@tiinex/core 0.7.0 → 0.8.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@tiinex/core",
-  "version": "0.7.0",
+  "version": "0.8.0",
   "description": "Shared host-neutral Tiinex implementation core for artifacts, schemas, validation, lineage, grounding, Handoffs, provenance and deterministic workflows.",
   "type": "module",
   "sideEffects": true,
@@ -167,12 +167,12 @@
     "type": "git",
     "url": "git+https://github.com/Tiinex/core.git"
   },
-  "gitHead": "c08cb2e85827e3b8565225208284933d97256d5f",
+  "gitHead": "6a139559c7cb3d809b2ecf0482d0ae42243aa609",
   "tiinexRelease": {
     "policy": "tiinex.master-npm-release.v1",
-    "sourceCommit": "c08cb2e85827e3b8565225208284933d97256d5f",
-    "sourceTree": "3cca44f889324a87400993c4e727c840e7cdc07e",
+    "sourceCommit": "6a139559c7cb3d809b2ecf0482d0ae42243aa609",
+    "sourceTree": "ec876301e7b78eaf85e8cbf9aba91dba873c2b3b",
     "repository": "Tiinex/core",
-    "previousVersion": "0.6.0"
+    "previousVersion": "0.7.0"
   }
 }

package/src/tooling/portable/adapters/cli/cli.handoff-manufacture.js

@@ -199,6 +199,11 @@ function projectWorkspaceCarrierHumanOutput(result = {}, flags = {}) {
   const dimension = String(projection.lineage?.dimension || '001');
   const projectedFilename = String(flags['projected-filename'] || flags.projectedFilename || result?.input?.projectedFilename || '').trim();
   const filename = projectedFilename || `tiinex-${dimension}.handoff-package.zip`;
+  // This is a basename-only presentation label; it does not define carrier lineage.
+  if (filename !== filename.trim() || !filename.endsWith('.handoff-package.zip') ||
+      /[<>:"/\\|?*\x00-\x1f\x7f]/.test(filename) || /[. ]$/.test(filename) ||
+      /^(?:con|prn|aux|nul|com[1-9]|lpt[1-9])(?:\.|$)/i.test(filename) ||
+      new TextEncoder().encode(filename).byteLength > 255) throw new Error('portable.cli.workspace-carrier.filename.invalid');
   return Object.freeze({
     schema: 'tiinex.portable.handoff-human-output.v1',
     status: ready ? 'ready' : 'blocked',

package/src/tooling/portable/adapters/node/handoff.manufacture.enumeration.js

@@ -4,13 +4,15 @@ import { sha256Hex } from '../../../../export/package.bytes.js';
 import { safeWorkspaceToken, serializableMetadata } from './handoff.manufacture.multiRoot.js';
 
 export const PORTABLE_NODE_WORKSPACE_ENUMERATION_SCHEMA_ID = 'tiinex.portable.node-workspace-enumeration.v1';
-export const DEFAULT_HANDOFF_MANUFACTURE_EXCLUDED_DIRECTORIES = Object.freeze(['.git', '.tiinex', 'node_modules', '.site-publish']);
+export const DEFAULT_HANDOFF_MANUFACTURE_EXCLUDED_DIRECTORIES = Object.freeze(['.git', '.tiinex', 'node_modules', '.site-publish', '.release', '.outgoing-handoff-packages']);
+export const DEFAULT_HANDOFF_MANUFACTURE_EXCLUDED_RELATIVE_PATHS = Object.freeze(['.vscode/link']);
 const DEFAULT_MAX_FILES = 10000;
 
 export async function enumerateNodeWorkspace(rootInput = '.', options = {}) {
   const root = path.resolve(String(rootInput || '.'));
   const maxFiles = positiveInteger(options.maxFiles, DEFAULT_MAX_FILES);
   const excluded = new Set([...(options.excludeDirectories || DEFAULT_HANDOFF_MANUFACTURE_EXCLUDED_DIRECTORIES)].map(String));
+  const excludedPaths = new Set(options.excludeRelativePaths || DEFAULT_HANDOFF_MANUFACTURE_EXCLUDED_RELATIVE_PATHS);
   const queue = [root];
   const absoluteFiles = [];
   const skippedSymlinks = [];
@@ -21,6 +23,7 @@ export async function enumerateNodeWorkspace(rootInput = '.', options = {}) {
     for (const entry of entries) {
       if (entry.isDirectory() && excluded.has(entry.name)) continue;
       const absolute = path.join(current, entry.name);
+      if (excludedPaths.has(normalizeRelativePath(path.relative(root, absolute)))) continue;
       if (entry.isSymbolicLink()) { skippedSymlinks.push(normalizeRelativePath(path.relative(root, absolute))); continue; }
       if (entry.isDirectory()) queue.push(absolute);
       else if (entry.isFile()) absoluteFiles.push(absolute);
@@ -59,7 +62,7 @@ export async function enumerateNodeWorkspace(rootInput = '.', options = {}) {
     workspaceId,
     entryCount: includedEntries.length,
     totalBytes,
-    exclusions: Object.freeze({ directories: Object.freeze([...excluded].sort()), symbolicLinks: 'excluded-and-reported' }),
+    exclusions: Object.freeze({ directories: Object.freeze([...excluded].sort()), relativePaths: Object.freeze([...excludedPaths].sort()), symbolicLinks: 'excluded-and-reported' }),
     skippedSymlinks: Object.freeze(skippedSymlinks.sort()),
     entriesFingerprint: sha256Text(stableJson(includedEntries))
   });