@mulmoclaude/core 0.2.15 → 0.4.0

package/dist/wiki/route.d.ts

@@ -0,0 +1,32 @@
+export declare const WIKI_ROUTE_SECTION: {
+    readonly pages: "pages";
+    readonly log: "log";
+    readonly lintReport: "lint-report";
+    readonly graph: "graph";
+};
+export type WikiRouteSection = (typeof WIKI_ROUTE_SECTION)[keyof typeof WIKI_ROUTE_SECTION];
+export declare const WIKI_ACTION: {
+    readonly index: "index";
+    readonly page: "page";
+    readonly log: "log";
+    readonly lintReport: "lint_report";
+    readonly graph: "graph";
+    readonly save: "save";
+};
+export type WikiAction = (typeof WIKI_ACTION)[keyof typeof WIKI_ACTION];
+export type WikiTarget = {
+    kind: "index";
+} | {
+    kind: "page";
+    slug: string;
+} | {
+    kind: "log";
+} | {
+    kind: "lint_report";
+} | {
+    kind: "graph";
+};
+export declare function isSafeWikiSlug(value: unknown): value is string;
+export declare function readWikiRouteTarget(params: unknown): WikiTarget | null;
+export declare function buildWikiRouteParams(target: WikiTarget): Record<string, string>;
+export declare function wikiActionFor(target: WikiTarget): WikiAction;

package/dist/wiki/server/index.cjs

@@ -0,0 +1,30 @@
+Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
+const require_rolldown_runtime = require("../../rolldown-runtime-D6vf50IK.cjs");
+const require_slug = require("../../slug-DbwORN9z.cjs");
+let node_path = require("node:path");
+node_path = require_rolldown_runtime.__toESM(node_path, 1);
+//#region src/wiki/server/paths.ts
+/** Given an absolute path and the absolute `pagesDir`, return the
+*  slug if `absPath` is a direct `.md` child of `pagesDir`, else
+*  null. Pure path-string math — no fs IO, no symlink resolution.
+*
+*  Caller responsibility: pass already-realpath'd values for both
+*  arguments. Mixing a realpath'd `absPath` with a symlinked
+*  `pagesDir` (or vice versa) silently mismatches because
+*  `path.relative` is plain string arithmetic. The trap caused
+*  #883 review-iter-1 — a symlinked workspace silently routed
+*  wiki writes through the generic writer. */
+function wikiSlugFromAbsPath(absPath, pagesDir) {
+	const rel = node_path.default.relative(pagesDir, absPath);
+	if (rel.length === 0) return null;
+	if (node_path.default.isAbsolute(rel)) return null;
+	if (rel.includes(node_path.default.sep)) return null;
+	if (!rel.endsWith(".md")) return null;
+	const slug = rel.slice(0, -3);
+	if (!require_slug.isSafeSlug(slug)) return null;
+	return slug;
+}
+//#endregion
+exports.wikiSlugFromAbsPath = wikiSlugFromAbsPath;
+
+//# sourceMappingURL=index.cjs.map

package/dist/wiki/server/index.cjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.cjs","names":[],"sources":["../../../src/wiki/server/paths.ts"],"sourcesContent":["// Node-only wiki-page helpers — anything that needs `node:path`\n// lives here so the rest of `@mulmoclaude/core/wiki` stays pure\n// (string-only, importable from both browser and Node bundles).\n// Frontend code MUST NOT import this file directly; use the pure\n// `@mulmoclaude/core/wiki` modules instead.\n\nimport path from \"node:path\";\nimport { isSafeSlug } from \"../slug.js\";\n\n/** Given an absolute path and the absolute `pagesDir`, return the\n *  slug if `absPath` is a direct `.md` child of `pagesDir`, else\n *  null. Pure path-string math — no fs IO, no symlink resolution.\n *\n *  Caller responsibility: pass already-realpath'd values for both\n *  arguments. Mixing a realpath'd `absPath` with a symlinked\n *  `pagesDir` (or vice versa) silently mismatches because\n *  `path.relative` is plain string arithmetic. The trap caused\n *  #883 review-iter-1 — a symlinked workspace silently routed\n *  wiki writes through the generic writer. */\nexport function wikiSlugFromAbsPath(absPath: string, pagesDir: string): string | null {\n  const rel = path.relative(pagesDir, absPath);\n  if (rel.length === 0) return null;\n  if (path.isAbsolute(rel)) return null;\n  // Direct child only — no nested layout today. Any separator\n  // means the path either escapes (`../secret.md`) or descends\n  // (`subdir/foo.md`). A literal page name like `..foo.md` is a\n  // single segment without a separator and is allowed (codex\n  // iter-3 #883 — the prior `startsWith(\"..\")` rule wrongly\n  // rejected it).\n  if (rel.includes(path.sep)) return null;\n  if (!rel.endsWith(\".md\")) return null;\n  const slug = rel.slice(0, -\".md\".length);\n  if (!isSafeSlug(slug)) return null;\n  return slug;\n}\n"],"mappings":";;;;;;;;;;;;;;;;AAmBA,SAAgB,oBAAoB,SAAiB,UAAiC;CACpF,MAAM,MAAM,UAAA,QAAK,SAAS,UAAU,OAAO;CAC3C,IAAI,IAAI,WAAW,GAAG,OAAO;CAC7B,IAAI,UAAA,QAAK,WAAW,GAAG,GAAG,OAAO;CAOjC,IAAI,IAAI,SAAS,UAAA,QAAK,GAAG,GAAG,OAAO;CACnC,IAAI,CAAC,IAAI,SAAS,KAAK,GAAG,OAAO;CACjC,MAAM,OAAO,IAAI,MAAM,GAAG,EAAa;CACvC,IAAI,CAAC,aAAA,WAAW,IAAI,GAAG,OAAO;CAC9B,OAAO;AACT"}

package/dist/wiki/server/index.d.ts

@@ -0,0 +1 @@
+export { wikiSlugFromAbsPath } from './paths.js';

package/dist/wiki/server/index.js

@@ -0,0 +1,27 @@
+import { t as isSafeSlug } from "../../slug-CdN-pQX1.js";
+import path from "node:path";
+//#region src/wiki/server/paths.ts
+/** Given an absolute path and the absolute `pagesDir`, return the
+*  slug if `absPath` is a direct `.md` child of `pagesDir`, else
+*  null. Pure path-string math — no fs IO, no symlink resolution.
+*
+*  Caller responsibility: pass already-realpath'd values for both
+*  arguments. Mixing a realpath'd `absPath` with a symlinked
+*  `pagesDir` (or vice versa) silently mismatches because
+*  `path.relative` is plain string arithmetic. The trap caused
+*  #883 review-iter-1 — a symlinked workspace silently routed
+*  wiki writes through the generic writer. */
+function wikiSlugFromAbsPath(absPath, pagesDir) {
+	const rel = path.relative(pagesDir, absPath);
+	if (rel.length === 0) return null;
+	if (path.isAbsolute(rel)) return null;
+	if (rel.includes(path.sep)) return null;
+	if (!rel.endsWith(".md")) return null;
+	const slug = rel.slice(0, -3);
+	if (!isSafeSlug(slug)) return null;
+	return slug;
+}
+//#endregion
+export { wikiSlugFromAbsPath };
+
+//# sourceMappingURL=index.js.map

package/dist/wiki/server/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","names":[],"sources":["../../../src/wiki/server/paths.ts"],"sourcesContent":["// Node-only wiki-page helpers — anything that needs `node:path`\n// lives here so the rest of `@mulmoclaude/core/wiki` stays pure\n// (string-only, importable from both browser and Node bundles).\n// Frontend code MUST NOT import this file directly; use the pure\n// `@mulmoclaude/core/wiki` modules instead.\n\nimport path from \"node:path\";\nimport { isSafeSlug } from \"../slug.js\";\n\n/** Given an absolute path and the absolute `pagesDir`, return the\n *  slug if `absPath` is a direct `.md` child of `pagesDir`, else\n *  null. Pure path-string math — no fs IO, no symlink resolution.\n *\n *  Caller responsibility: pass already-realpath'd values for both\n *  arguments. Mixing a realpath'd `absPath` with a symlinked\n *  `pagesDir` (or vice versa) silently mismatches because\n *  `path.relative` is plain string arithmetic. The trap caused\n *  #883 review-iter-1 — a symlinked workspace silently routed\n *  wiki writes through the generic writer. */\nexport function wikiSlugFromAbsPath(absPath: string, pagesDir: string): string | null {\n  const rel = path.relative(pagesDir, absPath);\n  if (rel.length === 0) return null;\n  if (path.isAbsolute(rel)) return null;\n  // Direct child only — no nested layout today. Any separator\n  // means the path either escapes (`../secret.md`) or descends\n  // (`subdir/foo.md`). A literal page name like `..foo.md` is a\n  // single segment without a separator and is allowed (codex\n  // iter-3 #883 — the prior `startsWith(\"..\")` rule wrongly\n  // rejected it).\n  if (rel.includes(path.sep)) return null;\n  if (!rel.endsWith(\".md\")) return null;\n  const slug = rel.slice(0, -\".md\".length);\n  if (!isSafeSlug(slug)) return null;\n  return slug;\n}\n"],"mappings":";;;;;;;;;;;;;AAmBA,SAAgB,oBAAoB,SAAiB,UAAiC;CACpF,MAAM,MAAM,KAAK,SAAS,UAAU,OAAO;CAC3C,IAAI,IAAI,WAAW,GAAG,OAAO;CAC7B,IAAI,KAAK,WAAW,GAAG,GAAG,OAAO;CAOjC,IAAI,IAAI,SAAS,KAAK,GAAG,GAAG,OAAO;CACnC,IAAI,CAAC,IAAI,SAAS,KAAK,GAAG,OAAO;CACjC,MAAM,OAAO,IAAI,MAAM,GAAG,EAAa;CACvC,IAAI,CAAC,WAAW,IAAI,GAAG,OAAO;CAC9B,OAAO;AACT"}

package/dist/wiki/server/paths.d.ts

@@ -0,0 +1,11 @@
+/** Given an absolute path and the absolute `pagesDir`, return the
+ *  slug if `absPath` is a direct `.md` child of `pagesDir`, else
+ *  null. Pure path-string math — no fs IO, no symlink resolution.
+ *
+ *  Caller responsibility: pass already-realpath'd values for both
+ *  arguments. Mixing a realpath'd `absPath` with a symlinked
+ *  `pagesDir` (or vice versa) silently mismatches because
+ *  `path.relative` is plain string arithmetic. The trap caused
+ *  #883 review-iter-1 — a symlinked workspace silently routed
+ *  wiki writes through the generic writer. */
+export declare function wikiSlugFromAbsPath(absPath: string, pagesDir: string): string | null;

package/dist/wiki/slug.d.ts

@@ -0,0 +1,24 @@
+/** Reject slugs that would escape `data/wiki/pages/` once
+ *  joined back into a path, or that are otherwise invalid as
+ *  page filenames. The chokepoint must defend itself even when
+ *  callers derive the slug from a trusted source — a typo or
+ *  future caller mistake should fail loud, not silently write
+ *  outside the wiki tree.
+ *
+ *  The rule is intentionally narrow — separators / `..` / NUL /
+ *  empty — so it only rejects unambiguous violations. Aesthetic
+ *  concerns (e.g. dot-prefixed filenames) are out of scope: a
+ *  pre-existing `data/wiki/pages/.foo.md` should remain writable
+ *  through the chokepoint (codex review iter-2 #883). */
+export declare function isSafeSlug(slug: string): boolean;
+/** Slug rules for `[[wiki link]]` text → slug derivation:
+ *  lowercase, spaces collapsed to hyphens, every non-ASCII /
+ *  non-alphanumeric / non-hyphen character stripped.
+ *
+ *  Pure: no normalisation, no transliteration — this is the
+ *  same shape the index parser, page resolver, and frontend
+ *  renderer all need to agree on. Non-ASCII titles (e.g.
+ *  Japanese) collapse to an empty string here; callers fall back
+ *  to other strategies (title-match in the index, or the agent
+ *  pre-resolving to a slug-form target via `[[slug|display]]`). */
+export declare function wikiSlugify(text: string): string;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@mulmoclaude/core",
-  "version": "0.2.15",
+  "version": "0.4.0",
   "description": "Shared server-side core for MulmoClaude and MulmoTerminal — the always-shipped-together subsystems consolidated behind subpath exports so the two hosts can't drift. Server-only except the browser-safe ./whisper/client, ./workspace-setup/slug and ./translation/client entries. All host specifics are injected.",
   "type": "module",
   "exports": {
@@ -22,6 +22,30 @@
       "require": "./dist/collection/paths.cjs",
       "default": "./dist/collection/paths.js"
     },
+    "./collection/registry": {
+      "types": "./dist/collection/registry/index.d.ts",
+      "import": "./dist/collection/registry/index.js",
+      "require": "./dist/collection/registry/index.cjs",
+      "default": "./dist/collection/registry/index.js"
+    },
+    "./collection/registry/server": {
+      "types": "./dist/collection/registry/server/index.d.ts",
+      "import": "./dist/collection/registry/server/index.js",
+      "require": "./dist/collection/registry/server/index.cjs",
+      "default": "./dist/collection/registry/server/index.js"
+    },
+    "./wiki": {
+      "types": "./dist/wiki/index.d.ts",
+      "import": "./dist/wiki/index.js",
+      "require": "./dist/wiki/index.cjs",
+      "default": "./dist/wiki/index.js"
+    },
+    "./wiki/server": {
+      "types": "./dist/wiki/server/index.d.ts",
+      "import": "./dist/wiki/server/index.js",
+      "require": "./dist/wiki/server/index.cjs",
+      "default": "./dist/wiki/server/index.js"
+    },
     "./feeds": {
       "types": "./dist/feeds/index.d.ts",
       "import": "./dist/feeds/index.js",