@mulmoclaude/core 5.7.1 → 5.8.1

package/dist/artifacts/paths.cjs

@@ -1,74 +1,7 @@
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
+let gui_chat_protocol = require("gui-chat-protocol");
+let _gui_chat_plugin_common = require("@gui-chat-plugin/common");
 //#region src/artifacts/paths.ts
-var MAX_SLUG_LEN = 120;
-/** The workspace directory every artifact lives under (`<workspace>/artifacts`). */
-var ARTIFACTS_ROOT = "artifacts";
-/**
-* Lowercase-ASCII slug for a throwaway, timestamped artifact filename. Empty,
-* whitespace-only, and non-ASCII-only titles fall back to `fallback`. Capped at
-* 120 chars so a long LLM title can't blow the filesystem's NAME_MAX.
-*
-* Leading/trailing hyphens are stripped with a linear scan rather than a regex
-* like `/^-+|-+$/` — CodeQL flags the trailing-anchor form as polynomial
-* backtracking on the attacker-influenced (LLM-provided) title. Strip → cap →
-* strip so a cut at the 120-char boundary can't re-expose a trailing hyphen.
-*/
-function slugifyArtifact(title, fallback) {
-	if (!title) return fallback;
-	const collapsed = title.toLowerCase().replace(/[^a-z0-9]+/g, "-");
-	let start = 0;
-	let end = collapsed.length;
-	while (start < end && collapsed[start] === "-") start += 1;
-	while (end > start && collapsed[end - 1] === "-") end -= 1;
-	if (end - start > MAX_SLUG_LEN) end = start + MAX_SLUG_LEN;
-	while (end > start && collapsed[end - 1] === "-") end -= 1;
-	return collapsed.slice(start, end) || fallback;
-}
-/** UTC `YYYY/MM` partition (matches the host's #764 artifact sharding). UTC —
-*  not local — so a workspace synced across timezones stays in one bucket. */
-function yearMonthUtc(now = /* @__PURE__ */ new Date()) {
-	return `${now.getUTCFullYear()}/${String(now.getUTCMonth() + 1).padStart(2, "0")}`;
-}
-/**
-* FileOps-relative artifact path: `<dir>[/YYYY/MM]/<slug>-<epochMs>[-<suffix>]<ext>`.
-* This is what `files.artifacts.write` takes; prefix it with
-* `toWorkspaceArtifactPath` for the workspace-relative form shown to the LLM.
-*
-* `<epochMs>` alone separates paths built at different times, but NOT two calls
-* with the same title inside one millisecond — those produce the same name, and
-* the second write silently replaces the first artifact. Pass `suffix` (a short
-* random token, as `shapeArtifactPath` does) wherever concurrent callers can
-* share a title.
-*/
-function buildArtifactRelPath(params) {
-	const { dir, title, ext, fallback, now = /* @__PURE__ */ new Date(), partitioned = true, suffix } = params;
-	const stamp = suffix ? `${now.getTime()}-${suffix}` : `${now.getTime()}`;
-	const fileName = `${slugifyArtifact(title, fallback)}-${stamp}${ext}`;
-	return (partitioned ? [
-		dir,
-		yearMonthUtc(now),
-		fileName
-	] : [dir, fileName]).join("/");
-}
-/** Prefix a FileOps-relative artifact path with the workspace `artifacts/` root. */
-function toWorkspaceArtifactPath(relPath) {
-	return `${ARTIFACTS_ROOT}/${relPath}`;
-}
-/**
-* True when any `/` or `\`-separated segment of `value` is empty (`//`,
-* leading/trailing slash), `.`, or `..`. The lexical traversal / non-canonical
-* guard every artifact path check shares — so a workspace-escape judgement
-* can't drift between plugins.
-*
-* Both separators, matching `classifyFilePath`: an artifact path is minted from
-* a slug and so never contains a backslash, while `node:path` on Windows treats
-* one as a separator. Splitting on `/` alone accepted
-* `artifacts/shapes/..\..\secrets.shape` — canonical to this check, traversal
-* to `path.join` (codex on #3056).
-*/
-function hasUnsafePathSegment(value) {
-	return value.split(/[/\\]/).some((seg) => seg === "" || seg === "." || seg === "..");
-}
 var WINDOWS_DRIVE_RE = /^[a-zA-Z]:[\\/]/;
 /** True when `value` names a location that does not depend on a base directory.
 *  Exported so a URL builder and a path resolver cannot disagree about which
@@ -110,14 +43,44 @@ function hasDotfileSegment(value) {
 	return value.split(/[/\\]/).some((segment) => segment.startsWith("."));
 }
 //#endregion
-exports.ARTIFACTS_ROOT = ARTIFACTS_ROOT;
-exports.buildArtifactRelPath = buildArtifactRelPath;
+Object.defineProperty(exports, "ARTIFACTS_ROOT", {
+	enumerable: true,
+	get: function() {
+		return gui_chat_protocol.ARTIFACTS_ROOT;
+	}
+});
+Object.defineProperty(exports, "buildArtifactRelPath", {
+	enumerable: true,
+	get: function() {
+		return _gui_chat_plugin_common.buildArtifactRelPath;
+	}
+});
 exports.classifyFilePath = classifyFilePath;
 exports.hasDotfileSegment = hasDotfileSegment;
-exports.hasUnsafePathSegment = hasUnsafePathSegment;
+Object.defineProperty(exports, "hasUnsafePathSegment", {
+	enumerable: true,
+	get: function() {
+		return _gui_chat_plugin_common.hasUnsafePathSegment;
+	}
+});
 exports.isAbsoluteFilePathValue = isAbsoluteFilePathValue;
-exports.slugifyArtifact = slugifyArtifact;
-exports.toWorkspaceArtifactPath = toWorkspaceArtifactPath;
-exports.yearMonthUtc = yearMonthUtc;
+Object.defineProperty(exports, "slugifyArtifact", {
+	enumerable: true,
+	get: function() {
+		return _gui_chat_plugin_common.slugifyArtifact;
+	}
+});
+Object.defineProperty(exports, "toWorkspaceArtifactPath", {
+	enumerable: true,
+	get: function() {
+		return _gui_chat_plugin_common.toWorkspaceArtifactPath;
+	}
+});
+Object.defineProperty(exports, "yearMonthUtc", {
+	enumerable: true,
+	get: function() {
+		return _gui_chat_plugin_common.yearMonthUtc;
+	}
+});
 
 //# sourceMappingURL=paths.cjs.map

package/dist/artifacts/paths.cjs.map

@@ -1 +1 @@
-{"version":3,"file":"paths.cjs","names":[],"sources":["../../src/artifacts/paths.ts"],"sourcesContent":["// Shared artifact-path builders for the presentation plugins (chart / html /\n// mulmoscript). Browser-safe by design: no node:path / no node:crypto, so it\n// bundles into both the server core and the browser (`./vue`) plugin entries.\n//\n// These are POSIX artifact *wire paths* — stored in JSON and used as the\n// generic `files.artifacts` FileOps keys — so they must ALWAYS join with `/`\n// regardless of host OS. `path.join` would emit `\\` on Windows and corrupt\n// them; `path.posix.join` would drag in node:path and break the browser\n// bundle. So already-sanitised segments are joined with `/` directly (same\n// choice the plugins made before this module existed).\n\nconst MAX_SLUG_LEN = 120;\n\n/** The workspace directory every artifact lives under (`<workspace>/artifacts`). */\nexport const ARTIFACTS_ROOT = \"artifacts\";\n\n/**\n * Lowercase-ASCII slug for a throwaway, timestamped artifact filename. Empty,\n * whitespace-only, and non-ASCII-only titles fall back to `fallback`. Capped at\n * 120 chars so a long LLM title can't blow the filesystem's NAME_MAX.\n *\n * Leading/trailing hyphens are stripped with a linear scan rather than a regex\n * like `/^-+|-+$/` — CodeQL flags the trailing-anchor form as polynomial\n * backtracking on the attacker-influenced (LLM-provided) title. Strip → cap →\n * strip so a cut at the 120-char boundary can't re-expose a trailing hyphen.\n */\nexport function slugifyArtifact(title: string | undefined, fallback: string): string {\n  if (!title) return fallback;\n  const collapsed = title.toLowerCase().replace(/[^a-z0-9]+/g, \"-\");\n  let start = 0;\n  let end = collapsed.length;\n  while (start < end && collapsed[start] === \"-\") start += 1;\n  while (end > start && collapsed[end - 1] === \"-\") end -= 1;\n  if (end - start > MAX_SLUG_LEN) end = start + MAX_SLUG_LEN;\n  while (end > start && collapsed[end - 1] === \"-\") end -= 1;\n  return collapsed.slice(start, end) || fallback;\n}\n\n/** UTC `YYYY/MM` partition (matches the host's #764 artifact sharding). UTC —\n *  not local — so a workspace synced across timezones stays in one bucket. */\nexport function yearMonthUtc(now: Date = new Date()): string {\n  const year = now.getUTCFullYear();\n  const month = String(now.getUTCMonth() + 1).padStart(2, \"0\");\n  return `${year}/${month}`;\n}\n\nexport interface ArtifactRelPathParams {\n  /** Artifact-kind directory under the artifacts root (e.g. `charts`, `html`, `stories`). */\n  dir: string;\n  /** Human title the slug is derived from; empty/non-ASCII falls back to `fallback`. */\n  title: string | undefined;\n  /** File extension INCLUDING the leading dot (e.g. `.html`, `.chart.json`). */\n  ext: string;\n  /** Slug used when `title` yields nothing (e.g. `chart`, `page`, `story`). */\n  fallback: string;\n  now?: Date;\n  /** Include the `YYYY/MM` partition segment. Default true; stories opt out. */\n  partitioned?: boolean;\n  /** Extra token appended after the timestamp, for callers that cannot accept a\n   *  same-millisecond collision (see the note on `buildArtifactRelPath`). */\n  suffix?: string;\n}\n\n/**\n * FileOps-relative artifact path: `<dir>[/YYYY/MM]/<slug>-<epochMs>[-<suffix>]<ext>`.\n * This is what `files.artifacts.write` takes; prefix it with\n * `toWorkspaceArtifactPath` for the workspace-relative form shown to the LLM.\n *\n * `<epochMs>` alone separates paths built at different times, but NOT two calls\n * with the same title inside one millisecond — those produce the same name, and\n * the second write silently replaces the first artifact. Pass `suffix` (a short\n * random token, as `shapeArtifactPath` does) wherever concurrent callers can\n * share a title.\n */\nexport function buildArtifactRelPath(params: ArtifactRelPathParams): string {\n  const { dir, title, ext, fallback, now = new Date(), partitioned = true, suffix } = params;\n  const stamp = suffix ? `${now.getTime()}-${suffix}` : `${now.getTime()}`;\n  const fileName = `${slugifyArtifact(title, fallback)}-${stamp}${ext}`;\n  const segments = partitioned ? [dir, yearMonthUtc(now), fileName] : [dir, fileName];\n  return segments.join(\"/\");\n}\n\n/** Prefix a FileOps-relative artifact path with the workspace `artifacts/` root. */\nexport function toWorkspaceArtifactPath(relPath: string): string {\n  return `${ARTIFACTS_ROOT}/${relPath}`;\n}\n\n/**\n * True when any `/` or `\\`-separated segment of `value` is empty (`//`,\n * leading/trailing slash), `.`, or `..`. The lexical traversal / non-canonical\n * guard every artifact path check shares — so a workspace-escape judgement\n * can't drift between plugins.\n *\n * Both separators, matching `classifyFilePath`: an artifact path is minted from\n * a slug and so never contains a backslash, while `node:path` on Windows treats\n * one as a separator. Splitting on `/` alone accepted\n * `artifacts/shapes/..\\..\\secrets.shape` — canonical to this check, traversal\n * to `path.join` (codex on #3056).\n */\nexport function hasUnsafePathSegment(value: string): boolean {\n  return value.split(/[/\\\\]/).some((seg) => seg === \"\" || seg === \".\" || seg === \"..\");\n}\n\n// ── Presentable document paths (presentDocument / presentHtml `path`) ──\n//\n// The two present* tools accept a path to an EXISTING file to display and\n// edit in place. That file is no longer necessarily an artifact the agent\n// wrote: it can be any document in the workspace (MulmoTerminal's workspace\n// IS the git project the user is working in) or, when the host allows it, an\n// absolute path elsewhere on disk.\n//\n// Which of those a value is decides how the host resolves it, so the\n// judgement lives here rather than in each plugin — the plugins may not\n// import one another, and a predicate two of them spell differently is how\n// \"the write site accepts what the refresh site rejects\" bugs start.\n\n/** How a caller-supplied file path must be resolved. `null` = not a usable path. */\nexport type FilePathKind = \"absolute\" | \"relative\";\n\n// `/x`, `C:\\x` / `C:/x`, `\\\\server\\share` (UNC), and the Windows root-relative\n// `\\dir\\x` — which node's `path.resolve` on Windows sends to the drive root, so\n// treating it as relative would mean the classification and the resolution\n// disagreed about where the file is. Windows spellings are recognised on every\n// platform: the value is produced by an LLM or a remote host, not by the local\n// `path` module.\nconst WINDOWS_DRIVE_RE = /^[a-zA-Z]:[\\\\/]/;\n\n/** True when `value` names a location that does not depend on a base directory.\n *  Exported so a URL builder and a path resolver cannot disagree about which\n *  values are rooted. */\nexport function isAbsoluteFilePathValue(value: string): boolean {\n  // One leading backslash covers both the UNC `\\\\server\\share` and the Windows\n  // root-relative `\\dir\\x`.\n  return value.startsWith(\"/\") || value.startsWith(\"\\\\\") || WINDOWS_DRIVE_RE.test(value);\n}\n\n/**\n * Classify a caller-supplied path to a file the host may read and overwrite.\n *\n * Accepts one of `extensions` (compared case-insensitively) and rejects NUL\n * bytes and any `.` / `..` / empty segment — a relative path must be canonical\n * so it can be joined onto a root, and an absolute one must not climb, so\n * neither form can be re-pointed by traversal after the host has vetted it.\n * Returns `\"absolute\"` / `\"relative\"` so the host knows whether to resolve\n * against its workspace root, or `null` when the value is unusable.\n *\n * This is a LEXICAL check only. Existence, file-vs-directory, symlink\n * containment and any host policy about which roots are reachable stay with\n * the host, which is the only layer that can consult the filesystem.\n */\nexport function classifyFilePath(value: string, extensions: readonly string[]): FilePathKind | null {\n  if (!value || value.includes(\"\\0\")) return null;\n  const lower = value.toLowerCase();\n  if (!extensions.some((ext) => lower.endsWith(ext))) return null;\n  const absolute = isAbsoluteFilePathValue(value);\n  // Split on both separators: `..` must be refused however the value spells it.\n  const segments = value.split(/[/\\\\]/);\n  // A leading `/` (or drive / UNC prefix) makes the first segment empty by\n  // construction — skip those, then require every remaining segment to be a\n  // real name.\n  const body = absolute ? segments.slice(segments.findIndex((segment) => segment.length > 0)) : segments;\n  if (body.length === 0) return null;\n  if (body.some((segment) => segment === \"\" || segment === \".\" || segment === \"..\")) return null;\n  return absolute ? \"absolute\" : \"relative\";\n}\n\n/** True when any `/` or `\\`-separated segment starts with a dot. The file\n *  servers that hand these pages to a browser refuse dotfile segments (the\n *  artifact mounts' `dotfiles: \"deny\"` policy), so a `path` argument bearing\n *  one can be accepted by a tool and then never render — the gate and the\n *  server have to agree on this, hence one definition. */\nexport function hasDotfileSegment(value: string): boolean {\n  return value.split(/[/\\\\]/).some((segment) => segment.startsWith(\".\"));\n}\n"],"mappings":";;AAWA,IAAM,eAAe;;AAGrB,IAAa,iBAAiB;;;;;;;;;;;AAY9B,SAAgB,gBAAgB,OAA2B,UAA0B;CACnF,IAAI,CAAC,OAAO,OAAO;CACnB,MAAM,YAAY,MAAM,YAAY,CAAC,CAAC,QAAQ,eAAe,GAAG;CAChE,IAAI,QAAQ;CACZ,IAAI,MAAM,UAAU;CACpB,OAAO,QAAQ,OAAO,UAAU,WAAW,KAAK,SAAS;CACzD,OAAO,MAAM,SAAS,UAAU,MAAM,OAAO,KAAK,OAAO;CACzD,IAAI,MAAM,QAAQ,cAAc,MAAM,QAAQ;CAC9C,OAAO,MAAM,SAAS,UAAU,MAAM,OAAO,KAAK,OAAO;CACzD,OAAO,UAAU,MAAM,OAAO,GAAG,KAAK;AACxC;;;AAIA,SAAgB,aAAa,sBAAY,IAAI,KAAK,GAAW;CAG3D,OAAO,GAFM,IAAI,eAEP,EAAK,GADD,OAAO,IAAI,YAAY,IAAI,CAAC,CAAC,CAAC,SAAS,GAAG,GACtC;AACpB;;;;;;;;;;;;AA8BA,SAAgB,qBAAqB,QAAuC;CAC1E,MAAM,EAAE,KAAK,OAAO,KAAK,UAAU,sBAAM,IAAI,KAAK,GAAG,cAAc,MAAM,WAAW;CACpF,MAAM,QAAQ,SAAS,GAAG,IAAI,QAAQ,EAAE,GAAG,WAAW,GAAG,IAAI,QAAQ;CACrE,MAAM,WAAW,GAAG,gBAAgB,OAAO,QAAQ,EAAE,GAAG,QAAQ;CAEhE,QADiB,cAAc;EAAC;EAAK,aAAa,GAAG;EAAG;CAAQ,IAAI,CAAC,KAAK,QAAQ,EAAA,CAClE,KAAK,GAAG;AAC1B;;AAGA,SAAgB,wBAAwB,SAAyB;CAC/D,OAAO,GAAG,eAAe,GAAG;AAC9B;;;;;;;;;;;;;AAcA,SAAgB,qBAAqB,OAAwB;CAC3D,OAAO,MAAM,MAAM,OAAO,CAAC,CAAC,MAAM,QAAQ,QAAQ,MAAM,QAAQ,OAAO,QAAQ,IAAI;AACrF;AAwBA,IAAM,mBAAmB;;;;AAKzB,SAAgB,wBAAwB,OAAwB;CAG9D,OAAO,MAAM,WAAW,GAAG,KAAK,MAAM,WAAW,IAAI,KAAK,iBAAiB,KAAK,KAAK;AACvF;;;;;;;;;;;;;;;AAgBA,SAAgB,iBAAiB,OAAe,YAAoD;CAClG,IAAI,CAAC,SAAS,MAAM,SAAS,IAAI,GAAG,OAAO;CAC3C,MAAM,QAAQ,MAAM,YAAY;CAChC,IAAI,CAAC,WAAW,MAAM,QAAQ,MAAM,SAAS,GAAG,CAAC,GAAG,OAAO;CAC3D,MAAM,WAAW,wBAAwB,KAAK;CAE9C,MAAM,WAAW,MAAM,MAAM,OAAO;CAIpC,MAAM,OAAO,WAAW,SAAS,MAAM,SAAS,WAAW,YAAY,QAAQ,SAAS,CAAC,CAAC,IAAI;CAC9F,IAAI,KAAK,WAAW,GAAG,OAAO;CAC9B,IAAI,KAAK,MAAM,YAAY,YAAY,MAAM,YAAY,OAAO,YAAY,IAAI,GAAG,OAAO;CAC1F,OAAO,WAAW,aAAa;AACjC;;;;;;AAOA,SAAgB,kBAAkB,OAAwB;CACxD,OAAO,MAAM,MAAM,OAAO,CAAC,CAAC,MAAM,YAAY,QAAQ,WAAW,GAAG,CAAC;AACvE"}
+{"version":3,"file":"paths.cjs","names":[],"sources":["../../src/artifacts/paths.ts"],"sourcesContent":["// Shared artifact-path builders for the presentation plugins (chart / html /\n// mulmoscript / markdown) and the host's file stores. Browser-safe by design:\n// no node:path / no node:crypto, so it bundles into both the server core and\n// the browser (`./vue`) plugin entries.\n//\n// The artifact-path half lives upstream so plugins outside this repo share it\n// without importing MulmoClaude: the directory's name is gui-chat-protocol's\n// (`ARTIFACTS_ROOT`, 2.3), and the slug / partition / path builder / traversal\n// guard are `@gui-chat-plugin/common`'s. They are re-exported here so every\n// existing `@mulmoclaude/core/artifacts` import keeps working unchanged.\n//\n// These are POSIX artifact *wire paths* — stored in JSON and used as the\n// generic `files.artifacts` FileOps keys — so they must ALWAYS join with `/`\n// regardless of host OS.\n\nexport { ARTIFACTS_ROOT } from \"gui-chat-protocol\";\nexport {\n  buildArtifactRelPath,\n  hasUnsafePathSegment,\n  slugifyArtifact,\n  toWorkspaceArtifactPath,\n  yearMonthUtc,\n  type ArtifactRelPathParams,\n} from \"@gui-chat-plugin/common\";\n\n// ── Presentable document paths (presentDocument / presentHtml `path`) ──\n//\n// The two present* tools accept a path to an EXISTING file to display and\n// edit in place. That file is no longer necessarily an artifact the agent\n// wrote: it can be any document in the workspace (MulmoTerminal's workspace\n// IS the git project the user is working in) or, when the host allows it, an\n// absolute path elsewhere on disk.\n//\n// Which of those a value is decides how the host resolves it, so the\n// judgement lives here rather than in each plugin — the plugins may not\n// import one another, and a predicate two of them spell differently is how\n// \"the write site accepts what the refresh site rejects\" bugs start.\n\n/** How a caller-supplied file path must be resolved. `null` = not a usable path. */\nexport type FilePathKind = \"absolute\" | \"relative\";\n\n// `/x`, `C:\\x` / `C:/x`, `\\\\server\\share` (UNC), and the Windows root-relative\n// `\\dir\\x` — which node's `path.resolve` on Windows sends to the drive root, so\n// treating it as relative would mean the classification and the resolution\n// disagreed about where the file is. Windows spellings are recognised on every\n// platform: the value is produced by an LLM or a remote host, not by the local\n// `path` module.\nconst WINDOWS_DRIVE_RE = /^[a-zA-Z]:[\\\\/]/;\n\n/** True when `value` names a location that does not depend on a base directory.\n *  Exported so a URL builder and a path resolver cannot disagree about which\n *  values are rooted. */\nexport function isAbsoluteFilePathValue(value: string): boolean {\n  // One leading backslash covers both the UNC `\\\\server\\share` and the Windows\n  // root-relative `\\dir\\x`.\n  return value.startsWith(\"/\") || value.startsWith(\"\\\\\") || WINDOWS_DRIVE_RE.test(value);\n}\n\n/**\n * Classify a caller-supplied path to a file the host may read and overwrite.\n *\n * Accepts one of `extensions` (compared case-insensitively) and rejects NUL\n * bytes and any `.` / `..` / empty segment — a relative path must be canonical\n * so it can be joined onto a root, and an absolute one must not climb, so\n * neither form can be re-pointed by traversal after the host has vetted it.\n * Returns `\"absolute\"` / `\"relative\"` so the host knows whether to resolve\n * against its workspace root, or `null` when the value is unusable.\n *\n * This is a LEXICAL check only. Existence, file-vs-directory, symlink\n * containment and any host policy about which roots are reachable stay with\n * the host, which is the only layer that can consult the filesystem.\n */\nexport function classifyFilePath(value: string, extensions: readonly string[]): FilePathKind | null {\n  if (!value || value.includes(\"\\0\")) return null;\n  const lower = value.toLowerCase();\n  if (!extensions.some((ext) => lower.endsWith(ext))) return null;\n  const absolute = isAbsoluteFilePathValue(value);\n  // Split on both separators: `..` must be refused however the value spells it.\n  const segments = value.split(/[/\\\\]/);\n  // A leading `/` (or drive / UNC prefix) makes the first segment empty by\n  // construction — skip those, then require every remaining segment to be a\n  // real name.\n  const body = absolute ? segments.slice(segments.findIndex((segment) => segment.length > 0)) : segments;\n  if (body.length === 0) return null;\n  if (body.some((segment) => segment === \"\" || segment === \".\" || segment === \"..\")) return null;\n  return absolute ? \"absolute\" : \"relative\";\n}\n\n/** True when any `/` or `\\`-separated segment starts with a dot. The file\n *  servers that hand these pages to a browser refuse dotfile segments (the\n *  artifact mounts' `dotfiles: \"deny\"` policy), so a `path` argument bearing\n *  one can be accepted by a tool and then never render — the gate and the\n *  server have to agree on this, hence one definition. */\nexport function hasDotfileSegment(value: string): boolean {\n  return value.split(/[/\\\\]/).some((segment) => segment.startsWith(\".\"));\n}\n"],"mappings":";;;;AA+CA,IAAM,mBAAmB;;;;AAKzB,SAAgB,wBAAwB,OAAwB;CAG9D,OAAO,MAAM,WAAW,GAAG,KAAK,MAAM,WAAW,IAAI,KAAK,iBAAiB,KAAK,KAAK;AACvF;;;;;;;;;;;;;;;AAgBA,SAAgB,iBAAiB,OAAe,YAAoD;CAClG,IAAI,CAAC,SAAS,MAAM,SAAS,IAAI,GAAG,OAAO;CAC3C,MAAM,QAAQ,MAAM,YAAY;CAChC,IAAI,CAAC,WAAW,MAAM,QAAQ,MAAM,SAAS,GAAG,CAAC,GAAG,OAAO;CAC3D,MAAM,WAAW,wBAAwB,KAAK;CAE9C,MAAM,WAAW,MAAM,MAAM,OAAO;CAIpC,MAAM,OAAO,WAAW,SAAS,MAAM,SAAS,WAAW,YAAY,QAAQ,SAAS,CAAC,CAAC,IAAI;CAC9F,IAAI,KAAK,WAAW,GAAG,OAAO;CAC9B,IAAI,KAAK,MAAM,YAAY,YAAY,MAAM,YAAY,OAAO,YAAY,IAAI,GAAG,OAAO;CAC1F,OAAO,WAAW,aAAa;AACjC;;;;;;AAOA,SAAgB,kBAAkB,OAAwB;CACxD,OAAO,MAAM,MAAM,OAAO,CAAC,CAAC,MAAM,YAAY,QAAQ,WAAW,GAAG,CAAC;AACvE"}

package/dist/artifacts/paths.d.ts

@@ -1,62 +1,5 @@
-/** The workspace directory every artifact lives under (`<workspace>/artifacts`). */
-export declare const ARTIFACTS_ROOT = "artifacts";
-/**
- * Lowercase-ASCII slug for a throwaway, timestamped artifact filename. Empty,
- * whitespace-only, and non-ASCII-only titles fall back to `fallback`. Capped at
- * 120 chars so a long LLM title can't blow the filesystem's NAME_MAX.
- *
- * Leading/trailing hyphens are stripped with a linear scan rather than a regex
- * like `/^-+|-+$/` — CodeQL flags the trailing-anchor form as polynomial
- * backtracking on the attacker-influenced (LLM-provided) title. Strip → cap →
- * strip so a cut at the 120-char boundary can't re-expose a trailing hyphen.
- */
-export declare function slugifyArtifact(title: string | undefined, fallback: string): string;
-/** UTC `YYYY/MM` partition (matches the host's #764 artifact sharding). UTC —
- *  not local — so a workspace synced across timezones stays in one bucket. */
-export declare function yearMonthUtc(now?: Date): string;
-export interface ArtifactRelPathParams {
-    /** Artifact-kind directory under the artifacts root (e.g. `charts`, `html`, `stories`). */
-    dir: string;
-    /** Human title the slug is derived from; empty/non-ASCII falls back to `fallback`. */
-    title: string | undefined;
-    /** File extension INCLUDING the leading dot (e.g. `.html`, `.chart.json`). */
-    ext: string;
-    /** Slug used when `title` yields nothing (e.g. `chart`, `page`, `story`). */
-    fallback: string;
-    now?: Date;
-    /** Include the `YYYY/MM` partition segment. Default true; stories opt out. */
-    partitioned?: boolean;
-    /** Extra token appended after the timestamp, for callers that cannot accept a
-     *  same-millisecond collision (see the note on `buildArtifactRelPath`). */
-    suffix?: string;
-}
-/**
- * FileOps-relative artifact path: `<dir>[/YYYY/MM]/<slug>-<epochMs>[-<suffix>]<ext>`.
- * This is what `files.artifacts.write` takes; prefix it with
- * `toWorkspaceArtifactPath` for the workspace-relative form shown to the LLM.
- *
- * `<epochMs>` alone separates paths built at different times, but NOT two calls
- * with the same title inside one millisecond — those produce the same name, and
- * the second write silently replaces the first artifact. Pass `suffix` (a short
- * random token, as `shapeArtifactPath` does) wherever concurrent callers can
- * share a title.
- */
-export declare function buildArtifactRelPath(params: ArtifactRelPathParams): string;
-/** Prefix a FileOps-relative artifact path with the workspace `artifacts/` root. */
-export declare function toWorkspaceArtifactPath(relPath: string): string;
-/**
- * True when any `/` or `\`-separated segment of `value` is empty (`//`,
- * leading/trailing slash), `.`, or `..`. The lexical traversal / non-canonical
- * guard every artifact path check shares — so a workspace-escape judgement
- * can't drift between plugins.
- *
- * Both separators, matching `classifyFilePath`: an artifact path is minted from
- * a slug and so never contains a backslash, while `node:path` on Windows treats
- * one as a separator. Splitting on `/` alone accepted
- * `artifacts/shapes/..\..\secrets.shape` — canonical to this check, traversal
- * to `path.join` (codex on #3056).
- */
-export declare function hasUnsafePathSegment(value: string): boolean;
+export { ARTIFACTS_ROOT } from 'gui-chat-protocol';
+export { buildArtifactRelPath, hasUnsafePathSegment, slugifyArtifact, toWorkspaceArtifactPath, yearMonthUtc, type ArtifactRelPathParams, } from '@gui-chat-plugin/common';
 /** How a caller-supplied file path must be resolved. `null` = not a usable path. */
 export type FilePathKind = "absolute" | "relative";
 /** True when `value` names a location that does not depend on a base directory.

package/dist/artifacts/paths.js

@@ -1,73 +1,6 @@
+import { ARTIFACTS_ROOT } from "gui-chat-protocol";
+import { buildArtifactRelPath, hasUnsafePathSegment, slugifyArtifact, toWorkspaceArtifactPath, yearMonthUtc } from "@gui-chat-plugin/common";
 //#region src/artifacts/paths.ts
-var MAX_SLUG_LEN = 120;
-/** The workspace directory every artifact lives under (`<workspace>/artifacts`). */
-var ARTIFACTS_ROOT = "artifacts";
-/**
-* Lowercase-ASCII slug for a throwaway, timestamped artifact filename. Empty,
-* whitespace-only, and non-ASCII-only titles fall back to `fallback`. Capped at
-* 120 chars so a long LLM title can't blow the filesystem's NAME_MAX.
-*
-* Leading/trailing hyphens are stripped with a linear scan rather than a regex
-* like `/^-+|-+$/` — CodeQL flags the trailing-anchor form as polynomial
-* backtracking on the attacker-influenced (LLM-provided) title. Strip → cap →
-* strip so a cut at the 120-char boundary can't re-expose a trailing hyphen.
-*/
-function slugifyArtifact(title, fallback) {
-	if (!title) return fallback;
-	const collapsed = title.toLowerCase().replace(/[^a-z0-9]+/g, "-");
-	let start = 0;
-	let end = collapsed.length;
-	while (start < end && collapsed[start] === "-") start += 1;
-	while (end > start && collapsed[end - 1] === "-") end -= 1;
-	if (end - start > MAX_SLUG_LEN) end = start + MAX_SLUG_LEN;
-	while (end > start && collapsed[end - 1] === "-") end -= 1;
-	return collapsed.slice(start, end) || fallback;
-}
-/** UTC `YYYY/MM` partition (matches the host's #764 artifact sharding). UTC —
-*  not local — so a workspace synced across timezones stays in one bucket. */
-function yearMonthUtc(now = /* @__PURE__ */ new Date()) {
-	return `${now.getUTCFullYear()}/${String(now.getUTCMonth() + 1).padStart(2, "0")}`;
-}
-/**
-* FileOps-relative artifact path: `<dir>[/YYYY/MM]/<slug>-<epochMs>[-<suffix>]<ext>`.
-* This is what `files.artifacts.write` takes; prefix it with
-* `toWorkspaceArtifactPath` for the workspace-relative form shown to the LLM.
-*
-* `<epochMs>` alone separates paths built at different times, but NOT two calls
-* with the same title inside one millisecond — those produce the same name, and
-* the second write silently replaces the first artifact. Pass `suffix` (a short
-* random token, as `shapeArtifactPath` does) wherever concurrent callers can
-* share a title.
-*/
-function buildArtifactRelPath(params) {
-	const { dir, title, ext, fallback, now = /* @__PURE__ */ new Date(), partitioned = true, suffix } = params;
-	const stamp = suffix ? `${now.getTime()}-${suffix}` : `${now.getTime()}`;
-	const fileName = `${slugifyArtifact(title, fallback)}-${stamp}${ext}`;
-	return (partitioned ? [
-		dir,
-		yearMonthUtc(now),
-		fileName
-	] : [dir, fileName]).join("/");
-}
-/** Prefix a FileOps-relative artifact path with the workspace `artifacts/` root. */
-function toWorkspaceArtifactPath(relPath) {
-	return `${ARTIFACTS_ROOT}/${relPath}`;
-}
-/**
-* True when any `/` or `\`-separated segment of `value` is empty (`//`,
-* leading/trailing slash), `.`, or `..`. The lexical traversal / non-canonical
-* guard every artifact path check shares — so a workspace-escape judgement
-* can't drift between plugins.
-*
-* Both separators, matching `classifyFilePath`: an artifact path is minted from
-* a slug and so never contains a backslash, while `node:path` on Windows treats
-* one as a separator. Splitting on `/` alone accepted
-* `artifacts/shapes/..\..\secrets.shape` — canonical to this check, traversal
-* to `path.join` (codex on #3056).
-*/
-function hasUnsafePathSegment(value) {
-	return value.split(/[/\\]/).some((seg) => seg === "" || seg === "." || seg === "..");
-}
 var WINDOWS_DRIVE_RE = /^[a-zA-Z]:[\\/]/;
 /** True when `value` names a location that does not depend on a base directory.
 *  Exported so a URL builder and a path resolver cannot disagree about which

package/dist/artifacts/paths.js.map

@@ -1 +1 @@
-{"version":3,"file":"paths.js","names":[],"sources":["../../src/artifacts/paths.ts"],"sourcesContent":["// Shared artifact-path builders for the presentation plugins (chart / html /\n// mulmoscript). Browser-safe by design: no node:path / no node:crypto, so it\n// bundles into both the server core and the browser (`./vue`) plugin entries.\n//\n// These are POSIX artifact *wire paths* — stored in JSON and used as the\n// generic `files.artifacts` FileOps keys — so they must ALWAYS join with `/`\n// regardless of host OS. `path.join` would emit `\\` on Windows and corrupt\n// them; `path.posix.join` would drag in node:path and break the browser\n// bundle. So already-sanitised segments are joined with `/` directly (same\n// choice the plugins made before this module existed).\n\nconst MAX_SLUG_LEN = 120;\n\n/** The workspace directory every artifact lives under (`<workspace>/artifacts`). */\nexport const ARTIFACTS_ROOT = \"artifacts\";\n\n/**\n * Lowercase-ASCII slug for a throwaway, timestamped artifact filename. Empty,\n * whitespace-only, and non-ASCII-only titles fall back to `fallback`. Capped at\n * 120 chars so a long LLM title can't blow the filesystem's NAME_MAX.\n *\n * Leading/trailing hyphens are stripped with a linear scan rather than a regex\n * like `/^-+|-+$/` — CodeQL flags the trailing-anchor form as polynomial\n * backtracking on the attacker-influenced (LLM-provided) title. Strip → cap →\n * strip so a cut at the 120-char boundary can't re-expose a trailing hyphen.\n */\nexport function slugifyArtifact(title: string | undefined, fallback: string): string {\n  if (!title) return fallback;\n  const collapsed = title.toLowerCase().replace(/[^a-z0-9]+/g, \"-\");\n  let start = 0;\n  let end = collapsed.length;\n  while (start < end && collapsed[start] === \"-\") start += 1;\n  while (end > start && collapsed[end - 1] === \"-\") end -= 1;\n  if (end - start > MAX_SLUG_LEN) end = start + MAX_SLUG_LEN;\n  while (end > start && collapsed[end - 1] === \"-\") end -= 1;\n  return collapsed.slice(start, end) || fallback;\n}\n\n/** UTC `YYYY/MM` partition (matches the host's #764 artifact sharding). UTC —\n *  not local — so a workspace synced across timezones stays in one bucket. */\nexport function yearMonthUtc(now: Date = new Date()): string {\n  const year = now.getUTCFullYear();\n  const month = String(now.getUTCMonth() + 1).padStart(2, \"0\");\n  return `${year}/${month}`;\n}\n\nexport interface ArtifactRelPathParams {\n  /** Artifact-kind directory under the artifacts root (e.g. `charts`, `html`, `stories`). */\n  dir: string;\n  /** Human title the slug is derived from; empty/non-ASCII falls back to `fallback`. */\n  title: string | undefined;\n  /** File extension INCLUDING the leading dot (e.g. `.html`, `.chart.json`). */\n  ext: string;\n  /** Slug used when `title` yields nothing (e.g. `chart`, `page`, `story`). */\n  fallback: string;\n  now?: Date;\n  /** Include the `YYYY/MM` partition segment. Default true; stories opt out. */\n  partitioned?: boolean;\n  /** Extra token appended after the timestamp, for callers that cannot accept a\n   *  same-millisecond collision (see the note on `buildArtifactRelPath`). */\n  suffix?: string;\n}\n\n/**\n * FileOps-relative artifact path: `<dir>[/YYYY/MM]/<slug>-<epochMs>[-<suffix>]<ext>`.\n * This is what `files.artifacts.write` takes; prefix it with\n * `toWorkspaceArtifactPath` for the workspace-relative form shown to the LLM.\n *\n * `<epochMs>` alone separates paths built at different times, but NOT two calls\n * with the same title inside one millisecond — those produce the same name, and\n * the second write silently replaces the first artifact. Pass `suffix` (a short\n * random token, as `shapeArtifactPath` does) wherever concurrent callers can\n * share a title.\n */\nexport function buildArtifactRelPath(params: ArtifactRelPathParams): string {\n  const { dir, title, ext, fallback, now = new Date(), partitioned = true, suffix } = params;\n  const stamp = suffix ? `${now.getTime()}-${suffix}` : `${now.getTime()}`;\n  const fileName = `${slugifyArtifact(title, fallback)}-${stamp}${ext}`;\n  const segments = partitioned ? [dir, yearMonthUtc(now), fileName] : [dir, fileName];\n  return segments.join(\"/\");\n}\n\n/** Prefix a FileOps-relative artifact path with the workspace `artifacts/` root. */\nexport function toWorkspaceArtifactPath(relPath: string): string {\n  return `${ARTIFACTS_ROOT}/${relPath}`;\n}\n\n/**\n * True when any `/` or `\\`-separated segment of `value` is empty (`//`,\n * leading/trailing slash), `.`, or `..`. The lexical traversal / non-canonical\n * guard every artifact path check shares — so a workspace-escape judgement\n * can't drift between plugins.\n *\n * Both separators, matching `classifyFilePath`: an artifact path is minted from\n * a slug and so never contains a backslash, while `node:path` on Windows treats\n * one as a separator. Splitting on `/` alone accepted\n * `artifacts/shapes/..\\..\\secrets.shape` — canonical to this check, traversal\n * to `path.join` (codex on #3056).\n */\nexport function hasUnsafePathSegment(value: string): boolean {\n  return value.split(/[/\\\\]/).some((seg) => seg === \"\" || seg === \".\" || seg === \"..\");\n}\n\n// ── Presentable document paths (presentDocument / presentHtml `path`) ──\n//\n// The two present* tools accept a path to an EXISTING file to display and\n// edit in place. That file is no longer necessarily an artifact the agent\n// wrote: it can be any document in the workspace (MulmoTerminal's workspace\n// IS the git project the user is working in) or, when the host allows it, an\n// absolute path elsewhere on disk.\n//\n// Which of those a value is decides how the host resolves it, so the\n// judgement lives here rather than in each plugin — the plugins may not\n// import one another, and a predicate two of them spell differently is how\n// \"the write site accepts what the refresh site rejects\" bugs start.\n\n/** How a caller-supplied file path must be resolved. `null` = not a usable path. */\nexport type FilePathKind = \"absolute\" | \"relative\";\n\n// `/x`, `C:\\x` / `C:/x`, `\\\\server\\share` (UNC), and the Windows root-relative\n// `\\dir\\x` — which node's `path.resolve` on Windows sends to the drive root, so\n// treating it as relative would mean the classification and the resolution\n// disagreed about where the file is. Windows spellings are recognised on every\n// platform: the value is produced by an LLM or a remote host, not by the local\n// `path` module.\nconst WINDOWS_DRIVE_RE = /^[a-zA-Z]:[\\\\/]/;\n\n/** True when `value` names a location that does not depend on a base directory.\n *  Exported so a URL builder and a path resolver cannot disagree about which\n *  values are rooted. */\nexport function isAbsoluteFilePathValue(value: string): boolean {\n  // One leading backslash covers both the UNC `\\\\server\\share` and the Windows\n  // root-relative `\\dir\\x`.\n  return value.startsWith(\"/\") || value.startsWith(\"\\\\\") || WINDOWS_DRIVE_RE.test(value);\n}\n\n/**\n * Classify a caller-supplied path to a file the host may read and overwrite.\n *\n * Accepts one of `extensions` (compared case-insensitively) and rejects NUL\n * bytes and any `.` / `..` / empty segment — a relative path must be canonical\n * so it can be joined onto a root, and an absolute one must not climb, so\n * neither form can be re-pointed by traversal after the host has vetted it.\n * Returns `\"absolute\"` / `\"relative\"` so the host knows whether to resolve\n * against its workspace root, or `null` when the value is unusable.\n *\n * This is a LEXICAL check only. Existence, file-vs-directory, symlink\n * containment and any host policy about which roots are reachable stay with\n * the host, which is the only layer that can consult the filesystem.\n */\nexport function classifyFilePath(value: string, extensions: readonly string[]): FilePathKind | null {\n  if (!value || value.includes(\"\\0\")) return null;\n  const lower = value.toLowerCase();\n  if (!extensions.some((ext) => lower.endsWith(ext))) return null;\n  const absolute = isAbsoluteFilePathValue(value);\n  // Split on both separators: `..` must be refused however the value spells it.\n  const segments = value.split(/[/\\\\]/);\n  // A leading `/` (or drive / UNC prefix) makes the first segment empty by\n  // construction — skip those, then require every remaining segment to be a\n  // real name.\n  const body = absolute ? segments.slice(segments.findIndex((segment) => segment.length > 0)) : segments;\n  if (body.length === 0) return null;\n  if (body.some((segment) => segment === \"\" || segment === \".\" || segment === \"..\")) return null;\n  return absolute ? \"absolute\" : \"relative\";\n}\n\n/** True when any `/` or `\\`-separated segment starts with a dot. The file\n *  servers that hand these pages to a browser refuse dotfile segments (the\n *  artifact mounts' `dotfiles: \"deny\"` policy), so a `path` argument bearing\n *  one can be accepted by a tool and then never render — the gate and the\n *  server have to agree on this, hence one definition. */\nexport function hasDotfileSegment(value: string): boolean {\n  return value.split(/[/\\\\]/).some((segment) => segment.startsWith(\".\"));\n}\n"],"mappings":";AAWA,IAAM,eAAe;;AAGrB,IAAa,iBAAiB;;;;;;;;;;;AAY9B,SAAgB,gBAAgB,OAA2B,UAA0B;CACnF,IAAI,CAAC,OAAO,OAAO;CACnB,MAAM,YAAY,MAAM,YAAY,CAAC,CAAC,QAAQ,eAAe,GAAG;CAChE,IAAI,QAAQ;CACZ,IAAI,MAAM,UAAU;CACpB,OAAO,QAAQ,OAAO,UAAU,WAAW,KAAK,SAAS;CACzD,OAAO,MAAM,SAAS,UAAU,MAAM,OAAO,KAAK,OAAO;CACzD,IAAI,MAAM,QAAQ,cAAc,MAAM,QAAQ;CAC9C,OAAO,MAAM,SAAS,UAAU,MAAM,OAAO,KAAK,OAAO;CACzD,OAAO,UAAU,MAAM,OAAO,GAAG,KAAK;AACxC;;;AAIA,SAAgB,aAAa,sBAAY,IAAI,KAAK,GAAW;CAG3D,OAAO,GAFM,IAAI,eAEP,EAAK,GADD,OAAO,IAAI,YAAY,IAAI,CAAC,CAAC,CAAC,SAAS,GAAG,GACtC;AACpB;;;;;;;;;;;;AA8BA,SAAgB,qBAAqB,QAAuC;CAC1E,MAAM,EAAE,KAAK,OAAO,KAAK,UAAU,sBAAM,IAAI,KAAK,GAAG,cAAc,MAAM,WAAW;CACpF,MAAM,QAAQ,SAAS,GAAG,IAAI,QAAQ,EAAE,GAAG,WAAW,GAAG,IAAI,QAAQ;CACrE,MAAM,WAAW,GAAG,gBAAgB,OAAO,QAAQ,EAAE,GAAG,QAAQ;CAEhE,QADiB,cAAc;EAAC;EAAK,aAAa,GAAG;EAAG;CAAQ,IAAI,CAAC,KAAK,QAAQ,EAAA,CAClE,KAAK,GAAG;AAC1B;;AAGA,SAAgB,wBAAwB,SAAyB;CAC/D,OAAO,GAAG,eAAe,GAAG;AAC9B;;;;;;;;;;;;;AAcA,SAAgB,qBAAqB,OAAwB;CAC3D,OAAO,MAAM,MAAM,OAAO,CAAC,CAAC,MAAM,QAAQ,QAAQ,MAAM,QAAQ,OAAO,QAAQ,IAAI;AACrF;AAwBA,IAAM,mBAAmB;;;;AAKzB,SAAgB,wBAAwB,OAAwB;CAG9D,OAAO,MAAM,WAAW,GAAG,KAAK,MAAM,WAAW,IAAI,KAAK,iBAAiB,KAAK,KAAK;AACvF;;;;;;;;;;;;;;;AAgBA,SAAgB,iBAAiB,OAAe,YAAoD;CAClG,IAAI,CAAC,SAAS,MAAM,SAAS,IAAI,GAAG,OAAO;CAC3C,MAAM,QAAQ,MAAM,YAAY;CAChC,IAAI,CAAC,WAAW,MAAM,QAAQ,MAAM,SAAS,GAAG,CAAC,GAAG,OAAO;CAC3D,MAAM,WAAW,wBAAwB,KAAK;CAE9C,MAAM,WAAW,MAAM,MAAM,OAAO;CAIpC,MAAM,OAAO,WAAW,SAAS,MAAM,SAAS,WAAW,YAAY,QAAQ,SAAS,CAAC,CAAC,IAAI;CAC9F,IAAI,KAAK,WAAW,GAAG,OAAO;CAC9B,IAAI,KAAK,MAAM,YAAY,YAAY,MAAM,YAAY,OAAO,YAAY,IAAI,GAAG,OAAO;CAC1F,OAAO,WAAW,aAAa;AACjC;;;;;;AAOA,SAAgB,kBAAkB,OAAwB;CACxD,OAAO,MAAM,MAAM,OAAO,CAAC,CAAC,MAAM,YAAY,QAAQ,WAAW,GAAG,CAAC;AACvE"}
+{"version":3,"file":"paths.js","names":[],"sources":["../../src/artifacts/paths.ts"],"sourcesContent":["// Shared artifact-path builders for the presentation plugins (chart / html /\n// mulmoscript / markdown) and the host's file stores. Browser-safe by design:\n// no node:path / no node:crypto, so it bundles into both the server core and\n// the browser (`./vue`) plugin entries.\n//\n// The artifact-path half lives upstream so plugins outside this repo share it\n// without importing MulmoClaude: the directory's name is gui-chat-protocol's\n// (`ARTIFACTS_ROOT`, 2.3), and the slug / partition / path builder / traversal\n// guard are `@gui-chat-plugin/common`'s. They are re-exported here so every\n// existing `@mulmoclaude/core/artifacts` import keeps working unchanged.\n//\n// These are POSIX artifact *wire paths* — stored in JSON and used as the\n// generic `files.artifacts` FileOps keys — so they must ALWAYS join with `/`\n// regardless of host OS.\n\nexport { ARTIFACTS_ROOT } from \"gui-chat-protocol\";\nexport {\n  buildArtifactRelPath,\n  hasUnsafePathSegment,\n  slugifyArtifact,\n  toWorkspaceArtifactPath,\n  yearMonthUtc,\n  type ArtifactRelPathParams,\n} from \"@gui-chat-plugin/common\";\n\n// ── Presentable document paths (presentDocument / presentHtml `path`) ──\n//\n// The two present* tools accept a path to an EXISTING file to display and\n// edit in place. That file is no longer necessarily an artifact the agent\n// wrote: it can be any document in the workspace (MulmoTerminal's workspace\n// IS the git project the user is working in) or, when the host allows it, an\n// absolute path elsewhere on disk.\n//\n// Which of those a value is decides how the host resolves it, so the\n// judgement lives here rather than in each plugin — the plugins may not\n// import one another, and a predicate two of them spell differently is how\n// \"the write site accepts what the refresh site rejects\" bugs start.\n\n/** How a caller-supplied file path must be resolved. `null` = not a usable path. */\nexport type FilePathKind = \"absolute\" | \"relative\";\n\n// `/x`, `C:\\x` / `C:/x`, `\\\\server\\share` (UNC), and the Windows root-relative\n// `\\dir\\x` — which node's `path.resolve` on Windows sends to the drive root, so\n// treating it as relative would mean the classification and the resolution\n// disagreed about where the file is. Windows spellings are recognised on every\n// platform: the value is produced by an LLM or a remote host, not by the local\n// `path` module.\nconst WINDOWS_DRIVE_RE = /^[a-zA-Z]:[\\\\/]/;\n\n/** True when `value` names a location that does not depend on a base directory.\n *  Exported so a URL builder and a path resolver cannot disagree about which\n *  values are rooted. */\nexport function isAbsoluteFilePathValue(value: string): boolean {\n  // One leading backslash covers both the UNC `\\\\server\\share` and the Windows\n  // root-relative `\\dir\\x`.\n  return value.startsWith(\"/\") || value.startsWith(\"\\\\\") || WINDOWS_DRIVE_RE.test(value);\n}\n\n/**\n * Classify a caller-supplied path to a file the host may read and overwrite.\n *\n * Accepts one of `extensions` (compared case-insensitively) and rejects NUL\n * bytes and any `.` / `..` / empty segment — a relative path must be canonical\n * so it can be joined onto a root, and an absolute one must not climb, so\n * neither form can be re-pointed by traversal after the host has vetted it.\n * Returns `\"absolute\"` / `\"relative\"` so the host knows whether to resolve\n * against its workspace root, or `null` when the value is unusable.\n *\n * This is a LEXICAL check only. Existence, file-vs-directory, symlink\n * containment and any host policy about which roots are reachable stay with\n * the host, which is the only layer that can consult the filesystem.\n */\nexport function classifyFilePath(value: string, extensions: readonly string[]): FilePathKind | null {\n  if (!value || value.includes(\"\\0\")) return null;\n  const lower = value.toLowerCase();\n  if (!extensions.some((ext) => lower.endsWith(ext))) return null;\n  const absolute = isAbsoluteFilePathValue(value);\n  // Split on both separators: `..` must be refused however the value spells it.\n  const segments = value.split(/[/\\\\]/);\n  // A leading `/` (or drive / UNC prefix) makes the first segment empty by\n  // construction — skip those, then require every remaining segment to be a\n  // real name.\n  const body = absolute ? segments.slice(segments.findIndex((segment) => segment.length > 0)) : segments;\n  if (body.length === 0) return null;\n  if (body.some((segment) => segment === \"\" || segment === \".\" || segment === \"..\")) return null;\n  return absolute ? \"absolute\" : \"relative\";\n}\n\n/** True when any `/` or `\\`-separated segment starts with a dot. The file\n *  servers that hand these pages to a browser refuse dotfile segments (the\n *  artifact mounts' `dotfiles: \"deny\"` policy), so a `path` argument bearing\n *  one can be accepted by a tool and then never render — the gate and the\n *  server have to agree on this, hence one definition. */\nexport function hasDotfileSegment(value: string): boolean {\n  return value.split(/[/\\\\]/).some((segment) => segment.startsWith(\".\"));\n}\n"],"mappings":";;;AA+CA,IAAM,mBAAmB;;;;AAKzB,SAAgB,wBAAwB,OAAwB;CAG9D,OAAO,MAAM,WAAW,GAAG,KAAK,MAAM,WAAW,IAAI,KAAK,iBAAiB,KAAK,KAAK;AACvF;;;;;;;;;;;;;;;AAgBA,SAAgB,iBAAiB,OAAe,YAAoD;CAClG,IAAI,CAAC,SAAS,MAAM,SAAS,IAAI,GAAG,OAAO;CAC3C,MAAM,QAAQ,MAAM,YAAY;CAChC,IAAI,CAAC,WAAW,MAAM,QAAQ,MAAM,SAAS,GAAG,CAAC,GAAG,OAAO;CAC3D,MAAM,WAAW,wBAAwB,KAAK;CAE9C,MAAM,WAAW,MAAM,MAAM,OAAO;CAIpC,MAAM,OAAO,WAAW,SAAS,MAAM,SAAS,WAAW,YAAY,QAAQ,SAAS,CAAC,CAAC,IAAI;CAC9F,IAAI,KAAK,WAAW,GAAG,OAAO;CAC9B,IAAI,KAAK,MAAM,YAAY,YAAY,MAAM,YAAY,OAAO,YAAY,IAAI,GAAG,OAAO;CAC1F,OAAO,WAAW,aAAa;AACjC;;;;;;AAOA,SAAgB,kBAAkB,OAAwB;CACxD,OAAO,MAAM,MAAM,OAAO,CAAC,CAAC,MAAM,YAAY,QAAQ,WAAW,GAAG,CAAC;AACvE"}

package/dist/collection/firestore.cjs.map

@@ -1 +1 @@
-{"version":3,"file":"firestore.cjs","names":[],"sources":["../../src/collection/server/firestoreDocs.ts"],"sourcesContent":["// The seam between the firestore store and the Firestore SDK.\n//\n// The modular SDK is function-based (`getDocs(query(collection(db, …)))`), so a\n// store that imported those functions directly could not be tested without a\n// real backend — a fake `db` would still be handed to the real functions.\n// Narrowing to this interface makes the backend swappable: core ships\n// `createFirestoreDocs` over the real SDK, and the tests inject an in-memory\n// fake that satisfies the same shape. That is what lets this repository's tests\n// run with no API key and no network.\n//\n// Deliberately minimal and id-keyed: no query builder, no field ordering, no\n// cursors. Everything the store needs is \"the documents of one collection path,\n// ordered by document id\" — see the store header for why field ordering is\n// avoided entirely.\n//\n// The collection path is an ARGUMENT, not something this module composes. It\n// owns the SDK calls; `firestoreStore` owns where the documents live.\n\nimport {\n  collection as firestoreCollection,\n  doc,\n  getDoc,\n  getDocs,\n  orderBy,\n  query as firestoreQuery,\n  onSnapshot,\n  runTransaction,\n  setDoc,\n  Timestamp,\n  type Firestore,\n} from \"firebase/firestore\";\n\n/** One stored record document. `data` is the document's own fields — the\n *  record itself, not a wrapper around it; see `set` below. The store\n *  validates its shape, because a document written by hand could be\n *  anything. */\nexport interface FirestoreDoc {\n  id: string;\n  data: unknown;\n}\n\nexport interface FirestoreDocs {\n  /** Every document under `collectionPath`, ordered by document id. */\n  list: (collectionPath: string) => Promise<FirestoreDoc[]>;\n  /** One document's fields, or null when it doesn't exist. */\n  get: (collectionPath: string, docId: string) => Promise<unknown | null>;\n  /** Create or replace. */\n  set: (collectionPath: string, docId: string, data: Record<string, unknown>) => Promise<void>;\n  /** Create only. Returns false when the id already exists — atomic, so two\n   *  concurrent creates can't both observe \"missing\". */\n  create: (collectionPath: string, docId: string, data: Record<string, unknown>) => Promise<boolean>;\n  /** Delete. Returns false when the id didn't exist, so a caller can tell a\n   *  real delete from a typo'd id. */\n  delete: (collectionPath: string, docId: string) => Promise<boolean>;\n  /** Listen to `collectionPath`. Every snapshot reports the ids that changed\n   *  in it, and whether it is the FIRST one.\n   *\n   *  `initial` is not a nicety. `onSnapshot` delivers the current contents\n   *  immediately, as one snapshot in which every existing document reads as\n   *  `added` — so a listener that treats snapshots uniformly announces the\n   *  whole collection as changed the moment it arms, on every mount. The flag\n   *  is passed up rather than swallowed here so the decision (and its test)\n   *  lives with the store's policy, next to the rest of it.\n   *\n   *  `onError` fires at most once per subscription: a Firestore listen error\n   *  TERMINATES the listener and never recovers on its own. Re-subscribing is\n   *  the caller's job (`firestore/listen.ts` holds the policy).\n   *\n   *  Returns the detach function synchronously — `onSnapshot` is not async. */\n  watch: (collectionPath: string, onChanged: (ids: string[], meta: { initial: boolean }) => void, onError: (error: unknown) => void) => () => void;\n  /** Firestore's own instant, for a field the store must hand back as the type\n   *  it was stored as.\n   *\n   *  Here rather than in the store because this is the seam that owns the SDK:\n   *  `firebase` is an OPTIONAL peer, and the store is reachable from\n   *  `collection/server` (the factory registry in `store.ts` names it), so a\n   *  top-level `import { Timestamp }` there makes the peer required for every\n   *  consumer of that entry — including hosts with no Firestore at all. Typed\n   *  `unknown` so no SDK type crosses back out. */\n  timestamp: (seconds: number, nanoseconds: number) => unknown;\n}\n\n/** The real implementation over the modular SDK.\n *\n *  THE RECORD IS THE DOCUMENT. Its fields are written at the top level, not\n *  nested under a `data` key. This is not a matter of taste: the deployed\n *  security rules read `request.resource.data.<field>` and\n *  `resource.data[submit.emailField]` — a wrapper would put every field one\n *  level down, so the required-field checks, the status state machine and the\n *  \"your own row\" predicate would all read absent values and fail closed. A\n *  shared record's shape is part of the authorization contract.\n *\n *  `orderBy(\"__name__\")` orders by DOCUMENT ID. Ordering by a record field\n *  would silently EXCLUDE documents missing that field (the trap\n *  `remote-host/server/hostRunner.ts:158-169` documents), turning a read into a\n *  partial one; the document id is always present and gives the stable order\n *  the store contract requires. */\nexport function createFirestoreDocs(database: Firestore): FirestoreDocs {\n  return {\n    list: async (collectionPath) => {\n      const snapshot = await getDocs(firestoreQuery(firestoreCollection(database, collectionPath), orderBy(\"__name__\")));\n      return snapshot.docs.map((entry) => ({ id: entry.id, data: entry.data() }));\n    },\n    get: async (collectionPath, docId) => {\n      const snapshot = await getDoc(doc(database, collectionPath, docId));\n      return snapshot.exists() ? snapshot.data() : null;\n    },\n    set: async (collectionPath, docId, data) => {\n      await setDoc(doc(database, collectionPath, docId), data);\n    },\n    create: (collectionPath, docId, data) =>\n      runTransaction(database, async (transaction) => {\n        const ref = doc(database, collectionPath, docId);\n        const existing = await transaction.get(ref);\n        if (existing.exists()) return false;\n        transaction.set(ref, data);\n        return true;\n      }),\n    // Firestore's deleteDoc succeeds on a missing document, so an existence\n    // check is what makes \"deleted\" distinguishable from \"there was nothing\".\n    // It runs INSIDE the transaction (like `create`): a plain get-then-delete\n    // would report `true` for a document a concurrent client had already\n    // removed, i.e. claim a delete this call never performed.\n    delete: (collectionPath, docId) =>\n      runTransaction(database, async (transaction) => {\n        const ref = doc(database, collectionPath, docId);\n        const existing = await transaction.get(ref);\n        if (!existing.exists()) return false;\n        transaction.delete(ref);\n        return true;\n      }),\n    // `docChanges()` rather than the whole snapshot: it names the documents\n    // that moved, which is what lets the store report per-record changes\n    // instead of \"something in this collection changed\". Added, modified and\n    // removed are all reported the same way — the store's listener takes an\n    // id, and re-reads; what KIND of change it was is not something a\n    // reconcile pass needs to be told.\n    //\n    // `includeMetadataChanges` is deliberately left off: local writes and\n    // has-pending-writes flips would otherwise wake every listener for\n    // changes this process just made.\n    watch: (collectionPath, onChanged, onError) => {\n      let seen = false;\n      return onSnapshot(\n        firestoreCollection(database, collectionPath),\n        (snapshot) => {\n          const initial = !seen;\n          seen = true;\n          onChanged(\n            snapshot.docChanges().map((change) => change.doc.id),\n            { initial },\n          );\n        },\n        onError,\n      );\n    },\n    timestamp: (seconds, nanoseconds) => new Timestamp(seconds, nanoseconds),\n  };\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;AAiGA,SAAgB,oBAAoB,UAAoC;CACtE,OAAO;EACL,MAAM,OAAO,mBAAmB;GAE9B,QAAO,OAAA,GADgB,mBAAA,QAAA,EAAA,GAAQ,mBAAA,MAAA,EAAA,GAAe,mBAAA,WAAA,CAAoB,UAAU,cAAc,IAAA,GAAG,mBAAA,QAAA,CAAQ,UAAU,CAAC,CAAC,EAAA,CACjG,KAAK,KAAK,WAAW;IAAE,IAAI,MAAM;IAAI,MAAM,MAAM,KAAK;GAAE,EAAE;EAC5E;EACA,KAAK,OAAO,gBAAgB,UAAU;GACpC,MAAM,WAAW,OAAA,GAAM,mBAAA,OAAA,EAAA,GAAO,mBAAA,IAAA,CAAI,UAAU,gBAAgB,KAAK,CAAC;GAClE,OAAO,SAAS,OAAO,IAAI,SAAS,KAAK,IAAI;EAC/C;EACA,KAAK,OAAO,gBAAgB,OAAO,SAAS;GAC1C,OAAA,GAAM,mBAAA,OAAA,EAAA,GAAO,mBAAA,IAAA,CAAI,UAAU,gBAAgB,KAAK,GAAG,IAAI;EACzD;EACA,SAAS,gBAAgB,OAAO,UAAA,GAC9B,mBAAA,eAAA,CAAe,UAAU,OAAO,gBAAgB;GAC9C,MAAM,OAAA,GAAM,mBAAA,IAAA,CAAI,UAAU,gBAAgB,KAAK;GAE/C,KAAI,MADmB,YAAY,IAAI,GAAG,EAAA,CAC7B,OAAO,GAAG,OAAO;GAC9B,YAAY,IAAI,KAAK,IAAI;GACzB,OAAO;EACT,CAAC;EAMH,SAAS,gBAAgB,WAAA,GACvB,mBAAA,eAAA,CAAe,UAAU,OAAO,gBAAgB;GAC9C,MAAM,OAAA,GAAM,mBAAA,IAAA,CAAI,UAAU,gBAAgB,KAAK;GAE/C,IAAI,EAAC,MADkB,YAAY,IAAI,GAAG,EAAA,CAC5B,OAAO,GAAG,OAAO;GAC/B,YAAY,OAAO,GAAG;GACtB,OAAO;EACT,CAAC;EAWH,QAAQ,gBAAgB,WAAW,YAAY;GAC7C,IAAI,OAAO;GACX,QAAA,GAAO,mBAAA,WAAA,EAAA,GACL,mBAAA,WAAA,CAAoB,UAAU,cAAc,IAC3C,aAAa;IACZ,MAAM,UAAU,CAAC;IACjB,OAAO;IACP,UACE,SAAS,WAAW,CAAC,CAAC,KAAK,WAAW,OAAO,IAAI,EAAE,GACnD,EAAE,QAAQ,CACZ;GACF,GACA,OACF;EACF;EACA,YAAY,SAAS,gBAAgB,IAAI,mBAAA,UAAU,SAAS,WAAW;CACzE;AACF"}
+{"version":3,"file":"firestore.cjs","names":["getDocs","firestoreQuery","firestoreCollection","orderBy","getDoc","doc","setDoc","runTransaction","onSnapshot","Timestamp"],"sources":["../../src/collection/server/firestoreDocs.ts"],"sourcesContent":["// The seam between the firestore store and the Firestore SDK.\n//\n// The modular SDK is function-based (`getDocs(query(collection(db, …)))`), so a\n// store that imported those functions directly could not be tested without a\n// real backend — a fake `db` would still be handed to the real functions.\n// Narrowing to this interface makes the backend swappable: core ships\n// `createFirestoreDocs` over the real SDK, and the tests inject an in-memory\n// fake that satisfies the same shape. That is what lets this repository's tests\n// run with no API key and no network.\n//\n// Deliberately minimal and id-keyed: no query builder, no field ordering, no\n// cursors. Everything the store needs is \"the documents of one collection path,\n// ordered by document id\" — see the store header for why field ordering is\n// avoided entirely.\n//\n// The collection path is an ARGUMENT, not something this module composes. It\n// owns the SDK calls; `firestoreStore` owns where the documents live.\n\nimport {\n  collection as firestoreCollection,\n  doc,\n  getDoc,\n  getDocs,\n  orderBy,\n  query as firestoreQuery,\n  onSnapshot,\n  runTransaction,\n  setDoc,\n  Timestamp,\n  type Firestore,\n} from \"firebase/firestore\";\n\n/** One stored record document. `data` is the document's own fields — the\n *  record itself, not a wrapper around it; see `set` below. The store\n *  validates its shape, because a document written by hand could be\n *  anything. */\nexport interface FirestoreDoc {\n  id: string;\n  data: unknown;\n}\n\nexport interface FirestoreDocs {\n  /** Every document under `collectionPath`, ordered by document id. */\n  list: (collectionPath: string) => Promise<FirestoreDoc[]>;\n  /** One document's fields, or null when it doesn't exist. */\n  get: (collectionPath: string, docId: string) => Promise<unknown | null>;\n  /** Create or replace. */\n  set: (collectionPath: string, docId: string, data: Record<string, unknown>) => Promise<void>;\n  /** Create only. Returns false when the id already exists — atomic, so two\n   *  concurrent creates can't both observe \"missing\". */\n  create: (collectionPath: string, docId: string, data: Record<string, unknown>) => Promise<boolean>;\n  /** Delete. Returns false when the id didn't exist, so a caller can tell a\n   *  real delete from a typo'd id. */\n  delete: (collectionPath: string, docId: string) => Promise<boolean>;\n  /** Listen to `collectionPath`. Every snapshot reports the ids that changed\n   *  in it, and whether it is the FIRST one.\n   *\n   *  `initial` is not a nicety. `onSnapshot` delivers the current contents\n   *  immediately, as one snapshot in which every existing document reads as\n   *  `added` — so a listener that treats snapshots uniformly announces the\n   *  whole collection as changed the moment it arms, on every mount. The flag\n   *  is passed up rather than swallowed here so the decision (and its test)\n   *  lives with the store's policy, next to the rest of it.\n   *\n   *  `onError` fires at most once per subscription: a Firestore listen error\n   *  TERMINATES the listener and never recovers on its own. Re-subscribing is\n   *  the caller's job (`firestore/listen.ts` holds the policy).\n   *\n   *  Returns the detach function synchronously — `onSnapshot` is not async. */\n  watch: (collectionPath: string, onChanged: (ids: string[], meta: { initial: boolean }) => void, onError: (error: unknown) => void) => () => void;\n  /** Firestore's own instant, for a field the store must hand back as the type\n   *  it was stored as.\n   *\n   *  Here rather than in the store because this is the seam that owns the SDK:\n   *  `firebase` is an OPTIONAL peer, and the store is reachable from\n   *  `collection/server` (the factory registry in `store.ts` names it), so a\n   *  top-level `import { Timestamp }` there makes the peer required for every\n   *  consumer of that entry — including hosts with no Firestore at all. Typed\n   *  `unknown` so no SDK type crosses back out. */\n  timestamp: (seconds: number, nanoseconds: number) => unknown;\n}\n\n/** The real implementation over the modular SDK.\n *\n *  THE RECORD IS THE DOCUMENT. Its fields are written at the top level, not\n *  nested under a `data` key. This is not a matter of taste: the deployed\n *  security rules read `request.resource.data.<field>` and\n *  `resource.data[submit.emailField]` — a wrapper would put every field one\n *  level down, so the required-field checks, the status state machine and the\n *  \"your own row\" predicate would all read absent values and fail closed. A\n *  shared record's shape is part of the authorization contract.\n *\n *  `orderBy(\"__name__\")` orders by DOCUMENT ID. Ordering by a record field\n *  would silently EXCLUDE documents missing that field (the trap\n *  `remote-host/server/hostRunner.ts:158-169` documents), turning a read into a\n *  partial one; the document id is always present and gives the stable order\n *  the store contract requires. */\nexport function createFirestoreDocs(database: Firestore): FirestoreDocs {\n  return {\n    list: async (collectionPath) => {\n      const snapshot = await getDocs(firestoreQuery(firestoreCollection(database, collectionPath), orderBy(\"__name__\")));\n      return snapshot.docs.map((entry) => ({ id: entry.id, data: entry.data() }));\n    },\n    get: async (collectionPath, docId) => {\n      const snapshot = await getDoc(doc(database, collectionPath, docId));\n      return snapshot.exists() ? snapshot.data() : null;\n    },\n    set: async (collectionPath, docId, data) => {\n      await setDoc(doc(database, collectionPath, docId), data);\n    },\n    create: (collectionPath, docId, data) =>\n      runTransaction(database, async (transaction) => {\n        const ref = doc(database, collectionPath, docId);\n        const existing = await transaction.get(ref);\n        if (existing.exists()) return false;\n        transaction.set(ref, data);\n        return true;\n      }),\n    // Firestore's deleteDoc succeeds on a missing document, so an existence\n    // check is what makes \"deleted\" distinguishable from \"there was nothing\".\n    // It runs INSIDE the transaction (like `create`): a plain get-then-delete\n    // would report `true` for a document a concurrent client had already\n    // removed, i.e. claim a delete this call never performed.\n    delete: (collectionPath, docId) =>\n      runTransaction(database, async (transaction) => {\n        const ref = doc(database, collectionPath, docId);\n        const existing = await transaction.get(ref);\n        if (!existing.exists()) return false;\n        transaction.delete(ref);\n        return true;\n      }),\n    // `docChanges()` rather than the whole snapshot: it names the documents\n    // that moved, which is what lets the store report per-record changes\n    // instead of \"something in this collection changed\". Added, modified and\n    // removed are all reported the same way — the store's listener takes an\n    // id, and re-reads; what KIND of change it was is not something a\n    // reconcile pass needs to be told.\n    //\n    // `includeMetadataChanges` is deliberately left off: local writes and\n    // has-pending-writes flips would otherwise wake every listener for\n    // changes this process just made.\n    watch: (collectionPath, onChanged, onError) => {\n      let seen = false;\n      return onSnapshot(\n        firestoreCollection(database, collectionPath),\n        (snapshot) => {\n          const initial = !seen;\n          seen = true;\n          onChanged(\n            snapshot.docChanges().map((change) => change.doc.id),\n            { initial },\n          );\n        },\n        onError,\n      );\n    },\n    timestamp: (seconds, nanoseconds) => new Timestamp(seconds, nanoseconds),\n  };\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;AAiGA,SAAgB,oBAAoB,UAAoC;CACtE,OAAO;EACL,MAAM,OAAO,mBAAmB;GAE9B,QAAO,OAAA,GADgBA,mBAAAA,QAAAA,EAAAA,GAAQC,mBAAAA,MAAAA,EAAAA,GAAeC,mBAAAA,WAAAA,CAAoB,UAAU,cAAc,IAAA,GAAGC,mBAAAA,QAAAA,CAAQ,UAAU,CAAC,CAAC,EAAA,CACjG,KAAK,KAAK,WAAW;IAAE,IAAI,MAAM;IAAI,MAAM,MAAM,KAAK;GAAE,EAAE;EAC5E;EACA,KAAK,OAAO,gBAAgB,UAAU;GACpC,MAAM,WAAW,OAAA,GAAMC,mBAAAA,OAAAA,EAAAA,GAAOC,mBAAAA,IAAAA,CAAI,UAAU,gBAAgB,KAAK,CAAC;GAClE,OAAO,SAAS,OAAO,IAAI,SAAS,KAAK,IAAI;EAC/C;EACA,KAAK,OAAO,gBAAgB,OAAO,SAAS;GAC1C,OAAA,GAAMC,mBAAAA,OAAAA,EAAAA,GAAOD,mBAAAA,IAAAA,CAAI,UAAU,gBAAgB,KAAK,GAAG,IAAI;EACzD;EACA,SAAS,gBAAgB,OAAO,UAAA,GAC9BE,mBAAAA,eAAAA,CAAe,UAAU,OAAO,gBAAgB;GAC9C,MAAM,OAAA,GAAMF,mBAAAA,IAAAA,CAAI,UAAU,gBAAgB,KAAK;GAE/C,KAAI,MADmB,YAAY,IAAI,GAAG,EAAA,CAC7B,OAAO,GAAG,OAAO;GAC9B,YAAY,IAAI,KAAK,IAAI;GACzB,OAAO;EACT,CAAC;EAMH,SAAS,gBAAgB,WAAA,GACvBE,mBAAAA,eAAAA,CAAe,UAAU,OAAO,gBAAgB;GAC9C,MAAM,OAAA,GAAMF,mBAAAA,IAAAA,CAAI,UAAU,gBAAgB,KAAK;GAE/C,IAAI,EAAC,MADkB,YAAY,IAAI,GAAG,EAAA,CAC5B,OAAO,GAAG,OAAO;GAC/B,YAAY,OAAO,GAAG;GACtB,OAAO;EACT,CAAC;EAWH,QAAQ,gBAAgB,WAAW,YAAY;GAC7C,IAAI,OAAO;GACX,QAAA,GAAOG,mBAAAA,WAAAA,EAAAA,GACLN,mBAAAA,WAAAA,CAAoB,UAAU,cAAc,IAC3C,aAAa;IACZ,MAAM,UAAU,CAAC;IACjB,OAAO;IACP,UACE,SAAS,WAAW,CAAC,CAAC,KAAK,WAAW,OAAO,IAAI,EAAE,GACnD,EAAE,QAAQ,CACZ;GACF,GACA,OACF;EACF;EACA,YAAY,SAAS,gBAAgB,IAAIO,mBAAAA,UAAU,SAAS,WAAW;CACzE;AACF"}

package/dist/collection/firestore.js.map

@@ -1 +1 @@
-{"version":3,"file":"firestore.js","names":[],"sources":["../../src/collection/server/firestoreDocs.ts"],"sourcesContent":["// The seam between the firestore store and the Firestore SDK.\n//\n// The modular SDK is function-based (`getDocs(query(collection(db, …)))`), so a\n// store that imported those functions directly could not be tested without a\n// real backend — a fake `db` would still be handed to the real functions.\n// Narrowing to this interface makes the backend swappable: core ships\n// `createFirestoreDocs` over the real SDK, and the tests inject an in-memory\n// fake that satisfies the same shape. That is what lets this repository's tests\n// run with no API key and no network.\n//\n// Deliberately minimal and id-keyed: no query builder, no field ordering, no\n// cursors. Everything the store needs is \"the documents of one collection path,\n// ordered by document id\" — see the store header for why field ordering is\n// avoided entirely.\n//\n// The collection path is an ARGUMENT, not something this module composes. It\n// owns the SDK calls; `firestoreStore` owns where the documents live.\n\nimport {\n  collection as firestoreCollection,\n  doc,\n  getDoc,\n  getDocs,\n  orderBy,\n  query as firestoreQuery,\n  onSnapshot,\n  runTransaction,\n  setDoc,\n  Timestamp,\n  type Firestore,\n} from \"firebase/firestore\";\n\n/** One stored record document. `data` is the document's own fields — the\n *  record itself, not a wrapper around it; see `set` below. The store\n *  validates its shape, because a document written by hand could be\n *  anything. */\nexport interface FirestoreDoc {\n  id: string;\n  data: unknown;\n}\n\nexport interface FirestoreDocs {\n  /** Every document under `collectionPath`, ordered by document id. */\n  list: (collectionPath: string) => Promise<FirestoreDoc[]>;\n  /** One document's fields, or null when it doesn't exist. */\n  get: (collectionPath: string, docId: string) => Promise<unknown | null>;\n  /** Create or replace. */\n  set: (collectionPath: string, docId: string, data: Record<string, unknown>) => Promise<void>;\n  /** Create only. Returns false when the id already exists — atomic, so two\n   *  concurrent creates can't both observe \"missing\". */\n  create: (collectionPath: string, docId: string, data: Record<string, unknown>) => Promise<boolean>;\n  /** Delete. Returns false when the id didn't exist, so a caller can tell a\n   *  real delete from a typo'd id. */\n  delete: (collectionPath: string, docId: string) => Promise<boolean>;\n  /** Listen to `collectionPath`. Every snapshot reports the ids that changed\n   *  in it, and whether it is the FIRST one.\n   *\n   *  `initial` is not a nicety. `onSnapshot` delivers the current contents\n   *  immediately, as one snapshot in which every existing document reads as\n   *  `added` — so a listener that treats snapshots uniformly announces the\n   *  whole collection as changed the moment it arms, on every mount. The flag\n   *  is passed up rather than swallowed here so the decision (and its test)\n   *  lives with the store's policy, next to the rest of it.\n   *\n   *  `onError` fires at most once per subscription: a Firestore listen error\n   *  TERMINATES the listener and never recovers on its own. Re-subscribing is\n   *  the caller's job (`firestore/listen.ts` holds the policy).\n   *\n   *  Returns the detach function synchronously — `onSnapshot` is not async. */\n  watch: (collectionPath: string, onChanged: (ids: string[], meta: { initial: boolean }) => void, onError: (error: unknown) => void) => () => void;\n  /** Firestore's own instant, for a field the store must hand back as the type\n   *  it was stored as.\n   *\n   *  Here rather than in the store because this is the seam that owns the SDK:\n   *  `firebase` is an OPTIONAL peer, and the store is reachable from\n   *  `collection/server` (the factory registry in `store.ts` names it), so a\n   *  top-level `import { Timestamp }` there makes the peer required for every\n   *  consumer of that entry — including hosts with no Firestore at all. Typed\n   *  `unknown` so no SDK type crosses back out. */\n  timestamp: (seconds: number, nanoseconds: number) => unknown;\n}\n\n/** The real implementation over the modular SDK.\n *\n *  THE RECORD IS THE DOCUMENT. Its fields are written at the top level, not\n *  nested under a `data` key. This is not a matter of taste: the deployed\n *  security rules read `request.resource.data.<field>` and\n *  `resource.data[submit.emailField]` — a wrapper would put every field one\n *  level down, so the required-field checks, the status state machine and the\n *  \"your own row\" predicate would all read absent values and fail closed. A\n *  shared record's shape is part of the authorization contract.\n *\n *  `orderBy(\"__name__\")` orders by DOCUMENT ID. Ordering by a record field\n *  would silently EXCLUDE documents missing that field (the trap\n *  `remote-host/server/hostRunner.ts:158-169` documents), turning a read into a\n *  partial one; the document id is always present and gives the stable order\n *  the store contract requires. */\nexport function createFirestoreDocs(database: Firestore): FirestoreDocs {\n  return {\n    list: async (collectionPath) => {\n      const snapshot = await getDocs(firestoreQuery(firestoreCollection(database, collectionPath), orderBy(\"__name__\")));\n      return snapshot.docs.map((entry) => ({ id: entry.id, data: entry.data() }));\n    },\n    get: async (collectionPath, docId) => {\n      const snapshot = await getDoc(doc(database, collectionPath, docId));\n      return snapshot.exists() ? snapshot.data() : null;\n    },\n    set: async (collectionPath, docId, data) => {\n      await setDoc(doc(database, collectionPath, docId), data);\n    },\n    create: (collectionPath, docId, data) =>\n      runTransaction(database, async (transaction) => {\n        const ref = doc(database, collectionPath, docId);\n        const existing = await transaction.get(ref);\n        if (existing.exists()) return false;\n        transaction.set(ref, data);\n        return true;\n      }),\n    // Firestore's deleteDoc succeeds on a missing document, so an existence\n    // check is what makes \"deleted\" distinguishable from \"there was nothing\".\n    // It runs INSIDE the transaction (like `create`): a plain get-then-delete\n    // would report `true` for a document a concurrent client had already\n    // removed, i.e. claim a delete this call never performed.\n    delete: (collectionPath, docId) =>\n      runTransaction(database, async (transaction) => {\n        const ref = doc(database, collectionPath, docId);\n        const existing = await transaction.get(ref);\n        if (!existing.exists()) return false;\n        transaction.delete(ref);\n        return true;\n      }),\n    // `docChanges()` rather than the whole snapshot: it names the documents\n    // that moved, which is what lets the store report per-record changes\n    // instead of \"something in this collection changed\". Added, modified and\n    // removed are all reported the same way — the store's listener takes an\n    // id, and re-reads; what KIND of change it was is not something a\n    // reconcile pass needs to be told.\n    //\n    // `includeMetadataChanges` is deliberately left off: local writes and\n    // has-pending-writes flips would otherwise wake every listener for\n    // changes this process just made.\n    watch: (collectionPath, onChanged, onError) => {\n      let seen = false;\n      return onSnapshot(\n        firestoreCollection(database, collectionPath),\n        (snapshot) => {\n          const initial = !seen;\n          seen = true;\n          onChanged(\n            snapshot.docChanges().map((change) => change.doc.id),\n            { initial },\n          );\n        },\n        onError,\n      );\n    },\n    timestamp: (seconds, nanoseconds) => new Timestamp(seconds, nanoseconds),\n  };\n}\n"],"mappings":";;;;;;;;;;;;;;;;;AAiGA,SAAgB,oBAAoB,UAAoC;CACtE,OAAO;EACL,MAAM,OAAO,mBAAmB;GAE9B,QAAO,MADgB,QAAQ,MAAe,WAAoB,UAAU,cAAc,GAAG,QAAQ,UAAU,CAAC,CAAC,EAAA,CACjG,KAAK,KAAK,WAAW;IAAE,IAAI,MAAM;IAAI,MAAM,MAAM,KAAK;GAAE,EAAE;EAC5E;EACA,KAAK,OAAO,gBAAgB,UAAU;GACpC,MAAM,WAAW,MAAM,OAAO,IAAI,UAAU,gBAAgB,KAAK,CAAC;GAClE,OAAO,SAAS,OAAO,IAAI,SAAS,KAAK,IAAI;EAC/C;EACA,KAAK,OAAO,gBAAgB,OAAO,SAAS;GAC1C,MAAM,OAAO,IAAI,UAAU,gBAAgB,KAAK,GAAG,IAAI;EACzD;EACA,SAAS,gBAAgB,OAAO,SAC9B,eAAe,UAAU,OAAO,gBAAgB;GAC9C,MAAM,MAAM,IAAI,UAAU,gBAAgB,KAAK;GAE/C,KAAI,MADmB,YAAY,IAAI,GAAG,EAAA,CAC7B,OAAO,GAAG,OAAO;GAC9B,YAAY,IAAI,KAAK,IAAI;GACzB,OAAO;EACT,CAAC;EAMH,SAAS,gBAAgB,UACvB,eAAe,UAAU,OAAO,gBAAgB;GAC9C,MAAM,MAAM,IAAI,UAAU,gBAAgB,KAAK;GAE/C,IAAI,EAAC,MADkB,YAAY,IAAI,GAAG,EAAA,CAC5B,OAAO,GAAG,OAAO;GAC/B,YAAY,OAAO,GAAG;GACtB,OAAO;EACT,CAAC;EAWH,QAAQ,gBAAgB,WAAW,YAAY;GAC7C,IAAI,OAAO;GACX,OAAO,WACL,WAAoB,UAAU,cAAc,IAC3C,aAAa;IACZ,MAAM,UAAU,CAAC;IACjB,OAAO;IACP,UACE,SAAS,WAAW,CAAC,CAAC,KAAK,WAAW,OAAO,IAAI,EAAE,GACnD,EAAE,QAAQ,CACZ;GACF,GACA,OACF;EACF;EACA,YAAY,SAAS,gBAAgB,IAAI,UAAU,SAAS,WAAW;CACzE;AACF"}
+{"version":3,"file":"firestore.js","names":["firestoreQuery","firestoreCollection"],"sources":["../../src/collection/server/firestoreDocs.ts"],"sourcesContent":["// The seam between the firestore store and the Firestore SDK.\n//\n// The modular SDK is function-based (`getDocs(query(collection(db, …)))`), so a\n// store that imported those functions directly could not be tested without a\n// real backend — a fake `db` would still be handed to the real functions.\n// Narrowing to this interface makes the backend swappable: core ships\n// `createFirestoreDocs` over the real SDK, and the tests inject an in-memory\n// fake that satisfies the same shape. That is what lets this repository's tests\n// run with no API key and no network.\n//\n// Deliberately minimal and id-keyed: no query builder, no field ordering, no\n// cursors. Everything the store needs is \"the documents of one collection path,\n// ordered by document id\" — see the store header for why field ordering is\n// avoided entirely.\n//\n// The collection path is an ARGUMENT, not something this module composes. It\n// owns the SDK calls; `firestoreStore` owns where the documents live.\n\nimport {\n  collection as firestoreCollection,\n  doc,\n  getDoc,\n  getDocs,\n  orderBy,\n  query as firestoreQuery,\n  onSnapshot,\n  runTransaction,\n  setDoc,\n  Timestamp,\n  type Firestore,\n} from \"firebase/firestore\";\n\n/** One stored record document. `data` is the document's own fields — the\n *  record itself, not a wrapper around it; see `set` below. The store\n *  validates its shape, because a document written by hand could be\n *  anything. */\nexport interface FirestoreDoc {\n  id: string;\n  data: unknown;\n}\n\nexport interface FirestoreDocs {\n  /** Every document under `collectionPath`, ordered by document id. */\n  list: (collectionPath: string) => Promise<FirestoreDoc[]>;\n  /** One document's fields, or null when it doesn't exist. */\n  get: (collectionPath: string, docId: string) => Promise<unknown | null>;\n  /** Create or replace. */\n  set: (collectionPath: string, docId: string, data: Record<string, unknown>) => Promise<void>;\n  /** Create only. Returns false when the id already exists — atomic, so two\n   *  concurrent creates can't both observe \"missing\". */\n  create: (collectionPath: string, docId: string, data: Record<string, unknown>) => Promise<boolean>;\n  /** Delete. Returns false when the id didn't exist, so a caller can tell a\n   *  real delete from a typo'd id. */\n  delete: (collectionPath: string, docId: string) => Promise<boolean>;\n  /** Listen to `collectionPath`. Every snapshot reports the ids that changed\n   *  in it, and whether it is the FIRST one.\n   *\n   *  `initial` is not a nicety. `onSnapshot` delivers the current contents\n   *  immediately, as one snapshot in which every existing document reads as\n   *  `added` — so a listener that treats snapshots uniformly announces the\n   *  whole collection as changed the moment it arms, on every mount. The flag\n   *  is passed up rather than swallowed here so the decision (and its test)\n   *  lives with the store's policy, next to the rest of it.\n   *\n   *  `onError` fires at most once per subscription: a Firestore listen error\n   *  TERMINATES the listener and never recovers on its own. Re-subscribing is\n   *  the caller's job (`firestore/listen.ts` holds the policy).\n   *\n   *  Returns the detach function synchronously — `onSnapshot` is not async. */\n  watch: (collectionPath: string, onChanged: (ids: string[], meta: { initial: boolean }) => void, onError: (error: unknown) => void) => () => void;\n  /** Firestore's own instant, for a field the store must hand back as the type\n   *  it was stored as.\n   *\n   *  Here rather than in the store because this is the seam that owns the SDK:\n   *  `firebase` is an OPTIONAL peer, and the store is reachable from\n   *  `collection/server` (the factory registry in `store.ts` names it), so a\n   *  top-level `import { Timestamp }` there makes the peer required for every\n   *  consumer of that entry — including hosts with no Firestore at all. Typed\n   *  `unknown` so no SDK type crosses back out. */\n  timestamp: (seconds: number, nanoseconds: number) => unknown;\n}\n\n/** The real implementation over the modular SDK.\n *\n *  THE RECORD IS THE DOCUMENT. Its fields are written at the top level, not\n *  nested under a `data` key. This is not a matter of taste: the deployed\n *  security rules read `request.resource.data.<field>` and\n *  `resource.data[submit.emailField]` — a wrapper would put every field one\n *  level down, so the required-field checks, the status state machine and the\n *  \"your own row\" predicate would all read absent values and fail closed. A\n *  shared record's shape is part of the authorization contract.\n *\n *  `orderBy(\"__name__\")` orders by DOCUMENT ID. Ordering by a record field\n *  would silently EXCLUDE documents missing that field (the trap\n *  `remote-host/server/hostRunner.ts:158-169` documents), turning a read into a\n *  partial one; the document id is always present and gives the stable order\n *  the store contract requires. */\nexport function createFirestoreDocs(database: Firestore): FirestoreDocs {\n  return {\n    list: async (collectionPath) => {\n      const snapshot = await getDocs(firestoreQuery(firestoreCollection(database, collectionPath), orderBy(\"__name__\")));\n      return snapshot.docs.map((entry) => ({ id: entry.id, data: entry.data() }));\n    },\n    get: async (collectionPath, docId) => {\n      const snapshot = await getDoc(doc(database, collectionPath, docId));\n      return snapshot.exists() ? snapshot.data() : null;\n    },\n    set: async (collectionPath, docId, data) => {\n      await setDoc(doc(database, collectionPath, docId), data);\n    },\n    create: (collectionPath, docId, data) =>\n      runTransaction(database, async (transaction) => {\n        const ref = doc(database, collectionPath, docId);\n        const existing = await transaction.get(ref);\n        if (existing.exists()) return false;\n        transaction.set(ref, data);\n        return true;\n      }),\n    // Firestore's deleteDoc succeeds on a missing document, so an existence\n    // check is what makes \"deleted\" distinguishable from \"there was nothing\".\n    // It runs INSIDE the transaction (like `create`): a plain get-then-delete\n    // would report `true` for a document a concurrent client had already\n    // removed, i.e. claim a delete this call never performed.\n    delete: (collectionPath, docId) =>\n      runTransaction(database, async (transaction) => {\n        const ref = doc(database, collectionPath, docId);\n        const existing = await transaction.get(ref);\n        if (!existing.exists()) return false;\n        transaction.delete(ref);\n        return true;\n      }),\n    // `docChanges()` rather than the whole snapshot: it names the documents\n    // that moved, which is what lets the store report per-record changes\n    // instead of \"something in this collection changed\". Added, modified and\n    // removed are all reported the same way — the store's listener takes an\n    // id, and re-reads; what KIND of change it was is not something a\n    // reconcile pass needs to be told.\n    //\n    // `includeMetadataChanges` is deliberately left off: local writes and\n    // has-pending-writes flips would otherwise wake every listener for\n    // changes this process just made.\n    watch: (collectionPath, onChanged, onError) => {\n      let seen = false;\n      return onSnapshot(\n        firestoreCollection(database, collectionPath),\n        (snapshot) => {\n          const initial = !seen;\n          seen = true;\n          onChanged(\n            snapshot.docChanges().map((change) => change.doc.id),\n            { initial },\n          );\n        },\n        onError,\n      );\n    },\n    timestamp: (seconds, nanoseconds) => new Timestamp(seconds, nanoseconds),\n  };\n}\n"],"mappings":";;;;;;;;;;;;;;;;;AAiGA,SAAgB,oBAAoB,UAAoC;CACtE,OAAO;EACL,MAAM,OAAO,mBAAmB;GAE9B,QAAO,MADgB,QAAQA,MAAeC,WAAoB,UAAU,cAAc,GAAG,QAAQ,UAAU,CAAC,CAAC,EAAA,CACjG,KAAK,KAAK,WAAW;IAAE,IAAI,MAAM;IAAI,MAAM,MAAM,KAAK;GAAE,EAAE;EAC5E;EACA,KAAK,OAAO,gBAAgB,UAAU;GACpC,MAAM,WAAW,MAAM,OAAO,IAAI,UAAU,gBAAgB,KAAK,CAAC;GAClE,OAAO,SAAS,OAAO,IAAI,SAAS,KAAK,IAAI;EAC/C;EACA,KAAK,OAAO,gBAAgB,OAAO,SAAS;GAC1C,MAAM,OAAO,IAAI,UAAU,gBAAgB,KAAK,GAAG,IAAI;EACzD;EACA,SAAS,gBAAgB,OAAO,SAC9B,eAAe,UAAU,OAAO,gBAAgB;GAC9C,MAAM,MAAM,IAAI,UAAU,gBAAgB,KAAK;GAE/C,KAAI,MADmB,YAAY,IAAI,GAAG,EAAA,CAC7B,OAAO,GAAG,OAAO;GAC9B,YAAY,IAAI,KAAK,IAAI;GACzB,OAAO;EACT,CAAC;EAMH,SAAS,gBAAgB,UACvB,eAAe,UAAU,OAAO,gBAAgB;GAC9C,MAAM,MAAM,IAAI,UAAU,gBAAgB,KAAK;GAE/C,IAAI,EAAC,MADkB,YAAY,IAAI,GAAG,EAAA,CAC5B,OAAO,GAAG,OAAO;GAC/B,YAAY,OAAO,GAAG;GACtB,OAAO;EACT,CAAC;EAWH,QAAQ,gBAAgB,WAAW,YAAY;GAC7C,IAAI,OAAO;GACX,OAAO,WACLA,WAAoB,UAAU,cAAc,IAC3C,aAAa;IACZ,MAAM,UAAU,CAAC;IACjB,OAAO;IACP,UACE,SAAS,WAAW,CAAC,CAAC,KAAK,WAAW,OAAO,IAAI,EAAE,GACnD,EAAE,QAAQ,CACZ;GACF,GACA,OACF;EACF;EACA,YAAY,SAAS,gBAAgB,IAAI,UAAU,SAAS,WAAW;CACzE;AACF"}

package/dist/collection/index.cjs

@@ -1,10 +1,10 @@
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
-const require_dist = require("../dist-Gj7ygaW2.cjs");
+const require_dist = require("../dist-BZ62pKuU.cjs");
 const require_itemId = require("../itemId-CVrNibwT.cjs");
-const require_promptSafety = require("../promptSafety-BGV1wrE6.cjs");
+const require_promptSafety = require("../promptSafety-auQEatax.cjs");
 const require_project = require("../project-C1ep9pvo.cjs");
 const require_iconGlyph = require("../iconGlyph-fSBp6k4J.cjs");
-require("../errorMessage-CT-va_Pv.cjs");
+require("../errorMessage-OEQzRwsi.cjs");
 //#region src/collection/core/presentCollection.ts
 var TOOL_NAME = "presentCollection";
 /** Stamp a host's opaque project scope onto a card payload. The ONLY way a