@neuralis/brain-core 0.3.1 → 0.4.0

package/dist/src/domain/access/nativeLocalFence.d.ts

@@ -0,0 +1,65 @@
+import { type RuntimeStackInfo } from '@neuralis/package-system/paths';
+import { type HierarchicalPermissions, type SourceConfig, type SourceEnabledState, type SyncConfig } from '../sourceConfig.js';
+/** Where a canonical path sits relative to what a native `local` source may root at. */
+export type NativeLocalPlacement = 
+/** IS or UNDER the caller's project zone — attachable with `sources.mount`. */
+'project'
+/** IS or UNDER a privileged row (a filesystem root exactly) — attachable with `sources.privileged`. */
+ | 'privileged'
+/** A strict ANCESTOR of the project zone — browsable on the way down, never attachable. */
+ | 'ancestor' | 'outside';
+/** The stable refusal every fenced consumer answers with. */
+export declare const NATIVE_LOCAL_REFUSAL: {
+    readonly code: 'native_local_root_outside_project';
+    readonly error: "On a native install a folder outside this project's own zone is reached through your own paired device: pair this computer (`neuralis device pair`), allow the folder, and add it as a folder on that device.";
+};
+/** An EDIT of an existing outside-rooted source: it may only narrow (`fencedEditWidens`). */
+export declare const NATIVE_LOCAL_EDIT_REFUSAL: {
+    readonly code: "native_local_root_outside_project";
+    readonly error: "This source is rooted outside this project's own zone, which a native install reaches only through your own paired device: it can still be disabled, narrowed, described or deleted, never widened.";
+};
+/** The fence applies unless the stack says, explicitly, that this is Docker. */
+export declare function nativeLocalFenceApplies(stack: Pick<RuntimeStackInfo, 'isDocker'> | null | undefined): boolean;
+/**
+ * Classify a canonical absolute path. `projectRoot` empty ⇒ no project zone
+ * (nothing is `project` or `ancestor`); `privilegedRoots` are the privileged
+ * table's zone paths.
+ */
+export declare function nativeLocalPlacement(path: string, projectRoot: string, privilegedRoots: readonly string[]): NativeLocalPlacement;
+/** Attachable as a native `local` root (the privileged rows still need their feature). */
+export declare function attachableNatively(placement: NativeLocalPlacement): boolean;
+/**
+ * Does the fence refuse an in-process folder rooted at `resolvedRoot` (already
+ * resolved the way the connector resolves it)? Judged on the lexical path and
+ * again on the REAL path when it exists — a symlink inside the project zone that
+ * points elsewhere is refused like its target. Any other plane (a device folder,
+ * a connector kind), or a Docker stack, is not the fence's to judge (`false`).
+ */
+export declare function nativeLocalRootRefused(input: {
+    stack: Pick<RuntimeStackInfo, 'isDocker'> | null | undefined;
+    connection: {
+        kind: string;
+        config?: unknown;
+    };
+    resolvedRoot: string;
+    projectRoot: string;
+    privilegedRoots: readonly string[];
+}): Promise<boolean>;
+/**
+ * Would this edit of a fenced in-process folder keep or create reach WIDER than
+ * it has? Reach = who may read/write/exec under the root (`permissions`), whether
+ * the source is live (`enabled`), whether it loads code (a `packageFolders`
+ * entry it did not carry)
+ * and which of its files the indexer reads (sync created, an exclude dropped, a
+ * wider include). Cadence, scan cap, media lanes and the description are not
+ * reach. `byRole` resolves by role PRIORITY, so its key set is reach too: a key
+ * may only be added denying all three bits, never removed.
+ */
+export declare function fencedEditWidens(existing: Pick<SourceConfig, 'permissions' | 'enabled' | 'sync' | 'packageFolders'>, patch: {
+    permissions?: HierarchicalPermissions;
+    enabled?: SourceEnabledState;
+    sync?: Pick<SyncConfig, 'exclude' | 'include'>;
+    clearSync?: boolean;
+    packageFolders?: readonly string[];
+}): boolean;
+//# sourceMappingURL=nativeLocalFence.d.ts.map

package/dist/src/domain/access/nativeLocalFence.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"nativeLocalFence.d.ts","sourceRoot":"","sources":["../../../../src/domain/access/nativeLocalFence.ts"],"names":[],"mappings":"AAsBA,OAAO,EAAmD,KAAK,gBAAgB,EAAE,MAAM,gCAAgC,CAAC;AAExH,OAAO,EAAuB,KAAK,uBAAuB,EAAuB,KAAK,YAAY,EAAE,KAAK,kBAAkB,EAAE,KAAK,UAAU,EAAE,MAAM,oBAAoB,CAAC;AAEzK,wFAAwF;AACxF,MAAM,MAAM,oBAAoB;AAC9B,+EAA+E;AAC7E,SAAS;AACX,uGAAuG;GACrG,YAAY;AACd,2FAA2F;GACzF,UAAU,GACV,SAAS,CAAC;AAEd,6DAA6D;AAC7D,eAAO,MAAM,oBAAoB;aAC/B,IAAI,EAAE,mCAAmC;aACzC,KAAK,EAAE,+MAA+M;CAC9M,CAAC;AAEX,6FAA6F;AAC7F,eAAO,MAAM,yBAAyB;aACpC,IAAI;aACJ,KAAK,EAAE,qMAAqM;CACpM,CAAC;AAEX,gFAAgF;AAChF,wBAAgB,uBAAuB,CAAC,KAAK,EAAE,IAAI,CAAC,gBAAgB,EAAE,UAAU,CAAC,GAAG,IAAI,GAAG,SAAS,GAAG,OAAO,CAE7G;AAED;;;;GAIG;AACH,wBAAgB,oBAAoB,CAClC,IAAI,EAAE,MAAM,EACZ,WAAW,EAAE,MAAM,EACnB,eAAe,EAAE,SAAS,MAAM,EAAE,GACjC,oBAAoB,CAQtB;AAED,0FAA0F;AAC1F,wBAAgB,kBAAkB,CAAC,SAAS,EAAE,oBAAoB,GAAG,OAAO,CAE3E;AAUD;;;;;;GAMG;AACH,wBAAsB,sBAAsB,CAAC,KAAK,EAAE;IAClD,KAAK,EAAE,IAAI,CAAC,gBAAgB,EAAE,UAAU,CAAC,GAAG,IAAI,GAAG,SAAS,CAAC;IAC7D,UAAU,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,MAAM,CAAC,EAAE,OAAO,CAAA;KAAE,CAAC;IAC/C,YAAY,EAAE,MAAM,CAAC;IACrB,WAAW,EAAE,MAAM,CAAC;IACpB,eAAe,EAAE,SAAS,MAAM,EAAE,CAAC;CACpC,GAAG,OAAO,CAAC,OAAO,CAAC,CAWnB;AA8CD;;;;;;;;;GASG;AACH,wBAAgB,gBAAgB,CAC9B,QAAQ,EAAE,IAAI,CAAC,YAAY,EAAE,aAAa,GAAG,SAAS,GAAG,MAAM,GAAG,gBAAgB,CAAC,EACnF,KAAK,EAAE;IACL,WAAW,CAAC,EAAE,uBAAuB,CAAC;IACtC,OAAO,CAAC,EAAE,kBAAkB,CAAC;IAC7B,IAAI,CAAC,EAAE,IAAI,CAAC,UAAU,EAAE,SAAS,GAAG,SAAS,CAAC,CAAC;IAC/C,SAAS,CAAC,EAAE,OAAO,CAAC;IACpB,cAAc,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;CACpC,GACA,OAAO,CAoBT"}

package/dist/src/domain/access/nativeLocalFence.js

@@ -0,0 +1,171 @@
+/**
+ * The native folder fence — where an IN-PROCESS folder (the `host` kind with
+ * no `device`, the kernel's `sourcePlane` = `local`) may be rooted when the
+ * platform runs WITHOUT a container (`stack.isDocker === false`).
+ *
+ * In Docker the container is the boundary: an in-process root names only what
+ * the operator mounted. On a native host there is none, so an in-process root is
+ * the host OS user's whole reach — a manager (`sources.mount` is a manager
+ * default) could otherwise attach `~/.ssh`. On a native host such a root is
+ * accepted only inside the caller's own project zone (`<home>/projects/<projectId>`),
+ * or IS / is UNDER one of the privileged rows (the App Zone, the Neuralis tree,
+ * the whole host — `/` or a drive root — exactly) — which still cost
+ * `sources.privileged` through the privileged-root table. Every other folder is
+ * a folder on the user's own paired device (the same kind, `device` set).
+ *
+ * The signal is the kernel's ONE `stack.isDocker`, and it fails CLOSED: only an
+ * explicit `true` opens the Docker arm. Scope: the folder kind's in-process
+ * transport only — the privileged-root gate's other root-bearing kinds are not
+ * covered here, and a device folder is the device owner's ceiling's to bound.
+ */
+import { realpath } from 'node:fs/promises';
+import { resolve } from 'node:path';
+import { hostPathFlavour, isFilesystemRoot, isPathInside } from '@neuralis/package-system/paths';
+import { sourcePlane } from '@neuralis/package-system/contracts';
+import { resolveEnabledState } from '../sourceConfig.js';
+/** The stable refusal every fenced consumer answers with. */
+export const NATIVE_LOCAL_REFUSAL = {
+    code: 'native_local_root_outside_project',
+    error: "On a native install a folder outside this project's own zone is reached through your own paired device: pair this computer (`neuralis device pair`), allow the folder, and add it as a folder on that device.",
+};
+/** An EDIT of an existing outside-rooted source: it may only narrow (`fencedEditWidens`). */
+export const NATIVE_LOCAL_EDIT_REFUSAL = {
+    code: NATIVE_LOCAL_REFUSAL.code,
+    error: "This source is rooted outside this project's own zone, which a native install reaches only through your own paired device: it can still be disabled, narrowed, described or deleted, never widened.",
+};
+/** The fence applies unless the stack says, explicitly, that this is Docker. */
+export function nativeLocalFenceApplies(stack) {
+    return stack?.isDocker !== true;
+}
+/**
+ * Classify a canonical absolute path. `projectRoot` empty ⇒ no project zone
+ * (nothing is `project` or `ancestor`); `privilegedRoots` are the privileged
+ * table's zone paths.
+ */
+export function nativeLocalPlacement(path, projectRoot, privilegedRoots) {
+    if (projectRoot && isPathInside(projectRoot, path))
+        return 'project';
+    for (const root of privilegedRoots) {
+        // A filesystem root covers only itself — under it is everything, which is no zone.
+        if ((!isFilesystemRoot(root) || isFilesystemRoot(path)) && isPathInside(root, path, hostPathFlavour(root)))
+            return 'privileged';
+    }
+    if (projectRoot && isPathInside(path, projectRoot))
+        return 'ancestor';
+    return 'outside';
+}
+/** Attachable as a native `local` root (the privileged rows still need their feature). */
+export function attachableNatively(placement) {
+    return placement === 'project' || placement === 'privileged';
+}
+async function realOrSelf(path) {
+    try {
+        return await realpath(path);
+    }
+    catch {
+        return path;
+    }
+}
+/**
+ * Does the fence refuse an in-process folder rooted at `resolvedRoot` (already
+ * resolved the way the connector resolves it)? Judged on the lexical path and
+ * again on the REAL path when it exists — a symlink inside the project zone that
+ * points elsewhere is refused like its target. Any other plane (a device folder,
+ * a connector kind), or a Docker stack, is not the fence's to judge (`false`).
+ */
+export async function nativeLocalRootRefused(input) {
+    const config = (input.connection.config ?? {});
+    if (sourcePlane(input.connection.kind, config) !== 'local' || !nativeLocalFenceApplies(input.stack))
+        return false;
+    const projectRoot = input.projectRoot ? resolve(input.projectRoot) : '';
+    const lexical = resolve(input.resolvedRoot);
+    if (!attachableNatively(nativeLocalPlacement(lexical, projectRoot, input.privilegedRoots)))
+        return true;
+    const real = await realOrSelf(lexical);
+    if (real === lexical)
+        return false;
+    const realProject = projectRoot ? await realOrSelf(projectRoot) : '';
+    const realPrivileged = await Promise.all(input.privilegedRoots.map((root) => (isFilesystemRoot(root) ? root : realOrSelf(root))));
+    return !attachableNatively(nativeLocalPlacement(real, realProject, realPrivileged));
+}
+const CAPS = ['read', 'write', 'exec'];
+/** A bit narrows when it never gains reach: unchanged, true→false, true→unset, unset→false. */
+const bitsNarrow = (old, next) => CAPS.every((c) => old[c] === next[c] || old[c] === true || next[c] === false);
+const grantsNothing = (b) => CAPS.every((c) => b[c] !== true);
+const deniesNothing = (b) => CAPS.every((c) => b[c] !== false);
+const deniesAll = (b) => CAPS.every((c) => b[c] === false);
+function entriesNarrow(old = {}, next = {}, added, removed) {
+    const has = Object.hasOwn;
+    return [...new Set([...Object.keys(old), ...Object.keys(next)])].every((k) => (has(old, k) && has(next, k) ? bitsNarrow(old[k], next[k])
+        : has(next, k) ? added(next[k]) : removed(old[k])));
+}
+const sameList = (a, b) => (a ?? []).join('\0') === (b ?? []).join('\0');
+const sameRule = (a, b) => a.pattern === b.pattern && a.override === b.override
+    && a.floor === b.floor && a.priority === b.priority && sameList(a.roles, b.roles) && sameList(a.agents, b.agents) && sameList(a.users, b.users);
+/**
+ * Path rows apply IN ORDER (an `override` row overwrites what came before), so
+ * the new list must derive from the old one through steps that each narrow: a
+ * row kept with the same pattern and conditions and narrowed bits, a removed row
+ * that denied nothing, an inserted row that grants nothing. Conservative — an
+ * alignment the walk misses is refused, never admitted.
+ */
+function pathsNarrow(old = [], next = []) {
+    let i = 0;
+    let j = 0;
+    while (i < old.length || j < next.length) {
+        if (i < old.length && j < next.length && sameRule(old[i], next[j]) && bitsNarrow(old[i].permissions, next[j].permissions)) {
+            i++;
+            j++;
+            continue;
+        }
+        if (j < next.length && !next[j].floor && grantsNothing(next[j].permissions)) {
+            j++;
+            continue;
+        }
+        if (i < old.length && !old[i].floor && deniesNothing(old[i].permissions)) {
+            i++;
+            continue;
+        }
+        return false;
+    }
+    return true;
+}
+const ENABLED_RANK = { false: 0, auto: 1, true: 2 };
+/**
+ * Would this edit of a fenced in-process folder keep or create reach WIDER than
+ * it has? Reach = who may read/write/exec under the root (`permissions`), whether
+ * the source is live (`enabled`), whether it loads code (a `packageFolders`
+ * entry it did not carry)
+ * and which of its files the indexer reads (sync created, an exclude dropped, a
+ * wider include). Cadence, scan cap, media lanes and the description are not
+ * reach. `byRole` resolves by role PRIORITY, so its key set is reach too: a key
+ * may only be added denying all three bits, never removed.
+ */
+export function fencedEditWidens(existing, patch) {
+    if (patch.enabled !== undefined && ENABLED_RANK[`${patch.enabled}`] > ENABLED_RANK[`${resolveEnabledState(existing)}`])
+        return true;
+    if (patch.packageFolders && !patch.packageFolders.every((folder) => (existing.packageFolders ?? []).includes(folder)))
+        return true;
+    const sync = patch.clearSync ? undefined : patch.sync;
+    if (sync) {
+        const old = existing.sync;
+        if (!old)
+            return true;
+        if (!old.exclude.every((p) => sync.exclude.includes(p)))
+            return true;
+        const oldIn = old.include ?? [];
+        const nextIn = sync.include ?? [];
+        if (oldIn.length > 0 && (nextIn.length === 0 || !nextIn.every((p) => oldIn.includes(p))))
+            return true;
+    }
+    const o = existing.permissions;
+    const n = patch.permissions;
+    if (!n)
+        return false;
+    return !(bitsNarrow(o.default, n.default)
+        && entriesNarrow(o.byRole, n.byRole, deniesAll, () => false)
+        && entriesNarrow(o.byUser, n.byUser, grantsNothing, deniesNothing)
+        && entriesNarrow(o.byAgent, n.byAgent, grantsNothing, deniesNothing)
+        && pathsNarrow(o.paths, n.paths));
+}
+//# sourceMappingURL=nativeLocalFence.js.map

package/dist/src/domain/access/nativeLocalFence.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"nativeLocalFence.js","sourceRoot":"","sources":["../../../../src/domain/access/nativeLocalFence.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AACH,OAAO,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AAC5C,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACpC,OAAO,EAAE,eAAe,EAAE,gBAAgB,EAAE,YAAY,EAAyB,MAAM,gCAAgC,CAAC;AACxH,OAAO,EAAE,WAAW,EAAE,MAAM,oCAAoC,CAAC;AACjE,OAAO,EAAE,mBAAmB,EAAkH,MAAM,oBAAoB,CAAC;AAYzK,6DAA6D;AAC7D,MAAM,CAAC,MAAM,oBAAoB,GAAG;IAClC,IAAI,EAAE,mCAAmC;IACzC,KAAK,EAAE,+MAA+M;CAC9M,CAAC;AAEX,6FAA6F;AAC7F,MAAM,CAAC,MAAM,yBAAyB,GAAG;IACvC,IAAI,EAAE,oBAAoB,CAAC,IAAI;IAC/B,KAAK,EAAE,qMAAqM;CACpM,CAAC;AAEX,gFAAgF;AAChF,MAAM,UAAU,uBAAuB,CAAC,KAA4D;IAClG,OAAO,KAAK,EAAE,QAAQ,KAAK,IAAI,CAAC;AAClC,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,oBAAoB,CAClC,IAAY,EACZ,WAAmB,EACnB,eAAkC;IAElC,IAAI,WAAW,IAAI,YAAY,CAAC,WAAW,EAAE,IAAI,CAAC;QAAE,OAAO,SAAS,CAAC;IACrE,KAAK,MAAM,IAAI,IAAI,eAAe,EAAE,CAAC;QACnC,mFAAmF;QACnF,IAAI,CAAC,CAAC,gBAAgB,CAAC,IAAI,CAAC,IAAI,gBAAgB,CAAC,IAAI,CAAC,CAAC,IAAI,YAAY,CAAC,IAAI,EAAE,IAAI,EAAE,eAAe,CAAC,IAAI,CAAC,CAAC;YAAE,OAAO,YAAY,CAAC;IAClI,CAAC;IACD,IAAI,WAAW,IAAI,YAAY,CAAC,IAAI,EAAE,WAAW,CAAC;QAAE,OAAO,UAAU,CAAC;IACtE,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,0FAA0F;AAC1F,MAAM,UAAU,kBAAkB,CAAC,SAA+B;IAChE,OAAO,SAAS,KAAK,SAAS,IAAI,SAAS,KAAK,YAAY,CAAC;AAC/D,CAAC;AAED,KAAK,UAAU,UAAU,CAAC,IAAY;IACpC,IAAI,CAAC;QACH,OAAO,MAAM,QAAQ,CAAC,IAAI,CAAC,CAAC;IAC9B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAAC,KAM5C;IACC,MAAM,MAAM,GAAG,CAAC,KAAK,CAAC,UAAU,CAAC,MAAM,IAAI,EAAE,CAA4B,CAAC;IAC1E,IAAI,WAAW,CAAC,KAAK,CAAC,UAAU,CAAC,IAAI,EAAE,MAAM,CAAC,KAAK,OAAO,IAAI,CAAC,uBAAuB,CAAC,KAAK,CAAC,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IAClH,MAAM,WAAW,GAAG,KAAK,CAAC,WAAW,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IACxE,MAAM,OAAO,GAAG,OAAO,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC;IAC5C,IAAI,CAAC,kBAAkB,CAAC,oBAAoB,CAAC,OAAO,EAAE,WAAW,EAAE,KAAK,CAAC,eAAe,CAAC,CAAC;QAAE,OAAO,IAAI,CAAC;IACxG,MAAM,IAAI,GAAG,MAAM,UAAU,CAAC,OAAO,CAAC,CAAC;IACvC,IAAI,IAAI,KAAK,OAAO;QAAE,OAAO,KAAK,CAAC;IACnC,MAAM,WAAW,GAAG,WAAW,CAAC,CAAC,CAAC,MAAM,UAAU,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IACrE,MAAM,cAAc,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,eAAe,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,gBAAgB,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;IAClI,OAAO,CAAC,kBAAkB,CAAC,oBAAoB,CAAC,IAAI,EAAE,WAAW,EAAE,cAAc,CAAC,CAAC,CAAC;AACtF,CAAC;AAGD,MAAM,IAAI,GAAG,CAAC,MAAM,EAAE,OAAO,EAAE,MAAM,CAAU,CAAC;AAChD,+FAA+F;AAC/F,MAAM,UAAU,GAAG,CAAC,GAAS,EAAE,IAAU,EAAW,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,KAAK,IAAI,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC,CAAC,CAAC,KAAK,IAAI,IAAI,IAAI,CAAC,CAAC,CAAC,KAAK,KAAK,CAAC,CAAC;AACrI,MAAM,aAAa,GAAG,CAAC,CAAO,EAAW,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,IAAI,CAAC,CAAC;AAC7E,MAAM,aAAa,GAAG,CAAC,CAAO,EAAW,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,KAAK,CAAC,CAAC;AAC9E,MAAM,SAAS,GAAG,CAAC,CAAO,EAAW,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,KAAK,CAAC,CAAC;AAE1E,SAAS,aAAa,CACpB,GAAG,GAAyB,EAAE,EAC9B,IAAI,GAAyB,EAAE,EAC/B,KAA2B,EAC3B,OAA6B;IAE7B,MAAM,GAAG,GAAG,MAAM,CAAC,MAAM,CAAC;IAC1B,OAAO,CAAC,GAAG,IAAI,GAAG,CAAC,CAAC,GAAG,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,GAAG,EAAE,CAAC,CAAC,IAAI,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC;QACtI,CAAC,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AACxD,CAAC;AAED,MAAM,QAAQ,GAAG,CAAC,CAAqB,EAAE,CAAqB,EAAW,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAC1H,MAAM,QAAQ,GAAG,CAAC,CAAiB,EAAE,CAAiB,EAAW,EAAE,CAAC,CAAC,CAAC,OAAO,KAAK,CAAC,CAAC,OAAO,IAAI,CAAC,CAAC,QAAQ,KAAK,CAAC,CAAC,QAAQ;OACnH,CAAC,CAAC,KAAK,KAAK,CAAC,CAAC,KAAK,IAAI,CAAC,CAAC,QAAQ,KAAK,CAAC,CAAC,QAAQ,IAAI,QAAQ,CAAC,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC,KAAK,CAAC,IAAI,QAAQ,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,MAAM,CAAC,IAAI,QAAQ,CAAC,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC;AAElJ;;;;;;GAMG;AACH,SAAS,WAAW,CAAC,GAAG,GAA8B,EAAE,EAAE,IAAI,GAA8B,EAAE;IAC5F,IAAI,CAAC,GAAG,CAAC,CAAC;IACV,IAAI,CAAC,GAAG,CAAC,CAAC;IACV,OAAO,CAAC,GAAG,GAAG,CAAC,MAAM,IAAI,CAAC,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC;QACzC,IAAI,CAAC,GAAG,GAAG,CAAC,MAAM,IAAI,CAAC,GAAG,IAAI,CAAC,MAAM,IAAI,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC,EAAE,CAAC;YAAC,CAAC,EAAE,CAAC;YAAC,CAAC,EAAE,CAAC;YAAC,SAAS;QAAC,CAAC;QAClJ,IAAI,CAAC,GAAG,IAAI,CAAC,MAAM,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,IAAI,aAAa,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC,EAAE,CAAC;YAAC,CAAC,EAAE,CAAC;YAAC,SAAS;QAAC,CAAC;QAC/F,IAAI,CAAC,GAAG,GAAG,CAAC,MAAM,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,IAAI,aAAa,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC,EAAE,CAAC;YAAC,CAAC,EAAE,CAAC;YAAC,SAAS;QAAC,CAAC;QAC5F,OAAO,KAAK,CAAC;IACf,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,MAAM,YAAY,GAAG,EAAE,KAAK,EAAE,CAAC,EAAE,IAAI,EAAE,CAAC,EAAE,IAAI,EAAE,CAAC,EAAW,CAAC;AAE7D;;;;;;;;;GASG;AACH,MAAM,UAAU,gBAAgB,CAC9B,QAAmF,EACnF,KAMC;IAED,IAAI,KAAK,CAAC,OAAO,KAAK,SAAS,IAAI,YAAY,CAAC,GAAG,KAAK,CAAC,OAAO,EAAE,CAAC,GAAG,YAAY,CAAC,GAAG,mBAAmB,CAAC,QAAQ,CAAC,EAAE,CAAC;QAAE,OAAO,IAAI,CAAC;IACpI,IAAI,KAAK,CAAC,cAAc,IAAI,CAAC,KAAK,CAAC,cAAc,CAAC,KAAK,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,QAAQ,CAAC,cAAc,IAAI,EAAE,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;QAAE,OAAO,IAAI,CAAC;IACnI,MAAM,IAAI,GAAG,KAAK,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC;IACtD,IAAI,IAAI,EAAE,CAAC;QACT,MAAM,GAAG,GAAG,QAAQ,CAAC,IAAI,CAAC;QAC1B,IAAI,CAAC,GAAG;YAAE,OAAO,IAAI,CAAC;QACtB,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC;YAAE,OAAO,IAAI,CAAC;QACrE,MAAM,KAAK,GAAG,GAAG,CAAC,OAAO,IAAI,EAAE,CAAC;QAChC,MAAM,MAAM,GAAG,IAAI,CAAC,OAAO,IAAI,EAAE,CAAC;QAClC,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC;YAAE,OAAO,IAAI,CAAC;IACxG,CAAC;IACD,MAAM,CAAC,GAAG,QAAQ,CAAC,WAAW,CAAC;IAC/B,MAAM,CAAC,GAAG,KAAK,CAAC,WAAW,CAAC;IAC5B,IAAI,CAAC,CAAC;QAAE,OAAO,KAAK,CAAC;IACrB,OAAO,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,OAAO,CAAC;WACpC,aAAa,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,SAAS,EAAE,GAAG,EAAE,CAAC,KAAK,CAAC;WACzD,aAAa,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,aAAa,EAAE,aAAa,CAAC;WAC/D,aAAa,CAAC,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,aAAa,EAAE,aAAa,CAAC;WACjE,WAAW,CAAC,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC;AACtC,CAAC"}

package/dist/src/domain/access/uriPermission.js

@@ -3,7 +3,7 @@ import { scopeAccessCtxFromExecution } from '../scopeAccessCtx.js';
 import { deriveSourceKind } from '../source.js';
 import { sourceFromUri } from '../uri.js';
 import { resolveCallerPermissions } from './callerPermissions.js';
-import { SourceNotConfiguredError, SourcePermissionDeniedError } from '../sourceConfig.js';
+import { SourceNotConfiguredError, SourcePermissionDeniedError, sourceScopeOrigin } from '../sourceConfig.js';
 import { assertSourceEnabled } from './sourceEnabled.js';
 /**
  * The THROWING per-uri gate every write (and every single-result read) passes.
@@ -65,11 +65,11 @@ export async function checkUriPermission(deps, ctx, uri, operation, configCache)
         throw new SourceNotConfiguredError(source);
     }
     const scopeCtx = scopeAccessCtxFromExecution(ctx);
-    if (!canAccessScope(config.scope, scopeCtx, 'read')) {
+    if (!canAccessScope(config.scope, scopeCtx, 'read', sourceScopeOrigin(config.connection))) {
         throw new SourceNotConfiguredError(source);
     }
     await assertSourceEnabled(deps, ctx.projectId, source, config);
-    if (operation !== 'read' && !canAccessScope(config.scope, scopeCtx, 'write')) {
+    if (operation !== 'read' && !canAccessScope(config.scope, scopeCtx, 'write', sourceScopeOrigin(config.connection))) {
         throw new SourcePermissionDeniedError(source, operation);
     }
     const resolved = await resolveCallerPermissions(config, uri, ctx, source);

package/dist/src/domain/access/uriPermission.js.map

@@ -1 +1 @@
-{"version":3,"file":"uriPermission.js","sourceRoot":"","sources":["../../../../src/domain/access/uriPermission.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,cAAc,EAAE,MAAM,oCAAoC,CAAC;AAEpE,OAAO,EAAE,2BAA2B,EAAE,MAAM,sBAAsB,CAAC;AACnE,OAAO,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AAChD,OAAO,EAAE,aAAa,EAAE,MAAM,WAAW,CAAC;AAC1C,OAAO,EAAE,wBAAwB,EAAE,MAAM,wBAAwB,CAAC;AAElE,OAAO,EAAE,wBAAwB,EAAE,2BAA2B,EAAE,MAAM,oBAAoB,CAAC;AAE3F,OAAO,EAAE,mBAAmB,EAA0B,MAAM,oBAAoB,CAAC;AAOjF;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAyCG;AACH,MAAM,CAAC,KAAK,UAAU,kBAAkB,CACtC,IAAuB,EACvB,GAAqB,EACrB,GAAW,EACX,SAAoC,EACpC,WAA8C;IAE9C,IAAI,CAAC,IAAI,CAAC,aAAa;QAAE,OAAO;IAChC,MAAM,MAAM,GAAG,aAAa,CAAC,GAAG,CAAC,CAAC;IAClC,IAAI,MAA2B,CAAC;IAChC,IAAI,WAAW,EAAE,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC;QAC7B,MAAM,GAAG,WAAW,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,IAAI,CAAC;IAC3C,CAAC;SAAM,CAAC;QACN,MAAM,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC,GAAG,CACnC,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,SAAS,EAAE,GAAG,CAAC,SAAS,EAAE,EAChD,MAAM,CACP,CAAC;QACF,WAAW,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACnC,CAAC;IACD,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,IAAI,gBAAgB,CAAC,MAAM,CAAC,KAAK,OAAO;YAAE,OAAO;QACjD,MAAM,IAAI,wBAAwB,CAAC,MAAM,CAAC,CAAC;IAC7C,CAAC;IACD,MAAM,QAAQ,GAAG,2BAA2B,CAAC,GAAG,CAAC,CAAC;IAClD,IAAI,CAAC,cAAc,CAAC,MAAM,CAAC,KAAK,EAAE,QAAQ,EAAE,MAAM,CAAC,EAAE,CAAC;QACpD,MAAM,IAAI,wBAAwB,CAAC,MAAM,CAAC,CAAC;IAC7C,CAAC;IACD,MAAM,mBAAmB,CAAC,IAAI,EAAE,GAAG,CAAC,SAAS,EAAE,MAAM,EAAE,MAAM,CAAC,CAAC;IAC/D,IAAI,SAAS,KAAK,MAAM,IAAI,CAAC,cAAc,CAAC,MAAM,CAAC,KAAK,EAAE,QAAQ,EAAE,OAAO,CAAC,EAAE,CAAC;QAC7E,MAAM,IAAI,2BAA2B,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC;IAC3D,CAAC;IACD,MAAM,QAAQ,GAAG,MAAM,wBAAwB,CAAC,MAAM,EAAE,GAAG,EAAE,GAAG,EAAE,MAAM,CAAC,CAAC;IAC1E,IAAI,CAAC,QAAQ,CAAC,SAAS,CAAC,EAAE,CAAC;QACzB,MAAM,IAAI,2BAA2B,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC;IAC3D,CAAC;AACH,CAAC"}
+{"version":3,"file":"uriPermission.js","sourceRoot":"","sources":["../../../../src/domain/access/uriPermission.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,cAAc,EAAE,MAAM,oCAAoC,CAAC;AAEpE,OAAO,EAAE,2BAA2B,EAAE,MAAM,sBAAsB,CAAC;AACnE,OAAO,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AAChD,OAAO,EAAE,aAAa,EAAE,MAAM,WAAW,CAAC;AAC1C,OAAO,EAAE,wBAAwB,EAAE,MAAM,wBAAwB,CAAC;AAElE,OAAO,EAAE,wBAAwB,EAAE,2BAA2B,EAAE,iBAAiB,EAAE,MAAM,oBAAoB,CAAC;AAE9G,OAAO,EAAE,mBAAmB,EAA0B,MAAM,oBAAoB,CAAC;AAOjF;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAyCG;AACH,MAAM,CAAC,KAAK,UAAU,kBAAkB,CACtC,IAAuB,EACvB,GAAqB,EACrB,GAAW,EACX,SAAoC,EACpC,WAA8C;IAE9C,IAAI,CAAC,IAAI,CAAC,aAAa;QAAE,OAAO;IAChC,MAAM,MAAM,GAAG,aAAa,CAAC,GAAG,CAAC,CAAC;IAClC,IAAI,MAA2B,CAAC;IAChC,IAAI,WAAW,EAAE,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC;QAC7B,MAAM,GAAG,WAAW,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,IAAI,CAAC;IAC3C,CAAC;SAAM,CAAC;QACN,MAAM,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC,GAAG,CACnC,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,SAAS,EAAE,GAAG,CAAC,SAAS,EAAE,EAChD,MAAM,CACP,CAAC;QACF,WAAW,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACnC,CAAC;IACD,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,IAAI,gBAAgB,CAAC,MAAM,CAAC,KAAK,OAAO;YAAE,OAAO;QACjD,MAAM,IAAI,wBAAwB,CAAC,MAAM,CAAC,CAAC;IAC7C,CAAC;IACD,MAAM,QAAQ,GAAG,2BAA2B,CAAC,GAAG,CAAC,CAAC;IAClD,IAAI,CAAC,cAAc,CAAC,MAAM,CAAC,KAAK,EAAE,QAAQ,EAAE,MAAM,EAAE,iBAAiB,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,EAAE,CAAC;QAC1F,MAAM,IAAI,wBAAwB,CAAC,MAAM,CAAC,CAAC;IAC7C,CAAC;IACD,MAAM,mBAAmB,CAAC,IAAI,EAAE,GAAG,CAAC,SAAS,EAAE,MAAM,EAAE,MAAM,CAAC,CAAC;IAC/D,IAAI,SAAS,KAAK,MAAM,IAAI,CAAC,cAAc,CAAC,MAAM,CAAC,KAAK,EAAE,QAAQ,EAAE,OAAO,EAAE,iBAAiB,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,EAAE,CAAC;QACnH,MAAM,IAAI,2BAA2B,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC;IAC3D,CAAC;IACD,MAAM,QAAQ,GAAG,MAAM,wBAAwB,CAAC,MAAM,EAAE,GAAG,EAAE,GAAG,EAAE,MAAM,CAAC,CAAC;IAC1E,IAAI,CAAC,QAAQ,CAAC,SAAS,CAAC,EAAE,CAAC;QACzB,MAAM,IAAI,2BAA2B,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC;IAC3D,CAAC;AACH,CAAC"}

package/dist/src/domain/byteRange.d.ts

@@ -0,0 +1,15 @@
+/**
+ * One `bytes=` range against a body of `size` bytes: `[start, end]` inclusive,
+ * `'unsatisfiable'` (416), or `null` when the header is absent, malformed or
+ * names several ranges — those get the whole body (RFC 9110 §14.2 lets a
+ * server ignore a Range it does not support).
+ */
+export declare function parseByteRange(header: string | null | undefined, size: number): [number, number] | 'unsatisfiable' | null;
+/**
+ * The most bytes ONE ranged answer carries (8 MiB). A range wider than this —
+ * a player's open-ended `bytes=0-` — is answered with its first 8 MiB and a
+ * `Content-Range` saying so; the client asks for the rest. This is what keeps a
+ * 206 memory-bounded however large the file is.
+ */
+export declare const RAW_RANGE_MAX_BYTES: number;
+//# sourceMappingURL=byteRange.d.ts.map

package/dist/src/domain/byteRange.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"byteRange.d.ts","sourceRoot":"","sources":["../../../src/domain/byteRange.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AACH,wBAAgB,cAAc,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,EAAE,IAAI,EAAE,MAAM,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,eAAe,GAAG,IAAI,CAYzH;AAED;;;;;GAKG;AACH,eAAO,MAAM,mBAAmB,QAAkB,CAAC"}

package/dist/src/domain/byteRange.js

@@ -0,0 +1,30 @@
+/**
+ * One `bytes=` range against a body of `size` bytes: `[start, end]` inclusive,
+ * `'unsatisfiable'` (416), or `null` when the header is absent, malformed or
+ * names several ranges — those get the whole body (RFC 9110 §14.2 lets a
+ * server ignore a Range it does not support).
+ */
+export function parseByteRange(header, size) {
+    const match = /^bytes=(\d*)-(\d*)$/.exec(String(header ?? '').trim());
+    if (!match || (match[1] === '' && match[2] === ''))
+        return null;
+    if (match[1] === '') {
+        const suffix = Number(match[2]);
+        if (suffix === 0 || size === 0)
+            return 'unsatisfiable';
+        return [Math.max(0, size - suffix), size - 1];
+    }
+    const start = Number(match[1]);
+    if (start >= size)
+        return 'unsatisfiable';
+    const end = match[2] === '' ? size - 1 : Math.min(Number(match[2]), size - 1);
+    return end < start ? null : [start, end];
+}
+/**
+ * The most bytes ONE ranged answer carries (8 MiB). A range wider than this —
+ * a player's open-ended `bytes=0-` — is answered with its first 8 MiB and a
+ * `Content-Range` saying so; the client asks for the rest. This is what keeps a
+ * 206 memory-bounded however large the file is.
+ */
+export const RAW_RANGE_MAX_BYTES = 8 * 1024 * 1024;
+//# sourceMappingURL=byteRange.js.map

package/dist/src/domain/byteRange.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"byteRange.js","sourceRoot":"","sources":["../../../src/domain/byteRange.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AACH,MAAM,UAAU,cAAc,CAAC,MAAiC,EAAE,IAAY;IAC5E,MAAM,KAAK,GAAG,qBAAqB,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;IACtE,IAAI,CAAC,KAAK,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,EAAE,IAAI,KAAK,CAAC,CAAC,CAAC,KAAK,EAAE,CAAC;QAAE,OAAO,IAAI,CAAC;IAChE,IAAI,KAAK,CAAC,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC;QACpB,MAAM,MAAM,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;QAChC,IAAI,MAAM,KAAK,CAAC,IAAI,IAAI,KAAK,CAAC;YAAE,OAAO,eAAe,CAAC;QACvD,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,GAAG,MAAM,CAAC,EAAE,IAAI,GAAG,CAAC,CAAC,CAAC;IAChD,CAAC;IACD,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;IAC/B,IAAI,KAAK,IAAI,IAAI;QAAE,OAAO,eAAe,CAAC;IAC1C,MAAM,GAAG,GAAG,KAAK,CAAC,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,IAAI,GAAG,CAAC,CAAC,CAAC;IAC9E,OAAO,GAAG,GAAG,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;AAC3C,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,MAAM,mBAAmB,GAAG,CAAC,GAAG,IAAI,GAAG,IAAI,CAAC"}

package/dist/src/domain/defaultPermissions.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"defaultPermissions.d.ts","sourceRoot":"","sources":["../../../src/domain/defaultPermissions.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,mBAAmB,CAAC;AAEjE;;;;;;;;;GASG;AACH,eAAO,MAAM,4BAA4B,UAwGxC,CAAC;AAEF;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,wBAAwB,EAAE,uBAGtC,CAAC;AAEF;;;;;GAKG;AACH,eAAO,MAAM,4BAA4B,EAAE,uBAG1C,CAAC;AAEF;;;;;GAKG;AACH,eAAO,MAAM,yBAAyB,EAAE,uBAMvC,CAAC"}
+{"version":3,"file":"defaultPermissions.d.ts","sourceRoot":"","sources":["../../../src/domain/defaultPermissions.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,mBAAmB,CAAC;AAEjE;;;;;;;;;GASG;AACH,eAAO,MAAM,4BAA4B,UAqIxC,CAAC;AAEF;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,wBAAwB,EAAE,uBAGtC,CAAC;AAEF;;;;;GAKG;AACH,eAAO,MAAM,4BAA4B,EAAE,uBAG1C,CAAC;AAEF;;;;;GAKG;AACH,eAAO,MAAM,yBAAyB,EAAE,uBAMvC,CAAC"}

package/dist/src/domain/defaultPermissions.js

@@ -118,6 +118,35 @@ export const DEFAULT_QDRANT_SYNC_EXCLUDES = [
     '**/.config/chromium/**',
     '**/.config/google-chrome/**',
     '**/.mozilla/**',
+    // A Neuralis device's own credentials: the CLI sign-in (Linux, macOS,
+    // Windows) and the device folder — every host's link secret — and the
+    // Neuralis host's own data in the same home, for a source that covers it
+    // (a whole-host or drive-root source): keys, users and platform config,
+    // each project's conversations and notifications, the backups. Named
+    // folder by folder: a project's own files and a device's scratch live
+    // under `.neuralis` too, never exclude it whole.
+    '**/.config/neuralis/**',
+    '**/Library/Application Support/neuralis/**',
+    '**/AppData/Roaming/neuralis/**',
+    '**/.neuralis/device/**',
+    '**/.local/share/neuralis/device/**',
+    '**/.neuralis/app/**',
+    '**/.local/share/neuralis/app/**',
+    '**/.neuralis/projects/*/data/**',
+    '**/.local/share/neuralis/projects/*/data/**',
+    '**/.neuralis/projects/*/notifications/**',
+    '**/.local/share/neuralis/projects/*/notifications/**',
+    '**/.neuralis/checkpoints/**',
+    '**/.local/share/neuralis/checkpoints/**',
+    '**/.neuralis/qdrant-backups/**',
+    '**/.local/share/neuralis/qdrant-backups/**',
+    '**/.neuralis/build/**',
+    '**/.local/share/neuralis/build/**',
+    '**/.neuralis/qdrant-version.json',
+    '**/.local/share/neuralis/qdrant-version.json',
+    // The pending OAuth sign-in store under the App Zone: a PKCE code verifier,
+    // the OAuth state and the captured sink for each sign-in in flight.
+    '**/oauth-flows/**',
 ];
 /**
  * data — generic frame applied at source creation. Every per-package

package/dist/src/domain/defaultPermissions.js.map

@@ -1 +1 @@
-{"version":3,"file":"defaultPermissions.js","sourceRoot":"","sources":["../../../src/domain/defaultPermissions.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAIH;;;;;;;;;GASG;AACH,MAAM,CAAC,MAAM,4BAA4B,GAAG;IAC1C,iBAAiB;IACjB,oBAAoB;IACpB,2EAA2E;IAC3E,0EAA0E;IAC1E,6DAA6D;IAC7D,gBAAgB;IAChB,mBAAmB;IACnB,gBAAgB;IAChB,mBAAmB;IACnB,SAAS;IACT,YAAY;IACZ,iBAAiB;IACjB,oBAAoB;IACpB,gBAAgB;IAChB,mBAAmB;IACnB,UAAU;IACV,aAAa;IACb,SAAS;IACT,YAAY;IACZ,UAAU;IACV,aAAa;IACb,QAAQ;IACR,WAAW;IACX,eAAe;IACf,kBAAkB;IAClB,QAAQ;IACR,WAAW;IACX,MAAM;IACN,SAAS;IACT,QAAQ;IACR,WAAW;IACX,OAAO;IACP,UAAU;IACV,OAAO;IACP,UAAU;IACV,QAAQ;IACR,WAAW;IACX,YAAY;IACZ,eAAe;IACf,gBAAgB;IAChB,mBAAmB;IACnB,WAAW;IACX,cAAc;IACd,4EAA4E;IAC5E,4EAA4E;IAC5E,2EAA2E;IAC3E,0EAA0E;IAC1E,6EAA6E;IAC7E,4EAA4E;IAC5E,6DAA6D;IAC7D,SAAS;IACT,YAAY;IACZ,YAAY;IACZ,4EAA4E;IAC5E,0EAA0E;IAC1E,0BAA0B;IAC1B,4EAA4E;IAC5E,4EAA4E;IAC5E,2EAA2E;IAC3E,sEAAsE;IACtE,6DAA6D;IAC7D,wBAAwB;IACxB,2BAA2B;IAC3B,yEAAyE;IACzE,2EAA2E;IAC3E,4EAA4E;IAC5E,yEAAyE;IACzE,uEAAuE;IACvE,wEAAwE;IACxE,4EAA4E;IAC5E,uEAAuE;IACvE,yEAAyE;IACzE,kEAAkE;IAClE,0EAA0E;IAC1E,YAAY;IACZ,cAAc;IACd,yEAAyE;IACzE,kEAAkE;IAClE,0EAA0E;IAC1E,qEAAqE;IACrE,uEAAuE;IACvE,2EAA2E;IAC3E,4DAA4D;IAC5D,YAAY;IACZ,wBAAwB;IACxB,YAAY;IACZ,YAAY;IACZ,cAAc;IACd,aAAa;IACb,eAAe;IACf,6BAA6B;IAC7B,sBAAsB;IACtB,kBAAkB;IAClB,sBAAsB;IACtB,WAAW;IACX,qBAAqB;IACrB,WAAW;IACX,YAAY;IACZ,6EAA6E;IAC7E,4BAA4B;IAC5B,wBAAwB;IACxB,6BAA6B;IAC7B,gBAAgB;CACjB,CAAC;AAEF;;;;;;;;;;;GAWG;AACH,MAAM,CAAC,MAAM,wBAAwB,GAA4B;IAC/D,OAAO,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE;IACjD,KAAK,EAAE,EAAE;CACV,CAAC;AAEF;;;;;GAKG;AACH,MAAM,CAAC,MAAM,4BAA4B,GAA4B;IACnE,OAAO,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE;IACjD,KAAK,EAAE,EAAE;CACV,CAAC;AAEF;;;;;GAKG;AACH,MAAM,CAAC,MAAM,yBAAyB,GAA4B;IAChE,OAAO,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE;IACjD,MAAM,EAAE;QACN,MAAM,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE;KACzB;IACD,KAAK,EAAE,EAAE;CACV,CAAC"}
+{"version":3,"file":"defaultPermissions.js","sourceRoot":"","sources":["../../../src/domain/defaultPermissions.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAIH;;;;;;;;;GASG;AACH,MAAM,CAAC,MAAM,4BAA4B,GAAG;IAC1C,iBAAiB;IACjB,oBAAoB;IACpB,2EAA2E;IAC3E,0EAA0E;IAC1E,6DAA6D;IAC7D,gBAAgB;IAChB,mBAAmB;IACnB,gBAAgB;IAChB,mBAAmB;IACnB,SAAS;IACT,YAAY;IACZ,iBAAiB;IACjB,oBAAoB;IACpB,gBAAgB;IAChB,mBAAmB;IACnB,UAAU;IACV,aAAa;IACb,SAAS;IACT,YAAY;IACZ,UAAU;IACV,aAAa;IACb,QAAQ;IACR,WAAW;IACX,eAAe;IACf,kBAAkB;IAClB,QAAQ;IACR,WAAW;IACX,MAAM;IACN,SAAS;IACT,QAAQ;IACR,WAAW;IACX,OAAO;IACP,UAAU;IACV,OAAO;IACP,UAAU;IACV,QAAQ;IACR,WAAW;IACX,YAAY;IACZ,eAAe;IACf,gBAAgB;IAChB,mBAAmB;IACnB,WAAW;IACX,cAAc;IACd,4EAA4E;IAC5E,4EAA4E;IAC5E,2EAA2E;IAC3E,0EAA0E;IAC1E,6EAA6E;IAC7E,4EAA4E;IAC5E,6DAA6D;IAC7D,SAAS;IACT,YAAY;IACZ,YAAY;IACZ,4EAA4E;IAC5E,0EAA0E;IAC1E,0BAA0B;IAC1B,4EAA4E;IAC5E,4EAA4E;IAC5E,2EAA2E;IAC3E,sEAAsE;IACtE,6DAA6D;IAC7D,wBAAwB;IACxB,2BAA2B;IAC3B,yEAAyE;IACzE,2EAA2E;IAC3E,4EAA4E;IAC5E,yEAAyE;IACzE,uEAAuE;IACvE,wEAAwE;IACxE,4EAA4E;IAC5E,uEAAuE;IACvE,yEAAyE;IACzE,kEAAkE;IAClE,0EAA0E;IAC1E,YAAY;IACZ,cAAc;IACd,yEAAyE;IACzE,kEAAkE;IAClE,0EAA0E;IAC1E,qEAAqE;IACrE,uEAAuE;IACvE,2EAA2E;IAC3E,4DAA4D;IAC5D,YAAY;IACZ,wBAAwB;IACxB,YAAY;IACZ,YAAY;IACZ,cAAc;IACd,aAAa;IACb,eAAe;IACf,6BAA6B;IAC7B,sBAAsB;IACtB,kBAAkB;IAClB,sBAAsB;IACtB,WAAW;IACX,qBAAqB;IACrB,WAAW;IACX,YAAY;IACZ,6EAA6E;IAC7E,4BAA4B;IAC5B,wBAAwB;IACxB,6BAA6B;IAC7B,gBAAgB;IAChB,sEAAsE;IACtE,sEAAsE;IACtE,yEAAyE;IACzE,wEAAwE;IACxE,qEAAqE;IACrE,sEAAsE;IACtE,iDAAiD;IACjD,wBAAwB;IACxB,4CAA4C;IAC5C,gCAAgC;IAChC,wBAAwB;IACxB,oCAAoC;IACpC,qBAAqB;IACrB,iCAAiC;IACjC,iCAAiC;IACjC,6CAA6C;IAC7C,0CAA0C;IAC1C,sDAAsD;IACtD,6BAA6B;IAC7B,yCAAyC;IACzC,gCAAgC;IAChC,4CAA4C;IAC5C,uBAAuB;IACvB,mCAAmC;IACnC,kCAAkC;IAClC,8CAA8C;IAC9C,4EAA4E;IAC5E,oEAAoE;IACpE,mBAAmB;CACpB,CAAC;AAEF;;;;;;;;;;;GAWG;AACH,MAAM,CAAC,MAAM,wBAAwB,GAA4B;IAC/D,OAAO,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE;IACjD,KAAK,EAAE,EAAE;CACV,CAAC;AAEF;;;;;GAKG;AACH,MAAM,CAAC,MAAM,4BAA4B,GAA4B;IACnE,OAAO,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE;IACjD,KAAK,EAAE,EAAE;CACV,CAAC;AAEF;;;;;GAKG;AACH,MAAM,CAAC,MAAM,yBAAyB,GAA4B;IAChE,OAAO,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE;IACjD,MAAM,EAAE;QACN,MAAM,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE;KACzB;IACD,KAAK,EAAE,EAAE;CACV,CAAC"}

package/dist/src/domain/mime.d.ts

@@ -4,8 +4,9 @@
  * Two jobs live here, and they are deliberately different layers:
  *
  *  1. **Resolution** (`inferMimeTypeFromFilename`, `looksTextByMime`) — what a
- *     file's type honestly IS. Moved here from `FilesystemUiService` so the
- *     serve path and the store path answer from the same table.
+ *     file's type honestly IS, so the serve path and the store path answer from
+ *     the same table. The extension tables themselves are the kernel's
+ *     (`@neuralis/package-system/web-common`), re-exported below.
  *  2. **Response policy** (`classifyResponseMime`, `buildRawResponseHeaders`) —
  *     what the byte lane is allowed to tell a BROWSER to do with those bytes.
  *
@@ -16,7 +17,7 @@
  *
  * ## The rule the policy encodes
  *
- * A member with `drive.write` can put arbitrary bytes at a URI another member
+ * A member with `files.write` can put arbitrary bytes at a URI another member
  * can read. If the byte lane then serves those bytes as a DOCUMENT on the app
  * origin (`content-type: image/svg+xml` + `content-disposition: inline`), the
  * document's script runs with the READER's session. That is a stored-XSS
@@ -67,7 +68,7 @@
  * multipart part type), by the write engine's create lane (the caller's
  * `fields.metadata`), and by its `fields` verb (a metadata PATCH — historically
  * the least guarded of the three, because the deleted `modify` route excluded
- * `set_fields` from the uri-policy check). All three are `drive.write`. `normalizeStoredMimeType` and
+ * `set_fields` from the uri-policy check). All three are `files.write`. `normalizeStoredMimeType` and
  * `normalizeNodeMetadataMime` below close all three; each one left open keeps
  * the classification input caller-controlled. The first round of this fix closed
  * only ONE, the architect's review found the second, and the live run found the
@@ -79,17 +80,8 @@
  * `FilesystemUiService` excludes the active-document class at that one site for
  * exactly this reason — the body is JSON and the wire should say so.
  */
+export { binaryMimeTypeForPath, inferMimeTypeFromFilename } from '@neuralis/package-system/web-common';
 export declare function looksTextByMime(mimeType: string | undefined): boolean;
-/**
- * Extension → mime, for files whose stored metadata carries no type.
- *
- * The five document extensions at the end are NOT decoration: they make the
- * extension agree with `classifyResponseMime`'s active-document set, so an
- * `.html` or `.xml` file reports what it is instead of `application/octet-stream`
- * and is classified on its merits. Both land on `attachment` either way — this
- * only removes a lie from the wire.
- */
-export declare function inferMimeTypeFromFilename(filename: string): string;
 /**
  * Lowercase `type/subtype`, parameters dropped, syntactically validated.
  * Returns `null` for anything absent, over-long or not token-shaped — the
@@ -141,9 +133,10 @@ export declare function buildRawResponseHeaders(input: RawResponseHeaderInput):
  *
  * **SCOPE, measured live — the magic-byte check governs the STORED value, and
  * on a non-brain source it does NOT reach the wire.** `loadRawBytes` returns
- * `result.mimeType || mimeType` for `sourceKind !== 'brain'`, so the local
- * connector's own extension-derived type wins over the persisted metadata at
- * serve time. HTML bytes stored as `application/octet-stream` under the name
+ * the connector's type for `sourceKind !== 'brain'` whenever the connector can
+ * tell (anything but `application/octet-stream`, the contract's "cannot
+ * tell"), so the local connector's own extension-derived type wins over the
+ * persisted metadata at serve time. HTML bytes stored as `application/octet-stream` under the name
  * `x.png` are therefore SERVED `image/png`. That is bounded and not a hole: the
  * classification still runs on the extension, so `.svg`/`.html`/`.xml` stay
  * `attachment`, and a mislabelled raster is inert under the globally-present
@@ -159,7 +152,7 @@ export declare function normalizeStoredMimeType(declared: string | undefined, fi
  *
  * `metadata.mimeType` has THREE writers — the byte lane (the multipart part
  * type), the write engine's create lane and its `fields` verb. All are
- * `drive.write`, a MEMBER default on the seeded `data` source, and the field is
+ * `files.write`, a MEMBER default on the seeded `data` source, and the field is
  * the FIRST thing `loadRawBytes` reads — i.e. the input the byte lane's
  * classifier rules on. Normalizing only one writer leaves that input
  * caller-controlled, so all three go through here. The `fields` verb
@@ -171,5 +164,4 @@ export declare function normalizeStoredMimeType(declared: string | undefined, fi
  * for every other reader of that request.
  */
 export declare function normalizeNodeMetadataMime(metadata: unknown, filename: string): Record<string, unknown> | undefined;
-export declare function binaryMimeTypeForPath(filePath: string): string | undefined;
 //# sourceMappingURL=mime.d.ts.map

package/dist/src/domain/mime.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"mime.d.ts","sourceRoot":"","sources":["../../../src/domain/mime.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgFG;AAWH,wBAAgB,eAAe,CAAC,QAAQ,EAAE,MAAM,GAAG,SAAS,GAAG,OAAO,CAGrE;AAED;;;;;;;;GAQG;AACH,wBAAgB,yBAAyB,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,CAmBlE;AAED;;;;GAIG;AACH,wBAAgB,gBAAgB,CAAC,GAAG,EAAE,MAAM,GAAG,SAAS,GAAG,IAAI,GAAG,MAAM,GAAG,IAAI,CAI9E;AAED,MAAM,MAAM,iBAAiB,GAAG,QAAQ,GAAG,iBAAiB,GAAG,QAAQ,CAAC;AAsBxE;;;;;GAKG;AACH,wBAAgB,oBAAoB,CAAC,OAAO,EAAE,MAAM,GAAG,IAAI,GAAG,iBAAiB,CAS9E;AA4BD,MAAM,MAAM,sBAAsB,GAAG;IACnC,oFAAoF;IACpF,QAAQ,EAAE,MAAM,GAAG,SAAS,CAAC;IAC7B,QAAQ,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC9B,IAAI,EAAE,MAAM,CAAC;CACd,CAAC;AAEF;;;;;;;GAOG;AACH,wBAAgB,uBAAuB,CAAC,KAAK,EAAE,sBAAsB,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAqB7F;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiCG;AACH,wBAAgB,uBAAuB,CACrC,QAAQ,EAAE,MAAM,GAAG,SAAS,EAC5B,QAAQ,EAAE,MAAM,EAChB,KAAK,CAAC,EAAE,UAAU,GACjB,MAAM,CAaR;AAED;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,yBAAyB,CACvC,QAAQ,EAAE,OAAO,EACjB,QAAQ,EAAE,MAAM,GACf,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,SAAS,CASrC;AA8CD,wBAAgB,qBAAqB,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAI1E"}
+{"version":3,"file":"mime.d.ts","sourceRoot":"","sources":["../../../src/domain/mime.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiFG;AAMH,OAAO,EAAE,qBAAqB,EAAE,yBAAyB,EAAE,MAAM,qCAAqC,CAAC;AAQvG,wBAAgB,eAAe,CAAC,QAAQ,EAAE,MAAM,GAAG,SAAS,GAAG,OAAO,CAGrE;AAGD;;;;GAIG;AACH,wBAAgB,gBAAgB,CAAC,GAAG,EAAE,MAAM,GAAG,SAAS,GAAG,IAAI,GAAG,MAAM,GAAG,IAAI,CAI9E;AAED,MAAM,MAAM,iBAAiB,GAAG,QAAQ,GAAG,iBAAiB,GAAG,QAAQ,CAAC;AAsBxE;;;;;GAKG;AACH,wBAAgB,oBAAoB,CAAC,OAAO,EAAE,MAAM,GAAG,IAAI,GAAG,iBAAiB,CAS9E;AA4BD,MAAM,MAAM,sBAAsB,GAAG;IACnC,oFAAoF;IACpF,QAAQ,EAAE,MAAM,GAAG,SAAS,CAAC;IAC7B,QAAQ,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC9B,IAAI,EAAE,MAAM,CAAC;CACd,CAAC;AAEF;;;;;;;GAOG;AACH,wBAAgB,uBAAuB,CAAC,KAAK,EAAE,sBAAsB,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAqB7F;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAkCG;AACH,wBAAgB,uBAAuB,CACrC,QAAQ,EAAE,MAAM,GAAG,SAAS,EAC5B,QAAQ,EAAE,MAAM,EAChB,KAAK,CAAC,EAAE,UAAU,GACjB,MAAM,CAaR;AAED;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,yBAAyB,CACvC,QAAQ,EAAE,OAAO,EACjB,QAAQ,EAAE,MAAM,GACf,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,SAAS,CASrC"}