@cleocode/core 2026.9.22 → 2026.9.24

package/dist/store/worktree-build-guard.js

@@ -0,0 +1,497 @@
+/**
+ * Worktree-build schema-write guard (T12687).
+ *
+ * A CLI built inside a linked git worktree carries that branch's UNRELEASED
+ * migrations and schema code. Path resolution maps a worktree to its parent
+ * project's store (T12460), so running that build — `cleo check arch`, an
+ * unsandboxed CLI test, a reviewer trying a PR build — changed the schema of
+ * the LIVE main-checkout store. Incident 2026-09-29: cleo-nexus's slice-2
+ * build wrote `__drizzle_migrations` row 114 into the live cleocode store; the
+ * released CLI then deleted the unknown row as an orphan and the next slice-2
+ * open re-ran `ADD COLUMN` and failed.
+ *
+ * ## One decision per store, enforced on the handle
+ *
+ * {@link schemaWriteRefusal} decides, once per store path, whether this build
+ * may change that store's schema. When it may not,
+ * {@link installSchemaWriteGuard} installs a SQLite authorizer on the handle
+ * that DENIES every schema change — `ALTER`, `DROP`, and any `CREATE` of an
+ * object that does not already exist (a `CREATE … IF NOT EXISTS` of an
+ * existing object is a no-op and stays allowed). That covers every DDL site
+ * at once — drizzle migrations, `ensureColumns`, raw `ALTER`s, table
+ * rebuilds, twin collapse, exodus — including sites added later. Migration
+ * sites additionally fail fast with {@link WorktreeBuildSchemaError} when the
+ * build has pending migrations: the store would not match what this build
+ * reads, so it refuses rather than failing later with `no such column`.
+ *
+ * ## Who is a dev build
+ *
+ * The build stamp `dist/build-provenance.json` (written at build time) names
+ * the linked worktree the build was made in, or null for a main checkout / CI
+ * clone — how released packages are built. The stamp travels with the build,
+ * so an `npm pack`ed worktree build installed globally, or a `dist` copied
+ * outside any checkout, is still recognised. Without a stamp (running from
+ * source), the running file's own location decides, and a path under
+ * `node_modules` counts as installed.
+ *
+ * Allowed without an opt-in: stores inside the build's own worktree, and the
+ * test harness's fixtures (under `VITEST`, a store below `os.tmpdir()` — the
+ * fork sandbox; or a store below a {@link TEST_SANDBOX_MARKER} for CLI
+ * children a test spawns). `VITEST` alone is NOT an exemption: a test that
+ * reaches a real checkout's store is refused (T12737). Outside the harness a
+ * temp directory alone is not one either — a project cloned under `/tmp` is a
+ * real store. Everything else needs `CLEO_ALLOW_WORKTREE_BUILD_MIGRATIONS=1`.
+ *
+ * @task T12687
+ */
+import { existsSync, readFileSync, realpathSync } from 'node:fs';
+import { createRequire } from 'node:module';
+import { tmpdir } from 'node:os';
+import { dirname, isAbsolute, join, relative, resolve, sep } from 'node:path';
+import { fileURLToPath } from 'node:url';
+import { ExitCode } from '@cleocode/contracts';
+import { CleoError } from '../errors.js';
+import { isGitLinkedCheckout } from '../project-scope.js';
+/** Opt-in that lets a worktree build change the schema of a store outside its worktree. */
+export const ALLOW_WORKTREE_BUILD_MIGRATIONS_ENV = 'CLEO_ALLOW_WORKTREE_BUILD_MIGRATIONS';
+/**
+ * File the test harness (`vitest.setup.ts`) writes at the root of each fork's
+ * sandbox. A store below it is a fixture — including one opened by a CLI child
+ * process the test spawned: such a child carries `VITEST` only when the test
+ * passes its own environment through, and many build an explicit `env`.
+ * A marker inside a git checkout is ignored: the sandbox is never in one, so a
+ * marker there was committed or planted in a real project.
+ */
+export const TEST_SANDBOX_MARKER = '.cleo-test-sandbox';
+/** Error code of {@link WorktreeBuildSchemaError}. */
+export const E_WORKTREE_BUILD_SCHEMA = 'E_WORKTREE_BUILD_SCHEMA';
+let overrides = null;
+const decisions = new Map();
+/**
+ * Replace the guard's view of the running build (tests only: a test process
+ * runs from source inside the harness, so it cannot be a dev build itself).
+ *
+ * @param next - Partial options, or null to restore the defaults.
+ * @internal
+ */
+export function setWorktreeBuildGuardForTests(next) {
+    overrides = next;
+    decisions.clear();
+}
+function realOrResolved(path) {
+    try {
+        return realpathSync(path);
+    }
+    catch {
+        return resolve(path);
+    }
+}
+function isWithin(root, path) {
+    const local = relative(root, path);
+    return local === '' || (!isAbsolute(local) && local !== '..' && !local.startsWith(`..${sep}`));
+}
+/** Whether `dir` or an ancestor is a git checkout (has `.git`). */
+function insideGitCheckout(dir) {
+    let current = dir;
+    for (;;) {
+        if (existsSync(join(current, '.git')))
+            return true;
+        const parent = dirname(current);
+        if (parent === current)
+            return false;
+        current = parent;
+    }
+}
+/**
+ * Whether a {@link TEST_SANDBOX_MARKER} sits in `path` or an ancestor, outside
+ * any git checkout (a marker inside a checkout is refused).
+ */
+function insideTestSandbox(path) {
+    let dir = dirname(path);
+    for (;;) {
+        if (existsSync(join(dir, TEST_SANDBOX_MARKER)))
+            return !insideGitCheckout(dir);
+        const parent = dirname(dir);
+        if (parent === dir)
+            return false;
+        dir = parent;
+    }
+}
+/**
+ * Root of the linked git worktree containing `path`, or null when the nearest
+ * enclosing checkout is a main checkout (or there is none).
+ *
+ * @param path - Any path.
+ * @returns The linked worktree root, or null.
+ */
+export function linkedWorktreeRootOf(path) {
+    let dir = realOrResolved(path);
+    for (;;) {
+        if (isGitLinkedCheckout(dir))
+            return dir;
+        if (existsSync(join(dir, '.git')))
+            return null; // a main checkout
+        const parent = dirname(dir);
+        if (parent === dir)
+            return null;
+        dir = parent;
+    }
+}
+/**
+ * The build stamp beside the running build: the nearest `build-provenance.json`
+ * walking up from `codePath`, stopping at the package root.
+ *
+ * @param codePath - A file of the running build.
+ * @returns The stamp, or null when there is none (running from source).
+ */
+export function readBuildProvenance(codePath) {
+    let dir = dirname(codePath);
+    for (;;) {
+        const stamp = join(dir, 'build-provenance.json');
+        if (existsSync(stamp)) {
+            try {
+                const parsed = JSON.parse(readFileSync(stamp, 'utf8'));
+                if (typeof parsed === 'object' && parsed !== null && 'linkedWorktree' in parsed) {
+                    const value = parsed.linkedWorktree;
+                    // Only an explicit null or a path is trusted; anything else falls back.
+                    if (value === null || typeof value === 'string')
+                        return { linkedWorktree: value };
+                }
+            }
+            catch {
+                // An unreadable stamp decides nothing; fall back to the path.
+            }
+            return null;
+        }
+        if (existsSync(join(dir, 'package.json')))
+            return null;
+        const parent = dirname(dir);
+        if (parent === dir)
+            return null;
+        dir = parent;
+    }
+}
+/**
+ * The linked worktree this build came from, or null for a released build.
+ *
+ * @param options - Injection points; defaults describe this process.
+ * @returns The worktree root, or null.
+ */
+export function devBuildWorktree(options = {}) {
+    const codePath = options.codePath ?? overrides?.codePath ?? fileURLToPath(import.meta.url);
+    const provenance = options.provenance !== undefined
+        ? options.provenance
+        : overrides?.provenance !== undefined
+            ? overrides.provenance
+            : readBuildProvenance(codePath);
+    if (provenance)
+        return provenance.linkedWorktree;
+    if (codePath.split(/[\\/]/).includes('node_modules'))
+        return null;
+    return linkedWorktreeRootOf(codePath);
+}
+/**
+ * Why this build must not change the schema of `dbPath`, or null when it may.
+ *
+ * @param dbPath - Store path.
+ * @param options - Injection points; defaults describe this process.
+ * @returns The refusal naming the build's worktree, the store and the opt-in.
+ * @task T12687
+ */
+export function schemaWriteRefusal(dbPath, options = {}) {
+    const env = options.env ?? overrides?.env ?? process.env;
+    const buildWorktree = devBuildWorktree(options);
+    if (buildWorktree === null)
+        return null;
+    const store = realOrResolved(dbPath);
+    if (isWithin(realOrResolved(buildWorktree), store))
+        return null;
+    // The test harness owns its FIXTURE stores — those under a temp root — and
+    // nothing else: an unconditional VITEST exemption let a test run from a
+    // worktree migrate the live main-checkout store (T12737).
+    if (env['VITEST']) {
+        const fixtureRoots = options.fixtureRoots ?? overrides?.fixtureRoots ?? [tmpdir()];
+        if (fixtureRoots.some((root) => isWithin(realOrResolved(root), store)))
+            return null;
+    }
+    const honourTestSandbox = options.honourTestSandbox ?? overrides?.honourTestSandbox ?? true;
+    if (honourTestSandbox && insideTestSandbox(store))
+        return null;
+    if (env[ALLOW_WORKTREE_BUILD_MIGRATIONS_ENV] === '1')
+        return null;
+    return (`Refusing to change the schema of ${store}: this CLI was built inside the git worktree ` +
+        `${buildWorktree}, and its schema may be unreleased. Run the released \`cleo\` against this ` +
+        `store, or opt in with ${ALLOW_WORKTREE_BUILD_MIGRATIONS_ENV}=1 (T12687).`);
+}
+/** Backwards-compatible alias of {@link schemaWriteRefusal}. */
+export const worktreeBuildMigrationRefusal = schemaWriteRefusal;
+/**
+ * The per-store decision, memoised for the process (one decision per store).
+ *
+ * @param dbPath - Store path.
+ * @returns The refusal, or null when schema writes are allowed.
+ */
+function decisionFor(dbPath) {
+    const key = realOrResolved(dbPath);
+    if (!decisions.has(key))
+        decisions.set(key, schemaWriteRefusal(key));
+    return decisions.get(key) ?? null;
+}
+/**
+ * Whether this build may change the schema of the store behind `nativeDb`.
+ *
+ * @param nativeDb - Store handle (`location()` is its path; in-memory is always allowed).
+ * @returns `true` when schema writes are allowed.
+ */
+export function schemaWritesAllowed(nativeDb) {
+    const dbPath = nativeDb.location();
+    return !dbPath || decisionFor(dbPath) === null;
+}
+/** Refusal raised when a dev build would change a foreign store's schema (T12687). */
+export class WorktreeBuildSchemaError extends CleoError {
+    constructor(message) {
+        super(ExitCode.CONFIG_ERROR, `${E_WORKTREE_BUILD_SCHEMA}: ${message}`, {
+            fix: 'Use the released `cleo` for this store, run the build against a store inside its own ' +
+                `worktree, or set ${ALLOW_WORKTREE_BUILD_MIGRATIONS_ENV}=1 to accept the schema change.`,
+        });
+    }
+}
+/** Whether `error` is (or wraps) a {@link WorktreeBuildSchemaError}. */
+export function isWorktreeBuildSchemaError(error) {
+    return error instanceof Error && error.message.includes(E_WORKTREE_BUILD_SCHEMA);
+}
+/**
+ * SQLite action codes, loaded on first use: `node:sqlite` must not load at
+ * module-init time (sqlite.ts imports this module; T1331 lazy-init contract).
+ */
+let authorizerCodes;
+function codes() {
+    if (authorizerCodes)
+        return authorizerCodes;
+    const sqlite = createRequire(import.meta.url)('node:sqlite')
+        .constants;
+    authorizerCodes = {
+        sqlite,
+        creates: new Map([
+            [sqlite.SQLITE_CREATE_TABLE, 'table'],
+            [sqlite.SQLITE_CREATE_VTABLE, 'table'],
+            [sqlite.SQLITE_CREATE_INDEX, 'index'],
+            [sqlite.SQLITE_CREATE_TRIGGER, 'trigger'],
+            [sqlite.SQLITE_CREATE_VIEW, 'view'],
+        ]),
+        changes: new Set([
+            sqlite.SQLITE_ALTER_TABLE,
+            sqlite.SQLITE_DROP_TABLE,
+            sqlite.SQLITE_DROP_INDEX,
+            sqlite.SQLITE_DROP_TRIGGER,
+            sqlite.SQLITE_DROP_VIEW,
+            sqlite.SQLITE_DROP_VTABLE,
+        ]),
+    };
+    return authorizerCodes;
+}
+const guards = new WeakMap();
+/** Refusal for an ATTACH whose store this build cannot identify from its name. */
+const UNKNOWN_ATTACH_REFUSAL = 'a store was ATTACHed by a bound, computed or URI filename, so this build cannot tell whose ' +
+    'store it is; schema changes on unmapped schemas are refused until the guard is refreshed';
+/**
+ * The refusal for an ATTACH, judged from the name SQLite's callback reports.
+ *
+ * Only a plain path is judged directly. The callback reports the filename only
+ * when it is a string literal (null otherwise), and a `file:` URI or a name
+ * with a `?` query is not a path: resolved against cwd it lands inside the
+ * worktree and would pass. Those fail closed until a refresh maps the real
+ * path from `PRAGMA database_list`. `''` and `:memory:` open private stores.
+ *
+ * @param name - The ATTACH callback's filename argument.
+ * @returns The refusal, or `null` when the attach is allowed.
+ */
+function attachRefusal(name) {
+    if (name === '' || name === ':memory:')
+        return null;
+    if (typeof name !== 'string' || /^file:/i.test(name) || name.includes('?')) {
+        return UNKNOWN_ATTACH_REFUSAL;
+    }
+    return decisionFor(name);
+}
+function readSchemas(nativeDb) {
+    const schemas = new Map();
+    const list = nativeDb.prepare('PRAGMA database_list').all();
+    for (const { name, file } of list) {
+        if (name === 'temp')
+            continue;
+        const rows = nativeDb
+            .prepare(`SELECT type, name FROM "${name.replaceAll('"', '""')}".sqlite_master`)
+            .all();
+        schemas.set(name.toLowerCase(), {
+            refusal: file ? decisionFor(file) : null, // '' = in-memory
+            objects: new Set(rows.map((r) => `${r.type}:${r.name}`)),
+        });
+    }
+    return schemas;
+}
+let processBuildWorktree;
+/**
+ * Whether this process is a dev build (the guard's precondition). The test
+ * harness is not exempt here: {@link schemaWriteRefusal} exempts its fixture
+ * stores per store, so a test run from a worktree that reaches a real store is
+ * still guarded (T12737).
+ */
+function guardActive() {
+    if (overrides)
+        return devBuildWorktree() !== null;
+    if (processBuildWorktree === undefined)
+        processBuildWorktree = devBuildWorktree();
+    return processBuildWorktree !== null;
+}
+/**
+ * Install the schema-write guard on a freshly opened writable handle. Call it
+ * right after opening, before any schema code runs.
+ *
+ * Only a dev build (outside the test harness) installs anything; released
+ * builds pay nothing. The authorizer then applies, PER SCHEMA, the decision
+ * for that schema's file: on a refused schema it denies `ALTER`, `DROP` and
+ * any `CREATE` of an object that does not already exist. That covers the main
+ * schema and any store ATTACHed later — an exempt handle (in-memory or inside
+ * the build's own worktree) that attaches a foreign store is guarded on the
+ * attached schema too.
+ *
+ * @param nativeDb - Freshly opened writable handle.
+ * @returns `true` when the main schema itself is refused.
+ * @task T12687
+ */
+export function installSchemaWriteGuard(nativeDb) {
+    if (!guardActive())
+        return false;
+    const location = nativeDb.location();
+    const mainRefusal = location ? decisionFor(location) : null; // in-memory is always allowed
+    if (typeof nativeDb.setAuthorizer !== 'function') {
+        // No authorizer in this Node: refuse a refused store outright rather than
+        // leave schema code unguarded.
+        if (mainRefusal)
+            throw new WorktreeBuildSchemaError(mainRefusal);
+        return false;
+    }
+    const state = {
+        schemas: readSchemas(nativeDb),
+        unmappedAttachRefusal: null,
+        stale: false,
+        lastDenied: null,
+    };
+    guards.set(nativeDb, state);
+    const { sqlite, creates, changes } = codes();
+    nativeDb.setAuthorizer((action, arg1, arg2, dbName) => {
+        if (action === sqlite.SQLITE_ATTACH) {
+            const refusal = attachRefusal(arg1);
+            if (refusal && !state.unmappedAttachRefusal)
+                state.unmappedAttachRefusal = refusal;
+            return sqlite.SQLITE_OK;
+        }
+        if (action === sqlite.SQLITE_DETACH) {
+            state.stale = true;
+            return sqlite.SQLITE_OK;
+        }
+        const createType = creates.get(action);
+        if (createType === undefined && !changes.has(action))
+            return sqlite.SQLITE_OK;
+        // SQLITE_ALTER_TABLE passes (schema, table) in arg1/arg2 and no dbName;
+        // every other action passes the schema as dbName.
+        // Schema names are case-insensitive in SQLite; the map is keyed lower-case.
+        const schema = ((action === sqlite.SQLITE_ALTER_TABLE ? arg1 : dbName) ?? 'main').toLowerCase();
+        if (schema === 'temp')
+            return sqlite.SQLITE_OK;
+        // After a DETACH every schema is unmapped until refresh. Its old refusal
+        // still applies, because the DETACH may have failed after authorization.
+        const mapped = state.schemas.get(schema);
+        const policy = state.stale ? undefined : mapped;
+        const refusal = policy
+            ? policy.refusal
+            : (mapped?.refusal ?? null) || state.unmappedAttachRefusal;
+        if (refusal === null)
+            return sqlite.SQLITE_OK;
+        // CREATE … IF NOT EXISTS of an existing object is a no-op.
+        if (createType !== undefined && policy?.objects.has(`${createType}:${arg1}`)) {
+            return sqlite.SQLITE_OK;
+        }
+        state.lastDenied = {
+            what: createType !== undefined
+                ? `CREATE ${createType} ${schema}.${arg1}`
+                : `schema change on ${schema}.${(action === sqlite.SQLITE_ALTER_TABLE ? arg2 : arg1) ?? ''}`,
+            refusal,
+        };
+        return sqlite.SQLITE_DENY;
+    });
+    return mainRefusal !== null;
+}
+/**
+ * Re-read the schema map after an `ATTACH`, so the attached schema gets its own
+ * decision and no-op `CREATE … IF NOT EXISTS` statements on it stay allowed.
+ *
+ * @param nativeDb - A handle passed to {@link installSchemaWriteGuard}.
+ */
+export function refreshSchemaWriteGuard(nativeDb) {
+    const state = guards.get(nativeDb);
+    if (!state)
+        return;
+    state.schemas = readSchemas(nativeDb);
+    state.unmappedAttachRefusal = null;
+    state.stale = false;
+}
+/**
+ * Turn SQLite's bare `not authorized` from a guarded handle into the refusal
+ * that says why and what to do. Other errors are returned unchanged.
+ *
+ * @param nativeDb - The handle the error came from.
+ * @param error - The caught error.
+ * @returns The error to rethrow.
+ */
+export function explainSchemaWriteDenial(nativeDb, error) {
+    if (!(error instanceof Error) || !/not authorized/i.test(error.message))
+        return error;
+    const denied = guards.get(nativeDb)?.lastDenied;
+    if (!denied)
+        return error;
+    return new WorktreeBuildSchemaError(`${denied.refusal} Denied: ${denied.what}.`);
+}
+/**
+ * Migrations of one lineage that `nativeDb`'s journal does not yet record.
+ *
+ * @param nativeDb - Store handle.
+ * @param migrations - The lineage's local migrations.
+ * @returns Names (or hashes) of the pending migrations; all of them when the
+ *   journal table does not exist yet.
+ */
+export function pendingMigrations(nativeDb, migrations) {
+    const hasJournal = nativeDb
+        .prepare("SELECT 1 FROM sqlite_master WHERE type = 'table' AND name = '__drizzle_migrations'")
+        .get();
+    const applied = hasJournal
+        ? new Set(nativeDb.prepare('SELECT hash FROM main."__drizzle_migrations"').all().map((row) => row.hash))
+        : new Set();
+    return migrations.filter((m) => !applied.has(m.hash)).map((m) => m.name ?? m.hash);
+}
+/**
+ * The guard at a migration site: when this build may not change the store's
+ * schema and the lineage has pending migrations, FAIL FAST — the store does
+ * not match what this build reads, so continuing would only fail later with
+ * `no such column`.
+ *
+ * @param nativeDb - Store handle.
+ * @param migrations - The lineage's local migrations.
+ * @throws {WorktreeBuildSchemaError} naming the build worktree, the store,
+ *   the pending migrations and the opt-in.
+ * @task T12687
+ */
+export function assertNoPendingMigrationsForWorktreeBuild(nativeDb, migrations) {
+    const dbPath = nativeDb.location();
+    if (!dbPath)
+        return;
+    const refusal = decisionFor(dbPath);
+    if (refusal === null)
+        return;
+    const pending = pendingMigrations(nativeDb, migrations);
+    if (pending.length === 0)
+        return;
+    throw new WorktreeBuildSchemaError(`${refusal} Pending migrations: ${pending.join(', ')}.`);
+}
+//# sourceMappingURL=worktree-build-guard.js.map

package/dist/store/worktree-build-guard.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"worktree-build-guard.js","sourceRoot":"","sources":["../../src/store/worktree-build-guard.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6CG;AAEH,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AACjE,OAAO,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAC5C,OAAO,EAAE,MAAM,EAAE,MAAM,SAAS,CAAC;AACjC,OAAO,EAAE,OAAO,EAAE,UAAU,EAAE,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,GAAG,EAAE,MAAM,WAAW,CAAC;AAE9E,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AACzC,OAAO,EAAE,QAAQ,EAAE,MAAM,qBAAqB,CAAC;AAE/C,OAAO,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AACzC,OAAO,EAAE,mBAAmB,EAAE,MAAM,qBAAqB,CAAC;AAE1D,2FAA2F;AAC3F,MAAM,CAAC,MAAM,mCAAmC,GAAG,sCAAsC,CAAC;AAE1F;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,mBAAmB,GAAG,oBAAoB,CAAC;AAExD,sDAAsD;AACtD,MAAM,CAAC,MAAM,uBAAuB,GAAG,yBAAyB,CAAC;AA+BjE,IAAI,SAAS,GAA8C,IAAI,CAAC;AAChE,MAAM,SAAS,GAAG,IAAI,GAAG,EAAyB,CAAC;AAEnD;;;;;;GAMG;AACH,MAAM,UAAU,6BAA6B,CAC3C,IAA+C;IAE/C,SAAS,GAAG,IAAI,CAAC;IACjB,SAAS,CAAC,KAAK,EAAE,CAAC;AACpB,CAAC;AAED,SAAS,cAAc,CAAC,IAAY;IAClC,IAAI,CAAC;QACH,OAAO,YAAY,CAAC,IAAI,CAAC,CAAC;IAC5B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,OAAO,CAAC,IAAI,CAAC,CAAC;IACvB,CAAC;AACH,CAAC;AAED,SAAS,QAAQ,CAAC,IAAY,EAAE,IAAY;IAC1C,MAAM,KAAK,GAAG,QAAQ,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;IACnC,OAAO,KAAK,KAAK,EAAE,IAAI,CAAC,CAAC,UAAU,CAAC,KAAK,CAAC,IAAI,KAAK,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,KAAK,GAAG,EAAE,CAAC,CAAC,CAAC;AACjG,CAAC;AAED,mEAAmE;AACnE,SAAS,iBAAiB,CAAC,GAAW;IACpC,IAAI,OAAO,GAAG,GAAG,CAAC;IAClB,SAAS,CAAC;QACR,IAAI,UAAU,CAAC,IAAI,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;YAAE,OAAO,IAAI,CAAC;QACnD,MAAM,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;QAChC,IAAI,MAAM,KAAK,OAAO;YAAE,OAAO,KAAK,CAAC;QACrC,OAAO,GAAG,MAAM,CAAC;IACnB,CAAC;AACH,CAAC;AAED;;;GAGG;AACH,SAAS,iBAAiB,CAAC,IAAY;IACrC,IAAI,GAAG,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACxB,SAAS,CAAC;QACR,IAAI,UAAU,CAAC,IAAI,CAAC,GAAG,EAAE,mBAAmB,CAAC,CAAC;YAAE,OAAO,CAAC,iBAAiB,CAAC,GAAG,CAAC,CAAC;QAC/E,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC;QAC5B,IAAI,MAAM,KAAK,GAAG;YAAE,OAAO,KAAK,CAAC;QACjC,GAAG,GAAG,MAAM,CAAC;IACf,CAAC;AACH,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,oBAAoB,CAAC,IAAY;IAC/C,IAAI,GAAG,GAAG,cAAc,CAAC,IAAI,CAAC,CAAC;IAC/B,SAAS,CAAC;QACR,IAAI,mBAAmB,CAAC,GAAG,CAAC;YAAE,OAAO,GAAG,CAAC;QACzC,IAAI,UAAU,CAAC,IAAI,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;YAAE,OAAO,IAAI,CAAC,CAAC,kBAAkB;QAClE,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC;QAC5B,IAAI,MAAM,KAAK,GAAG;YAAE,OAAO,IAAI,CAAC;QAChC,GAAG,GAAG,MAAM,CAAC;IACf,CAAC;AACH,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,mBAAmB,CAAC,QAAgB;IAClD,IAAI,GAAG,GAAG,OAAO,CAAC,QAAQ,CAAC,CAAC;IAC5B,SAAS,CAAC;QACR,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,EAAE,uBAAuB,CAAC,CAAC;QACjD,IAAI,UAAU,CAAC,KAAK,CAAC,EAAE,CAAC;YACtB,IAAI,CAAC;gBACH,MAAM,MAAM,GAAY,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC,CAAC;gBAChE,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,KAAK,IAAI,IAAI,gBAAgB,IAAI,MAAM,EAAE,CAAC;oBAChF,MAAM,KAAK,GAAI,MAAsC,CAAC,cAAc,CAAC;oBACrE,wEAAwE;oBACxE,IAAI,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ;wBAAE,OAAO,EAAE,cAAc,EAAE,KAAK,EAAE,CAAC;gBACpF,CAAC;YACH,CAAC;YAAC,MAAM,CAAC;gBACP,8DAA8D;YAChE,CAAC;YACD,OAAO,IAAI,CAAC;QACd,CAAC;QACD,IAAI,UAAU,CAAC,IAAI,CAAC,GAAG,EAAE,cAAc,CAAC,CAAC;YAAE,OAAO,IAAI,CAAC;QACvD,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC;QAC5B,IAAI,MAAM,KAAK,GAAG;YAAE,OAAO,IAAI,CAAC;QAChC,GAAG,GAAG,MAAM,CAAC;IACf,CAAC;AACH,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,gBAAgB,CAAC,UAA8C,EAAE;IAC/E,MAAM,QAAQ,GAAG,OAAO,CAAC,QAAQ,IAAI,SAAS,EAAE,QAAQ,IAAI,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAC3F,MAAM,UAAU,GACd,OAAO,CAAC,UAAU,KAAK,SAAS;QAC9B,CAAC,CAAC,OAAO,CAAC,UAAU;QACpB,CAAC,CAAC,SAAS,EAAE,UAAU,KAAK,SAAS;YACnC,CAAC,CAAC,SAAS,CAAC,UAAU;YACtB,CAAC,CAAC,mBAAmB,CAAC,QAAQ,CAAC,CAAC;IACtC,IAAI,UAAU;QAAE,OAAO,UAAU,CAAC,cAAc,CAAC;IACjD,IAAI,QAAQ,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,QAAQ,CAAC,cAAc,CAAC;QAAE,OAAO,IAAI,CAAC;IAClE,OAAO,oBAAoB,CAAC,QAAQ,CAAC,CAAC;AACxC,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,kBAAkB,CAChC,MAAc,EACd,UAA8C,EAAE;IAEhD,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,IAAI,SAAS,EAAE,GAAG,IAAI,OAAO,CAAC,GAAG,CAAC;IACzD,MAAM,aAAa,GAAG,gBAAgB,CAAC,OAAO,CAAC,CAAC;IAChD,IAAI,aAAa,KAAK,IAAI;QAAE,OAAO,IAAI,CAAC;IACxC,MAAM,KAAK,GAAG,cAAc,CAAC,MAAM,CAAC,CAAC;IACrC,IAAI,QAAQ,CAAC,cAAc,CAAC,aAAa,CAAC,EAAE,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IAChE,2EAA2E;IAC3E,wEAAwE;IACxE,0DAA0D;IAC1D,IAAI,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC;QAClB,MAAM,YAAY,GAAG,OAAO,CAAC,YAAY,IAAI,SAAS,EAAE,YAAY,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC;QACnF,IAAI,YAAY,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,QAAQ,CAAC,cAAc,CAAC,IAAI,CAAC,EAAE,KAAK,CAAC,CAAC;YAAE,OAAO,IAAI,CAAC;IACtF,CAAC;IACD,MAAM,iBAAiB,GAAG,OAAO,CAAC,iBAAiB,IAAI,SAAS,EAAE,iBAAiB,IAAI,IAAI,CAAC;IAC5F,IAAI,iBAAiB,IAAI,iBAAiB,CAAC,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IAC/D,IAAI,GAAG,CAAC,mCAAmC,CAAC,KAAK,GAAG;QAAE,OAAO,IAAI,CAAC;IAClE,OAAO,CACL,oCAAoC,KAAK,+CAA+C;QACxF,GAAG,aAAa,6EAA6E;QAC7F,yBAAyB,mCAAmC,cAAc,CAC3E,CAAC;AACJ,CAAC;AAED,gEAAgE;AAChE,MAAM,CAAC,MAAM,6BAA6B,GAAG,kBAAkB,CAAC;AAEhE;;;;;GAKG;AACH,SAAS,WAAW,CAAC,MAAc;IACjC,MAAM,GAAG,GAAG,cAAc,CAAC,MAAM,CAAC,CAAC;IACnC,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,GAAG,CAAC;QAAE,SAAS,CAAC,GAAG,CAAC,GAAG,EAAE,kBAAkB,CAAC,GAAG,CAAC,CAAC,CAAC;IACrE,OAAO,SAAS,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,IAAI,CAAC;AACpC,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,mBAAmB,CAAC,QAAsB;IACxD,MAAM,MAAM,GAAG,QAAQ,CAAC,QAAQ,EAAE,CAAC;IACnC,OAAO,CAAC,MAAM,IAAI,WAAW,CAAC,MAAM,CAAC,KAAK,IAAI,CAAC;AACjD,CAAC;AAED,sFAAsF;AACtF,MAAM,OAAO,wBAAyB,SAAQ,SAAS;IACrD,YAAY,OAAe;QACzB,KAAK,CAAC,QAAQ,CAAC,YAAY,EAAE,GAAG,uBAAuB,KAAK,OAAO,EAAE,EAAE;YACrE,GAAG,EACD,uFAAuF;gBACvF,oBAAoB,mCAAmC,iCAAiC;SAC3F,CAAC,CAAC;IACL,CAAC;CACF;AAED,wEAAwE;AACxE,MAAM,UAAU,0BAA0B,CAAC,KAAc;IACvD,OAAO,KAAK,YAAY,KAAK,IAAI,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,uBAAuB,CAAC,CAAC;AACnF,CAAC;AAID;;;GAGG;AACH,IAAI,eAMS,CAAC;AAEd,SAAS,KAAK;IACZ,IAAI,eAAe;QAAE,OAAO,eAAe,CAAC;IAC5C,MAAM,MAAM,GAAI,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,aAAa,CAAkC;SAC3F,SAAS,CAAC;IACb,eAAe,GAAG;QAChB,MAAM;QACN,OAAO,EAAE,IAAI,GAAG,CAAC;YACf,CAAC,MAAM,CAAC,mBAAmB,EAAE,OAAO,CAAC;YACrC,CAAC,MAAM,CAAC,oBAAoB,EAAE,OAAO,CAAC;YACtC,CAAC,MAAM,CAAC,mBAAmB,EAAE,OAAO,CAAC;YACrC,CAAC,MAAM,CAAC,qBAAqB,EAAE,SAAS,CAAC;YACzC,CAAC,MAAM,CAAC,kBAAkB,EAAE,MAAM,CAAC;SACpC,CAAC;QACF,OAAO,EAAE,IAAI,GAAG,CAAC;YACf,MAAM,CAAC,kBAAkB;YACzB,MAAM,CAAC,iBAAiB;YACxB,MAAM,CAAC,iBAAiB;YACxB,MAAM,CAAC,mBAAmB;YAC1B,MAAM,CAAC,gBAAgB;YACvB,MAAM,CAAC,kBAAkB;SAC1B,CAAC;KACH,CAAC;IACF,OAAO,eAAe,CAAC;AACzB,CAAC;AA4BD,MAAM,MAAM,GAAG,IAAI,OAAO,EAA6B,CAAC;AAExD,kFAAkF;AAClF,MAAM,sBAAsB,GAC1B,6FAA6F;IAC7F,0FAA0F,CAAC;AAE7F;;;;;;;;;;;GAWG;AACH,SAAS,aAAa,CAAC,IAA+B;IACpD,IAAI,IAAI,KAAK,EAAE,IAAI,IAAI,KAAK,UAAU;QAAE,OAAO,IAAI,CAAC;IACpD,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;QAC3E,OAAO,sBAAsB,CAAC;IAChC,CAAC;IACD,OAAO,WAAW,CAAC,IAAI,CAAC,CAAC;AAC3B,CAAC;AAED,SAAS,WAAW,CAAC,QAAsB;IACzC,MAAM,OAAO,GAAG,IAAI,GAAG,EAAwB,CAAC;IAChD,MAAM,IAAI,GAAG,QAAQ,CAAC,OAAO,CAAC,sBAAsB,CAAC,CAAC,GAAG,EAGvD,CAAC;IACH,KAAK,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,IAAI,EAAE,CAAC;QAClC,IAAI,IAAI,KAAK,MAAM;YAAE,SAAS;QAC9B,MAAM,IAAI,GAAG,QAAQ;aAClB,OAAO,CAAC,2BAA2B,IAAI,CAAC,UAAU,CAAC,GAAG,EAAE,IAAI,CAAC,iBAAiB,CAAC;aAC/E,GAAG,EAA2C,CAAC;QAClD,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,WAAW,EAAE,EAAE;YAC9B,OAAO,EAAE,IAAI,CAAC,CAAC,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,iBAAiB;YAC3D,OAAO,EAAE,IAAI,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;SACzD,CAAC,CAAC;IACL,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,IAAI,oBAA+C,CAAC;AAEpD;;;;;GAKG;AACH,SAAS,WAAW;IAClB,IAAI,SAAS;QAAE,OAAO,gBAAgB,EAAE,KAAK,IAAI,CAAC;IAClD,IAAI,oBAAoB,KAAK,SAAS;QAAE,oBAAoB,GAAG,gBAAgB,EAAE,CAAC;IAClF,OAAO,oBAAoB,KAAK,IAAI,CAAC;AACvC,CAAC;AAED;;;;;;;;;;;;;;;GAeG;AACH,MAAM,UAAU,uBAAuB,CAAC,QAAsB;IAC5D,IAAI,CAAC,WAAW,EAAE;QAAE,OAAO,KAAK,CAAC;IACjC,MAAM,QAAQ,GAAG,QAAQ,CAAC,QAAQ,EAAE,CAAC;IACrC,MAAM,WAAW,GAAG,QAAQ,CAAC,CAAC,CAAC,WAAW,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,8BAA8B;IAC3F,IAAI,OAAO,QAAQ,CAAC,aAAa,KAAK,UAAU,EAAE,CAAC;QACjD,0EAA0E;QAC1E,+BAA+B;QAC/B,IAAI,WAAW;YAAE,MAAM,IAAI,wBAAwB,CAAC,WAAW,CAAC,CAAC;QACjE,OAAO,KAAK,CAAC;IACf,CAAC;IACD,MAAM,KAAK,GAAgB;QACzB,OAAO,EAAE,WAAW,CAAC,QAAQ,CAAC;QAC9B,qBAAqB,EAAE,IAAI;QAC3B,KAAK,EAAE,KAAK;QACZ,UAAU,EAAE,IAAI;KACjB,CAAC;IACF,MAAM,CAAC,GAAG,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC;IAC5B,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,OAAO,EAAE,GAAG,KAAK,EAAE,CAAC;IAC7C,QAAQ,CAAC,aAAa,CAAC,CAAC,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE;QACpD,IAAI,MAAM,KAAK,MAAM,CAAC,aAAa,EAAE,CAAC;YACpC,MAAM,OAAO,GAAG,aAAa,CAAC,IAAI,CAAC,CAAC;YACpC,IAAI,OAAO,IAAI,CAAC,KAAK,CAAC,qBAAqB;gBAAE,KAAK,CAAC,qBAAqB,GAAG,OAAO,CAAC;YACnF,OAAO,MAAM,CAAC,SAAS,CAAC;QAC1B,CAAC;QACD,IAAI,MAAM,KAAK,MAAM,CAAC,aAAa,EAAE,CAAC;YACpC,KAAK,CAAC,KAAK,GAAG,IAAI,CAAC;YACnB,OAAO,MAAM,CAAC,SAAS,CAAC;QAC1B,CAAC;QACD,MAAM,UAAU,GAAG,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QACvC,IAAI,UAAU,KAAK,SAAS,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC;YAAE,OAAO,MAAM,CAAC,SAAS,CAAC;QAC9E,wEAAwE;QACxE,kDAAkD;QAClD,4EAA4E;QAC5E,MAAM,MAAM,GAAG,CAAC,CAAC,MAAM,KAAK,MAAM,CAAC,kBAAkB,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,MAAM,CAAC,CAAC,WAAW,EAAE,CAAC;QAChG,IAAI,MAAM,KAAK,MAAM;YAAE,OAAO,MAAM,CAAC,SAAS,CAAC;QAC/C,yEAAyE;QACzE,yEAAyE;QACzE,MAAM,MAAM,GAAG,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QACzC,MAAM,MAAM,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC;QAChD,MAAM,OAAO,GAAG,MAAM;YACpB,CAAC,CAAC,MAAM,CAAC,OAAO;YAChB,CAAC,CAAC,CAAC,MAAM,EAAE,OAAO,IAAI,IAAI,CAAC,IAAI,KAAK,CAAC,qBAAqB,CAAC;QAC7D,IAAI,OAAO,KAAK,IAAI;YAAE,OAAO,MAAM,CAAC,SAAS,CAAC;QAC9C,2DAA2D;QAC3D,IAAI,UAAU,KAAK,SAAS,IAAI,MAAM,EAAE,OAAO,CAAC,GAAG,CAAC,GAAG,UAAU,IAAI,IAAI,EAAE,CAAC,EAAE,CAAC;YAC7E,OAAO,MAAM,CAAC,SAAS,CAAC;QAC1B,CAAC;QACD,KAAK,CAAC,UAAU,GAAG;YACjB,IAAI,EACF,UAAU,KAAK,SAAS;gBACtB,CAAC,CAAC,UAAU,UAAU,IAAI,MAAM,IAAI,IAAI,EAAE;gBAC1C,CAAC,CAAC,oBAAoB,MAAM,IAAI,CAAC,MAAM,KAAK,MAAM,CAAC,kBAAkB,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,EAAE,EAAE;YAChG,OAAO;SACR,CAAC;QACF,OAAO,MAAM,CAAC,WAAW,CAAC;IAC5B,CAAC,CAAC,CAAC;IACH,OAAO,WAAW,KAAK,IAAI,CAAC;AAC9B,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,uBAAuB,CAAC,QAAsB;IAC5D,MAAM,KAAK,GAAG,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;IACnC,IAAI,CAAC,KAAK;QAAE,OAAO;IACnB,KAAK,CAAC,OAAO,GAAG,WAAW,CAAC,QAAQ,CAAC,CAAC;IACtC,KAAK,CAAC,qBAAqB,GAAG,IAAI,CAAC;IACnC,KAAK,CAAC,KAAK,GAAG,KAAK,CAAC;AACtB,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,wBAAwB,CAAC,QAAsB,EAAE,KAAc;IAC7E,IAAI,CAAC,CAAC,KAAK,YAAY,KAAK,CAAC,IAAI,CAAC,iBAAiB,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC;QAAE,OAAO,KAAK,CAAC;IACtF,MAAM,MAAM,GAAG,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,UAAU,CAAC;IAChD,IAAI,CAAC,MAAM;QAAE,OAAO,KAAK,CAAC;IAC1B,OAAO,IAAI,wBAAwB,CAAC,GAAG,MAAM,CAAC,OAAO,YAAY,MAAM,CAAC,IAAI,GAAG,CAAC,CAAC;AACnF,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,iBAAiB,CAC/B,QAAsB,EACtB,UAAoC;IAEpC,MAAM,UAAU,GAAG,QAAQ;SACxB,OAAO,CAAC,oFAAoF,CAAC;SAC7F,GAAG,EAAE,CAAC;IACT,MAAM,OAAO,GAAG,UAAU;QACxB,CAAC,CAAC,IAAI,GAAG,CAEH,QAAQ,CAAC,OAAO,CAAC,8CAA8C,CAAC,CAAC,GAAG,EAGrE,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,IAAI,CAAC,CACzB;QACH,CAAC,CAAC,IAAI,GAAG,EAAU,CAAC;IACtB,OAAO,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC,IAAI,CAAC,CAAC;AACrF,CAAC;AAED;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,yCAAyC,CACvD,QAAsB,EACtB,UAAoC;IAEpC,MAAM,MAAM,GAAG,QAAQ,CAAC,QAAQ,EAAE,CAAC;IACnC,IAAI,CAAC,MAAM;QAAE,OAAO;IACpB,MAAM,OAAO,GAAG,WAAW,CAAC,MAAM,CAAC,CAAC;IACpC,IAAI,OAAO,KAAK,IAAI;QAAE,OAAO;IAC7B,MAAM,OAAO,GAAG,iBAAiB,CAAC,QAAQ,EAAE,UAAU,CAAC,CAAC;IACxD,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO;IACjC,MAAM,IAAI,wBAAwB,CAAC,GAAG,OAAO,wBAAwB,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AAC9F,CAAC"}

package/dist/store/worktree-isolation-guard.d.ts

@@ -15,6 +15,7 @@
  * @saga T9800
  * @decision D009
  */
+import { CleoError } from '../errors.js';
 /**
  * Refuse to open a project-scope store file that lives inside a git worktree.
  *
@@ -61,4 +62,141 @@ export declare function assertStorePathIsNotWorktreeResident(role: string, dbPat
  * ```
  */
 export declare function assertDbPathIsNotWorktreeResident(role: string, cwd?: string): void;
+/** Error code: a whole-store rewrite would land inside a linked worktree (T12708). */
+export declare const E_WT_STORE_REWRITE_REFUSED = "E_WT_STORE_REWRITE_REFUSED";
+/** Error code: a whole-store rewrite of the owning project's store needs confirmation (T12708). */
+export declare const E_WT_STORE_REWRITE_CONFIRM_REQUIRED = "E_WT_STORE_REWRITE_CONFIRM_REQUIRED";
+/** CLI flag that confirms a whole-store rewrite of the owning project's live store. */
+export declare const CONFIRM_OWNER_STORE_FLAG = "--confirm-owner-store";
+/**
+ * Audit file, under the owning project's `.cleo/audit/`, recording every
+ * confirmed owner-store rewrite run from one of its worktrees (T12708).
+ */
+export declare const OWNER_STORE_REWRITE_AUDIT_FILE = "owner-store-rewrite.jsonl";
+/** Inputs of {@link ownerStoreRewriteRefusal} and {@link assertOwnerStoreRewriteConfirmed}. */
+export interface OwnerStoreRewriteOptions {
+    /**
+     * Directory the operation was invoked from. Explicit commands receive it
+     * from the CLI layer; open-time rewrites pass {@link invocationDirectory}.
+     */
+    cwd: string;
+    /** The operator confirmed overwriting the owning project's live store. */
+    confirmOwnerStore?: boolean | undefined;
+    /**
+     * The rewrite runs implicitly when a store opens (auto-recovery, exodus
+     * first-open migration, lineage rebuild, upgrade storage migration). It
+     * targets the owning project's store exactly as it would from the project
+     * root, so it needs no confirmation there: only a worktree-resident target
+     * is refused, and a run from a worktree is audited. Unreleased worktree
+     * builds are stopped separately by the T12687 schema-write guard.
+     */
+    openTime?: boolean | undefined;
+}
+/** One row of {@link OWNER_STORE_REWRITE_AUDIT_FILE}. */
+export interface OwnerStoreRewriteAuditRow {
+    /** ISO-8601 time of the rewrite. */
+    timestamp: string;
+    /** Operation label, e.g. `restore` or `backup recover tasks`. */
+    operation: string;
+    /** `confirmed` by {@link CONFIRM_OWNER_STORE_FLAG}, or an `open-time` rewrite. */
+    trigger: 'confirmed' | 'open-time';
+    /** Linked worktree the operation was run from. */
+    worktree: string;
+    /** Store file or `.cleo/` directory that was overwritten. */
+    store: string;
+    /** Invocation directory. */
+    cwd: string;
+    /** Process id of the writer. */
+    pid: number;
+}
+/**
+ * The directory an open-time store rewrite was invoked from.
+ *
+ * Open-time rewrites receive the caller's optional `cwd`, the same value the
+ * store path was resolved from; when it is absent the store was resolved from
+ * the process directory, so that is the invocation directory.
+ *
+ * @param cwd - The caller's optional working directory.
+ * @returns The absolute invocation directory.
+ * @example
+ * ```ts
+ * invocationDirectory(undefined); // the process directory
+ * ```
+ * @task T12708
+ */
+export declare function invocationDirectory(cwd: string | undefined): string;
+/**
+ * Decide whether a whole-store rewrite (restore, recovery, import, rebuild,
+ * migration) of a project store may run (T12680, T12708). Every whole-store
+ * rewrite shares this decision and its messages.
+ *
+ * - A target inside a linked worktree is refused: CLEO never reads a
+ *   worktree-resident store (T12460), so the rewrite would be lost.
+ * - The owning project's store, reached from one of its worktrees by an
+ *   explicit command, needs {@link CONFIRM_OWNER_STORE_FLAG}: path resolution
+ *   sent the operation to that LIVE store, so the operator must say they mean
+ *   it. An open-time rewrite ({@link OwnerStoreRewriteOptions.openTime}) is
+ *   allowed there.
+ * - Anything else (not a `<root>/.cleo` store, not run from a worktree, or a
+ *   store the worktree does not own) is allowed.
+ *
+ * @param operation - Label naming the rewrite in the message and audit row.
+ * @param target - Store file (`<root>/.cleo/cleo.db`) or `.cleo/` directory.
+ * @param opts - Invocation directory and confirmation.
+ * @returns The refusal, or null when the rewrite may proceed. Never writes.
+ * @example
+ * ```ts
+ * ownerStoreRewriteRefusal('restore', '/home/u/p/.cleo', { cwd: '/wt/T1' }); // CleoError
+ * ```
+ * @task T12708
+ */
+export declare function ownerStoreRewriteRefusal(operation: string, target: string, opts: OwnerStoreRewriteOptions): CleoError | null;
+/**
+ * Enforce {@link ownerStoreRewriteRefusal} and audit a confirmed overwrite.
+ *
+ * When the rewrite targets the owning project's store from one of its
+ * worktrees (confirmed, or an open-time rewrite), a row naming the worktree,
+ * store, operation and trigger is appended to `<owner>/.cleo/audit/`
+ * {@link OWNER_STORE_REWRITE_AUDIT_FILE} before anything is written. A failed
+ * audit write refuses the rewrite (the error propagates).
+ *
+ * @param operation - Label naming the rewrite in the message and audit row.
+ * @param target - Store file (`<root>/.cleo/cleo.db`) or `.cleo/` directory.
+ * @param opts - Invocation directory and confirmation.
+ * @throws `CleoError` {@link E_WT_STORE_REWRITE_REFUSED} or
+ *   {@link E_WT_STORE_REWRITE_CONFIRM_REQUIRED}.
+ * @example
+ * ```ts
+ * assertOwnerStoreRewriteConfirmed('backup recover tasks', '/home/u/p/.cleo/cleo.db', {
+ *   cwd: '/wt/T1',
+ *   confirmOwnerStore: true,
+ * }); // appends an audit row, returns
+ * ```
+ * @task T12708
+ */
+export declare function assertOwnerStoreRewriteConfirmed(operation: string, target: string, opts: OwnerStoreRewriteOptions): void;
+/**
+ * Guard a manual restore (`cleo restore backup`, `admin.backup` restore) that
+ * is run from inside a linked git worktree (T12680): the shared whole-store
+ * rewrite guard ({@link assertOwnerStoreRewriteConfirmed}) with the project's
+ * `.cleo/` as the target.
+ *
+ * @param storeRoot - Project root whose `.cleo/` the restore writes.
+ * @param opts - `cwd` the restore was invoked from (required: core never
+ *   falls back to `process.cwd()`; the CLI layer supplies it), and
+ *   `confirmOwnerStore` to allow overwriting the owner's live store.
+ * @throws `CleoError` {@link E_WT_STORE_REWRITE_REFUSED} when the store lies
+ *   inside a worktree, or {@link E_WT_STORE_REWRITE_CONFIRM_REQUIRED} when
+ *   confirmation is missing.
+ * @example
+ * ```ts
+ * assertRestoreTargetConfirmed('/home/u/project', { cwd: '/data/cleo/worktrees/abc/T1' }); // throws
+ * ```
+ * @task T12680
+ * @task T12708
+ */
+export declare function assertRestoreTargetConfirmed(storeRoot: string, opts: {
+    cwd: string;
+    confirmOwnerStore?: boolean | undefined;
+}): void;
 //# sourceMappingURL=worktree-isolation-guard.d.ts.map

package/dist/store/worktree-isolation-guard.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"worktree-isolation-guard.d.ts","sourceRoot":"","sources":["../../src/store/worktree-isolation-guard.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAWH;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AACH,wBAAgB,oCAAoC,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,IAAI,CAoBvF;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAgB,iCAAiC,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,CAAC,EAAE,MAAM,GAAG,IAAI,CAUlF"}
+{"version":3,"file":"worktree-isolation-guard.d.ts","sourceRoot":"","sources":["../../src/store/worktree-isolation-guard.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAKH,OAAO,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AAWzC;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AACH,wBAAgB,oCAAoC,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,IAAI,CAoBvF;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAgB,iCAAiC,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,CAAC,EAAE,MAAM,GAAG,IAAI,CAUlF;AAmBD,sFAAsF;AACtF,eAAO,MAAM,0BAA0B,+BAA+B,CAAC;AAEvE,mGAAmG;AACnG,eAAO,MAAM,mCAAmC,wCAAwC,CAAC;AAEzF,uFAAuF;AACvF,eAAO,MAAM,wBAAwB,0BAA0B,CAAC;AAEhE;;;GAGG;AACH,eAAO,MAAM,8BAA8B,8BAA8B,CAAC;AAE1E,+FAA+F;AAC/F,MAAM,WAAW,wBAAwB;IACvC;;;OAGG;IACH,GAAG,EAAE,MAAM,CAAC;IACZ,0EAA0E;IAC1E,iBAAiB,CAAC,EAAE,OAAO,GAAG,SAAS,CAAC;IACxC;;;;;;;OAOG;IACH,QAAQ,CAAC,EAAE,OAAO,GAAG,SAAS,CAAC;CAChC;AAED,yDAAyD;AACzD,MAAM,WAAW,yBAAyB;IACxC,oCAAoC;IACpC,SAAS,EAAE,MAAM,CAAC;IAClB,iEAAiE;IACjE,SAAS,EAAE,MAAM,CAAC;IAClB,kFAAkF;IAClF,OAAO,EAAE,WAAW,GAAG,WAAW,CAAC;IACnC,kDAAkD;IAClD,QAAQ,EAAE,MAAM,CAAC;IACjB,6DAA6D;IAC7D,KAAK,EAAE,MAAM,CAAC;IACd,4BAA4B;IAC5B,GAAG,EAAE,MAAM,CAAC;IACZ,gCAAgC;IAChC,GAAG,EAAE,MAAM,CAAC;CACb;AAED;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,mBAAmB,CAAC,GAAG,EAAE,MAAM,GAAG,SAAS,GAAG,MAAM,CAEnE;AA2BD;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,wBAAgB,wBAAwB,CACtC,SAAS,EAAE,MAAM,EACjB,MAAM,EAAE,MAAM,EACd,IAAI,EAAE,wBAAwB,GAC7B,SAAS,GAAG,IAAI,CAuBlB;AAED;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,wBAAgB,gCAAgC,CAC9C,SAAS,EAAE,MAAM,EACjB,MAAM,EAAE,MAAM,EACd,IAAI,EAAE,wBAAwB,GAC7B,IAAI,CAmBN;AAED;;;;;;;;;;;;;;;;;;;GAmBG;AACH,wBAAgB,4BAA4B,CAC1C,SAAS,EAAE,MAAM,EACjB,IAAI,EAAE;IAAE,GAAG,EAAE,MAAM,CAAC;IAAC,iBAAiB,CAAC,EAAE,OAAO,GAAG,SAAS,CAAA;CAAE,GAC7D,IAAI,CAEN"}