mdkg 0.4.2 → 0.5.1

package/dist/graph/node_body.js

@@ -3,13 +3,52 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
     return (mod && mod.__esModule) ? mod : { "default": mod };
 };
 Object.defineProperty(exports, "__esModule", { value: true });
+exports.DEFAULT_NODE_BODY_MAX_BYTES = void 0;
+exports.createNodeBodyReader = createNodeBodyReader;
 exports.readNodeBody = readNodeBody;
 const fs_1 = __importDefault(require("fs"));
 const path_1 = __importDefault(require("path"));
 const frontmatter_1 = require("./frontmatter");
 const zip_1 = require("../util/zip");
 const errors_1 = require("../util/errors");
-function readImportedBody(root, node) {
+const filesystem_authority_1 = require("../core/filesystem_authority");
+exports.DEFAULT_NODE_BODY_MAX_BYTES = 8 * 1024 * 1024;
+function createNodeBodyReader(root, maxBytes = exports.DEFAULT_NODE_BODY_MAX_BYTES) {
+    const bundleEntries = new Map();
+    return (node) => {
+        if (!node.source?.imported) {
+            const filePath = path_1.default.resolve(root, node.path);
+            if (!fs_1.default.existsSync(filePath)) {
+                throw new errors_1.NotFoundError(`file not found for ${node.qid}: ${node.path}`);
+            }
+            const content = (0, filesystem_authority_1.readContainedFile)({ root, relativePath: node.path, maxBytes }, "utf8");
+            const parsed = (0, frontmatter_1.parseFrontmatter)(content, filePath);
+            if (parsed.frontmatter.id !== node.id || parsed.frontmatter.type !== node.type) {
+                throw new Error(`cached node identity mismatch for ${node.qid}`);
+            }
+            return parsed.body.trimEnd();
+        }
+        const source = node.source;
+        const bundlePath = path_1.default.resolve(root, source.bundle_path);
+        let entries = bundleEntries.get(bundlePath);
+        if (!entries) {
+            if (!fs_1.default.existsSync(bundlePath)) {
+                throw new errors_1.NotFoundError(`bundle not found for ${node.qid}: ${source.bundle_path}`);
+            }
+            entries = new Map((0, zip_1.readZipFileEntries)(bundlePath).map((entry) => [entry.name, entry.data]));
+            bundleEntries.set(bundlePath, entries);
+        }
+        const entry = entries.get(source.original_path);
+        if (!entry) {
+            throw new errors_1.NotFoundError(`bundle entry not found for ${node.qid}: ${source.original_path}`);
+        }
+        if (entry.length > maxBytes) {
+            throw new Error(`node body source exceeds byte limit for ${node.qid}: ${maxBytes}`);
+        }
+        return (0, frontmatter_1.parseFrontmatter)(entry.toString("utf8"), source.original_path).body.trimEnd();
+    };
+}
+function readImportedBody(root, node, maxBytes) {
     const source = node.source;
     if (!source?.imported) {
         throw new Error("node is not imported");
@@ -18,20 +57,27 @@ function readImportedBody(root, node) {
     if (!fs_1.default.existsSync(bundlePath)) {
         throw new errors_1.NotFoundError(`bundle not found for ${node.qid}: ${source.bundle_path}`);
     }
-    const entry = (0, zip_1.readZipEntries)(fs_1.default.readFileSync(bundlePath)).find((candidate) => candidate.name === source.original_path);
+    const entry = (0, zip_1.readZipFileEntries)(bundlePath).find((candidate) => candidate.name === source.original_path);
     if (!entry) {
         throw new errors_1.NotFoundError(`bundle entry not found for ${node.qid}: ${source.original_path}`);
     }
+    if (entry.data.length > maxBytes) {
+        throw new Error(`node body source exceeds byte limit for ${node.qid}: ${maxBytes}`);
+    }
     return (0, frontmatter_1.parseFrontmatter)(entry.data.toString("utf8"), source.original_path).body.trimEnd();
 }
-function readNodeBody(root, node) {
+function readNodeBody(root, node, maxBytes = exports.DEFAULT_NODE_BODY_MAX_BYTES) {
     if (node.source?.imported) {
-        return readImportedBody(root, node);
+        return readImportedBody(root, node, maxBytes);
     }
     const filePath = path_1.default.resolve(root, node.path);
     if (!fs_1.default.existsSync(filePath)) {
         throw new errors_1.NotFoundError(`file not found for ${node.qid}: ${node.path}`);
     }
-    const content = fs_1.default.readFileSync(filePath, "utf8");
-    return (0, frontmatter_1.parseFrontmatter)(content, filePath).body.trimEnd();
+    const content = (0, filesystem_authority_1.readContainedFile)({ root, relativePath: node.path, maxBytes }, "utf8");
+    const parsed = (0, frontmatter_1.parseFrontmatter)(content, filePath);
+    if (parsed.frontmatter.id !== node.id || parsed.frontmatter.type !== node.type) {
+        throw new Error(`cached node identity mismatch for ${node.qid}`);
+    }
+    return parsed.body.trimEnd();
 }

package/dist/graph/skills_index_cache.js

@@ -10,6 +10,7 @@ const fs_1 = __importDefault(require("fs"));
 const path_1 = __importDefault(require("path"));
 const paths_1 = require("../core/paths");
 const atomic_1 = require("../util/atomic");
+const filesystem_authority_1 = require("../core/filesystem_authority");
 const skills_indexer_1 = require("./skills_indexer");
 function mtimeMs(filePath) {
     return fs_1.default.statSync(filePath).mtimeMs;
@@ -50,16 +51,39 @@ function isSkillsIndexStale(root, config) {
     }
     return false;
 }
-function readSkillsIndex(indexPath) {
+function isRecord(value) {
+    return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function readSkillsIndex(root, indexPath) {
     try {
-        const raw = fs_1.default.readFileSync(indexPath, "utf8");
-        return JSON.parse(raw);
+        const relativePath = path_1.default.relative(root, indexPath).split(path_1.default.sep).join("/");
+        const parsed = JSON.parse((0, filesystem_authority_1.readContainedFile)({ root, relativePath }, "utf8"));
+        if (!isRecord(parsed) || !isRecord(parsed.meta) || !isRecord(parsed.skills)) {
+            throw new Error("skills index cache has an invalid shape");
+        }
+        return parsed;
     }
     catch (err) {
         const message = err instanceof Error ? err.message : "unknown error";
         throw new Error(`failed to read skills index: ${message}`);
     }
 }
+function validateCachedSkillPaths(root, config, cached) {
+    const skillsRoot = (0, skills_indexer_1.resolveSkillsRoot)(root, config);
+    for (const [slug, skill] of Object.entries(cached.skills)) {
+        if (skill.slug !== slug || skill.id !== `skill:${slug}` || skill.qid !== `${skill.ws}:skill:${slug}`) {
+            throw new Error(`invalid cached skill identity: ${slug}`);
+        }
+        const absolutePath = path_1.default.resolve(root, skill.path);
+        const relativeSkillsPath = path_1.default.relative(skillsRoot, absolutePath);
+        if (path_1.default.isAbsolute(skill.path) || relativeSkillsPath.startsWith("..") || path_1.default.isAbsolute(relativeSkillsPath)) {
+            throw new Error(`cached skill path escapes skills root: ${slug}`);
+        }
+        const normalized = path_1.default.relative(root, absolutePath).split(path_1.default.sep).join("/");
+        (0, filesystem_authority_1.withContainedPathSink)({ root, relativePath: normalized, operation: "read" }, () => undefined);
+    }
+    return cached;
+}
 function writeSkillsIndex(indexPath, index) {
     const sortedSkills = {};
     for (const slug of Object.keys(index.skills).sort()) {
@@ -74,6 +98,7 @@ function writeSkillsIndex(indexPath, index) {
 function loadSkillsIndex(options) {
     const useCache = options.useCache ?? true;
     const allowReindex = options.allowReindex ?? options.config.index.auto_reindex;
+    const persistReindex = options.persistReindex ?? true;
     const indexPath = (0, skills_indexer_1.resolveSkillsIndexPath)(options.root);
     if (!useCache) {
         const index = (0, skills_indexer_1.buildSkillsIndex)(options.root, options.config);
@@ -81,15 +106,25 @@ function loadSkillsIndex(options) {
     }
     const stale = isSkillsIndexStale(options.root, options.config);
     if (fs_1.default.existsSync(indexPath) && !stale) {
-        return { index: readSkillsIndex(indexPath), rebuilt: false, stale: false };
+        return {
+            index: validateCachedSkillPaths(options.root, options.config, readSkillsIndex(options.root, indexPath)),
+            rebuilt: false,
+            stale: false,
+        };
     }
     if (allowReindex) {
         const index = (0, skills_indexer_1.buildSkillsIndex)(options.root, options.config);
-        writeSkillsIndex(indexPath, index);
+        if (persistReindex) {
+            writeSkillsIndex(indexPath, index);
+        }
         return { index, rebuilt: true, stale };
     }
     if (fs_1.default.existsSync(indexPath)) {
-        return { index: readSkillsIndex(indexPath), rebuilt: false, stale: true };
+        return {
+            index: validateCachedSkillPaths(options.root, options.config, readSkillsIndex(options.root, indexPath)),
+            rebuilt: false,
+            stale: true,
+        };
     }
     throw new Error("skills index missing and auto-reindex is disabled");
 }

package/dist/graph/skills_indexer.js

@@ -12,6 +12,7 @@ exports.buildSkillIndexEntry = buildSkillIndexEntry;
 exports.buildSkillsIndex = buildSkillsIndex;
 const fs_1 = __importDefault(require("fs"));
 const path_1 = __importDefault(require("path"));
+const filesystem_authority_1 = require("../core/filesystem_authority");
 const frontmatter_1 = require("./frontmatter");
 exports.SKILLS_INDEX_RELATIVE_PATH = ".mdkg/index/skills.json";
 exports.SKILL_SLUG_RE = /^[a-z0-9]+(?:-[a-z0-9]+)*$/;
@@ -94,7 +95,8 @@ function hasDirectory(dirPath) {
     if (!fs_1.default.existsSync(dirPath)) {
         return false;
     }
-    return fs_1.default.statSync(dirPath).isDirectory();
+    const stat = fs_1.default.lstatSync(dirPath);
+    return !stat.isSymbolicLink() && stat.isDirectory();
 }
 function rootWorkspaceMdkgPath(root, config) {
     const rootWs = config.workspaces.root;
@@ -113,7 +115,8 @@ function buildSkillIndexEntryForWorkspace(root, workspace, slug, filePath) {
     if (!exports.SKILL_SLUG_RE.test(slug)) {
         throw new Error(`${filePath}: skill slug must be kebab-case`);
     }
-    const content = fs_1.default.readFileSync(filePath, "utf8");
+    const relativePath = path_1.default.relative(root, filePath).split(path_1.default.sep).join("/");
+    const content = (0, filesystem_authority_1.readContainedFile)({ root, relativePath });
     const { frontmatter } = (0, frontmatter_1.parseFrontmatter)(content, filePath);
     const name = requireString(frontmatter, "name", filePath);
     const description = requireString(frontmatter, "description", filePath);

package/dist/graph/sqlite_index.js

@@ -14,6 +14,7 @@ exports.sqliteHealth = sqliteHealth;
 const crypto_1 = __importDefault(require("crypto"));
 const fs_1 = __importDefault(require("fs"));
 const path_1 = __importDefault(require("path"));
+const filesystem_authority_1 = require("../core/filesystem_authority");
 const staleness_1 = require("./staleness");
 exports.SQLITE_SCHEMA_VERSION = 2;
 function loadDatabaseCtor() {
@@ -61,8 +62,9 @@ function isSqliteBackend(config) {
 function resolveSqlitePath(root, config) {
     return path_1.default.resolve(root, config.index.sqlite_path);
 }
-function sqliteTempPath(sqlitePath) {
-    return path_1.default.join(path_1.default.dirname(sqlitePath), `.${path_1.default.basename(sqlitePath)}.${process.pid}.${Date.now()}.tmp`);
+function sqliteTempRelativePath(sqliteRelativePath) {
+    const normalized = sqliteRelativePath.replace(/\\/g, "/");
+    return path_1.default.posix.join(path_1.default.posix.dirname(normalized), `.${path_1.default.posix.basename(normalized)}.${process.pid}.${Date.now()}.tmp`);
 }
 function createSchema(db) {
     db.exec(`
@@ -163,127 +165,136 @@ function sqliteSourceFingerprint(options) {
     return buildSourceFingerprint({ ...options, nodeHashes });
 }
 function readSqliteIndexMeta(root, config) {
-    const sqlitePath = resolveSqlitePath(root, config);
     const DatabaseSync = loadDatabaseCtor();
-    const db = new DatabaseSync(sqlitePath);
-    try {
-        const rows = db.prepare("SELECT key, value FROM meta").all();
-        const meta = {};
-        for (const row of rows) {
-            meta[String(row.key)] = String(row.value);
+    return (0, filesystem_authority_1.withContainedPathSink)({ root, relativePath: config.index.sqlite_path, operation: "read" }, ({ absolutePath }) => {
+        const db = new DatabaseSync(absolutePath);
+        try {
+            const rows = db.prepare("SELECT key, value FROM meta").all();
+            const meta = {};
+            for (const row of rows) {
+                meta[String(row.key)] = String(row.value);
+            }
+            return meta;
         }
-        return meta;
-    }
-    finally {
-        db.close();
-    }
+        finally {
+            db.close();
+        }
+    });
 }
 function writeSqliteIndex(options) {
+    const sqliteRelativePath = options.config.index.sqlite_path;
     const sqlitePath = resolveSqlitePath(options.root, options.config);
-    fs_1.default.mkdirSync(path_1.default.dirname(sqlitePath), { recursive: true });
-    const tempPath = sqliteTempPath(sqlitePath);
-    fs_1.default.rmSync(tempPath, { force: true });
+    const tempRelativePath = sqliteTempRelativePath(sqliteRelativePath);
+    (0, filesystem_authority_1.withContainedPathSink)({ root: options.root, relativePath: sqliteRelativePath, operation: "replace", createParents: true }, () => undefined);
     const DatabaseSync = loadDatabaseCtor();
-    const db = new DatabaseSync(tempPath);
     try {
-        const nodeHashes = new Map();
-        for (const node of Object.values(options.nodeIndex.nodes)) {
-            nodeHashes.set(node.qid, nodeSourceHash(options.root, node.path));
-        }
-        createSchema(db);
-        insertMeta(db, "tool", "mdkg");
-        insertMeta(db, "schema_version", String(exports.SQLITE_SCHEMA_VERSION));
-        insertMeta(db, "package_schema_version", String(options.config.schema_version));
-        insertMeta(db, "backend", options.config.index.backend);
-        insertMeta(db, "source_fingerprint", buildSourceFingerprint({ ...options, nodeHashes }));
-        insertMeta(db, "root", ".");
-        const insertNode = db.prepare("INSERT INTO nodes (qid, id, ws, type, title, path, status, priority, updated, source_hash, json) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)");
-        const insertEdge = db.prepare("INSERT OR IGNORE INTO edges (source_qid, kind, target_qid) VALUES (?, ?, ?)");
-        for (const node of Object.values(options.nodeIndex.nodes).sort((a, b) => a.qid.localeCompare(b.qid))) {
-            insertNode.run(node.qid, node.id, node.ws, node.type, node.title, toPosixPath(node.path), node.status ?? null, node.priority ?? null, node.updated ?? null, nodeHashes.get(node.qid) ?? null, stableCacheJson(node));
-            for (const [kind, values] of [
-                ["relates", node.edges.relates],
-                ["blocked_by", node.edges.blocked_by],
-                ["blocks", node.edges.blocks],
-                ["context_refs", node.edges.context_refs ?? []],
-                ["evidence_refs", node.edges.evidence_refs ?? []],
-            ]) {
-                for (const target of values) {
-                    insertEdge.run(node.qid, kind, target);
+        (0, filesystem_authority_1.withContainedPathSink)({ root: options.root, relativePath: tempRelativePath, operation: "create", createParents: true }, ({ absolutePath: tempPath }) => {
+            const db = new DatabaseSync(tempPath);
+            try {
+                const nodeHashes = new Map();
+                for (const node of Object.values(options.nodeIndex.nodes)) {
+                    nodeHashes.set(node.qid, nodeSourceHash(options.root, node.path));
                 }
-            }
-            for (const [kind, target] of [
-                ["epic", node.edges.epic],
-                ["parent", node.edges.parent],
-                ["prev", node.edges.prev],
-                ["next", node.edges.next],
-            ]) {
-                if (target) {
-                    insertEdge.run(node.qid, kind, target);
+                createSchema(db);
+                insertMeta(db, "tool", "mdkg");
+                insertMeta(db, "schema_version", String(exports.SQLITE_SCHEMA_VERSION));
+                insertMeta(db, "package_schema_version", String(options.config.schema_version));
+                insertMeta(db, "backend", options.config.index.backend);
+                insertMeta(db, "source_fingerprint", buildSourceFingerprint({ ...options, nodeHashes }));
+                insertMeta(db, "root", ".");
+                const insertNode = db.prepare("INSERT INTO nodes (qid, id, ws, type, title, path, status, priority, updated, source_hash, json) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)");
+                const insertEdge = db.prepare("INSERT OR IGNORE INTO edges (source_qid, kind, target_qid) VALUES (?, ?, ?)");
+                for (const node of Object.values(options.nodeIndex.nodes).sort((a, b) => a.qid.localeCompare(b.qid))) {
+                    insertNode.run(node.qid, node.id, node.ws, node.type, node.title, toPosixPath(node.path), node.status ?? null, node.priority ?? null, node.updated ?? null, nodeHashes.get(node.qid) ?? null, stableCacheJson(node));
+                    for (const [kind, values] of [
+                        ["relates", node.edges.relates],
+                        ["blocked_by", node.edges.blocked_by],
+                        ["blocks", node.edges.blocks],
+                        ["context_refs", node.edges.context_refs ?? []],
+                        ["evidence_refs", node.edges.evidence_refs ?? []],
+                    ]) {
+                        for (const target of values) {
+                            insertEdge.run(node.qid, kind, target);
+                        }
+                    }
+                    for (const [kind, target] of [
+                        ["epic", node.edges.epic],
+                        ["parent", node.edges.parent],
+                        ["prev", node.edges.prev],
+                        ["next", node.edges.next],
+                    ]) {
+                        if (target) {
+                            insertEdge.run(node.qid, kind, target);
+                        }
+                    }
+                }
+                const insertSkill = db.prepare("INSERT INTO skills (qid, slug, ws, name, path, json) VALUES (?, ?, ?, ?, ?, ?)");
+                for (const skill of Object.values(options.skillsIndex.skills).sort((a, b) => a.qid.localeCompare(b.qid))) {
+                    insertSkill.run(skill.qid, skill.slug, skill.ws, skill.name, skill.path, stableCacheJson(skill));
+                }
+                const insertCapability = db.prepare("INSERT INTO capabilities (qid, kind, workspace, visibility, id, path, source_hash, json) VALUES (?, ?, ?, ?, ?, ?, ?, ?)");
+                for (const record of options.capabilitiesIndex.records) {
+                    insertCapability.run(record.qid, record.kind, record.workspace, record.visibility, record.id, record.path, record.source_hash, stableCacheJson(record));
+                }
+                const insertArchive = db.prepare("INSERT INTO archives (qid, visibility, compressed_path, compressed_sha256, json) VALUES (?, ?, ?, ?, ?)");
+                for (const node of Object.values(options.nodeIndex.nodes).filter((item) => item.type === "archive")) {
+                    insertArchive.run(node.qid, String(node.attributes.visibility ?? "private"), String(node.attributes.compressed_path ?? ""), String(node.attributes.compressed_sha256 ?? ""), stableCacheJson(node));
+                }
+                const insertSubgraph = db.prepare("INSERT INTO subgraphs (alias, enabled, stale, error_count, warning_count, json) VALUES (?, ?, ?, ?, ?, ?)");
+                for (const item of options.subgraphsIndex.subgraphs) {
+                    insertSubgraph.run(item.alias, item.enabled ? 1 : 0, item.stale ? 1 : 0, item.error_count, item.warning_count, stableCacheJson(item));
                 }
             }
-        }
-        const insertSkill = db.prepare("INSERT INTO skills (qid, slug, ws, name, path, json) VALUES (?, ?, ?, ?, ?, ?)");
-        for (const skill of Object.values(options.skillsIndex.skills).sort((a, b) => a.qid.localeCompare(b.qid))) {
-            insertSkill.run(skill.qid, skill.slug, skill.ws, skill.name, skill.path, stableCacheJson(skill));
-        }
-        const insertCapability = db.prepare("INSERT INTO capabilities (qid, kind, workspace, visibility, id, path, source_hash, json) VALUES (?, ?, ?, ?, ?, ?, ?, ?)");
-        for (const record of options.capabilitiesIndex.records) {
-            insertCapability.run(record.qid, record.kind, record.workspace, record.visibility, record.id, record.path, record.source_hash, stableCacheJson(record));
-        }
-        const insertArchive = db.prepare("INSERT INTO archives (qid, visibility, compressed_path, compressed_sha256, json) VALUES (?, ?, ?, ?, ?)");
-        for (const node of Object.values(options.nodeIndex.nodes).filter((item) => item.type === "archive")) {
-            insertArchive.run(node.qid, String(node.attributes.visibility ?? "private"), String(node.attributes.compressed_path ?? ""), String(node.attributes.compressed_sha256 ?? ""), stableCacheJson(node));
-        }
-        const insertSubgraph = db.prepare("INSERT INTO subgraphs (alias, enabled, stale, error_count, warning_count, json) VALUES (?, ?, ?, ?, ?, ?)");
-        for (const item of options.subgraphsIndex.subgraphs) {
-            insertSubgraph.run(item.alias, item.enabled ? 1 : 0, item.stale ? 1 : 0, item.error_count, item.warning_count, stableCacheJson(item));
-        }
+            finally {
+                db.close();
+            }
+        });
+        (0, filesystem_authority_1.withContainedPathSink)({ root: options.root, relativePath: sqliteRelativePath, operation: "replace", createParents: true }, ({ absolutePath: targetPath }) => (0, filesystem_authority_1.withContainedPathSink)({ root: options.root, relativePath: tempRelativePath, operation: "read" }, ({ absolutePath: tempPath }) => fs_1.default.renameSync(tempPath, targetPath)));
     }
-    finally {
-        db.close();
+    catch (error) {
+        (0, filesystem_authority_1.removeContainedPath)({ root: options.root, relativePath: tempRelativePath, force: true });
+        throw error;
     }
-    fs_1.default.renameSync(tempPath, sqlitePath);
     return sqlitePath;
 }
 function reserveSqliteNumericId(options) {
     if (!isSqliteBackend(options.config)) {
         return undefined;
     }
-    const sqlitePath = resolveSqlitePath(options.root, options.config);
-    fs_1.default.mkdirSync(path_1.default.dirname(sqlitePath), { recursive: true });
     const DatabaseSync = loadDatabaseCtor();
-    const db = new DatabaseSync(sqlitePath);
-    try {
-        db.exec("CREATE TABLE IF NOT EXISTS id_allocations (ws TEXT NOT NULL, prefix TEXT NOT NULL, next_value INTEGER NOT NULL, PRIMARY KEY (ws, prefix));");
-        db.exec("BEGIN IMMEDIATE");
-        const row = db
-            .prepare("SELECT next_value FROM id_allocations WHERE ws = ? AND prefix = ?")
-            .get(options.ws, options.prefix);
-        const existing = typeof row?.next_value === "number" ? row.next_value : undefined;
-        const nextValue = Math.max(existing ?? 1, options.currentMax + 1);
-        db.prepare("INSERT INTO id_allocations (ws, prefix, next_value) VALUES (?, ?, ?) ON CONFLICT(ws, prefix) DO UPDATE SET next_value = excluded.next_value").run(options.ws, options.prefix, nextValue + 1);
-        db.exec("COMMIT");
-        return `${options.prefix}-${nextValue}`;
-    }
-    catch (err) {
+    return (0, filesystem_authority_1.withContainedPathSink)({ root: options.root, relativePath: options.config.index.sqlite_path, operation: "replace", createParents: true }, ({ absolutePath }) => {
+        const db = new DatabaseSync(absolutePath);
         try {
-            db.exec("ROLLBACK");
+            db.exec("CREATE TABLE IF NOT EXISTS id_allocations (ws TEXT NOT NULL, prefix TEXT NOT NULL, next_value INTEGER NOT NULL, PRIMARY KEY (ws, prefix));");
+            db.exec("BEGIN IMMEDIATE");
+            const row = db
+                .prepare("SELECT next_value FROM id_allocations WHERE ws = ? AND prefix = ?")
+                .get(options.ws, options.prefix);
+            const existing = typeof row?.next_value === "number" ? row.next_value : undefined;
+            const nextValue = Math.max(existing ?? 1, options.currentMax + 1);
+            db.prepare("INSERT INTO id_allocations (ws, prefix, next_value) VALUES (?, ?, ?) ON CONFLICT(ws, prefix) DO UPDATE SET next_value = excluded.next_value").run(options.ws, options.prefix, nextValue + 1);
+            db.exec("COMMIT");
+            return `${options.prefix}-${nextValue}`;
         }
-        catch {
-            // ignore rollback failures when no transaction is active
+        catch (err) {
+            try {
+                db.exec("ROLLBACK");
+            }
+            catch {
+                // ignore rollback failures when no transaction is active
+            }
+            throw err;
         }
-        throw err;
-    }
-    finally {
-        db.close();
-    }
+        finally {
+            db.close();
+        }
+    });
 }
 function sqliteHealth(root, config) {
     const sqlitePath = resolveSqlitePath(root, config);
     const warnings = [];
     const errors = [];
-    if (!fs_1.default.existsSync(sqlitePath)) {
+    if (!(0, filesystem_authority_1.containedPathExists)({ root, relativePath: config.index.sqlite_path })) {
         warnings.push(`SQLite cache missing at ${toPosixPath(path_1.default.relative(root, sqlitePath))}; run mdkg index`);
         return { path: sqlitePath, exists: false, size: 0, warnings, errors };
     }
@@ -299,16 +310,18 @@ function sqliteHealth(root, config) {
     }
     try {
         const DatabaseSync = loadDatabaseCtor();
-        const db = new DatabaseSync(sqlitePath);
-        try {
-            const row = db.prepare("SELECT value FROM meta WHERE key = 'schema_version'").get();
-            if (String(row?.value ?? "") !== String(exports.SQLITE_SCHEMA_VERSION)) {
-                errors.push(`SQLite schema mismatch; run mdkg index`);
+        (0, filesystem_authority_1.withContainedPathSink)({ root, relativePath: config.index.sqlite_path, operation: "read" }, ({ absolutePath }) => {
+            const db = new DatabaseSync(absolutePath);
+            try {
+                const row = db.prepare("SELECT value FROM meta WHERE key = 'schema_version'").get();
+                if (String(row?.value ?? "") !== String(exports.SQLITE_SCHEMA_VERSION)) {
+                    errors.push(`SQLite schema mismatch; run mdkg index`);
+                }
             }
-        }
-        finally {
-            db.close();
-        }
+            finally {
+                db.close();
+            }
+        });
     }
     catch (err) {
         errors.push(`failed to read SQLite cache: ${err instanceof Error ? err.message : String(err)}`);