@beehexa/hexasync-template-model 2608.8.3 → 2608.20.18

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@beehexa/hexasync-template-model",
-  "version": "2608.8.3",
+  "version": "2608.20.18",
   "description": "Domain types for HexaSync templates. No behaviour.",
   "license": "SEE LICENSE IN ../../LICENSE",
   "type": "module",
@@ -21,6 +21,6 @@
   },
   "hexasync": {
     "layer": "core",
-    "composeContract": 2
+    "composeContract": 3
   }
 }

package/dist/contract.d.ts

@@ -1,49 +0,0 @@
-/**
- * The compose contract version (AD-13, Story 1.10).
- *
- * A single integer, deliberately independent of every package's semver. Semver answers "did the
- * API change?"; this answers a different and more dangerous question — "would the same input
- * compose to a different output?" A patch release that fixes a typo in a report heading changes
- * the version of the package but not the meaning of a composition, and warning about that would
- * train everyone to ignore the warning.
- *
- * BUMP THIS **ONLY** when merge, inheritance or substitution semantics change:
- *   - the merge engine's later-wins / id-matching behaviour
- *   - the resolver's generation, weight, index or dedupe ordering
- *   - which files are admitted to the variable pool, or how the pool is assembled
- *   - the shape or precedence of `!md[...]` include resolution
- *
- * Do NOT bump it for: report wording, new diagnostics, performance work, refactors that hold the
- * byte-identical baseline, or anything the composed `output.yaml` cannot observe.
- *
- * `scripts/contract-version-guard.mjs` enforces the first list in CI: touch a semantics file
- * without moving this integer and the build fails.
- *
- * History
- *   1 — Phase 1. Established at the end of Epic 1, covering the merge engine, the two-phase
- *       weighted resolver, and the Story 1.8 rule admitting a declared external's variables.yaml
- *       to the pool.
- *   2 — Epic 1 review fixes (2026-08-02). Three changes that a composed output CAN observe:
- *       variable precedence across sibling projects at the same generation no longer depends on
- *       which slot a value came from; `!md[...]` paths are resolved after a partial's
- *       `replacements` rather than before; and include discovery no longer misses a path
- *       containing `]` nor aborts on a reference the resolver would never resolve.
- */
-export declare const COMPOSE_CONTRACT_VERSION = 2;
-/** What a version mismatch means for a caller that found one. */
-export interface ContractComparison {
-    ours: number;
-    /** `undefined` when the workspace declared none — never fabricated from `ours`. */
-    theirs: number | undefined;
-    match: boolean;
-    /** Human-readable, naming BOTH versions — a warning that names only one is unactionable. */
-    message?: string;
-}
-/**
- * Compare the contract version a consumer was built against with the workspace toolchain's.
- *
- * Returns a comparison rather than throwing, because a mismatch must NOT stop anyone working
- * (AC 2). The editor keeps composing; it just says so, and stamps what it produced.
- */
-export declare function compareComposeContract(ours: number, theirs: number | undefined | null): ContractComparison;
-//# sourceMappingURL=contract.d.ts.map

package/dist/contract.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"contract.d.ts","sourceRoot":"","sources":["../src/contract.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8BG;AACH,eAAO,MAAM,wBAAwB,IAAI,CAAC;AAE1C,iEAAiE;AACjE,MAAM,WAAW,kBAAkB;IACjC,IAAI,EAAE,MAAM,CAAC;IACb,mFAAmF;IACnF,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC;IAC3B,KAAK,EAAE,OAAO,CAAC;IACf,4FAA4F;IAC5F,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAED;;;;;GAKG;AACH,wBAAgB,sBAAsB,CACpC,IAAI,EAAE,MAAM,EACZ,MAAM,EAAE,MAAM,GAAG,SAAS,GAAG,IAAI,GAChC,kBAAkB,CAoBpB"}

package/dist/contract.js

@@ -1,60 +0,0 @@
-/**
- * The compose contract version (AD-13, Story 1.10).
- *
- * A single integer, deliberately independent of every package's semver. Semver answers "did the
- * API change?"; this answers a different and more dangerous question — "would the same input
- * compose to a different output?" A patch release that fixes a typo in a report heading changes
- * the version of the package but not the meaning of a composition, and warning about that would
- * train everyone to ignore the warning.
- *
- * BUMP THIS **ONLY** when merge, inheritance or substitution semantics change:
- *   - the merge engine's later-wins / id-matching behaviour
- *   - the resolver's generation, weight, index or dedupe ordering
- *   - which files are admitted to the variable pool, or how the pool is assembled
- *   - the shape or precedence of `!md[...]` include resolution
- *
- * Do NOT bump it for: report wording, new diagnostics, performance work, refactors that hold the
- * byte-identical baseline, or anything the composed `output.yaml` cannot observe.
- *
- * `scripts/contract-version-guard.mjs` enforces the first list in CI: touch a semantics file
- * without moving this integer and the build fails.
- *
- * History
- *   1 — Phase 1. Established at the end of Epic 1, covering the merge engine, the two-phase
- *       weighted resolver, and the Story 1.8 rule admitting a declared external's variables.yaml
- *       to the pool.
- *   2 — Epic 1 review fixes (2026-08-02). Three changes that a composed output CAN observe:
- *       variable precedence across sibling projects at the same generation no longer depends on
- *       which slot a value came from; `!md[...]` paths are resolved after a partial's
- *       `replacements` rather than before; and include discovery no longer misses a path
- *       containing `]` nor aborts on a reference the resolver would never resolve.
- */
-export const COMPOSE_CONTRACT_VERSION = 2;
-/**
- * Compare the contract version a consumer was built against with the workspace toolchain's.
- *
- * Returns a comparison rather than throwing, because a mismatch must NOT stop anyone working
- * (AC 2). The editor keeps composing; it just says so, and stamps what it produced.
- */
-export function compareComposeContract(ours, theirs) {
-    // An unknown version is not a mismatch. An older toolchain that predates the contract cannot
-    // report one, and treating absence as disagreement would warn every user of it, every time.
-    if (theirs === undefined || theirs === null) {
-        // `theirs: undefined`, NOT `theirs: ours` (corrected 2026-08-02). Echoing `ours` back was
-        // convenient for the `match` check and a lie to every caller that reads the field — a
-        // display or an artefact stamp would report a version the workspace never declared.
-        return { ours, theirs: undefined, match: true };
-    }
-    if (ours === theirs)
-        return { ours, theirs, match: true };
-    return {
-        ours,
-        theirs,
-        match: false,
-        message: `Compose contract mismatch: this extension composes under contract v${ours}, but the ` +
-            `workspace toolchain uses v${theirs}. The editor and your CI can therefore disagree ` +
-            `about a composed profile without either being wrong. Align the pinned ` +
-            `@beehexa/* packages with the workspace's toolchain.`,
-    };
-}
-//# sourceMappingURL=contract.js.map

package/dist/contract.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"contract.js","sourceRoot":"","sources":["../src/contract.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8BG;AACH,MAAM,CAAC,MAAM,wBAAwB,GAAG,CAAC,CAAC;AAY1C;;;;;GAKG;AACH,MAAM,UAAU,sBAAsB,CACpC,IAAY,EACZ,MAAiC;IAEjC,6FAA6F;IAC7F,4FAA4F;IAC5F,IAAI,MAAM,KAAK,SAAS,IAAI,MAAM,KAAK,IAAI,EAAE,CAAC;QAC5C,0FAA0F;QAC1F,sFAAsF;QACtF,oFAAoF;QACpF,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,SAAS,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC;IAClD,CAAC;IACD,IAAI,IAAI,KAAK,MAAM;QAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC;IAC1D,OAAO;QACL,IAAI;QACJ,MAAM;QACN,KAAK,EAAE,KAAK;QACZ,OAAO,EACL,sEAAsE,IAAI,YAAY;YACtF,6BAA6B,MAAM,kDAAkD;YACrF,wEAAwE;YACxE,qDAAqD;KACxD,CAAC;AACJ,CAAC"}

package/dist/index.d.ts

@@ -1,25 +0,0 @@
-export { normalizeUri, joinUri, dirnameUri, basenameUri, resolveUri, relativeUri, isAbsoluteUri, isInsideUri, } from './uriPath.js';
-/**
- * A token rename applied to an inherited component (`replacements` on an external).
- *
- * Moved here from `apps/cli/src/helpers/@types` in Story 1.2: it is part of the composer's
- * domain vocabulary, and leaving it in the binary would have made every relocated core module
- * depend on the app — the exact direction AD-3 forbids.
- */
-export interface IExternalReplacement {
-    fromKey: string;
-    toKey: string;
-    value: string | number | null;
-}
-export { COMPOSE_CONTRACT_VERSION, compareComposeContract, type ContractComparison, } from './contract.js';
-export { classifyTemplating, hasComposeTimeTemplating, composeTimeKeys, type TemplatingLayer, type RuntimeReference, type TemplateOccurrence, } from './templating.js';
-/**
- * Which properties name another component (Phase 2 Story 1.2).
- *
- * Lives in `template-model` rather than in the index because reference kinds are domain VOCABULARY,
- * not index machinery: the validation rules need them as much as the graph does, and a registry
- * reachable from only one of the two surfaces is how a rule gets wired into the CLI and forgotten in
- * the editor (FR-54, counter-metric C3). `template-model` is the base package both already depend on.
- */
-export * from './references.js';
-//# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAMA,OAAO,EACL,YAAY,EACZ,OAAO,EACP,UAAU,EACV,WAAW,EACX,UAAU,EACV,WAAW,EACX,aAAa,EACb,WAAW,GACZ,MAAM,cAAc,CAAC;AAEtB;;;;;;GAMG;AACH,MAAM,WAAW,oBAAoB;IACnC,OAAO,EAAE,MAAM,CAAC;IAChB,KAAK,EAAE,MAAM,CAAC;IACd,KAAK,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAAC;CAC/B;AAED,OAAO,EACL,wBAAwB,EACxB,sBAAsB,EACtB,KAAK,kBAAkB,GACxB,MAAM,eAAe,CAAC;AAEvB,OAAO,EACL,kBAAkB,EAClB,wBAAwB,EACxB,eAAe,EACf,KAAK,eAAe,EACpB,KAAK,gBAAgB,EACrB,KAAK,kBAAkB,GACxB,MAAM,iBAAiB,CAAC;AAEzB;;;;;;;GAOG;AACH,cAAc,iBAAiB,CAAC"}

package/dist/index.js

@@ -1,19 +0,0 @@
-// Domain types for HexaSync templates, and the URI path algebra the whole system shares.
-//
-// The algebra lives in core because AD-18 requires ONE canonical identity: if each adapter
-// canonicalized paths its own way, the Node host and the web host could disagree about whether
-// two references point at the same file, and cycle detection and diamond dedupe would silently
-// differ between them.
-export { normalizeUri, joinUri, dirnameUri, basenameUri, resolveUri, relativeUri, isAbsoluteUri, isInsideUri, } from './uriPath.js';
-export { COMPOSE_CONTRACT_VERSION, compareComposeContract, } from './contract.js';
-export { classifyTemplating, hasComposeTimeTemplating, composeTimeKeys, } from './templating.js';
-/**
- * Which properties name another component (Phase 2 Story 1.2).
- *
- * Lives in `template-model` rather than in the index because reference kinds are domain VOCABULARY,
- * not index machinery: the validation rules need them as much as the graph does, and a registry
- * reachable from only one of the two surfaces is how a rule gets wired into the CLI and forgotten in
- * the editor (FR-54, counter-metric C3). `template-model` is the base package both already depend on.
- */
-export * from './references.js';
-//# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,yFAAyF;AACzF,EAAE;AACF,2FAA2F;AAC3F,+FAA+F;AAC/F,+FAA+F;AAC/F,uBAAuB;AACvB,OAAO,EACL,YAAY,EACZ,OAAO,EACP,UAAU,EACV,WAAW,EACX,UAAU,EACV,WAAW,EACX,aAAa,EACb,WAAW,GACZ,MAAM,cAAc,CAAC;AAetB,OAAO,EACL,wBAAwB,EACxB,sBAAsB,GAEvB,MAAM,eAAe,CAAC;AAEvB,OAAO,EACL,kBAAkB,EAClB,wBAAwB,EACxB,eAAe,GAIhB,MAAM,iBAAiB,CAAC;AAEzB;;;;;;;GAOG;AACH,cAAc,iBAAiB,CAAC"}

package/dist/references.d.ts

@@ -1,150 +0,0 @@
-/**
- * Which properties name another component — measured, not assumed (Stories 3.4 and 3.7).
- *
- * This list was originally guessed from what the collections are called, and the guess was wrong
- * in both directions. It is now derived from the corpus: every `*Id` / `*Ids` property in nine
- * real projects was resolved against the effective graph and kept only if its values are actually
- * component ids. The measured figures are recorded here because a list like this decays silently
- * — a property added next year will not announce itself — and the next person needs to know how
- * to re-derive it rather than how to guess again.
- *
- * Resolution rates, measured over real projects (hits / occurrences):
- *
- *   taskId            651/651  100%      metricId           0/651   0%
- *   connectorId       413/413  100%      providerId          0/27   0%
- *   connectionId      284/284  100%      columnIds           0/11   0%
- *   entityId          115/115  100%      credentialId         0/5   0%
- *   objectIds          90/90   100%      profileId            0/5   0%
- *   targetId           59/59   100%      systemId             0/4   0%
- *   fromConnectionId   54/54   100%      integrationAppId     0/4   0%
- *   objectId           50/50   100%      itemIds              0/3   0%
- *   object_id          13/13   100%
- *   pusherId            5/5    100%
- *   tableId             4/4    100%
- *   pullerId            2/2    100%
- *
- * Two findings worth stating plainly, because both contradict what was written down before:
- *
- *  1. **`taskId` is real, and is the most-used reference property in the corpus.** Story 3.7's AC
- *     calls it "the ideation document's illustrative `taskId`, which does not exist" — that is
- *     false. It appears 291 times in authored partials and resolves 651/651. The AC's underlying
- *     instruction — key these to REAL property names — is right, and following it is what turned
- *     up the error in its own example.
- *  2. **`validationId`, `transformationId`, `pullerIds` and `pusherIds` were invented** from the
- *     collection names and have zero authored occurrences. Removed. `pullerId` was on the same
- *     guessed list but turned out to be real (2/2), so it is kept — on the measurement, not on
- *     the fact that a `pullers` collection exists.
- *
- * The values are often COMPOSE-TIME TOKENS — `taskId: "**Sapo_Orders_Task_Id**"` — and they
- * resolve because the graph keys components in token form (Story 3.1). Keying on substituted
- * values would have made every one of these references dangle.
- */
-export declare const isTokenForm: (value: string) => boolean;
-/**
- * A target collection chosen by a sibling property's value.
- *
- * `entityId` means a Task under `entityType: TASK` and something outside the template under
- * `PROFILE`. The discriminator is read from the value's own containing map, so it is available
- * wherever the reference is — the relation walk holds the node, and the cursor holds the parent.
- */
-export interface ReferenceDiscriminator {
-    /** Sibling properties consulted in order; the first one present decides. */
-    readonly siblings: readonly string[];
-    /** Sibling value → target collection. `undefined` means "not a reference to a component". */
-    readonly byValue: ReadonlyMap<string, string | undefined>;
-    /** The collection when no discriminating sibling is present. */
-    readonly fallback?: string;
-}
-/** A property that names another component, and the collection it points into when that is fixed. */
-export interface ReferenceProperty {
-    readonly property: string;
-    /** The collection the target lives in, when the property only ever points at one. */
-    readonly collection?: string;
-    /** The collection when it is decided by a sibling rather than by the property name. */
-    readonly discriminator?: ReferenceDiscriminator;
-    /**
-     * Resolve only when the value is `**Token**` form.
-     *
-     * Set where the same property also legitimately holds a runtime UUID, so that a UUID reads as
-     * "not a component reference" instead of "a reference that is broken".
-     */
-    readonly tokenFormOnly?: boolean;
-}
-export declare const REFERENCE_PROPERTY_LIST: readonly ReferenceProperty[];
-/** What a property means at one position: whether it references, and what it points into. */
-export interface ReferenceKind {
-    /** The collection the target lives in, when it is known. */
-    readonly collection?: string;
-    /** The property name to report, which for a nested block is `table.id` rather than `id`. */
-    readonly property: string;
-}
-/**
- * Resolve what a reference property means beside its siblings.
- *
- * Returns `undefined` when this property/value/context is NOT a component reference — a raw UUID
- * in `entityId`, or `entityType: SELF`. That is a distinct answer from "a reference that does not
- * resolve", and collapsing the two is what puts diagnostics on correct files.
- */
-export declare function resolveReferenceKind(property: string, value: string, siblings?: Record<string, unknown>): ReferenceKind | undefined;
-/** Fast membership test for the walk in `queries.ts`. */
-export declare const REFERENCE_PROPERTIES: readonly string[];
-export declare const referencePropertyFor: (property: string) => ReferenceProperty | undefined;
-/**
- * `*Id` properties MEASURED at 0% resolution — not references, recorded so their absence reads
- * as a decision rather than an oversight.
- *
- * They hold runtime UUIDs, environment tokens or payload field names. Without this list the next
- * reader sees `metricId` missing from the set above and adds it, and every metric configuration
- * in the corpus grows a dangling-reference diagnostic.
- *
- * Every entry here has a row in the table above. `templateId` and `reportId` were previously
- * listed and have been REMOVED: they never occurred in the sampled projects at all, so "resolved
- * 0%" was never true of them — no-occurrences is not the same measurement as never-resolves, and
- * a list whose stated basis is measurement must not carry entries that were only assumed. They
- * do appear elsewhere in the corpus (`reportId` ~91 authored occurrences), so they are left
- * deliberately unclassified until someone measures them.
- */
-export declare const NON_REFERENCE_ID_PROPERTIES: readonly string[];
-/**
- * Blocks whose `id` names a component — the corpus's DOMINANT reference form.
- *
- * `objectAssociations` wires a Task to its entities like this:
- *
- *     objectAssociations:
- *       "**Orders_Task_Id**":
- *         table:  { id: "**Orders_Table_Id**" }
- *         puller: { id: "**Orders_Puller_Id**", resultKey: rows }
- *
- * Counted across the corpus's AUTHORED partials (`output.yaml` and `__configs` excluded):
- *
- *   nested `table:`  1,575      flat `tableId:`   308
- *   nested `puller:` 1,695      flat `pullerId:`   38
- *   nested `pusher:`   912      flat `pusherId:`   48
- *                    -----                        ---
- *                    4,182                        394
- *
- * The nested form outnumbers the flat one by roughly 10:1 — it is how the corpus wires a Task to
- * its entities, and a registry built only on flat property names saw NONE of it. The flat form is
- * a real minority, not noise, so both are supported.
- *
- * (An earlier draft of this comment said "4 / 2 / 5" and "three orders of magnitude". Those were
- * the nine-project RESOLUTION sample from the table above, quoted under a corpus-wide heading —
- * a different measurement of a different population. Corrected 2026-08-02.)
- *
- * The block carries more than the id (`resultKey`, for one), so the reference is the block's
- * `id` specifically, reported as `table.id` rather than as `table`.
- */
-export declare const NESTED_REFERENCE_BLOCKS: readonly ReferenceProperty[];
-export declare const nestedReferenceBlockFor: (property: string) => ReferenceProperty | undefined;
-/**
- * Collections whose component KEY is itself a reference into another collection.
- *
- * An `objectAssociations` entry is keyed BY the objectId it describes — that is what makes it
- * that object's association rather than a component that merely shares its name. Modelling it
- * matters twice: `getRelatedTask` can answer for an association, and renaming a Task has to
- * carry the association key with it, which only shows up in a blast radius if the key is an edge.
- */
-export declare const COLLECTIONS_KEYED_BY_REFERENCE: ReadonlyMap<string, string>;
-/** The property name reported for a reference carried by a component's own key. */
-export declare const KEY_REFERENCE_PROPERTY = "(key)";
-//# sourceMappingURL=references.d.ts.map

package/dist/references.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"references.d.ts","sourceRoot":"","sources":["../src/references.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAwCG;AAwCH,eAAO,MAAM,WAAW,GAAI,OAAO,MAAM,KAAG,OAAiC,CAAC;AAE9E;;;;;;GAMG;AACH,MAAM,WAAW,sBAAsB;IACrC,4EAA4E;IAC5E,QAAQ,CAAC,QAAQ,EAAE,SAAS,MAAM,EAAE,CAAC;IACrC,6FAA6F;IAC7F,QAAQ,CAAC,OAAO,EAAE,WAAW,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC,CAAC;IAC1D,gEAAgE;IAChE,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;CAC5B;AAED,qGAAqG;AACrG,MAAM,WAAW,iBAAiB;IAChC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,qFAAqF;IACrF,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC;IAC7B,uFAAuF;IACvF,QAAQ,CAAC,aAAa,CAAC,EAAE,sBAAsB,CAAC;IAChD;;;;;OAKG;IACH,QAAQ,CAAC,aAAa,CAAC,EAAE,OAAO,CAAC;CAClC;AAmBD,eAAO,MAAM,uBAAuB,EAAE,SAAS,iBAAiB,EA+C/D,CAAC;AAEF,6FAA6F;AAC7F,MAAM,WAAW,aAAa;IAC5B,4DAA4D;IAC5D,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC;IAC7B,4FAA4F;IAC5F,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;CAC3B;AAED;;;;;;GAMG;AACH,wBAAgB,oBAAoB,CAClC,QAAQ,EAAE,MAAM,EAChB,KAAK,EAAE,MAAM,EACb,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GACjC,aAAa,GAAG,SAAS,CA4B3B;AAED,yDAAyD;AACzD,eAAO,MAAM,oBAAoB,EAAE,SAAS,MAAM,EACF,CAAC;AAIjD,eAAO,MAAM,oBAAoB,GAC/B,UAAU,MAAM,KACf,iBAAiB,GAAG,SAAkC,CAAC;AAE1D;;;;;;;;;;;;;;GAcG;AACH,eAAO,MAAM,2BAA2B,EAAE,SAAS,MAAM,EASxD,CAAC;AAEF;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AACH,eAAO,MAAM,uBAAuB,EAAE,SAAS,iBAAiB,EAI/D,CAAC;AAMF,eAAO,MAAM,uBAAuB,GAClC,UAAU,MAAM,KACf,iBAAiB,GAAG,SAAyC,CAAC;AAEjE;;;;;;;GAOG;AACH,eAAO,MAAM,8BAA8B,EAAE,WAAW,CAAC,MAAM,EAAE,MAAM,CAyBnE,CAAC;AAEL,mFAAmF;AACnF,eAAO,MAAM,sBAAsB,UAAU,CAAC"}

package/dist/references.js

@@ -1,281 +0,0 @@
-/**
- * Which properties name another component — measured, not assumed (Stories 3.4 and 3.7).
- *
- * This list was originally guessed from what the collections are called, and the guess was wrong
- * in both directions. It is now derived from the corpus: every `*Id` / `*Ids` property in nine
- * real projects was resolved against the effective graph and kept only if its values are actually
- * component ids. The measured figures are recorded here because a list like this decays silently
- * — a property added next year will not announce itself — and the next person needs to know how
- * to re-derive it rather than how to guess again.
- *
- * Resolution rates, measured over real projects (hits / occurrences):
- *
- *   taskId            651/651  100%      metricId           0/651   0%
- *   connectorId       413/413  100%      providerId          0/27   0%
- *   connectionId      284/284  100%      columnIds           0/11   0%
- *   entityId          115/115  100%      credentialId         0/5   0%
- *   objectIds          90/90   100%      profileId            0/5   0%
- *   targetId           59/59   100%      systemId             0/4   0%
- *   fromConnectionId   54/54   100%      integrationAppId     0/4   0%
- *   objectId           50/50   100%      itemIds              0/3   0%
- *   object_id          13/13   100%
- *   pusherId            5/5    100%
- *   tableId             4/4    100%
- *   pullerId            2/2    100%
- *
- * Two findings worth stating plainly, because both contradict what was written down before:
- *
- *  1. **`taskId` is real, and is the most-used reference property in the corpus.** Story 3.7's AC
- *     calls it "the ideation document's illustrative `taskId`, which does not exist" — that is
- *     false. It appears 291 times in authored partials and resolves 651/651. The AC's underlying
- *     instruction — key these to REAL property names — is right, and following it is what turned
- *     up the error in its own example.
- *  2. **`validationId`, `transformationId`, `pullerIds` and `pusherIds` were invented** from the
- *     collection names and have zero authored occurrences. Removed. `pullerId` was on the same
- *     guessed list but turned out to be real (2/2), so it is kept — on the measurement, not on
- *     the fact that a `pullers` collection exists.
- *
- * The values are often COMPOSE-TIME TOKENS — `taskId: "**Sapo_Orders_Task_Id**"` — and they
- * resolve because the graph keys components in token form (Story 3.1). Keying on substituted
- * values would have made every one of these references dangle.
- */
-/**
- * CORRECTED 2026-08-02, and the correction is about METHOD, not about three names.
- *
- * The resolution rates in the table above were measured by asking *"is this value some
- * component's id?"* — never *"does it point into the collection we claim?"*. Three consequences,
- * each of which shipped:
- *
- *  1. **`connectionId` and `fromConnectionId` pointed at `connections`, a collection that does
- *     not exist.** Corpus-wide: **0** authored files declare `connections:`, **281** declare
- *     `connectors:`, and its ids are exactly the `**…ConnectionId**` tokens these properties
- *     hold. `connectionId`, `fromConnectionId` and `connectorId` are three spellings of one
- *     target: `connectors[*].id`. A method that only checked "is an id" scored the wrong
- *     collection at 100%.
- *  2. **`entityId` and `targetId` have no fixed collection — it comes from a SIBLING.** Measured
- *     `entityType`: `SELF` 261 · `TASK` 118 · `PROFILE` 9. Measured `targetType`: `PULLER` 144 ·
- *     `SCHEDULER` 105 · `REPORT` 44 · `SCHEMA` 43. `entityType: SELF` means "this task" and
- *     carries no `entityId` at all. Absent, the type defaults to Task. A single `collection` field
- *     cannot express this, which is why both were left collection-less — and a collection-less
- *     entry matched a component in ANY collection and reported it resolved.
- *  3. **They resolve only in `**Token**` form.** Authored value shapes: `entityId` 175 token /
- *     1 raw UUID, `targetId` 151 / 0. The rule is not about volume — it is that the graph keys
- *     components in TOKEN form (FR-45), so a raw UUID cannot match a component however it is
- *     spelled. Reporting it as an unresolved reference would be noise; declining says the true
- *     thing, and is a different answer from "a reference that does not resolve".
- *
- *     CORRECTED 2026-08-03. This first read "178 token-form vs 268 raw UUID … 437 legitimate
- *     authored values" — measured over a population that included GENERATED `output.yaml`, where
- *     compose has already substituted each token for the real id. The index never reads those
- *     files, so those values were never at risk. The mistake is the same one this whole note is
- *     about: a count that did not say precisely enough what it was counting.
- *
- * The lesson generalises: a reference is a property, a target collection AND a value shape. Any
- * future re-derivation must assert all three, or it will score a wrong answer at 100% again.
- */
-/** Values that are `**Token**` form — the only shape a conditional reference resolves in. */
-const TOKEN_FORM = /^\*\*[^*]+\*\*$/;
-export const isTokenForm = (value) => TOKEN_FORM.test(value);
-/** `entityType` → the collection an `entityId` beside it points into. */
-const ENTITY_TYPE_TARGETS = new Map([
-    ['TASK', 'objects'],
-    // "this task" — the entity IS the enclosing one, so there is no id to resolve.
-    ['SELF', undefined],
-    // A profile is not a template collection; the id is resolved outside the project.
-    ['PROFILE', undefined],
-]);
-/** `targetType` → the collection a `targetId` beside it points into. */
-const TARGET_TYPE_TARGETS = new Map([
-    ['PULLER', 'pullers'],
-    ['REPORT', 'reports'],
-    ['SCHEMA', 'schemas'],
-    ['SCHEDULER', 'startupTasks'],
-]);
-export const REFERENCE_PROPERTY_LIST = [
-    { property: 'taskId', collection: 'objects' },
-    { property: 'objectId', collection: 'objects' },
-    { property: 'object_id', collection: 'objects' },
-    { property: 'objectIds', collection: 'objects' },
-    { property: 'pusherId', collection: 'pushers' },
-    { property: 'pullerId', collection: 'pullers' },
-    { property: 'tableId', collection: 'tables' },
-    /**
-     * ADDED 2026-08-05, on measurement. A dependency names the Task it waits on with `dependedOn`.
-     *
-     * It was missing, and the omission was invisible because nothing asked for it: **910 authored
-     * occurrences across 665 files**, of which **271 of 272 (99.6%) resolve to a Task** when measured
-     * against composed graphs for all 33 buildable corpus projects. That is the same standard
-     * `NON_REFERENCE_ID_PROPERTIES` below applies in the other direction — a property measured at 0%
-     * resolution is not a reference, and one measured at 99.6% plainly is.
-     *
-     * The single miss is a REAL broken reference, in `001-projects/elly`: a `dependedOn` naming
-     * `**SapoProductPuller**`, a token that resolves to nothing and, by its name, aims at a puller
-     * where a Task belongs. Until now no validation, Find References or impact query could see it,
-     * because this row did not exist.
-     */
-    { property: 'dependedOn', collection: 'objects' },
-    // One target, three spellings. See the CORRECTED note above.
-    { property: 'connectionId', collection: 'connectors' },
-    { property: 'fromConnectionId', collection: 'connectors' },
-    { property: 'connectorId', collection: 'connectors' },
-    {
-        property: 'entityId',
-        tokenFormOnly: true,
-        discriminator: {
-            siblings: ['entityType'],
-            byValue: ENTITY_TYPE_TARGETS,
-            fallback: 'objects',
-        },
-    },
-    {
-        property: 'targetId',
-        tokenFormOnly: true,
-        discriminator: {
-            // `targetType` decides; `entityType` is the fallback discriminator where the block carries
-            // one instead, and a Task is the default when neither is written.
-            siblings: ['targetType', 'entityType'],
-            byValue: new Map([...TARGET_TYPE_TARGETS, ...ENTITY_TYPE_TARGETS]),
-            fallback: 'objects',
-        },
-    },
-];
-/**
- * Resolve what a reference property means beside its siblings.
- *
- * Returns `undefined` when this property/value/context is NOT a component reference — a raw UUID
- * in `entityId`, or `entityType: SELF`. That is a distinct answer from "a reference that does not
- * resolve", and collapsing the two is what puts diagnostics on correct files.
- */
-export function resolveReferenceKind(property, value, siblings) {
-    const entry = BY_NAME.get(property);
-    if (!entry)
-        return undefined;
-    if (entry.tokenFormOnly && !isTokenForm(value))
-        return undefined;
-    if (!entry.discriminator) {
-        return {
-            property,
-            ...(entry.collection ? { collection: entry.collection } : {}),
-        };
-    }
-    const { siblings: names, byValue, fallback } = entry.discriminator;
-    for (const name of names) {
-        const raw = siblings?.[name];
-        if (raw === undefined || raw === null)
-            continue;
-        const key = String(raw);
-        // `has` rather than `get`, because a MAPPED `undefined` ("`SELF` references nothing") and an
-        // UNMAPPED value ("a type nobody has measured yet") are different answers that both come back
-        // as `undefined` from `get`. Claiming a collection for an unknown type is how this registry
-        // was wrong the first time.
-        if (!byValue.has(key))
-            return undefined;
-        const collection = byValue.get(key);
-        // Present, measured, and not a component reference — `entityType: SELF`, `PROFILE`.
-        if (collection === undefined)
-            return undefined;
-        return { property, collection };
-    }
-    return { property, ...(fallback ? { collection: fallback } : {}) };
-}
-/** Fast membership test for the walk in `queries.ts`. */
-export const REFERENCE_PROPERTIES = REFERENCE_PROPERTY_LIST.map((r) => r.property);
-const BY_NAME = new Map(REFERENCE_PROPERTY_LIST.map((r) => [r.property, r]));
-export const referencePropertyFor = (property) => BY_NAME.get(property);
-/**
- * `*Id` properties MEASURED at 0% resolution — not references, recorded so their absence reads
- * as a decision rather than an oversight.
- *
- * They hold runtime UUIDs, environment tokens or payload field names. Without this list the next
- * reader sees `metricId` missing from the set above and adds it, and every metric configuration
- * in the corpus grows a dangling-reference diagnostic.
- *
- * Every entry here has a row in the table above. `templateId` and `reportId` were previously
- * listed and have been REMOVED: they never occurred in the sampled projects at all, so "resolved
- * 0%" was never true of them — no-occurrences is not the same measurement as never-resolves, and
- * a list whose stated basis is measurement must not carry entries that were only assumed. They
- * do appear elsewhere in the corpus (`reportId` ~91 authored occurrences), so they are left
- * deliberately unclassified until someone measures them.
- */
-export const NON_REFERENCE_ID_PROPERTIES = [
-    'metricId',
-    'providerId',
-    'columnIds',
-    'systemId',
-    'integrationAppId',
-    'credentialId',
-    'profileId',
-    'itemIds',
-];
-/**
- * Blocks whose `id` names a component — the corpus's DOMINANT reference form.
- *
- * `objectAssociations` wires a Task to its entities like this:
- *
- *     objectAssociations:
- *       "**Orders_Task_Id**":
- *         table:  { id: "**Orders_Table_Id**" }
- *         puller: { id: "**Orders_Puller_Id**", resultKey: rows }
- *
- * Counted across the corpus's AUTHORED partials (`output.yaml` and `__configs` excluded):
- *
- *   nested `table:`  1,575      flat `tableId:`   308
- *   nested `puller:` 1,695      flat `pullerId:`   38
- *   nested `pusher:`   912      flat `pusherId:`   48
- *                    -----                        ---
- *                    4,182                        394
- *
- * The nested form outnumbers the flat one by roughly 10:1 — it is how the corpus wires a Task to
- * its entities, and a registry built only on flat property names saw NONE of it. The flat form is
- * a real minority, not noise, so both are supported.
- *
- * (An earlier draft of this comment said "4 / 2 / 5" and "three orders of magnitude". Those were
- * the nine-project RESOLUTION sample from the table above, quoted under a corpus-wide heading —
- * a different measurement of a different population. Corrected 2026-08-02.)
- *
- * The block carries more than the id (`resultKey`, for one), so the reference is the block's
- * `id` specifically, reported as `table.id` rather than as `table`.
- */
-export const NESTED_REFERENCE_BLOCKS = [
-    { property: 'table', collection: 'tables' },
-    { property: 'puller', collection: 'pullers' },
-    { property: 'pusher', collection: 'pushers' },
-];
-const NESTED_BY_NAME = new Map(NESTED_REFERENCE_BLOCKS.map((r) => [r.property, r]));
-export const nestedReferenceBlockFor = (property) => NESTED_BY_NAME.get(property);
-/**
- * Collections whose component KEY is itself a reference into another collection.
- *
- * An `objectAssociations` entry is keyed BY the objectId it describes — that is what makes it
- * that object's association rather than a component that merely shares its name. Modelling it
- * matters twice: `getRelatedTask` can answer for an association, and renaming a Task has to
- * carry the association key with it, which only shows up in a blast radius if the key is an edge.
- */
-export const COLLECTIONS_KEYED_BY_REFERENCE = new Map([
-    ['objectAssociations', 'objects'],
-    /**
-     * ADDED 2026-08-06, on a reported bug: a Task's transformations and validations were invisible.
-     *
-     * Both are keyed by the Task they belong to, exactly as an association is — the key IS the objectId, and
-     * the value is that Task's list:
-     *
-     *     transformations:
-     *       "**MisaAmisSapoWeb__Inventories_Task_Id**":
-     *         - id: "**…_GetProductVariant_Transformation_Id**"
-     *           type: SQL
-     *
-     * Without the key modelled as a reference there is no edge between the two, so nothing could answer
-     * "which transformations does this Task have". Probed on `001-projects/catafa/sapo-misa`: the graph held
-     * 2 transformation and 5 validation components, and the Task's incoming relations were the association
-     * alone. The components were there; the edge was not.
-     *
-     * It matters twice, as the association's entry says: a query can answer for a Task, and renaming a Task
-     * carries its transformations and validations with it — which only shows up in a blast radius if the key
-     * is an edge.
-     */
-    ['transformations', 'objects'],
-    ['validations', 'objects'],
-]);
-/** The property name reported for a reference carried by a component's own key. */
-export const KEY_REFERENCE_PROPERTY = '(key)';
-//# sourceMappingURL=references.js.map

package/dist/references.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"references.js","sourceRoot":"","sources":["../src/references.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAwCG;AAEH;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiCG;AAEH,6FAA6F;AAC7F,MAAM,UAAU,GAAG,iBAAiB,CAAC;AAErC,MAAM,CAAC,MAAM,WAAW,GAAG,CAAC,KAAa,EAAW,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;AAkC9E,yEAAyE;AACzE,MAAM,mBAAmB,GAAG,IAAI,GAAG,CAA6B;IAC9D,CAAC,MAAM,EAAE,SAAS,CAAC;IACnB,+EAA+E;IAC/E,CAAC,MAAM,EAAE,SAAS,CAAC;IACnB,kFAAkF;IAClF,CAAC,SAAS,EAAE,SAAS,CAAC;CACvB,CAAC,CAAC;AAEH,wEAAwE;AACxE,MAAM,mBAAmB,GAAG,IAAI,GAAG,CAA6B;IAC9D,CAAC,QAAQ,EAAE,SAAS,CAAC;IACrB,CAAC,QAAQ,EAAE,SAAS,CAAC;IACrB,CAAC,QAAQ,EAAE,SAAS,CAAC;IACrB,CAAC,WAAW,EAAE,cAAc,CAAC;CAC9B,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,uBAAuB,GAAiC;IACnE,EAAE,QAAQ,EAAE,QAAQ,EAAE,UAAU,EAAE,SAAS,EAAE;IAC7C,EAAE,QAAQ,EAAE,UAAU,EAAE,UAAU,EAAE,SAAS,EAAE;IAC/C,EAAE,QAAQ,EAAE,WAAW,EAAE,UAAU,EAAE,SAAS,EAAE;IAChD,EAAE,QAAQ,EAAE,WAAW,EAAE,UAAU,EAAE,SAAS,EAAE;IAChD,EAAE,QAAQ,EAAE,UAAU,EAAE,UAAU,EAAE,SAAS,EAAE;IAC/C,EAAE,QAAQ,EAAE,UAAU,EAAE,UAAU,EAAE,SAAS,EAAE;IAC/C,EAAE,QAAQ,EAAE,SAAS,EAAE,UAAU,EAAE,QAAQ,EAAE;IAC7C;;;;;;;;;;;;;OAaG;IACH,EAAE,QAAQ,EAAE,YAAY,EAAE,UAAU,EAAE,SAAS,EAAE;IACjD,6DAA6D;IAC7D,EAAE,QAAQ,EAAE,cAAc,EAAE,UAAU,EAAE,YAAY,EAAE;IACtD,EAAE,QAAQ,EAAE,kBAAkB,EAAE,UAAU,EAAE,YAAY,EAAE;IAC1D,EAAE,QAAQ,EAAE,aAAa,EAAE,UAAU,EAAE,YAAY,EAAE;IACrD;QACE,QAAQ,EAAE,UAAU;QACpB,aAAa,EAAE,IAAI;QACnB,aAAa,EAAE;YACb,QAAQ,EAAE,CAAC,YAAY,CAAC;YACxB,OAAO,EAAE,mBAAmB;YAC5B,QAAQ,EAAE,SAAS;SACpB;KACF;IACD;QACE,QAAQ,EAAE,UAAU;QACpB,aAAa,EAAE,IAAI;QACnB,aAAa,EAAE;YACb,2FAA2F;YAC3F,kEAAkE;YAClE,QAAQ,EAAE,CAAC,YAAY,EAAE,YAAY,CAAC;YACtC,OAAO,EAAE,IAAI,GAAG,CAAC,CAAC,GAAG,mBAAmB,EAAE,GAAG,mBAAmB,CAAC,CAAC;YAClE,QAAQ,EAAE,SAAS;SACpB;KACF;CACF,CAAC;AAUF;;;;;;GAMG;AACH,MAAM,UAAU,oBAAoB,CAClC,QAAgB,EAChB,KAAa,EACb,QAAkC;IAElC,MAAM,KAAK,GAAG,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;IACpC,IAAI,CAAC,KAAK;QAAE,OAAO,SAAS,CAAC;IAC7B,IAAI,KAAK,CAAC,aAAa,IAAI,CAAC,WAAW,CAAC,KAAK,CAAC;QAAE,OAAO,SAAS,CAAC;IAEjE,IAAI,CAAC,KAAK,CAAC,aAAa,EAAE,CAAC;QACzB,OAAO;YACL,QAAQ;YACR,GAAG,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,KAAK,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAC9D,CAAC;IACJ,CAAC;IAED,MAAM,EAAE,QAAQ,EAAE,KAAK,EAAE,OAAO,EAAE,QAAQ,EAAE,GAAG,KAAK,CAAC,aAAa,CAAC;IACnE,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,MAAM,GAAG,GAAG,QAAQ,EAAE,CAAC,IAAI,CAAC,CAAC;QAC7B,IAAI,GAAG,KAAK,SAAS,IAAI,GAAG,KAAK,IAAI;YAAE,SAAS;QAChD,MAAM,GAAG,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC;QACxB,6FAA6F;QAC7F,8FAA8F;QAC9F,4FAA4F;QAC5F,4BAA4B;QAC5B,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC;YAAE,OAAO,SAAS,CAAC;QACxC,MAAM,UAAU,GAAG,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QACpC,oFAAoF;QACpF,IAAI,UAAU,KAAK,SAAS;YAAE,OAAO,SAAS,CAAC;QAC/C,OAAO,EAAE,QAAQ,EAAE,UAAU,EAAE,CAAC;IAClC,CAAC;IACD,OAAO,EAAE,QAAQ,EAAE,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC;AACrE,CAAC;AAED,yDAAyD;AACzD,MAAM,CAAC,MAAM,oBAAoB,GAC/B,uBAAuB,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC;AAEjD,MAAM,OAAO,GAAG,IAAI,GAAG,CAAC,uBAAuB,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;AAE7E,MAAM,CAAC,MAAM,oBAAoB,GAAG,CAClC,QAAgB,EACe,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;AAE1D;;;;;;;;;;;;;;GAcG;AACH,MAAM,CAAC,MAAM,2BAA2B,GAAsB;IAC5D,UAAU;IACV,YAAY;IACZ,WAAW;IACX,UAAU;IACV,kBAAkB;IAClB,cAAc;IACd,WAAW;IACX,SAAS;CACV,CAAC;AAEF;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AACH,MAAM,CAAC,MAAM,uBAAuB,GAAiC;IACnE,EAAE,QAAQ,EAAE,OAAO,EAAE,UAAU,EAAE,QAAQ,EAAE;IAC3C,EAAE,QAAQ,EAAE,QAAQ,EAAE,UAAU,EAAE,SAAS,EAAE;IAC7C,EAAE,QAAQ,EAAE,QAAQ,EAAE,UAAU,EAAE,SAAS,EAAE;CAC9C,CAAC;AAEF,MAAM,cAAc,GAAG,IAAI,GAAG,CAC5B,uBAAuB,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,CACpD,CAAC;AAEF,MAAM,CAAC,MAAM,uBAAuB,GAAG,CACrC,QAAgB,EACe,EAAE,CAAC,cAAc,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;AAEjE;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,8BAA8B,GACzC,IAAI,GAAG,CAAC;IACN,CAAC,oBAAoB,EAAE,SAAS,CAAC;IACjC;;;;;;;;;;;;;;;;;;;OAmBG;IACH,CAAC,iBAAiB,EAAE,SAAS,CAAC;IAC9B,CAAC,aAAa,EAAE,SAAS,CAAC;CAC3B,CAAC,CAAC;AAEL,mFAAmF;AACnF,MAAM,CAAC,MAAM,sBAAsB,GAAG,OAAO,CAAC"}

package/dist/templating.d.ts

@@ -1,88 +0,0 @@
-/**
- * The two templating layers, told apart (FR-50, Phase 1 Story 3.8).
- *
- * A value can carry substitution that happens when you BUILD and substitution that happens when
- * it RUNS, and the difference decides who finds out about a mistake:
- *
- *   `**VariableKey**`   COMPOSE-TIME. The composer substitutes it from the project's variable
- *                       pool. A missing one is caught at compose, by the person composing.
- *   `{{ … }}`           RUNTIME. The worker evaluates it (Scriban) against live data. A missing
- *                       one is caught in production, by whoever is on call.
- *
- * Conflating them is how a `{{env.__HSS_X}}` gets reported as an unresolved compose-time
- * variable — noise on something that is working exactly as designed — and, worse, how a genuinely
- * missing environment key gets the same severity as a typo'd variable name.
- *
- * ALL `{{ … }}` IS SCRIBAN — including inside a JSONata expression. A JSONata value may embed
- * Scriban so the JSONata itself can be built dynamically, and the worker evaluates Scriban FIRST,
- * then treats the result as JSONata. So there is no nested-language boundary to reason about
- * here: a `{{ … }}` occurrence is runtime Scriban wherever it appears, and the surrounding
- * expression language does not change that.
- *
- * RUNTIME IS SCRIBAN, NOT JUST `env`. The corpus holds ~30,000 `{{ … }}` occurrences: control
- * flow (`{{end}}`), pipes (`{{ '' | uuid }}`), runtime data (`{{puller.before.X}}`) and 377
- * distinct `env.__HSS_*` keys. The AC names the `env` case because that is the one with an
- * external dependency, so it is classified separately rather than being the whole definition of
- * "runtime" — a narrower model would have mislabelled the other 29,000.
- */
-/** When the substitution happens, and therefore who discovers a mistake. */
-export type TemplatingLayer = 'compose-time' | 'runtime';
-/**
- * What a runtime expression reaches for.
- *
- * `environment` is singled out because it depends on something outside the template entirely —
- * a key that must exist in the deployment — so a later diagnostic can treat it differently from
- * an expression over data the worker already holds.
- */
-export type RuntimeReference = 'environment' | 'expression';
-export interface TemplateOccurrence {
-    readonly layer: TemplatingLayer;
-    /** Only meaningful for `runtime`. */
-    readonly runtimeReference?: RuntimeReference;
-    /** The full matched text, e.g. `**Foo**` or `{{ env.__HSS_X }}`. */
-    readonly raw: string;
-    /**
-     * What the occurrence names: the variable key for compose-time, the environment key for a
-     * runtime `env` reference, and the trimmed expression otherwise.
-     */
-    readonly key: string;
-    /**
-     * Every environment key this occurrence reads, for a `runtime` occurrence that reads any.
-     *
-     * `key` carries only the FIRST, because it is one string. `{{ env.A + env.B }}` is one expression
-     * reading two keys, and the whole reason `environment` is a distinct `runtimeReference` is so a
-     * later rule can ask "does this deployment define them" — which it cannot do for `env.B` if only
-     * `env.A` was ever recorded.
-     */
-    readonly environmentKeys?: readonly string[];
-    /**
-     * Offsets into the VALUE as parsed, not into the source text.
-     *
-     * Named precisely because the difference bites: a caller receives `scalar.value`, which for a
-     * quoted scalar has had escapes expanded and for a block scalar has been folded and dedented, so
-     * these offsets are not source positions and cannot be turned into one without the scalar's own
-     * range. An earlier comment promised "so a caller can map back to a source range", which is not
-     * something these offsets alone can do.
-     */
-    readonly start: number;
-    readonly end: number;
-}
-/**
- * Every templating occurrence in a value, each classified independently.
- *
- * Independently matters: one value can mix layers — a URL built from a compose-time variable
- * followed by a runtime expression is both — and a classifier returning a single verdict per
- * value would have to be wrong about one of them.
- */
-export declare function classifyTemplating(value: string): TemplateOccurrence[];
-/** Does this value carry any compose-time substitution? */
-export declare function hasComposeTimeTemplating(value: string): boolean;
-/**
- * Compose-time keys in a value — what a resolver needs.
- *
- * Runtime occurrences are deliberately absent: asking the variable pool about `{{ item.id }}`
- * would always fail, and reporting that failure would be reporting on something the composer
- * was never responsible for.
- */
-export declare function composeTimeKeys(value: string): string[];
-//# sourceMappingURL=templating.d.ts.map

package/dist/templating.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"templating.d.ts","sourceRoot":"","sources":["../src/templating.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AAEH,4EAA4E;AAC5E,MAAM,MAAM,eAAe,GAAG,cAAc,GAAG,SAAS,CAAC;AAEzD;;;;;;GAMG;AACH,MAAM,MAAM,gBAAgB,GAAG,aAAa,GAAG,YAAY,CAAC;AAE5D,MAAM,WAAW,kBAAkB;IACjC,QAAQ,CAAC,KAAK,EAAE,eAAe,CAAC;IAChC,qCAAqC;IACrC,QAAQ,CAAC,gBAAgB,CAAC,EAAE,gBAAgB,CAAC;IAC7C,oEAAoE;IACpE,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB;;;OAGG;IACH,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB;;;;;;;OAOG;IACH,QAAQ,CAAC,eAAe,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAC7C;;;;;;;;OAQG;IACH,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;CACtB;AAwBD;;;;;;GAMG;AACH,wBAAgB,kBAAkB,CAAC,KAAK,EAAE,MAAM,GAAG,kBAAkB,EAAE,CAgCtE;AAED,2DAA2D;AAC3D,wBAAgB,wBAAwB,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAE/D;AAED;;;;;;GAMG;AACH,wBAAgB,eAAe,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,EAAE,CAQvD"}

package/dist/templating.js

@@ -1,103 +0,0 @@
-/**
- * The two templating layers, told apart (FR-50, Phase 1 Story 3.8).
- *
- * A value can carry substitution that happens when you BUILD and substitution that happens when
- * it RUNS, and the difference decides who finds out about a mistake:
- *
- *   `**VariableKey**`   COMPOSE-TIME. The composer substitutes it from the project's variable
- *                       pool. A missing one is caught at compose, by the person composing.
- *   `{{ … }}`           RUNTIME. The worker evaluates it (Scriban) against live data. A missing
- *                       one is caught in production, by whoever is on call.
- *
- * Conflating them is how a `{{env.__HSS_X}}` gets reported as an unresolved compose-time
- * variable — noise on something that is working exactly as designed — and, worse, how a genuinely
- * missing environment key gets the same severity as a typo'd variable name.
- *
- * ALL `{{ … }}` IS SCRIBAN — including inside a JSONata expression. A JSONata value may embed
- * Scriban so the JSONata itself can be built dynamically, and the worker evaluates Scriban FIRST,
- * then treats the result as JSONata. So there is no nested-language boundary to reason about
- * here: a `{{ … }}` occurrence is runtime Scriban wherever it appears, and the surrounding
- * expression language does not change that.
- *
- * RUNTIME IS SCRIBAN, NOT JUST `env`. The corpus holds ~30,000 `{{ … }}` occurrences: control
- * flow (`{{end}}`), pipes (`{{ '' | uuid }}`), runtime data (`{{puller.before.X}}`) and 377
- * distinct `env.__HSS_*` keys. The AC names the `env` case because that is the one with an
- * external dependency, so it is classified separately rather than being the whole definition of
- * "runtime" — a narrower model would have mislabelled the other 29,000.
- */
-/**
- * Identifier-shaped, matching the composer's own residual-token rule.
- *
- * Deliberately not `\*\*.+\*\*`: markdown bold is indistinguishable from a variable token by
- * shape alone, and a looser pattern would classify every bold phrase in a `description` as an
- * unresolved variable. The composer already draws the line here; drawing it differently would
- * mean two answers to one question.
- */
-const COMPOSE_TIME_RE = /\*\*[A-Za-z0-9_]+\*\*/g;
-/** Scriban, non-greedy so adjacent expressions do not merge into one. */
-const RUNTIME_RE = /\{\{[\s\S]*?\}\}/g;
-/**
- * A runtime expression that reads an environment key. GLOBAL — an expression can read several.
- *
- * The leading guard excludes `myenv.X`, but a QUOTE satisfies `[^A-Za-z0-9_.]` too, so
- * `{{ "env.LITERAL" }}` was reported as a deployment dependency on a key that is a string literal.
- * Quotes are now excluded explicitly.
- */
-const ENV_REF_RE = /(?:^|[^A-Za-z0-9_.'"`])env\.([A-Za-z0-9_]+)/g;
-/**
- * Every templating occurrence in a value, each classified independently.
- *
- * Independently matters: one value can mix layers — a URL built from a compose-time variable
- * followed by a runtime expression is both — and a classifier returning a single verdict per
- * value would have to be wrong about one of them.
- */
-export function classifyTemplating(value) {
-    if (typeof value !== 'string' || value.length === 0)
-        return [];
-    const found = [];
-    for (const m of value.matchAll(COMPOSE_TIME_RE)) {
-        found.push({
-            layer: 'compose-time',
-            raw: m[0],
-            key: m[0].slice(2, -2),
-            start: m.index,
-            end: m.index + m[0].length,
-        });
-    }
-    for (const m of value.matchAll(RUNTIME_RE)) {
-        const inner = m[0].slice(2, -2).trim();
-        // ALL of them. `ENV_REF_RE` was non-global and used with a single `.exec`, so a compound
-        // expression reported only its first key and every later one was invisible.
-        const envKeys = [...inner.matchAll(ENV_REF_RE)].map((e) => e[1]);
-        found.push({
-            layer: 'runtime',
-            runtimeReference: envKeys.length > 0 ? 'environment' : 'expression',
-            raw: m[0],
-            key: envKeys.length > 0 ? envKeys[0] : inner,
-            ...(envKeys.length > 0 ? { environmentKeys: envKeys } : {}),
-            start: m.index,
-            end: m.index + m[0].length,
-        });
-    }
-    // Source order, so a caller reporting occurrences reads them the way the author wrote them.
-    return found.sort((a, b) => a.start - b.start);
-}
-/** Does this value carry any compose-time substitution? */
-export function hasComposeTimeTemplating(value) {
-    return classifyTemplating(value).some((t) => t.layer === 'compose-time');
-}
-/**
- * Compose-time keys in a value — what a resolver needs.
- *
- * Runtime occurrences are deliberately absent: asking the variable pool about `{{ item.id }}`
- * would always fail, and reporting that failure would be reporting on something the composer
- * was never responsible for.
- */
-export function composeTimeKeys(value) {
-    return [
-        ...new Set(classifyTemplating(value)
-            .filter((t) => t.layer === 'compose-time')
-            .map((t) => t.key)),
-    ];
-}
-//# sourceMappingURL=templating.js.map

package/dist/templating.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"templating.js","sourceRoot":"","sources":["../src/templating.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AA+CH;;;;;;;GAOG;AACH,MAAM,eAAe,GAAG,wBAAwB,CAAC;AAEjD,yEAAyE;AACzE,MAAM,UAAU,GAAG,mBAAmB,CAAC;AAEvC;;;;;;GAMG;AACH,MAAM,UAAU,GAAG,8CAA8C,CAAC;AAElE;;;;;;GAMG;AACH,MAAM,UAAU,kBAAkB,CAAC,KAAa;IAC9C,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,EAAE,CAAC;IAC/D,MAAM,KAAK,GAAyB,EAAE,CAAC;IAEvC,KAAK,MAAM,CAAC,IAAI,KAAK,CAAC,QAAQ,CAAC,eAAe,CAAC,EAAE,CAAC;QAChD,KAAK,CAAC,IAAI,CAAC;YACT,KAAK,EAAE,cAAc;YACrB,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC;YACT,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;YACtB,KAAK,EAAE,CAAC,CAAC,KAAM;YACf,GAAG,EAAE,CAAC,CAAC,KAAM,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM;SAC5B,CAAC,CAAC;IACL,CAAC;IAED,KAAK,MAAM,CAAC,IAAI,KAAK,CAAC,QAAQ,CAAC,UAAU,CAAC,EAAE,CAAC;QAC3C,MAAM,KAAK,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;QACvC,yFAAyF;QACzF,4EAA4E;QAC5E,MAAM,OAAO,GAAG,CAAC,GAAG,KAAK,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,CAAE,CAAC,CAAC;QAClE,KAAK,CAAC,IAAI,CAAC;YACT,KAAK,EAAE,SAAS;YAChB,gBAAgB,EAAE,OAAO,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,YAAY;YACnE,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC;YACT,GAAG,EAAE,OAAO,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAE,CAAC,CAAC,CAAC,KAAK;YAC7C,GAAG,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,eAAe,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC3D,KAAK,EAAE,CAAC,CAAC,KAAM;YACf,GAAG,EAAE,CAAC,CAAC,KAAM,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM;SAC5B,CAAC,CAAC;IACL,CAAC;IAED,4FAA4F;IAC5F,OAAO,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC;AACjD,CAAC;AAED,2DAA2D;AAC3D,MAAM,UAAU,wBAAwB,CAAC,KAAa;IACpD,OAAO,kBAAkB,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,KAAK,cAAc,CAAC,CAAC;AAC3E,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,eAAe,CAAC,KAAa;IAC3C,OAAO;QACL,GAAG,IAAI,GAAG,CACR,kBAAkB,CAAC,KAAK,CAAC;aACtB,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,KAAK,cAAc,CAAC;aACzC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,CACrB;KACF,CAAC;AACJ,CAAC"}

package/dist/uriPath.d.ts

@@ -1,43 +0,0 @@
-/**
- * URI path algebra — the AD-18 corollary.
- *
- * Core may not use `node:path` (AD-3, amended 2026-08-01): the VS Code web
- * extension host does not provide it, and a bundler polyfill is exactly how
- * desktop and web end up disagreeing about file identity. So core does its own
- * path arithmetic over **normalized URI strings**: POSIX `/` only, with `.` and
- * `..` collapsed explicitly.
- *
- * Pure string work. No IO, no Node builtins, no platform behaviour.
- */
-export declare function normalizeUri(uri: string): string;
-export declare function joinUri(base: string, ...segments: readonly string[]): string;
-export declare function dirnameUri(uri: string): string;
-export declare function basenameUri(uri: string): string;
-/**
- * True when `target` is absolute in its own right — rooted, drive-rooted, or schemed.
- *
- * Exported because `node:path`'s `isAbsolute` cannot answer this question for the web host: it
- * knows nothing of `vscode-vfs://`, and on Windows it would reject a rooted POSIX path that is
- * perfectly absolute in URI terms. This was the last of Story 1.5's 37 `path.*` call sites, and
- * it had to move before `resolveMdIncludes` could follow the rest of the compose logic into core.
- *
- * ### The drive letter (reported 2026-08-08)
- *
- * It answered FALSE for `C:\docs\notes.md`, which is as absolute as a path gets. `merge.ts` asks
- * this question at both `!md[…]` resolution sites — `isAbsoluteUri(ref) ? ref : resolveUri(base,
- * ref)` — so an author on Windows writing an absolute include had it joined onto the project's base
- * directory instead, producing `D:/project/C:/docs/notes.md` and an `ENOENT` naming a path nobody
- * wrote. On Linux the same include starts with `/` and was always answered correctly, which is why
- * only a Windows test run found it.
- */
-export declare function isAbsoluteUri(target: string): boolean;
-export declare function resolveUri(base: string, target: string): string;
-export declare function relativeUri(from: string, to: string): string;
-/**
- * The escape guard (AC 5). True only when `child` is strictly inside `parent`.
- *
- * Segment-aware on purpose: a `startsWith` check would accept `rootsibling/x`
- * for parent `root` and happily write outside the install target.
- */
-export declare function isInsideUri(parent: string, child: string): boolean;
-//# sourceMappingURL=uriPath.d.ts.map

package/dist/uriPath.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"uriPath.d.ts","sourceRoot":"","sources":["../src/uriPath.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAkDH,wBAAgB,YAAY,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAWhD;AAED,wBAAgB,OAAO,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,QAAQ,EAAE,SAAS,MAAM,EAAE,GAAG,MAAM,CAM5E;AAED,wBAAgB,UAAU,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAM9C;AAED,wBAAgB,WAAW,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAK/C;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAgB,aAAa,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAOrD;AAED,wBAAgB,UAAU,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,MAAM,CAE/D;AAED,wBAAgB,WAAW,CAAC,IAAI,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,GAAG,MAAM,CAa5D;AAED;;;;;GAKG;AACH,wBAAgB,WAAW,CAAC,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAUlE"}

package/dist/uriPath.js

@@ -1,151 +0,0 @@
-/**
- * URI path algebra — the AD-18 corollary.
- *
- * Core may not use `node:path` (AD-3, amended 2026-08-01): the VS Code web
- * extension host does not provide it, and a bundler polyfill is exactly how
- * desktop and web end up disagreeing about file identity. So core does its own
- * path arithmetic over **normalized URI strings**: POSIX `/` only, with `.` and
- * `..` collapsed explicitly.
- *
- * Pure string work. No IO, no Node builtins, no platform behaviour.
- */
-/**
- * `c:/…` — a Windows absolute path, which is ROOTED WITHOUT a leading slash.
- *
- * The one shape this file's "POSIX `/` only" model does not otherwise describe. Every caller has
- * already folded backslashes to `/` before this is tested, so only the forward form appears here.
- *
- * A single letter followed by `:/` cannot be a URI scheme in this codebase's terms — `splitPrefix`
- * and `isAbsoluteUri` both test the `scheme://` form FIRST, so `c://host/x` is still read as a
- * scheme with an authority rather than as a drive.
- */
-const DRIVE_ROOT = /^[a-zA-Z]:\//;
-/** Splits `scheme://authority`, or a Windows drive root (if any), from the path remainder. */
-function splitPrefix(uri) {
-    const m = /^([a-zA-Z][a-zA-Z0-9+.-]*:\/\/[^/]*\/?)/.exec(uri);
-    if (m)
-        return { prefix: m[1], rest: uri.slice(m[1].length) };
-    // A DRIVE is a root. Left as an ordinary segment it was one — so `..` could climb PAST `c:` and
-    // out of the volume, and `relativeUri` saw two different drives as sharing a root and produced a
-    // traversal between them. `c:/` is three characters, always.
-    if (DRIVE_ROOT.test(uri))
-        return { prefix: uri.slice(0, 3), rest: uri.slice(3) };
-    if (uri.startsWith('/'))
-        return { prefix: '/', rest: uri.slice(1) };
-    return { prefix: '', rest: uri };
-}
-function collapse(segments, keepLeadingDotDot) {
-    const out = [];
-    for (const seg of segments) {
-        if (seg === '' || seg === '.')
-            continue;
-        if (seg === '..') {
-            const last = out[out.length - 1];
-            if (out.length > 0 && last !== '..') {
-                out.pop();
-            }
-            else if (keepLeadingDotDot) {
-                out.push('..');
-            }
-            // When traversal cannot be kept (rooted path), it is dropped —
-            // a rooted path can never escape its own root.
-            continue;
-        }
-        out.push(seg);
-    }
-    return out;
-}
-export function normalizeUri(uri) {
-    const forwardOnly = String(uri).replace(/\\/g, '/');
-    const { prefix, rest } = splitPrefix(forwardOnly);
-    const rooted = prefix !== '';
-    const segments = collapse(rest.split('/'), !rooted);
-    const joined = segments.join('/');
-    if (prefix === '')
-        return joined;
-    if (prefix === '/')
-        return `/${joined}`;
-    return joined === ''
-        ? prefix
-        : `${prefix.endsWith('/') ? prefix : `${prefix}/`}${joined}`;
-}
-export function joinUri(base, ...segments) {
-    const tail = segments.filter((s) => s !== undefined && s !== null && String(s) !== '');
-    const combined = [String(base), ...tail.map(String)].join('/');
-    return normalizeUri(combined);
-}
-export function dirnameUri(uri) {
-    const normalized = normalizeUri(uri);
-    const { prefix, rest } = splitPrefix(normalized);
-    const idx = rest.lastIndexOf('/');
-    if (idx === -1)
-        return prefix === '' ? '' : prefix;
-    return normalizeUri(`${prefix}${rest.slice(0, idx)}`);
-}
-export function basenameUri(uri) {
-    const normalized = normalizeUri(uri);
-    const { rest } = splitPrefix(normalized);
-    const idx = rest.lastIndexOf('/');
-    return idx === -1 ? rest : rest.slice(idx + 1);
-}
-/**
- * True when `target` is absolute in its own right — rooted, drive-rooted, or schemed.
- *
- * Exported because `node:path`'s `isAbsolute` cannot answer this question for the web host: it
- * knows nothing of `vscode-vfs://`, and on Windows it would reject a rooted POSIX path that is
- * perfectly absolute in URI terms. This was the last of Story 1.5's 37 `path.*` call sites, and
- * it had to move before `resolveMdIncludes` could follow the rest of the compose logic into core.
- *
- * ### The drive letter (reported 2026-08-08)
- *
- * It answered FALSE for `C:\docs\notes.md`, which is as absolute as a path gets. `merge.ts` asks
- * this question at both `!md[…]` resolution sites — `isAbsoluteUri(ref) ? ref : resolveUri(base,
- * ref)` — so an author on Windows writing an absolute include had it joined onto the project's base
- * directory instead, producing `D:/project/C:/docs/notes.md` and an `ENOENT` naming a path nobody
- * wrote. On Linux the same include starts with `/` and was always answered correctly, which is why
- * only a Windows test run found it.
- */
-export function isAbsoluteUri(target) {
-    const t = String(target).replace(/\\/g, '/');
-    return (t.startsWith('/') ||
-        /^[a-zA-Z][a-zA-Z0-9+.-]*:\/\//.test(t) ||
-        DRIVE_ROOT.test(t));
-}
-export function resolveUri(base, target) {
-    return isAbsoluteUri(target) ? normalizeUri(target) : joinUri(base, target);
-}
-export function relativeUri(from, to) {
-    const a = normalizeUri(from);
-    const b = normalizeUri(to);
-    const pa = splitPrefix(a);
-    const pb = splitPrefix(b);
-    if (pa.prefix !== pb.prefix)
-        return b; // different roots — no relative path exists
-    const fromSeg = pa.rest.split('/').filter((s) => s !== '');
-    const toSeg = pb.rest.split('/').filter((s) => s !== '');
-    let i = 0;
-    while (i < fromSeg.length && i < toSeg.length && fromSeg[i] === toSeg[i])
-        i += 1;
-    const up = Array.from({ length: fromSeg.length - i }, () => '..');
-    return [...up, ...toSeg.slice(i)].join('/');
-}
-/**
- * The escape guard (AC 5). True only when `child` is strictly inside `parent`.
- *
- * Segment-aware on purpose: a `startsWith` check would accept `rootsibling/x`
- * for parent `root` and happily write outside the install target.
- */
-export function isInsideUri(parent, child) {
-    const p = normalizeUri(parent);
-    const c = normalizeUri(child);
-    const pp = splitPrefix(p);
-    const pc = splitPrefix(c);
-    if (pp.prefix !== pc.prefix)
-        return false;
-    const pSeg = pp.rest.split('/').filter((s) => s !== '');
-    const cSeg = pc.rest.split('/').filter((s) => s !== '');
-    if (cSeg.length <= pSeg.length)
-        return false;
-    return pSeg.every((seg, i) => cSeg[i] === seg);
-}
-//# sourceMappingURL=uriPath.js.map

package/dist/uriPath.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"uriPath.js","sourceRoot":"","sources":["../src/uriPath.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH;;;;;;;;;GASG;AACH,MAAM,UAAU,GAAG,cAAc,CAAC;AAElC,8FAA8F;AAC9F,SAAS,WAAW,CAAC,GAAW;IAC9B,MAAM,CAAC,GAAG,yCAAyC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAC9D,IAAI,CAAC;QAAE,OAAO,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,CAAE,EAAE,IAAI,EAAE,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAE,CAAC,MAAM,CAAC,EAAE,CAAC;IAC/D,gGAAgG;IAChG,iGAAiG;IACjG,6DAA6D;IAC7D,IAAI,UAAU,CAAC,IAAI,CAAC,GAAG,CAAC;QACtB,OAAO,EAAE,MAAM,EAAE,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC;IACzD,IAAI,GAAG,CAAC,UAAU,CAAC,GAAG,CAAC;QAAE,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC;IACpE,OAAO,EAAE,MAAM,EAAE,EAAE,EAAE,IAAI,EAAE,GAAG,EAAE,CAAC;AACnC,CAAC;AAED,SAAS,QAAQ,CACf,QAA2B,EAC3B,iBAA0B;IAE1B,MAAM,GAAG,GAAa,EAAE,CAAC;IACzB,KAAK,MAAM,GAAG,IAAI,QAAQ,EAAE,CAAC;QAC3B,IAAI,GAAG,KAAK,EAAE,IAAI,GAAG,KAAK,GAAG;YAAE,SAAS;QACxC,IAAI,GAAG,KAAK,IAAI,EAAE,CAAC;YACjB,MAAM,IAAI,GAAG,GAAG,CAAC,GAAG,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;YACjC,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,IAAI,KAAK,IAAI,EAAE,CAAC;gBACpC,GAAG,CAAC,GAAG,EAAE,CAAC;YACZ,CAAC;iBAAM,IAAI,iBAAiB,EAAE,CAAC;gBAC7B,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YACjB,CAAC;YACD,+DAA+D;YAC/D,+CAA+C;YAC/C,SAAS;QACX,CAAC;QACD,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAChB,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,MAAM,UAAU,YAAY,CAAC,GAAW;IACtC,MAAM,WAAW,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;IACpD,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,GAAG,WAAW,CAAC,WAAW,CAAC,CAAC;IAClD,MAAM,MAAM,GAAG,MAAM,KAAK,EAAE,CAAC;IAC7B,MAAM,QAAQ,GAAG,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC,MAAM,CAAC,CAAC;IACpD,MAAM,MAAM,GAAG,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAClC,IAAI,MAAM,KAAK,EAAE;QAAE,OAAO,MAAM,CAAC;IACjC,IAAI,MAAM,KAAK,GAAG;QAAE,OAAO,IAAI,MAAM,EAAE,CAAC;IACxC,OAAO,MAAM,KAAK,EAAE;QAClB,CAAC,CAAC,MAAM;QACR,CAAC,CAAC,GAAG,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,GAAG,MAAM,GAAG,GAAG,MAAM,EAAE,CAAC;AACjE,CAAC;AAED,MAAM,UAAU,OAAO,CAAC,IAAY,EAAE,GAAG,QAA2B;IAClE,MAAM,IAAI,GAAG,QAAQ,CAAC,MAAM,CAC1B,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,SAAS,IAAI,CAAC,KAAK,IAAI,IAAI,MAAM,CAAC,CAAC,CAAC,KAAK,EAAE,CACzD,CAAC;IACF,MAAM,QAAQ,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,GAAG,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAC/D,OAAO,YAAY,CAAC,QAAQ,CAAC,CAAC;AAChC,CAAC;AAED,MAAM,UAAU,UAAU,CAAC,GAAW;IACpC,MAAM,UAAU,GAAG,YAAY,CAAC,GAAG,CAAC,CAAC;IACrC,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,GAAG,WAAW,CAAC,UAAU,CAAC,CAAC;IACjD,MAAM,GAAG,GAAG,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC;IAClC,IAAI,GAAG,KAAK,CAAC,CAAC;QAAE,OAAO,MAAM,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC;IACnD,OAAO,YAAY,CAAC,GAAG,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,CAAC,CAAC;AACxD,CAAC;AAED,MAAM,UAAU,WAAW,CAAC,GAAW;IACrC,MAAM,UAAU,GAAG,YAAY,CAAC,GAAG,CAAC,CAAC;IACrC,MAAM,EAAE,IAAI,EAAE,GAAG,WAAW,CAAC,UAAU,CAAC,CAAC;IACzC,MAAM,GAAG,GAAG,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC;IAClC,OAAO,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,GAAG,CAAC,CAAC,CAAC;AACjD,CAAC;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,UAAU,aAAa,CAAC,MAAc;IAC1C,MAAM,CAAC,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;IAC7C,OAAO,CACL,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC;QACjB,+BAA+B,CAAC,IAAI,CAAC,CAAC,CAAC;QACvC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,CACnB,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,UAAU,CAAC,IAAY,EAAE,MAAc;IACrD,OAAO,aAAa,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,YAAY,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;AAC9E,CAAC;AAED,MAAM,UAAU,WAAW,CAAC,IAAY,EAAE,EAAU;IAClD,MAAM,CAAC,GAAG,YAAY,CAAC,IAAI,CAAC,CAAC;IAC7B,MAAM,CAAC,GAAG,YAAY,CAAC,EAAE,CAAC,CAAC;IAC3B,MAAM,EAAE,GAAG,WAAW,CAAC,CAAC,CAAC,CAAC;IAC1B,MAAM,EAAE,GAAG,WAAW,CAAC,CAAC,CAAC,CAAC;IAC1B,IAAI,EAAE,CAAC,MAAM,KAAK,EAAE,CAAC,MAAM;QAAE,OAAO,CAAC,CAAC,CAAC,4CAA4C;IACnF,MAAM,OAAO,GAAG,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC;IAC3D,MAAM,KAAK,GAAG,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC;IACzD,IAAI,CAAC,GAAG,CAAC,CAAC;IACV,OAAO,CAAC,GAAG,OAAO,CAAC,MAAM,IAAI,CAAC,GAAG,KAAK,CAAC,MAAM,IAAI,OAAO,CAAC,CAAC,CAAC,KAAK,KAAK,CAAC,CAAC,CAAC;QACtE,CAAC,IAAI,CAAC,CAAC;IACT,MAAM,EAAE,GAAG,KAAK,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,EAAE,GAAG,EAAE,CAAC,IAAI,CAAC,CAAC;IAClE,OAAO,CAAC,GAAG,EAAE,EAAE,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AAC9C,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,WAAW,CAAC,MAAc,EAAE,KAAa;IACvD,MAAM,CAAC,GAAG,YAAY,CAAC,MAAM,CAAC,CAAC;IAC/B,MAAM,CAAC,GAAG,YAAY,CAAC,KAAK,CAAC,CAAC;IAC9B,MAAM,EAAE,GAAG,WAAW,CAAC,CAAC,CAAC,CAAC;IAC1B,MAAM,EAAE,GAAG,WAAW,CAAC,CAAC,CAAC,CAAC;IAC1B,IAAI,EAAE,CAAC,MAAM,KAAK,EAAE,CAAC,MAAM;QAAE,OAAO,KAAK,CAAC;IAC1C,MAAM,IAAI,GAAG,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC;IACxD,MAAM,IAAI,GAAG,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC;IACxD,IAAI,IAAI,CAAC,MAAM,IAAI,IAAI,CAAC,MAAM;QAAE,OAAO,KAAK,CAAC;IAC7C,OAAO,IAAI,CAAC,KAAK,CAAC,CAAC,GAAG,EAAE,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,GAAG,CAAC,CAAC;AACjD,CAAC"}