chore: import upstream snapshot with attribution

open-sse/services/compression/quantumLock/index.ts

@@ -0,0 +1,17 @@
+export {
+  QUANTUM_PATTERNS,
+  TAIL_DELIM,
+  placeholderFor,
+  type QuantumCategory,
+  type QuantumLockConfig,
+  type QuantumLockStats,
+  type VolatileSpan,
+} from "./quantumPatterns.ts";
+export { detectVolatileSpans } from "./quantumLock.ts";
+export { applyQuantumLock } from "./quantumLockStep.ts";
+export {
+  resolveQuantumLock,
+  quantumCachingContext,
+  withQuantumLock,
+  withQuantumLockAsync,
+} from "./strategyWrap.ts";

open-sse/services/compression/quantumLock/quantumLock.ts

@@ -0,0 +1,58 @@
+import {
+  QUANTUM_PATTERNS,
+  type QuantumLockConfig,
+  type VolatileSpan,
+} from "./quantumPatterns.ts";
+
+interface PrioritizedSpan extends VolatileSpan {
+  prio: number;
+}
+
+/**
+ * Detect non-semantic volatile spans in `text`, in the FIXED pattern order, then merge
+ * overlapping spans so a token is never double-replaced. Pure + fail-open: a throwing
+ * pattern aborts the scan and returns [] (QuantumLock must never corrupt a request).
+ *
+ * Merge rule (widest wins): sort by start asc, then by width desc, then by priority asc
+ * (earlier pattern = higher precedence); greedily keep a span only if it starts at/after
+ * the last accepted span's end.
+ */
+export function detectVolatileSpans(text: string, cfg: QuantumLockConfig): VolatileSpan[] {
+  if (!text) return [];
+  const allow = cfg.categories && cfg.categories.length > 0 ? new Set(cfg.categories) : null;
+  const raw: PrioritizedSpan[] = [];
+
+  try {
+    QUANTUM_PATTERNS.forEach(({ category, pattern }, prio) => {
+      if (allow && !allow.has(category)) return;
+      pattern.lastIndex = 0;
+      let m: RegExpExecArray | null;
+      while ((m = pattern.exec(text)) !== null) {
+        if (m[0].length === 0) {
+          pattern.lastIndex++;
+          continue;
+        }
+        raw.push({ start: m.index, end: m.index + m[0].length, category, prio });
+      }
+    });
+  } catch {
+    return [];
+  }
+
+  raw.sort((a, b) => a.start - b.start || b.end - a.end || a.prio - b.prio);
+
+  // Greedy non-overlapping sweep: accept a span only if it starts at/after the last accepted
+  // span's end. A nested or PARTIALLY-overlapping span is dropped whole (never split) — this is
+  // always SAFE (it can only under-stabilize, never corrupt text or shift placeholder numbering).
+  // With the current `\b`-anchored patterns true partial overlaps are unreachable; the drop rule
+  // is the conservative default if a future pattern can produce one.
+  const merged: VolatileSpan[] = [];
+  let lastEnd = -1;
+  for (const s of raw) {
+    if (s.start >= lastEnd) {
+      merged.push({ start: s.start, end: s.end, category: s.category });
+      lastEnd = s.end;
+    }
+  }
+  return merged;
+}

open-sse/services/compression/quantumLock/quantumLockStep.ts

@@ -0,0 +1,72 @@
+import { detectVolatileSpans } from "./quantumLock.ts";
+import {
+  placeholderFor,
+  TAIL_DELIM,
+  type QuantumCategory,
+  type QuantumLockConfig,
+  type QuantumLockStats,
+} from "./quantumPatterns.ts";
+
+/**
+ * Fresh zero-stats per call. NOT a shared singleton on purpose: `applyQuantumLock` is a public
+ * export and `categories` is mutable, so returning one shared object would let a stats-aggregating
+ * caller corrupt the no-op result for every subsequent call in the process.
+ */
+const emptyStats = (): QuantumLockStats => ({ fragments: 0, categories: {} });
+
+function isRecord(v: unknown): v is Record<string, unknown> {
+  return v !== null && typeof v === "object" && !Array.isArray(v);
+}
+
+/** v1 stabilizes string-content system messages only. Array/multimodal ⇒ no-op (follow-up). */
+function systemTextOf(msg: Record<string, unknown>): string {
+  return typeof msg.content === "string" ? msg.content : "";
+}
+
+/**
+ * Stabilize volatile fragments in the FIRST role:system message: replace each detected span
+ * with a positional, value-independent placeholder (⟦Q{i}⟧) and append a delimited value-tail.
+ * The rewritten body is sent to the model (lossless — the tail carries every value). Pure:
+ * clones the touched message, never mutates input. Fail-open: returns the input body + zero
+ * stats on every no-op path. `ctx` is accepted for symmetry with the wrapper; unused here.
+ */
+export function applyQuantumLock(
+  body: Record<string, unknown>,
+  cfg: QuantumLockConfig,
+  _ctx?: { isCachingProvider: boolean }
+): { body: Record<string, unknown>; stats: QuantumLockStats } {
+  const messages = body.messages;
+  if (!Array.isArray(messages)) return { body, stats: emptyStats() };
+
+  const idx = messages.findIndex((m) => isRecord(m) && m.role === "system");
+  if (idx === -1) return { body, stats: emptyStats() };
+
+  const sys = messages[idx] as Record<string, unknown>;
+  const text = systemTextOf(sys);
+  if (!text) return { body, stats: emptyStats() };
+  if (text.includes(TAIL_DELIM)) return { body, stats: emptyStats() }; // idempotency
+
+  const spans = detectVolatileSpans(text, cfg);
+  if (spans.length === 0) return { body, stats: emptyStats() };
+
+  let out = "";
+  let cursor = 0;
+  const values: string[] = [];
+  const categories: Partial<Record<QuantumCategory, number>> = {};
+  spans.forEach((span, i) => {
+    out += text.slice(cursor, span.start) + placeholderFor(i);
+    values.push(text.slice(span.start, span.end));
+    categories[span.category] = (categories[span.category] ?? 0) + 1;
+    cursor = span.end;
+  });
+  out += text.slice(cursor);
+
+  const tail = `\n\n${TAIL_DELIM}\n${values.map((v, i) => `${placeholderFor(i)}=${v}`).join("\n")}`;
+  const newMessages = messages.slice();
+  newMessages[idx] = { ...sys, content: out + tail };
+
+  return {
+    body: { ...body, messages: newMessages },
+    stats: { fragments: values.length, categories },
+  };
+}

open-sse/services/compression/quantumLock/quantumPatterns.ts

@@ -0,0 +1,80 @@
+/**
+ * QuantumLock leaf module: category enum, span/config/stats types, constants, and the
+ * fixed-order, ReDoS-bounded detection patterns. No imports — keeps every consumer one-way
+ * (cycle-safe). See docs/superpowers/specs/2026-06-28-compression-quantumlock-design.md.
+ */
+
+export type QuantumCategory =
+  | "uuid"
+  | "unix_ts"
+  | "long_hex"
+  | "jwt"
+  | "api_key_shape"
+  | "request_id";
+
+export interface VolatileSpan {
+  start: number; // inclusive char offset into the system text
+  end: number; // exclusive
+  category: QuantumCategory;
+}
+
+export interface QuantumLockConfig {
+  enabled: boolean;
+  /** Subset of categories to stabilize. Absent/empty ⇒ all categories. */
+  categories?: QuantumCategory[];
+}
+
+export interface QuantumLockStats {
+  fragments: number;
+  categories: Partial<Record<QuantumCategory, number>>;
+}
+
+/** Idempotency sentinel + tail header. Its presence in system text ⇒ already stabilized. */
+export const TAIL_DELIM = "⟦QUANTUMLOCK⟧";
+
+/** Positional, value-independent placeholder. Depends ONLY on match index. */
+export const placeholderFor = (i: number): string => `⟦Q${i}⟧`;
+
+interface QuantumPattern {
+  category: QuantumCategory;
+  pattern: RegExp;
+}
+
+/**
+ * Detection order is FIXED: most-specific / widest first so a token is never split.
+ * Every variable-length run is bounded ({N,M}) — no unbounded quantifier (anti-ReDoS).
+ */
+export const QUANTUM_PATTERNS: QuantumPattern[] = [
+  // JWTs start with base64url of `{"` → "eyJ". Run first so the whole token wins.
+  // Trailing negative-lookahead (not \b): a JWT signature can END in base64url `-`/`_`,
+  // where \b would misfire (it needs a following word char) and let the token escape detection.
+  {
+    category: "jwt",
+    pattern: /\beyJ[A-Za-z0-9_-]{8,512}\.[A-Za-z0-9_-]{8,512}\.[A-Za-z0-9_-]{8,512}(?![A-Za-z0-9_-])/g,
+  },
+  // Prefixed API keys (stripe/github/slack shapes).
+  {
+    category: "api_key_shape",
+    pattern: /\b(?:sk|pk|rk|ghp|gho|xox[baprs])[-_][A-Za-z0-9]{16,200}\b/g,
+  },
+  // Bearer tokens. Bounded whitespace ([ \t]{1,4}) per the file convention (no unbounded \s+).
+  {
+    category: "api_key_shape",
+    pattern: /\bBearer[ \t]{1,4}[A-Za-z0-9._-]{16,400}\b/g,
+  },
+  // Canonical UUID. Runs before long_hex so its inner hex is not re-claimed.
+  {
+    category: "uuid",
+    pattern: /\b[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}\b/gi,
+  },
+  // Correlation / request ids.
+  {
+    category: "request_id",
+    pattern: /\b(?:req|trace|span|corr|request)[-_][A-Za-z0-9]{6,128}\b/gi,
+  },
+  // Digests / SHAs. After uuid/jwt so it never eats their inner hex.
+  { category: "long_hex", pattern: /\b[0-9a-f]{16,128}\b/gi },
+  // 10- or 13-digit unix epoch in the 2001–2033 window (leading 1). LAST so it never
+  // fragments a longer token already claimed above.
+  { category: "unix_ts", pattern: /\b1[0-9]{9}(?:[0-9]{3})?\b/g },
+];

open-sse/services/compression/quantumLock/strategyWrap.ts

@@ -0,0 +1,72 @@
+import { detectCachingContext, type CachingDetectionContext } from "../cachingAware.ts";
+import type { CompressionConfig, CompressionResult, CompressionStats } from "../types.ts";
+import { applyQuantumLock } from "./quantumLockStep.ts";
+import type { QuantumLockConfig, QuantumLockStats } from "./quantumPatterns.ts";
+
+/** The QuantumLock config to apply, or undefined when absent/disabled. */
+export function resolveQuantumLock(options?: { config?: CompressionConfig }): QuantumLockConfig | undefined {
+  const ql = options?.config?.quantumLock;
+  return ql?.enabled ? ql : undefined;
+}
+
+/**
+ * Resolve the caching gate. Production passes `options.model` (provider inferred from the
+ * model slug) or an explicit `options.cachingContext`; the studio dry-run forces a caching
+ * context so the operator can see what WOULD be stabilized.
+ */
+export function quantumCachingContext(
+  body: Record<string, unknown>,
+  options?: { model?: string; cachingContext?: CachingDetectionContext }
+): { isCachingProvider: boolean } {
+  const ctx = detectCachingContext(body, options?.cachingContext ?? { model: options?.model });
+  return { isCachingProvider: ctx.isCachingProvider };
+}
+
+/** Attach QuantumLock stats to a result, creating a minimal stats carrier when needed. */
+function attachQuantumLockStats(
+  result: CompressionResult,
+  qlStats: QuantumLockStats
+): CompressionResult {
+  if (result.stats) {
+    result.stats.quantumLock = qlStats;
+    return result;
+  }
+  // Downstream compression produced no stats (e.g. message too short to compress).
+  // Create a passthrough carrier so the quantumLock field is not lost.
+  const carrier: CompressionStats = {
+    originalTokens: 0,
+    compressedTokens: 0,
+    savingsPercent: 0,
+    techniquesUsed: ["quantum-lock"],
+    mode: "off",
+    timestamp: Date.now(),
+    quantumLock: qlStats,
+  };
+  return { ...result, stats: carrier };
+}
+
+export function withQuantumLock(
+  body: Record<string, unknown>,
+  ql: QuantumLockConfig | undefined,
+  ctx: { isCachingProvider: boolean },
+  run: (b: Record<string, unknown>) => CompressionResult
+): CompressionResult {
+  if (!ql || !ctx.isCachingProvider) return run(body);
+  const { body: locked, stats } = applyQuantumLock(body, ql, ctx);
+  const result = run(locked);
+  if (stats.fragments > 0) return attachQuantumLockStats(result, stats);
+  return result;
+}
+
+export async function withQuantumLockAsync(
+  body: Record<string, unknown>,
+  ql: QuantumLockConfig | undefined,
+  ctx: { isCachingProvider: boolean },
+  run: (b: Record<string, unknown>) => Promise<CompressionResult>
+): Promise<CompressionResult> {
+  if (!ql || !ctx.isCachingProvider) return run(body);
+  const { body: locked, stats } = applyQuantumLock(body, ql, ctx);
+  const result = await run(locked);
+  if (stats.fragments > 0) return attachQuantumLockStats(result, stats);
+  return result;
+}