@ornexus/neocortex 4.60.64 → 4.60.65

package/packages/client/dist/commands/refactor-root.d.ts

@@ -90,160 +90,3 @@ export declare function verifyRootRefactorForCharacterization(projectRoot: strin
 }>;
 export declare function planRootRefactor(projectRoot: string, storyId: string): RefactorRootPlanV1;
 export declare function refactorRootCliHandler(args: readonly string[]): number;
-/** Read-only target identity; later admission must bind this exact plan. */
-export type RefactorRootTargetV2 = Readonly<{
-    kind: 'story';
-    storyId: string;
-}> | Readonly<{
-    kind: 'epic';
-    epicId: string;
-}> | Readonly<{
-    kind: 'idea';
-    idea: string;
-}>;
-export declare function planRootRefactorTarget(projectRoot: string, target: RefactorRootTargetV2): Readonly<{
-    schemaVersion: 2;
-    kind: "root-refactor-target-scope";
-    targetKind: "epic" | "story" | "idea";
-    targetId: string | null;
-    sourceHead: string;
-    projectBindingSha256: string;
-    targetContentSha256: string;
-    targetSha256: string;
-    planSha256: string;
-    scopeId: `rfs_${string}`;
-    candidateWriteSetRequired: true;
-    characterizationRequired: true;
-    executionAuthorized: false;
-    gitAuthority: "ROOT_ONLY";
-    graphExecution: "NOT_RUN";
-    publicSafe: true;
-}>;
-/** Reopen identity during a candidate run; grants no cleanliness or effect authority. */
-export declare function inspectRootRefactorTargetIdentity(projectRoot: string, target: RefactorRootTargetV2): Readonly<{
-    schemaVersion: 2;
-    kind: "root-refactor-target-scope";
-    targetKind: "epic" | "story" | "idea";
-    targetId: string | null;
-    sourceHead: string;
-    projectBindingSha256: string;
-    targetContentSha256: string;
-    targetSha256: string;
-    planSha256: string;
-    scopeId: `rfs_${string}`;
-    candidateWriteSetRequired: true;
-    characterizationRequired: true;
-    executionAuthorized: false;
-    gitAuthority: "ROOT_ONLY";
-    graphExecution: "NOT_RUN";
-    publicSafe: true;
-}>;
-/** Recompute from physical Git and root-owned target input; never trust a DTO. */
-export declare function verifyRootRefactorTargetPlan(projectRoot: string, plan: unknown, target: RefactorRootTargetV2): Readonly<{
-    schemaVersion: 2;
-    kind: "root-refactor-target-scope";
-    targetKind: "epic" | "story" | "idea";
-    targetId: string | null;
-    sourceHead: string;
-    projectBindingSha256: string;
-    targetContentSha256: string;
-    targetSha256: string;
-    planSha256: string;
-    scopeId: `rfs_${string}`;
-    candidateWriteSetRequired: true;
-    characterizationRequired: true;
-    executionAuthorized: false;
-    gitAuthority: "ROOT_ONLY";
-    graphExecution: "NOT_RUN";
-    publicSafe: true;
-}>;
-/** Identity binding only; authenticated registration and graph gates stay separate. */
-export declare function bindRootRefactorTargetControl(projectRoot: string, plan: unknown, target: RefactorRootTargetV2, context: Readonly<{
-    runId: string;
-    generationId: string;
-    includeScopeDecision: boolean;
-}>): Readonly<{
-    schemaVersion: 2;
-    kind: "root-refactor-target-control-binding";
-    scopeId: `rfs_${string}`;
-    targetKind: "epic" | "story" | "idea";
-    planSha256: string;
-    controlBindingSha256: string;
-    runId: string;
-    generationId: string;
-    includeScopeDecision: boolean;
-    executionAuthorized: false;
-    graphExecution: "NOT_RUN";
-    qaAccepted: false;
-    gitAuthority: "NONE";
-}>;
-export interface PrivateRefactorTargetAdmissionV3 {
-    readonly schemaVersion: 3;
-    readonly kind: 'private-root-refactor-target-admission';
-    readonly targetPlan: ReturnType<typeof planRootRefactorTarget>;
-    readonly indexSha256: string;
-    readonly sidecarSha256: string;
-    readonly files: readonly Readonly<{
-        path: string;
-        sha256: string;
-        mode: number;
-    }>[];
-    readonly newFiles: readonly Readonly<{
-        path: string;
-    }>[];
-    readonly admissionSha256: string;
-}
-/** Owner-private precommit read. It grants no containment, review or commit. */
-export declare function readPrivateRefactorTargetAdmission(projectRoot: string, sha256: string, target: RefactorRootTargetV2): PrivateRefactorTargetAdmissionV3;
-/** Root-only explicit write-set preparation, without project edits or stage execution. */
-export declare function admitRootRefactorTarget(projectRoot: string, plan: unknown, target: RefactorRootTargetV2, paths: readonly string[], newPaths: readonly string[], authorizeRootEdit: boolean): Readonly<{
-    schemaVersion: 3;
-    kind: "root-refactor-target-write-set-admission";
-    scopeId: `rfs_${string}`;
-    targetKind: "epic" | "story" | "idea";
-    sourceHead: string;
-    planSha256: string;
-    admissionSha256: string;
-    writeSetSha256: string;
-    fileCount: number;
-    newFileCount: number;
-    rootEditPrepared: true;
-    privateChildAuthorized: false;
-    gitCommitAuthorized: false;
-    publicSafe: true;
-}>;
-export declare function verifyRootRefactorTargetDelta(projectRoot: string, admissionSha256: string, target: RefactorRootTargetV2): Readonly<{
-    newFileCount: number;
-    kind: "root-refactor-target-delta-containment";
-    scopeId: `rfs_${string}`;
-    targetKind: "epic" | "story" | "idea";
-    sourceHead: string;
-    planSha256: string;
-    admissionSha256: string;
-    writeSetSha256: string;
-    changedFileCount: number;
-    rootEditContained: true;
-    qaAccepted: false;
-    gitCommitAuthorized: false;
-    publicSafe: true;
-    schemaVersion: 3;
-}>;
-export declare function verifyRootRefactorTargetForCharacterization(projectRoot: string, admissionSha256: string, target: RefactorRootTargetV2): Readonly<{
-    receipt: Readonly<{
-        newFileCount: number;
-        kind: "root-refactor-target-delta-containment";
-        scopeId: `rfs_${string}`;
-        targetKind: "epic" | "story" | "idea";
-        sourceHead: string;
-        planSha256: string;
-        admissionSha256: string;
-        writeSetSha256: string;
-        changedFileCount: number;
-        rootEditContained: true;
-        qaAccepted: false;
-        gitCommitAuthorized: false;
-        publicSafe: true;
-        schemaVersion: 3;
-    }>;
-    pendingDocumentationPaths: readonly string[];
-}>;

package/packages/client/dist/commands/refactor-root.js

@@ -1,12 +1,7 @@
-import{createHash as pe}from"node:crypto";import{closeSync as V,constants as N,existsSync as ne,fstatSync as ge,fsyncSync as K,lstatSync as v,mkdirSync as ye,openSync as q,readFileSync as H,readSync as se,realpathSync as j,writeFileSync as ae}from"node:fs";import{dirname as ce,isAbsolute as Z,join as A,resolve as F}from"node:path";import{mutationQaGit as E}from"./mutation-qa-git.js";const Q=/^P[0-9]{1,12}(?:\.[0-9]{1,12}){1,3}$/,$=/^[a-f0-9]{64}$/,D=8*1024*1024,Y=256;function y(s){return pe("sha256").update(s).digest("hex")}function M(s){const t=E(s,["rev-parse","--git-common-dir"]).toString("utf8").trim(),i=Z(t)?F(t):F(s,t);if(j(i)!==i||v(i).isSymbolicLink()||v(i).uid!==process.getuid?.())throw new Error("refactor-root-store-unverified");const e=A(i,"neocortex-refactor");ye(e,{recursive:!0,mode:448});const r=v(e);if(!r.isDirectory()||r.isSymbolicLink()||r.uid!==process.getuid?.()||(r.mode&63)!==0)throw new Error("refactor-root-store-unverified");return e}function _(s){return!s||s.length>512||Z(s)||s.includes("\\")||/[\u0000-\u001f\u007f:*?\[\]]/.test(s)||s.normalize("NFC")!==s?!1:!s.split("/").some(i=>!i||i==="."||i===".."||[".git",".neocortex","node_modules"].includes(i.toLowerCase()))}function ee(s,t){if(!_(t))throw new Error("refactor-root-write-set-invalid");const i=A(s,t),e=v(i);if(j(i)!==i||!e.isFile()||e.isSymbolicLink()||e.size===0||e.size>D)throw new Error("refactor-root-write-set-invalid");const r=H(i);if(r.length===0||r.length>D)throw new Error("refactor-root-write-set-invalid");if(new TextDecoder("utf-8",{fatal:!0}).decode(r),r.includes(0))throw new Error("refactor-root-write-set-invalid");const a=E(s,["show",`HEAD:${t}`]);if(!r.equals(a))throw new Error("refactor-root-source-dirty");return Object.freeze({sha256:y(r),mode:e.mode&511})}function te(s,t){try{return E(s,["check-ignore","--no-index","-q","--",t]),!0}catch(i){if(i.status===1)return!1;throw i}}function T(s,t){if(!_(t))throw new Error("refactor-root-write-set-invalid");const i=A(s,t),e=ce(i),r=v(e);if(!r.isDirectory()||r.isSymbolicLink()||j(e)!==e||E(s,["ls-files","--stage","-z","--",t]).length>0||te(s,t))throw new Error("refactor-root-write-set-invalid");try{throw v(i),new Error("refactor-root-write-set-invalid")}catch(a){if(a.code!=="ENOENT")throw a}}function C(s){return y(E(s,["ls-files","--stage","-z"]))}function I(s,t){const i=E(s,t);return new TextDecoder("utf-8",{fatal:!0}).decode(i).split("\0").filter(Boolean)}function W(s){if(I(s,["ls-files","-v","-z"]).some(i=>!i.startsWith("H ")))throw new Error("refactor-root-index-unverified")}function L(s){const t=[],i=new Set;let e=0;const r=I(s,["status","--porcelain=v1","-z","--untracked-files=all"]);r.push(...I(s,["ls-files","--others","--ignored","--exclude-standard","-z","--",".neocortex/"]).map(a=>`!! ${a}`));for(const a of r){if(a.length<4||a[2]!==" ")throw new Error("refactor-root-sidecar-unverified");const o=a.slice(3);if(!o.startsWith(".neocortex/"))continue;if(i.has(o)||o.includes("\\")||/[\u0000-\u001f\u007f]/.test(o)||o.split("/").some(m=>!m||m==="."||m===".."))throw new Error("refactor-root-sidecar-unverified");i.add(o);const l=A(s,o),n=v(l);if(j(l)!==l||!n.isFile()||n.isSymbolicLink()||n.nlink!==1||n.size>64*1024*1024)throw new Error("refactor-root-sidecar-unverified");if(e+=n.size,e>128*1024*1024)throw new Error("refactor-root-sidecar-unverified");const g=q(l,N.O_RDONLY|N.O_NOFOLLOW);try{const m=Buffer.alloc(n.size+1);let w=0;for(;w<m.length;){const d=se(g,m,w,m.length-w,w);if(!d)break;w+=d}const p=ge(g),f=v(l);if(w!==n.size||j(l)!==l||[p,f].some(d=>d.dev!==n.dev||d.ino!==n.ino||d.size!==n.size||d.mtimeMs!==n.mtimeMs||d.ctimeMs!==n.ctimeMs||d.mode!==n.mode||d.nlink!==1))throw new Error("refactor-root-sidecar-unverified");t.push({status:a.slice(0,2),path:o,sha256:y(m.subarray(0,w)),mode:n.mode&511})}finally{V(g)}}return t.sort((a,o)=>Buffer.from(a.path).compare(Buffer.from(o.path))),y(JSON.stringify(t))}function J(s){return[...s].sort((t,i)=>Buffer.from(t).compare(Buffer.from(i)))}function fe(s){const t=s.files.map(i=>i.path);return y(JSON.stringify(s.schemaVersion===1?t:{files:t,newFiles:s.newFiles.map(i=>i.path)}))}function de(s,t){if(!$.test(t))throw new Error("refactor-root-admission-invalid");return A(M(s),`admission-${t}.json`)}function re(s,t){const i=de(s,t),e=v(i);if(!e.isFile()||e.isSymbolicLink()||e.uid!==process.getuid?.()||(e.mode&63)!==0||e.size<100||e.size>512*1024)throw new Error("refactor-root-admission-invalid");const r=H(i);if(r.length>512*1024)throw new Error("refactor-root-admission-invalid");let a;try{a=JSON.parse(new TextDecoder("utf-8",{fatal:!0}).decode(r))}catch{throw new Error("refactor-root-admission-invalid")}if(!a||typeof a!="object"||Array.isArray(a))throw new Error("refactor-root-admission-invalid");const o=a,l=o.schemaVersion===2,n=["schemaVersion","kind","storyId","sourceHead","storySha256","planSha256","indexSha256","sidecarSha256","files","admissionSha256"];if(l&&n.push("newFiles"),Object.keys(o).sort().join("\0")!==n.sort().join("\0")||![1,2].includes(o.schemaVersion)||o.kind!=="private-root-refactor-admission"||typeof o.storyId!="string"||!Q.test(o.storyId)||typeof o.sourceHead!="string"||!/^[a-f0-9]{40}(?:[a-f0-9]{24})?$/.test(o.sourceHead)||typeof o.storySha256!="string"||!$.test(o.storySha256)||typeof o.planSha256!="string"||!$.test(o.planSha256)||typeof o.indexSha256!="string"||!$.test(o.indexSha256)||typeof o.sidecarSha256!="string"||!$.test(o.sidecarSha256)||o.admissionSha256!==t||!Array.isArray(o.files)||o.files.length>Y||(l?!Array.isArray(o.newFiles)||o.newFiles.length<1||o.files.length+o.newFiles.length>Y:o.files.length<1))throw new Error("refactor-root-admission-invalid");if(y(`root-refactor-story-scope-v1\0${o.sourceHead}\0${o.storyId}\0${o.storySha256}`)!==o.planSha256)throw new Error("refactor-root-admission-invalid");const g=o.files;if(g.some(f=>!f||typeof f!="object"||Array.isArray(f)||Object.keys(f).sort().join("\0")!==["mode","path","sha256"].join("\0")||typeof f.path!="string"||!_(f.path)||typeof f.sha256!="string"||!$.test(f.sha256)||!Number.isSafeInteger(f.mode)||f.mode<0||f.mode>511))throw new Error("refactor-root-admission-invalid");const m=g.map(f=>f.path);if(new Set(m).size!==m.length||m.join("\0")!==J(m).join("\0"))throw new Error("refactor-root-admission-invalid");if(l){const f=o.newFiles;if(f.some(c=>!c||typeof c!="object"||Array.isArray(c)||Object.keys(c).join("\0")!=="path"||typeof c.path!="string"||!_(c.path)))throw new Error("refactor-root-admission-invalid");const d=f.map(c=>c.path);if(new Set([...m,...d]).size!==m.length+d.length||d.join("\0")!==J(d).join("\0")||[...m,...d].includes(`docs/stories/${o.storyId}.story.md`))throw new Error("refactor-root-admission-invalid")}const{admissionSha256:w,...p}=o;if(y(JSON.stringify(p))!==t||!r.equals(Buffer.from(`${JSON.stringify(o)}
-`)))throw new Error("refactor-root-admission-invalid");return o}function Se(s,t,i,e,r,a=[]){if(!r)throw new Error("refactor-root-authorization-required");if(!$.test(i)||e.length+a.length<1||e.length+a.length>Y)throw new Error("refactor-root-write-set-invalid");const o=F(s);try{const l=X(o,t);if(l.planSha256!==i)throw new Error("refactor-root-plan-stale");W(o);const n=C(o),g=L(o),m=J(e),w=J(a);if(new Set([...m,...w]).size!==m.length+w.length||[...m,...w].includes(`docs/stories/${t}.story.md`))throw new Error("refactor-root-write-set-invalid");const p=m.map(h=>Object.freeze({path:h,...ee(o,h)})),f=w.map(h=>(T(o,h),Object.freeze({path:h})));if(C(o)!==n||L(o)!==g||X(o,t).planSha256!==i)throw new Error("refactor-root-source-dirty");for(const h of f)T(o,h.path);const d={kind:"private-root-refactor-admission",storyId:t,sourceHead:l.sourceHead,storySha256:l.storySha256,planSha256:i,indexSha256:n,sidecarSha256:g,files:p},c=f.length>0?{schemaVersion:2,...d,newFiles:f}:{schemaVersion:1,...d},S=y(JSON.stringify(c)),x={...c,admissionSha256:S},R=de(o,S),O=Buffer.from(`${JSON.stringify(x)}
-`);if(ne(R))re(o,S);else{const h=q(R,N.O_WRONLY|N.O_CREAT|N.O_EXCL|(N.O_NOFOLLOW??0),384);try{ae(h,O),K(h)}finally{V(h)}const u=q(M(o),N.O_RDONLY|(N.O_DIRECTORY??0));try{K(u)}finally{V(u)}}if(re(o,S),C(o)!==n||L(o)!==g||X(o,t).planSha256!==i)throw new Error("refactor-root-source-dirty");for(const h of f)T(o,h.path);const P={kind:"root-refactor-write-set-admission",storyId:t,sourceHead:l.sourceHead,planSha256:i,writeSetSha256:fe(x),admissionSha256:S,fileCount:p.length,rootEditPrepared:!0,privateChildAuthorized:!1,gitCommitAuthorized:!1,publicSafe:!0};return x.schemaVersion===2?Object.freeze({schemaVersion:2,...P,newFileCount:f.length}):Object.freeze({schemaVersion:1,...P})}catch(l){throw l instanceof Error&&l.message.startsWith("refactor-root-")?l:new Error("refactor-root-write-set-invalid")}}function U(s,t){if(!_(t)||te(s,t)||E(s,["ls-files","--stage","-z","--",t]).length>0)throw new Error("refactor-root-delta-outside-admission");const i=A(s,t),e=ce(i);if(!v(e).isDirectory()||j(e)!==e)throw new Error("refactor-root-delta-outside-admission");const r=v(i);if(j(i)!==i||!r.isFile()||r.isSymbolicLink()||r.size===0||r.size>D||(r.mode&75)!==0)throw new Error("refactor-root-delta-outside-admission");const a=H(i);if(a.length===0||a.length>D||a.includes(0))throw new Error("refactor-root-delta-outside-admission");return new TextDecoder("utf-8",{fatal:!0}).decode(a),y(a)}function Ee(s,t){return le(s,t,!1).receipt}function Ae(s,t){return le(s,t,!0)}function le(s,t,i){const e=F(s);try{const r=re(e,t),a=E(e,["rev-parse","--verify","HEAD"]).toString("utf8").trim();if(a!==r.sourceHead||C(e)!==r.indexSha256||L(e)!==r.sidecarSha256)throw new Error("refactor-root-baseline-stale");W(e);const o=A(e,"docs","stories",`${r.storyId}.story.md`),l=v(o);if(!l.isFile()||l.isSymbolicLink()||j(o)!==o||y(H(o))!==r.storySha256||y(E(e,["show",`HEAD:docs/stories/${r.storyId}.story.md`]))!==r.storySha256)throw new Error("refactor-root-baseline-stale");const n=I(e,["diff","--name-only","-z","--no-ext-diff","--no-textconv"]).filter(u=>!u.startsWith(".neocortex/")),g=I(e,["ls-files","--others","--exclude-standard","-z"]).filter(u=>!u.startsWith(".neocortex/")),m=new Set(r.files.map(u=>u.path)),w=r.schemaVersion===2?r.newFiles.map(u=>u.path):[],p=[];if(i){for(const u of w)if(u.endsWith(".md"))try{v(A(e,u))}catch(b){if(b.code!=="ENOENT")throw b;T(e,u),p.push(u)}}const f=w.filter(u=>!p.includes(u)),d=new Set(w);if(n.length+g.length===0||g.length!==f.length||n.some(u=>!m.has(u))||g.some(u=>!d.has(u)))throw new Error("refactor-root-delta-outside-admission");let c=0;const S=[];for(const u of r.files){const b=A(e,u.path);if(y(E(e,["show",`HEAD:${u.path}`]))!==u.sha256)throw new Error("refactor-root-admission-invalid");const z=v(b);if(j(b)!==b||!z.isFile()||z.isSymbolicLink()||z.size===0||z.size>D||(z.mode&511)!==u.mode)throw new Error("refactor-root-delta-outside-admission");const k=H(b);if(k.length===0||k.length>D)throw new Error("refactor-root-delta-outside-admission");if(new TextDecoder("utf-8",{fatal:!0}).decode(k),k.includes(0))throw new Error("refactor-root-delta-outside-admission");const B=y(k);S.push(B),B!==u.sha256&&c++}const x=f.map(u=>U(e,u));c+=x.length;const R=I(e,["diff","--name-only","-z","--no-ext-diff","--no-textconv"]).filter(u=>!u.startsWith(".neocortex/")),O=I(e,["ls-files","--others","--exclude-standard","-z"]).filter(u=>!u.startsWith(".neocortex/"));if(W(e),c===0||c!==n.length+g.length||R.join("\0")!==n.join("\0")||O.join("\0")!==g.join("\0")||r.files.some((u,b)=>{const z=A(e,u.path),k=v(z);if(j(z)!==z||!k.isFile()||k.isSymbolicLink()||k.size>D||(k.mode&511)!==u.mode)return!0;const B=H(z);return B.length>D||y(B)!==S[b]})||f.some((u,b)=>U(e,u)!==x[b])||C(e)!==r.indexSha256||L(e)!==r.sidecarSha256||E(e,["rev-parse","--verify","HEAD"]).toString("utf8").trim()!==a)throw new Error("refactor-root-baseline-stale");for(const u of p)T(e,u);const P={kind:"root-refactor-delta-containment",storyId:r.storyId,sourceHead:r.sourceHead,planSha256:r.planSha256,admissionSha256:t,writeSetSha256:fe(r),changedFileCount:c,rootEditContained:!0,qaAccepted:!1,gitCommitAuthorized:!1,publicSafe:!0},h=r.schemaVersion===2?Object.freeze({schemaVersion:2,...P,newFileCount:f.length}):Object.freeze({schemaVersion:1,...P});return Object.freeze({receipt:h,pendingDocumentationPaths:Object.freeze(p)})}catch(r){throw r instanceof Error&&r.message.startsWith("refactor-root-")?r:new Error("refactor-root-delta-unverified")}}function X(s,t){if(!Q.test(t))throw new Error("refactor-root-story-invalid");const i=F(s);try{if(j(i)!==i||!v(i).isDirectory())throw new Error("refactor-root-source-unverified");if(E(i,["rev-parse","--show-toplevel"]).toString("utf8").trim()!==i)throw new Error("refactor-root-source-unverified");if(E(i,["status","--porcelain=v1","-z","--untracked-files=all"]).toString("utf8").split("\0").filter(Boolean).some(f=>!/^.{2} \.neocortex\//.test(f)))throw new Error("refactor-root-source-dirty");const a=E(i,["rev-parse","--verify","HEAD"]).toString("utf8").trim();if(!/^[a-f0-9]{40}(?:[a-f0-9]{24})?$/.test(a))throw new Error("refactor-root-source-unverified");const o=`docs/stories/${t}.story.md`,l=A(i,o),n=v(l);if(j(l)!==l||!n.isFile()||n.isSymbolicLink()||n.size===0||n.size>1024*1024)throw new Error("refactor-root-story-unverified");const g=H(l),m=E(i,["show",`HEAD:${o}`]);if(!g.equals(m))throw new Error("refactor-root-story-unverified");const w=y(g),p=y(`root-refactor-story-scope-v1\0${a}\0${t}\0${w}`);return Object.freeze({schemaVersion:1,kind:"root-refactor-story-scope",storyId:t,sourceHead:a,storySha256:w,planSha256:p,candidateWriteSetRequired:!0,characterizationRequired:!0,executionAuthorized:!1,gitAuthority:"ROOT_ONLY",graphExecution:"NOT_RUN",publicSafe:!0})}catch(e){throw e instanceof Error&&e.message.startsWith("refactor-root-")?e:new Error("refactor-root-source-unverified")}}function xe(s){let t="",i="",e="",r="",a="",o=!1,l=!1;const n=[],g=[];let m="plain";try{const w=[...s];t=w.shift()??"";for(let f=0;f<w.length;f++){const d=w[f],c=()=>{const S=w[++f];if(!S||S.startsWith("--"))throw new Error("refactor-root-arguments-invalid");return S};if(d==="--project-root")i=c();else if(d==="--story")e=c();else if(d==="--target-stdin"){if(l)throw new Error("refactor-root-arguments-invalid");l=!0}else if(d==="--plan-sha")r=c();else if(d==="--admission-sha")a=c();else if(d==="--path")n.push(c());else if(d==="--new-path")g.push(c());else if(d==="--authorize-root-edit")o=!0;else if(d==="--format")m=c();else throw new Error("refactor-root-arguments-invalid")}if(!i||!["plain","json"].includes(m))throw new Error("refactor-root-arguments-invalid");if(l!==["target-plan","target-admit","target-verify"].includes(t)||l&&e)throw new Error("refactor-root-arguments-invalid");let p;if(l){const f=Buffer.alloc(65537);let d=0;for(;d<f.length;){const c=se(0,f,d,f.length-d,null);if(!c)break;d+=c}if(!d||d>65536)throw new Error("refactor-root-arguments-invalid");try{p=JSON.parse(new TextDecoder("utf-8",{fatal:!0}).decode(f.subarray(0,d)))}catch{throw new Error("refactor-root-arguments-invalid")}}if(t==="target-plan"&&p&&!r&&!a&&n.length===0&&g.length===0&&!o)process.stdout.write(`${JSON.stringify({ok:!0,plan:oe(i,p)})}
-`);else if(t==="target-admit"&&p&&r&&!a&&n.length+g.length>0){const f=oe(i,p);if(f.planSha256!==r)throw new Error("refactor-root-target-plan-unverified");const d=ve(i,f,p,n,g,o);process.stdout.write(`${JSON.stringify({ok:!0,admission:d})}
-`)}else if(t==="target-verify"&&p&&!r&&a&&n.length===0&&g.length===0&&!o)process.stdout.write(`${JSON.stringify({ok:!0,containment:Oe(i,a,p)})}
-`);else if(t==="plan"&&e&&!r&&!a&&n.length===0&&g.length===0&&!o){const f=X(i,e);process.stdout.write(`${JSON.stringify({ok:!0,plan:f})}
-`)}else if(t==="admit"&&e&&r&&!a&&n.length+g.length>0){const f=Se(i,e,r,n,o,g);process.stdout.write(`${JSON.stringify({ok:!0,admission:f})}
-`)}else if(t==="verify"&&!e&&!r&&a&&n.length===0&&g.length===0&&!o){const f=Ee(i,a);process.stdout.write(`${JSON.stringify({ok:!0,containment:f})}
-`)}else throw new Error("refactor-root-arguments-invalid");return 0}catch(w){const p=w instanceof Error&&/^refactor-root-[a-z-]+$/.test(w.message)?w.message:"refactor-root-source-unverified";return process.stdout.write(`${JSON.stringify({ok:!1,reasonCode:p})}
-`),1}}function oe(s,t){return ie(s,t,!0)}function Ne(s,t){return ie(s,t,!1)}function ie(s,t,i){const e=F(s),r=()=>{throw new Error("refactor-root-target-invalid")};(!t||typeof t!="object"||Array.isArray(t))&&r();const a=Object.keys(t).sort().join(",");let o=null,l=null,n;if(t.kind==="story"&&a==="kind,storyId"&&Q.test(t.storyId)?(l=t.storyId,o=`docs/stories/${t.storyId}.story.md`):t.kind==="epic"&&a==="epicId,kind"&&/^P[1-9][0-9]{0,11}$/.test(t.epicId)?(l=t.epicId,o=`docs/epics/epic-${t.epicId}.md`):t.kind==="idea"&&a==="idea,kind"&&typeof t.idea=="string"&&t.idea.trim()&&!t.idea.includes("\0")&&Buffer.byteLength(t.idea,"utf8")<=8192&&Buffer.from(t.idea,"utf8").toString("utf8")===t.idea?n=y(Buffer.from(t.idea,"utf8")):r(),j(e)!==e||!v(e).isDirectory()||E(e,["rev-parse","--show-toplevel"]).toString("utf8").trim()!==e)throw new Error("refactor-root-source-unverified");const g=()=>E(e,["status","--porcelain=v1","-z","--untracked-files=all"]).toString("utf8"),m=g();if(i&&m.split("\0").filter(Boolean).some(O=>!/^.{2} \.neocortex\//.test(O)))throw new Error("refactor-root-source-dirty");const w=E(e,["rev-parse","--verify","HEAD"]).toString("utf8").trim();if(!/^[a-f0-9]{40}(?:[a-f0-9]{24})?$/.test(w))throw new Error("refactor-root-source-unverified");o&&(n=ee(e,o).sha256);const p=y(JSON.stringify(["root-refactor-target-v2",t.kind,l,n])),f=v(e),d=E(e,["rev-parse","--git-common-dir"]).toString("utf8").trim(),c=Z(d)?F(d):F(e,d),S=v(c);if(j(c)!==c||!S.isDirectory()||S.isSymbolicLink()||S.uid!==process.getuid?.())throw new Error("refactor-root-source-unverified");const x=y(JSON.stringify(["root-refactor-project-v2",e,f.dev,f.ino,c,S.dev,S.ino])),R=y(JSON.stringify(["root-refactor-target-plan-v2",x,w,p]));if(w!==E(e,["rev-parse","--verify","HEAD"]).toString("utf8").trim()||m!==g())throw new Error("refactor-root-source-raced");return Object.freeze({schemaVersion:2,kind:"root-refactor-target-scope",targetKind:t.kind,targetId:l,sourceHead:w,projectBindingSha256:x,targetContentSha256:n,targetSha256:p,planSha256:R,scopeId:`rfs_${R}`,candidateWriteSetRequired:!0,characterizationRequired:!0,executionAuthorized:!1,gitAuthority:"ROOT_ONLY",graphExecution:"NOT_RUN",publicSafe:!0})}function G(s,t,i){const e=oe(s,i),r=Object.keys(e);if(!t||typeof t!="object"||Array.isArray(t)||Object.keys(t).sort().join(",")!==[...r].sort().join(",")||r.some(a=>t[a]!==e[a]))throw new Error("refactor-root-target-plan-unverified");return e}function Re(s,t,i,e){const r=G(s,t,i);if(!e||typeof e!="object"||Array.isArray(e)||Object.keys(e).sort().join(",")!=="generationId,includeScopeDecision,runId"||typeof e.runId!="string"||!/^[A-Za-z0-9][A-Za-z0-9._:-]{0,127}$/.test(e.runId)||typeof e.generationId!="string"||!/^sha256:[a-f0-9]{64}$/.test(e.generationId)||typeof e.includeScopeDecision!="boolean"||r.targetKind!=="story"&&!e.includeScopeDecision)throw new Error("refactor-root-target-control-invalid");const a=y(JSON.stringify(["root-refactor-target-control-v2",r.projectBindingSha256,r.sourceHead,r.targetSha256,r.planSha256,e.runId,e.generationId,e.includeScopeDecision]));return Object.freeze({schemaVersion:2,kind:"root-refactor-target-control-binding",scopeId:r.scopeId,targetKind:r.targetKind,planSha256:r.planSha256,controlBindingSha256:a,runId:e.runId,generationId:e.generationId,includeScopeDecision:e.includeScopeDecision,executionAuthorized:!1,graphExecution:"NOT_RUN",qaAccepted:!1,gitAuthority:"NONE"})}function he(s,t){if(!$.test(t))throw new Error("refactor-root-target-admission-invalid");return A(M(s),`target-admission-${t}.json`)}function ue(s){return y(JSON.stringify(["root-refactor-target-write-set-v3",s.targetPlan.scopeId,s.targetPlan.planSha256,s.files,s.newFiles]))}function we(s,t,i){const e=F(s),r=ie(e,i,!1),a=he(e,t),o=v(a);if(!o.isFile()||o.isSymbolicLink()||j(a)!==a||o.uid!==process.getuid?.()||(o.mode&63)!==0||o.size<100||o.size>512*1024)throw new Error("refactor-root-target-admission-invalid");const l=H(a);let n;try{n=JSON.parse(new TextDecoder("utf-8",{fatal:!0}).decode(l))}catch{throw new Error("refactor-root-target-admission-invalid")}const g=["schemaVersion","kind","targetPlan","indexSha256","sidecarSha256","files","newFiles","admissionSha256"];if(!n||typeof n!="object"||Array.isArray(n)||Object.keys(n).sort().join(",")!==g.sort().join(",")||n.schemaVersion!==3||n.kind!=="private-root-refactor-target-admission"||!$.test(n.indexSha256)||!$.test(n.sidecarSha256)||!Array.isArray(n.files)||!Array.isArray(n.newFiles)||n.files.length+n.newFiles.length<1||n.files.length+n.newFiles.length>Y||n.admissionSha256!==t||!l.equals(Buffer.from(`${JSON.stringify(n)}
-`)))throw new Error("refactor-root-target-admission-invalid");const{admissionSha256:m,...w}=n;if(y(`root-refactor-target-admission-v3\0${JSON.stringify(w)}`)!==t)throw new Error("refactor-root-target-admission-invalid");if(!n.targetPlan||typeof n.targetPlan!="object"||Array.isArray(n.targetPlan)||Object.keys(n.targetPlan).sort().join(",")!==Object.keys(r).sort().join(",")||Object.keys(r).some(c=>n.targetPlan[c]!==r[c]))throw new Error("refactor-root-target-plan-unverified");const p=n.files.map(c=>c?.path),f=n.newFiles.map(c=>c?.path),d=i.kind==="story"?`docs/stories/${i.storyId}.story.md`:i.kind==="epic"?`docs/epics/epic-${i.epicId}.md`:null;if(n.files.some(c=>!c||Object.keys(c).sort().join(",")!=="mode,path,sha256"||typeof c.path!="string"||!_(c.path)||!$.test(c.sha256)||!Number.isSafeInteger(c.mode)||c.mode<0||c.mode>511||y(E(e,["show",`HEAD:${c.path}`]))!==c.sha256)||n.newFiles.some(c=>!c||Object.keys(c).join(",")!=="path"||typeof c.path!="string"||!_(c.path)||E(e,["ls-files","--stage","-z","--",c.path]).length>0||te(e,c.path))||new Set([...p,...f]).size!==p.length+f.length||p.join("\0")!==J(p).join("\0")||f.join("\0")!==J(f).join("\0")||d!==null&&[...p,...f].includes(d))throw new Error("refactor-root-target-admission-invalid");if(W(e),C(e)!==n.indexSha256||L(e)!==n.sidecarSha256)throw new Error("refactor-root-source-dirty");return Object.freeze({...n,targetPlan:r,files:Object.freeze(n.files.map(c=>Object.freeze({...c}))),newFiles:Object.freeze(n.newFiles.map(c=>Object.freeze({...c})))})}function ve(s,t,i,e,r,a){if(!a)throw new Error("refactor-root-authorization-required");if(!Array.isArray(e)||!Array.isArray(r)||e.length+r.length<1||e.length+r.length>Y||[...e,...r].some(O=>typeof O!="string"||!_(O)))throw new Error("refactor-root-write-set-invalid");const o=F(s),l=G(o,t,i);W(o);const n=C(o),g=L(o),m=J(e),w=J(r),p=i.kind==="story"?`docs/stories/${i.storyId}.story.md`:i.kind==="epic"?`docs/epics/epic-${i.epicId}.md`:null;if(new Set([...m,...w]).size!==m.length+w.length||p!==null&&[...m,...w].includes(p))throw new Error("refactor-root-write-set-invalid");const f=m.map(O=>Object.freeze({path:O,...ee(o,O)})),d=w.map(O=>(T(o,O),Object.freeze({path:O})));if(C(o)!==n||L(o)!==g||G(o,t,i).planSha256!==l.planSha256)throw new Error("refactor-root-source-raced");const c={schemaVersion:3,kind:"private-root-refactor-target-admission",targetPlan:l,indexSha256:n,sidecarSha256:g,files:f,newFiles:d},S=y(`root-refactor-target-admission-v3\0${JSON.stringify(c)}`),x={...c,admissionSha256:S},R=he(o,S);if(!ne(R)){const O=q(R,N.O_WRONLY|N.O_CREAT|N.O_EXCL|(N.O_NOFOLLOW??0),384);try{ae(O,`${JSON.stringify(x)}
-`),K(O)}finally{V(O)}const P=q(M(o),N.O_RDONLY|(N.O_DIRECTORY??0));try{K(P)}finally{V(P)}}we(o,S,i),G(o,t,i);for(const O of d)T(o,O.path);return Object.freeze({schemaVersion:3,kind:"root-refactor-target-write-set-admission",scopeId:l.scopeId,targetKind:l.targetKind,sourceHead:l.sourceHead,planSha256:l.planSha256,admissionSha256:S,writeSetSha256:ue(x),fileCount:f.length,newFileCount:d.length,rootEditPrepared:!0,privateChildAuthorized:!1,gitCommitAuthorized:!1,publicSafe:!0})}function Oe(s,t,i){return me(s,t,i,!1).receipt}function De(s,t,i){return me(s,t,i,!0)}function me(s,t,i,e){const r=F(s);try{const a=we(r,t,i),o=E(r,["rev-parse","--verify","HEAD"]).toString("utf8").trim();if(o!==a.targetPlan.sourceHead||C(r)!==a.indexSha256||L(r)!==a.sidecarSha256)throw new Error("refactor-root-baseline-stale");W(r);const l=I(r,["diff","--name-only","-z","--no-ext-diff","--no-textconv"]).filter(h=>!h.startsWith(".neocortex/")),n=I(r,["ls-files","--others","--exclude-standard","-z"]).filter(h=>!h.startsWith(".neocortex/")),g=new Set(a.files.map(h=>h.path)),m=a.newFiles.map(h=>h.path),w=[];if(e){for(const h of m)if(h.endsWith(".md"))try{v(A(r,h))}catch(u){if(u.code!=="ENOENT")throw u;T(r,h),w.push(h)}}const p=m.filter(h=>!w.includes(h)),f=new Set(m);if(l.length+n.length===0||n.length!==p.length||l.some(h=>!g.has(h))||n.some(h=>!f.has(h)))throw new Error("refactor-root-delta-outside-admission");let d=0;const c=[];for(const h of a.files){const u=A(r,h.path);if(y(E(r,["show",`HEAD:${h.path}`]))!==h.sha256)throw new Error("refactor-root-admission-invalid");const b=v(u);if(j(u)!==u||!b.isFile()||b.isSymbolicLink()||b.size===0||b.size>D||(b.mode&511)!==h.mode)throw new Error("refactor-root-delta-outside-admission");const z=H(u);if(z.length===0||z.length>D)throw new Error("refactor-root-delta-outside-admission");if(new TextDecoder("utf-8",{fatal:!0}).decode(z),z.includes(0))throw new Error("refactor-root-delta-outside-admission");const k=y(z);c.push(k),k!==h.sha256&&d++}const S=p.map(h=>U(r,h));d+=S.length;const x=I(r,["diff","--name-only","-z","--no-ext-diff","--no-textconv"]).filter(h=>!h.startsWith(".neocortex/")),R=I(r,["ls-files","--others","--exclude-standard","-z"]).filter(h=>!h.startsWith(".neocortex/"));if(W(r),d===0||d!==l.length+n.length||x.join("\0")!==l.join("\0")||R.join("\0")!==n.join("\0")||a.files.some((h,u)=>{const b=A(r,h.path),z=v(b);if(j(b)!==b||!z.isFile()||z.isSymbolicLink()||z.size>D||(z.mode&511)!==h.mode)return!0;const k=H(b);return k.length>D||y(k)!==c[u]})||p.some((h,u)=>U(r,h)!==S[u])||C(r)!==a.indexSha256||L(r)!==a.sidecarSha256||E(r,["rev-parse","--verify","HEAD"]).toString("utf8").trim()!==o)throw new Error("refactor-root-baseline-stale");for(const h of w)T(r,h);const O={kind:"root-refactor-target-delta-containment",scopeId:a.targetPlan.scopeId,targetKind:a.targetPlan.targetKind,sourceHead:a.targetPlan.sourceHead,planSha256:a.targetPlan.planSha256,admissionSha256:t,writeSetSha256:ue(a),changedFileCount:d,rootEditContained:!0,qaAccepted:!1,gitCommitAuthorized:!1,publicSafe:!0},P=Object.freeze({schemaVersion:3,...O,newFileCount:p.length});return Object.freeze({receipt:P,pendingDocumentationPaths:Object.freeze(w)})}catch(a){throw a instanceof Error&&a.message.startsWith("refactor-root-")?a:new Error("refactor-root-delta-unverified")}}export{Se as admitRootRefactor,ve as admitRootRefactorTarget,Re as bindRootRefactorTargetControl,ee as exactCommittedRefactorFile,Ne as inspectRootRefactorTargetIdentity,X as planRootRefactor,oe as planRootRefactorTarget,M as privateRefactorDirectory,re as readPrivateRefactorAdmission,we as readPrivateRefactorTargetAdmission,xe as refactorRootCliHandler,L as refactorSidecarDigest,Ee as verifyRootRefactor,Ae as verifyRootRefactorForCharacterization,Oe as verifyRootRefactorTargetDelta,De as verifyRootRefactorTargetForCharacterization,G as verifyRootRefactorTargetPlan};
+import{createHash as se}from"node:crypto";import{closeSync as q,constants as j,existsSync as ne,fstatSync as ae,fsyncSync as G,lstatSync as p,mkdirSync as ce,openSync as I,readFileSync as A,readSync as fe,realpathSync as v,writeFileSync as de}from"node:fs";import{dirname as U,isAbsolute as Q,join as b,resolve as L}from"node:path";import{mutationQaGit as E}from"./mutation-qa-git.js";const K=/^P[0-9]{1,12}(?:\.[0-9]{1,12}){1,3}$/,F=/^[a-f0-9]{64}$/,N=8*1024*1024,Y=256;function g(s){return se("sha256").update(s).digest("hex")}function Z(s){const o=E(s,["rev-parse","--git-common-dir"]).toString("utf8").trim(),t=Q(o)?L(o):L(s,o);if(v(t)!==t||p(t).isSymbolicLink()||p(t).uid!==process.getuid?.())throw new Error("refactor-root-store-unverified");const r=b(t,"neocortex-refactor");ce(r,{recursive:!0,mode:448});const i=p(r);if(!i.isDirectory()||i.isSymbolicLink()||i.uid!==process.getuid?.()||(i.mode&63)!==0)throw new Error("refactor-root-store-unverified");return r}function C(s){return!s||s.length>512||Q(s)||s.includes("\\")||/[\u0000-\u001f\u007f:*?\[\]]/.test(s)||s.normalize("NFC")!==s?!1:!s.split("/").some(t=>!t||t==="."||t===".."||[".git",".neocortex","node_modules"].includes(t.toLowerCase()))}function le(s,o){if(!C(o))throw new Error("refactor-root-write-set-invalid");const t=b(s,o),r=p(t);if(v(t)!==t||!r.isFile()||r.isSymbolicLink()||r.size===0||r.size>N)throw new Error("refactor-root-write-set-invalid");const i=A(t);if(i.length===0||i.length>N)throw new Error("refactor-root-write-set-invalid");if(new TextDecoder("utf-8",{fatal:!0}).decode(i),i.includes(0))throw new Error("refactor-root-write-set-invalid");const n=E(s,["show",`HEAD:${o}`]);if(!i.equals(n))throw new Error("refactor-root-source-dirty");return Object.freeze({sha256:g(i),mode:r.mode&511})}function ee(s,o){try{return E(s,["check-ignore","--no-index","-q","--",o]),!0}catch(t){if(t.status===1)return!1;throw t}}function P(s,o){if(!C(o))throw new Error("refactor-root-write-set-invalid");const t=b(s,o),r=U(t),i=p(r);if(!i.isDirectory()||i.isSymbolicLink()||v(r)!==r||E(s,["ls-files","--stage","-z","--",o]).length>0||ee(s,o))throw new Error("refactor-root-write-set-invalid");try{throw p(t),new Error("refactor-root-write-set-invalid")}catch(n){if(n.code!=="ENOENT")throw n}}function _(s){return g(E(s,["ls-files","--stage","-z"]))}function D(s,o){const t=E(s,o);return new TextDecoder("utf-8",{fatal:!0}).decode(t).split("\0").filter(Boolean)}function M(s){if(D(s,["ls-files","-v","-z"]).some(t=>!t.startsWith("H ")))throw new Error("refactor-root-index-unverified")}function W(s){const o=[],t=new Set;let r=0;const i=D(s,["status","--porcelain=v1","-z","--untracked-files=all"]);i.push(...D(s,["ls-files","--others","--ignored","--exclude-standard","-z","--",".neocortex/"]).map(n=>`!! ${n}`));for(const n of i){if(n.length<4||n[2]!==" ")throw new Error("refactor-root-sidecar-unverified");const e=n.slice(3);if(!e.startsWith(".neocortex/"))continue;if(t.has(e)||e.includes("\\")||/[\u0000-\u001f\u007f]/.test(e)||e.split("/").some(l=>!l||l==="."||l===".."))throw new Error("refactor-root-sidecar-unverified");t.add(e);const d=b(s,e),f=p(d);if(v(d)!==d||!f.isFile()||f.isSymbolicLink()||f.nlink!==1||f.size>64*1024*1024)throw new Error("refactor-root-sidecar-unverified");if(r+=f.size,r>128*1024*1024)throw new Error("refactor-root-sidecar-unverified");const w=I(d,j.O_RDONLY|j.O_NOFOLLOW);try{const l=Buffer.alloc(f.size+1);let h=0;for(;h<l.length;){const u=fe(w,l,h,l.length-h,h);if(!u)break;h+=u}const m=ae(w),c=p(d);if(h!==f.size||v(d)!==d||[m,c].some(u=>u.dev!==f.dev||u.ino!==f.ino||u.size!==f.size||u.mtimeMs!==f.mtimeMs||u.ctimeMs!==f.ctimeMs||u.mode!==f.mode||u.nlink!==1))throw new Error("refactor-root-sidecar-unverified");o.push({status:n.slice(0,2),path:e,sha256:g(l.subarray(0,h)),mode:f.mode&511})}finally{q(w)}}return o.sort((n,e)=>Buffer.from(n.path).compare(Buffer.from(e.path))),g(JSON.stringify(o))}function V(s){return[...s].sort((o,t)=>Buffer.from(o).compare(Buffer.from(t)))}function te(s){const o=s.files.map(t=>t.path);return g(JSON.stringify(s.schemaVersion===1?o:{files:o,newFiles:s.newFiles.map(t=>t.path)}))}function re(s,o){if(!F.test(o))throw new Error("refactor-root-admission-invalid");return b(Z(s),`admission-${o}.json`)}function X(s,o){const t=re(s,o),r=p(t);if(!r.isFile()||r.isSymbolicLink()||r.uid!==process.getuid?.()||(r.mode&63)!==0||r.size<100||r.size>512*1024)throw new Error("refactor-root-admission-invalid");const i=A(t);if(i.length>512*1024)throw new Error("refactor-root-admission-invalid");let n;try{n=JSON.parse(new TextDecoder("utf-8",{fatal:!0}).decode(i))}catch{throw new Error("refactor-root-admission-invalid")}if(!n||typeof n!="object"||Array.isArray(n))throw new Error("refactor-root-admission-invalid");const e=n,d=e.schemaVersion===2,f=["schemaVersion","kind","storyId","sourceHead","storySha256","planSha256","indexSha256","sidecarSha256","files","admissionSha256"];if(d&&f.push("newFiles"),Object.keys(e).sort().join("\0")!==f.sort().join("\0")||![1,2].includes(e.schemaVersion)||e.kind!=="private-root-refactor-admission"||typeof e.storyId!="string"||!K.test(e.storyId)||typeof e.sourceHead!="string"||!/^[a-f0-9]{40}(?:[a-f0-9]{24})?$/.test(e.sourceHead)||typeof e.storySha256!="string"||!F.test(e.storySha256)||typeof e.planSha256!="string"||!F.test(e.planSha256)||typeof e.indexSha256!="string"||!F.test(e.indexSha256)||typeof e.sidecarSha256!="string"||!F.test(e.sidecarSha256)||e.admissionSha256!==o||!Array.isArray(e.files)||e.files.length>Y||(d?!Array.isArray(e.newFiles)||e.newFiles.length<1||e.files.length+e.newFiles.length>Y:e.files.length<1))throw new Error("refactor-root-admission-invalid");if(g(`root-refactor-story-scope-v1\0${e.sourceHead}\0${e.storyId}\0${e.storySha256}`)!==e.planSha256)throw new Error("refactor-root-admission-invalid");const w=e.files;if(w.some(c=>!c||typeof c!="object"||Array.isArray(c)||Object.keys(c).sort().join("\0")!==["mode","path","sha256"].join("\0")||typeof c.path!="string"||!C(c.path)||typeof c.sha256!="string"||!F.test(c.sha256)||!Number.isSafeInteger(c.mode)||c.mode<0||c.mode>511))throw new Error("refactor-root-admission-invalid");const l=w.map(c=>c.path);if(new Set(l).size!==l.length||l.join("\0")!==V(l).join("\0"))throw new Error("refactor-root-admission-invalid");if(d){const c=e.newFiles;if(c.some(y=>!y||typeof y!="object"||Array.isArray(y)||Object.keys(y).join("\0")!=="path"||typeof y.path!="string"||!C(y.path)))throw new Error("refactor-root-admission-invalid");const u=c.map(y=>y.path);if(new Set([...l,...u]).size!==l.length+u.length||u.join("\0")!==V(u).join("\0")||[...l,...u].includes(`docs/stories/${e.storyId}.story.md`))throw new Error("refactor-root-admission-invalid")}const{admissionSha256:h,...m}=e;if(g(JSON.stringify(m))!==o||!i.equals(Buffer.from(`${JSON.stringify(e)}
+`)))throw new Error("refactor-root-admission-invalid");return e}function he(s,o,t,r,i,n=[]){if(!i)throw new Error("refactor-root-authorization-required");if(!F.test(t)||r.length+n.length<1||r.length+n.length>Y)throw new Error("refactor-root-write-set-invalid");const e=L(s);try{const d=B(e,o);if(d.planSha256!==t)throw new Error("refactor-root-plan-stale");M(e);const f=_(e),w=W(e),l=V(r),h=V(n);if(new Set([...l,...h]).size!==l.length+h.length||[...l,...h].includes(`docs/stories/${o}.story.md`))throw new Error("refactor-root-write-set-invalid");const m=l.map(S=>Object.freeze({path:S,...le(e,S)})),c=h.map(S=>(P(e,S),Object.freeze({path:S})));if(_(e)!==f||W(e)!==w||B(e,o).planSha256!==t)throw new Error("refactor-root-source-dirty");for(const S of c)P(e,S.path);const u={kind:"private-root-refactor-admission",storyId:o,sourceHead:d.sourceHead,storySha256:d.storySha256,planSha256:t,indexSha256:f,sidecarSha256:w,files:m},y=c.length>0?{schemaVersion:2,...u,newFiles:c}:{schemaVersion:1,...u},k=g(JSON.stringify(y)),R={...y,admissionSha256:k},T=re(e,k),J=Buffer.from(`${JSON.stringify(R)}
+`);if(ne(T))X(e,k);else{const S=I(T,j.O_WRONLY|j.O_CREAT|j.O_EXCL|(j.O_NOFOLLOW??0),384);try{de(S,J),G(S)}finally{q(S)}const a=I(Z(e),j.O_RDONLY|(j.O_DIRECTORY??0));try{G(a)}finally{q(a)}}if(X(e,k),_(e)!==f||W(e)!==w||B(e,o).planSha256!==t)throw new Error("refactor-root-source-dirty");for(const S of c)P(e,S.path);const $={kind:"root-refactor-write-set-admission",storyId:o,sourceHead:d.sourceHead,planSha256:t,writeSetSha256:te(R),admissionSha256:k,fileCount:m.length,rootEditPrepared:!0,privateChildAuthorized:!1,gitCommitAuthorized:!1,publicSafe:!0};return R.schemaVersion===2?Object.freeze({schemaVersion:2,...$,newFileCount:c.length}):Object.freeze({schemaVersion:1,...$})}catch(d){throw d instanceof Error&&d.message.startsWith("refactor-root-")?d:new Error("refactor-root-write-set-invalid")}}function oe(s,o){if(!C(o)||ee(s,o)||E(s,["ls-files","--stage","-z","--",o]).length>0)throw new Error("refactor-root-delta-outside-admission");const t=b(s,o),r=U(t);if(!p(r).isDirectory()||v(r)!==r)throw new Error("refactor-root-delta-outside-admission");const i=p(t);if(v(t)!==t||!i.isFile()||i.isSymbolicLink()||i.size===0||i.size>N||(i.mode&75)!==0)throw new Error("refactor-root-delta-outside-admission");const n=A(t);if(n.length===0||n.length>N||n.includes(0))throw new Error("refactor-root-delta-outside-admission");return new TextDecoder("utf-8",{fatal:!0}).decode(n),g(n)}function ue(s,o){return ie(s,o,!1).receipt}function ge(s,o){return ie(s,o,!0)}function ie(s,o,t){const r=L(s);try{const i=X(r,o),n=E(r,["rev-parse","--verify","HEAD"]).toString("utf8").trim();if(n!==i.sourceHead||_(r)!==i.indexSha256||W(r)!==i.sidecarSha256)throw new Error("refactor-root-baseline-stale");M(r);const e=b(r,"docs","stories",`${i.storyId}.story.md`),d=p(e);if(!d.isFile()||d.isSymbolicLink()||v(e)!==e||g(A(e))!==i.storySha256||g(E(r,["show",`HEAD:docs/stories/${i.storyId}.story.md`]))!==i.storySha256)throw new Error("refactor-root-baseline-stale");const f=D(r,["diff","--name-only","-z","--no-ext-diff","--no-textconv"]).filter(a=>!a.startsWith(".neocortex/")),w=D(r,["ls-files","--others","--exclude-standard","-z"]).filter(a=>!a.startsWith(".neocortex/")),l=new Set(i.files.map(a=>a.path)),h=i.schemaVersion===2?i.newFiles.map(a=>a.path):[],m=[];if(t){for(const a of h)if(a.endsWith(".md"))try{p(b(r,a))}catch(z){if(z.code!=="ENOENT")throw z;P(r,a),m.push(a)}}const c=h.filter(a=>!m.includes(a)),u=new Set(h);if(f.length+w.length===0||w.length!==c.length||f.some(a=>!l.has(a))||w.some(a=>!u.has(a)))throw new Error("refactor-root-delta-outside-admission");let y=0;const k=[];for(const a of i.files){const z=b(r,a.path);if(g(E(r,["show",`HEAD:${a.path}`]))!==a.sha256)throw new Error("refactor-root-admission-invalid");const x=p(z);if(v(z)!==z||!x.isFile()||x.isSymbolicLink()||x.size===0||x.size>N||(x.mode&511)!==a.mode)throw new Error("refactor-root-delta-outside-admission");const O=A(z);if(O.length===0||O.length>N)throw new Error("refactor-root-delta-outside-admission");if(new TextDecoder("utf-8",{fatal:!0}).decode(O),O.includes(0))throw new Error("refactor-root-delta-outside-admission");const H=g(O);k.push(H),H!==a.sha256&&y++}const R=c.map(a=>oe(r,a));y+=R.length;const T=D(r,["diff","--name-only","-z","--no-ext-diff","--no-textconv"]).filter(a=>!a.startsWith(".neocortex/")),J=D(r,["ls-files","--others","--exclude-standard","-z"]).filter(a=>!a.startsWith(".neocortex/"));if(M(r),y===0||y!==f.length+w.length||T.join("\0")!==f.join("\0")||J.join("\0")!==w.join("\0")||i.files.some((a,z)=>{const x=b(r,a.path),O=p(x);if(v(x)!==x||!O.isFile()||O.isSymbolicLink()||O.size>N||(O.mode&511)!==a.mode)return!0;const H=A(x);return H.length>N||g(H)!==k[z]})||c.some((a,z)=>oe(r,a)!==R[z])||_(r)!==i.indexSha256||W(r)!==i.sidecarSha256||E(r,["rev-parse","--verify","HEAD"]).toString("utf8").trim()!==n)throw new Error("refactor-root-baseline-stale");for(const a of m)P(r,a);const $={kind:"root-refactor-delta-containment",storyId:i.storyId,sourceHead:i.sourceHead,planSha256:i.planSha256,admissionSha256:o,writeSetSha256:te(i),changedFileCount:y,rootEditContained:!0,qaAccepted:!1,gitCommitAuthorized:!1,publicSafe:!0},S=i.schemaVersion===2?Object.freeze({schemaVersion:2,...$,newFileCount:c.length}):Object.freeze({schemaVersion:1,...$});return Object.freeze({receipt:S,pendingDocumentationPaths:Object.freeze(m)})}catch(i){throw i instanceof Error&&i.message.startsWith("refactor-root-")?i:new Error("refactor-root-delta-unverified")}}function B(s,o){if(!K.test(o))throw new Error("refactor-root-story-invalid");const t=L(s);try{if(v(t)!==t||!p(t).isDirectory())throw new Error("refactor-root-source-unverified");if(E(t,["rev-parse","--show-toplevel"]).toString("utf8").trim()!==t)throw new Error("refactor-root-source-unverified");if(E(t,["status","--porcelain=v1","-z","--untracked-files=all"]).toString("utf8").split("\0").filter(Boolean).some(c=>!/^.{2} \.neocortex\//.test(c)))throw new Error("refactor-root-source-dirty");const n=E(t,["rev-parse","--verify","HEAD"]).toString("utf8").trim();if(!/^[a-f0-9]{40}(?:[a-f0-9]{24})?$/.test(n))throw new Error("refactor-root-source-unverified");const e=`docs/stories/${o}.story.md`,d=b(t,e),f=p(d);if(v(d)!==d||!f.isFile()||f.isSymbolicLink()||f.size===0||f.size>1024*1024)throw new Error("refactor-root-story-unverified");const w=A(d),l=E(t,["show",`HEAD:${e}`]);if(!w.equals(l))throw new Error("refactor-root-story-unverified");const h=g(w),m=g(`root-refactor-story-scope-v1\0${n}\0${o}\0${h}`);return Object.freeze({schemaVersion:1,kind:"root-refactor-story-scope",storyId:o,sourceHead:n,storySha256:h,planSha256:m,candidateWriteSetRequired:!0,characterizationRequired:!0,executionAuthorized:!1,gitAuthority:"ROOT_ONLY",graphExecution:"NOT_RUN",publicSafe:!0})}catch(r){throw r instanceof Error&&r.message.startsWith("refactor-root-")?r:new Error("refactor-root-source-unverified")}}function Se(s){let o="",t="",r="",i="",n="",e=!1;const d=[],f=[];let w="plain";try{const l=[...s];o=l.shift()??"";for(let h=0;h<l.length;h++){const m=l[h],c=()=>{const u=l[++h];if(!u||u.startsWith("--"))throw new Error("refactor-root-arguments-invalid");return u};if(m==="--project-root")t=c();else if(m==="--story")r=c();else if(m==="--plan-sha")i=c();else if(m==="--admission-sha")n=c();else if(m==="--path")d.push(c());else if(m==="--new-path")f.push(c());else if(m==="--authorize-root-edit")e=!0;else if(m==="--format")w=c();else throw new Error("refactor-root-arguments-invalid")}if(!t||!["plain","json"].includes(w))throw new Error("refactor-root-arguments-invalid");if(o==="plan"&&r&&!i&&!n&&d.length===0&&f.length===0&&!e){const h=B(t,r);process.stdout.write(`${JSON.stringify({ok:!0,plan:h})}
+`)}else if(o==="admit"&&r&&i&&!n&&d.length+f.length>0){const h=he(t,r,i,d,e,f);process.stdout.write(`${JSON.stringify({ok:!0,admission:h})}
+`)}else if(o==="verify"&&!r&&!i&&n&&d.length===0&&f.length===0&&!e){const h=ue(t,n);process.stdout.write(`${JSON.stringify({ok:!0,containment:h})}
+`)}else throw new Error("refactor-root-arguments-invalid");return 0}catch(l){const h=l instanceof Error&&/^refactor-root-[a-z-]+$/.test(l.message)?l.message:"refactor-root-source-unverified";return process.stdout.write(`${JSON.stringify({ok:!1,reasonCode:h})}
+`),1}}export{he as admitRootRefactor,le as exactCommittedRefactorFile,B as planRootRefactor,Z as privateRefactorDirectory,X as readPrivateRefactorAdmission,Se as refactorRootCliHandler,W as refactorSidecarDigest,ue as verifyRootRefactor,ge as verifyRootRefactorForCharacterization};

package/packages/client/dist/commands/shared-architecture-non-ui.d.ts

@@ -0,0 +1,18 @@
+/** Standalone-client projection of the public non-UI architecture receipt syntax. */
+export interface ArchitectureNonUiScopeReceipt {
+    readonly schemaVersion: 1;
+    readonly kind: 'ArchitectureNonUiScope/1';
+    readonly licenseHash: string;
+    readonly projectHash: string;
+    readonly targetEpicId: string;
+    readonly graphRevision: string;
+    readonly rootInputSha256: string;
+    readonly accountingId: string;
+    readonly applicability: 'non-ui';
+    readonly excludedStageCommands: readonly string[];
+    readonly macSha256: string;
+    readonly publicSafe: true;
+}
+export declare const ARCHITECTURE_PUBLIC_COMMANDS: readonly string[];
+export declare const ARCHITECTURE_NON_UI_COMMANDS: readonly string[];
+export declare function parseArchitectureNonUiScopeReceipt(value: unknown): ArchitectureNonUiScopeReceipt | undefined;

package/packages/client/dist/commands/shared-architecture-non-ui.js

@@ -0,0 +1 @@
+const i=Object.freeze(["arch-prd","arch-architecture","arch-fitness-functions","arch-api-contracts","generate-pacts","arch-api-integrations","arch-database","arch-security","arch-design-system","arch-ux-design","arch-performance","arch-testing","arch-infrastructure","arch-review","update-memory"]),n=Object.freeze(i.filter(t=>t!=="arch-design-system"&&t!=="arch-ux-design")),c=Object.freeze(["arch-design-system","arch-ux-design"]);function s(t){if(!t||typeof t!="object"||Array.isArray(t))return;const e=t;if(!(Object.keys(e).sort().join(",")!==["schemaVersion","kind","licenseHash","projectHash","targetEpicId","graphRevision","rootInputSha256","accountingId","applicability","excludedStageCommands","macSha256","publicSafe"].sort().join(",")||e.schemaVersion!==1||e.kind!=="ArchitectureNonUiScope/1"||e.publicSafe!==!0||e.applicability!=="non-ui"||typeof e.targetEpicId!="string"||!/^P[1-9][0-9]{0,11}$/.test(e.targetEpicId)||typeof e.accountingId!="string"||!/^arch-accounting-[a-f0-9]{32}$/.test(e.accountingId)||!["licenseHash","projectHash","graphRevision","rootInputSha256","macSha256"].every(r=>typeof e[r]=="string"&&/^[a-f0-9]{64}$/.test(e[r]))||!Array.isArray(e.excludedStageCommands)||e.excludedStageCommands.length!==c.length||!e.excludedStageCommands.every((r,a)=>r===c[a])))return Object.freeze({...e,excludedStageCommands:c})}export{n as ARCHITECTURE_NON_UI_COMMANDS,i as ARCHITECTURE_PUBLIC_COMMANDS,s as parseArchitectureNonUiScopeReceipt};

package/packages/client/dist/git/direct-yolo-checkpoint.d.ts

@@ -73,6 +73,10 @@ export interface DirectYoloCheckpointOptions {
     readonly beforeCheckpointPersist?: () => Promise<void>;
     /** Test seam for crash-window reproduction after durable CAS and before release. */
     readonly afterCheckpointPersist?: () => Promise<void>;
+    /** Test-only timing seam; production callers use the fixed 30-minute lease. */
+    readonly writerLeaseDurationMs?: number;
+    /** Test-only timing seam; production callers renew every five minutes. */
+    readonly writerLeaseHeartbeatIntervalMs?: number;
 }
 /**
  * Productive P207 setup boundary. It owns only the current checkout and the
@@ -87,7 +91,7 @@ export declare function acceptDirectYoloSetupCheckpoint(options: Pick<DirectYolo
  * one-time token never crosses stdout; only a public receipt is returned.
  */
 export declare function issueDirectYoloSetupLeaseHandoff(options: Pick<DirectYoloCheckpointOptions, 'projectRoot' | 'storyId' | 'nowIso'>): Promise<DirectYoloCheckpointResult<DirectYoloSetupHandoffReceipt>>;
-export declare function beginDirectYoloStoryCommit(options: Pick<DirectYoloCheckpointOptions, 'projectRoot' | 'storyId' | 'nowIso' | 'setupLeaseHandoff' | 'setupHandoffFault'>): Promise<DirectYoloCheckpointResult<DirectYoloCommitPlan>>;
+export declare function beginDirectYoloStoryCommit(options: Pick<DirectYoloCheckpointOptions, 'projectRoot' | 'storyId' | 'nowIso' | 'setupLeaseHandoff' | 'setupHandoffFault' | 'writerLeaseDurationMs'>): Promise<DirectYoloCheckpointResult<DirectYoloCommitPlan>>;
 export declare function finalizeDirectYoloStoryCheckpoint(options: DirectYoloCheckpointOptions): Promise<DirectYoloCheckpointResult<StoryCommitCheckpoint>>;
 export declare function recoverLegacyDirectYoloStoryCheckpoint(options: DirectYoloCheckpointOptions & {
     readonly commitSha: string;