@vibe-agent-toolkit/utils 0.2.0-rc.1 → 0.2.0-rc.10

package/dist/crawl-timing.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"crawl-timing.js","sourceRoot":"","sources":["../src/crawl-timing.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgOG;AAEH,OAAO,EAAE,iBAAiB,EAAE,MAAM,kBAAkB,CAAC;AAErD,OAAO,EACL,qBAAqB,EACrB,wBAAwB,EACxB,iBAAiB,EAEjB,eAAe,GAChB,MAAM,kBAAkB,CAAC;AAkB1B;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,YAAY,GAA4B,CAAC,MAAM,EAAE,SAAS,EAAE,OAAO,EAAE,QAAQ,CAAC,CAAC;AAa5F;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,iBAAiB,GAAG,CAAC,CAAC;AAEnC,mEAAmE;AACnE,MAAM,CAAC,MAAM,eAAe,GAAG,sBAAsB,CAAC;AAEtD;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,yBAAyB,GAAG,2BAA2B,CAAC;AAErE;;;;;;;;GAQG;AACH,MAAM,CAAC,MAAM,2BAA2B,GAAG,2BAA2B,CAAC;AAEvE,gFAAgF;AAChF,MAAM,CAAC,MAAM,wBAAwB,GAAG,kCAAkC,CAAC;AAE3E;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,wBAAwB,GAAG,oBAAoB,CAAC;AAE7D;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,MAAM,CAAC,MAAM,2BAA2B,GAAG,6BAA6B,CAAC;AAEzE;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+BG;AACH,MAAM,CAAC,MAAM,uBAAuB,GAAG,yBAAyB,CAAC;AAEjE,mFAAmF;AACnF,MAAM,CAAC,MAAM,+BAA+B,GAAG,iCAAiC,CAAC;AAEjF;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,MAAM,CAAC,MAAM,sBAAsB,GAAG,wBAAwB,CAAC;AAE/D;;;;;;;;;;;;;GAaG;AACH,MAAM,CAAC,MAAM,mBAAmB,GAAG,uBAAuB,CAAC;AAE3D;;;;;;;;;;;;;GAaG;AACH,MAAM,CAAC,MAAM,oBAAoB,GAAG,wBAAwB,CAAC;AAE7D;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,MAAM,CAAC,MAAM,2BAA2B,GAAG,wBAAwB,CAAC;AAEpE;;;;;;;;;GASG;AACH,MAAM,kBAAkB,GAAG,IAAI,iBAAiB,EAAsB,CAAC;AAEvE;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AACH,MAAM,CAAC,MAAM,oBAAoB,GAAsB;IACrD,sBAAsB;IACtB,2BAA2B;IAC3B,wBAAwB;IACxB,uBAAuB;IACvB,2BAA2B;IAC3B,+BAA+B;IAC/B,2BAA2B;IAC3B,mBAAmB;IACnB,oBAAoB;IACpB,yBAAyB;IACzB,eAAe;CAChB,CAAC;AAqEF,gFAAgF;AAChF,MAAM,aAAa,GAAG,cAAc,CAAC;AAErC,kDAAkD;AAClD,MAAM,SAAS,GAAG,cAAc,CAAC;AAWjC;;;;;;;;GAQG;AACH,MAAM,OAAO,GAAG,IAAI,GAAG,EAA4B,CAAC;AAEpD;;;;GAIG;AACH,IAAI,aAAa,GAAkB,wBAAwB,CAAC,OAAO,CAAC,GAAG,CAAC,kBAAkB,CAAC,CAAC,CAAC;AAE7F;;;GAGG;AACH,IAAI,aAAa,GAAG,aAAa,KAAK,IAAI,CAAC;AAE3C;;;;;;;GAOG;AACH,SAAS,KAAK,CAAC,aAAqB,EAAE,OAAqB,EAAE,IAAY;IACvE,OAAO,GAAG,OAAO,IAAI,MAAM,CAAC,IAAI,CAAC,IAAI,aAAa,EAAE,CAAC;AACvD,CAAC;AAED;;;;;;;GAOG;AACH,SAAS,QAAQ,CACf,aAAqB,EACrB,OAAqB,EACrB,IAAY,EACZ,SAAiB;IAEjB,sEAAsE;IACtE,2EAA2E;IAC3E,8EAA8E;IAC9E,wDAAwD;IACxD,MAAM,MAAM,GAAG,kBAAkB,CAAC,QAAQ,EAAE,KAAK,IAAI,CAAC,CAAC,CAAC,iBAAiB,CAAC,CAAC,CAAC,IAAI,CAAC;IACjF,MAAM,GAAG,GAAG,KAAK,CAAC,aAAa,EAAE,OAAO,EAAE,MAAM,CAAC,CAAC;IAClD,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IAChC,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;QACzB,OAAO,CAAC,GAAG,CAAC,GAAG,EAAE,EAAE,aAAa,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,EAAE,SAAS,EAAE,CAAC,CAAC;QAChF,OAAO;IACT,CAAC;IACD,MAAM,CAAC,KAAK,IAAI,CAAC,CAAC;IAClB,MAAM,CAAC,SAAS,IAAI,SAAS,CAAC;AAChC,CAAC;AAED;;;;;;;;;;GAUG;AACH,SAAS,cAAc,CAAC,IAAsB,EAAE,KAAuB;IACrE,MAAM,SAAS,GACb,YAAY,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,YAAY,CAAC,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IAC3E,IAAI,SAAS,KAAK,CAAC;QAAE,OAAO,SAAS,CAAC;IACtC,MAAM,IAAI,GAAG,IAAI,CAAC,aAAa,CAAC,aAAa,CAAC,KAAK,CAAC,aAAa,CAAC,CAAC;IACnE,IAAI,IAAI,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IAC5B,OAAO,IAAI,CAAC,IAAI,GAAG,KAAK,CAAC,IAAI,CAAC;AAChC,CAAC;AAED;;;;GAIG;AACH,SAAS,SAAS;IAChB,OAAO;QACL,GAAG,EAAE,OAAO,CAAC,GAAG;QAChB,OAAO,EAAE,iBAAiB,EAAE;QAC5B,OAAO,EAAE,EAAE,MAAM,EAAE,CAAC,GAAG,YAAY,CAAC,EAAE,YAAY,EAAE,CAAC,GAAG,oBAAoB,CAAC,EAAE;QAC/E,OAAO,EAAE,CAAC,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,EAAE,GAAG,KAAK,EAAE,CAAC,CAAC;KACnF,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACH,SAAS,SAAS;IAChB,OAAO,eAAe,CAAC,SAAS,EAAE,aAAa,EAAE,aAAa,EAAE,SAAS,CAAC,CAAC;AAC7E,CAAC;AAED,IAAI,aAAa,KAAK,IAAI,EAAE,CAAC;IAC3B,qBAAqB,CAAC,SAAS,EAAE,aAAa,CAAC,CAAC;IAChD,8EAA8E;IAC9E,OAAO,CAAC,EAAE,CAAC,MAAM,EAAE,GAAG,EAAE;QACtB,SAAS,EAAE,CAAC;IACd,CAAC,CAAC,CAAC;AACL,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,gBAAgB;IAC9B,OAAO,aAAa,CAAC,CAAC,CAAC,WAAW,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;AAC/C,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,eAAe,CAC7B,aAAqB,EACrB,OAAqB,EACrB,IAAY,EACZ,SAAiB;IAEjB,IAAI,CAAC,aAAa;QAAE,OAAO;IAC3B,QAAQ,CAAC,aAAa,EAAE,OAAO,EAAE,IAAI,EAAE,WAAW,CAAC,GAAG,EAAE,GAAG,SAAS,CAAC,CAAC;AACxE,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,SAAS,mBAAmB,CAC1B,aAAqB,EACrB,SAAiB,EACjB,QAAsB;IAEtB,MAAM,OAAO,GAAG,kBAAkB,CAAC,QAAQ,EAAE,IAAI,QAAQ,CAAC;IAC1D,QAAQ,CAAC,aAAa,EAAE,OAAO,EAAE,iBAAiB,EAAE,WAAW,CAAC,GAAG,EAAE,GAAG,SAAS,CAAC,CAAC;AACrF,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,kBAAkB,CAAC,aAAqB,EAAE,SAAiB;IACzE,IAAI,CAAC,aAAa;QAAE,OAAO;IAC3B,mBAAmB,CAAC,aAAa,EAAE,SAAS,EAAE,OAAO,CAAC,CAAC;AACzD,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,UAAU,gBAAgB,CAAC,aAAqB,EAAE,SAAiB;IACvE,IAAI,CAAC,aAAa;QAAE,OAAO;IAC3B,mBAAmB,CAAC,aAAa,EAAE,SAAS,EAAE,QAAQ,CAAC,CAAC;AAC1D,CAAC;AAED;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,sBAAsB,CACpC,OAA2B,EAC3B,GAAqB;IAErB,IAAI,CAAC,aAAa;QAAE,OAAO,GAAG,EAAE,CAAC;IACjC,OAAO,kBAAkB,CAAC,GAAG,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC;AAC9C,CAAC;AAED;;;;;;GAMG;AACH,MAAM,kBAAkB,GAAG,IAAI,iBAAiB,EAAQ,CAAC;AAEzD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAkCG;AACH,MAAM,UAAU,gBAAgB,CAAI,GAAqB;IACvD,IAAI,CAAC,aAAa;QAAE,OAAO,GAAG,EAAE,CAAC;IACjC,OAAO,kBAAkB,CAAC,GAAG,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;AAC3C,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,2BAA2B,CAAC,MAK3C;IACC,IAAI,CAAC,aAAa;QAAE,OAAO;IAC3B,QAAQ,CAAC,MAAM,CAAC,aAAa,EAAE,MAAM,CAAC,OAAO,EAAE,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,SAAS,CAAC,CAAC;AAChF,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,UAAU,uBAAuB,CAAC,SAAwB;IAC9D,aAAa,GAAG,wBAAwB,CAAC,SAAS,IAAI,SAAS,CAAC,CAAC;IACjE,aAAa,GAAG,aAAa,KAAK,IAAI,CAAC;IACvC,OAAO,CAAC,KAAK,EAAE,CAAC;IAChB,IAAI,aAAa,KAAK,IAAI;QAAE,qBAAqB,CAAC,SAAS,EAAE,aAAa,CAAC,CAAC;AAC9E,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,yBAAyB;IACvC,OAAO,SAAS,EAAE,CAAC;AACrB,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,6BAA6B;IAC3C,OAAO,SAAS,EAAE,CAAC;AACrB,CAAC"}

package/dist/crawl.d.ts

@@ -6,10 +6,8 @@
  * and shells out to `git` for the gitignore-aware fast path.
  *
  * This is the only *subpath* entry that reaches `picomatch` — `./crawl` is
- * therefore the narrow entry that makes `picomatch` a required install. It is
- * not the package's only consumer of it: `link-auth/select-provider.ts` uses
- * `picomatch.isMatch` for host-pattern matching, and that is reachable from the
- * `.` barrel.
+ * therefore the narrow entry that makes `picomatch` a required install. The `.`
+ * barrel reaches it too, through this same `file-crawler` route.
  *
  * Deliberately NOT folded into `./glob`. `./glob` is guarded as portable —
  * `node:path` and no third-party dependency (see `test/subpath-purity.test.ts`)

package/dist/crawl.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"crawl.d.ts","sourceRoot":"","sources":["../src/crawl.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAEH,cAAc,mBAAmB,CAAC"}
+{"version":3,"file":"crawl.d.ts","sourceRoot":"","sources":["../src/crawl.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAEH,cAAc,mBAAmB,CAAC"}

package/dist/crawl.js

@@ -6,10 +6,8 @@
  * and shells out to `git` for the gitignore-aware fast path.
  *
  * This is the only *subpath* entry that reaches `picomatch` — `./crawl` is
- * therefore the narrow entry that makes `picomatch` a required install. It is
- * not the package's only consumer of it: `link-auth/select-provider.ts` uses
- * `picomatch.isMatch` for host-pattern matching, and that is reachable from the
- * `.` barrel.
+ * therefore the narrow entry that makes `picomatch` a required install. The `.`
+ * barrel reaches it too, through this same `file-crawler` route.
  *
  * Deliberately NOT folded into `./glob`. `./glob` is guarded as portable —
  * `node:path` and no third-party dependency (see `test/subpath-purity.test.ts`)

package/dist/crawl.js.map

@@ -1 +1 @@
-{"version":3,"file":"crawl.js","sourceRoot":"","sources":["../src/crawl.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAEH,cAAc,mBAAmB,CAAC"}
+{"version":3,"file":"crawl.js","sourceRoot":"","sources":["../src/crawl.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAEH,cAAc,mBAAmB,CAAC"}

package/dist/dirent-kind.d.ts

@@ -0,0 +1,83 @@
+/**
+ * What a directory entry IS — with the symlink question asked first.
+ *
+ * A `Dirent` from `readdir(…, { withFileTypes: true })` describes the entry
+ * itself, so for a symlink BOTH `isFile()` and `isDirectory()` are false. A
+ * walk written `if (e.isDirectory()) recurse(); else if (e.isFile()) read();`
+ * therefore neither refuses a link nor follows it: it drops the entry on the
+ * floor without a word. The sweep found staged skill trees, size accounting
+ * and packaging walks with exactly that shape, every one reporting a tree
+ * with a symlink in it as clean. `local/dirent-type-needs-symlink-check`
+ * refuses that shape; these two helpers are what a walk says instead, and
+ * each makes the caller pick a policy by name.
+ *
+ * - {@link direntKind} — lstat semantics. A link is `'symlink'`, never what it
+ *   points at. For a walk that must NOT follow (a delete, a size count of
+ *   what `rm -rf` will remove, a bundle that travels as a tarball).
+ * - {@link direntKindFollowing} — stat semantics. A link is answered by its
+ *   target: `'file'`, `'directory'`, or `'dangling'`. For a walk over a tree
+ *   the caller trusts (its own build output, a dev-mode install, a fixture),
+ *   where a link is simply how the entry got there.
+ *
+ * Neither helper decides for the caller. A `'symlink'` or `'dangling'` that
+ * the caller ignores is still ignored — but it is ignored in a `case` the
+ * reader can see, which is the whole difference.
+ */
+import type { Dirent } from 'node:fs';
+import { VatError } from './errors/vat-error.js';
+/** What the entry itself is. A link is a link. */
+export type DirentKind = 'file' | 'directory' | 'symlink' | 'other';
+/** What the entry resolves to. A link is answered by its target, or is `dangling`. */
+export type FollowedKind = 'file' | 'directory' | 'dangling' | 'other';
+/**
+ * Classify an entry WITHOUT following it.
+ *
+ * @param entry - A `Dirent` from a `withFileTypes` listing
+ * @returns `'symlink'` for any link, else the entry's own type
+ */
+export declare function direntKind(entry: Dirent): DirentKind;
+/**
+ * Classify an entry by what it resolves to, following a link with one `stat`.
+ *
+ * A non-link entry costs no syscall. A link whose target is absent is
+ * `'dangling'`; a link the OS refuses to resolve (`ELOOP`, `EACCES`) is a
+ * refusal, not an absence, and stays loud.
+ *
+ * @param dir - The directory `entry` was listed from
+ * @param entry - A `Dirent` from a `withFileTypes` listing of `dir`
+ * @returns The target's kind, or `'dangling'`
+ */
+export declare function direntKindFollowingSync(dir: string, entry: Dirent): FollowedKind;
+/** The async counterpart of {@link direntKindFollowingSync}. */
+export declare function direntKindFollowing(dir: string, entry: Dirent): Promise<FollowedKind>;
+/** Thrown when a following walk is led back into a directory it has already entered. */
+export declare class DirectoryWalkRevisitedError extends VatError {
+    constructor(dir: string, enteredAs: string);
+}
+/**
+ * The directories a FOLLOWING walk has entered, by realpath, so a link that
+ * leads back into the walk is refused instead of recursed until
+ * `ENAMETOOLONG`.
+ *
+ * A walk that follows links (`direntKindFollowing`) has no cycle guard by
+ * construction: `scripts/loop -> .` makes a copy create `dest/loop/loop/…`,
+ * writing every file at every level first, and a hashing walk do the same in
+ * memory. Every following walk holds one of these and calls {@link enter}
+ * on every directory it recurses into — the root included. A REVISIT is
+ * refused, not just a cycle: two links to one directory make the walk's
+ * output ambiguous (which spelling is the file's path?), and a refusal that
+ * names both spellings is the answer the author can act on.
+ */
+export declare class FollowedWalk {
+    #private;
+    /**
+     * Record that the walk is entering `dir`. Synchronous on purpose — one
+     * realpath per directory entered is nothing beside the listing itself, and
+     * the sync and async walkers then share one guard.
+     *
+     * @param dir - A directory the walk is about to list, in any spelling
+     * @throws {DirectoryWalkRevisitedError} When its realpath was entered before
+     */
+    enter(dir: string): void;
+}
+//# sourceMappingURL=dirent-kind.d.ts.map

package/dist/dirent-kind.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"dirent-kind.d.ts","sourceRoot":"","sources":["../src/dirent-kind.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AAEH,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,SAAS,CAAC;AAKtC,OAAO,EAAE,QAAQ,EAAE,MAAM,uBAAuB,CAAC;AAIjD,kDAAkD;AAClD,MAAM,MAAM,UAAU,GAAG,MAAM,GAAG,WAAW,GAAG,SAAS,GAAG,OAAO,CAAC;AAEpE,sFAAsF;AACtF,MAAM,MAAM,YAAY,GAAG,MAAM,GAAG,WAAW,GAAG,UAAU,GAAG,OAAO,CAAC;AAEvE;;;;;GAKG;AACH,wBAAgB,UAAU,CAAC,KAAK,EAAE,MAAM,GAAG,UAAU,CAKpD;AASD;;;;;;;;;;GAUG;AACH,wBAAgB,uBAAuB,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,YAAY,CAQhF;AAED,gEAAgE;AAChE,wBAAsB,mBAAmB,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,YAAY,CAAC,CAQ3F;AAED,wFAAwF;AACxF,qBAAa,2BAA4B,SAAQ,QAAQ;gBAC3C,GAAG,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM;CAM3C;AAED;;;;;;;;;;;;;GAaG;AACH,qBAAa,YAAY;;IAGvB;;;;;;;OAOG;IACH,KAAK,CAAC,GAAG,EAAE,MAAM,GAAG,IAAI;CAMzB"}

package/dist/dirent-kind.js

@@ -0,0 +1,129 @@
+/**
+ * What a directory entry IS — with the symlink question asked first.
+ *
+ * A `Dirent` from `readdir(…, { withFileTypes: true })` describes the entry
+ * itself, so for a symlink BOTH `isFile()` and `isDirectory()` are false. A
+ * walk written `if (e.isDirectory()) recurse(); else if (e.isFile()) read();`
+ * therefore neither refuses a link nor follows it: it drops the entry on the
+ * floor without a word. The sweep found staged skill trees, size accounting
+ * and packaging walks with exactly that shape, every one reporting a tree
+ * with a symlink in it as clean. `local/dirent-type-needs-symlink-check`
+ * refuses that shape; these two helpers are what a walk says instead, and
+ * each makes the caller pick a policy by name.
+ *
+ * - {@link direntKind} — lstat semantics. A link is `'symlink'`, never what it
+ *   points at. For a walk that must NOT follow (a delete, a size count of
+ *   what `rm -rf` will remove, a bundle that travels as a tarball).
+ * - {@link direntKindFollowing} — stat semantics. A link is answered by its
+ *   target: `'file'`, `'directory'`, or `'dangling'`. For a walk over a tree
+ *   the caller trusts (its own build output, a dev-mode install, a fixture),
+ *   where a link is simply how the entry got there.
+ *
+ * Neither helper decides for the caller. A `'symlink'` or `'dangling'` that
+ * the caller ignores is still ignored — but it is ignored in a `case` the
+ * reader can see, which is the whole difference.
+ */
+import { statSync } from 'node:fs';
+import fs from 'node:fs/promises';
+import { isPathAbsentError } from './errors/errno.js';
+import { VatError } from './errors/vat-error.js';
+import { toForwardSlash } from './path-core.js';
+import { normalizePath, safePath } from './path-utils.js';
+/**
+ * Classify an entry WITHOUT following it.
+ *
+ * @param entry - A `Dirent` from a `withFileTypes` listing
+ * @returns `'symlink'` for any link, else the entry's own type
+ */
+export function direntKind(entry) {
+    if (entry.isSymbolicLink())
+        return 'symlink';
+    if (entry.isDirectory())
+        return 'directory';
+    if (entry.isFile())
+        return 'file';
+    return 'other';
+}
+/** The kind a `stat` result reports. */
+function kindOfStats(stats) {
+    if (stats.isDirectory())
+        return 'directory';
+    if (stats.isFile())
+        return 'file';
+    return 'other';
+}
+/**
+ * Classify an entry by what it resolves to, following a link with one `stat`.
+ *
+ * A non-link entry costs no syscall. A link whose target is absent is
+ * `'dangling'`; a link the OS refuses to resolve (`ELOOP`, `EACCES`) is a
+ * refusal, not an absence, and stays loud.
+ *
+ * @param dir - The directory `entry` was listed from
+ * @param entry - A `Dirent` from a `withFileTypes` listing of `dir`
+ * @returns The target's kind, or `'dangling'`
+ */
+export function direntKindFollowingSync(dir, entry) {
+    if (!entry.isSymbolicLink())
+        return kindOfStats(entry);
+    try {
+        return kindOfStats(statSync(safePath.join(dir, entry.name)));
+    }
+    catch (error) {
+        if (isPathAbsentError(error))
+            return 'dangling';
+        throw error;
+    }
+}
+/** The async counterpart of {@link direntKindFollowingSync}. */
+export async function direntKindFollowing(dir, entry) {
+    if (!entry.isSymbolicLink())
+        return kindOfStats(entry);
+    try {
+        return kindOfStats(await fs.stat(safePath.join(dir, entry.name)));
+    }
+    catch (error) {
+        if (isPathAbsentError(error))
+            return 'dangling';
+        throw error;
+    }
+}
+/** Thrown when a following walk is led back into a directory it has already entered. */
+export class DirectoryWalkRevisitedError extends VatError {
+    constructor(dir, enteredAs) {
+        super('DIRECTORY_WALK_REVISITED', `Refusing to enter ${dir}: it is the directory already walked as ${enteredAs} — a symlink leads the walk back into itself.`);
+    }
+}
+/**
+ * The directories a FOLLOWING walk has entered, by realpath, so a link that
+ * leads back into the walk is refused instead of recursed until
+ * `ENAMETOOLONG`.
+ *
+ * A walk that follows links (`direntKindFollowing`) has no cycle guard by
+ * construction: `scripts/loop -> .` makes a copy create `dest/loop/loop/…`,
+ * writing every file at every level first, and a hashing walk do the same in
+ * memory. Every following walk holds one of these and calls {@link enter}
+ * on every directory it recurses into — the root included. A REVISIT is
+ * refused, not just a cycle: two links to one directory make the walk's
+ * output ambiguous (which spelling is the file's path?), and a refusal that
+ * names both spellings is the answer the author can act on.
+ */
+export class FollowedWalk {
+    #entered = new Map();
+    /**
+     * Record that the walk is entering `dir`. Synchronous on purpose — one
+     * realpath per directory entered is nothing beside the listing itself, and
+     * the sync and async walkers then share one guard.
+     *
+     * @param dir - A directory the walk is about to list, in any spelling
+     * @throws {DirectoryWalkRevisitedError} When its realpath was entered before
+     */
+    enter(dir) {
+        const real = toForwardSlash(normalizePath(dir));
+        const before = this.#entered.get(real);
+        if (before !== undefined)
+            throw new DirectoryWalkRevisitedError(dir, before);
+        this.#entered.set(real, dir);
+    }
+}
+//# sourceMappingURL=dirent-kind.js.map

package/dist/dirent-kind.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"dirent-kind.js","sourceRoot":"","sources":["../src/dirent-kind.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AAGH,OAAO,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AACnC,OAAO,EAAE,MAAM,kBAAkB,CAAC;AAElC,OAAO,EAAE,iBAAiB,EAAE,MAAM,mBAAmB,CAAC;AACtD,OAAO,EAAE,QAAQ,EAAE,MAAM,uBAAuB,CAAC;AACjD,OAAO,EAAE,cAAc,EAAE,MAAM,gBAAgB,CAAC;AAChD,OAAO,EAAE,aAAa,EAAE,QAAQ,EAAE,MAAM,iBAAiB,CAAC;AAQ1D;;;;;GAKG;AACH,MAAM,UAAU,UAAU,CAAC,KAAa;IACtC,IAAI,KAAK,CAAC,cAAc,EAAE;QAAE,OAAO,SAAS,CAAC;IAC7C,IAAI,KAAK,CAAC,WAAW,EAAE;QAAE,OAAO,WAAW,CAAC;IAC5C,IAAI,KAAK,CAAC,MAAM,EAAE;QAAE,OAAO,MAAM,CAAC;IAClC,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,wCAAwC;AACxC,SAAS,WAAW,CAAC,KAAoD;IACvE,IAAI,KAAK,CAAC,WAAW,EAAE;QAAE,OAAO,WAAW,CAAC;IAC5C,IAAI,KAAK,CAAC,MAAM,EAAE;QAAE,OAAO,MAAM,CAAC;IAClC,OAAO,OAAO,CAAC;AACjB,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,UAAU,uBAAuB,CAAC,GAAW,EAAE,KAAa;IAChE,IAAI,CAAC,KAAK,CAAC,cAAc,EAAE;QAAE,OAAO,WAAW,CAAC,KAAK,CAAC,CAAC;IACvD,IAAI,CAAC;QACH,OAAO,WAAW,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAC/D,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,iBAAiB,CAAC,KAAK,CAAC;YAAE,OAAO,UAAU,CAAC;QAChD,MAAM,KAAK,CAAC;IACd,CAAC;AACH,CAAC;AAED,gEAAgE;AAChE,MAAM,CAAC,KAAK,UAAU,mBAAmB,CAAC,GAAW,EAAE,KAAa;IAClE,IAAI,CAAC,KAAK,CAAC,cAAc,EAAE;QAAE,OAAO,WAAW,CAAC,KAAK,CAAC,CAAC;IACvD,IAAI,CAAC;QACH,OAAO,WAAW,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IACpE,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,iBAAiB,CAAC,KAAK,CAAC;YAAE,OAAO,UAAU,CAAC;QAChD,MAAM,KAAK,CAAC;IACd,CAAC;AACH,CAAC;AAED,wFAAwF;AACxF,MAAM,OAAO,2BAA4B,SAAQ,QAAQ;IACvD,YAAY,GAAW,EAAE,SAAiB;QACxC,KAAK,CACH,0BAA0B,EAC1B,qBAAqB,GAAG,2CAA2C,SAAS,+CAA+C,CAC5H,CAAC;IACJ,CAAC;CACF;AAED;;;;;;;;;;;;;GAaG;AACH,MAAM,OAAO,YAAY;IACd,QAAQ,GAAG,IAAI,GAAG,EAAkB,CAAC;IAE9C;;;;;;;OAOG;IACH,KAAK,CAAC,GAAW;QACf,MAAM,IAAI,GAAG,cAAc,CAAC,aAAa,CAAC,GAAG,CAAC,CAAC,CAAC;QAChD,MAAM,MAAM,GAAG,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QACvC,IAAI,MAAM,KAAK,SAAS;YAAE,MAAM,IAAI,2BAA2B,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;QAC7E,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;IAC/B,CAAC;CACF"}

package/dist/entrypoint.d.ts

@@ -0,0 +1,54 @@
+/**
+ * The one answer to "am I the script Node was asked to run?"
+ *
+ * Lives here, in the package every other one already depends on, because there
+ * has to be exactly one: the question was previously answered three different
+ * ways across this monorepo (`import.meta.main`, a raw `pathToFileURL` string
+ * compare, and this function), and two of those three answer `false` for the
+ * script they guard — which makes the process exit 0 having run nothing.
+ */
+/**
+ * Was this module invoked as the process entrypoint, rather than imported?
+ *
+ * ⛔ **Do not reach for `import.meta.main` here.** It shipped in Node 24.2 and
+ * 22.18; this repo declares a floor of `>=22.13.0`, and on a real 22.13.0 the
+ * property is `undefined`:
+ *
+ * ```
+ * $ node-v22.13.0 --input-type=module -e "console.log(import.meta.main)"  -> undefined
+ * ```
+ *
+ * That is not a cosmetic gap. Every `if (import.meta.main)` guard in the
+ * dev-tools package was silently dead on the declared floor — running
+ * `validate-repo-structure.ts` under 22.13.0 printed nothing and exited 0, so a
+ * contributor sitting exactly on the supported Node got a green pre-commit
+ * structure gate that had run no rule at all. Raising the floor to 22.18 would
+ * have hidden the defect behind the number instead of fixing it.
+ *
+ * ⛔ **Nor the raw string compare it replaced**, which was the other seven
+ * guards in this repo:
+ *
+ * ```ts
+ * import.meta.url === pathToFileURL(process.argv[1]).href   // ❌
+ * ```
+ *
+ * A `node_modules/.bin` entry is a SYMLINK to the real script, so `argv[1]` is
+ * the link and `import.meta.url` is the resolved target. The two strings differ
+ * and the guard is false — measured false through a `.bin`-style symlink on both
+ * Node 22.14.0 and 24.13.1, where this function is true.
+ *
+ * `process.argv[1]` is defined on every Node this repo supports, so the
+ * comparison below is the portable form of the same question. The realpath pass
+ * covers the case where the script is reached through a symlink on one side of
+ * the comparison but not the other.
+ *
+ * `local/no-fragile-entrypoint-guard` (shipped on this package's `./eslint`
+ * subpath) is what keeps either of the two banned spellings from coming back —
+ * the prose comments that used to stand in for it did not.
+ *
+ * @param importMetaUrl - The calling module's `import.meta.url`
+ * @param entryPath - The invoked script path; defaults to `process.argv[1]`
+ * @returns `true` only when this module is the script Node was asked to run
+ */
+export declare function isEntrypoint(importMetaUrl: string, entryPath?: string | undefined): boolean;
+//# sourceMappingURL=entrypoint.d.ts.map

package/dist/entrypoint.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"entrypoint.d.ts","sourceRoot":"","sources":["../src/entrypoint.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAOH;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA0CG;AACH,wBAAgB,YAAY,CAC1B,aAAa,EAAE,MAAM,EACrB,SAAS,GAAE,MAAM,GAAG,SAA2B,GAC9C,OAAO,CAcT"}

package/dist/entrypoint.js

@@ -0,0 +1,71 @@
+/**
+ * The one answer to "am I the script Node was asked to run?"
+ *
+ * Lives here, in the package every other one already depends on, because there
+ * has to be exactly one: the question was previously answered three different
+ * ways across this monorepo (`import.meta.main`, a raw `pathToFileURL` string
+ * compare, and this function), and two of those three answer `false` for the
+ * script they guard — which makes the process exit 0 having run nothing.
+ */
+import { fileURLToPath } from 'node:url';
+import { safePath, toForwardSlash } from './path-core.js';
+import { normalizePath } from './path-utils.js';
+/**
+ * Was this module invoked as the process entrypoint, rather than imported?
+ *
+ * ⛔ **Do not reach for `import.meta.main` here.** It shipped in Node 24.2 and
+ * 22.18; this repo declares a floor of `>=22.13.0`, and on a real 22.13.0 the
+ * property is `undefined`:
+ *
+ * ```
+ * $ node-v22.13.0 --input-type=module -e "console.log(import.meta.main)"  -> undefined
+ * ```
+ *
+ * That is not a cosmetic gap. Every `if (import.meta.main)` guard in the
+ * dev-tools package was silently dead on the declared floor — running
+ * `validate-repo-structure.ts` under 22.13.0 printed nothing and exited 0, so a
+ * contributor sitting exactly on the supported Node got a green pre-commit
+ * structure gate that had run no rule at all. Raising the floor to 22.18 would
+ * have hidden the defect behind the number instead of fixing it.
+ *
+ * ⛔ **Nor the raw string compare it replaced**, which was the other seven
+ * guards in this repo:
+ *
+ * ```ts
+ * import.meta.url === pathToFileURL(process.argv[1]).href   // ❌
+ * ```
+ *
+ * A `node_modules/.bin` entry is a SYMLINK to the real script, so `argv[1]` is
+ * the link and `import.meta.url` is the resolved target. The two strings differ
+ * and the guard is false — measured false through a `.bin`-style symlink on both
+ * Node 22.14.0 and 24.13.1, where this function is true.
+ *
+ * `process.argv[1]` is defined on every Node this repo supports, so the
+ * comparison below is the portable form of the same question. The realpath pass
+ * covers the case where the script is reached through a symlink on one side of
+ * the comparison but not the other.
+ *
+ * `local/no-fragile-entrypoint-guard` (shipped on this package's `./eslint`
+ * subpath) is what keeps either of the two banned spellings from coming back —
+ * the prose comments that used to stand in for it did not.
+ *
+ * @param importMetaUrl - The calling module's `import.meta.url`
+ * @param entryPath - The invoked script path; defaults to `process.argv[1]`
+ * @returns `true` only when this module is the script Node was asked to run
+ */
+export function isEntrypoint(importMetaUrl, entryPath = process.argv[1]) {
+    // An empty argv[1] would resolve to the cwd and could then match a module by
+    // accident; `undefined` happens under `node -e`. Neither is an entrypoint.
+    if (entryPath === undefined || entryPath === '')
+        return false;
+    const modulePath = safePath.resolve(fileURLToPath(importMetaUrl));
+    const invokedPath = safePath.resolve(entryPath);
+    if (modulePath === invokedPath)
+        return true;
+    // `normalizePath` resolves symlinks and Windows 8.3 short names, and returns
+    // the path unchanged when it cannot — which is the right answer here, since
+    // the string comparison above has already decided the two differ and an
+    // unresolvable path carries no symlink information to compare.
+    return toForwardSlash(normalizePath(modulePath)) === toForwardSlash(normalizePath(invokedPath));
+}
+//# sourceMappingURL=entrypoint.js.map

package/dist/entrypoint.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"entrypoint.js","sourceRoot":"","sources":["../src/entrypoint.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AAEzC,OAAO,EAAE,QAAQ,EAAE,cAAc,EAAE,MAAM,gBAAgB,CAAC;AAC1D,OAAO,EAAE,aAAa,EAAE,MAAM,iBAAiB,CAAC;AAEhD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA0CG;AACH,MAAM,UAAU,YAAY,CAC1B,aAAqB,EACrB,YAAgC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC;IAE/C,6EAA6E;IAC7E,2EAA2E;IAC3E,IAAI,SAAS,KAAK,SAAS,IAAI,SAAS,KAAK,EAAE;QAAE,OAAO,KAAK,CAAC;IAE9D,MAAM,UAAU,GAAG,QAAQ,CAAC,OAAO,CAAC,aAAa,CAAC,aAAa,CAAC,CAAC,CAAC;IAClE,MAAM,WAAW,GAAG,QAAQ,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;IAChD,IAAI,UAAU,KAAK,WAAW;QAAE,OAAO,IAAI,CAAC;IAE5C,6EAA6E;IAC7E,4EAA4E;IAC5E,wEAAwE;IACxE,+DAA+D;IAC/D,OAAO,cAAc,CAAC,aAAa,CAAC,UAAU,CAAC,CAAC,KAAK,cAAc,CAAC,aAAa,CAAC,WAAW,CAAC,CAAC,CAAC;AAClG,CAAC"}

package/dist/env-flag.d.ts

@@ -0,0 +1,51 @@
+/**
+ * Read an environment variable as a boolean.
+ *
+ * 🔑 **Returns `undefined` for anything it does not recognise, and never
+ * guesses.** That is the whole point: the caller — not this function — decides
+ * what an unreadable value means, because only the caller knows which way is
+ * safe. A token-fetching kill switch wants "deny"; a cache toggle wants
+ * "leave the cache on". A parser that folded the unknown case into `false`
+ * would have made that choice for both of them.
+ *
+ * 🚨 **Why this exists at all.** Three switches were each a comparison against
+ * the literal string `'0'`, so `=false` turned none of them off — measured for
+ * `VAT_LINKAUTH_ALLOW_COMMAND`, which *still spawned subprocesses*. Every
+ * spelling a human reaches for (`false`, `no`, `off`, `FALSE`, a value with a
+ * stray space) failed open. A switch whose off position is one exact string is
+ * not a switch.
+ *
+ * 📍 **Why it lives in `utils`.** It was written next to its first consumer in
+ * `resources`, on the rule that utils takes a utility when a SECOND package
+ * needs it rather than speculatively. That second package arrived:
+ * `packages/cli`'s `projectionStoreSelected()` reads the same `VAT_CACHE` the
+ * `resources` parse cache does, and two independent readings of one variable is
+ * the defect, not the fix. The four consumers today:
+ *
+ * | Caller | Variable | Reads `undefined` as | Why |
+ * |---|---|---|---|
+ * | `link-auth/resolve-token.ts` | `VAT_LINKAUTH_ALLOW_COMMAND` | **deny** | gates a capability — fail closed |
+ * | `resources/parse-cache.ts` | `VAT_CACHE` | cache stays on | gates a cache — an unreadable value must not silently change behaviour |
+ * | `cli/utils/projection-store.ts` | `VAT_CACHE` | not a veto | same variable, same reading, one implementation |
+ * | `cli/utils/projection-store.ts` | `VAT_PROJECTION_STORE` | not a veto | the projection store is ON by default; only an explicit off spelling (or an empty value, which that call site handles before asking) turns it off |
+ *
+ * Same parser, different safe sides, each chosen at its own call site. That is
+ * the contract; do not move a default in here.
+ *
+ * 🔑 The last two rows are the interesting pair: one variable defaults OFF and
+ * the other defaults ON, and both are still read through this one function,
+ * because what it answers is not "is this on" but "did the operator say no".
+ */
+/**
+ * Parse an env value as a boolean.
+ *
+ * Case-insensitive and surrounding whitespace is trimmed, because a value that
+ * arrived through a shell, a CI YAML block, or a `.env` file routinely carries
+ * both. Everything else — including the empty string, which is what an unset
+ * shell variable expands to — returns `undefined`.
+ *
+ * @param raw - The raw env value, or `undefined` when the variable is unset
+ * @returns `true` / `false` for a recognised spelling; `undefined` otherwise
+ */
+export declare function parseEnvBoolean(raw: string | undefined): boolean | undefined;
+//# sourceMappingURL=env-flag.d.ts.map

package/dist/env-flag.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"env-flag.d.ts","sourceRoot":"","sources":["../src/env-flag.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAqCG;AAKH;;;;;;;;;;GAUG;AACH,wBAAgB,eAAe,CAAC,GAAG,EAAE,MAAM,GAAG,SAAS,GAAG,OAAO,GAAG,SAAS,CAM5E"}

package/dist/env-flag.js

@@ -0,0 +1,62 @@
+/**
+ * Read an environment variable as a boolean.
+ *
+ * 🔑 **Returns `undefined` for anything it does not recognise, and never
+ * guesses.** That is the whole point: the caller — not this function — decides
+ * what an unreadable value means, because only the caller knows which way is
+ * safe. A token-fetching kill switch wants "deny"; a cache toggle wants
+ * "leave the cache on". A parser that folded the unknown case into `false`
+ * would have made that choice for both of them.
+ *
+ * 🚨 **Why this exists at all.** Three switches were each a comparison against
+ * the literal string `'0'`, so `=false` turned none of them off — measured for
+ * `VAT_LINKAUTH_ALLOW_COMMAND`, which *still spawned subprocesses*. Every
+ * spelling a human reaches for (`false`, `no`, `off`, `FALSE`, a value with a
+ * stray space) failed open. A switch whose off position is one exact string is
+ * not a switch.
+ *
+ * 📍 **Why it lives in `utils`.** It was written next to its first consumer in
+ * `resources`, on the rule that utils takes a utility when a SECOND package
+ * needs it rather than speculatively. That second package arrived:
+ * `packages/cli`'s `projectionStoreSelected()` reads the same `VAT_CACHE` the
+ * `resources` parse cache does, and two independent readings of one variable is
+ * the defect, not the fix. The four consumers today:
+ *
+ * | Caller | Variable | Reads `undefined` as | Why |
+ * |---|---|---|---|
+ * | `link-auth/resolve-token.ts` | `VAT_LINKAUTH_ALLOW_COMMAND` | **deny** | gates a capability — fail closed |
+ * | `resources/parse-cache.ts` | `VAT_CACHE` | cache stays on | gates a cache — an unreadable value must not silently change behaviour |
+ * | `cli/utils/projection-store.ts` | `VAT_CACHE` | not a veto | same variable, same reading, one implementation |
+ * | `cli/utils/projection-store.ts` | `VAT_PROJECTION_STORE` | not a veto | the projection store is ON by default; only an explicit off spelling (or an empty value, which that call site handles before asking) turns it off |
+ *
+ * Same parser, different safe sides, each chosen at its own call site. That is
+ * the contract; do not move a default in here.
+ *
+ * 🔑 The last two rows are the interesting pair: one variable defaults OFF and
+ * the other defaults ON, and both are still read through this one function,
+ * because what it answers is not "is this on" but "did the operator say no".
+ */
+const TRUE_SPELLINGS = new Set(['1', 'true', 'yes', 'y', 'on']);
+const FALSE_SPELLINGS = new Set(['0', 'false', 'no', 'n', 'off']);
+/**
+ * Parse an env value as a boolean.
+ *
+ * Case-insensitive and surrounding whitespace is trimmed, because a value that
+ * arrived through a shell, a CI YAML block, or a `.env` file routinely carries
+ * both. Everything else — including the empty string, which is what an unset
+ * shell variable expands to — returns `undefined`.
+ *
+ * @param raw - The raw env value, or `undefined` when the variable is unset
+ * @returns `true` / `false` for a recognised spelling; `undefined` otherwise
+ */
+export function parseEnvBoolean(raw) {
+    if (raw === undefined)
+        return undefined;
+    const normalized = raw.trim().toLowerCase();
+    if (TRUE_SPELLINGS.has(normalized))
+        return true;
+    if (FALSE_SPELLINGS.has(normalized))
+        return false;
+    return undefined;
+}
+//# sourceMappingURL=env-flag.js.map

package/dist/env-flag.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"env-flag.js","sourceRoot":"","sources":["../src/env-flag.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAqCG;AAEH,MAAM,cAAc,GAAwB,IAAI,GAAG,CAAC,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,GAAG,EAAE,IAAI,CAAC,CAAC,CAAC;AACrF,MAAM,eAAe,GAAwB,IAAI,GAAG,CAAC,CAAC,GAAG,EAAE,OAAO,EAAE,IAAI,EAAE,GAAG,EAAE,KAAK,CAAC,CAAC,CAAC;AAEvF;;;;;;;;;;GAUG;AACH,MAAM,UAAU,eAAe,CAAC,GAAuB;IACrD,IAAI,GAAG,KAAK,SAAS;QAAE,OAAO,SAAS,CAAC;IACxC,MAAM,UAAU,GAAG,GAAG,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IAC5C,IAAI,cAAc,CAAC,GAAG,CAAC,UAAU,CAAC;QAAE,OAAO,IAAI,CAAC;IAChD,IAAI,eAAe,CAAC,GAAG,CAAC,UAAU,CAAC;QAAE,OAAO,KAAK,CAAC;IAClD,OAAO,SAAS,CAAC;AACnB,CAAC"}

package/dist/errors/errno.d.ts

@@ -0,0 +1,51 @@
+/**
+ * Errno predicates — the two questions every catch site asks of an OS error,
+ * answered by the `code` on the error or down its `cause` chain.
+ *
+ * ⚠️ This module imports NOTHING. It is the leaf that `fs-utils.ts`,
+ * `path-utils.ts`, `dirent-kind.ts`, `path-containment.ts` and the rest of the
+ * package share; it lived in `fs-utils.ts` until that put three of them in an
+ * import cycle (`fs-utils → path-utils → fs-utils` and two more), and a leaf
+ * is the one place a shared predicate cannot re-open one. (The cycle was once
+ * blamed for a platform-dependent knip verdict on these two names; breaking it
+ * changed nothing there — the cause was a missing knip entry, see
+ * `docs/contributing/traps.md`, "A subpath module's re-exports flap by platform".)
+ */
+/**
+ * Whether `error` is the filesystem refusing a path rather than a bug.
+ *
+ * Deliberately NOT `error instanceof Error`: the point of every caller is to
+ * degrade on a hostile tree, and a `TypeError` from a validator is not that.
+ * Treating one as environmental turns a real defect into a warning about
+ * whichever file it happened on — which makes a tool quietest exactly when it is
+ * most wrong.
+ *
+ * Walks `cause`, because the errno is routinely re-wrapped on its way up. The CLI
+ * config loader turns a read failure into `new Error('Failed to load config: …')`;
+ * without following the chain the predicate answered "not a filesystem error" for
+ * a plain `EACCES`, and an unreadable config aborted a whole `vat audit` run. Any
+ * layer that adds context to an OS error defeats a `code`-only check, so the check
+ * cannot be `code`-only.
+ */
+export declare function isFilesystemAccessError(error: unknown): boolean;
+/**
+ * Whether `error` means **there is nothing at this path** — `ENOENT`, or
+ * `ENOTDIR` for a path whose component turned out to be a file — and nothing
+ * else.
+ *
+ * This is the narrowing a `try { stat(p) } catch { return null }` is rewritten
+ * to under the `no-blind-catch` lint rule: the sentinel stands for *absent*,
+ * so only an absence may produce it; a refusal (`EACCES`, `EPERM`, `ELOOP`) or
+ * a bug (`TypeError`) is rethrown and stays loud.
+ *
+ * ⚠️ Deliberately NOT {@link isFilesystemAccessError}. That predicate answers
+ * "is this the environment's fault?" and to answer it groups `ENOENT` with
+ * `EACCES` — the exact conflation that once turned an unreadable directory
+ * into an empty one. The two questions have two predicates on purpose; see
+ * also {@link listingFailure}, which makes the same split for `readdir`.
+ *
+ * Walks `cause` for the same reason its sibling does: the errno is routinely
+ * re-wrapped on its way up.
+ */
+export declare function isPathAbsentError(error: unknown): boolean;
+//# sourceMappingURL=errno.d.ts.map

package/dist/errors/errno.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"errno.d.ts","sourceRoot":"","sources":["../../src/errors/errno.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAwCH;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,uBAAuB,CAAC,KAAK,EAAE,OAAO,GAAG,OAAO,CAE/D;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,wBAAgB,iBAAiB,CAAC,KAAK,EAAE,OAAO,GAAG,OAAO,CAEzD"}