@legioncodeinc/nectar 0.0.1

package/dist/registration/ladder.js

@@ -0,0 +1,378 @@
+import { inTenancy } from "../hive-graph/model.js";
+import { mintNectar, nectarCreatedAt } from "../hive-graph/ulid.js";
+import { sha256Hex } from "../hive-graph/hash.js";
+import { filenameOf, extOf } from "../hive-graph/paths.js";
+import { classifyNewFile } from "./copy-detect.js";
+// Value import; tlsh's back-edge to this module is `import type` (erased), so there is no runtime cycle.
+import { computeFingerprint } from "./tlsh.js";
+/** A simple `Map`-backed {@link StatCache}. One instance persists for the lifetime of a `RegistrationService` (across cycles, not across a daemon restart - a restart re-warms via the store's own version-row stat, just without the touch optimization until the next touch). */
+export function createInMemoryStatCache() {
+    const map = new Map();
+    return {
+        get: (relPath) => map.get(relPath),
+        set: (relPath, stat) => {
+            map.set(relPath, { mtimeObserved: stat.mtimeObserved, sizeBytes: stat.sizeBytes });
+        },
+        delete: (relPath) => {
+            map.delete(relPath);
+        },
+    };
+}
+/** Run the ladder for one observed file. Returns which step fired and the nectar it resolved to. */
+export function reassociate(file, deps) {
+    const { store, tenancy } = deps;
+    const byPath = store.latestVersionByPath(tenancy, file.relPath);
+    // Step 1: (path, mtime, size) exact -> unchanged, no read, no hash. A
+    // fast-path cache hit (NEC-035 / AC-018c.9) takes precedence over the
+    // stored version row's own stat: it is the freshest stat the ladder has
+    // ever observed for this path since the content last actually changed.
+    const cachedStat = deps.statCache?.get(file.relPath);
+    const effectiveMtime = cachedStat?.mtimeObserved ?? byPath?.version.mtimeObserved;
+    const effectiveSize = cachedStat?.sizeBytes ?? byPath?.version.sizeBytes;
+    if (byPath !== undefined && effectiveMtime === file.mtimeObserved && effectiveSize === file.sizeBytes) {
+        return { step: 1, action: "noop", nectar: byPath.identity.nectar };
+    }
+    // Anything past step 1 requires the content hash (and the persisted fingerprint).
+    const content = file.readContent();
+    const hash = sha256Hex(content);
+    const fingerprint = computeFingerprint(content);
+    // Step 2: path is known; compare content.
+    if (byPath !== undefined) {
+        if (byPath.version.contentHash === hash) {
+            // Content identical (mtime/size changed, e.g. `touch`): still a no-op,
+            // but remember the fresh stat (NEC-035) so the NEXT observation of this
+            // unchanged file takes the step-1 fast path instead of re-hashing.
+            deps.statCache?.set(file.relPath, { mtimeObserved: file.mtimeObserved, sizeBytes: file.sizeBytes });
+            return { step: 2, action: "noop", nectar: byPath.identity.nectar };
+        }
+        // Real content change: the fresh version row already carries the correct
+        // stat, so any stale cache entry from a prior touch must not shadow it.
+        deps.statCache?.delete(file.relPath);
+        appendEditVersion(deps, byPath, file, hash, fingerprint);
+        deps.onEnrichQueued?.(byPath.identity.nectar);
+        return { step: 2, action: "append-version", nectar: byPath.identity.nectar };
+    }
+    // Path is NOT known. Look for an exact content-hash match to another nectar.
+    const byHash = store.latestVersionByHash(tenancy, hash);
+    if (byHash !== undefined) {
+        const sourcePath = byHash.version.path;
+        // NEC-034 / AC-018c.8: on a case-insensitive filesystem, a case-only
+        // rename (`Foo.ts` -> `foo.ts`) leaves `existsOnDisk(sourcePath)` true
+        // (the OS resolves either casing to the same file), which would
+        // misclassify the rename as a copy. `file.relPath` is the TRUE on-disk
+        // casing of the just-observed path (from `fs.watch`/`readdir`, never
+        // user-typed), so a source that case-folds equal but differs in exact
+        // casing is unambiguously the same file, renamed - no filesystem
+        // existence check needed for that specific determination.
+        const caseOnlyRename = deps.caseInsensitive === true &&
+            sourcePath !== file.relPath &&
+            sourcePath.toLowerCase() === file.relPath.toLowerCase();
+        if (sourcePath !== file.relPath && (caseOnlyRename || !deps.existsOnDisk(sourcePath))) {
+            // Step 3: the source path is gone (or case-only renamed) -> this is a
+            // move. Carry the nectar, inherit the description (content unchanged),
+            // enqueue no enrich. The carry is refused (falls through to mint) if
+            // the source is out of tenancy. `file.relPath` (the fresh casing) is
+            // what gets written, so stored rows preserve on-disk casing.
+            if (writeCarriedRow(store, tenancy, deps.now(), byHash, file, hash, null, fingerprint)) {
+                deps.statCache?.delete(sourcePath);
+                return { step: 3, action: "carry-nectar", nectar: byHash.identity.nectar };
+            }
+        }
+        // Source still on disk -> a copy. Mint with provenance (step 5).
+        return mintOrCopy(deps, file, hash, fingerprint);
+    }
+    // Step 4: fuzzy match to a missing file (only if an injected fuzzy step exists).
+    // Candidates read the missing nectar's PERSISTED fingerprint column, so the
+    // match survives a daemon restart (no in-process cache).
+    let review = null;
+    if (deps.fuzzy !== undefined) {
+        const candidates = missingCandidates(deps, file.relPath).map((lv) => ({
+            ...lv,
+            fingerprint: lv.version.fingerprint ?? null,
+        }));
+        const outcome = deps.fuzzy.match(content, candidates);
+        switch (outcome.kind) {
+            case "match": {
+                const carried = store.latestVersion(outcome.nectar);
+                const identity = store.getIdentity(outcome.nectar);
+                if (carried !== undefined &&
+                    identity !== undefined &&
+                    writeCarriedRow(store, tenancy, deps.now(), { identity, version: carried }, file, hash, outcome.confidence, fingerprint)) {
+                    // High-confidence carry: content changed, so (re)describe (PRD-006d AC step-4 high band).
+                    deps.onEnrichQueued?.(outcome.nectar);
+                    return { step: 4, action: "carry-nectar", nectar: outcome.nectar };
+                }
+                break;
+            }
+            case "review": {
+                review = { nectar: outcome.nectar, confidence: outcome.confidence, distance: outcome.distance ?? null };
+                break;
+            }
+            case "none":
+                break;
+            default: {
+                const _exhaustive = outcome;
+                return _exhaustive;
+            }
+        }
+    }
+    // Step 5: mint (or copy, with provenance). A below-high fuzzy candidate is
+    // surfaced for review AFTER the fresh mint so the record can name the minted
+    // nectar; accepting it later re-associates the missing nectar onto this path.
+    const result = mintOrCopy(deps, file, hash, fingerprint);
+    if (review !== null) {
+        deps.onReviewNeeded?.({
+            nectar: review.nectar,
+            relPath: file.relPath,
+            confidence: review.confidence,
+            distance: review.distance,
+            contentHash: hash,
+            sizeBytes: file.sizeBytes,
+            mtimeObserved: file.mtimeObserved,
+            mintedNectar: result.nectar,
+        });
+    }
+    return result;
+}
+/**
+ * Missing candidates: known latest versions whose current path is gone from
+ * disk (and is not this file's path). PRD-018c EX-4 (change-detection review
+ * M7): when the caller supplies `deps.missingPaths` (computed ONCE per
+ * settle/resync cycle in `service.ts`'s `runCycle`), this is an O(1) set
+ * lookup per known version instead of an `existsOnDisk` stat - eliminating the
+ * O(known-files) stat-per-new-file cost the review flagged. Falls back to the
+ * pre-018c per-candidate `existsOnDisk` stat when `missingPaths` is omitted
+ * (unit tests calling `reassociate` directly need no change).
+ */
+function missingCandidates(deps, selfPath) {
+    const missing = deps.missingPaths;
+    if (missing !== undefined) {
+        return deps.store
+            .listLatestVersions(deps.tenancy)
+            .filter((lv) => lv.version.path !== selfPath && missing.has(lv.version.path));
+    }
+    return deps.store
+        .listLatestVersions(deps.tenancy)
+        .filter((lv) => lv.version.path !== selfPath && !deps.existsOnDisk(lv.version.path));
+}
+function baseVersion(tenancy, now, file, hash, seq, fingerprint) {
+    return {
+        nectar: "",
+        contentHash: hash,
+        seq,
+        path: file.relPath,
+        filename: filenameOf(file.relPath),
+        ext: extOf(file.relPath),
+        sizeBytes: file.sizeBytes,
+        mtimeObserved: file.mtimeObserved,
+        title: "",
+        description: "",
+        concepts: "[]",
+        embedding: null,
+        confidence: null,
+        fingerprint,
+        describedAt: "",
+        describeModel: "",
+        describeStatus: "pending",
+        observedAt: now,
+        orgId: tenancy.orgId,
+        workspaceId: tenancy.workspaceId,
+        projectId: tenancy.projectId,
+        lastUpdateDate: now,
+    };
+}
+/** Step 2: append an edited version (new content, pending description). Persists the content fingerprint. */
+function appendEditVersion(deps, prev, file, hash, fingerprint) {
+    const seq = deps.store.nextSeq(prev.identity.nectar);
+    const row = baseVersion(deps.tenancy, deps.now(), file, hash, seq, fingerprint);
+    row.nectar = prev.identity.nectar;
+    deps.store.appendVersion(row);
+    deps.store.touchIdentity(prev.identity.nectar, deps.now());
+}
+/**
+ * Step 3/4 carry: append a version row that carries `source`'s nectar to a new
+ * path, inheriting the prior description (content is identical for an exact
+ * step-3 move; a fuzzy carry keeps provenance and can be re-described later).
+ * Shared by the ladder and by `review-matches` accept.
+ *
+ * Returns false (and writes nothing) when `source.identity` is outside
+ * `tenancy`: a carry must never move a nectar minted under another project onto
+ * a path in this one (AC-20). Callers treat false as "no carry" and fall through
+ * to a fresh mint.
+ */
+function writeCarriedRow(store, tenancy, now, source, file, hash, confidence, fingerprint) {
+    if (!inTenancy(source.identity, tenancy))
+        return false; // refuse a cross-project carry
+    const seq = store.nextSeq(source.identity.nectar);
+    const row = baseVersion(tenancy, now, file, hash, seq, fingerprint);
+    row.nectar = source.identity.nectar;
+    row.title = source.version.title;
+    row.description = source.version.description;
+    row.concepts = source.version.concepts;
+    row.embedding = source.version.embedding;
+    row.describedAt = source.version.describedAt;
+    row.describeModel = source.version.describeModel;
+    row.describeStatus = source.version.describeStatus;
+    row.confidence = confidence;
+    store.appendVersion(row);
+    store.touchIdentity(source.identity.nectar, now);
+    return true;
+}
+/**
+ * Carry an existing nectar onto a new path (the `review-matches` accept path,
+ * AC-18): append a carried version row for `sourceNectar` at `target`. Returns
+ * false if the source nectar no longer exists. This is exactly what a
+ * high-confidence step 4 does, applied on human confirmation instead.
+ *
+ * The carried row's `fingerprint` is left NULL here: the accept path works from
+ * the persisted pending-candidate metadata (hash/size/mtime), not the file
+ * content, so there is nothing to fingerprint. It self-heals on the next
+ * observation of the file (a step-2 edit persists a fresh fingerprint), per the
+ * nullable-column contract.
+ */
+export function carryNectar(store, tenancy, now, sourceNectar, target, confidence) {
+    const version = store.latestVersion(sourceNectar);
+    const identity = store.getIdentity(sourceNectar);
+    if (version === undefined || identity === undefined)
+        return false;
+    // writeCarriedRow enforces the tenancy guard and returns false on a cross-project source.
+    return writeCarriedRow(store, tenancy, now, { identity, version }, { relPath: target.relPath, sizeBytes: target.sizeBytes, mtimeObserved: target.mtimeObserved }, target.contentHash, confidence, null);
+}
+/** Step 5: mint a fresh nectar, or record a copy with provenance. Persists the content fingerprint. */
+function mintOrCopy(deps, file, hash, fingerprint) {
+    const decision = classifyNewFile(deps.store, deps.tenancy, hash);
+    const nectar = mintNectar();
+    const now = deps.now();
+    const identity = {
+        nectar,
+        kind: "file",
+        createdAt: nectarCreatedAt(nectar),
+        derivedFromNectar: decision.action === "copy" ? decision.sourceNectar : "",
+        forkContentHash: decision.action === "copy" ? decision.forkContentHash : "",
+        orgId: deps.tenancy.orgId,
+        workspaceId: deps.tenancy.workspaceId,
+        projectId: deps.tenancy.projectId,
+        lastUpdateDate: now,
+    };
+    deps.store.insertIdentity(identity);
+    const row = baseVersion(deps.tenancy, now, file, hash, 0, fingerprint);
+    row.nectar = nectar;
+    deps.store.appendVersion(row);
+    deps.onEnrichQueued?.(nectar);
+    return { step: 5, action: decision.action === "copy" ? "copy" : "mint", nectar };
+}
+/**
+ * PRD-018d (NEC-036): the idempotent crash-repair sweep for the ladder's
+ * multi-write actions.
+ *
+ * Every ladder action that mutates the store is a SEQUENCE of two writes
+ * (mint = `insertIdentity` + `appendVersion`; edit/carry = `appendVersion` +
+ * `touchIdentity`; review-accept = carry + `deleteNectar` of the placeholder,
+ * `review-cli.ts`), with no atomicity across a crash between them (the
+ * sync/async store bridge that would let these be one transaction is
+ * PRD-018b's construction, a Non-Goal here). This sweep heals the three
+ * resulting invariant violations instead, and is idempotent: running it again
+ * on an already-healed store finds nothing to do.
+ *
+ *   1. An orphan identity (a mint that crashed after `insertIdentity`, before
+ *      `appendVersion`): zero version rows. There is no content to construct a
+ *      version from, so the only sound repair is deleting the orphan (the same
+ *      `deleteNectar` review-accept already uses to retire a placeholder -
+ *      this sweep is not a new deletion path, just a new caller of the
+ *      existing one). Requires the OPTIONAL `store.listIdentities` (skipped,
+ *      not guessed at, when the adapter omits it).
+ *   2. A stale `identity.lastUpdateDate` (an edit/carry that crashed after
+ *      `appendVersion`, before `touchIdentity`): the identity's timestamp
+ *      predates its own latest version's `lastUpdateDate`, which feeds prune
+ *      eligibility directly (`prune-cli.ts`). Healed by re-running
+ *      `touchIdentity` with the version's own timestamp.
+ *   3. Two identities both claiming one path as their latest version's `path`
+ *      (a review-accept that crashed after the carry landed, before the
+ *      placeholder delete ran): under normal ladder operation a carry only
+ *      ever targets a path with NO existing identity, so this can only be a
+ *      crash artifact. The carried identity's version always has a strictly
+ *      later `observedAt` than the placeholder's original mint, so the
+ *      survivor is the entry with the latest `observedAt`; every other
+ *      claimant is deleted.
+ */
+export function repairLadderState(store, tenancy) {
+    let healedOrphanIdentities = 0;
+    if (store.listIdentities !== undefined) {
+        for (const identity of store.listIdentities(tenancy)) {
+            if (store.latestVersion(identity.nectar) === undefined) {
+                store.deleteNectar(tenancy, identity.nectar);
+                healedOrphanIdentities += 1;
+            }
+        }
+    }
+    // 4. An orphan VERSION (CodeRabbit PR-18 finding #8, layer b): a version row
+    // whose nectar has no identity row at all - the inverse of the orphan-
+    // identity case above. This happens when a durable `insertIdentity` flush
+    // failed but a later `appendVersion` for the same nectar still landed (the
+    // sync/async bridge's layer-a fix, `store-bridge.ts`, prevents this for NEW
+    // writes; this heals any that already exist). Reads join through identities
+    // (`listLatestVersions` et al never surface the row), so the only sound
+    // repair is reconstructing a minimal identity from the version row itself:
+    // the nectar ULID encodes `createdAt`, and the version row carries its own
+    // tenancy + `lastUpdateDate`. Requires the OPTIONAL `store.listVersionNectars`
+    // (skipped, not guessed at, when the adapter omits it, mirroring how
+    // orphan-identity healing above skips when `listIdentities` is omitted).
+    let healedOrphanVersions = 0;
+    if (store.listVersionNectars !== undefined) {
+        for (const nectar of store.listVersionNectars(tenancy)) {
+            if (store.getIdentity(nectar) !== undefined)
+                continue; // already has an identity
+            const version = store.latestVersion(nectar);
+            if (version === undefined)
+                continue; // nothing to reconstruct from
+            store.insertIdentity({
+                nectar,
+                kind: "file",
+                createdAt: nectarCreatedAt(nectar),
+                derivedFromNectar: "",
+                forkContentHash: "",
+                orgId: version.orgId,
+                workspaceId: version.workspaceId,
+                projectId: version.projectId,
+                lastUpdateDate: version.lastUpdateDate,
+            });
+            healedOrphanVersions += 1;
+        }
+    }
+    const latest = store.listLatestVersions(tenancy);
+    let healedStaleLastUpdate = 0;
+    for (const lv of latest) {
+        const identityMs = Date.parse(lv.identity.lastUpdateDate);
+        const versionMs = Date.parse(lv.version.lastUpdateDate);
+        if (Number.isNaN(versionMs))
+            continue; // nothing trustworthy to catch up to
+        if (Number.isNaN(identityMs) || identityMs < versionMs) {
+            store.touchIdentity(lv.identity.nectar, lv.version.lastUpdateDate);
+            healedStaleLastUpdate += 1;
+        }
+    }
+    let healedDuplicatePaths = 0;
+    const byPath = new Map();
+    for (const lv of latest) {
+        const group = byPath.get(lv.version.path) ?? [];
+        group.push(lv);
+        byPath.set(lv.version.path, group);
+    }
+    for (const group of byPath.values()) {
+        if (group.length <= 1)
+            continue;
+        let survivor = group[0];
+        for (const lv of group) {
+            if (Date.parse(lv.version.observedAt) > Date.parse(survivor.version.observedAt))
+                survivor = lv;
+        }
+        for (const lv of group) {
+            if (lv.identity.nectar === survivor.identity.nectar)
+                continue;
+            store.deleteNectar(tenancy, lv.identity.nectar);
+            healedDuplicatePaths += 1;
+        }
+    }
+    return { healedOrphanIdentities, healedOrphanVersions, healedStaleLastUpdate, healedDuplicatePaths };
+}
+//# sourceMappingURL=ladder.js.map

package/dist/registration/ladder.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"ladder.js","sourceRoot":"","sources":["../../src/registration/ladder.ts"],"names":[],"mappings":"AAsBA,OAAO,EAAE,SAAS,EAAE,MAAM,wBAAwB,CAAC;AAEnD,OAAO,EAAE,UAAU,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAC;AACpE,OAAO,EAAE,SAAS,EAAE,MAAM,uBAAuB,CAAC;AAClD,OAAO,EAAE,UAAU,EAAE,KAAK,EAAE,MAAM,wBAAwB,CAAC;AAC3D,OAAO,EAAE,eAAe,EAAE,MAAM,kBAAkB,CAAC;AACnD,yGAAyG;AACzG,OAAO,EAAE,kBAAkB,EAAE,MAAM,WAAW,CAAC;AA4E/C,mRAAmR;AACnR,MAAM,UAAU,uBAAuB;IACrC,MAAM,GAAG,GAAG,IAAI,GAAG,EAAwD,CAAC;IAC5E,OAAO;QACL,GAAG,EAAE,CAAC,OAAO,EAAE,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC;QAClC,GAAG,EAAE,CAAC,OAAO,EAAE,IAAI,EAAE,EAAE;YACrB,GAAG,CAAC,GAAG,CAAC,OAAO,EAAE,EAAE,aAAa,EAAE,IAAI,CAAC,aAAa,EAAE,SAAS,EAAE,IAAI,CAAC,SAAS,EAAE,CAAC,CAAC;QACrF,CAAC;QACD,MAAM,EAAE,CAAC,OAAO,EAAE,EAAE;YAClB,GAAG,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;QACtB,CAAC;KACF,CAAC;AACJ,CAAC;AAgDD,oGAAoG;AACpG,MAAM,UAAU,WAAW,CAAC,IAAkB,EAAE,IAAgB;IAC9D,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,GAAG,IAAI,CAAC;IAChC,MAAM,MAAM,GAAG,KAAK,CAAC,mBAAmB,CAAC,OAAO,EAAE,IAAI,CAAC,OAAO,CAAC,CAAC;IAEhE,sEAAsE;IACtE,sEAAsE;IACtE,wEAAwE;IACxE,uEAAuE;IACvE,MAAM,UAAU,GAAG,IAAI,CAAC,SAAS,EAAE,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IACrD,MAAM,cAAc,GAAG,UAAU,EAAE,aAAa,IAAI,MAAM,EAAE,OAAO,CAAC,aAAa,CAAC;IAClF,MAAM,aAAa,GAAG,UAAU,EAAE,SAAS,IAAI,MAAM,EAAE,OAAO,CAAC,SAAS,CAAC;IACzE,IAAI,MAAM,KAAK,SAAS,IAAI,cAAc,KAAK,IAAI,CAAC,aAAa,IAAI,aAAa,KAAK,IAAI,CAAC,SAAS,EAAE,CAAC;QACtG,OAAO,EAAE,IAAI,EAAE,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,QAAQ,CAAC,MAAM,EAAE,CAAC;IACrE,CAAC;IAED,kFAAkF;IAClF,MAAM,OAAO,GAAG,IAAI,CAAC,WAAW,EAAE,CAAC;IACnC,MAAM,IAAI,GAAG,SAAS,CAAC,OAAO,CAAC,CAAC;IAChC,MAAM,WAAW,GAAG,kBAAkB,CAAC,OAAO,CAAC,CAAC;IAEhD,0CAA0C;IAC1C,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;QACzB,IAAI,MAAM,CAAC,OAAO,CAAC,WAAW,KAAK,IAAI,EAAE,CAAC;YACxC,uEAAuE;YACvE,wEAAwE;YACxE,mEAAmE;YACnE,IAAI,CAAC,SAAS,EAAE,GAAG,CAAC,IAAI,CAAC,OAAO,EAAE,EAAE,aAAa,EAAE,IAAI,CAAC,aAAa,EAAE,SAAS,EAAE,IAAI,CAAC,SAAS,EAAE,CAAC,CAAC;YACpG,OAAO,EAAE,IAAI,EAAE,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,QAAQ,CAAC,MAAM,EAAE,CAAC;QACrE,CAAC;QACD,yEAAyE;QACzE,wEAAwE;QACxE,IAAI,CAAC,SAAS,EAAE,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QACrC,iBAAiB,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,WAAW,CAAC,CAAC;QACzD,IAAI,CAAC,cAAc,EAAE,CAAC,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;QAC9C,OAAO,EAAE,IAAI,EAAE,CAAC,EAAE,MAAM,EAAE,gBAAgB,EAAE,MAAM,EAAE,MAAM,CAAC,QAAQ,CAAC,MAAM,EAAE,CAAC;IAC/E,CAAC;IAED,6EAA6E;IAC7E,MAAM,MAAM,GAAG,KAAK,CAAC,mBAAmB,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;IACxD,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;QACzB,MAAM,UAAU,GAAG,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC;QACvC,qEAAqE;QACrE,uEAAuE;QACvE,gEAAgE;QAChE,uEAAuE;QACvE,qEAAqE;QACrE,sEAAsE;QACtE,iEAAiE;QACjE,0DAA0D;QAC1D,MAAM,cAAc,GAClB,IAAI,CAAC,eAAe,KAAK,IAAI;YAC7B,UAAU,KAAK,IAAI,CAAC,OAAO;YAC3B,UAAU,CAAC,WAAW,EAAE,KAAK,IAAI,CAAC,OAAO,CAAC,WAAW,EAAE,CAAC;QAC1D,IAAI,UAAU,KAAK,IAAI,CAAC,OAAO,IAAI,CAAC,cAAc,IAAI,CAAC,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,CAAC,EAAE,CAAC;YACtF,sEAAsE;YACtE,uEAAuE;YACvE,qEAAqE;YACrE,qEAAqE;YACrE,6DAA6D;YAC7D,IAAI,eAAe,CAAC,KAAK,EAAE,OAAO,EAAE,IAAI,CAAC,GAAG,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,WAAW,CAAC,EAAE,CAAC;gBACvF,IAAI,CAAC,SAAS,EAAE,MAAM,CAAC,UAAU,CAAC,CAAC;gBACnC,OAAO,EAAE,IAAI,EAAE,CAAC,EAAE,MAAM,EAAE,cAAc,EAAE,MAAM,EAAE,MAAM,CAAC,QAAQ,CAAC,MAAM,EAAE,CAAC;YAC7E,CAAC;QACH,CAAC;QACD,iEAAiE;QACjE,OAAO,UAAU,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,WAAW,CAAC,CAAC;IACnD,CAAC;IAED,iFAAiF;IACjF,4EAA4E;IAC5E,yDAAyD;IACzD,IAAI,MAAM,GAA2E,IAAI,CAAC;IAC1F,IAAI,IAAI,CAAC,KAAK,KAAK,SAAS,EAAE,CAAC;QAC7B,MAAM,UAAU,GAAqB,iBAAiB,CAAC,IAAI,EAAE,IAAI,CAAC,OAAO,CAAC,CAAC,GAAG,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC;YACtF,GAAG,EAAE;YACL,WAAW,EAAE,EAAE,CAAC,OAAO,CAAC,WAAW,IAAI,IAAI;SAC5C,CAAC,CAAC,CAAC;QACJ,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,OAAO,EAAE,UAAU,CAAC,CAAC;QACtD,QAAQ,OAAO,CAAC,IAAI,EAAE,CAAC;YACrB,KAAK,OAAO,CAAC,CAAC,CAAC;gBACb,MAAM,OAAO,GAAG,KAAK,CAAC,aAAa,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;gBACpD,MAAM,QAAQ,GAAG,KAAK,CAAC,WAAW,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;gBACnD,IACE,OAAO,KAAK,SAAS;oBACrB,QAAQ,KAAK,SAAS;oBACtB,eAAe,CACb,KAAK,EACL,OAAO,EACP,IAAI,CAAC,GAAG,EAAE,EACV,EAAE,QAAQ,EAAE,OAAO,EAAE,OAAO,EAAE,EAC9B,IAAI,EACJ,IAAI,EACJ,OAAO,CAAC,UAAU,EAClB,WAAW,CACZ,EACD,CAAC;oBACD,0FAA0F;oBAC1F,IAAI,CAAC,cAAc,EAAE,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;oBACtC,OAAO,EAAE,IAAI,EAAE,CAAC,EAAE,MAAM,EAAE,cAAc,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,CAAC;gBACrE,CAAC;gBACD,MAAM;YACR,CAAC;YACD,KAAK,QAAQ,CAAC,CAAC,CAAC;gBACd,MAAM,GAAG,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,UAAU,EAAE,OAAO,CAAC,UAAU,EAAE,QAAQ,EAAE,OAAO,CAAC,QAAQ,IAAI,IAAI,EAAE,CAAC;gBACxG,MAAM;YACR,CAAC;YACD,KAAK,MAAM;gBACT,MAAM;YACR,OAAO,CAAC,CAAC,CAAC;gBACR,MAAM,WAAW,GAAU,OAAO,CAAC;gBACnC,OAAO,WAAW,CAAC;YACrB,CAAC;QACH,CAAC;IACH,CAAC;IAED,2EAA2E;IAC3E,6EAA6E;IAC7E,8EAA8E;IAC9E,MAAM,MAAM,GAAG,UAAU,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,WAAW,CAAC,CAAC;IACzD,IAAI,MAAM,KAAK,IAAI,EAAE,CAAC;QACpB,IAAI,CAAC,cAAc,EAAE,CAAC;YACpB,MAAM,EAAE,MAAM,CAAC,MAAM;YACrB,OAAO,EAAE,IAAI,CAAC,OAAO;YACrB,UAAU,EAAE,MAAM,CAAC,UAAU;YAC7B,QAAQ,EAAE,MAAM,CAAC,QAAQ;YACzB,WAAW,EAAE,IAAI;YACjB,SAAS,EAAE,IAAI,CAAC,SAAS;YACzB,aAAa,EAAE,IAAI,CAAC,aAAa;YACjC,YAAY,EAAE,MAAM,CAAC,MAAM;SAC5B,CAAC,CAAC;IACL,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED;;;;;;;;;GASG;AACH,SAAS,iBAAiB,CAAC,IAAgB,EAAE,QAAgB;IAC3D,MAAM,OAAO,GAAG,IAAI,CAAC,YAAY,CAAC;IAClC,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;QAC1B,OAAO,IAAI,CAAC,KAAK;aACd,kBAAkB,CAAC,IAAI,CAAC,OAAO,CAAC;aAChC,MAAM,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,CAAC,OAAO,CAAC,IAAI,KAAK,QAAQ,IAAI,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC;IAClF,CAAC;IACD,OAAO,IAAI,CAAC,KAAK;SACd,kBAAkB,CAAC,IAAI,CAAC,OAAO,CAAC;SAChC,MAAM,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,CAAC,OAAO,CAAC,IAAI,KAAK,QAAQ,IAAI,CAAC,IAAI,CAAC,YAAY,CAAC,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC;AACzF,CAAC;AAED,SAAS,WAAW,CAClB,OAAgB,EAChB,GAAW,EACX,IAAmE,EACnE,IAAY,EACZ,GAAW,EACX,WAA0B;IAE1B,OAAO;QACL,MAAM,EAAE,EAAE;QACV,WAAW,EAAE,IAAI;QACjB,GAAG;QACH,IAAI,EAAE,IAAI,CAAC,OAAO;QAClB,QAAQ,EAAE,UAAU,CAAC,IAAI,CAAC,OAAO,CAAC;QAClC,GAAG,EAAE,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC;QACxB,SAAS,EAAE,IAAI,CAAC,SAAS;QACzB,aAAa,EAAE,IAAI,CAAC,aAAa;QACjC,KAAK,EAAE,EAAE;QACT,WAAW,EAAE,EAAE;QACf,QAAQ,EAAE,IAAI;QACd,SAAS,EAAE,IAAI;QACf,UAAU,EAAE,IAAI;QAChB,WAAW;QACX,WAAW,EAAE,EAAE;QACf,aAAa,EAAE,EAAE;QACjB,cAAc,EAAE,SAAS;QACzB,UAAU,EAAE,GAAG;QACf,KAAK,EAAE,OAAO,CAAC,KAAK;QACpB,WAAW,EAAE,OAAO,CAAC,WAAW;QAChC,SAAS,EAAE,OAAO,CAAC,SAAS;QAC5B,cAAc,EAAE,GAAG;KACpB,CAAC;AACJ,CAAC;AAED,6GAA6G;AAC7G,SAAS,iBAAiB,CACxB,IAAgB,EAChB,IAAmB,EACnB,IAAkB,EAClB,IAAY,EACZ,WAAmB;IAEnB,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;IACrD,MAAM,GAAG,GAAG,WAAW,CAAC,IAAI,CAAC,OAAO,EAAE,IAAI,CAAC,GAAG,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,GAAG,EAAE,WAAW,CAAC,CAAC;IAChF,GAAG,CAAC,MAAM,GAAG,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC;IAClC,IAAI,CAAC,KAAK,CAAC,aAAa,CAAC,GAAG,CAAC,CAAC;IAC9B,IAAI,CAAC,KAAK,CAAC,aAAa,CAAC,IAAI,CAAC,QAAQ,CAAC,MAAM,EAAE,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC;AAC7D,CAAC;AAED;;;;;;;;;;GAUG;AACH,SAAS,eAAe,CACtB,KAAqB,EACrB,OAAgB,EAChB,GAAW,EACX,MAAqB,EACrB,IAAmE,EACnE,IAAY,EACZ,UAAyB,EACzB,WAA0B;IAE1B,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,QAAQ,EAAE,OAAO,CAAC;QAAE,OAAO,KAAK,CAAC,CAAC,+BAA+B;IACvF,MAAM,GAAG,GAAG,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;IAClD,MAAM,GAAG,GAAG,WAAW,CAAC,OAAO,EAAE,GAAG,EAAE,IAAI,EAAE,IAAI,EAAE,GAAG,EAAE,WAAW,CAAC,CAAC;IACpE,GAAG,CAAC,MAAM,GAAG,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC;IACpC,GAAG,CAAC,KAAK,GAAG,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC;IACjC,GAAG,CAAC,WAAW,GAAG,MAAM,CAAC,OAAO,CAAC,WAAW,CAAC;IAC7C,GAAG,CAAC,QAAQ,GAAG,MAAM,CAAC,OAAO,CAAC,QAAQ,CAAC;IACvC,GAAG,CAAC,SAAS,GAAG,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC;IACzC,GAAG,CAAC,WAAW,GAAG,MAAM,CAAC,OAAO,CAAC,WAAW,CAAC;IAC7C,GAAG,CAAC,aAAa,GAAG,MAAM,CAAC,OAAO,CAAC,aAAa,CAAC;IACjD,GAAG,CAAC,cAAc,GAAG,MAAM,CAAC,OAAO,CAAC,cAAc,CAAC;IACnD,GAAG,CAAC,UAAU,GAAG,UAAU,CAAC;IAC5B,KAAK,CAAC,aAAa,CAAC,GAAG,CAAC,CAAC;IACzB,KAAK,CAAC,aAAa,CAAC,MAAM,CAAC,QAAQ,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;IACjD,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,WAAW,CACzB,KAAqB,EACrB,OAAgB,EAChB,GAAW,EACX,YAAoB,EACpB,MAA0F,EAC1F,UAAyB;IAEzB,MAAM,OAAO,GAAG,KAAK,CAAC,aAAa,CAAC,YAAY,CAAC,CAAC;IAClD,MAAM,QAAQ,GAAG,KAAK,CAAC,WAAW,CAAC,YAAY,CAAC,CAAC;IACjD,IAAI,OAAO,KAAK,SAAS,IAAI,QAAQ,KAAK,SAAS;QAAE,OAAO,KAAK,CAAC;IAClE,0FAA0F;IAC1F,OAAO,eAAe,CACpB,KAAK,EACL,OAAO,EACP,GAAG,EACH,EAAE,QAAQ,EAAE,OAAO,EAAE,EACrB,EAAE,OAAO,EAAE,MAAM,CAAC,OAAO,EAAE,SAAS,EAAE,MAAM,CAAC,SAAS,EAAE,aAAa,EAAE,MAAM,CAAC,aAAa,EAAE,EAC7F,MAAM,CAAC,WAAW,EAClB,UAAU,EACV,IAAI,CACL,CAAC;AACJ,CAAC;AAED,uGAAuG;AACvG,SAAS,UAAU,CAAC,IAAgB,EAAE,IAAkB,EAAE,IAAY,EAAE,WAAmB;IACzF,MAAM,QAAQ,GAAG,eAAe,CAAC,IAAI,CAAC,KAAK,EAAE,IAAI,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;IACjE,MAAM,MAAM,GAAG,UAAU,EAAE,CAAC;IAC5B,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IAEvB,MAAM,QAAQ,GAAiB;QAC7B,MAAM;QACN,IAAI,EAAE,MAAM;QACZ,SAAS,EAAE,eAAe,CAAC,MAAM,CAAC;QAClC,iBAAiB,EAAE,QAAQ,CAAC,MAAM,KAAK,MAAM,CAAC,CAAC,CAAC,QAAQ,CAAC,YAAY,CAAC,CAAC,CAAC,EAAE;QAC1E,eAAe,EAAE,QAAQ,CAAC,MAAM,KAAK,MAAM,CAAC,CAAC,CAAC,QAAQ,CAAC,eAAe,CAAC,CAAC,CAAC,EAAE;QAC3E,KAAK,EAAE,IAAI,CAAC,OAAO,CAAC,KAAK;QACzB,WAAW,EAAE,IAAI,CAAC,OAAO,CAAC,WAAW;QACrC,SAAS,EAAE,IAAI,CAAC,OAAO,CAAC,SAAS;QACjC,cAAc,EAAE,GAAG;KACpB,CAAC;IACF,IAAI,CAAC,KAAK,CAAC,cAAc,CAAC,QAAQ,CAAC,CAAC;IAEpC,MAAM,GAAG,GAAG,WAAW,CAAC,IAAI,CAAC,OAAO,EAAE,GAAG,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,EAAE,WAAW,CAAC,CAAC;IACvE,GAAG,CAAC,MAAM,GAAG,MAAM,CAAC;IACpB,IAAI,CAAC,KAAK,CAAC,aAAa,CAAC,GAAG,CAAC,CAAC;IAC9B,IAAI,CAAC,cAAc,EAAE,CAAC,MAAM,CAAC,CAAC;IAE9B,OAAO,EAAE,IAAI,EAAE,CAAC,EAAE,MAAM,EAAE,QAAQ,CAAC,MAAM,KAAK,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,MAAM,EAAE,CAAC;AACnF,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiCG;AACH,MAAM,UAAU,iBAAiB,CAAC,KAAqB,EAAE,OAAgB;IACvE,IAAI,sBAAsB,GAAG,CAAC,CAAC;IAC/B,IAAI,KAAK,CAAC,cAAc,KAAK,SAAS,EAAE,CAAC;QACvC,KAAK,MAAM,QAAQ,IAAI,KAAK,CAAC,cAAc,CAAC,OAAO,CAAC,EAAE,CAAC;YACrD,IAAI,KAAK,CAAC,aAAa,CAAC,QAAQ,CAAC,MAAM,CAAC,KAAK,SAAS,EAAE,CAAC;gBACvD,KAAK,CAAC,YAAY,CAAC,OAAO,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAC;gBAC7C,sBAAsB,IAAI,CAAC,CAAC;YAC9B,CAAC;QACH,CAAC;IACH,CAAC;IAED,6EAA6E;IAC7E,uEAAuE;IACvE,0EAA0E;IAC1E,2EAA2E;IAC3E,4EAA4E;IAC5E,4EAA4E;IAC5E,wEAAwE;IACxE,2EAA2E;IAC3E,2EAA2E;IAC3E,+EAA+E;IAC/E,qEAAqE;IACrE,yEAAyE;IACzE,IAAI,oBAAoB,GAAG,CAAC,CAAC;IAC7B,IAAI,KAAK,CAAC,kBAAkB,KAAK,SAAS,EAAE,CAAC;QAC3C,KAAK,MAAM,MAAM,IAAI,KAAK,CAAC,kBAAkB,CAAC,OAAO,CAAC,EAAE,CAAC;YACvD,IAAI,KAAK,CAAC,WAAW,CAAC,MAAM,CAAC,KAAK,SAAS;gBAAE,SAAS,CAAC,0BAA0B;YACjF,MAAM,OAAO,GAAG,KAAK,CAAC,aAAa,CAAC,MAAM,CAAC,CAAC;YAC5C,IAAI,OAAO,KAAK,SAAS;gBAAE,SAAS,CAAC,8BAA8B;YACnE,KAAK,CAAC,cAAc,CAAC;gBACnB,MAAM;gBACN,IAAI,EAAE,MAAM;gBACZ,SAAS,EAAE,eAAe,CAAC,MAAM,CAAC;gBAClC,iBAAiB,EAAE,EAAE;gBACrB,eAAe,EAAE,EAAE;gBACnB,KAAK,EAAE,OAAO,CAAC,KAAK;gBACpB,WAAW,EAAE,OAAO,CAAC,WAAW;gBAChC,SAAS,EAAE,OAAO,CAAC,SAAS;gBAC5B,cAAc,EAAE,OAAO,CAAC,cAAc;aACvC,CAAC,CAAC;YACH,oBAAoB,IAAI,CAAC,CAAC;QAC5B,CAAC;IACH,CAAC;IAED,MAAM,MAAM,GAAG,KAAK,CAAC,kBAAkB,CAAC,OAAO,CAAC,CAAC;IAEjD,IAAI,qBAAqB,GAAG,CAAC,CAAC;IAC9B,KAAK,MAAM,EAAE,IAAI,MAAM,EAAE,CAAC;QACxB,MAAM,UAAU,GAAG,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,QAAQ,CAAC,cAAc,CAAC,CAAC;QAC1D,MAAM,SAAS,GAAG,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,OAAO,CAAC,cAAc,CAAC,CAAC;QACxD,IAAI,MAAM,CAAC,KAAK,CAAC,SAAS,CAAC;YAAE,SAAS,CAAC,qCAAqC;QAC5E,IAAI,MAAM,CAAC,KAAK,CAAC,UAAU,CAAC,IAAI,UAAU,GAAG,SAAS,EAAE,CAAC;YACvD,KAAK,CAAC,aAAa,CAAC,EAAE,CAAC,QAAQ,CAAC,MAAM,EAAE,EAAE,CAAC,OAAO,CAAC,cAAc,CAAC,CAAC;YACnE,qBAAqB,IAAI,CAAC,CAAC;QAC7B,CAAC;IACH,CAAC;IAED,IAAI,oBAAoB,GAAG,CAAC,CAAC;IAC7B,MAAM,MAAM,GAAG,IAAI,GAAG,EAA2B,CAAC;IAClD,KAAK,MAAM,EAAE,IAAI,MAAM,EAAE,CAAC;QACxB,MAAM,KAAK,GAAG,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC;QAChD,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QACf,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,OAAO,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;IACrC,CAAC;IACD,KAAK,MAAM,KAAK,IAAI,MAAM,CAAC,MAAM,EAAE,EAAE,CAAC;QACpC,IAAI,KAAK,CAAC,MAAM,IAAI,CAAC;YAAE,SAAS;QAChC,IAAI,QAAQ,GAAG,KAAK,CAAC,CAAC,CAAkB,CAAC;QACzC,KAAK,MAAM,EAAE,IAAI,KAAK,EAAE,CAAC;YACvB,IAAI,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,OAAO,CAAC,UAAU,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,OAAO,CAAC,UAAU,CAAC;gBAAE,QAAQ,GAAG,EAAE,CAAC;QACjG,CAAC;QACD,KAAK,MAAM,EAAE,IAAI,KAAK,EAAE,CAAC;YACvB,IAAI,EAAE,CAAC,QAAQ,CAAC,MAAM,KAAK,QAAQ,CAAC,QAAQ,CAAC,MAAM;gBAAE,SAAS;YAC9D,KAAK,CAAC,YAAY,CAAC,OAAO,EAAE,EAAE,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;YAChD,oBAAoB,IAAI,CAAC,CAAC;QAC5B,CAAC;IACH,CAAC;IAED,OAAO,EAAE,sBAAsB,EAAE,oBAAoB,EAAE,qBAAqB,EAAE,oBAAoB,EAAE,CAAC;AACvG,CAAC"}

package/dist/registration/paths-safe.d.ts

@@ -0,0 +1,21 @@
+/**
+ * True when `relPath` is a safe workspace-relative path: non-empty, not absolute
+ * (POSIX `/...`, Windows `C:\...`, or a UNC/backslash root), and with no `..`
+ * segment. This is a lexical check only; it does not touch the disk.
+ */
+export declare function isSafeRelPath(relPath: string): boolean;
+/**
+ * Resolve `relPath` under `root` and return the absolute path ONLY if it stays
+ * within `root` (inclusive of `root` itself); otherwise null. Lexical: it does
+ * not resolve symlinks. Returns null for any path {@link isSafeRelPath} rejects.
+ */
+export declare function containedPath(root: string, relPath: string): string | null;
+/**
+ * The symlink clamp for real disk reads: resolve symlinks on both the candidate
+ * and the root, and return the real candidate path ONLY if it stays under the
+ * real root; otherwise null. Returns null when the candidate does not exist (a
+ * broken symlink or missing file), when it is lexically unsafe, or when the real
+ * path escapes the root. Use this before reading content from a real filesystem.
+ */
+export declare function realpathContained(root: string, relPath: string): string | null;
+//# sourceMappingURL=paths-safe.d.ts.map

package/dist/registration/paths-safe.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"paths-safe.d.ts","sourceRoot":"","sources":["../../src/registration/paths-safe.ts"],"names":[],"mappings":"AAwBA;;;;GAIG;AACH,wBAAgB,aAAa,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAUtD;AAED;;;;GAIG;AACH,wBAAgB,aAAa,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAM1E;AAED;;;;;;GAMG;AACH,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAiB9E"}

package/dist/registration/paths-safe.js

@@ -0,0 +1,88 @@
+/**
+ * Workspace path containment for the file-registration surface (CWE-22).
+ *
+ * `fs.watch` and any injected filesystem seam can hand the pipeline a path that
+ * escapes the workspace: an absolute path (Node `path.join(root, abs)` discards
+ * `root`), a `..` traversal (`join(root, "../../etc/passwd")` resolves outside
+ * `root`), or a symlink inside the root that points out of it. This module is
+ * the single, dependency-free (Node built-ins only) guard the intake, the
+ * persistence path, and the CLI all use so no such path is ever stat-ed, read,
+ * persisted, or allowed to trigger a cycle.
+ *
+ * Two levels:
+ *   - {@link isSafeRelPath} / {@link containedPath}: purely lexical (no disk
+ *     access). Reject absolute paths and `..` segments, resolve, and require the
+ *     result to stay under the resolved root. Used everywhere a path is handled.
+ *   - {@link realpathContained}: the symlink clamp. Resolves symlinks on both the
+ *     candidate and the root via `realpathSync` and requires the REAL candidate
+ *     to stay under the REAL root. Used only where content is actually read from
+ *     a real disk (a symlink inside the root pointing outside is a lexical pass
+ *     but a real-path escape).
+ */
+import { isAbsolute, resolve, sep } from "node:path";
+import { realpathSync } from "node:fs";
+/**
+ * True when `relPath` is a safe workspace-relative path: non-empty, not absolute
+ * (POSIX `/...`, Windows `C:\...`, or a UNC/backslash root), and with no `..`
+ * segment. This is a lexical check only; it does not touch the disk.
+ */
+export function isSafeRelPath(relPath) {
+    if (relPath === "")
+        return false;
+    const norm = relPath.replace(/\\/g, "/");
+    if (norm.startsWith("/"))
+        return false; // POSIX absolute (or a leading-slash escape)
+    if (/^[a-zA-Z]:/.test(norm))
+        return false; // Windows drive prefix (C:/... or C:\...)
+    if (isAbsolute(relPath))
+        return false; // catches remaining platform-absolute forms
+    for (const segment of norm.split("/")) {
+        if (segment === "..")
+            return false;
+    }
+    return true;
+}
+/**
+ * Resolve `relPath` under `root` and return the absolute path ONLY if it stays
+ * within `root` (inclusive of `root` itself); otherwise null. Lexical: it does
+ * not resolve symlinks. Returns null for any path {@link isSafeRelPath} rejects.
+ */
+export function containedPath(root, relPath) {
+    if (!isSafeRelPath(relPath))
+        return null;
+    const rootResolved = resolve(root);
+    const candidate = resolve(rootResolved, relPath);
+    if (candidate !== rootResolved && !candidate.startsWith(rootResolved + sep))
+        return null;
+    return candidate;
+}
+/**
+ * The symlink clamp for real disk reads: resolve symlinks on both the candidate
+ * and the root, and return the real candidate path ONLY if it stays under the
+ * real root; otherwise null. Returns null when the candidate does not exist (a
+ * broken symlink or missing file), when it is lexically unsafe, or when the real
+ * path escapes the root. Use this before reading content from a real filesystem.
+ */
+export function realpathContained(root, relPath) {
+    const candidate = containedPath(root, relPath);
+    if (candidate === null)
+        return null;
+    let realRoot;
+    try {
+        realRoot = realpathSync(resolve(root));
+    }
+    catch {
+        return null;
+    }
+    let realCandidate;
+    try {
+        realCandidate = realpathSync(candidate);
+    }
+    catch {
+        return null; // does not exist, or a broken symlink
+    }
+    if (realCandidate !== realRoot && !realCandidate.startsWith(realRoot + sep))
+        return null;
+    return realCandidate;
+}
+//# sourceMappingURL=paths-safe.js.map

package/dist/registration/paths-safe.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"paths-safe.js","sourceRoot":"","sources":["../../src/registration/paths-safe.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,OAAO,EAAE,UAAU,EAAE,OAAO,EAAE,GAAG,EAAE,MAAM,WAAW,CAAC;AACrD,OAAO,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AAEvC;;;;GAIG;AACH,MAAM,UAAU,aAAa,CAAC,OAAe;IAC3C,IAAI,OAAO,KAAK,EAAE;QAAE,OAAO,KAAK,CAAC;IACjC,MAAM,IAAI,GAAG,OAAO,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;IACzC,IAAI,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC;QAAE,OAAO,KAAK,CAAC,CAAC,6CAA6C;IACrF,IAAI,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC;QAAE,OAAO,KAAK,CAAC,CAAC,0CAA0C;IACrF,IAAI,UAAU,CAAC,OAAO,CAAC;QAAE,OAAO,KAAK,CAAC,CAAC,4CAA4C;IACnF,KAAK,MAAM,OAAO,IAAI,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC;QACtC,IAAI,OAAO,KAAK,IAAI;YAAE,OAAO,KAAK,CAAC;IACrC,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,aAAa,CAAC,IAAY,EAAE,OAAe;IACzD,IAAI,CAAC,aAAa,CAAC,OAAO,CAAC;QAAE,OAAO,IAAI,CAAC;IACzC,MAAM,YAAY,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACnC,MAAM,SAAS,GAAG,OAAO,CAAC,YAAY,EAAE,OAAO,CAAC,CAAC;IACjD,IAAI,SAAS,KAAK,YAAY,IAAI,CAAC,SAAS,CAAC,UAAU,CAAC,YAAY,GAAG,GAAG,CAAC;QAAE,OAAO,IAAI,CAAC;IACzF,OAAO,SAAS,CAAC;AACnB,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,iBAAiB,CAAC,IAAY,EAAE,OAAe;IAC7D,MAAM,SAAS,GAAG,aAAa,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;IAC/C,IAAI,SAAS,KAAK,IAAI;QAAE,OAAO,IAAI,CAAC;IACpC,IAAI,QAAgB,CAAC;IACrB,IAAI,CAAC;QACH,QAAQ,GAAG,YAAY,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC;IACzC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;IACD,IAAI,aAAqB,CAAC;IAC1B,IAAI,CAAC;QACH,aAAa,GAAG,YAAY,CAAC,SAAS,CAAC,CAAC;IAC1C,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC,CAAC,sCAAsC;IACrD,CAAC;IACD,IAAI,aAAa,KAAK,QAAQ,IAAI,CAAC,aAAa,CAAC,UAAU,CAAC,QAAQ,GAAG,GAAG,CAAC;QAAE,OAAO,IAAI,CAAC;IACzF,OAAO,aAAa,CAAC;AACvB,CAAC"}

package/dist/registration/prune-cli.d.ts

@@ -0,0 +1,48 @@
+/**
+ * `nectar prune [--confirm]` command logic (PRD-006d AC-19).
+ *
+ * The SOLE nectar-deletion path. The re-association ladder never deletes or
+ * reuses a nectar; deletion is a separate, explicit, human-triggered operation:
+ *   - bare `prune`         -> a preview/list of prune candidates (no deletion);
+ *   - `prune --confirm`    -> the destructive act (delete each candidate).
+ *
+ * A prune candidate is a nectar whose latest-version path is absent from disk and
+ * whose last observed change is older than the grace period. The grace period
+ * exists because a "missing" file may be on another checked-out branch or return
+ * after a merge, so pruning is conservative.
+ *
+ * DEFAULT (flagged, not load-bearing on any algorithm): the grace period is 30
+ * days ({@link PRUNE_GRACE_MS}), configurable via `graceMs`.
+ */
+import type { HiveGraphStore } from "../hive-graph/store.js";
+import type { Tenancy } from "../hive-graph/model.js";
+/** Prune grace period: 30 days - DEFAULT - confirm before implementation. Configurable via `graceMs`. */
+export declare const PRUNE_GRACE_MS: number;
+export interface PruneDeps {
+    readonly store: HiveGraphStore;
+    readonly tenancy: Tenancy;
+    /** Whether a repo-relative path currently exists on disk. */
+    existsOnDisk(relPath: string): boolean;
+    /** ISO 8601 "now"; injectable for deterministic tests. */
+    now(): string;
+    /** Grace window in ms; defaults to {@link PRUNE_GRACE_MS}. */
+    readonly graceMs?: number;
+    /** true = delete (the destructive act); false/undefined = preview only. */
+    readonly confirm?: boolean;
+    out(line: string): void;
+}
+export interface PruneCandidate {
+    readonly nectar: string;
+    readonly path: string;
+    readonly lastUpdateDate: string;
+    readonly ageMs: number;
+}
+export interface PruneResult {
+    readonly candidates: readonly PruneCandidate[];
+    readonly deleted: number;
+    readonly confirmed: boolean;
+}
+/** Compute the prune candidates: latest path absent from disk AND older than the grace window. */
+export declare function findPruneCandidates(deps: PruneDeps): PruneCandidate[];
+export declare function runPrune(deps: PruneDeps): PruneResult;
+//# sourceMappingURL=prune-cli.d.ts.map

package/dist/registration/prune-cli.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"prune-cli.d.ts","sourceRoot":"","sources":["../../src/registration/prune-cli.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AACH,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,wBAAwB,CAAC;AAC7D,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,wBAAwB,CAAC;AAGtD,yGAAyG;AACzG,eAAO,MAAM,cAAc,QAA2B,CAAC;AAEvD,MAAM,WAAW,SAAS;IACxB,QAAQ,CAAC,KAAK,EAAE,cAAc,CAAC;IAC/B,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC;IAC1B,6DAA6D;IAC7D,YAAY,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC;IACvC,0DAA0D;IAC1D,GAAG,IAAI,MAAM,CAAC;IACd,8DAA8D;IAC9D,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC;IAC1B,2EAA2E;IAC3E,QAAQ,CAAC,OAAO,CAAC,EAAE,OAAO,CAAC;IAC3B,GAAG,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;CACzB;AAED,MAAM,WAAW,cAAc;IAC7B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAC;IAChC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;CACxB;AAED,MAAM,WAAW,WAAW;IAC1B,QAAQ,CAAC,UAAU,EAAE,SAAS,cAAc,EAAE,CAAC;IAC/C,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,SAAS,EAAE,OAAO,CAAC;CAC7B;AAED,kGAAkG;AAClG,wBAAgB,mBAAmB,CAAC,IAAI,EAAE,SAAS,GAAG,cAAc,EAAE,CAcrE;AAED,wBAAgB,QAAQ,CAAC,IAAI,EAAE,SAAS,GAAG,WAAW,CAoCrD"}

package/dist/registration/prune-cli.js

@@ -0,0 +1,57 @@
+import { inTenancy } from "../hive-graph/model.js";
+/** Prune grace period: 30 days - DEFAULT - confirm before implementation. Configurable via `graceMs`. */
+export const PRUNE_GRACE_MS = 30 * 24 * 60 * 60 * 1000;
+/** Compute the prune candidates: latest path absent from disk AND older than the grace window. */
+export function findPruneCandidates(deps) {
+    const graceMs = deps.graceMs ?? PRUNE_GRACE_MS;
+    const nowMs = Date.parse(deps.now());
+    const out = [];
+    for (const lv of deps.store.listLatestVersions(deps.tenancy)) {
+        if (deps.existsOnDisk(lv.version.path))
+            continue;
+        const lastMs = Date.parse(lv.identity.lastUpdateDate);
+        const ageMs = Number.isNaN(lastMs) ? Number.POSITIVE_INFINITY : nowMs - lastMs;
+        if (ageMs > graceMs) {
+            out.push({ nectar: lv.identity.nectar, path: lv.version.path, lastUpdateDate: lv.identity.lastUpdateDate, ageMs });
+        }
+    }
+    out.sort((a, b) => (a.path < b.path ? -1 : a.path > b.path ? 1 : 0));
+    return out;
+}
+export function runPrune(deps) {
+    const candidates = findPruneCandidates(deps);
+    const confirmed = deps.confirm === true;
+    if (candidates.length === 0) {
+        deps.out("Nothing to prune: no nectar is missing beyond the grace period.");
+        return { candidates, deleted: 0, confirmed };
+    }
+    if (!confirmed) {
+        deps.out(`${candidates.length} nectar(s) missing beyond the grace period (preview only):`);
+        for (const c of candidates) {
+            const days = Math.floor(c.ageMs / (24 * 60 * 60 * 1000));
+            deps.out(`  ${c.nectar}  ${c.path}  (missing/last-updated ${c.lastUpdateDate}, ~${days}d)`);
+        }
+        deps.out("Run 'nectar prune --confirm' to delete these nectars. This is the only deletion path.");
+        return { candidates, deleted: 0, confirmed: false };
+    }
+    let deleted = 0;
+    for (const c of candidates) {
+        // Re-check ELIGIBILITY immediately before each destructive delete: the file
+        // may have reappeared (path returned to disk) between candidate computation
+        // and now, in which case it is no longer a prune candidate and must be kept.
+        if (deps.existsOnDisk(c.path))
+            continue;
+        // Defense in depth: re-verify the identity is in scope, even though candidates
+        // already come from a scoped listLatestVersions. The delete itself is
+        // tenancy-scoped too (AC-20).
+        const identity = deps.store.getIdentity(c.nectar);
+        if (identity === undefined || !inTenancy(identity, deps.tenancy))
+            continue;
+        deps.store.deleteNectar(deps.tenancy, c.nectar);
+        deps.out(`pruned ${c.nectar} (${c.path})`);
+        deleted += 1;
+    }
+    deps.out(`Pruned ${deleted} nectar(s).`);
+    return { candidates, deleted, confirmed: true };
+}
+//# sourceMappingURL=prune-cli.js.map

package/dist/registration/prune-cli.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"prune-cli.js","sourceRoot":"","sources":["../../src/registration/prune-cli.ts"],"names":[],"mappings":"AAkBA,OAAO,EAAE,SAAS,EAAE,MAAM,wBAAwB,CAAC;AAEnD,yGAAyG;AACzG,MAAM,CAAC,MAAM,cAAc,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;AA6BvD,kGAAkG;AAClG,MAAM,UAAU,mBAAmB,CAAC,IAAe;IACjD,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,IAAI,cAAc,CAAC;IAC/C,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC;IACrC,MAAM,GAAG,GAAqB,EAAE,CAAC;IACjC,KAAK,MAAM,EAAE,IAAI,IAAI,CAAC,KAAK,CAAC,kBAAkB,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;QAC7D,IAAI,IAAI,CAAC,YAAY,CAAC,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC;YAAE,SAAS;QACjD,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,QAAQ,CAAC,cAAc,CAAC,CAAC;QACtD,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,iBAAiB,CAAC,CAAC,CAAC,KAAK,GAAG,MAAM,CAAC;QAC/E,IAAI,KAAK,GAAG,OAAO,EAAE,CAAC;YACpB,GAAG,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,EAAE,CAAC,QAAQ,CAAC,MAAM,EAAE,IAAI,EAAE,EAAE,CAAC,OAAO,CAAC,IAAI,EAAE,cAAc,EAAE,EAAE,CAAC,QAAQ,CAAC,cAAc,EAAE,KAAK,EAAE,CAAC,CAAC;QACrH,CAAC;IACH,CAAC;IACD,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IACrE,OAAO,GAAG,CAAC;AACb,CAAC;AAED,MAAM,UAAU,QAAQ,CAAC,IAAe;IACtC,MAAM,UAAU,GAAG,mBAAmB,CAAC,IAAI,CAAC,CAAC;IAC7C,MAAM,SAAS,GAAG,IAAI,CAAC,OAAO,KAAK,IAAI,CAAC;IAExC,IAAI,UAAU,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC5B,IAAI,CAAC,GAAG,CAAC,iEAAiE,CAAC,CAAC;QAC5E,OAAO,EAAE,UAAU,EAAE,OAAO,EAAE,CAAC,EAAE,SAAS,EAAE,CAAC;IAC/C,CAAC;IAED,IAAI,CAAC,SAAS,EAAE,CAAC;QACf,IAAI,CAAC,GAAG,CAAC,GAAG,UAAU,CAAC,MAAM,4DAA4D,CAAC,CAAC;QAC3F,KAAK,MAAM,CAAC,IAAI,UAAU,EAAE,CAAC;YAC3B,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,GAAG,CAAC,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC,CAAC;YACzD,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,MAAM,KAAK,CAAC,CAAC,IAAI,2BAA2B,CAAC,CAAC,cAAc,MAAM,IAAI,IAAI,CAAC,CAAC;QAC9F,CAAC;QACD,IAAI,CAAC,GAAG,CAAC,uFAAuF,CAAC,CAAC;QAClG,OAAO,EAAE,UAAU,EAAE,OAAO,EAAE,CAAC,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC;IACtD,CAAC;IAED,IAAI,OAAO,GAAG,CAAC,CAAC;IAChB,KAAK,MAAM,CAAC,IAAI,UAAU,EAAE,CAAC;QAC3B,4EAA4E;QAC5E,4EAA4E;QAC5E,6EAA6E;QAC7E,IAAI,IAAI,CAAC,YAAY,CAAC,CAAC,CAAC,IAAI,CAAC;YAAE,SAAS;QACxC,+EAA+E;QAC/E,sEAAsE;QACtE,8BAA8B;QAC9B,MAAM,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC;QAClD,IAAI,QAAQ,KAAK,SAAS,IAAI,CAAC,SAAS,CAAC,QAAQ,EAAE,IAAI,CAAC,OAAO,CAAC;YAAE,SAAS;QAC3E,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC;QAChD,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC,MAAM,KAAK,CAAC,CAAC,IAAI,GAAG,CAAC,CAAC;QAC3C,OAAO,IAAI,CAAC,CAAC;IACf,CAAC;IACD,IAAI,CAAC,GAAG,CAAC,UAAU,OAAO,aAAa,CAAC,CAAC;IACzC,OAAO,EAAE,UAAU,EAAE,OAAO,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC;AAClD,CAAC"}