@stackmemoryai/stackmemory 0.5.59 → 0.5.62

package/dist/src/core/extensions/sandbox-runtime.js.map

@@ -0,0 +1,7 @@
+{
+  "version": 3,
+  "sources": ["../../../../src/core/extensions/sandbox-runtime.ts"],
+  "sourcesContent": ["/**\n * Browser Sandbox Extension Runtime\n *\n * Provides isolated execution environment for extensions using iframe/worker isolation.\n * Exposes controlled Web APIs (fetch, DOM, storage) with permission-based access.\n * Supports hot-reload for extension updates without restart.\n */\n\nimport { z } from 'zod';\nimport { EventEmitter } from 'events';\nimport { ValidationError, ErrorCode, SystemError } from '../errors/index.js';\nimport { logger } from '../monitoring/logger.js';\n\n// ============================================================================\n// Permission System Types\n// ============================================================================\n\n/**\n * Permission types for extension capabilities\n */\nexport type PermissionType =\n  | 'network' // Network access with domain allowlist\n  | 'storage:local' // Local storage access\n  | 'storage:indexed' // IndexedDB access\n  | 'frames:read' // Read frame data\n  | 'frames:write' // Write frame data\n  | 'events:emit' // Emit events to other extensions\n  | 'events:subscribe' // Subscribe to events\n  | 'dom:read' // Read DOM elements (sandbox only)\n  | 'dom:write'; // Write DOM elements (sandbox only)\n\n/**\n * Network permission with domain specification\n */\nexport interface NetworkPermission {\n  type: 'network';\n  domains: string[]; // Allowlisted domains (e.g., ['api.linear.app', '*.github.com'])\n}\n\n/**\n * Storage permission\n */\nexport interface StoragePermission {\n  type: 'storage:local' | 'storage:indexed';\n  quotaBytes?: number; // Optional storage quota\n}\n\n/**\n * Frame access permission\n */\nexport interface FramePermission {\n  type: 'frames:read' | 'frames:write';\n  scope?: 'own' | 'all'; // 'own' = only extension's frames, 'all' = all frames\n}\n\n/**\n * Event permission\n */\nexport interface EventPermission {\n  type: 'events:emit' | 'events:subscribe';\n  patterns?: string[]; // Event name patterns (glob-style)\n}\n\n/**\n * DOM permission (sandbox only)\n */\nexport interface DomPermission {\n  type: 'dom:read' | 'dom:write';\n}\n\nexport type Permission =\n  | NetworkPermission\n  | StoragePermission\n  | FramePermission\n  | EventPermission\n  | DomPermission;\n\n/**\n * Permission manifest for an extension\n */\nexport interface PermissionManifest {\n  name: string;\n  version: string;\n  permissions: Permission[];\n  description?: string;\n  author?: string;\n  homepage?: string;\n}\n\n// ============================================================================\n// Extension Interface Types\n// ============================================================================\n\n/**\n * Tool definition for extension-provided tools\n */\nexport interface ToolDefinition {\n  name: string;\n  description: string;\n  parameters: Record<string, unknown>; // JSON Schema\n  execute: (params: unknown, context: ExtensionContext) => Promise<ToolResult>;\n}\n\n/**\n * Tool execution result\n */\nexport interface ToolResult {\n  success: boolean;\n  data?: unknown;\n  error?: string;\n}\n\n/**\n * Hook definition for lifecycle events\n */\nexport interface HookDefinition {\n  event: string;\n  handler: (data: unknown, context: ExtensionContext) => Promise<void>;\n  priority?: number;\n}\n\n/**\n * Provider adapter for LLM integrations\n */\nexport interface ProviderAdapter {\n  id: string;\n  name: string;\n\n  // Core streaming interface\n  stream(\n    messages: Message[],\n    options: StreamOptions\n  ): AsyncIterable<StreamEvent>;\n\n  // Provider-specific extensions (opt-in)\n  extensions?: {\n    extendedThinking?: boolean; // Claude\n    codeInterpreter?: boolean; // OpenAI\n    grounding?: boolean; // Gemini\n  };\n}\n\n/**\n * Message format for provider communication\n */\nexport interface Message {\n  role: 'user' | 'assistant' | 'system';\n  content: string;\n  metadata?: Record<string, unknown>;\n}\n\n/**\n * Stream options for provider calls\n */\nexport interface StreamOptions {\n  maxTokens?: number;\n  temperature?: number;\n  stopSequences?: string[];\n  tools?: ToolDefinition[];\n}\n\n/**\n * Stream event types\n */\nexport type StreamEvent =\n  | { type: 'text'; content: string }\n  | { type: 'tool_call'; name: string; arguments: unknown }\n  | { type: 'error'; error: string }\n  | { type: 'done' };\n\n/**\n * Event handler type\n */\nexport type EventHandler = (data: unknown) => void | Promise<void>;\n\n/**\n * Frame manager interface exposed to extensions\n */\nexport interface FrameManagerAPI {\n  getCurrentFrame(): Promise<FrameData | null>;\n  getFrame(frameId: string): Promise<FrameData | null>;\n  listFrames(filter?: FrameFilter): Promise<FrameData[]>;\n  createFrame?(options: FrameCreateOptions): Promise<FrameData>;\n  closeFrame?(frameId: string): Promise<void>;\n}\n\n/**\n * Frame data exposed to extensions\n */\nexport interface FrameData {\n  frameId: string;\n  name: string;\n  type: string;\n  state: string;\n  parentFrameId?: string;\n  createdAt: number;\n  closedAt?: number;\n  metadata?: Record<string, unknown>;\n}\n\n/**\n * Frame filter options\n */\nexport interface FrameFilter {\n  type?: string;\n  state?: 'active' | 'closed';\n  parentFrameId?: string;\n  limit?: number;\n}\n\n/**\n * Frame creation options\n */\nexport interface FrameCreateOptions {\n  name: string;\n  type: string;\n  parentFrameId?: string;\n  metadata?: Record<string, unknown>;\n}\n\n/**\n * State serializer interface exposed to extensions\n */\nexport interface StateSerializerAPI {\n  // Structured data (JSON) - surgical updates\n  get<T>(key: string): Promise<T | null>;\n  set<T>(key: string, value: T): Promise<void>;\n  delete(key: string): Promise<boolean>;\n\n  // Unstructured data (Markdown) - full load\n  getDocument(key: string): Promise<string | null>;\n  setDocument(key: string, content: string): Promise<void>;\n  deleteDocument(key: string): Promise<boolean>;\n}\n\n/**\n * Storage API exposed to extensions (localStorage-like)\n */\nexport interface StorageAPI {\n  getItem(key: string): string | null;\n  setItem(key: string, value: string): void;\n  removeItem(key: string): void;\n  clear(): void;\n  key(index: number): string | null;\n  readonly length: number;\n}\n\n/**\n * Context provided to extension during execution\n */\nexport interface ExtensionContext {\n  // Extension metadata\n  extensionId: string;\n  extensionName: string;\n  permissions: Permission[];\n\n  // Core APIs\n  frames: FrameManagerAPI;\n  state: StateSerializerAPI;\n\n  // Web APIs (sandboxed)\n  fetch: typeof globalThis.fetch;\n  storage: StorageAPI;\n\n  // Communication\n  emit(event: string, data: unknown): void;\n  on(event: string, handler: EventHandler): () => void;\n  off(event: string, handler: EventHandler): void;\n}\n\n/**\n * Extension interface that extensions must implement\n */\nexport interface Extension {\n  name: string;\n  version: string;\n  manifest: PermissionManifest;\n\n  // Lifecycle\n  init(context: ExtensionContext): Promise<void>;\n  destroy(): Promise<void>;\n\n  // Capabilities (optional)\n  tools?: ToolDefinition[];\n  providers?: ProviderAdapter[];\n  hooks?: HookDefinition[];\n}\n\n// ============================================================================\n// Sandbox Configuration\n// ============================================================================\n\n/**\n * Sandbox isolation mode\n */\nexport type SandboxMode =\n  | 'iframe' // Browser iframe isolation (full Web API access)\n  | 'worker' // Web Worker isolation (limited API access, better for compute)\n  | 'node'; // Node.js vm context (server-side only)\n\n/**\n * Sandbox runtime configuration\n */\nexport interface SandboxConfig {\n  mode: SandboxMode;\n  timeout: number; // Execution timeout in ms\n  memoryLimit?: number; // Memory limit in bytes (where supported)\n  networkAllowlist?: string[]; // Global network allowlist\n  enableDevtools?: boolean; // Enable debugging capabilities\n}\n\n/**\n * Extension load source\n */\nexport type ExtensionSource =\n  | { type: 'url'; url: string } // From URL (web-backed)\n  | { type: 'file'; path: string } // From local file (development)\n  | { type: 'npm'; package: string; version?: string } // From npm package\n  | { type: 'inline'; code: string; manifest: PermissionManifest }; // Inline code\n\n// ============================================================================\n// Sandbox Runtime Implementation\n// ============================================================================\n\n/**\n * Extension registration state\n */\ninterface ExtensionState {\n  extension: Extension;\n  context: ExtensionContext;\n  status: 'loading' | 'active' | 'error' | 'unloaded';\n  error?: Error;\n  loadedAt: number;\n  source: ExtensionSource;\n}\n\n/**\n * Zod schemas for validation\n */\nconst PermissionManifestSchema = z.object({\n  name: z.string().min(1).max(100),\n  version: z.string().regex(/^\\d+\\.\\d+\\.\\d+$/),\n  permissions: z.array(\n    z.discriminatedUnion('type', [\n      z.object({\n        type: z.literal('network'),\n        domains: z.array(z.string().min(1)),\n      }),\n      z.object({\n        type: z.literal('storage:local'),\n        quotaBytes: z.number().positive().optional(),\n      }),\n      z.object({\n        type: z.literal('storage:indexed'),\n        quotaBytes: z.number().positive().optional(),\n      }),\n      z.object({\n        type: z.literal('frames:read'),\n        scope: z.enum(['own', 'all']).optional(),\n      }),\n      z.object({\n        type: z.literal('frames:write'),\n        scope: z.enum(['own', 'all']).optional(),\n      }),\n      z.object({\n        type: z.literal('events:emit'),\n        patterns: z.array(z.string()).optional(),\n      }),\n      z.object({\n        type: z.literal('events:subscribe'),\n        patterns: z.array(z.string()).optional(),\n      }),\n      z.object({ type: z.literal('dom:read') }),\n      z.object({ type: z.literal('dom:write') }),\n    ])\n  ),\n  description: z.string().max(1000).optional(),\n  author: z.string().max(200).optional(),\n  homepage: z.string().url().optional(),\n});\n\n/**\n * Browser Sandbox Runtime\n *\n * Manages extension lifecycle, isolation, and API exposure.\n */\nexport class SandboxRuntime {\n  private extensions = new Map<string, ExtensionState>();\n  private eventBus = new EventEmitter();\n  private config: SandboxConfig;\n  private frameManager?: FrameManagerAPI;\n  private stateSerializer?: StateSerializerAPI;\n\n  constructor(config: Partial<SandboxConfig> = {}) {\n    this.config = {\n      mode: config.mode ?? 'node',\n      timeout: config.timeout ?? 30000,\n      memoryLimit: config.memoryLimit,\n      networkAllowlist: config.networkAllowlist ?? [],\n      enableDevtools: config.enableDevtools ?? false,\n    };\n\n    logger.info('SandboxRuntime initialized', {\n      mode: this.config.mode,\n      timeout: this.config.timeout,\n    });\n  }\n\n  /**\n   * Set the frame manager API for extensions\n   */\n  setFrameManager(frameManager: FrameManagerAPI): void {\n    this.frameManager = frameManager;\n  }\n\n  /**\n   * Set the state serializer API for extensions\n   */\n  setStateSerializer(stateSerializer: StateSerializerAPI): void {\n    this.stateSerializer = stateSerializer;\n  }\n\n  /**\n   * Load an extension from a source\n   */\n  async loadExtension(source: ExtensionSource): Promise<string> {\n    logger.info('Loading extension', { source });\n\n    const extension = await this.resolveExtension(source);\n    const manifest = extension.manifest;\n\n    // Validate manifest\n    this.validateManifest(manifest);\n\n    // Check for existing extension\n    if (this.extensions.has(manifest.name)) {\n      throw new ValidationError(\n        `Extension \"${manifest.name}\" is already loaded`,\n        ErrorCode.VALIDATION_FAILED,\n        { extensionName: manifest.name }\n      );\n    }\n\n    // Create isolated context\n    const context = this.createExtensionContext(manifest);\n\n    // Register extension state\n    const state: ExtensionState = {\n      extension,\n      context,\n      status: 'loading',\n      loadedAt: Date.now(),\n      source,\n    };\n    this.extensions.set(manifest.name, state);\n\n    try {\n      // Initialize extension with timeout\n      await this.withTimeout(\n        extension.init(context),\n        this.config.timeout,\n        `Extension \"${manifest.name}\" initialization timed out`\n      );\n\n      state.status = 'active';\n      logger.info('Extension loaded successfully', {\n        name: manifest.name,\n        version: manifest.version,\n      });\n\n      return manifest.name;\n    } catch (error) {\n      state.status = 'error';\n      state.error = error instanceof Error ? error : new Error(String(error));\n      logger.error('Extension initialization failed', {\n        name: manifest.name,\n        error: state.error.message,\n      });\n      throw error;\n    }\n  }\n\n  /**\n   * Unload an extension\n   */\n  async unloadExtension(extensionName: string): Promise<void> {\n    const state = this.extensions.get(extensionName);\n    if (!state) {\n      throw new ValidationError(\n        `Extension \"${extensionName}\" not found`,\n        ErrorCode.RESOURCE_NOT_FOUND,\n        { extensionName }\n      );\n    }\n\n    try {\n      await this.withTimeout(\n        state.extension.destroy(),\n        this.config.timeout,\n        `Extension \"${extensionName}\" destruction timed out`\n      );\n    } catch (error) {\n      logger.warn('Extension destruction failed', {\n        name: extensionName,\n        error: error instanceof Error ? error.message : String(error),\n      });\n    }\n\n    state.status = 'unloaded';\n    this.extensions.delete(extensionName);\n    logger.info('Extension unloaded', { name: extensionName });\n  }\n\n  /**\n   * Hot-reload an extension (unload and reload)\n   */\n  async reloadExtension(extensionName: string): Promise<void> {\n    const state = this.extensions.get(extensionName);\n    if (!state) {\n      throw new ValidationError(\n        `Extension \"${extensionName}\" not found`,\n        ErrorCode.RESOURCE_NOT_FOUND,\n        { extensionName }\n      );\n    }\n\n    const source = state.source;\n    await this.unloadExtension(extensionName);\n    await this.loadExtension(source);\n    logger.info('Extension reloaded', { name: extensionName });\n  }\n\n  /**\n   * Get extension by name\n   */\n  getExtension(extensionName: string): Extension | undefined {\n    return this.extensions.get(extensionName)?.extension;\n  }\n\n  /**\n   * Get all loaded extensions\n   */\n  listExtensions(): Array<{\n    name: string;\n    version: string;\n    status: string;\n    loadedAt: number;\n  }> {\n    return Array.from(this.extensions.entries()).map(([name, state]) => ({\n      name,\n      version: state.extension.version,\n      status: state.status,\n      loadedAt: state.loadedAt,\n    }));\n  }\n\n  /**\n   * Get tools from all active extensions\n   */\n  getTools(): ToolDefinition[] {\n    const tools: ToolDefinition[] = [];\n    for (const state of Array.from(this.extensions.values())) {\n      if (state.status === 'active' && state.extension.tools) {\n        tools.push(...state.extension.tools);\n      }\n    }\n    return tools;\n  }\n\n  /**\n   * Get providers from all active extensions\n   */\n  getProviders(): ProviderAdapter[] {\n    const providers: ProviderAdapter[] = [];\n    for (const state of Array.from(this.extensions.values())) {\n      if (state.status === 'active' && state.extension.providers) {\n        providers.push(...state.extension.providers);\n      }\n    }\n    return providers;\n  }\n\n  /**\n   * Emit event to all extensions\n   */\n  emit(event: string, data: unknown): void {\n    this.eventBus.emit(event, data);\n  }\n\n  /**\n   * Shutdown the runtime\n   */\n  async shutdown(): Promise<void> {\n    logger.info('Shutting down SandboxRuntime');\n    const names = Array.from(this.extensions.keys());\n    for (const name of names) {\n      try {\n        await this.unloadExtension(name);\n      } catch (error) {\n        logger.warn('Failed to unload extension during shutdown', {\n          name,\n          error: error instanceof Error ? error.message : String(error),\n        });\n      }\n    }\n    this.eventBus.removeAllListeners();\n    logger.info('SandboxRuntime shutdown complete');\n  }\n\n  // ============================================================================\n  // Private Methods\n  // ============================================================================\n\n  /**\n   * Resolve extension from source\n   */\n  private async resolveExtension(source: ExtensionSource): Promise<Extension> {\n    switch (source.type) {\n      case 'inline':\n        return this.loadInlineExtension(source.code, source.manifest);\n\n      case 'file':\n        return this.loadFileExtension(source.path);\n\n      case 'url':\n        return this.loadUrlExtension(source.url);\n\n      case 'npm':\n        return this.loadNpmExtension(source.package, source.version);\n\n      default:\n        throw new ValidationError(\n          'Invalid extension source type',\n          ErrorCode.VALIDATION_FAILED,\n          { source }\n        );\n    }\n  }\n\n  /**\n   * Load inline extension\n   */\n  private async loadInlineExtension(\n    code: string,\n    manifest: PermissionManifest\n  ): Promise<Extension> {\n    // For inline extensions, we expect the code to export a factory function\n    // In a real browser environment, this would use Function constructor or eval\n    // For Node.js, we use vm module\n\n    // Security: Code execution is sandboxed and requires manifest declaration\n    const AsyncFunction = Object.getPrototypeOf(\n      async function () {}\n    ).constructor;\n\n    try {\n      const factory = new AsyncFunction(\n        'manifest',\n        `\n        ${code}\n        return { ...exports, manifest };\n      `\n      );\n      const extension = await factory(manifest);\n      return extension as Extension;\n    } catch (error) {\n      throw new SystemError(\n        `Failed to load inline extension: ${error instanceof Error ? error.message : String(error)}`,\n        ErrorCode.INITIALIZATION_ERROR,\n        { manifest: manifest.name }\n      );\n    }\n  }\n\n  /**\n   * Load extension from file\n   */\n  private async loadFileExtension(filePath: string): Promise<Extension> {\n    try {\n      // Dynamic import for ES modules\n      const module = await import(filePath);\n      const extension = module.default || module;\n\n      if (!extension.name || !extension.version || !extension.manifest) {\n        throw new Error('Invalid extension export: missing required fields');\n      }\n\n      return extension as Extension;\n    } catch (error) {\n      throw new SystemError(\n        `Failed to load extension from file: ${error instanceof Error ? error.message : String(error)}`,\n        ErrorCode.FILE_NOT_FOUND,\n        { filePath }\n      );\n    }\n  }\n\n  /**\n   * Load extension from URL\n   */\n  private async loadUrlExtension(url: string): Promise<Extension> {\n    try {\n      const response = await fetch(url);\n      if (!response.ok) {\n        throw new Error(`HTTP ${response.status}: ${response.statusText}`);\n      }\n\n      const code = await response.text();\n      // Extract manifest from code (expects manifest export)\n      const manifestMatch = code.match(\n        /export\\s+const\\s+manifest\\s*=\\s*({[\\s\\S]*?});/\n      );\n      if (!manifestMatch) {\n        throw new Error('No manifest found in extension code');\n      }\n\n      const manifest = JSON.parse(\n        manifestMatch[1].replace(/'/g, '\"')\n      ) as PermissionManifest;\n      return this.loadInlineExtension(code, manifest);\n    } catch (error) {\n      throw new SystemError(\n        `Failed to load extension from URL: ${error instanceof Error ? error.message : String(error)}`,\n        ErrorCode.NETWORK_ERROR,\n        { url }\n      );\n    }\n  }\n\n  /**\n   * Load extension from npm package\n   */\n  private async loadNpmExtension(\n    packageName: string,\n    version?: string\n  ): Promise<Extension> {\n    try {\n      // Resolve package path - in production would use require.resolve\n      const packagePath = version ? `${packageName}@${version}` : packageName;\n      const module = await import(packagePath);\n      const extension = module.default || module;\n\n      if (!extension.name || !extension.version || !extension.manifest) {\n        throw new Error('Invalid extension export: missing required fields');\n      }\n\n      return extension as Extension;\n    } catch (error) {\n      throw new SystemError(\n        `Failed to load extension from npm: ${error instanceof Error ? error.message : String(error)}`,\n        ErrorCode.INITIALIZATION_ERROR,\n        { packageName, version }\n      );\n    }\n  }\n\n  /**\n   * Validate permission manifest\n   */\n  private validateManifest(manifest: PermissionManifest): void {\n    const result = PermissionManifestSchema.safeParse(manifest);\n    if (!result.success) {\n      throw new ValidationError(\n        `Invalid extension manifest: ${result.error.errors.map((e) => e.message).join(', ')}`,\n        ErrorCode.VALIDATION_FAILED,\n        { errors: result.error.errors }\n      );\n    }\n\n    // Validate network permissions against global allowlist\n    const networkPerms = manifest.permissions.filter(\n      (p): p is NetworkPermission => p.type === 'network'\n    );\n    for (const perm of networkPerms) {\n      for (const domain of perm.domains) {\n        if (!this.isDomainAllowed(domain)) {\n          throw new ValidationError(\n            `Domain \"${domain}\" is not in the global allowlist`,\n            ErrorCode.PERMISSION_VIOLATION,\n            { domain, allowlist: this.config.networkAllowlist }\n          );\n        }\n      }\n    }\n  }\n\n  /**\n   * Check if a domain is allowed\n   */\n  private isDomainAllowed(domain: string): boolean {\n    // If no global allowlist, allow all\n    if (\n      !this.config.networkAllowlist ||\n      this.config.networkAllowlist.length === 0\n    ) {\n      return true;\n    }\n\n    return this.config.networkAllowlist.some((allowed) => {\n      if (allowed === domain) return true;\n      if (allowed.startsWith('*.')) {\n        const suffix = allowed.slice(1);\n        return domain.endsWith(suffix) || domain === allowed.slice(2);\n      }\n      return false;\n    });\n  }\n\n  /**\n   * Create sandboxed extension context\n   */\n  private createExtensionContext(\n    manifest: PermissionManifest\n  ): ExtensionContext {\n    const extensionId = `${manifest.name}@${manifest.version}`;\n\n    // Create sandboxed fetch\n    const sandboxedFetch = this.createSandboxedFetch(manifest);\n\n    // Create sandboxed storage\n    const sandboxedStorage = this.createSandboxedStorage(manifest);\n\n    // Create frame manager proxy with permission checks\n    const framesAPI = this.createFramesAPI(manifest);\n\n    // Create state serializer proxy with permission checks\n    const stateAPI = this.createStateAPI(manifest);\n\n    // Event handlers map for this extension\n    const handlers = new Map<string, Set<EventHandler>>();\n\n    const context: ExtensionContext = {\n      extensionId,\n      extensionName: manifest.name,\n      permissions: manifest.permissions,\n\n      frames: framesAPI,\n      state: stateAPI,\n\n      fetch: sandboxedFetch,\n      storage: sandboxedStorage,\n\n      emit: (event: string, data: unknown) => {\n        if (!this.hasPermission(manifest, 'events:emit', event)) {\n          logger.warn('Extension attempted to emit without permission', {\n            extension: manifest.name,\n            event,\n          });\n          return;\n        }\n        this.eventBus.emit(event, data);\n      },\n\n      on: (event: string, handler: EventHandler) => {\n        if (!this.hasPermission(manifest, 'events:subscribe', event)) {\n          logger.warn('Extension attempted to subscribe without permission', {\n            extension: manifest.name,\n            event,\n          });\n          return () => {};\n        }\n\n        if (!handlers.has(event)) {\n          handlers.set(event, new Set());\n        }\n        handlers.get(event)!.add(handler);\n        this.eventBus.on(event, handler);\n\n        return () => {\n          handlers.get(event)?.delete(handler);\n          this.eventBus.off(event, handler);\n        };\n      },\n\n      off: (event: string, handler: EventHandler) => {\n        handlers.get(event)?.delete(handler);\n        this.eventBus.off(event, handler);\n      },\n    };\n\n    return context;\n  }\n\n  /**\n   * Create sandboxed fetch function\n   */\n  private createSandboxedFetch(\n    manifest: PermissionManifest\n  ): typeof globalThis.fetch {\n    const networkPerms = manifest.permissions.filter(\n      (p): p is NetworkPermission => p.type === 'network'\n    );\n    const allowedDomains = networkPerms.flatMap((p) => p.domains);\n\n    return async (input: RequestInfo | URL, init?: RequestInit) => {\n      const url =\n        typeof input === 'string'\n          ? new URL(input)\n          : input instanceof URL\n            ? input\n            : new URL(input.url);\n\n      // Check domain allowlist\n      const isAllowed = allowedDomains.some((domain) => {\n        if (domain === url.hostname) return true;\n        if (domain.startsWith('*.')) {\n          const suffix = domain.slice(1);\n          return url.hostname.endsWith(suffix);\n        }\n        return false;\n      });\n\n      if (!isAllowed) {\n        throw new ValidationError(\n          `Network access to \"${url.hostname}\" is not permitted`,\n          ErrorCode.PERMISSION_VIOLATION,\n          { hostname: url.hostname, allowed: allowedDomains }\n        );\n      }\n\n      // Perform the actual fetch\n      return globalThis.fetch(input, init);\n    };\n  }\n\n  /**\n   * Create sandboxed storage\n   */\n  private createSandboxedStorage(manifest: PermissionManifest): StorageAPI {\n    const hasLocalStorage = manifest.permissions.some(\n      (p) => p.type === 'storage:local'\n    );\n\n    if (!hasLocalStorage) {\n      // Return a no-op storage\n      return {\n        getItem: () => null,\n        setItem: () => {},\n        removeItem: () => {},\n        clear: () => {},\n        key: () => null,\n        length: 0,\n      };\n    }\n\n    // Create isolated storage namespace\n    const storageKey = `ext:${manifest.name}:`;\n    const storage = new Map<string, string>();\n\n    return {\n      getItem: (key: string) => storage.get(storageKey + key) ?? null,\n      setItem: (key: string, value: string) => {\n        storage.set(storageKey + key, value);\n      },\n      removeItem: (key: string) => {\n        storage.delete(storageKey + key);\n      },\n      clear: () => {\n        for (const key of Array.from(storage.keys())) {\n          if (key.startsWith(storageKey)) {\n            storage.delete(key);\n          }\n        }\n      },\n      key: (index: number) => {\n        const keys = Array.from(storage.keys()).filter((k) =>\n          k.startsWith(storageKey)\n        );\n        return keys[index]?.slice(storageKey.length) ?? null;\n      },\n      get length() {\n        return Array.from(storage.keys()).filter((k) =>\n          k.startsWith(storageKey)\n        ).length;\n      },\n    };\n  }\n\n  /**\n   * Create frames API with permission checks\n   */\n  private createFramesAPI(manifest: PermissionManifest): FrameManagerAPI {\n    const canRead = manifest.permissions.some((p) => p.type === 'frames:read');\n    const canWrite = manifest.permissions.some(\n      (p) => p.type === 'frames:write'\n    );\n\n    const noOpFrameManager: FrameManagerAPI = {\n      getCurrentFrame: async () => null,\n      getFrame: async () => null,\n      listFrames: async () => [],\n    };\n\n    if (!canRead && !this.frameManager) {\n      return noOpFrameManager;\n    }\n\n    const fm = this.frameManager;\n    const api: FrameManagerAPI = {\n      getCurrentFrame: async () => {\n        if (!canRead || !fm) return null;\n        return fm.getCurrentFrame();\n      },\n      getFrame: async (frameId: string) => {\n        if (!canRead || !fm) return null;\n        return fm.getFrame(frameId);\n      },\n      listFrames: async (filter?: FrameFilter) => {\n        if (!canRead || !fm) return [];\n        return fm.listFrames(filter);\n      },\n    };\n\n    if (canWrite && fm?.createFrame) {\n      api.createFrame = async (options: FrameCreateOptions) => {\n        return fm.createFrame!(options);\n      };\n    }\n\n    if (canWrite && fm?.closeFrame) {\n      api.closeFrame = async (frameId: string) => {\n        return fm.closeFrame!(frameId);\n      };\n    }\n\n    return api;\n  }\n\n  /**\n   * Create state API with permission checks\n   */\n  private createStateAPI(manifest: PermissionManifest): StateSerializerAPI {\n    const canRead = manifest.permissions.some((p) => p.type === 'frames:read');\n    const canWrite = manifest.permissions.some(\n      (p) => p.type === 'frames:write'\n    );\n\n    const prefix = `ext:${manifest.name}:`;\n    const ss = this.stateSerializer;\n\n    return {\n      get: async <T>(key: string): Promise<T | null> => {\n        if (!canRead || !ss) return null;\n        return ss.get<T>(prefix + key);\n      },\n      set: async <T>(key: string, value: T): Promise<void> => {\n        if (!canWrite || !ss) return;\n        await ss.set(prefix + key, value);\n      },\n      delete: async (key: string): Promise<boolean> => {\n        if (!canWrite || !ss) return false;\n        return ss.delete(prefix + key);\n      },\n      getDocument: async (key: string): Promise<string | null> => {\n        if (!canRead || !ss) return null;\n        return ss.getDocument(prefix + key);\n      },\n      setDocument: async (key: string, content: string): Promise<void> => {\n        if (!canWrite || !ss) return;\n        await ss.setDocument(prefix + key, content);\n      },\n      deleteDocument: async (key: string): Promise<boolean> => {\n        if (!canWrite || !ss) return false;\n        return ss.deleteDocument(prefix + key);\n      },\n    };\n  }\n\n  /**\n   * Check if extension has specific permission\n   */\n  private hasPermission(\n    manifest: PermissionManifest,\n    type: PermissionType,\n    target?: string\n  ): boolean {\n    const perm = manifest.permissions.find((p) => p.type === type);\n    if (!perm) return false;\n\n    // Check pattern matching for events\n    if ((type === 'events:emit' || type === 'events:subscribe') && target) {\n      const eventPerm = perm as EventPermission;\n      if (!eventPerm.patterns || eventPerm.patterns.length === 0) {\n        return true; // No patterns = all allowed\n      }\n      return eventPerm.patterns.some((pattern) =>\n        this.matchPattern(pattern, target)\n      );\n    }\n\n    return true;\n  }\n\n  /**\n   * Match glob-style pattern\n   */\n  private matchPattern(pattern: string, value: string): boolean {\n    const regex = new RegExp(\n      '^' + pattern.replace(/\\*/g, '.*').replace(/\\?/g, '.') + '$'\n    );\n    return regex.test(value);\n  }\n\n  /**\n   * Execute with timeout\n   */\n  private async withTimeout<T>(\n    promise: Promise<T>,\n    timeoutMs: number,\n    message: string\n  ): Promise<T> {\n    const timeoutPromise = new Promise<never>((_, reject) => {\n      setTimeout(() => reject(new Error(message)), timeoutMs);\n    });\n    return Promise.race([promise, timeoutPromise]);\n  }\n}\n\n// ============================================================================\n// Factory Functions\n// ============================================================================\n\n/**\n * Create a new sandbox runtime with default configuration\n */\nexport function createSandboxRuntime(\n  config?: Partial<SandboxConfig>\n): SandboxRuntime {\n  return new SandboxRuntime(config);\n}\n\n/**\n * Create a permission manifest\n */\nexport function createManifest(\n  name: string,\n  version: string,\n  permissions: Permission[],\n  options?: {\n    description?: string;\n    author?: string;\n    homepage?: string;\n  }\n): PermissionManifest {\n  return {\n    name,\n    version,\n    permissions,\n    ...options,\n  };\n}\n\n// ============================================================================\n// Exports\n// ============================================================================\n\nexport default SandboxRuntime;\n"],
+  "mappings": ";;;;AAQA,SAAS,SAAS;AAClB,SAAS,oBAAoB;AAC7B,SAAS,iBAAiB,WAAW,mBAAmB;AACxD,SAAS,cAAc;AAwUvB,MAAM,2BAA2B,EAAE,OAAO;AAAA,EACxC,MAAM,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,IAAI,GAAG;AAAA,EAC/B,SAAS,EAAE,OAAO,EAAE,MAAM,iBAAiB;AAAA,EAC3C,aAAa,EAAE;AAAA,IACb,EAAE,mBAAmB,QAAQ;AAAA,MAC3B,EAAE,OAAO;AAAA,QACP,MAAM,EAAE,QAAQ,SAAS;AAAA,QACzB,SAAS,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,CAAC,CAAC;AAAA,MACpC,CAAC;AAAA,MACD,EAAE,OAAO;AAAA,QACP,MAAM,EAAE,QAAQ,eAAe;AAAA,QAC/B,YAAY,EAAE,OAAO,EAAE,SAAS,EAAE,SAAS;AAAA,MAC7C,CAAC;AAAA,MACD,EAAE,OAAO;AAAA,QACP,MAAM,EAAE,QAAQ,iBAAiB;AAAA,QACjC,YAAY,EAAE,OAAO,EAAE,SAAS,EAAE,SAAS;AAAA,MAC7C,CAAC;AAAA,MACD,EAAE,OAAO;AAAA,QACP,MAAM,EAAE,QAAQ,aAAa;AAAA,QAC7B,OAAO,EAAE,KAAK,CAAC,OAAO,KAAK,CAAC,EAAE,SAAS;AAAA,MACzC,CAAC;AAAA,MACD,EAAE,OAAO;AAAA,QACP,MAAM,EAAE,QAAQ,cAAc;AAAA,QAC9B,OAAO,EAAE,KAAK,CAAC,OAAO,KAAK,CAAC,EAAE,SAAS;AAAA,MACzC,CAAC;AAAA,MACD,EAAE,OAAO;AAAA,QACP,MAAM,EAAE,QAAQ,aAAa;AAAA,QAC7B,UAAU,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,SAAS;AAAA,MACzC,CAAC;AAAA,MACD,EAAE,OAAO;AAAA,QACP,MAAM,EAAE,QAAQ,kBAAkB;AAAA,QAClC,UAAU,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,SAAS;AAAA,MACzC,CAAC;AAAA,MACD,EAAE,OAAO,EAAE,MAAM,EAAE,QAAQ,UAAU,EAAE,CAAC;AAAA,MACxC,EAAE,OAAO,EAAE,MAAM,EAAE,QAAQ,WAAW,EAAE,CAAC;AAAA,IAC3C,CAAC;AAAA,EACH;AAAA,EACA,aAAa,EAAE,OAAO,EAAE,IAAI,GAAI,EAAE,SAAS;AAAA,EAC3C,QAAQ,EAAE,OAAO,EAAE,IAAI,GAAG,EAAE,SAAS;AAAA,EACrC,UAAU,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS;AACtC,CAAC;AAOM,MAAM,eAAe;AAAA,EAClB,aAAa,oBAAI,IAA4B;AAAA,EAC7C,WAAW,IAAI,aAAa;AAAA,EAC5B;AAAA,EACA;AAAA,EACA;AAAA,EAER,YAAY,SAAiC,CAAC,GAAG;AAC/C,SAAK,SAAS;AAAA,MACZ,MAAM,OAAO,QAAQ;AAAA,MACrB,SAAS,OAAO,WAAW;AAAA,MAC3B,aAAa,OAAO;AAAA,MACpB,kBAAkB,OAAO,oBAAoB,CAAC;AAAA,MAC9C,gBAAgB,OAAO,kBAAkB;AAAA,IAC3C;AAEA,WAAO,KAAK,8BAA8B;AAAA,MACxC,MAAM,KAAK,OAAO;AAAA,MAClB,SAAS,KAAK,OAAO;AAAA,IACvB,CAAC;AAAA,EACH;AAAA;AAAA;AAAA;AAAA,EAKA,gBAAgB,cAAqC;AACnD,SAAK,eAAe;AAAA,EACtB;AAAA;AAAA;AAAA;AAAA,EAKA,mBAAmB,iBAA2C;AAC5D,SAAK,kBAAkB;AAAA,EACzB;AAAA;AAAA;AAAA;AAAA,EAKA,MAAM,cAAc,QAA0C;AAC5D,WAAO,KAAK,qBAAqB,EAAE,OAAO,CAAC;AAE3C,UAAM,YAAY,MAAM,KAAK,iBAAiB,MAAM;AACpD,UAAM,WAAW,UAAU;AAG3B,SAAK,iBAAiB,QAAQ;AAG9B,QAAI,KAAK,WAAW,IAAI,SAAS,IAAI,GAAG;AACtC,YAAM,IAAI;AAAA,QACR,cAAc,SAAS,IAAI;AAAA,QAC3B,UAAU;AAAA,QACV,EAAE,eAAe,SAAS,KAAK;AAAA,MACjC;AAAA,IACF;AAGA,UAAM,UAAU,KAAK,uBAAuB,QAAQ;AAGpD,UAAM,QAAwB;AAAA,MAC5B;AAAA,MACA;AAAA,MACA,QAAQ;AAAA,MACR,UAAU,KAAK,IAAI;AAAA,MACnB;AAAA,IACF;AACA,SAAK,WAAW,IAAI,SAAS,MAAM,KAAK;AAExC,QAAI;AAEF,YAAM,KAAK;AAAA,QACT,UAAU,KAAK,OAAO;AAAA,QACtB,KAAK,OAAO;AAAA,QACZ,cAAc,SAAS,IAAI;AAAA,MAC7B;AAEA,YAAM,SAAS;AACf,aAAO,KAAK,iCAAiC;AAAA,QAC3C,MAAM,SAAS;AAAA,QACf,SAAS,SAAS;AAAA,MACpB,CAAC;AAED,aAAO,SAAS;AAAA,IAClB,SAAS,OAAO;AACd,YAAM,SAAS;AACf,YAAM,QAAQ,iBAAiB,QAAQ,QAAQ,IAAI,MAAM,OAAO,KAAK,CAAC;AACtE,aAAO,MAAM,mCAAmC;AAAA,QAC9C,MAAM,SAAS;AAAA,QACf,OAAO,MAAM,MAAM;AAAA,MACrB,CAAC;AACD,YAAM;AAAA,IACR;AAAA,EACF;AAAA;AAAA;AAAA;AAAA,EAKA,MAAM,gBAAgB,eAAsC;AAC1D,UAAM,QAAQ,KAAK,WAAW,IAAI,aAAa;AAC/C,QAAI,CAAC,OAAO;AACV,YAAM,IAAI;AAAA,QACR,cAAc,aAAa;AAAA,QAC3B,UAAU;AAAA,QACV,EAAE,cAAc;AAAA,MAClB;AAAA,IACF;AAEA,QAAI;AACF,YAAM,KAAK;AAAA,QACT,MAAM,UAAU,QAAQ;AAAA,QACxB,KAAK,OAAO;AAAA,QACZ,cAAc,aAAa;AAAA,MAC7B;AAAA,IACF,SAAS,OAAO;AACd,aAAO,KAAK,gCAAgC;AAAA,QAC1C,MAAM;AAAA,QACN,OAAO,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK;AAAA,MAC9D,CAAC;AAAA,IACH;AAEA,UAAM,SAAS;AACf,SAAK,WAAW,OAAO,aAAa;AACpC,WAAO,KAAK,sBAAsB,EAAE,MAAM,cAAc,CAAC;AAAA,EAC3D;AAAA;AAAA;AAAA;AAAA,EAKA,MAAM,gBAAgB,eAAsC;AAC1D,UAAM,QAAQ,KAAK,WAAW,IAAI,aAAa;AAC/C,QAAI,CAAC,OAAO;AACV,YAAM,IAAI;AAAA,QACR,cAAc,aAAa;AAAA,QAC3B,UAAU;AAAA,QACV,EAAE,cAAc;AAAA,MAClB;AAAA,IACF;AAEA,UAAM,SAAS,MAAM;AACrB,UAAM,KAAK,gBAAgB,aAAa;AACxC,UAAM,KAAK,cAAc,MAAM;AAC/B,WAAO,KAAK,sBAAsB,EAAE,MAAM,cAAc,CAAC;AAAA,EAC3D;AAAA;AAAA;AAAA;AAAA,EAKA,aAAa,eAA8C;AACzD,WAAO,KAAK,WAAW,IAAI,aAAa,GAAG;AAAA,EAC7C;AAAA;AAAA;AAAA;AAAA,EAKA,iBAKG;AACD,WAAO,MAAM,KAAK,KAAK,WAAW,QAAQ,CAAC,EAAE,IAAI,CAAC,CAAC,MAAM,KAAK,OAAO;AAAA,MACnE;AAAA,MACA,SAAS,MAAM,UAAU;AAAA,MACzB,QAAQ,MAAM;AAAA,MACd,UAAU,MAAM;AAAA,IAClB,EAAE;AAAA,EACJ;AAAA;AAAA;AAAA;AAAA,EAKA,WAA6B;AAC3B,UAAM,QAA0B,CAAC;AACjC,eAAW,SAAS,MAAM,KAAK,KAAK,WAAW,OAAO,CAAC,GAAG;AACxD,UAAI,MAAM,WAAW,YAAY,MAAM,UAAU,OAAO;AACtD,cAAM,KAAK,GAAG,MAAM,UAAU,KAAK;AAAA,MACrC;AAAA,IACF;AACA,WAAO;AAAA,EACT;AAAA;AAAA;AAAA;AAAA,EAKA,eAAkC;AAChC,UAAM,YAA+B,CAAC;AACtC,eAAW,SAAS,MAAM,KAAK,KAAK,WAAW,OAAO,CAAC,GAAG;AACxD,UAAI,MAAM,WAAW,YAAY,MAAM,UAAU,WAAW;AAC1D,kBAAU,KAAK,GAAG,MAAM,UAAU,SAAS;AAAA,MAC7C;AAAA,IACF;AACA,WAAO;AAAA,EACT;AAAA;AAAA;AAAA;AAAA,EAKA,KAAK,OAAe,MAAqB;AACvC,SAAK,SAAS,KAAK,OAAO,IAAI;AAAA,EAChC;AAAA;AAAA;AAAA;AAAA,EAKA,MAAM,WAA0B;AAC9B,WAAO,KAAK,8BAA8B;AAC1C,UAAM,QAAQ,MAAM,KAAK,KAAK,WAAW,KAAK,CAAC;AAC/C,eAAW,QAAQ,OAAO;AACxB,UAAI;AACF,cAAM,KAAK,gBAAgB,IAAI;AAAA,MACjC,SAAS,OAAO;AACd,eAAO,KAAK,8CAA8C;AAAA,UACxD;AAAA,UACA,OAAO,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK;AAAA,QAC9D,CAAC;AAAA,MACH;AAAA,IACF;AACA,SAAK,SAAS,mBAAmB;AACjC,WAAO,KAAK,kCAAkC;AAAA,EAChD;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EASA,MAAc,iBAAiB,QAA6C;AAC1E,YAAQ,OAAO,MAAM;AAAA,MACnB,KAAK;AACH,eAAO,KAAK,oBAAoB,OAAO,MAAM,OAAO,QAAQ;AAAA,MAE9D,KAAK;AACH,eAAO,KAAK,kBAAkB,OAAO,IAAI;AAAA,MAE3C,KAAK;AACH,eAAO,KAAK,iBAAiB,OAAO,GAAG;AAAA,MAEzC,KAAK;AACH,eAAO,KAAK,iBAAiB,OAAO,SAAS,OAAO,OAAO;AAAA,MAE7D;AACE,cAAM,IAAI;AAAA,UACR;AAAA,UACA,UAAU;AAAA,UACV,EAAE,OAAO;AAAA,QACX;AAAA,IACJ;AAAA,EACF;AAAA;AAAA;AAAA;AAAA,EAKA,MAAc,oBACZ,MACA,UACoB;AAMpB,UAAM,gBAAgB,OAAO;AAAA,MAC3B,iBAAkB;AAAA,MAAC;AAAA,IACrB,EAAE;AAEF,QAAI;AACF,YAAM,UAAU,IAAI;AAAA,QAClB;AAAA,QACA;AAAA,UACE,IAAI;AAAA;AAAA;AAAA,MAGR;AACA,YAAM,YAAY,MAAM,QAAQ,QAAQ;AACxC,aAAO;AAAA,IACT,SAAS,OAAO;AACd,YAAM,IAAI;AAAA,QACR,oCAAoC,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK,CAAC;AAAA,QAC1F,UAAU;AAAA,QACV,EAAE,UAAU,SAAS,KAAK;AAAA,MAC5B;AAAA,IACF;AAAA,EACF;AAAA;AAAA;AAAA;AAAA,EAKA,MAAc,kBAAkB,UAAsC;AACpE,QAAI;AAEF,YAAM,SAAS,MAAM,OAAO;AAC5B,YAAM,YAAY,OAAO,WAAW;AAEpC,UAAI,CAAC,UAAU,QAAQ,CAAC,UAAU,WAAW,CAAC,UAAU,UAAU;AAChE,cAAM,IAAI,MAAM,mDAAmD;AAAA,MACrE;AAEA,aAAO;AAAA,IACT,SAAS,OAAO;AACd,YAAM,IAAI;AAAA,QACR,uCAAuC,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK,CAAC;AAAA,QAC7F,UAAU;AAAA,QACV,EAAE,SAAS;AAAA,MACb;AAAA,IACF;AAAA,EACF;AAAA;AAAA;AAAA;AAAA,EAKA,MAAc,iBAAiB,KAAiC;AAC9D,QAAI;AACF,YAAM,WAAW,MAAM,MAAM,GAAG;AAChC,UAAI,CAAC,SAAS,IAAI;AAChB,cAAM,IAAI,MAAM,QAAQ,SAAS,MAAM,KAAK,SAAS,UAAU,EAAE;AAAA,MACnE;AAEA,YAAM,OAAO,MAAM,SAAS,KAAK;AAEjC,YAAM,gBAAgB,KAAK;AAAA,QACzB;AAAA,MACF;AACA,UAAI,CAAC,eAAe;AAClB,cAAM,IAAI,MAAM,qCAAqC;AAAA,MACvD;AAEA,YAAM,WAAW,KAAK;AAAA,QACpB,cAAc,CAAC,EAAE,QAAQ,MAAM,GAAG;AAAA,MACpC;AACA,aAAO,KAAK,oBAAoB,MAAM,QAAQ;AAAA,IAChD,SAAS,OAAO;AACd,YAAM,IAAI;AAAA,QACR,sCAAsC,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK,CAAC;AAAA,QAC5F,UAAU;AAAA,QACV,EAAE,IAAI;AAAA,MACR;AAAA,IACF;AAAA,EACF;AAAA;AAAA;AAAA;AAAA,EAKA,MAAc,iBACZ,aACA,SACoB;AACpB,QAAI;AAEF,YAAM,cAAc,UAAU,GAAG,WAAW,IAAI,OAAO,KAAK;AAC5D,YAAM,SAAS,MAAM,OAAO;AAC5B,YAAM,YAAY,OAAO,WAAW;AAEpC,UAAI,CAAC,UAAU,QAAQ,CAAC,UAAU,WAAW,CAAC,UAAU,UAAU;AAChE,cAAM,IAAI,MAAM,mDAAmD;AAAA,MACrE;AAEA,aAAO;AAAA,IACT,SAAS,OAAO;AACd,YAAM,IAAI;AAAA,QACR,sCAAsC,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK,CAAC;AAAA,QAC5F,UAAU;AAAA,QACV,EAAE,aAAa,QAAQ;AAAA,MACzB;AAAA,IACF;AAAA,EACF;AAAA;AAAA;AAAA;AAAA,EAKQ,iBAAiB,UAAoC;AAC3D,UAAM,SAAS,yBAAyB,UAAU,QAAQ;AAC1D,QAAI,CAAC,OAAO,SAAS;AACnB,YAAM,IAAI;AAAA,QACR,+BAA+B,OAAO,MAAM,OAAO,IAAI,CAAC,MAAM,EAAE,OAAO,EAAE,KAAK,IAAI,CAAC;AAAA,QACnF,UAAU;AAAA,QACV,EAAE,QAAQ,OAAO,MAAM,OAAO;AAAA,MAChC;AAAA,IACF;AAGA,UAAM,eAAe,SAAS,YAAY;AAAA,MACxC,CAAC,MAA8B,EAAE,SAAS;AAAA,IAC5C;AACA,eAAW,QAAQ,cAAc;AAC/B,iBAAW,UAAU,KAAK,SAAS;AACjC,YAAI,CAAC,KAAK,gBAAgB,MAAM,GAAG;AACjC,gBAAM,IAAI;AAAA,YACR,WAAW,MAAM;AAAA,YACjB,UAAU;AAAA,YACV,EAAE,QAAQ,WAAW,KAAK,OAAO,iBAAiB;AAAA,UACpD;AAAA,QACF;AAAA,MACF;AAAA,IACF;AAAA,EACF;AAAA;AAAA;AAAA;AAAA,EAKQ,gBAAgB,QAAyB;AAE/C,QACE,CAAC,KAAK,OAAO,oBACb,KAAK,OAAO,iBAAiB,WAAW,GACxC;AACA,aAAO;AAAA,IACT;AAEA,WAAO,KAAK,OAAO,iBAAiB,KAAK,CAAC,YAAY;AACpD,UAAI,YAAY,OAAQ,QAAO;AAC/B,UAAI,QAAQ,WAAW,IAAI,GAAG;AAC5B,cAAM,SAAS,QAAQ,MAAM,CAAC;AAC9B,eAAO,OAAO,SAAS,MAAM,KAAK,WAAW,QAAQ,MAAM,CAAC;AAAA,MAC9D;AACA,aAAO;AAAA,IACT,CAAC;AAAA,EACH;AAAA;AAAA;AAAA;AAAA,EAKQ,uBACN,UACkB;AAClB,UAAM,cAAc,GAAG,SAAS,IAAI,IAAI,SAAS,OAAO;AAGxD,UAAM,iBAAiB,KAAK,qBAAqB,QAAQ;AAGzD,UAAM,mBAAmB,KAAK,uBAAuB,QAAQ;AAG7D,UAAM,YAAY,KAAK,gBAAgB,QAAQ;AAG/C,UAAM,WAAW,KAAK,eAAe,QAAQ;AAG7C,UAAM,WAAW,oBAAI,IAA+B;AAEpD,UAAM,UAA4B;AAAA,MAChC;AAAA,MACA,eAAe,SAAS;AAAA,MACxB,aAAa,SAAS;AAAA,MAEtB,QAAQ;AAAA,MACR,OAAO;AAAA,MAEP,OAAO;AAAA,MACP,SAAS;AAAA,MAET,MAAM,CAAC,OAAe,SAAkB;AACtC,YAAI,CAAC,KAAK,cAAc,UAAU,eAAe,KAAK,GAAG;AACvD,iBAAO,KAAK,kDAAkD;AAAA,YAC5D,WAAW,SAAS;AAAA,YACpB;AAAA,UACF,CAAC;AACD;AAAA,QACF;AACA,aAAK,SAAS,KAAK,OAAO,IAAI;AAAA,MAChC;AAAA,MAEA,IAAI,CAAC,OAAe,YAA0B;AAC5C,YAAI,CAAC,KAAK,cAAc,UAAU,oBAAoB,KAAK,GAAG;AAC5D,iBAAO,KAAK,uDAAuD;AAAA,YACjE,WAAW,SAAS;AAAA,YACpB;AAAA,UACF,CAAC;AACD,iBAAO,MAAM;AAAA,UAAC;AAAA,QAChB;AAEA,YAAI,CAAC,SAAS,IAAI,KAAK,GAAG;AACxB,mBAAS,IAAI,OAAO,oBAAI,IAAI,CAAC;AAAA,QAC/B;AACA,iBAAS,IAAI,KAAK,EAAG,IAAI,OAAO;AAChC,aAAK,SAAS,GAAG,OAAO,OAAO;AAE/B,eAAO,MAAM;AACX,mBAAS,IAAI,KAAK,GAAG,OAAO,OAAO;AACnC,eAAK,SAAS,IAAI,OAAO,OAAO;AAAA,QAClC;AAAA,MACF;AAAA,MAEA,KAAK,CAAC,OAAe,YAA0B;AAC7C,iBAAS,IAAI,KAAK,GAAG,OAAO,OAAO;AACnC,aAAK,SAAS,IAAI,OAAO,OAAO;AAAA,MAClC;AAAA,IACF;AAEA,WAAO;AAAA,EACT;AAAA;AAAA;AAAA;AAAA,EAKQ,qBACN,UACyB;AACzB,UAAM,eAAe,SAAS,YAAY;AAAA,MACxC,CAAC,MAA8B,EAAE,SAAS;AAAA,IAC5C;AACA,UAAM,iBAAiB,aAAa,QAAQ,CAAC,MAAM,EAAE,OAAO;AAE5D,WAAO,OAAO,OAA0B,SAAuB;AAC7D,YAAM,MACJ,OAAO,UAAU,WACb,IAAI,IAAI,KAAK,IACb,iBAAiB,MACf,QACA,IAAI,IAAI,MAAM,GAAG;AAGzB,YAAM,YAAY,eAAe,KAAK,CAAC,WAAW;AAChD,YAAI,WAAW,IAAI,SAAU,QAAO;AACpC,YAAI,OAAO,WAAW,IAAI,GAAG;AAC3B,gBAAM,SAAS,OAAO,MAAM,CAAC;AAC7B,iBAAO,IAAI,SAAS,SAAS,MAAM;AAAA,QACrC;AACA,eAAO;AAAA,MACT,CAAC;AAED,UAAI,CAAC,WAAW;AACd,cAAM,IAAI;AAAA,UACR,sBAAsB,IAAI,QAAQ;AAAA,UAClC,UAAU;AAAA,UACV,EAAE,UAAU,IAAI,UAAU,SAAS,eAAe;AAAA,QACpD;AAAA,MACF;AAGA,aAAO,WAAW,MAAM,OAAO,IAAI;AAAA,IACrC;AAAA,EACF;AAAA;AAAA;AAAA;AAAA,EAKQ,uBAAuB,UAA0C;AACvE,UAAM,kBAAkB,SAAS,YAAY;AAAA,MAC3C,CAAC,MAAM,EAAE,SAAS;AAAA,IACpB;AAEA,QAAI,CAAC,iBAAiB;AAEpB,aAAO;AAAA,QACL,SAAS,MAAM;AAAA,QACf,SAAS,MAAM;AAAA,QAAC;AAAA,QAChB,YAAY,MAAM;AAAA,QAAC;AAAA,QACnB,OAAO,MAAM;AAAA,QAAC;AAAA,QACd,KAAK,MAAM;AAAA,QACX,QAAQ;AAAA,MACV;AAAA,IACF;AAGA,UAAM,aAAa,OAAO,SAAS,IAAI;AACvC,UAAM,UAAU,oBAAI,IAAoB;AAExC,WAAO;AAAA,MACL,SAAS,CAAC,QAAgB,QAAQ,IAAI,aAAa,GAAG,KAAK;AAAA,MAC3D,SAAS,CAAC,KAAa,UAAkB;AACvC,gBAAQ,IAAI,aAAa,KAAK,KAAK;AAAA,MACrC;AAAA,MACA,YAAY,CAAC,QAAgB;AAC3B,gBAAQ,OAAO,aAAa,GAAG;AAAA,MACjC;AAAA,MACA,OAAO,MAAM;AACX,mBAAW,OAAO,MAAM,KAAK,QAAQ,KAAK,CAAC,GAAG;AAC5C,cAAI,IAAI,WAAW,UAAU,GAAG;AAC9B,oBAAQ,OAAO,GAAG;AAAA,UACpB;AAAA,QACF;AAAA,MACF;AAAA,MACA,KAAK,CAAC,UAAkB;AACtB,cAAM,OAAO,MAAM,KAAK,QAAQ,KAAK,CAAC,EAAE;AAAA,UAAO,CAAC,MAC9C,EAAE,WAAW,UAAU;AAAA,QACzB;AACA,eAAO,KAAK,KAAK,GAAG,MAAM,WAAW,MAAM,KAAK;AAAA,MAClD;AAAA,MACA,IAAI,SAAS;AACX,eAAO,MAAM,KAAK,QAAQ,KAAK,CAAC,EAAE;AAAA,UAAO,CAAC,MACxC,EAAE,WAAW,UAAU;AAAA,QACzB,EAAE;AAAA,MACJ;AAAA,IACF;AAAA,EACF;AAAA;AAAA;AAAA;AAAA,EAKQ,gBAAgB,UAA+C;AACrE,UAAM,UAAU,SAAS,YAAY,KAAK,CAAC,MAAM,EAAE,SAAS,aAAa;AACzE,UAAM,WAAW,SAAS,YAAY;AAAA,MACpC,CAAC,MAAM,EAAE,SAAS;AAAA,IACpB;AAEA,UAAM,mBAAoC;AAAA,MACxC,iBAAiB,YAAY;AAAA,MAC7B,UAAU,YAAY;AAAA,MACtB,YAAY,YAAY,CAAC;AAAA,IAC3B;AAEA,QAAI,CAAC,WAAW,CAAC,KAAK,cAAc;AAClC,aAAO;AAAA,IACT;AAEA,UAAM,KAAK,KAAK;AAChB,UAAM,MAAuB;AAAA,MAC3B,iBAAiB,YAAY;AAC3B,YAAI,CAAC,WAAW,CAAC,GAAI,QAAO;AAC5B,eAAO,GAAG,gBAAgB;AAAA,MAC5B;AAAA,MACA,UAAU,OAAO,YAAoB;AACnC,YAAI,CAAC,WAAW,CAAC,GAAI,QAAO;AAC5B,eAAO,GAAG,SAAS,OAAO;AAAA,MAC5B;AAAA,MACA,YAAY,OAAO,WAAyB;AAC1C,YAAI,CAAC,WAAW,CAAC,GAAI,QAAO,CAAC;AAC7B,eAAO,GAAG,WAAW,MAAM;AAAA,MAC7B;AAAA,IACF;AAEA,QAAI,YAAY,IAAI,aAAa;AAC/B,UAAI,cAAc,OAAO,YAAgC;AACvD,eAAO,GAAG,YAAa,OAAO;AAAA,MAChC;AAAA,IACF;AAEA,QAAI,YAAY,IAAI,YAAY;AAC9B,UAAI,aAAa,OAAO,YAAoB;AAC1C,eAAO,GAAG,WAAY,OAAO;AAAA,MAC/B;AAAA,IACF;AAEA,WAAO;AAAA,EACT;AAAA;AAAA;AAAA;AAAA,EAKQ,eAAe,UAAkD;AACvE,UAAM,UAAU,SAAS,YAAY,KAAK,CAAC,MAAM,EAAE,SAAS,aAAa;AACzE,UAAM,WAAW,SAAS,YAAY;AAAA,MACpC,CAAC,MAAM,EAAE,SAAS;AAAA,IACpB;AAEA,UAAM,SAAS,OAAO,SAAS,IAAI;AACnC,UAAM,KAAK,KAAK;AAEhB,WAAO;AAAA,MACL,KAAK,OAAU,QAAmC;AAChD,YAAI,CAAC,WAAW,CAAC,GAAI,QAAO;AAC5B,eAAO,GAAG,IAAO,SAAS,GAAG;AAAA,MAC/B;AAAA,MACA,KAAK,OAAU,KAAa,UAA4B;AACtD,YAAI,CAAC,YAAY,CAAC,GAAI;AACtB,cAAM,GAAG,IAAI,SAAS,KAAK,KAAK;AAAA,MAClC;AAAA,MACA,QAAQ,OAAO,QAAkC;AAC/C,YAAI,CAAC,YAAY,CAAC,GAAI,QAAO;AAC7B,eAAO,GAAG,OAAO,SAAS,GAAG;AAAA,MAC/B;AAAA,MACA,aAAa,OAAO,QAAwC;AAC1D,YAAI,CAAC,WAAW,CAAC,GAAI,QAAO;AAC5B,eAAO,GAAG,YAAY,SAAS,GAAG;AAAA,MACpC;AAAA,MACA,aAAa,OAAO,KAAa,YAAmC;AAClE,YAAI,CAAC,YAAY,CAAC,GAAI;AACtB,cAAM,GAAG,YAAY,SAAS,KAAK,OAAO;AAAA,MAC5C;AAAA,MACA,gBAAgB,OAAO,QAAkC;AACvD,YAAI,CAAC,YAAY,CAAC,GAAI,QAAO;AAC7B,eAAO,GAAG,eAAe,SAAS,GAAG;AAAA,MACvC;AAAA,IACF;AAAA,EACF;AAAA;AAAA;AAAA;AAAA,EAKQ,cACN,UACA,MACA,QACS;AACT,UAAM,OAAO,SAAS,YAAY,KAAK,CAAC,MAAM,EAAE,SAAS,IAAI;AAC7D,QAAI,CAAC,KAAM,QAAO;AAGlB,SAAK,SAAS,iBAAiB,SAAS,uBAAuB,QAAQ;AACrE,YAAM,YAAY;AAClB,UAAI,CAAC,UAAU,YAAY,UAAU,SAAS,WAAW,GAAG;AAC1D,eAAO;AAAA,MACT;AACA,aAAO,UAAU,SAAS;AAAA,QAAK,CAAC,YAC9B,KAAK,aAAa,SAAS,MAAM;AAAA,MACnC;AAAA,IACF;AAEA,WAAO;AAAA,EACT;AAAA;AAAA;AAAA;AAAA,EAKQ,aAAa,SAAiB,OAAwB;AAC5D,UAAM,QAAQ,IAAI;AAAA,MAChB,MAAM,QAAQ,QAAQ,OAAO,IAAI,EAAE,QAAQ,OAAO,GAAG,IAAI;AAAA,IAC3D;AACA,WAAO,MAAM,KAAK,KAAK;AAAA,EACzB;AAAA;AAAA;AAAA;AAAA,EAKA,MAAc,YACZ,SACA,WACA,SACY;AACZ,UAAM,iBAAiB,IAAI,QAAe,CAAC,GAAG,WAAW;AACvD,iBAAW,MAAM,OAAO,IAAI,MAAM,OAAO,CAAC,GAAG,SAAS;AAAA,IACxD,CAAC;AACD,WAAO,QAAQ,KAAK,CAAC,SAAS,cAAc,CAAC;AAAA,EAC/C;AACF;AASO,SAAS,qBACd,QACgB;AAChB,SAAO,IAAI,eAAe,MAAM;AAClC;AAKO,SAAS,eACd,MACA,SACA,aACA,SAKoB;AACpB,SAAO;AAAA,IACL;AAAA,IACA;AAAA,IACA;AAAA,IACA,GAAG;AAAA,EACL;AACF;AAMA,IAAO,0BAAQ;",
+  "names": []
+}

package/dist/src/core/retrieval/index.js

@@ -5,4 +5,6 @@ const __dirname = __pathDirname(__filename);
 export * from "./types.js";
 export * from "./summary-generator.js";
 export * from "./llm-context-retrieval.js";
+export * from "./privacy-filter.js";
+export * from "./unified-context-assembler.js";
 //# sourceMappingURL=index.js.map

package/dist/src/core/retrieval/index.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../../../src/core/retrieval/index.ts"],
-  "sourcesContent": ["/**\n * LLM-Driven Context Retrieval Module\n * Exports all retrieval functionality\n */\n\nexport * from './types.js';\nexport * from './summary-generator.js';\nexport * from './llm-context-retrieval.js';\n"],
-  "mappings": ";;;;AAKA,cAAc;AACd,cAAc;AACd,cAAc;",
+  "sourcesContent": ["/**\n * LLM-Driven Context Retrieval Module\n * Exports all retrieval functionality\n */\n\nexport * from './types.js';\nexport * from './summary-generator.js';\nexport * from './llm-context-retrieval.js';\nexport * from './privacy-filter.js';\nexport * from './unified-context-assembler.js';\n"],
+  "mappings": ";;;;AAKA,cAAc;AACd,cAAc;AACd,cAAc;AACd,cAAc;AACd,cAAc;",
   "names": []
 }

package/dist/src/core/retrieval/privacy-filter.js

@@ -0,0 +1,129 @@
+import { fileURLToPath as __fileURLToPath } from 'url';
+import { dirname as __pathDirname } from 'path';
+const __filename = __fileURLToPath(import.meta.url);
+const __dirname = __pathDirname(__filename);
+import { SENSITIVE_PATTERNS } from "../security/input-sanitizer.js";
+const PRIVACY_PATTERNS = {
+  // Permissive: Only critical secrets
+  permissive: [],
+  // Standard: Secrets + PII basics
+  standard: [
+    // Email addresses
+    /\b[A-Za-z0-9._%+-]+@[A-Za-z0-9.-]+\.[A-Z|a-z]{2,}\b/g,
+    // Phone numbers (various formats)
+    /\b(?:\+?1[-.\s]?)?(?:\(?\d{3}\)?[-.\s]?)?\d{3}[-.\s]?\d{4}\b/g,
+    // SSN-like patterns
+    /\b\d{3}[-.\s]?\d{2}[-.\s]?\d{4}\b/g,
+    // IP addresses (v4)
+    /\b(?:(?:25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)\.){3}(?:25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)\b/g
+  ],
+  // Strict: All standard + additional PII
+  strict: [
+    // Credit card-like numbers (13-19 digits, optionally separated)
+    /\b(?:\d{4}[-.\s]?){3,4}\d{1,4}\b/g,
+    // Date of birth patterns (various formats)
+    /\b(?:0?[1-9]|1[0-2])[-/](?:0?[1-9]|[12][0-9]|3[01])[-/](?:19|20)\d{2}\b/g,
+    // AWS-style keys
+    /\b(?:AKIA|ABIA|ACCA|ASIA)[A-Z0-9]{16}\b/g,
+    // Private key markers
+    /-----BEGIN (?:RSA |EC |DSA |OPENSSH )?PRIVATE KEY-----[\s\S]*?-----END (?:RSA |EC |DSA |OPENSSH )?PRIVATE KEY-----/g,
+    // JWT tokens
+    /\beyJ[A-Za-z0-9_-]*\.eyJ[A-Za-z0-9_-]*\.[A-Za-z0-9_-]*/g,
+    // URLs with credentials
+    /(?:https?|ftp):\/\/[^\s:@]+:[^\s:@]+@[^\s]+/gi,
+    // MAC addresses
+    /\b(?:[0-9A-Fa-f]{2}[:-]){5}[0-9A-Fa-f]{2}\b/g,
+    // UUID-like patterns that might be sensitive
+    /\b[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}\b/gi
+  ]
+};
+class PrivacyFilter {
+  config;
+  patterns;
+  constructor(config) {
+    this.config = config;
+    this.patterns = this.buildPatternList();
+  }
+  /**
+   * Build the complete list of patterns based on privacy mode
+   */
+  buildPatternList() {
+    const patterns = [];
+    patterns.push(...SENSITIVE_PATTERNS);
+    switch (this.config.mode) {
+      case "strict":
+        patterns.push(...PRIVACY_PATTERNS.strict);
+        patterns.push(...PRIVACY_PATTERNS.standard);
+        break;
+      case "standard":
+        patterns.push(...PRIVACY_PATTERNS.standard);
+        break;
+      case "permissive":
+        break;
+    }
+    return patterns;
+  }
+  /**
+   * Filter sensitive patterns from content
+   * @param content The content to filter
+   * @returns Filtered content and count of redactions
+   */
+  filter(content) {
+    if (!content) {
+      return { filtered: "", redactedCount: 0 };
+    }
+    let filtered = content;
+    let redactedCount = 0;
+    for (const pattern of this.patterns) {
+      pattern.lastIndex = 0;
+      const matches = content.match(pattern);
+      if (matches) {
+        redactedCount += matches.length;
+      }
+      filtered = filtered.replace(pattern, "[REDACTED]");
+    }
+    return { filtered, redactedCount };
+  }
+  /**
+   * Check if content contains sensitive data without modifying it
+   * @param content The content to check
+   * @returns True if sensitive data is detected
+   */
+  containsSensitive(content) {
+    if (!content) return false;
+    for (const pattern of this.patterns) {
+      pattern.lastIndex = 0;
+      if (pattern.test(content)) {
+        return true;
+      }
+    }
+    return false;
+  }
+  /**
+   * Get the current privacy mode
+   */
+  getMode() {
+    return this.config.mode;
+  }
+  /**
+   * Update the privacy mode and rebuild patterns
+   */
+  setMode(mode) {
+    this.config.mode = mode;
+    this.patterns = this.buildPatternList();
+  }
+  /**
+   * Get the count of active patterns
+   */
+  getPatternCount() {
+    return this.patterns.length;
+  }
+}
+function createPrivacyFilter(mode = "standard") {
+  return new PrivacyFilter({ mode });
+}
+export {
+  PrivacyFilter,
+  createPrivacyFilter
+};
+//# sourceMappingURL=privacy-filter.js.map

package/dist/src/core/retrieval/privacy-filter.js.map

@@ -0,0 +1,7 @@
+{
+  "version": 3,
+  "sources": ["../../../../src/core/retrieval/privacy-filter.ts"],
+  "sourcesContent": ["/**\n * Privacy Filter for Unified Context Assembly\n * Filters sensitive patterns from content before including in context\n */\n\nimport { SENSITIVE_PATTERNS } from '../security/input-sanitizer.js';\n\nexport type PrivacyMode = 'strict' | 'standard' | 'permissive';\n\nexport interface PrivacyFilterConfig {\n  mode: PrivacyMode;\n}\n\nexport interface FilterResult {\n  filtered: string;\n  redactedCount: number;\n}\n\n/**\n * Additional patterns for privacy filtering beyond security patterns\n * Organized by strictness level\n */\nconst PRIVACY_PATTERNS: Record<PrivacyMode, RegExp[]> = {\n  // Permissive: Only critical secrets\n  permissive: [],\n\n  // Standard: Secrets + PII basics\n  standard: [\n    // Email addresses\n    /\\b[A-Za-z0-9._%+-]+@[A-Za-z0-9.-]+\\.[A-Z|a-z]{2,}\\b/g,\n    // Phone numbers (various formats)\n    /\\b(?:\\+?1[-.\\s]?)?(?:\\(?\\d{3}\\)?[-.\\s]?)?\\d{3}[-.\\s]?\\d{4}\\b/g,\n    // SSN-like patterns\n    /\\b\\d{3}[-.\\s]?\\d{2}[-.\\s]?\\d{4}\\b/g,\n    // IP addresses (v4)\n    /\\b(?:(?:25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)\\.){3}(?:25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)\\b/g,\n  ],\n\n  // Strict: All standard + additional PII\n  strict: [\n    // Credit card-like numbers (13-19 digits, optionally separated)\n    /\\b(?:\\d{4}[-.\\s]?){3,4}\\d{1,4}\\b/g,\n    // Date of birth patterns (various formats)\n    /\\b(?:0?[1-9]|1[0-2])[-/](?:0?[1-9]|[12][0-9]|3[01])[-/](?:19|20)\\d{2}\\b/g,\n    // AWS-style keys\n    /\\b(?:AKIA|ABIA|ACCA|ASIA)[A-Z0-9]{16}\\b/g,\n    // Private key markers\n    /-----BEGIN (?:RSA |EC |DSA |OPENSSH )?PRIVATE KEY-----[\\s\\S]*?-----END (?:RSA |EC |DSA |OPENSSH )?PRIVATE KEY-----/g,\n    // JWT tokens\n    /\\beyJ[A-Za-z0-9_-]*\\.eyJ[A-Za-z0-9_-]*\\.[A-Za-z0-9_-]*/g,\n    // URLs with credentials\n    /(?:https?|ftp):\\/\\/[^\\s:@]+:[^\\s:@]+@[^\\s]+/gi,\n    // MAC addresses\n    /\\b(?:[0-9A-Fa-f]{2}[:-]){5}[0-9A-Fa-f]{2}\\b/g,\n    // UUID-like patterns that might be sensitive\n    /\\b[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}\\b/gi,\n  ],\n};\n\n/**\n * Privacy Filter class for filtering sensitive content\n */\nexport class PrivacyFilter {\n  private config: PrivacyFilterConfig;\n  private patterns: RegExp[];\n\n  constructor(config: PrivacyFilterConfig) {\n    this.config = config;\n    this.patterns = this.buildPatternList();\n  }\n\n  /**\n   * Build the complete list of patterns based on privacy mode\n   */\n  private buildPatternList(): RegExp[] {\n    const patterns: RegExp[] = [];\n\n    // Always include security patterns (API keys, tokens, etc.)\n    patterns.push(...SENSITIVE_PATTERNS);\n\n    // Add mode-specific patterns\n    switch (this.config.mode) {\n      case 'strict':\n        patterns.push(...PRIVACY_PATTERNS.strict);\n        patterns.push(...PRIVACY_PATTERNS.standard);\n        break;\n      case 'standard':\n        patterns.push(...PRIVACY_PATTERNS.standard);\n        break;\n      case 'permissive':\n        // Only security patterns (already added above)\n        break;\n    }\n\n    return patterns;\n  }\n\n  /**\n   * Filter sensitive patterns from content\n   * @param content The content to filter\n   * @returns Filtered content and count of redactions\n   */\n  filter(content: string): FilterResult {\n    if (!content) {\n      return { filtered: '', redactedCount: 0 };\n    }\n\n    let filtered = content;\n    let redactedCount = 0;\n\n    for (const pattern of this.patterns) {\n      // Reset regex state for global patterns\n      pattern.lastIndex = 0;\n\n      // Count matches before replacing\n      const matches = content.match(pattern);\n      if (matches) {\n        redactedCount += matches.length;\n      }\n\n      // Replace sensitive content\n      filtered = filtered.replace(pattern, '[REDACTED]');\n    }\n\n    return { filtered, redactedCount };\n  }\n\n  /**\n   * Check if content contains sensitive data without modifying it\n   * @param content The content to check\n   * @returns True if sensitive data is detected\n   */\n  containsSensitive(content: string): boolean {\n    if (!content) return false;\n\n    for (const pattern of this.patterns) {\n      pattern.lastIndex = 0;\n      if (pattern.test(content)) {\n        return true;\n      }\n    }\n\n    return false;\n  }\n\n  /**\n   * Get the current privacy mode\n   */\n  getMode(): PrivacyMode {\n    return this.config.mode;\n  }\n\n  /**\n   * Update the privacy mode and rebuild patterns\n   */\n  setMode(mode: PrivacyMode): void {\n    this.config.mode = mode;\n    this.patterns = this.buildPatternList();\n  }\n\n  /**\n   * Get the count of active patterns\n   */\n  getPatternCount(): number {\n    return this.patterns.length;\n  }\n}\n\n/**\n * Create a privacy filter with default config\n */\nexport function createPrivacyFilter(\n  mode: PrivacyMode = 'standard'\n): PrivacyFilter {\n  return new PrivacyFilter({ mode });\n}\n"],
+  "mappings": ";;;;AAKA,SAAS,0BAA0B;AAiBnC,MAAM,mBAAkD;AAAA;AAAA,EAEtD,YAAY,CAAC;AAAA;AAAA,EAGb,UAAU;AAAA;AAAA,IAER;AAAA;AAAA,IAEA;AAAA;AAAA,IAEA;AAAA;AAAA,IAEA;AAAA,EACF;AAAA;AAAA,EAGA,QAAQ;AAAA;AAAA,IAEN;AAAA;AAAA,IAEA;AAAA;AAAA,IAEA;AAAA;AAAA,IAEA;AAAA;AAAA,IAEA;AAAA;AAAA,IAEA;AAAA;AAAA,IAEA;AAAA;AAAA,IAEA;AAAA,EACF;AACF;AAKO,MAAM,cAAc;AAAA,EACjB;AAAA,EACA;AAAA,EAER,YAAY,QAA6B;AACvC,SAAK,SAAS;AACd,SAAK,WAAW,KAAK,iBAAiB;AAAA,EACxC;AAAA;AAAA;AAAA;AAAA,EAKQ,mBAA6B;AACnC,UAAM,WAAqB,CAAC;AAG5B,aAAS,KAAK,GAAG,kBAAkB;AAGnC,YAAQ,KAAK,OAAO,MAAM;AAAA,MACxB,KAAK;AACH,iBAAS,KAAK,GAAG,iBAAiB,MAAM;AACxC,iBAAS,KAAK,GAAG,iBAAiB,QAAQ;AAC1C;AAAA,MACF,KAAK;AACH,iBAAS,KAAK,GAAG,iBAAiB,QAAQ;AAC1C;AAAA,MACF,KAAK;AAEH;AAAA,IACJ;AAEA,WAAO;AAAA,EACT;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOA,OAAO,SAA+B;AACpC,QAAI,CAAC,SAAS;AACZ,aAAO,EAAE,UAAU,IAAI,eAAe,EAAE;AAAA,IAC1C;AAEA,QAAI,WAAW;AACf,QAAI,gBAAgB;AAEpB,eAAW,WAAW,KAAK,UAAU;AAEnC,cAAQ,YAAY;AAGpB,YAAM,UAAU,QAAQ,MAAM,OAAO;AACrC,UAAI,SAAS;AACX,yBAAiB,QAAQ;AAAA,MAC3B;AAGA,iBAAW,SAAS,QAAQ,SAAS,YAAY;AAAA,IACnD;AAEA,WAAO,EAAE,UAAU,cAAc;AAAA,EACnC;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOA,kBAAkB,SAA0B;AAC1C,QAAI,CAAC,QAAS,QAAO;AAErB,eAAW,WAAW,KAAK,UAAU;AACnC,cAAQ,YAAY;AACpB,UAAI,QAAQ,KAAK,OAAO,GAAG;AACzB,eAAO;AAAA,MACT;AAAA,IACF;AAEA,WAAO;AAAA,EACT;AAAA;AAAA;AAAA;AAAA,EAKA,UAAuB;AACrB,WAAO,KAAK,OAAO;AAAA,EACrB;AAAA;AAAA;AAAA;AAAA,EAKA,QAAQ,MAAyB;AAC/B,SAAK,OAAO,OAAO;AACnB,SAAK,WAAW,KAAK,iBAAiB;AAAA,EACxC;AAAA;AAAA;AAAA;AAAA,EAKA,kBAA0B;AACxB,WAAO,KAAK,SAAS;AAAA,EACvB;AACF;AAKO,SAAS,oBACd,OAAoB,YACL;AACf,SAAO,IAAI,cAAc,EAAE,KAAK,CAAC;AACnC;",
+  "names": []
+}

package/dist/src/core/retrieval/unified-context-assembler.js

@@ -0,0 +1,273 @@
+import { fileURLToPath as __fileURLToPath } from 'url';
+import { dirname as __pathDirname } from 'path';
+const __filename = __fileURLToPath(import.meta.url);
+const __dirname = __pathDirname(__filename);
+import {
+  createPrivacyFilter
+} from "./privacy-filter.js";
+import { logger } from "../monitoring/logger.js";
+const DEFAULT_UNIFIED_CONTEXT_CONFIG = {
+  totalTokenBudget: 8e3,
+  userKnowledgeBudget: 0.2,
+  // 20%
+  taskContextBudget: 0.7,
+  // 70%
+  systemContextBudget: 0.1,
+  // 10%
+  privacyMode: "standard"
+};
+function estimateTokens(content) {
+  if (!content) return 0;
+  return Math.ceil(content.length / 4);
+}
+function truncateToTokenBudget(content, tokenBudget) {
+  if (!content) return "";
+  const estimatedTokens = estimateTokens(content);
+  if (estimatedTokens <= tokenBudget) {
+    return content;
+  }
+  const charLimit = tokenBudget * 4;
+  const truncated = content.substring(0, charLimit);
+  const lastSpace = truncated.lastIndexOf(" ");
+  if (lastSpace > charLimit * 0.8) {
+    return truncated.substring(0, lastSpace) + "...";
+  }
+  return truncated + "...";
+}
+class UnifiedContextAssembler {
+  stackMemoryRetrieval;
+  diffMemHooks;
+  config;
+  privacyFilter;
+  constructor(stackMemoryRetrieval, diffMemHooks, config = {}) {
+    this.stackMemoryRetrieval = stackMemoryRetrieval;
+    this.diffMemHooks = diffMemHooks;
+    this.config = { ...DEFAULT_UNIFIED_CONTEXT_CONFIG, ...config };
+    this.privacyFilter = createPrivacyFilter(this.config.privacyMode);
+    const totalAllocation = this.config.userKnowledgeBudget + this.config.taskContextBudget + this.config.systemContextBudget;
+    if (Math.abs(totalAllocation - 1) > 1e-3) {
+      logger.warn("Budget allocations do not sum to 1.0", {
+        userKnowledge: this.config.userKnowledgeBudget,
+        taskContext: this.config.taskContextBudget,
+        systemContext: this.config.systemContextBudget,
+        total: totalAllocation
+      });
+    }
+  }
+  /**
+   * Assemble unified context from all sources
+   */
+  async assemble(query) {
+    const startTime = Date.now();
+    let totalPrivacyFiltered = 0;
+    const userKnowledgeBudget = Math.floor(
+      this.config.totalTokenBudget * this.config.userKnowledgeBudget
+    );
+    const taskContextBudget = Math.floor(
+      this.config.totalTokenBudget * this.config.taskContextBudget
+    );
+    const systemContextBudget = Math.floor(
+      this.config.totalTokenBudget * this.config.systemContextBudget
+    );
+    const {
+      content: userKnowledge,
+      memories: diffMemMemories,
+      available: diffMemAvailable
+    } = await this.gatherUserKnowledge(query, userKnowledgeBudget);
+    const userKnowledgeFiltered = this.privacyFilter.filter(userKnowledge);
+    totalPrivacyFiltered += userKnowledgeFiltered.redactedCount;
+    const filteredUserKnowledge = truncateToTokenBudget(
+      userKnowledgeFiltered.filtered,
+      userKnowledgeBudget
+    );
+    const { content: taskContext, frameCount } = await this.gatherTaskContext(
+      query,
+      taskContextBudget
+    );
+    const taskContextFiltered = this.privacyFilter.filter(taskContext);
+    totalPrivacyFiltered += taskContextFiltered.redactedCount;
+    const filteredTaskContext = truncateToTokenBudget(
+      taskContextFiltered.filtered,
+      taskContextBudget
+    );
+    const systemContext = this.gatherSystemContext(systemContextBudget);
+    const systemContextFiltered = this.privacyFilter.filter(systemContext);
+    totalPrivacyFiltered += systemContextFiltered.redactedCount;
+    const filteredSystemContext = truncateToTokenBudget(
+      systemContextFiltered.filtered,
+      systemContextBudget
+    );
+    const combined = this.combineContextSections(
+      filteredUserKnowledge,
+      filteredTaskContext,
+      filteredSystemContext
+    );
+    const tokenUsage = {
+      userKnowledge: estimateTokens(filteredUserKnowledge),
+      taskContext: estimateTokens(filteredTaskContext),
+      systemContext: estimateTokens(filteredSystemContext),
+      total: estimateTokens(combined),
+      budget: this.config.totalTokenBudget
+    };
+    const metadata = {
+      diffMemAvailable,
+      diffMemMemories,
+      stackMemoryFrames: frameCount,
+      privacyFiltered: totalPrivacyFiltered
+    };
+    logger.info("Unified context assembled", {
+      query: query.substring(0, 50),
+      tokenUsage,
+      metadata,
+      assemblyTimeMs: Date.now() - startTime
+    });
+    return {
+      userKnowledge: filteredUserKnowledge,
+      taskContext: filteredTaskContext,
+      systemContext: filteredSystemContext,
+      combined,
+      tokenUsage,
+      metadata
+    };
+  }
+  /**
+   * Gather user knowledge from DiffMem
+   */
+  async gatherUserKnowledge(query, tokenBudget) {
+    if (!this.diffMemHooks) {
+      return { content: "", memories: 0, available: false };
+    }
+    try {
+      const status = await this.diffMemHooks.getStatus();
+      if (!status.connected) {
+        logger.debug("DiffMem not connected");
+        return { content: "", memories: 0, available: false };
+      }
+      const memories = await this.diffMemHooks.getRelevantMemories(query, 10);
+      if (memories.length === 0) {
+        return { content: "", memories: 0, available: true };
+      }
+      const sections = ["## User Knowledge"];
+      const byCategory = /* @__PURE__ */ new Map();
+      for (const memory of memories) {
+        const existing = byCategory.get(memory.category) || [];
+        existing.push(memory);
+        byCategory.set(memory.category, existing);
+      }
+      for (const [category, categoryMemories] of byCategory) {
+        sections.push(`
+### ${this.formatCategory(category)}`);
+        for (const memory of categoryMemories) {
+          const confidence = memory.confidence >= 0.8 ? "(high confidence)" : memory.confidence >= 0.5 ? "" : "(tentative)";
+          sections.push(`- ${memory.content} ${confidence}`);
+        }
+      }
+      const content = sections.join("\n");
+      return {
+        content: truncateToTokenBudget(content, tokenBudget),
+        memories: memories.length,
+        available: true
+      };
+    } catch (error) {
+      logger.warn("Failed to gather user knowledge from DiffMem", { error });
+      return { content: "", memories: 0, available: false };
+    }
+  }
+  /**
+   * Format category name for display
+   */
+  formatCategory(category) {
+    return category.split("_").map((word) => word.charAt(0).toUpperCase() + word.slice(1)).join(" ");
+  }
+  /**
+   * Gather task context from StackMemory
+   */
+  async gatherTaskContext(query, tokenBudget) {
+    try {
+      const retrievedContext = await this.stackMemoryRetrieval.retrieveContext(
+        query,
+        {
+          tokenBudget
+        }
+      );
+      return {
+        content: retrievedContext.context,
+        frameCount: retrievedContext.frames.length
+      };
+    } catch (error) {
+      logger.warn("Failed to gather task context from StackMemory", { error });
+      return { content: "", frameCount: 0 };
+    }
+  }
+  /**
+   * Gather system context (environment, timestamps, etc.)
+   */
+  gatherSystemContext(tokenBudget) {
+    const sections = ["## System Context"];
+    sections.push(`
+**Current Time**: ${(/* @__PURE__ */ new Date()).toISOString()}`);
+    const nodeEnv = process.env.NODE_ENV || "development";
+    sections.push(`**Environment**: ${nodeEnv}`);
+    const projectId = process.env.STACKMEMORY_PROJECT_ID;
+    if (projectId) {
+      sections.push(`**Project**: ${projectId}`);
+    }
+    const sessionId = process.env.STACKMEMORY_SESSION_ID;
+    if (sessionId) {
+      sections.push(`**Session**: ${sessionId.substring(0, 8)}...`);
+    }
+    const content = sections.join("\n");
+    return truncateToTokenBudget(content, tokenBudget);
+  }
+  /**
+   * Combine all context sections into a single string
+   */
+  combineContextSections(userKnowledge, taskContext, systemContext) {
+    const sections = [];
+    if (taskContext) {
+      sections.push(taskContext);
+    }
+    if (userKnowledge) {
+      sections.push(userKnowledge);
+    }
+    if (systemContext) {
+      sections.push(systemContext);
+    }
+    return sections.join("\n\n---\n\n");
+  }
+  /**
+   * Update privacy mode
+   */
+  setPrivacyMode(mode) {
+    this.config.privacyMode = mode;
+    this.privacyFilter.setMode(mode);
+  }
+  /**
+   * Get current configuration
+   */
+  getConfig() {
+    return { ...this.config };
+  }
+  /**
+   * Update configuration
+   */
+  updateConfig(config) {
+    this.config = { ...this.config, ...config };
+    if (config.privacyMode) {
+      this.privacyFilter.setMode(config.privacyMode);
+    }
+  }
+}
+function createUnifiedContextAssembler(stackMemoryRetrieval, diffMemHooks = null, config = {}) {
+  return new UnifiedContextAssembler(
+    stackMemoryRetrieval,
+    diffMemHooks,
+    config
+  );
+}
+export {
+  DEFAULT_UNIFIED_CONTEXT_CONFIG,
+  UnifiedContextAssembler,
+  createUnifiedContextAssembler
+};
+//# sourceMappingURL=unified-context-assembler.js.map

package/dist/src/core/retrieval/unified-context-assembler.js.map

@@ -0,0 +1,7 @@
+{
+  "version": 3,
+  "sources": ["../../../../src/core/retrieval/unified-context-assembler.ts"],
+  "sourcesContent": ["/**\n * Unified Context Assembler\n * Combines StackMemory task context with DiffMem user knowledge\n * Applies privacy filtering and respects token budgets\n */\n\nimport {\n  PrivacyFilter,\n  PrivacyMode,\n  createPrivacyFilter,\n} from './privacy-filter.js';\nimport { LLMContextRetrieval } from './llm-context-retrieval.js';\nimport {\n  UserMemory,\n  MemoryQuery,\n  DiffMemStatus,\n} from '../../integrations/diffmem/types.js';\nimport { logger } from '../monitoring/logger.js';\n\n/**\n * Configuration for unified context assembly\n */\nexport interface UnifiedContextConfig {\n  /** Total token budget for all context */\n  totalTokenBudget: number;\n  /** Fraction of budget for user knowledge (0.0-1.0) */\n  userKnowledgeBudget: number;\n  /** Fraction of budget for task context (0.0-1.0) */\n  taskContextBudget: number;\n  /** Fraction of budget for system context (0.0-1.0) */\n  systemContextBudget: number;\n  /** Privacy filtering mode */\n  privacyMode: PrivacyMode;\n}\n\n/**\n * Token usage breakdown\n */\nexport interface TokenUsage {\n  userKnowledge: number;\n  taskContext: number;\n  systemContext: number;\n  total: number;\n  budget: number;\n}\n\n/**\n * Metadata about the assembled context\n */\nexport interface ContextMetadata {\n  diffMemAvailable: boolean;\n  diffMemMemories: number;\n  stackMemoryFrames: number;\n  privacyFiltered: number;\n}\n\n/**\n * Result of unified context assembly\n */\nexport interface UnifiedContext {\n  /** User knowledge from DiffMem */\n  userKnowledge: string;\n  /** Task context from StackMemory */\n  taskContext: string;\n  /** System context (environment, configuration) */\n  systemContext: string;\n  /** Combined context string */\n  combined: string;\n  /** Token usage breakdown */\n  tokenUsage: TokenUsage;\n  /** Assembly metadata */\n  metadata: ContextMetadata;\n}\n\n/**\n * Interface for DiffMem hooks (to be implemented by DiffMem integration)\n */\nexport interface DiffMemHooks {\n  /** Check if DiffMem is available and connected */\n  getStatus(): Promise<DiffMemStatus>;\n  /** Query user memories */\n  queryMemories(query: MemoryQuery): Promise<UserMemory[]>;\n  /** Get memories relevant to a query string */\n  getRelevantMemories(query: string, limit?: number): Promise<UserMemory[]>;\n}\n\n/**\n * Default configuration\n */\nexport const DEFAULT_UNIFIED_CONTEXT_CONFIG: UnifiedContextConfig = {\n  totalTokenBudget: 8000,\n  userKnowledgeBudget: 0.2, // 20%\n  taskContextBudget: 0.7, // 70%\n  systemContextBudget: 0.1, // 10%\n  privacyMode: 'standard',\n};\n\n/**\n * Estimate token count from content\n * Uses rough approximation: 1 token \u2248 4 characters\n */\nfunction estimateTokens(content: string): number {\n  if (!content) return 0;\n  return Math.ceil(content.length / 4);\n}\n\n/**\n * Truncate content to fit within token budget\n */\nfunction truncateToTokenBudget(content: string, tokenBudget: number): string {\n  if (!content) return '';\n\n  const estimatedTokens = estimateTokens(content);\n  if (estimatedTokens <= tokenBudget) {\n    return content;\n  }\n\n  // Truncate to approximate character limit\n  const charLimit = tokenBudget * 4;\n  const truncated = content.substring(0, charLimit);\n\n  // Try to truncate at a word boundary\n  const lastSpace = truncated.lastIndexOf(' ');\n  if (lastSpace > charLimit * 0.8) {\n    return truncated.substring(0, lastSpace) + '...';\n  }\n\n  return truncated + '...';\n}\n\n/**\n * Unified Context Assembler\n * Orchestrates context retrieval from multiple sources\n */\nexport class UnifiedContextAssembler {\n  private stackMemoryRetrieval: LLMContextRetrieval;\n  private diffMemHooks: DiffMemHooks | null;\n  private config: UnifiedContextConfig;\n  private privacyFilter: PrivacyFilter;\n\n  constructor(\n    stackMemoryRetrieval: LLMContextRetrieval,\n    diffMemHooks: DiffMemHooks | null,\n    config: Partial<UnifiedContextConfig> = {}\n  ) {\n    this.stackMemoryRetrieval = stackMemoryRetrieval;\n    this.diffMemHooks = diffMemHooks;\n    this.config = { ...DEFAULT_UNIFIED_CONTEXT_CONFIG, ...config };\n    this.privacyFilter = createPrivacyFilter(this.config.privacyMode);\n\n    // Validate budget allocations\n    const totalAllocation =\n      this.config.userKnowledgeBudget +\n      this.config.taskContextBudget +\n      this.config.systemContextBudget;\n\n    if (Math.abs(totalAllocation - 1.0) > 0.001) {\n      logger.warn('Budget allocations do not sum to 1.0', {\n        userKnowledge: this.config.userKnowledgeBudget,\n        taskContext: this.config.taskContextBudget,\n        systemContext: this.config.systemContextBudget,\n        total: totalAllocation,\n      });\n    }\n  }\n\n  /**\n   * Assemble unified context from all sources\n   */\n  async assemble(query: string): Promise<UnifiedContext> {\n    const startTime = Date.now();\n    let totalPrivacyFiltered = 0;\n\n    // Calculate token budgets for each section\n    const userKnowledgeBudget = Math.floor(\n      this.config.totalTokenBudget * this.config.userKnowledgeBudget\n    );\n    const taskContextBudget = Math.floor(\n      this.config.totalTokenBudget * this.config.taskContextBudget\n    );\n    const systemContextBudget = Math.floor(\n      this.config.totalTokenBudget * this.config.systemContextBudget\n    );\n\n    // 1. Gather user knowledge from DiffMem\n    const {\n      content: userKnowledge,\n      memories: diffMemMemories,\n      available: diffMemAvailable,\n    } = await this.gatherUserKnowledge(query, userKnowledgeBudget);\n\n    // Apply privacy filter to user knowledge\n    const userKnowledgeFiltered = this.privacyFilter.filter(userKnowledge);\n    totalPrivacyFiltered += userKnowledgeFiltered.redactedCount;\n    const filteredUserKnowledge = truncateToTokenBudget(\n      userKnowledgeFiltered.filtered,\n      userKnowledgeBudget\n    );\n\n    // 2. Gather task context from StackMemory\n    const { content: taskContext, frameCount } = await this.gatherTaskContext(\n      query,\n      taskContextBudget\n    );\n\n    // Apply privacy filter to task context\n    const taskContextFiltered = this.privacyFilter.filter(taskContext);\n    totalPrivacyFiltered += taskContextFiltered.redactedCount;\n    const filteredTaskContext = truncateToTokenBudget(\n      taskContextFiltered.filtered,\n      taskContextBudget\n    );\n\n    // 3. Gather system context\n    const systemContext = this.gatherSystemContext(systemContextBudget);\n\n    // Apply privacy filter to system context\n    const systemContextFiltered = this.privacyFilter.filter(systemContext);\n    totalPrivacyFiltered += systemContextFiltered.redactedCount;\n    const filteredSystemContext = truncateToTokenBudget(\n      systemContextFiltered.filtered,\n      systemContextBudget\n    );\n\n    // 4. Combine all context sections\n    const combined = this.combineContextSections(\n      filteredUserKnowledge,\n      filteredTaskContext,\n      filteredSystemContext\n    );\n\n    // Calculate token usage\n    const tokenUsage: TokenUsage = {\n      userKnowledge: estimateTokens(filteredUserKnowledge),\n      taskContext: estimateTokens(filteredTaskContext),\n      systemContext: estimateTokens(filteredSystemContext),\n      total: estimateTokens(combined),\n      budget: this.config.totalTokenBudget,\n    };\n\n    const metadata: ContextMetadata = {\n      diffMemAvailable,\n      diffMemMemories,\n      stackMemoryFrames: frameCount,\n      privacyFiltered: totalPrivacyFiltered,\n    };\n\n    logger.info('Unified context assembled', {\n      query: query.substring(0, 50),\n      tokenUsage,\n      metadata,\n      assemblyTimeMs: Date.now() - startTime,\n    });\n\n    return {\n      userKnowledge: filteredUserKnowledge,\n      taskContext: filteredTaskContext,\n      systemContext: filteredSystemContext,\n      combined,\n      tokenUsage,\n      metadata,\n    };\n  }\n\n  /**\n   * Gather user knowledge from DiffMem\n   */\n  private async gatherUserKnowledge(\n    query: string,\n    tokenBudget: number\n  ): Promise<{ content: string; memories: number; available: boolean }> {\n    if (!this.diffMemHooks) {\n      return { content: '', memories: 0, available: false };\n    }\n\n    try {\n      // Check DiffMem status\n      const status = await this.diffMemHooks.getStatus();\n      if (!status.connected) {\n        logger.debug('DiffMem not connected');\n        return { content: '', memories: 0, available: false };\n      }\n\n      // Query relevant memories\n      const memories = await this.diffMemHooks.getRelevantMemories(query, 10);\n\n      if (memories.length === 0) {\n        return { content: '', memories: 0, available: true };\n      }\n\n      // Format memories into context string\n      const sections: string[] = ['## User Knowledge'];\n\n      // Group memories by category\n      const byCategory = new Map<string, UserMemory[]>();\n      for (const memory of memories) {\n        const existing = byCategory.get(memory.category) || [];\n        existing.push(memory);\n        byCategory.set(memory.category, existing);\n      }\n\n      // Format each category\n      for (const [category, categoryMemories] of byCategory) {\n        sections.push(`\\n### ${this.formatCategory(category)}`);\n        for (const memory of categoryMemories) {\n          const confidence =\n            memory.confidence >= 0.8\n              ? '(high confidence)'\n              : memory.confidence >= 0.5\n                ? ''\n                : '(tentative)';\n          sections.push(`- ${memory.content} ${confidence}`);\n        }\n      }\n\n      const content = sections.join('\\n');\n      return {\n        content: truncateToTokenBudget(content, tokenBudget),\n        memories: memories.length,\n        available: true,\n      };\n    } catch (error) {\n      logger.warn('Failed to gather user knowledge from DiffMem', { error });\n      return { content: '', memories: 0, available: false };\n    }\n  }\n\n  /**\n   * Format category name for display\n   */\n  private formatCategory(category: string): string {\n    return category\n      .split('_')\n      .map((word) => word.charAt(0).toUpperCase() + word.slice(1))\n      .join(' ');\n  }\n\n  /**\n   * Gather task context from StackMemory\n   */\n  private async gatherTaskContext(\n    query: string,\n    tokenBudget: number\n  ): Promise<{ content: string; frameCount: number }> {\n    try {\n      const retrievedContext = await this.stackMemoryRetrieval.retrieveContext(\n        query,\n        {\n          tokenBudget,\n        }\n      );\n\n      return {\n        content: retrievedContext.context,\n        frameCount: retrievedContext.frames.length,\n      };\n    } catch (error) {\n      logger.warn('Failed to gather task context from StackMemory', { error });\n      return { content: '', frameCount: 0 };\n    }\n  }\n\n  /**\n   * Gather system context (environment, timestamps, etc.)\n   */\n  private gatherSystemContext(tokenBudget: number): string {\n    const sections: string[] = ['## System Context'];\n\n    // Add timestamp\n    sections.push(`\\n**Current Time**: ${new Date().toISOString()}`);\n\n    // Add environment info (sanitized)\n    const nodeEnv = process.env.NODE_ENV || 'development';\n    sections.push(`**Environment**: ${nodeEnv}`);\n\n    // Add project info if available\n    const projectId = process.env.STACKMEMORY_PROJECT_ID;\n    if (projectId) {\n      sections.push(`**Project**: ${projectId}`);\n    }\n\n    // Add session info\n    const sessionId = process.env.STACKMEMORY_SESSION_ID;\n    if (sessionId) {\n      sections.push(`**Session**: ${sessionId.substring(0, 8)}...`);\n    }\n\n    const content = sections.join('\\n');\n    return truncateToTokenBudget(content, tokenBudget);\n  }\n\n  /**\n   * Combine all context sections into a single string\n   */\n  private combineContextSections(\n    userKnowledge: string,\n    taskContext: string,\n    systemContext: string\n  ): string {\n    const sections: string[] = [];\n\n    // Add sections in priority order\n    if (taskContext) {\n      sections.push(taskContext);\n    }\n\n    if (userKnowledge) {\n      sections.push(userKnowledge);\n    }\n\n    if (systemContext) {\n      sections.push(systemContext);\n    }\n\n    return sections.join('\\n\\n---\\n\\n');\n  }\n\n  /**\n   * Update privacy mode\n   */\n  setPrivacyMode(mode: PrivacyMode): void {\n    this.config.privacyMode = mode;\n    this.privacyFilter.setMode(mode);\n  }\n\n  /**\n   * Get current configuration\n   */\n  getConfig(): UnifiedContextConfig {\n    return { ...this.config };\n  }\n\n  /**\n   * Update configuration\n   */\n  updateConfig(config: Partial<UnifiedContextConfig>): void {\n    this.config = { ...this.config, ...config };\n    if (config.privacyMode) {\n      this.privacyFilter.setMode(config.privacyMode);\n    }\n  }\n}\n\n/**\n * Factory function to create a unified context assembler\n */\nexport function createUnifiedContextAssembler(\n  stackMemoryRetrieval: LLMContextRetrieval,\n  diffMemHooks: DiffMemHooks | null = null,\n  config: Partial<UnifiedContextConfig> = {}\n): UnifiedContextAssembler {\n  return new UnifiedContextAssembler(\n    stackMemoryRetrieval,\n    diffMemHooks,\n    config\n  );\n}\n"],
+  "mappings": ";;;;AAMA;AAAA,EAGE;AAAA,OACK;AAOP,SAAS,cAAc;AAwEhB,MAAM,iCAAuD;AAAA,EAClE,kBAAkB;AAAA,EAClB,qBAAqB;AAAA;AAAA,EACrB,mBAAmB;AAAA;AAAA,EACnB,qBAAqB;AAAA;AAAA,EACrB,aAAa;AACf;AAMA,SAAS,eAAe,SAAyB;AAC/C,MAAI,CAAC,QAAS,QAAO;AACrB,SAAO,KAAK,KAAK,QAAQ,SAAS,CAAC;AACrC;AAKA,SAAS,sBAAsB,SAAiB,aAA6B;AAC3E,MAAI,CAAC,QAAS,QAAO;AAErB,QAAM,kBAAkB,eAAe,OAAO;AAC9C,MAAI,mBAAmB,aAAa;AAClC,WAAO;AAAA,EACT;AAGA,QAAM,YAAY,cAAc;AAChC,QAAM,YAAY,QAAQ,UAAU,GAAG,SAAS;AAGhD,QAAM,YAAY,UAAU,YAAY,GAAG;AAC3C,MAAI,YAAY,YAAY,KAAK;AAC/B,WAAO,UAAU,UAAU,GAAG,SAAS,IAAI;AAAA,EAC7C;AAEA,SAAO,YAAY;AACrB;AAMO,MAAM,wBAAwB;AAAA,EAC3B;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EAER,YACE,sBACA,cACA,SAAwC,CAAC,GACzC;AACA,SAAK,uBAAuB;AAC5B,SAAK,eAAe;AACpB,SAAK,SAAS,EAAE,GAAG,gCAAgC,GAAG,OAAO;AAC7D,SAAK,gBAAgB,oBAAoB,KAAK,OAAO,WAAW;AAGhE,UAAM,kBACJ,KAAK,OAAO,sBACZ,KAAK,OAAO,oBACZ,KAAK,OAAO;AAEd,QAAI,KAAK,IAAI,kBAAkB,CAAG,IAAI,MAAO;AAC3C,aAAO,KAAK,wCAAwC;AAAA,QAClD,eAAe,KAAK,OAAO;AAAA,QAC3B,aAAa,KAAK,OAAO;AAAA,QACzB,eAAe,KAAK,OAAO;AAAA,QAC3B,OAAO;AAAA,MACT,CAAC;AAAA,IACH;AAAA,EACF;AAAA;AAAA;AAAA;AAAA,EAKA,MAAM,SAAS,OAAwC;AACrD,UAAM,YAAY,KAAK,IAAI;AAC3B,QAAI,uBAAuB;AAG3B,UAAM,sBAAsB,KAAK;AAAA,MAC/B,KAAK,OAAO,mBAAmB,KAAK,OAAO;AAAA,IAC7C;AACA,UAAM,oBAAoB,KAAK;AAAA,MAC7B,KAAK,OAAO,mBAAmB,KAAK,OAAO;AAAA,IAC7C;AACA,UAAM,sBAAsB,KAAK;AAAA,MAC/B,KAAK,OAAO,mBAAmB,KAAK,OAAO;AAAA,IAC7C;AAGA,UAAM;AAAA,MACJ,SAAS;AAAA,MACT,UAAU;AAAA,MACV,WAAW;AAAA,IACb,IAAI,MAAM,KAAK,oBAAoB,OAAO,mBAAmB;AAG7D,UAAM,wBAAwB,KAAK,cAAc,OAAO,aAAa;AACrE,4BAAwB,sBAAsB;AAC9C,UAAM,wBAAwB;AAAA,MAC5B,sBAAsB;AAAA,MACtB;AAAA,IACF;AAGA,UAAM,EAAE,SAAS,aAAa,WAAW,IAAI,MAAM,KAAK;AAAA,MACtD;AAAA,MACA;AAAA,IACF;AAGA,UAAM,sBAAsB,KAAK,cAAc,OAAO,WAAW;AACjE,4BAAwB,oBAAoB;AAC5C,UAAM,sBAAsB;AAAA,MAC1B,oBAAoB;AAAA,MACpB;AAAA,IACF;AAGA,UAAM,gBAAgB,KAAK,oBAAoB,mBAAmB;AAGlE,UAAM,wBAAwB,KAAK,cAAc,OAAO,aAAa;AACrE,4BAAwB,sBAAsB;AAC9C,UAAM,wBAAwB;AAAA,MAC5B,sBAAsB;AAAA,MACtB;AAAA,IACF;AAGA,UAAM,WAAW,KAAK;AAAA,MACpB;AAAA,MACA;AAAA,MACA;AAAA,IACF;AAGA,UAAM,aAAyB;AAAA,MAC7B,eAAe,eAAe,qBAAqB;AAAA,MACnD,aAAa,eAAe,mBAAmB;AAAA,MAC/C,eAAe,eAAe,qBAAqB;AAAA,MACnD,OAAO,eAAe,QAAQ;AAAA,MAC9B,QAAQ,KAAK,OAAO;AAAA,IACtB;AAEA,UAAM,WAA4B;AAAA,MAChC;AAAA,MACA;AAAA,MACA,mBAAmB;AAAA,MACnB,iBAAiB;AAAA,IACnB;AAEA,WAAO,KAAK,6BAA6B;AAAA,MACvC,OAAO,MAAM,UAAU,GAAG,EAAE;AAAA,MAC5B;AAAA,MACA;AAAA,MACA,gBAAgB,KAAK,IAAI,IAAI;AAAA,IAC/B,CAAC;AAED,WAAO;AAAA,MACL,eAAe;AAAA,MACf,aAAa;AAAA,MACb,eAAe;AAAA,MACf;AAAA,MACA;AAAA,MACA;AAAA,IACF;AAAA,EACF;AAAA;AAAA;AAAA;AAAA,EAKA,MAAc,oBACZ,OACA,aACoE;AACpE,QAAI,CAAC,KAAK,cAAc;AACtB,aAAO,EAAE,SAAS,IAAI,UAAU,GAAG,WAAW,MAAM;AAAA,IACtD;AAEA,QAAI;AAEF,YAAM,SAAS,MAAM,KAAK,aAAa,UAAU;AACjD,UAAI,CAAC,OAAO,WAAW;AACrB,eAAO,MAAM,uBAAuB;AACpC,eAAO,EAAE,SAAS,IAAI,UAAU,GAAG,WAAW,MAAM;AAAA,MACtD;AAGA,YAAM,WAAW,MAAM,KAAK,aAAa,oBAAoB,OAAO,EAAE;AAEtE,UAAI,SAAS,WAAW,GAAG;AACzB,eAAO,EAAE,SAAS,IAAI,UAAU,GAAG,WAAW,KAAK;AAAA,MACrD;AAGA,YAAM,WAAqB,CAAC,mBAAmB;AAG/C,YAAM,aAAa,oBAAI,IAA0B;AACjD,iBAAW,UAAU,UAAU;AAC7B,cAAM,WAAW,WAAW,IAAI,OAAO,QAAQ,KAAK,CAAC;AACrD,iBAAS,KAAK,MAAM;AACpB,mBAAW,IAAI,OAAO,UAAU,QAAQ;AAAA,MAC1C;AAGA,iBAAW,CAAC,UAAU,gBAAgB,KAAK,YAAY;AACrD,iBAAS,KAAK;AAAA,MAAS,KAAK,eAAe,QAAQ,CAAC,EAAE;AACtD,mBAAW,UAAU,kBAAkB;AACrC,gBAAM,aACJ,OAAO,cAAc,MACjB,sBACA,OAAO,cAAc,MACnB,KACA;AACR,mBAAS,KAAK,KAAK,OAAO,OAAO,IAAI,UAAU,EAAE;AAAA,QACnD;AAAA,MACF;AAEA,YAAM,UAAU,SAAS,KAAK,IAAI;AAClC,aAAO;AAAA,QACL,SAAS,sBAAsB,SAAS,WAAW;AAAA,QACnD,UAAU,SAAS;AAAA,QACnB,WAAW;AAAA,MACb;AAAA,IACF,SAAS,OAAO;AACd,aAAO,KAAK,gDAAgD,EAAE,MAAM,CAAC;AACrE,aAAO,EAAE,SAAS,IAAI,UAAU,GAAG,WAAW,MAAM;AAAA,IACtD;AAAA,EACF;AAAA;AAAA;AAAA;AAAA,EAKQ,eAAe,UAA0B;AAC/C,WAAO,SACJ,MAAM,GAAG,EACT,IAAI,CAAC,SAAS,KAAK,OAAO,CAAC,EAAE,YAAY,IAAI,KAAK,MAAM,CAAC,CAAC,EAC1D,KAAK,GAAG;AAAA,EACb;AAAA;AAAA;AAAA;AAAA,EAKA,MAAc,kBACZ,OACA,aACkD;AAClD,QAAI;AACF,YAAM,mBAAmB,MAAM,KAAK,qBAAqB;AAAA,QACvD;AAAA,QACA;AAAA,UACE;AAAA,QACF;AAAA,MACF;AAEA,aAAO;AAAA,QACL,SAAS,iBAAiB;AAAA,QAC1B,YAAY,iBAAiB,OAAO;AAAA,MACtC;AAAA,IACF,SAAS,OAAO;AACd,aAAO,KAAK,kDAAkD,EAAE,MAAM,CAAC;AACvE,aAAO,EAAE,SAAS,IAAI,YAAY,EAAE;AAAA,IACtC;AAAA,EACF;AAAA;AAAA;AAAA;AAAA,EAKQ,oBAAoB,aAA6B;AACvD,UAAM,WAAqB,CAAC,mBAAmB;AAG/C,aAAS,KAAK;AAAA,qBAAuB,oBAAI,KAAK,GAAE,YAAY,CAAC,EAAE;AAG/D,UAAM,UAAU,QAAQ,IAAI,YAAY;AACxC,aAAS,KAAK,oBAAoB,OAAO,EAAE;AAG3C,UAAM,YAAY,QAAQ,IAAI;AAC9B,QAAI,WAAW;AACb,eAAS,KAAK,gBAAgB,SAAS,EAAE;AAAA,IAC3C;AAGA,UAAM,YAAY,QAAQ,IAAI;AAC9B,QAAI,WAAW;AACb,eAAS,KAAK,gBAAgB,UAAU,UAAU,GAAG,CAAC,CAAC,KAAK;AAAA,IAC9D;AAEA,UAAM,UAAU,SAAS,KAAK,IAAI;AAClC,WAAO,sBAAsB,SAAS,WAAW;AAAA,EACnD;AAAA;AAAA;AAAA;AAAA,EAKQ,uBACN,eACA,aACA,eACQ;AACR,UAAM,WAAqB,CAAC;AAG5B,QAAI,aAAa;AACf,eAAS,KAAK,WAAW;AAAA,IAC3B;AAEA,QAAI,eAAe;AACjB,eAAS,KAAK,aAAa;AAAA,IAC7B;AAEA,QAAI,eAAe;AACjB,eAAS,KAAK,aAAa;AAAA,IAC7B;AAEA,WAAO,SAAS,KAAK,aAAa;AAAA,EACpC;AAAA;AAAA;AAAA;AAAA,EAKA,eAAe,MAAyB;AACtC,SAAK,OAAO,cAAc;AAC1B,SAAK,cAAc,QAAQ,IAAI;AAAA,EACjC;AAAA;AAAA;AAAA;AAAA,EAKA,YAAkC;AAChC,WAAO,EAAE,GAAG,KAAK,OAAO;AAAA,EAC1B;AAAA;AAAA;AAAA;AAAA,EAKA,aAAa,QAA6C;AACxD,SAAK,SAAS,EAAE,GAAG,KAAK,QAAQ,GAAG,OAAO;AAC1C,QAAI,OAAO,aAAa;AACtB,WAAK,cAAc,QAAQ,OAAO,WAAW;AAAA,IAC/C;AAAA,EACF;AACF;AAKO,SAAS,8BACd,sBACA,eAAoC,MACpC,SAAwC,CAAC,GAChB;AACzB,SAAO,IAAI;AAAA,IACT;AAAA,IACA;AAAA,IACA;AAAA,EACF;AACF;",
+  "names": []
+}