@paraharness/fs 0.0.0-stage → 0.2.0

package/dist/executors/internal/compile-active-lease-write-matcher.js

@@ -0,0 +1,50 @@
+import { compileGlobOrExactMatcher } from './compile-glob-or-exact-matcher.js';
+import { CACHED_ACTIVE_LEASE_WRITE_MATCHERS } from './glob-matcher-cache.constants.js';
+/**
+ * Collects pre-compiled path matchers across all write-covering `FsGlobMatcherNode` grants in `activeLeases`.
+ *
+ * @param {readonly LeaseDelta[]} activeLeases - Active capability leases granted to the actor or loop.
+ *
+ * @returns {Array<(candidatePath: string) => boolean>} Compiled matchers for each write or `any` glob grant.
+ */
+function collectActiveLeaseMatchers(activeLeases) {
+    const leaseMatchers = [];
+    for (const lease of activeLeases) {
+        for (const matcher of lease.grantedMatchers) {
+            if (matcher.type === 'fs:match-globs' && (matcher.mode === 'write' || matcher.mode === 'any')) {
+                leaseMatchers.push(compileGlobOrExactMatcher(matcher.globs));
+            }
+        }
+    }
+    return leaseMatchers;
+}
+/**
+ * Pre-compiles and memoizes a single write-mode path matcher across all `FsGlobMatcherNode` grants in `activeLeases`.
+ *
+ * Evaluates both exact normalized file paths and `picomatch` glob patterns across all granted matchers (`Rule 4.4`),
+ * caching both per-matcher `matcher.globs` predicates in `CACHED_GLOB_OR_EXACT_MATCHERS` and the composed predicate
+ * in `CACHED_ACTIVE_LEASE_WRITE_MATCHERS`.
+ *
+ * @param {readonly LeaseDelta[]} activeLeases - Active capability leases granted to the actor or loop.
+ *
+ * @returns {(candidatePath: string) => boolean} Reusable synchronous predicate returning `true` when `candidatePath` is leased.
+ */
+export function compileActiveLeaseWriteMatcher(activeLeases) {
+    const cached = CACHED_ACTIVE_LEASE_WRITE_MATCHERS.get(activeLeases);
+    if (cached !== undefined) {
+        return cached;
+    }
+    const leaseMatchers = collectActiveLeaseMatchers(activeLeases);
+    const compiled = leaseMatchers.length === 0
+        ? () => false
+        : (candidatePath) => {
+            for (const isMatch of leaseMatchers) {
+                if (isMatch(candidatePath))
+                    return true;
+            }
+            return false;
+        };
+    CACHED_ACTIVE_LEASE_WRITE_MATCHERS.set(activeLeases, compiled);
+    return compiled;
+}
+//# sourceMappingURL=compile-active-lease-write-matcher.js.map

package/dist/executors/internal/compile-active-lease-write-matcher.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"compile-active-lease-write-matcher.js","sourceRoot":"","sources":["../../../src/executors/internal/compile-active-lease-write-matcher.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,yBAAyB,EAAE,MAAM,oCAAoC,CAAC;AAC/E,OAAO,EAAE,kCAAkC,EAAE,MAAM,mCAAmC,CAAC;AAEvF;;;;;;GAMG;AACH,SAAS,0BAA0B,CACjC,YAAmC;IAEnC,MAAM,aAAa,GAA8C,EAAE,CAAC;IACpE,KAAK,MAAM,KAAK,IAAI,YAAY,EAAE,CAAC;QACjC,KAAK,MAAM,OAAO,IAAI,KAAK,CAAC,eAAe,EAAE,CAAC;YAC5C,IAAI,OAAO,CAAC,IAAI,KAAK,gBAAgB,IAAI,CAAC,OAAO,CAAC,IAAI,KAAK,OAAO,IAAI,OAAO,CAAC,IAAI,KAAK,KAAK,CAAC,EAAE,CAAC;gBAC9F,aAAa,CAAC,IAAI,CAAC,yBAAyB,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC;YAC/D,CAAC;QACH,CAAC;IACH,CAAC;IACD,OAAO,aAAa,CAAC;AACvB,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,UAAU,8BAA8B,CAC5C,YAAmC;IAEnC,MAAM,MAAM,GAAG,kCAAkC,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC;IACpE,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;QACzB,OAAO,MAAM,CAAC;IAChB,CAAC;IACD,MAAM,aAAa,GAAG,0BAA0B,CAAC,YAAY,CAAC,CAAC;IAC/D,MAAM,QAAQ,GACZ,aAAa,CAAC,MAAM,KAAK,CAAC;QACxB,CAAC,CAAC,GAAY,EAAE,CAAC,KAAK;QACtB,CAAC,CAAC,CAAC,aAAqB,EAAW,EAAE;YACjC,KAAK,MAAM,OAAO,IAAI,aAAa,EAAE,CAAC;gBACpC,IAAI,OAAO,CAAC,aAAa,CAAC;oBAAE,OAAO,IAAI,CAAC;YAC1C,CAAC;YACD,OAAO,KAAK,CAAC;QACf,CAAC,CAAC;IACR,kCAAkC,CAAC,GAAG,CAAC,YAAY,EAAE,QAAQ,CAAC,CAAC;IAC/D,OAAO,QAAQ,CAAC;AAClB,CAAC"}

package/dist/executors/internal/compile-glob-or-exact-matcher.d.ts

@@ -0,0 +1,12 @@
+/**
+ * Pre-compiles and memoizes a path matcher testing exact normalized file paths, positive `picomatch` globs, and negated `!` globs (`SPEC.md` §4.3 & `Rule 4.4`).
+ *
+ * Ensures literal bracketed paths (such as `app/users/[id]/page.test.tsx`) match via $O(1)$
+ * `Set` lookup alongside standard POSIX glob patterns and `!` exclusions, reusing compiled matchers via `WeakMap`.
+ *
+ * @param {readonly string[]} globs - Exact file paths or POSIX glob patterns (including optional `!` negations).
+ *
+ * @returns {(candidatePath: string) => boolean} Reusable synchronous predicate testing a normalized POSIX path.
+ */
+export declare function compileGlobOrExactMatcher(globs: readonly string[]): (candidatePath: string) => boolean;
+//# sourceMappingURL=compile-glob-or-exact-matcher.d.ts.map

package/dist/executors/internal/compile-glob-or-exact-matcher.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"compile-glob-or-exact-matcher.d.ts","sourceRoot":"","sources":["../../../src/executors/internal/compile-glob-or-exact-matcher.ts"],"names":[],"mappings":"AA2CA;;;;;;;;;GASG;AACH,wBAAgB,yBAAyB,CACvC,KAAK,EAAE,SAAS,MAAM,EAAE,GACvB,CAAC,aAAa,EAAE,MAAM,KAAK,OAAO,CAQpC"}

package/dist/executors/internal/compile-glob-or-exact-matcher.js

@@ -0,0 +1,63 @@
+import picomatch from 'picomatch';
+import { CACHED_GLOB_OR_EXACT_MATCHERS } from './glob-matcher-cache.constants.js';
+/**
+ * Builds an uncached predicate matching exact normalized file paths, positive `picomatch` globs, and negated `!` globs.
+ *
+ * Separates positive patterns and `exactPaths` from leading `!` exclusion patterns.
+ *
+ * @param {readonly string[]} globs - Exact file paths or POSIX glob patterns.
+ *
+ * @returns {(candidatePath: string) => boolean} Synchronous predicate testing a normalized POSIX path.
+ */
+function buildUncachedGlobOrExactMatcher(globs) {
+    if (globs.length === 0) {
+        return () => false;
+    }
+    const exactPaths = new Set();
+    const positiveMatchers = [];
+    const ignoreMatchers = [];
+    for (const rawPattern of globs) {
+        const normalizedPattern = rawPattern.replace(/\\/g, '/').replace(/^\.\//, '');
+        if (normalizedPattern.startsWith('!') && normalizedPattern.length > 1) {
+            ignoreMatchers.push(picomatch(normalizedPattern.slice(1).replace(/^\.\//, ''), { dot: true }));
+        }
+        else {
+            exactPaths.add(normalizedPattern);
+            positiveMatchers.push(picomatch(normalizedPattern, { dot: true }));
+        }
+    }
+    return (candidatePath) => {
+        const normalizedCandidate = candidatePath.replace(/\\/g, '/').replace(/^\.\//, '');
+        for (const isIgnored of ignoreMatchers) {
+            if (isIgnored(normalizedCandidate))
+                return false;
+        }
+        if (exactPaths.has(normalizedCandidate))
+            return true;
+        for (const isMatch of positiveMatchers) {
+            if (isMatch(normalizedCandidate))
+                return true;
+        }
+        return positiveMatchers.length === 0 && exactPaths.size === 0 && ignoreMatchers.length > 0;
+    };
+}
+/**
+ * Pre-compiles and memoizes a path matcher testing exact normalized file paths, positive `picomatch` globs, and negated `!` globs (`SPEC.md` §4.3 & `Rule 4.4`).
+ *
+ * Ensures literal bracketed paths (such as `app/users/[id]/page.test.tsx`) match via $O(1)$
+ * `Set` lookup alongside standard POSIX glob patterns and `!` exclusions, reusing compiled matchers via `WeakMap`.
+ *
+ * @param {readonly string[]} globs - Exact file paths or POSIX glob patterns (including optional `!` negations).
+ *
+ * @returns {(candidatePath: string) => boolean} Reusable synchronous predicate testing a normalized POSIX path.
+ */
+export function compileGlobOrExactMatcher(globs) {
+    const cached = CACHED_GLOB_OR_EXACT_MATCHERS.get(globs);
+    if (cached !== undefined) {
+        return cached;
+    }
+    const compiled = buildUncachedGlobOrExactMatcher(globs);
+    CACHED_GLOB_OR_EXACT_MATCHERS.set(globs, compiled);
+    return compiled;
+}
+//# sourceMappingURL=compile-glob-or-exact-matcher.js.map

package/dist/executors/internal/compile-glob-or-exact-matcher.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"compile-glob-or-exact-matcher.js","sourceRoot":"","sources":["../../../src/executors/internal/compile-glob-or-exact-matcher.ts"],"names":[],"mappings":"AAAA,OAAO,SAAS,MAAM,WAAW,CAAC;AAClC,OAAO,EAAE,6BAA6B,EAAE,MAAM,mCAAmC,CAAC;AAElF;;;;;;;;GAQG;AACH,SAAS,+BAA+B,CACtC,KAAwB;IAExB,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACvB,OAAO,GAAY,EAAE,CAAC,KAAK,CAAC;IAC9B,CAAC;IACD,MAAM,UAAU,GAAG,IAAI,GAAG,EAAU,CAAC;IACrC,MAAM,gBAAgB,GAAsC,EAAE,CAAC;IAC/D,MAAM,cAAc,GAAsC,EAAE,CAAC;IAC7D,KAAK,MAAM,UAAU,IAAI,KAAK,EAAE,CAAC;QAC/B,MAAM,iBAAiB,GAAG,UAAU,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC;QAC9E,IAAI,iBAAiB,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,iBAAiB,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACtE,cAAc,CAAC,IAAI,CAAC,SAAS,CAAC,iBAAiB,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,EAAE,EAAE,CAAC,EAAE,EAAE,GAAG,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC;QACjG,CAAC;aAAM,CAAC;YACN,UAAU,CAAC,GAAG,CAAC,iBAAiB,CAAC,CAAC;YAClC,gBAAgB,CAAC,IAAI,CAAC,SAAS,CAAC,iBAAiB,EAAE,EAAE,GAAG,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC;QACrE,CAAC;IACH,CAAC;IACD,OAAO,CAAC,aAAqB,EAAW,EAAE;QACxC,MAAM,mBAAmB,GAAG,aAAa,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC;QACnF,KAAK,MAAM,SAAS,IAAI,cAAc,EAAE,CAAC;YACvC,IAAI,SAAS,CAAC,mBAAmB,CAAC;gBAAE,OAAO,KAAK,CAAC;QACnD,CAAC;QACD,IAAI,UAAU,CAAC,GAAG,CAAC,mBAAmB,CAAC;YAAE,OAAO,IAAI,CAAC;QACrD,KAAK,MAAM,OAAO,IAAI,gBAAgB,EAAE,CAAC;YACvC,IAAI,OAAO,CAAC,mBAAmB,CAAC;gBAAE,OAAO,IAAI,CAAC;QAChD,CAAC;QACD,OAAO,gBAAgB,CAAC,MAAM,KAAK,CAAC,IAAI,UAAU,CAAC,IAAI,KAAK,CAAC,IAAI,cAAc,CAAC,MAAM,GAAG,CAAC,CAAC;IAC7F,CAAC,CAAC;AACJ,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,yBAAyB,CACvC,KAAwB;IAExB,MAAM,MAAM,GAAG,6BAA6B,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;IACxD,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;QACzB,OAAO,MAAM,CAAC;IAChB,CAAC;IACD,MAAM,QAAQ,GAAG,+BAA+B,CAAC,KAAK,CAAC,CAAC;IACxD,6BAA6B,CAAC,GAAG,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAC;IACnD,OAAO,QAAQ,CAAC;AAClB,CAAC"}

package/dist/executors/internal/compile-secret-patterns.d.ts

@@ -0,0 +1,12 @@
+/**
+ * Compiles built-in and optional custom secret regular expressions for `fs:secret-literals`.
+ *
+ * Returns `DEFAULT_COMPILED_SECRET_PATTERNS` when no custom patterns are supplied, and caches
+ * compiled custom pattern lists in `CACHED_SECRET_PATTERN_LISTS` (`Rule 4.4`).
+ *
+ * @param {readonly string[] | undefined} customPatterns - Optional custom secret regex strings.
+ *
+ * @returns {readonly RegExp[]} Frozen array of compiled regular expressions.
+ */
+export declare function compileSecretPatterns(customPatterns: readonly string[] | undefined): readonly RegExp[];
+//# sourceMappingURL=compile-secret-patterns.d.ts.map

package/dist/executors/internal/compile-secret-patterns.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"compile-secret-patterns.d.ts","sourceRoot":"","sources":["../../../src/executors/internal/compile-secret-patterns.ts"],"names":[],"mappings":"AAKA;;;;;;;;;GASG;AACH,wBAAgB,qBAAqB,CACnC,cAAc,EAAE,SAAS,MAAM,EAAE,GAAG,SAAS,GAC5C,SAAS,MAAM,EAAE,CAanB"}

package/dist/executors/internal/compile-secret-patterns.js

@@ -0,0 +1,27 @@
+import { CACHED_SECRET_PATTERN_LISTS, DEFAULT_COMPILED_SECRET_PATTERNS, } from './secret-patterns.constants.js';
+/**
+ * Compiles built-in and optional custom secret regular expressions for `fs:secret-literals`.
+ *
+ * Returns `DEFAULT_COMPILED_SECRET_PATTERNS` when no custom patterns are supplied, and caches
+ * compiled custom pattern lists in `CACHED_SECRET_PATTERN_LISTS` (`Rule 4.4`).
+ *
+ * @param {readonly string[] | undefined} customPatterns - Optional custom secret regex strings.
+ *
+ * @returns {readonly RegExp[]} Frozen array of compiled regular expressions.
+ */
+export function compileSecretPatterns(customPatterns) {
+    if (customPatterns === undefined || customPatterns.length === 0) {
+        return DEFAULT_COMPILED_SECRET_PATTERNS;
+    }
+    const cached = CACHED_SECRET_PATTERN_LISTS.get(customPatterns);
+    if (cached !== undefined)
+        return cached;
+    const regexes = [...DEFAULT_COMPILED_SECRET_PATTERNS];
+    for (const custom of customPatterns) {
+        regexes.push(new RegExp(custom));
+    }
+    const frozen = Object.freeze(regexes);
+    CACHED_SECRET_PATTERN_LISTS.set(customPatterns, frozen);
+    return frozen;
+}
+//# sourceMappingURL=compile-secret-patterns.js.map

package/dist/executors/internal/compile-secret-patterns.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"compile-secret-patterns.js","sourceRoot":"","sources":["../../../src/executors/internal/compile-secret-patterns.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,2BAA2B,EAC3B,gCAAgC,GACjC,MAAM,gCAAgC,CAAC;AAExC;;;;;;;;;GASG;AACH,MAAM,UAAU,qBAAqB,CACnC,cAA6C;IAE7C,IAAI,cAAc,KAAK,SAAS,IAAI,cAAc,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAChE,OAAO,gCAAgC,CAAC;IAC1C,CAAC;IACD,MAAM,MAAM,GAAG,2BAA2B,CAAC,GAAG,CAAC,cAAc,CAAC,CAAC;IAC/D,IAAI,MAAM,KAAK,SAAS;QAAE,OAAO,MAAM,CAAC;IACxC,MAAM,OAAO,GAAa,CAAC,GAAG,gCAAgC,CAAC,CAAC;IAChE,KAAK,MAAM,MAAM,IAAI,cAAc,EAAE,CAAC;QACpC,OAAO,CAAC,IAAI,CAAC,IAAI,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC;IACnC,CAAC;IACD,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;IACtC,2BAA2B,CAAC,GAAG,CAAC,cAAc,EAAE,MAAM,CAAC,CAAC;IACxD,OAAO,MAAM,CAAC;AAChB,CAAC"}

package/dist/executors/internal/create-effect-base-ref-path-lookup.d.ts

@@ -0,0 +1,13 @@
+import type { ToolEffect } from '@paraharness/core';
+/**
+ * Builds an $O(1)$ per-effect `Set<string>` lookup for `existingPathsAtBaseRef` (`Rule 4.2`).
+ *
+ * Uses `effect.attributes['existingPathsAtBaseRef']` when populated, or falls back to
+ * `checkPathsExistAtBaseRef(scopeHandle, ...)` once per `ToolEffect` instance.
+ *
+ * @param {unknown} scopeHandle - Active isolation scope handle for fallback `baseRef` inspection.
+ *
+ * @returns {(effect: ToolEffect, normPath: string) => boolean} Predicate returning `true` when `normPath` existed at `baseRef`.
+ */
+export declare function createEffectBaseRefPathLookup(scopeHandle: unknown): (effect: ToolEffect, normPath: string) => boolean;
+//# sourceMappingURL=create-effect-base-ref-path-lookup.d.ts.map

package/dist/executors/internal/create-effect-base-ref-path-lookup.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"create-effect-base-ref-path-lookup.d.ts","sourceRoot":"","sources":["../../../src/executors/internal/create-effect-base-ref-path-lookup.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,mBAAmB,CAAC;AAGpD;;;;;;;;;GASG;AACH,wBAAgB,6BAA6B,CAC3C,WAAW,EAAE,OAAO,GACnB,CAAC,MAAM,EAAE,UAAU,EAAE,QAAQ,EAAE,MAAM,KAAK,OAAO,CAuBnD"}

package/dist/executors/internal/create-effect-base-ref-path-lookup.js

@@ -0,0 +1,33 @@
+import { checkPathsExistAtBaseRef } from './check-paths-exist-at-base-ref.js';
+/**
+ * Builds an $O(1)$ per-effect `Set<string>` lookup for `existingPathsAtBaseRef` (`Rule 4.2`).
+ *
+ * Uses `effect.attributes['existingPathsAtBaseRef']` when populated, or falls back to
+ * `checkPathsExistAtBaseRef(scopeHandle, ...)` once per `ToolEffect` instance.
+ *
+ * @param {unknown} scopeHandle - Active isolation scope handle for fallback `baseRef` inspection.
+ *
+ * @returns {(effect: ToolEffect, normPath: string) => boolean} Predicate returning `true` when `normPath` existed at `baseRef`.
+ */
+export function createEffectBaseRefPathLookup(scopeHandle) {
+    const cache = new WeakMap();
+    return (effect, normPath) => {
+        let baseSet = cache.get(effect);
+        if (baseSet === undefined) {
+            const declaredBase = effect.attributes?.['existingPathsAtBaseRef'];
+            const rawList = Array.isArray(declaredBase)
+                ? declaredBase
+                : checkPathsExistAtBaseRef(scopeHandle, effect.attributes?.['paths'] ?? [normPath]);
+            const constructed = new Set();
+            for (const item of rawList) {
+                if (typeof item === 'string') {
+                    constructed.add(item.replace(/\\/g, '/').replace(/^\.\//, ''));
+                }
+            }
+            baseSet = constructed;
+            cache.set(effect, baseSet);
+        }
+        return baseSet.has(normPath);
+    };
+}
+//# sourceMappingURL=create-effect-base-ref-path-lookup.js.map

package/dist/executors/internal/create-effect-base-ref-path-lookup.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"create-effect-base-ref-path-lookup.js","sourceRoot":"","sources":["../../../src/executors/internal/create-effect-base-ref-path-lookup.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,wBAAwB,EAAE,MAAM,oCAAoC,CAAC;AAE9E;;;;;;;;;GASG;AACH,MAAM,UAAU,6BAA6B,CAC3C,WAAoB;IAEpB,MAAM,KAAK,GAAG,IAAI,OAAO,EAAmC,CAAC;IAC7D,OAAO,CAAC,MAAkB,EAAE,QAAgB,EAAW,EAAE;QACvD,IAAI,OAAO,GAAG,KAAK,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QAChC,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;YAC1B,MAAM,YAAY,GAAG,MAAM,CAAC,UAAU,EAAE,CAAC,wBAAwB,CAAC,CAAC;YACnE,MAAM,OAAO,GAAG,KAAK,CAAC,OAAO,CAAC,YAAY,CAAC;gBACzC,CAAC,CAAE,YAAkC;gBACrC,CAAC,CAAC,wBAAwB,CACtB,WAAW,EACV,MAAM,CAAC,UAAU,EAAE,CAAC,OAAO,CAAmC,IAAI,CAAC,QAAQ,CAAC,CAC9E,CAAC;YACN,MAAM,WAAW,GAAG,IAAI,GAAG,EAAU,CAAC;YACtC,KAAK,MAAM,IAAI,IAAI,OAAO,EAAE,CAAC;gBAC3B,IAAI,OAAO,IAAI,KAAK,QAAQ,EAAE,CAAC;oBAC7B,WAAW,CAAC,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,CAAC;gBACjE,CAAC;YACH,CAAC;YACD,OAAO,GAAG,WAAW,CAAC;YACtB,KAAK,CAAC,GAAG,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;QAC7B,CAAC;QACD,OAAO,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;IAC/B,CAAC,CAAC;AACJ,CAAC"}

package/dist/executors/internal/create-fs-read-effect.d.ts

@@ -0,0 +1,12 @@
+import type { FsToolEffect } from '../fs-tool-effect.js';
+/**
+ * Constructs a frozen read-mode `FsToolEffect` record (`mutatesScope: false`).
+ *
+ * Preserves monomorphic property order across all `FsToolEffect` instances (`Rule 4.3`).
+ *
+ * @param {readonly string[]} paths - Canonicalized worktree-relative POSIX file paths read.
+ *
+ * @returns {FsToolEffect} Deeply frozen read `FsToolEffect`.
+ */
+export declare function createFsReadEffect(paths: readonly string[]): FsToolEffect;
+//# sourceMappingURL=create-fs-read-effect.d.ts.map

package/dist/executors/internal/create-fs-read-effect.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"create-fs-read-effect.d.ts","sourceRoot":"","sources":["../../../src/executors/internal/create-fs-read-effect.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,sBAAsB,CAAC;AAEzD;;;;;;;;GAQG;AACH,wBAAgB,kBAAkB,CAAC,KAAK,EAAE,SAAS,MAAM,EAAE,GAAG,YAAY,CAWzE"}

package/dist/executors/internal/create-fs-read-effect.js

@@ -0,0 +1,22 @@
+/**
+ * Constructs a frozen read-mode `FsToolEffect` record (`mutatesScope: false`).
+ *
+ * Preserves monomorphic property order across all `FsToolEffect` instances (`Rule 4.3`).
+ *
+ * @param {readonly string[]} paths - Canonicalized worktree-relative POSIX file paths read.
+ *
+ * @returns {FsToolEffect} Deeply frozen read `FsToolEffect`.
+ */
+export function createFsReadEffect(paths) {
+    return Object.freeze({
+        kind: 'fs:effect',
+        mutatesScope: false,
+        attributes: Object.freeze({
+            mode: 'read',
+            paths: Object.freeze([...paths]),
+            existingPathsAtBaseRef: undefined,
+            proposedContent: undefined,
+        }),
+    });
+}
+//# sourceMappingURL=create-fs-read-effect.js.map

package/dist/executors/internal/create-fs-read-effect.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"create-fs-read-effect.js","sourceRoot":"","sources":["../../../src/executors/internal/create-fs-read-effect.ts"],"names":[],"mappings":"AAEA;;;;;;;;GAQG;AACH,MAAM,UAAU,kBAAkB,CAAC,KAAwB;IACzD,OAAO,MAAM,CAAC,MAAM,CAAe;QACjC,IAAI,EAAE,WAAW;QACjB,YAAY,EAAE,KAAK;QACnB,UAAU,EAAE,MAAM,CAAC,MAAM,CAAC;YACxB,IAAI,EAAE,MAAM;YACZ,KAAK,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC,GAAG,KAAK,CAAC,CAAC;YAChC,sBAAsB,EAAE,SAAS;YACjC,eAAe,EAAE,SAAS;SAC3B,CAAC;KACH,CAAC,CAAC;AACL,CAAC"}

package/dist/executors/internal/create-fs-write-effect.d.ts

@@ -0,0 +1,14 @@
+import type { FsToolEffect } from '../fs-tool-effect.js';
+/**
+ * Constructs a frozen write-mode `FsToolEffect` record (`mutatesScope: true`).
+ *
+ * Populates `existingPathsAtBaseRef` and `proposedContent` for downstream policy guards (`SPEC.md` §4.3).
+ *
+ * @param {readonly string[]}                paths                  - Canonicalized worktree-relative POSIX paths mutated.
+ * @param {readonly string[]}                existingPathsAtBaseRef - Subset of `paths` existing at `baseRef`.
+ * @param {Readonly<Record<string, string>>} proposedContent        - Proposed post-edit UTF-8 content per path.
+ *
+ * @returns {FsToolEffect} Deeply frozen write `FsToolEffect`.
+ */
+export declare function createFsWriteEffect(paths: readonly string[], existingPathsAtBaseRef: readonly string[], proposedContent: Readonly<Record<string, string>>): FsToolEffect;
+//# sourceMappingURL=create-fs-write-effect.d.ts.map

package/dist/executors/internal/create-fs-write-effect.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"create-fs-write-effect.d.ts","sourceRoot":"","sources":["../../../src/executors/internal/create-fs-write-effect.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,sBAAsB,CAAC;AAEzD;;;;;;;;;;GAUG;AACH,wBAAgB,mBAAmB,CACjC,KAAK,EAAE,SAAS,MAAM,EAAE,EACxB,sBAAsB,EAAE,SAAS,MAAM,EAAE,EACzC,eAAe,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,GAChD,YAAY,CAWd"}

package/dist/executors/internal/create-fs-write-effect.js

@@ -0,0 +1,24 @@
+/**
+ * Constructs a frozen write-mode `FsToolEffect` record (`mutatesScope: true`).
+ *
+ * Populates `existingPathsAtBaseRef` and `proposedContent` for downstream policy guards (`SPEC.md` §4.3).
+ *
+ * @param {readonly string[]}                paths                  - Canonicalized worktree-relative POSIX paths mutated.
+ * @param {readonly string[]}                existingPathsAtBaseRef - Subset of `paths` existing at `baseRef`.
+ * @param {Readonly<Record<string, string>>} proposedContent        - Proposed post-edit UTF-8 content per path.
+ *
+ * @returns {FsToolEffect} Deeply frozen write `FsToolEffect`.
+ */
+export function createFsWriteEffect(paths, existingPathsAtBaseRef, proposedContent) {
+    return Object.freeze({
+        kind: 'fs:effect',
+        mutatesScope: true,
+        attributes: Object.freeze({
+            mode: 'write',
+            paths: Object.freeze([...paths]),
+            existingPathsAtBaseRef: Object.freeze([...existingPathsAtBaseRef]),
+            proposedContent: Object.freeze({ ...proposedContent }),
+        }),
+    });
+}
+//# sourceMappingURL=create-fs-write-effect.js.map

package/dist/executors/internal/create-fs-write-effect.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"create-fs-write-effect.js","sourceRoot":"","sources":["../../../src/executors/internal/create-fs-write-effect.ts"],"names":[],"mappings":"AAEA;;;;;;;;;;GAUG;AACH,MAAM,UAAU,mBAAmB,CACjC,KAAwB,EACxB,sBAAyC,EACzC,eAAiD;IAEjD,OAAO,MAAM,CAAC,MAAM,CAAe;QACjC,IAAI,EAAE,WAAW;QACjB,YAAY,EAAE,IAAI;QAClB,UAAU,EAAE,MAAM,CAAC,MAAM,CAAC;YACxB,IAAI,EAAE,OAAO;YACb,KAAK,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC,GAAG,KAAK,CAAC,CAAC;YAChC,sBAAsB,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC,GAAG,sBAAsB,CAAC,CAAC;YAClE,eAAe,EAAE,MAAM,CAAC,MAAM,CAAC,EAAE,GAAG,eAAe,EAAE,CAAC;SACvD,CAAC;KACH,CAAC,CAAC;AACL,CAAC"}

package/dist/executors/internal/describe-fs-edit-effects.d.ts

@@ -0,0 +1,13 @@
+import type { ToolEffect } from '@paraharness/core';
+/**
+ * Computes the synchronous pre-flight `FsToolEffect` write descriptor for `edit_file`.
+ *
+ * Populates `existingPathsAtBaseRef` and `proposedContent` after applying `oldString -> newString`.
+ *
+ * @param {unknown} scopeHandle - Active isolation scope handle.
+ * @param {unknown} args        - Raw tool call arguments.
+ *
+ * @returns {readonly ToolEffect[]} Frozen single-element array containing the write `FsToolEffect`.
+ */
+export declare function describeFsEditEffects(scopeHandle: unknown, args: unknown): readonly ToolEffect[];
+//# sourceMappingURL=describe-fs-edit-effects.d.ts.map

package/dist/executors/internal/describe-fs-edit-effects.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"describe-fs-edit-effects.d.ts","sourceRoot":"","sources":["../../../src/executors/internal/describe-fs-edit-effects.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,mBAAmB,CAAC;AAKpD;;;;;;;;;GASG;AACH,wBAAgB,qBAAqB,CACnC,WAAW,EAAE,OAAO,EACpB,IAAI,EAAE,OAAO,GACZ,SAAS,UAAU,EAAE,CAqBvB"}

package/dist/executors/internal/describe-fs-edit-effects.js

@@ -0,0 +1,31 @@
+import { existsSync, readFileSync } from 'node:fs';
+import { checkPathsExistAtBaseRef } from './check-paths-exist-at-base-ref.js';
+import { createFsWriteEffect } from './create-fs-write-effect.js';
+import { resolveJailedWorktreePath } from './resolve-jailed-worktree-path.js';
+/**
+ * Computes the synchronous pre-flight `FsToolEffect` write descriptor for `edit_file`.
+ *
+ * Populates `existingPathsAtBaseRef` and `proposedContent` after applying `oldString -> newString`.
+ *
+ * @param {unknown} scopeHandle - Active isolation scope handle.
+ * @param {unknown} args        - Raw tool call arguments.
+ *
+ * @returns {readonly ToolEffect[]} Frozen single-element array containing the write `FsToolEffect`.
+ */
+export function describeFsEditEffects(scopeHandle, args) {
+    const rec = args ?? {};
+    const { normalizedRelPath, absolutePath } = resolveJailedWorktreePath(scopeHandle, rec.path ?? '', 'write');
+    const currentContent = existsSync(absolutePath) ? readFileSync(absolutePath, 'utf8') : '';
+    const oldStr = rec.oldString ?? '';
+    const newStr = rec.newString ?? '';
+    const nextContent = oldStr.length > 0 && currentContent.includes(oldStr)
+        ? currentContent.replace(oldStr, () => newStr)
+        : `${currentContent}${newStr}`;
+    const existingAtBase = checkPathsExistAtBaseRef(scopeHandle, [normalizedRelPath]);
+    return Object.freeze([
+        createFsWriteEffect([normalizedRelPath], existingAtBase, {
+            [normalizedRelPath]: nextContent,
+        }),
+    ]);
+}
+//# sourceMappingURL=describe-fs-edit-effects.js.map

package/dist/executors/internal/describe-fs-edit-effects.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"describe-fs-edit-effects.js","sourceRoot":"","sources":["../../../src/executors/internal/describe-fs-edit-effects.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AAEnD,OAAO,EAAE,wBAAwB,EAAE,MAAM,oCAAoC,CAAC;AAC9E,OAAO,EAAE,mBAAmB,EAAE,MAAM,6BAA6B,CAAC;AAClE,OAAO,EAAE,yBAAyB,EAAE,MAAM,mCAAmC,CAAC;AAE9E;;;;;;;;;GASG;AACH,MAAM,UAAU,qBAAqB,CACnC,WAAoB,EACpB,IAAa;IAEb,MAAM,GAAG,GACN,IAAgH,IAAI,EAAE,CAAC;IAC1H,MAAM,EAAE,iBAAiB,EAAE,YAAY,EAAE,GAAG,yBAAyB,CACnE,WAAW,EACX,GAAG,CAAC,IAAI,IAAI,EAAE,EACd,OAAO,CACR,CAAC;IACF,MAAM,cAAc,GAAG,UAAU,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,YAAY,CAAC,YAAY,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IAC1F,MAAM,MAAM,GAAG,GAAG,CAAC,SAAS,IAAI,EAAE,CAAC;IACnC,MAAM,MAAM,GAAG,GAAG,CAAC,SAAS,IAAI,EAAE,CAAC;IACnC,MAAM,WAAW,GACf,MAAM,CAAC,MAAM,GAAG,CAAC,IAAI,cAAc,CAAC,QAAQ,CAAC,MAAM,CAAC;QAClD,CAAC,CAAC,cAAc,CAAC,OAAO,CAAC,MAAM,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC;QAC9C,CAAC,CAAC,GAAG,cAAc,GAAG,MAAM,EAAE,CAAC;IACnC,MAAM,cAAc,GAAG,wBAAwB,CAAC,WAAW,EAAE,CAAC,iBAAiB,CAAC,CAAC,CAAC;IAClF,OAAO,MAAM,CAAC,MAAM,CAAC;QACnB,mBAAmB,CAAC,CAAC,iBAAiB,CAAC,EAAE,cAAc,EAAE;YACvD,CAAC,iBAAiB,CAAC,EAAE,WAAW;SACjC,CAAC;KACH,CAAC,CAAC;AACL,CAAC"}

package/dist/executors/internal/describe-fs-write-effects.d.ts

@@ -0,0 +1,13 @@
+import type { ToolEffect } from '@paraharness/core';
+/**
+ * Computes the synchronous pre-flight `FsToolEffect` write descriptor for `write_file`.
+ *
+ * Populates `existingPathsAtBaseRef` and `proposedContent` for policy guard inspection.
+ *
+ * @param {unknown} scopeHandle - Active isolation scope handle.
+ * @param {unknown} args        - Raw tool call arguments.
+ *
+ * @returns {readonly ToolEffect[]} Frozen single-element array containing the write `FsToolEffect`.
+ */
+export declare function describeFsWriteEffects(scopeHandle: unknown, args: unknown): readonly ToolEffect[];
+//# sourceMappingURL=describe-fs-write-effects.d.ts.map

package/dist/executors/internal/describe-fs-write-effects.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"describe-fs-write-effects.d.ts","sourceRoot":"","sources":["../../../src/executors/internal/describe-fs-write-effects.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,mBAAmB,CAAC;AAKpD;;;;;;;;;GASG;AACH,wBAAgB,sBAAsB,CACpC,WAAW,EAAE,OAAO,EACpB,IAAI,EAAE,OAAO,GACZ,SAAS,UAAU,EAAE,CASvB"}

package/dist/executors/internal/describe-fs-write-effects.js

@@ -0,0 +1,24 @@
+import { checkPathsExistAtBaseRef } from './check-paths-exist-at-base-ref.js';
+import { createFsWriteEffect } from './create-fs-write-effect.js';
+import { resolveJailedWorktreePath } from './resolve-jailed-worktree-path.js';
+/**
+ * Computes the synchronous pre-flight `FsToolEffect` write descriptor for `write_file`.
+ *
+ * Populates `existingPathsAtBaseRef` and `proposedContent` for policy guard inspection.
+ *
+ * @param {unknown} scopeHandle - Active isolation scope handle.
+ * @param {unknown} args        - Raw tool call arguments.
+ *
+ * @returns {readonly ToolEffect[]} Frozen single-element array containing the write `FsToolEffect`.
+ */
+export function describeFsWriteEffects(scopeHandle, args) {
+    const rec = args ?? {};
+    const { normalizedRelPath } = resolveJailedWorktreePath(scopeHandle, rec.path ?? '', 'write');
+    const existingAtBase = checkPathsExistAtBaseRef(scopeHandle, [normalizedRelPath]);
+    return Object.freeze([
+        createFsWriteEffect([normalizedRelPath], existingAtBase, {
+            [normalizedRelPath]: rec.content ?? '',
+        }),
+    ]);
+}
+//# sourceMappingURL=describe-fs-write-effects.js.map

package/dist/executors/internal/describe-fs-write-effects.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"describe-fs-write-effects.js","sourceRoot":"","sources":["../../../src/executors/internal/describe-fs-write-effects.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,wBAAwB,EAAE,MAAM,oCAAoC,CAAC;AAC9E,OAAO,EAAE,mBAAmB,EAAE,MAAM,6BAA6B,CAAC;AAClE,OAAO,EAAE,yBAAyB,EAAE,MAAM,mCAAmC,CAAC;AAE9E;;;;;;;;;GASG;AACH,MAAM,UAAU,sBAAsB,CACpC,WAAoB,EACpB,IAAa;IAEb,MAAM,GAAG,GAAI,IAAiF,IAAI,EAAE,CAAC;IACrG,MAAM,EAAE,iBAAiB,EAAE,GAAG,yBAAyB,CAAC,WAAW,EAAE,GAAG,CAAC,IAAI,IAAI,EAAE,EAAE,OAAO,CAAC,CAAC;IAC9F,MAAM,cAAc,GAAG,wBAAwB,CAAC,WAAW,EAAE,CAAC,iBAAiB,CAAC,CAAC,CAAC;IAClF,OAAO,MAAM,CAAC,MAAM,CAAC;QACnB,mBAAmB,CAAC,CAAC,iBAAiB,CAAC,EAAE,cAAc,EAAE;YACvD,CAAC,iBAAiB,CAAC,EAAE,GAAG,CAAC,OAAO,IAAI,EAAE;SACvC,CAAC;KACH,CAAC,CAAC;AACL,CAAC"}

package/dist/executors/internal/enumerate-workspace-files-sync.d.ts

@@ -0,0 +1,12 @@
+/**
+ * Synchronously enumerates all jailed workspace-relative POSIX file paths matching `globPattern` via `tinyglobby`.
+ *
+ * Uses `globSync` from `tinyglobby` with `picomatch` verification for synchronous `describeEffects` evaluation.
+ *
+ * @param {string}                     rootPath    - Worktree or repository root directory path.
+ * @param {string | readonly string[]} globPattern - POSIX glob pattern(s) to match against relative paths.
+ *
+ * @returns {readonly string[]} Sorted frozen array of matching relative POSIX file paths.
+ */
+export declare function enumerateWorkspaceFilesSync(rootPath: string, globPattern: string | readonly string[]): readonly string[];
+//# sourceMappingURL=enumerate-workspace-files-sync.d.ts.map

package/dist/executors/internal/enumerate-workspace-files-sync.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"enumerate-workspace-files-sync.d.ts","sourceRoot":"","sources":["../../../src/executors/internal/enumerate-workspace-files-sync.ts"],"names":[],"mappings":"AAMA;;;;;;;;;GASG;AACH,wBAAgB,2BAA2B,CACzC,QAAQ,EAAE,MAAM,EAChB,WAAW,EAAE,MAAM,GAAG,SAAS,MAAM,EAAE,GACtC,SAAS,MAAM,EAAE,CAgCnB"}

package/dist/executors/internal/enumerate-workspace-files-sync.js

@@ -0,0 +1,52 @@
+import { readdirSync, realpathSync } from 'node:fs';
+import path from 'node:path';
+import { globSync } from 'tinyglobby';
+import { compileGlobOrExactMatcher } from './compile-glob-or-exact-matcher.js';
+import { filterJailedDirents } from './filter-jailed-dirents.js';
+/**
+ * Synchronously enumerates all jailed workspace-relative POSIX file paths matching `globPattern` via `tinyglobby`.
+ *
+ * Uses `globSync` from `tinyglobby` with `picomatch` verification for synchronous `describeEffects` evaluation.
+ *
+ * @param {string}                     rootPath    - Worktree or repository root directory path.
+ * @param {string | readonly string[]} globPattern - POSIX glob pattern(s) to match against relative paths.
+ *
+ * @returns {readonly string[]} Sorted frozen array of matching relative POSIX file paths.
+ */
+export function enumerateWorkspaceFilesSync(rootPath, globPattern) {
+    const realRoot = realpathSync(path.resolve(rootPath));
+    const visitedDirs = new Set([realRoot]);
+    const patternList = typeof globPattern === 'string' ? [globPattern] : globPattern;
+    const isMatch = compileGlobOrExactMatcher(patternList);
+    const rawMatches = globSync(patternList, {
+        cwd: realRoot,
+        dot: true,
+        onlyFiles: true,
+        ignore: ['**/.git/**', '**/node_modules/**'],
+        fs: {
+            readdirSync: ((dir, opts) => {
+                const entries = filterJailedDirents({
+                    realRoot,
+                    visitedDirs,
+                    dirPath: String(dir),
+                    entries: readdirSync(dir, { withFileTypes: true }),
+                });
+                if (typeof opts === 'object' && opts !== null)
+                    return entries;
+                const names = [];
+                for (const entry of entries)
+                    names.push(entry.name);
+                return names;
+            }),
+        },
+    });
+    const matched = [];
+    for (const entry of rawMatches) {
+        const cleanRel = entry.replace(/\\/g, '/').replace(/\/+$/, '');
+        if (isMatch(cleanRel))
+            matched.push(cleanRel);
+    }
+    matched.sort((a, b) => a.localeCompare(b));
+    return Object.freeze(matched);
+}
+//# sourceMappingURL=enumerate-workspace-files-sync.js.map

package/dist/executors/internal/enumerate-workspace-files-sync.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"enumerate-workspace-files-sync.js","sourceRoot":"","sources":["../../../src/executors/internal/enumerate-workspace-files-sync.ts"],"names":[],"mappings":"AAAA,OAAO,EAAiB,WAAW,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AACnE,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAA0B,QAAQ,EAAE,MAAM,YAAY,CAAC;AAC9D,OAAO,EAAE,yBAAyB,EAAE,MAAM,oCAAoC,CAAC;AAC/E,OAAO,EAAE,mBAAmB,EAAE,MAAM,4BAA4B,CAAC;AAEjE;;;;;;;;;GASG;AACH,MAAM,UAAU,2BAA2B,CACzC,QAAgB,EAChB,WAAuC;IAEvC,MAAM,QAAQ,GAAG,YAAY,CAAC,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC;IACtD,MAAM,WAAW,GAAG,IAAI,GAAG,CAAS,CAAC,QAAQ,CAAC,CAAC,CAAC;IAChD,MAAM,WAAW,GAAG,OAAO,WAAW,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC;IAClF,MAAM,OAAO,GAAG,yBAAyB,CAAC,WAAW,CAAC,CAAC;IACvD,MAAM,UAAU,GAAG,QAAQ,CAAC,WAAW,EAAE;QACvC,GAAG,EAAE,QAAQ;QACb,GAAG,EAAE,IAAI;QACT,SAAS,EAAE,IAAI;QACf,MAAM,EAAE,CAAC,YAAY,EAAE,oBAAoB,CAAC;QAC5C,EAAE,EAAE;YACF,WAAW,EAAE,CAAC,CAAC,GAAa,EAAE,IAAc,EAAE,EAAE;gBAC9C,MAAM,OAAO,GAAG,mBAAmB,CAAC;oBAClC,QAAQ;oBACR,WAAW;oBACX,OAAO,EAAE,MAAM,CAAC,GAAG,CAAC;oBACpB,OAAO,EAAE,WAAW,CAAC,GAAG,EAAE,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC;iBACnD,CAAC,CAAC;gBACH,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,IAAI,KAAK,IAAI;oBAAE,OAAO,OAAO,CAAC;gBAC9D,MAAM,KAAK,GAAa,EAAE,CAAC;gBAC3B,KAAK,MAAM,KAAK,IAAI,OAAO;oBAAE,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;gBACpD,OAAO,KAAK,CAAC;YACf,CAAC,CAAqC;SACvC;KACF,CAAC,CAAC;IACH,MAAM,OAAO,GAAa,EAAE,CAAC;IAC7B,KAAK,MAAM,KAAK,IAAI,UAAU,EAAE,CAAC;QAC/B,MAAM,QAAQ,GAAG,KAAK,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;QAC/D,IAAI,OAAO,CAAC,QAAQ,CAAC;YAAE,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IAChD,CAAC;IACD,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,CAAC;IAC3C,OAAO,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;AAChC,CAAC"}

package/dist/executors/internal/enumerate-workspace-files.d.ts

@@ -0,0 +1,13 @@
+/**
+ * Asynchronously enumerates all jailed workspace-relative POSIX file paths matching `globPattern` via `tinyglobby`.
+ *
+ * Uses `glob` from `tinyglobby` with `picomatch` verification, skipping `.git`, `node_modules`,
+ * and any symlink target escaping `rootPath`.
+ *
+ * @param {string}                     rootPath    - Worktree or repository root directory path.
+ * @param {string | readonly string[]} globPattern - POSIX glob pattern(s) to match against relative paths.
+ *
+ * @returns {Promise<readonly string[]>} Sorted frozen array of matching relative POSIX file paths.
+ */
+export declare function enumerateWorkspaceFiles(rootPath: string, globPattern: string | readonly string[]): Promise<readonly string[]>;
+//# sourceMappingURL=enumerate-workspace-files.d.ts.map

package/dist/executors/internal/enumerate-workspace-files.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"enumerate-workspace-files.d.ts","sourceRoot":"","sources":["../../../src/executors/internal/enumerate-workspace-files.ts"],"names":[],"mappings":"AAMA;;;;;;;;;;GAUG;AACH,wBAAsB,uBAAuB,CAC3C,QAAQ,EAAE,MAAM,EAChB,WAAW,EAAE,MAAM,GAAG,SAAS,MAAM,EAAE,GACtC,OAAO,CAAC,SAAS,MAAM,EAAE,CAAC,CA8B5B"}

package/dist/executors/internal/enumerate-workspace-files.js

@@ -0,0 +1,44 @@
+import { readdir, realpathSync } from 'node:fs';
+import path from 'node:path';
+import { glob } from 'tinyglobby';
+import { compileGlobOrExactMatcher } from './compile-glob-or-exact-matcher.js';
+import { filterJailedDirents } from './filter-jailed-dirents.js';
+/**
+ * Asynchronously enumerates all jailed workspace-relative POSIX file paths matching `globPattern` via `tinyglobby`.
+ *
+ * Uses `glob` from `tinyglobby` with `picomatch` verification, skipping `.git`, `node_modules`,
+ * and any symlink target escaping `rootPath`.
+ *
+ * @param {string}                     rootPath    - Worktree or repository root directory path.
+ * @param {string | readonly string[]} globPattern - POSIX glob pattern(s) to match against relative paths.
+ *
+ * @returns {Promise<readonly string[]>} Sorted frozen array of matching relative POSIX file paths.
+ */
+export async function enumerateWorkspaceFiles(rootPath, globPattern) {
+    const realRoot = realpathSync(path.resolve(rootPath));
+    const visitedDirs = new Set([realRoot]);
+    const patternList = typeof globPattern === 'string' ? [globPattern] : globPattern;
+    const isMatch = compileGlobOrExactMatcher(patternList);
+    const rawMatches = await glob(patternList, {
+        cwd: realRoot,
+        dot: true,
+        onlyFiles: true,
+        ignore: ['**/.git/**', '**/node_modules/**'],
+        fs: {
+            readdir: ((dir, _opts, cb) => {
+                readdir(dir, { withFileTypes: true }, (err, entries) => cb?.(err, err !== null
+                    ? []
+                    : filterJailedDirents({ realRoot, visitedDirs, dirPath: String(dir), entries })));
+            }),
+        },
+    });
+    const matched = [];
+    for (const entry of rawMatches) {
+        const cleanRel = entry.replace(/\\/g, '/').replace(/\/+$/, '');
+        if (isMatch(cleanRel))
+            matched.push(cleanRel);
+    }
+    matched.sort((a, b) => a.localeCompare(b));
+    return Object.freeze(matched);
+}
+//# sourceMappingURL=enumerate-workspace-files.js.map

package/dist/executors/internal/enumerate-workspace-files.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"enumerate-workspace-files.js","sourceRoot":"","sources":["../../../src/executors/internal/enumerate-workspace-files.ts"],"names":[],"mappings":"AAAA,OAAO,EAAe,OAAO,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AAC7D,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,IAAI,EAAE,MAAM,YAAY,CAAC;AAClC,OAAO,EAAE,yBAAyB,EAAE,MAAM,oCAAoC,CAAC;AAC/E,OAAO,EAAE,mBAAmB,EAAE,MAAM,4BAA4B,CAAC;AAEjE;;;;;;;;;;GAUG;AACH,MAAM,CAAC,KAAK,UAAU,uBAAuB,CAC3C,QAAgB,EAChB,WAAuC;IAEvC,MAAM,QAAQ,GAAG,YAAY,CAAC,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC;IACtD,MAAM,WAAW,GAAG,IAAI,GAAG,CAAS,CAAC,QAAQ,CAAC,CAAC,CAAC;IAChD,MAAM,WAAW,GAAG,OAAO,WAAW,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC;IAClF,MAAM,OAAO,GAAG,yBAAyB,CAAC,WAAW,CAAC,CAAC;IACvD,MAAM,UAAU,GAAG,MAAM,IAAI,CAAC,WAAW,EAAE;QACzC,GAAG,EAAE,QAAQ;QACb,GAAG,EAAE,IAAI;QACT,SAAS,EAAE,IAAI;QACf,MAAM,EAAE,CAAC,YAAY,EAAE,oBAAoB,CAAC;QAC5C,EAAE,EAAE;YACF,OAAO,EAAE,CAAC,CAAC,GAAW,EAAE,KAAc,EAAE,EAAiE,EAAE,EAAE;gBAC3G,OAAO,CAAC,GAAG,EAAE,EAAE,aAAa,EAAE,IAAI,EAAE,EAAE,CAAC,GAAG,EAAE,OAAO,EAAE,EAAE,CACrD,EAAE,EAAE,CACF,GAAG,EACH,GAAG,KAAK,IAAI;oBACV,CAAC,CAAC,EAAE;oBACJ,CAAC,CAAC,mBAAmB,CAAC,EAAE,QAAQ,EAAE,WAAW,EAAE,OAAO,EAAE,MAAM,CAAC,GAAG,CAAC,EAAE,OAAO,EAAE,CAAC,CAClF,CACF,CAAC;YACJ,CAAC,CAAmB;SACrB;KACF,CAAC,CAAC;IACH,MAAM,OAAO,GAAa,EAAE,CAAC;IAC7B,KAAK,MAAM,KAAK,IAAI,UAAU,EAAE,CAAC;QAC/B,MAAM,QAAQ,GAAG,KAAK,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;QAC/D,IAAI,OAAO,CAAC,QAAQ,CAAC;YAAE,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IAChD,CAAC;IACD,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,CAAC;IAC3C,OAAO,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;AAChC,CAAC"}

package/dist/executors/internal/evaluate-fs-allow-and-protect-guards.d.ts

@@ -0,0 +1,28 @@
+import type { FsAllowOnlyGuardNode, FsProtectGuardNode, PolicyGuardEvaluationInput, PolicyGuardEvaluationResult } from '@paraharness/core';
+/**
+ * Evaluates `FsProtectGuardNode` path globs against proposed write effects.
+ *
+ * @param {FsProtectGuardNode}         node  - Protect guard AST node.
+ * @param {PolicyGuardEvaluationInput} input - Proposed effects and active capability leases.
+ *
+ * @returns {PolicyGuardEvaluationResult} Frozen policy guard evaluation result.
+ */
+export declare function evaluateFsProtectPaths(node: FsProtectGuardNode, input: PolicyGuardEvaluationInput): PolicyGuardEvaluationResult;
+/**
+ * Evaluates `FsReadOnlyGuardNode` against proposed write effects.
+ *
+ * @param {PolicyGuardEvaluationInput} input - Proposed effects and active capability leases.
+ *
+ * @returns {PolicyGuardEvaluationResult} Frozen policy guard evaluation result.
+ */
+export declare function evaluateFsReadOnlyPaths(input: PolicyGuardEvaluationInput): PolicyGuardEvaluationResult;
+/**
+ * Evaluates `FsAllowOnlyGuardNode` path globs against proposed write effects.
+ *
+ * @param {FsAllowOnlyGuardNode}       node  - Allow-only guard AST node.
+ * @param {PolicyGuardEvaluationInput} input - Proposed effects and active capability leases.
+ *
+ * @returns {PolicyGuardEvaluationResult} Frozen policy guard evaluation result.
+ */
+export declare function evaluateFsAllowOnlyPaths(node: FsAllowOnlyGuardNode, input: PolicyGuardEvaluationInput): PolicyGuardEvaluationResult;
+//# sourceMappingURL=evaluate-fs-allow-and-protect-guards.d.ts.map