@feng0531/dsh-code-review 0.83.0 → 0.83.1

package/src/svn-effective-mergeinfo.mjs

@@ -1,46 +1,68 @@
-import {hash,relativePath} from './content.mjs';
-import {mergeinfoNavigation} from './svn-mergeinfo.mjs';
-const notice='Effective property navigation within the evidenced ancestor boundary only; not merge attribution, reviewed revision coverage, permission to read branch bodies, or proof of merge execution.';
+import { hash, relativePath } from './content.mjs';
+import { mergeinfoNavigation } from './svn-mergeinfo.mjs';
+
+const NOTICE = 'Effective property navigation within the evidenced ancestor boundary only; not merge attribution, reviewed revision coverage, permission to read branch bodies, or proof of merge execution.';
 
 // records are nearest-first and complete from target to the declared boundary.
 // present:false is proven absence; missing records must never mean absent.
-export function effectiveMergeinfo(target,records,{boundary='.',complete=false}={}){
- if(target!=='.')relativePath(target);if(boundary!=='.')relativePath(boundary);
- if(boundary!=='.'&&target!==boundary&&!target.startsWith(boundary+'/'))throw new Error('Mergeinfo boundary is not an ancestor');
- const unknown=reason=>({status:'unknown',reason,sources:[],notice});
- if(!Array.isArray(records)||records.length>33)return unknown('Ancestor evidence missing or depth limit exceeded');
- let cursor=target;const evidence=[];
- for(const record of records){
-  if(!record||record.path!==cursor||typeof record.present!=='boolean'||typeof record.identity!=='string'||!record.identity)return unknown('Incomplete or unordered ancestor provenance');
-  if(record.present&&typeof record.value!=='string')return unknown('Mergeinfo value is not captured text');
-  evidence.push({path:cursor,identity:record.identity,present:record.present,...(record.present?{propertyHash:hash(record.value)}:{})});
-  if(record.present){
-   const parsed=mergeinfoNavigation(record.value);if(parsed.status!=='parsed')return {...parsed,evidence,notice};
-   const inherited=cursor!==target,suffix=cursor==='.'?(target==='.'?'':target):target.slice(cursor.length+1);
-   const sources=parsed.sources.map(source=>({sourcePath:inherited?(source.sourcePath==='/'?'':source.sourcePath)+'/'+suffix:source.sourcePath,ranges:source.ranges.filter(range=>!inherited||range.inheritable)})).filter(source=>source.ranges.length);
-   if(sources.some(s=>s.sourcePath.length>1024))return {status:'limited',reason:'Inherited mergeinfo source path limit exceeded',sources:[],evidence,notice};
-   return {status:'parsed',origin:cursor,inherited,explicitEmpty:record.value==='',sources,evidence,hash:hash(JSON.stringify(evidence)),notice};
+export function effectiveMergeinfo(target, records, { boundary = '.', complete = false } = {}) {
+  if (target !== '.') relativePath(target);
+  if (boundary !== '.') relativePath(boundary);
+  if (boundary !== '.' && target !== boundary && !target.startsWith(boundary + '/')) throw new Error('Mergeinfo boundary is not an ancestor');
+
+  const unknown = reason => ({ status: 'unknown', reason, sources: [], notice: NOTICE });
+  if (!Array.isArray(records) || records.length > 33) return unknown('Ancestor evidence missing or depth limit exceeded');
+
+  let cursor = target;
+  const evidence = [];
+  for (const record of records) {
+    if (!record || record.path !== cursor || typeof record.present !== 'boolean' || typeof record.identity !== 'string' || !record.identity) return unknown('Incomplete or unordered ancestor provenance');
+    if (record.present && typeof record.value !== 'string') return unknown('Mergeinfo value is not captured text');
+    evidence.push({ path: cursor, identity: record.identity, present: record.present, ...(record.present ? { propertyHash: hash(record.value) } : {}) });
+
+    if (record.present) {
+      const parsed = mergeinfoNavigation(record.value);
+      if (parsed.status !== 'parsed') return { ...parsed, evidence, notice: NOTICE };
+      const inherited = cursor !== target;
+      const suffix = cursor === '.' ? (target === '.' ? '' : target) : target.slice(cursor.length + 1);
+      const sources = parsed.sources
+        .map(source => ({
+          sourcePath: inherited ? (source.sourcePath === '/' ? '' : source.sourcePath) + '/' + suffix : source.sourcePath,
+          ranges: source.ranges.filter(range => !inherited || range.inheritable),
+        }))
+        .filter(source => source.ranges.length);
+      if (sources.some(s => s.sourcePath.length > 1024)) return { status: 'limited', reason: 'Inherited mergeinfo source path limit exceeded', sources: [], evidence, notice: NOTICE };
+      return { status: 'parsed', origin: cursor, inherited, explicitEmpty: record.value === '', sources, evidence, hash: hash(JSON.stringify(evidence)), notice: NOTICE };
+    }
+
+    if (cursor === boundary) {
+      if (!complete) return { ...unknown('Ancestor boundary does not prove repository-wide absence'), evidence, hash: hash(JSON.stringify(evidence)) };
+      return { status: 'parsed', origin: null, inherited: false, sources: [], evidence, hash: hash(JSON.stringify(evidence)), notice: NOTICE };
+    }
+    if (cursor === '.') return unknown('Declared ancestor boundary was not reached');
+    cursor = cursor.includes('/') ? cursor.slice(0, cursor.lastIndexOf('/')) : '.';
   }
-  if(cursor===boundary){if(!complete)return {...unknown('Ancestor boundary does not prove repository-wide absence'),evidence,hash:hash(JSON.stringify(evidence))};return {status:'parsed',origin:null,inherited:false,sources:[],evidence,hash:hash(JSON.stringify(evidence)),notice};}
-  if(cursor==='.')return unknown('Declared ancestor boundary was not reached');
-  cursor=cursor.includes('/')?cursor.slice(0,cursor.lastIndexOf('/')):'.';
- }
- return unknown('Ancestor evidence ended before nearest explicit property or boundary');
+  return unknown('Ancestor evidence ended before nearest explicit property or boundary');
 }
 
 // Injected reader must freeze UUID/URL/peg/operative revision and charge its
 // existing command/metadata budget. This helper never reads branch bodies.
-export async function captureEffectiveMergeinfo(target,{read,signal,boundary='.',complete=false}={}){
- if(typeof read!=='function')throw new Error('Fixed ancestor property reader required');
- if(target!=='.')relativePath(target);if(boundary!=='.')relativePath(boundary);
- if(boundary!=='.'&&target!==boundary&&!target.startsWith(boundary+'/'))throw new Error('Mergeinfo boundary is not an ancestor');
- const records=[];let cursor=target;
- for(let depth=0;depth<33;depth++){
-  signal?.throwIfAborted();const record=await read(cursor);signal?.throwIfAborted();
-  if(record?.path!==cursor)throw new Error('Mergeinfo ancestor reader identity mismatch');records.push(record);
-  if(record.present||cursor===boundary)return effectiveMergeinfo(target,records,{boundary,complete});
-  if(cursor==='.')throw new Error('Mergeinfo ancestor boundary not reached');
-  cursor=cursor.includes('/')?cursor.slice(0,cursor.lastIndexOf('/')):'.';
- }
- return {status:'limited',reason:'Mergeinfo ancestor depth limit exceeded',sources:[],notice};
+export async function captureEffectiveMergeinfo(target, { read, signal, boundary = '.', complete = false } = {}) {
+  if (typeof read !== 'function') throw new Error('Fixed ancestor property reader required');
+  if (target !== '.') relativePath(target);
+  if (boundary !== '.') relativePath(boundary);
+  if (boundary !== '.' && target !== boundary && !target.startsWith(boundary + '/')) throw new Error('Mergeinfo boundary is not an ancestor');
+  const records = [];
+  let cursor = target;
+  for (let depth = 0; depth < 33; depth++) {
+    signal?.throwIfAborted();
+    const record = await read(cursor);
+    signal?.throwIfAborted();
+    if (record?.path !== cursor) throw new Error('Mergeinfo ancestor reader identity mismatch');
+    records.push(record);
+    if (record.present || cursor === boundary) return effectiveMergeinfo(target, records, { boundary, complete });
+    if (cursor === '.') throw new Error('Mergeinfo ancestor boundary not reached');
+    cursor = cursor.includes('/') ? cursor.slice(0, cursor.lastIndexOf('/')) : '.';
+  }
+  return { status: 'limited', reason: 'Mergeinfo ancestor depth limit exceeded', sources: [], notice: NOTICE };
 }

package/src/svn-eol-mapping.mjs

@@ -1,13 +1,25 @@
-import {hash} from './content.mjs';
+import { hash } from './content.mjs';
 
 // Keep raw text as evidence. LF view is metadata only, never a source replacement.
-export function svnEolMapping(text,style=null){
- if(typeof text!=='string'||Buffer.byteLength(text)>256*1024||!(style===null||['native','LF','CRLF','CR'].includes(style)))throw new Error('Unsupported SVN EOL mapping input or style');
- let crlf=0,lf=0,cr=0;
- for(let i=0;i<text.length;i++){
-  if(text[i]==='\r'){if(text[i+1]==='\n'){crlf++;i++;}else cr++;}
-  else if(text[i]==='\n')lf++;
- }
- const normalized=text.replace(/\r\n|\r/g,'\n');
- return {rawTextHash:hash(text),lfViewHash:hash(normalized),style,counts:{crlf,lf,cr},mixed:[crlf,lf,cr].filter(Boolean).length>1,lineMapping:cr?'not-identity-for-LF-evidence':'identity',notice:'Hashes describe decoded text encoded as UTF-8, not original source bytes. LF-view hash only; raw text and raw evidence line numbering remain authoritative. Lone CR changes LF line boundaries; do not use normalized line numbers. Newline-only differences do not independently prove a defect or runtime equivalence.'};
+const ALLOWED_STYLES = [null, 'native', 'LF', 'CRLF', 'CR'];
+
+export function svnEolMapping(text, style = null) {
+  if (typeof text !== 'string' || Buffer.byteLength(text) > 256 * 1024 || !ALLOWED_STYLES.includes(style)) throw new Error('Unsupported SVN EOL mapping input or style');
+  let crlf = 0, lf = 0, cr = 0;
+  for (let i = 0; i < text.length; i++) {
+    if (text[i] === '\r') {
+      if (text[i + 1] === '\n') { crlf++; i++; }
+      else cr++;
+    } else if (text[i] === '\n') lf++;
+  }
+  const normalized = text.replace(/\r\n|\r/g, '\n');
+  return {
+    rawTextHash: hash(text),
+    lfViewHash: hash(normalized),
+    style,
+    counts: { crlf, lf, cr },
+    mixed: [crlf, lf, cr].filter(Boolean).length > 1,
+    lineMapping: cr ? 'not-identity-for-LF-evidence' : 'identity',
+    notice: 'Hashes describe decoded text encoded as UTF-8, not original source bytes. LF-view hash only; raw text and raw evidence line numbering remain authoritative. Lone CR changes LF line boundaries; do not use normalized line numbers. Newline-only differences do not independently prove a defect or runtime equivalence.',
+  };
 }

package/src/svn-history-endpoints.mjs

@@ -1,15 +1,21 @@
-import {relativePath} from './content.mjs';
-import {assertNonSecretPath} from './secret-path.mjs';
+import { relativePath } from './content.mjs';
+import { assertNonSecretPath } from './secret-path.mjs';
 
 // Cross-branch endpoints are repository-relative paths, never arbitrary URLs.
-export function svnHistoryEndpoints(local,options,destination){
- const hasBase=options.svnBasePath!==undefined,hasTarget=options.svnTargetPath!==undefined;
- if(hasBase!==hasTarget)throw new Error('SVN branch comparison requires both svnBasePath and svnTargetPath');
- if(!hasBase)return {baseUrl:destination(local.url,options.svnAllowNetwork).url,targetUrl:destination(local.url,options.svnAllowNetwork).url,crossUrl:false};
- if(options.svnRevision!==undefined)throw new Error('SVN branch paths require explicit revision range');
- if(!local.repository?.root||!local.repository?.uuid)throw new Error('SVN repository root identity required');
- const endpoint=value=>{if(value!=='.'){relativePath(value);assertNonSecretPath(value);}const root=destination(local.repository.root,options.svnAllowNetwork).url;return value==='.'?root:root+'/'+value.split('/').map(encodeURIComponent).join('/');};
- const baseUrl=endpoint(options.svnBasePath),targetUrl=endpoint(options.svnTargetPath);
- if(baseUrl!==targetUrl&&(baseUrl.startsWith(targetUrl+'/')||targetUrl.startsWith(baseUrl+'/')))throw new Error('Overlapping SVN branch roots require unambiguous endpoint path mapping');
- return {baseUrl,targetUrl,crossUrl:baseUrl!==targetUrl};
+export function svnHistoryEndpoints(local, options, destination) {
+  const hasBase = options.svnBasePath !== undefined, hasTarget = options.svnTargetPath !== undefined;
+  if (hasBase !== hasTarget) throw new Error('SVN branch comparison requires both svnBasePath and svnTargetPath');
+  if (!hasBase) return { baseUrl: destination(local.url, options.svnAllowNetwork).url, targetUrl: destination(local.url, options.svnAllowNetwork).url, crossUrl: false };
+  if (options.svnRevision !== undefined) throw new Error('SVN branch paths require explicit revision range');
+  if (!local.repository?.root || !local.repository?.uuid) throw new Error('SVN repository root identity required');
+
+  const endpoint = value => {
+    if (value !== '.') { relativePath(value); assertNonSecretPath(value); }
+    const root = destination(local.repository.root, options.svnAllowNetwork).url;
+    return value === '.' ? root : root + '/' + value.split('/').map(encodeURIComponent).join('/');
+  };
+
+  const baseUrl = endpoint(options.svnBasePath), targetUrl = endpoint(options.svnTargetPath);
+  if (baseUrl !== targetUrl && (baseUrl.startsWith(targetUrl + '/') || targetUrl.startsWith(baseUrl + '/'))) throw new Error('Overlapping SVN branch roots require unambiguous endpoint path mapping');
+  return { baseUrl, targetUrl, crossUrl: baseUrl !== targetUrl };
 }

package/src/svn-history-lookup.mjs

@@ -1,31 +1,39 @@
 import path from 'node:path';
-import {relativePath} from './content.mjs';
+import { relativePath } from './content.mjs';
+
+const REVISION = /^(0|[1-9][0-9]*)$/;
 
 // A successful immediate-parent listing proves absence within the visible scope.
 // Access errors are propagated, not interpreted using stderr or localized text.
-export function fixedSvnLookup({list,signal,maxEntries=512}={}) {
- if(typeof list!=='function'||!Number.isSafeInteger(maxEntries)||maxEntries<1||maxEntries>512)throw new Error('Invalid SVN historical lookup capability');
- const directories=new Map();let entries=0;
- const lookup=async(name,revision,side)=>{
-  relativePath(name);signal?.throwIfAborted();
-  if(typeof revision!=='string'||!/^(0|[1-9][0-9]*)$/.test(revision)||!Number.isSafeInteger(Number(revision)))throw new Error('Invalid SVN lookup revision');
-  const parent=path.posix.dirname(name),key=JSON.stringify([side??null,revision,parent]);
-  if(!directories.has(key)){
-   if(parent!=='.'){
-    const node=await lookup(parent,revision,side);
-    if(!node||node.kind!=='dir')return null;
-   }
-   const records=await list(parent,revision,side);signal?.throwIfAborted();
-   if(!Array.isArray(records))throw new Error('Invalid fixed SVN directory listing');
-   const children=new Map();
-   for(const record of records){
-    if(++entries>maxEntries)throw new Error('SVN historical directory entry budget exceeded');
-    if(typeof record?.name!=='string'||record.name.includes('/')||relativePath(record.name)!==record.name||!['file','dir'].includes(record.kind)||children.has(record.name))throw new Error('Invalid fixed SVN directory entry');
-    children.set(record.name,{kind:record.kind});
-   }
-   directories.set(key,children);
-  }
-  return directories.get(key).get(path.posix.basename(name))??null;
- };
- return {lookup,usage:()=>({directories:directories.size,entries})};
+export function fixedSvnLookup({ list, signal, maxEntries = 512 } = {}) {
+  if (typeof list !== 'function' || !Number.isSafeInteger(maxEntries) || maxEntries < 1 || maxEntries > 512) throw new Error('Invalid SVN historical lookup capability');
+  const directories = new Map();
+  let entries = 0;
+
+  const lookup = async (name, revision, side) => {
+    relativePath(name);
+    signal?.throwIfAborted();
+    if (typeof revision !== 'string' || !REVISION.test(revision) || !Number.isSafeInteger(Number(revision))) throw new Error('Invalid SVN lookup revision');
+    const parent = path.posix.dirname(name);
+    const key = JSON.stringify([side ?? null, revision, parent]);
+    if (!directories.has(key)) {
+      if (parent !== '.') {
+        const node = await lookup(parent, revision, side);
+        if (!node || node.kind !== 'dir') return null;
+      }
+      const records = await list(parent, revision, side);
+      signal?.throwIfAborted();
+      if (!Array.isArray(records)) throw new Error('Invalid fixed SVN directory listing');
+      const children = new Map();
+      for (const record of records) {
+        if (++entries > maxEntries) throw new Error('SVN historical directory entry budget exceeded');
+        if (typeof record?.name !== 'string' || record.name.includes('/') || relativePath(record.name) !== record.name || !['file', 'dir'].includes(record.kind) || children.has(record.name)) throw new Error('Invalid fixed SVN directory entry');
+        children.set(record.name, { kind: record.kind });
+      }
+      directories.set(key, children);
+    }
+    return directories.get(key).get(path.posix.basename(name)) ?? null;
+  };
+
+  return { lookup, usage: () => ({ directories: directories.size, entries }) };
 }

package/src/svn-keyword-config.mjs

@@ -1,10 +1,13 @@
 // Native SVN separates keyword definitions using ASCII whitespace, not shell quotes.
-export function keywordConfigurationTokens(configuration){
- if(typeof configuration!=='string'||Buffer.byteLength(configuration)>4096)throw new Error('Invalid SVN keyword configuration');
- if(configuration.includes(String.fromCharCode(34))||configuration.includes(String.fromCharCode(39)))throw new Error('Quoted SVN keyword configurations are unsupported; use %_ for a space');
- if(/[\x00-\x08\x0e-\x1f\x7f]/.test(configuration))throw new Error('Control character in SVN keyword configuration');
- if(configuration.includes(String.fromCharCode(92)))throw new Error('Unquoted escape in SVN keyword configuration');
- const tokens=configuration.split(/[ \t\r\n\v\f]+/).filter(Boolean);
- if(tokens.length>100)throw new Error('SVN keyword configuration token limit exceeded');
- return tokens;
+const CONTROL_CHARS = /[\x00-\x08\x0e-\x1f\x7f]/;
+const WHITESPACE = /[ \t\r\n\v\f]+/;
+
+export function keywordConfigurationTokens(configuration) {
+  if (typeof configuration !== 'string' || Buffer.byteLength(configuration) > 4096) throw new Error('Invalid SVN keyword configuration');
+  if (configuration.includes(String.fromCharCode(34)) || configuration.includes(String.fromCharCode(39))) throw new Error('Quoted SVN keyword configurations are unsupported; use %_ for a space');
+  if (CONTROL_CHARS.test(configuration)) throw new Error('Control character in SVN keyword configuration');
+  if (configuration.includes(String.fromCharCode(92))) throw new Error('Unquoted escape in SVN keyword configuration');
+  const tokens = configuration.split(WHITESPACE).filter(Boolean);
+  if (tokens.length > 100) throw new Error('SVN keyword configuration token limit exceeded');
+  return tokens;
 }

package/src/svn-keyword-mapping.mjs

@@ -1,44 +1,75 @@
-import {hash} from './content.mjs';
-import {keywordConfigurationTokens} from './svn-keyword-config.mjs';
-const standard=new Set(['Date','LastChangedDate','Revision','Rev','LastChangedRevision','Author','LastChangedBy','HeadURL','URL','Id','Header']);
+import { hash } from './content.mjs';
+import { keywordConfigurationTokens } from './svn-keyword-config.mjs';
+
+const STANDARD = new Set(['Date', 'LastChangedDate', 'Revision', 'Rev', 'LastChangedRevision', 'Author', 'LastChangedBy', 'HeadURL', 'URL', 'Id', 'Header']);
+const CUSTOM_DEFINITION = /^([A-Za-z][A-Za-z0-9]*)=(.+)$/;
+const ALLOWED_FORMAT_FLAGS = 'radDuRPb_HI%';
+const ALLOWED_LITERAL = /[A-Za-z0-9_.:/ ()-]/;
+const EXPANSION = /\$([A-Za-z][A-Za-z0-9]*)(:{1,2})([^\r\n$]*)\$/g;
+const CONTRACTED_FIXED = /\$([A-Za-z][A-Za-z0-9]*)::( +)\$/g;
+
+function parseCustomFormat(format) {
+  for (let i = 0; i < format.length; i++) {
+    const c = format[i];
+    if (c === '%') {
+      if (!ALLOWED_FORMAT_FLAGS.includes(format[++i] ?? '') || i >= format.length) throw new Error('Unsupported SVN custom keyword format');
+    } else if (!ALLOWED_LITERAL.test(c)) {
+      throw new Error('Unsupported SVN custom keyword literal');
+    }
+  }
+}
 
 // Parse bounded quoted and unquoted SVN formats. Expansion is verified by SVN BASE,
 // never reimplemented here; raw source remains the only evidence.
-export function svnKeywordConfiguration(configuration){
- if(typeof configuration!=='string'||Buffer.byteLength(configuration)>4096)throw new Error('Invalid SVN keyword configuration');
- const enabled=new Set(),custom=[];
- for(const token of keywordConfigurationTokens(configuration)){
-  if(standard.has(token)){if(enabled.has(token))throw new Error('Duplicate SVN keyword configuration');enabled.add(token);continue;}
-  const match=/^([A-Za-z][A-Za-z0-9]*)=(.+)$/.exec(token);
-  if(!match||standard.has(match[1])||enabled.has(match[1]))throw new Error('Unsupported SVN custom keyword configuration');
-  const format=match[2];
-  for(let i=0;i<format.length;i++){
-   const c=format[i];if(c==='%'){if(!'radDuRPb_HI%'.includes(format[++i]??'')||i>=format.length)throw new Error('Unsupported SVN custom keyword format');}
-   else if(!/[A-Za-z0-9_.:/ ()-]/.test(c))throw new Error('Unsupported SVN custom keyword literal');
+export function svnKeywordConfiguration(configuration) {
+  if (typeof configuration !== 'string' || Buffer.byteLength(configuration) > 4096) throw new Error('Invalid SVN keyword configuration');
+  const enabled = new Set(), custom = [];
+  for (const token of keywordConfigurationTokens(configuration)) {
+    if (STANDARD.has(token)) {
+      if (enabled.has(token)) throw new Error('Duplicate SVN keyword configuration');
+      enabled.add(token);
+      continue;
+    }
+    const match = CUSTOM_DEFINITION.exec(token);
+    if (!match || STANDARD.has(match[1]) || enabled.has(match[1])) throw new Error('Unsupported SVN custom keyword configuration');
+    parseCustomFormat(match[2]);
+    enabled.add(match[1]);
+    custom.push({ name: match[1], format: match[2] });
   }
-  enabled.add(match[1]);custom.push({name:match[1],format});
- }
- return {enabled,custom};
+  return { enabled, custom };
 }
 
-export function svnKeywordMapping(text,configuration){
- if(typeof text!=='string'||Buffer.byteLength(text)>256*1024)throw new Error('Invalid SVN keyword mapping input');
- const {enabled,custom}=svnKeywordConfiguration(configuration);let replacements=0,fixedWidth=0;
- const normalized=text.replace(/\$([A-Za-z][A-Za-z0-9]*)(:{1,2})([^\r\n$]*)\$/g,(literal,name,separator,value)=>{
-  if(!enabled.has(name))return literal;
-  if(separator==='::'){
-   // SVN reserves the complete field width, including the initial space and
-   // final space (or # truncation marker); shrink values without changing width.
-   if(value.length<2||value[0]!==' '||![' ','#'].includes(value.at(-1)))throw new Error('Ambiguous SVN fixed-width keyword expansion');
-   fixedWidth++;if(/[^ ]/.test(value))replacements++;return '$'+name+'::'+' '.repeat(value.length)+'$';
+export function svnKeywordMapping(text, configuration) {
+  if (typeof text !== 'string' || Buffer.byteLength(text) > 256 * 1024) throw new Error('Invalid SVN keyword mapping input');
+  const { enabled, custom } = svnKeywordConfiguration(configuration);
+  let replacements = 0, fixedWidth = 0;
+  const normalized = text.replace(EXPANSION, (literal, name, separator, value) => {
+    if (!enabled.has(name)) return literal;
+    if (separator === '::') {
+      // SVN reserves the complete field width, including the initial space and
+      // final space (or # truncation marker); shrink values without changing width.
+      if (value.length < 2 || value[0] !== ' ' || ![' ', '#'].includes(value.at(-1))) throw new Error('Ambiguous SVN fixed-width keyword expansion');
+      fixedWidth++;
+      if (/[^ ]/.test(value)) replacements++;
+      return '$' + name + '::' + ' '.repeat(value.length) + '$';
+    }
+    if (!/^ .+ $/.test(value)) throw new Error('Ambiguous SVN keyword expansion');
+    replacements++;
+    return '$' + name + '$';
+  });
+  // Fixed fields intentionally retain :: after contraction. Any other colon
+  // occurrence must be a complete recognized field, not silently partial data.
+  const residual = normalized.replace(CONTRACTED_FIXED, (literal, name) => enabled.has(name) ? '' : literal);
+  for (const name of enabled) {
+    const escaped = name.replace(/[.*+?^${}()|[\]\\]/g, '\\$&');
+    if (new RegExp('\\$' + escaped + ':').test(residual)) throw new Error('Incomplete SVN keyword expansion mapping');
   }
-  if(!/^ .+ $/.test(value))throw new Error('Ambiguous SVN keyword expansion');
-  replacements++;return '$'+name+'$';
- });
- // Fixed fields intentionally retain :: after contraction. Any other colon
- // occurrence must be a complete recognized field, not silently partial data.
- const residual=normalized.replace(/\$([A-Za-z][A-Za-z0-9]*)::( +)\$/g,(literal,name)=>enabled.has(name)?'':literal);
- for(const name of enabled){const escaped=name.replace(/[.*+?^${}()|[\]\\]/g,'\\$&');if(new RegExp('\\$'+escaped+':').test(residual))throw new Error('Incomplete SVN keyword expansion mapping');}
- if(text.split('\n').length!==normalized.split('\n').length)throw new Error('SVN keyword mapping changed line identity');
- return {text:normalized,rawTextHash:hash(text),textHash:hash(normalized),replacements,...(fixedWidth?{fixedWidthFields:fixedWidth}:{}),...(custom.length?{customKeywords:custom}:{}),lineMapping:'identity',status:'candidate-only',notice:'Line-preserving keyword view only; fixed-field width retained. BASE contraction must be independently verified against svn cat --ignore-keywords. Raw source and original line numbers remain evidence, not behavioral equivalence.'};
+  if (text.split('\n').length !== normalized.split('\n').length) throw new Error('SVN keyword mapping changed line identity');
+  return {
+    text: normalized, rawTextHash: hash(text), textHash: hash(normalized), replacements,
+    ...(fixedWidth ? { fixedWidthFields: fixedWidth } : {}),
+    ...(custom.length ? { customKeywords: custom } : {}),
+    lineMapping: 'identity', status: 'candidate-only',
+    notice: 'Line-preserving keyword view only; fixed-field width retained. BASE contraction must be independently verified against svn cat --ignore-keywords. Raw source and original line numbers remain evidence, not behavioral equivalence.',
+  };
 }

package/src/svn-mergeinfo.mjs

@@ -1,32 +1,44 @@
-import {hash} from './content.mjs';
+import { hash } from './content.mjs';
 
 export function snapshotMergeSources(files) {
-  return files.filter(file=>file.eligibility==='reviewable').flatMap(file=>file.properties.filter(prop=>prop.name==='svn:mergeinfo').map(prop=>({path:file.path,old:mergeinfoNavigation(prop.old),new:mergeinfoNavigation(prop.new)})));
+  return files
+    .filter(file => file.eligibility === 'reviewable')
+    .flatMap(file => file.properties
+      .filter(prop => prop.name === 'svn:mergeinfo')
+      .map(prop => ({ path: file.path, old: mergeinfoNavigation(prop.old), new: mergeinfoNavigation(prop.new) })));
 }
 
+const CONTROL_OR_BACKSLASH = /[\x00-\x1f\\]/;
+const RANGE = /^([1-9][0-9]*)(?:-([1-9][0-9]*))?(\*)?$/;
+
 // Navigation over an already approved property. Never expands revisions or reads URLs.
 export function mergeinfoNavigation(text) {
-  if(text===null || text==='')return {status:'parsed',sources:[],hash:hash(text??'')};
-  if(typeof text!=='string')return {status:'invalid',reason:'Mergeinfo property is not text',sources:[]};
-  if(Buffer.byteLength(text)>16*1024)return {status:'limited',reason:'Mergeinfo navigation byte limit exceeded',sources:[],hash:hash(text)};
-  const lines=text.split(/\r?\n/);if(lines.at(-1)==='')lines.pop();
-  if(lines.length>100)return {status:'limited',reason:'Mergeinfo navigation source limit exceeded',sources:[],hash:hash(text)};
-  const sources=[],seen=new Set();let rangeCount=0;
-  for(const line of lines){
-    const delimiter=line.lastIndexOf(':');
-    const sourcePath=line.slice(0,delimiter),list=line.slice(delimiter+1);
-    if(delimiter<1||!sourcePath.startsWith('/')||/[\x00-\x1f\\]/.test(sourcePath)||sourcePath.length>1024||(sourcePath!=='/'&&sourcePath.slice(1).split('/').some(part=>!part||part==='.'||part==='..'))||seen.has(sourcePath))return {status:'invalid',reason:'Mergeinfo navigation path or duplicate source invalid',sources:[],hash:hash(text)};
+  if (text === null || text === '') return { status: 'parsed', sources: [], hash: hash(text ?? '') };
+  if (typeof text !== 'string') return { status: 'invalid', reason: 'Mergeinfo property is not text', sources: [] };
+  if (Buffer.byteLength(text) > 16 * 1024) return { status: 'limited', reason: 'Mergeinfo navigation byte limit exceeded', sources: [], hash: hash(text) };
+  const lines = text.split(/\r?\n/);
+  if (lines.at(-1) === '') lines.pop();
+  if (lines.length > 100) return { status: 'limited', reason: 'Mergeinfo navigation source limit exceeded', sources: [], hash: hash(text) };
+
+  const sources = [], seen = new Set();
+  let rangeCount = 0;
+  for (const line of lines) {
+    const delimiter = line.lastIndexOf(':');
+    const sourcePath = line.slice(0, delimiter), list = line.slice(delimiter + 1);
+    if (delimiter < 1 || !sourcePath.startsWith('/') || CONTROL_OR_BACKSLASH.test(sourcePath) || sourcePath.length > 1024 || (sourcePath !== '/' && sourcePath.slice(1).split('/').some(part => !part || part === '.' || part === '..')) || seen.has(sourcePath)) {
+      return { status: 'invalid', reason: 'Mergeinfo navigation path or duplicate source invalid', sources: [], hash: hash(text) };
+    }
     seen.add(sourcePath);
-    const ranges=[];
-    for(const token of list.split(',')){
-      if(++rangeCount>500)return {status:'limited',reason:'Mergeinfo navigation range limit exceeded',sources:[],hash:hash(text)};
-      const match=/^([1-9][0-9]*)(?:-([1-9][0-9]*))?(\*)?$/.exec(token);
-      if(!match)return {status:'invalid',reason:'Mergeinfo navigation revision range invalid',sources:[],hash:hash(text)};
-      const start=Number(match[1]),end=Number(match[2]??match[1]);
-      if(!Number.isSafeInteger(start)||!Number.isSafeInteger(end)||start>end)return {status:'invalid',reason:'Mergeinfo navigation revision range invalid',sources:[],hash:hash(text)};
-      ranges.push({start:String(start),end:String(end),inheritable:!match[3]});
+    const ranges = [];
+    for (const token of list.split(',')) {
+      if (++rangeCount > 500) return { status: 'limited', reason: 'Mergeinfo navigation range limit exceeded', sources: [], hash: hash(text) };
+      const match = RANGE.exec(token);
+      if (!match) return { status: 'invalid', reason: 'Mergeinfo navigation revision range invalid', sources: [], hash: hash(text) };
+      const start = Number(match[1]), end = Number(match[2] ?? match[1]);
+      if (!Number.isSafeInteger(start) || !Number.isSafeInteger(end) || start > end) return { status: 'invalid', reason: 'Mergeinfo navigation revision range invalid', sources: [], hash: hash(text) };
+      ranges.push({ start: String(start), end: String(end), inheritable: !match[3] });
     }
-    sources.push({sourcePath,ranges});
+    sources.push({ sourcePath, ranges });
   }
-  return {status:'parsed',sources,hash:hash(text),notice:'Explicit mergeinfo navigation only; not effective inherited mergeinfo, change attribution, permission to read a source or evidence that listed revisions were reviewed.'};
+  return { status: 'parsed', sources, hash: hash(text), notice: 'Explicit mergeinfo navigation only; not effective inherited mergeinfo, change attribution, permission to read a source or evidence that listed revisions were reviewed.' };
 }

package/src/svn-navigation-budget.mjs

@@ -1,6 +1,17 @@
-import {captureSignal} from './capture-signal.mjs';
+import { captureSignal } from './capture-signal.mjs';
+
 // One source ledger/deadline per working-copy navigation capture, never per stage.
-export function createSvnNavigationBudget(signal){
- const sharedSignal=captureSignal(signal);let bytes=0;
- return Object.freeze({signal:sharedSignal,charge(size){sharedSignal.throwIfAborted();if(!Number.isSafeInteger(size)||size<0)throw new Error('Invalid SVN navigation source size');bytes+=size;if(bytes>1024*1024)throw Object.assign(new Error('SVN shared navigation source byte limit exceeded'),{code:'SVN_NAVIGATION_BUDGET'});},usage(){return bytes;}});
+export function createSvnNavigationBudget(signal) {
+  const sharedSignal = captureSignal(signal);
+  let bytes = 0;
+  return Object.freeze({
+    signal: sharedSignal,
+    charge(size) {
+      sharedSignal.throwIfAborted();
+      if (!Number.isSafeInteger(size) || size < 0) throw new Error('Invalid SVN navigation source size');
+      bytes += size;
+      if (bytes > 1024 * 1024) throw Object.assign(new Error('SVN shared navigation source byte limit exceeded'), { code: 'SVN_NAVIGATION_BUDGET' });
+    },
+    usage() { return bytes; },
+  });
 }

package/src/svn-special.mjs

@@ -1,10 +1,15 @@
 // SVN stores symbolic links as file-node data. Never resolve or open the target.
-export function svnSpecialData(content,properties,kind){
- if(!Object.hasOwn(properties,'svn:special'))return null;
- if(kind!=='file'||properties['svn:special']!=='*')throw new Error('Unsupported SVN special node kind or property value');
- if(Object.hasOwn(properties,'svn:keywords')||Object.hasOwn(properties,'svn:eol-style'))throw new Error('SVN special node has incompatible text transformation properties');
- if(content.encoding!=='utf-8'||!content.text.startsWith('link '))throw new Error('SVN special node is not a UTF-8 link record');
- const target=content.text.slice(5);
- if(!target||/[\x00-\x1f\x7f]/.test(target)||Buffer.byteLength(target)>16384)throw new Error('Invalid or oversized SVN link target data');
- return {type:'symlink',target,recordHash:content.hash,followed:false,notice:'Repository link target data only. Target text is untrusted data, not an authorized path, source file, existence check or navigation instruction. Never follow this link.'};
+const CONTROL_CHARS = /[\x00-\x1f\x7f]/;
+
+export function svnSpecialData(content, properties, kind) {
+  if (!Object.hasOwn(properties, 'svn:special')) return null;
+  if (kind !== 'file' || properties['svn:special'] !== '*') throw new Error('Unsupported SVN special node kind or property value');
+  if (Object.hasOwn(properties, 'svn:keywords') || Object.hasOwn(properties, 'svn:eol-style')) throw new Error('SVN special node has incompatible text transformation properties');
+  if (content.encoding !== 'utf-8' || !content.text.startsWith('link ')) throw new Error('SVN special node is not a UTF-8 link record');
+  const target = content.text.slice(5);
+  if (!target || CONTROL_CHARS.test(target) || Buffer.byteLength(target) > 16384) throw new Error('Invalid or oversized SVN link target data');
+  return {
+    type: 'symlink', target, recordHash: content.hash, followed: false,
+    notice: 'Repository link target data only. Target text is untrusted data, not an authorized path, source file, existence check or navigation instruction. Never follow this link.',
+  };
 }

package/src/svn-url.mjs

@@ -1,8 +1,20 @@
 // Compare repository URL spelling without decoding path separators into structure.
-export function canonicalSvnUrl(value){
- if(typeof value!=='string')throw new Error('Missing SVN URL');const url=new URL(value);
- if(url.username||url.password||url.search||url.hash||!['file:','http:','https:','svn:','svn+ssh:'].includes(url.protocol))throw new Error('Unsafe SVN URL identity');
- const segments=url.pathname.split('/').map(segment=>{const decoded=decodeURIComponent(segment);if(decoded.includes('/')||decoded.includes('\\')||/[\x00-\x1f\x7f]/.test(decoded)||decoded==='.'||decoded==='..')throw new Error('Unsafe encoded SVN URL segment');return encodeURIComponent(decoded);});
- return url.protocol+'//'+url.host+segments.join('/').replace(/\/$/,'');
+const SAFE_PROTOCOLS = ['file:', 'http:', 'https:', 'svn:', 'svn+ssh:'];
+const CONTROL_CHARS = /[\x00-\x1f\x7f]/;
+
+export function canonicalSvnUrl(value) {
+  if (typeof value !== 'string') throw new Error('Missing SVN URL');
+  const url = new URL(value);
+  if (url.username || url.password || url.search || url.hash || !SAFE_PROTOCOLS.includes(url.protocol)) throw new Error('Unsafe SVN URL identity');
+  const segments = url.pathname.split('/').map(segment => {
+    const decoded = decodeURIComponent(segment);
+    if (decoded.includes('/') || decoded.includes('\\') || CONTROL_CHARS.test(decoded) || decoded === '.' || decoded === '..') throw new Error('Unsafe encoded SVN URL segment');
+    return encodeURIComponent(decoded);
+  });
+  return url.protocol + '//' + url.host + segments.join('/').replace(/\/$/, '');
+}
+
+export function sameSvnUrl(a, b) {
+  try { return canonicalSvnUrl(a) === canonicalSvnUrl(b); }
+  catch { return false; }
 }
-export function sameSvnUrl(a,b){try{return canonicalSvnUrl(a)===canonicalSvnUrl(b);}catch{return false;}}

package/src/svn-working-identity.mjs

@@ -1,10 +1,24 @@
-import {hash} from './content.mjs';
-import {sameSvnUrl,canonicalSvnUrl} from './svn-url.mjs';
-export function svnWorkingIdentity(node,rootInfo,name){
- const expected=name==='.'?rootInfo.url:rootInfo.url.replace(/\/$/,'')+'/'+name.split('/').map(encodeURIComponent).join('/');
+import { hash } from './content.mjs';
+import { sameSvnUrl, canonicalSvnUrl } from './svn-url.mjs';
 
- if(!sameSvnUrl(node?.url,expected))throw Object.assign(new Error('SVN node URL differs from selected working-copy path; switched ancestors are unsupported'),{code:'SVN_SWITCHED_ANCESTOR'});
- if(!rootInfo.repository?.uuid||node.repository?.uuid!==rootInfo.repository.uuid||node.repository?.root!==rootInfo.repository.root||node['wc-info']?.['wcroot-abspath']!==rootInfo['wc-info']?.['wcroot-abspath'])throw Object.assign(new Error('SVN node repository or working-copy identity mismatch'),{code:'SVN_NODE_IDENTITY'});
- const source={url:canonicalSvnUrl(node.url),repositoryUuid:node.repository.uuid,repositoryRoot:node.repository.root,revision:String(node['@_revision']),kind:node['@_kind'],...(node['@_kind']==='dir'?{depth:node['wc-info']?.depth??null}:{}),schedule:node['wc-info']?.schedule,copyFromUrl:node['wc-info']?.['copy-from-url']??null,copyFromRevision:node['wc-info']?.['copy-from-rev']??null};
- return {source,fingerprint:hash(JSON.stringify(source))};
+export function svnWorkingIdentity(node, rootInfo, name) {
+  const expected = name === '.'
+    ? rootInfo.url
+    : rootInfo.url.replace(/\/$/, '') + '/' + name.split('/').map(encodeURIComponent).join('/');
+
+  if (!sameSvnUrl(node?.url, expected)) throw Object.assign(new Error('SVN node URL differs from selected working-copy path; switched ancestors are unsupported'), { code: 'SVN_SWITCHED_ANCESTOR' });
+  if (!rootInfo.repository?.uuid || node.repository?.uuid !== rootInfo.repository.uuid || node.repository?.root !== rootInfo.repository.root || node['wc-info']?.['wcroot-abspath'] !== rootInfo['wc-info']?.['wcroot-abspath']) throw Object.assign(new Error('SVN node repository or working-copy identity mismatch'), { code: 'SVN_NODE_IDENTITY' });
+
+  const source = {
+    url: canonicalSvnUrl(node.url),
+    repositoryUuid: node.repository.uuid,
+    repositoryRoot: node.repository.root,
+    revision: String(node['@_revision']),
+    kind: node['@_kind'],
+    ...(node['@_kind'] === 'dir' ? { depth: node['wc-info']?.depth ?? null } : {}),
+    schedule: node['wc-info']?.schedule,
+    copyFromUrl: node['wc-info']?.['copy-from-url'] ?? null,
+    copyFromRevision: node['wc-info']?.['copy-from-rev'] ?? null,
+  };
+  return { source, fingerprint: hash(JSON.stringify(source)) };
 }