@wootsup/yt-builder-mcp 1.11.0 → 2.0.0

package/dist/sites/secret-resolver.js

@@ -1,49 +1,13 @@
-/**
- * W2 — Secret-Resolver: produce a bearer-token for a `SiteEntryT` at call
- * time, supporting either a plain in-file token (`bearer`) or a 1Password
- * Secret Reference (`bearer_ref`) resolved through the `op` CLI.
- *
- * Design choices (per plan §W2):
- *  - **`execFile`, never `exec`/`spawn` with `shell:true`.** `op read <ref>`
- *    must run as a direct `execve` with an argv array — no shell, no
- *    metacharacter expansion. The W1 schema already enforces
- *    {@link OP_REF_REGEX}; this module re-enforces it at the call site as
- *    defence-in-depth (a hand-edited sites.json could otherwise sneak a
- *    payload past validation).
- *  - **5-second hard timeout.** `op` is interactive in some failure modes
- *    (Touch-ID, biometric retry). We cap with a real timer + `kill()` to
- *    avoid agent-loop wedging on a stalled subprocess.
- *  - **Pluggable for testing.** The OpSecretResolver accepts an injected
- *    `execFile` callback so tests can mock subprocess invocation without
- *    monkey-patching the global `node:child_process` module.
- *
- * @license MIT
- */
 import { execFile as nodeExecFile } from 'node:child_process';
 import { existsSync } from 'node:fs';
 import { OP_REF_REGEX } from './schema.js';
-/** Hard cap for any single `op read` invocation. */
-const OP_TIMEOUT_MS = 5_000;
-/**
- * Common absolute install locations for the 1Password CLI. GUI-spawned
- * MCP hosts (Claude Desktop, etc.) launch the server subprocess with a
- * minimal PATH that usually omits `/opt/homebrew/bin` and `/usr/local/bin`,
- * so a bare `op` resolves to ENOENT even when the user has `op` working in
- * their shell. We probe these absolute paths before falling back to PATH.
- *
- * Order: Homebrew (Apple Silicon) → Homebrew/manual (Intel + /usr/local) →
- * Linux package managers → PATH.
- */
+import { redactCredentials } from '../errors/redact-credentials.js';
+export const OP_TIMEOUT_MS = 60_000;
 const OP_BINARY_CANDIDATES = [
     '/opt/homebrew/bin/op',
     '/usr/local/bin/op',
     '/usr/bin/op',
 ];
-/**
- * Resolve the `op` binary to an absolute path so it works under a
- * stripped-down GUI PATH. Precedence: explicit `YTB_MCP_OP_BINARY` env
- * override → first existing well-known absolute path → bare `op` (PATH).
- */
 export function resolveOpBinary(env = process.env) {
     const override = (env.YTB_MCP_OP_BINARY ?? '').trim();
     if (override.length > 0)
@@ -54,17 +18,17 @@ export function resolveOpBinary(env = process.env) {
                 return candidate;
         }
         catch {
-            // ignore stat errors and keep probing
         }
     }
     return 'op';
 }
-/** `op` CLI exit-code → friendly hint mapping. */
+export function hasServiceAccountToken(env = process.env) {
+    return (env.OP_SERVICE_ACCOUNT_TOKEN ?? '').trim().length > 0;
+}
 const OP_EXIT_CODE_HINTS = {
     6: 'Not signed in to 1Password CLI. Run `op signin` and retry.',
     1: 'Generic op CLI error — verify the secret reference exists and the vault is accessible.',
 };
-/** Domain-tagged error so callers (auth, client) can branch on `code`. */
 export class SecretResolverError extends Error {
     code;
     constructor(code, message) {
@@ -73,19 +37,11 @@ export class SecretResolverError extends Error {
         this.name = 'SecretResolverError';
     }
 }
-/** Default factory wrapping Node's real `execFile`. Adapter for type-shape. */
 const defaultExecFile = (file, args, options, callback) => {
-    // Pass `encoding: 'utf8'` explicitly so stdout/stderr are guaranteed
-    // strings, not Buffers. The execFile overload resolution returns `string`
-    // for both when `encoding` is set.
     nodeExecFile(file, args, { ...options, encoding: 'utf8' }, (err, stdout, stderr) => {
         callback(err, stdout, stderr);
     });
 };
-/**
- * Plain in-file bearer — used when `site.bearer` is populated. Returns the
- * stored token verbatim, with `source:'plain'`.
- */
 export class PlainSecretResolver {
     async resolve(site) {
         const token = site.bearer;
@@ -98,18 +54,19 @@ export class PlainSecretResolver {
         };
     }
 }
-/**
- * Resolves `bearer_ref` (`op://vault/item/field`) through the 1Password CLI.
- *
- * Failure surface:
- *  - Missing `bearer_ref`             → `OP_REF_MISSING`
- *  - Malformed ref at call site       → `OP_REF_INVALID`
- *  - `op` binary not on PATH (ENOENT) → `OP_CLI_MISSING`
- *  - `op` exit-code 6 (not signed in) → `OP_NOT_SIGNED_IN`
- *  - 5-second timeout exceeded        → `OP_TIMEOUT`
- *  - Empty/whitespace stdout          → `OP_EMPTY_OUTPUT`
- *  - Any other non-zero exit          → `OP_EXEC_FAILED`
- */
+function buildTimeoutMessage(ref, timeoutMs) {
+    if (hasServiceAccountToken()) {
+        return (`op read '${ref}' exceeded ${timeoutMs}ms while using `
+            + 'OP_SERVICE_ACCOUNT_TOKEN — a service account never shows a '
+            + 'biometric prompt, so this is not a stalled confirmation. '
+            + 'Check network connectivity to 1Password and that the token '
+            + 'is still valid.');
+    }
+    return (`op read '${ref}' exceeded ${timeoutMs}ms — is 1Password CLI hung `
+        + 'on a biometric prompt? If no confirmation dialog appeared, '
+        + 'verify the 1Password desktop app is running and its CLI '
+        + 'integration is enabled, or run `op signin`.');
+}
 export class OpSecretResolver {
     opBinary;
     execFile;
@@ -124,10 +81,6 @@ export class OpSecretResolver {
         if (ref === undefined || ref.length === 0) {
             throw new SecretResolverError('OP_REF_MISSING', `Site '${site.site_id}' has no 'bearer_ref' — OpSecretResolver requires one.`);
         }
-        // Defence-in-depth: re-validate the ref shape at the call site,
-        // BEFORE we hand the string to a subprocess. The W1 schema also
-        // enforces this on load/save, but a hand-edited or hot-loaded
-        // sites.json could in theory bypass that.
         if (!OP_REF_REGEX.test(ref)) {
             throw new SecretResolverError('OP_REF_INVALID', `Site '${site.site_id}' has an invalid 'bearer_ref' shape — must match op://<vault>/<item>/<field>.`);
         }
@@ -141,11 +94,6 @@ export class OpSecretResolver {
             source: 'op',
         };
     }
-    /**
-     * Invokes `op read <ref>` with a hard timeout. The promise is wrapped
-     * so a stalled subprocess (e.g. waiting on biometric prompt) cannot
-     * outlive {@link timeoutMs}.
-     */
     runOpRead(ref) {
         return new Promise((resolve, reject) => {
             let settled = false;
@@ -153,9 +101,8 @@ export class OpSecretResolver {
                 if (settled)
                     return;
                 settled = true;
-                reject(new SecretResolverError('OP_TIMEOUT', `op read '${ref}' exceeded ${this.timeoutMs}ms — is 1Password CLI hung on a biometric prompt?`));
+                reject(new SecretResolverError('OP_TIMEOUT', buildTimeoutMessage(ref, this.timeoutMs)));
             }, this.timeoutMs);
-            // Allow the test process to exit even if `op` is still pending.
             if (typeof timer.unref === 'function')
                 timer.unref();
             this.execFile(this.opBinary, ['read', ref], { timeout: this.timeoutMs, maxBuffer: 1024 * 64 }, (err, stdout, stderr) => {
@@ -164,46 +111,35 @@ export class OpSecretResolver {
                 settled = true;
                 clearTimeout(timer);
                 if (err) {
-                    reject(this.mapExecError(err, stderr, ref));
+                    reject(mapOpExecError(err, stderr, ref));
                     return;
                 }
                 resolve(stdout);
             });
         });
     }
-    mapExecError(err, stderr, ref) {
-        const codeStr = typeof err.code === 'string' ? err.code : '';
-        const codeNum = typeof err.code === 'number' ? err.code : NaN;
-        if (codeStr === 'ENOENT') {
-            return new SecretResolverError('OP_CLI_MISSING', `op CLI not found in PATH — install 1Password CLI or use plain bearer field instead of bearer_ref.`);
-        }
-        // W12-R1.2 (A5-S4): the `op` CLI returns "isn't an item" / "item
-        // not found" on stderr when the ref points to a nonexistent item.
-        // Surfaced as generic OP_EXEC_FAILED pre-W12, which left the
-        // customer guessing whether their ref shape was wrong vs whether
-        // the item was deleted. Brand it explicitly so the recovery hint
-        // can name the right knob.
-        const stderrLower = (stderr || '').toLowerCase();
-        if (stderrLower.includes(`isn't an item`)
-            || stderrLower.includes('item not found')) {
-            return new SecretResolverError('OP_ITEM_NOT_FOUND', `1Password item not found at '${ref}'. `
-                + 'Verify the ref points to an existing item, or update sites.json bearer_ref.');
-        }
-        if (Number.isFinite(codeNum)) {
-            const hint = OP_EXIT_CODE_HINTS[codeNum];
-            if (codeNum === 6) {
-                return new SecretResolverError('OP_NOT_SIGNED_IN', hint ?? `op exited 6 — not signed in.`);
-            }
-            return new SecretResolverError('OP_EXEC_FAILED', `op read '${ref}' failed with exit ${codeNum}: ${(stderr || '').trim() || (hint ?? 'no stderr')}`);
+}
+export function mapOpExecError(err, stderr, ref) {
+    const codeStr = typeof err.code === 'string' ? err.code : '';
+    const codeNum = typeof err.code === 'number' ? err.code : NaN;
+    if (codeStr === 'ENOENT') {
+        return new SecretResolverError('OP_CLI_MISSING', `op CLI not found in PATH — install 1Password CLI or use plain bearer field instead of bearer_ref.`);
+    }
+    const stderrLower = (stderr || '').toLowerCase();
+    if (stderrLower.includes(`isn't an item`)
+        || stderrLower.includes('item not found')) {
+        return new SecretResolverError('OP_ITEM_NOT_FOUND', `1Password item not found at '${redactCredentials(ref)}'. `
+            + 'Verify the ref points to an existing item, or update sites.json bearer_ref.');
+    }
+    if (Number.isFinite(codeNum)) {
+        const hint = OP_EXIT_CODE_HINTS[codeNum];
+        if (codeNum === 6) {
+            return new SecretResolverError('OP_NOT_SIGNED_IN', hint ?? `op exited 6 — not signed in.`);
         }
-        return new SecretResolverError('OP_EXEC_FAILED', `op read '${ref}' failed: ${err.message}`);
+        return new SecretResolverError('OP_EXEC_FAILED', `op read '${redactCredentials(ref)}' failed with exit ${codeNum}: ${(stderr || '').trim() || (hint ?? 'no stderr')}`);
     }
+    return new SecretResolverError('OP_EXEC_FAILED', `op read '${redactCredentials(ref)}' failed: ${redactCredentials(err.message)}`);
 }
-/**
- * Composite resolver — chooses Plain/Op per site at resolve-time. This is
- * the resolver wired into the registry in W4; W2 ships it standalone so
- * unit tests cover the routing logic in isolation from any caching.
- */
 export class CompositeSecretResolver {
     plain;
     op;
@@ -218,7 +154,6 @@ export class CompositeSecretResolver {
         return this.plain.resolve(site);
     }
 }
-/** Default factory consumed by the W4 registry / W5 auth pipeline. */
 export function defaultSecretResolver() {
     return new CompositeSecretResolver();
 }

package/dist/sites/secret-resolver.js.map

@@ -1 +1 @@
-{"version":3,"file":"secret-resolver.js","sourceRoot":"","sources":["../../src/sites/secret-resolver.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AAEH,OAAO,EAAE,QAAQ,IAAI,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAC9D,OAAO,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AAErC,OAAO,EAAE,YAAY,EAAmB,MAAM,aAAa,CAAC;AAE5D,oDAAoD;AACpD,MAAM,aAAa,GAAG,KAAK,CAAC;AAE5B;;;;;;;;;GASG;AACH,MAAM,oBAAoB,GAAsB;IAC5C,sBAAsB;IACtB,mBAAmB;IACnB,aAAa;CAChB,CAAC;AAEF;;;;GAIG;AACH,MAAM,UAAU,eAAe,CAC3B,MAAyB,OAAO,CAAC,GAAG;IAEpC,MAAM,QAAQ,GAAG,CAAC,GAAG,CAAC,iBAAiB,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;IACtD,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC;QAAE,OAAO,QAAQ,CAAC;IACzC,KAAK,MAAM,SAAS,IAAI,oBAAoB,EAAE,CAAC;QAC3C,IAAI,CAAC;YACD,IAAI,UAAU,CAAC,SAAS,CAAC;gBAAE,OAAO,SAAS,CAAC;QAChD,CAAC;QAAC,MAAM,CAAC;YACL,sCAAsC;QAC1C,CAAC;IACL,CAAC;IACD,OAAO,IAAI,CAAC;AAChB,CAAC;AAED,kDAAkD;AAClD,MAAM,kBAAkB,GAA2B;IAC/C,CAAC,EAAE,4DAA4D;IAC/D,CAAC,EAAE,wFAAwF;CAC9F,CAAC;AAuBF,0EAA0E;AAC1E,MAAM,OAAO,mBAAoB,SAAQ,KAAK;IACd;IAA5B,YAA4B,IAAY,EAAE,OAAe;QACrD,KAAK,CAAC,OAAO,CAAC,CAAC;QADS,SAAI,GAAJ,IAAI,CAAQ;QAEpC,IAAI,CAAC,IAAI,GAAG,qBAAqB,CAAC;IACtC,CAAC;CACJ;AAsBD,+EAA+E;AAC/E,MAAM,eAAe,GAAiB,CAAC,IAAI,EAAE,IAAI,EAAE,OAAO,EAAE,QAAQ,EAAE,EAAE;IACpE,qEAAqE;IACrE,0EAA0E;IAC1E,mCAAmC;IACnC,YAAY,CACR,IAAI,EACJ,IAAgB,EAChB,EAAE,GAAG,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,EAChC,CAAC,GAAG,EAAE,MAAM,EAAE,MAAM,EAAE,EAAE;QACpB,QAAQ,CACJ,GAAmE,EACnE,MAAM,EACN,MAAM,CACT,CAAC;IACN,CAAC,CACJ,CAAC;AACN,CAAC,CAAC;AAEF;;;GAGG;AACH,MAAM,OAAO,mBAAmB;IAC5B,KAAK,CAAC,OAAO,CAAC,IAAgB;QAC1B,MAAM,KAAK,GAAG,IAAI,CAAC,MAAM,CAAC;QAC1B,IAAI,KAAK,KAAK,SAAS,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC5C,MAAM,IAAI,mBAAmB,CACzB,sBAAsB,EACtB,SAAS,IAAI,CAAC,OAAO,+DAA+D,CACvF,CAAC;QACN,CAAC;QACD,OAAO;YACH,KAAK;YACL,MAAM,EAAE,OAAO;SAClB,CAAC;IACN,CAAC;CACJ;AAED;;;;;;;;;;;GAWG;AACH,MAAM,OAAO,gBAAgB;IAEJ;IACA;IACA;IAHrB,YACqB,WAAmB,eAAe,EAAE,EACpC,WAAyB,eAAe,EACxC,YAAoB,aAAa;QAFjC,aAAQ,GAAR,QAAQ,CAA4B;QACpC,aAAQ,GAAR,QAAQ,CAAgC;QACxC,cAAS,GAAT,SAAS,CAAwB;IACnD,CAAC;IAEJ,KAAK,CAAC,OAAO,CAAC,IAAgB;QAC1B,MAAM,GAAG,GAAG,IAAI,CAAC,UAAU,CAAC;QAC5B,IAAI,GAAG,KAAK,SAAS,IAAI,GAAG,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACxC,MAAM,IAAI,mBAAmB,CACzB,gBAAgB,EAChB,SAAS,IAAI,CAAC,OAAO,wDAAwD,CAChF,CAAC;QACN,CAAC;QAED,gEAAgE;QAChE,gEAAgE;QAChE,8DAA8D;QAC9D,0CAA0C;QAC1C,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;YAC1B,MAAM,IAAI,mBAAmB,CACzB,gBAAgB,EAChB,SAAS,IAAI,CAAC,OAAO,+EAA+E,CACvG,CAAC;QACN,CAAC;QAED,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC;QACzC,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,EAAE,CAAC;QAC5B,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACrB,MAAM,IAAI,mBAAmB,CACzB,iBAAiB,EACjB,iCAAiC,GAAG,+CAA+C,CACtF,CAAC;QACN,CAAC;QAED,OAAO;YACH,KAAK;YACL,MAAM,EAAE,IAAI;SACf,CAAC;IACN,CAAC;IAED;;;;OAIG;IACK,SAAS,CAAC,GAAW;QACzB,OAAO,IAAI,OAAO,CAAS,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;YAC3C,IAAI,OAAO,GAAG,KAAK,CAAC;YACpB,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE;gBAC1B,IAAI,OAAO;oBAAE,OAAO;gBACpB,OAAO,GAAG,IAAI,CAAC;gBACf,MAAM,CACF,IAAI,mBAAmB,CACnB,YAAY,EACZ,YAAY,GAAG,cAAc,IAAI,CAAC,SAAS,mDAAmD,CACjG,CACJ,CAAC;YACN,CAAC,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC;YAEnB,gEAAgE;YAChE,IAAI,OAAO,KAAK,CAAC,KAAK,KAAK,UAAU;gBAAE,KAAK,CAAC,KAAK,EAAE,CAAC;YAErD,IAAI,CAAC,QAAQ,CACT,IAAI,CAAC,QAAQ,EACb,CAAC,MAAM,EAAE,GAAG,CAAC,EACb,EAAE,OAAO,EAAE,IAAI,CAAC,SAAS,EAAE,SAAS,EAAE,IAAI,GAAG,EAAE,EAAE,EACjD,CAAC,GAAG,EAAE,MAAM,EAAE,MAAM,EAAE,EAAE;gBACpB,IAAI,OAAO;oBAAE,OAAO;gBACpB,OAAO,GAAG,IAAI,CAAC;gBACf,YAAY,CAAC,KAAK,CAAC,CAAC;gBAEpB,IAAI,GAAG,EAAE,CAAC;oBACN,MAAM,CAAC,IAAI,CAAC,YAAY,CAAC,GAAG,EAAE,MAAM,EAAE,GAAG,CAAC,CAAC,CAAC;oBAC5C,OAAO;gBACX,CAAC;gBACD,OAAO,CAAC,MAAM,CAAC,CAAC;YACpB,CAAC,CACJ,CAAC;QACN,CAAC,CAAC,CAAC;IACP,CAAC;IAEO,YAAY,CAChB,GAAwD,EACxD,MAAc,EACd,GAAW;QAEX,MAAM,OAAO,GAAG,OAAO,GAAG,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC;QAC7D,MAAM,OAAO,GAAG,OAAO,GAAG,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC;QAE9D,IAAI,OAAO,KAAK,QAAQ,EAAE,CAAC;YACvB,OAAO,IAAI,mBAAmB,CAC1B,gBAAgB,EAChB,mGAAmG,CACtG,CAAC;QACN,CAAC;QAED,iEAAiE;QACjE,kEAAkE;QAClE,6DAA6D;QAC7D,iEAAiE;QACjE,iEAAiE;QACjE,2BAA2B;QAC3B,MAAM,WAAW,GAAG,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC;QACjD,IACI,WAAW,CAAC,QAAQ,CAAC,eAAe,CAAC;eAClC,WAAW,CAAC,QAAQ,CAAC,gBAAgB,CAAC,EAC3C,CAAC;YACC,OAAO,IAAI,mBAAmB,CAC1B,mBAAmB,EACnB,gCAAgC,GAAG,KAAK;kBACtC,6EAA6E,CAClF,CAAC;QACN,CAAC;QAED,IAAI,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC;YAC3B,MAAM,IAAI,GAAG,kBAAkB,CAAC,OAAO,CAAC,CAAC;YACzC,IAAI,OAAO,KAAK,CAAC,EAAE,CAAC;gBAChB,OAAO,IAAI,mBAAmB,CAC1B,kBAAkB,EAClB,IAAI,IAAI,8BAA8B,CACzC,CAAC;YACN,CAAC;YACD,OAAO,IAAI,mBAAmB,CAC1B,gBAAgB,EAChB,YAAY,GAAG,sBAAsB,OAAO,KAAK,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI,IAAI,WAAW,CAAC,EAAE,CACpG,CAAC;QACN,CAAC;QAED,OAAO,IAAI,mBAAmB,CAC1B,gBAAgB,EAChB,YAAY,GAAG,aAAa,GAAG,CAAC,OAAO,EAAE,CAC5C,CAAC;IACN,CAAC;CACJ;AAED;;;;GAIG;AACH,MAAM,OAAO,uBAAuB;IAEX;IACA;IAFrB,YACqB,QAAwB,IAAI,mBAAmB,EAAE,EACjD,KAAqB,IAAI,gBAAgB,EAAE;QAD3C,UAAK,GAAL,KAAK,CAA4C;QACjD,OAAE,GAAF,EAAE,CAAyC;IAC7D,CAAC;IAEJ,KAAK,CAAC,OAAO,CAAC,IAAgB;QAC1B,IAAI,IAAI,CAAC,UAAU,KAAK,SAAS,EAAE,CAAC;YAChC,OAAO,IAAI,CAAC,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;QACjC,CAAC;QACD,OAAO,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;IACpC,CAAC;CACJ;AAED,sEAAsE;AACtE,MAAM,UAAU,qBAAqB;IACjC,OAAO,IAAI,uBAAuB,EAAE,CAAC;AACzC,CAAC"}
+{"version":3,"file":"secret-resolver.js","sourceRoot":"","sources":["../../src/sites/secret-resolver.ts"],"names":[],"mappings":"AAgCA,OAAO,EAAE,QAAQ,IAAI,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAC9D,OAAO,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AAErC,OAAO,EAAE,YAAY,EAAmB,MAAM,aAAa,CAAC;AAC5D,OAAO,EAAE,iBAAiB,EAAE,MAAM,iCAAiC,CAAC;AAkDpE,MAAM,CAAC,MAAM,aAAa,GAAG,MAAM,CAAC;AAYpC,MAAM,oBAAoB,GAAsB;IAC5C,sBAAsB;IACtB,mBAAmB;IACnB,aAAa;CAChB,CAAC;AAOF,MAAM,UAAU,eAAe,CAC3B,MAAyB,OAAO,CAAC,GAAG;IAEpC,MAAM,QAAQ,GAAG,CAAC,GAAG,CAAC,iBAAiB,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;IACtD,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC;QAAE,OAAO,QAAQ,CAAC;IACzC,KAAK,MAAM,SAAS,IAAI,oBAAoB,EAAE,CAAC;QAC3C,IAAI,CAAC;YACD,IAAI,UAAU,CAAC,SAAS,CAAC;gBAAE,OAAO,SAAS,CAAC;QAChD,CAAC;QAAC,MAAM,CAAC;QAET,CAAC;IACL,CAAC;IACD,OAAO,IAAI,CAAC;AAChB,CAAC;AAaD,MAAM,UAAU,sBAAsB,CAClC,MAAyB,OAAO,CAAC,GAAG;IAEpC,OAAO,CAAC,GAAG,CAAC,wBAAwB,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC,CAAC;AAClE,CAAC;AAGD,MAAM,kBAAkB,GAA2B;IAC/C,CAAC,EAAE,4DAA4D;IAC/D,CAAC,EAAE,wFAAwF;CAC9F,CAAC;AAwBF,MAAM,OAAO,mBAAoB,SAAQ,KAAK;IACd;IAA5B,YAA4B,IAAY,EAAE,OAAe;QACrD,KAAK,CAAC,OAAO,CAAC,CAAC;QADS,SAAI,GAAJ,IAAI,CAAQ;QAEpC,IAAI,CAAC,IAAI,GAAG,qBAAqB,CAAC;IACtC,CAAC;CACJ;AAuBD,MAAM,eAAe,GAAiB,CAAC,IAAI,EAAE,IAAI,EAAE,OAAO,EAAE,QAAQ,EAAE,EAAE;IAIpE,YAAY,CACR,IAAI,EACJ,IAAgB,EAChB,EAAE,GAAG,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,EAChC,CAAC,GAAG,EAAE,MAAM,EAAE,MAAM,EAAE,EAAE;QACpB,QAAQ,CACJ,GAAmE,EACnE,MAAM,EACN,MAAM,CACT,CAAC;IACN,CAAC,CACJ,CAAC;AACN,CAAC,CAAC;AAMF,MAAM,OAAO,mBAAmB;IAC5B,KAAK,CAAC,OAAO,CAAC,IAAgB;QAC1B,MAAM,KAAK,GAAG,IAAI,CAAC,MAAM,CAAC;QAC1B,IAAI,KAAK,KAAK,SAAS,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC5C,MAAM,IAAI,mBAAmB,CACzB,sBAAsB,EACtB,SAAS,IAAI,CAAC,OAAO,+DAA+D,CACvF,CAAC;QACN,CAAC;QACD,OAAO;YACH,KAAK;YACL,MAAM,EAAE,OAAO;SAClB,CAAC;IACN,CAAC;CACJ;AASD,SAAS,mBAAmB,CAAC,GAAW,EAAE,SAAiB;IACvD,IAAI,sBAAsB,EAAE,EAAE,CAAC;QAC3B,OAAO,CACH,YAAY,GAAG,cAAc,SAAS,iBAAiB;cACrD,6DAA6D;cAC7D,2DAA2D;cAC3D,6DAA6D;cAC7D,iBAAiB,CACtB,CAAC;IACN,CAAC;IACD,OAAO,CACH,YAAY,GAAG,cAAc,SAAS,6BAA6B;UACjE,6DAA6D;UAC7D,0DAA0D;UAC1D,6CAA6C,CAClD,CAAC;AACN,CAAC;AA6CD,MAAM,OAAO,gBAAgB;IAEJ;IACA;IACA;IAHrB,YACqB,WAAmB,eAAe,EAAE,EACpC,WAAyB,eAAe,EACxC,YAAoB,aAAa;QAFjC,aAAQ,GAAR,QAAQ,CAA4B;QACpC,aAAQ,GAAR,QAAQ,CAAgC;QACxC,cAAS,GAAT,SAAS,CAAwB;IACnD,CAAC;IAEJ,KAAK,CAAC,OAAO,CAAC,IAAgB;QAC1B,MAAM,GAAG,GAAG,IAAI,CAAC,UAAU,CAAC;QAC5B,IAAI,GAAG,KAAK,SAAS,IAAI,GAAG,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACxC,MAAM,IAAI,mBAAmB,CACzB,gBAAgB,EAChB,SAAS,IAAI,CAAC,OAAO,wDAAwD,CAChF,CAAC;QACN,CAAC;QAMD,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;YAC1B,MAAM,IAAI,mBAAmB,CACzB,gBAAgB,EAChB,SAAS,IAAI,CAAC,OAAO,+EAA+E,CACvG,CAAC;QACN,CAAC;QAED,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC;QACzC,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,EAAE,CAAC;QAC5B,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACrB,MAAM,IAAI,mBAAmB,CACzB,iBAAiB,EACjB,iCAAiC,GAAG,+CAA+C,CACtF,CAAC;QACN,CAAC;QAED,OAAO;YACH,KAAK;YACL,MAAM,EAAE,IAAI;SACf,CAAC;IACN,CAAC;IAOO,SAAS,CAAC,GAAW;QACzB,OAAO,IAAI,OAAO,CAAS,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;YAC3C,IAAI,OAAO,GAAG,KAAK,CAAC;YACpB,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE;gBAC1B,IAAI,OAAO;oBAAE,OAAO;gBACpB,OAAO,GAAG,IAAI,CAAC;gBACf,MAAM,CACF,IAAI,mBAAmB,CACnB,YAAY,EACZ,mBAAmB,CAAC,GAAG,EAAE,IAAI,CAAC,SAAS,CAAC,CAC3C,CACJ,CAAC;YACN,CAAC,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC;YAGnB,IAAI,OAAO,KAAK,CAAC,KAAK,KAAK,UAAU;gBAAE,KAAK,CAAC,KAAK,EAAE,CAAC;YAErD,IAAI,CAAC,QAAQ,CACT,IAAI,CAAC,QAAQ,EACb,CAAC,MAAM,EAAE,GAAG,CAAC,EACb,EAAE,OAAO,EAAE,IAAI,CAAC,SAAS,EAAE,SAAS,EAAE,IAAI,GAAG,EAAE,EAAE,EACjD,CAAC,GAAG,EAAE,MAAM,EAAE,MAAM,EAAE,EAAE;gBACpB,IAAI,OAAO;oBAAE,OAAO;gBACpB,OAAO,GAAG,IAAI,CAAC;gBACf,YAAY,CAAC,KAAK,CAAC,CAAC;gBAEpB,IAAI,GAAG,EAAE,CAAC;oBACN,MAAM,CAAC,cAAc,CAAC,GAAG,EAAE,MAAM,EAAE,GAAG,CAAC,CAAC,CAAC;oBACzC,OAAO;gBACX,CAAC;gBACD,OAAO,CAAC,MAAM,CAAC,CAAC;YACpB,CAAC,CACJ,CAAC;QACN,CAAC,CAAC,CAAC;IACP,CAAC;CACJ;AAUD,MAAM,UAAU,cAAc,CAC1B,GAAwD,EACxD,MAAc,EACd,GAAW;IAEX,MAAM,OAAO,GAAG,OAAO,GAAG,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC;IAC7D,MAAM,OAAO,GAAG,OAAO,GAAG,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC;IAE9D,IAAI,OAAO,KAAK,QAAQ,EAAE,CAAC;QACvB,OAAO,IAAI,mBAAmB,CAC1B,gBAAgB,EAChB,mGAAmG,CACtG,CAAC;IACN,CAAC;IAQD,MAAM,WAAW,GAAG,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC;IACjD,IACI,WAAW,CAAC,QAAQ,CAAC,eAAe,CAAC;WAClC,WAAW,CAAC,QAAQ,CAAC,gBAAgB,CAAC,EAC3C,CAAC;QACC,OAAO,IAAI,mBAAmB,CAC1B,mBAAmB,EACnB,gCAAgC,iBAAiB,CAAC,GAAG,CAAC,KAAK;cACzD,6EAA6E,CAClF,CAAC;IACN,CAAC;IAED,IAAI,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC;QAC3B,MAAM,IAAI,GAAG,kBAAkB,CAAC,OAAO,CAAC,CAAC;QACzC,IAAI,OAAO,KAAK,CAAC,EAAE,CAAC;YAChB,OAAO,IAAI,mBAAmB,CAC1B,kBAAkB,EAClB,IAAI,IAAI,8BAA8B,CACzC,CAAC;QACN,CAAC;QACD,OAAO,IAAI,mBAAmB,CAC1B,gBAAgB,EAChB,YAAY,iBAAiB,CAAC,GAAG,CAAC,sBAAsB,OAAO,KAAK,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI,IAAI,WAAW,CAAC,EAAE,CACvH,CAAC;IACN,CAAC;IAED,OAAO,IAAI,mBAAmB,CAC1B,gBAAgB,EAChB,YAAY,iBAAiB,CAAC,GAAG,CAAC,aAAa,iBAAiB,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,CAClF,CAAC;AACN,CAAC;AAOD,MAAM,OAAO,uBAAuB;IAEX;IACA;IAFrB,YACqB,QAAwB,IAAI,mBAAmB,EAAE,EACjD,KAAqB,IAAI,gBAAgB,EAAE;QAD3C,UAAK,GAAL,KAAK,CAA4C;QACjD,OAAE,GAAF,EAAE,CAAyC;IAC7D,CAAC;IAEJ,KAAK,CAAC,OAAO,CAAC,IAAgB;QAC1B,IAAI,IAAI,CAAC,UAAU,KAAK,SAAS,EAAE,CAAC;YAChC,OAAO,IAAI,CAAC,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;QACjC,CAAC;QACD,OAAO,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;IACpC,CAAC;CACJ;AAGD,MAAM,UAAU,qBAAqB;IACjC,OAAO,IAAI,uBAAuB,EAAE,CAAC;AACzC,CAAC"}

package/dist/sites/store.d.ts

@@ -1,89 +1,32 @@
-/**
- * W1 — Sites-Storage Foundation: load/save the sites file.
- *
- * Guarantees:
- *  - **Atomic replace.** Writes go to a sibling `*.tmp.<rand>` file, are
- *    fsynced, chmod'd to 0600, and then `rename(2)`d over the target.
- *    A SIGINT/SIGKILL between any two of these steps leaves either the
- *    old file intact or the new file fully written — never a torn write.
- *  - **Lock for concurrent writers.** `proper-lockfile` acquires an
- *    advisory lockfile (`<file>.lock`) before any read/modify/write
- *    cycle. Default `stale: 10000` ms; second concurrent save retries
- *    with exponential back-off (`retries: 10, minTimeout: 50`).
- *  - **0600 mode on write.** The temp file is opened/chmod'd to 0600
- *    BEFORE the rename so the new inode never exists with looser perms,
- *    even for one fsync window.
- *  - **Schema-version gate.** Refuses to load a file with a version we
- *    don't understand — explicit error, never silent migration.
- *
- * @license MIT
- */
 import { type SitesFileT } from './schema.js';
-/** Base class for any sites-file IO/format failure. */
 export declare class SitesFileError extends Error {
     readonly cause?: unknown | undefined;
     constructor(message: string, cause?: unknown | undefined);
 }
-/** Thrown when the on-disk file declares a `schema_version` we don't know. */
 export declare class SchemaVersionError extends SitesFileError {
     readonly found: unknown;
     constructor(found: unknown);
 }
-/**
- * Discriminated lock-acquisition failure. W12-R1.2 (A4-F1): the
- * pre-W12 `SitesFileError` collapsed three distinct failure modes into
- * one opaque "lock not acquired" string. Operators triaging a stuck
- * setup wizard need to distinguish them to choose the right recovery:
- *
- *   - LOCK_TIMEOUT    → another setup process is currently writing.
- *                       Wait + retry; do NOT touch the lockfile.
- *   - LOCK_ORPHAN     → stale lock from a crashed prior process.
- *                       Manual `rm <lockfilePath>` is the only fix.
- *   - LOCK_PERMISSION → the lock dir itself is not writable. Fix
- *                       file-system permissions.
- *
- * The `lockCode` discriminant + `lockfilePath` field let CLI surfaces
- * (and pre-flight automation) emit precise hints.
- */
 export type SitesFileLockCode = 'LOCK_TIMEOUT' | 'LOCK_ORPHAN' | 'LOCK_PERMISSION';
 export declare class SitesFileLockError extends SitesFileError {
     readonly lockCode: SitesFileLockCode;
     readonly lockfilePath: string;
     constructor(lockCode: SitesFileLockCode, lockfilePath: string, message: string, cause?: unknown);
 }
-/**
- * Returns the empty seed used when a sites file does not yet exist.
- * Callers (W3 registry) detect "no file → run env-bridge fallback".
- */
 export declare function emptySitesFile(): SitesFileT;
-/**
- * Load + validate a sites file.
- *
- * Returns {@link emptySitesFile} when the path does not exist (no error).
- * Throws {@link SchemaVersionError} for a known-unknown version and
- * {@link SitesFileError} for JSON-parse or Zod-validation failures.
- */
-/**
- * F190 (2026-06-12): expand a leading `~` to the user's home directory.
- * Node's fs does NOT do this — a `~/...` path typed into the Claude Desktop
- * MCPB settings silently yielded "0 sites" (existsSync false → emptySitesFile).
- * Only `~` and `~/...` are expanded; `~user/...` is left untouched.
- */
 export declare function expandTilde(p: string): string;
 export declare function loadSitesFile(rawPath: string): Promise<SitesFileT>;
-/**
- * Persist + validate a sites file atomically with chmod 0600.
- *
- * Pipeline:
- *  1. Acquire `<path>.lock` via proper-lockfile (with retries).
- *  2. Validate `data` through {@link SitesFile} (rejects bad input
- *     before touching the filesystem).
- *  3. Ensure parent directory exists.
- *  4. Write JSON to `<path>.tmp.<pid>.<rand>`, fsync, chmod 0600.
- *  5. `renameSync` over `<path>`.
- *  6. Release lock.
- *
- * Tmp-file cleanup on any failure path.
- */
+export interface AtomicWriteDetail {
+    readonly message: string;
+    readonly cause: unknown;
+}
+export interface AtomicLockDetail extends AtomicWriteDetail {
+    readonly lockCode: SitesFileLockCode;
+    readonly lockfilePath: string;
+}
+export declare function writeFileAtomic0600(path: string, payload: string, opts: {
+    readonly label: string;
+    readonly wrapError: (kind: 'write' | 'lock', detail: AtomicLockDetail | AtomicWriteDetail) => Error;
+}): Promise<void>;
 export declare function saveSitesFile(path: string, data: SitesFileT): Promise<void>;
 //# sourceMappingURL=store.d.ts.map

package/dist/sites/store.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"store.d.ts","sourceRoot":"","sources":["../../src/sites/store.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AAmBH,OAAO,EAAa,KAAK,UAAU,EAAE,MAAM,aAAa,CAAC;AAEzD,uDAAuD;AACvD,qBAAa,cAAe,SAAQ,KAAK;aACQ,KAAK,CAAC,EAAE,OAAO;gBAAhD,OAAO,EAAE,MAAM,EAAkB,KAAK,CAAC,EAAE,OAAO,YAAA;CAI/D;AAED,8EAA8E;AAC9E,qBAAa,kBAAmB,SAAQ,cAAc;aACtB,KAAK,EAAE,OAAO;gBAAd,KAAK,EAAE,OAAO;CAQ7C;AAED;;;;;;;;;;;;;;;GAeG;AACH,MAAM,MAAM,iBAAiB,GAAG,cAAc,GAAG,aAAa,GAAG,iBAAiB,CAAC;AAEnF,qBAAa,kBAAmB,SAAQ,cAAc;aAE9B,QAAQ,EAAE,iBAAiB;aAC3B,YAAY,EAAE,MAAM;gBADpB,QAAQ,EAAE,iBAAiB,EAC3B,YAAY,EAAE,MAAM,EACpC,OAAO,EAAE,MAAM,EACf,KAAK,CAAC,EAAE,OAAO;CAKtB;AAED;;;GAGG;AACH,wBAAgB,cAAc,IAAI,UAAU,CAE3C;AAED;;;;;;GAMG;AACH;;;;;GAKG;AACH,wBAAgB,WAAW,CAAC,CAAC,EAAE,MAAM,GAAG,MAAM,CAI7C;AAED,wBAAsB,aAAa,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,UAAU,CAAC,CAkCxE;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAsB,aAAa,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,UAAU,GAAG,OAAO,CAAC,IAAI,CAAC,CAoFjF"}
+{"version":3,"file":"store.d.ts","sourceRoot":"","sources":["../../src/sites/store.ts"],"names":[],"mappings":"AAsCA,OAAO,EAAa,KAAK,UAAU,EAAE,MAAM,aAAa,CAAC;AAGzD,qBAAa,cAAe,SAAQ,KAAK;aACQ,KAAK,CAAC,EAAE,OAAO;gBAAhD,OAAO,EAAE,MAAM,EAAkB,KAAK,CAAC,EAAE,OAAO,YAAA;CAI/D;AAGD,qBAAa,kBAAmB,SAAQ,cAAc;aACtB,KAAK,EAAE,OAAO;gBAAd,KAAK,EAAE,OAAO;CAQ7C;AAkBD,MAAM,MAAM,iBAAiB,GAAG,cAAc,GAAG,aAAa,GAAG,iBAAiB,CAAC;AAEnF,qBAAa,kBAAmB,SAAQ,cAAc;aAE9B,QAAQ,EAAE,iBAAiB;aAC3B,YAAY,EAAE,MAAM;gBADpB,QAAQ,EAAE,iBAAiB,EAC3B,YAAY,EAAE,MAAM,EACpC,OAAO,EAAE,MAAM,EACf,KAAK,CAAC,EAAE,OAAO;CAKtB;AAMD,wBAAgB,cAAc,IAAI,UAAU,CAE3C;AA+BD,wBAAgB,WAAW,CAAC,CAAC,EAAE,MAAM,GAAG,MAAM,CAI7C;AAED,wBAAsB,aAAa,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,UAAU,CAAC,CAkCxE;AASD,MAAM,WAAW,iBAAiB;IAE9B,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IAEzB,QAAQ,CAAC,KAAK,EAAE,OAAO,CAAC;CAC3B;AAUD,MAAM,WAAW,gBAAiB,SAAQ,iBAAiB;IACvD,QAAQ,CAAC,QAAQ,EAAE,iBAAiB,CAAC;IACrC,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;CACjC;AA6BD,wBAAsB,mBAAmB,CACrC,IAAI,EAAE,MAAM,EACZ,OAAO,EAAE,MAAM,EACf,IAAI,EAAE;IACF,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,SAAS,EAAE,CAChB,IAAI,EAAE,OAAO,GAAG,MAAM,EACtB,MAAM,EAAE,gBAAgB,GAAG,iBAAiB,KAC3C,KAAK,CAAC;CACd,GACF,OAAO,CAAC,IAAI,CAAC,CA6Ff;AAWD,wBAAsB,aAAa,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,UAAU,GAAG,OAAO,CAAC,IAAI,CAAC,CAwBjF"}

package/dist/sites/store.js

@@ -1,29 +1,8 @@
-/**
- * W1 — Sites-Storage Foundation: load/save the sites file.
- *
- * Guarantees:
- *  - **Atomic replace.** Writes go to a sibling `*.tmp.<rand>` file, are
- *    fsynced, chmod'd to 0600, and then `rename(2)`d over the target.
- *    A SIGINT/SIGKILL between any two of these steps leaves either the
- *    old file intact or the new file fully written — never a torn write.
- *  - **Lock for concurrent writers.** `proper-lockfile` acquires an
- *    advisory lockfile (`<file>.lock`) before any read/modify/write
- *    cycle. Default `stale: 10000` ms; second concurrent save retries
- *    with exponential back-off (`retries: 10, minTimeout: 50`).
- *  - **0600 mode on write.** The temp file is opened/chmod'd to 0600
- *    BEFORE the rename so the new inode never exists with looser perms,
- *    even for one fsync window.
- *  - **Schema-version gate.** Refuses to load a file with a version we
- *    don't understand — explicit error, never silent migration.
- *
- * @license MIT
- */
 import { chmodSync, closeSync, existsSync, fsyncSync, mkdirSync, openSync, readFileSync, renameSync, unlinkSync, writeSync, } from 'node:fs';
 import { homedir } from 'node:os';
 import { dirname, join } from 'node:path';
 import lockfile from 'proper-lockfile';
 import { SitesFile } from './schema.js';
-/** Base class for any sites-file IO/format failure. */
 export class SitesFileError extends Error {
     cause;
     constructor(message, cause) {
@@ -32,7 +11,6 @@ export class SitesFileError extends Error {
         this.name = 'SitesFileError';
     }
 }
-/** Thrown when the on-disk file declares a `schema_version` we don't know. */
 export class SchemaVersionError extends SitesFileError {
     found;
     constructor(found) {
@@ -53,26 +31,9 @@ export class SitesFileLockError extends SitesFileError {
         this.name = 'SitesFileLockError';
     }
 }
-/**
- * Returns the empty seed used when a sites file does not yet exist.
- * Callers (W3 registry) detect "no file → run env-bridge fallback".
- */
 export function emptySitesFile() {
     return { schema_version: 1, default_site_id: null, sites: [] };
 }
-/**
- * Load + validate a sites file.
- *
- * Returns {@link emptySitesFile} when the path does not exist (no error).
- * Throws {@link SchemaVersionError} for a known-unknown version and
- * {@link SitesFileError} for JSON-parse or Zod-validation failures.
- */
-/**
- * F190 (2026-06-12): expand a leading `~` to the user's home directory.
- * Node's fs does NOT do this — a `~/...` path typed into the Claude Desktop
- * MCPB settings silently yielded "0 sites" (existsSync false → emptySitesFile).
- * Only `~` and `~/...` are expanded; `~user/...` is left untouched.
- */
 export function expandTilde(p) {
     if (p === '~')
         return homedir();
@@ -82,14 +43,14 @@ export function expandTilde(p) {
 }
 export async function loadSitesFile(rawPath) {
     const path = expandTilde(rawPath);
-    if (!existsSync(path)) {
-        return emptySitesFile();
-    }
     let raw;
     try {
         raw = readFileSync(path, 'utf-8');
     }
     catch (e) {
+        if (e.code === 'ENOENT') {
+            return emptySitesFile();
+        }
         throw new SitesFileError(`Failed to read sites file at ${path}`, e);
     }
     let parsed;
@@ -111,40 +72,17 @@ export async function loadSitesFile(rawPath) {
     }
     return result.data;
 }
-/**
- * Persist + validate a sites file atomically with chmod 0600.
- *
- * Pipeline:
- *  1. Acquire `<path>.lock` via proper-lockfile (with retries).
- *  2. Validate `data` through {@link SitesFile} (rejects bad input
- *     before touching the filesystem).
- *  3. Ensure parent directory exists.
- *  4. Write JSON to `<path>.tmp.<pid>.<rand>`, fsync, chmod 0600.
- *  5. `renameSync` over `<path>`.
- *  6. Release lock.
- *
- * Tmp-file cleanup on any failure path.
- */
-export async function saveSitesFile(path, data) {
-    const validated = SitesFile.safeParse(data);
-    if (!validated.success) {
-        throw new SitesFileError(`Refusing to write invalid sites file: ` +
-            validated.error.issues.map((i) => `${i.path.join('.')}: ${i.message}`).join('; '));
-    }
+export async function writeFileAtomic0600(path, payload, opts) {
     const dir = dirname(path);
-    // W12-R1.2 (A2-M3): the on-disk sites file ends up chmod 0600, but
-    // the parent directory was previously created with the process
-    // umask — typically 0o755 on Linux/macOS, which is world-readable.
-    // A world-readable parent dir is harmless for the bearers (they
-    // live in 0600 files) but DOES leak the existence of a sites.json
-    // to any local user. Tighten to 0700 (owner-only rwx) on creation.
-    // Existing directories are left as-is — mkdirSync is a no-op when
-    // the dir exists, and chmod'ing an existing dir would surprise
-    // operators who chose a shared location intentionally.
-    mkdirSync(dir, { recursive: true, mode: 0o700 });
-    // proper-lockfile defaults to realpath:true, which throws ENOENT for
-    // a not-yet-existing target. Disable realpath + steer the lock at an
-    // explicit sibling path. The lock dir always exists (mkdirSync above).
+    try {
+        mkdirSync(dir, { recursive: true, mode: 0o700 });
+    }
+    catch (e) {
+        throw opts.wrapError('write', {
+            message: `Failed to create the directory for the ${opts.label} at ${dir}`,
+            cause: e,
+        });
+    }
     const lockfilePath = `${path}.lock`;
     let release;
     try {
@@ -156,10 +94,6 @@ export async function saveSitesFile(path, data) {
         });
     }
     catch (e) {
-        // W12-R1.2 (A4-F1): map the underlying error code into a
-        // discriminated lock-failure so callers can render the right
-        // recovery hint instead of telling the user three possible
-        // causes at once.
         const errCode = e !== null && typeof e === 'object' && 'code' in e
             ? e.code
             : undefined;
@@ -179,35 +113,52 @@ export async function saveSitesFile(path, data) {
             hint =
                 `Stale lock from prior crashed process. Remove with: rm ${lockfilePath}`;
         }
-        throw new SitesFileLockError(lockCode, lockfilePath, `Could not acquire lock on ${lockfilePath}. ${hint}`, e);
+        throw opts.wrapError('lock', {
+            lockCode,
+            lockfilePath,
+            message: `Could not acquire lock on ${lockfilePath}. ${hint}`,
+            cause: e,
+        });
     }
     const tmpPath = `${path}.tmp.${process.pid}.${Math.random().toString(36).slice(2, 10)}`;
     try {
         const fd = openSync(tmpPath, 'w', 0o600);
         try {
-            const payload = JSON.stringify(validated.data, null, 2) + '\n';
             writeSync(fd, payload);
             fsyncSync(fd);
         }
         finally {
             closeSync(fd);
         }
-        // Belt-and-braces: openSync's mode arg may be umask-clamped on
-        // some platforms; the explicit chmod guarantees 0600 regardless.
         chmodSync(tmpPath, 0o600);
         renameSync(tmpPath, path);
     }
     catch (e) {
-        // Best-effort tmp cleanup; ignore failures.
         try {
             if (existsSync(tmpPath))
                 unlinkSync(tmpPath);
         }
-        catch { /* swallow */ }
-        throw new SitesFileError(`Failed to write sites file at ${path}`, e);
+        catch { }
+        throw opts.wrapError('write', {
+            message: `Failed to write ${opts.label} at ${path}`,
+            cause: e,
+        });
     }
     finally {
         await release().catch(() => { });
     }
 }
+export async function saveSitesFile(path, data) {
+    const validated = SitesFile.safeParse(data);
+    if (!validated.success) {
+        throw new SitesFileError(`Refusing to write invalid sites file: ` +
+            validated.error.issues.map((i) => `${i.path.join('.')}: ${i.message}`).join('; '));
+    }
+    await writeFileAtomic0600(path, JSON.stringify(validated.data, null, 2) + '\n', {
+        label: 'sites file',
+        wrapError: (kind, detail) => kind === 'lock' && 'lockCode' in detail
+            ? new SitesFileLockError(detail.lockCode, detail.lockfilePath, detail.message, detail.cause)
+            : new SitesFileError(detail.message, detail.cause),
+    });
+}
 //# sourceMappingURL=store.js.map

package/dist/sites/store.js.map

@@ -1 +1 @@
-{"version":3,"file":"store.js","sourceRoot":"","sources":["../../src/sites/store.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AAEH,OAAO,EACH,SAAS,EACT,SAAS,EACT,UAAU,EACV,SAAS,EACT,SAAS,EACT,QAAQ,EACR,YAAY,EACZ,UAAU,EACV,UAAU,EACV,SAAS,GACZ,MAAM,SAAS,CAAC;AACjB,OAAO,EAAE,OAAO,EAAE,MAAM,SAAS,CAAC;AAClC,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAE1C,OAAO,QAAQ,MAAM,iBAAiB,CAAC;AAEvC,OAAO,EAAE,SAAS,EAAmB,MAAM,aAAa,CAAC;AAEzD,uDAAuD;AACvD,MAAM,OAAO,cAAe,SAAQ,KAAK;IACQ;IAA7C,YAAY,OAAe,EAAkB,KAAe;QACxD,KAAK,CAAC,OAAO,CAAC,CAAC;QAD0B,UAAK,GAAL,KAAK,CAAU;QAExD,IAAI,CAAC,IAAI,GAAG,gBAAgB,CAAC;IACjC,CAAC;CACJ;AAED,8EAA8E;AAC9E,MAAM,OAAO,kBAAmB,SAAQ,cAAc;IACtB;IAA5B,YAA4B,KAAc;QACtC,KAAK,CACD,0CAA0C,MAAM,CAAC,KAAK,CAAC,IAAI;YAC3D,yCAAyC;YACzC,qDAAqD,CACxD,CAAC;QALsB,UAAK,GAAL,KAAK,CAAS;QAMtC,IAAI,CAAC,IAAI,GAAG,oBAAoB,CAAC;IACrC,CAAC;CACJ;AAoBD,MAAM,OAAO,kBAAmB,SAAQ,cAAc;IAE9B;IACA;IAFpB,YACoB,QAA2B,EAC3B,YAAoB,EACpC,OAAe,EACf,KAAe;QAEf,KAAK,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;QALN,aAAQ,GAAR,QAAQ,CAAmB;QAC3B,iBAAY,GAAZ,YAAY,CAAQ;QAKpC,IAAI,CAAC,IAAI,GAAG,oBAAoB,CAAC;IACrC,CAAC;CACJ;AAED;;;GAGG;AACH,MAAM,UAAU,cAAc;IAC1B,OAAO,EAAE,cAAc,EAAE,CAAC,EAAE,eAAe,EAAE,IAAI,EAAE,KAAK,EAAE,EAAE,EAAE,CAAC;AACnE,CAAC;AAED;;;;;;GAMG;AACH;;;;;GAKG;AACH,MAAM,UAAU,WAAW,CAAC,CAAS;IACjC,IAAI,CAAC,KAAK,GAAG;QAAE,OAAO,OAAO,EAAE,CAAC;IAChC,IAAI,CAAC,CAAC,UAAU,CAAC,IAAI,CAAC;QAAE,OAAO,IAAI,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;IAC3D,OAAO,CAAC,CAAC;AACb,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,aAAa,CAAC,OAAe;IAC/C,MAAM,IAAI,GAAG,WAAW,CAAC,OAAO,CAAC,CAAC;IAClC,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;QACpB,OAAO,cAAc,EAAE,CAAC;IAC5B,CAAC;IACD,IAAI,GAAW,CAAC;IAChB,IAAI,CAAC;QACD,GAAG,GAAG,YAAY,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;IACtC,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACT,MAAM,IAAI,cAAc,CAAC,gCAAgC,IAAI,EAAE,EAAE,CAAC,CAAC,CAAC;IACxE,CAAC;IACD,IAAI,MAAe,CAAC;IACpB,IAAI,CAAC;QACD,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC7B,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACT,MAAM,IAAI,cAAc,CAAC,iBAAiB,IAAI,oBAAoB,EAAE,CAAC,CAAC,CAAC;IAC3E,CAAC;IACD,IACI,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,KAAK,IAAI;WAC1C,gBAAgB,IAAI,MAAM;WACzB,MAAsC,CAAC,cAAc,KAAK,CAAC,EACjE,CAAC;QACC,MAAM,IAAI,kBAAkB,CACvB,MAAsC,CAAC,cAAc,CACzD,CAAC;IACN,CAAC;IACD,MAAM,MAAM,GAAG,SAAS,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC;IAC3C,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;QAClB,MAAM,IAAI,cAAc,CACpB,iBAAiB,IAAI,6BAA6B;YAClD,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CACjF,CAAC;IACN,CAAC;IACD,OAAO,MAAM,CAAC,IAAI,CAAC;AACvB,CAAC;AAED;;;;;;;;;;;;;GAaG;AACH,MAAM,CAAC,KAAK,UAAU,aAAa,CAAC,IAAY,EAAE,IAAgB;IAC9D,MAAM,SAAS,GAAG,SAAS,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;IAC5C,IAAI,CAAC,SAAS,CAAC,OAAO,EAAE,CAAC;QACrB,MAAM,IAAI,cAAc,CACpB,wCAAwC;YACxC,SAAS,CAAC,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CACpF,CAAC;IACN,CAAC;IACD,MAAM,GAAG,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC1B,mEAAmE;IACnE,+DAA+D;IAC/D,mEAAmE;IACnE,gEAAgE;IAChE,kEAAkE;IAClE,mEAAmE;IACnE,kEAAkE;IAClE,+DAA+D;IAC/D,uDAAuD;IACvD,SAAS,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IAEjD,qEAAqE;IACrE,qEAAqE;IACrE,uEAAuE;IACvE,MAAM,YAAY,GAAG,GAAG,IAAI,OAAO,CAAC;IACpC,IAAI,OAA4B,CAAC;IACjC,IAAI,CAAC;QACD,OAAO,GAAG,MAAM,QAAQ,CAAC,IAAI,CAAC,IAAI,EAAE;YAChC,YAAY;YACZ,QAAQ,EAAE,KAAK;YACf,KAAK,EAAE,MAAM;YACb,OAAO,EAAE,EAAE,OAAO,EAAE,EAAE,EAAE,UAAU,EAAE,EAAE,EAAE,UAAU,EAAE,GAAG,EAAE,MAAM,EAAE,CAAC,EAAE;SACvE,CAAC,CAAC;IACP,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACT,yDAAyD;QACzD,6DAA6D;QAC7D,2DAA2D;QAC3D,kBAAkB;QAClB,MAAM,OAAO,GACT,CAAC,KAAK,IAAI,IAAI,OAAO,CAAC,KAAK,QAAQ,IAAI,MAAM,IAAI,CAAC;YAC9C,CAAC,CAAE,CAAwB,CAAC,IAAI;YAChC,CAAC,CAAC,SAAS,CAAC;QACpB,IAAI,QAA2B,CAAC;QAChC,IAAI,IAAY,CAAC;QACjB,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;YACxB,QAAQ,GAAG,cAAc,CAAC;YAC1B,IAAI;gBACA,4DAA4D,CAAC;QACrE,CAAC;aAAM,IAAI,OAAO,KAAK,QAAQ,IAAI,OAAO,KAAK,OAAO,EAAE,CAAC;YACrD,QAAQ,GAAG,iBAAiB,CAAC;YAC7B,IAAI,GAAG,kDAAkD,GAAG,GAAG,CAAC;QACpE,CAAC;aAAM,CAAC;YACJ,QAAQ,GAAG,aAAa,CAAC;YACzB,IAAI;gBACA,0DAA0D,YAAY,EAAE,CAAC;QACjF,CAAC;QACD,MAAM,IAAI,kBAAkB,CACxB,QAAQ,EACR,YAAY,EACZ,6BAA6B,YAAY,KAAK,IAAI,EAAE,EACpD,CAAC,CACJ,CAAC;IACN,CAAC;IAED,MAAM,OAAO,GAAG,GAAG,IAAI,QAAQ,OAAO,CAAC,GAAG,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,EAAE,CAAC;IACxF,IAAI,CAAC;QACD,MAAM,EAAE,GAAG,QAAQ,CAAC,OAAO,EAAE,GAAG,EAAE,KAAK,CAAC,CAAC;QACzC,IAAI,CAAC;YACD,MAAM,OAAO,GAAG,IAAI,CAAC,SAAS,CAAC,SAAS,CAAC,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,GAAG,IAAI,CAAC;YAC/D,SAAS,CAAC,EAAE,EAAE,OAAO,CAAC,CAAC;YACvB,SAAS,CAAC,EAAE,CAAC,CAAC;QAClB,CAAC;gBAAS,CAAC;YACP,SAAS,CAAC,EAAE,CAAC,CAAC;QAClB,CAAC;QACD,+DAA+D;QAC/D,iEAAiE;QACjE,SAAS,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;QAC1B,UAAU,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;IAC9B,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACT,4CAA4C;QAC5C,IAAI,CAAC;YAAC,IAAI,UAAU,CAAC,OAAO,CAAC;gBAAE,UAAU,CAAC,OAAO,CAAC,CAAC;QAAC,CAAC;QAAC,MAAM,CAAC,CAAC,aAAa,CAAC,CAAC;QAC7E,MAAM,IAAI,cAAc,CAAC,iCAAiC,IAAI,EAAE,EAAE,CAAC,CAAC,CAAC;IACzE,CAAC;YAAS,CAAC;QACP,MAAM,OAAO,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,GAA4C,CAAC,CAAC,CAAC;IAC9E,CAAC;AACL,CAAC"}
+{"version":3,"file":"store.js","sourceRoot":"","sources":["../../src/sites/store.ts"],"names":[],"mappings":"AAqBA,OAAO,EACH,SAAS,EACT,SAAS,EACT,UAAU,EACV,SAAS,EACT,SAAS,EACT,QAAQ,EACR,YAAY,EACZ,UAAU,EACV,UAAU,EACV,SAAS,GACZ,MAAM,SAAS,CAAC;AACjB,OAAO,EAAE,OAAO,EAAE,MAAM,SAAS,CAAC;AAClC,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAE1C,OAAO,QAAQ,MAAM,iBAAiB,CAAC;AAEvC,OAAO,EAAE,SAAS,EAAmB,MAAM,aAAa,CAAC;AAGzD,MAAM,OAAO,cAAe,SAAQ,KAAK;IACQ;IAA7C,YAAY,OAAe,EAAkB,KAAe;QACxD,KAAK,CAAC,OAAO,CAAC,CAAC;QAD0B,UAAK,GAAL,KAAK,CAAU;QAExD,IAAI,CAAC,IAAI,GAAG,gBAAgB,CAAC;IACjC,CAAC;CACJ;AAGD,MAAM,OAAO,kBAAmB,SAAQ,cAAc;IACtB;IAA5B,YAA4B,KAAc;QACtC,KAAK,CACD,0CAA0C,MAAM,CAAC,KAAK,CAAC,IAAI;YAC3D,yCAAyC;YACzC,qDAAqD,CACxD,CAAC;QALsB,UAAK,GAAL,KAAK,CAAS;QAMtC,IAAI,CAAC,IAAI,GAAG,oBAAoB,CAAC;IACrC,CAAC;CACJ;AAoBD,MAAM,OAAO,kBAAmB,SAAQ,cAAc;IAE9B;IACA;IAFpB,YACoB,QAA2B,EAC3B,YAAoB,EACpC,OAAe,EACf,KAAe;QAEf,KAAK,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;QALN,aAAQ,GAAR,QAAQ,CAAmB;QAC3B,iBAAY,GAAZ,YAAY,CAAQ;QAKpC,IAAI,CAAC,IAAI,GAAG,oBAAoB,CAAC;IACrC,CAAC;CACJ;AAMD,MAAM,UAAU,cAAc;IAC1B,OAAO,EAAE,cAAc,EAAE,CAAC,EAAE,eAAe,EAAE,IAAI,EAAE,KAAK,EAAE,EAAE,EAAE,CAAC;AACnE,CAAC;AA+BD,MAAM,UAAU,WAAW,CAAC,CAAS;IACjC,IAAI,CAAC,KAAK,GAAG;QAAE,OAAO,OAAO,EAAE,CAAC;IAChC,IAAI,CAAC,CAAC,UAAU,CAAC,IAAI,CAAC;QAAE,OAAO,IAAI,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;IAC3D,OAAO,CAAC,CAAC;AACb,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,aAAa,CAAC,OAAe;IAC/C,MAAM,IAAI,GAAG,WAAW,CAAC,OAAO,CAAC,CAAC;IAClC,IAAI,GAAW,CAAC;IAChB,IAAI,CAAC;QACD,GAAG,GAAG,YAAY,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;IACtC,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACT,IAAK,CAA2B,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;YACjD,OAAO,cAAc,EAAE,CAAC;QAC5B,CAAC;QACD,MAAM,IAAI,cAAc,CAAC,gCAAgC,IAAI,EAAE,EAAE,CAAC,CAAC,CAAC;IACxE,CAAC;IACD,IAAI,MAAe,CAAC;IACpB,IAAI,CAAC;QACD,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC7B,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACT,MAAM,IAAI,cAAc,CAAC,iBAAiB,IAAI,oBAAoB,EAAE,CAAC,CAAC,CAAC;IAC3E,CAAC;IACD,IACI,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,KAAK,IAAI;WAC1C,gBAAgB,IAAI,MAAM;WACzB,MAAsC,CAAC,cAAc,KAAK,CAAC,EACjE,CAAC;QACC,MAAM,IAAI,kBAAkB,CACvB,MAAsC,CAAC,cAAc,CACzD,CAAC;IACN,CAAC;IACD,MAAM,MAAM,GAAG,SAAS,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC;IAC3C,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;QAClB,MAAM,IAAI,cAAc,CACpB,iBAAiB,IAAI,6BAA6B;YAClD,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CACjF,CAAC;IACN,CAAC;IACD,OAAO,MAAM,CAAC,IAAI,CAAC;AACvB,CAAC;AAwDD,MAAM,CAAC,KAAK,UAAU,mBAAmB,CACrC,IAAY,EACZ,OAAe,EACf,IAMC;IAED,MAAM,GAAG,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC1B,IAAI,CAAC;QASD,SAAS,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IACrD,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QAST,MAAM,IAAI,CAAC,SAAS,CAAC,OAAO,EAAE;YAC1B,OAAO,EAAE,0CAA0C,IAAI,CAAC,KAAK,OAAO,GAAG,EAAE;YACzE,KAAK,EAAE,CAAC;SACX,CAAC,CAAC;IACP,CAAC;IAKD,MAAM,YAAY,GAAG,GAAG,IAAI,OAAO,CAAC;IACpC,IAAI,OAA4B,CAAC;IACjC,IAAI,CAAC;QACD,OAAO,GAAG,MAAM,QAAQ,CAAC,IAAI,CAAC,IAAI,EAAE;YAChC,YAAY;YACZ,QAAQ,EAAE,KAAK;YACf,KAAK,EAAE,MAAM;YACb,OAAO,EAAE,EAAE,OAAO,EAAE,EAAE,EAAE,UAAU,EAAE,EAAE,EAAE,UAAU,EAAE,GAAG,EAAE,MAAM,EAAE,CAAC,EAAE;SACvE,CAAC,CAAC;IACP,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QAKT,MAAM,OAAO,GACT,CAAC,KAAK,IAAI,IAAI,OAAO,CAAC,KAAK,QAAQ,IAAI,MAAM,IAAI,CAAC;YAC9C,CAAC,CAAE,CAAwB,CAAC,IAAI;YAChC,CAAC,CAAC,SAAS,CAAC;QACpB,IAAI,QAA2B,CAAC;QAChC,IAAI,IAAY,CAAC;QACjB,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;YACxB,QAAQ,GAAG,cAAc,CAAC;YAC1B,IAAI;gBACA,4DAA4D,CAAC;QACrE,CAAC;aAAM,IAAI,OAAO,KAAK,QAAQ,IAAI,OAAO,KAAK,OAAO,EAAE,CAAC;YACrD,QAAQ,GAAG,iBAAiB,CAAC;YAC7B,IAAI,GAAG,kDAAkD,GAAG,GAAG,CAAC;QACpE,CAAC;aAAM,CAAC;YACJ,QAAQ,GAAG,aAAa,CAAC;YACzB,IAAI;gBACA,0DAA0D,YAAY,EAAE,CAAC;QACjF,CAAC;QACD,MAAM,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE;YACzB,QAAQ;YACR,YAAY;YACZ,OAAO,EAAE,6BAA6B,YAAY,KAAK,IAAI,EAAE;YAC7D,KAAK,EAAE,CAAC;SACX,CAAC,CAAC;IACP,CAAC;IAED,MAAM,OAAO,GAAG,GAAG,IAAI,QAAQ,OAAO,CAAC,GAAG,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,EAAE,CAAC;IACxF,IAAI,CAAC;QACD,MAAM,EAAE,GAAG,QAAQ,CAAC,OAAO,EAAE,GAAG,EAAE,KAAK,CAAC,CAAC;QACzC,IAAI,CAAC;YACD,SAAS,CAAC,EAAE,EAAE,OAAO,CAAC,CAAC;YACvB,SAAS,CAAC,EAAE,CAAC,CAAC;QAClB,CAAC;gBAAS,CAAC;YACP,SAAS,CAAC,EAAE,CAAC,CAAC;QAClB,CAAC;QAGD,SAAS,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;QAC1B,UAAU,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;IAC9B,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QAET,IAAI,CAAC;YAAC,IAAI,UAAU,CAAC,OAAO,CAAC;gBAAE,UAAU,CAAC,OAAO,CAAC,CAAC;QAAC,CAAC;QAAC,MAAM,CAAC,CAAe,CAAC;QAC7E,MAAM,IAAI,CAAC,SAAS,CAAC,OAAO,EAAE;YAC1B,OAAO,EAAE,mBAAmB,IAAI,CAAC,KAAK,OAAO,IAAI,EAAE;YACnD,KAAK,EAAE,CAAC;SACX,CAAC,CAAC;IACP,CAAC;YAAS,CAAC;QACP,MAAM,OAAO,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,GAA4C,CAAC,CAAC,CAAC;IAC9E,CAAC;AACL,CAAC;AAWD,MAAM,CAAC,KAAK,UAAU,aAAa,CAAC,IAAY,EAAE,IAAgB;IAC9D,MAAM,SAAS,GAAG,SAAS,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;IAC5C,IAAI,CAAC,SAAS,CAAC,OAAO,EAAE,CAAC;QACrB,MAAM,IAAI,cAAc,CACpB,wCAAwC;YACxC,SAAS,CAAC,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CACpF,CAAC;IACN,CAAC;IACD,MAAM,mBAAmB,CACrB,IAAI,EACJ,IAAI,CAAC,SAAS,CAAC,SAAS,CAAC,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,GAAG,IAAI,EAC9C;QACI,KAAK,EAAE,YAAY;QACnB,SAAS,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,EAAE,CACxB,IAAI,KAAK,MAAM,IAAI,UAAU,IAAI,MAAM;YACnC,CAAC,CAAC,IAAI,kBAAkB,CAClB,MAAM,CAAC,QAAQ,EACf,MAAM,CAAC,YAAY,EACnB,MAAM,CAAC,OAAO,EACd,MAAM,CAAC,KAAK,CACf;YACH,CAAC,CAAC,IAAI,cAAc,CAAC,MAAM,CAAC,OAAO,EAAE,MAAM,CAAC,KAAK,CAAC;KAC7D,CACJ,CAAC;AACN,CAAC"}

package/dist/sites/substituted-registry.d.ts

@@ -0,0 +1,11 @@
+export type SubstitutedRegistryRefusal = Record<string, unknown> & {
+    readonly error: string;
+    readonly code: 'site_registry_substituted';
+    readonly config_problem: string;
+    readonly context: {
+        readonly site_id: string;
+    };
+    readonly hint: string;
+};
+export declare function substitutedRegistryRefusal(siteId: string, configProblem: string): SubstitutedRegistryRefusal;
+//# sourceMappingURL=substituted-registry.d.ts.map

package/dist/sites/substituted-registry.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"substituted-registry.d.ts","sourceRoot":"","sources":["../../src/sites/substituted-registry.ts"],"names":[],"mappings":"AAkEA,MAAM,MAAM,0BAA0B,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG;IAC/D,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,IAAI,EAAE,2BAA2B,CAAC;IAC3C,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAC;IAChC,QAAQ,CAAC,OAAO,EAAE;QAAE,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAA;KAAE,CAAC;IAC/C,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;CACzB,CAAC;AASF,wBAAgB,0BAA0B,CACtC,MAAM,EAAE,MAAM,EACd,aAAa,EAAE,MAAM,GACtB,0BAA0B,CAa5B"}

package/dist/sites/substituted-registry.js

@@ -0,0 +1,13 @@
+export function substitutedRegistryRefusal(siteId, configProblem) {
+    return {
+        error: `Refusing to target site_id "${siteId}": the configured site registry was rejected at startup, `
+            + 'so this session is running on a substitute site and the name may not mean what it did before.',
+        code: 'site_registry_substituted',
+        config_problem: configProblem,
+        context: { site_id: siteId },
+        hint: 'Repair the registry named in config_problem and restart this server. '
+            + 'Until then, calls WITHOUT site_id still run, against the substitute site — '
+            + 'yootheme_builder_sites_list shows which one that is.',
+    };
+}
+//# sourceMappingURL=substituted-registry.js.map

package/dist/sites/substituted-registry.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"substituted-registry.js","sourceRoot":"","sources":["../../src/sites/substituted-registry.ts"],"names":[],"mappings":"AAiFA,MAAM,UAAU,0BAA0B,CACtC,MAAc,EACd,aAAqB;IAErB,OAAO;QACH,KAAK,EACD,+BAA+B,MAAM,2DAA2D;cAC9F,+FAA+F;QACrG,IAAI,EAAE,2BAA2B;QACjC,cAAc,EAAE,aAAa;QAC7B,OAAO,EAAE,EAAE,OAAO,EAAE,MAAM,EAAE;QAC5B,IAAI,EACA,uEAAuE;cACrE,6EAA6E;cAC7E,sDAAsD;KAC/D,CAAC;AACN,CAAC"}