@ornexus/neocortex 4.60.68 → 4.60.69

package/packages/client/dist/license/license-client.js

@@ -1,304 +1 @@
-/**
- * @license FSL-1.1
- * Copyright (c) 2026 OrNexus AI
- *
- * This file is part of Neocortex CLI, licensed under the
- * Functional Source License, Version 1.1 (FSL-1.1).
- *
- * Change Date: February 20, 2029
- * Change License: MIT
- *
- * See the LICENSE file in the project root for full license text.
- */
-/**
- * @neocortex/client - License Client
- *
- * Manages license activation, JWT token caching, and proactive refresh.
- * Integrates with the IP Protection Server's license endpoints and
- * uses EncryptedCache for persistent token storage.
- *
- * Story 31.01: REFRESH_THRESHOLD_S fixed from 3600 to 300 (5 min)
- * Story 31.02: Refresh token support (store, use, rotate)
- * Story 31.03: Refresh token persistence in EncryptedCache
- *
- * NEVER throws exceptions - returns null on failure (graceful degradation).
- */
-import { decodeJwt } from 'jose';
-import { NoOpCache } from '../types/index.js';
-import { getMachineFingerprint } from '../machine/fingerprint.js';
-import { CLIENT_VERSION } from '../version.js';
-// ── Constants ────────────────────────────────────────────────────────────
-const CACHE_KEY = 'neocortex:jwt:token';
-const REFRESH_CACHE_KEY = 'neocortex:jwt:refresh_token';
-const REFRESH_THRESHOLD_S = 300; // 5 minutes before expiry
-const REFRESH_TOKEN_TTL_MS = 7 * 24 * 60 * 60 * 1000; // 7 days (matches server REFRESH_TOKEN_TTL_DAYS)
-// ── LicenseClient ────────────────────────────────────────────────────────
-export class LicenseClient {
-    serverUrl;
-    licenseKey;
-    cache;
-    clientVersion;
-    machineId;
-    strictReadOnly;
-    token = null;
-    refreshToken = null;
-    constructor(options) {
-        this.serverUrl = options.serverUrl.replace(/\/+$/, '');
-        this.licenseKey = options.licenseKey;
-        this.cache = options.cacheProvider ?? new NoOpCache();
-        this.clientVersion = options.clientVersion ?? CLIENT_VERSION;
-        this.strictReadOnly = options.strictReadOnly ?? false;
-        this.machineId = getMachineFingerprint({ strictReadOnly: this.strictReadOnly });
-    }
-    /**
-     * Get a valid JWT token. Checks memory, cache, refresh token, then activation.
-     * NEVER throws - returns null on failure.
-     *
-     * Flow:
-     * 1. in-memory JWT valid? -> return
-     * 2. in-memory JWT needs-refresh? -> refresh(refresh_token) -> return
-     * 3. cached JWT valid? -> return
-     * 4. cached JWT needs-refresh? -> refresh(refresh_token) -> return
-     * 5. cached refresh_token exists? -> refresh(refresh_token) -> return  (Story 31.02)
-     * 6. activate() -> return
-     */
-    async getToken() {
-        try {
-            if (this.strictReadOnly) {
-                const inspection = await this.inspectToken();
-                return inspection.status === 'authenticated' ? inspection.token : null;
-            }
-            // 1. Check in-memory token
-            if (this.token) {
-                const validity = this.checkTokenValidity(this.token);
-                if (validity === 'valid')
-                    return this.token;
-                if (validity === 'needs-refresh') {
-                    if (this.strictReadOnly)
-                        return this.token;
-                    const refreshed = await this.refresh();
-                    return refreshed?.token ?? this.token; // fallback to current if refresh fails
-                }
-                // expired or invalid - clear memory
-                this.token = null;
-            }
-            // 2. Check JWT cache
-            const cached = await this.loadFromCache();
-            if (cached) {
-                this.token = cached;
-                const validity = this.checkTokenValidity(cached);
-                if (validity === 'valid')
-                    return cached;
-                if (validity === 'needs-refresh') {
-                    if (this.strictReadOnly)
-                        return cached;
-                    const refreshed = await this.refresh();
-                    return refreshed?.token ?? cached; // fallback to current if refresh fails
-                }
-                // expired - clear
-                this.token = null;
-            }
-            // Strict inspection never turns authentication into activation or token
-            // refresh state. Missing/expired cached credentials fail closed.
-            if (this.strictReadOnly)
-                return null;
-            // 3. Try refresh with cached refresh_token (Story 31.02/31.03)
-            // Lazy load refresh_token from cache if not in memory
-            if (!this.refreshToken) {
-                this.refreshToken = await this.loadRefreshTokenFromCache();
-            }
-            if (this.refreshToken) {
-                const refreshed = await this.refresh();
-                if (refreshed?.token)
-                    return refreshed.token;
-            }
-            // 4. Activate (last resort)
-            const result = await this.activate();
-            return result?.token ?? null;
-        }
-        catch {
-            return null;
-        }
-    }
-    /** Read-only authentication classification. It never refreshes, activates, clears or writes cache state. */
-    async inspectToken() {
-        try {
-            const candidate = this.token ?? await this.loadFromCache();
-            if (candidate) {
-                const validity = this.checkTokenValidity(candidate);
-                if (validity === 'valid')
-                    return { status: 'authenticated', token: candidate };
-                return { status: 'refresh-required', reason: validity === 'needs-refresh' ? 'near-expiry' : 'expired' };
-            }
-            return this.licenseKey
-                ? { status: 'refresh-required', reason: 'unavailable' }
-                : { status: 'not-configured' };
-        }
-        catch {
-            return this.licenseKey
-                ? { status: 'refresh-required', reason: 'unavailable' }
-                : { status: 'not-configured' };
-        }
-    }
-    /**
-     * Activate through the endpoint matching the configured credential type.
-     * Stores token and refresh_token in memory and cache on success.
-     * NEVER throws - returns null on failure.
-     */
-    async activate() {
-        if (this.strictReadOnly)
-            return null;
-        try {
-            const apiKey = this.licenseKey.startsWith('nxk_');
-            const endpoint = apiKey ? 'activate-key' : 'activate';
-            const credential = apiKey ? { api_key: this.licenseKey } : { license_key: this.licenseKey };
-            const response = await fetch(`${this.serverUrl}/api/v1/license/${endpoint}`, {
-                method: 'POST',
-                headers: { 'Content-Type': 'application/json' },
-                body: JSON.stringify({
-                    ...credential,
-                    machine_id: this.machineId,
-                    client_version: this.clientVersion,
-                }),
-            });
-            if (!response.ok)
-                return null;
-            const data = (await response.json());
-            if (data.tier !== undefined && data.tier !== 'free' && data.tier !== 'pro'
-                && data.tier !== 'enterprise')
-                return null;
-            this.token = data.token;
-            this.refreshToken = data.refresh_token ?? null;
-            // Drain capability-backed persistence before returning so invoke receipt
-            // completion cannot race an owned cache effect.
-            await this.cache.set(CACHE_KEY, data.token, data.expires_in * 1000).catch(() => { });
-            // Persist refresh token with 7-day TTL (fire-and-forget)
-            if (data.refresh_token) {
-                await this.cache.set(REFRESH_CACHE_KEY, data.refresh_token, REFRESH_TOKEN_TTL_MS).catch(() => { });
-            }
-            return {
-                token: data.token,
-                expiresIn: data.expires_in,
-                refreshToken: data.refresh_token,
-                tier: data.tier,
-            };
-        }
-        catch {
-            return null;
-        }
-    }
-    /**
-     * Refresh using refresh_token by calling POST /api/v1/license/refresh.
-     * Sends refresh_token in body (no Authorization header needed).
-     * Handles token rotation: stores the new refresh_token from response.
-     * NEVER throws - returns null on failure.
-     *
-     * Story 31.02: Signature changed from refresh(currentToken) to refresh().
-     * The refresh_token in the body is the credential, not the JWT.
-     *
-     * @param _currentToken - Deprecated. Kept for backward compat but ignored.
-     */
-    async refresh(_currentToken) {
-        if (this.strictReadOnly)
-            return null;
-        try {
-            // Load refresh_token: in-memory first, then cache
-            const rt = this.refreshToken ?? await this.loadRefreshTokenFromCache();
-            if (!rt) {
-                // No refresh token available -- cannot use new flow
-                return null;
-            }
-            const response = await fetch(`${this.serverUrl}/api/v1/license/refresh`, {
-                method: 'POST',
-                headers: { 'Content-Type': 'application/json' },
-                body: JSON.stringify({ refresh_token: rt }),
-            });
-            if (!response.ok) {
-                // Refresh token invalid/expired -- clear it
-                this.refreshToken = null;
-                await this.cache.set(REFRESH_CACHE_KEY, '', 1).catch(() => { }); // expire immediately
-                return null;
-            }
-            const data = (await response.json());
-            this.token = data.token;
-            // Token rotation: server issues new refresh token
-            this.refreshToken = data.refresh_token ?? null;
-            await this.cache.set(CACHE_KEY, data.token, data.expires_in * 1000).catch(() => { });
-            // Persist rotated refresh token (fire-and-forget)
-            if (data.refresh_token) {
-                await this.cache.set(REFRESH_CACHE_KEY, data.refresh_token, REFRESH_TOKEN_TTL_MS).catch(() => { });
-            }
-            return {
-                token: data.token,
-                expiresIn: data.expires_in,
-                refreshToken: data.refresh_token,
-            };
-        }
-        catch {
-            return null;
-        }
-    }
-    /**
-     * Force-refresh the token.
-     * Used when tier_changed is detected or a 401 response indicates the token is expired.
-     * Falls back to re-activation if refresh fails.
-     * NEVER throws - returns new token or null on failure.
-     *
-     * Story 18.8: Updated to prefer refresh over re-activate (preserves updated tier).
-     * Story 31.02: Uses refresh_token flow instead of JWT-based refresh.
-     */
-    async forceRefresh() {
-        if (this.strictReadOnly)
-            return null;
-        try {
-            // 1. Try refresh with refresh_token first
-            const refreshResult = await this.refresh();
-            if (refreshResult?.token)
-                return refreshResult.token;
-            // 2. Refresh failed -- clear everything and re-activate
-            this.token = null;
-            this.refreshToken = null;
-            await this.cache.clear().catch(() => { });
-            const result = await this.activate();
-            return result?.token ?? null;
-        }
-        catch {
-            return null;
-        }
-    }
-    // ── Private Methods ─────────────────────────────────────────────────
-    checkTokenValidity(token) {
-        try {
-            const payload = decodeJwt(token);
-            if (!payload.exp)
-                return 'expired';
-            const now = Math.floor(Date.now() / 1000);
-            if (payload.exp <= now)
-                return 'expired';
-            if (payload.exp - now <= REFRESH_THRESHOLD_S)
-                return 'needs-refresh';
-            return 'valid';
-        }
-        catch {
-            return 'expired';
-        }
-    }
-    async loadFromCache() {
-        try {
-            return await this.cache.get(CACHE_KEY);
-        }
-        catch {
-            return null;
-        }
-    }
-    async loadRefreshTokenFromCache() {
-        try {
-            const rt = await this.cache.get(REFRESH_CACHE_KEY);
-            // Guard against empty/expired entries
-            return rt && rt.length > 0 ? rt : null;
-        }
-        catch {
-            return null;
-        }
-    }
-}
+import{decodeJwt as h}from"jose";import{NoOpCache as o}from"../types/index.js";import{getMachineFingerprint as l}from"../machine/fingerprint.js";import{CLIENT_VERSION as u}from"../version.js";const a="neocortex:jwt:token",s="neocortex:jwt:refresh_token",f=300,c=10080*60*1e3;class w{serverUrl;licenseKey;cache;clientVersion;machineId;strictReadOnly;token=null;refreshToken=null;constructor(e){this.serverUrl=e.serverUrl.replace(/\/+$/,""),this.licenseKey=e.licenseKey,this.cache=e.cacheProvider??new o,this.clientVersion=e.clientVersion??u,this.strictReadOnly=e.strictReadOnly??!1,this.machineId=l({strictReadOnly:this.strictReadOnly})}async getToken(){try{if(this.strictReadOnly){const t=await this.inspectToken();return t.status==="authenticated"?t.token:null}if(this.token){const t=this.checkTokenValidity(this.token);if(t==="valid")return this.token;if(t==="needs-refresh")return this.strictReadOnly?this.token:(await this.refresh())?.token??this.token;this.token=null}const e=await this.loadFromCache();if(e){this.token=e;const t=this.checkTokenValidity(e);if(t==="valid")return e;if(t==="needs-refresh")return this.strictReadOnly?e:(await this.refresh())?.token??e;this.token=null}if(this.strictReadOnly)return null;if(this.refreshToken||(this.refreshToken=await this.loadRefreshTokenFromCache()),this.refreshToken){const t=await this.refresh();if(t?.token)return t.token}return(await this.activate())?.token??null}catch{return null}}async inspectToken(){try{const e=this.token??await this.loadFromCache();if(e){const i=this.checkTokenValidity(e);return i==="valid"?{status:"authenticated",token:e}:{status:"refresh-required",reason:i==="needs-refresh"?"near-expiry":"expired"}}return this.licenseKey?{status:"refresh-required",reason:"unavailable"}:{status:"not-configured"}}catch{return this.licenseKey?{status:"refresh-required",reason:"unavailable"}:{status:"not-configured"}}}async activate(){if(this.strictReadOnly)return null;try{const e=this.licenseKey.startsWith("nxk_"),i=e?"activate-key":"activate",t=e?{api_key:this.licenseKey}:{license_key:this.licenseKey},r=await fetch(`${this.serverUrl}/api/v1/license/${i}`,{method:"POST",headers:{"Content-Type":"application/json"},body:JSON.stringify({...t,machine_id:this.machineId,client_version:this.clientVersion})});if(!r.ok)return null;const n=await r.json();return n.tier!==void 0&&n.tier!=="free"&&n.tier!=="pro"&&n.tier!=="enterprise"?null:(this.token=n.token,this.refreshToken=n.refresh_token??null,await this.cache.set(a,n.token,n.expires_in*1e3).catch(()=>{}),n.refresh_token&&await this.cache.set(s,n.refresh_token,c).catch(()=>{}),{token:n.token,expiresIn:n.expires_in,refreshToken:n.refresh_token,tier:n.tier})}catch{return null}}async refresh(e){if(this.strictReadOnly)return null;try{const i=this.refreshToken??await this.loadRefreshTokenFromCache();if(!i)return null;const t=await fetch(`${this.serverUrl}/api/v1/license/refresh`,{method:"POST",headers:{"Content-Type":"application/json"},body:JSON.stringify({refresh_token:i})});if(!t.ok)return this.refreshToken=null,await this.cache.set(s,"",1).catch(()=>{}),null;const r=await t.json();return this.token=r.token,this.refreshToken=r.refresh_token??null,await this.cache.set(a,r.token,r.expires_in*1e3).catch(()=>{}),r.refresh_token&&await this.cache.set(s,r.refresh_token,c).catch(()=>{}),{token:r.token,expiresIn:r.expires_in,refreshToken:r.refresh_token}}catch{return null}}async forceRefresh(){if(this.strictReadOnly)return null;try{const e=await this.refresh();return e?.token?e.token:(this.token=null,this.refreshToken=null,await this.cache.clear().catch(()=>{}),(await this.activate())?.token??null)}catch{return null}}checkTokenValidity(e){try{const i=h(e);if(!i.exp)return"expired";const t=Math.floor(Date.now()/1e3);return i.exp<=t?"expired":i.exp-t<=f?"needs-refresh":"valid"}catch{return"expired"}}async loadFromCache(){try{return await this.cache.get(a)}catch{return null}}async loadRefreshTokenFromCache(){try{const e=await this.cache.get(s);return e&&e.length>0?e:null}catch{return null}}}export{w as LicenseClient};

package/packages/client/dist/machine/fingerprint.js

@@ -1,163 +1,2 @@
-/**
- * @license FSL-1.1
- * Copyright (c) 2026 OrNexus AI
- *
- * This file is part of Neocortex CLI, licensed under the
- * Functional Source License, Version 1.1 (FSL-1.1).
- *
- * Change Date: February 20, 2029
- * Change License: MIT
- *
- * See the LICENSE file in the project root for full license text.
- */
-/**
- * @neocortex/client - Machine Fingerprint
- *
- * Generates a stable, deterministic machine identifier from hardware/OS
- * attributes using SHA-256. Used for license activation machine tracking.
- */
-import { createHash } from 'node:crypto';
-import { existsSync, readFileSync, writeFileSync, mkdirSync, chmodSync } from 'node:fs';
-import { join } from 'node:path';
-import { arch, cpus, hostname, networkInterfaces, platform } from 'node:os';
-import { neocortexProfileDirectory } from '../config/profile-directory.js';
-const ALL_ZEROS_MAC = '00:00:00:00:00:00';
-/** Path to the persisted machine-id file */
-const NEOCORTEX_DIR = neocortexProfileDirectory();
-const MACHINE_ID_FILE = join(NEOCORTEX_DIR, '.machine-id');
-/**
- * Collect sorted, non-internal MAC addresses from network interfaces.
- * Filters out internal/loopback interfaces and all-zeros MACs.
- */
-function collectMacAddresses() {
-    const interfaces = networkInterfaces();
-    const macs = [];
-    for (const entries of Object.values(interfaces)) {
-        if (!entries)
-            continue;
-        for (const entry of entries) {
-            if (!entry.internal && entry.mac !== ALL_ZEROS_MAC) {
-                macs.push(entry.mac);
-            }
-        }
-    }
-    // Sort for determinism regardless of NIC enumeration order
-    return [...new Set(macs)].sort();
-}
-/**
- * Generate a hardware-based fingerprint (not persisted).
- * This is the original computation used as fallback and for seeding.
- *
- * @returns 64-character hex string (SHA-256 digest)
- */
-export function computeHardwareFingerprint() {
-    const host = hostname();
-    const plat = platform();
-    const architecture = arch();
-    const cpuList = cpus();
-    const cpuModel = cpuList.length > 0 ? cpuList[0].model : '';
-    const macs = collectMacAddresses();
-    const input = `${host}|${plat}|${architecture}|${cpuModel}|${macs.join(',')}`;
-    return createHash('sha256').update(input).digest('hex');
-}
-/**
- * Set restrictive file permissions (chmod 600) on a file.
- * Fail-open: never throws.
- */
-function setFilePermissions600(filePath) {
-    try {
-        if (process.platform !== 'win32') {
-            chmodSync(filePath, 0o600);
-        }
-        // Windows ACL handled by secure-config.ts setSecureFilePermissions() if needed
-    }
-    catch {
-        // Fail-open
-    }
-}
-/**
- * Read persisted machine ID from disk.
- * Returns null if file doesn't exist or can't be read.
- */
-function readPersistedMachineId() {
-    try {
-        if (!existsSync(MACHINE_ID_FILE))
-            return null;
-        const raw = readFileSync(MACHINE_ID_FILE, 'utf-8').trim();
-        // Validate: must be a 64-char hex string
-        if (/^[a-f0-9]{64}$/.test(raw))
-            return raw;
-        return null;
-    }
-    catch {
-        return null;
-    }
-}
-/**
- * Persist machine ID to disk.
- * Creates ~/.neocortex/ if needed. Sets chmod 600 on the file.
- * Fail-open: never throws.
- */
-function persistMachineId(machineId) {
-    try {
-        mkdirSync(NEOCORTEX_DIR, { recursive: true });
-        writeFileSync(MACHINE_ID_FILE, machineId + '\n', 'utf-8');
-        setFilePermissions600(MACHINE_ID_FILE);
-    }
-    catch {
-        // Fail-open: if disk fails, fingerprint still works from hardware
-    }
-}
-/**
- * Check if config.json has a machineId field that can seed .machine-id.
- * This provides backward compatibility for existing installations.
- */
-function readMachineIdFromConfig() {
-    try {
-        const configPath = join(NEOCORTEX_DIR, 'config.json');
-        if (!existsSync(configPath))
-            return null;
-        const raw = readFileSync(configPath, 'utf-8');
-        const config = JSON.parse(raw.replace(/^\uFEFF/, ''));
-        const machineId = config.machineId;
-        if (typeof machineId === 'string' && /^[a-f0-9]{64}$/.test(machineId)) {
-            return machineId;
-        }
-        return null;
-    }
-    catch {
-        return null;
-    }
-}
-/**
- * Generate a stable machine fingerprint as a SHA-256 hex digest.
- *
- * Story P26.01: On first call, generates from hardware and persists to
- * ~/.neocortex/.machine-id. On subsequent calls, reads from disk.
- * This ensures the fingerprint remains stable even if hardware attributes
- * change (e.g., USB NIC added/removed, hostname change).
- *
- * Backward compat: if config.json has machineId, uses that to seed .machine-id.
- *
- * Fail-open: if disk operations fail, falls back to hardware-generated fingerprint.
- *
- * @returns 64-character hex string (SHA-256 digest)
- */
-export function getMachineFingerprint(options = {}) {
-    // 1. Try reading persisted machine ID from disk
-    const persisted = readPersistedMachineId();
-    if (persisted)
-        return persisted;
-    // 2. Check config.json for backward-compatible machineId
-    const fromConfig = readMachineIdFromConfig();
-    if (fromConfig) {
-        if (!options.strictReadOnly)
-            persistMachineId(fromConfig);
-        return fromConfig;
-    }
-    // 3. Generate from hardware and persist
-    const fingerprint = computeHardwareFingerprint();
-    if (!options.strictReadOnly)
-        persistMachineId(fingerprint);
-    return fingerprint;
-}
+import{createHash as p}from"node:crypto";import{existsSync as i,readFileSync as s,writeFileSync as d,mkdirSync as h,chmodSync as y}from"node:fs";import{join as f}from"node:path";import{arch as g,cpus as F,hostname as I,networkInterfaces as M,platform as S}from"node:os";import{neocortexProfileDirectory as w}from"../config/profile-directory.js";const O="00:00:00:00:00:00",o=w(),c=f(o,".machine-id");function $(){const t=M(),r=[];for(const e of Object.values(t))if(e)for(const n of e)!n.internal&&n.mac!==O&&r.push(n.mac);return[...new Set(r)].sort()}function E(){const t=I(),r=S(),e=g(),n=F(),u=n.length>0?n[0].model:"",l=$(),m=`${t}|${r}|${e}|${u}|${l.join(",")}`;return p("sha256").update(m).digest("hex")}function x(t){try{process.platform!=="win32"&&y(t,384)}catch{}}function C(){try{if(!i(c))return null;const t=s(c,"utf-8").trim();return/^[a-f0-9]{64}$/.test(t)?t:null}catch{return null}}function a(t){try{h(o,{recursive:!0}),d(c,t+`
+`,"utf-8"),x(c)}catch{}}function R(){try{const t=f(o,"config.json");if(!i(t))return null;const r=s(t,"utf-8"),n=JSON.parse(r.replace(/^\uFEFF/,"")).machineId;return typeof n=="string"&&/^[a-f0-9]{64}$/.test(n)?n:null}catch{return null}}function D(t={}){const r=C();if(r)return r;const e=R();if(e)return t.strictReadOnly||a(e),e;const n=E();return t.strictReadOnly||a(n),n}export{E as computeHardwareFingerprint,D as getMachineFingerprint};

package/packages/client/dist/machine/index.js

@@ -1,5 +1 @@
-/**
- * @license FSL-1.1
- * Copyright (c) 2026 OrNexus AI
- */
-export { getMachineFingerprint } from './fingerprint.js';
+import{getMachineFingerprint as i}from"./fingerprint.js";export{i as getMachineFingerprint};

package/packages/client/dist/memory/project-memory-path-scope.js

@@ -1,62 +1 @@
-import { lstatSync, readlinkSync, realpathSync } from 'node:fs';
-import { dirname, isAbsolute, join, relative, resolve, sep, win32 } from 'node:path';
-import { CANONICAL_PROJECT_MEMORY_SOURCE } from './shared-project-memory-types.js';
-export function invalidProjectMemoryPath(reason) {
-    throw new Error(`project-memory-path-${reason}`);
-}
-export function isValidScopedRelativePath(path) {
-    return typeof path === 'string' && path.length > 0 && !path.startsWith('~') &&
-        !path.includes('\\') && !path.includes('\0') && !isAbsolute(path) &&
-        !win32.isAbsolute(path) && !/^[a-zA-Z]:/.test(path) &&
-        !path.split('/').some((segment) => segment === '' || segment === '.' || segment === '..');
-}
-/** Reject unsafe paths before canonical content or any target is read or written. */
-export function assertProjectMemoryPaths(projectRoot, relativeFiles) {
-    let root;
-    try {
-        root = realpathSync(projectRoot);
-    }
-    catch {
-        invalidProjectMemoryPath('out-of-scope');
-    }
-    const canonical = join(root, CANONICAL_PROJECT_MEMORY_SOURCE);
-    for (const relativeFile of relativeFiles) {
-        if (!isValidScopedRelativePath(relativeFile)) {
-            invalidProjectMemoryPath('invalid');
-        }
-        const candidate = resolve(root, relativeFile);
-        const fromRoot = relative(root, candidate);
-        if (fromRoot === '' || fromRoot === '..' || fromRoot.startsWith(`..${sep}`) || isAbsolute(fromRoot)) {
-            invalidProjectMemoryPath('out-of-scope');
-        }
-        const segments = relativeFile.split('/');
-        for (let index = 0; index < segments.length; index++) {
-            const current = join(root, ...segments.slice(0, index + 1));
-            let stat;
-            try {
-                stat = lstatSync(current);
-            }
-            catch (error) {
-                if (error.code === 'ENOENT')
-                    continue;
-                invalidProjectMemoryPath('out-of-scope');
-            }
-            if (!stat.isSymbolicLink())
-                continue;
-            if (index !== segments.length - 1 || relativeFile === CANONICAL_PROJECT_MEMORY_SOURCE) {
-                invalidProjectMemoryPath('out-of-scope');
-            }
-            // A pre-existing semantic file may link only to the canonical file.
-            let linkTarget;
-            try {
-                linkTarget = readlinkSync(current);
-            }
-            catch {
-                invalidProjectMemoryPath('out-of-scope');
-            }
-            if (resolve(dirname(current), linkTarget) !== canonical) {
-                invalidProjectMemoryPath('out-of-scope');
-            }
-        }
-    }
-}
+import{lstatSync as E,readlinkSync as P,realpathSync as S}from"node:fs";import{dirname as A,isAbsolute as u,join as m,relative as O,resolve as d,sep as R,win32 as g}from"node:path";import{CANONICAL_PROJECT_MEMORY_SOURCE as p}from"./shared-project-memory-types.js";function t(o){throw new Error(`project-memory-path-${o}`)}function j(o){return typeof o=="string"&&o.length>0&&!o.startsWith("~")&&!o.includes("\\")&&!o.includes("\0")&&!u(o)&&!g.isAbsolute(o)&&!/^[a-zA-Z]:/.test(o)&&!o.split("/").some(e=>e===""||e==="."||e==="..")}function N(o,e){let i;try{i=S(o)}catch{t("out-of-scope")}const y=m(i,p);for(const r of e){j(r)||t("invalid");const h=d(i,r),c=O(i,h);(c===""||c===".."||c.startsWith(`..${R}`)||u(c))&&t("out-of-scope");const s=r.split("/");for(let n=0;n<s.length;n++){const l=m(i,...s.slice(0,n+1));let f;try{f=E(l)}catch(v){if(v.code==="ENOENT")continue;t("out-of-scope")}if(!f.isSymbolicLink())continue;(n!==s.length-1||r===p)&&t("out-of-scope");let a;try{a=P(l)}catch{t("out-of-scope")}d(A(l),a)!==y&&t("out-of-scope")}}}export{N as assertProjectMemoryPaths,t as invalidProjectMemoryPath,j as isValidScopedRelativePath};