@mulmoclaude/core 1.13.0 → 1.14.1

package/dist/{dist-21pMsI1a.cjs → dist-CsgSfWwR.cjs}

@@ -3,6 +3,15 @@
 function isRecord(value) {
 	return typeof value === "object" && value !== null && !Array.isArray(value);
 }
+/** Narrow `unknown` to any object (not null, arrays allowed).
+*  Use `isRecord` when you need to access string keys. */
+function isObj(value) {
+	return typeof value === "object" && value !== null;
+}
+/** String array (every element is a string). */
+function isStringArray(value) {
+	return Array.isArray(value) && value.every((val) => typeof val === "string");
+}
 /** An array of unknowns. Prefer this over a bare `Array.isArray` in typed code:
 *  `Array.isArray(x: unknown)` narrows to `any[]`, silently reintroducing
 *  `any`, whereas this keeps the element type `unknown`. */
@@ -89,12 +98,24 @@ Object.defineProperty(exports, "isErrorWithCode", {
 		return isErrorWithCode;
 	}
 });
+Object.defineProperty(exports, "isObj", {
+	enumerable: true,
+	get: function() {
+		return isObj;
+	}
+});
 Object.defineProperty(exports, "isRecord", {
 	enumerable: true,
 	get: function() {
 		return isRecord;
 	}
 });
+Object.defineProperty(exports, "isStringArray", {
+	enumerable: true,
+	get: function() {
+		return isStringArray;
+	}
+});
 Object.defineProperty(exports, "isUnknownArray", {
 	enumerable: true,
 	get: function() {
@@ -102,4 +123,4 @@ Object.defineProperty(exports, "isUnknownArray", {
 	}
 });
 
-//# sourceMappingURL=dist-21pMsI1a.cjs.map
+//# sourceMappingURL=dist-CsgSfWwR.cjs.map

package/dist/{dist-21pMsI1a.cjs.map → dist-CsgSfWwR.cjs.map}

@@ -1 +1 @@
-{"version":3,"file":"dist-21pMsI1a.cjs","names":[],"sources":["../../common/dist/index.js"],"sourcesContent":["// General-purpose runtime type guards, shared across the MulmoClaude host,\n// bridges, and plugins. This is a leaf package — pure and dependency-free — so\n// any tier can import it without creating an uphill edge.\n//\n// These originated as `server/utils/types.ts` (#504), which centralised 40+\n// hand-written inline `typeof x === \"object\"` checks. They are promoted here so\n// the same guards stop being re-hand-written in every bridge and plugin too.\n/** Narrow `unknown` to a plain object (not null, not array). */\nexport function isRecord(value) {\n    return typeof value === \"object\" && value !== null && !Array.isArray(value);\n}\n/** Narrow `unknown` to any object (not null, arrays allowed).\n *  Use `isRecord` when you need to access string keys. */\nexport function isObj(value) {\n    return typeof value === \"object\" && value !== null;\n}\n/** Non-empty string after trimming whitespace. */\nexport function isNonEmptyString(value) {\n    return typeof value === \"string\" && value.trim().length > 0;\n}\n/** Record whose values are all strings. */\nexport function isStringRecord(value) {\n    if (!isRecord(value))\n        return false;\n    return Object.values(value).every((val) => typeof val === \"string\");\n}\n/** String array (every element is a string). */\nexport function isStringArray(value) {\n    return Array.isArray(value) && value.every((val) => typeof val === \"string\");\n}\n/** An array of unknowns. Prefer this over a bare `Array.isArray` in typed code:\n *  `Array.isArray(x: unknown)` narrows to `any[]`, silently reintroducing\n *  `any`, whereas this keeps the element type `unknown`. */\nexport function isUnknownArray(value) {\n    return Array.isArray(value);\n}\n/** Error-like object with a `code` property (e.g. Node.js fs errors). */\nexport function isErrorWithCode(value) {\n    return isRecord(value) && typeof value.code === \"string\";\n}\n/** Check that a record has a specific key with a string value. */\nexport function hasStringProp(value, key) {\n    return isRecord(value) && typeof value[key] === \"string\";\n}\n/** Check that a record has a specific key with a number value. */\nexport function hasNumberProp(value, key) {\n    return isRecord(value) && typeof value[key] === \"number\";\n}\n/** Split a comma-separated env value into trimmed, non-empty entries.\n *  `lowercase` folds case for identifiers compared case-insensitively\n *  (JIDs, email addresses, hex pubkeys). Absent/empty input → empty list. */\nexport function parseCsvList(raw, opts) {\n    return (raw ?? \"\")\n        .split(\",\")\n        .map((entry) => (opts?.lowercase ? entry.trim().toLowerCase() : entry.trim()))\n        .filter(Boolean);\n}\n/** A comma-separated env value as a Set — the canonical allowlist shape,\n *  where an empty set is the \"allow all\" sentinel (`set.size === 0`). */\nexport function parseCsvSet(raw, opts) {\n    return new Set(parseCsvList(raw, opts));\n}\n/** Normalise an unknown thrown value into a human-readable string. Isomorphic\n *  (host, bridges, plugins, Vue) — this is the single home for the helper that\n *  #2217 could only consolidate for server code, since `@mulmoclaude/core/utils`\n *  is server-only.\n *\n *  A non-Error object with a non-empty string `details` (gRPC convention) or\n *  `message` field surfaces that field — `details` wins — instead of the\n *  `[object Object]` a bare `String(err)` would print; an empty-string field\n *  falls through. `fallback` covers the error-boundary idiom where a thrown\n *  non-Error should read as a descriptive message rather than `String(err)`\n *  noise; omit it in logging contexts where `String(err)` is fine. */\nexport function errorMessage(err, fallback) {\n    if (err instanceof Error)\n        return err.message;\n    if (hasStringProp(err, \"details\") && err.details)\n        return err.details;\n    if (hasStringProp(err, \"message\") && err.message)\n        return err.message;\n    if (fallback !== undefined)\n        return fallback;\n    return String(err);\n}\n/** `Date` → `YYYY-MM-DD` in UTC — for dates that must not shift with the\n *  host's local timezone (tool-trace search dirs, API date keys). Isomorphic\n *  single source (#2480): the host re-exports it from `server/utils/date.ts`,\n *  x-plugin imports it directly. The `@receptron/task-scheduler` copy stays\n *  local on purpose — that leaf package is published independently and kept\n *  dependency-free. Wall-clock questions use the host's `toLocalIsoDate`. */\nexport function toUtcIsoDate(timestamp) {\n    const year = timestamp.getUTCFullYear();\n    const month = String(timestamp.getUTCMonth() + 1).padStart(2, \"0\");\n    const day = String(timestamp.getUTCDate()).padStart(2, \"0\");\n    return `${year}-${month}-${day}`;\n}\n// A Map, not an object literal: `{}[char]` reads through the prototype chain,\n// so a future caller widening the regex would silently get `[object Object]`\n// for keys like `constructor`.\nconst HTML_ESCAPES = new Map([\n    [\"&\", \"&amp;\"],\n    [\"<\", \"&lt;\"],\n    [\">\", \"&gt;\"],\n    ['\"', \"&quot;\"],\n    [\"'\", \"&#39;\"],\n]);\n/** HTML-escape text destined for markup or an attribute value — the fixed\n *  five-character map, nothing more. Lives here rather than in\n *  `@mulmoclaude/core/wiki` (#2483) because `@mulmoclaude/markdown-utils` is a\n *  leaf that core depends on and so cannot import back up; core/wiki\n *  re-exports this, keeping its consumers' import path unchanged.\n *\n *  Escaping `&` first is what makes a single pass safe — the entities this\n *  introduces contain none of the other four characters, so nothing is\n *  double-escaped. Not a sanitiser: it neither strips tags nor validates URLs. */\nexport function escapeHtml(value) {\n    return value.replace(/[&<>\"']/g, (char) => HTML_ESCAPES.get(char) ?? char);\n}\nexport { scanEnvOptions, snakeToLowerCamel } from \"./envScan.js\";\n"],"mappings":";;AAQA,SAAgB,SAAS,OAAO;CAC5B,OAAO,OAAO,UAAU,YAAY,UAAU,QAAQ,CAAC,MAAM,QAAQ,KAAK;AAC9E;;;;AAuBA,SAAgB,eAAe,OAAO;CAClC,OAAO,MAAM,QAAQ,KAAK;AAC9B;;AAEA,SAAgB,gBAAgB,OAAO;CACnC,OAAO,SAAS,KAAK,KAAK,OAAO,MAAM,SAAS;AACpD;;AAEA,SAAgB,cAAc,OAAO,KAAK;CACtC,OAAO,SAAS,KAAK,KAAK,OAAO,MAAM,SAAS;AACpD;;AAEA,SAAgB,cAAc,OAAO,KAAK;CACtC,OAAO,SAAS,KAAK,KAAK,OAAO,MAAM,SAAS;AACpD;;;;;;;;;;;;AA0BA,SAAgB,aAAa,KAAK,UAAU;CACxC,IAAI,eAAe,OACf,OAAO,IAAI;CACf,IAAI,cAAc,KAAK,SAAS,KAAK,IAAI,SACrC,OAAO,IAAI;CACf,IAAI,cAAc,KAAK,SAAS,KAAK,IAAI,SACrC,OAAO,IAAI;CACf,IAAI,aAAa,KAAA,GACb,OAAO;CACX,OAAO,OAAO,GAAG;AACrB;AAgBA,IAAM,+BAAe,IAAI,IAAI;CACzB,CAAC,KAAK,OAAO;CACb,CAAC,KAAK,MAAM;CACZ,CAAC,KAAK,MAAM;CACZ,CAAC,MAAK,QAAQ;CACd,CAAC,KAAK,OAAO;AACjB,CAAC;;;;;;;;;;AAUD,SAAgB,WAAW,OAAO;CAC9B,OAAO,MAAM,QAAQ,aAAa,SAAS,aAAa,IAAI,IAAI,KAAK,IAAI;AAC7E"}
+{"version":3,"file":"dist-CsgSfWwR.cjs","names":[],"sources":["../../common/dist/index.js"],"sourcesContent":["// General-purpose runtime type guards, shared across the MulmoClaude host,\n// bridges, and plugins. This is a leaf package — pure and dependency-free — so\n// any tier can import it without creating an uphill edge.\n//\n// These originated as `server/utils/types.ts` (#504), which centralised 40+\n// hand-written inline `typeof x === \"object\"` checks. They are promoted here so\n// the same guards stop being re-hand-written in every bridge and plugin too.\n/** Narrow `unknown` to a plain object (not null, not array). */\nexport function isRecord(value) {\n    return typeof value === \"object\" && value !== null && !Array.isArray(value);\n}\n/** Narrow `unknown` to any object (not null, arrays allowed).\n *  Use `isRecord` when you need to access string keys. */\nexport function isObj(value) {\n    return typeof value === \"object\" && value !== null;\n}\n/** Non-empty string after trimming whitespace. */\nexport function isNonEmptyString(value) {\n    return typeof value === \"string\" && value.trim().length > 0;\n}\n/** Record whose values are all strings. */\nexport function isStringRecord(value) {\n    if (!isRecord(value))\n        return false;\n    return Object.values(value).every((val) => typeof val === \"string\");\n}\n/** String array (every element is a string). */\nexport function isStringArray(value) {\n    return Array.isArray(value) && value.every((val) => typeof val === \"string\");\n}\n/** An array of unknowns. Prefer this over a bare `Array.isArray` in typed code:\n *  `Array.isArray(x: unknown)` narrows to `any[]`, silently reintroducing\n *  `any`, whereas this keeps the element type `unknown`. */\nexport function isUnknownArray(value) {\n    return Array.isArray(value);\n}\n/** Error-like object with a `code` property (e.g. Node.js fs errors). */\nexport function isErrorWithCode(value) {\n    return isRecord(value) && typeof value.code === \"string\";\n}\n/** Check that a record has a specific key with a string value. */\nexport function hasStringProp(value, key) {\n    return isRecord(value) && typeof value[key] === \"string\";\n}\n/** Check that a record has a specific key with a number value. */\nexport function hasNumberProp(value, key) {\n    return isRecord(value) && typeof value[key] === \"number\";\n}\n/** Split a comma-separated env value into trimmed, non-empty entries.\n *  `lowercase` folds case for identifiers compared case-insensitively\n *  (JIDs, email addresses, hex pubkeys). Absent/empty input → empty list. */\nexport function parseCsvList(raw, opts) {\n    return (raw ?? \"\")\n        .split(\",\")\n        .map((entry) => (opts?.lowercase ? entry.trim().toLowerCase() : entry.trim()))\n        .filter(Boolean);\n}\n/** A comma-separated env value as a Set — the canonical allowlist shape,\n *  where an empty set is the \"allow all\" sentinel (`set.size === 0`). */\nexport function parseCsvSet(raw, opts) {\n    return new Set(parseCsvList(raw, opts));\n}\n/** Normalise an unknown thrown value into a human-readable string. Isomorphic\n *  (host, bridges, plugins, Vue) — this is the single home for the helper that\n *  #2217 could only consolidate for server code, since `@mulmoclaude/core/utils`\n *  is server-only.\n *\n *  A non-Error object with a non-empty string `details` (gRPC convention) or\n *  `message` field surfaces that field — `details` wins — instead of the\n *  `[object Object]` a bare `String(err)` would print; an empty-string field\n *  falls through. `fallback` covers the error-boundary idiom where a thrown\n *  non-Error should read as a descriptive message rather than `String(err)`\n *  noise; omit it in logging contexts where `String(err)` is fine. */\nexport function errorMessage(err, fallback) {\n    if (err instanceof Error)\n        return err.message;\n    if (hasStringProp(err, \"details\") && err.details)\n        return err.details;\n    if (hasStringProp(err, \"message\") && err.message)\n        return err.message;\n    if (fallback !== undefined)\n        return fallback;\n    return String(err);\n}\n/** `Date` → `YYYY-MM-DD` in UTC — for dates that must not shift with the\n *  host's local timezone (tool-trace search dirs, API date keys). Isomorphic\n *  single source (#2480): the host re-exports it from `server/utils/date.ts`,\n *  x-plugin imports it directly. The `@receptron/task-scheduler` copy stays\n *  local on purpose — that leaf package is published independently and kept\n *  dependency-free. Wall-clock questions use the host's `toLocalIsoDate`. */\nexport function toUtcIsoDate(timestamp) {\n    const year = timestamp.getUTCFullYear();\n    const month = String(timestamp.getUTCMonth() + 1).padStart(2, \"0\");\n    const day = String(timestamp.getUTCDate()).padStart(2, \"0\");\n    return `${year}-${month}-${day}`;\n}\n// A Map, not an object literal: `{}[char]` reads through the prototype chain,\n// so a future caller widening the regex would silently get `[object Object]`\n// for keys like `constructor`.\nconst HTML_ESCAPES = new Map([\n    [\"&\", \"&amp;\"],\n    [\"<\", \"&lt;\"],\n    [\">\", \"&gt;\"],\n    ['\"', \"&quot;\"],\n    [\"'\", \"&#39;\"],\n]);\n/** HTML-escape text destined for markup or an attribute value — the fixed\n *  five-character map, nothing more. Lives here rather than in\n *  `@mulmoclaude/core/wiki` (#2483) because `@mulmoclaude/markdown-utils` is a\n *  leaf that core depends on and so cannot import back up; core/wiki\n *  re-exports this, keeping its consumers' import path unchanged.\n *\n *  Escaping `&` first is what makes a single pass safe — the entities this\n *  introduces contain none of the other four characters, so nothing is\n *  double-escaped. Not a sanitiser: it neither strips tags nor validates URLs. */\nexport function escapeHtml(value) {\n    return value.replace(/[&<>\"']/g, (char) => HTML_ESCAPES.get(char) ?? char);\n}\nexport { scanEnvOptions, snakeToLowerCamel } from \"./envScan.js\";\n"],"mappings":";;AAQA,SAAgB,SAAS,OAAO;CAC5B,OAAO,OAAO,UAAU,YAAY,UAAU,QAAQ,CAAC,MAAM,QAAQ,KAAK;AAC9E;;;AAGA,SAAgB,MAAM,OAAO;CACzB,OAAO,OAAO,UAAU,YAAY,UAAU;AAClD;;AAYA,SAAgB,cAAc,OAAO;CACjC,OAAO,MAAM,QAAQ,KAAK,KAAK,MAAM,OAAO,QAAQ,OAAO,QAAQ,QAAQ;AAC/E;;;;AAIA,SAAgB,eAAe,OAAO;CAClC,OAAO,MAAM,QAAQ,KAAK;AAC9B;;AAEA,SAAgB,gBAAgB,OAAO;CACnC,OAAO,SAAS,KAAK,KAAK,OAAO,MAAM,SAAS;AACpD;;AAEA,SAAgB,cAAc,OAAO,KAAK;CACtC,OAAO,SAAS,KAAK,KAAK,OAAO,MAAM,SAAS;AACpD;;AAEA,SAAgB,cAAc,OAAO,KAAK;CACtC,OAAO,SAAS,KAAK,KAAK,OAAO,MAAM,SAAS;AACpD;;;;;;;;;;;;AA0BA,SAAgB,aAAa,KAAK,UAAU;CACxC,IAAI,eAAe,OACf,OAAO,IAAI;CACf,IAAI,cAAc,KAAK,SAAS,KAAK,IAAI,SACrC,OAAO,IAAI;CACf,IAAI,cAAc,KAAK,SAAS,KAAK,IAAI,SACrC,OAAO,IAAI;CACf,IAAI,aAAa,KAAA,GACb,OAAO;CACX,OAAO,OAAO,GAAG;AACrB;AAgBA,IAAM,+BAAe,IAAI,IAAI;CACzB,CAAC,KAAK,OAAO;CACb,CAAC,KAAK,MAAM;CACZ,CAAC,KAAK,MAAM;CACZ,CAAC,MAAK,QAAQ;CACd,CAAC,KAAK,OAAO;AACjB,CAAC;;;;;;;;;;AAUD,SAAgB,WAAW,OAAO;CAC9B,OAAO,MAAM,QAAQ,aAAa,SAAS,aAAa,IAAI,IAAI,KAAK,IAAI;AAC7E"}

package/dist/{dist-DP1FTGnO.js → dist-D8zokgGo.js}

@@ -3,6 +3,15 @@
 function isRecord(value) {
 	return typeof value === "object" && value !== null && !Array.isArray(value);
 }
+/** Narrow `unknown` to any object (not null, arrays allowed).
+*  Use `isRecord` when you need to access string keys. */
+function isObj(value) {
+	return typeof value === "object" && value !== null;
+}
+/** String array (every element is a string). */
+function isStringArray(value) {
+	return Array.isArray(value) && value.every((val) => typeof val === "string");
+}
 /** An array of unknowns. Prefer this over a bare `Array.isArray` in typed code:
 *  `Array.isArray(x: unknown)` narrows to `any[]`, silently reintroducing
 *  `any`, whereas this keeps the element type `unknown`. */
@@ -59,6 +68,6 @@ function escapeHtml(value) {
 	return value.replace(/[&<>"']/g, (char) => HTML_ESCAPES.get(char) ?? char);
 }
 //#endregion
-export { isErrorWithCode as a, hasStringProp as i, escapeHtml as n, isRecord as o, hasNumberProp as r, isUnknownArray as s, errorMessage as t };
+export { isErrorWithCode as a, isStringArray as c, hasStringProp as i, isUnknownArray as l, escapeHtml as n, isObj as o, hasNumberProp as r, isRecord as s, errorMessage as t };
 
-//# sourceMappingURL=dist-DP1FTGnO.js.map
+//# sourceMappingURL=dist-D8zokgGo.js.map

package/dist/{dist-DP1FTGnO.js.map → dist-D8zokgGo.js.map}

@@ -1 +1 @@
-{"version":3,"file":"dist-DP1FTGnO.js","names":[],"sources":["../../common/dist/index.js"],"sourcesContent":["// General-purpose runtime type guards, shared across the MulmoClaude host,\n// bridges, and plugins. This is a leaf package — pure and dependency-free — so\n// any tier can import it without creating an uphill edge.\n//\n// These originated as `server/utils/types.ts` (#504), which centralised 40+\n// hand-written inline `typeof x === \"object\"` checks. They are promoted here so\n// the same guards stop being re-hand-written in every bridge and plugin too.\n/** Narrow `unknown` to a plain object (not null, not array). */\nexport function isRecord(value) {\n    return typeof value === \"object\" && value !== null && !Array.isArray(value);\n}\n/** Narrow `unknown` to any object (not null, arrays allowed).\n *  Use `isRecord` when you need to access string keys. */\nexport function isObj(value) {\n    return typeof value === \"object\" && value !== null;\n}\n/** Non-empty string after trimming whitespace. */\nexport function isNonEmptyString(value) {\n    return typeof value === \"string\" && value.trim().length > 0;\n}\n/** Record whose values are all strings. */\nexport function isStringRecord(value) {\n    if (!isRecord(value))\n        return false;\n    return Object.values(value).every((val) => typeof val === \"string\");\n}\n/** String array (every element is a string). */\nexport function isStringArray(value) {\n    return Array.isArray(value) && value.every((val) => typeof val === \"string\");\n}\n/** An array of unknowns. Prefer this over a bare `Array.isArray` in typed code:\n *  `Array.isArray(x: unknown)` narrows to `any[]`, silently reintroducing\n *  `any`, whereas this keeps the element type `unknown`. */\nexport function isUnknownArray(value) {\n    return Array.isArray(value);\n}\n/** Error-like object with a `code` property (e.g. Node.js fs errors). */\nexport function isErrorWithCode(value) {\n    return isRecord(value) && typeof value.code === \"string\";\n}\n/** Check that a record has a specific key with a string value. */\nexport function hasStringProp(value, key) {\n    return isRecord(value) && typeof value[key] === \"string\";\n}\n/** Check that a record has a specific key with a number value. */\nexport function hasNumberProp(value, key) {\n    return isRecord(value) && typeof value[key] === \"number\";\n}\n/** Split a comma-separated env value into trimmed, non-empty entries.\n *  `lowercase` folds case for identifiers compared case-insensitively\n *  (JIDs, email addresses, hex pubkeys). Absent/empty input → empty list. */\nexport function parseCsvList(raw, opts) {\n    return (raw ?? \"\")\n        .split(\",\")\n        .map((entry) => (opts?.lowercase ? entry.trim().toLowerCase() : entry.trim()))\n        .filter(Boolean);\n}\n/** A comma-separated env value as a Set — the canonical allowlist shape,\n *  where an empty set is the \"allow all\" sentinel (`set.size === 0`). */\nexport function parseCsvSet(raw, opts) {\n    return new Set(parseCsvList(raw, opts));\n}\n/** Normalise an unknown thrown value into a human-readable string. Isomorphic\n *  (host, bridges, plugins, Vue) — this is the single home for the helper that\n *  #2217 could only consolidate for server code, since `@mulmoclaude/core/utils`\n *  is server-only.\n *\n *  A non-Error object with a non-empty string `details` (gRPC convention) or\n *  `message` field surfaces that field — `details` wins — instead of the\n *  `[object Object]` a bare `String(err)` would print; an empty-string field\n *  falls through. `fallback` covers the error-boundary idiom where a thrown\n *  non-Error should read as a descriptive message rather than `String(err)`\n *  noise; omit it in logging contexts where `String(err)` is fine. */\nexport function errorMessage(err, fallback) {\n    if (err instanceof Error)\n        return err.message;\n    if (hasStringProp(err, \"details\") && err.details)\n        return err.details;\n    if (hasStringProp(err, \"message\") && err.message)\n        return err.message;\n    if (fallback !== undefined)\n        return fallback;\n    return String(err);\n}\n/** `Date` → `YYYY-MM-DD` in UTC — for dates that must not shift with the\n *  host's local timezone (tool-trace search dirs, API date keys). Isomorphic\n *  single source (#2480): the host re-exports it from `server/utils/date.ts`,\n *  x-plugin imports it directly. The `@receptron/task-scheduler` copy stays\n *  local on purpose — that leaf package is published independently and kept\n *  dependency-free. Wall-clock questions use the host's `toLocalIsoDate`. */\nexport function toUtcIsoDate(timestamp) {\n    const year = timestamp.getUTCFullYear();\n    const month = String(timestamp.getUTCMonth() + 1).padStart(2, \"0\");\n    const day = String(timestamp.getUTCDate()).padStart(2, \"0\");\n    return `${year}-${month}-${day}`;\n}\n// A Map, not an object literal: `{}[char]` reads through the prototype chain,\n// so a future caller widening the regex would silently get `[object Object]`\n// for keys like `constructor`.\nconst HTML_ESCAPES = new Map([\n    [\"&\", \"&amp;\"],\n    [\"<\", \"&lt;\"],\n    [\">\", \"&gt;\"],\n    ['\"', \"&quot;\"],\n    [\"'\", \"&#39;\"],\n]);\n/** HTML-escape text destined for markup or an attribute value — the fixed\n *  five-character map, nothing more. Lives here rather than in\n *  `@mulmoclaude/core/wiki` (#2483) because `@mulmoclaude/markdown-utils` is a\n *  leaf that core depends on and so cannot import back up; core/wiki\n *  re-exports this, keeping its consumers' import path unchanged.\n *\n *  Escaping `&` first is what makes a single pass safe — the entities this\n *  introduces contain none of the other four characters, so nothing is\n *  double-escaped. Not a sanitiser: it neither strips tags nor validates URLs. */\nexport function escapeHtml(value) {\n    return value.replace(/[&<>\"']/g, (char) => HTML_ESCAPES.get(char) ?? char);\n}\nexport { scanEnvOptions, snakeToLowerCamel } from \"./envScan.js\";\n"],"mappings":";;AAQA,SAAgB,SAAS,OAAO;CAC5B,OAAO,OAAO,UAAU,YAAY,UAAU,QAAQ,CAAC,MAAM,QAAQ,KAAK;AAC9E;;;;AAuBA,SAAgB,eAAe,OAAO;CAClC,OAAO,MAAM,QAAQ,KAAK;AAC9B;;AAEA,SAAgB,gBAAgB,OAAO;CACnC,OAAO,SAAS,KAAK,KAAK,OAAO,MAAM,SAAS;AACpD;;AAEA,SAAgB,cAAc,OAAO,KAAK;CACtC,OAAO,SAAS,KAAK,KAAK,OAAO,MAAM,SAAS;AACpD;;AAEA,SAAgB,cAAc,OAAO,KAAK;CACtC,OAAO,SAAS,KAAK,KAAK,OAAO,MAAM,SAAS;AACpD;;;;;;;;;;;;AA0BA,SAAgB,aAAa,KAAK,UAAU;CACxC,IAAI,eAAe,OACf,OAAO,IAAI;CACf,IAAI,cAAc,KAAK,SAAS,KAAK,IAAI,SACrC,OAAO,IAAI;CACf,IAAI,cAAc,KAAK,SAAS,KAAK,IAAI,SACrC,OAAO,IAAI;CACf,IAAI,aAAa,KAAA,GACb,OAAO;CACX,OAAO,OAAO,GAAG;AACrB;AAgBA,IAAM,+BAAe,IAAI,IAAI;CACzB,CAAC,KAAK,OAAO;CACb,CAAC,KAAK,MAAM;CACZ,CAAC,KAAK,MAAM;CACZ,CAAC,MAAK,QAAQ;CACd,CAAC,KAAK,OAAO;AACjB,CAAC;;;;;;;;;;AAUD,SAAgB,WAAW,OAAO;CAC9B,OAAO,MAAM,QAAQ,aAAa,SAAS,aAAa,IAAI,IAAI,KAAK,IAAI;AAC7E"}
+{"version":3,"file":"dist-D8zokgGo.js","names":[],"sources":["../../common/dist/index.js"],"sourcesContent":["// General-purpose runtime type guards, shared across the MulmoClaude host,\n// bridges, and plugins. This is a leaf package — pure and dependency-free — so\n// any tier can import it without creating an uphill edge.\n//\n// These originated as `server/utils/types.ts` (#504), which centralised 40+\n// hand-written inline `typeof x === \"object\"` checks. They are promoted here so\n// the same guards stop being re-hand-written in every bridge and plugin too.\n/** Narrow `unknown` to a plain object (not null, not array). */\nexport function isRecord(value) {\n    return typeof value === \"object\" && value !== null && !Array.isArray(value);\n}\n/** Narrow `unknown` to any object (not null, arrays allowed).\n *  Use `isRecord` when you need to access string keys. */\nexport function isObj(value) {\n    return typeof value === \"object\" && value !== null;\n}\n/** Non-empty string after trimming whitespace. */\nexport function isNonEmptyString(value) {\n    return typeof value === \"string\" && value.trim().length > 0;\n}\n/** Record whose values are all strings. */\nexport function isStringRecord(value) {\n    if (!isRecord(value))\n        return false;\n    return Object.values(value).every((val) => typeof val === \"string\");\n}\n/** String array (every element is a string). */\nexport function isStringArray(value) {\n    return Array.isArray(value) && value.every((val) => typeof val === \"string\");\n}\n/** An array of unknowns. Prefer this over a bare `Array.isArray` in typed code:\n *  `Array.isArray(x: unknown)` narrows to `any[]`, silently reintroducing\n *  `any`, whereas this keeps the element type `unknown`. */\nexport function isUnknownArray(value) {\n    return Array.isArray(value);\n}\n/** Error-like object with a `code` property (e.g. Node.js fs errors). */\nexport function isErrorWithCode(value) {\n    return isRecord(value) && typeof value.code === \"string\";\n}\n/** Check that a record has a specific key with a string value. */\nexport function hasStringProp(value, key) {\n    return isRecord(value) && typeof value[key] === \"string\";\n}\n/** Check that a record has a specific key with a number value. */\nexport function hasNumberProp(value, key) {\n    return isRecord(value) && typeof value[key] === \"number\";\n}\n/** Split a comma-separated env value into trimmed, non-empty entries.\n *  `lowercase` folds case for identifiers compared case-insensitively\n *  (JIDs, email addresses, hex pubkeys). Absent/empty input → empty list. */\nexport function parseCsvList(raw, opts) {\n    return (raw ?? \"\")\n        .split(\",\")\n        .map((entry) => (opts?.lowercase ? entry.trim().toLowerCase() : entry.trim()))\n        .filter(Boolean);\n}\n/** A comma-separated env value as a Set — the canonical allowlist shape,\n *  where an empty set is the \"allow all\" sentinel (`set.size === 0`). */\nexport function parseCsvSet(raw, opts) {\n    return new Set(parseCsvList(raw, opts));\n}\n/** Normalise an unknown thrown value into a human-readable string. Isomorphic\n *  (host, bridges, plugins, Vue) — this is the single home for the helper that\n *  #2217 could only consolidate for server code, since `@mulmoclaude/core/utils`\n *  is server-only.\n *\n *  A non-Error object with a non-empty string `details` (gRPC convention) or\n *  `message` field surfaces that field — `details` wins — instead of the\n *  `[object Object]` a bare `String(err)` would print; an empty-string field\n *  falls through. `fallback` covers the error-boundary idiom where a thrown\n *  non-Error should read as a descriptive message rather than `String(err)`\n *  noise; omit it in logging contexts where `String(err)` is fine. */\nexport function errorMessage(err, fallback) {\n    if (err instanceof Error)\n        return err.message;\n    if (hasStringProp(err, \"details\") && err.details)\n        return err.details;\n    if (hasStringProp(err, \"message\") && err.message)\n        return err.message;\n    if (fallback !== undefined)\n        return fallback;\n    return String(err);\n}\n/** `Date` → `YYYY-MM-DD` in UTC — for dates that must not shift with the\n *  host's local timezone (tool-trace search dirs, API date keys). Isomorphic\n *  single source (#2480): the host re-exports it from `server/utils/date.ts`,\n *  x-plugin imports it directly. The `@receptron/task-scheduler` copy stays\n *  local on purpose — that leaf package is published independently and kept\n *  dependency-free. Wall-clock questions use the host's `toLocalIsoDate`. */\nexport function toUtcIsoDate(timestamp) {\n    const year = timestamp.getUTCFullYear();\n    const month = String(timestamp.getUTCMonth() + 1).padStart(2, \"0\");\n    const day = String(timestamp.getUTCDate()).padStart(2, \"0\");\n    return `${year}-${month}-${day}`;\n}\n// A Map, not an object literal: `{}[char]` reads through the prototype chain,\n// so a future caller widening the regex would silently get `[object Object]`\n// for keys like `constructor`.\nconst HTML_ESCAPES = new Map([\n    [\"&\", \"&amp;\"],\n    [\"<\", \"&lt;\"],\n    [\">\", \"&gt;\"],\n    ['\"', \"&quot;\"],\n    [\"'\", \"&#39;\"],\n]);\n/** HTML-escape text destined for markup or an attribute value — the fixed\n *  five-character map, nothing more. Lives here rather than in\n *  `@mulmoclaude/core/wiki` (#2483) because `@mulmoclaude/markdown-utils` is a\n *  leaf that core depends on and so cannot import back up; core/wiki\n *  re-exports this, keeping its consumers' import path unchanged.\n *\n *  Escaping `&` first is what makes a single pass safe — the entities this\n *  introduces contain none of the other four characters, so nothing is\n *  double-escaped. Not a sanitiser: it neither strips tags nor validates URLs. */\nexport function escapeHtml(value) {\n    return value.replace(/[&<>\"']/g, (char) => HTML_ESCAPES.get(char) ?? char);\n}\nexport { scanEnvOptions, snakeToLowerCamel } from \"./envScan.js\";\n"],"mappings":";;AAQA,SAAgB,SAAS,OAAO;CAC5B,OAAO,OAAO,UAAU,YAAY,UAAU,QAAQ,CAAC,MAAM,QAAQ,KAAK;AAC9E;;;AAGA,SAAgB,MAAM,OAAO;CACzB,OAAO,OAAO,UAAU,YAAY,UAAU;AAClD;;AAYA,SAAgB,cAAc,OAAO;CACjC,OAAO,MAAM,QAAQ,KAAK,KAAK,MAAM,OAAO,QAAQ,OAAO,QAAQ,QAAQ;AAC/E;;;;AAIA,SAAgB,eAAe,OAAO;CAClC,OAAO,MAAM,QAAQ,KAAK;AAC9B;;AAEA,SAAgB,gBAAgB,OAAO;CACnC,OAAO,SAAS,KAAK,KAAK,OAAO,MAAM,SAAS;AACpD;;AAEA,SAAgB,cAAc,OAAO,KAAK;CACtC,OAAO,SAAS,KAAK,KAAK,OAAO,MAAM,SAAS;AACpD;;AAEA,SAAgB,cAAc,OAAO,KAAK;CACtC,OAAO,SAAS,KAAK,KAAK,OAAO,MAAM,SAAS;AACpD;;;;;;;;;;;;AA0BA,SAAgB,aAAa,KAAK,UAAU;CACxC,IAAI,eAAe,OACf,OAAO,IAAI;CACf,IAAI,cAAc,KAAK,SAAS,KAAK,IAAI,SACrC,OAAO,IAAI;CACf,IAAI,cAAc,KAAK,SAAS,KAAK,IAAI,SACrC,OAAO,IAAI;CACf,IAAI,aAAa,KAAA,GACb,OAAO;CACX,OAAO,OAAO,GAAG;AACrB;AAgBA,IAAM,+BAAe,IAAI,IAAI;CACzB,CAAC,KAAK,OAAO;CACb,CAAC,KAAK,MAAM;CACZ,CAAC,KAAK,MAAM;CACZ,CAAC,MAAK,QAAQ;CACd,CAAC,KAAK,OAAO;AACjB,CAAC;;;;;;;;;;AAUD,SAAgB,WAAW,OAAO;CAC9B,OAAO,MAAM,QAAQ,aAAa,SAAS,aAAa,IAAI,IAAI,KAAK,IAAI;AAC7E"}

package/dist/feeds/index.cjs

@@ -1,6 +1,6 @@
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
-const require_calendarGrid = require("../calendarGrid-CaS9er8i.cjs");
-const require_ingestTypes = require("../ingestTypes-D1GQdG8e.cjs");
+const require_calendarGrid = require("../calendarGrid-p8K-7cuB.cjs");
+const require_ingestTypes = require("../ingestTypes-CPR-h-OZ.cjs");
 exports.AGENT_INGEST_KIND = require_ingestTypes.AGENT_INGEST_KIND;
 exports.DEFAULT_FEED_MAX_ITEMS = require_ingestTypes.DEFAULT_FEED_MAX_ITEMS;
 exports.FEED_SCHEDULES = require_calendarGrid.FEED_SCHEDULES;

package/dist/feeds/index.js

@@ -1,3 +1,3 @@
-import { C as FEED_SCHEDULES, w as INGEST_KINDS } from "../calendarGrid-CrGxeCOG.js";
-import { n as DEFAULT_FEED_MAX_ITEMS, r as isFeedSchedule, t as AGENT_INGEST_KIND } from "../ingestTypes-XReG-li7.js";
+import { C as FEED_SCHEDULES, w as INGEST_KINDS } from "../calendarGrid-Csy2rpjp.js";
+import { n as DEFAULT_FEED_MAX_ITEMS, r as isFeedSchedule, t as AGENT_INGEST_KIND } from "../ingestTypes-F2IJhOLJ.js";
 export { AGENT_INGEST_KIND, DEFAULT_FEED_MAX_ITEMS, FEED_SCHEDULES, INGEST_KINDS, isFeedSchedule };

package/dist/feeds/server/host.d.ts

@@ -20,9 +20,9 @@ export type AgentWorkerRunner = (args: {
     message: string;
     roleId: string;
     hidden: boolean;
-    onComplete?: (outcome: {
+    onComplete?: ((outcome: {
         didError: boolean;
-    }) => void | Promise<void>;
+    }) => void | Promise<void>) | undefined;
 }) => Promise<AgentWorkerResult>;
 /** Public alias of the shared `StructuredLogger` — same shape as `CollectionLogger`. */
 export type FeedsLogger = StructuredLogger;

package/dist/feeds/server/index.cjs

@@ -1,12 +1,13 @@
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
 const require_rolldown_runtime = require("../../rolldown-runtime-D6vf50IK.cjs");
-const require_calendarGrid = require("../../calendarGrid-CaS9er8i.cjs");
-const require_project = require("../../project-CCtT_fQr.cjs");
-const require_discovery = require("../../discovery-DAoMnBYM.cjs");
-const require_server = require("../../server-B_b0bLSW.cjs");
+const require_dist = require("../../dist-CsgSfWwR.cjs");
+const require_calendarGrid = require("../../calendarGrid-p8K-7cuB.cjs");
+const require_project = require("../../project-C1ep9pvo.cjs");
+const require_discovery = require("../../discovery-DSLgRQhN.cjs");
+const require_server = require("../../server-1c6gB372.cjs");
 const require_feeds_paths = require("../paths.cjs");
-const require_ingestTypes = require("../../ingestTypes-D1GQdG8e.cjs");
-const require_notifier = require("../../notifier-C3IhYxqh.cjs");
+const require_ingestTypes = require("../../ingestTypes-CPR-h-OZ.cjs");
+const require_notifier = require("../../notifier-CKFVVwDP.cjs");
 let node_path = require("node:path");
 node_path = require_rolldown_runtime.__toESM(node_path, 1);
 let node_crypto = require("node:crypto");
@@ -145,10 +146,10 @@ function stripIpv6Brackets(hostname) {
 *  `[::ffff:127.0.0.1]` as `::ffff:7f00:1`, so matching only the dotted form
 *  would wave the mapped loopback through any URL-sourced check. */
 function mappedIpv4Value(lower) {
-	const dotted = /^::ffff:(\d+\.\d+\.\d+\.\d+)$/.exec(lower);
-	if (dotted) return ipv4ToInt(dotted[1]);
-	const hex = /^::ffff:([0-9a-f]{1,4}):([0-9a-f]{1,4})$/.exec(lower);
-	if (hex) return Number.parseInt(hex[1], 16) * 65536 + Number.parseInt(hex[2], 16);
+	const dotted = /^::ffff:(\d+\.\d+\.\d+\.\d+)$/.exec(lower)?.[1];
+	if (dotted !== void 0) return ipv4ToInt(dotted);
+	const [, high, low] = /^::ffff:([0-9a-f]{1,4}):([0-9a-f]{1,4})$/.exec(lower) ?? [];
+	if (high !== void 0 && low !== void 0) return Number.parseInt(high, 16) * 65536 + Number.parseInt(low, 16);
 	return null;
 }
 /** Blocks loopback/unspecified, fc00::/7 unique-local, fe80::/10 link-local,
@@ -159,7 +160,7 @@ function isBlockedIpv6(address) {
 	if (lower === "::1" || lower === "::") return true;
 	const mapped = mappedIpv4Value(lower);
 	if (mapped !== null) return isBlockedIpv4Value(mapped);
-	const [head] = lower.split(":");
+	const [head = ""] = lower.split(":");
 	if (head.length === 0) return false;
 	const leading = Number.parseInt(head, 16);
 	if (Number.isNaN(leading)) return false;
@@ -374,7 +375,7 @@ function parseSegment(segment, tokens) {
 	});
 	if (bracketStart === -1) return;
 	for (const match of segment.slice(bracketStart).matchAll(BRACKET_RE)) {
-		const [, inner] = match;
+		const [, inner = ""] = match;
 		if (inner.length > 0) tokens.push({
 			kind: "index",
 			index: Number(inner)
@@ -389,11 +390,10 @@ function tokenize(path) {
 function step(current, token) {
 	if (current === null || current === void 0) return void 0;
 	if (token.kind === "key") {
-		if (typeof current !== "object" || Array.isArray(current)) return void 0;
-		const record = current;
-		return Object.hasOwn(record, token.key) ? record[token.key] : void 0;
+		if (!require_dist.isRecord(current)) return void 0;
+		return Object.hasOwn(current, token.key) ? current[token.key] : void 0;
 	}
-	return Array.isArray(current) ? current[token.index] : void 0;
+	return require_dist.isUnknownArray(current) ? current[token.index] : void 0;
 }
 /** Resolve a dot/bracket path against `root`, or `undefined` on any miss. */
 function getByPath(root, path) {
@@ -422,10 +422,9 @@ function asKeyString(value) {
 *  shape — so a tag like `<guid isPermaLink="false">id</guid>` maps to
 *  its text without the caller needing to write `.#text`. */
 function unwrapTextNode(value) {
-	if (value && typeof value === "object" && !Array.isArray(value)) {
-		const obj = value;
-		if (typeof obj["#text"] === "string") return obj["#text"];
-		if (typeof obj["#cdata"] === "string") return obj["#cdata"];
+	if (require_dist.isRecord(value)) {
+		if (typeof value["#text"] === "string") return value["#text"];
+		if (typeof value["#cdata"] === "string") return value["#cdata"];
 	}
 	return value;
 }
@@ -512,9 +511,16 @@ function defaultFeedState(slug) {
 		consecutiveFailures: 0
 	};
 }
+/** The stored cursor, keeping only the string entries its type promises. A
+*  hand-edited state file can hold anything; a non-string entry is unreadable
+*  to every retriever, so carrying it forward would only re-persist junk. */
+function readCursor(value) {
+	if (!require_dist.isRecord(value)) return {};
+	return Object.fromEntries(Object.entries(value).filter((entry) => typeof entry[1] === "string"));
+}
 function normalizeState(slug, parsed) {
 	const base = defaultFeedState(slug);
-	const cursor = parsed.cursor && typeof parsed.cursor === "object" ? parsed.cursor : base.cursor;
+	const cursor = parsed.cursor === void 0 ? base.cursor : readCursor(parsed.cursor);
 	return {
 		slug,
 		lastFetchedAt: typeof parsed.lastFetchedAt === "string" ? parsed.lastFetchedAt : base.lastFetchedAt,
@@ -529,9 +535,10 @@ async function readFeedState(workspaceRoot, target) {
 	const { slug } = target;
 	try {
 		const raw = await (0, node_fs_promises.readFile)(stateFilePath(target, workspaceRoot), "utf-8");
-		return normalizeState(slug, JSON.parse(raw));
+		const parsed = JSON.parse(raw);
+		return normalizeState(slug, require_dist.isRecord(parsed) ? parsed : {});
 	} catch (err) {
-		if (err.code !== "ENOENT") log.warn("feeds", "failed to read feed state, using default", {
+		if (!require_dist.isErrorWithCode(err) || err.code !== "ENOENT") log.warn("feeds", "failed to read feed state, using default", {
 			slug,
 			error: String(err)
 		});
@@ -576,8 +583,8 @@ function result(slug, patch) {
 async function refreshViaAgent(workspaceRoot, collection, opts) {
 	const hidden = opts?.hidden ?? true;
 	const { slug } = collection;
-	const ingest = collection.schema.ingest;
-	if (!ingest || ingest.kind !== "agent") return result(slug, { errors: ["collection has no agent ingest config"] });
+	const { ingest } = collection.schema;
+	if (ingest?.kind !== "agent") return result(slug, { errors: ["collection has no agent ingest config"] });
 	const workerRunner = workerRunnerOrNull();
 	if (!workerRunner) return result(slug, { errors: ["agent ingest worker runner not configured"] });
 	const template = await require_server.readSkillTemplate(collection.skillDir, ingest.template);
@@ -681,10 +688,9 @@ async function onWorkerSuccess(state, collection) {
 //#region src/feeds/server/engine.ts
 var ONE_HOUR_MS = 36e5;
 var ONE_DAY_MS = 864e5;
-/** Feed schemas carry the rich `IngestSpec` (validated at discovery —
-*  `source === "feed"` requires `ingest`), but the canonical
-*  `CollectionSchema.ingest` only promises the minimal `CollectionIngest`.
-*  Narrow here so the engine can read the retrieval fields type-safely. */
+/** A feed's retrieval config, or undefined. `CollectionSchema.ingest` and the
+*  engine's `IngestSpec` are both `IngestZ`'s inferred union, so this is a
+*  rename, not a narrowing — the engine keeps its own vocabulary at the seam. */
 function feedIngest(schema) {
 	return schema.ingest;
 }