@dogsbay/commands 0.2.0-beta.153 → 0.2.0-beta.155

package/README.md

@@ -18,6 +18,10 @@ Storage (injected I/O)      NodeStorage | MemoryStorage | (Electron IPC …)
 
 - **Storage** is the only I/O boundary. Commands never touch `node:fs`.
   All paths are workspace-root-relative posix paths.
+- **Browser-safe at import**: nothing reaches a Node built-in until a
+  `NodeStorage` is used (it loads `node:fs` then). With `MemoryStorage`
+  or a host's own `Storage`, the package bundles for a browser or Worker;
+  `tests/browser-bundle.test.ts` checks it.
 - **Indexes** are built in one pass: per-doc table (frontmatter,
   headings, anchors, links, includes, `key:` uses), topic-map table,
   key-definition table (from `*.keys.yaml`), and the inverted

package/dist/commands/content.js

@@ -14,9 +14,9 @@
  * H1) is refused with an issue, never guessed.
  */
 import { z } from "zod";
-import { createHash } from "node:crypto";
+import { sha256Hex } from "../sha256.js";
 import { dump as dumpYaml, load as loadYaml } from "js-yaml";
-import { containerOpenBefore, fenceOpenBefore, slugifyHeadingText } from "@dogsbay/format-dogsbay-md";
+import { containerOpenBefore, fenceOpenBefore, slugifyHeadingText } from "@dogsbay/format-dogsbay-md/browser";
 import { normalizeStoragePath } from "../storage.js";
 import { splitFrontmatter } from "../edits.js";
 import { defineCommand } from "../engine.js";
@@ -101,7 +101,7 @@ const isOutput = (x) => typeof x === "object" && x !== null && "data" in x;
  * the target changed in between (a human typing, another agent), the verb
  * refuses with the current hash instead of writing over the newer text.
  */
-export const contentHash = (text) => createHash("sha256").update(text).digest("hex").slice(0, 16);
+export const contentHash = (text) => sha256Hex(text).slice(0, 16);
 const sectionHash = (doc, s) => contentHash(doc.lines.slice(s.line, s.end).join("\n"));
 const fileHash = (doc) => contentHash(doc.frontmatter + doc.lines.join("\n"));
 const STALE_PREVIEW_LINES = 40;

package/dist/commands/link-retarget.js

@@ -8,7 +8,7 @@
  * changed since, like every other content verb.
  */
 import { z } from "zod";
-import { createHash } from "node:crypto";
+import { sha256Hex } from "../sha256.js";
 import { includeDirectiveRe } from "@dogsbay/minja/browser";
 import { defineCommand } from "../engine.js";
 import { normalizeStoragePath } from "../storage.js";
@@ -18,7 +18,7 @@ const fail = (code, message, file, extra = {}) => ({
     issues: [{ severity: "error", code, message, ...(file ? { file } : {}) }],
     summary: message,
 });
-const hashOf = (text) => createHash("sha256").update(text).digest("hex").slice(0, 16);
+const hashOf = (text) => sha256Hex(text).slice(0, 16);
 /** Find destination tokens equal to `from` (exact, decoded or encoded twin) in the masked source. */
 const destinationOffsets = (masked, from) => {
     const variants = new Set([from]);

package/dist/commands/refactor-files.js

@@ -5,7 +5,7 @@
  * rewritten in the same run (see edits.ts).
  */
 import { z } from "zod";
-import { fenceOpenBefore } from "@dogsbay/format-dogsbay-md";
+import { fenceOpenBefore } from "@dogsbay/format-dogsbay-md/browser";
 import { dirname } from "@dogsbay/format-topicmap";
 import { normalizeStoragePath } from "../storage.js";
 import { relativeHref, replaceLinkHrefs, replaceIncludePaths, replaceMapHref, rewriteInboundRefs, splitFrontmatter, } from "../edits.js";

package/dist/commands/refactor-structure.js

@@ -7,7 +7,7 @@
  * cannot be repaired mechanically is issued, never silently dropped.
  */
 import { z } from "zod";
-import { fenceOpenBefore, slugifyHeadingText, transformProseLines } from "@dogsbay/format-dogsbay-md";
+import { fenceOpenBefore, slugifyHeadingText, transformProseLines } from "@dogsbay/format-dogsbay-md/browser";
 import { dirname } from "@dogsbay/format-topicmap";
 import { normalizeStoragePath } from "../storage.js";
 import { relativeHref, replaceLinkHrefs, replaceIncludePaths, rewriteInboundRefs, splitFrontmatter, } from "../edits.js";

package/dist/commands/render-page.js

@@ -12,7 +12,7 @@
  */
 import { z } from "zod";
 import { defineCommand } from "../engine.js";
-import { dirname, join, normalize } from "node:path/posix";
+import { dirname, join, normalize } from "../posix-path.js";
 const MAX_MARKDOWN = 2_000_000;
 /** Embedded image bytes per page, in total (the page may go into an agent's context). */
 const IMAGE_BUDGET = 4_000_000;

package/dist/commands/validate.js

@@ -13,7 +13,7 @@ import { dirname as dirnameOf, joinPath } from "@dogsbay/format-topicmap";
 import { defineCommand } from "../engine.js";
 import { anchorAliases, anchorAliasTargets } from "../indexes.js";
 import { checkFrontmatter, frontmatterPolicyFromConfig, requiredFieldsFor, } from "@dogsbay/types";
-import { dirname as dirOf, relative as relPath } from "node:path/posix";
+import { dirname as dirOf, relative as relPath } from "../posix-path.js";
 import { load as loadYaml } from "js-yaml";
 const input = z.object({}).strict();
 async function siteLayout(storage) {

package/dist/edits.js

@@ -7,7 +7,7 @@
  * whole documents — authored formatting survives.
  */
 import { includeDirectiveRe } from "@dogsbay/minja/browser";
-import { transformProseSegments } from "@dogsbay/format-dogsbay-md";
+import { transformProseSegments } from "@dogsbay/format-dogsbay-md/browser";
 /**
  * Run a text edit over the PROSE of a markdown document only: the
  * frontmatter block, fenced code, and inline code spans pass through

package/dist/indexes.js

@@ -9,7 +9,7 @@
  *
  * Everything here is pure over `Storage` — no node:fs, browser-safe.
  */
-import { dogsbayMdToTree, extractHeadings, isMinjaProcessedFence, transformCodeRegions } from "@dogsbay/format-dogsbay-md";
+import { dogsbayMdToTree, extractHeadings, isMinjaProcessedFence, transformCodeRegions } from "@dogsbay/format-dogsbay-md/browser";
 import { includeDirectiveRe } from "@dogsbay/minja/browser";
 import { parseTopicMap, isTopicMapPath, isExternalHref, normalizePath, dirname, joinPath, } from "@dogsbay/format-topicmap";
 import { load as loadYaml } from "js-yaml";

package/dist/posix-path.d.ts

@@ -0,0 +1,11 @@
+/**
+ * The four node:path/posix functions the verbs use, without Node (so the package bundles for a
+ * browser or Worker). Same results as node:path/posix for workspace paths; `relative` takes two
+ * RELATIVE paths (Node would resolve them against the process's folder first).
+ * Checked against node:path/posix in tests/posix-path.test.ts.
+ */
+export declare function normalize(path: string): string;
+export declare function join(...parts: string[]): string;
+/** Node's own algorithm, duplicate slashes and all (`a//b` → `a/`). */
+export declare function dirname(path: string): string;
+export declare function relative(from: string, to: string): string;

package/dist/posix-path.js

@@ -0,0 +1,67 @@
+/**
+ * The four node:path/posix functions the verbs use, without Node (so the package bundles for a
+ * browser or Worker). Same results as node:path/posix for workspace paths; `relative` takes two
+ * RELATIVE paths (Node would resolve them against the process's folder first).
+ * Checked against node:path/posix in tests/posix-path.test.ts.
+ */
+export function normalize(path) {
+    if (path === "")
+        return ".";
+    const absolute = path.startsWith("/");
+    const trailing = path.endsWith("/");
+    const out = [];
+    for (const seg of path.split("/")) {
+        if (seg === "" || seg === ".")
+            continue;
+        if (seg === "..") {
+            if (out.length && out[out.length - 1] !== "..")
+                out.pop();
+            else if (!absolute)
+                out.push("..");
+        }
+        else
+            out.push(seg);
+    }
+    let joined = out.join("/");
+    if (!joined && !absolute)
+        joined = ".";
+    if (joined && trailing)
+        joined += "/";
+    return absolute ? `/${joined}` : joined;
+}
+export function join(...parts) {
+    const given = parts.filter((p) => p !== "");
+    return given.length ? normalize(given.join("/")) : ".";
+}
+/** Node's own algorithm, duplicate slashes and all (`a//b` → `a/`). */
+export function dirname(path) {
+    if (path === "")
+        return ".";
+    const hasRoot = path[0] === "/";
+    let end = -1;
+    let matchedSlash = true;
+    for (let i = path.length - 1; i >= 1; --i) {
+        if (path[i] === "/") {
+            if (!matchedSlash) {
+                end = i;
+                break;
+            }
+        }
+        else
+            matchedSlash = false;
+    }
+    if (end === -1)
+        return hasRoot ? "/" : ".";
+    if (hasRoot && end === 1)
+        return "//";
+    return path.slice(0, end);
+}
+export function relative(from, to) {
+    const segs = (p) => normalize(p).split("/").filter((s) => s !== "" && s !== ".");
+    const a = segs(from);
+    const b = segs(to);
+    let i = 0;
+    while (i < a.length && i < b.length && a[i] === b[i])
+        i++;
+    return [...a.slice(i).map(() => ".."), ...b.slice(i)].join("/");
+}

package/dist/sha256.d.ts

@@ -0,0 +1 @@
+export declare function sha256Hex(text: string): string;

package/dist/sha256.js

@@ -0,0 +1,60 @@
+/**
+ * SHA-256 of a string's UTF-8 bytes, as hex, synchronously and without Node: the content hashes
+ * the verbs compare (`contentHash`, link-retarget's) must be the same in a browser, a Worker and
+ * Node, and Web Crypto's digest is async. Checked against node:crypto in tests/sha256.test.ts.
+ */
+const K = new Uint32Array([
+    0x428a2f98, 0x71374491, 0xb5c0fbcf, 0xe9b5dba5, 0x3956c25b, 0x59f111f1, 0x923f82a4, 0xab1c5ed5,
+    0xd807aa98, 0x12835b01, 0x243185be, 0x550c7dc3, 0x72be5d74, 0x80deb1fe, 0x9bdc06a7, 0xc19bf174,
+    0xe49b69c1, 0xefbe4786, 0x0fc19dc6, 0x240ca1cc, 0x2de92c6f, 0x4a7484aa, 0x5cb0a9dc, 0x76f988da,
+    0x983e5152, 0xa831c66d, 0xb00327c8, 0xbf597fc7, 0xc6e00bf3, 0xd5a79147, 0x06ca6351, 0x14292967,
+    0x27b70a85, 0x2e1b2138, 0x4d2c6dfc, 0x53380d13, 0x650a7354, 0x766a0abb, 0x81c2c92e, 0x92722c85,
+    0xa2bfe8a1, 0xa81a664b, 0xc24b8b70, 0xc76c51a3, 0xd192e819, 0xd6990624, 0xf40e3585, 0x106aa070,
+    0x19a4c116, 0x1e376c08, 0x2748774c, 0x34b0bcb5, 0x391c0cb3, 0x4ed8aa4a, 0x5b9cca4f, 0x682e6ff3,
+    0x748f82ee, 0x78a5636f, 0x84c87814, 0x8cc70208, 0x90befffa, 0xa4506ceb, 0xbef9a3f7, 0xc67178f2,
+]);
+const rotr = (x, n) => (x >>> n) | (x << (32 - n));
+export function sha256Hex(text) {
+    const data = new TextEncoder().encode(text);
+    const bitLen = data.length * 8;
+    // Message + 0x80 + zeros + 64-bit length, to a multiple of 64 bytes
+    const padded = new Uint8Array((((data.length + 9 + 63) >> 6) << 6));
+    padded.set(data);
+    padded[data.length] = 0x80;
+    const view = new DataView(padded.buffer);
+    view.setUint32(padded.length - 8, Math.floor(bitLen / 0x100000000));
+    view.setUint32(padded.length - 4, bitLen >>> 0);
+    const h = new Uint32Array([0x6a09e667, 0xbb67ae85, 0x3c6ef372, 0xa54ff53a, 0x510e527f, 0x9b05688c, 0x1f83d9ab, 0x5be0cd19]);
+    const w = new Uint32Array(64);
+    for (let off = 0; off < padded.length; off += 64) {
+        for (let i = 0; i < 16; i++)
+            w[i] = view.getUint32(off + i * 4);
+        for (let i = 16; i < 64; i++) {
+            const s0 = rotr(w[i - 15], 7) ^ rotr(w[i - 15], 18) ^ (w[i - 15] >>> 3);
+            const s1 = rotr(w[i - 2], 17) ^ rotr(w[i - 2], 19) ^ (w[i - 2] >>> 10);
+            w[i] = (w[i - 16] + s0 + w[i - 7] + s1) >>> 0;
+        }
+        let [a, b, c, d, e, f, g, hh] = h;
+        for (let i = 0; i < 64; i++) {
+            const t1 = (hh + (rotr(e, 6) ^ rotr(e, 11) ^ rotr(e, 25)) + ((e & f) ^ (~e & g)) + K[i] + w[i]) >>> 0;
+            const t2 = ((rotr(a, 2) ^ rotr(a, 13) ^ rotr(a, 22)) + ((a & b) ^ (a & c) ^ (b & c))) >>> 0;
+            hh = g;
+            g = f;
+            f = e;
+            e = (d + t1) >>> 0;
+            d = c;
+            c = b;
+            b = a;
+            a = (t1 + t2) >>> 0;
+        }
+        h[0] += a;
+        h[1] += b;
+        h[2] += c;
+        h[3] += d;
+        h[4] += e;
+        h[5] += f;
+        h[6] += g;
+        h[7] += hh;
+    }
+    return Array.from(h, (x) => x.toString(16).padStart(8, "0")).join("");
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@dogsbay/commands",
-  "version": "0.2.0-beta.153",
+  "version": "0.2.0-beta.155",
   "description": "Typed, headless-first command engine for the Dogsbay platform — one zod-defined command yields CLI, JSON-RPC, and MCP surfaces",
   "type": "module",
   "main": "dist/index.js",
@@ -18,17 +18,18 @@
   "devDependencies": {
     "@types/js-yaml": "^4.0.9",
     "@types/node": "^25.9.5",
+    "esbuild": "0.28.1",
     "typescript": "^5.9.3",
     "vitest": "^4.1.10"
   },
   "dependencies": {
     "js-yaml": "^5.2.1",
     "zod": "^4.4.3",
-    "@dogsbay/format-dogsbay-md": "0.2.0-beta.153",
-    "@dogsbay/format-topicmap": "0.2.0-beta.153",
-    "@dogsbay/minja": "0.2.0-beta.153",
-    "@dogsbay/types": "0.2.0-beta.153",
-    "@dogsbay/render": "0.2.0-beta.153"
+    "@dogsbay/format-dogsbay-md": "0.2.0-beta.155",
+    "@dogsbay/format-topicmap": "0.2.0-beta.155",
+    "@dogsbay/render": "0.2.0-beta.155",
+    "@dogsbay/types": "0.2.0-beta.155",
+    "@dogsbay/minja": "0.2.0-beta.155"
   },
   "license": "MIT",
   "repository": {