@neuralis/brain-core 0.3.1 → 0.4.0

package/dist/src/domain/mime.js

@@ -4,8 +4,9 @@
  * Two jobs live here, and they are deliberately different layers:
  *
  *  1. **Resolution** (`inferMimeTypeFromFilename`, `looksTextByMime`) — what a
- *     file's type honestly IS. Moved here from `FilesystemUiService` so the
- *     serve path and the store path answer from the same table.
+ *     file's type honestly IS, so the serve path and the store path answer from
+ *     the same table. The extension tables themselves are the kernel's
+ *     (`@neuralis/package-system/web-common`), re-exported below.
  *  2. **Response policy** (`classifyResponseMime`, `buildRawResponseHeaders`) —
  *     what the byte lane is allowed to tell a BROWSER to do with those bytes.
  *
@@ -16,7 +17,7 @@
  *
  * ## The rule the policy encodes
  *
- * A member with `drive.write` can put arbitrary bytes at a URI another member
+ * A member with `files.write` can put arbitrary bytes at a URI another member
  * can read. If the byte lane then serves those bytes as a DOCUMENT on the app
  * origin (`content-type: image/svg+xml` + `content-disposition: inline`), the
  * document's script runs with the READER's session. That is a stored-XSS
@@ -67,7 +68,7 @@
  * multipart part type), by the write engine's create lane (the caller's
  * `fields.metadata`), and by its `fields` verb (a metadata PATCH — historically
  * the least guarded of the three, because the deleted `modify` route excluded
- * `set_fields` from the uri-policy check). All three are `drive.write`. `normalizeStoredMimeType` and
+ * `set_fields` from the uri-policy check). All three are `files.write`. `normalizeStoredMimeType` and
  * `normalizeNodeMetadataMime` below close all three; each one left open keeps
  * the classification input caller-controlled. The first round of this fix closed
  * only ONE, the architect's review found the second, and the live run found the
@@ -79,8 +80,10 @@
  * `FilesystemUiService` excludes the active-document class at that one site for
  * exactly this reason — the body is JSON and the wire should say so.
  */
-import { matchesMagic, MIN_MAGIC_BYTES } from '@neuralis/package-system/web-common';
+import { inferMimeTypeFromFilename, matchesMagic, MIN_MAGIC_BYTES } from '@neuralis/package-system/web-common';
 import { sanitizeFilename } from './paths.js';
+// The extension tables are the kernel's (`web-common/fileMime.ts`) — agent-core's device connector reads them too.
+export { binaryMimeTypeForPath, inferMimeTypeFromFilename } from '@neuralis/package-system/web-common';
 /** Longest mime essence we will echo; anything longer is treated as garbage. */
 const MAX_MIME_ESSENCE_LENGTH = 255;
 /** `type/subtype` in RFC 9110 token characters, nothing else. */
@@ -89,51 +92,6 @@ export function looksTextByMime(mimeType) {
     const mime = String(mimeType || '').toLowerCase();
     return mime.startsWith('text/') || mime === 'application/json' || mime.endsWith('+json');
 }
-/**
- * Extension → mime, for files whose stored metadata carries no type.
- *
- * The five document extensions at the end are NOT decoration: they make the
- * extension agree with `classifyResponseMime`'s active-document set, so an
- * `.html` or `.xml` file reports what it is instead of `application/octet-stream`
- * and is classified on its merits. Both land on `attachment` either way — this
- * only removes a lie from the wire.
- */
-export function inferMimeTypeFromFilename(filename) {
-    const lower = filename.toLowerCase();
-    if (lower.endsWith('.png'))
-        return 'image/png';
-    if (lower.endsWith('.jpg') || lower.endsWith('.jpeg'))
-        return 'image/jpeg';
-    if (lower.endsWith('.webp'))
-        return 'image/webp';
-    if (lower.endsWith('.gif'))
-        return 'image/gif';
-    if (lower.endsWith('.svg'))
-        return 'image/svg+xml';
-    if (lower.endsWith('.mp4'))
-        return 'video/mp4';
-    if (lower.endsWith('.webm'))
-        return 'video/webm';
-    if (lower.endsWith('.mp3'))
-        return 'audio/mpeg';
-    if (lower.endsWith('.wav'))
-        return 'audio/wav';
-    if (lower.endsWith('.json'))
-        return 'application/json; charset=utf-8';
-    if (lower.endsWith('.md'))
-        return 'text/markdown; charset=utf-8';
-    if (lower.endsWith('.txt'))
-        return 'text/plain; charset=utf-8';
-    if (lower.endsWith('.html') || lower.endsWith('.htm'))
-        return 'text/html; charset=utf-8';
-    if (lower.endsWith('.xhtml'))
-        return 'application/xhtml+xml';
-    if (lower.endsWith('.xml'))
-        return 'text/xml; charset=utf-8';
-    if (lower.endsWith('.xsl') || lower.endsWith('.xslt'))
-        return 'application/xslt+xml';
-    return 'application/octet-stream';
-}
 /**
  * Lowercase `type/subtype`, parameters dropped, syntactically validated.
  * Returns `null` for anything absent, over-long or not token-shaped — the
@@ -252,9 +210,10 @@ export function buildRawResponseHeaders(input) {
  *
  * **SCOPE, measured live — the magic-byte check governs the STORED value, and
  * on a non-brain source it does NOT reach the wire.** `loadRawBytes` returns
- * `result.mimeType || mimeType` for `sourceKind !== 'brain'`, so the local
- * connector's own extension-derived type wins over the persisted metadata at
- * serve time. HTML bytes stored as `application/octet-stream` under the name
+ * the connector's type for `sourceKind !== 'brain'` whenever the connector can
+ * tell (anything but `application/octet-stream`, the contract's "cannot
+ * tell"), so the local connector's own extension-derived type wins over the
+ * persisted metadata at serve time. HTML bytes stored as `application/octet-stream` under the name
  * `x.png` are therefore SERVED `image/png`. That is bounded and not a hole: the
  * classification still runs on the extension, so `.svg`/`.html`/`.xml` stay
  * `attachment`, and a mislabelled raster is inert under the globally-present
@@ -280,7 +239,7 @@ export function normalizeStoredMimeType(declared, filename, bytes) {
  *
  * `metadata.mimeType` has THREE writers — the byte lane (the multipart part
  * type), the write engine's create lane and its `fields` verb. All are
- * `drive.write`, a MEMBER default on the seeded `data` source, and the field is
+ * `files.write`, a MEMBER default on the seeded `data` source, and the field is
  * the FIRST thing `loadRawBytes` reads — i.e. the input the byte lane's
  * classifier rules on. Normalizing only one writer leaves that input
  * caller-controlled, so all three go through here. The `fields` verb
@@ -300,52 +259,4 @@ export function normalizeNodeMetadataMime(metadata, filename) {
     bag.mimeType = normalizeStoredMimeType(typeof bag.mimeType === 'string' ? bag.mimeType : undefined, filename);
     return bag;
 }
-const BINARY_READ_MIME_BY_EXTENSION = new Map([
-    ['.wasm', 'application/wasm'],
-    ['.png', 'image/png'],
-    ['.jpg', 'image/jpeg'],
-    ['.jpeg', 'image/jpeg'],
-    ['.gif', 'image/gif'],
-    ['.webp', 'image/webp'],
-    ['.ico', 'image/x-icon'],
-    ['.bmp', 'image/bmp'],
-    ['.mp4', 'video/mp4'],
-    ['.webm', 'video/webm'],
-    ['.avi', 'video/x-msvideo'],
-    ['.mov', 'video/quicktime'],
-    ['.mkv', 'video/x-matroska'],
-    ['.mp3', 'audio/mpeg'],
-    ['.wav', 'audio/wav'],
-    ['.ogg', 'audio/ogg'],
-    ['.flac', 'audio/flac'],
-    ['.aac', 'audio/aac'],
-    ['.m4a', 'audio/mp4'],
-    ['.zip', 'application/zip'],
-    ['.tar', 'application/x-tar'],
-    ['.gz', 'application/gzip'],
-    ['.bz2', 'application/x-bzip2'],
-    ['.7z', 'application/x-7z-compressed'],
-    ['.rar', 'application/vnd.rar'],
-    ['.pdf', 'application/pdf'],
-    ['.doc', 'application/msword'],
-    ['.docx', 'application/vnd.openxmlformats-officedocument.wordprocessingml.document'],
-    ['.xls', 'application/vnd.ms-excel'],
-    ['.xlsx', 'application/vnd.openxmlformats-officedocument.spreadsheetml.sheet'],
-    ['.ppt', 'application/vnd.ms-powerpoint'],
-    ['.pptx', 'application/vnd.openxmlformats-officedocument.presentationml.presentation'],
-    ['.exe', 'application/octet-stream'],
-    ['.dll', 'application/octet-stream'],
-    ['.so', 'application/octet-stream'],
-    ['.dylib', 'application/octet-stream'],
-    ['.ttf', 'font/ttf'],
-    ['.otf', 'font/otf'],
-    ['.woff', 'font/woff'],
-    ['.woff2', 'font/woff2'],
-    ['.eot', 'application/vnd.ms-fontobject'],
-]);
-export function binaryMimeTypeForPath(filePath) {
-    const name = filePath.slice(filePath.lastIndexOf('/') + 1);
-    const dot = name.lastIndexOf('.');
-    return dot > 0 ? BINARY_READ_MIME_BY_EXTENSION.get(name.slice(dot).toLowerCase()) : undefined;
-}
 //# sourceMappingURL=mime.js.map

package/dist/src/domain/mime.js.map

@@ -1 +1 @@
-{"version":3,"file":"mime.js","sourceRoot":"","sources":["../../../src/domain/mime.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgFG;AAEH,OAAO,EAAE,YAAY,EAAE,eAAe,EAAE,MAAM,qCAAqC,CAAC;AACpF,OAAO,EAAE,gBAAgB,EAAE,MAAM,YAAY,CAAC;AAE9C,gFAAgF;AAChF,MAAM,uBAAuB,GAAG,GAAG,CAAC;AAEpC,iEAAiE;AACjE,MAAM,oBAAoB,GAAG,0CAA0C,CAAC;AAExE,MAAM,UAAU,eAAe,CAAC,QAA4B;IAC1D,MAAM,IAAI,GAAG,MAAM,CAAC,QAAQ,IAAI,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC;IAClD,OAAO,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC,IAAI,IAAI,KAAK,kBAAkB,IAAI,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;AAC3F,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,yBAAyB,CAAC,QAAgB;IACxD,MAAM,KAAK,GAAG,QAAQ,CAAC,WAAW,EAAE,CAAC;IACrC,IAAI,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC;QAAE,OAAO,WAAW,CAAC;IAC/C,IAAI,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,QAAQ,CAAC,OAAO,CAAC;QAAE,OAAO,YAAY,CAAC;IAC3E,IAAI,KAAK,CAAC,QAAQ,CAAC,OAAO,CAAC;QAAE,OAAO,YAAY,CAAC;IACjD,IAAI,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC;QAAE,OAAO,WAAW,CAAC;IAC/C,IAAI,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC;QAAE,OAAO,eAAe,CAAC;IACnD,IAAI,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC;QAAE,OAAO,WAAW,CAAC;IAC/C,IAAI,KAAK,CAAC,QAAQ,CAAC,OAAO,CAAC;QAAE,OAAO,YAAY,CAAC;IACjD,IAAI,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC;QAAE,OAAO,YAAY,CAAC;IAChD,IAAI,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC;QAAE,OAAO,WAAW,CAAC;IAC/C,IAAI,KAAK,CAAC,QAAQ,CAAC,OAAO,CAAC;QAAE,OAAO,iCAAiC,CAAC;IACtE,IAAI,KAAK,CAAC,QAAQ,CAAC,KAAK,CAAC;QAAE,OAAO,8BAA8B,CAAC;IACjE,IAAI,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC;QAAE,OAAO,2BAA2B,CAAC;IAC/D,IAAI,KAAK,CAAC,QAAQ,CAAC,OAAO,CAAC,IAAI,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC;QAAE,OAAO,0BAA0B,CAAC;IACzF,IAAI,KAAK,CAAC,QAAQ,CAAC,QAAQ,CAAC;QAAE,OAAO,uBAAuB,CAAC;IAC7D,IAAI,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC;QAAE,OAAO,yBAAyB,CAAC;IAC7D,IAAI,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,QAAQ,CAAC,OAAO,CAAC;QAAE,OAAO,sBAAsB,CAAC;IACrF,OAAO,0BAA0B,CAAC;AACpC,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,gBAAgB,CAAC,GAA8B;IAC7D,MAAM,KAAK,GAAG,MAAM,CAAC,GAAG,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,WAAW,EAAE,IAAI,EAAE,CAAC;IAC1E,IAAI,CAAC,KAAK,IAAI,KAAK,CAAC,MAAM,GAAG,uBAAuB;QAAE,OAAO,IAAI,CAAC;IAClE,OAAO,oBAAoB,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC;AACzD,CAAC;AAID;;;;;GAKG;AACH,MAAM,qBAAqB,GAAG,IAAI,GAAG,CAAC;IACpC,eAAe;IACf,WAAW;IACX,WAAW;IACX,UAAU;IACV,UAAU;IACV,uBAAuB;IACvB,iBAAiB;IACjB,sBAAsB;CACvB,CAAC,CAAC;AAEH,gGAAgG;AAChG,MAAM,wBAAwB,GAAG,IAAI,GAAG,CAAC,CAAC,iBAAiB,EAAE,kBAAkB,CAAC,CAAC,CAAC;AAElF;;;;;GAKG;AACH,MAAM,UAAU,oBAAoB,CAAC,OAAsB;IACzD,IAAI,CAAC,OAAO;QAAE,OAAO,QAAQ,CAAC;IAC9B,IAAI,qBAAqB,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAC;QAAE,OAAO,iBAAiB,CAAC;IAC7F,MAAM,QAAQ,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC;IACxD,IAAI,QAAQ,KAAK,OAAO,IAAI,QAAQ,KAAK,OAAO,IAAI,QAAQ,KAAK,OAAO,IAAI,QAAQ,KAAK,MAAM,EAAE,CAAC;QAChG,OAAO,QAAQ,CAAC;IAClB,CAAC;IACD,IAAI,wBAAwB,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAC;QAAE,OAAO,QAAQ,CAAC;IACxF,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED;;;;;;GAMG;AACH,SAAS,aAAa,CAAC,KAAa;IAClC,OAAO,kBAAkB,CAAC,KAAK,CAAC,CAAC,OAAO,CACtC,UAAU,EACV,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,WAAW,EAAE,EAAE,CACxD,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACH,SAAS,uBAAuB,CAAC,WAAoC,EAAE,QAAiB;IACtF,MAAM,GAAG,GAAG,MAAM,CAAC,QAAQ,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;IAC1C,IAAI,CAAC,GAAG;QAAE,OAAO,WAAW,CAAC;IAC7B,MAAM,KAAK,GAAG,gBAAgB,CAAC,GAAG,CAAC,IAAI,MAAM,CAAC;IAC9C,OAAO,GAAG,WAAW,eAAe,KAAK,uBAAuB,aAAa,CAAC,GAAG,CAAC,EAAE,CAAC;AACvF,CAAC;AASD;;;;;;;GAOG;AACH,MAAM,UAAU,uBAAuB,CAAC,KAA6B;IACnE,MAAM,OAAO,GAAG,gBAAgB,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;IACjD,MAAM,aAAa,GAAG,oBAAoB,CAAC,OAAO,CAAC,CAAC;IAEpD,IAAI,WAAmB,CAAC;IACxB,IAAI,aAAa,KAAK,QAAQ,IAAI,OAAO,EAAE,CAAC;QAC1C,yEAAyE;QACzE,WAAW,GAAG,eAAe,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,GAAG,OAAO,iBAAiB,CAAC,CAAC,CAAC,OAAO,CAAC;IACjF,CAAC;SAAM,CAAC;QACN,WAAW,GAAG,OAAO,IAAI,0BAA0B,CAAC;IACtD,CAAC;IAED,OAAO;QACL,cAAc,EAAE,WAAW;QAC3B,gBAAgB,EAAE,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC;QACpC,qBAAqB,EAAE,uBAAuB,CAC5C,aAAa,KAAK,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,YAAY,EACpD,KAAK,CAAC,QAAQ,CACf;QACD,eAAe,EAAE,qBAAqB;KACvC,CAAC;AACJ,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiCG;AACH,MAAM,UAAU,uBAAuB,CACrC,QAA4B,EAC5B,QAAgB,EAChB,KAAkB;IAElB,MAAM,QAAQ,GAAG,gBAAgB,CAAC,yBAAyB,CAAC,QAAQ,CAAC,CAAC,CAAC;IACvE,MAAM,eAAe,GAAG,gBAAgB,CAAC,QAAQ,CAAC,CAAC;IAEnD,IAAI,QAAQ,GACV,QAAQ,IAAI,QAAQ,KAAK,0BAA0B;QACjD,CAAC,CAAC,QAAQ;QACV,CAAC,CAAC,eAAe,IAAI,0BAA0B,CAAC;IAEpD,IAAI,KAAK,IAAI,KAAK,CAAC,MAAM,IAAI,eAAe,IAAI,CAAC,YAAY,CAAC,QAAQ,EAAE,KAAK,CAAC,EAAE,CAAC;QAC/E,QAAQ,GAAG,0BAA0B,CAAC;IACxC,CAAC;IACD,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED;;;;;;;;;;;;;;;GAeG;AACH,MAAM,UAAU,yBAAyB,CACvC,QAAiB,EACjB,QAAgB;IAEhB,IAAI,CAAC,QAAQ,IAAI,OAAO,QAAQ,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC;QAAE,OAAO,SAAS,CAAC;IAC3F,MAAM,GAAG,GAAG,EAAE,GAAI,QAAoC,EAAE,CAAC;IACzD,IAAI,CAAC,CAAC,UAAU,IAAI,GAAG,CAAC;QAAE,OAAO,GAAG,CAAC;IACrC,GAAG,CAAC,QAAQ,GAAG,uBAAuB,CACpC,OAAO,GAAG,CAAC,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,SAAS,EAC3D,QAAQ,CACT,CAAC;IACF,OAAO,GAAG,CAAC;AACb,CAAC;AAED,MAAM,6BAA6B,GAAG,IAAI,GAAG,CAAiB;IAC5D,CAAC,OAAO,EAAE,kBAAkB,CAAC;IAC7B,CAAC,MAAM,EAAE,WAAW,CAAC;IACrB,CAAC,MAAM,EAAE,YAAY,CAAC;IACtB,CAAC,OAAO,EAAE,YAAY,CAAC;IACvB,CAAC,MAAM,EAAE,WAAW,CAAC;IACrB,CAAC,OAAO,EAAE,YAAY,CAAC;IACvB,CAAC,MAAM,EAAE,cAAc,CAAC;IACxB,CAAC,MAAM,EAAE,WAAW,CAAC;IACrB,CAAC,MAAM,EAAE,WAAW,CAAC;IACrB,CAAC,OAAO,EAAE,YAAY,CAAC;IACvB,CAAC,MAAM,EAAE,iBAAiB,CAAC;IAC3B,CAAC,MAAM,EAAE,iBAAiB,CAAC;IAC3B,CAAC,MAAM,EAAE,kBAAkB,CAAC;IAC5B,CAAC,MAAM,EAAE,YAAY,CAAC;IACtB,CAAC,MAAM,EAAE,WAAW,CAAC;IACrB,CAAC,MAAM,EAAE,WAAW,CAAC;IACrB,CAAC,OAAO,EAAE,YAAY,CAAC;IACvB,CAAC,MAAM,EAAE,WAAW,CAAC;IACrB,CAAC,MAAM,EAAE,WAAW,CAAC;IACrB,CAAC,MAAM,EAAE,iBAAiB,CAAC;IAC3B,CAAC,MAAM,EAAE,mBAAmB,CAAC;IAC7B,CAAC,KAAK,EAAE,kBAAkB,CAAC;IAC3B,CAAC,MAAM,EAAE,qBAAqB,CAAC;IAC/B,CAAC,KAAK,EAAE,6BAA6B,CAAC;IACtC,CAAC,MAAM,EAAE,qBAAqB,CAAC;IAC/B,CAAC,MAAM,EAAE,iBAAiB,CAAC;IAC3B,CAAC,MAAM,EAAE,oBAAoB,CAAC;IAC9B,CAAC,OAAO,EAAE,yEAAyE,CAAC;IACpF,CAAC,MAAM,EAAE,0BAA0B,CAAC;IACpC,CAAC,OAAO,EAAE,mEAAmE,CAAC;IAC9E,CAAC,MAAM,EAAE,+BAA+B,CAAC;IACzC,CAAC,OAAO,EAAE,2EAA2E,CAAC;IACtF,CAAC,MAAM,EAAE,0BAA0B,CAAC;IACpC,CAAC,MAAM,EAAE,0BAA0B,CAAC;IACpC,CAAC,KAAK,EAAE,0BAA0B,CAAC;IACnC,CAAC,QAAQ,EAAE,0BAA0B,CAAC;IACtC,CAAC,MAAM,EAAE,UAAU,CAAC;IACpB,CAAC,MAAM,EAAE,UAAU,CAAC;IACpB,CAAC,OAAO,EAAE,WAAW,CAAC;IACtB,CAAC,QAAQ,EAAE,YAAY,CAAC;IACxB,CAAC,MAAM,EAAE,+BAA+B,CAAC;CAC1C,CAAC,CAAC;AAEH,MAAM,UAAU,qBAAqB,CAAC,QAAgB;IACpD,MAAM,IAAI,GAAG,QAAQ,CAAC,KAAK,CAAC,QAAQ,CAAC,WAAW,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC;IAC3D,MAAM,GAAG,GAAG,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC;IAClC,OAAO,GAAG,GAAG,CAAC,CAAC,CAAC,CAAC,6BAA6B,CAAC,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;AAChG,CAAC"}
+{"version":3,"file":"mime.js","sourceRoot":"","sources":["../../../src/domain/mime.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiFG;AAEH,OAAO,EAAE,yBAAyB,EAAE,YAAY,EAAE,eAAe,EAAE,MAAM,qCAAqC,CAAC;AAC/G,OAAO,EAAE,gBAAgB,EAAE,MAAM,YAAY,CAAC;AAE9C,mHAAmH;AACnH,OAAO,EAAE,qBAAqB,EAAE,yBAAyB,EAAE,MAAM,qCAAqC,CAAC;AAEvG,gFAAgF;AAChF,MAAM,uBAAuB,GAAG,GAAG,CAAC;AAEpC,iEAAiE;AACjE,MAAM,oBAAoB,GAAG,0CAA0C,CAAC;AAExE,MAAM,UAAU,eAAe,CAAC,QAA4B;IAC1D,MAAM,IAAI,GAAG,MAAM,CAAC,QAAQ,IAAI,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC;IAClD,OAAO,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC,IAAI,IAAI,KAAK,kBAAkB,IAAI,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;AAC3F,CAAC;AAGD;;;;GAIG;AACH,MAAM,UAAU,gBAAgB,CAAC,GAA8B;IAC7D,MAAM,KAAK,GAAG,MAAM,CAAC,GAAG,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,WAAW,EAAE,IAAI,EAAE,CAAC;IAC1E,IAAI,CAAC,KAAK,IAAI,KAAK,CAAC,MAAM,GAAG,uBAAuB;QAAE,OAAO,IAAI,CAAC;IAClE,OAAO,oBAAoB,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC;AACzD,CAAC;AAID;;;;;GAKG;AACH,MAAM,qBAAqB,GAAG,IAAI,GAAG,CAAC;IACpC,eAAe;IACf,WAAW;IACX,WAAW;IACX,UAAU;IACV,UAAU;IACV,uBAAuB;IACvB,iBAAiB;IACjB,sBAAsB;CACvB,CAAC,CAAC;AAEH,gGAAgG;AAChG,MAAM,wBAAwB,GAAG,IAAI,GAAG,CAAC,CAAC,iBAAiB,EAAE,kBAAkB,CAAC,CAAC,CAAC;AAElF;;;;;GAKG;AACH,MAAM,UAAU,oBAAoB,CAAC,OAAsB;IACzD,IAAI,CAAC,OAAO;QAAE,OAAO,QAAQ,CAAC;IAC9B,IAAI,qBAAqB,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAC;QAAE,OAAO,iBAAiB,CAAC;IAC7F,MAAM,QAAQ,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC;IACxD,IAAI,QAAQ,KAAK,OAAO,IAAI,QAAQ,KAAK,OAAO,IAAI,QAAQ,KAAK,OAAO,IAAI,QAAQ,KAAK,MAAM,EAAE,CAAC;QAChG,OAAO,QAAQ,CAAC;IAClB,CAAC;IACD,IAAI,wBAAwB,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAC;QAAE,OAAO,QAAQ,CAAC;IACxF,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED;;;;;;GAMG;AACH,SAAS,aAAa,CAAC,KAAa;IAClC,OAAO,kBAAkB,CAAC,KAAK,CAAC,CAAC,OAAO,CACtC,UAAU,EACV,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,WAAW,EAAE,EAAE,CACxD,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACH,SAAS,uBAAuB,CAAC,WAAoC,EAAE,QAAiB;IACtF,MAAM,GAAG,GAAG,MAAM,CAAC,QAAQ,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;IAC1C,IAAI,CAAC,GAAG;QAAE,OAAO,WAAW,CAAC;IAC7B,MAAM,KAAK,GAAG,gBAAgB,CAAC,GAAG,CAAC,IAAI,MAAM,CAAC;IAC9C,OAAO,GAAG,WAAW,eAAe,KAAK,uBAAuB,aAAa,CAAC,GAAG,CAAC,EAAE,CAAC;AACvF,CAAC;AASD;;;;;;;GAOG;AACH,MAAM,UAAU,uBAAuB,CAAC,KAA6B;IACnE,MAAM,OAAO,GAAG,gBAAgB,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;IACjD,MAAM,aAAa,GAAG,oBAAoB,CAAC,OAAO,CAAC,CAAC;IAEpD,IAAI,WAAmB,CAAC;IACxB,IAAI,aAAa,KAAK,QAAQ,IAAI,OAAO,EAAE,CAAC;QAC1C,yEAAyE;QACzE,WAAW,GAAG,eAAe,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,GAAG,OAAO,iBAAiB,CAAC,CAAC,CAAC,OAAO,CAAC;IACjF,CAAC;SAAM,CAAC;QACN,WAAW,GAAG,OAAO,IAAI,0BAA0B,CAAC;IACtD,CAAC;IAED,OAAO;QACL,cAAc,EAAE,WAAW;QAC3B,gBAAgB,EAAE,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC;QACpC,qBAAqB,EAAE,uBAAuB,CAC5C,aAAa,KAAK,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,YAAY,EACpD,KAAK,CAAC,QAAQ,CACf;QACD,eAAe,EAAE,qBAAqB;KACvC,CAAC;AACJ,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAkCG;AACH,MAAM,UAAU,uBAAuB,CACrC,QAA4B,EAC5B,QAAgB,EAChB,KAAkB;IAElB,MAAM,QAAQ,GAAG,gBAAgB,CAAC,yBAAyB,CAAC,QAAQ,CAAC,CAAC,CAAC;IACvE,MAAM,eAAe,GAAG,gBAAgB,CAAC,QAAQ,CAAC,CAAC;IAEnD,IAAI,QAAQ,GACV,QAAQ,IAAI,QAAQ,KAAK,0BAA0B;QACjD,CAAC,CAAC,QAAQ;QACV,CAAC,CAAC,eAAe,IAAI,0BAA0B,CAAC;IAEpD,IAAI,KAAK,IAAI,KAAK,CAAC,MAAM,IAAI,eAAe,IAAI,CAAC,YAAY,CAAC,QAAQ,EAAE,KAAK,CAAC,EAAE,CAAC;QAC/E,QAAQ,GAAG,0BAA0B,CAAC;IACxC,CAAC;IACD,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED;;;;;;;;;;;;;;;GAeG;AACH,MAAM,UAAU,yBAAyB,CACvC,QAAiB,EACjB,QAAgB;IAEhB,IAAI,CAAC,QAAQ,IAAI,OAAO,QAAQ,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC;QAAE,OAAO,SAAS,CAAC;IAC3F,MAAM,GAAG,GAAG,EAAE,GAAI,QAAoC,EAAE,CAAC;IACzD,IAAI,CAAC,CAAC,UAAU,IAAI,GAAG,CAAC;QAAE,OAAO,GAAG,CAAC;IACrC,GAAG,CAAC,QAAQ,GAAG,uBAAuB,CACpC,OAAO,GAAG,CAAC,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,SAAS,EAC3D,QAAQ,CACT,CAAC;IACF,OAAO,GAAG,CAAC;AACb,CAAC"}

package/dist/src/domain/paths.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"paths.d.ts","sourceRoot":"","sources":["../../../src/domain/paths.ts"],"names":[],"mappings":"AAEA,wBAAgB,mBAAmB,CAAC,GAAG,EAAE,OAAO,GAAG,MAAM,CAYxD;AAED,wBAAgB,gBAAgB,CAAC,GAAG,EAAE,OAAO,GAAG,MAAM,CASrD;AAED;;;;;;;;;GASG;AACH,wBAAgB,YAAY,CAC1B,GAAG,EAAE,MAAM,EACX,SAAS,CAAC,EAAE;IAAE,YAAY,CAAC,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAAA;CAAE,GACjD,MAAM,GAAG,SAAS,CAUpB;AAED;;;;;GAKG;AACH,wBAAgB,oBAAoB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAE1D"}
+{"version":3,"file":"paths.d.ts","sourceRoot":"","sources":["../../../src/domain/paths.ts"],"names":[],"mappings":"AAGA,wBAAgB,mBAAmB,CAAC,GAAG,EAAE,OAAO,GAAG,MAAM,CAYxD;AAED,wBAAgB,gBAAgB,CAAC,GAAG,EAAE,OAAO,GAAG,MAAM,CAUrD;AAED;;;;;;;;;GASG;AACH,wBAAgB,YAAY,CAC1B,GAAG,EAAE,MAAM,EACX,SAAS,CAAC,EAAE;IAAE,YAAY,CAAC,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAAA;CAAE,GACjD,MAAM,GAAG,SAAS,CAUpB;AAED;;;;;GAKG;AACH,wBAAgB,oBAAoB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAE1D"}

package/dist/src/domain/paths.js

@@ -1,3 +1,4 @@
+import { hasDotDotSegment } from '@neuralis/package-system/paths';
 import { BrainError } from './BrainError.js';
 export function normalizeFolderPath(raw) {
     const value = typeof raw === 'string' ? raw.trim() : '';
@@ -5,8 +6,8 @@ export function normalizeFolderPath(raw) {
         return '/';
     const withLeading = value.startsWith('/') ? value : `/${value}`;
     const collapsed = withLeading.replace(/\/{2,}/g, '/');
-    if (collapsed.includes('..')) {
-        throw new BrainError({ code: 'INPUT_ERROR', message: 'folder_path may not contain ..', status: 400 });
+    if (hasDotDotSegment(collapsed)) {
+        throw new BrainError({ code: 'INPUT_ERROR', message: 'folder_path may not contain a .. segment', status: 400 });
     }
     if (collapsed.length > 512) {
         throw new BrainError({ code: 'INPUT_ERROR', message: 'folder_path is too long', status: 400 });
@@ -20,7 +21,8 @@ export function sanitizeFilename(raw) {
     const cleaned = value.replace(/\0/g, '').replace(/[\\]/g, '/');
     const base = cleaned.split('/').pop() ?? '';
     const safe = base.replace(/[^a-zA-Z0-9._ -]/g, '-').replace(/\s+/g, ' ').trim();
-    if (!safe)
+    // `.` and `..` name the folder itself or its parent, never a file.
+    if (!safe || safe === '.' || safe === '..')
         return '';
     if (safe.length > 200)
         return safe.slice(0, 200);

package/dist/src/domain/paths.js.map

@@ -1 +1 @@
-{"version":3,"file":"paths.js","sourceRoot":"","sources":["../../../src/domain/paths.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,iBAAiB,CAAC;AAE7C,MAAM,UAAU,mBAAmB,CAAC,GAAY;IAC9C,MAAM,KAAK,GAAG,OAAO,GAAG,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;IACxD,IAAI,CAAC,KAAK;QAAE,OAAO,GAAG,CAAC;IACvB,MAAM,WAAW,GAAG,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,KAAK,EAAE,CAAC;IAChE,MAAM,SAAS,GAAG,WAAW,CAAC,OAAO,CAAC,SAAS,EAAE,GAAG,CAAC,CAAC;IACtD,IAAI,SAAS,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;QAC7B,MAAM,IAAI,UAAU,CAAC,EAAE,IAAI,EAAE,aAAa,EAAE,OAAO,EAAE,gCAAgC,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC;IACxG,CAAC;IACD,IAAI,SAAS,CAAC,MAAM,GAAG,GAAG,EAAE,CAAC;QAC3B,MAAM,IAAI,UAAU,CAAC,EAAE,IAAI,EAAE,aAAa,EAAE,OAAO,EAAE,yBAAyB,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC;IACjG,CAAC;IACD,OAAO,SAAS,KAAK,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,SAAS,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;AAChE,CAAC;AAED,MAAM,UAAU,gBAAgB,CAAC,GAAY;IAC3C,MAAM,KAAK,GAAG,OAAO,GAAG,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;IACxD,IAAI,CAAC,KAAK;QAAE,OAAO,EAAE,CAAC;IACtB,MAAM,OAAO,GAAG,KAAK,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC;IAC/D,MAAM,IAAI,GAAG,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,IAAI,EAAE,CAAC;IAC5C,MAAM,IAAI,GAAG,IAAI,CAAC,OAAO,CAAC,mBAAmB,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC;IAChF,IAAI,CAAC,IAAI;QAAE,OAAO,EAAE,CAAC;IACrB,IAAI,IAAI,CAAC,MAAM,GAAG,GAAG;QAAE,OAAO,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;IACjD,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,YAAY,CAC1B,GAAW,EACX,SAAkD;IAElD,IAAI,GAAG,CAAC,UAAU,CAAC,UAAU,CAAC;QAAE,OAAO,SAAS,CAAC;IACjD,IAAI,CAAC,SAAS,EAAE,YAAY;QAAE,OAAO,SAAS,CAAC;IAC/C,IAAI,CAAC;QACH,OAAO,SAAS,CAAC,YAAY,CAAC,GAAG,CAAC,CAAC;IACrC,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,IAAI,GAAI,KAA2B,CAAC,IAAI,CAAC;QAC/C,IAAI,IAAI,KAAK,0BAA0B;YAAE,OAAO,SAAS,CAAC;QAC1D,MAAM,KAAK,CAAC;IACd,CAAC;AACH,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,oBAAoB,CAAC,IAAY;IAC/C,OAAO,yBAAyB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAC9C,CAAC"}
+{"version":3,"file":"paths.js","sourceRoot":"","sources":["../../../src/domain/paths.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,gBAAgB,EAAE,MAAM,gCAAgC,CAAC;AAClE,OAAO,EAAE,UAAU,EAAE,MAAM,iBAAiB,CAAC;AAE7C,MAAM,UAAU,mBAAmB,CAAC,GAAY;IAC9C,MAAM,KAAK,GAAG,OAAO,GAAG,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;IACxD,IAAI,CAAC,KAAK;QAAE,OAAO,GAAG,CAAC;IACvB,MAAM,WAAW,GAAG,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,KAAK,EAAE,CAAC;IAChE,MAAM,SAAS,GAAG,WAAW,CAAC,OAAO,CAAC,SAAS,EAAE,GAAG,CAAC,CAAC;IACtD,IAAI,gBAAgB,CAAC,SAAS,CAAC,EAAE,CAAC;QAChC,MAAM,IAAI,UAAU,CAAC,EAAE,IAAI,EAAE,aAAa,EAAE,OAAO,EAAE,0CAA0C,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC;IAClH,CAAC;IACD,IAAI,SAAS,CAAC,MAAM,GAAG,GAAG,EAAE,CAAC;QAC3B,MAAM,IAAI,UAAU,CAAC,EAAE,IAAI,EAAE,aAAa,EAAE,OAAO,EAAE,yBAAyB,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC;IACjG,CAAC;IACD,OAAO,SAAS,KAAK,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,SAAS,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;AAChE,CAAC;AAED,MAAM,UAAU,gBAAgB,CAAC,GAAY;IAC3C,MAAM,KAAK,GAAG,OAAO,GAAG,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;IACxD,IAAI,CAAC,KAAK;QAAE,OAAO,EAAE,CAAC;IACtB,MAAM,OAAO,GAAG,KAAK,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC;IAC/D,MAAM,IAAI,GAAG,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,IAAI,EAAE,CAAC;IAC5C,MAAM,IAAI,GAAG,IAAI,CAAC,OAAO,CAAC,mBAAmB,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC;IAChF,mEAAmE;IACnE,IAAI,CAAC,IAAI,IAAI,IAAI,KAAK,GAAG,IAAI,IAAI,KAAK,IAAI;QAAE,OAAO,EAAE,CAAC;IACtD,IAAI,IAAI,CAAC,MAAM,GAAG,GAAG;QAAE,OAAO,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;IACjD,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,YAAY,CAC1B,GAAW,EACX,SAAkD;IAElD,IAAI,GAAG,CAAC,UAAU,CAAC,UAAU,CAAC;QAAE,OAAO,SAAS,CAAC;IACjD,IAAI,CAAC,SAAS,EAAE,YAAY;QAAE,OAAO,SAAS,CAAC;IAC/C,IAAI,CAAC;QACH,OAAO,SAAS,CAAC,YAAY,CAAC,GAAG,CAAC,CAAC;IACrC,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,IAAI,GAAI,KAA2B,CAAC,IAAI,CAAC;QAC/C,IAAI,IAAI,KAAK,0BAA0B;YAAE,OAAO,SAAS,CAAC;QAC1D,MAAM,KAAK,CAAC;IACd,CAAC;AACH,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,oBAAoB,CAAC,IAAY;IAC/C,OAAO,yBAAyB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAC9C,CAAC"}

package/dist/src/domain/scopeAccessCtx.d.ts

@@ -17,8 +17,8 @@ export declare function scopeAccessCtxFromExecution(ctx: ExecutionContext): Scop
  * Synthesize the per-record owner scope used by the pending-change floor.
  * `canAccessScope` does NOT isolate per-user on a project-kind source (true for
  * every member), so a `{kind:'user', userId}` scope makes the ONE shared
- * predicate yield exactly "own record OR a `filesystem.observeScoped` /
- * `modifyScoped` HOLDER" — the grant decides, not the role NAME (D-A removed
+ * predicate yield exactly "own record OR a `files.readOthers` /
+ * `files.writeOthers` HOLDER" — the grant decides, not the role NAME (D-A removed
  * `canAccessScope`'s role-name conjunct, so a custom role granted the feature
  * passes exactly like the seeded `owner`/`admin`). The `' __no_owner__'`
  * sentinel (a leading space ⇒ an impossible real userId) fences an ownerless

package/dist/src/domain/scopeAccessCtx.js

@@ -23,8 +23,8 @@ export function scopeAccessCtxFromExecution(ctx) {
  * Synthesize the per-record owner scope used by the pending-change floor.
  * `canAccessScope` does NOT isolate per-user on a project-kind source (true for
  * every member), so a `{kind:'user', userId}` scope makes the ONE shared
- * predicate yield exactly "own record OR a `filesystem.observeScoped` /
- * `modifyScoped` HOLDER" — the grant decides, not the role NAME (D-A removed
+ * predicate yield exactly "own record OR a `files.readOthers` /
+ * `files.writeOthers` HOLDER" — the grant decides, not the role NAME (D-A removed
  * `canAccessScope`'s role-name conjunct, so a custom role granted the feature
  * passes exactly like the seeded `owner`/`admin`). The `' __no_owner__'`
  * sentinel (a leading space ⇒ an impossible real userId) fences an ownerless

package/dist/src/domain/sourceConfig.d.ts

@@ -8,7 +8,7 @@
  *   - Credentials never live in `connection.config`; they live in
  *     `CredentialStore`, keyed on `(projectId, source)`.
  */
-import type { ConnectorHierarchicalPermissions, SourceScope, SourceKindRegistry } from '@neuralis/package-system/contracts';
+import type { ConnectorHierarchicalPermissions, SourceScope, ScopeOrigin, SourceKindRegistry } from '@neuralis/package-system/contracts';
 /**
  * Open-shape source connection. Every source connector package declares
  * its `config` schema via `PackageConnector.configSchema` — the loader
@@ -201,19 +201,21 @@ export type SourceConfig = {
      */
     execGrantRepairVersion?: number;
     /**
-     * R2 — opt the source's directory in as a runtime-WASM package source, the
-     * same way the project `_packages/` drop-zone works: its dir is
-     * chokidar-watched and scanned for packages, which load under the same guards
-     * (`untrusted`, reserved-id ban, trust-escalation guard). ADDITIVE and
-     * orthogonal to the magpie markdown source-package path (both run on a
-     * flagged source). Deny-by-default (absent ⇒ false); valid ONLY for
-     * `connection.kind === 'local'` (brain/webtop have no host filesystem to
-     * scan). Distinct from `sync.alwaysActive` / `resolveAlwaysActive`, which is
-     * the SYNC-axis pin — this is the package-LOAD axis. Consumed by the host's
-     * `projectPackages` activation; R2 honours it only for `scope.kind ===
-     * 'project'` sources (user/agent-scope is R2b).
+     * The folders of this source that are watched for PACKAGES (the package-LOAD
+     * axis): each entry is a path RELATIVE to the source root (`''` = the whole
+     * source, `tools/pkgs` = that folder), and each is scanned the way the project
+     * `_packages/` drop-zone is — file-watched, loaded under the same guards
+     * (`untrusted`, reserved-id ban, trust-escalation guard; DISCOVERY IS NOT
+     * EXECUTION). ADDITIVE and orthogonal to the markdown source-package path.
+     * Deny-by-default (absent or empty ⇒ none). Valid on the `host` kind only
+     * (brain/webtop have no filesystem to scan); the WRITE is owner/admin-effective
+     * on create and PATCH (it is a code-LOAD surface). Distinct from
+     * `sync.alwaysActive` / `resolveAlwaysActive` (the SYNC-axis pin). A device
+     * folder's packages load from the app's own disk when the device is this
+     * machine (a loopback device, a native host), and over the device link
+     * otherwise — read, never copied here.
      */
-    recognizesPackages?: boolean;
+    packageFolders?: string[];
     createdAt: string;
     updatedAt: string;
     createdBy: string;
@@ -232,22 +234,45 @@ export type ValidationResult = {
  */
 export declare function setSourceKindRegistry(registry: SourceKindRegistry | null): void;
 export declare function validateSourceConfig(cfg: unknown): ValidationResult;
+/**
+ * `packageFolders`: a list of source-RELATIVE folders — each the kernel's ONE
+ * `isPackageFolderPath` (`''` for the whole source, or `/`-separated segments
+ * with no `.`/`..`, no empty segment, no backslash, no leading slash or drive:
+ * an absolute path would name a folder outside the source, the one thing a
+ * package folder must never do), at most `MAX_PACKAGE_FOLDERS`, no duplicates;
+ * on the `host` kind only.
+ */
+export declare function validatePackageFolders(value: unknown, connection: unknown): string[];
 /**
  * Resolve the effective `enabled` value for a config, defaulting `undefined`
  * to `true`. The string `'auto'` is returned as-is; the caller must consult
  * the connector's `isRunning(slug)` probe to decide.
  */
-export declare function resolveEnabledState(config: SourceConfig): SourceEnabledState;
+export declare function resolveEnabledState(config: Pick<SourceConfig, 'enabled'>): SourceEnabledState;
 /**
- * The `users[]` grant-only rule (kernel `validatePolicyUsersRule`) over every
- * path rule of a CALLER-supplied permissions payload — the write ingress
- * (create, PATCH, the policy patch). Deliberately NOT part of
+ * The two grant-only subject rules — `users[]` (kernel `validatePolicyUsersRule`)
+ * and `priority`, the caller's role priority, n or stronger (kernel
+ * `validatePolicyPriorityRule`) — over every path rule of a CALLER-supplied
+ * permissions payload: the route ingress (create, PATCH, the policy patch) AND
+ * the service floor below it (`BridgeService` create/update). Both are SHAPE
+ * rules, so they need no session. Deliberately NOT part of
  * `validateSourceConfig`: the store's READERS run that too, and there one
  * invalid persisted row would drop the whole source (every data route 404s,
  * the shell gate denies everything), while the evaluator already makes such a
  * row match nothing.
  */
-export declare function validatePermissionsUsersRules(perms: unknown): string[];
+export declare function validatePermissionsGrantOnlyRules(perms: unknown): string[];
+/**
+ * The role NAMES of a CALLER-supplied payload's path rules: every `roles[]`
+ * entry is a role of the caller's project (`SessionContext.rolePriorities`;
+ * without a map, only the built-in names). The only subject check that needs a
+ * session — `priority` is a number and its shape rule lives in
+ * {@link validatePermissionsGrantOnlyRules}. A name the stored config already carries
+ * (`existing`) passes, so resending a rule whose role was deleted later is not
+ * blocked — that row matches nobody. Write ingress only, for the reason
+ * {@link validatePermissionsGrantOnlyRules} gives.
+ */
+export declare function validatePermissionsSubjectRules(perms: unknown, rolePriorities: Record<string, number> | undefined, existing?: ConnectorHierarchicalPermissions | null): string[];
 /**
  * Effective `alwaysActive` pin: explicit value wins; package-content sources
  * (`data`, `packages`) are pinned by default.
@@ -334,7 +359,7 @@ export declare class SourceDisabledError extends Error {
  * reader sees, including sources attached long before it shipped. (The declared
  * `seed:'auto'` sources are a deliberate exception — `repairDeclaredSources`
  * backfills their blank descriptions once per repair version, so the persisted
- * config of a first-party source is authored, not empty. This chain covers the
+ * config of a native source is authored, not empty. This chain covers the
  * remainder: hand-added sources, and any description a human has cleared.)
  *
  * Order: what the owner wrote > what the package DECLARED for this source >
@@ -347,4 +372,12 @@ export declare function resolveSourceDescription(input: {
     declaredDescription?: string | null | undefined;
     kindDescription?: string | null | undefined;
 }): string | null;
+/**
+ * The plane a stored source's scope lives on — `canAccessScope`'s `origin`. A
+ * USER-scope source on a device serves its owner alone, so every gate that
+ * reads a source config's `scope` passes this; a `recordOwnerScope` gate has
+ * no connection and passes nothing (`test/domain/scopeOriginSweep.test.ts`
+ * counts both kinds).
+ */
+export declare function sourceScopeOrigin(connection: SourceConnection): ScopeOrigin;
 //# sourceMappingURL=sourceConfig.d.ts.map

package/dist/src/domain/sourceConfig.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"sourceConfig.d.ts","sourceRoot":"","sources":["../../../src/domain/sourceConfig.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,OAAO,KAAK,EACV,gCAAgC,EAChC,WAAW,EACX,kBAAkB,EACnB,MAAM,oCAAoC,CAAC;AAQ5C;;;;;GAKG;AACH,MAAM,MAAM,gBAAgB,GAAG;IAC7B,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACjC,CAAC;AAMF,MAAM,MAAM,iBAAiB,GAAG,gCAAgC,CAAC,SAAS,CAAC,CAAC;AAC5E,MAAM,MAAM,uBAAuB,GAAG,gCAAgC,CAAC;AACvE,MAAM,MAAM,cAAc,GAAG,WAAW,CAAC,gCAAgC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC;AAM5F;;;;;GAKG;AACH,MAAM,MAAM,WAAW,GAAG,QAAQ,GAAG,MAAM,GAAG,YAAY,MAAM,EAAE,CAAC;AACnE,MAAM,MAAM,UAAU,GAAG,QAAQ,GAAG,QAAQ,GAAG,OAAO,CAAC;AAEvD,MAAM,MAAM,iBAAiB,GAAG;IAC9B,UAAU,EAAE,MAAM,CAAC;IACnB,YAAY,EAAE,MAAM,CAAC;IACrB,YAAY,EAAE,MAAM,CAAC;IACrB,gFAAgF;IAChF,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,YAAY,EAAE,MAAM,CAAC;IACrB,UAAU,EAAE,MAAM,CAAC;IACnB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,+FAA+F;IAC/F,YAAY,CAAC,EAAE,eAAe,CAAC;IAC/B,qEAAqE;IACrE,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,qGAAqG;IACrG,iBAAiB,CAAC,EAAE,MAAM,EAAE,CAAC;CAC9B,CAAC;AAEF;;;;;;;GAOG;AACH,MAAM,MAAM,eAAe,GAAG;IAAE,aAAa,EAAE,MAAM,CAAC;IAAC,GAAG,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAC;IAAC,WAAW,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,CAAC;AAE7H;;;;GAIG;AACH,MAAM,MAAM,eAAe,GAAG;IAAE,MAAM,CAAC,EAAE,OAAO,CAAC;IAAC,GAAG,CAAC,EAAE,OAAO,CAAC;IAAC,KAAK,CAAC,EAAE,OAAO,CAAC;IAAC,KAAK,CAAC,EAAE,OAAO,CAAA;CAAE,CAAC;AAEpG;;;;;GAKG;AACH,MAAM,MAAM,gBAAgB,GAAG;IAC7B,8EAA8E;IAC9E,YAAY,EAAE,MAAM,CAAC;IACrB,6EAA6E;IAC7E,cAAc,EAAE,MAAM,CAAC;IACvB,mFAAmF;IACnF,UAAU,EAAE,MAAM,CAAC;IACnB,kFAAkF;IAClF,UAAU,EAAE,MAAM,CAAC;IACnB;;;;OAIG;IACH,SAAS,CAAC,EAAE,OAAO,CAAC;IACpB,4EAA4E;IAC5E,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB,CAAC;AAEF,MAAM,MAAM,UAAU,GAAG;IACvB,4EAA4E;IAC5E,OAAO,EAAE,MAAM,EAAE,CAAC;IAClB;;;;;OAKG;IACH,OAAO,CAAC,EAAE,MAAM,EAAE,CAAC;IACnB,OAAO,EAAE,WAAW,CAAC;IACrB;;;;OAIG;IACH,YAAY,CAAC,EAAE,OAAO,CAAC;IACvB,6EAA6E;IAC7E,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,mGAAmG;IACnG,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB;;;;OAIG;IACH,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,iEAAiE;IACjE,KAAK,CAAC,EAAE,eAAe,CAAC;IACxB;;;;OAIG;IACH,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,MAAM,CAAC,EAAE,UAAU,CAAC;IACpB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,cAAc,CAAC,EAAE,iBAAiB,CAAC;IACnC,mFAAmF;IACnF,KAAK,CAAC,EAAE,gBAAgB,CAAC;CAC1B,CAAC;AAMF;;;;;;GAMG;AACH,MAAM,MAAM,kBAAkB,GAAG,OAAO,GAAG,MAAM,CAAC;AAMlD,MAAM,MAAM,YAAY,GAAG;IACzB,MAAM,EAAE,MAAM,CAAC;IACf,KAAK,EAAE,WAAW,CAAC;IACnB,UAAU,EAAE,gBAAgB,CAAC;IAC7B,WAAW,EAAE,uBAAuB,CAAC;IACrC;;;;OAIG;IACH,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,IAAI,CAAC,EAAE,UAAU,CAAC;IAClB;;;;OAIG;IACH,OAAO,CAAC,EAAE,kBAAkB,CAAC;IAC7B;;;;OAIG;IACH,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB;;;;;;;;OAQG;IACH,qBAAqB,CAAC,EAAE,MAAM,CAAC;IAC/B;;;;;;;;OAQG;IACH,qBAAqB,CAAC,EAAE,MAAM,CAAC;IAC/B;;;;;;;OAOG;IACH,sBAAsB,CAAC,EAAE,MAAM,CAAC;IAChC;;;;;;;;;;;;OAYG;IACH,kBAAkB,CAAC,EAAE,OAAO,CAAC;IAC7B,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC;CACnB,CAAC;AAMF,MAAM,MAAM,gBAAgB,GACxB;IAAE,EAAE,EAAE,IAAI,CAAA;CAAE,GACZ;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,MAAM,EAAE,MAAM,EAAE,CAAA;CAAE,CAAC;AAMpC;;;;;GAKG;AACH,wBAAgB,qBAAqB,CAAC,QAAQ,EAAE,kBAAkB,GAAG,IAAI,GAAG,IAAI,CAE/E;AAED,wBAAgB,oBAAoB,CAAC,GAAG,EAAE,OAAO,GAAG,gBAAgB,CAkDnE;AAED;;;;GAIG;AACH,wBAAgB,mBAAmB,CAAC,MAAM,EAAE,YAAY,GAAG,kBAAkB,CAE5E;AA0GD;;;;;;;;GAQG;AACH,wBAAgB,6BAA6B,CAAC,KAAK,EAAE,OAAO,GAAG,MAAM,EAAE,CAKtE;AAiED;;;GAGG;AACH,wBAAgB,mBAAmB,CAAC,MAAM,EAAE,YAAY,GAAG,OAAO,CAGjE;AA6BD;;;;;;;;;;;;;;GAcG;AACH,qBAAa,wBAAyB,SAAQ,KAAK;IACjD,QAAQ,CAAC,MAAM,EAAG,GAAG,CAAU;IAC/B,QAAQ,CAAC,IAAI,EAAG,uBAAuB,CAAU;IACjD,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,SAAS,SAAS;IAC3B,QAAQ,CAAC,QAAQ,EAAG,0BAA0B,CAAU;IACxD,YAAY,MAAM,EAAE,MAAM,EAIzB;CACF;AAED,qBAAa,2BAA4B,SAAQ,KAAK;IACpD,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B;;;;;;;;;;;;;;;;;;;;;OAqBG;IACH,QAAQ,CAAC,MAAM,EAAG,GAAG,CAAU;IAC/B,QAAQ,CAAC,IAAI,EAAG,0BAA0B,CAAU;IACpD,YAAY,MAAM,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAK5C;CACF;AAED;;;;;GAKG;AACH,qBAAa,mBAAoB,SAAQ,KAAK;IAC5C,QAAQ,CAAC,IAAI,EAAG,iBAAiB,CAAU;IAC3C,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,KAAK,EAAE,WAAW,CAAC;IAC5B,QAAQ,CAAC,SAAS,SAAS;IAC3B,QAAQ,CAAC,QAAQ,EAAG,eAAe,CAAU;IAC7C,YAAY,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,WAAW,EAK7C;CACF;AAED;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,wBAAgB,wBAAwB,CAAC,KAAK,EAAE;IAC9C,iBAAiB,CAAC,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,CAAC;IAC9C,mBAAmB,CAAC,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,CAAC;IAChD,eAAe,CAAC,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,CAAC;CAC7C,GAAG,MAAM,GAAG,IAAI,CAOhB"}
+{"version":3,"file":"sourceConfig.d.ts","sourceRoot":"","sources":["../../../src/domain/sourceConfig.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,OAAO,KAAK,EACV,gCAAgC,EAChC,WAAW,EAAE,WAAW,EACxB,kBAAkB,EACnB,MAAM,oCAAoC,CAAC;AAS5C;;;;;GAKG;AACH,MAAM,MAAM,gBAAgB,GAAG;IAC7B,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACjC,CAAC;AAMF,MAAM,MAAM,iBAAiB,GAAG,gCAAgC,CAAC,SAAS,CAAC,CAAC;AAC5E,MAAM,MAAM,uBAAuB,GAAG,gCAAgC,CAAC;AACvE,MAAM,MAAM,cAAc,GAAG,WAAW,CAAC,gCAAgC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC;AAM5F;;;;;GAKG;AACH,MAAM,MAAM,WAAW,GAAG,QAAQ,GAAG,MAAM,GAAG,YAAY,MAAM,EAAE,CAAC;AACnE,MAAM,MAAM,UAAU,GAAG,QAAQ,GAAG,QAAQ,GAAG,OAAO,CAAC;AAEvD,MAAM,MAAM,iBAAiB,GAAG;IAC9B,UAAU,EAAE,MAAM,CAAC;IACnB,YAAY,EAAE,MAAM,CAAC;IACrB,YAAY,EAAE,MAAM,CAAC;IACrB,gFAAgF;IAChF,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,YAAY,EAAE,MAAM,CAAC;IACrB,UAAU,EAAE,MAAM,CAAC;IACnB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,+FAA+F;IAC/F,YAAY,CAAC,EAAE,eAAe,CAAC;IAC/B,qEAAqE;IACrE,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,qGAAqG;IACrG,iBAAiB,CAAC,EAAE,MAAM,EAAE,CAAC;CAC9B,CAAC;AAEF;;;;;;;GAOG;AACH,MAAM,MAAM,eAAe,GAAG;IAAE,aAAa,EAAE,MAAM,CAAC;IAAC,GAAG,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAC;IAAC,WAAW,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,CAAC;AAE7H;;;;GAIG;AACH,MAAM,MAAM,eAAe,GAAG;IAAE,MAAM,CAAC,EAAE,OAAO,CAAC;IAAC,GAAG,CAAC,EAAE,OAAO,CAAC;IAAC,KAAK,CAAC,EAAE,OAAO,CAAC;IAAC,KAAK,CAAC,EAAE,OAAO,CAAA;CAAE,CAAC;AAEpG;;;;;GAKG;AACH,MAAM,MAAM,gBAAgB,GAAG;IAC7B,8EAA8E;IAC9E,YAAY,EAAE,MAAM,CAAC;IACrB,6EAA6E;IAC7E,cAAc,EAAE,MAAM,CAAC;IACvB,mFAAmF;IACnF,UAAU,EAAE,MAAM,CAAC;IACnB,kFAAkF;IAClF,UAAU,EAAE,MAAM,CAAC;IACnB;;;;OAIG;IACH,SAAS,CAAC,EAAE,OAAO,CAAC;IACpB,4EAA4E;IAC5E,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB,CAAC;AAEF,MAAM,MAAM,UAAU,GAAG;IACvB,4EAA4E;IAC5E,OAAO,EAAE,MAAM,EAAE,CAAC;IAClB;;;;;OAKG;IACH,OAAO,CAAC,EAAE,MAAM,EAAE,CAAC;IACnB,OAAO,EAAE,WAAW,CAAC;IACrB;;;;OAIG;IACH,YAAY,CAAC,EAAE,OAAO,CAAC;IACvB,6EAA6E;IAC7E,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,mGAAmG;IACnG,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB;;;;OAIG;IACH,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,iEAAiE;IACjE,KAAK,CAAC,EAAE,eAAe,CAAC;IACxB;;;;OAIG;IACH,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,MAAM,CAAC,EAAE,UAAU,CAAC;IACpB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,cAAc,CAAC,EAAE,iBAAiB,CAAC;IACnC,mFAAmF;IACnF,KAAK,CAAC,EAAE,gBAAgB,CAAC;CAC1B,CAAC;AAMF;;;;;;GAMG;AACH,MAAM,MAAM,kBAAkB,GAAG,OAAO,GAAG,MAAM,CAAC;AAMlD,MAAM,MAAM,YAAY,GAAG;IACzB,MAAM,EAAE,MAAM,CAAC;IACf,KAAK,EAAE,WAAW,CAAC;IACnB,UAAU,EAAE,gBAAgB,CAAC;IAC7B,WAAW,EAAE,uBAAuB,CAAC;IACrC;;;;OAIG;IACH,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,IAAI,CAAC,EAAE,UAAU,CAAC;IAClB;;;;OAIG;IACH,OAAO,CAAC,EAAE,kBAAkB,CAAC;IAC7B;;;;OAIG;IACH,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB;;;;;;;;OAQG;IACH,qBAAqB,CAAC,EAAE,MAAM,CAAC;IAC/B;;;;;;;;OAQG;IACH,qBAAqB,CAAC,EAAE,MAAM,CAAC;IAC/B;;;;;;;OAOG;IACH,sBAAsB,CAAC,EAAE,MAAM,CAAC;IAChC;;;;;;;;;;;;;;OAcG;IACH,cAAc,CAAC,EAAE,MAAM,EAAE,CAAC;IAC1B,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC;CACnB,CAAC;AAMF,MAAM,MAAM,gBAAgB,GACxB;IAAE,EAAE,EAAE,IAAI,CAAA;CAAE,GACZ;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,MAAM,EAAE,MAAM,EAAE,CAAA;CAAE,CAAC;AAMpC;;;;;GAKG;AACH,wBAAgB,qBAAqB,CAAC,QAAQ,EAAE,kBAAkB,GAAG,IAAI,GAAG,IAAI,CAE/E;AAED,wBAAgB,oBAAoB,CAAC,GAAG,EAAE,OAAO,GAAG,gBAAgB,CA2CnE;AAED;;;;;;;GAOG;AACH,wBAAgB,sBAAsB,CAAC,KAAK,EAAE,OAAO,EAAE,UAAU,EAAE,OAAO,GAAG,MAAM,EAAE,CAqBpF;AAgBD;;;;GAIG;AACH,wBAAgB,mBAAmB,CAAC,MAAM,EAAE,IAAI,CAAC,YAAY,EAAE,SAAS,CAAC,GAAG,kBAAkB,CAE7F;AA0GD;;;;;;;;;;;GAWG;AACH,wBAAgB,iCAAiC,CAAC,KAAK,EAAE,OAAO,GAAG,MAAM,EAAE,CAK1E;AAED;;;;;;;;;GASG;AACH,wBAAgB,+BAA+B,CAC7C,KAAK,EAAE,OAAO,EACd,cAAc,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,SAAS,EAClD,QAAQ,CAAC,EAAE,gCAAgC,GAAG,IAAI,GACjD,MAAM,EAAE,CAkBV;AAiED;;;GAGG;AACH,wBAAgB,mBAAmB,CAAC,MAAM,EAAE,YAAY,GAAG,OAAO,CAGjE;AA6BD;;;;;;;;;;;;;;GAcG;AACH,qBAAa,wBAAyB,SAAQ,KAAK;IACjD,QAAQ,CAAC,MAAM,EAAG,GAAG,CAAU;IAC/B,QAAQ,CAAC,IAAI,EAAG,uBAAuB,CAAU;IACjD,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,SAAS,SAAS;IAC3B,QAAQ,CAAC,QAAQ,EAAG,0BAA0B,CAAU;IACxD,YAAY,MAAM,EAAE,MAAM,EAIzB;CACF;AAED,qBAAa,2BAA4B,SAAQ,KAAK;IACpD,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B;;;;;;;;;;;;;;;;;;;;;OAqBG;IACH,QAAQ,CAAC,MAAM,EAAG,GAAG,CAAU;IAC/B,QAAQ,CAAC,IAAI,EAAG,0BAA0B,CAAU;IACpD,YAAY,MAAM,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAK5C;CACF;AAED;;;;;GAKG;AACH,qBAAa,mBAAoB,SAAQ,KAAK;IAC5C,QAAQ,CAAC,IAAI,EAAG,iBAAiB,CAAU;IAC3C,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,KAAK,EAAE,WAAW,CAAC;IAC5B,QAAQ,CAAC,SAAS,SAAS;IAC3B,QAAQ,CAAC,QAAQ,EAAG,eAAe,CAAU;IAC7C,YAAY,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,WAAW,EAK7C;CACF;AAED;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,wBAAgB,wBAAwB,CAAC,KAAK,EAAE;IAC9C,iBAAiB,CAAC,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,CAAC;IAC9C,mBAAmB,CAAC,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,CAAC;IAChD,eAAe,CAAC,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,CAAC;CAC7C,GAAG,MAAM,GAAG,IAAI,CAOhB;AAED;;;;;;GAMG;AACH,wBAAgB,iBAAiB,CAAC,UAAU,EAAE,gBAAgB,GAAG,WAAW,CAE3E"}

package/dist/src/domain/sourceConfig.js

@@ -8,8 +8,9 @@
  *   - Credentials never live in `connection.config`; they live in
  *     `CredentialStore`, keyed on `(projectId, source)`.
  */
-import { validatePolicyFloorRule, validatePolicyUsersRule } from '@neuralis/package-system/policies';
-import { isSourceScope } from '@neuralis/package-system/contracts';
+import { validatePolicyFloorRule, validatePolicyPriorityRule, validatePolicyUsersRule } from '@neuralis/package-system/policies';
+import { BUILTIN_ROLE_PRIORITY } from '@neuralis/package-system/access';
+import { HOST_SOURCE_KIND, MAX_PACKAGE_FOLDERS, isPackageFolderPath, isSourceScope, sourcePlane } from '@neuralis/package-system/contracts';
 const SOURCE_PATTERN = /^[a-z][a-z0-9-]{0,199}$/;
 let sourceKindRegistry = null;
 /**
@@ -49,20 +50,57 @@ export function validateSourceConfig(cfg) {
             errors.push('enabled must be a boolean or "auto" if provided.');
         }
     }
-    if (c.recognizesPackages !== undefined) {
-        if (typeof c.recognizesPackages !== 'boolean') {
-            errors.push('recognizesPackages must be a boolean if provided.');
+    if (c.packageFolders !== undefined) {
+        errors.push(...validatePackageFolders(c.packageFolders, c.connection));
+    }
+    errors.push(...validateFolderTransport(c.connection));
+    return errors.length === 0 ? { ok: true } : { ok: false, errors };
+}
+/**
+ * `packageFolders`: a list of source-RELATIVE folders — each the kernel's ONE
+ * `isPackageFolderPath` (`''` for the whole source, or `/`-separated segments
+ * with no `.`/`..`, no empty segment, no backslash, no leading slash or drive:
+ * an absolute path would name a folder outside the source, the one thing a
+ * package folder must never do), at most `MAX_PACKAGE_FOLDERS`, no duplicates;
+ * on the `host` kind only.
+ */
+export function validatePackageFolders(value, connection) {
+    if (!Array.isArray(value))
+        return ['packageFolders must be an array of folder paths if provided.'];
+    const errors = [];
+    if (value.length > MAX_PACKAGE_FOLDERS)
+        errors.push(`packageFolders holds at most ${MAX_PACKAGE_FOLDERS} folders.`);
+    const seen = new Set();
+    for (const entry of value) {
+        if (!isPackageFolderPath(entry)) {
+            errors.push('packageFolders entries must be folders relative to the source root ("" for the whole source), without "." or ".." segments.');
+            break;
         }
-        else if (c.recognizesPackages === true) {
-            // Cross-field rule (R2 C1): a runtime-WASM package source needs a host
-            // filesystem to scan — only `local`-kind sources have one.
-            const kind = c.connection?.kind;
-            if (kind !== 'local') {
-                errors.push('recognizesPackages may only be true when connection.kind is "local".');
-            }
+        if (seen.has(entry)) {
+            errors.push('packageFolders must not repeat a folder.');
+            break;
         }
+        seen.add(entry);
     }
-    return errors.length === 0 ? { ok: true } : { ok: false, errors };
+    const kind = connection?.kind;
+    if (value.length > 0 && kind !== HOST_SOURCE_KIND) {
+        errors.push(`packageFolders may only be set when connection.kind is "${HOST_SOURCE_KIND}".`);
+    }
+    return errors;
+}
+/**
+ * The folder kind's device transport: a stored `device` makes `root` a path ON
+ * that device, so it must be absolute there (`/…`, or `C:\…` on a Windows
+ * device). The kind schema already refuses `device` beside `hostRoot`.
+ */
+function validateFolderTransport(connection) {
+    const c = connection;
+    if (c?.kind !== HOST_SOURCE_KIND || !c.config || sourcePlane(HOST_SOURCE_KIND, c.config) !== 'device')
+        return [];
+    const root = c.config.root;
+    return typeof root === 'string' && /^(\/|[A-Za-z]:[\\/])/.test(root)
+        ? []
+        : ['connection.config.root must be an absolute path on the device when connection.config.device is set.'];
 }
 /**
  * Resolve the effective `enabled` value for a config, defaulting `undefined`
@@ -172,19 +210,55 @@ function validateHierarchicalPermissions(perms) {
     return errors;
 }
 /**
- * The `users[]` grant-only rule (kernel `validatePolicyUsersRule`) over every
- * path rule of a CALLER-supplied permissions payload — the write ingress
- * (create, PATCH, the policy patch). Deliberately NOT part of
+ * The two grant-only subject rules — `users[]` (kernel `validatePolicyUsersRule`)
+ * and `priority`, the caller's role priority, n or stronger (kernel
+ * `validatePolicyPriorityRule`) — over every path rule of a CALLER-supplied
+ * permissions payload: the route ingress (create, PATCH, the policy patch) AND
+ * the service floor below it (`BridgeService` create/update). Both are SHAPE
+ * rules, so they need no session. Deliberately NOT part of
  * `validateSourceConfig`: the store's READERS run that too, and there one
  * invalid persisted row would drop the whole source (every data route 404s,
  * the shell gate denies everything), while the evaluator already makes such a
  * row match nothing.
  */
-export function validatePermissionsUsersRules(perms) {
+export function validatePermissionsGrantOnlyRules(perms) {
+    const paths = perms?.paths;
+    if (!Array.isArray(paths))
+        return [];
+    return paths.flatMap((rule, i) => [...validatePolicyUsersRule(rule), ...validatePolicyPriorityRule(rule)].map((error) => `permissions.paths[${i}].${error}`));
+}
+/**
+ * The role NAMES of a CALLER-supplied payload's path rules: every `roles[]`
+ * entry is a role of the caller's project (`SessionContext.rolePriorities`;
+ * without a map, only the built-in names). The only subject check that needs a
+ * session — `priority` is a number and its shape rule lives in
+ * {@link validatePermissionsGrantOnlyRules}. A name the stored config already carries
+ * (`existing`) passes, so resending a rule whose role was deleted later is not
+ * blocked — that row matches nobody. Write ingress only, for the reason
+ * {@link validatePermissionsGrantOnlyRules} gives.
+ */
+export function validatePermissionsSubjectRules(perms, rolePriorities, existing) {
     const paths = perms?.paths;
     if (!Array.isArray(paths))
         return [];
-    return paths.flatMap((rule, i) => validatePolicyUsersRule(rule).map((error) => `permissions.paths[${i}].${error}`));
+    const carried = new Set((existing?.paths ?? []).flatMap((rule) => rule.roles ?? []));
+    const known = (name) => carried.has(name)
+        || (rolePriorities ? Object.hasOwn(rolePriorities, name) : Object.hasOwn(BUILTIN_ROLE_PRIORITY, name));
+    return paths.flatMap((rule, i) => {
+        if (!rule || typeof rule !== 'object' || Array.isArray(rule))
+            return [];
+        const record = rule;
+        const errors = [];
+        if (Array.isArray(record.roles)) {
+            for (const name of record.roles) {
+                if (typeof name !== 'string' || name === '')
+                    errors.push('roles entries must be non-empty role names.');
+                else if (!known(name))
+                    errors.push(`roles names "${name}", which is not a role of this project.`);
+            }
+        }
+        return errors.map((error) => `permissions.paths[${i}].${error}`);
+    });
 }
 const MEDIA_LANE_KEYS = ['images', 'pdf', 'video', 'audio'];
 function validateSyncConfig(sync) {
@@ -376,7 +450,7 @@ export class SourceDisabledError extends Error {
  * reader sees, including sources attached long before it shipped. (The declared
  * `seed:'auto'` sources are a deliberate exception — `repairDeclaredSources`
  * backfills their blank descriptions once per repair version, so the persisted
- * config of a first-party source is authored, not empty. This chain covers the
+ * config of a native source is authored, not empty. This chain covers the
  * remainder: hand-added sources, and any description a human has cleared.)
  *
  * Order: what the owner wrote > what the package DECLARED for this source >
@@ -394,4 +468,14 @@ export function resolveSourceDescription(input) {
     }
     return null;
 }
+/**
+ * The plane a stored source's scope lives on — `canAccessScope`'s `origin`. A
+ * USER-scope source on a device serves its owner alone, so every gate that
+ * reads a source config's `scope` passes this; a `recordOwnerScope` gate has
+ * no connection and passes nothing (`test/domain/scopeOriginSweep.test.ts`
+ * counts both kinds).
+ */
+export function sourceScopeOrigin(connection) {
+    return { plane: sourcePlane(connection.kind, connection.config) };
+}
 //# sourceMappingURL=sourceConfig.js.map