@rpamis/comet 0.3.9 → 0.4.0-beta.10

package/dist/domains/workflow-contract/validation.js

@@ -0,0 +1,189 @@
+import { BUILTIN_COMET_NATIVE_OUTPUT_SCHEMAS, BUILTIN_COMET_OUTPUT_SCHEMAS, COMET_FIVE_PHASE_NODES, COMET_NATIVE_NODES, } from './builtins.js';
+function templatesFor(input) {
+    if (input.kind === 'comet-five-phase-overlay') {
+        return [...COMET_FIVE_PHASE_NODES, ...(input.customNodes ?? [])];
+    }
+    if (input.kind === 'comet-native') {
+        return [...COMET_NATIVE_NODES, ...(input.customNodes ?? [])];
+    }
+    return input.customNodes ?? [];
+}
+function schemaIdsFor(input) {
+    const schemas = input.kind === 'comet-five-phase-overlay'
+        ? BUILTIN_COMET_OUTPUT_SCHEMAS
+        : input.kind === 'comet-native'
+            ? BUILTIN_COMET_NATIVE_OUTPUT_SCHEMAS
+            : [];
+    return new Set([...schemas, ...(input.outputSchemas ?? [])].map((schema) => schema.id));
+}
+function uniqueTemplates(templates) {
+    const byId = new Map();
+    const findings = [];
+    for (const template of templates) {
+        if (byId.has(template.id)) {
+            findings.push({
+                code: 'duplicate-node',
+                nodeId: template.id,
+                message: `${template.id}: duplicate Workflow Node definition`,
+            });
+            continue;
+        }
+        byId.set(template.id, template);
+    }
+    return { byId, findings };
+}
+function validateBindingOperation(options) {
+    if (options.operation === 'default')
+        return;
+    if (options.node.operations.includes(options.operation))
+        return;
+    options.findings.push({
+        code: 'unsupported-operation',
+        nodeId: options.node.id,
+        skill: options.skill,
+        message: `${options.node.id}: ${options.label} cannot use ${options.operation}`,
+    });
+}
+export function validateWorkflowDefinition(input) {
+    const { byId, findings } = uniqueTemplates(templatesFor(input));
+    const schemaIds = schemaIdsFor(input);
+    for (const template of byId.values()) {
+        validateBindingOperation({
+            findings,
+            node: template,
+            skill: template.implementation.skill,
+            operation: template.implementation.operation,
+            label: 'implementation',
+        });
+        for (const binding of template.requiredSkillCalls ?? []) {
+            validateBindingOperation({
+                findings,
+                node: template,
+                skill: binding.skill,
+                operation: binding.operation ?? 'require',
+                label: 'required Skill call',
+            });
+        }
+        for (const binding of template.augmentations ?? []) {
+            validateBindingOperation({
+                findings,
+                node: template,
+                skill: binding.skill,
+                operation: binding.operation ?? 'augment',
+                label: 'augmentation',
+            });
+        }
+    }
+    for (const [nodeId, patch] of Object.entries(input.nodes ?? {})) {
+        const template = byId.get(nodeId);
+        if (!template) {
+            findings.push({
+                code: 'unknown-node',
+                nodeId,
+                message: `${nodeId}: unknown Workflow Node for ${input.kind}`,
+            });
+            continue;
+        }
+        if (patch.disabled && !template.optional) {
+            findings.push({
+                code: 'disabled-required-node',
+                nodeId,
+                message: `${nodeId}: required Workflow Node cannot be disabled`,
+            });
+        }
+        if (patch.implementation) {
+            const operation = patch.implementation.operation ?? 'override';
+            if (operation !== 'default' && !template.operations.includes(operation)) {
+                findings.push({
+                    code: 'unsupported-operation',
+                    nodeId,
+                    skill: patch.implementation.skill,
+                    message: `${nodeId}: ${template.kind} Node does not support ${operation}`,
+                });
+            }
+            if (template.kind === 'control' && operation === 'override') {
+                findings.push({
+                    code: 'control-node-override',
+                    nodeId,
+                    skill: patch.implementation.skill,
+                    message: `${nodeId}: control Node cannot use override in ordinary mode`,
+                });
+            }
+            if (template.kind === 'producer' && operation === 'override') {
+                const missing = template.outputSchemas.filter((schema) => !(patch.satisfies ?? []).includes(schema));
+                if (missing.length > 0) {
+                    findings.push({
+                        code: 'producer-missing-output-schema',
+                        nodeId,
+                        skill: patch.implementation.skill,
+                        message: `${nodeId}: producer override must satisfy Output Schema ${missing.join(', ')}`,
+                    });
+                }
+            }
+        }
+        for (const binding of patch.requiredSkillCalls ?? []) {
+            validateBindingOperation({
+                findings,
+                node: template,
+                skill: binding.skill,
+                operation: binding.operation ?? 'require',
+                label: 'required Skill call',
+            });
+        }
+        for (const binding of patch.augmentations ?? []) {
+            validateBindingOperation({
+                findings,
+                node: template,
+                skill: binding.skill,
+                operation: binding.operation ?? 'augment',
+                label: 'augmentation',
+            });
+        }
+        for (const schema of patch.outputSchemas ?? []) {
+            if (!schemaIds.has(schema)) {
+                findings.push({
+                    code: 'missing-output-schema',
+                    nodeId,
+                    message: `${nodeId}: Output Schema ${schema} is not defined`,
+                });
+            }
+        }
+    }
+    for (const template of byId.values()) {
+        for (const schema of template.outputSchemas) {
+            if (!schemaIds.has(schema)) {
+                findings.push({
+                    code: 'missing-output-schema',
+                    nodeId: template.id,
+                    message: `${template.id}: Output Schema ${schema} is not defined`,
+                });
+            }
+        }
+    }
+    const attachedSchemas = new Set();
+    for (const template of byId.values()) {
+        for (const schema of template.outputSchemas)
+            attachedSchemas.add(schema);
+    }
+    for (const [nodeId, patch] of Object.entries(input.nodes ?? {})) {
+        if (!byId.has(nodeId))
+            continue;
+        for (const schema of patch.outputSchemas ?? [])
+            attachedSchemas.add(schema);
+    }
+    const builtinSchemas = new Set((input.kind === 'comet-five-phase-overlay'
+        ? BUILTIN_COMET_OUTPUT_SCHEMAS
+        : input.kind === 'comet-native'
+            ? BUILTIN_COMET_NATIVE_OUTPUT_SCHEMAS
+            : []).map((schema) => schema.id));
+    for (const schema of input.outputSchemas ?? []) {
+        if (!builtinSchemas.has(schema.id) && !attachedSchemas.has(schema.id)) {
+            findings.push({
+                code: 'orphan-output-schema',
+                message: `Output Schema ${schema.id} is defined but not attached to any Workflow Node`,
+            });
+        }
+    }
+    return { valid: findings.length === 0, findings };
+}
+//# sourceMappingURL=validation.js.map

package/dist/domains/workflow-contract/validation.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"validation.js","sourceRoot":"","sources":["../../../domains/workflow-contract/validation.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,mCAAmC,EACnC,4BAA4B,EAC5B,sBAAsB,EACtB,kBAAkB,GACnB,MAAM,eAAe,CAAC;AASvB,SAAS,YAAY,CAAC,KAA8B;IAClD,IAAI,KAAK,CAAC,IAAI,KAAK,0BAA0B,EAAE,CAAC;QAC9C,OAAO,CAAC,GAAG,sBAAsB,EAAE,GAAG,CAAC,KAAK,CAAC,WAAW,IAAI,EAAE,CAAC,CAAC,CAAC;IACnE,CAAC;IACD,IAAI,KAAK,CAAC,IAAI,KAAK,cAAc,EAAE,CAAC;QAClC,OAAO,CAAC,GAAG,kBAAkB,EAAE,GAAG,CAAC,KAAK,CAAC,WAAW,IAAI,EAAE,CAAC,CAAC,CAAC;IAC/D,CAAC;IACD,OAAO,KAAK,CAAC,WAAW,IAAI,EAAE,CAAC;AACjC,CAAC;AAED,SAAS,YAAY,CAAC,KAA8B;IAClD,MAAM,OAAO,GACX,KAAK,CAAC,IAAI,KAAK,0BAA0B;QACvC,CAAC,CAAC,4BAA4B;QAC9B,CAAC,CAAC,KAAK,CAAC,IAAI,KAAK,cAAc;YAC7B,CAAC,CAAC,mCAAmC;YACrC,CAAC,CAAC,EAAE,CAAC;IACX,OAAO,IAAI,GAAG,CAAC,CAAC,GAAG,OAAO,EAAE,GAAG,CAAC,KAAK,CAAC,aAAa,IAAI,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC;AAC1F,CAAC;AAED,SAAS,eAAe,CAAC,SAAiC;IAIxD,MAAM,IAAI,GAAG,IAAI,GAAG,EAAgC,CAAC;IACrD,MAAM,QAAQ,GAAgC,EAAE,CAAC;IACjD,KAAK,MAAM,QAAQ,IAAI,SAAS,EAAE,CAAC;QACjC,IAAI,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC,EAAE,CAAC;YAC1B,QAAQ,CAAC,IAAI,CAAC;gBACZ,IAAI,EAAE,gBAAgB;gBACtB,MAAM,EAAE,QAAQ,CAAC,EAAE;gBACnB,OAAO,EAAE,GAAG,QAAQ,CAAC,EAAE,sCAAsC;aAC9D,CAAC,CAAC;YACH,SAAS;QACX,CAAC;QACD,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,EAAE,QAAQ,CAAC,CAAC;IAClC,CAAC;IACD,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC;AAC5B,CAAC;AAED,SAAS,wBAAwB,CAAC,OAMjC;IACC,IAAI,OAAO,CAAC,SAAS,KAAK,SAAS;QAAE,OAAO;IAC5C,IAAI,OAAO,CAAC,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,OAAO,CAAC,SAAS,CAAC;QAAE,OAAO;IAChE,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC;QACpB,IAAI,EAAE,uBAAuB;QAC7B,MAAM,EAAE,OAAO,CAAC,IAAI,CAAC,EAAE;QACvB,KAAK,EAAE,OAAO,CAAC,KAAK;QACpB,OAAO,EAAE,GAAG,OAAO,CAAC,IAAI,CAAC,EAAE,KAAK,OAAO,CAAC,KAAK,eAAe,OAAO,CAAC,SAAS,EAAE;KAChF,CAAC,CAAC;AACL,CAAC;AAED,MAAM,UAAU,0BAA0B,CACxC,KAA8B;IAE9B,MAAM,EAAE,IAAI,EAAE,QAAQ,EAAE,GAAG,eAAe,CAAC,YAAY,CAAC,KAAK,CAAC,CAAC,CAAC;IAChE,MAAM,SAAS,GAAG,YAAY,CAAC,KAAK,CAAC,CAAC;IAEtC,KAAK,MAAM,QAAQ,IAAI,IAAI,CAAC,MAAM,EAAE,EAAE,CAAC;QACrC,wBAAwB,CAAC;YACvB,QAAQ;YACR,IAAI,EAAE,QAAQ;YACd,KAAK,EAAE,QAAQ,CAAC,cAAc,CAAC,KAAK;YACpC,SAAS,EAAE,QAAQ,CAAC,cAAc,CAAC,SAAS;YAC5C,KAAK,EAAE,gBAAgB;SACxB,CAAC,CAAC;QACH,KAAK,MAAM,OAAO,IAAI,QAAQ,CAAC,kBAAkB,IAAI,EAAE,EAAE,CAAC;YACxD,wBAAwB,CAAC;gBACvB,QAAQ;gBACR,IAAI,EAAE,QAAQ;gBACd,KAAK,EAAE,OAAO,CAAC,KAAK;gBACpB,SAAS,EAAE,OAAO,CAAC,SAAS,IAAI,SAAS;gBACzC,KAAK,EAAE,qBAAqB;aAC7B,CAAC,CAAC;QACL,CAAC;QACD,KAAK,MAAM,OAAO,IAAI,QAAQ,CAAC,aAAa,IAAI,EAAE,EAAE,CAAC;YACnD,wBAAwB,CAAC;gBACvB,QAAQ;gBACR,IAAI,EAAE,QAAQ;gBACd,KAAK,EAAE,OAAO,CAAC,KAAK;gBACpB,SAAS,EAAE,OAAO,CAAC,SAAS,IAAI,SAAS;gBACzC,KAAK,EAAE,cAAc;aACtB,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED,KAAK,MAAM,CAAC,MAAM,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,KAAK,IAAI,EAAE,CAAC,EAAE,CAAC;QAChE,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QAClC,IAAI,CAAC,QAAQ,EAAE,CAAC;YACd,QAAQ,CAAC,IAAI,CAAC;gBACZ,IAAI,EAAE,cAAc;gBACpB,MAAM;gBACN,OAAO,EAAE,GAAG,MAAM,+BAA+B,KAAK,CAAC,IAAI,EAAE;aAC9D,CAAC,CAAC;YACH,SAAS;QACX,CAAC;QACD,IAAI,KAAK,CAAC,QAAQ,IAAI,CAAC,QAAQ,CAAC,QAAQ,EAAE,CAAC;YACzC,QAAQ,CAAC,IAAI,CAAC;gBACZ,IAAI,EAAE,wBAAwB;gBAC9B,MAAM;gBACN,OAAO,EAAE,GAAG,MAAM,6CAA6C;aAChE,CAAC,CAAC;QACL,CAAC;QACD,IAAI,KAAK,CAAC,cAAc,EAAE,CAAC;YACzB,MAAM,SAAS,GAAG,KAAK,CAAC,cAAc,CAAC,SAAS,IAAI,UAAU,CAAC;YAC/D,IAAI,SAAS,KAAK,SAAS,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC,QAAQ,CAAC,SAAS,CAAC,EAAE,CAAC;gBACxE,QAAQ,CAAC,IAAI,CAAC;oBACZ,IAAI,EAAE,uBAAuB;oBAC7B,MAAM;oBACN,KAAK,EAAE,KAAK,CAAC,cAAc,CAAC,KAAK;oBACjC,OAAO,EAAE,GAAG,MAAM,KAAK,QAAQ,CAAC,IAAI,0BAA0B,SAAS,EAAE;iBAC1E,CAAC,CAAC;YACL,CAAC;YACD,IAAI,QAAQ,CAAC,IAAI,KAAK,SAAS,IAAI,SAAS,KAAK,UAAU,EAAE,CAAC;gBAC5D,QAAQ,CAAC,IAAI,CAAC;oBACZ,IAAI,EAAE,uBAAuB;oBAC7B,MAAM;oBACN,KAAK,EAAE,KAAK,CAAC,cAAc,CAAC,KAAK;oBACjC,OAAO,EAAE,GAAG,MAAM,qDAAqD;iBACxE,CAAC,CAAC;YACL,CAAC;YACD,IAAI,QAAQ,CAAC,IAAI,KAAK,UAAU,IAAI,SAAS,KAAK,UAAU,EAAE,CAAC;gBAC7D,MAAM,OAAO,GAAG,QAAQ,CAAC,aAAa,CAAC,MAAM,CAC3C,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,SAAS,IAAI,EAAE,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CACtD,CAAC;gBACF,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;oBACvB,QAAQ,CAAC,IAAI,CAAC;wBACZ,IAAI,EAAE,gCAAgC;wBACtC,MAAM;wBACN,KAAK,EAAE,KAAK,CAAC,cAAc,CAAC,KAAK;wBACjC,OAAO,EAAE,GAAG,MAAM,kDAAkD,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE;qBACzF,CAAC,CAAC;gBACL,CAAC;YACH,CAAC;QACH,CAAC;QACD,KAAK,MAAM,OAAO,IAAI,KAAK,CAAC,kBAAkB,IAAI,EAAE,EAAE,CAAC;YACrD,wBAAwB,CAAC;gBACvB,QAAQ;gBACR,IAAI,EAAE,QAAQ;gBACd,KAAK,EAAE,OAAO,CAAC,KAAK;gBACpB,SAAS,EAAE,OAAO,CAAC,SAAS,IAAI,SAAS;gBACzC,KAAK,EAAE,qBAAqB;aAC7B,CAAC,CAAC;QACL,CAAC;QACD,KAAK,MAAM,OAAO,IAAI,KAAK,CAAC,aAAa,IAAI,EAAE,EAAE,CAAC;YAChD,wBAAwB,CAAC;gBACvB,QAAQ;gBACR,IAAI,EAAE,QAAQ;gBACd,KAAK,EAAE,OAAO,CAAC,KAAK;gBACpB,SAAS,EAAE,OAAO,CAAC,SAAS,IAAI,SAAS;gBACzC,KAAK,EAAE,cAAc;aACtB,CAAC,CAAC;QACL,CAAC;QACD,KAAK,MAAM,MAAM,IAAI,KAAK,CAAC,aAAa,IAAI,EAAE,EAAE,CAAC;YAC/C,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC;gBAC3B,QAAQ,CAAC,IAAI,CAAC;oBACZ,IAAI,EAAE,uBAAuB;oBAC7B,MAAM;oBACN,OAAO,EAAE,GAAG,MAAM,mBAAmB,MAAM,iBAAiB;iBAC7D,CAAC,CAAC;YACL,CAAC;QACH,CAAC;IACH,CAAC;IAED,KAAK,MAAM,QAAQ,IAAI,IAAI,CAAC,MAAM,EAAE,EAAE,CAAC;QACrC,KAAK,MAAM,MAAM,IAAI,QAAQ,CAAC,aAAa,EAAE,CAAC;YAC5C,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC;gBAC3B,QAAQ,CAAC,IAAI,CAAC;oBACZ,IAAI,EAAE,uBAAuB;oBAC7B,MAAM,EAAE,QAAQ,CAAC,EAAE;oBACnB,OAAO,EAAE,GAAG,QAAQ,CAAC,EAAE,mBAAmB,MAAM,iBAAiB;iBAClE,CAAC,CAAC;YACL,CAAC;QACH,CAAC;IACH,CAAC;IAED,MAAM,eAAe,GAAG,IAAI,GAAG,EAAU,CAAC;IAC1C,KAAK,MAAM,QAAQ,IAAI,IAAI,CAAC,MAAM,EAAE,EAAE,CAAC;QACrC,KAAK,MAAM,MAAM,IAAI,QAAQ,CAAC,aAAa;YAAE,eAAe,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;IAC3E,CAAC;IACD,KAAK,MAAM,CAAC,MAAM,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,KAAK,IAAI,EAAE,CAAC,EAAE,CAAC;QAChE,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC;YAAE,SAAS;QAChC,KAAK,MAAM,MAAM,IAAI,KAAK,CAAC,aAAa,IAAI,EAAE;YAAE,eAAe,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;IAC9E,CAAC;IACD,MAAM,cAAc,GAAG,IAAI,GAAG,CAC5B,CAAC,KAAK,CAAC,IAAI,KAAK,0BAA0B;QACxC,CAAC,CAAC,4BAA4B;QAC9B,CAAC,CAAC,KAAK,CAAC,IAAI,KAAK,cAAc;YAC7B,CAAC,CAAC,mCAAmC;YACrC,CAAC,CAAC,EAAE,CACP,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,EAAE,CAAC,CAC7B,CAAC;IACF,KAAK,MAAM,MAAM,IAAI,KAAK,CAAC,aAAa,IAAI,EAAE,EAAE,CAAC;QAC/C,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,EAAE,CAAC;YACtE,QAAQ,CAAC,IAAI,CAAC;gBACZ,IAAI,EAAE,sBAAsB;gBAC5B,OAAO,EAAE,iBAAiB,MAAM,CAAC,EAAE,mDAAmD;aACvF,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED,OAAO,EAAE,KAAK,EAAE,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE,QAAQ,EAAE,CAAC;AACpD,CAAC"}

package/dist/platform/fs/file-identity.d.ts

@@ -0,0 +1,9 @@
+export type FileIdentityScalar = number | bigint | string;
+export interface FileObjectIdentity {
+    dev: FileIdentityScalar;
+    ino: FileIdentityScalar;
+    birthtime: FileIdentityScalar;
+}
+export declare function hasComparableFileObject(left: FileObjectIdentity, right: FileObjectIdentity): boolean;
+export declare function sameFileObject(left: FileObjectIdentity, right: FileObjectIdentity): boolean;
+//# sourceMappingURL=file-identity.d.ts.map

package/dist/platform/fs/file-identity.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"file-identity.d.ts","sourceRoot":"","sources":["../../../platform/fs/file-identity.ts"],"names":[],"mappings":"AAAA,MAAM,MAAM,kBAAkB,GAAG,MAAM,GAAG,MAAM,GAAG,MAAM,CAAC;AAE1D,MAAM,WAAW,kBAAkB;IACjC,GAAG,EAAE,kBAAkB,CAAC;IACxB,GAAG,EAAE,kBAAkB,CAAC;IACxB,SAAS,EAAE,kBAAkB,CAAC;CAC/B;AAMD,wBAAgB,uBAAuB,CACrC,IAAI,EAAE,kBAAkB,EACxB,KAAK,EAAE,kBAAkB,GACxB,OAAO,CAOT;AAED,wBAAgB,cAAc,CAAC,IAAI,EAAE,kBAAkB,EAAE,KAAK,EAAE,kBAAkB,GAAG,OAAO,CAS3F"}

package/dist/platform/fs/file-identity.js

@@ -0,0 +1,21 @@
+function hasPlatformIdentity(value) {
+    return value !== 0 && value !== 0n && value !== '0';
+}
+export function hasComparableFileObject(left, right) {
+    return (hasPlatformIdentity(left.dev) &&
+        hasPlatformIdentity(right.dev) &&
+        hasPlatformIdentity(left.ino) &&
+        hasPlatformIdentity(right.ino));
+}
+export function sameFileObject(left, right) {
+    const comparableDevice = hasPlatformIdentity(left.dev) && hasPlatformIdentity(right.dev);
+    if (comparableDevice && left.dev !== right.dev)
+        return false;
+    const comparableInode = hasPlatformIdentity(left.ino) && hasPlatformIdentity(right.ino);
+    if (comparableInode && left.ino !== right.ino)
+        return false;
+    if (comparableDevice && comparableInode)
+        return true;
+    return left.birthtime === right.birthtime;
+}
+//# sourceMappingURL=file-identity.js.map

package/dist/platform/fs/file-identity.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"file-identity.js","sourceRoot":"","sources":["../../../platform/fs/file-identity.ts"],"names":[],"mappings":"AAQA,SAAS,mBAAmB,CAAC,KAAyB;IACpD,OAAO,KAAK,KAAK,CAAC,IAAI,KAAK,KAAK,EAAE,IAAI,KAAK,KAAK,GAAG,CAAC;AACtD,CAAC;AAED,MAAM,UAAU,uBAAuB,CACrC,IAAwB,EACxB,KAAyB;IAEzB,OAAO,CACL,mBAAmB,CAAC,IAAI,CAAC,GAAG,CAAC;QAC7B,mBAAmB,CAAC,KAAK,CAAC,GAAG,CAAC;QAC9B,mBAAmB,CAAC,IAAI,CAAC,GAAG,CAAC;QAC7B,mBAAmB,CAAC,KAAK,CAAC,GAAG,CAAC,CAC/B,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,cAAc,CAAC,IAAwB,EAAE,KAAyB;IAChF,MAAM,gBAAgB,GAAG,mBAAmB,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,mBAAmB,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IACzF,IAAI,gBAAgB,IAAI,IAAI,CAAC,GAAG,KAAK,KAAK,CAAC,GAAG;QAAE,OAAO,KAAK,CAAC;IAE7D,MAAM,eAAe,GAAG,mBAAmB,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,mBAAmB,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IACxF,IAAI,eAAe,IAAI,IAAI,CAAC,GAAG,KAAK,KAAK,CAAC,GAAG;QAAE,OAAO,KAAK,CAAC;IAE5D,IAAI,gBAAgB,IAAI,eAAe;QAAE,OAAO,IAAI,CAAC;IACrD,OAAO,IAAI,CAAC,SAAS,KAAK,KAAK,CAAC,SAAS,CAAC;AAC5C,CAAC"}

package/dist/{utils → platform/fs}/file-system.d.ts

@@ -40,9 +40,9 @@ export declare function removeFile(filePath: string): Promise<boolean>;
  */
 export declare function removeDir(dirPath: string): Promise<boolean>;
 /**
- * Check if a directory is empty. A missing directory is treated as empty;
- * unreadable directories (permissions/IO) return false so callers never delete
- * a directory they could not inspect.
+ * Check if a directory is empty. A missing directory is treated as empty and
+ * a non-directory path as non-empty; inspection failures are propagated so
+ * callers can report that cleanup was incomplete.
  */
 export declare function isDirEmpty(dirPath: string): Promise<boolean>;
 //# sourceMappingURL=file-system.d.ts.map

package/dist/platform/fs/file-system.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"file-system.d.ts","sourceRoot":"","sources":["../../../platform/fs/file-system.ts"],"names":[],"mappings":"AAiCA;;;GAGG;AACH,wBAAsB,SAAS,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAG1D;AAED;;;;;GAKG;AACH,wBAAsB,QAAQ,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAIvE;AAED;;GAEG;AACH,wBAAsB,UAAU,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAQnE;AAED;;GAEG;AACH,wBAAsB,QAAQ,CAAC,CAAC,GAAG,OAAO,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,CAAC,CAAC,CAGxE;AAED;;;GAGG;AACH,wBAAsB,SAAS,CAAC,QAAQ,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAIhF;AAED;;GAEG;AACH,wBAAsB,OAAO,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,CAWhE;AAgBD;;;;GAIG;AACH,wBAAsB,UAAU,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAQnE;AAED;;;;GAIG;AACH,wBAAsB,SAAS,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAcjE;AAED;;;;GAIG;AACH,wBAAsB,UAAU,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAUlE"}

package/dist/{utils → platform/fs}/file-system.js

@@ -56,8 +56,10 @@ export async function fileExists(filePath) {
         await fs.access(filePath);
         return true;
     }
-    catch {
-        return false;
+    catch (error) {
+        if (isMissingPathError(error))
+            return false;
+        throw error;
     }
 }
 /**
@@ -92,13 +94,17 @@ export async function readDir(dirPath) {
     }
 }
 /**
- * Returns true when an error means the path was simply not found. ENOENT is
- * the only non-fatal outcome for the removal helpers below; all other errors
- * (permissions, IO) are reported as failures instead of being masked as
- * "already gone".
+ * Returns true when an error means a path lookup found a file where it
+ * expected to be able to descend into a directory (ENOTDIR) — e.g. a stray
+ * `.DS_Store` sitting where a plugin marketplace directory was expected —
+ * treated the same as the path simply not being there (ENOENT). Only for
+ * read-only existence checks: a removal call hitting ENOTDIR means the
+ * on-disk shape is not what the caller expected, which is a real anomaly
+ * worth surfacing rather than masking as "already gone".
  */
-function isNotFoundError(error) {
-    return error?.code === 'ENOENT';
+function isMissingPathError(error) {
+    const code = error?.code;
+    return code === 'ENOENT' || code === 'ENOTDIR';
 }
 /**
  * Remove a file. Returns true if the file existed and was removed.
@@ -110,9 +116,10 @@ export async function removeFile(filePath) {
         await fs.unlink(filePath);
         return true;
     }
-    catch {
-        // Not found or failed (permissions/IO): nothing was removed.
-        return false;
+    catch (error) {
+        if (error?.code === 'ENOENT')
+            return false;
+        throw error;
     }
 }
 /**
@@ -128,17 +135,19 @@ export async function removeDir(dirPath) {
             await fs.unlink(dirPath);
             return true;
         }
-        await fs.rm(dirPath, { recursive: true, force: true });
+        await fs.rm(dirPath, { recursive: true, force: false });
         return true;
     }
     catch (error) {
-        return isNotFoundError(error);
+        if (error?.code === 'ENOENT')
+            return false;
+        throw error;
     }
 }
 /**
- * Check if a directory is empty. A missing directory is treated as empty;
- * unreadable directories (permissions/IO) return false so callers never delete
- * a directory they could not inspect.
+ * Check if a directory is empty. A missing directory is treated as empty and
+ * a non-directory path as non-empty; inspection failures are propagated so
+ * callers can report that cleanup was incomplete.
  */
 export async function isDirEmpty(dirPath) {
     try {
@@ -146,7 +155,12 @@ export async function isDirEmpty(dirPath) {
         return entries.length === 0;
     }
     catch (error) {
-        return isNotFoundError(error);
+        const code = error?.code;
+        if (code === 'ENOENT')
+            return true;
+        if (code === 'ENOTDIR')
+            return false;
+        throw error;
     }
 }
 //# sourceMappingURL=file-system.js.map

package/dist/platform/fs/file-system.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"file-system.js","sourceRoot":"","sources":["../../../platform/fs/file-system.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,IAAI,EAAE,EAAE,MAAM,IAAI,CAAC;AACpC,OAAO,IAAI,MAAM,MAAM,CAAC;AAExB;;;GAGG;AACH,KAAK,UAAU,kBAAkB,CAAC,QAAgB;IAChD,IAAI,CAAC;QACH,OAAO,MAAM,EAAE,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;IACrC,CAAC;IAAC,MAAM,CAAC;QACP,2EAA2E;QAC3E,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;QACnC,IAAI,GAAG,KAAK,QAAQ;YAAE,OAAO,QAAQ,CAAC,CAAC,kBAAkB;QAEzD,MAAM,WAAW,GAAG,MAAM,kBAAkB,CAAC,GAAG,CAAC,CAAC;QAClD,MAAM,IAAI,GAAG,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;QAErC,kEAAkE;QAClE,IAAI,CAAC;YACH,MAAM,IAAI,GAAG,MAAM,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,IAAI,CAAC,CAAC,CAAC;YAC1D,IAAI,IAAI,CAAC,cAAc,EAAE,EAAE,CAAC;gBAC1B,MAAM,MAAM,GAAG,MAAM,EAAE,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,IAAI,CAAC,CAAC,CAAC;gBAC/D,OAAO,IAAI,CAAC,OAAO,CAAC,WAAW,EAAE,MAAM,CAAC,CAAC;YAC3C,CAAC;QACH,CAAC;QAAC,MAAM,CAAC;YACP,uCAAuC;QACzC,CAAC;QAED,OAAO,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,IAAI,CAAC,CAAC;IACtC,CAAC;AACH,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,SAAS,CAAC,GAAW;IACzC,MAAM,QAAQ,GAAG,MAAM,kBAAkB,CAAC,GAAG,CAAC,CAAC;IAC/C,MAAM,EAAE,CAAC,KAAK,CAAC,QAAQ,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;AAChD,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,QAAQ,CAAC,GAAW,EAAE,IAAY;IACtD,MAAM,YAAY,GAAG,MAAM,kBAAkB,CAAC,IAAI,CAAC,CAAC;IACpD,MAAM,SAAS,CAAC,IAAI,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC,CAAC;IAC5C,MAAM,EAAE,CAAC,QAAQ,CAAC,GAAG,EAAE,YAAY,CAAC,CAAC;AACvC,CAAC;AAED;;GAEG;AACH,MAAM,CAAC,KAAK,UAAU,UAAU,CAAC,QAAgB;IAC/C,IAAI,CAAC;QACH,MAAM,EAAE,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;QAC1B,OAAO,IAAI,CAAC;IACd,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,kBAAkB,CAAC,KAAK,CAAC;YAAE,OAAO,KAAK,CAAC;QAC5C,MAAM,KAAK,CAAC;IACd,CAAC;AACH,CAAC;AAED;;GAEG;AACH,MAAM,CAAC,KAAK,UAAU,QAAQ,CAAc,QAAgB;IAC1D,MAAM,OAAO,GAAG,MAAM,EAAE,CAAC,QAAQ,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;IACrD,OAAO,IAAI,CAAC,KAAK,CAAC,OAAO,CAAM,CAAC;AAClC,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,SAAS,CAAC,QAAgB,EAAE,OAAe;IAC/D,MAAM,QAAQ,GAAG,MAAM,kBAAkB,CAAC,QAAQ,CAAC,CAAC;IACpD,MAAM,SAAS,CAAC,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC;IACxC,MAAM,EAAE,CAAC,SAAS,CAAC,QAAQ,EAAE,OAAO,EAAE,OAAO,CAAC,CAAC;AACjD,CAAC;AAED;;GAEG;AACH,MAAM,CAAC,KAAK,UAAU,OAAO,CAAC,OAAe;IAC3C,IAAI,CAAC;QACH,OAAO,MAAM,EAAE,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;IACnC,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,IAAI,GAAI,KAA+B,EAAE,IAAI,CAAC;QACpD,IAAI,IAAI,KAAK,QAAQ,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;YAC5C,OAAO,EAAE,CAAC;QACZ,CAAC;QAED,MAAM,KAAK,CAAC;IACd,CAAC;AACH,CAAC;AAED;;;;;;;;GAQG;AACH,SAAS,kBAAkB,CAAC,KAAc;IACxC,MAAM,IAAI,GAAI,KAA2C,EAAE,IAAI,CAAC;IAChE,OAAO,IAAI,KAAK,QAAQ,IAAI,IAAI,KAAK,SAAS,CAAC;AACjD,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,UAAU,CAAC,QAAgB;IAC/C,IAAI,CAAC;QACH,MAAM,EAAE,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;QAC1B,OAAO,IAAI,CAAC;IACd,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAK,KAA+B,EAAE,IAAI,KAAK,QAAQ;YAAE,OAAO,KAAK,CAAC;QACtE,MAAM,KAAK,CAAC;IACd,CAAC;AACH,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,SAAS,CAAC,OAAe;IAC7C,IAAI,CAAC;QACH,uFAAuF;QACvF,MAAM,IAAI,GAAG,MAAM,EAAE,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;QACrC,IAAI,IAAI,CAAC,cAAc,EAAE,EAAE,CAAC;YAC1B,MAAM,EAAE,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;YACzB,OAAO,IAAI,CAAC;QACd,CAAC;QACD,MAAM,EAAE,CAAC,EAAE,CAAC,OAAO,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,CAAC;QACxD,OAAO,IAAI,CAAC;IACd,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAK,KAA+B,EAAE,IAAI,KAAK,QAAQ;YAAE,OAAO,KAAK,CAAC;QACtE,MAAM,KAAK,CAAC;IACd,CAAC;AACH,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,UAAU,CAAC,OAAe;IAC9C,IAAI,CAAC;QACH,MAAM,OAAO,GAAG,MAAM,EAAE,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;QAC1C,OAAO,OAAO,CAAC,MAAM,KAAK,CAAC,CAAC;IAC9B,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,IAAI,GAAI,KAA2C,EAAE,IAAI,CAAC;QAChE,IAAI,IAAI,KAAK,QAAQ;YAAE,OAAO,IAAI,CAAC;QACnC,IAAI,IAAI,KAAK,SAAS;YAAE,OAAO,KAAK,CAAC;QACrC,MAAM,KAAK,CAAC;IACd,CAAC;AACH,CAAC"}

package/dist/platform/fs/race-safe-read.d.ts

@@ -0,0 +1,47 @@
+import type { BigIntStats, Stats } from 'fs';
+import { type FileObjectIdentity } from './file-identity.js';
+export type RaceSafeReadCheckpoint = 'pre-open' | 'post-open' | 'post-read';
+export interface RaceSafeReadContext {
+    realPath: string;
+    identity: FileObjectIdentity;
+}
+export type RaceSafeReadFailureReason = 'not-regular-file' | 'too-large' | 'changed';
+export declare class RaceSafeReadError extends Error {
+    readonly reason: RaceSafeReadFailureReason;
+    constructor(reason: RaceSafeReadFailureReason, message: string, options?: {
+        cause?: unknown;
+    });
+}
+export interface RaceSafeReadOptions {
+    /** Use BigIntStats precision (dev/ino/size/mtimeNs/ctimeNs) end to end. */
+    bigint?: boolean;
+    /** Prefixed into built-in error messages, e.g. `${label} changed while reading`. */
+    label?: string;
+    /** Test-only synchronization points; behavior is passed through unchanged. */
+    hooks?: {
+        afterOpen?: () => void | Promise<void>;
+        beforeFinalCheck?: () => void | Promise<void>;
+    };
+    /**
+     * Called inside the same synchronization window as the built-in identity
+     * checks at each checkpoint. A thrown error aborts the read exactly like an
+     * identity mismatch. Use this to stack domain-specific checks (for example
+     * Native directory-chain verification) without opening a second race window.
+     */
+    verify?: (checkpoint: RaceSafeReadCheckpoint, context: RaceSafeReadContext) => void | Promise<void>;
+}
+export interface RaceSafeReadResult {
+    bytes: Buffer;
+    stat: Stats | BigIntStats;
+    realPath: string;
+}
+/**
+ * Read a regular file through one descriptor with identity re-verification
+ * before open, after open, and after the bounded read, so a path swapped for
+ * a symlink or replacement file between checks is always rejected.
+ *
+ * ENOENT (and every other system error except ELOOP) propagates unchanged so
+ * callers can keep their own missing-file semantics.
+ */
+export declare function readFileRaceSafe(file: string, maxBytes: number, options?: RaceSafeReadOptions): Promise<RaceSafeReadResult>;
+//# sourceMappingURL=race-safe-read.d.ts.map

package/dist/platform/fs/race-safe-read.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"race-safe-read.d.ts","sourceRoot":"","sources":["../../../platform/fs/race-safe-read.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,WAAW,EAAE,KAAK,EAAE,MAAM,IAAI,CAAC;AAE7C,OAAO,EAGL,KAAK,kBAAkB,EACxB,MAAM,oBAAoB,CAAC;AAE5B,MAAM,MAAM,sBAAsB,GAAG,UAAU,GAAG,WAAW,GAAG,WAAW,CAAC;AAE5E,MAAM,WAAW,mBAAmB;IAClC,QAAQ,EAAE,MAAM,CAAC;IACjB,QAAQ,EAAE,kBAAkB,CAAC;CAC9B;AAED,MAAM,MAAM,yBAAyB,GAAG,kBAAkB,GAAG,WAAW,GAAG,SAAS,CAAC;AAErF,qBAAa,iBAAkB,SAAQ,KAAK;IAC1C,QAAQ,CAAC,MAAM,EAAE,yBAAyB,CAAC;gBAE/B,MAAM,EAAE,yBAAyB,EAAE,OAAO,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE;QAAE,KAAK,CAAC,EAAE,OAAO,CAAA;KAAE;CAK9F;AAED,MAAM,WAAW,mBAAmB;IAClC,2EAA2E;IAC3E,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,oFAAoF;IACpF,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,8EAA8E;IAC9E,KAAK,CAAC,EAAE;QACN,SAAS,CAAC,EAAE,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;QACvC,gBAAgB,CAAC,EAAE,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;KAC/C,CAAC;IACF;;;;;OAKG;IACH,MAAM,CAAC,EAAE,CACP,UAAU,EAAE,sBAAsB,EAClC,OAAO,EAAE,mBAAmB,KACzB,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CAC3B;AAED,MAAM,WAAW,kBAAkB;IACjC,KAAK,EAAE,MAAM,CAAC;IACd,IAAI,EAAE,KAAK,GAAG,WAAW,CAAC;IAC1B,QAAQ,EAAE,MAAM,CAAC;CAClB;AAgCD;;;;;;;GAOG;AACH,wBAAsB,gBAAgB,CACpC,IAAI,EAAE,MAAM,EACZ,QAAQ,EAAE,MAAM,EAChB,OAAO,GAAE,mBAAwB,GAChC,OAAO,CAAC,kBAAkB,CAAC,CAgG7B"}

package/dist/platform/fs/race-safe-read.js

@@ -0,0 +1,132 @@
+import { constants as fsConstants, promises as fs } from 'fs';
+import { hasComparableFileObject, sameFileObject, } from './file-identity.js';
+export class RaceSafeReadError extends Error {
+    reason;
+    constructor(reason, message, options) {
+        super(message, options);
+        this.name = 'RaceSafeReadError';
+        this.reason = reason;
+    }
+}
+function birthtimeOf(stat) {
+    return 'birthtimeNs' in stat && typeof stat.birthtimeNs === 'bigint'
+        ? stat.birthtimeNs
+        : stat.birthtimeMs;
+}
+function ctimeOf(stat) {
+    return 'ctimeNs' in stat && typeof stat.ctimeNs === 'bigint' ? stat.ctimeNs : stat.ctimeMs;
+}
+function identityOf(stat) {
+    return { dev: stat.dev, ino: stat.ino, birthtime: birthtimeOf(stat) };
+}
+function sameStatIdentity(left, right) {
+    const leftObject = identityOf(left);
+    const rightObject = identityOf(right);
+    if (hasComparableFileObject(leftObject, rightObject)) {
+        return sameFileObject(leftObject, rightObject);
+    }
+    return (sameFileObject(leftObject, rightObject) &&
+        birthtimeOf(left) === birthtimeOf(right) &&
+        ctimeOf(left) === ctimeOf(right) &&
+        left.size === right.size);
+}
+/**
+ * Read a regular file through one descriptor with identity re-verification
+ * before open, after open, and after the bounded read, so a path swapped for
+ * a symlink or replacement file between checks is always rejected.
+ *
+ * ENOENT (and every other system error except ELOOP) propagates unchanged so
+ * callers can keep their own missing-file semantics.
+ */
+export async function readFileRaceSafe(file, maxBytes, options = {}) {
+    if (!Number.isSafeInteger(maxBytes) || maxBytes < 1) {
+        throw new Error('race-safe read byte limit must be a positive integer');
+    }
+    const label = options.label ?? 'file';
+    const bigint = options.bigint === true;
+    const before = await fs.lstat(file, { bigint });
+    if (!before.isFile() || before.isSymbolicLink()) {
+        throw new RaceSafeReadError('not-regular-file', `${label} must be a regular file`);
+    }
+    if (BigInt(before.size) > BigInt(maxBytes)) {
+        throw new RaceSafeReadError('too-large', `${label} exceeds ${maxBytes} bytes`);
+    }
+    const beforeRealPath = await fs.realpath(file);
+    await options.verify?.('pre-open', { realPath: beforeRealPath, identity: identityOf(before) });
+    // POSIX: O_NOFOLLOW rejects a symlink swapped in since the lstat above and
+    // O_NONBLOCK prevents a FIFO from blocking the open. Windows: Node exposes
+    // neither flag, so this branch opens with plain O_RDONLY and the
+    // lstat/realpath identity checks below - which run identically on every
+    // platform - are the sole and sufficient guard against both swaps.
+    const flags = process.platform === 'win32'
+        ? fsConstants.O_RDONLY
+        : fsConstants.O_RDONLY | fsConstants.O_NOFOLLOW | fsConstants.O_NONBLOCK;
+    let handle;
+    try {
+        handle = await fs.open(file, flags);
+    }
+    catch (error) {
+        if (error.code === 'ELOOP') {
+            throw new RaceSafeReadError('not-regular-file', `${label} must be a regular file`, {
+                cause: error,
+            });
+        }
+        throw error;
+    }
+    try {
+        const [opened, pathAfterOpen, realPathAfterOpen] = await Promise.all([
+            handle.stat({ bigint }),
+            fs.lstat(file, { bigint }),
+            fs.realpath(file),
+        ]);
+        if (!opened.isFile() ||
+            !pathAfterOpen.isFile() ||
+            pathAfterOpen.isSymbolicLink() ||
+            realPathAfterOpen !== beforeRealPath ||
+            !sameStatIdentity(before, opened) ||
+            !sameStatIdentity(before, pathAfterOpen)) {
+            throw new RaceSafeReadError('changed', `${label} changed while opening`);
+        }
+        await options.verify?.('post-open', {
+            realPath: realPathAfterOpen,
+            identity: identityOf(opened),
+        });
+        await options.hooks?.afterOpen?.();
+        const chunks = [];
+        let total = 0;
+        const buffer = Buffer.allocUnsafe(Math.min(64 * 1024, maxBytes + 1));
+        for (;;) {
+            const remaining = maxBytes + 1 - total;
+            const { bytesRead } = await handle.read(buffer, 0, Math.min(buffer.length, remaining), null);
+            if (bytesRead === 0)
+                break;
+            total += bytesRead;
+            if (total > maxBytes) {
+                throw new RaceSafeReadError('too-large', `${label} exceeds ${maxBytes} bytes`);
+            }
+            chunks.push(Buffer.from(buffer.subarray(0, bytesRead)));
+        }
+        await options.hooks?.beforeFinalCheck?.();
+        const [afterHandle, afterPath, afterRealPath] = await Promise.all([
+            handle.stat({ bigint }),
+            fs.lstat(file, { bigint }),
+            fs.realpath(file),
+        ]);
+        if (!afterPath.isFile() ||
+            afterPath.isSymbolicLink() ||
+            afterRealPath !== beforeRealPath ||
+            !sameStatIdentity(before, afterHandle) ||
+            !sameStatIdentity(before, afterPath)) {
+            throw new RaceSafeReadError('changed', `${label} changed while reading`);
+        }
+        await options.verify?.('post-read', {
+            realPath: afterRealPath,
+            identity: identityOf(afterHandle),
+        });
+        return { bytes: Buffer.concat(chunks, total), stat: afterHandle, realPath: afterRealPath };
+    }
+    finally {
+        await handle.close();
+    }
+}
+//# sourceMappingURL=race-safe-read.js.map

package/dist/platform/fs/race-safe-read.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"race-safe-read.js","sourceRoot":"","sources":["../../../platform/fs/race-safe-read.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,IAAI,WAAW,EAAE,QAAQ,IAAI,EAAE,EAAE,MAAM,IAAI,CAAC;AAG9D,OAAO,EACL,uBAAuB,EACvB,cAAc,GAEf,MAAM,oBAAoB,CAAC;AAW5B,MAAM,OAAO,iBAAkB,SAAQ,KAAK;IACjC,MAAM,CAA4B;IAE3C,YAAY,MAAiC,EAAE,OAAe,EAAE,OAA6B;QAC3F,KAAK,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;QACxB,IAAI,CAAC,IAAI,GAAG,mBAAmB,CAAC;QAChC,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;IACvB,CAAC;CACF;AAgCD,SAAS,WAAW,CAAC,IAAc;IACjC,OAAO,aAAa,IAAI,IAAI,IAAI,OAAO,IAAI,CAAC,WAAW,KAAK,QAAQ;QAClE,CAAC,CAAC,IAAI,CAAC,WAAW;QAClB,CAAC,CAAC,IAAI,CAAC,WAAW,CAAC;AACvB,CAAC;AAED,SAAS,OAAO,CAAC,IAAc;IAC7B,OAAO,SAAS,IAAI,IAAI,IAAI,OAAO,IAAI,CAAC,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC;AAC7F,CAAC;AAED,SAAS,UAAU,CAAC,IAAc;IAChC,OAAO,EAAE,GAAG,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,IAAI,CAAC,GAAG,EAAE,SAAS,EAAE,WAAW,CAAC,IAAI,CAAC,EAAE,CAAC;AACxE,CAAC;AAED,SAAS,gBAAgB,CAAC,IAAc,EAAE,KAAe;IACvD,MAAM,UAAU,GAAG,UAAU,CAAC,IAAI,CAAC,CAAC;IACpC,MAAM,WAAW,GAAG,UAAU,CAAC,KAAK,CAAC,CAAC;IACtC,IAAI,uBAAuB,CAAC,UAAU,EAAE,WAAW,CAAC,EAAE,CAAC;QACrD,OAAO,cAAc,CAAC,UAAU,EAAE,WAAW,CAAC,CAAC;IACjD,CAAC;IACD,OAAO,CACL,cAAc,CAAC,UAAU,EAAE,WAAW,CAAC;QACvC,WAAW,CAAC,IAAI,CAAC,KAAK,WAAW,CAAC,KAAK,CAAC;QACxC,OAAO,CAAC,IAAI,CAAC,KAAK,OAAO,CAAC,KAAK,CAAC;QAChC,IAAI,CAAC,IAAI,KAAK,KAAK,CAAC,IAAI,CACzB,CAAC;AACJ,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,CAAC,KAAK,UAAU,gBAAgB,CACpC,IAAY,EACZ,QAAgB,EAChB,UAA+B,EAAE;IAEjC,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,QAAQ,CAAC,IAAI,QAAQ,GAAG,CAAC,EAAE,CAAC;QACpD,MAAM,IAAI,KAAK,CAAC,sDAAsD,CAAC,CAAC;IAC1E,CAAC;IACD,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,IAAI,MAAM,CAAC;IACtC,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,KAAK,IAAI,CAAC;IAEvC,MAAM,MAAM,GAAG,MAAM,EAAE,CAAC,KAAK,CAAC,IAAI,EAAE,EAAE,MAAM,EAAE,CAAC,CAAC;IAChD,IAAI,CAAC,MAAM,CAAC,MAAM,EAAE,IAAI,MAAM,CAAC,cAAc,EAAE,EAAE,CAAC;QAChD,MAAM,IAAI,iBAAiB,CAAC,kBAAkB,EAAE,GAAG,KAAK,yBAAyB,CAAC,CAAC;IACrF,CAAC;IACD,IAAI,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,MAAM,CAAC,QAAQ,CAAC,EAAE,CAAC;QAC3C,MAAM,IAAI,iBAAiB,CAAC,WAAW,EAAE,GAAG,KAAK,YAAY,QAAQ,QAAQ,CAAC,CAAC;IACjF,CAAC;IACD,MAAM,cAAc,GAAG,MAAM,EAAE,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;IAC/C,MAAM,OAAO,CAAC,MAAM,EAAE,CAAC,UAAU,EAAE,EAAE,QAAQ,EAAE,cAAc,EAAE,QAAQ,EAAE,UAAU,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;IAE/F,2EAA2E;IAC3E,2EAA2E;IAC3E,iEAAiE;IACjE,wEAAwE;IACxE,mEAAmE;IACnE,MAAM,KAAK,GACT,OAAO,CAAC,QAAQ,KAAK,OAAO;QAC1B,CAAC,CAAC,WAAW,CAAC,QAAQ;QACtB,CAAC,CAAC,WAAW,CAAC,QAAQ,GAAG,WAAW,CAAC,UAAU,GAAG,WAAW,CAAC,UAAU,CAAC;IAC7E,IAAI,MAA2C,CAAC;IAChD,IAAI,CAAC;QACH,MAAM,GAAG,MAAM,EAAE,CAAC,IAAI,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;IACtC,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAK,KAA+B,CAAC,IAAI,KAAK,OAAO,EAAE,CAAC;YACtD,MAAM,IAAI,iBAAiB,CAAC,kBAAkB,EAAE,GAAG,KAAK,yBAAyB,EAAE;gBACjF,KAAK,EAAE,KAAK;aACb,CAAC,CAAC;QACL,CAAC;QACD,MAAM,KAAK,CAAC;IACd,CAAC;IACD,IAAI,CAAC;QACH,MAAM,CAAC,MAAM,EAAE,aAAa,EAAE,iBAAiB,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;YACnE,MAAM,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,CAAC;YACvB,EAAE,CAAC,KAAK,CAAC,IAAI,EAAE,EAAE,MAAM,EAAE,CAAC;YAC1B,EAAE,CAAC,QAAQ,CAAC,IAAI,CAAC;SAClB,CAAC,CAAC;QACH,IACE,CAAC,MAAM,CAAC,MAAM,EAAE;YAChB,CAAC,aAAa,CAAC,MAAM,EAAE;YACvB,aAAa,CAAC,cAAc,EAAE;YAC9B,iBAAiB,KAAK,cAAc;YACpC,CAAC,gBAAgB,CAAC,MAAM,EAAE,MAAM,CAAC;YACjC,CAAC,gBAAgB,CAAC,MAAM,EAAE,aAAa,CAAC,EACxC,CAAC;YACD,MAAM,IAAI,iBAAiB,CAAC,SAAS,EAAE,GAAG,KAAK,wBAAwB,CAAC,CAAC;QAC3E,CAAC;QACD,MAAM,OAAO,CAAC,MAAM,EAAE,CAAC,WAAW,EAAE;YAClC,QAAQ,EAAE,iBAAiB;YAC3B,QAAQ,EAAE,UAAU,CAAC,MAAM,CAAC;SAC7B,CAAC,CAAC;QACH,MAAM,OAAO,CAAC,KAAK,EAAE,SAAS,EAAE,EAAE,CAAC;QAEnC,MAAM,MAAM,GAAa,EAAE,CAAC;QAC5B,IAAI,KAAK,GAAG,CAAC,CAAC;QACd,MAAM,MAAM,GAAG,MAAM,CAAC,WAAW,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,GAAG,IAAI,EAAE,QAAQ,GAAG,CAAC,CAAC,CAAC,CAAC;QACrE,SAAS,CAAC;YACR,MAAM,SAAS,GAAG,QAAQ,GAAG,CAAC,GAAG,KAAK,CAAC;YACvC,MAAM,EAAE,SAAS,EAAE,GAAG,MAAM,MAAM,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC,EAAE,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,MAAM,EAAE,SAAS,CAAC,EAAE,IAAI,CAAC,CAAC;YAC7F,IAAI,SAAS,KAAK,CAAC;gBAAE,MAAM;YAC3B,KAAK,IAAI,SAAS,CAAC;YACnB,IAAI,KAAK,GAAG,QAAQ,EAAE,CAAC;gBACrB,MAAM,IAAI,iBAAiB,CAAC,WAAW,EAAE,GAAG,KAAK,YAAY,QAAQ,QAAQ,CAAC,CAAC;YACjF,CAAC;YACD,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,EAAE,SAAS,CAAC,CAAC,CAAC,CAAC;QAC1D,CAAC;QACD,MAAM,OAAO,CAAC,KAAK,EAAE,gBAAgB,EAAE,EAAE,CAAC;QAE1C,MAAM,CAAC,WAAW,EAAE,SAAS,EAAE,aAAa,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;YAChE,MAAM,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,CAAC;YACvB,EAAE,CAAC,KAAK,CAAC,IAAI,EAAE,EAAE,MAAM,EAAE,CAAC;YAC1B,EAAE,CAAC,QAAQ,CAAC,IAAI,CAAC;SAClB,CAAC,CAAC;QACH,IACE,CAAC,SAAS,CAAC,MAAM,EAAE;YACnB,SAAS,CAAC,cAAc,EAAE;YAC1B,aAAa,KAAK,cAAc;YAChC,CAAC,gBAAgB,CAAC,MAAM,EAAE,WAAW,CAAC;YACtC,CAAC,gBAAgB,CAAC,MAAM,EAAE,SAAS,CAAC,EACpC,CAAC;YACD,MAAM,IAAI,iBAAiB,CAAC,SAAS,EAAE,GAAG,KAAK,wBAAwB,CAAC,CAAC;QAC3E,CAAC;QACD,MAAM,OAAO,CAAC,MAAM,EAAE,CAAC,WAAW,EAAE;YAClC,QAAQ,EAAE,aAAa;YACvB,QAAQ,EAAE,UAAU,CAAC,WAAW,CAAC;SAClC,CAAC,CAAC;QACH,OAAO,EAAE,KAAK,EAAE,MAAM,CAAC,MAAM,CAAC,MAAM,EAAE,KAAK,CAAC,EAAE,IAAI,EAAE,WAAW,EAAE,QAAQ,EAAE,aAAa,EAAE,CAAC;IAC7F,CAAC;YAAS,CAAC;QACT,MAAM,MAAM,CAAC,KAAK,EAAE,CAAC;IACvB,CAAC;AACH,CAAC"}

package/dist/platform/fs/trusted-readonly-file.d.ts

@@ -0,0 +1,31 @@
+export interface TrustedReadonlyFileIdentity {
+    realPath: string;
+    dev: number;
+    ino: number;
+    size: number;
+    mtimeMs: number;
+}
+export interface TrustedReadonlyPosixFacts {
+    currentUid: number;
+    fileUid: number;
+    fileMode: number;
+    fileWritable: boolean;
+    parents: Array<{
+        uid: number;
+        mode: number;
+        writable: boolean;
+    }>;
+}
+export declare function trustedReadonlyPosixFactsIssue(facts: TrustedReadonlyPosixFacts): string | null;
+export declare function registerTrustedReadonlyFileForTest(file: string): () => void;
+/**
+ * Proves that a trust-anchor file cannot be replaced or modified by the
+ * current process. POSIX proof requires a different owner and a complete
+ * non-writable parent chain. Windows must use a host-provided read-only mount
+ * capability until ACL proof is available.
+ */
+export declare function assertTrustedReadonlyFile(options: {
+    file: string;
+    previous?: TrustedReadonlyFileIdentity;
+}): Promise<TrustedReadonlyFileIdentity>;
+//# sourceMappingURL=trusted-readonly-file.d.ts.map

package/dist/platform/fs/trusted-readonly-file.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"trusted-readonly-file.d.ts","sourceRoot":"","sources":["../../../platform/fs/trusted-readonly-file.ts"],"names":[],"mappings":"AAGA,MAAM,WAAW,2BAA2B;IAC1C,QAAQ,EAAE,MAAM,CAAC;IACjB,GAAG,EAAE,MAAM,CAAC;IACZ,GAAG,EAAE,MAAM,CAAC;IACZ,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;CACjB;AAED,MAAM,WAAW,yBAAyB;IACxC,UAAU,EAAE,MAAM,CAAC;IACnB,OAAO,EAAE,MAAM,CAAC;IAChB,QAAQ,EAAE,MAAM,CAAC;IACjB,YAAY,EAAE,OAAO,CAAC;IACtB,OAAO,EAAE,KAAK,CAAC;QAAE,GAAG,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,OAAO,CAAA;KAAE,CAAC,CAAC;CAClE;AAED,wBAAgB,8BAA8B,CAAC,KAAK,EAAE,yBAAyB,GAAG,MAAM,GAAG,IAAI,CAe9F;AAID,wBAAgB,kCAAkC,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,IAAI,CAO3E;AA4CD;;;;;GAKG;AACH,wBAAsB,yBAAyB,CAAC,OAAO,EAAE;IACvD,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,CAAC,EAAE,2BAA2B,CAAC;CACxC,GAAG,OAAO,CAAC,2BAA2B,CAAC,CA2CvC"}