mrplex 0.0.1

package/dist/fixtures/starship/equipment/plasma-manifold-3.md

@@ -0,0 +1,15 @@
+---
+title: Number Three Plasma Manifold
+type: equipment
+status: damaged
+deck: 7
+maintainer: /crew/bexley-orr.md
+related:
+  - /equipment/coolant-loop-b.md
+---
+
+# Number Three Plasma Manifold
+
+The Meridian's chronic invalid. Manifold three has been rebuilt twice and derated once; it carries the ship's aft power distribution and it does not like to. Under sustained load it runs hot enough that the [[equipment/coolant-loop-b|B coolant loop]] can no longer keep pace, which is what ended the [[missions/the-cinder-run|Cinder Run]].
+
+Thorne has flagged it unfit for combat maneuvering. Orr keeps it alive shift by shift and swears it makes a sound, just below hearing, when it is about to misbehave.

package/dist/fixtures/starship/equipment/shuttle-corvid.md

@@ -0,0 +1,13 @@
+---
+title: Shuttle Corvid
+type: equipment
+status: offline
+deck: 5
+maintainer: /crew/dax-thorne.md
+---
+
+# Shuttle Corvid
+
+One of two shuttles aboard, currently offline pending a part that is three supply runs overdue. The Corvid carried the boarding team out to the derelict during the [[encounters/the-hollow-signal|Hollow Signal]] and came back with one empty seat, which the crew have not forgotten.
+
+There is a quiet, unofficial reluctance to fly it again. Thorne insists the reluctance is about the missing part and nothing else, and no one argues with him out loud.

package/dist/fixtures/starship/logs/marsh-4419-1.md

@@ -0,0 +1,13 @@
+---
+title: Science Log — Marsh, 4419.1
+type: log
+stardate: 4419.1
+author: /crew/isolde-marsh.md
+mission: /missions/the-drift-choir.md
+---
+
+# Science Log — Marsh, 4419.1
+
+Day forty of listening to the [[encounters/the-drift-choir|Choir]] and I am more certain than ever: this is language, not weather. The tones resolve into recurring structures — call them phrases — that answer one another across the nebula with a latency that tracks distance exactly. Something is talking to itself, and it is very large, and it is not in a hurry.
+
+I have started singing back. Simple intervals, held long. This morning the Choir held the same interval back to me for nine full seconds before letting it drift. Doctor [[crew/quill-vasquez|Vasquez]] wants me to rest; I told them I would rest when the conversation pauses. It has not paused in forty days.

package/dist/fixtures/starship/logs/okonkwo-4415-1.md

@@ -0,0 +1,13 @@
+---
+title: Command Log — Okonkwo, 4415.1
+type: log
+stardate: 4415.1
+author: /crew/aria-okonkwo.md
+mission: /missions/the-hollow-signal.md
+---
+
+# Command Log — Okonkwo, 4415.1
+
+The boarding team is back. Halloway is not. I am writing this while the count is still fresh because I do not trust my memory of it to stay honest.
+
+Everything on the derelict was working. Everything except the crew, who were simply gone — no bodies, no signs of struggle, no breach. [[crew/soren-halloway|Halloway]] reported a sealed compartment on the lower deck, said he was going to open it, and then said nothing at all. We searched for six hours. The [[encounters/the-hollow-signal|signal]] cut out the instant we broke orbit, as if it had gotten what it came for. I have opened an inquiry. I do not expect it to close.

package/dist/fixtures/starship/logs/orr-4413-1.md

@@ -0,0 +1,13 @@
+---
+title: Engineering Log — Orr, 4413.1
+type: log
+stardate: 4413.1
+author: /crew/bexley-orr.md
+mission: /missions/the-cinder-run.md
+---
+
+# Engineering Log — Orr, 4413.1
+
+Third pass through the debris field and the [[equipment/plasma-manifold-3|manifold]] is screaming. Not literally — but the harmonic is back, the one just under hearing that I keep trying to get someone to believe in. Coolant temps on [[equipment/coolant-loop-b|Loop B]] climbed past redline on the second trip and never fully came down before we went in again.
+
+Commander [[crew/aria-okonkwo|Okonkwo]] wanted a fourth run. Chief [[crew/dax-thorne|Thorne]] said no with a word I will not enter into the log. We pulled out. I keep thinking about the nine we did not reach. I have never seen the chief so quiet.

package/dist/fixtures/starship/logs/orr-4420-1.md

@@ -0,0 +1,12 @@
+---
+title: Engineering Log — Orr, 4420.1
+type: log
+stardate: 4420.1
+author: /crew/bexley-orr.md
+---
+
+# Engineering Log — Orr, 4420.1
+
+Quiet shift. The [[equipment/plasma-manifold-3|manifold]] behaved, which always makes me more nervous than when it doesn't. I ran the full diagnostic twice and both times it came back clean, and I do not believe it.
+
+I have started keeping a private tally of the sound — the sub-audible harmonic — against the load curve. If I am right, it leads the temperature spike by about ninety seconds. Ninety seconds is enough to shed load before Loop B ever notices. Nobody has asked me to do this. I am doing it anyway. If I am wrong it is a hobby; if I am right it is a warning system.

package/dist/fixtures/starship/logs/thorne-4413-2.md

@@ -0,0 +1,13 @@
+---
+title: Engineering Log — Thorne, 4413.2
+type: log
+stardate: 4413.2
+author: /crew/dax-thorne.md
+mission: /missions/the-cinder-run.md
+---
+
+# Engineering Log — Thorne, 4413.2
+
+For the record, since the record will be read: I aborted the fourth run on the Cinder Run over the first officer's stated objection. The [[equipment/plasma-manifold-3|number three manifold]] was past the point where I would trust it to hold formation, let alone thread a collapsing nursery a fourth time.
+
+I am formally requesting the manifold be listed unfit for combat maneuvering until it is replaced, not rebuilt. I have made this request before. I am making it again. [[crew/bexley-orr|Orr]] logged the coolant numbers; they are not opinions. If command wants a ship that can do this work, command can find me a manifold that is not held together by my own stubbornness and a prayer.

package/dist/fixtures/starship/logs/vance-4419-2.md

@@ -0,0 +1,13 @@
+---
+title: Captain's Log — Vance, 4419.2
+type: log
+stardate: 4419.2
+author: /crew/kestrel-vance.md
+mission: /missions/the-drift-choir.md
+---
+
+# Captain's Log — Vance, 4419.2
+
+[[crew/isolde-marsh|Marsh]] sang to the Choir today and it sang back. I watched her face when it held the note. Whatever we are doing out here, that was the reason for all of it — the surveys, the derelicts, the long empty months. One held interval, nine seconds, from a mind the size of a nebula.
+
+[[crew/aria-okonkwo|Okonkwo]] has, correctly, filed her concerns: we do not know what the Choir wants, what prolonged contact does to the crew, or how to leave gracefully if we must. She is right, as she usually is. I have logged her objection and overruled it, as I usually do. We stay. Curiosity outranks fear until fear can prove its case, and it has not proven its case yet.

package/dist/fixtures/starship/misc/the-galley-ficus.md

@@ -0,0 +1,11 @@
+---
+title: The Galley Ficus
+type: note
+status: active
+---
+
+# The Galley Ficus
+
+There is a ficus in the galley. No one remembers bringing it aboard, and no manifest lists it. It has survived two refits, one hull breach on the far side of the ship, and the collective neglect of a hundred and twenty people who assume someone else is watering it.
+
+The crew have adopted it as a mascot and a superstition: as long as the ficus lives, the Meridian comes home. So far, the ficus has been right. It links to nothing and nothing depends on it, which is exactly why the crew love it.

package/dist/fixtures/starship/missions/the-cinder-run.md

@@ -0,0 +1,17 @@
+---
+title: Mission — The Cinder Run
+type: mission
+status: aborted
+stardate: 4413.4
+classification: rescue
+commander: /crew/aria-okonkwo.md
+crew:
+  - /crew/dax-thorne.md
+  - /crew/bexley-orr.md
+---
+
+# The Cinder Run
+
+A mining outpost in a collapsing stellar nursery called for evacuation. The Meridian ran three trips through the debris field before the [[equipment/plasma-manifold-3|number three manifold]] overheated badly enough that Thorne pulled the ship out over Okonkwo's objection.
+
+Forty-one colonists were recovered; nine were not. Okonkwo filed the mission as aborted and requested the manifold be listed unfit for combat maneuvering. The request is still pending. The [[logs/orr-4413-1|shift log]] from that run is required reading for new engineering crew.

package/dist/fixtures/starship/missions/the-drift-choir.md

@@ -0,0 +1,17 @@
+---
+title: Mission — Answering the Drift Choir
+type: mission
+status: active
+stardate: 4419.0
+classification: contact
+commander: /crew/kestrel-vance.md
+crew:
+  - /crew/isolde-marsh.md
+  - /crew/quill-vasquez.md
+---
+
+# Answering the Drift Choir
+
+An ongoing first-contact effort with a distributed intelligence that communicates in overlapping tones across a whole nebula — the [[encounters/the-drift-choir|Drift Choir]]. Marsh leads the translation work; Vasquez monitors the crew for the disorientation that prolonged exposure to the Choir's song seems to cause.
+
+The mission has no defined end state, which unsettles the crew more than any weapon could. Vance considers it the most important thing the Meridian has ever attempted.

package/dist/fixtures/starship/missions/the-hollow-signal.md

@@ -0,0 +1,17 @@
+---
+title: Mission — The Hollow Signal
+type: mission
+status: completed
+stardate: 4415.7
+classification: contact
+commander: /crew/aria-okonkwo.md
+crew:
+  - /crew/soren-halloway.md
+  - /crew/quill-vasquez.md
+---
+
+# The Hollow Signal
+
+A repeating transmission led the Meridian to a derelict vessel adrift far from any charted lane. Okonkwo commanded from the bridge while [[crew/soren-halloway|Halloway]] took a boarding team across. The derelict was intact, powered, and empty — a ship that had been abandoned mid-sentence.
+
+The team recovered logs but no crew. Halloway did not return. The mission is filed as completed because the ship came home; the [[encounters/the-hollow-signal|encounter record]] and the standing inquiry disagree with that word.

package/dist/fixtures/starship/missions/the-silent-beacon.md

@@ -0,0 +1,17 @@
+---
+title: Mission — The Silent Beacon
+type: mission
+status: completed
+stardate: 4411.2
+classification: survey
+commander: /crew/kestrel-vance.md
+crew:
+  - /crew/isolde-marsh.md
+  - /crew/dax-thorne.md
+---
+
+# The Silent Beacon
+
+A survey buoy of unknown make was broadcasting a distress pattern into empty space, on a frequency abandoned two centuries ago. The Meridian was diverted to investigate. There was no ship, no colony, no sender — only the beacon, patiently calling for help that could no longer be meaningful.
+
+Marsh eventually decoded the pattern as a star map, not a distress call. The map pointed at a system that no longer exists. Vance logged the mission as completed and the beacon as a grave marker. See the [[encounters/the-wandering-buoy|wandering buoy]] for the object itself.

package/dist/fixtures/starship/moc/crew.md

@@ -0,0 +1,19 @@
+---
+title: MOC — Crew Roster
+type: moc
+---
+
+# Crew Roster
+
+The officers of the USS Meridian.
+
+## Command
+- [[crew/kestrel-vance]]
+- [[crew/aria-okonkwo]]
+
+## Departments
+- [[crew/dax-thorne]] — engineering
+- [[crew/isolde-marsh]] — science
+- [[crew/quill-vasquez]] — medical
+- [[crew/soren-halloway]] — security
+- [[crew/bexley-orr]] — engineering

package/dist/fixtures/starship/moc/encounters.md

@@ -0,0 +1,14 @@
+---
+title: MOC — Encounter Catalog
+type: moc
+---
+
+# Encounter Catalog
+
+The things the Meridian has met, sorted by how much sleep they cost the crew.
+
+- [[encounters/the-wandering-buoy]] — artifact, harmless
+- [[encounters/the-drift-choir]] — intelligence, unknown
+- [[encounters/the-hollow-signal]] — derelict, high threat
+
+Each encounter traces back to a mission in the [[moc/missions|mission log]].

package/dist/fixtures/starship/moc/missions.md

@@ -0,0 +1,15 @@
+---
+title: MOC — Mission Log
+type: moc
+---
+
+# Mission Log
+
+Every mission the USS Meridian has undertaken, in the order it was filed.
+
+- [[missions/the-silent-beacon]] — survey, completed
+- [[missions/the-cinder-run]] — rescue, aborted
+- [[missions/the-hollow-signal]] — contact, completed
+- [[missions/the-drift-choir]] — contact, active
+
+See also the [[moc/encounters]] these missions produced.

package/dist/fixtures/starship/readme.md

@@ -0,0 +1,60 @@
+# USS Meridian — Ship's Knowledge Base
+
+A sample mrplex repository: the operational notes, crew files, mission records, encounter logs, and equipment status of a fictional survey starship. Every entry is deliberately short — one idea, one to three paragraphs, zettelkasten-style — so the repo reads as a connected graph rather than a handful of long documents.
+
+Load it into a fresh database with:
+
+```bash
+mrplex demo seed
+export MRPLEX_REPO=demo
+```
+
+It exists to exercise mrplex end to end: links, backlinks, frontmatter reference-fields, graph queries, filters, and full-text search all have something real to bite on here.
+
+## Layout
+
+- `crew/` — officer files. Frontmatter `reports_to` builds the chain of command; heavily backlinked from logs and missions (the graph's hubs).
+- `missions/` — mission records. Frontmatter `commander` and `crew` link to the officers involved.
+- `encounters/` — what the missions found. Linked from missions and logs via `mission`.
+- `equipment/` — ship systems, each with a `status` (operational / damaged / offline) and a `maintainer`.
+- `logs/` — officer logs. Prose-heavy, so they drive full-text search and produce most of the backlinks.
+- `moc/` — maps of content: hand-curated wikilink indexes that make membership queries meaningful.
+- `misc/` — a home for the deliberately-unconnected (see the ficus).
+
+## Link configuration
+
+This repo opts the following frontmatter fields into the link graph:
+
+```json
+{ "fields": ["reports_to", "commander", "crew", "author", "mission", "maintainer", "related"] }
+```
+
+Body links use wikilinks (`[[crew/kestrel-vance]]`) and inline links; frontmatter fields use repo-absolute paths (`/crew/kestrel-vance.md`).
+
+## Example queries
+
+```bash
+# Who reports directly to the captain?
+mrplex -r starship query --filter '$in_static("crew/kestrel-vance.md", "reports_to")'
+
+# Which officer does the whole ship reference? (the hubs)
+mrplex -r starship query --filter '$backlinks_static().size() >= 4'
+
+# What's broken right now?
+mrplex -r starship query --filter 'status == "damaged" || status == "offline"'
+
+# Which missions did Okonkwo command?
+mrplex -r starship query --filter '$has_static("crew/aria-okonkwo.md", "commander")'
+
+# Every mission indexed by the mission MOC
+mrplex -r starship query --filter '$in_static("moc/missions.md")'
+
+# Leaf notes that link to nothing
+mrplex -r starship query --filter '$links_static().size() == 0'
+
+# Orphans nobody references
+mrplex -r starship query --filter '!$in_static("**")'
+
+# Full-text across the logs
+mrplex -r starship query --text 'manifold coolant'
+```

package/dist/index.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/index.js

@@ -0,0 +1,3 @@
+// mrplex root — see docs/design.md
+export {};
+//# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,mCAAmC;AACnC,OAAO,EAAE,CAAC"}

package/dist/kernel/auth/glob.d.ts

@@ -0,0 +1,46 @@
+/**
+ * Gitignore-style glob matching (design §8.2).
+ *
+ * Semantics — faithful to git's gitignore(5):
+ *   `**`         matches any sequence of characters (including `/`)
+ *   `**\/`       zero or more path segments (including none)
+ *   `/**` (end)  everything strictly inside the preceding directory
+ *   `*`          matches within a path segment (no `/`)
+ *   `?`          matches a single character (no `/`)
+ *   leading `/`  anchors the pattern to the root; the `/` is not part
+ *                of the matched string
+ *   no `/` in    pattern is a basename — matches at any depth
+ *     pattern
+ *   `!glob`      negates — handled at the LIST level, not the individual glob
+ *   literals     everything else, including `.`, is a literal char
+ *
+ * Kept small on purpose: no `[abc]` character classes.
+ */
+/**
+ * Compile a single glob (WITHOUT leading `!`) to a regex source string.
+ * Returns the raw pattern (no leading/trailing anchor); wrap in `^...$`
+ * for full-string matching. Kept separate from compileGlob so callers
+ * that need the source (e.g. to hand to a SQL regexp() UDF) don't have
+ * to re-derive it from RegExp.source.
+ */
+export declare function globToRegexSource(glob: string): string;
+/**
+ * Compile a single glob (WITHOUT leading `!`) to an anchored RegExp.
+ * Callers strip `!` before calling and track the negation flag themselves.
+ */
+export declare function compileGlob(glob: string): RegExp;
+/**
+ * Does `path` match any of `globs`, honoring gitignore's "last-match-wins"
+ * negation semantics? Returns true iff the last matching pattern is a
+ * positive one; false if no pattern matches or the last match was negated.
+ *
+ * An empty `globs` array yields false (no capability).
+ */
+export declare function pathMatchesGlobs(globs: readonly string[], path: string): boolean;
+/**
+ * Repo-slug pattern matching (§8.2 — "Since slugs contain no `/`, `*` is the
+ * canonical wildcard at the repo level"). Uses the same compileGlob so the
+ * `*`/`?` semantics stay consistent, but slug patterns don't need `**` or
+ * negation.
+ */
+export declare function slugMatchesPattern(pattern: string, slug: string): boolean;

package/dist/kernel/auth/glob.js

@@ -0,0 +1,112 @@
+/**
+ * Gitignore-style glob matching (design §8.2).
+ *
+ * Semantics — faithful to git's gitignore(5):
+ *   `**`         matches any sequence of characters (including `/`)
+ *   `**\/`       zero or more path segments (including none)
+ *   `/**` (end)  everything strictly inside the preceding directory
+ *   `*`          matches within a path segment (no `/`)
+ *   `?`          matches a single character (no `/`)
+ *   leading `/`  anchors the pattern to the root; the `/` is not part
+ *                of the matched string
+ *   no `/` in    pattern is a basename — matches at any depth
+ *     pattern
+ *   `!glob`      negates — handled at the LIST level, not the individual glob
+ *   literals     everything else, including `.`, is a literal char
+ *
+ * Kept small on purpose: no `[abc]` character classes.
+ */
+/**
+ * Compile a single glob (WITHOUT leading `!`) to a regex source string.
+ * Returns the raw pattern (no leading/trailing anchor); wrap in `^...$`
+ * for full-string matching. Kept separate from compileGlob so callers
+ * that need the source (e.g. to hand to a SQL regexp() UDF) don't have
+ * to re-derive it from RegExp.source.
+ */
+export function globToRegexSource(glob) {
+    const hasLeadingSlash = glob.startsWith("/");
+    const rest = hasLeadingSlash ? glob.slice(1) : glob;
+    const isBareBasename = !rest.includes("/");
+    // Bare `**` already expands to `.*`, which subsumes `(?:.*/)?` — skip the
+    // redundant prefix rather than emitting dead regex text.
+    const anyDepthPrefix = isBareBasename && !hasLeadingSlash && rest !== "**" ? "(?:.*/)?" : "";
+    let source = "";
+    let i = 0;
+    while (i < rest.length) {
+        // `**/` — zero or more path segments (including none)
+        if (rest.slice(i, i + 3) === "**/") {
+            source += "(?:.*/)?";
+            i += 3;
+            continue;
+        }
+        // Trailing `/**` — everything strictly inside the preceding dir
+        if (rest.slice(i, i + 3) === "/**" && i + 3 === rest.length) {
+            source += "/.*";
+            i += 3;
+            continue;
+        }
+        // Bare `**` — any run of characters, including `/`
+        if (rest[i] === "*" && rest[i + 1] === "*") {
+            source += ".*";
+            i += 2;
+            continue;
+        }
+        // `*` — within a segment
+        if (rest[i] === "*") {
+            source += "[^/]*";
+            i += 1;
+            continue;
+        }
+        // `?` — single char, not `/`
+        if (rest[i] === "?") {
+            source += "[^/]";
+            i += 1;
+            continue;
+        }
+        const ch = rest[i];
+        // Escape regex specials — critically `.`, which is a literal in globs.
+        if ("[](){}+^$.|\\".includes(ch)) {
+            source += `\\${ch}`;
+            i += 1;
+            continue;
+        }
+        source += ch;
+        i += 1;
+    }
+    return anyDepthPrefix + source;
+}
+/**
+ * Compile a single glob (WITHOUT leading `!`) to an anchored RegExp.
+ * Callers strip `!` before calling and track the negation flag themselves.
+ */
+export function compileGlob(glob) {
+    return new RegExp(`^${globToRegexSource(glob)}$`);
+}
+/**
+ * Does `path` match any of `globs`, honoring gitignore's "last-match-wins"
+ * negation semantics? Returns true iff the last matching pattern is a
+ * positive one; false if no pattern matches or the last match was negated.
+ *
+ * An empty `globs` array yields false (no capability).
+ */
+export function pathMatchesGlobs(globs, path) {
+    let allowed = false;
+    for (const g of globs) {
+        const negated = g.startsWith("!");
+        const pat = negated ? g.slice(1) : g;
+        if (compileGlob(pat).test(path)) {
+            allowed = !negated;
+        }
+    }
+    return allowed;
+}
+/**
+ * Repo-slug pattern matching (§8.2 — "Since slugs contain no `/`, `*` is the
+ * canonical wildcard at the repo level"). Uses the same compileGlob so the
+ * `*`/`?` semantics stay consistent, but slug patterns don't need `**` or
+ * negation.
+ */
+export function slugMatchesPattern(pattern, slug) {
+    return compileGlob(pattern).test(slug);
+}
+//# sourceMappingURL=glob.js.map

package/dist/kernel/auth/glob.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"glob.js","sourceRoot":"","sources":["../../../src/kernel/auth/glob.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AAEH;;;;;;GAMG;AACH,MAAM,UAAU,iBAAiB,CAAC,IAAY;IAC5C,MAAM,eAAe,GAAG,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC;IAC7C,MAAM,IAAI,GAAG,eAAe,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IACpD,MAAM,cAAc,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;IAC3C,0EAA0E;IAC1E,yDAAyD;IACzD,MAAM,cAAc,GAAG,cAAc,IAAI,CAAC,eAAe,IAAI,IAAI,KAAK,IAAI,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,CAAC;IAE7F,IAAI,MAAM,GAAG,EAAE,CAAC;IAChB,IAAI,CAAC,GAAG,CAAC,CAAC;IACV,OAAO,CAAC,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC;QACvB,sDAAsD;QACtD,IAAI,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,GAAG,CAAC,CAAC,KAAK,KAAK,EAAE,CAAC;YACnC,MAAM,IAAI,UAAU,CAAC;YACrB,CAAC,IAAI,CAAC,CAAC;YACP,SAAS;QACX,CAAC;QACD,gEAAgE;QAChE,IAAI,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,GAAG,CAAC,CAAC,KAAK,KAAK,IAAI,CAAC,GAAG,CAAC,KAAK,IAAI,CAAC,MAAM,EAAE,CAAC;YAC5D,MAAM,IAAI,KAAK,CAAC;YAChB,CAAC,IAAI,CAAC,CAAC;YACP,SAAS;QACX,CAAC;QACD,mDAAmD;QACnD,IAAI,IAAI,CAAC,CAAC,CAAC,KAAK,GAAG,IAAI,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,GAAG,EAAE,CAAC;YAC3C,MAAM,IAAI,IAAI,CAAC;YACf,CAAC,IAAI,CAAC,CAAC;YACP,SAAS;QACX,CAAC;QACD,yBAAyB;QACzB,IAAI,IAAI,CAAC,CAAC,CAAC,KAAK,GAAG,EAAE,CAAC;YACpB,MAAM,IAAI,OAAO,CAAC;YAClB,CAAC,IAAI,CAAC,CAAC;YACP,SAAS;QACX,CAAC;QACD,6BAA6B;QAC7B,IAAI,IAAI,CAAC,CAAC,CAAC,KAAK,GAAG,EAAE,CAAC;YACpB,MAAM,IAAI,MAAM,CAAC;YACjB,CAAC,IAAI,CAAC,CAAC;YACP,SAAS;QACX,CAAC;QACD,MAAM,EAAE,GAAG,IAAI,CAAC,CAAC,CAAW,CAAC;QAC7B,uEAAuE;QACvE,IAAI,eAAe,CAAC,QAAQ,CAAC,EAAE,CAAC,EAAE,CAAC;YACjC,MAAM,IAAI,KAAK,EAAE,EAAE,CAAC;YACpB,CAAC,IAAI,CAAC,CAAC;YACP,SAAS;QACX,CAAC;QACD,MAAM,IAAI,EAAE,CAAC;QACb,CAAC,IAAI,CAAC,CAAC;IACT,CAAC;IACD,OAAO,cAAc,GAAG,MAAM,CAAC;AACjC,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,WAAW,CAAC,IAAY;IACtC,OAAO,IAAI,MAAM,CAAC,IAAI,iBAAiB,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AACpD,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,gBAAgB,CAAC,KAAwB,EAAE,IAAY;IACrE,IAAI,OAAO,GAAG,KAAK,CAAC;IACpB,KAAK,MAAM,CAAC,IAAI,KAAK,EAAE,CAAC;QACtB,MAAM,OAAO,GAAG,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC;QAClC,MAAM,GAAG,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QACrC,IAAI,WAAW,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;YAChC,OAAO,GAAG,CAAC,OAAO,CAAC;QACrB,CAAC;IACH,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,kBAAkB,CAAC,OAAe,EAAE,IAAY;IAC9D,OAAO,WAAW,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AACzC,CAAC"}

package/dist/kernel/auth/scope.d.ts

@@ -0,0 +1,53 @@
+/**
+ * Read-scope claim evaluation — design §8.2, noauth plan §1.
+ *
+ * A `CallContext.scope` (ScopeClaim[]) narrows a call's visibility. Claims
+ * name repos by slug pattern and paths by gitignore-style globs, and are
+ * evaluated against the repos existing at call time — there is no issuance
+ * snapshot and no repo-id binding (noauth plan decision 4). A claim names what
+ * it names right now.
+ *
+ * This module owns:
+ *   • claim normalization (`ScopeClaim` → `ClaimMatcher[]`)
+ *   • the runtime grant checks (`claimsGrantRead`, `claimsGrantRepo`)
+ *   • compilation to `SearchPlan` scope groups (`claimsToScopeGroups`) — the
+ *     seam into the adapter's silent search filtering, unchanged from tokens;
+ *     only the provenance of the globs changed (per-call input, not a row).
+ *
+ * The old token machinery (id resolution, subset assertions, the child-token
+ * subset check) is gone: a caller who can supply a claim can supply a wider
+ * one, so narrowing across trust levels is the shell's concern, not ours.
+ */
+import type { ScopeGroup } from "../../storage/search-plan.js";
+import type { RepoRow } from "../../storage/types.js";
+import type { ScopeClaim } from "../context.js";
+/**
+ * Normalized claim: repo patterns split from the `"*"` fast-path, plus the
+ * path globs. `hasWildcard` distinguishes the dynamic all-repos claim (covers
+ * repos created after the call is issued) for scope-group compilation.
+ */
+export type ClaimMatcher = {
+    repoPatterns: string[];
+    hasWildcard: boolean;
+    paths: string[];
+};
+export declare function normalizeClaims(claims: readonly ScopeClaim[]): ClaimMatcher[];
+/**
+ * Does any claim grant read on `path` in the repo named `repoSlug`? Follows
+ * gitignore's per-glob-list "last match wins" (see glob.ts), OR'd across
+ * claims (union semantics, §8.2).
+ */
+export declare function claimsGrantRead(matchers: readonly ClaimMatcher[], repoSlug: string, path: string): boolean;
+/**
+ * Does any claim bind `repoSlug` at all (regardless of path)? Coarse
+ * addressability — used by `repos.list` and query repo resolution to filter
+ * to claimed repos (§8.2).
+ */
+export declare function claimsGrantRepo(matchers: readonly ClaimMatcher[], repoSlug: string): boolean;
+/**
+ * Compile claims into `SearchPlan` scope groups against the current repo set.
+ * A wildcard claim maps to the dynamic `"*"` group; a concrete claim resolves
+ * its repo patterns to the matching current repo ids. Claims with no path
+ * globs contribute nothing (they grant no path).
+ */
+export declare function claimsToScopeGroups(matchers: readonly ClaimMatcher[], repos: readonly RepoRow[]): ScopeGroup[];

package/dist/kernel/auth/scope.js

@@ -0,0 +1,83 @@
+/**
+ * Read-scope claim evaluation — design §8.2, noauth plan §1.
+ *
+ * A `CallContext.scope` (ScopeClaim[]) narrows a call's visibility. Claims
+ * name repos by slug pattern and paths by gitignore-style globs, and are
+ * evaluated against the repos existing at call time — there is no issuance
+ * snapshot and no repo-id binding (noauth plan decision 4). A claim names what
+ * it names right now.
+ *
+ * This module owns:
+ *   • claim normalization (`ScopeClaim` → `ClaimMatcher[]`)
+ *   • the runtime grant checks (`claimsGrantRead`, `claimsGrantRepo`)
+ *   • compilation to `SearchPlan` scope groups (`claimsToScopeGroups`) — the
+ *     seam into the adapter's silent search filtering, unchanged from tokens;
+ *     only the provenance of the globs changed (per-call input, not a row).
+ *
+ * The old token machinery (id resolution, subset assertions, the child-token
+ * subset check) is gone: a caller who can supply a claim can supply a wider
+ * one, so narrowing across trust levels is the shell's concern, not ours.
+ */
+import { pathMatchesGlobs, slugMatchesPattern } from "./glob.js";
+const asList = (v) => v === undefined ? [] : Array.isArray(v) ? v : [v];
+export function normalizeClaims(claims) {
+    return claims.map((c) => {
+        const repoPatterns = asList(c.repo);
+        return {
+            repoPatterns,
+            hasWildcard: repoPatterns.includes("*"),
+            paths: asList(c.paths),
+        };
+    });
+}
+function matcherCoversRepo(m, repoSlug) {
+    if (m.hasWildcard)
+        return true;
+    return m.repoPatterns.some((p) => slugMatchesPattern(p, repoSlug));
+}
+/**
+ * Does any claim grant read on `path` in the repo named `repoSlug`? Follows
+ * gitignore's per-glob-list "last match wins" (see glob.ts), OR'd across
+ * claims (union semantics, §8.2).
+ */
+export function claimsGrantRead(matchers, repoSlug, path) {
+    for (const m of matchers) {
+        if (!matcherCoversRepo(m, repoSlug))
+            continue;
+        if (pathMatchesGlobs(m.paths, path))
+            return true;
+    }
+    return false;
+}
+/**
+ * Does any claim bind `repoSlug` at all (regardless of path)? Coarse
+ * addressability — used by `repos.list` and query repo resolution to filter
+ * to claimed repos (§8.2).
+ */
+export function claimsGrantRepo(matchers, repoSlug) {
+    return matchers.some((m) => matcherCoversRepo(m, repoSlug));
+}
+/**
+ * Compile claims into `SearchPlan` scope groups against the current repo set.
+ * A wildcard claim maps to the dynamic `"*"` group; a concrete claim resolves
+ * its repo patterns to the matching current repo ids. Claims with no path
+ * globs contribute nothing (they grant no path).
+ */
+export function claimsToScopeGroups(matchers, repos) {
+    const groups = [];
+    for (const m of matchers) {
+        if (m.paths.length === 0)
+            continue;
+        if (m.hasWildcard) {
+            groups.push({ repos: "*", globs: m.paths });
+            continue;
+        }
+        const ids = repos
+            .filter((r) => m.repoPatterns.some((p) => slugMatchesPattern(p, r.slug)))
+            .map((r) => r.id);
+        if (ids.length > 0)
+            groups.push({ repos: ids, globs: m.paths });
+    }
+    return groups;
+}
+//# sourceMappingURL=scope.js.map

package/dist/kernel/auth/scope.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"scope.js","sourceRoot":"","sources":["../../../src/kernel/auth/scope.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AAKH,OAAO,EAAE,gBAAgB,EAAE,kBAAkB,EAAE,MAAM,WAAW,CAAC;AAEjE,MAAM,MAAM,GAAG,CAAC,CAAgC,EAAY,EAAE,CAC5D,CAAC,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AAapD,MAAM,UAAU,eAAe,CAAC,MAA6B;IAC3D,OAAO,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE;QACtB,MAAM,YAAY,GAAG,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;QACpC,OAAO;YACL,YAAY;YACZ,WAAW,EAAE,YAAY,CAAC,QAAQ,CAAC,GAAG,CAAC;YACvC,KAAK,EAAE,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC;SACvB,CAAC;IACJ,CAAC,CAAC,CAAC;AACL,CAAC;AAED,SAAS,iBAAiB,CAAC,CAAe,EAAE,QAAgB;IAC1D,IAAI,CAAC,CAAC,WAAW;QAAE,OAAO,IAAI,CAAC;IAC/B,OAAO,CAAC,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,kBAAkB,CAAC,CAAC,EAAE,QAAQ,CAAC,CAAC,CAAC;AACrE,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,eAAe,CAC7B,QAAiC,EACjC,QAAgB,EAChB,IAAY;IAEZ,KAAK,MAAM,CAAC,IAAI,QAAQ,EAAE,CAAC;QACzB,IAAI,CAAC,iBAAiB,CAAC,CAAC,EAAE,QAAQ,CAAC;YAAE,SAAS;QAC9C,IAAI,gBAAgB,CAAC,CAAC,CAAC,KAAK,EAAE,IAAI,CAAC;YAAE,OAAO,IAAI,CAAC;IACnD,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,eAAe,CAAC,QAAiC,EAAE,QAAgB;IACjF,OAAO,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,iBAAiB,CAAC,CAAC,EAAE,QAAQ,CAAC,CAAC,CAAC;AAC9D,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,mBAAmB,CACjC,QAAiC,EACjC,KAAyB;IAEzB,MAAM,MAAM,GAAiB,EAAE,CAAC;IAChC,KAAK,MAAM,CAAC,IAAI,QAAQ,EAAE,CAAC;QACzB,IAAI,CAAC,CAAC,KAAK,CAAC,MAAM,KAAK,CAAC;YAAE,SAAS;QACnC,IAAI,CAAC,CAAC,WAAW,EAAE,CAAC;YAClB,MAAM,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,GAAG,EAAE,KAAK,EAAE,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC;YAC5C,SAAS;QACX,CAAC;QACD,MAAM,GAAG,GAAG,KAAK;aACd,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,kBAAkB,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC;aACxE,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;QACpB,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC;YAAE,MAAM,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,GAAG,EAAE,KAAK,EAAE,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC;IAClE,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC"}