@angelmsger/fx 0.0.0-stage → 0.11.0

package/dist/domain/boundary/scan.js

@@ -0,0 +1,139 @@
+// @ts-check
+// Boundary findings identify locations, never matched values. Private manifest
+// addresses are permitted; credential and personnel protections apply everywhere.
+// JavaScript, because the package check loads the scanner without a build.
+/**
+ * @typedef {{
+ *   readonly text: string,
+ *   readonly policy: 'manifest' | 'distributable',
+ *   readonly internalHosts?: readonly string[],
+ *   readonly syntax?: 'code' | 'text',
+ * }} BoundaryInput
+ */
+/**
+ * @typedef {{
+ *   readonly rule: 'credential' | 'personnel' | 'email' | 'internal-address',
+ *   readonly line: number,
+ *   readonly column: number,
+ * }} BoundaryFinding
+ */
+/** @type {readonly { readonly rule: BoundaryFinding['rule'], readonly pattern: RegExp }[]} */
+const RULES = [
+    {
+        rule: 'personnel',
+        pattern: /^[ \t]*(?:["']?sensitive["']?:[ \t]*true\b|["']?people["']?:[ \t]*(?=\[|\{|$))/gm,
+    },
+    { rule: 'email', pattern: /[A-Za-z0-9._%+-]+@[A-Za-z0-9.-]+\.[A-Za-z]{2,}/g },
+    { rule: 'credential', pattern: /-{5}BEGIN (?:[A-Z]+ )?PRIVATE KEY-{5}/g },
+    {
+        rule: 'credential',
+        pattern: /\b(?:gh[pousr]_[A-Za-z0-9]{20,}|github_pat_[A-Za-z0-9_]{20,}|sk-[A-Za-z0-9_-]{20,}|AKIA[A-Z0-9]{16})\b/g,
+    },
+    { rule: 'credential', pattern: /\b[a-z][a-z0-9+.-]*:\/\/[^\s/@:]+:[^\s/@]+@/gi },
+    {
+        rule: 'credential',
+        pattern: /\b(?:password|passwd|secret|token|api[_-]?key|access[_-]?key|client[_-]?secret)\b["']?\s*(?::|=(?!=))\s*(["']?)([^\s,;\r\n]+)\1/gi,
+    },
+    { rule: 'credential', pattern: /\b(?:Bearer|Basic)\s+[A-Za-z0-9+/_=.-]{8,}/g },
+];
+/**
+ * @param {BoundaryInput} input
+ * @returns {readonly BoundaryFinding[]}
+ */
+export function scanBoundary(input) {
+    /** @type {BoundaryFinding[]} */
+    const findings = [];
+    for (const definition of RULES) {
+        for (const match of input.text.matchAll(new RegExp(definition.pattern))) {
+            if (match[2] !== undefined && isPlaceholder(match[2]))
+                continue;
+            if (match[2] !== undefined && input.syntax === 'code' && !match[1])
+                continue;
+            if (definition.rule === 'email' && isExampleEmail(match[0]))
+                continue;
+            findings.push(at(input.text, match.index, definition.rule));
+        }
+    }
+    if (input.policy === 'distributable')
+        findings.push(...scanAddresses(input));
+    return findings.sort((a, b) => a.line - b.line || a.column - b.column || a.rule.localeCompare(b.rule));
+}
+/**
+ * @param {string} value
+ * @returns {boolean}
+ */
+function isExampleEmail(value) {
+    return /@(?:[a-z0-9-]+\.)*example\.(?:com|org|net)$/i.test(value);
+}
+/**
+ * @param {string} value
+ * @returns {boolean}
+ */
+function isPlaceholder(value) {
+    const plain = value.replace(/["']$/, '');
+    return /^(?:\$\{[^}]+\}|\$[A-Z_][A-Z0-9_]*|<[^>]+>|null|undefined|true|false)$/u.test(plain);
+}
+/**
+ * @param {BoundaryInput} input
+ * @returns {BoundaryFinding[]}
+ */
+function scanAddresses(input) {
+    const matches = input.text.matchAll(/\b(?:[a-z0-9-]+\.)+[a-z0-9-]+\b/gi);
+    const known = new Set((input.internalHosts ?? []).map((host) => host.toLowerCase()));
+    /** @type {BoundaryFinding[]} */
+    const findings = [];
+    for (const match of matches) {
+        const host = match[0].toLowerCase();
+        if (input.syntax === 'code' && !isAddressLiteral(input.text, match.index, host.length))
+            continue;
+        if (/\.(?:internal|local|lan|corp)$/.test(host) || isPrivateIp(host) || known.has(host))
+            findings.push(at(input.text, match.index, 'internal-address'));
+    }
+    return findings;
+}
+/**
+ * @param {string} host
+ * @returns {boolean}
+ */
+function isPrivateIp(host) {
+    const octets = host.split('.');
+    if (octets.length !== 4 ||
+        octets.some((octet) => !/^\d{1,3}$/.test(octet) || Number(octet) > 255))
+        return false;
+    const [a, b] = octets.map(Number);
+    return (a === 10 || (a === 172 && b !== undefined && b >= 16 && b <= 31) || (a === 192 && b === 168));
+}
+/**
+ * @param {string} text
+ * @param {number} offset
+ * @param {BoundaryFinding['rule']} rule
+ * @returns {BoundaryFinding}
+ */
+function at(text, offset, rule) {
+    const before = text.slice(0, offset);
+    return { rule, line: before.split('\n').length, column: offset - before.lastIndexOf('\n') };
+}
+/**
+ * @param {string} text
+ * @param {number} start
+ * @param {number} length
+ * @returns {boolean}
+ */
+function isAddressLiteral(text, start, length) {
+    const before = text.slice(Math.max(0, start - 3), start);
+    const after = text[start + length];
+    return (before.endsWith('://') ||
+        (/["'`]$/.test(before) && (after === '"' || after === "'" || after === '`')));
+}
+/**
+ * @param {readonly string[]} vector
+ * @returns {boolean}
+ */
+export function containsCommandCredentials(vector) {
+    const literals = [
+        vector.join(' '),
+        ...vector.flatMap((arg, index) => arg.startsWith('-') && vector[index + 1] !== undefined ? [`${arg}=${vector[index + 1]}`] : []),
+    ];
+    return literals.some((text) => scanBoundary({ text, policy: 'manifest' }).some((finding) => finding.rule === 'credential'));
+}
+//# sourceMappingURL=scan.js.map

package/dist/domain/boundary/scan.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"scan.js","sourceRoot":"","sources":["../../../src/domain/boundary/scan.js"],"names":[],"mappings":"AAAA,YAAY;AACZ,+EAA+E;AAC/E,kFAAkF;AAClF,2EAA2E;AAE3E;;;;;;;GAOG;AAEH;;;;;;GAMG;AAEH,8FAA8F;AAC9F,MAAM,KAAK,GAAG;IACZ;QACE,IAAI,EAAE,WAAW;QACjB,OAAO,EAAE,kFAAkF;KAC5F;IACD,EAAE,IAAI,EAAE,OAAO,EAAE,OAAO,EAAE,iDAAiD,EAAE;IAC7E,EAAE,IAAI,EAAE,YAAY,EAAE,OAAO,EAAE,wCAAwC,EAAE;IACzE;QACE,IAAI,EAAE,YAAY;QAClB,OAAO,EACL,yGAAyG;KAC5G;IACD,EAAE,IAAI,EAAE,YAAY,EAAE,OAAO,EAAE,+CAA+C,EAAE;IAChF;QACE,IAAI,EAAE,YAAY;QAClB,OAAO,EACL,mIAAmI;KACtI;IACD,EAAE,IAAI,EAAE,YAAY,EAAE,OAAO,EAAE,6CAA6C,EAAE;CAC/E,CAAC;AAEF;;;GAGG;AACH,MAAM,UAAU,YAAY,CAAC,KAAK;IAChC,gCAAgC;IAChC,MAAM,QAAQ,GAAG,EAAE,CAAC;IACpB,KAAK,MAAM,UAAU,IAAI,KAAK,EAAE,CAAC;QAC/B,KAAK,MAAM,KAAK,IAAI,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,MAAM,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC,EAAE,CAAC;YACxE,IAAI,KAAK,CAAC,CAAC,CAAC,KAAK,SAAS,IAAI,aAAa,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;gBAAE,SAAS;YAChE,IAAI,KAAK,CAAC,CAAC,CAAC,KAAK,SAAS,IAAI,KAAK,CAAC,MAAM,KAAK,MAAM,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC;gBAAE,SAAS;YAC7E,IAAI,UAAU,CAAC,IAAI,KAAK,OAAO,IAAI,cAAc,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;gBAAE,SAAS;YACtE,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC,KAAK,CAAC,IAAI,EAAE,KAAK,CAAC,KAAK,EAAE,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC;QAC9D,CAAC;IACH,CAAC;IACD,IAAI,KAAK,CAAC,MAAM,KAAK,eAAe;QAAE,QAAQ,CAAC,IAAI,CAAC,GAAG,aAAa,CAAC,KAAK,CAAC,CAAC,CAAC;IAC7E,OAAO,QAAQ,CAAC,IAAI,CAClB,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,MAAM,IAAI,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,CAAC,IAAI,CAAC,CACjF,CAAC;AACJ,CAAC;AAED;;;GAGG;AACH,SAAS,cAAc,CAAC,KAAK;IAC3B,OAAO,8CAA8C,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;AACpE,CAAC;AAED;;;GAGG;AACH,SAAS,aAAa,CAAC,KAAK;IAC1B,MAAM,KAAK,GAAG,KAAK,CAAC,OAAO,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC;IACzC,OAAO,yEAAyE,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;AAC/F,CAAC;AAED;;;GAGG;AACH,SAAS,aAAa,CAAC,KAAK;IAC1B,MAAM,OAAO,GAAG,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,mCAAmC,CAAC,CAAC;IACzE,MAAM,KAAK,GAAG,IAAI,GAAG,CAAC,CAAC,KAAK,CAAC,aAAa,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC;IACrF,gCAAgC;IAChC,MAAM,QAAQ,GAAG,EAAE,CAAC;IACpB,KAAK,MAAM,KAAK,IAAI,OAAO,EAAE,CAAC;QAC5B,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC;QACpC,IAAI,KAAK,CAAC,MAAM,KAAK,MAAM,IAAI,CAAC,gBAAgB,CAAC,KAAK,CAAC,IAAI,EAAE,KAAK,CAAC,KAAK,EAAE,IAAI,CAAC,MAAM,CAAC;YACpF,SAAS;QACX,IAAI,gCAAgC,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,WAAW,CAAC,IAAI,CAAC,IAAI,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC;YACrF,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC,KAAK,CAAC,IAAI,EAAE,KAAK,CAAC,KAAK,EAAE,kBAAkB,CAAC,CAAC,CAAC;IACnE,CAAC;IACD,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED;;;GAGG;AACH,SAAS,WAAW,CAAC,IAAI;IACvB,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC/B,IACE,MAAM,CAAC,MAAM,KAAK,CAAC;QACnB,MAAM,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,WAAW,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,MAAM,CAAC,KAAK,CAAC,GAAG,GAAG,CAAC;QAEvE,OAAO,KAAK,CAAC;IACf,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,GAAG,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;IAClC,OAAO,CACL,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,SAAS,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,CAAC,IAAI,CAAC,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,GAAG,CAAC,CAC7F,CAAC;AACJ,CAAC;AAED;;;;;GAKG;AACH,SAAS,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI;IAC5B,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC;IACrC,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,MAAM,CAAC,WAAW,CAAC,IAAI,CAAC,EAAE,CAAC;AAC9F,CAAC;AAED;;;;;GAKG;AACH,SAAS,gBAAgB,CAAC,IAAI,EAAE,KAAK,EAAE,MAAM;IAC3C,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,KAAK,GAAG,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC;IACzD,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,GAAG,MAAM,CAAC,CAAC;IACnC,OAAO,CACL,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC;QACtB,CAAC,QAAQ,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,KAAK,GAAG,IAAI,KAAK,KAAK,GAAG,IAAI,KAAK,KAAK,GAAG,CAAC,CAAC,CAC7E,CAAC;AACJ,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,0BAA0B,CAAC,MAAM;IAC/C,MAAM,QAAQ,GAAG;QACf,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC;QAChB,GAAG,MAAM,CAAC,OAAO,CAAC,CAAC,GAAG,EAAE,KAAK,EAAE,EAAE,CAC/B,GAAG,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,MAAM,CAAC,KAAK,GAAG,CAAC,CAAC,KAAK,SAAS,CAAC,CAAC,CAAC,CAAC,GAAG,GAAG,IAAI,MAAM,CAAC,KAAK,GAAG,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,CAC9F;KACF,CAAC;IACF,OAAO,QAAQ,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAC5B,YAAY,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,UAAU,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,IAAI,KAAK,YAAY,CAAC,CAC5F,CAAC;AACJ,CAAC"}

package/dist/domain/capability.js

@@ -0,0 +1,53 @@
+// The responsibilities a workspace needs, independent of who provides them. Workspace-
+// scoped ones are bound once in workspace.yaml; environment-scoped ones are bound per
+// platform instance in environments.yaml; internal ones are wired by the tool itself.
+export const CAPABILITIES = [
+    'code-host',
+    'issue-tracker',
+    'knowledge-base',
+    'im',
+    'calendar',
+    'meeting',
+    'task',
+    'worklog',
+    'error-tracker',
+    'log-store',
+    'metrics',
+    'ci',
+    'cluster',
+    'installer',
+    'agent-host',
+    'git',
+    'manifest-source',
+];
+export const CAPABILITY_INFO = {
+    'code-host': { scope: 'workspace', desc: 'where repositories, forks and pull requests live' },
+    'issue-tracker': { scope: 'workspace', desc: 'where work items are tracked' },
+    'knowledge-base': { scope: 'workspace', desc: 'where team documentation lives' },
+    im: { scope: 'workspace', desc: 'how people are messaged' },
+    calendar: { scope: 'workspace', desc: 'where schedules and availability live' },
+    meeting: { scope: 'workspace', desc: 'where online meetings, recordings and minutes live' },
+    task: { scope: 'workspace', desc: 'where personal and team to-dos are tracked' },
+    worklog: { scope: 'workspace', desc: 'where time spent on work is recorded' },
+    'error-tracker': { scope: 'environment', desc: 'where runtime errors are collected' },
+    'log-store': { scope: 'environment', desc: 'where logs are searched' },
+    metrics: { scope: 'environment', desc: 'where service metrics are queried' },
+    ci: { scope: 'environment', desc: 'where builds run' },
+    cluster: { scope: 'environment', desc: 'where services run; read-only from fx' },
+    installer: { scope: 'internal', desc: 'how a companion tool is installed' },
+    'agent-host': { scope: 'internal', desc: 'a coding agent that loads Skills' },
+    git: { scope: 'internal', desc: 'the local git executable' },
+    'manifest-source': { scope: 'internal', desc: 'where the manifest is fetched from' },
+};
+export function capabilitiesInScope(scope) {
+    return CAPABILITIES.filter((c) => CAPABILITY_INFO[c].scope === scope);
+}
+// The capabilities a manifest binds, and so the only ones worth asking about: an
+// internal one has no binding to report.
+export function bindableCapabilities() {
+    return CAPABILITIES.filter((c) => CAPABILITY_INFO[c].scope !== 'internal');
+}
+export function knownCapability(name) {
+    return CAPABILITIES.includes(name) ? name : null;
+}
+//# sourceMappingURL=capability.js.map

package/dist/domain/capability.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"capability.js","sourceRoot":"","sources":["../../src/domain/capability.ts"],"names":[],"mappings":"AAAA,uFAAuF;AACvF,sFAAsF;AACtF,sFAAsF;AAEtF,MAAM,CAAC,MAAM,YAAY,GAAG;IAC1B,WAAW;IACX,eAAe;IACf,gBAAgB;IAChB,IAAI;IACJ,UAAU;IACV,SAAS;IACT,MAAM;IACN,SAAS;IACT,eAAe;IACf,WAAW;IACX,SAAS;IACT,IAAI;IACJ,SAAS;IACT,WAAW;IACX,YAAY;IACZ,KAAK;IACL,iBAAiB;CACT,CAAC;AAWX,MAAM,CAAC,MAAM,eAAe,GAAuC;IACjE,WAAW,EAAE,EAAE,KAAK,EAAE,WAAW,EAAE,IAAI,EAAE,kDAAkD,EAAE;IAC7F,eAAe,EAAE,EAAE,KAAK,EAAE,WAAW,EAAE,IAAI,EAAE,8BAA8B,EAAE;IAC7E,gBAAgB,EAAE,EAAE,KAAK,EAAE,WAAW,EAAE,IAAI,EAAE,gCAAgC,EAAE;IAChF,EAAE,EAAE,EAAE,KAAK,EAAE,WAAW,EAAE,IAAI,EAAE,yBAAyB,EAAE;IAC3D,QAAQ,EAAE,EAAE,KAAK,EAAE,WAAW,EAAE,IAAI,EAAE,uCAAuC,EAAE;IAC/E,OAAO,EAAE,EAAE,KAAK,EAAE,WAAW,EAAE,IAAI,EAAE,oDAAoD,EAAE;IAC3F,IAAI,EAAE,EAAE,KAAK,EAAE,WAAW,EAAE,IAAI,EAAE,4CAA4C,EAAE;IAChF,OAAO,EAAE,EAAE,KAAK,EAAE,WAAW,EAAE,IAAI,EAAE,sCAAsC,EAAE;IAC7E,eAAe,EAAE,EAAE,KAAK,EAAE,aAAa,EAAE,IAAI,EAAE,oCAAoC,EAAE;IACrF,WAAW,EAAE,EAAE,KAAK,EAAE,aAAa,EAAE,IAAI,EAAE,yBAAyB,EAAE;IACtE,OAAO,EAAE,EAAE,KAAK,EAAE,aAAa,EAAE,IAAI,EAAE,mCAAmC,EAAE;IAC5E,EAAE,EAAE,EAAE,KAAK,EAAE,aAAa,EAAE,IAAI,EAAE,kBAAkB,EAAE;IACtD,OAAO,EAAE,EAAE,KAAK,EAAE,aAAa,EAAE,IAAI,EAAE,uCAAuC,EAAE;IAChF,SAAS,EAAE,EAAE,KAAK,EAAE,UAAU,EAAE,IAAI,EAAE,mCAAmC,EAAE;IAC3E,YAAY,EAAE,EAAE,KAAK,EAAE,UAAU,EAAE,IAAI,EAAE,kCAAkC,EAAE;IAC7E,GAAG,EAAE,EAAE,KAAK,EAAE,UAAU,EAAE,IAAI,EAAE,0BAA0B,EAAE;IAC5D,iBAAiB,EAAE,EAAE,KAAK,EAAE,UAAU,EAAE,IAAI,EAAE,oCAAoC,EAAE;CACrF,CAAC;AAEF,MAAM,UAAU,mBAAmB,CAAC,KAAsB;IACxD,OAAO,YAAY,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,eAAe,CAAC,CAAC,CAAC,CAAC,KAAK,KAAK,KAAK,CAAC,CAAC;AACxE,CAAC;AAED,iFAAiF;AACjF,yCAAyC;AACzC,MAAM,UAAU,oBAAoB;IAClC,OAAO,YAAY,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,eAAe,CAAC,CAAC,CAAC,CAAC,KAAK,KAAK,UAAU,CAAC,CAAC;AAC7E,CAAC;AAOD,MAAM,UAAU,eAAe,CAAC,IAAoB;IAClD,OAAQ,YAAkC,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,CAAE,IAAmB,CAAC,CAAC,CAAC,IAAI,CAAC;AAC1F,CAAC"}

package/dist/domain/config/codec.js

@@ -0,0 +1,36 @@
+// Profile serialization and validation are pure: filesystem access and write
+// planning remain with the application use cases. Workspace names are checked
+// before they can become registry keys or filesystem path components.
+import { parse, stringify } from 'yaml';
+import { DevkitError } from '../errors.js';
+import { assertWorkspaceName } from '../workspace/name.js';
+import { profileSchema } from './profile.js';
+export function parseProfile(text) {
+    let raw;
+    try {
+        raw = parse(text);
+    }
+    catch (err) {
+        throw invalid(err instanceof Error ? err.message : String(err));
+    }
+    const parsed = profileSchema.safeParse(raw);
+    if (!parsed.success)
+        throw invalid(parsed.error.issues.map((i) => `${i.path.join('.') || '(root)'}: ${i.message}`).join('; '));
+    // Every name becomes a path component and a registry key; a profile is data.
+    for (const name of [
+        ...Object.keys(parsed.data.workspaces),
+        ...Object.keys(parsed.data.config.workspaces ?? {}),
+    ])
+        assertWorkspaceName(name);
+    return parsed.data;
+}
+function invalid(detail) {
+    return new DevkitError('parse', 'CONFIG_IMPORT_INVALID', `Not an fx profile: ${detail}`, {
+        hint: 'A profile is what `fx config export` writes.',
+        nextSteps: ['fx config export -o profile.yaml'],
+    });
+}
+export function renderProfile(profile) {
+    return stringify(profile);
+}
+//# sourceMappingURL=codec.js.map

package/dist/domain/config/codec.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"codec.js","sourceRoot":"","sources":["../../../src/domain/config/codec.ts"],"names":[],"mappings":"AAAA,6EAA6E;AAC7E,8EAA8E;AAC9E,sEAAsE;AAEtE,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,MAAM,MAAM,CAAC;AAExC,OAAO,EAAE,WAAW,EAAE,MAAM,cAAc,CAAC;AAC3C,OAAO,EAAE,mBAAmB,EAAE,MAAM,sBAAsB,CAAC;AAE3D,OAAO,EAAE,aAAa,EAAgB,MAAM,cAAc,CAAC;AAE3D,MAAM,UAAU,YAAY,CAAC,IAAY;IACvC,IAAI,GAAY,CAAC;IACjB,IAAI,CAAC;QACH,GAAG,GAAG,KAAK,CAAC,IAAI,CAAC,CAAC;IACpB,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,OAAO,CAAC,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC;IAClE,CAAC;IACD,MAAM,MAAM,GAAG,aAAa,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC;IAC5C,IAAI,CAAC,MAAM,CAAC,OAAO;QACjB,MAAM,OAAO,CACX,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,QAAQ,KAAK,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAC3F,CAAC;IACJ,6EAA6E;IAC7E,KAAK,MAAM,IAAI,IAAI;QACjB,GAAG,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC;QACtC,GAAG,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,UAAU,IAAI,EAAE,CAAC;KACpD;QACC,mBAAmB,CAAC,IAAI,CAAC,CAAC;IAC5B,OAAO,MAAM,CAAC,IAAI,CAAC;AACrB,CAAC;AAED,SAAS,OAAO,CAAC,MAAc;IAC7B,OAAO,IAAI,WAAW,CAAC,OAAO,EAAE,uBAAuB,EAAE,sBAAsB,MAAM,EAAE,EAAE;QACvF,IAAI,EAAE,8CAA8C;QACpD,SAAS,EAAE,CAAC,kCAAkC,CAAC;KAChD,CAAC,CAAC;AACL,CAAC;AAED,MAAM,UAAU,aAAa,CAAC,OAAgB;IAC5C,OAAO,SAAS,CAAC,OAAO,CAAC,CAAC;AAC5B,CAAC"}

package/dist/domain/config/file.js

@@ -0,0 +1,19 @@
+// Personal configuration has one validated shape for local storage and exported
+// profiles. Workspace selection remains data; resolution belongs to application.
+import * as z from 'zod';
+import { FORMATS } from '../format.js';
+import { COMMAND_SHELLS } from '../shell.js';
+export const configFileSchema = z.strictObject({
+    default_workspace: z.string().optional(),
+    workspaces: z
+        .record(z.string(), z.strictObject({ root: z.string(), source: z.string().optional() }))
+        .optional(),
+    user: z.string().optional(),
+    format: z.enum(FORMATS).optional(),
+    command_shell: z.enum(COMMAND_SHELLS).optional(),
+    agents: z.array(z.string()).optional(),
+    read_only: z.boolean().optional(),
+    update_check: z.boolean().optional(),
+    hooks: z.boolean().optional(),
+});
+//# sourceMappingURL=file.js.map

package/dist/domain/config/file.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"file.js","sourceRoot":"","sources":["../../../src/domain/config/file.ts"],"names":[],"mappings":"AAAA,gFAAgF;AAChF,iFAAiF;AAEjF,OAAO,KAAK,CAAC,MAAM,KAAK,CAAC;AAEzB,OAAO,EAAE,OAAO,EAAe,MAAM,cAAc,CAAC;AACpD,OAAO,EAAE,cAAc,EAAqB,MAAM,aAAa,CAAC;AAmBhE,MAAM,CAAC,MAAM,gBAAgB,GAAG,CAAC,CAAC,YAAY,CAAC;IAC7C,iBAAiB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACxC,UAAU,EAAE,CAAC;SACV,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,YAAY,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC;SACvF,QAAQ,EAAE;IACb,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC3B,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,QAAQ,EAAE;IAClC,aAAa,EAAE,CAAC,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC,QAAQ,EAAE;IAChD,MAAM,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE;IACtC,SAAS,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;IACjC,YAAY,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;IACpC,KAAK,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;CAC9B,CAAC,CAAC"}

package/dist/domain/config/profile.js

@@ -0,0 +1,15 @@
+// The profile document: everything personal that is worth carrying to
+// another machine — the config file and each workspace's personal layer —
+// and nothing that is not: no trust record, no cache, no credential.
+import * as z from 'zod';
+import { localSchema } from '../manifest/local.schema.js';
+import { configFileSchema } from './file.js';
+export const PROFILE_VERSION = 1;
+export { configFileSchema as profileConfig } from './file.js';
+export const profileSchema = z.strictObject({
+    fx_profile: z.literal(PROFILE_VERSION),
+    exported_at: z.string().optional(),
+    config: configFileSchema,
+    workspaces: z.record(z.string(), localSchema).default({}),
+});
+//# sourceMappingURL=profile.js.map

package/dist/domain/config/profile.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"profile.js","sourceRoot":"","sources":["../../../src/domain/config/profile.ts"],"names":[],"mappings":"AAAA,sEAAsE;AACtE,0EAA0E;AAC1E,qEAAqE;AAErE,OAAO,KAAK,CAAC,MAAM,KAAK,CAAC;AAEzB,OAAO,EAAE,WAAW,EAAE,MAAM,6BAA6B,CAAC;AAE1D,OAAO,EAAE,gBAAgB,EAAE,MAAM,WAAW,CAAC;AAE7C,MAAM,CAAC,MAAM,eAAe,GAAG,CAAC,CAAC;AAEjC,OAAO,EAAE,gBAAgB,IAAI,aAAa,EAAE,MAAM,WAAW,CAAC;AAE9D,MAAM,CAAC,MAAM,aAAa,GAAG,CAAC,CAAC,YAAY,CAAC;IAC1C,UAAU,EAAE,CAAC,CAAC,OAAO,CAAC,eAAe,CAAC;IACtC,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAClC,MAAM,EAAE,gBAAgB;IACxB,UAAU,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,WAAW,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;CAC1D,CAAC,CAAC"}

package/dist/domain/contribution/candidate.js

@@ -0,0 +1,23 @@
+// Candidate content is the upstream baseline overlaid with captured selected
+// bytes. The caller's live index and unrelated working files are not inputs.
+import { selectContributionFiles } from './selection.js';
+export function buildContributionCandidate(input) {
+    const candidate = { ...input.base };
+    const selected = selectContributionFiles({
+        paths: input.changes.map((file) => file.path),
+        changes: input.changes,
+    });
+    for (const file of selected) {
+        if (file.content === null)
+            delete candidate[file.path];
+        else
+            Object.defineProperty(candidate, file.path, {
+                value: file.content,
+                enumerable: true,
+                writable: true,
+                configurable: true,
+            });
+    }
+    return Object.freeze(candidate);
+}
+//# sourceMappingURL=candidate.js.map

package/dist/domain/contribution/candidate.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"candidate.js","sourceRoot":"","sources":["../../../src/domain/contribution/candidate.ts"],"names":[],"mappings":"AAAA,6EAA6E;AAC7E,6EAA6E;AAE7E,OAAO,EAAE,uBAAuB,EAAE,MAAM,gBAAgB,CAAC;AAQzD,MAAM,UAAU,0BAA0B,CACxC,KAAqB;IAErB,MAAM,SAAS,GAAG,EAAE,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC;IACpC,MAAM,QAAQ,GAAG,uBAAuB,CAAC;QACvC,KAAK,EAAE,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC;QAC7C,OAAO,EAAE,KAAK,CAAC,OAAO;KACvB,CAAC,CAAC;IACH,KAAK,MAAM,IAAI,IAAI,QAAQ,EAAE,CAAC;QAC5B,IAAI,IAAI,CAAC,OAAO,KAAK,IAAI;YAAE,OAAO,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;;YAErD,MAAM,CAAC,cAAc,CAAC,SAAS,EAAE,IAAI,CAAC,IAAI,EAAE;gBAC1C,KAAK,EAAE,IAAI,CAAC,OAAO;gBACnB,UAAU,EAAE,IAAI;gBAChB,QAAQ,EAAE,IAAI;gBACd,YAAY,EAAE,IAAI;aACnB,CAAC,CAAC;IACP,CAAC;IACD,OAAO,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;AAClC,CAAC"}

package/dist/domain/contribution/display-paths.js

@@ -0,0 +1,9 @@
+// Candidate filenames are untrusted content too. Plans may identify a rejected
+// path's position without exposing a credential or person embedded in its name.
+import { scanBoundary } from '../boundary/scan.js';
+export function displayContributionPaths(paths) {
+    return paths.map((value, index) => scanBoundary({ text: value, policy: 'manifest' }).length
+        ? `(protected path ${index + 1})`
+        : value);
+}
+//# sourceMappingURL=display-paths.js.map

package/dist/domain/contribution/display-paths.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"display-paths.js","sourceRoot":"","sources":["../../../src/domain/contribution/display-paths.ts"],"names":[],"mappings":"AAAA,+EAA+E;AAC/E,gFAAgF;AAEhF,OAAO,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAC;AAEnD,MAAM,UAAU,wBAAwB,CAAC,KAAwB;IAC/D,OAAO,KAAK,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,KAAK,EAAE,EAAE,CAChC,YAAY,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,UAAU,EAAE,CAAC,CAAC,MAAM;QACtD,CAAC,CAAC,mBAAmB,KAAK,GAAG,CAAC,GAAG;QACjC,CAAC,CAAC,KAAK,CACV,CAAC;AACJ,CAAC"}

package/dist/domain/contribution/operation.js

@@ -0,0 +1,4 @@
+// An operation journal stores identities and intended transitions, never file
+// contents or PR prose. Prepared objects are recorded before ref publication.
+export {};
+//# sourceMappingURL=operation.js.map

package/dist/domain/contribution/operation.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"operation.js","sourceRoot":"","sources":["../../../src/domain/contribution/operation.ts"],"names":[],"mappings":"AAAA,8EAA8E;AAC9E,8EAA8E"}

package/dist/domain/contribution/pending.js

@@ -0,0 +1,20 @@
+// Pending contributions retain intent across uncertain remote responses. Only
+// authoritative absence or closure permits retiring a record automatically.
+export function decideContributionReuse(input) {
+    const pending = input.pending;
+    if (input.forceNew || pending === null || pending.remoteIdentity !== input.remoteIdentity)
+        return 'new';
+    if (pending.phase !== 'open')
+        return 'recover';
+    if (input.pullRequestState === 'closed' || input.remoteHead === null)
+        return 'new';
+    if (input.pullRequestState === 'unknown' || input.remoteHead === undefined)
+        return 'recover';
+    const selected = new Set(input.files);
+    if (!pending.files.every((file) => selected.has(file)))
+        return 'new';
+    if (input.remoteHead !== pending.commit)
+        return 'conflict';
+    return input.tree === pending.tree ? 'unchanged' : 'reuse';
+}
+//# sourceMappingURL=pending.js.map

package/dist/domain/contribution/pending.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"pending.js","sourceRoot":"","sources":["../../../src/domain/contribution/pending.ts"],"names":[],"mappings":"AAAA,8EAA8E;AAC9E,4EAA4E;AA0B5E,MAAM,UAAU,uBAAuB,CACrC,KAAwB;IAExB,MAAM,OAAO,GAAG,KAAK,CAAC,OAAO,CAAC;IAC9B,IAAI,KAAK,CAAC,QAAQ,IAAI,OAAO,KAAK,IAAI,IAAI,OAAO,CAAC,cAAc,KAAK,KAAK,CAAC,cAAc;QACvF,OAAO,KAAK,CAAC;IACf,IAAI,OAAO,CAAC,KAAK,KAAK,MAAM;QAAE,OAAO,SAAS,CAAC;IAC/C,IAAI,KAAK,CAAC,gBAAgB,KAAK,QAAQ,IAAI,KAAK,CAAC,UAAU,KAAK,IAAI;QAAE,OAAO,KAAK,CAAC;IACnF,IAAI,KAAK,CAAC,gBAAgB,KAAK,SAAS,IAAI,KAAK,CAAC,UAAU,KAAK,SAAS;QAAE,OAAO,SAAS,CAAC;IAC7F,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;IACtC,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QAAE,OAAO,KAAK,CAAC;IACrE,IAAI,KAAK,CAAC,UAAU,KAAK,OAAO,CAAC,MAAM;QAAE,OAAO,UAAU,CAAC;IAC3D,OAAO,KAAK,CAAC,IAAI,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,OAAO,CAAC;AAC7D,CAAC"}

package/dist/domain/contribution/pull-request.js

@@ -0,0 +1,4 @@
+// A contribution PR names both repositories and branches. Its state comes from
+// one known remote request, never from a missing response or local timestamp.
+export {};
+//# sourceMappingURL=pull-request.js.map

package/dist/domain/contribution/pull-request.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"pull-request.js","sourceRoot":"","sources":["../../../src/domain/contribution/pull-request.ts"],"names":[],"mappings":"AAAA,+EAA+E;AAC/E,8EAA8E"}

package/dist/domain/contribution/remote.js

@@ -0,0 +1,111 @@
+// A contribution target needs provider identity evidence as well as a Git name.
+// Unknown parentage cannot be promoted to a fork merely by matching its URL.
+import path from 'node:path';
+import { DevkitError } from '../errors.js';
+export function verifyContributionRemote(input) {
+    const { settings, origin, upstream } = input;
+    if (!/^fx\/contribution\/[a-zA-Z0-9_-]+$/.test(input.branch) ||
+        input.branch === origin.defaultBranch ||
+        input.branch === upstream.defaultBranch)
+        throw new DevkitError('usage', 'SOURCE_BRANCH_INVALID', 'Contributions require a dedicated managed branch', { nextSteps: ['fx source push --new'] });
+    if (settings.originUrls.length !== 1 ||
+        settings.pushUrls.length !== 1 ||
+        settings.upstreamUrls.length !== 1 ||
+        settings.hasRewrite ||
+        settings.isMirror ||
+        settings.receivePack !== null)
+        throw unsafe();
+    if (origin.parent === undefined || origin.personalOwner === null)
+        throw unverified();
+    if (origin.personalOwner !== input.user ||
+        !origin.parent ||
+        !sameRef(origin.parent, upstream.ref) ||
+        sameRef(origin.ref, upstream.ref))
+        throw unsafe();
+    const url = settings.pushUrls[0];
+    if (!matches(url, origin.cloneUrls) ||
+        !matches(settings.originUrls[0], origin.cloneUrls) ||
+        !matches(settings.upstreamUrls[0], upstream.cloneUrls))
+        throw unsafe();
+    return {
+        url,
+        fingerprint: settings.fingerprint,
+        source: origin.ref,
+        target: upstream.ref,
+        targetBranch: upstream.defaultBranch,
+    };
+}
+function sameRef(a, b) {
+    return a.project === b.project && a.name === b.name;
+}
+function matches(url, advertised) {
+    const normalized = normalizeTransport(url);
+    return advertised.some((candidate) => normalizeTransport(candidate) === normalized);
+}
+function normalizeTransport(value) {
+    if (!value || /[\x00-\x1f\x7f]/u.test(value))
+        throw unsafe();
+    if (/^[a-z]:[\\/]/i.test(value))
+        return windowsTransport(value);
+    if (value.startsWith('/'))
+        return value.replace(/\/+$/, '').replace(/\.git$/, '');
+    if (/\s/u.test(value))
+        throw unsafe();
+    const scp = /^([^/@:]+@[^/:]+):(.+)$/.exec(value);
+    const normalized = scp ? `ssh://${scp[1]}/${scp[2]}` : value;
+    let url;
+    try {
+        url = new URL(normalized);
+    }
+    catch {
+        throw unsafe();
+    }
+    if (!['ssh:', 'https:', 'file:'].includes(url.protocol) ||
+        url.password ||
+        url.search ||
+        url.hash ||
+        (url.protocol === 'https:' && url.username))
+        throw unsafe();
+    url.pathname = url.pathname.replace(/\/+$/, '').replace(/\.git$/, '');
+    if (url.protocol === 'file:' && !url.hostname && /^\/[a-z]:\//i.test(url.pathname))
+        return windowsTransport(decodeURIComponent(url.pathname.slice(1)));
+    return url.toString();
+}
+function windowsTransport(value) {
+    const normalized = path.win32
+        .normalize(value)
+        .replaceAll('\\', '/')
+        .toLowerCase()
+        .replace(/\/+$/, '')
+        .replace(/\.git$/, '');
+    return `file:///${normalized
+        .split('/')
+        .map((part, index) => (index === 0 ? part : encodeURIComponent(part)))
+        .join('/')}`;
+}
+function unsafe() {
+    return new DevkitError('conflict', 'SOURCE_REMOTE_UNSAFE', 'Source remotes do not identify one verified personal fork and its upstream', {
+        hint: 'Review origin and upstream, including push URLs and URL rewrites. No remote was changed.',
+        nextSteps: [
+            'Inspect the source Git remote configuration.',
+            'Verify the fork owner and parent, then retry.',
+        ],
+    });
+}
+function unverified() {
+    return new DevkitError('config', 'SOURCE_IDENTITY_UNVERIFIED', 'The companion did not establish personal fork ownership and parentage', {
+        hint: 'Use a companion version that exposes repository parent identity; matching a URL is insufficient.',
+        nextSteps: ['fx doctor', 'Verify the personal fork and update the companion CLI.'],
+        handoff: {
+            summary: 'Repository identity evidence is incomplete.',
+            userSteps: [
+                {
+                    id: 'source-parent',
+                    kind: 'manual',
+                    title: 'Use a companion CLI that reports the personal fork and its parent repository.',
+                },
+            ],
+        },
+    });
+}
+//# sourceMappingURL=remote.js.map

package/dist/domain/contribution/remote.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"remote.js","sourceRoot":"","sources":["../../../src/domain/contribution/remote.ts"],"names":[],"mappings":"AAAA,gFAAgF;AAChF,6EAA6E;AAE7E,OAAO,IAAI,MAAM,WAAW,CAAC;AAE7B,OAAO,EAAE,WAAW,EAAE,MAAM,cAAc,CAAC;AAsC3C,MAAM,UAAU,wBAAwB,CAAC,KAAyB;IAChE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,QAAQ,EAAE,GAAG,KAAK,CAAC;IAC7C,IACE,CAAC,oCAAoC,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC;QACxD,KAAK,CAAC,MAAM,KAAK,MAAM,CAAC,aAAa;QACrC,KAAK,CAAC,MAAM,KAAK,QAAQ,CAAC,aAAa;QAEvC,MAAM,IAAI,WAAW,CACnB,OAAO,EACP,uBAAuB,EACvB,kDAAkD,EAClD,EAAE,SAAS,EAAE,CAAC,sBAAsB,CAAC,EAAE,CACxC,CAAC;IACJ,IACE,QAAQ,CAAC,UAAU,CAAC,MAAM,KAAK,CAAC;QAChC,QAAQ,CAAC,QAAQ,CAAC,MAAM,KAAK,CAAC;QAC9B,QAAQ,CAAC,YAAY,CAAC,MAAM,KAAK,CAAC;QAClC,QAAQ,CAAC,UAAU;QACnB,QAAQ,CAAC,QAAQ;QACjB,QAAQ,CAAC,WAAW,KAAK,IAAI;QAE7B,MAAM,MAAM,EAAE,CAAC;IACjB,IAAI,MAAM,CAAC,MAAM,KAAK,SAAS,IAAI,MAAM,CAAC,aAAa,KAAK,IAAI;QAAE,MAAM,UAAU,EAAE,CAAC;IACrF,IACE,MAAM,CAAC,aAAa,KAAK,KAAK,CAAC,IAAI;QACnC,CAAC,MAAM,CAAC,MAAM;QACd,CAAC,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,QAAQ,CAAC,GAAG,CAAC;QACrC,OAAO,CAAC,MAAM,CAAC,GAAG,EAAE,QAAQ,CAAC,GAAG,CAAC;QAEjC,MAAM,MAAM,EAAE,CAAC;IACjB,MAAM,GAAG,GAAG,QAAQ,CAAC,QAAQ,CAAC,CAAC,CAAE,CAAC;IAClC,IACE,CAAC,OAAO,CAAC,GAAG,EAAE,MAAM,CAAC,SAAS,CAAC;QAC/B,CAAC,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC,CAAE,EAAE,MAAM,CAAC,SAAS,CAAC;QACnD,CAAC,OAAO,CAAC,QAAQ,CAAC,YAAY,CAAC,CAAC,CAAE,EAAE,QAAQ,CAAC,SAAS,CAAC;QAEvD,MAAM,MAAM,EAAE,CAAC;IACjB,OAAO;QACL,GAAG;QACH,WAAW,EAAE,QAAQ,CAAC,WAAW;QACjC,MAAM,EAAE,MAAM,CAAC,GAAG;QAClB,MAAM,EAAE,QAAQ,CAAC,GAAG;QACpB,YAAY,EAAE,QAAQ,CAAC,aAAa;KACrC,CAAC;AACJ,CAAC;AAED,SAAS,OAAO,CAAC,CAAU,EAAE,CAAU;IACrC,OAAO,CAAC,CAAC,OAAO,KAAK,CAAC,CAAC,OAAO,IAAI,CAAC,CAAC,IAAI,KAAK,CAAC,CAAC,IAAI,CAAC;AACtD,CAAC;AAED,SAAS,OAAO,CAAC,GAAW,EAAE,UAA6B;IACzD,MAAM,UAAU,GAAG,kBAAkB,CAAC,GAAG,CAAC,CAAC;IAC3C,OAAO,UAAU,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,kBAAkB,CAAC,SAAS,CAAC,KAAK,UAAU,CAAC,CAAC;AACtF,CAAC;AAED,SAAS,kBAAkB,CAAC,KAAa;IACvC,IAAI,CAAC,KAAK,IAAI,kBAAkB,CAAC,IAAI,CAAC,KAAK,CAAC;QAAE,MAAM,MAAM,EAAE,CAAC;IAC7D,IAAI,eAAe,CAAC,IAAI,CAAC,KAAK,CAAC;QAAE,OAAO,gBAAgB,CAAC,KAAK,CAAC,CAAC;IAChE,IAAI,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC;QAAE,OAAO,KAAK,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC;IAClF,IAAI,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC;QAAE,MAAM,MAAM,EAAE,CAAC;IACtC,MAAM,GAAG,GAAG,yBAAyB,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IAClD,MAAM,UAAU,GAAG,GAAG,CAAC,CAAC,CAAC,SAAS,GAAG,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC;IAC7D,IAAI,GAAQ,CAAC;IACb,IAAI,CAAC;QACH,GAAG,GAAG,IAAI,GAAG,CAAC,UAAU,CAAC,CAAC;IAC5B,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,MAAM,EAAE,CAAC;IACjB,CAAC;IACD,IACE,CAAC,CAAC,MAAM,EAAE,QAAQ,EAAE,OAAO,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,QAAQ,CAAC;QACnD,GAAG,CAAC,QAAQ;QACZ,GAAG,CAAC,MAAM;QACV,GAAG,CAAC,IAAI;QACR,CAAC,GAAG,CAAC,QAAQ,KAAK,QAAQ,IAAI,GAAG,CAAC,QAAQ,CAAC;QAE3C,MAAM,MAAM,EAAE,CAAC;IACjB,GAAG,CAAC,QAAQ,GAAG,GAAG,CAAC,QAAQ,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC;IACtE,IAAI,GAAG,CAAC,QAAQ,KAAK,OAAO,IAAI,CAAC,GAAG,CAAC,QAAQ,IAAI,cAAc,CAAC,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC;QAChF,OAAO,gBAAgB,CAAC,kBAAkB,CAAC,GAAG,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IACrE,OAAO,GAAG,CAAC,QAAQ,EAAE,CAAC;AACxB,CAAC;AAED,SAAS,gBAAgB,CAAC,KAAa;IACrC,MAAM,UAAU,GAAG,IAAI,CAAC,KAAK;SAC1B,SAAS,CAAC,KAAK,CAAC;SAChB,UAAU,CAAC,IAAI,EAAE,GAAG,CAAC;SACrB,WAAW,EAAE;SACb,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC;SACnB,OAAO,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC;IACzB,OAAO,WAAW,UAAU;SACzB,KAAK,CAAC,GAAG,CAAC;SACV,GAAG,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC,CAAC,KAAK,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,kBAAkB,CAAC,IAAI,CAAC,CAAC,CAAC;SACrE,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;AACjB,CAAC;AAED,SAAS,MAAM;IACb,OAAO,IAAI,WAAW,CACpB,UAAU,EACV,sBAAsB,EACtB,4EAA4E,EAC5E;QACE,IAAI,EAAE,0FAA0F;QAChG,SAAS,EAAE;YACT,8CAA8C;YAC9C,+CAA+C;SAChD;KACF,CACF,CAAC;AACJ,CAAC;AAED,SAAS,UAAU;IACjB,OAAO,IAAI,WAAW,CACpB,QAAQ,EACR,4BAA4B,EAC5B,uEAAuE,EACvE;QACE,IAAI,EAAE,kGAAkG;QACxG,SAAS,EAAE,CAAC,WAAW,EAAE,wDAAwD,CAAC;QAClF,OAAO,EAAE;YACP,OAAO,EAAE,6CAA6C;YACtD,SAAS,EAAE;gBACT;oBACE,EAAE,EAAE,eAAe;oBACnB,IAAI,EAAE,QAAQ;oBACd,KAAK,EAAE,+EAA+E;iBACvF;aACF;SACF;KACF,CACF,CAAC;AACJ,CAAC"}

package/dist/domain/contribution/selection.js

@@ -0,0 +1,65 @@
+// Selection expands only known changed paths, never Git pathspec expressions.
+// Renames require both endpoints so a contribution cannot silently become a copy.
+import { scanBoundary } from '../boundary/scan.js';
+import { DevkitError } from '../errors.js';
+import { nearest } from '../fuzzy.js';
+export function selectContributionFiles(input) {
+    if (input.paths.length === 0)
+        throw new DevkitError('usage', 'INPUT_REQUIRED', 'Select files to contribute', {
+            nextSteps: ['fx source push <path>...'],
+        });
+    for (const path of input.paths)
+        assertSafePath(path);
+    for (const file of input.changes)
+        assertSafePath(file.path);
+    const selected = new Map();
+    for (const path of input.paths) {
+        const matches = input.changes.filter((file) => file.path === path || file.path.startsWith(`${path}/`));
+        if (matches.length === 0)
+            throw missingSelection(path, input.changes);
+        for (const file of matches)
+            selected.set(file.path, file);
+    }
+    for (const file of selected.values())
+        assertSupported(file, selected);
+    return [...selected.values()].sort((a, b) => {
+        if (a.path === b.path)
+            return 0;
+        return a.path < b.path ? -1 : 1;
+    });
+}
+function assertSafePath(path) {
+    const segments = path.split('/');
+    if (!path ||
+        /[\\\x00-\x1f\x7f:]/u.test(path) ||
+        segments.some((segment) => !segment || segment === '.' || segment === '..' || segment.toLowerCase() === '.git'))
+        throw new DevkitError('usage', 'SOURCE_PATH_INVALID', 'Contribution paths must be plain source-relative paths', {
+            nextSteps: [
+                `Replace "${path}" with a source-relative path without backslashes, "." , ".." or ".git" segments.`,
+            ],
+        });
+}
+function assertSupported(file, selected) {
+    if (file.kind === 'symlink' || file.kind === 'gitlink')
+        throw new DevkitError('usage', 'SOURCE_ENTRY_UNSUPPORTED', 'Contributions accept regular files and deletions only', {
+            nextSteps: [
+                `Remove ${file.path} from the selection; symbolic links and submodules cannot be contributed.`,
+            ],
+        });
+    if ((file.kind === 'deleted') !== (file.content === null))
+        throw new DevkitError('conflict', 'SOURCE_SNAPSHOT_INVALID', 'The captured file state is inconsistent', { nextSteps: ['Re-run the same fx source push command to capture the source again.'] });
+    if (file.renamePeer !== undefined && !selected.has(file.renamePeer))
+        throw new DevkitError('usage', 'SOURCE_RENAME_INCOMPLETE', 'Select both paths of a renamed file', { nextSteps: [`Add ${file.renamePeer} to the selection, then retry.`] });
+}
+function missingSelection(value, changes) {
+    const suggestion = nearest(value, changes
+        .map((file) => file.path)
+        .filter((file) => scanBoundary({ text: file, policy: 'manifest' }).length === 0));
+    return new DevkitError('usage', 'SOURCE_SELECTION_EMPTY', 'A selection matches no changed file', {
+        hint: suggestion
+            ? `Did you mean "${suggestion}"?`
+            : 'Choose changed files or directories relative to the source root.',
+        nextSteps: ['Review the changed source paths and retry with an explicit selection.'],
+    });
+}
+//# sourceMappingURL=selection.js.map

package/dist/domain/contribution/selection.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"selection.js","sourceRoot":"","sources":["../../../src/domain/contribution/selection.ts"],"names":[],"mappings":"AAAA,8EAA8E;AAC9E,kFAAkF;AAElF,OAAO,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAC;AACnD,OAAO,EAAE,WAAW,EAAE,MAAM,cAAc,CAAC;AAC3C,OAAO,EAAE,OAAO,EAAE,MAAM,aAAa,CAAC;AAStC,MAAM,UAAU,uBAAuB,CAAC,KAA4B;IAClE,IAAI,KAAK,CAAC,KAAK,CAAC,MAAM,KAAK,CAAC;QAC1B,MAAM,IAAI,WAAW,CAAC,OAAO,EAAE,gBAAgB,EAAE,4BAA4B,EAAE;YAC7E,SAAS,EAAE,CAAC,0BAA0B,CAAC;SACxC,CAAC,CAAC;IACL,KAAK,MAAM,IAAI,IAAI,KAAK,CAAC,KAAK;QAAE,cAAc,CAAC,IAAI,CAAC,CAAC;IACrD,KAAK,MAAM,IAAI,IAAI,KAAK,CAAC,OAAO;QAAE,cAAc,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC5D,MAAM,QAAQ,GAAG,IAAI,GAAG,EAA4B,CAAC;IACrD,KAAK,MAAM,IAAI,IAAI,KAAK,CAAC,KAAK,EAAE,CAAC;QAC/B,MAAM,OAAO,GAAG,KAAK,CAAC,OAAO,CAAC,MAAM,CAClC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,KAAK,IAAI,IAAI,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,IAAI,GAAG,CAAC,CACjE,CAAC;QACF,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC;YAAE,MAAM,gBAAgB,CAAC,IAAI,EAAE,KAAK,CAAC,OAAO,CAAC,CAAC;QACtE,KAAK,MAAM,IAAI,IAAI,OAAO;YAAE,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;IAC5D,CAAC;IACD,KAAK,MAAM,IAAI,IAAI,QAAQ,CAAC,MAAM,EAAE;QAAE,eAAe,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;IACtE,OAAO,CAAC,GAAG,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE;QAC1C,IAAI,CAAC,CAAC,IAAI,KAAK,CAAC,CAAC,IAAI;YAAE,OAAO,CAAC,CAAC;QAChC,OAAO,CAAC,CAAC,IAAI,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IAClC,CAAC,CAAC,CAAC;AACL,CAAC;AAED,SAAS,cAAc,CAAC,IAAY;IAClC,MAAM,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IACjC,IACE,CAAC,IAAI;QACL,qBAAqB,CAAC,IAAI,CAAC,IAAI,CAAC;QAChC,QAAQ,CAAC,IAAI,CACX,CAAC,OAAO,EAAE,EAAE,CACV,CAAC,OAAO,IAAI,OAAO,KAAK,GAAG,IAAI,OAAO,KAAK,IAAI,IAAI,OAAO,CAAC,WAAW,EAAE,KAAK,MAAM,CACtF;QAED,MAAM,IAAI,WAAW,CACnB,OAAO,EACP,qBAAqB,EACrB,wDAAwD,EACxD;YACE,SAAS,EAAE;gBACT,YAAY,IAAI,mFAAmF;aACpG;SACF,CACF,CAAC;AACN,CAAC;AAED,SAAS,eAAe,CACtB,IAAsB,EACtB,QAA+C;IAE/C,IAAI,IAAI,CAAC,IAAI,KAAK,SAAS,IAAI,IAAI,CAAC,IAAI,KAAK,SAAS;QACpD,MAAM,IAAI,WAAW,CACnB,OAAO,EACP,0BAA0B,EAC1B,uDAAuD,EACvD;YACE,SAAS,EAAE;gBACT,UAAU,IAAI,CAAC,IAAI,2EAA2E;aAC/F;SACF,CACF,CAAC;IACJ,IAAI,CAAC,IAAI,CAAC,IAAI,KAAK,SAAS,CAAC,KAAK,CAAC,IAAI,CAAC,OAAO,KAAK,IAAI,CAAC;QACvD,MAAM,IAAI,WAAW,CACnB,UAAU,EACV,yBAAyB,EACzB,yCAAyC,EACzC,EAAE,SAAS,EAAE,CAAC,qEAAqE,CAAC,EAAE,CACvF,CAAC;IACJ,IAAI,IAAI,CAAC,UAAU,KAAK,SAAS,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,UAAU,CAAC;QACjE,MAAM,IAAI,WAAW,CACnB,OAAO,EACP,0BAA0B,EAC1B,qCAAqC,EACrC,EAAE,SAAS,EAAE,CAAC,OAAO,IAAI,CAAC,UAAU,gCAAgC,CAAC,EAAE,CACxE,CAAC;AACN,CAAC;AAED,SAAS,gBAAgB,CAAC,KAAa,EAAE,OAAoC;IAC3E,MAAM,UAAU,GAAG,OAAO,CACxB,KAAK,EACL,OAAO;SACJ,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC;SACxB,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,YAAY,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,EAAE,UAAU,EAAE,CAAC,CAAC,MAAM,KAAK,CAAC,CAAC,CACnF,CAAC;IACF,OAAO,IAAI,WAAW,CAAC,OAAO,EAAE,wBAAwB,EAAE,qCAAqC,EAAE;QAC/F,IAAI,EAAE,UAAU;YACd,CAAC,CAAC,iBAAiB,UAAU,IAAI;YACjC,CAAC,CAAC,kEAAkE;QACtE,SAAS,EAAE,CAAC,uEAAuE,CAAC;KACrF,CAAC,CAAC;AACL,CAAC"}

package/dist/domain/contribution/snapshot.js

@@ -0,0 +1,4 @@
+// Captured contribution entries describe working-file bytes independently of
+// the real index. Adapters reject unreadable or non-text entries before capture.
+export {};
+//# sourceMappingURL=snapshot.js.map

package/dist/domain/contribution/snapshot.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"snapshot.js","sourceRoot":"","sources":["../../../src/domain/contribution/snapshot.ts"],"names":[],"mappings":"AAAA,6EAA6E;AAC7E,iFAAiF"}

package/dist/domain/deadline.js

@@ -0,0 +1,17 @@
+// Work given a deadline: past it, the fallback wins and the work is told to
+// stop through the signal it was handed. The timer is kept referenced so the
+// fallback is delivered even when nothing else keeps the process alive.
+export function withDeadline(work, ms, fallback) {
+    const control = new AbortController();
+    return new Promise((resolve) => {
+        const timer = setTimeout(() => {
+            control.abort();
+            resolve(fallback);
+        }, ms);
+        Promise.resolve()
+            .then(() => work(control.signal))
+            .then(resolve, () => resolve(fallback))
+            .finally(() => clearTimeout(timer));
+    });
+}
+//# sourceMappingURL=deadline.js.map

package/dist/domain/deadline.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"deadline.js","sourceRoot":"","sources":["../../src/domain/deadline.ts"],"names":[],"mappings":"AAAA,4EAA4E;AAC5E,6EAA6E;AAC7E,wEAAwE;AAExE,MAAM,UAAU,YAAY,CAC1B,IAAyC,EACzC,EAAU,EACV,QAAW;IAEX,MAAM,OAAO,GAAG,IAAI,eAAe,EAAE,CAAC;IACtC,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE;QAC7B,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE;YAC5B,OAAO,CAAC,KAAK,EAAE,CAAC;YAChB,OAAO,CAAC,QAAQ,CAAC,CAAC;QACpB,CAAC,EAAE,EAAE,CAAC,CAAC;QACP,OAAO,CAAC,OAAO,EAAE;aACd,IAAI,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;aAChC,IAAI,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;aACtC,OAAO,CAAC,GAAG,EAAE,CAAC,YAAY,CAAC,KAAK,CAAC,CAAC,CAAC;IACxC,CAAC,CAAC,CAAC;AACL,CAAC"}