@nklisch/pi-enhanced 0.1.0

package/node_modules/@nklisch/pi-plugins/dist/infrastructure/project/node-project-intent-file.js

@@ -0,0 +1,314 @@
+import { constants } from "node:fs";
+import { link, lstat, mkdir, open, readdir, realpath, unlink } from "node:fs/promises";
+import { resolve } from "node:path";
+import { hashContent } from "../../domain/content-manifest.js";
+import { NativeLifecycleOperationSessionPolicy } from "../../application/native-lifecycle-operation-contract.js";
+import { deriveProjectIntentObservationId } from "../../application/native-lifecycle-operation-identifiers.js";
+import { decodeProjectIntentBytes, encodeProjectIntentDeclaration } from "../../application/project-intent-codec.js";
+import { ProjectIntentWriteIdSchema } from "../../application/ports/project-intent-write-id.js";
+import { revalidateTrustedProjectRoot } from "./node-project-path-authority.js";
+const FILE = "plugins.json";
+const DIRECTORY = ".pi";
+const TEMP_PREFIX = ".plugins.json.project-intent-write-v1-";
+const TEMP_SUFFIX = ".tmp";
+class FileAuthorityError extends Error {
+    code;
+    constructor(code) {
+        super(code);
+        this.code = code;
+    }
+}
+function directoryIdentity(stats) {
+    return Object.freeze({ device: String(stats.dev), inode: String(stats.ino) });
+}
+function fileIdentity(stats) {
+    return Object.freeze({ device: String(stats.dev), inode: String(stats.ino), size: Number(stats.size) });
+}
+function same(left, right) { return JSON.stringify(left) === JSON.stringify(right); }
+async function readBounded(handle, size, signal) {
+    if (size > NativeLifecycleOperationSessionPolicy.maxProjectIntentBytes)
+        throw new FileAuthorityError("FILE_TOO_LARGE");
+    const output = new Uint8Array(size);
+    let offset = 0;
+    while (offset < size) {
+        signal.throwIfAborted();
+        const result = await handle.read(output, offset, size - offset, offset);
+        if (result.bytesRead === 0)
+            break;
+        offset += result.bytesRead;
+    }
+    if (offset !== size)
+        throw new FileAuthorityError("FILE_UNSAFE");
+    const extra = new Uint8Array(1);
+    if ((await handle.read(extra, 0, 1, size)).bytesRead !== 0)
+        throw new FileAuthorityError("FILE_TOO_LARGE");
+    return output;
+}
+async function syncDirectory(path) {
+    const handle = await open(path, constants.O_RDONLY | (constants.O_DIRECTORY ?? 0));
+    try {
+        await handle.sync();
+    }
+    finally {
+        await handle.close();
+    }
+}
+export function createNodeProjectIntentFilePort(input) {
+    if (input === null || typeof input !== "object" || typeof input.sha256 !== "function")
+        throw new TypeError("project intent file dependencies are required");
+    const observations = new WeakMap();
+    function issue(evidence) {
+        const observation = Object.freeze({ publicId: deriveProjectIntentObservationId(evidence, input.sha256) });
+        observations.set(observation, evidence);
+        return observation;
+    }
+    async function inspect(root, signal) {
+        let authority;
+        try {
+            authority = await revalidateTrustedProjectRoot(root, input.projectRoots, signal);
+        }
+        catch (error) {
+            if (signal.aborted)
+                throw signal.reason ?? error;
+            throw new FileAuthorityError("PROJECT_ROOT_STALE");
+        }
+        const rootIdentity = Object.freeze({ device: authority.device, inode: authority.inode });
+        const parentPath = resolve(authority.path, DIRECTORY);
+        const leafPath = resolve(parentPath, FILE);
+        let parentStats;
+        try {
+            parentStats = await lstat(parentPath);
+        }
+        catch (error) {
+            if (error.code === "ENOENT") {
+                return { rootPath: authority.path, parentPath, leafPath, evidence: Object.freeze({ root: rootIdentity, parent: { kind: "missing" }, leaf: { kind: "missing" } }) };
+            }
+            throw error;
+        }
+        if (!parentStats.isDirectory() || parentStats.isSymbolicLink() || await realpath(parentPath) !== parentPath)
+            throw new FileAuthorityError("FILE_UNSAFE");
+        const parentIdentity = directoryIdentity(parentStats);
+        let handle;
+        try {
+            handle = await open(leafPath, constants.O_RDONLY | constants.O_NOFOLLOW);
+        }
+        catch (error) {
+            const code = error.code;
+            if (code === "ENOENT")
+                return { rootPath: authority.path, parentPath, leafPath, evidence: Object.freeze({ root: rootIdentity, parent: { kind: "found", identity: parentIdentity }, leaf: { kind: "missing" } }) };
+            if (code === "ELOOP")
+                throw new FileAuthorityError("FILE_UNSAFE");
+            throw error;
+        }
+        try {
+            const before = await handle.stat();
+            if (!before.isFile() || before.isSymbolicLink())
+                throw new FileAuthorityError("FILE_UNSAFE");
+            const bytes = await readBounded(handle, before.size, signal);
+            const after = await handle.stat();
+            const pathAfter = await lstat(leafPath);
+            if (!after.isFile() || pathAfter.isSymbolicLink() || !pathAfter.isFile() || !same(fileIdentity(before), fileIdentity(after)) || !same(fileIdentity(after), fileIdentity(pathAfter)))
+                throw new FileAuthorityError("FILE_UNSAFE");
+            const decoded = decodeProjectIntentBytes(bytes, input.sha256);
+            if (decoded.kind === "invalid")
+                throw new FileAuthorityError(decoded.code);
+            const rawDigest = hashContent(bytes, input.sha256);
+            const evidence = Object.freeze({
+                root: rootIdentity,
+                parent: { kind: "found", identity: parentIdentity },
+                leaf: { kind: "found", identity: fileIdentity(after), rawDigest },
+                declarationDigest: decoded.digest,
+            });
+            return { rootPath: authority.path, parentPath, leafPath, evidence, declaration: decoded.declaration, digest: decoded.digest };
+        }
+        finally {
+            await handle.close();
+        }
+    }
+    async function read(root, signal) {
+        signal.throwIfAborted();
+        try {
+            const value = await inspect(root, signal);
+            const observation = issue(value.evidence);
+            return value.declaration === undefined
+                ? { kind: "missing", observation }
+                : { kind: "found", observation, declaration: value.declaration, digest: value.digest };
+        }
+        catch (error) {
+            if (signal.aborted)
+                throw signal.reason ?? error;
+            return { kind: "unavailable", code: error instanceof FileAuthorityError ? error.code : "ADAPTER_FAILED" };
+        }
+    }
+    async function replace(request, signal) {
+        signal.throwIfAborted();
+        const expected = observations.get(request.expected);
+        if (expected === undefined)
+            return { kind: "stale" };
+        let encoded;
+        try {
+            encoded = encodeProjectIntentDeclaration(request.declaration, input.sha256);
+        }
+        catch {
+            return { kind: "stale" };
+        }
+        const writeId = ProjectIntentWriteIdSchema.parse(request.writeId);
+        let current;
+        try {
+            current = await inspect(request.root, signal);
+        }
+        catch (error) {
+            if (signal.aborted)
+                throw signal.reason ?? error;
+            return { kind: "stale" };
+        }
+        if (!same(current.evidence, expected))
+            return { kind: "stale" };
+        if (current.digest === encoded.digest)
+            return { kind: "unchanged", observation: issue(current.evidence), digest: encoded.digest };
+        // Node exposes no conditional replacement primitive for an existing leaf.
+        // Check-then-rename would overwrite an editor save, so fail capability-closed.
+        if (current.evidence.leaf.kind === "found")
+            return { kind: "unavailable", code: "PROJECT_INTENT_WRITE_UNAVAILABLE" };
+        let parentIdentity;
+        if (current.evidence.parent.kind === "missing") {
+            try {
+                await mkdir(current.parentPath, { mode: 0o700 });
+            }
+            catch (error) {
+                return error.code === "EEXIST" ? { kind: "stale" } : { kind: "unavailable", code: "PROJECT_INTENT_WRITE_UNAVAILABLE" };
+            }
+            try {
+                await syncDirectory(current.rootPath);
+            }
+            catch {
+                return { kind: "ambiguous", expectedDigest: encoded.digest };
+            }
+            const parent = await lstat(current.parentPath).catch(() => undefined);
+            if (parent === undefined || !parent.isDirectory() || parent.isSymbolicLink() || await realpath(current.parentPath).catch(() => undefined) !== current.parentPath)
+                return { kind: "stale" };
+            parentIdentity = directoryIdentity(parent);
+        }
+        else {
+            parentIdentity = current.evidence.parent.identity;
+        }
+        const publicationEvidence = Object.freeze({
+            root: current.evidence.root,
+            parent: { kind: "found", identity: parentIdentity },
+            leaf: { kind: "missing" },
+        });
+        const safeId = writeId.slice("project-intent-write-v1:".length);
+        const tempPath = resolve(current.parentPath, `${TEMP_PREFIX}${safeId}${TEMP_SUFFIX}`);
+        const probePath = resolve(current.parentPath, `${TEMP_PREFIX}${safeId}.probe${TEMP_SUFFIX}`);
+        let temp;
+        try {
+            temp = await open(tempPath, constants.O_CREAT | constants.O_EXCL | constants.O_WRONLY | constants.O_NOFOLLOW, 0o600);
+            await temp.writeFile(encoded.bytes);
+            await temp.sync();
+            await temp.close();
+            temp = undefined;
+            const beforePublish = await inspect(request.root, signal);
+            if (!same(beforePublish.evidence, publicationEvidence))
+                return { kind: "stale" };
+            // Hard-link creation is the available platform CAS: the kernel publishes
+            // only while the destination is absent. Probe the exact filesystem first;
+            // no advisory lock or check-then-rename is treated as authority.
+            try {
+                await link(tempPath, probePath);
+                const source = await lstat(tempPath);
+                const probe = await lstat(probePath);
+                if (!source.isFile() || !probe.isFile() || source.dev !== probe.dev || source.ino !== probe.ino) {
+                    return { kind: "unavailable", code: "PROJECT_INTENT_WRITE_UNAVAILABLE" };
+                }
+                await unlink(probePath);
+            }
+            catch {
+                return { kind: "unavailable", code: "PROJECT_INTENT_WRITE_UNAVAILABLE" };
+            }
+            const afterProbe = await inspect(request.root, signal);
+            if (!same(afterProbe.evidence, publicationEvidence))
+                return { kind: "stale" };
+            try {
+                await link(tempPath, current.leafPath);
+            }
+            catch (error) {
+                if (error.code === "EEXIST")
+                    return { kind: "stale" };
+                return { kind: "unavailable", code: "PROJECT_INTENT_WRITE_UNAVAILABLE" };
+            }
+            try {
+                await syncDirectory(current.parentPath);
+            }
+            catch {
+                return { kind: "ambiguous", expectedDigest: encoded.digest };
+            }
+            const reconciled = await inspect(request.root, new AbortController().signal).catch(() => undefined);
+            if (reconciled?.digest !== encoded.digest)
+                return { kind: "ambiguous", expectedDigest: encoded.digest };
+            return { kind: "written", observation: issue(reconciled.evidence), digest: encoded.digest };
+        }
+        catch (error) {
+            if (signal.aborted)
+                throw signal.reason ?? error;
+            return { kind: "ambiguous", expectedDigest: encoded.digest };
+        }
+        finally {
+            try {
+                await temp?.close();
+            }
+            catch { /* retain primary result */ }
+            try {
+                await unlink(probePath);
+            }
+            catch { /* absent or already removed */ }
+            try {
+                await unlink(tempPath);
+            }
+            catch { /* published hard link retains bytes */ }
+        }
+    }
+    async function cleanup(signal) {
+        signal.throwIfAborted();
+        let root;
+        try {
+            root = await input.projectRoots.acquire(signal);
+        }
+        catch (error) {
+            if (signal.aborted)
+                throw signal.reason ?? error;
+            return;
+        }
+        let authority;
+        try {
+            authority = await revalidateTrustedProjectRoot(root, input.projectRoots, signal);
+        }
+        catch {
+            return;
+        }
+        const parent = resolve(authority.path, DIRECTORY);
+        let entries;
+        try {
+            entries = await readdir(parent);
+        }
+        catch (error) {
+            if (error.code === "ENOENT")
+                return;
+            throw error;
+        }
+        for (const name of entries.filter((entry) => entry.startsWith(TEMP_PREFIX) && entry.endsWith(TEMP_SUFFIX))) {
+            signal.throwIfAborted();
+            const path = resolve(parent, name);
+            try {
+                const stats = await lstat(path);
+                if (stats.isFile() && !stats.isSymbolicLink())
+                    await unlink(path);
+            }
+            catch (error) {
+                if (error.code !== "ENOENT")
+                    throw error;
+            }
+        }
+    }
+    return Object.freeze({ read, replace, cleanup });
+}
+//# sourceMappingURL=node-project-intent-file.js.map

package/node_modules/@nklisch/pi-plugins/dist/infrastructure/project/node-project-intent-file.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"node-project-intent-file.js","sourceRoot":"","sources":["../../../src/infrastructure/project/node-project-intent-file.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,SAAS,CAAC;AACpC,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,KAAK,EAAE,IAAI,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,kBAAkB,CAAC;AACvF,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACpC,OAAO,EAAE,WAAW,EAAsB,MAAM,kCAAkC,CAAC;AAEnF,OAAO,EAAE,qCAAqC,EAAE,MAAM,0DAA0D,CAAC;AACjH,OAAO,EAAE,gCAAgC,EAAE,MAAM,6DAA6D,CAAC;AAC/G,OAAO,EAAE,wBAAwB,EAAE,8BAA8B,EAAE,MAAM,2CAA2C,CAAC;AAOrH,OAAO,EAAE,0BAA0B,EAAE,MAAM,oDAAoD,CAAC;AAChG,OAAO,EAAE,4BAA4B,EAAE,MAAM,kCAAkC,CAAC;AAEhF,MAAM,IAAI,GAAG,cAAc,CAAC;AAC5B,MAAM,SAAS,GAAG,KAAK,CAAC;AACxB,MAAM,WAAW,GAAG,wCAAwC,CAAC;AAC7D,MAAM,WAAW,GAAG,MAAM,CAAC;AAW3B,MAAM,kBAAmB,SAAQ,KAAK;IACf,IAAI;IAAzB,YAAqB,IAAuE;QAAI,KAAK,CAAC,IAAI,CAAC,CAAC;oBAAvF,IAAI;IAAoF,CAAC;CAC/G;AAED,SAAS,iBAAiB,CAAC,KAAwC;IACjE,OAAO,MAAM,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;AAChF,CAAC;AACD,SAAS,YAAY,CAAC,KAAwC;IAC5D,OAAO,MAAM,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,IAAI,EAAE,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;AAC1G,CAAC;AACD,SAAS,IAAI,CAAC,IAAa,EAAE,KAAc,IAAa,OAAO,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,KAAK,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;AAEhH,KAAK,UAAU,WAAW,CAAC,MAAwC,EAAE,IAAY,EAAE,MAAmB;IACpG,IAAI,IAAI,GAAG,qCAAqC,CAAC,qBAAqB;QAAE,MAAM,IAAI,kBAAkB,CAAC,gBAAgB,CAAC,CAAC;IACvH,MAAM,MAAM,GAAG,IAAI,UAAU,CAAC,IAAI,CAAC,CAAC;IACpC,IAAI,MAAM,GAAG,CAAC,CAAC;IACf,OAAO,MAAM,GAAG,IAAI,EAAE,CAAC;QACrB,MAAM,CAAC,cAAc,EAAE,CAAC;QACxB,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,IAAI,CAAC,MAAM,EAAE,MAAM,EAAE,IAAI,GAAG,MAAM,EAAE,MAAM,CAAC,CAAC;QACxE,IAAI,MAAM,CAAC,SAAS,KAAK,CAAC;YAAE,MAAM;QAClC,MAAM,IAAI,MAAM,CAAC,SAAS,CAAC;IAC7B,CAAC;IACD,IAAI,MAAM,KAAK,IAAI;QAAE,MAAM,IAAI,kBAAkB,CAAC,aAAa,CAAC,CAAC;IACjE,MAAM,KAAK,GAAG,IAAI,UAAU,CAAC,CAAC,CAAC,CAAC;IAChC,IAAI,CAAC,MAAM,MAAM,CAAC,IAAI,CAAC,KAAK,EAAE,CAAC,EAAE,CAAC,EAAE,IAAI,CAAC,CAAC,CAAC,SAAS,KAAK,CAAC;QAAE,MAAM,IAAI,kBAAkB,CAAC,gBAAgB,CAAC,CAAC;IAC3G,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,KAAK,UAAU,aAAa,CAAC,IAAY;IACvC,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,IAAI,EAAE,SAAS,CAAC,QAAQ,GAAG,CAAC,SAAS,CAAC,WAAW,IAAI,CAAC,CAAC,CAAC,CAAC;IACnF,IAAI,CAAC;QAAC,MAAM,MAAM,CAAC,IAAI,EAAE,CAAC;IAAC,CAAC;YAAS,CAAC;QAAC,MAAM,MAAM,CAAC,KAAK,EAAE,CAAC;IAAC,CAAC;AAChE,CAAC;AAED,MAAM,UAAU,+BAA+B,CAAC,KAG9C;IACA,IAAI,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,OAAO,KAAK,CAAC,MAAM,KAAK,UAAU;QAAE,MAAM,IAAI,SAAS,CAAC,+CAA+C,CAAC,CAAC;IAC5J,MAAM,YAAY,GAAG,IAAI,OAAO,EAA+B,CAAC;IAEhE,SAAS,KAAK,CAAC,QAA6B;QAC1C,MAAM,WAAW,GAAG,MAAM,CAAC,MAAM,CAAC,EAAE,QAAQ,EAAE,gCAAgC,CAAC,QAAQ,EAAE,KAAK,CAAC,MAAM,CAAC,EAAE,CAAqC,CAAC;QAC9I,YAAY,CAAC,GAAG,CAAC,WAAW,EAAE,QAAQ,CAAC,CAAC;QACxC,OAAO,WAAW,CAAC;IACrB,CAAC;IAED,KAAK,UAAU,OAAO,CAAC,IAAwB,EAAE,MAAmB;QAQlE,IAAI,SAAS,CAAC;QACd,IAAI,CAAC;YAAC,SAAS,GAAG,MAAM,4BAA4B,CAAC,IAAI,EAAE,KAAK,CAAC,YAAY,EAAE,MAAM,CAAC,CAAC;QAAC,CAAC;QACzF,OAAO,KAAK,EAAE,CAAC;YACb,IAAI,MAAM,CAAC,OAAO;gBAAE,MAAM,MAAM,CAAC,MAAM,IAAI,KAAK,CAAC;YACjD,MAAM,IAAI,kBAAkB,CAAC,oBAAoB,CAAC,CAAC;QACrD,CAAC;QACD,MAAM,YAAY,GAAG,MAAM,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,SAAS,CAAC,MAAM,EAAE,KAAK,EAAE,SAAS,CAAC,KAAK,EAAE,CAAC,CAAC;QACzF,MAAM,UAAU,GAAG,OAAO,CAAC,SAAS,CAAC,IAAI,EAAE,SAAS,CAAC,CAAC;QACtD,MAAM,QAAQ,GAAG,OAAO,CAAC,UAAU,EAAE,IAAI,CAAC,CAAC;QAC3C,IAAI,WAAW,CAAC;QAChB,IAAI,CAAC;YAAC,WAAW,GAAG,MAAM,KAAK,CAAC,UAAU,CAAC,CAAC;QAAC,CAAC;QAC9C,OAAO,KAAK,EAAE,CAAC;YACb,IAAK,KAA+B,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;gBACvD,OAAO,EAAE,QAAQ,EAAE,SAAS,CAAC,IAAI,EAAE,UAAU,EAAE,QAAQ,EAAE,QAAQ,EAAE,MAAM,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,YAAY,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,EAAE,IAAI,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,EAAE,CAAC,EAAE,CAAC;YACrK,CAAC;YACD,MAAM,KAAK,CAAC;QACd,CAAC;QACD,IAAI,CAAC,WAAW,CAAC,WAAW,EAAE,IAAI,WAAW,CAAC,cAAc,EAAE,IAAI,MAAM,QAAQ,CAAC,UAAU,CAAC,KAAK,UAAU;YAAE,MAAM,IAAI,kBAAkB,CAAC,aAAa,CAAC,CAAC;QACzJ,MAAM,cAAc,GAAG,iBAAiB,CAAC,WAAW,CAAC,CAAC;QACtD,IAAI,MAAM,CAAC;QACX,IAAI,CAAC;YAAC,MAAM,GAAG,MAAM,IAAI,CAAC,QAAQ,EAAE,SAAS,CAAC,QAAQ,GAAG,SAAS,CAAC,UAAU,CAAC,CAAC;QAAC,CAAC;QACjF,OAAO,KAAK,EAAE,CAAC;YACb,MAAM,IAAI,GAAI,KAA+B,CAAC,IAAI,CAAC;YACnD,IAAI,IAAI,KAAK,QAAQ;gBAAE,OAAO,EAAE,QAAQ,EAAE,SAAS,CAAC,IAAI,EAAE,UAAU,EAAE,QAAQ,EAAE,QAAQ,EAAE,MAAM,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,YAAY,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,QAAQ,EAAE,cAAc,EAAE,EAAE,IAAI,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,EAAE,CAAC,EAAE,CAAC;YAClN,IAAI,IAAI,KAAK,OAAO;gBAAE,MAAM,IAAI,kBAAkB,CAAC,aAAa,CAAC,CAAC;YAClE,MAAM,KAAK,CAAC;QACd,CAAC;QACD,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,IAAI,EAAE,CAAC;YACnC,IAAI,CAAC,MAAM,CAAC,MAAM,EAAE,IAAI,MAAM,CAAC,cAAc,EAAE;gBAAE,MAAM,IAAI,kBAAkB,CAAC,aAAa,CAAC,CAAC;YAC7F,MAAM,KAAK,GAAG,MAAM,WAAW,CAAC,MAAM,EAAE,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;YAC7D,MAAM,KAAK,GAAG,MAAM,MAAM,CAAC,IAAI,EAAE,CAAC;YAClC,MAAM,SAAS,GAAG,MAAM,KAAK,CAAC,QAAQ,CAAC,CAAC;YACxC,IAAI,CAAC,KAAK,CAAC,MAAM,EAAE,IAAI,SAAS,CAAC,cAAc,EAAE,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,IAAI,CAAC,IAAI,CAAC,YAAY,CAAC,MAAM,CAAC,EAAE,YAAY,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,YAAY,CAAC,KAAK,CAAC,EAAE,YAAY,CAAC,SAAS,CAAC,CAAC;gBAAE,MAAM,IAAI,kBAAkB,CAAC,aAAa,CAAC,CAAC;YACjO,MAAM,OAAO,GAAG,wBAAwB,CAAC,KAAK,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;YAC9D,IAAI,OAAO,CAAC,IAAI,KAAK,SAAS;gBAAE,MAAM,IAAI,kBAAkB,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;YAC3E,MAAM,SAAS,GAAG,WAAW,CAAC,KAAK,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;YACnD,MAAM,QAAQ,GAAG,MAAM,CAAC,MAAM,CAAC;gBAC7B,IAAI,EAAE,YAAY;gBAClB,MAAM,EAAE,EAAE,IAAI,EAAE,OAAgB,EAAE,QAAQ,EAAE,cAAc,EAAE;gBAC5D,IAAI,EAAE,EAAE,IAAI,EAAE,OAAgB,EAAE,QAAQ,EAAE,YAAY,CAAC,KAAK,CAAC,EAAE,SAAS,EAAE;gBAC1E,iBAAiB,EAAE,OAAO,CAAC,MAAM;aAClC,CAAC,CAAC;YACH,OAAO,EAAE,QAAQ,EAAE,SAAS,CAAC,IAAI,EAAE,UAAU,EAAE,QAAQ,EAAE,QAAQ,EAAE,WAAW,EAAE,OAAO,CAAC,WAAW,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,CAAC;QAChI,CAAC;gBAAS,CAAC;YAAC,MAAM,MAAM,CAAC,KAAK,EAAE,CAAC;QAAC,CAAC;IACrC,CAAC;IAED,KAAK,UAAU,IAAI,CAAC,IAAwB,EAAE,MAAmB;QAC/D,MAAM,CAAC,cAAc,EAAE,CAAC;QACxB,IAAI,CAAC;YACH,MAAM,KAAK,GAAG,MAAM,OAAO,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;YAC1C,MAAM,WAAW,GAAG,KAAK,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;YAC1C,OAAO,KAAK,CAAC,WAAW,KAAK,SAAS;gBACpC,CAAC,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,WAAW,EAAE;gBAClC,CAAC,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,WAAW,EAAE,WAAW,EAAE,KAAK,CAAC,WAAW,EAAE,MAAM,EAAE,KAAK,CAAC,MAAO,EAAE,CAAC;QAC5F,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,MAAM,CAAC,OAAO;gBAAE,MAAM,MAAM,CAAC,MAAM,IAAI,KAAK,CAAC;YACjD,OAAO,EAAE,IAAI,EAAE,aAAa,EAAE,IAAI,EAAE,KAAK,YAAY,kBAAkB,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,gBAAgB,EAAE,CAAC;QAC5G,CAAC;IACH,CAAC;IAED,KAAK,UAAU,OAAO,CAAC,OAAwD,EAAE,MAAmB;QAClG,MAAM,CAAC,cAAc,EAAE,CAAC;QACxB,MAAM,QAAQ,GAAG,YAAY,CAAC,GAAG,CAAC,OAAO,CAAC,QAAkB,CAAC,CAAC;QAC9D,IAAI,QAAQ,KAAK,SAAS;YAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC;QACrD,IAAI,OAAO,CAAC;QACZ,IAAI,CAAC;YAAC,OAAO,GAAG,8BAA8B,CAAC,OAAO,CAAC,WAAW,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;QAAC,CAAC;QACpF,MAAM,CAAC;YAAC,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC;QAAC,CAAC;QACnC,MAAM,OAAO,GAAG,0BAA0B,CAAC,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;QAClE,IAAI,OAAO,CAAC;QACZ,IAAI,CAAC;YAAC,OAAO,GAAG,MAAM,OAAO,CAAC,OAAO,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;QAAC,CAAC;QACtD,OAAO,KAAK,EAAE,CAAC;YACb,IAAI,MAAM,CAAC,OAAO;gBAAE,MAAM,MAAM,CAAC,MAAM,IAAI,KAAK,CAAC;YACjD,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC;QAC3B,CAAC;QACD,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,QAAQ,EAAE,QAAQ,CAAC;YAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC;QAChE,IAAI,OAAO,CAAC,MAAM,KAAK,OAAO,CAAC,MAAM;YAAE,OAAO,EAAE,IAAI,EAAE,WAAW,EAAE,WAAW,EAAE,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,CAAC;QAClI,0EAA0E;QAC1E,+EAA+E;QAC/E,IAAI,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,KAAK,OAAO;YAAE,OAAO,EAAE,IAAI,EAAE,aAAa,EAAE,IAAI,EAAE,kCAAkC,EAAE,CAAC;QAErH,IAAI,cAAiC,CAAC;QACtC,IAAI,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;YAC/C,IAAI,CAAC;gBAAC,MAAM,KAAK,CAAC,OAAO,CAAC,UAAU,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;YAAC,CAAC;YACzD,OAAO,KAAK,EAAE,CAAC;gBAAC,OAAQ,KAA+B,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,aAAa,EAAE,IAAI,EAAE,kCAAkC,EAAE,CAAC;YAAC,CAAC;YACpK,IAAI,CAAC;gBAAC,MAAM,aAAa,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;YAAC,CAAC;YAC9C,MAAM,CAAC;gBAAC,OAAO,EAAE,IAAI,EAAE,WAAW,EAAE,cAAc,EAAE,OAAO,CAAC,MAAM,EAAE,CAAC;YAAC,CAAC;YACvE,MAAM,MAAM,GAAG,MAAM,KAAK,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;YACtE,IAAI,MAAM,KAAK,SAAS,IAAI,CAAC,MAAM,CAAC,WAAW,EAAE,IAAI,MAAM,CAAC,cAAc,EAAE,IAAI,MAAM,QAAQ,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,KAAK,OAAO,CAAC,UAAU;gBAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC;YAC3L,cAAc,GAAG,iBAAiB,CAAC,MAAM,CAAC,CAAC;QAC7C,CAAC;aAAM,CAAC;YACN,cAAc,GAAG,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAC,QAAQ,CAAC;QACpD,CAAC;QACD,MAAM,mBAAmB,GAAwB,MAAM,CAAC,MAAM,CAAC;YAC7D,IAAI,EAAE,OAAO,CAAC,QAAQ,CAAC,IAAI;YAC3B,MAAM,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,QAAQ,EAAE,cAAc,EAAE;YACnD,IAAI,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE;SAC1B,CAAC,CAAC;QACH,MAAM,MAAM,GAAG,OAAO,CAAC,KAAK,CAAC,0BAA0B,CAAC,MAAM,CAAC,CAAC;QAChE,MAAM,QAAQ,GAAG,OAAO,CAAC,OAAO,CAAC,UAAU,EAAE,GAAG,WAAW,GAAG,MAAM,GAAG,WAAW,EAAE,CAAC,CAAC;QACtF,MAAM,SAAS,GAAG,OAAO,CAAC,OAAO,CAAC,UAAU,EAAE,GAAG,WAAW,GAAG,MAAM,SAAS,WAAW,EAAE,CAAC,CAAC;QAC7F,IAAI,IAAI,CAAC;QACT,IAAI,CAAC;YACH,IAAI,GAAG,MAAM,IAAI,CAAC,QAAQ,EAAE,SAAS,CAAC,OAAO,GAAG,SAAS,CAAC,MAAM,GAAG,SAAS,CAAC,QAAQ,GAAG,SAAS,CAAC,UAAU,EAAE,KAAK,CAAC,CAAC;YACrH,MAAM,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;YACpC,MAAM,IAAI,CAAC,IAAI,EAAE,CAAC;YAClB,MAAM,IAAI,CAAC,KAAK,EAAE,CAAC;YACnB,IAAI,GAAG,SAAS,CAAC;YAEjB,MAAM,aAAa,GAAG,MAAM,OAAO,CAAC,OAAO,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;YAC1D,IAAI,CAAC,IAAI,CAAC,aAAa,CAAC,QAAQ,EAAE,mBAAmB,CAAC;gBAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC;YAEjF,yEAAyE;YACzE,0EAA0E;YAC1E,iEAAiE;YACjE,IAAI,CAAC;gBACH,MAAM,IAAI,CAAC,QAAQ,EAAE,SAAS,CAAC,CAAC;gBAChC,MAAM,MAAM,GAAG,MAAM,KAAK,CAAC,QAAQ,CAAC,CAAC;gBACrC,MAAM,KAAK,GAAG,MAAM,KAAK,CAAC,SAAS,CAAC,CAAC;gBACrC,IAAI,CAAC,MAAM,CAAC,MAAM,EAAE,IAAI,CAAC,KAAK,CAAC,MAAM,EAAE,IAAI,MAAM,CAAC,GAAG,KAAK,KAAK,CAAC,GAAG,IAAI,MAAM,CAAC,GAAG,KAAK,KAAK,CAAC,GAAG,EAAE,CAAC;oBAChG,OAAO,EAAE,IAAI,EAAE,aAAa,EAAE,IAAI,EAAE,kCAAkC,EAAE,CAAC;gBAC3E,CAAC;gBACD,MAAM,MAAM,CAAC,SAAS,CAAC,CAAC;YAC1B,CAAC;YAAC,MAAM,CAAC;gBACP,OAAO,EAAE,IAAI,EAAE,aAAa,EAAE,IAAI,EAAE,kCAAkC,EAAE,CAAC;YAC3E,CAAC;YAED,MAAM,UAAU,GAAG,MAAM,OAAO,CAAC,OAAO,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;YACvD,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,QAAQ,EAAE,mBAAmB,CAAC;gBAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC;YAC9E,IAAI,CAAC;gBACH,MAAM,IAAI,CAAC,QAAQ,EAAE,OAAO,CAAC,QAAQ,CAAC,CAAC;YACzC,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,IAAK,KAA+B,CAAC,IAAI,KAAK,QAAQ;oBAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC;gBACjF,OAAO,EAAE,IAAI,EAAE,aAAa,EAAE,IAAI,EAAE,kCAAkC,EAAE,CAAC;YAC3E,CAAC;YACD,IAAI,CAAC;gBAAC,MAAM,aAAa,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC;YAAC,CAAC;YAChD,MAAM,CAAC;gBAAC,OAAO,EAAE,IAAI,EAAE,WAAW,EAAE,cAAc,EAAE,OAAO,CAAC,MAAM,EAAE,CAAC;YAAC,CAAC;YACvE,MAAM,UAAU,GAAG,MAAM,OAAO,CAAC,OAAO,CAAC,IAAI,EAAE,IAAI,eAAe,EAAE,CAAC,MAAM,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;YACpG,IAAI,UAAU,EAAE,MAAM,KAAK,OAAO,CAAC,MAAM;gBAAE,OAAO,EAAE,IAAI,EAAE,WAAW,EAAE,cAAc,EAAE,OAAO,CAAC,MAAM,EAAE,CAAC;YACxG,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,WAAW,EAAE,KAAK,CAAC,UAAU,CAAC,QAAQ,CAAC,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,CAAC;QAC9F,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,MAAM,CAAC,OAAO;gBAAE,MAAM,MAAM,CAAC,MAAM,IAAI,KAAK,CAAC;YACjD,OAAO,EAAE,IAAI,EAAE,WAAW,EAAE,cAAc,EAAE,OAAO,CAAC,MAAM,EAAE,CAAC;QAC/D,CAAC;gBAAS,CAAC;YACT,IAAI,CAAC;gBAAC,MAAM,IAAI,EAAE,KAAK,EAAE,CAAC;YAAC,CAAC;YAAC,MAAM,CAAC,CAAC,2BAA2B,CAAC,CAAC;YAClE,IAAI,CAAC;gBAAC,MAAM,MAAM,CAAC,SAAS,CAAC,CAAC;YAAC,CAAC;YAAC,MAAM,CAAC,CAAC,+BAA+B,CAAC,CAAC;YAC1E,IAAI,CAAC;gBAAC,MAAM,MAAM,CAAC,QAAQ,CAAC,CAAC;YAAC,CAAC;YAAC,MAAM,CAAC,CAAC,uCAAuC,CAAC,CAAC;QACnF,CAAC;IACH,CAAC;IAED,KAAK,UAAU,OAAO,CAAC,MAAmB;QACxC,MAAM,CAAC,cAAc,EAAE,CAAC;QACxB,IAAI,IAAI,CAAC;QACT,IAAI,CAAC;YAAC,IAAI,GAAG,MAAM,KAAK,CAAC,YAAY,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;QAAC,CAAC;QACxD,OAAO,KAAK,EAAE,CAAC;YAAC,IAAI,MAAM,CAAC,OAAO;gBAAE,MAAM,MAAM,CAAC,MAAM,IAAI,KAAK,CAAC;YAAC,OAAO;QAAC,CAAC;QAC3E,IAAI,SAAS,CAAC;QACd,IAAI,CAAC;YAAC,SAAS,GAAG,MAAM,4BAA4B,CAAC,IAAI,EAAE,KAAK,CAAC,YAAY,EAAE,MAAM,CAAC,CAAC;QAAC,CAAC;QACzF,MAAM,CAAC;YAAC,OAAO;QAAC,CAAC;QACjB,MAAM,MAAM,GAAG,OAAO,CAAC,SAAS,CAAC,IAAI,EAAE,SAAS,CAAC,CAAC;QAClD,IAAI,OAAiB,CAAC;QACtB,IAAI,CAAC;YAAC,OAAO,GAAG,MAAM,OAAO,CAAC,MAAM,CAAC,CAAC;QAAC,CAAC;QACxC,OAAO,KAAK,EAAE,CAAC;YAAC,IAAK,KAA+B,CAAC,IAAI,KAAK,QAAQ;gBAAE,OAAO;YAAC,MAAM,KAAK,CAAC;QAAC,CAAC;QAC9F,KAAK,MAAM,IAAI,IAAI,OAAO,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,UAAU,CAAC,WAAW,CAAC,IAAI,KAAK,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC,EAAE,CAAC;YAC3G,MAAM,CAAC,cAAc,EAAE,CAAC;YACxB,MAAM,IAAI,GAAG,OAAO,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;YACnC,IAAI,CAAC;gBACH,MAAM,KAAK,GAAG,MAAM,KAAK,CAAC,IAAI,CAAC,CAAC;gBAChC,IAAI,KAAK,CAAC,MAAM,EAAE,IAAI,CAAC,KAAK,CAAC,cAAc,EAAE;oBAAE,MAAM,MAAM,CAAC,IAAI,CAAC,CAAC;YACpE,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBAAC,IAAK,KAA+B,CAAC,IAAI,KAAK,QAAQ;oBAAE,MAAM,KAAK,CAAC;YAAC,CAAC;QAC1F,CAAC;IACH,CAAC;IAED,OAAO,MAAM,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC,CAAC;AACnD,CAAC"}

package/node_modules/@nklisch/pi-plugins/dist/infrastructure/project/node-project-path-authority.d.ts

@@ -0,0 +1,20 @@
+import type { ProjectRootAuthorityPort, TrustedProjectRoot } from "../../application/ports/project-root-authority.js";
+import type { ScopeContext } from "../../domain/state/scope.js";
+export declare function isContainedProjectPath(base: string, candidate: string): boolean;
+export declare function projectPathHasSymlink(base: string, candidate: string): Promise<boolean>;
+export declare function trustedRootScope(root: TrustedProjectRoot): Extract<ScopeContext, {
+    kind: "project";
+}>;
+/** Revalidate the opaque project capability and the canonical root path itself. */
+export declare function revalidateTrustedProjectRoot(root: TrustedProjectRoot, authority: ProjectRootAuthorityPort, signal: AbortSignal): Promise<Readonly<{
+    scope: Extract<ScopeContext, {
+        kind: "project";
+    }>;
+    path: string;
+    device: string;
+    inode: string;
+}>>;
+export declare function resolveProjectPathWithoutSymlinks(base: string, value: string): Promise<Readonly<{
+    path: string;
+    exists: boolean;
+}>>;

package/node_modules/@nklisch/pi-plugins/dist/infrastructure/project/node-project-path-authority.js

@@ -0,0 +1,83 @@
+import { lstat, realpath } from "node:fs/promises";
+import { dirname, isAbsolute, relative, resolve, sep } from "node:path";
+import { fileURLToPath } from "node:url";
+export function isContainedProjectPath(base, candidate) {
+    const rel = relative(base, candidate);
+    return rel === "" || (!rel.startsWith(`..${sep}`) && rel !== ".." && !isAbsolute(rel));
+}
+export async function projectPathHasSymlink(base, candidate) {
+    const rel = relative(base, candidate);
+    let current = base;
+    for (const segment of rel.split(sep).filter(Boolean)) {
+        current = resolve(current, segment);
+        try {
+            const stats = await lstat(current);
+            if (stats.isSymbolicLink())
+                return true;
+        }
+        catch (error) {
+            if (error.code === "ENOENT")
+                return false;
+            throw error;
+        }
+    }
+    return false;
+}
+export function trustedRootScope(root) {
+    return { kind: "project", identity: root.identity, projectKey: root.projectKey };
+}
+/** Revalidate the opaque project capability and the canonical root path itself. */
+export async function revalidateTrustedProjectRoot(root, authority, signal) {
+    signal.throwIfAborted();
+    const scope = trustedRootScope(root);
+    if (authority.revalidate !== undefined)
+        await authority.revalidate(root, scope, signal);
+    else
+        authority.verify(root, scope);
+    const path = fileURLToPath(root.canonicalRoot);
+    const stats = await lstat(path);
+    if (!stats.isDirectory() || stats.isSymbolicLink() || await realpath(path) !== resolve(path))
+        throw new Error("trusted project root is not a stable regular directory");
+    signal.throwIfAborted();
+    return Object.freeze({ scope, path, device: String(stats.dev), inode: String(stats.ino) });
+}
+export async function resolveProjectPathWithoutSymlinks(base, value) {
+    const canonicalBase = await realpath(base);
+    if (canonicalBase !== resolve(base))
+        throw new Error("project root is not canonical");
+    const candidate = resolve(canonicalBase, value);
+    if (!isContainedProjectPath(canonicalBase, candidate) || await projectPathHasSymlink(canonicalBase, candidate))
+        throw new Error("project path is unsafe");
+    try {
+        const stats = await lstat(candidate);
+        if (stats.isSymbolicLink())
+            throw new Error("project path is a symlink");
+        const canonicalCandidate = await realpath(candidate);
+        if (!isContainedProjectPath(canonicalBase, canonicalCandidate) || canonicalCandidate !== candidate)
+            throw new Error("project path changed identity");
+        return Object.freeze({ path: canonicalCandidate, exists: true });
+    }
+    catch (error) {
+        if (error.code !== "ENOENT")
+            throw error;
+        // The existing ancestor must still remain under the trusted root.
+        let ancestor = dirname(candidate);
+        while (ancestor !== canonicalBase) {
+            try {
+                const stats = await lstat(ancestor);
+                if (stats.isSymbolicLink() || !stats.isDirectory() || await realpath(ancestor) !== ancestor)
+                    throw new Error("project path ancestor is unsafe");
+                break;
+            }
+            catch (error) {
+                if (error.code !== "ENOENT")
+                    throw error;
+                ancestor = dirname(ancestor);
+            }
+        }
+        if (!isContainedProjectPath(canonicalBase, ancestor))
+            throw new Error("project path escaped root");
+        return Object.freeze({ path: candidate, exists: false });
+    }
+}
+//# sourceMappingURL=node-project-path-authority.js.map

package/node_modules/@nklisch/pi-plugins/dist/infrastructure/project/node-project-path-authority.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"node-project-path-authority.js","sourceRoot":"","sources":["../../../src/infrastructure/project/node-project-path-authority.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AACnD,OAAO,EAAE,OAAO,EAAE,UAAU,EAAE,QAAQ,EAAE,OAAO,EAAE,GAAG,EAAE,MAAM,WAAW,CAAC;AACxE,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AAIzC,MAAM,UAAU,sBAAsB,CAAC,IAAY,EAAE,SAAiB;IACpE,MAAM,GAAG,GAAG,QAAQ,CAAC,IAAI,EAAE,SAAS,CAAC,CAAC;IACtC,OAAO,GAAG,KAAK,EAAE,IAAI,CAAC,CAAC,GAAG,CAAC,UAAU,CAAC,KAAK,GAAG,EAAE,CAAC,IAAI,GAAG,KAAK,IAAI,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC;AACzF,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,qBAAqB,CAAC,IAAY,EAAE,SAAiB;IACzE,MAAM,GAAG,GAAG,QAAQ,CAAC,IAAI,EAAE,SAAS,CAAC,CAAC;IACtC,IAAI,OAAO,GAAG,IAAI,CAAC;IACnB,KAAK,MAAM,OAAO,IAAI,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE,CAAC;QACrD,OAAO,GAAG,OAAO,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;QACpC,IAAI,CAAC;YACH,MAAM,KAAK,GAAG,MAAM,KAAK,CAAC,OAAO,CAAC,CAAC;YACnC,IAAI,KAAK,CAAC,cAAc,EAAE;gBAAE,OAAO,IAAI,CAAC;QAC1C,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAK,KAA+B,CAAC,IAAI,KAAK,QAAQ;gBAAE,OAAO,KAAK,CAAC;YACrE,MAAM,KAAK,CAAC;QACd,CAAC;IACH,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,MAAM,UAAU,gBAAgB,CAAC,IAAwB;IACvD,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,QAAQ,EAAE,IAAI,CAAC,QAAQ,EAAE,UAAU,EAAE,IAAI,CAAC,UAAU,EAAE,CAAC;AACnF,CAAC;AAED,mFAAmF;AACnF,MAAM,CAAC,KAAK,UAAU,4BAA4B,CAChD,IAAwB,EACxB,SAAmC,EACnC,MAAmB;IAEnB,MAAM,CAAC,cAAc,EAAE,CAAC;IACxB,MAAM,KAAK,GAAG,gBAAgB,CAAC,IAAI,CAAC,CAAC;IACrC,IAAI,SAAS,CAAC,UAAU,KAAK,SAAS;QAAE,MAAM,SAAS,CAAC,UAAU,CAAC,IAAI,EAAE,KAAK,EAAE,MAAM,CAAC,CAAC;;QACnF,SAAS,CAAC,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;IACnC,MAAM,IAAI,GAAG,aAAa,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC;IAC/C,MAAM,KAAK,GAAG,MAAM,KAAK,CAAC,IAAI,CAAC,CAAC;IAChC,IAAI,CAAC,KAAK,CAAC,WAAW,EAAE,IAAI,KAAK,CAAC,cAAc,EAAE,IAAI,MAAM,QAAQ,CAAC,IAAI,CAAC,KAAK,OAAO,CAAC,IAAI,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,wDAAwD,CAAC,CAAC;IACxK,MAAM,CAAC,cAAc,EAAE,CAAC;IACxB,OAAO,MAAM,CAAC,MAAM,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;AAC7F,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,iCAAiC,CACrD,IAAY,EACZ,KAAa;IAEb,MAAM,aAAa,GAAG,MAAM,QAAQ,CAAC,IAAI,CAAC,CAAC;IAC3C,IAAI,aAAa,KAAK,OAAO,CAAC,IAAI,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,+BAA+B,CAAC,CAAC;IACtF,MAAM,SAAS,GAAG,OAAO,CAAC,aAAa,EAAE,KAAK,CAAC,CAAC;IAChD,IAAI,CAAC,sBAAsB,CAAC,aAAa,EAAE,SAAS,CAAC,IAAI,MAAM,qBAAqB,CAAC,aAAa,EAAE,SAAS,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,wBAAwB,CAAC,CAAC;IAC1J,IAAI,CAAC;QACH,MAAM,KAAK,GAAG,MAAM,KAAK,CAAC,SAAS,CAAC,CAAC;QACrC,IAAI,KAAK,CAAC,cAAc,EAAE;YAAE,MAAM,IAAI,KAAK,CAAC,2BAA2B,CAAC,CAAC;QACzE,MAAM,kBAAkB,GAAG,MAAM,QAAQ,CAAC,SAAS,CAAC,CAAC;QACrD,IAAI,CAAC,sBAAsB,CAAC,aAAa,EAAE,kBAAkB,CAAC,IAAI,kBAAkB,KAAK,SAAS;YAAE,MAAM,IAAI,KAAK,CAAC,+BAA+B,CAAC,CAAC;QACrJ,OAAO,MAAM,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,kBAAkB,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC;IACnE,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAK,KAA+B,CAAC,IAAI,KAAK,QAAQ;YAAE,MAAM,KAAK,CAAC;QACpE,kEAAkE;QAClE,IAAI,QAAQ,GAAG,OAAO,CAAC,SAAS,CAAC,CAAC;QAClC,OAAO,QAAQ,KAAK,aAAa,EAAE,CAAC;YAClC,IAAI,CAAC;gBACH,MAAM,KAAK,GAAG,MAAM,KAAK,CAAC,QAAQ,CAAC,CAAC;gBACpC,IAAI,KAAK,CAAC,cAAc,EAAE,IAAI,CAAC,KAAK,CAAC,WAAW,EAAE,IAAI,MAAM,QAAQ,CAAC,QAAQ,CAAC,KAAK,QAAQ;oBAAE,MAAM,IAAI,KAAK,CAAC,iCAAiC,CAAC,CAAC;gBAChJ,MAAM;YACR,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,IAAK,KAA+B,CAAC,IAAI,KAAK,QAAQ;oBAAE,MAAM,KAAK,CAAC;gBACpE,QAAQ,GAAG,OAAO,CAAC,QAAQ,CAAC,CAAC;YAC/B,CAAC;QACH,CAAC;QACD,IAAI,CAAC,sBAAsB,CAAC,aAAa,EAAE,QAAQ,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,2BAA2B,CAAC,CAAC;QACnG,OAAO,MAAM,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC;IAC3D,CAAC;AACH,CAAC"}

package/node_modules/@nklisch/pi-plugins/dist/infrastructure/project/node-project-root-resolver.d.ts

@@ -0,0 +1,15 @@
+import type { ProjectRootResolutionPort } from "../../application/ports/project-root-authority.js";
+import type { CommandRunner } from "../../application/ports/process-runner.js";
+import { type Sha256 } from "../../domain/source.js";
+import { type ProjectIdentity } from "../../domain/state/scope.js";
+export declare function resolveNodeProjectIdentity(input: Readonly<{
+    cwd: string;
+    sha256: Sha256;
+    git?: Pick<CommandRunner, "run">;
+    signal: AbortSignal;
+}>): Promise<ProjectIdentity>;
+export declare function createNodeProjectRootResolver(input: Readonly<{
+    cwd: string;
+    sha256: Sha256;
+    git?: Pick<CommandRunner, "run">;
+}>): ProjectRootResolutionPort;

package/node_modules/@nklisch/pi-plugins/dist/infrastructure/project/node-project-root-resolver.js

@@ -0,0 +1,73 @@
+import { lstat, realpath } from "node:fs/promises";
+import { isAbsolute, resolve } from "node:path";
+import { pathToFileURL } from "node:url";
+import { SourceHashSchema } from "../../domain/source.js";
+import { CanonicalProjectRootSchema, ProjectIdentitySchema, deriveProjectKey, } from "../../domain/state/scope.js";
+function digest(bytes, sha256) {
+    const result = sha256(bytes);
+    if (!(result instanceof Uint8Array) || result.byteLength !== 32)
+        throw new Error("SHA-256 must return 32 bytes");
+    return [...result].map((byte) => byte.toString(16).padStart(2, "0")).join("");
+}
+async function gitCommonDirectory(cwd, git, signal) {
+    try {
+        const result = await git.run({
+            executable: "git",
+            args: ["rev-parse", "--path-format=absolute", "--git-common-dir"],
+            cwd,
+            environment: { inherit: "host", values: {} },
+            capture: {
+                stdout: { mode: "capture", maxBytes: 16 * 1024, overflow: "error" },
+                stderr: { maxBytes: 16 * 1024, overflow: "truncate" },
+            },
+            timeoutMs: 5_000,
+        }, signal);
+        if (result.exitCode !== 0 || !(result.stdout instanceof Uint8Array))
+            return undefined;
+        const value = new TextDecoder("utf-8", { fatal: true }).decode(result.stdout).trim();
+        if (!isAbsolute(value))
+            return undefined;
+        return await realpath(value);
+    }
+    catch (error) {
+        if (signal.aborted)
+            throw signal.reason;
+        return undefined;
+    }
+}
+export async function resolveNodeProjectIdentity(input) {
+    input.signal.throwIfAborted();
+    if (typeof input.cwd !== "string" || !isAbsolute(input.cwd))
+        throw new TypeError("project cwd must be absolute");
+    const canonicalPath = await realpath(resolve(input.cwd));
+    const canonicalRoot = CanonicalProjectRootSchema.parse(pathToFileURL(canonicalPath).href);
+    const common = input.git === undefined ? undefined : await gitCommonDirectory(canonicalPath, input.git, input.signal);
+    if (common === undefined) {
+        return ProjectIdentitySchema.parse({
+            kind: "path-only",
+            canonicalRoot,
+            limitation: "identity-changes-with-canonical-root",
+        });
+    }
+    const stats = await lstat(common);
+    if (!stats.isDirectory() || stats.isSymbolicLink())
+        throw new Error("Git common directory identity is invalid");
+    const preimage = new TextEncoder().encode(`git-common-directory-v1\0device:${String(stats.dev)}\0inode:${String(stats.ino)}`);
+    return ProjectIdentitySchema.parse({
+        kind: "repository",
+        canonicalRoot,
+        repositoryFingerprint: SourceHashSchema.parse(`sha256:${digest(preimage, input.sha256)}`),
+    });
+}
+export function createNodeProjectRootResolver(input) {
+    return Object.freeze({
+        resolve(signal) {
+            return resolveNodeProjectIdentity({ ...input, signal }).then((identity) => ({
+                kind: "project",
+                identity,
+                projectKey: deriveProjectKey(identity, input.sha256),
+            }));
+        },
+    });
+}
+//# sourceMappingURL=node-project-root-resolver.js.map

package/node_modules/@nklisch/pi-plugins/dist/infrastructure/project/node-project-root-resolver.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"node-project-root-resolver.js","sourceRoot":"","sources":["../../../src/infrastructure/project/node-project-root-resolver.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AACnD,OAAO,EAAE,UAAU,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAChD,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AAGzC,OAAO,EAAE,gBAAgB,EAAe,MAAM,wBAAwB,CAAC;AACvE,OAAO,EACL,0BAA0B,EAC1B,qBAAqB,EACrB,gBAAgB,GAEjB,MAAM,6BAA6B,CAAC;AAErC,SAAS,MAAM,CAAC,KAAiB,EAAE,MAAc;IAC/C,MAAM,MAAM,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC;IAC7B,IAAI,CAAC,CAAC,MAAM,YAAY,UAAU,CAAC,IAAI,MAAM,CAAC,UAAU,KAAK,EAAE;QAAE,MAAM,IAAI,KAAK,CAAC,8BAA8B,CAAC,CAAC;IACjH,OAAO,CAAC,GAAG,MAAM,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;AAChF,CAAC;AAED,KAAK,UAAU,kBAAkB,CAAC,GAAW,EAAE,GAA+B,EAAE,MAAmB;IACjG,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,MAAM,GAAG,CAAC,GAAG,CAAC;YAC3B,UAAU,EAAE,KAAK;YACjB,IAAI,EAAE,CAAC,WAAW,EAAE,wBAAwB,EAAE,kBAAkB,CAAC;YACjE,GAAG;YACH,WAAW,EAAE,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,EAAE,EAAE;YAC5C,OAAO,EAAE;gBACP,MAAM,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,QAAQ,EAAE,EAAE,GAAG,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE;gBACnE,MAAM,EAAE,EAAE,QAAQ,EAAE,EAAE,GAAG,IAAI,EAAE,QAAQ,EAAE,UAAU,EAAE;aACtD;YACD,SAAS,EAAE,KAAK;SACjB,EAAE,MAAM,CAAC,CAAC;QACX,IAAI,MAAM,CAAC,QAAQ,KAAK,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,MAAM,YAAY,UAAU,CAAC;YAAE,OAAO,SAAS,CAAC;QACtF,MAAM,KAAK,GAAG,IAAI,WAAW,CAAC,OAAO,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,CAAC;QACrF,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC;YAAE,OAAO,SAAS,CAAC;QACzC,OAAO,MAAM,QAAQ,CAAC,KAAK,CAAC,CAAC;IAC/B,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,MAAM,CAAC,OAAO;YAAE,MAAM,MAAM,CAAC,MAAM,CAAC;QACxC,OAAO,SAAS,CAAC;IACnB,CAAC;AACH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,0BAA0B,CAAC,KAK/C;IACA,KAAK,CAAC,MAAM,CAAC,cAAc,EAAE,CAAC;IAC9B,IAAI,OAAO,KAAK,CAAC,GAAG,KAAK,QAAQ,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC,GAAG,CAAC;QAAE,MAAM,IAAI,SAAS,CAAC,8BAA8B,CAAC,CAAC;IACjH,MAAM,aAAa,GAAG,MAAM,QAAQ,CAAC,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC;IACzD,MAAM,aAAa,GAAG,0BAA0B,CAAC,KAAK,CAAC,aAAa,CAAC,aAAa,CAAC,CAAC,IAAI,CAAC,CAAC;IAC1F,MAAM,MAAM,GAAG,KAAK,CAAC,GAAG,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,MAAM,kBAAkB,CAAC,aAAa,EAAE,KAAK,CAAC,GAAG,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;IACtH,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;QACzB,OAAO,qBAAqB,CAAC,KAAK,CAAC;YACjC,IAAI,EAAE,WAAW;YACjB,aAAa;YACb,UAAU,EAAE,sCAAsC;SACnD,CAAC,CAAC;IACL,CAAC;IACD,MAAM,KAAK,GAAG,MAAM,KAAK,CAAC,MAAM,CAAC,CAAC;IAClC,IAAI,CAAC,KAAK,CAAC,WAAW,EAAE,IAAI,KAAK,CAAC,cAAc,EAAE;QAAE,MAAM,IAAI,KAAK,CAAC,0CAA0C,CAAC,CAAC;IAChH,MAAM,QAAQ,GAAG,IAAI,WAAW,EAAE,CAAC,MAAM,CACvC,mCAAmC,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,WAAW,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,CACnF,CAAC;IACF,OAAO,qBAAqB,CAAC,KAAK,CAAC;QACjC,IAAI,EAAE,YAAY;QAClB,aAAa;QACb,qBAAqB,EAAE,gBAAgB,CAAC,KAAK,CAAC,UAAU,MAAM,CAAC,QAAQ,EAAE,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC;KAC1F,CAAC,CAAC;AACL,CAAC;AAED,MAAM,UAAU,6BAA6B,CAAC,KAI5C;IACA,OAAO,MAAM,CAAC,MAAM,CAAC;QACnB,OAAO,CAAC,MAAmB;YACzB,OAAO,0BAA0B,CAAC,EAAE,GAAG,KAAK,EAAE,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC;gBAC1E,IAAI,EAAE,SAAkB;gBACxB,QAAQ;gBACR,UAAU,EAAE,gBAAgB,CAAC,QAAQ,EAAE,KAAK,CAAC,MAAM,CAAC;aACrD,CAAC,CAAC,CAAC;QACN,CAAC;KACF,CAAC,CAAC;AACL,CAAC"}

package/node_modules/@nklisch/pi-plugins/dist/infrastructure/recovery/create-node-recovery-adapters.d.ts

@@ -0,0 +1,23 @@
+import type { ScopeReference } from "../../domain/state/scope.js";
+import type { LifecycleTransitionStore } from "../../application/ports/lifecycle-transition-store.js";
+import type { RevisionRetentionStore } from "../../application/ports/revision-retention-store.js";
+import type { RevisionLeaseStore } from "../../application/ports/revision-lease-store.js";
+import type { RevisionArtifactStore } from "../../application/ports/revision-artifact-store.js";
+import type { LifecycleRecoveryService, LifecycleRecoveryServiceDependencies } from "../../application/recovery-service.js";
+import { createRevisionCollectionService, type RevisionCollectionDependencies } from "../../application/revision-collection-service.js";
+export type NodeRecoveryAdapterOptions = Readonly<{
+    hostRoot: string;
+    verifyLocalFilesystem?: (root: string) => Promise<void>;
+}>;
+export type NodeRecoveryAdapters = Readonly<{
+    transitions(scope: ScopeReference): LifecycleTransitionStore;
+    transitionStore: LifecycleTransitionStore;
+    leases: RevisionLeaseStore;
+    retention: RevisionRetentionStore;
+    artifacts: RevisionArtifactStore;
+    createRecoveryService(dependencies: Omit<LifecycleRecoveryServiceDependencies, "transitions">): LifecycleRecoveryService;
+    createCollectionService(dependencies: Omit<RevisionCollectionDependencies, "transitions" | "leases" | "retention" | "artifacts" | "sha256">): ReturnType<typeof createRevisionCollectionService>;
+    close(): Promise<void>;
+}>;
+/** Composition root: adapter details remain private while application policy stays injectable. */
+export declare function createNodeRecoveryAdapters(options: NodeRecoveryAdapterOptions): Promise<NodeRecoveryAdapters>;