@unbrained/pm-cli 2026.9.6 → 2026.9.8

package/dist/sdk/merge.js

@@ -1,11 +1,2 @@
-/**
- * @module sdk/merge
- *
- * Provides semantic tracker merge, reconciliation, and merge-fence APIs.
- */
-
-!function(){try{var e="undefined"!=typeof window?window:"undefined"!=typeof global?global:"undefined"!=typeof globalThis?globalThis:"undefined"!=typeof self?self:{},n=(new e.Error).stack;n&&(e._sentryDebugIds=e._sentryDebugIds||{},e._sentryDebugIds[n]="00dc29ff-60e0-5755-b7f1-4f69e438e87f")}catch(e){}}();
-export * from "./merge/index.js";
-export * from "./merge/install.js";
+!(function(){try{var e="undefined"!=typeof window?window:"undefined"!=typeof global?global:"undefined"!=typeof globalThis?globalThis:"undefined"!=typeof self?self:{},n=new e.Error().stack;n&&(e._sentryDebugIds=e._sentryDebugIds||{},e._sentryDebugIds[n]="682aba7b-ccef-5c63-969d-ef0c41fda653")}catch(e2){}})();export*from"./merge/index.js";export*from"./merge/install.js";
 //# sourceMappingURL=merge.js.map
-//# debugId=00dc29ff-60e0-5755-b7f1-4f69e438e87f

package/dist/sdk/mutation-events.js

@@ -1,293 +1,2 @@
-/**
- * @module sdk/mutation-events
- *
- * Exposes cursor-resumable, cross-item mutation events over the append-only
- * history store without requiring a daemon or shell subprocess.
- */
-
-!function(){try{var e="undefined"!=typeof window?window:"undefined"!=typeof global?global:"undefined"!=typeof globalThis?globalThis:"undefined"!=typeof self?self:{},n=(new e.Error).stack;n&&(e._sentryDebugIds=e._sentryDebugIds||{},e._sentryDebugIds[n]="01043e67-99d4-5b68-a1b2-33f35f5cef5f")}catch(e){}}();
-import { assertInitializedTracker } from "./environment/tracker-preflight.js";
-import { createHash } from "node:crypto";
-import { setTimeout as delay } from "node:timers/promises";
-import { queryHistoryEventIndex, queryHistoryEventStreams, rebuildHistoryEventIndex, } from "../core/history/event-index.js";
-import { EXIT_CODE } from "../core/shared/constants.js";
-import { PmCliError } from "../core/shared/errors.js";
-import { stableStringify } from "../core/shared/serialization.js";
-import { resolvePmRoot } from "../core/store/paths.js";
-import { readSettings } from "../core/store/settings.js";
-import { parseHistoryProvenanceFilters, projectHistoryProvenance, resolveHistoryProvenanceDimensions, summarizeHistoryProvenance, } from "./history-provenance.js";
-const MUTATION_EVENT_CURSOR_VERSION = 1;
-const MUTATION_EVENT_CURSOR_PATTERN = /^[A-Za-z0-9_-]+$/;
-const DEFAULT_EVENT_LIMIT = 100;
-const MAX_EVENT_LIMIT = 1_000;
-const DEFAULT_FOLLOW_INTERVAL_MS = 250;
-/** Regression budgets for the canonical 200-event wire-cost fixture. */
-export const MUTATION_EVENT_WIRE_BUDGET = Object.freeze({
-    /** Maximum default batch bytes divided by legacy row-cursor bytes. */
-    batch_to_row_ratio: 0.6,
-    /** Fixture size used to keep the ratio representative of fleet catch-up. */
-    fixture_events: 200,
-});
-function normalizeFilter(value) {
-    if (value === undefined)
-        return undefined;
-    const values = typeof value === "string" ? [value] : value;
-    const normalized = [
-        ...new Set(values
-            .flatMap((entry) => entry.split(","))
-            .map((entry) => entry.trim())
-            .filter(Boolean)),
-    ].sort((left, right) => left.localeCompare(right));
-    return normalized.length === 0 ? undefined : normalized;
-}
-function eventQueryFingerprint(options) {
-    return createHash("sha256")
-        .update(stableStringify({
-        type: normalizeFilter(options.type),
-        author: normalizeFilter(options.author),
-        item: normalizeFilter(options.item),
-        harness: normalizeFilter(options.harness),
-        agent_instance: normalizeFilter(options.agentInstance),
-        provenance: normalizeFilter(options.provenanceFilter),
-    }))
-        .digest("hex")
-        .slice(0, 24);
-}
-function encodeMutationEventCursor(event, fingerprint) {
-    const envelope = {
-        version: MUTATION_EVENT_CURSOR_VERSION,
-        fingerprint,
-        ts: event.entry.ts,
-        stream_id: event.stream_id,
-        stream_offset: event.stream_offset,
-    };
-    return Buffer.from(JSON.stringify(envelope), "utf8").toString("base64url");
-}
-function isMutationEventCursorEnvelope(value, fingerprint) {
-    if (typeof value !== "object" || value === null)
-        return false;
-    const candidate = value;
-    return [
-        candidate.version === MUTATION_EVENT_CURSOR_VERSION,
-        candidate.fingerprint === fingerprint,
-        typeof candidate.ts === "string",
-        typeof candidate.stream_id === "string",
-        typeof candidate.stream_offset === "number",
-        Number.isSafeInteger(candidate.stream_offset),
-        Number(candidate.stream_offset) >= 0,
-    ].every(Boolean);
-}
-function decodeMutationEventCursor(cursor, fingerprint) {
-    const normalized = cursor.trim();
-    if (normalized.length === 0 ||
-        normalized.length > 4_096 ||
-        !MUTATION_EVENT_CURSOR_PATTERN.test(normalized)) {
-        throw new PmCliError("Invalid mutation event cursor.", EXIT_CODE.USAGE, {
-            code: "invalid_event_cursor",
-        });
-    }
-    let parsed;
-    try {
-        parsed = JSON.parse(Buffer.from(normalized, "base64url").toString("utf8"));
-    }
-    catch {
-        throw new PmCliError("Invalid mutation event cursor.", EXIT_CODE.USAGE, {
-            code: "invalid_event_cursor",
-        });
-    }
-    if (!isMutationEventCursorEnvelope(parsed, fingerprint)) {
-        throw new PmCliError("Mutation event cursor does not match this query.", EXIT_CODE.USAGE, { code: "event_cursor_query_mismatch" });
-    }
-    return parsed;
-}
-function parseMutationEventLimit(value) {
-    const limit = value ?? DEFAULT_EVENT_LIMIT;
-    if (!Number.isSafeInteger(limit) || limit < 0 || limit > MAX_EVENT_LIMIT) {
-        throw new PmCliError(`Mutation event limit must be an integer from 0 to ${MAX_EVENT_LIMIT}.`, EXIT_CODE.USAGE, { code: "invalid_event_limit" });
-    }
-    return limit;
-}
-function isAbortError(error) {
-    return error instanceof Error && error.name === "AbortError";
-}
-function resolveMutationEventStart(sinceValue, fingerprint) {
-    const since = sinceValue?.trim();
-    if (!since)
-        return {};
-    if (MUTATION_EVENT_CURSOR_PATTERN.test(since)) {
-        return { cursor: decodeMutationEventCursor(since, fingerprint) };
-    }
-    const milliseconds = Date.parse(since);
-    if (!Number.isFinite(milliseconds)) {
-        throw new PmCliError("Mutation event --since must be an event cursor or ISO timestamp.", EXIT_CODE.USAGE, { code: "invalid_event_since" });
-    }
-    return { sinceTimestamp: new Date(milliseconds).toISOString() };
-}
-async function resolveIndexedMutationEvents(pmRoot, query) {
-    let indexed = await queryHistoryEventIndex(pmRoot, query);
-    if (indexed === null) {
-        if (!(await rebuildHistoryEventIndex(pmRoot))) {
-            return {
-                ...(await queryHistoryEventStreams(pmRoot, query)),
-                source: "authoritative_history",
-            };
-        }
-        indexed = await queryHistoryEventIndex(pmRoot, query);
-    }
-    if (indexed === null) {
-        throw new PmCliError("Mutation event index could not be opened after rebuild.", EXIT_CODE.GENERIC_FAILURE, { code: "event_index_unavailable" });
-    }
-    return { ...indexed, source: "derived_index" };
-}
-/** Resolves the event cursor emission mode and rejects unsupported transport spellings. */
-function resolveMutationEventCursorMode(value) {
-    const cursorMode = value ?? "batch";
-    if (cursorMode !== "batch" && cursorMode !== "row") {
-        throw new PmCliError("Mutation event cursor mode must be batch or row.", EXIT_CODE.USAGE, { code: "invalid_event_cursor_mode" });
-    }
-    return cursorMode;
-}
-/** Read one bounded page of mutation events from the persistent projection. */
-export async function listMutationEvents(options = {}) {
-    const pmRoot = resolvePmRoot(options.cwd ?? process.cwd(), options.pmRoot);
-    await assertInitializedTracker(pmRoot);
-    const requestedLimit = parseMutationEventLimit(options.limit);
-    const cursorMode = resolveMutationEventCursorMode(options.cursorMode);
-    if (options.full === true && options.provenance === true) {
-        throw new PmCliError("Mutation event projections are mutually exclusive. Use --provenance or --full.", EXIT_CODE.USAGE);
-    }
-    const settings = await readSettings(pmRoot);
-    const vocabulary = settings.agent_identity.identity_vocabulary;
-    const dimensions = resolveHistoryProvenanceDimensions(settings.agent_identity.harness_signals);
-    const provenancePredicates = parseHistoryProvenanceFilters({ provenance: options.provenanceFilter }, dimensions);
-    const harnesses = normalizeFilter(options.harness);
-    const fingerprint = eventQueryFingerprint(options);
-    const { cursor, sinceTimestamp } = resolveMutationEventStart(options.since, fingerprint);
-    const query = {
-        ...(cursor
-            ? {
-                after_ts: cursor.ts,
-                after_stream_id: cursor.stream_id,
-                after_stream_offset: cursor.stream_offset,
-            }
-            : sinceTimestamp
-                ? { since_ts: sinceTimestamp }
-                : {}),
-        ops: normalizeFilter(options.type),
-        authors: normalizeFilter(options.author),
-        harnesses,
-        harness_alias_authors: harnesses
-            ? Object.entries(vocabulary.aliases)
-                .filter(([, harness]) => harnesses.includes(harness))
-                .map(([author]) => author)
-            : undefined,
-        agent_instances: normalizeFilter(options.agentInstance),
-        provenance: [...provenancePredicates].map(([dimension, values]) => ({
-            dimension,
-            values: [...values],
-        })),
-        stream_ids: normalizeFilter(options.item),
-        limit: requestedLimit,
-    };
-    const indexed = await resolveIndexedMutationEvents(pmRoot, query);
-    const events = indexed.events.map((event) => ({
-        ...(cursorMode === "row"
-            ? { cursor: encodeMutationEventCursor(event, fingerprint) }
-            : {}),
-        item_id: event.stream_id,
-        version: event.stream_offset + 1,
-        ts: event.entry.ts,
-        author: event.entry.author,
-        type: event.entry.op,
-        ...(event.entry.message === undefined
-            ? {}
-            : { message: event.entry.message }),
-        patch_count: event.entry.patch.length,
-        ...(options.full === true ? { entry: event.entry } : {}),
-        ...(options.provenance === true
-            ? {
-                provenance: projectHistoryProvenance(event.entry, vocabulary, {
-                    itemId: event.stream_id,
-                    version: event.stream_offset + 1,
-                }),
-            }
-            : {}),
-    }));
-    return {
-        events,
-        count: events.length,
-        has_more: indexed.has_more,
-        cursor_mode: cursorMode,
-        ...(indexed.events.length === 0
-            ? {}
-            : {
-                next_cursor: encodeMutationEventCursor(indexed.events[indexed.events.length - 1], fingerprint),
-            }),
-        source: indexed.source,
-        ...(options.provenanceSummary === true
-            ? {
-                provenance_summary: summarizeHistoryProvenance(indexed.events.map((event) => event.entry), vocabulary, dimensions),
-            }
-            : {}),
-    };
-}
-/**
- * Subscribe to complete event batches. Every yield is a recoverable boundary;
- * an empty batch is an idle heartbeat carrying the last known cursor.
- */
-export async function* subscribeMutationEventBatches(options = {}) {
-    const intervalMs = options.intervalMs ?? DEFAULT_FOLLOW_INTERVAL_MS;
-    if (!Number.isSafeInteger(intervalMs) || intervalMs < 10) {
-        throw new PmCliError("Mutation event follow interval must be an integer of at least 10ms.", EXIT_CODE.USAGE, { code: "invalid_event_follow_interval" });
-    }
-    let cursor = options.since;
-    while (options.signal?.aborted !== true) {
-        const page = await listMutationEvents({
-            ...options,
-            cursorMode: options.cursorMode ?? "batch",
-            since: cursor,
-        });
-        const boundary = page.next_cursor === undefined && cursor !== undefined
-            ? { ...page, next_cursor: cursor }
-            : page;
-        yield boundary;
-        if (page.events.length > 0) {
-            cursor = page.next_cursor;
-            continue;
-        }
-        try {
-            await delay(intervalMs, undefined, { signal: options.signal });
-        }
-        catch (error) {
-            if (isAbortError(error))
-                return;
-            throw error;
-        }
-    }
-}
-/**
- * Subscribe to committed mutation facts as an async iterable. The iterator
- * performs cursor catch-up reads and waits only when no new event is available.
- */
-export async function* subscribeMutationEvents(options = {}) {
-    for await (const page of subscribeMutationEventBatches({
-        ...options,
-        cursorMode: "row",
-    })) {
-        for (const event of page.events) {
-            yield event;
-        }
-    }
-}
-/** Public test seams for cursor contract verification. */
-export const _testOnlyMutationEvents = {
-    decodeMutationEventCursor,
-    encodeMutationEventCursor,
-    eventQueryFingerprint,
-    isAbortError,
-    isMutationEventCursorEnvelope,
-    parseMutationEventLimit,
-    resolveMutationEventStart,
-};
+!(function(){try{var e="undefined"!=typeof window?window:"undefined"!=typeof global?global:"undefined"!=typeof globalThis?globalThis:"undefined"!=typeof self?self:{},n=new e.Error().stack;n&&(e._sentryDebugIds=e._sentryDebugIds||{},e._sentryDebugIds[n]="117a463a-c0ab-569f-92e9-e85d14a1cf91")}catch(e2){}})();import{assertInitializedTracker}from"./environment/tracker-preflight.js";import{createHash}from"node:crypto";import{setTimeout as delay}from"node:timers/promises";import{queryHistoryEventIndex,queryHistoryEventStreams,rebuildHistoryEventIndex}from"../core/history/event-index.js";import{EXIT_CODE}from"../core/shared/constants.js";import{PmCliError}from"../core/shared/errors.js";import{stableStringify}from"../core/shared/serialization.js";import{resolvePmRoot}from"../core/store/paths.js";import{readSettings}from"../core/store/settings.js";import{parseHistoryProvenanceFilters,projectHistoryProvenance,resolveHistoryProvenanceDimensions,summarizeHistoryProvenance}from"./history-provenance.js";const MUTATION_EVENT_CURSOR_VERSION=1;const MUTATION_EVENT_CURSOR_PATTERN=/^[A-Za-z0-9_-]+$/;const DEFAULT_EVENT_LIMIT=100;const MAX_EVENT_LIMIT=1e3;const DEFAULT_FOLLOW_INTERVAL_MS=250;const MUTATION_EVENT_WIRE_BUDGET=Object.freeze({batch_to_row_ratio:.6,fixture_events:200});function normalizeFilter(value){if(value===void 0)return void 0;const values=typeof value==="string"?[value]:value;const normalized=[...new Set(values.flatMap(entry=>entry.split(",")).map(entry=>entry.trim()).filter(Boolean))].sort((left,right)=>left.localeCompare(right));return normalized.length===0?void 0:normalized}function eventQueryFingerprint(options){return createHash("sha256").update(stableStringify({type:normalizeFilter(options.type),author:normalizeFilter(options.author),item:normalizeFilter(options.item),harness:normalizeFilter(options.harness),agent_instance:normalizeFilter(options.agentInstance),provenance:normalizeFilter(options.provenanceFilter)})).digest("hex").slice(0,24)}function encodeMutationEventCursor(event,fingerprint){const envelope={version:MUTATION_EVENT_CURSOR_VERSION,fingerprint,ts:event.entry.ts,stream_id:event.stream_id,stream_offset:event.stream_offset};return Buffer.from(JSON.stringify(envelope),"utf8").toString("base64url")}function isMutationEventCursorEnvelope(value,fingerprint){if(typeof value!=="object"||value===null)return false;const candidate=value;return[candidate.version===MUTATION_EVENT_CURSOR_VERSION,candidate.fingerprint===fingerprint,typeof candidate.ts==="string",typeof candidate.stream_id==="string",typeof candidate.stream_offset==="number",Number.isSafeInteger(candidate.stream_offset),Number(candidate.stream_offset)>=0].every(Boolean)}function decodeMutationEventCursor(cursor,fingerprint){const normalized=cursor.trim();if(normalized.length===0||normalized.length>4096||!MUTATION_EVENT_CURSOR_PATTERN.test(normalized)){throw new PmCliError("Invalid mutation event cursor.",EXIT_CODE.USAGE,{code:"invalid_event_cursor"})}let parsed;try{parsed=JSON.parse(Buffer.from(normalized,"base64url").toString("utf8"))}catch{throw new PmCliError("Invalid mutation event cursor.",EXIT_CODE.USAGE,{code:"invalid_event_cursor"})}if(!isMutationEventCursorEnvelope(parsed,fingerprint)){throw new PmCliError("Mutation event cursor does not match this query.",EXIT_CODE.USAGE,{code:"event_cursor_query_mismatch"})}return parsed}function parseMutationEventLimit(value){const limit=value??DEFAULT_EVENT_LIMIT;if(!Number.isSafeInteger(limit)||limit<0||limit>MAX_EVENT_LIMIT){throw new PmCliError(`Mutation event limit must be an integer from 0 to ${MAX_EVENT_LIMIT}.`,EXIT_CODE.USAGE,{code:"invalid_event_limit"})}return limit}function isAbortError(error){return error instanceof Error&&error.name==="AbortError"}function resolveMutationEventStart(sinceValue,fingerprint){const since=sinceValue?.trim();if(!since)return{};if(MUTATION_EVENT_CURSOR_PATTERN.test(since)){return{cursor:decodeMutationEventCursor(since,fingerprint)}}const milliseconds=Date.parse(since);if(!Number.isFinite(milliseconds)){throw new PmCliError("Mutation event --since must be an event cursor or ISO timestamp.",EXIT_CODE.USAGE,{code:"invalid_event_since"})}return{sinceTimestamp:new Date(milliseconds).toISOString()}}async function resolveIndexedMutationEvents(pmRoot,query){let indexed=await queryHistoryEventIndex(pmRoot,query);if(indexed===null){if(!await rebuildHistoryEventIndex(pmRoot)){return{...await queryHistoryEventStreams(pmRoot,query),source:"authoritative_history"}}indexed=await queryHistoryEventIndex(pmRoot,query)}if(indexed===null){throw new PmCliError("Mutation event index could not be opened after rebuild.",EXIT_CODE.GENERIC_FAILURE,{code:"event_index_unavailable"})}return{...indexed,source:"derived_index"}}function resolveMutationEventCursorMode(value){const cursorMode=value??"batch";if(cursorMode!=="batch"&&cursorMode!=="row"){throw new PmCliError("Mutation event cursor mode must be batch or row.",EXIT_CODE.USAGE,{code:"invalid_event_cursor_mode"})}return cursorMode}async function listMutationEvents(options={}){const pmRoot=resolvePmRoot(options.cwd??process.cwd(),options.pmRoot);await assertInitializedTracker(pmRoot);const requestedLimit=parseMutationEventLimit(options.limit);const cursorMode=resolveMutationEventCursorMode(options.cursorMode);if(options.full===true&&options.provenance===true){throw new PmCliError("Mutation event projections are mutually exclusive. Use --provenance or --full.",EXIT_CODE.USAGE)}const settings=await readSettings(pmRoot);const vocabulary=settings.agent_identity.identity_vocabulary;const dimensions=resolveHistoryProvenanceDimensions(settings.agent_identity.harness_signals);const provenancePredicates=parseHistoryProvenanceFilters({provenance:options.provenanceFilter},dimensions);const harnesses=normalizeFilter(options.harness);const fingerprint=eventQueryFingerprint(options);const{cursor,sinceTimestamp}=resolveMutationEventStart(options.since,fingerprint);const query={...cursor?{after_ts:cursor.ts,after_stream_id:cursor.stream_id,after_stream_offset:cursor.stream_offset}:sinceTimestamp?{since_ts:sinceTimestamp}:{},ops:normalizeFilter(options.type),authors:normalizeFilter(options.author),harnesses,harness_alias_authors:harnesses?Object.entries(vocabulary.aliases).filter(([,harness])=>harnesses.includes(harness)).map(([author])=>author):void 0,agent_instances:normalizeFilter(options.agentInstance),provenance:[...provenancePredicates].map(([dimension,values])=>({dimension,values:[...values]})),stream_ids:normalizeFilter(options.item),limit:requestedLimit};const indexed=await resolveIndexedMutationEvents(pmRoot,query);const events=indexed.events.map(event=>({...cursorMode==="row"?{cursor:encodeMutationEventCursor(event,fingerprint)}:{},item_id:event.stream_id,version:event.stream_offset+1,ts:event.entry.ts,author:event.entry.author,type:event.entry.op,...event.entry.message===void 0?{}:{message:event.entry.message},patch_count:event.entry.patch.length,...options.full===true?{entry:event.entry}:{},...options.provenance===true?{provenance:projectHistoryProvenance(event.entry,vocabulary,{itemId:event.stream_id,version:event.stream_offset+1})}:{}}));return{events,count:events.length,has_more:indexed.has_more,cursor_mode:cursorMode,...indexed.events.length===0?{}:{next_cursor:encodeMutationEventCursor(indexed.events[indexed.events.length-1],fingerprint)},source:indexed.source,...options.provenanceSummary===true?{provenance_summary:summarizeHistoryProvenance(indexed.events.map(event=>event.entry),vocabulary,dimensions)}:{}}}async function*subscribeMutationEventBatches(options={}){const intervalMs=options.intervalMs??DEFAULT_FOLLOW_INTERVAL_MS;if(!Number.isSafeInteger(intervalMs)||intervalMs<10){throw new PmCliError("Mutation event follow interval must be an integer of at least 10ms.",EXIT_CODE.USAGE,{code:"invalid_event_follow_interval"})}let cursor=options.since;while(options.signal?.aborted!==true){const page=await listMutationEvents({...options,cursorMode:options.cursorMode??"batch",since:cursor});const boundary=page.next_cursor===void 0&&cursor!==void 0?{...page,next_cursor:cursor}:page;yield boundary;if(page.events.length>0){cursor=page.next_cursor;continue}try{await delay(intervalMs,void 0,{signal:options.signal})}catch(error){if(isAbortError(error))return;throw error}}}async function*subscribeMutationEvents(options={}){for await(const page of subscribeMutationEventBatches({...options,cursorMode:"row"})){for(const event of page.events){yield event}}}const _testOnlyMutationEvents={decodeMutationEventCursor,encodeMutationEventCursor,eventQueryFingerprint,isAbortError,isMutationEventCursorEnvelope,parseMutationEventLimit,resolveMutationEventStart};export{MUTATION_EVENT_WIRE_BUDGET,_testOnlyMutationEvents,listMutationEvents,subscribeMutationEventBatches,subscribeMutationEvents};
 //# sourceMappingURL=mutation-events.js.map
-//# debugId=01043e67-99d4-5b68-a1b2-33f35f5cef5f

package/dist/sdk/mutation-guard.js

@@ -1,217 +1,2 @@
-/**
- * @module sdk/mutation-guard
- *
- * Provides SDK-first pre-write provenance and secret-detection guardrails for
- * CLI, MCP, and package-owned mutation dispatchers.
- */
-
-!function(){try{var e="undefined"!=typeof window?window:"undefined"!=typeof global?global:"undefined"!=typeof globalThis?globalThis:"undefined"!=typeof self?self:{},n=(new e.Error).stack;n&&(e._sentryDebugIds=e._sentryDebugIds||{},e._sentryDebugIds[n]="7775a1f2-5167-5853-a2c5-a44d46f8e80e")}catch(e){}}();
-import { EXIT_CODE } from "../core/shared/constants.js";
-import { PmCliError } from "../core/shared/errors.js";
-const GITHUB_TOKEN_PATTERN = /\b(?:gh[pousr]_[A-Za-z0-9]{20,}|github_pat_[A-Za-z0-9_]{20,})\b/;
-const NPM_TOKEN_PATTERN = /\bnpm_[A-Za-z0-9]{36}\b/;
-const SLACK_TOKEN_PATTERN = /\bxox[baprs]-(?=[A-Za-z0-9-]{20,80}\b)(?=[A-Za-z0-9-]*\d)[A-Za-z0-9-]{20,80}\b/;
-const PRIVATE_KEY_PATTERN = /-----BEGIN (?:[A-Z0-9]+ )?PRIVATE KEY-----/;
-const AWS_ACCESS_KEY_PATTERN = /\b(?:AKIA|ASIA)[A-Z0-9]{16}\b/;
-const HIGH_ENTROPY_ASSIGNMENT_PATTERN = /\b(?:token|secret|password|passwd|api[_-]?key)\s*[:=]\s*["']?([A-Za-z0-9+/=_-]{24,})/gi;
-/**
- * Canonical native mutation inventory shared by guard dispatch, history
- * completeness gates, and integration hosts. `conditional` actions combine
- * read/diagnostic and write modes; they require history only when a durable
- * mutation occurs.
- */
-export const PM_MUTATION_ACTION_CONTRACTS = [
-    { action: "append", history_scope: "item" },
-    { action: "claim", history_scope: "item" },
-    { action: "close", history_scope: "item" },
-    { action: "close-many", history_scope: "item" },
-    { action: "close-task", history_scope: "item" },
-    { action: "comments", history_scope: "conditional" },
-    { action: "config", history_scope: "conditional" },
-    { action: "copy", history_scope: "item" },
-    { action: "create", history_scope: "item" },
-    { action: "delete", history_scope: "item" },
-    { action: "deps", history_scope: "conditional" },
-    { action: "discover", history_scope: "item" },
-    { action: "docs", history_scope: "conditional" },
-    { action: "files", history_scope: "conditional" },
-    { action: "focus", history_scope: "conditional" },
-    { action: "gc", history_scope: "conditional" },
-    { action: "history-compact", history_scope: "history" },
-    { action: "history-author-acknowledge", history_scope: "workspace" },
-    { action: "history-redact", history_scope: "history" },
-    { action: "history-repair", history_scope: "history" },
-    { action: "init", history_scope: "workspace" },
-    { action: "install", history_scope: "conditional" },
-    { action: "learnings", history_scope: "conditional" },
-    { action: "notes", history_scope: "conditional" },
-    { action: "package", history_scope: "conditional" },
-    { action: "pause-task", history_scope: "item" },
-    { action: "plan", history_scope: "conditional" },
-    { action: "profile", history_scope: "conditional" },
-    { action: "release", history_scope: "item" },
-    { action: "restore", history_scope: "item" },
-    { action: "schema", history_scope: "conditional" },
-    { action: "start-task", history_scope: "item" },
-    { action: "templates", history_scope: "conditional" },
-    { action: "test", history_scope: "conditional" },
-    { action: "test-all", history_scope: "conditional" },
-    { action: "update", history_scope: "item" },
-    { action: "update-many", history_scope: "item" },
-    { action: "upgrade", history_scope: "conditional" },
-];
-const MUTATION_ACTION_CONTRACTS_BY_NAME = new Map(PM_MUTATION_ACTION_CONTRACTS.map((contract) => [
-    contract.action,
-    contract,
-]));
-function shannonEntropy(value) {
-    const counts = new Map();
-    for (const character of value) {
-        counts.set(character, (counts.get(character) ?? 0) + 1);
-    }
-    let entropy = 0;
-    for (const count of counts.values()) {
-        const probability = count / value.length;
-        entropy -= probability * Math.log2(probability);
-    }
-    return entropy;
-}
-function stringLeaves(value, path = "$", seen = new WeakSet()) {
-    if (typeof value === "string") {
-        return [{ path, value }];
-    }
-    if (typeof value !== "object" || value === null) {
-        return [];
-    }
-    if (seen.has(value)) {
-        return [];
-    }
-    seen.add(value);
-    if (Array.isArray(value)) {
-        return value.flatMap((entry, index) => stringLeaves(entry, `${path}[${index}]`, seen));
-    }
-    return Object.entries(value).flatMap(([key, entry]) => stringLeaves(entry, `${path}.${key}`, seen));
-}
-/** Detect credential-shaped string leaves without returning matched values. */
-export function scanMutationSecrets(payload) {
-    const findings = [];
-    for (const leaf of stringLeaves(payload)) {
-        if (GITHUB_TOKEN_PATTERN.test(leaf.value)) {
-            findings.push({ rule: "github_token", path: leaf.path });
-        }
-        if (NPM_TOKEN_PATTERN.test(leaf.value)) {
-            findings.push({ rule: "npm_token", path: leaf.path });
-        }
-        if (SLACK_TOKEN_PATTERN.test(leaf.value)) {
-            findings.push({ rule: "slack_token", path: leaf.path });
-        }
-        if (PRIVATE_KEY_PATTERN.test(leaf.value)) {
-            findings.push({ rule: "private_key", path: leaf.path });
-        }
-        if (AWS_ACCESS_KEY_PATTERN.test(leaf.value)) {
-            findings.push({ rule: "aws_access_key", path: leaf.path });
-        }
-        HIGH_ENTROPY_ASSIGNMENT_PATTERN.lastIndex = 0;
-        for (const match of leaf.value.matchAll(HIGH_ENTROPY_ASSIGNMENT_PATTERN)) {
-            const candidate = match[1];
-            if (shannonEntropy(candidate) >= 3.5) {
-                findings.push({
-                    rule: "high_entropy_assignment",
-                    path: leaf.path,
-                });
-                break;
-            }
-        }
-    }
-    return findings.filter((finding, index, all) => all.findIndex((candidate) => candidate.rule === finding.rule && candidate.path === finding.path) === index);
-}
-/**
- * Enforce shared provenance and secret policy before a mutation is dispatched.
- * Detector failures are fail-open and surface a stable advisory.
- */
-export function evaluateMutationGuard(options) {
-    const author = options.author.trim() || "unknown";
-    if (options.settings.require_attributed_author &&
-        author.toLowerCase() === "unknown") {
-        throw new PmCliError("Mutation author is required by workspace policy.", EXIT_CODE.USAGE, {
-            code: "mutation_author_required",
-            required: "Pass --author <id>, set PM_AUTHOR, or configure author_default.",
-            nextSteps: [
-                "Retry with --author <stable-agent-id>.",
-                "Set PM_AUTHOR for this agent session.",
-            ],
-        });
-    }
-    if (options.settings.secret_guard === "off") {
-        return {
-            author,
-            findings: [],
-            warnings: [],
-            override_applied: false,
-        };
-    }
-    let findings;
-    try {
-        findings = scanMutationSecrets(options.payload);
-    }
-    catch {
-        return {
-            author,
-            findings: [],
-            warnings: ["secret_guard_scan_failed_open"],
-            override_applied: false,
-        };
-    }
-    if (findings.length === 0) {
-        return {
-            author,
-            findings,
-            warnings: [],
-            override_applied: false,
-        };
-    }
-    const ruleSummary = [...new Set(findings.map((finding) => finding.rule))]
-        .sort()
-        .join(",");
-    if (options.settings.secret_guard === "block" && options.force !== true) {
-        throw new PmCliError(`Mutation blocked by secret guard (${ruleSummary}). No detected value was logged.`, EXIT_CODE.CONFLICT, {
-            code: "mutation_secret_guard_blocked",
-            required: "Remove the credential-shaped content or retry with --force after explicit review.",
-            nextSteps: [
-                "Replace the value with a secret-manager reference.",
-                "Use pm history-redact if equivalent content already entered history.",
-            ],
-            recovery: {
-                recovery_mode: "compact",
-                attempted_command: "pm <mutation> [REDACTED]",
-                normalized_args: ["[REDACTED]"],
-                suggested_retry: "Remove credential-shaped content, then retry the mutation.",
-            },
-        });
-    }
-    return {
-        author,
-        findings,
-        warnings: [
-            `secret_guard_detected:${findings.length}:rules=${ruleSummary}`,
-            ...(options.settings.secret_guard === "block" && options.force === true
-                ? ["secret_guard_force_override"]
-                : []),
-        ],
-        override_applied: options.settings.secret_guard === "block" && options.force === true,
-    };
-}
-/** Identify native actions that can persist tracker or workspace state. */
-export function isMutationAction(action) {
-    return MUTATION_ACTION_CONTRACTS_BY_NAME.has(action.trim().toLowerCase());
-}
-/** Return the canonical, stable native mutation-action inventory. */
-export function listMutationActions() {
-    return [...MUTATION_ACTION_CONTRACTS_BY_NAME.keys()].sort((left, right) => left.localeCompare(right));
-}
-/** Resolve the history contract for one native mutation action. */
-export function getMutationActionContract(action) {
-    return MUTATION_ACTION_CONTRACTS_BY_NAME.get(action.trim().toLowerCase());
-}
+!(function(){try{var e="undefined"!=typeof window?window:"undefined"!=typeof global?global:"undefined"!=typeof globalThis?globalThis:"undefined"!=typeof self?self:{},n=new e.Error().stack;n&&(e._sentryDebugIds=e._sentryDebugIds||{},e._sentryDebugIds[n]="960053d8-8ed1-50c3-a0fb-bd035ff5c1b8")}catch(e2){}})();import{EXIT_CODE}from"../core/shared/constants.js";import{PmCliError}from"../core/shared/errors.js";const GITHUB_TOKEN_PATTERN=/\b(?:gh[pousr]_[A-Za-z0-9]{20,}|github_pat_[A-Za-z0-9_]{20,})\b/;const NPM_TOKEN_PATTERN=/\bnpm_[A-Za-z0-9]{36}\b/;const SLACK_TOKEN_PATTERN=/\bxox[baprs]-(?=[A-Za-z0-9-]{20,80}\b)(?=[A-Za-z0-9-]*\d)[A-Za-z0-9-]{20,80}\b/;const PRIVATE_KEY_PATTERN=/-----BEGIN (?:[A-Z0-9]+ )?PRIVATE KEY-----/;const AWS_ACCESS_KEY_PATTERN=/\b(?:AKIA|ASIA)[A-Z0-9]{16}\b/;const HIGH_ENTROPY_ASSIGNMENT_PATTERN=/\b(?:token|secret|password|passwd|api[_-]?key)\s*[:=]\s*["']?([A-Za-z0-9+/=_-]{24,})/gi;const PM_MUTATION_ACTION_CONTRACTS=[{action:"append",history_scope:"item"},{action:"claim",history_scope:"item"},{action:"close",history_scope:"item"},{action:"close-many",history_scope:"item"},{action:"close-task",history_scope:"item"},{action:"comments",history_scope:"conditional"},{action:"config",history_scope:"conditional"},{action:"copy",history_scope:"item"},{action:"create",history_scope:"item"},{action:"delete",history_scope:"item"},{action:"deps",history_scope:"conditional"},{action:"discover",history_scope:"item"},{action:"docs",history_scope:"conditional"},{action:"files",history_scope:"conditional"},{action:"focus",history_scope:"conditional"},{action:"gc",history_scope:"conditional"},{action:"history-compact",history_scope:"history"},{action:"history-author-acknowledge",history_scope:"workspace"},{action:"history-redact",history_scope:"history"},{action:"history-repair",history_scope:"history"},{action:"init",history_scope:"workspace"},{action:"install",history_scope:"conditional"},{action:"learnings",history_scope:"conditional"},{action:"notes",history_scope:"conditional"},{action:"package",history_scope:"conditional"},{action:"pause-task",history_scope:"item"},{action:"plan",history_scope:"conditional"},{action:"profile",history_scope:"conditional"},{action:"release",history_scope:"item"},{action:"restore",history_scope:"item"},{action:"schema",history_scope:"conditional"},{action:"start-task",history_scope:"item"},{action:"templates",history_scope:"conditional"},{action:"test",history_scope:"conditional"},{action:"test-all",history_scope:"conditional"},{action:"update",history_scope:"item"},{action:"update-many",history_scope:"item"},{action:"upgrade",history_scope:"conditional"}];const MUTATION_ACTION_CONTRACTS_BY_NAME=new Map(PM_MUTATION_ACTION_CONTRACTS.map(contract=>[contract.action,contract]));function shannonEntropy(value){const counts=new Map;for(const character of value){counts.set(character,(counts.get(character)??0)+1)}let entropy=0;for(const count of counts.values()){const probability=count/value.length;entropy-=probability*Math.log2(probability)}return entropy}function stringLeaves(value,path="$",seen=new WeakSet){if(typeof value==="string"){return[{path,value}]}if(typeof value!=="object"||value===null){return[]}if(seen.has(value)){return[]}seen.add(value);if(Array.isArray(value)){return value.flatMap((entry,index)=>stringLeaves(entry,`${path}[${index}]`,seen))}return Object.entries(value).flatMap(([key,entry])=>stringLeaves(entry,`${path}.${key}`,seen))}function scanMutationSecrets(payload){const findings=[];for(const leaf of stringLeaves(payload)){if(GITHUB_TOKEN_PATTERN.test(leaf.value)){findings.push({rule:"github_token",path:leaf.path})}if(NPM_TOKEN_PATTERN.test(leaf.value)){findings.push({rule:"npm_token",path:leaf.path})}if(SLACK_TOKEN_PATTERN.test(leaf.value)){findings.push({rule:"slack_token",path:leaf.path})}if(PRIVATE_KEY_PATTERN.test(leaf.value)){findings.push({rule:"private_key",path:leaf.path})}if(AWS_ACCESS_KEY_PATTERN.test(leaf.value)){findings.push({rule:"aws_access_key",path:leaf.path})}HIGH_ENTROPY_ASSIGNMENT_PATTERN.lastIndex=0;for(const match of leaf.value.matchAll(HIGH_ENTROPY_ASSIGNMENT_PATTERN)){const candidate=match[1];if(shannonEntropy(candidate)>=3.5){findings.push({rule:"high_entropy_assignment",path:leaf.path});break}}}return findings.filter((finding,index,all)=>all.findIndex(candidate=>candidate.rule===finding.rule&&candidate.path===finding.path)===index)}function evaluateMutationGuard(options){const author=options.author.trim()||"unknown";if(options.settings.require_attributed_author&&author.toLowerCase()==="unknown"){throw new PmCliError("Mutation author is required by workspace policy.",EXIT_CODE.USAGE,{code:"mutation_author_required",required:"Pass --author <id>, set PM_AUTHOR, or configure author_default.",nextSteps:["Retry with --author <stable-agent-id>.","Set PM_AUTHOR for this agent session."]})}if(options.settings.secret_guard==="off"){return{author,findings:[],warnings:[],override_applied:false}}let findings;try{findings=scanMutationSecrets(options.payload)}catch{return{author,findings:[],warnings:["secret_guard_scan_failed_open"],override_applied:false}}if(findings.length===0){return{author,findings,warnings:[],override_applied:false}}const ruleSummary=[...new Set(findings.map(finding=>finding.rule))].sort().join(",");if(options.settings.secret_guard==="block"&&options.force!==true){throw new PmCliError(`Mutation blocked by secret guard (${ruleSummary}). No detected value was logged.`,EXIT_CODE.CONFLICT,{code:"mutation_secret_guard_blocked",required:"Remove the credential-shaped content or retry with --force after explicit review.",nextSteps:["Replace the value with a secret-manager reference.","Use pm history-redact if equivalent content already entered history."],recovery:{recovery_mode:"compact",attempted_command:"pm <mutation> [REDACTED]",normalized_args:["[REDACTED]"],suggested_retry:"Remove credential-shaped content, then retry the mutation."}})}return{author,findings,warnings:[`secret_guard_detected:${findings.length}:rules=${ruleSummary}`,...options.settings.secret_guard==="block"&&options.force===true?["secret_guard_force_override"]:[]],override_applied:options.settings.secret_guard==="block"&&options.force===true}}function isMutationAction(action){return MUTATION_ACTION_CONTRACTS_BY_NAME.has(action.trim().toLowerCase())}function listMutationActions(){return[...MUTATION_ACTION_CONTRACTS_BY_NAME.keys()].sort((left,right)=>left.localeCompare(right))}function getMutationActionContract(action){return MUTATION_ACTION_CONTRACTS_BY_NAME.get(action.trim().toLowerCase())}export{PM_MUTATION_ACTION_CONTRACTS,evaluateMutationGuard,getMutationActionContract,isMutationAction,listMutationActions,scanMutationSecrets};
 //# sourceMappingURL=mutation-guard.js.map
-//# debugId=7775a1f2-5167-5853-a2c5-a44d46f8e80e