@software-dlc/cli 0.157.2

package/dist/local/save-layout.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"save-layout.js","sourceRoot":"","sources":["../../src/local/save-layout.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AACrC,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AACzC,OAAO,EAAE,MAAM,EAAE,MAAM,qBAAqB,CAAC;AAE7C,OAAO,EACL,+BAA+B,EAC/B,iCAAiC,EAClC,MAAM,4BAA4B,CAAC;AAUpC;;;;;;;;GAQG;AAEH,kFAAkF;AAClF,MAAM,CAAC,MAAM,mBAAmB,GAAG,CAAC,CAAC;AAErC,4DAA4D;AAC5D,0EAA0E;AAC1E,kCAAkC;AAClC,MAAM,uBAAuB,GAAG,EAAE,CAAC;AAEnC,4EAA4E;AAC5E,iBAAiB;AACjB,MAAM,oBAAoB,GAAG,EAAE,CAAC;AAoBhC;;;;GAIG;AACH,MAAM,UAAU,sBAAsB,CAAC,KAGtC;IACC,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IACrC,OAAO,CACL,KAAK,CAAC,IAAI,KAAK,CAAC;QAChB,CAAC,KAAK,CAAC,MAAM,GAAG,uBAAuB;YACrC,KAAK,CAAC,MAAM,GAAG,CAAC,GAAG,KAAK,CAAC,IAAI,GAAG,KAAK,CAAC,MAAM,CAAC,CAChD,CAAC;AACJ,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,cAAc,CAAC,KAKpC;IACC,MAAM,UAAU,GAAG,CAAC,QAA2B,EAAE,EAAE,CACjD,IAAI,GAAG,CACL,QAAQ,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE,CACpC,OAAO,CAAC,IAAI,KAAK,MAAM;QACrB,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,SAAS,EAAE,OAAO,CAAC,WAAW,CAAU,CAAC;QACrD,CAAC,CAAC,EAAE,CACP,CACF,CAAC;IACJ,MAAM,IAAI,GAAG,UAAU,CAAC,KAAK,CAAC,aAAa,CAAC,CAAC;IAC7C,MAAM,MAAM,GAAG,UAAU,CAAC,KAAK,CAAC,eAAe,CAAC,CAAC;IACjD,IAAI,IAAI,GAAG,CAAC,CAAC;IACb,KAAK,MAAM,IAAI,IAAI,KAAK,CAAC,KAAK,CAAC,KAAK,EAAE,CAAC;QACrC,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QACpC,IAAI,CAAC,SAAS;YAAE,SAAS;QACzB,IAAI,SAAS,KAAK,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,CAAC;YACtC,IAAI,IAAI,CAAC,CAAC;YACV,SAAS;QACX,CAAC;QACD,IAAI,MAAuB,CAAC;QAC5B,IAAI,CAAC;YACH,MAAM,GAAG,MAAM,KAAK,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC;QAC7C,CAAC;QAAC,MAAM,CAAC;YACP,SAAS;QACX,CAAC;QACD,MAAM,IAAI,GAAI,MAA6C,CAAC,IAAI,CAAC;QACjE,IAAI,CAAC,IAAI,EAAE,SAAS,IAAI,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,QAAQ,IAAI,IAAI,CAAC;YAAE,IAAI,IAAI,CAAC,CAAC;IACvE,CAAC;IACD,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,CAAC,KAAK,CAAC,KAAK,CAAC,MAAM,GAAG,IAAI,EAAE,CAAC;AAC3D,CAAC;AAED,SAAS,YAAY,CAAC,KAAoB;IACxC,MAAM,QAAQ,GAAG,IAAI,GAAG,EAAoB,CAAC;IAC7C,KAAK,MAAM,IAAI,IAAI,KAAK,CAAC,KAAK,EAAE,CAAC;QAC/B,MAAM,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,IAAI,CAAC;QACzC,IACE,CAAC,MAAM,CAAC,QAAQ,CAAC,QAAQ,EAAE,CAAC,CAAC;YAC7B,CAAC,MAAM,CAAC,QAAQ,CAAC,QAAQ,EAAE,CAAC,CAAC;YAC7B,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC;YACvB,CAAC,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,EACxB,CAAC;YACD,OAAO,IAAI,CAAC;QACd,CAAC;QACD,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,EAAE;YACpB,CAAC,EAAE,QAAS,CAAC,CAAC;YACd,CAAC,EAAE,QAAS,CAAC,CAAC;YACd,KAAK,EAAE,KAAM;YACb,MAAM,EAAE,MAAO;SAChB,CAAC,CAAC;IACL,CAAC;IACD,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,MAAM,KAAK,GAAG,CAAC,KAAa,EAAE,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,GAAG,GAAG,CAAC,GAAG,GAAG,CAAC;AAE/D;;;;GAIG;AACH,MAAM,UAAU,cAAc,CAC5B,KAAoB,EACpB,QAAuC;IAEvC,MAAM,OAAO,GAAG,KAAK,CAAC,KAAK;SACxB,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE;QACZ,MAAM,KAAK,GAAG,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QACpC,OAAO,KAAK;YACV,CAAC,CAAC;gBACE,SAAS,EAAE,IAAI,CAAC,EAAE;gBAClB,KAAK,EAAE;oBACL,CAAC,EAAE,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC;oBACjB,CAAC,EAAE,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC;oBACjB,KAAK,EAAE,KAAK,CAAC,KAAK,CAAC,KAAK,CAAC;oBACzB,MAAM,EAAE,KAAK,CAAC,KAAK,CAAC,MAAM,CAAC;iBAC5B;aACF;YACH,CAAC,CAAC,IAAI,CAAC;IACX,CAAC,CAAC;SACD,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,KAAK,IAAI,CAAC;SACjC,IAAI,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CACpB,IAAI,CAAC,SAAS,GAAG,KAAK,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,GAAG,KAAK,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CACjF,CAAC;IACJ,IAAI,OAAO,CAAC,MAAM,KAAK,KAAK,CAAC,KAAK,CAAC,MAAM;QAAE,OAAO,IAAI,CAAC;IACvD,MAAM,MAAM,GAAG,iCAAiC,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC;IACpE,OAAO,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC;AAC7C,CAAC;AAED,SAAS,WAAW;IAClB,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,yBAAyB,EAAE,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IACrE,IAAI,UAAU,CAAC,aAAa,CAAC,QAAQ,CAAC,CAAC;QAAE,OAAO,EAAE,GAAG,EAAE,QAAQ,EAAE,QAAQ,EAAE,EAAE,EAAE,CAAC;IAChF,kEAAkE;IAClE,OAAO;QACL,GAAG,EAAE,IAAI,GAAG,CAAC,yBAAyB,EAAE,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC;QACxD,QAAQ,EAAE,CAAC,4BAA4B,EAAE,uCAAuC,CAAC;KAClF,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,mBAAmB,CACvC,KAAoB,EACpB,UAAoC,EAAE;IAEtC,OAAO,CAAC,MAAM,EAAE,cAAc,EAAE,CAAC;IACjC,MAAM,KAAK,GAAG,WAAW,EAAE,CAAC;IAC5B,MAAM,MAAM,GAAG,IAAI,MAAM,CAAC,KAAK,CAAC,GAAG,EAAE;QACnC,QAAQ,EAAE,KAAK,CAAC,QAAQ;QACxB,cAAc,EAAE,EAAE,WAAW,EAAE,oBAAoB,EAAE;KACtD,CAAC,CAAC;IACH,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,MAAM,IAAI,OAAO,CAAyB,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;YAC3E,MAAM,KAAK,GAAG,GAAG,EAAE,CAAC,MAAM,CAAC,OAAO,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;YACnD,OAAO,CAAC,MAAM,EAAE,gBAAgB,CAAC,OAAO,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;YACjE,MAAM,MAAM,GAAG,GAAG,EAAE,CAAC,OAAO,CAAC,MAAM,EAAE,mBAAmB,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;YACzE,MAAM,CAAC,IAAI,CAAC,SAAS,EAAE,CAAC,KAA6B,EAAE,EAAE;gBACvD,MAAM,EAAE,CAAC;gBACT,OAAO,CAAC,KAAK,CAAC,CAAC;YACjB,CAAC,CAAC,CAAC;YACH,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC,KAAK,EAAE,EAAE;gBAC7B,MAAM,EAAE,CAAC;gBACT,MAAM,CAAC,KAAK,CAAC,CAAC;YAChB,CAAC,CAAC,CAAC;YACH,MAAM,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,EAAE;gBAC3B,MAAM,EAAE,CAAC;gBACT,MAAM,CAAC,IAAI,KAAK,CAAC,sCAAsC,IAAI,oBAAoB,CAAC,CAAC,CAAC;YACpF,CAAC,CAAC,CAAC;YACH,MAAM,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC;QAC5B,CAAC,CAAC,CAAC;QACH,IAAI,CAAC,MAAM,CAAC,EAAE;YAAE,MAAM,IAAI,KAAK,CAAC,+BAA+B,MAAM,CAAC,KAAK,EAAE,CAAC,CAAC;QAC/E,OAAO,IAAI,GAAG,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;IAClC,CAAC;YAAS,CAAC;QACT,MAAM,MAAM,CAAC,SAAS,EAAE,CAAC;IAC3B,CAAC;AACH,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,gBAAgB,CAAC,KAStC;IAIC,MAAM,UAAU,GAAG,WAAW,CAAC,GAAG,EAAE,CAAC;IACrC,MAAM,UAAU,GAAG,KAAK,CAAC,KAAK,CAAC,KAAK,CAAC,MAAM,CAAC;IAC5C,MAAM,MAAM,GAAG,CAAC,MAA0B,EAAE,IAAa,EAAgB,EAAE,CAAC,CAAC;QAC3E,IAAI;QACJ,MAAM;QACN,UAAU;QACV,EAAE,EAAE,IAAI,CAAC,KAAK,CAAC,WAAW,CAAC,GAAG,EAAE,GAAG,UAAU,CAAC;KAC/C,CAAC,CAAC;IACH,MAAM,MAAM,GAAG,MAAM,cAAc,CAAC,KAAK,CAAC,CAAC;IAC3C,IAAI,CAAC,sBAAsB,CAAC,MAAM,CAAC,EAAE,CAAC;QACpC,OAAO,EAAE,aAAa,EAAE,MAAM,CAAC,eAAe,EAAE,KAAK,CAAC,EAAE,CAAC;IAC3D,CAAC;IACD,IAAI,CAAC,KAAK,CAAC,8BAA8B,CAAC,QAAQ,CAAC,mBAAmB,CAAC,EAAE,CAAC;QACxE,KAAK,CAAC,QAAQ,EAAE,CACd,uEAAuE,UAAU,wDAAwD,CAC1I,CAAC;QACF,OAAO,EAAE,aAAa,EAAE,MAAM,CAAC,eAAe,EAAE,KAAK,CAAC,EAAE,CAAC;IAC3D,CAAC;IACD,IAAI,UAAU,GAAG,+BAA+B,EAAE,CAAC;QACjD,KAAK,CAAC,QAAQ,EAAE,CACd,UAAU,UAAU,uBAAuB,+BAA+B,sGAAsG,CACjL,CAAC;QACF,OAAO,EAAE,aAAa,EAAE,MAAM,CAAC,YAAY,EAAE,KAAK,CAAC,EAAE,CAAC;IACxD,CAAC;IACD,MAAM,SAAS,GAAG,YAAY,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;IAC5C,IAAI,QAAQ,GAAG,SAAS,CAAC;IACzB,IAAI,CAAC,QAAQ,EAAE,CAAC;QACd,KAAK,CAAC,QAAQ,EAAE,CAAC,qBAAqB,UAAU,QAAQ,CAAC,CAAC;QAC1D,IAAI,CAAC;YACH,QAAQ,GAAG,MAAM,CAAC,KAAK,CAAC,MAAM,IAAI,mBAAmB,CAAC,CAAC,KAAK,CAAC,KAAK,EAAE;gBAClE,MAAM,EAAE,KAAK,CAAC,MAAM;aACrB,CAAC,CAAC;QACL,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,wEAAwE;YACxE,4CAA4C;YAC5C,IAAI,KAAK,CAAC,MAAM,EAAE,OAAO;gBAAE,MAAM,KAAK,CAAC;YACvC,KAAK,CAAC,QAAQ,EAAE,CACd,sCAAsC,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,+EAA+E,CAC5K,CAAC;YACF,OAAO,EAAE,aAAa,EAAE,MAAM,CAAC,eAAe,EAAE,KAAK,CAAC,EAAE,CAAC;QAC3D,CAAC;IACH,CAAC;IACD,MAAM,YAAY,GAAG,cAAc,CAAC,KAAK,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAC;IAC3D,IAAI,CAAC,YAAY,EAAE,CAAC;QAClB,KAAK,CAAC,QAAQ,EAAE,CACd,oIAAoI,CACrI,CAAC;QACF,OAAO,EAAE,aAAa,EAAE,MAAM,CAAC,YAAY,EAAE,KAAK,CAAC,EAAE,CAAC;IACxD,CAAC;IACD,MAAM,aAAa,GAAG,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC,UAAU,EAAE,IAAI,CAAC,CAAC;IAC7E,IAAI,CAAC,SAAS,EAAE,CAAC;QACf,KAAK,CAAC,QAAQ,EAAE,CACd,mBAAmB,UAAU,aAAa,CAAC,aAAa,CAAC,EAAE,GAAG,IAAI,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CACnF,CAAC;IACJ,CAAC;IACD,OAAO,EAAE,aAAa,EAAE,YAAY,EAAE,CAAC;AACzC,CAAC"}

package/dist/local/scope-impact.d.ts

@@ -0,0 +1,31 @@
+import type { GraphScopeImpactEntity, GraphScopeRecipeV1, PortableGraph } from '@software-dlc/graph/types';
+export declare function resolveLocalScopeImpact(input: {
+    graph: PortableGraph;
+    selectors: GraphScopeRecipeV1['selectors'];
+    entity: GraphScopeImpactEntity;
+}): {
+    status: "invalid_projection";
+    validation: import("./projection.js").ProjectionValidation;
+    resolution?: undefined;
+    recipe_hash?: undefined;
+    membership_profile_id?: undefined;
+    membership_profile_version?: undefined;
+    impact?: undefined;
+} | {
+    status: "resolution_failed";
+    resolution: import("@software-dlc/graph/validator").GraphScopeResolution;
+    validation?: undefined;
+    recipe_hash?: undefined;
+    membership_profile_id?: undefined;
+    membership_profile_version?: undefined;
+    impact?: undefined;
+} | {
+    status: "ready";
+    recipe_hash: `sha256:${string}`;
+    membership_profile_id: "graph_scope_v1";
+    membership_profile_version: 1;
+    impact: import("@software-dlc/graph/validator").GraphScopeExternalImpact;
+    validation?: undefined;
+    resolution?: undefined;
+};
+//# sourceMappingURL=scope-impact.d.ts.map

package/dist/local/scope-impact.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"scope-impact.d.ts","sourceRoot":"","sources":["../../src/local/scope-impact.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EAEV,sBAAsB,EACtB,kBAAkB,EAClB,aAAa,EACd,MAAM,2BAA2B,CAAC;AAInC,wBAAgB,uBAAuB,CAAC,KAAK,EAAE;IAC7C,KAAK,EAAE,aAAa,CAAC;IACrB,SAAS,EAAE,kBAAkB,CAAC,WAAW,CAAC,CAAC;IAC3C,MAAM,EAAE,sBAAsB,CAAC;CAChC;;;;;;;;;;;;;;;;;;;;;;;;EAgCA"}

package/dist/local/scope-impact.js

@@ -0,0 +1,32 @@
+import { buildGraphScopeExternalImpact, resolveGraphScopeV1 } from '@software-dlc/graph/validator';
+import { validateProjectionGraph } from './projection.js';
+export function resolveLocalScopeImpact(input) {
+    const validation = validateProjectionGraph(input.graph);
+    if (!validation.is_valid) {
+        return {
+            status: 'invalid_projection',
+            validation
+        };
+    }
+    const graph = input.graph;
+    const resolution = resolveGraphScopeV1({
+        graph,
+        recipe: { schema_version: 1, selectors: input.selectors }
+    });
+    if (resolution.outcome !== 'ready_complete' &&
+        resolution.outcome !== 'scope_absent') {
+        return { status: 'resolution_failed', resolution };
+    }
+    return {
+        status: 'ready',
+        recipe_hash: resolution.recipe_hash,
+        membership_profile_id: resolution.membership_profile_id,
+        membership_profile_version: resolution.membership_profile_version,
+        impact: buildGraphScopeExternalImpact({
+            graph,
+            resolution,
+            entity: input.entity
+        })
+    };
+}
+//# sourceMappingURL=scope-impact.js.map

package/dist/local/scope-impact.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"scope-impact.js","sourceRoot":"","sources":["../../src/local/scope-impact.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,6BAA6B,EAC7B,mBAAmB,EACpB,MAAM,+BAA+B,CAAC;AAQvC,OAAO,EAAE,uBAAuB,EAAE,MAAM,iBAAiB,CAAC;AAE1D,MAAM,UAAU,uBAAuB,CAAC,KAIvC;IACC,MAAM,UAAU,GAAG,uBAAuB,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;IACxD,IAAI,CAAC,UAAU,CAAC,QAAQ,EAAE,CAAC;QACzB,OAAO;YACL,MAAM,EAAE,oBAA6B;YACrC,UAAU;SACX,CAAC;IACJ,CAAC;IAED,MAAM,KAAK,GAAG,KAAK,CAAC,KAA2B,CAAC;IAChD,MAAM,UAAU,GAAG,mBAAmB,CAAC;QACrC,KAAK;QACL,MAAM,EAAE,EAAE,cAAc,EAAE,CAAC,EAAE,SAAS,EAAE,KAAK,CAAC,SAAS,EAAE;KAC1D,CAAC,CAAC;IACH,IACE,UAAU,CAAC,OAAO,KAAK,gBAAgB;QACvC,UAAU,CAAC,OAAO,KAAK,cAAc,EACrC,CAAC;QACD,OAAO,EAAE,MAAM,EAAE,mBAA4B,EAAE,UAAU,EAAE,CAAC;IAC9D,CAAC;IAED,OAAO;QACL,MAAM,EAAE,OAAgB;QACxB,WAAW,EAAE,UAAU,CAAC,WAAW;QACnC,qBAAqB,EAAE,UAAU,CAAC,qBAAqB;QACvD,0BAA0B,EAAE,UAAU,CAAC,0BAA0B;QACjE,MAAM,EAAE,6BAA6B,CAAC;YACpC,KAAK;YACL,UAAU;YACV,MAAM,EAAE,KAAK,CAAC,MAAM;SACrB,CAAC;KACH,CAAC;AACJ,CAAC"}

package/dist/local/source-evidence/filesystem-worker.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=filesystem-worker.d.ts.map

package/dist/local/source-evidence/filesystem-worker.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"filesystem-worker.d.ts","sourceRoot":"","sources":["../../../src/local/source-evidence/filesystem-worker.ts"],"names":[],"mappings":""}

package/dist/local/source-evidence/filesystem-worker.js

@@ -0,0 +1,139 @@
+import { constants, openSync, closeSync, readSync, fstatSync, lstatSync, realpathSync } from 'node:fs';
+import { dirname, join, parse } from 'node:path';
+import { createHash } from 'node:crypto';
+import { filesystem_request_schema, SourceReadError } from './protocol.js';
+function stamp(path) {
+    const value = lstatSync(path, { bigint: true });
+    if (value.isSymbolicLink())
+        throw new SourceReadError('unsupported_read');
+    return [
+        value.dev,
+        value.ino,
+        value.mode,
+        value.isDirectory() ? '' : value.size,
+        value.isDirectory() ? '' : value.mtimeNs,
+        value.isDirectory() ? '' : value.ctimeNs
+    ].join(':');
+}
+function absent(path) {
+    try {
+        lstatSync(path);
+        return false;
+    }
+    catch (error) {
+        if (error &&
+            typeof error === 'object' &&
+            'code' in error &&
+            error.code === 'ENOENT')
+            return true;
+        throw error;
+    }
+}
+function ancestors(path) {
+    const entries = [];
+    for (let current = path;; current = dirname(current)) {
+        const value = stamp(current);
+        if (!lstatSync(current).isDirectory())
+            throw new SourceReadError('unsupported_read');
+        entries.push([current, value]);
+        if (current === parse(current).root)
+            break;
+    }
+    return entries;
+}
+function unchanged(entries) {
+    for (const [path, value] of entries)
+        if (stamp(path) !== value)
+            throw new SourceReadError('changed_during_read');
+}
+// No spawn/import of child_process. Synchronous I/O is isolated in this killable process.
+process.once('message', (message) => {
+    const parsed = filesystem_request_schema.safeParse(message);
+    try {
+        if (!parsed.success)
+            throw new SourceReadError('unsupported_read');
+        const request = parsed.data;
+        if (realpathSync(request.root) !== request.root)
+            throw new SourceReadError('unsupported_read');
+        if (request.kind === 'guard') {
+            if (realpathSync(request.common) !== request.common)
+                throw new SourceReadError('unsupported_read');
+            const entries = [
+                ...ancestors(request.root),
+                ...ancestors(join(request.common, 'objects/info'))
+            ];
+            for (const name of ['alternates', 'http-alternates'])
+                if (!absent(join(request.common, 'objects/info', name)))
+                    throw new SourceReadError('unsupported_read');
+            unchanged(entries);
+            process.send?.({ status: 'ok', value: JSON.stringify(entries) });
+        }
+        else {
+            const full = join(request.root, request.path);
+            const entries = ancestors(dirname(full));
+            for (let current = dirname(full); current !== request.root; current = dirname(current)) {
+                if (!absent(join(current, '.git')))
+                    throw new SourceReadError('unsupported_read');
+            }
+            const before = stamp(full);
+            const initial = lstatSync(full);
+            if (!initial.isFile() || initial.nlink !== 1)
+                throw new SourceReadError('unsupported_read');
+            if (initial.size > request.limit)
+                throw new SourceReadError('budget_insufficient');
+            const fd = openSync(full, constants.O_RDONLY | constants.O_NOFOLLOW | constants.O_NONBLOCK);
+            let value;
+            try {
+                const opened = fstatSync(fd);
+                if (!opened.isFile() ||
+                    opened.nlink !== 1 ||
+                    opened.dev !== initial.dev ||
+                    opened.ino !== initial.ino)
+                    throw new SourceReadError('changed_during_read');
+                const buffer = Buffer.alloc(request.limit + 1);
+                let offset = 0;
+                while (offset < buffer.length) {
+                    const size = readSync(fd, buffer, offset, buffer.length - offset, offset);
+                    if (!size)
+                        break;
+                    offset += size;
+                }
+                if (offset > request.limit)
+                    throw new SourceReadError('budget_insufficient');
+                unchanged(entries);
+                if (stamp(full) !== before)
+                    throw new SourceReadError('changed_during_read');
+                const bytes = buffer.subarray(0, offset);
+                const text = new TextDecoder('utf-8', { fatal: true }).decode(bytes);
+                if (bytes.includes(0))
+                    throw new SourceReadError('unsupported_read');
+                let lines = bytes.length ? 1 : 0;
+                for (const byte of bytes)
+                    if (byte === 10)
+                        lines++;
+                if (text.endsWith('\n'))
+                    lines--;
+                value = {
+                    hash: createHash('sha256').update(bytes).digest('hex'),
+                    bytes: offset,
+                    lines,
+                    stamp: JSON.stringify([before, entries])
+                };
+            }
+            finally {
+                closeSync(fd);
+            }
+            process.send?.({ status: 'ok', value });
+        }
+    }
+    catch (error) {
+        process.send?.({
+            status: 'error',
+            reason: error instanceof SourceReadError ? error.reason : 'unsupported_read'
+        });
+    }
+    finally {
+        process.disconnect();
+    }
+});
+//# sourceMappingURL=filesystem-worker.js.map

package/dist/local/source-evidence/filesystem-worker.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"filesystem-worker.js","sourceRoot":"","sources":["../../../src/local/source-evidence/filesystem-worker.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,SAAS,EACT,QAAQ,EACR,SAAS,EACT,QAAQ,EACR,SAAS,EACT,SAAS,EACT,YAAY,EACb,MAAM,SAAS,CAAC;AACjB,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,MAAM,WAAW,CAAC;AACjD,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EACL,yBAAyB,EACzB,eAAe,EAEhB,MAAM,eAAe,CAAC;AAEvB,SAAS,KAAK,CAAC,IAAY;IACzB,MAAM,KAAK,GAAG,SAAS,CAAC,IAAI,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC;IAChD,IAAI,KAAK,CAAC,cAAc,EAAE;QAAE,MAAM,IAAI,eAAe,CAAC,kBAAkB,CAAC,CAAC;IAC1E,OAAO;QACL,KAAK,CAAC,GAAG;QACT,KAAK,CAAC,GAAG;QACT,KAAK,CAAC,IAAI;QACV,KAAK,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI;QACrC,KAAK,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO;QACxC,KAAK,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO;KACzC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AACd,CAAC;AACD,SAAS,MAAM,CAAC,IAAY;IAC1B,IAAI,CAAC;QACH,SAAS,CAAC,IAAI,CAAC,CAAC;QAChB,OAAO,KAAK,CAAC;IACf,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IACE,KAAK;YACL,OAAO,KAAK,KAAK,QAAQ;YACzB,MAAM,IAAI,KAAK;YACf,KAAK,CAAC,IAAI,KAAK,QAAQ;YAEvB,OAAO,IAAI,CAAC;QACd,MAAM,KAAK,CAAC;IACd,CAAC;AACH,CAAC;AACD,SAAS,SAAS,CAAC,IAAY;IAC7B,MAAM,OAAO,GAAuB,EAAE,CAAC;IACvC,KAAK,IAAI,OAAO,GAAG,IAAI,GAAI,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;QACtD,MAAM,KAAK,GAAG,KAAK,CAAC,OAAO,CAAC,CAAC;QAC7B,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC,WAAW,EAAE;YACnC,MAAM,IAAI,eAAe,CAAC,kBAAkB,CAAC,CAAC;QAChD,OAAO,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC,CAAC;QAC/B,IAAI,OAAO,KAAK,KAAK,CAAC,OAAO,CAAC,CAAC,IAAI;YAAE,MAAM;IAC7C,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AACD,SAAS,SAAS,CAAC,OAA2B;IAC5C,KAAK,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,OAAO;QACjC,IAAI,KAAK,CAAC,IAAI,CAAC,KAAK,KAAK;YAAE,MAAM,IAAI,eAAe,CAAC,qBAAqB,CAAC,CAAC;AAChF,CAAC;AACD,0FAA0F;AAC1F,OAAO,CAAC,IAAI,CAAC,SAAS,EAAE,CAAC,OAAgB,EAAE,EAAE;IAC3C,MAAM,MAAM,GAAG,yBAAyB,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC;IAC5D,IAAI,CAAC;QACH,IAAI,CAAC,MAAM,CAAC,OAAO;YAAE,MAAM,IAAI,eAAe,CAAC,kBAAkB,CAAC,CAAC;QACnE,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,CAAC;QAC5B,IAAI,YAAY,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,OAAO,CAAC,IAAI;YAC7C,MAAM,IAAI,eAAe,CAAC,kBAAkB,CAAC,CAAC;QAChD,IAAI,OAAO,CAAC,IAAI,KAAK,OAAO,EAAE,CAAC;YAC7B,IAAI,YAAY,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK,OAAO,CAAC,MAAM;gBACjD,MAAM,IAAI,eAAe,CAAC,kBAAkB,CAAC,CAAC;YAChD,MAAM,OAAO,GAAG;gBACd,GAAG,SAAS,CAAC,OAAO,CAAC,IAAI,CAAC;gBAC1B,GAAG,SAAS,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,cAAc,CAAC,CAAC;aACnD,CAAC;YACF,KAAK,MAAM,IAAI,IAAI,CAAC,YAAY,EAAE,iBAAiB,CAAC;gBAClD,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,cAAc,EAAE,IAAI,CAAC,CAAC;oBACrD,MAAM,IAAI,eAAe,CAAC,kBAAkB,CAAC,CAAC;YAClD,SAAS,CAAC,OAAO,CAAC,CAAC;YACnB,OAAO,CAAC,IAAI,EAAE,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;QACnE,CAAC;aAAM,CAAC;YACN,MAAM,IAAI,GAAG,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,OAAO,CAAC,IAAI,CAAC,CAAC;YAC9C,MAAM,OAAO,GAAG,SAAS,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC;YACzC,KACE,IAAI,OAAO,GAAG,OAAO,CAAC,IAAI,CAAC,EAC3B,OAAO,KAAK,OAAO,CAAC,IAAI,EACxB,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,EAC1B,CAAC;gBACD,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;oBAChC,MAAM,IAAI,eAAe,CAAC,kBAAkB,CAAC,CAAC;YAClD,CAAC;YACD,MAAM,MAAM,GAAG,KAAK,CAAC,IAAI,CAAC,CAAC;YAC3B,MAAM,OAAO,GAAG,SAAS,CAAC,IAAI,CAAC,CAAC;YAChC,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,IAAI,OAAO,CAAC,KAAK,KAAK,CAAC;gBAC1C,MAAM,IAAI,eAAe,CAAC,kBAAkB,CAAC,CAAC;YAChD,IAAI,OAAO,CAAC,IAAI,GAAG,OAAO,CAAC,KAAK;gBAC9B,MAAM,IAAI,eAAe,CAAC,qBAAqB,CAAC,CAAC;YACnD,MAAM,EAAE,GAAG,QAAQ,CACjB,IAAI,EACJ,SAAS,CAAC,QAAQ,GAAG,SAAS,CAAC,UAAU,GAAG,SAAS,CAAC,UAAU,CACjE,CAAC;YACF,IAAI,KAAgB,CAAC;YACrB,IAAI,CAAC;gBACH,MAAM,MAAM,GAAG,SAAS,CAAC,EAAE,CAAC,CAAC;gBAC7B,IACE,CAAC,MAAM,CAAC,MAAM,EAAE;oBAChB,MAAM,CAAC,KAAK,KAAK,CAAC;oBAClB,MAAM,CAAC,GAAG,KAAK,OAAO,CAAC,GAAG;oBAC1B,MAAM,CAAC,GAAG,KAAK,OAAO,CAAC,GAAG;oBAE1B,MAAM,IAAI,eAAe,CAAC,qBAAqB,CAAC,CAAC;gBACnD,MAAM,MAAM,GAAG,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC;gBAC/C,IAAI,MAAM,GAAG,CAAC,CAAC;gBACf,OAAO,MAAM,GAAG,MAAM,CAAC,MAAM,EAAE,CAAC;oBAC9B,MAAM,IAAI,GAAG,QAAQ,CACnB,EAAE,EACF,MAAM,EACN,MAAM,EACN,MAAM,CAAC,MAAM,GAAG,MAAM,EACtB,MAAM,CACP,CAAC;oBACF,IAAI,CAAC,IAAI;wBAAE,MAAM;oBACjB,MAAM,IAAI,IAAI,CAAC;gBACjB,CAAC;gBACD,IAAI,MAAM,GAAG,OAAO,CAAC,KAAK;oBACxB,MAAM,IAAI,eAAe,CAAC,qBAAqB,CAAC,CAAC;gBACnD,SAAS,CAAC,OAAO,CAAC,CAAC;gBACnB,IAAI,KAAK,CAAC,IAAI,CAAC,KAAK,MAAM;oBACxB,MAAM,IAAI,eAAe,CAAC,qBAAqB,CAAC,CAAC;gBACnD,MAAM,KAAK,GAAG,MAAM,CAAC,QAAQ,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC;gBACzC,MAAM,IAAI,GAAG,IAAI,WAAW,CAAC,OAAO,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;gBACrE,IAAI,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC;oBAAE,MAAM,IAAI,eAAe,CAAC,kBAAkB,CAAC,CAAC;gBACrE,IAAI,KAAK,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;gBACjC,KAAK,MAAM,IAAI,IAAI,KAAK;oBAAE,IAAI,IAAI,KAAK,EAAE;wBAAE,KAAK,EAAE,CAAC;gBACnD,IAAI,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC;oBAAE,KAAK,EAAE,CAAC;gBACjC,KAAK,GAAG;oBACN,IAAI,EAAE,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC;oBACtD,KAAK,EAAE,MAAM;oBACb,KAAK;oBACL,KAAK,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;iBACzC,CAAC;YACJ,CAAC;oBAAS,CAAC;gBACT,SAAS,CAAC,EAAE,CAAC,CAAC;YAChB,CAAC;YACD,OAAO,CAAC,IAAI,EAAE,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;QAC1C,CAAC;IACH,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,OAAO,CAAC,IAAI,EAAE,CAAC;YACb,MAAM,EAAE,OAAO;YACf,MAAM,EACJ,KAAK,YAAY,eAAe,CAAC,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,kBAAkB;SACvE,CAAC,CAAC;IACL,CAAC;YAAS,CAAC;QACT,OAAO,CAAC,UAAU,EAAE,CAAC;IACvB,CAAC;AACH,CAAC,CAAC,CAAC"}

package/dist/local/source-evidence/processes.d.ts

@@ -0,0 +1,20 @@
+import { type FilesystemRequest } from './protocol.js';
+/** Trusted application-owned environment only. No arbitrary command/provider input. */
+export declare class SourceProcesses {
+    readonly root: string;
+    readonly signal: AbortSignal;
+    readonly max_calls: number;
+    readonly path: string | undefined;
+    calls: number;
+    constructor(root: string, signal: AbortSignal, max_calls: number, path?: string | undefined);
+    check(): void;
+    git(args: string[], limit?: number): Promise<Buffer>;
+    filesystem(request: FilesystemRequest): Promise<string | {
+        hash: string;
+        bytes: number;
+        lines: number;
+        stamp: string;
+    }>;
+    private join;
+}
+//# sourceMappingURL=processes.d.ts.map

package/dist/local/source-evidence/processes.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"processes.d.ts","sourceRoot":"","sources":["../../../src/local/source-evidence/processes.ts"],"names":[],"mappings":"AAEA,OAAO,EAIL,KAAK,iBAAiB,EACvB,MAAM,eAAe,CAAC;AAEvB,uFAAuF;AACvF,qBAAa,eAAe;IAGxB,QAAQ,CAAC,IAAI,EAAE,MAAM;IACrB,QAAQ,CAAC,MAAM,EAAE,WAAW;IAC5B,QAAQ,CAAC,SAAS,EAAE,MAAM;IAC1B,QAAQ,CAAC,IAAI;IALf,KAAK,SAAK;gBAEC,IAAI,EAAE,MAAM,EACZ,MAAM,EAAE,WAAW,EACnB,SAAS,EAAE,MAAM,EACjB,IAAI,qBAAmB;IAElC,KAAK,IAAI,IAAI;IAGP,GAAG,CACP,IAAI,EAAE,MAAM,EAAE,EACd,KAAK,GAAE,MAA0C,GAChD,OAAO,CAAC,MAAM,CAAC;IAwDZ,UAAU,CAAC,OAAO,EAAE,iBAAiB;;;;;;IAsC3C,OAAO,CAAC,IAAI;CAgBb"}

package/dist/local/source-evidence/processes.js

@@ -0,0 +1,133 @@
+import { fork, spawn } from 'node:child_process';
+import { fileURLToPath } from 'node:url';
+import { filesystem_result_schema, SourceReadError, SOURCE_READ_LIMITS } from './protocol.js';
+/** Trusted application-owned environment only. No arbitrary command/provider input. */
+export class SourceProcesses {
+    root;
+    signal;
+    max_calls;
+    path;
+    calls = 0;
+    constructor(root, signal, max_calls, path = process.env.PATH) {
+        this.root = root;
+        this.signal = signal;
+        this.max_calls = max_calls;
+        this.path = path;
+    }
+    check() {
+        if (this.signal.aborted)
+            throw this.signal.reason;
+    }
+    async git(args, limit = SOURCE_READ_LIMITS.metadata_bytes) {
+        this.check();
+        if (++this.calls > this.max_calls)
+            throw new SourceReadError('budget_insufficient');
+        const child = spawn('git', [
+            '--no-lazy-fetch',
+            '--no-replace-objects',
+            '--no-optional-locks',
+            '--literal-pathspecs',
+            '-c',
+            'core.fsmonitor=false',
+            ...args
+        ], {
+            cwd: this.root,
+            env: {
+                NODE_ENV: 'production',
+                PATH: this.path,
+                LC_ALL: 'C',
+                GIT_CONFIG_NOSYSTEM: '1',
+                GIT_CONFIG_GLOBAL: '/dev/null',
+                GIT_TERMINAL_PROMPT: '0',
+                GIT_ALLOW_PROTOCOL: ''
+            },
+            stdio: ['ignore', 'pipe', 'pipe']
+        });
+        const chunks = [];
+        let bytes = 0;
+        let stderr_bytes = 0;
+        let failure;
+        child.stdout.on('data', (chunk) => {
+            const remaining = Math.max(0, limit - bytes);
+            // Copy only permitted bytes; a subarray would retain the oversized pipe allocation.
+            if (remaining)
+                chunks.push(Buffer.from(chunk.subarray(0, remaining)));
+            bytes += chunk.length;
+            if (bytes > limit) {
+                failure = new SourceReadError('budget_insufficient');
+                child.kill('SIGKILL');
+            }
+        });
+        child.stderr.on('data', (chunk) => {
+            stderr_bytes += chunk.length;
+            if (stderr_bytes > SOURCE_READ_LIMITS.stderr_bytes) {
+                failure = new SourceReadError('budget_insufficient');
+                child.kill('SIGKILL');
+            }
+        });
+        const code = await this.join(child);
+        this.check();
+        if (failure)
+            throw failure;
+        if (code !== 0)
+            throw new SourceReadError('unsupported_read');
+        return Buffer.concat(chunks);
+    }
+    async filesystem(request) {
+        this.check();
+        const child = fork(fileURLToPath(new URL('./filesystem-worker.js', import.meta.url)), [], {
+            execArgv: ['--max-old-space-size=64'],
+            env: { NODE_ENV: 'production' },
+            stdio: ['ignore', 'ignore', 'ignore', 'ipc'],
+            serialization: 'json'
+        });
+        let answer;
+        let failed = false;
+        const fail = () => {
+            failed = true;
+            child.kill('SIGKILL');
+        };
+        child.on('message', (value) => {
+            const parsed = filesystem_result_schema.safeParse(value);
+            if (parsed.success && !answer && !failed)
+                answer = parsed.data;
+            else
+                fail();
+        });
+        const closed = this.join(child);
+        try {
+            child.send(request, (error) => {
+                if (error)
+                    fail();
+            });
+        }
+        catch {
+            fail();
+        }
+        const code = await closed;
+        this.check();
+        if (failed || code !== 0 || !answer)
+            throw new SourceReadError('unsupported_read');
+        if (answer.status === 'error')
+            throw new SourceReadError(answer.reason);
+        return answer.value;
+    }
+    join(child) {
+        return new Promise((resolve) => {
+            let failed = false;
+            const stop = () => child.kill('SIGKILL');
+            child.on('error', () => {
+                failed = true;
+                stop();
+            });
+            child.once('close', (code) => {
+                this.signal.removeEventListener('abort', stop);
+                resolve(failed ? null : code);
+            });
+            this.signal.addEventListener('abort', stop, { once: true });
+            if (this.signal.aborted)
+                stop();
+        });
+    }
+}
+//# sourceMappingURL=processes.js.map

package/dist/local/source-evidence/processes.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"processes.js","sourceRoot":"","sources":["../../../src/local/source-evidence/processes.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAE,KAAK,EAAqB,MAAM,oBAAoB,CAAC;AACpE,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AACzC,OAAO,EACL,wBAAwB,EACxB,eAAe,EACf,kBAAkB,EAEnB,MAAM,eAAe,CAAC;AAEvB,uFAAuF;AACvF,MAAM,OAAO,eAAe;IAGf;IACA;IACA;IACA;IALX,KAAK,GAAG,CAAC,CAAC;IACV,YACW,IAAY,EACZ,MAAmB,EACnB,SAAiB,EACjB,OAAO,OAAO,CAAC,GAAG,CAAC,IAAI;QAHvB,SAAI,GAAJ,IAAI,CAAQ;QACZ,WAAM,GAAN,MAAM,CAAa;QACnB,cAAS,GAAT,SAAS,CAAQ;QACjB,SAAI,GAAJ,IAAI,CAAmB;IAC/B,CAAC;IACJ,KAAK;QACH,IAAI,IAAI,CAAC,MAAM,CAAC,OAAO;YAAE,MAAM,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC;IACpD,CAAC;IACD,KAAK,CAAC,GAAG,CACP,IAAc,EACd,QAAgB,kBAAkB,CAAC,cAAc;QAEjD,IAAI,CAAC,KAAK,EAAE,CAAC;QACb,IAAI,EAAE,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,SAAS;YAC/B,MAAM,IAAI,eAAe,CAAC,qBAAqB,CAAC,CAAC;QACnD,MAAM,KAAK,GAAG,KAAK,CACjB,KAAK,EACL;YACE,iBAAiB;YACjB,sBAAsB;YACtB,qBAAqB;YACrB,qBAAqB;YACrB,IAAI;YACJ,sBAAsB;YACtB,GAAG,IAAI;SACR,EACD;YACE,GAAG,EAAE,IAAI,CAAC,IAAI;YACd,GAAG,EAAE;gBACH,QAAQ,EAAE,YAAY;gBACtB,IAAI,EAAE,IAAI,CAAC,IAAI;gBACf,MAAM,EAAE,GAAG;gBACX,mBAAmB,EAAE,GAAG;gBACxB,iBAAiB,EAAE,WAAW;gBAC9B,mBAAmB,EAAE,GAAG;gBACxB,kBAAkB,EAAE,EAAE;aACvB;YACD,KAAK,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,CAAC;SAClC,CACF,CAAC;QACF,MAAM,MAAM,GAAa,EAAE,CAAC;QAC5B,IAAI,KAAK,GAAG,CAAC,CAAC;QACd,IAAI,YAAY,GAAG,CAAC,CAAC;QACrB,IAAI,OAAoC,CAAC;QACzC,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,KAAa,EAAE,EAAE;YACxC,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,KAAK,GAAG,KAAK,CAAC,CAAC;YAC7C,oFAAoF;YACpF,IAAI,SAAS;gBAAE,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,EAAE,SAAS,CAAC,CAAC,CAAC,CAAC;YACtE,KAAK,IAAI,KAAK,CAAC,MAAM,CAAC;YACtB,IAAI,KAAK,GAAG,KAAK,EAAE,CAAC;gBAClB,OAAO,GAAG,IAAI,eAAe,CAAC,qBAAqB,CAAC,CAAC;gBACrD,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;YACxB,CAAC;QACH,CAAC,CAAC,CAAC;QACH,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,KAAa,EAAE,EAAE;YACxC,YAAY,IAAI,KAAK,CAAC,MAAM,CAAC;YAC7B,IAAI,YAAY,GAAG,kBAAkB,CAAC,YAAY,EAAE,CAAC;gBACnD,OAAO,GAAG,IAAI,eAAe,CAAC,qBAAqB,CAAC,CAAC;gBACrD,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;YACxB,CAAC;QACH,CAAC,CAAC,CAAC;QACH,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACpC,IAAI,CAAC,KAAK,EAAE,CAAC;QACb,IAAI,OAAO;YAAE,MAAM,OAAO,CAAC;QAC3B,IAAI,IAAI,KAAK,CAAC;YAAE,MAAM,IAAI,eAAe,CAAC,kBAAkB,CAAC,CAAC;QAC9D,OAAO,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;IAC/B,CAAC;IACD,KAAK,CAAC,UAAU,CAAC,OAA0B;QACzC,IAAI,CAAC,KAAK,EAAE,CAAC;QACb,MAAM,KAAK,GAAG,IAAI,CAChB,aAAa,CAAC,IAAI,GAAG,CAAC,wBAAwB,EAAE,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,EACjE,EAAE,EACF;YACE,QAAQ,EAAE,CAAC,yBAAyB,CAAC;YACrC,GAAG,EAAE,EAAE,QAAQ,EAAE,YAAY,EAAE;YAC/B,KAAK,EAAE,CAAC,QAAQ,EAAE,QAAQ,EAAE,QAAQ,EAAE,KAAK,CAAC;YAC5C,aAAa,EAAE,MAAM;SACtB,CACF,CAAC;QACF,IAAI,MAAqE,CAAC;QAC1E,IAAI,MAAM,GAAG,KAAK,CAAC;QACnB,MAAM,IAAI,GAAG,GAAG,EAAE;YAChB,MAAM,GAAG,IAAI,CAAC;YACd,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;QACxB,CAAC,CAAC;QACF,KAAK,CAAC,EAAE,CAAC,SAAS,EAAE,CAAC,KAAc,EAAE,EAAE;YACrC,MAAM,MAAM,GAAG,wBAAwB,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;YACzD,IAAI,MAAM,CAAC,OAAO,IAAI,CAAC,MAAM,IAAI,CAAC,MAAM;gBAAE,MAAM,GAAG,MAAM,CAAC,IAAI,CAAC;;gBAC1D,IAAI,EAAE,CAAC;QACd,CAAC,CAAC,CAAC;QACH,MAAM,MAAM,GAAG,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAChC,IAAI,CAAC;YACH,KAAK,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC,KAAK,EAAE,EAAE;gBAC5B,IAAI,KAAK;oBAAE,IAAI,EAAE,CAAC;YACpB,CAAC,CAAC,CAAC;QACL,CAAC;QAAC,MAAM,CAAC;YACP,IAAI,EAAE,CAAC;QACT,CAAC;QACD,MAAM,IAAI,GAAG,MAAM,MAAM,CAAC;QAC1B,IAAI,CAAC,KAAK,EAAE,CAAC;QACb,IAAI,MAAM,IAAI,IAAI,KAAK,CAAC,IAAI,CAAC,MAAM;YACjC,MAAM,IAAI,eAAe,CAAC,kBAAkB,CAAC,CAAC;QAChD,IAAI,MAAM,CAAC,MAAM,KAAK,OAAO;YAAE,MAAM,IAAI,eAAe,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;QACxE,OAAO,MAAM,CAAC,KAAK,CAAC;IACtB,CAAC;IACO,IAAI,CAAC,KAAmB;QAC9B,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE;YAC7B,IAAI,MAAM,GAAG,KAAK,CAAC;YACnB,MAAM,IAAI,GAAG,GAAG,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;YACzC,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE;gBACrB,MAAM,GAAG,IAAI,CAAC;gBACd,IAAI,EAAE,CAAC;YACT,CAAC,CAAC,CAAC;YACH,KAAK,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC,IAAI,EAAE,EAAE;gBAC3B,IAAI,CAAC,MAAM,CAAC,mBAAmB,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;gBAC/C,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;YAChC,CAAC,CAAC,CAAC;YACH,IAAI,CAAC,MAAM,CAAC,gBAAgB,CAAC,OAAO,EAAE,IAAI,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;YAC5D,IAAI,IAAI,CAAC,MAAM,CAAC,OAAO;gBAAE,IAAI,EAAE,CAAC;QAClC,CAAC,CAAC,CAAC;IACL,CAAC;CACF"}

package/dist/local/source-evidence/protocol.d.ts

@@ -0,0 +1,52 @@
+import { z } from 'zod';
+import type { ContextReason } from '../task-context-schema.js';
+export declare const SOURCE_READ_LIMITS: Readonly<{
+    file_bytes: 1048576;
+    aggregate_bytes: 4194304;
+    git_calls: 72;
+    metadata_bytes: 16384;
+    stderr_bytes: 8192;
+    mapping_bytes: 65536;
+}>;
+export declare function permittedSourcePath(path: string): boolean;
+export declare const exact_path: z.ZodString;
+export declare class SourceReadError extends Error {
+    readonly reason: ContextReason;
+    constructor(reason: ContextReason);
+}
+declare const file_value: z.ZodObject<{
+    hash: z.ZodString;
+    bytes: z.ZodNumber;
+    lines: z.ZodNumber;
+    stamp: z.ZodString;
+}, z.core.$strict>;
+export declare const filesystem_request_schema: z.ZodDiscriminatedUnion<[z.ZodObject<{
+    kind: z.ZodLiteral<"guard">;
+    root: z.ZodString;
+    common: z.ZodString;
+}, z.core.$strict>, z.ZodObject<{
+    kind: z.ZodLiteral<"file">;
+    root: z.ZodString;
+    path: z.ZodString;
+    limit: z.ZodNumber;
+}, z.core.$strict>], "kind">;
+export declare const filesystem_result_schema: z.ZodDiscriminatedUnion<[z.ZodObject<{
+    status: z.ZodLiteral<"ok">;
+    value: z.ZodUnion<readonly [z.ZodObject<{
+        hash: z.ZodString;
+        bytes: z.ZodNumber;
+        lines: z.ZodNumber;
+        stamp: z.ZodString;
+    }, z.core.$strict>, z.ZodString]>;
+}, z.core.$strict>, z.ZodObject<{
+    status: z.ZodLiteral<"error">;
+    reason: z.ZodEnum<{
+        changed_during_read: "changed_during_read";
+        unsupported_read: "unsupported_read";
+        budget_insufficient: "budget_insufficient";
+    }>;
+}, z.core.$strict>], "status">;
+export type FilesystemRequest = z.infer<typeof filesystem_request_schema>;
+export type FileValue = z.infer<typeof file_value>;
+export {};
+//# sourceMappingURL=protocol.d.ts.map

package/dist/local/source-evidence/protocol.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"protocol.d.ts","sourceRoot":"","sources":["../../../src/local/source-evidence/protocol.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,2BAA2B,CAAC;AAC/D,eAAO,MAAM,kBAAkB;;;;;;;EAO7B,CAAC;AACH,wBAAgB,mBAAmB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAgBzD;AACD,eAAO,MAAM,UAAU,aAIqD,CAAC;AAC7E,qBAAa,eAAgB,SAAQ,KAAK;IAC5B,QAAQ,CAAC,MAAM,EAAE,aAAa;gBAArB,MAAM,EAAE,aAAa;CAG3C;AACD,QAAA,MAAM,UAAU;;;;;kBAOL,CAAC;AACZ,eAAO,MAAM,yBAAyB;;;;;;;;;4BAYpC,CAAC;AACH,eAAO,MAAM,wBAAwB;;;;;;;;;;;;;;;8BAiBnC,CAAC;AACH,MAAM,MAAM,iBAAiB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,yBAAyB,CAAC,CAAC;AAC1E,MAAM,MAAM,SAAS,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,UAAU,CAAC,CAAC"}

package/dist/local/source-evidence/protocol.js

@@ -0,0 +1,72 @@
+import { isAbsolute } from 'node:path';
+import { z } from 'zod';
+export const SOURCE_READ_LIMITS = Object.freeze({
+    file_bytes: 1_048_576,
+    aggregate_bytes: 4_194_304,
+    git_calls: 72,
+    metadata_bytes: 16_384,
+    stderr_bytes: 8192,
+    mapping_bytes: 65_536
+});
+export function permittedSourcePath(path) {
+    const parts = path.split('/');
+    return (Buffer.byteLength(path) <= 1024 &&
+        !/[\\\0:\uD800-\uDFFF]/u.test(path) &&
+        parts.length <= 32 &&
+        parts.every((part) => !!part &&
+            !part.startsWith('.') &&
+            !/^(credentials|node_modules|vendor|dist|build|out|coverage|sdlc)$/i.test(part) &&
+            !/\.(pem|key|p12|pfx)$/i.test(part)));
+}
+export const exact_path = z
+    .string()
+    .min(1)
+    .max(4096)
+    .refine((value) => isAbsolute(value) && !/[\0\uD800-\uDFFF]/u.test(value));
+export class SourceReadError extends Error {
+    reason;
+    constructor(reason) {
+        super(reason);
+        this.reason = reason;
+    }
+}
+const file_value = z
+    .object({
+    hash: z.string().regex(/^[a-f0-9]{64}$/),
+    bytes: z.number().int().nonnegative().max(SOURCE_READ_LIMITS.file_bytes),
+    lines: z.number().int().nonnegative(),
+    stamp: z.string().max(16384)
+})
+    .strict();
+export const filesystem_request_schema = z.discriminatedUnion('kind', [
+    z
+        .object({ kind: z.literal('guard'), root: exact_path, common: exact_path })
+        .strict(),
+    z
+        .object({
+        kind: z.literal('file'),
+        root: exact_path,
+        path: z.string().min(1).max(1024).refine(permittedSourcePath),
+        limit: z.number().int().min(1).max(SOURCE_READ_LIMITS.file_bytes)
+    })
+        .strict()
+]);
+export const filesystem_result_schema = z.discriminatedUnion('status', [
+    z
+        .object({
+        status: z.literal('ok'),
+        value: z.union([file_value, z.string().max(16384)])
+    })
+        .strict(),
+    z
+        .object({
+        status: z.literal('error'),
+        reason: z.enum([
+            'unsupported_read',
+            'changed_during_read',
+            'budget_insufficient'
+        ])
+    })
+        .strict()
+]);
+//# sourceMappingURL=protocol.js.map

package/dist/local/source-evidence/protocol.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"protocol.js","sourceRoot":"","sources":["../../../src/local/source-evidence/protocol.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,WAAW,CAAC;AACvC,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,MAAM,CAAC,MAAM,kBAAkB,GAAG,MAAM,CAAC,MAAM,CAAC;IAC9C,UAAU,EAAE,SAAS;IACrB,eAAe,EAAE,SAAS;IAC1B,SAAS,EAAE,EAAE;IACb,cAAc,EAAE,MAAM;IACtB,YAAY,EAAE,IAAI;IAClB,aAAa,EAAE,MAAM;CACtB,CAAC,CAAC;AACH,MAAM,UAAU,mBAAmB,CAAC,IAAY;IAC9C,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC9B,OAAO,CACL,MAAM,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,IAAI;QAC/B,CAAC,uBAAuB,CAAC,IAAI,CAAC,IAAI,CAAC;QACnC,KAAK,CAAC,MAAM,IAAI,EAAE;QAClB,KAAK,CAAC,KAAK,CACT,CAAC,IAAI,EAAE,EAAE,CACP,CAAC,CAAC,IAAI;YACN,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC;YACrB,CAAC,mEAAmE,CAAC,IAAI,CACvE,IAAI,CACL;YACD,CAAC,uBAAuB,CAAC,IAAI,CAAC,IAAI,CAAC,CACtC,CACF,CAAC;AACJ,CAAC;AACD,MAAM,CAAC,MAAM,UAAU,GAAG,CAAC;KACxB,MAAM,EAAE;KACR,GAAG,CAAC,CAAC,CAAC;KACN,GAAG,CAAC,IAAI,CAAC;KACT,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,UAAU,CAAC,KAAK,CAAC,IAAI,CAAC,oBAAoB,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC;AAC7E,MAAM,OAAO,eAAgB,SAAQ,KAAK;IACnB;IAArB,YAAqB,MAAqB;QACxC,KAAK,CAAC,MAAM,CAAC,CAAC;QADK,WAAM,GAAN,MAAM,CAAe;IAE1C,CAAC;CACF;AACD,MAAM,UAAU,GAAG,CAAC;KACjB,MAAM,CAAC;IACN,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,gBAAgB,CAAC;IACxC,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,WAAW,EAAE,CAAC,GAAG,CAAC,kBAAkB,CAAC,UAAU,CAAC;IACxE,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,WAAW,EAAE;IACrC,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,KAAK,CAAC;CAC7B,CAAC;KACD,MAAM,EAAE,CAAC;AACZ,MAAM,CAAC,MAAM,yBAAyB,GAAG,CAAC,CAAC,kBAAkB,CAAC,MAAM,EAAE;IACpE,CAAC;SACE,MAAM,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,IAAI,EAAE,UAAU,EAAE,MAAM,EAAE,UAAU,EAAE,CAAC;SAC1E,MAAM,EAAE;IACX,CAAC;SACE,MAAM,CAAC;QACN,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC;QACvB,IAAI,EAAE,UAAU;QAChB,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,mBAAmB,CAAC;QAC7D,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,kBAAkB,CAAC,UAAU,CAAC;KAClE,CAAC;SACD,MAAM,EAAE;CACZ,CAAC,CAAC;AACH,MAAM,CAAC,MAAM,wBAAwB,GAAG,CAAC,CAAC,kBAAkB,CAAC,QAAQ,EAAE;IACrE,CAAC;SACE,MAAM,CAAC;QACN,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC;QACvB,KAAK,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC;KACpD,CAAC;SACD,MAAM,EAAE;IACX,CAAC;SACE,MAAM,CAAC;QACN,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC;QAC1B,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC;YACb,kBAAkB;YAClB,qBAAqB;YACrB,qBAAqB;SACtB,CAAC;KACH,CAAC;SACD,MAAM,EAAE;CACZ,CAAC,CAAC"}

package/dist/local/source-evidence/reader.d.ts

@@ -0,0 +1,14 @@
+import { OperationError } from '../operation.js';
+import { type SourceReadResult, type SourceBudget } from './schema.js';
+/** Internal library reader. Trusted mapping is separate from caller request JSON.
+ * No task-context composition, network transport, source-text output or mutation.
+ */
+export declare function readLocalSourceEvidence(input: {
+    request_json: string;
+    trusted_source_json?: string;
+    budget?: Partial<SourceBudget>;
+    signal?: AbortSignal;
+    timeout_ms?: number;
+    on_cleanup_timeout?: (error: OperationError) => void;
+}): Promise<SourceReadResult>;
+//# sourceMappingURL=reader.d.ts.map

package/dist/local/source-evidence/reader.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"reader.d.ts","sourceRoot":"","sources":["../../../src/local/source-evidence/reader.ts"],"names":[],"mappings":"AAOA,OAAO,EAGL,cAAc,EACf,MAAM,iBAAiB,CAAC;AAEzB,OAAO,EAML,KAAK,gBAAgB,EAGrB,KAAK,YAAY,EAElB,MAAM,aAAa,CAAC;AA0BrB;;GAEG;AACH,wBAAsB,uBAAuB,CAAC,KAAK,EAAE;IACnD,YAAY,EAAE,MAAM,CAAC;IACrB,mBAAmB,CAAC,EAAE,MAAM,CAAC;IAC7B,MAAM,CAAC,EAAE,OAAO,CAAC,YAAY,CAAC,CAAC;IAC/B,MAAM,CAAC,EAAE,WAAW,CAAC;IACrB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,kBAAkB,CAAC,EAAE,CAAC,KAAK,EAAE,cAAc,KAAK,IAAI,CAAC;CACtD,GAAG,OAAO,CAAC,gBAAgB,CAAC,CAgU5B"}