@starci/hfs 1.0.0 → 2.0.0

package/runtime/scripts/checks/common.mjs

@@ -0,0 +1,37 @@
+import fs from 'node:fs';
+import path from 'node:path';
+import {fileURLToPath} from 'node:url';
+
+/** Whether `target` is `root` itself or inside it (filesystem paths, either separator). */
+export function isInside(root, target) {
+  const relative = path.relative(root, target);
+  return relative === '' || (!relative.startsWith(`..${path.sep}`) && relative !== '..' && !path.isAbsolute(relative));
+}
+
+/** True when this module is the process entry point (`node file.mjs`, not an import). */
+export const isMain = (metaUrl, argv = process.argv) => Boolean(argv[1]) && path.resolve(argv[1]) === fileURLToPath(metaUrl);
+
+/**
+ * Every entry under `dir` that is not a directory, depth-first; `filter` sees the entry name and full
+ * path. `sorted` sorts each directory's entries by name (default: readdir order). `exclude`
+ * applies to files and directories before descent; `maxDepth` counts from the starting dir.
+ */
+export function walkFiles(dir, {filter = () => true, sorted = false, exclude = () => false,
+  maxDepth = Infinity, ignoreReadErrors = false} = {}) {
+  const out = [];
+  const visit = (current, depth) => {
+    if (depth > maxDepth) return;
+    let entries;
+    try { entries = fs.readdirSync(current, {withFileTypes: true}); }
+    catch (error) { if (ignoreReadErrors) return; throw error; }
+    if (sorted) entries = entries.sort((a, b) => a.name.localeCompare(b.name));
+    for (const entry of entries) {
+      const full = path.join(current, entry.name);
+      if (exclude(entry.name, full, entry)) continue;
+      if (entry.isDirectory()) visit(full, depth + 1);
+      else if (filter(entry.name, full)) out.push(full);
+    }
+  };
+  visit(dir, 0);
+  return out;
+}

package/runtime/scripts/checks/typescript-programs.mjs

@@ -0,0 +1,82 @@
+import { AsyncLocalStorage } from 'node:async_hooks';
+import { createRequire } from 'node:module';
+import path from 'node:path';
+
+// One TypeScript program per (compiler, root names, compiler options, project references) inside a program run, and
+// one value per (kind, compiler, input) for what callers derive from those programs (the architecture context).
+// check-scoped-lint opens one run around its architecture check and its script checkers and releases it before
+// ESLint and the base measurement, so nothing built here outlives the run that built it. Outside a run every call
+// builds afresh.
+const runs = new AsyncLocalStorage();
+
+/** A program run: run(fn) shares what is built inside fn; release() drops it. */
+export function typeScriptProgramRun() {
+  const values = new Map();
+  return {
+    run: fn => runs.run(values, fn),
+    release: () => values.clear(),
+  };
+}
+
+function keyOf(value) {
+  if (value === undefined) return 'u';
+  if (value === null || typeof value === 'string' || typeof value === 'number' || typeof value === 'boolean') return JSON.stringify(value);
+  if (Array.isArray(value)) {
+    const items = value.map(keyOf);
+    return items.includes(null) ? null : `[${items.join(',')}]`;
+  }
+  if (typeof value !== 'object' || (Object.getPrototypeOf(value) !== Object.prototype && Object.getPrototypeOf(value) !== null)) return null;
+  const entries = [];
+  for (const name of Object.keys(value).sort()) {
+    const item = keyOf(value[name]);
+    if (item === null) return null;
+    entries.push(`${JSON.stringify(name)}:${item}`);
+  }
+  return `{${entries.join(',')}}`;
+}
+
+/**
+ * build(), shared inside a program run by every caller that asks for the same kind, compiler and input. An input that
+ * is not plain data (a function, a class instance) is never shared.
+ */
+export function sharedInProgramRun(kind, ts, input, build) {
+  const values = runs.getStore();
+  const key = values ? keyOf(input) : null;
+  if (key === null) return build();
+  let byKey = values.get(ts);
+  if (!byKey) values.set(ts, byKey = new Map());
+  const id = `${kind}\0${key}`;
+  if (!byKey.has(id)) byKey.set(id, build());
+  return byKey.get(id);
+}
+
+/** ts.createProgram, shared inside a program run. */
+export function createTypeScriptProgram(ts, { rootNames, options, projectReferences }) {
+  return sharedInProgramRun('program', ts, { rootNames, options, projectReferences },
+    () => ts.createProgram({ rootNames, options, projectReferences }));
+}
+
+/** Read and expand a tsconfig with the caller's TypeScript compiler and optional tracked file reader. */
+export function readTypeScriptProject(ts, configFile, readFile = ts.sys.readFile) {
+  const read = ts.readConfigFile(configFile, readFile);
+  if (read.error) return { read, parsed: null };
+  const host = readFile === ts.sys.readFile ? ts.sys : { ...ts.sys, readFile };
+  return { read, parsed: ts.parseJsonConfigFileContent(read.config, host, path.dirname(configFile), undefined, configFile) };
+}
+
+/** Resolve a project reference with the compiler's API, including older compiler fallback. */
+export function typeScriptProjectReferencePath(ts, reference) {
+  if (typeof ts.resolveProjectReferencePath === 'function') return ts.resolveProjectReferencePath(reference);
+  return path.extname(reference.path) ? reference.path : path.join(reference.path, 'tsconfig.json');
+}
+
+/** Resolve an import using the selected project's compiler options. */
+export function resolveTypeScriptModule(ts, specifier, from, options, host = ts.sys) {
+  return ts.resolveModuleName(specifier, from, options, host).resolvedModule?.resolvedFileName;
+}
+
+/** Configuration imports prefer Node's package resolution, then the selected TypeScript project. */
+export function resolveNodeOrTypeScriptModule(ts, specifier, from, options, host = ts.sys) {
+  try { return createRequire(from).resolve(specifier); }
+  catch { return resolveTypeScriptModule(ts, specifier, from, options, host); }
+}

package/runtime/scripts/lib/artifact-hold.mjs

@@ -0,0 +1,89 @@
+// artifact-hold.mjs — the retention exemption for job proofs. A path an indexed job artifact lives at
+// (job_artifacts, engine/migrations/runtime/0001-init.sql), a tree holding one, and the evidence directory around one (never a shared root:
+// the repository, .starciwork, .starciwork/evidence or .starciwork/kernel-evidence itself) are never
+// removed by housekeeping, whatever the workflow's phase (running, finished, archived); nor is the repository's
+// ledger .starciwork/runtime.sqlite (it holds the typed logs since 2026-09-27, scripts/kernel/typed-logs.mjs), nor the
+// retired logs file .starciwork/logs.sqlite or its logs.sqlite.migrated-<date> copy, nor a tree holding one. Every
+// runtime delete of a tree (safe-remove.mjs safeRemoveTree) and every housekeeping unlink asks artifactHoldOf first.
+// Proofs, artifacts and logs are deleted ONLY by the owner-approved workflow purge (scripts/work/purge-workflow.mjs:
+// archive to a verified ZIP, then delete the finished workflow as a unit), never here.
+//
+// The ledgers are the ones the machine registry enrols (machine.sqlite `ledgers`); a ledger's repository is
+// the directory above its .starciwork. Only a target that overlaps a registered repository opens that
+// ledger, read-only, so a temp or lane sweep never touches sqlite past the registry read.
+import fs from 'node:fs';
+import path from 'node:path';
+import { createRequire } from 'node:module';
+import { hasLedgerColumn, hasLedgerTable, openLedgerReader } from '../../engine/ledger-db.mjs';
+import { machineFileFor, readMachine } from '../../engine/machine-db.mjs';
+import { pathKey, sameOrUnder } from './path-key.mjs';
+
+const require = createRequire(import.meta.url);
+const REGISTRY_TTL_MS = 30000;
+const norm = pathKey;
+let cache = { file: null, at: 0, repos: [] };
+
+const openReadOnly = (file) => openLedgerReader(file);
+
+/** The repositories whose ledgers the registry enrols: [{repo, ledger}], cached briefly per registry file; null when the registry cannot be read. */
+export function registeredRepos({ env = process.env, now = Date.now() } = {}) {
+  const file = machineFileFor(env);
+  if (cache.file === file && now - cache.at < REGISTRY_TTL_MS) return cache.repos;
+  const repos = fs.existsSync(file) ? readMachine((m) => m.listLedgers().map((l) => ({ ledger: l.file, repo: l.repoRoot })), null, { file, env }) : [];
+  cache = { file, at: now, repos };
+  return repos;
+}
+
+/**
+ * Null when removing `target` touches no indexed artifact; else {ledger, repo, paths:[...up to 5], count}.
+ * Held: an indexed file at or sameOrUnder `target`, or `target` inside the directory of an indexed file.
+ * A ledger that cannot be read holds its whole repository, and an unreadable registry holds every path in or
+ * holding a .starciwork directory - where every indexed artifact lives (fail closed).
+ */
+export function artifactHoldOf(target, { env = process.env, repos = registeredRepos({ env }) } = {}) {
+  const t = norm(target);
+  if (repos === null) {
+    const work = t.split('/').includes('.starciwork') || fs.existsSync(path.join(target, '.starciwork'));
+    return work ? { ledger: machineFileFor(env), repo: null, paths: [], count: null, error: 'the machine registry cannot be read' } : null;
+  }
+  for (const { ledger, repo } of repos) {
+    const r = norm(repo);
+    if (!sameOrUnder(t, r) && !sameOrUnder(r, t)) continue;
+    // The repository's typed logs (scripts/kernel/typed-logs.mjs: the ledger's logs table, and the retired logs.sqlite
+    // with its migrated copy) are append-only history: never swept.
+    const work = path.join(repo, '.starciwork');
+    const logFiles = [path.basename(ledger), 'logs.sqlite', ...(fs.existsSync(work) && sameOrUnder(norm(work), t) ? fs.readdirSync(work).filter((n) => /^logs\.sqlite\.migrated-/.test(n)) : [])]
+      .filter((name, i, all) => all.indexOf(name) === i).map((name) => path.join(work, name)).filter((file) => sameOrUnder(norm(file), t) && fs.existsSync(file));
+    if (logFiles.length) return { ledger, repo, paths: logFiles.map((file) => `.starciwork/${path.basename(file)}`), count: logFiles.length };
+    if (!fs.existsSync(ledger)) continue;
+    let paths;
+    try {
+      const db = openReadOnly(ledger);
+      // alpha.3: job_artifacts index blobs by sha256 and hold no repository path (no `path` column), so an alpha.3
+      // ledger holds no tree; only a ledger that still indexes paths does.
+      try { paths = hasLedgerTable(db, 'job_artifacts') && hasLedgerColumn(db, 'job_artifacts', 'path') ? db.prepare('SELECT DISTINCT path FROM job_artifacts').all().map((row) => row.path) : []; }
+      finally { db.close(); }
+    } catch (error) {
+      return { ledger, repo, paths: [], count: null, error: String(error?.message ?? error) };
+    }
+    // "Around" holds an evidence directory, never a shared root: an artifact filed at the repository root or directly
+    // in .starciwork (e.g. a scope op indexing .starciwork/index.yaml) held every tree sameOrUnder it, so no purge could
+    // remove an archived workflow's kernel-evidence directory.
+    const shared = new Set([r, norm(work), norm(path.join(work, 'evidence')), norm(path.join(work, 'kernel-evidence'))]);
+    const held = paths.filter((rel) => {
+      const abs = norm(path.join(repo, rel));
+      const dir = norm(path.dirname(abs));
+      return sameOrUnder(abs, t) || (!shared.has(dir) && sameOrUnder(t, dir));
+    });
+    if (held.length) return { ledger, repo, paths: held.slice(0, 5), count: held.length };
+  }
+  return null;
+}
+
+/** artifactHoldOf as one refusal line, or null. */
+export const artifactHoldReason = (target, options) => {
+  const hold = artifactHoldOf(target, options);
+  if (!hold) return null;
+  return hold.error ? `the ledger ${hold.ledger} holding indexed job artifacts cannot be read (${hold.error})`
+    : `${hold.count} indexed job artifact(s) of ${hold.ledger} (${hold.paths.join(', ')})`;
+};

package/runtime/scripts/lib/artifact-store.mjs

@@ -0,0 +1,103 @@
+// Content-addressed operational evidence. Blob bytes are immutable and never removed here.
+import fs from 'node:fs';
+import os from 'node:os';
+import path from 'node:path';
+import crypto from 'node:crypto';
+
+export const ARTIFACT_ROOT_ENV = 'STARCI_ARTIFACT_ROOT';
+export const artifactRoot = (env = process.env) => path.resolve(env[ARTIFACT_ROOT_ENV] || path.join(os.homedir(), '.starci', 'artifacts'));
+const SHA = /^[a-f0-9]{64}$/;
+const assertSha = sha => {
+  if (typeof sha !== 'string' || !SHA.test(sha)) throw new TypeError('blob sha must be a lowercase sha256 hex digest');
+  return sha;
+};
+const location = sha => path.join(artifactRoot(), assertSha(sha).slice(0, 2), sha);
+const metadataPath = sha => `${location(sha)}.json`;
+const digest = bytes => crypto.createHash('sha256').update(bytes).digest('hex');
+
+// Reject roots inside a checkout, including worktrees whose .git is a file.
+function ensureExternalRoot(root) {
+  let cursor = root;
+  while (true) {
+    if (fs.existsSync(path.join(cursor, '.git'))) throw new Error(`artifact root is inside a git checkout: ${root}`);
+    const parent = path.dirname(cursor);
+    if (parent === cursor) return;
+    cursor = parent;
+  }
+}
+
+function sourceBytes(bufferOrPath) {
+  if (Buffer.isBuffer(bufferOrPath)) return bufferOrPath;
+  if (bufferOrPath instanceof Uint8Array) return Buffer.from(bufferOrPath);
+  if (typeof bufferOrPath === 'string') return fs.readFileSync(bufferOrPath);
+  throw new TypeError('putBlob expects a Buffer, Uint8Array, or file path');
+}
+
+function publishOnce(destination, bytes) {
+  const dir = path.dirname(destination);
+  fs.mkdirSync(dir, { recursive: true });
+  const temp = path.join(dir, `.${path.basename(destination)}.${process.pid}.${crypto.randomUUID()}.tmp`);
+  try {
+    fs.writeFileSync(temp, bytes, { flag: 'wx' });
+    try { fs.linkSync(temp, destination); }
+    catch (error) { if (error.code !== 'EEXIST') throw error; }
+  } finally { try { fs.unlinkSync(temp); } catch (error) { if (error.code !== 'ENOENT') throw error; } }
+}
+
+/** Store original bytes under their sha256. A concurrent or repeated put never replaces published bytes. */
+export function putBlob(bufferOrPath, { mediaType = 'application/octet-stream' } = {}) {
+  if (typeof mediaType !== 'string' || !mediaType.trim()) throw new TypeError('mediaType must be a nonempty string');
+  const root = artifactRoot();
+  ensureExternalRoot(root);
+  const bytes = sourceBytes(bufferOrPath);
+  const sha = digest(bytes);
+  const destination = location(sha);
+  const metadata = { size: bytes.length, mediaType, createdAt: new Date().toISOString() };
+  // Metadata is published first so a visible blob always has a sidecar. A crash can leave an orphan sidecar;
+  // the next put completes it. The first published media type and creation time win.
+  publishOnce(metadataPath(sha), Buffer.from(JSON.stringify(metadata)));
+  publishOnce(destination, bytes);
+  const stored = fs.statSync(destination);
+  if (stored.size !== bytes.length) throw new Error(`blob size mismatch: ${sha}`);
+  const info = statBlob(sha);
+  return { sha, size: info.size, mediaType: info.mediaType };
+}
+
+export function blobPath(sha) {
+  const file = location(sha);
+  return fs.existsSync(file) && fs.statSync(file).isFile() ? file : null;
+}
+
+export const hasBlob = sha => blobPath(sha) !== null;
+
+export function getBlob(sha) {
+  const file = blobPath(sha);
+  if (!file) throw Object.assign(new Error(`blob not found: ${sha}`), { code: 'ENOENT' });
+  const bytes = fs.readFileSync(file);
+  if (digest(bytes) !== sha) throw new Error(`blob hash mismatch: ${sha}`);
+  return bytes;
+}
+
+export function statBlob(sha) {
+  const file = blobPath(sha);
+  if (!file) return null;
+  const { size } = fs.statSync(file);
+  const metadata = JSON.parse(fs.readFileSync(metadataPath(sha), 'utf8'));
+  if (metadata.size !== size) throw new Error(`blob sidecar size mismatch: ${sha}`);
+  return { sha, size, mediaType: metadata.mediaType, createdAt: metadata.createdAt };
+}
+
+function canonical(value) {
+  if (value && typeof value === 'object') {
+    if (typeof value.toJSON === 'function') return canonical(value.toJSON());
+    if (Array.isArray(value)) return value.map(item => item === undefined ? null : canonical(item));
+    return Object.fromEntries(Object.keys(value).sort().filter(key => value[key] !== undefined).map(key => [key, canonical(value[key])]));
+  }
+  return value;
+}
+
+export function putJson(obj) {
+  const encoded = JSON.stringify(canonical(obj));
+  if (encoded === undefined) throw new TypeError('putJson expects a JSON value');
+  return putBlob(Buffer.from(encoded), { mediaType: 'application/json' }).sha;
+}

package/runtime/scripts/lib/fs-kind.mjs

@@ -0,0 +1,10 @@
+// fs-kind.mjs — the forgiving fs.statSync probes a dozen scripts re-declared by hand.
+// A missing or unreadable path is false/null, never a throw; the stat syscall decides kind.
+import fs from 'node:fs';
+
+/** `p` names a file; false on any stat error (missing path, dangling link, EPERM). */
+export const isFile = (p) => { try { return fs.statSync(p).isFile(); } catch { return false; } };
+/** `p` names a directory; false on any stat error. */
+export const isDir = (p) => { try { return fs.statSync(p).isDirectory(); } catch { return false; } };
+/** `p`'s canonical spelling via the filesystem (links resolved), or null when it cannot be read. */
+export const realpathOr = (p) => { try { return fs.realpathSync.native(p); } catch { return null; } };

package/runtime/scripts/lib/git.mjs

@@ -0,0 +1,53 @@
+// git.mjs — the one spawn the runtime's guard/kernel scripts run git through.
+//
+// Every copy spelt the same options by hand - encoding:'utf8', windowsHide:true, sometimes a
+// timeout - with two shapes: `git args` in a cwd (shim's pathspec scans, footprint-scan,
+// safe-remove's prune) and `git -C dir args` (settle-landed, install, terminal-dedupe's worktree
+// list). gitOutput is the throwing shape (stdout text, or an Error on a non-zero exit). gitSpawn keeps the spawnSync(file, args, options) signature so an injected runner or a
+// spec's fake takes the same three arguments; runGit is the `-C` convenience; gitResult folds the
+// result into settle-landed's {ok, stdout, error} envelope.
+import { spawnSync } from 'node:child_process';
+
+/**
+ * Spawn `file` (the git binary) once with `args`: utf8 text, a hidden window, never a shell.
+ * Options pass through last, so cwd, timeout, input, env or maxBuffer land as given. encoding:'buffer'
+ * is a request for raw bytes, not an encoding: spawnSync encodes a string `input` with it and throws
+ * ERR_UNKNOWN_ENCODING, so it reaches spawnSync as encoding:null (Buffer output either way).
+ */
+export const gitSpawn = (file, args, options = {}) => {
+  const spawn = { encoding: 'utf8', windowsHide: true, ...options };
+  if (spawn.encoding === 'buffer') spawn.encoding = null;
+  return spawnSync(file, args, spawn);
+};
+
+/** `git args` in `cwd`, or `git -C dir args` when `dir` is given. `git` overrides the binary. */
+export const runGit = (args, { cwd = null, dir = null, git = 'git', ...options } = {}) =>
+  gitSpawn(git, [...(dir ? ['-C', dir] : []), ...args], cwd ? { cwd, ...options } : options);
+
+/** runGit's stdout as text; throws the spawn error, or an Error carrying git's stderr and exit status, unless git exits 0. */
+export function gitOutput(args, options = {}) {
+  const r = runGit(args, options);
+  if (r.error) throw r.error;
+  if (r.status !== 0) throw Object.assign(new Error(`git ${args.join(' ')} exited ${r.status}: ${(r.stderr ?? '').trim()}`), { status: r.status, stderr: r.stderr });
+  return r.stdout;
+}
+
+/** runGit's result as {ok, stdout, error}: ok only on a clean exit, error from stderr or the spawn. */
+export function gitResult(args, options = {}) {
+  const r = runGit(args, options);
+  return {
+    ok: !r.error && r.status === 0,
+    stdout: r.stdout ?? '',
+    error: (r.stderr ?? '').trim() || String(r.error?.message ?? (r.status == null ? 'timed out' : `exit ${r.status}`)),
+  };
+}
+
+/**
+ * git's C-quoted diff path decoded - `"b\303\251"` a `+++ ` header line prints when core.quotePath
+ * covers the name. Octal escapes become \u00XX for JSON.parse (which answers \n, \t, \" and \\);
+ * a value not wrapped in quotes passes through unchanged.
+ */
+export const unquoteDiffPath = (value) =>
+  /^".*"$/.test(value)
+    ? JSON.parse(value.replace(/\\([0-7]{3})/g, (_, octal) => `\\u00${Number.parseInt(octal, 8).toString(16).padStart(2, '0')}`))
+    : value;

package/runtime/scripts/lib/hfs-allows.mjs

@@ -0,0 +1,57 @@
+import path from 'node:path';
+import { braceVariants, globExpression } from './glob.mjs';
+
+/**
+ * What a slot's `requires`, `allows` and `forbids` entries (knowledge/hfs/slots.yaml) say about a file, read through the
+ * resolver of scripts/lib/hfs-slots.mjs. The machine checks that judge "this folder holds only what its slot allows"
+ * (feature-shape, fe-slot-allows) and the front-end lint rules (through `hfs.allows(file)` of scripts/lib/hfs-view.mjs) read it here so no check keeps a path list.
+ *
+ * An entry is a name relative to the slot instance root: `<var>` is the instance's bound variable when the slot binds it
+ * (`<feature>`, `<capability>`) and one path segment of any text otherwise (`<action>`), `*` and `?` stay inside a segment,
+ * `{a,b}` alternates, a trailing `/` names a directory and everything below it.
+ */
+const VAR = /<([A-Za-z][A-Za-z0-9-]*)>/g;
+
+function matchersOf(entries, bindings) {
+  return (entries ?? []).flatMap(entry => {
+    const directory = entry.endsWith('/');
+    const body = directory ? entry.slice(0, -1) : entry;
+    const filled = body.replace(VAR, (whole, name) => bindings[name] ?? '*');
+    return braceVariants(filled).map(variant => ({ entry, directory, expression: globExpression(directory ? `${variant}/**` : variant) }));
+  });
+}
+
+/** The path of `file` below the instance root of the slot that owns it. */
+export function relativeToRoot(file, root) {
+  return root && file.startsWith(`${root}/`) ? file.slice(root.length + 1) : path.posix.basename(file);
+}
+
+/**
+ * Whether the slot that owns `file` names it in `requires` or `allows` (and does not forbid it); null when no enabled slot
+ * owns it. Unlike allowsFile it judges a slot that lists only `requires` too, so a folder closed by its slot (an app's
+ * src/) is read from the slot and never from a check's own list.
+ */
+export function slotAdmitsFile(resolver, file) {
+  const classified = resolver.classifyPath(file);
+  if (classified.status === 'no-slot' || classified.status === 'ambiguous' || !classified.slot) return null;
+  const slot = resolver.slot(classified.slot);
+  const relative = relativeToRoot(classified.path, classified.root);
+  const hit = matchersOf([...(slot.requires ?? []), ...(slot.allows ?? [])], classified.bindings).find(matcher => matcher.expression.test(relative));
+  const forbidden = matchersOf(slot.forbids, classified.bindings).find(matcher => matcher.expression.test(relative) || matcher.expression.test(`${relative}/`));
+  return Boolean(hit) && !forbidden;
+}
+
+/**
+ * {slot, root, relative, allowed, entry?, forbiddenBy?} for a repository-relative file, or null when no enabled slot owns
+ * it or the slot names no `allows`. `allowed` is true when the relative path matches a `requires` or `allows` entry.
+ */
+export function allowsFile(resolver, file) {
+  const classified = resolver.classifyPath(file);
+  if (classified.status === 'no-slot' || classified.status === 'ambiguous' || !classified.slot) return null;
+  const slot = resolver.slot(classified.slot);
+  if (!slot?.allows?.length) return null;
+  const relative = relativeToRoot(classified.path, classified.root);
+  const hit = matchersOf([...(slot.requires ?? []), ...slot.allows], classified.bindings).find(matcher => matcher.expression.test(relative));
+  const forbidden = matchersOf(slot.forbids, classified.bindings).find(matcher => matcher.expression.test(relative) || matcher.expression.test(`${relative}/`));
+  return { slot: slot.id, root: classified.root, relative, allowed: Boolean(hit) && !forbidden, entry: hit?.entry, forbiddenBy: forbidden?.entry, allows: slot.allows };
+}