@superblocksteam/vite-plugin-file-sync 2.0.117 → 2.0.118-next.0

package/dist/ai-service/app-interface/npm-registry.d.ts

@@ -0,0 +1,123 @@
+/**
+ * Scopes whose existing `<scope>:registry=` lines in a project / pod `.npmrc`
+ * must survive `writeNpmrc` calls. Shared between AppShell, TemplateRenderer,
+ * and any other call site so a new scope only needs to be added in one place.
+ *
+ * `setup-template.sh` bakes
+ * `@superblocksteam:registry=https://npm.pkg.github.com/` into the template
+ * `.npmrc` for ephemeral environments; we must not clobber it.
+ */
+export declare const PRESERVE_NPMRC_SCOPES: string[];
+/**
+ * Configuration for an npm registry sourced from environment variables.
+ *
+ * The "single-host MVP" surface is `url` + `token`; `scopes` is plumbed for
+ * forward-compatibility (two-host setups like @superblocksteam on GitHub
+ * Packages plus third-party deps on Artifactory) but admin UX is deferred.
+ */
+export interface NpmRegistryConfig {
+    /** Default registry URL (e.g. https://artifactory.example.com/api/npm/npm-virtual/) */
+    url: string;
+    /** Optional auth token for the default registry host */
+    token?: string;
+    /**
+     * Optional per-scope registry mappings. e.g.
+     *   { "@superblocksteam": "https://npm.pkg.github.com/" }
+     */
+    scopes?: Record<string, string>;
+    /**
+     * When true, AppShell refuses to run npm if the registry env is unset.
+     * Plumbed for the upcoming `SUPERBLOCKS_REQUIRE_PRIVATE_REGISTRY` enforcement
+     * branch; not yet read by any consumer in this PR.
+     */
+    require?: boolean;
+}
+/**
+ * Reads the npm registry env contract and returns a typed config, or undefined
+ * when `SUPERBLOCKS_NPM_REGISTRY` is unset or invalid (preserves SaaS / local
+ * behavior). Invalid values are logged as warnings and treated as unset rather
+ * than half-broken (avoids landing a `.npmrc` with a malformed `registry=`
+ * line and no `_authToken=`).
+ *
+ * Env contract:
+ * - SUPERBLOCKS_NPM_REGISTRY: full registry URL
+ * - SUPERBLOCKS_NPM_REGISTRY_TOKEN: optional auth token
+ * - SUPERBLOCKS_NPM_REGISTRY_SCOPES_JSON: optional JSON map of scope -> URL
+ * - SUPERBLOCKS_REQUIRE_PRIVATE_REGISTRY: opt-in strict mode (default off)
+ */
+export declare function getNpmRegistryConfig(env?: NodeJS.ProcessEnv): NpmRegistryConfig | undefined;
+export interface WriteNpmrcOptions {
+    /**
+     * Scope prefixes (e.g. `@superblocksteam`) whose existing
+     * `<scope>:registry=` lines must survive. Used to preserve scope mappings
+     * baked into a template `.npmrc` by setup-template.sh in EE builds.
+     */
+    preserveScopeLines?: string[];
+}
+/**
+ * Renders the npm registry config to an `.npmrc` file at `targetPath`.
+ *
+ * When `preserveScopeLines` is provided, any existing `<scope>:registry=`
+ * lines for those scopes are preserved verbatim (so EE-baked
+ * `@superblocksteam:registry=https://npm.pkg.github.com/` survives) UNLESS
+ * the same scope is explicitly overridden in `config.scopes`.
+ *
+ * Idempotent: rewrites the file in full each call. Writes are atomic (tmp +
+ * rename) and the file mode is restricted to 0600 because the file may carry
+ * an auth token.
+ */
+export declare function writeNpmrc(targetPath: string, config: NpmRegistryConfig, options?: WriteNpmrcOptions): Promise<void>;
+/**
+ * Convenience: invoke `writeNpmrc` against `<dir>/.npmrc` if registry config is
+ * present in the env. No-op when unset (preserves today's behavior for SaaS /
+ * local dev).
+ *
+ * Returns the loaded config when an `.npmrc` was written, otherwise `undefined`.
+ */
+export declare function maybeWriteNpmrcForDir(dir: string, options?: WriteNpmrcOptions, env?: NodeJS.ProcessEnv): Promise<NpmRegistryConfig | undefined>;
+/**
+ * Materializes the private-registry `.npmrc` AND strips `resolved` URLs from
+ * any lockfile present in `dir`, so a subsequent `npm install` is guaranteed
+ * to re-resolve through the active registry. No-op when the env contract is
+ * unset.
+ *
+ * Combines `maybeWriteNpmrcForDir` with `stripResolvedFromLockfile`. The two
+ * always go together at install call sites because:
+ *   - Writing `.npmrc` alone is insufficient: `resolved` URLs in the
+ *     lockfile silently bypass it.
+ *   - Stripping `resolved` alone is insufficient: npm would re-resolve
+ *     against the wrong registry (or fail with no auth).
+ *
+ * Returns the loaded config when an `.npmrc` was written (also implying the
+ * lockfile was stripped), otherwise `undefined`.
+ */
+export declare function prepareForPrivateRegistry(dir: string, options?: WriteNpmrcOptions, env?: NodeJS.ProcessEnv): Promise<NpmRegistryConfig | undefined>;
+/**
+ * Removes the `resolved` field from every entry in `.packages` of an npm v2+
+ * lockfile. TS-side counterpart to `scripts/strip-lockfile-resolved.sh`.
+ *
+ * Same goal: npm honors `resolved` URLs verbatim, so a lockfile whose entries
+ * point at registry.npmjs.org keeps fetching from npmjs even after we've
+ * written a private `registry=` line to `.npmrc`. Stripping forces npm to
+ * re-resolve through the active registry.
+ *
+ * Use at runtime for *brownfield* apps — apps imported into Superblocks with
+ * a lockfile baked at customer-side npm install time (typically against
+ * npmjs.org). Greenfield template lockfiles are stripped at image-build time
+ * by the bash script; this function handles the rest.
+ *
+ * Behavior:
+ *   - Strips both `<dir>/package-lock.json` and the hidden
+ *     `<dir>/node_modules/.package-lock.json` if present.
+ *   - No-op when neither file exists (brownfield apps may not have a
+ *     lockfile yet).
+ *   - Idempotent: a second call against an already-stripped file is a no-op.
+ *   - Malformed JSON or wrong shape -> logged warning, file left untouched.
+ *     We don't throw because the consuming `npm install` will surface a
+ *     clearer error on the same lockfile, and an unrelated parse bug here
+ *     should not block the user's install.
+ *   - Atomic: writes via tmp + rename to avoid leaving a partial lockfile on
+ *     crash mid-write.
+ */
+export declare function stripResolvedFromLockfile(dir: string): Promise<void>;
+//# sourceMappingURL=npm-registry.d.ts.map

package/dist/ai-service/app-interface/npm-registry.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"npm-registry.d.ts","sourceRoot":"","sources":["../../../src/ai-service/app-interface/npm-registry.ts"],"names":[],"mappings":"AAYA;;;;;;;;GAQG;AACH,eAAO,MAAM,qBAAqB,UAAuB,CAAC;AAE1D;;;;;;GAMG;AACH,MAAM,WAAW,iBAAiB;IAChC,uFAAuF;IACvF,GAAG,EAAE,MAAM,CAAC;IACZ,wDAAwD;IACxD,KAAK,CAAC,EAAE,MAAM,CAAC;IACf;;;OAGG;IACH,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAChC;;;;OAIG;IACH,OAAO,CAAC,EAAE,OAAO,CAAC;CACnB;AAwCD;;;;;;;;;;;;GAYG;AACH,wBAAgB,oBAAoB,CAClC,GAAG,GAAE,MAAM,CAAC,UAAwB,GACnC,iBAAiB,GAAG,SAAS,CAsF/B;AAmCD,MAAM,WAAW,iBAAiB;IAChC;;;;OAIG;IACH,kBAAkB,CAAC,EAAE,MAAM,EAAE,CAAC;CAC/B;AAED;;;;;;;;;;;GAWG;AACH,wBAAsB,UAAU,CAC9B,UAAU,EAAE,MAAM,EAClB,MAAM,EAAE,iBAAiB,EACzB,OAAO,GAAE,iBAAsB,GAC9B,OAAO,CAAC,IAAI,CAAC,CAiFf;AAED;;;;;;GAMG;AACH,wBAAsB,qBAAqB,CACzC,GAAG,EAAE,MAAM,EACX,OAAO,GAAE,iBAAsB,EAC/B,GAAG,GAAE,MAAM,CAAC,UAAwB,GACnC,OAAO,CAAC,iBAAiB,GAAG,SAAS,CAAC,CAOxC;AAED;;;;;;;;;;;;;;;GAeG;AACH,wBAAsB,yBAAyB,CAC7C,GAAG,EAAE,MAAM,EACX,OAAO,GAAE,iBAAsB,EAC/B,GAAG,GAAE,MAAM,CAAC,UAAwB,GACnC,OAAO,CAAC,iBAAiB,GAAG,SAAS,CAAC,CAMxC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AACH,wBAAsB,yBAAyB,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAO1E"}

package/dist/ai-service/app-interface/npm-registry.js

@@ -0,0 +1,395 @@
+import { chmod, mkdir, readFile, rename, stat, writeFile, } from "node:fs/promises";
+import * as path from "node:path";
+import { getLogger } from "../../util/logger.js";
+/**
+ * Scopes whose existing `<scope>:registry=` lines in a project / pod `.npmrc`
+ * must survive `writeNpmrc` calls. Shared between AppShell, TemplateRenderer,
+ * and any other call site so a new scope only needs to be added in one place.
+ *
+ * `setup-template.sh` bakes
+ * `@superblocksteam:registry=https://npm.pkg.github.com/` into the template
+ * `.npmrc` for ephemeral environments; we must not clobber it.
+ */
+export const PRESERVE_NPMRC_SCOPES = ["@superblocksteam"];
+/**
+ * Returns true iff the value contains an embedded CR or LF, which would inject
+ * additional directives into the rendered `.npmrc`.
+ */
+function hasEmbeddedNewline(value) {
+    return /[\r\n]/.test(value);
+}
+/**
+ * Returns a log-safe rendering of a registry URL. Strips userinfo so an
+ * operator who accidentally inlined credentials in `SUPERBLOCKS_NPM_REGISTRY`
+ * (`https://user:pass@host/...`) doesn't have those credentials surfaced to
+ * centralized logging when validation rejects the value. Best-effort: if the
+ * input is unparseable we still return a placeholder rather than the raw
+ * value.
+ */
+function redactRegistryForLog(value) {
+    try {
+        const u = new URL(value);
+        if (u.username || u.password) {
+            u.username = "";
+            u.password = "";
+            return `${u.toString()} (userinfo redacted)`;
+        }
+        return u.toString();
+    }
+    catch {
+        return "<unparseable URL — value redacted>";
+    }
+}
+/**
+ * Parses the `SUPERBLOCKS_REQUIRE_PRIVATE_REGISTRY` truthy-flag value.
+ */
+function parseRequireFlag(env) {
+    const raw = env.SUPERBLOCKS_REQUIRE_PRIVATE_REGISTRY?.trim().toLowerCase();
+    return raw === "true" || raw === "1" || raw === "yes" || raw === "on";
+}
+/**
+ * Reads the npm registry env contract and returns a typed config, or undefined
+ * when `SUPERBLOCKS_NPM_REGISTRY` is unset or invalid (preserves SaaS / local
+ * behavior). Invalid values are logged as warnings and treated as unset rather
+ * than half-broken (avoids landing a `.npmrc` with a malformed `registry=`
+ * line and no `_authToken=`).
+ *
+ * Env contract:
+ * - SUPERBLOCKS_NPM_REGISTRY: full registry URL
+ * - SUPERBLOCKS_NPM_REGISTRY_TOKEN: optional auth token
+ * - SUPERBLOCKS_NPM_REGISTRY_SCOPES_JSON: optional JSON map of scope -> URL
+ * - SUPERBLOCKS_REQUIRE_PRIVATE_REGISTRY: opt-in strict mode (default off)
+ */
+export function getNpmRegistryConfig(env = process.env) {
+    const url = env.SUPERBLOCKS_NPM_REGISTRY?.trim();
+    if (!url) {
+        // The public name `SUPERBLOCKS_REQUIRE_PRIVATE_REGISTRY` promises strict
+        // mode; until the enforcement branch (#17) lands, surface a warning when
+        // an operator opts in but forgot to also set the registry URL — otherwise
+        // they silently fall back to public npm and assume they're protected.
+        if (parseRequireFlag(env)) {
+            getLogger().warn("[npm-registry] SUPERBLOCKS_REQUIRE_PRIVATE_REGISTRY is set but " +
+                "SUPERBLOCKS_NPM_REGISTRY is unset; falling back to default " +
+                "registry-resolution. Strict-mode enforcement is deferred to a " +
+                "follow-up; set SUPERBLOCKS_NPM_REGISTRY to take effect today.");
+        }
+        return;
+    }
+    if (hasEmbeddedNewline(url)) {
+        getLogger().warn("[npm-registry] SUPERBLOCKS_NPM_REGISTRY contains a newline; ignoring");
+        return;
+    }
+    // Validate the URL upfront so we never emit a half-broken .npmrc (e.g.
+    // `registry=` line with no matching `_authToken=`). Also rejects userinfo
+    // (`user:pass@host`) — tokens belong on a `_authToken=` line, never in the
+    // URL itself; URL-embedded credentials end up in HTTP request logs.
+    if (!toNpmAuthOrigin(url)) {
+        getLogger().warn("[npm-registry] SUPERBLOCKS_NPM_REGISTRY is not a valid registry URL " +
+            "(must be parseable and must not contain user:pass@ userinfo); ignoring", { url: redactRegistryForLog(url) });
+        return;
+    }
+    let token = env.SUPERBLOCKS_NPM_REGISTRY_TOKEN?.trim() || undefined;
+    if (token && hasEmbeddedNewline(token)) {
+        getLogger().warn("[npm-registry] SUPERBLOCKS_NPM_REGISTRY_TOKEN contains a newline; ignoring token");
+        token = undefined;
+    }
+    const require = parseRequireFlag(env);
+    let scopes;
+    const scopesJson = env.SUPERBLOCKS_NPM_REGISTRY_SCOPES_JSON?.trim();
+    if (scopesJson) {
+        try {
+            const parsed = JSON.parse(scopesJson);
+            if (parsed && typeof parsed === "object" && !Array.isArray(parsed)) {
+                scopes = {};
+                for (const [scope, scopeUrl] of Object.entries(parsed)) {
+                    if (typeof scopeUrl !== "string") {
+                        continue;
+                    }
+                    // Validate both the scope key and the scope URL value for embedded
+                    // newlines — a key containing `\n` (valid in JSON strings) would
+                    // inject an extra line into the rendered `.npmrc` (e.g.
+                    // `"@x\n_authToken=stolen"`). Mirror the existing URL-value check.
+                    if (hasEmbeddedNewline(scope)) {
+                        getLogger().warn("[npm-registry] SUPERBLOCKS_NPM_REGISTRY_SCOPES_JSON scope key contains a newline; ignoring entry");
+                        continue;
+                    }
+                    const trimmed = scopeUrl.trim();
+                    if (trimmed === "" || hasEmbeddedNewline(trimmed)) {
+                        continue;
+                    }
+                    scopes[scope] = trimmed;
+                }
+                if (Object.keys(scopes).length === 0) {
+                    scopes = undefined;
+                }
+            }
+        }
+        catch (error) {
+            getLogger().warn("[npm-registry] Failed to parse SUPERBLOCKS_NPM_REGISTRY_SCOPES_JSON; ignoring", { error: error instanceof Error ? error.message : String(error) });
+        }
+    }
+    return { url, token, scopes, require };
+}
+/**
+ * Extracts the host portion of a registry URL for use in npm auth lines, e.g.
+ * `https://artifactory.example.com/api/npm/npm-virtual/` ->
+ *   `//artifactory.example.com/api/npm/npm-virtual/`.
+ *
+ * npm matches `_authToken` lines by URL prefix (sans scheme), so we keep the
+ * full path. Trailing slash is normalized. Returns undefined for unparseable
+ * URLs OR URLs that carry userinfo (`user:pass@host`) — userinfo would make
+ * the `registry=` and `_authToken=` lines disagree under npm's URL-prefix
+ * matching rule and would also leak credentials into process logs.
+ */
+function toNpmAuthOrigin(registryUrl) {
+    try {
+        const u = new URL(registryUrl);
+        if (u.username || u.password) {
+            return;
+        }
+        const pathname = u.pathname.endsWith("/") ? u.pathname : `${u.pathname}/`;
+        return `//${u.host}${pathname}`;
+    }
+    catch {
+        return;
+    }
+}
+/**
+ * Normalizes a registry URL to end in exactly one trailing slash so the
+ * `registry=` line and the `_authToken=` host prefix line match exactly under
+ * npm's URL-prefix matching rule. Mirrors the shell script behavior.
+ */
+function normalizeRegistryUrl(registryUrl) {
+    return registryUrl.endsWith("/") ? registryUrl : `${registryUrl}/`;
+}
+/**
+ * Renders the npm registry config to an `.npmrc` file at `targetPath`.
+ *
+ * When `preserveScopeLines` is provided, any existing `<scope>:registry=`
+ * lines for those scopes are preserved verbatim (so EE-baked
+ * `@superblocksteam:registry=https://npm.pkg.github.com/` survives) UNLESS
+ * the same scope is explicitly overridden in `config.scopes`.
+ *
+ * Idempotent: rewrites the file in full each call. Writes are atomic (tmp +
+ * rename) and the file mode is restricted to 0600 because the file may carry
+ * an auth token.
+ */
+export async function writeNpmrc(targetPath, config, options = {}) {
+    const preserveScopes = options.preserveScopeLines ?? [];
+    // Map of scope -> verbatim line, so we both dedup correctly and preserve the
+    // exact bytes (whitespace, trailing comments) the operator wrote.
+    const preservedScopeLines = new Map();
+    if (preserveScopes.length > 0) {
+        let existing = "";
+        try {
+            existing = await readFile(targetPath, "utf-8");
+        }
+        catch (error) {
+            // ENOENT is the expected case (no pre-existing .npmrc). EACCES / EIO /
+            // EBUSY are not — surface them so we don't silently drop a load-bearing
+            // `@superblocksteam:registry=` line (the exact failure class APPS-2053
+            // was meant to prevent).
+            const code = error?.code;
+            if (code !== "ENOENT") {
+                getLogger().warn("[npm-registry] failed to read existing .npmrc for scope preservation; proceeding without preserve", {
+                    path: targetPath,
+                    code,
+                    error: error instanceof Error ? error.message : String(error),
+                });
+            }
+        }
+        if (existing) {
+            const lines = existing.split(/\r?\n/);
+            for (const scope of preserveScopes) {
+                // Skip preservation if config explicitly overrides this scope.
+                if (config.scopes && config.scopes[scope]) {
+                    continue;
+                }
+                const prefix = `${scope}:registry=`;
+                for (const line of lines) {
+                    const trimmed = line.trim();
+                    if (trimmed.startsWith(prefix)) {
+                        preservedScopeLines.set(scope, trimmed);
+                        break;
+                    }
+                }
+            }
+        }
+    }
+    const normalizedUrl = normalizeRegistryUrl(config.url);
+    const lines = [];
+    lines.push(`registry=${normalizedUrl}`);
+    const authOrigin = toNpmAuthOrigin(normalizedUrl);
+    if (config.token && authOrigin) {
+        lines.push(`${authOrigin}:_authToken=${config.token}`);
+    }
+    if (config.scopes) {
+        for (const [scope, scopeUrl] of Object.entries(config.scopes)) {
+            lines.push(`${scope}:registry=${scopeUrl}`);
+            // Explicit scope override wins; drop the preserved line for the same
+            // scope so we don't emit two `<scope>:registry=` lines.
+            preservedScopeLines.delete(scope);
+        }
+    }
+    for (const line of preservedScopeLines.values()) {
+        lines.push(line);
+    }
+    const content = lines.join("\n") + "\n";
+    await mkdir(path.dirname(targetPath), { recursive: true });
+    // Atomic write: render to a sibling tmp file with restrictive perms, then
+    // rename. Avoids leaving a partial/empty .npmrc on crash mid-write, and
+    // narrows the window where the token might be readable at the default umask.
+    const tmpPath = `${targetPath}.tmp-${process.pid}-${Date.now()}`;
+    await writeFile(tmpPath, content, { encoding: "utf-8", mode: 0o600 });
+    // `mode` only applies on creation; explicit chmod handles the case where the
+    // tmp path was preexisting (e.g. crash recovery).
+    await chmod(tmpPath, 0o600);
+    await rename(tmpPath, targetPath);
+}
+/**
+ * Convenience: invoke `writeNpmrc` against `<dir>/.npmrc` if registry config is
+ * present in the env. No-op when unset (preserves today's behavior for SaaS /
+ * local dev).
+ *
+ * Returns the loaded config when an `.npmrc` was written, otherwise `undefined`.
+ */
+export async function maybeWriteNpmrcForDir(dir, options = {}, env = process.env) {
+    const config = getNpmRegistryConfig(env);
+    if (!config) {
+        return;
+    }
+    await writeNpmrc(path.join(dir, ".npmrc"), config, options);
+    return config;
+}
+/**
+ * Materializes the private-registry `.npmrc` AND strips `resolved` URLs from
+ * any lockfile present in `dir`, so a subsequent `npm install` is guaranteed
+ * to re-resolve through the active registry. No-op when the env contract is
+ * unset.
+ *
+ * Combines `maybeWriteNpmrcForDir` with `stripResolvedFromLockfile`. The two
+ * always go together at install call sites because:
+ *   - Writing `.npmrc` alone is insufficient: `resolved` URLs in the
+ *     lockfile silently bypass it.
+ *   - Stripping `resolved` alone is insufficient: npm would re-resolve
+ *     against the wrong registry (or fail with no auth).
+ *
+ * Returns the loaded config when an `.npmrc` was written (also implying the
+ * lockfile was stripped), otherwise `undefined`.
+ */
+export async function prepareForPrivateRegistry(dir, options = {}, env = process.env) {
+    const config = await maybeWriteNpmrcForDir(dir, options, env);
+    if (config) {
+        await stripResolvedFromLockfile(dir);
+    }
+    return config;
+}
+/**
+ * Removes the `resolved` field from every entry in `.packages` of an npm v2+
+ * lockfile. TS-side counterpart to `scripts/strip-lockfile-resolved.sh`.
+ *
+ * Same goal: npm honors `resolved` URLs verbatim, so a lockfile whose entries
+ * point at registry.npmjs.org keeps fetching from npmjs even after we've
+ * written a private `registry=` line to `.npmrc`. Stripping forces npm to
+ * re-resolve through the active registry.
+ *
+ * Use at runtime for *brownfield* apps — apps imported into Superblocks with
+ * a lockfile baked at customer-side npm install time (typically against
+ * npmjs.org). Greenfield template lockfiles are stripped at image-build time
+ * by the bash script; this function handles the rest.
+ *
+ * Behavior:
+ *   - Strips both `<dir>/package-lock.json` and the hidden
+ *     `<dir>/node_modules/.package-lock.json` if present.
+ *   - No-op when neither file exists (brownfield apps may not have a
+ *     lockfile yet).
+ *   - Idempotent: a second call against an already-stripped file is a no-op.
+ *   - Malformed JSON or wrong shape -> logged warning, file left untouched.
+ *     We don't throw because the consuming `npm install` will surface a
+ *     clearer error on the same lockfile, and an unrelated parse bug here
+ *     should not block the user's install.
+ *   - Atomic: writes via tmp + rename to avoid leaving a partial lockfile on
+ *     crash mid-write.
+ */
+export async function stripResolvedFromLockfile(dir) {
+    await Promise.all([
+        stripResolvedFromLockfilePath(path.join(dir, "package-lock.json")),
+        stripResolvedFromLockfilePath(path.join(dir, "node_modules", ".package-lock.json")),
+    ]);
+}
+async function stripResolvedFromLockfilePath(lockfilePath) {
+    let raw;
+    try {
+        raw = await readFile(lockfilePath, "utf-8");
+    }
+    catch (error) {
+        const code = error?.code;
+        if (code === "ENOENT") {
+            return;
+        }
+        getLogger().warn("[npm-registry] failed to read lockfile for resolved-strip; skipping", {
+            path: lockfilePath,
+            code,
+            error: error instanceof Error ? error.message : String(error),
+        });
+        return;
+    }
+    let parsed;
+    try {
+        parsed = JSON.parse(raw);
+    }
+    catch (error) {
+        getLogger().warn("[npm-registry] lockfile is not valid JSON; skipping resolved-strip", {
+            path: lockfilePath,
+            error: error instanceof Error ? error.message : String(error),
+        });
+        return;
+    }
+    if (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) {
+        getLogger().warn("[npm-registry] lockfile root is not a JSON object; skipping resolved-strip", { path: lockfilePath });
+        return;
+    }
+    const lockfile = parsed;
+    const packages = lockfile.packages;
+    // npm v1 lockfiles have no .packages object; nothing to strip. Some custom
+    // shapes may also omit it (e.g. fixture lockfiles). Skip silently.
+    if (packages === undefined) {
+        return;
+    }
+    if (!packages || typeof packages !== "object" || Array.isArray(packages)) {
+        getLogger().warn("[npm-registry] lockfile .packages is not an object; skipping resolved-strip", { path: lockfilePath });
+        return;
+    }
+    let mutated = false;
+    for (const entry of Object.values(packages)) {
+        if (entry &&
+            typeof entry === "object" &&
+            !Array.isArray(entry) &&
+            "resolved" in entry) {
+            delete entry.resolved;
+            mutated = true;
+        }
+    }
+    if (!mutated) {
+        return;
+    }
+    // Preserve a trailing newline if the original had one (npm writes its
+    // lockfiles with a trailing newline; matching it minimizes spurious diffs
+    // when the file is later committed back from a customer-side workflow).
+    const trailingNewline = raw.endsWith("\n") ? "\n" : "";
+    const next = JSON.stringify(lockfile, null, 2) + trailingNewline;
+    // Atomic write: tmp + rename. Inherit the original mode where possible so
+    // we don't widen perms on a customer-owned lockfile (npm typically writes
+    // 0644, but we don't assume).
+    const tmpPath = `${lockfilePath}.tmp-${process.pid}-${Date.now()}`;
+    await writeFile(tmpPath, next, "utf-8");
+    try {
+        const original = await stat(lockfilePath);
+        await chmod(tmpPath, original.mode & 0o777);
+    }
+    catch {
+        // Best-effort mode parity only; the rewrite itself is what matters.
+    }
+    await rename(tmpPath, lockfilePath);
+}
+//# sourceMappingURL=npm-registry.js.map

package/dist/ai-service/app-interface/npm-registry.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"npm-registry.js","sourceRoot":"","sources":["../../../src/ai-service/app-interface/npm-registry.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,KAAK,EACL,KAAK,EACL,QAAQ,EACR,MAAM,EACN,IAAI,EACJ,SAAS,GACV,MAAM,kBAAkB,CAAC;AAC1B,OAAO,KAAK,IAAI,MAAM,WAAW,CAAC;AAElC,OAAO,EAAE,SAAS,EAAE,MAAM,sBAAsB,CAAC;AAEjD;;;;;;;;GAQG;AACH,MAAM,CAAC,MAAM,qBAAqB,GAAG,CAAC,kBAAkB,CAAC,CAAC;AA2B1D;;;GAGG;AACH,SAAS,kBAAkB,CAAC,KAAa;IACvC,OAAO,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;AAC9B,CAAC;AAED;;;;;;;GAOG;AACH,SAAS,oBAAoB,CAAC,KAAa;IACzC,IAAI,CAAC;QACH,MAAM,CAAC,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC;QACzB,IAAI,CAAC,CAAC,QAAQ,IAAI,CAAC,CAAC,QAAQ,EAAE,CAAC;YAC7B,CAAC,CAAC,QAAQ,GAAG,EAAE,CAAC;YAChB,CAAC,CAAC,QAAQ,GAAG,EAAE,CAAC;YAChB,OAAO,GAAG,CAAC,CAAC,QAAQ,EAAE,sBAAsB,CAAC;QAC/C,CAAC;QACD,OAAO,CAAC,CAAC,QAAQ,EAAE,CAAC;IACtB,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,oCAAoC,CAAC;IAC9C,CAAC;AACH,CAAC;AAED;;GAEG;AACH,SAAS,gBAAgB,CAAC,GAAsB;IAC9C,MAAM,GAAG,GAAG,GAAG,CAAC,oCAAoC,EAAE,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IAC3E,OAAO,GAAG,KAAK,MAAM,IAAI,GAAG,KAAK,GAAG,IAAI,GAAG,KAAK,KAAK,IAAI,GAAG,KAAK,IAAI,CAAC;AACxE,CAAC;AAED;;;;;;;;;;;;GAYG;AACH,MAAM,UAAU,oBAAoB,CAClC,MAAyB,OAAO,CAAC,GAAG;IAEpC,MAAM,GAAG,GAAG,GAAG,CAAC,wBAAwB,EAAE,IAAI,EAAE,CAAC;IACjD,IAAI,CAAC,GAAG,EAAE,CAAC;QACT,yEAAyE;QACzE,yEAAyE;QACzE,0EAA0E;QAC1E,sEAAsE;QACtE,IAAI,gBAAgB,CAAC,GAAG,CAAC,EAAE,CAAC;YAC1B,SAAS,EAAE,CAAC,IAAI,CACd,iEAAiE;gBAC/D,6DAA6D;gBAC7D,gEAAgE;gBAChE,+DAA+D,CAClE,CAAC;QACJ,CAAC;QACD,OAAO;IACT,CAAC;IACD,IAAI,kBAAkB,CAAC,GAAG,CAAC,EAAE,CAAC;QAC5B,SAAS,EAAE,CAAC,IAAI,CACd,sEAAsE,CACvE,CAAC;QACF,OAAO;IACT,CAAC;IACD,uEAAuE;IACvE,0EAA0E;IAC1E,2EAA2E;IAC3E,oEAAoE;IACpE,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,EAAE,CAAC;QAC1B,SAAS,EAAE,CAAC,IAAI,CACd,sEAAsE;YACpE,wEAAwE,EAC1E,EAAE,GAAG,EAAE,oBAAoB,CAAC,GAAG,CAAC,EAAE,CACnC,CAAC;QACF,OAAO;IACT,CAAC;IAED,IAAI,KAAK,GAAG,GAAG,CAAC,8BAA8B,EAAE,IAAI,EAAE,IAAI,SAAS,CAAC;IACpE,IAAI,KAAK,IAAI,kBAAkB,CAAC,KAAK,CAAC,EAAE,CAAC;QACvC,SAAS,EAAE,CAAC,IAAI,CACd,kFAAkF,CACnF,CAAC;QACF,KAAK,GAAG,SAAS,CAAC;IACpB,CAAC;IAED,MAAM,OAAO,GAAG,gBAAgB,CAAC,GAAG,CAAC,CAAC;IAEtC,IAAI,MAA0C,CAAC;IAC/C,MAAM,UAAU,GAAG,GAAG,CAAC,oCAAoC,EAAE,IAAI,EAAE,CAAC;IACpE,IAAI,UAAU,EAAE,CAAC;QACf,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC;YACtC,IAAI,MAAM,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;gBACnE,MAAM,GAAG,EAAE,CAAC;gBACZ,KAAK,MAAM,CAAC,KAAK,EAAE,QAAQ,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;oBACvD,IAAI,OAAO,QAAQ,KAAK,QAAQ,EAAE,CAAC;wBACjC,SAAS;oBACX,CAAC;oBACD,mEAAmE;oBACnE,iEAAiE;oBACjE,wDAAwD;oBACxD,mEAAmE;oBACnE,IAAI,kBAAkB,CAAC,KAAK,CAAC,EAAE,CAAC;wBAC9B,SAAS,EAAE,CAAC,IAAI,CACd,kGAAkG,CACnG,CAAC;wBACF,SAAS;oBACX,CAAC;oBACD,MAAM,OAAO,GAAG,QAAQ,CAAC,IAAI,EAAE,CAAC;oBAChC,IAAI,OAAO,KAAK,EAAE,IAAI,kBAAkB,CAAC,OAAO,CAAC,EAAE,CAAC;wBAClD,SAAS;oBACX,CAAC;oBACD,MAAM,CAAC,KAAK,CAAC,GAAG,OAAO,CAAC;gBAC1B,CAAC;gBACD,IAAI,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;oBACrC,MAAM,GAAG,SAAS,CAAC;gBACrB,CAAC;YACH,CAAC;QACH,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,SAAS,EAAE,CAAC,IAAI,CACd,+EAA+E,EAC/E,EAAE,KAAK,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAClE,CAAC;QACJ,CAAC;IACH,CAAC;IAED,OAAO,EAAE,GAAG,EAAE,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC;AACzC,CAAC;AAED;;;;;;;;;;GAUG;AACH,SAAS,eAAe,CAAC,WAAmB;IAC1C,IAAI,CAAC;QACH,MAAM,CAAC,GAAG,IAAI,GAAG,CAAC,WAAW,CAAC,CAAC;QAC/B,IAAI,CAAC,CAAC,QAAQ,IAAI,CAAC,CAAC,QAAQ,EAAE,CAAC;YAC7B,OAAO;QACT,CAAC;QACD,MAAM,QAAQ,GAAG,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,QAAQ,GAAG,CAAC;QAC1E,OAAO,KAAK,CAAC,CAAC,IAAI,GAAG,QAAQ,EAAE,CAAC;IAClC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO;IACT,CAAC;AACH,CAAC;AAED;;;;GAIG;AACH,SAAS,oBAAoB,CAAC,WAAmB;IAC/C,OAAO,WAAW,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,GAAG,WAAW,GAAG,CAAC;AACrE,CAAC;AAWD;;;;;;;;;;;GAWG;AACH,MAAM,CAAC,KAAK,UAAU,UAAU,CAC9B,UAAkB,EAClB,MAAyB,EACzB,UAA6B,EAAE;IAE/B,MAAM,cAAc,GAAG,OAAO,CAAC,kBAAkB,IAAI,EAAE,CAAC;IACxD,6EAA6E;IAC7E,kEAAkE;IAClE,MAAM,mBAAmB,GAAG,IAAI,GAAG,EAAkB,CAAC;IAEtD,IAAI,cAAc,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC9B,IAAI,QAAQ,GAAG,EAAE,CAAC;QAClB,IAAI,CAAC;YACH,QAAQ,GAAG,MAAM,QAAQ,CAAC,UAAU,EAAE,OAAO,CAAC,CAAC;QACjD,CAAC;QAAC,OAAO,KAAc,EAAE,CAAC;YACxB,uEAAuE;YACvE,wEAAwE;YACxE,uEAAuE;YACvE,yBAAyB;YACzB,MAAM,IAAI,GAAI,KAA2C,EAAE,IAAI,CAAC;YAChE,IAAI,IAAI,KAAK,QAAQ,EAAE,CAAC;gBACtB,SAAS,EAAE,CAAC,IAAI,CACd,mGAAmG,EACnG;oBACE,IAAI,EAAE,UAAU;oBAChB,IAAI;oBACJ,KAAK,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC;iBAC9D,CACF,CAAC;YACJ,CAAC;QACH,CAAC;QAED,IAAI,QAAQ,EAAE,CAAC;YACb,MAAM,KAAK,GAAG,QAAQ,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;YACtC,KAAK,MAAM,KAAK,IAAI,cAAc,EAAE,CAAC;gBACnC,+DAA+D;gBAC/D,IAAI,MAAM,CAAC,MAAM,IAAI,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC;oBAC1C,SAAS;gBACX,CAAC;gBACD,MAAM,MAAM,GAAG,GAAG,KAAK,YAAY,CAAC;gBACpC,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;oBACzB,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;oBAC5B,IAAI,OAAO,CAAC,UAAU,CAAC,MAAM,CAAC,EAAE,CAAC;wBAC/B,mBAAmB,CAAC,GAAG,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;wBACxC,MAAM;oBACR,CAAC;gBACH,CAAC;YACH,CAAC;QACH,CAAC;IACH,CAAC;IAED,MAAM,aAAa,GAAG,oBAAoB,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;IACvD,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,KAAK,CAAC,IAAI,CAAC,YAAY,aAAa,EAAE,CAAC,CAAC;IAExC,MAAM,UAAU,GAAG,eAAe,CAAC,aAAa,CAAC,CAAC;IAClD,IAAI,MAAM,CAAC,KAAK,IAAI,UAAU,EAAE,CAAC;QAC/B,KAAK,CAAC,IAAI,CAAC,GAAG,UAAU,eAAe,MAAM,CAAC,KAAK,EAAE,CAAC,CAAC;IACzD,CAAC;IAED,IAAI,MAAM,CAAC,MAAM,EAAE,CAAC;QAClB,KAAK,MAAM,CAAC,KAAK,EAAE,QAAQ,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC;YAC9D,KAAK,CAAC,IAAI,CAAC,GAAG,KAAK,aAAa,QAAQ,EAAE,CAAC,CAAC;YAC5C,qEAAqE;YACrE,wDAAwD;YACxD,mBAAmB,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QACpC,CAAC;IACH,CAAC;IAED,KAAK,MAAM,IAAI,IAAI,mBAAmB,CAAC,MAAM,EAAE,EAAE,CAAC;QAChD,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACnB,CAAC;IAED,MAAM,OAAO,GAAG,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC;IAExC,MAAM,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAC3D,0EAA0E;IAC1E,wEAAwE;IACxE,6EAA6E;IAC7E,MAAM,OAAO,GAAG,GAAG,UAAU,QAAQ,OAAO,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC;IACjE,MAAM,SAAS,CAAC,OAAO,EAAE,OAAO,EAAE,EAAE,QAAQ,EAAE,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IACtE,6EAA6E;IAC7E,kDAAkD;IAClD,MAAM,KAAK,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;IAC5B,MAAM,MAAM,CAAC,OAAO,EAAE,UAAU,CAAC,CAAC;AACpC,CAAC;AAED;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,qBAAqB,CACzC,GAAW,EACX,UAA6B,EAAE,EAC/B,MAAyB,OAAO,CAAC,GAAG;IAEpC,MAAM,MAAM,GAAG,oBAAoB,CAAC,GAAG,CAAC,CAAC;IACzC,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,OAAO;IACT,CAAC;IACD,MAAM,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,QAAQ,CAAC,EAAE,MAAM,EAAE,OAAO,CAAC,CAAC;IAC5D,OAAO,MAAM,CAAC;AAChB,CAAC;AAED;;;;;;;;;;;;;;;GAeG;AACH,MAAM,CAAC,KAAK,UAAU,yBAAyB,CAC7C,GAAW,EACX,UAA6B,EAAE,EAC/B,MAAyB,OAAO,CAAC,GAAG;IAEpC,MAAM,MAAM,GAAG,MAAM,qBAAqB,CAAC,GAAG,EAAE,OAAO,EAAE,GAAG,CAAC,CAAC;IAC9D,IAAI,MAAM,EAAE,CAAC;QACX,MAAM,yBAAyB,CAAC,GAAG,CAAC,CAAC;IACvC,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AACH,MAAM,CAAC,KAAK,UAAU,yBAAyB,CAAC,GAAW;IACzD,MAAM,OAAO,CAAC,GAAG,CAAC;QAChB,6BAA6B,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,mBAAmB,CAAC,CAAC;QAClE,6BAA6B,CAC3B,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,cAAc,EAAE,oBAAoB,CAAC,CACrD;KACF,CAAC,CAAC;AACL,CAAC;AAED,KAAK,UAAU,6BAA6B,CAC1C,YAAoB;IAEpB,IAAI,GAAW,CAAC;IAChB,IAAI,CAAC;QACH,GAAG,GAAG,MAAM,QAAQ,CAAC,YAAY,EAAE,OAAO,CAAC,CAAC;IAC9C,CAAC;IAAC,OAAO,KAAc,EAAE,CAAC;QACxB,MAAM,IAAI,GAAI,KAA2C,EAAE,IAAI,CAAC;QAChE,IAAI,IAAI,KAAK,QAAQ,EAAE,CAAC;YACtB,OAAO;QACT,CAAC;QACD,SAAS,EAAE,CAAC,IAAI,CACd,qEAAqE,EACrE;YACE,IAAI,EAAE,YAAY;YAClB,IAAI;YACJ,KAAK,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC;SAC9D,CACF,CAAC;QACF,OAAO;IACT,CAAC;IAED,IAAI,MAAe,CAAC;IACpB,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC3B,CAAC;IAAC,OAAO,KAAc,EAAE,CAAC;QACxB,SAAS,EAAE,CAAC,IAAI,CACd,oEAAoE,EACpE;YACE,IAAI,EAAE,YAAY;YAClB,KAAK,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC;SAC9D,CACF,CAAC;QACF,OAAO;IACT,CAAC;IAED,IAAI,CAAC,MAAM,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;QACnE,SAAS,EAAE,CAAC,IAAI,CACd,4EAA4E,EAC5E,EAAE,IAAI,EAAE,YAAY,EAAE,CACvB,CAAC;QACF,OAAO;IACT,CAAC;IAED,MAAM,QAAQ,GAAG,MAAiC,CAAC;IACnD,MAAM,QAAQ,GAAG,QAAQ,CAAC,QAAQ,CAAC;IAEnC,2EAA2E;IAC3E,mEAAmE;IACnE,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;QAC3B,OAAO;IACT,CAAC;IACD,IAAI,CAAC,QAAQ,IAAI,OAAO,QAAQ,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAC;QACzE,SAAS,EAAE,CAAC,IAAI,CACd,6EAA6E,EAC7E,EAAE,IAAI,EAAE,YAAY,EAAE,CACvB,CAAC;QACF,OAAO;IACT,CAAC;IAED,IAAI,OAAO,GAAG,KAAK,CAAC;IACpB,KAAK,MAAM,KAAK,IAAI,MAAM,CAAC,MAAM,CAAC,QAAmC,CAAC,EAAE,CAAC;QACvE,IACE,KAAK;YACL,OAAO,KAAK,KAAK,QAAQ;YACzB,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;YACrB,UAAU,IAAI,KAAK,EACnB,CAAC;YACD,OAAQ,KAAiC,CAAC,QAAQ,CAAC;YACnD,OAAO,GAAG,IAAI,CAAC;QACjB,CAAC;IACH,CAAC;IAED,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,OAAO;IACT,CAAC;IAED,sEAAsE;IACtE,0EAA0E;IAC1E,wEAAwE;IACxE,MAAM,eAAe,GAAG,GAAG,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC;IACvD,MAAM,IAAI,GAAG,IAAI,CAAC,SAAS,CAAC,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC,GAAG,eAAe,CAAC;IAEjE,0EAA0E;IAC1E,0EAA0E;IAC1E,8BAA8B;IAC9B,MAAM,OAAO,GAAG,GAAG,YAAY,QAAQ,OAAO,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC;IACnE,MAAM,SAAS,CAAC,OAAO,EAAE,IAAI,EAAE,OAAO,CAAC,CAAC;IACxC,IAAI,CAAC;QACH,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,CAAC;QAC1C,MAAM,KAAK,CAAC,OAAO,EAAE,QAAQ,CAAC,IAAI,GAAG,KAAK,CAAC,CAAC;IAC9C,CAAC;IAAC,MAAM,CAAC;QACP,oEAAoE;IACtE,CAAC;IACD,MAAM,MAAM,CAAC,OAAO,EAAE,YAAY,CAAC,CAAC;AACtC,CAAC"}

package/dist/ai-service/app-interface/shell.d.ts

@@ -14,6 +14,33 @@ export interface ListFilesOptions extends GlobOptionsWithFileTypesUnset {
     /** Include directories in listing. Default: false (files only) */
     includeDirs?: boolean;
 }
+export type CopyConflictStrategy = "fail" | "skip" | "replace";
+export type CopyToolResult = {
+    copiedCount: number;
+    skippedCount: number;
+    rejectedCount: number;
+    copied?: string[];
+    skipped?: Array<{
+        path: string;
+        reason: "destination_exists" | "default_excluded";
+    }>;
+    rejected?: Array<{
+        path: string;
+        reason: string;
+    }>;
+};
+export type CopyFileOptions = {
+    sourcePath: string;
+    destinationPath: string;
+    conflictStrategy?: CopyConflictStrategy;
+    verbose?: boolean;
+};
+export type CopyDirectoryOptions = {
+    sourceDir: string;
+    destinationDir: string;
+    conflictStrategy?: CopyConflictStrategy;
+    verbose?: boolean;
+};
 /**
  * AppShell provides the primary interface for the AI agent to interact
  * with the application environment.
@@ -140,6 +167,17 @@ export declare class AppShell {
      * Called directly by writeFile (no queue wrapper needed since draftInterface queues).
      */
     private writeFileInternal;
+    private resolveAppRelativePath;
+    private createEmptyCopyResult;
+    private recordCopied;
+    private recordSkipped;
+    private recordRejected;
+    private finalizeCopyResult;
+    private copyFileInternal;
+    private preflightCopyFile;
+    copyFile(options: CopyFileOptions): Promise<CopyToolResult>;
+    private collectDirectoryCopyEntries;
+    copyDirectory(options: CopyDirectoryOptions): Promise<CopyToolResult>;
     /**
      * Deletes a file or directory as a draft operation.
      *

package/dist/ai-service/app-interface/shell.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"shell.d.ts","sourceRoot":"","sources":["../../../src/ai-service/app-interface/shell.ts"],"names":[],"mappings":"AAaA,OAAO,EAAQ,KAAK,6BAA6B,EAAE,MAAM,MAAM,CAAC;AAKhE,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,0BAA0B,CAAC;AAE/D,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,+BAA+B,CAAC;AAErE,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,yBAAyB,CAAC;AAChE,OAAO,EAAmB,KAAK,YAAY,EAAE,MAAM,aAAa,CAAC;AAOjE,OAAO,EAGL,KAAK,YAAY,EACjB,KAAK,YAAY,EACjB,KAAK,aAAa,EACnB,MAAM,uBAAuB,CAAC;AAC/B,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,uBAAuB,CAAC;AAK/D;;GAEG;AACH,MAAM,WAAW,gBAAiB,SAAQ,6BAA6B;IACrE,gEAAgE;IAChE,eAAe,CAAC,EAAE,OAAO,CAAC;IAC1B,kEAAkE;IAClE,WAAW,CAAC,EAAE,OAAO,CAAC;CACvB;AAED;;;;;;;;;;GAUG;AACH,qBAAa,QAAQ;IACnB,SAAgB,cAAc,EAAE,MAAM,CAAC;IACvC,OAAO,CAAC,QAAQ,CAAC,gBAAgB,CAAkB;IACnD,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAS;IAChC,OAAO,CAAC,aAAa,CAAC,CAAkC;IACxD,OAAO,CAAC,QAAQ,CAAC,YAAY,CAAC,CAAe;IAC7C,OAAO,CAAC,QAAQ,CAAC,gBAAgB,CAAC,CAAmB;IACrD,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAoB;IAC9C,OAAO,CAAC,QAAQ,CAAC,aAAa,CAAgB;IAC9C,OAAO,CAAC,QAAQ,CAAC,uBAAuB,CAAU;IAElD;;;OAGG;IACH,OAAO,CAAC,QAAQ,CAAC,aAAa,CAAqB;gBAEvC,EACV,cAAc,EACd,gBAAgB,EAChB,aAAa,EACb,cAAc,EACd,gBAAgB,EAChB,iBAAiB,EACjB,aAAa,EACb,uBAAuB,GACxB,EAAE;QACD,cAAc,EAAE,MAAM,CAAC;QACvB,gBAAgB,EAAE,eAAe,CAAC;QAClC,aAAa,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;QAChD,cAAc,CAAC,EAAE,cAAc,CAAC;QAChC,gBAAgB,CAAC,EAAE,gBAAgB,CAAC;QACpC,iBAAiB,EAAE,iBAAiB,CAAC;QACrC,6DAA6D;QAC7D,aAAa,EAAE,aAAa,CAAC;QAC7B,gEAAgE;QAChE,uBAAuB,CAAC,EAAE,OAAO,CAAC;KACnC;IAeD;;;;OAIG;IACI,oBAAoB,CAAC,OAAO,EAAE,OAAO,GAAG,IAAI;IAInD;;;OAGG;YACW,kBAAkB;IA2BnB,SAAS,CACpB,QAAQ,EAAE,MAAM,EAAE,EAClB,WAAW,CAAC,EAAE,6BAA6B,EAC3C,kBAAkB,UAAO,GACxB,OAAO,CAAC,YAAY,EAAE,CAAC;IAkCb,YAAY,CACvB,WAAW,CAAC,EAAE,WAAW,GACxB,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,EAAE,CAAC,GAAG,IAAI,CAAC;IAoB9B,qBAAqB,CAChC,WAAW,CAAC,EAAE,WAAW,GACxB,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC;IAwCZ,SAAS,CACpB,SAAS,EAAE,MAAM,EAAE,EACnB,WAAW,CAAC,EAAE,WAAW,GACxB,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,EAAE,CAAC,GAAG,IAAI,CAAC;IA+BpC,eAAe;IAKT,aAAa,CAAC,WAAW,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,IAAI,CAAC;IA2BvD,wBAAwB,CAAC,WAAW,CAAC,EAAE,WAAW;IA2DlD,uBAAuB,CAClC,QAAQ,EAAE,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,OAAO,CAAC,EAAE,MAAM,CAAC;QAAC,GAAG,CAAC,EAAE,OAAO,CAAA;KAAE,CAAC,EAClE,WAAW,CAAC,EAAE,WAAW,GACxB,OAAO,CAAC,MAAM,CAAC;IA8GL,iBAAiB,CAC5B,QAAQ,EAAE,MAAM,EAAE,EAClB,OAAO,CAAC,EAAE;QACR,WAAW,CAAC,EAAE,WAAW,CAAC;KAC3B,GACA,OAAO,CAAC;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE,CAAC;IA0B9C,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,mBAAmB,CAAM;IAGpC,qBAAqB,CAChC,QAAQ,EAAE,YAAY,EACtB,MAAM,EAAE,MAAM,EACd,YAAY,EAAE,MAAM,GACnB,OAAO,CAAC,IAAI,CAAC;IAsBH,gBAAgB,CAC3B,QAAQ,SAA+B,GACtC,OAAO,CAAC,IAAI,CAAC;IAgCH,WAAW,CAAC,OAAO,EAAE;QAChC,IAAI,EAAE,MAAM,CAAC;QACb,OAAO,CAAC,EAAE,GAAG,CAAC;KACf,GAAG,OAAO,CAAC,IAAI,CAAC;IAUjB,mDAAmD;IACtC,UAAU,CAAC,YAAY,EAAE,MAAM;IAW5C;;;OAGG;IACU,qBAAqB,IAAI,OAAO,CAAC,IAAI,CAAC;IAmBnD;;;;;;;;;;;;;OAaG;IAEU,QAAQ,CACnB,YAAY,EAAE,MAAM,EACpB,OAAO,CAAC,EAAE;QAAE,MAAM,CAAC,EAAE,MAAM,CAAC;QAAC,KAAK,CAAC,EAAE,MAAM,CAAA;KAAE,GAC5C,OAAO,CAAC,MAAM,CAAC;IAiBlB;;;OAGG;YACW,gBAAgB;IA4D9B;;;;;;;;;;;;;OAaG;IAEU,SAAS,CACpB,YAAY,EAAE,MAAM,EACpB,OAAO,EAAE,MAAM,EACf,OAAO,CAAC,EAAE;QAAE,iBAAiB,CAAC,EAAE,OAAO,CAAA;KAAE,GACxC,OAAO,CAAC,IAAI,CAAC;IAyBhB;;;OAGG;YACW,iBAAiB;IAgC/B;;;;;;;;;OASG;IAEU,UAAU,CAAC,YAAY,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAU5D;;;OAGG;YACW,kBAAkB;IA2ChC;;;;;;;;;OASG;IACU,SAAS,CACpB,QAAQ,CAAC,EAAE,MAAM,EAAE,EACnB,OAAO,CAAC,EAAE,6BAA6B,GACtC,OAAO,CAAC,MAAM,EAAE,CAAC;IAEpB;;;;;;OAMG;IACU,SAAS,CACpB,QAAQ,CAAC,EAAE,MAAM,EAAE,EACnB,OAAO,CAAC,EAAE,gBAAgB,GAAG;QAAE,eAAe,EAAE,IAAI,CAAA;KAAE,GACrD,OAAO,CAAC,YAAY,EAAE,CAAC;IAiC1B;;;;;;;OAOG;YAEW,iBAAiB;IAmC/B;;;;;OAKG;YACW,mBAAmB;IAajC;;;;;OAKG;YACW,eAAe;IA+B7B;;;;;;OAMG;YACW,kBAAkB;IA0ChC;;;;;;;;;OASG;IAEU,UAAU,CAAC,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IA2CxE;;;;OAIG;IACU,eAAe,IAAI,OAAO,CAAC,OAAO,CAAC;IAOhD;;;;;OAKG;IACU,YAAY,CAAC,KAAK,CAAC,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,MAAM,CAAC;IAO5D;;;;OAIG;IACU,eAAe,IAAI,OAAO,CAAC,YAAY,CAAC;IAOrD;;;;;;;;OAQG;IACI,iBAAiB,IAAI,cAAc,GAAG,SAAS;IAQtD;;;;;OAKG;IACI,cAAc,CAAC,YAAY,EAAE,MAAM,GAAG,OAAO;IAIpD;;;;;;;OAOG;IACI,WAAW,CAAC,YAAY,EAAE,MAAM,GAAG,IAAI;IAI9C;;;OAGG;IACH,OAAO,CAAC,QAAQ;IAIhB,OAAO,CAAC,gCAAgC;IAUxC;;OAEG;YACW,wBAAwB;CAkBvC"}
+{"version":3,"file":"shell.d.ts","sourceRoot":"","sources":["../../../src/ai-service/app-interface/shell.ts"],"names":[],"mappings":"AAaA,OAAO,EAAQ,KAAK,6BAA6B,EAAE,MAAM,MAAM,CAAC;AAKhE,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,0BAA0B,CAAC;AAE/D,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,+BAA+B,CAAC;AAErE,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,yBAAyB,CAAC;AAChE,OAAO,EAAmB,KAAK,YAAY,EAAE,MAAM,aAAa,CAAC;AAOjE,OAAO,EAGL,KAAK,YAAY,EACjB,KAAK,YAAY,EACjB,KAAK,aAAa,EACnB,MAAM,uBAAuB,CAAC;AAC/B,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,uBAAuB,CAAC;AAU/D;;GAEG;AACH,MAAM,WAAW,gBAAiB,SAAQ,6BAA6B;IACrE,gEAAgE;IAChE,eAAe,CAAC,EAAE,OAAO,CAAC;IAC1B,kEAAkE;IAClE,WAAW,CAAC,EAAE,OAAO,CAAC;CACvB;AAED,MAAM,MAAM,oBAAoB,GAAG,MAAM,GAAG,MAAM,GAAG,SAAS,CAAC;AAE/D,MAAM,MAAM,cAAc,GAAG;IAC3B,WAAW,EAAE,MAAM,CAAC;IACpB,YAAY,EAAE,MAAM,CAAC;IACrB,aAAa,EAAE,MAAM,CAAC;IACtB,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC;IAClB,OAAO,CAAC,EAAE,KAAK,CAAC;QACd,IAAI,EAAE,MAAM,CAAC;QACb,MAAM,EAAE,oBAAoB,GAAG,kBAAkB,CAAC;KACnD,CAAC,CAAC;IACH,QAAQ,CAAC,EAAE,KAAK,CAAC;QACf,IAAI,EAAE,MAAM,CAAC;QACb,MAAM,EAAE,MAAM,CAAC;KAChB,CAAC,CAAC;CACJ,CAAC;AAEF,MAAM,MAAM,eAAe,GAAG;IAC5B,UAAU,EAAE,MAAM,CAAC;IACnB,eAAe,EAAE,MAAM,CAAC;IACxB,gBAAgB,CAAC,EAAE,oBAAoB,CAAC;IACxC,OAAO,CAAC,EAAE,OAAO,CAAC;CACnB,CAAC;AAEF,MAAM,MAAM,oBAAoB,GAAG;IACjC,SAAS,EAAE,MAAM,CAAC;IAClB,cAAc,EAAE,MAAM,CAAC;IACvB,gBAAgB,CAAC,EAAE,oBAAoB,CAAC;IACxC,OAAO,CAAC,EAAE,OAAO,CAAC;CACnB,CAAC;AAUF;;;;;;;;;;GAUG;AACH,qBAAa,QAAQ;IACnB,SAAgB,cAAc,EAAE,MAAM,CAAC;IACvC,OAAO,CAAC,QAAQ,CAAC,gBAAgB,CAAkB;IACnD,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAS;IAChC,OAAO,CAAC,aAAa,CAAC,CAAkC;IACxD,OAAO,CAAC,QAAQ,CAAC,YAAY,CAAC,CAAe;IAC7C,OAAO,CAAC,QAAQ,CAAC,gBAAgB,CAAC,CAAmB;IACrD,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAoB;IAC9C,OAAO,CAAC,QAAQ,CAAC,aAAa,CAAgB;IAC9C,OAAO,CAAC,QAAQ,CAAC,uBAAuB,CAAU;IAElD;;;OAGG;IACH,OAAO,CAAC,QAAQ,CAAC,aAAa,CAAqB;gBAEvC,EACV,cAAc,EACd,gBAAgB,EAChB,aAAa,EACb,cAAc,EACd,gBAAgB,EAChB,iBAAiB,EACjB,aAAa,EACb,uBAAuB,GACxB,EAAE;QACD,cAAc,EAAE,MAAM,CAAC;QACvB,gBAAgB,EAAE,eAAe,CAAC;QAClC,aAAa,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;QAChD,cAAc,CAAC,EAAE,cAAc,CAAC;QAChC,gBAAgB,CAAC,EAAE,gBAAgB,CAAC;QACpC,iBAAiB,EAAE,iBAAiB,CAAC;QACrC,6DAA6D;QAC7D,aAAa,EAAE,aAAa,CAAC;QAC7B,gEAAgE;QAChE,uBAAuB,CAAC,EAAE,OAAO,CAAC;KACnC;IAeD;;;;OAIG;IACI,oBAAoB,CAAC,OAAO,EAAE,OAAO,GAAG,IAAI;IAInD;;;OAGG;YACW,kBAAkB;IA2BnB,SAAS,CACpB,QAAQ,EAAE,MAAM,EAAE,EAClB,WAAW,CAAC,EAAE,6BAA6B,EAC3C,kBAAkB,UAAO,GACxB,OAAO,CAAC,YAAY,EAAE,CAAC;IAkCb,YAAY,CACvB,WAAW,CAAC,EAAE,WAAW,GACxB,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,EAAE,CAAC,GAAG,IAAI,CAAC;IAoB9B,qBAAqB,CAChC,WAAW,CAAC,EAAE,WAAW,GACxB,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC;IAwCZ,SAAS,CACpB,SAAS,EAAE,MAAM,EAAE,EACnB,WAAW,CAAC,EAAE,WAAW,GACxB,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,EAAE,CAAC,GAAG,IAAI,CAAC;IA+BpC,eAAe;IAKT,aAAa,CAAC,WAAW,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,IAAI,CAAC;IAsCvD,wBAAwB,CAAC,WAAW,CAAC,EAAE,WAAW;IAkElD,uBAAuB,CAClC,QAAQ,EAAE,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,OAAO,CAAC,EAAE,MAAM,CAAC;QAAC,GAAG,CAAC,EAAE,OAAO,CAAA;KAAE,CAAC,EAClE,WAAW,CAAC,EAAE,WAAW,GACxB,OAAO,CAAC,MAAM,CAAC;IAqHL,iBAAiB,CAC5B,QAAQ,EAAE,MAAM,EAAE,EAClB,OAAO,CAAC,EAAE;QACR,WAAW,CAAC,EAAE,WAAW,CAAC;KAC3B,GACA,OAAO,CAAC;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE,CAAC;IAqC9C,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,mBAAmB,CAAM;IAGpC,qBAAqB,CAChC,QAAQ,EAAE,YAAY,EACtB,MAAM,EAAE,MAAM,EACd,YAAY,EAAE,MAAM,GACnB,OAAO,CAAC,IAAI,CAAC;IAsBH,gBAAgB,CAC3B,QAAQ,SAA+B,GACtC,OAAO,CAAC,IAAI,CAAC;IAgCH,WAAW,CAAC,OAAO,EAAE;QAChC,IAAI,EAAE,MAAM,CAAC;QACb,OAAO,CAAC,EAAE,GAAG,CAAC;KACf,GAAG,OAAO,CAAC,IAAI,CAAC;IAUjB,mDAAmD;IACtC,UAAU,CAAC,YAAY,EAAE,MAAM;IAW5C;;;OAGG;IACU,qBAAqB,IAAI,OAAO,CAAC,IAAI,CAAC;IAmBnD;;;;;;;;;;;;;OAaG;IAEU,QAAQ,CACnB,YAAY,EAAE,MAAM,EACpB,OAAO,CAAC,EAAE;QAAE,MAAM,CAAC,EAAE,MAAM,CAAC;QAAC,KAAK,CAAC,EAAE,MAAM,CAAA;KAAE,GAC5C,OAAO,CAAC,MAAM,CAAC;IAiBlB;;;OAGG;YACW,gBAAgB;IA4D9B;;;;;;;;;;;;;OAaG;IAEU,SAAS,CACpB,YAAY,EAAE,MAAM,EACpB,OAAO,EAAE,MAAM,EACf,OAAO,CAAC,EAAE;QAAE,iBAAiB,CAAC,EAAE,OAAO,CAAA;KAAE,GACxC,OAAO,CAAC,IAAI,CAAC;IAyBhB;;;OAGG;YACW,iBAAiB;IAuC/B,OAAO,CAAC,sBAAsB;IAyB9B,OAAO,CAAC,qBAAqB;IAW7B,OAAO,CAAC,YAAY;IAKpB,OAAO,CAAC,aAAa;IASrB,OAAO,CAAC,cAAc;IAStB,OAAO,CAAC,kBAAkB;YAaZ,gBAAgB;YA4ChB,iBAAiB;IA8BlB,QAAQ,CAAC,OAAO,EAAE,eAAe,GAAG,OAAO,CAAC,cAAc,CAAC;YAyB1D,2BAA2B;IA2D5B,aAAa,CACxB,OAAO,EAAE,oBAAoB,GAC5B,OAAO,CAAC,cAAc,CAAC;IA6D1B;;;;;;;;;OASG;IAEU,UAAU,CAAC,YAAY,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAU5D;;;OAGG;YACW,kBAAkB;IA2ChC;;;;;;;;;OASG;IACU,SAAS,CACpB,QAAQ,CAAC,EAAE,MAAM,EAAE,EACnB,OAAO,CAAC,EAAE,6BAA6B,GACtC,OAAO,CAAC,MAAM,EAAE,CAAC;IAEpB;;;;;;OAMG;IACU,SAAS,CACpB,QAAQ,CAAC,EAAE,MAAM,EAAE,EACnB,OAAO,CAAC,EAAE,gBAAgB,GAAG;QAAE,eAAe,EAAE,IAAI,CAAA;KAAE,GACrD,OAAO,CAAC,YAAY,EAAE,CAAC;IAiC1B;;;;;;;OAOG;YAEW,iBAAiB;IAmC/B;;;;;OAKG;YACW,mBAAmB;IAajC;;;;;OAKG;YACW,eAAe;IA+B7B;;;;;;OAMG;YACW,kBAAkB;IA0ChC;;;;;;;;;OASG;IAEU,UAAU,CAAC,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IA2CxE;;;;OAIG;IACU,eAAe,IAAI,OAAO,CAAC,OAAO,CAAC;IAOhD;;;;;OAKG;IACU,YAAY,CAAC,KAAK,CAAC,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,MAAM,CAAC;IAO5D;;;;OAIG;IACU,eAAe,IAAI,OAAO,CAAC,YAAY,CAAC;IAOrD;;;;;;;;OAQG;IACI,iBAAiB,IAAI,cAAc,GAAG,SAAS;IAQtD;;;;;OAKG;IACI,cAAc,CAAC,YAAY,EAAE,MAAM,GAAG,OAAO;IAIpD;;;;;;;OAOG;IACI,WAAW,CAAC,YAAY,EAAE,MAAM,GAAG,IAAI;IAI9C;;;OAGG;IACH,OAAO,CAAC,QAAQ;IAIhB,OAAO,CAAC,gCAAgC;IAUxC;;OAEG;YACW,wBAAwB;CAkBvC"}