@sponsio/sdk 0.1.0 → 0.2.0-alpha.10

package/dist/core/session-log.js

@@ -52,7 +52,26 @@ const SAFE_AGENT_ID_RE = /[^A-Za-z0-9._:\-]/g;
 function sanitizeAgentId(agentId) {
     if (!agentId)
         return "_unknown";
-    const cleaned = agentId.replace(SAFE_AGENT_ID_RE, "_").replace(/^[._]+|[._]+$/g, "");
+    // Char-loop strip (ReDoS-free): both anchored ``[._]+`` regex forms
+    // still get flagged by CodeQL js/polynomial-redos because the engine
+    // is conservative about ``+$`` patterns even though they're linear.
+    // Equivalent to Python ``str.strip("._")``.
+    const replaced = agentId.replace(SAFE_AGENT_ID_RE, "_");
+    let start = 0;
+    while (start < replaced.length) {
+        const c = replaced.charCodeAt(start);
+        if (c !== 46 /* . */ && c !== 95 /* _ */)
+            break;
+        start++;
+    }
+    let end = replaced.length;
+    while (end > start) {
+        const c = replaced.charCodeAt(end - 1);
+        if (c !== 46 && c !== 95)
+            break;
+        end--;
+    }
+    const cleaned = replaced.slice(start, end);
     if (!cleaned || cleaned === "." || cleaned === "..")
         return "_unknown";
     return cleaned.slice(0, 128);

package/dist/core/session-log.js.map

@@ -1 +1 @@
-{"version":3,"file":"session-log.js","sourceRoot":"","sources":["../../src/core/session-log.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AAEH,OAAO,EACL,cAAc,EACd,UAAU,EACV,SAAS,EACT,WAAW,EACX,QAAQ,EACR,UAAU,GACX,MAAM,SAAS,CAAC;AACjB,OAAO,EAAE,OAAO,EAAE,MAAM,SAAS,CAAC;AAClC,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAEjC;;;;;;;;;;;GAWG;AACH,SAAS,UAAU;IACjB,IAAI,CAAC;QACH,MAAM,CAAC,GAAI,UAA8C,CAAC,OAAO,CAAC;QAClE,OAAO,OAAO,CAAC,EAAE,GAAG,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;IAChD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,CAAC,CAAC;IACX,CAAC;AACH,CAAC;AAED,MAAM,iBAAiB,GAAG,CAAC,CAAC;AAC5B,MAAM,cAAc,GAAG,GAAG,CAAC;AAE3B,qEAAqE;AACrE,mEAAmE;AACnE,iEAAiE;AACjE,MAAM,gBAAgB,GAAG,oBAAoB,CAAC;AAE9C,SAAS,eAAe,CAAC,OAAe;IACtC,IAAI,CAAC,OAAO;QAAE,OAAO,UAAU,CAAC;IAChC,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,gBAAgB,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,gBAAgB,EAAE,EAAE,CAAC,CAAC;IACrF,IAAI,CAAC,OAAO,IAAI,OAAO,KAAK,GAAG,IAAI,OAAO,KAAK,IAAI;QAAE,OAAO,UAAU,CAAC;IACvE,OAAO,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;AAC/B,CAAC;AAED,SAAS,cAAc;IACrB,OAAO,IAAI,CAAC,OAAO,EAAE,EAAE,UAAU,EAAE,UAAU,CAAC,CAAC;AACjD,CAAC;AAED,SAAS,IAAI,CAAC,CAAS;IACrB,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC;AACnC,CAAC;AAED,SAAS,cAAc,CAAC,IAAU,IAAI,IAAI,EAAE;IAC1C,OAAO,CACL,GAAG,CAAC,CAAC,WAAW,EAAE,EAAE;QACpB,GAAG,IAAI,CAAC,CAAC,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAC,EAAE;QAC3B,GAAG,IAAI,CAAC,CAAC,CAAC,OAAO,EAAE,CAAC,EAAE;QACtB,GAAG;QACH,GAAG,IAAI,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC,EAAE;QACvB,GAAG,IAAI,CAAC,CAAC,CAAC,UAAU,EAAE,CAAC,EAAE;QACzB,GAAG,IAAI,CAAC,CAAC,CAAC,UAAU,EAAE,CAAC,EAAE,CAC1B,CAAC;AACJ,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,cAAc,CAC5B,OAAe,EACf,WAAmB,iBAAiB,EACpC,QAAgB,cAAc;IAE9B,MAAM,OAAO,GAAa,EAAE,CAAC;IAC7B,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC;QAAE,OAAO,OAAO,CAAC;IAEzC,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IACvB,MAAM,QAAQ,GAAG,GAAG,GAAG,QAAQ,GAAG,KAAK,GAAG,IAAI,CAAC;IAG/C,MAAM,KAAK,GAAe,EAAE,CAAC;IAE7B,IAAI,SAAS,GAAa,EAAE,CAAC;IAC7B,IAAI,CAAC;QACH,SAAS,GAAG,WAAW,CAAC,OAAO,CAAC,CAAC;IACnC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,OAAO,CAAC;IACjB,CAAC;IAED,KAAK,MAAM,KAAK,IAAI,SAAS,EAAE,CAAC;QAC9B,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;QACjC,IAAI,KAAK,GAAa,EAAE,CAAC;QACzB,IAAI,CAAC;YACH,KAAK,GAAG,WAAW,CAAC,GAAG,CAAC,CAAC;QAC3B,CAAC;QAAC,MAAM,CAAC;YACP,SAAS;QACX,CAAC;QACD,KAAK,MAAM,CAAC,IAAI,KAAK,EAAE,CAAC;YACtB,IAAI,CAAC,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC;gBAAE,SAAS;YACpC,MAAM,CAAC,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC;YACvB,IAAI,EAAE,CAAC;YACP,IAAI,CAAC;gBACH,EAAE,GAAG,QAAQ,CAAC,CAAC,CAAC,CAAC;YACnB,CAAC;YAAC,MAAM,CAAC;gBACP,SAAS;YACX,CAAC;YACD,MAAM,KAAK,GAAG,EAAE,CAAC,OAAO,CAAC;YACzB,IAAI,KAAK,GAAG,QAAQ,EAAE,CAAC;gBACrB,IAAI,CAAC;oBACH,UAAU,CAAC,CAAC,CAAC,CAAC;oBACd,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;gBAClB,CAAC;gBAAC,MAAM,CAAC;oBACP,SAAS;gBACX,CAAC;gBACD,SAAS;YACX,CAAC;YACD,KAAK,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE,EAAE,CAAC,IAAI,EAAE,CAAC,CAAC;QAChD,CAAC;IACH,CAAC;IAED,MAAM,MAAM,GAAG,KAAK,GAAG,IAAI,GAAG,IAAI,CAAC;IACnC,IAAI,KAAK,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,CAAC,EAAE,EAAE,CAAC,GAAG,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC;IACtD,IAAI,KAAK,GAAG,MAAM,EAAE,CAAC;QACnB,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC;QACxC,KAAK,MAAM,CAAC,IAAI,KAAK,EAAE,CAAC;YACtB,IAAI,KAAK,IAAI,MAAM;gBAAE,MAAM;YAC3B,IAAI,CAAC;gBACH,UAAU,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;gBACnB,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;gBACrB,KAAK,IAAI,CAAC,CAAC,IAAI,CAAC;YAClB,CAAC;YAAC,MAAM,CAAC;gBACP,SAAS;YACX,CAAC;QACH,CAAC;IACH,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AA+DD;;;GAGG;AACH,MAAM,OAAO,aAAa;IACf,OAAO,CAAS;IAChB,IAAI,CAAS;IAEtB,YAAY,OAAe,EAAE,UAAgC,EAAE;QAC7D,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC;QACvB,MAAM,IAAI,GAAG,OAAO,CAAC,OAAO,IAAI,cAAc,EAAE,CAAC;QACjD,MAAM,IAAI,GAAG,eAAe,CAAC,OAAO,CAAC,CAAC;QAEtC,IAAI,CAAC;YACH,SAAS,CAAC,IAAI,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QACvC,CAAC;QAAC,MAAM,CAAC;YACP,wDAAwD;QAC1D,CAAC;QAED,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;QAClC,IAAI,CAAC;YACH,SAAS,CAAC,QAAQ,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QAC3C,CAAC;QAAC,MAAM,CAAC;YACP,SAAS;QACX,CAAC;QAED,IAAI,CAAC,OAAO,CAAC,YAAY,EAAE,CAAC;YAC1B,cAAc,CACZ,IAAI,EACJ,OAAO,CAAC,QAAQ,IAAI,iBAAiB,EACrC,OAAO,CAAC,KAAK,IAAI,cAAc,CAChC,CAAC;QACJ,CAAC;QAED,MAAM,KAAK,GAAG,OAAO,CAAC,SAAS,IAAI,cAAc,EAAE,CAAC;QACpD,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC,QAAQ,EAAE,GAAG,KAAK,IAAI,UAAU,EAAE,QAAQ,CAAC,CAAC;IAC/D,CAAC;IAED,GAAG,CAAC,MAAqB;QACvB,IAAI,IAAY,CAAC;QACjB,IAAI,CAAC;YACH,IAAI,GAAG,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC;QAChC,CAAC;QAAC,MAAM,CAAC;YACP,sDAAsD;YACtD,OAAO;QACT,CAAC;QACD,IAAI,CAAC;YACH,cAAc,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,GAAG,IAAI,EAAE,OAAO,CAAC,CAAC;QAClD,CAAC;QAAC,MAAM,CAAC;YACP,0CAA0C;QAC5C,CAAC;IACH,CAAC;CACF"}
+{"version":3,"file":"session-log.js","sourceRoot":"","sources":["../../src/core/session-log.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AAEH,OAAO,EACL,cAAc,EACd,UAAU,EACV,SAAS,EACT,WAAW,EACX,QAAQ,EACR,UAAU,GACX,MAAM,SAAS,CAAC;AACjB,OAAO,EAAE,OAAO,EAAE,MAAM,SAAS,CAAC;AAClC,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAEjC;;;;;;;;;;;GAWG;AACH,SAAS,UAAU;IACjB,IAAI,CAAC;QACH,MAAM,CAAC,GAAI,UAA8C,CAAC,OAAO,CAAC;QAClE,OAAO,OAAO,CAAC,EAAE,GAAG,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;IAChD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,CAAC,CAAC;IACX,CAAC;AACH,CAAC;AAED,MAAM,iBAAiB,GAAG,CAAC,CAAC;AAC5B,MAAM,cAAc,GAAG,GAAG,CAAC;AAE3B,qEAAqE;AACrE,mEAAmE;AACnE,iEAAiE;AACjE,MAAM,gBAAgB,GAAG,oBAAoB,CAAC;AAE9C,SAAS,eAAe,CAAC,OAAe;IACtC,IAAI,CAAC,OAAO;QAAE,OAAO,UAAU,CAAC;IAChC,oEAAoE;IACpE,qEAAqE;IACrE,oEAAoE;IACpE,4CAA4C;IAC5C,MAAM,QAAQ,GAAG,OAAO,CAAC,OAAO,CAAC,gBAAgB,EAAE,GAAG,CAAC,CAAC;IACxD,IAAI,KAAK,GAAG,CAAC,CAAC;IACd,OAAO,KAAK,GAAG,QAAQ,CAAC,MAAM,EAAE,CAAC;QAC/B,MAAM,CAAC,GAAG,QAAQ,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC;QACrC,IAAI,CAAC,KAAK,EAAE,CAAC,OAAO,IAAI,CAAC,KAAK,EAAE,CAAC,OAAO;YAAE,MAAM;QAChD,KAAK,EAAE,CAAC;IACV,CAAC;IACD,IAAI,GAAG,GAAG,QAAQ,CAAC,MAAM,CAAC;IAC1B,OAAO,GAAG,GAAG,KAAK,EAAE,CAAC;QACnB,MAAM,CAAC,GAAG,QAAQ,CAAC,UAAU,CAAC,GAAG,GAAG,CAAC,CAAC,CAAC;QACvC,IAAI,CAAC,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE;YAAE,MAAM;QAChC,GAAG,EAAE,CAAC;IACR,CAAC;IACD,MAAM,OAAO,GAAG,QAAQ,CAAC,KAAK,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;IAC3C,IAAI,CAAC,OAAO,IAAI,OAAO,KAAK,GAAG,IAAI,OAAO,KAAK,IAAI;QAAE,OAAO,UAAU,CAAC;IACvE,OAAO,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;AAC/B,CAAC;AAED,SAAS,cAAc;IACrB,OAAO,IAAI,CAAC,OAAO,EAAE,EAAE,UAAU,EAAE,UAAU,CAAC,CAAC;AACjD,CAAC;AAED,SAAS,IAAI,CAAC,CAAS;IACrB,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC;AACnC,CAAC;AAED,SAAS,cAAc,CAAC,IAAU,IAAI,IAAI,EAAE;IAC1C,OAAO,CACL,GAAG,CAAC,CAAC,WAAW,EAAE,EAAE;QACpB,GAAG,IAAI,CAAC,CAAC,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAC,EAAE;QAC3B,GAAG,IAAI,CAAC,CAAC,CAAC,OAAO,EAAE,CAAC,EAAE;QACtB,GAAG;QACH,GAAG,IAAI,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC,EAAE;QACvB,GAAG,IAAI,CAAC,CAAC,CAAC,UAAU,EAAE,CAAC,EAAE;QACzB,GAAG,IAAI,CAAC,CAAC,CAAC,UAAU,EAAE,CAAC,EAAE,CAC1B,CAAC;AACJ,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,cAAc,CAC5B,OAAe,EACf,WAAmB,iBAAiB,EACpC,QAAgB,cAAc;IAE9B,MAAM,OAAO,GAAa,EAAE,CAAC;IAC7B,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC;QAAE,OAAO,OAAO,CAAC;IAEzC,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IACvB,MAAM,QAAQ,GAAG,GAAG,GAAG,QAAQ,GAAG,KAAK,GAAG,IAAI,CAAC;IAG/C,MAAM,KAAK,GAAe,EAAE,CAAC;IAE7B,IAAI,SAAS,GAAa,EAAE,CAAC;IAC7B,IAAI,CAAC;QACH,SAAS,GAAG,WAAW,CAAC,OAAO,CAAC,CAAC;IACnC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,OAAO,CAAC;IACjB,CAAC;IAED,KAAK,MAAM,KAAK,IAAI,SAAS,EAAE,CAAC;QAC9B,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;QACjC,IAAI,KAAK,GAAa,EAAE,CAAC;QACzB,IAAI,CAAC;YACH,KAAK,GAAG,WAAW,CAAC,GAAG,CAAC,CAAC;QAC3B,CAAC;QAAC,MAAM,CAAC;YACP,SAAS;QACX,CAAC;QACD,KAAK,MAAM,CAAC,IAAI,KAAK,EAAE,CAAC;YACtB,IAAI,CAAC,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC;gBAAE,SAAS;YACpC,MAAM,CAAC,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC;YACvB,IAAI,EAAE,CAAC;YACP,IAAI,CAAC;gBACH,EAAE,GAAG,QAAQ,CAAC,CAAC,CAAC,CAAC;YACnB,CAAC;YAAC,MAAM,CAAC;gBACP,SAAS;YACX,CAAC;YACD,MAAM,KAAK,GAAG,EAAE,CAAC,OAAO,CAAC;YACzB,IAAI,KAAK,GAAG,QAAQ,EAAE,CAAC;gBACrB,IAAI,CAAC;oBACH,UAAU,CAAC,CAAC,CAAC,CAAC;oBACd,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;gBAClB,CAAC;gBAAC,MAAM,CAAC;oBACP,SAAS;gBACX,CAAC;gBACD,SAAS;YACX,CAAC;YACD,KAAK,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE,EAAE,CAAC,IAAI,EAAE,CAAC,CAAC;QAChD,CAAC;IACH,CAAC;IAED,MAAM,MAAM,GAAG,KAAK,GAAG,IAAI,GAAG,IAAI,CAAC;IACnC,IAAI,KAAK,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,CAAC,EAAE,EAAE,CAAC,GAAG,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC;IACtD,IAAI,KAAK,GAAG,MAAM,EAAE,CAAC;QACnB,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC;QACxC,KAAK,MAAM,CAAC,IAAI,KAAK,EAAE,CAAC;YACtB,IAAI,KAAK,IAAI,MAAM;gBAAE,MAAM;YAC3B,IAAI,CAAC;gBACH,UAAU,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;gBACnB,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;gBACrB,KAAK,IAAI,CAAC,CAAC,IAAI,CAAC;YAClB,CAAC;YAAC,MAAM,CAAC;gBACP,SAAS;YACX,CAAC;QACH,CAAC;IACH,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AA+DD;;;GAGG;AACH,MAAM,OAAO,aAAa;IACf,OAAO,CAAS;IAChB,IAAI,CAAS;IAEtB,YAAY,OAAe,EAAE,UAAgC,EAAE;QAC7D,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC;QACvB,MAAM,IAAI,GAAG,OAAO,CAAC,OAAO,IAAI,cAAc,EAAE,CAAC;QACjD,MAAM,IAAI,GAAG,eAAe,CAAC,OAAO,CAAC,CAAC;QAEtC,IAAI,CAAC;YACH,SAAS,CAAC,IAAI,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QACvC,CAAC;QAAC,MAAM,CAAC;YACP,wDAAwD;QAC1D,CAAC;QAED,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;QAClC,IAAI,CAAC;YACH,SAAS,CAAC,QAAQ,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QAC3C,CAAC;QAAC,MAAM,CAAC;YACP,SAAS;QACX,CAAC;QAED,IAAI,CAAC,OAAO,CAAC,YAAY,EAAE,CAAC;YAC1B,cAAc,CACZ,IAAI,EACJ,OAAO,CAAC,QAAQ,IAAI,iBAAiB,EACrC,OAAO,CAAC,KAAK,IAAI,cAAc,CAChC,CAAC;QACJ,CAAC;QAED,MAAM,KAAK,GAAG,OAAO,CAAC,SAAS,IAAI,cAAc,EAAE,CAAC;QACpD,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC,QAAQ,EAAE,GAAG,KAAK,IAAI,UAAU,EAAE,QAAQ,CAAC,CAAC;IAC/D,CAAC;IAED,GAAG,CAAC,MAAqB;QACvB,IAAI,IAAY,CAAC;QACjB,IAAI,CAAC;YACH,IAAI,GAAG,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC;QAChC,CAAC;QAAC,MAAM,CAAC;YACP,sDAAsD;YACtD,OAAO;QACT,CAAC;QACD,IAAI,CAAC;YACH,cAAc,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,GAAG,IAAI,EAAE,OAAO,CAAC,CAAC;QAClD,CAAC;QAAC,MAAM,CAAC;YACP,0CAA0C;QAC5C,CAAC;IACH,CAAC;CACF"}

package/dist/core/sto.d.ts

@@ -1,45 +1,39 @@
 /**
- * OSS↔Cloud schema surface for the sto (stochastic / LLM-judge) pipeline.
+ * Schema surface for the sto (stochastic / LLM-judge) pipeline extension point.
  *
- * The TS SDK is **det-only**, mirroring Sponsio Python's OSS engine.
+ * The TS SDK is **det-only**, mirroring the Python deterministic engine.
  * The managed evaluator catalog (``tone`` / ``relevance`` / ``llm_judge`` /
- * ``hallucination_free`` …), the OpenAI-compatible judge client, and the
- * per-evaluator scoring code are Sponsio Cloud features. They live in
- * the proprietary ``sponsio_cloud.sto.*`` Python package; a Cloud-TS
- * package will mirror them later.
+ * ``hallucination_free`` ...), an OpenAI-compatible judge client, and the
+ * per-evaluator scoring code are not part of this build (the deterministic
+ * engine provides no implementation).
  *
- * What this file ships in OSS:
+ * What this file ships:
  *
- *   - **Type contracts** — ``StoEvaluator`` / ``StoResult`` / ``StoInput`` /
+ *   - **Type contracts**, ``StoEvaluator`` / ``StoResult`` / ``StoInput`` /
  *     ``StoContract`` / ``JudgeClient`` / ``JudgeConfig`` /
- *     ``StoContextSnapshot``. Cloud subclasses / OSS callers consuming the
- *     schema (session loggers, dashboards) reference these.
- *   - ``CloudFeatureError`` — the exception any Cloud-only code path
- *     raises when reached on the OSS engine.
- *   - ``parseScore`` — a pure utility that converts a 0-1 score from a
+ *     ``StoContextSnapshot``. External callers consuming the schema
+ *     (session loggers, dashboards) reference these.
+ *   - ``CloudFeatureError``, the exception any code path raises when an
+ *     unimplemented sto feature is reached. The class name is kept for
+ *     ABI stability, the message is neutral.
+ *   - ``parseScore``, a pure utility that converts a 0-1 score from a
  *     judge response. Kept because it never contacts an LLM.
  *
- * What this file does NOT ship in OSS (deleted alongside the Python
- * mirrors — ``RetryWithConstraint`` / ``RedirectToSafe`` /
- * ``FeedbackGenerator`` / the per-atom evaluator stubs):
+ * What this file does NOT ship (deleted alongside the Python mirrors,
+ * ``RetryWithConstraint`` / ``RedirectToSafe`` / ``FeedbackGenerator`` /
+ * the per-atom evaluator stubs):
  *
- *   - ``createJudge`` — judge construction
+ *   - ``createJudge``, judge construction
  *   - ``LlmJudgeEvaluator`` / ``ToneEvaluator`` / ``RelevanceEvaluator``
  *     / ``SemanticPiiFreeEvaluator`` / ``HallucinationFreeEvaluator``
  *     / ``ScopeRespectEvaluator`` / ``MetricIntegrityEvaluator``
  *     / ``InjectionFreeEvaluator``
  *
  * The Sponsio constructor rejects yaml-declared sto contracts and any
- * ``judge:`` option at config-load time, so OSS callers never reach a
- * code path that would have built one of these. Cloud installs will
- * supply real implementations of the same Protocol surface.
- *
- * Operators who want the sto pipeline:
- *
- *     pip install sponsio[cloud]
- *
- * or contact your Sponsio account team for managed sto access. See
- * ``docs/oss_scope.md`` for the OSS / Cloud boundary.
+ * ``judge:`` option at config-load time, so callers never reach a code
+ * path that would have built one of these. This file is an extension
+ * point: external builds can supply real implementations of the same
+ * Protocol surface.
  */
 export interface StoInput {
     toolName: string;

package/dist/core/sto.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"sto.d.ts","sourceRoot":"","sources":["../../src/core/sto.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA0CG;AAIH,MAAM,WAAW,QAAQ;IACvB,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,EAAE,MAAM,CAAC;IACf,2DAA2D;IAC3D,OAAO,CAAC,EAAE,kBAAkB,CAAC;CAC9B;AAED,MAAM,WAAW,kBAAkB;IACjC,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAED,MAAM,WAAW,SAAS;IACxB,KAAK,EAAE,MAAM,CAAC;IACd,MAAM,EAAE,OAAO,CAAC;IAChB,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,YAAY;IAC3B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,KAAK,EAAE,QAAQ,GAAG,OAAO,CAAC,SAAS,CAAC,CAAC;CAC/C;AAED,MAAM,WAAW,WAAW;IAC1B,QAAQ,CAAC,EAAE,QAAQ,CAAC;IACpB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,YAAY,CAAC,EAAE,OAAO,GAAG,MAAM,GAAG,MAAM,CAAC;CAC1C;AAED,MAAM,WAAW,WAAW;IAC1B,QAAQ,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;CAC3C;AAED,MAAM,WAAW,WAAW;IAC1B,IAAI,EAAE,MAAM,CAAC;IACb,SAAS,EAAE,YAAY,CAAC;CACzB;AAUD,qBAAa,iBAAkB,SAAQ,KAAK;gBAC9B,WAAW,EAAE,MAAM;CAIhC;AAID;;;;GAIG;AACH,wBAAgB,UAAU,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAmB9C"}
+{"version":3,"file":"sto.d.ts","sourceRoot":"","sources":["../../src/core/sto.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAoCG;AAIH,MAAM,WAAW,QAAQ;IACvB,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,EAAE,MAAM,CAAC;IACf,2DAA2D;IAC3D,OAAO,CAAC,EAAE,kBAAkB,CAAC;CAC9B;AAED,MAAM,WAAW,kBAAkB;IACjC,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAED,MAAM,WAAW,SAAS;IACxB,KAAK,EAAE,MAAM,CAAC;IACd,MAAM,EAAE,OAAO,CAAC;IAChB,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,YAAY;IAC3B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,KAAK,EAAE,QAAQ,GAAG,OAAO,CAAC,SAAS,CAAC,CAAC;CAC/C;AAED,MAAM,WAAW,WAAW;IAC1B,QAAQ,CAAC,EAAE,QAAQ,CAAC;IACpB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,YAAY,CAAC,EAAE,OAAO,GAAG,MAAM,GAAG,MAAM,CAAC;CAC1C;AAED,MAAM,WAAW,WAAW;IAC1B,QAAQ,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;CAC3C;AAED,MAAM,WAAW,WAAW;IAC1B,IAAI,EAAE,MAAM,CAAC;IACb,SAAS,EAAE,YAAY,CAAC;CACzB;AAUD,qBAAa,iBAAkB,SAAQ,KAAK;gBAC9B,WAAW,EAAE,MAAM;CAIhC;AAID;;;;GAIG;AACH,wBAAgB,UAAU,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAsB9C"}

package/dist/core/sto.js

@@ -1,54 +1,48 @@
 /**
- * OSS↔Cloud schema surface for the sto (stochastic / LLM-judge) pipeline.
+ * Schema surface for the sto (stochastic / LLM-judge) pipeline extension point.
  *
- * The TS SDK is **det-only**, mirroring Sponsio Python's OSS engine.
+ * The TS SDK is **det-only**, mirroring the Python deterministic engine.
  * The managed evaluator catalog (``tone`` / ``relevance`` / ``llm_judge`` /
- * ``hallucination_free`` …), the OpenAI-compatible judge client, and the
- * per-evaluator scoring code are Sponsio Cloud features. They live in
- * the proprietary ``sponsio_cloud.sto.*`` Python package; a Cloud-TS
- * package will mirror them later.
+ * ``hallucination_free`` ...), an OpenAI-compatible judge client, and the
+ * per-evaluator scoring code are not part of this build (the deterministic
+ * engine provides no implementation).
  *
- * What this file ships in OSS:
+ * What this file ships:
  *
- *   - **Type contracts** — ``StoEvaluator`` / ``StoResult`` / ``StoInput`` /
+ *   - **Type contracts**, ``StoEvaluator`` / ``StoResult`` / ``StoInput`` /
  *     ``StoContract`` / ``JudgeClient`` / ``JudgeConfig`` /
- *     ``StoContextSnapshot``. Cloud subclasses / OSS callers consuming the
- *     schema (session loggers, dashboards) reference these.
- *   - ``CloudFeatureError`` — the exception any Cloud-only code path
- *     raises when reached on the OSS engine.
- *   - ``parseScore`` — a pure utility that converts a 0-1 score from a
+ *     ``StoContextSnapshot``. External callers consuming the schema
+ *     (session loggers, dashboards) reference these.
+ *   - ``CloudFeatureError``, the exception any code path raises when an
+ *     unimplemented sto feature is reached. The class name is kept for
+ *     ABI stability, the message is neutral.
+ *   - ``parseScore``, a pure utility that converts a 0-1 score from a
  *     judge response. Kept because it never contacts an LLM.
  *
- * What this file does NOT ship in OSS (deleted alongside the Python
- * mirrors — ``RetryWithConstraint`` / ``RedirectToSafe`` /
- * ``FeedbackGenerator`` / the per-atom evaluator stubs):
+ * What this file does NOT ship (deleted alongside the Python mirrors,
+ * ``RetryWithConstraint`` / ``RedirectToSafe`` / ``FeedbackGenerator`` /
+ * the per-atom evaluator stubs):
  *
- *   - ``createJudge`` — judge construction
+ *   - ``createJudge``, judge construction
  *   - ``LlmJudgeEvaluator`` / ``ToneEvaluator`` / ``RelevanceEvaluator``
  *     / ``SemanticPiiFreeEvaluator`` / ``HallucinationFreeEvaluator``
  *     / ``ScopeRespectEvaluator`` / ``MetricIntegrityEvaluator``
  *     / ``InjectionFreeEvaluator``
  *
  * The Sponsio constructor rejects yaml-declared sto contracts and any
- * ``judge:`` option at config-load time, so OSS callers never reach a
- * code path that would have built one of these. Cloud installs will
- * supply real implementations of the same Protocol surface.
- *
- * Operators who want the sto pipeline:
- *
- *     pip install sponsio[cloud]
- *
- * or contact your Sponsio account team for managed sto access. See
- * ``docs/oss_scope.md`` for the OSS / Cloud boundary.
+ * ``judge:`` option at config-load time, so callers never reach a code
+ * path that would have built one of these. This file is an extension
+ * point: external builds can supply real implementations of the same
+ * Protocol surface.
  */
 // ----- CloudFeatureError ---------------------------------------------
-const CLOUD_HINT = "Sponsio's sto (LLM-judge) pipeline is a Cloud feature, not bundled " +
-    "with the OSS engine. Install `sponsio[cloud]` (Python) or contact " +
-    "your Sponsio account team for managed sto access. See " +
-    "https://github.com/SponsioLabs/Sponsio/blob/main/docs/oss_scope.md.";
+const CLOUD_HINT = "Sponsio's sto (LLM-judge) pipeline is not supported in this build " +
+    "(the engine is deterministic-only). The schema types remain as an " +
+    "extension point so external implementations can supply real " +
+    "evaluators behind the same Protocol surface.";
 export class CloudFeatureError extends Error {
     constructor(featureName) {
-        super(`[sponsio] ${featureName} is not available in OSS. ${CLOUD_HINT}`);
+        super(`[sponsio] ${featureName} is not supported in this build. ${CLOUD_HINT}`);
         this.name = "CloudFeatureError";
     }
 }
@@ -70,7 +64,10 @@ export function parseScore(raw) {
             /* fall through */
         }
     }
-    const m = trimmed.match(/([01](?:\.\d+)?|0?\.\d+)/);
+    // Anchored + non-overlapping alternatives: prevents the polynomial
+    // backtracking CodeQL flags when ``[01](?:\.\d+)?`` and ``0?\.\d+``
+    // could both match prefixes like ``0`` or ``0.5``.
+    const m = trimmed.match(/^([01](?:\.\d+)?|\.\d+)/);
     if (!m) {
         throw new Error(`unparseable score: ${JSON.stringify(trimmed.slice(0, 80))}`);
     }

package/dist/core/sto.js.map

@@ -1 +1 @@
-{"version":3,"file":"sto.js","sourceRoot":"","sources":["../../src/core/sto.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA0CG;AAgDH,wEAAwE;AAExE,MAAM,UAAU,GACd,qEAAqE;IACrE,oEAAoE;IACpE,wDAAwD;IACxD,qEAAqE,CAAC;AAExE,MAAM,OAAO,iBAAkB,SAAQ,KAAK;IAC1C,YAAY,WAAmB;QAC7B,KAAK,CAAC,aAAa,WAAW,6BAA6B,UAAU,EAAE,CAAC,CAAC;QACzE,IAAI,CAAC,IAAI,GAAG,mBAAmB,CAAC;IAClC,CAAC;CACF;AAED,wEAAwE;AAExE;;;;GAIG;AACH,MAAM,UAAU,UAAU,CAAC,GAAW;IACpC,MAAM,OAAO,GAAG,GAAG,CAAC,IAAI,EAAE,CAAC;IAC3B,IAAI,OAAO,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;QAC5B,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAwB,CAAC;YACvD,IAAI,OAAO,GAAG,CAAC,KAAK,KAAK,QAAQ;gBAAE,OAAO,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;QAC/D,CAAC;QAAC,MAAM,CAAC;YACP,kBAAkB;QACpB,CAAC;IACH,CAAC;IACD,MAAM,CAAC,GAAG,OAAO,CAAC,KAAK,CAAC,0BAA0B,CAAC,CAAC;IACpD,IAAI,CAAC,CAAC,EAAE,CAAC;QACP,MAAM,IAAI,KAAK,CACb,sBAAsB,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,CAC7D,CAAC;IACJ,CAAC;IACD,MAAM,CAAC,GAAG,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IAC3B,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,qBAAqB,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;IACtE,OAAO,OAAO,CAAC,CAAC,CAAC,CAAC;AACpB,CAAC;AAED,SAAS,OAAO,CAAC,CAAS;IACxB,IAAI,CAAC,GAAG,CAAC;QAAE,OAAO,CAAC,CAAC;IACpB,IAAI,CAAC,GAAG,CAAC;QAAE,OAAO,CAAC,CAAC;IACpB,OAAO,CAAC,CAAC;AACX,CAAC"}
+{"version":3,"file":"sto.js","sourceRoot":"","sources":["../../src/core/sto.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAoCG;AAgDH,wEAAwE;AAExE,MAAM,UAAU,GACd,oEAAoE;IACpE,oEAAoE;IACpE,8DAA8D;IAC9D,8CAA8C,CAAC;AAEjD,MAAM,OAAO,iBAAkB,SAAQ,KAAK;IAC1C,YAAY,WAAmB;QAC7B,KAAK,CAAC,aAAa,WAAW,oCAAoC,UAAU,EAAE,CAAC,CAAC;QAChF,IAAI,CAAC,IAAI,GAAG,mBAAmB,CAAC;IAClC,CAAC;CACF;AAED,wEAAwE;AAExE;;;;GAIG;AACH,MAAM,UAAU,UAAU,CAAC,GAAW;IACpC,MAAM,OAAO,GAAG,GAAG,CAAC,IAAI,EAAE,CAAC;IAC3B,IAAI,OAAO,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;QAC5B,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAwB,CAAC;YACvD,IAAI,OAAO,GAAG,CAAC,KAAK,KAAK,QAAQ;gBAAE,OAAO,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;QAC/D,CAAC;QAAC,MAAM,CAAC;YACP,kBAAkB;QACpB,CAAC;IACH,CAAC;IACD,mEAAmE;IACnE,oEAAoE;IACpE,mDAAmD;IACnD,MAAM,CAAC,GAAG,OAAO,CAAC,KAAK,CAAC,yBAAyB,CAAC,CAAC;IACnD,IAAI,CAAC,CAAC,EAAE,CAAC;QACP,MAAM,IAAI,KAAK,CACb,sBAAsB,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,CAC7D,CAAC;IACJ,CAAC;IACD,MAAM,CAAC,GAAG,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IAC3B,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,qBAAqB,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;IACtE,OAAO,OAAO,CAAC,CAAC,CAAC,CAAC;AACpB,CAAC;AAED,SAAS,OAAO,CAAC,CAAS;IACxB,IAAI,CAAC,GAAG,CAAC;QAAE,OAAO,CAAC,CAAC;IACpB,IAAI,CAAC,GAAG,CAAC;QAAE,OAAO,CAAC,CAAC;IACpB,OAAO,CAAC,CAAC;AACX,CAAC"}

package/dist/core/tool-names.d.ts

@@ -0,0 +1,59 @@
+/**
+ * One canonical spelling for a tool name, shared by contracts and grounding.
+ *
+ * Port of sponsio/formulas/tool_names.py.
+ *
+ * Predicate keys are map keys: ``called(issue_refund)`` and
+ * ``called(Issue_Refund)`` are different entries, and a contract looks up
+ * the spelling its author typed. So a rule written against ``issue_refund``
+ * was silently inert against an event whose tool arrived as
+ * ``Issue_Refund``, as ``"issue_refund "`` with a stray space, or as
+ * ``mcp__finance__issue_refund`` (our own documented MCP wire format).
+ * ``mustPrecede`` compiles to ``Or(order-holds, never-called)``, so a name
+ * that never matches makes the second disjunct true and the contract
+ * reports satisfied while the guarded action runs unchecked.
+ *
+ * Two functions, used on opposite sides of the same join:
+ *
+ * - {@link canonicalTool}: what a *contract* keys on. Contracts are
+ *   authored once, so they collapse to a single canonical spelling.
+ * - {@link toolAliases}: what an *event* answers to. A tool call is a fact
+ *   and cannot be rewritten, so it is grounded under every spelling a
+ *   contract might reasonably have used, canonical form included.
+ *
+ * Widening only ever makes more contracts apply to a given call, never
+ * fewer.
+ */
+/**
+ * Claude Code / MCP wire format: ``mcp__<server>__<tool>``, prefix in any
+ * case (``MCP__finance__x`` is the same call). The server segment has no
+ * ``__`` of its own; the tool segment may, so the split is on the FIRST
+ * ``__`` after the prefix. ``[^\n]`` rather than ``.`` because
+ * Python's ``.`` excludes only ``\n`` while JavaScript's also excludes
+ * ``\r`` and U+2028/2029.
+ */
+export declare const MCP_TOOL_RE: RegExp;
+/**
+ * OpenClaw's MCP wire format: ``<server>__<tool>`` with no ``mcp__``
+ * prefix. Same split; consulted only when {@link MCP_TOOL_RE} did not
+ * match, so the ``mcp`` of a prefixed name is never read as a server.
+ */
+export declare const SERVER_TOOL_RE: RegExp;
+/**
+ * The single spelling a contract keys on.
+ *
+ * Strips surrounding whitespace and case-folds. The MCP prefix is *not*
+ * stripped here: a contract that deliberately names
+ * ``mcp__finance__issue_refund`` means that server's tool and should not
+ * widen to every tool of that name. Grounding supplies the bare-name
+ * alias so the reverse direction still joins.
+ */
+export declare function canonicalTool(tool: string): string;
+/**
+ * Every spelling an event's tool call should answer to.
+ *
+ * Ordered, duplicate-free, and always contains the raw name first so
+ * existing traces and predicate keys keep working unchanged.
+ */
+export declare function toolAliases(tool: string): string[];
+//# sourceMappingURL=tool-names.d.ts.map

package/dist/core/tool-names.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"tool-names.d.ts","sourceRoot":"","sources":["../../src/core/tool-names.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AAEH;;;;;;;GAOG;AACH,eAAO,MAAM,WAAW,QAAyC,CAAC;AAElE;;;;GAIG;AACH,eAAO,MAAM,cAAc,QAAmC,CAAC;AA4D/D;;;;;;;;GAQG;AACH,wBAAgB,aAAa,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAElD;AAED;;;;;GAKG;AACH,wBAAgB,WAAW,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,EAAE,CAQlD"}

package/dist/core/tool-names.js

@@ -0,0 +1,128 @@
+/**
+ * One canonical spelling for a tool name, shared by contracts and grounding.
+ *
+ * Port of sponsio/formulas/tool_names.py.
+ *
+ * Predicate keys are map keys: ``called(issue_refund)`` and
+ * ``called(Issue_Refund)`` are different entries, and a contract looks up
+ * the spelling its author typed. So a rule written against ``issue_refund``
+ * was silently inert against an event whose tool arrived as
+ * ``Issue_Refund``, as ``"issue_refund "`` with a stray space, or as
+ * ``mcp__finance__issue_refund`` (our own documented MCP wire format).
+ * ``mustPrecede`` compiles to ``Or(order-holds, never-called)``, so a name
+ * that never matches makes the second disjunct true and the contract
+ * reports satisfied while the guarded action runs unchecked.
+ *
+ * Two functions, used on opposite sides of the same join:
+ *
+ * - {@link canonicalTool}: what a *contract* keys on. Contracts are
+ *   authored once, so they collapse to a single canonical spelling.
+ * - {@link toolAliases}: what an *event* answers to. A tool call is a fact
+ *   and cannot be rewritten, so it is grounded under every spelling a
+ *   contract might reasonably have used, canonical form included.
+ *
+ * Widening only ever makes more contracts apply to a given call, never
+ * fewer.
+ */
+/**
+ * Claude Code / MCP wire format: ``mcp__<server>__<tool>``, prefix in any
+ * case (``MCP__finance__x`` is the same call). The server segment has no
+ * ``__`` of its own; the tool segment may, so the split is on the FIRST
+ * ``__`` after the prefix. ``[^\n]`` rather than ``.`` because
+ * Python's ``.`` excludes only ``\n`` while JavaScript's also excludes
+ * ``\r`` and U+2028/2029.
+ */
+export const MCP_TOOL_RE = /^mcp__([^_]+(?:_[^_]+)*)__([^\n]+)$/i;
+/**
+ * OpenClaw's MCP wire format: ``<server>__<tool>`` with no ``mcp__``
+ * prefix. Same split; consulted only when {@link MCP_TOOL_RE} did not
+ * match, so the ``mcp`` of a prefixed name is never read as a server.
+ */
+export const SERVER_TOOL_RE = /^([^_]+(?:_[^_]+)*)__([^\n]+)$/;
+/**
+ * Python ``str.strip()`` whitespace (``str.isspace``). Differs from
+ * ``String.prototype.trim`` on U+001C-001F and U+0085 (Python strips,
+ * JavaScript keeps) and U+FEFF (JavaScript strips, Python keeps).
+ */
+const PY_WS = "\\t\\n\\v\\f\\r\\x1c-\\x20\\x85\\xa0\\u1680\\u2000-\\u200a\\u2028\\u2029\\u202f\\u205f\\u3000";
+const PY_STRIP_RE = new RegExp(`^[${PY_WS}]+|[${PY_WS}]+$`, "g");
+function pyStrip(s) {
+    return s.replace(PY_STRIP_RE, "");
+}
+/**
+ * Python ``str.casefold()``, per code point.
+ *
+ * Lower-casing alone misses the full case folds (``ß`` -> ``ss``,
+ * ``ſ`` -> ``s``, final sigma -> ``σ``, ``µ`` -> ``μ``); folding through
+ * the upper case catches those. Two families need explicit handling:
+ * dotless ``ı`` has no fold in Python but upper-cases to ``I``, and
+ * Unicode folds lower-case Cherokee *to* the upper-case letters. Code
+ * points added in a Unicode version one runtime knows and the other does
+ * not can still differ; tool names are ASCII in practice.
+ */
+function pyCasefold(s) {
+    let out = "";
+    for (const ch of s) {
+        const cp = ch.codePointAt(0);
+        if (cp < 0x80) {
+            out += ch.toLowerCase();
+        }
+        else if (cp === 0x131) {
+            out += ch;
+        }
+        else if (cp >= 0xab70 && cp <= 0xabbf) {
+            out += String.fromCodePoint(cp - 0xab70 + 0x13a0);
+        }
+        else if (cp >= 0x13f8 && cp <= 0x13fd) {
+            out += String.fromCodePoint(cp - 8);
+        }
+        else if (cp >= 0x13a0 && cp <= 0x13f5) {
+            out += ch;
+        }
+        else {
+            const lower = ch.toLowerCase();
+            const upper = lower.toUpperCase();
+            out += upper !== lower ? upper.toLowerCase() : lower;
+        }
+    }
+    return out;
+}
+/** ``mcp__finance__issue_refund`` -> ``issue_refund``; else ``null``. */
+function stripMcp(name) {
+    const m = MCP_TOOL_RE.exec(name);
+    return m ? m[2] : null;
+}
+/** ``finance__issue_refund`` -> ``issue_refund``; else ``null``. */
+function stripServer(name) {
+    const m = SERVER_TOOL_RE.exec(name);
+    return m ? m[2] : null;
+}
+/**
+ * The single spelling a contract keys on.
+ *
+ * Strips surrounding whitespace and case-folds. The MCP prefix is *not*
+ * stripped here: a contract that deliberately names
+ * ``mcp__finance__issue_refund`` means that server's tool and should not
+ * widen to every tool of that name. Grounding supplies the bare-name
+ * alias so the reverse direction still joins.
+ */
+export function canonicalTool(tool) {
+    return pyCasefold(pyStrip(String(tool)));
+}
+/**
+ * Every spelling an event's tool call should answer to.
+ *
+ * Ordered, duplicate-free, and always contains the raw name first so
+ * existing traces and predicate keys keep working unchanged.
+ */
+export function toolAliases(tool) {
+    const raw = String(tool);
+    const out = [raw];
+    const stripped = pyStrip(raw);
+    out.push(stripped, pyCasefold(stripped));
+    const bare = stripMcp(stripped) ?? stripServer(stripped);
+    if (bare)
+        out.push(bare, pyCasefold(bare));
+    return [...new Set(out)].filter((k) => k);
+}
+//# sourceMappingURL=tool-names.js.map

package/dist/core/tool-names.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"tool-names.js","sourceRoot":"","sources":["../../src/core/tool-names.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AAEH;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,WAAW,GAAG,sCAAsC,CAAC;AAElE;;;;GAIG;AACH,MAAM,CAAC,MAAM,cAAc,GAAG,gCAAgC,CAAC;AAE/D;;;;GAIG;AACH,MAAM,KAAK,GAAG,+FAA+F,CAAC;AAC9G,MAAM,WAAW,GAAG,IAAI,MAAM,CAAC,KAAK,KAAK,OAAO,KAAK,KAAK,EAAE,GAAG,CAAC,CAAC;AAEjE,SAAS,OAAO,CAAC,CAAS;IACxB,OAAO,CAAC,CAAC,OAAO,CAAC,WAAW,EAAE,EAAE,CAAC,CAAC;AACpC,CAAC;AAED;;;;;;;;;;GAUG;AACH,SAAS,UAAU,CAAC,CAAS;IAC3B,IAAI,GAAG,GAAG,EAAE,CAAC;IACb,KAAK,MAAM,EAAE,IAAI,CAAC,EAAE,CAAC;QACnB,MAAM,EAAE,GAAG,EAAE,CAAC,WAAW,CAAC,CAAC,CAAW,CAAC;QACvC,IAAI,EAAE,GAAG,IAAI,EAAE,CAAC;YACd,GAAG,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;QAC1B,CAAC;aAAM,IAAI,EAAE,KAAK,KAAK,EAAE,CAAC;YACxB,GAAG,IAAI,EAAE,CAAC;QACZ,CAAC;aAAM,IAAI,EAAE,IAAI,MAAM,IAAI,EAAE,IAAI,MAAM,EAAE,CAAC;YACxC,GAAG,IAAI,MAAM,CAAC,aAAa,CAAC,EAAE,GAAG,MAAM,GAAG,MAAM,CAAC,CAAC;QACpD,CAAC;aAAM,IAAI,EAAE,IAAI,MAAM,IAAI,EAAE,IAAI,MAAM,EAAE,CAAC;YACxC,GAAG,IAAI,MAAM,CAAC,aAAa,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC;QACtC,CAAC;aAAM,IAAI,EAAE,IAAI,MAAM,IAAI,EAAE,IAAI,MAAM,EAAE,CAAC;YACxC,GAAG,IAAI,EAAE,CAAC;QACZ,CAAC;aAAM,CAAC;YACN,MAAM,KAAK,GAAG,EAAE,CAAC,WAAW,EAAE,CAAC;YAC/B,MAAM,KAAK,GAAG,KAAK,CAAC,WAAW,EAAE,CAAC;YAClC,GAAG,IAAI,KAAK,KAAK,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC;QACvD,CAAC;IACH,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,yEAAyE;AACzE,SAAS,QAAQ,CAAC,IAAY;IAC5B,MAAM,CAAC,GAAG,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACjC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;AACzB,CAAC;AAED,oEAAoE;AACpE,SAAS,WAAW,CAAC,IAAY;IAC/B,MAAM,CAAC,GAAG,cAAc,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACpC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;AACzB,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,aAAa,CAAC,IAAY;IACxC,OAAO,UAAU,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AAC3C,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,WAAW,CAAC,IAAY;IACtC,MAAM,GAAG,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC;IACzB,MAAM,GAAG,GAAG,CAAC,GAAG,CAAC,CAAC;IAClB,MAAM,QAAQ,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC;IAC9B,GAAG,CAAC,IAAI,CAAC,QAAQ,EAAE,UAAU,CAAC,QAAQ,CAAC,CAAC,CAAC;IACzC,MAAM,IAAI,GAAG,QAAQ,CAAC,QAAQ,CAAC,IAAI,WAAW,CAAC,QAAQ,CAAC,CAAC;IACzD,IAAI,IAAI;QAAE,GAAG,CAAC,IAAI,CAAC,IAAI,EAAE,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC;IAC3C,OAAO,CAAC,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC;AAC5C,CAAC"}