cursedbelt-core 1.0.0 → 1.2.0

package/dist/core/file-tree/fileTreeModel.d.ts

@@ -259,6 +259,24 @@ export declare function resolveKeyboardMove({ nodes, rows, row, direction, locke
  * Empty for no target — a refusal has its own words and this must never carry a second "no".
  */
 export declare function describeDrop(nodes: readonly FileTreeNode[], drop: FileTreeDrop | null): string;
+/** The consumer's own words for the 🔒 access mark, per state. See {@link accessMarkCopy}. */
+export interface AccessMarkCopy {
+    private?: string;
+    locked?: string;
+}
+/**
+ * What the access mark's tooltip SAYS for a given access state.
+ *
+ * 🔴 The defaults speak collections' vocabulary — "hidden from a locked page" — because
+ * that is the app the mark was built for. The mark itself is generic and the words are
+ * not: the vault's protected folders wear the same padlock meaning "everything in here
+ * needs the master password", and a claim of hiddenness would be false there (the rows
+ * are visible; their SECRETS are sealed). So the words are an argument with a default,
+ * resolved here rather than inline, where they can be tested without simulating a hover.
+ *
+ * Empty string for `normal` — a row with no mark has nothing to say.
+ */
+export declare function accessMarkCopy(access: FileTreeAccess | undefined, copy?: AccessMarkCopy): string;
 /**
  * The next row whose name starts with `query`, searching from `fromIndex` and wrapping.
  *

package/dist/core/file-tree/fileTreeModel.js

@@ -268,6 +268,30 @@ export function describeDrop(nodes, drop) {
     const where = drop.kind === 'before' ? 'Above' : 'Below';
     return sibling ? `${where} ${sibling.name}` : `${where} this row`;
 }
+/**
+ * What the access mark's tooltip SAYS for a given access state.
+ *
+ * 🔴 The defaults speak collections' vocabulary — "hidden from a locked page" — because
+ * that is the app the mark was built for. The mark itself is generic and the words are
+ * not: the vault's protected folders wear the same padlock meaning "everything in here
+ * needs the master password", and a claim of hiddenness would be false there (the rows
+ * are visible; their SECRETS are sealed). So the words are an argument with a default,
+ * resolved here rather than inline, where they can be tested without simulating a hover.
+ *
+ * Empty string for `normal` — a row with no mark has nothing to say.
+ */
+export function accessMarkCopy(access, copy) {
+    if (access === 'locked')
+        return copy?.locked ?? 'Hidden — unlock to see what is in here';
+    if (access === 'private') {
+        // Deliberately "this or what is in it": a consumer sets `private` both for a row that
+        // is itself private and for a public folder holding private children (collections does
+        // exactly that), and a wording that claimed only the first would be false on half the
+        // rows it marks.
+        return copy?.private ?? 'Private — this, or something in it, is hidden from a locked page';
+    }
+    return '';
+}
 /**
  * The next row whose name starts with `query`, searching from `fromIndex` and wrapping.
  *

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "cursedbelt-core",
-	"version": "1.0.0",
+	"version": "1.2.0",
 	"license": "ISC",
 	"type": "module",
 	"description": "Framework-agnostic core of the cursedbelt split \u2014 isomorphic domain logic. cwip below it, cursedbelt-server and cursedbelt (react) above it.",
@@ -356,7 +356,7 @@
 	},
 	"dependencies": {
 		"@leeoniya/ufuzzy": "^1.0.19",
-		"cwip": "^3.0.2"
+		"cwip": "^4.1.0"
 	},
 	"peerDependencies": {
 		"zod": "^4.4.0"

package/src/core/file-tree/fileTreeModel.spec.ts

@@ -1,5 +1,6 @@
 import { describe, expect, test } from 'bun:test';
 import {
+  accessMarkCopy,
   descendantIdsOf,
   type FileTreeDrop,
   type FileTreeNode,
@@ -460,3 +461,25 @@ describe('describeDrop', () => {
     expect(describeDrop(TREE, { kind: 'into', parentId: 'gone' })).toBe('Into this folder');
   });
 });
+
+describe('accessMarkCopy', () => {
+  test('defaults speak collections — hiddenness, per state', () => {
+    expect(accessMarkCopy('locked')).toBe('Hidden — unlock to see what is in here');
+    expect(accessMarkCopy('private')).toContain('hidden from a locked page');
+  });
+
+  test('🔴 a consumer with its own privacy vocabulary overrides the words', () => {
+    // The vault's protected folders wear the same padlock meaning "needs the master
+    // password" — a claim of hiddenness would be FALSE there (rows visible, secrets
+    // sealed), which is why the words are an argument and not a constant.
+    const copy = { private: 'Protected — everything in here needs the master password' };
+    expect(accessMarkCopy('private', copy)).toBe(copy.private);
+    // An override for one state leaves the other's default standing.
+    expect(accessMarkCopy('locked', copy)).toBe('Hidden — unlock to see what is in here');
+  });
+
+  test('normal (and absent) access has nothing to say', () => {
+    expect(accessMarkCopy('normal')).toBe('');
+    expect(accessMarkCopy(undefined)).toBe('');
+  });
+});

package/src/core/file-tree/fileTreeModel.ts

@@ -464,6 +464,39 @@ export function describeDrop(nodes: readonly FileTreeNode[], drop: FileTreeDrop
   return sibling ? `${where} ${sibling.name}` : `${where} this row`;
 }
 
+/** The consumer's own words for the 🔒 access mark, per state. See {@link accessMarkCopy}. */
+export interface AccessMarkCopy {
+  private?: string;
+  locked?: string;
+}
+
+/**
+ * What the access mark's tooltip SAYS for a given access state.
+ *
+ * 🔴 The defaults speak collections' vocabulary — "hidden from a locked page" — because
+ * that is the app the mark was built for. The mark itself is generic and the words are
+ * not: the vault's protected folders wear the same padlock meaning "everything in here
+ * needs the master password", and a claim of hiddenness would be false there (the rows
+ * are visible; their SECRETS are sealed). So the words are an argument with a default,
+ * resolved here rather than inline, where they can be tested without simulating a hover.
+ *
+ * Empty string for `normal` — a row with no mark has nothing to say.
+ */
+export function accessMarkCopy(
+  access: FileTreeAccess | undefined,
+  copy?: AccessMarkCopy,
+): string {
+  if (access === 'locked') return copy?.locked ?? 'Hidden — unlock to see what is in here';
+  if (access === 'private') {
+    // Deliberately "this or what is in it": a consumer sets `private` both for a row that
+    // is itself private and for a public folder holding private children (collections does
+    // exactly that), and a wording that claimed only the first would be false on half the
+    // rows it marks.
+    return copy?.private ?? 'Private — this, or something in it, is hidden from a locked page';
+  }
+  return '';
+}
+
 /**
  * The next row whose name starts with `query`, searching from `fromIndex` and wrapping.
  *

package/src/leafSubpathsImportNothing.spec.ts

@@ -152,8 +152,10 @@ const sourceOf = (subpath: string): string => {
  * Resolution here is therefore explicit rather than inherited. The redirected root is
  * used when it lies outside the repo (the normal case — the runner always sets
  * `$FORGE_STATE`, and the preload's sweep then cleans up after a killed run). When it
- * does not, this hops to `$HOME`, which `resolveTestTmpRoot` refuses for the general
- * default and which this check genuinely requires: an isolated root is the whole
+ * does not, this hops to `$FORGE_STATE/test-scratch.noindex` — or, with no generation
+ * in the environment, `~/.code/test-scratch.noindex`, which is where this machine keeps
+ * everything it builds for itself. `resolveTestTmpRoot` refuses `$HOME` for the general
+ * default and this check genuinely requires an isolated root: that isolation is the whole
  * measurement. Stale siblings are swept by mtime, the same way the preload does it,
  * so the hop cannot accumulate.
  */
@@ -171,7 +173,17 @@ const fixtureRoot = (): string => {
         'a check that cannot isolate itself is not a passing check',
     );
   }
-  const outside = `${home}/.${pkg.name}-leaf-fixture.noindex`;
+  // 🔴 Under `$FORGE_STATE`, or under `~/.code` — never a dotted directory of its own in
+  // `$HOME`. Measured 2026-09-17: this hop had left three `~/.cursedbelt*-leaf-fixture.noindex`
+  // trees in the owner's home directory, indistinguishable at a glance from the forty a Mac's
+  // real software puts there, and the sweep below only ever cleaned their INSIDES. A check that
+  // tidies up after itself and still leaves its address behind for ever is the shape this
+  // generation's home-dir rule exists to stop; `tools/check-home-dir.ts` now fails on it.
+  const state = process.env.FORGE_STATE?.trim();
+  const outside =
+    state !== undefined && state !== '' && !`${state}/`.startsWith(REPO_PREFIX)
+      ? `${state}/test-scratch.noindex/${pkg.name}-leaf-fixture`
+      : `${home}/.code/test-scratch.noindex/${pkg.name}-leaf-fixture`;
   try {
     const cutoff = Date.now() - 6 * 60 * 60 * 1000;
     for (const entry of readdirSync(outside)) {

package/src/shippedFilesAreTracked.spec.ts

@@ -0,0 +1,69 @@
+/**
+ * 🔴 `bun publish` packs the WORKING DIRECTORY, not the git index — so a package can
+ * ship a file the repo does not have.
+ *
+ * ── What this cost, 2026-09-15 ─────────────────────────────────────────────────────
+ * The cursedbelt split (task 148) moved two integration specs into this package from
+ * `cursedbelt`. `git add -u .` stages only files git already knows about, so both were
+ * committed nowhere — and `bun run verify` was green *because they were present on disk*,
+ * which is the same reason nobody noticed. `1.0.2` went to the registry carrying two
+ * `src/` files that existed in no commit, and `git status` said `tracked-dirty=0`.
+ *
+ * "The tree is clean" and "everything that ships is committed" are different claims, and
+ * only the first one is what people actually check. npm versions are immutable, so the
+ * window to notice closes at publish time.
+ *
+ * ── Why this shape ─────────────────────────────────────────────────────────────────
+ * It asks git, for exactly the directories `package.json#files` promises to ship, which
+ * of those paths git does not track. That is narrower than "any untracked file" on
+ * purpose: scratch files, `.agent.noindex/`, a half-written script and an uncommitted
+ * lockfile are all legitimate states for a working tree and reddening on them would teach
+ * people to skip this. A file INSIDE the published surface is the only case where
+ * untracked means "about to ship something no one can review or revert".
+ *
+ * 🔴 It must run from a real checkout to mean anything, so it refuses rather than passes
+ * when `git` cannot answer — a check that silently degrades to green is worse than none.
+ */
+import { describe, expect, test } from 'bun:test';
+import { spawnSync } from 'node:child_process';
+import { existsSync } from 'node:fs';
+import { fileURLToPath } from 'node:url';
+import pkg from '../package.json';
+
+const repoRoot = fileURLToPath(new URL('..', import.meta.url));
+
+/** The directories `files` promises to ship, minus build output nobody commits. */
+const shippedDirs = (): string[] =>
+	((pkg as { files?: string[] }).files ?? []).filter((f) => f !== 'dist' && existsSync(`${repoRoot}/${f}`));
+
+const git = (...args: string[]): { ok: boolean; out: string } => {
+	const r = spawnSync('git', ['-C', repoRoot, ...args], { encoding: 'utf8' });
+	return { ok: r.status === 0, out: (r.stdout ?? '').trim() };
+};
+
+describe('every file inside the published surface is tracked', () => {
+	test('git can answer at all — a degraded check must refuse, not pass', () => {
+		expect(git('rev-parse', '--is-inside-work-tree').ok, 'not a git checkout, so this check proves nothing').toBe(true);
+	});
+
+	test('package.json names a shippable directory to scan', () => {
+		// Vacuity guard: an empty `files`, or one naming only `dist`, makes the assertion
+		// below pass while scanning nothing at all.
+		expect(shippedDirs().length, '`files` names no committed directory — nothing would be scanned').toBeGreaterThan(0);
+	});
+
+	test('no untracked file sits inside a directory `files` ships', () => {
+		// --others = untracked; --exclude-standard honours .gitignore, so deliberately
+		// ignored paths (.agent.noindex, node_modules) are not offences.
+		const { ok, out } = git('ls-files', '--others', '--exclude-standard', '--', ...shippedDirs());
+		expect(ok, 'git ls-files failed').toBe(true);
+		const untracked = out === '' ? [] : out.split('\n');
+		expect(
+			untracked,
+			'these would be PUBLISHED but exist in no commit — `bun publish` packs the working directory, not the index,\n' +
+				'so the registry would carry code nobody can review, diff or revert, and npm versions are immutable.\n' +
+				'Commit them (or add them to .gitignore if they genuinely must not ship):\n  ' +
+				untracked.join('\n  '),
+		).toEqual([]);
+	});
+});