@nklisch/pi-enhanced 0.2.3 → 0.2.5

package/node_modules/@nklisch/pi-plugins/dist/infrastructure/filesystem/installed-plugin-loader.js

@@ -1,80 +0,0 @@
-import { dirname } from "node:path";
-import { InstalledPluginLoaderRequestSchema, LoadedInstalledPluginSchema, } from "../../application/ports/installed-plugin-loader.js";
-import { verifyInstalledRevisionDescriptor } from "../../application/installed-revision-descriptor.js";
-import { createInstalledRevisionRecord } from "../../domain/state/installed-state.js";
-import { createScopeContext, toScopeReference } from "../../domain/state/scope.js";
-import { inspectPublishedRevision } from "./immutable-content-store.js";
-export class InstalledPluginLoadError extends Error {
-    code;
-    constructor(code, cause) {
-        super(code === "INSTALLED_DESCRIPTOR_UNAVAILABLE"
-            ? "installed revision cannot be reconstructed"
-            : "installed revision reconstruction evidence is corrupt", cause === undefined ? undefined : { cause });
-        this.name = "InstalledPluginLoadError";
-        this.code = code;
-    }
-    toJSON() {
-        return Object.freeze({ code: this.code, message: this.message });
-    }
-}
-function sameJson(left, right) {
-    return JSON.stringify(left) === JSON.stringify(right);
-}
-function deepFreeze(value, seen = new WeakSet()) {
-    if (value === null || typeof value !== "object" || seen.has(value))
-        return;
-    seen.add(value);
-    for (const child of Object.values(value))
-        deepFreeze(child, seen);
-    Object.freeze(value);
-}
-export function createInstalledPluginLoader(input) {
-    if (input === null || typeof input !== "object" || typeof input.sha256 !== "function") {
-        throw new TypeError("installed plugin loader dependencies are required");
-    }
-    return Object.freeze({
-        async load(requestInput, signal) {
-            signal.throwIfAborted();
-            const request = InstalledPluginLoaderRequestSchema.parse(requestInput);
-            const scope = createScopeContext(request.scope, input.sha256);
-            const scopeReference = toScopeReference(scope);
-            const resolved = await input.content.resolvePlugin(request.revision, signal, scopeReference);
-            const published = await inspectPublishedRevision(dirname(resolved.root), input.sha256);
-            if (published.descriptor === undefined) {
-                throw new InstalledPluginLoadError("INSTALLED_DESCRIPTOR_UNAVAILABLE");
-            }
-            try {
-                const descriptor = verifyInstalledRevisionDescriptor(published.descriptor, request.revision, input.sha256);
-                if (!sameJson(descriptor.loaded.content, resolved.manifest) || descriptor.loaded.binding !== request.revision.revision) {
-                    throw new Error("descriptor content does not match resolved revision");
-                }
-                const evidence = request.revision.evidence.source;
-                const reconstructed = createInstalledRevisionRecord({
-                    plugin: descriptor.loaded.plugin,
-                    compatibility: descriptor.loaded.compatibility,
-                    content: descriptor.loaded.content,
-                    revision: request.revision.revision,
-                    contentRef: request.revision.contentRef,
-                    dataRef: request.revision.dataRef,
-                    ...(request.revision.configurationRef === undefined ? {} : { configurationRef: request.revision.configurationRef }),
-                    ...(evidence.marketplaceSourceIdentity === undefined ? {} : { marketplaceSourceIdentity: evidence.marketplaceSourceIdentity }),
-                    ...(evidence.pluginSourceIdentity === undefined ? {} : { pluginSourceIdentity: evidence.pluginSourceIdentity }),
-                    ...(evidence.declaredVersion === undefined ? {} : { declaredVersion: evidence.declaredVersion }),
-                    scope: scopeReference,
-                }, input.sha256);
-                if (!sameJson(reconstructed, request.revision)) {
-                    throw new Error("descriptor does not reproduce installed revision evidence");
-                }
-                const loaded = LoadedInstalledPluginSchema.parse(descriptor.loaded);
-                deepFreeze(loaded);
-                return loaded;
-            }
-            catch (cause) {
-                if (cause instanceof InstalledPluginLoadError)
-                    throw cause;
-                throw new InstalledPluginLoadError("INSTALLED_DESCRIPTOR_CORRUPT", cause);
-            }
-        },
-    });
-}
-//# sourceMappingURL=installed-plugin-loader.js.map

package/node_modules/@nklisch/pi-plugins/dist/infrastructure/filesystem/installed-plugin-loader.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"installed-plugin-loader.js","sourceRoot":"","sources":["../../../src/infrastructure/filesystem/installed-plugin-loader.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAEpC,OAAO,EACL,kCAAkC,EAClC,2BAA2B,GAG5B,MAAM,oDAAoD,CAAC;AAC5D,OAAO,EAAE,iCAAiC,EAAE,MAAM,oDAAoD,CAAC;AACvG,OAAO,EAAE,6BAA6B,EAAE,MAAM,uCAAuC,CAAC;AACtF,OAAO,EAAE,kBAAkB,EAAE,gBAAgB,EAAE,MAAM,6BAA6B,CAAC;AAEnF,OAAO,EAAE,wBAAwB,EAAE,MAAM,8BAA8B,CAAC;AAExE,MAAM,OAAO,wBAAyB,SAAQ,KAAK;IACxC,IAAI,CAEsB;IAEnC,YAAY,IAAsC,EAAE,KAAe;QACjE,KAAK,CAAC,IAAI,KAAK,kCAAkC;YAC/C,CAAC,CAAC,4CAA4C;YAC9C,CAAC,CAAC,uDAAuD,EAC3D,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC;QAC7C,IAAI,CAAC,IAAI,GAAG,0BAA0B,CAAC;QACvC,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC;IACnB,CAAC;IAED,MAAM;QACJ,OAAO,MAAM,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,CAAC,CAAC;IACnE,CAAC;CACF;AAED,SAAS,QAAQ,CAAC,IAAa,EAAE,KAAc;IAC7C,OAAO,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,KAAK,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;AACxD,CAAC;AAED,SAAS,UAAU,CAAC,KAAc,EAAE,IAAI,GAAG,IAAI,OAAO,EAAU;IAC9D,IAAI,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC;QAAE,OAAO;IAC3E,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;IAChB,KAAK,MAAM,KAAK,IAAI,MAAM,CAAC,MAAM,CAAC,KAAgC,CAAC;QAAE,UAAU,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC;IAC7F,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AACvB,CAAC;AAED,MAAM,UAAU,2BAA2B,CAAC,KAG1C;IACA,IAAI,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,OAAO,KAAK,CAAC,MAAM,KAAK,UAAU,EAAE,CAAC;QACtF,MAAM,IAAI,SAAS,CAAC,mDAAmD,CAAC,CAAC;IAC3E,CAAC;IACD,OAAO,MAAM,CAAC,MAAM,CAAC;QACnB,KAAK,CAAC,IAAI,CACR,YAA0D,EAC1D,MAAmB;YAEnB,MAAM,CAAC,cAAc,EAAE,CAAC;YACxB,MAAM,OAAO,GAAG,kCAAkC,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC;YACvE,MAAM,KAAK,GAAG,kBAAkB,CAAC,OAAO,CAAC,KAAK,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;YAC9D,MAAM,cAAc,GAAG,gBAAgB,CAAC,KAAK,CAAC,CAAC;YAC/C,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,OAAO,CAAC,aAAa,CAAC,OAAO,CAAC,QAAQ,EAAE,MAAM,EAAE,cAAc,CAAC,CAAC;YAC7F,MAAM,SAAS,GAAG,MAAM,wBAAwB,CAAC,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;YACvF,IAAI,SAAS,CAAC,UAAU,KAAK,SAAS,EAAE,CAAC;gBACvC,MAAM,IAAI,wBAAwB,CAAC,kCAAkC,CAAC,CAAC;YACzE,CAAC;YACD,IAAI,CAAC;gBACH,MAAM,UAAU,GAAG,iCAAiC,CAAC,SAAS,CAAC,UAAU,EAAE,OAAO,CAAC,QAAQ,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;gBAC3G,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC,MAAM,CAAC,OAAO,EAAE,QAAQ,CAAC,QAAQ,CAAC,IAAI,UAAU,CAAC,MAAM,CAAC,OAAO,KAAK,OAAO,CAAC,QAAQ,CAAC,QAAQ,EAAE,CAAC;oBACvH,MAAM,IAAI,KAAK,CAAC,qDAAqD,CAAC,CAAC;gBACzE,CAAC;gBACD,MAAM,QAAQ,GAAG,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAC,MAAM,CAAC;gBAClD,MAAM,aAAa,GAAG,6BAA6B,CAAC;oBAClD,MAAM,EAAE,UAAU,CAAC,MAAM,CAAC,MAAM;oBAChC,aAAa,EAAE,UAAU,CAAC,MAAM,CAAC,aAAa;oBAC9C,OAAO,EAAE,UAAU,CAAC,MAAM,CAAC,OAAO;oBAClC,QAAQ,EAAE,OAAO,CAAC,QAAQ,CAAC,QAAQ;oBACnC,UAAU,EAAE,OAAO,CAAC,QAAQ,CAAC,UAAU;oBACvC,OAAO,EAAE,OAAO,CAAC,QAAQ,CAAC,OAAO;oBACjC,GAAG,CAAC,OAAO,CAAC,QAAQ,CAAC,gBAAgB,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,gBAAgB,EAAE,OAAO,CAAC,QAAQ,CAAC,gBAAgB,EAAE,CAAC;oBACnH,GAAG,CAAC,QAAQ,CAAC,yBAAyB,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,yBAAyB,EAAE,QAAQ,CAAC,yBAAyB,EAAE,CAAC;oBAC9H,GAAG,CAAC,QAAQ,CAAC,oBAAoB,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,oBAAoB,EAAE,QAAQ,CAAC,oBAAoB,EAAE,CAAC;oBAC/G,GAAG,CAAC,QAAQ,CAAC,eAAe,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,eAAe,EAAE,QAAQ,CAAC,eAAe,EAAE,CAAC;oBAChG,KAAK,EAAE,cAAc;iBACtB,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;gBACjB,IAAI,CAAC,QAAQ,CAAC,aAAa,EAAE,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAC;oBAC/C,MAAM,IAAI,KAAK,CAAC,2DAA2D,CAAC,CAAC;gBAC/E,CAAC;gBACD,MAAM,MAAM,GAAG,2BAA2B,CAAC,KAAK,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC;gBACpE,UAAU,CAAC,MAAM,CAAC,CAAC;gBACnB,OAAO,MAAM,CAAC;YAChB,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,IAAI,KAAK,YAAY,wBAAwB;oBAAE,MAAM,KAAK,CAAC;gBAC3D,MAAM,IAAI,wBAAwB,CAAC,8BAA8B,EAAE,KAAK,CAAC,CAAC;YAC5E,CAAC;QACH,CAAC;KACF,CAAC,CAAC;AACL,CAAC"}

package/node_modules/@nklisch/pi-plugins/dist/infrastructure/filesystem/manifest-backed-file.d.ts

@@ -1,15 +0,0 @@
-import type { Sha256 } from "../../domain/source.js";
-import type { ManifestFileRef } from "../../application/ports/content-read.js";
-type ManifestBackedFileFailureKind = "missing" | "escape" | "mutated" | "unreadable";
-export declare class ManifestBackedFileError extends Error {
-    readonly kind: ManifestBackedFileFailureKind;
-    constructor(kind: ManifestBackedFileFailureKind, message: string, options?: ErrorOptions);
-}
-export declare function manifestBackedFilePath(file: ManifestFileRef): string;
-export declare function inspectManifestBackedFile(file: ManifestFileRef, signal: AbortSignal): Promise<Readonly<{
-    path: string;
-    canonicalPath: string;
-}>>;
-/** Shared exact-file read used by the existing inspection adapter. */
-export declare function readManifestBackedFile(file: ManifestFileRef, limitBytes: number, sha256: Sha256, signal: AbortSignal): Promise<Uint8Array>;
-export {};

package/node_modules/@nklisch/pi-plugins/dist/infrastructure/filesystem/manifest-backed-file.js

@@ -1,169 +0,0 @@
-import { constants } from "node:fs";
-import { lstat, open, realpath } from "node:fs/promises";
-import { isAbsolute, resolve, sep } from "node:path";
-import { ContentManifestEntrySchema, hashContent, normalizeContentPath, } from "../../domain/content-manifest.js";
-const CHUNK_SIZE = 64 * 1024;
-export class ManifestBackedFileError extends Error {
-    kind;
-    constructor(kind, message, options) {
-        super(message, options);
-        this.kind = kind;
-        this.name = "ManifestBackedFileError";
-    }
-}
-function classifyFsError(error, kind = "unreadable") {
-    if (error !== null && typeof error === "object" && "code" in error && error.code === "ENOENT") {
-        return new ManifestBackedFileError("missing", "manifest-backed file is missing", { cause: error });
-    }
-    return new ManifestBackedFileError(kind, "manifest-backed file could not be inspected", { cause: error });
-}
-function assertRoot(root) {
-    if (typeof root !== "string" || root.length === 0 || !isAbsolute(root)) {
-        throw new ManifestBackedFileError("escape", "manifest-backed content root is not absolute");
-    }
-    return resolve(root);
-}
-function assertEntry(entry) {
-    const parsed = ContentManifestEntrySchema.parse(entry);
-    if (parsed.kind !== "file")
-        throw new ManifestBackedFileError("mutated", "manifest-backed entry is not a file");
-    return parsed;
-}
-export function manifestBackedFilePath(file) {
-    const root = assertRoot(file.root);
-    const entry = assertEntry(file.entry);
-    let normalized;
-    try {
-        normalized = normalizeContentPath(entry.path);
-    }
-    catch (error) {
-        throw new ManifestBackedFileError("escape", "manifest-backed content path is unsafe", { cause: error });
-    }
-    const candidate = resolve(root, ...normalized.split("/"));
-    const prefix = root.endsWith(sep) ? root : `${root}${sep}`;
-    if (candidate === root || !candidate.startsWith(prefix)) {
-        throw new ManifestBackedFileError("escape", "manifest-backed content path escapes its root");
-    }
-    return candidate;
-}
-async function inspectPath(root, target) {
-    let rootStat;
-    try {
-        rootStat = await lstat(root);
-    }
-    catch (error) {
-        throw classifyFsError(error);
-    }
-    if (rootStat.isSymbolicLink() || !rootStat.isDirectory()) {
-        throw new ManifestBackedFileError("escape", "manifest-backed content root is not a real directory");
-    }
-    let canonicalRoot;
-    try {
-        canonicalRoot = await realpath(root);
-    }
-    catch (error) {
-        throw classifyFsError(error);
-    }
-    if (canonicalRoot !== root) {
-        throw new ManifestBackedFileError("escape", "manifest-backed content root is not canonical");
-    }
-    const relative = target.slice(root.length).replace(/^[/\\]+/u, "");
-    let current = root;
-    for (const segment of relative.split(sep)) {
-        if (segment.length === 0)
-            continue;
-        current = resolve(current, segment);
-        let stats;
-        try {
-            stats = await lstat(current);
-        }
-        catch (error) {
-            throw classifyFsError(error);
-        }
-        if (stats.isSymbolicLink()) {
-            throw new ManifestBackedFileError("escape", "manifest-backed content path contains a symlink");
-        }
-        if (current !== target && !stats.isDirectory()) {
-            throw new ManifestBackedFileError("mutated", "manifest-backed content ancestor is not a directory");
-        }
-    }
-    let targetStat;
-    try {
-        targetStat = await lstat(target);
-    }
-    catch (error) {
-        throw classifyFsError(error);
-    }
-    if (targetStat.isSymbolicLink())
-        throw new ManifestBackedFileError("escape", "manifest-backed content target is a symlink");
-    if (!targetStat.isFile())
-        throw new ManifestBackedFileError("mutated", "manifest-backed content target is not a regular file");
-    let canonicalTarget;
-    try {
-        canonicalTarget = await realpath(target);
-    }
-    catch (error) {
-        throw classifyFsError(error);
-    }
-    const rootPrefix = canonicalRoot.endsWith(sep) ? canonicalRoot : `${canonicalRoot}${sep}`;
-    if (canonicalTarget !== target || !canonicalTarget.startsWith(rootPrefix)) {
-        throw new ManifestBackedFileError("escape", "manifest-backed content target escapes its root");
-    }
-    return canonicalTarget;
-}
-export async function inspectManifestBackedFile(file, signal) {
-    if (signal.aborted)
-        throw signal.reason ?? new DOMException("The operation was aborted", "AbortError");
-    const path = manifestBackedFilePath(file);
-    if (signal.aborted)
-        throw signal.reason ?? new DOMException("The operation was aborted", "AbortError");
-    const canonicalPath = await inspectPath(resolve(file.root), path);
-    if (signal.aborted)
-        throw signal.reason ?? new DOMException("The operation was aborted", "AbortError");
-    return Object.freeze({ path, canonicalPath });
-}
-/** Shared exact-file read used by the existing inspection adapter. */
-export async function readManifestBackedFile(file, limitBytes, sha256, signal) {
-    const inspected = await inspectManifestBackedFile(file, signal);
-    const entry = assertEntry(file.entry);
-    if (!Number.isSafeInteger(limitBytes) || limitBytes <= 0)
-        throw new ManifestBackedFileError("unreadable", "manifest content limit is invalid");
-    if (entry.size > limitBytes)
-        throw new ManifestBackedFileError("mutated", "manifest file exceeds its configured read limit");
-    let handle;
-    try {
-        // O_NOFOLLOW closes the final-component race between inspection and open.
-        handle = await open(inspected.path, constants.O_RDONLY | constants.O_NOFOLLOW);
-        if (signal.aborted)
-            throw signal.reason ?? new DOMException("The operation was aborted", "AbortError");
-        const stats = await handle.stat();
-        if (!stats.isFile() || stats.size !== entry.size || stats.size > limitBytes) {
-            throw new ManifestBackedFileError("mutated", "manifest file changed after inspection");
-        }
-        const bytes = new Uint8Array(entry.size);
-        let offset = 0;
-        while (offset < bytes.byteLength) {
-            if (signal.aborted)
-                throw signal.reason ?? new DOMException("The operation was aborted", "AbortError");
-            const result = await handle.read(bytes, offset, Math.min(CHUNK_SIZE, bytes.byteLength - offset), offset);
-            if (result.bytesRead <= 0)
-                throw new ManifestBackedFileError("mutated", "manifest file ended before its declared size");
-            offset += result.bytesRead;
-        }
-        if (signal.aborted)
-            throw signal.reason ?? new DOMException("The operation was aborted", "AbortError");
-        if (hashContent(bytes, sha256) !== entry.digest)
-            throw new ManifestBackedFileError("mutated", "manifest file digest does not match");
-        return bytes;
-    }
-    catch (error) {
-        if (error instanceof ManifestBackedFileError || (error !== null && typeof error === "object" && "name" in error && error.name === "AbortError"))
-            throw error;
-        throw classifyFsError(error);
-    }
-    finally {
-        if (handle !== undefined)
-            await handle.close().catch((error) => { throw classifyFsError(error); });
-    }
-}
-//# sourceMappingURL=manifest-backed-file.js.map

package/node_modules/@nklisch/pi-plugins/dist/infrastructure/filesystem/manifest-backed-file.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"manifest-backed-file.js","sourceRoot":"","sources":["../../../src/infrastructure/filesystem/manifest-backed-file.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,SAAS,CAAC;AACpC,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AACzD,OAAO,EAAE,UAAU,EAAE,OAAO,EAAE,GAAG,EAAE,MAAM,WAAW,CAAC;AACrD,OAAO,EACL,0BAA0B,EAC1B,WAAW,EACX,oBAAoB,GAErB,MAAM,kCAAkC,CAAC;AAI1C,MAAM,UAAU,GAAG,EAAE,GAAG,IAAI,CAAC;AAI7B,MAAM,OAAO,uBAAwB,SAAQ,KAAK;IAC3B,IAAI;IAAzB,YAAqB,IAAmC,EAAE,OAAe,EAAE,OAAsB;QAC/F,KAAK,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;oBADL,IAAI;QAEvB,IAAI,CAAC,IAAI,GAAG,yBAAyB,CAAC;IACxC,CAAC;CACF;AAED,SAAS,eAAe,CAAC,KAAc,EAAE,IAAI,GAAkC,YAAY;IACzF,IAAI,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,MAAM,IAAI,KAAK,IAAK,KAA4B,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;QACtH,OAAO,IAAI,uBAAuB,CAAC,SAAS,EAAE,iCAAiC,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,CAAC;IACrG,CAAC;IACD,OAAO,IAAI,uBAAuB,CAAC,IAAI,EAAE,6CAA6C,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,CAAC;AAC5G,CAAC;AAED,SAAS,UAAU,CAAC,IAAY;IAC9B,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;QACvE,MAAM,IAAI,uBAAuB,CAAC,QAAQ,EAAE,8CAA8C,CAAC,CAAC;IAC9F,CAAC;IACD,OAAO,OAAO,CAAC,IAAI,CAAC,CAAC;AACvB,CAAC;AAED,SAAS,WAAW,CAAC,KAA2B;IAC9C,MAAM,MAAM,GAAG,0BAA0B,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;IACvD,IAAI,MAAM,CAAC,IAAI,KAAK,MAAM;QAAE,MAAM,IAAI,uBAAuB,CAAC,SAAS,EAAE,qCAAqC,CAAC,CAAC;IAChH,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,MAAM,UAAU,sBAAsB,CAAC,IAAqB;IAC1D,MAAM,IAAI,GAAG,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACnC,MAAM,KAAK,GAAG,WAAW,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IACtC,IAAI,UAAkB,CAAC;IACvB,IAAI,CAAC;QACH,UAAU,GAAG,oBAAoB,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IAChD,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,IAAI,uBAAuB,CAAC,QAAQ,EAAE,wCAAwC,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,CAAC;IAC1G,CAAC;IACD,MAAM,SAAS,GAAG,OAAO,CAAC,IAAI,EAAE,GAAG,UAAU,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC;IAC1D,MAAM,MAAM,GAAG,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,IAAI,GAAG,GAAG,EAAE,CAAC;IAC3D,IAAI,SAAS,KAAK,IAAI,IAAI,CAAC,SAAS,CAAC,UAAU,CAAC,MAAM,CAAC,EAAE,CAAC;QACxD,MAAM,IAAI,uBAAuB,CAAC,QAAQ,EAAE,+CAA+C,CAAC,CAAC;IAC/F,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,KAAK,UAAU,WAAW,CAAC,IAAY,EAAE,MAAc;IACrD,IAAI,QAAQ,CAAC;IACb,IAAI,CAAC;QACH,QAAQ,GAAG,MAAM,KAAK,CAAC,IAAI,CAAC,CAAC;IAC/B,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,eAAe,CAAC,KAAK,CAAC,CAAC;IAC/B,CAAC;IACD,IAAI,QAAQ,CAAC,cAAc,EAAE,IAAI,CAAC,QAAQ,CAAC,WAAW,EAAE,EAAE,CAAC;QACzD,MAAM,IAAI,uBAAuB,CAAC,QAAQ,EAAE,sDAAsD,CAAC,CAAC;IACtG,CAAC;IACD,IAAI,aAAqB,CAAC;IAC1B,IAAI,CAAC;QACH,aAAa,GAAG,MAAM,QAAQ,CAAC,IAAI,CAAC,CAAC;IACvC,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,eAAe,CAAC,KAAK,CAAC,CAAC;IAC/B,CAAC;IACD,IAAI,aAAa,KAAK,IAAI,EAAE,CAAC;QAC3B,MAAM,IAAI,uBAAuB,CAAC,QAAQ,EAAE,+CAA+C,CAAC,CAAC;IAC/F,CAAC;IAED,MAAM,QAAQ,GAAG,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,OAAO,CAAC,UAAU,EAAE,EAAE,CAAC,CAAC;IACnE,IAAI,OAAO,GAAG,IAAI,CAAC;IACnB,KAAK,MAAM,OAAO,IAAI,QAAQ,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC;QAC1C,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC;YAAE,SAAS;QACnC,OAAO,GAAG,OAAO,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;QACpC,IAAI,KAAK,CAAC;QACV,IAAI,CAAC;YACH,KAAK,GAAG,MAAM,KAAK,CAAC,OAAO,CAAC,CAAC;QAC/B,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,eAAe,CAAC,KAAK,CAAC,CAAC;QAC/B,CAAC;QACD,IAAI,KAAK,CAAC,cAAc,EAAE,EAAE,CAAC;YAC3B,MAAM,IAAI,uBAAuB,CAAC,QAAQ,EAAE,iDAAiD,CAAC,CAAC;QACjG,CAAC;QACD,IAAI,OAAO,KAAK,MAAM,IAAI,CAAC,KAAK,CAAC,WAAW,EAAE,EAAE,CAAC;YAC/C,MAAM,IAAI,uBAAuB,CAAC,SAAS,EAAE,qDAAqD,CAAC,CAAC;QACtG,CAAC;IACH,CAAC;IACD,IAAI,UAAU,CAAC;IACf,IAAI,CAAC;QACH,UAAU,GAAG,MAAM,KAAK,CAAC,MAAM,CAAC,CAAC;IACnC,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,eAAe,CAAC,KAAK,CAAC,CAAC;IAC/B,CAAC;IACD,IAAI,UAAU,CAAC,cAAc,EAAE;QAAE,MAAM,IAAI,uBAAuB,CAAC,QAAQ,EAAE,6CAA6C,CAAC,CAAC;IAC5H,IAAI,CAAC,UAAU,CAAC,MAAM,EAAE;QAAE,MAAM,IAAI,uBAAuB,CAAC,SAAS,EAAE,sDAAsD,CAAC,CAAC;IAC/H,IAAI,eAAuB,CAAC;IAC5B,IAAI,CAAC;QACH,eAAe,GAAG,MAAM,QAAQ,CAAC,MAAM,CAAC,CAAC;IAC3C,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,eAAe,CAAC,KAAK,CAAC,CAAC;IAC/B,CAAC;IACD,MAAM,UAAU,GAAG,aAAa,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,GAAG,aAAa,GAAG,GAAG,EAAE,CAAC;IAC1F,IAAI,eAAe,KAAK,MAAM,IAAI,CAAC,eAAe,CAAC,UAAU,CAAC,UAAU,CAAC,EAAE,CAAC;QAC1E,MAAM,IAAI,uBAAuB,CAAC,QAAQ,EAAE,iDAAiD,CAAC,CAAC;IACjG,CAAC;IACD,OAAO,eAAe,CAAC;AACzB,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,yBAAyB,CAAC,IAAqB,EAAE,MAAmB;IACxF,IAAI,MAAM,CAAC,OAAO;QAAE,MAAM,MAAM,CAAC,MAAM,IAAI,IAAI,YAAY,CAAC,2BAA2B,EAAE,YAAY,CAAC,CAAC;IACvG,MAAM,IAAI,GAAG,sBAAsB,CAAC,IAAI,CAAC,CAAC;IAC1C,IAAI,MAAM,CAAC,OAAO;QAAE,MAAM,MAAM,CAAC,MAAM,IAAI,IAAI,YAAY,CAAC,2BAA2B,EAAE,YAAY,CAAC,CAAC;IACvG,MAAM,aAAa,GAAG,MAAM,WAAW,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,IAAI,CAAC,CAAC;IAClE,IAAI,MAAM,CAAC,OAAO;QAAE,MAAM,MAAM,CAAC,MAAM,IAAI,IAAI,YAAY,CAAC,2BAA2B,EAAE,YAAY,CAAC,CAAC;IACvG,OAAO,MAAM,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,aAAa,EAAE,CAAC,CAAC;AAChD,CAAC;AAED,sEAAsE;AACtE,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAAC,IAAqB,EAAE,UAAkB,EAAE,MAAc,EAAE,MAAmB;IACzH,MAAM,SAAS,GAAG,MAAM,yBAAyB,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;IAChE,MAAM,KAAK,GAAG,WAAW,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IACtC,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,UAAU,CAAC,IAAI,UAAU,IAAI,CAAC;QAAE,MAAM,IAAI,uBAAuB,CAAC,YAAY,EAAE,mCAAmC,CAAC,CAAC;IAC/I,IAAI,KAAK,CAAC,IAAI,GAAG,UAAU;QAAE,MAAM,IAAI,uBAAuB,CAAC,SAAS,EAAE,iDAAiD,CAAC,CAAC;IAC7H,IAAI,MAAoD,CAAC;IACzD,IAAI,CAAC;QACH,0EAA0E;QAC1E,MAAM,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,IAAI,EAAE,SAAS,CAAC,QAAQ,GAAG,SAAS,CAAC,UAAU,CAAC,CAAC;QAC/E,IAAI,MAAM,CAAC,OAAO;YAAE,MAAM,MAAM,CAAC,MAAM,IAAI,IAAI,YAAY,CAAC,2BAA2B,EAAE,YAAY,CAAC,CAAC;QACvG,MAAM,KAAK,GAAG,MAAM,MAAM,CAAC,IAAI,EAAE,CAAC;QAClC,IAAI,CAAC,KAAK,CAAC,MAAM,EAAE,IAAI,KAAK,CAAC,IAAI,KAAK,KAAK,CAAC,IAAI,IAAI,KAAK,CAAC,IAAI,GAAG,UAAU,EAAE,CAAC;YAC5E,MAAM,IAAI,uBAAuB,CAAC,SAAS,EAAE,wCAAwC,CAAC,CAAC;QACzF,CAAC;QACD,MAAM,KAAK,GAAG,IAAI,UAAU,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QACzC,IAAI,MAAM,GAAG,CAAC,CAAC;QACf,OAAO,MAAM,GAAG,KAAK,CAAC,UAAU,EAAE,CAAC;YACjC,IAAI,MAAM,CAAC,OAAO;gBAAE,MAAM,MAAM,CAAC,MAAM,IAAI,IAAI,YAAY,CAAC,2BAA2B,EAAE,YAAY,CAAC,CAAC;YACvG,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,IAAI,CAAC,KAAK,EAAE,MAAM,EAAE,IAAI,CAAC,GAAG,CAAC,UAAU,EAAE,KAAK,CAAC,UAAU,GAAG,MAAM,CAAC,EAAE,MAAM,CAAC,CAAC;YACzG,IAAI,MAAM,CAAC,SAAS,IAAI,CAAC;gBAAE,MAAM,IAAI,uBAAuB,CAAC,SAAS,EAAE,8CAA8C,CAAC,CAAC;YACxH,MAAM,IAAI,MAAM,CAAC,SAAS,CAAC;QAC7B,CAAC;QACD,IAAI,MAAM,CAAC,OAAO;YAAE,MAAM,MAAM,CAAC,MAAM,IAAI,IAAI,YAAY,CAAC,2BAA2B,EAAE,YAAY,CAAC,CAAC;QACvG,IAAI,WAAW,CAAC,KAAK,EAAE,MAAM,CAAC,KAAK,KAAK,CAAC,MAAM;YAAE,MAAM,IAAI,uBAAuB,CAAC,SAAS,EAAE,qCAAqC,CAAC,CAAC;QACrI,OAAO,KAAK,CAAC;IACf,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,KAAK,YAAY,uBAAuB,IAAI,CAAC,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,MAAM,IAAI,KAAK,IAAK,KAA4B,CAAC,IAAI,KAAK,YAAY,CAAC;YAAE,MAAM,KAAK,CAAC;QACrL,MAAM,eAAe,CAAC,KAAK,CAAC,CAAC;IAC/B,CAAC;YAAS,CAAC;QACT,IAAI,MAAM,KAAK,SAAS;YAAE,MAAM,MAAM,CAAC,KAAK,EAAE,CAAC,KAAK,CAAC,CAAC,KAAK,EAAE,EAAE,GAAG,MAAM,eAAe,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IACrG,CAAC;AACH,CAAC"}

package/node_modules/@nklisch/pi-plugins/dist/infrastructure/filesystem/manifest-content-reader.d.ts

@@ -1,7 +0,0 @@
-import type { Sha256 } from "../../domain/source.js";
-import type { ContentReadPort } from "../../application/ports/content-read.js";
-/**
- * Node adapter for the exact content-read port. The shared helper owns all
- * containment, no-symlink, no-follow, bounded-read, and digest mechanics.
- */
-export declare function createManifestContentReader(sha256: Sha256): ContentReadPort;

package/node_modules/@nklisch/pi-plugins/dist/infrastructure/filesystem/manifest-content-reader.js

@@ -1,55 +0,0 @@
-import { BoundaryError, ErrorCodeRegistry } from "../../domain/errors.js";
-import { ManifestBackedFileError, readManifestBackedFile, } from "./manifest-backed-file.js";
-const OPERATION = "readManifestContentFile";
-function pathBoundary(message, cause) {
-    return new BoundaryError({
-        code: ErrorCodeRegistry.pathContainmentFailed,
-        operation: OPERATION,
-        message,
-        details: { operation: OPERATION, failureKind: "escape" },
-        cause,
-    });
-}
-function adapterBoundary(cause, failureKind = "unreadable") {
-    return new BoundaryError({
-        code: ErrorCodeRegistry.adapterFailed,
-        operation: OPERATION,
-        message: "manifest-backed content adapter failed",
-        details: { operation: OPERATION, failureKind },
-        cause,
-    });
-}
-function mapFailure(error) {
-    if (error instanceof ManifestBackedFileError) {
-        if (error.kind === "escape")
-            return pathBoundary("manifest-backed content path is outside its root", error);
-        return adapterBoundary(error, error.kind);
-    }
-    if (error instanceof BoundaryError)
-        return error;
-    return adapterBoundary(error);
-}
-/**
- * Node adapter for the exact content-read port. The shared helper owns all
- * containment, no-symlink, no-follow, bounded-read, and digest mechanics.
- */
-export function createManifestContentReader(sha256) {
-    if (typeof sha256 !== "function")
-        throw new TypeError("manifest content reader requires a SHA-256 function");
-    return {
-        async readFile(file, limitBytes, signal) {
-            if (signal.aborted)
-                throw signal.reason ?? new DOMException("The operation was aborted", "AbortError");
-            try {
-                return await readManifestBackedFile(file, limitBytes, sha256, signal);
-            }
-            catch (error) {
-                if (signal.aborted || (error !== null && typeof error === "object" && "name" in error && error.name === "AbortError")) {
-                    throw signal.reason ?? error;
-                }
-                throw mapFailure(error);
-            }
-        },
-    };
-}
-//# sourceMappingURL=manifest-content-reader.js.map

package/node_modules/@nklisch/pi-plugins/dist/infrastructure/filesystem/manifest-content-reader.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"manifest-content-reader.js","sourceRoot":"","sources":["../../../src/infrastructure/filesystem/manifest-content-reader.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,iBAAiB,EAAE,MAAM,wBAAwB,CAAC;AAM1E,OAAO,EACL,uBAAuB,EACvB,sBAAsB,GACvB,MAAM,2BAA2B,CAAC;AAEnC,MAAM,SAAS,GAAG,yBAAyB,CAAC;AAE5C,SAAS,YAAY,CAAC,OAAe,EAAE,KAAe;IACpD,OAAO,IAAI,aAAa,CAAC;QACvB,IAAI,EAAE,iBAAiB,CAAC,qBAAqB;QAC7C,SAAS,EAAE,SAAS;QACpB,OAAO;QACP,OAAO,EAAE,EAAE,SAAS,EAAE,SAAS,EAAE,WAAW,EAAE,QAAQ,EAAE;QACxD,KAAK;KACN,CAAC,CAAC;AACL,CAAC;AAED,SAAS,eAAe,CAAC,KAAe,EAAE,WAAW,GAAyC,YAAY;IACxG,OAAO,IAAI,aAAa,CAAC;QACvB,IAAI,EAAE,iBAAiB,CAAC,aAAa;QACrC,SAAS,EAAE,SAAS;QACpB,OAAO,EAAE,wCAAwC;QACjD,OAAO,EAAE,EAAE,SAAS,EAAE,SAAS,EAAE,WAAW,EAAE;QAC9C,KAAK;KACN,CAAC,CAAC;AACL,CAAC;AAED,SAAS,UAAU,CAAC,KAAc;IAChC,IAAI,KAAK,YAAY,uBAAuB,EAAE,CAAC;QAC7C,IAAI,KAAK,CAAC,IAAI,KAAK,QAAQ;YAAE,OAAO,YAAY,CAAC,kDAAkD,EAAE,KAAK,CAAC,CAAC;QAC5G,OAAO,eAAe,CAAC,KAAK,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC;IAC5C,CAAC;IACD,IAAI,KAAK,YAAY,aAAa;QAAE,OAAO,KAAK,CAAC;IACjD,OAAO,eAAe,CAAC,KAAK,CAAC,CAAC;AAChC,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,2BAA2B,CAAC,MAAc;IACxD,IAAI,OAAO,MAAM,KAAK,UAAU;QAAE,MAAM,IAAI,SAAS,CAAC,qDAAqD,CAAC,CAAC;IAE7G,OAAO;QACL,KAAK,CAAC,QAAQ,CAAC,IAAqB,EAAE,UAAkB,EAAE,MAAmB;YAC3E,IAAI,MAAM,CAAC,OAAO;gBAAE,MAAM,MAAM,CAAC,MAAM,IAAI,IAAI,YAAY,CAAC,2BAA2B,EAAE,YAAY,CAAC,CAAC;YACvG,IAAI,CAAC;gBACH,OAAO,MAAM,sBAAsB,CAAC,IAAI,EAAE,UAAU,EAAE,MAAM,EAAE,MAAM,CAAC,CAAC;YACxE,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,IAAI,MAAM,CAAC,OAAO,IAAI,CAAC,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,MAAM,IAAI,KAAK,IAAK,KAA4B,CAAC,IAAI,KAAK,YAAY,CAAC,EAAE,CAAC;oBAC9I,MAAM,MAAM,CAAC,MAAM,IAAI,KAAK,CAAC;gBAC/B,CAAC;gBACD,MAAM,UAAU,CAAC,KAAK,CAAC,CAAC;YAC1B,CAAC;QACH,CAAC;KACF,CAAC;AACJ,CAAC"}

package/node_modules/@nklisch/pi-plugins/dist/infrastructure/filesystem/manifest-skill-path-verifier.d.ts

@@ -1,6 +0,0 @@
-import type { ContentReadPort } from "../../application/ports/content-read.js";
-import type { SkillResourcePathPort } from "../../application/ports/skill-resource-path.js";
-/** Verify exactly one manifest-selected skill file; no skill metadata is parsed. */
-export declare function createManifestSkillPathVerifier(dependencies: Readonly<{
-    content: ContentReadPort;
-}>): SkillResourcePathPort;

package/node_modules/@nklisch/pi-plugins/dist/infrastructure/filesystem/manifest-skill-path-verifier.js

@@ -1,73 +0,0 @@
-import { ContentManifestEntrySchema } from "../../domain/content-manifest.js";
-import { BoundaryError } from "../../domain/errors.js";
-import { ManifestBackedFileError, inspectManifestBackedFile, } from "./manifest-backed-file.js";
-function cancelled(signal) {
-    if (!signal.aborted)
-        return { kind: "cancelled" };
-    return { kind: "cancelled" };
-}
-function mapFailure(error) {
-    if (error instanceof ManifestBackedFileError) {
-        switch (error.kind) {
-            case "missing": return { kind: "failed", code: "ROOT_MISSING" };
-            case "escape": return { kind: "failed", code: "ROOT_ESCAPE" };
-            case "mutated": return { kind: "failed", code: "ROOT_MUTATED" };
-            case "unreadable": return { kind: "failed", code: "ROOT_UNREADABLE" };
-        }
-    }
-    if (error instanceof BoundaryError) {
-        const details = error.details;
-        if (details !== undefined && details !== null && typeof details === "object" && !Array.isArray(details) && "failureKind" in details) {
-            switch (details.failureKind) {
-                case "missing": return { kind: "failed", code: "ROOT_MISSING" };
-                case "mutated": return { kind: "failed", code: "ROOT_MUTATED" };
-                case "escape": return { kind: "failed", code: "ROOT_ESCAPE" };
-                case "unreadable": return { kind: "failed", code: "ROOT_UNREADABLE" };
-            }
-        }
-        return { kind: "failed", code: error.code === "PATH_CONTAINMENT_FAILED" ? "ROOT_ESCAPE" : "ROOT_UNREADABLE" };
-    }
-    return { kind: "failed", code: "ROOT_UNREADABLE" };
-}
-function isAbort(error, signal) {
-    return signal.aborted || (error !== null && typeof error === "object" && "name" in error && error.name === "AbortError");
-}
-/** Verify exactly one manifest-selected skill file; no skill metadata is parsed. */
-export function createManifestSkillPathVerifier(dependencies) {
-    if (dependencies === null || typeof dependencies !== "object" || dependencies.content === null || typeof dependencies.content.readFile !== "function") {
-        throw new TypeError("manifest skill path verifier requires a content reader");
-    }
-    async function verify(fileInput, signal) {
-        try {
-            if (signal.aborted)
-                return cancelled(signal);
-            const entry = ContentManifestEntrySchema.parse(fileInput.entry);
-            if (entry.kind !== "file")
-                return { kind: "failed", code: "ROOT_MUTATED" };
-            const file = { root: fileInput.root, entry };
-            const inspected = await inspectManifestBackedFile(file, signal);
-            if (signal.aborted)
-                return cancelled(signal);
-            const bytes = await dependencies.content.readFile(file, Math.max(entry.size, 1), signal);
-            if (signal.aborted)
-                return cancelled(signal);
-            if (bytes.byteLength !== entry.size) {
-                return { kind: "failed", code: "ROOT_MUTATED" };
-            }
-            // The content port contract guarantees digest verification. Re-open the
-            // exact file through the shared no-follow helper to close a verification
-            // to contribution race before exposing the ephemeral path.
-            const final = await inspectManifestBackedFile(file, signal);
-            if (signal.aborted)
-                return cancelled(signal);
-            return { kind: "ready", value: { path: final.path, canonicalPath: final.canonicalPath } };
-        }
-        catch (error) {
-            if (isAbort(error, signal))
-                return cancelled(signal);
-            return mapFailure(error);
-        }
-    }
-    return Object.freeze({ verify });
-}
-//# sourceMappingURL=manifest-skill-path-verifier.js.map

package/node_modules/@nklisch/pi-plugins/dist/infrastructure/filesystem/manifest-skill-path-verifier.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"manifest-skill-path-verifier.js","sourceRoot":"","sources":["../../../src/infrastructure/filesystem/manifest-skill-path-verifier.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,0BAA0B,EAAE,MAAM,kCAAkC,CAAC;AAC9E,OAAO,EAAE,aAAa,EAAE,MAAM,wBAAwB,CAAC;AAMvD,OAAO,EACL,uBAAuB,EACvB,yBAAyB,GAC1B,MAAM,2BAA2B,CAAC;AAEnC,SAAS,SAAS,CAAC,MAAmB;IACpC,IAAI,CAAC,MAAM,CAAC,OAAO;QAAE,OAAO,EAAE,IAAI,EAAE,WAAW,EAAE,CAAC;IAClD,OAAO,EAAE,IAAI,EAAE,WAAW,EAAE,CAAC;AAC/B,CAAC;AAED,SAAS,UAAU,CAAC,KAAc;IAChC,IAAI,KAAK,YAAY,uBAAuB,EAAE,CAAC;QAC7C,QAAQ,KAAK,CAAC,IAAI,EAAE,CAAC;YACnB,KAAK,SAAS,EAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,cAAc,EAAE,CAAC;YAChE,KAAK,QAAQ,EAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,aAAa,EAAE,CAAC;YAC9D,KAAK,SAAS,EAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,cAAc,EAAE,CAAC;YAChE,KAAK,YAAY,EAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,iBAAiB,EAAE,CAAC;QACxE,CAAC;IACH,CAAC;IACD,IAAI,KAAK,YAAY,aAAa,EAAE,CAAC;QACnC,MAAM,OAAO,GAAG,KAAK,CAAC,OAAO,CAAC;QAC9B,IAAI,OAAO,KAAK,SAAS,IAAI,OAAO,KAAK,IAAI,IAAI,OAAO,OAAO,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,IAAI,aAAa,IAAI,OAAO,EAAE,CAAC;YACpI,QAAQ,OAAO,CAAC,WAAW,EAAE,CAAC;gBAC5B,KAAK,SAAS,EAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,cAAc,EAAE,CAAC;gBAChE,KAAK,SAAS,EAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,cAAc,EAAE,CAAC;gBAChE,KAAK,QAAQ,EAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,aAAa,EAAE,CAAC;gBAC9D,KAAK,YAAY,EAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,iBAAiB,EAAE,CAAC;YACxE,CAAC;QACH,CAAC;QACD,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,KAAK,yBAAyB,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,iBAAiB,EAAE,CAAC;IAChH,CAAC;IACD,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,iBAAiB,EAAE,CAAC;AACrD,CAAC;AAED,SAAS,OAAO,CAAC,KAAc,EAAE,MAAmB;IAClD,OAAO,MAAM,CAAC,OAAO,IAAI,CAAC,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,MAAM,IAAI,KAAK,IAAK,KAA4B,CAAC,IAAI,KAAK,YAAY,CAAC,CAAC;AACnJ,CAAC;AAED,oFAAoF;AACpF,MAAM,UAAU,+BAA+B,CAAC,YAE9C;IACA,IAAI,YAAY,KAAK,IAAI,IAAI,OAAO,YAAY,KAAK,QAAQ,IAAI,YAAY,CAAC,OAAO,KAAK,IAAI,IAAI,OAAO,YAAY,CAAC,OAAO,CAAC,QAAQ,KAAK,UAAU,EAAE,CAAC;QACtJ,MAAM,IAAI,SAAS,CAAC,wDAAwD,CAAC,CAAC;IAChF,CAAC;IAED,KAAK,UAAU,MAAM,CAAC,SAA0B,EAAE,MAAmB;QACnE,IAAI,CAAC;YACH,IAAI,MAAM,CAAC,OAAO;gBAAE,OAAO,SAAS,CAAC,MAAM,CAAC,CAAC;YAC7C,MAAM,KAAK,GAAG,0BAA0B,CAAC,KAAK,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;YAChE,IAAI,KAAK,CAAC,IAAI,KAAK,MAAM;gBAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,cAAc,EAAE,CAAC;YAC3E,MAAM,IAAI,GAAG,EAAE,IAAI,EAAE,SAAS,CAAC,IAAI,EAAE,KAAK,EAA4B,CAAC;YACvE,MAAM,SAAS,GAAG,MAAM,yBAAyB,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;YAChE,IAAI,MAAM,CAAC,OAAO;gBAAE,OAAO,SAAS,CAAC,MAAM,CAAC,CAAC;YAC7C,MAAM,KAAK,GAAG,MAAM,YAAY,CAAC,OAAO,CAAC,QAAQ,CAAC,IAAI,EAAE,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC;YACzF,IAAI,MAAM,CAAC,OAAO;gBAAE,OAAO,SAAS,CAAC,MAAM,CAAC,CAAC;YAC7C,IAAI,KAAK,CAAC,UAAU,KAAK,KAAK,CAAC,IAAI,EAAE,CAAC;gBACpC,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,cAAc,EAAE,CAAC;YAClD,CAAC;YACD,wEAAwE;YACxE,yEAAyE;YACzE,2DAA2D;YAC3D,MAAM,KAAK,GAAG,MAAM,yBAAyB,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;YAC5D,IAAI,MAAM,CAAC,OAAO;gBAAE,OAAO,SAAS,CAAC,MAAM,CAAC,CAAC;YAC7C,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,aAAa,EAAE,KAAK,CAAC,aAAa,EAAE,EAAE,CAAC;QAC5F,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,OAAO,CAAC,KAAK,EAAE,MAAM,CAAC;gBAAE,OAAO,SAAS,CAAC,MAAM,CAAC,CAAC;YACrD,OAAO,UAAU,CAAC,KAAK,CAAC,CAAC;QAC3B,CAAC;IACH,CAAC;IAED,OAAO,MAAM,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC;AACnC,CAAC"}

package/node_modules/@nklisch/pi-plugins/dist/infrastructure/filesystem/marketplace-local-source.d.ts

@@ -1,3 +0,0 @@
-import type { MarketplaceLocalSourcePort } from "../../application/ports/marketplace-registration.js";
-/** Canonicalize one explicitly approved user-local Git root without following a symlink leaf. */
-export declare function createNodeMarketplaceLocalSourcePort(): MarketplaceLocalSourcePort;

package/node_modules/@nklisch/pi-plugins/dist/infrastructure/filesystem/marketplace-local-source.js

@@ -1,24 +0,0 @@
-import { lstat, realpath } from "node:fs/promises";
-import { isAbsolute } from "node:path";
-import { MarketplaceSourceSchema } from "../../domain/source.js";
-/** Canonicalize one explicitly approved user-local Git root without following a symlink leaf. */
-export function createNodeMarketplaceLocalSourcePort() {
-    const port = {
-        async canonicalize(source, signal) {
-            signal.throwIfAborted();
-            if (!isAbsolute(source.path))
-                throw new Error("local marketplace path must be absolute");
-            const declared = await lstat(source.path);
-            if (declared.isSymbolicLink() || !declared.isDirectory())
-                throw new Error("local marketplace path must be a real directory");
-            const canonical = await realpath(source.path);
-            signal.throwIfAborted();
-            const target = await lstat(canonical);
-            if (target.isSymbolicLink() || !target.isDirectory())
-                throw new Error("local marketplace path must be a real directory");
-            return MarketplaceSourceSchema.parse({ ...source, path: canonical });
-        },
-    };
-    return Object.freeze(port);
-}
-//# sourceMappingURL=marketplace-local-source.js.map

package/node_modules/@nklisch/pi-plugins/dist/infrastructure/filesystem/marketplace-local-source.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"marketplace-local-source.js","sourceRoot":"","sources":["../../../src/infrastructure/filesystem/marketplace-local-source.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AACnD,OAAO,EAAE,UAAU,EAAE,MAAM,WAAW,CAAC;AACvC,OAAO,EAAE,uBAAuB,EAAE,MAAM,wBAAwB,CAAC;AAGjE,iGAAiG;AACjG,MAAM,UAAU,oCAAoC;IAClD,MAAM,IAAI,GAA+B;QACvC,KAAK,CAAC,YAAY,CAAC,MAAM,EAAE,MAAM;YAC/B,MAAM,CAAC,cAAc,EAAE,CAAC;YACxB,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,IAAI,CAAC;gBAAE,MAAM,IAAI,KAAK,CAAC,yCAAyC,CAAC,CAAC;YACzF,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;YAC1C,IAAI,QAAQ,CAAC,cAAc,EAAE,IAAI,CAAC,QAAQ,CAAC,WAAW,EAAE;gBAAE,MAAM,IAAI,KAAK,CAAC,iDAAiD,CAAC,CAAC;YAC7H,MAAM,SAAS,GAAG,MAAM,QAAQ,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;YAC9C,MAAM,CAAC,cAAc,EAAE,CAAC;YACxB,MAAM,MAAM,GAAG,MAAM,KAAK,CAAC,SAAS,CAAC,CAAC;YACtC,IAAI,MAAM,CAAC,cAAc,EAAE,IAAI,CAAC,MAAM,CAAC,WAAW,EAAE;gBAAE,MAAM,IAAI,KAAK,CAAC,iDAAiD,CAAC,CAAC;YACzH,OAAO,uBAAuB,CAAC,KAAK,CAAC,EAAE,GAAG,MAAM,EAAE,IAAI,EAAE,SAAS,EAAE,CAAkD,CAAC;QACxH,CAAC;KACF,CAAC;IACF,OAAO,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;AAC7B,CAAC"}

package/node_modules/@nklisch/pi-plugins/dist/infrastructure/filesystem/persistent-data-removal.d.ts

@@ -1,8 +0,0 @@
-import type { Sha256 } from "../../domain/source.js";
-import type { PersistentDataRemovalPort } from "../../application/ports/persistent-data-removal.js";
-import type { ContentStoreLayout } from "./content-store-layout.js";
-/** Remove only the digest-addressed data root proven by scope/plugin/ref evidence. */
-export declare function createNodePersistentDataRemovalPort(input: Readonly<{
-    layout: ContentStoreLayout;
-    sha256: Sha256;
-}>): PersistentDataRemovalPort;

package/node_modules/@nklisch/pi-plugins/dist/infrastructure/filesystem/persistent-data-removal.js

@@ -1,37 +0,0 @@
-import { lstat, realpath, rm } from "node:fs/promises";
-import { dirname } from "node:path";
-import { derivePluginDataRef } from "../../domain/state/references.js";
-/** Remove only the digest-addressed data root proven by scope/plugin/ref evidence. */
-export function createNodePersistentDataRemovalPort(input) {
-    return Object.freeze({
-        async remove(plan, signal) {
-            signal.throwIfAborted();
-            const expected = derivePluginDataRef({ scope: plan.scope, plugin: plan.plugin, purpose: "persistent-plugin-data" }, input.sha256);
-            if (plan.dataRef !== expected || plan.confirmation !== "delete-confirmed")
-                throw new Error("persistent data deletion evidence is invalid");
-            const path = input.layout.dataPath(plan.dataRef);
-            let stats;
-            try {
-                stats = await lstat(path);
-            }
-            catch (error) {
-                if (error.code === "ENOENT")
-                    return "already-absent";
-                throw error;
-            }
-            if (!stats.isDirectory() || stats.isSymbolicLink() || await realpath(path) !== path || await realpath(dirname(path)) !== dirname(path))
-                throw new Error("persistent data root is unsafe");
-            await rm(path, { recursive: true, force: false, maxRetries: 0 });
-            try {
-                await lstat(path);
-                throw new Error("persistent data root remains after deletion");
-            }
-            catch (error) {
-                if (error.code !== "ENOENT")
-                    throw error;
-            }
-            return "removed";
-        },
-    });
-}
-//# sourceMappingURL=persistent-data-removal.js.map

package/node_modules/@nklisch/pi-plugins/dist/infrastructure/filesystem/persistent-data-removal.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"persistent-data-removal.js","sourceRoot":"","sources":["../../../src/infrastructure/filesystem/persistent-data-removal.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,EAAE,QAAQ,EAAE,EAAE,EAAE,MAAM,kBAAkB,CAAC;AACvD,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACpC,OAAO,EAAE,mBAAmB,EAAE,MAAM,kCAAkC,CAAC;AAKvE,sFAAsF;AACtF,MAAM,UAAU,mCAAmC,CAAC,KAGlD;IACA,OAAO,MAAM,CAAC,MAAM,CAAC;QACnB,KAAK,CAAC,MAAM,CAAC,IAAwD,EAAE,MAAmB;YACxF,MAAM,CAAC,cAAc,EAAE,CAAC;YACxB,MAAM,QAAQ,GAAG,mBAAmB,CAAC,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,OAAO,EAAE,wBAAwB,EAAE,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;YAClI,IAAI,IAAI,CAAC,OAAO,KAAK,QAAQ,IAAI,IAAI,CAAC,YAAY,KAAK,kBAAkB;gBAAE,MAAM,IAAI,KAAK,CAAC,8CAA8C,CAAC,CAAC;YAC3I,MAAM,IAAI,GAAG,KAAK,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;YACjD,IAAI,KAAK,CAAC;YACV,IAAI,CAAC;gBAAC,KAAK,GAAG,MAAM,KAAK,CAAC,IAAI,CAAC,CAAC;YAAC,CAAC;YAClC,OAAO,KAAK,EAAE,CAAC;gBAAC,IAAK,KAA+B,CAAC,IAAI,KAAK,QAAQ;oBAAE,OAAO,gBAAgB,CAAC;gBAAC,MAAM,KAAK,CAAC;YAAC,CAAC;YAC/G,IAAI,CAAC,KAAK,CAAC,WAAW,EAAE,IAAI,KAAK,CAAC,cAAc,EAAE,IAAI,MAAM,QAAQ,CAAC,IAAI,CAAC,KAAK,IAAI,IAAI,MAAM,QAAQ,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,KAAK,OAAO,CAAC,IAAI,CAAC;gBAAE,MAAM,IAAI,KAAK,CAAC,gCAAgC,CAAC,CAAC;YAC1L,MAAM,EAAE,CAAC,IAAI,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,KAAK,EAAE,UAAU,EAAE,CAAC,EAAE,CAAC,CAAC;YACjE,IAAI,CAAC;gBAAC,MAAM,KAAK,CAAC,IAAI,CAAC,CAAC;gBAAC,MAAM,IAAI,KAAK,CAAC,6CAA6C,CAAC,CAAC;YAAC,CAAC;YAC1F,OAAO,KAAK,EAAE,CAAC;gBAAC,IAAK,KAA+B,CAAC,IAAI,KAAK,QAAQ;oBAAE,MAAM,KAAK,CAAC;YAAC,CAAC;YACtF,OAAO,SAAS,CAAC;QACnB,CAAC;KACF,CAAC,CAAC;AACL,CAAC"}

package/node_modules/@nklisch/pi-plugins/dist/infrastructure/filesystem/prepared-tree-cleanup.d.ts

@@ -1,11 +0,0 @@
-import { type RootCapability } from "./content-store-layout.js";
-export type PreparedTreeIdentity = Readonly<{
-    dev: number;
-    ino: number;
-}>;
-/**
- * Remove an adapter-owned prepared tree without following a substituted root.
- * The caller may provide the identity captured immediately after creation;
- * mismatches are reported instead of mutating a foreign directory.
- */
-export declare function removePreparedTree(path: string, expected?: PreparedTreeIdentity, parent?: RootCapability): Promise<"removed" | "already-absent">;

package/node_modules/@nklisch/pi-plugins/dist/infrastructure/filesystem/prepared-tree-cleanup.js

@@ -1,76 +0,0 @@
-import { chmod, lstat, readdir, rm } from "node:fs/promises";
-import { join } from "node:path";
-import { assertRootCapability } from "./content-store-layout.js";
-async function collectEntries(path, entries) {
-    const stat = await lstat(path);
-    if (stat.isSymbolicLink()) {
-        entries.push({ path, kind: "symlink", dev: stat.dev, ino: stat.ino });
-        return;
-    }
-    if (stat.isDirectory()) {
-        for (const child of await readdir(path)) {
-            await collectEntries(join(path, child), entries);
-        }
-        entries.push({ path, kind: "directory", dev: stat.dev, ino: stat.ino });
-        return;
-    }
-    entries.push({ path, kind: "file", dev: stat.dev, ino: stat.ino });
-}
-/** Restore permissions bottom-up before removing a sealed tree. */
-async function restorePermissions(path) {
-    const entries = [];
-    await collectEntries(path, entries);
-    for (const entry of entries) {
-        if (entry.kind === "symlink")
-            continue;
-        const current = await lstat(entry.path);
-        if (current.isSymbolicLink() || current.dev !== entry.dev || current.ino !== entry.ino) {
-            throw new Error("prepared cleanup entry identity changed");
-        }
-        if (entry.kind === "file")
-            await chmod(entry.path, 0o600);
-    }
-    for (const entry of entries) {
-        if (entry.kind !== "directory")
-            continue;
-        const current = await lstat(entry.path);
-        if (current.isSymbolicLink() || current.dev !== entry.dev || current.ino !== entry.ino) {
-            throw new Error("prepared cleanup entry identity changed");
-        }
-        await chmod(entry.path, 0o700);
-    }
-}
-/**
- * Remove an adapter-owned prepared tree without following a substituted root.
- * The caller may provide the identity captured immediately after creation;
- * mismatches are reported instead of mutating a foreign directory.
- */
-export async function removePreparedTree(path, expected, parent) {
-    if (parent !== undefined)
-        await assertRootCapability(parent, "removePreparedTree");
-    let stat;
-    try {
-        stat = await lstat(path);
-    }
-    catch (error) {
-        if (error.code === "ENOENT")
-            return "already-absent";
-        throw error;
-    }
-    if (!stat.isDirectory() || stat.isSymbolicLink()) {
-        throw new Error("prepared cleanup root is not an owned directory");
-    }
-    if (expected !== undefined && (stat.dev !== expected.dev || stat.ino !== expected.ino)) {
-        throw new Error("prepared cleanup root identity changed");
-    }
-    await restorePermissions(path);
-    if (parent !== undefined)
-        await assertRootCapability(parent, "removePreparedTree");
-    const final = await lstat(path);
-    if (final.isSymbolicLink() || !final.isDirectory() || (expected !== undefined && (final.dev !== expected.dev || final.ino !== expected.ino))) {
-        throw new Error("prepared cleanup root identity changed");
-    }
-    await rm(path, { recursive: true, force: false });
-    return "removed";
-}
-//# sourceMappingURL=prepared-tree-cleanup.js.map