@vibgrate/cli 2026.729.1 → 2026.729.3

package/dist/chunk-543E6WDJ.js

@@ -0,0 +1,61 @@
+// src/code/secrets.ts
+var SECRET_FILE = new RegExp(
+  [
+    String.raw`(^|/)\.env(\.[\w.-]+)?$`,
+    // .env, .env.local, .env.production
+    String.raw`(^|/)\.npmrc$`,
+    String.raw`(^|/)\.netrc$`,
+    String.raw`(^|/)\.pgpass$`,
+    String.raw`(^|/)\.git-credentials$`,
+    String.raw`(^|/)id_(rsa|dsa|ecdsa|ed25519)$`,
+    String.raw`\.pem$`,
+    String.raw`\.key$`,
+    String.raw`\.p12$`,
+    String.raw`\.pfx$`,
+    String.raw`(^|/)credentials(\.json)?$`,
+    // aws credentials, gcloud
+    String.raw`(^|/)\.aws/credentials$`,
+    String.raw`(^|/)secrets?\.(ya?ml|json|toml|env)$`
+  ].join("|"),
+  "i"
+);
+function isSecretPath(file) {
+  const normalized = file.replace(/\\/g, "/");
+  return SECRET_FILE.test(normalized);
+}
+function secretRefusal(file) {
+  return `refusing to read ${file} \u2014 it looks like a secrets/credentials file, and this content would be sent to the model. Reference the values by name instead, or read a non-secret file.`;
+}
+var TOKEN_SHAPES = /\b(sk|pk|rk|xoxb|xoxp|ghp|gho|ghs|ghu|glpat|AKIA|ASIA|AIza|ya29|hf|nvapi|sk-ant|sk-or)[-_][A-Za-z0-9\-_./+]{8,}/g;
+var BEARER = /\b(Authorization|Bearer|token|api[_-]?key)\b\s*[:=]\s*['"]?[A-Za-z0-9\-_./+]{12,}['"]?/gi;
+var ASSIGNMENT = /\b([A-Za-z0-9_]*(?:KEY|TOKEN|SECRET|PASSWORD|PASSWD|PWD|CREDENTIAL|PRIVATE|ACCESS|SESSION)[A-Za-z0-9_]*)\s*([:=])\s*['"]?([^\s'";,]{6,})/gi;
+var URL_AUTH = /\b([a-z][a-z0-9+.-]*:\/\/)([^:/\s]+):([^@/\s]+)@/gi;
+function redactText(text) {
+  return text.replace(URL_AUTH, "$1$2:***redacted***@").replace(TOKEN_SHAPES, (_m, prefix) => `${prefix}-***redacted***`).replace(BEARER, (_m, k) => `${k}: ***redacted***`).replace(ASSIGNMENT, (_m, name, op) => `${name}${op}***redacted***`);
+}
+function findSecretShapes(text) {
+  const hits = [];
+  const scan = (re, kind) => {
+    re.lastIndex = 0;
+    let m;
+    while ((m = re.exec(text)) !== null) {
+      hits.push({ kind, index: m.index });
+      if (m[0].length === 0) re.lastIndex++;
+    }
+  };
+  scan(TOKEN_SHAPES, "token");
+  scan(BEARER, "bearer");
+  scan(ASSIGNMENT, "assignment");
+  scan(URL_AUTH, "url-auth");
+  return hits.sort((a, b) => a.index - b.index || a.kind.localeCompare(b.kind));
+}
+function secretEgressRefusal(text, surface = "network payload") {
+  const hits = findSecretShapes(text);
+  if (hits.length === 0) return null;
+  const kinds = [...new Set(hits.map((h) => h.kind))].sort().join(", ");
+  return `refusing to send ${surface} \u2014 detected credential-shaped content (${kinds}). Remove secrets before any network call; path-level secrets files are also blocked.`;
+}
+
+export { isSecretPath, redactText, secretEgressRefusal, secretRefusal };
+//# sourceMappingURL=chunk-543E6WDJ.js.map
+//# sourceMappingURL=chunk-543E6WDJ.js.map

package/dist/chunk-543E6WDJ.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/code/secrets.ts"],"names":[],"mappings":";AAkBA,IAAM,cAAc,IAAI,MAAA;AAAA,EACtB;AAAA,IACE,MAAA,CAAO,GAAA,CAAA,uBAAA,CAAA;AAAA;AAAA,IACP,MAAA,CAAO,GAAA,CAAA,aAAA,CAAA;AAAA,IACP,MAAA,CAAO,GAAA,CAAA,aAAA,CAAA;AAAA,IACP,MAAA,CAAO,GAAA,CAAA,cAAA,CAAA;AAAA,IACP,MAAA,CAAO,GAAA,CAAA,uBAAA,CAAA;AAAA,IACP,MAAA,CAAO,GAAA,CAAA,gCAAA,CAAA;AAAA,IACP,MAAA,CAAO,GAAA,CAAA,MAAA,CAAA;AAAA,IACP,MAAA,CAAO,GAAA,CAAA,MAAA,CAAA;AAAA,IACP,MAAA,CAAO,GAAA,CAAA,MAAA,CAAA;AAAA,IACP,MAAA,CAAO,GAAA,CAAA,MAAA,CAAA;AAAA,IACP,MAAA,CAAO,GAAA,CAAA,0BAAA,CAAA;AAAA;AAAA,IACP,MAAA,CAAO,GAAA,CAAA,uBAAA,CAAA;AAAA,IACP,MAAA,CAAO,GAAA,CAAA,qCAAA;AAAA,GACT,CAAE,KAAK,GAAG,CAAA;AAAA,EACV;AACF,CAAA;AAGO,SAAS,aAAa,IAAA,EAAuB;AAClD,EAAA,MAAM,UAAA,GAAa,IAAA,CAAK,OAAA,CAAQ,KAAA,EAAO,GAAG,CAAA;AAC1C,EAAA,OAAO,WAAA,CAAY,KAAK,UAAU,CAAA;AACpC;AAGO,SAAS,cAAc,IAAA,EAAsB;AAClD,EAAA,OAAO,oBAAoB,IAAI,CAAA,+JAAA,CAAA;AACjC;AAGA,IAAM,YAAA,GAAe,kHAAA;AACrB,IAAM,MAAA,GAAS,0FAAA;AAEf,IAAM,UAAA,GAAa,4IAAA;AACnB,IAAM,QAAA,GAAW,oDAAA;AAOV,SAAS,WAAW,IAAA,EAAsB;AAC/C,EAAA,OAAO,IAAA,CACJ,OAAA,CAAQ,QAAA,EAAU,sBAAsB,EACxC,OAAA,CAAQ,YAAA,EAAc,CAAC,EAAA,EAAI,MAAA,KAAW,CAAA,EAAG,MAAM,CAAA,eAAA,CAAiB,EAChE,OAAA,CAAQ,MAAA,EAAQ,CAAC,EAAA,EAAI,CAAA,KAAM,CAAA,EAAG,CAAC,CAAA,gBAAA,CAAkB,EACjD,OAAA,CAAQ,UAAA,EAAY,CAAC,EAAA,EAAI,MAAM,EAAA,KAAO,CAAA,EAAG,IAAI,CAAA,EAAG,EAAE,CAAA,cAAA,CAAgB,CAAA;AACvE;AAeO,SAAS,iBAAiB,IAAA,EAAgC;AAC/D,EAAA,MAAM,OAAyB,EAAC;AAChC,EAAA,MAAM,IAAA,GAAO,CAAC,EAAA,EAAY,IAAA,KAAgC;AACxD,IAAA,EAAA,CAAG,SAAA,GAAY,CAAA;AACf,IAAA,IAAI,CAAA;AACJ,IAAA,OAAA,CAAQ,CAAA,GAAI,EAAA,CAAG,IAAA,CAAK,IAAI,OAAO,IAAA,EAAM;AACnC,MAAA,IAAA,CAAK,KAAK,EAAE,IAAA,EAAM,KAAA,EAAO,CAAA,CAAE,OAAO,CAAA;AAClC,MAAA,IAAI,CAAA,CAAE,CAAC,CAAA,CAAE,MAAA,KAAW,GAAG,EAAA,CAAG,SAAA,EAAA;AAAA,IAC5B;AAAA,EACF,CAAA;AACA,EAAA,IAAA,CAAK,cAAc,OAAO,CAAA;AAC1B,EAAA,IAAA,CAAK,QAAQ,QAAQ,CAAA;AACrB,EAAA,IAAA,CAAK,YAAY,YAAY,CAAA;AAC7B,EAAA,IAAA,CAAK,UAAU,UAAU,CAAA;AACzB,EAAA,OAAO,IAAA,CAAK,IAAA,CAAK,CAAC,CAAA,EAAG,MAAM,CAAA,CAAE,KAAA,GAAQ,CAAA,CAAE,KAAA,IAAS,CAAA,CAAE,IAAA,CAAK,aAAA,CAAc,CAAA,CAAE,IAAI,CAAC,CAAA;AAC9E;AAWO,SAAS,mBAAA,CAAoB,IAAA,EAAc,OAAA,GAAU,iBAAA,EAAkC;AAC5F,EAAA,MAAM,IAAA,GAAO,iBAAiB,IAAI,CAAA;AAClC,EAAA,IAAI,IAAA,CAAK,MAAA,KAAW,CAAA,EAAG,OAAO,IAAA;AAC9B,EAAA,MAAM,QAAQ,CAAC,GAAG,IAAI,GAAA,CAAI,KAAK,GAAA,CAAI,CAAC,CAAA,KAAM,CAAA,CAAE,IAAI,CAAC,CAAC,EAAE,IAAA,EAAK,CAAE,KAAK,IAAI,CAAA;AACpE,EAAA,OACE,CAAA,iBAAA,EAAoB,OAAO,CAAA,4CAAA,EAA0C,KAAK,CAAA,qFAAA,CAAA;AAG9E","file":"chunk-543E6WDJ.js","sourcesContent":["/**\n * Secret-safe file access for the VG Code agent (VG-CLI-CODE §13, GUARDRAILS §1.1).\n *\n * The agent reads files and hands them to a model — which, for a hosted model,\n * means they leave the machine. So a coding agent that will happily open `.env`\n * or a private key and paste it into a prompt is a credential-egress bug. Two\n * defenses, applied at the boundary (before anything reaches the model):\n *\n *  1. **Refuse** to read files that exist only to hold secrets (`.env`, key\n *     material, `.npmrc`, `.netrc`, cloud credentials…).\n *  2. **Redact** credential shapes from the content of any file we *do* read —\n *     token prefixes, `Authorization` headers, and `NAME_KEY=value` style\n *     assignments — so a stray secret in an otherwise-normal file is masked.\n *\n * Pure and unit-tested; no I/O here.\n */\n\n/** Files whose whole purpose is secrets — never read them into a prompt. */\nconst SECRET_FILE = new RegExp(\n  [\n    String.raw`(^|/)\\.env(\\.[\\w.-]+)?$`, // .env, .env.local, .env.production\n    String.raw`(^|/)\\.npmrc$`,\n    String.raw`(^|/)\\.netrc$`,\n    String.raw`(^|/)\\.pgpass$`,\n    String.raw`(^|/)\\.git-credentials$`,\n    String.raw`(^|/)id_(rsa|dsa|ecdsa|ed25519)$`,\n    String.raw`\\.pem$`,\n    String.raw`\\.key$`,\n    String.raw`\\.p12$`,\n    String.raw`\\.pfx$`,\n    String.raw`(^|/)credentials(\\.json)?$`, // aws credentials, gcloud\n    String.raw`(^|/)\\.aws/credentials$`,\n    String.raw`(^|/)secrets?\\.(ya?ml|json|toml|env)$`,\n  ].join('|'),\n  'i',\n);\n\n/** Whether a path should never be read into a model prompt. */\nexport function isSecretPath(file: string): boolean {\n  const normalized = file.replace(/\\\\/g, '/');\n  return SECRET_FILE.test(normalized);\n}\n\n/** A one-line, actionable refusal message for a blocked read. */\nexport function secretRefusal(file: string): string {\n  return `refusing to read ${file} — it looks like a secrets/credentials file, and this content would be sent to the model. Reference the values by name instead, or read a non-secret file.`;\n}\n\n// Known credential token prefixes (same family the ingest redaction guards).\nconst TOKEN_SHAPES = /\\b(sk|pk|rk|xoxb|xoxp|ghp|gho|ghs|ghu|glpat|AKIA|ASIA|AIza|ya29|hf|nvapi|sk-ant|sk-or)[-_][A-Za-z0-9\\-_./+]{8,}/g;\nconst BEARER = /\\b(Authorization|Bearer|token|api[_-]?key)\\b\\s*[:=]\\s*['\"]?[A-Za-z0-9\\-_./+]{12,}['\"]?/gi;\n// `NAME_KEY=secret`, `PASSWORD: \"…\"`, connection strings — mask the value only.\nconst ASSIGNMENT = /\\b([A-Za-z0-9_]*(?:KEY|TOKEN|SECRET|PASSWORD|PASSWD|PWD|CREDENTIAL|PRIVATE|ACCESS|SESSION)[A-Za-z0-9_]*)\\s*([:=])\\s*['\"]?([^\\s'\";,]{6,})/gi;\nconst URL_AUTH = /\\b([a-z][a-z0-9+.-]*:\\/\\/)([^:/\\s]+):([^@/\\s]+)@/gi;\n\n/**\n * Redact credential shapes from text before it reaches the model. Masks the\n * secret value, never the surrounding structure, so the model still sees that a\n * key exists (and its name) without seeing the value.\n */\nexport function redactText(text: string): string {\n  return text\n    .replace(URL_AUTH, '$1$2:***redacted***@')\n    .replace(TOKEN_SHAPES, (_m, prefix) => `${prefix}-***redacted***`)\n    .replace(BEARER, (_m, k) => `${k}: ***redacted***`)\n    .replace(ASSIGNMENT, (_m, name, op) => `${name}${op}***redacted***`);\n}\n\nexport type SecretShapeKind = 'token' | 'bearer' | 'assignment' | 'url-auth';\n\nexport interface SecretShapeHit {\n  kind: SecretShapeKind;\n  /** Character index of the match in the original text. */\n  index: number;\n}\n\n/**\n * Locate credential shapes without redacting. Used to refuse network egress\n * (and similar) when a payload still contains secrets — defense-in-depth on\n * top of path refusal + redaction.\n */\nexport function findSecretShapes(text: string): SecretShapeHit[] {\n  const hits: SecretShapeHit[] = [];\n  const scan = (re: RegExp, kind: SecretShapeKind): void => {\n    re.lastIndex = 0;\n    let m: RegExpExecArray | null;\n    while ((m = re.exec(text)) !== null) {\n      hits.push({ kind, index: m.index });\n      if (m[0].length === 0) re.lastIndex++;\n    }\n  };\n  scan(TOKEN_SHAPES, 'token');\n  scan(BEARER, 'bearer');\n  scan(ASSIGNMENT, 'assignment');\n  scan(URL_AUTH, 'url-auth');\n  return hits.sort((a, b) => a.index - b.index || a.kind.localeCompare(b.kind));\n}\n\n/** True when {@link findSecretShapes} finds at least one credential shape. */\nexport function containsSecretShapes(text: string): boolean {\n  return findSecretShapes(text).length > 0;\n}\n\n/**\n * Refuse network-bound payloads that still carry secret shapes after redaction\n * would be expected. Returns an actionable reason, or null when safe.\n */\nexport function secretEgressRefusal(text: string, surface = 'network payload'): string | null {\n  const hits = findSecretShapes(text);\n  if (hits.length === 0) return null;\n  const kinds = [...new Set(hits.map((h) => h.kind))].sort().join(', ');\n  return (\n    `refusing to send ${surface} — detected credential-shaped content (${kinds}). ` +\n    `Remove secrets before any network call; path-level secrets files are also blocked.`\n  );\n}\n"]}

package/dist/{chunk-JIBOJTGS.js → chunk-5HYCB55P.js}

@@ -78,105 +78,6 @@ function trieEnumerateWords(root, limit = 4096) {
   walk(root, "");
   return out;
 }
-
-// src/runtime/identifier-mask.ts
-var IDENT_RE = /\b[A-Za-z_][A-Za-z0-9_]{2,}\b/g;
-var STOP = /* @__PURE__ */ new Set([
-  "the",
-  "and",
-  "for",
-  "var",
-  "let",
-  "const",
-  "function",
-  "class",
-  "return",
-  "import",
-  "export",
-  "from",
-  "async",
-  "await",
-  "true",
-  "false",
-  "null",
-  "undefined",
-  "this",
-  "new",
-  "typeof",
-  "interface",
-  "type",
-  "string",
-  "number",
-  "boolean",
-  "void",
-  "any",
-  "unknown",
-  "Promise",
-  "Array",
-  "Object",
-  "Error",
-  "console",
-  "process",
-  "require",
-  "module",
-  "exports",
-  "default",
-  "extends",
-  "implements",
-  "public",
-  "private",
-  "protected",
-  "static",
-  "readonly",
-  "if",
-  "else",
-  "while",
-  "switch",
-  "case",
-  "break",
-  "continue",
-  "try",
-  "catch",
-  "finally",
-  "throw",
-  "with",
-  "yield",
-  "of",
-  "in",
-  "as",
-  "is",
-  "get",
-  "set"
-]);
-function extractIdentifiers(text) {
-  const out = /* @__PURE__ */ new Set();
-  for (const m of text.matchAll(IDENT_RE)) {
-    const t = m[0];
-    if (STOP.has(t) || STOP.has(t.toLowerCase())) continue;
-    out.add(t);
-  }
-  return [...out].sort();
-}
-function scanIdentifiersAgainstTrie(text, trie) {
-  const known = [];
-  const unknown = [];
-  for (const id of extractIdentifiers(text)) {
-    if (trieHas(trie, id) || trieHasPrefix(trie, id)) known.push(id);
-    else unknown.push(id);
-  }
-  return { known, unknown, clean: unknown.length === 0 };
-}
-function maskAllowedNextChars(trie, partialIdent) {
-  return trieAllowedNextChars(trie, partialIdent);
-}
-function annotateUnknownIdentifiers(text, trie) {
-  const scan = scanIdentifiersAgainstTrie(text, trie);
-  if (scan.clean) return { text, unknown: [] };
-  const note = `
-
-/* vg: unknown identifiers vs graph (not rewritten): ${scan.unknown.slice(0, 12).join(", ")}${scan.unknown.length > 12 ? "\u2026" : ""} */`;
-  return { text: text + note, unknown: scan.unknown };
-}
 var KV_CACHE_SCHEMA = "kv-cache/0";
 function contentHash(text) {
   return createHash("sha256").update(text, "utf8").digest("hex");
@@ -308,6 +209,105 @@ function graphDraftCandidates(knownVerbatim, max = 8) {
   return knownVerbatim.map((s) => s.trim()).filter((s) => s.length >= 8 && s.length <= 400).slice(0, max);
 }
 
+// src/runtime/identifier-mask.ts
+var IDENT_RE = /\b[A-Za-z_][A-Za-z0-9_]{2,}\b/g;
+var STOP = /* @__PURE__ */ new Set([
+  "the",
+  "and",
+  "for",
+  "var",
+  "let",
+  "const",
+  "function",
+  "class",
+  "return",
+  "import",
+  "export",
+  "from",
+  "async",
+  "await",
+  "true",
+  "false",
+  "null",
+  "undefined",
+  "this",
+  "new",
+  "typeof",
+  "interface",
+  "type",
+  "string",
+  "number",
+  "boolean",
+  "void",
+  "any",
+  "unknown",
+  "Promise",
+  "Array",
+  "Object",
+  "Error",
+  "console",
+  "process",
+  "require",
+  "module",
+  "exports",
+  "default",
+  "extends",
+  "implements",
+  "public",
+  "private",
+  "protected",
+  "static",
+  "readonly",
+  "if",
+  "else",
+  "while",
+  "switch",
+  "case",
+  "break",
+  "continue",
+  "try",
+  "catch",
+  "finally",
+  "throw",
+  "with",
+  "yield",
+  "of",
+  "in",
+  "as",
+  "is",
+  "get",
+  "set"
+]);
+function extractIdentifiers(text) {
+  const out = /* @__PURE__ */ new Set();
+  for (const m of text.matchAll(IDENT_RE)) {
+    const t = m[0];
+    if (STOP.has(t) || STOP.has(t.toLowerCase())) continue;
+    out.add(t);
+  }
+  return [...out].sort();
+}
+function scanIdentifiersAgainstTrie(text, trie) {
+  const known = [];
+  const unknown = [];
+  for (const id of extractIdentifiers(text)) {
+    if (trieHas(trie, id) || trieHasPrefix(trie, id)) known.push(id);
+    else unknown.push(id);
+  }
+  return { known, unknown, clean: unknown.length === 0 };
+}
+function maskAllowedNextChars(trie, partialIdent) {
+  return trieAllowedNextChars(trie, partialIdent);
+}
+function annotateUnknownIdentifiers(text, trie) {
+  const scan = scanIdentifiersAgainstTrie(text, trie);
+  if (scan.clean) return { text, unknown: [] };
+  const note = `
+
+/* vg: unknown identifiers vs graph (not rewritten): ${scan.unknown.slice(0, 12).join(", ")}${scan.unknown.length > 12 ? "\u2026" : ""} */`;
+  return { text: text + note, unknown: scan.unknown };
+}
+
 export { KvBlockRegistry, SessionPrefixCursor, annotateUnknownIdentifiers, buildIdentifierTrieFromGraph, contentHash, extractIdentifiers, graphDraftCandidates, longestWarmPrefix, maskAllowedNextChars, scanIdentifiersAgainstTrie, trieEnumerateWords, trieHas, trieHasPrefix };
-//# sourceMappingURL=chunk-JIBOJTGS.js.map
-//# sourceMappingURL=chunk-JIBOJTGS.js.map
+//# sourceMappingURL=chunk-5HYCB55P.js.map
+//# sourceMappingURL=chunk-5HYCB55P.js.map

package/dist/chunk-5HYCB55P.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/runtime/identifier-trie.ts","../src/runtime/kv-cache.ts","../src/runtime/identifier-mask.ts"],"names":[],"mappings":";;;AAaO,SAAS,cAAA,GAA2B;AACzC,EAAA,OAAO,EAAE,QAAA,kBAAU,IAAI,GAAA,EAAI,EAAG,UAAU,KAAA,EAAM;AAChD;AAEO,SAAS,UAAA,CAAW,MAAgB,IAAA,EAAoB;AAC7D,EAAA,IAAI,IAAA,GAAO,IAAA;AACX,EAAA,KAAA,MAAW,MAAM,IAAA,EAAM;AACrB,IAAA,IAAI,IAAA,GAAO,IAAA,CAAK,QAAA,CAAS,GAAA,CAAI,EAAE,CAAA;AAC/B,IAAA,IAAI,CAAC,IAAA,EAAM;AACT,MAAA,IAAA,GAAO,cAAA,EAAe;AACtB,MAAA,IAAA,CAAK,QAAA,CAAS,GAAA,CAAI,EAAA,EAAI,IAAI,CAAA;AAAA,IAC5B;AACA,IAAA,IAAA,GAAO,IAAA;AAAA,EACT;AACA,EAAA,IAAA,CAAK,QAAA,GAAW,IAAA;AAClB;AAEO,SAAS,OAAA,CAAQ,MAAgB,IAAA,EAAuB;AAC7D,EAAA,IAAI,IAAA,GAAO,IAAA;AACX,EAAA,KAAA,MAAW,MAAM,IAAA,EAAM;AACrB,IAAA,MAAM,IAAA,GAAO,IAAA,CAAK,QAAA,CAAS,GAAA,CAAI,EAAE,CAAA;AACjC,IAAA,IAAI,CAAC,MAAM,OAAO,KAAA;AAClB,IAAA,IAAA,GAAO,IAAA;AAAA,EACT;AACA,EAAA,OAAO,IAAA,CAAK,QAAA;AACd;AAEO,SAAS,aAAA,CAAc,MAAgB,MAAA,EAAyB;AACrE,EAAA,IAAI,IAAA,GAAO,IAAA;AACX,EAAA,KAAA,MAAW,MAAM,MAAA,EAAQ;AACvB,IAAA,MAAM,IAAA,GAAO,IAAA,CAAK,QAAA,CAAS,GAAA,CAAI,EAAE,CAAA;AACjC,IAAA,IAAI,CAAC,MAAM,OAAO,KAAA;AAClB,IAAA,IAAA,GAAO,IAAA;AAAA,EACT;AACA,EAAA,OAAO,IAAA;AACT;AA+BO,SAAS,6BAA6B,KAAA,EAAmC;AAC9E,EAAA,MAAM,OAAO,cAAA,EAAe;AAC5B,EAAA,MAAM,IAAA,uBAAW,GAAA,EAAY;AAC7B,EAAA,MAAM,GAAA,GAAM,CAAC,CAAA,KAAgC;AAC3C,IAAA,MAAM,CAAA,GAAA,CAAK,CAAA,IAAK,EAAA,EAAI,IAAA,EAAK;AACzB,IAAA,IAAI,CAAC,CAAA,IAAK,IAAA,CAAK,GAAA,CAAI,CAAC,CAAA,EAAG;AACvB,IAAA,IAAA,CAAK,IAAI,CAAC,CAAA;AACV,IAAA,UAAA,CAAW,MAAM,CAAC,CAAA;AAElB,IAAA,KAAA,MAAW,IAAA,IAAQ,CAAA,CAAE,KAAA,CAAM,QAAQ,CAAA,EAAG;AACpC,MAAA,MAAM,CAAA,GAAI,KAAK,IAAA,EAAK;AACpB,MAAA,IAAI,CAAC,CAAA,IAAK,IAAA,CAAK,GAAA,CAAI,CAAC,CAAA,EAAG;AACvB,MAAA,IAAA,CAAK,IAAI,CAAC,CAAA;AACV,MAAA,UAAA,CAAW,MAAM,CAAC,CAAA;AAAA,IACpB;AAAA,EACF,CAAA;AACA,EAAA,KAAA,MAAW,CAAA,IAAK,MAAM,KAAA,EAAO;AAC3B,IAAA,GAAA,CAAI,EAAE,IAAI,CAAA;AACV,IAAA,GAAA,CAAI,EAAE,aAAa,CAAA;AACnB,IAAA,GAAA,CAAI,EAAE,EAAE,CAAA;AAAA,EACV;AACA,EAAA,OAAO,IAAA;AACT;AAGO,SAAS,oBAAA,CAAqB,MAAgB,MAAA,EAA0B;AAC7E,EAAA,IAAI,IAAA,GAAO,IAAA;AACX,EAAA,KAAA,MAAW,MAAM,MAAA,EAAQ;AACvB,IAAA,MAAM,IAAA,GAAO,IAAA,CAAK,QAAA,CAAS,GAAA,CAAI,EAAE,CAAA;AACjC,IAAA,IAAI,CAAC,IAAA,EAAM,OAAO,EAAC;AACnB,IAAA,IAAA,GAAO,IAAA;AAAA,EACT;AACA,EAAA,OAAO,CAAC,GAAG,IAAA,CAAK,SAAS,IAAA,EAAM,EAAE,IAAA,EAAK;AACxC;AAMO,SAAS,kBAAA,CAAmB,IAAA,EAAgB,KAAA,GAAQ,IAAA,EAAgB;AACzE,EAAA,MAAM,MAAgB,EAAC;AACvB,EAAA,MAAM,IAAA,GAAO,CAAC,CAAA,EAAa,GAAA,KAAsB;AAC/C,IAAA,IAAI,GAAA,CAAI,UAAU,KAAA,EAAO;AACzB,IAAA,IAAI,EAAE,QAAA,IAAY,GAAA,CAAI,SAAS,CAAA,EAAG,GAAA,CAAI,KAAK,GAAG,CAAA;AAC9C,IAAA,KAAA,MAAW,CAAC,IAAI,KAAK,CAAA,IAAK,CAAC,GAAG,CAAA,CAAE,QAAA,CAAS,OAAA,EAAS,CAAA,CAAE,KAAK,CAAC,CAAA,EAAG,CAAA,KAAM,CAAA,CAAE,CAAC,CAAA,CAAE,cAAc,CAAA,CAAE,CAAC,CAAC,CAAC,CAAA,EAAG;AAC5F,MAAA,IAAA,CAAK,KAAA,EAAO,MAAM,EAAE,CAAA;AACpB,MAAA,IAAI,GAAA,CAAI,UAAU,KAAA,EAAO;AAAA,IAC3B;AAAA,EACF,CAAA;AACA,EAAA,IAAA,CAAK,MAAM,EAAE,CAAA;AACb,EAAA,OAAO,GAAA;AACT;ACrHO,IAAM,eAAA,GAAkB,YAAA;AAmCxB,SAAS,YAAY,IAAA,EAAsB;AAChD,EAAA,OAAO,UAAA,CAAW,QAAQ,CAAA,CAAE,MAAA,CAAO,MAAM,MAAM,CAAA,CAAE,OAAO,KAAK,CAAA;AAC/D;AAEO,SAAS,aAAa,IAAA,EAAsB;AACjD,EAAA,OAAO,IAAA,CAAK,IAAI,CAAA,EAAG,IAAA,CAAK,KAAK,IAAA,CAAK,MAAA,GAAS,CAAC,CAAC,CAAA;AAC/C;AAEO,SAAS,UAAU,IAAA,EAAc,IAAA,EAAc,GAAA,GAAM,IAAA,CAAK,KAAI,EAAgB;AACnF,EAAA,OAAO;AAAA,IACL,IAAA,EAAM,YAAY,IAAI,CAAA;AAAA,IACtB,IAAA;AAAA,IACA,KAAA,EAAO,MAAA,CAAO,UAAA,CAAW,IAAA,EAAM,MAAM,CAAA;AAAA,IACrC,YAAA,EAAc,aAAa,IAAI,CAAA;AAAA,IAC/B,SAAA,EAAW;AAAA,GACb;AACF;AAGO,IAAM,kBAAN,MAAsB;AAAA,EACV,IAAA,uBAAW,GAAA,EAAyB;AAAA,EAErD,SAAS,IAAA,EAAyB;AAChC,IAAA,IAAA,CAAK,IAAA,CAAK,GAAA,CAAI,IAAA,CAAK,IAAA,EAAM,IAAI,CAAA;AAAA,EAC/B;AAAA,EAEA,OAAO,IAAA,EAAuB;AAC5B,IAAA,OAAO,IAAA,CAAK,IAAA,CAAK,GAAA,CAAI,IAAI,CAAA;AAAA,EAC3B;AAAA,EAEA,IAAI,IAAA,EAAuC;AACzC,IAAA,OAAO,IAAA,CAAK,IAAA,CAAK,GAAA,CAAI,IAAI,CAAA;AAAA,EAC3B;AAAA,EAEA,KAAA,GAAc;AACZ,IAAA,IAAA,CAAK,KAAK,KAAA,EAAM;AAAA,EAClB;AAAA,EAEA,IAAA,GAAe;AACb,IAAA,OAAO,KAAK,IAAA,CAAK,IAAA;AAAA,EACnB;AAAA;AAAA;AAAA;AAAA;AAAA,EAMA,IAAA,CAAK,UAAiD,MAAA,EAA8C;AAClG,IAAA,MAAM,QAAkB,EAAC;AACzB,IAAA,MAAM,MAAgB,EAAC;AACvB,IAAA,MAAM,OAA+B,EAAC;AACtC,IAAA,IAAI,SAAA,GAAY,CAAA;AAChB,IAAA,IAAI,WAAA,GAAc,CAAA;AAClB,IAAA,KAAA,MAAW,OAAO,QAAA,EAAU;AAC1B,MAAA,MAAM,IAAA,GAAO,SAAA,CAAU,GAAA,CAAI,IAAA,EAAM,IAAI,IAAI,CAAA;AACzC,MAAA,KAAA,CAAM,IAAA,CAAK,KAAK,IAAI,CAAA;AACpB,MAAA,WAAA,IAAe,IAAA,CAAK,YAAA;AACpB,MAAA,IAAI,IAAA,CAAK,MAAA,CAAO,IAAA,CAAK,IAAI,CAAA,EAAG;AAC1B,QAAA,GAAA,CAAI,IAAA,CAAK,KAAK,IAAI,CAAA;AAClB,QAAA,SAAA,IAAa,IAAA,CAAK,YAAA;AAAA,MACpB,CAAA,MAAO;AACL,QAAA,IAAA,CAAK,IAAA,CAAK,EAAE,IAAA,EAAM,IAAA,CAAK,IAAA,EAAM,IAAA,EAAM,IAAA,CAAK,IAAA,EAAM,YAAA,EAAc,IAAA,CAAK,YAAA,EAAc,CAAA;AAAA,MACjF;AAAA,IACF;AACA,IAAA,IAAI,gBAAA,GAAmB,CAAA;AACvB,IAAA,IAAI,WAAA,GAAc,WAAA;AAClB,IAAA,IAAI,MAAA,EAAQ;AACV,MAAA,MAAM,CAAA,GAAI,MAAA,CAAO,KAAA,CAAM,KAAA,EAAO,QAAQ,CAAA;AACtC,MAAA,gBAAA,GAAmB,CAAA,CAAE,UAAA;AACrB,MAAA,WAAA,GAAc,CAAA,CAAE,cAAA;AAAA,IAClB;AACA,IAAA,OAAO;AAAA,MACL,aAAA,EAAe,eAAA;AAAA,MACf,GAAA;AAAA,MACA,IAAA;AAAA,MACA,KAAA;AAAA,MACA,SAAA;AAAA,MACA,WAAA;AAAA,MACA,gBAAA;AAAA,MACA;AAAA,KACF;AAAA,EACF;AAAA;AAAA,EAGA,OAAO,QAAA,EAAuD;AAC5D,IAAA,KAAA,MAAW,OAAO,QAAA,EAAU;AAC1B,MAAA,IAAA,CAAK,SAAS,SAAA,CAAU,GAAA,CAAI,IAAA,EAAM,GAAA,CAAI,IAAI,CAAC,CAAA;AAAA,IAC7C;AAAA,EACF;AACF;AAMO,IAAM,sBAAN,MAA0B;AAAA,EACvB,QAAkB,EAAC;AAAA;AAAA,EAG3B,IAAI,eAAA,GAAqC;AACvC,IAAA,OAAO,IAAA,CAAK,KAAA;AAAA,EACd;AAAA;AAAA;AAAA;AAAA;AAAA,EAMA,KAAA,CACE,OACA,QAAA,EACsE;AACtE,IAAA,IAAI,IAAA,GAAO,CAAA;AACX,IAAA,OAAO,IAAA,GAAO,KAAA,CAAM,MAAA,IAAU,IAAA,GAAO,IAAA,CAAK,KAAA,CAAM,MAAA,IAAU,KAAA,CAAM,IAAI,CAAA,KAAM,IAAA,CAAK,KAAA,CAAM,IAAI,CAAA,EAAG;AAC1F,MAAA,IAAA,EAAA;AAAA,IACF;AACA,IAAA,IAAI,cAAA,GAAiB,CAAA;AACrB,IAAA,MAAM,QAAkB,EAAC;AACzB,IAAA,KAAA,IAAS,CAAA,GAAI,IAAA,EAAM,CAAA,GAAI,QAAA,CAAS,QAAQ,CAAA,EAAA,EAAK;AAC3C,MAAA,MAAM,IAAA,GAAO,UAAU,QAAA,CAAS,CAAC,EAAE,IAAA,EAAM,QAAA,CAAS,CAAC,CAAA,CAAE,IAAI,CAAA;AACzD,MAAA,cAAA,IAAkB,IAAA,CAAK,YAAA;AACvB,MAAA,KAAA,CAAM,IAAA,CAAK,QAAA,CAAS,CAAC,CAAA,CAAE,IAAI,CAAA;AAAA,IAC7B;AACA,IAAA,OAAO,EAAE,YAAY,IAAA,EAAM,cAAA,EAAgB,cAAc,KAAA,CAAM,IAAA,CAAK,IAAI,CAAA,EAAE;AAAA,EAC5E;AAAA;AAAA,EAGA,OAAO,KAAA,EAAuB;AAC5B,IAAA,IAAA,CAAK,KAAA,GAAQ,CAAC,GAAG,KAAK,CAAA;AAAA,EACxB;AAAA;AAAA,EAGA,KAAA,GAAc;AACZ,IAAA,IAAA,CAAK,QAAQ,EAAC;AAAA,EAChB;AACF;AAMO,SAAS,iBAAA,CACd,UACA,QAAA,EAMA;AACA,EAAA,IAAI,KAAA,GAAQ,CAAA;AACZ,EAAA,IAAI,MAAA,GAAS,CAAA;AACb,EAAA,MAAM,SAAmB,EAAC;AAC1B,EAAA,MAAM,QAAkB,EAAC;AACzB,EAAA,KAAA,MAAW,OAAO,QAAA,EAAU;AAC1B,IAAA,MAAM,IAAA,GAAO,SAAA,CAAU,GAAA,CAAI,IAAA,EAAM,IAAI,IAAI,CAAA;AACzC,IAAA,IAAI,CAAC,QAAA,CAAS,MAAA,CAAO,IAAA,CAAK,IAAI,CAAA,EAAG;AACjC,IAAA,KAAA,EAAA;AACA,IAAA,MAAA,IAAU,IAAA,CAAK,YAAA;AACf,IAAA,MAAA,CAAO,IAAA,CAAK,KAAK,IAAI,CAAA;AACrB,IAAA,KAAA,CAAM,IAAA,CAAK,IAAI,IAAI,CAAA;AAAA,EACrB;AACA,EAAA,OAAO,EAAE,OAAO,MAAA,EAAQ,IAAA,EAAM,MAAM,IAAA,CAAK,IAAI,GAAG,MAAA,EAAO;AACzD;AAOO,SAAS,oBAAA,CACd,aAAA,EACA,GAAA,GAAM,CAAA,EACI;AACV,EAAA,OAAO,aAAA,CACJ,IAAI,CAAC,CAAA,KAAM,EAAE,IAAA,EAAM,EACnB,MAAA,CAAO,CAAC,MAAM,CAAA,CAAE,MAAA,IAAU,KAAK,CAAA,CAAE,MAAA,IAAU,GAAG,CAAA,CAC9C,KAAA,CAAM,GAAG,GAAG,CAAA;AACjB;;;AClNA,IAAM,QAAA,GAAW,gCAAA;AAGjB,IAAM,IAAA,uBAAW,GAAA,CAAI;AAAA,EACnB,KAAA;AAAA,EACA,KAAA;AAAA,EACA,KAAA;AAAA,EACA,KAAA;AAAA,EACA,KAAA;AAAA,EACA,OAAA;AAAA,EACA,UAAA;AAAA,EACA,OAAA;AAAA,EACA,QAAA;AAAA,EACA,QAAA;AAAA,EACA,QAAA;AAAA,EACA,MAAA;AAAA,EACA,OAAA;AAAA,EACA,OAAA;AAAA,EACA,MAAA;AAAA,EACA,OAAA;AAAA,EACA,MAAA;AAAA,EACA,WAAA;AAAA,EACA,MAAA;AAAA,EACA,KAAA;AAAA,EACA,QAAA;AAAA,EACA,WAAA;AAAA,EACA,MAAA;AAAA,EACA,QAAA;AAAA,EACA,QAAA;AAAA,EACA,SAAA;AAAA,EACA,MAAA;AAAA,EACA,KAAA;AAAA,EACA,SAAA;AAAA,EACA,SAAA;AAAA,EACA,OAAA;AAAA,EACA,QAAA;AAAA,EACA,OAAA;AAAA,EACA,SAAA;AAAA,EACA,SAAA;AAAA,EACA,SAAA;AAAA,EACA,QAAA;AAAA,EACA,SAAA;AAAA,EACA,SAAA;AAAA,EACA,SAAA;AAAA,EACA,YAAA;AAAA,EACA,QAAA;AAAA,EACA,SAAA;AAAA,EACA,WAAA;AAAA,EACA,QAAA;AAAA,EACA,UAAA;AAAA,EACA,IAAA;AAAA,EACA,MAAA;AAAA,EACA,OAAA;AAAA,EACA,QAAA;AAAA,EACA,MAAA;AAAA,EACA,OAAA;AAAA,EACA,UAAA;AAAA,EACA,KAAA;AAAA,EACA,OAAA;AAAA,EACA,SAAA;AAAA,EACA,OAAA;AAAA,EACA,MAAA;AAAA,EACA,OAAA;AAAA,EACA,IAAA;AAAA,EACA,IAAA;AAAA,EACA,IAAA;AAAA,EACA,IAAA;AAAA,EACA,KAAA;AAAA,EACA;AACF,CAAC,CAAA;AAYM,SAAS,mBAAmB,IAAA,EAAwB;AACzD,EAAA,MAAM,GAAA,uBAAU,GAAA,EAAY;AAC5B,EAAA,KAAA,MAAW,CAAA,IAAK,IAAA,CAAK,QAAA,CAAS,QAAQ,CAAA,EAAG;AACvC,IAAA,MAAM,CAAA,GAAI,EAAE,CAAC,CAAA;AACb,IAAA,IAAI,IAAA,CAAK,IAAI,CAAC,CAAA,IAAK,KAAK,GAAA,CAAI,CAAA,CAAE,WAAA,EAAa,CAAA,EAAG;AAC9C,IAAA,GAAA,CAAI,IAAI,CAAC,CAAA;AAAA,EACX;AACA,EAAA,OAAO,CAAC,GAAG,GAAG,CAAA,CAAE,IAAA,EAAK;AACvB;AAEO,SAAS,0BAAA,CAA2B,MAAc,IAAA,EAAsC;AAC7F,EAAA,MAAM,QAAkB,EAAC;AACzB,EAAA,MAAM,UAAoB,EAAC;AAC3B,EAAA,KAAA,MAAW,EAAA,IAAM,kBAAA,CAAmB,IAAI,CAAA,EAAG;AACzC,IAAA,IAAI,OAAA,CAAQ,IAAA,EAAM,EAAE,CAAA,IAAK,aAAA,CAAc,MAAM,EAAE,CAAA,EAAG,KAAA,CAAM,IAAA,CAAK,EAAE,CAAA;AAAA,SAC1D,OAAA,CAAQ,KAAK,EAAE,CAAA;AAAA,EACtB;AACA,EAAA,OAAO,EAAE,KAAA,EAAO,OAAA,EAAS,KAAA,EAAO,OAAA,CAAQ,WAAW,CAAA,EAAE;AACvD;AAMO,SAAS,oBAAA,CAAqB,MAAgB,YAAA,EAAgC;AACnF,EAAA,OAAO,oBAAA,CAAqB,MAAM,YAAY,CAAA;AAChD;AAOO,SAAS,0BAAA,CAA2B,MAAc,IAAA,EAAqD;AAC5G,EAAA,MAAM,IAAA,GAAO,0BAAA,CAA2B,IAAA,EAAM,IAAI,CAAA;AAClD,EAAA,IAAI,KAAK,KAAA,EAAO,OAAO,EAAE,IAAA,EAAM,OAAA,EAAS,EAAC,EAAE;AAC3C,EAAA,MAAM,IAAA,GAAO;;AAAA,qDAAA,EAA4D,IAAA,CAAK,OAAA,CAAQ,KAAA,CAAM,CAAA,EAAG,EAAE,CAAA,CAAE,IAAA,CAAK,IAAI,CAAC,GAAG,IAAA,CAAK,OAAA,CAAQ,MAAA,GAAS,EAAA,GAAK,WAAM,EAAE,CAAA,GAAA,CAAA;AACnJ,EAAA,OAAO,EAAE,IAAA,EAAM,IAAA,GAAO,IAAA,EAAM,OAAA,EAAS,KAAK,OAAA,EAAQ;AACpD","file":"chunk-5HYCB55P.js","sourcesContent":["/**\n * Identifier trie for future logit masking (Approach B sampler hooks).\n *\n * Built from ActiveGraph symbol short/qualified names so constrained generation\n * can refuse identifiers that do not exist in the repo. Pure data structure —\n * no model binding required to unit-test.\n */\n\nexport interface TrieNode {\n  children: Map<string, TrieNode>;\n  terminal: boolean;\n}\n\nexport function createTrieNode(): TrieNode {\n  return { children: new Map(), terminal: false };\n}\n\nexport function trieInsert(root: TrieNode, word: string): void {\n  let node = root;\n  for (const ch of word) {\n    let next = node.children.get(ch);\n    if (!next) {\n      next = createTrieNode();\n      node.children.set(ch, next);\n    }\n    node = next;\n  }\n  node.terminal = true;\n}\n\nexport function trieHas(root: TrieNode, word: string): boolean {\n  let node = root;\n  for (const ch of word) {\n    const next = node.children.get(ch);\n    if (!next) return false;\n    node = next;\n  }\n  return node.terminal;\n}\n\nexport function trieHasPrefix(root: TrieNode, prefix: string): boolean {\n  let node = root;\n  for (const ch of prefix) {\n    const next = node.children.get(ch);\n    if (!next) return false;\n    node = next;\n  }\n  return true;\n}\n\n/** Completions that extend `prefix` (capped). */\nexport function trieComplete(root: TrieNode, prefix: string, limit = 32): string[] {\n  let node = root;\n  for (const ch of prefix) {\n    const next = node.children.get(ch);\n    if (!next) return [];\n    node = next;\n  }\n  const out: string[] = [];\n  const walk = (n: TrieNode, acc: string): void => {\n    if (out.length >= limit) return;\n    if (n.terminal) out.push(acc);\n    for (const [ch, child] of [...n.children.entries()].sort((a, b) => a[0].localeCompare(b[0]))) {\n      walk(child, acc + ch);\n      if (out.length >= limit) return;\n    }\n  };\n  walk(node, prefix);\n  return out;\n}\n\nexport interface GraphLikeForTrie {\n  nodes: Array<{ name?: string; qualifiedName?: string; id?: string }>;\n}\n\n/**\n * Build a trie of symbol identifiers from a graph. Includes short names and\n * the last segment of qualified names (e.g. `Foo` from `pkg.Foo`).\n */\nexport function buildIdentifierTrieFromGraph(graph: GraphLikeForTrie): TrieNode {\n  const root = createTrieNode();\n  const seen = new Set<string>();\n  const add = (s: string | undefined): void => {\n    const t = (s ?? '').trim();\n    if (!t || seen.has(t)) return;\n    seen.add(t);\n    trieInsert(root, t);\n    // Path segments for dotted / slash-qualified names (e.g. pkg.util.Foo → util, Foo).\n    for (const part of t.split(/[./:#]/)) {\n      const p = part.trim();\n      if (!p || seen.has(p)) continue;\n      seen.add(p);\n      trieInsert(root, p);\n    }\n  };\n  for (const n of graph.nodes) {\n    add(n.name);\n    add(n.qualifiedName);\n    add(n.id);\n  }\n  return root;\n}\n\n/** Characters allowed to continue after `prefix` under the trie (for logit mask). */\nexport function trieAllowedNextChars(root: TrieNode, prefix: string): string[] {\n  let node = root;\n  for (const ch of prefix) {\n    const next = node.children.get(ch);\n    if (!next) return [];\n    node = next;\n  }\n  return [...node.children.keys()].sort();\n}\n\n/**\n * Enumerate terminal words in the trie (capped). Used to positively bias known\n * graph identifiers when building a TokenBias without scanning the full vocab.\n */\nexport function trieEnumerateWords(root: TrieNode, limit = 4096): string[] {\n  const out: string[] = [];\n  const walk = (n: TrieNode, acc: string): void => {\n    if (out.length >= limit) return;\n    if (n.terminal && acc.length > 0) out.push(acc);\n    for (const [ch, child] of [...n.children.entries()].sort((a, b) => a[0].localeCompare(b[0]))) {\n      walk(child, acc + ch);\n      if (out.length >= limit) return;\n    }\n  };\n  walk(root, '');\n  return out;\n}\n","/**\n * Block-level KV / prompt prefix cache keyed by content hash (Approach B).\n *\n * Pure planning layer + multi-turn prefix cursor (P1/P2). The warm host uses\n * {@link longestWarmPrefix} / {@link SessionPrefixCursor} and may call the\n * binding's `evaluateWithoutGeneratingNewTokens` so RoPE state for warm\n * system/capsule blocks is not rebuilt every turn.\n *\n * schemaVersion: kv-cache/0\n */\n\nimport { createHash } from 'node:crypto';\n\nexport const KV_CACHE_SCHEMA = 'kv-cache/0' as const;\n\nexport interface KvBlockMeta {\n  /** Content hash (sha256 hex, truncated in keys for path safety). */\n  hash: string;\n  /** Human label (system, capsule, tools, …). */\n  kind: string;\n  /** UTF-8 byte length of the source text. */\n  bytes: number;\n  /** Approx token count (chars/4 heuristic when unknown). */\n  approxTokens: number;\n  /** When this block entered the registry. */\n  createdAt: number;\n}\n\nexport interface KvAssemblyPlan {\n  schemaVersion: typeof KV_CACHE_SCHEMA;\n  /** Blocks to reuse from cache (hashes). */\n  hit: string[];\n  /** Blocks that must be prefilled (hash + kind). */\n  miss: Array<{ hash: string; kind: string; approxTokens: number }>;\n  /** Ordered sequence of block hashes for the full prompt. */\n  order: string[];\n  /** Estimated tokens already “warm” vs total. */\n  hitTokens: number;\n  totalTokens: number;\n  /**\n   * P2: tokens that must be re-evaluated because the multi-turn cursor\n   * diverged (subset of miss + trailing hits after fork).\n   */\n  deltaTokens?: number;\n  /** How many leading blocks the session cursor already has evaluated. */\n  cursorSkipBlocks?: number;\n}\n\nexport function contentHash(text: string): string {\n  return createHash('sha256').update(text, 'utf8').digest('hex');\n}\n\nexport function approxTokens(text: string): number {\n  return Math.max(1, Math.ceil(text.length / 4));\n}\n\nexport function blockMeta(kind: string, text: string, now = Date.now()): KvBlockMeta {\n  return {\n    hash: contentHash(text),\n    kind,\n    bytes: Buffer.byteLength(text, 'utf8'),\n    approxTokens: approxTokens(text),\n    createdAt: now,\n  };\n}\n\n/** In-memory registry of which content hashes are considered warm. */\nexport class KvBlockRegistry {\n  private readonly warm = new Map<string, KvBlockMeta>();\n\n  markWarm(meta: KvBlockMeta): void {\n    this.warm.set(meta.hash, meta);\n  }\n\n  isWarm(hash: string): boolean {\n    return this.warm.has(hash);\n  }\n\n  get(hash: string): KvBlockMeta | undefined {\n    return this.warm.get(hash);\n  }\n\n  clear(): void {\n    this.warm.clear();\n  }\n\n  size(): number {\n    return this.warm.size;\n  }\n\n  /**\n   * Plan assembly for ordered text segments. Hits reuse warm blocks; misses\n   * need prefill. After a successful forward pass, call {@link commit} on miss hashes.\n   */\n  plan(segments: Array<{ kind: string; text: string }>, cursor?: SessionPrefixCursor): KvAssemblyPlan {\n    const order: string[] = [];\n    const hit: string[] = [];\n    const miss: KvAssemblyPlan['miss'] = [];\n    let hitTokens = 0;\n    let totalTokens = 0;\n    for (const seg of segments) {\n      const meta = blockMeta(seg.kind, seg.text);\n      order.push(meta.hash);\n      totalTokens += meta.approxTokens;\n      if (this.isWarm(meta.hash)) {\n        hit.push(meta.hash);\n        hitTokens += meta.approxTokens;\n      } else {\n        miss.push({ hash: meta.hash, kind: meta.kind, approxTokens: meta.approxTokens });\n      }\n    }\n    let cursorSkipBlocks = 0;\n    let deltaTokens = totalTokens;\n    if (cursor) {\n      const d = cursor.delta(order, segments);\n      cursorSkipBlocks = d.skipBlocks;\n      deltaTokens = d.evaluateTokens;\n    }\n    return {\n      schemaVersion: KV_CACHE_SCHEMA,\n      hit,\n      miss,\n      order,\n      hitTokens,\n      totalTokens,\n      cursorSkipBlocks,\n      deltaTokens,\n    };\n  }\n\n  /** After prefill, mark miss segments warm. */\n  commit(segments: Array<{ kind: string; text: string }>): void {\n    for (const seg of segments) {\n      this.markWarm(blockMeta(seg.kind, seg.text));\n    }\n  }\n}\n\n/**\n * Multi-turn cursor: remembers the hash chain last evaluated on the sequence\n * so we only re-evaluate from the first divergence (P2 RoPE-friendly delta).\n */\nexport class SessionPrefixCursor {\n  private chain: string[] = [];\n\n  /** Hashes currently considered evaluated on the sequence. */\n  get evaluatedHashes(): readonly string[] {\n    return this.chain;\n  }\n\n  /**\n   * Compute how many leading blocks match the previous chain and how many\n   * approx tokens still need evaluate (from the fork point).\n   */\n  delta(\n    order: string[],\n    segments: Array<{ kind: string; text: string }>,\n  ): { skipBlocks: number; evaluateTokens: number; evaluateText: string } {\n    let skip = 0;\n    while (skip < order.length && skip < this.chain.length && order[skip] === this.chain[skip]) {\n      skip++;\n    }\n    let evaluateTokens = 0;\n    const parts: string[] = [];\n    for (let i = skip; i < segments.length; i++) {\n      const meta = blockMeta(segments[i].kind, segments[i].text);\n      evaluateTokens += meta.approxTokens;\n      parts.push(segments[i].text);\n    }\n    return { skipBlocks: skip, evaluateTokens, evaluateText: parts.join('\\n') };\n  }\n\n  /** After successful evaluate of full ordered hashes, advance the cursor. */\n  commit(order: string[]): void {\n    this.chain = [...order];\n  }\n\n  /** Reset after sequence dispose / model reload. */\n  reset(): void {\n    this.chain = [];\n  }\n}\n\n/**\n * Longest leading run of warm segments (stable system/capsule prefix).\n * Host can skip re-prefilling these when the sequence API allows evaluate-only.\n */\nexport function longestWarmPrefix(\n  registry: KvBlockRegistry,\n  segments: Array<{ kind: string; text: string }>,\n): {\n  count: number;\n  tokens: number;\n  text: string;\n  hashes: string[];\n} {\n  let count = 0;\n  let tokens = 0;\n  const hashes: string[] = [];\n  const parts: string[] = [];\n  for (const seg of segments) {\n    const meta = blockMeta(seg.kind, seg.text);\n    if (!registry.isWarm(meta.hash)) break;\n    count++;\n    tokens += meta.approxTokens;\n    hashes.push(meta.hash);\n    parts.push(seg.text);\n  }\n  return { count, tokens, text: parts.join('\\n'), hashes };\n}\n\n/**\n * Speculative draft tokens for quotational spans the graph already knows\n * verbatim (signatures / imports). The big model verifies; high acceptance\n * expected on code. Pure: returns candidate draft strings, does not call a model.\n */\nexport function graphDraftCandidates(\n  knownVerbatim: string[],\n  max = 8,\n): string[] {\n  return knownVerbatim\n    .map((s) => s.trim())\n    .filter((s) => s.length >= 8 && s.length <= 400)\n    .slice(0, max);\n}\n","/**\n * Identifier masking helpers for Approach B sampler integration.\n *\n * Full logit masking needs the llama.cpp binding's token callback. Until that\n * hook is universal across binding versions, we:\n *  1. Expose allowed-next-char sets from the trie (for native mask hooks)\n *  2. Post-validate free-text model output for repo identifiers\n *  3. Optionally rewrite / flag unknown identifiers in code-like spans\n */\n\nimport type { TrieNode } from './identifier-trie.js';\nimport { trieAllowedNextChars, trieHas, trieHasPrefix } from './identifier-trie.js';\n\n/** JS/TS-ish identifier token (conservative). */\nconst IDENT_RE = /\\b[A-Za-z_][A-Za-z0-9_]{2,}\\b/g;\n\n/** Tokens we never treat as \"must exist in the graph\". */\nconst STOP = new Set([\n  'the',\n  'and',\n  'for',\n  'var',\n  'let',\n  'const',\n  'function',\n  'class',\n  'return',\n  'import',\n  'export',\n  'from',\n  'async',\n  'await',\n  'true',\n  'false',\n  'null',\n  'undefined',\n  'this',\n  'new',\n  'typeof',\n  'interface',\n  'type',\n  'string',\n  'number',\n  'boolean',\n  'void',\n  'any',\n  'unknown',\n  'Promise',\n  'Array',\n  'Object',\n  'Error',\n  'console',\n  'process',\n  'require',\n  'module',\n  'exports',\n  'default',\n  'extends',\n  'implements',\n  'public',\n  'private',\n  'protected',\n  'static',\n  'readonly',\n  'if',\n  'else',\n  'while',\n  'switch',\n  'case',\n  'break',\n  'continue',\n  'try',\n  'catch',\n  'finally',\n  'throw',\n  'with',\n  'yield',\n  'of',\n  'in',\n  'as',\n  'is',\n  'get',\n  'set',\n]);\n\nexport interface IdentifierScanResult {\n  /** Identifiers that appear in text and exist in the trie. */\n  known: string[];\n  /** Identifiers that appear in text but are absent from the trie. */\n  unknown: string[];\n  /** True when every scanned identifier is known (or stopword). */\n  clean: boolean;\n}\n\n/** Extract candidate identifiers from model text. */\nexport function extractIdentifiers(text: string): string[] {\n  const out = new Set<string>();\n  for (const m of text.matchAll(IDENT_RE)) {\n    const t = m[0];\n    if (STOP.has(t) || STOP.has(t.toLowerCase())) continue;\n    out.add(t);\n  }\n  return [...out].sort();\n}\n\nexport function scanIdentifiersAgainstTrie(text: string, trie: TrieNode): IdentifierScanResult {\n  const known: string[] = [];\n  const unknown: string[] = [];\n  for (const id of extractIdentifiers(text)) {\n    if (trieHas(trie, id) || trieHasPrefix(trie, id)) known.push(id);\n    else unknown.push(id);\n  }\n  return { known, unknown, clean: unknown.length === 0 };\n}\n\n/**\n * Allowed next characters for a partial identifier under the trie — the hook\n * surface for real logit masks when the binding supports custom samplers.\n */\nexport function maskAllowedNextChars(trie: TrieNode, partialIdent: string): string[] {\n  return trieAllowedNextChars(trie, partialIdent);\n}\n\n/**\n * Annotate model output when unknown identifiers appear (non-destructive).\n * Returns original text when clean; otherwise appends a short warning block the\n * agent/tools can surface without rewriting the patch body blindly.\n */\nexport function annotateUnknownIdentifiers(text: string, trie: TrieNode): { text: string; unknown: string[] } {\n  const scan = scanIdentifiersAgainstTrie(text, trie);\n  if (scan.clean) return { text, unknown: [] };\n  const note = `\\n\\n/* vg: unknown identifiers vs graph (not rewritten): ${scan.unknown.slice(0, 12).join(', ')}${scan.unknown.length > 12 ? '…' : ''} */`;\n  return { text: text + note, unknown: scan.unknown };\n}\n"]}

package/dist/{chunk-EEVZVXT2.js → chunk-5MNX3OLS.js}

@@ -1,13 +1,13 @@
-import { MockProvider, LocalLlamaProvider, OPENAI_COMPATIBLE, OllamaProvider, OpenAiCompatibleProvider } from './chunk-RZEXHDCF.js';
+import { managerFromProviderId, formatManagerBadgeLine } from './chunk-WHJMS7XC.js';
 import { c, info, json, out } from './chunk-CT5BS56U.js';
+import { MockProvider, LocalLlamaProvider, OPENAI_COMPATIBLE, OllamaProvider, OpenAiCompatibleProvider } from './chunk-MYM5VIJ4.js';
 import { resolveGgufPath } from './chunk-7AVYKZEM.js';
-import { managerFromProviderId, formatManagerBadgeLine } from './chunk-WHJMS7XC.js';
-import { usageError, buildGraph, UsageError, ResourceLimitError, CliError, ExitCode, writeSnapshot, refreshInstalledInstructions, SMALL_REPO_FILES, epistemicBreakdown, verifyDeterminism } from './chunk-YMHQZ24Q.js';
-import { brandProgressBar, resolveHead, workingTreeDirty } from './chunk-OIWHR57Q.js';
+import { usageError, buildGraph, UsageError, ResourceLimitError, CliError, ExitCode, writeSnapshot, refreshInstalledInstructions, SMALL_REPO_FILES, epistemicBreakdown, verifyDeterminism } from './chunk-3FQSBVQD.js';
+import { brandProgressBar, resolveHead, workingTreeDirty } from './chunk-4BOWWYSE.js';
 import { resolveEmbedModel, isModelReady, countPending } from './chunk-EETK7S43.js';
 import { discoverModels } from './chunk-CQDUBAQY.js';
-import { writeArtifacts, renderHtml, renderReport, loadGraph } from './chunk-YKVNMNEM.js';
-import { VERSION } from './chunk-NQ4FSRXL.js';
+import { writeArtifacts, renderHtml, renderReport, loadGraph } from './chunk-JXMZCTVZ.js';
+import { VERSION } from './chunk-N3HCPBFY.js';
 import { serializeGraph } from './chunk-ZKNB4YH4.js';
 import { canonicalize } from './chunk-JFGYT6BI.js';
 import * as path from 'path';
@@ -747,7 +747,7 @@ function titleCase(id) {
 }
 
 // src/code/router.ts
-var HOSTED_IDS = /* @__PURE__ */ new Set(["openrouter", "litellm", "openai", "together"]);
+var HOSTED_IDS = /* @__PURE__ */ new Set(["vibgrate-relay", "openrouter", "litellm", "openai", "together"]);
 function resolveProviders(opts, deps = {}) {
   const env = deps.env ?? process.env;
   const discover = deps.discover ?? discoverModels;
@@ -791,6 +791,14 @@ function resolveProviders(opts, deps = {}) {
     }
     return finish(locals2, "--local (on-device backends only)");
   }
+  if (env.VIBGRATE_RELAY_TOKEN) {
+    const model = resolveHostedModel(opts, env, "vibgrate-relay");
+    const primary = buildHosted("vibgrate-relay", model);
+    return finish(
+      [primary, ...localFallbacks(opts, env, discover, "vibgrate-relay", { allowLmStudio: false })],
+      "VIBGRATE_RELAY_TOKEN is set \u2192 Vibgrate Relay (with local fallback)"
+    );
+  }
   if (env.OPENROUTER_API_KEY) {
     const model = resolveHostedModel(opts, env, "openrouter");
     const primary = buildHosted("openrouter", model);
@@ -809,7 +817,7 @@ function resolveProviders(opts, deps = {}) {
     }
   }
   throw new CliError(
-    "no model backend configured. Do one of: set OPENROUTER_API_KEY for the hosted router, run `vg models install spark` for the Vibgrate manager, run Ollama locally, or use --local with a local model. Set the model with --model or VG_CODE_MODEL.",
+    "no model backend configured. Do one of: sign in to Vibgrate Relay (VIBGRATE_RELAY_TOKEN), set OPENROUTER_API_KEY for the hosted router, run `vg models install spark` for the Vibgrate manager, run Ollama locally, or use --local with a local model. Set the model with --model or VG_CODE_MODEL.",
     ExitCode.NOT_FOUND
   );
 }
@@ -846,7 +854,7 @@ function buildExplicit(id, opts, env, discover) {
   }
   if (HOSTED_IDS.has(id)) return buildHosted(id, resolveHostedModel(opts, env, id));
   throw new CliError(
-    `unknown --provider "${id}". Known: ollama, lmstudio, foundry-local, openrouter, litellm, openai, together, llama-cpp.`,
+    `unknown --provider "${id}". Known: vibgrate-relay, ollama, lmstudio, foundry-local, openrouter, litellm, openai, together, llama-cpp.`,
     ExitCode.USAGE_ERROR
   );
 }
@@ -916,5 +924,5 @@ function basename2(p) {
 }
 
 export { DSSE_PAYLOAD_TYPE, ProgressBar, applyGlobalOptions, dssePae, fetchCatalog, generateKeypair, keyId, printCodeLogo, printLogo, readGlobal, registerBuild, resolveProviders, runBuild, sha256Hex, topProviders };
-//# sourceMappingURL=chunk-EEVZVXT2.js.map
-//# sourceMappingURL=chunk-EEVZVXT2.js.map
+//# sourceMappingURL=chunk-5MNX3OLS.js.map
+//# sourceMappingURL=chunk-5MNX3OLS.js.map