open-multi-agent-kit 0.80.6 → 0.80.8

package/dist/core/package-procurement.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"package-procurement.js","sourceRoot":"","sources":["../../src/core/package-procurement.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAEH,OAAO,EAAE,WAAW,EAAE,MAAM,iBAAiB,CAAC;AA+G9C,8EAA8E;AAC9E,+BAA+B;AAC/B,8EAA8E;AAE9E,sEAAsE;AACtE,MAAM,CAAC,MAAM,oBAAoB,GAChC,2FAA2F,CAAC;AAE7F,MAAM,SAAS,GAAG,IAAI,GAAG,CAAC;IACzB,QAAQ;IACR,MAAM;IACN,MAAM;IACN,OAAO;IACP,QAAQ;IACR,IAAI;IACJ,KAAK;IACL,SAAS;IACT,QAAQ;IACR,cAAc;IACd,UAAU;CACV,CAAC,CAAC;AAEH,0EAA0E;AAC1E,MAAM,eAAe,GAAG,yBAAyB,CAAC;AAOlD,MAAM,UAAU,uBAAuB,CAAC,OAA2B,EAAqB;IACvF,MAAM,KAAK,GAAG,CAAC,OAAO,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;IACrC,IAAI,CAAC,KAAK,EAAE,CAAC;QACZ,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,SAAS,EAAE,OAAO,EAAE,2BAA2B,EAAE,CAAC;IAC/E,CAAC;IACD,IAAI,SAAS,CAAC,GAAG,CAAC,KAAK,CAAC,WAAW,EAAE,CAAC,EAAE,CAAC;QACxC,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,UAAU,EAAE,OAAO,EAAE,aAAa,KAAK,cAAc,EAAE,CAAC;IACrF,CAAC;IACD,IAAI,oBAAoB,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;QACtC,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;IACrC,CAAC;IACD,IAAI,eAAe,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;QACjC,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,OAAO,EAAE,mBAAmB,KAAK,2BAA2B,EAAE,CAAC;IACrG,CAAC;IACD,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,SAAS,EAAE,OAAO,EAAE,IAAI,KAAK,+BAA+B,EAAE,CAAC;AAAA,CAC3F;AAED,8EAA8E;AAC9E,8BAA8B;AAC9B,8EAA8E;AAE9E,MAAM,gBAAgB,GAAG,0DAA0D,CAAC;AAIpF,MAAM,UAAU,sBAAsB,CAAC,IAAY,EAAkB;IACpE,MAAM,KAAK,GAAG,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;IAClC,IAAI,CAAC,KAAK,EAAE,CAAC;QACZ,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,0BAA0B,EAAE,CAAC;IAC3D,CAAC;IACD,IAAI,KAAK,CAAC,MAAM,GAAG,GAAG,EAAE,CAAC;QACxB,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,qCAAqC,EAAE,CAAC;IACtE,CAAC;IACD,IAAI,KAAK,KAAK,KAAK,CAAC,WAAW,EAAE,EAAE,CAAC;QACnC,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,gCAAgC,EAAE,CAAC;IACjE,CAAC;IACD,IAAI,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;QAC1B,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,8CAA8C,EAAE,CAAC;IAC/E,CAAC;IACD,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;QACnC,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,IAAI,KAAK,mCAAmC,EAAE,CAAC;IAC7E,CAAC;IACD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC;AAAA,CACjC;AAED,8EAA8E;AAC9E,qBAAqB;AACrB,8EAA8E;AAE9E,MAAM,QAAQ,GAAG,iCAAiC,CAAC;AACnD,MAAM,QAAQ,GAAG,aAAa,CAAC;AAC/B,MAAM,gBAAgB,GAAG,IAAI,GAAG,CAAC,CAAC,MAAM,EAAE,QAAQ,EAAE,SAAS,EAAE,KAAK,EAAE,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,QAAQ,EAAE,QAAQ,CAAC,CAAC,CAAC;AAOvH,MAAM,UAAU,cAAc,CAAC,GAAuB,EAAE,cAAuB,EAAiB;IAC/F,MAAM,KAAK,GAAG,CAAC,GAAG,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;IACjC,IAAI,CAAC,KAAK,EAAE,CAAC;QACZ,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,SAAS,EAAE,OAAO,EAAE,qBAAqB,EAAE,CAAC;IACzE,CAAC;IACD,IAAI,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;QAC1B,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,GAAG,EAAE,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC;IAChE,CAAC;IAED,MAAM,KAAK,GAAG,KAAK,CAAC,WAAW,EAAE,CAAC;IAClC,IAAI,gBAAgB,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,KAAK,KAAK,MAAM,IAAI,KAAK,CAAC,UAAU,CAAC,aAAa,CAAC,EAAE,CAAC;QACxF,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,gBAAgB,EAAE,OAAO,EAAE,IAAI,KAAK,uBAAuB,EAAE,CAAC;IAC3F,CAAC;IACD,IAAI,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,MAAM,GAAG,EAAE,EAAE,CAAC;QAC/C,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,WAAW,EAAE,OAAO,EAAE,IAAI,KAAK,+CAA+C,EAAE,CAAC;IAC9G,CAAC;IAED,wFAAwF;IACxF,MAAM,MAAM,GAAG,CAAC,cAAc,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;IAC7C,IAAI,CAAC,MAAM,EAAE,CAAC;QACb,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,gBAAgB,EAAE,OAAO,EAAE,QAAQ,KAAK,wCAAwC,EAAE,CAAC;IAChH,CAAC;IACD,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC;QAC5B,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,SAAS,EAAE,OAAO,EAAE,mBAAmB,MAAM,qBAAqB,EAAE,CAAC;IAClG,CAAC;IACD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,GAAG,EAAE,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,cAAc,EAAE,CAAC;AAAA,CAC9D;AAYD,MAAM,UAAU,kBAAkB,CAAC,KAA4B,EAAuB;IACrF,MAAM,OAAO,GAAa,EAAE,CAAC;IAC7B,MAAM,MAAM,GAAG,OAAO,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC;IAC3C,MAAM,MAAM,GAAG,OAAO,CAAC,KAAK,CAAC,OAAO,IAAI,KAAK,CAAC,MAAM,CAAC,CAAC;IAEtD,IAAI,MAAM,IAAI,MAAM,EAAE,CAAC;QACtB,OAAO,CAAC,IAAI,CAAC,kFAAkF,CAAC,CAAC;QACjG,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC;IAC/B,CAAC;IACD,IAAI,CAAC,MAAM,IAAI,CAAC,MAAM,EAAE,CAAC;QACxB,OAAO,CAAC,IAAI,CAAC,oEAAoE,CAAC,CAAC;QACnF,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC;IAC/B,CAAC;IAED,IAAI,MAAM,EAAE,CAAC;QACZ,MAAM,SAAS,GAAG,sBAAsB,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QACrD,IAAI,CAAC,SAAS,CAAC,EAAE;YAAE,OAAO,CAAC,IAAI,CAAC,qBAAqB,SAAS,CAAC,OAAO,EAAE,CAAC,CAAC;QAC1E,MAAM,YAAY,GAAG,uBAAuB,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC;QACjE,IAAI,CAAC,YAAY,CAAC,EAAE;YAAE,OAAO,CAAC,IAAI,CAAC,YAAY,YAAY,CAAC,OAAO,EAAE,CAAC,CAAC;QACvE,IAAI,SAAS,CAAC,EAAE,IAAI,YAAY,CAAC,EAAE,EAAE,CAAC;YACrC,OAAO;gBACN,EAAE,EAAE,IAAI;gBACR,IAAI,EAAE,KAAK;gBACX,MAAM,EAAE,OAAO,SAAS,CAAC,IAAI,IAAI,YAAY,CAAC,OAAO,EAAE;gBACvD,IAAI,EAAE,SAAS,CAAC,IAAI;gBACpB,OAAO,EAAE,YAAY,CAAC,OAAO;aAC7B,CAAC;QACH,CAAC;QACD,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC;IAC/B,CAAC;IAED,MAAM;IACN,MAAM,GAAG,GAAG,cAAc,CAAC,KAAK,CAAC,OAAO,IAAI,EAAE,CAAC,CAAC;IAChD,IAAI,CAAC,GAAG;QAAE,OAAO,CAAC,IAAI,CAAC,gEAAgE,CAAC,CAAC;IACzF,MAAM,QAAQ,GAAG,cAAc,CAAC,KAAK,CAAC,MAAM,EAAE,KAAK,CAAC,cAAc,CAAC,CAAC;IACpE,IAAI,CAAC,QAAQ,CAAC,EAAE;QAAE,OAAO,CAAC,IAAI,CAAC,YAAY,QAAQ,CAAC,OAAO,EAAE,CAAC,CAAC;IAC/D,IAAI,GAAG,IAAI,QAAQ,CAAC,EAAE,EAAE,CAAC;QACxB,OAAO;YACN,EAAE,EAAE,IAAI;YACR,IAAI,EAAE,KAAK;YACX,MAAM,EAAE,OAAO,GAAG,CAAC,IAAI,IAAI,GAAG,CAAC,IAAI,IAAI,QAAQ,CAAC,MAAM,EAAE;YACxD,IAAI,EAAE,GAAG,CAAC,IAAI;YACd,IAAI,EAAE,GAAG,CAAC,IAAI;YACd,IAAI,EAAE,GAAG,CAAC,IAAI;YACd,GAAG,EAAE,QAAQ,CAAC,GAAG;YACjB,MAAM,EAAE,QAAQ,CAAC,MAAM;SACvB,CAAC;IACH,CAAC;IACD,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC;AAAA,CAC9B;AAED,SAAS,cAAc,CAAC,IAAY,EAAuD;IAC1F,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;IAC5B,IAAI,CAAC,OAAO;QAAE,OAAO,IAAI,CAAC;IAC1B,MAAM,MAAM,GAAG,WAAW,CAAC,OAAO,CAAC,IAAI,WAAW,CAAC,OAAO,OAAO,EAAE,CAAC,CAAC;IACrE,IAAI,CAAC,MAAM;QAAE,OAAO,IAAI,CAAC;IACzB,OAAO,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,CAAC;AAAA,CACnE;AAsBD,MAAM,mBAAmB,GAAG,IAAI,GAAG,CAAC;IACnC,KAAK;IACL,OAAO;IACP,KAAK;IACL,KAAK;IACL,cAAc;IACd,cAAc;IACd,YAAY;IACZ,MAAM;IACN,WAAW;IACX,SAAS;IACT,eAAe;IACf,MAAM;IACN,YAAY;IACZ,OAAO;CACP,CAAC,CAAC;AAEH,MAAM,wBAAwB,GAAG,IAAI,GAAG,CAAC,CAAC,YAAY,EAAE,KAAK,EAAE,cAAc,EAAE,cAAc,EAAE,SAAS,CAAC,CAAC,CAAC;AAE3G,SAAS,UAAU,CAAC,OAAe,EAAU;IAC5C,OAAO,OAAO,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;AAAA,CACxD;AAED,MAAM,UAAU,eAAe,CAAC,OAA2B,EAAyB;IACnF,IAAI,CAAC,OAAO,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE;QAAE,OAAO,SAAS,CAAC;IAClD,MAAM,GAAG,GAAG,UAAU,CAAC,OAAO,CAAC,CAAC;IAChC,IAAI,GAAG,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,GAAG,CAAC,QAAQ,CAAC,MAAM,CAAC;QAAE,OAAO,kBAAkB,CAAC;IAC5E,IAAI,GAAG,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,GAAG,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,GAAG,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,GAAG,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;QAChG,OAAO,eAAe,CAAC;IACxB,CAAC;IACD,IAAI,GAAG,CAAC,QAAQ,CAAC,KAAK,CAAC;QAAE,OAAO,iBAAiB,CAAC;IAClD,IAAI,mBAAmB,CAAC,GAAG,CAAC,GAAG,CAAC;QAAE,OAAO,YAAY,CAAC;IACtD,OAAO,SAAS,CAAC;AAAA,CACjB;AAED,MAAM,UAAU,eAAe,CAAC,KAAmB,EAAwB;IAC1E,MAAM,OAAO,GAAa,EAAE,CAAC;IAC7B,MAAM,cAAc,GAAG,eAAe,CAAC,KAAK,CAAC,eAAe,CAAC,CAAC;IAC9D,MAAM,YAAY,GACjB,OAAO,CAAC,KAAK,CAAC,eAAe,CAAC;QAC9B,CAAC,wBAAwB,CAAC,GAAG,CAAC,UAAU,CAAC,KAAK,CAAC,eAAe,IAAI,EAAE,CAAC,CAAC,IAAI,cAAc,KAAK,eAAe,CAAC,CAAC;IAE/G,IAAI,cAAc,KAAK,SAAS,EAAE,CAAC;QAClC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,eAAe,CAAC,CAAC,CAAC,yBAAyB,KAAK,CAAC,eAAe,EAAE,CAAC,CAAC,CAAC,iBAAiB,CAAC,CAAC;QAC3G,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,cAAc,EAAE,YAAY,EAAE,OAAO,EAAE,CAAC;IACrE,CAAC;IACD,IAAI,cAAc,KAAK,kBAAkB,IAAI,cAAc,KAAK,iBAAiB,EAAE,CAAC;QACnF,OAAO,CAAC,IAAI,CAAC,6BAA6B,KAAK,CAAC,eAAe,EAAE,CAAC,CAAC;QACnE,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,cAAc,EAAE,YAAY,EAAE,OAAO,EAAE,CAAC;IACrE,CAAC;IACD,IAAI,cAAc,KAAK,eAAe,EAAE,CAAC;QACxC,OAAO,CAAC,IAAI,CAAC,+BAA+B,KAAK,CAAC,eAAe,EAAE,CAAC,CAAC;QACrE,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,cAAc,EAAE,YAAY,EAAE,OAAO,EAAE,CAAC;IACrE,CAAC;IAED,+EAA+E;IAC/E,IACC,KAAK,CAAC,WAAW,KAAK,iBAAiB;QACvC,CAAC,CAAC,KAAK,CAAC,kBAAkB,IAAI,KAAK,CAAC,kBAAkB,CAAC,MAAM,KAAK,CAAC,CAAC,EACnE,CAAC;QACF,OAAO,CAAC,IAAI,CAAC,uCAAuC,CAAC,CAAC;QACtD,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,cAAc,EAAE,YAAY,EAAE,OAAO,EAAE,CAAC;IACrE,CAAC;IACD,IAAI,KAAK,CAAC,kBAAkB,EAAE,CAAC;QAC9B,KAAK,MAAM,UAAU,IAAI,KAAK,CAAC,kBAAkB,EAAE,CAAC;YACnD,MAAM,eAAe,GAAG,eAAe,CAAC,UAAU,CAAC,CAAC;YACpD,IAAI,eAAe,KAAK,iBAAiB,IAAI,eAAe,KAAK,kBAAkB,EAAE,CAAC;gBACrF,OAAO,CAAC,IAAI,CAAC,wBAAwB,UAAU,EAAE,CAAC,CAAC;gBACnD,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,cAAc,EAAE,YAAY,EAAE,OAAO,EAAE,CAAC;YACrE,CAAC;YACD,IAAI,eAAe,KAAK,SAAS,IAAI,eAAe,KAAK,eAAe,EAAE,CAAC;gBAC1E,OAAO,CAAC,IAAI,CAAC,4BAA4B,UAAU,EAAE,CAAC,CAAC;gBACvD,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,cAAc,EAAE,YAAY,EAAE,OAAO,EAAE,CAAC;YACrE,CAAC;QACF,CAAC;IACF,CAAC;IACD,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,cAAc,EAAE,YAAY,EAAE,OAAO,EAAE,CAAC;AAAA,CAClE;AAED,8EAA8E;AAC9E,wBAAwB;AACxB,8EAA8E;AAE9E,kFAAkF;AAClF,MAAM,CAAC,MAAM,sBAAsB,GAAsB;IACxD,YAAY;IACZ,SAAS;IACT,aAAa;IACb,cAAc;IACd,WAAW;IACX,eAAe;IACf,SAAS;IACT,YAAY;IACZ,gBAAgB;IAChB,SAAS;IACT,UAAU;CACV,CAAC;AAqBF,MAAM,UAAU,wBAAwB,CAAC,KAA2B,EAA0B;IAC7F,MAAM,OAAO,GAAG,KAAK,CAAC,kBAAkB,IAAI,EAAE,CAAC;IAC/C,MAAM,QAAQ,GAAG,sBAAsB,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC;QACxD,MAAM,KAAK,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;QAC5B,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC,CAAC;IAAA,CAC5D,CAAC,CAAC;IAEH,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC3B,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,eAAe,EAAE,EAAE,EAAE,iBAAiB,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE,EAAE,CAAC;IACxF,CAAC;IAED,IAAI,CAAC,KAAK,CAAC,qBAAqB,EAAE,CAAC;QAClC,OAAO;YACN,OAAO,EAAE,QAAQ;YACjB,eAAe,EAAE,QAAQ;YACzB,iBAAiB,EAAE,IAAI;YACvB,OAAO,EAAE,CAAC,8BAA8B,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;SAC9D,CAAC;IACH,CAAC;IAED,MAAM,KAAK,GAAG,IAAI,GAAG,CAAC,CAAC,KAAK,CAAC,iBAAiB,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,OAAO,CAAC,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;IACjG,MAAM,YAAY,GAAG,OAAO,CAAC,KAAK,CAAC,MAAM,IAAI,KAAK,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC;IACtE,MAAM,eAAe,GAAG,OAAO,CAAC,KAAK,CAAC,QAAQ,IAAI,KAAK,CAAC,GAAG,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC;IAC7E,MAAM,IAAI,GAAG,KAAK,CAAC,sBAAsB,IAAI,OAAO,CAAC;IACrD,IAAI,CAAC,YAAY,IAAI,CAAC,CAAC,IAAI,KAAK,UAAU,IAAI,eAAe,CAAC,EAAE,CAAC;QAChE,OAAO;YACN,OAAO,EAAE,QAAQ;YACjB,eAAe,EAAE,QAAQ;YACzB,iBAAiB,EAAE,IAAI;YACvB,OAAO,EAAE;gBACR,eAAe;oBACd,CAAC,CAAC,iDAAiD;oBACnD,CAAC,CAAC,2DAA2D;aAC9D;SACD,CAAC;IACH,CAAC;IACD,OAAO;QACN,OAAO,EAAE,MAAM;QACf,eAAe,EAAE,QAAQ;QACzB,iBAAiB,EAAE,IAAI;QACvB,OAAO,EAAE,CAAC,oDAAoD,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;KACpF,CAAC;AAAA,CACF;AA2BD,MAAM,sBAAsB,GAAG,IAAI,CAAC;AAEpC,MAAM,mBAAmB,GAAkB;IAC1C;QACC,IAAI,EAAE,kBAAkB;QACxB,QAAQ,EAAE,OAAO;QACjB,OAAO,EAAE,IAAI,MAAM,CAAC,GAAG,MAAM,CAAC,GAAG,CAAA,OAAO,GAAG,sBAAsB,GAAG,MAAM,CAAC,GAAG,CAAA,WAAW,EAAE,CAAC;KAC5F;IACD;QACC,IAAI,EAAE,kBAAkB;QACxB,QAAQ,EAAE,OAAO;QACjB,OAAO,EAAE,IAAI,MAAM,CAAC,GAAG,MAAM,CAAC,GAAG,CAAA,IAAI,GAAG,sBAAsB,GAAG,MAAM,CAAC,GAAG,CAAA,YAAY,EAAE,CAAC;KAC1F;IACD;QACC,IAAI,EAAE,qBAAqB;QAC3B,QAAQ,EAAE,OAAO;QACjB,OAAO,EAAE,IAAI,MAAM,CAAC,GAAG,MAAM,CAAC,GAAG,CAAA,gBAAgB,GAAG,sBAAsB,GAAG,MAAM,CAAC,GAAG,CAAA,IAAI,EAAE,CAAC;KAC9F;IACD,EAAE,IAAI,EAAE,qBAAqB,EAAE,QAAQ,EAAE,OAAO,EAAE,OAAO,EAAE,iBAAiB,EAAE;IAC9E,EAAE,IAAI,EAAE,uBAAuB,EAAE,QAAQ,EAAE,OAAO,EAAE,OAAO,EAAE,6BAA6B,EAAE;IAC5F,EAAE,IAAI,EAAE,YAAY,EAAE,QAAQ,EAAE,MAAM,EAAE,OAAO,EAAE,wBAAwB,EAAE;IAC3E,EAAE,IAAI,EAAE,eAAe,EAAE,QAAQ,EAAE,OAAO,EAAE,OAAO,EAAE,uCAAuC,EAAE;IAC9F,EAAE,IAAI,EAAE,UAAU,EAAE,QAAQ,EAAE,MAAM,EAAE,OAAO,EAAE,qBAAqB,EAAE;CACtE,CAAC;AAEF,SAAS,aAAa,CAAC,OAAqB,EAAE,KAAoB,EAAiB;IAClF,MAAM,QAAQ,GAAkB,EAAE,CAAC;IACnC,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;QAC9B,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;QACzC,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;YACvC,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;YACtB,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;gBAC1B,IAAI,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;oBAC7B,QAAQ,CAAC,IAAI,CAAC;wBACb,IAAI,EAAE,IAAI,CAAC,IAAI;wBACf,QAAQ,EAAE,IAAI,CAAC,QAAQ;wBACvB,IAAI,EAAE,MAAM,CAAC,IAAI;wBACjB,IAAI,EAAE,CAAC,GAAG,CAAC;wBACX,OAAO,EAAE,IAAI,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC;qBAClC,CAAC,CAAC;gBACJ,CAAC;YACF,CAAC;QACF,CAAC;IACF,CAAC;IACD,OAAO,QAAQ,CAAC;AAAA,CAChB;AAED,MAAM,UAAU,0BAA0B,CAAC,OAAqB,EAA2B;IAC1F,MAAM,QAAQ,GAAG,aAAa,CAAC,OAAO,EAAE,mBAAmB,CAAC,CAAC;IAC7D,MAAM,QAAQ,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,OAAO,CAAC,CAAC;IAC9D,MAAM,MAAM,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,UAAU,CAAC,CAAC;IAC3D,MAAM,OAAO,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,MAAM,CAAC,CAAC;IAE5D,IAAI,OAA0B,CAAC;IAC/B,IAAI,QAAQ,EAAE,CAAC;QACd,OAAO,GAAG,kBAAkB,CAAC;IAC9B,CAAC;SAAM,IAAI,MAAM,EAAE,CAAC;QACnB,OAAO,GAAG,YAAY,CAAC;IACxB,CAAC;SAAM,IAAI,OAAO,EAAE,CAAC;QACpB,OAAO,GAAG,SAAS,CAAC;IACrB,CAAC;SAAM,CAAC;QACP,OAAO,GAAG,SAAS,CAAC;IACrB,CAAC;IACD,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,CAAC;AAAA,CAC7B;AAWD,MAAM,gBAAgB,GAAkB;IACvC,uDAAuD;IACvD,EAAE,IAAI,EAAE,iBAAiB,EAAE,QAAQ,EAAE,OAAO,EAAE,OAAO,EAAE,qCAAqC,EAAE;IAC9F,EAAE,IAAI,EAAE,iBAAiB,EAAE,QAAQ,EAAE,OAAO,EAAE,OAAO,EAAE,4BAA4B,EAAE;IACrF;QACC,IAAI,EAAE,iBAAiB;QACvB,QAAQ,EAAE,OAAO;QACjB,OAAO,EAAE,6DAA6D;KACtE;IACD,EAAE,IAAI,EAAE,iBAAiB,EAAE,QAAQ,EAAE,OAAO,EAAE,OAAO,EAAE,mDAAmD,EAAE;IAC5G,EAAE,IAAI,EAAE,aAAa,EAAE,QAAQ,EAAE,OAAO,EAAE,OAAO,EAAE,+CAA+C,EAAE;IACpG,EAAE,IAAI,EAAE,eAAe,EAAE,QAAQ,EAAE,MAAM,EAAE,OAAO,EAAE,sDAAsD,EAAE;IAC5G;QACC,IAAI,EAAE,SAAS;QACf,QAAQ,EAAE,MAAM;QAChB,OAAO,EAAE,4EAA4E;KACrF;IACD;QACC,IAAI,EAAE,kBAAkB;QACxB,QAAQ,EAAE,MAAM;QAChB,OAAO,EAAE,iFAAiF;KAC1F;IACD,EAAE,IAAI,EAAE,iBAAiB,EAAE,QAAQ,EAAE,MAAM,EAAE,OAAO,EAAE,8CAA8C,EAAE;IACtG,EAAE,IAAI,EAAE,WAAW,EAAE,QAAQ,EAAE,MAAM,EAAE,OAAO,EAAE,2DAA2D,EAAE;IAC7G,EAAE,IAAI,EAAE,WAAW,EAAE,QAAQ,EAAE,MAAM,EAAE,OAAO,EAAE,kBAAkB,EAAE;IACpE,EAAE,IAAI,EAAE,WAAW,EAAE,QAAQ,EAAE,MAAM,EAAE,OAAO,EAAE,kBAAkB,EAAE;IACpE,EAAE,IAAI,EAAE,oBAAoB,EAAE,QAAQ,EAAE,MAAM,EAAE,OAAO,EAAE,2BAA2B,EAAE;IACtF,EAAE,IAAI,EAAE,WAAW,EAAE,QAAQ,EAAE,MAAM,EAAE,OAAO,EAAE,kBAAkB,EAAE;IACpE,EAAE,IAAI,EAAE,gBAAgB,EAAE,QAAQ,EAAE,MAAM,EAAE,OAAO,EAAE,uBAAuB,EAAE;IAC9E,EAAE,IAAI,EAAE,UAAU,EAAE,QAAQ,EAAE,MAAM,EAAE,OAAO,EAAE,iBAAiB,EAAE;IAClE,EAAE,IAAI,EAAE,kBAAkB,EAAE,QAAQ,EAAE,MAAM,EAAE,OAAO,EAAE,yBAAyB,EAAE;IAClF,EAAE,IAAI,EAAE,YAAY,EAAE,QAAQ,EAAE,MAAM,EAAE,OAAO,EAAE,qBAAqB,EAAE;IACxE,EAAE,IAAI,EAAE,cAAc,EAAE,QAAQ,EAAE,MAAM,EAAE,OAAO,EAAE,uBAAuB,EAAE;IAC5E,EAAE,IAAI,EAAE,yBAAyB,EAAE,QAAQ,EAAE,MAAM,EAAE,OAAO,EAAE,gCAAgC,EAAE;IAChG,EAAE,IAAI,EAAE,yBAAyB,EAAE,QAAQ,EAAE,MAAM,EAAE,OAAO,EAAE,mCAAmC,EAAE;IACnG,EAAE,IAAI,EAAE,SAAS,EAAE,QAAQ,EAAE,MAAM,EAAE,OAAO,EAAE,mBAAmB,EAAE;IACnE,EAAE,IAAI,EAAE,wBAAwB,EAAE,QAAQ,EAAE,MAAM,EAAE,OAAO,EAAE,kCAAkC,EAAE;IACjG,EAAE,IAAI,EAAE,mBAAmB,EAAE,QAAQ,EAAE,MAAM,EAAE,OAAO,EAAE,uDAAuD,EAAE;CACjH,CAAC;AAEF,MAAM,UAAU,sBAAsB,CAAC,OAAqB,EAAwB;IACnF,MAAM,QAAQ,GAAG,aAAa,CAAC,OAAO,EAAE,gBAAgB,CAAC,CAAC;IAC1D,MAAM,YAAY,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAC/D,OAAO,EAAE,YAAY,EAAE,QAAQ,EAAE,CAAC;AAAA,CAClC;AAoBD,MAAM,UAAU,kBAAkB,CAAC,KAAsB,EAAoB;IAC5E,MAAM,MAAM,GAAG,KAAK,CAAC,iBAAiB,IAAI,CAAC,CAAC;IAC5C,IAAI,MAAM,IAAI,CAAC;QAAE,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,0BAA0B,EAAE,CAAC;IAChF,IAAI,CAAC,KAAK,CAAC,WAAW;QAAE,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,kCAAkC,EAAE,CAAC;IACjG,MAAM,SAAS,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC;IAChD,IAAI,MAAM,CAAC,KAAK,CAAC,SAAS,CAAC;QAAE,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,kCAAkC,EAAE,CAAC;IACtG,MAAM,GAAG,GAAG,KAAK,CAAC,GAAG,EAAE,OAAO,EAAE,IAAI,IAAI,CAAC,GAAG,EAAE,CAAC;IAC/C,MAAM,OAAO,GAAG,CAAC,GAAG,GAAG,SAAS,CAAC,GAAG,UAAU,CAAC;IAC/C,IAAI,OAAO,GAAG,MAAM,EAAE,CAAC;QACtB,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,qBAAqB,MAAM,OAAO,EAAE,OAAO,EAAE,CAAC;IAClF,CAAC;IACD,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,gBAAgB,EAAE,OAAO,EAAE,CAAC;AAAA,CAC9D;AAED,MAAM,UAAU,qBAAqB,CAAC,KAAK,GAAyB,EAAE,EAAa;IAClF,IAAI,KAAK,CAAC,iBAAiB,KAAK,IAAI;QAAE,OAAO,KAAK,CAAC;IACnD,IAAI,KAAK,CAAC,iBAAiB,KAAK,KAAK,IAAI,CAAC,KAAK,CAAC,cAAc,IAAI,MAAM,CAAC,iBAAiB,CAAC,GAAG,EAAE;QAAE,OAAO,MAAM,CAAC;IAChH,IAAI,KAAK,CAAC,iBAAiB,KAAK,KAAK;QAAE,OAAO,QAAQ,CAAC;IACvD,OAAO,KAAK,CAAC;AAAA,CACb;AAED,SAAS,OAAO,CAAC,CAAY,EAAE,CAAY,EAAa;IACvD,MAAM,IAAI,GAA8B,EAAE,GAAG,EAAE,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,IAAI,EAAE,CAAC,EAAE,CAAC;IACvE,OAAO,IAAI,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AAAA,CAClC;AAED,8EAA8E;AAC9E,iBAAiB;AACjB,8EAA8E;AAE9E,MAAM,sBAAsB,GAAG,IAAI,GAAG,CAAC,CAAC,iBAAiB,EAAE,aAAa,CAAC,CAAC,CAAC;AAC3E,MAAM,wBAAwB,GAAG,IAAI,GAAG,CAAC,CAAC,eAAe,EAAE,SAAS,EAAE,iBAAiB,CAAC,CAAC,CAAC;AAE1F,MAAM,UAAU,SAAS,CACxB,YAAsB,EACtB,cAA2B,EAC3B,gBAA6B,EAC7B,UAAiC,EACrB;IACZ,IAAI,IAAI,GAAc,KAAK,CAAC;IAC5B,IACC,cAAc,KAAK,QAAQ;QAC3B,gBAAgB,KAAK,QAAQ;QAC7B,YAAY,CAAC,IAAI,CAAC,CAAC,UAAU,EAAE,EAAE,CAAC,sBAAsB,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC,EACxE,CAAC;QACF,IAAI,GAAG,MAAM,CAAC;IACf,CAAC;SAAM,IACN,cAAc,KAAK,QAAQ;QAC3B,gBAAgB,KAAK,QAAQ;QAC7B,YAAY,CAAC,IAAI,CAAC,CAAC,UAAU,EAAE,EAAE,CAAC,wBAAwB,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC,EAC1E,CAAC;QACF,IAAI,GAAG,QAAQ,CAAC;IACjB,CAAC;IACD,OAAO,OAAO,CAAC,IAAI,EAAE,qBAAqB,CAAC,UAAU,CAAC,CAAC,CAAC;AAAA,CACxD;AAyBD,SAAS,eAAe,CAAC,WAAwB,EAAY;IAC5D,QAAQ,WAAW,EAAE,CAAC;QACrB,KAAK,QAAQ;YACZ,OAAO,QAAQ,CAAC;QACjB,KAAK,QAAQ,CAAC;QACd,KAAK,YAAY;YAChB,OAAO,QAAQ,CAAC;QACjB,KAAK,iBAAiB;YACrB,OAAO,iBAAiB,CAAC;QAC1B,KAAK,iBAAiB;YACrB,OAAO,mBAAmB,CAAC;QAC5B,KAAK,WAAW;YACf,OAAO,gBAAgB,CAAC;QACzB,KAAK,UAAU;YACd,OAAO,eAAe,CAAC;QACxB,KAAK,aAAa;YACjB,OAAO,aAAa,CAAC;QACtB,KAAK,mBAAmB;YACvB,OAAO,mBAAmB,CAAC;IAC7B,CAAC;AAAA,CACD;AAED,SAAS,QAAQ,CAAC,MAAsB,EAAE,eAAe,GAAa,EAAE,EAAoB;IAC3F,OAAO,EAAE,QAAQ,EAAE,UAAU,EAAE,cAAc,EAAE,MAAM,EAAE,eAAe,EAAE,CAAC,MAAM,EAAE,GAAG,eAAe,CAAC,EAAE,CAAC;AAAA,CACvG;AAED,SAAS,gBAAgB,CAAC,KAAoB,EAA6B;IAC1E,OAAO,KAAK,CAAC,aAAa,CAAC;AAAA,CAC3B;AAED,SAAS,oBAAoB,CAAC,MAAuC,EAAW;IAC/E,OAAO,OAAO,CACb,MAAM,EAAE,UAAU,KAAK,IAAI;QAC1B,MAAM,CAAC,eAAe,KAAK,IAAI;QAC/B,MAAM,CAAC,aAAa,KAAK,IAAI;QAC7B,MAAM,CAAC,iBAAiB,KAAK,IAAI,CAClC,CAAC;AAAA,CACF;AAED,MAAM,UAAU,cAAc,CAAC,KAAoB,EAAoB;IACtE,MAAM,OAAO,GAAa,EAAE,CAAC;IAC7B,MAAM,IAAI,GAAG,eAAe,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC;IAChD,MAAM,MAAM,GAAG,gBAAgB,CAAC,KAAK,CAAC,CAAC;IAEvC,IAAI,CAAC,KAAK,CAAC,KAAK,EAAE,CAAC;QAClB,IACC,IAAI,KAAK,QAAQ;YACjB,IAAI,KAAK,gBAAgB;YACzB,IAAI,KAAK,eAAe;YACxB,IAAI,KAAK,aAAa;YACtB,IAAI,KAAK,mBAAmB,EAC3B,CAAC;YACF,OAAO,QAAQ,CAAC,mBAAmB,CAAC,CAAC;QACtC,CAAC;QACD,OAAO,CAAC,IAAI,CAAC,oBAAoB,CAAC,CAAC;QACnC,OAAO,EAAE,QAAQ,EAAE,QAAQ,EAAE,eAAe,EAAE,OAAO,EAAE,CAAC;IACzD,CAAC;IAED,IAAI,IAAI,KAAK,QAAQ,EAAE,CAAC;QACvB,IAAI,KAAK,CAAC,UAAU,EAAE,MAAM,KAAK,KAAK;YAAE,OAAO,QAAQ,CAAC,qBAAqB,CAAC,CAAC;QAC/E,IAAI,KAAK,CAAC,YAAY,CAAC,QAAQ,CAAC,iBAAiB,CAAC;YAAE,OAAO,CAAC,IAAI,CAAC,4BAA4B,CAAC,CAAC;QAC/F,IAAI,KAAK,CAAC,cAAc,KAAK,QAAQ;YAAE,OAAO,CAAC,IAAI,CAAC,0BAA0B,CAAC,CAAC;QAChF,IAAI,KAAK,CAAC,gBAAgB,KAAK,QAAQ;YAAE,OAAO,CAAC,IAAI,CAAC,oCAAoC,CAAC,CAAC;QAC5F,IAAI,KAAK,CAAC,iBAAiB,KAAK,kBAAkB;YAAE,OAAO,CAAC,IAAI,CAAC,iCAAiC,CAAC,CAAC;QACpG,IAAI,MAAM,EAAE,WAAW,KAAK,SAAS,IAAI,CAAC,MAAM,CAAC,cAAc;YAAE,OAAO,QAAQ,CAAC,yBAAyB,CAAC,CAAC;QAC5G,IAAI,MAAM,EAAE,WAAW,KAAK,SAAS;YAAE,OAAO,CAAC,IAAI,CAAC,yBAAyB,CAAC,CAAC;QAC/E,OAAO,EAAE,QAAQ,EAAE,QAAQ,EAAE,eAAe,EAAE,OAAO,EAAE,CAAC;IACzD,CAAC;IAED,IAAI,MAAM,EAAE,WAAW,KAAK,QAAQ,IAAI,KAAK,CAAC,YAAY,CAAC,QAAQ,CAAC,iBAAiB,CAAC,EAAE,CAAC;QACxF,OAAO,CAAC,IAAI,CAAC,iCAAiC,CAAC,CAAC;QAChD,OAAO,EAAE,QAAQ,EAAE,QAAQ,EAAE,eAAe,EAAE,OAAO,EAAE,CAAC;IACzD,CAAC;IACD,IAAI,KAAK,CAAC,YAAY,CAAC,QAAQ,CAAC,iBAAiB,CAAC,EAAE,CAAC;QACpD,OAAO,CAAC,IAAI,CAAC,mBAAmB,CAAC,CAAC;QAClC,OAAO,EAAE,QAAQ,EAAE,QAAQ,EAAE,eAAe,EAAE,OAAO,EAAE,CAAC;IACzD,CAAC;IACD,IAAI,KAAK,CAAC,cAAc,KAAK,QAAQ,EAAE,CAAC;QACvC,OAAO,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAC;QAChC,OAAO,EAAE,QAAQ,EAAE,QAAQ,EAAE,eAAe,EAAE,OAAO,EAAE,CAAC;IACzD,CAAC;IACD,IAAI,KAAK,CAAC,gBAAgB,KAAK,QAAQ,EAAE,CAAC;QACzC,OAAO,CAAC,IAAI,CAAC,2BAA2B,CAAC,CAAC;QAC1C,OAAO,EAAE,QAAQ,EAAE,QAAQ,EAAE,eAAe,EAAE,OAAO,EAAE,CAAC;IACzD,CAAC;IACD,IAAI,KAAK,CAAC,iBAAiB,KAAK,kBAAkB,EAAE,CAAC;QACpD,OAAO,CAAC,IAAI,CAAC,wBAAwB,CAAC,CAAC;QACvC,OAAO,EAAE,QAAQ,EAAE,QAAQ,EAAE,eAAe,EAAE,OAAO,EAAE,CAAC;IACzD,CAAC;IAED,IAAI,MAAM,EAAE,WAAW,KAAK,oBAAoB,EAAE,CAAC;QAClD,IAAI,MAAM,CAAC,0BAA0B,KAAK,IAAI,EAAE,CAAC;YAChD,OAAO,EAAE,QAAQ,EAAE,QAAQ,EAAE,eAAe,EAAE,CAAC,8BAA8B,CAAC,EAAE,CAAC;QAClF,CAAC;QACD,OAAO,EAAE,QAAQ,EAAE,gBAAgB,EAAE,eAAe,EAAE,OAAO,EAAE,CAAC;IACjE,CAAC;IAED,IAAI,MAAM,EAAE,WAAW,KAAK,SAAS,EAAE,CAAC;QACvC,IAAI,CAAC,MAAM,CAAC,cAAc,EAAE,CAAC;YAC5B,OAAO,CAAC,IAAI,CAAC,0BAA0B,CAAC,CAAC;YACzC,OAAO,EAAE,QAAQ,EAAE,QAAQ,EAAE,eAAe,EAAE,OAAO,EAAE,CAAC;QACzD,CAAC;QACD,OAAO,CAAC,IAAI,CAAC,yBAAyB,CAAC,CAAC;IACzC,CAAC;IAED,IACC,MAAM,EAAE,WAAW,KAAK,eAAe;QACvC,IAAI,KAAK,mBAAmB;QAC5B,CAAC,oBAAoB,CAAC,MAAM,CAAC,YAAY,CAAC,EACzC,CAAC;QACF,OAAO,QAAQ,CAAC,uBAAuB,CAAC,CAAC;IAC1C,CAAC;IAED,IAAI,MAAM,EAAE,WAAW,KAAK,SAAS,IAAI,MAAM,EAAE,WAAW,KAAK,SAAS,EAAE,CAAC;QAC5E,IAAI,KAAK,CAAC,YAAY,CAAC,QAAQ,CAAC,kBAAkB,CAAC,IAAI,KAAK,CAAC,YAAY,CAAC,QAAQ,CAAC,eAAe,CAAC,EAAE,CAAC;YACrG,OAAO,CAAC,IAAI,CAAC,6BAA6B,CAAC,CAAC;QAC7C,CAAC;QACD,OAAO,EAAE,QAAQ,EAAE,aAAa,EAAE,eAAe,EAAE,OAAO,EAAE,CAAC;IAC9D,CAAC;IAED,IAAI,IAAI,KAAK,mBAAmB,EAAE,CAAC;QAClC,IAAI,CAAC,KAAK,CAAC,OAAO,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,QAAQ,CAAC,iBAAiB,CAAC,CAAC;QACrF,OAAO,EAAE,QAAQ,EAAE,mBAAmB,EAAE,eAAe,EAAE,OAAO,EAAE,CAAC;IACpE,CAAC;IAED,IAAI,IAAI,KAAK,gBAAgB,IAAI,IAAI,KAAK,eAAe,IAAI,IAAI,KAAK,aAAa,EAAE,CAAC;QACrF,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,eAAe,EAAE,OAAO,EAAE,CAAC;IACrD,CAAC;IAED,IAAI,IAAI,KAAK,mBAAmB,EAAE,CAAC;QAClC,IAAI,KAAK,CAAC,IAAI,KAAK,MAAM,EAAE,CAAC;YAC3B,OAAO,CAAC,IAAI,CAAC,6BAA6B,CAAC,CAAC;YAC5C,OAAO,EAAE,QAAQ,EAAE,QAAQ,EAAE,eAAe,EAAE,OAAO,EAAE,CAAC;QACzD,CAAC;QACD,IACC,KAAK,CAAC,cAAc,KAAK,QAAQ;YACjC,KAAK,CAAC,gBAAgB,KAAK,QAAQ;YACnC,KAAK,CAAC,iBAAiB,KAAK,SAAS,EACpC,CAAC;YACF,OAAO,CAAC,IAAI,CAAC,+BAA+B,CAAC,CAAC;YAC9C,OAAO,EAAE,QAAQ,EAAE,iBAAiB,EAAE,eAAe,EAAE,OAAO,EAAE,CAAC;QAClE,CAAC;QACD,OAAO,EAAE,QAAQ,EAAE,mBAAmB,EAAE,eAAe,EAAE,OAAO,EAAE,CAAC;IACpE,CAAC;IAED,IAAI,IAAI,KAAK,QAAQ,EAAE,CAAC;QACvB,IAAI,KAAK,CAAC,cAAc,KAAK,QAAQ;YAAE,OAAO,CAAC,IAAI,CAAC,8BAA8B,CAAC,CAAC;QACpF,OAAO,EAAE,QAAQ,EAAE,QAAQ,EAAE,eAAe,EAAE,OAAO,EAAE,CAAC;IACzD,CAAC;IAED,OAAO,EAAE,QAAQ,EAAE,iBAAiB,EAAE,eAAe,EAAE,OAAO,EAAE,CAAC;AAAA,CACjE;AAwCD,MAAM,UAAU,gBAAgB,CAAC,MAA+B,EAAqB;IACpF,MAAM,SAAS,GAAG,MAAM,CAAC,SAAS,CAAC;IACnC,MAAM,UAAU,GAAG,kBAAkB,CAAC,SAAS,CAAC,CAAC;IACjD,MAAM,MAAM,GAAG,UAAU,CAAC,EAAE,CAAC;IAE7B,MAAM,OAAO,GAAG,eAAe,CAAC;QAC/B,eAAe,EAAE,MAAM,CAAC,eAAe;QACvC,YAAY,EAAE,MAAM,CAAC,YAAY;QACjC,kBAAkB,EAAE,MAAM,CAAC,kBAAkB;QAC7C,WAAW,EAAE,SAAS,CAAC,WAAW;KAClC,CAAC,CAAC;IAEH,MAAM,SAAS,GAAG,wBAAwB,CAAC;QAC1C,kBAAkB,EAAE,MAAM,CAAC,kBAAkB;QAC7C,qBAAqB,EAAE,SAAS,CAAC,qBAAqB;QACtD,iBAAiB,EAAE,MAAM,CAAC,uBAAuB;QACjD,MAAM,EAAE,UAAU,CAAC,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS;QACrD,QAAQ,EAAE,UAAU,CAAC,EAAE,CAAC,CAAC,CAAC,cAAc,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,SAAS;QAChE,sBAAsB,EAAE,MAAM,CAAC,sBAAsB;KACrD,CAAC,CAAC;IAEH,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,IAAI,EAAE,CAAC;IACrC,MAAM,aAAa,GAAG,0BAA0B,CAAC,OAAO,CAAC,CAAC;IAC1D,MAAM,YAAY,GAAG,sBAAsB,CAAC,OAAO,CAAC,CAAC;IACrD,MAAM,UAAU,GAAG,kBAAkB,CAAC;QACrC,WAAW,EAAE,SAAS,CAAC,WAAW;QAClC,iBAAiB,EAAE,SAAS,CAAC,iBAAiB;QAC9C,GAAG,EAAE,MAAM,CAAC,GAAG;KACf,CAAC,CAAC;IACH,MAAM,cAAc,GAAG,qBAAqB,CAAC,SAAS,CAAC,UAAU,CAAC,CAAC;IACnE,MAAM,IAAI,GACT,SAAS,CAAC,IAAI,IAAI,SAAS,CAAC,YAAY,CAAC,YAAY,EAAE,OAAO,CAAC,OAAO,EAAE,SAAS,CAAC,OAAO,EAAE,SAAS,CAAC,UAAU,CAAC,CAAC;IAClH,MAAM,aAAa,GAClB,MAAM,CAAC,aAAa;QACpB,SAAS,CAAC,aAAa;QACvB,CAAC,SAAS,CAAC,WAAW,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,SAAS,CAAC,WAAW,EAAE,CAAC,CAAC;IAE5F,MAAM,QAAQ,GAAG,cAAc,CAAC;QAC/B,WAAW,EAAE,SAAS,CAAC,WAAW;QAClC,IAAI;QACJ,KAAK,EAAE,MAAM;QACb,cAAc,EAAE,OAAO,CAAC,OAAO;QAC/B,gBAAgB,EAAE,SAAS,CAAC,OAAO;QACnC,iBAAiB,EAAE,aAAa,CAAC,OAAO;QACxC,YAAY,EAAE,YAAY,CAAC,YAAY;QACvC,UAAU,EAAE,SAAS,CAAC,UAAU;QAChC,aAAa;QACb,OAAO,EAAE,SAAS,CAAC,OAAO;KAC1B,CAAC,CAAC;IAEH,MAAM,eAAe,GAAG,CAAC,GAAG,QAAQ,CAAC,eAAe,CAAC,CAAC;IACtD,IAAI,CAAC,UAAU,CAAC,EAAE,EAAE,CAAC;QACpB,eAAe,CAAC,IAAI,CAAC,GAAG,UAAU,CAAC,OAAO,CAAC,CAAC;IAC7C,CAAC;IAED,OAAO;QACN,SAAS;QACT,UAAU,EAAE,UAAU,CAAC,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,IAAI;QAC7C,MAAM;QACN,cAAc,EAAE,OAAO,CAAC,OAAO;QAC/B,qBAAqB,EAAE,OAAO,CAAC,cAAc;QAC7C,YAAY,EAAE,OAAO,CAAC,YAAY;QAClC,gBAAgB,EAAE,SAAS,CAAC,OAAO;QACnC,wBAAwB,EAAE,SAAS,CAAC,eAAe;QACnD,iBAAiB,EAAE,aAAa,CAAC,OAAO;QACxC,qBAAqB,EAAE,aAAa,CAAC,QAAQ;QAC7C,YAAY,EAAE,YAAY,CAAC,YAAY;QACvC,kBAAkB,EAAE,YAAY,CAAC,QAAQ;QACzC,IAAI;QACJ,QAAQ,EAAE,QAAQ,CAAC,QAAQ;QAC3B,GAAG,CAAC,QAAQ,CAAC,cAAc,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,cAAc,EAAE,QAAQ,CAAC,cAAc,EAAE,CAAC;QAC7F,iBAAiB,EAAE,UAAU,CAAC,OAAO;QACrC,cAAc;QACd,eAAe;KACf,CAAC;AAAA,CACF;AAmBD,SAAS,iBAAiB,CACzB,MAAyB,EACzB,MAAsB,EACtB,cAAsB,EACF;IACpB,OAAO;QACN,GAAG,MAAM;QACT,QAAQ,EAAE,UAAU;QACpB,cAAc,EAAE,MAAM;QACtB,eAAe,EAAE,CAAC,GAAG,MAAM,CAAC,eAAe,EAAE,cAAc,CAAC;KAC5D,CAAC;AAAA,CACF;AAED,SAAS,iBAAiB,CAAC,MAAyB,EAAW;IAC9D,OAAO,MAAM,CAAC,QAAQ,KAAK,QAAQ,IAAI,MAAM,CAAC,QAAQ,KAAK,UAAU,CAAC;AAAA,CACtE;AAED,MAAM,UAAU,qBAAqB,CAAC,KAA4B,EAA0B;IAC3F,MAAM,eAAe,GAA2B,EAAE,CAAC;IACnD,MAAM,QAAQ,GAAwB,EAAE,CAAC;IACzC,KAAK,MAAM,SAAS,IAAI,KAAK,CAAC,UAAU,EAAE,CAAC;QAC1C,MAAM,MAAM,GAAG,gBAAgB,CAAC;YAC/B,SAAS;YACT,kBAAkB,EAAE,KAAK,CAAC,kBAAkB;YAC5C,eAAe,EAAE,KAAK,CAAC,eAAe,IAAI,KAAK;YAC/C,kBAAkB,EAAE,KAAK,CAAC,kBAAkB;YAC5C,OAAO,EAAE,KAAK,CAAC,OAAO;YACtB,uBAAuB,EAAE,KAAK,CAAC,uBAAuB;YACtD,sBAAsB,EAAE,KAAK,CAAC,sBAAsB;YACpD,GAAG,EAAE,KAAK,CAAC,GAAG;SACd,CAAC,CAAC;QACH,MAAM,KAAK,GAAG,SAAS,CAAC,YAAY,CAAC;QACrC,IAAI,KAAK,IAAI,iBAAiB,CAAC,MAAM,CAAC,EAAE,CAAC;YACxC,IAAI,eAAe,CAAC,KAAK,CAAC,KAAK,SAAS,EAAE,CAAC;gBAC1C,eAAe,CAAC,KAAK,CAAC,GAAG,SAAS,CAAC,IAAI,CAAC;gBACxC,QAAQ,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;YACvB,CAAC;iBAAM,CAAC;gBACP,QAAQ,CAAC,IAAI,CAAC,iBAAiB,CAAC,MAAM,EAAE,gBAAgB,EAAE,oBAAoB,KAAK,EAAE,CAAC,CAAC,CAAC;YACzF,CAAC;QACF,CAAC;aAAM,CAAC;YACP,QAAQ,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QACvB,CAAC;IACF,CAAC;IACD,OAAO,EAAE,QAAQ,EAAE,cAAc,EAAE,EAAE,EAAE,eAAe,EAAE,CAAC;AAAA,CACzD;AAED,SAAS,cAAc,CAAC,UAA4B,EAAU;IAC7D,IAAI,UAAU,CAAC,IAAI,KAAK,KAAK,EAAE,CAAC;QAC/B,OAAO,OAAO,UAAU,CAAC,IAAI,EAAE,CAAC;IACjC,CAAC;IACD,OAAO,OAAO,UAAU,CAAC,IAAI,IAAI,UAAU,CAAC,IAAI,EAAE,CAAC;AAAA,CACnD","sourcesContent":["/**\n * Package procurement / exact-pin gate.\n *\n * Pure, native-only procurement algorithms for OMK package adoption. None of these\n * functions install, fetch, clone, spawn, or touch the filesystem/network. They take\n * already-supplied source-review inputs (manifest fields, license metadata, source\n * text) and return advisory verdicts so an external installer never runs against an\n * unvetted, mutable, or copyleft-contaminated source.\n *\n * Implements PR A from .omk/runs/omk-package-hardening-plan/{procurement.md,algorithm-plan.md}:\n *   - exact npm semver validation (shared pattern with scripts/check-pinned-deps.mjs)\n *   - mutable range/tag/branch rejection\n *   - candidate input normalization to a canonical pinned source string\n *   - license verdict gate (permissive / weak / strong / network copyleft / unknown)\n *   - lifecycle-script gate (fail-closed; reviewed allowlist exception only)\n *   - legacy/OMK compatibility scan over provided source text\n *   - source capability scan (credential reads, sockets, network, exec, fs writes)\n *   - risk/adoption decision matrix\n */\n\nimport { parseGitUrl } from \"../utils/git.ts\";\n\n// ---------------------------------------------------------------------------\n// Shared types\n// ---------------------------------------------------------------------------\n\nexport type IntendedUse =\n\t| \"native\"\n\t| \"vendor\"\n\t| \"ephemeral-adopt\"\n\t| \"permanent-adopt\"\n\t| \"theme-port\"\n\t| \"reference\"\n\t| \"advisory\"\n\t| \"report-only\"\n\t| \"measurement-gated\";\nexport type DeclaredUse =\n\t| \"sandbox\"\n\t| \"loadout\"\n\t| \"checkpoint\"\n\t| \"observability\"\n\t| \"advisor\"\n\t| \"quality\"\n\t| \"memory\"\n\t| \"workflow-reference\"\n\t| \"cache-perf\";\nexport type ResourceKind = \"extension\" | \"skill\" | \"prompt\" | \"theme\" | \"tool\";\nexport type RiskLevel = \"low\" | \"medium\" | \"high\";\nexport type GateVerdict = \"pass\" | \"review\" | \"reject\";\nexport type PathCompatibility = \"omk-native\" | \"legacy-hardcoded\" | \"unknown\";\nexport type Adoption =\n\t| \"native\"\n\t| \"vendor\"\n\t| \"ephemeral-trial\"\n\t| \"permanent-package\"\n\t| \"reference-only\"\n\t| \"advisory-only\"\n\t| \"report-only\"\n\t| \"measurement-gated\"\n\t| \"deferred\"\n\t| \"reject\";\nexport type DeferredReason =\n\t| \"missing-exact-pin\"\n\t| \"pending-native-spec\"\n\t| \"pending-metrics\"\n\t| \"pending-export-policy\"\n\t| \"group-excluded\"\n\t| \"pending-identity-reconciliation\"\n\t| \"pending-advisory-spec\"\n\t| \"pending-measurement-plan\"\n\t| \"pending-sandbox-backend\";\nexport type LifecycleAllowlistMode = \"exact\" | \"identity\";\nexport type SandboxBackend = \"seatbelt\" | \"bubblewrap\" | \"none\";\nexport type MutationMode = \"report-only\";\n\nexport interface NativeSpecPrecondition {\n\texists: boolean;\n\ttrackId?: string;\n\tspecPath?: string;\n}\n\nexport interface MaintainerTrustInput {\n\tscope?: string;\n\tverifiedPublisher?: boolean;\n\taccountAgeDays?: number;\n}\n\nexport interface ExportPolicyOverlay {\n\tdefaultOff: boolean;\n\tofflineDisables: boolean;\n\tdenyRawPrompt: boolean;\n\tdenyRawToolOutput: boolean;\n\tpayloadTier?: \"metadata\" | \"summary\" | \"full\";\n}\n\nexport interface PolicyOverlay {\n\tdeclaredUse: DeclaredUse;\n\tsandboxBackend?: SandboxBackend;\n\texportPolicy?: ExportPolicyOverlay;\n\tmutationMode?: MutationMode;\n\tadvisoryOnly?: boolean;\n\treplayInput?: boolean;\n\tactivateAlongsideScheduler?: boolean;\n}\n\nexport interface CandidatePackageInput {\n\tname: string;\n\texactVersion?: string;\n\tgitRepo?: string;\n\tgitRef?: string;\n\t/** Reviewed full commit SHA used to anchor an otherwise-mutable tag. */\n\tresolvedCommit?: string;\n\tintendedUse: IntendedUse;\n\tdeclaredUse?: DeclaredUse;\n\texpectedResources: ResourceKind[];\n\tallowLifecycleScripts?: boolean;\n\trisk?: RiskLevel;\n\tnativeSpec?: NativeSpecPrecondition;\n\tpolicyOverlay?: PolicyOverlay;\n\tmetrics?: string[];\n\texcludeGroup?: string;\n\tpublishedAt?: string;\n\tminReleaseAgeDays?: number;\n\tmaintainer?: MaintainerTrustInput;\n}\n\nexport interface SourceText {\n\tpath?: string;\n\ttext: string;\n}\n\n// ---------------------------------------------------------------------------\n// Exact npm version validation\n// ---------------------------------------------------------------------------\n\n/** Exact semver shape, identical to scripts/check-pinned-deps.mjs. */\nexport const EXACT_SEMVER_PATTERN =\n\t/^(?:0|[1-9]\\d*)\\.(?:0|[1-9]\\d*)\\.(?:0|[1-9]\\d*)(?:-[0-9A-Za-z.-]+)?(?:\\+[0-9A-Za-z.-]+)?$/;\n\nconst DIST_TAGS = new Set([\n\t\"latest\",\n\t\"next\",\n\t\"beta\",\n\t\"alpha\",\n\t\"canary\",\n\t\"rc\",\n\t\"dev\",\n\t\"nightly\",\n\t\"stable\",\n\t\"experimental\",\n\t\"insiders\",\n]);\n\n// whitespace, range operators (^ ~ > < = *), or a standalone wildcard x/X\nconst RANGE_INDICATOR = /[\\s^~><=*|]|\\bx\\b|\\bX\\b/;\n\nexport type NpmVersionRejectReason = \"missing\" | \"dist-tag\" | \"range\" | \"invalid\";\nexport type NpmVersionVerdict =\n\t| { ok: true; version: string }\n\t| { ok: false; reason: NpmVersionRejectReason; message: string };\n\nexport function validateExactNpmVersion(version: string | undefined): NpmVersionVerdict {\n\tconst value = (version ?? \"\").trim();\n\tif (!value) {\n\t\treturn { ok: false, reason: \"missing\", message: \"exact version is required\" };\n\t}\n\tif (DIST_TAGS.has(value.toLowerCase())) {\n\t\treturn { ok: false, reason: \"dist-tag\", message: `dist-tag \"${value}\" is mutable` };\n\t}\n\tif (EXACT_SEMVER_PATTERN.test(value)) {\n\t\treturn { ok: true, version: value };\n\t}\n\tif (RANGE_INDICATOR.test(value)) {\n\t\treturn { ok: false, reason: \"range\", message: `range/wildcard \"${value}\" is not an exact version` };\n\t}\n\treturn { ok: false, reason: \"invalid\", message: `\"${value}\" is not a valid exact semver` };\n}\n\n// ---------------------------------------------------------------------------\n// npm package name validation\n// ---------------------------------------------------------------------------\n\nconst NPM_NAME_PATTERN = /^(?:@[a-z0-9-~][a-z0-9-._~]*\\/)?[a-z0-9-~][a-z0-9-._~]*$/;\n\nexport type NpmNameVerdict = { ok: true; name: string } | { ok: false; message: string };\n\nexport function validateNpmPackageName(name: string): NpmNameVerdict {\n\tconst value = (name ?? \"\").trim();\n\tif (!value) {\n\t\treturn { ok: false, message: \"package name is required\" };\n\t}\n\tif (value.length > 214) {\n\t\treturn { ok: false, message: \"package name exceeds 214 characters\" };\n\t}\n\tif (value !== value.toLowerCase()) {\n\t\treturn { ok: false, message: \"package name must be lowercase\" };\n\t}\n\tif (value.includes(\"..\")) {\n\t\treturn { ok: false, message: \"package name must not contain path traversal\" };\n\t}\n\tif (!NPM_NAME_PATTERN.test(value)) {\n\t\treturn { ok: false, message: `\"${value}\" is not a valid npm package name` };\n\t}\n\treturn { ok: true, name: value };\n}\n\n// ---------------------------------------------------------------------------\n// git ref validation\n// ---------------------------------------------------------------------------\n\nconst FULL_SHA = /^(?:[0-9a-f]{40}|[0-9a-f]{64})$/;\nconst HEX_ONLY = /^[0-9a-f]+$/;\nconst MUTABLE_BRANCHES = new Set([\"main\", \"master\", \"develop\", \"dev\", \"trunk\", \"head\", \"release\", \"stable\", \"latest\"]);\n\nexport type GitRefRejectReason = \"missing\" | \"mutable-branch\" | \"short-sha\" | \"unresolved-tag\" | \"invalid\";\nexport type GitRefVerdict =\n\t| { ok: true; ref: string; commit: string; kind: \"commit\" | \"resolved-tag\" }\n\t| { ok: false; reason: GitRefRejectReason; message: string };\n\nexport function validateGitRef(ref: string | undefined, resolvedCommit?: string): GitRefVerdict {\n\tconst value = (ref ?? \"\").trim();\n\tif (!value) {\n\t\treturn { ok: false, reason: \"missing\", message: \"git ref is required\" };\n\t}\n\tif (FULL_SHA.test(value)) {\n\t\treturn { ok: true, ref: value, commit: value, kind: \"commit\" };\n\t}\n\n\tconst lower = value.toLowerCase();\n\tif (MUTABLE_BRANCHES.has(lower) || value === \"HEAD\" || value.startsWith(\"refs/heads/\")) {\n\t\treturn { ok: false, reason: \"mutable-branch\", message: `\"${value}\" is a mutable branch` };\n\t}\n\tif (HEX_ONLY.test(lower) && lower.length < 40) {\n\t\treturn { ok: false, reason: \"short-sha\", message: `\"${value}\" is an abbreviated commit; full SHA required` };\n\t}\n\n\t// Treat anything else as a tag: immutable only when anchored to a reviewed full commit.\n\tconst commit = (resolvedCommit ?? \"\").trim();\n\tif (!commit) {\n\t\treturn { ok: false, reason: \"unresolved-tag\", message: `tag \"${value}\" needs a reviewed resolved commit SHA` };\n\t}\n\tif (!FULL_SHA.test(commit)) {\n\t\treturn { ok: false, reason: \"invalid\", message: `resolvedCommit \"${commit}\" is not a full SHA` };\n\t}\n\treturn { ok: true, ref: value, commit, kind: \"resolved-tag\" };\n}\n\n// ---------------------------------------------------------------------------\n// Candidate normalization\n// ---------------------------------------------------------------------------\n\nexport type NormalizedSource =\n\t| { ok: true; kind: \"npm\"; source: string; name: string; version: string }\n\t| { ok: true; kind: \"git\"; source: string; repo: string; host: string; path: string; ref: string; commit: string };\n\nexport type NormalizedCandidate = NormalizedSource | { ok: false; reasons: string[] };\n\nexport function normalizeCandidate(input: CandidatePackageInput): NormalizedCandidate {\n\tconst reasons: string[] = [];\n\tconst hasNpm = Boolean(input.exactVersion);\n\tconst hasGit = Boolean(input.gitRepo || input.gitRef);\n\n\tif (hasNpm && hasGit) {\n\t\treasons.push(\"ambiguous-source: provide either an npm exactVersion or a git repo+ref, not both\");\n\t\treturn { ok: false, reasons };\n\t}\n\tif (!hasNpm && !hasGit) {\n\t\treasons.push(\"missing-source: provide exactVersion (npm) or gitRepo+gitRef (git)\");\n\t\treturn { ok: false, reasons };\n\t}\n\n\tif (hasNpm) {\n\t\tconst nameCheck = validateNpmPackageName(input.name);\n\t\tif (!nameCheck.ok) reasons.push(`invalid-npm-name: ${nameCheck.message}`);\n\t\tconst versionCheck = validateExactNpmVersion(input.exactVersion);\n\t\tif (!versionCheck.ok) reasons.push(`version: ${versionCheck.message}`);\n\t\tif (nameCheck.ok && versionCheck.ok) {\n\t\t\treturn {\n\t\t\t\tok: true,\n\t\t\t\tkind: \"npm\",\n\t\t\t\tsource: `npm:${nameCheck.name}@${versionCheck.version}`,\n\t\t\t\tname: nameCheck.name,\n\t\t\t\tversion: versionCheck.version,\n\t\t\t};\n\t\t}\n\t\treturn { ok: false, reasons };\n\t}\n\n\t// git\n\tconst git = resolveGitRepo(input.gitRepo ?? \"\");\n\tif (!git) reasons.push(\"invalid-git-repo: could not parse a host/org/repo from gitRepo\");\n\tconst refCheck = validateGitRef(input.gitRef, input.resolvedCommit);\n\tif (!refCheck.ok) reasons.push(`git-ref: ${refCheck.message}`);\n\tif (git && refCheck.ok) {\n\t\treturn {\n\t\t\tok: true,\n\t\t\tkind: \"git\",\n\t\t\tsource: `git:${git.host}/${git.path}@${refCheck.commit}`,\n\t\t\trepo: git.repo,\n\t\t\thost: git.host,\n\t\t\tpath: git.path,\n\t\t\tref: refCheck.ref,\n\t\t\tcommit: refCheck.commit,\n\t\t};\n\t}\n\treturn { ok: false, reasons };\n}\n\nfunction resolveGitRepo(repo: string): { repo: string; host: string; path: string } | null {\n\tconst trimmed = repo.trim();\n\tif (!trimmed) return null;\n\tconst parsed = parseGitUrl(trimmed) ?? parseGitUrl(`git:${trimmed}`);\n\tif (!parsed) return null;\n\treturn { repo: parsed.repo, host: parsed.host, path: parsed.path };\n}\n\n// ---------------------------------------------------------------------------\n// License gate\n// ---------------------------------------------------------------------------\n\nexport type LicenseClassification = \"permissive\" | \"weak-copyleft\" | \"strong-copyleft\" | \"network-copyleft\" | \"unknown\";\n\nexport interface LicenseInput {\n\tdeclaredLicense?: string;\n\tlicenseFiles?: string[];\n\ttransitiveLicenses?: string[];\n\tintendedUse: IntendedUse;\n}\n\nexport interface LicenseVerdictResult {\n\tverdict: GateVerdict;\n\tclassification: LicenseClassification;\n\tnoticeNeeded: boolean;\n\treasons: string[];\n}\n\nconst PERMISSIVE_LICENSES = new Set([\n\t\"MIT\",\n\t\"MIT-0\",\n\t\"ISC\",\n\t\"BSD\",\n\t\"BSD-2-CLAUSE\",\n\t\"BSD-3-CLAUSE\",\n\t\"APACHE-2.0\",\n\t\"0BSD\",\n\t\"UNLICENSE\",\n\t\"CC0-1.0\",\n\t\"BLUEOAK-1.0.0\",\n\t\"ZLIB\",\n\t\"PYTHON-2.0\",\n\t\"WTFPL\",\n]);\n\nconst NOTICE_REQUIRED_LICENSES = new Set([\"APACHE-2.0\", \"BSD\", \"BSD-2-CLAUSE\", \"BSD-3-CLAUSE\", \"MPL-2.0\"]);\n\nfunction licenseKey(license: string): string {\n\treturn license.trim().toUpperCase().replace(/\\s+/g, \"\");\n}\n\nexport function classifyLicense(license: string | undefined): LicenseClassification {\n\tif (!license || !license.trim()) return \"unknown\";\n\tconst key = licenseKey(license);\n\tif (key.includes(\"AGPL\") || key.includes(\"SSPL\")) return \"network-copyleft\";\n\tif (key.includes(\"LGPL\") || key.includes(\"MPL\") || key.includes(\"EPL\") || key.includes(\"CDDL\")) {\n\t\treturn \"weak-copyleft\";\n\t}\n\tif (key.includes(\"GPL\")) return \"strong-copyleft\";\n\tif (PERMISSIVE_LICENSES.has(key)) return \"permissive\";\n\treturn \"unknown\";\n}\n\nexport function evaluateLicense(input: LicenseInput): LicenseVerdictResult {\n\tconst reasons: string[] = [];\n\tconst classification = classifyLicense(input.declaredLicense);\n\tconst noticeNeeded =\n\t\tBoolean(input.declaredLicense) &&\n\t\t(NOTICE_REQUIRED_LICENSES.has(licenseKey(input.declaredLicense ?? \"\")) || classification === \"weak-copyleft\");\n\n\tif (classification === \"unknown\") {\n\t\treasons.push(input.declaredLicense ? `unrecognized-license: ${input.declaredLicense}` : \"missing-license\");\n\t\treturn { verdict: \"review\", classification, noticeNeeded, reasons };\n\t}\n\tif (classification === \"network-copyleft\" || classification === \"strong-copyleft\") {\n\t\treasons.push(`copyleft-blocks-adoption: ${input.declaredLicense}`);\n\t\treturn { verdict: \"reject\", classification, noticeNeeded, reasons };\n\t}\n\tif (classification === \"weak-copyleft\") {\n\t\treasons.push(`weak-copyleft-needs-review: ${input.declaredLicense}`);\n\t\treturn { verdict: \"review\", classification, noticeNeeded, reasons };\n\t}\n\n\t// Permissive: runtime/permanent adoption needs a transitive license inventory.\n\tif (\n\t\tinput.intendedUse === \"permanent-adopt\" &&\n\t\t(!input.transitiveLicenses || input.transitiveLicenses.length === 0)\n\t) {\n\t\treasons.push(\"transitive-license-inventory-required\");\n\t\treturn { verdict: \"review\", classification, noticeNeeded, reasons };\n\t}\n\tif (input.transitiveLicenses) {\n\t\tfor (const transitive of input.transitiveLicenses) {\n\t\t\tconst transitiveClass = classifyLicense(transitive);\n\t\t\tif (transitiveClass === \"strong-copyleft\" || transitiveClass === \"network-copyleft\") {\n\t\t\t\treasons.push(`transitive-copyleft: ${transitive}`);\n\t\t\t\treturn { verdict: \"reject\", classification, noticeNeeded, reasons };\n\t\t\t}\n\t\t\tif (transitiveClass === \"unknown\" || transitiveClass === \"weak-copyleft\") {\n\t\t\t\treasons.push(`transitive-needs-review: ${transitive}`);\n\t\t\t\treturn { verdict: \"review\", classification, noticeNeeded, reasons };\n\t\t\t}\n\t\t}\n\t}\n\treturn { verdict: \"pass\", classification, noticeNeeded, reasons };\n}\n\n// ---------------------------------------------------------------------------\n// Lifecycle-script gate\n// ---------------------------------------------------------------------------\n\n/** npm/pnpm/bun lifecycle hooks that run automatically during install or pack. */\nexport const LIFECYCLE_SCRIPT_NAMES: readonly string[] = [\n\t\"preinstall\",\n\t\"install\",\n\t\"postinstall\",\n\t\"preuninstall\",\n\t\"uninstall\",\n\t\"postuninstall\",\n\t\"prepare\",\n\t\"prepublish\",\n\t\"prepublishOnly\",\n\t\"prepack\",\n\t\"postpack\",\n];\n\nexport interface LifecycleScriptInput {\n\tpackageJsonScripts?: Record<string, string>;\n\tallowLifecycleScripts?: boolean;\n\treviewedAllowlist?: string[];\n\t/** Full pinned source spec, e.g. npm:pi-sandbox@0.4.3 */\n\tsource?: string;\n\t/** Identity without version/ref, e.g. npm:pi-sandbox */\n\tidentity?: string;\n\t/** Defaults to exact, matching the published shrinkwrap allowlist semantics. */\n\tlifecycleAllowlistMode?: LifecycleAllowlistMode;\n}\n\nexport interface LifecycleVerdictResult {\n\tverdict: GateVerdict;\n\tdeclaredScripts: string[];\n\trequiresException: boolean;\n\treasons: string[];\n}\n\nexport function evaluateLifecycleScripts(input: LifecycleScriptInput): LifecycleVerdictResult {\n\tconst scripts = input.packageJsonScripts ?? {};\n\tconst declared = LIFECYCLE_SCRIPT_NAMES.filter((name) => {\n\t\tconst value = scripts[name];\n\t\treturn typeof value === \"string\" && value.trim().length > 0;\n\t});\n\n\tif (declared.length === 0) {\n\t\treturn { verdict: \"pass\", declaredScripts: [], requiresException: false, reasons: [] };\n\t}\n\n\tif (!input.allowLifecycleScripts) {\n\t\treturn {\n\t\t\tverdict: \"reject\",\n\t\t\tdeclaredScripts: declared,\n\t\t\trequiresException: true,\n\t\t\treasons: [`lifecycle-scripts-present: ${declared.join(\", \")}`],\n\t\t};\n\t}\n\n\tconst allow = new Set((input.reviewedAllowlist ?? []).filter((entry) => Boolean(entry?.trim())));\n\tconst exactMatched = Boolean(input.source && allow.has(input.source));\n\tconst identityMatched = Boolean(input.identity && allow.has(input.identity));\n\tconst mode = input.lifecycleAllowlistMode ?? \"exact\";\n\tif (!exactMatched && !(mode === \"identity\" && identityMatched)) {\n\t\treturn {\n\t\t\tverdict: \"review\",\n\t\t\tdeclaredScripts: declared,\n\t\t\trequiresException: true,\n\t\t\treasons: [\n\t\t\t\tidentityMatched\n\t\t\t\t\t? \"lifecycle-scripts-require-exact-allowlist-entry\"\n\t\t\t\t\t: \"lifecycle-scripts-opt-in-without-reviewed-allowlist-entry\",\n\t\t\t],\n\t\t};\n\t}\n\treturn {\n\t\tverdict: \"pass\",\n\t\tdeclaredScripts: declared,\n\t\trequiresException: true,\n\t\treasons: [`lifecycle-scripts-allowed-by-reviewed-allowlist: ${declared.join(\", \")}`],\n\t};\n}\n\n// ---------------------------------------------------------------------------\n// Legacy / OMK compatibility scan\n// ---------------------------------------------------------------------------\n\nexport type FindingSeverity = \"info\" | \"warn\" | \"block\";\n\nexport interface ScanFinding {\n\tkind: string;\n\tseverity: FindingSeverity;\n\tpath?: string;\n\tline: number;\n\tsnippet: string;\n}\n\nexport interface CompatibilityScanResult {\n\tverdict: PathCompatibility;\n\tfindings: ScanFinding[];\n}\n\ninterface PatternRule {\n\tkind: string;\n\tseverity: FindingSeverity;\n\tpattern: RegExp;\n}\n\nconst LEGACY_CONFIG_DIR_NAME = \"pi\";\n\nconst COMPATIBILITY_RULES: PatternRule[] = [\n\t{\n\t\tkind: \"legacy-home-path\",\n\t\tseverity: \"block\",\n\t\tpattern: new RegExp(`${String.raw`~\\/\\.`}${LEGACY_CONFIG_DIR_NAME}${String.raw`(?:\\/|\\b)`}`),\n\t},\n\t{\n\t\tkind: \"legacy-state-dir\",\n\t\tseverity: \"block\",\n\t\tpattern: new RegExp(`${String.raw`\\.`}${LEGACY_CONFIG_DIR_NAME}${String.raw`\\/agents\\b`}`),\n\t},\n\t{\n\t\tkind: \"legacy-project-path\",\n\t\tseverity: \"block\",\n\t\tpattern: new RegExp(`${String.raw`(?:^|[^.\\w])\\.`}${LEGACY_CONFIG_DIR_NAME}${String.raw`\\/`}`),\n\t},\n\t{ kind: \"legacy-package-path\", severity: \"block\", pattern: /pi-coding-agent/ },\n\t{ kind: \"legacy-cli-invocation\", severity: \"block\", pattern: /\\bpi\\s+(?:install|update)\\b/ },\n\t{ kind: \"legacy-env\", severity: \"warn\", pattern: /\\bPI_[A-Z][A-Z0-9_]*\\b/ },\n\t{ kind: \"legacy-import\", severity: \"block\", pattern: /@(?:mariozechner|earendil-works)\\/pi-/ },\n\t{ kind: \"omk-path\", severity: \"info\", pattern: /(?:^|[^.\\w])\\.omk\\// },\n];\n\nfunction scanWithRules(sources: SourceText[], rules: PatternRule[]): ScanFinding[] {\n\tconst findings: ScanFinding[] = [];\n\tfor (const source of sources) {\n\t\tconst lines = source.text.split(/\\r?\\n/);\n\t\tfor (let i = 0; i < lines.length; i++) {\n\t\t\tconst line = lines[i];\n\t\t\tfor (const rule of rules) {\n\t\t\t\tif (rule.pattern.test(line)) {\n\t\t\t\t\tfindings.push({\n\t\t\t\t\t\tkind: rule.kind,\n\t\t\t\t\t\tseverity: rule.severity,\n\t\t\t\t\t\tpath: source.path,\n\t\t\t\t\t\tline: i + 1,\n\t\t\t\t\t\tsnippet: line.trim().slice(0, 200),\n\t\t\t\t\t});\n\t\t\t\t}\n\t\t\t}\n\t\t}\n\t}\n\treturn findings;\n}\n\nexport function scanLegacyOmkCompatibility(sources: SourceText[]): CompatibilityScanResult {\n\tconst findings = scanWithRules(sources, COMPATIBILITY_RULES);\n\tconst hasBlock = findings.some((f) => f.severity === \"block\");\n\tconst hasOmk = findings.some((f) => f.kind === \"omk-path\");\n\tconst hasWarn = findings.some((f) => f.severity === \"warn\");\n\n\tlet verdict: PathCompatibility;\n\tif (hasBlock) {\n\t\tverdict = \"legacy-hardcoded\";\n\t} else if (hasOmk) {\n\t\tverdict = \"omk-native\";\n\t} else if (hasWarn) {\n\t\tverdict = \"unknown\";\n\t} else {\n\t\tverdict = \"unknown\";\n\t}\n\treturn { verdict, findings };\n}\n\n// ---------------------------------------------------------------------------\n// Source capability scan\n// ---------------------------------------------------------------------------\n\nexport interface CapabilityScanResult {\n\tcapabilities: string[];\n\tfindings: ScanFinding[];\n}\n\nconst CAPABILITY_RULES: PatternRule[] = [\n\t// Credential / secret file reads are the hard blocker.\n\t{ kind: \"credential-read\", severity: \"block\", pattern: /[\"'`][^\"'`]*\\.env(?:\\.[\\w-]+)?[\"'`]/ },\n\t{ kind: \"credential-read\", severity: \"block\", pattern: /auth\\.json|\\.npmrc|\\.netrc/ },\n\t{\n\t\tkind: \"credential-read\",\n\t\tseverity: \"block\",\n\t\tpattern: /id_rsa|id_ed25519|\\.ssh\\/|\\.aws\\/credentials|\\.kube\\/config/,\n\t},\n\t{ kind: \"credential-read\", severity: \"block\", pattern: /BEGIN\\s+(?:RSA\\s+|EC\\s+|OPENSSH\\s+)?PRIVATE\\s+KEY/ },\n\t{ kind: \"host-socket\", severity: \"block\", pattern: /\\/var\\/run\\/docker\\.sock|dockerode|kubeconfig/ },\n\t{ kind: \"child-process\", severity: \"warn\", pattern: /child_process|\\bspawn\\s*\\(|\\bexec(?:Sync|File)?\\s*\\(/ },\n\t{\n\t\tkind: \"network\",\n\t\tseverity: \"warn\",\n\t\tpattern: /\\bfetch\\s*\\(\\s*[\"'`]?https?:|https?\\.request|node-fetch|axios|undici|got\\(/,\n\t},\n\t{\n\t\tkind: \"filesystem-write\",\n\t\tseverity: \"warn\",\n\t\tpattern: /writeFileSync|appendFileSync|\\bfs\\.(?:write|append)|rmSync|unlinkSync|mkdirSync/,\n\t},\n\t{ kind: \"browser-control\", severity: \"warn\", pattern: /puppeteer|playwright|chrome-devtools|:9222\\b/ },\n\t{ kind: \"telemetry\", severity: \"warn\", pattern: /\\btelemetry\\b|posthog|segment\\.io|@braintrust|analytics\\b/ },\n\t{ kind: \"setFooter\", severity: \"info\", pattern: /\\bsetFooter\\s*\\(/ },\n\t{ kind: \"setHeader\", severity: \"info\", pattern: /\\bsetHeader\\s*\\(/ },\n\t{ kind: \"setEditorComponent\", severity: \"info\", pattern: /\\bsetEditorComponent\\s*\\(/ },\n\t{ kind: \"setStatus\", severity: \"info\", pattern: /\\bsetStatus\\s*\\(/ },\n\t{ kind: \"setActiveTools\", severity: \"info\", pattern: /\\bsetActiveTools\\s*\\(/ },\n\t{ kind: \"setModel\", severity: \"warn\", pattern: /\\bsetModel\\s*\\(/ },\n\t{ kind: \"setThinkingLevel\", severity: \"warn\", pattern: /\\bsetThinkingLevel\\s*\\(/ },\n\t{ kind: \"renderCall\", severity: \"info\", pattern: /\\brenderCall\\s*[:(]/ },\n\t{ kind: \"renderResult\", severity: \"info\", pattern: /\\brenderResult\\s*[:(]/ },\n\t{ kind: \"registerMessageRenderer\", severity: \"info\", pattern: /\\bregisterMessageRenderer\\s*\\(/ },\n\t{ kind: \"before_provider_request\", severity: \"warn\", pattern: /[\"'`]before_provider_request[\"'`]/ },\n\t{ kind: \"context\", severity: \"warn\", pattern: /[\"'`]context[\"'`]/ },\n\t{ kind: \"session_before_compact\", severity: \"warn\", pattern: /[\"'`]session_before_compact[\"'`]/ },\n\t{ kind: \"env-secret-access\", severity: \"info\", pattern: /process\\.env\\.[A-Z0-9_]*(?:TOKEN|SECRET|KEY|PASSWORD)/ },\n];\n\nexport function scanSourceCapabilities(sources: SourceText[]): CapabilityScanResult {\n\tconst findings = scanWithRules(sources, CAPABILITY_RULES);\n\tconst capabilities = [...new Set(findings.map((f) => f.kind))];\n\treturn { capabilities, findings };\n}\n\n// ---------------------------------------------------------------------------\n// Release-age and maintainer trust gates\n// ---------------------------------------------------------------------------\n\nexport type ReleaseAgeVerdict = \"pass\" | \"review\" | \"defer\";\n\nexport interface ReleaseAgeInput {\n\tpublishedAt?: string;\n\tminReleaseAgeDays?: number;\n\tnow?: Date;\n}\n\nexport interface ReleaseAgeResult {\n\tverdict: ReleaseAgeVerdict;\n\treason?: string;\n\tageDays?: number;\n}\n\nexport function evaluateReleaseAge(input: ReleaseAgeInput): ReleaseAgeResult {\n\tconst minAge = input.minReleaseAgeDays ?? 0;\n\tif (minAge <= 0) return { verdict: \"pass\", reason: \"release-age-not-required\" };\n\tif (!input.publishedAt) return { verdict: \"review\", reason: \"release-age-published-at-missing\" };\n\tconst published = Date.parse(input.publishedAt);\n\tif (Number.isNaN(published)) return { verdict: \"review\", reason: \"release-age-invalid-published-at\" };\n\tconst now = input.now?.getTime() ?? Date.now();\n\tconst ageDays = (now - published) / 86_400_000;\n\tif (ageDays < minAge) {\n\t\treturn { verdict: \"defer\", reason: `release-age-below-${minAge}-days`, ageDays };\n\t}\n\treturn { verdict: \"pass\", reason: \"release-age-ok\", ageDays };\n}\n\nexport function assessMaintainerTrust(input: MaintainerTrustInput = {}): RiskLevel {\n\tif (input.verifiedPublisher === true) return \"low\";\n\tif (input.verifiedPublisher === false && (input.accountAgeDays ?? Number.POSITIVE_INFINITY) < 60) return \"high\";\n\tif (input.verifiedPublisher === false) return \"medium\";\n\treturn \"low\";\n}\n\nfunction maxRisk(a: RiskLevel, b: RiskLevel): RiskLevel {\n\tconst rank: Record<RiskLevel, number> = { low: 0, medium: 1, high: 2 };\n\treturn rank[a] >= rank[b] ? a : b;\n}\n\n// ---------------------------------------------------------------------------\n// Risk inference\n// ---------------------------------------------------------------------------\n\nconst HIGH_RISK_CAPABILITIES = new Set([\"credential-read\", \"host-socket\"]);\nconst MEDIUM_RISK_CAPABILITIES = new Set([\"child-process\", \"network\", \"browser-control\"]);\n\nexport function inferRisk(\n\tcapabilities: string[],\n\tlicenseVerdict: GateVerdict,\n\tlifecycleVerdict: GateVerdict,\n\tmaintainer?: MaintainerTrustInput,\n): RiskLevel {\n\tlet risk: RiskLevel = \"low\";\n\tif (\n\t\tlicenseVerdict === \"reject\" ||\n\t\tlifecycleVerdict === \"reject\" ||\n\t\tcapabilities.some((capability) => HIGH_RISK_CAPABILITIES.has(capability))\n\t) {\n\t\trisk = \"high\";\n\t} else if (\n\t\tlicenseVerdict === \"review\" ||\n\t\tlifecycleVerdict === \"review\" ||\n\t\tcapabilities.some((capability) => MEDIUM_RISK_CAPABILITIES.has(capability))\n\t) {\n\t\trisk = \"medium\";\n\t}\n\treturn maxRisk(risk, assessMaintainerTrust(maintainer));\n}\n\n// ---------------------------------------------------------------------------\n// Adoption decision matrix\n// ---------------------------------------------------------------------------\n\nexport interface AdoptionInput {\n\tintendedUse: IntendedUse;\n\trisk: RiskLevel;\n\tpinOk: boolean;\n\tlicenseVerdict: GateVerdict;\n\tlifecycleVerdict: GateVerdict;\n\tpathCompatibility: PathCompatibility;\n\tcapabilities: string[];\n\tnativeSpec?: NativeSpecPrecondition;\n\tpolicyOverlay?: PolicyOverlay;\n\tmetrics?: string[];\n}\n\nexport interface AdoptionDecision {\n\tadoption: Adoption;\n\trejectedReasons: string[];\n\tdeferredReason?: DeferredReason;\n}\n\nfunction baseAdoptionFor(intendedUse: IntendedUse): Adoption {\n\tswitch (intendedUse) {\n\t\tcase \"native\":\n\t\t\treturn \"native\";\n\t\tcase \"vendor\":\n\t\tcase \"theme-port\":\n\t\t\treturn \"vendor\";\n\t\tcase \"ephemeral-adopt\":\n\t\t\treturn \"ephemeral-trial\";\n\t\tcase \"permanent-adopt\":\n\t\t\treturn \"permanent-package\";\n\t\tcase \"reference\":\n\t\t\treturn \"reference-only\";\n\t\tcase \"advisory\":\n\t\t\treturn \"advisory-only\";\n\t\tcase \"report-only\":\n\t\t\treturn \"report-only\";\n\t\tcase \"measurement-gated\":\n\t\t\treturn \"measurement-gated\";\n\t}\n}\n\nfunction deferred(reason: DeferredReason, rejectedReasons: string[] = []): AdoptionDecision {\n\treturn { adoption: \"deferred\", deferredReason: reason, rejectedReasons: [reason, ...rejectedReasons] };\n}\n\nfunction policyOverlayFor(input: AdoptionInput): PolicyOverlay | undefined {\n\treturn input.policyOverlay;\n}\n\nfunction hasValidExportPolicy(policy: ExportPolicyOverlay | undefined): boolean {\n\treturn Boolean(\n\t\tpolicy?.defaultOff === true &&\n\t\t\tpolicy.offlineDisables === true &&\n\t\t\tpolicy.denyRawPrompt === true &&\n\t\t\tpolicy.denyRawToolOutput === true,\n\t);\n}\n\nexport function decideAdoption(input: AdoptionInput): AdoptionDecision {\n\tconst reasons: string[] = [];\n\tconst base = baseAdoptionFor(input.intendedUse);\n\tconst policy = policyOverlayFor(input);\n\n\tif (!input.pinOk) {\n\t\tif (\n\t\t\tbase === \"native\" ||\n\t\t\tbase === \"reference-only\" ||\n\t\t\tbase === \"advisory-only\" ||\n\t\t\tbase === \"report-only\" ||\n\t\t\tbase === \"measurement-gated\"\n\t\t) {\n\t\t\treturn deferred(\"missing-exact-pin\");\n\t\t}\n\t\treasons.push(\"exact-pin-required\");\n\t\treturn { adoption: \"reject\", rejectedReasons: reasons };\n\t}\n\n\tif (base === \"native\") {\n\t\tif (input.nativeSpec?.exists === false) return deferred(\"pending-native-spec\");\n\t\tif (input.capabilities.includes(\"credential-read\")) reasons.push(\"reads-credentials-upstream\");\n\t\tif (input.licenseVerdict === \"reject\") reasons.push(\"license-blocked-upstream\");\n\t\tif (input.lifecycleVerdict === \"reject\") reasons.push(\"lifecycle-scripts-blocked-upstream\");\n\t\tif (input.pathCompatibility === \"legacy-hardcoded\") reasons.push(\"legacy-hardcoded-paths-upstream\");\n\t\tif (policy?.declaredUse === \"sandbox\" && !policy.sandboxBackend) return deferred(\"pending-sandbox-backend\");\n\t\tif (policy?.declaredUse === \"sandbox\") reasons.push(\"sandbox-risk-floor-high\");\n\t\treturn { adoption: \"native\", rejectedReasons: reasons };\n\t}\n\n\tif (policy?.declaredUse === \"memory\" && input.capabilities.includes(\"credential-read\")) {\n\t\treasons.push(\"memory-credential-read-rejected\");\n\t\treturn { adoption: \"reject\", rejectedReasons: reasons };\n\t}\n\tif (input.capabilities.includes(\"credential-read\")) {\n\t\treasons.push(\"reads-credentials\");\n\t\treturn { adoption: \"reject\", rejectedReasons: reasons };\n\t}\n\tif (input.licenseVerdict === \"reject\") {\n\t\treasons.push(\"license-blocked\");\n\t\treturn { adoption: \"reject\", rejectedReasons: reasons };\n\t}\n\tif (input.lifecycleVerdict === \"reject\") {\n\t\treasons.push(\"lifecycle-scripts-blocked\");\n\t\treturn { adoption: \"reject\", rejectedReasons: reasons };\n\t}\n\tif (input.pathCompatibility === \"legacy-hardcoded\") {\n\t\treasons.push(\"legacy-hardcoded-paths\");\n\t\treturn { adoption: \"reject\", rejectedReasons: reasons };\n\t}\n\n\tif (policy?.declaredUse === \"workflow-reference\") {\n\t\tif (policy.activateAlongsideScheduler === true) {\n\t\t\treturn { adoption: \"reject\", rejectedReasons: [\"scheduler-coexistence-denied\"] };\n\t\t}\n\t\treturn { adoption: \"reference-only\", rejectedReasons: reasons };\n\t}\n\n\tif (policy?.declaredUse === \"sandbox\") {\n\t\tif (!policy.sandboxBackend) {\n\t\t\treasons.push(\"sandbox-requires-backend\");\n\t\t\treturn { adoption: \"reject\", rejectedReasons: reasons };\n\t\t}\n\t\treasons.push(\"sandbox-risk-floor-high\");\n\t}\n\n\tif (\n\t\tpolicy?.declaredUse === \"observability\" &&\n\t\tbase === \"permanent-package\" &&\n\t\t!hasValidExportPolicy(policy.exportPolicy)\n\t) {\n\t\treturn deferred(\"pending-export-policy\");\n\t}\n\n\tif (policy?.declaredUse === \"advisor\" || policy?.declaredUse === \"quality\") {\n\t\tif (input.capabilities.includes(\"filesystem-write\") || input.capabilities.includes(\"child-process\")) {\n\t\t\treasons.push(\"report-only-mutation-denied\");\n\t\t}\n\t\treturn { adoption: \"report-only\", rejectedReasons: reasons };\n\t}\n\n\tif (base === \"measurement-gated\") {\n\t\tif (!input.metrics || input.metrics.length === 0) return deferred(\"pending-metrics\");\n\t\treturn { adoption: \"measurement-gated\", rejectedReasons: reasons };\n\t}\n\n\tif (base === \"reference-only\" || base === \"advisory-only\" || base === \"report-only\") {\n\t\treturn { adoption: base, rejectedReasons: reasons };\n\t}\n\n\tif (base === \"permanent-package\") {\n\t\tif (input.risk === \"high\") {\n\t\t\treasons.push(\"high-risk-permanent-blocked\");\n\t\t\treturn { adoption: \"reject\", rejectedReasons: reasons };\n\t\t}\n\t\tif (\n\t\t\tinput.licenseVerdict === \"review\" ||\n\t\t\tinput.lifecycleVerdict === \"review\" ||\n\t\t\tinput.pathCompatibility === \"unknown\"\n\t\t) {\n\t\t\treasons.push(\"needs-review-before-permanent\");\n\t\t\treturn { adoption: \"ephemeral-trial\", rejectedReasons: reasons };\n\t\t}\n\t\treturn { adoption: \"permanent-package\", rejectedReasons: reasons };\n\t}\n\n\tif (base === \"vendor\") {\n\t\tif (input.licenseVerdict === \"review\") reasons.push(\"license-review-before-vendor\");\n\t\treturn { adoption: \"vendor\", rejectedReasons: reasons };\n\t}\n\n\treturn { adoption: \"ephemeral-trial\", rejectedReasons: reasons };\n}\n\n// ---------------------------------------------------------------------------\n// Top-level procurement review\n// ---------------------------------------------------------------------------\n\nexport interface ProcurementReviewInputs {\n\tcandidate: CandidatePackageInput;\n\tpackageJsonScripts?: Record<string, string>;\n\tdeclaredLicense?: string;\n\tlicenseFiles?: string[];\n\ttransitiveLicenses?: string[];\n\tsources?: SourceText[];\n\treviewedScriptAllowlist?: string[];\n\tlifecycleAllowlistMode?: LifecycleAllowlistMode;\n\tpolicyOverlay?: PolicyOverlay;\n\tnow?: Date;\n}\n\nexport interface ProcurementReview {\n\tcandidate: CandidatePackageInput;\n\tnormalized: NormalizedSource | null;\n\tpinned: boolean;\n\tlicenseVerdict: GateVerdict;\n\tlicenseClassification: LicenseClassification;\n\tnoticeNeeded: boolean;\n\tlifecycleVerdict: GateVerdict;\n\tdeclaredLifecycleScripts: string[];\n\tpathCompatibility: PathCompatibility;\n\tcompatibilityFindings: ScanFinding[];\n\tcapabilities: string[];\n\tcapabilityFindings: ScanFinding[];\n\trisk: RiskLevel;\n\tadoption: Adoption;\n\tdeferredReason?: DeferredReason;\n\treleaseAgeVerdict: ReleaseAgeVerdict;\n\tmaintainerRisk: RiskLevel;\n\trejectedReasons: string[];\n}\n\nexport function procureCandidate(inputs: ProcurementReviewInputs): ProcurementReview {\n\tconst candidate = inputs.candidate;\n\tconst normalized = normalizeCandidate(candidate);\n\tconst pinned = normalized.ok;\n\n\tconst license = evaluateLicense({\n\t\tdeclaredLicense: inputs.declaredLicense,\n\t\tlicenseFiles: inputs.licenseFiles,\n\t\ttransitiveLicenses: inputs.transitiveLicenses,\n\t\tintendedUse: candidate.intendedUse,\n\t});\n\n\tconst lifecycle = evaluateLifecycleScripts({\n\t\tpackageJsonScripts: inputs.packageJsonScripts,\n\t\tallowLifecycleScripts: candidate.allowLifecycleScripts,\n\t\treviewedAllowlist: inputs.reviewedScriptAllowlist,\n\t\tsource: normalized.ok ? normalized.source : undefined,\n\t\tidentity: normalized.ok ? sourceIdentity(normalized) : undefined,\n\t\tlifecycleAllowlistMode: inputs.lifecycleAllowlistMode,\n\t});\n\n\tconst sources = inputs.sources ?? [];\n\tconst compatibility = scanLegacyOmkCompatibility(sources);\n\tconst capabilities = scanSourceCapabilities(sources);\n\tconst releaseAge = evaluateReleaseAge({\n\t\tpublishedAt: candidate.publishedAt,\n\t\tminReleaseAgeDays: candidate.minReleaseAgeDays,\n\t\tnow: inputs.now,\n\t});\n\tconst maintainerRisk = assessMaintainerTrust(candidate.maintainer);\n\tconst risk =\n\t\tcandidate.risk ?? inferRisk(capabilities.capabilities, license.verdict, lifecycle.verdict, candidate.maintainer);\n\tconst policyOverlay =\n\t\tinputs.policyOverlay ??\n\t\tcandidate.policyOverlay ??\n\t\t(candidate.declaredUse === undefined ? undefined : { declaredUse: candidate.declaredUse });\n\n\tconst decision = decideAdoption({\n\t\tintendedUse: candidate.intendedUse,\n\t\trisk,\n\t\tpinOk: pinned,\n\t\tlicenseVerdict: license.verdict,\n\t\tlifecycleVerdict: lifecycle.verdict,\n\t\tpathCompatibility: compatibility.verdict,\n\t\tcapabilities: capabilities.capabilities,\n\t\tnativeSpec: candidate.nativeSpec,\n\t\tpolicyOverlay,\n\t\tmetrics: candidate.metrics,\n\t});\n\n\tconst rejectedReasons = [...decision.rejectedReasons];\n\tif (!normalized.ok) {\n\t\trejectedReasons.push(...normalized.reasons);\n\t}\n\n\treturn {\n\t\tcandidate,\n\t\tnormalized: normalized.ok ? normalized : null,\n\t\tpinned,\n\t\tlicenseVerdict: license.verdict,\n\t\tlicenseClassification: license.classification,\n\t\tnoticeNeeded: license.noticeNeeded,\n\t\tlifecycleVerdict: lifecycle.verdict,\n\t\tdeclaredLifecycleScripts: lifecycle.declaredScripts,\n\t\tpathCompatibility: compatibility.verdict,\n\t\tcompatibilityFindings: compatibility.findings,\n\t\tcapabilities: capabilities.capabilities,\n\t\tcapabilityFindings: capabilities.findings,\n\t\trisk,\n\t\tadoption: decision.adoption,\n\t\t...(decision.deferredReason === undefined ? {} : { deferredReason: decision.deferredReason }),\n\t\treleaseAgeVerdict: releaseAge.verdict,\n\t\tmaintainerRisk,\n\t\trejectedReasons,\n\t};\n}\n\nexport interface ProcurementBatchInput {\n\tcandidates: readonly CandidatePackageInput[];\n\tpackageJsonScripts?: Record<string, string>;\n\tdeclaredLicense?: string;\n\ttransitiveLicenses?: string[];\n\tsources?: SourceText[];\n\treviewedScriptAllowlist?: string[];\n\tlifecycleAllowlistMode?: LifecycleAllowlistMode;\n\tnow?: Date;\n}\n\nexport interface ProcurementBatchResult {\n\tcoverage: ProcurementReview[];\n\tglobalBlockers: string[];\n\tselectedByGroup: Record<string, string>;\n}\n\nfunction withBatchDeferral(\n\treview: ProcurementReview,\n\treason: DeferredReason,\n\trejectedReason: string,\n): ProcurementReview {\n\treturn {\n\t\t...review,\n\t\tadoption: \"deferred\",\n\t\tdeferredReason: reason,\n\t\trejectedReasons: [...review.rejectedReasons, rejectedReason],\n\t};\n}\n\nfunction isAdoptedForGroup(review: ProcurementReview): boolean {\n\treturn review.adoption !== \"reject\" && review.adoption !== \"deferred\";\n}\n\nexport function procureCandidateBatch(input: ProcurementBatchInput): ProcurementBatchResult {\n\tconst selectedByGroup: Record<string, string> = {};\n\tconst coverage: ProcurementReview[] = [];\n\tfor (const candidate of input.candidates) {\n\t\tconst review = procureCandidate({\n\t\t\tcandidate,\n\t\t\tpackageJsonScripts: input.packageJsonScripts,\n\t\t\tdeclaredLicense: input.declaredLicense ?? \"MIT\",\n\t\t\ttransitiveLicenses: input.transitiveLicenses,\n\t\t\tsources: input.sources,\n\t\t\treviewedScriptAllowlist: input.reviewedScriptAllowlist,\n\t\t\tlifecycleAllowlistMode: input.lifecycleAllowlistMode,\n\t\t\tnow: input.now,\n\t\t});\n\t\tconst group = candidate.excludeGroup;\n\t\tif (group && isAdoptedForGroup(review)) {\n\t\t\tif (selectedByGroup[group] === undefined) {\n\t\t\t\tselectedByGroup[group] = candidate.name;\n\t\t\t\tcoverage.push(review);\n\t\t\t} else {\n\t\t\t\tcoverage.push(withBatchDeferral(review, \"group-excluded\", `group-exclusion: ${group}`));\n\t\t\t}\n\t\t} else {\n\t\t\tcoverage.push(review);\n\t\t}\n\t}\n\treturn { coverage, globalBlockers: [], selectedByGroup };\n}\n\nfunction sourceIdentity(normalized: NormalizedSource): string {\n\tif (normalized.kind === \"npm\") {\n\t\treturn `npm:${normalized.name}`;\n\t}\n\treturn `git:${normalized.host}/${normalized.path}`;\n}\n"]}

package/dist/core/provider-attribution.d.ts

@@ -1,4 +1,4 @@
-import type { Api, Model } from "@earendil-works/omk-ai";
+import type { Api, Model } from "omk-ai";
 import type { SettingsManager } from "./settings-manager.ts";
 export declare function mergeProviderAttributionHeaders(model: Model<Api>, settingsManager: SettingsManager, sessionId: string | undefined, ...headerSources: Array<Record<string, string> | undefined>): Record<string, string> | undefined;
 //# sourceMappingURL=provider-attribution.d.ts.map

package/dist/core/provider-attribution.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"provider-attribution.d.ts","sourceRoot":"","sources":["../../src/core/provider-attribution.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,GAAG,EAAE,KAAK,EAAE,MAAM,wBAAwB,CAAC;AACzD,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAC;AA6E7D,wBAAgB,+BAA+B,CAC9C,KAAK,EAAE,KAAK,CAAC,GAAG,CAAC,EACjB,eAAe,EAAE,eAAe,EAChC,SAAS,EAAE,MAAM,GAAG,SAAS,EAC7B,GAAG,aAAa,EAAE,KAAK,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,SAAS,CAAC,GACzD,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,SAAS,CAapC","sourcesContent":["import type { Api, Model } from \"@earendil-works/omk-ai\";\nimport type { SettingsManager } from \"./settings-manager.ts\";\nimport { isInstallTelemetryEnabled } from \"./telemetry.ts\";\n\nconst OPENROUTER_HOST = \"openrouter.ai\";\nconst NVIDIA_NIM_HOST = \"integrate.api.nvidia.com\";\nconst CLOUDFLARE_API_HOST = \"api.cloudflare.com\";\nconst CLOUDFLARE_AI_GATEWAY_HOST = \"gateway.ai.cloudflare.com\";\nconst OPENCODE_HOST = \"opencode.ai\";\n\nfunction matchesHost(baseUrl: string, expectedHost: string): boolean {\n\ttry {\n\t\treturn new URL(baseUrl).hostname === expectedHost;\n\t} catch {\n\t\treturn false;\n\t}\n}\n\nfunction isOpenRouterModel(model: Model<Api>): boolean {\n\treturn model.provider === \"openrouter\" || model.baseUrl.includes(OPENROUTER_HOST);\n}\n\nfunction isNvidiaNimModel(model: Model<Api>): boolean {\n\treturn model.provider === \"nvidia\" || matchesHost(model.baseUrl, NVIDIA_NIM_HOST);\n}\n\nfunction isCloudflareModel(model: Model<Api>): boolean {\n\treturn (\n\t\tmodel.provider === \"cloudflare-workers-ai\" ||\n\t\tmodel.provider === \"cloudflare-ai-gateway\" ||\n\t\tmatchesHost(model.baseUrl, CLOUDFLARE_API_HOST) ||\n\t\tmatchesHost(model.baseUrl, CLOUDFLARE_AI_GATEWAY_HOST)\n\t);\n}\n\nfunction getDefaultAttributionHeaders(\n\tmodel: Model<Api>,\n\tsettingsManager: SettingsManager,\n): Record<string, string> | undefined {\n\tif (!isInstallTelemetryEnabled(settingsManager)) {\n\t\treturn undefined;\n\t}\n\n\tif (isOpenRouterModel(model)) {\n\t\treturn {\n\t\t\t\"HTTP-Referer\": \"https://github.com/dmae97/omk\",\n\t\t\t\"X-OpenRouter-Title\": \"omk\",\n\t\t\t\"X-OpenRouter-Categories\": \"cli-agent\",\n\t\t};\n\t}\n\n\tif (isNvidiaNimModel(model)) {\n\t\treturn {\n\t\t\t\"X-BILLING-INVOKE-ORIGIN\": \"OMK\",\n\t\t};\n\t}\n\n\tif (isCloudflareModel(model)) {\n\t\treturn {\n\t\t\t\"User-Agent\": \"open-multi-agent-kit\",\n\t\t};\n\t}\n\n\treturn undefined;\n}\n\nfunction getSessionHeaders(model: Model<Api>, sessionId: string | undefined): Record<string, string> | undefined {\n\tif (!sessionId) return undefined;\n\tif (\n\t\tmodel.provider !== \"opencode\" &&\n\t\tmodel.provider !== \"opencode-go\" &&\n\t\t!matchesHost(model.baseUrl, OPENCODE_HOST)\n\t) {\n\t\treturn undefined;\n\t}\n\treturn { \"x-opencode-session\": sessionId, \"x-opencode-client\": \"omk\" };\n}\n\nexport function mergeProviderAttributionHeaders(\n\tmodel: Model<Api>,\n\tsettingsManager: SettingsManager,\n\tsessionId: string | undefined,\n\t...headerSources: Array<Record<string, string> | undefined>\n): Record<string, string> | undefined {\n\tconst merged = {\n\t\t...getSessionHeaders(model, sessionId),\n\t\t...getDefaultAttributionHeaders(model, settingsManager),\n\t};\n\n\tfor (const headers of headerSources) {\n\t\tif (headers) {\n\t\t\tObject.assign(merged, headers);\n\t\t}\n\t}\n\n\treturn Object.keys(merged).length > 0 ? merged : undefined;\n}\n"]}
+{"version":3,"file":"provider-attribution.d.ts","sourceRoot":"","sources":["../../src/core/provider-attribution.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,GAAG,EAAE,KAAK,EAAE,MAAM,QAAQ,CAAC;AACzC,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAC;AA6E7D,wBAAgB,+BAA+B,CAC9C,KAAK,EAAE,KAAK,CAAC,GAAG,CAAC,EACjB,eAAe,EAAE,eAAe,EAChC,SAAS,EAAE,MAAM,GAAG,SAAS,EAC7B,GAAG,aAAa,EAAE,KAAK,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,SAAS,CAAC,GACzD,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,SAAS,CAapC","sourcesContent":["import type { Api, Model } from \"omk-ai\";\nimport type { SettingsManager } from \"./settings-manager.ts\";\nimport { isInstallTelemetryEnabled } from \"./telemetry.ts\";\n\nconst OPENROUTER_HOST = \"openrouter.ai\";\nconst NVIDIA_NIM_HOST = \"integrate.api.nvidia.com\";\nconst CLOUDFLARE_API_HOST = \"api.cloudflare.com\";\nconst CLOUDFLARE_AI_GATEWAY_HOST = \"gateway.ai.cloudflare.com\";\nconst OPENCODE_HOST = \"opencode.ai\";\n\nfunction matchesHost(baseUrl: string, expectedHost: string): boolean {\n\ttry {\n\t\treturn new URL(baseUrl).hostname === expectedHost;\n\t} catch {\n\t\treturn false;\n\t}\n}\n\nfunction isOpenRouterModel(model: Model<Api>): boolean {\n\treturn model.provider === \"openrouter\" || model.baseUrl.includes(OPENROUTER_HOST);\n}\n\nfunction isNvidiaNimModel(model: Model<Api>): boolean {\n\treturn model.provider === \"nvidia\" || matchesHost(model.baseUrl, NVIDIA_NIM_HOST);\n}\n\nfunction isCloudflareModel(model: Model<Api>): boolean {\n\treturn (\n\t\tmodel.provider === \"cloudflare-workers-ai\" ||\n\t\tmodel.provider === \"cloudflare-ai-gateway\" ||\n\t\tmatchesHost(model.baseUrl, CLOUDFLARE_API_HOST) ||\n\t\tmatchesHost(model.baseUrl, CLOUDFLARE_AI_GATEWAY_HOST)\n\t);\n}\n\nfunction getDefaultAttributionHeaders(\n\tmodel: Model<Api>,\n\tsettingsManager: SettingsManager,\n): Record<string, string> | undefined {\n\tif (!isInstallTelemetryEnabled(settingsManager)) {\n\t\treturn undefined;\n\t}\n\n\tif (isOpenRouterModel(model)) {\n\t\treturn {\n\t\t\t\"HTTP-Referer\": \"https://github.com/dmae97/omk\",\n\t\t\t\"X-OpenRouter-Title\": \"omk\",\n\t\t\t\"X-OpenRouter-Categories\": \"cli-agent\",\n\t\t};\n\t}\n\n\tif (isNvidiaNimModel(model)) {\n\t\treturn {\n\t\t\t\"X-BILLING-INVOKE-ORIGIN\": \"OMK\",\n\t\t};\n\t}\n\n\tif (isCloudflareModel(model)) {\n\t\treturn {\n\t\t\t\"User-Agent\": \"open-multi-agent-kit\",\n\t\t};\n\t}\n\n\treturn undefined;\n}\n\nfunction getSessionHeaders(model: Model<Api>, sessionId: string | undefined): Record<string, string> | undefined {\n\tif (!sessionId) return undefined;\n\tif (\n\t\tmodel.provider !== \"opencode\" &&\n\t\tmodel.provider !== \"opencode-go\" &&\n\t\t!matchesHost(model.baseUrl, OPENCODE_HOST)\n\t) {\n\t\treturn undefined;\n\t}\n\treturn { \"x-opencode-session\": sessionId, \"x-opencode-client\": \"omk\" };\n}\n\nexport function mergeProviderAttributionHeaders(\n\tmodel: Model<Api>,\n\tsettingsManager: SettingsManager,\n\tsessionId: string | undefined,\n\t...headerSources: Array<Record<string, string> | undefined>\n): Record<string, string> | undefined {\n\tconst merged = {\n\t\t...getSessionHeaders(model, sessionId),\n\t\t...getDefaultAttributionHeaders(model, settingsManager),\n\t};\n\n\tfor (const headers of headerSources) {\n\t\tif (headers) {\n\t\t\tObject.assign(merged, headers);\n\t\t}\n\t}\n\n\treturn Object.keys(merged).length > 0 ? merged : undefined;\n}\n"]}

package/dist/core/provider-attribution.js.map

@@ -1 +1 @@
-{"version":3,"file":"provider-attribution.js","sourceRoot":"","sources":["../../src/core/provider-attribution.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,yBAAyB,EAAE,MAAM,gBAAgB,CAAC;AAE3D,MAAM,eAAe,GAAG,eAAe,CAAC;AACxC,MAAM,eAAe,GAAG,0BAA0B,CAAC;AACnD,MAAM,mBAAmB,GAAG,oBAAoB,CAAC;AACjD,MAAM,0BAA0B,GAAG,2BAA2B,CAAC;AAC/D,MAAM,aAAa,GAAG,aAAa,CAAC;AAEpC,SAAS,WAAW,CAAC,OAAe,EAAE,YAAoB,EAAW;IACpE,IAAI,CAAC;QACJ,OAAO,IAAI,GAAG,CAAC,OAAO,CAAC,CAAC,QAAQ,KAAK,YAAY,CAAC;IACnD,CAAC;IAAC,MAAM,CAAC;QACR,OAAO,KAAK,CAAC;IACd,CAAC;AAAA,CACD;AAED,SAAS,iBAAiB,CAAC,KAAiB,EAAW;IACtD,OAAO,KAAK,CAAC,QAAQ,KAAK,YAAY,IAAI,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,eAAe,CAAC,CAAC;AAAA,CAClF;AAED,SAAS,gBAAgB,CAAC,KAAiB,EAAW;IACrD,OAAO,KAAK,CAAC,QAAQ,KAAK,QAAQ,IAAI,WAAW,CAAC,KAAK,CAAC,OAAO,EAAE,eAAe,CAAC,CAAC;AAAA,CAClF;AAED,SAAS,iBAAiB,CAAC,KAAiB,EAAW;IACtD,OAAO,CACN,KAAK,CAAC,QAAQ,KAAK,uBAAuB;QAC1C,KAAK,CAAC,QAAQ,KAAK,uBAAuB;QAC1C,WAAW,CAAC,KAAK,CAAC,OAAO,EAAE,mBAAmB,CAAC;QAC/C,WAAW,CAAC,KAAK,CAAC,OAAO,EAAE,0BAA0B,CAAC,CACtD,CAAC;AAAA,CACF;AAED,SAAS,4BAA4B,CACpC,KAAiB,EACjB,eAAgC,EACK;IACrC,IAAI,CAAC,yBAAyB,CAAC,eAAe,CAAC,EAAE,CAAC;QACjD,OAAO,SAAS,CAAC;IAClB,CAAC;IAED,IAAI,iBAAiB,CAAC,KAAK,CAAC,EAAE,CAAC;QAC9B,OAAO;YACN,cAAc,EAAE,+BAA+B;YAC/C,oBAAoB,EAAE,KAAK;YAC3B,yBAAyB,EAAE,WAAW;SACtC,CAAC;IACH,CAAC;IAED,IAAI,gBAAgB,CAAC,KAAK,CAAC,EAAE,CAAC;QAC7B,OAAO;YACN,yBAAyB,EAAE,KAAK;SAChC,CAAC;IACH,CAAC;IAED,IAAI,iBAAiB,CAAC,KAAK,CAAC,EAAE,CAAC;QAC9B,OAAO;YACN,YAAY,EAAE,sBAAsB;SACpC,CAAC;IACH,CAAC;IAED,OAAO,SAAS,CAAC;AAAA,CACjB;AAED,SAAS,iBAAiB,CAAC,KAAiB,EAAE,SAA6B,EAAsC;IAChH,IAAI,CAAC,SAAS;QAAE,OAAO,SAAS,CAAC;IACjC,IACC,KAAK,CAAC,QAAQ,KAAK,UAAU;QAC7B,KAAK,CAAC,QAAQ,KAAK,aAAa;QAChC,CAAC,WAAW,CAAC,KAAK,CAAC,OAAO,EAAE,aAAa,CAAC,EACzC,CAAC;QACF,OAAO,SAAS,CAAC;IAClB,CAAC;IACD,OAAO,EAAE,oBAAoB,EAAE,SAAS,EAAE,mBAAmB,EAAE,KAAK,EAAE,CAAC;AAAA,CACvE;AAED,MAAM,UAAU,+BAA+B,CAC9C,KAAiB,EACjB,eAAgC,EAChC,SAA6B,EAC7B,GAAG,aAAwD,EACtB;IACrC,MAAM,MAAM,GAAG;QACd,GAAG,iBAAiB,CAAC,KAAK,EAAE,SAAS,CAAC;QACtC,GAAG,4BAA4B,CAAC,KAAK,EAAE,eAAe,CAAC;KACvD,CAAC;IAEF,KAAK,MAAM,OAAO,IAAI,aAAa,EAAE,CAAC;QACrC,IAAI,OAAO,EAAE,CAAC;YACb,MAAM,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;QAChC,CAAC;IACF,CAAC;IAED,OAAO,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC;AAAA,CAC3D","sourcesContent":["import type { Api, Model } from \"@earendil-works/omk-ai\";\nimport type { SettingsManager } from \"./settings-manager.ts\";\nimport { isInstallTelemetryEnabled } from \"./telemetry.ts\";\n\nconst OPENROUTER_HOST = \"openrouter.ai\";\nconst NVIDIA_NIM_HOST = \"integrate.api.nvidia.com\";\nconst CLOUDFLARE_API_HOST = \"api.cloudflare.com\";\nconst CLOUDFLARE_AI_GATEWAY_HOST = \"gateway.ai.cloudflare.com\";\nconst OPENCODE_HOST = \"opencode.ai\";\n\nfunction matchesHost(baseUrl: string, expectedHost: string): boolean {\n\ttry {\n\t\treturn new URL(baseUrl).hostname === expectedHost;\n\t} catch {\n\t\treturn false;\n\t}\n}\n\nfunction isOpenRouterModel(model: Model<Api>): boolean {\n\treturn model.provider === \"openrouter\" || model.baseUrl.includes(OPENROUTER_HOST);\n}\n\nfunction isNvidiaNimModel(model: Model<Api>): boolean {\n\treturn model.provider === \"nvidia\" || matchesHost(model.baseUrl, NVIDIA_NIM_HOST);\n}\n\nfunction isCloudflareModel(model: Model<Api>): boolean {\n\treturn (\n\t\tmodel.provider === \"cloudflare-workers-ai\" ||\n\t\tmodel.provider === \"cloudflare-ai-gateway\" ||\n\t\tmatchesHost(model.baseUrl, CLOUDFLARE_API_HOST) ||\n\t\tmatchesHost(model.baseUrl, CLOUDFLARE_AI_GATEWAY_HOST)\n\t);\n}\n\nfunction getDefaultAttributionHeaders(\n\tmodel: Model<Api>,\n\tsettingsManager: SettingsManager,\n): Record<string, string> | undefined {\n\tif (!isInstallTelemetryEnabled(settingsManager)) {\n\t\treturn undefined;\n\t}\n\n\tif (isOpenRouterModel(model)) {\n\t\treturn {\n\t\t\t\"HTTP-Referer\": \"https://github.com/dmae97/omk\",\n\t\t\t\"X-OpenRouter-Title\": \"omk\",\n\t\t\t\"X-OpenRouter-Categories\": \"cli-agent\",\n\t\t};\n\t}\n\n\tif (isNvidiaNimModel(model)) {\n\t\treturn {\n\t\t\t\"X-BILLING-INVOKE-ORIGIN\": \"OMK\",\n\t\t};\n\t}\n\n\tif (isCloudflareModel(model)) {\n\t\treturn {\n\t\t\t\"User-Agent\": \"open-multi-agent-kit\",\n\t\t};\n\t}\n\n\treturn undefined;\n}\n\nfunction getSessionHeaders(model: Model<Api>, sessionId: string | undefined): Record<string, string> | undefined {\n\tif (!sessionId) return undefined;\n\tif (\n\t\tmodel.provider !== \"opencode\" &&\n\t\tmodel.provider !== \"opencode-go\" &&\n\t\t!matchesHost(model.baseUrl, OPENCODE_HOST)\n\t) {\n\t\treturn undefined;\n\t}\n\treturn { \"x-opencode-session\": sessionId, \"x-opencode-client\": \"omk\" };\n}\n\nexport function mergeProviderAttributionHeaders(\n\tmodel: Model<Api>,\n\tsettingsManager: SettingsManager,\n\tsessionId: string | undefined,\n\t...headerSources: Array<Record<string, string> | undefined>\n): Record<string, string> | undefined {\n\tconst merged = {\n\t\t...getSessionHeaders(model, sessionId),\n\t\t...getDefaultAttributionHeaders(model, settingsManager),\n\t};\n\n\tfor (const headers of headerSources) {\n\t\tif (headers) {\n\t\t\tObject.assign(merged, headers);\n\t\t}\n\t}\n\n\treturn Object.keys(merged).length > 0 ? merged : undefined;\n}\n"]}
+{"version":3,"file":"provider-attribution.js","sourceRoot":"","sources":["../../src/core/provider-attribution.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,yBAAyB,EAAE,MAAM,gBAAgB,CAAC;AAE3D,MAAM,eAAe,GAAG,eAAe,CAAC;AACxC,MAAM,eAAe,GAAG,0BAA0B,CAAC;AACnD,MAAM,mBAAmB,GAAG,oBAAoB,CAAC;AACjD,MAAM,0BAA0B,GAAG,2BAA2B,CAAC;AAC/D,MAAM,aAAa,GAAG,aAAa,CAAC;AAEpC,SAAS,WAAW,CAAC,OAAe,EAAE,YAAoB,EAAW;IACpE,IAAI,CAAC;QACJ,OAAO,IAAI,GAAG,CAAC,OAAO,CAAC,CAAC,QAAQ,KAAK,YAAY,CAAC;IACnD,CAAC;IAAC,MAAM,CAAC;QACR,OAAO,KAAK,CAAC;IACd,CAAC;AAAA,CACD;AAED,SAAS,iBAAiB,CAAC,KAAiB,EAAW;IACtD,OAAO,KAAK,CAAC,QAAQ,KAAK,YAAY,IAAI,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,eAAe,CAAC,CAAC;AAAA,CAClF;AAED,SAAS,gBAAgB,CAAC,KAAiB,EAAW;IACrD,OAAO,KAAK,CAAC,QAAQ,KAAK,QAAQ,IAAI,WAAW,CAAC,KAAK,CAAC,OAAO,EAAE,eAAe,CAAC,CAAC;AAAA,CAClF;AAED,SAAS,iBAAiB,CAAC,KAAiB,EAAW;IACtD,OAAO,CACN,KAAK,CAAC,QAAQ,KAAK,uBAAuB;QAC1C,KAAK,CAAC,QAAQ,KAAK,uBAAuB;QAC1C,WAAW,CAAC,KAAK,CAAC,OAAO,EAAE,mBAAmB,CAAC;QAC/C,WAAW,CAAC,KAAK,CAAC,OAAO,EAAE,0BAA0B,CAAC,CACtD,CAAC;AAAA,CACF;AAED,SAAS,4BAA4B,CACpC,KAAiB,EACjB,eAAgC,EACK;IACrC,IAAI,CAAC,yBAAyB,CAAC,eAAe,CAAC,EAAE,CAAC;QACjD,OAAO,SAAS,CAAC;IAClB,CAAC;IAED,IAAI,iBAAiB,CAAC,KAAK,CAAC,EAAE,CAAC;QAC9B,OAAO;YACN,cAAc,EAAE,+BAA+B;YAC/C,oBAAoB,EAAE,KAAK;YAC3B,yBAAyB,EAAE,WAAW;SACtC,CAAC;IACH,CAAC;IAED,IAAI,gBAAgB,CAAC,KAAK,CAAC,EAAE,CAAC;QAC7B,OAAO;YACN,yBAAyB,EAAE,KAAK;SAChC,CAAC;IACH,CAAC;IAED,IAAI,iBAAiB,CAAC,KAAK,CAAC,EAAE,CAAC;QAC9B,OAAO;YACN,YAAY,EAAE,sBAAsB;SACpC,CAAC;IACH,CAAC;IAED,OAAO,SAAS,CAAC;AAAA,CACjB;AAED,SAAS,iBAAiB,CAAC,KAAiB,EAAE,SAA6B,EAAsC;IAChH,IAAI,CAAC,SAAS;QAAE,OAAO,SAAS,CAAC;IACjC,IACC,KAAK,CAAC,QAAQ,KAAK,UAAU;QAC7B,KAAK,CAAC,QAAQ,KAAK,aAAa;QAChC,CAAC,WAAW,CAAC,KAAK,CAAC,OAAO,EAAE,aAAa,CAAC,EACzC,CAAC;QACF,OAAO,SAAS,CAAC;IAClB,CAAC;IACD,OAAO,EAAE,oBAAoB,EAAE,SAAS,EAAE,mBAAmB,EAAE,KAAK,EAAE,CAAC;AAAA,CACvE;AAED,MAAM,UAAU,+BAA+B,CAC9C,KAAiB,EACjB,eAAgC,EAChC,SAA6B,EAC7B,GAAG,aAAwD,EACtB;IACrC,MAAM,MAAM,GAAG;QACd,GAAG,iBAAiB,CAAC,KAAK,EAAE,SAAS,CAAC;QACtC,GAAG,4BAA4B,CAAC,KAAK,EAAE,eAAe,CAAC;KACvD,CAAC;IAEF,KAAK,MAAM,OAAO,IAAI,aAAa,EAAE,CAAC;QACrC,IAAI,OAAO,EAAE,CAAC;YACb,MAAM,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;QAChC,CAAC;IACF,CAAC;IAED,OAAO,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC;AAAA,CAC3D","sourcesContent":["import type { Api, Model } from \"omk-ai\";\nimport type { SettingsManager } from \"./settings-manager.ts\";\nimport { isInstallTelemetryEnabled } from \"./telemetry.ts\";\n\nconst OPENROUTER_HOST = \"openrouter.ai\";\nconst NVIDIA_NIM_HOST = \"integrate.api.nvidia.com\";\nconst CLOUDFLARE_API_HOST = \"api.cloudflare.com\";\nconst CLOUDFLARE_AI_GATEWAY_HOST = \"gateway.ai.cloudflare.com\";\nconst OPENCODE_HOST = \"opencode.ai\";\n\nfunction matchesHost(baseUrl: string, expectedHost: string): boolean {\n\ttry {\n\t\treturn new URL(baseUrl).hostname === expectedHost;\n\t} catch {\n\t\treturn false;\n\t}\n}\n\nfunction isOpenRouterModel(model: Model<Api>): boolean {\n\treturn model.provider === \"openrouter\" || model.baseUrl.includes(OPENROUTER_HOST);\n}\n\nfunction isNvidiaNimModel(model: Model<Api>): boolean {\n\treturn model.provider === \"nvidia\" || matchesHost(model.baseUrl, NVIDIA_NIM_HOST);\n}\n\nfunction isCloudflareModel(model: Model<Api>): boolean {\n\treturn (\n\t\tmodel.provider === \"cloudflare-workers-ai\" ||\n\t\tmodel.provider === \"cloudflare-ai-gateway\" ||\n\t\tmatchesHost(model.baseUrl, CLOUDFLARE_API_HOST) ||\n\t\tmatchesHost(model.baseUrl, CLOUDFLARE_AI_GATEWAY_HOST)\n\t);\n}\n\nfunction getDefaultAttributionHeaders(\n\tmodel: Model<Api>,\n\tsettingsManager: SettingsManager,\n): Record<string, string> | undefined {\n\tif (!isInstallTelemetryEnabled(settingsManager)) {\n\t\treturn undefined;\n\t}\n\n\tif (isOpenRouterModel(model)) {\n\t\treturn {\n\t\t\t\"HTTP-Referer\": \"https://github.com/dmae97/omk\",\n\t\t\t\"X-OpenRouter-Title\": \"omk\",\n\t\t\t\"X-OpenRouter-Categories\": \"cli-agent\",\n\t\t};\n\t}\n\n\tif (isNvidiaNimModel(model)) {\n\t\treturn {\n\t\t\t\"X-BILLING-INVOKE-ORIGIN\": \"OMK\",\n\t\t};\n\t}\n\n\tif (isCloudflareModel(model)) {\n\t\treturn {\n\t\t\t\"User-Agent\": \"open-multi-agent-kit\",\n\t\t};\n\t}\n\n\treturn undefined;\n}\n\nfunction getSessionHeaders(model: Model<Api>, sessionId: string | undefined): Record<string, string> | undefined {\n\tif (!sessionId) return undefined;\n\tif (\n\t\tmodel.provider !== \"opencode\" &&\n\t\tmodel.provider !== \"opencode-go\" &&\n\t\t!matchesHost(model.baseUrl, OPENCODE_HOST)\n\t) {\n\t\treturn undefined;\n\t}\n\treturn { \"x-opencode-session\": sessionId, \"x-opencode-client\": \"omk\" };\n}\n\nexport function mergeProviderAttributionHeaders(\n\tmodel: Model<Api>,\n\tsettingsManager: SettingsManager,\n\tsessionId: string | undefined,\n\t...headerSources: Array<Record<string, string> | undefined>\n): Record<string, string> | undefined {\n\tconst merged = {\n\t\t...getSessionHeaders(model, sessionId),\n\t\t...getDefaultAttributionHeaders(model, settingsManager),\n\t};\n\n\tfor (const headers of headerSources) {\n\t\tif (headers) {\n\t\t\tObject.assign(merged, headers);\n\t\t}\n\t}\n\n\treturn Object.keys(merged).length > 0 ? merged : undefined;\n}\n"]}

package/dist/core/read-anchors.d.ts

@@ -0,0 +1,110 @@
+/**
+ * `omk.read-anchor` — pure hash-anchored read/edit primitives.
+ *
+ * A read anchor binds a read result to the exact bytes the model saw: the
+ * newline-normalized SHA-256 of the whole file plus the SHA-256 of the specific
+ * line block that was read. Edits can then carry the anchor so the core can
+ * reject stale edits (the file changed under the model) before applying them.
+ *
+ * All hashing in this module is performed on newline-normalized (LF) UTF-8
+ * content so anchors are robust to CRLF/CR differences, matching the edit
+ * pipeline which normalizes to LF before matching.
+ *
+ * Side-effect free: no filesystem access; `node:crypto` only.
+ *
+ * Derived clean-room from the lane C plan
+ * (`.omk/runs/omk-package-hardening-plan/recovery-readseek.md`); no legacy
+ * package source is imported or copied.
+ */
+export declare const READ_ANCHOR_SCHEMA_VERSION = "omk.read-anchor.v1";
+export interface ReadAnchorRange {
+    /** 1-indexed start line (resolved). */
+    readonly offset: number;
+    /** Number of lines included in the block (resolved). */
+    readonly limit: number;
+    /** 1-indexed last line included, inclusive. Equals `offset - 1` for an empty block. */
+    readonly endLine: number;
+}
+export interface ReadAnchor {
+    readonly schemaVersion: typeof READ_ANCHOR_SCHEMA_VERSION;
+    readonly readId: string;
+    readonly path: string;
+    /** SHA-256 (hex) of the newline-normalized full file content. */
+    readonly fileSha256: string;
+    readonly range: ReadAnchorRange;
+    /** SHA-256 (hex) of the newline-normalized read block content. */
+    readonly blockSha256: string;
+}
+export interface CreateReadAnchorInput {
+    readonly path: string;
+    /** Full file content as read. */
+    readonly content: string;
+    /** 1-indexed start line; defaults to 1 (whole file). */
+    readonly offset?: number;
+    /** Maximum number of lines; defaults to the rest of the file. */
+    readonly limit?: number;
+    /** Optional deterministic id (otherwise a UUID is generated). */
+    readonly readId?: string;
+}
+/**
+ * Create a hash anchor for a read. Hashes both the full (normalized) file and
+ * the specific line block so a later edit can prove it is operating on the same
+ * bytes the model saw.
+ */
+export declare function createReadAnchor(input: CreateReadAnchorInput): ReadAnchor;
+export interface ReadAnchorVerification {
+    readonly ok: boolean;
+    readonly fileMatches: boolean;
+    readonly blockMatches: boolean;
+    readonly currentFileSha256: string;
+    readonly currentBlockSha256: string;
+}
+/**
+ * Verify an anchor against the current file content. `fileMatches` is the strict
+ * whole-file check; `blockMatches` re-extracts the anchored range and compares
+ * the block hash (useful for lenient relocation diagnostics).
+ */
+export declare function verifyReadAnchor(anchor: ReadAnchor, currentContent: string): ReadAnchorVerification;
+/** Validate an untrusted value as a {@link ReadAnchor}. Pure and fail-closed. */
+export declare function validateReadAnchor(value: unknown): {
+    ok: boolean;
+    errors: readonly string[];
+    anchor?: ReadAnchor;
+};
+export type AnchoredEditMode = "strict" | "lenient";
+export type AnchoredEditVerdict = "allow" | "allow-lenient" | "reject-stale";
+export interface AnchoredEditDecisionInput {
+    readonly anchor: ReadAnchor;
+    /** Current full file content at edit time. */
+    readonly currentContent: string;
+    /** Defaults to `strict`. */
+    readonly mode?: AnchoredEditMode;
+    /**
+     * The exact anchored block text (typically the edit's `oldText`). Required
+     * for lenient relocation when the file has changed; must hash to
+     * `anchor.blockSha256` to be trusted.
+     */
+    readonly anchoredBlockText?: string;
+}
+export interface AnchoredEditDecision {
+    readonly verdict: AnchoredEditVerdict;
+    readonly reason: string;
+    readonly currentFileSha256: string;
+    readonly fileChanged: boolean;
+    /** Lenient mode only: whether the anchored block was uniquely relocated. */
+    readonly blockRelocated?: boolean;
+    /** Lenient mode only: occurrences of the anchored block in current content. */
+    readonly occurrences?: number;
+}
+/**
+ * Decide whether an anchored edit may proceed.
+ *
+ *  - Unchanged file -> `allow` (the common fast path).
+ *  - Changed file, strict mode -> `reject-stale` (the default; forces a re-read).
+ *  - Changed file, lenient mode -> `allow-lenient` only when the anchored block
+ *    text is supplied, hashes to the recorded `blockSha256`, and still occurs
+ *    exactly once in the current content (unique, non-overlapping relocation).
+ *    Zero or multiple occurrences -> `reject-stale`.
+ */
+export declare function decideAnchoredEdit(input: AnchoredEditDecisionInput): AnchoredEditDecision;
+//# sourceMappingURL=read-anchors.d.ts.map

package/dist/core/read-anchors.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"read-anchors.d.ts","sourceRoot":"","sources":["../../src/core/read-anchors.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AAIH,eAAO,MAAM,0BAA0B,uBAAuB,CAAC;AAE/D,MAAM,WAAW,eAAe;IAC/B,uCAAuC;IACvC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,wDAAwD;IACxD,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,uFAAuF;IACvF,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;CACzB;AAED,MAAM,WAAW,UAAU;IAC1B,QAAQ,CAAC,aAAa,EAAE,OAAO,0BAA0B,CAAC;IAC1D,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,iEAAiE;IACjE,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,KAAK,EAAE,eAAe,CAAC;IAChC,kEAAkE;IAClE,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;CAC7B;AAqCD,MAAM,WAAW,qBAAqB;IACrC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,iCAAiC;IACjC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,wDAAwD;IACxD,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IACzB,iEAAiE;IACjE,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC;IACxB,iEAAiE;IACjE,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;CACzB;AAED;;;;GAIG;AACH,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,qBAAqB,GAAG,UAAU,CAWzE;AAED,MAAM,WAAW,sBAAsB;IACtC,QAAQ,CAAC,EAAE,EAAE,OAAO,CAAC;IACrB,QAAQ,CAAC,WAAW,EAAE,OAAO,CAAC;IAC9B,QAAQ,CAAC,YAAY,EAAE,OAAO,CAAC;IAC/B,QAAQ,CAAC,iBAAiB,EAAE,MAAM,CAAC;IACnC,QAAQ,CAAC,kBAAkB,EAAE,MAAM,CAAC;CACpC;AAED;;;;GAIG;AACH,wBAAgB,gBAAgB,CAAC,MAAM,EAAE,UAAU,EAAE,cAAc,EAAE,MAAM,GAAG,sBAAsB,CAcnG;AAED,iFAAiF;AACjF,wBAAgB,kBAAkB,CAAC,KAAK,EAAE,OAAO,GAAG;IAAE,EAAE,EAAE,OAAO,CAAC;IAAC,MAAM,EAAE,SAAS,MAAM,EAAE,CAAC;IAAC,MAAM,CAAC,EAAE,UAAU,CAAA;CAAE,CA+BlH;AAED,MAAM,MAAM,gBAAgB,GAAG,QAAQ,GAAG,SAAS,CAAC;AAEpD,MAAM,MAAM,mBAAmB,GAAG,OAAO,GAAG,eAAe,GAAG,cAAc,CAAC;AAE7E,MAAM,WAAW,yBAAyB;IACzC,QAAQ,CAAC,MAAM,EAAE,UAAU,CAAC;IAC5B,8CAA8C;IAC9C,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAC;IAChC,4BAA4B;IAC5B,QAAQ,CAAC,IAAI,CAAC,EAAE,gBAAgB,CAAC;IACjC;;;;OAIG;IACH,QAAQ,CAAC,iBAAiB,CAAC,EAAE,MAAM,CAAC;CACpC;AAED,MAAM,WAAW,oBAAoB;IACpC,QAAQ,CAAC,OAAO,EAAE,mBAAmB,CAAC;IACtC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,iBAAiB,EAAE,MAAM,CAAC;IACnC,QAAQ,CAAC,WAAW,EAAE,OAAO,CAAC;IAC9B,4EAA4E;IAC5E,QAAQ,CAAC,cAAc,CAAC,EAAE,OAAO,CAAC;IAClC,+EAA+E;IAC/E,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;CAC9B;AAeD;;;;;;;;;GASG;AACH,wBAAgB,kBAAkB,CAAC,KAAK,EAAE,yBAAyB,GAAG,oBAAoB,CAwDzF","sourcesContent":["/**\n * `omk.read-anchor` — pure hash-anchored read/edit primitives.\n *\n * A read anchor binds a read result to the exact bytes the model saw: the\n * newline-normalized SHA-256 of the whole file plus the SHA-256 of the specific\n * line block that was read. Edits can then carry the anchor so the core can\n * reject stale edits (the file changed under the model) before applying them.\n *\n * All hashing in this module is performed on newline-normalized (LF) UTF-8\n * content so anchors are robust to CRLF/CR differences, matching the edit\n * pipeline which normalizes to LF before matching.\n *\n * Side-effect free: no filesystem access; `node:crypto` only.\n *\n * Derived clean-room from the lane C plan\n * (`.omk/runs/omk-package-hardening-plan/recovery-readseek.md`); no legacy\n * package source is imported or copied.\n */\n\nimport { createHash, randomUUID } from \"node:crypto\";\n\nexport const READ_ANCHOR_SCHEMA_VERSION = \"omk.read-anchor.v1\";\n\nexport interface ReadAnchorRange {\n\t/** 1-indexed start line (resolved). */\n\treadonly offset: number;\n\t/** Number of lines included in the block (resolved). */\n\treadonly limit: number;\n\t/** 1-indexed last line included, inclusive. Equals `offset - 1` for an empty block. */\n\treadonly endLine: number;\n}\n\nexport interface ReadAnchor {\n\treadonly schemaVersion: typeof READ_ANCHOR_SCHEMA_VERSION;\n\treadonly readId: string;\n\treadonly path: string;\n\t/** SHA-256 (hex) of the newline-normalized full file content. */\n\treadonly fileSha256: string;\n\treadonly range: ReadAnchorRange;\n\t/** SHA-256 (hex) of the newline-normalized read block content. */\n\treadonly blockSha256: string;\n}\n\nconst HEX64 = /^[0-9a-f]{64}$/i;\n\nfunction normalizeNewlines(content: string): string {\n\treturn content.replace(/\\r\\n/g, \"\\n\").replace(/\\r/g, \"\\n\");\n}\n\nfunction sha256Hex(content: string): string {\n\treturn createHash(\"sha256\").update(content, \"utf8\").digest(\"hex\");\n}\n\ninterface ExtractedBlock {\n\treadonly text: string;\n\treadonly range: ReadAnchorRange;\n}\n\n/**\n * Extract a line block from already newline-normalized content using read-tool\n * semantics: `offset` is a 1-indexed start line, `limit` is the maximum number\n * of lines. Out-of-range requests clamp to an empty block at the end of file.\n */\nfunction extractBlock(normalized: string, offset: number | undefined, limit: number | undefined): ExtractedBlock {\n\tconst lines = normalized.split(\"\\n\");\n\tconst start = Math.max(1, Math.floor(offset ?? 1));\n\tif (start > lines.length) {\n\t\treturn { text: \"\", range: { offset: start, limit: 0, endLine: start - 1 } };\n\t}\n\tconst available = lines.length - (start - 1);\n\tconst count = limit === undefined ? available : Math.max(0, Math.min(Math.floor(limit), available));\n\tconst blockLines = lines.slice(start - 1, start - 1 + count);\n\treturn {\n\t\ttext: blockLines.join(\"\\n\"),\n\t\trange: { offset: start, limit: count, endLine: start - 1 + count },\n\t};\n}\n\nexport interface CreateReadAnchorInput {\n\treadonly path: string;\n\t/** Full file content as read. */\n\treadonly content: string;\n\t/** 1-indexed start line; defaults to 1 (whole file). */\n\treadonly offset?: number;\n\t/** Maximum number of lines; defaults to the rest of the file. */\n\treadonly limit?: number;\n\t/** Optional deterministic id (otherwise a UUID is generated). */\n\treadonly readId?: string;\n}\n\n/**\n * Create a hash anchor for a read. Hashes both the full (normalized) file and\n * the specific line block so a later edit can prove it is operating on the same\n * bytes the model saw.\n */\nexport function createReadAnchor(input: CreateReadAnchorInput): ReadAnchor {\n\tconst normalized = normalizeNewlines(input.content);\n\tconst block = extractBlock(normalized, input.offset, input.limit);\n\treturn {\n\t\tschemaVersion: READ_ANCHOR_SCHEMA_VERSION,\n\t\treadId: input.readId ?? randomUUID(),\n\t\tpath: input.path,\n\t\tfileSha256: sha256Hex(normalized),\n\t\trange: block.range,\n\t\tblockSha256: sha256Hex(block.text),\n\t};\n}\n\nexport interface ReadAnchorVerification {\n\treadonly ok: boolean;\n\treadonly fileMatches: boolean;\n\treadonly blockMatches: boolean;\n\treadonly currentFileSha256: string;\n\treadonly currentBlockSha256: string;\n}\n\n/**\n * Verify an anchor against the current file content. `fileMatches` is the strict\n * whole-file check; `blockMatches` re-extracts the anchored range and compares\n * the block hash (useful for lenient relocation diagnostics).\n */\nexport function verifyReadAnchor(anchor: ReadAnchor, currentContent: string): ReadAnchorVerification {\n\tconst normalized = normalizeNewlines(currentContent);\n\tconst currentFileSha256 = sha256Hex(normalized);\n\tconst block = extractBlock(normalized, anchor.range.offset, anchor.range.limit);\n\tconst currentBlockSha256 = sha256Hex(block.text);\n\tconst fileMatches = currentFileSha256 === anchor.fileSha256;\n\tconst blockMatches = currentBlockSha256 === anchor.blockSha256;\n\treturn {\n\t\tok: fileMatches && blockMatches,\n\t\tfileMatches,\n\t\tblockMatches,\n\t\tcurrentFileSha256,\n\t\tcurrentBlockSha256,\n\t};\n}\n\n/** Validate an untrusted value as a {@link ReadAnchor}. Pure and fail-closed. */\nexport function validateReadAnchor(value: unknown): { ok: boolean; errors: readonly string[]; anchor?: ReadAnchor } {\n\tconst errors: string[] = [];\n\tif (typeof value !== \"object\" || value === null || Array.isArray(value)) {\n\t\treturn { ok: false, errors: [\"anchor must be an object\"] };\n\t}\n\tconst anchor = value as Record<string, unknown>;\n\tif (anchor.schemaVersion !== READ_ANCHOR_SCHEMA_VERSION) {\n\t\terrors.push(`schemaVersion must be ${READ_ANCHOR_SCHEMA_VERSION}`);\n\t}\n\tif (typeof anchor.readId !== \"string\" || anchor.readId.length === 0)\n\t\terrors.push(\"readId must be a non-empty string\");\n\tif (typeof anchor.path !== \"string\" || anchor.path.length === 0) errors.push(\"path must be a non-empty string\");\n\tif (typeof anchor.fileSha256 !== \"string\" || !HEX64.test(anchor.fileSha256)) {\n\t\terrors.push(\"fileSha256 must be a 64-char hex digest\");\n\t}\n\tif (typeof anchor.blockSha256 !== \"string\" || !HEX64.test(anchor.blockSha256)) {\n\t\terrors.push(\"blockSha256 must be a 64-char hex digest\");\n\t}\n\tconst range = anchor.range;\n\tif (typeof range !== \"object\" || range === null || Array.isArray(range)) {\n\t\terrors.push(\"range must be an object\");\n\t} else {\n\t\tconst r = range as Record<string, unknown>;\n\t\tfor (const key of [\"offset\", \"limit\", \"endLine\"]) {\n\t\t\tif (typeof r[key] !== \"number\" || !Number.isInteger(r[key]) || (r[key] as number) < 0) {\n\t\t\t\terrors.push(`range.${key} must be a non-negative integer`);\n\t\t\t}\n\t\t}\n\t}\n\tif (errors.length > 0) return { ok: false, errors };\n\treturn { ok: true, errors: [], anchor: value as unknown as ReadAnchor };\n}\n\nexport type AnchoredEditMode = \"strict\" | \"lenient\";\n\nexport type AnchoredEditVerdict = \"allow\" | \"allow-lenient\" | \"reject-stale\";\n\nexport interface AnchoredEditDecisionInput {\n\treadonly anchor: ReadAnchor;\n\t/** Current full file content at edit time. */\n\treadonly currentContent: string;\n\t/** Defaults to `strict`. */\n\treadonly mode?: AnchoredEditMode;\n\t/**\n\t * The exact anchored block text (typically the edit's `oldText`). Required\n\t * for lenient relocation when the file has changed; must hash to\n\t * `anchor.blockSha256` to be trusted.\n\t */\n\treadonly anchoredBlockText?: string;\n}\n\nexport interface AnchoredEditDecision {\n\treadonly verdict: AnchoredEditVerdict;\n\treadonly reason: string;\n\treadonly currentFileSha256: string;\n\treadonly fileChanged: boolean;\n\t/** Lenient mode only: whether the anchored block was uniquely relocated. */\n\treadonly blockRelocated?: boolean;\n\t/** Lenient mode only: occurrences of the anchored block in current content. */\n\treadonly occurrences?: number;\n}\n\nfunction countOccurrences(haystack: string, needle: string): number {\n\tif (needle.length === 0) return 0;\n\tlet count = 0;\n\tlet index = haystack.indexOf(needle);\n\twhile (index !== -1) {\n\t\tcount += 1;\n\t\tindex = haystack.indexOf(needle, index + needle.length);\n\t}\n\treturn count;\n}\n\nconst STALE_REREAD_HINT = \"stale read: the file changed since it was read; re-read the file before editing\";\n\n/**\n * Decide whether an anchored edit may proceed.\n *\n *  - Unchanged file -> `allow` (the common fast path).\n *  - Changed file, strict mode -> `reject-stale` (the default; forces a re-read).\n *  - Changed file, lenient mode -> `allow-lenient` only when the anchored block\n *    text is supplied, hashes to the recorded `blockSha256`, and still occurs\n *    exactly once in the current content (unique, non-overlapping relocation).\n *    Zero or multiple occurrences -> `reject-stale`.\n */\nexport function decideAnchoredEdit(input: AnchoredEditDecisionInput): AnchoredEditDecision {\n\tconst mode = input.mode ?? \"strict\";\n\tconst normalized = normalizeNewlines(input.currentContent);\n\tconst currentFileSha256 = sha256Hex(normalized);\n\tconst fileChanged = currentFileSha256 !== input.anchor.fileSha256;\n\n\tif (!fileChanged) {\n\t\treturn { verdict: \"allow\", reason: \"current file hash matches the anchor\", currentFileSha256, fileChanged };\n\t}\n\n\tif (mode === \"strict\") {\n\t\treturn { verdict: \"reject-stale\", reason: STALE_REREAD_HINT, currentFileSha256, fileChanged };\n\t}\n\n\tconst blockText = input.anchoredBlockText;\n\tif (blockText === undefined || blockText.length === 0) {\n\t\treturn {\n\t\t\tverdict: \"reject-stale\",\n\t\t\treason: \"lenient relocation requires the anchored block text\",\n\t\t\tcurrentFileSha256,\n\t\t\tfileChanged,\n\t\t};\n\t}\n\n\tconst normalizedBlock = normalizeNewlines(blockText);\n\tif (sha256Hex(normalizedBlock) !== input.anchor.blockSha256) {\n\t\treturn {\n\t\t\tverdict: \"reject-stale\",\n\t\t\treason: \"supplied block text does not match the anchored block hash\",\n\t\t\tcurrentFileSha256,\n\t\t\tfileChanged,\n\t\t};\n\t}\n\n\tconst occurrences = countOccurrences(normalized, normalizedBlock);\n\tif (occurrences === 1) {\n\t\treturn {\n\t\t\tverdict: \"allow-lenient\",\n\t\t\treason: \"file changed but the anchored block is still uniquely locatable\",\n\t\t\tcurrentFileSha256,\n\t\t\tfileChanged,\n\t\t\tblockRelocated: true,\n\t\t\toccurrences,\n\t\t};\n\t}\n\treturn {\n\t\tverdict: \"reject-stale\",\n\t\treason:\n\t\t\toccurrences === 0\n\t\t\t\t? \"anchored block no longer exists in the current file\"\n\t\t\t\t: \"anchored block is ambiguous (multiple matches) in the current file\",\n\t\tcurrentFileSha256,\n\t\tfileChanged,\n\t\tblockRelocated: false,\n\t\toccurrences,\n\t};\n}\n"]}

package/dist/core/read-anchors.js

@@ -0,0 +1,193 @@
+/**
+ * `omk.read-anchor` — pure hash-anchored read/edit primitives.
+ *
+ * A read anchor binds a read result to the exact bytes the model saw: the
+ * newline-normalized SHA-256 of the whole file plus the SHA-256 of the specific
+ * line block that was read. Edits can then carry the anchor so the core can
+ * reject stale edits (the file changed under the model) before applying them.
+ *
+ * All hashing in this module is performed on newline-normalized (LF) UTF-8
+ * content so anchors are robust to CRLF/CR differences, matching the edit
+ * pipeline which normalizes to LF before matching.
+ *
+ * Side-effect free: no filesystem access; `node:crypto` only.
+ *
+ * Derived clean-room from the lane C plan
+ * (`.omk/runs/omk-package-hardening-plan/recovery-readseek.md`); no legacy
+ * package source is imported or copied.
+ */
+import { createHash, randomUUID } from "node:crypto";
+export const READ_ANCHOR_SCHEMA_VERSION = "omk.read-anchor.v1";
+const HEX64 = /^[0-9a-f]{64}$/i;
+function normalizeNewlines(content) {
+    return content.replace(/\r\n/g, "\n").replace(/\r/g, "\n");
+}
+function sha256Hex(content) {
+    return createHash("sha256").update(content, "utf8").digest("hex");
+}
+/**
+ * Extract a line block from already newline-normalized content using read-tool
+ * semantics: `offset` is a 1-indexed start line, `limit` is the maximum number
+ * of lines. Out-of-range requests clamp to an empty block at the end of file.
+ */
+function extractBlock(normalized, offset, limit) {
+    const lines = normalized.split("\n");
+    const start = Math.max(1, Math.floor(offset ?? 1));
+    if (start > lines.length) {
+        return { text: "", range: { offset: start, limit: 0, endLine: start - 1 } };
+    }
+    const available = lines.length - (start - 1);
+    const count = limit === undefined ? available : Math.max(0, Math.min(Math.floor(limit), available));
+    const blockLines = lines.slice(start - 1, start - 1 + count);
+    return {
+        text: blockLines.join("\n"),
+        range: { offset: start, limit: count, endLine: start - 1 + count },
+    };
+}
+/**
+ * Create a hash anchor for a read. Hashes both the full (normalized) file and
+ * the specific line block so a later edit can prove it is operating on the same
+ * bytes the model saw.
+ */
+export function createReadAnchor(input) {
+    const normalized = normalizeNewlines(input.content);
+    const block = extractBlock(normalized, input.offset, input.limit);
+    return {
+        schemaVersion: READ_ANCHOR_SCHEMA_VERSION,
+        readId: input.readId ?? randomUUID(),
+        path: input.path,
+        fileSha256: sha256Hex(normalized),
+        range: block.range,
+        blockSha256: sha256Hex(block.text),
+    };
+}
+/**
+ * Verify an anchor against the current file content. `fileMatches` is the strict
+ * whole-file check; `blockMatches` re-extracts the anchored range and compares
+ * the block hash (useful for lenient relocation diagnostics).
+ */
+export function verifyReadAnchor(anchor, currentContent) {
+    const normalized = normalizeNewlines(currentContent);
+    const currentFileSha256 = sha256Hex(normalized);
+    const block = extractBlock(normalized, anchor.range.offset, anchor.range.limit);
+    const currentBlockSha256 = sha256Hex(block.text);
+    const fileMatches = currentFileSha256 === anchor.fileSha256;
+    const blockMatches = currentBlockSha256 === anchor.blockSha256;
+    return {
+        ok: fileMatches && blockMatches,
+        fileMatches,
+        blockMatches,
+        currentFileSha256,
+        currentBlockSha256,
+    };
+}
+/** Validate an untrusted value as a {@link ReadAnchor}. Pure and fail-closed. */
+export function validateReadAnchor(value) {
+    const errors = [];
+    if (typeof value !== "object" || value === null || Array.isArray(value)) {
+        return { ok: false, errors: ["anchor must be an object"] };
+    }
+    const anchor = value;
+    if (anchor.schemaVersion !== READ_ANCHOR_SCHEMA_VERSION) {
+        errors.push(`schemaVersion must be ${READ_ANCHOR_SCHEMA_VERSION}`);
+    }
+    if (typeof anchor.readId !== "string" || anchor.readId.length === 0)
+        errors.push("readId must be a non-empty string");
+    if (typeof anchor.path !== "string" || anchor.path.length === 0)
+        errors.push("path must be a non-empty string");
+    if (typeof anchor.fileSha256 !== "string" || !HEX64.test(anchor.fileSha256)) {
+        errors.push("fileSha256 must be a 64-char hex digest");
+    }
+    if (typeof anchor.blockSha256 !== "string" || !HEX64.test(anchor.blockSha256)) {
+        errors.push("blockSha256 must be a 64-char hex digest");
+    }
+    const range = anchor.range;
+    if (typeof range !== "object" || range === null || Array.isArray(range)) {
+        errors.push("range must be an object");
+    }
+    else {
+        const r = range;
+        for (const key of ["offset", "limit", "endLine"]) {
+            if (typeof r[key] !== "number" || !Number.isInteger(r[key]) || r[key] < 0) {
+                errors.push(`range.${key} must be a non-negative integer`);
+            }
+        }
+    }
+    if (errors.length > 0)
+        return { ok: false, errors };
+    return { ok: true, errors: [], anchor: value };
+}
+function countOccurrences(haystack, needle) {
+    if (needle.length === 0)
+        return 0;
+    let count = 0;
+    let index = haystack.indexOf(needle);
+    while (index !== -1) {
+        count += 1;
+        index = haystack.indexOf(needle, index + needle.length);
+    }
+    return count;
+}
+const STALE_REREAD_HINT = "stale read: the file changed since it was read; re-read the file before editing";
+/**
+ * Decide whether an anchored edit may proceed.
+ *
+ *  - Unchanged file -> `allow` (the common fast path).
+ *  - Changed file, strict mode -> `reject-stale` (the default; forces a re-read).
+ *  - Changed file, lenient mode -> `allow-lenient` only when the anchored block
+ *    text is supplied, hashes to the recorded `blockSha256`, and still occurs
+ *    exactly once in the current content (unique, non-overlapping relocation).
+ *    Zero or multiple occurrences -> `reject-stale`.
+ */
+export function decideAnchoredEdit(input) {
+    const mode = input.mode ?? "strict";
+    const normalized = normalizeNewlines(input.currentContent);
+    const currentFileSha256 = sha256Hex(normalized);
+    const fileChanged = currentFileSha256 !== input.anchor.fileSha256;
+    if (!fileChanged) {
+        return { verdict: "allow", reason: "current file hash matches the anchor", currentFileSha256, fileChanged };
+    }
+    if (mode === "strict") {
+        return { verdict: "reject-stale", reason: STALE_REREAD_HINT, currentFileSha256, fileChanged };
+    }
+    const blockText = input.anchoredBlockText;
+    if (blockText === undefined || blockText.length === 0) {
+        return {
+            verdict: "reject-stale",
+            reason: "lenient relocation requires the anchored block text",
+            currentFileSha256,
+            fileChanged,
+        };
+    }
+    const normalizedBlock = normalizeNewlines(blockText);
+    if (sha256Hex(normalizedBlock) !== input.anchor.blockSha256) {
+        return {
+            verdict: "reject-stale",
+            reason: "supplied block text does not match the anchored block hash",
+            currentFileSha256,
+            fileChanged,
+        };
+    }
+    const occurrences = countOccurrences(normalized, normalizedBlock);
+    if (occurrences === 1) {
+        return {
+            verdict: "allow-lenient",
+            reason: "file changed but the anchored block is still uniquely locatable",
+            currentFileSha256,
+            fileChanged,
+            blockRelocated: true,
+            occurrences,
+        };
+    }
+    return {
+        verdict: "reject-stale",
+        reason: occurrences === 0
+            ? "anchored block no longer exists in the current file"
+            : "anchored block is ambiguous (multiple matches) in the current file",
+        currentFileSha256,
+        fileChanged,
+        blockRelocated: false,
+        occurrences,
+    };
+}
+//# sourceMappingURL=read-anchors.js.map

package/dist/core/read-anchors.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"read-anchors.js","sourceRoot":"","sources":["../../src/core/read-anchors.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AAEH,OAAO,EAAE,UAAU,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAErD,MAAM,CAAC,MAAM,0BAA0B,GAAG,oBAAoB,CAAC;AAsB/D,MAAM,KAAK,GAAG,iBAAiB,CAAC;AAEhC,SAAS,iBAAiB,CAAC,OAAe,EAAU;IACnD,OAAO,OAAO,CAAC,OAAO,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC;AAAA,CAC3D;AAED,SAAS,SAAS,CAAC,OAAe,EAAU;IAC3C,OAAO,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AAAA,CAClE;AAOD;;;;GAIG;AACH,SAAS,YAAY,CAAC,UAAkB,EAAE,MAA0B,EAAE,KAAyB,EAAkB;IAChH,MAAM,KAAK,GAAG,UAAU,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IACrC,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,KAAK,CAAC,MAAM,IAAI,CAAC,CAAC,CAAC,CAAC;IACnD,IAAI,KAAK,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC;QAC1B,OAAO,EAAE,IAAI,EAAE,EAAE,EAAE,KAAK,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,EAAE,OAAO,EAAE,KAAK,GAAG,CAAC,EAAE,EAAE,CAAC;IAC7E,CAAC;IACD,MAAM,SAAS,GAAG,KAAK,CAAC,MAAM,GAAG,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC;IAC7C,MAAM,KAAK,GAAG,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,EAAE,SAAS,CAAC,CAAC,CAAC;IACpG,MAAM,UAAU,GAAG,KAAK,CAAC,KAAK,CAAC,KAAK,GAAG,CAAC,EAAE,KAAK,GAAG,CAAC,GAAG,KAAK,CAAC,CAAC;IAC7D,OAAO;QACN,IAAI,EAAE,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC;QAC3B,KAAK,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,OAAO,EAAE,KAAK,GAAG,CAAC,GAAG,KAAK,EAAE;KAClE,CAAC;AAAA,CACF;AAcD;;;;GAIG;AACH,MAAM,UAAU,gBAAgB,CAAC,KAA4B,EAAc;IAC1E,MAAM,UAAU,GAAG,iBAAiB,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IACpD,MAAM,KAAK,GAAG,YAAY,CAAC,UAAU,EAAE,KAAK,CAAC,MAAM,EAAE,KAAK,CAAC,KAAK,CAAC,CAAC;IAClE,OAAO;QACN,aAAa,EAAE,0BAA0B;QACzC,MAAM,EAAE,KAAK,CAAC,MAAM,IAAI,UAAU,EAAE;QACpC,IAAI,EAAE,KAAK,CAAC,IAAI;QAChB,UAAU,EAAE,SAAS,CAAC,UAAU,CAAC;QACjC,KAAK,EAAE,KAAK,CAAC,KAAK;QAClB,WAAW,EAAE,SAAS,CAAC,KAAK,CAAC,IAAI,CAAC;KAClC,CAAC;AAAA,CACF;AAUD;;;;GAIG;AACH,MAAM,UAAU,gBAAgB,CAAC,MAAkB,EAAE,cAAsB,EAA0B;IACpG,MAAM,UAAU,GAAG,iBAAiB,CAAC,cAAc,CAAC,CAAC;IACrD,MAAM,iBAAiB,GAAG,SAAS,CAAC,UAAU,CAAC,CAAC;IAChD,MAAM,KAAK,GAAG,YAAY,CAAC,UAAU,EAAE,MAAM,CAAC,KAAK,CAAC,MAAM,EAAE,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;IAChF,MAAM,kBAAkB,GAAG,SAAS,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IACjD,MAAM,WAAW,GAAG,iBAAiB,KAAK,MAAM,CAAC,UAAU,CAAC;IAC5D,MAAM,YAAY,GAAG,kBAAkB,KAAK,MAAM,CAAC,WAAW,CAAC;IAC/D,OAAO;QACN,EAAE,EAAE,WAAW,IAAI,YAAY;QAC/B,WAAW;QACX,YAAY;QACZ,iBAAiB;QACjB,kBAAkB;KAClB,CAAC;AAAA,CACF;AAED,iFAAiF;AACjF,MAAM,UAAU,kBAAkB,CAAC,KAAc,EAAmE;IACnH,MAAM,MAAM,GAAa,EAAE,CAAC;IAC5B,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QACzE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,0BAA0B,CAAC,EAAE,CAAC;IAC5D,CAAC;IACD,MAAM,MAAM,GAAG,KAAgC,CAAC;IAChD,IAAI,MAAM,CAAC,aAAa,KAAK,0BAA0B,EAAE,CAAC;QACzD,MAAM,CAAC,IAAI,CAAC,yBAAyB,0BAA0B,EAAE,CAAC,CAAC;IACpE,CAAC;IACD,IAAI,OAAO,MAAM,CAAC,MAAM,KAAK,QAAQ,IAAI,MAAM,CAAC,MAAM,CAAC,MAAM,KAAK,CAAC;QAClE,MAAM,CAAC,IAAI,CAAC,mCAAmC,CAAC,CAAC;IAClD,IAAI,OAAO,MAAM,CAAC,IAAI,KAAK,QAAQ,IAAI,MAAM,CAAC,IAAI,CAAC,MAAM,KAAK,CAAC;QAAE,MAAM,CAAC,IAAI,CAAC,iCAAiC,CAAC,CAAC;IAChH,IAAI,OAAO,MAAM,CAAC,UAAU,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC,EAAE,CAAC;QAC7E,MAAM,CAAC,IAAI,CAAC,yCAAyC,CAAC,CAAC;IACxD,CAAC;IACD,IAAI,OAAO,MAAM,CAAC,WAAW,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,WAAW,CAAC,EAAE,CAAC;QAC/E,MAAM,CAAC,IAAI,CAAC,0CAA0C,CAAC,CAAC;IACzD,CAAC;IACD,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC;IAC3B,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QACzE,MAAM,CAAC,IAAI,CAAC,yBAAyB,CAAC,CAAC;IACxC,CAAC;SAAM,CAAC;QACP,MAAM,CAAC,GAAG,KAAgC,CAAC;QAC3C,KAAK,MAAM,GAAG,IAAI,CAAC,QAAQ,EAAE,OAAO,EAAE,SAAS,CAAC,EAAE,CAAC;YAClD,IAAI,OAAO,CAAC,CAAC,GAAG,CAAC,KAAK,QAAQ,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,IAAK,CAAC,CAAC,GAAG,CAAY,GAAG,CAAC,EAAE,CAAC;gBACvF,MAAM,CAAC,IAAI,CAAC,SAAS,GAAG,iCAAiC,CAAC,CAAC;YAC5D,CAAC;QACF,CAAC;IACF,CAAC;IACD,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC;IACpD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,EAAE,KAA8B,EAAE,CAAC;AAAA,CACxE;AA+BD,SAAS,gBAAgB,CAAC,QAAgB,EAAE,MAAc,EAAU;IACnE,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,CAAC,CAAC;IAClC,IAAI,KAAK,GAAG,CAAC,CAAC;IACd,IAAI,KAAK,GAAG,QAAQ,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;IACrC,OAAO,KAAK,KAAK,CAAC,CAAC,EAAE,CAAC;QACrB,KAAK,IAAI,CAAC,CAAC;QACX,KAAK,GAAG,QAAQ,CAAC,OAAO,CAAC,MAAM,EAAE,KAAK,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC;IACzD,CAAC;IACD,OAAO,KAAK,CAAC;AAAA,CACb;AAED,MAAM,iBAAiB,GAAG,iFAAiF,CAAC;AAE5G;;;;;;;;;GASG;AACH,MAAM,UAAU,kBAAkB,CAAC,KAAgC,EAAwB;IAC1F,MAAM,IAAI,GAAG,KAAK,CAAC,IAAI,IAAI,QAAQ,CAAC;IACpC,MAAM,UAAU,GAAG,iBAAiB,CAAC,KAAK,CAAC,cAAc,CAAC,CAAC;IAC3D,MAAM,iBAAiB,GAAG,SAAS,CAAC,UAAU,CAAC,CAAC;IAChD,MAAM,WAAW,GAAG,iBAAiB,KAAK,KAAK,CAAC,MAAM,CAAC,UAAU,CAAC;IAElE,IAAI,CAAC,WAAW,EAAE,CAAC;QAClB,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,sCAAsC,EAAE,iBAAiB,EAAE,WAAW,EAAE,CAAC;IAC7G,CAAC;IAED,IAAI,IAAI,KAAK,QAAQ,EAAE,CAAC;QACvB,OAAO,EAAE,OAAO,EAAE,cAAc,EAAE,MAAM,EAAE,iBAAiB,EAAE,iBAAiB,EAAE,WAAW,EAAE,CAAC;IAC/F,CAAC;IAED,MAAM,SAAS,GAAG,KAAK,CAAC,iBAAiB,CAAC;IAC1C,IAAI,SAAS,KAAK,SAAS,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACvD,OAAO;YACN,OAAO,EAAE,cAAc;YACvB,MAAM,EAAE,qDAAqD;YAC7D,iBAAiB;YACjB,WAAW;SACX,CAAC;IACH,CAAC;IAED,MAAM,eAAe,GAAG,iBAAiB,CAAC,SAAS,CAAC,CAAC;IACrD,IAAI,SAAS,CAAC,eAAe,CAAC,KAAK,KAAK,CAAC,MAAM,CAAC,WAAW,EAAE,CAAC;QAC7D,OAAO;YACN,OAAO,EAAE,cAAc;YACvB,MAAM,EAAE,4DAA4D;YACpE,iBAAiB;YACjB,WAAW;SACX,CAAC;IACH,CAAC;IAED,MAAM,WAAW,GAAG,gBAAgB,CAAC,UAAU,EAAE,eAAe,CAAC,CAAC;IAClE,IAAI,WAAW,KAAK,CAAC,EAAE,CAAC;QACvB,OAAO;YACN,OAAO,EAAE,eAAe;YACxB,MAAM,EAAE,iEAAiE;YACzE,iBAAiB;YACjB,WAAW;YACX,cAAc,EAAE,IAAI;YACpB,WAAW;SACX,CAAC;IACH,CAAC;IACD,OAAO;QACN,OAAO,EAAE,cAAc;QACvB,MAAM,EACL,WAAW,KAAK,CAAC;YAChB,CAAC,CAAC,qDAAqD;YACvD,CAAC,CAAC,oEAAoE;QACxE,iBAAiB;QACjB,WAAW;QACX,cAAc,EAAE,KAAK;QACrB,WAAW;KACX,CAAC;AAAA,CACF","sourcesContent":["/**\n * `omk.read-anchor` — pure hash-anchored read/edit primitives.\n *\n * A read anchor binds a read result to the exact bytes the model saw: the\n * newline-normalized SHA-256 of the whole file plus the SHA-256 of the specific\n * line block that was read. Edits can then carry the anchor so the core can\n * reject stale edits (the file changed under the model) before applying them.\n *\n * All hashing in this module is performed on newline-normalized (LF) UTF-8\n * content so anchors are robust to CRLF/CR differences, matching the edit\n * pipeline which normalizes to LF before matching.\n *\n * Side-effect free: no filesystem access; `node:crypto` only.\n *\n * Derived clean-room from the lane C plan\n * (`.omk/runs/omk-package-hardening-plan/recovery-readseek.md`); no legacy\n * package source is imported or copied.\n */\n\nimport { createHash, randomUUID } from \"node:crypto\";\n\nexport const READ_ANCHOR_SCHEMA_VERSION = \"omk.read-anchor.v1\";\n\nexport interface ReadAnchorRange {\n\t/** 1-indexed start line (resolved). */\n\treadonly offset: number;\n\t/** Number of lines included in the block (resolved). */\n\treadonly limit: number;\n\t/** 1-indexed last line included, inclusive. Equals `offset - 1` for an empty block. */\n\treadonly endLine: number;\n}\n\nexport interface ReadAnchor {\n\treadonly schemaVersion: typeof READ_ANCHOR_SCHEMA_VERSION;\n\treadonly readId: string;\n\treadonly path: string;\n\t/** SHA-256 (hex) of the newline-normalized full file content. */\n\treadonly fileSha256: string;\n\treadonly range: ReadAnchorRange;\n\t/** SHA-256 (hex) of the newline-normalized read block content. */\n\treadonly blockSha256: string;\n}\n\nconst HEX64 = /^[0-9a-f]{64}$/i;\n\nfunction normalizeNewlines(content: string): string {\n\treturn content.replace(/\\r\\n/g, \"\\n\").replace(/\\r/g, \"\\n\");\n}\n\nfunction sha256Hex(content: string): string {\n\treturn createHash(\"sha256\").update(content, \"utf8\").digest(\"hex\");\n}\n\ninterface ExtractedBlock {\n\treadonly text: string;\n\treadonly range: ReadAnchorRange;\n}\n\n/**\n * Extract a line block from already newline-normalized content using read-tool\n * semantics: `offset` is a 1-indexed start line, `limit` is the maximum number\n * of lines. Out-of-range requests clamp to an empty block at the end of file.\n */\nfunction extractBlock(normalized: string, offset: number | undefined, limit: number | undefined): ExtractedBlock {\n\tconst lines = normalized.split(\"\\n\");\n\tconst start = Math.max(1, Math.floor(offset ?? 1));\n\tif (start > lines.length) {\n\t\treturn { text: \"\", range: { offset: start, limit: 0, endLine: start - 1 } };\n\t}\n\tconst available = lines.length - (start - 1);\n\tconst count = limit === undefined ? available : Math.max(0, Math.min(Math.floor(limit), available));\n\tconst blockLines = lines.slice(start - 1, start - 1 + count);\n\treturn {\n\t\ttext: blockLines.join(\"\\n\"),\n\t\trange: { offset: start, limit: count, endLine: start - 1 + count },\n\t};\n}\n\nexport interface CreateReadAnchorInput {\n\treadonly path: string;\n\t/** Full file content as read. */\n\treadonly content: string;\n\t/** 1-indexed start line; defaults to 1 (whole file). */\n\treadonly offset?: number;\n\t/** Maximum number of lines; defaults to the rest of the file. */\n\treadonly limit?: number;\n\t/** Optional deterministic id (otherwise a UUID is generated). */\n\treadonly readId?: string;\n}\n\n/**\n * Create a hash anchor for a read. Hashes both the full (normalized) file and\n * the specific line block so a later edit can prove it is operating on the same\n * bytes the model saw.\n */\nexport function createReadAnchor(input: CreateReadAnchorInput): ReadAnchor {\n\tconst normalized = normalizeNewlines(input.content);\n\tconst block = extractBlock(normalized, input.offset, input.limit);\n\treturn {\n\t\tschemaVersion: READ_ANCHOR_SCHEMA_VERSION,\n\t\treadId: input.readId ?? randomUUID(),\n\t\tpath: input.path,\n\t\tfileSha256: sha256Hex(normalized),\n\t\trange: block.range,\n\t\tblockSha256: sha256Hex(block.text),\n\t};\n}\n\nexport interface ReadAnchorVerification {\n\treadonly ok: boolean;\n\treadonly fileMatches: boolean;\n\treadonly blockMatches: boolean;\n\treadonly currentFileSha256: string;\n\treadonly currentBlockSha256: string;\n}\n\n/**\n * Verify an anchor against the current file content. `fileMatches` is the strict\n * whole-file check; `blockMatches` re-extracts the anchored range and compares\n * the block hash (useful for lenient relocation diagnostics).\n */\nexport function verifyReadAnchor(anchor: ReadAnchor, currentContent: string): ReadAnchorVerification {\n\tconst normalized = normalizeNewlines(currentContent);\n\tconst currentFileSha256 = sha256Hex(normalized);\n\tconst block = extractBlock(normalized, anchor.range.offset, anchor.range.limit);\n\tconst currentBlockSha256 = sha256Hex(block.text);\n\tconst fileMatches = currentFileSha256 === anchor.fileSha256;\n\tconst blockMatches = currentBlockSha256 === anchor.blockSha256;\n\treturn {\n\t\tok: fileMatches && blockMatches,\n\t\tfileMatches,\n\t\tblockMatches,\n\t\tcurrentFileSha256,\n\t\tcurrentBlockSha256,\n\t};\n}\n\n/** Validate an untrusted value as a {@link ReadAnchor}. Pure and fail-closed. */\nexport function validateReadAnchor(value: unknown): { ok: boolean; errors: readonly string[]; anchor?: ReadAnchor } {\n\tconst errors: string[] = [];\n\tif (typeof value !== \"object\" || value === null || Array.isArray(value)) {\n\t\treturn { ok: false, errors: [\"anchor must be an object\"] };\n\t}\n\tconst anchor = value as Record<string, unknown>;\n\tif (anchor.schemaVersion !== READ_ANCHOR_SCHEMA_VERSION) {\n\t\terrors.push(`schemaVersion must be ${READ_ANCHOR_SCHEMA_VERSION}`);\n\t}\n\tif (typeof anchor.readId !== \"string\" || anchor.readId.length === 0)\n\t\terrors.push(\"readId must be a non-empty string\");\n\tif (typeof anchor.path !== \"string\" || anchor.path.length === 0) errors.push(\"path must be a non-empty string\");\n\tif (typeof anchor.fileSha256 !== \"string\" || !HEX64.test(anchor.fileSha256)) {\n\t\terrors.push(\"fileSha256 must be a 64-char hex digest\");\n\t}\n\tif (typeof anchor.blockSha256 !== \"string\" || !HEX64.test(anchor.blockSha256)) {\n\t\terrors.push(\"blockSha256 must be a 64-char hex digest\");\n\t}\n\tconst range = anchor.range;\n\tif (typeof range !== \"object\" || range === null || Array.isArray(range)) {\n\t\terrors.push(\"range must be an object\");\n\t} else {\n\t\tconst r = range as Record<string, unknown>;\n\t\tfor (const key of [\"offset\", \"limit\", \"endLine\"]) {\n\t\t\tif (typeof r[key] !== \"number\" || !Number.isInteger(r[key]) || (r[key] as number) < 0) {\n\t\t\t\terrors.push(`range.${key} must be a non-negative integer`);\n\t\t\t}\n\t\t}\n\t}\n\tif (errors.length > 0) return { ok: false, errors };\n\treturn { ok: true, errors: [], anchor: value as unknown as ReadAnchor };\n}\n\nexport type AnchoredEditMode = \"strict\" | \"lenient\";\n\nexport type AnchoredEditVerdict = \"allow\" | \"allow-lenient\" | \"reject-stale\";\n\nexport interface AnchoredEditDecisionInput {\n\treadonly anchor: ReadAnchor;\n\t/** Current full file content at edit time. */\n\treadonly currentContent: string;\n\t/** Defaults to `strict`. */\n\treadonly mode?: AnchoredEditMode;\n\t/**\n\t * The exact anchored block text (typically the edit's `oldText`). Required\n\t * for lenient relocation when the file has changed; must hash to\n\t * `anchor.blockSha256` to be trusted.\n\t */\n\treadonly anchoredBlockText?: string;\n}\n\nexport interface AnchoredEditDecision {\n\treadonly verdict: AnchoredEditVerdict;\n\treadonly reason: string;\n\treadonly currentFileSha256: string;\n\treadonly fileChanged: boolean;\n\t/** Lenient mode only: whether the anchored block was uniquely relocated. */\n\treadonly blockRelocated?: boolean;\n\t/** Lenient mode only: occurrences of the anchored block in current content. */\n\treadonly occurrences?: number;\n}\n\nfunction countOccurrences(haystack: string, needle: string): number {\n\tif (needle.length === 0) return 0;\n\tlet count = 0;\n\tlet index = haystack.indexOf(needle);\n\twhile (index !== -1) {\n\t\tcount += 1;\n\t\tindex = haystack.indexOf(needle, index + needle.length);\n\t}\n\treturn count;\n}\n\nconst STALE_REREAD_HINT = \"stale read: the file changed since it was read; re-read the file before editing\";\n\n/**\n * Decide whether an anchored edit may proceed.\n *\n *  - Unchanged file -> `allow` (the common fast path).\n *  - Changed file, strict mode -> `reject-stale` (the default; forces a re-read).\n *  - Changed file, lenient mode -> `allow-lenient` only when the anchored block\n *    text is supplied, hashes to the recorded `blockSha256`, and still occurs\n *    exactly once in the current content (unique, non-overlapping relocation).\n *    Zero or multiple occurrences -> `reject-stale`.\n */\nexport function decideAnchoredEdit(input: AnchoredEditDecisionInput): AnchoredEditDecision {\n\tconst mode = input.mode ?? \"strict\";\n\tconst normalized = normalizeNewlines(input.currentContent);\n\tconst currentFileSha256 = sha256Hex(normalized);\n\tconst fileChanged = currentFileSha256 !== input.anchor.fileSha256;\n\n\tif (!fileChanged) {\n\t\treturn { verdict: \"allow\", reason: \"current file hash matches the anchor\", currentFileSha256, fileChanged };\n\t}\n\n\tif (mode === \"strict\") {\n\t\treturn { verdict: \"reject-stale\", reason: STALE_REREAD_HINT, currentFileSha256, fileChanged };\n\t}\n\n\tconst blockText = input.anchoredBlockText;\n\tif (blockText === undefined || blockText.length === 0) {\n\t\treturn {\n\t\t\tverdict: \"reject-stale\",\n\t\t\treason: \"lenient relocation requires the anchored block text\",\n\t\t\tcurrentFileSha256,\n\t\t\tfileChanged,\n\t\t};\n\t}\n\n\tconst normalizedBlock = normalizeNewlines(blockText);\n\tif (sha256Hex(normalizedBlock) !== input.anchor.blockSha256) {\n\t\treturn {\n\t\t\tverdict: \"reject-stale\",\n\t\t\treason: \"supplied block text does not match the anchored block hash\",\n\t\t\tcurrentFileSha256,\n\t\t\tfileChanged,\n\t\t};\n\t}\n\n\tconst occurrences = countOccurrences(normalized, normalizedBlock);\n\tif (occurrences === 1) {\n\t\treturn {\n\t\t\tverdict: \"allow-lenient\",\n\t\t\treason: \"file changed but the anchored block is still uniquely locatable\",\n\t\t\tcurrentFileSha256,\n\t\t\tfileChanged,\n\t\t\tblockRelocated: true,\n\t\t\toccurrences,\n\t\t};\n\t}\n\treturn {\n\t\tverdict: \"reject-stale\",\n\t\treason:\n\t\t\toccurrences === 0\n\t\t\t\t? \"anchored block no longer exists in the current file\"\n\t\t\t\t: \"anchored block is ambiguous (multiple matches) in the current file\",\n\t\tcurrentFileSha256,\n\t\tfileChanged,\n\t\tblockRelocated: false,\n\t\toccurrences,\n\t};\n}\n"]}