@mulmoclaude/collection-plugin 0.5.0 → 0.5.2

package/dist/server/discovery.d.ts

@@ -1,6 +1,6 @@
 import { z } from "zod";
 import type { LoadedCollection } from "./discoveredCollection";
-import type { CollectionDetail, CollectionSummary } from "../core/schema";
+import type { CollectionDetail, CollectionSchema, CollectionSource, CollectionSummary } from "../core/schema";
 export declare const CollectionSchemaZ: z.ZodObject<{
     title: z.ZodString;
     icon: z.ZodString;
@@ -159,6 +159,34 @@ export declare const CollectionSchemaZ: z.ZodObject<{
         maxItems: z.ZodOptional<z.ZodNumber>;
     }, z.core.$strip>>;
 }, z.core.$strip>;
+/** Result of the post-Zod acceptance gates: the resolved record dir on
+ *  success, or a one-line reason discovery would skip the schema. */
+export type SchemaAcceptance = {
+    ok: true;
+    dataDir: string;
+} | {
+    ok: false;
+    reason: string;
+};
+/** The acceptance gates discovery applies AFTER `CollectionSchemaZ` parses,
+ *  before a schema becomes a live collection:
+ *
+ *  - the `primaryKey` must be a declared field flagged `primary: true` —
+ *    without the flag CollectionView renders the field editable, and a
+ *    rename is silently pinned back to the URL itemId on save, so the user's
+ *    edit is dropped with no error;
+ *  - a `feed` schema must declare an `ingest` block (else it's a dead,
+ *    non-refreshable card);
+ *  - `dataPath` must resolve INSIDE the workspace.
+ *
+ *  Exported so `manageCollection`'s `putSchema` can run the SAME gates before
+ *  it reports success — a schema that passes `CollectionSchemaZ` but fails one
+ *  of these would otherwise write cleanly yet be skipped on the next discovery,
+ *  hiding the collection (the exact failure that tool exists to prevent). */
+export declare function acceptParsedSchema(schema: CollectionSchema, opts: {
+    source: CollectionSource;
+    workspaceRoot: string;
+}): SchemaAcceptance;
 export interface DiscoveryOptions {
     /** Override the workspace root for project-scope skill discovery.
      *  Default: the live `workspacePath`. Tests point this at a

package/dist/server/discovery.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"discovery.d.ts","sourceRoot":"","sources":["../../src/server/discovery.ts"],"names":[],"mappings":"AASA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAIxB,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,wBAAwB,CAAC;AAE/D,OAAO,KAAK,EAAE,gBAAgB,EAAoB,iBAAiB,EAAE,MAAM,gBAAgB,CAAC;AAwT5F,eAAO,MAAM,iBAAiB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBA6P1B,CAAC;AAsHL,MAAM,WAAW,gBAAgB;IAC/B;;;;+DAI2D;IAC3D,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB;;;4CAGwC;IACxC,aAAa,CAAC,EAAE,MAAM,CAAC;CACxB;AAED;;;;;;+BAM+B;AAC/B,wBAAsB,mBAAmB,CAAC,IAAI,GAAE,gBAAqB,GAAG,OAAO,CAAC,gBAAgB,EAAE,CAAC,CAgBlG;AAED;4DAC4D;AAC5D,wBAAsB,cAAc,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,GAAE,gBAAqB,GAAG,OAAO,CAAC,gBAAgB,GAAG,IAAI,CAAC,CAchH;AAED,wBAAgB,SAAS,CAAC,UAAU,EAAE,gBAAgB,GAAG,iBAAiB,CAEzE;AAED,wBAAgB,QAAQ,CAAC,UAAU,EAAE,gBAAgB,GAAG,gBAAgB,CAEvE"}
+{"version":3,"file":"discovery.d.ts","sourceRoot":"","sources":["../../src/server/discovery.ts"],"names":[],"mappings":"AASA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAIxB,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,wBAAwB,CAAC;AAE/D,OAAO,KAAK,EAAE,gBAAgB,EAAE,gBAAgB,EAAE,gBAAgB,EAAE,iBAAiB,EAAE,MAAM,gBAAgB,CAAC;AAwT9G,eAAO,MAAM,iBAAiB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBA6P1B,CAAC;AAmBL;qEACqE;AACrE,MAAM,MAAM,gBAAgB,GAAG;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,GAAG;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAAC;AAE7F;;;;;;;;;;;;;;6EAc6E;AAC7E,wBAAgB,kBAAkB,CAAC,MAAM,EAAE,gBAAgB,EAAE,IAAI,EAAE;IAAE,MAAM,EAAE,gBAAgB,CAAC;IAAC,aAAa,EAAE,MAAM,CAAA;CAAE,GAAG,gBAAgB,CAQxI;AA+ED,MAAM,WAAW,gBAAgB;IAC/B;;;;+DAI2D;IAC3D,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB;;;4CAGwC;IACxC,aAAa,CAAC,EAAE,MAAM,CAAC;CACxB;AAED;;;;;;+BAM+B;AAC/B,wBAAsB,mBAAmB,CAAC,IAAI,GAAE,gBAAqB,GAAG,OAAO,CAAC,gBAAgB,EAAE,CAAC,CAgBlG;AAED;4DAC4D;AAC5D,wBAAsB,cAAc,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,GAAE,gBAAqB,GAAG,OAAO,CAAC,gBAAgB,GAAG,IAAI,CAAC,CAchH;AAED,wBAAgB,SAAS,CAAC,UAAU,EAAE,gBAAgB,GAAG,iBAAiB,CAEzE;AAED,wBAAgB,QAAQ,CAAC,UAAU,EAAE,gBAAgB,GAAG,gBAAgB,CAEvE"}

package/dist/server/paths.d.ts

@@ -5,6 +5,12 @@ export declare const SCHEMA_FILE = "schema.json";
  *  The basename round-trip is the pattern CodeQL recognises as a
  *  `js/path-injection` sanitiser. */
 export declare function safeSlugName(slug: string): string | null;
+/** Sanitise a user-supplied record id into a safe filename stem. Like
+ *  `safeSlugName` but tolerates interior dots (so natural keys work),
+ *  while still rejecting any `..` substring, path separators, and
+ *  leading/trailing dots. The `path.basename` round-trip is the same
+ *  `js/path-injection` sanitiser CodeQL recognises on `safeSlugName`. */
+export declare function safeRecordId(recordId: string): string | null;
 /** True iff the realpath'd closest existing ancestor of `absPath`
  *  resolves under `rootPath`'s realpath. Pure helper, takes both
  *  paths explicitly so tests can drive it against a `mkdtempSync`

package/dist/server/paths.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"paths.d.ts","sourceRoot":"","sources":["../../src/server/paths.ts"],"names":[],"mappings":"AAQA,eAAO,MAAM,WAAW,gBAAgB,CAAC;AAQzC;;;;qCAIqC;AACrC,wBAAgB,YAAY,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAMxD;AAwBD;;;;;;;;uDAQuD;AACvD,wBAAgB,iBAAiB,CAAC,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAW5E;AAED;4DAC4D;AAC5D,wBAAgB,sBAAsB,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAE/D;AAED;;;;;;;;;;;;;;4CAc4C;AAC5C,wBAAgB,cAAc,CAAC,QAAQ,EAAE,MAAM,EAAE,QAAQ,GAAE,MAA2B,GAAG,MAAM,GAAG,IAAI,CAQrG;AAED;;qDAEqD;AACrD,wBAAgB,YAAY,CAAC,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,MAAM,CAEpE;AAED;;;;iDAIiD;AACjD,wBAAgB,mBAAmB,CAAC,QAAQ,EAAE,MAAM,EAAE,eAAe,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAQ5F"}
+{"version":3,"file":"paths.d.ts","sourceRoot":"","sources":["../../src/server/paths.ts"],"names":[],"mappings":"AAQA,eAAO,MAAM,WAAW,gBAAgB,CAAC;AAQzC;;;;qCAIqC;AACrC,wBAAgB,YAAY,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAMxD;AAaD;;;;yEAIyE;AACzE,wBAAgB,YAAY,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAO5D;AAwBD;;;;;;;;uDAQuD;AACvD,wBAAgB,iBAAiB,CAAC,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAW5E;AAED;4DAC4D;AAC5D,wBAAgB,sBAAsB,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAE/D;AAED;;;;;;;;;;;;;;4CAc4C;AAC5C,wBAAgB,cAAc,CAAC,QAAQ,EAAE,MAAM,EAAE,QAAQ,GAAE,MAA2B,GAAG,MAAM,GAAG,IAAI,CAQrG;AAED;;qDAEqD;AACrD,wBAAgB,YAAY,CAAC,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,MAAM,CAEpE;AAED;;;;iDAIiD;AACjD,wBAAgB,mBAAmB,CAAC,QAAQ,EAAE,MAAM,EAAE,eAAe,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAQ5F"}

package/dist/server.cjs

@@ -72,6 +72,20 @@ function safeSlugName(slug) {
 	if (basename !== slug) return null;
 	return basename;
 }
+var SAFE_RECORD_ID_PATTERN = /^[a-zA-Z0-9](?:[a-zA-Z0-9_.-]*[a-zA-Z0-9])?$/;
+/** Sanitise a user-supplied record id into a safe filename stem. Like
+*  `safeSlugName` but tolerates interior dots (so natural keys work),
+*  while still rejecting any `..` substring, path separators, and
+*  leading/trailing dots. The `path.basename` round-trip is the same
+*  `js/path-injection` sanitiser CodeQL recognises on `safeSlugName`. */
+function safeRecordId(recordId) {
+	if (typeof recordId !== "string") return null;
+	if (!SAFE_RECORD_ID_PATTERN.test(recordId)) return null;
+	if (recordId.includes("..")) return null;
+	const basename = node_path.default.basename(recordId);
+	if (basename !== recordId) return null;
+	return basename;
+}
 /** Realpath the closest existing ancestor of `absPath` and return it.
 *  Returns null if no ancestor exists or if the realpath call fails
 *  for a non-ENOENT reason (permissions, etc.). Used by
@@ -305,7 +319,7 @@ async function listItems(dataDir, opts = {}) {
 *  when the record file itself is a symlink (file-disclosure
 *  defense — see `isRegularFile`). */
 async function readItem(dataDir, itemId, opts = {}) {
-	const safeId = safeSlugName(itemId);
+	const safeId = safeRecordId(itemId);
 	if (safeId === null) return null;
 	if (!isContainedInRoot(dataDir, opts.workspaceRoot ?? getWorkspaceRoot())) return null;
 	const filePath = itemFilePath(dataDir, safeId);
@@ -335,7 +349,7 @@ async function readItem(dataDir, itemId, opts = {}) {
 *  Update path (`refuseOverwrite: false`) uses `writeFileAtomic` so
 *  PUT remains crash-atomic. No race there — the URL pins the id. */
 async function writeItem(dataDir, itemId, item, opts = {}) {
-	const safeId = safeSlugName(itemId);
+	const safeId = safeRecordId(itemId);
 	if (safeId === null) return {
 		kind: "invalid-id",
 		itemId
@@ -394,7 +408,7 @@ async function writeItem(dataDir, itemId, item, opts = {}) {
 	};
 }
 async function deleteItem(dataDir, itemId, opts = {}) {
-	const safeId = safeSlugName(itemId);
+	const safeId = safeRecordId(itemId);
 	if (safeId === null) return {
 		kind: "invalid-id",
 		itemId
@@ -848,8 +862,8 @@ var CollectionSchemaZ = zod.z.object({
 	views: zod.z.array(CustomViewSchema).optional(),
 	notifyWhen: WhenSchema.optional(),
 	ingest: IngestSchemaZ.optional()
-}).refine((schema) => schema.singleton === void 0 || safeSlugName(schema.singleton) !== null, {
-	message: "schema `singleton` must be a valid item id (alphanumeric / hyphen / underscore, no path separators)",
+}).refine((schema) => schema.singleton === void 0 || safeRecordId(schema.singleton) !== null, {
+	message: "schema `singleton` must be a valid item id (alphanumeric / hyphen / underscore / interior dot, no `..` or path separators)",
 	path: ["singleton"]
 }).refine((schema) => schema.actions === void 0 || new Set(schema.actions.map((action) => action.id)).size === schema.actions.length, {
 	message: "schema `actions` must have unique `id`s",
@@ -940,6 +954,45 @@ function applyFeedSchemaDefaults(parsed, slug) {
 		dataPath: `data/feeds/${slug}`
 	};
 }
+/** The acceptance gates discovery applies AFTER `CollectionSchemaZ` parses,
+*  before a schema becomes a live collection:
+*
+*  - the `primaryKey` must be a declared field flagged `primary: true` —
+*    without the flag CollectionView renders the field editable, and a
+*    rename is silently pinned back to the URL itemId on save, so the user's
+*    edit is dropped with no error;
+*  - a `feed` schema must declare an `ingest` block (else it's a dead,
+*    non-refreshable card);
+*  - `dataPath` must resolve INSIDE the workspace.
+*
+*  Exported so `manageCollection`'s `putSchema` can run the SAME gates before
+*  it reports success — a schema that passes `CollectionSchemaZ` but fails one
+*  of these would otherwise write cleanly yet be skipped on the next discovery,
+*  hiding the collection (the exact failure that tool exists to prevent). */
+function acceptParsedSchema(schema, opts) {
+	const primaryField = schema.fields[schema.primaryKey];
+	if (!primaryField) return {
+		ok: false,
+		reason: `primaryKey '${schema.primaryKey}' is not one of the declared fields`
+	};
+	if (primaryField.primary !== true) return {
+		ok: false,
+		reason: `the primaryKey field '${schema.primaryKey}' must be flagged \`primary: true\``
+	};
+	if (opts.source === "feed" && !schema.ingest) return {
+		ok: false,
+		reason: "a feed schema must declare an `ingest` block"
+	};
+	const dataDir = resolveDataDir(schema.dataPath, opts.workspaceRoot);
+	if (dataDir === null) return {
+		ok: false,
+		reason: `dataPath '${schema.dataPath}' escapes the workspace`
+	};
+	return {
+		ok: true,
+		dataDir
+	};
+}
 async function loadOneCollection(skillsRoot, slug, source, workspaceRoot) {
 	const safeName = safeSlugName(slug);
 	if (safeName === null) return null;
@@ -976,31 +1029,14 @@ async function loadOneCollection(skillsRoot, slug, source, workspaceRoot) {
 		return null;
 	}
 	const schema = parsed.data;
-	const primaryField = schema.fields[schema.primaryKey];
-	if (!primaryField) {
-		log.warn("collections", "schema.json primaryKey not found in fields, skipping", {
-			slug: safeName,
-			primaryKey: schema.primaryKey
-		});
-		return null;
-	}
-	if (primaryField.primary !== true) {
-		log.warn("collections", "schema.json primaryKey field is not flagged primary: true, skipping", {
-			slug: safeName,
-			primaryKey: schema.primaryKey
-		});
-		return null;
-	}
-	if (source === "feed" && !schema.ingest) {
-		log.warn("collections", "feed schema.json has no `ingest` block, skipping", { slug: safeName });
-		return null;
-	}
-	const dataDir = resolveDataDir(schema.dataPath, workspaceRoot);
-	if (dataDir === null) {
-		log.warn("collections", "schema.json dataPath escapes workspace, skipping", {
+	const acceptance = acceptParsedSchema(schema, {
+		source,
+		workspaceRoot
+	});
+	if (!acceptance.ok) {
+		log.warn("collections", "schema.json rejected after validation, skipping", {
 			slug: safeName,
-			dataPath: schema.dataPath,
-			workspaceRoot
+			reason: acceptance.reason
 		});
 		return null;
 	}
@@ -1008,7 +1044,7 @@ async function loadOneCollection(skillsRoot, slug, source, workspaceRoot) {
 		slug: safeName,
 		source,
 		schema,
-		dataDir,
+		dataDir: acceptance.dataDir,
 		skillDir: node_path.default.join(skillsRoot, safeName)
 	};
 }
@@ -1577,6 +1613,7 @@ async function deleteCustomView(collection, viewId, opts = {}) {
 exports.COMPUTED_TYPES = COMPUTED_TYPES;
 exports.CollectionSchemaZ = CollectionSchemaZ;
 exports.SCHEMA_FILE = SCHEMA_FILE;
+exports.acceptParsedSchema = acceptParsedSchema;
 exports.advanceTriggerDate = advanceTriggerDate;
 exports.buildActionSeedPrompt = buildActionSeedPrompt;
 exports.buildCollectionActionSeedPrompt = buildCollectionActionSeedPrompt;
@@ -1610,6 +1647,7 @@ exports.readSkillTemplate = readSkillTemplate;
 exports.resolveCreateItemId = resolveCreateItemId;
 exports.resolveDataDir = resolveDataDir;
 exports.resolveTemplatePath = resolveTemplatePath;
+exports.safeRecordId = safeRecordId;
 exports.safeSlugName = safeSlugName;
 exports.successorId = successorId;
 exports.toDetail = toDetail;