@paraharness/fs 0.0.0-stage → 0.1.0

package/dist/builders/create-fs-protect-guard-builder.js

@@ -0,0 +1,22 @@
+/**
+ * Compiles a passive `FsProtectGuardNode` (`fs:protect`) for `fs.protect(globs)`.
+ *
+ * Blocks any write mutation targeting files matching `globs` unless covered by an
+ * explicitly elevated capability lease.
+ *
+ * @param {readonly string[]} globs - Protected file glob patterns.
+ *
+ * @returns {FsProtectGuardNode} Deeply frozen `FsProtectGuardNode` AST descriptor.
+ */
+export function createFsProtectGuardBuilder(globs) {
+    if (!Array.isArray(globs) || globs.length === 0) {
+        throw new Error('fs.protect requires a non-empty globs array.');
+    }
+    const frozenGlobs = Object.freeze([...globs]);
+    return Object.freeze({
+        type: 'fs:protect',
+        id: `fs:protect:${frozenGlobs.join(',')}`,
+        globs: frozenGlobs,
+    });
+}
+//# sourceMappingURL=create-fs-protect-guard-builder.js.map

package/dist/builders/create-fs-protect-guard-builder.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"create-fs-protect-guard-builder.js","sourceRoot":"","sources":["../../src/builders/create-fs-protect-guard-builder.ts"],"names":[],"mappings":"AAEA;;;;;;;;;GASG;AACH,MAAM,UAAU,2BAA2B,CAAC,KAAwB;IAClE,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAChD,MAAM,IAAI,KAAK,CAAC,8CAA8C,CAAC,CAAC;IAClE,CAAC;IACD,MAAM,WAAW,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,GAAG,KAAK,CAAC,CAAC,CAAC;IAC9C,OAAO,MAAM,CAAC,MAAM,CAAqB;QACvC,IAAI,EAAE,YAAY;QAClB,EAAE,EAAE,cAAc,WAAW,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE;QACzC,KAAK,EAAE,WAAW;KACnB,CAAC,CAAC;AACL,CAAC"}

package/dist/builders/create-fs-read-only-guard-builder.d.ts

@@ -0,0 +1,11 @@
+import type { FsReadOnlyGuardNode } from '@paraharness/core';
+/**
+ * Compiles a passive `FsReadOnlyGuardNode` (`fs:read-only`) for `fs.readOnly()`.
+ *
+ * Rejects all filesystem write mutations across declared and post-flight-diffed tools
+ * unless covered by an active capability lease.
+ *
+ * @returns {FsReadOnlyGuardNode} Deeply frozen `FsReadOnlyGuardNode` AST descriptor.
+ */
+export declare function createFsReadOnlyGuardBuilder(): FsReadOnlyGuardNode;
+//# sourceMappingURL=create-fs-read-only-guard-builder.d.ts.map

package/dist/builders/create-fs-read-only-guard-builder.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"create-fs-read-only-guard-builder.d.ts","sourceRoot":"","sources":["../../src/builders/create-fs-read-only-guard-builder.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,mBAAmB,CAAC;AAE7D;;;;;;;GAOG;AACH,wBAAgB,4BAA4B,IAAI,mBAAmB,CAKlE"}

package/dist/builders/create-fs-read-only-guard-builder.js

@@ -0,0 +1,15 @@
+/**
+ * Compiles a passive `FsReadOnlyGuardNode` (`fs:read-only`) for `fs.readOnly()`.
+ *
+ * Rejects all filesystem write mutations across declared and post-flight-diffed tools
+ * unless covered by an active capability lease.
+ *
+ * @returns {FsReadOnlyGuardNode} Deeply frozen `FsReadOnlyGuardNode` AST descriptor.
+ */
+export function createFsReadOnlyGuardBuilder() {
+    return Object.freeze({
+        type: 'fs:read-only',
+        id: 'fs:read-only',
+    });
+}
+//# sourceMappingURL=create-fs-read-only-guard-builder.js.map

package/dist/builders/create-fs-read-only-guard-builder.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"create-fs-read-only-guard-builder.js","sourceRoot":"","sources":["../../src/builders/create-fs-read-only-guard-builder.ts"],"names":[],"mappings":"AAEA;;;;;;;GAOG;AACH,MAAM,UAAU,4BAA4B;IAC1C,OAAO,MAAM,CAAC,MAAM,CAAsB;QACxC,IAAI,EAAE,cAAc;QACpB,EAAE,EAAE,cAAc;KACnB,CAAC,CAAC;AACL,CAAC"}

package/dist/builders/create-fs-read-only-tools.d.ts

@@ -0,0 +1,15 @@
+import { type FsGlobToolNode, type FsGrepToolNode, type FsReadToolNode, type MaybeBuilder, type NodeRunnerNode } from '@paraharness/core';
+/**
+ * Compiles the 3-tool workspace-jailed read-only bundle (`fs.readOnlyTools(runner)`).
+ *
+ * Returns passive `ToolASTNode` descriptors (`read_file`, `glob_files`, `grep_files`)
+ * with `effectTracking: 'declared'` for evaluators, adjudicators, and arbiters.
+ *
+ * @template THandle Runtime handle type of the active isolation scope.
+ *
+ * @param {MaybeBuilder<NodeRunnerNode>} runner - Runner pool AST node or builder.
+ *
+ * @returns {readonly [FsReadToolNode<THandle>, FsGlobToolNode<THandle>, FsGrepToolNode<THandle>]} Frozen 3-tuple of read-only filesystem tool AST nodes.
+ */
+export declare function createFsReadOnlyTools<THandle = unknown>(runner: MaybeBuilder<NodeRunnerNode>): readonly [FsReadToolNode<THandle>, FsGlobToolNode<THandle>, FsGrepToolNode<THandle>];
+//# sourceMappingURL=create-fs-read-only-tools.d.ts.map

package/dist/builders/create-fs-read-only-tools.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"create-fs-read-only-tools.d.ts","sourceRoot":"","sources":["../../src/builders/create-fs-read-only-tools.ts"],"names":[],"mappings":"AAAA,OAAO,EAEL,KAAK,cAAc,EACnB,KAAK,cAAc,EACnB,KAAK,cAAc,EACnB,KAAK,YAAY,EACjB,KAAK,cAAc,EACpB,MAAM,mBAAmB,CAAC;AAO3B;;;;;;;;;;;GAWG;AACH,wBAAgB,qBAAqB,CAAC,OAAO,GAAG,OAAO,EACrD,MAAM,EAAE,YAAY,CAAC,cAAc,CAAC,GACnC,SAAS,CAAC,cAAc,CAAC,OAAO,CAAC,EAAE,cAAc,CAAC,OAAO,CAAC,EAAE,cAAc,CAAC,OAAO,CAAC,CAAC,CAOtF"}

package/dist/builders/create-fs-read-only-tools.js

@@ -0,0 +1,23 @@
+import { extractAST, } from '@paraharness/core';
+import { buildFsGlobToolNode, buildFsGrepToolNode, buildFsReadToolNode, } from './internal/build-fs-tool-nodes.js';
+/**
+ * Compiles the 3-tool workspace-jailed read-only bundle (`fs.readOnlyTools(runner)`).
+ *
+ * Returns passive `ToolASTNode` descriptors (`read_file`, `glob_files`, `grep_files`)
+ * with `effectTracking: 'declared'` for evaluators, adjudicators, and arbiters.
+ *
+ * @template THandle Runtime handle type of the active isolation scope.
+ *
+ * @param {MaybeBuilder<NodeRunnerNode>} runner - Runner pool AST node or builder.
+ *
+ * @returns {readonly [FsReadToolNode<THandle>, FsGlobToolNode<THandle>, FsGrepToolNode<THandle>]} Frozen 3-tuple of read-only filesystem tool AST nodes.
+ */
+export function createFsReadOnlyTools(runner) {
+    const runnerNode = extractAST(runner);
+    return Object.freeze([
+        buildFsReadToolNode(runnerNode),
+        buildFsGlobToolNode(runnerNode),
+        buildFsGrepToolNode(runnerNode),
+    ]);
+}
+//# sourceMappingURL=create-fs-read-only-tools.js.map

package/dist/builders/create-fs-read-only-tools.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"create-fs-read-only-tools.js","sourceRoot":"","sources":["../../src/builders/create-fs-read-only-tools.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,UAAU,GAMX,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EACL,mBAAmB,EACnB,mBAAmB,EACnB,mBAAmB,GACpB,MAAM,mCAAmC,CAAC;AAE3C;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,qBAAqB,CACnC,MAAoC;IAEpC,MAAM,UAAU,GAAG,UAAU,CAAC,MAAM,CAAC,CAAC;IACtC,OAAO,MAAM,CAAC,MAAM,CAAC;QACnB,mBAAmB,CAAU,UAAU,CAAC;QACxC,mBAAmB,CAAU,UAAU,CAAC;QACxC,mBAAmB,CAAU,UAAU,CAAC;KACzC,CAAC,CAAC;AACL,CAAC"}

package/dist/builders/create-fs-regex-check-builder.d.ts

@@ -0,0 +1,34 @@
+import type { FsRegexCheckNode } from '@paraharness/core';
+/**
+ * Configuration options for `fs.regexCheck(id, options)`.
+ *
+ * Specifies the target file globs to inspect among mutated files, the forbidden regex
+ * pattern (as a `string` or `RegExp`), and the deficit message reported on match.
+ */
+export interface FsRegexCheckOptions {
+    /** Glob patterns selecting mutated files to scan. */
+    readonly targetGlobs: readonly string[];
+    /** Regular expression pattern or `RegExp` instance that fails the check when matched. */
+    readonly forbidPattern: string | RegExp;
+    /** Optional regular expression flags when `forbidPattern` is provided as a string. */
+    readonly forbidFlags?: string;
+    /** Diagnostic message reported in `deficits` when a match is found. */
+    readonly violationMessage: string;
+}
+/**
+ * Compiles a passive `FsRegexCheckNode` (`fs:regex-check`) for `fs.regexCheck(id, options)`.
+ *
+ * Normalizes `options.forbidPattern` (`string | RegExp`) into serializable `forbidPattern`
+ * and `forbidFlags` properties and validates regular expression compilation at build time.
+ *
+ * @template THandle Runtime handle type of the active isolation scope.
+ *
+ * @param {string}              id      - Unique identifier for the regex check.
+ * @param {FsRegexCheckOptions} options - Target globs, forbidden pattern, and violation message.
+ *
+ * @returns {FsRegexCheckNode<THandle>} Deeply frozen `FsRegexCheckNode` AST descriptor.
+ *
+ * @throws {Error} If `id`, `options.targetGlobs`, or `options.violationMessage` is empty.
+ */
+export declare function createFsRegexCheckBuilder<THandle = unknown>(id: string, options: FsRegexCheckOptions): FsRegexCheckNode<THandle>;
+//# sourceMappingURL=create-fs-regex-check-builder.d.ts.map

package/dist/builders/create-fs-regex-check-builder.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"create-fs-regex-check-builder.d.ts","sourceRoot":"","sources":["../../src/builders/create-fs-regex-check-builder.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,mBAAmB,CAAC;AAE1D;;;;;GAKG;AACH,MAAM,WAAW,mBAAmB;IAClC,qDAAqD;IACrD,QAAQ,CAAC,WAAW,EAAE,SAAS,MAAM,EAAE,CAAC;IACxC,yFAAyF;IACzF,QAAQ,CAAC,aAAa,EAAE,MAAM,GAAG,MAAM,CAAC;IACxC,sFAAsF;IACtF,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;IAC9B,uEAAuE;IACvE,QAAQ,CAAC,gBAAgB,EAAE,MAAM,CAAC;CACnC;AA6BD;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,yBAAyB,CAAC,OAAO,GAAG,OAAO,EACzD,EAAE,EAAE,MAAM,EACV,OAAO,EAAE,mBAAmB,GAC3B,gBAAgB,CAAC,OAAO,CAAC,CAmB3B"}

package/dist/builders/create-fs-regex-check-builder.js

@@ -0,0 +1,58 @@
+/**
+ * Resolves the normalized regular expression pattern source and flags from `options`.
+ *
+ * Validates that the compiled `RegExp` is syntactically valid at AST construction time.
+ *
+ * @param {FsRegexCheckOptions} options - Regex check options containing `forbidPattern` and `forbidFlags`.
+ *
+ * @returns {{ readonly forbidPattern: string; readonly forbidFlags: string | undefined }} Normalized pattern and optional flags.
+ */
+function resolveForbidPatternAndFlags(options) {
+    if (options.forbidPattern instanceof RegExp) {
+        const rawFlags = options.forbidFlags ?? options.forbidPattern.flags;
+        const forbidFlags = rawFlags.length > 0 ? rawFlags : undefined;
+        void new RegExp(options.forbidPattern.source, forbidFlags);
+        return { forbidPattern: options.forbidPattern.source, forbidFlags };
+    }
+    const forbidFlags = options.forbidFlags !== undefined && options.forbidFlags.length > 0
+        ? options.forbidFlags
+        : undefined;
+    void new RegExp(options.forbidPattern, forbidFlags);
+    return { forbidPattern: options.forbidPattern, forbidFlags };
+}
+/**
+ * Compiles a passive `FsRegexCheckNode` (`fs:regex-check`) for `fs.regexCheck(id, options)`.
+ *
+ * Normalizes `options.forbidPattern` (`string | RegExp`) into serializable `forbidPattern`
+ * and `forbidFlags` properties and validates regular expression compilation at build time.
+ *
+ * @template THandle Runtime handle type of the active isolation scope.
+ *
+ * @param {string}              id      - Unique identifier for the regex check.
+ * @param {FsRegexCheckOptions} options - Target globs, forbidden pattern, and violation message.
+ *
+ * @returns {FsRegexCheckNode<THandle>} Deeply frozen `FsRegexCheckNode` AST descriptor.
+ *
+ * @throws {Error} If `id`, `options.targetGlobs`, or `options.violationMessage` is empty.
+ */
+export function createFsRegexCheckBuilder(id, options) {
+    if (typeof id !== 'string' || id.trim().length === 0) {
+        throw new Error('fs.regexCheck requires a non-empty check id.');
+    }
+    if (!Array.isArray(options.targetGlobs) || options.targetGlobs.length === 0) {
+        throw new Error(`fs.regexCheck('${id}') requires a non-empty targetGlobs array.`);
+    }
+    if (typeof options.violationMessage !== 'string' || options.violationMessage.trim().length === 0) {
+        throw new Error(`fs.regexCheck('${id}') requires a non-empty violationMessage.`);
+    }
+    const { forbidPattern, forbidFlags } = resolveForbidPatternAndFlags(options);
+    return Object.freeze({
+        type: 'fs:regex-check',
+        id: id.trim(),
+        targetGlobs: Object.freeze([...options.targetGlobs]),
+        forbidPattern,
+        forbidFlags,
+        violationMessage: options.violationMessage,
+    });
+}
+//# sourceMappingURL=create-fs-regex-check-builder.js.map

package/dist/builders/create-fs-regex-check-builder.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"create-fs-regex-check-builder.js","sourceRoot":"","sources":["../../src/builders/create-fs-regex-check-builder.ts"],"names":[],"mappings":"AAmBA;;;;;;;;GAQG;AACH,SAAS,4BAA4B,CAAC,OAA4B;IAIhE,IAAI,OAAO,CAAC,aAAa,YAAY,MAAM,EAAE,CAAC;QAC5C,MAAM,QAAQ,GAAG,OAAO,CAAC,WAAW,IAAI,OAAO,CAAC,aAAa,CAAC,KAAK,CAAC;QACpE,MAAM,WAAW,GAAG,QAAQ,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,SAAS,CAAC;QAC/D,KAAK,IAAI,MAAM,CAAC,OAAO,CAAC,aAAa,CAAC,MAAM,EAAE,WAAW,CAAC,CAAC;QAC3D,OAAO,EAAE,aAAa,EAAE,OAAO,CAAC,aAAa,CAAC,MAAM,EAAE,WAAW,EAAE,CAAC;IACtE,CAAC;IACD,MAAM,WAAW,GACf,OAAO,CAAC,WAAW,KAAK,SAAS,IAAI,OAAO,CAAC,WAAW,CAAC,MAAM,GAAG,CAAC;QACjE,CAAC,CAAC,OAAO,CAAC,WAAW;QACrB,CAAC,CAAC,SAAS,CAAC;IAChB,KAAK,IAAI,MAAM,CAAC,OAAO,CAAC,aAAa,EAAE,WAAW,CAAC,CAAC;IACpD,OAAO,EAAE,aAAa,EAAE,OAAO,CAAC,aAAa,EAAE,WAAW,EAAE,CAAC;AAC/D,CAAC;AAED;;;;;;;;;;;;;;GAcG;AACH,MAAM,UAAU,yBAAyB,CACvC,EAAU,EACV,OAA4B;IAE5B,IAAI,OAAO,EAAE,KAAK,QAAQ,IAAI,EAAE,CAAC,IAAI,EAAE,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACrD,MAAM,IAAI,KAAK,CAAC,8CAA8C,CAAC,CAAC;IAClE,CAAC;IACD,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,WAAW,CAAC,IAAI,OAAO,CAAC,WAAW,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC5E,MAAM,IAAI,KAAK,CAAC,kBAAkB,EAAE,4CAA4C,CAAC,CAAC;IACpF,CAAC;IACD,IAAI,OAAO,OAAO,CAAC,gBAAgB,KAAK,QAAQ,IAAI,OAAO,CAAC,gBAAgB,CAAC,IAAI,EAAE,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACjG,MAAM,IAAI,KAAK,CAAC,kBAAkB,EAAE,2CAA2C,CAAC,CAAC;IACnF,CAAC;IACD,MAAM,EAAE,aAAa,EAAE,WAAW,EAAE,GAAG,4BAA4B,CAAC,OAAO,CAAC,CAAC;IAC7E,OAAO,MAAM,CAAC,MAAM,CAA4B;QAC9C,IAAI,EAAE,gBAAgB;QACtB,EAAE,EAAE,EAAE,CAAC,IAAI,EAAE;QACb,WAAW,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC,GAAG,OAAO,CAAC,WAAW,CAAC,CAAC;QACpD,aAAa;QACb,WAAW;QACX,gBAAgB,EAAE,OAAO,CAAC,gBAAgB;KAC3C,CAAC,CAAC;AACL,CAAC"}

package/dist/builders/create-fs-require-read-before-write-guard-builder.d.ts

@@ -0,0 +1,11 @@
+import type { FsRequireReadBeforeWriteGuardNode } from '@paraharness/core';
+/**
+ * Compiles a passive `FsRequireReadBeforeWriteGuardNode` (`fs:require-read-before-write`) for `fs.requireReadBeforeWrite()`.
+ *
+ * Rejects mutating any file that already existed at `baseRef` unless `observedEffects`
+ * contains a prior read effect for that path in the active session.
+ *
+ * @returns {FsRequireReadBeforeWriteGuardNode} Deeply frozen `FsRequireReadBeforeWriteGuardNode` AST descriptor.
+ */
+export declare function createFsRequireReadBeforeWriteGuardBuilder(): FsRequireReadBeforeWriteGuardNode;
+//# sourceMappingURL=create-fs-require-read-before-write-guard-builder.d.ts.map

package/dist/builders/create-fs-require-read-before-write-guard-builder.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"create-fs-require-read-before-write-guard-builder.d.ts","sourceRoot":"","sources":["../../src/builders/create-fs-require-read-before-write-guard-builder.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,iCAAiC,EAAE,MAAM,mBAAmB,CAAC;AAE3E;;;;;;;GAOG;AACH,wBAAgB,0CAA0C,IAAI,iCAAiC,CAK9F"}

package/dist/builders/create-fs-require-read-before-write-guard-builder.js

@@ -0,0 +1,15 @@
+/**
+ * Compiles a passive `FsRequireReadBeforeWriteGuardNode` (`fs:require-read-before-write`) for `fs.requireReadBeforeWrite()`.
+ *
+ * Rejects mutating any file that already existed at `baseRef` unless `observedEffects`
+ * contains a prior read effect for that path in the active session.
+ *
+ * @returns {FsRequireReadBeforeWriteGuardNode} Deeply frozen `FsRequireReadBeforeWriteGuardNode` AST descriptor.
+ */
+export function createFsRequireReadBeforeWriteGuardBuilder() {
+    return Object.freeze({
+        type: 'fs:require-read-before-write',
+        id: 'fs:require-read-before-write',
+    });
+}
+//# sourceMappingURL=create-fs-require-read-before-write-guard-builder.js.map

package/dist/builders/create-fs-require-read-before-write-guard-builder.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"create-fs-require-read-before-write-guard-builder.js","sourceRoot":"","sources":["../../src/builders/create-fs-require-read-before-write-guard-builder.ts"],"names":[],"mappings":"AAEA;;;;;;;GAOG;AACH,MAAM,UAAU,0CAA0C;IACxD,OAAO,MAAM,CAAC,MAAM,CAAoC;QACtD,IAAI,EAAE,8BAA8B;QACpC,EAAE,EAAE,8BAA8B;KACnC,CAAC,CAAC;AACL,CAAC"}

package/dist/builders/create-fs-scoped-write-guard-builder.d.ts

@@ -0,0 +1,15 @@
+import type { FsPartitionMapNode, FsScopedWriteGuardNode } from '@paraharness/core';
+/**
+ * Compiles a passive `FsScopedWriteGuardNode` (`fs:scoped-write`) for `fs.scopedWrite(partitionMap)`.
+ *
+ * Restricts write mutations strictly to the union of member `globs` for the actor's
+ * `activePartitions` in `partitionMap`.
+ *
+ * @template TPartition Literal union of partition identifiers in `partitionMap`.
+ *
+ * @param {FsPartitionMapNode<TPartition>} partitionMap - Filesystem partition map AST node.
+ *
+ * @returns {FsScopedWriteGuardNode} Deeply frozen `FsScopedWriteGuardNode` AST descriptor.
+ */
+export declare function createFsScopedWriteGuardBuilder<TPartition extends string = string>(partitionMap: FsPartitionMapNode<TPartition>): FsScopedWriteGuardNode;
+//# sourceMappingURL=create-fs-scoped-write-guard-builder.d.ts.map

package/dist/builders/create-fs-scoped-write-guard-builder.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"create-fs-scoped-write-guard-builder.d.ts","sourceRoot":"","sources":["../../src/builders/create-fs-scoped-write-guard-builder.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,kBAAkB,EAAE,sBAAsB,EAAE,MAAM,mBAAmB,CAAC;AAEpF;;;;;;;;;;;GAWG;AACH,wBAAgB,+BAA+B,CAAC,UAAU,SAAS,MAAM,GAAG,MAAM,EAChF,YAAY,EAAE,kBAAkB,CAAC,UAAU,CAAC,GAC3C,sBAAsB,CAMxB"}

package/dist/builders/create-fs-scoped-write-guard-builder.js

@@ -0,0 +1,20 @@
+/**
+ * Compiles a passive `FsScopedWriteGuardNode` (`fs:scoped-write`) for `fs.scopedWrite(partitionMap)`.
+ *
+ * Restricts write mutations strictly to the union of member `globs` for the actor's
+ * `activePartitions` in `partitionMap`.
+ *
+ * @template TPartition Literal union of partition identifiers in `partitionMap`.
+ *
+ * @param {FsPartitionMapNode<TPartition>} partitionMap - Filesystem partition map AST node.
+ *
+ * @returns {FsScopedWriteGuardNode} Deeply frozen `FsScopedWriteGuardNode` AST descriptor.
+ */
+export function createFsScopedWriteGuardBuilder(partitionMap) {
+    return Object.freeze({
+        type: 'fs:scoped-write',
+        id: `fs:scoped-write:${partitionMap.topology.id}`,
+        partitionMap: partitionMap,
+    });
+}
+//# sourceMappingURL=create-fs-scoped-write-guard-builder.js.map

package/dist/builders/create-fs-scoped-write-guard-builder.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"create-fs-scoped-write-guard-builder.js","sourceRoot":"","sources":["../../src/builders/create-fs-scoped-write-guard-builder.ts"],"names":[],"mappings":"AAEA;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,+BAA+B,CAC7C,YAA4C;IAE5C,OAAO,MAAM,CAAC,MAAM,CAAyB;QAC3C,IAAI,EAAE,iBAAiB;QACvB,EAAE,EAAE,mBAAmB,YAAY,CAAC,QAAQ,CAAC,EAAE,EAAE;QACjD,YAAY,EAAE,YAA0C;KACzD,CAAC,CAAC;AACL,CAAC"}

package/dist/builders/create-fs-secret-literals-guard-builder.d.ts

@@ -0,0 +1,13 @@
+import type { FsSecretLiteralsGuardNode } from '@paraharness/core';
+/**
+ * Compiles a passive `FsSecretLiteralsGuardNode` (`fs:secret-literals`) for `fs.secretLiterals(patterns)`.
+ *
+ * Scans `proposedContent` on pre-flight and post-flight file writes against built-in
+ * credential patterns and any custom regex `patterns`.
+ *
+ * @param {readonly string[]} [patterns] - Optional custom regular expression pattern strings.
+ *
+ * @returns {FsSecretLiteralsGuardNode} Deeply frozen `FsSecretLiteralsGuardNode` AST descriptor.
+ */
+export declare function createFsSecretLiteralsGuardBuilder(patterns?: readonly string[]): FsSecretLiteralsGuardNode;
+//# sourceMappingURL=create-fs-secret-literals-guard-builder.d.ts.map

package/dist/builders/create-fs-secret-literals-guard-builder.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"create-fs-secret-literals-guard-builder.d.ts","sourceRoot":"","sources":["../../src/builders/create-fs-secret-literals-guard-builder.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,yBAAyB,EAAE,MAAM,mBAAmB,CAAC;AAEnE;;;;;;;;;GASG;AACH,wBAAgB,kCAAkC,CAChD,QAAQ,CAAC,EAAE,SAAS,MAAM,EAAE,GAC3B,yBAAyB,CAU3B"}

package/dist/builders/create-fs-secret-literals-guard-builder.js

@@ -0,0 +1,21 @@
+/**
+ * Compiles a passive `FsSecretLiteralsGuardNode` (`fs:secret-literals`) for `fs.secretLiterals(patterns)`.
+ *
+ * Scans `proposedContent` on pre-flight and post-flight file writes against built-in
+ * credential patterns and any custom regex `patterns`.
+ *
+ * @param {readonly string[]} [patterns] - Optional custom regular expression pattern strings.
+ *
+ * @returns {FsSecretLiteralsGuardNode} Deeply frozen `FsSecretLiteralsGuardNode` AST descriptor.
+ */
+export function createFsSecretLiteralsGuardBuilder(patterns) {
+    const frozenPatterns = patterns !== undefined ? Object.freeze([...patterns]) : undefined;
+    return Object.freeze({
+        type: 'fs:secret-literals',
+        id: frozenPatterns !== undefined && frozenPatterns.length > 0
+            ? `fs:secret-literals:${frozenPatterns.join(',')}`
+            : 'fs:secret-literals',
+        patterns: frozenPatterns,
+    });
+}
+//# sourceMappingURL=create-fs-secret-literals-guard-builder.js.map

package/dist/builders/create-fs-secret-literals-guard-builder.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"create-fs-secret-literals-guard-builder.js","sourceRoot":"","sources":["../../src/builders/create-fs-secret-literals-guard-builder.ts"],"names":[],"mappings":"AAEA;;;;;;;;;GASG;AACH,MAAM,UAAU,kCAAkC,CAChD,QAA4B;IAE5B,MAAM,cAAc,GAAG,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,GAAG,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IACzF,OAAO,MAAM,CAAC,MAAM,CAA4B;QAC9C,IAAI,EAAE,oBAAoB;QAC1B,EAAE,EACA,cAAc,KAAK,SAAS,IAAI,cAAc,CAAC,MAAM,GAAG,CAAC;YACvD,CAAC,CAAC,sBAAsB,cAAc,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE;YAClD,CAAC,CAAC,oBAAoB;QAC1B,QAAQ,EAAE,cAAc;KACzB,CAAC,CAAC;AACL,CAAC"}

package/dist/builders/create-fs-telemetry-builder.d.ts

@@ -0,0 +1,11 @@
+import type { FsTelemetryCollectorNode } from '@paraharness/core';
+/**
+ * Compiles a passive `FsTelemetryCollectorNode` (`fs:telemetry`) for `fs.telemetry()`.
+ *
+ * Collects distinct `filesRead` and `filesMutated` arrays from `FsToolEffect` records
+ * into `UniversalStepTelemetry.custom`.
+ *
+ * @returns {FsTelemetryCollectorNode} Deeply frozen `FsTelemetryCollectorNode` AST descriptor.
+ */
+export declare function createFsTelemetryBuilder(): FsTelemetryCollectorNode;
+//# sourceMappingURL=create-fs-telemetry-builder.d.ts.map

package/dist/builders/create-fs-telemetry-builder.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"create-fs-telemetry-builder.d.ts","sourceRoot":"","sources":["../../src/builders/create-fs-telemetry-builder.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,mBAAmB,CAAC;AAGlE;;;;;;;GAOG;AACH,wBAAgB,wBAAwB,IAAI,wBAAwB,CAMnE"}

package/dist/builders/create-fs-telemetry-builder.js

@@ -0,0 +1,17 @@
+import { FsTelemetryMetricsSchema } from './internal/fs-tool-input.schema.js';
+/**
+ * Compiles a passive `FsTelemetryCollectorNode` (`fs:telemetry`) for `fs.telemetry()`.
+ *
+ * Collects distinct `filesRead` and `filesMutated` arrays from `FsToolEffect` records
+ * into `UniversalStepTelemetry.custom`.
+ *
+ * @returns {FsTelemetryCollectorNode} Deeply frozen `FsTelemetryCollectorNode` AST descriptor.
+ */
+export function createFsTelemetryBuilder() {
+    return Object.freeze({
+        type: 'fs:telemetry',
+        id: 'fs:telemetry',
+        schema: FsTelemetryMetricsSchema,
+    });
+}
+//# sourceMappingURL=create-fs-telemetry-builder.js.map

package/dist/builders/create-fs-telemetry-builder.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"create-fs-telemetry-builder.js","sourceRoot":"","sources":["../../src/builders/create-fs-telemetry-builder.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,wBAAwB,EAAE,MAAM,oCAAoC,CAAC;AAE9E;;;;;;;GAOG;AACH,MAAM,UAAU,wBAAwB;IACtC,OAAO,MAAM,CAAC,MAAM,CAA2B;QAC7C,IAAI,EAAE,cAAc;QACpB,EAAE,EAAE,cAAc;QAClB,MAAM,EAAE,wBAAwB;KACjC,CAAC,CAAC;AACL,CAAC"}

package/dist/builders/create-fs-text-source-builder.d.ts

@@ -0,0 +1,14 @@
+import type { FsTextSourceNode } from '@paraharness/core';
+/**
+ * Compiles a passive `FsTextSourceNode` (`fs:text-source`) for `fs.text(filePath)`.
+ *
+ * Resolves `filePath` against the immutable host repository root during control-plane
+ * and prefix compilation, or against `ResolutionContext.scopeHandle` when computing
+ * in-run grounding diffs.
+ *
+ * @param {string} filePath - Repository-relative path to the UTF-8 text file.
+ *
+ * @returns {FsTextSourceNode} Deeply frozen `FsTextSourceNode` AST descriptor.
+ */
+export declare function createFsTextSourceBuilder(filePath: string): FsTextSourceNode;
+//# sourceMappingURL=create-fs-text-source-builder.d.ts.map

package/dist/builders/create-fs-text-source-builder.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"create-fs-text-source-builder.d.ts","sourceRoot":"","sources":["../../src/builders/create-fs-text-source-builder.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,mBAAmB,CAAC;AAE1D;;;;;;;;;;GAUG;AACH,wBAAgB,yBAAyB,CAAC,QAAQ,EAAE,MAAM,GAAG,gBAAgB,CAU5E"}

package/dist/builders/create-fs-text-source-builder.js

@@ -0,0 +1,23 @@
+/**
+ * Compiles a passive `FsTextSourceNode` (`fs:text-source`) for `fs.text(filePath)`.
+ *
+ * Resolves `filePath` against the immutable host repository root during control-plane
+ * and prefix compilation, or against `ResolutionContext.scopeHandle` when computing
+ * in-run grounding diffs.
+ *
+ * @param {string} filePath - Repository-relative path to the UTF-8 text file.
+ *
+ * @returns {FsTextSourceNode} Deeply frozen `FsTextSourceNode` AST descriptor.
+ */
+export function createFsTextSourceBuilder(filePath) {
+    if (typeof filePath !== 'string' || filePath.trim().length === 0) {
+        throw new Error('fs.text requires a non-empty filePath string.');
+    }
+    const normalizedPath = filePath.trim();
+    return Object.freeze({
+        type: 'fs:text-source',
+        id: `fs:text-source:${normalizedPath}`,
+        path: normalizedPath,
+    });
+}
+//# sourceMappingURL=create-fs-text-source-builder.js.map

package/dist/builders/create-fs-text-source-builder.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"create-fs-text-source-builder.js","sourceRoot":"","sources":["../../src/builders/create-fs-text-source-builder.ts"],"names":[],"mappings":"AAEA;;;;;;;;;;GAUG;AACH,MAAM,UAAU,yBAAyB,CAAC,QAAgB;IACxD,IAAI,OAAO,QAAQ,KAAK,QAAQ,IAAI,QAAQ,CAAC,IAAI,EAAE,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACjE,MAAM,IAAI,KAAK,CAAC,+CAA+C,CAAC,CAAC;IACnE,CAAC;IACD,MAAM,cAAc,GAAG,QAAQ,CAAC,IAAI,EAAE,CAAC;IACvC,OAAO,MAAM,CAAC,MAAM,CAAmB;QACrC,IAAI,EAAE,gBAAgB;QACtB,EAAE,EAAE,kBAAkB,cAAc,EAAE;QACtC,IAAI,EAAE,cAAc;KACrB,CAAC,CAAC;AACL,CAAC"}

package/dist/builders/create-fs-write-guard-builder.d.ts

@@ -0,0 +1,29 @@
+import type { FsWriteGuardNode } from '@paraharness/core';
+/**
+ * Configuration options for `fs.writeGuard(options)`.
+ *
+ * Defines glob patterns that deny write mutations (`denyGlobs`), optional exemptions
+ * (`allowGlobs`), and optional base-ref existence filtering (`onlyExistingAtBaseRef`).
+ */
+export interface FsWriteGuardOptions {
+    /** Glob patterns denying write mutations. */
+    readonly denyGlobs: readonly string[];
+    /** Optional glob patterns exempted from `denyGlobs`. */
+    readonly allowGlobs?: readonly string[];
+    /** When `true`, blocks only paths that already existed at `handle.baseRef`. */
+    readonly onlyExistingAtBaseRef?: boolean;
+}
+/**
+ * Compiles a passive `FsWriteGuardNode` (`fs:write-guard`) for `fs.writeGuard(options)`.
+ *
+ * Rejects write effects matching `options.denyGlobs` unless exempted by `options.allowGlobs`
+ * or an active `LeaseDelta`, optionally scoping denials to files existing at `baseRef`.
+ *
+ * @param {FsWriteGuardOptions} options - Write guard deny/allow glob and baseRef options.
+ *
+ * @returns {FsWriteGuardNode} Deeply frozen `FsWriteGuardNode` AST descriptor.
+ *
+ * @throws {Error} If `options.denyGlobs` is empty.
+ */
+export declare function createFsWriteGuardBuilder(options: FsWriteGuardOptions): FsWriteGuardNode;
+//# sourceMappingURL=create-fs-write-guard-builder.d.ts.map

package/dist/builders/create-fs-write-guard-builder.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"create-fs-write-guard-builder.d.ts","sourceRoot":"","sources":["../../src/builders/create-fs-write-guard-builder.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,mBAAmB,CAAC;AAE1D;;;;;GAKG;AACH,MAAM,WAAW,mBAAmB;IAClC,6CAA6C;IAC7C,QAAQ,CAAC,SAAS,EAAE,SAAS,MAAM,EAAE,CAAC;IACtC,wDAAwD;IACxD,QAAQ,CAAC,UAAU,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IACxC,+EAA+E;IAC/E,QAAQ,CAAC,qBAAqB,CAAC,EAAE,OAAO,CAAC;CAC1C;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,yBAAyB,CAAC,OAAO,EAAE,mBAAmB,GAAG,gBAAgB,CAgBxF"}

package/dist/builders/create-fs-write-guard-builder.js

@@ -0,0 +1,29 @@
+/**
+ * Compiles a passive `FsWriteGuardNode` (`fs:write-guard`) for `fs.writeGuard(options)`.
+ *
+ * Rejects write effects matching `options.denyGlobs` unless exempted by `options.allowGlobs`
+ * or an active `LeaseDelta`, optionally scoping denials to files existing at `baseRef`.
+ *
+ * @param {FsWriteGuardOptions} options - Write guard deny/allow glob and baseRef options.
+ *
+ * @returns {FsWriteGuardNode} Deeply frozen `FsWriteGuardNode` AST descriptor.
+ *
+ * @throws {Error} If `options.denyGlobs` is empty.
+ */
+export function createFsWriteGuardBuilder(options) {
+    if (!Array.isArray(options.denyGlobs) || options.denyGlobs.length === 0) {
+        throw new Error('fs.writeGuard requires a non-empty denyGlobs array.');
+    }
+    const denyGlobs = Object.freeze([...options.denyGlobs]);
+    const allowGlobs = options.allowGlobs !== undefined ? Object.freeze([...options.allowGlobs]) : undefined;
+    const allowKey = allowGlobs !== undefined ? allowGlobs.join(',') : '';
+    const existingKey = String(options.onlyExistingAtBaseRef === true);
+    return Object.freeze({
+        type: 'fs:write-guard',
+        id: `fs:write-guard:deny=${denyGlobs.join(',')}|allow=${allowKey}|existing=${existingKey}`,
+        denyGlobs,
+        allowGlobs,
+        onlyExistingAtBaseRef: options.onlyExistingAtBaseRef,
+    });
+}
+//# sourceMappingURL=create-fs-write-guard-builder.js.map

package/dist/builders/create-fs-write-guard-builder.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"create-fs-write-guard-builder.js","sourceRoot":"","sources":["../../src/builders/create-fs-write-guard-builder.ts"],"names":[],"mappings":"AAiBA;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,yBAAyB,CAAC,OAA4B;IACpE,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,SAAS,CAAC,IAAI,OAAO,CAAC,SAAS,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACxE,MAAM,IAAI,KAAK,CAAC,qDAAqD,CAAC,CAAC;IACzE,CAAC;IACD,MAAM,SAAS,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,GAAG,OAAO,CAAC,SAAS,CAAC,CAAC,CAAC;IACxD,MAAM,UAAU,GACd,OAAO,CAAC,UAAU,KAAK,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,GAAG,OAAO,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IACxF,MAAM,QAAQ,GAAG,UAAU,KAAK,SAAS,CAAC,CAAC,CAAC,UAAU,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IACtE,MAAM,WAAW,GAAG,MAAM,CAAC,OAAO,CAAC,qBAAqB,KAAK,IAAI,CAAC,CAAC;IACnE,OAAO,MAAM,CAAC,MAAM,CAAmB;QACrC,IAAI,EAAE,gBAAgB;QACtB,EAAE,EAAE,uBAAuB,SAAS,CAAC,IAAI,CAAC,GAAG,CAAC,UAAU,QAAQ,aAAa,WAAW,EAAE;QAC1F,SAAS;QACT,UAAU;QACV,qBAAqB,EAAE,OAAO,CAAC,qBAAqB;KACrD,CAAC,CAAC;AACL,CAAC"}