@neuralis/brain-core 0.3.2 → 0.4.1

package/dist/src/usecases/browseSourceFolders.js

@@ -0,0 +1,210 @@
+/**
+ * `GET /sources/browse` — one level of FOLDERS, the step that precedes attaching
+ * a source. Two planes, one rule: **you may browse exactly what you would be
+ * allowed to attach.**
+ *
+ * - **This server** (`browseServerFolders`). The route admits `sources.mount`
+ *   (the attach act's own gate) and hands over the gates it owns: the shared
+ *   protected-root table (`/`, the App Zone and the Neuralis tree cost
+ *   `sources.privileged` here exactly as at attach time), matched IS-or-UNDER
+ *   so a parent stays walkable while a protected child is simply absent
+ *   (hidden-not-locked), and the native folder fence. Natively any absolute
+ *   path the gates admit; in Docker the `/mounts` zone and every folder under
+ *   it, never above it. The gate runs on the lexical path AND again on the
+ *   `realpath` — a symlink whose literal path is innocent can still point at
+ *   `/`, a protected zone or out of `/mounts`.
+ * - **The caller's own device** (`browseDeviceFolders`). The device plane's
+ *   ONE attach gate (agent-core's `mayAttach`: the device's owner holding
+ *   `device.own`, nothing else — `sources.mount` is a manager default and never
+ *   reaches somebody's machine) decides; every other caller gets ONE fixed
+ *   refusal, the same bytes for an unknown id. The device's broker clamps the
+ *   path against the folders its owner allowed THIS host, lexically before any
+ *   realpath, so a refusal says nothing about existence. An empty path lists
+ *   those allowed folders (where the picker starts).
+ *
+ * Invariant 9 on both planes: a failure never carries the path or an errno —
+ * one stable sentence on this server, a fixed code from a device; the operator
+ * reads the detail in the server log. Cost: one `readdir` + `realpath` per call
+ * here; one broker `/fs/list` (≤ 2 000 entries, folder names only on the way
+ * back) or one `/ceiling/roots` per call on a device. No cache, no timer.
+ */
+import { readdir, realpath, stat } from 'node:fs/promises';
+import { platform } from 'node:os';
+import { dirname, isAbsolute, join, posix, resolve } from 'node:path';
+import { hostPathFlavour, isFilesystemRoot, isPathInside } from '@neuralis/package-system/paths';
+import { NATIVE_LOCAL_REFUSAL, nativeLocalPlacement } from '../domain/access/nativeLocalFence.js';
+/** One stable sentence for every server-side browse failure (invariant 9). */
+export const BROWSE_UNREADABLE = 'That path is not available.';
+/** The ONE answer to every caller the device attach gate does not admit — an unknown id included. */
+export const DEVICE_BROWSE_REFUSAL = "Only the device's owner may browse it.";
+/** The container's bind-mount zone: the only folders a Docker deployment can attach. */
+export const DOCKER_MOUNTS_ROOT = '/mounts';
+const refusedFeature = (feature) => ({ status: 403, body: { error: `Browsing this path requires the ${feature} feature.` } });
+const unreadable = () => ({ status: 400, body: { error: BROWSE_UNREADABLE } });
+/** The visible, non-dot sub-folders of `real`, sorted, as entries under `real`. */
+async function listFolders(real, visible) {
+    const entries = await readdir(real, { withFileTypes: true });
+    return entries.filter((e) => e.isDirectory() && !e.name.startsWith('.'))
+        .sort((a, b) => a.name.localeCompare(b.name))
+        .map((e) => ({ name: e.name, path: join(real, e.name), type: 'directory' }))
+        .filter((e) => visible(e.path));
+}
+/**
+ * Docker: `/mounts` and anything under it — the zone's bind mounts and their
+ * sub-folders (an attach there derives its `hostRoot` from the bind, so a
+ * sub-folder works like the bind itself). Empty path ⇒ the zone. Outside the
+ * zone, lexically or by its realpath, is the one unreadable answer: the zone is
+ * the whole of what a container can attach. A zone that does not exist yet
+ * ("no mounts configured") is an empty list, not an error.
+ */
+async function browseDockerMounts(rawPath, gates, zone) {
+    const requested = rawPath || zone;
+    if (requested.includes('\0') || !posix.isAbsolute(requested))
+        return unreadable();
+    const canonical = posix.resolve(requested);
+    if (!isPathInside(zone, canonical, posix))
+        return unreadable();
+    let real;
+    let realZone;
+    try {
+        realZone = await realpath(zone);
+    }
+    catch {
+        return canonical === zone ? { status: 200, body: { entries: [], atRoot: true } } : unreadable();
+    }
+    try {
+        real = await realpath(canonical);
+    }
+    catch {
+        return unreadable();
+    }
+    if (!isPathInside(realZone, real, posix))
+        return unreadable();
+    for (const candidate of new Set([canonical, real])) {
+        const missing = gates.missingFeatures(candidate);
+        if (missing.length > 0)
+            return refusedFeature(missing[0]);
+    }
+    try {
+        return { status: 200, body: { entries: await listFolders(real, gates.childVisible), atRoot: real === realZone } };
+    }
+    catch (err) {
+        console.warn('[sources/browse] readdir failed:', err instanceof Error ? err.message : String(err));
+        return unreadable();
+    }
+}
+/** One level of folders on THIS server — the route has already admitted `sources.mount`. */
+export async function browseServerFolders(input, gates) {
+    if (input.isDocker)
+        return browseDockerMounts(input.rawPath, gates, input.mountsRoot ?? DOCKER_MOUNTS_ROOT);
+    const rawPath = input.rawPath;
+    if (!rawPath)
+        return { status: 400, body: { error: 'Missing path parameter' } };
+    // A NUL byte survives `resolve()` unchanged and would slip past every string
+    // comparison in the table before `readdir` rejects it.
+    if (rawPath.includes('\0'))
+        return unreadable();
+    // A relative path would resolve against the SERVER process cwd — never what
+    // the caller meant, and it also closes the drive-relative `C:foo` form.
+    if (!isAbsolute(rawPath))
+        return { status: 400, body: { error: 'Path must be absolute' } };
+    // ONE canonical value from here on: the gate, the root test, the readdir and
+    // the child paths all use it.
+    const canonical = resolve(rawPath);
+    const denied = gates.missingFeatures(canonical);
+    if (denied.length > 0)
+        return refusedFeature(denied[0]);
+    const fenceRoot = await gates.fenceProject();
+    const fenceProject = fenceRoot ? resolve(fenceRoot) : '';
+    if (fenceRoot !== null && nativeLocalPlacement(canonical, fenceProject, gates.privilegedRoots) === 'outside') {
+        return { status: 403, body: NATIVE_LOCAL_REFUSAL };
+    }
+    // `resolve` is purely LEXICAL — re-run the same gate on the real path.
+    let real;
+    try {
+        real = await realpath(canonical);
+    }
+    catch {
+        return unreadable();
+    }
+    if (real !== canonical) {
+        const deniedReal = gates.missingFeatures(real);
+        if (deniedReal.length > 0)
+            return refusedFeature(deniedReal[0]);
+    }
+    const realProject = fenceProject ? await realpath(fenceProject).catch(() => fenceProject) : '';
+    const placement = fenceRoot === null ? null : nativeLocalPlacement(real, realProject, gates.privilegedRoots);
+    if (placement === 'outside')
+        return { status: 403, body: NATIVE_LOCAL_REFUSAL };
+    // Whole-host discovery by definition — the drive letters ARE the host. The
+    // filesystem-root floor already required the privileged feature; this second
+    // check keeps that true even if the table ever changes.
+    if (platform() === 'win32' && dirname(real) === real) {
+        if (!gates.mayBrowseDrives())
+            return refusedFeature(gates.privilegedFeature);
+        const drives = [];
+        for (const letter of 'ABCDEFGHIJKLMNOPQRSTUVWXYZ') {
+            try {
+                await stat(`${letter}:\\`);
+                drives.push({ name: `${letter}:\\`, path: `${letter}:\\`, type: 'directory' });
+            }
+            catch { /* skip */ }
+        }
+        return { status: 200, body: { entries: drives, atRoot: true } };
+    }
+    try {
+        const visible = (child) => gates.childVisible(child)
+            // Natively an ANCESTOR lists only the children on the way to an attachable root.
+            && (placement !== 'ancestor' || nativeLocalPlacement(child, realProject, gates.privilegedRoots) !== 'outside');
+        // The "up" control's one answer — the kernel's root predicate, so a
+        // Windows drive root ends the climb exactly like `/`.
+        return { status: 200, body: { entries: await listFolders(real, visible), atRoot: isFilesystemRoot(real) } };
+    }
+    catch (err) {
+        // Never the raw message: it carries the absolute path and tells "does not
+        // exist" from "cannot be read" — an existence oracle over the host.
+        console.warn('[sources/browse] readdir failed:', err instanceof Error ? err.message : String(err));
+        return unreadable();
+    }
+}
+/**
+ * One level of folders on the caller's OWN paired device, or (empty path) the
+ * folders that device allows THIS host. `allowed` is the route's attach verdict
+ * (`devices.mayAttach`); agent-core re-checks it on every call. A device that
+ * cannot answer (offline, an older CLI, the folder outside what it allows) is a
+ * 200 with `state` = that fixed code and no entries — the picker says which,
+ * and a typed path still attaches (the create re-checks everything).
+ */
+export async function browseDeviceFolders(input, devices, session) {
+    const refused = { status: 403, body: { error: DEVICE_BROWSE_REFUSAL } };
+    if (!input.allowed || !devices)
+        return refused;
+    const { device, rawPath } = input;
+    if (!rawPath) {
+        const roots = await devices.ceilingRoots(session, device);
+        if (!roots.ok)
+            return roots.code === 'refused' ? refused : { status: 200, body: { entries: [], atRoot: true, roots: true, state: roots.code } };
+        const write = new Set(roots.write);
+        const all = [...new Set([...roots.read, ...roots.write])].sort((a, b) => a.localeCompare(b));
+        const entries = all.map((p) => ({ name: p, path: p, type: 'directory', access: write.has(p) ? 'write' : 'read' }));
+        return { status: 200, body: { entries, atRoot: true, roots: true, state: 'ok' } };
+    }
+    if (rawPath.includes('\0') || rawPath.length > 4096)
+        return unreadable();
+    if (!hostPathFlavour(rawPath).isAbsolute(rawPath))
+        return { status: 400, body: { error: 'Path must be absolute' } };
+    const listing = await devices.listFolder(session, device, rawPath);
+    if (!listing.ok)
+        return listing.code === 'refused' ? refused : { status: 200, body: { entries: [], atRoot: false, state: listing.code } };
+    return {
+        status: 200,
+        body: {
+            entries: listing.entries.map((e) => ({ ...e, type: 'directory' })),
+            atRoot: isFilesystemRoot(rawPath),
+            state: 'ok',
+            ...(listing.truncated ? { truncated: true } : {}),
+            ...(listing.symlinks > 0 ? { symlinks: listing.symlinks } : {}),
+        },
+    };
+}
+//# sourceMappingURL=browseSourceFolders.js.map

package/dist/src/usecases/browseSourceFolders.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"browseSourceFolders.js","sourceRoot":"","sources":["../../../src/usecases/browseSourceFolders.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AAEH,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,kBAAkB,CAAC;AAC3D,OAAO,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AACnC,OAAO,EAAE,OAAO,EAAE,UAAU,EAAE,IAAI,EAAE,KAAK,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAEtE,OAAO,EAAE,eAAe,EAAE,gBAAgB,EAAE,YAAY,EAAE,MAAM,gCAAgC,CAAC;AACjG,OAAO,EAAE,oBAAoB,EAAE,oBAAoB,EAAE,MAAM,sCAAsC,CAAC;AAElG,8EAA8E;AAC9E,MAAM,CAAC,MAAM,iBAAiB,GAAG,6BAA6B,CAAC;AAC/D,qGAAqG;AACrG,MAAM,CAAC,MAAM,qBAAqB,GAAG,wCAAwC,CAAC;AAC9E,wFAAwF;AACxF,MAAM,CAAC,MAAM,kBAAkB,GAAG,SAAS,CAAC;AAmB5C,MAAM,cAAc,GAAG,CAAC,OAAe,EAAgB,EAAE,CAAC,CAAC,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE,KAAK,EAAE,mCAAmC,OAAO,WAAW,EAAE,EAAE,CAAC,CAAC;AACpJ,MAAM,UAAU,GAAG,GAAiB,EAAE,CAAC,CAAC,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE,KAAK,EAAE,iBAAiB,EAAE,EAAE,CAAC,CAAC;AAE7F,mFAAmF;AACnF,KAAK,UAAU,WAAW,CAAC,IAAY,EAAE,OAAmC;IAC1E,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,IAAI,EAAE,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC,CAAC;IAC7D,OAAO,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,WAAW,EAAE,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC;SACrE,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;SAC5C,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,WAAoB,EAAE,CAAC,CAAC;SACpF,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC;AACpC,CAAC;AAED;;;;;;;GAOG;AACH,KAAK,UAAU,kBAAkB,CAAC,OAAe,EAAE,KAAwB,EAAE,IAAY;IACvF,MAAM,SAAS,GAAG,OAAO,IAAI,IAAI,CAAC;IAClC,IAAI,SAAS,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,SAAS,CAAC;QAAE,OAAO,UAAU,EAAE,CAAC;IAClF,MAAM,SAAS,GAAG,KAAK,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;IAC3C,IAAI,CAAC,YAAY,CAAC,IAAI,EAAE,SAAS,EAAE,KAAK,CAAC;QAAE,OAAO,UAAU,EAAE,CAAC;IAC/D,IAAI,IAAY,CAAC;IACjB,IAAI,QAAgB,CAAC;IACrB,IAAI,CAAC;QACH,QAAQ,GAAG,MAAM,QAAQ,CAAC,IAAI,CAAC,CAAC;IAClC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,KAAK,IAAI,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE,OAAO,EAAE,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,EAAE,CAAC,CAAC,CAAC,UAAU,EAAE,CAAC;IAClG,CAAC;IACD,IAAI,CAAC;QACH,IAAI,GAAG,MAAM,QAAQ,CAAC,SAAS,CAAC,CAAC;IACnC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,UAAU,EAAE,CAAC;IACtB,CAAC;IACD,IAAI,CAAC,YAAY,CAAC,QAAQ,EAAE,IAAI,EAAE,KAAK,CAAC;QAAE,OAAO,UAAU,EAAE,CAAC;IAC9D,KAAK,MAAM,SAAS,IAAI,IAAI,GAAG,CAAC,CAAC,SAAS,EAAE,IAAI,CAAC,CAAC,EAAE,CAAC;QACnD,MAAM,OAAO,GAAG,KAAK,CAAC,eAAe,CAAC,SAAS,CAAC,CAAC;QACjD,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC;YAAE,OAAO,cAAc,CAAC,OAAO,CAAC,CAAC,CAAE,CAAC,CAAC;IAC7D,CAAC;IACD,IAAI,CAAC;QACH,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC,IAAI,EAAE,KAAK,CAAC,YAAY,CAAC,EAAE,MAAM,EAAE,IAAI,KAAK,QAAQ,EAAE,EAAE,CAAC;IACpH,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO,CAAC,IAAI,CAAC,kCAAkC,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC;QACnG,OAAO,UAAU,EAAE,CAAC;IACtB,CAAC;AACH,CAAC;AAED,4FAA4F;AAC5F,MAAM,CAAC,KAAK,UAAU,mBAAmB,CACvC,KAAkE,EAClE,KAAwB;IAExB,IAAI,KAAK,CAAC,QAAQ;QAAE,OAAO,kBAAkB,CAAC,KAAK,CAAC,OAAO,EAAE,KAAK,EAAE,KAAK,CAAC,UAAU,IAAI,kBAAkB,CAAC,CAAC;IAC5G,MAAM,OAAO,GAAG,KAAK,CAAC,OAAO,CAAC;IAC9B,IAAI,CAAC,OAAO;QAAE,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE,KAAK,EAAE,wBAAwB,EAAE,EAAE,CAAC;IAChF,6EAA6E;IAC7E,uDAAuD;IACvD,IAAI,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC;QAAE,OAAO,UAAU,EAAE,CAAC;IAChD,4EAA4E;IAC5E,wEAAwE;IACxE,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC;QAAE,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE,KAAK,EAAE,uBAAuB,EAAE,EAAE,CAAC;IAE3F,6EAA6E;IAC7E,8BAA8B;IAC9B,MAAM,SAAS,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IACnC,MAAM,MAAM,GAAG,KAAK,CAAC,eAAe,CAAC,SAAS,CAAC,CAAC;IAChD,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC;QAAE,OAAO,cAAc,CAAC,MAAM,CAAC,CAAC,CAAE,CAAC,CAAC;IACzD,MAAM,SAAS,GAAG,MAAM,KAAK,CAAC,YAAY,EAAE,CAAC;IAC7C,MAAM,YAAY,GAAG,SAAS,CAAC,CAAC,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IACzD,IAAI,SAAS,KAAK,IAAI,IAAI,oBAAoB,CAAC,SAAS,EAAE,YAAY,EAAE,KAAK,CAAC,eAAe,CAAC,KAAK,SAAS,EAAE,CAAC;QAC7G,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,oBAAoB,EAAE,CAAC;IACrD,CAAC;IAED,uEAAuE;IACvE,IAAI,IAAY,CAAC;IACjB,IAAI,CAAC;QACH,IAAI,GAAG,MAAM,QAAQ,CAAC,SAAS,CAAC,CAAC;IACnC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,UAAU,EAAE,CAAC;IACtB,CAAC;IACD,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;QACvB,MAAM,UAAU,GAAG,KAAK,CAAC,eAAe,CAAC,IAAI,CAAC,CAAC;QAC/C,IAAI,UAAU,CAAC,MAAM,GAAG,CAAC;YAAE,OAAO,cAAc,CAAC,UAAU,CAAC,CAAC,CAAE,CAAC,CAAC;IACnE,CAAC;IACD,MAAM,WAAW,GAAG,YAAY,CAAC,CAAC,CAAC,MAAM,QAAQ,CAAC,YAAY,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IAC/F,MAAM,SAAS,GAAG,SAAS,KAAK,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,oBAAoB,CAAC,IAAI,EAAE,WAAW,EAAE,KAAK,CAAC,eAAe,CAAC,CAAC;IAC7G,IAAI,SAAS,KAAK,SAAS;QAAE,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,oBAAoB,EAAE,CAAC;IAEhF,2EAA2E;IAC3E,6EAA6E;IAC7E,wDAAwD;IACxD,IAAI,QAAQ,EAAE,KAAK,OAAO,IAAI,OAAO,CAAC,IAAI,CAAC,KAAK,IAAI,EAAE,CAAC;QACrD,IAAI,CAAC,KAAK,CAAC,eAAe,EAAE;YAAE,OAAO,cAAc,CAAC,KAAK,CAAC,iBAAiB,CAAC,CAAC;QAC7E,MAAM,MAAM,GAAkB,EAAE,CAAC;QACjC,KAAK,MAAM,MAAM,IAAI,4BAA4B,EAAE,CAAC;YAClD,IAAI,CAAC;gBAAC,MAAM,IAAI,CAAC,GAAG,MAAM,KAAK,CAAC,CAAC;gBAAC,MAAM,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,GAAG,MAAM,KAAK,EAAE,IAAI,EAAE,GAAG,MAAM,KAAK,EAAE,IAAI,EAAE,WAAW,EAAE,CAAC,CAAC;YAAC,CAAC;YAAC,MAAM,CAAC,CAAC,UAAU,CAAC,CAAC;QAC1I,CAAC;QACD,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,EAAE,CAAC;IAClE,CAAC;IAED,IAAI,CAAC;QACH,MAAM,OAAO,GAAG,CAAC,KAAa,EAAW,EAAE,CAAC,KAAK,CAAC,YAAY,CAAC,KAAK,CAAC;YACnE,iFAAiF;eAC9E,CAAC,SAAS,KAAK,UAAU,IAAI,oBAAoB,CAAC,KAAK,EAAE,WAAW,EAAE,KAAK,CAAC,eAAe,CAAC,KAAK,SAAS,CAAC,CAAC;QACjH,oEAAoE;QACpE,sDAAsD;QACtD,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC,IAAI,EAAE,OAAO,CAAC,EAAE,MAAM,EAAE,gBAAgB,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC;IAC9G,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,0EAA0E;QAC1E,oEAAoE;QACpE,OAAO,CAAC,IAAI,CAAC,kCAAkC,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC;QACnG,OAAO,UAAU,EAAE,CAAC;IACtB,CAAC;AACH,CAAC;AAKD;;;;;;;GAOG;AACH,MAAM,CAAC,KAAK,UAAU,mBAAmB,CACvC,KAA4D,EAC5D,OAAqC,EACrC,OAAsD;IAEtD,MAAM,OAAO,GAAiB,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE,KAAK,EAAE,qBAAqB,EAAE,EAAE,CAAC;IACtF,IAAI,CAAC,KAAK,CAAC,OAAO,IAAI,CAAC,OAAO;QAAE,OAAO,OAAO,CAAC;IAC/C,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,GAAG,KAAK,CAAC;IAClC,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,MAAM,KAAK,GAAG,MAAM,OAAO,CAAC,YAAY,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;QAC1D,IAAI,CAAC,KAAK,CAAC,EAAE;YAAE,OAAO,KAAK,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE,OAAO,EAAE,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,KAAK,EAAE,KAAK,CAAC,IAAI,EAAE,EAAE,CAAC;QAChJ,MAAM,KAAK,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;QACnC,MAAM,GAAG,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,CAAC,GAAG,KAAK,CAAC,IAAI,EAAE,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,CAAC;QAC7F,MAAM,OAAO,GAAkB,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,EAAE,IAAI,EAAE,CAAC,EAAE,IAAI,EAAE,WAAW,EAAE,MAAM,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC;QAClI,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,EAAE,CAAC;IACpF,CAAC;IACD,IAAI,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,OAAO,CAAC,MAAM,GAAG,IAAI;QAAE,OAAO,UAAU,EAAE,CAAC;IACzE,IAAI,CAAC,eAAe,CAAC,OAAO,CAAC,CAAC,UAAU,CAAC,OAAO,CAAC;QAAE,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE,KAAK,EAAE,uBAAuB,EAAE,EAAE,CAAC;IACpH,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,UAAU,CAAC,OAAO,EAAE,MAAM,EAAE,OAAO,CAAC,CAAC;IACnE,IAAI,CAAC,OAAO,CAAC,EAAE;QAAE,OAAO,OAAO,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE,OAAO,EAAE,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,KAAK,EAAE,OAAO,CAAC,IAAI,EAAE,EAAE,CAAC;IAC1I,OAAO;QACL,MAAM,EAAE,GAAG;QACX,IAAI,EAAE;YACJ,OAAO,EAAE,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,IAAI,EAAE,WAAoB,EAAE,CAAC,CAAC;YAC3E,MAAM,EAAE,gBAAgB,CAAC,OAAO,CAAC;YACjC,KAAK,EAAE,IAAI;YACX,GAAG,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACjD,GAAG,CAAC,OAAO,CAAC,QAAQ,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,OAAO,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAChE;KACF,CAAC;AACJ,CAAC"}

package/dist/src/usecases/createDeclaredSources.d.ts

@@ -1,5 +1,5 @@
 import type { ConnectorHierarchicalPermissions, ConnectorPathPermission, PackageSourceDeclaration } from '@neuralis/package-system/contracts';
-import type { RuntimeStackInfo } from '@neuralis/package-system/paths';
+import { type RuntimeStackInfo } from '@neuralis/package-system/paths';
 import type { SourceConfigPort, SourceConfigScope } from '../connectors/types.js';
 import type { SourceConfig } from '../domain/sourceConfig.js';
 type RepairLogger = {
@@ -24,9 +24,20 @@ type RepairLogger = {
  */
 export type DeclaredSourceFailure = {
     source: string;
-    reason: 'baselines_unresolvable' | 'write_failed' | 'binding_failed';
+    reason: 'baselines_unresolvable' | 'root_outside_project' | 'write_failed' | 'binding_failed';
     error: string;
 };
+/**
+ * Does a declared in-process folder's root leave its project zone on disk? The
+ * kernel validator already keeps a declared root project-relative (no `..`, no
+ * absolute path), so the LEXICAL path stays inside; what it never sees is a
+ * symlink standing at that path. This is the route's realpath arm for the third
+ * producer: the folder's REAL path must stay inside the project zone's real
+ * path, on either plane (natively the fence's own rule; in a container the zone
+ * is still the only place a declaration may name). A root that does not exist
+ * yet cannot point anywhere and passes; no known projects root ⇒ no judgement.
+ */
+export declare function declaredRootLeavesProject(config: Pick<SourceConfig, 'connection'>, runtimeStack: RuntimeStackInfo | null, projectId: string): Promise<boolean>;
 export declare function createMissingDeclaredSources(deps: {
     sourceConfigs: SourceConfigPort;
     bindSource: (scope: SourceConfigScope, config: SourceConfig) => Promise<void>;

package/dist/src/usecases/createDeclaredSources.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"createDeclaredSources.d.ts","sourceRoot":"","sources":["../../../src/usecases/createDeclaredSources.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,gCAAgC,EAAE,uBAAuB,EAAE,wBAAwB,EAAE,MAAM,oCAAoC,CAAC;AAC9I,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,gCAAgC,CAAC;AAEvE,OAAO,KAAK,EAAE,gBAAgB,EAAE,iBAAiB,EAAE,MAAM,wBAAwB,CAAC;AAClF,OAAO,KAAK,EAA2B,YAAY,EAAE,MAAM,2BAA2B,CAAC;AAGvF,KAAK,YAAY,GAAG;IAAE,IAAI,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAAK,IAAI,CAAC;IAAC,IAAI,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAAK,IAAI,CAAA;CAAE,CAAC;AAEnJ;;;;;;;;;;;;;;;GAeG;AACH,MAAM,MAAM,qBAAqB,GAAG;IAClC,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,wBAAwB,GAAG,cAAc,GAAG,gBAAgB,CAAC;IACrE,KAAK,EAAE,MAAM,CAAC;CACf,CAAC;AAEF,wBAAsB,4BAA4B,CAChD,IAAI,EAAE;IACJ,aAAa,EAAE,gBAAgB,CAAC;IAChC,UAAU,EAAE,CAAC,KAAK,EAAE,iBAAiB,EAAE,MAAM,EAAE,YAAY,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IAC9E,aAAa,EAAE,MAAM,CAAC;IACtB,gFAAgF;IAChF,kBAAkB,EAAE,SAAS,MAAM,EAAE,CAAC;IACtC,qBAAqB,EAAE,MAAM,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,gCAAgC,CAAC,CAAC,CAAC;IAC9F,kBAAkB,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,uBAAuB,EAAE,CAAC;IAChE,YAAY,EAAE,gBAAgB,GAAG,IAAI,CAAC;IACtC,GAAG,EAAE,MAAM,MAAM,CAAC;IAClB,MAAM,CAAC,EAAE,YAAY,CAAC;CACvB,EACD,MAAM,EAAE;IACN,SAAS,EAAE,MAAM,CAAC;IAClB,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC;IACtB,KAAK,EAAE,aAAa,CAAC;QAAE,aAAa,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,wBAAwB,CAAA;KAAE,CAAC,CAAC;CACjF,GACA,OAAO,CAAC;IAAE,OAAO,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,qBAAqB,EAAE,CAAA;CAAE,CAAC,CA8EhF"}
+{"version":3,"file":"createDeclaredSources.d.ts","sourceRoot":"","sources":["../../../src/usecases/createDeclaredSources.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,gCAAgC,EAAE,uBAAuB,EAAE,wBAAwB,EAAE,MAAM,oCAAoC,CAAC;AAI9I,OAAO,EAAgB,KAAK,gBAAgB,EAAE,MAAM,gCAAgC,CAAC;AAErF,OAAO,KAAK,EAAE,gBAAgB,EAAE,iBAAiB,EAAE,MAAM,wBAAwB,CAAC;AAClF,OAAO,KAAK,EAA2B,YAAY,EAAE,MAAM,2BAA2B,CAAC;AAGvF,KAAK,YAAY,GAAG;IAAE,IAAI,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAAK,IAAI,CAAC;IAAC,IAAI,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAAK,IAAI,CAAA;CAAE,CAAC;AAEnJ;;;;;;;;;;;;;;;GAeG;AACH,MAAM,MAAM,qBAAqB,GAAG;IAClC,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,wBAAwB,GAAG,sBAAsB,GAAG,cAAc,GAAG,gBAAgB,CAAC;IAC9F,KAAK,EAAE,MAAM,CAAC;CACf,CAAC;AAEF;;;;;;;;;GASG;AACH,wBAAsB,yBAAyB,CAC7C,MAAM,EAAE,IAAI,CAAC,YAAY,EAAE,YAAY,CAAC,EACxC,YAAY,EAAE,gBAAgB,GAAG,IAAI,EACrC,SAAS,EAAE,MAAM,GAChB,OAAO,CAAC,OAAO,CAAC,CAelB;AAED,wBAAsB,4BAA4B,CAChD,IAAI,EAAE;IACJ,aAAa,EAAE,gBAAgB,CAAC;IAChC,UAAU,EAAE,CAAC,KAAK,EAAE,iBAAiB,EAAE,MAAM,EAAE,YAAY,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IAC9E,aAAa,EAAE,MAAM,CAAC;IACtB,gFAAgF;IAChF,kBAAkB,EAAE,SAAS,MAAM,EAAE,CAAC;IACtC,qBAAqB,EAAE,MAAM,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,gCAAgC,CAAC,CAAC,CAAC;IAC9F,kBAAkB,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,uBAAuB,EAAE,CAAC;IAChE,YAAY,EAAE,gBAAgB,GAAG,IAAI,CAAC;IACtC,GAAG,EAAE,MAAM,MAAM,CAAC;IAClB,MAAM,CAAC,EAAE,YAAY,CAAC;CACvB,EACD,MAAM,EAAE;IACN,SAAS,EAAE,MAAM,CAAC;IAClB,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC;IACtB,KAAK,EAAE,aAAa,CAAC;QAAE,aAAa,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,wBAAwB,CAAA;KAAE,CAAC,CAAC;CACjF,GACA,OAAO,CAAC;IAAE,OAAO,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,qBAAqB,EAAE,CAAA;CAAE,CAAC,CAoFhF"}

package/dist/src/usecases/createDeclaredSources.js

@@ -1,6 +1,39 @@
+import { realpath } from 'node:fs/promises';
+import path from 'node:path';
+import { HOST_SOURCE_KIND, sourcePlane } from '@neuralis/package-system/contracts';
+import { isPathInside } from '@neuralis/package-system/paths';
 import { applyTrustedSourceBaselines, manifestBaselineScheme } from '@neuralis/package-system/policies';
 import { buildDeclaredSourceConfig, isOwnDataZoneDeclaration } from '../services/declaredSources.js';
 import { SOURCE_BASELINE_REPAIR_VERSION } from '../services/baselineRepair.js';
+/**
+ * Does a declared in-process folder's root leave its project zone on disk? The
+ * kernel validator already keeps a declared root project-relative (no `..`, no
+ * absolute path), so the LEXICAL path stays inside; what it never sees is a
+ * symlink standing at that path. This is the route's realpath arm for the third
+ * producer: the folder's REAL path must stay inside the project zone's real
+ * path, on either plane (natively the fence's own rule; in a container the zone
+ * is still the only place a declaration may name). A root that does not exist
+ * yet cannot point anywhere and passes; no known projects root ⇒ no judgement.
+ */
+export async function declaredRootLeavesProject(config, runtimeStack, projectId) {
+    const { kind, config: connection } = config.connection;
+    if (kind !== HOST_SOURCE_KIND || sourcePlane(kind, connection) !== 'local')
+        return false;
+    const root = typeof connection.root === 'string' ? connection.root : '';
+    if (!root || !runtimeStack?.projectsRoot)
+        return false;
+    const projectRoot = path.join(runtimeStack.projectsRoot, projectId);
+    const lexical = path.resolve(projectRoot, root);
+    let real;
+    try {
+        real = await realpath(lexical);
+    }
+    catch {
+        return !isPathInside(projectRoot, lexical);
+    }
+    const realProject = await realpath(projectRoot).catch(() => projectRoot);
+    return !isPathInside(realProject, real);
+}
 export async function createMissingDeclaredSources(deps, target) {
     const { projectId, userId, existing } = target;
     let created = 0;
@@ -32,6 +65,12 @@ export async function createMissingDeclaredSources(deps, target) {
             skipped += 1;
             continue;
         }
+        if (await declaredRootLeavesProject(built, deps.runtimeStack, projectId)) {
+            const error = 'the declared folder resolves outside this project on disk';
+            failed.push({ source: decl.source, reason: 'root_outside_project', error });
+            deps.logger?.warn?.('declared-source create refused: root outside the project zone', { source: decl.source, projectId });
+            continue;
+        }
         let complete;
         try {
             const applied = applyTrustedSourceBaselines({

package/dist/src/usecases/createDeclaredSources.js.map

@@ -1 +1 @@
-{"version":3,"file":"createDeclaredSources.js","sourceRoot":"","sources":["../../../src/usecases/createDeclaredSources.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,2BAA2B,EAAE,sBAAsB,EAAE,MAAM,mCAAmC,CAAC;AAGxG,OAAO,EAAE,yBAAyB,EAAE,wBAAwB,EAAE,MAAM,gCAAgC,CAAC;AACrG,OAAO,EAAE,8BAA8B,EAAE,MAAM,+BAA+B,CAAC;AAyB/E,MAAM,CAAC,KAAK,UAAU,4BAA4B,CAChD,IAWC,EACD,MAKC;IAED,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,QAAQ,EAAE,GAAG,MAAM,CAAC;IAC/C,IAAI,OAAO,GAAG,CAAC,CAAC;IAChB,IAAI,OAAO,GAAG,CAAC,CAAC;IAChB,MAAM,MAAM,GAA4B,EAAE,CAAC;IAC3C,KAAK,MAAM,EAAE,aAAa,EAAE,IAAI,EAAE,IAAI,MAAM,CAAC,KAAK,EAAE,CAAC;QACnD,IAAI,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC;YAC9B,IAAI,CAAC;gBACH,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,EAAE,MAAM,EAAE,SAAS,EAAE,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC;gBAChF,IAAI,CAAC,MAAM;oBAAE,MAAM,IAAI,KAAK,CAAC,8BAA8B,CAAC,CAAC;gBAC7D,MAAM,IAAI,CAAC,UAAU,CAAC,EAAE,MAAM,EAAE,SAAS,EAAE,EAAE,MAAM,CAAC,CAAC;YACvD,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,aAAa,CAAC,IAAI,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;YAClC,CAAC;YACD,SAAS;QACX,CAAC;QACD,MAAM,KAAK,GAAG,yBAAyB,CAAC,IAAI,EAAE;YAC5C,SAAS;YACT,SAAS,EAAE,MAAM;YACjB,GAAG,EAAE,IAAI,CAAC,GAAG,EAAE;YACf,YAAY,EAAE,IAAI,CAAC,YAAY;YAC/B,GAAG,CAAC,wBAAwB,CAAC,aAAa,EAAE,IAAI,EAAE,IAAI,CAAC,aAAa,CAAC;gBACnE,CAAC,CAAC,EAAE,YAAY,EAAE,IAAI,CAAC,kBAAkB,EAAE;gBAC3C,CAAC,CAAC,EAAE,CAAC;SACR,CAAC,CAAC;QACH,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,OAAO,IAAI,CAAC,CAAC;YACb,SAAS;QACX,CAAC;QACD,IAAI,QAAsB,CAAC;QAC3B,IAAI,CAAC;YACH,MAAM,OAAO,GAAG,2BAA2B,CAAC;gBAC1C,WAAW,EAAE,KAAK,CAAC,WAA0D;gBAC7E,MAAM,EAAE,KAAK,CAAC,MAAM;gBACpB,kBAAkB,EAAE,IAAI,CAAC,qBAAqB,EAAE;gBAChD,eAAe,EAAE,IAAI,CAAC,kBAAkB,CAAC,KAAK,CAAC,UAAU,CAAC,IAAI,CAAC;gBAC/D,cAAc,EAAE,IAAI;aACrB,CAAC,CAAC;YACH,IAAI,CAAC,OAAO,IAAI,sBAAsB,CAAC,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC;gBACrD,MAAM,IAAI,KAAK,CAAC,sCAAsC,CAAC,CAAC;YAC1D,CAAC;YACD,QAAQ,GAAG,OAAO;gBAChB,CAAC,CAAC;oBACE,GAAG,KAAK;oBACR,WAAW,EAAE,OAAO,CAAC,WAAiD;oBACtE,qBAAqB,EAAE,8BAA8B;iBACtD;gBACH,CAAC,CAAC,KAAK,CAAC;QACZ,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,KAAK,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;YAC/D,MAAM,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,MAAM,EAAE,wBAAwB,EAAE,KAAK,EAAE,CAAC,CAAC;YAC9E,IAAI,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,oEAAoE,EAAE;gBACxF,MAAM,EAAE,IAAI,CAAC,MAAM;gBACnB,SAAS;gBACT,KAAK;aACN,CAAC,CAAC;YACH,SAAS;QACX,CAAC;QACD,IAAI,CAAC;YACH,MAAM,IAAI,CAAC,aAAa,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,SAAS,EAAE,EAAE,QAAQ,CAAC,CAAC;YACjE,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;YAC1B,OAAO,IAAI,CAAC,CAAC;QACf,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,KAAK,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;YAC/D,MAAM,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,MAAM,EAAE,cAAc,EAAE,KAAK,EAAE,CAAC,CAAC;YACpE,IAAI,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,+BAA+B,EAAE,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC,CAAC;YAChG,SAAS;QACX,CAAC;QACD,IAAI,CAAC;YAAC,MAAM,IAAI,CAAC,UAAU,CAAC,EAAE,MAAM,EAAE,SAAS,EAAE,EAAE,QAAQ,CAAC,CAAC;QAAC,CAAC;QAC/D,OAAO,GAAG,EAAE,CAAC;YAAC,aAAa,CAAC,IAAI,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;QAAC,CAAC;IAClD,CAAC;IACD,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,CAAC;IAEpC,SAAS,aAAa,CAAC,MAAc,EAAE,GAAY;QACjD,MAAM,KAAK,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QAC/D,MAAM,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,gBAAgB,EAAE,KAAK,EAAE,CAAC,CAAC;QACzD,IAAI,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,gCAAgC,EAAE,EAAE,MAAM,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC,CAAC;IACtF,CAAC;AACH,CAAC"}
+{"version":3,"file":"createDeclaredSources.js","sourceRoot":"","sources":["../../../src/usecases/createDeclaredSources.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AAC5C,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,gBAAgB,EAAE,WAAW,EAAE,MAAM,oCAAoC,CAAC;AACnF,OAAO,EAAE,YAAY,EAAyB,MAAM,gCAAgC,CAAC;AACrF,OAAO,EAAE,2BAA2B,EAAE,sBAAsB,EAAE,MAAM,mCAAmC,CAAC;AAGxG,OAAO,EAAE,yBAAyB,EAAE,wBAAwB,EAAE,MAAM,gCAAgC,CAAC;AACrG,OAAO,EAAE,8BAA8B,EAAE,MAAM,+BAA+B,CAAC;AAyB/E;;;;;;;;;GASG;AACH,MAAM,CAAC,KAAK,UAAU,yBAAyB,CAC7C,MAAwC,EACxC,YAAqC,EACrC,SAAiB;IAEjB,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,UAAU,EAAE,GAAG,MAAM,CAAC,UAAU,CAAC;IACvD,IAAI,IAAI,KAAK,gBAAgB,IAAI,WAAW,CAAC,IAAI,EAAE,UAAU,CAAC,KAAK,OAAO;QAAE,OAAO,KAAK,CAAC;IACzF,MAAM,IAAI,GAAG,OAAO,UAAU,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC;IACxE,IAAI,CAAC,IAAI,IAAI,CAAC,YAAY,EAAE,YAAY;QAAE,OAAO,KAAK,CAAC;IACvD,MAAM,WAAW,GAAG,IAAI,CAAC,IAAI,CAAC,YAAY,CAAC,YAAY,EAAE,SAAS,CAAC,CAAC;IACpE,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC,WAAW,EAAE,IAAI,CAAC,CAAC;IAChD,IAAI,IAAY,CAAC;IACjB,IAAI,CAAC;QACH,IAAI,GAAG,MAAM,QAAQ,CAAC,OAAO,CAAC,CAAC;IACjC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,CAAC,YAAY,CAAC,WAAW,EAAE,OAAO,CAAC,CAAC;IAC7C,CAAC;IACD,MAAM,WAAW,GAAG,MAAM,QAAQ,CAAC,WAAW,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,WAAW,CAAC,CAAC;IACzE,OAAO,CAAC,YAAY,CAAC,WAAW,EAAE,IAAI,CAAC,CAAC;AAC1C,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,4BAA4B,CAChD,IAWC,EACD,MAKC;IAED,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,QAAQ,EAAE,GAAG,MAAM,CAAC;IAC/C,IAAI,OAAO,GAAG,CAAC,CAAC;IAChB,IAAI,OAAO,GAAG,CAAC,CAAC;IAChB,MAAM,MAAM,GAA4B,EAAE,CAAC;IAC3C,KAAK,MAAM,EAAE,aAAa,EAAE,IAAI,EAAE,IAAI,MAAM,CAAC,KAAK,EAAE,CAAC;QACnD,IAAI,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC;YAC9B,IAAI,CAAC;gBACH,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,EAAE,MAAM,EAAE,SAAS,EAAE,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC;gBAChF,IAAI,CAAC,MAAM;oBAAE,MAAM,IAAI,KAAK,CAAC,8BAA8B,CAAC,CAAC;gBAC7D,MAAM,IAAI,CAAC,UAAU,CAAC,EAAE,MAAM,EAAE,SAAS,EAAE,EAAE,MAAM,CAAC,CAAC;YACvD,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,aAAa,CAAC,IAAI,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;YAClC,CAAC;YACD,SAAS;QACX,CAAC;QACD,MAAM,KAAK,GAAG,yBAAyB,CAAC,IAAI,EAAE;YAC5C,SAAS;YACT,SAAS,EAAE,MAAM;YACjB,GAAG,EAAE,IAAI,CAAC,GAAG,EAAE;YACf,YAAY,EAAE,IAAI,CAAC,YAAY;YAC/B,GAAG,CAAC,wBAAwB,CAAC,aAAa,EAAE,IAAI,EAAE,IAAI,CAAC,aAAa,CAAC;gBACnE,CAAC,CAAC,EAAE,YAAY,EAAE,IAAI,CAAC,kBAAkB,EAAE;gBAC3C,CAAC,CAAC,EAAE,CAAC;SACR,CAAC,CAAC;QACH,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,OAAO,IAAI,CAAC,CAAC;YACb,SAAS;QACX,CAAC;QACD,IAAI,MAAM,yBAAyB,CAAC,KAAK,EAAE,IAAI,CAAC,YAAY,EAAE,SAAS,CAAC,EAAE,CAAC;YACzE,MAAM,KAAK,GAAG,2DAA2D,CAAC;YAC1E,MAAM,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,MAAM,EAAE,sBAAsB,EAAE,KAAK,EAAE,CAAC,CAAC;YAC5E,IAAI,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,+DAA+D,EAAE,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,SAAS,EAAE,CAAC,CAAC;YACzH,SAAS;QACX,CAAC;QACD,IAAI,QAAsB,CAAC;QAC3B,IAAI,CAAC;YACH,MAAM,OAAO,GAAG,2BAA2B,CAAC;gBAC1C,WAAW,EAAE,KAAK,CAAC,WAA0D;gBAC7E,MAAM,EAAE,KAAK,CAAC,MAAM;gBACpB,kBAAkB,EAAE,IAAI,CAAC,qBAAqB,EAAE;gBAChD,eAAe,EAAE,IAAI,CAAC,kBAAkB,CAAC,KAAK,CAAC,UAAU,CAAC,IAAI,CAAC;gBAC/D,cAAc,EAAE,IAAI;aACrB,CAAC,CAAC;YACH,IAAI,CAAC,OAAO,IAAI,sBAAsB,CAAC,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC;gBACrD,MAAM,IAAI,KAAK,CAAC,sCAAsC,CAAC,CAAC;YAC1D,CAAC;YACD,QAAQ,GAAG,OAAO;gBAChB,CAAC,CAAC;oBACE,GAAG,KAAK;oBACR,WAAW,EAAE,OAAO,CAAC,WAAiD;oBACtE,qBAAqB,EAAE,8BAA8B;iBACtD;gBACH,CAAC,CAAC,KAAK,CAAC;QACZ,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,KAAK,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;YAC/D,MAAM,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,MAAM,EAAE,wBAAwB,EAAE,KAAK,EAAE,CAAC,CAAC;YAC9E,IAAI,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,oEAAoE,EAAE;gBACxF,MAAM,EAAE,IAAI,CAAC,MAAM;gBACnB,SAAS;gBACT,KAAK;aACN,CAAC,CAAC;YACH,SAAS;QACX,CAAC;QACD,IAAI,CAAC;YACH,MAAM,IAAI,CAAC,aAAa,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,SAAS,EAAE,EAAE,QAAQ,CAAC,CAAC;YACjE,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;YAC1B,OAAO,IAAI,CAAC,CAAC;QACf,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,KAAK,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;YAC/D,MAAM,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,MAAM,EAAE,cAAc,EAAE,KAAK,EAAE,CAAC,CAAC;YACpE,IAAI,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,+BAA+B,EAAE,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC,CAAC;YAChG,SAAS;QACX,CAAC;QACD,IAAI,CAAC;YAAC,MAAM,IAAI,CAAC,UAAU,CAAC,EAAE,MAAM,EAAE,SAAS,EAAE,EAAE,QAAQ,CAAC,CAAC;QAAC,CAAC;QAC/D,OAAO,GAAG,EAAE,CAAC;YAAC,aAAa,CAAC,IAAI,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;QAAC,CAAC;IAClD,CAAC;IACD,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,CAAC;IAEpC,SAAS,aAAa,CAAC,MAAc,EAAE,GAAY;QACjD,MAAM,KAAK,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QAC/D,MAAM,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,gBAAgB,EAAE,KAAK,EAAE,CAAC,CAAC;QACzD,IAAI,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,gCAAgC,EAAE,EAAE,MAAM,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC,CAAC;IACtF,CAAC;AACH,CAAC"}

package/dist/src/usecases/deprovisionProject.d.ts

@@ -7,14 +7,13 @@
  * the purge before its own destructive steps (the project stays archived and the
  * purge can be retried — the filter matches nothing the second time).
  *
- * A degraded boot is refused too: when Qdrant is configured but brain-core fell
- * back to the in-memory index, a delete would succeed on the in-memory copy and
- * leave every real point in Qdrant — the one outcome the permanent delete must
- * not report as done.
+ * An unavailable vector store is such a failure: the shared index refuses with
+ * `VectorStoreUnavailableError` (no network call), so the purge stops here and
+ * is retried once the store is back.
  */
 import type { DeprovisionProjectContext } from '@neuralis/package-system/contracts';
 import type { BrainCoreState } from '../lifecycle.js';
-export type DeprovisionProjectDeps = Pick<BrainCoreState, 'infraFactory' | 'vectorBackend' | 'syncQueue'> & {
+export type DeprovisionProjectDeps = Pick<BrainCoreState, 'infraFactory' | 'syncQueue'> & {
     syncLogger: Pick<BrainCoreState['syncLogger'], 'info'>;
 };
 export declare function deprovisionProject(deps: DeprovisionProjectDeps, ctx: DeprovisionProjectContext): Promise<{

package/dist/src/usecases/deprovisionProject.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"deprovisionProject.d.ts","sourceRoot":"","sources":["../../../src/usecases/deprovisionProject.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAEH,OAAO,KAAK,EAAE,yBAAyB,EAAE,MAAM,oCAAoC,CAAC;AACpF,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,iBAAiB,CAAC;AAGtD,MAAM,MAAM,sBAAsB,GAAG,IAAI,CAAC,cAAc,EAAE,cAAc,GAAG,eAAe,GAAG,WAAW,CAAC,GAAG;IAC1G,UAAU,EAAE,IAAI,CAAC,cAAc,CAAC,YAAY,CAAC,EAAE,MAAM,CAAC,CAAC;CACxD,CAAC;AAEF,wBAAsB,kBAAkB,CACtC,IAAI,EAAE,sBAAsB,EAC5B,GAAG,EAAE,yBAAyB,GAC7B,OAAO,CAAC;IAAE,aAAa,EAAE,MAAM,CAAA;CAAE,CAAC,CAepC"}
+{"version":3,"file":"deprovisionProject.d.ts","sourceRoot":"","sources":["../../../src/usecases/deprovisionProject.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH,OAAO,KAAK,EAAE,yBAAyB,EAAE,MAAM,oCAAoC,CAAC;AACpF,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,iBAAiB,CAAC;AAEtD,MAAM,MAAM,sBAAsB,GAAG,IAAI,CAAC,cAAc,EAAE,cAAc,GAAG,WAAW,CAAC,GAAG;IACxF,UAAU,EAAE,IAAI,CAAC,cAAc,CAAC,YAAY,CAAC,EAAE,MAAM,CAAC,CAAC;CACxD,CAAC;AAEF,wBAAsB,kBAAkB,CACtC,IAAI,EAAE,sBAAsB,EAC5B,GAAG,EAAE,yBAAyB,GAC7B,OAAO,CAAC;IAAE,aAAa,EAAE,MAAM,CAAA;CAAE,CAAC,CAYpC"}

package/dist/src/usecases/deprovisionProject.js

@@ -7,16 +7,11 @@
  * the purge before its own destructive steps (the project stays archived and the
  * purge can be retried — the filter matches nothing the second time).
  *
- * A degraded boot is refused too: when Qdrant is configured but brain-core fell
- * back to the in-memory index, a delete would succeed on the in-memory copy and
- * leave every real point in Qdrant — the one outcome the permanent delete must
- * not report as done.
+ * An unavailable vector store is such a failure: the shared index refuses with
+ * `VectorStoreUnavailableError` (no network call), so the purge stops here and
+ * is retried once the store is back.
  */
-import { inferInfraModeFromEnv } from '../wiring.js';
 export async function deprovisionProject(deps, ctx) {
-    if (deps.vectorBackend === 'inmemory' && inferInfraModeFromEnv(process.env) !== 'inmemory') {
-        throw new Error('vector index degraded (Qdrant configured, in-memory fallback wired) — restart to purge vectors');
-    }
     return deps.syncQueue.withProjectDrained(ctx.projectId, async () => {
         const infra = await deps.infraFactory.getInfra(ctx.projectId);
         const pointsRemoved = await infra.vector.deleteByFilter({

package/dist/src/usecases/deprovisionProject.js.map

@@ -1 +1 @@
-{"version":3,"file":"deprovisionProject.js","sourceRoot":"","sources":["../../../src/usecases/deprovisionProject.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAIH,OAAO,EAAE,qBAAqB,EAAE,MAAM,cAAc,CAAC;AAMrD,MAAM,CAAC,KAAK,UAAU,kBAAkB,CACtC,IAA4B,EAC5B,GAA8B;IAE9B,IAAI,IAAI,CAAC,aAAa,KAAK,UAAU,IAAI,qBAAqB,CAAC,OAAO,CAAC,GAAG,CAAC,KAAK,UAAU,EAAE,CAAC;QAC3F,MAAM,IAAI,KAAK,CAAC,gGAAgG,CAAC,CAAC;IACpH,CAAC;IACD,OAAO,IAAI,CAAC,SAAS,CAAC,kBAAkB,CAAC,GAAG,CAAC,SAAS,EAAE,KAAK,IAAI,EAAE;QACjE,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,QAAQ,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;QAC9D,MAAM,aAAa,GAAG,MAAM,KAAK,CAAC,MAAM,CAAC,cAAc,CAAC;YACtD,IAAI,EAAE,CAAC,EAAE,KAAK,EAAE,WAAW,EAAE,MAAM,EAAE,GAAG,CAAC,SAAS,EAAE,CAAC;SACtD,CAAC,CAAC;QACH,2EAA2E;QAC3E,6EAA6E;QAC7E,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;QAC5C,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,+CAA+C,EAAE,EAAE,SAAS,EAAE,GAAG,CAAC,SAAS,EAAE,aAAa,EAAE,CAAC,CAAC;QACnH,OAAO,EAAE,aAAa,EAAE,CAAC;IAC3B,CAAC,CAAC,CAAC;AACL,CAAC"}
+{"version":3,"file":"deprovisionProject.js","sourceRoot":"","sources":["../../../src/usecases/deprovisionProject.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AASH,MAAM,CAAC,KAAK,UAAU,kBAAkB,CACtC,IAA4B,EAC5B,GAA8B;IAE9B,OAAO,IAAI,CAAC,SAAS,CAAC,kBAAkB,CAAC,GAAG,CAAC,SAAS,EAAE,KAAK,IAAI,EAAE;QACjE,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,QAAQ,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;QAC9D,MAAM,aAAa,GAAG,MAAM,KAAK,CAAC,MAAM,CAAC,cAAc,CAAC;YACtD,IAAI,EAAE,CAAC,EAAE,KAAK,EAAE,WAAW,EAAE,MAAM,EAAE,GAAG,CAAC,SAAS,EAAE,CAAC;SACtD,CAAC,CAAC;QACH,2EAA2E;QAC3E,6EAA6E;QAC7E,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;QAC5C,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,+CAA+C,EAAE,EAAE,SAAS,EAAE,GAAG,CAAC,SAAS,EAAE,aAAa,EAAE,CAAC,CAAC;QACnH,OAAO,EAAE,aAAa,EAAE,CAAC;IAC3B,CAAC,CAAC,CAAC;AACL,CAAC"}

package/dist/src/usecases/list.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"list.d.ts","sourceRoot":"","sources":["../../../src/usecases/list.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,+BAA+B,CAAC;AAMtE,OAAO,KAAK,EACV,cAAc,EAEd,iBAAiB,EACjB,kBAAkB,EAEnB,MAAM,oBAAoB,CAAC;AAC5B,OAAO,KAAK,EAAE,eAAe,EAAgB,MAAM,oBAAoB,CAAC;AACxE,OAAO,EAA4B,KAAK,aAAa,EAAE,MAAM,oCAAoC,CAAC;AAuClG,iFAAiF;AACjF,wBAAgB,eAAe,IAAI,MAAM,CAExC;AACD,kFAAkF;AAClF,wBAAgB,iBAAiB,IAAI,MAAM,CAE1C;AACD,qFAAqF;AACrF,wBAAgB,oBAAoB,IAAI,MAAM,CAE7C;AACD,0EAA0E;AAC1E,wBAAgB,cAAc,IAAI,MAAM,CAEvC;AAaD,wBAAgB,iBAAiB,IAAI,MAAM,CAE1C;AAED;;;;GAIG;AACH,wBAAsB,kBAAkB,CAAC,CAAC,EAAE,CAAC,EAC3C,KAAK,EAAE,SAAS,CAAC,EAAE,EACnB,KAAK,EAAE,MAAM,EACb,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,EAAE,KAAK,EAAE,MAAM,KAAK,OAAO,CAAC,CAAC,CAAC,GAC7C,OAAO,CAAC,CAAC,EAAE,CAAC,CAed;AAkFD,MAAM,MAAM,QAAQ,GAAG;IACrB,MAAM,EAAE,eAAe,CAAC,cAAc,CAAC,CAAC;IACxC,gEAAgE;IAChE,UAAU,CAAC,EAAE,GAAG,CAAC,MAAM,EAAE,aAAa,CAAC,CAAC;IACxC;;;;;;;;OAQG;IACH,gBAAgB,CAAC,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC;IAC/B;;;;;;OAMG;IACH,UAAU,CAAC,EAAE,GAAG,CAAC,MAAM,EAAE;QAAE,YAAY,EAAE,MAAM,EAAE,CAAC;QAAC,YAAY,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAC3E;;;OAGG;IACH,MAAM,CAAC,EAAE;QAAE,IAAI,EAAE,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAAK,IAAI,CAAA;KAAE,CAAC;CAC1E,CAAC;AAKF;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,wBAAsB,WAAW,CAC/B,IAAI,EAAE,QAAQ,EACd,GAAG,EAAE,gBAAgB,EACrB,GAAG,EAAE,iBAAiB,GACrB,OAAO,CAAC,kBAAkB,CAAC,CAqkB7B;AA4VD;;;;;;;;GAQG;AACH,wBAAgB,iBAAiB,CAAC,GAAG,EAAE,OAAO,GAAG,MAAM,CAetD"}
+{"version":3,"file":"list.d.ts","sourceRoot":"","sources":["../../../src/usecases/list.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,+BAA+B,CAAC;AAMtE,OAAO,KAAK,EACV,cAAc,EAEd,iBAAiB,EACjB,kBAAkB,EAEnB,MAAM,oBAAoB,CAAC;AAC5B,OAAO,KAAK,EAAE,eAAe,EAAgB,MAAM,oBAAoB,CAAC;AACxE,OAAO,EAA4B,KAAK,aAAa,EAAE,MAAM,oCAAoC,CAAC;AA0ClG,iFAAiF;AACjF,wBAAgB,eAAe,IAAI,MAAM,CAExC;AACD,kFAAkF;AAClF,wBAAgB,iBAAiB,IAAI,MAAM,CAE1C;AACD,qFAAqF;AACrF,wBAAgB,oBAAoB,IAAI,MAAM,CAE7C;AACD,0EAA0E;AAC1E,wBAAgB,cAAc,IAAI,MAAM,CAEvC;AAaD,wBAAgB,iBAAiB,IAAI,MAAM,CAE1C;AAED;;;;GAIG;AACH,wBAAsB,kBAAkB,CAAC,CAAC,EAAE,CAAC,EAC3C,KAAK,EAAE,SAAS,CAAC,EAAE,EACnB,KAAK,EAAE,MAAM,EACb,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,EAAE,KAAK,EAAE,MAAM,KAAK,OAAO,CAAC,CAAC,CAAC,GAC7C,OAAO,CAAC,CAAC,EAAE,CAAC,CAed;AAkFD,MAAM,MAAM,QAAQ,GAAG;IACrB,MAAM,EAAE,eAAe,CAAC,cAAc,CAAC,CAAC;IACxC,gEAAgE;IAChE,UAAU,CAAC,EAAE,GAAG,CAAC,MAAM,EAAE,aAAa,CAAC,CAAC;IACxC;;;;;;;;OAQG;IACH,gBAAgB,CAAC,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC;IAC/B;;;;;;OAMG;IACH,UAAU,CAAC,EAAE,GAAG,CAAC,MAAM,EAAE;QAAE,YAAY,EAAE,MAAM,EAAE,CAAC;QAAC,YAAY,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAC3E;;;OAGG;IACH,MAAM,CAAC,EAAE;QAAE,IAAI,EAAE,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAAK,IAAI,CAAA;KAAE,CAAC;CAC1E,CAAC;AAKF;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,wBAAsB,WAAW,CAC/B,IAAI,EAAE,QAAQ,EACd,GAAG,EAAE,gBAAgB,EACrB,GAAG,EAAE,iBAAiB,GACrB,OAAO,CAAC,kBAAkB,CAAC,CA0kB7B;AAsZD;;;;;;;;GAQG;AACH,wBAAgB,iBAAiB,CAAC,GAAG,EAAE,OAAO,GAAG,MAAM,CAetD"}

package/dist/src/usecases/list.js

@@ -5,6 +5,7 @@ import { extractIndexText } from '../domain/text.js';
 import { containsAbsolutePath } from '../domain/paths.js';
 import { ConnectorRootAccessError } from '@neuralis/package-system/contracts';
 import { getBrainConfigNumber } from '../config/env.js';
+import { HostConnector } from '../connectors/HostConnector.js';
 /** Internal summary budget for inline content attachments (see `summary_chars`). */
 const SUMMARY_BUDGET_CHARS = 40_000;
 /** Unindexed-file preview: max file size to read from connector. */
@@ -34,6 +35,8 @@ const MAX_FOLDER_ENRICH_PAGES_DEFAULT = 6;
  * filesystem/network walks as the project has sources.
  */
 const CONNECTOR_CONCURRENCY_DEFAULT = 4;
+/** The host's `routeSlowMs` default: the registry's per-source line follows the route's slow line. */
+const ROUTE_SLOW_MS_DEFAULT = 1_000;
 /**
  * Default cap on CONCURRENT git probes. Lower than the connector cap on purpose —
  * each one is a child PROCESS, not an I/O handle.
@@ -391,7 +394,12 @@ export async function listUseCase(deps, ctx, req) {
                 // fall back (D-5) to the source's indexed slice as `stale_indexed`
                 // ("indexed but the live connector is unavailable") so a Docker host-pair
                 // miss still shows what is indexed instead of an empty drive.
-                out.error = describeWalkError(err);
+                // A device folder whose plane is down names it by the listing's own
+                // `live_reason` (the same probe), so `last_error` and `live_reason`
+                // agree; a refusal keeps its own sentence. A probe that throws leaves
+                // the walk's own description — the warn below logs the error either way.
+                const unavailable = connector instanceof HostConnector ? await connector.unavailable(err).catch(() => undefined) : undefined;
+                out.error = unavailable && 'live' in unavailable ? unavailable.reason : describeWalkError(err);
                 const raw = err;
                 deps.logger?.warn('list: source walk failed', {
                     source,
@@ -971,10 +979,16 @@ function computePerSourceLimit(connectors, budget, scopeSource) {
  * With `includeCounts:false` the expensive count walk (`countByFilter` +
  * `connector.count`) is skipped entirely; `on_disk` is still filled when the
  * peekCount cache happens to be warm.
+ *
+ * The sources are probed CONCURRENTLY (at most `connectorConcurrency()` at once,
+ * the listing's own walk cap) and reported in their input order, each with its
+ * own error: the wall time is the slowest walks', never their sum. A registry
+ * that took at least the route slow threshold (`routeSlowMs`) logs one line with
+ * each source's milliseconds, beside the route's own slow line.
  */
 async function computeSourcesRegistry(params) {
     const { deps, ctx, scopeSource, scopeUri, onlyIndexed, includeCounts, qdrantError, connectorErrors } = params;
-    const entries = [];
+    const startedAt = Date.now();
     const sourcesToReport = new Set();
     if (scopeSource) {
         sourcesToReport.add(scopeSource);
@@ -986,22 +1000,50 @@ async function computeSourcesRegistry(params) {
                 sourcesToReport.add(source);
         }
     }
-    for (const source of sourcesToReport) {
+    const deferred = [];
+    const probed = await mapWithConcurrency([...sourcesToReport], connectorConcurrency(), async (source) => {
+        const sourceStartedAt = Date.now();
+        const entry = await probeSourceEntry(source);
+        return { source, entry, ms: Date.now() - sourceStartedAt };
+    });
+    if (deferred.length > 0) {
+        // The SAME cap as the probes: at most `connectorConcurrency()` walks in
+        // flight. A cached, stale or remembered answer frees its slot in the same
+        // turn, so only real walks queue; whatever has not settled after one turn
+        // stays uncounted and a later call shows it (one walk per key — the
+        // connector's single-flight). Never awaited: one slow device must not hold
+        // the whole list.
+        void mapWithConcurrency(deferred, connectorConcurrency(), async (job) => {
+            job.outcome = await job.run().then((value) => ({ ok: true, value }), (error) => ({ ok: false, error }));
+        });
+        await new Promise((resolve) => { setImmediate(resolve); });
+        for (const job of deferred)
+            if (job.outcome)
+                applyCount(job.entry, job.source, job.scan, job.outcome);
+    }
+    const ms = Date.now() - startedAt;
+    const slowMs = getBrainConfigNumber('routeSlowMs', undefined, ROUTE_SLOW_MS_DEFAULT);
+    if (includeCounts && ms >= slowMs) {
+        deps.logger?.warn('list: source registry slow', {
+            ms,
+            concurrency: connectorConcurrency(),
+            sources: Object.fromEntries(probed.map((p) => [p.source, p.ms])),
+        });
+    }
+    return probed.map((p) => p.entry);
+    async function probeSourceEntry(source) {
         const uriRoot = `${source}://`;
         const connector = deps.connectors?.get(source);
-        const source_kind = source === 'brain'
-            ? 'brain'
-            : connector?.kind === 'local' ? 'local-disk' : (connector?.kind ?? 'unknown');
+        const source_kind = source === 'brain' ? 'brain' : (connector?.kind ?? 'unknown');
         const entry = { uri_root: uriRoot, source_kind };
         // Per-source connector-walk failure (Phase 2 isolation): surface the error
         // on this source row and skip the count probes — they would only re-hit the
-        // same broken connector. Other sources are unaffected.
+        // same broken connector. Other sources are unaffected. `last_error` only:
+        // `sync_status` is the SYNC's state, which a failed walk says nothing about.
         const connectorError = connectorErrors.get(source);
         if (connectorError) {
             entry.last_error = connectorError;
-            entry.sync_status = 'error';
-            entries.push(entry);
-            continue;
+            return entry;
         }
         // Exact indexed count via Qdrant count endpoint. Count-gated — this REST
         // round-trip per source is part of the cost we make opt-in.
@@ -1037,35 +1079,50 @@ async function computeSourcesRegistry(params) {
                 ? { excludeGlobs: scan.excludeGlobs, maxScanFiles: scan.maxScanFiles }
                 : undefined;
             const cached = connector.peekCount?.(countKey, countOpts);
+            const count = connector.count?.bind(connector);
             if (typeof cached === 'number') {
-                entry.on_disk = cached;
+                applyCount(entry, source, scan, { ok: true, value: cached });
             }
-            else if (includeCounts && connector.count) {
-                try {
-                    entry.on_disk = await connector.count(countKey, countOpts);
+            else if (includeCounts && count) {
+                // A ONE-source listing (and a connector with no count cache) waits for
+                // its walk; the every-source registry defers it (see `deferred`).
+                if (scopeSource || !connector.peekCount) {
+                    applyCount(entry, source, scan, await count(countKey, countOpts).then((value) => ({ ok: true, value }), (error) => ({ ok: false, error })));
                 }
-                catch (err) {
-                    const message = err instanceof Error ? err.message : 'connector count failed';
-                    entry.last_error = entry.last_error ?? message;
-                    entry.sync_status = 'error';
+                else {
+                    deferred.push({ source, entry, scan, run: () => count(countKey, countOpts) });
                 }
             }
+        }
+        else {
+            applyCount(entry, source, undefined, undefined);
+        }
+        // Surface qdrant-wide errors on the brain entry so the status has a home.
+        if (source === 'brain' && qdrantError && !entry.last_error) {
+            entry.last_error = qdrantError;
+        }
+        return entry;
+    }
+    /** A count's answer onto its row: the total (`N+` at the cap) and `unindexed`, or the failure as a code. */
+    function applyCount(entry, source, scan, outcome) {
+        if (outcome?.ok) {
+            entry.on_disk = outcome.value;
             // The count stopped at the cap ⇒ `on_disk` is a floor; flag it so the UI
             // renders `N+` instead of presenting the cap value as the true total.
-            if (scan && typeof entry.on_disk === 'number' && entry.on_disk >= scan.maxScanFiles) {
+            if (scan && outcome.value >= scan.maxScanFiles)
                 entry.truncated = true;
-            }
+        }
+        else if (outcome) {
+            const err = outcome.error;
+            // Member-facing, like the walk's: a code, never a path (security invariant 9).
+            // `last_error` only — a failed COUNT is not a sync error.
+            entry.last_error = entry.last_error ?? describeWalkError(err);
+            deps.logger?.warn('list: source count failed', { source, error: err instanceof Error ? err.message : String(err) });
         }
         if (typeof entry.on_disk === 'number' && typeof entry.indexed_count === 'number') {
             entry.unindexed = Math.max(0, entry.on_disk - entry.indexed_count);
         }
-        // Surface qdrant-wide errors on the brain entry so the status has a home.
-        if (source === 'brain' && qdrantError && !entry.last_error) {
-            entry.last_error = qdrantError;
-        }
-        entries.push(entry);
     }
-    return entries;
 }
 /**
  * The per-source walk failure as it reaches `last_error` — a member-facing field