@remnic/core 9.3.655 → 9.3.656

package/dist/chunk-GYSYLGNE.js

@@ -0,0 +1,650 @@
+import {
+  launchProcessSync
+} from "./chunk-O75CRYGF.js";
+import {
+  canReadNamespace,
+  canWriteNamespace,
+  defaultNamespaceForPrincipal
+} from "./chunk-UZYLX7M6.js";
+import {
+  isSafeRouteNamespace
+} from "./chunk-U3PN77QT.js";
+import {
+  expandTildePath
+} from "./chunk-EYIEWJNI.js";
+
+// src/coding/git-context.ts
+import path from "path";
+var DEFAULT_GIT_TIMEOUT_MS = 2e3;
+function defaultGitInvoker() {
+  return (cwd, args) => {
+    const result = launchProcessSync("git", args, {
+      cwd,
+      encoding: "utf-8",
+      timeout: DEFAULT_GIT_TIMEOUT_MS,
+      shell: false
+    });
+    if (result.error) {
+      return { stdout: "", exitCode: 127 };
+    }
+    return {
+      stdout: typeof result.stdout === "string" ? result.stdout : "",
+      exitCode: typeof result.status === "number" ? result.status : 1
+    };
+  };
+}
+function stableHash(input) {
+  let hash = 2166136261;
+  for (let i = 0; i < input.length; i++) {
+    hash ^= input.charCodeAt(i);
+    hash = Math.imul(hash, 16777619) >>> 0;
+  }
+  return hash.toString(16).padStart(8, "0");
+}
+function normalizeOriginUrl(rawUrl) {
+  let url = rawUrl.trim();
+  if (!url) return "";
+  if (/\.git$/i.test(url)) url = url.slice(0, -4);
+  if (/^[A-Za-z]:[\\/]/.test(url)) {
+    return url.toLowerCase();
+  }
+  const protoMatch = /^[a-z][a-z0-9+.-]*:\/\/(?:[^@/]+@)?(\[[^\]]+\]|[^/:]*)(?::(\d+))?(\/.*)?$/i.exec(url);
+  if (protoMatch) {
+    let host = protoMatch[1] ?? "";
+    const wasBracketed = host.startsWith("[") && host.endsWith("]");
+    if (wasBracketed) host = host.slice(1, -1);
+    const port = protoMatch[2];
+    const repoPath = (protoMatch[3] ?? "").replace(/^\/+/, "");
+    const hostPort = port ? wasBracketed ? `[${host}]:${port}` : `${host}:${port}` : host;
+    const prefix = hostPort.length > 0 ? hostPort : "localhost";
+    return `${prefix}/${repoPath}`.toLowerCase();
+  }
+  const scpMatch = /^(?:([^@\s/]+)@)?(\[[^\]]+\]|[^:@\s/]+):(.+)$/.exec(url);
+  if (scpMatch) {
+    let host = scpMatch[2] ?? "";
+    if (host.startsWith("[") && host.endsWith("]")) host = host.slice(1, -1);
+    const repoPath = scpMatch[3] ?? "";
+    if (repoPath.startsWith("//")) {
+      return url.toLowerCase();
+    }
+    return `${host}/${repoPath.replace(/^\/+/, "")}`.toLowerCase();
+  }
+  return url.toLowerCase();
+}
+async function resolveGitContext(cwd, options = {}) {
+  try {
+    if (typeof cwd !== "string" || cwd.length === 0) return null;
+    const expanded = expandTildePath(cwd);
+    if (!path.isAbsolute(expanded)) return null;
+    const invoker = options.invoker ?? defaultGitInvoker();
+    const topLevel = invoker(expanded, ["rev-parse", "--show-toplevel"]);
+    if (topLevel.exitCode !== 0) return null;
+    const rootPath = topLevel.stdout.trim();
+    if (!rootPath) return null;
+    const branchResult = invoker(rootPath, ["rev-parse", "--abbrev-ref", "HEAD"]);
+    let branch = null;
+    if (branchResult.exitCode === 0) {
+      const raw = branchResult.stdout.trim();
+      branch = raw && raw !== "HEAD" ? raw : null;
+    } else {
+      const unbornRef = invoker(rootPath, ["symbolic-ref", "--quiet", "HEAD"]);
+      if (unbornRef.exitCode === 0) {
+        const raw = unbornRef.stdout.trim();
+        const prefix = "refs/heads/";
+        if (raw.startsWith(prefix)) {
+          const candidate = raw.slice(prefix.length);
+          if (candidate) branch = candidate;
+        }
+      }
+    }
+    const originResult = invoker(rootPath, ["remote", "get-url", "origin"]);
+    let projectId;
+    if (originResult.exitCode === 0) {
+      const normalized = normalizeOriginUrl(originResult.stdout);
+      projectId = normalized ? `origin:${stableHash(normalized)}` : `root:${stableHash(rootPath)}`;
+    } else {
+      projectId = `root:${stableHash(rootPath)}`;
+    }
+    const headRef = invoker(rootPath, ["symbolic-ref", "--quiet", "refs/remotes/origin/HEAD"]);
+    let defaultBranch = null;
+    if (headRef.exitCode === 0) {
+      const raw = headRef.stdout.trim();
+      const prefix = "refs/remotes/origin/";
+      if (raw.startsWith(prefix)) {
+        const candidate = raw.slice(prefix.length);
+        if (candidate) defaultBranch = candidate;
+      }
+    }
+    return {
+      projectId,
+      branch,
+      rootPath,
+      defaultBranch
+    };
+  } catch {
+    return null;
+  }
+}
+
+// src/coding/coding-namespace.ts
+function sanitizeFragment(input) {
+  if (typeof input !== "string") return "";
+  const trimmed = input.trim().toLowerCase();
+  let out = "";
+  let prevIsDash = true;
+  for (let i = 0; i < trimmed.length; i += 1) {
+    const c = trimmed[i];
+    const cc = trimmed.charCodeAt(i);
+    const isSafe = cc >= 48 && cc <= 57 || cc >= 97 && cc <= 122 || cc === 46 || cc === 95;
+    if (isSafe) {
+      out += c;
+      prevIsDash = false;
+    } else if (!prevIsDash) {
+      out += "-";
+      prevIsDash = true;
+    }
+  }
+  if (out.endsWith("-")) out = out.slice(0, -1);
+  return out;
+}
+var MAX_NAMESPACE_LEN = 64;
+var HASH_SUFFIX_LEN = 9;
+function capLength(value) {
+  if (value.length <= MAX_NAMESPACE_LEN) return value;
+  const hash = stableHash(value);
+  let end = MAX_NAMESPACE_LEN - HASH_SUFFIX_LEN;
+  while (end > 0 && value.charCodeAt(end - 1) === 45) end -= 1;
+  return `${value.slice(0, end)}-${hash}`;
+}
+function projectNamespaceName(projectId) {
+  const frag = sanitizeFragment(projectId);
+  return capLength(`project-${frag || "unknown"}`);
+}
+function projectTagProjectId(projectTag) {
+  const trimmed = projectTag.trim();
+  const frag = sanitizeFragment(trimmed);
+  const disambig = trimmed.length > 0 && frag !== trimmed;
+  const suffix = disambig ? `-${stableHash(trimmed)}` : "";
+  return `tag:${frag || "unknown"}${suffix}`;
+}
+function sanitizeBaseFragment(input) {
+  if (typeof input !== "string") return "";
+  const trimmed = input.trim();
+  let out = "";
+  let prevIsDash = true;
+  for (let i = 0; i < trimmed.length; i += 1) {
+    const c = trimmed[i];
+    const cc = trimmed.charCodeAt(i);
+    const isSafe = cc >= 48 && cc <= 57 || cc >= 65 && cc <= 90 || cc >= 97 && cc <= 122 || cc === 46 || cc === 95;
+    if (isSafe) {
+      out += c;
+      prevIsDash = false;
+    } else if (!prevIsDash) {
+      out += "-";
+      prevIsDash = true;
+    }
+  }
+  if (out.endsWith("-")) out = out.slice(0, -1);
+  return out;
+}
+function combineNamespaces(base, overlay) {
+  const baseFrag = sanitizeBaseFragment(base);
+  const overlayFrag = sanitizeFragment(overlay);
+  if (!baseFrag) return capLength(overlayFrag || "unknown");
+  if (!overlayFrag) return capLength(baseFrag);
+  return capLength(`${baseFrag}-${overlayFrag}`);
+}
+function branchNamespaceName(projectId, branch) {
+  const projectFrag = sanitizeFragment(projectId);
+  const trimmedBranch = branch.trim();
+  const branchFrag = sanitizeFragment(trimmedBranch);
+  const disambig = trimmedBranch.length > 0 && branchFrag !== trimmedBranch;
+  const base = `project-${projectFrag || "unknown"}-branch-${branchFrag || "unknown"}`;
+  const suffixed = disambig ? `${base}-${stableHash(trimmedBranch)}` : base;
+  return capLength(suffixed);
+}
+function resolveCodingNamespaceOverlay(codingContext, config, defaultNamespace) {
+  if (!codingContext) return null;
+  if (!config.projectScope) return null;
+  const projectId = typeof codingContext.projectId === "string" ? codingContext.projectId.trim() : "";
+  if (!projectId) return null;
+  const projectNs = projectNamespaceName(projectId);
+  const includeRoot = config.globalFallback === true;
+  if (config.branchScope && typeof codingContext.branch === "string" && codingContext.branch.length > 0) {
+    const branchNs = branchNamespaceName(projectId, codingContext.branch);
+    const fallbacks = [projectNs];
+    if (includeRoot) fallbacks.push("");
+    return {
+      namespace: branchNs,
+      readFallbacks: fallbacks,
+      scope: "branch"
+    };
+  }
+  return {
+    namespace: projectNs,
+    readFallbacks: includeRoot ? [""] : [],
+    scope: "project"
+  };
+}
+function describeCodingScope(codingContext, config, defaultNamespace) {
+  const projectId = codingContext?.projectId ?? null;
+  const branch = codingContext?.branch ?? null;
+  if (!codingContext) {
+    return {
+      scope: "none",
+      projectId: null,
+      branch: null,
+      effectiveNamespace: null,
+      readFallbacks: [],
+      disabledReason: "no-context"
+    };
+  }
+  if (!config.projectScope) {
+    return {
+      scope: "none",
+      projectId,
+      branch,
+      effectiveNamespace: null,
+      readFallbacks: [],
+      disabledReason: "disabled"
+    };
+  }
+  const trimmedId = typeof projectId === "string" ? projectId.trim() : "";
+  if (!trimmedId) {
+    return {
+      scope: "none",
+      projectId,
+      branch,
+      effectiveNamespace: null,
+      readFallbacks: [],
+      disabledReason: "empty-project"
+    };
+  }
+  const overlay = resolveCodingNamespaceOverlay(codingContext, config, defaultNamespace);
+  if (!overlay) {
+    return {
+      scope: "none",
+      projectId,
+      branch,
+      effectiveNamespace: null,
+      readFallbacks: [],
+      disabledReason: "disabled"
+    };
+  }
+  return {
+    scope: overlay.scope,
+    projectId,
+    branch,
+    effectiveNamespace: overlay.namespace,
+    readFallbacks: overlay.readFallbacks,
+    disabledReason: null
+  };
+}
+var LCM_NS_SENTINEL = "";
+function escapeDefaultLcmKey(sessionKey) {
+  return sessionKey.startsWith(LCM_NS_SENTINEL) ? `${LCM_NS_SENTINEL}${sessionKey}` : sessionKey;
+}
+function lcmSessionKeyForNamespace(namespace, sessionKey, defaultNamespace) {
+  if (typeof sessionKey !== "string" || sessionKey.length === 0) return sessionKey;
+  if (typeof namespace === "string" && namespace.length > 0 && namespace !== defaultNamespace) {
+    return `${LCM_NS_SENTINEL}${namespace}${LCM_NS_SENTINEL}${sessionKey}`;
+  }
+  return escapeDefaultLcmKey(sessionKey);
+}
+function lcmReadSessionIdsForNamespaces(namespaces, sessionKey, defaultNamespace) {
+  if (typeof sessionKey !== "string" || sessionKey.length === 0) {
+    return [void 0];
+  }
+  const out = [];
+  const seen = /* @__PURE__ */ new Set();
+  for (const namespace of namespaces) {
+    const key = lcmSessionKeyForNamespace(namespace, sessionKey, defaultNamespace) ?? sessionKey;
+    if (!seen.has(key)) {
+      seen.add(key);
+      out.push(key);
+    }
+  }
+  return out;
+}
+
+// src/namespaces/scope-profiles.ts
+import { createHash } from "crypto";
+function activeScopeProfile(config) {
+  const profileId = config.defaultScopeProfile;
+  if (!profileId) return null;
+  const profile = (config.scopeProfiles ?? {})[profileId];
+  return profile ? { profileId, profile } : null;
+}
+function principalListed(list, principal) {
+  if (!principal) return false;
+  return list.includes(principal) || list.includes("*");
+}
+function derivedScopeProfileSelfNamespace(principal, config) {
+  if (!principal || principal === config.defaultNamespace || principal === config.sharedNamespace) return null;
+  if (isSafeRouteNamespace(principal)) return principal;
+  return "principal-" + createHash("sha256").update(principal).digest("hex").slice(0, 54);
+}
+function scopeProfileSelfNamespace(principal, config) {
+  const existing = defaultNamespaceForPrincipal(principal, config);
+  if (existing !== config.defaultNamespace) return existing;
+  return derivedScopeProfileSelfNamespace(principal, config) ?? existing;
+}
+function hasExplicitNamespacePolicy(namespace, config) {
+  return (config.namespacePolicies ?? []).some((policy) => policy.name === namespace);
+}
+function isScopeProfileImplicitSelfNamespace(principal, namespace, config) {
+  const derived = derivedScopeProfileSelfNamespace(principal, config);
+  return Boolean(
+    derived && namespace === derived && namespace !== config.defaultNamespace && namespace !== config.sharedNamespace && isSafeRouteNamespace(namespace) && !hasExplicitNamespacePolicy(namespace, config)
+  );
+}
+function canReadScopeProfileNamespace(principal, namespace, config) {
+  return isScopeProfileImplicitSelfNamespace(principal, namespace, config) || canReadNamespace(principal, namespace, config);
+}
+function canWriteScopeProfileNamespace(principal, namespace, config) {
+  return isScopeProfileImplicitSelfNamespace(principal, namespace, config) || canWriteNamespace(principal, namespace, config);
+}
+function resolveTeam(config, profile, principal) {
+  const configuredTeamId = profile.teamProject?.teamId;
+  if (configuredTeamId) {
+    const configured = (config.teams ?? {})[configuredTeamId];
+    return configured ? { teamId: configuredTeamId, team: configured } : null;
+  }
+  const readableTeams = Object.entries(config.teams ?? {}).filter(
+    ([, team]) => principalListed(team.principals, principal) || principalListed(team.read, principal)
+  );
+  const needsWritableTeam = profile.writeDefault === "teamProject" || profile.readOrder.includes("teamProject");
+  if (needsWritableTeam) {
+    const writableTeam = readableTeams.find(([, team]) => principalListed(team.write, principal));
+    if (writableTeam) return { teamId: writableTeam[0], team: writableTeam[1] };
+  }
+  const needsPromotableTeam = profile.promotionTargets.includes("teamProject") || profile.autoPromote.targets.includes("teamProject");
+  if (needsPromotableTeam) {
+    const promotableTeam = readableTeams.find(
+      ([, team]) => principalListed(team.promote, principal) || principalListed(team.write, principal)
+    );
+    if (promotableTeam) return { teamId: promotableTeam[0], team: promotableTeam[1] };
+  }
+  const firstReadableTeam = readableTeams[0];
+  return firstReadableTeam ? { teamId: firstReadableTeam[0], team: firstReadableTeam[1] } : null;
+}
+function renderTeamProjectNamespace(params) {
+  const replacements = {
+    teamId: params.teamId,
+    principal: params.principal ?? "anonymous",
+    projectId: params.codingContext.projectId,
+    projectHash: stableHash(params.codingContext.projectId),
+    projectNamespace: params.codingOverlay.namespace
+  };
+  const unknownPlaceholders = [];
+  const namespace = params.template.replace(/\{([A-Za-z][A-Za-z0-9]*)\}/g, (match, key) => {
+    const replacement = replacements[key];
+    if (replacement !== void 0) return replacement;
+    if (!unknownPlaceholders.includes(key)) unknownPlaceholders.push(key);
+    return match;
+  });
+  return { namespace, unknownPlaceholders };
+}
+function resolveLayer(params) {
+  const { id, config, profile, principal, baseNamespace, codingContext, codingOverlay } = params;
+  if (id === "userGlobal") {
+    return {
+      id,
+      kind: "user-global",
+      namespace: baseNamespace,
+      readable: canReadScopeProfileNamespace(principal, baseNamespace, config),
+      writable: canWriteScopeProfileNamespace(principal, baseNamespace, config),
+      promotable: canWriteScopeProfileNamespace(principal, baseNamespace, config),
+      reason: "principal self/global namespace"
+    };
+  }
+  if (id === "serverShared") {
+    return {
+      id,
+      kind: "server-shared",
+      namespace: config.sharedNamespace,
+      readable: canReadNamespace(principal, config.sharedNamespace, config),
+      writable: canWriteNamespace(principal, config.sharedNamespace, config),
+      promotable: canWriteNamespace(principal, config.sharedNamespace, config),
+      reason: "configured shared namespace"
+    };
+  }
+  if (id === "userProject") {
+    if (!codingContext || !codingOverlay) {
+      return {
+        id,
+        kind: "user-project",
+        readable: false,
+        writable: false,
+        promotable: false,
+        reason: "missing project context"
+      };
+    }
+    const namespace2 = combineNamespaces(baseNamespace, codingOverlay.namespace);
+    const explicitProjectPolicy = hasExplicitNamespacePolicy(namespace2, config);
+    const baseReadable = canReadScopeProfileNamespace(principal, baseNamespace, config);
+    const baseWritable = canWriteScopeProfileNamespace(principal, baseNamespace, config);
+    const projectReadable = explicitProjectPolicy ? canReadNamespace(principal, namespace2, config) : baseReadable;
+    const projectWritable = explicitProjectPolicy ? canWriteNamespace(principal, namespace2, config) : baseWritable;
+    return {
+      id,
+      kind: "user-project",
+      namespace: namespace2,
+      readable: projectReadable,
+      writable: projectWritable,
+      promotable: projectWritable,
+      reason: explicitProjectPolicy ? "explicit user-project namespace policy" : baseReadable || baseWritable ? "principal project namespace derived from coding context" : "principal base namespace is not authorized"
+    };
+  }
+  const team = resolveTeam(config, profile, principal);
+  if (!team) {
+    return {
+      id,
+      kind: "team-project",
+      readable: false,
+      writable: false,
+      promotable: false,
+      reason: "no authorized team mapping"
+    };
+  }
+  if (!codingContext || !codingOverlay) {
+    return {
+      id,
+      kind: "team-project",
+      readable: false,
+      writable: false,
+      promotable: false,
+      reason: "missing project context"
+    };
+  }
+  const template = profile.teamProject?.namespaceTemplate ?? team.team.projectNamespaceTemplate ?? "team-{teamId}-project-{projectHash}";
+  const renderedNamespace = renderTeamProjectNamespace({
+    template,
+    teamId: team.teamId,
+    principal,
+    codingContext,
+    codingOverlay
+  });
+  const namespace = renderedNamespace.namespace.trim();
+  if (renderedNamespace.unknownPlaceholders.length > 0) {
+    return {
+      id,
+      kind: "team-project",
+      namespace,
+      readable: false,
+      writable: false,
+      promotable: false,
+      reason: `unknown team-project namespace template placeholder(s): ${renderedNamespace.unknownPlaceholders.join(", ")}`
+    };
+  }
+  if (!namespace || !isSafeRouteNamespace(namespace)) {
+    return {
+      id,
+      kind: "team-project",
+      namespace,
+      readable: false,
+      writable: false,
+      promotable: false,
+      reason: "team-project namespace template resolved to an unsafe namespace"
+    };
+  }
+  const teamReadable = principalListed(team.team.read, principal) || principalListed(team.team.principals, principal);
+  const teamWritable = principalListed(team.team.write, principal);
+  const teamPromotable = principalListed(team.team.promote, principal) || principalListed(team.team.write, principal);
+  const userProjectSuffix = `-${codingOverlay.namespace}`;
+  const userProjectBase = namespace.endsWith(userProjectSuffix) ? namespace.slice(0, -userProjectSuffix.length) : "";
+  const dynamicUserProjectCollision = userProjectBase.length > 0 && (userProjectBase === config.defaultNamespace || userProjectBase === config.sharedNamespace || (config.namespacePolicies ?? []).some((policy) => policy.name === userProjectBase));
+  const protectedNamespace = namespace === config.defaultNamespace || namespace === config.sharedNamespace || dynamicUserProjectCollision || (config.namespacePolicies ?? []).some((policy) => policy.name === namespace);
+  const policyReadable = !protectedNamespace || canReadNamespace(principal, namespace, config);
+  const policyWritable = !protectedNamespace || canWriteNamespace(principal, namespace, config);
+  const policyBlocked = protectedNamespace && (!policyReadable || !policyWritable);
+  return {
+    id,
+    kind: "team-project",
+    namespace,
+    readable: teamReadable && policyReadable,
+    writable: teamWritable && policyWritable,
+    promotable: teamPromotable && policyWritable,
+    reason: policyBlocked ? "team-project namespace collides with a protected namespace policy" : "trusted team-project namespace derived from team and project config"
+  };
+}
+function resolveScopeProfilePlan(options) {
+  const active = activeScopeProfile(options.config);
+  if (!active || !options.config.namespacesEnabled) return null;
+  const baseNamespace = scopeProfileSelfNamespace(options.principal, options.config);
+  const layerIds = Array.from(
+    /* @__PURE__ */ new Set([
+      ...active.profile.readOrder,
+      active.profile.writeDefault,
+      "userGlobal",
+      ...active.profile.promotionTargets.filter(
+        (target) => ["userProject", "teamProject", "userGlobal", "serverShared"].includes(target)
+      )
+    ])
+  );
+  const layerMap = /* @__PURE__ */ new Map();
+  for (const id of layerIds) {
+    layerMap.set(
+      id,
+      resolveLayer({
+        id,
+        config: options.config,
+        profile: active.profile,
+        principal: options.principal,
+        baseNamespace,
+        codingContext: options.codingContext,
+        codingOverlay: options.codingOverlay
+      })
+    );
+  }
+  const readNamespaces = [];
+  for (const id of active.profile.readOrder) {
+    const layer = layerMap.get(id);
+    if (layer?.readable && layer.namespace && !readNamespaces.includes(layer.namespace)) {
+      readNamespaces.push(layer.namespace);
+    }
+  }
+  const preferredWriteLayer = layerMap.get(active.profile.writeDefault);
+  const readableWriteLayers = active.profile.readOrder.map((id) => layerMap.get(id)).filter(
+    (layer) => Boolean(layer?.writable && layer.namespace && readNamespaces.includes(layer.namespace))
+  );
+  const fallbackWriteLayer = preferredWriteLayer?.writable && preferredWriteLayer.namespace && readNamespaces.includes(preferredWriteLayer.namespace) ? preferredWriteLayer : readableWriteLayers[0];
+  const warnings = [];
+  if (!fallbackWriteLayer?.namespace) {
+    warnings.push(`scope profile ${active.profileId} has no writable layer inside the profile read stack; writes disabled`);
+  } else if (fallbackWriteLayer.id !== active.profile.writeDefault) {
+    warnings.push(
+      `scope profile ${active.profileId} writeDefault ${active.profile.writeDefault} unavailable: ${preferredWriteLayer?.reason ?? "not resolved"}`
+    );
+  }
+  const promotionTargets = active.profile.promotionTargets.map((target) => {
+    const layer = layerMap.get(target);
+    if (!layer) {
+      return {
+        target,
+        authorized: false,
+        reason: "promotion target did not resolve to a profile layer"
+      };
+    }
+    return {
+      target,
+      namespace: layer.namespace,
+      authorized: layer.promotable && Boolean(layer.namespace),
+      reason: layer.reason
+    };
+  });
+  return {
+    profileId: active.profileId,
+    profile: active.profile,
+    baseNamespace,
+    writeLayer: fallbackWriteLayer?.id ?? active.profile.writeDefault,
+    writeNamespace: fallbackWriteLayer?.namespace ?? "",
+    readNamespaces,
+    layers: [...layerMap.values()],
+    promotionTargets,
+    warnings
+  };
+}
+function expandScopeProfileReadNamespaces(options) {
+  if (options.profilePlan.readNamespaces.length === 0) {
+    return [];
+  }
+  const out = [...options.profilePlan.readNamespaces];
+  const add = (namespace) => {
+    if (namespace && !out.includes(namespace)) out.push(namespace);
+  };
+  const userProjectReadable = options.profilePlan.profile.readOrder.includes("userProject") && options.profilePlan.layers.some(
+    (layer) => layer.id === "userProject" && layer.readable && layer.namespace
+  );
+  const userGlobalReadable = options.profilePlan.profile.readOrder.includes("userGlobal") && options.profilePlan.layers.some(
+    (layer) => layer.id === "userGlobal" && layer.readable && layer.namespace
+  );
+  if (userProjectReadable) {
+    for (const fallback of options.codingOverlay?.readFallbacks ?? []) {
+      if (fallback === "" && !userGlobalReadable) continue;
+      const fallbackNamespace = combineNamespaces(options.principalSelfNamespace, fallback);
+      if (!hasExplicitNamespacePolicy(fallbackNamespace, options.config) || canReadScopeProfileNamespace(options.principal, fallbackNamespace, options.config)) {
+        add(fallbackNamespace);
+      }
+    }
+  }
+  return out;
+}
+
+// src/procedural/reinforcement-core.ts
+function clusterByKey(items, keyFn) {
+  const clusters = /* @__PURE__ */ new Map();
+  for (const item of items) {
+    const key = keyFn(item);
+    if (typeof key !== "string") {
+      throw new TypeError(
+        `clusterByKey: keyFn must return a string, got ${key === null ? "null" : typeof key}`
+      );
+    }
+    const existing = clusters.get(key);
+    if (existing) {
+      existing.push(item);
+    } else {
+      clusters.set(key, [item]);
+    }
+  }
+  return clusters;
+}
+
+export {
+  clusterByKey,
+  stableHash,
+  normalizeOriginUrl,
+  resolveGitContext,
+  projectNamespaceName,
+  projectTagProjectId,
+  combineNamespaces,
+  branchNamespaceName,
+  resolveCodingNamespaceOverlay,
+  describeCodingScope,
+  lcmSessionKeyForNamespace,
+  lcmReadSessionIdsForNamespaces,
+  resolveScopeProfilePlan,
+  expandScopeProfileReadNamespaces
+};
+//# sourceMappingURL=chunk-GYSYLGNE.js.map