@neuralis/brain-core 0.3.1 → 0.4.0

package/dist/src/tools/fs_read.js.map

@@ -1 +1 @@
-{"version":3,"file":"fs_read.js","sourceRoot":"","sources":["../../../src/tools/fs_read.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,aAAa,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AACxD,OAAO,EAAE,kBAAkB,EAAE,gBAAgB,EAAE,MAAM,qBAAqB,CAAC;AAC3E,OAAO,EAAE,oBAAoB,EAAE,MAAM,kBAAkB,CAAC;AAExD,SAAS,sBAAsB,CAAC,GAAQ;IACtC,gEAAgE;IAChE,2EAA2E;IAC3E,6EAA6E;IAC7E,wEAAwE;IACxE,iCAAiC;IACjC,OAAO;QACL,KAAK,EAAE,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC;YAC7B,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAM,EAAE,EAAE,CAAC,CAAC;gBACzB,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBAC7B,GAAG,EAAE,CAAC,CAAC,GAAG;gBACV,GAAG,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBAC/C,GAAG,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,CAAC,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBACrD,GAAG,CAAC,CAAC,CAAC,MAAM,KAAK,IAAI,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBAC9C,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBACzC,GAAG,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBAC/C,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBACvE,GAAG,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBAC/C,GAAG,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,CAAC,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBAClD,GAAG,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,CAAC,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBAClD,GAAG,CAAC,OAAO,CAAC,CAAC,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBAChE,GAAG,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,CAAC,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBACrD,GAAG,CAAC,CAAC,CAAC,gBAAgB,CAAC,CAAC,CAAC,EAAE,gBAAgB,EAAE,CAAC,CAAC,gBAAgB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBACvE,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,kBAAkB,CAAC,CAAC,CAAC,CAAC,EAAE,kBAAkB,EAAE,CAAC,CAAC,kBAAkB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBAC5F,GAAG,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,CAAC,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBACrD,GAAG,CAAC,gBAAgB,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,gBAAgB,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBAChF,GAAG,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBAC/C,GAAG,CAAC,OAAO,CAAC,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBACvD,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBACzC,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBACtC,sEAAsE;gBACtE,uEAAuE;gBACvE,sEAAsE;gBACtE,iEAAiE;gBACjE,uEAAuE;gBACvE,kEAAkE;gBAClE,4DAA4D;gBAC5D,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBACvC,GAAG,CAAC,CAAC,CAAC,KAAK,IAAI,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aACrD,CAAC,CAAC;YACL,CAAC,CAAC,EAAE;KACP,CAAC;AACJ,CAAC;AAED,SAAS,WAAW,CAAC,GAAwB;IAC3C,OAAO,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,EAAE,KAAK,EAAE,GAAG,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC;AACpE,CAAC;AAED,SAAS,WAAW,CAAC,CAAS;IAC5B,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC;QAAE,OAAO,KAAK,CAAC;IAChD,IAAI,CAAC,GAAG,IAAI;QAAE,OAAO,GAAG,CAAC,IAAI,CAAC;IAC9B,IAAI,CAAC,GAAG,IAAI,GAAG,IAAI;QAAE,OAAO,GAAG,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,KAAK,CAAC;IAC1D,OAAO,GAAG,CAAC,CAAC,GAAG,CAAC,IAAI,GAAG,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,KAAK,CAAC;AAChD,CAAC;AAED;;;;;GAKG;AACH,SAAS,WAAW,CAAC,IAAY,EAAE,SAAiB;IAClD,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IAC/B,MAAM,KAAK,GAAG,MAAM,CAAC,SAAS,GAAG,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC;IAC1D,OAAO,KAAK;SACT,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC,EAAE,EAAE,CAAC,GAAG,MAAM,CAAC,SAAS,GAAG,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,EAAE,GAAG,CAAC,IAAI,IAAI,EAAE,CAAC;SACzE,IAAI,CAAC,IAAI,CAAC,CAAC;AAChB,CAAC;AAED;;;;;GAKG;AACH,SAAS,iBAAiB,CACxB,IAAY,EACZ,GAAW;IAEX,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;IAChC,MAAM,SAAS,GAAG,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC;IACzC,4EAA4E;IAC5E,wEAAwE;IACxE,2EAA2E;IAC3E,mDAAmD;IACnD,IAAI,SAAS,IAAI,CAAC;QAAE,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,UAAU,EAAE,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;IACzE,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,SAAS,CAAC,CAAC;IACvC,OAAO,EAAE,KAAK,EAAE,UAAU,EAAE,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;AACzE,CAAC;AAED,MAAM,OAAO,GAAgB,KAAK,EAAE,IAAI,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE;IACpD,MAAM,KAAK,GAAG,GAAqB,CAAC;IACpC,MAAM,EAAE,GAAG,CAAC,MAAM,KAAK,CAAC,YAAY,CAAC,WAAW,CAAC,GAAG,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC,CAAC,UAAU,CAAC;IACpF,MAAM,OAAO,GAAG,SAAS,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;IAEvC,IAAI,CAAC;QACH,MAAM,KAAK,GAAG,CAAC,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAE,IAAY,CAAC,CAAC,CAAC,EAAE,CAAC;QAC9F,MAAM,GAAG,GAAqB;YAC5B,oEAAoE;YACpE,mEAAmE;YACnE,uEAAuE;YACvE,KAAK,EAAE,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE;YACpD,WAAW,EAAE,KAAK,CAAC,WAAW;YAC9B,YAAY,EAAE,KAAK,CAAC,YAAY;YAChC,UAAU,EAAE,KAAK,CAAC,UAAU;YAC5B,QAAQ,EAAE,KAAK,CAAC,QAAQ;SACzB,CAAC;QACF,MAAM,GAAG,GAAG,MAAM,EAAE,CAAC,IAAI,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC;QACxC,MAAM,UAAU,GAAG,KAAK,CAAC,WAAW,KAAK,IAAI,CAAC;QAC9C,MAAM,MAAM,GAAa,EAAE,CAAC;QAC5B,MAAM,CAAC,IAAI,CAAC,aAAa,GAAG,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC;QAC9C,KAAK,MAAM,CAAC,IAAI,GAAG,CAAC,KAAK,EAAE,CAAC;YAC1B,IAAI,CAAC,CAAC,KAAK,EAAE,CAAC;gBACZ,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,GAAG,KAAK,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC;gBACtC,SAAS;YACX,CAAC;YACD,MAAM,KAAK,GAAa,CAAC,KAAK,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC;YACzC,IAAI,UAAU,IAAI,CAAC,CAAC,EAAE;gBAAE,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;YACpD,IAAI,CAAC,CAAC,MAAM;gBAAE,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;YACnC,IAAI,CAAC,CAAC,MAAM,IAAI,CAAC,CAAC,MAAM,KAAK,WAAW;gBAAE,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC;YACtE,IAAI,CAAC,CAAC,gBAAgB,IAAI,CAAC,CAAC,gBAAgB,KAAK,SAAS;gBAAE,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,gBAAgB,GAAG,CAAC,CAAC;YAClG,MAAM,YAAY,GAAG,kBAAkB,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC;YACnD,IAAI,YAAY;gBAAE,KAAK,CAAC,IAAI,CAAC,YAAY,CAAC,IAAI,EAAE,CAAC,CAAC;YAClD,IAAI,CAAC,CAAC,MAAM;gBAAE,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC;iBACrC,IAAI,CAAC,CAAC,KAAK;gBAAE,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,QAAQ,IAAI,QAAQ,KAAK,WAAW,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC,0BAA0B,CAAC,CAAC;YACjH,MAAM,CAAC,IAAI,CAAC,KAAK,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QACtC,CAAC;QACD,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QAChB,MAAM,UAAU,GAAG,oBAAoB,CAAC,uBAAuB,EAAE,SAAS,EAAE,IAAI,CAAC,CAAC;QAClF,KAAK,MAAM,CAAC,IAAI,GAAG,CAAC,KAAK,EAAE,CAAC;YAC1B,IAAI,CAAC,CAAC,KAAK;gBAAE,SAAS;YACtB,MAAM,IAAI,GAAG,OAAO,CAAC,CAAC,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC;YAC5D,IAAI,CAAC,IAAI;gBAAE,SAAS;YACpB,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,GAAG,GAAG,kBAAkB,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;YAC5D,MAAM,KAAK,GAAG,CAAC,CAAC,UAAU,CAAC;YAC3B,yEAAyE;YACzE,wEAAwE;YACxE,yCAAyC;YACzC,MAAM,GAAG,GAAG,CAAC,KAAK,EAAE,QAAQ,IAAI,IAAI,CAAC,MAAM,GAAG,UAAU;gBACtD,CAAC,CAAC,iBAAiB,CAAC,IAAI,EAAE,UAAU,CAAC;gBACrC,CAAC,CAAC,IAAI,CAAC;YACT,MAAM,KAAK,GAAG,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC;YACrC,IAAI,KAAK,EAAE,CAAC;gBACV,MAAM,SAAS,GAAG,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,GAAG,GAAG,CAAC,UAAU,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC;gBACrE,MAAM,CAAC,IAAI,CAAC,SAAS,KAAK,CAAC,KAAK,IAAI,SAAS,MAAM,KAAK,CAAC,KAAK,EAAE,CAAC,CAAC;gBAClE,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;gBACnB,MAAM,CAAC,IAAI,CAAC,WAAW,CAAC,KAAK,EAAE,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC;gBAC7C,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;gBACnB,IAAI,GAAG,EAAE,CAAC;oBACR,MAAM,IAAI,GAAG,WAAW,CAAC,MAAM,CAAC,UAAU,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,CAAC;oBAC1D,MAAM,CAAC,IAAI,CACT,GAAG,CAAC,OAAO;wBACT,CAAC,CAAC,iBAAiB,UAAU,sBAAsB,KAAK,CAAC,KAAK,gCAAgC;8BAC1F,MAAM,KAAK,CAAC,KAAK,WAAW,IAAI,mBAAmB,CAAC,CAAC,GAAG,kBAAkB,KAAK,CAAC,KAAK,GAAG,CAAC,IAAI;8BAC7F,wFAAwF;wBAC5F,CAAC,CAAC,iBAAiB,UAAU,YAAY,KAAK,CAAC,KAAK,WAAW,IAAI,SAAS;8BACxE,0BAA0B,CAAC,CAAC,GAAG,kBAAkB,SAAS,GAAG,CAAC,KAAK,CAC1E,CAAC;gBACJ,CAAC;YACH,CAAC;iBAAM,CAAC;gBACN,iEAAiE;gBACjE,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;gBACnB,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;gBACnB,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;YACrB,CAAC;YACD,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QAClB,CAAC;QACD,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,CAAC;QACzC,uEAAuE;QACvE,yEAAyE;QACzE,0EAA0E;QAC1E,MAAM,OAAO,GAAuB,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC,CAAC;QACtE,KAAK,MAAM,CAAC,IAAI,GAAG,CAAC,KAAK,EAAE,CAAC;YAC1B,IAAI,CAAC,CAAC,CAAC,KAAK;gBAAE,SAAS;YACvB,MAAM,UAAU,GAAa,CAAC,OAAO,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC;YAC9C,IAAI,CAAC,CAAC,QAAQ;gBAAE,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE,CAAC,CAAC;YAClD,IAAI,OAAO,CAAC,CAAC,IAAI,KAAK,QAAQ;gBAAE,UAAU,CAAC,IAAI,CAAC,GAAG,WAAW,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;iBACtE,IAAI,CAAC,CAAC,QAAQ;gBAAE,UAAU,CAAC,UAAU,CAAC,MAAM,GAAG,CAAC,CAAC,IAAI,GAAG,CAAC;YAC9D,OAAO,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,UAAU,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;YAC3D,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC;QACxB,CAAC;QACD,+CAA+C;QAC/C,MAAM,IAAI,GAAG,WAAW,CAAC,GAAG,CAAC,CAAC;QAC9B,OAAO;YACL,OAAO;YACP,iBAAiB,EAAE,sBAAsB,CAAC,GAAG,CAAQ;YACrD,OAAO,EAAE,KAAK;YACd,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SACjC,CAAC;IACJ,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,OAAO,GAAG,aAAa,CAAC,GAAG,CAAC,CAAC;QACnC,OAAO;YACL,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAe,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC;YACnD,iBAAiB,EAAE,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,iBAAiB,EAAE,OAAO,EAAE;YACnE,OAAO,EAAE,IAAI;SACd,CAAC;IACJ,CAAC;AACH,CAAC,CAAC;AAEF,eAAe,OAAO,CAAC"}
+{"version":3,"file":"fs_read.js","sourceRoot":"","sources":["../../../src/tools/fs_read.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,aAAa,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AACxD,OAAO,EAAE,kBAAkB,EAAE,gBAAgB,EAAE,MAAM,qBAAqB,CAAC;AAC3E,OAAO,EAAE,oBAAoB,EAAE,MAAM,kBAAkB,CAAC;AAExD,SAAS,sBAAsB,CAAC,GAAQ;IACtC,gEAAgE;IAChE,2EAA2E;IAC3E,6EAA6E;IAC7E,wEAAwE;IACxE,iCAAiC;IACjC,OAAO;QACL,KAAK,EAAE,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC;YAC7B,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAM,EAAE,EAAE,CAAC,CAAC;gBACzB,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBAC7B,GAAG,EAAE,CAAC,CAAC,GAAG;gBACV,GAAG,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBAC/C,GAAG,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,CAAC,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBACrD,GAAG,CAAC,CAAC,CAAC,MAAM,KAAK,IAAI,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBAC9C,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBACzC,GAAG,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBAC/C,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBACvE,GAAG,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBAC/C,GAAG,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,CAAC,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBAClD,GAAG,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,CAAC,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBAClD,GAAG,CAAC,OAAO,CAAC,CAAC,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBAChE,GAAG,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,CAAC,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBACrD,GAAG,CAAC,CAAC,CAAC,SAAS,KAAK,IAAI,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBACpD,GAAG,CAAC,CAAC,CAAC,gBAAgB,CAAC,CAAC,CAAC,EAAE,gBAAgB,EAAE,CAAC,CAAC,gBAAgB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBACvE,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,kBAAkB,CAAC,CAAC,CAAC,CAAC,EAAE,kBAAkB,EAAE,CAAC,CAAC,kBAAkB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBAC5F,GAAG,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,CAAC,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBACrD,GAAG,CAAC,gBAAgB,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,gBAAgB,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBAChF,GAAG,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBAC/C,GAAG,CAAC,OAAO,CAAC,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBACvD,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBACzC,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBACtC,sEAAsE;gBACtE,uEAAuE;gBACvE,sEAAsE;gBACtE,iEAAiE;gBACjE,uEAAuE;gBACvE,kEAAkE;gBAClE,4DAA4D;gBAC5D,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBACvC,GAAG,CAAC,CAAC,CAAC,KAAK,IAAI,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aACrD,CAAC,CAAC;YACL,CAAC,CAAC,EAAE;KACP,CAAC;AACJ,CAAC;AAED,SAAS,WAAW,CAAC,GAAwB;IAC3C,OAAO,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,EAAE,KAAK,EAAE,GAAG,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC;AACpE,CAAC;AAED,SAAS,WAAW,CAAC,CAAS;IAC5B,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC;QAAE,OAAO,KAAK,CAAC;IAChD,IAAI,CAAC,GAAG,IAAI;QAAE,OAAO,GAAG,CAAC,IAAI,CAAC;IAC9B,IAAI,CAAC,GAAG,IAAI,GAAG,IAAI;QAAE,OAAO,GAAG,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,KAAK,CAAC;IAC1D,OAAO,GAAG,CAAC,CAAC,GAAG,CAAC,IAAI,GAAG,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,KAAK,CAAC;AAChD,CAAC;AAED;;;;;GAKG;AACH,SAAS,WAAW,CAAC,IAAY,EAAE,SAAiB;IAClD,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IAC/B,MAAM,KAAK,GAAG,MAAM,CAAC,SAAS,GAAG,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC;IAC1D,OAAO,KAAK;SACT,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC,EAAE,EAAE,CAAC,GAAG,MAAM,CAAC,SAAS,GAAG,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,EAAE,GAAG,CAAC,IAAI,IAAI,EAAE,CAAC;SACzE,IAAI,CAAC,IAAI,CAAC,CAAC;AAChB,CAAC;AAED;;;;;GAKG;AACH,SAAS,iBAAiB,CACxB,IAAY,EACZ,GAAW;IAEX,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;IAChC,MAAM,SAAS,GAAG,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC;IACzC,4EAA4E;IAC5E,wEAAwE;IACxE,2EAA2E;IAC3E,mDAAmD;IACnD,IAAI,SAAS,IAAI,CAAC;QAAE,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,UAAU,EAAE,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;IACzE,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,SAAS,CAAC,CAAC;IACvC,OAAO,EAAE,KAAK,EAAE,UAAU,EAAE,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;AACzE,CAAC;AAED,MAAM,OAAO,GAAgB,KAAK,EAAE,IAAI,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE;IACpD,MAAM,KAAK,GAAG,GAAqB,CAAC;IACpC,MAAM,EAAE,GAAG,CAAC,MAAM,KAAK,CAAC,YAAY,CAAC,WAAW,CAAC,GAAG,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC,CAAC,UAAU,CAAC;IACpF,MAAM,OAAO,GAAG,SAAS,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;IAEvC,IAAI,CAAC;QACH,MAAM,KAAK,GAAG,CAAC,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAE,IAAY,CAAC,CAAC,CAAC,EAAE,CAAC;QAC9F,MAAM,GAAG,GAAqB;YAC5B,oEAAoE;YACpE,mEAAmE;YACnE,uEAAuE;YACvE,KAAK,EAAE,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE;YACpD,WAAW,EAAE,KAAK,CAAC,WAAW;YAC9B,YAAY,EAAE,KAAK,CAAC,YAAY;YAChC,UAAU,EAAE,KAAK,CAAC,UAAU;YAC5B,QAAQ,EAAE,KAAK,CAAC,QAAQ;SACzB,CAAC;QACF,MAAM,GAAG,GAAG,MAAM,EAAE,CAAC,IAAI,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC;QACxC,MAAM,UAAU,GAAG,KAAK,CAAC,WAAW,KAAK,IAAI,CAAC;QAC9C,MAAM,MAAM,GAAa,EAAE,CAAC;QAC5B,MAAM,CAAC,IAAI,CAAC,aAAa,GAAG,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC;QAC9C,KAAK,MAAM,CAAC,IAAI,GAAG,CAAC,KAAK,EAAE,CAAC;YAC1B,IAAI,CAAC,CAAC,KAAK,EAAE,CAAC;gBACZ,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,GAAG,KAAK,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC;gBACtC,SAAS;YACX,CAAC;YACD,MAAM,KAAK,GAAa,CAAC,KAAK,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC;YACzC,IAAI,UAAU,IAAI,CAAC,CAAC,EAAE;gBAAE,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;YACpD,IAAI,CAAC,CAAC,MAAM;gBAAE,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;YACnC,IAAI,CAAC,CAAC,MAAM,IAAI,CAAC,CAAC,MAAM,KAAK,WAAW;gBAAE,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC;YACtE,IAAI,CAAC,CAAC,gBAAgB,IAAI,CAAC,CAAC,gBAAgB,KAAK,SAAS;gBAAE,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,gBAAgB,GAAG,CAAC,CAAC;YAClG,MAAM,YAAY,GAAG,kBAAkB,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC;YACnD,IAAI,YAAY;gBAAE,KAAK,CAAC,IAAI,CAAC,YAAY,CAAC,IAAI,EAAE,CAAC,CAAC;YAClD,IAAI,CAAC,CAAC,MAAM;gBAAE,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC;iBACrC,IAAI,CAAC,CAAC,KAAK;gBAAE,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,QAAQ,IAAI,QAAQ,KAAK,WAAW,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC,0BAA0B,CAAC,CAAC;YACjH,MAAM,CAAC,IAAI,CAAC,KAAK,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QACtC,CAAC;QACD,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QAChB,MAAM,UAAU,GAAG,oBAAoB,CAAC,uBAAuB,EAAE,SAAS,EAAE,IAAI,CAAC,CAAC;QAClF,KAAK,MAAM,CAAC,IAAI,GAAG,CAAC,KAAK,EAAE,CAAC;YAC1B,IAAI,CAAC,CAAC,KAAK;gBAAE,SAAS;YACtB,MAAM,IAAI,GAAG,OAAO,CAAC,CAAC,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC;YAC5D,IAAI,CAAC,IAAI;gBAAE,SAAS;YACpB,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,GAAG,GAAG,kBAAkB,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;YAC5D,sEAAsE;YACtE,IAAI,CAAC,CAAC,UAAU,KAAK,OAAO,EAAE,CAAC;gBAC7B,MAAM,CAAC,IAAI,CAAC,qCAAqC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,yBAAyB,CAAC,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;YACpG,CAAC;YACD,MAAM,KAAK,GAAG,CAAC,CAAC,UAAU,CAAC;YAC3B,yEAAyE;YACzE,wEAAwE;YACxE,yCAAyC;YACzC,MAAM,GAAG,GAAG,CAAC,KAAK,EAAE,QAAQ,IAAI,IAAI,CAAC,MAAM,GAAG,UAAU;gBACtD,CAAC,CAAC,iBAAiB,CAAC,IAAI,EAAE,UAAU,CAAC;gBACrC,CAAC,CAAC,IAAI,CAAC;YACT,MAAM,KAAK,GAAG,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC;YACrC,IAAI,KAAK,EAAE,CAAC;gBACV,MAAM,SAAS,GAAG,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,GAAG,GAAG,CAAC,UAAU,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC;gBACrE,MAAM,CAAC,IAAI,CAAC,SAAS,KAAK,CAAC,KAAK,IAAI,SAAS,MAAM,KAAK,CAAC,KAAK,EAAE,CAAC,CAAC;gBAClE,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;gBACnB,MAAM,CAAC,IAAI,CAAC,WAAW,CAAC,KAAK,EAAE,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC;gBAC7C,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;gBACnB,IAAI,GAAG,EAAE,CAAC;oBACR,MAAM,IAAI,GAAG,WAAW,CAAC,MAAM,CAAC,UAAU,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,CAAC;oBAC1D,MAAM,CAAC,IAAI,CACT,GAAG,CAAC,OAAO;wBACT,CAAC,CAAC,iBAAiB,UAAU,sBAAsB,KAAK,CAAC,KAAK,gCAAgC;8BAC1F,MAAM,KAAK,CAAC,KAAK,WAAW,IAAI,mBAAmB,CAAC,CAAC,GAAG,kBAAkB,KAAK,CAAC,KAAK,GAAG,CAAC,IAAI;8BAC7F,wFAAwF;wBAC5F,CAAC,CAAC,iBAAiB,UAAU,YAAY,KAAK,CAAC,KAAK,WAAW,IAAI,SAAS;8BACxE,0BAA0B,CAAC,CAAC,GAAG,kBAAkB,SAAS,GAAG,CAAC,KAAK,CAC1E,CAAC;gBACJ,CAAC;YACH,CAAC;iBAAM,CAAC;gBACN,iEAAiE;gBACjE,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;gBACnB,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;gBACnB,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;YACrB,CAAC;YACD,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QAClB,CAAC;QACD,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,CAAC;QACzC,uEAAuE;QACvE,yEAAyE;QACzE,0EAA0E;QAC1E,MAAM,OAAO,GAAuB,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC,CAAC;QACtE,KAAK,MAAM,CAAC,IAAI,GAAG,CAAC,KAAK,EAAE,CAAC;YAC1B,IAAI,CAAC,CAAC,CAAC,KAAK;gBAAE,SAAS;YACvB,MAAM,UAAU,GAAa,CAAC,OAAO,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC;YAC9C,IAAI,CAAC,CAAC,QAAQ;gBAAE,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE,CAAC,CAAC;YAClD,IAAI,OAAO,CAAC,CAAC,IAAI,KAAK,QAAQ;gBAAE,UAAU,CAAC,IAAI,CAAC,GAAG,WAAW,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;iBACtE,IAAI,CAAC,CAAC,QAAQ;gBAAE,UAAU,CAAC,UAAU,CAAC,MAAM,GAAG,CAAC,CAAC,IAAI,GAAG,CAAC;YAC9D,OAAO,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,UAAU,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;YAC3D,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC;QACxB,CAAC;QACD,+CAA+C;QAC/C,MAAM,IAAI,GAAG,WAAW,CAAC,GAAG,CAAC,CAAC;QAC9B,OAAO;YACL,OAAO;YACP,iBAAiB,EAAE,sBAAsB,CAAC,GAAG,CAAQ;YACrD,OAAO,EAAE,KAAK;YACd,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SACjC,CAAC;IACJ,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,OAAO,GAAG,aAAa,CAAC,GAAG,CAAC,CAAC;QACnC,OAAO;YACL,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAe,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC;YACnD,iBAAiB,EAAE,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,iBAAiB,EAAE,OAAO,EAAE;YACnE,OAAO,EAAE,IAAI;SACd,CAAC;IACJ,CAAC;AACH,CAAC,CAAC;AAEF,eAAe,OAAO,CAAC"}

package/dist/src/usecases/admitSourceRoot.d.ts

@@ -0,0 +1,65 @@
+import type { HostAuditSink } from '@neuralis/package-system/contracts';
+import { type SourceRootStack } from '../domain/sourceRootPair.js';
+/** The create route's refusal of a root pair: one code, never a path. */
+export declare const SOURCE_ROOT_PAIR_MISMATCH: {
+    readonly code: 'source_root_pair_mismatch';
+    readonly error: 'connection.config.hostRoot does not match the folder this server derives for the root — omit it and the server fills it in.';
+};
+/** A folder on this server sent without a root. */
+export declare const SOURCE_ROOT_REQUIRED: {
+    readonly code: 'source_root_required';
+    readonly error: 'A folder on this server needs a root.';
+};
+/** A `neuralis-tree:` root that is not a source-relative folder, or carries a machine half. */
+export declare const SOURCE_ANCHOR_INVALID: {
+    readonly code: 'source_anchor_invalid';
+    readonly error: 'A Neuralis-tree root names a folder relative to the tree (no `..`) and takes no host path.';
+};
+/** A `neuralis-tree:` root on a plane with no attachable Neuralis tree (Docker without the `--neuralis` overlay). */
+export declare const SOURCE_ANCHOR_UNRESOLVABLE: {
+    readonly code: 'source_anchor_unresolvable';
+    readonly error: 'The Neuralis tree is not available on this server.';
+};
+type Connection = {
+    kind: string;
+    config?: unknown;
+};
+export type AdmittedSourceRoot = {
+    connection: Connection;
+    auditHandSet?: (userId: string, projectId: string, source: string) => void;
+} | {
+    status: 400;
+    body: typeof SOURCE_ROOT_PAIR_MISMATCH | typeof SOURCE_ROOT_REQUIRED | typeof SOURCE_ANCHOR_INVALID | typeof SOURCE_ANCHOR_UNRESOLVABLE;
+};
+/**
+ * The root PAIR of an in-process folder on create (`domain/sourceRootPair.ts`):
+ * the server derives the half the client did not anchor, so the gates judge,
+ * and the store keeps, the pair this server would write for that root. A
+ * supplied half that contradicts the derivation answers 400. A half NOTHING
+ * derives (a hand-made bind the mount table does not know) is a statement about
+ * the host filesystem outside every known table: kept only for a caller holding
+ * `sources.privileged` (`mayHandSet`), who may attach `/` anyway, and audited
+ * through the host sink — no sink, no hand-set pair. A root-less folder on this
+ * server is refused here, never stored to be dropped from every listing by the
+ * kind's validator. A Neuralis-tree anchor is resolved by the ONE root resolver
+ * on every plane, so it never takes a stored machine half — and an anchor this
+ * plane cannot open is refused here, not attached to stay unreachable. Another
+ * kind, or a device folder, passes through untouched.
+ */
+export declare function admitSourceRoot(input: {
+    connection: Connection;
+    stack: SourceRootStack;
+    mayHandSet: boolean;
+    audit?: HostAuditSink;
+}): AdmittedSourceRoot;
+/**
+ * `work`'s answer, or `null` when it needed a Neuralis-tree anchor this plane
+ * cannot open (`SourceAnchorUnresolvableError`). A gate that cannot resolve a
+ * zone never judges it: the edit is refused, the listing reads "not attachable".
+ * Any other error propagates.
+ */
+export declare function unlessAnchorUnresolvable<T>(work: Promise<T>): Promise<{
+    value: T;
+} | null>;
+export {};
+//# sourceMappingURL=admitSourceRoot.d.ts.map

package/dist/src/usecases/admitSourceRoot.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"admitSourceRoot.d.ts","sourceRoot":"","sources":["../../../src/usecases/admitSourceRoot.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,oCAAoC,CAAC;AAGxE,OAAO,EAAwC,KAAK,eAAe,EAAE,MAAM,6BAA6B,CAAC;AAEzG,yEAAyE;AACzE,eAAO,MAAM,yBAAyB;aACpC,IAAI,EAAE,2BAA2B;aACjC,KAAK,EAAE,6HAA6H;CAC5H,CAAC;AACX,mDAAmD;AACnD,eAAO,MAAM,oBAAoB;aAAK,IAAI,EAAE,sBAAsB;aAAE,KAAK,EAAE,uCAAuC;CAAW,CAAC;AAC9H,+FAA+F;AAC/F,eAAO,MAAM,qBAAqB;aAAK,IAAI,EAAE,uBAAuB;aAAE,KAAK,EAAE,4FAA4F;CAAW,CAAC;AACrL,qHAAqH;AACrH,eAAO,MAAM,0BAA0B;aAAK,IAAI,EAAE,4BAA4B;aAAE,KAAK,EAAE,oDAAoD;CAAW,CAAC;AAEvJ,KAAK,UAAU,GAAG;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,MAAM,CAAC,EAAE,OAAO,CAAA;CAAE,CAAC;AACrD,MAAM,MAAM,kBAAkB,GAC1B;IAAE,UAAU,EAAE,UAAU,CAAC;IAAC,YAAY,CAAC,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,KAAK,IAAI,CAAA;CAAE,GACtG;IAAE,MAAM,EAAE,GAAG,CAAC;IAAC,IAAI,EAAE,OAAO,yBAAyB,GAAG,OAAO,oBAAoB,GAAG,OAAO,qBAAqB,GAAG,OAAO,0BAA0B,CAAA;CAAE,CAAC;AAE7J;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,eAAe,CAAC,KAAK,EAAE;IACrC,UAAU,EAAE,UAAU,CAAC;IACvB,KAAK,EAAE,eAAe,CAAC;IACvB,UAAU,EAAE,OAAO,CAAC;IACpB,KAAK,CAAC,EAAE,aAAa,CAAC;CACvB,GAAG,kBAAkB,CA+BrB;AAED;;;;;GAKG;AACH,wBAAsB,wBAAwB,CAAC,CAAC,EAAE,IAAI,EAAE,OAAO,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC;IAAE,KAAK,EAAE,CAAC,CAAA;CAAE,GAAG,IAAI,CAAC,CAOhG"}

package/dist/src/usecases/admitSourceRoot.js

@@ -0,0 +1,85 @@
+import { HOST_SOURCE_KIND, sourcePlane } from '@neuralis/package-system/contracts';
+import { SourceAnchorUnresolvableError, resolveLocalRoot, treeAnchorPath } from '../connectors/inProcessTransport.js';
+import { judgeSourceRootPair, sourceRootPlane } from '../domain/sourceRootPair.js';
+/** The create route's refusal of a root pair: one code, never a path. */
+export const SOURCE_ROOT_PAIR_MISMATCH = {
+    code: 'source_root_pair_mismatch',
+    error: 'connection.config.hostRoot does not match the folder this server derives for the root — omit it and the server fills it in.',
+};
+/** A folder on this server sent without a root. */
+export const SOURCE_ROOT_REQUIRED = { code: 'source_root_required', error: 'A folder on this server needs a root.' };
+/** A `neuralis-tree:` root that is not a source-relative folder, or carries a machine half. */
+export const SOURCE_ANCHOR_INVALID = { code: 'source_anchor_invalid', error: 'A Neuralis-tree root names a folder relative to the tree (no `..`) and takes no host path.' };
+/** A `neuralis-tree:` root on a plane with no attachable Neuralis tree (Docker without the `--neuralis` overlay). */
+export const SOURCE_ANCHOR_UNRESOLVABLE = { code: 'source_anchor_unresolvable', error: 'The Neuralis tree is not available on this server.' };
+/**
+ * The root PAIR of an in-process folder on create (`domain/sourceRootPair.ts`):
+ * the server derives the half the client did not anchor, so the gates judge,
+ * and the store keeps, the pair this server would write for that root. A
+ * supplied half that contradicts the derivation answers 400. A half NOTHING
+ * derives (a hand-made bind the mount table does not know) is a statement about
+ * the host filesystem outside every known table: kept only for a caller holding
+ * `sources.privileged` (`mayHandSet`), who may attach `/` anyway, and audited
+ * through the host sink — no sink, no hand-set pair. A root-less folder on this
+ * server is refused here, never stored to be dropped from every listing by the
+ * kind's validator. A Neuralis-tree anchor is resolved by the ONE root resolver
+ * on every plane, so it never takes a stored machine half — and an anchor this
+ * plane cannot open is refused here, not attached to stay unreachable. Another
+ * kind, or a device folder, passes through untouched.
+ */
+export function admitSourceRoot(input) {
+    const { connection, stack } = input;
+    const config = (connection.config ?? {});
+    if (sourcePlane(connection.kind, config) !== 'local')
+        return { connection };
+    if (typeof config.root !== 'string' || config.root.length === 0) {
+        return connection.kind === HOST_SOURCE_KIND ? { status: 400, body: SOURCE_ROOT_REQUIRED } : { connection };
+    }
+    const anchored = treeAnchorPath(config.root);
+    if (anchored !== null) {
+        if (anchored === false || config.hostRoot !== undefined)
+            return { status: 400, body: SOURCE_ANCHOR_INVALID };
+        try {
+            resolveLocalRoot({ configured: config.root, hostRoot: undefined, projectRoot: '', isDocker: stack.isDocker, source: '' });
+        }
+        catch (error) {
+            if (error instanceof SourceAnchorUnresolvableError)
+                return { status: 400, body: SOURCE_ANCHOR_UNRESOLVABLE };
+            throw error;
+        }
+        return { connection };
+    }
+    const verdict = judgeSourceRootPair({ root: config.root, hostRoot: config.hostRoot }, sourceRootPlane(stack));
+    if (verdict.kind === 'mismatch')
+        return { status: 400, body: SOURCE_ROOT_PAIR_MISMATCH };
+    const rest = { ...config };
+    delete rest.hostRoot;
+    const paired = { kind: connection.kind, config: { ...rest, ...verdict.pair } };
+    if (verdict.kind === 'derived')
+        return { connection: paired };
+    const audit = input.audit;
+    if (!audit || !input.mayHandSet)
+        return { status: 400, body: SOURCE_ROOT_PAIR_MISMATCH };
+    const { root, hostRoot } = verdict.pair;
+    return {
+        connection: paired,
+        auditHandSet: (userId, projectId, source) => audit({ action: 'source.host_root_set', userId, target: source, details: { projectId, root, hostRoot } }),
+    };
+}
+/**
+ * `work`'s answer, or `null` when it needed a Neuralis-tree anchor this plane
+ * cannot open (`SourceAnchorUnresolvableError`). A gate that cannot resolve a
+ * zone never judges it: the edit is refused, the listing reads "not attachable".
+ * Any other error propagates.
+ */
+export async function unlessAnchorUnresolvable(work) {
+    try {
+        return { value: await work };
+    }
+    catch (error) {
+        if (error instanceof SourceAnchorUnresolvableError)
+            return null;
+        throw error;
+    }
+}
+//# sourceMappingURL=admitSourceRoot.js.map

package/dist/src/usecases/admitSourceRoot.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"admitSourceRoot.js","sourceRoot":"","sources":["../../../src/usecases/admitSourceRoot.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,gBAAgB,EAAE,WAAW,EAAE,MAAM,oCAAoC,CAAC;AACnF,OAAO,EAAE,6BAA6B,EAAE,gBAAgB,EAAE,cAAc,EAAE,MAAM,qCAAqC,CAAC;AACtH,OAAO,EAAE,mBAAmB,EAAE,eAAe,EAAwB,MAAM,6BAA6B,CAAC;AAEzG,yEAAyE;AACzE,MAAM,CAAC,MAAM,yBAAyB,GAAG;IACvC,IAAI,EAAE,2BAA2B;IACjC,KAAK,EAAE,6HAA6H;CAC5H,CAAC;AACX,mDAAmD;AACnD,MAAM,CAAC,MAAM,oBAAoB,GAAG,EAAE,IAAI,EAAE,sBAAsB,EAAE,KAAK,EAAE,uCAAuC,EAAW,CAAC;AAC9H,+FAA+F;AAC/F,MAAM,CAAC,MAAM,qBAAqB,GAAG,EAAE,IAAI,EAAE,uBAAuB,EAAE,KAAK,EAAE,4FAA4F,EAAW,CAAC;AACrL,qHAAqH;AACrH,MAAM,CAAC,MAAM,0BAA0B,GAAG,EAAE,IAAI,EAAE,4BAA4B,EAAE,KAAK,EAAE,oDAAoD,EAAW,CAAC;AAOvJ;;;;;;;;;;;;;;GAcG;AACH,MAAM,UAAU,eAAe,CAAC,KAK/B;IACC,MAAM,EAAE,UAAU,EAAE,KAAK,EAAE,GAAG,KAAK,CAAC;IACpC,MAAM,MAAM,GAAG,CAAC,UAAU,CAAC,MAAM,IAAI,EAAE,CAA4B,CAAC;IACpE,IAAI,WAAW,CAAC,UAAU,CAAC,IAAI,EAAE,MAAM,CAAC,KAAK,OAAO;QAAE,OAAO,EAAE,UAAU,EAAE,CAAC;IAC5E,IAAI,OAAO,MAAM,CAAC,IAAI,KAAK,QAAQ,IAAI,MAAM,CAAC,IAAI,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAChE,OAAO,UAAU,CAAC,IAAI,KAAK,gBAAgB,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,oBAAoB,EAAE,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,CAAC;IAC7G,CAAC;IACD,MAAM,QAAQ,GAAG,cAAc,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;IAC7C,IAAI,QAAQ,KAAK,IAAI,EAAE,CAAC;QACtB,IAAI,QAAQ,KAAK,KAAK,IAAI,MAAM,CAAC,QAAQ,KAAK,SAAS;YAAE,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,qBAAqB,EAAE,CAAC;QAC7G,IAAI,CAAC;YACH,gBAAgB,CAAC,EAAE,UAAU,EAAE,MAAM,CAAC,IAAI,EAAE,QAAQ,EAAE,SAAS,EAAE,WAAW,EAAE,EAAE,EAAE,QAAQ,EAAE,KAAK,CAAC,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC,CAAC;QAC5H,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,KAAK,YAAY,6BAA6B;gBAAE,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,0BAA0B,EAAE,CAAC;YAC7G,MAAM,KAAK,CAAC;QACd,CAAC;QACD,OAAO,EAAE,UAAU,EAAE,CAAC;IACxB,CAAC;IACD,MAAM,OAAO,GAAG,mBAAmB,CAAC,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,QAAQ,EAAE,MAAM,CAAC,QAAQ,EAAE,EAAE,eAAe,CAAC,KAAK,CAAC,CAAC,CAAC;IAC9G,IAAI,OAAO,CAAC,IAAI,KAAK,UAAU;QAAE,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,yBAAyB,EAAE,CAAC;IACzF,MAAM,IAAI,GAAG,EAAE,GAAG,MAAM,EAAE,CAAC;IAC3B,OAAO,IAAI,CAAC,QAAQ,CAAC;IACrB,MAAM,MAAM,GAAG,EAAE,IAAI,EAAE,UAAU,CAAC,IAAI,EAAE,MAAM,EAAE,EAAE,GAAG,IAAI,EAAE,GAAG,OAAO,CAAC,IAAI,EAAE,EAAE,CAAC;IAC/E,IAAI,OAAO,CAAC,IAAI,KAAK,SAAS;QAAE,OAAO,EAAE,UAAU,EAAE,MAAM,EAAE,CAAC;IAC9D,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC;IAC1B,IAAI,CAAC,KAAK,IAAI,CAAC,KAAK,CAAC,UAAU;QAAE,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,yBAAyB,EAAE,CAAC;IACzF,MAAM,EAAE,IAAI,EAAE,QAAQ,EAAE,GAAG,OAAO,CAAC,IAAI,CAAC;IACxC,OAAO;QACL,UAAU,EAAE,MAAM;QAClB,YAAY,EAAE,CAAC,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,EAAE,CAAC,KAAK,CAAC,EAAE,MAAM,EAAE,sBAAsB,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,QAAQ,EAAE,EAAE,CAAC;KACvJ,CAAC;AACJ,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,wBAAwB,CAAI,IAAgB;IAChE,IAAI,CAAC;QACH,OAAO,EAAE,KAAK,EAAE,MAAM,IAAI,EAAE,CAAC;IAC/B,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,KAAK,YAAY,6BAA6B;YAAE,OAAO,IAAI,CAAC;QAChE,MAAM,KAAK,CAAC;IACd,CAAC;AACH,CAAC"}

package/dist/src/usecases/browseSourceFolders.d.ts

@@ -0,0 +1,85 @@
+/**
+ * `GET /sources/browse` — one level of FOLDERS, the step that precedes attaching
+ * a source. Two planes, one rule: **you may browse exactly what you would be
+ * allowed to attach.**
+ *
+ * - **This server** (`browseServerFolders`). The route admits `sources.mount`
+ *   (the attach act's own gate) and hands over the gates it owns: the shared
+ *   protected-root table (`/`, the App Zone and the Neuralis tree cost
+ *   `sources.privileged` here exactly as at attach time), matched IS-or-UNDER
+ *   so a parent stays walkable while a protected child is simply absent
+ *   (hidden-not-locked), and the native folder fence. Natively any absolute
+ *   path the gates admit; in Docker the `/mounts` zone and every folder under
+ *   it, never above it. The gate runs on the lexical path AND again on the
+ *   `realpath` — a symlink whose literal path is innocent can still point at
+ *   `/`, a protected zone or out of `/mounts`.
+ * - **The caller's own device** (`browseDeviceFolders`). The device plane's
+ *   ONE attach gate (agent-core's `mayAttach`: the device's owner holding
+ *   `device.own`, nothing else — `sources.mount` is a manager default and never
+ *   reaches somebody's machine) decides; every other caller gets ONE fixed
+ *   refusal, the same bytes for an unknown id. The device's broker clamps the
+ *   path against the folders its owner allowed THIS host, lexically before any
+ *   realpath, so a refusal says nothing about existence. An empty path lists
+ *   those allowed folders (where the picker starts).
+ *
+ * Invariant 9 on both planes: a failure never carries the path or an errno —
+ * one stable sentence on this server, a fixed code from a device; the operator
+ * reads the detail in the server log. Cost: one `readdir` + `realpath` per call
+ * here; one broker `/fs/list` (≤ 2 000 entries, folder names only on the way
+ * back) or one `/ceiling/roots` per call on a device. No cache, no timer.
+ */
+import type { AgentCoreApi } from '@neuralis/agent-core';
+/** One stable sentence for every server-side browse failure (invariant 9). */
+export declare const BROWSE_UNREADABLE = "That path is not available.";
+/** The ONE answer to every caller the device attach gate does not admit — an unknown id included. */
+export declare const DEVICE_BROWSE_REFUSAL = "Only the device's owner may browse it.";
+/** The container's bind-mount zone: the only folders a Docker deployment can attach. */
+export declare const DOCKER_MOUNTS_ROOT = "/mounts";
+export type BrowseEntry = {
+    name: string;
+    path: string;
+    type: 'directory';
+    access?: 'read' | 'write';
+};
+export type BrowseAnswer = {
+    status: number;
+    body: Record<string, unknown>;
+};
+/** The gates `routes/sources.ts` owns, bound to the caller. */
+export type ServerBrowseGates = {
+    /** Features the caller lacks to enumerate `candidate` (the protected-root table + the table-independent floor). */
+    missingFeatures(candidate: string): string[];
+    /** Hidden-not-locked: may the caller SEE this child at all? */
+    childVisible(child: string): boolean;
+    /** Whole-host discovery (the Windows drive letters) — `sources.privileged`. */
+    mayBrowseDrives(): boolean;
+    privilegedFeature: string;
+    privilegedRoots: readonly string[];
+    /** The native fence's project zone, or `null` where the fence does not apply (Docker). */
+    fenceProject(): Promise<string | null>;
+};
+/** One level of folders on THIS server — the route has already admitted `sources.mount`. */
+export declare function browseServerFolders(input: {
+    rawPath: string;
+    isDocker: boolean;
+    mountsRoot?: string;
+}, gates: ServerBrowseGates): Promise<BrowseAnswer>;
+/** The device half of agent-core's cross-package API the picker reads. */
+export type DeviceBrowsePort = Pick<NonNullable<AgentCoreApi['devices']>, 'listFolder' | 'ceilingRoots'>;
+/**
+ * One level of folders on the caller's OWN paired device, or (empty path) the
+ * folders that device allows THIS host. `allowed` is the route's attach verdict
+ * (`devices.mayAttach`); agent-core re-checks it on every call. A device that
+ * cannot answer (offline, an older CLI, the folder outside what it allows) is a
+ * 200 with `state` = that fixed code and no entries — the picker says which,
+ * and a typed path still attaches (the create re-checks everything).
+ */
+export declare function browseDeviceFolders(input: {
+    device: string;
+    rawPath: string;
+    allowed: boolean;
+}, devices: DeviceBrowsePort | undefined, session: {
+    userId: string;
+    grantedFeatures: string[];
+}): Promise<BrowseAnswer>;
+//# sourceMappingURL=browseSourceFolders.d.ts.map

package/dist/src/usecases/browseSourceFolders.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"browseSourceFolders.d.ts","sourceRoot":"","sources":["../../../src/usecases/browseSourceFolders.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AAKH,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,sBAAsB,CAAC;AAIzD,8EAA8E;AAC9E,eAAO,MAAM,iBAAiB,gCAAgC,CAAC;AAC/D,qGAAqG;AACrG,eAAO,MAAM,qBAAqB,2CAA2C,CAAC;AAC9E,wFAAwF;AACxF,eAAO,MAAM,kBAAkB,YAAY,CAAC;AAE5C,MAAM,MAAM,WAAW,GAAG;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,WAAW,CAAC;IAAC,MAAM,CAAC,EAAE,MAAM,GAAG,OAAO,CAAA;CAAE,CAAC;AACvG,MAAM,MAAM,YAAY,GAAG;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;CAAE,CAAC;AAE7E,+DAA+D;AAC/D,MAAM,MAAM,iBAAiB,GAAG;IAC9B,mHAAmH;IACnH,eAAe,CAAC,SAAS,EAAE,MAAM,GAAG,MAAM,EAAE,CAAC;IAC7C,+DAA+D;IAC/D,YAAY,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC;IACrC,+EAA+E;IAC/E,eAAe,IAAI,OAAO,CAAC;IAC3B,iBAAiB,EAAE,MAAM,CAAC;IAC1B,eAAe,EAAE,SAAS,MAAM,EAAE,CAAC;IACnC,0FAA0F;IAC1F,YAAY,IAAI,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAAC;CACxC,CAAC;AAoDF,4FAA4F;AAC5F,wBAAsB,mBAAmB,CACvC,KAAK,EAAE;IAAE,OAAO,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,OAAO,CAAC;IAAC,UAAU,CAAC,EAAE,MAAM,CAAA;CAAE,EAClE,KAAK,EAAE,iBAAiB,GACvB,OAAO,CAAC,YAAY,CAAC,CA8DvB;AAED,0EAA0E;AAC1E,MAAM,MAAM,gBAAgB,GAAG,IAAI,CAAC,WAAW,CAAC,YAAY,CAAC,SAAS,CAAC,CAAC,EAAE,YAAY,GAAG,cAAc,CAAC,CAAC;AAEzG;;;;;;;GAOG;AACH,wBAAsB,mBAAmB,CACvC,KAAK,EAAE;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,OAAO,CAAA;CAAE,EAC5D,OAAO,EAAE,gBAAgB,GAAG,SAAS,EACrC,OAAO,EAAE;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,eAAe,EAAE,MAAM,EAAE,CAAA;CAAE,GACrD,OAAO,CAAC,YAAY,CAAC,CA0BvB"}

package/dist/src/usecases/browseSourceFolders.js

@@ -0,0 +1,210 @@
+/**
+ * `GET /sources/browse` — one level of FOLDERS, the step that precedes attaching
+ * a source. Two planes, one rule: **you may browse exactly what you would be
+ * allowed to attach.**
+ *
+ * - **This server** (`browseServerFolders`). The route admits `sources.mount`
+ *   (the attach act's own gate) and hands over the gates it owns: the shared
+ *   protected-root table (`/`, the App Zone and the Neuralis tree cost
+ *   `sources.privileged` here exactly as at attach time), matched IS-or-UNDER
+ *   so a parent stays walkable while a protected child is simply absent
+ *   (hidden-not-locked), and the native folder fence. Natively any absolute
+ *   path the gates admit; in Docker the `/mounts` zone and every folder under
+ *   it, never above it. The gate runs on the lexical path AND again on the
+ *   `realpath` — a symlink whose literal path is innocent can still point at
+ *   `/`, a protected zone or out of `/mounts`.
+ * - **The caller's own device** (`browseDeviceFolders`). The device plane's
+ *   ONE attach gate (agent-core's `mayAttach`: the device's owner holding
+ *   `device.own`, nothing else — `sources.mount` is a manager default and never
+ *   reaches somebody's machine) decides; every other caller gets ONE fixed
+ *   refusal, the same bytes for an unknown id. The device's broker clamps the
+ *   path against the folders its owner allowed THIS host, lexically before any
+ *   realpath, so a refusal says nothing about existence. An empty path lists
+ *   those allowed folders (where the picker starts).
+ *
+ * Invariant 9 on both planes: a failure never carries the path or an errno —
+ * one stable sentence on this server, a fixed code from a device; the operator
+ * reads the detail in the server log. Cost: one `readdir` + `realpath` per call
+ * here; one broker `/fs/list` (≤ 2 000 entries, folder names only on the way
+ * back) or one `/ceiling/roots` per call on a device. No cache, no timer.
+ */
+import { readdir, realpath, stat } from 'node:fs/promises';
+import { platform } from 'node:os';
+import { dirname, isAbsolute, join, posix, resolve } from 'node:path';
+import { hostPathFlavour, isFilesystemRoot, isPathInside } from '@neuralis/package-system/paths';
+import { NATIVE_LOCAL_REFUSAL, nativeLocalPlacement } from '../domain/access/nativeLocalFence.js';
+/** One stable sentence for every server-side browse failure (invariant 9). */
+export const BROWSE_UNREADABLE = 'That path is not available.';
+/** The ONE answer to every caller the device attach gate does not admit — an unknown id included. */
+export const DEVICE_BROWSE_REFUSAL = "Only the device's owner may browse it.";
+/** The container's bind-mount zone: the only folders a Docker deployment can attach. */
+export const DOCKER_MOUNTS_ROOT = '/mounts';
+const refusedFeature = (feature) => ({ status: 403, body: { error: `Browsing this path requires the ${feature} feature.` } });
+const unreadable = () => ({ status: 400, body: { error: BROWSE_UNREADABLE } });
+/** The visible, non-dot sub-folders of `real`, sorted, as entries under `real`. */
+async function listFolders(real, visible) {
+    const entries = await readdir(real, { withFileTypes: true });
+    return entries.filter((e) => e.isDirectory() && !e.name.startsWith('.'))
+        .sort((a, b) => a.name.localeCompare(b.name))
+        .map((e) => ({ name: e.name, path: join(real, e.name), type: 'directory' }))
+        .filter((e) => visible(e.path));
+}
+/**
+ * Docker: `/mounts` and anything under it — the zone's bind mounts and their
+ * sub-folders (an attach there derives its `hostRoot` from the bind, so a
+ * sub-folder works like the bind itself). Empty path ⇒ the zone. Outside the
+ * zone, lexically or by its realpath, is the one unreadable answer: the zone is
+ * the whole of what a container can attach. A zone that does not exist yet
+ * ("no mounts configured") is an empty list, not an error.
+ */
+async function browseDockerMounts(rawPath, gates, zone) {
+    const requested = rawPath || zone;
+    if (requested.includes('\0') || !posix.isAbsolute(requested))
+        return unreadable();
+    const canonical = posix.resolve(requested);
+    if (!isPathInside(zone, canonical, posix))
+        return unreadable();
+    let real;
+    let realZone;
+    try {
+        realZone = await realpath(zone);
+    }
+    catch {
+        return canonical === zone ? { status: 200, body: { entries: [], atRoot: true } } : unreadable();
+    }
+    try {
+        real = await realpath(canonical);
+    }
+    catch {
+        return unreadable();
+    }
+    if (!isPathInside(realZone, real, posix))
+        return unreadable();
+    for (const candidate of new Set([canonical, real])) {
+        const missing = gates.missingFeatures(candidate);
+        if (missing.length > 0)
+            return refusedFeature(missing[0]);
+    }
+    try {
+        return { status: 200, body: { entries: await listFolders(real, gates.childVisible), atRoot: real === realZone } };
+    }
+    catch (err) {
+        console.warn('[sources/browse] readdir failed:', err instanceof Error ? err.message : String(err));
+        return unreadable();
+    }
+}
+/** One level of folders on THIS server — the route has already admitted `sources.mount`. */
+export async function browseServerFolders(input, gates) {
+    if (input.isDocker)
+        return browseDockerMounts(input.rawPath, gates, input.mountsRoot ?? DOCKER_MOUNTS_ROOT);
+    const rawPath = input.rawPath;
+    if (!rawPath)
+        return { status: 400, body: { error: 'Missing path parameter' } };
+    // A NUL byte survives `resolve()` unchanged and would slip past every string
+    // comparison in the table before `readdir` rejects it.
+    if (rawPath.includes('\0'))
+        return unreadable();
+    // A relative path would resolve against the SERVER process cwd — never what
+    // the caller meant, and it also closes the drive-relative `C:foo` form.
+    if (!isAbsolute(rawPath))
+        return { status: 400, body: { error: 'Path must be absolute' } };
+    // ONE canonical value from here on: the gate, the root test, the readdir and
+    // the child paths all use it.
+    const canonical = resolve(rawPath);
+    const denied = gates.missingFeatures(canonical);
+    if (denied.length > 0)
+        return refusedFeature(denied[0]);
+    const fenceRoot = await gates.fenceProject();
+    const fenceProject = fenceRoot ? resolve(fenceRoot) : '';
+    if (fenceRoot !== null && nativeLocalPlacement(canonical, fenceProject, gates.privilegedRoots) === 'outside') {
+        return { status: 403, body: NATIVE_LOCAL_REFUSAL };
+    }
+    // `resolve` is purely LEXICAL — re-run the same gate on the real path.
+    let real;
+    try {
+        real = await realpath(canonical);
+    }
+    catch {
+        return unreadable();
+    }
+    if (real !== canonical) {
+        const deniedReal = gates.missingFeatures(real);
+        if (deniedReal.length > 0)
+            return refusedFeature(deniedReal[0]);
+    }
+    const realProject = fenceProject ? await realpath(fenceProject).catch(() => fenceProject) : '';
+    const placement = fenceRoot === null ? null : nativeLocalPlacement(real, realProject, gates.privilegedRoots);
+    if (placement === 'outside')
+        return { status: 403, body: NATIVE_LOCAL_REFUSAL };
+    // Whole-host discovery by definition — the drive letters ARE the host. The
+    // filesystem-root floor already required the privileged feature; this second
+    // check keeps that true even if the table ever changes.
+    if (platform() === 'win32' && dirname(real) === real) {
+        if (!gates.mayBrowseDrives())
+            return refusedFeature(gates.privilegedFeature);
+        const drives = [];
+        for (const letter of 'ABCDEFGHIJKLMNOPQRSTUVWXYZ') {
+            try {
+                await stat(`${letter}:\\`);
+                drives.push({ name: `${letter}:\\`, path: `${letter}:\\`, type: 'directory' });
+            }
+            catch { /* skip */ }
+        }
+        return { status: 200, body: { entries: drives, atRoot: true } };
+    }
+    try {
+        const visible = (child) => gates.childVisible(child)
+            // Natively an ANCESTOR lists only the children on the way to an attachable root.
+            && (placement !== 'ancestor' || nativeLocalPlacement(child, realProject, gates.privilegedRoots) !== 'outside');
+        // The "up" control's one answer — the kernel's root predicate, so a
+        // Windows drive root ends the climb exactly like `/`.
+        return { status: 200, body: { entries: await listFolders(real, visible), atRoot: isFilesystemRoot(real) } };
+    }
+    catch (err) {
+        // Never the raw message: it carries the absolute path and tells "does not
+        // exist" from "cannot be read" — an existence oracle over the host.
+        console.warn('[sources/browse] readdir failed:', err instanceof Error ? err.message : String(err));
+        return unreadable();
+    }
+}
+/**
+ * One level of folders on the caller's OWN paired device, or (empty path) the
+ * folders that device allows THIS host. `allowed` is the route's attach verdict
+ * (`devices.mayAttach`); agent-core re-checks it on every call. A device that
+ * cannot answer (offline, an older CLI, the folder outside what it allows) is a
+ * 200 with `state` = that fixed code and no entries — the picker says which,
+ * and a typed path still attaches (the create re-checks everything).
+ */
+export async function browseDeviceFolders(input, devices, session) {
+    const refused = { status: 403, body: { error: DEVICE_BROWSE_REFUSAL } };
+    if (!input.allowed || !devices)
+        return refused;
+    const { device, rawPath } = input;
+    if (!rawPath) {
+        const roots = await devices.ceilingRoots(session, device);
+        if (!roots.ok)
+            return roots.code === 'refused' ? refused : { status: 200, body: { entries: [], atRoot: true, roots: true, state: roots.code } };
+        const write = new Set(roots.write);
+        const all = [...new Set([...roots.read, ...roots.write])].sort((a, b) => a.localeCompare(b));
+        const entries = all.map((p) => ({ name: p, path: p, type: 'directory', access: write.has(p) ? 'write' : 'read' }));
+        return { status: 200, body: { entries, atRoot: true, roots: true, state: 'ok' } };
+    }
+    if (rawPath.includes('\0') || rawPath.length > 4096)
+        return unreadable();
+    if (!hostPathFlavour(rawPath).isAbsolute(rawPath))
+        return { status: 400, body: { error: 'Path must be absolute' } };
+    const listing = await devices.listFolder(session, device, rawPath);
+    if (!listing.ok)
+        return listing.code === 'refused' ? refused : { status: 200, body: { entries: [], atRoot: false, state: listing.code } };
+    return {
+        status: 200,
+        body: {
+            entries: listing.entries.map((e) => ({ ...e, type: 'directory' })),
+            atRoot: isFilesystemRoot(rawPath),
+            state: 'ok',
+            ...(listing.truncated ? { truncated: true } : {}),
+            ...(listing.symlinks > 0 ? { symlinks: listing.symlinks } : {}),
+        },
+    };
+}
+//# sourceMappingURL=browseSourceFolders.js.map

package/dist/src/usecases/browseSourceFolders.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"browseSourceFolders.js","sourceRoot":"","sources":["../../../src/usecases/browseSourceFolders.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AAEH,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,kBAAkB,CAAC;AAC3D,OAAO,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AACnC,OAAO,EAAE,OAAO,EAAE,UAAU,EAAE,IAAI,EAAE,KAAK,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAEtE,OAAO,EAAE,eAAe,EAAE,gBAAgB,EAAE,YAAY,EAAE,MAAM,gCAAgC,CAAC;AACjG,OAAO,EAAE,oBAAoB,EAAE,oBAAoB,EAAE,MAAM,sCAAsC,CAAC;AAElG,8EAA8E;AAC9E,MAAM,CAAC,MAAM,iBAAiB,GAAG,6BAA6B,CAAC;AAC/D,qGAAqG;AACrG,MAAM,CAAC,MAAM,qBAAqB,GAAG,wCAAwC,CAAC;AAC9E,wFAAwF;AACxF,MAAM,CAAC,MAAM,kBAAkB,GAAG,SAAS,CAAC;AAmB5C,MAAM,cAAc,GAAG,CAAC,OAAe,EAAgB,EAAE,CAAC,CAAC,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE,KAAK,EAAE,mCAAmC,OAAO,WAAW,EAAE,EAAE,CAAC,CAAC;AACpJ,MAAM,UAAU,GAAG,GAAiB,EAAE,CAAC,CAAC,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE,KAAK,EAAE,iBAAiB,EAAE,EAAE,CAAC,CAAC;AAE7F,mFAAmF;AACnF,KAAK,UAAU,WAAW,CAAC,IAAY,EAAE,OAAmC;IAC1E,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,IAAI,EAAE,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC,CAAC;IAC7D,OAAO,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,WAAW,EAAE,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC;SACrE,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;SAC5C,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,WAAoB,EAAE,CAAC,CAAC;SACpF,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC;AACpC,CAAC;AAED;;;;;;;GAOG;AACH,KAAK,UAAU,kBAAkB,CAAC,OAAe,EAAE,KAAwB,EAAE,IAAY;IACvF,MAAM,SAAS,GAAG,OAAO,IAAI,IAAI,CAAC;IAClC,IAAI,SAAS,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,SAAS,CAAC;QAAE,OAAO,UAAU,EAAE,CAAC;IAClF,MAAM,SAAS,GAAG,KAAK,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;IAC3C,IAAI,CAAC,YAAY,CAAC,IAAI,EAAE,SAAS,EAAE,KAAK,CAAC;QAAE,OAAO,UAAU,EAAE,CAAC;IAC/D,IAAI,IAAY,CAAC;IACjB,IAAI,QAAgB,CAAC;IACrB,IAAI,CAAC;QACH,QAAQ,GAAG,MAAM,QAAQ,CAAC,IAAI,CAAC,CAAC;IAClC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,KAAK,IAAI,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE,OAAO,EAAE,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,EAAE,CAAC,CAAC,CAAC,UAAU,EAAE,CAAC;IAClG,CAAC;IACD,IAAI,CAAC;QACH,IAAI,GAAG,MAAM,QAAQ,CAAC,SAAS,CAAC,CAAC;IACnC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,UAAU,EAAE,CAAC;IACtB,CAAC;IACD,IAAI,CAAC,YAAY,CAAC,QAAQ,EAAE,IAAI,EAAE,KAAK,CAAC;QAAE,OAAO,UAAU,EAAE,CAAC;IAC9D,KAAK,MAAM,SAAS,IAAI,IAAI,GAAG,CAAC,CAAC,SAAS,EAAE,IAAI,CAAC,CAAC,EAAE,CAAC;QACnD,MAAM,OAAO,GAAG,KAAK,CAAC,eAAe,CAAC,SAAS,CAAC,CAAC;QACjD,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC;YAAE,OAAO,cAAc,CAAC,OAAO,CAAC,CAAC,CAAE,CAAC,CAAC;IAC7D,CAAC;IACD,IAAI,CAAC;QACH,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC,IAAI,EAAE,KAAK,CAAC,YAAY,CAAC,EAAE,MAAM,EAAE,IAAI,KAAK,QAAQ,EAAE,EAAE,CAAC;IACpH,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO,CAAC,IAAI,CAAC,kCAAkC,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC;QACnG,OAAO,UAAU,EAAE,CAAC;IACtB,CAAC;AACH,CAAC;AAED,4FAA4F;AAC5F,MAAM,CAAC,KAAK,UAAU,mBAAmB,CACvC,KAAkE,EAClE,KAAwB;IAExB,IAAI,KAAK,CAAC,QAAQ;QAAE,OAAO,kBAAkB,CAAC,KAAK,CAAC,OAAO,EAAE,KAAK,EAAE,KAAK,CAAC,UAAU,IAAI,kBAAkB,CAAC,CAAC;IAC5G,MAAM,OAAO,GAAG,KAAK,CAAC,OAAO,CAAC;IAC9B,IAAI,CAAC,OAAO;QAAE,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE,KAAK,EAAE,wBAAwB,EAAE,EAAE,CAAC;IAChF,6EAA6E;IAC7E,uDAAuD;IACvD,IAAI,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC;QAAE,OAAO,UAAU,EAAE,CAAC;IAChD,4EAA4E;IAC5E,wEAAwE;IACxE,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC;QAAE,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE,KAAK,EAAE,uBAAuB,EAAE,EAAE,CAAC;IAE3F,6EAA6E;IAC7E,8BAA8B;IAC9B,MAAM,SAAS,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IACnC,MAAM,MAAM,GAAG,KAAK,CAAC,eAAe,CAAC,SAAS,CAAC,CAAC;IAChD,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC;QAAE,OAAO,cAAc,CAAC,MAAM,CAAC,CAAC,CAAE,CAAC,CAAC;IACzD,MAAM,SAAS,GAAG,MAAM,KAAK,CAAC,YAAY,EAAE,CAAC;IAC7C,MAAM,YAAY,GAAG,SAAS,CAAC,CAAC,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IACzD,IAAI,SAAS,KAAK,IAAI,IAAI,oBAAoB,CAAC,SAAS,EAAE,YAAY,EAAE,KAAK,CAAC,eAAe,CAAC,KAAK,SAAS,EAAE,CAAC;QAC7G,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,oBAAoB,EAAE,CAAC;IACrD,CAAC;IAED,uEAAuE;IACvE,IAAI,IAAY,CAAC;IACjB,IAAI,CAAC;QACH,IAAI,GAAG,MAAM,QAAQ,CAAC,SAAS,CAAC,CAAC;IACnC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,UAAU,EAAE,CAAC;IACtB,CAAC;IACD,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;QACvB,MAAM,UAAU,GAAG,KAAK,CAAC,eAAe,CAAC,IAAI,CAAC,CAAC;QAC/C,IAAI,UAAU,CAAC,MAAM,GAAG,CAAC;YAAE,OAAO,cAAc,CAAC,UAAU,CAAC,CAAC,CAAE,CAAC,CAAC;IACnE,CAAC;IACD,MAAM,WAAW,GAAG,YAAY,CAAC,CAAC,CAAC,MAAM,QAAQ,CAAC,YAAY,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IAC/F,MAAM,SAAS,GAAG,SAAS,KAAK,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,oBAAoB,CAAC,IAAI,EAAE,WAAW,EAAE,KAAK,CAAC,eAAe,CAAC,CAAC;IAC7G,IAAI,SAAS,KAAK,SAAS;QAAE,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,oBAAoB,EAAE,CAAC;IAEhF,2EAA2E;IAC3E,6EAA6E;IAC7E,wDAAwD;IACxD,IAAI,QAAQ,EAAE,KAAK,OAAO,IAAI,OAAO,CAAC,IAAI,CAAC,KAAK,IAAI,EAAE,CAAC;QACrD,IAAI,CAAC,KAAK,CAAC,eAAe,EAAE;YAAE,OAAO,cAAc,CAAC,KAAK,CAAC,iBAAiB,CAAC,CAAC;QAC7E,MAAM,MAAM,GAAkB,EAAE,CAAC;QACjC,KAAK,MAAM,MAAM,IAAI,4BAA4B,EAAE,CAAC;YAClD,IAAI,CAAC;gBAAC,MAAM,IAAI,CAAC,GAAG,MAAM,KAAK,CAAC,CAAC;gBAAC,MAAM,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,GAAG,MAAM,KAAK,EAAE,IAAI,EAAE,GAAG,MAAM,KAAK,EAAE,IAAI,EAAE,WAAW,EAAE,CAAC,CAAC;YAAC,CAAC;YAAC,MAAM,CAAC,CAAC,UAAU,CAAC,CAAC;QAC1I,CAAC;QACD,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,EAAE,CAAC;IAClE,CAAC;IAED,IAAI,CAAC;QACH,MAAM,OAAO,GAAG,CAAC,KAAa,EAAW,EAAE,CAAC,KAAK,CAAC,YAAY,CAAC,KAAK,CAAC;YACnE,iFAAiF;eAC9E,CAAC,SAAS,KAAK,UAAU,IAAI,oBAAoB,CAAC,KAAK,EAAE,WAAW,EAAE,KAAK,CAAC,eAAe,CAAC,KAAK,SAAS,CAAC,CAAC;QACjH,oEAAoE;QACpE,sDAAsD;QACtD,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC,IAAI,EAAE,OAAO,CAAC,EAAE,MAAM,EAAE,gBAAgB,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC;IAC9G,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,0EAA0E;QAC1E,oEAAoE;QACpE,OAAO,CAAC,IAAI,CAAC,kCAAkC,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC;QACnG,OAAO,UAAU,EAAE,CAAC;IACtB,CAAC;AACH,CAAC;AAKD;;;;;;;GAOG;AACH,MAAM,CAAC,KAAK,UAAU,mBAAmB,CACvC,KAA4D,EAC5D,OAAqC,EACrC,OAAsD;IAEtD,MAAM,OAAO,GAAiB,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE,KAAK,EAAE,qBAAqB,EAAE,EAAE,CAAC;IACtF,IAAI,CAAC,KAAK,CAAC,OAAO,IAAI,CAAC,OAAO;QAAE,OAAO,OAAO,CAAC;IAC/C,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,GAAG,KAAK,CAAC;IAClC,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,MAAM,KAAK,GAAG,MAAM,OAAO,CAAC,YAAY,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;QAC1D,IAAI,CAAC,KAAK,CAAC,EAAE;YAAE,OAAO,KAAK,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE,OAAO,EAAE,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,KAAK,EAAE,KAAK,CAAC,IAAI,EAAE,EAAE,CAAC;QAChJ,MAAM,KAAK,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;QACnC,MAAM,GAAG,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,CAAC,GAAG,KAAK,CAAC,IAAI,EAAE,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,CAAC;QAC7F,MAAM,OAAO,GAAkB,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,EAAE,IAAI,EAAE,CAAC,EAAE,IAAI,EAAE,WAAW,EAAE,MAAM,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC;QAClI,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,EAAE,CAAC;IACpF,CAAC;IACD,IAAI,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,OAAO,CAAC,MAAM,GAAG,IAAI;QAAE,OAAO,UAAU,EAAE,CAAC;IACzE,IAAI,CAAC,eAAe,CAAC,OAAO,CAAC,CAAC,UAAU,CAAC,OAAO,CAAC;QAAE,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE,KAAK,EAAE,uBAAuB,EAAE,EAAE,CAAC;IACpH,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,UAAU,CAAC,OAAO,EAAE,MAAM,EAAE,OAAO,CAAC,CAAC;IACnE,IAAI,CAAC,OAAO,CAAC,EAAE;QAAE,OAAO,OAAO,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE,OAAO,EAAE,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,KAAK,EAAE,OAAO,CAAC,IAAI,EAAE,EAAE,CAAC;IAC1I,OAAO;QACL,MAAM,EAAE,GAAG;QACX,IAAI,EAAE;YACJ,OAAO,EAAE,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,IAAI,EAAE,WAAoB,EAAE,CAAC,CAAC;YAC3E,MAAM,EAAE,gBAAgB,CAAC,OAAO,CAAC;YACjC,KAAK,EAAE,IAAI;YACX,GAAG,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACjD,GAAG,CAAC,OAAO,CAAC,QAAQ,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,OAAO,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAChE;KACF,CAAC;AACJ,CAAC"}

package/dist/src/usecases/createDeclaredSources.d.ts

@@ -1,5 +1,5 @@
 import type { ConnectorHierarchicalPermissions, ConnectorPathPermission, PackageSourceDeclaration } from '@neuralis/package-system/contracts';
-import type { RuntimeStackInfo } from '@neuralis/package-system/paths';
+import { type RuntimeStackInfo } from '@neuralis/package-system/paths';
 import type { SourceConfigPort, SourceConfigScope } from '../connectors/types.js';
 import type { SourceConfig } from '../domain/sourceConfig.js';
 type RepairLogger = {
@@ -24,9 +24,20 @@ type RepairLogger = {
  */
 export type DeclaredSourceFailure = {
     source: string;
-    reason: 'baselines_unresolvable' | 'write_failed' | 'binding_failed';
+    reason: 'baselines_unresolvable' | 'root_outside_project' | 'write_failed' | 'binding_failed';
     error: string;
 };
+/**
+ * Does a declared in-process folder's root leave its project zone on disk? The
+ * kernel validator already keeps a declared root project-relative (no `..`, no
+ * absolute path), so the LEXICAL path stays inside; what it never sees is a
+ * symlink standing at that path. This is the route's realpath arm for the third
+ * producer: the folder's REAL path must stay inside the project zone's real
+ * path, on either plane (natively the fence's own rule; in a container the zone
+ * is still the only place a declaration may name). A root that does not exist
+ * yet cannot point anywhere and passes; no known projects root ⇒ no judgement.
+ */
+export declare function declaredRootLeavesProject(config: Pick<SourceConfig, 'connection'>, runtimeStack: RuntimeStackInfo | null, projectId: string): Promise<boolean>;
 export declare function createMissingDeclaredSources(deps: {
     sourceConfigs: SourceConfigPort;
     bindSource: (scope: SourceConfigScope, config: SourceConfig) => Promise<void>;

package/dist/src/usecases/createDeclaredSources.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"createDeclaredSources.d.ts","sourceRoot":"","sources":["../../../src/usecases/createDeclaredSources.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,gCAAgC,EAAE,uBAAuB,EAAE,wBAAwB,EAAE,MAAM,oCAAoC,CAAC;AAC9I,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,gCAAgC,CAAC;AAEvE,OAAO,KAAK,EAAE,gBAAgB,EAAE,iBAAiB,EAAE,MAAM,wBAAwB,CAAC;AAClF,OAAO,KAAK,EAA2B,YAAY,EAAE,MAAM,2BAA2B,CAAC;AAGvF,KAAK,YAAY,GAAG;IAAE,IAAI,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAAK,IAAI,CAAC;IAAC,IAAI,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAAK,IAAI,CAAA;CAAE,CAAC;AAEnJ;;;;;;;;;;;;;;;GAeG;AACH,MAAM,MAAM,qBAAqB,GAAG;IAClC,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,wBAAwB,GAAG,cAAc,GAAG,gBAAgB,CAAC;IACrE,KAAK,EAAE,MAAM,CAAC;CACf,CAAC;AAEF,wBAAsB,4BAA4B,CAChD,IAAI,EAAE;IACJ,aAAa,EAAE,gBAAgB,CAAC;IAChC,UAAU,EAAE,CAAC,KAAK,EAAE,iBAAiB,EAAE,MAAM,EAAE,YAAY,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IAC9E,aAAa,EAAE,MAAM,CAAC;IACtB,gFAAgF;IAChF,kBAAkB,EAAE,SAAS,MAAM,EAAE,CAAC;IACtC,qBAAqB,EAAE,MAAM,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,gCAAgC,CAAC,CAAC,CAAC;IAC9F,kBAAkB,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,uBAAuB,EAAE,CAAC;IAChE,YAAY,EAAE,gBAAgB,GAAG,IAAI,CAAC;IACtC,GAAG,EAAE,MAAM,MAAM,CAAC;IAClB,MAAM,CAAC,EAAE,YAAY,CAAC;CACvB,EACD,MAAM,EAAE;IACN,SAAS,EAAE,MAAM,CAAC;IAClB,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC;IACtB,KAAK,EAAE,aAAa,CAAC;QAAE,aAAa,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,wBAAwB,CAAA;KAAE,CAAC,CAAC;CACjF,GACA,OAAO,CAAC;IAAE,OAAO,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,qBAAqB,EAAE,CAAA;CAAE,CAAC,CA8EhF"}
+{"version":3,"file":"createDeclaredSources.d.ts","sourceRoot":"","sources":["../../../src/usecases/createDeclaredSources.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,gCAAgC,EAAE,uBAAuB,EAAE,wBAAwB,EAAE,MAAM,oCAAoC,CAAC;AAI9I,OAAO,EAAgB,KAAK,gBAAgB,EAAE,MAAM,gCAAgC,CAAC;AAErF,OAAO,KAAK,EAAE,gBAAgB,EAAE,iBAAiB,EAAE,MAAM,wBAAwB,CAAC;AAClF,OAAO,KAAK,EAA2B,YAAY,EAAE,MAAM,2BAA2B,CAAC;AAGvF,KAAK,YAAY,GAAG;IAAE,IAAI,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAAK,IAAI,CAAC;IAAC,IAAI,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAAK,IAAI,CAAA;CAAE,CAAC;AAEnJ;;;;;;;;;;;;;;;GAeG;AACH,MAAM,MAAM,qBAAqB,GAAG;IAClC,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,wBAAwB,GAAG,sBAAsB,GAAG,cAAc,GAAG,gBAAgB,CAAC;IAC9F,KAAK,EAAE,MAAM,CAAC;CACf,CAAC;AAEF;;;;;;;;;GASG;AACH,wBAAsB,yBAAyB,CAC7C,MAAM,EAAE,IAAI,CAAC,YAAY,EAAE,YAAY,CAAC,EACxC,YAAY,EAAE,gBAAgB,GAAG,IAAI,EACrC,SAAS,EAAE,MAAM,GAChB,OAAO,CAAC,OAAO,CAAC,CAelB;AAED,wBAAsB,4BAA4B,CAChD,IAAI,EAAE;IACJ,aAAa,EAAE,gBAAgB,CAAC;IAChC,UAAU,EAAE,CAAC,KAAK,EAAE,iBAAiB,EAAE,MAAM,EAAE,YAAY,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IAC9E,aAAa,EAAE,MAAM,CAAC;IACtB,gFAAgF;IAChF,kBAAkB,EAAE,SAAS,MAAM,EAAE,CAAC;IACtC,qBAAqB,EAAE,MAAM,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,gCAAgC,CAAC,CAAC,CAAC;IAC9F,kBAAkB,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,uBAAuB,EAAE,CAAC;IAChE,YAAY,EAAE,gBAAgB,GAAG,IAAI,CAAC;IACtC,GAAG,EAAE,MAAM,MAAM,CAAC;IAClB,MAAM,CAAC,EAAE,YAAY,CAAC;CACvB,EACD,MAAM,EAAE;IACN,SAAS,EAAE,MAAM,CAAC;IAClB,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC;IACtB,KAAK,EAAE,aAAa,CAAC;QAAE,aAAa,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,wBAAwB,CAAA;KAAE,CAAC,CAAC;CACjF,GACA,OAAO,CAAC;IAAE,OAAO,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,qBAAqB,EAAE,CAAA;CAAE,CAAC,CAoFhF"}

package/dist/src/usecases/createDeclaredSources.js

@@ -1,6 +1,39 @@
+import { realpath } from 'node:fs/promises';
+import path from 'node:path';
+import { HOST_SOURCE_KIND, sourcePlane } from '@neuralis/package-system/contracts';
+import { isPathInside } from '@neuralis/package-system/paths';
 import { applyTrustedSourceBaselines, manifestBaselineScheme } from '@neuralis/package-system/policies';
 import { buildDeclaredSourceConfig, isOwnDataZoneDeclaration } from '../services/declaredSources.js';
 import { SOURCE_BASELINE_REPAIR_VERSION } from '../services/baselineRepair.js';
+/**
+ * Does a declared in-process folder's root leave its project zone on disk? The
+ * kernel validator already keeps a declared root project-relative (no `..`, no
+ * absolute path), so the LEXICAL path stays inside; what it never sees is a
+ * symlink standing at that path. This is the route's realpath arm for the third
+ * producer: the folder's REAL path must stay inside the project zone's real
+ * path, on either plane (natively the fence's own rule; in a container the zone
+ * is still the only place a declaration may name). A root that does not exist
+ * yet cannot point anywhere and passes; no known projects root ⇒ no judgement.
+ */
+export async function declaredRootLeavesProject(config, runtimeStack, projectId) {
+    const { kind, config: connection } = config.connection;
+    if (kind !== HOST_SOURCE_KIND || sourcePlane(kind, connection) !== 'local')
+        return false;
+    const root = typeof connection.root === 'string' ? connection.root : '';
+    if (!root || !runtimeStack?.projectsRoot)
+        return false;
+    const projectRoot = path.join(runtimeStack.projectsRoot, projectId);
+    const lexical = path.resolve(projectRoot, root);
+    let real;
+    try {
+        real = await realpath(lexical);
+    }
+    catch {
+        return !isPathInside(projectRoot, lexical);
+    }
+    const realProject = await realpath(projectRoot).catch(() => projectRoot);
+    return !isPathInside(realProject, real);
+}
 export async function createMissingDeclaredSources(deps, target) {
     const { projectId, userId, existing } = target;
     let created = 0;
@@ -32,6 +65,12 @@ export async function createMissingDeclaredSources(deps, target) {
             skipped += 1;
             continue;
         }
+        if (await declaredRootLeavesProject(built, deps.runtimeStack, projectId)) {
+            const error = 'the declared folder resolves outside this project on disk';
+            failed.push({ source: decl.source, reason: 'root_outside_project', error });
+            deps.logger?.warn?.('declared-source create refused: root outside the project zone', { source: decl.source, projectId });
+            continue;
+        }
         let complete;
         try {
             const applied = applyTrustedSourceBaselines({