mdkg 0.4.2 → 0.5.0

package/dist/pack/pack.js

@@ -7,6 +7,17 @@ const qid_1 = require("../util/qid");
 const order_1 = require("./order");
 const verbose_core_1 = require("./verbose_core");
 const EDGE_KEYS = ["parent", "epic", "relates", "blocked_by", "blocks", "prev", "next", "context_refs", "evidence_refs"];
+const LOOP_REF_FIELDS = [
+    "scope_refs",
+    "child_refs",
+    "lane_waiver_refs",
+    "run_refs",
+    "decision_refs",
+    "output_refs",
+    "approval_refs",
+    "evaluation_refs",
+];
+const LOOP_REVERSE_CHILD_EDGES = ["parent", "epic", "relates"];
 function normalizeEdgeList(edges) {
     const seen = new Set();
     const result = [];
@@ -71,7 +82,7 @@ function getNeighbors(index, qid, edges) {
     }
     return neighbors;
 }
-function collectNodes(index, rootQid, depth, edges) {
+function collectNodes(index, rootQid, depth, edges, maxNodes) {
     const selectedEdges = normalizeEdgeList(edges);
     const visited = new Set();
     const depths = new Map();
@@ -95,6 +106,9 @@ function collectNodes(index, rootQid, depth, edges) {
             if (visited.has(neighbor)) {
                 continue;
             }
+            if (visited.size >= maxNodes) {
+                throw new Error(`pack graph traversal exceeds node limit: ${maxNodes}`);
+            }
             visited.add(neighbor);
             depths.set(neighbor, current.depth + 1);
             queue.push({ qid: neighbor, depth: current.depth + 1 });
@@ -102,7 +116,121 @@ function collectNodes(index, rootQid, depth, edges) {
     }
     return { qids: visited, depths };
 }
-function buildPackNode(root, index, qid) {
+function toStringList(value) {
+    if (!Array.isArray(value)) {
+        return [];
+    }
+    return value.filter((item) => typeof item === "string");
+}
+function isUriRef(value) {
+    return value.includes("://");
+}
+function resolveLoopGraphRef(index, loopQid, field, ref, wsHint, warnings) {
+    if (isUriRef(ref)) {
+        return undefined;
+    }
+    const resolved = (0, qid_1.resolveQid)(index, ref, wsHint);
+    if (resolved.status === "ok") {
+        return resolved.qid;
+    }
+    if (resolved.status === "ambiguous") {
+        mergeWarnings(warnings, `loop scope ref ambiguous: ${loopQid} ${field} ${ref} (${resolved.candidates.join(", ")})`);
+        return undefined;
+    }
+    mergeWarnings(warnings, `loop scope ref missing: ${loopQid} ${field} ${ref}`);
+    return undefined;
+}
+function addLoopPackClosure(index, rootLoopQid, qids, depths, warnings, maxNodes) {
+    const visited = new Set();
+    const queued = new Set();
+    const queue = [];
+    function enqueue(qid, depth) {
+        if (queued.has(qid)) {
+            return;
+        }
+        if (queued.size >= maxNodes) {
+            throw new Error(`loop pack closure exceeds node limit: ${maxNodes}`);
+        }
+        queued.add(qid);
+        queue.push({ qid, depth });
+    }
+    function addDeclaredLoopRefs(loopQid, depth) {
+        const loop = index.nodes[loopQid];
+        if (!loop) {
+            return;
+        }
+        for (const field of LOOP_REF_FIELDS) {
+            for (const ref of toStringList(loop.attributes[field])) {
+                const resolved = resolveLoopGraphRef(index, loop.qid, field, ref, loop.ws, warnings);
+                if (resolved) {
+                    enqueue(resolved, depth);
+                }
+            }
+        }
+    }
+    function addReverseChildren(qid, depth) {
+        for (const edge of LOOP_REVERSE_CHILD_EDGES) {
+            for (const childQid of index.reverse_edges[edge]?.[qid] ?? []) {
+                enqueue(childQid, depth);
+            }
+        }
+    }
+    function addSemanticEdges(loopQid, depth) {
+        const loop = index.nodes[loopQid];
+        if (!loop) {
+            return;
+        }
+        for (const field of ["context_refs", "evidence_refs"]) {
+            for (const ref of loop.edges[field] ?? []) {
+                if (index.nodes[ref]) {
+                    enqueue(ref, depth);
+                }
+                else if (!isUriRef(ref)) {
+                    mergeWarnings(warnings, `loop scope ref missing: ${loop.qid} ${field} ${ref}`);
+                }
+            }
+        }
+    }
+    addDeclaredLoopRefs(rootLoopQid, 1);
+    addSemanticEdges(rootLoopQid, 1);
+    addReverseChildren(rootLoopQid, 1);
+    while (queue.length > 0) {
+        const current = queue.shift();
+        if (!current || visited.has(current.qid)) {
+            continue;
+        }
+        visited.add(current.qid);
+        const node = index.nodes[current.qid];
+        if (!node) {
+            continue;
+        }
+        qids.add(current.qid);
+        if (!depths.has(current.qid)) {
+            depths.set(current.qid, current.depth);
+        }
+        if (node.type === "goal") {
+            const scoped = (0, goal_scope_1.collectGoalScope)(index, node, { maxNodes });
+            for (const scopedQid of scoped.qids) {
+                enqueue(scopedQid, current.depth + 1);
+            }
+            for (const missing of scoped.missingRefs) {
+                mergeWarnings(warnings, `loop goal scope ref missing: ${node.qid} ${missing}`);
+            }
+            for (const invalid of scoped.invalidRefs) {
+                mergeWarnings(warnings, `loop goal scope ref unsupported: ${node.qid} ${invalid}`);
+            }
+        }
+        if (node.type === "loop") {
+            addDeclaredLoopRefs(node.qid, current.depth + 1);
+            addSemanticEdges(node.qid, current.depth + 1);
+            addReverseChildren(node.qid, current.depth + 1);
+        }
+        if (node.type === "epic" || node.type === "feat") {
+            addReverseChildren(node.qid, current.depth + 1);
+        }
+    }
+}
+function buildPackNode(index, qid, readBody) {
     const node = index.nodes[qid];
     if (!node) {
         throw new Error(`node not found: ${qid}`);
@@ -124,7 +252,7 @@ function buildPackNode(root, index, qid) {
         aliases: node.aliases,
         attributes: node.attributes ?? {},
         ...(node.source ? { source: node.source } : {}),
-        body: (0, node_body_1.readNodeBody)(root, node),
+        body: readBody(node),
     };
 }
 function mergeWarnings(warnings, message) {
@@ -160,11 +288,12 @@ function applyMaxNodes(orderedQids, maxNodes, truncation) {
 }
 function buildPack(options) {
     const warnings = [];
+    const maxTraversalNodes = options.maxTraversalNodes ?? Math.max(1000, options.maxNodes * 10);
     const includeLatestCheckpoint = options.includeLatestCheckpoint ?? true;
-    const { qids, depths } = collectNodes(options.index, options.rootQid, options.depth, options.edges);
+    const { qids, depths } = collectNodes(options.index, options.rootQid, options.depth, options.edges, maxTraversalNodes);
     const rootNode = options.index.nodes[options.rootQid];
     if (rootNode?.type === "goal") {
-        const scoped = (0, goal_scope_1.collectGoalScope)(options.index, rootNode);
+        const scoped = (0, goal_scope_1.collectGoalScope)(options.index, rootNode, { maxNodes: maxTraversalNodes });
         for (const qid of scoped.qids) {
             qids.add(qid);
             if (!depths.has(qid)) {
@@ -178,6 +307,9 @@ function buildPack(options) {
             mergeWarnings(warnings, `goal scope ref unsupported: ${invalid}`);
         }
     }
+    if (rootNode?.type === "loop") {
+        addLoopPackClosure(options.index, rootNode.qid, qids, depths, warnings, maxTraversalNodes);
+    }
     const workspace = checkpointWorkspaceFromQid(options.rootQid);
     const latestCheckpointHint = options.index.meta.latest_checkpoint_qid?.[workspace];
     const latestCheckpointResolved = includeLatestCheckpoint
@@ -214,7 +346,8 @@ function buildPack(options) {
         dropped: [],
     };
     const { included } = applyMaxNodes(ordered, options.maxNodes, truncation);
-    const nodes = included.map((qid) => buildPackNode(options.root, options.index, qid));
+    const readBody = (0, node_body_1.createNodeBodyReader)(options.root, options.maxBodyBytes);
+    const nodes = included.map((qid) => buildPackNode(options.index, qid, readBody));
     const pack = {
         meta: {
             root: options.rootQid,

package/dist/templates/loader.js

@@ -6,17 +6,23 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.loadTemplate = loadTemplate;
 exports.renderTemplate = renderTemplate;
 const fs_1 = __importDefault(require("fs"));
+const path_1 = __importDefault(require("path"));
+const filesystem_authority_1 = require("../core/filesystem_authority");
 const frontmatter_1 = require("../graph/frontmatter");
 const errors_1 = require("../util/errors");
 const builtin_1 = require("./builtin");
 function loadTemplate(root, config, type, templateSet) {
     const templatePath = (0, builtin_1.resolveLocalTemplatePath)(root, config, type, templateSet);
-    if (!fs_1.default.existsSync(templatePath) && templateSet !== undefined) {
+    const templateRelativePath = path_1.default.relative(root, templatePath).split(path_1.default.sep).join("/");
+    const localExists = (0, filesystem_authority_1.containedPathExists)({ root, relativePath: templateRelativePath });
+    if (!localExists && templateSet !== undefined) {
         throw new errors_1.NotFoundError(`template not found: ${templateSet.toLowerCase()}/${(0, builtin_1.templateNameForType)(type)}.md`);
     }
-    const source = fs_1.default.existsSync(templatePath) ? "local" : "bundled";
+    const source = localExists ? "local" : "bundled";
     const resolvedPath = source === "local" ? templatePath : (0, builtin_1.requireBundledTemplatePath)(type);
-    const content = fs_1.default.readFileSync(resolvedPath, "utf8");
+    const content = source === "local"
+        ? (0, filesystem_authority_1.readContainedFile)({ root, relativePath: templateRelativePath })
+        : fs_1.default.readFileSync(resolvedPath, "utf8");
     const { frontmatter, body } = (0, frontmatter_1.parseFrontmatter)(content, resolvedPath);
     return { templatePath: resolvedPath, source, frontmatter, body };
 }

package/dist/util/lock.js

@@ -7,6 +7,7 @@ exports.withMutationLock = withMutationLock;
 exports.lockTimeoutFromConfig = lockTimeoutFromConfig;
 const fs_1 = __importDefault(require("fs"));
 const path_1 = __importDefault(require("path"));
+const filesystem_authority_1 = require("../core/filesystem_authority");
 const HELD_LOCKS = new Set();
 function sleepSync(ms) {
     const shared = new SharedArrayBuffer(4);
@@ -28,15 +29,15 @@ function withMutationLock(root, timeoutMs, fn) {
     if (HELD_LOCKS.has(dir)) {
         return fn();
     }
-    fs_1.default.mkdirSync(path_1.default.dirname(dir), { recursive: true });
+    (0, filesystem_authority_1.ensureContainedDirectory)({ root, relativePath: ".mdkg/index" });
     const started = Date.now();
     let lastError;
     while (Date.now() - started <= timeoutMs) {
         try {
-            fs_1.default.mkdirSync(dir);
+            (0, filesystem_authority_1.withContainedPathSink)({ root, relativePath: ".mdkg/index/write.lock", operation: "create" }, ({ absolutePath }) => fs_1.default.mkdirSync(absolutePath));
             let acquired = false;
             try {
-                fs_1.default.writeFileSync(path_1.default.join(dir, "owner.json"), lockOwner(), "utf8");
+                (0, filesystem_authority_1.writeContainedFileExclusive)({ root, relativePath: ".mdkg/index/write.lock/owner.json" }, lockOwner());
                 HELD_LOCKS.add(dir);
                 acquired = true;
                 try {
@@ -44,28 +45,28 @@ function withMutationLock(root, timeoutMs, fn) {
                 }
                 finally {
                     HELD_LOCKS.delete(dir);
-                    fs_1.default.rmSync(dir, { recursive: true, force: true });
+                    (0, filesystem_authority_1.removeContainedPath)({ root, relativePath: ".mdkg/index/write.lock", recursive: true, force: true });
                 }
             }
             catch (err) {
                 if (!acquired) {
-                    fs_1.default.rmSync(dir, { recursive: true, force: true });
+                    (0, filesystem_authority_1.removeContainedPath)({ root, relativePath: ".mdkg/index/write.lock", recursive: true, force: true });
                 }
                 throw err;
             }
         }
         catch (err) {
             const code = typeof err === "object" && err !== null && "code" in err ? String(err.code) : "";
-            if (code !== "EEXIST") {
+            // A competing writer can release the lock between authority inspection
+            // and realpath resolution. Treat that transient ENOENT like contention.
+            if (code !== "EEXIST" && code !== "ENOENT") {
                 throw err;
             }
             lastError = err;
             sleepSync(25);
         }
     }
-    const detailPath = path_1.default.join(dir, "owner.json");
-    const owner = fs_1.default.existsSync(detailPath) ? fs_1.default.readFileSync(detailPath, "utf8").trim() : "unknown owner";
-    throw new Error(`timed out waiting for mdkg mutation lock at ${path_1.default.relative(root, dir)}; owner: ${owner || "unknown"}`);
+    throw new Error(`timed out waiting for mdkg mutation lock at ${path_1.default.relative(root, dir)}; owner details withheld`);
 }
 function lockTimeoutFromConfig(config) {
     return config.index.lock_timeout_ms;

package/dist/util/zip.js

@@ -3,10 +3,14 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
     return (mod && mod.__esModule) ? mod : { "default": mod };
 };
 Object.defineProperty(exports, "__esModule", { value: true });
+exports.DEFAULT_ZIP_READ_LIMITS = void 0;
 exports.createDeterministicZip = createDeterministicZip;
 exports.createDeterministicZipFromEntries = createDeterministicZipFromEntries;
 exports.readZipEntries = readZipEntries;
+exports.readZipFileEntries = readZipFileEntries;
 exports.readSingleFileZip = readSingleFileZip;
+exports.readSingleFileZipPath = readSingleFileZipPath;
+const fs_1 = __importDefault(require("fs"));
 const zlib_1 = __importDefault(require("zlib"));
 const CRC_TABLE = new Uint32Array(256);
 for (let i = 0; i < 256; i += 1) {
@@ -35,6 +39,14 @@ function headerBuffer(size) {
 function createDeterministicZip(entryName, data) {
     return createDeterministicZipFromEntries([{ name: entryName, data }]);
 }
+exports.DEFAULT_ZIP_READ_LIMITS = {
+    maxArchiveBytes: 128 * 1024 * 1024,
+    maxEntries: 10000,
+    maxEntryNameBytes: 4 * 1024,
+    maxEntryUncompressedBytes: 64 * 1024 * 1024,
+    maxTotalUncompressedBytes: 256 * 1024 * 1024,
+    maxExpansionRatio: 1000,
+};
 function normalizeEntryName(entryName) {
     const normalizedName = entryName.split(/[\\/]/).filter(Boolean).join("/");
     if (!normalizedName || normalizedName.includes("..")) {
@@ -112,38 +124,173 @@ function createDeterministicZipFromEntries(entries) {
     end.writeUInt16LE(0, 20);
     return Buffer.concat([localPayload, centralPayload, end]);
 }
-function readZipEntries(zip) {
+function resolveZipReadLimits(overrides) {
+    const limits = { ...exports.DEFAULT_ZIP_READ_LIMITS, ...overrides };
+    for (const [key, value] of Object.entries(limits)) {
+        if (!Number.isFinite(value) || value <= 0) {
+            throw new Error(`zip read limit must be positive: ${key}`);
+        }
+    }
+    if (limits.maxExpansionRatio < 1) {
+        throw new Error("zip read limit maxExpansionRatio must be at least 1");
+    }
+    return limits;
+}
+function readCentralDirectoryBounds(zip, limits) {
+    if (zip.length < 22) {
+        throw new Error("zip end of central directory missing or truncated");
+    }
+    const minimumOffset = Math.max(0, zip.length - (22 + 0xffff));
+    for (let offset = zip.length - 22; offset >= minimumOffset; offset -= 1) {
+        if (zip.readUInt32LE(offset) !== 0x06054b50) {
+            continue;
+        }
+        const commentLength = zip.readUInt16LE(offset + 20);
+        if (offset + 22 + commentLength !== zip.length) {
+            continue;
+        }
+        const diskNumber = zip.readUInt16LE(offset + 4);
+        const centralDisk = zip.readUInt16LE(offset + 6);
+        const diskEntries = zip.readUInt16LE(offset + 8);
+        const entryCount = zip.readUInt16LE(offset + 10);
+        const centralSize = zip.readUInt32LE(offset + 12);
+        const centralOffset = zip.readUInt32LE(offset + 16);
+        if (diskNumber !== 0 ||
+            centralDisk !== 0 ||
+            diskEntries !== entryCount ||
+            entryCount === 0xffff ||
+            centralSize === 0xffffffff ||
+            centralOffset === 0xffffffff) {
+            throw new Error("multi-disk and ZIP64 archives are not supported");
+        }
+        if (entryCount > limits.maxEntries) {
+            throw new Error(`zip entry count exceeds configured limit: ${limits.maxEntries}`);
+        }
+        if (centralOffset + centralSize > offset || centralOffset > zip.length) {
+            throw new Error("zip central directory bounds are invalid");
+        }
+        return { offset: centralOffset, entryCount };
+    }
+    throw new Error("zip end of central directory missing or truncated");
+}
+function exceedsExpansionRatio(uncompressedSize, compressedSize, limit) {
+    if (uncompressedSize === 0) {
+        return false;
+    }
+    return compressedSize === 0 || uncompressedSize / compressedSize > limit;
+}
+function readZipEntries(zip, overrides = {}) {
+    const limits = resolveZipReadLimits(overrides);
+    if (zip.length > limits.maxArchiveBytes) {
+        throw new Error(`zip archive exceeds configured byte limit: ${limits.maxArchiveBytes}`);
+    }
+    const centralDirectory = readCentralDirectoryBounds(zip, limits);
     const entries = [];
+    const seenNames = new Set();
+    let totalUncompressedBytes = 0;
+    let localEntryCount = 0;
     let offset = 0;
-    while (offset + 4 <= zip.length) {
-        const signature = zip.readUInt32LE(offset);
-        if (signature === 0x02014b50 || signature === 0x06054b50) {
-            break;
+    while (offset < centralDirectory.offset) {
+        localEntryCount += 1;
+        if (localEntryCount > limits.maxEntries || localEntryCount > centralDirectory.entryCount) {
+            throw new Error(`zip local entry count exceeds declared or configured limit: ${limits.maxEntries}`);
+        }
+        if (offset + 30 > centralDirectory.offset) {
+            throw new Error("zip local header is truncated");
         }
+        const signature = zip.readUInt32LE(offset);
         if (signature !== 0x04034b50) {
             throw new Error("zip local header missing");
         }
+        const flags = zip.readUInt16LE(offset + 6);
         const method = zip.readUInt16LE(offset + 8);
         const compressedSize = zip.readUInt32LE(offset + 18);
         const uncompressedSize = zip.readUInt32LE(offset + 22);
         const nameLength = zip.readUInt16LE(offset + 26);
         const extraLength = zip.readUInt16LE(offset + 28);
+        if ((flags & ~0x0806) !== 0) {
+            throw new Error(`unsupported zip general-purpose flags: ${flags}`);
+        }
+        if (method !== 0 && method !== 8) {
+            throw new Error(`unsupported zip compression method: ${method}`);
+        }
+        if (nameLength === 0 || nameLength > limits.maxEntryNameBytes) {
+            throw new Error(`zip entry name exceeds configured limit: ${limits.maxEntryNameBytes}`);
+        }
         const nameStart = offset + 30;
         const dataOffset = nameStart + nameLength + extraLength;
+        const dataEnd = dataOffset + compressedSize;
+        if (dataOffset > centralDirectory.offset || dataEnd > centralDirectory.offset) {
+            throw new Error("zip entry data is truncated");
+        }
         const entryName = zip.slice(nameStart, nameStart + nameLength).toString("utf8");
+        if (seenNames.has(entryName)) {
+            throw new Error(`duplicate zip entry: ${entryName}`);
+        }
+        if (uncompressedSize > limits.maxEntryUncompressedBytes) {
+            throw new Error(`zip entry exceeds configured uncompressed byte limit: ${entryName} (${limits.maxEntryUncompressedBytes})`);
+        }
+        if (totalUncompressedBytes + uncompressedSize > limits.maxTotalUncompressedBytes) {
+            throw new Error(`zip total uncompressed bytes exceed configured limit: ${limits.maxTotalUncompressedBytes}`);
+        }
+        if (exceedsExpansionRatio(uncompressedSize, compressedSize, limits.maxExpansionRatio)) {
+            throw new Error(`zip entry exceeds configured expansion ratio: ${entryName}`);
+        }
         const compressed = zip.slice(dataOffset, dataOffset + compressedSize);
-        const data = method === 8 ? zlib_1.default.inflateRawSync(compressed) : method === 0 ? compressed : undefined;
-        if (!data) {
-            throw new Error(`unsupported zip compression method: ${method}`);
+        let data;
+        if (method === 0) {
+            data = compressed;
+        }
+        else {
+            const remainingTotal = limits.maxTotalUncompressedBytes - totalUncompressedBytes;
+            const maxOutputLength = Math.max(1, Math.min(limits.maxEntryUncompressedBytes, remainingTotal));
+            try {
+                data = zlib_1.default.inflateRawSync(compressed, { maxOutputLength });
+            }
+            catch (err) {
+                const code = err.code;
+                const message = err instanceof Error ? err.message : String(err);
+                if (code === "ERR_BUFFER_TOO_LARGE" || /maxOutputLength|larger than/i.test(message)) {
+                    throw new Error(`zip entry output exceeds configured limit: ${entryName}`);
+                }
+                throw new Error(`zip entry inflation failed for ${entryName}: ${message}`);
+            }
         }
         if (data.length !== uncompressedSize) {
             throw new Error("zip uncompressed size mismatch");
         }
+        if (data.length > limits.maxEntryUncompressedBytes) {
+            throw new Error(`zip entry output exceeds configured limit: ${entryName}`);
+        }
+        if (totalUncompressedBytes + data.length > limits.maxTotalUncompressedBytes) {
+            throw new Error(`zip total uncompressed bytes exceed configured limit: ${limits.maxTotalUncompressedBytes}`);
+        }
+        if (exceedsExpansionRatio(data.length, compressedSize, limits.maxExpansionRatio)) {
+            throw new Error(`zip entry exceeds configured expansion ratio: ${entryName}`);
+        }
+        seenNames.add(entryName);
+        totalUncompressedBytes += data.length;
         entries.push({ name: entryName, data });
-        offset = dataOffset + compressedSize;
+        offset = dataEnd;
+    }
+    if (offset !== centralDirectory.offset ||
+        localEntryCount !== centralDirectory.entryCount ||
+        entries.length !== centralDirectory.entryCount) {
+        throw new Error("zip local and central directory entry counts do not match");
     }
     return entries;
 }
+function readZipFileEntries(filePath, overrides = {}) {
+    const limits = resolveZipReadLimits(overrides);
+    const stat = fs_1.default.statSync(filePath);
+    if (!stat.isFile()) {
+        throw new Error(`zip path is not a regular file: ${filePath}`);
+    }
+    if (stat.size > limits.maxArchiveBytes) {
+        throw new Error(`zip archive exceeds configured byte limit: ${limits.maxArchiveBytes}`);
+    }
+    return readZipEntries(fs_1.default.readFileSync(filePath), limits);
+}
 function readSingleFileZip(zip) {
     const entries = readZipEntries(zip);
     if (entries.length !== 1) {
@@ -151,3 +298,10 @@ function readSingleFileZip(zip) {
     }
     return { entryName: entries[0].name, data: entries[0].data };
 }
+function readSingleFileZipPath(filePath) {
+    const entries = readZipFileEntries(filePath);
+    if (entries.length !== 1) {
+        throw new Error("zip must contain exactly one file");
+    }
+    return { entryName: entries[0].name, data: entries[0].data };
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "mdkg",
-  "version": "0.4.2",
+  "version": "0.5.0",
   "description": "Git-native project memory for AI coding agents",
   "license": "MIT",
   "bin": {
@@ -9,9 +9,12 @@
   "scripts": {
     "build": "node scripts/clean-build-output.js && tsc -p tsconfig.build.json && node scripts/add-shebang.js && node scripts/copy-init-assets.js && node scripts/generate-command-contract.js --write",
     "build:test": "node scripts/clean-build-output.js tests && tsc -p tsconfig.test.json",
-    "test": "npm run build && npm run build:test && node --test dist/tests/**/*.test.js",
+    "test": "npm run build && npm run build:test && node --test dist/tests/**/*.test.js && npm run test:public-release",
+    "test:public-release": "node --test tests/public-release.test.mjs tests/security-remediation.test.mjs",
+    "security:verify": "node scripts/verify-security-remediation.js",
     "test:coverage": "npm run build && npm run build:test && node --test --experimental-test-coverage dist/tests/**/*.test.js",
     "smoke:consumer": "npm run build && node scripts/smoke-consumer.js",
+    "smoke:loop": "npm run build && node scripts/smoke-loop.js",
     "smoke:matrix": "npm run build && node scripts/smoke-command-matrix.js",
     "smoke:upgrade": "npm run build && node scripts/smoke-upgrade.js",
     "smoke:init": "npm run build && node scripts/smoke-init.js",
@@ -63,8 +66,9 @@
     "cli:snapshot": "npm run build && node scripts/cli_help_snapshot.js",
     "cli:check": "npm run build && node scripts/cli_help_snapshot.js --check",
     "cli:contract": "npm run build && node scripts/generate-command-contract.js --check",
-    "prepack": "npm run build && node scripts/assert-publish-ready.js",
-    "prepublishOnly": "npm run test && npm run cli:check && npm run cli:contract && npm run docs:check && node dist/cli.js validate && npm run smoke:consumer && npm run smoke:matrix && npm run smoke:upgrade && npm run smoke:init && npm run smoke:capabilities && npm run smoke:db && npm run smoke:db-queue && npm run smoke:db-queue-cli && npm run smoke:db-events && npm run smoke:db-materializer && npm run smoke:db-snapshot && npm run smoke:archive-work && npm run smoke:work-invocation && npm run smoke:cli-ux-polish && npm run smoke:operator-health && npm run smoke:fix-plan && npm run smoke:branch-conflicts && npm run smoke:id-repair && npm run smoke:command-docs && npm run smoke:spike && npm run smoke:goal-lifecycle && npm run smoke:semantic-refs && npm run smoke:checkpoint-templates && npm run smoke:handoff && npm run smoke:warning-ux && npm run smoke:integration-ux && npm run smoke:mdkg-dev && npm run smoke:mdkg-dev-docs && npm run smoke:mdkg-dev-seo && npm run smoke:mdkg-dev-polish-pass2 && npm run smoke:mdkg-dev-polish-pass3 && npm run smoke:mdkg-dev-polish-pass4 && npm run smoke:mdkg-dev-polish-pass5 && npm run smoke:mdkg-dev-a11y && npm run smoke:mdkg-dev-perf && npm run smoke:demo-graph && npm run smoke:bundle && npm run smoke:graph-clone && npm run smoke:mcp && npm run smoke:subgraph && npm run smoke:visibility && npm run smoke:sqlite && npm run smoke:parallel && npm run smoke:goal && node scripts/assert-publish-ready.js",
+    "ci:release": "npm run test && npm run cli:check && npm run cli:contract && npm run docs:check && npm run smoke:loop && npm run security:verify && node scripts/assert-publish-ready.js",
+    "prepack": "npm run build && npm run security:verify && node scripts/assert-publish-ready.js",
+    "prepublishOnly": "npm run test && npm run cli:check && npm run cli:contract && npm run docs:check && node dist/cli.js validate && npm run security:verify && npm run smoke:consumer && npm run smoke:loop && npm run smoke:matrix && npm run smoke:upgrade && npm run smoke:init && npm run smoke:capabilities && npm run smoke:db && npm run smoke:db-queue && npm run smoke:db-queue-cli && npm run smoke:db-events && npm run smoke:db-materializer && npm run smoke:db-snapshot && npm run smoke:archive-work && npm run smoke:work-invocation && npm run smoke:cli-ux-polish && npm run smoke:operator-health && npm run smoke:fix-plan && npm run smoke:branch-conflicts && npm run smoke:id-repair && npm run smoke:command-docs && npm run smoke:spike && npm run smoke:goal-lifecycle && npm run smoke:semantic-refs && npm run smoke:checkpoint-templates && npm run smoke:handoff && npm run smoke:warning-ux && npm run smoke:integration-ux && npm run smoke:mdkg-dev && npm run smoke:mdkg-dev-docs && npm run smoke:mdkg-dev-seo && npm run smoke:mdkg-dev-polish-pass2 && npm run smoke:mdkg-dev-polish-pass3 && npm run smoke:mdkg-dev-polish-pass4 && npm run smoke:mdkg-dev-polish-pass5 && npm run smoke:mdkg-dev-a11y && npm run smoke:mdkg-dev-perf && npm run smoke:demo-graph && npm run smoke:bundle && npm run smoke:graph-clone && npm run smoke:mcp && npm run smoke:subgraph && npm run smoke:visibility && npm run smoke:sqlite && npm run smoke:parallel && npm run smoke:goal && node scripts/assert-publish-ready.js",
     "postinstall": "node scripts/postinstall.js",
     "smoke:subgraph": "npm run build && node scripts/smoke-subgraph.js"
   },