nexus-agents 8.16.0 → 8.18.0

package/dist/{chunk-RJO6I6JV.js → chunk-2T2MSN7B.js}

@@ -75,6 +75,8 @@ var SanitizedInputSchema = z.object({
   injectionFlags: z.array(InjectionFlagSchema),
   /** Elements stripped during sanitization (audit trail). */
   strippedElements: z.array(StrippedElementSchema),
+  /** Whether content exceeded the configured limit. Absent on records that predate this field. */
+  truncated: z.boolean().optional(),
   /** Whether any dangerous content was detected and stripped. */
   wasModified: z.boolean(),
   /** Timestamp of sanitization (ISO 8601). */
@@ -286,10 +288,11 @@ function assignTrustTier(userRole, injectionFlags, allowlisted) {
 }
 function sanitizeInput(content, userRole, username, config) {
   const cfg = SanitizerConfigSchema.parse(config ?? {});
-  const truncated = content.slice(0, cfg.maxInputLength);
+  const truncatedContent = content.slice(0, cfg.maxInputLength);
+  const truncated = truncatedContent.length < content.length;
   const allowlisted = cfg.allowlistedMaintainers.includes(username);
   try {
-    const entityDecoded = applyEntityEvasionDefense(truncated);
+    const entityDecoded = applyEntityEvasionDefense(truncatedContent);
     const html = stripDangerousHtml(entityDecoded.cleaned);
     const xml = stripXmlTags(html.cleaned);
     const comments = stripHtmlComments(xml.cleaned);
@@ -299,7 +302,7 @@ function sanitizeInput(content, userRole, username, config) {
       ...xml.stripped,
       ...comments.stripped
     ];
-    const injectionFlags = detectInjectionPatterns(truncated);
+    const injectionFlags = detectInjectionPatterns(truncatedContent);
     const trustTier = assignTrustTier(userRole, injectionFlags, allowlisted);
     return {
       content: comments.cleaned,
@@ -309,11 +312,12 @@ function sanitizeInput(content, userRole, username, config) {
       userRole,
       injectionFlags,
       strippedElements: allStripped,
-      wasModified: allStripped.length > 0,
+      truncated,
+      wasModified: truncated || allStripped.length > 0,
       sanitizedAt: (/* @__PURE__ */ new Date()).toISOString()
     };
   } catch (err) {
-    return buildFailClosedResult(err, content, truncated, userRole, allowlisted);
+    return buildFailClosedResult(err, content, truncatedContent, userRole, allowlisted);
   }
 }
 function buildFailClosedResult(err, originalContent, truncated, userRole, allowlisted) {
@@ -333,6 +337,7 @@ function buildFailClosedResult(err, originalContent, truncated, userRole, allowl
         length: truncated.length
       }
     ],
+    truncated: truncated.length < originalContent.length,
     wasModified: true,
     sanitizedAt: (/* @__PURE__ */ new Date()).toISOString()
   };
@@ -519,6 +524,9 @@ function assessReputation(metadata, cache) {
   const assessment = {
     username: metadata.username,
     userRole,
+    coverage: {
+      activity: metadata.priorContributions !== void 0 && metadata.recentCommentCount !== void 0 && metadata.recentCommentWindowMinutes !== void 0 ? "measured" : "unmeasured"
+    },
     suspiciousSignals: signals,
     isSuspicious: signals.length > 0,
     effectiveTrustTier: effectiveTier,
@@ -580,4 +588,4 @@ export {
   resolveReputationGatingMode,
   gateWithReputation
 };
-//# sourceMappingURL=chunk-RJO6I6JV.js.map
+//# sourceMappingURL=chunk-2T2MSN7B.js.map

package/dist/chunk-2T2MSN7B.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/security/trust-types.ts","../src/security/input-sanitizer.ts","../src/security/reputation-model.ts","../src/security/env-mode.ts"],"sourcesContent":["/**\n * nexus-agents/security - Trust Types\n *\n * Zod schemas and TypeScript types for the untrusted input hardening\n * framework. Defines trust tiers, sanitized input, user roles, and\n * injection detection flags.\n *\n * @module security/trust-types\n * (Source: Issue #818, #819 — Phase 1: Input Sanitization)\n */\n\nimport { z } from 'zod';\n\n// ============================================================================\n// Trust Tiers\n// ============================================================================\n\n/**\n * Trust tier classification for input sources.\n * Lower number = higher trust.\n *\n * 1 = Authoritative (repo files, CI, CLAUDE.md, allowlisted maintainers)\n * 2 = Semi-trusted (collaborator issue body, contributor PR metadata)\n * 3 = Untrusted (unknown user comments, non-collaborator issue body)\n * 4 = Hostile (injection patterns, hidden HTML, instruction-like content)\n */\nexport const TrustTierSchema = z.enum(['1', '2', '3', '4']);\nexport type TrustTier = z.infer<typeof TrustTierSchema>;\n\n/** Numeric trust tier for comparisons. Higher number = lower trust. */\nexport const TRUST_TIER_NUMERIC: Record<TrustTier, number> = {\n  '1': 1,\n  '2': 2,\n  '3': 3,\n  '4': 4,\n};\n\n// ============================================================================\n// GitHub User Roles\n// ============================================================================\n\n/**\n * GitHub user relationship to the repository.\n */\nexport const GitHubUserRoleSchema = z.enum([\n  'owner',\n  'maintainer',\n  'collaborator',\n  'contributor',\n  'member',\n  'unknown',\n]);\nexport type GitHubUserRole = z.infer<typeof GitHubUserRoleSchema>;\n\n/**\n * Default trust tier mapping for each GitHub role.\n * Can be overridden by injection pattern detection (downgrade only).\n */\nexport const ROLE_DEFAULT_TRUST: Record<GitHubUserRole, TrustTier> = {\n  owner: '1',\n  maintainer: '1',\n  collaborator: '2',\n  contributor: '2',\n  member: '3',\n  unknown: '3',\n};\n\n// ============================================================================\n// Injection Detection\n// ============================================================================\n\n/**\n * Categories of injection patterns detected in content.\n */\nexport const InjectionFlagSchema = z.enum([\n  'authority_claim',\n  'instruction_pattern',\n  'system_prompt_manipulation',\n  'hidden_content',\n  'urgency_manipulation',\n  'fake_conversation',\n  'base64_encoded',\n  'external_link_instruction',\n]);\nexport type InjectionFlag = z.infer<typeof InjectionFlagSchema>;\n\n/**\n * An element stripped during sanitization, preserved for audit trail.\n */\nexport const StrippedElementSchema = z.object({\n  /** Type of element stripped. */\n  tag: z.string().min(1),\n  /** Reason for stripping. */\n  reason: z.string().min(1),\n  /** Start index in original content. */\n  startIndex: z.number().int().nonnegative(),\n  /** Length of stripped content. */\n  length: z.number().int().positive(),\n});\nexport type StrippedElement = z.infer<typeof StrippedElementSchema>;\n\n// ============================================================================\n// Sanitized Input\n// ============================================================================\n\n/**\n * The result of sanitizing untrusted input.\n * Contains cleaned content, trust classification, and audit data.\n */\nexport const SanitizedInputSchema = z.object({\n  /** Sanitized content with dangerous elements removed. */\n  content: z.string(),\n  /** Original content before sanitization (for audit). */\n  originalLength: z.number().int().nonnegative(),\n  /**\n   * Assigned trust tier based on user role and content analysis.\n   *\n   * Deprecation note: required today; a future major makes it absent when\n   * unmeasured (see the next-major issue named in the changeset).\n   */\n  trustTier: TrustTierSchema,\n  /**\n   * True when `trustTier` is the sanitizer's measured content tier; false when\n   * the sanitization stage was disabled and `trustTier` is only the\n   * role-derived base tier. Absent on records that predate this field; an\n   * absent value MUST be treated as measured so legacy content downgrades are\n   * preserved fail-closed.\n   */\n  contentTierMeasured: z.boolean().optional(),\n  /** GitHub user role of the input source. */\n  userRole: GitHubUserRoleSchema,\n  /** Injection patterns detected in content. */\n  injectionFlags: z.array(InjectionFlagSchema),\n  /** Elements stripped during sanitization (audit trail). */\n  strippedElements: z.array(StrippedElementSchema),\n  /** Whether content exceeded the configured limit. Absent on records that predate this field. */\n  truncated: z.boolean().optional(),\n  /** Whether any dangerous content was detected and stripped. */\n  wasModified: z.boolean(),\n  /** Timestamp of sanitization (ISO 8601). */\n  sanitizedAt: z.iso.datetime(),\n});\nexport type SanitizedInput = z.infer<typeof SanitizedInputSchema>;\n\n// ============================================================================\n// Configuration\n// ============================================================================\n\n/**\n * Configuration for the input sanitizer.\n */\nexport const SanitizerConfigSchema = z.object({\n  /** GitHub usernames that are always Tier 1 (allowlisted maintainers). */\n  allowlistedMaintainers: z.array(z.string().min(1)).default([]),\n  /** Whether to fail open (log only) or fail closed (block). Phase 1 = open. */\n  failOpen: z.boolean().default(true),\n  /** Maximum input length before truncation. */\n  maxInputLength: z.number().int().positive().default(50_000),\n});\nexport type SanitizerConfig = z.infer<typeof SanitizerConfigSchema>;\n","/**\n * nexus-agents/security - Input Sanitizer\n *\n * Sanitizes untrusted GitHub input by stripping dangerous HTML/XML tags,\n * detecting injection patterns, and producing a SanitizedInput result\n * with full audit trail.\n *\n * Defense layer 1 of the three-layer hardening architecture.\n * See: docs/architecture/UNTRUSTED_INPUT_HARDENING.md\n *\n * @module security/input-sanitizer\n * (Source: Issue #818, #819 — Phase 1: Input Sanitization)\n */\n\nimport type {\n  InjectionFlag,\n  SanitizedInput,\n  SanitizerConfig,\n  StrippedElement,\n  TrustTier,\n  GitHubUserRole,\n} from './trust-types.js';\nimport { ROLE_DEFAULT_TRUST, SanitizerConfigSchema } from './trust-types.js';\n\n// ============================================================================\n// Dangerous HTML Patterns (Trail of Bits / GitHub Copilot vectors)\n// ============================================================================\n\n/**\n * HTML tags to strip. These are known injection vectors:\n * - `<picture>` / `<source>`: Trail of Bits GitHub Copilot injection\n * - `<img>`: Can carry injection via alt text or onerror\n */\nconst DANGEROUS_HTML_PATTERN =\n  /<(picture|source|img)\\b[^>]*>[\\s\\S]*?<\\/\\1>|<(picture|source|img)\\b[^>]*\\/?>/gi;\n\n// ============================================================================\n// XML-like Tags (Conversation History Injection)\n// ============================================================================\n\n/**\n * XML-like tags that mimic conversation structure or system prompts.\n */\nconst XML_INJECTION_PATTERN =\n  /<\\/?(system|human|assistant|instructions|user|prompt|context|tool_use|tool_result)\\b[^>]*>/gi;\n\n// ============================================================================\n// HTML Comments with Instructions\n// ============================================================================\n\nconst HTML_COMMENT_PATTERN = /<!--[\\s\\S]*?-->/g;\n\n// ============================================================================\n// Injection Pattern Detectors\n// ============================================================================\n\ninterface PatternMatch {\n  flag: InjectionFlag;\n  pattern: RegExp;\n}\n\nconst INJECTION_PATTERNS: readonly PatternMatch[] = [\n  {\n    flag: 'authority_claim',\n    pattern: /\\b(as (?:a|the) (?:maintainer|admin|owner|security lead|repo owner|developer))\\b/i,\n  },\n  {\n    flag: 'authority_claim',\n    pattern: /\\b(i(?:'m| am) the (?:repo |project )?(?:owner|maintainer|admin))\\b/i,\n  },\n  {\n    flag: 'instruction_pattern',\n    pattern: /\\b(please (?:close|merge|label|mark|apply|delete|remove|approve|reject))\\b/i,\n  },\n  {\n    flag: 'instruction_pattern',\n    pattern: /\\b(you (?:should|must|need to) (?:close|merge|label|apply|delete))\\b/i,\n  },\n  {\n    flag: 'system_prompt_manipulation',\n    pattern: /\\b(ignore (?:all )?previous (?:instructions|rules|prompts))\\b/i,\n  },\n  {\n    flag: 'system_prompt_manipulation',\n    pattern: /\\b(forget (?:your |all )?(?:instructions|rules|safety))\\b/i,\n  },\n  {\n    flag: 'system_prompt_manipulation',\n    pattern: /\\b(new (?:instructions|rules|system prompt|directives))\\b/i,\n  },\n  {\n    flag: 'urgency_manipulation',\n    pattern: /\\b(critical|emergency|urgent|must act now|immediately|time[- ]?sensitive)\\b/i,\n  },\n  {\n    flag: 'fake_conversation',\n    pattern: /<(?:assistant|human|user|system)>/i,\n  },\n  // base64_encoded is detected separately by `looksLikeBase64Payload` below.\n  // The lookahead-based regex it replaced exhibited catastrophic backtracking\n  // on long hex-only inputs (#2191) — see `looksLikeBase64Payload` for the\n  // two-phase rewrite that preserves the #1811 SHA-hash false-positive guard.\n  {\n    flag: 'external_link_instruction',\n    pattern: /(?:apply|run|execute|install)\\s+(?:this\\s+)?(?:from\\s+)?https?:\\/\\//i,\n  },\n];\n\n/**\n * Two-phase base64-payload detection (#2191).\n *\n * The original `(?=[A-Za-z0-9+/]*[g-zG-Z+/=])[A-Za-z0-9+/]{40,}={0,2}` regex\n * was vulnerable to catastrophic backtracking — V8 took ~1.8s on a 50K\n * hex-only adversarial input. Splitting the check into two non-overlapping\n * phases removes the lookahead and makes the worst case linear.\n *\n *   Phase 1: find a 40+ run of base64-alphabet chars (no lookahead).\n *   Phase 2: confirm the matched substring contains a base64-discriminating\n *            char (g-z, G-Z, +, /, =) so SHA-1 / SHA-256 hex hashes don't\n *            false-positive (preserves #1811 behavior).\n *\n * Same detection coverage as the original; same false-positive resistance.\n */\nconst BASE64_RUN_GLOBAL = /[A-Za-z0-9+/]{40,}={0,2}/g;\nconst BASE64_DISCRIMINATOR = /[g-zG-Z+/=]/;\n\nfunction looksLikeBase64Payload(content: string): boolean {\n  // Iterate every 40+ base64-alphabet run rather than just the first one,\n  // so a long hex-only prefix doesn't mask a real base64 payload that\n  // appears later in the content.\n  for (const match of content.matchAll(BASE64_RUN_GLOBAL)) {\n    if (BASE64_DISCRIMINATOR.test(match[0])) return true;\n  }\n  return false;\n}\n\n// ============================================================================\n// HTML Entity Decoding (evasion defense)\n// ============================================================================\n\n/**\n * Dangerous-tag names we will still match after entity decoding.\n * Kept in sync with DANGEROUS_HTML_PATTERN and XML_INJECTION_PATTERN above.\n */\nconst DANGEROUS_TAG_NAMES =\n  'picture|source|img|system|human|assistant|instructions|user|prompt|context|tool_use|tool_result';\n\n/**\n * Detects whether the input contains entity-encoded forms of any dangerous\n * tag (&lt;picture, &#60;system, &#x3c;img …). Used as a cheap pre-check so\n * that benign content with legitimate entities (e.g. \"AT&amp;T\") is passed\n * through untouched and wasModified stays false.\n */\nconst ENCODED_DANGEROUS_TAG_PATTERN = new RegExp(\n  `&(?:lt|#0*60|#x0*3c);\\\\s*\\\\/?\\\\s*(?:${DANGEROUS_TAG_NAMES})\\\\b`,\n  'i'\n);\n\n/** Decodes the subset of HTML entities that can reconstruct tag syntax. */\nfunction decodeEntities(content: string): string {\n  return (\n    content\n      // Numeric (decimal) references\n      .replace(/&#(\\d+);/g, (_match, dec: string) => {\n        const code = Number.parseInt(dec, 10);\n        return Number.isFinite(code) ? String.fromCodePoint(code) : _match;\n      })\n      // Numeric (hex) references\n      .replace(/&#x([0-9a-f]+);/gi, (_match, hex: string) => {\n        const code = Number.parseInt(hex, 16);\n        return Number.isFinite(code) ? String.fromCodePoint(code) : _match;\n      })\n      // Named entities most relevant to tag reconstruction\n      .replace(/&lt;/gi, '<')\n      .replace(/&gt;/gi, '>')\n      .replace(/&quot;/gi, '\"')\n      .replace(/&apos;/gi, \"'\")\n      // &amp; must be decoded last so that &amp;lt; does not resurface as <\n      .replace(/&amp;/gi, '&')\n  );\n}\n\n/**\n * Runs decodeEntities only if the input contains an entity-encoded dangerous\n * tag. This keeps benign content with legitimate entities untouched.\n */\nfunction applyEntityEvasionDefense(content: string): {\n  cleaned: string;\n  stripped: StrippedElement[];\n} {\n  if (!ENCODED_DANGEROUS_TAG_PATTERN.test(content)) {\n    return { cleaned: content, stripped: [] };\n  }\n  const decoded = decodeEntities(content);\n  return {\n    cleaned: decoded,\n    stripped: [\n      {\n        tag: '&…;',\n        reason: 'HTML entity-encoded dangerous tag decoded for stripping (CWE-79)',\n        startIndex: 0,\n        length: content.length,\n      },\n    ],\n  };\n}\n\n// ============================================================================\n// Core Sanitization Functions\n// ============================================================================\n\n/** Strips dangerous HTML tags and records what was removed.\n * Loops until stable to prevent reconstructed patterns after removal (#1496). */\nfunction stripDangerousHtml(content: string): {\n  cleaned: string;\n  stripped: StrippedElement[];\n} {\n  const stripped: StrippedElement[] = [];\n  let cleaned = content;\n  const MAX_PASSES = 5;\n  for (let pass = 0; pass < MAX_PASSES; pass++) {\n    DANGEROUS_HTML_PATTERN.lastIndex = 0;\n    if (!DANGEROUS_HTML_PATTERN.test(cleaned)) break;\n    cleaned = cleaned.replace(DANGEROUS_HTML_PATTERN, (match, _g1, _g2, offset: number) => {\n      stripped.push({\n        tag: match.slice(0, 30) + (match.length > 30 ? '...' : ''),\n        reason: 'Dangerous HTML tag (Trail of Bits injection vector)',\n        startIndex: offset,\n        length: match.length,\n      });\n      return '';\n    });\n  }\n  return { cleaned, stripped };\n}\n\n/** Strips XML-like tags that mimic conversation structure.\n * Loops until stable to prevent reconstructed patterns after removal (#1496). */\nfunction stripXmlTags(content: string): {\n  cleaned: string;\n  stripped: StrippedElement[];\n} {\n  const stripped: StrippedElement[] = [];\n  let cleaned = content;\n  const MAX_PASSES = 5;\n  for (let pass = 0; pass < MAX_PASSES; pass++) {\n    XML_INJECTION_PATTERN.lastIndex = 0;\n    if (!XML_INJECTION_PATTERN.test(cleaned)) break;\n    cleaned = cleaned.replace(XML_INJECTION_PATTERN, (match, _g1, offset: number) => {\n      stripped.push({\n        tag: match,\n        reason: 'XML-like conversation injection tag',\n        startIndex: offset,\n        length: match.length,\n      });\n      return '';\n    });\n  }\n  return { cleaned, stripped };\n}\n\n/** Strips HTML comments that may contain hidden instructions.\n * Loops until stable to prevent reconstructed comment patterns (#1496). */\nfunction stripHtmlComments(content: string): {\n  cleaned: string;\n  stripped: StrippedElement[];\n} {\n  const stripped: StrippedElement[] = [];\n  let cleaned = content;\n  // Loop until stable: stripping may reveal new instruction-bearing comments\n  const MAX_PASSES = 5;\n  for (let pass = 0; pass < MAX_PASSES; pass++) {\n    HTML_COMMENT_PATTERN.lastIndex = 0;\n    const prevLength = cleaned.length;\n    cleaned = cleaned.replace(HTML_COMMENT_PATTERN, (match, offset: number) => {\n      const hasInstruction = /\\b(ignore|execute|close|merge|delete|apply)\\b/i.test(match);\n      if (!hasInstruction) return match;\n\n      stripped.push({\n        tag: '<!-- ... -->',\n        reason: 'HTML comment with instruction-like content',\n        startIndex: offset,\n        length: match.length,\n      });\n      return '';\n    });\n    if (cleaned.length === prevLength) break;\n  }\n  // Second pass: strip unclosed <!-- tags (incomplete comment injection)\n  let searchFrom = 0;\n  while (searchFrom < cleaned.length) {\n    const openIdx = cleaned.indexOf('<!--', searchFrom);\n    if (openIdx === -1) break;\n    const closeIdx = cleaned.indexOf('-->', openIdx + 4);\n    if (closeIdx === -1) {\n      stripped.push({\n        tag: '<!--',\n        reason: 'Unclosed HTML comment (potential injection vector)',\n        startIndex: openIdx,\n        length: cleaned.length - openIdx,\n      });\n      cleaned = cleaned.slice(0, openIdx);\n      break;\n    }\n    searchFrom = closeIdx + 3;\n  }\n  return { cleaned, stripped };\n}\n\n/** Detects injection patterns in content without modifying it. */\nfunction detectInjectionPatterns(content: string): InjectionFlag[] {\n  const flags = new Set<InjectionFlag>();\n  for (const { flag, pattern } of INJECTION_PATTERNS) {\n    // Reset lastIndex for global patterns\n    pattern.lastIndex = 0;\n    if (pattern.test(content)) {\n      flags.add(flag);\n    }\n  }\n  if (looksLikeBase64Payload(content)) {\n    flags.add('base64_encoded');\n  }\n  return Array.from(flags);\n}\n\n/** Lower-cases an arbitrary role literal and maps it to a known role. */\nfunction normalizeRole(userRole: string): GitHubUserRole {\n  const lower = userRole.toLowerCase();\n  if (lower in ROLE_DEFAULT_TRUST) return lower as GitHubUserRole;\n  return 'unknown';\n}\n\n/**\n * Assigns trust tier based on user role and injection analysis.\n * Injection patterns can only DOWNGRADE trust, never upgrade.\n */\nfunction assignTrustTier(\n  userRole: GitHubUserRole,\n  injectionFlags: readonly InjectionFlag[],\n  allowlisted: boolean\n): TrustTier {\n  if (allowlisted) return '1';\n\n  // Defensive lowercase — the type says GitHubUserRole, but callers\n  // sometimes cast an unnormalized GitHub author_association literal\n  // (e.g. 'OWNER', 'MEMBER') directly. Normalize here so the maintainer\n  // exemption below matches regardless of case (CWE-178).\n  const normalizedRole = normalizeRole(userRole);\n  const baseTier = ROLE_DEFAULT_TRUST[normalizedRole];\n\n  // Content with injection patterns is downgraded to Tier 4 (hostile)\n  const hostileFlags: InjectionFlag[] = ['system_prompt_manipulation', 'fake_conversation'];\n  if (injectionFlags.some((f) => hostileFlags.includes(f))) return '4';\n\n  // Content with authority claims from non-maintainers is suspicious\n  if (\n    injectionFlags.includes('authority_claim') &&\n    normalizedRole !== 'owner' &&\n    normalizedRole !== 'maintainer'\n  ) {\n    return '4';\n  }\n\n  return baseTier;\n}\n\n// ============================================================================\n// Public API\n// ============================================================================\n\n/**\n * Sanitizes untrusted GitHub input through the full Layer 1 pipeline:\n * 1. HTML stripping (picture/source/img tags)\n * 2. XML tag stripping (system/human/assistant)\n * 3. HTML comment stripping (instruction-bearing comments only)\n * 4. Injection pattern detection\n * 5. Trust tier assignment\n *\n * ⚠ **Use HostileInputFirewall.process() in agent code paths.** Calling\n * sanitizeInput() directly only runs Layer 1 — it does not evaluate the\n * Rule of Two and does not emit audit-trail events. An agent that processes\n * untrusted input while holding both write access and secrets violates the\n * Rule of Two; `evaluatePolicy` in policy-gate.ts enforces that per action,\n * and the firewall evaluates it per input as a signal (refusing only under\n * `NEXUS_FIREWALL_POLICY=enforce`). The live paths route their trust\n * decision through the firewall as of #4992 and keep direct sanitizeInput()\n * calls only for content cleaning of text they embed. Direct use of this\n * function is appropriate for unit tests and pure content analysis, not\n * for agent decision paths.\n *\n * @see packages/nexus-agents/src/security/firewall/firewall-pipeline.ts\n * @see packages/nexus-agents/src/security/policy-gate.ts\n * @param content - Raw untrusted content from GitHub\n * @param userRole - GitHub user's relationship to the repository\n * @param username - GitHub username (for allowlist check)\n * @param config - Optional sanitizer configuration\n * @returns SanitizedInput with cleaned content and audit data\n */\nexport function sanitizeInput(\n  content: string,\n  userRole: GitHubUserRole,\n  username: string,\n  config?: Partial<SanitizerConfig>\n): SanitizedInput {\n  const cfg = SanitizerConfigSchema.parse(config ?? {});\n  const truncatedContent = content.slice(0, cfg.maxInputLength);\n  const truncated = truncatedContent.length < content.length;\n  const allowlisted = cfg.allowlistedMaintainers.includes(username);\n\n  try {\n    // Pipeline: decode entity-encoded dangerous tags, then strip dangerous content\n    const entityDecoded = applyEntityEvasionDefense(truncatedContent);\n    const html = stripDangerousHtml(entityDecoded.cleaned);\n    const xml = stripXmlTags(html.cleaned);\n    const comments = stripHtmlComments(xml.cleaned);\n    const allStripped = [\n      ...entityDecoded.stripped,\n      ...html.stripped,\n      ...xml.stripped,\n      ...comments.stripped,\n    ];\n\n    // Detect injection patterns on ORIGINAL content (before stripping)\n    const injectionFlags = detectInjectionPatterns(truncatedContent);\n\n    // Assign trust tier\n    const trustTier = assignTrustTier(userRole, injectionFlags, allowlisted);\n\n    return {\n      content: comments.cleaned,\n      originalLength: content.length,\n      trustTier,\n      contentTierMeasured: true,\n      userRole,\n      injectionFlags,\n      strippedElements: allStripped,\n      truncated,\n      wasModified: truncated || allStripped.length > 0,\n      sanitizedAt: new Date().toISOString(),\n    };\n  } catch (err: unknown) {\n    return buildFailClosedResult(err, content, truncatedContent, userRole, allowlisted);\n  }\n}\n\n/**\n * Fail-closed result returned when the sanitizer pipeline throws.\n * Returns empty content at Tier-4 (or Tier-1 for allowlisted maintainers,\n * since their bypass is not regex-dependent) so downstream consumers\n * cannot act on untrusted content we could not validate.\n * CLAUDE.md: \"Fail closed on ambiguity.\"\n */\nfunction buildFailClosedResult(\n  err: unknown,\n  originalContent: string,\n  truncated: string,\n  userRole: GitHubUserRole,\n  allowlisted: boolean\n): SanitizedInput {\n  const message = err instanceof Error ? err.message : String(err);\n  return {\n    content: '',\n    originalLength: originalContent.length,\n    trustTier: allowlisted ? '1' : '4',\n    contentTierMeasured: true,\n    userRole,\n    injectionFlags: [],\n    strippedElements: [\n      {\n        tag: '(pipeline-failure)',\n        reason: `Sanitizer pipeline threw; input discarded as fail-closed: ${message}`,\n        startIndex: 0,\n        length: truncated.length,\n      },\n    ],\n    truncated: truncated.length < originalContent.length,\n    wasModified: true,\n    sanitizedAt: new Date().toISOString(),\n  };\n}\n","/**\n * nexus-agents/security - Reputation Model\n *\n * Lightweight trust model for GitHub users that assesses reputation\n * based on account age, contribution history, and behavioral signals.\n * Integrates with the trust classifier for comprehensive trust assessment.\n *\n * @module security/reputation-model\n * (Source: Issue #818, #824 — Phase 3: Reputation Model)\n */\n\nimport { z } from 'zod';\n\nimport { getTimeProvider } from '../core/index.js';\nimport { resolveEnvMode } from './env-mode.js';\nimport type { TrustTier, GitHubUserRole, InjectionFlag } from './trust-types.js';\nimport { TRUST_TIER_NUMERIC, ROLE_DEFAULT_TRUST } from './trust-types.js';\n\n// ============================================================================\n// Types\n// ============================================================================\n\n/**\n * Signals that indicate a suspicious actor.\n */\nexport const SuspiciousSignalSchema = z.enum([\n  'new_account',\n  'no_prior_contributions',\n  'injection_patterns_detected',\n  'rapid_comments',\n  'mismatched_authority_claim',\n]);\nexport type SuspiciousSignal = z.infer<typeof SuspiciousSignalSchema>;\n\n/**\n * GitHub user metadata for reputation assessment.\n */\nexport interface GitHubUserMetadata {\n  readonly username: string;\n  /**\n   * Account/activity fields are OPTIONAL (#3106). When a field is absent (the\n   * caller couldn't fetch it — e.g. the firewall before Phase 3 wiring), its\n   * signal is SKIPPED rather than fabricated: an unknown value must never be\n   * treated as benign (the old hardcoded `365`/`0`) nor as hostile. Only the\n   * `authorAssociation` + `injectionFlags` signals fire on absent activity data.\n   */\n  readonly accountAgeDays?: number;\n  readonly priorContributions?: number;\n  readonly recentCommentCount?: number;\n  readonly recentCommentWindowMinutes?: number;\n  readonly authorAssociation: string;\n  readonly injectionFlags: readonly InjectionFlag[];\n}\n\n/**\n * Result of a reputation assessment.\n */\nexport interface ReputationAssessment {\n  readonly username: string;\n  readonly userRole: GitHubUserRole;\n  /** Measurement coverage; absent on assessments created before coverage tracking. */\n  readonly coverage?: {\n    readonly activity: 'measured' | 'unmeasured';\n  };\n  readonly suspiciousSignals: readonly SuspiciousSignal[];\n  readonly isSuspicious: boolean;\n  readonly effectiveTrustTier: TrustTier;\n  readonly reputationScore: number;\n  readonly reason: string;\n  readonly assessedAt: string;\n}\n\n// ============================================================================\n// Configuration\n// ============================================================================\n\n/** Thresholds for suspicious behavior detection. */\n/** Approximate days per year, used to normalize account age to a 0–10 scale. */\nconst DAYS_PER_YEAR_APPROX = 36.5;\n\nconst SUSPICIOUS_THRESHOLDS = {\n  /** Account younger than this (days) is flagged. */\n  newAccountDays: 30,\n  /** Fewer contributions than this is flagged. */\n  minContributions: 1,\n  /** More comments than this in the window triggers rapid-comment flag. */\n  rapidCommentThreshold: 5,\n  /** Time window (minutes) for rapid comment detection. */\n  rapidCommentWindowMinutes: 10,\n} as const;\n\n// ============================================================================\n// Reputation Cache\n// ============================================================================\n\ninterface CacheEntry {\n  assessment: ReputationAssessment;\n  expiresAt: number;\n}\n\n// Canonical source: config/timeouts.ts (Issue #1046)\nimport { CACHE_TIMEOUTS } from '../config/timeouts.js';\n\nconst DEFAULT_TTL_MS: number = CACHE_TIMEOUTS.reputationTtlMs;\nconst DEFAULT_MAX_SIZE = 1000;\n\n/**\n * In-memory reputation cache with TTL and max size.\n * Reduces redundant assessments for the same user within a short window.\n * Evicts oldest entries when max size is exceeded.\n */\nexport class ReputationCache {\n  private readonly cache = new Map<string, CacheEntry>();\n  private readonly ttlMs: number;\n  private readonly maxSize: number;\n\n  constructor(ttlMs = DEFAULT_TTL_MS, maxSize = DEFAULT_MAX_SIZE) {\n    this.ttlMs = ttlMs;\n    this.maxSize = maxSize;\n  }\n\n  get(username: string): ReputationAssessment | undefined {\n    const entry = this.cache.get(username);\n    if (entry === undefined) return undefined;\n    if (getTimeProvider().now() > entry.expiresAt) {\n      this.cache.delete(username);\n      return undefined;\n    }\n    return entry.assessment;\n  }\n\n  set(username: string, assessment: ReputationAssessment): void {\n    if (this.cache.size >= this.maxSize && !this.cache.has(username)) {\n      this.evictOldest();\n    }\n    this.cache.set(username, {\n      assessment,\n      expiresAt: getTimeProvider().now() + this.ttlMs,\n    });\n  }\n\n  /** Evict a batch of oldest entries (10% of maxSize, minimum 1). */\n  private evictOldest(): void {\n    const batchSize = Math.max(1, Math.floor(this.maxSize * 0.1));\n    const keys = this.cache.keys();\n    for (let i = 0; i < batchSize; i++) {\n      const next = keys.next();\n      if (next.done === true) break;\n      this.cache.delete(next.value);\n    }\n  }\n\n  clear(): void {\n    this.cache.clear();\n  }\n\n  get size(): number {\n    return this.cache.size;\n  }\n}\n\n// ============================================================================\n// Suspicious Signal Detection\n// ============================================================================\n\n/** Only hostile-tier injection flags count — benign flags like\n * instruction_pattern (\"please remove\") must not trip the injection signal. */\nconst HOSTILE_INJECTION_FLAGS: readonly InjectionFlag[] = [\n  'system_prompt_manipulation',\n  'fake_conversation',\n  'authority_claim',\n  'hidden_content',\n];\n\nfunction hasHostileInjection(flags: readonly InjectionFlag[]): boolean {\n  return flags.some((f) => HOSTILE_INJECTION_FLAGS.includes(f));\n}\n\n/** Rapid-comment burst — only when both count and window are known (#3106). */\nfunction isRapidCommenting(m: GitHubUserMetadata): boolean {\n  return (\n    m.recentCommentCount !== undefined &&\n    m.recentCommentWindowMinutes !== undefined &&\n    m.recentCommentCount > SUSPICIOUS_THRESHOLDS.rapidCommentThreshold &&\n    m.recentCommentWindowMinutes <= SUSPICIOUS_THRESHOLDS.rapidCommentWindowMinutes\n  );\n}\n\n/** Authority claim from a non-maintainer role. */\nfunction isMismatchedAuthority(m: GitHubUserMetadata): boolean {\n  if (!m.injectionFlags.includes('authority_claim')) return false;\n  const association = m.authorAssociation.toUpperCase();\n  return association !== 'OWNER' && association !== 'MEMBER';\n}\n\n/** Detect all suspicious signals from user metadata. #3106: account/activity\n * signals are skipped when their data is absent — never fabricated. */\nfunction detectSuspiciousSignals(metadata: GitHubUserMetadata): SuspiciousSignal[] {\n  const signals: SuspiciousSignal[] = [];\n  const { accountAgeDays, priorContributions } = metadata;\n\n  if (accountAgeDays !== undefined && accountAgeDays < SUSPICIOUS_THRESHOLDS.newAccountDays) {\n    signals.push('new_account');\n  }\n  if (\n    priorContributions !== undefined &&\n    priorContributions < SUSPICIOUS_THRESHOLDS.minContributions\n  ) {\n    signals.push('no_prior_contributions');\n  }\n  if (hasHostileInjection(metadata.injectionFlags)) signals.push('injection_patterns_detected');\n  if (isRapidCommenting(metadata)) signals.push('rapid_comments');\n  if (isMismatchedAuthority(metadata)) signals.push('mismatched_authority_claim');\n\n  return signals;\n}\n\n/** Calculate a 0-100 reputation score. */\nfunction calculateReputationScore(\n  metadata: GitHubUserMetadata,\n  signals: readonly SuspiciousSignal[],\n  userRole: GitHubUserRole\n): number {\n  let score = 50; // baseline\n\n  // Role bonus\n  const roleBonus: Record<GitHubUserRole, number> = {\n    owner: 40,\n    maintainer: 35,\n    collaborator: 25,\n    contributor: 15,\n    member: 5,\n    unknown: 0,\n  };\n  score += roleBonus[userRole];\n\n  // Account age bonus (max +10). #3106: absent → no bonus (avoid NaN; an\n  // unknown account neither earns nor loses the age bonus).\n  if (metadata.accountAgeDays !== undefined) {\n    score += Math.min(metadata.accountAgeDays / DAYS_PER_YEAR_APPROX, 10);\n  }\n\n  // Contribution bonus (max +10). #3106: absent → no bonus.\n  if (metadata.priorContributions !== undefined) {\n    score += Math.min(metadata.priorContributions, 10);\n  }\n\n  // Suspicious signal penalties\n  const signalPenalty: Record<SuspiciousSignal, number> = {\n    new_account: -15,\n    no_prior_contributions: -10,\n    injection_patterns_detected: -25,\n    rapid_comments: -20,\n    mismatched_authority_claim: -30,\n  };\n  for (const signal of signals) {\n    score += signalPenalty[signal];\n  }\n\n  return Math.max(0, Math.min(100, Math.round(score)));\n}\n\n/** Map role string to GitHubUserRole. */\nfunction mapRole(association: string): GitHubUserRole {\n  switch (association.toUpperCase()) {\n    case 'OWNER':\n      return 'owner';\n    case 'MEMBER':\n      return 'member';\n    case 'COLLABORATOR':\n      return 'collaborator';\n    case 'CONTRIBUTOR':\n      return 'contributor';\n    default:\n      return 'unknown';\n  }\n}\n\n/** Determine effective trust tier from signals and role. */\nfunction determineEffectiveTier(\n  userRole: GitHubUserRole,\n  signals: readonly SuspiciousSignal[]\n): TrustTier {\n  const baseTier = ROLE_DEFAULT_TRUST[userRole];\n\n  // Hostile signals → Tier 4\n  const hostileSignals: SuspiciousSignal[] = [\n    'injection_patterns_detected',\n    'mismatched_authority_claim',\n  ];\n  if (signals.some((s) => hostileSignals.includes(s))) return '4';\n\n  // Multiple suspicious signals → downgrade by 1, CLAMPED AT TIER 3 (#4681).\n  //\n  // Tier 4 is the HOSTILE tier — `.rules/untrusted-input.md` defines it as\n  // \"injection patterns, hidden HTML, instruction-like content\". It is reached\n  // ONLY via `hostileSignals` above. The generic downgrade must not manufacture\n  // it, because the two most common signals (`new_account` and\n  // `no_prior_contributions`) BOTH fire automatically for any genuine\n  // first-time reporter — they are two readings of one fact, not independent\n  // evidence of hostility. Clamping at 4 meant an `unknown` author (base 3)\n  // filing an ordinary bug report was classified hostile; once enforce mode\n  // became the default (#4675) that refused every new account's first issue\n  // and escalated it to security.\n  //\n  // Tier 3 is the correct destination: \"untrusted\" — still processed, but\n  // never treated as instructions.\n  if (signals.length >= 2) {\n    const baseNumeric = TRUST_TIER_NUMERIC[baseTier];\n    const downgraded = Math.min(baseNumeric + 1, 3);\n    return String(downgraded) as TrustTier;\n  }\n\n  return baseTier;\n}\n\n// ============================================================================\n// Public API\n// ============================================================================\n\n/**\n * Assess a GitHub user's reputation for trust classification.\n *\n * @param metadata - User metadata from GitHub API or local context.\n * @param cache - Optional cache instance for TTL-based deduplication.\n * @returns ReputationAssessment with trust tier and suspicious signals.\n */\nexport function assessReputation(\n  metadata: GitHubUserMetadata,\n  cache?: ReputationCache\n): ReputationAssessment {\n  // Check cache first\n  const cached = cache?.get(metadata.username);\n  if (cached !== undefined) return cached;\n\n  const userRole = mapRole(metadata.authorAssociation);\n  const signals = detectSuspiciousSignals(metadata);\n  const score = calculateReputationScore(metadata, signals, userRole);\n  const effectiveTier = determineEffectiveTier(userRole, signals);\n\n  const assessment: ReputationAssessment = {\n    username: metadata.username,\n    userRole,\n    coverage: {\n      activity:\n        metadata.priorContributions !== undefined &&\n        metadata.recentCommentCount !== undefined &&\n        metadata.recentCommentWindowMinutes !== undefined\n          ? 'measured'\n          : 'unmeasured',\n    },\n    suspiciousSignals: signals,\n    isSuspicious: signals.length > 0,\n    effectiveTrustTier: effectiveTier,\n    reputationScore: score,\n    reason: buildReason(userRole, signals, effectiveTier),\n    assessedAt: new Date().toISOString(),\n  };\n\n  cache?.set(metadata.username, assessment);\n  return assessment;\n}\n\n/**\n * Reconcile a trust-classifier tier with a reputation assessment into the\n * effective tier to enforce (#3119 / epic #3118). Demotion-only — reputation\n * can only RAISE the tier number (more restrictive), never lower it.\n *\n * Invariants:\n * - **Allowlist/Tier-1 wins**: a classifier Tier 1 (owner/allowlisted maintainer)\n *   is authoritative — reputation never demotes it.\n * - **Absent reputation → classifier tier**: no assessment (stage off / not\n *   fetched) keeps the classifier/role-default tier — never fabricate a benign\n *   tier, never escalate on mere absence (fetch-failure ≠ hostile signal).\n * - **Score is advisory**: only `effectiveTrustTier` participates; the 0–100\n *   `reputationScore` never moves the gate.\n */\nexport function reconcileTrustTier(\n  classifierTier: TrustTier,\n  reputation: ReputationAssessment | undefined\n): TrustTier {\n  if (classifierTier === '1') return '1';\n  const repTier = reputation?.effectiveTrustTier;\n  if (repTier === undefined) return classifierTier;\n  return TRUST_TIER_NUMERIC[repTier] > TRUST_TIER_NUMERIC[classifierTier]\n    ? repTier\n    : classifierTier;\n}\n\n// ============================================================================\n// Reputation gating rollout (#3122 / epic #3118 Phase 4)\n// ============================================================================\n\n/**\n * Rollout mode for reputation-based tier gating, mirroring\n * `NEXUS_ACCESS_POLICY_MODE` (#1977): `off` (no reputation effect), `audit`\n * (compute + report the would-be demotion but enforce the classifier tier), or\n * `enforce` (apply the demotion). Default `enforce` since #4667 — see\n * {@link DEFAULT_REPUTATION_GATING_MODE} for the measurement that justified the\n * flip. (This block previously still described the pre-flip `audit` default.)\n */\nexport const ReputationGatingModeSchema = z.enum(['off', 'audit', 'enforce']);\nexport type ReputationGatingMode = z.infer<typeof ReputationGatingModeSchema>;\n\n/**\n * Default gating mode.\n *\n * Flipped `audit` → `enforce` in #4667. `audit` computed the demotion, logged\n * \"would block under enforce\", and let the actions through — so a detected\n * prompt injection changed nothing in the shipped configuration.\n *\n * Measured before flipping, over the real triage path with only the SCM\n * provider mocked: 5/5 hostile inputs blocked, 0 false positives across five\n * real repository issues (as OWNER and as an unaffiliated author), and 0 across\n * ordinary maintainer language (\"please close this\", \"URGENT\", \"you should\n * merge #88 first\"). The one synthetic false-positive class is a body quoting\n * an injection payload verbatim, which is arguably correct fail-closed\n * behaviour for a security report — and is now visible, because a tier-4\n * outcome emits a `RefuseAction` rather than silently approving less.\n *\n * `NEXUS_REPUTATION_GATING=audit` remains available to roll back.\n */\nexport const DEFAULT_REPUTATION_GATING_MODE: ReputationGatingMode = 'enforce';\n\n/**\n * Resolve the gating mode from the environment (invalid → default + warn, never\n * throws — #3130). Delegates to the shared `resolveEnvMode` so this flag and\n * `NEXUS_ACCESS_POLICY_MODE` coerce identically.\n */\nexport function resolveReputationGatingMode(\n  env: NodeJS.ProcessEnv = process.env\n): ReputationGatingMode {\n  return resolveEnvMode(\n    env['NEXUS_REPUTATION_GATING'],\n    ReputationGatingModeSchema,\n    DEFAULT_REPUTATION_GATING_MODE,\n    'NEXUS_REPUTATION_GATING'\n  );\n}\n\n/** Outcome of applying the gating mode to a reputation assessment. */\nexport interface ReputationGateDecision {\n  /** Tier to actually enforce at the policy gate. */\n  readonly enforcedTier: TrustTier;\n  /** Tier reputation reconciliation computed (what `enforce` mode WOULD use). */\n  readonly reconciledTier: TrustTier;\n  /** True when reputation would demote but the mode (off/audit) did not enforce it. */\n  readonly demotionSuppressed: boolean;\n  readonly mode: ReputationGatingMode;\n}\n\n/**\n * Apply the rollout mode to a reputation assessment (#3122). `enforce` gates on\n * the reconciled (possibly demoted) tier; `audit`/`off` gate on the classifier\n * tier but report whether a demotion was suppressed (for telemetry). The\n * Tier-1/allowlist-wins and demotion-only invariants live in `reconcileTrustTier`,\n * so the allowlist remains the escape hatch in every mode.\n */\nexport function gateWithReputation(\n  classifierTier: TrustTier,\n  reputation: ReputationAssessment | undefined,\n  mode: ReputationGatingMode\n): ReputationGateDecision {\n  const reconciledTier =\n    mode === 'off' ? classifierTier : reconcileTrustTier(classifierTier, reputation);\n  const enforcedTier = mode === 'enforce' ? reconciledTier : classifierTier;\n  return {\n    enforcedTier,\n    reconciledTier,\n    demotionSuppressed: mode !== 'enforce' && reconciledTier !== classifierTier,\n    mode,\n  };\n}\n\n/** Build a human-readable reason string. */\nfunction buildReason(\n  role: GitHubUserRole,\n  signals: readonly SuspiciousSignal[],\n  tier: TrustTier\n): string {\n  if (signals.length === 0) {\n    return `Role ${role} → Tier ${tier} (no suspicious signals)`;\n  }\n  const signalList = signals.join(', ');\n  return `Role ${role} → Tier ${tier} (signals: ${signalList})`;\n}\n","/**\n * Shared resolver for `off`/`audit`/`enforce`-style security-mode env vars\n * (#3130). Both `resolveAccessPolicyMode` (ClawGuard, #1977) and\n * `resolveReputationGatingMode` (reputation gating, #3122) parse an enum env\n * var, coerce an invalid value to a safe default, and must NEVER throw — a\n * security layer must not fail-closed on a misconfiguration at startup.\n *\n * Previously the coercion was silent: a typo'd `enforce` (`enfroce`) degraded\n * to the default with no signal. This helper keeps the never-throw coercion but\n * emits a one-line `warn` so the misconfiguration is observable, and guarantees\n * both flags behave identically.\n *\n * @module security/env-mode\n */\n\nimport type { ZodType } from 'zod';\nimport { createLogger } from '../core/index.js';\nimport type { ILogger } from '../core/index.js';\n\nconst defaultLogger = createLogger({ component: 'env-mode' });\n\n/**\n * Resolve an enum-valued env var to one of its allowed values, coercing an\n * invalid/typo'd value rather than throwing. Unset or empty → `fallback`\n * silently (absence is normal, not a misconfiguration). A non-empty value that\n * fails to parse → `invalidFallback` (default: `fallback`) plus a `warn`, since\n * an explicit-but-invalid value is an operator error worth surfacing. Never\n * throws.\n *\n * @param raw      The raw env value (e.g. `process.env['NEXUS_X']`).\n * @param schema   Zod enum schema for the allowed values.\n * @param fallback Returned when `raw` is absent or empty.\n * @param varName  Env var name, for the warning message.\n * @param options  `logger` (injectable for tests) and `invalidFallback` (the\n *                 mode an explicit-but-invalid value lands on; defaults to\n *                 `fallback`). See the inline docs on the parameter.\n */\nexport function resolveEnvMode<T extends string>(\n  raw: string | undefined,\n  schema: ZodType<T>,\n  fallback: T,\n  varName: string,\n  options: {\n    /** Injectable for testing; defaults to the module logger. */\n    readonly logger?: ILogger;\n    /**\n     * The mode an explicit-but-UNPARSEABLE value lands on. Defaults to\n     * `fallback`, so a caller that does not pass it is byte-identical to the\n     * previous behaviour.\n     *\n     * It exists because `fallback` answers two different questions with one\n     * value: what absence means, and what a typo means. For a flag whose unset\n     * default is the permissive end those answers should differ —\n     * `NEXUS_FIREWALL_POLICY=enfroce` used to resolve to `off`, so an operator\n     * who explicitly asked for enforcement got a gate that refuses nothing\n     * (refines #3130; ratified by a 7-voter panel at the supermajority bar,\n     * 5 of 6 approvers — rationale in the changeset).\n     *\n     * Constrained deliberately: typed as the same `T` as `fallback`, so it can\n     * only select among the flag's own modes and can never introduce a fourth\n     * behaviour. It must never be MORE permissive than `fallback` — a typo may\n     * tighten the gate, never loosen it. A caller whose unset default is\n     * already the strictest mode (e.g. `NEXUS_REPUTATION_GATING`, which\n     * defaults to `enforce`) has nothing to correct and should not pass it.\n     *\n     * Declared inline rather than as an exported interface: no caller needs the\n     * name (they pass object literals), and exporting it would add a symbol\n     * with no cross-file consumer, which the #3024 gate correctly rejects.\n     */\n    readonly invalidFallback?: T;\n  } = {}\n): T {\n  const { logger = defaultLogger, invalidFallback } = options;\n  if (typeof raw !== 'string' || raw.length === 0) return fallback;\n  const parsed = schema.safeParse(raw.toLowerCase());\n  if (parsed.success) return parsed.data;\n  const applied = invalidFallback ?? fallback;\n  // Name the mode actually applied, not just \"the default\": when `applied`\n  // differs from `fallback` a log line saying \"coercing to default\" would\n  // describe a value the process did not use.\n  logger.warn(`Invalid ${varName} value — coercing to ${applied}`, {\n    raw,\n    default: fallback,\n    applied,\n  });\n  return applied;\n}\n"],"mappings":";;;;;;;AAWA,SAAS,SAAS;AAeX,IAAM,kBAAkB,EAAE,KAAK,CAAC,KAAK,KAAK,KAAK,GAAG,CAAC;AAInD,IAAM,qBAAgD;AAAA,EAC3D,KAAK;AAAA,EACL,KAAK;AAAA,EACL,KAAK;AAAA,EACL,KAAK;AACP;AASO,IAAM,uBAAuB,EAAE,KAAK;AAAA,EACzC;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF,CAAC;AAOM,IAAM,qBAAwD;AAAA,EACnE,OAAO;AAAA,EACP,YAAY;AAAA,EACZ,cAAc;AAAA,EACd,aAAa;AAAA,EACb,QAAQ;AAAA,EACR,SAAS;AACX;AASO,IAAM,sBAAsB,EAAE,KAAK;AAAA,EACxC;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF,CAAC;AAMM,IAAM,wBAAwB,EAAE,OAAO;AAAA;AAAA,EAE5C,KAAK,EAAE,OAAO,EAAE,IAAI,CAAC;AAAA;AAAA,EAErB,QAAQ,EAAE,OAAO,EAAE,IAAI,CAAC;AAAA;AAAA,EAExB,YAAY,EAAE,OAAO,EAAE,IAAI,EAAE,YAAY;AAAA;AAAA,EAEzC,QAAQ,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS;AACpC,CAAC;AAWM,IAAM,uBAAuB,EAAE,OAAO;AAAA;AAAA,EAE3C,SAAS,EAAE,OAAO;AAAA;AAAA,EAElB,gBAAgB,EAAE,OAAO,EAAE,IAAI,EAAE,YAAY;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAO7C,WAAW;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAQX,qBAAqB,EAAE,QAAQ,EAAE,SAAS;AAAA;AAAA,EAE1C,UAAU;AAAA;AAAA,EAEV,gBAAgB,EAAE,MAAM,mBAAmB;AAAA;AAAA,EAE3C,kBAAkB,EAAE,MAAM,qBAAqB;AAAA;AAAA,EAE/C,WAAW,EAAE,QAAQ,EAAE,SAAS;AAAA;AAAA,EAEhC,aAAa,EAAE,QAAQ;AAAA;AAAA,EAEvB,aAAa,EAAE,IAAI,SAAS;AAC9B,CAAC;AAUM,IAAM,wBAAwB,EAAE,OAAO;AAAA;AAAA,EAE5C,wBAAwB,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,CAAC,CAAC,EAAE,QAAQ,CAAC,CAAC;AAAA;AAAA,EAE7D,UAAU,EAAE,QAAQ,EAAE,QAAQ,IAAI;AAAA;AAAA,EAElC,gBAAgB,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,QAAQ,GAAM;AAC5D,CAAC;;;AC7HD,IAAM,yBACJ;AASF,IAAM,wBACJ;AAMF,IAAM,uBAAuB;AAW7B,IAAM,qBAA8C;AAAA,EAClD;AAAA,IACE,MAAM;AAAA,IACN,SAAS;AAAA,EACX;AAAA,EACA;AAAA,IACE,MAAM;AAAA,IACN,SAAS;AAAA,EACX;AAAA,EACA;AAAA,IACE,MAAM;AAAA,IACN,SAAS;AAAA,EACX;AAAA,EACA;AAAA,IACE,MAAM;AAAA,IACN,SAAS;AAAA,EACX;AAAA,EACA;AAAA,IACE,MAAM;AAAA,IACN,SAAS;AAAA,EACX;AAAA,EACA;AAAA,IACE,MAAM;AAAA,IACN,SAAS;AAAA,EACX;AAAA,EACA;AAAA,IACE,MAAM;AAAA,IACN,SAAS;AAAA,EACX;AAAA,EACA;AAAA,IACE,MAAM;AAAA,IACN,SAAS;AAAA,EACX;AAAA,EACA;AAAA,IACE,MAAM;AAAA,IACN,SAAS;AAAA,EACX;AAAA;AAAA;AAAA;AAAA;AAAA,EAKA;AAAA,IACE,MAAM;AAAA,IACN,SAAS;AAAA,EACX;AACF;AAiBA,IAAM,oBAAoB;AAC1B,IAAM,uBAAuB;AAE7B,SAAS,uBAAuB,SAA0B;AAIxD,aAAW,SAAS,QAAQ,SAAS,iBAAiB,GAAG;AACvD,QAAI,qBAAqB,KAAK,MAAM,CAAC,CAAC,EAAG,QAAO;AAAA,EAClD;AACA,SAAO;AACT;AAUA,IAAM,sBACJ;AAQF,IAAM,gCAAgC,IAAI;AAAA,EACxC,uCAAuC,mBAAmB;AAAA,EAC1D;AACF;AAGA,SAAS,eAAe,SAAyB;AAC/C,SACE,QAEG,QAAQ,aAAa,CAAC,QAAQ,QAAgB;AAC7C,UAAM,OAAO,OAAO,SAAS,KAAK,EAAE;AACpC,WAAO,OAAO,SAAS,IAAI,IAAI,OAAO,cAAc,IAAI,IAAI;AAAA,EAC9D,CAAC,EAEA,QAAQ,qBAAqB,CAAC,QAAQ,QAAgB;AACrD,UAAM,OAAO,OAAO,SAAS,KAAK,EAAE;AACpC,WAAO,OAAO,SAAS,IAAI,IAAI,OAAO,cAAc,IAAI,IAAI;AAAA,EAC9D,CAAC,EAEA,QAAQ,UAAU,GAAG,EACrB,QAAQ,UAAU,GAAG,EACrB,QAAQ,YAAY,GAAG,EACvB,QAAQ,YAAY,GAAG,EAEvB,QAAQ,WAAW,GAAG;AAE7B;AAMA,SAAS,0BAA0B,SAGjC;AACA,MAAI,CAAC,8BAA8B,KAAK,OAAO,GAAG;AAChD,WAAO,EAAE,SAAS,SAAS,UAAU,CAAC,EAAE;AAAA,EAC1C;AACA,QAAM,UAAU,eAAe,OAAO;AACtC,SAAO;AAAA,IACL,SAAS;AAAA,IACT,UAAU;AAAA,MACR;AAAA,QACE,KAAK;AAAA,QACL,QAAQ;AAAA,QACR,YAAY;AAAA,QACZ,QAAQ,QAAQ;AAAA,MAClB;AAAA,IACF;AAAA,EACF;AACF;AAQA,SAAS,mBAAmB,SAG1B;AACA,QAAM,WAA8B,CAAC;AACrC,MAAI,UAAU;AACd,QAAM,aAAa;AACnB,WAAS,OAAO,GAAG,OAAO,YAAY,QAAQ;AAC5C,2BAAuB,YAAY;AACnC,QAAI,CAAC,uBAAuB,KAAK,OAAO,EAAG;AAC3C,cAAU,QAAQ,QAAQ,wBAAwB,CAAC,OAAO,KAAK,KAAK,WAAmB;AACrF,eAAS,KAAK;AAAA,QACZ,KAAK,MAAM,MAAM,GAAG,EAAE,KAAK,MAAM,SAAS,KAAK,QAAQ;AAAA,QACvD,QAAQ;AAAA,QACR,YAAY;AAAA,QACZ,QAAQ,MAAM;AAAA,MAChB,CAAC;AACD,aAAO;AAAA,IACT,CAAC;AAAA,EACH;AACA,SAAO,EAAE,SAAS,SAAS;AAC7B;AAIA,SAAS,aAAa,SAGpB;AACA,QAAM,WAA8B,CAAC;AACrC,MAAI,UAAU;AACd,QAAM,aAAa;AACnB,WAAS,OAAO,GAAG,OAAO,YAAY,QAAQ;AAC5C,0BAAsB,YAAY;AAClC,QAAI,CAAC,sBAAsB,KAAK,OAAO,EAAG;AAC1C,cAAU,QAAQ,QAAQ,uBAAuB,CAAC,OAAO,KAAK,WAAmB;AAC/E,eAAS,KAAK;AAAA,QACZ,KAAK;AAAA,QACL,QAAQ;AAAA,QACR,YAAY;AAAA,QACZ,QAAQ,MAAM;AAAA,MAChB,CAAC;AACD,aAAO;AAAA,IACT,CAAC;AAAA,EACH;AACA,SAAO,EAAE,SAAS,SAAS;AAC7B;AAIA,SAAS,kBAAkB,SAGzB;AACA,QAAM,WAA8B,CAAC;AACrC,MAAI,UAAU;AAEd,QAAM,aAAa;AACnB,WAAS,OAAO,GAAG,OAAO,YAAY,QAAQ;AAC5C,yBAAqB,YAAY;AACjC,UAAM,aAAa,QAAQ;AAC3B,cAAU,QAAQ,QAAQ,sBAAsB,CAAC,OAAO,WAAmB;AACzE,YAAM,iBAAiB,iDAAiD,KAAK,KAAK;AAClF,UAAI,CAAC,eAAgB,QAAO;AAE5B,eAAS,KAAK;AAAA,QACZ,KAAK;AAAA,QACL,QAAQ;AAAA,QACR,YAAY;AAAA,QACZ,QAAQ,MAAM;AAAA,MAChB,CAAC;AACD,aAAO;AAAA,IACT,CAAC;AACD,QAAI,QAAQ,WAAW,WAAY;AAAA,EACrC;AAEA,MAAI,aAAa;AACjB,SAAO,aAAa,QAAQ,QAAQ;AAClC,UAAM,UAAU,QAAQ,QAAQ,QAAQ,UAAU;AAClD,QAAI,YAAY,GAAI;AACpB,UAAM,WAAW,QAAQ,QAAQ,OAAO,UAAU,CAAC;AACnD,QAAI,aAAa,IAAI;AACnB,eAAS,KAAK;AAAA,QACZ,KAAK;AAAA,QACL,QAAQ;AAAA,QACR,YAAY;AAAA,QACZ,QAAQ,QAAQ,SAAS;AAAA,MAC3B,CAAC;AACD,gBAAU,QAAQ,MAAM,GAAG,OAAO;AAClC;AAAA,IACF;AACA,iBAAa,WAAW;AAAA,EAC1B;AACA,SAAO,EAAE,SAAS,SAAS;AAC7B;AAGA,SAAS,wBAAwB,SAAkC;AACjE,QAAM,QAAQ,oBAAI,IAAmB;AACrC,aAAW,EAAE,MAAM,QAAQ,KAAK,oBAAoB;AAElD,YAAQ,YAAY;AACpB,QAAI,QAAQ,KAAK,OAAO,GAAG;AACzB,YAAM,IAAI,IAAI;AAAA,IAChB;AAAA,EACF;AACA,MAAI,uBAAuB,OAAO,GAAG;AACnC,UAAM,IAAI,gBAAgB;AAAA,EAC5B;AACA,SAAO,MAAM,KAAK,KAAK;AACzB;AAGA,SAAS,cAAc,UAAkC;AACvD,QAAM,QAAQ,SAAS,YAAY;AACnC,MAAI,SAAS,mBAAoB,QAAO;AACxC,SAAO;AACT;AAMA,SAAS,gBACP,UACA,gBACA,aACW;AACX,MAAI,YAAa,QAAO;AAMxB,QAAM,iBAAiB,cAAc,QAAQ;AAC7C,QAAM,WAAW,mBAAmB,cAAc;AAGlD,QAAM,eAAgC,CAAC,8BAA8B,mBAAmB;AACxF,MAAI,eAAe,KAAK,CAAC,MAAM,aAAa,SAAS,CAAC,CAAC,EAAG,QAAO;AAGjE,MACE,eAAe,SAAS,iBAAiB,KACzC,mBAAmB,WACnB,mBAAmB,cACnB;AACA,WAAO;AAAA,EACT;AAEA,SAAO;AACT;AAkCO,SAAS,cACd,SACA,UACA,UACA,QACgB;AAChB,QAAM,MAAM,sBAAsB,MAAM,UAAU,CAAC,CAAC;AACpD,QAAM,mBAAmB,QAAQ,MAAM,GAAG,IAAI,cAAc;AAC5D,QAAM,YAAY,iBAAiB,SAAS,QAAQ;AACpD,QAAM,cAAc,IAAI,uBAAuB,SAAS,QAAQ;AAEhE,MAAI;AAEF,UAAM,gBAAgB,0BAA0B,gBAAgB;AAChE,UAAM,OAAO,mBAAmB,cAAc,OAAO;AACrD,UAAM,MAAM,aAAa,KAAK,OAAO;AACrC,UAAM,WAAW,kBAAkB,IAAI,OAAO;AAC9C,UAAM,cAAc;AAAA,MAClB,GAAG,cAAc;AAAA,MACjB,GAAG,KAAK;AAAA,MACR,GAAG,IAAI;AAAA,MACP,GAAG,SAAS;AAAA,IACd;AAGA,UAAM,iBAAiB,wBAAwB,gBAAgB;AAG/D,UAAM,YAAY,gBAAgB,UAAU,gBAAgB,WAAW;AAEvE,WAAO;AAAA,MACL,SAAS,SAAS;AAAA,MAClB,gBAAgB,QAAQ;AAAA,MACxB;AAAA,MACA,qBAAqB;AAAA,MACrB;AAAA,MACA;AAAA,MACA,kBAAkB;AAAA,MAClB;AAAA,MACA,aAAa,aAAa,YAAY,SAAS;AAAA,MAC/C,cAAa,oBAAI,KAAK,GAAE,YAAY;AAAA,IACtC;AAAA,EACF,SAAS,KAAc;AACrB,WAAO,sBAAsB,KAAK,SAAS,kBAAkB,UAAU,WAAW;AAAA,EACpF;AACF;AASA,SAAS,sBACP,KACA,iBACA,WACA,UACA,aACgB;AAChB,QAAM,UAAU,eAAe,QAAQ,IAAI,UAAU,OAAO,GAAG;AAC/D,SAAO;AAAA,IACL,SAAS;AAAA,IACT,gBAAgB,gBAAgB;AAAA,IAChC,WAAW,cAAc,MAAM;AAAA,IAC/B,qBAAqB;AAAA,IACrB;AAAA,IACA,gBAAgB,CAAC;AAAA,IACjB,kBAAkB;AAAA,MAChB;AAAA,QACE,KAAK;AAAA,QACL,QAAQ,6DAA6D,OAAO;AAAA,QAC5E,YAAY;AAAA,QACZ,QAAQ,UAAU;AAAA,MACpB;AAAA,IACF;AAAA,IACA,WAAW,UAAU,SAAS,gBAAgB;AAAA,IAC9C,aAAa;AAAA,IACb,cAAa,oBAAI,KAAK,GAAE,YAAY;AAAA,EACtC;AACF;;;ACpdA,SAAS,KAAAA,UAAS;;;ACQlB,IAAM,gBAAgB,aAAa,EAAE,WAAW,WAAW,CAAC;AAkBrD,SAAS,eACd,KACA,QACA,UACA,SACA,UA4BI,CAAC,GACF;AACH,QAAM,EAAE,SAAS,eAAe,gBAAgB,IAAI;AACpD,MAAI,OAAO,QAAQ,YAAY,IAAI,WAAW,EAAG,QAAO;AACxD,QAAM,SAAS,OAAO,UAAU,IAAI,YAAY,CAAC;AACjD,MAAI,OAAO,QAAS,QAAO,OAAO;AAClC,QAAM,UAAU,mBAAmB;AAInC,SAAO,KAAK,WAAW,OAAO,6BAAwB,OAAO,IAAI;AAAA,IAC/D;AAAA,IACA,SAAS;AAAA,IACT;AAAA,EACF,CAAC;AACD,SAAO;AACT;;;AD7DO,IAAM,yBAAyBC,GAAE,KAAK;AAAA,EAC3C;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF,CAAC;AA+CD,IAAM,uBAAuB;AAE7B,IAAM,wBAAwB;AAAA;AAAA,EAE5B,gBAAgB;AAAA;AAAA,EAEhB,kBAAkB;AAAA;AAAA,EAElB,uBAAuB;AAAA;AAAA,EAEvB,2BAA2B;AAC7B;AAcA,IAAM,iBAAyB,eAAe;AAC9C,IAAM,mBAAmB;AAOlB,IAAM,kBAAN,MAAsB;AAAA,EACV,QAAQ,oBAAI,IAAwB;AAAA,EACpC;AAAA,EACA;AAAA,EAEjB,YAAY,QAAQ,gBAAgB,UAAU,kBAAkB;AAC9D,SAAK,QAAQ;AACb,SAAK,UAAU;AAAA,EACjB;AAAA,EAEA,IAAI,UAAoD;AACtD,UAAM,QAAQ,KAAK,MAAM,IAAI,QAAQ;AACrC,QAAI,UAAU,OAAW,QAAO;AAChC,QAAI,gBAAgB,EAAE,IAAI,IAAI,MAAM,WAAW;AAC7C,WAAK,MAAM,OAAO,QAAQ;AAC1B,aAAO;AAAA,IACT;AACA,WAAO,MAAM;AAAA,EACf;AAAA,EAEA,IAAI,UAAkB,YAAwC;AAC5D,QAAI,KAAK,MAAM,QAAQ,KAAK,WAAW,CAAC,KAAK,MAAM,IAAI,QAAQ,GAAG;AAChE,WAAK,YAAY;AAAA,IACnB;AACA,SAAK,MAAM,IAAI,UAAU;AAAA,MACvB;AAAA,MACA,WAAW,gBAAgB,EAAE,IAAI,IAAI,KAAK;AAAA,IAC5C,CAAC;AAAA,EACH;AAAA;AAAA,EAGQ,cAAoB;AAC1B,UAAM,YAAY,KAAK,IAAI,GAAG,KAAK,MAAM,KAAK,UAAU,GAAG,CAAC;AAC5D,UAAM,OAAO,KAAK,MAAM,KAAK;AAC7B,aAAS,IAAI,GAAG,IAAI,WAAW,KAAK;AAClC,YAAM,OAAO,KAAK,KAAK;AACvB,UAAI,KAAK,SAAS,KAAM;AACxB,WAAK,MAAM,OAAO,KAAK,KAAK;AAAA,IAC9B;AAAA,EACF;AAAA,EAEA,QAAc;AACZ,SAAK,MAAM,MAAM;AAAA,EACnB;AAAA,EAEA,IAAI,OAAe;AACjB,WAAO,KAAK,MAAM;AAAA,EACpB;AACF;AAQA,IAAM,0BAAoD;AAAA,EACxD;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF;AAEA,SAAS,oBAAoB,OAA0C;AACrE,SAAO,MAAM,KAAK,CAAC,MAAM,wBAAwB,SAAS,CAAC,CAAC;AAC9D;AAGA,SAAS,kBAAkB,GAAgC;AACzD,SACE,EAAE,uBAAuB,UACzB,EAAE,+BAA+B,UACjC,EAAE,qBAAqB,sBAAsB,yBAC7C,EAAE,8BAA8B,sBAAsB;AAE1D;AAGA,SAAS,sBAAsB,GAAgC;AAC7D,MAAI,CAAC,EAAE,eAAe,SAAS,iBAAiB,EAAG,QAAO;AAC1D,QAAM,cAAc,EAAE,kBAAkB,YAAY;AACpD,SAAO,gBAAgB,WAAW,gBAAgB;AACpD;AAIA,SAAS,wBAAwB,UAAkD;AACjF,QAAM,UAA8B,CAAC;AACrC,QAAM,EAAE,gBAAgB,mBAAmB,IAAI;AAE/C,MAAI,mBAAmB,UAAa,iBAAiB,sBAAsB,gBAAgB;AACzF,YAAQ,KAAK,aAAa;AAAA,EAC5B;AACA,MACE,uBAAuB,UACvB,qBAAqB,sBAAsB,kBAC3C;AACA,YAAQ,KAAK,wBAAwB;AAAA,EACvC;AACA,MAAI,oBAAoB,SAAS,cAAc,EAAG,SAAQ,KAAK,6BAA6B;AAC5F,MAAI,kBAAkB,QAAQ,EAAG,SAAQ,KAAK,gBAAgB;AAC9D,MAAI,sBAAsB,QAAQ,EAAG,SAAQ,KAAK,4BAA4B;AAE9E,SAAO;AACT;AAGA,SAAS,yBACP,UACA,SACA,UACQ;AACR,MAAI,QAAQ;AAGZ,QAAM,YAA4C;AAAA,IAChD,OAAO;AAAA,IACP,YAAY;AAAA,IACZ,cAAc;AAAA,IACd,aAAa;AAAA,IACb,QAAQ;AAAA,IACR,SAAS;AAAA,EACX;AACA,WAAS,UAAU,QAAQ;AAI3B,MAAI,SAAS,mBAAmB,QAAW;AACzC,aAAS,KAAK,IAAI,SAAS,iBAAiB,sBAAsB,EAAE;AAAA,EACtE;AAGA,MAAI,SAAS,uBAAuB,QAAW;AAC7C,aAAS,KAAK,IAAI,SAAS,oBAAoB,EAAE;AAAA,EACnD;AAGA,QAAM,gBAAkD;AAAA,IACtD,aAAa;AAAA,IACb,wBAAwB;AAAA,IACxB,6BAA6B;AAAA,IAC7B,gBAAgB;AAAA,IAChB,4BAA4B;AAAA,EAC9B;AACA,aAAW,UAAU,SAAS;AAC5B,aAAS,cAAc,MAAM;AAAA,EAC/B;AAEA,SAAO,KAAK,IAAI,GAAG,KAAK,IAAI,KAAK,KAAK,MAAM,KAAK,CAAC,CAAC;AACrD;AAGA,SAAS,QAAQ,aAAqC;AACpD,UAAQ,YAAY,YAAY,GAAG;AAAA,IACjC,KAAK;AACH,aAAO;AAAA,IACT,KAAK;AACH,aAAO;AAAA,IACT,KAAK;AACH,aAAO;AAAA,IACT,KAAK;AACH,aAAO;AAAA,IACT;AACE,aAAO;AAAA,EACX;AACF;AAGA,SAAS,uBACP,UACA,SACW;AACX,QAAM,WAAW,mBAAmB,QAAQ;AAG5C,QAAM,iBAAqC;AAAA,IACzC;AAAA,IACA;AAAA,EACF;AACA,MAAI,QAAQ,KAAK,CAAC,MAAM,eAAe,SAAS,CAAC,CAAC,EAAG,QAAO;AAiB5D,MAAI,QAAQ,UAAU,GAAG;AACvB,UAAM,cAAc,mBAAmB,QAAQ;AAC/C,UAAM,aAAa,KAAK,IAAI,cAAc,GAAG,CAAC;AAC9C,WAAO,OAAO,UAAU;AAAA,EAC1B;AAEA,SAAO;AACT;AAaO,SAAS,iBACd,UACA,OACsB;AAEtB,QAAM,SAAS,OAAO,IAAI,SAAS,QAAQ;AAC3C,MAAI,WAAW,OAAW,QAAO;AAEjC,QAAM,WAAW,QAAQ,SAAS,iBAAiB;AACnD,QAAM,UAAU,wBAAwB,QAAQ;AAChD,QAAM,QAAQ,yBAAyB,UAAU,SAAS,QAAQ;AAClE,QAAM,gBAAgB,uBAAuB,UAAU,OAAO;AAE9D,QAAM,aAAmC;AAAA,IACvC,UAAU,SAAS;AAAA,IACnB;AAAA,IACA,UAAU;AAAA,MACR,UACE,SAAS,uBAAuB,UAChC,SAAS,uBAAuB,UAChC,SAAS,+BAA+B,SACpC,aACA;AAAA,IACR;AAAA,IACA,mBAAmB;AAAA,IACnB,cAAc,QAAQ,SAAS;AAAA,IAC/B,oBAAoB;AAAA,IACpB,iBAAiB;AAAA,IACjB,QAAQ,YAAY,UAAU,SAAS,aAAa;AAAA,IACpD,aAAY,oBAAI,KAAK,GAAE,YAAY;AAAA,EACrC;AAEA,SAAO,IAAI,SAAS,UAAU,UAAU;AACxC,SAAO;AACT;AAgBO,SAAS,mBACd,gBACA,YACW;AACX,MAAI,mBAAmB,IAAK,QAAO;AACnC,QAAM,UAAU,YAAY;AAC5B,MAAI,YAAY,OAAW,QAAO;AAClC,SAAO,mBAAmB,OAAO,IAAI,mBAAmB,cAAc,IAClE,UACA;AACN;AAcO,IAAM,6BAA6BA,GAAE,KAAK,CAAC,OAAO,SAAS,SAAS,CAAC;AAqBrE,IAAM,iCAAuD;AAO7D,SAAS,4BACd,MAAyB,QAAQ,KACX;AACtB,SAAO;AAAA,IACL,IAAI,yBAAyB;AAAA,IAC7B;AAAA,IACA;AAAA,IACA;AAAA,EACF;AACF;AAoBO,SAAS,mBACd,gBACA,YACA,MACwB;AACxB,QAAM,iBACJ,SAAS,QAAQ,iBAAiB,mBAAmB,gBAAgB,UAAU;AACjF,QAAM,eAAe,SAAS,YAAY,iBAAiB;AAC3D,SAAO;AAAA,IACL;AAAA,IACA;AAAA,IACA,oBAAoB,SAAS,aAAa,mBAAmB;AAAA,IAC7D;AAAA,EACF;AACF;AAGA,SAAS,YACP,MACA,SACA,MACQ;AACR,MAAI,QAAQ,WAAW,GAAG;AACxB,WAAO,QAAQ,IAAI,gBAAW,IAAI;AAAA,EACpC;AACA,QAAM,aAAa,QAAQ,KAAK,IAAI;AACpC,SAAO,QAAQ,IAAI,gBAAW,IAAI,cAAc,UAAU;AAC5D;","names":["z","z"]}

package/dist/{chunk-R2VSXNGB.js → chunk-4U555SVX.js}

@@ -12,7 +12,7 @@ import {
   resolveEnvMode,
   resolveReputationGatingMode,
   sanitizeInput
-} from "./chunk-RJO6I6JV.js";
+} from "./chunk-2T2MSN7B.js";
 import {
   MAX_STRIPPED_ELEMENTS_PER_EVENT,
   createAuditTrail,
@@ -20,7 +20,7 @@ import {
   emitReputationEvent,
   emitSanitizationEvent,
   emitTrustEvent
-} from "./chunk-IVGQWADP.js";
+} from "./chunk-I4EHDJTI.js";
 import {
   hasToken
 } from "./chunk-JYMFL4M6.js";
@@ -155,6 +155,7 @@ function mapSanitization(e) {
     metadata: {
       source: e.source,
       wasModified: e.wasModified,
+      ...e.truncated !== void 0 ? { truncated: e.truncated } : {},
       strippedCount: e.strippedCount,
       injectionFlagCount: e.injectionFlagCount,
       strippedElements: e.strippedElements
@@ -419,6 +420,7 @@ function createPassthroughSanitized(meta) {
     userRole,
     injectionFlags: [],
     strippedElements: [],
+    truncated: false,
     wasModified: false,
     sanitizedAt: (/* @__PURE__ */ new Date()).toISOString()
   };
@@ -1146,6 +1148,7 @@ var HostileInputFirewall = class {
       emitSanitizationEvent(this.auditTrail, {
         source: meta.sourceType,
         wasModified: result.wasModified,
+        ...result.truncated !== void 0 ? { truncated: result.truncated } : {},
         strippedCount: result.strippedElements.length,
         injectionFlagCount: result.injectionFlags.length,
         strippedElements: result.strippedElements.slice(0, MAX_STRIPPED_ELEMENTS_PER_EVENT).map((e) => ({ tag: e.tag, reason: e.reason }))
@@ -1682,6 +1685,35 @@ function extractLabelsFromBody(title, body) {
   }
   return labels.slice(0, 5);
 }
+function mapIssueComments(comments) {
+  return comments.map((comment) => ({
+    id: comment.id,
+    body: comment.body,
+    author: comment.author,
+    authorAssociation: comment.authorAssociation,
+    createdAt: comment.createdAt
+  }));
+}
+function describeAction(action) {
+  switch (action.type) {
+    case "ClassifyIssue":
+      return `Classified as ${action.category} (${String(Math.round(action.confidence * 100))}% confidence)`;
+    case "ProposeLabels":
+      return `Suggest labels: ${action.labels.join(", ")}`;
+    case "SummarizeIssue":
+      return action.summary.slice(0, 100);
+    default:
+      return `${action.type} action`;
+  }
+}
+function buildActionDetails(action, policy, corrob) {
+  return {
+    policyViolations: policy.violations.map((violation) => violation.rule),
+    missingCorroboration: corrob.missing,
+    ...action.type === "ClassifyIssue" && { category: action.category },
+    ...action.type === "ProposeLabels" && { labels: action.labels }
+  };
+}
 
 // src/dogfooding/issue-triage.ts
 var logger5 = createLogger({ component: "IssueTriage" });
@@ -1736,10 +1768,10 @@ var IssueTriage = class {
     const { owner, repo, issueNumber } = parseResult.value;
     const fetchResult = await this.fetchIssueData(owner, repo, issueNumber);
     if (!fetchResult.ok) return fetchResult;
-    const { issue: issueResult, comments, accountAgeDays } = fetchResult.value;
+    const { issue: issueResult } = fetchResult.value;
     const safeTitle = this.sanitizeContent(issueResult.title, issueResult.author);
     const safeBody = this.sanitizeContent(issueResult.body, issueResult.author);
-    const reputation = this.assessAuthorReputation(issueResult, comments, accountAgeDays);
+    const reputation = this.assessAuthorReputation(fetchResult.value);
     const firewall = this.classifyAuthor(issueResult, reputation);
     if (!firewall.ok) return firewall;
     const trustResult = firewall.value.trust;
@@ -1839,21 +1871,24 @@ var IssueTriage = class {
    * This is one of the two NEW security module wirings completing #828.
    * (Source: Issue #828 — reputation-model wiring)
    */
-  assessAuthorReputation(issue, comments, accountAgeDays) {
+  assessAuthorReputation(data) {
     if (!this.config.enableReputation) return void 0;
+    const { issue, comments, commentsAvailable, accountAgeDays } = data;
     const bodyScan = sanitizeInput(issue.body, "unknown", issue.author);
     const titleScan = sanitizeInput(issue.title, "unknown", issue.author);
     const injectionFlags = [.../* @__PURE__ */ new Set([...titleScan.injectionFlags, ...bodyScan.injectionFlags])];
     const metadata = {
       username: issue.author,
       ...accountAgeDays !== void 0 ? { accountAgeDays } : {},
-      priorContributions: countAuthorComments(issue.author, comments),
-      recentCommentCount: countRecentComments(issue.author, comments),
-      recentCommentWindowMinutes: 10,
+      ...commentsAvailable ? {
+        priorContributions: countAuthorComments(issue.author, comments),
+        recentCommentCount: countRecentComments(issue.author, comments),
+        recentCommentWindowMinutes: 10
+      } : {},
       authorAssociation: issue.authorAssociation,
       injectionFlags
     };
-    return assessReputation(metadata, this.reputationCache);
+    return assessReputation(metadata, commentsAvailable ? this.reputationCache : void 0);
   }
   /**
    * Generates typed agent actions based on issue analysis.
@@ -1941,6 +1976,7 @@ var IssueTriage = class {
       ...isAllowlisted !== void 0 ? { isAllowlisted } : {},
       auditSink,
       reputationScore: reputation?.reputationScore,
+      coverage: reputation?.coverage,
       suspiciousSignals: isTier1 ? [] : reputation?.suspiciousSignals ?? [],
       isSuspicious: isTier1 ? false : reputation?.isSuspicious ?? false,
       // #3122: surface both the enforced tier (what the gate used) and the
@@ -1994,16 +2030,17 @@ var IssueTriage = class {
       createdAt: detail.createdAt
     };
     const commentsResult = await provider.listCommentDetails(issueNumber);
-    const comments = commentsResult.ok ? commentsResult.value.map((c) => ({
-      id: c.id,
-      body: c.body,
-      author: c.author,
-      authorAssociation: c.authorAssociation,
-      createdAt: c.createdAt
-    })) : [];
+    if (!commentsResult.ok) {
+      logger5.warn("Failed to fetch issue comments; activity reputation is unmeasured", {
+        issueNumber,
+        error: commentsResult.error.message
+      });
+    }
+    const comments = commentsResult.ok ? mapIssueComments(commentsResult.value) : [];
+    const commentsAvailable = commentsResult.ok;
     const accountAgeDays = await this.fetchAccountAgeDays(provider, detail.author);
     return ok(
-      accountAgeDays !== void 0 ? { issue, comments, accountAgeDays } : { issue, comments }
+      accountAgeDays !== void 0 ? { issue, comments, commentsAvailable, accountAgeDays } : { issue, comments, commentsAvailable }
     );
   }
   /**
@@ -2024,34 +2061,14 @@ var IssueTriage = class {
   }
 };
 function countAuthorComments(author, comments) {
-  return comments.filter((c) => c.author === author).length;
+  return comments.filter((comment) => comment.author === author).length;
 }
 function countRecentComments(author, comments) {
   const tenMinutesAgo = Date.now() - 10 * 60 * 1e3;
   return comments.filter(
-    (c) => c.author === author && new Date(c.createdAt).getTime() > tenMinutesAgo
+    (comment) => comment.author === author && new Date(comment.createdAt).getTime() > tenMinutesAgo
   ).length;
 }
-function describeAction(action) {
-  switch (action.type) {
-    case "ClassifyIssue":
-      return `Classified as ${action.category} (${String(Math.round(action.confidence * 100))}% confidence)`;
-    case "ProposeLabels":
-      return `Suggest labels: ${action.labels.join(", ")}`;
-    case "SummarizeIssue":
-      return action.summary.slice(0, 100);
-    default:
-      return `${action.type} action`;
-  }
-}
-function buildActionDetails(action, policy, corrob) {
-  return {
-    policyViolations: policy.violations.map((v) => v.rule),
-    missingCorroboration: corrob.missing,
-    ...action.type === "ClassifyIssue" && { category: action.category },
-    ...action.type === "ProposeLabels" && { labels: action.labels }
-  };
-}
 function createIssueTriage(config) {
   return new IssueTriage(config);
 }
@@ -2093,4 +2110,4 @@ export {
   IssueTriage,
   createIssueTriage
 };
-//# sourceMappingURL=chunk-R2VSXNGB.js.map
+//# sourceMappingURL=chunk-4U555SVX.js.map