@remnic/core 1.1.12 → 1.1.14

package/dist/chunk-A2XUIMJ3.js

@@ -0,0 +1,341 @@
+import {
+  isValidCapsuleSince
+} from "./chunk-2F2W355T.js";
+import {
+  CAPSULE_ID_PATTERN
+} from "./chunk-WEHSQBFR.js";
+import {
+  ACTION_CONFIDENCE_CONTEXT_READINESS,
+  ACTION_CONFIDENCE_RISK_CATEGORIES,
+  ACTION_CONFIDENCE_RULE_KINDS
+} from "./chunk-AH2JUU6X.js";
+
+// src/access-schema.ts
+import { z } from "zod";
+function formatZodError(error) {
+  return {
+    error: "request validation failed",
+    code: "validation_error",
+    details: error.issues.map((issue) => ({
+      field: issue.path.join(".") || "(root)",
+      message: issue.message
+    }))
+  };
+}
+var namespaceSchema = z.string().trim().max(256).optional();
+var sessionKeySchema = z.string().trim().min(1).max(512).optional();
+var idempotencyKeySchema = z.string().trim().min(1).max(256).optional();
+var dryRunSchema = z.boolean().optional();
+var schemaVersionSchema = z.number().int().optional();
+var codingContextSchema = z.object({
+  projectId: z.string().trim().min(1, "codingContext.projectId is required").max(128),
+  branch: z.string().trim().max(256).nullable(),
+  rootPath: z.string().trim().min(1, "codingContext.rootPath is required").max(1024),
+  defaultBranch: z.string().trim().max(256).nullable()
+}).nullable();
+var recallDisclosureSchema = z.enum(["chunk", "section", "raw"]);
+var tagMatchSchema = z.enum(["any", "all"]);
+var recallRequestSchema = z.object({
+  query: z.string().min(1, "query is required"),
+  sessionKey: sessionKeySchema,
+  namespace: namespaceSchema,
+  topK: z.number().int().min(0).max(200).optional(),
+  mode: z.enum(["auto", "no_recall", "minimal", "full", "graph_mode"]).optional(),
+  includeDebug: z.boolean().optional(),
+  idempotencyKey: idempotencyKeySchema,
+  disclosure: recallDisclosureSchema.optional(),
+  codingContext: codingContextSchema.optional(),
+  /** Working directory for auto git-context resolution (issue #569). */
+  cwd: z.string().trim().min(1, "cwd must be non-empty when provided").max(2048).optional(),
+  /**
+   * Arbitrary project tag for non-git-based project scoping (issue #569).
+   * Creates a coding context with `projectId: "tag:<projectTag>"`.
+   */
+  projectTag: z.string().trim().min(1, "projectTag must be non-empty when provided").max(256).optional(),
+  /**
+   * Historical recall pin (issue #680).  ISO 8601 timestamp.  The
+   * schema only enforces the basic shape; the access service runs
+   * `Date.parse` and emits a structured 400 on malformed input
+   * (CLAUDE.md rule 51).
+   */
+  asOf: z.string().trim().min(1, "asOf must be a non-empty ISO 8601 timestamp").max(64).optional(),
+  /**
+   * Free-form recall tag filter (issue #689). When provided, recall results
+   * whose frontmatter `tags` do not match the filter are removed before the
+   * response is returned. Comparison is case-sensitive exact match.
+   */
+  tags: z.array(z.string().trim().min(1).max(256)).max(50).optional(),
+  /**
+   * Match mode for `tags` (issue #689). Defaults to `"any"` when `tags` is
+   * provided and `tagMatch` is omitted. Ignored when `tags` is absent.
+   */
+  tagMatch: tagMatchSchema.optional(),
+  /**
+   * Include graph edges below `graphTraversalConfidenceFloor` for diagnostic
+   * recall traversal (issue #681). Defaults to false.
+   */
+  includeLowConfidence: z.boolean().optional()
+});
+var recallExplainRequestSchema = z.object({
+  sessionKey: sessionKeySchema,
+  namespace: namespaceSchema
+});
+var setCodingContextRequestSchema = z.object({
+  sessionKey: z.string().trim().min(1, "sessionKey is required").max(512),
+  codingContext: codingContextSchema
+});
+var messageSchema = z.object({
+  role: z.enum(["user", "assistant"]),
+  content: z.string().min(1, "message content must be non-empty"),
+  sourceFormat: z.enum(["openai", "anthropic", "openclaw", "pi", "lossless-claw", "remnic"]).nullable().optional(),
+  rawContent: z.unknown().nullable().optional(),
+  parts: z.array(
+    z.object({
+      ordinal: z.number().int().min(0).nullable().optional(),
+      kind: z.enum([
+        "text",
+        "tool_call",
+        "tool_result",
+        "patch",
+        "file_read",
+        "file_write",
+        "step_start",
+        "step_finish",
+        "snapshot",
+        "retry"
+      ]),
+      payload: z.record(z.string(), z.unknown()),
+      toolName: z.string().nullable().optional(),
+      tool_name: z.string().nullable().optional(),
+      filePath: z.string().nullable().optional(),
+      file_path: z.string().nullable().optional(),
+      createdAt: z.string().nullable().optional(),
+      created_at: z.string().nullable().optional()
+    })
+  ).nullable().optional()
+});
+var observeRequestSchema = z.object({
+  sessionKey: z.string().trim().min(1, "sessionKey is required").max(512),
+  messages: z.array(messageSchema).min(1, "messages must be a non-empty array"),
+  namespace: namespaceSchema,
+  skipExtraction: z.boolean().optional(),
+  /** Working directory for auto git-context resolution (issue #569). */
+  cwd: z.string().trim().min(1, "cwd must be non-empty when provided").max(2048).optional(),
+  /**
+   * Arbitrary project tag for non-git-based project scoping (issue #569).
+   * Creates a coding context with `projectId: "tag:<projectTag>"`.
+   */
+  projectTag: z.string().trim().min(1, "projectTag must be non-empty when provided").max(256).optional()
+});
+var writeContentSchema = z.string().min(1, "content is required").max(5e4);
+var categorySchema = z.enum([
+  "fact",
+  "preference",
+  "correction",
+  "entity",
+  "decision",
+  "relationship",
+  "principle",
+  "commitment",
+  "moment",
+  "skill",
+  "rule",
+  "procedure",
+  "reasoning_trace"
+]).optional();
+var confidenceSchema = z.number().min(0).max(1).optional();
+var tagsSchema = z.array(z.string().max(256)).max(50).optional();
+var entityRefSchema = z.string().trim().max(512).optional();
+var ttlSchema = z.string().trim().max(128).optional();
+var sourceReasonSchema = z.string().trim().max(2e3).optional();
+var memoryStoreRequestSchema = z.object({
+  schemaVersion: schemaVersionSchema,
+  idempotencyKey: idempotencyKeySchema,
+  dryRun: dryRunSchema,
+  sessionKey: sessionKeySchema,
+  content: writeContentSchema,
+  category: categorySchema,
+  confidence: confidenceSchema,
+  namespace: namespaceSchema,
+  tags: tagsSchema,
+  entityRef: entityRefSchema,
+  ttl: ttlSchema,
+  sourceReason: sourceReasonSchema
+});
+var suggestionSubmitRequestSchema = memoryStoreRequestSchema;
+var reviewDispositionRequestSchema = z.object({
+  memoryId: z.string().trim().min(1, "memoryId is required"),
+  status: z.enum([
+    "active",
+    "pending_review",
+    "quarantined",
+    "rejected",
+    "superseded",
+    "archived"
+  ]),
+  reasonCode: z.string().trim().min(1, "reasonCode is required"),
+  namespace: namespaceSchema
+});
+var trustZonePromoteRequestSchema = z.object({
+  recordId: z.string().trim().min(1, "recordId is required"),
+  targetZone: z.enum(["working", "trusted"], {
+    errorMap: () => ({ message: "targetZone must be 'working' or 'trusted'" })
+  }),
+  promotionReason: z.string().trim().min(1, "promotionReason is required"),
+  recordedAt: z.string().trim().optional(),
+  summary: z.string().trim().max(5e3).optional(),
+  dryRun: dryRunSchema,
+  namespace: namespaceSchema
+});
+var trustZoneDemoSeedRequestSchema = z.object({
+  scenario: z.string().trim().max(256).optional(),
+  recordedAt: z.string().trim().optional(),
+  dryRun: dryRunSchema,
+  namespace: namespaceSchema
+});
+var lcmSearchRequestSchema = z.object({
+  query: z.string().min(1, "query is required"),
+  sessionKey: sessionKeySchema,
+  namespace: namespaceSchema,
+  limit: z.number().int().min(1).max(100).optional()
+});
+var lcmCompactionFlushRequestSchema = z.object({
+  sessionKey: z.string().trim().min(1, "sessionKey is required").max(512),
+  namespace: namespaceSchema
+});
+var lcmCompactionRecordRequestSchema = z.object({
+  sessionKey: z.string().trim().min(1, "sessionKey is required").max(512),
+  namespace: namespaceSchema,
+  tokensBefore: z.number().int().min(0, "tokensBefore must be a non-negative integer"),
+  tokensAfter: z.number().int().min(0, "tokensAfter must be a non-negative integer")
+});
+var daySummaryRequestSchema = z.object({
+  memories: z.string().max(1e5).optional(),
+  sessionKey: sessionKeySchema,
+  namespace: namespaceSchema
+});
+var capsuleTopLevelSegmentSchema = z.string().trim().min(1).max(128).refine(
+  (value) => !value.includes("/") && !value.includes("\\"),
+  "must be a top-level directory name without path separators"
+);
+var capsulePeerIdSchema = z.string().trim().min(1).max(256).refine(
+  (value) => value !== "." && value !== ".." && !value.includes("/") && !value.includes("\\"),
+  "must be a plain peer id without path separators"
+);
+var capsuleIsoSinceSchema = z.string().trim().min(1, "since must be a non-empty ISO 8601 timestamp").max(128).refine(
+  isValidCapsuleSince,
+  "since must be a valid ISO 8601 timestamp with no calendar overflow"
+);
+var capsuleExportRequestSchema = z.object({
+  name: z.string().trim().min(1, "name is required").max(64, "name must be 64 characters or fewer").regex(
+    CAPSULE_ID_PATTERN,
+    "name must be alphanumeric with single dashes (no spaces, no leading/trailing dashes)"
+  ),
+  namespace: namespaceSchema,
+  since: capsuleIsoSinceSchema.optional(),
+  includeKinds: z.array(capsuleTopLevelSegmentSchema).max(50).optional(),
+  peerIds: z.array(capsulePeerIdSchema).max(100).optional(),
+  includeTranscripts: z.boolean().optional(),
+  encrypt: z.boolean().optional()
+});
+var capsuleImportRequestSchema = z.object({
+  archivePath: z.string().trim().min(1, "archivePath is required").max(4096),
+  namespace: namespaceSchema,
+  mode: z.enum(["skip", "overwrite", "fork"]).optional()
+});
+var capsuleListRequestSchema = z.object({
+  namespace: namespaceSchema
+});
+var nullableOptional = (schema) => schema.optional().nullable().transform((value) => value ?? void 0);
+var actionConfidenceRuleSchema = z.object({
+  kind: z.enum(ACTION_CONFIDENCE_RULE_KINDS),
+  description: nullableOptional(z.string().trim().min(1).max(2e3)),
+  matched: nullableOptional(z.boolean())
+}).strict();
+var actionConfidenceMemorySchema = z.object({
+  source: nullableOptional(z.string().trim().min(1).max(256)),
+  created: nullableOptional(z.string().trim().min(1).max(128)),
+  updated: nullableOptional(z.string().trim().min(1).max(128)),
+  scope: nullableOptional(z.string().trim().min(1).max(512)),
+  userContextScopes: nullableOptional(z.array(z.string().trim().min(1).max(128)).max(50)),
+  retrievalReason: nullableOptional(z.string().trim().min(1).max(2e3)),
+  confidence: nullableOptional(z.number().min(0).max(1)),
+  stale: nullableOptional(z.boolean()),
+  corrected: nullableOptional(z.boolean()),
+  correctionState: nullableOptional(z.enum(["none", "correction", "superseded", "disputed", "forgotten"])),
+  safeToUse: nullableOptional(z.boolean()),
+  safety: nullableOptional(z.enum(["safe", "requires-review", "blocked"])),
+  safetyReasons: nullableOptional(z.array(z.string().trim().min(1).max(1e3)).max(50))
+}).strict();
+var actionConfidenceRequestSchema = z.object({
+  intendedAction: nullableOptional(z.string().trim().min(1).max(1e3)),
+  confidence: nullableOptional(z.number().min(0).max(1)),
+  risk: nullableOptional(z.enum(ACTION_CONFIDENCE_RISK_CATEGORIES)),
+  contextReadiness: nullableOptional(z.enum(ACTION_CONFIDENCE_CONTEXT_READINESS)),
+  currentContextScopes: nullableOptional(z.array(z.string().trim().min(1).max(128)).max(50)),
+  userRules: nullableOptional(z.array(actionConfidenceRuleSchema).max(100)),
+  retrievedMemories: nullableOptional(z.array(actionConfidenceMemorySchema).max(200))
+}).strict();
+var schemas = {
+  recall: recallRequestSchema,
+  recallExplain: recallExplainRequestSchema,
+  setCodingContext: setCodingContextRequestSchema,
+  observe: observeRequestSchema,
+  memoryStore: memoryStoreRequestSchema,
+  suggestionSubmit: suggestionSubmitRequestSchema,
+  reviewDisposition: reviewDispositionRequestSchema,
+  trustZonePromote: trustZonePromoteRequestSchema,
+  trustZoneDemoSeed: trustZoneDemoSeedRequestSchema,
+  lcmSearch: lcmSearchRequestSchema,
+  lcmCompactionFlush: lcmCompactionFlushRequestSchema,
+  lcmCompactionRecord: lcmCompactionRecordRequestSchema,
+  daySummary: daySummaryRequestSchema,
+  capsuleExport: capsuleExportRequestSchema,
+  capsuleImport: capsuleImportRequestSchema,
+  capsuleList: capsuleListRequestSchema,
+  actionConfidence: actionConfidenceRequestSchema
+};
+function validateRequest(schemaName, body) {
+  const schema = schemas[schemaName];
+  if (!schema) {
+    return {
+      success: false,
+      error: {
+        error: `unknown schema: ${schemaName}`,
+        code: "validation_error",
+        details: []
+      }
+    };
+  }
+  const result = schema.safeParse(body);
+  if (result.success) {
+    return { success: true, data: result.data };
+  }
+  return { success: false, error: formatZodError(result.error) };
+}
+
+export {
+  formatZodError,
+  codingContextSchema,
+  recallDisclosureSchema,
+  tagMatchSchema,
+  recallRequestSchema,
+  recallExplainRequestSchema,
+  setCodingContextRequestSchema,
+  observeRequestSchema,
+  memoryStoreRequestSchema,
+  suggestionSubmitRequestSchema,
+  reviewDispositionRequestSchema,
+  trustZonePromoteRequestSchema,
+  trustZoneDemoSeedRequestSchema,
+  lcmSearchRequestSchema,
+  lcmCompactionFlushRequestSchema,
+  lcmCompactionRecordRequestSchema,
+  daySummaryRequestSchema,
+  capsuleExportRequestSchema,
+  capsuleImportRequestSchema,
+  capsuleListRequestSchema,
+  actionConfidenceRequestSchema,
+  validateRequest
+};
+//# sourceMappingURL=chunk-A2XUIMJ3.js.map

package/dist/chunk-A2XUIMJ3.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/access-schema.ts"],"sourcesContent":["// Request/response schema validation for the Remnic HTTP API.\n// Uses zod for runtime validation — returns structured 400 errors with\n// field-level detail so consumers get clear feedback on malformed requests.\n\nimport { z } from \"zod\";\nimport {\n  ACTION_CONFIDENCE_CONTEXT_READINESS,\n  ACTION_CONFIDENCE_RISK_CATEGORIES,\n  ACTION_CONFIDENCE_RULE_KINDS,\n} from \"./action-confidence.js\";\nimport { isValidCapsuleSince } from \"./transfer/capsule-export.js\";\nimport { CAPSULE_ID_PATTERN } from \"./transfer/types.js\";\n\n// ---------------------------------------------------------------------------\n// Error formatting\n// ---------------------------------------------------------------------------\n\nexport interface SchemaValidationError {\n  error: string;\n  code: \"validation_error\";\n  details: Array<{ field: string; message: string }>;\n}\n\nexport function formatZodError(error: z.ZodError): SchemaValidationError {\n  return {\n    error: \"request validation failed\",\n    code: \"validation_error\",\n    details: error.issues.map((issue) => ({\n      field: issue.path.join(\".\") || \"(root)\",\n      message: issue.message,\n    })),\n  };\n}\n\n// ---------------------------------------------------------------------------\n// Shared fields\n// ---------------------------------------------------------------------------\n\nconst namespaceSchema = z.string().trim().max(256).optional();\nconst sessionKeySchema = z.string().trim().min(1).max(512).optional();\nconst idempotencyKeySchema = z.string().trim().min(1).max(256).optional();\nconst dryRunSchema = z.boolean().optional();\nconst schemaVersionSchema = z.number().int().optional();\n\n// ---------------------------------------------------------------------------\n// Recall\n// ---------------------------------------------------------------------------\n\n/**\n * Coding-agent context (issue #569). Optional payload that connectors may\n * ship with a recall request so the project/branch namespace overlay\n * applies to that recall. All fields are validated per CLAUDE.md #51 —\n * empty-string projectId / rootPath is rejected, not silently accepted.\n */\nexport const codingContextSchema = z\n  .object({\n    projectId: z.string().trim().min(1, \"codingContext.projectId is required\").max(128),\n    branch: z.string().trim().max(256).nullable(),\n    rootPath: z.string().trim().min(1, \"codingContext.rootPath is required\").max(1024),\n    defaultBranch: z.string().trim().max(256).nullable(),\n  })\n  .nullable();\n\n/**\n * Recall disclosure depth (issue #677).  Mirrors the `RecallDisclosure`\n * type in `types.ts` — keep these in sync.  Default-application happens\n * inside `EngramAccessService.recall()`; the schema only accepts/rejects.\n * Invalid values throw a structured 400 instead of silently defaulting,\n * per CLAUDE.md rule 51.\n */\nexport const recallDisclosureSchema = z.enum([\"chunk\", \"section\", \"raw\"]);\n\n/**\n * Tag-match semantics (issue #689). `any` (default when `tags` is provided\n * and `tagMatch` is omitted) admits a result when it carries at least one\n * of the filter tags. `all` requires every filter tag to be present.\n * Schema rejects unknown values up front — never silently defaults\n * (CLAUDE.md rule 51).\n */\nexport const tagMatchSchema = z.enum([\"any\", \"all\"]);\n\nexport const recallRequestSchema = z.object({\n  query: z.string().min(1, \"query is required\"),\n  sessionKey: sessionKeySchema,\n  namespace: namespaceSchema,\n  topK: z.number().int().min(0).max(200).optional(),\n  mode: z.enum([\"auto\", \"no_recall\", \"minimal\", \"full\", \"graph_mode\"]).optional(),\n  includeDebug: z.boolean().optional(),\n  idempotencyKey: idempotencyKeySchema,\n  disclosure: recallDisclosureSchema.optional(),\n  codingContext: codingContextSchema.optional(),\n  /** Working directory for auto git-context resolution (issue #569). */\n  cwd: z.string().trim().min(1, \"cwd must be non-empty when provided\").max(2048).optional(),\n  /**\n   * Arbitrary project tag for non-git-based project scoping (issue #569).\n   * Creates a coding context with `projectId: \"tag:<projectTag>\"`.\n   */\n  projectTag: z.string().trim().min(1, \"projectTag must be non-empty when provided\").max(256).optional(),\n  /**\n   * Historical recall pin (issue #680).  ISO 8601 timestamp.  The\n   * schema only enforces the basic shape; the access service runs\n   * `Date.parse` and emits a structured 400 on malformed input\n   * (CLAUDE.md rule 51).\n   */\n  asOf: z.string().trim().min(1, \"asOf must be a non-empty ISO 8601 timestamp\").max(64).optional(),\n  /**\n   * Free-form recall tag filter (issue #689). When provided, recall results\n   * whose frontmatter `tags` do not match the filter are removed before the\n   * response is returned. Comparison is case-sensitive exact match.\n   */\n  tags: z.array(z.string().trim().min(1).max(256)).max(50).optional(),\n  /**\n   * Match mode for `tags` (issue #689). Defaults to `\"any\"` when `tags` is\n   * provided and `tagMatch` is omitted. Ignored when `tags` is absent.\n   */\n  tagMatch: tagMatchSchema.optional(),\n  /**\n   * Include graph edges below `graphTraversalConfidenceFloor` for diagnostic\n   * recall traversal (issue #681). Defaults to false.\n   */\n  includeLowConfidence: z.boolean().optional(),\n});\n\nexport const recallExplainRequestSchema = z.object({\n  sessionKey: sessionKeySchema,\n  namespace: namespaceSchema,\n});\n\n/**\n * Standalone \"set coding context\" request. Used by the HTTP endpoint\n * `POST /engram/v1/coding-context` and the MCP `remnic.set_coding_context`\n * tool (PR 7). `codingContext: null` clears the attached context.\n */\nexport const setCodingContextRequestSchema = z.object({\n  sessionKey: z.string().trim().min(1, \"sessionKey is required\").max(512),\n  codingContext: codingContextSchema,\n});\n\n// ---------------------------------------------------------------------------\n// Observe\n// ---------------------------------------------------------------------------\n\nconst messageSchema = z.object({\n  role: z.enum([\"user\", \"assistant\"]),\n  content: z.string().min(1, \"message content must be non-empty\"),\n  sourceFormat: z\n    .enum([\"openai\", \"anthropic\", \"openclaw\", \"pi\", \"lossless-claw\", \"remnic\"])\n    .nullable()\n    .optional(),\n  rawContent: z.unknown().nullable().optional(),\n  parts: z\n    .array(\n      z.object({\n        ordinal: z.number().int().min(0).nullable().optional(),\n        kind: z.enum([\n          \"text\",\n          \"tool_call\",\n          \"tool_result\",\n          \"patch\",\n          \"file_read\",\n          \"file_write\",\n          \"step_start\",\n          \"step_finish\",\n          \"snapshot\",\n          \"retry\",\n        ]),\n        payload: z.record(z.string(), z.unknown()),\n        toolName: z.string().nullable().optional(),\n        tool_name: z.string().nullable().optional(),\n        filePath: z.string().nullable().optional(),\n        file_path: z.string().nullable().optional(),\n        createdAt: z.string().nullable().optional(),\n        created_at: z.string().nullable().optional(),\n      }),\n    )\n    .nullable()\n    .optional(),\n});\n\nexport const observeRequestSchema = z.object({\n  sessionKey: z.string().trim().min(1, \"sessionKey is required\").max(512),\n  messages: z.array(messageSchema).min(1, \"messages must be a non-empty array\"),\n  namespace: namespaceSchema,\n  skipExtraction: z.boolean().optional(),\n  /** Working directory for auto git-context resolution (issue #569). */\n  cwd: z.string().trim().min(1, \"cwd must be non-empty when provided\").max(2048).optional(),\n  /**\n   * Arbitrary project tag for non-git-based project scoping (issue #569).\n   * Creates a coding context with `projectId: \"tag:<projectTag>\"`.\n   */\n  projectTag: z.string().trim().min(1, \"projectTag must be non-empty when provided\").max(256).optional(),\n});\n\n// ---------------------------------------------------------------------------\n// Memory store / suggestion submit\n// ---------------------------------------------------------------------------\n\nconst writeContentSchema = z.string().min(1, \"content is required\").max(50000);\nconst categorySchema = z\n  .enum([\n    \"fact\", \"preference\", \"correction\", \"entity\", \"decision\",\n    \"relationship\", \"principle\", \"commitment\", \"moment\", \"skill\", \"rule\", \"procedure\",\n    \"reasoning_trace\",\n  ])\n  .optional();\nconst confidenceSchema = z.number().min(0).max(1).optional();\nconst tagsSchema = z.array(z.string().max(256)).max(50).optional();\nconst entityRefSchema = z.string().trim().max(512).optional();\nconst ttlSchema = z.string().trim().max(128).optional();\nconst sourceReasonSchema = z.string().trim().max(2000).optional();\n\nexport const memoryStoreRequestSchema = z.object({\n  schemaVersion: schemaVersionSchema,\n  idempotencyKey: idempotencyKeySchema,\n  dryRun: dryRunSchema,\n  sessionKey: sessionKeySchema,\n  content: writeContentSchema,\n  category: categorySchema,\n  confidence: confidenceSchema,\n  namespace: namespaceSchema,\n  tags: tagsSchema,\n  entityRef: entityRefSchema,\n  ttl: ttlSchema,\n  sourceReason: sourceReasonSchema,\n});\n\nexport const suggestionSubmitRequestSchema = memoryStoreRequestSchema;\n\n// ---------------------------------------------------------------------------\n// Review disposition\n// ---------------------------------------------------------------------------\n\nexport const reviewDispositionRequestSchema = z.object({\n  memoryId: z.string().trim().min(1, \"memoryId is required\"),\n  status: z.enum([\n    \"active\", \"pending_review\", \"quarantined\", \"rejected\", \"superseded\", \"archived\",\n  ]),\n  reasonCode: z.string().trim().min(1, \"reasonCode is required\"),\n  namespace: namespaceSchema,\n});\n\n// ---------------------------------------------------------------------------\n// Trust-zone promote\n// ---------------------------------------------------------------------------\n\nexport const trustZonePromoteRequestSchema = z.object({\n  recordId: z.string().trim().min(1, \"recordId is required\"),\n  targetZone: z.enum([\"working\", \"trusted\"], {\n    errorMap: () => ({ message: \"targetZone must be 'working' or 'trusted'\" }),\n  }),\n  promotionReason: z.string().trim().min(1, \"promotionReason is required\"),\n  recordedAt: z.string().trim().optional(),\n  summary: z.string().trim().max(5000).optional(),\n  dryRun: dryRunSchema,\n  namespace: namespaceSchema,\n});\n\n// ---------------------------------------------------------------------------\n// Trust-zone demo-seed\n// ---------------------------------------------------------------------------\n\nexport const trustZoneDemoSeedRequestSchema = z.object({\n  scenario: z.string().trim().max(256).optional(),\n  recordedAt: z.string().trim().optional(),\n  dryRun: dryRunSchema,\n  namespace: namespaceSchema,\n});\n\n// ---------------------------------------------------------------------------\n// LCM search\n// ---------------------------------------------------------------------------\n\nexport const lcmSearchRequestSchema = z.object({\n  query: z.string().min(1, \"query is required\"),\n  sessionKey: sessionKeySchema,\n  namespace: namespaceSchema,\n  limit: z.number().int().min(1).max(100).optional(),\n});\n\nexport const lcmCompactionFlushRequestSchema = z.object({\n  sessionKey: z.string().trim().min(1, \"sessionKey is required\").max(512),\n  namespace: namespaceSchema,\n});\n\nexport const lcmCompactionRecordRequestSchema = z.object({\n  sessionKey: z.string().trim().min(1, \"sessionKey is required\").max(512),\n  namespace: namespaceSchema,\n  tokensBefore: z.number().int().min(0, \"tokensBefore must be a non-negative integer\"),\n  tokensAfter: z.number().int().min(0, \"tokensAfter must be a non-negative integer\"),\n});\n\n// ---------------------------------------------------------------------------\n// Day summary\n// ---------------------------------------------------------------------------\n\nexport const daySummaryRequestSchema = z.object({\n  memories: z.string().max(100000).optional(),\n  sessionKey: sessionKeySchema,\n  namespace: namespaceSchema,\n});\n\n// ---------------------------------------------------------------------------\n// Capsule export\n// ---------------------------------------------------------------------------\n\nconst capsuleTopLevelSegmentSchema = z\n  .string()\n  .trim()\n  .min(1)\n  .max(128)\n  .refine(\n    (value) => !value.includes(\"/\") && !value.includes(\"\\\\\"),\n    \"must be a top-level directory name without path separators\",\n  );\n\nconst capsulePeerIdSchema = z\n  .string()\n  .trim()\n  .min(1)\n  .max(256)\n  .refine(\n    (value) => value !== \".\" && value !== \"..\" && !value.includes(\"/\") && !value.includes(\"\\\\\"),\n    \"must be a plain peer id without path separators\",\n  );\n\nconst capsuleIsoSinceSchema = z\n  .string()\n  .trim()\n  .min(1, \"since must be a non-empty ISO 8601 timestamp\")\n  .max(128)\n  .refine(\n    isValidCapsuleSince,\n    \"since must be a valid ISO 8601 timestamp with no calendar overflow\",\n  );\n\nexport const capsuleExportRequestSchema = z\n  .object({\n    name: z\n      .string()\n      .trim()\n      .min(1, \"name is required\")\n      .max(64, \"name must be 64 characters or fewer\")\n      .regex(\n        CAPSULE_ID_PATTERN,\n        \"name must be alphanumeric with single dashes (no spaces, no leading/trailing dashes)\",\n      ),\n    namespace: namespaceSchema,\n    since: capsuleIsoSinceSchema.optional(),\n    includeKinds: z.array(capsuleTopLevelSegmentSchema).max(50).optional(),\n    peerIds: z.array(capsulePeerIdSchema).max(100).optional(),\n    includeTranscripts: z.boolean().optional(),\n    encrypt: z.boolean().optional(),\n  });\n\nexport const capsuleImportRequestSchema = z\n  .object({\n    archivePath: z.string().trim().min(1, \"archivePath is required\").max(4096),\n    namespace: namespaceSchema,\n    mode: z.enum([\"skip\", \"overwrite\", \"fork\"]).optional(),\n  });\n\nexport const capsuleListRequestSchema = z\n  .object({\n    namespace: namespaceSchema,\n  });\n\n// ---------------------------------------------------------------------------\n// Action confidence\n// ---------------------------------------------------------------------------\n\nconst nullableOptional = <T extends z.ZodTypeAny>(schema: T) =>\n  schema.optional().nullable().transform((value) => value ?? undefined);\n\nconst actionConfidenceRuleSchema = z\n  .object({\n    kind: z.enum(ACTION_CONFIDENCE_RULE_KINDS),\n    description: nullableOptional(z.string().trim().min(1).max(2000)),\n    matched: nullableOptional(z.boolean()),\n  })\n  .strict();\n\nconst actionConfidenceMemorySchema = z\n  .object({\n    source: nullableOptional(z.string().trim().min(1).max(256)),\n    created: nullableOptional(z.string().trim().min(1).max(128)),\n    updated: nullableOptional(z.string().trim().min(1).max(128)),\n    scope: nullableOptional(z.string().trim().min(1).max(512)),\n    userContextScopes: nullableOptional(z.array(z.string().trim().min(1).max(128)).max(50)),\n    retrievalReason: nullableOptional(z.string().trim().min(1).max(2000)),\n    confidence: nullableOptional(z.number().min(0).max(1)),\n    stale: nullableOptional(z.boolean()),\n    corrected: nullableOptional(z.boolean()),\n    correctionState: nullableOptional(z.enum([\"none\", \"correction\", \"superseded\", \"disputed\", \"forgotten\"])),\n    safeToUse: nullableOptional(z.boolean()),\n    safety: nullableOptional(z.enum([\"safe\", \"requires-review\", \"blocked\"])),\n    safetyReasons: nullableOptional(z.array(z.string().trim().min(1).max(1000)).max(50)),\n  })\n  .strict();\n\nexport const actionConfidenceRequestSchema = z\n  .object({\n    intendedAction: nullableOptional(z.string().trim().min(1).max(1000)),\n    confidence: nullableOptional(z.number().min(0).max(1)),\n    risk: nullableOptional(z.enum(ACTION_CONFIDENCE_RISK_CATEGORIES)),\n    contextReadiness: nullableOptional(z.enum(ACTION_CONFIDENCE_CONTEXT_READINESS)),\n    currentContextScopes: nullableOptional(z.array(z.string().trim().min(1).max(128)).max(50)),\n    userRules: nullableOptional(z.array(actionConfidenceRuleSchema).max(100)),\n    retrievedMemories: nullableOptional(z.array(actionConfidenceMemorySchema).max(200)),\n  })\n  .strict();\n\n// ---------------------------------------------------------------------------\n// Inferred types\n// ---------------------------------------------------------------------------\n\nexport type RecallRequest = z.infer<typeof recallRequestSchema>;\nexport type RecallExplainRequest = z.infer<typeof recallExplainRequestSchema>;\nexport type SetCodingContextRequest = z.infer<typeof setCodingContextRequestSchema>;\nexport type ObserveRequest = z.infer<typeof observeRequestSchema>;\nexport type MemoryStoreRequest = z.infer<typeof memoryStoreRequestSchema>;\nexport type SuggestionSubmitRequest = z.infer<typeof suggestionSubmitRequestSchema>;\nexport type ReviewDispositionRequest = z.infer<typeof reviewDispositionRequestSchema>;\nexport type TrustZonePromoteRequest = z.infer<typeof trustZonePromoteRequestSchema>;\nexport type TrustZoneDemoSeedRequest = z.infer<typeof trustZoneDemoSeedRequestSchema>;\nexport type LcmSearchRequest = z.infer<typeof lcmSearchRequestSchema>;\nexport type LcmCompactionFlushRequest = z.infer<typeof lcmCompactionFlushRequestSchema>;\nexport type LcmCompactionRecordRequest = z.infer<typeof lcmCompactionRecordRequestSchema>;\nexport type DaySummaryRequest = z.infer<typeof daySummaryRequestSchema>;\nexport type CapsuleExportRequest = z.infer<typeof capsuleExportRequestSchema>;\nexport type CapsuleImportRequest = z.infer<typeof capsuleImportRequestSchema>;\nexport type CapsuleListRequest = z.infer<typeof capsuleListRequestSchema>;\nexport type ActionConfidenceRequest = z.infer<typeof actionConfidenceRequestSchema>;\n\n// ---------------------------------------------------------------------------\n// Validation helper\n// ---------------------------------------------------------------------------\n\nexport type SchemaName =\n  | \"recall\"\n  | \"recallExplain\"\n  | \"setCodingContext\"\n  | \"observe\"\n  | \"memoryStore\"\n  | \"suggestionSubmit\"\n  | \"reviewDisposition\"\n  | \"trustZonePromote\"\n  | \"trustZoneDemoSeed\"\n  | \"lcmSearch\"\n  | \"lcmCompactionFlush\"\n  | \"lcmCompactionRecord\"\n  | \"daySummary\"\n  | \"capsuleExport\"\n  | \"capsuleImport\"\n  | \"capsuleList\"\n  | \"actionConfidence\";\n\nexport type SchemaTypeFor<N extends SchemaName> =\n  N extends \"recall\" ? RecallRequest\n  : N extends \"recallExplain\" ? RecallExplainRequest\n  : N extends \"setCodingContext\" ? SetCodingContextRequest\n  : N extends \"observe\" ? ObserveRequest\n  : N extends \"memoryStore\" ? MemoryStoreRequest\n  : N extends \"suggestionSubmit\" ? SuggestionSubmitRequest\n  : N extends \"reviewDisposition\" ? ReviewDispositionRequest\n  : N extends \"trustZonePromote\" ? TrustZonePromoteRequest\n  : N extends \"trustZoneDemoSeed\" ? TrustZoneDemoSeedRequest\n  : N extends \"lcmSearch\" ? LcmSearchRequest\n  : N extends \"lcmCompactionFlush\" ? LcmCompactionFlushRequest\n  : N extends \"lcmCompactionRecord\" ? LcmCompactionRecordRequest\n  : N extends \"daySummary\" ? DaySummaryRequest\n  : N extends \"capsuleExport\" ? CapsuleExportRequest\n  : N extends \"capsuleImport\" ? CapsuleImportRequest\n  : N extends \"capsuleList\" ? CapsuleListRequest\n  : N extends \"actionConfidence\" ? ActionConfidenceRequest\n  : never;\n\nconst schemas: Record<SchemaName, z.ZodTypeAny> = {\n  recall: recallRequestSchema,\n  recallExplain: recallExplainRequestSchema,\n  setCodingContext: setCodingContextRequestSchema,\n  observe: observeRequestSchema,\n  memoryStore: memoryStoreRequestSchema,\n  suggestionSubmit: suggestionSubmitRequestSchema,\n  reviewDisposition: reviewDispositionRequestSchema,\n  trustZonePromote: trustZonePromoteRequestSchema,\n  trustZoneDemoSeed: trustZoneDemoSeedRequestSchema,\n  lcmSearch: lcmSearchRequestSchema,\n  lcmCompactionFlush: lcmCompactionFlushRequestSchema,\n  lcmCompactionRecord: lcmCompactionRecordRequestSchema,\n  daySummary: daySummaryRequestSchema,\n  capsuleExport: capsuleExportRequestSchema,\n  capsuleImport: capsuleImportRequestSchema,\n  capsuleList: capsuleListRequestSchema,\n  actionConfidence: actionConfidenceRequestSchema,\n};\n\n/**\n * Validate a request body against the named schema.\n * Returns `{ success: true, data }` on pass or\n * `{ success: false, error }` on failure with field-level detail.\n */\nexport function validateRequest<T = unknown>(\n  schemaName: SchemaName,\n  body: unknown,\n): { success: true; data: T } | { success: false; error: SchemaValidationError } {\n  const schema = schemas[schemaName];\n  if (!schema) {\n    return {\n      success: false,\n      error: {\n        error: `unknown schema: ${schemaName}`,\n        code: \"validation_error\",\n        details: [],\n      },\n    };\n  }\n  const result = schema.safeParse(body);\n  if (result.success) {\n    return { success: true, data: result.data as T };\n  }\n  return { success: false, error: formatZodError(result.error) };\n}\n"],"mappings":";;;;;;;;;;;;;AAIA,SAAS,SAAS;AAmBX,SAAS,eAAe,OAA0C;AACvE,SAAO;AAAA,IACL,OAAO;AAAA,IACP,MAAM;AAAA,IACN,SAAS,MAAM,OAAO,IAAI,CAAC,WAAW;AAAA,MACpC,OAAO,MAAM,KAAK,KAAK,GAAG,KAAK;AAAA,MAC/B,SAAS,MAAM;AAAA,IACjB,EAAE;AAAA,EACJ;AACF;AAMA,IAAM,kBAAkB,EAAE,OAAO,EAAE,KAAK,EAAE,IAAI,GAAG,EAAE,SAAS;AAC5D,IAAM,mBAAmB,EAAE,OAAO,EAAE,KAAK,EAAE,IAAI,CAAC,EAAE,IAAI,GAAG,EAAE,SAAS;AACpE,IAAM,uBAAuB,EAAE,OAAO,EAAE,KAAK,EAAE,IAAI,CAAC,EAAE,IAAI,GAAG,EAAE,SAAS;AACxE,IAAM,eAAe,EAAE,QAAQ,EAAE,SAAS;AAC1C,IAAM,sBAAsB,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS;AAY/C,IAAM,sBAAsB,EAChC,OAAO;AAAA,EACN,WAAW,EAAE,OAAO,EAAE,KAAK,EAAE,IAAI,GAAG,qCAAqC,EAAE,IAAI,GAAG;AAAA,EAClF,QAAQ,EAAE,OAAO,EAAE,KAAK,EAAE,IAAI,GAAG,EAAE,SAAS;AAAA,EAC5C,UAAU,EAAE,OAAO,EAAE,KAAK,EAAE,IAAI,GAAG,oCAAoC,EAAE,IAAI,IAAI;AAAA,EACjF,eAAe,EAAE,OAAO,EAAE,KAAK,EAAE,IAAI,GAAG,EAAE,SAAS;AACrD,CAAC,EACA,SAAS;AASL,IAAM,yBAAyB,EAAE,KAAK,CAAC,SAAS,WAAW,KAAK,CAAC;AASjE,IAAM,iBAAiB,EAAE,KAAK,CAAC,OAAO,KAAK,CAAC;AAE5C,IAAM,sBAAsB,EAAE,OAAO;AAAA,EAC1C,OAAO,EAAE,OAAO,EAAE,IAAI,GAAG,mBAAmB;AAAA,EAC5C,YAAY;AAAA,EACZ,WAAW;AAAA,EACX,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,CAAC,EAAE,IAAI,GAAG,EAAE,SAAS;AAAA,EAChD,MAAM,EAAE,KAAK,CAAC,QAAQ,aAAa,WAAW,QAAQ,YAAY,CAAC,EAAE,SAAS;AAAA,EAC9E,cAAc,EAAE,QAAQ,EAAE,SAAS;AAAA,EACnC,gBAAgB;AAAA,EAChB,YAAY,uBAAuB,SAAS;AAAA,EAC5C,eAAe,oBAAoB,SAAS;AAAA;AAAA,EAE5C,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,IAAI,GAAG,qCAAqC,EAAE,IAAI,IAAI,EAAE,SAAS;AAAA;AAAA;AAAA;AAAA;AAAA,EAKxF,YAAY,EAAE,OAAO,EAAE,KAAK,EAAE,IAAI,GAAG,4CAA4C,EAAE,IAAI,GAAG,EAAE,SAAS;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOrG,MAAM,EAAE,OAAO,EAAE,KAAK,EAAE,IAAI,GAAG,6CAA6C,EAAE,IAAI,EAAE,EAAE,SAAS;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAM/F,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,KAAK,EAAE,IAAI,CAAC,EAAE,IAAI,GAAG,CAAC,EAAE,IAAI,EAAE,EAAE,SAAS;AAAA;AAAA;AAAA;AAAA;AAAA,EAKlE,UAAU,eAAe,SAAS;AAAA;AAAA;AAAA;AAAA;AAAA,EAKlC,sBAAsB,EAAE,QAAQ,EAAE,SAAS;AAC7C,CAAC;AAEM,IAAM,6BAA6B,EAAE,OAAO;AAAA,EACjD,YAAY;AAAA,EACZ,WAAW;AACb,CAAC;AAOM,IAAM,gCAAgC,EAAE,OAAO;AAAA,EACpD,YAAY,EAAE,OAAO,EAAE,KAAK,EAAE,IAAI,GAAG,wBAAwB,EAAE,IAAI,GAAG;AAAA,EACtE,eAAe;AACjB,CAAC;AAMD,IAAM,gBAAgB,EAAE,OAAO;AAAA,EAC7B,MAAM,EAAE,KAAK,CAAC,QAAQ,WAAW,CAAC;AAAA,EAClC,SAAS,EAAE,OAAO,EAAE,IAAI,GAAG,mCAAmC;AAAA,EAC9D,cAAc,EACX,KAAK,CAAC,UAAU,aAAa,YAAY,MAAM,iBAAiB,QAAQ,CAAC,EACzE,SAAS,EACT,SAAS;AAAA,EACZ,YAAY,EAAE,QAAQ,EAAE,SAAS,EAAE,SAAS;AAAA,EAC5C,OAAO,EACJ;AAAA,IACC,EAAE,OAAO;AAAA,MACP,SAAS,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,CAAC,EAAE,SAAS,EAAE,SAAS;AAAA,MACrD,MAAM,EAAE,KAAK;AAAA,QACX;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,MACF,CAAC;AAAA,MACD,SAAS,EAAE,OAAO,EAAE,OAAO,GAAG,EAAE,QAAQ,CAAC;AAAA,MACzC,UAAU,EAAE,OAAO,EAAE,SAAS,EAAE,SAAS;AAAA,MACzC,WAAW,EAAE,OAAO,EAAE,SAAS,EAAE,SAAS;AAAA,MAC1C,UAAU,EAAE,OAAO,EAAE,SAAS,EAAE,SAAS;AAAA,MACzC,WAAW,EAAE,OAAO,EAAE,SAAS,EAAE,SAAS;AAAA,MAC1C,WAAW,EAAE,OAAO,EAAE,SAAS,EAAE,SAAS;AAAA,MAC1C,YAAY,EAAE,OAAO,EAAE,SAAS,EAAE,SAAS;AAAA,IAC7C,CAAC;AAAA,EACH,EACC,SAAS,EACT,SAAS;AACd,CAAC;AAEM,IAAM,uBAAuB,EAAE,OAAO;AAAA,EAC3C,YAAY,EAAE,OAAO,EAAE,KAAK,EAAE,IAAI,GAAG,wBAAwB,EAAE,IAAI,GAAG;AAAA,EACtE,UAAU,EAAE,MAAM,aAAa,EAAE,IAAI,GAAG,oCAAoC;AAAA,EAC5E,WAAW;AAAA,EACX,gBAAgB,EAAE,QAAQ,EAAE,SAAS;AAAA;AAAA,EAErC,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,IAAI,GAAG,qCAAqC,EAAE,IAAI,IAAI,EAAE,SAAS;AAAA;AAAA;AAAA;AAAA;AAAA,EAKxF,YAAY,EAAE,OAAO,EAAE,KAAK,EAAE,IAAI,GAAG,4CAA4C,EAAE,IAAI,GAAG,EAAE,SAAS;AACvG,CAAC;AAMD,IAAM,qBAAqB,EAAE,OAAO,EAAE,IAAI,GAAG,qBAAqB,EAAE,IAAI,GAAK;AAC7E,IAAM,iBAAiB,EACpB,KAAK;AAAA,EACJ;AAAA,EAAQ;AAAA,EAAc;AAAA,EAAc;AAAA,EAAU;AAAA,EAC9C;AAAA,EAAgB;AAAA,EAAa;AAAA,EAAc;AAAA,EAAU;AAAA,EAAS;AAAA,EAAQ;AAAA,EACtE;AACF,CAAC,EACA,SAAS;AACZ,IAAM,mBAAmB,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,IAAI,CAAC,EAAE,SAAS;AAC3D,IAAM,aAAa,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,GAAG,CAAC,EAAE,IAAI,EAAE,EAAE,SAAS;AACjE,IAAM,kBAAkB,EAAE,OAAO,EAAE,KAAK,EAAE,IAAI,GAAG,EAAE,SAAS;AAC5D,IAAM,YAAY,EAAE,OAAO,EAAE,KAAK,EAAE,IAAI,GAAG,EAAE,SAAS;AACtD,IAAM,qBAAqB,EAAE,OAAO,EAAE,KAAK,EAAE,IAAI,GAAI,EAAE,SAAS;AAEzD,IAAM,2BAA2B,EAAE,OAAO;AAAA,EAC/C,eAAe;AAAA,EACf,gBAAgB;AAAA,EAChB,QAAQ;AAAA,EACR,YAAY;AAAA,EACZ,SAAS;AAAA,EACT,UAAU;AAAA,EACV,YAAY;AAAA,EACZ,WAAW;AAAA,EACX,MAAM;AAAA,EACN,WAAW;AAAA,EACX,KAAK;AAAA,EACL,cAAc;AAChB,CAAC;AAEM,IAAM,gCAAgC;AAMtC,IAAM,iCAAiC,EAAE,OAAO;AAAA,EACrD,UAAU,EAAE,OAAO,EAAE,KAAK,EAAE,IAAI,GAAG,sBAAsB;AAAA,EACzD,QAAQ,EAAE,KAAK;AAAA,IACb;AAAA,IAAU;AAAA,IAAkB;AAAA,IAAe;AAAA,IAAY;AAAA,IAAc;AAAA,EACvE,CAAC;AAAA,EACD,YAAY,EAAE,OAAO,EAAE,KAAK,EAAE,IAAI,GAAG,wBAAwB;AAAA,EAC7D,WAAW;AACb,CAAC;AAMM,IAAM,gCAAgC,EAAE,OAAO;AAAA,EACpD,UAAU,EAAE,OAAO,EAAE,KAAK,EAAE,IAAI,GAAG,sBAAsB;AAAA,EACzD,YAAY,EAAE,KAAK,CAAC,WAAW,SAAS,GAAG;AAAA,IACzC,UAAU,OAAO,EAAE,SAAS,4CAA4C;AAAA,EAC1E,CAAC;AAAA,EACD,iBAAiB,EAAE,OAAO,EAAE,KAAK,EAAE,IAAI,GAAG,6BAA6B;AAAA,EACvE,YAAY,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS;AAAA,EACvC,SAAS,EAAE,OAAO,EAAE,KAAK,EAAE,IAAI,GAAI,EAAE,SAAS;AAAA,EAC9C,QAAQ;AAAA,EACR,WAAW;AACb,CAAC;AAMM,IAAM,iCAAiC,EAAE,OAAO;AAAA,EACrD,UAAU,EAAE,OAAO,EAAE,KAAK,EAAE,IAAI,GAAG,EAAE,SAAS;AAAA,EAC9C,YAAY,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS;AAAA,EACvC,QAAQ;AAAA,EACR,WAAW;AACb,CAAC;AAMM,IAAM,yBAAyB,EAAE,OAAO;AAAA,EAC7C,OAAO,EAAE,OAAO,EAAE,IAAI,GAAG,mBAAmB;AAAA,EAC5C,YAAY;AAAA,EACZ,WAAW;AAAA,EACX,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,CAAC,EAAE,IAAI,GAAG,EAAE,SAAS;AACnD,CAAC;AAEM,IAAM,kCAAkC,EAAE,OAAO;AAAA,EACtD,YAAY,EAAE,OAAO,EAAE,KAAK,EAAE,IAAI,GAAG,wBAAwB,EAAE,IAAI,GAAG;AAAA,EACtE,WAAW;AACb,CAAC;AAEM,IAAM,mCAAmC,EAAE,OAAO;AAAA,EACvD,YAAY,EAAE,OAAO,EAAE,KAAK,EAAE,IAAI,GAAG,wBAAwB,EAAE,IAAI,GAAG;AAAA,EACtE,WAAW;AAAA,EACX,cAAc,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,GAAG,6CAA6C;AAAA,EACnF,aAAa,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,GAAG,4CAA4C;AACnF,CAAC;AAMM,IAAM,0BAA0B,EAAE,OAAO;AAAA,EAC9C,UAAU,EAAE,OAAO,EAAE,IAAI,GAAM,EAAE,SAAS;AAAA,EAC1C,YAAY;AAAA,EACZ,WAAW;AACb,CAAC;AAMD,IAAM,+BAA+B,EAClC,OAAO,EACP,KAAK,EACL,IAAI,CAAC,EACL,IAAI,GAAG,EACP;AAAA,EACC,CAAC,UAAU,CAAC,MAAM,SAAS,GAAG,KAAK,CAAC,MAAM,SAAS,IAAI;AAAA,EACvD;AACF;AAEF,IAAM,sBAAsB,EACzB,OAAO,EACP,KAAK,EACL,IAAI,CAAC,EACL,IAAI,GAAG,EACP;AAAA,EACC,CAAC,UAAU,UAAU,OAAO,UAAU,QAAQ,CAAC,MAAM,SAAS,GAAG,KAAK,CAAC,MAAM,SAAS,IAAI;AAAA,EAC1F;AACF;AAEF,IAAM,wBAAwB,EAC3B,OAAO,EACP,KAAK,EACL,IAAI,GAAG,8CAA8C,EACrD,IAAI,GAAG,EACP;AAAA,EACC;AAAA,EACA;AACF;AAEK,IAAM,6BAA6B,EACvC,OAAO;AAAA,EACN,MAAM,EACH,OAAO,EACP,KAAK,EACL,IAAI,GAAG,kBAAkB,EACzB,IAAI,IAAI,qCAAqC,EAC7C;AAAA,IACC;AAAA,IACA;AAAA,EACF;AAAA,EACF,WAAW;AAAA,EACX,OAAO,sBAAsB,SAAS;AAAA,EACtC,cAAc,EAAE,MAAM,4BAA4B,EAAE,IAAI,EAAE,EAAE,SAAS;AAAA,EACrE,SAAS,EAAE,MAAM,mBAAmB,EAAE,IAAI,GAAG,EAAE,SAAS;AAAA,EACxD,oBAAoB,EAAE,QAAQ,EAAE,SAAS;AAAA,EACzC,SAAS,EAAE,QAAQ,EAAE,SAAS;AAChC,CAAC;AAEI,IAAM,6BAA6B,EACvC,OAAO;AAAA,EACN,aAAa,EAAE,OAAO,EAAE,KAAK,EAAE,IAAI,GAAG,yBAAyB,EAAE,IAAI,IAAI;AAAA,EACzE,WAAW;AAAA,EACX,MAAM,EAAE,KAAK,CAAC,QAAQ,aAAa,MAAM,CAAC,EAAE,SAAS;AACvD,CAAC;AAEI,IAAM,2BAA2B,EACrC,OAAO;AAAA,EACN,WAAW;AACb,CAAC;AAMH,IAAM,mBAAmB,CAAyB,WAChD,OAAO,SAAS,EAAE,SAAS,EAAE,UAAU,CAAC,UAAU,SAAS,MAAS;AAEtE,IAAM,6BAA6B,EAChC,OAAO;AAAA,EACN,MAAM,EAAE,KAAK,4BAA4B;AAAA,EACzC,aAAa,iBAAiB,EAAE,OAAO,EAAE,KAAK,EAAE,IAAI,CAAC,EAAE,IAAI,GAAI,CAAC;AAAA,EAChE,SAAS,iBAAiB,EAAE,QAAQ,CAAC;AACvC,CAAC,EACA,OAAO;AAEV,IAAM,+BAA+B,EAClC,OAAO;AAAA,EACN,QAAQ,iBAAiB,EAAE,OAAO,EAAE,KAAK,EAAE,IAAI,CAAC,EAAE,IAAI,GAAG,CAAC;AAAA,EAC1D,SAAS,iBAAiB,EAAE,OAAO,EAAE,KAAK,EAAE,IAAI,CAAC,EAAE,IAAI,GAAG,CAAC;AAAA,EAC3D,SAAS,iBAAiB,EAAE,OAAO,EAAE,KAAK,EAAE,IAAI,CAAC,EAAE,IAAI,GAAG,CAAC;AAAA,EAC3D,OAAO,iBAAiB,EAAE,OAAO,EAAE,KAAK,EAAE,IAAI,CAAC,EAAE,IAAI,GAAG,CAAC;AAAA,EACzD,mBAAmB,iBAAiB,EAAE,MAAM,EAAE,OAAO,EAAE,KAAK,EAAE,IAAI,CAAC,EAAE,IAAI,GAAG,CAAC,EAAE,IAAI,EAAE,CAAC;AAAA,EACtF,iBAAiB,iBAAiB,EAAE,OAAO,EAAE,KAAK,EAAE,IAAI,CAAC,EAAE,IAAI,GAAI,CAAC;AAAA,EACpE,YAAY,iBAAiB,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,IAAI,CAAC,CAAC;AAAA,EACrD,OAAO,iBAAiB,EAAE,QAAQ,CAAC;AAAA,EACnC,WAAW,iBAAiB,EAAE,QAAQ,CAAC;AAAA,EACvC,iBAAiB,iBAAiB,EAAE,KAAK,CAAC,QAAQ,cAAc,cAAc,YAAY,WAAW,CAAC,CAAC;AAAA,EACvG,WAAW,iBAAiB,EAAE,QAAQ,CAAC;AAAA,EACvC,QAAQ,iBAAiB,EAAE,KAAK,CAAC,QAAQ,mBAAmB,SAAS,CAAC,CAAC;AAAA,EACvE,eAAe,iBAAiB,EAAE,MAAM,EAAE,OAAO,EAAE,KAAK,EAAE,IAAI,CAAC,EAAE,IAAI,GAAI,CAAC,EAAE,IAAI,EAAE,CAAC;AACrF,CAAC,EACA,OAAO;AAEH,IAAM,gCAAgC,EAC1C,OAAO;AAAA,EACN,gBAAgB,iBAAiB,EAAE,OAAO,EAAE,KAAK,EAAE,IAAI,CAAC,EAAE,IAAI,GAAI,CAAC;AAAA,EACnE,YAAY,iBAAiB,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,IAAI,CAAC,CAAC;AAAA,EACrD,MAAM,iBAAiB,EAAE,KAAK,iCAAiC,CAAC;AAAA,EAChE,kBAAkB,iBAAiB,EAAE,KAAK,mCAAmC,CAAC;AAAA,EAC9E,sBAAsB,iBAAiB,EAAE,MAAM,EAAE,OAAO,EAAE,KAAK,EAAE,IAAI,CAAC,EAAE,IAAI,GAAG,CAAC,EAAE,IAAI,EAAE,CAAC;AAAA,EACzF,WAAW,iBAAiB,EAAE,MAAM,0BAA0B,EAAE,IAAI,GAAG,CAAC;AAAA,EACxE,mBAAmB,iBAAiB,EAAE,MAAM,4BAA4B,EAAE,IAAI,GAAG,CAAC;AACpF,CAAC,EACA,OAAO;AAmEV,IAAM,UAA4C;AAAA,EAChD,QAAQ;AAAA,EACR,eAAe;AAAA,EACf,kBAAkB;AAAA,EAClB,SAAS;AAAA,EACT,aAAa;AAAA,EACb,kBAAkB;AAAA,EAClB,mBAAmB;AAAA,EACnB,kBAAkB;AAAA,EAClB,mBAAmB;AAAA,EACnB,WAAW;AAAA,EACX,oBAAoB;AAAA,EACpB,qBAAqB;AAAA,EACrB,YAAY;AAAA,EACZ,eAAe;AAAA,EACf,eAAe;AAAA,EACf,aAAa;AAAA,EACb,kBAAkB;AACpB;AAOO,SAAS,gBACd,YACA,MAC+E;AAC/E,QAAM,SAAS,QAAQ,UAAU;AACjC,MAAI,CAAC,QAAQ;AACX,WAAO;AAAA,MACL,SAAS;AAAA,MACT,OAAO;AAAA,QACL,OAAO,mBAAmB,UAAU;AAAA,QACpC,MAAM;AAAA,QACN,SAAS,CAAC;AAAA,MACZ;AAAA,IACF;AAAA,EACF;AACA,QAAM,SAAS,OAAO,UAAU,IAAI;AACpC,MAAI,OAAO,SAAS;AAClB,WAAO,EAAE,SAAS,MAAM,MAAM,OAAO,KAAU;AAAA,EACjD;AACA,SAAO,EAAE,SAAS,OAAO,OAAO,eAAe,OAAO,KAAK,EAAE;AAC/D;","names":[]}

package/dist/chunk-AGZQD76C.js

@@ -0,0 +1,201 @@
+// src/transfer/fs-utils.ts
+import { createHash } from "crypto";
+import {
+  lstat,
+  mkdir,
+  readdir,
+  readFile,
+  realpath,
+  stat,
+  writeFile
+} from "fs/promises";
+import path from "path";
+var fatalUtf8Decoder = new TextDecoder("utf-8", { fatal: true, ignoreBOM: true });
+async function sha256File(filePath) {
+  const buf = await readFile(filePath);
+  const sha256 = createHash("sha256").update(buf).digest("hex");
+  return { sha256, bytes: buf.byteLength };
+}
+function sha256Bytes(content) {
+  const buf = Buffer.from(content);
+  const sha256 = createHash("sha256").update(buf).digest("hex");
+  return { sha256, bytes: buf.byteLength };
+}
+function sha256String(content) {
+  return sha256Bytes(Buffer.from(content, "utf-8"));
+}
+async function readUtf8FileStrict(filePath) {
+  const buf = await readFile(filePath);
+  let content;
+  try {
+    content = fatalUtf8Decoder.decode(buf);
+  } catch {
+    throw new Error(`transfer export requires UTF-8 text files: ${filePath}`);
+  }
+  return { content, ...sha256Bytes(buf) };
+}
+async function writeJsonFile(filePath, value) {
+  await mkdir(path.dirname(filePath), { recursive: true });
+  await writeFile(filePath, JSON.stringify(value, null, 2) + "\n", "utf-8");
+}
+async function readJsonFile(filePath) {
+  const raw = await readFile(filePath, "utf-8");
+  return JSON.parse(raw);
+}
+async function listFilesRecursive(rootDir) {
+  const out = [];
+  async function walk(dir) {
+    const entries = await readdir(dir, { withFileTypes: true });
+    for (const ent of entries) {
+      const fp = path.join(dir, ent.name);
+      if (ent.isDirectory()) {
+        await walk(fp);
+      } else if (ent.isFile()) {
+        out.push(fp);
+      }
+    }
+  }
+  await walk(rootDir);
+  return out.sort();
+}
+async function ensureDirExists(dirPath) {
+  await mkdir(dirPath, { recursive: true });
+}
+async function fileExists(filePath) {
+  try {
+    await stat(filePath);
+    return true;
+  } catch {
+    return false;
+  }
+}
+function toPosixRelPath(absPath, rootDir) {
+  const rel = path.relative(rootDir, absPath);
+  return rel.split(path.sep).join("/");
+}
+function fromPosixRelPath(relPath) {
+  return relPath.split("/").join(path.sep);
+}
+async function prepareSafeArchiveRoot(absPath, errorPrefix, argName) {
+  const rootAbs = path.resolve(absPath);
+  await assertIsDirectoryNotSymlink(rootAbs, errorPrefix, argName);
+  return {
+    abs: rootAbs,
+    real: await realpath(rootAbs),
+    errorPrefix,
+    argName
+  };
+}
+function validateArchiveRelativePath(relPath, errorPrefix) {
+  if (relPath.length === 0) {
+    throw new Error(`${errorPrefix}: record path must not be empty`);
+  }
+  if (relPath.includes("\\")) {
+    throw new Error(
+      `${errorPrefix}: record path must use POSIX separators: ${relPath}`
+    );
+  }
+  if (path.posix.isAbsolute(relPath)) {
+    throw new Error(
+      `${errorPrefix}: record path must be relative: ${relPath}`
+    );
+  }
+  const segments = relPath.split("/");
+  if (segments.some((segment) => segment === "" || segment === "." || segment === "..")) {
+    throw new Error(
+      `${errorPrefix}: record path contains unsafe segments: ${relPath}`
+    );
+  }
+  const normalized = path.posix.normalize(relPath);
+  if (normalized === "." || normalized === ".." || normalized.startsWith("../") || path.posix.isAbsolute(normalized)) {
+    throw new Error(
+      `${errorPrefix}: record path escapes target root: ${relPath}`
+    );
+  }
+  return normalized;
+}
+async function resolveSafeArchiveTarget(root, relPath) {
+  const safeRelPath = validateArchiveRelativePath(relPath, root.errorPrefix);
+  const targetAbs = path.resolve(root.abs, fromPosixRelPath(safeRelPath));
+  if (!isPathInsideRoot(root.abs, targetAbs)) {
+    throw new Error(
+      `${root.errorPrefix}: record path escapes target root: ${relPath}`
+    );
+  }
+  const targetStat = await lstat(targetAbs).catch((error) => {
+    if (error.code === "ENOENT") return null;
+    throw error;
+  });
+  if (targetStat?.isSymbolicLink()) {
+    throw new Error(
+      `${root.errorPrefix}: record path targets a symlink: ${relPath}`
+    );
+  }
+  await assertRealpathInsideRoot(
+    root.real,
+    targetAbs,
+    relPath,
+    root.errorPrefix
+  );
+  return targetAbs;
+}
+function isPathInsideRoot(rootReal, absPath) {
+  const rel = path.relative(rootReal, absPath);
+  if (rel === "") return true;
+  if (rel === "..") return false;
+  if (rel.startsWith(`..${path.sep}`)) return false;
+  if (path.isAbsolute(rel)) return false;
+  return true;
+}
+async function assertIsDirectoryNotSymlink(absPath, errorPrefix, argName) {
+  const st = await stat(absPath).catch(() => null);
+  if (!st || !st.isDirectory()) {
+    throw new Error(
+      `${errorPrefix}: '${argName}' must be an existing directory: ${absPath}`
+    );
+  }
+  const lst = await lstat(absPath).catch(() => null);
+  if (lst && lst.isSymbolicLink()) {
+    throw new Error(
+      `${errorPrefix}: '${argName}' must not be a symlink \u2014 resolve it to its real path first: ${absPath}`
+    );
+  }
+}
+async function assertRealpathInsideRoot(rootReal, targetAbs, sourcePath, errorPrefix) {
+  let existing = targetAbs;
+  const suffix = [];
+  while (existing !== path.dirname(existing)) {
+    const st = await lstat(existing).catch(() => null);
+    if (st !== null) break;
+    suffix.unshift(path.basename(existing));
+    existing = path.dirname(existing);
+  }
+  const existingReal = await realpath(existing).catch(() => existing);
+  const targetReal = suffix.length > 0 ? path.join(existingReal, ...suffix) : existingReal;
+  if (!isPathInsideRoot(rootReal, targetReal)) {
+    throw new Error(
+      `${errorPrefix}: record path escapes target root via symlink: ${sourcePath}`
+    );
+  }
+}
+
+export {
+  sha256File,
+  sha256Bytes,
+  sha256String,
+  readUtf8FileStrict,
+  writeJsonFile,
+  readJsonFile,
+  listFilesRecursive,
+  ensureDirExists,
+  fileExists,
+  toPosixRelPath,
+  fromPosixRelPath,
+  prepareSafeArchiveRoot,
+  validateArchiveRelativePath,
+  resolveSafeArchiveTarget,
+  isPathInsideRoot,
+  assertIsDirectoryNotSymlink,
+  assertRealpathInsideRoot
+};
+//# sourceMappingURL=chunk-AGZQD76C.js.map

package/dist/chunk-AGZQD76C.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/transfer/fs-utils.ts"],"sourcesContent":["import { createHash } from \"node:crypto\";\nimport {\n  lstat,\n  mkdir,\n  readdir,\n  readFile,\n  realpath,\n  stat,\n  writeFile,\n} from \"node:fs/promises\";\nimport path from \"node:path\";\n\nconst fatalUtf8Decoder = new TextDecoder(\"utf-8\", { fatal: true, ignoreBOM: true });\n\nexport async function sha256File(filePath: string): Promise<{ sha256: string; bytes: number }> {\n  const buf = await readFile(filePath);\n  const sha256 = createHash(\"sha256\").update(buf).digest(\"hex\");\n  return { sha256, bytes: buf.byteLength };\n}\n\nexport function sha256Bytes(content: Uint8Array): { sha256: string; bytes: number } {\n  const buf = Buffer.from(content);\n  const sha256 = createHash(\"sha256\").update(buf).digest(\"hex\");\n  return { sha256, bytes: buf.byteLength };\n}\n\nexport function sha256String(content: string): { sha256: string; bytes: number } {\n  return sha256Bytes(Buffer.from(content, \"utf-8\"));\n}\n\nexport async function readUtf8FileStrict(filePath: string): Promise<{ content: string; sha256: string; bytes: number }> {\n  const buf = await readFile(filePath);\n  let content: string;\n  try {\n    content = fatalUtf8Decoder.decode(buf);\n  } catch {\n    throw new Error(`transfer export requires UTF-8 text files: ${filePath}`);\n  }\n  return { content, ...sha256Bytes(buf) };\n}\n\nexport async function writeJsonFile(filePath: string, value: unknown): Promise<void> {\n  await mkdir(path.dirname(filePath), { recursive: true });\n  await writeFile(filePath, JSON.stringify(value, null, 2) + \"\\n\", \"utf-8\");\n}\n\nexport async function readJsonFile<T>(filePath: string): Promise<T> {\n  const raw = await readFile(filePath, \"utf-8\");\n  return JSON.parse(raw) as T;\n}\n\nexport async function listFilesRecursive(rootDir: string): Promise<string[]> {\n  const out: string[] = [];\n  async function walk(dir: string): Promise<void> {\n    const entries = await readdir(dir, { withFileTypes: true });\n    for (const ent of entries) {\n      const fp = path.join(dir, ent.name);\n      if (ent.isDirectory()) {\n        await walk(fp);\n      } else if (ent.isFile()) {\n        out.push(fp);\n      }\n    }\n  }\n  await walk(rootDir);\n  return out.sort();\n}\n\nexport async function ensureDirExists(dirPath: string): Promise<void> {\n  await mkdir(dirPath, { recursive: true });\n}\n\nexport async function fileExists(filePath: string): Promise<boolean> {\n  try {\n    await stat(filePath);\n    return true;\n  } catch {\n    return false;\n  }\n}\n\nexport function toPosixRelPath(absPath: string, rootDir: string): string {\n  const rel = path.relative(rootDir, absPath);\n  // normalize to posix for portability across platforms\n  return rel.split(path.sep).join(\"/\");\n}\n\nexport function fromPosixRelPath(relPath: string): string {\n  return relPath.split(\"/\").join(path.sep);\n}\n\nexport interface SafeArchiveRoot {\n  abs: string;\n  real: string;\n  errorPrefix: string;\n  argName: string;\n}\n\nexport async function prepareSafeArchiveRoot(\n  absPath: string,\n  errorPrefix: string,\n  argName: string,\n): Promise<SafeArchiveRoot> {\n  const rootAbs = path.resolve(absPath);\n  await assertIsDirectoryNotSymlink(rootAbs, errorPrefix, argName);\n  return {\n    abs: rootAbs,\n    real: await realpath(rootAbs),\n    errorPrefix,\n    argName,\n  };\n}\n\nexport function validateArchiveRelativePath(\n  relPath: string,\n  errorPrefix: string,\n): string {\n  if (relPath.length === 0) {\n    throw new Error(`${errorPrefix}: record path must not be empty`);\n  }\n  if (relPath.includes(\"\\\\\")) {\n    throw new Error(\n      `${errorPrefix}: record path must use POSIX separators: ${relPath}`,\n    );\n  }\n  if (path.posix.isAbsolute(relPath)) {\n    throw new Error(\n      `${errorPrefix}: record path must be relative: ${relPath}`,\n    );\n  }\n\n  const segments = relPath.split(\"/\");\n  if (segments.some((segment) => segment === \"\" || segment === \".\" || segment === \"..\")) {\n    throw new Error(\n      `${errorPrefix}: record path contains unsafe segments: ${relPath}`,\n    );\n  }\n\n  const normalized = path.posix.normalize(relPath);\n  if (\n    normalized === \".\" ||\n    normalized === \"..\" ||\n    normalized.startsWith(\"../\") ||\n    path.posix.isAbsolute(normalized)\n  ) {\n    throw new Error(\n      `${errorPrefix}: record path escapes target root: ${relPath}`,\n    );\n  }\n\n  return normalized;\n}\n\nexport async function resolveSafeArchiveTarget(\n  root: SafeArchiveRoot,\n  relPath: string,\n): Promise<string> {\n  const safeRelPath = validateArchiveRelativePath(relPath, root.errorPrefix);\n  const targetAbs = path.resolve(root.abs, fromPosixRelPath(safeRelPath));\n  if (!isPathInsideRoot(root.abs, targetAbs)) {\n    throw new Error(\n      `${root.errorPrefix}: record path escapes target root: ${relPath}`,\n    );\n  }\n\n  const targetStat = await lstat(targetAbs).catch((error: unknown) => {\n    if ((error as NodeJS.ErrnoException).code === \"ENOENT\") return null;\n    throw error;\n  });\n  if (targetStat?.isSymbolicLink()) {\n    throw new Error(\n      `${root.errorPrefix}: record path targets a symlink: ${relPath}`,\n    );\n  }\n\n  await assertRealpathInsideRoot(\n    root.real,\n    targetAbs,\n    relPath,\n    root.errorPrefix,\n  );\n  return targetAbs;\n}\n\n// ---------------------------------------------------------------------------\n// Shared path-safety helpers (used by capsule-import, capsule-merge, and\n// capsule-fork).\n//\n// These helpers are security-critical (path-traversal and symlink-bypass\n// guards), so any future fix must apply uniformly. The `errorPrefix` and\n// `argName` arguments let each caller surface module-specific error messages\n// (\"importCapsule:\" vs \"mergeCapsule:\" vs \"forkCapsule:\") without forking the\n// implementation.\n// ---------------------------------------------------------------------------\n\n/**\n * Return true when {@link absPath} is the same as {@link rootReal} or a\n * descendant. {@link rootReal} should be the value returned by\n * `realpath(rootAbs)` so that symlinked subdirectories are detected.\n */\nexport function isPathInsideRoot(rootReal: string, absPath: string): boolean {\n  const rel = path.relative(rootReal, absPath);\n  if (rel === \"\") return true;\n  if (rel === \"..\") return false;\n  if (rel.startsWith(`..${path.sep}`)) return false;\n  if (path.isAbsolute(rel)) return false;\n  return true;\n}\n\n/**\n * Assert that {@link absPath} is an existing directory and is not itself a\n * symlink. `existsSync` returns true for files (gotcha #24); a stat-based\n * check is required. Symlinked roots are rejected up-front so an attacker\n * cannot hand the importer a `~/import-target` link → `/etc` and have writes\n * silently follow the link (Codex P1 round 5 thread on PR #741).\n */\nexport async function assertIsDirectoryNotSymlink(\n  absPath: string,\n  errorPrefix: string,\n  argName: string,\n): Promise<void> {\n  const st = await stat(absPath).catch(() => null);\n  if (!st || !st.isDirectory()) {\n    throw new Error(\n      `${errorPrefix}: '${argName}' must be an existing directory: ${absPath}`,\n    );\n  }\n  const lst = await lstat(absPath).catch(() => null);\n  if (lst && lst.isSymbolicLink()) {\n    throw new Error(\n      `${errorPrefix}: '${argName}' must not be a symlink — resolve it to its real path first: ${absPath}`,\n    );\n  }\n}\n\n/**\n * Walk upward from {@link targetAbs} to find the nearest existing ancestor,\n * resolve it via `fs.realpath` (which follows symlinks), then re-append the\n * remaining suffix and verify the result is inside {@link rootReal}.\n *\n * This catches the case where an existing subdirectory at any point in the\n * path is a symlink that points outside the intended root. Because the file\n * does not exist yet we cannot realpath it directly; we resolve the deepest\n * existing prefix and re-apply the non-existent suffix. Callers must ensure\n * {@link rootReal} was already resolved via `realpath`.\n */\nexport async function assertRealpathInsideRoot(\n  rootReal: string,\n  targetAbs: string,\n  sourcePath: string,\n  errorPrefix: string,\n): Promise<void> {\n  let existing = targetAbs;\n  const suffix: string[] = [];\n  while (existing !== path.dirname(existing)) {\n    const st = await lstat(existing).catch(() => null);\n    if (st !== null) break;\n    suffix.unshift(path.basename(existing));\n    existing = path.dirname(existing);\n  }\n  const existingReal = await realpath(existing).catch(() => existing);\n  const targetReal =\n    suffix.length > 0 ? path.join(existingReal, ...suffix) : existingReal;\n  if (!isPathInsideRoot(rootReal, targetReal)) {\n    throw new Error(\n      `${errorPrefix}: record path escapes target root via symlink: ${sourcePath}`,\n    );\n  }\n}\n"],"mappings":";AAAA,SAAS,kBAAkB;AAC3B;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OACK;AACP,OAAO,UAAU;AAEjB,IAAM,mBAAmB,IAAI,YAAY,SAAS,EAAE,OAAO,MAAM,WAAW,KAAK,CAAC;AAElF,eAAsB,WAAW,UAA8D;AAC7F,QAAM,MAAM,MAAM,SAAS,QAAQ;AACnC,QAAM,SAAS,WAAW,QAAQ,EAAE,OAAO,GAAG,EAAE,OAAO,KAAK;AAC5D,SAAO,EAAE,QAAQ,OAAO,IAAI,WAAW;AACzC;AAEO,SAAS,YAAY,SAAwD;AAClF,QAAM,MAAM,OAAO,KAAK,OAAO;AAC/B,QAAM,SAAS,WAAW,QAAQ,EAAE,OAAO,GAAG,EAAE,OAAO,KAAK;AAC5D,SAAO,EAAE,QAAQ,OAAO,IAAI,WAAW;AACzC;AAEO,SAAS,aAAa,SAAoD;AAC/E,SAAO,YAAY,OAAO,KAAK,SAAS,OAAO,CAAC;AAClD;AAEA,eAAsB,mBAAmB,UAA+E;AACtH,QAAM,MAAM,MAAM,SAAS,QAAQ;AACnC,MAAI;AACJ,MAAI;AACF,cAAU,iBAAiB,OAAO,GAAG;AAAA,EACvC,QAAQ;AACN,UAAM,IAAI,MAAM,8CAA8C,QAAQ,EAAE;AAAA,EAC1E;AACA,SAAO,EAAE,SAAS,GAAG,YAAY,GAAG,EAAE;AACxC;AAEA,eAAsB,cAAc,UAAkB,OAA+B;AACnF,QAAM,MAAM,KAAK,QAAQ,QAAQ,GAAG,EAAE,WAAW,KAAK,CAAC;AACvD,QAAM,UAAU,UAAU,KAAK,UAAU,OAAO,MAAM,CAAC,IAAI,MAAM,OAAO;AAC1E;AAEA,eAAsB,aAAgB,UAA8B;AAClE,QAAM,MAAM,MAAM,SAAS,UAAU,OAAO;AAC5C,SAAO,KAAK,MAAM,GAAG;AACvB;AAEA,eAAsB,mBAAmB,SAAoC;AAC3E,QAAM,MAAgB,CAAC;AACvB,iBAAe,KAAK,KAA4B;AAC9C,UAAM,UAAU,MAAM,QAAQ,KAAK,EAAE,eAAe,KAAK,CAAC;AAC1D,eAAW,OAAO,SAAS;AACzB,YAAM,KAAK,KAAK,KAAK,KAAK,IAAI,IAAI;AAClC,UAAI,IAAI,YAAY,GAAG;AACrB,cAAM,KAAK,EAAE;AAAA,MACf,WAAW,IAAI,OAAO,GAAG;AACvB,YAAI,KAAK,EAAE;AAAA,MACb;AAAA,IACF;AAAA,EACF;AACA,QAAM,KAAK,OAAO;AAClB,SAAO,IAAI,KAAK;AAClB;AAEA,eAAsB,gBAAgB,SAAgC;AACpE,QAAM,MAAM,SAAS,EAAE,WAAW,KAAK,CAAC;AAC1C;AAEA,eAAsB,WAAW,UAAoC;AACnE,MAAI;AACF,UAAM,KAAK,QAAQ;AACnB,WAAO;AAAA,EACT,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAEO,SAAS,eAAe,SAAiB,SAAyB;AACvE,QAAM,MAAM,KAAK,SAAS,SAAS,OAAO;AAE1C,SAAO,IAAI,MAAM,KAAK,GAAG,EAAE,KAAK,GAAG;AACrC;AAEO,SAAS,iBAAiB,SAAyB;AACxD,SAAO,QAAQ,MAAM,GAAG,EAAE,KAAK,KAAK,GAAG;AACzC;AASA,eAAsB,uBACpB,SACA,aACA,SAC0B;AAC1B,QAAM,UAAU,KAAK,QAAQ,OAAO;AACpC,QAAM,4BAA4B,SAAS,aAAa,OAAO;AAC/D,SAAO;AAAA,IACL,KAAK;AAAA,IACL,MAAM,MAAM,SAAS,OAAO;AAAA,IAC5B;AAAA,IACA;AAAA,EACF;AACF;AAEO,SAAS,4BACd,SACA,aACQ;AACR,MAAI,QAAQ,WAAW,GAAG;AACxB,UAAM,IAAI,MAAM,GAAG,WAAW,iCAAiC;AAAA,EACjE;AACA,MAAI,QAAQ,SAAS,IAAI,GAAG;AAC1B,UAAM,IAAI;AAAA,MACR,GAAG,WAAW,4CAA4C,OAAO;AAAA,IACnE;AAAA,EACF;AACA,MAAI,KAAK,MAAM,WAAW,OAAO,GAAG;AAClC,UAAM,IAAI;AAAA,MACR,GAAG,WAAW,mCAAmC,OAAO;AAAA,IAC1D;AAAA,EACF;AAEA,QAAM,WAAW,QAAQ,MAAM,GAAG;AAClC,MAAI,SAAS,KAAK,CAAC,YAAY,YAAY,MAAM,YAAY,OAAO,YAAY,IAAI,GAAG;AACrF,UAAM,IAAI;AAAA,MACR,GAAG,WAAW,2CAA2C,OAAO;AAAA,IAClE;AAAA,EACF;AAEA,QAAM,aAAa,KAAK,MAAM,UAAU,OAAO;AAC/C,MACE,eAAe,OACf,eAAe,QACf,WAAW,WAAW,KAAK,KAC3B,KAAK,MAAM,WAAW,UAAU,GAChC;AACA,UAAM,IAAI;AAAA,MACR,GAAG,WAAW,sCAAsC,OAAO;AAAA,IAC7D;AAAA,EACF;AAEA,SAAO;AACT;AAEA,eAAsB,yBACpB,MACA,SACiB;AACjB,QAAM,cAAc,4BAA4B,SAAS,KAAK,WAAW;AACzE,QAAM,YAAY,KAAK,QAAQ,KAAK,KAAK,iBAAiB,WAAW,CAAC;AACtE,MAAI,CAAC,iBAAiB,KAAK,KAAK,SAAS,GAAG;AAC1C,UAAM,IAAI;AAAA,MACR,GAAG,KAAK,WAAW,sCAAsC,OAAO;AAAA,IAClE;AAAA,EACF;AAEA,QAAM,aAAa,MAAM,MAAM,SAAS,EAAE,MAAM,CAAC,UAAmB;AAClE,QAAK,MAAgC,SAAS,SAAU,QAAO;AAC/D,UAAM;AAAA,EACR,CAAC;AACD,MAAI,YAAY,eAAe,GAAG;AAChC,UAAM,IAAI;AAAA,MACR,GAAG,KAAK,WAAW,oCAAoC,OAAO;AAAA,IAChE;AAAA,EACF;AAEA,QAAM;AAAA,IACJ,KAAK;AAAA,IACL;AAAA,IACA;AAAA,IACA,KAAK;AAAA,EACP;AACA,SAAO;AACT;AAkBO,SAAS,iBAAiB,UAAkB,SAA0B;AAC3E,QAAM,MAAM,KAAK,SAAS,UAAU,OAAO;AAC3C,MAAI,QAAQ,GAAI,QAAO;AACvB,MAAI,QAAQ,KAAM,QAAO;AACzB,MAAI,IAAI,WAAW,KAAK,KAAK,GAAG,EAAE,EAAG,QAAO;AAC5C,MAAI,KAAK,WAAW,GAAG,EAAG,QAAO;AACjC,SAAO;AACT;AASA,eAAsB,4BACpB,SACA,aACA,SACe;AACf,QAAM,KAAK,MAAM,KAAK,OAAO,EAAE,MAAM,MAAM,IAAI;AAC/C,MAAI,CAAC,MAAM,CAAC,GAAG,YAAY,GAAG;AAC5B,UAAM,IAAI;AAAA,MACR,GAAG,WAAW,MAAM,OAAO,oCAAoC,OAAO;AAAA,IACxE;AAAA,EACF;AACA,QAAM,MAAM,MAAM,MAAM,OAAO,EAAE,MAAM,MAAM,IAAI;AACjD,MAAI,OAAO,IAAI,eAAe,GAAG;AAC/B,UAAM,IAAI;AAAA,MACR,GAAG,WAAW,MAAM,OAAO,qEAAgE,OAAO;AAAA,IACpG;AAAA,EACF;AACF;AAaA,eAAsB,yBACpB,UACA,WACA,YACA,aACe;AACf,MAAI,WAAW;AACf,QAAM,SAAmB,CAAC;AAC1B,SAAO,aAAa,KAAK,QAAQ,QAAQ,GAAG;AAC1C,UAAM,KAAK,MAAM,MAAM,QAAQ,EAAE,MAAM,MAAM,IAAI;AACjD,QAAI,OAAO,KAAM;AACjB,WAAO,QAAQ,KAAK,SAAS,QAAQ,CAAC;AACtC,eAAW,KAAK,QAAQ,QAAQ;AAAA,EAClC;AACA,QAAM,eAAe,MAAM,SAAS,QAAQ,EAAE,MAAM,MAAM,QAAQ;AAClE,QAAM,aACJ,OAAO,SAAS,IAAI,KAAK,KAAK,cAAc,GAAG,MAAM,IAAI;AAC3D,MAAI,CAAC,iBAAiB,UAAU,UAAU,GAAG;AAC3C,UAAM,IAAI;AAAA,MACR,GAAG,WAAW,kDAAkD,UAAU;AAAA,IAC5E;AAAA,EACF;AACF;","names":[]}