daftari 1.30.0 → 1.32.0

package/CHANGELOG.md

@@ -7,6 +7,180 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+## [1.32.0] - 2026-07-25
+
+The interview release: the vault interrogates its principal. `daftari
+interview` turns the signals the vault already computes — open tensions,
+expired canon, unanswered `questions_raised` — into a question sheet, asks
+you at the terminal, and folds the verbatim answers back into the corpus as
+first-class source material. Plus the OKF bridge learns spec v0.2's trust
+signals. Design record:
+`docs/superpowers/specs/2026-07-25-principal-interview-design.md`.
+
+### Added
+
+- **`daftari interview` — the principal interview.** The design steal is the
+  companion interview on Terence Tao's AI-views "living summary" page: after
+  an assistant compiles a corpus of someone's positions, its highest-value
+  next move is to ask the principal about the places the corpus is unclear
+  and record the answers verbatim. Daftari already computes "unclear" three
+  ways, so the sheet is assembled deterministically (LLM-free, the circadian
+  precedent — nothing on this surface can spend): open tensions (contested
+  first, longest-carried first; legacy `unspecified` and system-generated
+  `inter-proposal` entries excluded), canonical accumulation docs past their
+  `ttl_days` (largest overshoot first; generative decay is expected, never
+  asked about), and `questions_raised` entries no document's
+  `questions_answered` covers (duplicate raisings merged). `daftari
+  interview` prints the sheet read-only; `daftari interview ask` conducts
+  the session and records answers **verbatim** as a vault document in an
+  `interviews/` collection — `tier: source` (body immutable), `provenance:
+  direct`, `ttl_days: null` (testimony doesn't expire), `sources` tracing
+  each question back to its prompting signal, `questions_answered` carrying
+  the question texts so a later sheet never re-asks. The write round-trips
+  the parser before touching disk, is confined by the same vault-path gate
+  as every other write, and auto-commits honoring `auto_commit`/`git_dir`.
+  Recording testimony resolves nothing: the CLI ends by pointing at
+  `daftari court rule <id> --references <transcript>` and at re-verified
+  writes — a tension may never masquerade as a supersession. Operator-only
+  like the court (no access context, no MCP tool); the `--collection` flag
+  is allow-listed (one path segment, reserved names rejected) so the
+  transcript can neither respell its RBAC collection nor land where vault
+  scans can't see it.
+
+### Changed
+
+- **OKF bridge upgraded to spec v0.2 — trust signals.** OKF v0.2 adds opt-in
+  trust metadata (raw credibility indicators, never computed scores); the
+  `daftari okf` bridge now speaks it in both directions. Export derives the
+  signals from native metadata: `updated`/`updated_by` become
+  `generated: {by, at}` (the spec's rename of v0.1 `timestamp`), the Daftari
+  lifecycle maps onto `status: draft|stable|deprecated`
+  (canonical → stable; deprecated/superseded/archived → deprecated),
+  `ttl_days` becomes an absolute `stale_after` date anchored at `updated`, and
+  `sources` become structured `{id, resource}` entries. `verified` is never
+  fabricated — Daftari records authorship, not independent confirmations, so
+  exported docs honestly carry the "unverified" trust tier. Import understands
+  the signals: `generated.at` dates the doc (falling back to `timestamp` per
+  spec), a human-reviewed doc (`human:*` in `verified`) lands with
+  `confidence: high` (positive signals only ever raise confidence — absence
+  keeps the `medium` default, since an unverified v0.2 doc is
+  indistinguishable from a v0.1 doc), `status: deprecated` imports as
+  `deprecated` instead of resurfacing as a fresh draft, and `stale_after`
+  converts to `ttl_days`. The new `Attested Computation` concept type is
+  surfaced in an import warning but never auto-elevated to a write-protected
+  tier — `tier: source` is enforcement whose only sanctioned grant path is
+  `vault_set_tier` (reason required, provenance-logged), and a foreign
+  bundle's self-declared `type` must not buy it; the operator reviews and
+  elevates deliberately. OKF
+  fields with no lossless Daftari slot (the trust record, the attestation
+  machinery, unknown producer fields) are preserved under `okf_*` keys, so
+  import stays non-destructive. v0.1 bundles import unchanged.
+
+## [1.31.0] - 2026-07-22
+
+The self-hosted deployment release: one always-on `daftari serve` instance
+over Streamable HTTP with per-session identity (static tokens and/or OAuth
+2.1), plus durable object-storage backing (S3/Azure/GCS-interop) behind the
+canonical local git working copy. Design record:
+`docs/superpowers/specs/2026-07-20-self-hosted-server-mode-design.md`.
+
+### Added
+
+- **`daftari serve` — server mode over Streamable HTTP (#5).** One always-on
+  instance, many MCP clients, per-session RBAC identity resolved at session
+  open (zero tool changes — every existence-disclosure invariant applies per
+  connection). Static bearer tokens declared in config with values in env
+  vars. Fail-loud posture throughout: a non-loopback bind refuses without
+  auth AND an explicit `server.transport_security: external` declaration
+  (daftari never terminates TLS); with auth configured a bad credential is a
+  401 at session open, never a guest downgrade; loopback binds carry a
+  DNS-rebinding guard (Host/Origin validated before routing). The process
+  lock learns modes: a stray stdio invocation refuses against a live server,
+  a new serve refuses against any live holder, and deliberate replacement is
+  `daftari serve --takeover` (stdio-vs-stdio keeps its classic takeover;
+  stale locks are still overwritten silently).
+- **OAuth 2.1 resource-server auth for serve (#7).** Bearer JWTs verified
+  against your IdP's JWKS (issuer + audience + signature + expiry via
+  `jose`), with the subject claim mapped through a config-declared subjects
+  table. A valid token with an unmapped subject is 403 — authenticated, not
+  authorized — never a guest, never a default role. Composes with static
+  tokens (agents on tokens, humans through the IdP). Hardened: https-only
+  issuer/JWKS URLs (loopback http for test IdPs only), constant-time static
+  token matching, `Object.prototype`-collision-proof subject lookup.
+- **Pluggable storage backends as sync targets (#6).** The local git working
+  copy stays canonical; a backend is a dumb `get/put/list/delete` target.
+  Backends: `fs` (local/mounted directory), `s3` (S3, MinIO, R2, GCS via its
+  S3-interop endpoint), `azure` (Blob/ADLS Gen2) — cloud SDKs are optional
+  peer dependencies loaded on demand, credentials come only from the SDKs'
+  environment chains, custom endpoints must be https. `daftari sync` pushes
+  incrementally against a remote hash manifest (tree + `.git` + durable
+  `.daftari` journals; the rebuildable index/locks never sync) and
+  `daftari sync --restore` rebuilds a vault into an empty directory with
+  per-object hash verification and a reindex. `daftari serve` can push on a
+  cadence (`storage.sync_interval_minutes`). Security posture: `.git/config`
+  and `.git/hooks` are never synced or restored (git executes what they
+  declare — a backup channel must not deliver code), and restore re-enforces
+  every exclusion against the untrusted manifest.
+- **Agent-as-judge rerank pool on `vault_search` (#3).** Opt-in
+  `rerank_candidates`: the server prepares the fused candidate pool and the
+  protocol; the calling agent is the judge.
+- **Per-document theme distributions (#58).** True multi-theme membership via
+  chunk-level clustering.
+- **Configurable tool-exposure tiers (#103, #104).** `tools.tier`
+  (`core`/`standard`/`full`) plus `include`/`exclude` lists in config.
+- **Resumable reindex (#54).** Per-batch embedding commits so an interrupted
+  reindex resumes instead of restarting.
+- **`daftari eval prune` (#100)** — `results/` and `scores/` housekeeping —
+  and eval v1 polish (#102): honest exit codes, skipped-run reporting, resume
+  validation, tier-aware triviality, intra-call dedupe, `--max-nodes`.
+- **Advisory domain-boundary enforcement (#4)** and inline structural decay
+  checks (orphans, deprecated-still-linked) in the curation engine.
+- **Advisory supersede nudge** when overwriting an existing doc, and a YAML
+  config error hint for comment lines that lost their `#`.
+- **`daftari okf export|import` — Open Knowledge Format bridge.** OKF is Google
+  Cloud's vendor-neutral spec (v0.1) for the LLM-wiki pattern — a directory of
+  markdown files with YAML frontmatter — which is exactly Daftari's storage
+  model. `okf export` renders a vault as a portable OKF bundle: each doc becomes
+  an OKF concept doc carrying the core `type` / `title` / `description` /
+  `resource` / `tags` / `timestamp` fields plus a verbatim `daftari` sidecar for
+  lossless round-trip, alongside generated `index.md` and `log.md` reserved
+  files; the source vault is never mutated. `okf import` adopts an OKF bundle
+  into a vault — a bundle from `okf export` round-trips exactly via its sidecar,
+  while a foreign bundle is mapped conservatively (docs land as `draft` in the
+  `accumulation` domain, the source OKF `type` preserved in `okf_type`); writes
+  auto-commit and the index is rebuilt. `--dry-run` previews the import plan.
+
+- **The compilation pipeline (#232–#236, #141, #217).** Edge provenance
+  classes with type-directed change dispatch (tier 1), structure-first tier-0
+  lint checks with a ratify gate, a semantic-review queue with typed verdicts
+  (tier 2), the compiled `consumes` dependency graph (run-correlated reads ×
+  writes, #233), edge staleness classes and the broken-read rate (#234),
+  proposal deltas (write action type, `run_id` provenance, inter-proposal
+  tension, a propose-only role, #235), write-protection tiers
+  (source/compiled/manual with a demote-then-write escape hatch, #141), a
+  review-throughput lint aggregate, and edge-graph existence disclosure
+  (blast B′, edges/lint omission) extending the 2026-07-14 RBAC spec (#217).
+- **`sleep` tension-scan dream-type (#228)** closing the day-0 detection gap,
+  a langgraph-store adapter with the dedup-is-not-epistemics demo (#227),
+  the daftari.dev landing page (#226), and MCP Registry metadata (#222).
+- **Dev maturity (#238–#242):** e2e gate on the built server, tag-driven npm
+  release via OIDC trusted publishing, automated code + security review on
+  PRs, an `@claude` mention responder, and a nightly maintenance loop.
+
+### Fixed
+
+- Canonical-path tension/provenance gates in `vault_status`, `vault_receipt`,
+  and precedent lookups (#216), and tier-1 anchors that are unreadable leak
+  neither provenance metadata nor existence (#252).
+- `daftari audit` no longer flags on-disk assets and unaudited siblings as
+  missing (#255); eval exit codes and resume validation honesty (#102).
+
+### Performance
+
+- SQL-authoritative edge reads with write-through and stat-marker self-heal
+  (#236), FTS5 `snippet()` for lexical excerpts on the chunk path, and the
+  file watcher filters non-markdown events at watch time (#107).
+
 ## [1.30.0] - 2026-07-13
 
 ### Added
@@ -1377,6 +1551,8 @@ vault to AI agents, exposing 13 tools over stdio.
   example documents, git history, search index); `daftari --vault` serves it.
 - 160 tests covering all 13 tools and their supporting modules.
 
+[1.32.0]: https://github.com/mavaali/daftari/releases/tag/v1.32.0
+[1.31.0]: https://github.com/mavaali/daftari/releases/tag/v1.31.0
 [1.5.1]: https://github.com/mavaali/daftari/releases/tag/v1.5.1
 [1.4.0]: https://github.com/mavaali/daftari/releases/tag/v1.4.0
 [1.1.1]: https://github.com/mavaali/daftari/releases/tag/v1.1.1

package/README.md

@@ -116,6 +116,31 @@ The curation engine is advisory: `vault_lint` reports problems and
 `vault_tension_log` records contradictions. Neither auto-fixes anything. Every
 change is a deliberate, attributable act.
 
+### Tool tiers
+
+Every advertised tool costs the agent context tokens and a decision branch.
+The `tools` block in `.daftari/config.yaml` picks how much of the registry
+`tools/list` advertises:
+
+```yaml
+tools:
+  tier: standard   # core | standard | full (default: full)
+  include:         # add tools the tier omits
+    - vault_tension_log
+  exclude:         # remove tools the tier includes — exclude wins
+    - vault_status
+```
+
+`core` is the search-before-derive loop (`vault_search`, `vault_read`,
+`vault_write`, `vault_index`, `vault_lint`, `vault_status`); `standard` adds
+the full document lifecycle (append/promote/deprecate/supersede/merge,
+confidence and tier setters, propose/ratify) plus diagnostics; `full` is
+everything. `--tools <tier>` overrides the tier for one invocation. Filtering
+only changes what is *advertised* — calls to any registered tool still work,
+so an agent holding a cached tool name keeps working across a tier change.
+Unknown names in `include`/`exclude` warn at startup and are ignored, so a
+config written for a newer daftari still loads.
+
 **Evaluate (opt-in, requires an Anthropic API key):** `daftari eval` — scores how
 well an LLM can use the curation surface to answer multi-hop questions about the
 vault. See the [design spec](docs/superpowers/specs/2026-05-31-cortex-quality-metric-design.md)
@@ -243,6 +268,129 @@ daftari backfill --plan
 daftari backfill --apply --scope specs
 ```
 
+## Open Knowledge Format (OKF)
+
+[OKF](https://cloud.google.com/blog/products/data-analytics/how-the-open-knowledge-format-can-improve-data-sharing/)
+is Google Cloud's vendor-neutral spec for the LLM-wiki pattern: a directory of
+markdown files with YAML frontmatter that any producer can emit and any consumer
+can read without translation. A Daftari vault *is* that pattern, so `daftari
+okf` bridges the two directions.
+[v0.2](https://cloud.google.com/blog/products/data-analytics/okf-v0-2-adds-trust-signals/)
+adds opt-in **trust signals** — raw credibility indicators (provenance,
+verification, lifecycle, freshness), never computed scores — and Daftari maps
+them from/to its native metadata.
+
+**Export** renders the vault as a portable OKF bundle — every doc becomes an OKF
+concept doc (the core `type` / `title` / `description` / `resource` / `tags`
+fields, plus a verbatim `daftari` sidecar for lossless round-trip), with
+generated `index.md` (progressive-disclosure listing) and `log.md`
+(chronological history). Trust signals derive from native metadata:
+`updated`/`updated_by` become `generated`, the lifecycle maps to
+`draft`/`stable`/`deprecated`, `ttl_days` becomes an absolute `stale_after`
+date, and `sources` become structured entries. `verified` is never fabricated —
+Daftari records authorship, not independent confirmations, so exported docs
+honestly read as unverified. The source vault is never mutated.
+
+```bash
+daftari okf export ./my-vault --out ./okf-bundle
+daftari okf export ./my-vault --out ./okf-bundle --collection pricing
+```
+
+**Import** adopts an OKF bundle into a vault. A bundle produced by `okf export`
+round-trips exactly via its sidecar; a foreign bundle is mapped conservatively
+(docs land as `draft` in the `accumulation` domain, the original OKF `type` is
+preserved in an `okf_type` field). Trust signals inform the mapping: a
+human-reviewed doc (a `human:*` entry in `verified`) imports with `confidence:
+high`, `status: deprecated` stays `deprecated` (retired knowledge must not
+resurface as a fresh draft), and `stale_after` converts to `ttl_days`. An
+`Attested Computation` is surfaced in an import warning but **not**
+auto-write-protected: `tier: source` is enforcement, and its only sanctioned
+grant path is `vault_set_tier` (reason required, provenance-logged) — a foreign
+bundle's self-declared `type` doesn't buy it. Review the doc, then elevate
+deliberately. OKF fields with no lossless Daftari slot (the trust record,
+attestation machinery) are preserved under `okf_*` keys. Writes auto-commit and
+the index is rebuilt.
+
+```bash
+daftari okf import ./okf-bundle --into ./my-vault --dry-run
+daftari okf import ./okf-bundle --into ./my-vault
+```
+
+## Server mode (self-hosted)
+
+By default daftari is a per-user stdio process. `daftari serve` starts the
+same vault as **one always-on instance over Streamable HTTP** — for a team, or
+for clients that can't spawn a local process (claude.ai web/mobile, Cowork):
+
+```bash
+daftari serve --vault ./my-vault              # http://127.0.0.1:8787/mcp
+daftari serve --vault ./my-vault --bind 0.0.0.0 --port 9000
+```
+
+Identity is **per MCP session**, resolved when the session opens, so every
+RBAC and existence-disclosure rule applies per connection with zero tool
+changes. Two composable auth schemes, both declared in config:
+
+```yaml
+server:
+  transport_security: external   # required off-loopback: TLS terminates upstream
+  auth:
+    tokens:                      # static bearer tokens (agents, ETL)
+      - env: DAFTARI_TOKEN_ETL   # the VALUE lives in this env var, never in config
+        user: agent:etl
+        role: admin
+    oauth:                       # OAuth 2.1 resource server (humans via your IdP)
+      issuer: https://idp.example.com
+      audience: daftari
+      jwks_uri: https://idp.example.com/.well-known/jwks.json
+      subjects:
+        "alice@example.com": { user: human:alice, role: analyst }
+```
+
+The posture is fail-loud, never silent-downgrade: a non-loopback bind refuses
+to start without auth **and** the explicit `transport_security: external`
+acknowledgment (daftari never terminates TLS itself — put Caddy/nginx/a load
+balancer in front); with any auth configured, a bad or missing credential is
+a 401 at session open and a valid JWT whose subject isn't mapped is a 403 —
+neither ever becomes the guest. Guest sessions exist only in the no-auth
+loopback configuration. A running server also refuses to be silently killed:
+stray stdio invocations against the same vault refuse to start, and replacing
+a live holder requires a deliberate `daftari serve --takeover`.
+
+## Storage backing
+
+A self-hosted vault can push to durable object storage (#6). The local git
+working copy stays canonical — reads, writes, auto-commits, locks, and the
+index all stay exactly as above — and the backing is a dumb sync target:
+
+```yaml
+# .daftari/config.yaml
+storage:
+  backend: s3            # fs | s3 | azure
+  bucket: team-vault
+  region: us-east-1
+  # endpoint: https://…  # MinIO / R2 / GCS S3-interop endpoints
+  # sync_interval_minutes: 15   # daftari serve pushes on this cadence
+```
+
+```bash
+daftari sync --vault ./my-vault              # incremental push
+daftari sync --vault ./my-vault --dry-run    # show the diff only
+daftari sync --vault ./empty-dir --restore --backend s3 --bucket team-vault
+```
+
+The push covers the markdown tree, the `.git` directory, and durable
+`.daftari` journals; the rebuildable SQLite index and lock files never sync.
+Neither do `.git/config` and `.git/hooks` — git *executes* what those
+declare, and a backup channel must not deliver code (`git clone` refuses to
+transmit them for the same reason), so re-add remotes and local git config
+by hand after a restore.
+Cloud backends load their SDKs (`@aws-sdk/client-s3`, `@azure/storage-blob`)
+as optional dependencies — install the one you use; credentials come from the
+SDK's standard environment chain, never from vault config. GCS is reached via
+its S3-interoperability endpoint. Restore refuses non-empty directories and
+reindexes when done.
+
 ## How it compares
 
 |                    |AGENTS.md        |RAG                          |Daftari                              |
@@ -257,12 +405,18 @@ daftari backfill --apply --scope specs
 
 Deliberately deferred to keep the surface tight:
 
-- **Cloud-hosted multi-tenant server** with S3/GCS backend and token auth
-- **Remote MCP transport** for claude.ai web, mobile, and Cowork (v1 is a local desktop extension for Claude Desktop and Claude Code)
+- **Cloud-hosted multi-tenant SaaS** (self-hosted server mode HAS shipped —
+  see [Server mode](#server-mode-self-hosted) and
+  [Storage backing](#storage-backing); the project itself hosts nothing)
 - **Conflict resolution beyond file-level locks** (CRDTs, semantic merge)
 - **Background curation agent** running lint on a cadence
-- **LLM reranking** of search results
-- **Enforced domain separation** (v1 documents the convention; v2 enforces it)
+- **Enforced domain separation** (v1 documents the convention; v2 enforces it —
+  advisory boundary warnings shipped in the meantime: `vault_lint`'s
+  `domainLeaks` check and write-time `domain_warnings`)
+
+(LLM reranking, deferred here originally, has since shipped as the opt-in
+agent-as-judge `rerank_candidates` on `vault_search`: the server prepares the
+fused candidate pool and the protocol; the calling agent is the judge.)
 
 Each is a clean increment on a surface that already works.
 
@@ -493,6 +647,36 @@ collection-pair > same-kind; no LLM): the court retrieves how this house has
 resolved similar disputes before, and whether a precedent applies stays the
 human's judgment. Memory grows case law.
 
+## The principal interview
+
+The vault interrogates you. `daftari interview` assembles a question sheet
+from what the vault already knows is unclear — open tensions (contested
+first, longest-carried first), canonical accumulation docs past their TTL,
+and `questions_raised` entries no document answers — deterministic and
+LLM-free, like the circadian pass:
+
+```bash
+# The sheet — read-only, priority-ordered
+daftari interview --vault ./my-vault
+
+# Sit for it. Answers are recorded VERBATIM; empty skips, 'q' ends.
+daftari interview ask --vault ./my-vault
+```
+
+Answered questions become a transcript document in an `interviews/`
+collection — `tier: source` (your words, body immutable), `provenance:
+direct`, no TTL (testimony doesn't expire) — committed like any other write,
+with `sources` tracing each question back to the tension or document that
+prompted it. The pattern is the companion interview on a living-summary
+page: the compiler's highest-value move is not more compilation, it is
+asking the principal about the unclear spots and folding the verbatim
+answers back into the corpus.
+
+Recording testimony resolves nothing. The transcript is *evidence*: the CLI
+ends by pointing at `daftari court rule <id> --references <transcript>` for
+tensions it touched, and at re-verified writes for stale docs. Operator-only,
+like the court — no MCP tool, no access context.
+
 ## Belief archaeology
 
 Git is the version layer, so the vault can answer **"what did we believe on

package/dist/access/rbac.d.ts

@@ -12,6 +12,7 @@ export declare function canRead(role: RoleConfig | null, collection: string): bo
 export declare function canWrite(role: RoleConfig | null, collection: string): boolean;
 export declare function canPromote(role: RoleConfig | null): boolean;
 export declare function canRatify(role: RoleConfig | null): boolean;
+export declare function isProposeOnly(role: RoleConfig | null): boolean;
 export declare function hasAnyRead(role: RoleConfig | null): boolean;
 export declare function filterByReadPermission<T extends {
     collection: string;

package/dist/access/rbac.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"rbac.d.ts","sourceRoot":"","sources":["../../src/access/rbac.ts"],"names":[],"mappings":"AAUA,OAAO,KAAK,EAAE,aAAa,EAAE,UAAU,EAAE,MAAM,oBAAoB,CAAC;AAEpE,eAAO,MAAM,UAAU,UAAU,CAAC;AAClC,eAAO,MAAM,QAAQ,MAAM,CAAC;AAI5B,MAAM,WAAW,aAAa;IAC5B,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,EAAE,MAAM,CAAC;IACjB,IAAI,EAAE,UAAU,GAAG,IAAI,CAAC;CACzB;AAKD,wBAAgB,aAAa,CAC3B,MAAM,EAAE,aAAa,EACrB,IAAI,EAAE,MAAM,EACZ,QAAQ,EAAE,MAAM,GACf,aAAa,CAEf;AAID,wBAAgB,WAAW,CAAC,IAAI,SAAU,GAAG,aAAa,CAEzD;AAOD,wBAAgB,OAAO,CAAC,IAAI,EAAE,UAAU,GAAG,IAAI,EAAE,UAAU,EAAE,MAAM,GAAG,OAAO,CAE5E;AAGD,wBAAgB,QAAQ,CAAC,IAAI,EAAE,UAAU,GAAG,IAAI,EAAE,UAAU,EAAE,MAAM,GAAG,OAAO,CAE7E;AAGD,wBAAgB,UAAU,CAAC,IAAI,EAAE,UAAU,GAAG,IAAI,GAAG,OAAO,CAE3D;AAMD,wBAAgB,SAAS,CAAC,IAAI,EAAE,UAAU,GAAG,IAAI,GAAG,OAAO,CAE1D;AAID,wBAAgB,UAAU,CAAC,IAAI,EAAE,UAAU,GAAG,IAAI,GAAG,OAAO,CAE3D;AAID,wBAAgB,sBAAsB,CAAC,CAAC,SAAS;IAAE,UAAU,EAAE,MAAM,CAAA;CAAE,EACrE,IAAI,EAAE,UAAU,GAAG,IAAI,EACvB,KAAK,EAAE,CAAC,EAAE,GACT,CAAC,EAAE,CAEL"}
+{"version":3,"file":"rbac.d.ts","sourceRoot":"","sources":["../../src/access/rbac.ts"],"names":[],"mappings":"AAUA,OAAO,KAAK,EAAE,aAAa,EAAE,UAAU,EAAE,MAAM,oBAAoB,CAAC;AAEpE,eAAO,MAAM,UAAU,UAAU,CAAC;AAClC,eAAO,MAAM,QAAQ,MAAM,CAAC;AAI5B,MAAM,WAAW,aAAa;IAC5B,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,EAAE,MAAM,CAAC;IACjB,IAAI,EAAE,UAAU,GAAG,IAAI,CAAC;CACzB;AAKD,wBAAgB,aAAa,CAC3B,MAAM,EAAE,aAAa,EACrB,IAAI,EAAE,MAAM,EACZ,QAAQ,EAAE,MAAM,GACf,aAAa,CAEf;AAID,wBAAgB,WAAW,CAAC,IAAI,SAAU,GAAG,aAAa,CAEzD;AAOD,wBAAgB,OAAO,CAAC,IAAI,EAAE,UAAU,GAAG,IAAI,EAAE,UAAU,EAAE,MAAM,GAAG,OAAO,CAE5E;AAGD,wBAAgB,QAAQ,CAAC,IAAI,EAAE,UAAU,GAAG,IAAI,EAAE,UAAU,EAAE,MAAM,GAAG,OAAO,CAE7E;AAGD,wBAAgB,UAAU,CAAC,IAAI,EAAE,UAAU,GAAG,IAAI,GAAG,OAAO,CAE3D;AAMD,wBAAgB,SAAS,CAAC,IAAI,EAAE,UAAU,GAAG,IAAI,GAAG,OAAO,CAE1D;AAMD,wBAAgB,aAAa,CAAC,IAAI,EAAE,UAAU,GAAG,IAAI,GAAG,OAAO,CAE9D;AAID,wBAAgB,UAAU,CAAC,IAAI,EAAE,UAAU,GAAG,IAAI,GAAG,OAAO,CAE3D;AAID,wBAAgB,sBAAsB,CAAC,CAAC,SAAS;IAAE,UAAU,EAAE,MAAM,CAAA;CAAE,EACrE,IAAI,EAAE,UAAU,GAAG,IAAI,EACvB,KAAK,EAAE,CAAC,EAAE,GACT,CAAC,EAAE,CAEL"}

package/dist/access/rbac.js

@@ -42,6 +42,13 @@ export function canPromote(role) {
 export function canRatify(role) {
     return role?.ratify ?? false;
 }
+// True if the role is propose-only (#235): its writes must land as staged
+// `write` proposals, never as direct mutations. vault_write coerces; every
+// other write tool denies. The write grant still scopes WHICH collections the
+// role may propose into.
+export function isProposeOnly(role) {
+    return role?.proposeOnly ?? false;
+}
 // True if the role has read access to at least one collection. Curation tools
 // (lint, tension log, provenance) are open to anyone with any read grant.
 export function hasAnyRead(role) {

package/dist/access/rbac.js.map

@@ -1 +1 @@
-{"version":3,"file":"rbac.js","sourceRoot":"","sources":["../../src/access/rbac.ts"],"names":[],"mappings":"AAAA,6BAA6B;AAC7B,EAAE;AACF,6EAA6E;AAC7E,8EAA8E;AAC9E,2EAA2E;AAC3E,EAAE;AACF,8EAA8E;AAC9E,2EAA2E;AAC3E,0EAA0E;AAI1E,MAAM,CAAC,MAAM,UAAU,GAAG,OAAO,CAAC;AAClC,MAAM,CAAC,MAAM,QAAQ,GAAG,GAAG,CAAC;AAU5B,+EAA+E;AAC/E,6EAA6E;AAC7E,2BAA2B;AAC3B,MAAM,UAAU,aAAa,CAC3B,MAAqB,EACrB,IAAY,EACZ,QAAgB;IAEhB,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,CAAC,KAAK,CAAC,QAAQ,CAAC,IAAI,IAAI,EAAE,CAAC;AAClE,CAAC;AAED,2EAA2E;AAC3E,0BAA0B;AAC1B,MAAM,UAAU,WAAW,CAAC,IAAI,GAAG,OAAO;IACxC,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,UAAU,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;AACpD,CAAC;AAED,SAAS,OAAO,CAAC,IAAc,EAAE,UAAkB;IACjD,OAAO,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC;AAC9D,CAAC;AAED,uDAAuD;AACvD,MAAM,UAAU,OAAO,CAAC,IAAuB,EAAE,UAAkB;IACjE,OAAO,IAAI,KAAK,IAAI,IAAI,OAAO,CAAC,IAAI,CAAC,IAAI,EAAE,UAAU,CAAC,CAAC;AACzD,CAAC;AAED,gEAAgE;AAChE,MAAM,UAAU,QAAQ,CAAC,IAAuB,EAAE,UAAkB;IAClE,OAAO,IAAI,KAAK,IAAI,IAAI,OAAO,CAAC,IAAI,CAAC,KAAK,EAAE,UAAU,CAAC,CAAC;AAC1D,CAAC;AAED,qDAAqD;AACrD,MAAM,UAAU,UAAU,CAAC,IAAuB;IAChD,OAAO,IAAI,EAAE,OAAO,IAAI,KAAK,CAAC;AAChC,CAAC;AAED,8EAA8E;AAC9E,4EAA4E;AAC5E,wEAAwE;AACxE,kDAAkD;AAClD,MAAM,UAAU,SAAS,CAAC,IAAuB;IAC/C,OAAO,IAAI,EAAE,MAAM,IAAI,KAAK,CAAC;AAC/B,CAAC;AAED,8EAA8E;AAC9E,0EAA0E;AAC1E,MAAM,UAAU,UAAU,CAAC,IAAuB;IAChD,OAAO,IAAI,KAAK,IAAI,IAAI,IAAI,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC;AAC/C,CAAC;AAED,8EAA8E;AAC9E,wBAAwB;AACxB,MAAM,UAAU,sBAAsB,CACpC,IAAuB,EACvB,KAAU;IAEV,OAAO,KAAK,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,OAAO,CAAC,IAAI,EAAE,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC;AAChE,CAAC"}
+{"version":3,"file":"rbac.js","sourceRoot":"","sources":["../../src/access/rbac.ts"],"names":[],"mappings":"AAAA,6BAA6B;AAC7B,EAAE;AACF,6EAA6E;AAC7E,8EAA8E;AAC9E,2EAA2E;AAC3E,EAAE;AACF,8EAA8E;AAC9E,2EAA2E;AAC3E,0EAA0E;AAI1E,MAAM,CAAC,MAAM,UAAU,GAAG,OAAO,CAAC;AAClC,MAAM,CAAC,MAAM,QAAQ,GAAG,GAAG,CAAC;AAU5B,+EAA+E;AAC/E,6EAA6E;AAC7E,2BAA2B;AAC3B,MAAM,UAAU,aAAa,CAC3B,MAAqB,EACrB,IAAY,EACZ,QAAgB;IAEhB,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,CAAC,KAAK,CAAC,QAAQ,CAAC,IAAI,IAAI,EAAE,CAAC;AAClE,CAAC;AAED,2EAA2E;AAC3E,0BAA0B;AAC1B,MAAM,UAAU,WAAW,CAAC,IAAI,GAAG,OAAO;IACxC,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,UAAU,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;AACpD,CAAC;AAED,SAAS,OAAO,CAAC,IAAc,EAAE,UAAkB;IACjD,OAAO,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC;AAC9D,CAAC;AAED,uDAAuD;AACvD,MAAM,UAAU,OAAO,CAAC,IAAuB,EAAE,UAAkB;IACjE,OAAO,IAAI,KAAK,IAAI,IAAI,OAAO,CAAC,IAAI,CAAC,IAAI,EAAE,UAAU,CAAC,CAAC;AACzD,CAAC;AAED,gEAAgE;AAChE,MAAM,UAAU,QAAQ,CAAC,IAAuB,EAAE,UAAkB;IAClE,OAAO,IAAI,KAAK,IAAI,IAAI,OAAO,CAAC,IAAI,CAAC,KAAK,EAAE,UAAU,CAAC,CAAC;AAC1D,CAAC;AAED,qDAAqD;AACrD,MAAM,UAAU,UAAU,CAAC,IAAuB;IAChD,OAAO,IAAI,EAAE,OAAO,IAAI,KAAK,CAAC;AAChC,CAAC;AAED,8EAA8E;AAC9E,4EAA4E;AAC5E,wEAAwE;AACxE,kDAAkD;AAClD,MAAM,UAAU,SAAS,CAAC,IAAuB;IAC/C,OAAO,IAAI,EAAE,MAAM,IAAI,KAAK,CAAC;AAC/B,CAAC;AAED,0EAA0E;AAC1E,2EAA2E;AAC3E,8EAA8E;AAC9E,yBAAyB;AACzB,MAAM,UAAU,aAAa,CAAC,IAAuB;IACnD,OAAO,IAAI,EAAE,WAAW,IAAI,KAAK,CAAC;AACpC,CAAC;AAED,8EAA8E;AAC9E,0EAA0E;AAC1E,MAAM,UAAU,UAAU,CAAC,IAAuB;IAChD,OAAO,IAAI,KAAK,IAAI,IAAI,IAAI,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC;AAC/C,CAAC;AAED,8EAA8E;AAC9E,wBAAwB;AACxB,MAAM,UAAU,sBAAsB,CACpC,IAAuB,EACvB,KAAU;IAEV,OAAO,KAAK,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,OAAO,CAAC,IAAI,EAAE,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC;AAChE,CAAC"}

package/dist/audit/checks/broken_refs.d.ts

@@ -1,3 +1,3 @@
 import type { BrokenRefFinding, LinkEdge, RepoSnapshot } from "../types.js";
-export declare function checkBrokenRefs(snapshots: RepoSnapshot[], edges: LinkEdge[]): BrokenRefFinding[];
+export declare function checkBrokenRefs(snapshots: RepoSnapshot[], edges: LinkEdge[], existsWithin?: (rootAbs: string, targetAbs: string) => boolean): BrokenRefFinding[];
 //# sourceMappingURL=broken_refs.d.ts.map

package/dist/audit/checks/broken_refs.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"broken_refs.d.ts","sourceRoot":"","sources":["../../../src/audit/checks/broken_refs.ts"],"names":[],"mappings":"AAaA,OAAO,KAAK,EAAE,gBAAgB,EAAE,QAAQ,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAE5E,wBAAgB,eAAe,CAAC,SAAS,EAAE,YAAY,EAAE,EAAE,KAAK,EAAE,QAAQ,EAAE,GAAG,gBAAgB,EAAE,CA0DhG"}
+{"version":3,"file":"broken_refs.d.ts","sourceRoot":"","sources":["../../../src/audit/checks/broken_refs.ts"],"names":[],"mappings":"AA2BA,OAAO,KAAK,EAAE,gBAAgB,EAAE,QAAQ,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAS5E,wBAAgB,eAAe,CAC7B,SAAS,EAAE,YAAY,EAAE,EACzB,KAAK,EAAE,QAAQ,EAAE,EAIjB,YAAY,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,KAAK,OAAO,GAC7D,gBAAgB,EAAE,CAiGpB"}

package/dist/audit/checks/broken_refs.js

@@ -1,32 +1,72 @@
 // src/audit/checks/broken_refs.ts
 // Pure function: given snapshots and classified edges, return every broken
-// reference as a BrokenRefFinding. No throws. No classes.
+// reference as a BrokenRefFinding. No throws. No classes. Disk access enters
+// ONLY through the injected `existsWithin` oracle — the orchestrator passes
+// collect.ts's symlink-safe implementation; tests pass a fake; omitting it
+// reproduces the index-only behavior. The oracle receives the CONTAINMENT
+// ROOT alongside the target because existence and confinement must be
+// decided together: a lexical check here plus a bare exists() there would
+// let a committed symlink (repo/escape -> /) walk the probe back out.
 //
 // Resolution logic:
 //   1. Look up target repo by name; if not found → missing_file.
 //   2. Look up targetPath in that repo's docs Map.
 //   3. If not found and targetPath lacks a ".md" extension, try targetPath +
 //      ".md" (spec §7 bare-path fallback).
-//   4. If still not found → missing_file.
-//   5. If found and targetAnchor is set: check DocSnapshot.headings. If absent
+//   4. Still not found, edge escaped every configured repo (outOfScope):
+//      existing on disk → out_of_scope_target (the audit can't vouch for it,
+//      but the link is not broken — #133); absent → missing_file.
+//   5. Still not found, in-scope: existing on disk → NOT a finding — the doc
+//      index only holds glob-matched markdown, and references to real assets
+//      (.png, .pdf, .dagitty, …) are legitimate (#132). Anchors into such
+//      files are unverifiable and deliberately not flagged.
+//   6. Otherwise → missing_file.
+//   7. If found and targetAnchor is set: check DocSnapshot.headings. If absent
 //      → missing_anchor.
-export function checkBrokenRefs(snapshots, edges) {
+import { isAbsolute, relative as nodeRelative, resolve as nodeResolve } from "node:path";
+// True iff `abs` sits at or under `root` (lexical containment; both sides are
+// already-resolved absolute paths).
+function within(root, abs) {
+    const rel = nodeRelative(root, abs);
+    return rel === "" || (!rel.startsWith("..") && !isAbsolute(rel));
+}
+export function checkBrokenRefs(snapshots, edges, 
+// Must return true only when targetAbs exists on disk AND its REAL
+// (symlink-resolved) location sits under rootAbs. See
+// collect.ts#symlinkSafeExistsWithin for the production implementation.
+existsWithin) {
     // Index snapshots by repo name for O(1) lookup.
     const byRepo = new Map();
     for (const snap of snapshots) {
         byRepo.set(snap.config.name, snap);
     }
+    // The existence oracle is CONFINED (security review on #255): probing an
+    // arbitrary resolvedAbs would let anyone who can author a doc turn the
+    // audit report into a host-filesystem existence probe
+    // ([x](../../../../etc/shadow) → out_of_scope_target vs missing_file).
+    // #133's actual case is UNAUDITED SIBLINGS, so out-of-scope probes are
+    // allowed only under the parent directories of the configured repo roots;
+    // anything further out is reported missing_file without ever touching
+    // disk — exactly the pre-oracle behavior. A repo mounted directly under
+    // the filesystem root gets NO sibling scope: its "parent" would be the
+    // entire filesystem and the confinement would collapse to none, so
+    // out-of-scope refs from such a repo stay unprobed.
+    const siblingScopes = snapshots.flatMap((s) => {
+        const parent = nodeResolve(s.config.path, "..");
+        return nodeResolve(parent, "..") === parent ? [] : [parent];
+    });
     const findings = [];
     for (const edge of edges) {
+        const finding = (kind, path) => ({
+            kind,
+            source: { repo: edge.sourceRepo, path: edge.sourcePath },
+            target: { repo: edge.targetRepo, path, anchor: edge.targetAnchor },
+            rawHref: edge.rawHref,
+        });
         const targetSnap = byRepo.get(edge.targetRepo);
         if (!targetSnap) {
             // Target repo itself is unknown — treat as missing file.
-            findings.push({
-                kind: "missing_file",
-                source: { repo: edge.sourceRepo, path: edge.sourcePath },
-                target: { repo: edge.targetRepo, path: edge.targetPath, anchor: edge.targetAnchor },
-                rawHref: edge.rawHref,
-            });
+            findings.push(finding("missing_file", edge.targetPath));
             continue;
         }
         // Resolve the target doc: exact match, then .md fallback.
@@ -41,24 +81,39 @@ export function checkBrokenRefs(snapshots, edges) {
             }
         }
         if (resolvedPath === null) {
-            findings.push({
-                kind: "missing_file",
-                source: { repo: edge.sourceRepo, path: edge.sourcePath },
-                target: { repo: edge.targetRepo, path: edge.targetPath, anchor: edge.targetAnchor },
-                rawHref: edge.rawHref,
-            });
+            if (edge.outOfScope) {
+                // The href escaped every audited repo (#133). A file that exists out
+                // there is not a broken link — but it stays VISIBLE with its own
+                // kind, never silently passed: the audit cannot vouch for a target
+                // it does not scan. The probe runs only inside the sibling scopes
+                // (see above); a target beyond them is missing_file, unprobed.
+                const resolvedAbs = edge.resolvedAbs;
+                // Lexical pre-filter picks the candidate scope without touching
+                // disk; the oracle then re-verifies containment on REAL paths.
+                const scope = resolvedAbs !== undefined ? siblingScopes.find((s) => within(s, resolvedAbs)) : undefined;
+                findings.push(finding(resolvedAbs !== undefined && scope !== undefined && existsWithin?.(scope, resolvedAbs)
+                    ? "out_of_scope_target"
+                    : "missing_file", edge.targetPath));
+                continue;
+            }
+            // In-scope miss: the docs map only holds glob-matched markdown, but a
+            // reference to a real on-disk asset is legitimate (#132) — one
+            // existence probe, no finding. Anchors into assets are unverifiable.
+            // The probe is confined to the target repo root: a URL-derived
+            // targetPath can carry ../ segments, and escaping paths must not be
+            // probed (same oracle concern as above).
+            const abs = nodeResolve(targetSnap.config.path, edge.targetPath);
+            if (within(targetSnap.config.path, abs) && existsWithin?.(targetSnap.config.path, abs)) {
+                continue;
+            }
+            findings.push(finding("missing_file", edge.targetPath));
             continue;
         }
         // File found. Check anchor if present.
         if (edge.targetAnchor !== null) {
             const doc = targetSnap.docs.get(resolvedPath);
             if (doc && !doc.headings.has(edge.targetAnchor)) {
-                findings.push({
-                    kind: "missing_anchor",
-                    source: { repo: edge.sourceRepo, path: edge.sourcePath },
-                    target: { repo: edge.targetRepo, path: resolvedPath, anchor: edge.targetAnchor },
-                    rawHref: edge.rawHref,
-                });
+                findings.push(finding("missing_anchor", resolvedPath));
             }
         }
     }

package/dist/audit/checks/broken_refs.js.map

@@ -1 +1 @@
-{"version":3,"file":"broken_refs.js","sourceRoot":"","sources":["../../../src/audit/checks/broken_refs.ts"],"names":[],"mappings":"AAAA,kCAAkC;AAClC,2EAA2E;AAC3E,0DAA0D;AAC1D,EAAE;AACF,oBAAoB;AACpB,iEAAiE;AACjE,mDAAmD;AACnD,6EAA6E;AAC7E,2CAA2C;AAC3C,0CAA0C;AAC1C,+EAA+E;AAC/E,yBAAyB;AAIzB,MAAM,UAAU,eAAe,CAAC,SAAyB,EAAE,KAAiB;IAC1E,gDAAgD;IAChD,MAAM,MAAM,GAAG,IAAI,GAAG,EAAwB,CAAC;IAC/C,KAAK,MAAM,IAAI,IAAI,SAAS,EAAE,CAAC;QAC7B,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;IACrC,CAAC;IAED,MAAM,QAAQ,GAAuB,EAAE,CAAC;IAExC,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,MAAM,UAAU,GAAG,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;QAC/C,IAAI,CAAC,UAAU,EAAE,CAAC;YAChB,yDAAyD;YACzD,QAAQ,CAAC,IAAI,CAAC;gBACZ,IAAI,EAAE,cAAc;gBACpB,MAAM,EAAE,EAAE,IAAI,EAAE,IAAI,CAAC,UAAU,EAAE,IAAI,EAAE,IAAI,CAAC,UAAU,EAAE;gBACxD,MAAM,EAAE,EAAE,IAAI,EAAE,IAAI,CAAC,UAAU,EAAE,IAAI,EAAE,IAAI,CAAC,UAAU,EAAE,MAAM,EAAE,IAAI,CAAC,YAAY,EAAE;gBACnF,OAAO,EAAE,IAAI,CAAC,OAAO;aACtB,CAAC,CAAC;YACH,SAAS;QACX,CAAC;QAED,0DAA0D;QAC1D,IAAI,YAAY,GAAkB,IAAI,CAAC;QACvC,IAAI,UAAU,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,UAAU,CAAC,EAAE,CAAC;YACzC,YAAY,GAAG,IAAI,CAAC,UAAU,CAAC;QACjC,CAAC;aAAM,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;YAC5C,MAAM,MAAM,GAAG,GAAG,IAAI,CAAC,UAAU,KAAK,CAAC;YACvC,IAAI,UAAU,CAAC,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC;gBAChC,YAAY,GAAG,MAAM,CAAC;YACxB,CAAC;QACH,CAAC;QAED,IAAI,YAAY,KAAK,IAAI,EAAE,CAAC;YAC1B,QAAQ,CAAC,IAAI,CAAC;gBACZ,IAAI,EAAE,cAAc;gBACpB,MAAM,EAAE,EAAE,IAAI,EAAE,IAAI,CAAC,UAAU,EAAE,IAAI,EAAE,IAAI,CAAC,UAAU,EAAE;gBACxD,MAAM,EAAE,EAAE,IAAI,EAAE,IAAI,CAAC,UAAU,EAAE,IAAI,EAAE,IAAI,CAAC,UAAU,EAAE,MAAM,EAAE,IAAI,CAAC,YAAY,EAAE;gBACnF,OAAO,EAAE,IAAI,CAAC,OAAO;aACtB,CAAC,CAAC;YACH,SAAS;QACX,CAAC;QAED,uCAAuC;QACvC,IAAI,IAAI,CAAC,YAAY,KAAK,IAAI,EAAE,CAAC;YAC/B,MAAM,GAAG,GAAG,UAAU,CAAC,IAAI,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC;YAC9C,IAAI,GAAG,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,YAAY,CAAC,EAAE,CAAC;gBAChD,QAAQ,CAAC,IAAI,CAAC;oBACZ,IAAI,EAAE,gBAAgB;oBACtB,MAAM,EAAE,EAAE,IAAI,EAAE,IAAI,CAAC,UAAU,EAAE,IAAI,EAAE,IAAI,CAAC,UAAU,EAAE;oBACxD,MAAM,EAAE,EAAE,IAAI,EAAE,IAAI,CAAC,UAAU,EAAE,IAAI,EAAE,YAAY,EAAE,MAAM,EAAE,IAAI,CAAC,YAAY,EAAE;oBAChF,OAAO,EAAE,IAAI,CAAC,OAAO;iBACtB,CAAC,CAAC;YACL,CAAC;QACH,CAAC;IACH,CAAC;IAED,OAAO,QAAQ,CAAC;AAClB,CAAC"}
+{"version":3,"file":"broken_refs.js","sourceRoot":"","sources":["../../../src/audit/checks/broken_refs.ts"],"names":[],"mappings":"AAAA,kCAAkC;AAClC,2EAA2E;AAC3E,6EAA6E;AAC7E,4EAA4E;AAC5E,2EAA2E;AAC3E,0EAA0E;AAC1E,sEAAsE;AACtE,0EAA0E;AAC1E,sEAAsE;AACtE,EAAE;AACF,oBAAoB;AACpB,iEAAiE;AACjE,mDAAmD;AACnD,6EAA6E;AAC7E,2CAA2C;AAC3C,yEAAyE;AACzE,6EAA6E;AAC7E,kEAAkE;AAClE,6EAA6E;AAC7E,6EAA6E;AAC7E,0EAA0E;AAC1E,4DAA4D;AAC5D,iCAAiC;AACjC,+EAA+E;AAC/E,yBAAyB;AAEzB,OAAO,EAAE,UAAU,EAAE,QAAQ,IAAI,YAAY,EAAE,OAAO,IAAI,WAAW,EAAE,MAAM,WAAW,CAAC;AAGzF,8EAA8E;AAC9E,oCAAoC;AACpC,SAAS,MAAM,CAAC,IAAY,EAAE,GAAW;IACvC,MAAM,GAAG,GAAG,YAAY,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;IACpC,OAAO,GAAG,KAAK,EAAE,IAAI,CAAC,CAAC,GAAG,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC;AACnE,CAAC;AAED,MAAM,UAAU,eAAe,CAC7B,SAAyB,EACzB,KAAiB;AACjB,mEAAmE;AACnE,sDAAsD;AACtD,wEAAwE;AACxE,YAA8D;IAE9D,gDAAgD;IAChD,MAAM,MAAM,GAAG,IAAI,GAAG,EAAwB,CAAC;IAC/C,KAAK,MAAM,IAAI,IAAI,SAAS,EAAE,CAAC;QAC7B,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;IACrC,CAAC;IAED,yEAAyE;IACzE,uEAAuE;IACvE,sDAAsD;IACtD,uEAAuE;IACvE,uEAAuE;IACvE,0EAA0E;IAC1E,sEAAsE;IACtE,wEAAwE;IACxE,uEAAuE;IACvE,mEAAmE;IACnE,oDAAoD;IACpD,MAAM,aAAa,GAAG,SAAS,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE;QAC5C,MAAM,MAAM,GAAG,WAAW,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;QAChD,OAAO,WAAW,CAAC,MAAM,EAAE,IAAI,CAAC,KAAK,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC;IAC9D,CAAC,CAAC,CAAC;IAEH,MAAM,QAAQ,GAAuB,EAAE,CAAC;IAExC,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,MAAM,OAAO,GAAG,CAAC,IAA8B,EAAE,IAAY,EAAoB,EAAE,CAAC,CAAC;YACnF,IAAI;YACJ,MAAM,EAAE,EAAE,IAAI,EAAE,IAAI,CAAC,UAAU,EAAE,IAAI,EAAE,IAAI,CAAC,UAAU,EAAE;YACxD,MAAM,EAAE,EAAE,IAAI,EAAE,IAAI,CAAC,UAAU,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,CAAC,YAAY,EAAE;YAClE,OAAO,EAAE,IAAI,CAAC,OAAO;SACtB,CAAC,CAAC;QAEH,MAAM,UAAU,GAAG,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;QAC/C,IAAI,CAAC,UAAU,EAAE,CAAC;YAChB,yDAAyD;YACzD,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,cAAc,EAAE,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC;YACxD,SAAS;QACX,CAAC;QAED,0DAA0D;QAC1D,IAAI,YAAY,GAAkB,IAAI,CAAC;QACvC,IAAI,UAAU,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,UAAU,CAAC,EAAE,CAAC;YACzC,YAAY,GAAG,IAAI,CAAC,UAAU,CAAC;QACjC,CAAC;aAAM,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;YAC5C,MAAM,MAAM,GAAG,GAAG,IAAI,CAAC,UAAU,KAAK,CAAC;YACvC,IAAI,UAAU,CAAC,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC;gBAChC,YAAY,GAAG,MAAM,CAAC;YACxB,CAAC;QACH,CAAC;QAED,IAAI,YAAY,KAAK,IAAI,EAAE,CAAC;YAC1B,IAAI,IAAI,CAAC,UAAU,EAAE,CAAC;gBACpB,qEAAqE;gBACrE,iEAAiE;gBACjE,mEAAmE;gBACnE,kEAAkE;gBAClE,+DAA+D;gBAC/D,MAAM,WAAW,GAAG,IAAI,CAAC,WAAW,CAAC;gBACrC,gEAAgE;gBAChE,+DAA+D;gBAC/D,MAAM,KAAK,GACT,WAAW,KAAK,SAAS,CAAC,CAAC,CAAC,aAAa,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,CAAC,EAAE,WAAW,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;gBAC5F,QAAQ,CAAC,IAAI,CACX,OAAO,CACL,WAAW,KAAK,SAAS,IAAI,KAAK,KAAK,SAAS,IAAI,YAAY,EAAE,CAAC,KAAK,EAAE,WAAW,CAAC;oBACpF,CAAC,CAAC,qBAAqB;oBACvB,CAAC,CAAC,cAAc,EAClB,IAAI,CAAC,UAAU,CAChB,CACF,CAAC;gBACF,SAAS;YACX,CAAC;YACD,sEAAsE;YACtE,+DAA+D;YAC/D,qEAAqE;YACrE,+DAA+D;YAC/D,oEAAoE;YACpE,yCAAyC;YACzC,MAAM,GAAG,GAAG,WAAW,CAAC,UAAU,CAAC,MAAM,CAAC,IAAI,EAAE,IAAI,CAAC,UAAU,CAAC,CAAC;YACjE,IAAI,MAAM,CAAC,UAAU,CAAC,MAAM,CAAC,IAAI,EAAE,GAAG,CAAC,IAAI,YAAY,EAAE,CAAC,UAAU,CAAC,MAAM,CAAC,IAAI,EAAE,GAAG,CAAC,EAAE,CAAC;gBACvF,SAAS;YACX,CAAC;YACD,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,cAAc,EAAE,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC;YACxD,SAAS;QACX,CAAC;QAED,uCAAuC;QACvC,IAAI,IAAI,CAAC,YAAY,KAAK,IAAI,EAAE,CAAC;YAC/B,MAAM,GAAG,GAAG,UAAU,CAAC,IAAI,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC;YAC9C,IAAI,GAAG,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,YAAY,CAAC,EAAE,CAAC;gBAChD,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,gBAAgB,EAAE,YAAY,CAAC,CAAC,CAAC;YACzD,CAAC;QACH,CAAC;IACH,CAAC;IAED,OAAO,QAAQ,CAAC;AAClB,CAAC"}

package/dist/audit/collect.d.ts

@@ -1,4 +1,5 @@
 import { type Result } from "../frontmatter/types.js";
 import type { AuditConfig, AuditError, RepoSnapshot } from "./types.js";
+export declare function symlinkSafeExistsWithin(rootAbs: string, targetAbs: string): boolean;
 export declare function collectRepos(config: AuditConfig): Promise<Result<RepoSnapshot[], AuditError>>;
 //# sourceMappingURL=collect.d.ts.map

package/dist/audit/collect.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"collect.d.ts","sourceRoot":"","sources":["../../src/audit/collect.ts"],"names":[],"mappings":"AAWA,OAAO,EAAW,KAAK,MAAM,EAAE,MAAM,yBAAyB,CAAC;AAE/D,OAAO,KAAK,EAAE,WAAW,EAAE,UAAU,EAA2B,YAAY,EAAE,MAAM,YAAY,CAAC;AAqKjG,wBAAsB,YAAY,CAChC,MAAM,EAAE,WAAW,GAClB,OAAO,CAAC,MAAM,CAAC,YAAY,EAAE,EAAE,UAAU,CAAC,CAAC,CAa7C"}
+{"version":3,"file":"collect.d.ts","sourceRoot":"","sources":["../../src/audit/collect.ts"],"names":[],"mappings":"AAWA,OAAO,EAAW,KAAK,MAAM,EAAE,MAAM,yBAAyB,CAAC;AAE/D,OAAO,KAAK,EAAE,WAAW,EAAE,UAAU,EAA2B,YAAY,EAAE,MAAM,YAAY,CAAC;AAYjG,wBAAgB,uBAAuB,CAAC,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,OAAO,CASnF;AAoKD,wBAAsB,YAAY,CAChC,MAAM,EAAE,WAAW,GAClB,OAAO,CAAC,MAAM,CAAC,YAAY,EAAE,EAAE,UAAU,CAAC,CAAC,CAa7C"}