mdkg 0.4.2 → 0.5.1

package/dist/commands/archive.js

@@ -11,6 +11,8 @@ exports.runArchiveCompressCommand = runArchiveCompressCommand;
 const fs_1 = __importDefault(require("fs"));
 const path_1 = __importDefault(require("path"));
 const config_1 = require("../core/config");
+const filesystem_authority_1 = require("../core/filesystem_authority");
+const workspace_path_1 = require("../core/workspace_path");
 const frontmatter_1 = require("../graph/frontmatter");
 const archive_integrity_1 = require("../graph/archive_integrity");
 const indexer_1 = require("../graph/indexer");
@@ -21,7 +23,6 @@ const date_1 = require("../util/date");
 const errors_1 = require("../util/errors");
 const id_1 = require("../util/id");
 const refs_1 = require("../util/refs");
-const atomic_1 = require("../util/atomic");
 const lock_1 = require("../util/lock");
 const zip_1 = require("../util/zip");
 const event_support_1 = require("./event_support");
@@ -82,6 +83,22 @@ function normalizeArchiveId(raw) {
     }
     return normalized;
 }
+function archiveTargetFromInput(value, ws) {
+    const uriId = (0, refs_1.archiveIdFromUri)(value);
+    if (uriId) {
+        return { id: normalizeArchiveId(uriId), workspace: normalizeWorkspace(ws) };
+    }
+    const separator = value.indexOf(":");
+    if (separator > 0) {
+        const workspace = normalizeWorkspace(value.slice(0, separator));
+        const id = normalizeArchiveId(value.slice(separator + 1));
+        if (ws && normalizeWorkspace(ws) !== workspace) {
+            throw new errors_1.UsageError(`archive qid ${value} conflicts with --ws ${normalizeWorkspace(ws)}`);
+        }
+        return { id, workspace };
+    }
+    return { id: normalizeArchiveId(value), workspace: normalizeWorkspace(ws) };
+}
 function archiveIdFromInput(value) {
     return normalizeArchiveId((0, refs_1.archiveIdFromUri)(value) ?? value);
 }
@@ -132,9 +149,8 @@ function maybeReindex(root) {
 function resolveArchiveNode(root, id, ws) {
     const config = (0, config_1.loadConfig)(root);
     const { index } = (0, index_cache_1.loadIndex)({ root, config });
-    const archiveId = archiveIdFromInput(id);
-    const wsHint = normalizeWorkspace(ws);
-    const qid = archiveId.includes(":") ? archiveId : `${wsHint}:${archiveId}`;
+    const target = archiveTargetFromInput(id, ws);
+    const qid = `${target.workspace}:${target.id}`;
     const node = index.nodes[qid];
     if (!node || node.type !== "archive") {
         throw new errors_1.NotFoundError(`archive not found: ${id}`);
@@ -142,6 +158,9 @@ function resolveArchiveNode(root, id, ws) {
     return node;
 }
 function archiveNodePaths(root, node) {
+    if (node.source?.imported || node.source?.read_only || node.path.includes("#")) {
+        throw new errors_1.ValidationError(`refusing to derive filesystem paths for read-only archive projection ${node.qid}`);
+    }
     const sidecarPath = path_1.default.resolve(root, node.path);
     const sidecarDir = path_1.default.dirname(sidecarPath);
     return {
@@ -173,10 +192,13 @@ function walkArchiveSidecars(root) {
 function stringAttribute(value) {
     return typeof value === "string" && value.trim().length > 0 ? value : undefined;
 }
-function writeArchiveSidecar(sidecarPath, frontmatter, body) {
+function writeArchiveSidecar(root, sidecarPath, frontmatter, body) {
+    (0, filesystem_authority_1.atomicReplaceContainedFile)({ root, relativePath: toPosixPath(path_1.default.relative(root, sidecarPath)) }, formatArchiveSidecar(frontmatter, body));
+}
+function formatArchiveSidecar(frontmatter, body) {
     const lines = (0, frontmatter_1.formatFrontmatter)(frontmatter);
     const content = ["---", ...lines, "---", body.trimStart()].join("\n");
-    (0, atomic_1.atomicWriteFile)(sidecarPath, content.endsWith("\n") ? content : `${content}\n`);
+    return content.endsWith("\n") ? content : `${content}\n`;
 }
 function verifyArchiveSidecar(root, ws, sidecarPath) {
     const relativePath = toPosixPath(path_1.default.relative(root, sidecarPath));
@@ -302,18 +324,28 @@ function runArchiveAddCommandLocked(options) {
     const visibility = (0, visibility_1.normalizeVisibility)(options.visibility);
     const today = (0, date_1.formatDate)(options.now ?? new Date());
     const archiveDir = path_1.default.resolve(options.root, workspace.path, workspace.mdkg_dir, "archive", id);
+    const archiveRelativeDir = (0, workspace_path_1.workspaceDocumentRelativePath)(workspace.path, workspace.mdkg_dir, "archive", id);
     const rawDir = path_1.default.join(archiveDir, "source");
     const rawPath = path_1.default.join(rawDir, basename);
     const zipPath = path_1.default.join(archiveDir, `${basename}.zip`);
     const sidecarPath = path_1.default.join(archiveDir, `${basename}.md`);
-    if (fs_1.default.existsSync(sidecarPath)) {
+    const sidecarRelativePath = `${archiveRelativeDir}/${basename}.md`;
+    const rawRelativePath = `${archiveRelativeDir}/source/${basename}`;
+    const zipRelativePath = `${archiveRelativeDir}/${basename}.zip`;
+    if ((0, filesystem_authority_1.containedPathExists)({ root: options.root, relativePath: sidecarRelativePath })) {
         throw new errors_1.UsageError(`archive sidecar already exists: ${path_1.default.relative(options.root, sidecarPath)}`);
     }
-    fs_1.default.mkdirSync(rawDir, { recursive: true });
-    fs_1.default.copyFileSync(sourcePath, rawPath);
-    const rawData = fs_1.default.readFileSync(rawPath);
+    for (const [relativePath, operation] of [
+        [rawRelativePath, "create"],
+        [zipRelativePath, "replace"],
+        [sidecarRelativePath, "create"],
+    ]) {
+        (0, filesystem_authority_1.withContainedPathSink)({ root: options.root, relativePath, operation, createParents: true }, () => undefined);
+    }
+    const rawData = fs_1.default.readFileSync(sourcePath);
+    (0, filesystem_authority_1.writeContainedFileExclusive)({ root: options.root, relativePath: rawRelativePath }, rawData);
     const zipData = (0, zip_1.createDeterministicZip)(basename, rawData);
-    (0, atomic_1.atomicWriteFile)(zipPath, zipData);
+    (0, filesystem_authority_1.atomicReplaceContainedFile)({ root: options.root, relativePath: zipRelativePath }, zipData);
     const frontmatter = {
         id,
         type: "archive",
@@ -339,7 +371,7 @@ function runArchiveAddCommandLocked(options) {
         created: today,
         updated: today,
     };
-    writeArchiveSidecar(sidecarPath, frontmatter, ["# Archive Entry", "", `Archived ${archiveKind}: ${basename}`, "", "# Provenance", "", "Copied from local workspace input."].join("\n"));
+    writeArchiveSidecar(options.root, sidecarPath, frontmatter, ["# Archive Entry", "", `Archived ${archiveKind}: ${basename}`, "", "# Provenance", "", "Copied from local workspace input."].join("\n"));
     maybeReindex(options.root);
     (0, event_support_1.appendAutomaticEvent)({
         root: options.root,
@@ -425,36 +457,137 @@ function runArchiveVerifyCommand(options) {
         throw new errors_1.ValidationError("archive verification failed");
     }
 }
-function runArchiveCompressCommandLocked(options) {
-    if (!options.all && !options.id) {
-        throw new errors_1.UsageError("archive compress requires <id-or-archive-uri> or --all");
+function isReadOnlyArchiveProjection(config, node) {
+    return Boolean(node.source?.imported ||
+        node.source?.read_only ||
+        config.subgraphs[node.source?.subgraph_alias ?? node.ws]);
+}
+function readOnlyArchiveError(node) {
+    const alias = node.source?.subgraph_alias ?? node.ws;
+    return new errors_1.ValidationError(`cannot compress read-only archive ${node.qid} from imported workspace ${alias}; ` +
+        "run compression in the source workspace and refresh the subgraph bundle");
+}
+function readOnlyWorkspaceError(alias) {
+    return new errors_1.ValidationError(`cannot compress archives in read-only imported workspace ${alias}; ` +
+        "run compression in the source workspace and refresh the subgraph bundle");
+}
+function assertWritableArchiveOwner(config, node) {
+    if (isReadOnlyArchiveProjection(config, node)) {
+        throw readOnlyArchiveError(node);
     }
-    const config = (0, config_1.loadConfig)(options.root);
-    const { index } = (0, index_cache_1.loadIndex)({ root: options.root, config });
-    const nodes = options.all
-        ? Object.values(index.nodes).filter((node) => node.type === "archive")
-        : [resolveArchiveNode(options.root, String(options.id), options.ws)];
-    const updated = [];
-    const today = (0, date_1.formatDate)(options.now ?? new Date());
-    for (const node of nodes) {
-        const { sidecarPath, rawPath, zipPath } = archiveNodePaths(options.root, node);
-        if (!fs_1.default.existsSync(rawPath)) {
-            throw new errors_1.NotFoundError(`raw archive file missing for ${node.qid}: ${path_1.default.relative(options.root, rawPath)}`);
+    const workspace = config.workspaces[node.ws];
+    if (!workspace) {
+        throw new errors_1.ValidationError(`archive ${node.qid} has no configured local workspace owner`);
+    }
+    if (!workspace.enabled) {
+        throw new errors_1.ValidationError(`archive workspace ${node.ws} is disabled and not writable`);
+    }
+    const archiveRoot = (0, workspace_path_1.workspaceDocumentRelativePath)(workspace.path, workspace.mdkg_dir, "archive");
+    const nodePath = toPosixPath(node.path);
+    if (!nodePath.startsWith(`${archiveRoot}/`)) {
+        throw new errors_1.ValidationError(`archive ${node.qid} path is outside its configured local archive root: ${archiveRoot}`);
+    }
+}
+function resolveArchiveNodeFromIndex(index, id, ws) {
+    const target = archiveTargetFromInput(id, ws);
+    const qid = `${target.workspace}:${target.id}`;
+    const node = index.nodes[qid];
+    if (!node || node.type !== "archive") {
+        throw new errors_1.NotFoundError(`archive not found: ${id}`);
+    }
+    return node;
+}
+function selectArchiveCompressionNodes(options, config, index) {
+    if (options.all && options.id) {
+        throw new errors_1.UsageError("archive compress accepts either <id-or-archive-uri-or-qid> or --all, not both");
+    }
+    const requestedWorkspace = options.ws ? normalizeWorkspace(options.ws) : null;
+    const excluded = [];
+    let nodes;
+    if (options.all) {
+        if (requestedWorkspace && config.subgraphs[requestedWorkspace]) {
+            throw readOnlyWorkspaceError(requestedWorkspace);
         }
-        const rawData = fs_1.default.readFileSync(rawPath);
-        const zipData = (0, zip_1.createDeterministicZip)(path_1.default.basename(rawPath), rawData);
-        (0, atomic_1.atomicWriteFile)(zipPath, zipData);
-        const parsed = (0, frontmatter_1.parseFrontmatter)(fs_1.default.readFileSync(sidecarPath, "utf8"), sidecarPath);
-        const nextFrontmatter = {
-            ...parsed.frontmatter,
-            byte_size: String(rawData.length),
-            sha256: (0, archive_integrity_1.hashArchiveBuffer)(rawData),
-            compressed_sha256: (0, archive_integrity_1.hashArchiveBuffer)(zipData),
-            ingest_status: "compressed",
-            updated: today,
-        };
-        writeArchiveSidecar(sidecarPath, nextFrontmatter, parsed.body);
-        updated.push({
+        if (requestedWorkspace) {
+            const workspace = config.workspaces[requestedWorkspace];
+            if (!workspace) {
+                throw new errors_1.NotFoundError(`workspace not found: ${requestedWorkspace}`);
+            }
+            if (!workspace.enabled) {
+                throw new errors_1.ValidationError(`archive workspace ${requestedWorkspace} is disabled and not writable`);
+            }
+        }
+        nodes = Object.values(index.nodes)
+            .filter((node) => node.type === "archive")
+            .sort((a, b) => a.qid.localeCompare(b.qid))
+            .filter((node) => {
+            if (requestedWorkspace && node.ws !== requestedWorkspace) {
+                return false;
+            }
+            if (isReadOnlyArchiveProjection(config, node)) {
+                if (!requestedWorkspace) {
+                    excluded.push({
+                        workspace: node.ws,
+                        qid: node.qid,
+                        reason: "read_only_imported_subgraph",
+                    });
+                }
+                return false;
+            }
+            assertWritableArchiveOwner(config, node);
+            return true;
+        });
+    }
+    else {
+        const node = resolveArchiveNodeFromIndex(index, String(options.id), options.ws);
+        assertWritableArchiveOwner(config, node);
+        nodes = [node];
+    }
+    return {
+        nodes,
+        selection: {
+            requested_workspace: requestedWorkspace,
+            selected_workspaces: Array.from(new Set(nodes.map((node) => node.ws))).sort(),
+            excluded_read_only: excluded.sort((a, b) => a.qid.localeCompare(b.qid)),
+        },
+    };
+}
+function preflightArchiveCompression(root, node, today) {
+    for (const attribute of ["stored_path", "compressed_path"]) {
+        if (typeof node.attributes[attribute] !== "string" || !String(node.attributes[attribute]).trim()) {
+            throw new errors_1.ValidationError(`${node.qid}: ${attribute} is required before archive compression`);
+        }
+    }
+    const { sidecarPath, rawPath, zipPath } = archiveNodePaths(root, node);
+    const rawRelativePath = toPosixPath(path_1.default.relative(root, rawPath));
+    const zipRelativePath = toPosixPath(path_1.default.relative(root, zipPath));
+    const sidecarRelativePath = toPosixPath(path_1.default.relative(root, sidecarPath));
+    for (const relativePath of [rawRelativePath, zipRelativePath, sidecarRelativePath]) {
+        (0, filesystem_authority_1.withContainedPathSink)({ root, relativePath, operation: relativePath === rawRelativePath ? "read" : "replace" }, () => undefined);
+    }
+    if (!(0, filesystem_authority_1.containedPathExists)({ root, relativePath: rawRelativePath })) {
+        throw new errors_1.NotFoundError(`raw archive file missing for ${node.qid}: ${path_1.default.relative(root, rawPath)}`);
+    }
+    const rawData = (0, filesystem_authority_1.readContainedFile)({ root, relativePath: rawRelativePath }, null);
+    const parsed = (0, frontmatter_1.parseFrontmatter)((0, filesystem_authority_1.readContainedFile)({ root, relativePath: sidecarRelativePath }), sidecarPath);
+    if (parsed.frontmatter.type !== "archive" || parsed.frontmatter.id !== node.id) {
+        throw new errors_1.ValidationError(`${node.qid}: archive sidecar identity changed before compression`);
+    }
+    const zipData = (0, zip_1.createDeterministicZip)(path_1.default.basename(rawPath), rawData);
+    const nextFrontmatter = {
+        ...parsed.frontmatter,
+        byte_size: String(rawData.length),
+        sha256: (0, archive_integrity_1.hashArchiveBuffer)(rawData),
+        compressed_sha256: (0, archive_integrity_1.hashArchiveBuffer)(zipData),
+        ingest_status: "compressed",
+        updated: today,
+    };
+    return {
+        zipRelativePath,
+        sidecarRelativePath,
+        zipData,
+        sidecarContent: formatArchiveSidecar(nextFrontmatter, parsed.body),
+        receipt: {
             workspace: node.ws,
             id: node.id,
             qid: node.qid,
@@ -465,14 +598,35 @@ function runArchiveCompressCommandLocked(options) {
             sha256: String(nextFrontmatter.sha256),
             compressed_sha256: String(nextFrontmatter.compressed_sha256),
             visibility: (0, visibility_1.normalizeVisibility)(typeof nextFrontmatter.visibility === "string" ? nextFrontmatter.visibility : undefined, "archive visibility"),
-        });
+        },
+    };
+}
+function runArchiveCompressCommandLocked(options) {
+    if (!options.all && !options.id) {
+        throw new errors_1.UsageError("archive compress requires <id-or-archive-uri-or-qid> or --all");
+    }
+    const config = (0, config_1.loadConfig)(options.root);
+    const { index } = (0, index_cache_1.loadIndex)({ root: options.root, config });
+    const { nodes, selection } = selectArchiveCompressionNodes(options, config, index);
+    const today = (0, date_1.formatDate)(options.now ?? new Date());
+    const plans = nodes.map((node) => preflightArchiveCompression(options.root, node, today));
+    const updated = [];
+    for (const plan of plans) {
+        (0, filesystem_authority_1.atomicReplaceContainedFile)({ root: options.root, relativePath: plan.zipRelativePath }, plan.zipData);
+        (0, filesystem_authority_1.atomicReplaceContainedFile)({ root: options.root, relativePath: plan.sidecarRelativePath }, plan.sidecarContent);
+        updated.push(plan.receipt);
     }
     maybeReindex(options.root);
     if (options.json) {
-        console.log(JSON.stringify({ action: "compressed", count: updated.length, archives: updated }, null, 2));
+        console.log(JSON.stringify({ action: "compressed", count: updated.length, archives: updated, selection }, null, 2));
         return;
     }
     console.log(`archive compressed: ${updated.length}`);
+    console.log(`selected workspaces: ${selection.selected_workspaces.join(", ") || "none"}`);
+    console.log(`excluded read-only projections: ${selection.excluded_read_only.length}`);
+    for (const excluded of selection.excluded_read_only) {
+        console.log(`  - ${excluded.qid} (${excluded.reason})`);
+    }
 }
 function withArchiveLock(root, fn) {
     const config = (0, config_1.loadConfig)(root);

package/dist/commands/bundle.js

@@ -3,6 +3,8 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
     return (mod && mod.__esModule) ? mod : { "default": mod };
 };
 Object.defineProperty(exports, "__esModule", { value: true });
+exports.validateBundleManifest = validateBundleManifest;
+exports.bundlePayloadErrors = bundlePayloadErrors;
 exports.sha256Buffer = sha256Buffer;
 exports.buildBundle = buildBundle;
 exports.parseBundle = parseBundle;
@@ -16,6 +18,8 @@ const fs_1 = __importDefault(require("fs"));
 const path_1 = __importDefault(require("path"));
 const child_process_1 = require("child_process");
 const config_1 = require("../core/config");
+const filesystem_authority_1 = require("../core/filesystem_authority");
+const atomic_1 = require("../util/atomic");
 const capabilities_indexer_1 = require("../graph/capabilities_indexer");
 const subgraphs_1 = require("../graph/subgraphs");
 const indexer_1 = require("../graph/indexer");
@@ -31,6 +35,168 @@ const INDEX_ENTRY_PATHS = {
     skills: ".mdkg/index/skills.json",
     capabilities: ".mdkg/index/capabilities.json",
 };
+const REQUIRED_INDEX_PATHS = Object.values(INDEX_ENTRY_PATHS);
+const SHA256_PATTERN = /^sha256:[a-f0-9]{64}$/;
+function isRecord(value) {
+    return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function manifestError(message) {
+    throw new errors_1.ValidationError(`bundle manifest invalid: ${message}`);
+}
+function manifestString(value, field) {
+    if (typeof value !== "string" || value.length === 0) {
+        manifestError(`${field} must be a non-empty string`);
+    }
+    return value;
+}
+function manifestHash(value, field) {
+    const hash = manifestString(value, field);
+    if (!SHA256_PATTERN.test(hash)) {
+        manifestError(`${field} must be a sha256 digest`);
+    }
+    return hash;
+}
+function safeManifestPath(value, field) {
+    const candidate = manifestString(value, field).replace(/\\/g, "/");
+    const parts = candidate.split("/");
+    if (path_1.default.posix.isAbsolute(candidate) || parts.some((part) => part === "" || part === "." || part === "..")) {
+        manifestError(`${field} must be a safe relative path`);
+    }
+    return candidate;
+}
+function validateBundleManifest(value) {
+    if (!isRecord(value))
+        manifestError("root must be an object");
+    if (value.manifest_version !== 1)
+        manifestError("manifest_version must be 1");
+    if (value.tool !== "mdkg")
+        manifestError("tool must be mdkg");
+    const mdkgVersion = manifestString(value.mdkg_version, "mdkg_version");
+    if (value.profile !== "private" && value.profile !== "public") {
+        manifestError("profile must be private or public");
+    }
+    if (!Array.isArray(value.selected_workspaces) || value.selected_workspaces.length === 0) {
+        manifestError("selected_workspaces must be a non-empty string array");
+    }
+    const selectedWorkspaces = value.selected_workspaces.map((item, index) => manifestString(item, `selected_workspaces[${index}]`));
+    if (new Set(selectedWorkspaces).size !== selectedWorkspaces.length) {
+        manifestError("selected_workspaces must not contain duplicates");
+    }
+    if (!isRecord(value.source))
+        manifestError("source must be an object");
+    const repo = manifestString(value.source.repo, "source.repo");
+    const gitHead = value.source.git_head;
+    if (gitHead !== null && (typeof gitHead !== "string" || !/^[a-f0-9]{40}$/.test(gitHead))) {
+        manifestError("source.git_head must be null or a 40-character lowercase Git SHA");
+    }
+    if (typeof value.source.dirty !== "boolean")
+        manifestError("source.dirty must be boolean");
+    const sourceTreeHash = manifestHash(value.source_tree_hash, "source_tree_hash");
+    const bundleHash = manifestHash(value.bundle_hash, "bundle_hash");
+    if (!Number.isSafeInteger(value.file_count) || Number(value.file_count) < 0) {
+        manifestError("file_count must be a non-negative safe integer");
+    }
+    if (!isRecord(value.index_hashes))
+        manifestError("index_hashes must be an object");
+    const indexHashes = {};
+    for (const [rawPath, rawHash] of Object.entries(value.index_hashes)) {
+        const indexPath = safeManifestPath(rawPath, "index_hashes key");
+        indexHashes[indexPath] = manifestHash(rawHash, `index_hashes.${indexPath}`);
+    }
+    for (const requiredPath of REQUIRED_INDEX_PATHS) {
+        if (!indexHashes[requiredPath])
+            manifestError(`index_hashes missing required index ${requiredPath}`);
+    }
+    if (!Array.isArray(value.files))
+        manifestError("files must be an array");
+    const seenPaths = new Set();
+    const files = value.files.map((rawFile, index) => {
+        if (!isRecord(rawFile))
+            manifestError(`files[${index}] must be an object`);
+        const filePath = safeManifestPath(rawFile.path, `files[${index}].path`);
+        if (seenPaths.has(filePath))
+            manifestError(`duplicate file path: ${filePath}`);
+        seenPaths.add(filePath);
+        if (rawFile.kind !== "authored" && rawFile.kind !== "archive_cache" && rawFile.kind !== "generated_index") {
+            manifestError(`files[${index}].kind is invalid`);
+        }
+        if (!Number.isSafeInteger(rawFile.size) || Number(rawFile.size) < 0) {
+            manifestError(`files[${index}].size must be a non-negative safe integer`);
+        }
+        const workspace = rawFile.workspace === undefined
+            ? undefined
+            : manifestString(rawFile.workspace, `files[${index}].workspace`);
+        const visibility = rawFile.visibility;
+        if (visibility !== undefined && visibility !== "private" && visibility !== "internal" && visibility !== "public") {
+            manifestError(`files[${index}].visibility is invalid`);
+        }
+        return {
+            path: filePath,
+            kind: rawFile.kind,
+            ...(workspace ? { workspace } : {}),
+            ...(visibility ? { visibility } : {}),
+            size: Number(rawFile.size),
+            sha256: manifestHash(rawFile.sha256, `files[${index}].sha256`),
+        };
+    });
+    if (Number(value.file_count) !== files.length)
+        manifestError("file_count does not match files length");
+    for (const requiredPath of REQUIRED_INDEX_PATHS) {
+        const row = files.find((file) => file.path === requiredPath);
+        if (!row || row.kind !== "generated_index") {
+            manifestError(`files missing required generated index ${requiredPath}`);
+        }
+        if (row.sha256 !== indexHashes[requiredPath]) {
+            manifestError(`index hash does not match file row for ${requiredPath}`);
+        }
+    }
+    return {
+        manifest_version: 1,
+        tool: "mdkg",
+        mdkg_version: mdkgVersion,
+        profile: value.profile,
+        selected_workspaces: selectedWorkspaces,
+        source: { repo, git_head: gitHead, dirty: value.source.dirty },
+        source_tree_hash: sourceTreeHash,
+        bundle_hash: bundleHash,
+        file_count: files.length,
+        index_hashes: indexHashes,
+        files,
+    };
+}
+function bundlePayloadErrors(entries, manifest) {
+    const errors = [];
+    const manifestPaths = new Set(manifest.files.map((file) => file.path));
+    for (const entryPath of entries.keys()) {
+        if (entryPath !== MANIFEST_ENTRY && !manifestPaths.has(entryPath))
+            errors.push(`unexpected bundle entry: ${entryPath}`);
+    }
+    for (const file of manifest.files) {
+        const data = entries.get(file.path);
+        if (!data) {
+            errors.push(`missing bundle entry: ${file.path}`);
+            continue;
+        }
+        if (sha256Buffer(data) !== file.sha256)
+            errors.push(`hash mismatch for ${file.path}`);
+        if (data.length !== file.size)
+            errors.push(`size mismatch for ${file.path}`);
+    }
+    for (const requiredPath of REQUIRED_INDEX_PATHS) {
+        const data = entries.get(requiredPath);
+        if (!data)
+            continue;
+        if (sha256Buffer(data) !== manifest.index_hashes[requiredPath]) {
+            errors.push(`generated index hash mismatch: ${requiredPath}`);
+        }
+    }
+    if (hashManifestFiles(manifest.files.filter((file) => file.kind !== "generated_index")) !== manifest.source_tree_hash) {
+        errors.push("source_tree_hash mismatch");
+    }
+    if (hashManifestFiles(manifest.files) !== manifest.bundle_hash)
+        errors.push("bundle_hash mismatch");
+    return Array.from(new Set(errors));
+}
 function toPosixPath(value) {
     return value.split(path_1.default.sep).join("/");
 }
@@ -519,9 +685,8 @@ function buildBundle(options) {
     };
 }
 function parseBundle(bundlePath) {
-    const zip = fs_1.default.readFileSync(bundlePath);
     const entries = new Map();
-    for (const entry of (0, zip_1.readZipEntries)(zip)) {
+    for (const entry of (0, zip_1.readZipFileEntries)(bundlePath)) {
         entries.set(entry.name, entry.data);
     }
     const manifestData = entries.get(MANIFEST_ENTRY);
@@ -529,10 +694,7 @@ function parseBundle(bundlePath) {
         throw new errors_1.ValidationError("bundle manifest missing");
     }
     try {
-        return {
-            entries,
-            manifest: JSON.parse(manifestData.toString("utf8")),
-        };
+        return { entries, manifest: validateBundleManifest(JSON.parse(manifestData.toString("utf8"))) };
     }
     catch (err) {
         const message = err instanceof Error ? err.message : String(err);
@@ -562,25 +724,8 @@ function verifyBundle(root, bundlePath) {
             stale_paths: [],
         };
     }
-    const manifestPaths = new Set(manifest.files.map((file) => file.path));
-    for (const entryPath of entries.keys()) {
-        if (entryPath !== MANIFEST_ENTRY && !manifestPaths.has(entryPath)) {
-            errors.push(`unexpected bundle entry: ${entryPath}`);
-        }
-    }
+    errors.push(...bundlePayloadErrors(entries, manifest));
     for (const file of manifest.files) {
-        const data = entries.get(file.path);
-        if (!data) {
-            errors.push(`missing bundle entry: ${file.path}`);
-            continue;
-        }
-        const hash = sha256Buffer(data);
-        if (hash !== file.sha256) {
-            errors.push(`hash mismatch for ${file.path}`);
-        }
-        if (data.length !== file.size) {
-            errors.push(`size mismatch for ${file.path}`);
-        }
         if (file.kind !== "generated_index") {
             const sourcePath = path_1.default.resolve(root, file.path);
             if (!fs_1.default.existsSync(sourcePath)) {
@@ -592,24 +737,6 @@ function verifyBundle(root, bundlePath) {
             }
         }
     }
-    for (const [indexPath, expectedHash] of Object.entries(manifest.index_hashes)) {
-        const data = entries.get(indexPath);
-        if (!data) {
-            errors.push(`missing generated index: ${indexPath}`);
-            continue;
-        }
-        if (sha256Buffer(data) !== expectedHash) {
-            errors.push(`generated index hash mismatch: ${indexPath}`);
-        }
-    }
-    const computedSourceHash = hashManifestFiles(manifest.files.filter((file) => file.kind !== "generated_index"));
-    if (computedSourceHash !== manifest.source_tree_hash) {
-        errors.push("source_tree_hash mismatch");
-    }
-    const computedBundleHash = hashManifestFiles(manifest.files);
-    if (computedBundleHash !== manifest.bundle_hash) {
-        errors.push("bundle_hash mismatch");
-    }
     const currentHead = gitOutput(root, ["rev-parse", "HEAD"]);
     if (manifest.source.git_head && currentHead && manifest.source.git_head !== currentHead) {
         stalePaths.push("git:HEAD");
@@ -645,8 +772,17 @@ function bundleSummary(manifest, bundlePath, zipSha256) {
 }
 function runBundleCreateCommand(options) {
     const result = buildBundle(options);
-    fs_1.default.mkdirSync(path_1.default.dirname(result.outputPath), { recursive: true });
-    fs_1.default.writeFileSync(result.outputPath, result.zip);
+    if (options.output && path_1.default.isAbsolute(options.output)) {
+        const external = (0, filesystem_authority_1.authorizeOperatorSelectedExternalPath)({
+            operation: "replace",
+            path: options.output,
+            operatorSelected: true,
+        });
+        (0, atomic_1.atomicWriteFile)(external.absolutePath, result.zip);
+    }
+    else {
+        (0, filesystem_authority_1.atomicReplaceContainedFile)({ root: options.root, relativePath: path_1.default.relative(options.root, result.outputPath).split(path_1.default.sep).join("/") }, result.zip);
+    }
     const receipt = {
         action: "created",
         ...bundleSummary(result.manifest, path_1.default.relative(options.root, result.outputPath), result.zipSha256),

package/dist/commands/capability.js

@@ -39,6 +39,7 @@ function loadCapabilityRecords(options) {
         config,
         useCache: !options.noCache,
         allowReindex: !options.noReindex,
+        persistReindex: false,
     });
     if (stale && !rebuilt && !options.noCache) {
         console.error("warning: capabilities index is stale; run mdkg index to refresh");

package/dist/commands/checkpoint.js

@@ -6,15 +6,15 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.CHECKPOINT_KINDS = void 0;
 exports.createCheckpoint = createCheckpoint;
 exports.runCheckpointNewCommand = runCheckpointNewCommand;
-const fs_1 = __importDefault(require("fs"));
 const path_1 = __importDefault(require("path"));
 const config_1 = require("../core/config");
+const filesystem_authority_1 = require("../core/filesystem_authority");
+const workspace_path_1 = require("../core/workspace_path");
 const index_cache_1 = require("../graph/index_cache");
 const loader_1 = require("../templates/loader");
 const date_1 = require("../util/date");
 const errors_1 = require("../util/errors");
 const id_1 = require("../util/id");
-const atomic_1 = require("../util/atomic");
 const lock_1 = require("../util/lock");
 const sqlite_index_1 = require("../graph/sqlite_index");
 const event_support_1 = require("./event_support");
@@ -253,7 +253,8 @@ function createCheckpointLocked(options) {
     const wsEntry = config.workspaces[ws];
     const workDir = path_1.default.resolve(options.root, wsEntry.path, wsEntry.mdkg_dir, "work");
     const filePath = path_1.default.join(workDir, fileName);
-    if (fs_1.default.existsSync(filePath)) {
+    const relativeFilePath = (0, workspace_path_1.workspaceDocumentRelativePath)(wsEntry.path, wsEntry.mdkg_dir, "work", fileName);
+    if ((0, filesystem_authority_1.containedPathExists)({ root: options.root, relativePath: relativeFilePath })) {
         throw new errors_1.UsageError(`checkpoint file already exists: ${path_1.default.relative(options.root, filePath)}`);
     }
     const relates = parseCsvList(options.relates).map((value) => normalizeIdRef(value, "--relates"));
@@ -279,9 +280,9 @@ function createCheckpointLocked(options) {
         relates,
         scope,
     });
-    const rendered = replaceRenderedBody(content, checkpointBody(kind));
+    const rendered = replaceRenderedBody(content, options.body ?? checkpointBody(kind));
     try {
-        (0, atomic_1.writeFileExclusive)(filePath, rendered);
+        (0, filesystem_authority_1.writeContainedFileExclusive)({ root: options.root, relativePath: relativeFilePath }, rendered);
     }
     catch (err) {
         const code = typeof err === "object" && err !== null && "code" in err ? String(err.code) : "";