mdkg 0.4.1 → 0.5.0

package/dist/commands/archive.js

@@ -11,6 +11,8 @@ exports.runArchiveCompressCommand = runArchiveCompressCommand;
 const fs_1 = __importDefault(require("fs"));
 const path_1 = __importDefault(require("path"));
 const config_1 = require("../core/config");
+const filesystem_authority_1 = require("../core/filesystem_authority");
+const workspace_path_1 = require("../core/workspace_path");
 const frontmatter_1 = require("../graph/frontmatter");
 const archive_integrity_1 = require("../graph/archive_integrity");
 const indexer_1 = require("../graph/indexer");
@@ -21,7 +23,6 @@ const date_1 = require("../util/date");
 const errors_1 = require("../util/errors");
 const id_1 = require("../util/id");
 const refs_1 = require("../util/refs");
-const atomic_1 = require("../util/atomic");
 const lock_1 = require("../util/lock");
 const zip_1 = require("../util/zip");
 const event_support_1 = require("./event_support");
@@ -173,10 +174,10 @@ function walkArchiveSidecars(root) {
 function stringAttribute(value) {
     return typeof value === "string" && value.trim().length > 0 ? value : undefined;
 }
-function writeArchiveSidecar(sidecarPath, frontmatter, body) {
+function writeArchiveSidecar(root, sidecarPath, frontmatter, body) {
     const lines = (0, frontmatter_1.formatFrontmatter)(frontmatter);
     const content = ["---", ...lines, "---", body.trimStart()].join("\n");
-    (0, atomic_1.atomicWriteFile)(sidecarPath, content.endsWith("\n") ? content : `${content}\n`);
+    (0, filesystem_authority_1.atomicReplaceContainedFile)({ root, relativePath: toPosixPath(path_1.default.relative(root, sidecarPath)) }, content.endsWith("\n") ? content : `${content}\n`);
 }
 function verifyArchiveSidecar(root, ws, sidecarPath) {
     const relativePath = toPosixPath(path_1.default.relative(root, sidecarPath));
@@ -302,18 +303,28 @@ function runArchiveAddCommandLocked(options) {
     const visibility = (0, visibility_1.normalizeVisibility)(options.visibility);
     const today = (0, date_1.formatDate)(options.now ?? new Date());
     const archiveDir = path_1.default.resolve(options.root, workspace.path, workspace.mdkg_dir, "archive", id);
+    const archiveRelativeDir = (0, workspace_path_1.workspaceDocumentRelativePath)(workspace.path, workspace.mdkg_dir, "archive", id);
     const rawDir = path_1.default.join(archiveDir, "source");
     const rawPath = path_1.default.join(rawDir, basename);
     const zipPath = path_1.default.join(archiveDir, `${basename}.zip`);
     const sidecarPath = path_1.default.join(archiveDir, `${basename}.md`);
-    if (fs_1.default.existsSync(sidecarPath)) {
+    const sidecarRelativePath = `${archiveRelativeDir}/${basename}.md`;
+    const rawRelativePath = `${archiveRelativeDir}/source/${basename}`;
+    const zipRelativePath = `${archiveRelativeDir}/${basename}.zip`;
+    if ((0, filesystem_authority_1.containedPathExists)({ root: options.root, relativePath: sidecarRelativePath })) {
         throw new errors_1.UsageError(`archive sidecar already exists: ${path_1.default.relative(options.root, sidecarPath)}`);
     }
-    fs_1.default.mkdirSync(rawDir, { recursive: true });
-    fs_1.default.copyFileSync(sourcePath, rawPath);
-    const rawData = fs_1.default.readFileSync(rawPath);
+    for (const [relativePath, operation] of [
+        [rawRelativePath, "create"],
+        [zipRelativePath, "replace"],
+        [sidecarRelativePath, "create"],
+    ]) {
+        (0, filesystem_authority_1.withContainedPathSink)({ root: options.root, relativePath, operation, createParents: true }, () => undefined);
+    }
+    const rawData = fs_1.default.readFileSync(sourcePath);
+    (0, filesystem_authority_1.writeContainedFileExclusive)({ root: options.root, relativePath: rawRelativePath }, rawData);
     const zipData = (0, zip_1.createDeterministicZip)(basename, rawData);
-    (0, atomic_1.atomicWriteFile)(zipPath, zipData);
+    (0, filesystem_authority_1.atomicReplaceContainedFile)({ root: options.root, relativePath: zipRelativePath }, zipData);
     const frontmatter = {
         id,
         type: "archive",
@@ -339,7 +350,7 @@ function runArchiveAddCommandLocked(options) {
         created: today,
         updated: today,
     };
-    writeArchiveSidecar(sidecarPath, frontmatter, ["# Archive Entry", "", `Archived ${archiveKind}: ${basename}`, "", "# Provenance", "", "Copied from local workspace input."].join("\n"));
+    writeArchiveSidecar(options.root, sidecarPath, frontmatter, ["# Archive Entry", "", `Archived ${archiveKind}: ${basename}`, "", "# Provenance", "", "Copied from local workspace input."].join("\n"));
     maybeReindex(options.root);
     (0, event_support_1.appendAutomaticEvent)({
         root: options.root,
@@ -438,13 +449,19 @@ function runArchiveCompressCommandLocked(options) {
     const today = (0, date_1.formatDate)(options.now ?? new Date());
     for (const node of nodes) {
         const { sidecarPath, rawPath, zipPath } = archiveNodePaths(options.root, node);
-        if (!fs_1.default.existsSync(rawPath)) {
+        const rawRelativePath = toPosixPath(path_1.default.relative(options.root, rawPath));
+        const zipRelativePath = toPosixPath(path_1.default.relative(options.root, zipPath));
+        const sidecarRelativePath = toPosixPath(path_1.default.relative(options.root, sidecarPath));
+        for (const relativePath of [rawRelativePath, zipRelativePath, sidecarRelativePath]) {
+            (0, filesystem_authority_1.withContainedPathSink)({ root: options.root, relativePath, operation: relativePath === rawRelativePath ? "read" : "replace" }, () => undefined);
+        }
+        if (!(0, filesystem_authority_1.containedPathExists)({ root: options.root, relativePath: rawRelativePath })) {
             throw new errors_1.NotFoundError(`raw archive file missing for ${node.qid}: ${path_1.default.relative(options.root, rawPath)}`);
         }
-        const rawData = fs_1.default.readFileSync(rawPath);
+        const rawData = (0, filesystem_authority_1.readContainedFile)({ root: options.root, relativePath: rawRelativePath }, null);
         const zipData = (0, zip_1.createDeterministicZip)(path_1.default.basename(rawPath), rawData);
-        (0, atomic_1.atomicWriteFile)(zipPath, zipData);
-        const parsed = (0, frontmatter_1.parseFrontmatter)(fs_1.default.readFileSync(sidecarPath, "utf8"), sidecarPath);
+        (0, filesystem_authority_1.atomicReplaceContainedFile)({ root: options.root, relativePath: zipRelativePath }, zipData);
+        const parsed = (0, frontmatter_1.parseFrontmatter)((0, filesystem_authority_1.readContainedFile)({ root: options.root, relativePath: sidecarRelativePath }), sidecarPath);
         const nextFrontmatter = {
             ...parsed.frontmatter,
             byte_size: String(rawData.length),
@@ -453,7 +470,7 @@ function runArchiveCompressCommandLocked(options) {
             ingest_status: "compressed",
             updated: today,
         };
-        writeArchiveSidecar(sidecarPath, nextFrontmatter, parsed.body);
+        writeArchiveSidecar(options.root, sidecarPath, nextFrontmatter, parsed.body);
         updated.push({
             workspace: node.ws,
             id: node.id,

package/dist/commands/bundle.js

@@ -3,6 +3,8 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
     return (mod && mod.__esModule) ? mod : { "default": mod };
 };
 Object.defineProperty(exports, "__esModule", { value: true });
+exports.validateBundleManifest = validateBundleManifest;
+exports.bundlePayloadErrors = bundlePayloadErrors;
 exports.sha256Buffer = sha256Buffer;
 exports.buildBundle = buildBundle;
 exports.parseBundle = parseBundle;
@@ -16,6 +18,8 @@ const fs_1 = __importDefault(require("fs"));
 const path_1 = __importDefault(require("path"));
 const child_process_1 = require("child_process");
 const config_1 = require("../core/config");
+const filesystem_authority_1 = require("../core/filesystem_authority");
+const atomic_1 = require("../util/atomic");
 const capabilities_indexer_1 = require("../graph/capabilities_indexer");
 const subgraphs_1 = require("../graph/subgraphs");
 const indexer_1 = require("../graph/indexer");
@@ -31,6 +35,168 @@ const INDEX_ENTRY_PATHS = {
     skills: ".mdkg/index/skills.json",
     capabilities: ".mdkg/index/capabilities.json",
 };
+const REQUIRED_INDEX_PATHS = Object.values(INDEX_ENTRY_PATHS);
+const SHA256_PATTERN = /^sha256:[a-f0-9]{64}$/;
+function isRecord(value) {
+    return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function manifestError(message) {
+    throw new errors_1.ValidationError(`bundle manifest invalid: ${message}`);
+}
+function manifestString(value, field) {
+    if (typeof value !== "string" || value.length === 0) {
+        manifestError(`${field} must be a non-empty string`);
+    }
+    return value;
+}
+function manifestHash(value, field) {
+    const hash = manifestString(value, field);
+    if (!SHA256_PATTERN.test(hash)) {
+        manifestError(`${field} must be a sha256 digest`);
+    }
+    return hash;
+}
+function safeManifestPath(value, field) {
+    const candidate = manifestString(value, field).replace(/\\/g, "/");
+    const parts = candidate.split("/");
+    if (path_1.default.posix.isAbsolute(candidate) || parts.some((part) => part === "" || part === "." || part === "..")) {
+        manifestError(`${field} must be a safe relative path`);
+    }
+    return candidate;
+}
+function validateBundleManifest(value) {
+    if (!isRecord(value))
+        manifestError("root must be an object");
+    if (value.manifest_version !== 1)
+        manifestError("manifest_version must be 1");
+    if (value.tool !== "mdkg")
+        manifestError("tool must be mdkg");
+    const mdkgVersion = manifestString(value.mdkg_version, "mdkg_version");
+    if (value.profile !== "private" && value.profile !== "public") {
+        manifestError("profile must be private or public");
+    }
+    if (!Array.isArray(value.selected_workspaces) || value.selected_workspaces.length === 0) {
+        manifestError("selected_workspaces must be a non-empty string array");
+    }
+    const selectedWorkspaces = value.selected_workspaces.map((item, index) => manifestString(item, `selected_workspaces[${index}]`));
+    if (new Set(selectedWorkspaces).size !== selectedWorkspaces.length) {
+        manifestError("selected_workspaces must not contain duplicates");
+    }
+    if (!isRecord(value.source))
+        manifestError("source must be an object");
+    const repo = manifestString(value.source.repo, "source.repo");
+    const gitHead = value.source.git_head;
+    if (gitHead !== null && (typeof gitHead !== "string" || !/^[a-f0-9]{40}$/.test(gitHead))) {
+        manifestError("source.git_head must be null or a 40-character lowercase Git SHA");
+    }
+    if (typeof value.source.dirty !== "boolean")
+        manifestError("source.dirty must be boolean");
+    const sourceTreeHash = manifestHash(value.source_tree_hash, "source_tree_hash");
+    const bundleHash = manifestHash(value.bundle_hash, "bundle_hash");
+    if (!Number.isSafeInteger(value.file_count) || Number(value.file_count) < 0) {
+        manifestError("file_count must be a non-negative safe integer");
+    }
+    if (!isRecord(value.index_hashes))
+        manifestError("index_hashes must be an object");
+    const indexHashes = {};
+    for (const [rawPath, rawHash] of Object.entries(value.index_hashes)) {
+        const indexPath = safeManifestPath(rawPath, "index_hashes key");
+        indexHashes[indexPath] = manifestHash(rawHash, `index_hashes.${indexPath}`);
+    }
+    for (const requiredPath of REQUIRED_INDEX_PATHS) {
+        if (!indexHashes[requiredPath])
+            manifestError(`index_hashes missing required index ${requiredPath}`);
+    }
+    if (!Array.isArray(value.files))
+        manifestError("files must be an array");
+    const seenPaths = new Set();
+    const files = value.files.map((rawFile, index) => {
+        if (!isRecord(rawFile))
+            manifestError(`files[${index}] must be an object`);
+        const filePath = safeManifestPath(rawFile.path, `files[${index}].path`);
+        if (seenPaths.has(filePath))
+            manifestError(`duplicate file path: ${filePath}`);
+        seenPaths.add(filePath);
+        if (rawFile.kind !== "authored" && rawFile.kind !== "archive_cache" && rawFile.kind !== "generated_index") {
+            manifestError(`files[${index}].kind is invalid`);
+        }
+        if (!Number.isSafeInteger(rawFile.size) || Number(rawFile.size) < 0) {
+            manifestError(`files[${index}].size must be a non-negative safe integer`);
+        }
+        const workspace = rawFile.workspace === undefined
+            ? undefined
+            : manifestString(rawFile.workspace, `files[${index}].workspace`);
+        const visibility = rawFile.visibility;
+        if (visibility !== undefined && visibility !== "private" && visibility !== "internal" && visibility !== "public") {
+            manifestError(`files[${index}].visibility is invalid`);
+        }
+        return {
+            path: filePath,
+            kind: rawFile.kind,
+            ...(workspace ? { workspace } : {}),
+            ...(visibility ? { visibility } : {}),
+            size: Number(rawFile.size),
+            sha256: manifestHash(rawFile.sha256, `files[${index}].sha256`),
+        };
+    });
+    if (Number(value.file_count) !== files.length)
+        manifestError("file_count does not match files length");
+    for (const requiredPath of REQUIRED_INDEX_PATHS) {
+        const row = files.find((file) => file.path === requiredPath);
+        if (!row || row.kind !== "generated_index") {
+            manifestError(`files missing required generated index ${requiredPath}`);
+        }
+        if (row.sha256 !== indexHashes[requiredPath]) {
+            manifestError(`index hash does not match file row for ${requiredPath}`);
+        }
+    }
+    return {
+        manifest_version: 1,
+        tool: "mdkg",
+        mdkg_version: mdkgVersion,
+        profile: value.profile,
+        selected_workspaces: selectedWorkspaces,
+        source: { repo, git_head: gitHead, dirty: value.source.dirty },
+        source_tree_hash: sourceTreeHash,
+        bundle_hash: bundleHash,
+        file_count: files.length,
+        index_hashes: indexHashes,
+        files,
+    };
+}
+function bundlePayloadErrors(entries, manifest) {
+    const errors = [];
+    const manifestPaths = new Set(manifest.files.map((file) => file.path));
+    for (const entryPath of entries.keys()) {
+        if (entryPath !== MANIFEST_ENTRY && !manifestPaths.has(entryPath))
+            errors.push(`unexpected bundle entry: ${entryPath}`);
+    }
+    for (const file of manifest.files) {
+        const data = entries.get(file.path);
+        if (!data) {
+            errors.push(`missing bundle entry: ${file.path}`);
+            continue;
+        }
+        if (sha256Buffer(data) !== file.sha256)
+            errors.push(`hash mismatch for ${file.path}`);
+        if (data.length !== file.size)
+            errors.push(`size mismatch for ${file.path}`);
+    }
+    for (const requiredPath of REQUIRED_INDEX_PATHS) {
+        const data = entries.get(requiredPath);
+        if (!data)
+            continue;
+        if (sha256Buffer(data) !== manifest.index_hashes[requiredPath]) {
+            errors.push(`generated index hash mismatch: ${requiredPath}`);
+        }
+    }
+    if (hashManifestFiles(manifest.files.filter((file) => file.kind !== "generated_index")) !== manifest.source_tree_hash) {
+        errors.push("source_tree_hash mismatch");
+    }
+    if (hashManifestFiles(manifest.files) !== manifest.bundle_hash)
+        errors.push("bundle_hash mismatch");
+    return Array.from(new Set(errors));
+}
 function toPosixPath(value) {
     return value.split(path_1.default.sep).join("/");
 }
@@ -519,9 +685,8 @@ function buildBundle(options) {
     };
 }
 function parseBundle(bundlePath) {
-    const zip = fs_1.default.readFileSync(bundlePath);
     const entries = new Map();
-    for (const entry of (0, zip_1.readZipEntries)(zip)) {
+    for (const entry of (0, zip_1.readZipFileEntries)(bundlePath)) {
         entries.set(entry.name, entry.data);
     }
     const manifestData = entries.get(MANIFEST_ENTRY);
@@ -529,10 +694,7 @@ function parseBundle(bundlePath) {
         throw new errors_1.ValidationError("bundle manifest missing");
     }
     try {
-        return {
-            entries,
-            manifest: JSON.parse(manifestData.toString("utf8")),
-        };
+        return { entries, manifest: validateBundleManifest(JSON.parse(manifestData.toString("utf8"))) };
     }
     catch (err) {
         const message = err instanceof Error ? err.message : String(err);
@@ -562,25 +724,8 @@ function verifyBundle(root, bundlePath) {
             stale_paths: [],
         };
     }
-    const manifestPaths = new Set(manifest.files.map((file) => file.path));
-    for (const entryPath of entries.keys()) {
-        if (entryPath !== MANIFEST_ENTRY && !manifestPaths.has(entryPath)) {
-            errors.push(`unexpected bundle entry: ${entryPath}`);
-        }
-    }
+    errors.push(...bundlePayloadErrors(entries, manifest));
     for (const file of manifest.files) {
-        const data = entries.get(file.path);
-        if (!data) {
-            errors.push(`missing bundle entry: ${file.path}`);
-            continue;
-        }
-        const hash = sha256Buffer(data);
-        if (hash !== file.sha256) {
-            errors.push(`hash mismatch for ${file.path}`);
-        }
-        if (data.length !== file.size) {
-            errors.push(`size mismatch for ${file.path}`);
-        }
         if (file.kind !== "generated_index") {
             const sourcePath = path_1.default.resolve(root, file.path);
             if (!fs_1.default.existsSync(sourcePath)) {
@@ -592,24 +737,6 @@ function verifyBundle(root, bundlePath) {
             }
         }
     }
-    for (const [indexPath, expectedHash] of Object.entries(manifest.index_hashes)) {
-        const data = entries.get(indexPath);
-        if (!data) {
-            errors.push(`missing generated index: ${indexPath}`);
-            continue;
-        }
-        if (sha256Buffer(data) !== expectedHash) {
-            errors.push(`generated index hash mismatch: ${indexPath}`);
-        }
-    }
-    const computedSourceHash = hashManifestFiles(manifest.files.filter((file) => file.kind !== "generated_index"));
-    if (computedSourceHash !== manifest.source_tree_hash) {
-        errors.push("source_tree_hash mismatch");
-    }
-    const computedBundleHash = hashManifestFiles(manifest.files);
-    if (computedBundleHash !== manifest.bundle_hash) {
-        errors.push("bundle_hash mismatch");
-    }
     const currentHead = gitOutput(root, ["rev-parse", "HEAD"]);
     if (manifest.source.git_head && currentHead && manifest.source.git_head !== currentHead) {
         stalePaths.push("git:HEAD");
@@ -645,8 +772,17 @@ function bundleSummary(manifest, bundlePath, zipSha256) {
 }
 function runBundleCreateCommand(options) {
     const result = buildBundle(options);
-    fs_1.default.mkdirSync(path_1.default.dirname(result.outputPath), { recursive: true });
-    fs_1.default.writeFileSync(result.outputPath, result.zip);
+    if (options.output && path_1.default.isAbsolute(options.output)) {
+        const external = (0, filesystem_authority_1.authorizeOperatorSelectedExternalPath)({
+            operation: "replace",
+            path: options.output,
+            operatorSelected: true,
+        });
+        (0, atomic_1.atomicWriteFile)(external.absolutePath, result.zip);
+    }
+    else {
+        (0, filesystem_authority_1.atomicReplaceContainedFile)({ root: options.root, relativePath: path_1.default.relative(options.root, result.outputPath).split(path_1.default.sep).join("/") }, result.zip);
+    }
     const receipt = {
         action: "created",
         ...bundleSummary(result.manifest, path_1.default.relative(options.root, result.outputPath), result.zipSha256),

package/dist/commands/capability.js

@@ -39,6 +39,7 @@ function loadCapabilityRecords(options) {
         config,
         useCache: !options.noCache,
         allowReindex: !options.noReindex,
+        persistReindex: false,
     });
     if (stale && !rebuilt && !options.noCache) {
         console.error("warning: capabilities index is stale; run mdkg index to refresh");

package/dist/commands/checkpoint.js

@@ -6,15 +6,15 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.CHECKPOINT_KINDS = void 0;
 exports.createCheckpoint = createCheckpoint;
 exports.runCheckpointNewCommand = runCheckpointNewCommand;
-const fs_1 = __importDefault(require("fs"));
 const path_1 = __importDefault(require("path"));
 const config_1 = require("../core/config");
+const filesystem_authority_1 = require("../core/filesystem_authority");
+const workspace_path_1 = require("../core/workspace_path");
 const index_cache_1 = require("../graph/index_cache");
 const loader_1 = require("../templates/loader");
 const date_1 = require("../util/date");
 const errors_1 = require("../util/errors");
 const id_1 = require("../util/id");
-const atomic_1 = require("../util/atomic");
 const lock_1 = require("../util/lock");
 const sqlite_index_1 = require("../graph/sqlite_index");
 const event_support_1 = require("./event_support");
@@ -253,7 +253,8 @@ function createCheckpointLocked(options) {
     const wsEntry = config.workspaces[ws];
     const workDir = path_1.default.resolve(options.root, wsEntry.path, wsEntry.mdkg_dir, "work");
     const filePath = path_1.default.join(workDir, fileName);
-    if (fs_1.default.existsSync(filePath)) {
+    const relativeFilePath = (0, workspace_path_1.workspaceDocumentRelativePath)(wsEntry.path, wsEntry.mdkg_dir, "work", fileName);
+    if ((0, filesystem_authority_1.containedPathExists)({ root: options.root, relativePath: relativeFilePath })) {
         throw new errors_1.UsageError(`checkpoint file already exists: ${path_1.default.relative(options.root, filePath)}`);
     }
     const relates = parseCsvList(options.relates).map((value) => normalizeIdRef(value, "--relates"));
@@ -279,9 +280,9 @@ function createCheckpointLocked(options) {
         relates,
         scope,
     });
-    const rendered = replaceRenderedBody(content, checkpointBody(kind));
+    const rendered = replaceRenderedBody(content, options.body ?? checkpointBody(kind));
     try {
-        (0, atomic_1.writeFileExclusive)(filePath, rendered);
+        (0, filesystem_authority_1.writeContainedFileExclusive)({ root: options.root, relativePath: relativeFilePath }, rendered);
     }
     catch (err) {
         const code = typeof err === "object" && err !== null && "code" in err ? String(err.code) : "";

package/dist/commands/event_support.js

@@ -12,9 +12,10 @@ exports.normalizeEventRefList = normalizeEventRefList;
 exports.normalizeEventStringList = normalizeEventStringList;
 exports.appendEvent = appendEvent;
 exports.appendAutomaticEvent = appendAutomaticEvent;
-const fs_1 = __importDefault(require("fs"));
 const path_1 = __importDefault(require("path"));
 const config_1 = require("../core/config");
+const filesystem_authority_1 = require("../core/filesystem_authority");
+const workspace_path_1 = require("../core/workspace_path");
 const errors_1 = require("../util/errors");
 function normalizeWorkspaceForEvents(config, raw) {
     const normalized = (raw ?? "root").toLowerCase();
@@ -33,6 +34,13 @@ function resolveEventsPath(root, config, ws = "root") {
     }
     return path_1.default.resolve(root, entry.path, entry.mdkg_dir, "work", "events", "events.jsonl");
 }
+function resolveEventsRelativePath(config, ws) {
+    const entry = config.workspaces[ws];
+    if (!entry) {
+        throw new errors_1.NotFoundError(`workspace not found: ${ws}`);
+    }
+    return (0, workspace_path_1.workspaceDocumentRelativePath)(entry.path, entry.mdkg_dir, "work", "events", "events.jsonl");
+}
 function formatRunIdTimestamp(now) {
     const iso = now.toISOString().replace(/[-:]/g, "").replace(/\./g, "").replace("Z", "Z");
     return iso;
@@ -43,16 +51,16 @@ function createLocalRunId(kind, now = new Date()) {
 }
 function isEventLoggingEnabled(root, config, ws) {
     const normalizedWs = normalizeWorkspaceForEvents(config, ws);
-    return fs_1.default.existsSync(resolveEventsPath(root, config, normalizedWs));
+    return (0, filesystem_authority_1.containedPathExists)({ root, relativePath: resolveEventsRelativePath(config, normalizedWs) });
 }
 function ensureEventsEnabled(options) {
     const config = (0, config_1.loadConfig)(options.root);
     const ws = normalizeWorkspaceForEvents(config, options.ws);
     const eventsPath = resolveEventsPath(options.root, config, ws);
+    const relativePath = resolveEventsRelativePath(config, ws);
     let created = false;
-    if (!fs_1.default.existsSync(eventsPath)) {
-        fs_1.default.mkdirSync(path_1.default.dirname(eventsPath), { recursive: true });
-        fs_1.default.writeFileSync(eventsPath, "", "utf8");
+    if (!(0, filesystem_authority_1.containedPathExists)({ root: options.root, relativePath })) {
+        (0, filesystem_authority_1.writeContainedFileExclusive)({ root: options.root, relativePath }, "");
         created = true;
     }
     return { ws, eventsPath, created };
@@ -102,10 +110,11 @@ function appendEvent(options) {
         throw new errors_1.UsageError("--refs requires at least one id or qid");
     }
     const eventsPath = resolveEventsPath(options.root, config, record.workspace);
-    if (!fs_1.default.existsSync(eventsPath)) {
+    const relativePath = resolveEventsRelativePath(config, record.workspace);
+    if (!(0, filesystem_authority_1.containedPathExists)({ root: options.root, relativePath })) {
         throw new errors_1.NotFoundError(`events.jsonl is missing for workspace ${record.workspace}; run \`mdkg event enable --ws ${record.workspace}\``);
     }
-    fs_1.default.appendFileSync(eventsPath, `${JSON.stringify(record)}\n`, "utf8");
+    (0, filesystem_authority_1.appendContainedFile)({ root: options.root, relativePath }, `${JSON.stringify(record)}\n`);
     return record;
 }
 function appendAutomaticEvent(options) {

package/dist/commands/fix.js

@@ -13,6 +13,7 @@ const child_process_1 = require("child_process");
 const fs_1 = __importDefault(require("fs"));
 const path_1 = __importDefault(require("path"));
 const config_1 = require("../core/config");
+const filesystem_authority_1 = require("../core/filesystem_authority");
 const capabilities_indexer_1 = require("../graph/capabilities_indexer");
 const capabilities_index_cache_1 = require("../graph/capabilities_index_cache");
 const staleness_1 = require("../graph/staleness");
@@ -26,7 +27,6 @@ const template_schema_1 = require("../graph/template_schema");
 const workspace_files_1 = require("../graph/workspace_files");
 const errors_1 = require("../util/errors");
 const refs_1 = require("../util/refs");
-const atomic_1 = require("../util/atomic");
 const lock_1 = require("../util/lock");
 const index_1 = require("./index");
 const FAMILY_VALUES = new Set(["index", "refs", "ids", "all"]);
@@ -1211,12 +1211,12 @@ function applyDuplicateIdChange(root, change) {
     if (!fromId || !toId) {
         throw new errors_1.UsageError(`fix apply change ${change.id} is missing duplicate id rewrite details`);
     }
-    const current = fs_1.default.readFileSync(absPath, "utf8");
+    const current = (0, filesystem_authority_1.readContainedFile)({ root, relativePath });
     const rewritten = rewriteIdInNodeContent(current, fromId, toId);
     if (rewritten === current) {
         throw new errors_1.UsageError(`fix apply change ${change.id} produced no file changes`);
     }
-    (0, atomic_1.atomicWriteFile)(absPath, rewritten);
+    (0, filesystem_authority_1.atomicReplaceContainedFile)({ root, relativePath }, rewritten);
     const afterDetails = change.after;
     const safeReferenceRewrites = Array.isArray(afterDetails.safe_reference_rewrites)
         ? afterDetails.safe_reference_rewrites
@@ -1227,13 +1227,13 @@ function applyDuplicateIdChange(root, change) {
             continue;
         }
         const rewriteAbs = path_1.default.resolve(root, rewrite.path);
-        if (!isInsideRoot(root, rewriteAbs) || !fs_1.default.existsSync(rewriteAbs)) {
+        if (!isInsideRoot(root, rewriteAbs) || !(0, filesystem_authority_1.containedPathExists)({ root, relativePath: rewrite.path })) {
             continue;
         }
-        const rewriteCurrent = fs_1.default.readFileSync(rewriteAbs, "utf8");
+        const rewriteCurrent = (0, filesystem_authority_1.readContainedFile)({ root, relativePath: rewrite.path });
         const rewriteNext = rewriteCurrent.split(rewrite.from).join(rewrite.to);
         if (rewriteNext !== rewriteCurrent) {
-            (0, atomic_1.atomicWriteFile)(rewriteAbs, rewriteNext);
+            (0, filesystem_authority_1.atomicReplaceContainedFile)({ root, relativePath: rewrite.path }, rewriteNext);
             touchedPaths.add(rewrite.path);
         }
     }
@@ -1273,8 +1273,11 @@ function applyGitStageDuplicateIdChange(root, change) {
         throw new errors_1.UsageError(`fix apply refused path outside repo while resolving ${conflictPath}`);
     }
     const rewrittenDuplicate = rewriteIdInNodeContent(duplicateContent, fromId, candidateId);
-    (0, atomic_1.atomicWriteFile)(canonicalAbs, canonicalContent);
-    (0, atomic_1.atomicWriteFile)(candidateAbs, rewrittenDuplicate);
+    for (const relativePath of [conflictPath, candidatePath]) {
+        (0, filesystem_authority_1.withContainedPathSink)({ root, relativePath, operation: "replace", createParents: true }, () => undefined);
+    }
+    (0, filesystem_authority_1.atomicReplaceContainedFile)({ root, relativePath: conflictPath }, canonicalContent);
+    (0, filesystem_authority_1.atomicReplaceContainedFile)({ root, relativePath: candidatePath }, rewrittenDuplicate);
     runGitStrict(root, ["add", "--", conflictPath, candidatePath]);
     return {
         id: change.id,