@bevel-software/platform-core-backend 0.12.0 → 0.13.1

package/dist/modules/kb-fs/clone-config.js

@@ -1,6 +1,13 @@
 /**
- * The git configuration a per-branch workspace clone must have for its branch
- * to track exactly ONE upstream ref.
+ * The git configuration a per-branch workspace clone must carry: the tracking
+ * config that pins its branch to exactly ONE upstream ref, and the credential
+ * helper its remote operations authenticate with.
+ *
+ * Both are stamped at clone time AND re-stamped when an existing clone is
+ * adopted from disk, so a clone created by an older build — or by a path that
+ * only authenticated its own invocation — is repaired rather than left broken.
+ *
+ * On the tracking half:
  *
  * Why this exists: a clone's config is append-only from git's point of view,
  * and several things write to it:
@@ -66,4 +73,89 @@ export function cloneTrackingConfigArgs(branch) {
         ['config', '--replace-all', `branch.${branch}.merge`, `refs/heads/${branch}`],
     ];
 }
+/**
+ * The inline credential helper a workspace clone authenticates its remote
+ * operations with, or null when the deployment has no git token configured.
+ *
+ * The snippet reads `$GITHUB_TOKEN` at CALL time, so the secret itself never
+ * enters argv, the clone's `.git/config`, or any error message quoting either.
+ * `GITHUB_TOKEN` is the normalised name — `CoreConfig` collapses `GIT_TOKEN` /
+ * `GH_TOKEN` onto it at boot, and `DeploymentSettingsService.syncGitTokenEnv`
+ * publishes a token supplied through the setup screen to the same place — so
+ * this one name covers every way a token can arrive.
+ *
+ * The username is provider-specific (GitHub `x-access-token`, GitLab `oauth2`,
+ * Bitbucket `x-token-auth`); the token is always the Basic-auth password,
+ * which every major host accepts.
+ */
+export function credentialHelperValue(gitUsername) {
+    if (!process.env.GITHUB_TOKEN)
+        return null;
+    // Interpolated into a shell snippet that git will execute. `CoreConfig` and
+    // `DeploymentSettingsService` both reject a username outside this charset
+    // before it can get this far, so reaching the throw means an unvalidated
+    // fourth path appeared — fail closed rather than emit an injectable helper.
+    if (!/^[A-Za-z0-9._-]+$/.test(gitUsername)) {
+        throw new Error(`git username must match [A-Za-z0-9._-]+; got "${gitUsername}"`);
+    }
+    // printf '%s' rather than echo: POSIX leaves echo's handling of backslash
+    // escapes implementation-defined (dash interprets \c as "stop output"), so
+    // a token containing a backslash sequence could be silently truncated on
+    // the way to git. printf %s passes the bytes through verbatim. The literal
+    // `password=$GITHUB_TOKEN` stays in the snippet, which is what
+    // APP_HELPER_VALUE_PATTERN keys on — echo-era helpers stamped by earlier
+    // builds still match it and get replaced on the next stamp.
+    return `!f() { printf '%s\\n' "username=${gitUsername}" "password=$GITHUB_TOKEN"; }; f`;
+}
+/**
+ * `git clone` arguments that PERSIST the credential helper into the repository
+ * being created. Position is load-bearing: these belong AFTER the `clone`
+ * subcommand, where `--config` means "write this into the new repo's config".
+ * The same pair placed BEFORE it is git's per-invocation `-c`, which
+ * authenticates that one clone and leaves the resulting repo with no helper at
+ * all — so every later `git push` from that clone prompts for a username,
+ * finds no tty, and dies. That was a real outage: a self-hosted deployment
+ * cloned fine, committed fine, and silently pushed nothing for two days.
+ *
+ * Empty when no token is configured, matching the un-authenticated clone the
+ * rest of the layer already supports.
+ */
+export function cloneCredentialArgs(gitUsername) {
+    const helper = credentialHelperValue(gitUsername);
+    return helper ? ['--config', `credential.helper=${helper}`] : [];
+}
+/**
+ * `git` argument lists that bring a clone's credential helper into line with
+ * the deployment's current config — the repair path for clones on disk (see
+ * `cloneCredentialArgs`), applied wherever `cloneTrackingConfigArgs` is:
+ * `--replace-all` when a token is configured (idempotent re-stamp, stale
+ * values collapse), `--unset-all` when the deployment lost its token (a
+ * leftover helper answering with an empty password must not shadow whatever
+ * auth the operator fell back to; unset of a missing value exits non-zero
+ * and callers tolerate it — see `stampCredentialHelper`). Both operations
+ * are scoped by the value pattern below so only app-owned helpers are
+ * touched. Returns the arguments rather than running them, for the same
+ * reason `cloneTrackingConfigArgs` does.
+ */
+/**
+ * Value pattern (a POSIX ERE, as `git config`'s optional value-pattern
+ * argument expects) that matches ONLY helpers this application stamped —
+ * every one of ours reads `password=$GITHUB_TOKEN`, and no operator-authored
+ * helper has a reason to contain that literal. Scoping both the replace and
+ * the unset to it means an operator's own clone-local helper (`store`,
+ * `cache`, something custom) is never collapsed away or deleted by our
+ * stamping: git chains all configured helpers in order, so ours and theirs
+ * coexist.
+ */
+const APP_HELPER_VALUE_PATTERN = 'password=\\$GITHUB_TOKEN';
+export function cloneCredentialConfigArgs(gitUsername) {
+    const helper = credentialHelperValue(gitUsername);
+    // `--replace-all key value pattern` replaces every line MATCHING the
+    // pattern with the one value (adding it when none match) and leaves
+    // non-matching values — operator helpers — untouched. Same scoping on the
+    // unset: only app-stamped values are removed when the token goes away.
+    return helper
+        ? [['config', '--replace-all', 'credential.helper', helper, APP_HELPER_VALUE_PATTERN]]
+        : [['config', '--unset-all', 'credential.helper', APP_HELPER_VALUE_PATTERN]];
+}
 //# sourceMappingURL=clone-config.js.map

package/dist/modules/kb-fs/clone-config.js.map

@@ -1 +1 @@
-{"version":3,"file":"clone-config.js","sourceRoot":"","sources":["../../../src/modules/kb-fs/clone-config.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAoCG;AAEH,4EAA4E;AAC5E,MAAM,CAAC,MAAM,oBAAoB,GAAG,qCAAqC,CAAC;AAE1E;;;;;;;;;;;;GAYG;AACH,MAAM,CAAC,MAAM,wBAAwB,GAAsB;IACzD,OAAO,EAAE,SAAS,EAAE,uBAAuB,EAAE,QAAQ;CACtD,CAAC;AAEF;;;;;GAKG;AACH,MAAM,UAAU,uBAAuB,CAAC,MAAc;IACpD,OAAO;QACL,CAAC,QAAQ,EAAE,eAAe,EAAE,qBAAqB,EAAE,oBAAoB,CAAC;QACxE,CAAC,QAAQ,EAAE,eAAe,EAAE,UAAU,MAAM,SAAS,EAAE,QAAQ,CAAC;QAChE,CAAC,QAAQ,EAAE,eAAe,EAAE,UAAU,MAAM,QAAQ,EAAE,cAAc,MAAM,EAAE,CAAC;KAC9E,CAAC;AACJ,CAAC"}
+{"version":3,"file":"clone-config.js","sourceRoot":"","sources":["../../../src/modules/kb-fs/clone-config.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2CG;AAEH,4EAA4E;AAC5E,MAAM,CAAC,MAAM,oBAAoB,GAAG,qCAAqC,CAAC;AAE1E;;;;;;;;;;;;GAYG;AACH,MAAM,CAAC,MAAM,wBAAwB,GAAsB;IACzD,OAAO,EAAE,SAAS,EAAE,uBAAuB,EAAE,QAAQ;CACtD,CAAC;AAEF;;;;;GAKG;AACH,MAAM,UAAU,uBAAuB,CAAC,MAAc;IACpD,OAAO;QACL,CAAC,QAAQ,EAAE,eAAe,EAAE,qBAAqB,EAAE,oBAAoB,CAAC;QACxE,CAAC,QAAQ,EAAE,eAAe,EAAE,UAAU,MAAM,SAAS,EAAE,QAAQ,CAAC;QAChE,CAAC,QAAQ,EAAE,eAAe,EAAE,UAAU,MAAM,QAAQ,EAAE,cAAc,MAAM,EAAE,CAAC;KAC9E,CAAC;AACJ,CAAC;AAED;;;;;;;;;;;;;;GAcG;AACH,MAAM,UAAU,qBAAqB,CAAC,WAAmB;IACvD,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,YAAY;QAAE,OAAO,IAAI,CAAC;IAC3C,4EAA4E;IAC5E,0EAA0E;IAC1E,yEAAyE;IACzE,4EAA4E;IAC5E,IAAI,CAAC,mBAAmB,CAAC,IAAI,CAAC,WAAW,CAAC,EAAE,CAAC;QAC3C,MAAM,IAAI,KAAK,CAAC,iDAAiD,WAAW,GAAG,CAAC,CAAC;IACnF,CAAC;IACD,0EAA0E;IAC1E,2EAA2E;IAC3E,yEAAyE;IACzE,2EAA2E;IAC3E,+DAA+D;IAC/D,yEAAyE;IACzE,4DAA4D;IAC5D,OAAO,mCAAmC,WAAW,kCAAkC,CAAC;AAC1F,CAAC;AAED;;;;;;;;;;;;GAYG;AACH,MAAM,UAAU,mBAAmB,CAAC,WAAmB;IACrD,MAAM,MAAM,GAAG,qBAAqB,CAAC,WAAW,CAAC,CAAC;IAClD,OAAO,MAAM,CAAC,CAAC,CAAC,CAAC,UAAU,EAAE,qBAAqB,MAAM,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;AACnE,CAAC;AAED;;;;;;;;;;;;GAYG;AACH;;;;;;;;;GASG;AACH,MAAM,wBAAwB,GAAG,0BAA0B,CAAC;AAE5D,MAAM,UAAU,yBAAyB,CAAC,WAAmB;IAC3D,MAAM,MAAM,GAAG,qBAAqB,CAAC,WAAW,CAAC,CAAC;IAClD,qEAAqE;IACrE,oEAAoE;IACpE,0EAA0E;IAC1E,uEAAuE;IACvE,OAAO,MAAM;QACX,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE,eAAe,EAAE,mBAAmB,EAAE,MAAM,EAAE,wBAAwB,CAAC,CAAC;QACtF,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE,aAAa,EAAE,mBAAmB,EAAE,wBAAwB,CAAC,CAAC,CAAC;AACjF,CAAC"}

package/dist/modules/kb-fs/locking-filesystem.d.ts

@@ -46,6 +46,16 @@ export interface LockingFilesystemContext {
     workspaceId: string;
     branch: string;
     user: AuthUser;
+    /**
+     * The clone folder at the workspace root (`knowledge-base`). The filesystem
+     * is rooted one level ABOVE the repository, so containment alone lets a
+     * repo-relative path (`KnowledgeBase/…`) land beside the clone, where git
+     * never sees it and the release commit quietly no-ops. Every op that
+     * creates or modifies bytes is refused unless its path starts with this
+     * folder; removals stay open so a stray the old behaviour left there can
+     * still be cleaned up.
+     */
+    kbDirName: string;
     /**
      * Optional pre-disk write validator. Invoked with the (workspace-relative
      * path, full content) of every WHOLE-FILE write BEFORE the bytes land. Throw
@@ -108,6 +118,12 @@ export declare class LockingFilesystem extends LocalFilesystem {
         recursive?: boolean;
     }): Promise<void>;
     rmdir(_inputPath: string, _options?: RemoveOptions): Promise<void>;
+    /**
+     * Refuse a path that would put bytes beside the repository instead of in
+     * it. Runs before any side effect (plan, validator, lock, disk) so a refusal
+     * leaves nothing behind. See `LockingFilesystemContext.kbDirName`.
+     */
+    private assertInsideRepo;
     /**
      * Land a `seed-access-md` creation-grant plan: under the access.md's own
      * lock (single acquire+release cycle → one commit), re-read the CURRENT

package/dist/modules/kb-fs/locking-filesystem.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"locking-filesystem.d.ts","sourceRoot":"","sources":["../../../src/modules/kb-fs/locking-filesystem.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgCG;AAGH,OAAO,EACL,eAAe,EACf,KAAK,sBAAsB,EAC3B,KAAK,WAAW,EAChB,KAAK,WAAW,EAChB,KAAK,aAAa,EAClB,KAAK,YAAY,EAClB,MAAM,wBAAwB,CAAC;AAChC,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,EAAE,gBAAgB,EAAE,MAAM,iCAAiC,CAAC;AAE1F,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,2BAA2B,CAAC;AACpE,OAAO,KAAK,EAAqB,cAAc,EAAE,MAAM,4BAA4B,CAAC;AAOpF;;;;;GAKG;AACH,MAAM,WAAW,wBAAwB;IACvC,QAAQ,EAAE,gBAAgB,CAAC;IAC3B,WAAW,EAAE,MAAM,CAAC;IACpB,MAAM,EAAE,MAAM,CAAC;IACf,IAAI,EAAE,QAAQ,CAAC;IACf;;;;;;;OAOG;IACH,aAAa,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,WAAW,KAAK,IAAI,CAAC;IAC7D;;;;OAIG;IACH,WAAW,CAAC,EAAE,kBAAkB,CAAC;IACjC;;;;;;;OAOG;IACH,aAAa,CAAC,EAAE,cAAc,CAAC;CAChC;AAED,qBAAa,iBAAkB,SAAQ,eAAe;IACpD,OAAO,CAAC,QAAQ,CAAC,WAAW,CAA2B;gBAGrD,OAAO,EAAE,sBAAsB,EAC/B,WAAW,EAAE,wBAAwB;IAMxB,SAAS,CACtB,SAAS,EAAE,MAAM,EACjB,OAAO,EAAE,WAAW,EACpB,OAAO,CAAC,EAAE,YAAY,GACrB,OAAO,CAAC,IAAI,CAAC;IAiBD,UAAU,CAAC,SAAS,EAAE,MAAM,EAAE,OAAO,EAAE,WAAW,GAAG,OAAO,CAAC,IAAI,CAAC;IAIlE,UAAU,CAAC,SAAS,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,aAAa,GAAG,OAAO,CAAC,IAAI,CAAC;IAIrE,QAAQ,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,IAAI,CAAC;IAMzE,QAAQ,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,IAAI,CAAC;IAsBxF;;;;;;;;;;;;;;;;;;;;OAoBG;IACG,UAAU,CACd,MAAM,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,WAAW,CAAA;KAAE,EAAE,EAChD,OAAO,EAAE,MAAM,EACf,OAAO,GAAE,MAAM,EAAO,GACrB,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC;IAySV,KAAK,CAAC,SAAS,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE;QAAE,SAAS,CAAC,EAAE,OAAO,CAAA;KAAE,GAAG,OAAO,CAAC,IAAI,CAAC;IAqC1E,KAAK,CAAC,UAAU,EAAE,MAAM,EAAE,QAAQ,CAAC,EAAE,aAAa,GAAG,OAAO,CAAC,IAAI,CAAC;IAYjF;;;;;;;;OAQG;YACW,YAAY;IA0B1B;;;;;OAKG;YACW,UAAU;IAiBxB;;;;;;OAMG;YACW,QAAQ;CAoDvB"}
+{"version":3,"file":"locking-filesystem.d.ts","sourceRoot":"","sources":["../../../src/modules/kb-fs/locking-filesystem.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgCG;AAGH,OAAO,EACL,eAAe,EACf,KAAK,sBAAsB,EAC3B,KAAK,WAAW,EAChB,KAAK,WAAW,EAChB,KAAK,aAAa,EAClB,KAAK,YAAY,EAClB,MAAM,wBAAwB,CAAC;AAChC,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,EAAE,gBAAgB,EAAE,MAAM,iCAAiC,CAAC;AAE1F,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,2BAA2B,CAAC;AAEpE,OAAO,KAAK,EAAqB,cAAc,EAAE,MAAM,4BAA4B,CAAC;AAOpF;;;;;GAKG;AACH,MAAM,WAAW,wBAAwB;IACvC,QAAQ,EAAE,gBAAgB,CAAC;IAC3B,WAAW,EAAE,MAAM,CAAC;IACpB,MAAM,EAAE,MAAM,CAAC;IACf,IAAI,EAAE,QAAQ,CAAC;IACf;;;;;;;;OAQG;IACH,SAAS,EAAE,MAAM,CAAC;IAClB;;;;;;;OAOG;IACH,aAAa,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,WAAW,KAAK,IAAI,CAAC;IAC7D;;;;OAIG;IACH,WAAW,CAAC,EAAE,kBAAkB,CAAC;IACjC;;;;;;;OAOG;IACH,aAAa,CAAC,EAAE,cAAc,CAAC;CAChC;AAED,qBAAa,iBAAkB,SAAQ,eAAe;IACpD,OAAO,CAAC,QAAQ,CAAC,WAAW,CAA2B;gBAGrD,OAAO,EAAE,sBAAsB,EAC/B,WAAW,EAAE,wBAAwB;IAMxB,SAAS,CACtB,SAAS,EAAE,MAAM,EACjB,OAAO,EAAE,WAAW,EACpB,OAAO,CAAC,EAAE,YAAY,GACrB,OAAO,CAAC,IAAI,CAAC;IAkBD,UAAU,CAAC,SAAS,EAAE,MAAM,EAAE,OAAO,EAAE,WAAW,GAAG,OAAO,CAAC,IAAI,CAAC;IAKlE,UAAU,CAAC,SAAS,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,aAAa,GAAG,OAAO,CAAC,IAAI,CAAC;IAIrE,QAAQ,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,IAAI,CAAC;IAOzE,QAAQ,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,IAAI,CAAC;IAyBxF;;;;;;;;;;;;;;;;;;;;OAoBG;IACG,UAAU,CACd,MAAM,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,WAAW,CAAA;KAAE,EAAE,EAChD,OAAO,EAAE,MAAM,EACf,OAAO,GAAE,MAAM,EAAO,GACrB,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC;IA4SV,KAAK,CAAC,SAAS,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE;QAAE,SAAS,CAAC,EAAE,OAAO,CAAA;KAAE,GAAG,OAAO,CAAC,IAAI,CAAC;IAsC1E,KAAK,CAAC,UAAU,EAAE,MAAM,EAAE,QAAQ,CAAC,EAAE,aAAa,GAAG,OAAO,CAAC,IAAI,CAAC;IAYjF;;;;OAIG;IACH,OAAO,CAAC,gBAAgB;IAIxB;;;;;;;;OAQG;YACW,YAAY;IA0B1B;;;;;OAKG;YACW,UAAU;IAiBxB;;;;;;OAMG;YACW,QAAQ;CAoDvB"}

package/dist/modules/kb-fs/locking-filesystem.js

@@ -34,6 +34,7 @@
 import fs from 'node:fs/promises';
 import { LocalFilesystem, } from '@mastra/core/workspace';
 import { PushNeedsAgentResolutionError } from '../../shared/domain-errors.js';
+import { assertInsideRepo } from './repo-path.js';
 /** How many times to retry a contended acquire before giving up. */
 const ACQUIRE_RETRY_ATTEMPTS = 3;
 /** Backoff between retries (ms). 3 attempts × 2s ≈ 6s ceiling. */
@@ -45,6 +46,7 @@ export class LockingFilesystem extends LocalFilesystem {
         this.lockContext = lockContext;
     }
     async writeFile(inputPath, content, options) {
+        this.assertInsideRepo(inputPath);
         // Pre-disk gate (e.g. reject a roles.yaml edit that would lock out admins).
         // Runs OUTSIDE the lock so a refusal never acquires/holds one.
         this.lockContext.validateWrite?.(inputPath, content);
@@ -61,17 +63,22 @@ export class LockingFilesystem extends LocalFilesystem {
         return this.withLock(inputPath, () => super.writeFile(inputPath, toWrite, options));
     }
     async appendFile(inputPath, content) {
+        this.assertInsideRepo(inputPath);
         return this.withLock(inputPath, () => super.appendFile(inputPath, content));
     }
     async deleteFile(inputPath, options) {
         return this.withLock(inputPath, () => super.deleteFile(inputPath, options));
     }
     async copyFile(src, dest, options) {
+        this.assertInsideRepo(dest);
         // Lock on `dest`. `src` is read-only from this op's perspective — copy
         // creates a new file at dest without disturbing src on disk.
         return this.withLock(dest, () => super.copyFile(src, dest, options));
     }
     async moveFile(src, dest, options) {
+        // Only the destination is gated: moving a stray INTO the repository is how
+        // a file the old behaviour left beside the clone gets rescued.
+        this.assertInsideRepo(dest);
         // A move mutates two paths: the source is deleted and the destination
         // is created. Only locking `dest` would let a concurrent writer hold
         // the source's lock and mutate it under us, and would also leave the
@@ -113,6 +120,10 @@ export class LockingFilesystem extends LocalFilesystem {
      */
     async writeFiles(writes, summary, deletes = []) {
         const { workflow, workspaceId, branch, user } = this.lockContext;
+        // Fail the whole batch before any plan, validator or lock: one stray path
+        // must not let its siblings land while it silently misses git.
+        for (const w of writes)
+            this.assertInsideRepo(w.path);
         // Creator read grants for the batch: transform new markdown files'
         // content in place, and fold any subtree access.md seeds into the SAME
         // atomic batch (deduped — several files landing in one new folder share
@@ -396,6 +407,7 @@ export class LockingFilesystem extends LocalFilesystem {
         return change;
     }
     async mkdir(inputPath, options) {
+        this.assertInsideRepo(inputPath);
         // Creator read grant: planned BEFORE the dir exists (the plan's
         // new-directory detection needs the pre-creation tree), seeded right
         // after — so the new folder's access.md names the acting user under
@@ -443,6 +455,14 @@ export class LockingFilesystem extends LocalFilesystem {
         throw new Error('Recursive directory removal is not supported through the lock-aware filesystem. ' +
             'Delete files individually so each removal lands as its own change.');
     }
+    /**
+     * Refuse a path that would put bytes beside the repository instead of in
+     * it. Runs before any side effect (plan, validator, lock, disk) so a refusal
+     * leaves nothing behind. See `LockingFilesystemContext.kbDirName`.
+     */
+    assertInsideRepo(inputPath) {
+        assertInsideRepo(inputPath, this.lockContext.kbDirName);
+    }
     /**
      * Land a `seed-access-md` creation-grant plan: under the access.md's own
      * lock (single acquire+release cycle → one commit), re-read the CURRENT

package/dist/modules/kb-fs/locking-filesystem.js.map

@@ -1 +1 @@
-{"version":3,"file":"locking-filesystem.js","sourceRoot":"","sources":["../../../src/modules/kb-fs/locking-filesystem.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgCG;AAEH,OAAO,EAAE,MAAM,kBAAkB,CAAC;AAClC,OAAO,EACL,eAAe,GAMhB,MAAM,wBAAwB,CAAC;AAEhC,OAAO,EAAE,6BAA6B,EAAE,MAAM,+BAA+B,CAAC;AAI9E,oEAAoE;AACpE,MAAM,sBAAsB,GAAG,CAAC,CAAC;AACjC,kEAAkE;AAClE,MAAM,sBAAsB,GAAG,KAAK,CAAC;AAuCrC,MAAM,OAAO,iBAAkB,SAAQ,eAAe;IACnC,WAAW,CAA2B;IAEvD,YACE,OAA+B,EAC/B,WAAqC;QAErC,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,WAAW,GAAG,WAAW,CAAC;IACjC,CAAC;IAEQ,KAAK,CAAC,SAAS,CACtB,SAAiB,EACjB,OAAoB,EACpB,OAAsB;QAEtB,4EAA4E;QAC5E,+DAA+D;QAC/D,IAAI,CAAC,WAAW,CAAC,aAAa,EAAE,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC;QACrD,2EAA2E;QAC3E,mEAAmE;QACnE,uEAAuE;QACvE,kEAAkE;QAClE,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC;QACtD,IAAI,IAAI,EAAE,IAAI,KAAK,gBAAgB;YAAE,MAAM,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC;QACnE,MAAM,OAAO,GACX,IAAI,EAAE,IAAI,KAAK,aAAa,IAAI,OAAO,OAAO,KAAK,QAAQ;YACzD,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC;YACrB,CAAC,CAAC,OAAO,CAAC;QACd,OAAO,IAAI,CAAC,QAAQ,CAAC,SAAS,EAAE,GAAG,EAAE,CAAC,KAAK,CAAC,SAAS,CAAC,SAAS,EAAE,OAAO,EAAE,OAAO,CAAC,CAAC,CAAC;IACtF,CAAC;IAEQ,KAAK,CAAC,UAAU,CAAC,SAAiB,EAAE,OAAoB;QAC/D,OAAO,IAAI,CAAC,QAAQ,CAAC,SAAS,EAAE,GAAG,EAAE,CAAC,KAAK,CAAC,UAAU,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC,CAAC;IAC9E,CAAC;IAEQ,KAAK,CAAC,UAAU,CAAC,SAAiB,EAAE,OAAuB;QAClE,OAAO,IAAI,CAAC,QAAQ,CAAC,SAAS,EAAE,GAAG,EAAE,CAAC,KAAK,CAAC,UAAU,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC,CAAC;IAC9E,CAAC;IAEQ,KAAK,CAAC,QAAQ,CAAC,GAAW,EAAE,IAAY,EAAE,OAAqB;QACtE,uEAAuE;QACvE,6DAA6D;QAC7D,OAAO,IAAI,CAAC,QAAQ,CAAC,IAAI,EAAE,GAAG,EAAE,CAAC,KAAK,CAAC,QAAQ,CAAC,GAAG,EAAE,IAAI,EAAE,OAAO,CAAC,CAAC,CAAC;IACvE,CAAC;IAEQ,KAAK,CAAC,QAAQ,CAAC,GAAW,EAAE,IAAY,EAAE,OAAqB;QACtE,sEAAsE;QACtE,qEAAqE;QACrE,qEAAqE;QACrE,uEAAuE;QACvE,iEAAiE;QACjE,EAAE;QACF,mEAAmE;QACnE,qEAAqE;QACrE,qEAAqE;QACrE,qEAAqE;QACrE,6DAA6D;QAC7D,oEAAoE;QACpE,IAAI,GAAG,KAAK,IAAI,EAAE,CAAC;YACjB,OAAO,IAAI,CAAC,QAAQ,CAAC,IAAI,EAAE,GAAG,EAAE,CAAC,KAAK,CAAC,QAAQ,CAAC,GAAG,EAAE,IAAI,EAAE,OAAO,CAAC,CAAC,CAAC;QACvE,CAAC;QACD,MAAM,CAAC,KAAK,EAAE,MAAM,CAAC,GAAG,GAAG,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;QAC/D,OAAO,IAAI,CAAC,QAAQ,CAAC,KAAK,EAAE,GAAG,EAAE,CAC/B,IAAI,CAAC,QAAQ,CAAC,MAAM,EAAE,GAAG,EAAE,CAAC,KAAK,CAAC,QAAQ,CAAC,GAAG,EAAE,IAAI,EAAE,OAAO,CAAC,CAAC,CAChE,CAAC;IACJ,CAAC;IAED;;;;;;;;;;;;;;;;;;;;OAoBG;IACH,KAAK,CAAC,UAAU,CACd,MAAgD,EAChD,OAAe,EACf,UAAoB,EAAE;QAEtB,MAAM,EAAE,QAAQ,EAAE,WAAW,EAAE,MAAM,EAAE,IAAI,EAAE,GAAG,IAAI,CAAC,WAAW,CAAC;QACjE,mEAAmE;QACnE,uEAAuE;QACvE,wEAAwE;QACxE,wEAAwE;QACxE,0EAA0E;QAC1E,yEAAyE;QACzE,OAAO;QACP,MAAM,KAAK,GAAG,IAAI,GAAG,EAAuC,CAAC;QAC7D,MAAM,aAAa,GAA6C,EAAE,CAAC;QACnE,KAAK,MAAM,CAAC,IAAI,MAAM,EAAE,CAAC;YACvB,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;YACnD,IAAI,IAAI,EAAE,IAAI,KAAK,gBAAgB,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC;gBACtF,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC;YACxC,CAAC;YACD,aAAa,CAAC,IAAI,CAChB,IAAI,EAAE,IAAI,KAAK,aAAa,IAAI,OAAO,CAAC,CAAC,OAAO,KAAK,QAAQ;gBAC3D,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,OAAO,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE;gBAClD,CAAC,CAAC,CAAC,CACN,CAAC;QACJ,CAAC;QACD,MAAM,GAAG,aAAa,CAAC;QACvB,sEAAsE;QACtE,iEAAiE;QACjE,IAAI,IAAI,CAAC,WAAW,CAAC,aAAa,EAAE,CAAC;YACnC,KAAK,MAAM,CAAC,IAAI,MAAM;gBAAE,IAAI,CAAC,WAAW,CAAC,aAAa,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC;QAC5E,CAAC;QACD,wEAAwE;QACxE,2EAA2E;QAC3E,8EAA8E;QAC9E,6DAA6D;QAC7D,MAAM,KAAK,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,CAAC,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;QAC9E,MAAM,QAAQ,GAAa,EAAE,CAAC;QAC9B,wEAAwE;QACxE,wEAAwE;QACxE,wEAAwE;QACxE,sEAAsE;QACtE,mEAAmE;QACnE,4CAA4C;QAC5C,MAAM,OAAO,GAAG,IAAI,GAAG,EAAU,CAAC;QAClC,oEAAoE;QACpE,qEAAqE;QACrE,iEAAiE;QACjE,MAAM,kBAAkB,GAAG,IAAI,GAAG,EAAU,CAAC;QAC7C,mEAAmE;QACnE,uEAAuE;QACvE,EAAE;QACF,yEAAyE;QACzE,wEAAwE;QACxE,qEAAqE;QACrE,sEAAsE;QACtE,sEAAsE;QACtE,uEAAuE;QACvE,qEAAqE;QACrE,uEAAuE;QACvE,wEAAwE;QACxE,sEAAsE;QACtE,sEAAsE;QACtE,wEAAwE;QACxE,wEAAwE;QACxE,8BAA8B;QAC9B,MAAM,UAAU,GAAG,KAAK,EACtB,MAA0D,EAC3C,EAAE;YACjB,KAAK,MAAM,CAAC,IAAI,QAAQ,EAAE,CAAC;gBACzB,IAAI,CAAC;oBACH,MAAM,IAAI,GAAG,MAAM,CAAC,CAAC,CAAC,CAAC;oBACvB,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;wBACvB,MAAM,QAAQ,CAAC,mBAAmB,CAAC,WAAW,EAAE,MAAM,EAAE,CAAC,EAAE,IAAI,CAAC,CAAC;oBACnE,CAAC;yBAAM,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;wBAC9B,MAAM,QAAQ,CAAC,WAAW,CAAC,WAAW,EAAE,MAAM,EAAE,CAAC,EAAE,IAAI,CAAC,CAAC;oBAC3D,CAAC;yBAAM,CAAC;wBACN,MAAM,QAAQ,CAAC,oBAAoB,CAAC,WAAW,EAAE,MAAM,EAAE,CAAC,EAAE,IAAI,CAAC,CAAC;oBACpE,CAAC;gBACH,CAAC;gBAAC,OAAO,UAAU,EAAE,CAAC;oBACpB,OAAO,CAAC,IAAI,CACV,yCAAyC,CAAC,sBAAsB,EAChE,UAAU,YAAY,KAAK,CAAC,CAAC,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC,CAAC,UAAU,CAC9D,CAAC;gBACJ,CAAC;YACH,CAAC;QACH,CAAC,CAAC;QAEF,oEAAoE;QACpE,KAAK,MAAM,CAAC,IAAI,KAAK,EAAE,CAAC;YACtB,IAAI,UAAU,GAAkB,IAAI,CAAC;YACrC,IAAI,EAAE,GAAG,KAAK,CAAC;YACf,KAAK,IAAI,OAAO,GAAG,CAAC,EAAE,OAAO,GAAG,sBAAsB,EAAE,OAAO,EAAE,EAAE,CAAC;gBAClE,MAAM,MAAM,GAAG,MAAM,QAAQ,CAAC,WAAW,CAAC,WAAW,EAAE,MAAM,EAAE,CAAC,EAAE,IAAI,CAAC,CAAC;gBACxE,IAAI,MAAM,CAAC,QAAQ,EAAE,CAAC;oBACpB,EAAE,GAAG,IAAI,CAAC;oBACV,MAAM;gBACR,CAAC;gBACD,UAAU,GAAG,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC;gBACpC,IAAI,OAAO,GAAG,sBAAsB,GAAG,CAAC;oBAAE,MAAM,KAAK,CAAC,sBAAsB,CAAC,CAAC;YAChF,CAAC;YACD,IAAI,CAAC,EAAE,EAAE,CAAC;gBACR,oEAAoE;gBACpE,4DAA4D;gBAC5D,MAAM,UAAU,CAAC,GAAG,EAAE,CAAC,WAAW,CAAC,CAAC;gBACpC,MAAM,IAAI,KAAK,CACb,oBAAoB,CAAC,iBAAiB,UAAU,IAAI,cAAc,IAAI;oBACpE,wDAAwD,CAC3D,CAAC;YACJ,CAAC;YACD,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QACnB,CAAC;QAED,qEAAqE;QACrE,sEAAsE;QACtE,wEAAwE;QACxE,0EAA0E;QAC1E,KAAK,MAAM,CAAC,IAAI,CAAC,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC;YACzC,IAAI,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC;gBAAE,SAAS,CAAC,kCAAkC;YACnE,MAAM,MAAM,GAAG,MAAM,QAAQ,CAAC,WAAW,CAAC,WAAW,EAAE,MAAM,EAAE,CAAC,EAAE,IAAI,CAAC,CAAC;YACxE,IAAI,MAAM,CAAC,QAAQ,EAAE,CAAC;gBACpB,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;YACnB,CAAC;iBAAM,CAAC;gBACN,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;gBAChB,OAAO,CAAC,IAAI,CACV,oDAAoD,CAAC,iBAAiB,MAAM,CAAC,IAAI,CAAC,UAAU,IAAI,cAAc,EAAE,CACjH,CAAC;YACJ,CAAC;QACH,CAAC;QAED,yEAAyE;QACzE,qEAAqE;QACrE,yEAAyE;QACzE,sEAAsE;QACtE,sEAAsE;QACtE,wDAAwD;QACxD,MAAM,OAAO,GAAG,CAAC,GAAG,KAAK,CAAC,CAAC;QAC3B,sEAAsE;QACtE,sEAAsE;QACtE,sEAAsE;QACtE,uEAAuE;QACvE,MAAM,WAAW,GAAG,IAAI,GAAG,EAAuD,CAAC;QACnF,IAAI,MAAqB,CAAC;QAC1B,IAAI,CAAC;YACH,wEAAwE;YACxE,2EAA2E;YAC3E,2EAA2E;YAC3E,KAAK,MAAM,CAAC,IAAI,MAAM,EAAE,CAAC;gBACvB,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;gBACpB,MAAM,KAAK,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC;YAC3C,CAAC;YACD,KAAK,MAAM,CAAC,IAAI,OAAO,EAAE,CAAC;gBACxB,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;gBACf,MAAM,KAAK,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC;YAC5B,CAAC;YACD,wEAAwE;YACxE,0EAA0E;YAC1E,KAAK,MAAM,CAAC,CAAC,EAAE,KAAK,CAAC,IAAI,KAAK,EAAE,CAAC;gBAC/B,IAAI,OAAO,GAAG,EAAE,CAAC;gBACjB,IAAI,aAAa,GAAG,KAAK,CAAC;gBAC1B,MAAM,QAAQ,GAAG,IAAI,CAAC,mBAAmB,CAAC,CAAC,CAAC,CAAC;gBAC7C,IAAI,QAAQ,EAAE,CAAC;oBACb,IAAI,CAAC;wBACH,OAAO,GAAG,MAAM,EAAE,CAAC,QAAQ,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;wBAC/C,aAAa,GAAG,IAAI,CAAC;oBACvB,CAAC;oBAAC,MAAM,CAAC;wBACP,6DAA6D;oBAC/D,CAAC;gBACH,CAAC;gBACD,IAAI,IAAY,CAAC;gBACjB,IAAI,CAAC;oBACH,IAAI,GAAG,KAAK,CAAC,OAAO,CAAC,CAAC;gBACxB,CAAC;gBAAC,OAAO,GAAG,EAAE,CAAC;oBACb,8DAA8D;oBAC9D,OAAO,CAAC,IAAI,CACV,mDAAmD,CAAC,IAAI,EACxD,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG,CACzC,CAAC;oBACF,SAAS;gBACX,CAAC;gBACD,IAAI,IAAI,KAAK,OAAO;oBAAE,SAAS;gBAC/B,IAAI,CAAC;oBACH,MAAM,KAAK,CAAC,SAAS,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC;oBAC/B,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;oBAChB,WAAW,CAAC,GAAG,CAAC,CAAC,EAAE,EAAE,OAAO,EAAE,aAAa,EAAE,CAAC,CAAC;gBACjD,CAAC;gBAAC,OAAO,GAAG,EAAE,CAAC;oBACb,+DAA+D;oBAC/D,gEAAgE;oBAChE,kEAAkE;oBAClE,iEAAiE;oBACjE,iEAAiE;oBACjE,gEAAgE;oBAChE,gEAAgE;oBAChE,gEAAgE;oBAChE,mEAAmE;oBACnE,+DAA+D;oBAC/D,kEAAkE;oBAClE,OAAO,CAAC,IAAI,CACV,mDAAmD,CAAC,IAAI,EACxD,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG,CACzC,CAAC;oBACF,IAAI,QAAQ,GAAG,KAAK,CAAC;oBACrB,IAAI,CAAC;wBACH,IAAI,aAAa,EAAE,CAAC;4BAClB,MAAM,KAAK,CAAC,SAAS,CAAC,CAAC,EAAE,OAAO,CAAC,CAAC;4BAClC,QAAQ,GAAG,IAAI,CAAC;wBAClB,CAAC;6BAAM,IAAI,QAAQ,EAAE,CAAC;4BACpB,+DAA+D;4BAC/D,MAAM,EAAE,CAAC,EAAE,CAAC,QAAQ,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;4BACvC,QAAQ,GAAG,IAAI,CAAC;wBAClB,CAAC;oBACH,CAAC;oBAAC,MAAM,CAAC;wBACP,mCAAmC;oBACrC,CAAC;oBACD,IAAI,CAAC,QAAQ,EAAE,CAAC;wBACd,kBAAkB,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;wBAC1B,OAAO,CAAC,IAAI,CACV,sDAAsD,CAAC,4BAA4B,CACpF,CAAC;oBACJ,CAAC;gBACH,CAAC;YACH,CAAC;YACD,oEAAoE;YACpE,yEAAyE;YACzE,qEAAqE;YACrE,mDAAmD;YACnD,MAAM,GAAG,MAAM,QAAQ,CAAC,aAAa,CAAC,WAAW,EAAE,IAAI,EAAE,OAAO,EAAE,OAAO,CAAC,CAAC;YAC3E,IAAI,KAAK,CAAC,IAAI,GAAG,CAAC;gBAAE,IAAI,CAAC,WAAW,CAAC,aAAa,EAAE,qBAAqB,CAAC,WAAW,CAAC,CAAC;QACzF,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,GAAG,YAAY,6BAA6B,EAAE,CAAC;gBACjD,sEAAsE;gBACtE,sEAAsE;gBACtE,mEAAmE;gBACnE,qEAAqE;gBACrE,oEAAoE;gBACpE,mEAAmE;gBACnE,oEAAoE;gBACpE,kEAAkE;gBAClE,oEAAoE;gBACpE,gEAAgE;gBAChE,0DAA0D;gBAC1D,kEAAkE;gBAClE,2CAA2C;gBAC3C,MAAM,SAAS,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,CAAC;gBACnC,MAAM,UAAU,CAAC,CAAC,CAAC,EAAE,EAAE,CACrB,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,kBAAkB,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,WAAW,CACnF,CAAC;gBACF,MAAM,GAAG,CAAC;YACZ,CAAC;YACD,mEAAmE;YACnE,mEAAmE;YACnE,oEAAoE;YACpE,kEAAkE;YAClE,oEAAoE;YACpE,kCAAkC;YAClC,KAAK,MAAM,CAAC,CAAC,EAAE,GAAG,CAAC,IAAI,WAAW,EAAE,CAAC;gBACnC,IAAI,CAAC;oBACH,IAAI,GAAG,CAAC,aAAa,EAAE,CAAC;wBACtB,MAAM,KAAK,CAAC,SAAS,CAAC,CAAC,EAAE,GAAG,CAAC,OAAO,CAAC,CAAC;oBACxC,CAAC;yBAAM,CAAC;wBACN,MAAM,QAAQ,GAAG,IAAI,CAAC,mBAAmB,CAAC,CAAC,CAAC,CAAC;wBAC7C,IAAI,QAAQ;4BAAE,MAAM,EAAE,CAAC,EAAE,CAAC,QAAQ,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;oBACvD,CAAC;gBACH,CAAC;gBAAC,MAAM,CAAC;oBACP,kBAAkB,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;oBAC1B,OAAO,CAAC,IAAI,CACV,oDAAoD,CAAC,iDAAiD,CACvG,CAAC;gBACJ,CAAC;YACH,CAAC;YACD,sEAAsE;YACtE,sEAAsE;YACtE,4DAA4D;YAC5D,MAAM,UAAU,CAAC,CAAC,CAAC,EAAE,EAAE,CACrB,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,kBAAkB,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,WAAW,CACtE,CAAC;YACF,MAAM,GAAG,CAAC;QACZ,CAAC;QACD,sEAAsE;QACtE,sEAAsE;QACtE,oEAAoE;QACpE,sEAAsE;QACtE,oEAAoE;QACpE,uEAAuE;QACvE,MAAM,SAAS,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,CAAC;QACnC,MAAM,UAAU,CAAC,CAAC,CAAC,EAAE,EAAE,CACrB,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,kBAAkB,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,WAAW,CACxE,CAAC;QACF,6EAA6E;QAC7E,4EAA4E;QAC5E,+EAA+E;QAC/E,4EAA4E;QAC5E,8CAA8C;QAC9C,IAAI,MAAM,EAAE,CAAC;YACX,wEAAwE;YACxE,2DAA2D;YAC3D,IAAI,CAAC,WAAW,CAAC,WAAW,EAAE,IAAI,CAAC,EAAE,WAAW,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC;QAC5F,CAAC;QACD,OAAO,MAAM,CAAC;IAChB,CAAC;IAEQ,KAAK,CAAC,KAAK,CAAC,SAAiB,EAAE,OAAiC;QACvE,gEAAgE;QAChE,qEAAqE;QACrE,oEAAoE;QACpE,uEAAuE;QACvE,yEAAyE;QACzE,oEAAoE;QACpE,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,SAAS,EAAE,KAAK,CAAC,CAAC;QACrD,wEAAwE;QACxE,yEAAyE;QACzE,mEAAmE;QACnE,oEAAoE;QACpE,wEAAwE;QACxE,kEAAkE;QAClE,MAAM,KAAK,CAAC,KAAK,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC;QACtC,IAAI,IAAI,EAAE,IAAI,KAAK,gBAAgB;YAAE,MAAM,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC;QACnE,MAAM,YAAY,GAAG,IAAI,CAAC,mBAAmB,CAAC,SAAS,CAAC,CAAC;QACzD,IAAI,CAAC,YAAY;YAAE,OAAO;QAC1B,IAAI,OAAiB,CAAC;QACtB,IAAI,CAAC;YACH,OAAO,GAAG,MAAM,EAAE,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC;QAC3C,CAAC;QAAC,MAAM,CAAC;YACP,qEAAqE;YACrE,yDAAyD;YACzD,OAAO;QACT,CAAC;QACD,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACzB,MAAM,WAAW,GAAG,SAAS,CAAC,QAAQ,CAAC,GAAG,CAAC;gBACzC,CAAC,CAAC,GAAG,SAAS,UAAU;gBACxB,CAAC,CAAC,GAAG,SAAS,WAAW,CAAC;YAC5B,mEAAmE;YACnE,+DAA+D;YAC/D,oBAAoB;YACpB,MAAM,IAAI,CAAC,SAAS,CAAC,WAAW,EAAE,EAAE,CAAC,CAAC;QACxC,CAAC;IACH,CAAC;IAEQ,KAAK,CAAC,KAAK,CAAC,UAAkB,EAAE,QAAwB;QAC/D,mEAAmE;QACnE,iEAAiE;QACjE,mEAAmE;QACnE,iEAAiE;QACjE,+CAA+C;QAC/C,MAAM,IAAI,KAAK,CACb,kFAAkF;YAChF,oEAAoE,CACvE,CAAC;IACJ,CAAC;IAED;;;;;;;;OAQG;IACK,KAAK,CAAC,YAAY,CACxB,IAA4D;QAE5D,IAAI,CAAC;YACH,MAAM,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,SAAS,EAAE,KAAK,IAAI,EAAE;gBAC7C,IAAI,OAAO,GAAG,EAAE,CAAC;gBACjB,MAAM,QAAQ,GAAG,IAAI,CAAC,mBAAmB,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;gBAC1D,IAAI,QAAQ,EAAE,CAAC;oBACb,IAAI,CAAC;wBACH,OAAO,GAAG,MAAM,EAAE,CAAC,QAAQ,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;oBACjD,CAAC;oBAAC,MAAM,CAAC;wBACP,6DAA6D;oBAC/D,CAAC;gBACH,CAAC;gBACD,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;gBACjC,IAAI,IAAI,KAAK,OAAO;oBAAE,MAAM,KAAK,CAAC,SAAS,CAAC,IAAI,CAAC,SAAS,EAAE,IAAI,CAAC,CAAC;YACpE,CAAC,CAAC,CAAC;YACH,IAAI,CAAC,WAAW,CAAC,aAAa,EAAE,qBAAqB,CAAC,IAAI,CAAC,WAAW,CAAC,WAAW,CAAC,CAAC;QACtF,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,OAAO,CAAC,IAAI,CACV,mDAAmD,IAAI,CAAC,SAAS,IAAI,EACrE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG,CACzC,CAAC;QACJ,CAAC;IACH,CAAC;IAED;;;;;OAKG;IACK,KAAK,CAAC,UAAU,CACtB,SAAiB,EACjB,IAAoB;QAEpB,MAAM,EAAE,aAAa,EAAE,WAAW,EAAE,IAAI,EAAE,GAAG,IAAI,CAAC,WAAW,CAAC;QAC9D,IAAI,CAAC,aAAa;YAAE,OAAO,IAAI,CAAC;QAChC,IAAI,CAAC;YACH,OAAO,MAAM,aAAa,CAAC,aAAa,CAAC,WAAW,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,CAAC,CAAC;QAC/E,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,OAAO,CAAC,IAAI,CACV,wDAAwD,SAAS,IAAI,EACrE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG,CACzC,CAAC;YACF,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC;IAED;;;;;;OAMG;IACK,KAAK,CAAC,QAAQ,CAAI,SAAiB,EAAE,EAAoB;QAC/D,MAAM,EAAE,QAAQ,EAAE,WAAW,EAAE,MAAM,EAAE,IAAI,EAAE,GAAG,IAAI,CAAC,WAAW,CAAC;QAEjE,IAAI,cAAc,GAAkB,IAAI,CAAC;QACzC,IAAI,QAAQ,GAAG,KAAK,CAAC;QACrB,KAAK,IAAI,OAAO,GAAG,CAAC,EAAE,OAAO,GAAG,sBAAsB,EAAE,OAAO,EAAE,EAAE,CAAC;YAClE,MAAM,MAAM,GAAG,MAAM,QAAQ,CAAC,WAAW,CAAC,WAAW,EAAE,MAAM,EAAE,SAAS,EAAE,IAAI,CAAC,CAAC;YAChF,IAAI,MAAM,CAAC,QAAQ,EAAE,CAAC;gBACpB,QAAQ,GAAG,IAAI,CAAC;gBAChB,MAAM;YACR,CAAC;YACD,cAAc,GAAG,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC;YACxC,IAAI,OAAO,GAAG,sBAAsB,GAAG,CAAC,EAAE,CAAC;gBACzC,MAAM,KAAK,CAAC,sBAAsB,CAAC,CAAC;YACtC,CAAC;QACH,CAAC;QACD,IAAI,CAAC,QAAQ,EAAE,CAAC;YACd,MAAM,IAAI,KAAK,CACb,oBAAoB,SAAS,iBAAiB,cAAc,IAAI,cAAc,IAAI;gBAChF,wDAAwD,CAC3D,CAAC;QACJ,CAAC;QAED,IAAI,MAAS,CAAC;QACd,IAAI,CAAC;YACH,MAAM,GAAG,MAAM,EAAE,EAAE,CAAC;QACtB,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,mEAAmE;YACnE,mEAAmE;YACnE,kEAAkE;YAClE,gEAAgE;YAChE,gEAAgE;YAChE,yDAAyD;YACzD,IAAI,CAAC;gBACH,MAAM,QAAQ,CAAC,mBAAmB,CAAC,WAAW,EAAE,MAAM,EAAE,SAAS,EAAE,IAAI,CAAC,CAAC;YAC3E,CAAC;YAAC,OAAO,UAAU,EAAE,CAAC;gBACpB,OAAO,CAAC,IAAI,CACV,gDAAgD,SAAS,mBAAmB,EAC5E,UAAU,YAAY,KAAK,CAAC,CAAC,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC,CAAC,UAAU,CAC9D,CAAC;YACJ,CAAC;YACD,MAAM,GAAG,CAAC;QACZ,CAAC;QAED,sEAAsE;QACtE,oEAAoE;QACpE,gEAAgE;QAChE,iEAAiE;QACjE,mEAAmE;QACnE,MAAM,QAAQ,CAAC,WAAW,CAAC,WAAW,EAAE,MAAM,EAAE,SAAS,EAAE,IAAI,CAAC,CAAC;QACjE,OAAO,MAAM,CAAC;IAChB,CAAC;CACF;AAED,SAAS,KAAK,CAAC,EAAU;IACvB,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,UAAU,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,CAAC;AAC3D,CAAC"}
+{"version":3,"file":"locking-filesystem.js","sourceRoot":"","sources":["../../../src/modules/kb-fs/locking-filesystem.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgCG;AAEH,OAAO,EAAE,MAAM,kBAAkB,CAAC;AAClC,OAAO,EACL,eAAe,GAMhB,MAAM,wBAAwB,CAAC;AAEhC,OAAO,EAAE,6BAA6B,EAAE,MAAM,+BAA+B,CAAC;AAE9E,OAAO,EAAE,gBAAgB,EAAE,MAAM,gBAAgB,CAAC;AAGlD,oEAAoE;AACpE,MAAM,sBAAsB,GAAG,CAAC,CAAC;AACjC,kEAAkE;AAClE,MAAM,sBAAsB,GAAG,KAAK,CAAC;AAiDrC,MAAM,OAAO,iBAAkB,SAAQ,eAAe;IACnC,WAAW,CAA2B;IAEvD,YACE,OAA+B,EAC/B,WAAqC;QAErC,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,WAAW,GAAG,WAAW,CAAC;IACjC,CAAC;IAEQ,KAAK,CAAC,SAAS,CACtB,SAAiB,EACjB,OAAoB,EACpB,OAAsB;QAEtB,IAAI,CAAC,gBAAgB,CAAC,SAAS,CAAC,CAAC;QACjC,4EAA4E;QAC5E,+DAA+D;QAC/D,IAAI,CAAC,WAAW,CAAC,aAAa,EAAE,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC;QACrD,2EAA2E;QAC3E,mEAAmE;QACnE,uEAAuE;QACvE,kEAAkE;QAClE,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC;QACtD,IAAI,IAAI,EAAE,IAAI,KAAK,gBAAgB;YAAE,MAAM,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC;QACnE,MAAM,OAAO,GACX,IAAI,EAAE,IAAI,KAAK,aAAa,IAAI,OAAO,OAAO,KAAK,QAAQ;YACzD,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC;YACrB,CAAC,CAAC,OAAO,CAAC;QACd,OAAO,IAAI,CAAC,QAAQ,CAAC,SAAS,EAAE,GAAG,EAAE,CAAC,KAAK,CAAC,SAAS,CAAC,SAAS,EAAE,OAAO,EAAE,OAAO,CAAC,CAAC,CAAC;IACtF,CAAC;IAEQ,KAAK,CAAC,UAAU,CAAC,SAAiB,EAAE,OAAoB;QAC/D,IAAI,CAAC,gBAAgB,CAAC,SAAS,CAAC,CAAC;QACjC,OAAO,IAAI,CAAC,QAAQ,CAAC,SAAS,EAAE,GAAG,EAAE,CAAC,KAAK,CAAC,UAAU,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC,CAAC;IAC9E,CAAC;IAEQ,KAAK,CAAC,UAAU,CAAC,SAAiB,EAAE,OAAuB;QAClE,OAAO,IAAI,CAAC,QAAQ,CAAC,SAAS,EAAE,GAAG,EAAE,CAAC,KAAK,CAAC,UAAU,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC,CAAC;IAC9E,CAAC;IAEQ,KAAK,CAAC,QAAQ,CAAC,GAAW,EAAE,IAAY,EAAE,OAAqB;QACtE,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,CAAC;QAC5B,uEAAuE;QACvE,6DAA6D;QAC7D,OAAO,IAAI,CAAC,QAAQ,CAAC,IAAI,EAAE,GAAG,EAAE,CAAC,KAAK,CAAC,QAAQ,CAAC,GAAG,EAAE,IAAI,EAAE,OAAO,CAAC,CAAC,CAAC;IACvE,CAAC;IAEQ,KAAK,CAAC,QAAQ,CAAC,GAAW,EAAE,IAAY,EAAE,OAAqB;QACtE,2EAA2E;QAC3E,+DAA+D;QAC/D,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,CAAC;QAC5B,sEAAsE;QACtE,qEAAqE;QACrE,qEAAqE;QACrE,uEAAuE;QACvE,iEAAiE;QACjE,EAAE;QACF,mEAAmE;QACnE,qEAAqE;QACrE,qEAAqE;QACrE,qEAAqE;QACrE,6DAA6D;QAC7D,oEAAoE;QACpE,IAAI,GAAG,KAAK,IAAI,EAAE,CAAC;YACjB,OAAO,IAAI,CAAC,QAAQ,CAAC,IAAI,EAAE,GAAG,EAAE,CAAC,KAAK,CAAC,QAAQ,CAAC,GAAG,EAAE,IAAI,EAAE,OAAO,CAAC,CAAC,CAAC;QACvE,CAAC;QACD,MAAM,CAAC,KAAK,EAAE,MAAM,CAAC,GAAG,GAAG,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;QAC/D,OAAO,IAAI,CAAC,QAAQ,CAAC,KAAK,EAAE,GAAG,EAAE,CAC/B,IAAI,CAAC,QAAQ,CAAC,MAAM,EAAE,GAAG,EAAE,CAAC,KAAK,CAAC,QAAQ,CAAC,GAAG,EAAE,IAAI,EAAE,OAAO,CAAC,CAAC,CAChE,CAAC;IACJ,CAAC;IAED;;;;;;;;;;;;;;;;;;;;OAoBG;IACH,KAAK,CAAC,UAAU,CACd,MAAgD,EAChD,OAAe,EACf,UAAoB,EAAE;QAEtB,MAAM,EAAE,QAAQ,EAAE,WAAW,EAAE,MAAM,EAAE,IAAI,EAAE,GAAG,IAAI,CAAC,WAAW,CAAC;QACjE,0EAA0E;QAC1E,+DAA+D;QAC/D,KAAK,MAAM,CAAC,IAAI,MAAM;YAAE,IAAI,CAAC,gBAAgB,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;QACtD,mEAAmE;QACnE,uEAAuE;QACvE,wEAAwE;QACxE,wEAAwE;QACxE,0EAA0E;QAC1E,yEAAyE;QACzE,OAAO;QACP,MAAM,KAAK,GAAG,IAAI,GAAG,EAAuC,CAAC;QAC7D,MAAM,aAAa,GAA6C,EAAE,CAAC;QACnE,KAAK,MAAM,CAAC,IAAI,MAAM,EAAE,CAAC;YACvB,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;YACnD,IAAI,IAAI,EAAE,IAAI,KAAK,gBAAgB,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC;gBACtF,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC;YACxC,CAAC;YACD,aAAa,CAAC,IAAI,CAChB,IAAI,EAAE,IAAI,KAAK,aAAa,IAAI,OAAO,CAAC,CAAC,OAAO,KAAK,QAAQ;gBAC3D,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,OAAO,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE;gBAClD,CAAC,CAAC,CAAC,CACN,CAAC;QACJ,CAAC;QACD,MAAM,GAAG,aAAa,CAAC;QACvB,sEAAsE;QACtE,iEAAiE;QACjE,IAAI,IAAI,CAAC,WAAW,CAAC,aAAa,EAAE,CAAC;YACnC,KAAK,MAAM,CAAC,IAAI,MAAM;gBAAE,IAAI,CAAC,WAAW,CAAC,aAAa,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC;QAC5E,CAAC;QACD,wEAAwE;QACxE,2EAA2E;QAC3E,8EAA8E;QAC9E,6DAA6D;QAC7D,MAAM,KAAK,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,CAAC,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;QAC9E,MAAM,QAAQ,GAAa,EAAE,CAAC;QAC9B,wEAAwE;QACxE,wEAAwE;QACxE,wEAAwE;QACxE,sEAAsE;QACtE,mEAAmE;QACnE,4CAA4C;QAC5C,MAAM,OAAO,GAAG,IAAI,GAAG,EAAU,CAAC;QAClC,oEAAoE;QACpE,qEAAqE;QACrE,iEAAiE;QACjE,MAAM,kBAAkB,GAAG,IAAI,GAAG,EAAU,CAAC;QAC7C,mEAAmE;QACnE,uEAAuE;QACvE,EAAE;QACF,yEAAyE;QACzE,wEAAwE;QACxE,qEAAqE;QACrE,sEAAsE;QACtE,sEAAsE;QACtE,uEAAuE;QACvE,qEAAqE;QACrE,uEAAuE;QACvE,wEAAwE;QACxE,sEAAsE;QACtE,sEAAsE;QACtE,wEAAwE;QACxE,wEAAwE;QACxE,8BAA8B;QAC9B,MAAM,UAAU,GAAG,KAAK,EACtB,MAA0D,EAC3C,EAAE;YACjB,KAAK,MAAM,CAAC,IAAI,QAAQ,EAAE,CAAC;gBACzB,IAAI,CAAC;oBACH,MAAM,IAAI,GAAG,MAAM,CAAC,CAAC,CAAC,CAAC;oBACvB,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;wBACvB,MAAM,QAAQ,CAAC,mBAAmB,CAAC,WAAW,EAAE,MAAM,EAAE,CAAC,EAAE,IAAI,CAAC,CAAC;oBACnE,CAAC;yBAAM,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;wBAC9B,MAAM,QAAQ,CAAC,WAAW,CAAC,WAAW,EAAE,MAAM,EAAE,CAAC,EAAE,IAAI,CAAC,CAAC;oBAC3D,CAAC;yBAAM,CAAC;wBACN,MAAM,QAAQ,CAAC,oBAAoB,CAAC,WAAW,EAAE,MAAM,EAAE,CAAC,EAAE,IAAI,CAAC,CAAC;oBACpE,CAAC;gBACH,CAAC;gBAAC,OAAO,UAAU,EAAE,CAAC;oBACpB,OAAO,CAAC,IAAI,CACV,yCAAyC,CAAC,sBAAsB,EAChE,UAAU,YAAY,KAAK,CAAC,CAAC,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC,CAAC,UAAU,CAC9D,CAAC;gBACJ,CAAC;YACH,CAAC;QACH,CAAC,CAAC;QAEF,oEAAoE;QACpE,KAAK,MAAM,CAAC,IAAI,KAAK,EAAE,CAAC;YACtB,IAAI,UAAU,GAAkB,IAAI,CAAC;YACrC,IAAI,EAAE,GAAG,KAAK,CAAC;YACf,KAAK,IAAI,OAAO,GAAG,CAAC,EAAE,OAAO,GAAG,sBAAsB,EAAE,OAAO,EAAE,EAAE,CAAC;gBAClE,MAAM,MAAM,GAAG,MAAM,QAAQ,CAAC,WAAW,CAAC,WAAW,EAAE,MAAM,EAAE,CAAC,EAAE,IAAI,CAAC,CAAC;gBACxE,IAAI,MAAM,CAAC,QAAQ,EAAE,CAAC;oBACpB,EAAE,GAAG,IAAI,CAAC;oBACV,MAAM;gBACR,CAAC;gBACD,UAAU,GAAG,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC;gBACpC,IAAI,OAAO,GAAG,sBAAsB,GAAG,CAAC;oBAAE,MAAM,KAAK,CAAC,sBAAsB,CAAC,CAAC;YAChF,CAAC;YACD,IAAI,CAAC,EAAE,EAAE,CAAC;gBACR,oEAAoE;gBACpE,4DAA4D;gBAC5D,MAAM,UAAU,CAAC,GAAG,EAAE,CAAC,WAAW,CAAC,CAAC;gBACpC,MAAM,IAAI,KAAK,CACb,oBAAoB,CAAC,iBAAiB,UAAU,IAAI,cAAc,IAAI;oBACpE,wDAAwD,CAC3D,CAAC;YACJ,CAAC;YACD,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QACnB,CAAC;QAED,qEAAqE;QACrE,sEAAsE;QACtE,wEAAwE;QACxE,0EAA0E;QAC1E,KAAK,MAAM,CAAC,IAAI,CAAC,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC;YACzC,IAAI,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC;gBAAE,SAAS,CAAC,kCAAkC;YACnE,MAAM,MAAM,GAAG,MAAM,QAAQ,CAAC,WAAW,CAAC,WAAW,EAAE,MAAM,EAAE,CAAC,EAAE,IAAI,CAAC,CAAC;YACxE,IAAI,MAAM,CAAC,QAAQ,EAAE,CAAC;gBACpB,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;YACnB,CAAC;iBAAM,CAAC;gBACN,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;gBAChB,OAAO,CAAC,IAAI,CACV,oDAAoD,CAAC,iBAAiB,MAAM,CAAC,IAAI,CAAC,UAAU,IAAI,cAAc,EAAE,CACjH,CAAC;YACJ,CAAC;QACH,CAAC;QAED,yEAAyE;QACzE,qEAAqE;QACrE,yEAAyE;QACzE,sEAAsE;QACtE,sEAAsE;QACtE,wDAAwD;QACxD,MAAM,OAAO,GAAG,CAAC,GAAG,KAAK,CAAC,CAAC;QAC3B,sEAAsE;QACtE,sEAAsE;QACtE,sEAAsE;QACtE,uEAAuE;QACvE,MAAM,WAAW,GAAG,IAAI,GAAG,EAAuD,CAAC;QACnF,IAAI,MAAqB,CAAC;QAC1B,IAAI,CAAC;YACH,wEAAwE;YACxE,2EAA2E;YAC3E,2EAA2E;YAC3E,KAAK,MAAM,CAAC,IAAI,MAAM,EAAE,CAAC;gBACvB,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;gBACpB,MAAM,KAAK,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC;YAC3C,CAAC;YACD,KAAK,MAAM,CAAC,IAAI,OAAO,EAAE,CAAC;gBACxB,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;gBACf,MAAM,KAAK,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC;YAC5B,CAAC;YACD,wEAAwE;YACxE,0EAA0E;YAC1E,KAAK,MAAM,CAAC,CAAC,EAAE,KAAK,CAAC,IAAI,KAAK,EAAE,CAAC;gBAC/B,IAAI,OAAO,GAAG,EAAE,CAAC;gBACjB,IAAI,aAAa,GAAG,KAAK,CAAC;gBAC1B,MAAM,QAAQ,GAAG,IAAI,CAAC,mBAAmB,CAAC,CAAC,CAAC,CAAC;gBAC7C,IAAI,QAAQ,EAAE,CAAC;oBACb,IAAI,CAAC;wBACH,OAAO,GAAG,MAAM,EAAE,CAAC,QAAQ,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;wBAC/C,aAAa,GAAG,IAAI,CAAC;oBACvB,CAAC;oBAAC,MAAM,CAAC;wBACP,6DAA6D;oBAC/D,CAAC;gBACH,CAAC;gBACD,IAAI,IAAY,CAAC;gBACjB,IAAI,CAAC;oBACH,IAAI,GAAG,KAAK,CAAC,OAAO,CAAC,CAAC;gBACxB,CAAC;gBAAC,OAAO,GAAG,EAAE,CAAC;oBACb,8DAA8D;oBAC9D,OAAO,CAAC,IAAI,CACV,mDAAmD,CAAC,IAAI,EACxD,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG,CACzC,CAAC;oBACF,SAAS;gBACX,CAAC;gBACD,IAAI,IAAI,KAAK,OAAO;oBAAE,SAAS;gBAC/B,IAAI,CAAC;oBACH,MAAM,KAAK,CAAC,SAAS,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC;oBAC/B,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;oBAChB,WAAW,CAAC,GAAG,CAAC,CAAC,EAAE,EAAE,OAAO,EAAE,aAAa,EAAE,CAAC,CAAC;gBACjD,CAAC;gBAAC,OAAO,GAAG,EAAE,CAAC;oBACb,+DAA+D;oBAC/D,gEAAgE;oBAChE,kEAAkE;oBAClE,iEAAiE;oBACjE,iEAAiE;oBACjE,gEAAgE;oBAChE,gEAAgE;oBAChE,gEAAgE;oBAChE,mEAAmE;oBACnE,+DAA+D;oBAC/D,kEAAkE;oBAClE,OAAO,CAAC,IAAI,CACV,mDAAmD,CAAC,IAAI,EACxD,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG,CACzC,CAAC;oBACF,IAAI,QAAQ,GAAG,KAAK,CAAC;oBACrB,IAAI,CAAC;wBACH,IAAI,aAAa,EAAE,CAAC;4BAClB,MAAM,KAAK,CAAC,SAAS,CAAC,CAAC,EAAE,OAAO,CAAC,CAAC;4BAClC,QAAQ,GAAG,IAAI,CAAC;wBAClB,CAAC;6BAAM,IAAI,QAAQ,EAAE,CAAC;4BACpB,+DAA+D;4BAC/D,MAAM,EAAE,CAAC,EAAE,CAAC,QAAQ,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;4BACvC,QAAQ,GAAG,IAAI,CAAC;wBAClB,CAAC;oBACH,CAAC;oBAAC,MAAM,CAAC;wBACP,mCAAmC;oBACrC,CAAC;oBACD,IAAI,CAAC,QAAQ,EAAE,CAAC;wBACd,kBAAkB,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;wBAC1B,OAAO,CAAC,IAAI,CACV,sDAAsD,CAAC,4BAA4B,CACpF,CAAC;oBACJ,CAAC;gBACH,CAAC;YACH,CAAC;YACD,oEAAoE;YACpE,yEAAyE;YACzE,qEAAqE;YACrE,mDAAmD;YACnD,MAAM,GAAG,MAAM,QAAQ,CAAC,aAAa,CAAC,WAAW,EAAE,IAAI,EAAE,OAAO,EAAE,OAAO,CAAC,CAAC;YAC3E,IAAI,KAAK,CAAC,IAAI,GAAG,CAAC;gBAAE,IAAI,CAAC,WAAW,CAAC,aAAa,EAAE,qBAAqB,CAAC,WAAW,CAAC,CAAC;QACzF,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,GAAG,YAAY,6BAA6B,EAAE,CAAC;gBACjD,sEAAsE;gBACtE,sEAAsE;gBACtE,mEAAmE;gBACnE,qEAAqE;gBACrE,oEAAoE;gBACpE,mEAAmE;gBACnE,oEAAoE;gBACpE,kEAAkE;gBAClE,oEAAoE;gBACpE,gEAAgE;gBAChE,0DAA0D;gBAC1D,kEAAkE;gBAClE,2CAA2C;gBAC3C,MAAM,SAAS,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,CAAC;gBACnC,MAAM,UAAU,CAAC,CAAC,CAAC,EAAE,EAAE,CACrB,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,kBAAkB,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,WAAW,CACnF,CAAC;gBACF,MAAM,GAAG,CAAC;YACZ,CAAC;YACD,mEAAmE;YACnE,mEAAmE;YACnE,oEAAoE;YACpE,kEAAkE;YAClE,oEAAoE;YACpE,kCAAkC;YAClC,KAAK,MAAM,CAAC,CAAC,EAAE,GAAG,CAAC,IAAI,WAAW,EAAE,CAAC;gBACnC,IAAI,CAAC;oBACH,IAAI,GAAG,CAAC,aAAa,EAAE,CAAC;wBACtB,MAAM,KAAK,CAAC,SAAS,CAAC,CAAC,EAAE,GAAG,CAAC,OAAO,CAAC,CAAC;oBACxC,CAAC;yBAAM,CAAC;wBACN,MAAM,QAAQ,GAAG,IAAI,CAAC,mBAAmB,CAAC,CAAC,CAAC,CAAC;wBAC7C,IAAI,QAAQ;4BAAE,MAAM,EAAE,CAAC,EAAE,CAAC,QAAQ,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;oBACvD,CAAC;gBACH,CAAC;gBAAC,MAAM,CAAC;oBACP,kBAAkB,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;oBAC1B,OAAO,CAAC,IAAI,CACV,oDAAoD,CAAC,iDAAiD,CACvG,CAAC;gBACJ,CAAC;YACH,CAAC;YACD,sEAAsE;YACtE,sEAAsE;YACtE,4DAA4D;YAC5D,MAAM,UAAU,CAAC,CAAC,CAAC,EAAE,EAAE,CACrB,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,kBAAkB,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,WAAW,CACtE,CAAC;YACF,MAAM,GAAG,CAAC;QACZ,CAAC;QACD,sEAAsE;QACtE,sEAAsE;QACtE,oEAAoE;QACpE,sEAAsE;QACtE,oEAAoE;QACpE,uEAAuE;QACvE,MAAM,SAAS,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,CAAC;QACnC,MAAM,UAAU,CAAC,CAAC,CAAC,EAAE,EAAE,CACrB,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,kBAAkB,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,WAAW,CACxE,CAAC;QACF,6EAA6E;QAC7E,4EAA4E;QAC5E,+EAA+E;QAC/E,4EAA4E;QAC5E,8CAA8C;QAC9C,IAAI,MAAM,EAAE,CAAC;YACX,wEAAwE;YACxE,2DAA2D;YAC3D,IAAI,CAAC,WAAW,CAAC,WAAW,EAAE,IAAI,CAAC,EAAE,WAAW,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC;QAC5F,CAAC;QACD,OAAO,MAAM,CAAC;IAChB,CAAC;IAEQ,KAAK,CAAC,KAAK,CAAC,SAAiB,EAAE,OAAiC;QACvE,IAAI,CAAC,gBAAgB,CAAC,SAAS,CAAC,CAAC;QACjC,gEAAgE;QAChE,qEAAqE;QACrE,oEAAoE;QACpE,uEAAuE;QACvE,yEAAyE;QACzE,oEAAoE;QACpE,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,SAAS,EAAE,KAAK,CAAC,CAAC;QACrD,wEAAwE;QACxE,yEAAyE;QACzE,mEAAmE;QACnE,oEAAoE;QACpE,wEAAwE;QACxE,kEAAkE;QAClE,MAAM,KAAK,CAAC,KAAK,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC;QACtC,IAAI,IAAI,EAAE,IAAI,KAAK,gBAAgB;YAAE,MAAM,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC;QACnE,MAAM,YAAY,GAAG,IAAI,CAAC,mBAAmB,CAAC,SAAS,CAAC,CAAC;QACzD,IAAI,CAAC,YAAY;YAAE,OAAO;QAC1B,IAAI,OAAiB,CAAC;QACtB,IAAI,CAAC;YACH,OAAO,GAAG,MAAM,EAAE,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC;QAC3C,CAAC;QAAC,MAAM,CAAC;YACP,qEAAqE;YACrE,yDAAyD;YACzD,OAAO;QACT,CAAC;QACD,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACzB,MAAM,WAAW,GAAG,SAAS,CAAC,QAAQ,CAAC,GAAG,CAAC;gBACzC,CAAC,CAAC,GAAG,SAAS,UAAU;gBACxB,CAAC,CAAC,GAAG,SAAS,WAAW,CAAC;YAC5B,mEAAmE;YACnE,+DAA+D;YAC/D,oBAAoB;YACpB,MAAM,IAAI,CAAC,SAAS,CAAC,WAAW,EAAE,EAAE,CAAC,CAAC;QACxC,CAAC;IACH,CAAC;IAEQ,KAAK,CAAC,KAAK,CAAC,UAAkB,EAAE,QAAwB;QAC/D,mEAAmE;QACnE,iEAAiE;QACjE,mEAAmE;QACnE,iEAAiE;QACjE,+CAA+C;QAC/C,MAAM,IAAI,KAAK,CACb,kFAAkF;YAChF,oEAAoE,CACvE,CAAC;IACJ,CAAC;IAED;;;;OAIG;IACK,gBAAgB,CAAC,SAAiB;QACxC,gBAAgB,CAAC,SAAS,EAAE,IAAI,CAAC,WAAW,CAAC,SAAS,CAAC,CAAC;IAC1D,CAAC;IAED;;;;;;;;OAQG;IACK,KAAK,CAAC,YAAY,CACxB,IAA4D;QAE5D,IAAI,CAAC;YACH,MAAM,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,SAAS,EAAE,KAAK,IAAI,EAAE;gBAC7C,IAAI,OAAO,GAAG,EAAE,CAAC;gBACjB,MAAM,QAAQ,GAAG,IAAI,CAAC,mBAAmB,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;gBAC1D,IAAI,QAAQ,EAAE,CAAC;oBACb,IAAI,CAAC;wBACH,OAAO,GAAG,MAAM,EAAE,CAAC,QAAQ,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;oBACjD,CAAC;oBAAC,MAAM,CAAC;wBACP,6DAA6D;oBAC/D,CAAC;gBACH,CAAC;gBACD,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;gBACjC,IAAI,IAAI,KAAK,OAAO;oBAAE,MAAM,KAAK,CAAC,SAAS,CAAC,IAAI,CAAC,SAAS,EAAE,IAAI,CAAC,CAAC;YACpE,CAAC,CAAC,CAAC;YACH,IAAI,CAAC,WAAW,CAAC,aAAa,EAAE,qBAAqB,CAAC,IAAI,CAAC,WAAW,CAAC,WAAW,CAAC,CAAC;QACtF,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,OAAO,CAAC,IAAI,CACV,mDAAmD,IAAI,CAAC,SAAS,IAAI,EACrE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG,CACzC,CAAC;QACJ,CAAC;IACH,CAAC;IAED;;;;;OAKG;IACK,KAAK,CAAC,UAAU,CACtB,SAAiB,EACjB,IAAoB;QAEpB,MAAM,EAAE,aAAa,EAAE,WAAW,EAAE,IAAI,EAAE,GAAG,IAAI,CAAC,WAAW,CAAC;QAC9D,IAAI,CAAC,aAAa;YAAE,OAAO,IAAI,CAAC;QAChC,IAAI,CAAC;YACH,OAAO,MAAM,aAAa,CAAC,aAAa,CAAC,WAAW,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,CAAC,CAAC;QAC/E,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,OAAO,CAAC,IAAI,CACV,wDAAwD,SAAS,IAAI,EACrE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG,CACzC,CAAC;YACF,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC;IAED;;;;;;OAMG;IACK,KAAK,CAAC,QAAQ,CAAI,SAAiB,EAAE,EAAoB;QAC/D,MAAM,EAAE,QAAQ,EAAE,WAAW,EAAE,MAAM,EAAE,IAAI,EAAE,GAAG,IAAI,CAAC,WAAW,CAAC;QAEjE,IAAI,cAAc,GAAkB,IAAI,CAAC;QACzC,IAAI,QAAQ,GAAG,KAAK,CAAC;QACrB,KAAK,IAAI,OAAO,GAAG,CAAC,EAAE,OAAO,GAAG,sBAAsB,EAAE,OAAO,EAAE,EAAE,CAAC;YAClE,MAAM,MAAM,GAAG,MAAM,QAAQ,CAAC,WAAW,CAAC,WAAW,EAAE,MAAM,EAAE,SAAS,EAAE,IAAI,CAAC,CAAC;YAChF,IAAI,MAAM,CAAC,QAAQ,EAAE,CAAC;gBACpB,QAAQ,GAAG,IAAI,CAAC;gBAChB,MAAM;YACR,CAAC;YACD,cAAc,GAAG,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC;YACxC,IAAI,OAAO,GAAG,sBAAsB,GAAG,CAAC,EAAE,CAAC;gBACzC,MAAM,KAAK,CAAC,sBAAsB,CAAC,CAAC;YACtC,CAAC;QACH,CAAC;QACD,IAAI,CAAC,QAAQ,EAAE,CAAC;YACd,MAAM,IAAI,KAAK,CACb,oBAAoB,SAAS,iBAAiB,cAAc,IAAI,cAAc,IAAI;gBAChF,wDAAwD,CAC3D,CAAC;QACJ,CAAC;QAED,IAAI,MAAS,CAAC;QACd,IAAI,CAAC;YACH,MAAM,GAAG,MAAM,EAAE,EAAE,CAAC;QACtB,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,mEAAmE;YACnE,mEAAmE;YACnE,kEAAkE;YAClE,gEAAgE;YAChE,gEAAgE;YAChE,yDAAyD;YACzD,IAAI,CAAC;gBACH,MAAM,QAAQ,CAAC,mBAAmB,CAAC,WAAW,EAAE,MAAM,EAAE,SAAS,EAAE,IAAI,CAAC,CAAC;YAC3E,CAAC;YAAC,OAAO,UAAU,EAAE,CAAC;gBACpB,OAAO,CAAC,IAAI,CACV,gDAAgD,SAAS,mBAAmB,EAC5E,UAAU,YAAY,KAAK,CAAC,CAAC,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC,CAAC,UAAU,CAC9D,CAAC;YACJ,CAAC;YACD,MAAM,GAAG,CAAC;QACZ,CAAC;QAED,sEAAsE;QACtE,oEAAoE;QACpE,gEAAgE;QAChE,iEAAiE;QACjE,mEAAmE;QACnE,MAAM,QAAQ,CAAC,WAAW,CAAC,WAAW,EAAE,MAAM,EAAE,SAAS,EAAE,IAAI,CAAC,CAAC;QACjE,OAAO,MAAM,CAAC;IAChB,CAAC;CACF;AAED,SAAS,KAAK,CAAC,EAAU;IACvB,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,UAAU,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,CAAC;AAC3D,CAAC"}

package/dist/modules/kb-fs/repo-path.d.ts

@@ -0,0 +1,32 @@
+/**
+ * Workspace-relative paths and the repository folder.
+ *
+ * A workspace directory holds the git clone as `<kbDirName>/` (plus transient
+ * scratch such as `tmp/`). The agent filesystem, the lock keys and the human
+ * editor all speak WORKSPACE-relative paths, so a path reaches git only when
+ * it starts with that folder. `KnowledgeBase/Foo.md` on its own is not a
+ * shorthand for `knowledge-base/KnowledgeBase/Foo.md`: it is a different
+ * location, beside the clone, that nothing commits and nothing pushes.
+ */
+/**
+ * True when `wsPath` is the repository folder or lies under it.
+ *
+ * Judged segment by segment, not by string prefix: `knowledge-base/../x.md`
+ * starts with the folder yet resolves beside it, and the filesystem's own
+ * containment is against the WORKSPACE dir, so it would accept that path.
+ * `.` and `..` segments (and empty ones from `//`) are therefore refused
+ * outright, and so is any backslash: on Windows it separates segments too,
+ * so `foo\..\..` would climb the same way. Both match what the commit layer
+ * accepts. A single trailing slash on a directory path is tolerated.
+ */
+export declare function isInsideRepo(wsPath: string, kbDirName: string): boolean;
+/**
+ * Refuse a workspace-relative path that would land outside the repository.
+ * The message carries the corrected path so an agent can retry without
+ * guessing; the payload carries a typed discriminator for callers that
+ * switch on it, plus the same corrected path on its own, for a consumer
+ * that cannot rely on the message surviving intact (the pending-commits
+ * worker stores a sanitized, truncated copy).
+ */
+export declare function assertInsideRepo(wsPath: string, kbDirName: string): void;
+//# sourceMappingURL=repo-path.d.ts.map

package/dist/modules/kb-fs/repo-path.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"repo-path.d.ts","sourceRoot":"","sources":["../../../src/modules/kb-fs/repo-path.ts"],"names":[],"mappings":"AAGA;;;;;;;;;GASG;AAEH;;;;;;;;;;GAUG;AACH,wBAAgB,YAAY,CAAC,MAAM,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,OAAO,CAKvE;AAED;;;;;;;GAOG;AACH,wBAAgB,gBAAgB,CAAC,MAAM,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,IAAI,CAexE"}

package/dist/modules/kb-fs/repo-path.js

@@ -0,0 +1,54 @@
+import path from 'node:path';
+import { WorkflowValidationError } from '../../shared/domain-errors.js';
+/**
+ * Workspace-relative paths and the repository folder.
+ *
+ * A workspace directory holds the git clone as `<kbDirName>/` (plus transient
+ * scratch such as `tmp/`). The agent filesystem, the lock keys and the human
+ * editor all speak WORKSPACE-relative paths, so a path reaches git only when
+ * it starts with that folder. `KnowledgeBase/Foo.md` on its own is not a
+ * shorthand for `knowledge-base/KnowledgeBase/Foo.md`: it is a different
+ * location, beside the clone, that nothing commits and nothing pushes.
+ */
+/**
+ * True when `wsPath` is the repository folder or lies under it.
+ *
+ * Judged segment by segment, not by string prefix: `knowledge-base/../x.md`
+ * starts with the folder yet resolves beside it, and the filesystem's own
+ * containment is against the WORKSPACE dir, so it would accept that path.
+ * `.` and `..` segments (and empty ones from `//`) are therefore refused
+ * outright, and so is any backslash: on Windows it separates segments too,
+ * so `foo\..\..` would climb the same way. Both match what the commit layer
+ * accepts. A single trailing slash on a directory path is tolerated.
+ */
+export function isInsideRepo(wsPath, kbDirName) {
+    if (typeof wsPath !== 'string' || wsPath.includes('\\'))
+        return false;
+    const segments = wsPath.replace(/\/$/, '').split('/');
+    if (segments[0] !== kbDirName)
+        return false;
+    return segments.every((segment) => segment !== '' && segment !== '.' && segment !== '..');
+}
+/**
+ * Refuse a workspace-relative path that would land outside the repository.
+ * The message carries the corrected path so an agent can retry without
+ * guessing; the payload carries a typed discriminator for callers that
+ * switch on it, plus the same corrected path on its own, for a consumer
+ * that cannot rely on the message surviving intact (the pending-commits
+ * worker stores a sanitized, truncated copy).
+ */
+export function assertInsideRepo(wsPath, kbDirName) {
+    if (isInsideRepo(wsPath, kbDirName))
+        return;
+    // The suggestion collapses what made the path wrong: backslashes, leading
+    // `./` or `/`, and any `..` climbing back out (a bare `..` included, so the
+    // suggestion is never itself a climb). The agent gets a path it can use.
+    const normalized = path.posix
+        .normalize(String(wsPath).replace(/\\/g, '/').replace(/^(\.\/|\/)+/, ''))
+        .replace(/^(\.\.(\/|$))+/, '')
+        .replace(/^\.$/, '');
+    const corrected = isInsideRepo(normalized, kbDirName) ? normalized : `${kbDirName}/${normalized}`;
+    throw new WorkflowValidationError(`"${wsPath}" is outside the knowledge base repository: paths are workspace-relative, must start with "${kbDirName}/" and may not contain "." or ".." segments or backslashes. ` +
+        `Use "${corrected}" instead. A file written without that prefix lands beside the repository, where it is never committed or pushed.`, { kind: 'path-outside-repo', path: wsPath, kbDirName, corrected });
+}
+//# sourceMappingURL=repo-path.js.map

package/dist/modules/kb-fs/repo-path.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"repo-path.js","sourceRoot":"","sources":["../../../src/modules/kb-fs/repo-path.ts"],"names":[],"mappings":"AAAA,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,uBAAuB,EAAE,MAAM,+BAA+B,CAAC;AAExE;;;;;;;;;GASG;AAEH;;;;;;;;;;GAUG;AACH,MAAM,UAAU,YAAY,CAAC,MAAc,EAAE,SAAiB;IAC5D,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC;QAAE,OAAO,KAAK,CAAC;IACtE,MAAM,QAAQ,GAAG,MAAM,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IACtD,IAAI,QAAQ,CAAC,CAAC,CAAC,KAAK,SAAS;QAAE,OAAO,KAAK,CAAC;IAC5C,OAAO,QAAQ,CAAC,KAAK,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,KAAK,EAAE,IAAI,OAAO,KAAK,GAAG,IAAI,OAAO,KAAK,IAAI,CAAC,CAAC;AAC5F,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,gBAAgB,CAAC,MAAc,EAAE,SAAiB;IAChE,IAAI,YAAY,CAAC,MAAM,EAAE,SAAS,CAAC;QAAE,OAAO;IAC5C,0EAA0E;IAC1E,4EAA4E;IAC5E,yEAAyE;IACzE,MAAM,UAAU,GAAG,IAAI,CAAC,KAAK;SAC1B,SAAS,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,aAAa,EAAE,EAAE,CAAC,CAAC;SACxE,OAAO,CAAC,gBAAgB,EAAE,EAAE,CAAC;SAC7B,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;IACvB,MAAM,SAAS,GAAG,YAAY,CAAC,UAAU,EAAE,SAAS,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,GAAG,SAAS,IAAI,UAAU,EAAE,CAAC;IAClG,MAAM,IAAI,uBAAuB,CAC/B,IAAI,MAAM,8FAA8F,SAAS,8DAA8D;QAC7K,QAAQ,SAAS,mHAAmH,EACtI,EAAE,IAAI,EAAE,mBAAmB,EAAE,IAAI,EAAE,MAAM,EAAE,SAAS,EAAE,SAAS,EAAE,CAClE,CAAC;AACJ,CAAC"}

package/dist/modules/secrets-vault/db-secrets-vault.service.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"db-secrets-vault.service.d.ts","sourceRoot":"","sources":["../../../src/modules/secrets-vault/db-secrets-vault.service.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,2BAA2B,CAAC;AAI1D,OAAO,EACL,KAAK,oBAAoB,EACzB,KAAK,aAAa,EAClB,KAAK,kBAAkB,EACvB,KAAK,oBAAoB,EACzB,KAAK,0BAA0B,EAC/B,KAAK,sBAAsB,EAC3B,KAAK,mBAAmB,EACxB,KAAK,qBAAqB,EAI3B,MAAM,6BAA6B,CAAC;AAqCrC;;;;;;;;;;;GAWG;AACH,qBAAa,qBAAsB,YAAW,oBAAoB;IAI9D,OAAO,CAAC,QAAQ,CAAC,EAAE;IACnB,yFAAyF;IACzF,OAAO,CAAC,QAAQ,CAAC,MAAM;IACvB,OAAO,CAAC,QAAQ,CAAC,GAAG;IACpB;;;;;OAKG;IACH,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAC;IAb3B,OAAO,CAAC,cAAc,CAA4B;gBAG/B,EAAE,EAAE,QAAQ;IAC7B,yFAAyF;IACxE,MAAM,EAAE,MAAM,EACd,GAAG,GAAE,MAAM,MAAiB;IAC7C;;;;;OAKG;IACc,OAAO,CAAC,EAAE,qBAAqB,YAAA;IAGlD,kGAAkG;IAClG,OAAO,CAAC,MAAM;IAiBd,OAAO,CAAC,QAAQ,CAAC,iBAAiB,CAA8C;IAEhF,UAAU,CAAC,QAAQ,EAAE,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI,KAAK,IAAI,GAAG,IAAI;IAI3D,OAAO,CAAC,cAAc;IAUhB,IAAI,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,aAAa,EAAE,CAAC;IAS9C,OAAO,CAAC,MAAM,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,aAAa,GAAG,IAAI,CAAC;IAKlE,SAAS,CAAC,KAAK,EAAE,oBAAoB,GAAG,OAAO,CAAC,aAAa,CAAC;IAyB9D,WAAW,CAAC,KAAK,EAAE,sBAAsB,GAAG,OAAO,CAAC,aAAa,CAAC;IAwBlE,MAAM,CAAC,MAAM,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IASjD,eAAe,CAAC,KAAK,EAAE,0BAA0B,GAAG,OAAO,CAAC,aAAa,CAAC;IA0B1E,YAAY,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IASxC,eAAe,CAAC,MAAM,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAS3D,SAAS,CAAC,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,kBAAkB,EAAE,CAAC;IA4B9E;;;;OAIG;IACH,OAAO,CAAC,cAAc;IAQhB,UAAU,CAAC,MAAM,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IAiD3F,aAAa,CAAC,MAAM,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IA4B3F,0BAA0B,CAAC,KAAK,EAAE;QACtC,GAAG,EAAE,MAAM,CAAC;QACZ,YAAY,EAAE,MAAM,CAAC;QACrB,QAAQ,EAAE,mBAAmB,CAAC;KAC/B,GAAG,OAAO,CAAC,IAAI,CAAC;IAuBX,mBAAmB,CAAC,KAAK,EAAE;QAC/B,MAAM,EAAE,MAAM,CAAC;QACf,GAAG,EAAE,MAAM,CAAC;QACZ,WAAW,EAAE,MAAM,CAAC;QACpB,KAAK,EAAE,MAAM,CAAC;QACd,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC;KACnB,GAAG,OAAO,CAAC;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,GAAG,EAAE,MAAM,CAAA;KAAE,CAAC;IAiGlC,OAAO,CAAC,MAAM,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC;IA6G5D,sBAAsB,CAAC,KAAK,EAAE;QAClC,GAAG,EAAE,MAAM,CAAC;QACZ,KAAK,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;QACtB,QAAQ,EAAE,mBAAmB,CAAC;KAC/B,GAAG,OAAO,CAAC,IAAI,CAAC;IAuBX,sBAAsB,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,mBAAmB,GAAG,IAAI,CAAC;YAgBhE,YAAY;YA2CZ,GAAG;YASH,UAAU;IAMxB,OAAO,CAAC,QAAQ;IAKhB,OAAO,CAAC,QAAQ;IAwBhB,OAAO,CAAC,kBAAkB;IAa1B,OAAO,CAAC,eAAe;IA8BvB,OAAO,CAAC,UAAU;IAclB,OAAO,CAAC,aAAa;IAMrB,OAAO,CAAC,UAAU;IAalB,OAAO,CAAC,cAAc;IAStB,OAAO,CAAC,SAAS;CAelB"}
+{"version":3,"file":"db-secrets-vault.service.d.ts","sourceRoot":"","sources":["../../../src/modules/secrets-vault/db-secrets-vault.service.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,2BAA2B,CAAC;AAI1D,OAAO,EACL,KAAK,oBAAoB,EACzB,KAAK,aAAa,EAClB,KAAK,kBAAkB,EACvB,KAAK,oBAAoB,EACzB,KAAK,0BAA0B,EAC/B,KAAK,sBAAsB,EAC3B,KAAK,mBAAmB,EACxB,KAAK,qBAAqB,EAI3B,MAAM,6BAA6B,CAAC;AA+CrC;;;;;;;;;;;GAWG;AACH,qBAAa,qBAAsB,YAAW,oBAAoB;IAI9D,OAAO,CAAC,QAAQ,CAAC,EAAE;IACnB,yFAAyF;IACzF,OAAO,CAAC,QAAQ,CAAC,MAAM;IACvB,OAAO,CAAC,QAAQ,CAAC,GAAG;IACpB;;;;;OAKG;IACH,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAC;IAb3B,OAAO,CAAC,cAAc,CAA4B;gBAG/B,EAAE,EAAE,QAAQ;IAC7B,yFAAyF;IACxE,MAAM,EAAE,MAAM,EACd,GAAG,GAAE,MAAM,MAAiB;IAC7C;;;;;OAKG;IACc,OAAO,CAAC,EAAE,qBAAqB,YAAA;IAGlD,kGAAkG;IAClG,OAAO,CAAC,MAAM;IAiBd,OAAO,CAAC,QAAQ,CAAC,iBAAiB,CAA8C;IAEhF,UAAU,CAAC,QAAQ,EAAE,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI,KAAK,IAAI,GAAG,IAAI;IAI3D,OAAO,CAAC,cAAc;IAUhB,IAAI,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,aAAa,EAAE,CAAC;IAS9C,OAAO,CAAC,MAAM,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,aAAa,GAAG,IAAI,CAAC;IAKlE,SAAS,CAAC,KAAK,EAAE,oBAAoB,GAAG,OAAO,CAAC,aAAa,CAAC;IAyB9D,WAAW,CAAC,KAAK,EAAE,sBAAsB,GAAG,OAAO,CAAC,aAAa,CAAC;IAwBlE,MAAM,CAAC,MAAM,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IASjD,eAAe,CAAC,KAAK,EAAE,0BAA0B,GAAG,OAAO,CAAC,aAAa,CAAC;IA0B1E,YAAY,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IASxC,eAAe,CAAC,MAAM,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAS3D,SAAS,CAAC,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,kBAAkB,EAAE,CAAC;IA4B9E;;;;OAIG;IACH,OAAO,CAAC,cAAc;IAQhB,UAAU,CAAC,MAAM,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IAwE3F,aAAa,CAAC,MAAM,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAmC3F,0BAA0B,CAAC,KAAK,EAAE;QACtC,GAAG,EAAE,MAAM,CAAC;QACZ,YAAY,EAAE,MAAM,CAAC;QACrB,QAAQ,EAAE,mBAAmB,CAAC;KAC/B,GAAG,OAAO,CAAC,IAAI,CAAC;IAuBX,mBAAmB,CAAC,KAAK,EAAE;QAC/B,MAAM,EAAE,MAAM,CAAC;QACf,GAAG,EAAE,MAAM,CAAC;QACZ,WAAW,EAAE,MAAM,CAAC;QACpB,KAAK,EAAE,MAAM,CAAC;QACd,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC;KACnB,GAAG,OAAO,CAAC;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,GAAG,EAAE,MAAM,CAAA;KAAE,CAAC;IA0GlC,OAAO,CAAC,MAAM,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC;IA+G5D,sBAAsB,CAAC,KAAK,EAAE;QAClC,GAAG,EAAE,MAAM,CAAC;QACZ,KAAK,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;QACtB,QAAQ,EAAE,mBAAmB,CAAC;KAC/B,GAAG,OAAO,CAAC,IAAI,CAAC;IAuBX,sBAAsB,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,mBAAmB,GAAG,IAAI,CAAC;YAgBhE,YAAY;YA2CZ,GAAG;YASH,UAAU;IAMxB,OAAO,CAAC,QAAQ;IAKhB,OAAO,CAAC,QAAQ;IAwBhB,OAAO,CAAC,kBAAkB;IAa1B,OAAO,CAAC,eAAe;IA8BvB,OAAO,CAAC,UAAU;IAclB,OAAO,CAAC,aAAa;IAMrB,OAAO,CAAC,UAAU;IAalB,OAAO,CAAC,cAAc;IAStB,OAAO,CAAC,SAAS;CAelB"}

package/dist/modules/secrets-vault/db-secrets-vault.service.js

@@ -229,16 +229,39 @@ export class DbSecretsVaultService {
         // PKCE (S256): same as the tool path — mint the verifier, stash it on the
         // row (so `completeOAuth` echoes it at the token exchange), and put only
         // the derived challenge in the consent URL. A provider registered pkce
-        // would otherwise fail the exchange from this standalone flow.
-        let pendingVerifier;
-        if (meta.pkce) {
-            pendingVerifier = randomBytes(32).toString('base64url');
-            const blob = this.readBlob(row.valueEncrypted);
-            const next = { ...blob, pendingVerifier };
-            await this.db
-                .update(secrets)
-                .set({ valueEncrypted: this.crypto().encrypt(JSON.stringify(next)), updatedAt: new Date() })
-                .where(and(eq(secrets.id, id), eq(secrets.userId, userId)));
+        // would otherwise fail the exchange from this standalone flow. The
+        // requested scopes ride along for the same exchange (see `pendingScopes`).
+        const pendingVerifier = meta.pkce ? randomBytes(32).toString('base64url') : undefined;
+        const pendingScopes = meta.scopes && meta.scopes.length ? meta.scopes.join(' ') : undefined;
+        if (pendingVerifier || pendingScopes) {
+            // Read-modify-write on the blob, guarded on the ciphertext we read: a
+            // refresh running concurrently (the row is a live credential) may have
+            // persisted ROTATED tokens in between, and writing our copy over them
+            // would leave the row holding a dead refresh token if this consent is
+            // then abandoned. On a miss (0 rows), re-read and merge onto the fresh
+            // blob; bounded so a row that keeps changing fails loudly, not forever.
+            let current = row;
+            for (let attempt = 0;; attempt++) {
+                const blob = this.readBlob(current.valueEncrypted);
+                const next = { ...blob, pendingVerifier, pendingScopes };
+                const written = await this.db
+                    .update(secrets)
+                    .set({ valueEncrypted: this.crypto().encrypt(JSON.stringify(next)), updatedAt: new Date() })
+                    .where(and(eq(secrets.id, id), eq(secrets.userId, userId), eq(secrets.valueEncrypted, current.valueEncrypted)))
+                    .returning({ id: secrets.id });
+                if (!Array.isArray(written) || written.length > 0)
+                    break;
+                if (attempt >= 2)
+                    throw new SecretOAuthError('The sign-in changed while starting — try again');
+                current = await this.requireRow(userId, id);
+                // Only a token rotation is merge-able. A row that is no longer this
+                // OAuth secret — re-registered against another provider, or replaced by
+                // a static value — would have the consent URL built above pointing at
+                // one provider and the pending fields stashed for another.
+                if (current.kind !== 'oauth' || JSON.stringify(current.oauthMeta) !== JSON.stringify(row.oauthMeta)) {
+                    throw new SecretOAuthError('The sign-in changed while starting — try again');
+                }
+            }
         }
         const url = new URL(meta.authorizationUrl);
         url.searchParams.set('response_type', 'code');
@@ -291,7 +314,15 @@ export class DbSecretsVaultService {
         if (meta.resource)
             body.set('resource', meta.resource);
         const tokens = await this.tokenRequest(meta.tokenUrl, body);
-        // The verifier is one-time — never carried past the exchange it was minted for.
+        // A silent token response granted what was asked (RFC 6749 §5.1) — record
+        // the request as the grant, or every declared scope would read as missing
+        // and the sign-in would be flagged "again" forever. An echoed `scope` is
+        // the provider's own word and wins — narrower grants included, and so does
+        // an explicit empty one: only an ABSENT field means "as requested".
+        if (tokens.scope === undefined && blob.pendingScopes)
+            tokens.scope = blob.pendingScopes;
+        // The verifier and the requested scopes are one-time — never carried past
+        // the exchange they were minted for.
         const next = { clientSecret: blob.clientSecret, tokens };
         await this.db
             .update(secrets)
@@ -369,10 +400,21 @@ export class DbSecretsVaultService {
         // only the derived challenge in the consent URL. `completeOAuth` echoes the
         // verifier at the token exchange and drops it.
         const pendingVerifier = meta.pkce ? randomBytes(32).toString('base64url') : undefined;
+        // The scopes this consent asks for: the caller may override from the live
+        // tool file (`input.scopes`) so an owner adding a permission takes effect
+        // without re-setting the secret. Remembered on the row so a token response
+        // that echoes no `scope` is read as granting exactly this (RFC 6749 §5.1).
+        const requestedScopes = input.scopes && input.scopes.length ? input.scopes : meta.scopes;
+        const pendingScopes = requestedScopes && requestedScopes.length ? requestedScopes.join(' ') : undefined;
         // Provision (or reset) the caller's own oauth row for this key from the shared
         // provider meta + secret, preserving any existing tokens. Keyed `<manual>_<VAR>`
         // so `resolve` (scope 'user') returns the token once sign-in completes.
-        const blob = { clientSecret: sharedBlob.clientSecret, tokens: existingTokens, pendingVerifier };
+        const blob = {
+            clientSecret: sharedBlob.clientSecret,
+            tokens: existingTokens,
+            pendingVerifier,
+            pendingScopes,
+        };
         const valueEncrypted = this.crypto().encrypt(JSON.stringify(blob));
         const [row] = await this.db
             .insert(secrets)
@@ -383,10 +425,8 @@ export class DbSecretsVaultService {
         })
             .returning();
         // Build the consent URL exactly as beginOAuth does, from the stored meta —
-        // EXCEPT the requested scopes, which the caller may override from the live tool
-        // file (`input.scopes`) so an owner adding a permission takes effect without
-        // re-setting the secret. Client id, addresses, and secret stay owner-pinned.
-        const requestedScopes = input.scopes && input.scopes.length ? input.scopes : meta.scopes;
+        // EXCEPT the requested scopes (above). Client id, addresses, and secret
+        // stay owner-pinned.
         const url = new URL(meta.authorizationUrl);
         url.searchParams.set('response_type', 'code');
         url.searchParams.set('client_id', meta.clientId);
@@ -512,8 +552,10 @@ export class DbSecretsVaultService {
         if (!refreshed.refresh_token)
             refreshed.refresh_token = tokens.refresh_token;
         // Likewise, a refresh response often omits `scope` — keep the granted scopes
-        // recorded at sign-in so coverage checks don't regress to "unknown".
-        if (!refreshed.scope)
+        // recorded at sign-in so coverage checks don't regress to "unknown". Same
+        // rule as the exchange: only an ABSENT field means "unchanged"; an echoed
+        // value, empty included, is the provider's word.
+        if (refreshed.scope === undefined)
             refreshed.scope = tokens.scope;
         const next = { clientSecret: blob.clientSecret, tokens: refreshed };
         // Optimistic concurrency: only persist if the stored ciphertext is unchanged,