@neuralis/brain-core 0.3.2 → 0.4.1

package/dist/src/domain/access/callerPermissions.js

@@ -1,4 +1,4 @@
-import { resolveResourceOwner } from '@neuralis/package-system/policies';
+import { classifyUriSubtree, normalizePolicyUri, resolvePolicyPatternTokens, resolveResourceOwner, } from '@neuralis/package-system/policies';
 import { resolvePermissions } from '../permissionResolver.js';
 /**
  * The caller's EFFECTIVE per-path permission on `uri` — the ONE place a
@@ -20,14 +20,94 @@ import { resolvePermissions } from '../permissionResolver.js';
 export async function resolveCallerPermissions(config, uri, ctx, source) {
     const resourceOwnerUserId = await resolveResourceOwner({ projectId: ctx.projectId, uri });
     return resolvePermissions(config.permissions, uri, {
+        ...callerPolicyContext(config, ctx, ctx.role ?? 'member'),
+        source,
+        ...(resourceOwnerUserId ? { resourceOwnerUserId } : {}),
+    });
+}
+function callerPolicyContext(config, ctx, role) {
+    return {
         userId: ctx.userId,
-        role: ctx.role ?? 'member',
+        role,
         priority: ctx.priority,
         rolePriorities: ctx.rolePriorities,
         agentId: ctx.agentId,
         creatorUserId: config.createdBy,
-        source,
-        ...(resourceOwnerUserId ? { resourceOwnerUserId } : {}),
-    });
+        source: config.source,
+    };
+}
+const NO_BITS = { read: false, write: false, exec: false };
+/**
+ * The LITERAL heads of the path rules that certainly GRANT the caller `read` on
+ * `config` — each a normalized directory uri ending in `/` (`x://a/sec/` for
+ * `x://a/sec/**`; the bare `x://` for a pattern whose first segment is a glob).
+ * The head is the pattern's segments before the first one holding `*` or `?`,
+ * after token resolution; it is what the rule itself SPELLS, so naming it
+ * discloses nothing the grant does not already state.
+ *
+ * "Certainly" is the kernel's own subtree classifier over that one rule alone
+ * (every bit false, the rule re-pointed at `<head>**`): only a rule that turns
+ * `read` on for the WHOLE head, for THIS caller, counts — a role/user/priority
+ * miss, a non-override allow (it cannot lift a `false`) and an undecidable
+ * `$owner` row all read `false`. A floor row never grants. A head the full
+ * config denies uniformly (a floor over it) is dropped too.
+ *
+ * Consumers: source admission and the list-only ancestor reveal. Absent `role`
+ * ⇒ no heads (the weakest interpretation).
+ */
+export function callerReadGrantHeads(config, ctx) {
+    if (!ctx.role)
+        return [];
+    const policyCtx = callerPolicyContext(config, ctx, ctx.role);
+    const root = `${config.source}://`;
+    const heads = [];
+    for (const rule of config.permissions.paths ?? []) {
+        if (rule.floor === true || rule.permissions.read !== true)
+            continue;
+        const pattern = resolvePolicyPatternTokens(rule.pattern, policyCtx);
+        if (pattern === null)
+            continue;
+        const normalized = normalizePolicyUri(pattern);
+        if (!normalized.startsWith(root))
+            continue;
+        const literal = [];
+        for (const segment of normalized.slice(root.length).split('/')) {
+            if (segment === '' || /[*?]/.test(segment))
+                break;
+            literal.push(segment);
+        }
+        const head = `${root}${literal.map((s) => `${s}/`).join('')}`;
+        const alone = classifyUriSubtree({ default: { ...NO_BITS }, paths: [{ ...rule, pattern: `${head}**` }] }, head, policyCtx, { capabilities: ['read'] });
+        if (alone.kind !== 'uniform' || alone.permissions.read !== true)
+            continue;
+        const whole = classifyUriSubtree(config.permissions, head, policyCtx, { capabilities: ['read'] });
+        if (whole.kind === 'uniform' && whole.permissions.read === false)
+            continue;
+        if (!heads.includes(head))
+            heads.push(head);
+    }
+    return heads;
+}
+/**
+ * The folder uris a caller's grant heads put on its way: every head and every
+ * strict ancestor of it, as normalized directory uris (`x://a/`, `x://a/sec/`),
+ * never the source root. A LIST may name these folders (names only) and be
+ * scoped into them; nothing else — search, discovery and the git listings —
+ * reads this set.
+ */
+export function grantPathFolders(heads) {
+    const folders = new Set();
+    for (const head of heads) {
+        const sep = head.indexOf('://') + 3;
+        for (let at = head.indexOf('/', sep); at !== -1; at = head.indexOf('/', at + 1)) {
+            folders.add(head.slice(0, at + 1));
+        }
+    }
+    return folders;
+}
+/** A uri as the directory key {@link grantPathFolders} holds: normalized, ending in `/`. */
+export function folderKey(uri) {
+    const normalized = normalizePolicyUri(uri);
+    return normalized.endsWith('/') ? normalized : `${normalized}/`;
 }
 //# sourceMappingURL=callerPermissions.js.map

package/dist/src/domain/access/callerPermissions.js.map

@@ -1 +1 @@
-{"version":3,"file":"callerPermissions.js","sourceRoot":"","sources":["../../../../src/domain/access/callerPermissions.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,oBAAoB,EAAE,MAAM,mCAAmC,CAAC;AAEzE,OAAO,EAAE,kBAAkB,EAAE,MAAM,0BAA0B,CAAC;AAG9D;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,CAAC,KAAK,UAAU,wBAAwB,CAC5C,MAAoB,EACpB,GAAW,EACX,GAAqB,EACrB,MAAc;IAEd,MAAM,mBAAmB,GAAG,MAAM,oBAAoB,CAAC,EAAE,SAAS,EAAE,GAAG,CAAC,SAAS,EAAE,GAAG,EAAE,CAAC,CAAC;IAC1F,OAAO,kBAAkB,CAAC,MAAM,CAAC,WAAW,EAAE,GAAG,EAAE;QACjD,MAAM,EAAE,GAAG,CAAC,MAAM;QAClB,IAAI,EAAE,GAAG,CAAC,IAAI,IAAI,QAAQ;QAC1B,QAAQ,EAAE,GAAG,CAAC,QAAQ;QACtB,cAAc,EAAE,GAAG,CAAC,cAAc;QAClC,OAAO,EAAE,GAAG,CAAC,OAAO;QACpB,aAAa,EAAE,MAAM,CAAC,SAAS;QAC/B,MAAM;QACN,GAAG,CAAC,mBAAmB,CAAC,CAAC,CAAC,EAAE,mBAAmB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KACxD,CAAC,CAAC;AACL,CAAC"}
+{"version":3,"file":"callerPermissions.js","sourceRoot":"","sources":["../../../../src/domain/access/callerPermissions.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,kBAAkB,EAClB,kBAAkB,EAClB,0BAA0B,EAC1B,oBAAoB,GACrB,MAAM,mCAAmC,CAAC;AAG3C,OAAO,EAAE,kBAAkB,EAAE,MAAM,0BAA0B,CAAC;AAG9D;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,CAAC,KAAK,UAAU,wBAAwB,CAC5C,MAAoB,EACpB,GAAW,EACX,GAAqB,EACrB,MAAc;IAEd,MAAM,mBAAmB,GAAG,MAAM,oBAAoB,CAAC,EAAE,SAAS,EAAE,GAAG,CAAC,SAAS,EAAE,GAAG,EAAE,CAAC,CAAC;IAC1F,OAAO,kBAAkB,CAAC,MAAM,CAAC,WAAW,EAAE,GAAG,EAAE;QACjD,GAAG,mBAAmB,CAAC,MAAM,EAAE,GAAG,EAAE,GAAG,CAAC,IAAI,IAAI,QAAQ,CAAC;QACzD,MAAM;QACN,GAAG,CAAC,mBAAmB,CAAC,CAAC,CAAC,EAAE,mBAAmB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KACxD,CAAC,CAAC;AACL,CAAC;AAED,SAAS,mBAAmB,CAAC,MAAoB,EAAE,GAAqB,EAAE,IAAY;IACpF,OAAO;QACL,MAAM,EAAE,GAAG,CAAC,MAAM;QAClB,IAAI;QACJ,QAAQ,EAAE,GAAG,CAAC,QAAQ;QACtB,cAAc,EAAE,GAAG,CAAC,cAAc;QAClC,OAAO,EAAE,GAAG,CAAC,OAAO;QACpB,aAAa,EAAE,MAAM,CAAC,SAAS;QAC/B,MAAM,EAAE,MAAM,CAAC,MAAM;KACtB,CAAC;AACJ,CAAC;AAED,MAAM,OAAO,GAAG,EAAE,IAAI,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,IAAI,EAAE,KAAK,EAAW,CAAC;AAEpE;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,UAAU,oBAAoB,CAAC,MAAoB,EAAE,GAAqB;IAC9E,IAAI,CAAC,GAAG,CAAC,IAAI;QAAE,OAAO,EAAE,CAAC;IACzB,MAAM,SAAS,GAAG,mBAAmB,CAAC,MAAM,EAAE,GAAG,EAAE,GAAG,CAAC,IAAI,CAAC,CAAC;IAC7D,MAAM,IAAI,GAAG,GAAG,MAAM,CAAC,MAAM,KAAK,CAAC;IACnC,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,KAAK,MAAM,IAAI,IAAI,MAAM,CAAC,WAAW,CAAC,KAAK,IAAI,EAAE,EAAE,CAAC;QAClD,IAAI,IAAI,CAAC,KAAK,KAAK,IAAI,IAAI,IAAI,CAAC,WAAW,CAAC,IAAI,KAAK,IAAI;YAAE,SAAS;QACpE,MAAM,OAAO,GAAG,0BAA0B,CAAC,IAAI,CAAC,OAAO,EAAE,SAAS,CAAC,CAAC;QACpE,IAAI,OAAO,KAAK,IAAI;YAAE,SAAS;QAC/B,MAAM,UAAU,GAAG,kBAAkB,CAAC,OAAO,CAAC,CAAC;QAC/C,IAAI,CAAC,UAAU,CAAC,UAAU,CAAC,IAAI,CAAC;YAAE,SAAS;QAC3C,MAAM,OAAO,GAAa,EAAE,CAAC;QAC7B,KAAK,MAAM,OAAO,IAAI,UAAU,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC;YAC/D,IAAI,OAAO,KAAK,EAAE,IAAI,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC;gBAAE,MAAM;YAClD,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QACxB,CAAC;QACD,MAAM,IAAI,GAAG,GAAG,IAAI,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,CAAC;QAC9D,MAAM,KAAK,GAAG,kBAAkB,CAC9B,EAAE,OAAO,EAAE,EAAE,GAAG,OAAO,EAAE,EAAE,KAAK,EAAE,CAAC,EAAE,GAAG,IAAI,EAAE,OAAO,EAAE,GAAG,IAAI,IAAI,EAAE,CAAC,EAAE,EACvE,IAAI,EAAE,SAAS,EAAE,EAAE,YAAY,EAAE,CAAC,MAAM,CAAC,EAAE,CAC5C,CAAC;QACF,IAAI,KAAK,CAAC,IAAI,KAAK,SAAS,IAAI,KAAK,CAAC,WAAW,CAAC,IAAI,KAAK,IAAI;YAAE,SAAS;QAC1E,MAAM,KAAK,GAAG,kBAAkB,CAAC,MAAM,CAAC,WAAW,EAAE,IAAI,EAAE,SAAS,EAAE,EAAE,YAAY,EAAE,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;QAClG,IAAI,KAAK,CAAC,IAAI,KAAK,SAAS,IAAI,KAAK,CAAC,WAAW,CAAC,IAAI,KAAK,KAAK;YAAE,SAAS;QAC3E,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC;YAAE,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC9C,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,gBAAgB,CAAC,KAAwB;IACvD,MAAM,OAAO,GAAG,IAAI,GAAG,EAAU,CAAC;IAClC,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QACpC,KAAK,IAAI,EAAE,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,GAAG,CAAC,EAAE,EAAE,KAAK,CAAC,CAAC,EAAE,EAAE,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,GAAG,CAAC,CAAC,EAAE,CAAC;YAChF,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC;QACrC,CAAC;IACH,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,4FAA4F;AAC5F,MAAM,UAAU,SAAS,CAAC,GAAW;IACnC,MAAM,UAAU,GAAG,kBAAkB,CAAC,GAAG,CAAC,CAAC;IAC3C,OAAO,UAAU,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,GAAG,UAAU,GAAG,CAAC;AAClE,CAAC"}

package/dist/src/domain/access/nativeLocalFence.d.ts

@@ -0,0 +1,65 @@
+import { type RuntimeStackInfo } from '@neuralis/package-system/paths';
+import { type HierarchicalPermissions, type SourceConfig, type SourceEnabledState, type SyncConfig } from '../sourceConfig.js';
+/** Where a canonical path sits relative to what a native `local` source may root at. */
+export type NativeLocalPlacement = 
+/** IS or UNDER the caller's project zone — attachable with `sources.mount`. */
+'project'
+/** IS or UNDER a privileged row (a filesystem root exactly) — attachable with `sources.privileged`. */
+ | 'privileged'
+/** A strict ANCESTOR of the project zone — browsable on the way down, never attachable. */
+ | 'ancestor' | 'outside';
+/** The stable refusal every fenced consumer answers with. */
+export declare const NATIVE_LOCAL_REFUSAL: {
+    readonly code: 'native_local_root_outside_project';
+    readonly error: "On a native install a folder outside this project's own zone is reached through your own paired device: pair this computer (`neuralis device pair`), allow the folder, and add it as a folder on that device.";
+};
+/** An EDIT of an existing outside-rooted source: it may only narrow (`fencedEditWidens`). */
+export declare const NATIVE_LOCAL_EDIT_REFUSAL: {
+    readonly code: "native_local_root_outside_project";
+    readonly error: "This source is rooted outside this project's own zone, which a native install reaches only through your own paired device: it can still be disabled, narrowed, described or deleted, never widened.";
+};
+/** The fence applies unless the stack says, explicitly, that this is Docker. */
+export declare function nativeLocalFenceApplies(stack: Pick<RuntimeStackInfo, 'isDocker'> | null | undefined): boolean;
+/**
+ * Classify a canonical absolute path. `projectRoot` empty ⇒ no project zone
+ * (nothing is `project` or `ancestor`); `privilegedRoots` are the privileged
+ * table's zone paths.
+ */
+export declare function nativeLocalPlacement(path: string, projectRoot: string, privilegedRoots: readonly string[]): NativeLocalPlacement;
+/** Attachable as a native `local` root (the privileged rows still need their feature). */
+export declare function attachableNatively(placement: NativeLocalPlacement): boolean;
+/**
+ * Does the fence refuse an in-process folder rooted at `resolvedRoot` (already
+ * resolved the way the connector resolves it)? Judged on the lexical path and
+ * again on the REAL path when it exists — a symlink inside the project zone that
+ * points elsewhere is refused like its target. Any other plane (a device folder,
+ * a connector kind), or a Docker stack, is not the fence's to judge (`false`).
+ */
+export declare function nativeLocalRootRefused(input: {
+    stack: Pick<RuntimeStackInfo, 'isDocker'> | null | undefined;
+    connection: {
+        kind: string;
+        config?: unknown;
+    };
+    resolvedRoot: string;
+    projectRoot: string;
+    privilegedRoots: readonly string[];
+}): Promise<boolean>;
+/**
+ * Would this edit of a fenced in-process folder keep or create reach WIDER than
+ * it has? Reach = who may read/write/exec under the root (`permissions`), whether
+ * the source is live (`enabled`), whether it loads code (a `packageFolders`
+ * entry it did not carry)
+ * and which of its files the indexer reads (sync created, an exclude dropped, a
+ * wider include). Cadence, scan cap, media lanes and the description are not
+ * reach. `byRole` resolves by role PRIORITY, so its key set is reach too: a key
+ * may only be added denying all three bits, never removed.
+ */
+export declare function fencedEditWidens(existing: Pick<SourceConfig, 'permissions' | 'enabled' | 'sync' | 'packageFolders'>, patch: {
+    permissions?: HierarchicalPermissions;
+    enabled?: SourceEnabledState;
+    sync?: Pick<SyncConfig, 'exclude' | 'include'>;
+    clearSync?: boolean;
+    packageFolders?: readonly string[];
+}): boolean;
+//# sourceMappingURL=nativeLocalFence.d.ts.map

package/dist/src/domain/access/nativeLocalFence.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"nativeLocalFence.d.ts","sourceRoot":"","sources":["../../../../src/domain/access/nativeLocalFence.ts"],"names":[],"mappings":"AAsBA,OAAO,EAAmD,KAAK,gBAAgB,EAAE,MAAM,gCAAgC,CAAC;AAExH,OAAO,EAAuB,KAAK,uBAAuB,EAAuB,KAAK,YAAY,EAAE,KAAK,kBAAkB,EAAE,KAAK,UAAU,EAAE,MAAM,oBAAoB,CAAC;AAEzK,wFAAwF;AACxF,MAAM,MAAM,oBAAoB;AAC9B,+EAA+E;AAC7E,SAAS;AACX,uGAAuG;GACrG,YAAY;AACd,2FAA2F;GACzF,UAAU,GACV,SAAS,CAAC;AAEd,6DAA6D;AAC7D,eAAO,MAAM,oBAAoB;aAC/B,IAAI,EAAE,mCAAmC;aACzC,KAAK,EAAE,+MAA+M;CAC9M,CAAC;AAEX,6FAA6F;AAC7F,eAAO,MAAM,yBAAyB;aACpC,IAAI;aACJ,KAAK,EAAE,qMAAqM;CACpM,CAAC;AAEX,gFAAgF;AAChF,wBAAgB,uBAAuB,CAAC,KAAK,EAAE,IAAI,CAAC,gBAAgB,EAAE,UAAU,CAAC,GAAG,IAAI,GAAG,SAAS,GAAG,OAAO,CAE7G;AAED;;;;GAIG;AACH,wBAAgB,oBAAoB,CAClC,IAAI,EAAE,MAAM,EACZ,WAAW,EAAE,MAAM,EACnB,eAAe,EAAE,SAAS,MAAM,EAAE,GACjC,oBAAoB,CAQtB;AAED,0FAA0F;AAC1F,wBAAgB,kBAAkB,CAAC,SAAS,EAAE,oBAAoB,GAAG,OAAO,CAE3E;AAUD;;;;;;GAMG;AACH,wBAAsB,sBAAsB,CAAC,KAAK,EAAE;IAClD,KAAK,EAAE,IAAI,CAAC,gBAAgB,EAAE,UAAU,CAAC,GAAG,IAAI,GAAG,SAAS,CAAC;IAC7D,UAAU,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,MAAM,CAAC,EAAE,OAAO,CAAA;KAAE,CAAC;IAC/C,YAAY,EAAE,MAAM,CAAC;IACrB,WAAW,EAAE,MAAM,CAAC;IACpB,eAAe,EAAE,SAAS,MAAM,EAAE,CAAC;CACpC,GAAG,OAAO,CAAC,OAAO,CAAC,CAWnB;AA8CD;;;;;;;;;GASG;AACH,wBAAgB,gBAAgB,CAC9B,QAAQ,EAAE,IAAI,CAAC,YAAY,EAAE,aAAa,GAAG,SAAS,GAAG,MAAM,GAAG,gBAAgB,CAAC,EACnF,KAAK,EAAE;IACL,WAAW,CAAC,EAAE,uBAAuB,CAAC;IACtC,OAAO,CAAC,EAAE,kBAAkB,CAAC;IAC7B,IAAI,CAAC,EAAE,IAAI,CAAC,UAAU,EAAE,SAAS,GAAG,SAAS,CAAC,CAAC;IAC/C,SAAS,CAAC,EAAE,OAAO,CAAC;IACpB,cAAc,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;CACpC,GACA,OAAO,CAoBT"}

package/dist/src/domain/access/nativeLocalFence.js

@@ -0,0 +1,171 @@
+/**
+ * The native folder fence — where an IN-PROCESS folder (the `host` kind with
+ * no `device`, the kernel's `sourcePlane` = `local`) may be rooted when the
+ * platform runs WITHOUT a container (`stack.isDocker === false`).
+ *
+ * In Docker the container is the boundary: an in-process root names only what
+ * the operator mounted. On a native host there is none, so an in-process root is
+ * the host OS user's whole reach — a manager (`sources.mount` is a manager
+ * default) could otherwise attach `~/.ssh`. On a native host such a root is
+ * accepted only inside the caller's own project zone (`<home>/projects/<projectId>`),
+ * or IS / is UNDER one of the privileged rows (the App Zone, the Neuralis tree,
+ * the whole host — `/` or a drive root — exactly) — which still cost
+ * `sources.privileged` through the privileged-root table. Every other folder is
+ * a folder on the user's own paired device (the same kind, `device` set).
+ *
+ * The signal is the kernel's ONE `stack.isDocker`, and it fails CLOSED: only an
+ * explicit `true` opens the Docker arm. Scope: the folder kind's in-process
+ * transport only — the privileged-root gate's other root-bearing kinds are not
+ * covered here, and a device folder is the device owner's ceiling's to bound.
+ */
+import { realpath } from 'node:fs/promises';
+import { resolve } from 'node:path';
+import { hostPathFlavour, isFilesystemRoot, isPathInside } from '@neuralis/package-system/paths';
+import { sourcePlane } from '@neuralis/package-system/contracts';
+import { resolveEnabledState } from '../sourceConfig.js';
+/** The stable refusal every fenced consumer answers with. */
+export const NATIVE_LOCAL_REFUSAL = {
+    code: 'native_local_root_outside_project',
+    error: "On a native install a folder outside this project's own zone is reached through your own paired device: pair this computer (`neuralis device pair`), allow the folder, and add it as a folder on that device.",
+};
+/** An EDIT of an existing outside-rooted source: it may only narrow (`fencedEditWidens`). */
+export const NATIVE_LOCAL_EDIT_REFUSAL = {
+    code: NATIVE_LOCAL_REFUSAL.code,
+    error: "This source is rooted outside this project's own zone, which a native install reaches only through your own paired device: it can still be disabled, narrowed, described or deleted, never widened.",
+};
+/** The fence applies unless the stack says, explicitly, that this is Docker. */
+export function nativeLocalFenceApplies(stack) {
+    return stack?.isDocker !== true;
+}
+/**
+ * Classify a canonical absolute path. `projectRoot` empty ⇒ no project zone
+ * (nothing is `project` or `ancestor`); `privilegedRoots` are the privileged
+ * table's zone paths.
+ */
+export function nativeLocalPlacement(path, projectRoot, privilegedRoots) {
+    if (projectRoot && isPathInside(projectRoot, path))
+        return 'project';
+    for (const root of privilegedRoots) {
+        // A filesystem root covers only itself — under it is everything, which is no zone.
+        if ((!isFilesystemRoot(root) || isFilesystemRoot(path)) && isPathInside(root, path, hostPathFlavour(root)))
+            return 'privileged';
+    }
+    if (projectRoot && isPathInside(path, projectRoot))
+        return 'ancestor';
+    return 'outside';
+}
+/** Attachable as a native `local` root (the privileged rows still need their feature). */
+export function attachableNatively(placement) {
+    return placement === 'project' || placement === 'privileged';
+}
+async function realOrSelf(path) {
+    try {
+        return await realpath(path);
+    }
+    catch {
+        return path;
+    }
+}
+/**
+ * Does the fence refuse an in-process folder rooted at `resolvedRoot` (already
+ * resolved the way the connector resolves it)? Judged on the lexical path and
+ * again on the REAL path when it exists — a symlink inside the project zone that
+ * points elsewhere is refused like its target. Any other plane (a device folder,
+ * a connector kind), or a Docker stack, is not the fence's to judge (`false`).
+ */
+export async function nativeLocalRootRefused(input) {
+    const config = (input.connection.config ?? {});
+    if (sourcePlane(input.connection.kind, config) !== 'local' || !nativeLocalFenceApplies(input.stack))
+        return false;
+    const projectRoot = input.projectRoot ? resolve(input.projectRoot) : '';
+    const lexical = resolve(input.resolvedRoot);
+    if (!attachableNatively(nativeLocalPlacement(lexical, projectRoot, input.privilegedRoots)))
+        return true;
+    const real = await realOrSelf(lexical);
+    if (real === lexical)
+        return false;
+    const realProject = projectRoot ? await realOrSelf(projectRoot) : '';
+    const realPrivileged = await Promise.all(input.privilegedRoots.map((root) => (isFilesystemRoot(root) ? root : realOrSelf(root))));
+    return !attachableNatively(nativeLocalPlacement(real, realProject, realPrivileged));
+}
+const CAPS = ['read', 'write', 'exec'];
+/** A bit narrows when it never gains reach: unchanged, true→false, true→unset, unset→false. */
+const bitsNarrow = (old, next) => CAPS.every((c) => old[c] === next[c] || old[c] === true || next[c] === false);
+const grantsNothing = (b) => CAPS.every((c) => b[c] !== true);
+const deniesNothing = (b) => CAPS.every((c) => b[c] !== false);
+const deniesAll = (b) => CAPS.every((c) => b[c] === false);
+function entriesNarrow(old = {}, next = {}, added, removed) {
+    const has = Object.hasOwn;
+    return [...new Set([...Object.keys(old), ...Object.keys(next)])].every((k) => (has(old, k) && has(next, k) ? bitsNarrow(old[k], next[k])
+        : has(next, k) ? added(next[k]) : removed(old[k])));
+}
+const sameList = (a, b) => (a ?? []).join('\0') === (b ?? []).join('\0');
+const sameRule = (a, b) => a.pattern === b.pattern && a.override === b.override
+    && a.floor === b.floor && a.priority === b.priority && sameList(a.roles, b.roles) && sameList(a.agents, b.agents) && sameList(a.users, b.users);
+/**
+ * Path rows apply IN ORDER (an `override` row overwrites what came before), so
+ * the new list must derive from the old one through steps that each narrow: a
+ * row kept with the same pattern and conditions and narrowed bits, a removed row
+ * that denied nothing, an inserted row that grants nothing. Conservative — an
+ * alignment the walk misses is refused, never admitted.
+ */
+function pathsNarrow(old = [], next = []) {
+    let i = 0;
+    let j = 0;
+    while (i < old.length || j < next.length) {
+        if (i < old.length && j < next.length && sameRule(old[i], next[j]) && bitsNarrow(old[i].permissions, next[j].permissions)) {
+            i++;
+            j++;
+            continue;
+        }
+        if (j < next.length && !next[j].floor && grantsNothing(next[j].permissions)) {
+            j++;
+            continue;
+        }
+        if (i < old.length && !old[i].floor && deniesNothing(old[i].permissions)) {
+            i++;
+            continue;
+        }
+        return false;
+    }
+    return true;
+}
+const ENABLED_RANK = { false: 0, auto: 1, true: 2 };
+/**
+ * Would this edit of a fenced in-process folder keep or create reach WIDER than
+ * it has? Reach = who may read/write/exec under the root (`permissions`), whether
+ * the source is live (`enabled`), whether it loads code (a `packageFolders`
+ * entry it did not carry)
+ * and which of its files the indexer reads (sync created, an exclude dropped, a
+ * wider include). Cadence, scan cap, media lanes and the description are not
+ * reach. `byRole` resolves by role PRIORITY, so its key set is reach too: a key
+ * may only be added denying all three bits, never removed.
+ */
+export function fencedEditWidens(existing, patch) {
+    if (patch.enabled !== undefined && ENABLED_RANK[`${patch.enabled}`] > ENABLED_RANK[`${resolveEnabledState(existing)}`])
+        return true;
+    if (patch.packageFolders && !patch.packageFolders.every((folder) => (existing.packageFolders ?? []).includes(folder)))
+        return true;
+    const sync = patch.clearSync ? undefined : patch.sync;
+    if (sync) {
+        const old = existing.sync;
+        if (!old)
+            return true;
+        if (!old.exclude.every((p) => sync.exclude.includes(p)))
+            return true;
+        const oldIn = old.include ?? [];
+        const nextIn = sync.include ?? [];
+        if (oldIn.length > 0 && (nextIn.length === 0 || !nextIn.every((p) => oldIn.includes(p))))
+            return true;
+    }
+    const o = existing.permissions;
+    const n = patch.permissions;
+    if (!n)
+        return false;
+    return !(bitsNarrow(o.default, n.default)
+        && entriesNarrow(o.byRole, n.byRole, deniesAll, () => false)
+        && entriesNarrow(o.byUser, n.byUser, grantsNothing, deniesNothing)
+        && entriesNarrow(o.byAgent, n.byAgent, grantsNothing, deniesNothing)
+        && pathsNarrow(o.paths, n.paths));
+}
+//# sourceMappingURL=nativeLocalFence.js.map

package/dist/src/domain/access/nativeLocalFence.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"nativeLocalFence.js","sourceRoot":"","sources":["../../../../src/domain/access/nativeLocalFence.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AACH,OAAO,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AAC5C,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACpC,OAAO,EAAE,eAAe,EAAE,gBAAgB,EAAE,YAAY,EAAyB,MAAM,gCAAgC,CAAC;AACxH,OAAO,EAAE,WAAW,EAAE,MAAM,oCAAoC,CAAC;AACjE,OAAO,EAAE,mBAAmB,EAAkH,MAAM,oBAAoB,CAAC;AAYzK,6DAA6D;AAC7D,MAAM,CAAC,MAAM,oBAAoB,GAAG;IAClC,IAAI,EAAE,mCAAmC;IACzC,KAAK,EAAE,+MAA+M;CAC9M,CAAC;AAEX,6FAA6F;AAC7F,MAAM,CAAC,MAAM,yBAAyB,GAAG;IACvC,IAAI,EAAE,oBAAoB,CAAC,IAAI;IAC/B,KAAK,EAAE,qMAAqM;CACpM,CAAC;AAEX,gFAAgF;AAChF,MAAM,UAAU,uBAAuB,CAAC,KAA4D;IAClG,OAAO,KAAK,EAAE,QAAQ,KAAK,IAAI,CAAC;AAClC,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,oBAAoB,CAClC,IAAY,EACZ,WAAmB,EACnB,eAAkC;IAElC,IAAI,WAAW,IAAI,YAAY,CAAC,WAAW,EAAE,IAAI,CAAC;QAAE,OAAO,SAAS,CAAC;IACrE,KAAK,MAAM,IAAI,IAAI,eAAe,EAAE,CAAC;QACnC,mFAAmF;QACnF,IAAI,CAAC,CAAC,gBAAgB,CAAC,IAAI,CAAC,IAAI,gBAAgB,CAAC,IAAI,CAAC,CAAC,IAAI,YAAY,CAAC,IAAI,EAAE,IAAI,EAAE,eAAe,CAAC,IAAI,CAAC,CAAC;YAAE,OAAO,YAAY,CAAC;IAClI,CAAC;IACD,IAAI,WAAW,IAAI,YAAY,CAAC,IAAI,EAAE,WAAW,CAAC;QAAE,OAAO,UAAU,CAAC;IACtE,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,0FAA0F;AAC1F,MAAM,UAAU,kBAAkB,CAAC,SAA+B;IAChE,OAAO,SAAS,KAAK,SAAS,IAAI,SAAS,KAAK,YAAY,CAAC;AAC/D,CAAC;AAED,KAAK,UAAU,UAAU,CAAC,IAAY;IACpC,IAAI,CAAC;QACH,OAAO,MAAM,QAAQ,CAAC,IAAI,CAAC,CAAC;IAC9B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAAC,KAM5C;IACC,MAAM,MAAM,GAAG,CAAC,KAAK,CAAC,UAAU,CAAC,MAAM,IAAI,EAAE,CAA4B,CAAC;IAC1E,IAAI,WAAW,CAAC,KAAK,CAAC,UAAU,CAAC,IAAI,EAAE,MAAM,CAAC,KAAK,OAAO,IAAI,CAAC,uBAAuB,CAAC,KAAK,CAAC,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IAClH,MAAM,WAAW,GAAG,KAAK,CAAC,WAAW,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IACxE,MAAM,OAAO,GAAG,OAAO,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC;IAC5C,IAAI,CAAC,kBAAkB,CAAC,oBAAoB,CAAC,OAAO,EAAE,WAAW,EAAE,KAAK,CAAC,eAAe,CAAC,CAAC;QAAE,OAAO,IAAI,CAAC;IACxG,MAAM,IAAI,GAAG,MAAM,UAAU,CAAC,OAAO,CAAC,CAAC;IACvC,IAAI,IAAI,KAAK,OAAO;QAAE,OAAO,KAAK,CAAC;IACnC,MAAM,WAAW,GAAG,WAAW,CAAC,CAAC,CAAC,MAAM,UAAU,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IACrE,MAAM,cAAc,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,eAAe,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,gBAAgB,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;IAClI,OAAO,CAAC,kBAAkB,CAAC,oBAAoB,CAAC,IAAI,EAAE,WAAW,EAAE,cAAc,CAAC,CAAC,CAAC;AACtF,CAAC;AAGD,MAAM,IAAI,GAAG,CAAC,MAAM,EAAE,OAAO,EAAE,MAAM,CAAU,CAAC;AAChD,+FAA+F;AAC/F,MAAM,UAAU,GAAG,CAAC,GAAS,EAAE,IAAU,EAAW,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,KAAK,IAAI,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC,CAAC,CAAC,KAAK,IAAI,IAAI,IAAI,CAAC,CAAC,CAAC,KAAK,KAAK,CAAC,CAAC;AACrI,MAAM,aAAa,GAAG,CAAC,CAAO,EAAW,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,IAAI,CAAC,CAAC;AAC7E,MAAM,aAAa,GAAG,CAAC,CAAO,EAAW,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,KAAK,CAAC,CAAC;AAC9E,MAAM,SAAS,GAAG,CAAC,CAAO,EAAW,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,KAAK,CAAC,CAAC;AAE1E,SAAS,aAAa,CACpB,GAAG,GAAyB,EAAE,EAC9B,IAAI,GAAyB,EAAE,EAC/B,KAA2B,EAC3B,OAA6B;IAE7B,MAAM,GAAG,GAAG,MAAM,CAAC,MAAM,CAAC;IAC1B,OAAO,CAAC,GAAG,IAAI,GAAG,CAAC,CAAC,GAAG,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,GAAG,EAAE,CAAC,CAAC,IAAI,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC;QACtI,CAAC,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AACxD,CAAC;AAED,MAAM,QAAQ,GAAG,CAAC,CAAqB,EAAE,CAAqB,EAAW,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAC1H,MAAM,QAAQ,GAAG,CAAC,CAAiB,EAAE,CAAiB,EAAW,EAAE,CAAC,CAAC,CAAC,OAAO,KAAK,CAAC,CAAC,OAAO,IAAI,CAAC,CAAC,QAAQ,KAAK,CAAC,CAAC,QAAQ;OACnH,CAAC,CAAC,KAAK,KAAK,CAAC,CAAC,KAAK,IAAI,CAAC,CAAC,QAAQ,KAAK,CAAC,CAAC,QAAQ,IAAI,QAAQ,CAAC,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC,KAAK,CAAC,IAAI,QAAQ,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,MAAM,CAAC,IAAI,QAAQ,CAAC,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC;AAElJ;;;;;;GAMG;AACH,SAAS,WAAW,CAAC,GAAG,GAA8B,EAAE,EAAE,IAAI,GAA8B,EAAE;IAC5F,IAAI,CAAC,GAAG,CAAC,CAAC;IACV,IAAI,CAAC,GAAG,CAAC,CAAC;IACV,OAAO,CAAC,GAAG,GAAG,CAAC,MAAM,IAAI,CAAC,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC;QACzC,IAAI,CAAC,GAAG,GAAG,CAAC,MAAM,IAAI,CAAC,GAAG,IAAI,CAAC,MAAM,IAAI,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC,EAAE,CAAC;YAAC,CAAC,EAAE,CAAC;YAAC,CAAC,EAAE,CAAC;YAAC,SAAS;QAAC,CAAC;QAClJ,IAAI,CAAC,GAAG,IAAI,CAAC,MAAM,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,IAAI,aAAa,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC,EAAE,CAAC;YAAC,CAAC,EAAE,CAAC;YAAC,SAAS;QAAC,CAAC;QAC/F,IAAI,CAAC,GAAG,GAAG,CAAC,MAAM,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,IAAI,aAAa,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC,EAAE,CAAC;YAAC,CAAC,EAAE,CAAC;YAAC,SAAS;QAAC,CAAC;QAC5F,OAAO,KAAK,CAAC;IACf,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,MAAM,YAAY,GAAG,EAAE,KAAK,EAAE,CAAC,EAAE,IAAI,EAAE,CAAC,EAAE,IAAI,EAAE,CAAC,EAAW,CAAC;AAE7D;;;;;;;;;GASG;AACH,MAAM,UAAU,gBAAgB,CAC9B,QAAmF,EACnF,KAMC;IAED,IAAI,KAAK,CAAC,OAAO,KAAK,SAAS,IAAI,YAAY,CAAC,GAAG,KAAK,CAAC,OAAO,EAAE,CAAC,GAAG,YAAY,CAAC,GAAG,mBAAmB,CAAC,QAAQ,CAAC,EAAE,CAAC;QAAE,OAAO,IAAI,CAAC;IACpI,IAAI,KAAK,CAAC,cAAc,IAAI,CAAC,KAAK,CAAC,cAAc,CAAC,KAAK,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,QAAQ,CAAC,cAAc,IAAI,EAAE,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;QAAE,OAAO,IAAI,CAAC;IACnI,MAAM,IAAI,GAAG,KAAK,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC;IACtD,IAAI,IAAI,EAAE,CAAC;QACT,MAAM,GAAG,GAAG,QAAQ,CAAC,IAAI,CAAC;QAC1B,IAAI,CAAC,GAAG;YAAE,OAAO,IAAI,CAAC;QACtB,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC;YAAE,OAAO,IAAI,CAAC;QACrE,MAAM,KAAK,GAAG,GAAG,CAAC,OAAO,IAAI,EAAE,CAAC;QAChC,MAAM,MAAM,GAAG,IAAI,CAAC,OAAO,IAAI,EAAE,CAAC;QAClC,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC;YAAE,OAAO,IAAI,CAAC;IACxG,CAAC;IACD,MAAM,CAAC,GAAG,QAAQ,CAAC,WAAW,CAAC;IAC/B,MAAM,CAAC,GAAG,KAAK,CAAC,WAAW,CAAC;IAC5B,IAAI,CAAC,CAAC;QAAE,OAAO,KAAK,CAAC;IACrB,OAAO,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,OAAO,CAAC;WACpC,aAAa,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,SAAS,EAAE,GAAG,EAAE,CAAC,KAAK,CAAC;WACzD,aAAa,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,aAAa,EAAE,aAAa,CAAC;WAC/D,aAAa,CAAC,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,aAAa,EAAE,aAAa,CAAC;WACjE,WAAW,CAAC,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC;AACtC,CAAC"}

package/dist/src/domain/access/uriPermission.js

@@ -3,7 +3,7 @@ import { scopeAccessCtxFromExecution } from '../scopeAccessCtx.js';
 import { deriveSourceKind } from '../source.js';
 import { sourceFromUri } from '../uri.js';
 import { resolveCallerPermissions } from './callerPermissions.js';
-import { SourceNotConfiguredError, SourcePermissionDeniedError } from '../sourceConfig.js';
+import { SourceNotConfiguredError, SourcePermissionDeniedError, sourceScopeOrigin } from '../sourceConfig.js';
 import { assertSourceEnabled } from './sourceEnabled.js';
 /**
  * The THROWING per-uri gate every write (and every single-result read) passes.
@@ -65,11 +65,11 @@ export async function checkUriPermission(deps, ctx, uri, operation, configCache)
         throw new SourceNotConfiguredError(source);
     }
     const scopeCtx = scopeAccessCtxFromExecution(ctx);
-    if (!canAccessScope(config.scope, scopeCtx, 'read')) {
+    if (!canAccessScope(config.scope, scopeCtx, 'read', sourceScopeOrigin(config.connection))) {
         throw new SourceNotConfiguredError(source);
     }
     await assertSourceEnabled(deps, ctx.projectId, source, config);
-    if (operation !== 'read' && !canAccessScope(config.scope, scopeCtx, 'write')) {
+    if (operation !== 'read' && !canAccessScope(config.scope, scopeCtx, 'write', sourceScopeOrigin(config.connection))) {
         throw new SourcePermissionDeniedError(source, operation);
     }
     const resolved = await resolveCallerPermissions(config, uri, ctx, source);

package/dist/src/domain/access/uriPermission.js.map

@@ -1 +1 @@
-{"version":3,"file":"uriPermission.js","sourceRoot":"","sources":["../../../../src/domain/access/uriPermission.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,cAAc,EAAE,MAAM,oCAAoC,CAAC;AAEpE,OAAO,EAAE,2BAA2B,EAAE,MAAM,sBAAsB,CAAC;AACnE,OAAO,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AAChD,OAAO,EAAE,aAAa,EAAE,MAAM,WAAW,CAAC;AAC1C,OAAO,EAAE,wBAAwB,EAAE,MAAM,wBAAwB,CAAC;AAElE,OAAO,EAAE,wBAAwB,EAAE,2BAA2B,EAAE,MAAM,oBAAoB,CAAC;AAE3F,OAAO,EAAE,mBAAmB,EAA0B,MAAM,oBAAoB,CAAC;AAOjF;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAyCG;AACH,MAAM,CAAC,KAAK,UAAU,kBAAkB,CACtC,IAAuB,EACvB,GAAqB,EACrB,GAAW,EACX,SAAoC,EACpC,WAA8C;IAE9C,IAAI,CAAC,IAAI,CAAC,aAAa;QAAE,OAAO;IAChC,MAAM,MAAM,GAAG,aAAa,CAAC,GAAG,CAAC,CAAC;IAClC,IAAI,MAA2B,CAAC;IAChC,IAAI,WAAW,EAAE,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC;QAC7B,MAAM,GAAG,WAAW,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,IAAI,CAAC;IAC3C,CAAC;SAAM,CAAC;QACN,MAAM,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC,GAAG,CACnC,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,SAAS,EAAE,GAAG,CAAC,SAAS,EAAE,EAChD,MAAM,CACP,CAAC;QACF,WAAW,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACnC,CAAC;IACD,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,IAAI,gBAAgB,CAAC,MAAM,CAAC,KAAK,OAAO;YAAE,OAAO;QACjD,MAAM,IAAI,wBAAwB,CAAC,MAAM,CAAC,CAAC;IAC7C,CAAC;IACD,MAAM,QAAQ,GAAG,2BAA2B,CAAC,GAAG,CAAC,CAAC;IAClD,IAAI,CAAC,cAAc,CAAC,MAAM,CAAC,KAAK,EAAE,QAAQ,EAAE,MAAM,CAAC,EAAE,CAAC;QACpD,MAAM,IAAI,wBAAwB,CAAC,MAAM,CAAC,CAAC;IAC7C,CAAC;IACD,MAAM,mBAAmB,CAAC,IAAI,EAAE,GAAG,CAAC,SAAS,EAAE,MAAM,EAAE,MAAM,CAAC,CAAC;IAC/D,IAAI,SAAS,KAAK,MAAM,IAAI,CAAC,cAAc,CAAC,MAAM,CAAC,KAAK,EAAE,QAAQ,EAAE,OAAO,CAAC,EAAE,CAAC;QAC7E,MAAM,IAAI,2BAA2B,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC;IAC3D,CAAC;IACD,MAAM,QAAQ,GAAG,MAAM,wBAAwB,CAAC,MAAM,EAAE,GAAG,EAAE,GAAG,EAAE,MAAM,CAAC,CAAC;IAC1E,IAAI,CAAC,QAAQ,CAAC,SAAS,CAAC,EAAE,CAAC;QACzB,MAAM,IAAI,2BAA2B,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC;IAC3D,CAAC;AACH,CAAC"}
+{"version":3,"file":"uriPermission.js","sourceRoot":"","sources":["../../../../src/domain/access/uriPermission.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,cAAc,EAAE,MAAM,oCAAoC,CAAC;AAEpE,OAAO,EAAE,2BAA2B,EAAE,MAAM,sBAAsB,CAAC;AACnE,OAAO,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AAChD,OAAO,EAAE,aAAa,EAAE,MAAM,WAAW,CAAC;AAC1C,OAAO,EAAE,wBAAwB,EAAE,MAAM,wBAAwB,CAAC;AAElE,OAAO,EAAE,wBAAwB,EAAE,2BAA2B,EAAE,iBAAiB,EAAE,MAAM,oBAAoB,CAAC;AAE9G,OAAO,EAAE,mBAAmB,EAA0B,MAAM,oBAAoB,CAAC;AAOjF;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAyCG;AACH,MAAM,CAAC,KAAK,UAAU,kBAAkB,CACtC,IAAuB,EACvB,GAAqB,EACrB,GAAW,EACX,SAAoC,EACpC,WAA8C;IAE9C,IAAI,CAAC,IAAI,CAAC,aAAa;QAAE,OAAO;IAChC,MAAM,MAAM,GAAG,aAAa,CAAC,GAAG,CAAC,CAAC;IAClC,IAAI,MAA2B,CAAC;IAChC,IAAI,WAAW,EAAE,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC;QAC7B,MAAM,GAAG,WAAW,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,IAAI,CAAC;IAC3C,CAAC;SAAM,CAAC;QACN,MAAM,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC,GAAG,CACnC,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,SAAS,EAAE,GAAG,CAAC,SAAS,EAAE,EAChD,MAAM,CACP,CAAC;QACF,WAAW,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACnC,CAAC;IACD,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,IAAI,gBAAgB,CAAC,MAAM,CAAC,KAAK,OAAO;YAAE,OAAO;QACjD,MAAM,IAAI,wBAAwB,CAAC,MAAM,CAAC,CAAC;IAC7C,CAAC;IACD,MAAM,QAAQ,GAAG,2BAA2B,CAAC,GAAG,CAAC,CAAC;IAClD,IAAI,CAAC,cAAc,CAAC,MAAM,CAAC,KAAK,EAAE,QAAQ,EAAE,MAAM,EAAE,iBAAiB,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,EAAE,CAAC;QAC1F,MAAM,IAAI,wBAAwB,CAAC,MAAM,CAAC,CAAC;IAC7C,CAAC;IACD,MAAM,mBAAmB,CAAC,IAAI,EAAE,GAAG,CAAC,SAAS,EAAE,MAAM,EAAE,MAAM,CAAC,CAAC;IAC/D,IAAI,SAAS,KAAK,MAAM,IAAI,CAAC,cAAc,CAAC,MAAM,CAAC,KAAK,EAAE,QAAQ,EAAE,OAAO,EAAE,iBAAiB,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,EAAE,CAAC;QACnH,MAAM,IAAI,2BAA2B,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC;IAC3D,CAAC;IACD,MAAM,QAAQ,GAAG,MAAM,wBAAwB,CAAC,MAAM,EAAE,GAAG,EAAE,GAAG,EAAE,MAAM,CAAC,CAAC;IAC1E,IAAI,CAAC,QAAQ,CAAC,SAAS,CAAC,EAAE,CAAC;QACzB,MAAM,IAAI,2BAA2B,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC;IAC3D,CAAC;AACH,CAAC"}

package/dist/src/domain/byteRange.d.ts

@@ -0,0 +1,15 @@
+/**
+ * One `bytes=` range against a body of `size` bytes: `[start, end]` inclusive,
+ * `'unsatisfiable'` (416), or `null` when the header is absent, malformed or
+ * names several ranges — those get the whole body (RFC 9110 §14.2 lets a
+ * server ignore a Range it does not support).
+ */
+export declare function parseByteRange(header: string | null | undefined, size: number): [number, number] | 'unsatisfiable' | null;
+/**
+ * The most bytes ONE ranged answer carries (8 MiB). A range wider than this —
+ * a player's open-ended `bytes=0-` — is answered with its first 8 MiB and a
+ * `Content-Range` saying so; the client asks for the rest. This is what keeps a
+ * 206 memory-bounded however large the file is.
+ */
+export declare const RAW_RANGE_MAX_BYTES: number;
+//# sourceMappingURL=byteRange.d.ts.map

package/dist/src/domain/byteRange.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"byteRange.d.ts","sourceRoot":"","sources":["../../../src/domain/byteRange.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AACH,wBAAgB,cAAc,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,EAAE,IAAI,EAAE,MAAM,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,eAAe,GAAG,IAAI,CAYzH;AAED;;;;;GAKG;AACH,eAAO,MAAM,mBAAmB,QAAkB,CAAC"}

package/dist/src/domain/byteRange.js

@@ -0,0 +1,30 @@
+/**
+ * One `bytes=` range against a body of `size` bytes: `[start, end]` inclusive,
+ * `'unsatisfiable'` (416), or `null` when the header is absent, malformed or
+ * names several ranges — those get the whole body (RFC 9110 §14.2 lets a
+ * server ignore a Range it does not support).
+ */
+export function parseByteRange(header, size) {
+    const match = /^bytes=(\d*)-(\d*)$/.exec(String(header ?? '').trim());
+    if (!match || (match[1] === '' && match[2] === ''))
+        return null;
+    if (match[1] === '') {
+        const suffix = Number(match[2]);
+        if (suffix === 0 || size === 0)
+            return 'unsatisfiable';
+        return [Math.max(0, size - suffix), size - 1];
+    }
+    const start = Number(match[1]);
+    if (start >= size)
+        return 'unsatisfiable';
+    const end = match[2] === '' ? size - 1 : Math.min(Number(match[2]), size - 1);
+    return end < start ? null : [start, end];
+}
+/**
+ * The most bytes ONE ranged answer carries (8 MiB). A range wider than this —
+ * a player's open-ended `bytes=0-` — is answered with its first 8 MiB and a
+ * `Content-Range` saying so; the client asks for the rest. This is what keeps a
+ * 206 memory-bounded however large the file is.
+ */
+export const RAW_RANGE_MAX_BYTES = 8 * 1024 * 1024;
+//# sourceMappingURL=byteRange.js.map

package/dist/src/domain/byteRange.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"byteRange.js","sourceRoot":"","sources":["../../../src/domain/byteRange.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AACH,MAAM,UAAU,cAAc,CAAC,MAAiC,EAAE,IAAY;IAC5E,MAAM,KAAK,GAAG,qBAAqB,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;IACtE,IAAI,CAAC,KAAK,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,EAAE,IAAI,KAAK,CAAC,CAAC,CAAC,KAAK,EAAE,CAAC;QAAE,OAAO,IAAI,CAAC;IAChE,IAAI,KAAK,CAAC,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC;QACpB,MAAM,MAAM,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;QAChC,IAAI,MAAM,KAAK,CAAC,IAAI,IAAI,KAAK,CAAC;YAAE,OAAO,eAAe,CAAC;QACvD,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,GAAG,MAAM,CAAC,EAAE,IAAI,GAAG,CAAC,CAAC,CAAC;IAChD,CAAC;IACD,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;IAC/B,IAAI,KAAK,IAAI,IAAI;QAAE,OAAO,eAAe,CAAC;IAC1C,MAAM,GAAG,GAAG,KAAK,CAAC,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,IAAI,GAAG,CAAC,CAAC,CAAC;IAC9E,OAAO,GAAG,GAAG,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;AAC3C,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,MAAM,mBAAmB,GAAG,CAAC,GAAG,IAAI,GAAG,IAAI,CAAC"}

package/dist/src/domain/defaultPermissions.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"defaultPermissions.d.ts","sourceRoot":"","sources":["../../../src/domain/defaultPermissions.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,mBAAmB,CAAC;AAEjE;;;;;;;;;GASG;AACH,eAAO,MAAM,4BAA4B,UAwGxC,CAAC;AAEF;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,wBAAwB,EAAE,uBAGtC,CAAC;AAEF;;;;;GAKG;AACH,eAAO,MAAM,4BAA4B,EAAE,uBAG1C,CAAC;AAEF;;;;;GAKG;AACH,eAAO,MAAM,yBAAyB,EAAE,uBAMvC,CAAC"}
+{"version":3,"file":"defaultPermissions.d.ts","sourceRoot":"","sources":["../../../src/domain/defaultPermissions.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,mBAAmB,CAAC;AAEjE;;;;;;;;;GASG;AACH,eAAO,MAAM,4BAA4B,UAqIxC,CAAC;AAEF;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,wBAAwB,EAAE,uBAGtC,CAAC;AAEF;;;;;GAKG;AACH,eAAO,MAAM,4BAA4B,EAAE,uBAG1C,CAAC;AAEF;;;;;GAKG;AACH,eAAO,MAAM,yBAAyB,EAAE,uBAMvC,CAAC"}

package/dist/src/domain/defaultPermissions.js

@@ -118,6 +118,35 @@ export const DEFAULT_QDRANT_SYNC_EXCLUDES = [
     '**/.config/chromium/**',
     '**/.config/google-chrome/**',
     '**/.mozilla/**',
+    // A Neuralis device's own credentials: the CLI sign-in (Linux, macOS,
+    // Windows) and the device folder — every host's link secret — and the
+    // Neuralis host's own data in the same home, for a source that covers it
+    // (a whole-host or drive-root source): keys, users and platform config,
+    // each project's conversations and notifications, the backups. Named
+    // folder by folder: a project's own files and a device's scratch live
+    // under `.neuralis` too, never exclude it whole.
+    '**/.config/neuralis/**',
+    '**/Library/Application Support/neuralis/**',
+    '**/AppData/Roaming/neuralis/**',
+    '**/.neuralis/device/**',
+    '**/.local/share/neuralis/device/**',
+    '**/.neuralis/app/**',
+    '**/.local/share/neuralis/app/**',
+    '**/.neuralis/projects/*/data/**',
+    '**/.local/share/neuralis/projects/*/data/**',
+    '**/.neuralis/projects/*/notifications/**',
+    '**/.local/share/neuralis/projects/*/notifications/**',
+    '**/.neuralis/checkpoints/**',
+    '**/.local/share/neuralis/checkpoints/**',
+    '**/.neuralis/qdrant-backups/**',
+    '**/.local/share/neuralis/qdrant-backups/**',
+    '**/.neuralis/build/**',
+    '**/.local/share/neuralis/build/**',
+    '**/.neuralis/qdrant-version.json',
+    '**/.local/share/neuralis/qdrant-version.json',
+    // The pending OAuth sign-in store under the App Zone: a PKCE code verifier,
+    // the OAuth state and the captured sink for each sign-in in flight.
+    '**/oauth-flows/**',
 ];
 /**
  * data — generic frame applied at source creation. Every per-package

package/dist/src/domain/defaultPermissions.js.map

@@ -1 +1 @@
-{"version":3,"file":"defaultPermissions.js","sourceRoot":"","sources":["../../../src/domain/defaultPermissions.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAIH;;;;;;;;;GASG;AACH,MAAM,CAAC,MAAM,4BAA4B,GAAG;IAC1C,iBAAiB;IACjB,oBAAoB;IACpB,2EAA2E;IAC3E,0EAA0E;IAC1E,6DAA6D;IAC7D,gBAAgB;IAChB,mBAAmB;IACnB,gBAAgB;IAChB,mBAAmB;IACnB,SAAS;IACT,YAAY;IACZ,iBAAiB;IACjB,oBAAoB;IACpB,gBAAgB;IAChB,mBAAmB;IACnB,UAAU;IACV,aAAa;IACb,SAAS;IACT,YAAY;IACZ,UAAU;IACV,aAAa;IACb,QAAQ;IACR,WAAW;IACX,eAAe;IACf,kBAAkB;IAClB,QAAQ;IACR,WAAW;IACX,MAAM;IACN,SAAS;IACT,QAAQ;IACR,WAAW;IACX,OAAO;IACP,UAAU;IACV,OAAO;IACP,UAAU;IACV,QAAQ;IACR,WAAW;IACX,YAAY;IACZ,eAAe;IACf,gBAAgB;IAChB,mBAAmB;IACnB,WAAW;IACX,cAAc;IACd,4EAA4E;IAC5E,4EAA4E;IAC5E,2EAA2E;IAC3E,0EAA0E;IAC1E,6EAA6E;IAC7E,4EAA4E;IAC5E,6DAA6D;IAC7D,SAAS;IACT,YAAY;IACZ,YAAY;IACZ,4EAA4E;IAC5E,0EAA0E;IAC1E,0BAA0B;IAC1B,4EAA4E;IAC5E,4EAA4E;IAC5E,2EAA2E;IAC3E,sEAAsE;IACtE,6DAA6D;IAC7D,wBAAwB;IACxB,2BAA2B;IAC3B,yEAAyE;IACzE,2EAA2E;IAC3E,4EAA4E;IAC5E,yEAAyE;IACzE,uEAAuE;IACvE,wEAAwE;IACxE,4EAA4E;IAC5E,uEAAuE;IACvE,yEAAyE;IACzE,kEAAkE;IAClE,0EAA0E;IAC1E,YAAY;IACZ,cAAc;IACd,yEAAyE;IACzE,kEAAkE;IAClE,0EAA0E;IAC1E,qEAAqE;IACrE,uEAAuE;IACvE,2EAA2E;IAC3E,4DAA4D;IAC5D,YAAY;IACZ,wBAAwB;IACxB,YAAY;IACZ,YAAY;IACZ,cAAc;IACd,aAAa;IACb,eAAe;IACf,6BAA6B;IAC7B,sBAAsB;IACtB,kBAAkB;IAClB,sBAAsB;IACtB,WAAW;IACX,qBAAqB;IACrB,WAAW;IACX,YAAY;IACZ,6EAA6E;IAC7E,4BAA4B;IAC5B,wBAAwB;IACxB,6BAA6B;IAC7B,gBAAgB;CACjB,CAAC;AAEF;;;;;;;;;;;GAWG;AACH,MAAM,CAAC,MAAM,wBAAwB,GAA4B;IAC/D,OAAO,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE;IACjD,KAAK,EAAE,EAAE;CACV,CAAC;AAEF;;;;;GAKG;AACH,MAAM,CAAC,MAAM,4BAA4B,GAA4B;IACnE,OAAO,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE;IACjD,KAAK,EAAE,EAAE;CACV,CAAC;AAEF;;;;;GAKG;AACH,MAAM,CAAC,MAAM,yBAAyB,GAA4B;IAChE,OAAO,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE;IACjD,MAAM,EAAE;QACN,MAAM,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE;KACzB;IACD,KAAK,EAAE,EAAE;CACV,CAAC"}
+{"version":3,"file":"defaultPermissions.js","sourceRoot":"","sources":["../../../src/domain/defaultPermissions.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAIH;;;;;;;;;GASG;AACH,MAAM,CAAC,MAAM,4BAA4B,GAAG;IAC1C,iBAAiB;IACjB,oBAAoB;IACpB,2EAA2E;IAC3E,0EAA0E;IAC1E,6DAA6D;IAC7D,gBAAgB;IAChB,mBAAmB;IACnB,gBAAgB;IAChB,mBAAmB;IACnB,SAAS;IACT,YAAY;IACZ,iBAAiB;IACjB,oBAAoB;IACpB,gBAAgB;IAChB,mBAAmB;IACnB,UAAU;IACV,aAAa;IACb,SAAS;IACT,YAAY;IACZ,UAAU;IACV,aAAa;IACb,QAAQ;IACR,WAAW;IACX,eAAe;IACf,kBAAkB;IAClB,QAAQ;IACR,WAAW;IACX,MAAM;IACN,SAAS;IACT,QAAQ;IACR,WAAW;IACX,OAAO;IACP,UAAU;IACV,OAAO;IACP,UAAU;IACV,QAAQ;IACR,WAAW;IACX,YAAY;IACZ,eAAe;IACf,gBAAgB;IAChB,mBAAmB;IACnB,WAAW;IACX,cAAc;IACd,4EAA4E;IAC5E,4EAA4E;IAC5E,2EAA2E;IAC3E,0EAA0E;IAC1E,6EAA6E;IAC7E,4EAA4E;IAC5E,6DAA6D;IAC7D,SAAS;IACT,YAAY;IACZ,YAAY;IACZ,4EAA4E;IAC5E,0EAA0E;IAC1E,0BAA0B;IAC1B,4EAA4E;IAC5E,4EAA4E;IAC5E,2EAA2E;IAC3E,sEAAsE;IACtE,6DAA6D;IAC7D,wBAAwB;IACxB,2BAA2B;IAC3B,yEAAyE;IACzE,2EAA2E;IAC3E,4EAA4E;IAC5E,yEAAyE;IACzE,uEAAuE;IACvE,wEAAwE;IACxE,4EAA4E;IAC5E,uEAAuE;IACvE,yEAAyE;IACzE,kEAAkE;IAClE,0EAA0E;IAC1E,YAAY;IACZ,cAAc;IACd,yEAAyE;IACzE,kEAAkE;IAClE,0EAA0E;IAC1E,qEAAqE;IACrE,uEAAuE;IACvE,2EAA2E;IAC3E,4DAA4D;IAC5D,YAAY;IACZ,wBAAwB;IACxB,YAAY;IACZ,YAAY;IACZ,cAAc;IACd,aAAa;IACb,eAAe;IACf,6BAA6B;IAC7B,sBAAsB;IACtB,kBAAkB;IAClB,sBAAsB;IACtB,WAAW;IACX,qBAAqB;IACrB,WAAW;IACX,YAAY;IACZ,6EAA6E;IAC7E,4BAA4B;IAC5B,wBAAwB;IACxB,6BAA6B;IAC7B,gBAAgB;IAChB,sEAAsE;IACtE,sEAAsE;IACtE,yEAAyE;IACzE,wEAAwE;IACxE,qEAAqE;IACrE,sEAAsE;IACtE,iDAAiD;IACjD,wBAAwB;IACxB,4CAA4C;IAC5C,gCAAgC;IAChC,wBAAwB;IACxB,oCAAoC;IACpC,qBAAqB;IACrB,iCAAiC;IACjC,iCAAiC;IACjC,6CAA6C;IAC7C,0CAA0C;IAC1C,sDAAsD;IACtD,6BAA6B;IAC7B,yCAAyC;IACzC,gCAAgC;IAChC,4CAA4C;IAC5C,uBAAuB;IACvB,mCAAmC;IACnC,kCAAkC;IAClC,8CAA8C;IAC9C,4EAA4E;IAC5E,oEAAoE;IACpE,mBAAmB;CACpB,CAAC;AAEF;;;;;;;;;;;GAWG;AACH,MAAM,CAAC,MAAM,wBAAwB,GAA4B;IAC/D,OAAO,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE;IACjD,KAAK,EAAE,EAAE;CACV,CAAC;AAEF;;;;;GAKG;AACH,MAAM,CAAC,MAAM,4BAA4B,GAA4B;IACnE,OAAO,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE;IACjD,KAAK,EAAE,EAAE;CACV,CAAC;AAEF;;;;;GAKG;AACH,MAAM,CAAC,MAAM,yBAAyB,GAA4B;IAChE,OAAO,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE;IACjD,MAAM,EAAE;QACN,MAAM,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE;KACzB;IACD,KAAK,EAAE,EAAE;CACV,CAAC"}

package/dist/src/domain/mime.d.ts

@@ -4,8 +4,9 @@
  * Two jobs live here, and they are deliberately different layers:
  *
  *  1. **Resolution** (`inferMimeTypeFromFilename`, `looksTextByMime`) — what a
- *     file's type honestly IS. Moved here from `FilesystemUiService` so the
- *     serve path and the store path answer from the same table.
+ *     file's type honestly IS, so the serve path and the store path answer from
+ *     the same table. The extension tables themselves are the kernel's
+ *     (`@neuralis/package-system/web-common`), re-exported below.
  *  2. **Response policy** (`classifyResponseMime`, `buildRawResponseHeaders`) —
  *     what the byte lane is allowed to tell a BROWSER to do with those bytes.
  *
@@ -79,17 +80,8 @@
  * `FilesystemUiService` excludes the active-document class at that one site for
  * exactly this reason — the body is JSON and the wire should say so.
  */
+export { binaryMimeTypeForPath, inferMimeTypeFromFilename } from '@neuralis/package-system/web-common';
 export declare function looksTextByMime(mimeType: string | undefined): boolean;
-/**
- * Extension → mime, for files whose stored metadata carries no type.
- *
- * The five document extensions at the end are NOT decoration: they make the
- * extension agree with `classifyResponseMime`'s active-document set, so an
- * `.html` or `.xml` file reports what it is instead of `application/octet-stream`
- * and is classified on its merits. Both land on `attachment` either way — this
- * only removes a lie from the wire.
- */
-export declare function inferMimeTypeFromFilename(filename: string): string;
 /**
  * Lowercase `type/subtype`, parameters dropped, syntactically validated.
  * Returns `null` for anything absent, over-long or not token-shaped — the
@@ -141,9 +133,10 @@ export declare function buildRawResponseHeaders(input: RawResponseHeaderInput):
  *
  * **SCOPE, measured live — the magic-byte check governs the STORED value, and
  * on a non-brain source it does NOT reach the wire.** `loadRawBytes` returns
- * `result.mimeType || mimeType` for `sourceKind !== 'brain'`, so the local
- * connector's own extension-derived type wins over the persisted metadata at
- * serve time. HTML bytes stored as `application/octet-stream` under the name
+ * the connector's type for `sourceKind !== 'brain'` whenever the connector can
+ * tell (anything but `application/octet-stream`, the contract's "cannot
+ * tell"), so the local connector's own extension-derived type wins over the
+ * persisted metadata at serve time. HTML bytes stored as `application/octet-stream` under the name
  * `x.png` are therefore SERVED `image/png`. That is bounded and not a hole: the
  * classification still runs on the extension, so `.svg`/`.html`/`.xml` stay
  * `attachment`, and a mislabelled raster is inert under the globally-present
@@ -171,5 +164,4 @@ export declare function normalizeStoredMimeType(declared: string | undefined, fi
  * for every other reader of that request.
  */
 export declare function normalizeNodeMetadataMime(metadata: unknown, filename: string): Record<string, unknown> | undefined;
-export declare function binaryMimeTypeForPath(filePath: string): string | undefined;
 //# sourceMappingURL=mime.d.ts.map

package/dist/src/domain/mime.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"mime.d.ts","sourceRoot":"","sources":["../../../src/domain/mime.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgFG;AAWH,wBAAgB,eAAe,CAAC,QAAQ,EAAE,MAAM,GAAG,SAAS,GAAG,OAAO,CAGrE;AAED;;;;;;;;GAQG;AACH,wBAAgB,yBAAyB,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,CAmBlE;AAED;;;;GAIG;AACH,wBAAgB,gBAAgB,CAAC,GAAG,EAAE,MAAM,GAAG,SAAS,GAAG,IAAI,GAAG,MAAM,GAAG,IAAI,CAI9E;AAED,MAAM,MAAM,iBAAiB,GAAG,QAAQ,GAAG,iBAAiB,GAAG,QAAQ,CAAC;AAsBxE;;;;;GAKG;AACH,wBAAgB,oBAAoB,CAAC,OAAO,EAAE,MAAM,GAAG,IAAI,GAAG,iBAAiB,CAS9E;AA4BD,MAAM,MAAM,sBAAsB,GAAG;IACnC,oFAAoF;IACpF,QAAQ,EAAE,MAAM,GAAG,SAAS,CAAC;IAC7B,QAAQ,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC9B,IAAI,EAAE,MAAM,CAAC;CACd,CAAC;AAEF;;;;;;;GAOG;AACH,wBAAgB,uBAAuB,CAAC,KAAK,EAAE,sBAAsB,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAqB7F;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiCG;AACH,wBAAgB,uBAAuB,CACrC,QAAQ,EAAE,MAAM,GAAG,SAAS,EAC5B,QAAQ,EAAE,MAAM,EAChB,KAAK,CAAC,EAAE,UAAU,GACjB,MAAM,CAaR;AAED;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,yBAAyB,CACvC,QAAQ,EAAE,OAAO,EACjB,QAAQ,EAAE,MAAM,GACf,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,SAAS,CASrC;AA8CD,wBAAgB,qBAAqB,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAI1E"}
+{"version":3,"file":"mime.d.ts","sourceRoot":"","sources":["../../../src/domain/mime.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiFG;AAMH,OAAO,EAAE,qBAAqB,EAAE,yBAAyB,EAAE,MAAM,qCAAqC,CAAC;AAQvG,wBAAgB,eAAe,CAAC,QAAQ,EAAE,MAAM,GAAG,SAAS,GAAG,OAAO,CAGrE;AAGD;;;;GAIG;AACH,wBAAgB,gBAAgB,CAAC,GAAG,EAAE,MAAM,GAAG,SAAS,GAAG,IAAI,GAAG,MAAM,GAAG,IAAI,CAI9E;AAED,MAAM,MAAM,iBAAiB,GAAG,QAAQ,GAAG,iBAAiB,GAAG,QAAQ,CAAC;AAsBxE;;;;;GAKG;AACH,wBAAgB,oBAAoB,CAAC,OAAO,EAAE,MAAM,GAAG,IAAI,GAAG,iBAAiB,CAS9E;AA4BD,MAAM,MAAM,sBAAsB,GAAG;IACnC,oFAAoF;IACpF,QAAQ,EAAE,MAAM,GAAG,SAAS,CAAC;IAC7B,QAAQ,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC9B,IAAI,EAAE,MAAM,CAAC;CACd,CAAC;AAEF;;;;;;;GAOG;AACH,wBAAgB,uBAAuB,CAAC,KAAK,EAAE,sBAAsB,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAqB7F;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAkCG;AACH,wBAAgB,uBAAuB,CACrC,QAAQ,EAAE,MAAM,GAAG,SAAS,EAC5B,QAAQ,EAAE,MAAM,EAChB,KAAK,CAAC,EAAE,UAAU,GACjB,MAAM,CAaR;AAED;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,yBAAyB,CACvC,QAAQ,EAAE,OAAO,EACjB,QAAQ,EAAE,MAAM,GACf,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,SAAS,CASrC"}