@north-light/crouter 0.3.154

package/dist/core/events/serialize.js

@@ -0,0 +1,199 @@
+export const MAX_EVENT_RECORD_BYTES = 65_536;
+const MAX_STRING_BYTES = 4_096;
+const MAX_KEY_BYTES = 128;
+const MAX_ERROR_STACK_BYTES = 16_384;
+const MAX_DEPTH = 4;
+const MAX_MEMBERS = 64;
+// Bounds total normalize() work regardless of graph shape: MAX_DEPTH/MAX_MEMBERS
+// alone permit a tiny SHARED-reference graph (no cycle, so the WeakSet guard
+// never fires) to fan out combinatorially — e.g. four levels of 64 shared
+// children reach 64^4 visits. This budget caps total node visits so one event
+// cannot stall or exhaust its process regardless of how references are shared.
+const MAX_NORMALIZE_UNITS = 5_000;
+function byteLength(value) { return Buffer.byteLength(value, 'utf8'); }
+function truncate(value, cap) {
+    if (byteLength(value) <= cap)
+        return { value, altered: false };
+    const suffix = '…';
+    const target = cap - byteLength(suffix);
+    let used = 0;
+    let result = '';
+    for (const character of value) {
+        const size = byteLength(character);
+        if (used + size > target)
+            break;
+        result += character;
+        used += size;
+    }
+    return { value: result + suffix, altered: true };
+}
+function unsupported(value) {
+    if (value === undefined)
+        return '[Unsupported undefined]';
+    if (typeof value === 'function')
+        return `[Unsupported function${value.name ? ` ${value.name}` : ''}]`;
+    if (typeof value === 'symbol')
+        return `[Unsupported ${String(value)}]`;
+    return `[Unsupported ${value?.constructor?.name ?? typeof value}]`;
+}
+function normalize(value, depth, active, budget) {
+    if (budget.remaining <= 0)
+        return { value: '[Omitted]', altered: true, dropped: 0 };
+    budget.remaining -= 1;
+    if (value === null || typeof value === 'boolean')
+        return { value, altered: false, dropped: 0 };
+    if (typeof value === 'string') {
+        const limited = truncate(value, MAX_STRING_BYTES);
+        return { value: limited.value, altered: limited.altered, dropped: 0 };
+    }
+    if (typeof value === 'number')
+        return Number.isFinite(value) ? { value, altered: false, dropped: 0 } : { value: String(value), altered: true, dropped: 0 };
+    if (typeof value === 'bigint')
+        return { value: value.toString(), altered: true, dropped: 0 };
+    if (value instanceof Date) {
+        const rendered = Number.isNaN(value.getTime()) ? 'Invalid Date' : value.toISOString();
+        return { value: rendered, altered: true, dropped: 0 };
+    }
+    if (typeof value !== 'object' || value === undefined)
+        return { value: unsupported(value), altered: true, dropped: 0 };
+    if (active.has(value))
+        return { value: '[Circular]', altered: true, dropped: 0 };
+    if (depth >= MAX_DEPTH)
+        return { value: '[Max depth]', altered: true, dropped: 0 };
+    active.add(value);
+    try {
+        if (Array.isArray(value)) {
+            const count = Math.min(value.length, MAX_MEMBERS);
+            const items = [];
+            let altered = value.length > count;
+            let dropped = value.length - count;
+            for (let index = 0; index < count; index += 1) {
+                if (budget.remaining <= 0) {
+                    altered = true;
+                    dropped += count - index;
+                    break;
+                }
+                const item = normalize(value[index], depth + 1, active, budget);
+                items.push(item.value);
+                altered ||= item.altered;
+                dropped += item.dropped;
+            }
+            return { value: items, altered, dropped };
+        }
+        let keys;
+        try {
+            keys = Object.keys(value).sort();
+        }
+        catch {
+            return { value: '[Unsupported object]', altered: true, dropped: 0 };
+        }
+        const selected = keys.slice(0, MAX_MEMBERS);
+        const output = {};
+        let altered = keys.length > selected.length;
+        let dropped = keys.length - selected.length;
+        for (let index = 0; index < selected.length; index += 1) {
+            const key = selected[index];
+            if (budget.remaining <= 0) {
+                altered = true;
+                dropped += selected.length - index;
+                break;
+            }
+            const limitedKey = truncate(key, MAX_KEY_BYTES);
+            let child;
+            try {
+                child = normalize(value[key], depth + 1, active, budget);
+            }
+            catch {
+                child = { value: '[Unsupported property]', altered: true, dropped: 0 };
+            }
+            // Two distinct original keys can truncate to the same bounded key (e.g. two
+            // 200-byte keys sharing their first 127 bytes). Silently overwriting would
+            // under-report the omission; count the collision as dropped instead.
+            if (Object.prototype.hasOwnProperty.call(output, limitedKey.value)) {
+                altered = true;
+                dropped += 1;
+                continue;
+            }
+            output[limitedKey.value] = child.value;
+            altered ||= limitedKey.altered || child.altered;
+            dropped += child.dropped;
+        }
+        return { value: output, altered, dropped };
+    }
+    finally {
+        active.delete(value);
+    }
+}
+function normalizeError(error) {
+    const type = truncate(String(error.type), MAX_KEY_BYTES);
+    const message = truncate(String(error.message), MAX_STRING_BYTES);
+    const result = { type: type.value, message: message.value };
+    let altered = type.altered || message.altered;
+    if (error.stack !== undefined) {
+        const stack = truncate(String(error.stack), MAX_ERROR_STACK_BYTES);
+        result.stack = stack.value;
+        altered ||= stack.altered;
+    }
+    if (error.cause !== undefined) {
+        const cause = truncate(String(error.cause), MAX_STRING_BYTES);
+        result.cause = cause.value;
+        altered ||= cause.altered;
+    }
+    return { value: result, altered };
+}
+function encoded(value) { return JSON.stringify(value); }
+function recordBytes(value) { return byteLength(encoded(value)) + 1; }
+/** Serializes a bounded NDJSON record without its newline; appendRotatingRecord owns that byte. */
+export function serializeEventRecord(envelope) {
+    const normalizedFields = envelope.fields === undefined ? undefined : normalize(envelope.fields, 0, new WeakSet(), { remaining: MAX_NORMALIZE_UNITS });
+    const normalizedError = envelope.error === undefined ? undefined : normalizeError(envelope.error);
+    const record = {
+        v: 1,
+        ts: envelope.ts,
+        level: envelope.level,
+        event: envelope.event,
+        component: envelope.component,
+        operation_id: envelope.operation_id,
+        ...(envelope.node_id === undefined ? {} : { node_id: envelope.node_id }),
+        ...(envelope.stream_id === undefined ? {} : { stream_id: envelope.stream_id }),
+        ...(envelope.duration_ms === undefined ? {} : { duration_ms: envelope.duration_ms }),
+        ...(envelope.outcome === undefined ? {} : { outcome: envelope.outcome }),
+        ...(envelope.attempt === undefined ? {} : { attempt: envelope.attempt }),
+        ...(envelope.error_class === undefined ? {} : { error_class: envelope.error_class }),
+        ...(normalizedError === undefined ? {} : { error: normalizedError.value }),
+        ...(normalizedFields === undefined ? {} : { fields: normalizedFields.value }),
+    };
+    const originalBytes = recordBytes(record);
+    const altered = normalizedFields?.altered === true || normalizedError?.altered === true || originalBytes > MAX_EVENT_RECORD_BYTES;
+    let dropped = normalizedFields?.dropped ?? 0;
+    if (altered)
+        Object.assign(record, { record_truncated: true, original_bytes: originalBytes, dropped_fields_count: dropped });
+    while (recordBytes(record) > MAX_EVENT_RECORD_BYTES && record['fields'] !== undefined) {
+        const fields = record['fields'];
+        const keys = Object.keys(fields);
+        if (keys.length === 0) {
+            delete record['fields'];
+            break;
+        }
+        keys.sort((left, right) => {
+            const bySize = byteLength(encoded(fields[right])) - byteLength(encoded(fields[left]));
+            return bySize !== 0 ? bySize : right < left ? -1 : right > left ? 1 : 0;
+        });
+        delete fields[keys[0]];
+        dropped += 1;
+        record.record_truncated = true;
+        record.original_bytes = originalBytes;
+        record.dropped_fields_count = dropped;
+    }
+    const error = record['error'];
+    if (recordBytes(record) > MAX_EVENT_RECORD_BYTES && error?.stack !== undefined)
+        delete error.stack;
+    if (recordBytes(record) > MAX_EVENT_RECORD_BYTES && error?.cause !== undefined)
+        delete error.cause;
+    if (recordBytes(record) > MAX_EVENT_RECORD_BYTES && error !== undefined)
+        error.message = truncate(error.message, 64).value;
+    const result = encoded(record);
+    if (byteLength(result) + 1 > MAX_EVENT_RECORD_BYTES)
+        throw new RangeError('event record cannot fit within 64 KiB');
+    return result;
+}

package/dist/core/events/source.d.ts

@@ -0,0 +1,18 @@
+import type { EventComponent } from './types.js';
+export interface BoundEventSource {
+    component: EventComponent;
+    path: string;
+    node_id?: string;
+    stream_id?: string;
+}
+export declare function bindDaemonEventSource(): void;
+export declare function bindBrokerEventSource(nodeId: string): void;
+export declare function webStreamId(host: string, port: number): string;
+export declare function bindWebEventSource(host: string, port: number): void;
+export declare function eventSource(): BoundEventSource | undefined;
+/** Test-only: clear the process-global binding. A single test process can
+ * legitimately play several components in sequence (an in-process revive binds
+ * a broker source via host.ts's bind-if-unbound; a later daemon-tick test then
+ * inherits it and trips emit's cross-node guard). Production processes bind
+ * exactly once and never reset. */
+export declare function resetEventSourceForTests(): void;

package/dist/core/events/source.js

@@ -0,0 +1,47 @@
+import { createHash } from 'node:crypto';
+import { join } from 'node:path';
+import { crtrHome, isSafeNodeId, jobDir } from '../canvas/paths.js';
+let bound;
+function equal(left, right) {
+    return left.component === right.component && left.path === right.path && left.node_id === right.node_id && left.stream_id === right.stream_id;
+}
+function bind(source) {
+    if (bound === undefined) {
+        bound = source;
+        return;
+    }
+    if (!equal(bound, source))
+        throw new Error('event source is already bound for this process');
+}
+export function bindDaemonEventSource() {
+    bind({ component: 'daemon', path: join(crtrHome(), 'crtrd.log') });
+}
+export function bindBrokerEventSource(nodeId) {
+    if (!isSafeNodeId(nodeId))
+        throw new TypeError('node_id must be a non-empty path segment of at most 128 UTF-8 bytes');
+    bind({ component: 'broker', node_id: nodeId, path: join(jobDir(nodeId), 'log.jsonl') });
+}
+function normalizeHost(host) {
+    const unbracketed = host.trim().toLowerCase().replace(/^\[|\]$/g, '');
+    if (unbracketed === '' || unbracketed === '0.0.0.0' || unbracketed === '::')
+        return 'localhost';
+    return unbracketed;
+}
+export function webStreamId(host, port) {
+    if (!Number.isInteger(port) || port < 0 || port > 65_535)
+        throw new TypeError('web port is invalid');
+    return createHash('sha256').update(`${normalizeHost(host)}\0${port}`).digest('hex').slice(0, 16);
+}
+export function bindWebEventSource(host, port) {
+    const stream_id = webStreamId(host, port);
+    bind({ component: 'web', stream_id, path: join(crtrHome(), `web.${stream_id}.log.jsonl`) });
+}
+export function eventSource() { return bound; }
+/** Test-only: clear the process-global binding. A single test process can
+ * legitimately play several components in sequence (an in-process revive binds
+ * a broker source via host.ts's bind-if-unbound; a later daemon-tick test then
+ * inherits it and trips emit's cross-node guard). Production processes bind
+ * exactly once and never reset. */
+export function resetEventSourceForTests() {
+    bound = undefined;
+}

package/dist/core/events/types.d.ts

@@ -0,0 +1,68 @@
+export type EventLevel = 'error' | 'warn' | 'info' | 'debug';
+export type EventComponent = 'daemon' | 'broker' | 'web' | 'control-plane' | 'front' | 'sentinel';
+export type EventOutcome = 'succeeded' | 'failed' | 'skipped';
+export type RetryDisposition = 'auto' | 'manual' | 'fatal';
+export type OperationId = string & {
+    readonly __operationId: unique symbol;
+};
+export declare const errorClassCodes: readonly ["rate_limit", "overloaded", "connection", "auth", "protocol", "context_overflow", "wedged", "model_not_found", "unknown"];
+export type ErrorClassCode = (typeof errorClassCodes)[number];
+export interface ErrorClass {
+    class: ErrorClassCode;
+    status?: number;
+    provider?: string;
+    retry_disposition?: RetryDisposition;
+}
+export interface EventError {
+    type: string;
+    message: string;
+    stack?: string;
+    cause?: string;
+}
+export type EventField = null | boolean | number | string | readonly EventField[] | {
+    readonly [key: string]: EventField;
+};
+export interface EventEnvelope {
+    v: 1;
+    ts: string;
+    level: EventLevel;
+    event: string;
+    component: EventComponent;
+    operation_id: OperationId;
+    node_id?: string;
+    stream_id?: string;
+    duration_ms?: number;
+    outcome?: EventOutcome;
+    attempt?: number;
+    error_class?: ErrorClass;
+    error?: EventError;
+    fields?: Readonly<Record<string, EventField>>;
+    record_truncated?: true;
+    original_bytes?: number;
+    dropped_fields_count?: number;
+}
+export interface BuildEnvelopeInput {
+    ts?: string;
+    level: EventLevel;
+    event: string;
+    component: EventComponent;
+    operation_id?: string;
+    node_id?: string;
+    stream_id?: string;
+    duration_ms?: number;
+    outcome?: EventOutcome;
+    attempt?: number;
+    error_class?: ErrorClass;
+    error?: unknown;
+    fields?: Readonly<Record<string, unknown>>;
+}
+export interface ErrorClassHints {
+    status?: number;
+    provider?: string;
+    retry_disposition?: RetryDisposition;
+}
+export interface OperationIdContext {
+    current(): OperationId | undefined;
+    run<T>(operationId: string, callback: () => T): T;
+    fresh<T>(callback: (operationId: OperationId) => T): T;
+}

package/dist/core/events/types.js

@@ -0,0 +1,11 @@
+export const errorClassCodes = [
+    'rate_limit',
+    'overloaded',
+    'connection',
+    'auth',
+    'protocol',
+    'context_overflow',
+    'wedged',
+    'model_not_found',
+    'unknown',
+];

package/dist/core/fault-classifier.d.ts

@@ -0,0 +1,43 @@
+import type { ErrorClass, OperationId } from './events/types.js';
+export type FaultLink = 'pi→provider' | 'viewer↔broker' | 'relay↔broker' | 'browser↔relay' | 'cli→exa' | 'daemon→node' | 'crtr→pi';
+export type FaultKind = 'rate-limit' | 'overloaded' | 'connection' | 'auth' | 'protocol' | 'context-overflow' | 'other' | 'wedged' | 'model-not-found';
+export type FaultRetryDisposition = 'auto' | 'manual' | 'fatal';
+export type FaultRetryOwner = 'sdk' | 'daemon' | 'client';
+export interface FaultRetry {
+    disposition: FaultRetryDisposition;
+    by?: FaultRetryOwner;
+    attempt?: number;
+    max?: number;
+    nextAt?: string;
+}
+export interface Fault {
+    link: FaultLink;
+    op: string;
+    kind: FaultKind;
+    retry: FaultRetry;
+    message: string;
+    since: string;
+    operation_id: OperationId;
+    anchorEntryId?: string;
+}
+export interface FaultClassification {
+    kind: FaultKind;
+    disposition: FaultRetryDisposition;
+}
+export declare function errorClassFromFault(fault: Pick<Fault, 'kind' | 'retry'>): ErrorClass;
+export interface FaultErrnoLike {
+    code?: unknown;
+    errno?: unknown;
+    message?: unknown;
+}
+export interface FaultHttpLike {
+    status?: unknown;
+    statusText?: unknown;
+    ok?: unknown;
+    message?: unknown;
+}
+export interface FaultWsCloseLike {
+    code?: unknown;
+    reason?: unknown;
+}
+export declare function classify(link: FaultLink, raw: unknown): FaultClassification;

package/dist/core/fault-classifier.js

@@ -0,0 +1,143 @@
+import { hasManagedProviderCoolingDiagnostic } from './runtime/managed-provider-cooling.js';
+const errorClassByFaultKind = {
+    'rate-limit': 'rate_limit',
+    overloaded: 'overloaded',
+    connection: 'connection',
+    auth: 'auth',
+    protocol: 'protocol',
+    'context-overflow': 'context_overflow',
+    wedged: 'wedged',
+    'model-not-found': 'model_not_found',
+    other: 'unknown',
+};
+export function errorClassFromFault(fault) {
+    return {
+        class: errorClassByFaultKind[fault.kind],
+        retry_disposition: fault.retry.disposition,
+    };
+}
+function isRecord(value) {
+    return typeof value === 'object' && value !== null;
+}
+function text(value) {
+    return typeof value === 'string' ? value : '';
+}
+function classifyProviderText(message) {
+    const m = message ?? '';
+    // ORDER MATTERS: rate-limit → auth/protocol → overloaded → connection → other.
+    // Auth must win over a generic API-error wrapper, and a policy-violation close
+    // must not become a retryable transport interruption.
+    if (/rate.?limit|\b429\b|too many requests|quota/i.test(m))
+        return 'rate-limit';
+    if (/invalid_grant|refresh token|unauthori[sz]ed|invalid.?api.?key|authentication failed|\b401\b|\b403\b/i.test(m))
+        return 'auth';
+    // pi compacts and retries a raw provider overflow. Its failed-recovery result
+    // is the point at which the session cannot become viable without a new launch.
+    if (/context overflow recovery failed/i.test(m))
+        return 'context-overflow';
+    if (/websocket.*(?:closed.*\b(?:1002|1003|1007|1008|1009|1010)\b|protocol error|policy violation|unsupported data|invalid (?:frame|payload)|message too big|mandatory extension)/i.test(m))
+        return 'protocol';
+    if (/overloaded|\b5\d\d\b|internal server error|api.?error|capacity|server.{0,3}busy|temporarily unavailable/i.test(m))
+        return 'overloaded';
+    if (/connection|econnreset|etimedout|enotfound|econnrefused|network|fetch failed|socket hang|timed? out|timeout|\bterminated\b|other side closed|premature close|websocket\s+(?:was\s+)?closed|websocket stream closed before response\.completed|websocket\s+error|websocket.*interrupt/i.test(m))
+        return 'connection';
+    return 'other';
+}
+function classifyErrno(raw) {
+    const code = text(raw.code) || text(raw.errno);
+    if (code === '')
+        return null;
+    if (/^(ECONNREFUSED|ECONNRESET|ETIMEDOUT|ENOENT|ENOTFOUND|EAI_AGAIN|EPIPE|EHOSTUNREACH|ENETUNREACH)$/i.test(code)) {
+        return 'connection';
+    }
+    return null;
+}
+function classifyHttp(raw) {
+    const status = typeof raw.status === 'number' ? raw.status : null;
+    if (status === null)
+        return null;
+    if (status === 401 || status === 403)
+        return 'auth';
+    if (status === 429)
+        return 'rate-limit';
+    if (status === 503 || status === 529)
+        return 'overloaded';
+    if (status >= 500 && status <= 599)
+        return 'overloaded';
+    if (status >= 400 && status <= 499)
+        return 'protocol';
+    return null;
+}
+function classifyWsClose(raw) {
+    const code = typeof raw.code === 'number' ? raw.code : null;
+    if (code === null)
+        return null;
+    if (code === 1008)
+        return 'protocol';
+    if (code === 1006)
+        return 'connection';
+    if (code === 1011) {
+        const reason = text(raw.reason);
+        if (/no running broker/i.test(reason))
+            return 'connection';
+        return classifyProviderText(reason) === 'connection' ? 'connection' : 'other';
+    }
+    return null;
+}
+function classifyDisposition(link, kind) {
+    if (kind === 'auth' || kind === 'protocol' || kind === 'context-overflow')
+        return 'fatal';
+    if (link === 'pi→provider') {
+        if (kind === 'connection' || kind === 'rate-limit' || kind === 'overloaded')
+            return 'auto';
+        return 'fatal';
+    }
+    return 'manual';
+}
+function rawText(raw) {
+    if (typeof raw === 'string')
+        return raw;
+    if (!isRecord(raw))
+        return '';
+    const candidates = [
+        raw['message'],
+        raw['errorMessage'],
+        raw['reason'],
+        raw['body'],
+        raw['statusText'],
+    ];
+    for (const candidate of candidates) {
+        if (typeof candidate === 'string' && candidate !== '')
+            return candidate;
+    }
+    const nested = raw['error'];
+    if (isRecord(nested)) {
+        const nestedMessage = nested['message'];
+        if (typeof nestedMessage === 'string' && nestedMessage !== '')
+            return nestedMessage;
+        const nestedReason = nested['reason'];
+        if (typeof nestedReason === 'string' && nestedReason !== '')
+            return nestedReason;
+    }
+    return '';
+}
+export function classify(link, raw) {
+    // This diagnostic is the stable machine carrier for an all-managed-pools
+    // cooldown. Do not make its retryability depend on explanatory error prose.
+    if (link === 'pi→provider' && hasManagedProviderCoolingDiagnostic(raw)) {
+        return { kind: 'rate-limit', disposition: 'auto' };
+    }
+    if (isRecord(raw)) {
+        const errno = classifyErrno(raw);
+        if (errno !== null)
+            return { kind: errno, disposition: classifyDisposition(link, errno) };
+        const http = classifyHttp(raw);
+        if (http !== null)
+            return { kind: http, disposition: classifyDisposition(link, http) };
+        const ws = classifyWsClose(raw);
+        if (ws !== null)
+            return { kind: ws, disposition: classifyDisposition(link, ws) };
+    }
+    const kind = classifyProviderText(rawText(raw));
+    return { kind, disposition: classifyDisposition(link, kind) };
+}

package/dist/core/feed/__tests__/coalesce-human.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/core/feed/__tests__/coalesce-human.test.js

@@ -0,0 +1,36 @@
+import { test } from 'node:test';
+import assert from 'node:assert/strict';
+import { coalesce } from '../inbox.js';
+// Guards the contract that a human typing directly into a node's box is a
+// CONVERSATION TURN, not a notification: coalesce() delivers those words
+// verbatim (no "From … — N updates" digest header, no `[message]` kind tag),
+// so the dormant wake path reads identically to the live path. Every other
+// sender keeps the digest framing.
+function entry(over) {
+    return {
+        entry_id: '0'.repeat(31) + '1',
+        operation_id: 'op',
+        ts: '2026-01-01T00:00:00.000Z',
+        from: null,
+        tier: 'normal',
+        kind: 'message',
+        label: 'hi',
+        ...over,
+    };
+}
+test('a lone human message renders verbatim — no digest framing', () => {
+    const out = coalesce([entry({ from: 'human', label: 'hi', data: { body: 'hi' } })]);
+    assert.equal(out, 'hi');
+    assert.doesNotMatch(out, /From human/);
+    assert.doesNotMatch(out, /update/);
+    assert.doesNotMatch(out, /\[message\]/);
+});
+test('a multi-line human message keeps its body verbatim', () => {
+    const body = 'first line\n\nsecond paragraph';
+    const out = coalesce([entry({ from: 'human', label: 'first line', data: { body } })]);
+    assert.equal(out, body);
+});
+test('a non-human sender still gets the digest header', () => {
+    const out = coalesce([entry({ from: 'mqifzplr-0753bde3', label: 'go', data: { body: 'go' } })]);
+    assert.match(out, /^From mqifzplr-0753bde3 — 1 update:/);
+});

package/dist/core/feed/__tests__/empty-node-guard.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/core/feed/__tests__/empty-node-guard.test.js

@@ -0,0 +1,45 @@
+// Regression: a report/skeleton write for an EMPTY node id used to resolve
+// reportsDir('') → `nodes/reports` and silently mint a stray non-node sibling
+// under nodes/. That stray entry broke the full-tier test harness's node-dir
+// counter (`expected exactly 1 new node dir, got [<id>, reports]` — the rare
+// flake on CI run 27459304455). The boundary now refuses an empty node id loudly
+// instead of writing garbage. This locks that in.
+import { test } from 'node:test';
+import assert from 'node:assert/strict';
+import { mkdtempSync, existsSync, rmSync } from 'node:fs';
+import { join } from 'node:path';
+import { tmpdir } from 'node:os';
+import { push } from '../feed.js';
+import { ensureNodeDirs, nodesRoot } from '../../canvas/paths.js';
+test('push() rejects an empty nodeId and creates no stray nodes/reports dir', async () => {
+    const home = mkdtempSync(join(tmpdir(), 'crtr-emptyguard-'));
+    const orig = process.env['CRTR_HOME'];
+    process.env['CRTR_HOME'] = home;
+    try {
+        await assert.rejects(() => push('', { kind: 'update', body: 'orphan report' }), /empty nodeId/);
+        assert.equal(existsSync(join(nodesRoot(), 'reports')), false, 'no stray nodes/reports dir was created');
+    }
+    finally {
+        if (orig === undefined)
+            delete process.env['CRTR_HOME'];
+        else
+            process.env['CRTR_HOME'] = orig;
+        rmSync(home, { recursive: true, force: true });
+    }
+});
+test('ensureNodeDirs() rejects an empty nodeId and creates no stray skeleton dirs', () => {
+    const home = mkdtempSync(join(tmpdir(), 'crtr-emptyguard-'));
+    const orig = process.env['CRTR_HOME'];
+    process.env['CRTR_HOME'] = home;
+    try {
+        assert.throws(() => ensureNodeDirs(''), /non-empty path segment/);
+        assert.equal(existsSync(join(nodesRoot(), 'reports')), false, 'no stray nodes/reports dir was created');
+    }
+    finally {
+        if (orig === undefined)
+            delete process.env['CRTR_HOME'];
+        else
+            process.env['CRTR_HOME'] = orig;
+        rmSync(home, { recursive: true, force: true });
+    }
+});

package/dist/core/feed/__tests__/inbox-migrate.test.d.ts

@@ -0,0 +1 @@
+export {};