vgxness 1.20.4 → 1.20.6

package/dist/memory/sqlite/database.js

@@ -1,228 +1 @@
-import { existsSync, readdirSync, readFileSync } from 'node:fs';
-import { createRequire } from 'node:module';
-import { dirname, join } from 'node:path';
-import { fileURLToPath } from 'node:url';
-const migrationsDirectory = join(dirname(fileURLToPath(import.meta.url)), 'migrations');
-export const sqliteBusyTimeoutMs = 5000;
-const bunRequiredGuidance = 'Real local SQLite storage requires Bun. Use the installed Bun-backed vgxness/vgx runtime, or run Bun storage verification with bun run verify:bun-sqlite.';
-export class MemoryDatabase {
-    connection;
-    constructor(connection) {
-        this.connection = connection;
-    }
-    static open(options) {
-        try {
-            const connection = openSqliteConnection(options);
-            connection.pragma('foreign_keys = ON');
-            connection.pragma(`busy_timeout = ${sqliteBusyTimeoutMs}`);
-            const memoryDatabase = new MemoryDatabase(connection);
-            if (!(options.readonly ?? false)) {
-                const migration = memoryDatabase.applyMigrations();
-                if (!migration.ok) {
-                    connection.close();
-                    return migration;
-                }
-            }
-            return { ok: true, value: memoryDatabase };
-        }
-        catch (cause) {
-            return {
-                ok: false,
-                error: {
-                    code: 'store_unavailable',
-                    message: buildMemoryStoreUnavailableMessage(options.path, cause),
-                    cause,
-                },
-            };
-        }
-    }
-    applyMigrations() {
-        if (!existsSync(migrationsDirectory)) {
-            return migrationFailure(`Migrations directory not found: ${migrationsDirectory}`);
-        }
-        const migrationFiles = readdirSync(migrationsDirectory)
-            .filter((file) => file.endsWith('.sql'))
-            .sort();
-        try {
-            const run = this.connection.transaction(() => {
-                this.connection.exec(`
-          CREATE TABLE IF NOT EXISTS schema_migrations (
-            version TEXT PRIMARY KEY,
-            applied_at TEXT NOT NULL DEFAULT (strftime('%Y-%m-%dT%H:%M:%fZ', 'now'))
-          );
-        `);
-                const hasMigration = this.connection.prepare('SELECT 1 FROM schema_migrations WHERE version = ?');
-                const recordMigration = this.connection.prepare('INSERT INTO schema_migrations(version) VALUES (?)');
-                for (const file of migrationFiles) {
-                    if (hasMigration.get(file))
-                        continue;
-                    this.connection.exec(readFileSync(join(migrationsDirectory, file), 'utf8'));
-                    recordMigration.run(file);
-                }
-            });
-            run();
-            return { ok: true, value: undefined };
-        }
-        catch (cause) {
-            return migrationFailure('Failed to apply local memory migrations', cause);
-        }
-    }
-    transaction(operation) {
-        try {
-            const run = this.connection.transaction(operation);
-            return { ok: true, value: run.immediate() };
-        }
-        catch (cause) {
-            return {
-                ok: false,
-                error: {
-                    code: 'transaction_failed',
-                    message: 'Local memory transaction failed and was rolled back',
-                    cause,
-                },
-            };
-        }
-    }
-    close() {
-        this.connection.close();
-    }
-}
-export function openMemoryDatabase(options) {
-    return MemoryDatabase.open(options);
-}
-export function buildMemoryStoreUnavailableMessage(path, cause) {
-    const message = `Unable to open local memory store at ${path}`;
-    if (!isUnsupportedSqliteRuntimeError(cause))
-        return message;
-    return `${message}. ${bunRequiredGuidance}`;
-}
-function openSqliteConnection(options) {
-    return resolveSqliteDriver()(options);
-}
-function resolveSqliteDriver() {
-    if (isBunRuntime())
-        return resolveBunSqliteDriver();
-    throw createUnsupportedSqliteRuntimeError();
-}
-function isBunRuntime() {
-    return typeof globalThis.Bun !== 'undefined';
-}
-function resolveBunSqliteDriver() {
-    const require = createRequire(import.meta.url);
-    const module = require('bun:sqlite');
-    const BunDatabase = module.Database;
-    if (typeof BunDatabase !== 'function')
-        throw new Error('bun:sqlite Database constructor is unavailable');
-    return (options) => createBunSqliteConnection(new BunDatabase(options.path, { readonly: options.readonly ?? false, strict: true }));
-}
-function createUnsupportedSqliteRuntimeError() {
-    const error = new Error(bunRequiredGuidance);
-    error.name = 'UnsupportedSqliteRuntimeError';
-    return error;
-}
-function isUnsupportedSqliteRuntimeError(cause) {
-    return cause instanceof Error && cause.name === 'UnsupportedSqliteRuntimeError';
-}
-function createBunSqliteConnection(database) {
-    const record = database;
-    return {
-        prepare(sql) {
-            const prepare = record.prepare;
-            if (typeof prepare !== 'function')
-                throw new Error('bun:sqlite prepare() is unavailable');
-            return createBunSqliteStatement(prepare.call(database, sql));
-        },
-        exec(sql) {
-            const exec = record.exec;
-            if (typeof exec === 'function')
-                return exec.call(database, sql);
-            const run = record.run;
-            if (typeof run === 'function')
-                return run.call(database, sql);
-            throw new Error('bun:sqlite exec() is unavailable');
-        },
-        pragma(statement) {
-            return runBunPragma(database, statement);
-        },
-        transaction(operation) {
-            const transaction = record.transaction;
-            if (typeof transaction !== 'function')
-                throw new Error('bun:sqlite transaction() is unavailable');
-            const run = transaction.call(database, operation);
-            if (typeof run !== 'function')
-                throw new Error('bun:sqlite transaction() did not return a callable transaction');
-            const transactionRunner = run;
-            if (typeof transactionRunner.immediate !== 'function') {
-                throw new Error('bun:sqlite transaction().immediate() is unavailable');
-            }
-            return transactionRunner;
-        },
-        close() {
-            const close = record.close;
-            if (typeof close !== 'function')
-                return;
-            close.call(database, false);
-        },
-    };
-}
-function createBunSqliteStatement(statement) {
-    const record = statement;
-    return {
-        get(...params) {
-            const get = record.get;
-            if (typeof get !== 'function')
-                throw new Error('bun:sqlite statement.get() is unavailable');
-            const row = get.call(statement, ...params);
-            return row === null ? undefined : row;
-        },
-        all(...params) {
-            const all = record.all;
-            if (typeof all !== 'function')
-                throw new Error('bun:sqlite statement.all() is unavailable');
-            return all.call(statement, ...params);
-        },
-        run(...params) {
-            const run = record.run;
-            if (typeof run !== 'function')
-                throw new Error('bun:sqlite statement.run() is unavailable');
-            return run.call(statement, ...params);
-        },
-    };
-}
-function runBunPragma(database, statement) {
-    const normalizedStatement = statement.trim();
-    if (isPragmaSetter(normalizedStatement)) {
-        const exec = database.exec;
-        if (typeof exec !== 'function')
-            throw new Error('bun:sqlite exec() is unavailable for PRAGMA setter');
-        return exec.call(database, `PRAGMA ${normalizedStatement}`);
-    }
-    const prepare = database.prepare;
-    if (typeof prepare !== 'function')
-        throw new Error('bun:sqlite prepare() is unavailable for PRAGMA reader');
-    const rows = prepare.call(database, `PRAGMA ${normalizedStatement}`).all();
-    if (/^busy_timeout\b/i.test(normalizedStatement))
-        return normalizeBusyTimeoutRows(rows);
-    return rows;
-}
-function isPragmaSetter(statement) {
-    return /=/.test(statement);
-}
-function normalizeBusyTimeoutRows(rows) {
-    return rows.map((row) => {
-        if (row === null || typeof row !== 'object')
-            return row;
-        const record = row;
-        if (typeof record.timeout === 'number')
-            return row;
-        if (typeof record.busy_timeout === 'number')
-            return { timeout: record.busy_timeout };
-        return row;
-    });
-}
-function migrationFailure(message, cause) {
-    const error = { code: 'migration_failed', message };
-    if (cause !== undefined)
-        error.cause = cause;
-    return { ok: false, error };
-}
+export * from '../../storage/memory/sqlite/database.js';

package/dist/memory/storage-paths.js

@@ -1,72 +1 @@
-import { mkdirSync } from 'node:fs';
-import path, { dirname, resolve } from 'node:path';
-export function resolveMemoryDatabasePath(input) {
-    if (hasPathValue(input.explicitPath)) {
-        return { ok: true, value: { path: absolutePath(input.cwd, input.explicitPath), source: 'flag' } };
-    }
-    if (hasPathValue(input.env.VGXNESS_DB_PATH)) {
-        return { ok: true, value: { path: absolutePath(input.cwd, input.env.VGXNESS_DB_PATH), source: 'environment' } };
-    }
-    const globalPath = defaultGlobalMemoryDatabasePath({ env: input.env, platform: input.platform });
-    return globalPath.ok ? { ok: true, value: { path: globalPath.value, source: 'global-default' } } : globalPath;
-}
-export function defaultGlobalMemoryDatabasePath(input) {
-    const platform = input.platform ?? process.platform;
-    if (platform === 'darwin')
-        return homeRelativePath(input.env, ['Library', 'Application Support', 'vgxness', 'memory.sqlite']);
-    if (platform === 'win32')
-        return windowsAppDataPath(input.env);
-    return linuxDataPath(input.env);
-}
-export function prepareMemoryDatabasePath(databasePath) {
-    try {
-        mkdirSync(dirname(databasePath), { recursive: true });
-        return { ok: true, value: databasePath };
-    }
-    catch (cause) {
-        return {
-            ok: false,
-            error: {
-                code: 'store_unavailable',
-                message: `Unable to prepare local memory store directory at ${dirname(databasePath)}`,
-                cause,
-            },
-        };
-    }
-}
-function linuxDataPath(env) {
-    if (hasPathValue(env.XDG_DATA_HOME))
-        return { ok: true, value: path.join(env.XDG_DATA_HOME, 'vgxness', 'memory.sqlite') };
-    return homeRelativePath(env, ['.local', 'share', 'vgxness', 'memory.sqlite']);
-}
-function windowsAppDataPath(env) {
-    if (hasPathValue(env.LOCALAPPDATA))
-        return { ok: true, value: path.win32.join(env.LOCALAPPDATA, 'vgxness', 'memory.sqlite') };
-    if (hasPathValue(env.APPDATA))
-        return { ok: true, value: path.win32.join(env.APPDATA, 'vgxness', 'memory.sqlite') };
-    return missingBase('LOCALAPPDATA or APPDATA');
-}
-function homeRelativePath(env, segments) {
-    const home = userHome(env);
-    if (!hasPathValue(home))
-        return missingBase('HOME');
-    return { ok: true, value: path.join(home, ...segments) };
-}
-function userHome(env) {
-    return env.HOME;
-}
-function missingBase(variable) {
-    return {
-        ok: false,
-        error: {
-            code: 'store_unavailable',
-            message: `Unable to resolve global memory store path because ${variable} is not set. Provide --db or VGXNESS_DB_PATH to select an explicit database.`,
-        },
-    };
-}
-function absolutePath(cwd, configuredPath) {
-    return path.isAbsolute(configuredPath) ? configuredPath : resolve(cwd, configuredPath);
-}
-function hasPathValue(value) {
-    return value !== undefined && value.trim().length > 0;
-}
+export * from '../storage/memory/storage-paths.js';

package/dist/payload/context-budget-policy.js

@@ -7,6 +7,16 @@ export const defaultContextBudgetPolicy = {
         { id: 'snapshotExpanded', label: 'Expanded snapshot', targetBytes: 30_720, hardLimitBytes: 46_080, enforcement: 'report' },
         { id: 'subagentVerbosePayload', label: 'Subagent verbose payload', targetBytes: 122_880, hardLimitBytes: 184_320, enforcement: 'report' },
         { id: 'initialMcpCalls', label: 'Initial MCP calls', targetBytes: 3, hardLimitBytes: 5, enforcement: 'report' },
+        { id: 'providerManagerPayload', label: 'Provider manager payload', targetBytes: 24_576, hardLimitBytes: 36_864, enforcement: 'warn' },
+        { id: 'providerArtifactSection', label: 'Provider artifact section', targetBytes: 12_288, hardLimitBytes: 18_432, enforcement: 'warn' },
+        { id: 'sddArtifactCompact', label: 'Compact SDD artifact', targetBytes: 8_192, hardLimitBytes: 12_288, enforcement: 'warn' },
+        { id: 'sddArtifactVerbose', label: 'Verbose SDD artifact', targetBytes: 65_536, hardLimitBytes: 98_304, enforcement: 'report' },
+        { id: 'skillPayloadCompact', label: 'Compact skill payload', targetBytes: 12_288, hardLimitBytes: 18_432, enforcement: 'warn' },
+        { id: 'skillPayloadVerbose', label: 'Verbose skill payload', targetBytes: 65_536, hardLimitBytes: 98_304, enforcement: 'report' },
+        { id: 'contextCockpitCompact', label: 'Compact context cockpit', targetBytes: 10_240, hardLimitBytes: 15_360, enforcement: 'warn' },
+        { id: 'contextCockpitExpanded', label: 'Expanded context cockpit', targetBytes: 30_720, hardLimitBytes: 46_080, enforcement: 'report' },
+        { id: 'opencodeHandoffPreview', label: 'OpenCode handoff preview', targetBytes: 16_384, hardLimitBytes: 24_576, enforcement: 'warn' },
+        { id: 'subagentResultDraft', label: 'Subagent result draft', targetBytes: 16_384, hardLimitBytes: 24_576, enforcement: 'warn' },
     ],
 };
 export function getContextBudgetLimit(policy, id) {

package/dist/payload/context-budget-service.js

@@ -17,6 +17,12 @@ export class ContextBudgetService {
     reportJson(id, value) {
         return this.buildReport(id, this.measureJsonBytes(value));
     }
+    reportContentV2(id, content, options = {}) {
+        return this.buildReportV2(id, this.measureUtf8Bytes(content), options);
+    }
+    reportJsonV2(id, value, options = {}) {
+        return this.buildReportV2(id, this.measureJsonBytes(value), options);
+    }
     buildReport(id, measuredBytes) {
         if (!Number.isSafeInteger(measuredBytes) || measuredBytes < 0)
             throw new RangeError('measuredBytes must be a non-negative safe integer');
@@ -34,6 +40,26 @@ export class ContextBudgetService {
             recommendations: budgetRecommendations(budget, excessTargetBytes, excessHardLimitBytes),
         };
     }
+    buildReportV2(id, measuredBytes, options = {}) {
+        const report = this.buildReport(id, measuredBytes);
+        return {
+            ...report,
+            severity: budgetSeverity(report),
+            ...(options.includeApproximateTokens === true ? { approximateTokens: approximateTokenEstimate(measuredBytes) } : {}),
+        };
+    }
+}
+export function approximateTokenEstimate(measuredBytes) {
+    if (!Number.isSafeInteger(measuredBytes) || measuredBytes < 0)
+        throw new RangeError('measuredBytes must be a non-negative safe integer');
+    return Math.ceil(measuredBytes / 4);
+}
+function budgetSeverity(report) {
+    if (!report.withinHardLimit)
+        return 'hard-limit-exceeded';
+    if (!report.withinTarget)
+        return 'target-exceeded';
+    return 'ok';
 }
 function budgetRecommendations(budget, excessTargetBytes, excessHardLimitBytes) {
     if (excessHardLimitBytes > 0)

package/dist/payload/payload-diagnostics.js

@@ -0,0 +1,50 @@
+import { responseByteAccounting, sha256Hex, utf8ByteCount } from './payload-summary.js';
+export function buildPayloadSectionAccounting(input) {
+    const bytes = resolveSectionBytes(input);
+    const contentHash = input.contentHash ?? (input.content === undefined ? undefined : sha256Hex(input.content));
+    return {
+        id: input.id,
+        ...(input.label === undefined ? {} : { label: input.label }),
+        bytes,
+        ...(contentHash === undefined ? {} : { contentHash }),
+        included: input.included,
+        ...(input.omittedBytes === undefined ? {} : { omittedBytes: input.omittedBytes }),
+        ...(input.ref === undefined ? {} : { ref: input.ref }),
+        ...(input.notes === undefined ? {} : { notes: input.notes }),
+    };
+}
+export function buildCompositePayloadDiagnostics(sections, largestSectionLimit = sections.length) {
+    if (!Number.isSafeInteger(largestSectionLimit) || largestSectionLimit < 0)
+        throw new RangeError('largestSectionLimit must be a non-negative safe integer');
+    const totalBytes = sections.reduce((total, section) => total + section.bytes, 0);
+    const includedBytes = sections.filter((section) => section.included).reduce((total, section) => total + section.bytes, 0);
+    const omittedBytes = sections.reduce((total, section) => total + (section.included ? (section.omittedBytes ?? 0) : section.bytes), 0);
+    return {
+        totalBytes,
+        includedBytes,
+        omittedBytes,
+        sections,
+        largestSections: [...sections].sort((left, right) => right.bytes - left.bytes).slice(0, largestSectionLimit),
+    };
+}
+export function buildCompactVerboseDiagnostics(verboseValue, compactValue, options = {}) {
+    const verboseJson = JSON.stringify(verboseValue);
+    const compactJson = JSON.stringify(compactValue);
+    return {
+        accounting: responseByteAccounting(verboseValue, compactValue),
+        compact: { bytes: utf8ByteCount(compactJson), contentHash: sha256Hex(compactJson) },
+        verbose: { bytes: utf8ByteCount(verboseJson), contentHash: sha256Hex(verboseJson) },
+        ...(options.retrievalRef === undefined ? {} : { retrievalRef: options.retrievalRef }),
+        ...(options.notes === undefined ? {} : { notes: options.notes }),
+    };
+}
+function resolveSectionBytes(input) {
+    if (input.bytes !== undefined) {
+        if (!Number.isSafeInteger(input.bytes) || input.bytes < 0)
+            throw new RangeError('bytes must be a non-negative safe integer');
+        return input.bytes;
+    }
+    if (input.content !== undefined)
+        return utf8ByteCount(input.content);
+    throw new Error('Payload section accounting requires either bytes or content.');
+}

package/dist/permissions/explicit-request-authorization.js

@@ -0,0 +1,126 @@
+import { isAbsolute, resolve } from 'node:path';
+export function evaluateExplicitRequestAuthorization(input) {
+    const explicit = input.request.explicitRequest;
+    if (explicit === undefined)
+        return evaluation(input, 'ask', 'missing-context', ['explicit_request_missing']);
+    if (explicit.actor.type !== 'human')
+        return evaluation(input, 'ask', 'actor-mismatch', ['explicit_request_actor_mismatch']);
+    if (!validIsoTimestamp(explicit.request.requestedAt))
+        return evaluation(input, 'ask', 'timestamp-invalid', ['explicit_request_timestamp_invalid']);
+    if (explicit.request.runId !== undefined && input.request.runId !== undefined && explicit.request.runId !== input.request.runId)
+        return evaluation(input, 'ask', 'scope-mismatch', ['explicit_request_scope_mismatch']);
+    if (explicit.parser.exact !== true || explicit.parser.confidence === 'medium' || explicit.parser.confidence === 'low' || hasItems(explicit.parser.ambiguityReasons))
+        return evaluation(input, 'ask', 'ambiguous-request', ['explicit_request_ambiguous']);
+    if (hasItems(explicit.parser.expansionReasons))
+        return evaluation(input, 'ask', 'scope-expanded', ['explicit_request_scope_expanded']);
+    if (isSddAcceptanceAttempt(input.request))
+        return evaluation(input, 'deny', 'hard-stop', ['sdd_human_acceptance_required']);
+    if (input.request.category === 'secrets' || input.risk.reasonCodes.includes('secret_access') || explicit.riskAttributes.secrets === true)
+        return evaluation(input, 'deny', 'hard-stop', ['explicit_request_secret_access']);
+    if (explicit.requestedOperation.category !== input.request.category)
+        return evaluation(input, 'ask', 'category-mismatch', ['explicit_request_category_mismatch']);
+    if (normalizeOperation(explicit.requestedOperation.operation) !== normalizeOperation(input.request.operation))
+        return evaluation(input, 'ask', 'operation-mismatch', ['explicit_request_operation_mismatch']);
+    if (!optionalExact(explicit.requestedOperation.commandId, input.request.commandId))
+        return evaluation(input, 'ask', 'scope-mismatch', ['explicit_request_scope_mismatch']);
+    if (!optionalExact(explicit.requestedOperation.providerToolName, input.request.providerToolName))
+        return evaluation(input, 'ask', 'scope-mismatch', ['explicit_request_scope_mismatch']);
+    if (!optionalPathExact(explicit.requestedOperation.workspaceRoot, input.request.workspaceRoot, input.request.workspaceRoot))
+        return evaluation(input, 'ask', 'scope-mismatch', ['explicit_request_scope_mismatch']);
+    if (!optionalPathExact(explicit.requestedOperation.cwd, input.request.cwd, input.request.workspaceRoot))
+        return evaluation(input, 'ask', 'scope-mismatch', ['explicit_request_scope_mismatch']);
+    if (!targetSetMatches(input.request, explicit.requestedOperation))
+        return evaluation(input, 'ask', 'scope-mismatch', ['explicit_request_scope_mismatch']);
+    const riskMismatch = riskMismatchReasons(input.request, input.risk, explicit.riskAttributes);
+    if (riskMismatch.length > 0)
+        return evaluation(input, 'ask', 'risk-attribute-mismatch', riskMismatch);
+    return evaluation(input, 'allow', 'exact-match', ['explicit_request_exact_match']);
+}
+function evaluation(input, decision, matchStatus, reasonCodes) {
+    const explicit = input.request.explicitRequest;
+    return {
+        decision,
+        audit: {
+            authorization: 'explicit-request',
+            matched: decision === 'allow',
+            matchStatus,
+            ...(explicit?.request.id === undefined ? {} : { requestRef: explicit.request.id }),
+            ...(explicit?.actor === undefined ? {} : { actor: explicit.actor }),
+            ...(explicit?.request.requestedAt === undefined ? {} : { requestedAt: explicit.request.requestedAt }),
+            evaluatedAt: input.evaluatedAt,
+            runId: input.request.runId ?? explicit?.request.runId ?? '',
+            category: input.request.category,
+            operation: input.request.operation,
+            scopeSummary: explicit?.requestedOperation.scopeSummary ?? '',
+            riskAttributes: explicitRiskAttributes(explicit?.riskAttributes),
+            reasonCodes,
+        },
+    };
+}
+function riskMismatchReasons(request, risk, explicit) {
+    const reasons = [];
+    if (request.destructive === true && explicit.destructive !== true)
+        reasons.push('explicit_request_destructive_not_explicit');
+    if (request.privileged === true && explicit.privileged !== true)
+        reasons.push('explicit_request_privileged_not_explicit');
+    if ((request.external === true || risk.reasonCodes.includes('external_operation')) && explicit.external !== true && explicit.network !== true && explicit.install !== true)
+        reasons.push('explicit_request_external_not_explicit');
+    if (request.ambiguous === true && explicit.ambiguous !== true)
+        reasons.push('explicit_request_ambiguous');
+    if (request.globalConfigMutation === true && explicit.globalConfigMutation !== true)
+        reasons.push('explicit_request_global_config_not_explicit');
+    if (request.providerConfigMutation === true && explicit.providerConfigMutation !== true)
+        reasons.push('explicit_request_provider_config_not_explicit');
+    if (request.providerConfigMutation !== true && request.globalConfigMutation !== true && risk.reasonCodes.includes('provider_config_write') && explicit.providerConfigMutation !== true)
+        reasons.push('explicit_request_provider_config_not_explicit');
+    if (request.category === 'network' && explicit.network !== true)
+        reasons.push('explicit_request_risk_mismatch');
+    if (request.category === 'install' && explicit.install !== true)
+        reasons.push('explicit_request_risk_mismatch');
+    return [...new Set(reasons)];
+}
+function targetSetMatches(request, explicit) {
+    const requested = targetSet(request.targetPath, request.targetPaths, request.workspaceRoot);
+    const authorized = targetSet(explicit.targetPath, explicit.targetPaths, request.workspaceRoot ?? explicit.workspaceRoot);
+    if (requested.length === 0 && authorized.length === 0)
+        return true;
+    if (requested.length === 0 || authorized.length === 0)
+        return false;
+    if (requested.length !== authorized.length)
+        return false;
+    return requested.every((value, index) => value === authorized[index]);
+}
+function targetSet(targetPath, targetPaths, workspaceRoot) {
+    return [...new Set([...(targetPath === undefined ? [] : [targetPath]), ...(targetPaths ?? [])].map((path) => normalizePath(path, workspaceRoot)))].sort();
+}
+function optionalExact(explicit, actual) {
+    return actual === undefined ? explicit === undefined : explicit === actual;
+}
+function optionalPathExact(explicit, actual, workspaceRoot) {
+    return actual === undefined ? explicit === undefined : explicit !== undefined && normalizePath(explicit, workspaceRoot) === normalizePath(actual, workspaceRoot);
+}
+function normalizePath(path, workspaceRoot) {
+    const base = workspaceRoot === undefined ? undefined : resolve(workspaceRoot);
+    return resolve(isAbsolute(path) || base === undefined ? path : resolve(base, path));
+}
+function normalizeOperation(value) {
+    return value.trim().replace(/\s+/g, ' ');
+}
+function hasItems(values) {
+    return values !== undefined && values.length > 0;
+}
+function validIsoTimestamp(value) {
+    const timestamp = Date.parse(value);
+    return Number.isFinite(timestamp) && new Date(timestamp).toISOString() === value && timestamp <= Date.now() + 60_000;
+}
+function explicitRiskAttributes(value) {
+    const output = {};
+    for (const key of ['destructive', 'privileged', 'external', 'ambiguous', 'secrets', 'providerConfigMutation', 'globalConfigMutation', 'network', 'install']) {
+        output[key] = value?.[key] === true;
+    }
+    return output;
+}
+function isSddAcceptanceAttempt(request) {
+    const text = `${request.category} ${request.operation} ${request.providerToolName ?? ''}`.toLowerCase();
+    return /vgxness_sdd_accept_artifact|sdd_accept_artifact|artifact acceptance|accept artifact|acceptedby/.test(text);
+}