now();
+  const moves = [];
+  for (let offset = 0; offset < pairs.length; offset += MAX_REWRITE_PAIRS_PER_MOVE) {
+    const sortedPairs = pairs.slice(offset, offset + MAX_REWRITE_PAIRS_PER_MOVE);
+    const moveId = `rewrite:v1:${createHash("sha256").update(JSON.stringify(["rewrite:v1", repoSyncId, workspaceId, rewrite.source, sortedPairs])).digest("hex")}`;
+    moves.push({
+      moveId,
+      capturedAt: observedAt,
+      sessionId: "",
+      eventType: "git.rewrite",
+      payload: {
+        kind: "git.rewrite",
+        source: rewrite.source,
+        pairs: sortedPairs,
+        ...branch ? { branch } : {}
+      },
+      env: scrubEnvironmentPaths({
+        cwd,
+        cliVersion,
+        osPlatform: platform(),
+        ...repository ? {
+          repoRoot: repository.repoRoot,
+          repoKey: repository.repoKey,
+          gitRoot: repository.repoRoot
+        } : {},
+        ...repoFullName ? { repoFullName } : {},
+        repoSyncId,
+        workspaceId
+      }),
+      envelopeVersion: ENVELOPE_VERSION
+    });
+  }
+  return moves;
+}
+function shouldFlushAfter(eventType) {
+  return eventType === "SessionEnd";
+}
+
+export {
+  postToolInvocationId,
+  toolOutcomeFor,
+  toMove,
+  commitAttributionFromEnvironment,
+  toCommitMove,
+  canonicalRewritePairs,
+  toRewriteMove,
+  shouldFlushAfter
+};