open-multi-agent-kit 0.80.6 → 0.80.7

package/dist/core/policy-overlays-runtime.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"policy-overlays-runtime.js","sourceRoot":"","sources":["../../src/core/policy-overlays-runtime.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAQpC,OAAO,EAAE,iBAAiB,EAAE,MAAM,0BAA0B,CAAC;AA0H7D,8EAA8E;AAC9E,gCAAgC;AAChC,8EAA8E;AAE9E,MAAM,SAAS,GAA2C;IACzD,QAAQ,EAAE,CAAC;IACX,OAAO,EAAE,CAAC;IACV,IAAI,EAAE,CAAC;CACP,CAAC;AAEF,MAAM,UAAU,0BAA0B,CACzC,MAAuC,EACvC,OAAmC,EAClB;IACjB,IAAI,MAAM,KAAK,SAAS,IAAI,MAAM,CAAC,UAAU,KAAK,IAAI,EAAE,CAAC;QACxD,IAAI,OAAO,CAAC,IAAI,KAAK,YAAY,EAAE,CAAC;YACnC,OAAO;gBACN,IAAI,EAAE,MAAM;gBACZ,IAAI,EAAE,oBAAoB;gBAC1B,MAAM,EAAE,4CAA4C;aACpD,CAAC;QACH,CAAC;IACF,CAAC;IACD,IAAI,OAAO,CAAC,GAAG,CAAC,OAAO,KAAK,IAAI,EAAE,CAAC;QAClC,OAAO;YACN,IAAI,EAAE,MAAM;YACZ,IAAI,EAAE,gBAAgB;YACtB,MAAM,EAAE,8CAA8C;SACtD,CAAC;IACH,CAAC;IACD,IAAI,OAAO,CAAC,IAAI,KAAK,YAAY,EAAE,CAAC;QACnC,OAAO;YACN,IAAI,EAAE,MAAM;YACZ,IAAI,EAAE,mBAAmB;YACzB,MAAM,EAAE,wCAAwC;SAChD,CAAC;IACH,CAAC;IACD,IAAI,MAAM,EAAE,WAAW,KAAK,SAAS,IAAI,SAAS,CAAC,OAAO,CAAC,WAAW,CAAC,GAAG,SAAS,CAAC,MAAM,CAAC,WAAW,CAAC,EAAE,CAAC;QACzG,OAAO;YACN,IAAI,EAAE,MAAM;YACZ,IAAI,EAAE,sBAAsB;YAC5B,MAAM,EAAE,wCAAwC;SAChD,CAAC;IACH,CAAC;IACD,OAAO;QACN,IAAI,EAAE,OAAO;QACb,IAAI,EAAE,gBAAgB;QACtB,MAAM,EAAE,4CAA4C;KACpD,CAAC;AAAA,CACF;AAED,8EAA8E;AAC9E,8BAA8B;AAC9B,8EAA8E;AAE9E,MAAM,kBAAkB,GAAG,iCAAiC,CAAC;AAC7D,MAAM,gBAAgB,GAAG,4DAA4D,CAAC;AAEtF,SAAS,QAAQ,CAAC,KAAqB,EAAE,QAA2B,EAAkB;IACrF,IAAI,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QACjD,OAAO,KAAK,CAAC;IACd,CAAC;IACD,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QAC1B,OAAO,KAAK,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,QAAQ,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAC,CAAC;IACxD,CAAC;IACD,MAAM,MAAM,GAAoB,EAAE,CAAC;IACnC,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QAClD,IAAI,QAAQ,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC;YACnD,SAAS;QACV,CAAC;QACD,MAAM,CAAC,GAAG,CAAC,GAAG,QAAQ,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAC;IACzC,CAAC;IACD,OAAO,MAAM,CAAC;AAAA,CACd;AAED,MAAM,UAAU,uBAAuB,CACtC,MAAuC,EACvC,IAAqB,EACH;IAClB,MAAM,QAAQ,GAAa,EAAE,CAAC;IAC9B,IAAI,MAAM,EAAE,aAAa,KAAK,IAAI,EAAE,CAAC;QACpC,QAAQ,CAAC,IAAI,CAAC,kBAAkB,CAAC,CAAC;IACnC,CAAC;IACD,IAAI,MAAM,EAAE,iBAAiB,KAAK,IAAI,EAAE,CAAC;QACxC,QAAQ,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAC;IACjC,CAAC;IACD,MAAM,IAAI,GAAG,iBAAiB,CAAC,IAAI,CAAC,CAAC;IACrC,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC3B,OAAO,IAAI,CAAC;IACb,CAAC;IACD,OAAO,QAAQ,CAAC,IAAI,EAAE,QAAQ,CAAoB,CAAC;AAAA,CACnD;AAED,8EAA8E;AAC9E,iDAAiD;AACjD,8EAA8E;AAE9E,MAAM,eAAe,GAAG,YAAY,CAAC;AACrC,MAAM,sBAAsB,GAAG,mBAAmB,CAAC;AACnD,MAAM,wBAAwB,GAAG,8BAA0B,CAAC;AAC5D,MAAM,0BAA0B,GAAG,CAAC,CAAC;AACrC,MAAM,sBAAsB,GAAG,EAAE,CAAC;AAClC,MAAM,sBAAsB,GAAG,EAAE,CAAC;AAClC,MAAM,sBAAsB,GAAG,KAAK,CAAC;AACrC,MAAM,yBAAyB,GAAG,KAAK,CAAC;AACxC,MAAM,oBAAoB,GAAG,MAAM,CAAC,sBAAsB,CAAC,CAAC;AAC5D,MAAM,2BAA2B,GAAG,oCAAoC,CAAC;AACzE,MAAM,aAAa,GAAG,+BAA+B,CAAC;AACtD,MAAM,4BAA4B,GACjC,mIAAmI,CAAC;AACrI,MAAM,uBAAuB,GAAG,4EAA4E,CAAC;AAC7G,MAAM,mBAAmB,GAAG,yEAAyE,CAAC;AACtG,MAAM,uBAAuB,GAAG,+EAA+E,CAAC;AAChH,MAAM,cAAc,GAAG,mCAAmC,CAAC;AAC3D,MAAM,WAAW,GAAG,iEAAiE,CAAC;AACtF,MAAM,sBAAsB,GAAG,2CAA2C,CAAC;AAC3E,MAAM,qBAAqB,GAC1B,4FAA4F,CAAC;AAC9F,MAAM,sBAAsB,GAAG,uBAAuB,CAAC;AACvD,MAAM,6BAA6B,GAClC,+GAA+G,CAAC;AACjH,MAAM,wBAAwB,GAC7B,0OAA0O,CAAC;AAC5O,MAAM,aAAa,GAAG,6CAA6C,CAAC;AACpE,MAAM,aAAa,GAAG,4BAA4B,CAAC;AACnD,MAAM,WAAW,GAAG,wBAAwB,CAAC;AAC7C,MAAM,mBAAmB,GAAG,0BAA0B,CAAC;AACvD,MAAM,iBAAiB,GAAG,+BAA+B,CAAC;AAC1D,MAAM,4BAA4B,GAAG,yEAAyE,CAAC;AAW/G,SAAS,UAAU,CAAC,KAAa,EAAU;IAC1C,OAAO,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AAAA,CACxD;AAED,SAAS,mBAAmB,CAAC,KAAqB,EAAU;IAC3D,IAAI,KAAK,KAAK,IAAI;QAAE,OAAO,MAAM,CAAC;IAClC,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,OAAO,KAAK,KAAK,SAAS,EAAE,CAAC;QAC1F,OAAO,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;IAC9B,CAAC;IACD,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QAC1B,OAAO,IAAI,KAAK,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,mBAAmB,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC;IAC1E,CAAC;IACD,OAAO,IAAI,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC;SAC3B,IAAI,EAAE;SACN,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,IAAI,mBAAmB,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,IAAI,CAAC,EAAE,CAAC;SACjF,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC;AAAA,CACf;AAED,SAAS,yBAAyB,CAAC,aAAa,GAAG,CAAC,EAA2B;IAC9E,OAAO;QACN,SAAS,EAAE,KAAK;QAChB,MAAM,EAAE,KAAK;QACb,UAAU,EAAE,EAAE;QACd,cAAc,EAAE,CAAC;QACjB,aAAa;QACb,SAAS,EAAE,CAAC;QACZ,MAAM,EAAE,UAAU,CAAC,MAAM,CAAC;KAC1B,CAAC;AAAA,CACF;AAED,SAAS,mBAAmB,CAAC,KAA4B,EAAE,QAAiC,EAAE,KAAK,GAAG,CAAC,EAAQ;IAC9G,KAAK,CAAC,UAAU,CAAC,QAAQ,CAAC,GAAG,CAAC,KAAK,CAAC,UAAU,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,GAAG,KAAK,CAAC;IACvE,KAAK,CAAC,cAAc,IAAI,KAAK,CAAC;AAAA,CAC9B;AAED,SAAS,mBAAmB,CAAC,KAAc,EAAU;IACpD,IAAI,CAAC;QACJ,MAAM,UAAU,GAAG,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;QACzC,OAAO,UAAU,EAAE,MAAM,IAAI,MAAM,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC;IACnD,CAAC;IAAC,MAAM,CAAC;QACR,OAAO,MAAM,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC;IAC7B,CAAC;AAAA,CACD;AAED,SAAS,iBAAiB,CAAC,KAAa,EAAE,QAAgB,EAAwC;IACjG,MAAM,MAAM,GAAG,MAAM,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IACjF,IAAI,MAAM,IAAI,CAAC;QAAE,OAAO,EAAE,IAAI,EAAE,EAAE,EAAE,SAAS,EAAE,KAAK,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;IAClE,IAAI,KAAK,CAAC,MAAM,IAAI,MAAM;QAAE,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC;IACrE,MAAM,MAAM,GAAG,wBAAwB,CAAC,MAAM,GAAG,MAAM,CAAC,CAAC,CAAC,wBAAwB,CAAC,CAAC,CAAC,MAAM,IAAI,CAAC,CAAC,CAAC,CAAC,KAAG,CAAC,CAAC,CAAC,EAAE,CAAC;IAC5G,MAAM,aAAa,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC;IAC1D,MAAM,UAAU,GAAG,IAAI,CAAC,KAAK,CAAC,aAAa,GAAG,CAAC,CAAC,CAAC;IACjD,MAAM,UAAU,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,aAAa,GAAG,UAAU,CAAC,CAAC;IAC3D,OAAO;QACN,IAAI,EAAE,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,UAAU,CAAC,GAAG,MAAM,GAAG,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,KAAK,CAAC,MAAM,GAAG,UAAU,CAAC,CAAC,EAAE;QACpG,SAAS,EAAE,IAAI;KACf,CAAC;AAAA,CACF;AAED,SAAS,kBAAkB,CAAC,KAAa,EAAE,KAA4B,EAAE,QAAgB,EAAU;IAClG,IAAI,QAAQ,GAAG,KAAK,CAAC;IACrB,QAAQ,GAAG,QAAQ,CAAC,OAAO,CAAC,mBAAmB,EAAE,GAAG,EAAE,CAAC;QACtD,KAAK,CAAC,iBAAiB,GAAG,IAAI,CAAC;QAC/B,mBAAmB,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAC;QACrC,OAAO,eAAe,CAAC;IAAA,CACvB,CAAC,CAAC;IACH,QAAQ,GAAG,QAAQ,CAAC,OAAO,CAAC,uBAAuB,EAAE,GAAG,EAAE,CAAC;QAC1D,KAAK,CAAC,iBAAiB,GAAG,IAAI,CAAC;QAC/B,mBAAmB,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAC;QACrC,OAAO,eAAe,CAAC;IAAA,CACvB,CAAC,CAAC;IACH,QAAQ,GAAG,QAAQ,CAAC,OAAO,CAAC,6BAA6B,EAAE,CAAC,MAAc,EAAE,MAAc,EAAE,UAAkB,EAAE,EAAE,CAAC;QAClH,mBAAmB,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAC;QACrC,OAAO,GAAG,MAAM,GAAG,UAAU,GAAG,eAAe,EAAE,CAAC;IAAA,CAClD,CAAC,CAAC;IACH,QAAQ,GAAG,QAAQ,CAAC,OAAO,CAAC,cAAc,EAAE,GAAG,EAAE,CAAC;QACjD,mBAAmB,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;QACnC,OAAO,UAAU,eAAe,EAAE,CAAC;IAAA,CACnC,CAAC,CAAC;IACH,QAAQ,GAAG,QAAQ,CAAC,OAAO,CAAC,WAAW,EAAE,GAAG,EAAE,CAAC;QAC9C,mBAAmB,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;QACnC,OAAO,eAAe,CAAC;IAAA,CACvB,CAAC,CAAC;IACH,QAAQ,GAAG,QAAQ,CAAC,OAAO,CAAC,sBAAsB,EAAE,GAAG,EAAE,CAAC;QACzD,mBAAmB,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAC;QACrC,OAAO,eAAe,CAAC;IAAA,CACvB,CAAC,CAAC;IACH,QAAQ,GAAG,QAAQ,CAAC,OAAO,CAAC,qBAAqB,EAAE,GAAG,EAAE,CAAC;QACxD,mBAAmB,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAC;QACrC,OAAO,eAAe,CAAC;IAAA,CACvB,CAAC,CAAC;IACH,QAAQ,GAAG,QAAQ,CAAC,OAAO,CAAC,sBAAsB,EAAE,GAAG,EAAE,CAAC;QACzD,mBAAmB,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAC;QACrC,OAAO,eAAe,CAAC;IAAA,CACvB,CAAC,CAAC;IACH,QAAQ,GAAG,QAAQ,CAAC,OAAO,CAC1B,wBAAwB,EACxB,CACC,KAAa,EACb,MAAc,EACd,UAAkB,EAClB,YAAgC,EAChC,YAAgC,EAChC,IAAwB,EACvB,EAAE,CAAC;QACJ,MAAM,KAAK,GAAG,YAAY,IAAI,YAAY,IAAI,IAAI,IAAI,EAAE,CAAC;QACzD,IAAI,KAAK,CAAC,QAAQ,CAAC,eAAe,CAAC,IAAI,KAAK,CAAC,QAAQ,CAAC,WAAW,CAAC;YAAE,OAAO,KAAK,CAAC;QACjF,mBAAmB,CAAC,KAAK,EAAE,uBAAuB,CAAC,UAAU,CAAC,CAAC,CAAC;QAChE,IAAI,YAAY,KAAK,SAAS;YAAE,OAAO,GAAG,MAAM,GAAG,UAAU,IAAI,eAAe,GAAG,CAAC;QACpF,IAAI,YAAY,KAAK,SAAS;YAAE,OAAO,GAAG,MAAM,GAAG,UAAU,IAAI,eAAe,GAAG,CAAC;QACpF,OAAO,GAAG,MAAM,GAAG,UAAU,GAAG,eAAe,EAAE,CAAC;IAAA,CAClD,CACD,CAAC;IACF,QAAQ,GAAG,QAAQ,CAAC,OAAO,CAAC,aAAa,EAAE,GAAG,EAAE,CAAC;QAChD,mBAAmB,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;QAClC,OAAO,eAAe,CAAC;IAAA,CACvB,CAAC,CAAC;IACH,QAAQ,GAAG,QAAQ,CAAC,OAAO,CAAC,WAAW,EAAE,GAAG,EAAE,CAAC;QAC9C,mBAAmB,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;QAClC,OAAO,eAAe,CAAC;IAAA,CACvB,CAAC,CAAC;IACH,QAAQ,GAAG,QAAQ,CAAC,OAAO,CAAC,mBAAmB,EAAE,GAAG,EAAE,CAAC;QACtD,mBAAmB,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;QAClC,OAAO,eAAe,CAAC;IAAA,CACvB,CAAC,CAAC;IACH,QAAQ,GAAG,QAAQ,CAAC,OAAO,CAAC,aAAa,EAAE,GAAG,EAAE,CAAC;QAChD,mBAAmB,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;QAClC,OAAO,eAAe,CAAC;IAAA,CACvB,CAAC,CAAC;IACH,QAAQ,GAAG,QAAQ,CAAC,OAAO,CAAC,iBAAiB,EAAE,GAAG,EAAE,CAAC;QACpD,mBAAmB,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;QACnC,OAAO,GAAG,CAAC;IAAA,CACX,CAAC,CAAC;IACH,QAAQ,GAAG,QAAQ,CAAC,OAAO,CAAC,4BAA4B,EAAE,GAAG,EAAE,CAAC;QAC/D,mBAAmB,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAC;QACrC,OAAO,eAAe,CAAC;IAAA,CACvB,CAAC,CAAC;IACH,MAAM,OAAO,GAAG,iBAAiB,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC;IACtD,IAAI,OAAO,CAAC,SAAS;QAAE,KAAK,CAAC,SAAS,GAAG,IAAI,CAAC;IAC9C,OAAO,OAAO,CAAC,IAAI,CAAC;AAAA,CACpB;AAED,SAAS,4BAA4B,CAAC,MAAyB,EAAW;IACzE,OAAO,MAAM,KAAK,eAAe,CAAC;AAAA,CAClC;AAED,SAAS,uBAAuB,CAAC,GAAW,EAA2B;IACtE,OAAO,uBAAuB,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,QAAQ,CAAC;AAAA,CAC7D;AAED,SAAS,aAAa,CAAC,KAAa,EAAoC;IACvE,OAAO,MAAM,CAAC,cAAc,CAAC,KAAK,CAAC,KAAK,MAAM,CAAC,SAAS,IAAI,MAAM,CAAC,cAAc,CAAC,KAAK,CAAC,KAAK,IAAI,CAAC;AAAA,CAClG;AAED,SAAS,mBAAmB,CAC3B,KAAc,EACd,OAAyB,EACzB,KAA4B,EAC5B,KAAa,EACb,IAAqB,EACE;IACvB,IAAI,KAAK,KAAK,IAAI;QAAE,OAAO,IAAI,CAAC;IAChC,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,kBAAkB,CAAC,KAAK,EAAE,KAAK,EAAE,OAAO,CAAC,QAAQ,CAAC,CAAC;IACzF,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IACrF,IAAI,OAAO,KAAK,KAAK,SAAS;QAAE,OAAO,KAAK,CAAC;IAC7C,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,KAAK,CAAC,QAAQ,EAAE,CAAC;IACvD,IAAI,OAAO,KAAK,KAAK,WAAW;QAAE,OAAO,EAAE,CAAC;IAC5C,IAAI,OAAO,KAAK,KAAK,UAAU,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,MAAM,CAAC,KAAK,CAAC,CAAC;IACnF,IAAI,KAAK,IAAI,0BAA0B;QAAE,OAAO,aAAa,CAAC;IAE9D,IAAI,KAAK,YAAY,WAAW,IAAI,WAAW,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC;QAC/D,mBAAmB,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAC;QACrC,OAAO,sBAAsB,CAAC;IAC/B,CAAC;IACD,IAAI,KAAK,YAAY,IAAI;QAAE,OAAO,KAAK,CAAC,WAAW,EAAE,CAAC;IACtD,IAAI,KAAK,YAAY,KAAK,EAAE,CAAC;QAC5B,OAAO;YACN,IAAI,EAAE,kBAAkB,CAAC,KAAK,CAAC,IAAI,EAAE,KAAK,EAAE,OAAO,CAAC,QAAQ,CAAC;YAC7D,OAAO,EAAE,kBAAkB,CAAC,KAAK,CAAC,OAAO,EAAE,KAAK,EAAE,OAAO,CAAC,QAAQ,CAAC;SACnE,CAAC;IACH,CAAC;IACD,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QAC1B,OAAO,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,sBAAsB,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC;YAC5D,MAAM,SAAS,GAAG,mBAAmB,CAAC,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,GAAG,CAAC,EAAE,IAAI,CAAC,CAAC;YAC9E,OAAO,SAAS,KAAK,oBAAoB,CAAC,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC,SAAS,CAAC;QAAA,CACxE,CAAC,CAAC;IACJ,CAAC;IACD,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QAC/B,IAAI,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC;YAAE,OAAO,YAAY,CAAC;QACzC,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;QAChB,MAAM,OAAO,GAAG,aAAa,CAAC,KAAK,CAAC;YACnC,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC;YACvB,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,sBAAsB,CAAC,CAAC;QAC1D,MAAM,MAAM,GAAoB,EAAE,CAAC;QACnC,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,sBAAsB,CAAC,EAAE,CAAC;YACrE,IAAI,4BAA4B,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;gBAC5C,IAAI,kBAAkB,CAAC,IAAI,CAAC,GAAG,CAAC;oBAAE,KAAK,CAAC,iBAAiB,GAAG,IAAI,CAAC;gBACjE,mBAAmB,CAAC,KAAK,EAAE,uBAAuB,CAAC,GAAG,CAAC,CAAC,CAAC;gBACzD,MAAM,CAAC,GAAG,CAAC,GAAG,eAAe,CAAC;gBAC9B,SAAS;YACV,CAAC;YACD,IAAI,4BAA4B,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,OAAO,CAAC,WAAW,KAAK,UAAU,EAAE,CAAC;gBACxF,IAAI,kBAAkB,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;oBAClC,mBAAmB,CAAC,KAAK,EAAE,WAAW,CAAC,CAAC;oBACxC,SAAS;gBACV,CAAC;gBACD,IAAI,gBAAgB,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;oBAChC,mBAAmB,CAAC,KAAK,EAAE,SAAS,CAAC,CAAC;oBACtC,SAAS;gBACV,CAAC;YACF,CAAC;YACD,MAAM,SAAS,GAAG,mBAAmB,CAAC,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,GAAG,CAAC,EAAE,IAAI,CAAC,CAAC;YAC9E,IAAI,SAAS,KAAK,oBAAoB;gBAAE,MAAM,CAAC,GAAG,CAAC,GAAG,SAAS,CAAC;QACjE,CAAC;QACD,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QACnB,OAAO,MAAM,CAAC;IACf,CAAC;IACD,OAAO,MAAM,CAAC,KAAK,CAAC,CAAC;AAAA,CACrB;AAED,SAAS,qBAAqB,CAAC,KAAqB,EAAE,QAAgB,EAAE,KAA4B,EAAkB;IACrH,MAAM,SAAS,GAAG,mBAAmB,CAAC,KAAK,CAAC,CAAC;IAC7C,IAAI,SAAS,CAAC,MAAM,IAAI,QAAQ;QAAE,OAAO,KAAK,CAAC;IAC/C,MAAM,OAAO,GAAG,iBAAiB,CAAC,SAAS,EAAE,QAAQ,CAAC,CAAC;IACvD,IAAI,OAAO,CAAC,SAAS;QAAE,KAAK,CAAC,SAAS,GAAG,IAAI,CAAC;IAC9C,OAAO,OAAO,CAAC,IAAI,CAAC;AAAA,CACpB;AAED,SAAS,oBAAoB,CAAC,KAAqB,EAAW;IAC7D,IAAI,KAAK,KAAK,IAAI;QAAE,OAAO,IAAI,CAAC;IAChC,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,KAAK,CAAC,IAAI,EAAE,CAAC,MAAM,KAAK,CAAC,CAAC;IAChE,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC,MAAM,KAAK,CAAC,CAAC;IACpD,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,MAAM,KAAK,CAAC,CAAC;IACtE,OAAO,KAAK,CAAC;AAAA,CACb;AAED,SAAS,mBAAmB,CAC3B,OAAuB,EACvB,OAAyB,EACzB,KAA4B,EACP;IACrB,IAAI,KAAK,CAAC,iBAAiB;QAAE,OAAO,8BAA8B,CAAC;IACnE,MAAM,cAAc,GAAG,CAAC,KAAK,CAAC,UAAU,CAAC,MAAM,IAAI,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,UAAU,CAAC,IAAI,IAAI,CAAC,CAAC,CAAC;IACrF,IAAI,cAAc,IAAI,CAAC,IAAI,cAAc,GAAG,CAAC,IAAI,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,KAAK,CAAC,cAAc,CAAC,EAAE,CAAC;QACpF,OAAO,sCAAsC,CAAC;IAC/C,CAAC;IACD,IAAI,OAAO,CAAC,WAAW,KAAK,UAAU,IAAI,oBAAoB,CAAC,OAAO,CAAC;QAAE,OAAO,gCAAgC,CAAC;IACjH,OAAO,SAAS,CAAC;AAAA,CACjB;AAED,MAAM,UAAU,qBAAqB,CAAC,OAAgB,EAAE,OAAyB,EAAyB;IACzG,MAAM,aAAa,GAAG,mBAAmB,CAAC,OAAO,CAAC,CAAC;IACnD,MAAM,KAAK,GAA0B;QACpC,UAAU,EAAE,EAAE;QACd,cAAc,EAAE,CAAC;QACjB,iBAAiB,EAAE,KAAK;QACxB,SAAS,EAAE,KAAK;KAChB,CAAC;IACF,MAAM,cAAc,GAAG,mBAAmB,CAAC,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC,EAAE,IAAI,OAAO,EAAU,CAAC,CAAC;IAC9F,MAAM,gBAAgB,GAAG,cAAc,KAAK,oBAAoB,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,cAAc,CAAC;IACzF,MAAM,cAAc,GAAG,qBAAqB,CAAC,gBAAgB,EAAE,OAAO,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC;IACxF,MAAM,gBAAgB,GAAG,mBAAmB,CAAC,cAAc,CAAC,CAAC;IAC7D,MAAM,MAAM,GAAG,mBAAmB,CAAC,cAAc,EAAE,OAAO,EAAE,KAAK,CAAC,CAAC;IACnE,OAAO;QACN,OAAO,EAAE,cAAc;QACvB,QAAQ,EAAE;YACT,SAAS,EAAE,KAAK,CAAC,cAAc,GAAG,CAAC,IAAI,KAAK,CAAC,SAAS;YACtD,MAAM,EAAE,MAAM,KAAK,SAAS;YAC5B,UAAU,EAAE,KAAK,CAAC,UAAU;YAC5B,cAAc,EAAE,KAAK,CAAC,cAAc;YACpC,aAAa;YACb,SAAS,EAAE,gBAAgB,CAAC,MAAM;YAClC,MAAM,EAAE,UAAU,CAAC,gBAAgB,CAAC;SACpC;QACD,MAAM;KACN,CAAC;AAAA,CACF;AAED,SAAS,oBAAoB,CAAC,IAAY,EAAU;IACnD,OAAO,UAAU,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;AAAA,CAClE;AAED,SAAS,4BAA4B,CAAC,IAAY,EAAU;IAC3D,MAAM,UAAU,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;IACrD,IAAI,UAAU,CAAC,MAAM,GAAG,CAAC,IAAI,UAAU,CAAC,QAAQ,CAAC,GAAG,CAAC;QAAE,OAAO,UAAU,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;IAC7F,OAAO,UAAU,CAAC;AAAA,CAClB;AAED,SAAS,2BAA2B,CAAC,WAAmB,EAAE,GAAW,EAAW;IAC/E,MAAM,IAAI,GAAG,4BAA4B,CAAC,WAAW,CAAC,CAAC;IACvD,MAAM,OAAO,GAAG,4BAA4B,CAAC,GAAG,CAAC,CAAC;IAClD,OAAO,OAAO,KAAK,IAAI,IAAI,OAAO,CAAC,UAAU,CAAC,GAAG,IAAI,GAAG,CAAC,CAAC;AAAA,CAC1D;AAED,SAAS,wBAAwB,CAChC,OAA4B,EAC5B,OAA+B,EACoC;IACnE,IAAI,OAAO,CAAC,WAAW,KAAK,SAAS;QAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,WAAW,EAAE,OAAO,CAAC,GAAG,EAAE,CAAC;IAC1F,IAAI,2BAA2B,CAAC,OAAO,CAAC,WAAW,EAAE,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;QACnE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,WAAW,EAAE,OAAO,CAAC,WAAW,EAAE,CAAC;IAC5D,CAAC;IACD,OAAO;QACN,IAAI,EAAE,MAAM;QACZ,IAAI,EAAE,wCAAwC;QAC9C,MAAM,EAAE,kEAAkE;KAC1E,CAAC;AAAA,CACF;AAED,SAAS,0BAA0B,CAAC,IAAY,EAAE,KAAa,EAAuC;IACrG,IAAI,2BAA2B,CAAC,IAAI,CAAC,KAAK,CAAC;QAAE,OAAO,SAAS,CAAC;IAC9D,OAAO;QACN,IAAI,EAAE,MAAM;QACZ,IAAI,EAAE,oCAAoC;QAC1C,MAAM,EAAE,GAAG,IAAI,6CAA6C;KAC5D,CAAC;AAAA,CACF;AAED,SAAS,oBAAoB,CAAC,KAAyB,EAA+D;IACrH,IAAI,KAAK,KAAK,SAAS;QAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC;IAClD,MAAM,UAAU,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IAC9C,IACC,UAAU,CAAC,MAAM,KAAK,CAAC;QACvB,UAAU,CAAC,QAAQ,CAAC,IAAI,CAAC;QACzB,UAAU,CAAC,UAAU,CAAC,GAAG,CAAC;QAC1B,UAAU,CAAC,QAAQ,CAAC,IAAI,CAAC;QACzB,qBAAqB,CAAC,IAAI,CAAC,UAAU,CAAC;QACtC,iBAAiB,CAAC,IAAI,CAAC,UAAU,CAAC;QAClC,CAAC,aAAa,CAAC,IAAI,CAAC,UAAU,CAAC,EAC9B,CAAC;QACF,OAAO;YACN,IAAI,EAAE,MAAM;YACZ,IAAI,EAAE,gCAAgC;YACtC,MAAM,EAAE,uDAAuD;SAC/D,CAAC;IACH,CAAC;IACD,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,UAAU,EAAE,CAAC;AAAA,CAC5C;AAED,SAAS,wBAAwB,CAAC,OAAiB,EAA2B;IAC7E,OAAO;QACN,IAAI,EAAE,OAAO;QACb,IAAI,EAAE,kCAAkC;QACxC,MAAM,EAAE,+CAA+C;QACvD,OAAO;KACP,CAAC;AAAA,CACF;AAED,SAAS,iBAAiB,CAAC,SAAiB,EAAE,KAAyB,EAAU;IAChF,OAAO,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,GAAG,SAAS,IAAI,KAAK,EAAE,CAAC;AAAA,CACjE;AAED,MAAM,UAAU,qBAAqB,CACpC,OAA4B,EAC5B,OAA+B,EACL;IAC1B,MAAM,KAAK,GAAG,oBAAoB,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;IAClD,IAAI,KAAK,CAAC,IAAI,KAAK,OAAO;QAAE,OAAO,KAAK,CAAC;IACzC,MAAM,WAAW,GAAG,wBAAwB,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;IAC/D,IAAI,CAAC,CAAC,aAAa,IAAI,WAAW,CAAC;QAAE,OAAO,WAAW,CAAC;IACxD,MAAM,WAAW,GAAG,oBAAoB,CAAC,WAAW,CAAC,WAAW,CAAC,CAAC;IAClE,MAAM,gBAAgB,GAAG,eAAe,WAAW,EAAE,CAAC;IACtD,IAAI,OAAO,CAAC,KAAK,KAAK,SAAS;QAC9B,OAAO;YACN,IAAI,EAAE,OAAO;YACb,IAAI,EAAE,0BAA0B;YAChC,MAAM,EAAE,4BAA4B;YACpC,SAAS,EAAE,iBAAiB,CAAC,gBAAgB,EAAE,KAAK,CAAC,KAAK,CAAC;YAC3D,KAAK,EAAE,KAAK,CAAC,KAAK;SAClB,CAAC;IAEH,IAAI,OAAO,CAAC,KAAK,KAAK,SAAS,EAAE,CAAC;QACjC,MAAM,SAAS,GAAG,OAAO,CAAC,SAAS,IAAI,OAAO,CAAC,SAAS,CAAC;QACzD,IAAI,SAAS,KAAK,SAAS;YAAE,OAAO,wBAAwB,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC;QAC5E,MAAM,OAAO,GAAG,0BAA0B,CAAC,WAAW,EAAE,SAAS,CAAC,CAAC;QACnE,IAAI,OAAO;YAAE,OAAO,OAAO,CAAC;QAC5B,OAAO;YACN,IAAI,EAAE,OAAO;YACb,IAAI,EAAE,0BAA0B;YAChC,MAAM,EAAE,4BAA4B;YACpC,SAAS,EAAE,iBAAiB,CAAC,GAAG,gBAAgB,YAAY,SAAS,EAAE,EAAE,KAAK,CAAC,KAAK,CAAC;YACrF,KAAK,EAAE,KAAK,CAAC,KAAK;SAClB,CAAC;IACH,CAAC;IAED,IAAI,OAAO,CAAC,KAAK,KAAK,MAAM,EAAE,CAAC;QAC9B,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,IAAI,OAAO,CAAC,MAAM,CAAC;QAChD,IAAI,MAAM,KAAK,SAAS;YAAE,OAAO,wBAAwB,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC;QACtE,MAAM,OAAO,GAAG,0BAA0B,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;QAC7D,IAAI,OAAO;YAAE,OAAO,OAAO,CAAC;QAC5B,OAAO;YACN,IAAI,EAAE,OAAO;YACb,IAAI,EAAE,uBAAuB;YAC7B,MAAM,EAAE,yBAAyB;YACjC,SAAS,EAAE,iBAAiB,CAAC,GAAG,gBAAgB,SAAS,MAAM,EAAE,EAAE,KAAK,CAAC,KAAK,CAAC;YAC/E,KAAK,EAAE,KAAK,CAAC,KAAK;SAClB,CAAC;IACH,CAAC;IAED,IAAI,OAAO,CAAC,KAAK,KAAK,MAAM,EAAE,CAAC;QAC9B,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,IAAI,OAAO,CAAC,MAAM,CAAC;QAChD,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,IAAI,OAAO,CAAC,MAAM,CAAC;QAChD,IAAI,MAAM,KAAK,SAAS,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;YAClD,MAAM,OAAO,GAAG;gBACf,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,SAAS;gBAC3C,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,SAAS;aAC3C,CAAC,MAAM,CAAC,CAAC,KAAK,EAAmB,EAAE,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC;YAC1D,OAAO,wBAAwB,CAAC,OAAO,CAAC,CAAC;QAC1C,CAAC;QACD,MAAM,WAAW,GAAG,0BAA0B,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;QACjE,IAAI,WAAW;YAAE,OAAO,WAAW,CAAC;QACpC,MAAM,WAAW,GAAG,0BAA0B,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;QACjE,IAAI,WAAW;YAAE,OAAO,WAAW,CAAC;QACpC,OAAO;YACN,IAAI,EAAE,OAAO;YACb,IAAI,EAAE,uBAAuB;YAC7B,MAAM,EAAE,yBAAyB;YACjC,SAAS,EAAE,iBAAiB,CAAC,GAAG,gBAAgB,SAAS,MAAM,SAAS,MAAM,EAAE,EAAE,KAAK,CAAC,KAAK,CAAC;YAC9F,KAAK,EAAE,KAAK,CAAC,KAAK;SAClB,CAAC;IACH,CAAC;IAED,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IAC9B,IAAI,MAAM,KAAK,SAAS;QAAE,OAAO,wBAAwB,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC;IACtE,OAAO;QACN,IAAI,EAAE,OAAO;QACb,IAAI,EAAE,uBAAuB;QAC7B,MAAM,EAAE,yBAAyB;QACjC,SAAS,EAAE,iBAAiB,CAAC,YAAY,UAAU,CAAC,MAAM,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,EAAE,EAAE,KAAK,CAAC,KAAK,CAAC;QACxF,KAAK,EAAE,KAAK,CAAC,KAAK;KAClB,CAAC;AAAA,CACF;AAED,SAAS,aAAa,CAAC,SAA8B,EAAW;IAC/D,OAAO,SAAS,KAAK,MAAM,IAAI,SAAS,KAAK,iBAAiB,IAAI,SAAS,KAAK,cAAc,CAAC;AAAA,CAC/F;AAED,SAAS,cAAc,CAAC,SAA8B,EAAW;IAChE,OAAO,SAAS,KAAK,iBAAiB,IAAI,SAAS,KAAK,cAAc,CAAC;AAAA,CACvE;AAED,SAAS,oBAAoB,CAC5B,OAAkC,EAClC,OAA4B,EAC5B,OAAwC,EAClB;IACtB,OAAO;QACN,GAAG,EAAE,OAAO,EAAE,GAAG,IAAI,OAAO,CAAC,GAAG,EAAE;QAClC,SAAS,EAAE,OAAO,EAAE,SAAS;QAC7B,MAAM,EAAE,OAAO,EAAE,MAAM;QACvB,MAAM,EAAE,OAAO,EAAE,MAAM;QACvB,MAAM,EAAE,OAAO,EAAE,MAAM;QACvB,aAAa,EACZ,OAAO,EAAE,aAAa,IAAI,CAAC,OAAO,EAAE,WAAW,KAAK,QAAQ,IAAI,OAAO,CAAC,IAAI,KAAK,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC;QAC3G,OAAO,EAAE,OAAO,EAAE,OAAO;KACzB,CAAC;AAAA,CACF;AAED,SAAS,UAAU,CAAC,IAAY,EAAE,MAAc,EAAE,QAAQ,GAAG,yBAAyB,EAAE,EAAwB;IAC/G,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC;AAAA,CAChD;AAED,SAAS,WAAW,CACnB,IAAY,EACZ,MAAc,EACd,OAAiB,EACjB,QAAQ,GAAG,yBAAyB,EAAE,EACf;IACvB,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,QAAQ,EAAE,CAAC;AAAA,CAC1D;AAED,SAAS,yBAAyB,CACjC,QAA6D,EACtC;IACvB,IAAI,QAAQ,CAAC,IAAI,KAAK,MAAM;QAAE,OAAO,UAAU,CAAC,QAAQ,CAAC,IAAI,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAC;IAChF,OAAO,WAAW,CAAC,QAAQ,CAAC,IAAI,EAAE,QAAQ,CAAC,MAAM,EAAE,QAAQ,CAAC,OAAO,CAAC,CAAC;AAAA,CACrE;AAED,SAAS,oBAAoB,CAAC,OAA4B,EAAY;IACrE,OAAO;QACN,OAAO,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,SAAS;QACnD,OAAO,CAAC,WAAW,KAAK,SAAS,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,SAAS;KAC7D,CAAC,MAAM,CAAC,CAAC,KAAK,EAAmB,EAAE,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC;AAAA,CAC1D;AAED,SAAS,cAAc,CAAC,KAAkB,EAAU;IACnD,OAAO,KAAK,KAAK,aAAa,CAAC,CAAC,CAAC,yBAAyB,CAAC,CAAC,CAAC,sBAAsB,CAAC;AAAA,CACpF;AAED,MAAM,UAAU,mBAAmB,CAClC,OAAkC,EAClC,OAA4B,EAC5B,OAA6B,EACN;IACvB,MAAM,gBAAgB,GAAG,oBAAoB,CAAC,OAAO,EAAE,OAAO,EAAE,OAAO,CAAC,CAAC;IACzE,MAAM,iBAAiB,GAAG,qBAAqB,CAAC,gBAAgB,EAAE,OAAO,CAAC,SAAS,IAAI,EAAE,KAAK,EAAE,SAAS,EAAE,CAAC,CAAC;IAC7G,IAAI,iBAAiB,CAAC,IAAI,KAAK,OAAO;QAAE,OAAO,yBAAyB,CAAC,iBAAiB,CAAC,CAAC;IAE5F,IAAI,OAAO,CAAC,IAAI,KAAK,MAAM,EAAE,CAAC;QAC7B,IAAI,CAAC,aAAa,CAAC,gBAAgB,CAAC,aAAa,CAAC,EAAE,CAAC;YACpD,OAAO,UAAU,CAAC,yBAAyB,EAAE,6CAA6C,CAAC,CAAC;QAC7F,CAAC;QACD,OAAO;YACN,IAAI,EAAE,OAAO;YACb,IAAI,EAAE,qBAAqB;YAC3B,MAAM,EAAE,wBAAwB;YAChC,SAAS,EAAE,iBAAiB,CAAC,SAAS;YACtC,QAAQ,EAAE,yBAAyB,EAAE;SACrC,CAAC;IACH,CAAC;IAED,IAAI,OAAO,CAAC,KAAK,KAAK,aAAa,IAAI,OAAO,CAAC,WAAW,KAAK,KAAK,EAAE,CAAC;QACtE,OAAO,UAAU,CAAC,+BAA+B,EAAE,kDAAkD,CAAC,CAAC;IACxG,CAAC;IACD,IAAI,OAAO,EAAE,WAAW,KAAK,QAAQ,EAAE,CAAC;QACvC,OAAO,UAAU,CAAC,0BAA0B,EAAE,+CAA+C,CAAC,CAAC;IAChG,CAAC;IACD,IAAI,OAAO,CAAC,YAAY,KAAK,IAAI,EAAE,CAAC;QACnC,OAAO,UAAU,CAAC,sBAAsB,EAAE,8CAA8C,CAAC,CAAC;IAC3F,CAAC;IACD,IAAI,CAAC,cAAc,CAAC,gBAAgB,CAAC,aAAa,CAAC,EAAE,CAAC;QACrD,OAAO,UAAU,CAAC,yBAAyB,EAAE,uDAAuD,CAAC,CAAC;IACvG,CAAC;IACD,IAAI,OAAO,CAAC,IAAI,KAAK,QAAQ,IAAI,OAAO,CAAC,WAAW,KAAK,IAAI,EAAE,CAAC;QAC/D,OAAO,UAAU,CAAC,kBAAkB,EAAE,yDAAyD,CAAC,CAAC;IAClG,CAAC;IACD,IAAI,gBAAgB,CAAC,OAAO,KAAK,IAAI,IAAI,OAAO,CAAC,KAAK,KAAK,aAAa,EAAE,CAAC;QAC1E,OAAO,WAAW,CAAC,4BAA4B,EAAE,gDAAgD,EAAE,CAAC,QAAQ,CAAC,CAAC,CAAC;IAChH,CAAC;IACD,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IAC9B,MAAM,WAAW,GAAG,OAAO,CAAC,WAAW,CAAC;IACxC,IAAI,MAAM,KAAK,SAAS,IAAI,WAAW,KAAK,SAAS,EAAE,CAAC;QACvD,MAAM,OAAO,GAAG,oBAAoB,CAAC,OAAO,CAAC,CAAC;QAC9C,OAAO,WAAW,CAAC,gCAAgC,EAAE,gDAAgD,EAAE,OAAO,CAAC,CAAC;IACjH,CAAC;IACD,IAAI,OAAO,CAAC,SAAS,EAAE,KAAK,KAAK,MAAM,EAAE,CAAC;QACzC,IAAI,gBAAgB,CAAC,aAAa,KAAK,cAAc,IAAI,MAAM,KAAK,eAAe,EAAE,CAAC;YACrF,OAAO,UAAU,CAChB,gCAAgC,EAChC,8DAA8D,CAC9D,CAAC;QACH,CAAC;IACF,CAAC;IACD,IAAI,WAAW,KAAK,KAAK,EAAE,CAAC;QAC3B,IACC,OAAO,CAAC,KAAK,KAAK,QAAQ;YAC1B,MAAM,KAAK,eAAe;YAC1B,gBAAgB,CAAC,aAAa,KAAK,cAAc,EAChD,CAAC;YACF,OAAO,UAAU,CAChB,mBAAmB,EACnB,wEAAwE,CACxE,CAAC;QACH,CAAC;IACF,CAAC;IAED,MAAM,SAAS,GAAG,qBAAqB,CAAC,OAAO,CAAC,OAAO,IAAI,IAAI,EAAE;QAChE,MAAM;QACN,WAAW;QACX,QAAQ,EAAE,cAAc,CAAC,OAAO,CAAC,KAAK,CAAC;QACvC,QAAQ,EAAE,OAAO,CAAC,KAAK,KAAK,aAAa;KACzC,CAAC,CAAC;IACH,IAAI,SAAS,CAAC,QAAQ,CAAC,MAAM,EAAE,CAAC;QAC/B,OAAO,UAAU,CAChB,SAAS,CAAC,MAAM,IAAI,yBAAyB,EAC7C,8CAA8C,EAC9C,SAAS,CAAC,QAAQ,CAClB,CAAC;IACH,CAAC;IACD,IAAI,WAAW,KAAK,KAAK,IAAI,SAAS,CAAC,QAAQ,CAAC,cAAc,GAAG,CAAC,EAAE,CAAC;QACpE,OAAO,UAAU,CAChB,6BAA6B,EAC7B,iDAAiD,EACjD,SAAS,CAAC,QAAQ,CAClB,CAAC;IACH,CAAC;IACD,OAAO;QACN,IAAI,EAAE,OAAO;QACb,IAAI,EAAE,OAAO,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,yBAAyB,CAAC,CAAC,CAAC,wBAAwB;QACtF,MAAM,EAAE,8CAA8C;QACtD,SAAS,EAAE,iBAAiB,CAAC,SAAS;QACtC,gBAAgB,EAAE,SAAS,CAAC,OAAO;QACnC,QAAQ,EAAE,SAAS,CAAC,QAAQ;KAC5B,CAAC;AAAA,CACF;AAED,8EAA8E;AAC9E,+CAA+C;AAC/C,8EAA8E;AAE9E,MAAM,UAAU,+BAA+B,CAC9C,OAAkC,EAClC,OAA8B,EACb;IACjB,IAAI,OAAO,CAAC,MAAM,KAAK,SAAS,IAAI,OAAO,CAAC,MAAM,KAAK,UAAU,EAAE,CAAC;QACnE,OAAO;YACN,IAAI,EAAE,OAAO;YACb,IAAI,EAAE,oBAAoB;YAC1B,MAAM,EAAE,iCAAiC;SACzC,CAAC;IACH,CAAC;IACD,MAAM,WAAW,GAAG,OAAO,EAAE,WAAW,CAAC;IACzC,MAAM,gBAAgB,GACrB,OAAO,EAAE,YAAY,KAAK,aAAa,IAAI,WAAW,KAAK,SAAS,IAAI,WAAW,KAAK,SAAS,CAAC;IACnG,IAAI,CAAC,gBAAgB,EAAE,CAAC;QACvB,OAAO;YACN,IAAI,EAAE,MAAM;YACZ,IAAI,EAAE,yBAAyB;YAC/B,MAAM,EAAE,yDAAyD;SACjE,CAAC;IACH,CAAC;IACD,IAAI,OAAO,CAAC,YAAY,KAAK,OAAO,IAAI,OAAO,CAAC,YAAY,KAAK,OAAO,EAAE,CAAC;QAC1E,OAAO;YACN,IAAI,EAAE,MAAM;YACZ,IAAI,EAAE,yBAAyB;YAC/B,MAAM,EAAE,yCAAyC;SACjD,CAAC;IACH,CAAC;IACD,OAAO;QACN,IAAI,EAAE,OAAO;QACb,IAAI,EAAE,sBAAsB;QAC5B,MAAM,EAAE,4CAA4C;KACpD,CAAC;AAAA,CACF;AAED,8EAA8E;AAC9E,0BAA0B;AAC1B,8EAA8E;AAE9E,SAAS,kBAAkB,CAAC,IAAY,EAAU;IACjD,OAAO,IAAI,CAAC,OAAO,CAAC,2BAA2B,EAAE,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;AAAA,CAC5D;AAMD,MAAM,UAAU,mBAAmB,CAAC,OAA2B,EAA6B;IAC3F,IAAI,OAAO,CAAC,MAAM,KAAK,oBAAoB,EAAE,CAAC;QAC7C,OAAO,EAAE,aAAa,EAAE,KAAK,EAAE,OAAO,EAAE,kBAAkB,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;IAC5E,CAAC;IACD,OAAO,EAAE,aAAa,EAAE,IAAI,EAAE,MAAM,EAAE,eAAe,EAAE,CAAC;AAAA,CACxD;AAED,8EAA8E;AAC9E,uCAAuC;AACvC,8EAA8E;AAE9E,MAAM,UAAU,yBAAyB,CACxC,OAAkC,EAClC,OAA8B,EACb;IACjB,IAAI,OAAO,EAAE,WAAW,KAAK,YAAY,EAAE,CAAC;QAC3C,OAAO;YACN,IAAI,EAAE,MAAM;YACZ,IAAI,EAAE,6BAA6B;YACnC,MAAM,EAAE,oDAAoD;SAC5D,CAAC;IACH,CAAC;IACD,IAAI,OAAO,CAAC,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAClC,OAAO;YACN,IAAI,EAAE,OAAO;YACb,IAAI,EAAE,0BAA0B;YAChC,MAAM,EAAE,yCAAyC;YACjD,cAAc,EAAE,0BAA0B;SAC1C,CAAC;IACH,CAAC;IACD,IAAI,OAAO,CAAC,YAAY,KAAK,WAAW,EAAE,CAAC;QAC1C,OAAO;YACN,IAAI,EAAE,OAAO;YACb,IAAI,EAAE,0BAA0B;YAChC,MAAM,EAAE,kDAAkD;YAC1D,cAAc,EAAE,0BAA0B;SAC1C,CAAC;IACH,CAAC;IACD,OAAO;QACN,IAAI,EAAE,OAAO;QACb,IAAI,EAAE,yBAAyB;QAC/B,MAAM,EAAE,sCAAsC;KAC9C,CAAC;AAAA,CACF","sourcesContent":["import { createHash } from \"node:crypto\";\nimport { resolve } from \"node:path\";\nimport type {\n\tTraceContentTier,\n\tTraceEnvironment,\n\tTraceJsonObject,\n\tTraceJsonValue,\n\tTraceSink,\n} from \"./observability-trace.ts\";\nimport { sanitizeTraceData } from \"./observability-trace.ts\";\nimport type { DeferredReason, ExportPolicyOverlay, PolicyOverlay } from \"./package-procurement.ts\";\n\n// ---------------------------------------------------------------------------\n// Shared types\n// ---------------------------------------------------------------------------\n\nexport type PolicyDomain = \"observability\" | \"memory\" | \"advisor\" | \"simplify\" | \"todo\" | \"cache-optimizer\";\n\nexport type PolicyDecision =\n\t| { kind: \"allow\"; rule: string; reason: string }\n\t| { kind: \"deny\"; rule: string; reason: string }\n\t| { kind: \"defer\"; rule: string; reason: string; deferredReason: DeferredReason };\n\nexport type PolicyTraceContentTier = TraceContentTier | \"full\";\n\nexport interface ObservabilityExportRequest {\n\tsink: TraceSink;\n\tcontentTier: PolicyTraceContentTier;\n\tenv: TraceEnvironment;\n\tdata: TraceJsonObject;\n}\n\nexport type MemoryStore = \"memory\" | \"supermemory\";\nexport type MemoryOperation = \"read\" | \"write\" | \"replay\";\nexport type MemoryWriteSource =\n\t| \"user-explicit\"\n\t| \"compaction-summary\"\n\t| \"branch-summary\"\n\t| \"session-digest\"\n\t| \"harness-control\"\n\t| \"extension\";\nexport type MemoryContentTier = \"metadata\" | \"summary\" | \"evidence\" | \"raw\";\nexport type MemoryLaneAuthority = \"none\" | \"read\" | \"write-sanitized\" | \"write-global\";\nexport type MemoryNamespaceScope = \"project\" | \"session\" | \"goal\" | \"lane\" | \"user\";\nexport type MemorySanitizerCategory = \"secret\" | \"auth\" | \"pii\" | \"path\" | \"rawTool\" | \"rawPrompt\" | \"binary\";\n\nexport interface MemoryNamespaceRequest {\n\tscope: MemoryNamespaceScope;\n\tprojectRoot?: string;\n\tsessionId?: string;\n\tgoalId?: string;\n\tlaneId?: string;\n\ttopic?: string;\n}\n\nexport interface MemoryPolicyContext {\n\tcwd: string;\n\tsessionId?: string;\n\tgoalId?: string;\n\tlaneId?: string;\n\tuserId?: string;\n\tlaneAuthority: MemoryLaneAuthority;\n\toffline?: boolean;\n}\n\nexport interface MemoryAccessRequest {\n\tkind: MemoryOperation;\n\tstore: MemoryStore;\n\tkey?: string;\n\tnamespace?: MemoryNamespaceRequest;\n\tsource?: MemoryWriteSource;\n\tcontentTier?: MemoryContentTier;\n\tpayload?: unknown;\n}\n\nexport interface SanitizerOptions {\n\tsource: MemoryWriteSource;\n\tcontentTier: MemoryContentTier;\n\tmaxChars: number;\n\texternal: boolean;\n}\n\nexport interface SanitizerFindingSummary {\n\tsanitized: boolean;\n\tdenied: boolean;\n\tcategories: Partial<Record<MemorySanitizerCategory, number>>;\n\tredactionCount: number;\n\toriginalChars: number;\n\tkeptChars: number;\n\tdigest: string;\n}\n\nexport interface MemorySanitizerResult {\n\tpayload: TraceJsonValue;\n\tfindings: SanitizerFindingSummary;\n\treason?: string;\n}\n\nexport type MemoryNamespaceDecision =\n\t| { kind: \"allow\"; rule: string; reason: string; namespace: string; topic?: string }\n\t| { kind: \"deny\"; rule: string; reason: string }\n\t| { kind: \"defer\"; rule: string; reason: string; missing: string[] };\n\nexport type MemoryPolicyDecision =\n\t| {\n\t\t\tkind: \"allow\";\n\t\t\trule: string;\n\t\t\treason: string;\n\t\t\tnamespace: string;\n\t\t\tsanitizedPayload?: TraceJsonValue;\n\t\t\tfindings: SanitizerFindingSummary;\n\t  }\n\t| { kind: \"deny\"; rule: string; reason: string; findings: SanitizerFindingSummary }\n\t| { kind: \"defer\"; rule: string; reason: string; missing: string[]; findings: SanitizerFindingSummary };\n\nexport interface ToolInvocationRequest {\n\tsource: \"advisor\" | \"simplify\" | \"harness-control\" | \"verification\" | \"package-manager\";\n\ttoolName: string;\n\ttoolCategory: \"read\" | \"write\" | \"shell\" | \"memory\" | \"other\";\n}\n\nexport interface TodoOverlayRequest {\n\ttext: string;\n\tsource: \"compaction-summary\" | \"user-explicit\";\n}\n\nexport interface CacheOptimizerRequest {\n\tmetrics: string[];\n\tgateDecision?: \"control\" | \"treatment\" | \"deferred\";\n}\n\n// ---------------------------------------------------------------------------\n// Observability export enforcer\n// ---------------------------------------------------------------------------\n\nconst TIER_RANK: Record<PolicyTraceContentTier, number> = {\n\tmetadata: 0,\n\tsummary: 1,\n\tfull: 2,\n};\n\nexport function enforceObservabilityExport(\n\tpolicy: ExportPolicyOverlay | undefined,\n\trequest: ObservabilityExportRequest,\n): PolicyDecision {\n\tif (policy === undefined || policy.defaultOff === true) {\n\t\tif (request.sink === \"braintrust\") {\n\t\t\treturn {\n\t\t\t\tkind: \"deny\",\n\t\t\t\trule: \"export.default_off\",\n\t\t\t\treason: \"External trace export disabled by default.\",\n\t\t\t};\n\t\t}\n\t}\n\tif (request.env.offline === true) {\n\t\treturn {\n\t\t\tkind: \"deny\",\n\t\t\trule: \"export.offline\",\n\t\t\treason: \"Offline mode disables external trace export.\",\n\t\t};\n\t}\n\tif (request.sink !== \"braintrust\") {\n\t\treturn {\n\t\t\tkind: \"deny\",\n\t\t\trule: \"export.local_sink\",\n\t\t\treason: \"Local sink does not export externally.\",\n\t\t};\n\t}\n\tif (policy?.payloadTier !== undefined && TIER_RANK[request.contentTier] > TIER_RANK[policy.payloadTier]) {\n\t\treturn {\n\t\t\tkind: \"deny\",\n\t\t\trule: \"export.tier_exceeded\",\n\t\t\treason: \"Requested content tier exceeds policy.\",\n\t\t};\n\t}\n\treturn {\n\t\tkind: \"allow\",\n\t\trule: \"export.allowed\",\n\t\treason: \"External trace export permitted by policy.\",\n\t};\n}\n\n// ---------------------------------------------------------------------------\n// Trace sanitization enforcer\n// ---------------------------------------------------------------------------\n\nconst PROMPT_KEY_PATTERN = /(?:prompt|completion|response)/i;\nconst TOOL_KEY_PATTERN = /tool[_-]?(?:output|input|call|result)|toolCall|toolResult/i;\n\nfunction dropKeys(value: TraceJsonValue, patterns: readonly RegExp[]): TraceJsonValue {\n\tif (value === null || typeof value !== \"object\") {\n\t\treturn value;\n\t}\n\tif (Array.isArray(value)) {\n\t\treturn value.map((entry) => dropKeys(entry, patterns));\n\t}\n\tconst result: TraceJsonObject = {};\n\tfor (const [key, entry] of Object.entries(value)) {\n\t\tif (patterns.some((pattern) => pattern.test(key))) {\n\t\t\tcontinue;\n\t\t}\n\t\tresult[key] = dropKeys(entry, patterns);\n\t}\n\treturn result;\n}\n\nexport function sanitizeForExportPolicy(\n\tpolicy: ExportPolicyOverlay | undefined,\n\tdata: TraceJsonObject,\n): TraceJsonObject {\n\tconst patterns: RegExp[] = [];\n\tif (policy?.denyRawPrompt === true) {\n\t\tpatterns.push(PROMPT_KEY_PATTERN);\n\t}\n\tif (policy?.denyRawToolOutput === true) {\n\t\tpatterns.push(TOOL_KEY_PATTERN);\n\t}\n\tconst base = sanitizeTraceData(data);\n\tif (patterns.length === 0) {\n\t\treturn base;\n\t}\n\treturn dropKeys(base, patterns) as TraceJsonObject;\n}\n\n// ---------------------------------------------------------------------------\n// Memory namespace / sanitizer / access enforcer\n// ---------------------------------------------------------------------------\n\nconst MEMORY_REDACTED = \"[redacted]\";\nconst MEMORY_BINARY_REDACTED = \"[redacted:binary]\";\nconst MEMORY_TRUNCATION_MARKER = \"…[omk-memory:truncated]…\";\nconst MAX_MEMORY_SANITIZER_DEPTH = 6;\nconst MAX_MEMORY_OBJECT_KEYS = 80;\nconst MAX_MEMORY_ARRAY_ITEMS = 80;\nconst LOCAL_MEMORY_MAX_CHARS = 8_000;\nconst EXTERNAL_MEMORY_MAX_CHARS = 4_000;\nconst OMITTED_MEMORY_VALUE = Symbol(\"omitted-memory-value\");\nconst NAMESPACE_COMPONENT_PATTERN = /^[A-Za-z0-9][A-Za-z0-9._-]{0,120}$/;\nconst TOPIC_PATTERN = /^[a-z0-9][a-z0-9._/-]{0,120}$/;\nconst SENSITIVE_MEMORY_KEY_PATTERN =\n\t/(?:secret|token|api[_-]?key|authorization|password|credential|private[_-]?key|cookie|session|refresh[_-]?token|access[_-]?token)/i;\nconst AUTH_MEMORY_KEY_PATTERN = /(?:authorization|cookie|session|refresh[_-]?token|access[_-]?token|token)/i;\nconst PRIVATE_KEY_PATTERN = /-----BEGIN [^-]+PRIVATE KEY-----[\\s\\S]*?-----END [^-]+PRIVATE KEY-----/g;\nconst SSH_PRIVATE_KEY_PATTERN = /-----BEGIN OPENSSH PRIVATE KEY-----[\\s\\S]*?-----END OPENSSH PRIVATE KEY-----/g;\nconst BEARER_PATTERN = /Bearer\\s+[A-Za-z0-9._~+/=-]{8,}/gi;\nconst JWT_PATTERN = /\\beyJ[A-Za-z0-9_-]{5,}\\.[A-Za-z0-9_-]{5,}\\.[A-Za-z0-9_-]{5,}\\b/g;\nconst PROVIDER_TOKEN_PATTERN = /\\bsk-(?:proj-|ant-)?[A-Za-z0-9_-]{16,}\\b/g;\nconst SERVICE_TOKEN_PATTERN =\n\t/\\b(?:ghp|gho|ghu|ghs|ghr|github_pat|npm|xox[baprs]|rk_live|sk_live)_[A-Za-z0-9_=-]{16,}\\b/g;\nconst AWS_ACCESS_KEY_PATTERN = /\\bAKIA[0-9A-Z]{16}\\b/g;\nconst ENV_SECRET_ASSIGNMENT_PATTERN =\n\t/(^|\\n)([A-Z0-9_]*(?:SECRET|TOKEN|API[_-]?KEY|PASSWORD|CREDENTIAL|PRIVATE[_-]?KEY)[A-Z0-9_]*\\s*=\\s*)([^\\s]+)/gi;\nconst SECRET_KEY_VALUE_PATTERN =\n\t/(^|[\\s,;{[(])([A-Z0-9_.-]*(?:SECRET|TOKEN|API[_-]?KEY|APIKEY|AUTHORIZATION|PASSWORD|CREDENTIAL|PRIVATE[_-]?KEY|COOKIE|SESSION|REFRESH[_-]?TOKEN|ACCESS[_-]?TOKEN)[A-Z0-9_.-]*\\s*[:=]\\s*)(?:\"([^\"\\r\\n]*)\"|'([^'\\r\\n]*)'|([^\\s,;}\\])]+))/gi;\nconst EMAIL_PATTERN = /\\b[A-Z0-9._%+-]+@[A-Z0-9.-]+\\.[A-Z]{2,}\\b/gi;\nconst PHONE_PATTERN = /\\b\\+?\\d[\\d\\s().-]{7,}\\d\\b/g;\nconst SSN_PATTERN = /\\b\\d{3}-\\d{2}-\\d{4}\\b/g;\nconst CREDIT_CARD_PATTERN = /\\b(?:\\d[ -]*?){13,19}\\b/g;\nconst HOME_PATH_PATTERN = /(?:\\/home|\\/Users)\\/[^/\\s:]+/g;\nconst GENERIC_HIGH_ENTROPY_PATTERN = /\\b(?=[A-Za-z0-9+/=_-]{32,}\\b)(?=.*[A-Za-z])(?=.*\\d)[A-Za-z0-9+/=_-]+\\b/g;\n\ntype SanitizedMemoryValue = TraceJsonValue | typeof OMITTED_MEMORY_VALUE;\n\ninterface MutableSanitizerState {\n\tcategories: Partial<Record<MemorySanitizerCategory, number>>;\n\tredactionCount: number;\n\tprivateKeyBlocked: boolean;\n\ttruncated: boolean;\n}\n\nfunction sha256Text(value: string): string {\n\treturn createHash(\"sha256\").update(value).digest(\"hex\");\n}\n\nfunction canonicalMemoryJson(value: TraceJsonValue): string {\n\tif (value === null) return \"null\";\n\tif (typeof value === \"string\" || typeof value === \"number\" || typeof value === \"boolean\") {\n\t\treturn JSON.stringify(value);\n\t}\n\tif (Array.isArray(value)) {\n\t\treturn `[${value.map((entry) => canonicalMemoryJson(entry)).join(\",\")}]`;\n\t}\n\treturn `{${Object.keys(value)\n\t\t.sort()\n\t\t.map((key) => `${JSON.stringify(key)}:${canonicalMemoryJson(value[key] ?? null)}`)\n\t\t.join(\",\")}}`;\n}\n\nfunction createEmptyMemoryFindings(originalChars = 0): SanitizerFindingSummary {\n\treturn {\n\t\tsanitized: false,\n\t\tdenied: false,\n\t\tcategories: {},\n\t\tredactionCount: 0,\n\t\toriginalChars,\n\t\tkeptChars: 0,\n\t\tdigest: sha256Text(\"null\"),\n\t};\n}\n\nfunction recordMemoryFinding(state: MutableSanitizerState, category: MemorySanitizerCategory, count = 1): void {\n\tstate.categories[category] = (state.categories[category] ?? 0) + count;\n\tstate.redactionCount += count;\n}\n\nfunction measureUnknownChars(value: unknown): number {\n\ttry {\n\t\tconst serialized = JSON.stringify(value);\n\t\treturn serialized?.length ?? String(value).length;\n\t} catch {\n\t\treturn String(value).length;\n\t}\n}\n\nfunction boundMemoryString(value: string, maxChars: number): { text: string; truncated: boolean } {\n\tconst budget = Number.isFinite(maxChars) ? Math.max(0, Math.floor(maxChars)) : 0;\n\tif (budget <= 0) return { text: \"\", truncated: value.length > 0 };\n\tif (value.length <= budget) return { text: value, truncated: false };\n\tconst marker = MEMORY_TRUNCATION_MARKER.length < budget ? MEMORY_TRUNCATION_MARKER : budget >= 3 ? \"…\" : \"\";\n\tconst contentBudget = Math.max(0, budget - marker.length);\n\tconst headBudget = Math.floor(contentBudget / 2);\n\tconst tailBudget = Math.max(0, contentBudget - headBudget);\n\treturn {\n\t\ttext: `${value.slice(0, headBudget)}${marker}${value.slice(Math.max(0, value.length - tailBudget))}`,\n\t\ttruncated: true,\n\t};\n}\n\nfunction redactMemoryString(value: string, state: MutableSanitizerState, maxChars: number): string {\n\tlet redacted = value;\n\tredacted = redacted.replace(PRIVATE_KEY_PATTERN, () => {\n\t\tstate.privateKeyBlocked = true;\n\t\trecordMemoryFinding(state, \"secret\");\n\t\treturn MEMORY_REDACTED;\n\t});\n\tredacted = redacted.replace(SSH_PRIVATE_KEY_PATTERN, () => {\n\t\tstate.privateKeyBlocked = true;\n\t\trecordMemoryFinding(state, \"secret\");\n\t\treturn MEMORY_REDACTED;\n\t});\n\tredacted = redacted.replace(ENV_SECRET_ASSIGNMENT_PATTERN, (_match: string, prefix: string, assignment: string) => {\n\t\trecordMemoryFinding(state, \"secret\");\n\t\treturn `${prefix}${assignment}${MEMORY_REDACTED}`;\n\t});\n\tredacted = redacted.replace(BEARER_PATTERN, () => {\n\t\trecordMemoryFinding(state, \"auth\");\n\t\treturn `Bearer ${MEMORY_REDACTED}`;\n\t});\n\tredacted = redacted.replace(JWT_PATTERN, () => {\n\t\trecordMemoryFinding(state, \"auth\");\n\t\treturn MEMORY_REDACTED;\n\t});\n\tredacted = redacted.replace(PROVIDER_TOKEN_PATTERN, () => {\n\t\trecordMemoryFinding(state, \"secret\");\n\t\treturn MEMORY_REDACTED;\n\t});\n\tredacted = redacted.replace(SERVICE_TOKEN_PATTERN, () => {\n\t\trecordMemoryFinding(state, \"secret\");\n\t\treturn MEMORY_REDACTED;\n\t});\n\tredacted = redacted.replace(AWS_ACCESS_KEY_PATTERN, () => {\n\t\trecordMemoryFinding(state, \"secret\");\n\t\treturn MEMORY_REDACTED;\n\t});\n\tredacted = redacted.replace(\n\t\tSECRET_KEY_VALUE_PATTERN,\n\t\t(\n\t\t\tmatch: string,\n\t\t\tprefix: string,\n\t\t\tassignment: string,\n\t\t\tdoubleQuoted: string | undefined,\n\t\t\tsingleQuoted: string | undefined,\n\t\t\tbare: string | undefined,\n\t\t) => {\n\t\t\tconst value = doubleQuoted ?? singleQuoted ?? bare ?? \"\";\n\t\t\tif (value.includes(MEMORY_REDACTED) || value.includes(\"[redacted\")) return match;\n\t\t\trecordMemoryFinding(state, categoryForSensitiveKey(assignment));\n\t\t\tif (doubleQuoted !== undefined) return `${prefix}${assignment}\"${MEMORY_REDACTED}\"`;\n\t\t\tif (singleQuoted !== undefined) return `${prefix}${assignment}'${MEMORY_REDACTED}'`;\n\t\t\treturn `${prefix}${assignment}${MEMORY_REDACTED}`;\n\t\t},\n\t);\n\tredacted = redacted.replace(EMAIL_PATTERN, () => {\n\t\trecordMemoryFinding(state, \"pii\");\n\t\treturn MEMORY_REDACTED;\n\t});\n\tredacted = redacted.replace(SSN_PATTERN, () => {\n\t\trecordMemoryFinding(state, \"pii\");\n\t\treturn MEMORY_REDACTED;\n\t});\n\tredacted = redacted.replace(CREDIT_CARD_PATTERN, () => {\n\t\trecordMemoryFinding(state, \"pii\");\n\t\treturn MEMORY_REDACTED;\n\t});\n\tredacted = redacted.replace(PHONE_PATTERN, () => {\n\t\trecordMemoryFinding(state, \"pii\");\n\t\treturn MEMORY_REDACTED;\n\t});\n\tredacted = redacted.replace(HOME_PATH_PATTERN, () => {\n\t\trecordMemoryFinding(state, \"path\");\n\t\treturn \"~\";\n\t});\n\tredacted = redacted.replace(GENERIC_HIGH_ENTROPY_PATTERN, () => {\n\t\trecordMemoryFinding(state, \"secret\");\n\t\treturn MEMORY_REDACTED;\n\t});\n\tconst bounded = boundMemoryString(redacted, maxChars);\n\tif (bounded.truncated) state.truncated = true;\n\treturn bounded.text;\n}\n\nfunction isSessionDerivedMemorySource(source: MemoryWriteSource): boolean {\n\treturn source !== \"user-explicit\";\n}\n\nfunction categoryForSensitiveKey(key: string): MemorySanitizerCategory {\n\treturn AUTH_MEMORY_KEY_PATTERN.test(key) ? \"auth\" : \"secret\";\n}\n\nfunction isPlainObject(value: object): value is Record<string, unknown> {\n\treturn Object.getPrototypeOf(value) === Object.prototype || Object.getPrototypeOf(value) === null;\n}\n\nfunction sanitizeMemoryValue(\n\tvalue: unknown,\n\toptions: SanitizerOptions,\n\tstate: MutableSanitizerState,\n\tdepth: number,\n\tseen: WeakSet<object>,\n): SanitizedMemoryValue {\n\tif (value === null) return null;\n\tif (typeof value === \"string\") return redactMemoryString(value, state, options.maxChars);\n\tif (typeof value === \"number\") return Number.isFinite(value) ? value : String(value);\n\tif (typeof value === \"boolean\") return value;\n\tif (typeof value === \"bigint\") return value.toString();\n\tif (typeof value === \"undefined\") return \"\";\n\tif (typeof value === \"function\" || typeof value === \"symbol\") return String(value);\n\tif (depth >= MAX_MEMORY_SANITIZER_DEPTH) return \"[max-depth]\";\n\n\tif (value instanceof ArrayBuffer || ArrayBuffer.isView(value)) {\n\t\trecordMemoryFinding(state, \"binary\");\n\t\treturn MEMORY_BINARY_REDACTED;\n\t}\n\tif (value instanceof Date) return value.toISOString();\n\tif (value instanceof Error) {\n\t\treturn {\n\t\t\tname: redactMemoryString(value.name, state, options.maxChars),\n\t\t\tmessage: redactMemoryString(value.message, state, options.maxChars),\n\t\t};\n\t}\n\tif (Array.isArray(value)) {\n\t\treturn value.slice(0, MAX_MEMORY_ARRAY_ITEMS).map((entry) => {\n\t\t\tconst sanitized = sanitizeMemoryValue(entry, options, state, depth + 1, seen);\n\t\t\treturn sanitized === OMITTED_MEMORY_VALUE ? MEMORY_REDACTED : sanitized;\n\t\t});\n\t}\n\tif (typeof value === \"object\") {\n\t\tif (seen.has(value)) return \"[circular]\";\n\t\tseen.add(value);\n\t\tconst entries = isPlainObject(value)\n\t\t\t? Object.entries(value)\n\t\t\t: Object.entries(value).slice(0, MAX_MEMORY_OBJECT_KEYS);\n\t\tconst result: TraceJsonObject = {};\n\t\tfor (const [key, entry] of entries.slice(0, MAX_MEMORY_OBJECT_KEYS)) {\n\t\t\tif (SENSITIVE_MEMORY_KEY_PATTERN.test(key)) {\n\t\t\t\tif (/private[_-]?key/i.test(key)) state.privateKeyBlocked = true;\n\t\t\t\trecordMemoryFinding(state, categoryForSensitiveKey(key));\n\t\t\t\tresult[key] = MEMORY_REDACTED;\n\t\t\t\tcontinue;\n\t\t\t}\n\t\t\tif (isSessionDerivedMemorySource(options.source) && options.contentTier !== \"evidence\") {\n\t\t\t\tif (PROMPT_KEY_PATTERN.test(key)) {\n\t\t\t\t\trecordMemoryFinding(state, \"rawPrompt\");\n\t\t\t\t\tcontinue;\n\t\t\t\t}\n\t\t\t\tif (TOOL_KEY_PATTERN.test(key)) {\n\t\t\t\t\trecordMemoryFinding(state, \"rawTool\");\n\t\t\t\t\tcontinue;\n\t\t\t\t}\n\t\t\t}\n\t\t\tconst sanitized = sanitizeMemoryValue(entry, options, state, depth + 1, seen);\n\t\t\tif (sanitized !== OMITTED_MEMORY_VALUE) result[key] = sanitized;\n\t\t}\n\t\tseen.delete(value);\n\t\treturn result;\n\t}\n\treturn String(value);\n}\n\nfunction boundSanitizedPayload(value: TraceJsonValue, maxChars: number, state: MutableSanitizerState): TraceJsonValue {\n\tconst canonical = canonicalMemoryJson(value);\n\tif (canonical.length <= maxChars) return value;\n\tconst bounded = boundMemoryString(canonical, maxChars);\n\tif (bounded.truncated) state.truncated = true;\n\treturn bounded.text;\n}\n\nfunction isEmptyMemoryPayload(value: TraceJsonValue): boolean {\n\tif (value === null) return true;\n\tif (typeof value === \"string\") return value.trim().length === 0;\n\tif (Array.isArray(value)) return value.length === 0;\n\tif (typeof value === \"object\") return Object.keys(value).length === 0;\n\treturn false;\n}\n\nfunction sanitizerDenyReason(\n\tpayload: TraceJsonValue,\n\toptions: SanitizerOptions,\n\tstate: MutableSanitizerState,\n): string | undefined {\n\tif (state.privateKeyBlocked) return \"memory.sanitizer.private_key\";\n\tconst sensitiveCount = (state.categories.secret ?? 0) + (state.categories.auth ?? 0);\n\tif (sensitiveCount >= 3 && sensitiveCount * 2 >= Math.max(1, state.redactionCount)) {\n\t\treturn \"memory.sanitizer.high_secret_density\";\n\t}\n\tif (options.contentTier !== \"metadata\" && isEmptyMemoryPayload(payload)) return \"memory.sanitizer.empty_payload\";\n\treturn undefined;\n}\n\nexport function sanitizeMemoryPayload(payload: unknown, options: SanitizerOptions): MemorySanitizerResult {\n\tconst originalChars = measureUnknownChars(payload);\n\tconst state: MutableSanitizerState = {\n\t\tcategories: {},\n\t\tredactionCount: 0,\n\t\tprivateKeyBlocked: false,\n\t\ttruncated: false,\n\t};\n\tconst sanitizedValue = sanitizeMemoryValue(payload, options, state, 0, new WeakSet<object>());\n\tconst sanitizedPayload = sanitizedValue === OMITTED_MEMORY_VALUE ? null : sanitizedValue;\n\tconst boundedPayload = boundSanitizedPayload(sanitizedPayload, options.maxChars, state);\n\tconst canonicalPayload = canonicalMemoryJson(boundedPayload);\n\tconst reason = sanitizerDenyReason(boundedPayload, options, state);\n\treturn {\n\t\tpayload: boundedPayload,\n\t\tfindings: {\n\t\t\tsanitized: state.redactionCount > 0 || state.truncated,\n\t\t\tdenied: reason !== undefined,\n\t\t\tcategories: state.categories,\n\t\t\tredactionCount: state.redactionCount,\n\t\t\toriginalChars,\n\t\t\tkeptChars: canonicalPayload.length,\n\t\t\tdigest: sha256Text(canonicalPayload),\n\t\t},\n\t\treason,\n\t};\n}\n\nfunction canonicalProjectHash(root: string): string {\n\treturn sha256Text(resolve(root).replace(/\\\\/g, \"/\")).slice(0, 16);\n}\n\nfunction normalizeResolvedProjectPath(path: string): string {\n\tconst normalized = resolve(path).replace(/\\\\/g, \"/\");\n\tif (normalized.length > 1 && normalized.endsWith(\"/\")) return normalized.replace(/\\/+$/, \"\");\n\treturn normalized;\n}\n\nfunction isSameOrAncestorProjectRoot(projectRoot: string, cwd: string): boolean {\n\tconst root = normalizeResolvedProjectPath(projectRoot);\n\tconst current = normalizeResolvedProjectPath(cwd);\n\treturn current === root || current.startsWith(`${root}/`);\n}\n\nfunction resolveMemoryProjectRoot(\n\tcontext: MemoryPolicyContext,\n\trequest: MemoryNamespaceRequest,\n): MemoryNamespaceDecision | { kind: \"allow\"; projectRoot: string } {\n\tif (request.projectRoot === undefined) return { kind: \"allow\", projectRoot: context.cwd };\n\tif (isSameOrAncestorProjectRoot(request.projectRoot, context.cwd)) {\n\t\treturn { kind: \"allow\", projectRoot: request.projectRoot };\n\t}\n\treturn {\n\t\tkind: \"deny\",\n\t\trule: \"memory.namespace.project_root_mismatch\",\n\t\treason: \"Memory namespace project root must contain the active workspace.\",\n\t};\n}\n\nfunction validateNamespaceComponent(name: string, value: string): MemoryNamespaceDecision | undefined {\n\tif (NAMESPACE_COMPONENT_PATTERN.test(value)) return undefined;\n\treturn {\n\t\tkind: \"deny\",\n\t\trule: \"memory.namespace.invalid_component\",\n\t\treason: `${name} contains unsupported namespace characters.`,\n\t};\n}\n\nfunction normalizeMemoryTopic(topic: string | undefined): MemoryNamespaceDecision | { kind: \"allow\"; topic?: string } {\n\tif (topic === undefined) return { kind: \"allow\" };\n\tconst normalized = topic.trim().toLowerCase();\n\tif (\n\t\tnormalized.length === 0 ||\n\t\tnormalized.includes(\"..\") ||\n\t\tnormalized.startsWith(\"/\") ||\n\t\tnormalized.includes(\"\\\\\") ||\n\t\t/^[a-z][a-z0-9+.-]*:/.test(normalized) ||\n\t\t/[\\x00-\\x1f\\x7f]/.test(normalized) ||\n\t\t!TOPIC_PATTERN.test(normalized)\n\t) {\n\t\treturn {\n\t\t\tkind: \"deny\",\n\t\t\trule: \"memory.namespace.invalid_topic\",\n\t\t\treason: \"Memory namespace topic is not a safe relative suffix.\",\n\t\t};\n\t}\n\treturn { kind: \"allow\", topic: normalized };\n}\n\nfunction missingNamespaceDecision(missing: string[]): MemoryNamespaceDecision {\n\treturn {\n\t\tkind: \"defer\",\n\t\trule: \"memory.namespace.missing_context\",\n\t\treason: \"Memory namespace requires additional context.\",\n\t\tmissing,\n\t};\n}\n\nfunction appendMemoryTopic(namespace: string, topic: string | undefined): string {\n\treturn topic === undefined ? namespace : `${namespace}:${topic}`;\n}\n\nexport function deriveMemoryNamespace(\n\tcontext: MemoryPolicyContext,\n\trequest: MemoryNamespaceRequest,\n): MemoryNamespaceDecision {\n\tconst topic = normalizeMemoryTopic(request.topic);\n\tif (topic.kind !== \"allow\") return topic;\n\tconst projectRoot = resolveMemoryProjectRoot(context, request);\n\tif (!(\"projectRoot\" in projectRoot)) return projectRoot;\n\tconst projectHash = canonicalProjectHash(projectRoot.projectRoot);\n\tconst projectNamespace = `omk:project:${projectHash}`;\n\tif (request.scope === \"project\")\n\t\treturn {\n\t\t\tkind: \"allow\",\n\t\t\trule: \"memory.namespace.project\",\n\t\t\treason: \"Project namespace derived.\",\n\t\t\tnamespace: appendMemoryTopic(projectNamespace, topic.topic),\n\t\t\ttopic: topic.topic,\n\t\t};\n\n\tif (request.scope === \"session\") {\n\t\tconst sessionId = request.sessionId ?? context.sessionId;\n\t\tif (sessionId === undefined) return missingNamespaceDecision([\"sessionId\"]);\n\t\tconst invalid = validateNamespaceComponent(\"sessionId\", sessionId);\n\t\tif (invalid) return invalid;\n\t\treturn {\n\t\t\tkind: \"allow\",\n\t\t\trule: \"memory.namespace.session\",\n\t\t\treason: \"Session namespace derived.\",\n\t\t\tnamespace: appendMemoryTopic(`${projectNamespace}:session:${sessionId}`, topic.topic),\n\t\t\ttopic: topic.topic,\n\t\t};\n\t}\n\n\tif (request.scope === \"goal\") {\n\t\tconst goalId = request.goalId ?? context.goalId;\n\t\tif (goalId === undefined) return missingNamespaceDecision([\"goalId\"]);\n\t\tconst invalid = validateNamespaceComponent(\"goalId\", goalId);\n\t\tif (invalid) return invalid;\n\t\treturn {\n\t\t\tkind: \"allow\",\n\t\t\trule: \"memory.namespace.goal\",\n\t\t\treason: \"Goal namespace derived.\",\n\t\t\tnamespace: appendMemoryTopic(`${projectNamespace}:goal:${goalId}`, topic.topic),\n\t\t\ttopic: topic.topic,\n\t\t};\n\t}\n\n\tif (request.scope === \"lane\") {\n\t\tconst goalId = request.goalId ?? context.goalId;\n\t\tconst laneId = request.laneId ?? context.laneId;\n\t\tif (goalId === undefined || laneId === undefined) {\n\t\t\tconst missing = [\n\t\t\t\tgoalId === undefined ? \"goalId\" : undefined,\n\t\t\t\tlaneId === undefined ? \"laneId\" : undefined,\n\t\t\t].filter((entry): entry is string => entry !== undefined);\n\t\t\treturn missingNamespaceDecision(missing);\n\t\t}\n\t\tconst invalidGoal = validateNamespaceComponent(\"goalId\", goalId);\n\t\tif (invalidGoal) return invalidGoal;\n\t\tconst invalidLane = validateNamespaceComponent(\"laneId\", laneId);\n\t\tif (invalidLane) return invalidLane;\n\t\treturn {\n\t\t\tkind: \"allow\",\n\t\t\trule: \"memory.namespace.lane\",\n\t\t\treason: \"Lane namespace derived.\",\n\t\t\tnamespace: appendMemoryTopic(`${projectNamespace}:goal:${goalId}:lane:${laneId}`, topic.topic),\n\t\t\ttopic: topic.topic,\n\t\t};\n\t}\n\n\tconst userId = context.userId;\n\tif (userId === undefined) return missingNamespaceDecision([\"userId\"]);\n\treturn {\n\t\tkind: \"allow\",\n\t\trule: \"memory.namespace.user\",\n\t\treason: \"User namespace derived.\",\n\t\tnamespace: appendMemoryTopic(`omk:user:${sha256Text(userId).slice(0, 16)}`, topic.topic),\n\t\ttopic: topic.topic,\n\t};\n}\n\nfunction canReadMemory(authority: MemoryLaneAuthority): boolean {\n\treturn authority === \"read\" || authority === \"write-sanitized\" || authority === \"write-global\";\n}\n\nfunction canWriteMemory(authority: MemoryLaneAuthority): boolean {\n\treturn authority === \"write-sanitized\" || authority === \"write-global\";\n}\n\nfunction defaultMemoryContext(\n\toverlay: PolicyOverlay | undefined,\n\trequest: MemoryAccessRequest,\n\tcontext: MemoryPolicyContext | undefined,\n): MemoryPolicyContext {\n\treturn {\n\t\tcwd: context?.cwd ?? process.cwd(),\n\t\tsessionId: context?.sessionId,\n\t\tgoalId: context?.goalId,\n\t\tlaneId: context?.laneId,\n\t\tuserId: context?.userId,\n\t\tlaneAuthority:\n\t\t\tcontext?.laneAuthority ?? (overlay?.declaredUse === \"memory\" && request.kind === \"read\" ? \"read\" : \"none\"),\n\t\toffline: context?.offline,\n\t};\n}\n\nfunction denyMemory(rule: string, reason: string, findings = createEmptyMemoryFindings()): MemoryPolicyDecision {\n\treturn { kind: \"deny\", rule, reason, findings };\n}\n\nfunction deferMemory(\n\trule: string,\n\treason: string,\n\tmissing: string[],\n\tfindings = createEmptyMemoryFindings(),\n): MemoryPolicyDecision {\n\treturn { kind: \"defer\", rule, reason, missing, findings };\n}\n\nfunction namespaceToPolicyDecision(\n\tdecision: Exclude<MemoryNamespaceDecision, { kind: \"allow\" }>,\n): MemoryPolicyDecision {\n\tif (decision.kind === \"deny\") return denyMemory(decision.rule, decision.reason);\n\treturn deferMemory(decision.rule, decision.reason, decision.missing);\n}\n\nfunction missingRequestFields(request: MemoryAccessRequest): string[] {\n\treturn [\n\t\trequest.source === undefined ? \"source\" : undefined,\n\t\trequest.contentTier === undefined ? \"contentTier\" : undefined,\n\t].filter((entry): entry is string => entry !== undefined);\n}\n\nfunction memoryMaxChars(store: MemoryStore): number {\n\treturn store === \"supermemory\" ? EXTERNAL_MEMORY_MAX_CHARS : LOCAL_MEMORY_MAX_CHARS;\n}\n\nexport function enforceMemoryAccess(\n\toverlay: PolicyOverlay | undefined,\n\trequest: MemoryAccessRequest,\n\tcontext?: MemoryPolicyContext,\n): MemoryPolicyDecision {\n\tconst effectiveContext = defaultMemoryContext(overlay, request, context);\n\tconst namespaceDecision = deriveMemoryNamespace(effectiveContext, request.namespace ?? { scope: \"project\" });\n\tif (namespaceDecision.kind !== \"allow\") return namespaceToPolicyDecision(namespaceDecision);\n\n\tif (request.kind === \"read\") {\n\t\tif (!canReadMemory(effectiveContext.laneAuthority)) {\n\t\t\treturn denyMemory(\"memory.authority_denied\", \"Memory read requires lane memory authority.\");\n\t\t}\n\t\treturn {\n\t\t\tkind: \"allow\",\n\t\t\trule: \"memory.read_allowed\",\n\t\t\treason: \"Memory read permitted.\",\n\t\t\tnamespace: namespaceDecision.namespace,\n\t\t\tfindings: createEmptyMemoryFindings(),\n\t\t};\n\t}\n\n\tif (request.store === \"supermemory\" && request.contentTier === \"raw\") {\n\t\treturn denyMemory(\"memory.supermemory_raw_denied\", \"Supermemory does not accept raw memory payloads.\");\n\t}\n\tif (overlay?.declaredUse !== \"memory\") {\n\t\treturn denyMemory(\"memory.not_a_memory_lane\", \"Write/replay requested outside a memory lane.\");\n\t}\n\tif (overlay.advisoryOnly === true) {\n\t\treturn denyMemory(\"memory.advisory_only\", \"Memory lane is advisory-only; writes denied.\");\n\t}\n\tif (!canWriteMemory(effectiveContext.laneAuthority)) {\n\t\treturn denyMemory(\"memory.authority_denied\", \"Memory write requires sanitized-write lane authority.\");\n\t}\n\tif (request.kind === \"replay\" && overlay.replayInput !== true) {\n\t\treturn denyMemory(\"memory.no_replay\", \"Memory replay requires an explicit replayInput overlay.\");\n\t}\n\tif (effectiveContext.offline === true && request.store === \"supermemory\") {\n\t\treturn deferMemory(\"memory.supermemory_offline\", \"Supermemory writes are deferred while offline.\", [\"online\"]);\n\t}\n\tconst source = request.source;\n\tconst contentTier = request.contentTier;\n\tif (source === undefined || contentTier === undefined) {\n\t\tconst missing = missingRequestFields(request);\n\t\treturn deferMemory(\"memory.request.missing_context\", \"Memory write requires source and content tier.\", missing);\n\t}\n\tif (request.namespace?.scope === \"user\") {\n\t\tif (effectiveContext.laneAuthority !== \"write-global\" || source !== \"user-explicit\") {\n\t\t\treturn denyMemory(\n\t\t\t\t\"memory.global_authority_denied\",\n\t\t\t\t\"User/global memory writes require explicit global authority.\",\n\t\t\t);\n\t\t}\n\t}\n\tif (contentTier === \"raw\") {\n\t\tif (\n\t\t\trequest.store !== \"memory\" ||\n\t\t\tsource !== \"user-explicit\" ||\n\t\t\teffectiveContext.laneAuthority !== \"write-global\"\n\t\t) {\n\t\t\treturn denyMemory(\n\t\t\t\t\"memory.raw_denied\",\n\t\t\t\t\"Raw memory writes require explicit user-global local memory authority.\",\n\t\t\t);\n\t\t}\n\t}\n\n\tconst sanitized = sanitizeMemoryPayload(request.payload ?? null, {\n\t\tsource,\n\t\tcontentTier,\n\t\tmaxChars: memoryMaxChars(request.store),\n\t\texternal: request.store === \"supermemory\",\n\t});\n\tif (sanitized.findings.denied) {\n\t\treturn denyMemory(\n\t\t\tsanitized.reason ?? \"memory.sanitizer.denied\",\n\t\t\t\"Memory payload sanitizer denied persistence.\",\n\t\t\tsanitized.findings,\n\t\t);\n\t}\n\tif (contentTier === \"raw\" && sanitized.findings.redactionCount > 0) {\n\t\treturn denyMemory(\n\t\t\t\"memory.raw_sensitive_denied\",\n\t\t\t\"Raw memory payload contains sanitizer findings.\",\n\t\t\tsanitized.findings,\n\t\t);\n\t}\n\treturn {\n\t\tkind: \"allow\",\n\t\trule: request.kind === \"replay\" ? \"memory.replay_sanitized\" : \"memory.write_sanitized\",\n\t\treason: \"Memory payload permitted after sanitization.\",\n\t\tnamespace: namespaceDecision.namespace,\n\t\tsanitizedPayload: sanitized.payload,\n\t\tfindings: sanitized.findings,\n\t};\n}\n\n// ---------------------------------------------------------------------------\n// Advisor / simplify report-only tool enforcer\n// ---------------------------------------------------------------------------\n\nexport function enforceReportOnlyToolInvocation(\n\toverlay: PolicyOverlay | undefined,\n\trequest: ToolInvocationRequest,\n): PolicyDecision {\n\tif (request.source !== \"advisor\" && request.source !== \"simplify\") {\n\t\treturn {\n\t\t\tkind: \"allow\",\n\t\t\trule: \"source.not_advisor\",\n\t\t\treason: \"Source is not advisor/simplify.\",\n\t\t};\n\t}\n\tconst declaredUse = overlay?.declaredUse;\n\tconst hasReportOverlay =\n\t\toverlay?.mutationMode === \"report-only\" || declaredUse === \"advisor\" || declaredUse === \"quality\";\n\tif (!hasReportOverlay) {\n\t\treturn {\n\t\t\tkind: \"deny\",\n\t\t\trule: \"advisor.missing_overlay\",\n\t\t\treason: \"Advisor/simplify source requires a report-only overlay.\",\n\t\t};\n\t}\n\tif (request.toolCategory === \"write\" || request.toolCategory === \"shell\") {\n\t\treturn {\n\t\t\tkind: \"deny\",\n\t\t\trule: \"advisor.mutation_denied\",\n\t\t\treason: \"Advisor/simplify tools are report-only.\",\n\t\t};\n\t}\n\treturn {\n\t\tkind: \"allow\",\n\t\trule: \"advisor.read_allowed\",\n\t\treason: \"Read-only advisor/simplify tool permitted.\",\n\t};\n}\n\n// ---------------------------------------------------------------------------\n// Todo overlay classifier\n// ---------------------------------------------------------------------------\n\nfunction sanitizeStatusText(text: string): string {\n\treturn text.replace(/[\\x00-\\x08\\x0b-\\x1f\\x7f]/g, \"\").trim();\n}\n\nexport type TodoOverlayClassification =\n\t| { authoritative: false; display: string }\n\t| { authoritative: true; source: \"user-explicit\" };\n\nexport function classifyTodoOverlay(request: TodoOverlayRequest): TodoOverlayClassification {\n\tif (request.source === \"compaction-summary\") {\n\t\treturn { authoritative: false, display: sanitizeStatusText(request.text) };\n\t}\n\treturn { authoritative: true, source: \"user-explicit\" };\n}\n\n// ---------------------------------------------------------------------------\n// Cache optimizer A/B measurement gate\n// ---------------------------------------------------------------------------\n\nexport function enforceCacheOptimizerGate(\n\toverlay: PolicyOverlay | undefined,\n\trequest: CacheOptimizerRequest,\n): PolicyDecision {\n\tif (overlay?.declaredUse !== \"cache-perf\") {\n\t\treturn {\n\t\t\tkind: \"deny\",\n\t\t\trule: \"cache.not_a_cache_optimizer\",\n\t\t\treason: \"Cache optimizer gate requested for non-cache lane.\",\n\t\t};\n\t}\n\tif (request.metrics.length === 0) {\n\t\treturn {\n\t\t\tkind: \"defer\",\n\t\t\trule: \"pending-measurement-plan\",\n\t\t\treason: \"Cache optimizer requires metrics array.\",\n\t\t\tdeferredReason: \"pending-measurement-plan\",\n\t\t};\n\t}\n\tif (request.gateDecision !== \"treatment\") {\n\t\treturn {\n\t\t\tkind: \"defer\",\n\t\t\trule: \"pending-measurement-plan\",\n\t\t\treason: \"Cache optimizer awaiting A/B treatment decision.\",\n\t\t\tdeferredReason: \"pending-measurement-plan\",\n\t\t};\n\t}\n\treturn {\n\t\tkind: \"allow\",\n\t\trule: \"cache.treatment_allowed\",\n\t\treason: \"Cache optimizer treatment permitted.\",\n\t};\n}\n"]}

package/dist/core/read-anchor-registry.d.ts

@@ -0,0 +1,27 @@
+import type { ReadAnchor } from "./read-anchors.ts";
+export interface ReadAnchorRegistryEntry {
+    readonly anchor: ReadAnchor;
+    readonly content: string;
+}
+export interface ReadAnchorRegistry {
+    /** Store an anchor and the newline-normalized full-file content it was derived from. */
+    register(anchor: ReadAnchor, normalizedContent: string): void;
+    /** Look up a registered anchor and its stored content by readId. */
+    get(readId: string): ReadAnchorRegistryEntry | undefined;
+    /** Return all registered anchors for a path, newest first by registration time. */
+    getByPath(path: string): ReadAnchor[];
+    /** Evict every entry associated with a path. */
+    invalidatePath(path: string): void;
+    /** Evict every entry. */
+    clear(): void;
+    /** Number of currently stored anchors. */
+    readonly size: number;
+}
+/** Create a factory that yields deterministic, sortable, unique read ids. */
+export declare function createMonotonicReadIdFactory(): () => string;
+/**
+ * Create a per-session registry that maps read ids to anchors and supports
+ * path-indexed invalidation and deterministic LRU eviction.
+ */
+export declare function createReadAnchorRegistry(maxEntries?: number): ReadAnchorRegistry;
+//# sourceMappingURL=read-anchor-registry.d.ts.map

package/dist/core/read-anchor-registry.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"read-anchor-registry.d.ts","sourceRoot":"","sources":["../../src/core/read-anchor-registry.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,mBAAmB,CAAC;AAEpD,MAAM,WAAW,uBAAuB;IACvC,QAAQ,CAAC,MAAM,EAAE,UAAU,CAAC;IAC5B,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;CACzB;AAED,MAAM,WAAW,kBAAkB;IAClC,wFAAwF;IACxF,QAAQ,CAAC,MAAM,EAAE,UAAU,EAAE,iBAAiB,EAAE,MAAM,GAAG,IAAI,CAAC;IAC9D,oEAAoE;IACpE,GAAG,CAAC,MAAM,EAAE,MAAM,GAAG,uBAAuB,GAAG,SAAS,CAAC;IACzD,mFAAmF;IACnF,SAAS,CAAC,IAAI,EAAE,MAAM,GAAG,UAAU,EAAE,CAAC;IACtC,gDAAgD;IAChD,cAAc,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;IACnC,yBAAyB;IACzB,KAAK,IAAI,IAAI,CAAC;IACd,0CAA0C;IAC1C,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;CACtB;AAWD,6EAA6E;AAC7E,wBAAgB,4BAA4B,IAAI,MAAM,MAAM,CAM3D;AAED;;;GAGG;AACH,wBAAgB,wBAAwB,CAAC,UAAU,SAA+B,GAAG,kBAAkB,CAqFtG","sourcesContent":["import type { ReadAnchor } from \"./read-anchors.ts\";\n\nexport interface ReadAnchorRegistryEntry {\n\treadonly anchor: ReadAnchor;\n\treadonly content: string;\n}\n\nexport interface ReadAnchorRegistry {\n\t/** Store an anchor and the newline-normalized full-file content it was derived from. */\n\tregister(anchor: ReadAnchor, normalizedContent: string): void;\n\t/** Look up a registered anchor and its stored content by readId. */\n\tget(readId: string): ReadAnchorRegistryEntry | undefined;\n\t/** Return all registered anchors for a path, newest first by registration time. */\n\tgetByPath(path: string): ReadAnchor[];\n\t/** Evict every entry associated with a path. */\n\tinvalidatePath(path: string): void;\n\t/** Evict every entry. */\n\tclear(): void;\n\t/** Number of currently stored anchors. */\n\treadonly size: number;\n}\n\ninterface Entry extends ReadAnchorRegistryEntry {\n\t/** Monotonic registration order; determines \"newest first\" for path queries. */\n\treadonly registeredAt: number;\n\t/** Monotonic last-access counter; drives deterministic LRU eviction. */\n\tlastAccess: number;\n}\n\nconst DEFAULT_MAX_REGISTRY_ENTRIES = 1000;\n\n/** Create a factory that yields deterministic, sortable, unique read ids. */\nexport function createMonotonicReadIdFactory(): () => string {\n\tlet counter = 0;\n\treturn () => {\n\t\tcounter += 1;\n\t\treturn `ra-${counter.toString(36).padStart(12, \"0\")}`;\n\t};\n}\n\n/**\n * Create a per-session registry that maps read ids to anchors and supports\n * path-indexed invalidation and deterministic LRU eviction.\n */\nexport function createReadAnchorRegistry(maxEntries = DEFAULT_MAX_REGISTRY_ENTRIES): ReadAnchorRegistry {\n\tlet accessCounter = 0;\n\tconst byId = new Map<string, Entry>();\n\tconst byPath = new Map<string, Set<string>>();\n\n\tfunction touch(entry: Entry): Entry {\n\t\taccessCounter += 1;\n\t\treturn { ...entry, lastAccess: accessCounter };\n\t}\n\n\tfunction evictIfNeeded(): void {\n\t\tif (byId.size <= maxEntries) return;\n\t\tlet oldest: Entry | undefined;\n\t\tfor (const entry of byId.values()) {\n\t\t\tif (oldest === undefined || entry.lastAccess < oldest.lastAccess) {\n\t\t\t\toldest = entry;\n\t\t\t}\n\t\t}\n\t\tif (oldest === undefined) return;\n\t\tbyId.delete(oldest.anchor.readId);\n\t\tconst pathSet = byPath.get(oldest.anchor.path);\n\t\tif (pathSet) {\n\t\t\tpathSet.delete(oldest.anchor.readId);\n\t\t\tif (pathSet.size === 0) {\n\t\t\t\tbyPath.delete(oldest.anchor.path);\n\t\t\t}\n\t\t}\n\t}\n\n\treturn {\n\t\tregister(anchor, normalizedContent) {\n\t\t\taccessCounter += 1;\n\t\t\tconst entry: Entry = {\n\t\t\t\tanchor,\n\t\t\t\tcontent: normalizedContent,\n\t\t\t\tregisteredAt: accessCounter,\n\t\t\t\tlastAccess: accessCounter,\n\t\t\t};\n\t\t\tbyId.set(anchor.readId, entry);\n\t\t\tlet pathSet = byPath.get(anchor.path);\n\t\t\tif (!pathSet) {\n\t\t\t\tpathSet = new Set<string>();\n\t\t\t\tbyPath.set(anchor.path, pathSet);\n\t\t\t}\n\t\t\tpathSet.add(anchor.readId);\n\t\t\tevictIfNeeded();\n\t\t},\n\t\tget(readId) {\n\t\t\tconst entry = byId.get(readId);\n\t\t\tif (entry === undefined) return undefined;\n\t\t\tconst touched = touch(entry);\n\t\t\tbyId.set(readId, touched);\n\t\t\treturn { anchor: touched.anchor, content: touched.content };\n\t\t},\n\t\tgetByPath(path) {\n\t\t\tconst pathSet = byPath.get(path);\n\t\t\tif (pathSet === undefined) return [];\n\t\t\tconst anchors: ReadAnchor[] = [];\n\t\t\tfor (const readId of pathSet) {\n\t\t\t\tconst entry = byId.get(readId);\n\t\t\t\tif (entry === undefined) continue;\n\t\t\t\tconst touched = touch(entry);\n\t\t\t\tbyId.set(readId, touched);\n\t\t\t\tanchors.push(touched.anchor);\n\t\t\t}\n\t\t\tanchors.sort((a, b) => byId.get(b.readId)!.registeredAt - byId.get(a.readId)!.registeredAt);\n\t\t\treturn anchors;\n\t\t},\n\t\tinvalidatePath(path) {\n\t\t\tconst pathSet = byPath.get(path);\n\t\t\tif (pathSet === undefined) return;\n\t\t\tfor (const readId of pathSet) {\n\t\t\t\tbyId.delete(readId);\n\t\t\t}\n\t\t\tbyPath.delete(path);\n\t\t},\n\t\tclear() {\n\t\t\tbyId.clear();\n\t\t\tbyPath.clear();\n\t\t\taccessCounter = 0;\n\t\t},\n\t\tget size() {\n\t\t\treturn byId.size;\n\t\t},\n\t};\n}\n"]}

package/dist/core/read-anchor-registry.js

@@ -0,0 +1,103 @@
+const DEFAULT_MAX_REGISTRY_ENTRIES = 1000;
+/** Create a factory that yields deterministic, sortable, unique read ids. */
+export function createMonotonicReadIdFactory() {
+    let counter = 0;
+    return () => {
+        counter += 1;
+        return `ra-${counter.toString(36).padStart(12, "0")}`;
+    };
+}
+/**
+ * Create a per-session registry that maps read ids to anchors and supports
+ * path-indexed invalidation and deterministic LRU eviction.
+ */
+export function createReadAnchorRegistry(maxEntries = DEFAULT_MAX_REGISTRY_ENTRIES) {
+    let accessCounter = 0;
+    const byId = new Map();
+    const byPath = new Map();
+    function touch(entry) {
+        accessCounter += 1;
+        return { ...entry, lastAccess: accessCounter };
+    }
+    function evictIfNeeded() {
+        if (byId.size <= maxEntries)
+            return;
+        let oldest;
+        for (const entry of byId.values()) {
+            if (oldest === undefined || entry.lastAccess < oldest.lastAccess) {
+                oldest = entry;
+            }
+        }
+        if (oldest === undefined)
+            return;
+        byId.delete(oldest.anchor.readId);
+        const pathSet = byPath.get(oldest.anchor.path);
+        if (pathSet) {
+            pathSet.delete(oldest.anchor.readId);
+            if (pathSet.size === 0) {
+                byPath.delete(oldest.anchor.path);
+            }
+        }
+    }
+    return {
+        register(anchor, normalizedContent) {
+            accessCounter += 1;
+            const entry = {
+                anchor,
+                content: normalizedContent,
+                registeredAt: accessCounter,
+                lastAccess: accessCounter,
+            };
+            byId.set(anchor.readId, entry);
+            let pathSet = byPath.get(anchor.path);
+            if (!pathSet) {
+                pathSet = new Set();
+                byPath.set(anchor.path, pathSet);
+            }
+            pathSet.add(anchor.readId);
+            evictIfNeeded();
+        },
+        get(readId) {
+            const entry = byId.get(readId);
+            if (entry === undefined)
+                return undefined;
+            const touched = touch(entry);
+            byId.set(readId, touched);
+            return { anchor: touched.anchor, content: touched.content };
+        },
+        getByPath(path) {
+            const pathSet = byPath.get(path);
+            if (pathSet === undefined)
+                return [];
+            const anchors = [];
+            for (const readId of pathSet) {
+                const entry = byId.get(readId);
+                if (entry === undefined)
+                    continue;
+                const touched = touch(entry);
+                byId.set(readId, touched);
+                anchors.push(touched.anchor);
+            }
+            anchors.sort((a, b) => byId.get(b.readId).registeredAt - byId.get(a.readId).registeredAt);
+            return anchors;
+        },
+        invalidatePath(path) {
+            const pathSet = byPath.get(path);
+            if (pathSet === undefined)
+                return;
+            for (const readId of pathSet) {
+                byId.delete(readId);
+            }
+            byPath.delete(path);
+        },
+        clear() {
+            byId.clear();
+            byPath.clear();
+            accessCounter = 0;
+        },
+        get size() {
+            return byId.size;
+        },
+    };
+}
+//# sourceMappingURL=read-anchor-registry.js.map

package/dist/core/read-anchor-registry.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"read-anchor-registry.js","sourceRoot":"","sources":["../../src/core/read-anchor-registry.ts"],"names":[],"mappings":"AA6BA,MAAM,4BAA4B,GAAG,IAAI,CAAC;AAE1C,6EAA6E;AAC7E,MAAM,UAAU,4BAA4B,GAAiB;IAC5D,IAAI,OAAO,GAAG,CAAC,CAAC;IAChB,OAAO,GAAG,EAAE,CAAC;QACZ,OAAO,IAAI,CAAC,CAAC;QACb,OAAO,MAAM,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,EAAE,EAAE,GAAG,CAAC,EAAE,CAAC;IAAA,CACtD,CAAC;AAAA,CACF;AAED;;;GAGG;AACH,MAAM,UAAU,wBAAwB,CAAC,UAAU,GAAG,4BAA4B,EAAsB;IACvG,IAAI,aAAa,GAAG,CAAC,CAAC;IACtB,MAAM,IAAI,GAAG,IAAI,GAAG,EAAiB,CAAC;IACtC,MAAM,MAAM,GAAG,IAAI,GAAG,EAAuB,CAAC;IAE9C,SAAS,KAAK,CAAC,KAAY,EAAS;QACnC,aAAa,IAAI,CAAC,CAAC;QACnB,OAAO,EAAE,GAAG,KAAK,EAAE,UAAU,EAAE,aAAa,EAAE,CAAC;IAAA,CAC/C;IAED,SAAS,aAAa,GAAS;QAC9B,IAAI,IAAI,CAAC,IAAI,IAAI,UAAU;YAAE,OAAO;QACpC,IAAI,MAAyB,CAAC;QAC9B,KAAK,MAAM,KAAK,IAAI,IAAI,CAAC,MAAM,EAAE,EAAE,CAAC;YACnC,IAAI,MAAM,KAAK,SAAS,IAAI,KAAK,CAAC,UAAU,GAAG,MAAM,CAAC,UAAU,EAAE,CAAC;gBAClE,MAAM,GAAG,KAAK,CAAC;YAChB,CAAC;QACF,CAAC;QACD,IAAI,MAAM,KAAK,SAAS;YAAE,OAAO;QACjC,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;QAClC,MAAM,OAAO,GAAG,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;QAC/C,IAAI,OAAO,EAAE,CAAC;YACb,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;YACrC,IAAI,OAAO,CAAC,IAAI,KAAK,CAAC,EAAE,CAAC;gBACxB,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;YACnC,CAAC;QACF,CAAC;IAAA,CACD;IAED,OAAO;QACN,QAAQ,CAAC,MAAM,EAAE,iBAAiB,EAAE;YACnC,aAAa,IAAI,CAAC,CAAC;YACnB,MAAM,KAAK,GAAU;gBACpB,MAAM;gBACN,OAAO,EAAE,iBAAiB;gBAC1B,YAAY,EAAE,aAAa;gBAC3B,UAAU,EAAE,aAAa;aACzB,CAAC;YACF,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;YAC/B,IAAI,OAAO,GAAG,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;YACtC,IAAI,CAAC,OAAO,EAAE,CAAC;gBACd,OAAO,GAAG,IAAI,GAAG,EAAU,CAAC;gBAC5B,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;YAClC,CAAC;YACD,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;YAC3B,aAAa,EAAE,CAAC;QAAA,CAChB;QACD,GAAG,CAAC,MAAM,EAAE;YACX,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;YAC/B,IAAI,KAAK,KAAK,SAAS;gBAAE,OAAO,SAAS,CAAC;YAC1C,MAAM,OAAO,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC;YAC7B,IAAI,CAAC,GAAG,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;YAC1B,OAAO,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,OAAO,EAAE,OAAO,CAAC,OAAO,EAAE,CAAC;QAAA,CAC5D;QACD,SAAS,CAAC,IAAI,EAAE;YACf,MAAM,OAAO,GAAG,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;YACjC,IAAI,OAAO,KAAK,SAAS;gBAAE,OAAO,EAAE,CAAC;YACrC,MAAM,OAAO,GAAiB,EAAE,CAAC;YACjC,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;gBAC9B,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;gBAC/B,IAAI,KAAK,KAAK,SAAS;oBAAE,SAAS;gBAClC,MAAM,OAAO,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC;gBAC7B,IAAI,CAAC,GAAG,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;gBAC1B,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;YAC9B,CAAC;YACD,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,CAAE,CAAC,YAAY,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,CAAE,CAAC,YAAY,CAAC,CAAC;YAC5F,OAAO,OAAO,CAAC;QAAA,CACf;QACD,cAAc,CAAC,IAAI,EAAE;YACpB,MAAM,OAAO,GAAG,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;YACjC,IAAI,OAAO,KAAK,SAAS;gBAAE,OAAO;YAClC,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;gBAC9B,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;YACrB,CAAC;YACD,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;QAAA,CACpB;QACD,KAAK,GAAG;YACP,IAAI,CAAC,KAAK,EAAE,CAAC;YACb,MAAM,CAAC,KAAK,EAAE,CAAC;YACf,aAAa,GAAG,CAAC,CAAC;QAAA,CAClB;QACD,IAAI,IAAI,GAAG;YACV,OAAO,IAAI,CAAC,IAAI,CAAC;QAAA,CACjB;KACD,CAAC;AAAA,CACF","sourcesContent":["import type { ReadAnchor } from \"./read-anchors.ts\";\n\nexport interface ReadAnchorRegistryEntry {\n\treadonly anchor: ReadAnchor;\n\treadonly content: string;\n}\n\nexport interface ReadAnchorRegistry {\n\t/** Store an anchor and the newline-normalized full-file content it was derived from. */\n\tregister(anchor: ReadAnchor, normalizedContent: string): void;\n\t/** Look up a registered anchor and its stored content by readId. */\n\tget(readId: string): ReadAnchorRegistryEntry | undefined;\n\t/** Return all registered anchors for a path, newest first by registration time. */\n\tgetByPath(path: string): ReadAnchor[];\n\t/** Evict every entry associated with a path. */\n\tinvalidatePath(path: string): void;\n\t/** Evict every entry. */\n\tclear(): void;\n\t/** Number of currently stored anchors. */\n\treadonly size: number;\n}\n\ninterface Entry extends ReadAnchorRegistryEntry {\n\t/** Monotonic registration order; determines \"newest first\" for path queries. */\n\treadonly registeredAt: number;\n\t/** Monotonic last-access counter; drives deterministic LRU eviction. */\n\tlastAccess: number;\n}\n\nconst DEFAULT_MAX_REGISTRY_ENTRIES = 1000;\n\n/** Create a factory that yields deterministic, sortable, unique read ids. */\nexport function createMonotonicReadIdFactory(): () => string {\n\tlet counter = 0;\n\treturn () => {\n\t\tcounter += 1;\n\t\treturn `ra-${counter.toString(36).padStart(12, \"0\")}`;\n\t};\n}\n\n/**\n * Create a per-session registry that maps read ids to anchors and supports\n * path-indexed invalidation and deterministic LRU eviction.\n */\nexport function createReadAnchorRegistry(maxEntries = DEFAULT_MAX_REGISTRY_ENTRIES): ReadAnchorRegistry {\n\tlet accessCounter = 0;\n\tconst byId = new Map<string, Entry>();\n\tconst byPath = new Map<string, Set<string>>();\n\n\tfunction touch(entry: Entry): Entry {\n\t\taccessCounter += 1;\n\t\treturn { ...entry, lastAccess: accessCounter };\n\t}\n\n\tfunction evictIfNeeded(): void {\n\t\tif (byId.size <= maxEntries) return;\n\t\tlet oldest: Entry | undefined;\n\t\tfor (const entry of byId.values()) {\n\t\t\tif (oldest === undefined || entry.lastAccess < oldest.lastAccess) {\n\t\t\t\toldest = entry;\n\t\t\t}\n\t\t}\n\t\tif (oldest === undefined) return;\n\t\tbyId.delete(oldest.anchor.readId);\n\t\tconst pathSet = byPath.get(oldest.anchor.path);\n\t\tif (pathSet) {\n\t\t\tpathSet.delete(oldest.anchor.readId);\n\t\t\tif (pathSet.size === 0) {\n\t\t\t\tbyPath.delete(oldest.anchor.path);\n\t\t\t}\n\t\t}\n\t}\n\n\treturn {\n\t\tregister(anchor, normalizedContent) {\n\t\t\taccessCounter += 1;\n\t\t\tconst entry: Entry = {\n\t\t\t\tanchor,\n\t\t\t\tcontent: normalizedContent,\n\t\t\t\tregisteredAt: accessCounter,\n\t\t\t\tlastAccess: accessCounter,\n\t\t\t};\n\t\t\tbyId.set(anchor.readId, entry);\n\t\t\tlet pathSet = byPath.get(anchor.path);\n\t\t\tif (!pathSet) {\n\t\t\t\tpathSet = new Set<string>();\n\t\t\t\tbyPath.set(anchor.path, pathSet);\n\t\t\t}\n\t\t\tpathSet.add(anchor.readId);\n\t\t\tevictIfNeeded();\n\t\t},\n\t\tget(readId) {\n\t\t\tconst entry = byId.get(readId);\n\t\t\tif (entry === undefined) return undefined;\n\t\t\tconst touched = touch(entry);\n\t\t\tbyId.set(readId, touched);\n\t\t\treturn { anchor: touched.anchor, content: touched.content };\n\t\t},\n\t\tgetByPath(path) {\n\t\t\tconst pathSet = byPath.get(path);\n\t\t\tif (pathSet === undefined) return [];\n\t\t\tconst anchors: ReadAnchor[] = [];\n\t\t\tfor (const readId of pathSet) {\n\t\t\t\tconst entry = byId.get(readId);\n\t\t\t\tif (entry === undefined) continue;\n\t\t\t\tconst touched = touch(entry);\n\t\t\t\tbyId.set(readId, touched);\n\t\t\t\tanchors.push(touched.anchor);\n\t\t\t}\n\t\t\tanchors.sort((a, b) => byId.get(b.readId)!.registeredAt - byId.get(a.readId)!.registeredAt);\n\t\t\treturn anchors;\n\t\t},\n\t\tinvalidatePath(path) {\n\t\t\tconst pathSet = byPath.get(path);\n\t\t\tif (pathSet === undefined) return;\n\t\t\tfor (const readId of pathSet) {\n\t\t\t\tbyId.delete(readId);\n\t\t\t}\n\t\t\tbyPath.delete(path);\n\t\t},\n\t\tclear() {\n\t\t\tbyId.clear();\n\t\t\tbyPath.clear();\n\t\t\taccessCounter = 0;\n\t\t},\n\t\tget size() {\n\t\t\treturn byId.size;\n\t\t},\n\t};\n}\n"]}

package/dist/core/read-anchors.d.ts

@@ -0,0 +1,110 @@
+/**
+ * `omk.read-anchor` — pure hash-anchored read/edit primitives.
+ *
+ * A read anchor binds a read result to the exact bytes the model saw: the
+ * newline-normalized SHA-256 of the whole file plus the SHA-256 of the specific
+ * line block that was read. Edits can then carry the anchor so the core can
+ * reject stale edits (the file changed under the model) before applying them.
+ *
+ * All hashing in this module is performed on newline-normalized (LF) UTF-8
+ * content so anchors are robust to CRLF/CR differences, matching the edit
+ * pipeline which normalizes to LF before matching.
+ *
+ * Side-effect free: no filesystem access; `node:crypto` only.
+ *
+ * Derived clean-room from the lane C plan
+ * (`.omk/runs/omk-pi-package-hardening-plan/recovery-readseek.md`); no Pi
+ * package source is imported or copied.
+ */
+export declare const READ_ANCHOR_SCHEMA_VERSION = "omk.read-anchor.v1";
+export interface ReadAnchorRange {
+    /** 1-indexed start line (resolved). */
+    readonly offset: number;
+    /** Number of lines included in the block (resolved). */
+    readonly limit: number;
+    /** 1-indexed last line included, inclusive. Equals `offset - 1` for an empty block. */
+    readonly endLine: number;
+}
+export interface ReadAnchor {
+    readonly schemaVersion: typeof READ_ANCHOR_SCHEMA_VERSION;
+    readonly readId: string;
+    readonly path: string;
+    /** SHA-256 (hex) of the newline-normalized full file content. */
+    readonly fileSha256: string;
+    readonly range: ReadAnchorRange;
+    /** SHA-256 (hex) of the newline-normalized read block content. */
+    readonly blockSha256: string;
+}
+export interface CreateReadAnchorInput {
+    readonly path: string;
+    /** Full file content as read. */
+    readonly content: string;
+    /** 1-indexed start line; defaults to 1 (whole file). */
+    readonly offset?: number;
+    /** Maximum number of lines; defaults to the rest of the file. */
+    readonly limit?: number;
+    /** Optional deterministic id (otherwise a UUID is generated). */
+    readonly readId?: string;
+}
+/**
+ * Create a hash anchor for a read. Hashes both the full (normalized) file and
+ * the specific line block so a later edit can prove it is operating on the same
+ * bytes the model saw.
+ */
+export declare function createReadAnchor(input: CreateReadAnchorInput): ReadAnchor;
+export interface ReadAnchorVerification {
+    readonly ok: boolean;
+    readonly fileMatches: boolean;
+    readonly blockMatches: boolean;
+    readonly currentFileSha256: string;
+    readonly currentBlockSha256: string;
+}
+/**
+ * Verify an anchor against the current file content. `fileMatches` is the strict
+ * whole-file check; `blockMatches` re-extracts the anchored range and compares
+ * the block hash (useful for lenient relocation diagnostics).
+ */
+export declare function verifyReadAnchor(anchor: ReadAnchor, currentContent: string): ReadAnchorVerification;
+/** Validate an untrusted value as a {@link ReadAnchor}. Pure and fail-closed. */
+export declare function validateReadAnchor(value: unknown): {
+    ok: boolean;
+    errors: readonly string[];
+    anchor?: ReadAnchor;
+};
+export type AnchoredEditMode = "strict" | "lenient";
+export type AnchoredEditVerdict = "allow" | "allow-lenient" | "reject-stale";
+export interface AnchoredEditDecisionInput {
+    readonly anchor: ReadAnchor;
+    /** Current full file content at edit time. */
+    readonly currentContent: string;
+    /** Defaults to `strict`. */
+    readonly mode?: AnchoredEditMode;
+    /**
+     * The exact anchored block text (typically the edit's `oldText`). Required
+     * for lenient relocation when the file has changed; must hash to
+     * `anchor.blockSha256` to be trusted.
+     */
+    readonly anchoredBlockText?: string;
+}
+export interface AnchoredEditDecision {
+    readonly verdict: AnchoredEditVerdict;
+    readonly reason: string;
+    readonly currentFileSha256: string;
+    readonly fileChanged: boolean;
+    /** Lenient mode only: whether the anchored block was uniquely relocated. */
+    readonly blockRelocated?: boolean;
+    /** Lenient mode only: occurrences of the anchored block in current content. */
+    readonly occurrences?: number;
+}
+/**
+ * Decide whether an anchored edit may proceed.
+ *
+ *  - Unchanged file -> `allow` (the common fast path).
+ *  - Changed file, strict mode -> `reject-stale` (the default; forces a re-read).
+ *  - Changed file, lenient mode -> `allow-lenient` only when the anchored block
+ *    text is supplied, hashes to the recorded `blockSha256`, and still occurs
+ *    exactly once in the current content (unique, non-overlapping relocation).
+ *    Zero or multiple occurrences -> `reject-stale`.
+ */
+export declare function decideAnchoredEdit(input: AnchoredEditDecisionInput): AnchoredEditDecision;
+//# sourceMappingURL=read-anchors.d.ts.map

package/dist/core/read-anchors.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"read-anchors.d.ts","sourceRoot":"","sources":["../../src/core/read-anchors.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AAIH,eAAO,MAAM,0BAA0B,uBAAuB,CAAC;AAE/D,MAAM,WAAW,eAAe;IAC/B,uCAAuC;IACvC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,wDAAwD;IACxD,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,uFAAuF;IACvF,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;CACzB;AAED,MAAM,WAAW,UAAU;IAC1B,QAAQ,CAAC,aAAa,EAAE,OAAO,0BAA0B,CAAC;IAC1D,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,iEAAiE;IACjE,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,KAAK,EAAE,eAAe,CAAC;IAChC,kEAAkE;IAClE,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;CAC7B;AAqCD,MAAM,WAAW,qBAAqB;IACrC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,iCAAiC;IACjC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,wDAAwD;IACxD,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IACzB,iEAAiE;IACjE,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC;IACxB,iEAAiE;IACjE,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;CACzB;AAED;;;;GAIG;AACH,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,qBAAqB,GAAG,UAAU,CAWzE;AAED,MAAM,WAAW,sBAAsB;IACtC,QAAQ,CAAC,EAAE,EAAE,OAAO,CAAC;IACrB,QAAQ,CAAC,WAAW,EAAE,OAAO,CAAC;IAC9B,QAAQ,CAAC,YAAY,EAAE,OAAO,CAAC;IAC/B,QAAQ,CAAC,iBAAiB,EAAE,MAAM,CAAC;IACnC,QAAQ,CAAC,kBAAkB,EAAE,MAAM,CAAC;CACpC;AAED;;;;GAIG;AACH,wBAAgB,gBAAgB,CAAC,MAAM,EAAE,UAAU,EAAE,cAAc,EAAE,MAAM,GAAG,sBAAsB,CAcnG;AAED,iFAAiF;AACjF,wBAAgB,kBAAkB,CAAC,KAAK,EAAE,OAAO,GAAG;IAAE,EAAE,EAAE,OAAO,CAAC;IAAC,MAAM,EAAE,SAAS,MAAM,EAAE,CAAC;IAAC,MAAM,CAAC,EAAE,UAAU,CAAA;CAAE,CA+BlH;AAED,MAAM,MAAM,gBAAgB,GAAG,QAAQ,GAAG,SAAS,CAAC;AAEpD,MAAM,MAAM,mBAAmB,GAAG,OAAO,GAAG,eAAe,GAAG,cAAc,CAAC;AAE7E,MAAM,WAAW,yBAAyB;IACzC,QAAQ,CAAC,MAAM,EAAE,UAAU,CAAC;IAC5B,8CAA8C;IAC9C,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAC;IAChC,4BAA4B;IAC5B,QAAQ,CAAC,IAAI,CAAC,EAAE,gBAAgB,CAAC;IACjC;;;;OAIG;IACH,QAAQ,CAAC,iBAAiB,CAAC,EAAE,MAAM,CAAC;CACpC;AAED,MAAM,WAAW,oBAAoB;IACpC,QAAQ,CAAC,OAAO,EAAE,mBAAmB,CAAC;IACtC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,iBAAiB,EAAE,MAAM,CAAC;IACnC,QAAQ,CAAC,WAAW,EAAE,OAAO,CAAC;IAC9B,4EAA4E;IAC5E,QAAQ,CAAC,cAAc,CAAC,EAAE,OAAO,CAAC;IAClC,+EAA+E;IAC/E,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;CAC9B;AAeD;;;;;;;;;GASG;AACH,wBAAgB,kBAAkB,CAAC,KAAK,EAAE,yBAAyB,GAAG,oBAAoB,CAwDzF","sourcesContent":["/**\n * `omk.read-anchor` — pure hash-anchored read/edit primitives.\n *\n * A read anchor binds a read result to the exact bytes the model saw: the\n * newline-normalized SHA-256 of the whole file plus the SHA-256 of the specific\n * line block that was read. Edits can then carry the anchor so the core can\n * reject stale edits (the file changed under the model) before applying them.\n *\n * All hashing in this module is performed on newline-normalized (LF) UTF-8\n * content so anchors are robust to CRLF/CR differences, matching the edit\n * pipeline which normalizes to LF before matching.\n *\n * Side-effect free: no filesystem access; `node:crypto` only.\n *\n * Derived clean-room from the lane C plan\n * (`.omk/runs/omk-pi-package-hardening-plan/recovery-readseek.md`); no Pi\n * package source is imported or copied.\n */\n\nimport { createHash, randomUUID } from \"node:crypto\";\n\nexport const READ_ANCHOR_SCHEMA_VERSION = \"omk.read-anchor.v1\";\n\nexport interface ReadAnchorRange {\n\t/** 1-indexed start line (resolved). */\n\treadonly offset: number;\n\t/** Number of lines included in the block (resolved). */\n\treadonly limit: number;\n\t/** 1-indexed last line included, inclusive. Equals `offset - 1` for an empty block. */\n\treadonly endLine: number;\n}\n\nexport interface ReadAnchor {\n\treadonly schemaVersion: typeof READ_ANCHOR_SCHEMA_VERSION;\n\treadonly readId: string;\n\treadonly path: string;\n\t/** SHA-256 (hex) of the newline-normalized full file content. */\n\treadonly fileSha256: string;\n\treadonly range: ReadAnchorRange;\n\t/** SHA-256 (hex) of the newline-normalized read block content. */\n\treadonly blockSha256: string;\n}\n\nconst HEX64 = /^[0-9a-f]{64}$/i;\n\nfunction normalizeNewlines(content: string): string {\n\treturn content.replace(/\\r\\n/g, \"\\n\").replace(/\\r/g, \"\\n\");\n}\n\nfunction sha256Hex(content: string): string {\n\treturn createHash(\"sha256\").update(content, \"utf8\").digest(\"hex\");\n}\n\ninterface ExtractedBlock {\n\treadonly text: string;\n\treadonly range: ReadAnchorRange;\n}\n\n/**\n * Extract a line block from already newline-normalized content using read-tool\n * semantics: `offset` is a 1-indexed start line, `limit` is the maximum number\n * of lines. Out-of-range requests clamp to an empty block at the end of file.\n */\nfunction extractBlock(normalized: string, offset: number | undefined, limit: number | undefined): ExtractedBlock {\n\tconst lines = normalized.split(\"\\n\");\n\tconst start = Math.max(1, Math.floor(offset ?? 1));\n\tif (start > lines.length) {\n\t\treturn { text: \"\", range: { offset: start, limit: 0, endLine: start - 1 } };\n\t}\n\tconst available = lines.length - (start - 1);\n\tconst count = limit === undefined ? available : Math.max(0, Math.min(Math.floor(limit), available));\n\tconst blockLines = lines.slice(start - 1, start - 1 + count);\n\treturn {\n\t\ttext: blockLines.join(\"\\n\"),\n\t\trange: { offset: start, limit: count, endLine: start - 1 + count },\n\t};\n}\n\nexport interface CreateReadAnchorInput {\n\treadonly path: string;\n\t/** Full file content as read. */\n\treadonly content: string;\n\t/** 1-indexed start line; defaults to 1 (whole file). */\n\treadonly offset?: number;\n\t/** Maximum number of lines; defaults to the rest of the file. */\n\treadonly limit?: number;\n\t/** Optional deterministic id (otherwise a UUID is generated). */\n\treadonly readId?: string;\n}\n\n/**\n * Create a hash anchor for a read. Hashes both the full (normalized) file and\n * the specific line block so a later edit can prove it is operating on the same\n * bytes the model saw.\n */\nexport function createReadAnchor(input: CreateReadAnchorInput): ReadAnchor {\n\tconst normalized = normalizeNewlines(input.content);\n\tconst block = extractBlock(normalized, input.offset, input.limit);\n\treturn {\n\t\tschemaVersion: READ_ANCHOR_SCHEMA_VERSION,\n\t\treadId: input.readId ?? randomUUID(),\n\t\tpath: input.path,\n\t\tfileSha256: sha256Hex(normalized),\n\t\trange: block.range,\n\t\tblockSha256: sha256Hex(block.text),\n\t};\n}\n\nexport interface ReadAnchorVerification {\n\treadonly ok: boolean;\n\treadonly fileMatches: boolean;\n\treadonly blockMatches: boolean;\n\treadonly currentFileSha256: string;\n\treadonly currentBlockSha256: string;\n}\n\n/**\n * Verify an anchor against the current file content. `fileMatches` is the strict\n * whole-file check; `blockMatches` re-extracts the anchored range and compares\n * the block hash (useful for lenient relocation diagnostics).\n */\nexport function verifyReadAnchor(anchor: ReadAnchor, currentContent: string): ReadAnchorVerification {\n\tconst normalized = normalizeNewlines(currentContent);\n\tconst currentFileSha256 = sha256Hex(normalized);\n\tconst block = extractBlock(normalized, anchor.range.offset, anchor.range.limit);\n\tconst currentBlockSha256 = sha256Hex(block.text);\n\tconst fileMatches = currentFileSha256 === anchor.fileSha256;\n\tconst blockMatches = currentBlockSha256 === anchor.blockSha256;\n\treturn {\n\t\tok: fileMatches && blockMatches,\n\t\tfileMatches,\n\t\tblockMatches,\n\t\tcurrentFileSha256,\n\t\tcurrentBlockSha256,\n\t};\n}\n\n/** Validate an untrusted value as a {@link ReadAnchor}. Pure and fail-closed. */\nexport function validateReadAnchor(value: unknown): { ok: boolean; errors: readonly string[]; anchor?: ReadAnchor } {\n\tconst errors: string[] = [];\n\tif (typeof value !== \"object\" || value === null || Array.isArray(value)) {\n\t\treturn { ok: false, errors: [\"anchor must be an object\"] };\n\t}\n\tconst anchor = value as Record<string, unknown>;\n\tif (anchor.schemaVersion !== READ_ANCHOR_SCHEMA_VERSION) {\n\t\terrors.push(`schemaVersion must be ${READ_ANCHOR_SCHEMA_VERSION}`);\n\t}\n\tif (typeof anchor.readId !== \"string\" || anchor.readId.length === 0)\n\t\terrors.push(\"readId must be a non-empty string\");\n\tif (typeof anchor.path !== \"string\" || anchor.path.length === 0) errors.push(\"path must be a non-empty string\");\n\tif (typeof anchor.fileSha256 !== \"string\" || !HEX64.test(anchor.fileSha256)) {\n\t\terrors.push(\"fileSha256 must be a 64-char hex digest\");\n\t}\n\tif (typeof anchor.blockSha256 !== \"string\" || !HEX64.test(anchor.blockSha256)) {\n\t\terrors.push(\"blockSha256 must be a 64-char hex digest\");\n\t}\n\tconst range = anchor.range;\n\tif (typeof range !== \"object\" || range === null || Array.isArray(range)) {\n\t\terrors.push(\"range must be an object\");\n\t} else {\n\t\tconst r = range as Record<string, unknown>;\n\t\tfor (const key of [\"offset\", \"limit\", \"endLine\"]) {\n\t\t\tif (typeof r[key] !== \"number\" || !Number.isInteger(r[key]) || (r[key] as number) < 0) {\n\t\t\t\terrors.push(`range.${key} must be a non-negative integer`);\n\t\t\t}\n\t\t}\n\t}\n\tif (errors.length > 0) return { ok: false, errors };\n\treturn { ok: true, errors: [], anchor: value as unknown as ReadAnchor };\n}\n\nexport type AnchoredEditMode = \"strict\" | \"lenient\";\n\nexport type AnchoredEditVerdict = \"allow\" | \"allow-lenient\" | \"reject-stale\";\n\nexport interface AnchoredEditDecisionInput {\n\treadonly anchor: ReadAnchor;\n\t/** Current full file content at edit time. */\n\treadonly currentContent: string;\n\t/** Defaults to `strict`. */\n\treadonly mode?: AnchoredEditMode;\n\t/**\n\t * The exact anchored block text (typically the edit's `oldText`). Required\n\t * for lenient relocation when the file has changed; must hash to\n\t * `anchor.blockSha256` to be trusted.\n\t */\n\treadonly anchoredBlockText?: string;\n}\n\nexport interface AnchoredEditDecision {\n\treadonly verdict: AnchoredEditVerdict;\n\treadonly reason: string;\n\treadonly currentFileSha256: string;\n\treadonly fileChanged: boolean;\n\t/** Lenient mode only: whether the anchored block was uniquely relocated. */\n\treadonly blockRelocated?: boolean;\n\t/** Lenient mode only: occurrences of the anchored block in current content. */\n\treadonly occurrences?: number;\n}\n\nfunction countOccurrences(haystack: string, needle: string): number {\n\tif (needle.length === 0) return 0;\n\tlet count = 0;\n\tlet index = haystack.indexOf(needle);\n\twhile (index !== -1) {\n\t\tcount += 1;\n\t\tindex = haystack.indexOf(needle, index + needle.length);\n\t}\n\treturn count;\n}\n\nconst STALE_REREAD_HINT = \"stale read: the file changed since it was read; re-read the file before editing\";\n\n/**\n * Decide whether an anchored edit may proceed.\n *\n *  - Unchanged file -> `allow` (the common fast path).\n *  - Changed file, strict mode -> `reject-stale` (the default; forces a re-read).\n *  - Changed file, lenient mode -> `allow-lenient` only when the anchored block\n *    text is supplied, hashes to the recorded `blockSha256`, and still occurs\n *    exactly once in the current content (unique, non-overlapping relocation).\n *    Zero or multiple occurrences -> `reject-stale`.\n */\nexport function decideAnchoredEdit(input: AnchoredEditDecisionInput): AnchoredEditDecision {\n\tconst mode = input.mode ?? \"strict\";\n\tconst normalized = normalizeNewlines(input.currentContent);\n\tconst currentFileSha256 = sha256Hex(normalized);\n\tconst fileChanged = currentFileSha256 !== input.anchor.fileSha256;\n\n\tif (!fileChanged) {\n\t\treturn { verdict: \"allow\", reason: \"current file hash matches the anchor\", currentFileSha256, fileChanged };\n\t}\n\n\tif (mode === \"strict\") {\n\t\treturn { verdict: \"reject-stale\", reason: STALE_REREAD_HINT, currentFileSha256, fileChanged };\n\t}\n\n\tconst blockText = input.anchoredBlockText;\n\tif (blockText === undefined || blockText.length === 0) {\n\t\treturn {\n\t\t\tverdict: \"reject-stale\",\n\t\t\treason: \"lenient relocation requires the anchored block text\",\n\t\t\tcurrentFileSha256,\n\t\t\tfileChanged,\n\t\t};\n\t}\n\n\tconst normalizedBlock = normalizeNewlines(blockText);\n\tif (sha256Hex(normalizedBlock) !== input.anchor.blockSha256) {\n\t\treturn {\n\t\t\tverdict: \"reject-stale\",\n\t\t\treason: \"supplied block text does not match the anchored block hash\",\n\t\t\tcurrentFileSha256,\n\t\t\tfileChanged,\n\t\t};\n\t}\n\n\tconst occurrences = countOccurrences(normalized, normalizedBlock);\n\tif (occurrences === 1) {\n\t\treturn {\n\t\t\tverdict: \"allow-lenient\",\n\t\t\treason: \"file changed but the anchored block is still uniquely locatable\",\n\t\t\tcurrentFileSha256,\n\t\t\tfileChanged,\n\t\t\tblockRelocated: true,\n\t\t\toccurrences,\n\t\t};\n\t}\n\treturn {\n\t\tverdict: \"reject-stale\",\n\t\treason:\n\t\t\toccurrences === 0\n\t\t\t\t? \"anchored block no longer exists in the current file\"\n\t\t\t\t: \"anchored block is ambiguous (multiple matches) in the current file\",\n\t\tcurrentFileSha256,\n\t\tfileChanged,\n\t\tblockRelocated: false,\n\t\toccurrences,\n\t};\n}\n"]}