@bevel-software/platform-core-backend 0.14.0 → 0.19.0

package/dist/modules/workspace/startup/steps/plugin-layout.js

@@ -0,0 +1,97 @@
+import { HEXIS_EXTENSION_NS, PLUGIN_MANIFEST_FILE, PLUGIN_MCP_FILE, PLUGIN_SKILLS_DIR, } from '@bevel-software/platform-shared';
+import { BUNDLE_FILE } from '../../../plugins/discovery/bundle-dialect/bundle.source.js';
+import { isSkippedEntry } from '../../../../shared/fs.contract.js';
+/**
+ * Whether a folder's listing carries a plugin manifest or a bundle as a
+ * regular file — THE "has a manifest" judgement, shared by the manifest step
+ * and the migration. Pure: it reads the entries it is given and touches no
+ * disk, so it stays a function.
+ */
+export function hasManifestEntry(entries) {
+    return entries.some((e) => e.isFile() && (e.name === PLUGIN_MANIFEST_FILE || e.name === BUNDLE_FILE));
+}
+/**
+ * The questions BOTH plugin-shaped startup steps ask of the tree: is this
+ * folder a plugin from before manifests existed, and does a real plugin live
+ * beneath it?
+ *
+ * Two steps need these answers — the manifest back-fill and the
+ * Groups→Plugins migration — and they must never disagree, or one would write
+ * a manifest into a folder the other treats as a grouping folder. They used
+ * to share the answers as free functions taking the walker, which put the
+ * port in every signature and every call. Injected once instead: the walker
+ * is a constructor dependency, as an INTERFACE, and the questions read as
+ * questions.
+ */
+export class PluginLayout {
+    disk;
+    constructor(disk) {
+        this.disk = disk;
+    }
+    /**
+     * Whether a folder's own content is what the legacy layout put in a plugin
+     * — THE rule for "this folder was a plugin before manifests existed". A
+     * folder with nothing of the kind (a `.gitkeep`, a grouping folder someone
+     * made in the tree) is not.
+     *
+     * Entries the walk SKIPS are not content. The two callers reach this with
+     * listings of different provenance — the manifest step's come from a walk
+     * that has already dropped dot-entries and `node_modules`, the migration's
+     * come raw from `listDir` — and judging the raw ones as they arrived made
+     * a folder holding nothing but `.hidden.tool` a plugin: the migration wrote
+     * it a manifest and then moved nothing into it, because its own sweep skips
+     * exactly what this had counted. Filtered HERE rather than at that call
+     * site, so the answer cannot depend on which door it came through.
+     */
+    async looksLikeLegacyPlugin(dir, entries) {
+        for (const entry of entries) {
+            if (isSkippedEntry(entry.name))
+                continue;
+            if (entry.isFile() &&
+                (entry.name === 'access.md' || entry.name === PLUGIN_MCP_FILE || entry.name.toLowerCase().endsWith('.tool'))) {
+                return true;
+            }
+            if (entry.isDirectory() && (entry.name === PLUGIN_SKILLS_DIR || entry.name === HEXIS_EXTENSION_NS))
+                return true;
+        }
+        return this.hasSkillBeneath(dir);
+    }
+    /**
+     * Whether a plugin (a folder carrying `plugin.json` or a bundle) sits
+     * anywhere BELOW `dir` — which makes `dir` a grouping folder, never a
+     * plugin itself.
+     *
+     * Judged the way discovery judges it: a manifest is a REGULAR file entry
+     * (`Dirent.isFile()` — a symlink so named is not one, exactly as the walk
+     * behind the catalog sees it), and the entries the walk skips (dot-folders,
+     * `node_modules`) hold nothing here either. Anything looser would let an
+     * ignored or unsupported entry hide a legacy plugin from its manifest.
+     */
+    async hasPluginBeneath(dir) {
+        return this.anyFolderIn(dir, (rel, entries) => rel !== '' && hasManifestEntry(entries));
+    }
+    /** The pre-`skills/` shape: `Plugins/<Plugin>/<skill>/SKILL.md`, at any depth (`dir` itself included). */
+    async hasSkillBeneath(dir) {
+        return this.anyFolderIn(dir, (_rel, entries) => entries.some((e) => e.isFile() && e.name === 'SKILL.md'));
+    }
+    /**
+     * Whether any folder at or under `dir` — walked as the catalog walks it, so
+     * a SKILL.md vendored under `node_modules` is nobody's skill and makes no
+     * folder a plugin — has a listing that satisfies `test`. Stops at the
+     * first. A missing `dir` has none; a folder that cannot be listed is the
+     * error.
+     */
+    async anyFolderIn(dir, test) {
+        let found = false;
+        await this.disk.walkKb(dir, [
+            {
+                onDir(rel, entries) {
+                    if (test(rel, entries))
+                        found = true;
+                },
+            },
+        ], { until: () => found, unreadable: 'throw' });
+        return found;
+    }
+}
+//# sourceMappingURL=plugin-layout.js.map

package/dist/modules/workspace/startup/steps/plugin-layout.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"plugin-layout.js","sourceRoot":"","sources":["../../../../../src/modules/workspace/startup/steps/plugin-layout.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,kBAAkB,EAClB,oBAAoB,EACpB,eAAe,EACf,iBAAiB,GAClB,MAAM,iCAAiC,CAAC;AACzC,OAAO,EAAE,WAAW,EAAE,MAAM,4DAA4D,CAAC;AACzF,OAAO,EAAE,cAAc,EAAsC,MAAM,mCAAmC,CAAC;AAEvG;;;;;GAKG;AACH,MAAM,UAAU,gBAAgB,CAAC,OAA+B;IAC9D,OAAO,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC,CAAC,IAAI,KAAK,oBAAoB,IAAI,CAAC,CAAC,IAAI,KAAK,WAAW,CAAC,CAAC,CAAC;AACxG,CAAC;AAED;;;;;;;;;;;;GAYG;AACH,MAAM,OAAO,YAAY;IACM;IAA7B,YAA6B,IAAiB;QAAjB,SAAI,GAAJ,IAAI,CAAa;IAAG,CAAC;IAElD;;;;;;;;;;;;;;OAcG;IACH,KAAK,CAAC,qBAAqB,CAAC,GAAW,EAAE,OAA+B;QACtE,KAAK,MAAM,KAAK,IAAI,OAAO,EAAE,CAAC;YAC5B,IAAI,cAAc,CAAC,KAAK,CAAC,IAAI,CAAC;gBAAE,SAAS;YACzC,IACE,KAAK,CAAC,MAAM,EAAE;gBACd,CAAC,KAAK,CAAC,IAAI,KAAK,WAAW,IAAI,KAAK,CAAC,IAAI,KAAK,eAAe,IAAI,KAAK,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,EAC5G,CAAC;gBACD,OAAO,IAAI,CAAC;YACd,CAAC;YACD,IAAI,KAAK,CAAC,WAAW,EAAE,IAAI,CAAC,KAAK,CAAC,IAAI,KAAK,iBAAiB,IAAI,KAAK,CAAC,IAAI,KAAK,kBAAkB,CAAC;gBAAE,OAAO,IAAI,CAAC;QAClH,CAAC;QACD,OAAO,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,CAAC;IACnC,CAAC;IAED;;;;;;;;;;OAUG;IACH,KAAK,CAAC,gBAAgB,CAAC,GAAW;QAChC,OAAO,IAAI,CAAC,WAAW,CAAC,GAAG,EAAE,CAAC,GAAG,EAAE,OAAO,EAAE,EAAE,CAAC,GAAG,KAAK,EAAE,IAAI,gBAAgB,CAAC,OAAO,CAAC,CAAC,CAAC;IAC1F,CAAC;IAED,0GAA0G;IAClG,KAAK,CAAC,eAAe,CAAC,GAAW;QACvC,OAAO,IAAI,CAAC,WAAW,CAAC,GAAG,EAAE,CAAC,IAAI,EAAE,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC,IAAI,KAAK,UAAU,CAAC,CAAC,CAAC;IAC5G,CAAC;IAED;;;;;;OAMG;IACK,KAAK,CAAC,WAAW,CACvB,GAAW,EACX,IAA+D;QAE/D,IAAI,KAAK,GAAG,KAAK,CAAC;QAClB,MAAM,IAAI,CAAC,IAAI,CAAC,MAAM,CACpB,GAAG,EACH;YACE;gBACE,KAAK,CAAC,GAAG,EAAE,OAAO;oBAChB,IAAI,IAAI,CAAC,GAAG,EAAE,OAAO,CAAC;wBAAE,KAAK,GAAG,IAAI,CAAC;gBACvC,CAAC;aACF;SACF,EACD,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC,KAAK,EAAE,UAAU,EAAE,OAAO,EAAE,CAC5C,CAAC;QACF,OAAO,KAAK,CAAC;IACf,CAAC;CACF"}

package/dist/modules/workspace/startup/steps/plugin-manifests.step.d.ts

@@ -0,0 +1,41 @@
+import type { ITreeWalker } from '../../../../shared/fs.contract.js';
+import type { OnServerStart, ServerStartContext, StepResult } from '../on-server-start.js';
+/**
+ * Give every legacy plugin folder its manifest, as an {@link OnServerStart}
+ * step.
+ *
+ * A plugin IS a folder carrying `plugin.json` (or a `plugin.bundle.json`, the
+ * read-only customer dialect) — discovery reads nothing else, at any depth.
+ * Folders from before the manifest existed have `access.md`, an `mcp.json`,
+ * a `skills/` tree or `.tool` manuals and no `plugin.json` beside them; the
+ * old scanners read those by position (directly under the plugins root),
+ * and this step is what retires that rule: it writes the minimal manifest
+ * into each such folder, once, so the position never has to mean anything
+ * again.
+ *
+ * WHICH folders: walk the plugins root; a folder holding either file is a
+ * plugin and is not entered. Any other folder is entered first. A folder
+ * DIRECTLY under the root — the only place the legacy layout ever put a
+ * plugin — becomes one when nothing plugin-shaped lives beneath it and its
+ * own content is legacy content: a scope folder (the dialect's
+ * `plugins/functional/…`) can carry an `access.md` of its own and must stay
+ * a scope, and a skill folder inside a legacy plugin must not become a
+ * plugin of its own. "Legacy content" is the set of things provisioning and
+ * the old migration ever put in a plugin folder: `access.md`, `mcp.json`,
+ * `skills/`, the hexis extension directory, a `.tool` file, or a `SKILL.md`
+ * anywhere beneath (the pre-`skills/` shape) — see {@link PluginLayout},
+ * which the Groups→Plugins migration reads the same answers from.
+ *
+ * Every branch, drafts included, like the Groups→Plugins migration and for
+ * the same reason: a draft migrated alongside its target diffs by the user's
+ * own changes only. Idempotent: a folder that has its manifest is skipped.
+ */
+export declare class PluginManifestsStep implements OnServerStart {
+    private readonly disk;
+    readonly name = "plugin-manifests";
+    private readonly layout;
+    constructor(disk: ITreeWalker);
+    run(ctx: ServerStartContext): Promise<StepResult>;
+    private addManifests;
+}
+//# sourceMappingURL=plugin-manifests.step.d.ts.map

package/dist/modules/workspace/startup/steps/plugin-manifests.step.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"plugin-manifests.step.d.ts","sourceRoot":"","sources":["../../../../../src/modules/workspace/startup/steps/plugin-manifests.step.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,WAAW,EAAe,MAAM,mCAAmC,CAAC;AAElF,OAAO,KAAK,EAAY,aAAa,EAAE,kBAAkB,EAAE,UAAU,EAAE,MAAM,uBAAuB,CAAC;AAErG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AACH,qBAAa,mBAAoB,YAAW,aAAa;IAK3C,OAAO,CAAC,QAAQ,CAAC,IAAI;IAJjC,QAAQ,CAAC,IAAI,sBAAsB;IAEnC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAe;gBAET,IAAI,EAAE,WAAW;IAIxC,GAAG,CAAC,GAAG,EAAE,kBAAkB,GAAG,OAAO,CAAC,UAAU,CAAC;YAOzC,YAAY;CAqC3B"}

package/dist/modules/workspace/startup/steps/plugin-manifests.step.js

@@ -0,0 +1,85 @@
+import path from 'node:path';
+import { PLUGINS_DIR, PLUGIN_MANIFEST_FILE, renderPluginManifest } from '@bevel-software/platform-shared';
+import { PluginLayout, hasManifestEntry } from './plugin-layout.js';
+/**
+ * Give every legacy plugin folder its manifest, as an {@link OnServerStart}
+ * step.
+ *
+ * A plugin IS a folder carrying `plugin.json` (or a `plugin.bundle.json`, the
+ * read-only customer dialect) — discovery reads nothing else, at any depth.
+ * Folders from before the manifest existed have `access.md`, an `mcp.json`,
+ * a `skills/` tree or `.tool` manuals and no `plugin.json` beside them; the
+ * old scanners read those by position (directly under the plugins root),
+ * and this step is what retires that rule: it writes the minimal manifest
+ * into each such folder, once, so the position never has to mean anything
+ * again.
+ *
+ * WHICH folders: walk the plugins root; a folder holding either file is a
+ * plugin and is not entered. Any other folder is entered first. A folder
+ * DIRECTLY under the root — the only place the legacy layout ever put a
+ * plugin — becomes one when nothing plugin-shaped lives beneath it and its
+ * own content is legacy content: a scope folder (the dialect's
+ * `plugins/functional/…`) can carry an `access.md` of its own and must stay
+ * a scope, and a skill folder inside a legacy plugin must not become a
+ * plugin of its own. "Legacy content" is the set of things provisioning and
+ * the old migration ever put in a plugin folder: `access.md`, `mcp.json`,
+ * `skills/`, the hexis extension directory, a `.tool` file, or a `SKILL.md`
+ * anywhere beneath (the pre-`skills/` shape) — see {@link PluginLayout},
+ * which the Groups→Plugins migration reads the same answers from.
+ *
+ * Every branch, drafts included, like the Groups→Plugins migration and for
+ * the same reason: a draft migrated alongside its target diffs by the user's
+ * own changes only. Idempotent: a folder that has its manifest is skipped.
+ */
+export class PluginManifestsStep {
+    disk;
+    name = 'plugin-manifests';
+    layout;
+    constructor(disk) {
+        this.disk = disk;
+        this.layout = new PluginLayout(disk);
+    }
+    async run(ctx) {
+        for (const branch of await ctx.allBranches()) {
+            await this.addManifests(branch);
+        }
+        return { outcome: 'ok' };
+    }
+    async addManifests(branch) {
+        const repoDir = await branch.repoDir();
+        const root = path.join(repoDir, PLUGINS_DIR);
+        const added = [];
+        // A plugin is a folder whose OWN listing holds a manifest as a regular
+        // file — the judgement discovery makes, entry for entry (a symlink so
+        // named is none) — and a leaf: nothing beneath it is a plugin. Absence is
+        // the plugins root not existing yet; any other hole must stop the boot
+        // rather than quietly leave legacy plugins without manifests.
+        const plugins = [];
+        const topLevel = [];
+        await this.disk.walkKb(root, [
+            {
+                onDir(rel, entries) {
+                    if (rel && hasManifestEntry(entries))
+                        plugins.push(rel);
+                    else if (rel && !rel.includes('/'))
+                        topLevel.push({ rel, entries });
+                },
+            },
+        ], { leaf: (dir, entries) => dir.rel !== '' && hasManifestEntry(entries), unreadable: 'throw' });
+        for (const { rel, entries } of topLevel) {
+            // A grouping folder — plugins beneath it — is never a plugin itself.
+            if (plugins.some((p) => p.startsWith(`${rel}/`)))
+                continue;
+            if (!(await this.layout.looksLikeLegacyPlugin(path.join(root, rel), entries)))
+                continue;
+            branch.write(`${PLUGINS_DIR}/${rel}/${PLUGIN_MANIFEST_FILE}`, renderPluginManifest(rel));
+            added.push(rel);
+        }
+        if (added.length === 0)
+            return;
+        branch.note(`Add plugin manifests to ${added.length === 1 ? 'a legacy plugin folder' : `${added.length} legacy plugin folders`}`);
+        for (const rel of added)
+            branch.note(`${PLUGINS_DIR}/${rel}: ${PLUGIN_MANIFEST_FILE} written`);
+    }
+}
+//# sourceMappingURL=plugin-manifests.step.js.map

package/dist/modules/workspace/startup/steps/plugin-manifests.step.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"plugin-manifests.step.js","sourceRoot":"","sources":["../../../../../src/modules/workspace/startup/steps/plugin-manifests.step.ts"],"names":[],"mappings":"AAAA,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,WAAW,EAAE,oBAAoB,EAAE,oBAAoB,EAAE,MAAM,iCAAiC,CAAC;AAE1G,OAAO,EAAE,YAAY,EAAE,gBAAgB,EAAE,MAAM,oBAAoB,CAAC;AAGpE;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AACH,MAAM,OAAO,mBAAmB;IAKD;IAJpB,IAAI,GAAG,kBAAkB,CAAC;IAElB,MAAM,CAAe;IAEtC,YAA6B,IAAiB;QAAjB,SAAI,GAAJ,IAAI,CAAa;QAC5C,IAAI,CAAC,MAAM,GAAG,IAAI,YAAY,CAAC,IAAI,CAAC,CAAC;IACvC,CAAC;IAED,KAAK,CAAC,GAAG,CAAC,GAAuB;QAC/B,KAAK,MAAM,MAAM,IAAI,MAAM,GAAG,CAAC,WAAW,EAAE,EAAE,CAAC;YAC7C,MAAM,IAAI,CAAC,YAAY,CAAC,MAAM,CAAC,CAAC;QAClC,CAAC;QACD,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;IAC3B,CAAC;IAEO,KAAK,CAAC,YAAY,CAAC,MAAgB;QACzC,MAAM,OAAO,GAAG,MAAM,MAAM,CAAC,OAAO,EAAE,CAAC;QACvC,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,WAAW,CAAC,CAAC;QAC7C,MAAM,KAAK,GAAa,EAAE,CAAC;QAE3B,uEAAuE;QACvE,sEAAsE;QACtE,0EAA0E;QAC1E,uEAAuE;QACvE,8DAA8D;QAC9D,MAAM,OAAO,GAAa,EAAE,CAAC;QAC7B,MAAM,QAAQ,GAAuD,EAAE,CAAC;QACxE,MAAM,IAAI,CAAC,IAAI,CAAC,MAAM,CACpB,IAAI,EACJ;YACE;gBACE,KAAK,CAAC,GAAG,EAAE,OAAO;oBAChB,IAAI,GAAG,IAAI,gBAAgB,CAAC,OAAO,CAAC;wBAAE,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;yBACnD,IAAI,GAAG,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC;wBAAE,QAAQ,CAAC,IAAI,CAAC,EAAE,GAAG,EAAE,OAAO,EAAE,CAAC,CAAC;gBACtE,CAAC;aACF;SACF,EACD,EAAE,IAAI,EAAE,CAAC,GAAG,EAAE,OAAO,EAAE,EAAE,CAAC,GAAG,CAAC,GAAG,KAAK,EAAE,IAAI,gBAAgB,CAAC,OAAO,CAAC,EAAE,UAAU,EAAE,OAAO,EAAE,CAC7F,CAAC;QACF,KAAK,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,IAAI,QAAQ,EAAE,CAAC;YACxC,qEAAqE;YACrE,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC,GAAG,GAAG,GAAG,CAAC,CAAC;gBAAE,SAAS;YAC3D,IAAI,CAAC,CAAC,MAAM,IAAI,CAAC,MAAM,CAAC,qBAAqB,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,GAAG,CAAC,EAAE,OAAO,CAAC,CAAC;gBAAE,SAAS;YACxF,MAAM,CAAC,KAAK,CAAC,GAAG,WAAW,IAAI,GAAG,IAAI,oBAAoB,EAAE,EAAE,oBAAoB,CAAC,GAAG,CAAC,CAAC,CAAC;YACzF,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAClB,CAAC;QACD,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO;QAC/B,MAAM,CAAC,IAAI,CACT,2BAA2B,KAAK,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,wBAAwB,CAAC,CAAC,CAAC,GAAG,KAAK,CAAC,MAAM,wBAAwB,EAAE,CACrH,CAAC;QACF,KAAK,MAAM,GAAG,IAAI,KAAK;YAAE,MAAM,CAAC,IAAI,CAAC,GAAG,WAAW,IAAI,GAAG,KAAK,oBAAoB,UAAU,CAAC,CAAC;IACjG,CAAC;CACF"}

package/dist/modules/workspace/startup/steps/roles-yaml.step.d.ts

@@ -1,3 +1,4 @@
+import type { IFsProbe } from '../../../../shared/fs.contract.js';
 import type { OnServerStart, ServerStartContext, StepResult } from '../on-server-start.js';
 /**
  * Write `roles.yaml` on any protected branch missing it, generated from the
@@ -15,9 +16,10 @@ import type { OnServerStart, ServerStartContext, StepResult } from '../on-server
  * log. Access resolution will fail until an Admin roles.yaml exists.
  */
 export declare class RolesYamlStep implements OnServerStart {
+    private readonly disk;
     private readonly seedAdminEmails;
     readonly name = "roles-yaml";
-    constructor(seedAdminEmails: readonly string[]);
+    constructor(disk: IFsProbe, seedAdminEmails: readonly string[]);
     run(ctx: ServerStartContext): Promise<StepResult>;
 }
 //# sourceMappingURL=roles-yaml.step.d.ts.map

package/dist/modules/workspace/startup/steps/roles-yaml.step.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"roles-yaml.step.d.ts","sourceRoot":"","sources":["../../../../../src/modules/workspace/startup/steps/roles-yaml.step.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,aAAa,EAAE,kBAAkB,EAAE,UAAU,EAAE,MAAM,uBAAuB,CAAC;AAE3F;;;;;;;;;;;;;;GAcG;AACH,qBAAa,aAAc,YAAW,aAAa;IAGrC,OAAO,CAAC,QAAQ,CAAC,eAAe;IAF5C,QAAQ,CAAC,IAAI,gBAAgB;gBAEA,eAAe,EAAE,SAAS,MAAM,EAAE;IAEzD,GAAG,CAAC,GAAG,EAAE,kBAAkB,GAAG,OAAO,CAAC,UAAU,CAAC;CAoCxD"}
+{"version":3,"file":"roles-yaml.step.d.ts","sourceRoot":"","sources":["../../../../../src/modules/workspace/startup/steps/roles-yaml.step.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,mCAAmC,CAAC;AAElE,OAAO,KAAK,EAAE,aAAa,EAAE,kBAAkB,EAAE,UAAU,EAAE,MAAM,uBAAuB,CAAC;AAE3F;;;;;;;;;;;;;;GAcG;AACH,qBAAa,aAAc,YAAW,aAAa;IAI/C,OAAO,CAAC,QAAQ,CAAC,IAAI;IACrB,OAAO,CAAC,QAAQ,CAAC,eAAe;IAJlC,QAAQ,CAAC,IAAI,gBAAgB;gBAGV,IAAI,EAAE,QAAQ,EACd,eAAe,EAAE,SAAS,MAAM,EAAE;IAG/C,GAAG,CAAC,GAAG,EAAE,kBAAkB,GAAG,OAAO,CAAC,UAAU,CAAC;CAoCxD"}

package/dist/modules/workspace/startup/steps/roles-yaml.step.js

@@ -1,4 +1,3 @@
-import fs from 'node:fs/promises';
 import path from 'node:path';
 import { renderRolesYaml } from '../../../access-model/render-roles-yaml.js';
 /**
@@ -17,9 +16,11 @@ import { renderRolesYaml } from '../../../access-model/render-roles-yaml.js';
  * log. Access resolution will fail until an Admin roles.yaml exists.
  */
 export class RolesYamlStep {
+    disk;
     seedAdminEmails;
     name = 'roles-yaml';
-    constructor(seedAdminEmails) {
+    constructor(disk, seedAdminEmails) {
+        this.disk = disk;
         this.seedAdminEmails = seedAdminEmails;
     }
     async run(ctx) {
@@ -30,7 +31,7 @@ export class RolesYamlStep {
             // read as "present" and be skipped over — reporting success over a
             // knowledge base whose access roster cannot be read. Fail closed, same
             // as template-files' squatter checks: this is a state a human must fix.
-            const found = await lstatOrNull(path.join(repoDir, 'roles.yaml'));
+            const found = await this.disk.lstatOrNull(path.join(repoDir, 'roles.yaml'));
             if (found) {
                 if (found.isFile())
                     continue; // the operator's file — leave it alone
@@ -57,13 +58,4 @@ export class RolesYamlStep {
         return { outcome: 'ok' };
     }
 }
-/** `lstat` without the throw — null when nothing is at `p`. */
-async function lstatOrNull(p) {
-    try {
-        return await fs.lstat(p);
-    }
-    catch {
-        return null;
-    }
-}
 //# sourceMappingURL=roles-yaml.step.js.map

package/dist/modules/workspace/startup/steps/roles-yaml.step.js.map

@@ -1 +1 @@
-{"version":3,"file":"roles-yaml.step.js","sourceRoot":"","sources":["../../../../../src/modules/workspace/startup/steps/roles-yaml.step.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,kBAAkB,CAAC;AAClC,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,eAAe,EAAE,MAAM,4CAA4C,CAAC;AAG7E;;;;;;;;;;;;;;GAcG;AACH,MAAM,OAAO,aAAa;IAGK;IAFpB,IAAI,GAAG,YAAY,CAAC;IAE7B,YAA6B,eAAkC;QAAlC,oBAAe,GAAf,eAAe,CAAmB;IAAG,CAAC;IAEnE,KAAK,CAAC,GAAG,CAAC,GAAuB;QAC/B,MAAM,SAAS,GAAa,EAAE,CAAC;QAC/B,KAAK,MAAM,MAAM,IAAI,MAAM,GAAG,CAAC,iBAAiB,EAAE,EAAE,CAAC;YACnD,MAAM,OAAO,GAAG,MAAM,MAAM,CAAC,OAAO,EAAE,CAAC;YACvC,yEAAyE;YACzE,mEAAmE;YACnE,uEAAuE;YACvE,wEAAwE;YACxE,MAAM,KAAK,GAAG,MAAM,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,YAAY,CAAC,CAAC,CAAC;YAClE,IAAI,KAAK,EAAE,CAAC;gBACV,IAAI,KAAK,CAAC,MAAM,EAAE;oBAAE,SAAS,CAAC,uCAAuC;gBACrE,MAAM,IAAI,KAAK,CACb,2BAA2B,MAAM,CAAC,IAAI,qCAAqC;oBACzE,IAAI,KAAK,CAAC,cAAc,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,KAAK,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,cAAc,KAAK;oBAChG,uGAAuG,CAC1G,CAAC;YACJ,CAAC;YACD,IAAI,IAAI,CAAC,eAAe,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;gBACtC,SAAS,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;gBAC5B,SAAS;YACX,CAAC;YACD,MAAM,CAAC,KAAK,CAAC,YAAY,EAAE,eAAe,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC,CAAC;YAClE,MAAM,CAAC,IAAI,CAAC,6DAA6D,CAAC,CAAC;QAC7E,CAAC;QACD,IAAI,SAAS,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACzB,uEAAuE;YACvE,+CAA+C;YAC/C,OAAO;gBACL,OAAO,EAAE,SAAS;gBAClB,MAAM,EACJ,4BAA4B,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,iDAAiD;oBACjG,2GAA2G;aAC9G,CAAC;QACJ,CAAC;QACD,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;IAC3B,CAAC;CACF;AAED,+DAA+D;AAC/D,KAAK,UAAU,WAAW,CAAC,CAAS;IAClC,IAAI,CAAC;QACH,OAAO,MAAM,EAAE,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;IAC3B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC"}
+{"version":3,"file":"roles-yaml.step.js","sourceRoot":"","sources":["../../../../../src/modules/workspace/startup/steps/roles-yaml.step.ts"],"names":[],"mappings":"AAAA,OAAO,IAAI,MAAM,WAAW,CAAC;AAE7B,OAAO,EAAE,eAAe,EAAE,MAAM,4CAA4C,CAAC;AAG7E;;;;;;;;;;;;;;GAcG;AACH,MAAM,OAAO,aAAa;IAIL;IACA;IAJV,IAAI,GAAG,YAAY,CAAC;IAE7B,YACmB,IAAc,EACd,eAAkC;QADlC,SAAI,GAAJ,IAAI,CAAU;QACd,oBAAe,GAAf,eAAe,CAAmB;IAClD,CAAC;IAEJ,KAAK,CAAC,GAAG,CAAC,GAAuB;QAC/B,MAAM,SAAS,GAAa,EAAE,CAAC;QAC/B,KAAK,MAAM,MAAM,IAAI,MAAM,GAAG,CAAC,iBAAiB,EAAE,EAAE,CAAC;YACnD,MAAM,OAAO,GAAG,MAAM,MAAM,CAAC,OAAO,EAAE,CAAC;YACvC,yEAAyE;YACzE,mEAAmE;YACnE,uEAAuE;YACvE,wEAAwE;YACxE,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,YAAY,CAAC,CAAC,CAAC;YAC5E,IAAI,KAAK,EAAE,CAAC;gBACV,IAAI,KAAK,CAAC,MAAM,EAAE;oBAAE,SAAS,CAAC,uCAAuC;gBACrE,MAAM,IAAI,KAAK,CACb,2BAA2B,MAAM,CAAC,IAAI,qCAAqC;oBACzE,IAAI,KAAK,CAAC,cAAc,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,KAAK,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,cAAc,KAAK;oBAChG,uGAAuG,CAC1G,CAAC;YACJ,CAAC;YACD,IAAI,IAAI,CAAC,eAAe,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;gBACtC,SAAS,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;gBAC5B,SAAS;YACX,CAAC;YACD,MAAM,CAAC,KAAK,CAAC,YAAY,EAAE,eAAe,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC,CAAC;YAClE,MAAM,CAAC,IAAI,CAAC,6DAA6D,CAAC,CAAC;QAC7E,CAAC;QACD,IAAI,SAAS,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACzB,uEAAuE;YACvE,+CAA+C;YAC/C,OAAO;gBACL,OAAO,EAAE,SAAS;gBAClB,MAAM,EACJ,4BAA4B,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,iDAAiD;oBACjG,2GAA2G;aAC9G,CAAC;QACJ,CAAC;QACD,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;IAC3B,CAAC;CACF"}

package/dist/modules/workspace/startup/steps/seed-tree.d.ts

@@ -1,3 +1,4 @@
+import type { IFsProbe, ITreeWalker } from '../../../../shared/fs.contract.js';
 /**
  * The empty-remote seed builder the runner takes as `buildSeedTree`: the full
  * template tree, every reserved root, and a generated roles.yaml. DIRECT fs
@@ -12,6 +13,10 @@
  * `extraRootDirs` is validated eagerly, at composition time: a bad value
  * should fail at boot beside the rest of the wiring, not mid-seed of
  * somebody's knowledge base.
+ *
+ * A factory over {@link KbSeedTree} rather than the class itself, because the
+ * runner's port is a function: it asks for a directory to be filled and gets
+ * back what was generated, and knows nothing of templates or disks.
  */
-export declare function buildSeedTree(templateDir: string, extraRootDirs: readonly string[], seedAdminEmails: readonly string[]): (dir: string) => Promise<string[]>;
+export declare function buildSeedTree(disk: IFsProbe & ITreeWalker, templateDir: string, extraRootDirs: readonly string[], seedAdminEmails: readonly string[]): (dir: string) => Promise<string[]>;
 //# sourceMappingURL=seed-tree.d.ts.map

package/dist/modules/workspace/startup/steps/seed-tree.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"seed-tree.d.ts","sourceRoot":"","sources":["../../../../../src/modules/workspace/startup/steps/seed-tree.ts"],"names":[],"mappings":"AAKA;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,aAAa,CAC3B,WAAW,EAAE,MAAM,EACnB,aAAa,EAAE,SAAS,MAAM,EAAE,EAChC,eAAe,EAAE,SAAS,MAAM,EAAE,GACjC,CAAC,GAAG,EAAE,MAAM,KAAK,OAAO,CAAC,MAAM,EAAE,CAAC,CA8BpC"}
+{"version":3,"file":"seed-tree.d.ts","sourceRoot":"","sources":["../../../../../src/modules/workspace/startup/steps/seed-tree.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,QAAQ,EAAE,WAAW,EAAE,MAAM,mCAAmC,CAAC;AAO/E;;;;;;;;;;;;;;;;;;GAkBG;AACH,wBAAgB,aAAa,CAC3B,IAAI,EAAE,QAAQ,GAAG,WAAW,EAC5B,WAAW,EAAE,MAAM,EACnB,aAAa,EAAE,SAAS,MAAM,EAAE,EAChC,eAAe,EAAE,SAAS,MAAM,EAAE,GACjC,CAAC,GAAG,EAAE,MAAM,KAAK,OAAO,CAAC,MAAM,EAAE,CAAC,CAMpC"}

package/dist/modules/workspace/startup/steps/seed-tree.js

@@ -1,7 +1,11 @@
 import fs from 'node:fs/promises';
 import path from 'node:path';
+import { AGENTS_FILE, LEGACY_AGENTS_FILE, renderKbLayoutPlaceholders, } from '@bevel-software/platform-shared';
 import { renderRolesYaml } from '../../../access-model/render-roles-yaml.js';
-import { TEMPLATE_SOURCE_FALLBACKS, reservedRootDirs, templateSource } from './template-files.step.js';
+import { reservedRootDirs } from './template-files.step.js';
+import { TEMPLATE_SOURCE_FALLBACKS, TemplateSource } from './template-source.js';
+import { assertNotGitInternals, hasGitInternalsSegment } from '../../../../shared/git-internals.js';
+import { GitInternalsError } from '../../../../shared/domain-errors.js';
 /**
  * The empty-remote seed builder the runner takes as `buildSeedTree`: the full
  * template tree, every reserved root, and a generated roles.yaml. DIRECT fs
@@ -16,21 +20,52 @@ import { TEMPLATE_SOURCE_FALLBACKS, reservedRootDirs, templateSource } from './t
  * `extraRootDirs` is validated eagerly, at composition time: a bad value
  * should fail at boot beside the rest of the wiring, not mid-seed of
  * somebody's knowledge base.
+ *
+ * A factory over {@link KbSeedTree} rather than the class itself, because the
+ * runner's port is a function: it asks for a directory to be filled and gets
+ * back what was generated, and knows nothing of templates or disks.
  */
-export function buildSeedTree(templateDir, extraRootDirs, seedAdminEmails) {
-    const requiredDirs = reservedRootDirs(extraRootDirs);
-    return async (dir) => {
+export function buildSeedTree(disk, templateDir, extraRootDirs, seedAdminEmails) {
+    // Validated eagerly; resolved per seed. The core roots are live bindings the
+    // setup-completing save may configure after this builder was composed.
+    reservedRootDirs(extraRootDirs);
+    const seeder = new KbSeedTree(disk, new TemplateSource(disk, templateDir), extraRootDirs, seedAdminEmails);
+    return (dir) => seeder.seed(dir);
+}
+/**
+ * Seeding a fresh knowledge base into an empty directory.
+ *
+ * The walker and the template are held, not passed: every step of a seed —
+ * the tree copy, one file's copy, the link check — reads the SAME template
+ * through the SAME disk, and threading both through each helper's signature
+ * only created places where a future caller could pass a different one.
+ */
+class KbSeedTree {
+    disk;
+    templates;
+    extraRootDirs;
+    seedAdminEmails;
+    constructor(disk, templates, extraRootDirs, seedAdminEmails) {
+        this.disk = disk;
+        this.templates = templates;
+        this.extraRootDirs = extraRootDirs;
+        this.seedAdminEmails = seedAdminEmails;
+    }
+    /** Fill `dir` with a complete knowledge base; resolve to what was GENERATED. */
+    async seed(dir) {
         const generated = [];
-        await copyTemplateTree(templateDir, dir);
+        await this.copyTemplateTree(dir);
         // Reserved roots the template does not carry. Without this the seed commit
         // would hold only what the template has, and a distribution's own roots
         // would appear a step later, when the first startup phase tops them up —
         // the same folders, arriving in a second commit for no reason. Keyed on
         // the DIRECTORY's existence: a template already carrying content under a
         // root never gets a pointless placeholder beside it.
-        for (const rootDir of requiredDirs) {
+        // Resolved NOW, not when the builder was composed: a seed that runs on the
+        // save completing first-run setup must lay down the names that save applied.
+        for (const rootDir of reservedRootDirs(this.extraRootDirs)) {
             const abs = path.join(dir, rootDir);
-            const found = await lstatOrNull(abs);
+            const found = await this.disk.lstatOrNull(abs);
             if (found) {
                 if (found.isDirectory())
                     continue;
@@ -44,66 +79,151 @@ export function buildSeedTree(templateDir, extraRootDirs, seedAdminEmails) {
         }
         // Generated, never templated — see roles-yaml.step.ts. The runner refuses
         // to seed an empty remote with no admins, so the list is non-empty here.
-        await fs.writeFile(path.join(dir, 'roles.yaml'), renderRolesYaml(seedAdminEmails), 'utf8');
+        await fs.writeFile(path.join(dir, 'roles.yaml'), renderRolesYaml(this.seedAdminEmails), 'utf8');
         generated.push('roles.yaml');
         return generated;
-    };
-}
-/** Copy the entire template tree into `dest` (roles.yaml isn't in it — it's generated). */
-async function copyTemplateTree(templateDir, dest) {
-    const packableToReal = new Map(Object.entries(TEMPLATE_SOURCE_FALLBACKS).map(([real, packable]) => [packable, real]));
-    const walk = async (relDir) => {
-        const abs = path.join(templateDir, relDir);
-        const entries = await fs.readdir(abs, { withFileTypes: true });
-        for (const entry of entries) {
-            // Never copy a git dir: a KB_TEMPLATE_DIR that is itself a working tree
-            // (this repo in a Docker build) must not seed its history into the KB.
-            if (entry.name === '.git')
-                continue;
-            const rel = relDir ? path.join(relDir, entry.name) : entry.name;
-            if (entry.isDirectory()) {
-                await walk(rel);
-                continue;
-            }
-            // A packable spelling at the template root seeds under its REAL name
-            // — unless the template also carries the literal file (a
-            // distribution's own template), which wins and is copied by its own
-            // walk entry; copying the packable twin too would clobber it.
-            const realName = relDir === '' ? packableToReal.get(entry.name) : undefined;
-            if (realName !== undefined) {
-                if (!(await exists(path.join(templateDir, realName)))) {
-                    await copyTemplateFile(templateDir, realName, dest);
-                }
-                continue;
+    }
+    /** Copy the entire template tree into `dest` (roles.yaml isn't in it — it's generated). */
+    async copyTemplateTree(dest) {
+        // A template that is not there is a broken build, not an empty seed.
+        const templateStat = await this.templates.rootStat();
+        if (templateStat === null || !templateStat.isDirectory()) {
+            throw new Error(`KB template "${this.templates.root}" is not a directory.`);
+        }
+        // Never copy a git dir: a KB_TEMPLATE_DIR that is itself a working tree
+        // (this repo in a Docker build) must not seed its history into the KB.
+        // Every other entry is template content, dot-files included.
+        await this.disk.walk(this.templates.root, { skip: (e) => hasGitInternalsSegment(e.name), unreadable: 'throw' }, [
+            {
+                onFile: (relDir, name) => this.seedFile(relDir, name, dest),
+                onOther: async (relDir, entry) => {
+                    // A template may LINK to a file (a distribution's checkout, a Docker
+                    // build's copy): its content is template content, read through the
+                    // link and seeded under the link's own name like any file. Anything
+                    // else — a link to a folder or to nothing, a socket — is a broken
+                    // template, and the error says what was found.
+                    const rel = relDir ? path.join(relDir, entry.name) : entry.name;
+                    // A link whose target is inside a git folder is not template
+                    // content, whatever it is named: seeding it would copy a working
+                    // tree's `.git/config` into the KB as an ordinary file. The name
+                    // check above cannot see this — only the resolved target can.
+                    if (await linksIntoGitInternals(this.templates.root, rel))
+                        return;
+                    const target = await this.templates.statOf(rel);
+                    if (target === null || !target.isFile()) {
+                        const what = target === null ? 'nothing' : target.isDirectory() ? 'a directory' : 'a special file';
+                        throw new Error(`KB template entry "${rel}" ${entry.isSymbolicLink() ? `links to ${what}` : `is ${what}`} — a template holds regular files, or links to them.`);
+                    }
+                    await this.seedFile(relDir, entry.name, dest);
+                },
+            },
+        ]);
+    }
+    /** Seed one template file, by the name the walk saw it under. */
+    async seedFile(relDir, name, dest) {
+        // A packable spelling at the template root seeds under its REAL name
+        // — unless the template also carries the literal file (a
+        // distribution's own template), which wins and is copied by its own
+        // walk entry; copying the packable twin too would clobber it.
+        const realName = relDir === '' ? PACKABLE_TO_REAL.get(name) : undefined;
+        if (realName !== undefined) {
+            if (!(await this.templates.carries(realName))) {
+                await this.copyTemplateFile(realName, dest);
             }
-            await copyTemplateFile(templateDir, rel, dest);
+            return;
         }
-    };
-    await walk('');
-}
-/** Copy one template file (by repo-relative path) into `dest`, creating parents. */
-async function copyTemplateFile(templateDir, relPath, dest) {
-    const from = await templateSource(templateDir, relPath);
-    const to = path.join(dest, relPath);
-    await fs.mkdir(path.dirname(to), { recursive: true });
-    await fs.copyFile(from, to);
+        // The agent guide ships under one name and lands under this deployment's.
+        // Done HERE rather than left to the top-up step, which would otherwise
+        // write the guide under its configured name and then delete the
+        // `AGENTS.md` this seed had just laid down — two commits saying opposite
+        // things about a knowledge base nobody had used yet.
+        if (relDir === '' && name === LEGACY_AGENTS_FILE) {
+            await this.copyTemplateFile(name, dest, AGENTS_FILE);
+            return;
+        }
+        // TWO template entries, ONE destination. A custom template that happens to
+        // carry a root file under the name THIS deployment gave its guide
+        // (`HEXIS.md` in the template, `HEXIS.md` in the setting) would be copied
+        // over the guide the branch above just wrote, or under it, depending on
+        // which order the walk happened to reach them in — and an empty deployment
+        // would be seeded with whichever won. The MANAGED guide wins, always: it
+        // is the file the platform owns, refreshes from the packaged template on
+        // every start and tells every agent to read. The twin is skipped, on the
+        // same reasoning as the packable spelling above.
+        if (relDir === '' && name === AGENTS_FILE && (await this.templates.carries(LEGACY_AGENTS_FILE))) {
+            return;
+        }
+        await this.copyTemplateFile(relDir ? path.join(relDir, name) : name, dest);
+    }
+    /**
+     * Copy one template file (by repo-relative path) into `dest`, creating
+     * parents. `destRel` is the name it lands under when that differs from the
+     * template's — true of the agent guide and nothing else. Text files are RENDERED — the managed guide and the ignore file
+     * name the three root folders, which a deployment may have renamed — and a
+     * file without placeholders comes out byte-identical to its source.
+     *
+     * "Text" is decided by the BYTES, not the name: strict UTF-8 with no NUL.
+     * A name-based rule mistook a hidden binary for text and re-encoded it;
+     * anything that does not decode is copied byte for byte. Either way the
+     * source's mode survives — a template script keeps its executable bit.
+     */
+    async copyTemplateFile(relPath, dest, destRel = relPath) {
+        const from = await this.templates.pathOf(relPath);
+        const to = path.join(dest, destRel);
+        await fs.mkdir(path.dirname(to), { recursive: true });
+        // A binary is spotted from its first bytes (a NUL turns up early in any
+        // real one) and streamed across without ever being read whole; only what
+        // may be text is read in full, and the full decode is still the judge.
+        const text = (await headHasNul(from)) ? null : asText(await fs.readFile(from));
+        if (text === null) {
+            await fs.copyFile(from, to);
+        }
+        else {
+            await fs.writeFile(to, renderKbLayoutPlaceholders(text), 'utf8');
+        }
+        await fs.chmod(to, (await fs.stat(from)).mode & 0o777);
+    }
 }
-async function exists(p) {
+/** The packable spelling a template may carry → the name it seeds under. */
+const PACKABLE_TO_REAL = new Map([...TEMPLATE_SOURCE_FALLBACKS].map(([real, packable]) => [packable, real]));
+/** Whether the first 8 KiB carry a NUL byte — the cheap half of "is this text". */
+async function headHasNul(file) {
+    const handle = await fs.open(file, 'r');
     try {
-        await fs.access(p);
-        return true;
+        const buf = Buffer.alloc(8192);
+        const { bytesRead } = await handle.read(buf, 0, buf.length, 0);
+        return buf.subarray(0, bytesRead).includes(0);
     }
-    catch {
-        return false;
+    finally {
+        await handle.close();
     }
 }
-/** `lstat` without the throw — null when nothing is at `p`. */
-async function lstatOrNull(p) {
+/** The bytes as text when they ARE text — strict UTF-8, BOM kept, no NUL — else null. */
+function asText(bytes) {
+    if (bytes.includes(0))
+        return null;
     try {
-        return await fs.lstat(p);
+        return new TextDecoder('utf-8', { fatal: true, ignoreBOM: true }).decode(bytes);
     }
     catch {
         return null;
     }
 }
+/**
+ * Whether `rel` under `templateRoot` resolves inside a git folder — the
+ * template entry is a link, and following it would read the repository's own
+ * git data. Judged on the resolved path, so a link out of the template into
+ * some other checkout's `.git` counts too.
+ */
+async function linksIntoGitInternals(templateRoot, rel) {
+    try {
+        await assertNotGitInternals(templateRoot, rel);
+        return false;
+    }
+    catch (err) {
+        if (err instanceof GitInternalsError)
+            return true;
+        throw err;
+    }
+}
 //# sourceMappingURL=seed-tree.js.map