@xenosystem/agent-sdk 0.9.27 → 0.9.28

package/dist/artifacts/index.js

@@ -1,10 +1,10 @@
-var h=1,oe=1,He=["plan","requirements","design","task-graph","patch","diff","file","document","diagram","screenshot","recording","browser-snapshot","test-report","review-report","security-report","performance-report","release-report","sbom","provenance","attestation"],je=["draft","pending_review","approved","rejected","superseded","archived"],qe=["public","internal","confidential","restricted"],Je=["agent","tool","user","system","integration"],se=["requirement","design-decision","risk","task","agent","run","tool-call","edit","commit","test-case","test-run","finding","approval","artifact","release","claim"],ae=["decomposes","depends_on","implements","changes","tests","verifies","finds","fixes","reviews","approves","rejects","supersedes","derived_from","produced_by","supports_claim","contradicts_claim","released_as"];import{Buffer as Be}from"node:buffer";import{createHash as zt}from"node:crypto";function _(e){return{algorithm:"sha256",value:zt("sha256").update(e).digest("hex")}}function S(e){return JSON.stringify(Ee(e,new Set))}function T(e){return _(S(e))}function Ee(e,t){if(e===null||typeof e!="object"){if(typeof e=="number"&&!Number.isFinite(e))throw new TypeError("Artifact JSON cannot contain non-finite numbers");return e}if(t.has(e))throw new TypeError("Artifact JSON cannot contain cycles");if(t.add(e),Array.isArray(e)){let i=e.map(o=>Ee(o,t));return t.delete(e),i}let n={};for(let i of Object.keys(e).sort((o,r)=>o.localeCompare(r))){let o=e[i];if(o===void 0)throw new TypeError(`Artifact JSON property ${i} is undefined`);n[i]=Ee(o,t)}return t.delete(e),n}var Kt=/^[a-z0-9][a-z0-9._/-]{0,127}$/,Re="custom:";function $(e,t=Re){return e.startsWith(t)?Kt.test(e.slice(t.length)):!1}var M=class extends Error{code="ARTIFACT_INVALID";issues;constructor(t,n){super(t),this.name="XenoArtifactValidationError",this.issues=n.map(i=>({...i}))}},Xe=class extends Error{constructor(n,i){super(`Artifact state cannot transition from ${n} to ${i}`);this.fromState=n;this.toState=i;this.name="XenoArtifactStateTransitionError"}fromState;toState;code="ARTIFACT_STATE_TRANSITION_INVALID"},Gt={draft:["pending_review","superseded","archived"],pending_review:["approved","rejected","superseded","archived"],approved:["superseded","archived"],rejected:["superseded","archived"],superseded:["archived"],archived:[]},Yt="[\\u0000-\\u001f\\u007f]",Zt=new RegExp(Yt),Ue=/^[a-f0-9]{64}$/,Qt=/^(?:[A-Za-z0-9+/]{4})*(?:[A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=)?$/,en=new Set(je),tn=new Set(qe),nn=new Set(Je),rn=new Set(He),on=new Set(se),sn=new Set(ae);function p(e,t,n,i){e.push({path:t,code:n,message:i})}function l(e,t,n,i=1024){return typeof e!="string"||e.trim().length===0?(p(n,t,"required_string","Value must be a non-empty string"),!1):(e.length>i&&p(n,t,"string_too_long",`Value must not exceed ${i} characters`),Zt.test(e)&&p(n,t,"control_character","Value must not contain control characters"),!0)}function B(e,t,n){e!==void 0&&(!Number.isFinite(Date.parse(e))||!e.includes("T"))&&p(n,t,"invalid_timestamp","Value must be an ISO 8601 timestamp")}function O(e,t,n,i){typeof e=="string"&&e.startsWith(t)&&($(e,t)||p(i,n,"invalid_custom_name",`Custom name after ${t} is invalid`))}function We(e,t,n){if(!e||typeof e!="object"){p(n,t,"missing_actor","Actor is required");return}l(e.kind,`${t}.kind`,n,64),nn.has(e.kind)||p(n,`${t}.kind`,"unknown_actor_kind","Actor kind is not supported"),l(e.id,`${t}.id`,n,512),e?.displayName!==void 0&&l(e.displayName,`${t}.displayName`,n,512),e?.profileFingerprint!==void 0&&!/^[a-f0-9]{64}$/.test(e.profileFingerprint)&&p(n,`${t}.profileFingerprint`,"invalid_fingerprint","Profile fingerprint must be 64 lowercase hexadecimal characters")}function Se(e,t,n){if(!e||typeof e!="object"){p(n,t,"invalid_anchor","Anchor must be an object");return}switch(e.kind){case"file":l(e.path,`${t}.path`,n,4096);break;case"source-line":l(e.path,`${t}.path`,n,4096),(!Number.isInteger(e.startLine)||e.startLine<1)&&p(n,`${t}.startLine`,"invalid_line","startLine must be a positive integer"),e.endLine!==void 0&&(!Number.isInteger(e.endLine)||e.endLine<e.startLine)&&p(n,`${t}.endLine`,"invalid_line_range","endLine must be greater than or equal to startLine");break;case"diff-hunk":l(e.path,`${t}.path`,n,4096),l(e.hunkId,`${t}.hunkId`,n,512);break;case"symbol":l(e.path,`${t}.path`,n,4096),l(e.symbol,`${t}.symbol`,n,1024);break;case"dom-node":l(e.pageId,`${t}.pageId`,n,512),!e.selector&&!e.accessibilityId&&!e.snapshotArtifactId&&p(n,t,"missing_dom_locator","DOM anchors require a selector, accessibility ID, or snapshot artifact ID");break;case"timeline":l(e.recordingArtifactId,`${t}.recordingArtifactId`,n,512),(!Number.isFinite(e.startMs)||e.startMs<0)&&p(n,`${t}.startMs`,"invalid_time","startMs must be a non-negative finite number"),e.endMs!==void 0&&(!Number.isFinite(e.endMs)||e.endMs<e.startMs)&&p(n,`${t}.endMs`,"invalid_time_range","endMs must be greater than or equal to startMs");break;case"region":l(e.mediaArtifactId,`${t}.mediaArtifactId`,n,512),[e.x,e.y,e.width,e.height].every(Number.isFinite)?(e.width<=0||e.height<=0)&&p(n,t,"invalid_region_size","Region width and height must be positive"):p(n,t,"invalid_region","Region coordinates must be finite numbers");break;case"artifact":l(e.artifactId,`${t}.artifactId`,n,512);break;default:typeof e.kind!="string"||!e.kind.startsWith("custom:")?p(n,`${t}.kind`,"unknown_anchor","Anchor kind is not supported"):O(e.kind,"custom:",`${t}.kind`,n)}}function U(e,t,n,i){if(!(e===null||typeof e=="string"||typeof e=="boolean")){if(typeof e=="number"){Number.isFinite(e)||p(n,t,"non_finite_number","JSON numbers must be finite");return}if(typeof e!="object"){p(n,t,"non_json_value","Value must be JSON-serializable");return}if(i.has(e)){p(n,t,"cyclic_value","Value must not contain cycles");return}if(i.add(e),Array.isArray(e))e.forEach((o,r)=>U(o,`${t}[${r}]`,n,i));else for(let[o,r]of Object.entries(e))r===void 0?p(n,`${t}.${o}`,"undefined_value","Undefined is not valid JSON"):U(r,`${t}.${o}`,n,i);i.delete(e)}}function an(e){let t=[];if(!e||typeof e!="object")return[{path:"$",code:"invalid_artifact",message:"Artifact must be an object"}];if(e.schemaVersion!==1&&p(t,"schemaVersion","unsupported_schema",`schemaVersion must be ${1}`),l(e.artifactId,"artifactId",t,512),(!Number.isInteger(e.revision)||e.revision<1)&&p(t,"revision","invalid_revision","revision must be a positive integer"),l(e.kind,"kind",t,160),typeof e.kind=="string"&&!rn.has(e.kind)&&!e.kind.startsWith("custom:")&&p(t,"kind","unknown_artifact_kind","Artifact kind is not supported"),O(e.kind,"custom:","kind",t),l(e.title,"title",t,1024),e.description!==void 0&&l(e.description,"description",t,32768),l(e.state,"state",t,64),en.has(e.state)||p(t,"state","unknown_state","Artifact state is not supported"),l(e.createdAt,"createdAt",t,128),B(e.createdAt,"createdAt",t),B(e.updatedAt,"updatedAt",t),e.updatedAt&&Number.isFinite(Date.parse(e.createdAt))&&Date.parse(e.updatedAt)<Date.parse(e.createdAt)&&p(t,"updatedAt","timestamp_order","updatedAt must not precede createdAt"),l(e.mediaType,"mediaType",t,255),l(e.sensitivity,"sensitivity",t,64),tn.has(e.sensitivity)||p(t,"sensitivity","unknown_sensitivity","Sensitivity is not supported"),e.identity)for(let[i,o]of Object.entries(e.identity))o!==void 0&&l(o,`identity.${i}`,t,512);if(!e.content||typeof e.content!="object")p(t,"content","missing_content","content descriptor is required");else{!e.content.hash||typeof e.content.hash!="object"?p(t,"content.hash","missing_hash","content hash is required"):(l(e.content.hash.algorithm,"content.hash.algorithm",t,128),O(e.content.hash.algorithm,"custom:","content.hash.algorithm",t),typeof e.content.hash.algorithm=="string"&&e.content.hash.algorithm!=="sha256"&&!e.content.hash.algorithm.startsWith("custom:")&&p(t,"content.hash.algorithm","unknown_hash_algorithm","Hash algorithm is not supported"),l(e.content.hash.value,"content.hash.value",t,512),e.content.hash.algorithm==="sha256"&&!Ue.test(e.content.hash.value)&&p(t,"content.hash.value","invalid_sha256","SHA-256 hash must be 64 lowercase hexadecimal characters")),(!Number.isSafeInteger(e.content.sizeBytes)||e.content.sizeBytes<0)&&p(t,"content.sizeBytes","invalid_size","sizeBytes must be a non-negative safe integer");let i=e.content.storage;if(!i||typeof i!="object")p(t,"content.storage","missing_storage","storage reference is required");else if(i.type==="inline")if(i.text===void 0==(i.base64===void 0))p(t,"content.storage","invalid_inline_storage","Inline storage requires exactly one of text or base64");else{let o;i.text!==void 0?o=Be.from(i.text,"utf8"):i.base64!==void 0&&(Qt.test(i.base64)?o=Be.from(i.base64,"base64"):p(t,"content.storage.base64","invalid_base64","Inline base64 content is malformed")),o&&e.content.sizeBytes!==o.byteLength&&p(t,"content.sizeBytes","content_size_mismatch","sizeBytes does not match inline content"),o&&e.content.hash.algorithm==="sha256"&&_(o).value!==e.content.hash.value&&p(t,"content.hash.value","content_hash_mismatch","Hash does not match inline content")}else i.type==="file"?l(i.path,"content.storage.path",t,4096):i.type==="blob"?l(i.uri,"content.storage.uri",t,8192):i.type==="git"?(l(i.commit,"content.storage.commit",t,512),l(i.path,"content.storage.path",t,4096)):i.type==="url"?(l(i.url,"content.storage.url",t,8192),B(i.expiresAt,"content.storage.expiresAt",t)):i.type==="external"?(l(i.provider,"content.storage.provider",t,255),l(i.locator,"content.storage.locator",t,8192)):p(t,"content.storage.type","unknown_storage","Storage type is not supported");e.content.encoding!==void 0&&(typeof e.content.encoding!="string"||e.content.encoding!=="utf8"&&e.content.encoding!=="base64"&&e.content.encoding!=="binary"&&!e.content.encoding.startsWith("custom:"))&&p(t,"content.encoding","unknown_encoding","Content encoding is not supported"),O(e.content.encoding,"custom:","content.encoding",t)}!e.provenance||typeof e.provenance!="object"?p(t,"provenance","missing_provenance","provenance is required"):(We(e.provenance.producer,"provenance.producer",t),e.provenance.capabilityLeaseIds?.forEach((i,o)=>l(i,`provenance.capabilityLeaseIds[${o}]`,t,512)),e.provenance.sourceArtifactIds?.forEach((i,o)=>l(i,`provenance.sourceArtifactIds[${o}]`,t,512)),e.provenance.attributes&&U(e.provenance.attributes,"provenance.attributes",t,new Set));let n=new Set;return e.relationships?.forEach((i,o)=>{let r=`relationships[${o}]`;l(i.relation,`${r}.relation`,t,160),typeof i.relation=="string"&&!sn.has(i.relation)&&!i.relation.startsWith("custom:")&&p(t,`${r}.relation`,"unknown_relationship","Relationship type is not supported"),O(i.relation,"custom:",`${r}.relation`,t),l(i.target?.type,`${r}.target.type`,t,160),typeof i.target?.type=="string"&&!on.has(i.target.type)&&!i.target.type.startsWith("custom:")&&p(t,`${r}.target.type`,"unknown_reference_type","Evidence reference type is not supported"),O(i.target?.type,"custom:",`${r}.target.type`,t),l(i.target?.id,`${r}.target.id`,t,512);let a=`${i.relation}:${i.target?.type}:${i.target?.id}:${i.target?.revision??""}`;n.has(a)&&p(t,r,"duplicate_relationship","Duplicate relationship"),n.add(a),i.attributes&&U(i.attributes,`${r}.attributes`,t,new Set)}),e.anchors?.forEach((i,o)=>Se(i,`anchors[${o}]`,t)),e.revision===1&&e.predecessorRevision!==void 0&&p(t,"predecessorRevision","unexpected_predecessor","First revision cannot have a predecessor"),e.revision>1&&(!Number.isInteger(e.predecessorRevision)||(e.predecessorRevision??0)>=e.revision)&&p(t,"predecessorRevision","invalid_predecessor","Later revisions require an earlier predecessor revision"),B(e.retention?.retainUntil,"retention.retainUntil",t),e.retention?.legalHold!==void 0&&typeof e.retention.legalHold!="boolean"&&p(t,"retention.legalHold","invalid_boolean","legalHold must be a boolean"),e.extensions&&U(e.extensions,"extensions",t,new Set),t}function w(e){let t=an(e);if(t.length>0)throw new M("XENO artifact validation failed",t)}function cn(e,t){return Gt[e].includes(t)}function ce(e,t){if(!cn(e,t))throw new Xe(e,t)}function be(e,t){let n=[];return e.schemaVersion!==1&&p(n,"schemaVersion","unsupported_schema",`schemaVersion must be ${1}`),l(e.eventId,"eventId",n,512),l(e.artifactId,"artifactId",n,512),(!Number.isInteger(e.artifactRevision)||e.artifactRevision<1)&&p(n,"artifactRevision","invalid_revision","artifactRevision must be a positive integer"),(!Number.isInteger(e.sequence)||e.sequence<1)&&p(n,"sequence","invalid_sequence","sequence must be a positive integer"),l(e.recordedAt,"recordedAt",n,128),B(e.recordedAt,"recordedAt",n),We(e.actor,"actor",n),!e.artifactHash||typeof e.artifactHash!="object"?p(n,"artifactHash","missing_hash","Artifact hash is required"):(l(e.artifactHash.algorithm,"artifactHash.algorithm",n,128),O(e.artifactHash.algorithm,"custom:","artifactHash.algorithm",n),l(e.artifactHash.value,"artifactHash.value",n,512),e.artifactHash.algorithm==="sha256"&&!Ue.test(e.artifactHash.value)&&p(n,"artifactHash.value","invalid_sha256","SHA-256 hash must be 64 lowercase hexadecimal characters"),typeof e.artifactHash.algorithm=="string"&&e.artifactHash.algorithm!=="sha256"&&!e.artifactHash.algorithm.startsWith("custom:")&&p(n,"artifactHash.algorithm","unknown_hash_algorithm","Hash algorithm is not supported")),["review-requested","comment-added","comment-resolved","comment-reopened","decision-recorded","review-withdrawn"].includes(e.type)||p(n,"type","unknown_review_event","Review event type is not supported"),e.type==="comment-added"?(l(e.commentId,"commentId",n,512),l(e.body,"body",n,65536),e.anchor&&Se(e.anchor,"anchor",n)):e.type==="comment-resolved"||e.type==="comment-reopened"?l(e.commentId,"commentId",n,512):e.type==="decision-recorded"&&(["approved","rejected","changes_requested"].includes(e.decision)||p(n,"decision","unknown_review_decision","Review decision is not supported"),e.scope&&Se(e.scope,"scope",n)),t&&(e.artifactId!==t.artifactId&&p(n,"artifactId","artifact_mismatch","Review event targets a different artifact"),e.artifactRevision!==t.revision&&p(n,"artifactRevision","revision_mismatch","Review event targets a different revision"),e.artifactHash&&(e.artifactHash.algorithm!==t.content.hash.algorithm||e.artifactHash.value!==t.content.hash.value)&&p(n,"artifactHash","hash_mismatch","Review event hash does not match the artifact revision")),n}function _e(e){let t="not_requested",n,i,o,r=0,a=new Set,c=new Set;for(let s of[...e].sort((d,f)=>d.sequence-f.sequence))o=s.recordedAt,s.type==="review-requested"?t="pending":s.type==="review-withdrawn"?t="withdrawn":s.type==="comment-added"?(a.add(s.commentId),c.delete(s.commentId),t==="not_requested"&&(t="pending")):s.type==="comment-resolved"?c.add(s.commentId):s.type==="comment-reopened"?c.delete(s.commentId):s.type==="decision-recorded"&&(s.scope?r+=1:(n=s.decision,i=s.eventId,t=s.decision));return{status:t,totalComments:a.size,unresolvedComments:[...a].filter(s=>!c.has(s)).length,...n?{latestDecision:n}:{},...i?{latestDecisionEventId:i}:{},...r>0?{scopedDecisionCount:r}:{},...o?{lastReviewedAt:o}:{}}}var Te=class extends Error{code="EVIDENCE_GRAPH_INVALID";issues;constructor(t){super("XENO evidence graph validation failed"),this.name="XenoEvidenceGraphValidationError",this.issues=t.map(n=>({...n}))}},dn=new Set(["depends_on","decomposes","supersedes"]),fn=new Set(se),pn=new Set(ae);function A(e,t,n,i){e.push({path:t,code:n,message:i})}function W(e){return e.includes("T")&&Number.isFinite(Date.parse(e))}function ze(e,t){return e.startsWith(Re)?$(e):t.has(e)}function un(e){let t=[];if(!e||typeof e!="object")return[{path:"$",code:"invalid_graph",message:"Evidence graph must be an object"}];e.schemaVersion!==1&&A(t,"schemaVersion","unsupported_schema",`schemaVersion must be ${1}`),(typeof e.graphId!="string"||e.graphId.trim().length===0)&&A(t,"graphId","required_string","graphId must be a non-empty string"),(!Number.isInteger(e.version)||e.version<1)&&A(t,"version","invalid_version","version must be a positive integer"),W(e.createdAt)||A(t,"createdAt","invalid_timestamp","createdAt must be an ISO 8601 timestamp"),W(e.updatedAt)||A(t,"updatedAt","invalid_timestamp","updatedAt must be an ISO 8601 timestamp"),W(e.createdAt)&&W(e.updatedAt)&&Date.parse(e.updatedAt)<Date.parse(e.createdAt)&&A(t,"updatedAt","timestamp_order","updatedAt must not precede createdAt");let n=new Map;Array.isArray(e.nodes)||A(t,"nodes","invalid_nodes","nodes must be an array"),(Array.isArray(e.nodes)?e.nodes:[]).forEach((f,g)=>{let I=`nodes[${g}]`;typeof f.id!="string"||f.id.trim().length===0?A(t,`${I}.id`,"required_string","Node ID must be a non-empty string"):n.has(f.id)?A(t,`${I}.id`,"duplicate_node",`Node ID ${f.id} is duplicated`):n.set(f.id,f),(typeof f.type!="string"||!ze(f.type,fn))&&A(t,`${I}.type`,"invalid_node_type","Node type is invalid"),f.artifactRevision!==void 0&&(!Number.isInteger(f.artifactRevision)||f.artifactRevision<1)&&A(t,`${I}.artifactRevision`,"invalid_revision","artifactRevision must be a positive integer")});let i=new Set,o=new Set;Array.isArray(e.edges)||A(t,"edges","invalid_edges","edges must be an array"),(Array.isArray(e.edges)?e.edges:[]).forEach((f,g)=>{let I=`edges[${g}]`;typeof f.id!="string"||f.id.trim().length===0?A(t,`${I}.id`,"required_string","Edge ID must be a non-empty string"):i.has(f.id)&&A(t,`${I}.id`,"duplicate_edge",`Edge ID ${f.id} is duplicated`),i.add(f.id),(typeof f.type!="string"||!ze(f.type,pn))&&A(t,`${I}.type`,"invalid_edge_type","Edge type is invalid");let V=`${f.type}:${f.from}:${f.to}`;o.has(V)&&A(t,I,"duplicate_edge_identity","Equivalent evidence edge is duplicated"),o.add(V),n.has(f.from)||A(t,`${I}.from`,"dangling_reference",`Source node ${f.from} does not exist`),n.has(f.to)||A(t,`${I}.to`,"dangling_reference",`Target node ${f.to} does not exist`),f.from===f.to&&A(t,I,"self_edge","Evidence edges cannot point to the same node"),W(f.createdAt)||A(t,`${I}.createdAt`,"invalid_timestamp","createdAt must be an ISO 8601 timestamp")});let r=(Array.isArray(e.edges)?e.edges:[]).filter(f=>dn.has(f.type)),a=new Map;for(let f of r){let g=a.get(f.from)??[];g.push(f.to),a.set(f.from,g)}let c=new Set,s=new Set,d=f=>{if(c.has(f))return!0;if(s.has(f))return!1;c.add(f);for(let g of a.get(f)??[])if(d(g))return!0;return c.delete(f),s.add(f),!1};for(let f of n.keys())if(d(f)){A(t,"edges","cyclic_graph","Dependency, decomposition, and supersession edges must be acyclic");break}return t}function z(e){let t=un(e);if(t.length>0)throw new Te(t)}var Ke=class{now;graph;constructor(t){if("schemaVersion"in t)z(t),this.now=()=>new Date().toISOString(),this.graph=de(t);else{this.now=t.now??(()=>new Date().toISOString());let n=this.now();this.graph={schemaVersion:1,graphId:t.graphId,version:1,createdAt:n,updatedAt:n,nodes:[],edges:[]},z(this.graph)}}addNode(t){let n=de(this.graph);return n.nodes.push(Ge(t)),this.touch(n),z(n),this.graph=n,this}addEdge(t){let n=de(this.graph);return n.edges.push(Ye(t)),this.touch(n),z(n),this.graph=n,this}build(){return z(this.graph),de(this.graph)}touch(t){t.version+=1,t.updatedAt=this.now()}};function Ge(e){return{...e,...e.attributes?{attributes:structuredClone(e.attributes)}:{}}}function Ye(e){return{...e,...e.producer?{producer:{...e.producer}}:{},...e.attributes?{attributes:structuredClone(e.attributes)}:{}}}function de(e){return{...e,nodes:e.nodes.map(Ge),edges:e.edges.map(Ye)}}var u=class extends Error{constructor(n,i,o,r){super(i,r);this.code=n;this.detail=o;this.name="XenoArtifactRepositoryError"}code;detail},G=class{records=new Map;currentRevisions=new Map;now;idFactory;eventIds=new Set;idCounter=0;constructor(t={}){this.now=t.now??(()=>new Date().toISOString()),this.idFactory=t.idFactory??(n=>(this.idCounter+=1,`${n}_${Date.now().toString(36)}_${this.idCounter.toString(36)}`)),t.initialState&&this.hydrate(t.initialState)}exportState(){let t=[...this.records.values()].flatMap(n=>[...n.values()]).sort(Ze).map(n=>({artifact:K(n.artifact),recordVersion:n.recordVersion,lifecycleEvents:structuredClone(n.lifecycleEvents),reviewEvents:structuredClone(n.reviewEvents)}));return{schemaVersion:1,records:t}}async create(t){if(w(t),this.assertInitialState(t),t.revision!==1)throw new u("ARTIFACT_REVISION_INVALID","A new artifact must begin at revision 1",{artifactId:t.artifactId,revision:t.revision});if(this.records.has(t.artifactId))throw new u("ARTIFACT_ALREADY_EXISTS",`Artifact ${t.artifactId} already exists`,{artifactId:t.artifactId});let n=K(t),i=this.createLifecycleEvent({artifact:n,sequence:1,actor:n.provenance.producer,fromState:null,toState:n.state,reason:"artifact-created"}),o={artifact:n,recordVersion:1,lifecycleEvents:[i],reviewEvents:[]};return this.records.set(n.artifactId,new Map([[n.revision,o]])),this.currentRevisions.set(n.artifactId,n.revision),D(o)}async createRevision(t,n={}){w(t),this.assertInitialState(t);let i=this.getMutable(t.artifactId);this.assertVersion(i,n.expectedRecordVersion);let o=i.artifact.revision+1;if(t.revision!==o||t.predecessorRevision!==i.artifact.revision)throw new u("ARTIFACT_REVISION_INVALID",`Revision ${t.revision} does not follow current revision ${i.artifact.revision}`,{artifactId:t.artifactId,currentRevision:i.artifact.revision,requestedRevision:t.revision});if(mn(t,i.artifact))throw new u("ARTIFACT_CONTENT_UNCHANGED","A new artifact revision must have a different content hash",{artifactId:t.artifactId,revision:t.revision});if(i.artifact.state==="archived")throw new u("ARTIFACT_REVISION_INVALID","Archived artifacts cannot receive new revisions",{artifactId:t.artifactId,revision:i.artifact.revision});if(i.artifact.state!=="superseded"){ce(i.artifact.state,"superseded");let s=this.now(),d=this.createLifecycleEvent({artifact:i.artifact,sequence:i.lifecycleEvents.length+1,actor:n.actor??t.provenance.producer,fromState:i.artifact.state,toState:"superseded",reason:n.reason??`superseded-by-revision-${t.revision}`,recordedAt:s});i.artifact.state="superseded",i.artifact.updatedAt=s,i.lifecycleEvents.push(d),i.recordVersion+=1}let r=K(t),a=this.createLifecycleEvent({artifact:r,sequence:1,actor:n.actor??r.provenance.producer,fromState:null,toState:r.state,reason:n.reason??`revision-created-from-${i.artifact.revision}`}),c={artifact:r,recordVersion:1,lifecycleEvents:[a],reviewEvents:[]};return this.records.get(r.artifactId)?.set(r.revision,c),this.currentRevisions.set(r.artifactId,r.revision),D(c)}async get(t,n){let i=this.records.get(t);if(!i)return;let o=n??this.currentRevisions.get(t);if(o===void 0)return;let r=i.get(o);return r?D(r):void 0}async require(t,n){let i=await this.get(t,n);if(!i)throw new u("ARTIFACT_NOT_FOUND",`Artifact ${t}${n===void 0?"":` revision ${n}`} was not found`,{artifactId:t,...n===void 0?{}:{revision:n}});return i}async list(t={}){let n=[];for(let[i,o]of this.records)if(!(t.artifactIds&&!t.artifactIds.includes(i)))if(t.includeSuperseded)n.push(...o.values());else{let r=this.currentRevisions.get(i);if(r!==void 0){let a=o.get(r);a&&n.push(a)}}return n.filter(i=>vn(i.artifact,t)).sort(Ze).map(D)}async listRevisions(t){let n=this.records.get(t);return n?[...n.values()].sort((i,o)=>i.artifact.revision-o.artifact.revision).map(D):[]}async transition(t){let n=this.getMutable(t.artifactId,t.revision);if(this.assertVersion(n,t.expectedRecordVersion),ce(n.artifact.state,t.toState),t.toState==="approved"||t.toState==="rejected"){let a=t.reviewEventId?n.reviewEvents.find(s=>s.eventId===t.reviewEventId&&s.type==="decision-recorded"):void 0,c=_e(n.reviewEvents);if(!a||a.decision!==t.toState||c.latestDecisionEventId!==a.eventId)throw new u("ARTIFACT_REVIEW_DECISION_REQUIRED",`Transition to ${t.toState} requires a matching decision event`,{artifactId:t.artifactId,revision:n.artifact.revision});if(t.toState==="approved"&&c.unresolvedComments>0)throw new u("ARTIFACT_UNRESOLVED_COMMENTS",`Artifact has ${c.unresolvedComments} unresolved review comment(s)`,{artifactId:t.artifactId,revision:n.artifact.revision,unresolvedComments:c.unresolvedComments})}let i=this.now(),o=n.artifact.state,r=this.createLifecycleEvent({artifact:n.artifact,sequence:n.lifecycleEvents.length+1,actor:t.actor,fromState:o,toState:t.toState,reason:t.reason,reviewEventId:t.reviewEventId,recordedAt:i});return n.artifact.state=t.toState,n.artifact.updatedAt=i,n.lifecycleEvents.push(r),n.recordVersion+=1,D(n)}async appendReviewEvent(t){let n=t.event,i=this.getMutable(n.artifactId,n.artifactRevision);if(this.assertVersion(i,t.expectedRecordVersion),i.artifact.state==="archived"||i.artifact.state==="superseded")throw new u("ARTIFACT_REVIEW_INVALID",`Cannot append review events to a ${i.artifact.state} artifact revision`,{artifactId:n.artifactId,revision:n.artifactRevision});if(this.assertReviewCommentState(i,n),(n.type==="review-requested"||n.type==="review-withdrawn"||n.type==="decision-recorded")&&i.artifact.state!=="pending_review")throw new u("ARTIFACT_REVIEW_INVALID",`${n.type} requires an artifact in pending_review state`,{artifactId:n.artifactId,revision:n.artifactRevision});let o={...structuredClone(n),schemaVersion:1,eventId:this.nextEventId("review_event"),sequence:i.reviewEvents.length+1,recordedAt:this.now()},r=be(o,i.artifact);if(r.length>0)throw new M("XENO artifact review event validation failed",r);return i.reviewEvents.push(o),i.recordVersion+=1,D(i)}getMutable(t,n){let i=this.records.get(t),o=n??this.currentRevisions.get(t),r=o===void 0?void 0:i?.get(o);if(!r)throw new u("ARTIFACT_NOT_FOUND",`Artifact ${t}${n===void 0?"":` revision ${n}`} was not found`,{artifactId:t,...n===void 0?{}:{revision:n}});return r}assertVersion(t,n){if(n!==void 0&&n!==t.recordVersion)throw new u("ARTIFACT_CONFLICT",`Expected record version ${n}, found ${t.recordVersion}`,{artifactId:t.artifact.artifactId,revision:t.artifact.revision,expectedRecordVersion:n,actualRecordVersion:t.recordVersion})}assertInitialState(t){if(t.state!=="draft"&&t.state!=="pending_review")throw new u("ARTIFACT_REVISION_INVALID","New artifact revisions must begin in draft or pending_review state",{artifactId:t.artifactId,revision:t.revision})}assertReviewCommentState(t,n){if(n.type==="comment-added"){if(t.reviewEvents.some(r=>r.type==="comment-added"&&r.commentId===n.commentId))throw new u("ARTIFACT_REVIEW_INVALID",`Comment ${n.commentId} already exists`);if(n.parentCommentId&&!t.reviewEvents.some(r=>r.type==="comment-added"&&r.commentId===n.parentCommentId))throw new u("ARTIFACT_REVIEW_INVALID",`Parent comment ${n.parentCommentId} does not exist`);return}if(n.type!=="comment-resolved"&&n.type!=="comment-reopened")return;if(!t.reviewEvents.some(r=>r.type==="comment-added"&&r.commentId===n.commentId))throw new u("ARTIFACT_REVIEW_INVALID",`Comment ${n.commentId} does not exist`);let o=hn(t.reviewEvents,n.commentId);if(n.type==="comment-resolved"&&o.resolved)throw new u("ARTIFACT_REVIEW_INVALID",`Comment ${n.commentId} is already resolved`);if(n.type==="comment-reopened"&&!o.resolved)throw new u("ARTIFACT_REVIEW_INVALID",`Comment ${n.commentId} is not resolved`)}createLifecycleEvent(t){return{schemaVersion:1,eventId:this.nextEventId("artifact_event"),artifactId:t.artifact.artifactId,revision:t.artifact.revision,sequence:t.sequence,recordedAt:t.recordedAt??this.now(),actor:{...t.actor},fromState:t.fromState,toState:t.toState,...t.reason?{reason:t.reason}:{},...t.reviewEventId?{reviewEventId:t.reviewEventId}:{}}}nextEventId(t){let n=this.idFactory(t);if(typeof n!="string"||n.trim().length===0||this.eventIds.has(n))throw new u("ARTIFACT_CONFLICT",`Event ID factory produced an invalid or duplicate ${t} ID`);return this.eventIds.add(n),n}hydrate(t){if(t.schemaVersion!==1||!Array.isArray(t.records))throw new u("ARTIFACT_REVISION_INVALID","Artifact repository state has an unsupported schema or record collection");let n=[...t.records].sort((i,o)=>i.artifact.artifactId.localeCompare(o.artifact.artifactId)||i.artifact.revision-o.artifact.revision);for(let i of n){let o=ln(i,this.eventIds),r=this.records.get(o.artifact.artifactId);if(r||(r=new Map,this.records.set(o.artifact.artifactId,r)),r.has(o.artifact.revision))throw new u("ARTIFACT_REVISION_INVALID",`Duplicate persisted revision ${o.artifact.artifactId}:${o.artifact.revision}`);r.set(o.artifact.revision,o),this.currentRevisions.set(o.artifact.artifactId,o.artifact.revision)}for(let[i,o]of this.records){let r=[...o.values()].sort((a,c)=>a.artifact.revision-c.artifact.revision);for(let a=0;a<r.length;a+=1){let c=r[a],s=a+1;if(c.artifact.revision!==s)throw new u("ARTIFACT_REVISION_INVALID",`Persisted artifact ${i} is missing revision ${s}`);if(a===0&&c.artifact.predecessorRevision!==void 0)throw new u("ARTIFACT_REVISION_INVALID",`Initial revision for ${i} cannot declare a predecessor`);if(a>0&&c.artifact.predecessorRevision!==s-1)throw new u("ARTIFACT_REVISION_INVALID",`Persisted revision ${i}:${s} has an invalid predecessor`);if(a<r.length-1&&c.artifact.state!=="superseded")throw new u("ARTIFACT_REVISION_INVALID",`Non-current revision ${i}:${s} must be superseded`)}}}};function ln(e,t){if(w(e.artifact),!Number.isInteger(e.recordVersion)||e.recordVersion<1)throw new u("ARTIFACT_REVISION_INVALID","Persisted artifact recordVersion must be a positive integer",{artifactId:e.artifact.artifactId,revision:e.artifact.revision});if(!Array.isArray(e.lifecycleEvents)||e.lifecycleEvents.length===0||!Array.isArray(e.reviewEvents))throw new u("ARTIFACT_REVISION_INVALID","Persisted artifact records require lifecycle and review event arrays",{artifactId:e.artifact.artifactId,revision:e.artifact.revision});let n=e.lifecycleEvents.length+e.reviewEvents.length;if(e.recordVersion!==n)throw new u("ARTIFACT_REVISION_INVALID",`Persisted record version ${e.recordVersion} does not match ${n} mutations`,{artifactId:e.artifact.artifactId,revision:e.artifact.revision});let i=null;for(let r=0;r<e.lifecycleEvents.length;r+=1){let a=e.lifecycleEvents[r];if(a.schemaVersion!==1||a.artifactId!==e.artifact.artifactId||a.revision!==e.artifact.revision||a.sequence!==r+1||a.fromState!==i||typeof a.eventId!="string"||a.eventId.length===0||t.has(a.eventId)||!Number.isFinite(Date.parse(a.recordedAt)))throw new u("ARTIFACT_REVISION_INVALID",`Persisted lifecycle event ${r+1} is invalid`,{artifactId:e.artifact.artifactId,revision:e.artifact.revision});if(i===null){if(a.toState!=="draft"&&a.toState!=="pending_review")throw new u("ARTIFACT_REVISION_INVALID","A persisted artifact must begin in draft or pending_review state",{artifactId:e.artifact.artifactId,revision:e.artifact.revision})}else ce(i,a.toState);t.add(a.eventId),i=a.toState}if(i!==e.artifact.state)throw new u("ARTIFACT_REVISION_INVALID","Persisted artifact state does not match its lifecycle tail",{artifactId:e.artifact.artifactId,revision:e.artifact.revision});let o=new Map;for(let r=0;r<e.reviewEvents.length;r+=1){let a=e.reviewEvents[r];if(a.sequence!==r+1||t.has(a.eventId))throw new u("ARTIFACT_REVIEW_INVALID",`Persisted review event ${r+1} has an invalid sequence or duplicate ID`,{artifactId:e.artifact.artifactId,revision:e.artifact.revision});let c=be(a,e.artifact);if(c.length>0)throw new M("Persisted XENO artifact review event validation failed",c);if(a.type==="comment-added"){if(o.has(a.commentId)||a.parentCommentId!==void 0&&!o.has(a.parentCommentId))throw new u("ARTIFACT_REVIEW_INVALID",`Persisted comment ${a.commentId} has an invalid identity or parent`);o.set(a.commentId,!1)}else if(a.type==="comment-resolved"||a.type==="comment-reopened"){let s=o.get(a.commentId);if(s===void 0||a.type==="comment-resolved"&&s||a.type==="comment-reopened"&&!s)throw new u("ARTIFACT_REVIEW_INVALID",`Persisted comment transition for ${a.commentId} is invalid`);o.set(a.commentId,a.type==="comment-resolved")}t.add(a.eventId)}return{artifact:K(e.artifact),recordVersion:e.recordVersion,lifecycleEvents:structuredClone(e.lifecycleEvents),reviewEvents:structuredClone(e.reviewEvents)}}function mn(e,t){return e.content.hash.algorithm===t.content.hash.algorithm&&e.content.hash.value===t.content.hash.value}function vn(e,t){return!(t.kinds&&!t.kinds.includes(e.kind)||t.states&&!t.states.includes(e.state)||t.runId&&e.identity?.runId!==t.runId||t.sessionId&&e.identity?.sessionId!==t.sessionId||t.turnId&&e.identity?.turnId!==t.turnId||t.taskId&&e.identity?.taskId!==t.taskId||t.workspaceId&&e.identity?.workspaceId!==t.workspaceId||t.repositoryId&&e.identity?.repositoryId!==t.repositoryId||t.producerId&&e.provenance.producer.id!==t.producerId||t.sensitivity&&!t.sensitivity.includes(e.sensitivity))}function Ze(e,t){return e.artifact.createdAt.localeCompare(t.artifact.createdAt)||e.artifact.artifactId.localeCompare(t.artifact.artifactId)||e.artifact.revision-t.artifact.revision}function hn(e,t){let n=!1;for(let i of e)(i.type==="comment-resolved"||i.type==="comment-reopened")&&i.commentId===t&&(n=i.type==="comment-resolved");return{resolved:n}}function K(e){return structuredClone(e)}function D(e){return{artifact:K(e.artifact),recordVersion:e.recordVersion,etag:`${e.artifact.artifactId}:${e.artifact.revision}:${e.recordVersion}`,lifecycleEvents:structuredClone(e.lifecycleEvents),reviewEvents:structuredClone(e.reviewEvents),reviewSummary:_e(e.reviewEvents)}}import{randomUUID as ft}from"node:crypto";import{mkdir as pt,open as ot,readFile as bn,rename as _n,stat as ut,unlink as Tn}from"node:fs/promises";import{basename as st,dirname as at,join as kn,resolve as xn}from"node:path";import{mkdirSync as gn,readFileSync as An,rmSync as et,writeFileSync as yn}from"node:fs";import{hostname as tt}from"node:os";import{dirname as In}from"node:path";function wn(){return new Date().toISOString()}function En(){return new Date(Date.now()-Math.floor(process.uptime()*1e3)).toISOString()}function nt(e){try{return JSON.parse(An(e,"utf8"))}catch{return null}}function Rn(e){if(!e||e<=0)return!1;try{return process.kill(e,0),!0}catch{return!1}}function Xn(e){return e.hostname!==tt()?!0:Rn(e.pid)}function Qe(e,t){gn(In(e),{recursive:!0}),yn(e,JSON.stringify(t,null,2)+`
-`,{encoding:"utf8",flag:"wx"})}function Sn(e,t){let n=nt(e);n?.pid!==t.pid||n.hostname!==t.hostname||et(e,{force:!0})}function it(e,t,n){let i=wn(),o={schemaVersion:1,name:t,pid:process.pid,hostname:tt(),processStartedAt:En(),version:n,acquiredAt:i,updatedAt:i};try{Qe(e,o)}catch(r){if(r.code!=="EEXIST")throw r;let c=nt(e);if(c&&Xn(c))throw new Error(`${t} is already locked by PID ${c.pid} on ${c.hostname}.`);et(e,{force:!0}),Qe(e,o)}return{record:o,release:()=>{Sn(e,o)}}}var rt="0.9.26";var lt=1,Cn="repository.v1.json",Nn=5e3,Vn=20,Pn=64*1024*1024,ct=class{directory;snapshotPath;backupPath;lockPath;now;lockTimeoutMs;lockRetryMs;maxSnapshotBytes;onRecovery;mutationTail=Promise.resolve();constructor(t){if(!t||typeof t.directory!="string"||t.directory.trim().length===0)throw new TypeError("Artifact repository directory is required");let n=t.snapshotFileName??Cn;if(st(n)!==n||!/^[A-Za-z0-9_.-]+$/.test(n))throw new TypeError("Artifact snapshot filename must be a safe basename");this.directory=xn(t.directory),this.snapshotPath=kn(this.directory,n),this.backupPath=`${this.snapshotPath}.bak`,this.lockPath=`${this.snapshotPath}.lock`,this.now=t.now??(()=>new Date().toISOString()),this.lockTimeoutMs=ke(t.lockTimeoutMs,Nn,100,6e4,"lockTimeoutMs"),this.lockRetryMs=ke(t.lockRetryMs,Vn,1,1e3,"lockRetryMs"),this.maxSnapshotBytes=ke(t.maxSnapshotBytes,Pn,1024,1024*1024*1024,"maxSnapshotBytes"),this.onRecovery=t.onRecovery}async create(t){return this.mutate(n=>n.create(t))}async createRevision(t,n){return this.mutate(i=>i.createRevision(t,n))}async get(t,n){return(await this.load()).repository.get(t,n)}async require(t,n){return(await this.load()).repository.require(t,n)}async list(t){return(await this.load()).repository.list(t)}async listRevisions(t){return(await this.load()).repository.listRevisions(t)}async transition(t){return this.mutate(n=>n.transition(t))}async appendReviewEvent(t){return this.mutate(n=>n.appendReviewEvent(t))}async inspectSnapshot(){return this.readSnapshot(this.snapshotPath,!0)}async mutate(t){return this.enqueueMutation(async()=>{let n=await this.acquireLock();try{let i=await this.load(),o=await t(i.repository);return await this.persist(i),o}finally{n.release()}})}async enqueueMutation(t){let n=this.mutationTail.then(t,t);return this.mutationTail=n.then(()=>{},()=>{}),n}async acquireLock(){let t=Date.now(),n;for(;Date.now()-t<=this.lockTimeoutMs;)try{return it(this.lockPath,`artifact-repository:${st(this.snapshotPath)}`,rt)}catch(i){if(!(i instanceof Error)||!/already locked by PID/.test(i.message))throw i;n=i,await Ln(this.lockRetryMs)}throw new u("ARTIFACT_PERSISTENCE_LOCKED",`Artifact repository remained locked for ${this.lockTimeoutMs}ms`,{snapshotPath:this.snapshotPath},{cause:n})}async load(){let t,n,i=!1;try{n=await this.readSnapshot(this.snapshotPath,!1)}catch(r){t=fe(r)}if(!n&&(t||await Fn(this.backupPath)))try{let r=await this.readSnapshot(this.backupPath,!0);r&&(this.onRecovery?.({snapshotPath:this.snapshotPath,backupPath:this.backupPath,reason:t?.message??"primary snapshot missing"}),n=r,i=!0)}catch(r){throw t?new u("ARTIFACT_PERSISTENCE_CORRUPT","Artifact repository primary and backup snapshots are unreadable",{snapshotPath:this.snapshotPath,backupPath:this.backupPath},{cause:new AggregateError([t,fe(r)])}):r}if(!n&&t)throw t;let o=n?.state??{schemaVersion:1,records:[]};return{repository:new G({now:this.now,idFactory:r=>`${r}_${ft()}`,initialState:o}),generation:n?.generation??0,createdAt:n?.createdAt??this.now(),hasSnapshot:n!==void 0,recoveredFromBackup:i,...n?{sourceSnapshot:n}:{}}}async persist(t){let n=this.now(),o={...{schemaVersion:lt,generation:t.generation,createdAt:t.createdAt,updatedAt:n,state:t.repository.exportState()},generation:t.generation+1},r=On(o),a=`${JSON.stringify(r,null,2)}
+var h=1,oe=1,He=["plan","requirements","design","task-graph","patch","diff","file","document","diagram","screenshot","recording","browser-snapshot","test-report","review-report","security-report","performance-report","release-report","sbom","provenance","attestation"],je=["draft","pending_review","approved","rejected","superseded","archived"],qe=["public","internal","confidential","restricted"],Je=["agent","tool","user","system","integration"],se=["requirement","design-decision","risk","task","agent","run","tool-call","edit","commit","test-case","test-run","finding","approval","artifact","release","claim"],ae=["decomposes","depends_on","implements","changes","tests","verifies","finds","fixes","reviews","approves","rejects","supersedes","derived_from","produced_by","supports_claim","contradicts_claim","released_as"];import{Buffer as Be}from"node:buffer";import{createHash as zt}from"node:crypto";function _(e){return{algorithm:"sha256",value:zt("sha256").update(e).digest("hex")}}function S(e){return JSON.stringify(Ee(e,new Set))}function T(e){return _(S(e))}function Ee(e,t){if(e===null||typeof e!="object"){if(typeof e=="number"&&!Number.isFinite(e))throw new TypeError("Artifact JSON cannot contain non-finite numbers");return e}if(t.has(e))throw new TypeError("Artifact JSON cannot contain cycles");if(t.add(e),Array.isArray(e)){let i=e.map(o=>Ee(o,t));return t.delete(e),i}let n={};for(let i of Object.keys(e).sort((o,r)=>o.localeCompare(r))){let o=e[i];if(o===void 0)throw new TypeError(`Artifact JSON property ${i} is undefined`);n[i]=Ee(o,t)}return t.delete(e),n}var Kt=/^[a-z0-9][a-z0-9._/-]{0,127}$/,Re="custom:";function $(e,t=Re){return e.startsWith(t)?Kt.test(e.slice(t.length)):!1}var M=class extends Error{code="ARTIFACT_INVALID";issues;constructor(t,n){super(t),this.name="XenoArtifactValidationError",this.issues=n.map(i=>({...i}))}},Xe=class extends Error{constructor(n,i){super(`Artifact state cannot transition from ${n} to ${i}`);this.fromState=n;this.toState=i;this.name="XenoArtifactStateTransitionError"}fromState;toState;code="ARTIFACT_STATE_TRANSITION_INVALID"},Gt={draft:["pending_review","superseded","archived"],pending_review:["approved","rejected","superseded","archived"],approved:["superseded","archived"],rejected:["superseded","archived"],superseded:["archived"],archived:[]},Yt="[\\u0000-\\u001f\\u007f]",Zt=new RegExp(Yt),Ue=/^[a-f0-9]{64}$/,Qt=/^(?:[A-Za-z0-9+/]{4})*(?:[A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=)?$/,en=new Set(je),tn=new Set(qe),nn=new Set(Je),rn=new Set(He),on=new Set(se),sn=new Set(ae);function p(e,t,n,i){e.push({path:t,code:n,message:i})}function l(e,t,n,i=1024){return typeof e!="string"||e.trim().length===0?(p(n,t,"required_string","Value must be a non-empty string"),!1):(e.length>i&&p(n,t,"string_too_long",`Value must not exceed ${i} characters`),Zt.test(e)&&p(n,t,"control_character","Value must not contain control characters"),!0)}function B(e,t,n){e!==void 0&&(!Number.isFinite(Date.parse(e))||!e.includes("T"))&&p(n,t,"invalid_timestamp","Value must be an ISO 8601 timestamp")}function O(e,t,n,i){typeof e=="string"&&e.startsWith(t)&&($(e,t)||p(i,n,"invalid_custom_name",`Custom name after ${t} is invalid`))}function We(e,t,n){if(!e||typeof e!="object"){p(n,t,"missing_actor","Actor is required");return}l(e.kind,`${t}.kind`,n,64),nn.has(e.kind)||p(n,`${t}.kind`,"unknown_actor_kind","Actor kind is not supported"),l(e.id,`${t}.id`,n,512),e?.displayName!==void 0&&l(e.displayName,`${t}.displayName`,n,512),e?.profileFingerprint!==void 0&&!/^[a-f0-9]{64}$/.test(e.profileFingerprint)&&p(n,`${t}.profileFingerprint`,"invalid_fingerprint","Profile fingerprint must be 64 lowercase hexadecimal characters")}function Se(e,t,n){if(!e||typeof e!="object"){p(n,t,"invalid_anchor","Anchor must be an object");return}switch(e.kind){case"file":l(e.path,`${t}.path`,n,4096);break;case"source-line":l(e.path,`${t}.path`,n,4096),(!Number.isInteger(e.startLine)||e.startLine<1)&&p(n,`${t}.startLine`,"invalid_line","startLine must be a positive integer"),e.endLine!==void 0&&(!Number.isInteger(e.endLine)||e.endLine<e.startLine)&&p(n,`${t}.endLine`,"invalid_line_range","endLine must be greater than or equal to startLine");break;case"diff-hunk":l(e.path,`${t}.path`,n,4096),l(e.hunkId,`${t}.hunkId`,n,512);break;case"symbol":l(e.path,`${t}.path`,n,4096),l(e.symbol,`${t}.symbol`,n,1024);break;case"dom-node":l(e.pageId,`${t}.pageId`,n,512),!e.selector&&!e.accessibilityId&&!e.snapshotArtifactId&&p(n,t,"missing_dom_locator","DOM anchors require a selector, accessibility ID, or snapshot artifact ID");break;case"timeline":l(e.recordingArtifactId,`${t}.recordingArtifactId`,n,512),(!Number.isFinite(e.startMs)||e.startMs<0)&&p(n,`${t}.startMs`,"invalid_time","startMs must be a non-negative finite number"),e.endMs!==void 0&&(!Number.isFinite(e.endMs)||e.endMs<e.startMs)&&p(n,`${t}.endMs`,"invalid_time_range","endMs must be greater than or equal to startMs");break;case"region":l(e.mediaArtifactId,`${t}.mediaArtifactId`,n,512),[e.x,e.y,e.width,e.height].every(Number.isFinite)?(e.width<=0||e.height<=0)&&p(n,t,"invalid_region_size","Region width and height must be positive"):p(n,t,"invalid_region","Region coordinates must be finite numbers");break;case"artifact":l(e.artifactId,`${t}.artifactId`,n,512);break;default:typeof e.kind!="string"||!e.kind.startsWith("custom:")?p(n,`${t}.kind`,"unknown_anchor","Anchor kind is not supported"):O(e.kind,"custom:",`${t}.kind`,n)}}function U(e,t,n,i){if(!(e===null||typeof e=="string"||typeof e=="boolean")){if(typeof e=="number"){Number.isFinite(e)||p(n,t,"non_finite_number","JSON numbers must be finite");return}if(typeof e!="object"){p(n,t,"non_json_value","Value must be JSON-serializable");return}if(i.has(e)){p(n,t,"cyclic_value","Value must not contain cycles");return}if(i.add(e),Array.isArray(e))e.forEach((o,r)=>U(o,`${t}[${r}]`,n,i));else for(let[o,r]of Object.entries(e))r===void 0?p(n,`${t}.${o}`,"undefined_value","Undefined is not valid JSON"):U(r,`${t}.${o}`,n,i);i.delete(e)}}function an(e){let t=[];if(!e||typeof e!="object")return[{path:"$",code:"invalid_artifact",message:"Artifact must be an object"}];if(e.schemaVersion!==1&&p(t,"schemaVersion","unsupported_schema",`schemaVersion must be ${1}`),l(e.artifactId,"artifactId",t,512),(!Number.isInteger(e.revision)||e.revision<1)&&p(t,"revision","invalid_revision","revision must be a positive integer"),l(e.kind,"kind",t,160),typeof e.kind=="string"&&!rn.has(e.kind)&&!e.kind.startsWith("custom:")&&p(t,"kind","unknown_artifact_kind","Artifact kind is not supported"),O(e.kind,"custom:","kind",t),l(e.title,"title",t,1024),e.description!==void 0&&l(e.description,"description",t,32768),l(e.state,"state",t,64),en.has(e.state)||p(t,"state","unknown_state","Artifact state is not supported"),l(e.createdAt,"createdAt",t,128),B(e.createdAt,"createdAt",t),B(e.updatedAt,"updatedAt",t),e.updatedAt&&Number.isFinite(Date.parse(e.createdAt))&&Date.parse(e.updatedAt)<Date.parse(e.createdAt)&&p(t,"updatedAt","timestamp_order","updatedAt must not precede createdAt"),l(e.mediaType,"mediaType",t,255),l(e.sensitivity,"sensitivity",t,64),tn.has(e.sensitivity)||p(t,"sensitivity","unknown_sensitivity","Sensitivity is not supported"),e.identity)for(let[i,o]of Object.entries(e.identity))o!==void 0&&l(o,`identity.${i}`,t,512);if(!e.content||typeof e.content!="object")p(t,"content","missing_content","content descriptor is required");else{!e.content.hash||typeof e.content.hash!="object"?p(t,"content.hash","missing_hash","content hash is required"):(l(e.content.hash.algorithm,"content.hash.algorithm",t,128),O(e.content.hash.algorithm,"custom:","content.hash.algorithm",t),typeof e.content.hash.algorithm=="string"&&e.content.hash.algorithm!=="sha256"&&!e.content.hash.algorithm.startsWith("custom:")&&p(t,"content.hash.algorithm","unknown_hash_algorithm","Hash algorithm is not supported"),l(e.content.hash.value,"content.hash.value",t,512),e.content.hash.algorithm==="sha256"&&!Ue.test(e.content.hash.value)&&p(t,"content.hash.value","invalid_sha256","SHA-256 hash must be 64 lowercase hexadecimal characters")),(!Number.isSafeInteger(e.content.sizeBytes)||e.content.sizeBytes<0)&&p(t,"content.sizeBytes","invalid_size","sizeBytes must be a non-negative safe integer");let i=e.content.storage;if(!i||typeof i!="object")p(t,"content.storage","missing_storage","storage reference is required");else if(i.type==="inline")if(i.text===void 0==(i.base64===void 0))p(t,"content.storage","invalid_inline_storage","Inline storage requires exactly one of text or base64");else{let o;i.text!==void 0?o=Be.from(i.text,"utf8"):i.base64!==void 0&&(Qt.test(i.base64)?o=Be.from(i.base64,"base64"):p(t,"content.storage.base64","invalid_base64","Inline base64 content is malformed")),o&&e.content.sizeBytes!==o.byteLength&&p(t,"content.sizeBytes","content_size_mismatch","sizeBytes does not match inline content"),o&&e.content.hash.algorithm==="sha256"&&_(o).value!==e.content.hash.value&&p(t,"content.hash.value","content_hash_mismatch","Hash does not match inline content")}else i.type==="file"?l(i.path,"content.storage.path",t,4096):i.type==="blob"?l(i.uri,"content.storage.uri",t,8192):i.type==="git"?(l(i.commit,"content.storage.commit",t,512),l(i.path,"content.storage.path",t,4096)):i.type==="url"?(l(i.url,"content.storage.url",t,8192),B(i.expiresAt,"content.storage.expiresAt",t)):i.type==="external"?(l(i.provider,"content.storage.provider",t,255),l(i.locator,"content.storage.locator",t,8192)):p(t,"content.storage.type","unknown_storage","Storage type is not supported");e.content.encoding!==void 0&&(typeof e.content.encoding!="string"||e.content.encoding!=="utf8"&&e.content.encoding!=="base64"&&e.content.encoding!=="binary"&&!e.content.encoding.startsWith("custom:"))&&p(t,"content.encoding","unknown_encoding","Content encoding is not supported"),O(e.content.encoding,"custom:","content.encoding",t)}!e.provenance||typeof e.provenance!="object"?p(t,"provenance","missing_provenance","provenance is required"):(We(e.provenance.producer,"provenance.producer",t),e.provenance.capabilityLeaseIds?.forEach((i,o)=>l(i,`provenance.capabilityLeaseIds[${o}]`,t,512)),e.provenance.sourceArtifactIds?.forEach((i,o)=>l(i,`provenance.sourceArtifactIds[${o}]`,t,512)),e.provenance.attributes&&U(e.provenance.attributes,"provenance.attributes",t,new Set));let n=new Set;return e.relationships?.forEach((i,o)=>{let r=`relationships[${o}]`;l(i.relation,`${r}.relation`,t,160),typeof i.relation=="string"&&!sn.has(i.relation)&&!i.relation.startsWith("custom:")&&p(t,`${r}.relation`,"unknown_relationship","Relationship type is not supported"),O(i.relation,"custom:",`${r}.relation`,t),l(i.target?.type,`${r}.target.type`,t,160),typeof i.target?.type=="string"&&!on.has(i.target.type)&&!i.target.type.startsWith("custom:")&&p(t,`${r}.target.type`,"unknown_reference_type","Evidence reference type is not supported"),O(i.target?.type,"custom:",`${r}.target.type`,t),l(i.target?.id,`${r}.target.id`,t,512);let a=`${i.relation}:${i.target?.type}:${i.target?.id}:${i.target?.revision??""}`;n.has(a)&&p(t,r,"duplicate_relationship","Duplicate relationship"),n.add(a),i.attributes&&U(i.attributes,`${r}.attributes`,t,new Set)}),e.anchors?.forEach((i,o)=>Se(i,`anchors[${o}]`,t)),e.revision===1&&e.predecessorRevision!==void 0&&p(t,"predecessorRevision","unexpected_predecessor","First revision cannot have a predecessor"),e.revision>1&&(!Number.isInteger(e.predecessorRevision)||(e.predecessorRevision??0)>=e.revision)&&p(t,"predecessorRevision","invalid_predecessor","Later revisions require an earlier predecessor revision"),B(e.retention?.retainUntil,"retention.retainUntil",t),e.retention?.legalHold!==void 0&&typeof e.retention.legalHold!="boolean"&&p(t,"retention.legalHold","invalid_boolean","legalHold must be a boolean"),e.extensions&&U(e.extensions,"extensions",t,new Set),t}function w(e){let t=an(e);if(t.length>0)throw new M("XENO artifact validation failed",t)}function cn(e,t){return Gt[e].includes(t)}function ce(e,t){if(!cn(e,t))throw new Xe(e,t)}function be(e,t){let n=[];return e.schemaVersion!==1&&p(n,"schemaVersion","unsupported_schema",`schemaVersion must be ${1}`),l(e.eventId,"eventId",n,512),l(e.artifactId,"artifactId",n,512),(!Number.isInteger(e.artifactRevision)||e.artifactRevision<1)&&p(n,"artifactRevision","invalid_revision","artifactRevision must be a positive integer"),(!Number.isInteger(e.sequence)||e.sequence<1)&&p(n,"sequence","invalid_sequence","sequence must be a positive integer"),l(e.recordedAt,"recordedAt",n,128),B(e.recordedAt,"recordedAt",n),We(e.actor,"actor",n),!e.artifactHash||typeof e.artifactHash!="object"?p(n,"artifactHash","missing_hash","Artifact hash is required"):(l(e.artifactHash.algorithm,"artifactHash.algorithm",n,128),O(e.artifactHash.algorithm,"custom:","artifactHash.algorithm",n),l(e.artifactHash.value,"artifactHash.value",n,512),e.artifactHash.algorithm==="sha256"&&!Ue.test(e.artifactHash.value)&&p(n,"artifactHash.value","invalid_sha256","SHA-256 hash must be 64 lowercase hexadecimal characters"),typeof e.artifactHash.algorithm=="string"&&e.artifactHash.algorithm!=="sha256"&&!e.artifactHash.algorithm.startsWith("custom:")&&p(n,"artifactHash.algorithm","unknown_hash_algorithm","Hash algorithm is not supported")),["review-requested","comment-added","comment-resolved","comment-reopened","decision-recorded","review-withdrawn"].includes(e.type)||p(n,"type","unknown_review_event","Review event type is not supported"),e.type==="comment-added"?(l(e.commentId,"commentId",n,512),l(e.body,"body",n,65536),e.anchor&&Se(e.anchor,"anchor",n)):e.type==="comment-resolved"||e.type==="comment-reopened"?l(e.commentId,"commentId",n,512):e.type==="decision-recorded"&&(["approved","rejected","changes_requested"].includes(e.decision)||p(n,"decision","unknown_review_decision","Review decision is not supported"),e.scope&&Se(e.scope,"scope",n)),t&&(e.artifactId!==t.artifactId&&p(n,"artifactId","artifact_mismatch","Review event targets a different artifact"),e.artifactRevision!==t.revision&&p(n,"artifactRevision","revision_mismatch","Review event targets a different revision"),e.artifactHash&&(e.artifactHash.algorithm!==t.content.hash.algorithm||e.artifactHash.value!==t.content.hash.value)&&p(n,"artifactHash","hash_mismatch","Review event hash does not match the artifact revision")),n}function _e(e){let t="not_requested",n,i,o,r=0,a=new Set,c=new Set;for(let s of[...e].sort((d,f)=>d.sequence-f.sequence))o=s.recordedAt,s.type==="review-requested"?t="pending":s.type==="review-withdrawn"?t="withdrawn":s.type==="comment-added"?(a.add(s.commentId),c.delete(s.commentId),t==="not_requested"&&(t="pending")):s.type==="comment-resolved"?c.add(s.commentId):s.type==="comment-reopened"?c.delete(s.commentId):s.type==="decision-recorded"&&(s.scope?r+=1:(n=s.decision,i=s.eventId,t=s.decision));return{status:t,totalComments:a.size,unresolvedComments:[...a].filter(s=>!c.has(s)).length,...n?{latestDecision:n}:{},...i?{latestDecisionEventId:i}:{},...r>0?{scopedDecisionCount:r}:{},...o?{lastReviewedAt:o}:{}}}var Te=class extends Error{code="EVIDENCE_GRAPH_INVALID";issues;constructor(t){super("XENO evidence graph validation failed"),this.name="XenoEvidenceGraphValidationError",this.issues=t.map(n=>({...n}))}},dn=new Set(["depends_on","decomposes","supersedes"]),fn=new Set(se),pn=new Set(ae);function A(e,t,n,i){e.push({path:t,code:n,message:i})}function W(e){return e.includes("T")&&Number.isFinite(Date.parse(e))}function ze(e,t){return e.startsWith(Re)?$(e):t.has(e)}function un(e){let t=[];if(!e||typeof e!="object")return[{path:"$",code:"invalid_graph",message:"Evidence graph must be an object"}];e.schemaVersion!==1&&A(t,"schemaVersion","unsupported_schema",`schemaVersion must be ${1}`),(typeof e.graphId!="string"||e.graphId.trim().length===0)&&A(t,"graphId","required_string","graphId must be a non-empty string"),(!Number.isInteger(e.version)||e.version<1)&&A(t,"version","invalid_version","version must be a positive integer"),W(e.createdAt)||A(t,"createdAt","invalid_timestamp","createdAt must be an ISO 8601 timestamp"),W(e.updatedAt)||A(t,"updatedAt","invalid_timestamp","updatedAt must be an ISO 8601 timestamp"),W(e.createdAt)&&W(e.updatedAt)&&Date.parse(e.updatedAt)<Date.parse(e.createdAt)&&A(t,"updatedAt","timestamp_order","updatedAt must not precede createdAt");let n=new Map;Array.isArray(e.nodes)||A(t,"nodes","invalid_nodes","nodes must be an array"),(Array.isArray(e.nodes)?e.nodes:[]).forEach((f,g)=>{let I=`nodes[${g}]`;typeof f.id!="string"||f.id.trim().length===0?A(t,`${I}.id`,"required_string","Node ID must be a non-empty string"):n.has(f.id)?A(t,`${I}.id`,"duplicate_node",`Node ID ${f.id} is duplicated`):n.set(f.id,f),(typeof f.type!="string"||!ze(f.type,fn))&&A(t,`${I}.type`,"invalid_node_type","Node type is invalid"),f.artifactRevision!==void 0&&(!Number.isInteger(f.artifactRevision)||f.artifactRevision<1)&&A(t,`${I}.artifactRevision`,"invalid_revision","artifactRevision must be a positive integer")});let i=new Set,o=new Set;Array.isArray(e.edges)||A(t,"edges","invalid_edges","edges must be an array"),(Array.isArray(e.edges)?e.edges:[]).forEach((f,g)=>{let I=`edges[${g}]`;typeof f.id!="string"||f.id.trim().length===0?A(t,`${I}.id`,"required_string","Edge ID must be a non-empty string"):i.has(f.id)&&A(t,`${I}.id`,"duplicate_edge",`Edge ID ${f.id} is duplicated`),i.add(f.id),(typeof f.type!="string"||!ze(f.type,pn))&&A(t,`${I}.type`,"invalid_edge_type","Edge type is invalid");let V=`${f.type}:${f.from}:${f.to}`;o.has(V)&&A(t,I,"duplicate_edge_identity","Equivalent evidence edge is duplicated"),o.add(V),n.has(f.from)||A(t,`${I}.from`,"dangling_reference",`Source node ${f.from} does not exist`),n.has(f.to)||A(t,`${I}.to`,"dangling_reference",`Target node ${f.to} does not exist`),f.from===f.to&&A(t,I,"self_edge","Evidence edges cannot point to the same node"),W(f.createdAt)||A(t,`${I}.createdAt`,"invalid_timestamp","createdAt must be an ISO 8601 timestamp")});let r=(Array.isArray(e.edges)?e.edges:[]).filter(f=>dn.has(f.type)),a=new Map;for(let f of r){let g=a.get(f.from)??[];g.push(f.to),a.set(f.from,g)}let c=new Set,s=new Set,d=f=>{if(c.has(f))return!0;if(s.has(f))return!1;c.add(f);for(let g of a.get(f)??[])if(d(g))return!0;return c.delete(f),s.add(f),!1};for(let f of n.keys())if(d(f)){A(t,"edges","cyclic_graph","Dependency, decomposition, and supersession edges must be acyclic");break}return t}function z(e){let t=un(e);if(t.length>0)throw new Te(t)}var Ke=class{now;graph;constructor(t){if("schemaVersion"in t)z(t),this.now=()=>new Date().toISOString(),this.graph=de(t);else{this.now=t.now??(()=>new Date().toISOString());let n=this.now();this.graph={schemaVersion:1,graphId:t.graphId,version:1,createdAt:n,updatedAt:n,nodes:[],edges:[]},z(this.graph)}}addNode(t){let n=de(this.graph);return n.nodes.push(Ge(t)),this.touch(n),z(n),this.graph=n,this}addEdge(t){let n=de(this.graph);return n.edges.push(Ye(t)),this.touch(n),z(n),this.graph=n,this}build(){return z(this.graph),de(this.graph)}touch(t){t.version+=1,t.updatedAt=this.now()}};function Ge(e){return{...e,...e.attributes?{attributes:structuredClone(e.attributes)}:{}}}function Ye(e){return{...e,...e.producer?{producer:{...e.producer}}:{},...e.attributes?{attributes:structuredClone(e.attributes)}:{}}}function de(e){return{...e,nodes:e.nodes.map(Ge),edges:e.edges.map(Ye)}}var u=class extends Error{constructor(n,i,o,r){super(i,r);this.code=n;this.detail=o;this.name="XenoArtifactRepositoryError"}code;detail},G=class{records=new Map;currentRevisions=new Map;now;idFactory;eventIds=new Set;idCounter=0;constructor(t={}){this.now=t.now??(()=>new Date().toISOString()),this.idFactory=t.idFactory??(n=>(this.idCounter+=1,`${n}_${Date.now().toString(36)}_${this.idCounter.toString(36)}`)),t.initialState&&this.hydrate(t.initialState)}exportState(){let t=[...this.records.values()].flatMap(n=>[...n.values()]).sort(Ze).map(n=>({artifact:K(n.artifact),recordVersion:n.recordVersion,lifecycleEvents:structuredClone(n.lifecycleEvents),reviewEvents:structuredClone(n.reviewEvents)}));return{schemaVersion:1,records:t}}async create(t){if(w(t),this.assertInitialState(t),t.revision!==1)throw new u("ARTIFACT_REVISION_INVALID","A new artifact must begin at revision 1",{artifactId:t.artifactId,revision:t.revision});if(this.records.has(t.artifactId))throw new u("ARTIFACT_ALREADY_EXISTS",`Artifact ${t.artifactId} already exists`,{artifactId:t.artifactId});let n=K(t),i=this.createLifecycleEvent({artifact:n,sequence:1,actor:n.provenance.producer,fromState:null,toState:n.state,reason:"artifact-created"}),o={artifact:n,recordVersion:1,lifecycleEvents:[i],reviewEvents:[]};return this.records.set(n.artifactId,new Map([[n.revision,o]])),this.currentRevisions.set(n.artifactId,n.revision),D(o)}async createRevision(t,n={}){w(t),this.assertInitialState(t);let i=this.getMutable(t.artifactId);this.assertVersion(i,n.expectedRecordVersion);let o=i.artifact.revision+1;if(t.revision!==o||t.predecessorRevision!==i.artifact.revision)throw new u("ARTIFACT_REVISION_INVALID",`Revision ${t.revision} does not follow current revision ${i.artifact.revision}`,{artifactId:t.artifactId,currentRevision:i.artifact.revision,requestedRevision:t.revision});if(mn(t,i.artifact))throw new u("ARTIFACT_CONTENT_UNCHANGED","A new artifact revision must have a different content hash",{artifactId:t.artifactId,revision:t.revision});if(i.artifact.state==="archived")throw new u("ARTIFACT_REVISION_INVALID","Archived artifacts cannot receive new revisions",{artifactId:t.artifactId,revision:i.artifact.revision});if(i.artifact.state!=="superseded"){ce(i.artifact.state,"superseded");let s=this.now(),d=this.createLifecycleEvent({artifact:i.artifact,sequence:i.lifecycleEvents.length+1,actor:n.actor??t.provenance.producer,fromState:i.artifact.state,toState:"superseded",reason:n.reason??`superseded-by-revision-${t.revision}`,recordedAt:s});i.artifact.state="superseded",i.artifact.updatedAt=s,i.lifecycleEvents.push(d),i.recordVersion+=1}let r=K(t),a=this.createLifecycleEvent({artifact:r,sequence:1,actor:n.actor??r.provenance.producer,fromState:null,toState:r.state,reason:n.reason??`revision-created-from-${i.artifact.revision}`}),c={artifact:r,recordVersion:1,lifecycleEvents:[a],reviewEvents:[]};return this.records.get(r.artifactId)?.set(r.revision,c),this.currentRevisions.set(r.artifactId,r.revision),D(c)}async get(t,n){let i=this.records.get(t);if(!i)return;let o=n??this.currentRevisions.get(t);if(o===void 0)return;let r=i.get(o);return r?D(r):void 0}async require(t,n){let i=await this.get(t,n);if(!i)throw new u("ARTIFACT_NOT_FOUND",`Artifact ${t}${n===void 0?"":` revision ${n}`} was not found`,{artifactId:t,...n===void 0?{}:{revision:n}});return i}async list(t={}){let n=[];for(let[i,o]of this.records)if(!(t.artifactIds&&!t.artifactIds.includes(i)))if(t.includeSuperseded)n.push(...o.values());else{let r=this.currentRevisions.get(i);if(r!==void 0){let a=o.get(r);a&&n.push(a)}}return n.filter(i=>vn(i.artifact,t)).sort(Ze).map(D)}async listRevisions(t){let n=this.records.get(t);return n?[...n.values()].sort((i,o)=>i.artifact.revision-o.artifact.revision).map(D):[]}async transition(t){let n=this.getMutable(t.artifactId,t.revision);if(this.assertVersion(n,t.expectedRecordVersion),ce(n.artifact.state,t.toState),t.toState==="approved"||t.toState==="rejected"){let a=t.reviewEventId?n.reviewEvents.find(s=>s.eventId===t.reviewEventId&&s.type==="decision-recorded"):void 0,c=_e(n.reviewEvents);if(!a||a.decision!==t.toState||c.latestDecisionEventId!==a.eventId)throw new u("ARTIFACT_REVIEW_DECISION_REQUIRED",`Transition to ${t.toState} requires a matching decision event`,{artifactId:t.artifactId,revision:n.artifact.revision});if(t.toState==="approved"&&c.unresolvedComments>0)throw new u("ARTIFACT_UNRESOLVED_COMMENTS",`Artifact has ${c.unresolvedComments} unresolved review comment(s)`,{artifactId:t.artifactId,revision:n.artifact.revision,unresolvedComments:c.unresolvedComments})}let i=this.now(),o=n.artifact.state,r=this.createLifecycleEvent({artifact:n.artifact,sequence:n.lifecycleEvents.length+1,actor:t.actor,fromState:o,toState:t.toState,reason:t.reason,reviewEventId:t.reviewEventId,recordedAt:i});return n.artifact.state=t.toState,n.artifact.updatedAt=i,n.lifecycleEvents.push(r),n.recordVersion+=1,D(n)}async appendReviewEvent(t){let n=t.event,i=this.getMutable(n.artifactId,n.artifactRevision);if(this.assertVersion(i,t.expectedRecordVersion),i.artifact.state==="archived"||i.artifact.state==="superseded")throw new u("ARTIFACT_REVIEW_INVALID",`Cannot append review events to a ${i.artifact.state} artifact revision`,{artifactId:n.artifactId,revision:n.artifactRevision});if(this.assertReviewCommentState(i,n),(n.type==="review-requested"||n.type==="review-withdrawn"||n.type==="decision-recorded")&&i.artifact.state!=="pending_review")throw new u("ARTIFACT_REVIEW_INVALID",`${n.type} requires an artifact in pending_review state`,{artifactId:n.artifactId,revision:n.artifactRevision});let o={...structuredClone(n),schemaVersion:1,eventId:this.nextEventId("review_event"),sequence:i.reviewEvents.length+1,recordedAt:this.now()},r=be(o,i.artifact);if(r.length>0)throw new M("XENO artifact review event validation failed",r);return i.reviewEvents.push(o),i.recordVersion+=1,D(i)}getMutable(t,n){let i=this.records.get(t),o=n??this.currentRevisions.get(t),r=o===void 0?void 0:i?.get(o);if(!r)throw new u("ARTIFACT_NOT_FOUND",`Artifact ${t}${n===void 0?"":` revision ${n}`} was not found`,{artifactId:t,...n===void 0?{}:{revision:n}});return r}assertVersion(t,n){if(n!==void 0&&n!==t.recordVersion)throw new u("ARTIFACT_CONFLICT",`Expected record version ${n}, found ${t.recordVersion}`,{artifactId:t.artifact.artifactId,revision:t.artifact.revision,expectedRecordVersion:n,actualRecordVersion:t.recordVersion})}assertInitialState(t){if(t.state!=="draft"&&t.state!=="pending_review")throw new u("ARTIFACT_REVISION_INVALID","New artifact revisions must begin in draft or pending_review state",{artifactId:t.artifactId,revision:t.revision})}assertReviewCommentState(t,n){if(n.type==="comment-added"){if(t.reviewEvents.some(r=>r.type==="comment-added"&&r.commentId===n.commentId))throw new u("ARTIFACT_REVIEW_INVALID",`Comment ${n.commentId} already exists`);if(n.parentCommentId&&!t.reviewEvents.some(r=>r.type==="comment-added"&&r.commentId===n.parentCommentId))throw new u("ARTIFACT_REVIEW_INVALID",`Parent comment ${n.parentCommentId} does not exist`);return}if(n.type!=="comment-resolved"&&n.type!=="comment-reopened")return;if(!t.reviewEvents.some(r=>r.type==="comment-added"&&r.commentId===n.commentId))throw new u("ARTIFACT_REVIEW_INVALID",`Comment ${n.commentId} does not exist`);let o=hn(t.reviewEvents,n.commentId);if(n.type==="comment-resolved"&&o.resolved)throw new u("ARTIFACT_REVIEW_INVALID",`Comment ${n.commentId} is already resolved`);if(n.type==="comment-reopened"&&!o.resolved)throw new u("ARTIFACT_REVIEW_INVALID",`Comment ${n.commentId} is not resolved`)}createLifecycleEvent(t){return{schemaVersion:1,eventId:this.nextEventId("artifact_event"),artifactId:t.artifact.artifactId,revision:t.artifact.revision,sequence:t.sequence,recordedAt:t.recordedAt??this.now(),actor:{...t.actor},fromState:t.fromState,toState:t.toState,...t.reason?{reason:t.reason}:{},...t.reviewEventId?{reviewEventId:t.reviewEventId}:{}}}nextEventId(t){let n=this.idFactory(t);if(typeof n!="string"||n.trim().length===0||this.eventIds.has(n))throw new u("ARTIFACT_CONFLICT",`Event ID factory produced an invalid or duplicate ${t} ID`);return this.eventIds.add(n),n}hydrate(t){if(t.schemaVersion!==1||!Array.isArray(t.records))throw new u("ARTIFACT_REVISION_INVALID","Artifact repository state has an unsupported schema or record collection");let n=[...t.records].sort((i,o)=>i.artifact.artifactId.localeCompare(o.artifact.artifactId)||i.artifact.revision-o.artifact.revision);for(let i of n){let o=ln(i,this.eventIds),r=this.records.get(o.artifact.artifactId);if(r||(r=new Map,this.records.set(o.artifact.artifactId,r)),r.has(o.artifact.revision))throw new u("ARTIFACT_REVISION_INVALID",`Duplicate persisted revision ${o.artifact.artifactId}:${o.artifact.revision}`);r.set(o.artifact.revision,o),this.currentRevisions.set(o.artifact.artifactId,o.artifact.revision)}for(let[i,o]of this.records){let r=[...o.values()].sort((a,c)=>a.artifact.revision-c.artifact.revision);for(let a=0;a<r.length;a+=1){let c=r[a],s=a+1;if(c.artifact.revision!==s)throw new u("ARTIFACT_REVISION_INVALID",`Persisted artifact ${i} is missing revision ${s}`);if(a===0&&c.artifact.predecessorRevision!==void 0)throw new u("ARTIFACT_REVISION_INVALID",`Initial revision for ${i} cannot declare a predecessor`);if(a>0&&c.artifact.predecessorRevision!==s-1)throw new u("ARTIFACT_REVISION_INVALID",`Persisted revision ${i}:${s} has an invalid predecessor`);if(a<r.length-1&&c.artifact.state!=="superseded")throw new u("ARTIFACT_REVISION_INVALID",`Non-current revision ${i}:${s} must be superseded`)}}}};function ln(e,t){if(w(e.artifact),!Number.isInteger(e.recordVersion)||e.recordVersion<1)throw new u("ARTIFACT_REVISION_INVALID","Persisted artifact recordVersion must be a positive integer",{artifactId:e.artifact.artifactId,revision:e.artifact.revision});if(!Array.isArray(e.lifecycleEvents)||e.lifecycleEvents.length===0||!Array.isArray(e.reviewEvents))throw new u("ARTIFACT_REVISION_INVALID","Persisted artifact records require lifecycle and review event arrays",{artifactId:e.artifact.artifactId,revision:e.artifact.revision});let n=e.lifecycleEvents.length+e.reviewEvents.length;if(e.recordVersion!==n)throw new u("ARTIFACT_REVISION_INVALID",`Persisted record version ${e.recordVersion} does not match ${n} mutations`,{artifactId:e.artifact.artifactId,revision:e.artifact.revision});let i=null;for(let r=0;r<e.lifecycleEvents.length;r+=1){let a=e.lifecycleEvents[r];if(a.schemaVersion!==1||a.artifactId!==e.artifact.artifactId||a.revision!==e.artifact.revision||a.sequence!==r+1||a.fromState!==i||typeof a.eventId!="string"||a.eventId.length===0||t.has(a.eventId)||!Number.isFinite(Date.parse(a.recordedAt)))throw new u("ARTIFACT_REVISION_INVALID",`Persisted lifecycle event ${r+1} is invalid`,{artifactId:e.artifact.artifactId,revision:e.artifact.revision});if(i===null){if(a.toState!=="draft"&&a.toState!=="pending_review")throw new u("ARTIFACT_REVISION_INVALID","A persisted artifact must begin in draft or pending_review state",{artifactId:e.artifact.artifactId,revision:e.artifact.revision})}else ce(i,a.toState);t.add(a.eventId),i=a.toState}if(i!==e.artifact.state)throw new u("ARTIFACT_REVISION_INVALID","Persisted artifact state does not match its lifecycle tail",{artifactId:e.artifact.artifactId,revision:e.artifact.revision});let o=new Map;for(let r=0;r<e.reviewEvents.length;r+=1){let a=e.reviewEvents[r];if(a.sequence!==r+1||t.has(a.eventId))throw new u("ARTIFACT_REVIEW_INVALID",`Persisted review event ${r+1} has an invalid sequence or duplicate ID`,{artifactId:e.artifact.artifactId,revision:e.artifact.revision});let c=be(a,e.artifact);if(c.length>0)throw new M("Persisted XENO artifact review event validation failed",c);if(a.type==="comment-added"){if(o.has(a.commentId)||a.parentCommentId!==void 0&&!o.has(a.parentCommentId))throw new u("ARTIFACT_REVIEW_INVALID",`Persisted comment ${a.commentId} has an invalid identity or parent`);o.set(a.commentId,!1)}else if(a.type==="comment-resolved"||a.type==="comment-reopened"){let s=o.get(a.commentId);if(s===void 0||a.type==="comment-resolved"&&s||a.type==="comment-reopened"&&!s)throw new u("ARTIFACT_REVIEW_INVALID",`Persisted comment transition for ${a.commentId} is invalid`);o.set(a.commentId,a.type==="comment-resolved")}t.add(a.eventId)}return{artifact:K(e.artifact),recordVersion:e.recordVersion,lifecycleEvents:structuredClone(e.lifecycleEvents),reviewEvents:structuredClone(e.reviewEvents)}}function mn(e,t){return e.content.hash.algorithm===t.content.hash.algorithm&&e.content.hash.value===t.content.hash.value}function vn(e,t){return!(t.kinds&&!t.kinds.includes(e.kind)||t.states&&!t.states.includes(e.state)||t.runId&&e.identity?.runId!==t.runId||t.sessionId&&e.identity?.sessionId!==t.sessionId||t.turnId&&e.identity?.turnId!==t.turnId||t.taskId&&e.identity?.taskId!==t.taskId||t.workspaceId&&e.identity?.workspaceId!==t.workspaceId||t.repositoryId&&e.identity?.repositoryId!==t.repositoryId||t.producerId&&e.provenance.producer.id!==t.producerId||t.sensitivity&&!t.sensitivity.includes(e.sensitivity))}function Ze(e,t){return e.artifact.createdAt.localeCompare(t.artifact.createdAt)||e.artifact.artifactId.localeCompare(t.artifact.artifactId)||e.artifact.revision-t.artifact.revision}function hn(e,t){let n=!1;for(let i of e)(i.type==="comment-resolved"||i.type==="comment-reopened")&&i.commentId===t&&(n=i.type==="comment-resolved");return{resolved:n}}function K(e){return structuredClone(e)}function D(e){return{artifact:K(e.artifact),recordVersion:e.recordVersion,etag:`${e.artifact.artifactId}:${e.artifact.revision}:${e.recordVersion}`,lifecycleEvents:structuredClone(e.lifecycleEvents),reviewEvents:structuredClone(e.reviewEvents),reviewSummary:_e(e.reviewEvents)}}import{randomUUID as ft}from"node:crypto";import{mkdir as pt,open as ot,readFile as bn,rename as _n,stat as ut,unlink as Tn}from"node:fs/promises";import{basename as st,dirname as at,join as kn,resolve as Cn}from"node:path";import{mkdirSync as gn,readFileSync as An,rmSync as et,writeFileSync as yn}from"node:fs";import{hostname as tt}from"node:os";import{dirname as In}from"node:path";function wn(){return new Date().toISOString()}function En(){return new Date(Date.now()-Math.floor(process.uptime()*1e3)).toISOString()}function nt(e){try{return JSON.parse(An(e,"utf8"))}catch{return null}}function Rn(e){if(!e||e<=0)return!1;try{return process.kill(e,0),!0}catch{return!1}}function Xn(e){return e.hostname!==tt()?!0:Rn(e.pid)}function Qe(e,t){gn(In(e),{recursive:!0}),yn(e,JSON.stringify(t,null,2)+`
+`,{encoding:"utf8",flag:"wx"})}function Sn(e,t){let n=nt(e);n?.pid!==t.pid||n.hostname!==t.hostname||et(e,{force:!0})}function it(e,t,n){let i=wn(),o={schemaVersion:1,name:t,pid:process.pid,hostname:tt(),processStartedAt:En(),version:n,acquiredAt:i,updatedAt:i};try{Qe(e,o)}catch(r){if(r.code!=="EEXIST")throw r;let c=nt(e);if(c&&Xn(c))throw new Error(`${t} is already locked by PID ${c.pid} on ${c.hostname}.`);et(e,{force:!0}),Qe(e,o)}return{record:o,release:()=>{Sn(e,o)}}}var rt="0.9.28";var lt=1,xn="repository.v1.json",Nn=5e3,Vn=20,Pn=64*1024*1024,ct=class{directory;snapshotPath;backupPath;lockPath;now;lockTimeoutMs;lockRetryMs;maxSnapshotBytes;onRecovery;mutationTail=Promise.resolve();constructor(t){if(!t||typeof t.directory!="string"||t.directory.trim().length===0)throw new TypeError("Artifact repository directory is required");let n=t.snapshotFileName??xn;if(st(n)!==n||!/^[A-Za-z0-9_.-]+$/.test(n))throw new TypeError("Artifact snapshot filename must be a safe basename");this.directory=Cn(t.directory),this.snapshotPath=kn(this.directory,n),this.backupPath=`${this.snapshotPath}.bak`,this.lockPath=`${this.snapshotPath}.lock`,this.now=t.now??(()=>new Date().toISOString()),this.lockTimeoutMs=ke(t.lockTimeoutMs,Nn,100,6e4,"lockTimeoutMs"),this.lockRetryMs=ke(t.lockRetryMs,Vn,1,1e3,"lockRetryMs"),this.maxSnapshotBytes=ke(t.maxSnapshotBytes,Pn,1024,1024*1024*1024,"maxSnapshotBytes"),this.onRecovery=t.onRecovery}async create(t){return this.mutate(n=>n.create(t))}async createRevision(t,n){return this.mutate(i=>i.createRevision(t,n))}async get(t,n){return(await this.load()).repository.get(t,n)}async require(t,n){return(await this.load()).repository.require(t,n)}async list(t){return(await this.load()).repository.list(t)}async listRevisions(t){return(await this.load()).repository.listRevisions(t)}async transition(t){return this.mutate(n=>n.transition(t))}async appendReviewEvent(t){return this.mutate(n=>n.appendReviewEvent(t))}async inspectSnapshot(){return this.readSnapshot(this.snapshotPath,!0)}async mutate(t){return this.enqueueMutation(async()=>{let n=await this.acquireLock();try{let i=await this.load(),o=await t(i.repository);return await this.persist(i),o}finally{n.release()}})}async enqueueMutation(t){let n=this.mutationTail.then(t,t);return this.mutationTail=n.then(()=>{},()=>{}),n}async acquireLock(){let t=Date.now(),n;for(;Date.now()-t<=this.lockTimeoutMs;)try{return it(this.lockPath,`artifact-repository:${st(this.snapshotPath)}`,rt)}catch(i){if(!(i instanceof Error)||!/already locked by PID/.test(i.message))throw i;n=i,await Ln(this.lockRetryMs)}throw new u("ARTIFACT_PERSISTENCE_LOCKED",`Artifact repository remained locked for ${this.lockTimeoutMs}ms`,{snapshotPath:this.snapshotPath},{cause:n})}async load(){let t,n,i=!1;try{n=await this.readSnapshot(this.snapshotPath,!1)}catch(r){t=fe(r)}if(!n&&(t||await Fn(this.backupPath)))try{let r=await this.readSnapshot(this.backupPath,!0);r&&(this.onRecovery?.({snapshotPath:this.snapshotPath,backupPath:this.backupPath,reason:t?.message??"primary snapshot missing"}),n=r,i=!0)}catch(r){throw t?new u("ARTIFACT_PERSISTENCE_CORRUPT","Artifact repository primary and backup snapshots are unreadable",{snapshotPath:this.snapshotPath,backupPath:this.backupPath},{cause:new AggregateError([t,fe(r)])}):r}if(!n&&t)throw t;let o=n?.state??{schemaVersion:1,records:[]};return{repository:new G({now:this.now,idFactory:r=>`${r}_${ft()}`,initialState:o}),generation:n?.generation??0,createdAt:n?.createdAt??this.now(),hasSnapshot:n!==void 0,recoveredFromBackup:i,...n?{sourceSnapshot:n}:{}}}async persist(t){let n=this.now(),o={...{schemaVersion:lt,generation:t.generation,createdAt:t.createdAt,updatedAt:n,state:t.repository.exportState()},generation:t.generation+1},r=On(o),a=`${JSON.stringify(r,null,2)}
 `;if(Buffer.byteLength(a,"utf8")>this.maxSnapshotBytes)throw new u("ARTIFACT_PERSISTENCE_IO",`Artifact repository snapshot exceeds ${this.maxSnapshotBytes} bytes`,{snapshotPath:this.snapshotPath,maxSnapshotBytes:this.maxSnapshotBytes});await pt(this.directory,{recursive:!0,mode:448}),t.hasSnapshot&&!t.recoveredFromBackup&&t.sourceSnapshot&&await dt(this.backupPath,`${JSON.stringify(t.sourceSnapshot,null,2)}
-`),await dt(this.snapshotPath,a)}async readSnapshot(t,n){let i;try{i=await ut(t)}catch(o){if(!n&&Ce(o,"ENOENT")||n&&Ce(o,"ENOENT"))return;throw Ne("Unable to inspect artifact repository snapshot",t,o)}if(!i.isFile()||i.size>this.maxSnapshotBytes)throw new u("ARTIFACT_PERSISTENCE_CORRUPT","Artifact repository snapshot is not a bounded regular file",{snapshotPath:t,sizeBytes:i.size,maxSnapshotBytes:this.maxSnapshotBytes});try{let o=await bn(t);if(o.byteLength>this.maxSnapshotBytes)throw new Error("snapshot grew beyond the configured size limit while reading");return $n(JSON.parse(o.toString("utf8")),t)}catch(o){throw o instanceof u?o:Ne("Unable to parse artifact repository snapshot",t,o,!0)}}};function $n(e,t){if(!xe(e)||e.schemaVersion!==lt||!Number.isInteger(e.generation)||e.generation<0||typeof e.createdAt!="string"||!Number.isFinite(Date.parse(e.createdAt))||typeof e.updatedAt!="string"||!Number.isFinite(Date.parse(e.updatedAt))||!xe(e.state)||e.state.schemaVersion!==1||!Array.isArray(e.state.records)||!xe(e.checksum)||e.checksum.algorithm!=="sha256"||typeof e.checksum.value!="string")throw new u("ARTIFACT_PERSISTENCE_CORRUPT","Artifact repository snapshot envelope is invalid",{snapshotPath:t});let n=e,i=Dn(n),o=mt(i);if(n.checksum.value!==o)throw new u("ARTIFACT_PERSISTENCE_CORRUPT","Artifact repository snapshot checksum does not match its payload",{snapshotPath:t});return new G({initialState:n.state}),structuredClone(n)}function On(e){return{...structuredClone(e),checksum:{algorithm:"sha256",value:mt(e)}}}function Dn(e){return{schemaVersion:e.schemaVersion,generation:e.generation,createdAt:e.createdAt,updatedAt:e.updatedAt,state:e.state}}function mt(e){return _(JSON.stringify(e)).value}async function dt(e,t){await pt(at(e),{recursive:!0,mode:448});let n=`${e}.tmp.${process.pid}.${ft()}`,i;try{i=await ot(n,"wx",384),await i.writeFile(t,{encoding:"utf8"}),await i.sync(),await i.close(),i=void 0,await _n(n,e);try{let o=await ot(at(e),"r");try{await o.sync()}finally{await o.close()}}catch{}}finally{i&&await i.close().catch(()=>{}),await Tn(n).catch(()=>{})}}function ke(e,t,n,i,o){if(e===void 0)return t;if(!Number.isInteger(e)||e<n||e>i)throw new TypeError(`${o} must be an integer between ${n} and ${i}`);return e}function xe(e){return e!==null&&typeof e=="object"&&!Array.isArray(e)}function Ce(e,t){return e instanceof Error&&e.code===t}async function Fn(e){try{return(await ut(e)).isFile()}catch(t){if(Ce(t,"ENOENT"))return!1;throw Ne("Unable to inspect artifact repository backup",e,t)}}function fe(e){return e instanceof Error?e:new Error(String(e))}function Ne(e,t,n,i=!1){return new u(i?"ARTIFACT_PERSISTENCE_CORRUPT":"ARTIFACT_PERSISTENCE_IO",`${e}: ${fe(n).message}`,{snapshotPath:t},{cause:fe(n)})}function Ln(e){return new Promise(t=>setTimeout(t,e))}import{Buffer as At}from"node:buffer";var Mn=16*1024*1024,Hn=5e3,jn=1e5,qn=1e6,Jn=/^@@ -(\d+)(?:,(\d+))? \+(\d+)(?:,(\d+))? @@(?:\s?(.*))?$/,X=class extends Error{constructor(n,i){super(i===void 0?n:`${n} at diff line ${i}`);this.line=i;this.name="XenoDiffParseError"}line;code="XENO_DIFF_INVALID"};function yt(e,t={}){if(typeof e!="string")throw new TypeError("Unified diff must be a string");let n=pe(t.maxBytes,Mn,1024,256*1024*1024,"maxBytes"),i=pe(t.maxFiles,Hn,1,1e5,"maxFiles"),o=pe(t.maxHunks,jn,1,1e6,"maxHunks"),r=pe(t.maxLines,qn,1,5e6,"maxLines");if(At.byteLength(e,"utf8")>n)throw new X(`Unified diff exceeds ${n} bytes`);let a=e.replace(/\r\n/g,`
+`),await dt(this.snapshotPath,a)}async readSnapshot(t,n){let i;try{i=await ut(t)}catch(o){if(!n&&xe(o,"ENOENT")||n&&xe(o,"ENOENT"))return;throw Ne("Unable to inspect artifact repository snapshot",t,o)}if(!i.isFile()||i.size>this.maxSnapshotBytes)throw new u("ARTIFACT_PERSISTENCE_CORRUPT","Artifact repository snapshot is not a bounded regular file",{snapshotPath:t,sizeBytes:i.size,maxSnapshotBytes:this.maxSnapshotBytes});try{let o=await bn(t);if(o.byteLength>this.maxSnapshotBytes)throw new Error("snapshot grew beyond the configured size limit while reading");return $n(JSON.parse(o.toString("utf8")),t)}catch(o){throw o instanceof u?o:Ne("Unable to parse artifact repository snapshot",t,o,!0)}}};function $n(e,t){if(!Ce(e)||e.schemaVersion!==lt||!Number.isInteger(e.generation)||e.generation<0||typeof e.createdAt!="string"||!Number.isFinite(Date.parse(e.createdAt))||typeof e.updatedAt!="string"||!Number.isFinite(Date.parse(e.updatedAt))||!Ce(e.state)||e.state.schemaVersion!==1||!Array.isArray(e.state.records)||!Ce(e.checksum)||e.checksum.algorithm!=="sha256"||typeof e.checksum.value!="string")throw new u("ARTIFACT_PERSISTENCE_CORRUPT","Artifact repository snapshot envelope is invalid",{snapshotPath:t});let n=e,i=Dn(n),o=mt(i);if(n.checksum.value!==o)throw new u("ARTIFACT_PERSISTENCE_CORRUPT","Artifact repository snapshot checksum does not match its payload",{snapshotPath:t});return new G({initialState:n.state}),structuredClone(n)}function On(e){return{...structuredClone(e),checksum:{algorithm:"sha256",value:mt(e)}}}function Dn(e){return{schemaVersion:e.schemaVersion,generation:e.generation,createdAt:e.createdAt,updatedAt:e.updatedAt,state:e.state}}function mt(e){return _(JSON.stringify(e)).value}async function dt(e,t){await pt(at(e),{recursive:!0,mode:448});let n=`${e}.tmp.${process.pid}.${ft()}`,i;try{i=await ot(n,"wx",384),await i.writeFile(t,{encoding:"utf8"}),await i.sync(),await i.close(),i=void 0,await _n(n,e);try{let o=await ot(at(e),"r");try{await o.sync()}finally{await o.close()}}catch{}}finally{i&&await i.close().catch(()=>{}),await Tn(n).catch(()=>{})}}function ke(e,t,n,i,o){if(e===void 0)return t;if(!Number.isInteger(e)||e<n||e>i)throw new TypeError(`${o} must be an integer between ${n} and ${i}`);return e}function Ce(e){return e!==null&&typeof e=="object"&&!Array.isArray(e)}function xe(e,t){return e instanceof Error&&e.code===t}async function Fn(e){try{return(await ut(e)).isFile()}catch(t){if(xe(t,"ENOENT"))return!1;throw Ne("Unable to inspect artifact repository backup",e,t)}}function fe(e){return e instanceof Error?e:new Error(String(e))}function Ne(e,t,n,i=!1){return new u(i?"ARTIFACT_PERSISTENCE_CORRUPT":"ARTIFACT_PERSISTENCE_IO",`${e}: ${fe(n).message}`,{snapshotPath:t},{cause:fe(n)})}function Ln(e){return new Promise(t=>setTimeout(t,e))}import{Buffer as At}from"node:buffer";var Mn=16*1024*1024,Hn=5e3,jn=1e5,qn=1e6,Jn=/^@@ -(\d+)(?:,(\d+))? \+(\d+)(?:,(\d+))? @@(?:\s?(.*))?$/,X=class extends Error{constructor(n,i){super(i===void 0?n:`${n} at diff line ${i}`);this.line=i;this.name="XenoDiffParseError"}line;code="XENO_DIFF_INVALID"};function yt(e,t={}){if(typeof e!="string")throw new TypeError("Unified diff must be a string");let n=pe(t.maxBytes,Mn,1024,256*1024*1024,"maxBytes"),i=pe(t.maxFiles,Hn,1,1e5,"maxFiles"),o=pe(t.maxHunks,jn,1,1e6,"maxHunks"),r=pe(t.maxLines,qn,1,5e6,"maxLines");if(At.byteLength(e,"utf8")>n)throw new X(`Unified diff exceeds ${n} bytes`);let a=e.replace(/\r\n/g,`
 `).replace(/\r/g,`
 `),c=a.length===0?[]:a.split(`
 `);if(c.length>r)throw new X(`Unified diff exceeds ${r} lines`);let s=[],d,f=0,g=(v,m)=>{if(d&&vt(d,s),s.length>=i)throw new X(`Unified diff exceeds ${i} files`);return d={oldPath:v,newPath:m,status:"modified",binary:!1,headerLines:[],hunks:[]},d};for(let v=0;v<c.length;v+=1){let m=c[v];if(m.startsWith("diff --git ")){let[b,j]=Bn(m.slice(11),v+1);g(b,j).headerLines.push(m);continue}if(m.startsWith("--- ")){(!d||d.hunks.length>0)&&(d=g()),d.oldPath=ht(m.slice(4)),d.headerLines.push(m);continue}if(m.startsWith("+++ ")){d||(d=g()),d.newPath=ht(m.slice(4)),d.headerLines.push(m);continue}if(m.startsWith("@@ ")){if(!d)throw new X("Hunk appears before a file header",v+1);if(f>=o)throw new X(`Unified diff exceeds ${o} hunks`,v+1);let b=Jn.exec(m);if(!b)throw new X("Malformed unified diff hunk header",v+1);let j=Number(b[1]),ie=b[2]===void 0?1:Number(b[2]),we=Number(b[3]),re=b[4]===void 0?1:Number(b[4]),N=[],q=j,J=we,Oe=0,De=0,P=v+1;for(;P<c.length;P+=1){let y=c[P],Ut=q-j===ie,Wt=J-we===re;if(Ut&&Wt&&y.length===0||y.startsWith("diff --git ")||y.startsWith("@@ ")||y.startsWith("--- ")&&c[P+1]?.startsWith("+++ "))break;if(y.startsWith("+"))N.push({kind:"addition",text:y.slice(1),newLine:J}),J+=1,Oe+=1;else if(y.startsWith("-"))N.push({kind:"deletion",text:y.slice(1),oldLine:q}),q+=1,De+=1;else if(y.startsWith(" "))N.push({kind:"context",text:y.slice(1),oldLine:q,newLine:J}),q+=1,J+=1;else if(y==="\")N.push({kind:"no-newline",text:y});else{if(y.length===0&&P===c.length-1)break;throw new X("Unexpected line inside unified diff hunk",P+1)}}let Fe=N.filter(y=>y.kind==="context"||y.kind==="deletion").length,Le=N.filter(y=>y.kind==="context"||y.kind==="addition").length;if(Fe!==ie||Le!==re)throw new X(`Hunk line counts do not match header (expected -${ie}/+${re}, observed -${Fe}/+${Le})`,v+1);let Me=m,Bt=_(JSON.stringify({oldPath:d.oldPath??null,newPath:d.newPath??null,header:Me,lines:N})).value.slice(0,32);d.hunks.push({hunkId:Bt,header:Me,...b[5]?{section:b[5]}:{},oldStart:j,oldLines:ie,newStart:we,newLines:re,additions:Oe,deletions:De,lines:N}),f+=1,v=P-1;continue}if(!d){if(m.trim().length===0)continue;throw new X("Content appears before the first diff file header",v+1)}d.headerLines.push(m),m.startsWith("new file mode ")?d.status="added":m.startsWith("deleted file mode ")?d.status="deleted":m.startsWith("rename from ")?(d.status="renamed",d.oldPath=F(m.slice(12))):m.startsWith("rename to ")?(d.status="renamed",d.newPath=F(m.slice(10))):m.startsWith("copy from ")?(d.status="copied",d.oldPath=F(m.slice(10))):m.startsWith("copy to ")?(d.status="copied",d.newPath=F(m.slice(8))):(m.startsWith("Binary files ")||m==="GIT binary patch")&&(d.binary=!0,d.status="binary")}d&&vt(d,s);let I=s.reduce((v,m)=>v+m.additions,0),V=s.reduce((v,m)=>v+m.deletions,0);return{schemaVersion:1,mode:t.mode??"working-tree",...t.repositoryId?{repositoryId:t.repositoryId}:{},...t.baseRef?{baseRef:t.baseRef}:{},...t.headRef?{headRef:t.headRef}:{},files:s,additions:I,deletions:V,rawDiff:a}}function It(e,t){let n=yt(e,{mode:t.mode,repositoryId:t.repositoryId,baseRef:t.baseRef,headRef:t.headRef}),i=n,o=S(i),r=[t.identity?.runId,t.identity?.turnId,t.identity?.taskId,t.repositoryId,t.mode].filter(Boolean).join(":"),a=t.kind??"diff",c=t.artifactId??`${a}_${_(`${r}:${n.rawDiff}`).value.slice(0,24)}`,s=t.revision??1,d={schemaVersion:1,artifactId:c,revision:s,kind:a,title:t.title??`${zn(n.mode)} diff (${n.files.length} files)`,...t.description?{description:t.description}:{},state:"pending_review",createdAt:t.createdAt??new Date().toISOString(),mediaType:`application/vnd.xeno.${a}+json`,sensitivity:t.sensitivity??"internal",...t.identity?{identity:structuredClone(t.identity)}:{},content:{hash:T(i),sizeBytes:At.byteLength(o,"utf8"),encoding:"utf8",storage:{type:"inline",text:o},redactedPreview:`${n.files.length} files, +${n.additions}/-${n.deletions}`},provenance:{producer:{...t.producer}},anchors:n.files.flatMap(f=>[{kind:"file",path:f.displayPath,...t.repositoryId?{repositoryId:t.repositoryId}:{}},...f.hunks.map(g=>({kind:"diff-hunk",path:f.displayPath,hunkId:g.hunkId,artifactId:c,revision:s}))]),...s>1?{predecessorRevision:t.predecessorRevision??s-1}:{},...t.accessPolicyId?{accessPolicyId:t.accessPolicyId}:{},extensions:{"xeno.diff.mode":n.mode,"xeno.diff.files":n.files.length,"xeno.diff.additions":n.additions,"xeno.diff.deletions":n.deletions}};return w(d),d}function wt(e){if(w(e),e.kind!=="diff"&&e.kind!=="patch")throw new TypeError("Artifact is not a diff or patch");if(e.content.storage.type!=="inline"||typeof e.content.storage.text!="string")throw new TypeError("Diff artifact content is not available inline");let t;try{t=JSON.parse(e.content.storage.text)}catch(i){throw new X(`Diff artifact JSON is malformed: ${Kn(i).message}`)}if(!Wn(t))throw new X("Diff artifact document is invalid");let n=yt(t.rawDiff,{mode:t.mode,repositoryId:t.repositoryId,baseRef:t.baseRef,headRef:t.headRef});if(S(n)!==S(t))throw new X("Diff artifact document does not match its raw diff");return n}function vt(e,t){if(!e.oldPath&&!e.newPath)throw new X("Diff file has no path");e.oldPath||(e.status="added"),e.newPath||(e.status="deleted"),e.binary&&(e.status="binary");let n=e.hunks.reduce((o,r)=>o+r.additions,0),i=e.hunks.reduce((o,r)=>o+r.deletions,0);t.push({...e.oldPath?{oldPath:e.oldPath}:{},...e.newPath?{newPath:e.newPath}:{},displayPath:e.newPath??e.oldPath,status:e.status,additions:n,deletions:i,binary:e.binary,headerLines:[...e.headerLines],hunks:structuredClone(e.hunks)})}function Bn(e,t){let n=Un(e);if(n.length!==2)throw new X("Malformed diff --git path pair",t);return[F(n[0]),F(n[1])]}function Un(e){let t=[],n=0;for(;n<e.length;){for(;e[n]===" ";)n+=1;if(n>=e.length)break;if(e[n]==='"'){let i='"';n+=1;let o=!1;for(;n<e.length;){let r=e[n];if(i+=r,n+=1,!o&&r==='"')break;o=!o&&r==="\\",r!=="\\"&&(o=!1)}t.push(Et(i))}else{let i=e.indexOf(" ",n);if(i===-1){t.push(e.slice(n));break}t.push(e.slice(n,i)),n=i+1}}return t}function Et(e){return!e.startsWith('"')||!e.endsWith('"')?e:e.slice(1,-1).replace(/\\([\\"tnr]|[0-7]{1,3})/g,(n,i)=>i==="t"?"	":i==="n"?`
-`:i==="r"?"\r":i==="\\"?"\\":i==='"'?'"':String.fromCharCode(Number.parseInt(i,8)))}function ht(e){let t=e.split("	",1)[0].trim();if(t!=="/dev/null")return F(Et(t))}function F(e){let t=e.replace(/\\/g,"/");return t.startsWith("a/")||t.startsWith("b/")?t.slice(2):t}function Wn(e){return!gt(e)||e.schemaVersion!==1||!["working-tree","staged","turn","commit","preview"].includes(String(e.mode))||!Array.isArray(e.files)||!Number.isSafeInteger(e.additions)||!Number.isSafeInteger(e.deletions)||typeof e.rawDiff!="string"?!1:e.files.every(t=>gt(t)&&typeof t.displayPath=="string"&&Array.isArray(t.headerLines)&&Array.isArray(t.hunks))}function gt(e){return e!==null&&typeof e=="object"&&!Array.isArray(e)}function pe(e,t,n,i,o){if(e===void 0)return t;if(!Number.isInteger(e)||e<n||e>i)throw new TypeError(`${o} must be an integer between ${n} and ${i}`);return e}function zn(e){return e.split("-").map(t=>t[0].toUpperCase()+t.slice(1)).join(" ")}function Kn(e){return e instanceof Error?e:new Error(String(e))}import{randomUUID as Gn}from"node:crypto";var Y=class{repository;actor;idFactory;constructor(t){if(!t?.repository)throw new TypeError("Artifact repository is required");if(!t.actor?.kind||!t.actor.id?.trim())throw new TypeError("Review actor is required");this.repository=t.repository,this.actor=structuredClone(t.actor),this.idFactory=t.idFactory??(()=>`comment_${Gn()}`)}async addComment(t){let n=le(t.body,"Review comment body",65536),i=await this.repository.require(t.artifactId,t.revision),o=Rt(i,t),r=ue(this.idFactory(),"Comment ID"),a=Zn(t.parentCommentId,"Parent comment ID");return this.repository.appendReviewEvent({expectedRecordVersion:i.recordVersion,event:{type:"comment-added",artifactId:i.artifact.artifactId,artifactRevision:i.artifact.revision,artifactHash:i.artifact.content.hash,actor:this.actor,commentId:r,body:n,...o?{anchor:o}:{},...a?{parentCommentId:a}:{}}})}async setCommentResolution(t){let n=ue(t.commentId,"Review comment ID"),i=Xt(t.reason,"Resolution reason",16*1024),o=await this.repository.require(t.artifactId,t.revision);return this.repository.appendReviewEvent({expectedRecordVersion:o.recordVersion,event:{type:t.resolved?"comment-resolved":"comment-reopened",artifactId:o.artifact.artifactId,artifactRevision:o.artifact.revision,artifactHash:o.artifact.content.hash,actor:this.actor,commentId:n,...i?{reason:i}:{}}})}async decide(t){let n=await this.repository.require(t.artifactId,t.revision);if(n.artifact.state!=="pending_review")throw new u("ARTIFACT_REVIEW_INVALID",`Artifact must be pending_review, found ${n.artifact.state}`);let i=Rt(n,t),o=Xt(t.rationale,"Decision rationale",64*1024),r=await this.repository.appendReviewEvent({expectedRecordVersion:n.recordVersion,event:{type:"decision-recorded",artifactId:n.artifact.artifactId,artifactRevision:n.artifact.revision,artifactHash:n.artifact.content.hash,actor:this.actor,decision:t.decision,...o?{rationale:o}:{},...i?{scope:i}:{}}});if(i||t.decision==="changes_requested")return r;let a=r.reviewEvents.at(-1);if(!a||a.type!=="decision-recorded")throw new u("ARTIFACT_REVIEW_INVALID","Artifact decision event was not recorded");return this.repository.transition({artifactId:r.artifact.artifactId,revision:r.artifact.revision,expectedRecordVersion:r.recordVersion,toState:t.decision,actor:this.actor,reviewEventId:a.eventId,...o?{reason:o}:{}})}};function Rt(e,t){if((t.line!==void 0||t.hunkId!==void 0)&&!t.file)throw C("Line and hunk anchors require a file");if(t.line!==void 0&&t.hunkId!==void 0)throw C("Line and hunk anchors cannot be combined");if(!t.file)return;let n=Yn(t.file);if(t.line!==void 0&&(!Number.isInteger(t.line)||t.line<1))throw C("Review line must be a positive integer");if(e.artifact.kind==="diff"||e.artifact.kind==="patch"){let o=wt(e.artifact).files.find(r=>r.displayPath===n);if(!o)throw C(`File ${n} is not present in this artifact`);if(t.hunkId&&!o.hunks.some(r=>r.hunkId===t.hunkId))throw C(`Hunk ${t.hunkId} is not present in ${n}`)}return t.hunkId?{kind:"diff-hunk",path:n,hunkId:ue(t.hunkId,"Hunk ID"),artifactId:e.artifact.artifactId,revision:e.artifact.revision}:t.line!==void 0?{kind:"source-line",path:n,startLine:t.line}:{kind:"file",path:n}}function Yn(e){let t=le(e,"Artifact review file",4096).replace(/\\/g,"/").replace(/^\.\//,"");if(t.startsWith("../")||t.startsWith("/")||/^[A-Za-z]:\//.test(t)||t.split("/").some(n=>n===".."||n.length===0))throw C("Artifact review file anchors must be repository-relative paths");return t}function le(e,t,n){let i=typeof e=="string"?e.trim():"";if(!i)throw C(`${t} cannot be empty`);if(i.length>n)throw C(`${t} exceeds ${n} characters`);return i}function Xt(e,t,n){if(e!==void 0)return le(e,t,n)}function ue(e,t){let n=le(e,t,512);if(!/^[A-Za-z0-9][A-Za-z0-9._:-]*$/.test(n))throw C(`${t} contains unsupported characters`);return n}function Zn(e,t){return e===void 0?void 0:ue(e,t)}function C(e){return new u("ARTIFACT_REVIEW_INVALID",e)}import{randomUUID as Qn}from"node:crypto";var ee="xeno.spec.v1",ve="xeno.spec-execution.v1",E=class extends Error{constructor(n){super(`XENO spec is invalid: ${n.join("; ")}`);this.issues=n;this.name="XenoSpecValidationError"}issues;code="XENO_SPEC_INVALID"},St=class{repository;now;idFactory;constructor(t){if(!t?.repository)throw new TypeError("Artifact repository is required");this.repository=t.repository,this.now=t.now??(()=>new Date().toISOString()),this.idFactory=t.idFactory??(()=>Qn())}async create(t,n){if(t.revision!==1||t.predecessorRevision!==void 0)throw new E(["A new spec must begin at revision 1 without a predecessor"]);let i=bt(t,n);return await this.repository.create(i.requirements),await this.repository.create(i.design),await this.repository.create(i.taskGraph),await this.repository.create(i.plan),i}async revise(t,n){let i=Z(t.specId),o=await this.repository.require(i.plan);if(t.revision!==o.artifact.revision+1||t.predecessorRevision!==o.artifact.revision)throw new E([`Revision ${t.revision} must follow approved or reviewed revision ${o.artifact.revision}`]);let r=bt(t,n);return await this.repository.createRevision(r.requirements,{actor:n.producer,reason:"spec-revised"}),await this.repository.createRevision(r.design,{actor:n.producer,reason:"spec-revised"}),await this.repository.createRevision(r.taskGraph,{actor:n.producer,reason:"spec-revised"}),await this.repository.createRevision(r.plan,{actor:n.producer,reason:"spec-revised"}),r}async approve(t,n,i){return new Y({repository:this.repository,actor:n}).decide({artifactId:Z(t).plan,decision:"approved",...i?{rationale:i}:{}})}async reject(t,n,i){return new Y({repository:this.repository,actor:n}).decide({artifactId:Z(t).plan,decision:"rejected",rationale:i})}async startExecution(t,n){let i=await this.repository.require(Z(t).plan);if(i.artifact.state!=="approved")throw new E([`Spec ${t} must be approved before execution`]);let o=_t(i.artifact),r=this.now(),a={schemaVersion:ve,executionId:`spec_execution_${this.idFactory()}`,specId:o.specId,specRevision:o.revision,planArtifactId:i.artifact.artifactId,planHash:{...i.artifact.content.hash},state:"ready",createdAt:r,updatedAt:r,observedPaths:[],tasks:o.tasks.map(c=>({taskId:c.id,status:"pending",evidence:[],acceptanceEvidence:Object.fromEntries(c.acceptanceCriterionIds.map(s=>[s,[]]))}))};return this.repository.create(Tt(a,{producer:n,identity:i.artifact.identity,sensitivity:i.artifact.sensitivity,accessPolicyId:i.artifact.accessPolicyId}))}async updateExecution(t,n,i){let o=await this.repository.require(t),r=ti(o.artifact),a=await this.repository.require(r.planArtifactId,r.specRevision);if(a.artifact.state!=="approved"||!ne(a.artifact.content.hash,r.planHash))throw new E(["Execution is no longer bound to the approved plan revision"]);let c=n(structuredClone(r));c.schemaVersion=ve,c.executionId=r.executionId,c.specId=r.specId,c.specRevision=r.specRevision,c.planArtifactId=r.planArtifactId,c.planHash={...r.planHash},c.createdAt=r.createdAt,c.updatedAt=this.now(),kt(c,_t(a.artifact));let s=Tt(c,{producer:i,identity:o.artifact.identity,sensitivity:o.artifact.sensitivity,accessPolicyId:o.artifact.accessPolicyId},o.artifact.revision+1,o.artifact.revision);return this.repository.createRevision(s,{actor:i,reason:"spec-execution-updated"})}};function Z(e){let t=ii(e,"specId");return{plan:`spec_${t}_plan`,requirements:`spec_${t}_requirements`,design:`spec_${t}_design`,taskGraph:`spec_${t}_task_graph`}}function ei(e){let t=[];e?.schemaVersion!==ee&&t.push(`schemaVersion must be ${ee}`),te(e?.specId,"specId",t),(!Number.isInteger(e?.revision)||e.revision<1)&&t.push("revision must be a positive integer"),k(e?.title,"title",t),k(e?.problem,"problem",t),he(e?.createdAt,"createdAt",t),he(e?.updatedAt,"updatedAt",t),e?.predecessorRevision!==void 0&&(!Number.isInteger(e.predecessorRevision)||e.predecessorRevision!==e.revision-1)&&t.push("predecessorRevision must be the immediately preceding revision");let n=me(e?.requirements,"requirement",t),i=me(e?.tasks,"task",t),o=new Set,r=[...Array.isArray(e?.acceptanceCriteria)?e.acceptanceCriteria:[],...Array.isArray(e?.requirements)?e.requirements.flatMap(s=>Array.isArray(s.acceptanceCriteria)?s.acceptanceCriteria:[]):[]];for(let s of r){te(s?.id,"acceptance criterion id",t),k(s?.text,`acceptance criterion ${s?.id??"?"}`,t),o.has(s?.id)&&t.push(`Duplicate acceptance criterion: ${s?.id}`),o.add(s?.id);for(let d of s?.requiredEvidenceKinds??[])te(d,"required evidence kind",t)}for(let s of e?.requirements??[])k(s?.text,`requirement ${s?.id??"?"}`,t),["must","should","could"].includes(s?.priority)||t.push(`Requirement ${s?.id??"?"} has invalid priority`),(!Array.isArray(s?.acceptanceCriteria)||s.acceptanceCriteria.length===0)&&t.push(`Requirement ${s?.id??"?"} needs at least one acceptance criterion`);k(e?.design?.summary,"design summary",t);let a=me(e?.design?.decisions,"design decision",t),c=me(e?.design?.risks,"risk",t);for(let s of e?.design?.decisions??[]){k(s?.decision,`design decision ${s?.id??"?"}`,t),k(s?.rationale,`design rationale ${s?.id??"?"}`,t);for(let d of s?.requirementIds??[])n.has(d)||t.push(`Design decision ${s.id} references unknown requirement ${d}`)}for(let s of e?.design?.risks??[])k(s?.description,`risk ${s?.id??"?"}`,t),k(s?.mitigation,`risk mitigation ${s?.id??"?"}`,t),["low","medium","high","critical"].includes(s?.impact)||t.push(`Risk ${s?.id??"?"} has invalid impact`);for(let s of e?.tasks??[]){k(s?.title,`task title ${s?.id??"?"}`,t),k(s?.description,`task description ${s?.id??"?"}`,t);for(let d of s?.dependsOn??[])i.has(d)||t.push(`Task ${s.id} depends on unknown task ${d}`),d===s.id&&t.push(`Task ${s.id} cannot depend on itself`);for(let d of s?.requirementIds??[])n.has(d)||t.push(`Task ${s.id} references unknown requirement ${d}`);for(let d of s?.acceptanceCriterionIds??[])o.has(d)||t.push(`Task ${s.id} references unknown acceptance criterion ${d}`);for(let d of s?.expectedPaths??[])Ct(d)||t.push(`Task ${s.id} has unsafe expected path ${d}`)}return ri(e?.tasks??[])&&t.push("Task dependency graph contains a cycle"),[...new Set(t)]}function Ve(e){let t=ei(e);if(t.length>0)throw new E(t)}function bt(e,t){Ve(e);let n=Z(e.specId),i=e.revision,o={...t,createdAt:e.updatedAt,state:"draft"},r=Q({artifactId:n.requirements,revision:i,predecessorRevision:e.predecessorRevision,kind:"requirements",title:`${e.title} - requirements`,value:{schemaVersion:ee,specId:e.specId,revision:i,problem:e.problem,requirements:e.requirements,acceptanceCriteria:e.acceptanceCriteria},context:o}),a=Q({artifactId:n.design,revision:i,predecessorRevision:e.predecessorRevision,kind:"design",title:`${e.title} - design`,value:{schemaVersion:ee,specId:e.specId,revision:i,design:e.design,...e.sourceBaseline?{sourceBaseline:e.sourceBaseline}:{}},context:o}),c=Q({artifactId:n.taskGraph,revision:i,predecessorRevision:e.predecessorRevision,kind:"task-graph",title:`${e.title} - task graph`,value:{schemaVersion:ee,specId:e.specId,revision:i,tasks:e.tasks},context:o}),s=[r,a,c].map(f=>({relation:"decomposes",target:{type:"artifact",id:f.artifactId,revision:f.revision}})),d=Q({artifactId:n.plan,revision:i,predecessorRevision:e.predecessorRevision,kind:"plan",title:e.title,description:e.problem,value:e,context:{...t,createdAt:e.updatedAt,state:"pending_review"},relationships:s,extensions:{"xeno.spec.id":e.specId,"xeno.spec.revision":e.revision,"xeno.spec.requirements_hash":r.content.hash.value,"xeno.spec.design_hash":a.content.hash.value,"xeno.spec.task_graph_hash":c.content.hash.value}});return{document:structuredClone(e),plan:d,requirements:r,design:a,taskGraph:c}}function _t(e){if(e.kind!=="plan"||e.mediaType!=="application/vnd.xeno.spec+json")throw new E([`Artifact ${e.artifactId} is not a XENO spec plan`]);let t=xt(e);if(Ve(t),t.revision!==e.revision)throw new E(["Spec and artifact revisions differ"]);if(!ne(T(t),e.content.hash))throw new E(["Spec artifact content hash is invalid"]);return structuredClone(t)}function Tt(e,t,n=1,i){let o=structuredClone(e);return Q({artifactId:e.executionId,revision:n,predecessorRevision:i,kind:"custom:xeno.spec-execution",title:`Execution of ${e.specId} revision ${e.specRevision}`,description:`Execution state: ${e.state}`,value:o,context:{...t,createdAt:e.updatedAt,state:e.state==="completed"?"pending_review":"draft"},relationships:[{relation:"implements",target:{type:"artifact",id:e.planArtifactId,revision:e.specRevision}}],extensions:{"xeno.spec.execution_state":e.state,"xeno.spec.plan_hash":e.planHash.value}})}function ti(e){if(e.kind!=="custom:xeno.spec-execution")throw new E([`Artifact ${e.artifactId} is not a spec execution`]);let t=xt(e);if(t.schemaVersion!==ve||t.executionId!==e.artifactId)throw new E(["Spec execution identity or schema is invalid"]);if(!ne(T(t),e.content.hash))throw new E(["Spec execution content hash is invalid"]);return structuredClone(t)}function kt(e,t){let n=[];e.schemaVersion!==ve&&n.push("Execution schema is invalid"),(e.specId!==t.specId||e.specRevision!==t.revision)&&n.push("Execution is bound to the wrong spec revision");let i=new Map(t.tasks.map(r=>[r.id,r])),o=new Set;for(let r of e.tasks){o.has(r.taskId)&&n.push(`Duplicate execution task ${r.taskId}`),o.add(r.taskId);let a=i.get(r.taskId);if(!a){n.push(`Unknown execution task ${r.taskId}`);continue}for(let c of a.acceptanceCriterionIds)Array.isArray(r.acceptanceEvidence?.[c])||n.push(`Task ${r.taskId} is missing acceptance evidence slot ${c}`)}for(let r of i.keys())o.has(r)||n.push(`Execution is missing task ${r}`);for(let r of e.observedPaths)oi(r)||n.push(`Unsafe observed path ${r}`);if(he(e.createdAt,"execution createdAt",n),he(e.updatedAt,"execution updatedAt",n),n.length>0)throw new E([...new Set(n)])}function pr(e,t,n,i,o=new Date().toISOString()){Ve(e),kt(n,e);let r=[];(!ne(t,i)||!ne(n.planHash,i))&&r.push({code:"PLAN_HASH_MISMATCH",severity:"error",message:"Execution is not bound to the approved plan content hash"});let a=new Map(e.tasks.map(d=>[d.id,d])),c=new Map(n.tasks.map(d=>[d.taskId,d]));for(let d of n.tasks){let f=a.get(d.taskId);if(!f){r.push({code:"UNKNOWN_TASK",severity:"error",taskId:d.taskId,message:`Unknown task ${d.taskId}`});continue}if(d.status==="completed"){d.evidence.length===0&&r.push({code:"MISSING_TASK_EVIDENCE",severity:"error",taskId:f.id,message:`Completed task ${f.id} has no evidence`});for(let g of f.dependsOn??[])c.get(g)?.status!=="completed"&&r.push({code:"DEPENDENCY_INCOMPLETE",severity:"error",taskId:f.id,message:`Task ${f.id} completed before dependency ${g}`});for(let g of f.acceptanceCriterionIds)(d.acceptanceEvidence[g]??[]).length===0&&r.push({code:"MISSING_ACCEPTANCE_EVIDENCE",severity:"error",taskId:f.id,criterionId:g,message:`Completed task ${f.id} has no evidence for ${g}`})}}let s=e.tasks.flatMap(d=>d.expectedPaths??[]);for(let d of n.observedPaths)s.some(f=>si(d,f))||r.push({code:"UNKNOWN_PATH",severity:"warning",path:d,message:`Observed path ${d} is outside the approved task plan`});return{schemaVersion:"xeno.spec-drift.v1",specId:e.specId,specRevision:e.revision,executionId:n.executionId,checkedAt:o,drifted:r.length>0,findings:r}}function Q(e){let t=e.value,n=S(t);return{schemaVersion:1,artifactId:e.artifactId,revision:e.revision,kind:e.kind,title:e.title,...e.description?{description:e.description}:{},state:e.context.state,createdAt:e.context.createdAt??new Date().toISOString(),mediaType:ni(e.kind),sensitivity:e.context.sensitivity??"internal",...e.context.identity?{identity:structuredClone(e.context.identity)}:{},content:{hash:T(t),sizeBytes:Buffer.byteLength(n,"utf8"),encoding:"utf8",storage:{type:"inline",text:n},redactedPreview:e.title},provenance:{producer:structuredClone(e.context.producer)},...e.relationships?.length?{relationships:structuredClone(e.relationships)}:{},...e.predecessorRevision!==void 0?{predecessorRevision:e.predecessorRevision}:{},...e.context.accessPolicyId?{accessPolicyId:e.context.accessPolicyId}:{},...e.extensions?{extensions:structuredClone(e.extensions)}:{}}}function ni(e){return e==="plan"?"application/vnd.xeno.spec+json":e==="custom:xeno.spec-execution"?"application/vnd.xeno.spec-execution+json":`application/vnd.xeno.spec-${e}+json`}function xt(e){let t=e.content.storage;if(t.type!=="inline"||typeof t.text!="string")throw new E(["Spec artifacts require inline JSON content"]);try{return JSON.parse(t.text)}catch(n){throw new E([`Spec artifact JSON is invalid: ${n instanceof Error?n.message:String(n)}`])}}function me(e,t,n){let i=new Set;(!Array.isArray(e)||e.length===0)&&n.push(`${t} list cannot be empty`);for(let o of e??[])te(o?.id,`${t} id`,n),i.has(o?.id??"")&&n.push(`Duplicate ${t}: ${o?.id}`),o?.id&&i.add(o.id);return i}function te(e,t,n){(typeof e!="string"||!/^[A-Za-z0-9][A-Za-z0-9._-]{0,127}$/u.test(e))&&n.push(`${t} must match [A-Za-z0-9][A-Za-z0-9._-]{0,127}`)}function k(e,t,n){(typeof e!="string"||e.trim().length===0||e.length>64*1024)&&n.push(`${t} must be non-empty and no longer than 65536 characters`)}function he(e,t,n){(typeof e!="string"||!e.includes("T")||!Number.isFinite(Date.parse(e)))&&n.push(`${t} must be an ISO 8601 timestamp`)}function ii(e,t){let n=[];if(te(e,t,n),n.length>0)throw new E(n);return e}function ri(e){let t=new Map(e.map(r=>[r.id,r])),n=new Set,i=new Set,o=r=>{if(n.has(r))return!0;if(i.has(r))return!1;n.add(r);for(let a of t.get(r)?.dependsOn??[])if(o(a))return!0;return n.delete(r),i.add(r),!1};return e.some(r=>o(r.id))}function Ct(e){let t=e.replace(/\\/gu,"/");return t.length>0&&t.length<=4096&&!t.startsWith("/")&&!/^[A-Za-z]:/u.test(t)&&!t.split("/").includes("..")}function oi(e){return Ct(e)&&!e.includes("*")}function si(e,t){let n=e.replace(/\\/gu,"/"),i=t.replace(/\\/gu,"/");if(i.endsWith("/**")){let o=i.slice(0,-3).replace(/\/$/u,"");return n===o||n.startsWith(`${o}/`)}if(i.endsWith("/*")){let o=i.slice(0,-2).replace(/\/$/u,""),r=n.startsWith(`${o}/`)?n.slice(o.length+1):"";return r.length>0&&!r.includes("/")}return n===i}function ne(e,t){return e.algorithm===t.algorithm&&e.value===t.value}import{randomUUID as ai}from"node:crypto";var Vt="xeno.review-report.v1",ci=["correctness","security","performance","api","tests","documentation"],di=["source","test","trace","artifact","reproduction","benchmark"],R=class extends Error{constructor(n){super(`XENO review is invalid: ${n.join("; ")}`);this.issues=n;this.name="XenoReviewValidationError"}issues;code="XENO_REVIEW_INVALID"},Nt=class{reviewer;verifier;now;idFactory;constructor(t){if(typeof t?.reviewer!="function")throw new TypeError("Review agent executor is required");this.reviewer=t.reviewer,this.verifier=t.verifier,this.now=t.now??(()=>new Date().toISOString()),this.idFactory=t.idFactory??(n=>`${n}_${ai()}`)}async run(t){Pt(t.pack),$t(t.target),ge(t.runId,"runId");let n=this.now(),i=await Promise.all(t.pack.dimensions.map(async(s,d)=>{let f=await this.reviewer({...t,dimension:s,reviewerSlot:d});return ui(f,s,t.pack.maxFindings),structuredClone(f)})),o=i.flatMap(s=>s.findings.map(d=>({finding:d,reviewerAgentId:s.reviewerAgentId})));if(o.length>t.pack.maxFindings)throw new R([`Reviewers returned ${o.length} findings, exceeding maxFindings ${t.pack.maxFindings}`]);let r=fi(o,this.idFactory);for(let s of r){let d=this.verifier?await Promise.all(Array.from({length:t.pack.verifierCount},async(v,m)=>{let b=await this.verifier({...t,finding:structuredClone(s),verifierSlot:m});return li(b),structuredClone(b)})):[];s.verifications=mi(d),s.evidence=Dt([...s.evidence,...s.verifications.flatMap(v=>v.evidence)]);let f=new Set(s.verifications.filter(v=>v.outcome==="reproduced").map(v=>v.verifierAgentId)).size,g=s.verifications.length>0&&s.verifications.every(v=>v.outcome==="rejected"),I=new Set(s.evidence.map(v=>v.producerId)).size;f>=t.pack.minimumVerifierReproductions?(s.state="verified",s.verificationBasis="verifier"):t.pack.allowIndependentEvidenceVerification&&I>=t.pack.minimumIndependentEvidenceProducers?(s.state="verified",s.verificationBasis="independent-evidence"):g?(s.state="rejected",s.verificationBasis="verifier"):(s.state="unverified",s.verificationBasis="none");let V=s.verifications.map(v=>v.confidence).filter(v=>v!==void 0);V.length>0&&(s.confidence=qt(Math.min(s.confidence,...V)))}r.sort(vi);let a=this.now(),c={schemaVersion:Vt,reportId:ge(this.idFactory("report"),"reportId"),runId:t.runId,pack:structuredClone(t.pack),target:structuredClone(t.target),startedAt:n,completedAt:a,reviewers:i.map(s=>({agentId:s.reviewerAgentId,dimension:s.dimension,findingCount:s.findings.length})),findings:r,summary:Mt(r)};return ye(c),c}};function Ar(e="xeno-production-review"){return{schemaVersion:"xeno.review-pack.v1",packId:e,version:"1.0.0",dimensions:["correctness","security","performance","api","tests","documentation"],verifierCount:1,minimumVerifierReproductions:1,allowIndependentEvidenceVerification:!1,minimumIndependentEvidenceProducers:2,maxFindings:256}}function Pt(e){let t=[];e?.schemaVersion!=="xeno.review-pack.v1"&&t.push("Review pack schemaVersion must be xeno.review-pack.v1"),x(e?.packId,"packId",t),(typeof e?.version!="string"||!/^\d+\.\d+\.\d+(?:[-+][A-Za-z0-9.-]+)?$/u.test(e.version))&&t.push("Review pack version must be semantic version text"),(!Array.isArray(e?.dimensions)||e.dimensions.length===0)&&t.push("Review pack needs at least one dimension"),new Set(e?.dimensions??[]).size!==(e?.dimensions??[]).length&&t.push("Review pack dimensions must be unique");for(let n of e?.dimensions??[])jt(n)||t.push(`Invalid review dimension ${n}`);if((!Number.isInteger(e?.verifierCount)||e.verifierCount<0||e.verifierCount>8)&&t.push("verifierCount must be 0 through 8"),(!Number.isInteger(e?.minimumVerifierReproductions)||e.minimumVerifierReproductions<1||e.minimumVerifierReproductions>Math.max(1,e.verifierCount))&&t.push("minimumVerifierReproductions must be positive and no greater than verifierCount"),(!Number.isInteger(e?.minimumIndependentEvidenceProducers)||e.minimumIndependentEvidenceProducers<2)&&t.push("minimumIndependentEvidenceProducers must be at least 2"),(!Number.isInteger(e?.maxFindings)||e.maxFindings<1||e.maxFindings>2048)&&t.push("maxFindings must be 1 through 2048"),t.length>0)throw new R(t)}function $t(e){let t=[];if(x(e?.artifactId,"target artifactId",t),(!Number.isInteger(e?.revision)||e.revision<1)&&t.push("Target revision must be positive"),L(e?.title,"target title",t),(e?.contentHash?.algorithm!=="sha256"||!/^[a-f0-9]{64}$/u.test(e?.contentHash?.value??""))&&t.push("Target contentHash must be lowercase sha256"),t.length>0)throw new R(t)}function ye(e){let t=[];e?.schemaVersion!==Vt&&t.push("Review report schemaVersion is invalid"),x(e?.reportId,"reportId",t),x(e?.runId,"runId",t),Ae(e?.startedAt,"startedAt",t),Ae(e?.completedAt,"completedAt",t),Date.parse(e?.completedAt)<Date.parse(e?.startedAt)&&t.push("completedAt cannot precede startedAt");try{Pt(e.pack)}catch(r){t.push(r instanceof Error?r.message:String(r))}try{$t(e.target)}catch(r){t.push(r instanceof Error?r.message:String(r))}let n=new Set,i=new Set;for(let r of e?.findings??[])x(r?.findingId,"findingId",t),n.has(r.findingId)&&t.push(`Duplicate findingId ${r.findingId}`),n.add(r.findingId),/^[a-f0-9]{64}$/u.test(r?.fingerprint??"")||t.push(`Finding ${r.findingId} has invalid fingerprint`),i.has(r.fingerprint)&&t.push(`Duplicate finding fingerprint ${r.fingerprint}`),i.add(r.fingerprint),L(r?.title,`finding ${r.findingId} title`,t),L(r?.summary,`finding ${r.findingId} summary`,t),Ht(r?.severity)||t.push(`Finding ${r.findingId} has invalid severity`),(!Number.isFinite(r?.confidence)||r.confidence<0||r.confidence>1)&&t.push(`Finding ${r.findingId} has invalid confidence`),r?.state==="verified"&&r.verificationBasis==="none"&&t.push(`Finding ${r.findingId} cannot be verified without a basis`),r?.state!=="verified"&&r.verificationBasis==="independent-evidence"&&t.push(`Finding ${r.findingId} has inconsistent evidence verification`);let o=Mt(e?.findings??[]);if((o.total!==e?.summary?.total||o.verified!==e?.summary?.verified||o.unverified!==e?.summary?.unverified||o.rejected!==e?.summary?.rejected||Object.keys(o.bySeverity).some(r=>o.bySeverity[r]!==e?.summary?.bySeverity?.[r]))&&t.push("Review report summary is inconsistent"),t.length>0)throw new R([...new Set(t)])}function yr(e,t){ye(e);let n=e,i=S(n),o=t.artifactId??`review_${_(`${e.runId}:${e.target.artifactId}:${e.target.contentHash.value}`).value.slice(0,24)}`,r={schemaVersion:1,artifactId:o,revision:1,kind:"review-report",title:`Review of ${e.target.title}`,description:`${e.summary.verified} verified, ${e.summary.unverified} unverified, ${e.summary.rejected} rejected findings`,state:"pending_review",createdAt:t.createdAt??e.completedAt,mediaType:"application/vnd.xeno.review-report+json",sensitivity:t.sensitivity??"internal",...t.identity?{identity:structuredClone(t.identity)}:{},content:{hash:T(n),sizeBytes:Buffer.byteLength(i,"utf8"),encoding:"utf8",storage:{type:"inline",text:i},redactedPreview:`${e.summary.total} findings; ${e.summary.verified} verified`},provenance:{producer:structuredClone(t.producer),sourceArtifactIds:[e.target.artifactId],attributes:{reviewPackId:e.pack.packId,reviewPackVersion:e.pack.version}},relationships:[{relation:"reviews",target:{type:"artifact",id:e.target.artifactId,revision:e.target.revision}}],anchors:Ft(e.findings.flatMap(a=>a.anchors)),...t.accessPolicyId?{accessPolicyId:t.accessPolicyId}:{},extensions:{"xeno.review.pack":e.pack.packId,"xeno.review.verified":e.summary.verified,"xeno.review.unverified":e.summary.unverified,"xeno.review.rejected":e.summary.rejected}};return w(r),r}function Ir(e){if(e.kind!=="review-report"||e.mediaType!=="application/vnd.xeno.review-report+json")throw new R([`Artifact ${e.artifactId} is not a XENO review report`]);if(e.content.storage.type!=="inline"||typeof e.content.storage.text!="string")throw new R(["Review report requires inline JSON content"]);let t;try{t=JSON.parse(e.content.storage.text)}catch(n){throw new R([`Review report JSON is invalid: ${n instanceof Error?n.message:String(n)}`])}if(ye(t),!gi(T(t),e.content.hash))throw new R(["Review report content hash is invalid"]);return structuredClone(t)}function wr(e,t={}){ye(e);let n=[];for(let i of e.findings){if(t.verifiedOnly!==!1&&i.state!=="verified")continue;let o=i.anchors.find(r=>r.kind==="source-line"||r.kind==="file"||r.kind==="diff-hunk");!o||!("path"in o)||n.push({findingId:i.findingId,path:o.path,...o.kind==="source-line"?{line:o.startLine}:{},severity:i.severity,verified:i.state==="verified",body:[`**${i.severity.toUpperCase()} - ${i.title}**`,"",i.summary,"",`Evidence: ${i.evidence.map(r=>r.summary).join("; ")||"none"}`,i.remediation?`Suggested remediation: ${i.remediation}`:"",`XENO finding: ${i.findingId} (${i.state}, confidence ${i.confidence.toFixed(2)})`].filter(Boolean).join(`
-`)})}return n}function fi(e,t){let n=new Map;for(let i of e){Ot(i.finding),ge(i.reviewerAgentId,"reviewerAgentId");let o=pi(i.finding),r=n.get(o)??[];r.push(structuredClone(i)),n.set(o,r)}return[...n.entries()].map(([i,o])=>{let r=[...o].sort((c,s)=>H(s.finding.severity)-H(c.finding.severity))[0],a=Dt(o.flatMap(c=>c.finding.evidence));return{findingId:ge(t("finding"),"findingId"),fingerprint:i,ruleIds:[...new Set(o.flatMap(c=>c.finding.ruleId?[c.finding.ruleId]:[]))].sort(),dimensions:[...new Set(o.map(c=>c.finding.dimension))].sort(),reviewerAgentIds:[...new Set(o.map(c=>c.reviewerAgentId))].sort(),title:r.finding.title,summary:r.finding.summary,severity:o.reduce((c,s)=>H(s.finding.severity)>H(c)?s.finding.severity:c,r.finding.severity),confidence:qt(Math.max(...o.map(c=>c.finding.confidence))),state:"unverified",verificationBasis:"none",anchors:Ft(o.flatMap(c=>c.finding.anchors)),evidence:a,verifications:[],...r.finding.remediation?{remediation:r.finding.remediation}:{},duplicateProposalCount:o.length}})}function pi(e){let t=e.anchors.map(Lt).sort();return T({ruleId:e.ruleId??"",title:hi(e.title),anchors:t}).value}function ui(e,t,n){let i=[];x(e?.reviewerAgentId,"reviewerAgentId",i),e?.dimension!==t&&i.push(`Reviewer returned dimension ${e?.dimension} for requested ${t}`),Ae(e?.completedAt,"reviewer completedAt",i),(!Array.isArray(e?.findings)||e.findings.length>n)&&i.push("Reviewer finding list is invalid or exceeds maxFindings");for(let o of e?.findings??[]){try{Ot(o)}catch(r){i.push(r instanceof Error?r.message:String(r))}o.dimension!==t&&i.push(`Finding dimension ${o.dimension} differs from reviewer dimension ${t}`)}if(i.length>0)throw new R([...new Set(i)])}function Ot(e){let t=[];jt(e?.dimension)||t.push(`Invalid finding dimension ${e?.dimension}`),L(e?.title,"finding title",t),L(e?.summary,"finding summary",t),Ht(e?.severity)||t.push(`Invalid finding severity ${e?.severity}`),(!Number.isFinite(e?.confidence)||e.confidence<0||e.confidence>1)&&t.push("Finding confidence must be 0 through 1"),(!Array.isArray(e?.anchors)||e.anchors.length===0)&&t.push("Finding needs at least one source or artifact anchor"),Array.isArray(e?.evidence)||t.push("Finding evidence must be an array");for(let n of e?.evidence??[])Pe(n,t);if(e?.ruleId!==void 0&&x(e.ruleId,"ruleId",t),t.length>0)throw new R([...new Set(t)])}function li(e){let t=[];x(e?.verifierAgentId,"verifierAgentId",t),["reproduced","rejected","inconclusive"].includes(e?.outcome)||t.push("Verifier outcome is invalid"),L(e?.rationale,"verifier rationale",t),Ae(e?.completedAt,"verifier completedAt",t),Array.isArray(e?.evidence)||t.push("Verifier evidence must be an array");for(let n of e?.evidence??[])Pe(n,t);if(e?.outcome==="reproduced"&&(e?.evidence?.length??0)===0&&t.push("A reproduced finding requires verifier evidence"),e?.confidence!==void 0&&(!Number.isFinite(e.confidence)||e.confidence<0||e.confidence>1)&&t.push("Verifier confidence must be 0 through 1"),t.length>0)throw new R([...new Set(t)])}function Pe(e,t){x(e?.evidenceId,"evidenceId",t),x(e?.producerId,"evidence producerId",t),L(e?.summary,"evidence summary",t),(typeof e?.kind!="string"||!(di.includes(e.kind)||$(e.kind)))&&t.push(`Invalid evidence kind ${e?.kind}`)}function Dt(e){let t=new Map;for(let n of e){let i=[];if(Pe(n,i),i.length>0)throw new R(i);let o=t.get(n.evidenceId);if(o&&S(o)!==S(n))throw new R([`Conflicting evidence ID ${n.evidenceId}`]);t.set(n.evidenceId,structuredClone(n))}return[...t.values()].sort((n,i)=>n.evidenceId.localeCompare(i.evidenceId))}function mi(e){let t=new Map;for(let n of e){if(t.has(n.verifierAgentId))throw new R([`Verifier ${n.verifierAgentId} returned more than one result for a finding`]);t.set(n.verifierAgentId,structuredClone(n))}return[...t.values()].sort((n,i)=>n.verifierAgentId.localeCompare(i.verifierAgentId))}function Ft(e){let t=new Map;for(let n of e)t.set(Lt(n),structuredClone(n));return[...t.entries()].sort(([n],[i])=>n.localeCompare(i)).map(([,n])=>n)}function Lt(e){return S(e)}function Mt(e){let t={info:0,low:0,medium:0,high:0,critical:0};for(let n of e)t[n.severity]+=1;return{total:e.length,verified:e.filter(n=>n.state==="verified").length,unverified:e.filter(n=>n.state==="unverified").length,rejected:e.filter(n=>n.state==="rejected").length,bySeverity:t}}function vi(e,t){return H(t.severity)-H(e.severity)||+(t.state==="verified")-+(e.state==="verified")||e.fingerprint.localeCompare(t.fingerprint)}function H(e){return{info:0,low:1,medium:2,high:3,critical:4}[e]}function Ht(e){return typeof e=="string"&&["info","low","medium","high","critical"].includes(e)}function jt(e){return typeof e=="string"&&(ci.includes(e)||$(e))}function hi(e){return e.trim().toLowerCase().replace(/\s+/gu," ")}function qt(e){return Math.max(0,Math.min(1,Number(e.toFixed(6))))}function x(e,t,n){(typeof e!="string"||!/^[A-Za-z0-9][A-Za-z0-9._:-]{0,255}$/u.test(e))&&n.push(`${t} has an invalid identifier`)}function ge(e,t){let n=[];if(x(e,t,n),n.length>0)throw new R(n);return e}function L(e,t,n){(typeof e!="string"||e.trim().length===0||e.length>64*1024)&&n.push(`${t} must be non-empty and no longer than 65536 characters`)}function Ae(e,t,n){(typeof e!="string"||!e.includes("T")||!Number.isFinite(Date.parse(e)))&&n.push(`${t} must be an ISO 8601 timestamp`)}function gi(e,t){return e.algorithm===t.algorithm&&e.value===t.value}import{Buffer as Ie}from"node:buffer";function Tr(e,t){let n=t.contentEncoding??"utf8",i=n==="base64"?Ie.from(e.content,"base64"):Ie.from(e.content,"utf8"),o=[t.identity?.runId,t.identity?.taskId,t.identity?.turnId].filter(Boolean).join(":"),r=_(`${o}:${e.name}:${e.mimeType??""}:${e.content}`).value.slice(0,24),a={schemaVersion:1,artifactId:t.artifactId??`legacy_agent_artifact_${r}`,revision:t.revision??1,kind:t.kind??Ai(e),title:e.name,state:t.state??"draft",createdAt:t.createdAt??new Date().toISOString(),mediaType:e.mimeType??"text/plain",sensitivity:t.sensitivity??"internal",...t.identity?{identity:structuredClone(t.identity)}:{},content:{hash:_(i),sizeBytes:i.byteLength,encoding:n,storage:n==="base64"?{type:"inline",base64:e.content}:{type:"inline",text:e.content}},provenance:{producer:{...t.producer}},...t.accessPolicyId?{accessPolicyId:t.accessPolicyId}:{},extensions:{"xeno.legacy.agentArtifact":{name:e.name,...e.mimeType?{mimeType:e.mimeType}:{},content:e.content,encoding:n}}};return w(a),a}function kr(e){w(e);let t=e.extensions?.["xeno.legacy.agentArtifact"];if($e(t)&&typeof t.name=="string"&&typeof t.content=="string")return{name:t.name,...typeof t.mimeType=="string"?{mimeType:t.mimeType}:{},content:t.content};if(e.content.storage.type!=="inline")throw new TypeError("Only inline XENO artifacts can be converted to legacy AgentArtifact values");return{name:e.title,mimeType:e.mediaType,content:e.content.storage.text??e.content.storage.base64??""}}function xr(e,t){let n=Jt(e),i=S(n),o={schemaVersion:1,artifactId:t.artifactId??e.id,revision:t.revision??1,kind:yi(e),title:e.path?`Evidence for ${e.path}`:`Tool evidence ${e.id}`,state:t.state??"draft",createdAt:t.createdAt??e.observedAt,mediaType:"application/vnd.xeno.tool-evidence+json",sensitivity:t.sensitivity??"internal",...t.identity?{identity:structuredClone(t.identity)}:{},content:{hash:T(n),sizeBytes:Ie.byteLength(i,"utf8"),encoding:"utf8",storage:{type:"inline",text:i}},provenance:{producer:{...t.producer},operationId:e.operationId,attributes:{legacyEvidenceId:e.id,legacyEvidenceKind:e.kind,legacyEvidenceStatus:e.status}},...t.accessPolicyId?{accessPolicyId:t.accessPolicyId}:{},extensions:{"xeno.legacy.toolEvidence":n}};return w(o),o}function Cr(e){w(e);let t=e.extensions?.["xeno.legacy.toolEvidence"];if(Ii(t))return structuredClone(t);throw new TypeError("XENO artifact does not contain lossless legacy ToolEvidence data")}function Nr(e,t){let n=Jt(e),i=e.files.map(a=>a.patch).filter(a=>!!a);if(e.files.length>0&&i.length===e.files.length&&i.every(a=>a.startsWith("diff --git ")))try{let a=It(i.join(`
-`),{artifactId:t.artifactId??`turn_diff_${e.turnId}`,revision:t.revision??1,createdAt:t.createdAt??e.completedAt,title:`Turn ${e.turnId} changes`,producer:t.producer,identity:{...t.identity?structuredClone(t.identity):{},turnId:t.identity?.turnId??e.turnId},sensitivity:t.sensitivity??"internal",...t.accessPolicyId?{accessPolicyId:t.accessPolicyId}:{},mode:"turn"}),c={...a,state:t.state??a.state,extensions:{...a.extensions??{},"xeno.legacy.turnDiffSummary":n}};return w(c),c}catch{}let o=S(n),r={schemaVersion:1,artifactId:t.artifactId??`turn_diff_${e.turnId}`,revision:t.revision??1,kind:"diff",title:`Turn ${e.turnId} changes`,state:t.state??"pending_review",createdAt:t.createdAt??e.completedAt,mediaType:"application/vnd.xeno.turn-diff+json",sensitivity:t.sensitivity??"internal",identity:{...t.identity?structuredClone(t.identity):{},turnId:t.identity?.turnId??e.turnId},content:{hash:T(n),sizeBytes:Ie.byteLength(o,"utf8"),encoding:"utf8",storage:{type:"inline",text:o}},provenance:{producer:{...t.producer}},anchors:e.files.map(a=>({kind:"custom:source-file",data:{path:a.path}})),...t.accessPolicyId?{accessPolicyId:t.accessPolicyId}:{},extensions:{"xeno.legacy.turnDiffSummary":n}};return w(r),r}function Vr(e){w(e);let t=e.extensions?.["xeno.legacy.turnDiffSummary"];if(wi(t))return structuredClone(t);throw new TypeError("XENO artifact does not contain lossless TurnDiffSummary data")}function Ai(e){let t=e.name.toLowerCase(),n=e.mimeType?.toLowerCase()??"";return t.endsWith(".patch")||n.includes("patch")?"patch":t.endsWith(".diff")||n.includes("diff")?"diff":n.startsWith("image/")?"screenshot":n.startsWith("video/")?"recording":n.includes("json")&&t.includes("report")?"test-report":"file"}function yi(e){return e.kind==="artifact"?e.path?"file":"custom:tool-artifact-evidence":e.kind==="verification"?"test-report":"custom:tool-process-evidence"}function Jt(e){return JSON.parse(JSON.stringify(e))}function $e(e){return e!==null&&typeof e=="object"&&!Array.isArray(e)}function Ii(e){return $e(e)?typeof e.id=="string"&&(e.kind==="artifact"||e.kind==="process"||e.kind==="verification")&&(e.status==="pending"||e.status==="verified"||e.status==="failed")&&typeof e.observedAt=="string"&&typeof e.operationId=="string":!1}function wi(e){return $e(e)?typeof e.turnId=="string"&&typeof e.startedAt=="string"&&typeof e.completedAt=="string"&&Array.isArray(e.files):!1}export{ct as FileXenoArtifactRepository,G as InMemoryXenoArtifactRepository,Je as XENO_ARTIFACT_ACTOR_KINDS,lt as XENO_ARTIFACT_FILE_REPOSITORY_SCHEMA_VERSION,h as XENO_ARTIFACT_SCHEMA_VERSION,qe as XENO_ARTIFACT_SENSITIVITIES,je as XENO_ARTIFACT_STATES,He as XENO_BUILTIN_ARTIFACT_KINDS,ae as XENO_EVIDENCE_EDGE_TYPES,oe as XENO_EVIDENCE_GRAPH_SCHEMA_VERSION,se as XENO_EVIDENCE_NODE_TYPES,ci as XENO_REVIEW_DIMENSIONS,di as XENO_REVIEW_EVIDENCE_KINDS,Vt as XENO_REVIEW_REPORT_SCHEMA_VERSION,ve as XENO_SPEC_EXECUTION_SCHEMA_VERSION,ee as XENO_SPEC_SCHEMA_VERSION,u as XenoArtifactRepositoryError,Y as XenoArtifactReviewService,Xe as XenoArtifactStateTransitionError,M as XenoArtifactValidationError,X as XenoDiffParseError,Ke as XenoEvidenceGraphBuilder,Te as XenoEvidenceGraphValidationError,Nt as XenoMultiAgentReviewCoordinator,R as XenoReviewValidationError,St as XenoSpecLifecycleService,E as XenoSpecValidationError,w as assertValidXenoArtifact,z as assertValidXenoEvidenceGraph,Pt as assertValidXenoReviewPack,ye as assertValidXenoReviewReport,$t as assertValidXenoReviewTarget,Ve as assertValidXenoSpecDocument,kt as assertValidXenoSpecExecution,ce as assertXenoArtifactStateTransition,Rt as buildXenoArtifactReviewAnchor,cn as canTransitionXenoArtifactState,S as canonicalizeArtifactJson,Ar as defaultXenoReviewPack,pr as detectXenoSpecDrift,Tr as legacyAgentArtifactToXenoArtifact,Yn as normalizeRepositoryRelativePath,yt as parseUnifiedDiff,_ as sha256ArtifactBytes,T as sha256ArtifactJson,_e as summarizeXenoArtifactReview,xr as toolEvidenceToXenoArtifact,Nr as turnDiffSummaryToXenoArtifact,It as unifiedDiffToXenoArtifact,an as validateXenoArtifact,be as validateXenoArtifactReviewEvent,un as validateXenoEvidenceGraph,ei as validateXenoSpecDocument,wt as xenoArtifactToDiffDocument,kr as xenoArtifactToLegacyAgentArtifact,Ir as xenoArtifactToReviewReport,_t as xenoArtifactToSpecDocument,ti as xenoArtifactToSpecExecution,Cr as xenoArtifactToToolEvidence,Vr as xenoArtifactToTurnDiffSummary,yr as xenoReviewReportToArtifact,wr as xenoReviewReportToGitHubComments,Z as xenoSpecArtifactIds,Tt as xenoSpecExecutionToArtifact,bt as xenoSpecToArtifactBundle};
+`:i==="r"?"\r":i==="\\"?"\\":i==='"'?'"':String.fromCharCode(Number.parseInt(i,8)))}function ht(e){let t=e.split("	",1)[0].trim();if(t!=="/dev/null")return F(Et(t))}function F(e){let t=e.replace(/\\/g,"/");return t.startsWith("a/")||t.startsWith("b/")?t.slice(2):t}function Wn(e){return!gt(e)||e.schemaVersion!==1||!["working-tree","staged","turn","commit","preview"].includes(String(e.mode))||!Array.isArray(e.files)||!Number.isSafeInteger(e.additions)||!Number.isSafeInteger(e.deletions)||typeof e.rawDiff!="string"?!1:e.files.every(t=>gt(t)&&typeof t.displayPath=="string"&&Array.isArray(t.headerLines)&&Array.isArray(t.hunks))}function gt(e){return e!==null&&typeof e=="object"&&!Array.isArray(e)}function pe(e,t,n,i,o){if(e===void 0)return t;if(!Number.isInteger(e)||e<n||e>i)throw new TypeError(`${o} must be an integer between ${n} and ${i}`);return e}function zn(e){return e.split("-").map(t=>t[0].toUpperCase()+t.slice(1)).join(" ")}function Kn(e){return e instanceof Error?e:new Error(String(e))}import{randomUUID as Gn}from"node:crypto";var Y=class{repository;actor;idFactory;constructor(t){if(!t?.repository)throw new TypeError("Artifact repository is required");if(!t.actor?.kind||!t.actor.id?.trim())throw new TypeError("Review actor is required");this.repository=t.repository,this.actor=structuredClone(t.actor),this.idFactory=t.idFactory??(()=>`comment_${Gn()}`)}async addComment(t){let n=le(t.body,"Review comment body",65536),i=await this.repository.require(t.artifactId,t.revision),o=Rt(i,t),r=ue(this.idFactory(),"Comment ID"),a=Zn(t.parentCommentId,"Parent comment ID");return this.repository.appendReviewEvent({expectedRecordVersion:i.recordVersion,event:{type:"comment-added",artifactId:i.artifact.artifactId,artifactRevision:i.artifact.revision,artifactHash:i.artifact.content.hash,actor:this.actor,commentId:r,body:n,...o?{anchor:o}:{},...a?{parentCommentId:a}:{}}})}async setCommentResolution(t){let n=ue(t.commentId,"Review comment ID"),i=Xt(t.reason,"Resolution reason",16*1024),o=await this.repository.require(t.artifactId,t.revision);return this.repository.appendReviewEvent({expectedRecordVersion:o.recordVersion,event:{type:t.resolved?"comment-resolved":"comment-reopened",artifactId:o.artifact.artifactId,artifactRevision:o.artifact.revision,artifactHash:o.artifact.content.hash,actor:this.actor,commentId:n,...i?{reason:i}:{}}})}async decide(t){let n=await this.repository.require(t.artifactId,t.revision);if(n.artifact.state!=="pending_review")throw new u("ARTIFACT_REVIEW_INVALID",`Artifact must be pending_review, found ${n.artifact.state}`);let i=Rt(n,t),o=Xt(t.rationale,"Decision rationale",64*1024),r=await this.repository.appendReviewEvent({expectedRecordVersion:n.recordVersion,event:{type:"decision-recorded",artifactId:n.artifact.artifactId,artifactRevision:n.artifact.revision,artifactHash:n.artifact.content.hash,actor:this.actor,decision:t.decision,...o?{rationale:o}:{},...i?{scope:i}:{}}});if(i||t.decision==="changes_requested")return r;let a=r.reviewEvents.at(-1);if(!a||a.type!=="decision-recorded")throw new u("ARTIFACT_REVIEW_INVALID","Artifact decision event was not recorded");return this.repository.transition({artifactId:r.artifact.artifactId,revision:r.artifact.revision,expectedRecordVersion:r.recordVersion,toState:t.decision,actor:this.actor,reviewEventId:a.eventId,...o?{reason:o}:{}})}};function Rt(e,t){if((t.line!==void 0||t.hunkId!==void 0)&&!t.file)throw x("Line and hunk anchors require a file");if(t.line!==void 0&&t.hunkId!==void 0)throw x("Line and hunk anchors cannot be combined");if(!t.file)return;let n=Yn(t.file);if(t.line!==void 0&&(!Number.isInteger(t.line)||t.line<1))throw x("Review line must be a positive integer");if(e.artifact.kind==="diff"||e.artifact.kind==="patch"){let o=wt(e.artifact).files.find(r=>r.displayPath===n);if(!o)throw x(`File ${n} is not present in this artifact`);if(t.hunkId&&!o.hunks.some(r=>r.hunkId===t.hunkId))throw x(`Hunk ${t.hunkId} is not present in ${n}`)}return t.hunkId?{kind:"diff-hunk",path:n,hunkId:ue(t.hunkId,"Hunk ID"),artifactId:e.artifact.artifactId,revision:e.artifact.revision}:t.line!==void 0?{kind:"source-line",path:n,startLine:t.line}:{kind:"file",path:n}}function Yn(e){let t=le(e,"Artifact review file",4096).replace(/\\/g,"/").replace(/^\.\//,"");if(t.startsWith("../")||t.startsWith("/")||/^[A-Za-z]:\//.test(t)||t.split("/").some(n=>n===".."||n.length===0))throw x("Artifact review file anchors must be repository-relative paths");return t}function le(e,t,n){let i=typeof e=="string"?e.trim():"";if(!i)throw x(`${t} cannot be empty`);if(i.length>n)throw x(`${t} exceeds ${n} characters`);return i}function Xt(e,t,n){if(e!==void 0)return le(e,t,n)}function ue(e,t){let n=le(e,t,512);if(!/^[A-Za-z0-9][A-Za-z0-9._:-]*$/.test(n))throw x(`${t} contains unsupported characters`);return n}function Zn(e,t){return e===void 0?void 0:ue(e,t)}function x(e){return new u("ARTIFACT_REVIEW_INVALID",e)}import{randomUUID as Qn}from"node:crypto";var ee="xeno.spec.v1",ve="xeno.spec-execution.v1",E=class extends Error{constructor(n){super(`XENO spec is invalid: ${n.join("; ")}`);this.issues=n;this.name="XenoSpecValidationError"}issues;code="XENO_SPEC_INVALID"},St=class{repository;now;idFactory;constructor(t){if(!t?.repository)throw new TypeError("Artifact repository is required");this.repository=t.repository,this.now=t.now??(()=>new Date().toISOString()),this.idFactory=t.idFactory??(()=>Qn())}async create(t,n){if(t.revision!==1||t.predecessorRevision!==void 0)throw new E(["A new spec must begin at revision 1 without a predecessor"]);let i=bt(t,n);return await this.repository.create(i.requirements),await this.repository.create(i.design),await this.repository.create(i.taskGraph),await this.repository.create(i.plan),i}async revise(t,n){let i=Z(t.specId),o=await this.repository.require(i.plan);if(t.revision!==o.artifact.revision+1||t.predecessorRevision!==o.artifact.revision)throw new E([`Revision ${t.revision} must follow approved or reviewed revision ${o.artifact.revision}`]);let r=bt(t,n);return await this.repository.createRevision(r.requirements,{actor:n.producer,reason:"spec-revised"}),await this.repository.createRevision(r.design,{actor:n.producer,reason:"spec-revised"}),await this.repository.createRevision(r.taskGraph,{actor:n.producer,reason:"spec-revised"}),await this.repository.createRevision(r.plan,{actor:n.producer,reason:"spec-revised"}),r}async approve(t,n,i){return new Y({repository:this.repository,actor:n}).decide({artifactId:Z(t).plan,decision:"approved",...i?{rationale:i}:{}})}async reject(t,n,i){return new Y({repository:this.repository,actor:n}).decide({artifactId:Z(t).plan,decision:"rejected",rationale:i})}async startExecution(t,n){let i=await this.repository.require(Z(t).plan);if(i.artifact.state!=="approved")throw new E([`Spec ${t} must be approved before execution`]);let o=_t(i.artifact),r=this.now(),a={schemaVersion:ve,executionId:`spec_execution_${this.idFactory()}`,specId:o.specId,specRevision:o.revision,planArtifactId:i.artifact.artifactId,planHash:{...i.artifact.content.hash},state:"ready",createdAt:r,updatedAt:r,observedPaths:[],tasks:o.tasks.map(c=>({taskId:c.id,status:"pending",evidence:[],acceptanceEvidence:Object.fromEntries(c.acceptanceCriterionIds.map(s=>[s,[]]))}))};return this.repository.create(Tt(a,{producer:n,identity:i.artifact.identity,sensitivity:i.artifact.sensitivity,accessPolicyId:i.artifact.accessPolicyId}))}async updateExecution(t,n,i){let o=await this.repository.require(t),r=ti(o.artifact),a=await this.repository.require(r.planArtifactId,r.specRevision);if(a.artifact.state!=="approved"||!ne(a.artifact.content.hash,r.planHash))throw new E(["Execution is no longer bound to the approved plan revision"]);let c=n(structuredClone(r));c.schemaVersion=ve,c.executionId=r.executionId,c.specId=r.specId,c.specRevision=r.specRevision,c.planArtifactId=r.planArtifactId,c.planHash={...r.planHash},c.createdAt=r.createdAt,c.updatedAt=this.now(),kt(c,_t(a.artifact));let s=Tt(c,{producer:i,identity:o.artifact.identity,sensitivity:o.artifact.sensitivity,accessPolicyId:o.artifact.accessPolicyId},o.artifact.revision+1,o.artifact.revision);return this.repository.createRevision(s,{actor:i,reason:"spec-execution-updated"})}};function Z(e){let t=ii(e,"specId");return{plan:`spec_${t}_plan`,requirements:`spec_${t}_requirements`,design:`spec_${t}_design`,taskGraph:`spec_${t}_task_graph`}}function ei(e){let t=[];e?.schemaVersion!==ee&&t.push(`schemaVersion must be ${ee}`),te(e?.specId,"specId",t),(!Number.isInteger(e?.revision)||e.revision<1)&&t.push("revision must be a positive integer"),k(e?.title,"title",t),k(e?.problem,"problem",t),he(e?.createdAt,"createdAt",t),he(e?.updatedAt,"updatedAt",t),e?.predecessorRevision!==void 0&&(!Number.isInteger(e.predecessorRevision)||e.predecessorRevision!==e.revision-1)&&t.push("predecessorRevision must be the immediately preceding revision");let n=me(e?.requirements,"requirement",t),i=me(e?.tasks,"task",t),o=new Set,r=[...Array.isArray(e?.acceptanceCriteria)?e.acceptanceCriteria:[],...Array.isArray(e?.requirements)?e.requirements.flatMap(s=>Array.isArray(s.acceptanceCriteria)?s.acceptanceCriteria:[]):[]];for(let s of r){te(s?.id,"acceptance criterion id",t),k(s?.text,`acceptance criterion ${s?.id??"?"}`,t),o.has(s?.id)&&t.push(`Duplicate acceptance criterion: ${s?.id}`),o.add(s?.id);for(let d of s?.requiredEvidenceKinds??[])te(d,"required evidence kind",t)}for(let s of e?.requirements??[])k(s?.text,`requirement ${s?.id??"?"}`,t),["must","should","could"].includes(s?.priority)||t.push(`Requirement ${s?.id??"?"} has invalid priority`),(!Array.isArray(s?.acceptanceCriteria)||s.acceptanceCriteria.length===0)&&t.push(`Requirement ${s?.id??"?"} needs at least one acceptance criterion`);k(e?.design?.summary,"design summary",t);let a=me(e?.design?.decisions,"design decision",t),c=me(e?.design?.risks,"risk",t);for(let s of e?.design?.decisions??[]){k(s?.decision,`design decision ${s?.id??"?"}`,t),k(s?.rationale,`design rationale ${s?.id??"?"}`,t);for(let d of s?.requirementIds??[])n.has(d)||t.push(`Design decision ${s.id} references unknown requirement ${d}`)}for(let s of e?.design?.risks??[])k(s?.description,`risk ${s?.id??"?"}`,t),k(s?.mitigation,`risk mitigation ${s?.id??"?"}`,t),["low","medium","high","critical"].includes(s?.impact)||t.push(`Risk ${s?.id??"?"} has invalid impact`);for(let s of e?.tasks??[]){k(s?.title,`task title ${s?.id??"?"}`,t),k(s?.description,`task description ${s?.id??"?"}`,t);for(let d of s?.dependsOn??[])i.has(d)||t.push(`Task ${s.id} depends on unknown task ${d}`),d===s.id&&t.push(`Task ${s.id} cannot depend on itself`);for(let d of s?.requirementIds??[])n.has(d)||t.push(`Task ${s.id} references unknown requirement ${d}`);for(let d of s?.acceptanceCriterionIds??[])o.has(d)||t.push(`Task ${s.id} references unknown acceptance criterion ${d}`);for(let d of s?.expectedPaths??[])xt(d)||t.push(`Task ${s.id} has unsafe expected path ${d}`)}return ri(e?.tasks??[])&&t.push("Task dependency graph contains a cycle"),[...new Set(t)]}function Ve(e){let t=ei(e);if(t.length>0)throw new E(t)}function bt(e,t){Ve(e);let n=Z(e.specId),i=e.revision,o={...t,createdAt:e.updatedAt,state:"draft"},r=Q({artifactId:n.requirements,revision:i,predecessorRevision:e.predecessorRevision,kind:"requirements",title:`${e.title} - requirements`,value:{schemaVersion:ee,specId:e.specId,revision:i,problem:e.problem,requirements:e.requirements,acceptanceCriteria:e.acceptanceCriteria},context:o}),a=Q({artifactId:n.design,revision:i,predecessorRevision:e.predecessorRevision,kind:"design",title:`${e.title} - design`,value:{schemaVersion:ee,specId:e.specId,revision:i,design:e.design,...e.sourceBaseline?{sourceBaseline:e.sourceBaseline}:{}},context:o}),c=Q({artifactId:n.taskGraph,revision:i,predecessorRevision:e.predecessorRevision,kind:"task-graph",title:`${e.title} - task graph`,value:{schemaVersion:ee,specId:e.specId,revision:i,tasks:e.tasks},context:o}),s=[r,a,c].map(f=>({relation:"decomposes",target:{type:"artifact",id:f.artifactId,revision:f.revision}})),d=Q({artifactId:n.plan,revision:i,predecessorRevision:e.predecessorRevision,kind:"plan",title:e.title,description:e.problem,value:e,context:{...t,createdAt:e.updatedAt,state:"pending_review"},relationships:s,extensions:{"xeno.spec.id":e.specId,"xeno.spec.revision":e.revision,"xeno.spec.requirements_hash":r.content.hash.value,"xeno.spec.design_hash":a.content.hash.value,"xeno.spec.task_graph_hash":c.content.hash.value}});return{document:structuredClone(e),plan:d,requirements:r,design:a,taskGraph:c}}function _t(e){if(e.kind!=="plan"||e.mediaType!=="application/vnd.xeno.spec+json")throw new E([`Artifact ${e.artifactId} is not a XENO spec plan`]);let t=Ct(e);if(Ve(t),t.revision!==e.revision)throw new E(["Spec and artifact revisions differ"]);if(!ne(T(t),e.content.hash))throw new E(["Spec artifact content hash is invalid"]);return structuredClone(t)}function Tt(e,t,n=1,i){let o=structuredClone(e);return Q({artifactId:e.executionId,revision:n,predecessorRevision:i,kind:"custom:xeno.spec-execution",title:`Execution of ${e.specId} revision ${e.specRevision}`,description:`Execution state: ${e.state}`,value:o,context:{...t,createdAt:e.updatedAt,state:e.state==="completed"?"pending_review":"draft"},relationships:[{relation:"implements",target:{type:"artifact",id:e.planArtifactId,revision:e.specRevision}}],extensions:{"xeno.spec.execution_state":e.state,"xeno.spec.plan_hash":e.planHash.value}})}function ti(e){if(e.kind!=="custom:xeno.spec-execution")throw new E([`Artifact ${e.artifactId} is not a spec execution`]);let t=Ct(e);if(t.schemaVersion!==ve||t.executionId!==e.artifactId)throw new E(["Spec execution identity or schema is invalid"]);if(!ne(T(t),e.content.hash))throw new E(["Spec execution content hash is invalid"]);return structuredClone(t)}function kt(e,t){let n=[];e.schemaVersion!==ve&&n.push("Execution schema is invalid"),(e.specId!==t.specId||e.specRevision!==t.revision)&&n.push("Execution is bound to the wrong spec revision");let i=new Map(t.tasks.map(r=>[r.id,r])),o=new Set;for(let r of e.tasks){o.has(r.taskId)&&n.push(`Duplicate execution task ${r.taskId}`),o.add(r.taskId);let a=i.get(r.taskId);if(!a){n.push(`Unknown execution task ${r.taskId}`);continue}for(let c of a.acceptanceCriterionIds)Array.isArray(r.acceptanceEvidence?.[c])||n.push(`Task ${r.taskId} is missing acceptance evidence slot ${c}`)}for(let r of i.keys())o.has(r)||n.push(`Execution is missing task ${r}`);for(let r of e.observedPaths)oi(r)||n.push(`Unsafe observed path ${r}`);if(he(e.createdAt,"execution createdAt",n),he(e.updatedAt,"execution updatedAt",n),n.length>0)throw new E([...new Set(n)])}function pr(e,t,n,i,o=new Date().toISOString()){Ve(e),kt(n,e);let r=[];(!ne(t,i)||!ne(n.planHash,i))&&r.push({code:"PLAN_HASH_MISMATCH",severity:"error",message:"Execution is not bound to the approved plan content hash"});let a=new Map(e.tasks.map(d=>[d.id,d])),c=new Map(n.tasks.map(d=>[d.taskId,d]));for(let d of n.tasks){let f=a.get(d.taskId);if(!f){r.push({code:"UNKNOWN_TASK",severity:"error",taskId:d.taskId,message:`Unknown task ${d.taskId}`});continue}if(d.status==="completed"){d.evidence.length===0&&r.push({code:"MISSING_TASK_EVIDENCE",severity:"error",taskId:f.id,message:`Completed task ${f.id} has no evidence`});for(let g of f.dependsOn??[])c.get(g)?.status!=="completed"&&r.push({code:"DEPENDENCY_INCOMPLETE",severity:"error",taskId:f.id,message:`Task ${f.id} completed before dependency ${g}`});for(let g of f.acceptanceCriterionIds)(d.acceptanceEvidence[g]??[]).length===0&&r.push({code:"MISSING_ACCEPTANCE_EVIDENCE",severity:"error",taskId:f.id,criterionId:g,message:`Completed task ${f.id} has no evidence for ${g}`})}}let s=e.tasks.flatMap(d=>d.expectedPaths??[]);for(let d of n.observedPaths)s.some(f=>si(d,f))||r.push({code:"UNKNOWN_PATH",severity:"warning",path:d,message:`Observed path ${d} is outside the approved task plan`});return{schemaVersion:"xeno.spec-drift.v1",specId:e.specId,specRevision:e.revision,executionId:n.executionId,checkedAt:o,drifted:r.length>0,findings:r}}function Q(e){let t=e.value,n=S(t);return{schemaVersion:1,artifactId:e.artifactId,revision:e.revision,kind:e.kind,title:e.title,...e.description?{description:e.description}:{},state:e.context.state,createdAt:e.context.createdAt??new Date().toISOString(),mediaType:ni(e.kind),sensitivity:e.context.sensitivity??"internal",...e.context.identity?{identity:structuredClone(e.context.identity)}:{},content:{hash:T(t),sizeBytes:Buffer.byteLength(n,"utf8"),encoding:"utf8",storage:{type:"inline",text:n},redactedPreview:e.title},provenance:{producer:structuredClone(e.context.producer)},...e.relationships?.length?{relationships:structuredClone(e.relationships)}:{},...e.predecessorRevision!==void 0?{predecessorRevision:e.predecessorRevision}:{},...e.context.accessPolicyId?{accessPolicyId:e.context.accessPolicyId}:{},...e.extensions?{extensions:structuredClone(e.extensions)}:{}}}function ni(e){return e==="plan"?"application/vnd.xeno.spec+json":e==="custom:xeno.spec-execution"?"application/vnd.xeno.spec-execution+json":`application/vnd.xeno.spec-${e}+json`}function Ct(e){let t=e.content.storage;if(t.type!=="inline"||typeof t.text!="string")throw new E(["Spec artifacts require inline JSON content"]);try{return JSON.parse(t.text)}catch(n){throw new E([`Spec artifact JSON is invalid: ${n instanceof Error?n.message:String(n)}`])}}function me(e,t,n){let i=new Set;(!Array.isArray(e)||e.length===0)&&n.push(`${t} list cannot be empty`);for(let o of e??[])te(o?.id,`${t} id`,n),i.has(o?.id??"")&&n.push(`Duplicate ${t}: ${o?.id}`),o?.id&&i.add(o.id);return i}function te(e,t,n){(typeof e!="string"||!/^[A-Za-z0-9][A-Za-z0-9._-]{0,127}$/u.test(e))&&n.push(`${t} must match [A-Za-z0-9][A-Za-z0-9._-]{0,127}`)}function k(e,t,n){(typeof e!="string"||e.trim().length===0||e.length>64*1024)&&n.push(`${t} must be non-empty and no longer than 65536 characters`)}function he(e,t,n){(typeof e!="string"||!e.includes("T")||!Number.isFinite(Date.parse(e)))&&n.push(`${t} must be an ISO 8601 timestamp`)}function ii(e,t){let n=[];if(te(e,t,n),n.length>0)throw new E(n);return e}function ri(e){let t=new Map(e.map(r=>[r.id,r])),n=new Set,i=new Set,o=r=>{if(n.has(r))return!0;if(i.has(r))return!1;n.add(r);for(let a of t.get(r)?.dependsOn??[])if(o(a))return!0;return n.delete(r),i.add(r),!1};return e.some(r=>o(r.id))}function xt(e){let t=e.replace(/\\/gu,"/");return t.length>0&&t.length<=4096&&!t.startsWith("/")&&!/^[A-Za-z]:/u.test(t)&&!t.split("/").includes("..")}function oi(e){return xt(e)&&!e.includes("*")}function si(e,t){let n=e.replace(/\\/gu,"/"),i=t.replace(/\\/gu,"/");if(i.endsWith("/**")){let o=i.slice(0,-3).replace(/\/$/u,"");return n===o||n.startsWith(`${o}/`)}if(i.endsWith("/*")){let o=i.slice(0,-2).replace(/\/$/u,""),r=n.startsWith(`${o}/`)?n.slice(o.length+1):"";return r.length>0&&!r.includes("/")}return n===i}function ne(e,t){return e.algorithm===t.algorithm&&e.value===t.value}import{randomUUID as ai}from"node:crypto";var Vt="xeno.review-report.v1",ci=["correctness","security","performance","api","tests","documentation"],di=["source","test","trace","artifact","reproduction","benchmark"],R=class extends Error{constructor(n){super(`XENO review is invalid: ${n.join("; ")}`);this.issues=n;this.name="XenoReviewValidationError"}issues;code="XENO_REVIEW_INVALID"},Nt=class{reviewer;verifier;now;idFactory;constructor(t){if(typeof t?.reviewer!="function")throw new TypeError("Review agent executor is required");this.reviewer=t.reviewer,this.verifier=t.verifier,this.now=t.now??(()=>new Date().toISOString()),this.idFactory=t.idFactory??(n=>`${n}_${ai()}`)}async run(t){Pt(t.pack),$t(t.target),ge(t.runId,"runId");let n=this.now(),i=await Promise.all(t.pack.dimensions.map(async(s,d)=>{let f=await this.reviewer({...t,dimension:s,reviewerSlot:d});return ui(f,s,t.pack.maxFindings),structuredClone(f)})),o=i.flatMap(s=>s.findings.map(d=>({finding:d,reviewerAgentId:s.reviewerAgentId})));if(o.length>t.pack.maxFindings)throw new R([`Reviewers returned ${o.length} findings, exceeding maxFindings ${t.pack.maxFindings}`]);let r=fi(o,this.idFactory);for(let s of r){let d=this.verifier?await Promise.all(Array.from({length:t.pack.verifierCount},async(v,m)=>{let b=await this.verifier({...t,finding:structuredClone(s),verifierSlot:m});return li(b),structuredClone(b)})):[];s.verifications=mi(d),s.evidence=Dt([...s.evidence,...s.verifications.flatMap(v=>v.evidence)]);let f=new Set(s.verifications.filter(v=>v.outcome==="reproduced").map(v=>v.verifierAgentId)).size,g=s.verifications.length>0&&s.verifications.every(v=>v.outcome==="rejected"),I=new Set(s.evidence.map(v=>v.producerId)).size;f>=t.pack.minimumVerifierReproductions?(s.state="verified",s.verificationBasis="verifier"):t.pack.allowIndependentEvidenceVerification&&I>=t.pack.minimumIndependentEvidenceProducers?(s.state="verified",s.verificationBasis="independent-evidence"):g?(s.state="rejected",s.verificationBasis="verifier"):(s.state="unverified",s.verificationBasis="none");let V=s.verifications.map(v=>v.confidence).filter(v=>v!==void 0);V.length>0&&(s.confidence=qt(Math.min(s.confidence,...V)))}r.sort(vi);let a=this.now(),c={schemaVersion:Vt,reportId:ge(this.idFactory("report"),"reportId"),runId:t.runId,pack:structuredClone(t.pack),target:structuredClone(t.target),startedAt:n,completedAt:a,reviewers:i.map(s=>({agentId:s.reviewerAgentId,dimension:s.dimension,findingCount:s.findings.length})),findings:r,summary:Mt(r)};return ye(c),c}};function Ar(e="xeno-production-review"){return{schemaVersion:"xeno.review-pack.v1",packId:e,version:"1.0.0",dimensions:["correctness","security","performance","api","tests","documentation"],verifierCount:1,minimumVerifierReproductions:1,allowIndependentEvidenceVerification:!1,minimumIndependentEvidenceProducers:2,maxFindings:256}}function Pt(e){let t=[];e?.schemaVersion!=="xeno.review-pack.v1"&&t.push("Review pack schemaVersion must be xeno.review-pack.v1"),C(e?.packId,"packId",t),(typeof e?.version!="string"||!/^\d+\.\d+\.\d+(?:[-+][A-Za-z0-9.-]+)?$/u.test(e.version))&&t.push("Review pack version must be semantic version text"),(!Array.isArray(e?.dimensions)||e.dimensions.length===0)&&t.push("Review pack needs at least one dimension"),new Set(e?.dimensions??[]).size!==(e?.dimensions??[]).length&&t.push("Review pack dimensions must be unique");for(let n of e?.dimensions??[])jt(n)||t.push(`Invalid review dimension ${n}`);if((!Number.isInteger(e?.verifierCount)||e.verifierCount<0||e.verifierCount>8)&&t.push("verifierCount must be 0 through 8"),(!Number.isInteger(e?.minimumVerifierReproductions)||e.minimumVerifierReproductions<1||e.minimumVerifierReproductions>Math.max(1,e.verifierCount))&&t.push("minimumVerifierReproductions must be positive and no greater than verifierCount"),(!Number.isInteger(e?.minimumIndependentEvidenceProducers)||e.minimumIndependentEvidenceProducers<2)&&t.push("minimumIndependentEvidenceProducers must be at least 2"),(!Number.isInteger(e?.maxFindings)||e.maxFindings<1||e.maxFindings>2048)&&t.push("maxFindings must be 1 through 2048"),t.length>0)throw new R(t)}function $t(e){let t=[];if(C(e?.artifactId,"target artifactId",t),(!Number.isInteger(e?.revision)||e.revision<1)&&t.push("Target revision must be positive"),L(e?.title,"target title",t),(e?.contentHash?.algorithm!=="sha256"||!/^[a-f0-9]{64}$/u.test(e?.contentHash?.value??""))&&t.push("Target contentHash must be lowercase sha256"),t.length>0)throw new R(t)}function ye(e){let t=[];e?.schemaVersion!==Vt&&t.push("Review report schemaVersion is invalid"),C(e?.reportId,"reportId",t),C(e?.runId,"runId",t),Ae(e?.startedAt,"startedAt",t),Ae(e?.completedAt,"completedAt",t),Date.parse(e?.completedAt)<Date.parse(e?.startedAt)&&t.push("completedAt cannot precede startedAt");try{Pt(e.pack)}catch(r){t.push(r instanceof Error?r.message:String(r))}try{$t(e.target)}catch(r){t.push(r instanceof Error?r.message:String(r))}let n=new Set,i=new Set;for(let r of e?.findings??[])C(r?.findingId,"findingId",t),n.has(r.findingId)&&t.push(`Duplicate findingId ${r.findingId}`),n.add(r.findingId),/^[a-f0-9]{64}$/u.test(r?.fingerprint??"")||t.push(`Finding ${r.findingId} has invalid fingerprint`),i.has(r.fingerprint)&&t.push(`Duplicate finding fingerprint ${r.fingerprint}`),i.add(r.fingerprint),L(r?.title,`finding ${r.findingId} title`,t),L(r?.summary,`finding ${r.findingId} summary`,t),Ht(r?.severity)||t.push(`Finding ${r.findingId} has invalid severity`),(!Number.isFinite(r?.confidence)||r.confidence<0||r.confidence>1)&&t.push(`Finding ${r.findingId} has invalid confidence`),r?.state==="verified"&&r.verificationBasis==="none"&&t.push(`Finding ${r.findingId} cannot be verified without a basis`),r?.state!=="verified"&&r.verificationBasis==="independent-evidence"&&t.push(`Finding ${r.findingId} has inconsistent evidence verification`);let o=Mt(e?.findings??[]);if((o.total!==e?.summary?.total||o.verified!==e?.summary?.verified||o.unverified!==e?.summary?.unverified||o.rejected!==e?.summary?.rejected||Object.keys(o.bySeverity).some(r=>o.bySeverity[r]!==e?.summary?.bySeverity?.[r]))&&t.push("Review report summary is inconsistent"),t.length>0)throw new R([...new Set(t)])}function yr(e,t){ye(e);let n=e,i=S(n),o=t.artifactId??`review_${_(`${e.runId}:${e.target.artifactId}:${e.target.contentHash.value}`).value.slice(0,24)}`,r={schemaVersion:1,artifactId:o,revision:1,kind:"review-report",title:`Review of ${e.target.title}`,description:`${e.summary.verified} verified, ${e.summary.unverified} unverified, ${e.summary.rejected} rejected findings`,state:"pending_review",createdAt:t.createdAt??e.completedAt,mediaType:"application/vnd.xeno.review-report+json",sensitivity:t.sensitivity??"internal",...t.identity?{identity:structuredClone(t.identity)}:{},content:{hash:T(n),sizeBytes:Buffer.byteLength(i,"utf8"),encoding:"utf8",storage:{type:"inline",text:i},redactedPreview:`${e.summary.total} findings; ${e.summary.verified} verified`},provenance:{producer:structuredClone(t.producer),sourceArtifactIds:[e.target.artifactId],attributes:{reviewPackId:e.pack.packId,reviewPackVersion:e.pack.version}},relationships:[{relation:"reviews",target:{type:"artifact",id:e.target.artifactId,revision:e.target.revision}}],anchors:Ft(e.findings.flatMap(a=>a.anchors)),...t.accessPolicyId?{accessPolicyId:t.accessPolicyId}:{},extensions:{"xeno.review.pack":e.pack.packId,"xeno.review.verified":e.summary.verified,"xeno.review.unverified":e.summary.unverified,"xeno.review.rejected":e.summary.rejected}};return w(r),r}function Ir(e){if(e.kind!=="review-report"||e.mediaType!=="application/vnd.xeno.review-report+json")throw new R([`Artifact ${e.artifactId} is not a XENO review report`]);if(e.content.storage.type!=="inline"||typeof e.content.storage.text!="string")throw new R(["Review report requires inline JSON content"]);let t;try{t=JSON.parse(e.content.storage.text)}catch(n){throw new R([`Review report JSON is invalid: ${n instanceof Error?n.message:String(n)}`])}if(ye(t),!gi(T(t),e.content.hash))throw new R(["Review report content hash is invalid"]);return structuredClone(t)}function wr(e,t={}){ye(e);let n=[];for(let i of e.findings){if(t.verifiedOnly!==!1&&i.state!=="verified")continue;let o=i.anchors.find(r=>r.kind==="source-line"||r.kind==="file"||r.kind==="diff-hunk");!o||!("path"in o)||n.push({findingId:i.findingId,path:o.path,...o.kind==="source-line"?{line:o.startLine}:{},severity:i.severity,verified:i.state==="verified",body:[`**${i.severity.toUpperCase()} - ${i.title}**`,"",i.summary,"",`Evidence: ${i.evidence.map(r=>r.summary).join("; ")||"none"}`,i.remediation?`Suggested remediation: ${i.remediation}`:"",`XENO finding: ${i.findingId} (${i.state}, confidence ${i.confidence.toFixed(2)})`].filter(Boolean).join(`
+`)})}return n}function fi(e,t){let n=new Map;for(let i of e){Ot(i.finding),ge(i.reviewerAgentId,"reviewerAgentId");let o=pi(i.finding),r=n.get(o)??[];r.push(structuredClone(i)),n.set(o,r)}return[...n.entries()].map(([i,o])=>{let r=[...o].sort((c,s)=>H(s.finding.severity)-H(c.finding.severity))[0],a=Dt(o.flatMap(c=>c.finding.evidence));return{findingId:ge(t("finding"),"findingId"),fingerprint:i,ruleIds:[...new Set(o.flatMap(c=>c.finding.ruleId?[c.finding.ruleId]:[]))].sort(),dimensions:[...new Set(o.map(c=>c.finding.dimension))].sort(),reviewerAgentIds:[...new Set(o.map(c=>c.reviewerAgentId))].sort(),title:r.finding.title,summary:r.finding.summary,severity:o.reduce((c,s)=>H(s.finding.severity)>H(c)?s.finding.severity:c,r.finding.severity),confidence:qt(Math.max(...o.map(c=>c.finding.confidence))),state:"unverified",verificationBasis:"none",anchors:Ft(o.flatMap(c=>c.finding.anchors)),evidence:a,verifications:[],...r.finding.remediation?{remediation:r.finding.remediation}:{},duplicateProposalCount:o.length}})}function pi(e){let t=e.anchors.map(Lt).sort();return T({ruleId:e.ruleId??"",title:hi(e.title),anchors:t}).value}function ui(e,t,n){let i=[];C(e?.reviewerAgentId,"reviewerAgentId",i),e?.dimension!==t&&i.push(`Reviewer returned dimension ${e?.dimension} for requested ${t}`),Ae(e?.completedAt,"reviewer completedAt",i),(!Array.isArray(e?.findings)||e.findings.length>n)&&i.push("Reviewer finding list is invalid or exceeds maxFindings");for(let o of e?.findings??[]){try{Ot(o)}catch(r){i.push(r instanceof Error?r.message:String(r))}o.dimension!==t&&i.push(`Finding dimension ${o.dimension} differs from reviewer dimension ${t}`)}if(i.length>0)throw new R([...new Set(i)])}function Ot(e){let t=[];jt(e?.dimension)||t.push(`Invalid finding dimension ${e?.dimension}`),L(e?.title,"finding title",t),L(e?.summary,"finding summary",t),Ht(e?.severity)||t.push(`Invalid finding severity ${e?.severity}`),(!Number.isFinite(e?.confidence)||e.confidence<0||e.confidence>1)&&t.push("Finding confidence must be 0 through 1"),(!Array.isArray(e?.anchors)||e.anchors.length===0)&&t.push("Finding needs at least one source or artifact anchor"),Array.isArray(e?.evidence)||t.push("Finding evidence must be an array");for(let n of e?.evidence??[])Pe(n,t);if(e?.ruleId!==void 0&&C(e.ruleId,"ruleId",t),t.length>0)throw new R([...new Set(t)])}function li(e){let t=[];C(e?.verifierAgentId,"verifierAgentId",t),["reproduced","rejected","inconclusive"].includes(e?.outcome)||t.push("Verifier outcome is invalid"),L(e?.rationale,"verifier rationale",t),Ae(e?.completedAt,"verifier completedAt",t),Array.isArray(e?.evidence)||t.push("Verifier evidence must be an array");for(let n of e?.evidence??[])Pe(n,t);if(e?.outcome==="reproduced"&&(e?.evidence?.length??0)===0&&t.push("A reproduced finding requires verifier evidence"),e?.confidence!==void 0&&(!Number.isFinite(e.confidence)||e.confidence<0||e.confidence>1)&&t.push("Verifier confidence must be 0 through 1"),t.length>0)throw new R([...new Set(t)])}function Pe(e,t){C(e?.evidenceId,"evidenceId",t),C(e?.producerId,"evidence producerId",t),L(e?.summary,"evidence summary",t),(typeof e?.kind!="string"||!(di.includes(e.kind)||$(e.kind)))&&t.push(`Invalid evidence kind ${e?.kind}`)}function Dt(e){let t=new Map;for(let n of e){let i=[];if(Pe(n,i),i.length>0)throw new R(i);let o=t.get(n.evidenceId);if(o&&S(o)!==S(n))throw new R([`Conflicting evidence ID ${n.evidenceId}`]);t.set(n.evidenceId,structuredClone(n))}return[...t.values()].sort((n,i)=>n.evidenceId.localeCompare(i.evidenceId))}function mi(e){let t=new Map;for(let n of e){if(t.has(n.verifierAgentId))throw new R([`Verifier ${n.verifierAgentId} returned more than one result for a finding`]);t.set(n.verifierAgentId,structuredClone(n))}return[...t.values()].sort((n,i)=>n.verifierAgentId.localeCompare(i.verifierAgentId))}function Ft(e){let t=new Map;for(let n of e)t.set(Lt(n),structuredClone(n));return[...t.entries()].sort(([n],[i])=>n.localeCompare(i)).map(([,n])=>n)}function Lt(e){return S(e)}function Mt(e){let t={info:0,low:0,medium:0,high:0,critical:0};for(let n of e)t[n.severity]+=1;return{total:e.length,verified:e.filter(n=>n.state==="verified").length,unverified:e.filter(n=>n.state==="unverified").length,rejected:e.filter(n=>n.state==="rejected").length,bySeverity:t}}function vi(e,t){return H(t.severity)-H(e.severity)||+(t.state==="verified")-+(e.state==="verified")||e.fingerprint.localeCompare(t.fingerprint)}function H(e){return{info:0,low:1,medium:2,high:3,critical:4}[e]}function Ht(e){return typeof e=="string"&&["info","low","medium","high","critical"].includes(e)}function jt(e){return typeof e=="string"&&(ci.includes(e)||$(e))}function hi(e){return e.trim().toLowerCase().replace(/\s+/gu," ")}function qt(e){return Math.max(0,Math.min(1,Number(e.toFixed(6))))}function C(e,t,n){(typeof e!="string"||!/^[A-Za-z0-9][A-Za-z0-9._:-]{0,255}$/u.test(e))&&n.push(`${t} has an invalid identifier`)}function ge(e,t){let n=[];if(C(e,t,n),n.length>0)throw new R(n);return e}function L(e,t,n){(typeof e!="string"||e.trim().length===0||e.length>64*1024)&&n.push(`${t} must be non-empty and no longer than 65536 characters`)}function Ae(e,t,n){(typeof e!="string"||!e.includes("T")||!Number.isFinite(Date.parse(e)))&&n.push(`${t} must be an ISO 8601 timestamp`)}function gi(e,t){return e.algorithm===t.algorithm&&e.value===t.value}import{Buffer as Ie}from"node:buffer";function Tr(e,t){let n=t.contentEncoding??"utf8",i=n==="base64"?Ie.from(e.content,"base64"):Ie.from(e.content,"utf8"),o=[t.identity?.runId,t.identity?.taskId,t.identity?.turnId].filter(Boolean).join(":"),r=_(`${o}:${e.name}:${e.mimeType??""}:${e.content}`).value.slice(0,24),a={schemaVersion:1,artifactId:t.artifactId??`legacy_agent_artifact_${r}`,revision:t.revision??1,kind:t.kind??Ai(e),title:e.name,state:t.state??"draft",createdAt:t.createdAt??new Date().toISOString(),mediaType:e.mimeType??"text/plain",sensitivity:t.sensitivity??"internal",...t.identity?{identity:structuredClone(t.identity)}:{},content:{hash:_(i),sizeBytes:i.byteLength,encoding:n,storage:n==="base64"?{type:"inline",base64:e.content}:{type:"inline",text:e.content}},provenance:{producer:{...t.producer}},...t.accessPolicyId?{accessPolicyId:t.accessPolicyId}:{},extensions:{"xeno.legacy.agentArtifact":{name:e.name,...e.mimeType?{mimeType:e.mimeType}:{},content:e.content,encoding:n}}};return w(a),a}function kr(e){w(e);let t=e.extensions?.["xeno.legacy.agentArtifact"];if($e(t)&&typeof t.name=="string"&&typeof t.content=="string")return{name:t.name,...typeof t.mimeType=="string"?{mimeType:t.mimeType}:{},content:t.content};if(e.content.storage.type!=="inline")throw new TypeError("Only inline XENO artifacts can be converted to legacy AgentArtifact values");return{name:e.title,mimeType:e.mediaType,content:e.content.storage.text??e.content.storage.base64??""}}function Cr(e,t){let n=Jt(e),i=S(n),o={schemaVersion:1,artifactId:t.artifactId??e.id,revision:t.revision??1,kind:yi(e),title:e.path?`Evidence for ${e.path}`:`Tool evidence ${e.id}`,state:t.state??"draft",createdAt:t.createdAt??e.observedAt,mediaType:"application/vnd.xeno.tool-evidence+json",sensitivity:t.sensitivity??"internal",...t.identity?{identity:structuredClone(t.identity)}:{},content:{hash:T(n),sizeBytes:Ie.byteLength(i,"utf8"),encoding:"utf8",storage:{type:"inline",text:i}},provenance:{producer:{...t.producer},operationId:e.operationId,attributes:{legacyEvidenceId:e.id,legacyEvidenceKind:e.kind,legacyEvidenceStatus:e.status}},...t.accessPolicyId?{accessPolicyId:t.accessPolicyId}:{},extensions:{"xeno.legacy.toolEvidence":n}};return w(o),o}function xr(e){w(e);let t=e.extensions?.["xeno.legacy.toolEvidence"];if(Ii(t))return structuredClone(t);throw new TypeError("XENO artifact does not contain lossless legacy ToolEvidence data")}function Nr(e,t){let n=Jt(e),i=e.files.map(a=>a.patch).filter(a=>!!a);if(e.files.length>0&&i.length===e.files.length&&i.every(a=>a.startsWith("diff --git ")))try{let a=It(i.join(`
+`),{artifactId:t.artifactId??`turn_diff_${e.turnId}`,revision:t.revision??1,createdAt:t.createdAt??e.completedAt,title:`Turn ${e.turnId} changes`,producer:t.producer,identity:{...t.identity?structuredClone(t.identity):{},turnId:t.identity?.turnId??e.turnId},sensitivity:t.sensitivity??"internal",...t.accessPolicyId?{accessPolicyId:t.accessPolicyId}:{},mode:"turn"}),c={...a,state:t.state??a.state,extensions:{...a.extensions??{},"xeno.legacy.turnDiffSummary":n}};return w(c),c}catch{}let o=S(n),r={schemaVersion:1,artifactId:t.artifactId??`turn_diff_${e.turnId}`,revision:t.revision??1,kind:"diff",title:`Turn ${e.turnId} changes`,state:t.state??"pending_review",createdAt:t.createdAt??e.completedAt,mediaType:"application/vnd.xeno.turn-diff+json",sensitivity:t.sensitivity??"internal",identity:{...t.identity?structuredClone(t.identity):{},turnId:t.identity?.turnId??e.turnId},content:{hash:T(n),sizeBytes:Ie.byteLength(o,"utf8"),encoding:"utf8",storage:{type:"inline",text:o}},provenance:{producer:{...t.producer}},anchors:e.files.map(a=>({kind:"custom:source-file",data:{path:a.path}})),...t.accessPolicyId?{accessPolicyId:t.accessPolicyId}:{},extensions:{"xeno.legacy.turnDiffSummary":n}};return w(r),r}function Vr(e){w(e);let t=e.extensions?.["xeno.legacy.turnDiffSummary"];if(wi(t))return structuredClone(t);throw new TypeError("XENO artifact does not contain lossless TurnDiffSummary data")}function Ai(e){let t=e.name.toLowerCase(),n=e.mimeType?.toLowerCase()??"";return t.endsWith(".patch")||n.includes("patch")?"patch":t.endsWith(".diff")||n.includes("diff")?"diff":n.startsWith("image/")?"screenshot":n.startsWith("video/")?"recording":n.includes("json")&&t.includes("report")?"test-report":"file"}function yi(e){return e.kind==="artifact"?e.path?"file":"custom:tool-artifact-evidence":e.kind==="verification"?"test-report":"custom:tool-process-evidence"}function Jt(e){return JSON.parse(JSON.stringify(e))}function $e(e){return e!==null&&typeof e=="object"&&!Array.isArray(e)}function Ii(e){return $e(e)?typeof e.id=="string"&&(e.kind==="artifact"||e.kind==="process"||e.kind==="verification")&&(e.status==="pending"||e.status==="verified"||e.status==="failed")&&typeof e.observedAt=="string"&&typeof e.operationId=="string":!1}function wi(e){return $e(e)?typeof e.turnId=="string"&&typeof e.startedAt=="string"&&typeof e.completedAt=="string"&&Array.isArray(e.files):!1}export{ct as FileXenoArtifactRepository,G as InMemoryXenoArtifactRepository,Je as XENO_ARTIFACT_ACTOR_KINDS,lt as XENO_ARTIFACT_FILE_REPOSITORY_SCHEMA_VERSION,h as XENO_ARTIFACT_SCHEMA_VERSION,qe as XENO_ARTIFACT_SENSITIVITIES,je as XENO_ARTIFACT_STATES,He as XENO_BUILTIN_ARTIFACT_KINDS,ae as XENO_EVIDENCE_EDGE_TYPES,oe as XENO_EVIDENCE_GRAPH_SCHEMA_VERSION,se as XENO_EVIDENCE_NODE_TYPES,ci as XENO_REVIEW_DIMENSIONS,di as XENO_REVIEW_EVIDENCE_KINDS,Vt as XENO_REVIEW_REPORT_SCHEMA_VERSION,ve as XENO_SPEC_EXECUTION_SCHEMA_VERSION,ee as XENO_SPEC_SCHEMA_VERSION,u as XenoArtifactRepositoryError,Y as XenoArtifactReviewService,Xe as XenoArtifactStateTransitionError,M as XenoArtifactValidationError,X as XenoDiffParseError,Ke as XenoEvidenceGraphBuilder,Te as XenoEvidenceGraphValidationError,Nt as XenoMultiAgentReviewCoordinator,R as XenoReviewValidationError,St as XenoSpecLifecycleService,E as XenoSpecValidationError,w as assertValidXenoArtifact,z as assertValidXenoEvidenceGraph,Pt as assertValidXenoReviewPack,ye as assertValidXenoReviewReport,$t as assertValidXenoReviewTarget,Ve as assertValidXenoSpecDocument,kt as assertValidXenoSpecExecution,ce as assertXenoArtifactStateTransition,Rt as buildXenoArtifactReviewAnchor,cn as canTransitionXenoArtifactState,S as canonicalizeArtifactJson,Ar as defaultXenoReviewPack,pr as detectXenoSpecDrift,Tr as legacyAgentArtifactToXenoArtifact,Yn as normalizeRepositoryRelativePath,yt as parseUnifiedDiff,_ as sha256ArtifactBytes,T as sha256ArtifactJson,_e as summarizeXenoArtifactReview,Cr as toolEvidenceToXenoArtifact,Nr as turnDiffSummaryToXenoArtifact,It as unifiedDiffToXenoArtifact,an as validateXenoArtifact,be as validateXenoArtifactReviewEvent,un as validateXenoEvidenceGraph,ei as validateXenoSpecDocument,wt as xenoArtifactToDiffDocument,kr as xenoArtifactToLegacyAgentArtifact,Ir as xenoArtifactToReviewReport,_t as xenoArtifactToSpecDocument,ti as xenoArtifactToSpecExecution,xr as xenoArtifactToToolEvidence,Vr as xenoArtifactToTurnDiffSummary,yr as xenoReviewReportToArtifact,wr as xenoReviewReportToGitHubComments,Z as xenoSpecArtifactIds,Tt as xenoSpecExecutionToArtifact,bt as xenoSpecToArtifactBundle};

package/dist/artifacts/metafile-cjs.json

@@ -1 +1 @@
-{"inputs":{"src/artifacts/types.ts":{"bytes":11224,"imports":[],"format":"esm"},"src/artifacts/browser-diff.ts":{"bytes":8767,"imports":[],"format":"esm"},"src/artifacts/browser.ts":{"bytes":232,"imports":[{"path":"src/artifacts/types.ts","kind":"import-statement","original":"./types.js"},{"path":"src/artifacts/browser-diff.ts","kind":"import-statement","original":"./browser-diff.js"}],"format":"esm"},"src/artifacts/hash.ts":{"bytes":1489,"imports":[{"path":"node:crypto","kind":"import-statement","external":true}],"format":"esm"},"src/utils/custom-names.ts":{"bytes":2210,"imports":[],"format":"esm"},"src/artifacts/validation.ts":{"bytes":25271,"imports":[{"path":"src/artifacts/types.ts","kind":"import-statement","original":"./types.js"},{"path":"node:buffer","kind":"import-statement","external":true},{"path":"src/artifacts/hash.ts","kind":"import-statement","original":"./hash.js"},{"path":"src/utils/custom-names.ts","kind":"import-statement","original":"../utils/custom-names.js"},{"path":"src/artifacts/types.ts","kind":"import-statement","original":"./types.js"}],"format":"esm"},"src/artifacts/evidence-graph.ts":{"bytes":8778,"imports":[{"path":"src/artifacts/types.ts","kind":"import-statement","original":"./types.js"},{"path":"src/utils/custom-names.ts","kind":"import-statement","original":"../utils/custom-names.js"}],"format":"esm"},"src/artifacts/repository.ts":{"bytes":29289,"imports":[{"path":"src/artifacts/types.ts","kind":"import-statement","original":"./types.js"},{"path":"src/artifacts/validation.ts","kind":"import-statement","original":"./validation.js"}],"format":"esm"},"src/control-plane/lock.ts":{"bytes":2496,"imports":[{"path":"node:fs","kind":"import-statement","external":true},{"path":"node:os","kind":"import-statement","external":true},{"path":"node:path","kind":"import-statement","external":true}],"format":"esm"},"src/version.ts":{"bytes":37,"imports":[],"format":"esm"},"src/artifacts/file-repository.ts":{"bytes":16334,"imports":[{"path":"node:crypto","kind":"import-statement","external":true},{"path":"node:fs/promises","kind":"import-statement","external":true},{"path":"node:path","kind":"import-statement","external":true},{"path":"src/control-plane/lock.ts","kind":"import-statement","original":"../control-plane/lock.js"},{"path":"src/version.ts","kind":"import-statement","original":"../version.js"},{"path":"src/artifacts/hash.ts","kind":"import-statement","original":"./hash.js"},{"path":"src/artifacts/repository.ts","kind":"import-statement","original":"./repository.js"},{"path":"src/artifacts/types.ts","kind":"import-statement","original":"./types.js"}],"format":"esm"},"src/artifacts/diff-artifact.ts":{"bytes":17998,"imports":[{"path":"node:buffer","kind":"import-statement","external":true},{"path":"src/artifacts/hash.ts","kind":"import-statement","original":"./hash.js"},{"path":"src/artifacts/types.ts","kind":"import-statement","original":"./types.js"},{"path":"src/artifacts/validation.ts","kind":"import-statement","original":"./validation.js"}],"format":"esm"},"src/artifacts/review-service.ts":{"bytes":8672,"imports":[{"path":"node:crypto","kind":"import-statement","external":true},{"path":"src/artifacts/diff-artifact.ts","kind":"import-statement","original":"./diff-artifact.js"},{"path":"src/artifacts/repository.ts","kind":"import-statement","original":"./repository.js"}],"format":"esm"},"src/artifacts/spec-lifecycle.ts":{"bytes":31007,"imports":[{"path":"node:crypto","kind":"import-statement","external":true},{"path":"src/artifacts/hash.ts","kind":"import-statement","original":"./hash.js"},{"path":"src/artifacts/review-service.ts","kind":"import-statement","original":"./review-service.js"},{"path":"src/artifacts/types.ts","kind":"import-statement","original":"./types.js"}],"format":"esm"},"src/artifacts/multi-agent-review.ts":{"bytes":30649,"imports":[{"path":"node:crypto","kind":"import-statement","external":true},{"path":"src/artifacts/hash.ts","kind":"import-statement","original":"./hash.js"},{"path":"src/artifacts/types.ts","kind":"import-statement","original":"./types.js"},{"path":"src/artifacts/validation.ts","kind":"import-statement","original":"./validation.js"},{"path":"src/utils/custom-names.ts","kind":"import-statement","original":"../utils/custom-names.js"}],"format":"esm"},"src/artifacts/legacy-adapters.ts":{"bytes":10908,"imports":[{"path":"node:buffer","kind":"import-statement","external":true},{"path":"src/artifacts/hash.ts","kind":"import-statement","original":"./hash.js"},{"path":"src/artifacts/types.ts","kind":"import-statement","original":"./types.js"},{"path":"src/artifacts/validation.ts","kind":"import-statement","original":"./validation.js"},{"path":"src/artifacts/diff-artifact.ts","kind":"import-statement","original":"./diff-artifact.js"}],"format":"esm"},"src/artifacts/index.ts":{"bytes":385,"imports":[{"path":"src/artifacts/types.ts","kind":"import-statement","original":"./types.js"},{"path":"src/artifacts/validation.ts","kind":"import-statement","original":"./validation.js"},{"path":"src/artifacts/hash.ts","kind":"import-statement","original":"./hash.js"},{"path":"src/artifacts/evidence-graph.ts","kind":"import-statement","original":"./evidence-graph.js"},{"path":"src/artifacts/repository.ts","kind":"import-statement","original":"./repository.js"},{"path":"src/artifacts/file-repository.ts","kind":"import-statement","original":"./file-repository.js"},{"path":"src/artifacts/diff-artifact.ts","kind":"import-statement","original":"./diff-artifact.js"},{"path":"src/artifacts/review-service.ts","kind":"import-statement","original":"./review-service.js"},{"path":"src/artifacts/spec-lifecycle.ts","kind":"import-statement","original":"./spec-lifecycle.js"},{"path":"src/artifacts/multi-agent-review.ts","kind":"import-statement","original":"./multi-agent-review.js"},{"path":"src/artifacts/legacy-adapters.ts","kind":"import-statement","original":"./legacy-adapters.js"}],"format":"esm"}},"outputs":{"dist/artifacts/browser.cjs":{"imports":[],"exports":[],"entryPoint":"src/artifacts/browser.ts","inputs":{"src/artifacts/browser.ts":{"bytesInOutput":361},"src/artifacts/types.ts":{"bytesInOutput":820},"src/artifacts/browser-diff.ts":{"bytesInOutput":4291}},"bytes":6185},"dist/artifacts/index.cjs":{"imports":[{"path":"node:buffer","kind":"require-call","external":true},{"path":"node:crypto","kind":"require-call","external":true},{"path":"node:crypto","kind":"require-call","external":true},{"path":"node:fs/promises","kind":"require-call","external":true},{"path":"node:path","kind":"require-call","external":true},{"path":"node:fs","kind":"require-call","external":true},{"path":"node:os","kind":"require-call","external":true},{"path":"node:path","kind":"require-call","external":true},{"path":"node:buffer","kind":"require-call","external":true},{"path":"node:crypto","kind":"require-call","external":true},{"path":"node:crypto","kind":"require-call","external":true},{"path":"node:crypto","kind":"require-call","external":true},{"path":"node:buffer","kind":"require-call","external":true}],"exports":[],"entryPoint":"src/artifacts/index.ts","inputs":{"src/artifacts/index.ts":{"bytesInOutput":2267},"src/artifacts/types.ts":{"bytesInOutput":826},"src/artifacts/validation.ts":{"bytesInOutput":13371},"src/artifacts/hash.ts":{"bytesInOutput":721},"src/utils/custom-names.ts":{"bytesInOutput":124},"src/artifacts/evidence-graph.ts":{"bytesInOutput":4301},"src/artifacts/repository.ts":{"bytesInOutput":13747},"src/artifacts/file-repository.ts":{"bytesInOutput":6758},"src/control-plane/lock.ts":{"bytesInOutput":1067},"src/version.ts":{"bytesInOutput":16},"src/artifacts/diff-artifact.ts":{"bytesInOutput":7846},"src/artifacts/review-service.ts":{"bytesInOutput":3921},"src/artifacts/spec-lifecycle.ts":{"bytesInOutput":14029},"src/artifacts/multi-agent-review.ts":{"bytesInOutput":14125},"src/artifacts/legacy-adapters.ts":{"bytesInOutput":5009}},"bytes":90377}}}
+{"inputs":{"src/artifacts/types.ts":{"bytes":11224,"imports":[],"format":"esm"},"src/artifacts/browser-diff.ts":{"bytes":8767,"imports":[],"format":"esm"},"src/artifacts/browser.ts":{"bytes":232,"imports":[{"path":"src/artifacts/types.ts","kind":"import-statement","original":"./types.js"},{"path":"src/artifacts/browser-diff.ts","kind":"import-statement","original":"./browser-diff.js"}],"format":"esm"},"src/artifacts/hash.ts":{"bytes":1489,"imports":[{"path":"node:crypto","kind":"import-statement","external":true}],"format":"esm"},"src/utils/custom-names.ts":{"bytes":2210,"imports":[],"format":"esm"},"src/artifacts/validation.ts":{"bytes":25271,"imports":[{"path":"src/artifacts/types.ts","kind":"import-statement","original":"./types.js"},{"path":"node:buffer","kind":"import-statement","external":true},{"path":"src/artifacts/hash.ts","kind":"import-statement","original":"./hash.js"},{"path":"src/utils/custom-names.ts","kind":"import-statement","original":"../utils/custom-names.js"},{"path":"src/artifacts/types.ts","kind":"import-statement","original":"./types.js"}],"format":"esm"},"src/artifacts/evidence-graph.ts":{"bytes":8778,"imports":[{"path":"src/artifacts/types.ts","kind":"import-statement","original":"./types.js"},{"path":"src/utils/custom-names.ts","kind":"import-statement","original":"../utils/custom-names.js"}],"format":"esm"},"src/artifacts/repository.ts":{"bytes":29289,"imports":[{"path":"src/artifacts/types.ts","kind":"import-statement","original":"./types.js"},{"path":"src/artifacts/validation.ts","kind":"import-statement","original":"./validation.js"}],"format":"esm"},"src/control-plane/lock.ts":{"bytes":2496,"imports":[{"path":"node:fs","kind":"import-statement","external":true},{"path":"node:os","kind":"import-statement","external":true},{"path":"node:path","kind":"import-statement","external":true}],"format":"esm"},"src/version.ts":{"bytes":195,"imports":[],"format":"esm"},"src/artifacts/file-repository.ts":{"bytes":16334,"imports":[{"path":"node:crypto","kind":"import-statement","external":true},{"path":"node:fs/promises","kind":"import-statement","external":true},{"path":"node:path","kind":"import-statement","external":true},{"path":"src/control-plane/lock.ts","kind":"import-statement","original":"../control-plane/lock.js"},{"path":"src/version.ts","kind":"import-statement","original":"../version.js"},{"path":"src/artifacts/hash.ts","kind":"import-statement","original":"./hash.js"},{"path":"src/artifacts/repository.ts","kind":"import-statement","original":"./repository.js"},{"path":"src/artifacts/types.ts","kind":"import-statement","original":"./types.js"}],"format":"esm"},"src/artifacts/diff-artifact.ts":{"bytes":17998,"imports":[{"path":"node:buffer","kind":"import-statement","external":true},{"path":"src/artifacts/hash.ts","kind":"import-statement","original":"./hash.js"},{"path":"src/artifacts/types.ts","kind":"import-statement","original":"./types.js"},{"path":"src/artifacts/validation.ts","kind":"import-statement","original":"./validation.js"}],"format":"esm"},"src/artifacts/review-service.ts":{"bytes":8672,"imports":[{"path":"node:crypto","kind":"import-statement","external":true},{"path":"src/artifacts/diff-artifact.ts","kind":"import-statement","original":"./diff-artifact.js"},{"path":"src/artifacts/repository.ts","kind":"import-statement","original":"./repository.js"}],"format":"esm"},"src/artifacts/spec-lifecycle.ts":{"bytes":31007,"imports":[{"path":"node:crypto","kind":"import-statement","external":true},{"path":"src/artifacts/hash.ts","kind":"import-statement","original":"./hash.js"},{"path":"src/artifacts/review-service.ts","kind":"import-statement","original":"./review-service.js"},{"path":"src/artifacts/types.ts","kind":"import-statement","original":"./types.js"}],"format":"esm"},"src/artifacts/multi-agent-review.ts":{"bytes":30649,"imports":[{"path":"node:crypto","kind":"import-statement","external":true},{"path":"src/artifacts/hash.ts","kind":"import-statement","original":"./hash.js"},{"path":"src/artifacts/types.ts","kind":"import-statement","original":"./types.js"},{"path":"src/artifacts/validation.ts","kind":"import-statement","original":"./validation.js"},{"path":"src/utils/custom-names.ts","kind":"import-statement","original":"../utils/custom-names.js"}],"format":"esm"},"src/artifacts/legacy-adapters.ts":{"bytes":10908,"imports":[{"path":"node:buffer","kind":"import-statement","external":true},{"path":"src/artifacts/hash.ts","kind":"import-statement","original":"./hash.js"},{"path":"src/artifacts/types.ts","kind":"import-statement","original":"./types.js"},{"path":"src/artifacts/validation.ts","kind":"import-statement","original":"./validation.js"},{"path":"src/artifacts/diff-artifact.ts","kind":"import-statement","original":"./diff-artifact.js"}],"format":"esm"},"src/artifacts/index.ts":{"bytes":385,"imports":[{"path":"src/artifacts/types.ts","kind":"import-statement","original":"./types.js"},{"path":"src/artifacts/validation.ts","kind":"import-statement","original":"./validation.js"},{"path":"src/artifacts/hash.ts","kind":"import-statement","original":"./hash.js"},{"path":"src/artifacts/evidence-graph.ts","kind":"import-statement","original":"./evidence-graph.js"},{"path":"src/artifacts/repository.ts","kind":"import-statement","original":"./repository.js"},{"path":"src/artifacts/file-repository.ts","kind":"import-statement","original":"./file-repository.js"},{"path":"src/artifacts/diff-artifact.ts","kind":"import-statement","original":"./diff-artifact.js"},{"path":"src/artifacts/review-service.ts","kind":"import-statement","original":"./review-service.js"},{"path":"src/artifacts/spec-lifecycle.ts","kind":"import-statement","original":"./spec-lifecycle.js"},{"path":"src/artifacts/multi-agent-review.ts","kind":"import-statement","original":"./multi-agent-review.js"},{"path":"src/artifacts/legacy-adapters.ts","kind":"import-statement","original":"./legacy-adapters.js"}],"format":"esm"}},"outputs":{"dist/artifacts/browser.cjs":{"imports":[],"exports":[],"entryPoint":"src/artifacts/browser.ts","inputs":{"src/artifacts/browser.ts":{"bytesInOutput":361},"src/artifacts/types.ts":{"bytesInOutput":820},"src/artifacts/browser-diff.ts":{"bytesInOutput":4291}},"bytes":6185},"dist/artifacts/index.cjs":{"imports":[{"path":"node:buffer","kind":"require-call","external":true},{"path":"node:crypto","kind":"require-call","external":true},{"path":"node:crypto","kind":"require-call","external":true},{"path":"node:fs/promises","kind":"require-call","external":true},{"path":"node:path","kind":"require-call","external":true},{"path":"node:fs","kind":"require-call","external":true},{"path":"node:os","kind":"require-call","external":true},{"path":"node:path","kind":"require-call","external":true},{"path":"node:buffer","kind":"require-call","external":true},{"path":"node:crypto","kind":"require-call","external":true},{"path":"node:crypto","kind":"require-call","external":true},{"path":"node:crypto","kind":"require-call","external":true},{"path":"node:buffer","kind":"require-call","external":true}],"exports":[],"entryPoint":"src/artifacts/index.ts","inputs":{"src/artifacts/index.ts":{"bytesInOutput":2267},"src/artifacts/types.ts":{"bytesInOutput":826},"src/artifacts/validation.ts":{"bytesInOutput":13371},"src/artifacts/hash.ts":{"bytesInOutput":721},"src/utils/custom-names.ts":{"bytesInOutput":124},"src/artifacts/evidence-graph.ts":{"bytesInOutput":4301},"src/artifacts/repository.ts":{"bytesInOutput":13747},"src/artifacts/file-repository.ts":{"bytesInOutput":6758},"src/control-plane/lock.ts":{"bytesInOutput":1067},"src/version.ts":{"bytesInOutput":16},"src/artifacts/diff-artifact.ts":{"bytesInOutput":7846},"src/artifacts/review-service.ts":{"bytesInOutput":3921},"src/artifacts/spec-lifecycle.ts":{"bytesInOutput":14029},"src/artifacts/multi-agent-review.ts":{"bytesInOutput":14125},"src/artifacts/legacy-adapters.ts":{"bytesInOutput":5009}},"bytes":90377}}}