@provos/ironcurtain 0.10.0 → 0.12.0

package/dist/persona/broad-policy-validator.d.ts

@@ -0,0 +1,95 @@
+/**
+ * src/persona/broad-policy-validator.ts
+ *
+ * Broad-policy validator (Phase 1c, §7). Passed as the `validateCompiled` hook
+ * to `compilePersonaPolicy` by the persona-compile orchestrator. It runs on the
+ * in-memory `CompiledPolicyFile` BEFORE any artifact is written, so a rejection
+ * leaves the prior generation's files intact (no partial write).
+ *
+ * It defeats constitution prompt-injection toward an over-permissive policy in a
+ * way that is fully LLM-independent: it inspects the COMPILED rules, not the
+ * constitution text. A persona may only emit a "broad" policy if it has been
+ * explicitly opted in via the gated `personas.setBroadPolicyOptIn` flow
+ * (`persona.allowBroadPolicy === true`). Otherwise the following are rejected:
+ *
+ *   - any "broad wildcard" `domains.allowed` entry (see isBroadDomainPattern),
+ *   - any "broad wildcard" `lists[].allowed` entry,
+ *   - any `paths.within` that resolves OUTSIDE the persona's workspace dir.
+ *
+ * A "broad wildcard" is not just the literal `*`. The runtime matcher
+ * (domainMatchesAllowlist in trusted-process/domain-utils.ts) treats any
+ * `*.`-prefixed pattern as a hostname suffix match, and the compiler is
+ * explicitly allowed to emit prefix wildcards (`*.example.com`). A TLD-level
+ * wildcard like `*.com`, `*.gov`, or the empty-suffix `*.` therefore grants
+ * near-wildcard egress and must be treated as broad — only a wildcard whose
+ * suffix has TWO OR MORE labels (e.g. `*.github.com`, scoped to a single
+ * registered domain) is considered narrow and allowed without opt-in.
+ *
+ * Rejection throws {@link BroadPolicyRejectedError}; the orchestrator maps the
+ * `code` (`BROAD_POLICY_REJECTED`) onto a terminal `persona.compile.failed`
+ * event.
+ *
+ * ZERO runtime value-imports from src/pipeline — the `CompiledPolicyFile` shape
+ * is a type-only import. Path containment uses the live-layer `resolveRealPath`
+ * helper (symlink-aware), consistent with the policy engine.
+ *
+ * @see docs/designs/web-ui-policy-persona-management.md §7
+ */
+import type { ErrorCode } from '../web-ui/web-ui-types.js';
+import type { CompiledPolicyFile, DynamicListsFile } from '../pipeline/types.js';
+/** Thrown when a compiled policy is "broad" but the persona is not opted in. */
+export declare class BroadPolicyRejectedError extends Error {
+    readonly data?: {
+        broadenedDomains: string[];
+        outOfWorkspacePaths: string[];
+    } | undefined;
+    readonly code: ErrorCode;
+    constructor(message: string, data?: {
+        broadenedDomains: string[];
+        outOfWorkspacePaths: string[];
+    } | undefined);
+}
+/** Findings produced by inspecting a compiled policy for broadening. */
+export interface BroadPolicyFindings {
+    /**
+     * Broad-wildcard entries found in any `domains.allowed` or `lists[].allowed`
+     * (the literal pattern, e.g. `*`, `*.`, `*.com`). See {@link isBroadDomainPattern}.
+     */
+    readonly broadenedDomains: string[];
+    /** `paths.within` values resolving outside the workspace dir. */
+    readonly outOfWorkspacePaths: string[];
+}
+/**
+ * Returns true iff `pattern` grants near-wildcard egress and therefore requires
+ * the broad-policy opt-in. This mirrors the runtime matcher semantics in
+ * `domainMatchesAllowlist` (trusted-process/domain-utils.ts), where `*` matches
+ * any non-IP host and `*.<suffix>` matches every host ending in `.<suffix>`.
+ *
+ * Broad (rejected without opt-in):
+ *   - `*`            — matches every (non-IP) host
+ *   - `*.`           — empty suffix; `endsWith('.')` matches ~everything
+ *   - `*.com`/`*.gov`— TLD-only suffix (<= 1 label after the `*.`)
+ *
+ * Narrow (allowed without opt-in):
+ *   - `*.github.com` — suffix has >= 2 labels (one registered domain)
+ *   - `github.com`   — bare hostname (no wildcard)
+ */
+export declare function isBroadDomainPattern(pattern: string): boolean;
+/**
+ * Inspects a compiled policy and returns the set of "broad" findings. Pure /
+ * side-effect-free so it can also feed the ruleDelta computation. A path is
+ * "out of workspace" iff its real-resolved form is neither the workspace dir nor
+ * a descendant of it. When `dynamicLists` is supplied, `@list` references in
+ * `domains.allowed` / `lists[].allowed` are resolved to their concrete values so
+ * a list that resolves to a broad wildcard is detected (the validator passes it;
+ * callers without the resolved lists — e.g. the rule-delta report — still get the
+ * literal-pattern findings).
+ */
+export declare function findBroadPolicy(policy: CompiledPolicyFile, workspaceDir: string, dynamicLists?: DynamicListsFile): BroadPolicyFindings;
+/**
+ * Builds a `validateCompiled` hook bound to a persona's workspace dir and
+ * opt-in flag. When `allowBroadPolicy` is true the hook is a no-op (broadening
+ * is permitted); otherwise it throws {@link BroadPolicyRejectedError} on any
+ * broad finding.
+ */
+export declare function makeBroadPolicyValidator(workspaceDir: string, allowBroadPolicy: boolean): (policy: CompiledPolicyFile, dynamicLists?: DynamicListsFile) => void;

package/dist/persona/broad-policy-validator.js

@@ -0,0 +1,171 @@
+/**
+ * src/persona/broad-policy-validator.ts
+ *
+ * Broad-policy validator (Phase 1c, §7). Passed as the `validateCompiled` hook
+ * to `compilePersonaPolicy` by the persona-compile orchestrator. It runs on the
+ * in-memory `CompiledPolicyFile` BEFORE any artifact is written, so a rejection
+ * leaves the prior generation's files intact (no partial write).
+ *
+ * It defeats constitution prompt-injection toward an over-permissive policy in a
+ * way that is fully LLM-independent: it inspects the COMPILED rules, not the
+ * constitution text. A persona may only emit a "broad" policy if it has been
+ * explicitly opted in via the gated `personas.setBroadPolicyOptIn` flow
+ * (`persona.allowBroadPolicy === true`). Otherwise the following are rejected:
+ *
+ *   - any "broad wildcard" `domains.allowed` entry (see isBroadDomainPattern),
+ *   - any "broad wildcard" `lists[].allowed` entry,
+ *   - any `paths.within` that resolves OUTSIDE the persona's workspace dir.
+ *
+ * A "broad wildcard" is not just the literal `*`. The runtime matcher
+ * (domainMatchesAllowlist in trusted-process/domain-utils.ts) treats any
+ * `*.`-prefixed pattern as a hostname suffix match, and the compiler is
+ * explicitly allowed to emit prefix wildcards (`*.example.com`). A TLD-level
+ * wildcard like `*.com`, `*.gov`, or the empty-suffix `*.` therefore grants
+ * near-wildcard egress and must be treated as broad — only a wildcard whose
+ * suffix has TWO OR MORE labels (e.g. `*.github.com`, scoped to a single
+ * registered domain) is considered narrow and allowed without opt-in.
+ *
+ * Rejection throws {@link BroadPolicyRejectedError}; the orchestrator maps the
+ * `code` (`BROAD_POLICY_REJECTED`) onto a terminal `persona.compile.failed`
+ * event.
+ *
+ * ZERO runtime value-imports from src/pipeline — the `CompiledPolicyFile` shape
+ * is a type-only import. Path containment uses the live-layer `resolveRealPath`
+ * helper (symlink-aware), consistent with the policy engine.
+ *
+ * @see docs/designs/web-ui-policy-persona-management.md §7
+ */
+import { resolveRealPath } from '../types/argument-roles.js';
+/** Thrown when a compiled policy is "broad" but the persona is not opted in. */
+export class BroadPolicyRejectedError extends Error {
+    data;
+    code = 'BROAD_POLICY_REJECTED';
+    constructor(message, data) {
+        super(message);
+        this.data = data;
+        this.name = 'BroadPolicyRejectedError';
+    }
+}
+/**
+ * Returns true iff `pattern` grants near-wildcard egress and therefore requires
+ * the broad-policy opt-in. This mirrors the runtime matcher semantics in
+ * `domainMatchesAllowlist` (trusted-process/domain-utils.ts), where `*` matches
+ * any non-IP host and `*.<suffix>` matches every host ending in `.<suffix>`.
+ *
+ * Broad (rejected without opt-in):
+ *   - `*`            — matches every (non-IP) host
+ *   - `*.`           — empty suffix; `endsWith('.')` matches ~everything
+ *   - `*.com`/`*.gov`— TLD-only suffix (<= 1 label after the `*.`)
+ *
+ * Narrow (allowed without opt-in):
+ *   - `*.github.com` — suffix has >= 2 labels (one registered domain)
+ *   - `github.com`   — bare hostname (no wildcard)
+ */
+export function isBroadDomainPattern(pattern) {
+    if (pattern === '*')
+        return true;
+    if (!pattern.startsWith('*.'))
+        return false;
+    const suffix = pattern.slice(2); // drop the leading "*."
+    // Empty or single-label suffix (TLD-only) => broad. Count non-empty labels.
+    const labels = suffix.split('.').filter((l) => l.length > 0);
+    return labels.length <= 1;
+}
+/**
+ * Expands an `allowed` array (from `domains.allowed` or `lists[].allowed`) into
+ * the concrete values to test for breadth. A `@list` reference contributes its
+ * EFFECTIVE values (values + manualAdditions − manualRemovals), mirroring
+ * `PolicyEngine.getEffectiveListValues` — so a list that RESOLVES to a broad
+ * wildcard (e.g. a "major news sites" list containing `*.com`) is caught even
+ * though the rule only stores the `@list` symbol and the resolved values live
+ * separately in dynamic-lists.json. A missing list contributes nothing: the
+ * runtime fails closed (missing `@list` => empty => deny), so there is nothing
+ * broad to flag. `via` records the originating `@list` for a clear message.
+ */
+function expandAllowedForBreadth(allowed, dynamicLists) {
+    const out = [];
+    for (const entry of allowed) {
+        if (!entry.startsWith('@')) {
+            out.push({ value: entry });
+            continue;
+        }
+        const list = dynamicLists?.lists[entry.slice(1)];
+        if (!list)
+            continue;
+        const removals = new Set(list.manualRemovals);
+        for (const v of new Set([...list.values, ...list.manualAdditions])) {
+            if (!removals.has(v))
+                out.push({ value: v, via: entry });
+        }
+    }
+    return out;
+}
+/**
+ * Inspects a compiled policy and returns the set of "broad" findings. Pure /
+ * side-effect-free so it can also feed the ruleDelta computation. A path is
+ * "out of workspace" iff its real-resolved form is neither the workspace dir nor
+ * a descendant of it. When `dynamicLists` is supplied, `@list` references in
+ * `domains.allowed` / `lists[].allowed` are resolved to their concrete values so
+ * a list that resolves to a broad wildcard is detected (the validator passes it;
+ * callers without the resolved lists — e.g. the rule-delta report — still get the
+ * literal-pattern findings).
+ */
+export function findBroadPolicy(policy, workspaceDir, dynamicLists) {
+    const broadenedDomains = new Set();
+    const outOfWorkspacePaths = new Set();
+    const workspaceReal = resolveRealPath(workspaceDir);
+    const flagBroad = (entries) => {
+        for (const { value, via } of expandAllowedForBreadth(entries, dynamicLists)) {
+            if (isBroadDomainPattern(value))
+                broadenedDomains.add(via ? `${value} (via ${via})` : value);
+        }
+    };
+    for (const rule of policy.rules) {
+        const cond = rule.if;
+        // Wildcard domains — incl. those reached through a resolved @list.
+        if (cond.domains?.allowed)
+            flagBroad(cond.domains.allowed);
+        // Wildcard list allowances.
+        if (cond.lists) {
+            for (const list of cond.lists)
+                flagBroad(list.allowed);
+        }
+        // Out-of-workspace path containment.
+        if (cond.paths?.within) {
+            const within = cond.paths.within;
+            const withinReal = resolveRealPath(within);
+            const contained = withinReal === workspaceReal || withinReal.startsWith(workspaceReal + '/');
+            if (!contained)
+                outOfWorkspacePaths.add(within);
+        }
+    }
+    return {
+        broadenedDomains: [...broadenedDomains],
+        outOfWorkspacePaths: [...outOfWorkspacePaths],
+    };
+}
+/**
+ * Builds a `validateCompiled` hook bound to a persona's workspace dir and
+ * opt-in flag. When `allowBroadPolicy` is true the hook is a no-op (broadening
+ * is permitted); otherwise it throws {@link BroadPolicyRejectedError} on any
+ * broad finding.
+ */
+export function makeBroadPolicyValidator(workspaceDir, allowBroadPolicy) {
+    return (policy, dynamicLists) => {
+        if (allowBroadPolicy)
+            return;
+        const findings = findBroadPolicy(policy, workspaceDir, dynamicLists);
+        if (findings.broadenedDomains.length === 0 && findings.outOfWorkspacePaths.length === 0) {
+            return;
+        }
+        const parts = [];
+        if (findings.broadenedDomains.length > 0) {
+            parts.push(`broad wildcard domain/list access: ${findings.broadenedDomains.join(', ')}`);
+        }
+        if (findings.outOfWorkspacePaths.length > 0) {
+            parts.push(`out-of-workspace path(s): ${findings.outOfWorkspacePaths.join(', ')}`);
+        }
+        throw new BroadPolicyRejectedError(`Compiled policy is too broad (${parts.join('; ')}). Enable broad policy for this persona to allow it.`, { broadenedDomains: findings.broadenedDomains, outOfWorkspacePaths: findings.outOfWorkspacePaths });
+    };
+}
+//# sourceMappingURL=broad-policy-validator.js.map

package/dist/persona/broad-policy-validator.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"broad-policy-validator.js","sourceRoot":"","sources":["../../src/persona/broad-policy-validator.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAoCG;AAEH,OAAO,EAAE,eAAe,EAAE,MAAM,4BAA4B,CAAC;AAK7D,gFAAgF;AAChF,MAAM,OAAO,wBAAyB,SAAQ,KAAK;IAItC;IAHF,IAAI,GAAc,uBAAuB,CAAC;IACnD,YACE,OAAe,EACN,IAAoE;QAE7E,KAAK,CAAC,OAAO,CAAC,CAAC;QAFN,SAAI,GAAJ,IAAI,CAAgE;QAG7E,IAAI,CAAC,IAAI,GAAG,0BAA0B,CAAC;IACzC,CAAC;CACF;AAaD;;;;;;;;;;;;;;GAcG;AACH,MAAM,UAAU,oBAAoB,CAAC,OAAe;IAClD,IAAI,OAAO,KAAK,GAAG;QAAE,OAAO,IAAI,CAAC;IACjC,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,IAAI,CAAC;QAAE,OAAO,KAAK,CAAC;IAC5C,MAAM,MAAM,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,wBAAwB;IACzD,4EAA4E;IAC5E,MAAM,MAAM,GAAG,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;IAC7D,OAAO,MAAM,CAAC,MAAM,IAAI,CAAC,CAAC;AAC5B,CAAC;AAED;;;;;;;;;;GAUG;AACH,SAAS,uBAAuB,CAC9B,OAA0B,EAC1B,YAA0C;IAE1C,MAAM,GAAG,GAAsC,EAAE,CAAC;IAClD,KAAK,MAAM,KAAK,IAAI,OAAO,EAAE,CAAC;QAC5B,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;YAC3B,GAAG,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,CAAC;YAC3B,SAAS;QACX,CAAC;QACD,MAAM,IAAI,GAAG,YAAY,EAAE,KAAK,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;QACjD,IAAI,CAAC,IAAI;YAAE,SAAS;QACpB,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC;QAC9C,KAAK,MAAM,CAAC,IAAI,IAAI,GAAG,CAAC,CAAC,GAAG,IAAI,CAAC,MAAM,EAAE,GAAG,IAAI,CAAC,eAAe,CAAC,CAAC,EAAE,CAAC;YACnE,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC;gBAAE,GAAG,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,CAAC,EAAE,GAAG,EAAE,KAAK,EAAE,CAAC,CAAC;QAC3D,CAAC;IACH,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,eAAe,CAC7B,MAA0B,EAC1B,YAAoB,EACpB,YAA+B;IAE/B,MAAM,gBAAgB,GAAG,IAAI,GAAG,EAAU,CAAC;IAC3C,MAAM,mBAAmB,GAAG,IAAI,GAAG,EAAU,CAAC;IAE9C,MAAM,aAAa,GAAG,eAAe,CAAC,YAAY,CAAC,CAAC;IACpD,MAAM,SAAS,GAAG,CAAC,OAA0B,EAAQ,EAAE;QACrD,KAAK,MAAM,EAAE,KAAK,EAAE,GAAG,EAAE,IAAI,uBAAuB,CAAC,OAAO,EAAE,YAAY,CAAC,EAAE,CAAC;YAC5E,IAAI,oBAAoB,CAAC,KAAK,CAAC;gBAAE,gBAAgB,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,KAAK,SAAS,GAAG,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC;QAC/F,CAAC;IACH,CAAC,CAAC;IAEF,KAAK,MAAM,IAAI,IAAI,MAAM,CAAC,KAAK,EAAE,CAAC;QAChC,MAAM,IAAI,GAAG,IAAI,CAAC,EAAE,CAAC;QACrB,mEAAmE;QACnE,IAAI,IAAI,CAAC,OAAO,EAAE,OAAO;YAAE,SAAS,CAAC,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;QAC3D,4BAA4B;QAC5B,IAAI,IAAI,CAAC,KAAK,EAAE,CAAC;YACf,KAAK,MAAM,IAAI,IAAI,IAAI,CAAC,KAAK;gBAAE,SAAS,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QACzD,CAAC;QACD,qCAAqC;QACrC,IAAI,IAAI,CAAC,KAAK,EAAE,MAAM,EAAE,CAAC;YACvB,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC;YACjC,MAAM,UAAU,GAAG,eAAe,CAAC,MAAM,CAAC,CAAC;YAC3C,MAAM,SAAS,GAAG,UAAU,KAAK,aAAa,IAAI,UAAU,CAAC,UAAU,CAAC,aAAa,GAAG,GAAG,CAAC,CAAC;YAC7F,IAAI,CAAC,SAAS;gBAAE,mBAAmB,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QAClD,CAAC;IACH,CAAC;IAED,OAAO;QACL,gBAAgB,EAAE,CAAC,GAAG,gBAAgB,CAAC;QACvC,mBAAmB,EAAE,CAAC,GAAG,mBAAmB,CAAC;KAC9C,CAAC;AACJ,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,wBAAwB,CACtC,YAAoB,EACpB,gBAAyB;IAEzB,OAAO,CAAC,MAA0B,EAAE,YAA+B,EAAQ,EAAE;QAC3E,IAAI,gBAAgB;YAAE,OAAO;QAC7B,MAAM,QAAQ,GAAG,eAAe,CAAC,MAAM,EAAE,YAAY,EAAE,YAAY,CAAC,CAAC;QACrE,IAAI,QAAQ,CAAC,gBAAgB,CAAC,MAAM,KAAK,CAAC,IAAI,QAAQ,CAAC,mBAAmB,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACxF,OAAO;QACT,CAAC;QACD,MAAM,KAAK,GAAa,EAAE,CAAC;QAC3B,IAAI,QAAQ,CAAC,gBAAgB,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACzC,KAAK,CAAC,IAAI,CAAC,sCAAsC,QAAQ,CAAC,gBAAgB,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QAC3F,CAAC;QACD,IAAI,QAAQ,CAAC,mBAAmB,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC5C,KAAK,CAAC,IAAI,CAAC,6BAA6B,QAAQ,CAAC,mBAAmB,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QACrF,CAAC;QACD,MAAM,IAAI,wBAAwB,CAChC,iCAAiC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,sDAAsD,EACvG,EAAE,gBAAgB,EAAE,QAAQ,CAAC,gBAAgB,EAAE,mBAAmB,EAAE,QAAQ,CAAC,mBAAmB,EAAE,CACnG,CAAC;IACJ,CAAC,CAAC;AACJ,CAAC"}

package/dist/persona/compile-persona-policy.d.ts

@@ -6,9 +6,61 @@
  * compileTaskPolicy() in src/cron/compile-task-policy.ts. The key
  * difference is constitutionKind: 'constitution' (broad principles)
  * vs 'task-policy' (task-specific whitelist).
+ *
+ * This is the SANCTIONED pipeline value-import seam (see
+ * test/pipeline-import-boundary.test.ts + the ESLint no-restricted-imports
+ * rule). It is reached ONLY via `await import(...)` from
+ * persona-compile-orchestrator.ts; nothing on the live runtime path imports it
+ * statically.
  */
+import { type PipelineModels } from '../pipeline/pipeline-runner.js';
 import type { PersonaName } from './types.js';
-import type { CompiledPolicyFile } from '../pipeline/types.js';
+import type { CompiledPolicyFile, DynamicListsFile } from '../pipeline/types.js';
+import type { ServerProgressReporter } from '../pipeline/pipeline-shared.js';
+/**
+ * Options for a streamed persona compile (Phase 1b). Threads the long-running
+ * concerns through to `PipelineRunner.run`. All fields are optional; absent =>
+ * the legacy CLI behavior (no reporter factory, no signal, not quiet, MCP lists
+ * allowed, workspace-bound allowedDirectory).
+ */
+export interface CompilePersonaOptions {
+    /** Per-server progress reporter factory (the EventBusProgressReporter). */
+    readonly reporterFactory?: (serverName: string) => ServerProgressReporter;
+    /** Cooperative cancellation (wall-clock cap / shutdown). */
+    readonly signal?: AbortSignal;
+    /** Suppress narrative stderr; requires a reporterFactory. */
+    readonly quiet?: boolean;
+    /**
+     * Operation id used to scope the per-op LLM interaction log to
+     * `generated/llm-interactions/<operationId>.jsonl`.
+     */
+    readonly operationId?: string;
+    /**
+     * Whether the list resolver may connect to live MCP servers. The WS path
+     * passes false (no live MCP) so MCP-backed lists fail fast.
+     */
+    readonly allowMcpLists?: boolean;
+    /**
+     * Sandbox boundary for structural invariant checks. Defaults to the
+     * persona's workspace dir (stable, persona-bound). Per spike A9 this is for
+     * cache/log stability only — it is NOT the runtime containment authority.
+     */
+    readonly allowedDirectory?: string;
+    /**
+     * Optional validation hook invoked on the in-memory compiled policy BEFORE any
+     * artifact is written (threads through to `PipelineRunner.run`). Throwing
+     * rejects the compile and leaves prior artifacts intact. Phase 1c uses this to
+     * enforce the broad-policy invariant (reject `'*'` domains/lists or
+     * out-of-workspace `paths.within` unless the persona is opted in).
+     */
+    readonly validateCompiled?: (policy: CompiledPolicyFile, dynamicLists?: DynamicListsFile) => void;
+    /**
+     * TEST-ONLY injection seam: pre-built PipelineModels (fake LLM). When absent,
+     * `createPipelineModels` is called (real provider). Production callers never
+     * pass this.
+     */
+    readonly models?: PipelineModels;
+}
 /**
  * Compiles a persona's constitution.md into policy rules, writing
  * output to the persona's generated/ directory.
@@ -18,4 +70,4 @@ import type { CompiledPolicyFile } from '../pipeline/types.js';
  * allowlist, only filtered servers are passed to the pipeline so the
  * compiled policy only references relevant tools.
  */
-export declare function compilePersonaPolicy(name: PersonaName): Promise<CompiledPolicyFile>;
+export declare function compilePersonaPolicy(name: PersonaName, opts?: CompilePersonaOptions): Promise<CompiledPolicyFile>;

package/dist/persona/compile-persona-policy.js

@@ -6,12 +6,19 @@
  * compileTaskPolicy() in src/cron/compile-task-policy.ts. The key
  * difference is constitutionKind: 'constitution' (broad principles)
  * vs 'task-policy' (task-specific whitelist).
+ *
+ * This is the SANCTIONED pipeline value-import seam (see
+ * test/pipeline-import-boundary.test.ts + the ESLint no-restricted-imports
+ * rule). It is reached ONLY via `await import(...)` from
+ * persona-compile-orchestrator.ts; nothing on the live runtime path imports it
+ * statically.
  */
 import { readFileSync } from 'node:fs';
+import { resolve } from 'node:path';
 import { PipelineRunner, createPipelineModels } from '../pipeline/pipeline-runner.js';
 import { loadConfig, getPackageGeneratedDir } from '../config/index.js';
 import { getUserGeneratedDir } from '../config/paths.js';
-import { getPersonaConstitutionPath, getPersonaGeneratedDir, loadPersona, applyServerAllowlist } from './resolve.js';
+import { getPersonaConstitutionPath, getPersonaGeneratedDir, getPersonaWorkspaceDir, loadPersona, applyServerAllowlist, } from './resolve.js';
 /**
  * Compiles a persona's constitution.md into policy rules, writing
  * output to the persona's generated/ directory.
@@ -21,13 +28,23 @@ import { getPersonaConstitutionPath, getPersonaGeneratedDir, loadPersona, applyS
  * allowlist, only filtered servers are passed to the pipeline so the
  * compiled policy only references relevant tools.
  */
-export async function compilePersonaPolicy(name) {
+export async function compilePersonaPolicy(name, opts = {}) {
     const config = loadConfig();
     const outputDir = getPersonaGeneratedDir(name);
     const constitutionPath = getPersonaConstitutionPath(name);
     const constitutionText = readFileSync(constitutionPath, 'utf-8');
     const annotationsDir = getUserGeneratedDir();
-    const models = await createPipelineModels(outputDir);
+    // Per-operation LLM log path when an operationId is supplied:
+    // `generated/llm-interactions/<operationId>.jsonl`. The pipeline truncates the
+    // file when it initializes the log (createLlmLoggingMiddleware -> initLogFile)
+    // and appends thereafter; because the operationId is interpolated into the
+    // FILENAME (not just used as a presence check), each compile writes to its own
+    // fresh file, so concurrent/successive compiles of the same persona never
+    // co-mingle or clobber one another. Without an operationId, the pipeline
+    // default (`<outputDir>/llm-interactions.jsonl`) applies.
+    const logDir = opts.operationId ? resolve(outputDir, 'llm-interactions') : outputDir;
+    const logFileName = opts.operationId ? `${opts.operationId}.jsonl` : undefined;
+    const models = opts.models ?? (await createPipelineModels(logDir, logFileName));
     const runner = new PipelineRunner(models);
     // Apply server allowlist if the persona specifies one
     let mcpServers = config.mcpServers;
@@ -35,17 +52,25 @@ export async function compilePersonaPolicy(name) {
     if (persona.servers) {
         mcpServers = applyServerAllowlist(mcpServers, persona.servers);
     }
+    // allowedDirectory defaults to the persona workspace dir (stable, persona-
+    // bound) rather than the daemon's process.env.ALLOWED_DIRECTORY fallback.
+    const allowedDirectory = opts.allowedDirectory ?? getPersonaWorkspaceDir(name);
     return runner.run({
         constitutionInput: constitutionText,
         constitutionKind: 'constitution',
         outputDir,
         toolAnnotationsDir: annotationsDir,
         toolAnnotationsFallbackDir: getPackageGeneratedDir(),
-        allowedDirectory: config.allowedDirectory,
+        allowedDirectory,
         protectedPaths: config.protectedPaths,
         mcpServers,
         includeHandwrittenScenarios: false,
         prefilterText: constitutionText,
+        ...(opts.reporterFactory ? { reporterFactory: opts.reporterFactory } : {}),
+        ...(opts.signal ? { signal: opts.signal } : {}),
+        ...(opts.quiet !== undefined ? { quiet: opts.quiet } : {}),
+        ...(opts.allowMcpLists !== undefined ? { allowMcpLists: opts.allowMcpLists } : {}),
+        ...(opts.validateCompiled ? { validateCompiled: opts.validateCompiled } : {}),
     });
 }
 //# sourceMappingURL=compile-persona-policy.js.map

package/dist/persona/compile-persona-policy.js.map

@@ -1 +1 @@
-{"version":3,"file":"compile-persona-policy.js","sourceRoot":"","sources":["../../src/persona/compile-persona-policy.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AACvC,OAAO,EAAE,cAAc,EAAE,oBAAoB,EAAE,MAAM,gCAAgC,CAAC;AACtF,OAAO,EAAE,UAAU,EAAE,sBAAsB,EAAE,MAAM,oBAAoB,CAAC;AACxE,OAAO,EAAE,mBAAmB,EAAE,MAAM,oBAAoB,CAAC;AACzD,OAAO,EAAE,0BAA0B,EAAE,sBAAsB,EAAE,WAAW,EAAE,oBAAoB,EAAE,MAAM,cAAc,CAAC;AAIrH;;;;;;;;GAQG;AACH,MAAM,CAAC,KAAK,UAAU,oBAAoB,CAAC,IAAiB;IAC1D,MAAM,MAAM,GAAG,UAAU,EAAE,CAAC;IAC5B,MAAM,SAAS,GAAG,sBAAsB,CAAC,IAAI,CAAC,CAAC;IAC/C,MAAM,gBAAgB,GAAG,0BAA0B,CAAC,IAAI,CAAC,CAAC;IAC1D,MAAM,gBAAgB,GAAG,YAAY,CAAC,gBAAgB,EAAE,OAAO,CAAC,CAAC;IACjE,MAAM,cAAc,GAAG,mBAAmB,EAAE,CAAC;IAC7C,MAAM,MAAM,GAAG,MAAM,oBAAoB,CAAC,SAAS,CAAC,CAAC;IACrD,MAAM,MAAM,GAAG,IAAI,cAAc,CAAC,MAAM,CAAC,CAAC;IAE1C,sDAAsD;IACtD,IAAI,UAAU,GAAG,MAAM,CAAC,UAAU,CAAC;IACnC,MAAM,OAAO,GAAG,WAAW,CAAC,IAAI,CAAC,CAAC;IAClC,IAAI,OAAO,CAAC,OAAO,EAAE,CAAC;QACpB,UAAU,GAAG,oBAAoB,CAAC,UAAU,EAAE,OAAO,CAAC,OAAO,CAAC,CAAC;IACjE,CAAC;IAED,OAAO,MAAM,CAAC,GAAG,CAAC;QAChB,iBAAiB,EAAE,gBAAgB;QACnC,gBAAgB,EAAE,cAAc;QAChC,SAAS;QACT,kBAAkB,EAAE,cAAc;QAClC,0BAA0B,EAAE,sBAAsB,EAAE;QACpD,gBAAgB,EAAE,MAAM,CAAC,gBAAgB;QACzC,cAAc,EAAE,MAAM,CAAC,cAAc;QACrC,UAAU;QACV,2BAA2B,EAAE,KAAK;QAClC,aAAa,EAAE,gBAAgB;KAChC,CAAC,CAAC;AACL,CAAC"}
+{"version":3,"file":"compile-persona-policy.js","sourceRoot":"","sources":["../../src/persona/compile-persona-policy.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAEH,OAAO,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AACvC,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACpC,OAAO,EAAE,cAAc,EAAE,oBAAoB,EAAuB,MAAM,gCAAgC,CAAC;AAC3G,OAAO,EAAE,UAAU,EAAE,sBAAsB,EAAE,MAAM,oBAAoB,CAAC;AACxE,OAAO,EAAE,mBAAmB,EAAE,MAAM,oBAAoB,CAAC;AACzD,OAAO,EACL,0BAA0B,EAC1B,sBAAsB,EACtB,sBAAsB,EACtB,WAAW,EACX,oBAAoB,GACrB,MAAM,cAAc,CAAC;AAkDtB;;;;;;;;GAQG;AACH,MAAM,CAAC,KAAK,UAAU,oBAAoB,CACxC,IAAiB,EACjB,OAA8B,EAAE;IAEhC,MAAM,MAAM,GAAG,UAAU,EAAE,CAAC;IAC5B,MAAM,SAAS,GAAG,sBAAsB,CAAC,IAAI,CAAC,CAAC;IAC/C,MAAM,gBAAgB,GAAG,0BAA0B,CAAC,IAAI,CAAC,CAAC;IAC1D,MAAM,gBAAgB,GAAG,YAAY,CAAC,gBAAgB,EAAE,OAAO,CAAC,CAAC;IACjE,MAAM,cAAc,GAAG,mBAAmB,EAAE,CAAC;IAE7C,8DAA8D;IAC9D,+EAA+E;IAC/E,+EAA+E;IAC/E,2EAA2E;IAC3E,+EAA+E;IAC/E,0EAA0E;IAC1E,yEAAyE;IACzE,0DAA0D;IAC1D,MAAM,MAAM,GAAG,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC,OAAO,CAAC,SAAS,EAAE,kBAAkB,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IACrF,MAAM,WAAW,GAAG,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC,GAAG,IAAI,CAAC,WAAW,QAAQ,CAAC,CAAC,CAAC,SAAS,CAAC;IAC/E,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,IAAI,CAAC,MAAM,oBAAoB,CAAC,MAAM,EAAE,WAAW,CAAC,CAAC,CAAC;IAChF,MAAM,MAAM,GAAG,IAAI,cAAc,CAAC,MAAM,CAAC,CAAC;IAE1C,sDAAsD;IACtD,IAAI,UAAU,GAAG,MAAM,CAAC,UAAU,CAAC;IACnC,MAAM,OAAO,GAAG,WAAW,CAAC,IAAI,CAAC,CAAC;IAClC,IAAI,OAAO,CAAC,OAAO,EAAE,CAAC;QACpB,UAAU,GAAG,oBAAoB,CAAC,UAAU,EAAE,OAAO,CAAC,OAAO,CAAC,CAAC;IACjE,CAAC;IAED,2EAA2E;IAC3E,0EAA0E;IAC1E,MAAM,gBAAgB,GAAG,IAAI,CAAC,gBAAgB,IAAI,sBAAsB,CAAC,IAAI,CAAC,CAAC;IAE/E,OAAO,MAAM,CAAC,GAAG,CAAC;QAChB,iBAAiB,EAAE,gBAAgB;QACnC,gBAAgB,EAAE,cAAc;QAChC,SAAS;QACT,kBAAkB,EAAE,cAAc;QAClC,0BAA0B,EAAE,sBAAsB,EAAE;QACpD,gBAAgB;QAChB,cAAc,EAAE,MAAM,CAAC,cAAc;QACrC,UAAU;QACV,2BAA2B,EAAE,KAAK;QAClC,aAAa,EAAE,gBAAgB;QAC/B,GAAG,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC,CAAC,EAAE,eAAe,EAAE,IAAI,CAAC,eAAe,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC1E,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC/C,GAAG,CAAC,IAAI,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC1D,GAAG,CAAC,IAAI,CAAC,aAAa,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,IAAI,CAAC,aAAa,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAClF,GAAG,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAC,CAAC,EAAE,gBAAgB,EAAE,IAAI,CAAC,gBAAgB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAC9E,CAAC,CAAC;AACL,CAAC"}

package/dist/persona/event-bus-progress-reporter.d.ts

@@ -0,0 +1,57 @@
+/**
+ * src/persona/event-bus-progress-reporter.ts
+ *
+ * Bridges the pipeline's per-server {@link ServerProgressReporter} contract to
+ * the daemon's persona-compile operation record + WS event bus (Phase 1b, §4.2).
+ *
+ * The reporter is created per server via the `reporterFactory` injected into
+ * `PipelineRunConfig`. On every phase transition it:
+ *   1. writes the live `{ serverName, compilationPhase, detail }` into the
+ *      active operation record (the SNAPSHOT — the source of truth, so a
+ *      reconnecting client renders the current phase from one `listCompiles`
+ *      call), THEN
+ *   2. emits the best-effort / lossy `persona.compile.progress` event (which
+ *      only reaches currently-open WS clients).
+ *
+ * ZERO runtime value-imports from src/pipeline — the `ServerProgressReporter` /
+ * `CompilationPhase` contracts are TYPE-ONLY imports. Enforced by the Phase-0
+ * ESLint no-restricted-imports rule + test/pipeline-import-boundary.test.ts.
+ *
+ * @see docs/designs/web-ui-policy-persona-management.md §4.2
+ */
+import type { ServerProgressReporter, CompilationPhase } from '../pipeline/pipeline-shared.js';
+/** Live server-progress snapshot written into the operation record. */
+export interface ServerProgressSnapshot {
+    readonly serverName: string;
+    readonly compilationPhase: CompilationPhase;
+    readonly detail?: string;
+}
+/** Wiring the reporter needs to update the snapshot and emit progress. */
+export interface EventBusProgressReporterContext {
+    readonly operationId: string;
+    readonly personaName: string;
+    readonly serverName: string;
+    /** Emit the (best-effort) progress event. */
+    readonly emit: (progress: {
+        name: string;
+        operationId: string;
+        serverName: string;
+        phase: CompilationPhase;
+        detail?: string;
+    }) => void;
+    /** Write the live phase into the active operation record (source of truth). */
+    readonly snapshotUpdate: (snapshot: ServerProgressSnapshot) => void;
+}
+/**
+ * `ServerProgressReporter` implementation that drives the operation-record
+ * snapshot first, then emits a progress event.
+ */
+export declare class EventBusProgressReporter implements ServerProgressReporter {
+    private readonly ctx;
+    constructor(ctx: EventBusProgressReporterContext);
+    update(phase: CompilationPhase, detail?: string): void;
+    complete(phase: CompilationPhase, summary: string, elapsed: number): void;
+    warn(message: string): void;
+    fail(phase: CompilationPhase, error: Error): void;
+    done(summary: string): void;
+}

package/dist/persona/event-bus-progress-reporter.js

@@ -0,0 +1,66 @@
+/**
+ * src/persona/event-bus-progress-reporter.ts
+ *
+ * Bridges the pipeline's per-server {@link ServerProgressReporter} contract to
+ * the daemon's persona-compile operation record + WS event bus (Phase 1b, §4.2).
+ *
+ * The reporter is created per server via the `reporterFactory` injected into
+ * `PipelineRunConfig`. On every phase transition it:
+ *   1. writes the live `{ serverName, compilationPhase, detail }` into the
+ *      active operation record (the SNAPSHOT — the source of truth, so a
+ *      reconnecting client renders the current phase from one `listCompiles`
+ *      call), THEN
+ *   2. emits the best-effort / lossy `persona.compile.progress` event (which
+ *      only reaches currently-open WS clients).
+ *
+ * ZERO runtime value-imports from src/pipeline — the `ServerProgressReporter` /
+ * `CompilationPhase` contracts are TYPE-ONLY imports. Enforced by the Phase-0
+ * ESLint no-restricted-imports rule + test/pipeline-import-boundary.test.ts.
+ *
+ * @see docs/designs/web-ui-policy-persona-management.md §4.2
+ */
+/**
+ * `ServerProgressReporter` implementation that drives the operation-record
+ * snapshot first, then emits a progress event.
+ */
+export class EventBusProgressReporter {
+    ctx;
+    constructor(ctx) {
+        this.ctx = ctx;
+    }
+    update(phase, detail) {
+        // 1) snapshot = source of truth — write BEFORE emitting.
+        this.ctx.snapshotUpdate({
+            serverName: this.ctx.serverName,
+            compilationPhase: phase,
+            ...(detail ? { detail } : {}),
+        });
+        // 2) best-effort, lossy progress event.
+        this.ctx.emit({
+            name: this.ctx.personaName,
+            operationId: this.ctx.operationId,
+            serverName: this.ctx.serverName,
+            phase,
+            ...(detail ? { detail } : {}),
+        });
+    }
+    // eslint-disable-next-line @typescript-eslint/no-unused-vars -- interface conformance (elapsed unused)
+    complete(phase, summary, elapsed) {
+        this.update(phase, summary);
+    }
+    warn(message) {
+        // Route applyServerAllowlist-style warnings as progress, not stderr.
+        this.update('compiling', message);
+    }
+    // eslint-disable-next-line @typescript-eslint/no-unused-vars -- interface conformance
+    fail(phase, error) {
+        // The terminal `persona.compile.failed` event is emitted by the
+        // orchestrator's finally block; nothing to do here.
+    }
+    done(summary) {
+        // The terminal `persona.compile.done` event is emitted by the
+        // orchestrator's finally block; reflect the final phase in the snapshot.
+        this.update('done', summary);
+    }
+}
+//# sourceMappingURL=event-bus-progress-reporter.js.map

package/dist/persona/event-bus-progress-reporter.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"event-bus-progress-reporter.js","sourceRoot":"","sources":["../../src/persona/event-bus-progress-reporter.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AA4BH;;;GAGG;AACH,MAAM,OAAO,wBAAwB;IACN;IAA7B,YAA6B,GAAoC;QAApC,QAAG,GAAH,GAAG,CAAiC;IAAG,CAAC;IAErE,MAAM,CAAC,KAAuB,EAAE,MAAe;QAC7C,yDAAyD;QACzD,IAAI,CAAC,GAAG,CAAC,cAAc,CAAC;YACtB,UAAU,EAAE,IAAI,CAAC,GAAG,CAAC,UAAU;YAC/B,gBAAgB,EAAE,KAAK;YACvB,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAC9B,CAAC,CAAC;QACH,wCAAwC;QACxC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC;YACZ,IAAI,EAAE,IAAI,CAAC,GAAG,CAAC,WAAW;YAC1B,WAAW,EAAE,IAAI,CAAC,GAAG,CAAC,WAAW;YACjC,UAAU,EAAE,IAAI,CAAC,GAAG,CAAC,UAAU;YAC/B,KAAK;YACL,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAC9B,CAAC,CAAC;IACL,CAAC;IAED,uGAAuG;IACvG,QAAQ,CAAC,KAAuB,EAAE,OAAe,EAAE,OAAe;QAChE,IAAI,CAAC,MAAM,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;IAC9B,CAAC;IAED,IAAI,CAAC,OAAe;QAClB,qEAAqE;QACrE,IAAI,CAAC,MAAM,CAAC,WAAW,EAAE,OAAO,CAAC,CAAC;IACpC,CAAC;IAED,sFAAsF;IACtF,IAAI,CAAC,KAAuB,EAAE,KAAY;QACxC,gEAAgE;QAChE,oDAAoD;IACtD,CAAC;IAED,IAAI,CAAC,OAAe;QAClB,8DAA8D;QAC9D,yEAAyE;QACzE,IAAI,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAC/B,CAAC;CACF"}

package/dist/persona/memory-gate.d.ts

@@ -0,0 +1,19 @@
+/**
+ * Loader-aware memory-gate wrapper for callers that have only a persona
+ * NAME in scope (e.g., the workflow orchestrator at relay-derivation
+ * time).
+ *
+ * Lives in `src/persona/` (not `src/memory/`) to avoid closing a
+ * `memory/ -> persona/ -> memory/` import cycle: `loadPersona` lives
+ * in `src/persona/resolve.ts`, which already imports from
+ * `src/memory/memory-annotations.ts`.
+ */
+import type { ResolvedUserConfig } from '../config/user-config.js';
+/**
+ * Loads the persona definition by name and runs the memory gate.
+ *
+ * Fail-closed: if the persona file is missing or malformed (loadPersona
+ * throws), returns false. The orchestrator should not spawn a memory
+ * relay for a persona it cannot load.
+ */
+export declare function isMemoryEnabledForPersonaName(name: string, userConfig: ResolvedUserConfig): boolean;

package/dist/persona/memory-gate.js

@@ -0,0 +1,33 @@
+/**
+ * Loader-aware memory-gate wrapper for callers that have only a persona
+ * NAME in scope (e.g., the workflow orchestrator at relay-derivation
+ * time).
+ *
+ * Lives in `src/persona/` (not `src/memory/`) to avoid closing a
+ * `memory/ -> persona/ -> memory/` import cycle: `loadPersona` lives
+ * in `src/persona/resolve.ts`, which already imports from
+ * `src/memory/memory-annotations.ts`.
+ */
+import { isMemoryEnabledFor } from '../memory/memory-policy.js';
+import { loadPersona } from './resolve.js';
+import { createPersonaName } from './types.js';
+/**
+ * Loads the persona definition by name and runs the memory gate.
+ *
+ * Fail-closed: if the persona file is missing or malformed (loadPersona
+ * throws), returns false. The orchestrator should not spawn a memory
+ * relay for a persona it cannot load.
+ */
+export function isMemoryEnabledForPersonaName(name, userConfig) {
+    if (!userConfig.memory.enabled)
+        return false;
+    let persona;
+    try {
+        persona = loadPersona(createPersonaName(name));
+    }
+    catch {
+        return false;
+    }
+    return isMemoryEnabledFor({ persona, userConfig });
+}
+//# sourceMappingURL=memory-gate.js.map

package/dist/persona/memory-gate.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"memory-gate.js","sourceRoot":"","sources":["../../src/persona/memory-gate.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAGH,OAAO,EAAE,kBAAkB,EAAE,MAAM,4BAA4B,CAAC;AAChE,OAAO,EAAE,WAAW,EAAE,MAAM,cAAc,CAAC;AAC3C,OAAO,EAAE,iBAAiB,EAA0B,MAAM,YAAY,CAAC;AAEvE;;;;;;GAMG;AACH,MAAM,UAAU,6BAA6B,CAAC,IAAY,EAAE,UAA8B;IACxF,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,OAAO;QAAE,OAAO,KAAK,CAAC;IAC7C,IAAI,OAA0B,CAAC;IAC/B,IAAI,CAAC;QACH,OAAO,GAAG,WAAW,CAAC,iBAAiB,CAAC,IAAI,CAAC,CAAC,CAAC;IACjD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;IACD,OAAO,kBAAkB,CAAC,EAAE,OAAO,EAAE,UAAU,EAAE,CAAC,CAAC;AACrD,CAAC"}