@lzehrung/codegraph 2.3.21 → 2.3.22

package/dist/util/bloom-filter.js

@@ -0,0 +1,206 @@
+/**
+ * Simple bloom filter implementation for fast reference pre-filtering
+ *
+ * Used to quickly determine if a file MIGHT contain references to a symbol,
+ * allowing us to skip files that definitely don't contain the symbol.
+ */
+import { BLOOM_FILTER_IDENTIFIER_SOURCE } from "./identifiers.js";
+import { fileIdentityKey } from "./paths.js";
+import crypto from "node:crypto";
+/**
+ * Calculate optimal bloom filter parameters for a target false positive rate.
+ * @param expectedItems - Expected number of items to be added
+ * @param falsePositiveRate - Target false positive rate (default: 0.01 = 1%)
+ * @returns Optimal size in bits and hash count
+ */
+export function calculateOptimalBloomParams(expectedItems, falsePositiveRate = 0.01) {
+    // Ensure reasonable bounds
+    const n = Math.max(1, expectedItems);
+    const p = Math.max(0.0001, Math.min(0.5, falsePositiveRate));
+    // Optimal size: m = -n * ln(p) / (ln(2)^2)
+    const ln2 = Math.LN2;
+    const ln2Squared = ln2 * ln2;
+    const optimalSize = Math.ceil((-n * Math.log(p)) / ln2Squared);
+    // Optimal hash count: k = (m/n) * ln(2)
+    const optimalHashCount = Math.max(1, Math.round((optimalSize / n) * ln2));
+    // Clamp to reasonable bounds
+    const size = Math.max(1000, Math.min(1000000, optimalSize)); // 1KB to 125KB
+    const hashCount = Math.max(1, Math.min(10, optimalHashCount));
+    return { size, hashCount };
+}
+export class BloomFilter {
+    bits;
+    size;
+    hashCount;
+    itemCount = 0;
+    /**
+     * Create a bloom filter
+     * @param size - Number of bits in the filter (default: 10000)
+     * @param hashCount - Number of hash functions to use (default: 3)
+     */
+    constructor(size = 10000, hashCount = 3) {
+        this.size = size;
+        this.hashCount = hashCount;
+        this.bits = new Uint8Array(Math.ceil(size / 8));
+    }
+    /**
+     * Create an optimally-sized bloom filter for the expected number of items.
+     * @param expectedItems - Expected number of items to be added
+     * @param falsePositiveRate - Target false positive rate (default: 0.01 = 1%)
+     */
+    static createOptimal(expectedItems, falsePositiveRate = 0.01) {
+        const { size, hashCount } = calculateOptimalBloomParams(expectedItems, falsePositiveRate);
+        return new BloomFilter(size, hashCount);
+    }
+    /**
+     * Add an item to the bloom filter
+     */
+    add(item) {
+        // Set all bits first, only increment count if all operations succeed
+        for (const hash of this.getHashes(item)) {
+            const byteIndex = Math.floor(hash / 8);
+            const bitIndex = hash % 8;
+            if (byteIndex < 0 || byteIndex >= this.bits.length)
+                return;
+            const currentByte = this.bits[byteIndex];
+            if (currentByte !== undefined) {
+                this.bits[byteIndex] = currentByte | (1 << bitIndex);
+            }
+        }
+        // Only increment after successful addition
+        this.itemCount++;
+    }
+    /**
+     * Get the number of items added to the filter
+     */
+    getItemCount() {
+        return this.itemCount;
+    }
+    /**
+     * Get the current estimated false positive rate based on items added
+     */
+    getCurrentFalsePositiveRate() {
+        return this.getFalsePositiveRate(this.itemCount);
+    }
+    /**
+     * Check if an item might be in the set
+     * Returns false if definitely not present, true if might be present
+     */
+    mightContain(item) {
+        for (const hash of this.getHashes(item)) {
+            const byteIndex = Math.floor(hash / 8);
+            const bitIndex = hash % 8;
+            if (byteIndex < 0 || byteIndex >= this.bits.length)
+                return false;
+            const currentByte = this.bits[byteIndex];
+            if (currentByte === undefined || (currentByte & (1 << bitIndex)) === 0) {
+                return false;
+            }
+        }
+        return true;
+    }
+    /**
+     * Generate multiple hash values for an item
+     */
+    *getHashes(item) {
+        // Use a single hash and derive multiple values from it
+        const hash = crypto.createHash("sha256").update(item).digest();
+        for (let i = 0; i < this.hashCount; i++) {
+            // Take different 4-byte segments of the hash
+            const offset = (i * 4) % (hash.length - 4);
+            const value = hash.readUInt32LE(offset);
+            yield value % this.size;
+        }
+    }
+    /**
+     * Get the approximate false positive rate
+     */
+    getFalsePositiveRate(itemCount) {
+        // Formula: (1 - e^(-k*n/m))^k
+        // where k = hashCount, n = itemCount, m = size
+        const exp = Math.exp((-this.hashCount * itemCount) / this.size);
+        return Math.pow(1 - exp, this.hashCount);
+    }
+    /**
+     * Serialize to buffer for caching
+     */
+    toBuffer() {
+        return Buffer.from(this.bits);
+    }
+    /**
+     * Deserialize from buffer
+     */
+    static fromBuffer(buffer, size, hashCount, itemCount = 0) {
+        const filter = new BloomFilter(size, hashCount);
+        filter.bits = new Uint8Array(buffer);
+        filter.itemCount = itemCount;
+        return filter;
+    }
+    /**
+     * Get metadata for serialization
+     */
+    getMetadata() {
+        return { size: this.size, hashCount: this.hashCount };
+    }
+}
+/**
+ * Build a bloom filter from source code with auto-sizing.
+ * Extracts all identifiers and adds them to an optimally-sized filter.
+ * @param source - The source code to analyze
+ * @param support - The language support for the source file
+ * @param falsePositiveRate - Target false positive rate (default: 0.01 = 1%)
+ */
+export function buildBloomFilterFromSource(source, support, falsePositiveRate = 0.01) {
+    const identifierPattern = new RegExp(BLOOM_FILTER_IDENTIFIER_SOURCE, "gu");
+    const matches = source.match(identifierPattern);
+    const unique = new Set();
+    for (const identifier of matches ?? []) {
+        unique.add(support.normalizeIdentifier(identifier));
+    }
+    const filter = BloomFilter.createOptimal(unique.size || 100, falsePositiveRate);
+    for (const identifier of unique) {
+        filter.add(identifier);
+    }
+    return filter;
+}
+/**
+ * Cache of bloom filters per file
+ */
+export class BloomFilterCache {
+    filters = new Map();
+    set(file, filter) {
+        this.filters.set(fileIdentityKey(file), filter);
+    }
+    get(file) {
+        return this.filters.get(fileIdentityKey(file));
+    }
+    has(file) {
+        return this.filters.has(fileIdentityKey(file));
+    }
+    /**
+     * Check if a symbol might be in any of the provided files
+     * Returns only files that might contain the symbol
+     */
+    filterFiles(symbol, files) {
+        const candidates = [];
+        for (const file of files) {
+            const filter = this.filters.get(fileIdentityKey(file));
+            if (!filter) {
+                // If no filter exists, assume it might contain the symbol
+                candidates.push(file);
+            }
+            else if (filter.mightContain(symbol)) {
+                candidates.push(file);
+            }
+            // If filter exists and definitely doesn't contain symbol, skip
+        }
+        return candidates;
+    }
+    clear() {
+        this.filters.clear();
+    }
+    size() {
+        return this.filters.size;
+    }
+}
+//# sourceMappingURL=bloom-filter.js.map

package/dist/util/bloom-filter.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"bloom-filter.js","sourceRoot":"","sources":["../../src/util/bloom-filter.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EAAE,8BAA8B,EAAE,MAAM,kBAAkB,CAAC;AAElE,OAAO,EAAE,eAAe,EAAE,MAAM,YAAY,CAAC;AAC7C,OAAO,MAAM,MAAM,aAAa,CAAC;AAEjC;;;;;GAKG;AACH,MAAM,UAAU,2BAA2B,CACzC,aAAqB,EACrB,iBAAiB,GAAG,IAAI;IAExB,2BAA2B;IAC3B,MAAM,CAAC,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,aAAa,CAAC,CAAC;IACrC,MAAM,CAAC,GAAG,IAAI,CAAC,GAAG,CAAC,MAAM,EAAE,IAAI,CAAC,GAAG,CAAC,GAAG,EAAE,iBAAiB,CAAC,CAAC,CAAC;IAE7D,2CAA2C;IAC3C,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,CAAC;IACrB,MAAM,UAAU,GAAG,GAAG,GAAG,GAAG,CAAC;IAC7B,MAAM,WAAW,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,UAAU,CAAC,CAAC;IAE/D,wCAAwC;IACxC,MAAM,gBAAgB,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC,WAAW,GAAG,CAAC,CAAC,GAAG,GAAG,CAAC,CAAC,CAAC;IAE1E,6BAA6B;IAC7B,MAAM,IAAI,GAAG,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE,IAAI,CAAC,GAAG,CAAC,OAAO,EAAE,WAAW,CAAC,CAAC,CAAC,CAAC,eAAe;IAC5E,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,gBAAgB,CAAC,CAAC,CAAC;IAE9D,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC;AAC7B,CAAC;AAED,MAAM,OAAO,WAAW;IACd,IAAI,CAAa;IACjB,IAAI,CAAS;IACb,SAAS,CAAS;IAClB,SAAS,GAAW,CAAC,CAAC;IAE9B;;;;OAIG;IACH,YAAY,IAAI,GAAG,KAAK,EAAE,SAAS,GAAG,CAAC;QACrC,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC;QACjB,IAAI,CAAC,SAAS,GAAG,SAAS,CAAC;QAC3B,IAAI,CAAC,IAAI,GAAG,IAAI,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,GAAG,CAAC,CAAC,CAAC,CAAC;IAClD,CAAC;IAED;;;;OAIG;IACH,MAAM,CAAC,aAAa,CAAC,aAAqB,EAAE,iBAAiB,GAAG,IAAI;QAClE,MAAM,EAAE,IAAI,EAAE,SAAS,EAAE,GAAG,2BAA2B,CAAC,aAAa,EAAE,iBAAiB,CAAC,CAAC;QAC1F,OAAO,IAAI,WAAW,CAAC,IAAI,EAAE,SAAS,CAAC,CAAC;IAC1C,CAAC;IAED;;OAEG;IACH,GAAG,CAAC,IAAY;QACd,qEAAqE;QACrE,KAAK,MAAM,IAAI,IAAI,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,EAAE,CAAC;YACxC,MAAM,SAAS,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,GAAG,CAAC,CAAC,CAAC;YACvC,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,CAAC;YAC1B,IAAI,SAAS,GAAG,CAAC,IAAI,SAAS,IAAI,IAAI,CAAC,IAAI,CAAC,MAAM;gBAAE,OAAO;YAC3D,MAAM,WAAW,GAAG,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;YACzC,IAAI,WAAW,KAAK,SAAS,EAAE,CAAC;gBAC9B,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,GAAG,WAAW,GAAG,CAAC,CAAC,IAAI,QAAQ,CAAC,CAAC;YACvD,CAAC;QACH,CAAC;QACD,2CAA2C;QAC3C,IAAI,CAAC,SAAS,EAAE,CAAC;IACnB,CAAC;IAED;;OAEG;IACH,YAAY;QACV,OAAO,IAAI,CAAC,SAAS,CAAC;IACxB,CAAC;IAED;;OAEG;IACH,2BAA2B;QACzB,OAAO,IAAI,CAAC,oBAAoB,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;IACnD,CAAC;IAED;;;OAGG;IACH,YAAY,CAAC,IAAY;QACvB,KAAK,MAAM,IAAI,IAAI,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,EAAE,CAAC;YACxC,MAAM,SAAS,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,GAAG,CAAC,CAAC,CAAC;YACvC,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,CAAC;YAC1B,IAAI,SAAS,GAAG,CAAC,IAAI,SAAS,IAAI,IAAI,CAAC,IAAI,CAAC,MAAM;gBAAE,OAAO,KAAK,CAAC;YACjE,MAAM,WAAW,GAAG,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;YACzC,IAAI,WAAW,KAAK,SAAS,IAAI,CAAC,WAAW,GAAG,CAAC,CAAC,IAAI,QAAQ,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC;gBACvE,OAAO,KAAK,CAAC;YACf,CAAC;QACH,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IAED;;OAEG;IACK,CAAC,SAAS,CAAC,IAAY;QAC7B,uDAAuD;QACvD,MAAM,IAAI,GAAG,MAAM,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,CAAC;QAE/D,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,IAAI,CAAC,SAAS,EAAE,CAAC,EAAE,EAAE,CAAC;YACxC,6CAA6C;YAC7C,MAAM,MAAM,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;YAC3C,MAAM,KAAK,GAAG,IAAI,CAAC,YAAY,CAAC,MAAM,CAAC,CAAC;YACxC,MAAM,KAAK,GAAG,IAAI,CAAC,IAAI,CAAC;QAC1B,CAAC;IACH,CAAC;IAED;;OAEG;IACH,oBAAoB,CAAC,SAAiB;QACpC,8BAA8B;QAC9B,+CAA+C;QAC/C,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,GAAG,SAAS,CAAC,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC;QAChE,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC,GAAG,GAAG,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC;IAC3C,CAAC;IAED;;OAEG;IACH,QAAQ;QACN,OAAO,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAChC,CAAC;IAED;;OAEG;IACH,MAAM,CAAC,UAAU,CAAC,MAAc,EAAE,IAAY,EAAE,SAAiB,EAAE,SAAS,GAAG,CAAC;QAC9E,MAAM,MAAM,GAAG,IAAI,WAAW,CAAC,IAAI,EAAE,SAAS,CAAC,CAAC;QAChD,MAAM,CAAC,IAAI,GAAG,IAAI,UAAU,CAAC,MAAM,CAAC,CAAC;QACrC,MAAM,CAAC,SAAS,GAAG,SAAS,CAAC;QAC7B,OAAO,MAAM,CAAC;IAChB,CAAC;IAED;;OAEG;IACH,WAAW;QACT,OAAO,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,SAAS,EAAE,IAAI,CAAC,SAAS,EAAE,CAAC;IACxD,CAAC;CACF;AAED;;;;;;GAMG;AACH,MAAM,UAAU,0BAA0B,CACxC,MAAc,EACd,OAAqD,EACrD,iBAAiB,GAAG,IAAI;IAExB,MAAM,iBAAiB,GAAG,IAAI,MAAM,CAAC,8BAA8B,EAAE,IAAI,CAAC,CAAC;IAC3E,MAAM,OAAO,GAAG,MAAM,CAAC,KAAK,CAAC,iBAAiB,CAAC,CAAC;IAEhD,MAAM,MAAM,GAAG,IAAI,GAAG,EAAU,CAAC;IACjC,KAAK,MAAM,UAAU,IAAI,OAAO,IAAI,EAAE,EAAE,CAAC;QACvC,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,mBAAmB,CAAC,UAAU,CAAC,CAAC,CAAC;IACtD,CAAC;IAED,MAAM,MAAM,GAAG,WAAW,CAAC,aAAa,CAAC,MAAM,CAAC,IAAI,IAAI,GAAG,EAAE,iBAAiB,CAAC,CAAC;IAChF,KAAK,MAAM,UAAU,IAAI,MAAM,EAAE,CAAC;QAChC,MAAM,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;IACzB,CAAC;IAED,OAAO,MAAM,CAAC;AAChB,CAAC;AAED;;GAEG;AACH,MAAM,OAAO,gBAAgB;IACnB,OAAO,GAAG,IAAI,GAAG,EAAuB,CAAC;IAEjD,GAAG,CAAC,IAAY,EAAE,MAAmB;QACnC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC,CAAC;IAClD,CAAC;IAED,GAAG,CAAC,IAAY;QACd,OAAO,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC,IAAI,CAAC,CAAC,CAAC;IACjD,CAAC;IAED,GAAG,CAAC,IAAY;QACd,OAAO,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC,IAAI,CAAC,CAAC,CAAC;IACjD,CAAC;IAED;;;OAGG;IACH,WAAW,CAAC,MAAc,EAAE,KAAe;QACzC,MAAM,UAAU,GAAa,EAAE,CAAC;QAEhC,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;YACzB,MAAM,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC,IAAI,CAAC,CAAC,CAAC;YACvD,IAAI,CAAC,MAAM,EAAE,CAAC;gBACZ,0DAA0D;gBAC1D,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YACxB,CAAC;iBAAM,IAAI,MAAM,CAAC,YAAY,CAAC,MAAM,CAAC,EAAE,CAAC;gBACvC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YACxB,CAAC;YACD,+DAA+D;QACjE,CAAC;QAED,OAAO,UAAU,CAAC;IACpB,CAAC;IAED,KAAK;QACH,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,CAAC;IACvB,CAAC;IAED,IAAI;QACF,OAAO,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC;IAC3B,CAAC;CACF"}

package/dist/util/confined-file.d.ts

@@ -0,0 +1,48 @@
+import { type BigIntStats } from "node:fs";
+import { type FileHandle } from "node:fs/promises";
+export type ConfinedReadableFile = {
+    handle: FileHandle;
+    realPath: string;
+    displayPath: string;
+    size: number;
+};
+type ConfinedFileTestHook = (realPath: string) => void | Promise<void>;
+type PreparedReadableFile = {
+    displayPath: string;
+    expectedStats: readonly BigIntStats[];
+    realPath: string;
+};
+/**
+ * Test-only seam after the trusted file identity is captured and before the descriptor opens.
+ * Production code must leave this unset.
+ */
+export declare function setAfterConfinedPathVerifiedForTests(hook: ConfinedFileTestHook | undefined): void;
+export declare function resolveReadableFile(realRoot: string, root: string, filePath: string): Promise<PreparedReadableFile>;
+/**
+ * Resolve a project path, open it, and verify the opened descriptor before any read.
+ *
+ * Flow: capture the lexical file identity (following any alias) -> realpath confinement -> capture
+ * the resolved regular file identity -> optional test hook -> open the realpath'd target -> `fstat`
+ * on that descriptor -> compare it to every pre-open identity -> callers read only through the
+ * returned handle (never re-resolve the path string).
+ *
+ * POSIX: open uses `O_RDONLY | O_NOFOLLOW` so a leaf symlink swap fails the open with ELOOP.
+ * win32: Node's `fs.open` has no portable `O_NOFOLLOW` (`fs.constants.O_NOFOLLOW` is absent).
+ * Guarantee there is post-open identity: `fstat.ino` must match every pre-open identity. `dev` is
+ * compared when both sides expose it. When win32 `lstat.dev` is zero while `fstat.dev` has the
+ * volume serial, the creation time must also match, so a cross-volume junction swap cannot pass
+ * on a colliding inode alone.
+ *
+ * In-root symlinks still work: confinement realpaths them first, then the open targets the
+ * resolved regular file inside the root, not the symlink leaf.
+ *
+ * A pre-existing in-root hard link remains indistinguishable from one whose other directory entry
+ * is outside the root. Pathname confinement proves the opened descriptor, not hard-link provenance.
+ */
+export declare function openConfinedReadableFile(realRoot: string, root: string, filePath: string): Promise<ConfinedReadableFile>;
+export declare function readConfinedUtf8File(realRoot: string, root: string, filePath: string): Promise<string>;
+export declare function resolveProjectFile(realRoot: string, root: string, filePath: string): Promise<string>;
+export declare function assertRealPathCandidateWithinRoot(realRoot: string, filePath: string, label: string): Promise<string>;
+export declare function findNearestExistingPath(filePath: string): Promise<string>;
+export {};
+//# sourceMappingURL=confined-file.d.ts.map

package/dist/util/confined-file.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"confined-file.d.ts","sourceRoot":"","sources":["../../src/util/confined-file.ts"],"names":[],"mappings":"AAAA,OAAO,EAA4B,KAAK,WAAW,EAAE,MAAM,SAAS,CAAC;AACrE,OAAW,EAAE,KAAK,UAAU,EAAE,MAAM,kBAAkB,CAAC;AAKvD,MAAM,MAAM,oBAAoB,GAAG;IACjC,MAAM,EAAE,UAAU,CAAC;IACnB,QAAQ,EAAE,MAAM,CAAC;IACjB,WAAW,EAAE,MAAM,CAAC;IACpB,IAAI,EAAE,MAAM,CAAC;CACd,CAAC;AAEF,KAAK,oBAAoB,GAAG,CAAC,QAAQ,EAAE,MAAM,KAAK,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;AACvE,KAAK,oBAAoB,GAAG;IAC1B,WAAW,EAAE,MAAM,CAAC;IACpB,aAAa,EAAE,SAAS,WAAW,EAAE,CAAC;IACtC,QAAQ,EAAE,MAAM,CAAC;CAClB,CAAC;AAIF;;;GAGG;AACH,wBAAgB,oCAAoC,CAAC,IAAI,EAAE,oBAAoB,GAAG,SAAS,GAAG,IAAI,CAEjG;AAED,wBAAsB,mBAAmB,CACvC,QAAQ,EAAE,MAAM,EAChB,IAAI,EAAE,MAAM,EACZ,QAAQ,EAAE,MAAM,GACf,OAAO,CAAC,oBAAoB,CAAC,CAW/B;AAED;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,wBAAsB,wBAAwB,CAC5C,QAAQ,EAAE,MAAM,EAChB,IAAI,EAAE,MAAM,EACZ,QAAQ,EAAE,MAAM,GACf,OAAO,CAAC,oBAAoB,CAAC,CAO/B;AACD,wBAAsB,oBAAoB,CAAC,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAO5G;AAED,wBAAsB,kBAAkB,CAAC,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAS1G;AAOD,wBAAsB,iCAAiC,CACrD,QAAQ,EAAE,MAAM,EAChB,QAAQ,EAAE,MAAM,EAChB,KAAK,EAAE,MAAM,GACZ,OAAO,CAAC,MAAM,CAAC,CAiBjB;AAED,wBAAsB,uBAAuB,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAY/E"}

package/dist/util/confined-file.js

@@ -0,0 +1,164 @@
+import { constants as fsConstants } from "node:fs";
+import fs, {} from "node:fs/promises";
+import path from "node:path";
+import { isFilePathWithinRoot, normalizePath, toProjectRelativePath } from "./paths.js";
+let afterConfinedPathVerifiedForTests;
+/**
+ * Test-only seam after the trusted file identity is captured and before the descriptor opens.
+ * Production code must leave this unset.
+ */
+export function setAfterConfinedPathVerifiedForTests(hook) {
+    afterConfinedPathVerifiedForTests = hook;
+}
+export async function resolveReadableFile(realRoot, root, filePath) {
+    const candidatePath = path.isAbsolute(filePath) ? path.resolve(filePath) : path.resolve(root, filePath);
+    assertCandidatePathWithinRoot(realRoot, root, candidatePath, "File");
+    const candidateStat = await fs.stat(candidatePath, { bigint: true });
+    assertRegularFileStat(candidateStat, candidatePath);
+    const realPath = await assertRealPathCandidateWithinRoot(realRoot, candidatePath, "File");
+    const expectedStat = await fs.lstat(realPath, { bigint: true });
+    assertRegularFileStat(expectedStat, realPath);
+    const displayPath = toProjectRelativePath(root, candidatePath) ?? toProjectRelativePath(realRoot, realPath) ?? normalizePath(realPath);
+    return { realPath, displayPath, expectedStats: [candidateStat, expectedStat] };
+}
+/**
+ * Resolve a project path, open it, and verify the opened descriptor before any read.
+ *
+ * Flow: capture the lexical file identity (following any alias) -> realpath confinement -> capture
+ * the resolved regular file identity -> optional test hook -> open the realpath'd target -> `fstat`
+ * on that descriptor -> compare it to every pre-open identity -> callers read only through the
+ * returned handle (never re-resolve the path string).
+ *
+ * POSIX: open uses `O_RDONLY | O_NOFOLLOW` so a leaf symlink swap fails the open with ELOOP.
+ * win32: Node's `fs.open` has no portable `O_NOFOLLOW` (`fs.constants.O_NOFOLLOW` is absent).
+ * Guarantee there is post-open identity: `fstat.ino` must match every pre-open identity. `dev` is
+ * compared when both sides expose it. When win32 `lstat.dev` is zero while `fstat.dev` has the
+ * volume serial, the creation time must also match, so a cross-volume junction swap cannot pass
+ * on a colliding inode alone.
+ *
+ * In-root symlinks still work: confinement realpaths them first, then the open targets the
+ * resolved regular file inside the root, not the symlink leaf.
+ *
+ * A pre-existing in-root hard link remains indistinguishable from one whose other directory entry
+ * is outside the root. Pathname confinement proves the opened descriptor, not hard-link provenance.
+ */
+export async function openConfinedReadableFile(realRoot, root, filePath) {
+    const { realPath, displayPath, expectedStats } = await resolveReadableFile(realRoot, root, filePath);
+    if (afterConfinedPathVerifiedForTests) {
+        await afterConfinedPathVerifiedForTests(realPath);
+    }
+    const { handle, size } = await openVerifiedRegularFile(realPath, expectedStats);
+    return { handle, realPath, displayPath, size };
+}
+export async function readConfinedUtf8File(realRoot, root, filePath) {
+    const confined = await openConfinedReadableFile(realRoot, root, filePath);
+    try {
+        return await confined.handle.readFile({ encoding: "utf8" });
+    }
+    finally {
+        await confined.handle.close();
+    }
+}
+export async function resolveProjectFile(realRoot, root, filePath) {
+    const candidatePath = path.isAbsolute(filePath) ? path.resolve(filePath) : path.resolve(root, filePath);
+    assertCandidatePathWithinRoot(realRoot, root, candidatePath, "File");
+    const realPath = await assertRealPathCandidateWithinRoot(realRoot, candidatePath, "File");
+    const lexicalRelativePath = toProjectRelativePath(root, candidatePath);
+    if (lexicalRelativePath)
+        return normalizePath(path.resolve(root, lexicalRelativePath));
+    const realRelativePath = toProjectRelativePath(realRoot, realPath);
+    if (realRelativePath)
+        return normalizePath(path.resolve(root, realRelativePath));
+    throw new Error(`File is outside project root: ${normalizePath(realPath)} (root: ${normalizePath(realRoot)})`);
+}
+function assertCandidatePathWithinRoot(realRoot, root, candidatePath, label) {
+    if (isFilePathWithinRoot(root, candidatePath) || isFilePathWithinRoot(realRoot, candidatePath))
+        return;
+    throw new Error(`${label} is outside project root: ${normalizePath(candidatePath)} (root: ${normalizePath(root)})`);
+}
+export async function assertRealPathCandidateWithinRoot(realRoot, filePath, label) {
+    const existingPath = await findNearestExistingPath(filePath);
+    const realExistingPath = await fs.realpath(existingPath);
+    const relativeSuffix = path.relative(existingPath, filePath);
+    const realTargetPath = path.resolve(realExistingPath, relativeSuffix);
+    if (!isFilePathWithinRoot(realRoot, realTargetPath)) {
+        throw new Error(`${label} is outside project root: ${normalizePath(realTargetPath)} (root: ${normalizePath(realRoot)})`);
+    }
+    const finalRealPath = await fs.realpath(filePath);
+    if (!isFilePathWithinRoot(realRoot, finalRealPath)) {
+        throw new Error(`${label} is outside project root: ${normalizePath(finalRealPath)} (root: ${normalizePath(realRoot)})`);
+    }
+    return finalRealPath;
+}
+export async function findNearestExistingPath(filePath) {
+    let current = filePath;
+    while (current !== path.dirname(current)) {
+        try {
+            await fs.stat(current);
+            return current;
+        }
+        catch (error) {
+            if (!isMissingPathError(error))
+                throw error;
+            current = path.dirname(current);
+        }
+    }
+    return current;
+}
+async function openVerifiedRegularFile(realPath, expectedStats) {
+    // O_NONBLOCK guards against a verified regular file being swapped for a FIFO before this open:
+    // without it, opening a FIFO for O_RDONLY blocks until a writer connects, hanging the caller
+    // before the fstat() below can reject the non-regular target. POSIX ignores O_NONBLOCK on
+    // regular files, so normal reads through the returned handle are unaffected.
+    const openFlags = fsConstants.O_RDONLY | (fsConstants.O_NOFOLLOW ?? 0) | (fsConstants.O_NONBLOCK ?? 0);
+    let handle;
+    try {
+        handle = await fs.open(realPath, openFlags);
+    }
+    catch (error) {
+        throw rewriteNoFollowOpenError(error, realPath);
+    }
+    try {
+        const postStat = await handle.stat({ bigint: true });
+        assertRegularFileStat(postStat, realPath);
+        if (!expectedStats.every((expectedStat) => sameFileIdentity(expectedStat, postStat))) {
+            throw new Error(`File changed between verification and open: ${normalizePath(realPath)} (possible path confinement race)`);
+        }
+        return { handle, size: Number(postStat.size) };
+    }
+    catch (error) {
+        await handle.close().catch(() => undefined);
+        throw error;
+    }
+}
+function sameFileIdentity(preStat, postStat) {
+    if (preStat.ino !== postStat.ino)
+        return false;
+    // Birth time (nanosecond precision) must always match: an unlink+recreate on the same
+    // filesystem can reuse the same inode, and no descriptor is held open across the pre-open
+    // checks to pin identity, so ino/dev equality alone cannot prove it is the same file.
+    if (preStat.birthtimeNs !== postStat.birthtimeNs)
+        return false;
+    if (preStat.dev === 0n || postStat.dev === 0n)
+        return true;
+    return preStat.dev === postStat.dev;
+}
+function assertRegularFileStat(stat, filePath) {
+    if (stat.isFile())
+        return;
+    throw new Error(`Confined file target is not a file: ${normalizePath(filePath)}`);
+}
+function rewriteNoFollowOpenError(error, filePath) {
+    if (error instanceof Error &&
+        "code" in error &&
+        (error.code === "ELOOP" || error.code === "EMLINK" || error.code === "EINVAL")) {
+        return new Error(`File changed between verification and open: ${normalizePath(filePath)} (possible path confinement race)`);
+    }
+    if (error instanceof Error)
+        return error;
+    return new Error(String(error));
+}
+function isMissingPathError(error) {
+    return error instanceof Error && "code" in error && error.code === "ENOENT";
+}
+//# sourceMappingURL=confined-file.js.map

package/dist/util/confined-file.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"confined-file.js","sourceRoot":"","sources":["../../src/util/confined-file.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,IAAI,WAAW,EAAoB,MAAM,SAAS,CAAC;AACrE,OAAO,EAAE,EAAE,EAAmB,MAAM,kBAAkB,CAAC;AACvD,OAAO,IAAI,MAAM,WAAW,CAAC;AAE7B,OAAO,EAAE,oBAAoB,EAAE,aAAa,EAAE,qBAAqB,EAAE,MAAM,YAAY,CAAC;AAgBxF,IAAI,iCAAmE,CAAC;AAExE;;;GAGG;AACH,MAAM,UAAU,oCAAoC,CAAC,IAAsC;IACzF,iCAAiC,GAAG,IAAI,CAAC;AAC3C,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,mBAAmB,CACvC,QAAgB,EAChB,IAAY,EACZ,QAAgB;IAEhB,MAAM,aAAa,GAAG,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;IACxG,6BAA6B,CAAC,QAAQ,EAAE,IAAI,EAAE,aAAa,EAAE,MAAM,CAAC,CAAC;IACrE,MAAM,aAAa,GAAG,MAAM,EAAE,CAAC,IAAI,CAAC,aAAa,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC;IACrE,qBAAqB,CAAC,aAAa,EAAE,aAAa,CAAC,CAAC;IACpD,MAAM,QAAQ,GAAG,MAAM,iCAAiC,CAAC,QAAQ,EAAE,aAAa,EAAE,MAAM,CAAC,CAAC;IAC1F,MAAM,YAAY,GAAG,MAAM,EAAE,CAAC,KAAK,CAAC,QAAQ,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC;IAChE,qBAAqB,CAAC,YAAY,EAAE,QAAQ,CAAC,CAAC;IAC9C,MAAM,WAAW,GACf,qBAAqB,CAAC,IAAI,EAAE,aAAa,CAAC,IAAI,qBAAqB,CAAC,QAAQ,EAAE,QAAQ,CAAC,IAAI,aAAa,CAAC,QAAQ,CAAC,CAAC;IACrH,OAAO,EAAE,QAAQ,EAAE,WAAW,EAAE,aAAa,EAAE,CAAC,aAAa,EAAE,YAAY,CAAC,EAAE,CAAC;AACjF,CAAC;AAED;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,MAAM,CAAC,KAAK,UAAU,wBAAwB,CAC5C,QAAgB,EAChB,IAAY,EACZ,QAAgB;IAEhB,MAAM,EAAE,QAAQ,EAAE,WAAW,EAAE,aAAa,EAAE,GAAG,MAAM,mBAAmB,CAAC,QAAQ,EAAE,IAAI,EAAE,QAAQ,CAAC,CAAC;IACrG,IAAI,iCAAiC,EAAE,CAAC;QACtC,MAAM,iCAAiC,CAAC,QAAQ,CAAC,CAAC;IACpD,CAAC;IACD,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,uBAAuB,CAAC,QAAQ,EAAE,aAAa,CAAC,CAAC;IAChF,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,WAAW,EAAE,IAAI,EAAE,CAAC;AACjD,CAAC;AACD,MAAM,CAAC,KAAK,UAAU,oBAAoB,CAAC,QAAgB,EAAE,IAAY,EAAE,QAAgB;IACzF,MAAM,QAAQ,GAAG,MAAM,wBAAwB,CAAC,QAAQ,EAAE,IAAI,EAAE,QAAQ,CAAC,CAAC;IAC1E,IAAI,CAAC;QACH,OAAO,MAAM,QAAQ,CAAC,MAAM,CAAC,QAAQ,CAAC,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC,CAAC;IAC9D,CAAC;YAAS,CAAC;QACT,MAAM,QAAQ,CAAC,MAAM,CAAC,KAAK,EAAE,CAAC;IAChC,CAAC;AACH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,kBAAkB,CAAC,QAAgB,EAAE,IAAY,EAAE,QAAgB;IACvF,MAAM,aAAa,GAAG,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;IACxG,6BAA6B,CAAC,QAAQ,EAAE,IAAI,EAAE,aAAa,EAAE,MAAM,CAAC,CAAC;IACrE,MAAM,QAAQ,GAAG,MAAM,iCAAiC,CAAC,QAAQ,EAAE,aAAa,EAAE,MAAM,CAAC,CAAC;IAC1F,MAAM,mBAAmB,GAAG,qBAAqB,CAAC,IAAI,EAAE,aAAa,CAAC,CAAC;IACvE,IAAI,mBAAmB;QAAE,OAAO,aAAa,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,mBAAmB,CAAC,CAAC,CAAC;IACvF,MAAM,gBAAgB,GAAG,qBAAqB,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC;IACnE,IAAI,gBAAgB;QAAE,OAAO,aAAa,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,gBAAgB,CAAC,CAAC,CAAC;IACjF,MAAM,IAAI,KAAK,CAAC,iCAAiC,aAAa,CAAC,QAAQ,CAAC,WAAW,aAAa,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;AACjH,CAAC;AAED,SAAS,6BAA6B,CAAC,QAAgB,EAAE,IAAY,EAAE,aAAqB,EAAE,KAAa;IACzG,IAAI,oBAAoB,CAAC,IAAI,EAAE,aAAa,CAAC,IAAI,oBAAoB,CAAC,QAAQ,EAAE,aAAa,CAAC;QAAE,OAAO;IACvG,MAAM,IAAI,KAAK,CAAC,GAAG,KAAK,6BAA6B,aAAa,CAAC,aAAa,CAAC,WAAW,aAAa,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AACtH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,iCAAiC,CACrD,QAAgB,EAChB,QAAgB,EAChB,KAAa;IAEb,MAAM,YAAY,GAAG,MAAM,uBAAuB,CAAC,QAAQ,CAAC,CAAC;IAC7D,MAAM,gBAAgB,GAAG,MAAM,EAAE,CAAC,QAAQ,CAAC,YAAY,CAAC,CAAC;IACzD,MAAM,cAAc,GAAG,IAAI,CAAC,QAAQ,CAAC,YAAY,EAAE,QAAQ,CAAC,CAAC;IAC7D,MAAM,cAAc,GAAG,IAAI,CAAC,OAAO,CAAC,gBAAgB,EAAE,cAAc,CAAC,CAAC;IACtE,IAAI,CAAC,oBAAoB,CAAC,QAAQ,EAAE,cAAc,CAAC,EAAE,CAAC;QACpD,MAAM,IAAI,KAAK,CACb,GAAG,KAAK,6BAA6B,aAAa,CAAC,cAAc,CAAC,WAAW,aAAa,CAAC,QAAQ,CAAC,GAAG,CACxG,CAAC;IACJ,CAAC;IACD,MAAM,aAAa,GAAG,MAAM,EAAE,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;IAClD,IAAI,CAAC,oBAAoB,CAAC,QAAQ,EAAE,aAAa,CAAC,EAAE,CAAC;QACnD,MAAM,IAAI,KAAK,CACb,GAAG,KAAK,6BAA6B,aAAa,CAAC,aAAa,CAAC,WAAW,aAAa,CAAC,QAAQ,CAAC,GAAG,CACvG,CAAC;IACJ,CAAC;IACD,OAAO,aAAa,CAAC;AACvB,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,uBAAuB,CAAC,QAAgB;IAC5D,IAAI,OAAO,GAAG,QAAQ,CAAC;IACvB,OAAO,OAAO,KAAK,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;QACzC,IAAI,CAAC;YACH,MAAM,EAAE,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;YACvB,OAAO,OAAO,CAAC;QACjB,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,CAAC,kBAAkB,CAAC,KAAK,CAAC;gBAAE,MAAM,KAAK,CAAC;YAC5C,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;QAClC,CAAC;IACH,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,KAAK,UAAU,uBAAuB,CACpC,QAAgB,EAChB,aAAqC;IAErC,+FAA+F;IAC/F,6FAA6F;IAC7F,0FAA0F;IAC1F,6EAA6E;IAC7E,MAAM,SAAS,GAAG,WAAW,CAAC,QAAQ,GAAG,CAAC,WAAW,CAAC,UAAU,IAAI,CAAC,CAAC,GAAG,CAAC,WAAW,CAAC,UAAU,IAAI,CAAC,CAAC,CAAC;IACvG,IAAI,MAAkB,CAAC;IACvB,IAAI,CAAC;QACH,MAAM,GAAG,MAAM,EAAE,CAAC,IAAI,CAAC,QAAQ,EAAE,SAAS,CAAC,CAAC;IAC9C,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,wBAAwB,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAC;IAClD,CAAC;IAED,IAAI,CAAC;QACH,MAAM,QAAQ,GAAG,MAAM,MAAM,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC;QACrD,qBAAqB,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC;QAC1C,IAAI,CAAC,aAAa,CAAC,KAAK,CAAC,CAAC,YAAY,EAAE,EAAE,CAAC,gBAAgB,CAAC,YAAY,EAAE,QAAQ,CAAC,CAAC,EAAE,CAAC;YACrF,MAAM,IAAI,KAAK,CACb,+CAA+C,aAAa,CAAC,QAAQ,CAAC,mCAAmC,CAC1G,CAAC;QACJ,CAAC;QACD,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;IACjD,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,MAAM,CAAC,KAAK,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;QAC5C,MAAM,KAAK,CAAC;IACd,CAAC;AACH,CAAC;AAED,SAAS,gBAAgB,CAAC,OAAoB,EAAE,QAAqB;IACnE,IAAI,OAAO,CAAC,GAAG,KAAK,QAAQ,CAAC,GAAG;QAAE,OAAO,KAAK,CAAC;IAC/C,sFAAsF;IACtF,0FAA0F;IAC1F,sFAAsF;IACtF,IAAI,OAAO,CAAC,WAAW,KAAK,QAAQ,CAAC,WAAW;QAAE,OAAO,KAAK,CAAC;IAC/D,IAAI,OAAO,CAAC,GAAG,KAAK,EAAE,IAAI,QAAQ,CAAC,GAAG,KAAK,EAAE;QAAE,OAAO,IAAI,CAAC;IAC3D,OAAO,OAAO,CAAC,GAAG,KAAK,QAAQ,CAAC,GAAG,CAAC;AACtC,CAAC;AAED,SAAS,qBAAqB,CAAC,IAAiB,EAAE,QAAgB;IAChE,IAAI,IAAI,CAAC,MAAM,EAAE;QAAE,OAAO;IAC1B,MAAM,IAAI,KAAK,CAAC,uCAAuC,aAAa,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC;AACpF,CAAC;AAED,SAAS,wBAAwB,CAAC,KAAc,EAAE,QAAgB;IAChE,IACE,KAAK,YAAY,KAAK;QACtB,MAAM,IAAI,KAAK;QACf,CAAC,KAAK,CAAC,IAAI,KAAK,OAAO,IAAI,KAAK,CAAC,IAAI,KAAK,QAAQ,IAAI,KAAK,CAAC,IAAI,KAAK,QAAQ,CAAC,EAC9E,CAAC;QACD,OAAO,IAAI,KAAK,CACd,+CAA+C,aAAa,CAAC,QAAQ,CAAC,mCAAmC,CAC1G,CAAC;IACJ,CAAC;IACD,IAAI,KAAK,YAAY,KAAK;QAAE,OAAO,KAAK,CAAC;IACzC,OAAO,IAAI,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;AAClC,CAAC;AAED,SAAS,kBAAkB,CAAC,KAAc;IACxC,OAAO,KAAK,YAAY,KAAK,IAAI,MAAM,IAAI,KAAK,IAAI,KAAK,CAAC,IAAI,KAAK,QAAQ,CAAC;AAC9E,CAAC"}

package/dist/util/discovery-path.d.ts

@@ -0,0 +1,3 @@
+export declare function isRelativePathInside(relativePath: string): boolean;
+export declare function matchesDiscoveryGlob(absolutePath: string, projectRoot: string, matcher: (relativePath: string) => boolean): boolean;
+//# sourceMappingURL=discovery-path.d.ts.map

package/dist/util/discovery-path.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"discovery-path.d.ts","sourceRoot":"","sources":["../../src/util/discovery-path.ts"],"names":[],"mappings":"AAGA,wBAAgB,oBAAoB,CAAC,YAAY,EAAE,MAAM,GAAG,OAAO,CAUlE;AAED,wBAAgB,oBAAoB,CAClC,YAAY,EAAE,MAAM,EACpB,WAAW,EAAE,MAAM,EACnB,OAAO,EAAE,CAAC,YAAY,EAAE,MAAM,KAAK,OAAO,GACzC,OAAO,CAMT"}

package/dist/util/discovery-path.js

@@ -0,0 +1,19 @@
+import path from "node:path";
+import { normalizePath } from "./paths.js";
+export function isRelativePathInside(relativePath) {
+    const normalized = normalizePath(relativePath);
+    return (!!normalized &&
+        normalized !== ".." &&
+        !normalized.startsWith("../") &&
+        !path.isAbsolute(relativePath) &&
+        !path.win32.isAbsolute(relativePath) &&
+        !path.posix.isAbsolute(relativePath));
+}
+export function matchesDiscoveryGlob(absolutePath, projectRoot, matcher) {
+    const relativePath = path.relative(projectRoot, absolutePath);
+    if (!isRelativePathInside(relativePath)) {
+        return false;
+    }
+    return matcher(normalizePath(relativePath));
+}
+//# sourceMappingURL=discovery-path.js.map

package/dist/util/discovery-path.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"discovery-path.js","sourceRoot":"","sources":["../../src/util/discovery-path.ts"],"names":[],"mappings":"AAAA,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,aAAa,EAAE,MAAM,YAAY,CAAC;AAE3C,MAAM,UAAU,oBAAoB,CAAC,YAAoB;IACvD,MAAM,UAAU,GAAG,aAAa,CAAC,YAAY,CAAC,CAAC;IAC/C,OAAO,CACL,CAAC,CAAC,UAAU;QACZ,UAAU,KAAK,IAAI;QACnB,CAAC,UAAU,CAAC,UAAU,CAAC,KAAK,CAAC;QAC7B,CAAC,IAAI,CAAC,UAAU,CAAC,YAAY,CAAC;QAC9B,CAAC,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,YAAY,CAAC;QACpC,CAAC,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,YAAY,CAAC,CACrC,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,oBAAoB,CAClC,YAAoB,EACpB,WAAmB,EACnB,OAA0C;IAE1C,MAAM,YAAY,GAAG,IAAI,CAAC,QAAQ,CAAC,WAAW,EAAE,YAAY,CAAC,CAAC;IAC9D,IAAI,CAAC,oBAAoB,CAAC,YAAY,CAAC,EAAE,CAAC;QACxC,OAAO,KAAK,CAAC;IACf,CAAC;IACD,OAAO,OAAO,CAAC,aAAa,CAAC,YAAY,CAAC,CAAC,CAAC;AAC9C,CAAC"}

package/dist/util/graph-edges.d.ts

@@ -0,0 +1,5 @@
+import type { Edge } from "../types.js";
+export declare function edgeKey(edge: Edge): string;
+export declare function compareEdges(left: Edge, right: Edge): number;
+export declare function toRelativeEdge(projectRoot: string, edge: Edge): Edge;
+//# sourceMappingURL=graph-edges.d.ts.map

package/dist/util/graph-edges.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"graph-edges.d.ts","sourceRoot":"","sources":["../../src/util/graph-edges.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,aAAa,CAAC;AAGxC,wBAAgB,OAAO,CAAC,IAAI,EAAE,IAAI,GAAG,MAAM,CAI1C;AAED,wBAAgB,YAAY,CAAC,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,GAAG,MAAM,CAe5D;AAED,wBAAgB,cAAc,CAAC,WAAW,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,GAAG,IAAI,CAepE"}

package/dist/util/graph-edges.js

@@ -0,0 +1,42 @@
+import { toProjectDisplayPath } from "./paths.js";
+export function edgeKey(edge) {
+    const toKey = edge.to.type === "file" ? `file:${edge.to.path}` : `external:${edge.to.name}`;
+    const typeOnly = edge.typeOnly ? "1" : "0";
+    return `${edge.from}|${toKey}|${edge.raw}|${typeOnly}`;
+}
+export function compareEdges(left, right) {
+    const fromCompare = left.from.localeCompare(right.from);
+    if (fromCompare)
+        return fromCompare;
+    if (left.to.type !== right.to.type) {
+        return left.to.type === "file" ? -1 : 1;
+    }
+    const leftTo = left.to.type === "file" ? left.to.path : left.to.name;
+    const rightTo = right.to.type === "file" ? right.to.path : right.to.name;
+    const toCompare = leftTo.localeCompare(rightTo);
+    if (toCompare)
+        return toCompare;
+    const rawCompare = left.raw.localeCompare(right.raw);
+    if (rawCompare)
+        return rawCompare;
+    const leftTypeOnly = left.typeOnly ? 1 : 0;
+    const rightTypeOnly = right.typeOnly ? 1 : 0;
+    return leftTypeOnly - rightTypeOnly;
+}
+export function toRelativeEdge(projectRoot, edge) {
+    const from = toProjectDisplayPath(projectRoot, edge.from);
+    let to = edge.to;
+    if (edge.to.type === "file") {
+        to = {
+            type: "file",
+            path: toProjectDisplayPath(projectRoot, edge.to.path),
+        };
+    }
+    return {
+        from,
+        to,
+        raw: edge.raw,
+        ...(edge.typeOnly ? { typeOnly: edge.typeOnly } : {}),
+    };
+}
+//# sourceMappingURL=graph-edges.js.map

package/dist/util/graph-edges.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"graph-edges.js","sourceRoot":"","sources":["../../src/util/graph-edges.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,oBAAoB,EAAE,MAAM,YAAY,CAAC;AAElD,MAAM,UAAU,OAAO,CAAC,IAAU;IAChC,MAAM,KAAK,GAAG,IAAI,CAAC,EAAE,CAAC,IAAI,KAAK,MAAM,CAAC,CAAC,CAAC,QAAQ,IAAI,CAAC,EAAE,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,YAAY,IAAI,CAAC,EAAE,CAAC,IAAI,EAAE,CAAC;IAC5F,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC;IAC3C,OAAO,GAAG,IAAI,CAAC,IAAI,IAAI,KAAK,IAAI,IAAI,CAAC,GAAG,IAAI,QAAQ,EAAE,CAAC;AACzD,CAAC;AAED,MAAM,UAAU,YAAY,CAAC,IAAU,EAAE,KAAW;IAClD,MAAM,WAAW,GAAG,IAAI,CAAC,IAAI,CAAC,aAAa,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IACxD,IAAI,WAAW;QAAE,OAAO,WAAW,CAAC;IACpC,IAAI,IAAI,CAAC,EAAE,CAAC,IAAI,KAAK,KAAK,CAAC,EAAE,CAAC,IAAI,EAAE,CAAC;QACnC,OAAO,IAAI,CAAC,EAAE,CAAC,IAAI,KAAK,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IAC1C,CAAC;IACD,MAAM,MAAM,GAAG,IAAI,CAAC,EAAE,CAAC,IAAI,KAAK,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC;IACrE,MAAM,OAAO,GAAG,KAAK,CAAC,EAAE,CAAC,IAAI,KAAK,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,IAAI,CAAC;IACzE,MAAM,SAAS,GAAG,MAAM,CAAC,aAAa,CAAC,OAAO,CAAC,CAAC;IAChD,IAAI,SAAS;QAAE,OAAO,SAAS,CAAC;IAChC,MAAM,UAAU,GAAG,IAAI,CAAC,GAAG,CAAC,aAAa,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IACrD,IAAI,UAAU;QAAE,OAAO,UAAU,CAAC;IAClC,MAAM,YAAY,GAAG,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IAC3C,MAAM,aAAa,GAAG,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IAC7C,OAAO,YAAY,GAAG,aAAa,CAAC;AACtC,CAAC;AAED,MAAM,UAAU,cAAc,CAAC,WAAmB,EAAE,IAAU;IAC5D,MAAM,IAAI,GAAG,oBAAoB,CAAC,WAAW,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC;IAC1D,IAAI,EAAE,GAAG,IAAI,CAAC,EAAE,CAAC;IACjB,IAAI,IAAI,CAAC,EAAE,CAAC,IAAI,KAAK,MAAM,EAAE,CAAC;QAC5B,EAAE,GAAG;YACH,IAAI,EAAE,MAAM;YACZ,IAAI,EAAE,oBAAoB,CAAC,WAAW,EAAE,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC;SACtD,CAAC;IACJ,CAAC;IACD,OAAO;QACL,IAAI;QACJ,EAAE;QACF,GAAG,EAAE,IAAI,CAAC,GAAG;QACb,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,IAAI,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KACtD,CAAC;AACJ,CAAC"}

package/dist/util/graph-only-extensions.d.ts

@@ -0,0 +1,5 @@
+export declare const GRAPH_ONLY_DOCUMENT_EXTENSIONS: readonly [".md", ".mdx", ".rst", ".adoc", ".asciidoc"];
+export type GraphOnlyDocumentExtension = (typeof GRAPH_ONLY_DOCUMENT_EXTENSIONS)[number];
+export declare const GRAPH_ONLY_RESOLUTION_EXTENSIONS: readonly [".md", ".mdx", ".astro", ".hbs", ".handlebars", ".rst", ".adoc", ".asciidoc"];
+export type GraphOnlyResolutionExtension = (typeof GRAPH_ONLY_RESOLUTION_EXTENSIONS)[number];
+//# sourceMappingURL=graph-only-extensions.d.ts.map

package/dist/util/graph-only-extensions.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"graph-only-extensions.d.ts","sourceRoot":"","sources":["../../src/util/graph-only-extensions.ts"],"names":[],"mappings":"AAAA,eAAO,MAAM,8BAA8B,wDAAyD,CAAC;AAErG,MAAM,MAAM,0BAA0B,GAAG,CAAC,OAAO,8BAA8B,CAAC,CAAC,MAAM,CAAC,CAAC;AAEzF,eAAO,MAAM,gCAAgC,yFASnC,CAAC;AAEX,MAAM,MAAM,4BAA4B,GAAG,CAAC,OAAO,gCAAgC,CAAC,CAAC,MAAM,CAAC,CAAC"}

package/dist/util/graph-only-extensions.js

@@ -0,0 +1,12 @@
+export const GRAPH_ONLY_DOCUMENT_EXTENSIONS = [".md", ".mdx", ".rst", ".adoc", ".asciidoc"];
+export const GRAPH_ONLY_RESOLUTION_EXTENSIONS = [
+    ".md",
+    ".mdx",
+    ".astro",
+    ".hbs",
+    ".handlebars",
+    ".rst",
+    ".adoc",
+    ".asciidoc",
+];
+//# sourceMappingURL=graph-only-extensions.js.map

package/dist/util/graph-only-extensions.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"graph-only-extensions.js","sourceRoot":"","sources":["../../src/util/graph-only-extensions.ts"],"names":[],"mappings":"AAAA,MAAM,CAAC,MAAM,8BAA8B,GAAG,CAAC,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,WAAW,CAAU,CAAC;AAIrG,MAAM,CAAC,MAAM,gCAAgC,GAAG;IAC9C,KAAK;IACL,MAAM;IACN,QAAQ;IACR,MAAM;IACN,aAAa;IACb,MAAM;IACN,OAAO;IACP,WAAW;CACH,CAAC"}

package/dist/util/include-roots.d.ts

@@ -0,0 +1,6 @@
+import type { Graph } from "../types.js";
+export declare function isPathUnderIncludeRoots(normalizedPath: string, normalizedRoots: readonly string[]): boolean;
+export declare function normalizeIncludeRootsRelative(projectRoot: string, includeRoots: readonly string[]): string[];
+export declare function normalizeIncludeRootsAbsolute(projectRoot: string, includeRoots: readonly string[]): string[];
+export declare function restrictGraphToIncludeRoots(graph: Graph, includeRoots: readonly string[], normalizeFile?: (file: string) => string): Graph;
+//# sourceMappingURL=include-roots.d.ts.map

package/dist/util/include-roots.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"include-roots.d.ts","sourceRoot":"","sources":["../../src/util/include-roots.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,aAAa,CAAC;AAGzC,wBAAgB,uBAAuB,CAAC,cAAc,EAAE,MAAM,EAAE,eAAe,EAAE,SAAS,MAAM,EAAE,GAAG,OAAO,CAI3G;AAED,wBAAgB,6BAA6B,CAAC,WAAW,EAAE,MAAM,EAAE,YAAY,EAAE,SAAS,MAAM,EAAE,GAAG,MAAM,EAAE,CAS5G;AAED,wBAAgB,6BAA6B,CAAC,WAAW,EAAE,MAAM,EAAE,YAAY,EAAE,SAAS,MAAM,EAAE,GAAG,MAAM,EAAE,CAE5G;AAED,wBAAgB,2BAA2B,CACzC,KAAK,EAAE,KAAK,EACZ,YAAY,EAAE,SAAS,MAAM,EAAE,EAC/B,aAAa,GAAE,CAAC,IAAI,EAAE,MAAM,KAAK,MAAsB,GACtD,KAAK,CA8BP"}

package/dist/util/include-roots.js

@@ -0,0 +1,53 @@
+import path from "node:path";
+import { normalizePath, resolveFilePathFromRoot } from "./paths.js";
+export function isPathUnderIncludeRoots(normalizedPath, normalizedRoots) {
+    if (!normalizedRoots.length)
+        return true;
+    const file = normalizedPath.replace(/\\/g, "/");
+    return normalizedRoots.some((root) => file === root || file.startsWith(`${root}/`));
+}
+export function normalizeIncludeRootsRelative(projectRoot, includeRoots) {
+    return includeRoots
+        .map((includeRoot) => {
+        const relativeRoot = path.isAbsolute(includeRoot) ? path.relative(projectRoot, includeRoot) : includeRoot;
+        return normalizePath(relativeRoot)
+            .replace(/^\.?\//, "")
+            .replace(/\/$/, "");
+    })
+        .filter((includeRoot) => includeRoot && includeRoot !== ".");
+}
+export function normalizeIncludeRootsAbsolute(projectRoot, includeRoots) {
+    return includeRoots.map((entry) => normalizePath(resolveFilePathFromRoot(projectRoot, entry)));
+}
+export function restrictGraphToIncludeRoots(graph, includeRoots, normalizeFile = normalizePath) {
+    if (!includeRoots.length) {
+        return graph;
+    }
+    const normalizedRoots = includeRoots.map(normalizeFile);
+    const nodes = new Set();
+    for (const file of graph.nodes) {
+        const normalizedFile = normalizeFile(file);
+        if (isPathUnderIncludeRoots(normalizedFile, normalizedRoots)) {
+            nodes.add(normalizedFile);
+        }
+    }
+    const edges = graph.edges.flatMap((edge) => {
+        const from = normalizeFile(edge.from);
+        if (!nodes.has(from)) {
+            return [];
+        }
+        if (edge.to.type === "external") {
+            return [{ ...edge, from }];
+        }
+        const toPath = normalizeFile(edge.to.path);
+        if (!nodes.has(toPath)) {
+            return [];
+        }
+        return [{ ...edge, from, to: { type: "file", path: toPath } }];
+    });
+    return {
+        nodes,
+        edges,
+    };
+}
+//# sourceMappingURL=include-roots.js.map

package/dist/util/include-roots.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"include-roots.js","sourceRoot":"","sources":["../../src/util/include-roots.ts"],"names":[],"mappings":"AAAA,OAAO,IAAI,MAAM,WAAW,CAAC;AAE7B,OAAO,EAAE,aAAa,EAAE,uBAAuB,EAAE,MAAM,YAAY,CAAC;AAEpE,MAAM,UAAU,uBAAuB,CAAC,cAAsB,EAAE,eAAkC;IAChG,IAAI,CAAC,eAAe,CAAC,MAAM;QAAE,OAAO,IAAI,CAAC;IACzC,MAAM,IAAI,GAAG,cAAc,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;IAChD,OAAO,eAAe,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,KAAK,IAAI,IAAI,IAAI,CAAC,UAAU,CAAC,GAAG,IAAI,GAAG,CAAC,CAAC,CAAC;AACtF,CAAC;AAED,MAAM,UAAU,6BAA6B,CAAC,WAAmB,EAAE,YAA+B;IAChG,OAAO,YAAY;SAChB,GAAG,CAAC,CAAC,WAAW,EAAE,EAAE;QACnB,MAAM,YAAY,GAAG,IAAI,CAAC,UAAU,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,WAAW,EAAE,WAAW,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC;QAC1G,OAAO,aAAa,CAAC,YAAY,CAAC;aAC/B,OAAO,CAAC,QAAQ,EAAE,EAAE,CAAC;aACrB,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;IACxB,CAAC,CAAC;SACD,MAAM,CAAC,CAAC,WAAW,EAAE,EAAE,CAAC,WAAW,IAAI,WAAW,KAAK,GAAG,CAAC,CAAC;AACjE,CAAC;AAED,MAAM,UAAU,6BAA6B,CAAC,WAAmB,EAAE,YAA+B;IAChG,OAAO,YAAY,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,aAAa,CAAC,uBAAuB,CAAC,WAAW,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC;AACjG,CAAC;AAED,MAAM,UAAU,2BAA2B,CACzC,KAAY,EACZ,YAA+B,EAC/B,gBAA0C,aAAa;IAEvD,IAAI,CAAC,YAAY,CAAC,MAAM,EAAE,CAAC;QACzB,OAAO,KAAK,CAAC;IACf,CAAC;IACD,MAAM,eAAe,GAAG,YAAY,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC;IACxD,MAAM,KAAK,GAAG,IAAI,GAAG,EAAU,CAAC;IAChC,KAAK,MAAM,IAAI,IAAI,KAAK,CAAC,KAAK,EAAE,CAAC;QAC/B,MAAM,cAAc,GAAG,aAAa,CAAC,IAAI,CAAC,CAAC;QAC3C,IAAI,uBAAuB,CAAC,cAAc,EAAE,eAAe,CAAC,EAAE,CAAC;YAC7D,KAAK,CAAC,GAAG,CAAC,cAAc,CAAC,CAAC;QAC5B,CAAC;IACH,CAAC;IACD,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,EAAE;QACzC,MAAM,IAAI,GAAG,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACtC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;YACrB,OAAO,EAAE,CAAC;QACZ,CAAC;QACD,IAAI,IAAI,CAAC,EAAE,CAAC,IAAI,KAAK,UAAU,EAAE,CAAC;YAChC,OAAO,CAAC,EAAE,GAAG,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;QAC7B,CAAC;QACD,MAAM,MAAM,GAAG,aAAa,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,CAAC;QAC3C,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC;YACvB,OAAO,EAAE,CAAC;QACZ,CAAC;QACD,OAAO,CAAC,EAAE,GAAG,IAAI,EAAE,IAAI,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE,MAAe,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,CAAC,CAAC;IAC1E,CAAC,CAAC,CAAC;IACH,OAAO;QACL,KAAK;QACL,KAAK;KACN,CAAC;AACJ,CAAC"}