@feng0531/dsh-code-review 0.79.0 → 0.80.1

package/src/svn-history.mjs

@@ -1,10 +1,14 @@
+import {sameSvnUrl,canonicalSvnUrl} from './svn-url.mjs';
+import {svnHistoryEndpoints} from './svn-history-endpoints.mjs';
 import {realpath} from 'node:fs/promises';
 import {checked} from './process.mjs';
 import {xml} from './svn.mjs';
 import {hash,decode,relativePath} from './content.mjs';
 import {isSecretPath,assertNonSecretPath} from './secret-path.mjs';
 import {captureProjectRules} from './project-rules.mjs';
+import {captureEffectiveMergeinfo} from './svn-effective-mergeinfo.mjs';
 import {snapshotMergeSources} from './svn-mergeinfo.mjs';
+import {svnSpecialData} from './svn-special.mjs';
 import {svnEolMapping} from './svn-eol-mapping.mjs';
 import {fixedSvnLookup} from './svn-history-lookup.mjs';
 import {svnHistoryDependencies} from './svn-history-dependencies.mjs';
@@ -24,7 +28,7 @@ export function svnHistoryRange(options) {
     return {base:String(Number(target)-1),target,mode:'svn-revision'};
   }
   const base=revision(options.svnBaseRevision),target=revision(options.svnTargetRevision);
-  if (Number(base)>=Number(target)) throw new Error('SVN range requires base before target');
+  if(Number(base)>Number(target)||base===target&&!(options.svnBasePath!==undefined&&options.svnTargetPath!==undefined&&options.svnBasePath!==options.svnTargetPath))throw new Error('SVN range requires base before target, or distinct branch paths at the same revision');
   return {base,target,mode:'svn-range'};
 }
 
@@ -47,6 +51,7 @@ export function mergeSvnHistoryRecord(previous, item) {
 // Fixed URL objects only. No checkout, update, merge, working body or lazy HEAD read.
 export async function captureSvnHistory(cwd,options={}) {
   const range=svnHistoryRange(options);
+  if(options.svnEffectiveMergeinfo!==undefined&&typeof options.svnEffectiveMergeinfo!=='boolean')throw new Error('Invalid SVN effective mergeinfo opt-in');
   if (options.svnAllowNetwork!==undefined && typeof options.svnAllowNetwork!=='boolean') throw new Error('Invalid SVN network opt-in');
   if (options.callerScopePaths!==undefined) validateCallerScopes(options.callerScopePaths);
   const contextPaths=options.contextPaths??[],oldContextPaths=options.oldContextPaths??[],rulePaths=options.rulePaths??[],maxContextFiles=options.maxContextFiles??20;
@@ -71,32 +76,41 @@ export async function captureSvnHistory(cwd,options={}) {
   if(!local?.['wc-info']?.['wcroot-abspath'] || !local.repository?.uuid || !local.url)throw new Error('Missing SVN working-copy identity');
   const root=await realpath(local['wc-info']['wcroot-abspath']);
   if(root!==await realpath(cwd))throw new Error('SVN historical scope must be working-copy root');
-  const {url,networkAccess}=svnHistoryDestination(local.url,options.svnAllowNetwork);
-  const at=(name,rev)=>(name==='.'?url:url+'/'+name.split('/').map(encodeURIComponent).join('/'))+'@'+rev;
-  const identity=async(name,rev)=>{
-    const node=xml(await run(['info','--xml','-r',rev,'--',at(name,rev)])).info?.entry?.[0];
-    const expected=at(name,rev).slice(0,-rev.length-1);
-    if(!node||node.url!==expected||String(node['@_revision'])!==rev||node.repository?.uuid!==local.repository.uuid||node.repository?.root!==local.repository.root||!['file','dir'].includes(node['@_kind']))throw new Error('SVN fixed historical identity mismatch');
+  const endpoints=svnHistoryEndpoints(local,options,svnHistoryDestination);
+  const {url,networkAccess}=svnHistoryDestination(endpoints.targetUrl,options.svnAllowNetwork);
+  const sideFor=(rev,side)=>side??(rev===range.base?'old':'new');
+  const rootFor=(rev,side)=>sideFor(rev,side)==='old'?endpoints.baseUrl:endpoints.targetUrl;
+  const at=(name,rev,side)=>(name==='.'?rootFor(rev,side):rootFor(rev,side)+'/'+name.split('/').map(encodeURIComponent).join('/'))+'@'+rev;
+  const summaryArgs=endpoints.crossUrl?['diff','--summarize','--xml','--notice-ancestry','--',at('.',range.base,'old'),at('.',range.target,'new')]:['diff','--summarize','--xml','--notice-ancestry','-r',range.base+':'+range.target,'--',at('.',range.target)];
+  const identity=async(name,rev,side)=>{
+    const node=xml(await run(['info','--xml','-r',rev,'--',at(name,rev,side)])).info?.entry?.[0];
+    const expected=at(name,rev,side).slice(0,-rev.length-1);
+    if(!node||!sameSvnUrl(node.url,expected)||String(node['@_revision'])!==rev||node.repository?.uuid!==local.repository.uuid||!sameSvnUrl(node.repository?.root,local.repository.root)||!['file','dir'].includes(node['@_kind']))throw new Error('SVN fixed historical identity mismatch');
     return node;
   };
-  await identity('.',range.base);await identity('.',range.target);
-  const summary=await run(['diff','--summarize','--xml','--notice-ancestry','-r',range.base+':'+range.target,'--',at('.',range.target)]);
+  await identity('.',range.base,'old');await identity('.',range.target,'new');
+  const summary=await run(summaryArgs);
   const raw=xml(summary).diff?.paths?.path;
   const paths=raw===undefined?[]:Array.isArray(raw)?raw:[raw];
   if(paths.length>maxFiles)throw new Error('SVN historical change count limit exceeded');
   const records=new Map();
   for(const item of paths){
-    const value=item['#text'];
-    if(typeof value!=='string'||(value!==url&&!value.startsWith(url+'/')))throw new Error('SVN historical path escaped scope');
-    const name=value===url?'.':value.slice(url.length+1).split('/').map(part=>{
+    const rawPath=item['#text'];
+    const value=typeof rawPath==='string'?canonicalSvnUrl(rawPath):rawPath;
+    const scope=typeof value==='string'?[canonicalSvnUrl(endpoints.baseUrl),canonicalSvnUrl(endpoints.targetUrl)].sort((a,b)=>b.length-a.length).find(base=>value===base||value.startsWith(base+'/')):undefined;
+    if(!scope)throw new Error('SVN historical path escaped fixed endpoint scopes');
+    const name=value===scope?'.':value.slice(scope.length+1).split('/').map(part=>{
       const decoded=decodeURIComponent(part);if(decoded.includes('/')||decoded.includes('\\'))throw new Error('Encoded SVN path separator');return decoded;
     }).join('/');
     if(name!=='.')relativePath(name);
+    // SVN may render every summary path relative to one comparison root.
+    // Actions choose existence sides; each actual read separately verifies its URL.
+    // Scope matching here bounds paths only, and is not read authority.
     records.set(name,mergeSvnHistoryRecord(records.get(name),item));
   }
   if(selectedPaths?.some(name=>!records.has(name)))throw new Error('Selected path is not an SVN historical change');
-  const properties=async(name,rev)=>{
-    const targets=xml(await run(['proplist','--xml','--verbose','-r',rev,'--',at(name,rev)])).properties?.target??[];
+  const properties=async(name,rev,side)=>{
+    const targets=xml(await run(['proplist','--xml','--verbose','-r',rev,'--',at(name,rev,side)])).properties?.target??[];
     const result=Object.create(null);
     for(const prop of targets.flatMap(t=>t.property??[])){
       if(typeof prop['@_name']!=='string'||prop['@_encoding']||Object.hasOwn(result,prop['@_name']))throw new Error('Unsupported historical property representation');
@@ -104,11 +118,12 @@ export async function captureSvnHistory(cwd,options={}) {
     }
     return Object.fromEntries(Object.entries(result).sort(([a],[b])=>a.localeCompare(b)));
   };
-  const readSource=async(name,rev)=>{
-    const node=await identity(name,rev),props=await properties(name,rev);
-    if(Object.hasOwn(props,'svn:special'))throw new Error('Historical SVN special node excluded');
-    const content=node['@_kind']==='dir'?decode(Buffer.alloc(0)):decode(await run(['cat','--ignore-keywords','-r',rev,'--',at(name,rev)],true));
-    return {content,props,kind:node['@_kind'],source:{repositoryUuid:local.repository.uuid,url:at(name,rev).slice(0,-rev.length-1),pegRevision:rev,operativeRevision:rev,kind:node['@_kind'],hash:content.hash,textHash:hash(content.text),...(node['@_kind']==='file'&&Object.hasOwn(props,'svn:eol-style')?{eolMapping:svnEolMapping(content.text,props['svn:eol-style'])}:{})}};
+  const readSource=async(name,rev,allowSpecial=false,side)=>{
+    const node=await identity(name,rev,side),props=await properties(name,rev,side);
+    if(Object.hasOwn(props,'svn:special')&&!allowSpecial)throw new Error('Historical SVN special node is link data, not navigation context');
+    const content=node['@_kind']==='dir'?decode(Buffer.alloc(0)):decode(await run(['cat','--ignore-keywords','-r',rev,'--',at(name,rev,side)],true));
+    const special=svnSpecialData(content,props,node['@_kind']);
+    return {content,props,...(special?{special}:{}),kind:node['@_kind'],source:{repositoryUuid:local.repository.uuid,url:at(name,rev,side).slice(0,-rev.length-1),pegRevision:rev,operativeRevision:rev,kind:node['@_kind'],hash:content.hash,textHash:hash(content.text),...(node['@_kind']==='file'&&Object.hasOwn(props,'svn:eol-style')?{eolMapping:svnEolMapping(content.text,props['svn:eol-style'])}:{})}};
   };
   const files=[];
   for(const [name,record]of [...records].sort(([a],[b])=>a<b?-1:a>b?1:0)){
@@ -118,15 +133,16 @@ export async function captureSvnHistory(cwd,options={}) {
     if(isSecretPath(name)){item.eligibility='excluded';item.reason='Credential path excluded';continue;}
     if(selectedPaths&&!selectedPaths.includes(name)){item.eligibility='excluded';item.reason='Not explicitly selected';continue;}
     try{
-      const readSide=async(rev,exists,kind)=>{
+      const readSide=async(rev,exists,kind,side)=>{
         if(!exists)return {content:decode(Buffer.alloc(0)),props:{}};
-        const result=await readSource(name,rev);
+        const result=await readSource(name,rev,true,side);
         if(result.kind!==kind)throw new Error('Historical node kind differs');
         return result;
       };
-      const left=await readSide(range.base,status!=='added',item.oldKind),right=await readSide(range.target,status!=='deleted',item.newKind);
+      const left=await readSide(range.base,status!=='added',item.oldKind,'old'),right=await readSide(range.target,status!=='deleted',item.newKind,'new');
        if(status==='replaced')item.nodeNotice='Fixed historical replacement; each side has its own node kind. Directory content is not file text; descendant changes require separate coverage.';
       item.left=left.content;item.right=right.content;
+      if(left.special||right.special){item.specialData={old:left.special??null,new:right.special??null};item.contentNotice='Each special side is repository link-record data only, not source code or followed target content. Non-special side remains ordinary source. Link targets do not authorize reads.';}
       item.svnSources={...(left.source?{old:left.source}:{}),...(right.source?{new:right.source}:{})};
       for(const key of [...new Set([...Object.keys(left.props),...Object.keys(right.props)])].sort())if(left.props[key]!==right.props[key])item.properties.push({name:key,old:left.props[key]??null,new:right.props[key]??null});
       item.propertyIdentity=hash(JSON.stringify([left.props,right.props]));
@@ -147,10 +163,10 @@ export async function captureSvnHistory(cwd,options={}) {
   const targetContent=async(name)=>{
     const changed=files.find(file=>file.path===name);
     if(changed){
-      if(changed.eligibility!=='reviewable'||changed.rightExists===false||changed.kind!=='file')throw new Error('Historical context or rule is excluded blocked deleted or not a file');
+      if(changed.eligibility!=='reviewable'||changed.rightExists===false||changed.kind!=='file'||changed.specialData)throw new Error('Historical context or rule is excluded blocked deleted or not a file');
       return {content:changed.right,source:changed.svnSources.new};
     }
-    const result=await readSource(name,range.target);if(result.kind!=='file')throw new Error('Historical context or rule requires a file');return result;
+    const result=await readSource(name,range.target,false,'new');if(result.kind!=='file')throw new Error('Historical context or rule requires a file');return result;
   };
   for(const name of [...contextPaths].sort()){
     const target=await targetContent(name),record=records.get(name),changed=files.find(file=>file.path===name);
@@ -159,7 +175,7 @@ export async function captureSvnHistory(cwd,options={}) {
     else{
       // No change record means both fixed sides are present and equal. Read and verify
       // rather than inferring baseline content from target or from the working tree.
-      const old=await readSource(name,range.base);if(old.kind!=='file'||old.content.hash!==target.content.hash||JSON.stringify(old.props)!==JSON.stringify(target.props))throw new Error('Unchanged historical context identity mismatch');
+      const old=await readSource(name,range.base,false,'old');if(old.kind!=='file'||(!endpoints.crossUrl&&(old.content.hash!==target.content.hash||JSON.stringify(old.props)!==JSON.stringify(target.props))))throw new Error('Unchanged historical context identity mismatch');
       item.oldText=old.content.text;item.oldRevision=range.base;item.oldSvnSource=old.source;
     }
     context.push(item);
@@ -167,11 +183,11 @@ export async function captureSvnHistory(cwd,options={}) {
   for(const name of [...oldContextPaths].sort()){
     const changed=files.find(file=>file.path===name);
     if(changed){
-      if(changed.eligibility!=='reviewable'||changed.oldKind!=='file'||!changed.svnSources?.old)throw new Error('Old SVN context conflicts with excluded blocked or absent baseline change');
+      if(changed.eligibility!=='reviewable'||changed.oldKind!=='file'||changed.specialData?.old||!changed.svnSources?.old)throw new Error('Old SVN context conflicts with excluded blocked or absent baseline change');
       // The original changed-file old identity already authorizes this side.
       continue;
     }
-    const old=await readSource(name,range.base);if(old.kind!=='file')throw new Error('Old SVN context requires baseline file');
+    const old=await readSource(name,range.base,false,'old');if(old.kind!=='file')throw new Error('Old SVN context requires baseline file');
     context.push({path:name,oldOnly:true,oldText:old.content.text,oldHash:hash(old.content.text),oldRevision:range.base,oldSvnSource:old.source});
   }
   const rules=await captureProjectRules(root,rulePaths,{signal,files,read:async(_root,name)=>{
@@ -179,40 +195,40 @@ export async function captureSvnHistory(cwd,options={}) {
   }});
   let autoContext,callerDiscovery;
   if(options.autoContext===true||options.callerScopePaths!==undefined){
-    const probes=fixedSvnLookup({signal,list:async(name,rev)=>{
-      const directory=await identity(name,rev);if(directory['@_kind']!=='dir')throw new Error('Historical lookup parent is not directory');
-      const data=xml(await run(['list','--xml','--depth','immediates','-r',rev,'--',at(name,rev)]));
+    const probes=fixedSvnLookup({signal,list:async(name,rev,side)=>{
+      const directory=await identity(name,rev,side);if(directory['@_kind']!=='dir')throw new Error('Historical lookup parent is not directory');
+      const data=xml(await run(['list','--xml','--depth','immediates','-r',rev,'--',at(name,rev,side)]));
       const lists=data.lists?.list;
       const one=Array.isArray(lists)?lists:[lists];
-      if(one.length!==1||!one[0]||one[0]['@_path']!==at(name,rev).slice(0,-rev.length-1))throw new Error('Historical directory listing identity mismatch');
+      if(one.length!==1||!one[0]||!sameSvnUrl(one[0]['@_path'],at(name,rev,side).slice(0,-rev.length-1)))throw new Error('Historical directory listing identity mismatch');
       return (one[0].entry??[]).map(entry=>({name:entry.name,kind:entry['@_kind']}));
     }});
     const exactProbes=new Map();
-    const lookup=async(name,rev)=>{
-      const key=JSON.stringify([rev,name]);
+    const lookup=async(name,rev,side)=>{
+      const key=JSON.stringify([sideFor(rev,side),rev,name]);
       if(!exactProbes.has(key)){
         if(exactProbes.size>=512)throw new Error('SVN historical shared navigation probe limit exceeded');
-        exactProbes.set(key,await probes.lookup(name,rev));
+        exactProbes.set(key,await probes.lookup(name,rev,side));
       }
       return exactProbes.get(key);
     };
     let navigationBytes=context.reduce((sum,item)=>sum+Buffer.byteLength(item.text??'')+Buffer.byteLength(item.oldText??''),0);
-    const navigationRead=async(name,rev)=>{
-      const value=await readSource(name,rev);navigationBytes+=value.content.bytes;
+    const navigationRead=async(name,rev,side)=>{
+      const value=await readSource(name,rev,false,side);navigationBytes+=value.content.bytes;
       if(navigationBytes>1024*1024)throw new Error('SVN historical shared navigation source limit exceeded');
       return value;
     };
     if(navigationBytes>1024*1024)throw new Error('SVN historical shared navigation source limit exceeded');
     if(options.callerScopePaths!==undefined){
       let indexRecords=0;
-      const index=async(scopes,rev)=>{
+      const index=async(scopes,rev,side)=>{
         const entries=[];
         for(const scope of scopes){
-          const node=await lookup(scope,rev);if(!node)continue;if(node.kind!=='dir')throw new Error('Historical caller scope is not directory');
-          await identity(scope,rev);
-          const data=xml(await run(['list','--xml','--depth','infinity','-r',rev,'--',at(scope,rev)]));
+          const node=await lookup(scope,rev,side);if(!node)continue;if(node.kind!=='dir')throw new Error('Historical caller scope is not directory');
+          await identity(scope,rev,side);
+          const data=xml(await run(['list','--xml','--depth','infinity','-r',rev,'--',at(scope,rev,side)]));
           const lists=data.lists?.list,one=Array.isArray(lists)?lists:[lists];
-          if(one.length!==1||!one[0]||one[0]['@_path']!==at(scope,rev).slice(0,-rev.length-1))throw new Error('Historical caller listing identity mismatch');
+          if(one.length!==1||!one[0]||!sameSvnUrl(one[0]['@_path'],at(scope,rev,side).slice(0,-rev.length-1)))throw new Error('Historical caller listing identity mismatch');
           for(const entry of one[0].entry??[]){
             if(++indexRecords>256)throw new Error('Historical caller shared index limit exceeded');
             const name=relativePath(entry.name);entries.push({path:scope+'/'+name,kind:entry['@_kind']});
@@ -228,15 +244,38 @@ export async function captureSvnHistory(cwd,options={}) {
     }
     if(callerDiscovery)callerDiscovery.navigationSourceBytes=navigationBytes;
   }
+  const effectiveMergeSources=[];
+  if(options.svnEffectiveMergeinfo===true){
+    const cache=new Map();
+    const readAncestor=async(name,rev,side)=>{
+      const key=JSON.stringify([side, name,rev]);if(cache.has(key))return cache.get(key);
+      const node=await identity(name,rev,side),props=await properties(name,rev,side);
+      const source={repositoryUuid:local.repository.uuid,url:at(name,rev,side).slice(0,-rev.length-1),pegRevision:rev,operativeRevision:rev,kind:node['@_kind'],propertyHash:hash(JSON.stringify(props))};
+      const record={path:name,present:Object.hasOwn(props,'svn:mergeinfo'),...(Object.hasOwn(props,'svn:mergeinfo')?{value:props['svn:mergeinfo']}:{}),identity:hash(JSON.stringify(source)),source};
+      cache.set(key,record);return record;
+    };
+    for(const file of files.filter(f=>f.eligibility==='reviewable')){
+      const result={path:file.path};
+      for(const [side,rev,kind]of [['old',range.base,file.oldKind],['new',range.target,file.newKind]]){
+        if(kind===null){result[side]={status:'absent',sources:[]};continue;}
+        result[side]=await captureEffectiveMergeinfo(file.path,{signal,boundary:'.',complete:sameSvnUrl(rootFor(rev,side),local.repository.root),read:name=>readAncestor(name,rev,side)});
+      }
+      effectiveMergeSources.push(result);
+    }
+    // Evidence contains complete source identities, not just opaque hashes.
+    for(const result of effectiveMergeSources)for(const side of ['old','new'])for(const evidence of result[side].evidence??[]){const rev=side==='old'?range.base:range.target;evidence.source=cache.get(JSON.stringify([side,evidence.path,rev])).source;}
+  }
   // Read the same fixed summary and repository identity again; never use HEAD.
-  const after=await run(['diff','--summarize','--xml','--notice-ancestry','-r',range.base+':'+range.target,'--',at('.',range.target)]);
+  const after=await run(summaryArgs);
   if(!isDeepSummary(summary,after))throw new Error('SVN historical summary changed during capture');
-  await identity('.',range.base);await identity('.',range.target);
-  const snapshot={schemaVersion:1,vcs:'svn',root,repositoryUuid:local.repository.uuid,context,...(rules.length?{rules}:{}),...(autoContext?{autoContext}:{}),...(callerDiscovery?{callerDiscovery}:{}),history:{...range,vcs:'svn',url,repositoryUuid:local.repository.uuid,pegRevision:range.target,networkAccess,...(mergeSources.length?{mergeSources}:{}),semantics:'fixed revision tree endpoints; no merge attribution or working text'},files};
+  await identity('.',range.base,'old');await identity('.',range.target,'new');
+  const snapshot={schemaVersion:1,vcs:'svn',root,repositoryUuid:local.repository.uuid,context,...(rules.length?{rules}:{}),...(autoContext?{autoContext}:{}),...(callerDiscovery?{callerDiscovery}:{}),history:{...range,vcs:'svn',url,baseUrl:endpoints.baseUrl,targetUrl:endpoints.targetUrl,crossUrl:endpoints.crossUrl,repositoryUuid:local.repository.uuid,pegRevision:range.target,networkAccess,...(options.svnEffectiveMergeinfo===true?{effectiveMergeSources,effectiveMergeinfoNotice:'Explicit opt-in ancestor properties within selected URL boundary; unknown at incomplete boundaries. No branch source reads or merge attribution.'}:{}),...(mergeSources.length?{mergeSources}:{}),semantics:'fixed revision tree endpoints; no merge attribution or working text'},files};
   const serialized=JSON.stringify(snapshot);if(Buffer.byteLength(serialized)>maxSnapshotBytes)throw new Error('SVN historical snapshot limit exceeded');
   return {...snapshot,id:hash(serialized)};
 }
 function isDeepSummary(a,b){
-  const canonical=v=>Array.isArray(v)?v.map(canonical):v&&typeof v==='object'?Object.fromEntries(Object.keys(v).sort().map(k=>[k,canonical(v[k])])):v;
-  return JSON.stringify(canonical(xml(a)))===JSON.stringify(canonical(xml(b)));
+  const records=bytes=>{const data=xml(bytes),raw=data.diff?.paths?.path;const paths=raw===undefined?[]:Array.isArray(raw)?raw:[raw];return paths.map(record=>{if(typeof record?.['#text']!=='string')throw new Error('Invalid summary path identity');return JSON.stringify(Object.fromEntries(Object.entries({...record,'#text':canonicalSvnUrl(record['#text'])}).sort(([a],[b])=>a.localeCompare(b))));}).sort();};
+  // SVN does not promise ordering among diff-summary sibling records. Sorting
+  // preserves multiplicity and all record attributes; no source changes hidden.
+  return JSON.stringify(records(a))===JSON.stringify(records(b));
 }

package/src/svn-keyword-config.mjs

@@ -0,0 +1,19 @@
+// Bounded quoting tokenizer, not a shell parser. Never executes configuration.
+export function keywordConfigurationTokens(configuration){
+ if(typeof configuration!=='string'||Buffer.byteLength(configuration)>4096)throw new Error('Invalid SVN keyword configuration');
+ if(configuration.includes(String.fromCharCode(34))||configuration.includes(String.fromCharCode(39)))throw new Error('Quoted SVN keyword configurations are not supported by verified native token semantics; use %_ for a space');
+ const tokens=[];let token='',quote=null,started=false;
+ for(let i=0;i<configuration.length;i++){
+  const c=configuration[i];
+  if(c==='\0'||c==='\r'||c==='\n'||c.charCodeAt(0)<32&&c!=='\t')throw new Error('Control character in SVN keyword configuration');
+  if(quote){if(c===quote){quote=null;}else if(c==='\\'){const next=configuration[++i];if(next!==quote&&next!=='\\')throw new Error('Unsupported escape in SVN keyword configuration');token+=next;}else token+=c;started=true;continue;}
+  if(c==='\"'||c==="'"){quote=c;started=true;continue;}
+  if(/\s/.test(c)){if(started){tokens.push(token);token='';started=false;}continue;}
+  if(c==='\\')throw new Error('Unquoted escape in SVN keyword configuration');
+  token+=c;started=true;
+ }
+ if(quote)throw new Error('Unterminated SVN keyword configuration quote');
+ if(started)tokens.push(token);
+ if(tokens.length>100||tokens.some(t=>!t))throw new Error('Invalid SVN keyword configuration token count or empty token');
+ return tokens;
+}

package/src/svn-keyword-mapping.mjs

@@ -1,27 +1,44 @@
 import {hash} from './content.mjs';
+import {keywordConfigurationTokens} from './svn-keyword-config.mjs';
 const standard=new Set(['Date','LastChangedDate','Revision','Rev','LastChangedRevision','Author','LastChangedBy','HeadURL','URL','Id','Header']);
 
-// A line-preserving view only. Raw source remains authoritative for evidence.
-export function svnKeywordMapping(text,configuration){
- if(typeof text!=='string'||typeof configuration!=='string'||Buffer.byteLength(text)>256*1024||Buffer.byteLength(configuration)>4096)throw new Error('Invalid SVN keyword mapping input');
+// Parse bounded quoted and unquoted SVN formats. Expansion is verified by SVN BASE,
+// never reimplemented here; raw source remains the only evidence.
+export function svnKeywordConfiguration(configuration){
+ if(typeof configuration!=='string'||Buffer.byteLength(configuration)>4096)throw new Error('Invalid SVN keyword configuration');
  const enabled=new Set(),custom=[];
- for(const token of configuration.trim().split(/\s+/).filter(Boolean)){
-  if(standard.has(token)){enabled.add(token);continue;}
-  const match=/^([A-Za-z][A-Za-z0-9]*)=(%r)$/.exec(token);
+ for(const token of keywordConfigurationTokens(configuration)){
+  if(standard.has(token)){if(enabled.has(token))throw new Error('Duplicate SVN keyword configuration');enabled.add(token);continue;}
+  const match=/^([A-Za-z][A-Za-z0-9]*)=(.+)$/.exec(token);
   if(!match||standard.has(match[1])||enabled.has(match[1]))throw new Error('Unsupported SVN custom keyword configuration');
-  enabled.add(match[1]);custom.push({name:match[1],format:match[2]});
+  const format=match[2];
+  for(let i=0;i<format.length;i++){
+   const c=format[i];if(c==='%'){if(!'radDuRPb_HI%'.includes(format[++i]??'')||i>=format.length)throw new Error('Unsupported SVN custom keyword format');}
+   else if(!/[A-Za-z0-9_.:/ ()-]/.test(c))throw new Error('Unsupported SVN custom keyword literal');
+  }
+  enabled.add(match[1]);custom.push({name:match[1],format});
  }
- let replacements=0;
+ return {enabled,custom};
+}
+
+export function svnKeywordMapping(text,configuration){
+ if(typeof text!=='string'||Buffer.byteLength(text)>256*1024)throw new Error('Invalid SVN keyword mapping input');
+ const {enabled,custom}=svnKeywordConfiguration(configuration);let replacements=0,fixedWidth=0;
  const normalized=text.replace(/\$([A-Za-z][A-Za-z0-9]*)(:{1,2})([^\r\n$]*)\$/g,(literal,name,separator,value)=>{
   if(!enabled.has(name))return literal;
-  if(separator!==':'||!/^ .+ $/.test(value))throw new Error('Unsupported SVN fixed-width or ambiguous keyword expansion');
+  if(separator==='::'){
+   // SVN reserves the complete field width, including the initial space and
+   // final space (or # truncation marker); shrink values without changing width.
+   if(value.length<2||value[0]!==' '||![' ','#'].includes(value.at(-1)))throw new Error('Ambiguous SVN fixed-width keyword expansion');
+   fixedWidth++;if(/[^ ]/.test(value))replacements++;return '$'+name+'::'+' '.repeat(value.length)+'$';
+  }
+  if(!/^ .+ $/.test(value))throw new Error('Ambiguous SVN keyword expansion');
   replacements++;return '$'+name+'$';
  });
- // Reject enabled malformed expansions, rather than silently offering a partial mapping.
- for(const name of enabled){
-  const escaped=name.replace(/[.*+?^${}()|[\]\\]/g,'\\$&');
-  if(new RegExp('\\$'+escaped+':').test(normalized))throw new Error('Incomplete SVN keyword expansion mapping');
- }
+ // Fixed fields intentionally retain :: after contraction. Any other colon
+ // occurrence must be a complete recognized field, not silently partial data.
+ const residual=normalized.replace(/\$([A-Za-z][A-Za-z0-9]*)::( +)\$/g,(literal,name)=>enabled.has(name)?'':literal);
+ for(const name of enabled){const escaped=name.replace(/[.*+?^${}()|[\]\\]/g,'\\$&');if(new RegExp('\\$'+escaped+':').test(residual))throw new Error('Incomplete SVN keyword expansion mapping');}
  if(text.split('\n').length!==normalized.split('\n').length)throw new Error('SVN keyword mapping changed line identity');
- return {text:normalized,rawTextHash:hash(text),textHash:hash(normalized),replacements,...(custom.length?{customKeywords:custom}:{}),lineMapping:'identity',status:'candidate-only',notice:'Line-preserving standard keyword view, not evidence of equivalent program behavior; raw source remains required. Capture must independently verify BASE contraction and keep raw evidence.'};
+ return {text:normalized,rawTextHash:hash(text),textHash:hash(normalized),replacements,...(fixedWidth?{fixedWidthFields:fixedWidth}:{}),...(custom.length?{customKeywords:custom}:{}),lineMapping:'identity',status:'candidate-only',notice:'Line-preserving keyword view only; fixed-field width retained. BASE contraction must be independently verified against svn cat --ignore-keywords. Raw source and original line numbers remain evidence, not behavioral equivalence.'};
 }

package/src/svn-replacement-source.mjs

@@ -0,0 +1,25 @@
+import {sameSvnUrl} from './svn-url.mjs';
+import {checked} from './process.mjs';
+import {xml} from './svn.mjs';
+import {decode,hash,relativePath} from './content.mjs';
+
+// Explicit independent repository baseline; never local BASE/copy-source pristine.
+export async function readReplacementSource(root,rootInfo,name,revision,options={}){
+ relativePath(name);if(typeof revision!=='string'||!/^(0|[1-9][0-9]*)$/.test(revision)||!Number.isSafeInteger(Number(revision)))throw new Error('Replacement baseline requires fixed numeric revision');
+ const url=rootInfo.url.replace(/\/$/,'')+'/'+name.split('/').map(encodeURIComponent).join('/'),destination=new URL(url);
+ if(destination.username||destination.password||destination.search||destination.hash||!['file:','http:','https:','svn:','svn+ssh:'].includes(destination.protocol))throw new Error('Unsafe replacement baseline URL');
+ if((destination.protocol!=='file:'||destination.hostname)&&options.svnReplacementAllowNetwork!==true)throw new Error('Replacement repository baseline requires explicit svnReplacementAllowNetwork');
+ const at=url+'@'+revision;const run=async(args,body=false)=>checked('svn',['--non-interactive',...args,'--',at],{...options,cwd:root,maxBytes:body?options.maxFileBytes??256*1024:256*1024});
+ const node=xml(await run(['info','--xml','-r',revision])).info?.entry?.[0];
+ if(!sameSvnUrl(node?.url,url)||String(node['@_revision'])!==revision||node.repository?.uuid!==rootInfo.repository.uuid||!sameSvnUrl(node.repository?.root,rootInfo.repository.root)||!['file','dir'].includes(node['@_kind']))throw new Error('Replacement baseline identity or kind mismatch');
+ const props=Object.create(null);for(const p of xml(await run(['proplist','--xml','--verbose','-r',revision])).properties?.target?.[0]?.property??[]){if(typeof p['@_name']!=='string'||p['@_encoding']||Object.hasOwn(props,p['@_name']))throw new Error('Unsafe replacement baseline property representation');props[p['@_name']]=p['#text']??'';}
+ let descendants=[];
+ if(node['@_kind']==='dir'){
+  const listing=xml(await run(['list','--xml','--depth','infinity','-r',revision]));
+  const lists=listing.lists?.list,one=Array.isArray(lists)?lists:[lists];
+  if(one.length!==1||!one[0]||!sameSvnUrl(one[0]['@_path'],url))throw new Error('Replacement old directory listing identity mismatch');
+  const seen=new Set();for(const entry of one[0].entry??[]){const child=relativePath(entry.name);if(seen.has(child)||!['file','dir'].includes(entry['@_kind']))throw new Error('Invalid replacement old descendant');seen.add(child);if(seen.size>200)throw new Error('Replacement old descendant count limit exceeded');descendants.push({path:name+'/'+child,kind:entry['@_kind']});}
+ }
+ const content=node['@_kind']==='dir'?decode(Buffer.alloc(0)):decode(await run(['cat','--ignore-keywords','-r',revision],true));
+ return {content,props,kind:node['@_kind'],descendants,source:{repositoryUuid:rootInfo.repository.uuid,url,pegRevision:revision,operativeRevision:revision,kind:node['@_kind'],descendantHash:hash(JSON.stringify(descendants)),hash:content.hash,textHash:hash(content.text),propertyHash:hash(JSON.stringify(Object.entries(props).sort()))}};
+}

package/src/svn-replacement-tree.mjs

@@ -0,0 +1,49 @@
+import {checked} from './process.mjs';
+import {xml} from './svn.mjs';
+import {readReplacementSource} from './svn-replacement-source.mjs';
+import {svnWorkingIdentity} from './svn-working-identity.mjs';
+import {hash,decode,relativePath,readLocal} from './content.mjs';
+import {isSecretPath} from './secret-path.mjs';
+import {svnKeywordMapping} from './svn-keyword-mapping.mjs';
+import {svnEolMapping} from './svn-eol-mapping.mjs';
+import {svnSpecialData} from './svn-special.mjs';
+import {readWorkingSvnSpecial} from './svn-working-special.mjs';
+
+// Fixed repository tree versus explicitly selected working replacement tree.
+// Every descendant is a separate source/coverage unit, never an implicit approval.
+export async function captureReplacementTree(root,rootInfo,name,options={}){
+ relativePath(name);if(isSecretPath(name))throw new Error('Credential replacement root excluded');const revision=options.svnReplacementBaseRevision;
+ const run=async args=>checked('svn',['--non-interactive',...args],{...options,cwd:root,maxBytes:1024*1024});
+ const inventory=async()=>{const data=xml(await run(['status','--xml','--verbose','--ignore-externals','--depth','infinity','--',name+'@']));const map=new Map();for(const entry of data.status?.target?.flatMap(t=>t.entry??[])??[]){const p=entry['@_path'].replaceAll('\\','/');relativePath(p);if(p!==name&&!p.startsWith(name+'/')||map.has(p))throw new Error('Replacement working inventory escaped scope or duplicated');map.set(p,entry);if(map.size>200)throw new Error('Replacement working descendant count limit exceeded');}if(!map.has(name))throw new Error('Replacement root missing from working inventory');return map;};
+ const current=await inventory(),oldRoot=await readReplacementSource(root,rootInfo,name,revision,options);
+ const oldNodes=new Map([[name,oldRoot.kind],...oldRoot.descendants.map(x=>[x.path,x.kind])]);const paths=[...new Set([...oldNodes.keys(),...current.keys()])].sort();if(paths.length>200)throw new Error('Replacement combined descendant count limit exceeded');
+ if(options.selectedPaths?.some(p=>(p===name||p.startsWith(name+'/'))&&!paths.includes(p)))throw new Error('Selected replacement descendant absent from both approved inventories');
+ const files=[],receipts=[];
+ const props=async p=>{const data=xml(await run(['proplist','--xml','--verbose','--',p+'@']));const out=Object.create(null);for(const x of data.properties?.target?.[0]?.property??[]){if(typeof x['@_name']!=='string'||x['@_encoding']||Object.hasOwn(out,x['@_name']))throw new Error('Unsafe replacement working properties');out[x['@_name']]=x['#text']??'';}return out;};
+ const readCurrent=async p=>{const entry=current.get(p),s=entry?.['wc-status'];if(!entry)return null;if(!s)throw new Error('Replacement status missing node state');if(s['@_item']==='deleted')return null;
+  if(['@_switched','@_file-external','@_tree-conflicted'].some(k=>s[k]==='true')||!['normal','modified','added','replaced'].includes(s['@_item'])||s['@_props']==='conflicted')throw new Error('Unsafe replacement descendant state');
+  const node=xml(await run(['info','--xml','--',p+'@'])).info?.entry?.[0],identity=svnWorkingIdentity(node,rootInfo,p);if(!['file','dir'].includes(node['@_kind']))throw new Error('Unsupported replacement descendant kind');
+  if(node['@_kind']==='dir'&&identity.source.depth!=='infinity')throw new Error('Sparse replacement target cannot prove descendant inventory');
+  const properties=await props(p);if(Object.hasOwn(properties,'svn:externals'))throw new Error('Replacement externals require independent scope');
+  const content=node['@_kind']==='dir'?decode(Buffer.alloc(0)):Object.hasOwn(properties,'svn:special')?(await readWorkingSvnSpecial(root,p,properties,options)).content:await readLocal(root,p,options);
+  return {kind:node['@_kind'],content,props:properties,source:identity.source,identity:identity.fingerprint,special:svnSpecialData(content,properties,node['@_kind'])};
+ };
+ for(const p of paths){const f={id:hash(p),path:p,rawStatus:p===name?'replaced':'replacement-descendant',eligibility:'reviewable',properties:[],replacementTreeRoot:name,contentNotice:'Explicit fixed repository baseline versus current replacement tree. Not recovered local BASE or copy-source history. Every descendant requires independent approval; link records are data only.'};files.push(f);
+  if(isSecretPath(p)){f.eligibility='excluded';f.reason='Credential replacement path excluded';continue;}if(options.selectedPaths&&!options.selectedPaths.includes(p)){f.eligibility='excluded';f.reason='Replacement descendant not explicitly selected';continue;}
+  try{const old=oldNodes.has(p)?await readReplacementSource(root,rootInfo,p,revision,options):null,newer=await readCurrent(p);if(!old&&!newer)throw new Error('Replacement inventory node has no captured side');
+   f.oldKind=old?.kind??null;f.newKind=newer?.kind??null;f.kind=newer?.kind??old.kind;f.rightExists=!!newer;f.left=old?.content??decode(Buffer.alloc(0));f.right=newer?.content??decode(Buffer.alloc(0));f.baseRevision=old?revision:undefined;
+   if(old)f.replacementSource=old.source;if(newer)f.workingSource=newer.source;
+   const a=old?.props??{},b=newer?.props??{};for(const key of [...new Set([...Object.keys(a),...Object.keys(b)])].sort())if(a[key]!==b[key])f.properties.push({name:key,old:a[key]??null,new:b[key]??null});
+   const oldSpecial=old?svnSpecialData(old.content,a,old.kind):null;if(oldSpecial||newer?.special)f.specialData={old:oldSpecial,new:newer?.special??null};
+   if(Object.hasOwn(a,'svn:eol-style')||Object.hasOwn(b,'svn:eol-style'))f.eolMapping={old:old?.kind==='file'?svnEolMapping(f.left.text,a['svn:eol-style']??null):null,new:newer?.kind==='file'?svnEolMapping(f.right.text,b['svn:eol-style']??null):null};
+   if(b['svn:keywords']&&newer?.kind==='file'){const {text,...mapping}=svnKeywordMapping(f.right.text,b['svn:keywords']);f.keywordMapping={new:{...mapping,status:'working-line-view'},notice:'Old side is fixed repository text read with --ignore-keywords, not local BASE. Current contraction preserves lines only, not behavioral equivalence.'};}
+   receipts.push({path:p,old:old?.source??null,current:newer?hash(JSON.stringify([newer.identity,newer.props,newer.content.hash])):null});
+  }catch(error){options.signal?.throwIfAborted();if(error.code==='SVN_CAPTURE_BUDGET')throw error;f.eligibility='blocked';f.reason=error.message;delete f.left;delete f.right;}
+ }
+ for(const f of files.filter(f=>f.oldKind==='dir'||f.newKind==='dir').sort((a,b)=>b.path.length-a.path.length)){const children=files.filter(x=>x.path.startsWith(f.path+'/'));f.structuralDescendants=children.map(x=>x.path);if(f.eligibility==='reviewable'&&children.some(x=>x.eligibility!=='reviewable')){f.eligibility='blocked';f.reason='Replacement descendant coverage incomplete';delete f.left;delete f.right;}}
+ const verify=async()=>{const again=await inventory();const canonical=m=>JSON.stringify([...m].map(([p,e])=>[p,Object.fromEntries(Object.entries(e['wc-status']??{}).sort())]).sort());if(canonical(again)!==canonical(current))throw new Error('Replacement working inventory changed');
+  const oldAgain=await readReplacementSource(root,rootInfo,name,revision,options);if(JSON.stringify(oldAgain.source)!==JSON.stringify(oldRoot.source))throw new Error('Replacement old inventory changed');
+  for(const receipt of receipts){if(receipt.old){const value=await readReplacementSource(root,rootInfo,receipt.path,revision,options);if(JSON.stringify(value.source)!==JSON.stringify(receipt.old))throw new Error('Replacement old descendant changed');}const value=await readCurrent(receipt.path);const fingerprint=value?hash(JSON.stringify([value.identity,value.props,value.content.hash])):null;if(fingerprint!==receipt.current)throw new Error('Replacement working descendant changed');}
+ };
+ return {files,verify};
+}

package/src/svn-special.mjs

@@ -0,0 +1,10 @@
+// SVN stores symbolic links as file-node data. Never resolve or open the target.
+export function svnSpecialData(content,properties,kind){
+ if(!Object.hasOwn(properties,'svn:special'))return null;
+ if(kind!=='file'||properties['svn:special']!=='*')throw new Error('Unsupported SVN special node kind or property value');
+ if(Object.hasOwn(properties,'svn:keywords')||Object.hasOwn(properties,'svn:eol-style'))throw new Error('SVN special node has incompatible text transformation properties');
+ if(content.encoding!=='utf-8'||!content.text.startsWith('link '))throw new Error('SVN special node is not a UTF-8 link record');
+ const target=content.text.slice(5);
+ if(!target||/[\x00-\x1f\x7f]/.test(target)||Buffer.byteLength(target)>16384)throw new Error('Invalid or oversized SVN link target data');
+ return {type:'symlink',target,recordHash:content.hash,followed:false,notice:'Repository link target data only. Target text is untrusted data, not an authorized path, source file, existence check or navigation instruction. Never follow this link.'};
+}

package/src/svn-url.mjs

@@ -0,0 +1,8 @@
+// Compare repository URL spelling without decoding path separators into structure.
+export function canonicalSvnUrl(value){
+ if(typeof value!=='string')throw new Error('Missing SVN URL');const url=new URL(value);
+ if(url.username||url.password||url.search||url.hash||!['file:','http:','https:','svn:','svn+ssh:'].includes(url.protocol))throw new Error('Unsafe SVN URL identity');
+ const segments=url.pathname.split('/').map(segment=>{const decoded=decodeURIComponent(segment);if(decoded.includes('/')||decoded.includes('\\')||/[\x00-\x1f\x7f]/.test(decoded)||decoded==='.'||decoded==='..')throw new Error('Unsafe encoded SVN URL segment');return encodeURIComponent(decoded);});
+ return url.protocol+'//'+url.host+segments.join('/').replace(/\/$/,'');
+}
+export function sameSvnUrl(a,b){try{return canonicalSvnUrl(a)===canonicalSvnUrl(b);}catch{return false;}}

package/src/svn-working-identity.mjs

@@ -1,9 +1,10 @@
 import {hash} from './content.mjs';
+import {sameSvnUrl,canonicalSvnUrl} from './svn-url.mjs';
 export function svnWorkingIdentity(node,rootInfo,name){
  const expected=name==='.'?rootInfo.url:rootInfo.url.replace(/\/$/,'')+'/'+name.split('/').map(encodeURIComponent).join('/');
- const sameUrl=(a,b)=>{try{const x=new URL(a),y=new URL(b);return x.protocol===y.protocol&&x.host===y.host&&x.username===y.username&&x.password===y.password&&decodeURIComponent(x.pathname)===decodeURIComponent(y.pathname)&&x.search===y.search&&x.hash===y.hash;}catch{return false;}};
- if(!sameUrl(node?.url,expected))throw Object.assign(new Error('SVN node URL differs from selected working-copy path; switched ancestors are unsupported'),{code:'SVN_SWITCHED_ANCESTOR'});
+
+ if(!sameSvnUrl(node?.url,expected))throw Object.assign(new Error('SVN node URL differs from selected working-copy path; switched ancestors are unsupported'),{code:'SVN_SWITCHED_ANCESTOR'});
  if(!rootInfo.repository?.uuid||node.repository?.uuid!==rootInfo.repository.uuid||node.repository?.root!==rootInfo.repository.root||node['wc-info']?.['wcroot-abspath']!==rootInfo['wc-info']?.['wcroot-abspath'])throw Object.assign(new Error('SVN node repository or working-copy identity mismatch'),{code:'SVN_NODE_IDENTITY'});
- const source={url:node.url,repositoryUuid:node.repository.uuid,repositoryRoot:node.repository.root,revision:String(node['@_revision']),kind:node['@_kind'],schedule:node['wc-info']?.schedule,copyFromUrl:node['wc-info']?.['copy-from-url']??null,copyFromRevision:node['wc-info']?.['copy-from-rev']??null};
+ const source={url:canonicalSvnUrl(node.url),repositoryUuid:node.repository.uuid,repositoryRoot:node.repository.root,revision:String(node['@_revision']),kind:node['@_kind'],...(node['@_kind']==='dir'?{depth:node['wc-info']?.depth??null}:{}),schedule:node['wc-info']?.schedule,copyFromUrl:node['wc-info']?.['copy-from-url']??null,copyFromRevision:node['wc-info']?.['copy-from-rev']??null};
  return {source,fingerprint:hash(JSON.stringify(source))};
 }

package/src/svn-working-mergeinfo.mjs

@@ -0,0 +1,31 @@
+import {checked} from './process.mjs';
+import {xml} from './svn.mjs';
+import {hash} from './content.mjs';
+import {svnWorkingIdentity} from './svn-working-identity.mjs';
+import {captureEffectiveMergeinfo} from './svn-effective-mergeinfo.mjs';
+
+export async function workingEffectiveMergeinfo(root,rootInfo,files,options={}){
+ const signal=AbortSignal.any([AbortSignal.timeout(30000),...(options.signal?[options.signal]:[])]);let commands=0,bytes=0;const cache=new Map();
+ const run=async args=>{signal.throwIfAborted();if(++commands>512)throw new Error('SVN working mergeinfo command budget exceeded');const data=await checked('svn',['--non-interactive',...args],{...options,cwd:root,signal,maxBytes:256*1024});bytes+=data.length;if(bytes>1024*1024)throw new Error('SVN working mergeinfo metadata budget exceeded');return xml(data);};
+ const read=async(name,side,revision)=>{
+  const key=JSON.stringify([name,side]);if(cache.has(key)){const value=cache.get(key);if(side==='old'&&value.source.revision!==revision)throw new Error('Mixed BASE revisions cannot prove effective mergeinfo');return value;}
+  const node=(await run(['info','--xml','--',name+'@'])).info?.entry?.[0];const identity=svnWorkingIdentity(node,rootInfo,name);
+  const entries=(await run(['status','--xml','--verbose','--ignore-externals','--depth','empty','--',name+'@'])).status?.target?.flatMap(t=>t.entry??[])??[];const state=entries[0]?.['wc-status'];
+  if(entries.length!==1||!state||['@_switched','@_file-external','@_tree-conflicted','@_copied'].some(k=>state[k]==='true')||!['normal','modified','deleted'].includes(state['@_item'])||state['@_props']==='conflicted')throw new Error('Unsafe ancestor state for effective mergeinfo');
+  if(side==='old'&&String(node['@_revision'])!==revision)throw new Error('Mixed BASE revisions cannot prove effective mergeinfo');
+  const props=(await run(['proplist','--xml','--verbose',...(side==='old'?['-r','BASE']:[]),'--',name+'@'])).properties?.target?.[0]?.property??[];const values=Object.create(null);
+  for(const p of props){if(typeof p['@_name']!=='string'||p['@_encoding']||Object.hasOwn(values,p['@_name']))throw new Error('Unsafe effective mergeinfo property representation');values[p['@_name']]=p['#text']??'';}
+  if(Object.hasOwn(values,'svn:externals')||Object.hasOwn(values,'svn:special'))throw new Error('Unsafe ancestor properties for effective mergeinfo');
+  const source={...identity.source,side,revision:String(node['@_revision']),propertyHash:hash(JSON.stringify(Object.entries(values).sort()))};
+  const record={path:name,present:Object.hasOwn(values,'svn:mergeinfo'),...(Object.hasOwn(values,'svn:mergeinfo')?{value:values['svn:mergeinfo']}:{}),identity:hash(JSON.stringify(source)),source};cache.set(key,record);return record;
+ };
+ const results=[];
+ for(const file of files.filter(f=>f.eligibility==='reviewable')){const value={path:file.path};for(const side of ['old','new']){
+   if(side==='old'&&['added','unversioned'].includes(file.rawStatus)||side==='new'&&file.rawStatus==='deleted'){value[side]={status:'absent',sources:[]};continue;}
+   if(file.replacementTreeRoot||file.replacementSource||file.copySource||file.targetAddition||file.rawStatus==='unversioned'){value[side]={status:'unknown',reason:'Added/copied/untracked ancestor semantics require separate provenance',sources:[]};continue;}
+   try{value[side]=await captureEffectiveMergeinfo(file.path,{signal,boundary:'.',complete:rootInfo.url===rootInfo.repository.root,read:name=>read(name,side,String(file.baseRevision))});for(const evidence of value[side].evidence??[])evidence.source=cache.get(JSON.stringify([evidence.path,side])).source;}catch(error){signal.throwIfAborted();if(error.code==='SVN_CAPTURE_BUDGET'||/budget exceeded/.test(error.message))throw error;value[side]={status:'unknown',reason:error.message,sources:[]};}
+  }results.push(value);}
+ // Re-read every captured property/identity after collection, charging same budget.
+ const original=[...cache.entries()];cache.clear();for(const [key,record]of original){const [name,side]=JSON.parse(key);if((await read(name,side,record.source.revision)).identity!==record.identity)throw new Error('Effective working mergeinfo changed during capture');}
+ return results;
+}

package/src/svn-working-scope.mjs

@@ -0,0 +1,7 @@
+// Describes observed evidence only; never infers a complete working tree from status.
+export function workingScopeEvidence(rootSource,files){
+ const revisions=[...new Set(files.filter(f=>f.eligibility==='reviewable'&&f.workingSource&&/^[0-9]+$/.test(f.workingSource.revision)).map(f=>f.workingSource.revision))].sort((a,b)=>Number(a)-Number(b));
+ const sparse=files.filter(f=>f.workingSource?.kind==='dir'&&f.workingSource.depth!=='infinity').map(f=>({path:f.path,depth:f.workingSource.depth??'unknown'}));
+ if(rootSource.depth!=='infinity'&&!sparse.some(s=>s.path==='.'))sparse.unshift({path:'.',depth:rootSource.depth??'unknown'});
+ return {root:rootSource,observedBaseRevisions:revisions,mixedObservedRevisions:revisions.length>1,sparseDirectories:sparse,inventoryComplete:false,notice:'Only selected/observed change metadata is described. Mixed revisions bind each node BASE independently, not a common historical tree. Sparse or unenumerated paths are not deletion evidence or reviewed coverage; no update/deepen/external traversal was performed.'};
+}

package/src/svn-working-special.mjs

@@ -0,0 +1,24 @@
+import {lstat,readlink,realpath} from 'node:fs/promises';
+import path from 'node:path';
+import {relativePath,readLocal,decode} from './content.mjs';
+import {assertNonSecretPath} from './secret-path.mjs';
+import {svnSpecialData} from './svn-special.mjs';
+
+// Validate ancestors but never realpath/open a symbolic-link leaf or its target.
+export async function readWorkingSvnSpecial(root,name,properties,options={}){
+ relativePath(name);assertNonSecretPath(name);options.signal?.throwIfAborted();
+ const canonical=await realpath(root);let cursor=canonical;const parts=name.split('/');
+ for(const part of parts.slice(0,-1)){cursor=path.join(cursor,part);const stat=await lstat(cursor);if(stat.isSymbolicLink()||!stat.isDirectory())throw new Error('SVN special ancestor must be a real directory');}
+ const filename=path.join(cursor,parts.at(-1)),before=await lstat(filename);let content;
+ if(before.isSymbolicLink()){
+  const target=await readlink(filename,{encoding:'buffer'});if(target.length>16384)throw new Error('SVN link target byte limit exceeded');
+  const bytes=Buffer.concat([Buffer.from('link '),target]);if(bytes.length>(options.maxFileBytes??256*1024))throw new Error('SVN special file size limit exceeded');
+  content=decode(bytes);const after=await lstat(filename);const again=await readlink(filename,{encoding:'buffer'});
+  if(!after.isSymbolicLink()||before.ino!==after.ino||before.mtimeMs!==after.mtimeMs||before.ctimeMs!==after.ctimeMs||!again.equals(target))throw new Error('SVN link changed during capture');
+ }else{
+  if(!before.isFile())throw new Error('SVN special working node is neither link nor regular link record');
+  content=await readLocal(canonical,name,options);
+ }
+ options.signal?.throwIfAborted();
+ return {content,special:svnSpecialData(content,properties,'file')};
+}