@mulmoclaude/core 0.13.0 → 0.14.0

package/dist/collection/core/templatePath.d.ts

@@ -0,0 +1,34 @@
+/**
+ * A safe skill-relative path: non-empty, no backslash, not absolute,
+ * and every `/`-separated segment is a plain `[A-Za-z0-9._-]+` token
+ * that isn't `.` / `..` (no traversal). Multi-segment (nested) paths
+ * are allowed. The reader's realpath containment is the hard
+ * guarantee; this fails a bad path fast.
+ */
+export declare function isSafeTemplatePath(value: string): boolean;
+/**
+ * An action `template` value: a safe path that lives under the skill's
+ * `templates/` subdir. This is the canonical contract — the schema
+ * validator rejects anything else up front, and the bridge mirrors
+ * exactly these. Nested paths (`templates/mail/welcome.md`) and any
+ * extension are allowed as long as the path is otherwise safe.
+ */
+export declare function isSafeActionTemplatePath(value: string): boolean;
+/**
+ * A custom-view `file` value: a safe path under the skill's `views/`
+ * subdir that ends in `.html`. Custom views are LLM-authored HTML the
+ * host renders in a sandboxed iframe; constraining them to `views/*.html`
+ * keeps the data folder and the schema/template files off-limits to the
+ * view-file reader. Same per-segment safety as templates; the reader's
+ * realpath containment is the hard guarantee.
+ */
+export declare function isSafeCustomViewPath(value: string): boolean;
+/**
+ * A custom-view `i18n` value: the JSON dictionary file authors ship next to
+ * their `views/<id>.html`. Constrained to `views/<name>.i18n.json` so the
+ * field can only point at a translation file co-located with the view it
+ * translates — the same `views/` containment the HTML reader uses. The
+ * `.i18n.json` suffix (vs plain `.json`) makes the file's purpose grep-able
+ * for both authors and tooling.
+ */
+export declare function isSafeCustomViewI18nPath(value: string): boolean;

package/dist/collection/core/where.d.ts

@@ -1,28 +1,22 @@
-/** Comparison operators one `WhereCond` may apply to `record[field]`. */
-export type WhereOp = "eq" | "ne" | "in" | "gt" | "gte" | "lt" | "lte" | "contains";
+import { z } from 'zod';
+import { ValueRefZ, WhereCondZ, WhereZ } from './schemaZ';
 /** Reads the comparison value from a field instead of a schema literal:
  *  - `record` set → another record: `recordsById[record][field]` (e.g. a
  *    `_config` singleton's `defaultCity`, following a per-user setting);
  *  - `record` omitted → the SAME record being matched (field-to-field, e.g.
  *    `spent > budget`). */
-export interface ValueRef {
-    record?: string;
-    field: string;
-}
+export type ValueRef = z.infer<typeof ValueRefZ>;
 /** One typed condition: `record[field] <op> value`. The comparison value is
  *  either a literal `value` (a plain string for every op except `in`, which
  *  takes the allowed set) or a `valueFrom` reference resolved against the
  *  `recordsById` map passed to `matchesWhere`. Exactly one of the two is
- *  expected — enforced by zod at the schema boundary (`server/discovery.ts`),
- *  not here. */
-export interface WhereCond {
-    field: string;
-    op: WhereOp;
-    value?: string | string[];
-    valueFrom?: ValueRef;
-}
+ *  expected — enforced by zod at the schema boundary (`./schemaZ`), not
+ *  here. */
+export type WhereCond = z.infer<typeof WhereCondZ>;
+/** Comparison operators one `WhereCond` may apply to `record[field]`. */
+export type WhereOp = WhereCond["op"];
 /** A `where` clause is the AND of its conditions — every one must match. */
-export type Where = WhereCond[];
+export type Where = z.infer<typeof WhereZ>;
 /** True when `record` satisfies every condition in `where` (AND). An empty
  *  `where` matches everything. `recordsById` — the source collection's
  *  records keyed by primaryKey — resolves any `valueFrom` reference;

package/dist/collection/index.cjs

@@ -1,5 +1,5 @@
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
-const require_deriveAll = require("../deriveAll-BQ_p5HSB.cjs");
+const require_calendarGrid = require("../calendarGrid-C1rfCXJ3.cjs");
 const require_errorMessage = require("../errorMessage--LvXe_Jx.cjs");
 //#region src/collection/core/presentCollection.ts
 var TOOL_NAME = "presentCollection";
@@ -149,7 +149,8 @@ function resolveEnumColor(schema, fieldKey, value) {
 		if (rank < 0) return ENUM_NEUTRAL;
 		return rank === 0 ? ENUM_ALERT : ENUM_NUDGE;
 	}
-	return enumColorClasses(enumValueIndex(schema.fields[fieldKey]?.values, value));
+	const spec = schema.fields[fieldKey];
+	return enumColorClasses(enumValueIndex(spec?.type === "enum" ? spec.values : void 0, value));
 }
 //#endregion
 //#region src/collection/core/actionVisible.ts
@@ -294,7 +295,7 @@ function isMissingDraftValue(value) {
 }
 /** Label of the first required table sub-field empty in any row, else null. */
 function firstMissingTableSubField(field, rows) {
-	if (!field.of || !rows) return null;
+	if (field.type !== "table" || !rows) return null;
 	for (let rowIdx = 0; rowIdx < rows.length; rowIdx++) {
 		const row = rows[rowIdx];
 		for (const [subKey, subField] of Object.entries(field.of)) {
@@ -444,272 +445,6 @@ function itemLabelOf(item, schema, labelField) {
 	return itemIdOf(item, schema);
 }
 //#endregion
-//#region src/collection/core/calendarGrid.ts
-var MS_PER_DAY = 864e5;
-var ISO_DATE_RE = /^(\d{4})-(\d{2})-(\d{2})$/;
-var TWO_DIGIT_RE = /^\d{2}$/;
-var CLOCK_RE = /(\d{1,2}):(\d{2})/g;
-var RANGE_SEP_RE = /[-–—~〜～]/;
-/** Minutes in a full day — the timeline's vertical extent. */
-var MINUTES_PER_DAY = 1440;
-function pad2(value) {
-	return String(value).padStart(2, "0");
-}
-/** Canonical `YYYY-MM-DD` string for a civil date. */
-function ymdKey(ymd) {
-	return `${String(ymd.year).padStart(4, "0")}-${pad2(ymd.month)}-${pad2(ymd.day)}`;
-}
-/** Strictly parse a `YYYY-MM-DD` string into a civil date, rejecting
-*  anything that isn't a real calendar day (e.g. `2026-02-30`, `2026-13-01`).
-*  Returns null for non-strings and malformed values so callers can route
-*  records with no usable date into the "no date" tray rather than crash. */
-function parseIsoDate(value) {
-	if (typeof value !== "string") return null;
-	const match = ISO_DATE_RE.exec(value.trim());
-	if (!match) return null;
-	const year = Number(match[1]);
-	const month = Number(match[2]);
-	const day = Number(match[3]);
-	const probe = new Date(Date.UTC(year, month - 1, day));
-	if (probe.getUTCFullYear() !== year || probe.getUTCMonth() !== month - 1 || probe.getUTCDate() !== day) return null;
-	return {
-		year,
-		month,
-		day
-	};
-}
-/** Minutes-of-day for an `HH:MM` pair, or null when out of range. */
-function clockToMinutes(hours, minutes) {
-	if (hours < 0 || hours > 23 || minutes < 0 || minutes > 59) return null;
-	return hours * 60 + minutes;
-}
-/** Strictly parse a `YYYY-MM-DDTHH:MM` (optional `:SS`) datetime into its
-*  civil date and minutes-of-day. Returns null for anything that isn't a real
-*  calendar day or a valid 24h clock. */
-function parseIsoDateTime(value) {
-	if (typeof value !== "string") return null;
-	const trimmed = value.trim();
-	const tIndex = trimmed.indexOf("T");
-	if (tIndex === -1) return null;
-	const ymd = parseIsoDate(trimmed.slice(0, tIndex));
-	if (!ymd) return null;
-	const parts = trimmed.slice(tIndex + 1).split(":");
-	if (parts.length < 2 || parts.length > 3 || !parts.every((part) => TWO_DIGIT_RE.test(part))) return null;
-	const minutes = clockToMinutes(Number(parts[0]), Number(parts[1]));
-	if (minutes === null) return null;
-	return {
-		ymd,
-		minutes
-	};
-}
-/** Civil date from either a `YYYY-MM-DD` or a `YYYY-MM-DDTHH:MM` value, so the
-*  month grid buckets date-only and datetime anchors alike. */
-function dateOf(value) {
-	return parseIsoDate(value) ?? parseIsoDateTime(value)?.ymd ?? null;
-}
-/** Minutes-of-day from a datetime value, or null for date-only / invalid. */
-function timeOf(value) {
-	return parseIsoDateTime(value)?.minutes ?? null;
-}
-/** Parse a free-form time-string field into start/end minutes-of-day.
-*  Handles the common shapes in user data:
-*    "14:00-17:00" → { start: 840, end: 1020 }   (range → block)
-*    "17:00-"      → { start: 1020, end: null }   (open end → single line)
-*    "16:30"       → { start: 990, end: null }    (point in time → single line)
-*    "終日" / ""   → null                          (no clock → all-day)
-*  Returns null when no clock token is parseable. */
-function parseTimeRange(value) {
-	if (typeof value !== "string") return null;
-	const text = value.trim();
-	if (!text) return null;
-	const tokens = [...text.matchAll(CLOCK_RE)];
-	if (tokens.length === 0) return null;
-	const minutesOf = (match) => clockToMinutes(Number(match[1]), Number(match[2]));
-	if (!RANGE_SEP_RE.test(text)) {
-		const startMin = minutesOf(tokens[0]);
-		return startMin === null ? null : {
-			startMin,
-			endMin: null
-		};
-	}
-	const sepIndex = text.search(RANGE_SEP_RE);
-	let startMin = null;
-	let endMin = null;
-	for (const token of tokens) if ((token.index ?? 0) < sepIndex) startMin = minutesOf(token);
-	else endMin = minutesOf(token);
-	if (startMin === null) return null;
-	return {
-		startMin,
-		endMin
-	};
-}
-function ymdToUtcMs(ymd) {
-	return Date.UTC(ymd.year, ymd.month - 1, ymd.day);
-}
-function utcMsToYmd(epochMs) {
-	const date = new Date(epochMs);
-	return {
-		year: date.getUTCFullYear(),
-		month: date.getUTCMonth() + 1,
-		day: date.getUTCDate()
-	};
-}
-/** Chronological comparison: negative if `left` precedes `right`, 0 if the
-*  same day, positive if after. */
-function compareYmd(left, right) {
-	return ymdToUtcMs(left) - ymdToUtcMs(right);
-}
-/** True iff `day` falls within the inclusive span `[span.start, span.end]`. */
-function spanCoversDay(span, day) {
-	return compareYmd(span.start, day) <= 0 && compareYmd(day, span.end) <= 0;
-}
-/** Build the 6×7 (42-cell) grid for the given month, including the
-*  leading/trailing days of the adjacent months so every week is full.
-*  `month` is 1-12. `weekStartsOn` is 0 (Sunday) … 6 (Saturday). */
-function buildMonthGrid(year, month, weekStartsOn = 0) {
-	const lead = (new Date(Date.UTC(year, month - 1, 1)).getUTCDay() - weekStartsOn + 7) % 7;
-	const startMs = Date.UTC(year, month - 1, 1) - lead * MS_PER_DAY;
-	const cells = [];
-	for (let i = 0; i < 42; i++) {
-		const ymd = utcMsToYmd(startMs + i * MS_PER_DAY);
-		cells.push({
-			ymd,
-			inMonth: ymd.year === year && ymd.month === month,
-			key: ymdKey(ymd)
-		});
-	}
-	return cells;
-}
-/** Resolve a record's calendar span from its date/datetime fields. Returns
-*  null when the anchor date is missing/invalid (→ the caller's "no date"
-*  tray). An end date that is missing, invalid, or earlier than the start
-*  collapses to a single-day span — never an inverted range.
-*
-*  Times for the day (time-allocation) view come from, in priority order:
-*    1. the clock on a `datetime` anchor/end value, else
-*    2. `timeField` — a separate free-form time-string column (e.g. "14:00-17:00").
-*  A record with no resolvable clock has `startMin === endMin === null`. */
-function recordSpan(item, anchorField, endField, timeField) {
-	const startRaw = item[anchorField];
-	const start = dateOf(startRaw);
-	if (!start) return null;
-	let end = start;
-	let startMin = timeOf(startRaw);
-	let endMin = null;
-	if (endField) {
-		const endRaw = item[endField];
-		const parsedEnd = dateOf(endRaw);
-		if (parsedEnd && compareYmd(parsedEnd, start) >= 0) {
-			end = parsedEnd;
-			endMin = timeOf(endRaw);
-		}
-	}
-	if (timeField && startMin === null && endMin === null) {
-		const range = parseTimeRange(item[timeField]);
-		if (range) ({startMin, endMin} = range);
-	}
-	return {
-		item,
-		start,
-		end,
-		startMin,
-		endMin
-	};
-}
-/** Split records into those that land on the calendar (with their spans)
-*  and those with no usable anchor date (the "no date" tray). Spans are
-*  sorted by start day so same-day stacking is stable across renders. */
-function bucketRecords(items, anchorField, endField, timeField) {
-	const spans = [];
-	const noDate = [];
-	for (const item of items) {
-		const span = recordSpan(item, anchorField, endField, timeField);
-		if (span) spans.push(span);
-		else noDate.push(item);
-	}
-	spans.sort((left, right) => compareYmd(left.start, right.start));
-	return {
-		spans,
-		noDate
-	};
-}
-/** Project a record's span onto a single day for the time-allocation view, or
-*  null when the span doesn't cover that day. */
-function daySlice(span, day) {
-	if (!spanCoversDay(span, day)) return null;
-	const hasStart = span.startMin !== null;
-	const hasEnd = span.endMin !== null;
-	if (!hasStart && !hasEnd) return {
-		kind: "allDay",
-		startMin: 0,
-		endMin: MINUTES_PER_DAY,
-		bleedsBefore: false,
-		bleedsAfter: false
-	};
-	const singleDay = compareYmd(span.start, span.end) === 0;
-	const isStartDay = compareYmd(day, span.start) === 0;
-	const isEndDay = compareYmd(day, span.end) === 0;
-	if (singleDay && hasStart && !hasEnd) return {
-		kind: "line",
-		startMin: span.startMin,
-		endMin: span.startMin,
-		bleedsBefore: false,
-		bleedsAfter: false
-	};
-	const startMin = isStartDay && hasStart ? span.startMin : 0;
-	const endMin = isEndDay && hasEnd ? span.endMin : MINUTES_PER_DAY;
-	if (singleDay && endMin <= startMin) return {
-		kind: "line",
-		startMin,
-		endMin: startMin,
-		bleedsBefore: false,
-		bleedsAfter: false
-	};
-	return {
-		kind: "block",
-		startMin,
-		endMin,
-		bleedsBefore: !isStartDay,
-		bleedsAfter: !isEndDay
-	};
-}
-function assignLanes(blocks) {
-	const order = [...blocks.keys()].sort((left, right) => blocks[left].startMin - blocks[right].startMin || blocks[left].endMin - blocks[right].endMin);
-	const result = blocks.map(() => ({
-		lane: 0,
-		lanes: 1
-	}));
-	let cluster = [];
-	let clusterEnd = Number.NEGATIVE_INFINITY;
-	const laneEnds = [];
-	const flush = () => {
-		for (const index of cluster) result[index].lanes = laneEnds.length;
-		cluster = [];
-		laneEnds.length = 0;
-		clusterEnd = Number.NEGATIVE_INFINITY;
-	};
-	for (const index of order) {
-		const block = blocks[index];
-		if (cluster.length > 0 && block.startMin >= clusterEnd) flush();
-		let lane = laneEnds.findIndex((end) => end <= block.startMin);
-		if (lane === -1) {
-			lane = laneEnds.length;
-			laneEnds.push(block.endMin);
-		} else laneEnds[lane] = block.endMin;
-		result[index].lane = lane;
-		cluster.push(index);
-		clusterEnd = Math.max(clusterEnd, block.endMin);
-	}
-	flush();
-	return result;
-}
-/** Month label key inputs — returns the 1st of the month as a `Date` so the
-*  component can feed it to `Intl.DateTimeFormat(locale, …)` for a localized
-*  "April 2026" header without this module taking a locale dependency. */
-function monthAnchorDate(year, month) {
-	return new Date(Date.UTC(year, month - 1, 1));
-}
-//#endregion
 //#region src/collection/core/shortHexId.ts
 /**
 * 8-char hex id — short, slug-safe, and editable. Produces the same id *shape*
@@ -729,64 +464,68 @@ function defangForPrompt(value) {
 	return value.replace(/[<>]/g, "").replace(/`/g, "'").replace(/\$\{/g, "$ {").replace(/\s+/g, " ").slice(0, DEFANG_MAX_LEN);
 }
 //#endregion
-exports.AGENT_INGEST_KIND = require_deriveAll.AGENT_INGEST_KIND;
+exports.AGENT_INGEST_KIND = require_calendarGrid.AGENT_INGEST_KIND;
 exports.ENUM_ALERT = ENUM_ALERT;
 exports.ENUM_NEUTRAL = ENUM_NEUTRAL;
 exports.ENUM_NUDGE = ENUM_NUDGE;
-exports.FEED_SCHEDULES = require_deriveAll.FEED_SCHEDULES;
-exports.INGEST_KINDS = require_deriveAll.INGEST_KINDS;
-exports.MINUTES_PER_DAY = MINUTES_PER_DAY;
+exports.FEED_SCHEDULES = require_calendarGrid.FEED_SCHEDULES;
+exports.INGEST_KINDS = require_calendarGrid.INGEST_KINDS;
+exports.MINUTES_PER_DAY = require_calendarGrid.MINUTES_PER_DAY;
+exports.SAFE_RECORD_ID_PATTERN = require_calendarGrid.SAFE_RECORD_ID_PATTERN;
+exports.SAFE_SLUG_PATTERN = require_calendarGrid.SAFE_SLUG_PATTERN;
 exports.TOOL_DEFINITION = TOOL_DEFINITION;
 exports.TOOL_NAME = TOOL_NAME;
 exports.actionVisible = actionVisible;
-exports.assignLanes = assignLanes;
+exports.assignLanes = require_calendarGrid.assignLanes;
 exports.boolSortValue = boolSortValue;
-exports.bucketRecords = bucketRecords;
-exports.buildMonthGrid = buildMonthGrid;
+exports.bucketRecords = require_calendarGrid.bucketRecords;
+exports.buildMonthGrid = require_calendarGrid.buildMonthGrid;
 exports.buildUpdatedRecord = buildUpdatedRecord;
 exports.coerceInlineValue = coerceInlineValue;
 exports.compareSortValues = compareSortValues;
-exports.compareYmd = compareYmd;
-exports.dateOf = dateOf;
+exports.compareYmd = require_calendarGrid.compareYmd;
+exports.dateOf = require_calendarGrid.dateOf;
 exports.dateSortValue = dateSortValue;
-exports.daySlice = daySlice;
+exports.daySlice = require_calendarGrid.daySlice;
 exports.defangForPrompt = defangForPrompt;
-exports.deriveAll = require_deriveAll.deriveAll;
+exports.deriveAll = require_calendarGrid.deriveAll;
 exports.draftToRecord = draftToRecord;
-exports.embedTargetId = require_deriveAll.embedTargetId;
+exports.embedTargetId = require_calendarGrid.embedTargetId;
 exports.emptyRow = emptyRow;
 exports.enumColorClasses = enumColorClasses;
 exports.enumSortValue = enumSortValue;
 exports.enumValueIndex = enumValueIndex;
 exports.errorMessage = require_errorMessage.errorMessage;
-exports.evaluateDerived = require_deriveAll.evaluateDerived;
+exports.evaluateDerived = require_calendarGrid.evaluateDerived;
 exports.executePresentCollection = executePresentCollection;
 exports.fieldVisible = fieldVisible;
-exports.firstDateField = require_deriveAll.firstDateField;
+exports.firstDateField = require_calendarGrid.firstDateField;
 exports.firstMissingRequiredField = firstMissingRequiredField;
-exports.isFieldDrivenEvery = require_deriveAll.isFieldDrivenEvery;
+exports.isFieldDrivenEvery = require_calendarGrid.isFieldDrivenEvery;
+exports.isSafeRecordId = require_calendarGrid.isSafeRecordId;
+exports.isSafeSlug = require_calendarGrid.isSafeSlug;
 exports.isSortableField = isSortableField;
 exports.itemIdOf = itemIdOf;
 exports.itemLabelOf = itemLabelOf;
 exports.labelFieldFor = labelFieldFor;
-exports.matchesWhere = require_deriveAll.matchesWhere;
-exports.monthAnchorDate = monthAnchorDate;
+exports.matchesWhere = require_calendarGrid.matchesWhere;
+exports.monthAnchorDate = require_calendarGrid.monthAnchorDate;
 exports.nextSortDirection = nextSortDirection;
 exports.numericSortValue = numericSortValue;
-exports.parseIsoDate = parseIsoDate;
-exports.parseIsoDateTime = parseIsoDateTime;
-exports.parseTimeRange = parseTimeRange;
-exports.recordSpan = recordSpan;
+exports.parseIsoDate = require_calendarGrid.parseIsoDate;
+exports.parseIsoDateTime = require_calendarGrid.parseIsoDateTime;
+exports.parseTimeRange = require_calendarGrid.parseTimeRange;
+exports.recordSpan = require_calendarGrid.recordSpan;
 exports.resolveEnumColor = resolveEnumColor;
-exports.resolveIcon = require_deriveAll.resolveIcon;
-exports.resolveRowRefs = require_deriveAll.resolveRowRefs;
+exports.resolveIcon = require_calendarGrid.resolveIcon;
+exports.resolveRowRefs = require_calendarGrid.resolveRowRefs;
 exports.rowFromItem = rowFromItem;
-exports.selectDynamicRecord = require_deriveAll.selectDynamicRecord;
+exports.selectDynamicRecord = require_calendarGrid.selectDynamicRecord;
 exports.shortHexId = shortHexId;
 exports.sortItems = sortItems;
-exports.spanCoversDay = spanCoversDay;
+exports.spanCoversDay = require_calendarGrid.spanCoversDay;
 exports.stringSortValue = stringSortValue;
 exports.whenMatches = whenMatches;
-exports.ymdKey = ymdKey;
+exports.ymdKey = require_calendarGrid.ymdKey;
 
 //# sourceMappingURL=index.cjs.map