@plebeiantech/lat.md 0.12.3-fork.17 → 0.12.3-fork.20

package/dist/src/view/repository.js

@@ -1,11 +1,11 @@
 import { readFile, realpath } from 'node:fs/promises';
 import { dirname, extname, isAbsolute, join, posix, relative, resolve, sep, } from 'node:path';
-import { buildFileIndex, buildSectionSlugIndex, flattenSections, resolveRef, } from '../lattice-model.js';
-import { createExternalResolver, } from '../external-sources.js';
-import { addExternalDocumentAliasAnchors, externalDocumentSections, } from '../external-documents.js';
-import { resolveSourceSymbol, SourceParserRuntime, } from '../source-parser.js';
-import { isSourceFileExtension } from '../source-formats.js';
-import { toPosix } from '../path.js';
+import { buildFileIndex, buildSectionSlugIndex, flattenSections, resolveRef, } from '@plebeiantech/lat.md-core/lattice-model';
+import { createExternalResolver, } from '@plebeiantech/lat.md-core/external-sources';
+import { addExternalDocumentAliasAnchors, externalDocumentSections, } from '@plebeiantech/lat.md-core/external-documents';
+import { resolveSourceSymbol, SourceParserRuntime, } from '@plebeiantech/lat.md-core/source-parser';
+import { isSourceFileExtension } from '@plebeiantech/lat.md-core/source-formats';
+import { toPosix } from '@plebeiantech/lat.md-core/path';
 import { renderExternalDocumentTree } from './external-document-tree.js';
 import { visitDocumentElements } from './document-tree.js';
 import { highlightSource } from './highlight.js';
@@ -73,7 +73,7 @@ function externalDocumentLink(href, current, external, available) {
         href.startsWith('?') ||
         href.startsWith('//') ||
         /^[a-z][a-z\d+.-]*:/i.test(href) ||
-        /^\/(?:code|docs|external)(?:\/|$)/.test(href)) {
+        /^\/external(?:\/|$)/.test(href)) {
         return undefined;
     }
     let destination;
@@ -168,7 +168,7 @@ function matchingSymbol(symbols, symbolPath) {
     }
     return undefined;
 }
-export async function createMarkdownWikiLinkResolver(latDir, requestedPath, loadedSections, referenceIndex, externalResolver) {
+export async function createMarkdownWikiLinkResolver(latDir, requestedPath, loadedSections, referenceIndex, externalResolver, publishable) {
     const external = externalResolver ?? (await createExternalResolver(latDir, dirname(latDir)));
     const projectRoot = dirname(latDir);
     const flat = flattenSections(loadedSections);
@@ -210,7 +210,7 @@ export async function createMarkdownWikiLinkResolver(latDir, requestedPath, load
             };
         }
         const source = viewSourceTarget(target);
-        if (!source)
+        if (!source || (publishable && !(await publishable(source.path))))
             return null;
         try {
             await readViewSource(latDir, projectRoot, source.path, source.symbol);
@@ -236,7 +236,7 @@ export async function createMarkdownWikiLinkResolver(latDir, requestedPath, load
     };
 }
 /** Resolve and render one configured external file through the normal view models. */
-export async function getViewExternal(latDir, projectRoot, targetValue, external, allSections, referenceIndex) {
+export async function getViewExternal(latDir, projectRoot, targetValue, external, allSections, referenceIndex, publishable) {
     let resolved;
     try {
         resolved = await external.resolve(targetValue);
@@ -244,12 +244,26 @@ export async function getViewExternal(latDir, projectRoot, targetValue, external
     catch (error) {
         throw new ViewExternalNotFoundError(error.message);
     }
-    const createResolver = (path) => createMarkdownWikiLinkResolver(latDir, path, allSections, referenceIndex, external);
+    const createResolver = (path) => createMarkdownWikiLinkResolver(latDir, path, allSections, referenceIndex, external, publishable);
     if (resolved.kind === 'document') {
         const virtualPath = join(projectRoot, 'lat.md', '.external', resolved.target.handle, resolved.target.resolvedPath);
         const analysis = resolved.document;
         const sections = externalDocumentSections(virtualPath, analysis);
-        const resolver = await createResolver(resolved.target.resolvedPath);
+        // Remote-authored wiki links may resolve only to configured external files.
+        // Do not call the local resolver before rewriting their URLs.
+        const available = availableExternalFiles(external, referenceIndex, resolved.target);
+        const resolver = async (target) => {
+            try {
+                const parsed = external.parse(target);
+                if (parsed)
+                    return { href: externalUrl(parsed.identity), referenceCount: 0 };
+            }
+            catch {
+                return null;
+            }
+            const href = externalDocumentLink(target, resolved.target, external, available);
+            return typeof href === 'string' ? { href, referenceCount: 0 } : null;
+        };
         const rendered = analysis.format === 'markdown'
             ? await renderMarkdown(resolved.fullContent, resolved.target.resolvedPath, resolver, {})
             : {
@@ -382,10 +396,10 @@ async function readViewSource(latDir, projectRoot, requestedPath, requestedSymbo
     };
 }
 /** Read and highlight a source file after constraining it to the project root. */
-export async function getViewSource(latDir, projectRoot, requestedPath, requestedSymbol = '', origin, requestedLine = 0, allSections = [], referenceIndex) {
+export async function getViewSource(latDir, projectRoot, requestedPath, requestedSymbol = '', origin, requestedLine = 0, allSections = [], referenceIndex, publishable) {
     const source = await readViewSource(latDir, projectRoot, requestedPath, requestedSymbol, requestedLine);
     const references = referenceIndex
-        ? await renderSourceReferenceContext(referenceIndex, `${source.path}${requestedSymbol ? `#${requestedSymbol}` : ''}`, origin, latDir, projectRoot, (path) => createMarkdownWikiLinkResolver(latDir, path, allSections, referenceIndex))
+        ? await renderSourceReferenceContext(referenceIndex, `${source.path}${requestedSymbol ? `#${requestedSymbol}` : ''}`, origin, latDir, projectRoot, (path) => createMarkdownWikiLinkResolver(latDir, path, allSections, referenceIndex, undefined, publishable))
         : { context: null, otherReferences: [] };
     return {
         ...source,

package/dist/src/view/request-security.d.ts

@@ -0,0 +1,5 @@
+import type { IncomingMessage } from 'node:http';
+/** Check the actual listener authority; forwarding headers are not trusted. */
+export declare function trustedLiveRequest(req: IncomingMessage, configuredHost: string): boolean;
+/** Untrusted repository resources cannot execute with the editor's origin. */
+export declare const RESOURCE_CONTENT_SECURITY_POLICY = "sandbox; default-src 'none'; img-src 'self' data:; style-src 'unsafe-inline'; base-uri 'none'; form-action 'none'; frame-ancestors 'none'";

package/dist/src/view/request-security.js

@@ -0,0 +1,46 @@
+const LOOPBACK_HOSTS = new Set(['localhost', '127.0.0.1', '[::1]']);
+const urlHost = (host) => host.includes(':') && !host.startsWith('[')
+    ? `[${host}]`
+    : host.toLowerCase();
+/** Check the actual listener authority; forwarding headers are not trusted. */
+export function trustedLiveRequest(req, configuredHost) {
+    const authority = req.headers.host;
+    if (!authority || !/^[a-z\d.\-:[\]]+$/i.test(authority))
+        return false;
+    let url;
+    try {
+        url = new URL(`http://${authority}`);
+    }
+    catch {
+        return false;
+    }
+    if (Number(url.port || 80) !== req.socket.localPort)
+        return false;
+    const host = urlHost(configuredHost);
+    const allowed = new Set([host]);
+    if (LOOPBACK_HOSTS.has(host) || host === '0.0.0.0' || host === '[::]') {
+        for (const name of LOOPBACK_HOSTS)
+            allowed.add(name);
+        if (req.socket.localAddress)
+            allowed.add(urlHost(req.socket.localAddress));
+    }
+    if (!allowed.has(url.hostname))
+        return false;
+    const origin = req.headers.origin;
+    if (origin !== undefined && origin !== url.origin)
+        return false;
+    if (!['GET', 'HEAD'].includes(req.method ?? 'GET') &&
+        req.headers['sec-fetch-site'] === 'cross-site')
+        return false;
+    // Do not accept an absolute-form URL for a different authority.
+    try {
+        if (new URL(req.url ?? '/', url).origin !== url.origin)
+            return false;
+    }
+    catch {
+        return false;
+    }
+    return true;
+}
+/** Untrusted repository resources cannot execute with the editor's origin. */
+export const RESOURCE_CONTENT_SECURITY_POLICY = "sandbox; default-src 'none'; img-src 'self' data:; style-src 'unsafe-inline'; base-uri 'none'; form-action 'none'; frame-ancestors 'none'";

package/dist/src/view/search-result.d.ts

@@ -1,4 +1,4 @@
-import type { SectionMatch } from '../lattice-model.js';
+import type { SectionMatch } from '@plebeiantech/lat.md-core/lattice-model';
 import type { ViewSearchResult } from './protocol.js';
 /** Convert one graph section match into the browser search protocol. */
 export declare function viewSearchResult(latDir: string, match: SectionMatch, documentPaths?: ReadonlyMap<string, string>): ViewSearchResult;

package/dist/src/view/search-result.js

@@ -1,5 +1,5 @@
 import { dirname, relative, resolve } from 'node:path';
-import { toPosix } from '../path.js';
+import { toPosix } from '@plebeiantech/lat.md-core/path';
 import { documentUrl } from './document-route.js';
 /** Convert one graph section match into the browser search protocol. */
 export function viewSearchResult(latDir, match, documentPaths) {

package/dist/src/view/search.d.ts

@@ -1,4 +1,4 @@
-import type { Section, SectionMatch } from '../lattice-model.js';
+import type { Section, SectionMatch } from '@plebeiantech/lat.md-core/lattice-model';
 import type { ViewSearchResponse } from './protocol.js';
 export type ViewSearch = (query: string) => Promise<ViewSearchResponse>;
 export type ViewSearchDependencies = {

package/dist/src/view/server-build.d.ts

@@ -1,6 +1,6 @@
 import { getLatServerVersion } from '../../vendor/lat.md-server/index.js';
-import type { CmdContext } from '../context.js';
-import { analyzeMarkdownProject, type MarkdownProjectAnalysis } from '../project-analysis.js';
+import type { CmdContext } from '@plebeiantech/lat.md-core/context';
+import { analyzeMarkdownProject, type MarkdownProjectAnalysis } from '@plebeiantech/lat.md-core/project-analysis';
 import { getLocalVersion } from '../version.js';
 import { buildStaticView, type StaticViewBuildOptions, type StaticViewBuildResult } from './static-build.js';
 export type ServerViewBuildOptions = Omit<StaticViewBuildOptions, 'searchApi'>;

package/dist/src/view/server-build.js

@@ -4,9 +4,9 @@ import { mkdtemp, mkdir, rm, writeFile } from 'node:fs/promises';
 import { dirname, join, relative, resolve } from 'node:path';
 import { fileURLToPath } from 'node:url';
 import { getLatServerVersion } from '../../vendor/lat.md-server/index.js';
-import { analyzeMarkdownProject, } from '../project-analysis.js';
+import { analyzeMarkdownProject, } from '@plebeiantech/lat.md-core/project-analysis';
 import { getLocalVersion } from '../version.js';
-import { toPosix } from '../path.js';
+import { toPosix } from '@plebeiantech/lat.md-core/path';
 import { buildStaticView, moveViewBuildOutput, removeViewBuildStaging, normalizeStaticViewBasePath, validateViewBuildOutput, } from './static-build.js';
 import { SERVER_VIEW_SCHEMA_VERSION, } from './server-deployment.js';
 const defaultDependencies = {

package/dist/src/view/server-deployment.d.ts

@@ -1,6 +1,6 @@
 import { type LatServerApp } from '../../vendor/lat.md-server/index.js';
 import type { Express } from 'express';
-import type { Section } from '../lattice-model.js';
+import type { Section } from '@plebeiantech/lat.md-core/lattice-model';
 import type { CreateSearchEngine } from '../search/embedder.js';
 import type { ViewSearchResponse } from './protocol.js';
 export declare const SERVER_VIEW_SCHEMA_VERSION = 1;
@@ -16,7 +16,6 @@ export type ServerViewAppOptions = {
     app: Express;
     manifestFile: string | URL;
     indexFile: string | URL;
-    cacheDir?: string | URL;
     createSearchEngine?: CreateSearchEngine;
     search?: (query: string) => Promise<ViewSearchResponse>;
 };

package/dist/src/view/server-deployment.js

@@ -1,7 +1,6 @@
 import { INDEX_FILE } from '../search/db.js';
-import { copyFile, mkdir, mkdtemp, readFile, rm } from 'node:fs/promises';
-import { tmpdir } from 'node:os';
-import { dirname, join, resolve } from 'node:path';
+import { readFile } from 'node:fs/promises';
+import { basename, dirname, resolve } from 'node:path';
 import { fileURLToPath } from 'node:url';
 import { createLatServerApp } from '../../vendor/lat.md-server/index.js';
 import { createPreindexedViewSearch, } from './preindexed-search.js';
@@ -29,66 +28,27 @@ async function readManifest(path) {
     }
     return manifest;
 }
-/** Native SQLite handles may outlive close until the Windows process exits. */
-async function removeRuntimeCache(path) {
-    try {
-        await rm(path, {
-            recursive: true,
-            force: true,
-            maxRetries: 10,
-            retryDelay: 150,
-        });
-    }
-    catch (error) {
-        const code = error.code;
-        if (process.platform !== 'win32' ||
-            (code !== 'EBUSY' && code !== 'EPERM' && code !== 'ENOTEMPTY')) {
-            throw error;
-        }
-        // This is an owned OS-temp copy, never the deployed index or user data.
-        // A lingering native lock must not fail otherwise successful shutdown.
-    }
-}
 async function prepareServerView(options, manifestFile, indexFile) {
     const manifest = await readManifest(manifestFile);
-    let runtimeCacheDir = options.cacheDir ? localPath(options.cacheDir) : '';
-    let ownsCache = false;
     let search = options.search;
     let ownedSearch;
     if (!search) {
-        if (!runtimeCacheDir) {
-            runtimeCacheDir = await mkdtemp(join(tmpdir(), 'lat-ui-search-'));
-            ownsCache = true;
-        }
-        await mkdir(runtimeCacheDir, { recursive: true });
-        try {
-            await copyFile(indexFile, join(runtimeCacheDir, INDEX_FILE));
-        }
-        catch (error) {
-            if (ownsCache) {
-                await removeRuntimeCache(runtimeCacheDir);
-            }
-            throw error;
+        if (basename(indexFile) !== INDEX_FILE) {
+            throw new Error(`Server search index must be named ${INDEX_FILE}: ${indexFile}`);
         }
         const documentPaths = new Map();
         const sections = manifest.sections.map(({ documentPath, ...section }) => {
             documentPaths.set(section.id.toLowerCase(), documentPath);
             return { ...section, children: [] };
         });
-        ownedSearch = await createPreindexedViewSearch(dirname(indexFile), runtimeCacheDir, sections, documentPaths, undefined, options.createSearchEngine);
+        ownedSearch = await createPreindexedViewSearch(dirname(indexFile), dirname(indexFile), sections, documentPaths, undefined, options.createSearchEngine);
         search = ownedSearch;
     }
     return {
         manifest,
         search,
         close: async () => {
-            try {
-                await ownedSearch?.close();
-            }
-            finally {
-                if (ownsCache)
-                    await removeRuntimeCache(runtimeCacheDir);
-            }
+            await ownedSearch?.close();
         },
     };
 }

package/dist/src/view/server-index-worker.d.ts

@@ -1,4 +1,4 @@
-import type { MarkdownProjectAnalysis } from '../project-analysis.js';
+import type { MarkdownProjectAnalysis } from '@plebeiantech/lat.md-core/project-analysis';
 export type ServerIndexRequest = {
     latDir: string;
     project: MarkdownProjectAnalysis;

package/dist/src/view/server.d.ts

@@ -1,6 +1,6 @@
 import { type Server } from 'node:http';
 import { type LatServerApp } from '../../vendor/lat.md-server/index.js';
-import { type CmdContext } from '../context.js';
+import { type CmdContext } from '@plebeiantech/lat.md-core/context';
 import { type ViewSearch } from './search.js';
 import { type ViewStore } from './store.js';
 export declare const DEFAULT_VIEW_PORT = 4242;

package/dist/src/view/server.js

@@ -1,10 +1,11 @@
+import { trustedLiveRequest, RESOURCE_CONTENT_SECURITY_POLICY, } from './request-security.js';
 import { readFile } from 'node:fs/promises';
 import { randomUUID } from 'node:crypto';
 import { extname, join, relative, resolve, sep } from 'node:path';
 import { fileURLToPath } from 'node:url';
 import { createLatServerApp, listenLatServer, } from '../../vendor/lat.md-server/index.js';
-import { plainStyler } from '../context.js';
-import { sectionCommand } from '../cli/section.js';
+import { plainStyler, } from '@plebeiantech/lat.md-core/context';
+import { sectionCommand } from '@plebeiantech/lat.md-core/cli/section';
 import { DEFAULT_VIEW_LOGO_TEXT, } from './protocol.js';
 import { ViewDocumentConflictError } from './document-edit.js';
 import { ViewExternalNotFoundError, ViewDocumentNotFoundError, ViewSourceNotFoundError, } from './repository.js';
@@ -149,9 +150,13 @@ export async function createViewApp(ctx, options = {}) {
     heartbeat.unref();
     const handleRequest = (req, res) => {
         void (async () => {
+            if (!trustedLiveRequest(req, host)) {
+                send(res, 403, 'text/plain; charset=utf-8', 'Untrusted request origin or host');
+                return;
+            }
             const method = req.method ?? 'GET';
             const headOnly = method === 'HEAD';
-            const url = new URL(req.url ?? '/', `http://${host}`);
+            const url = new URL(req.url ?? '/', `http://${req.headers.host}`);
             const documentEdit = method === 'PATCH' && url.pathname === '/api/document';
             if (method !== 'GET' && !headOnly && !documentEdit) {
                 res.setHeader('Allow', 'GET, HEAD');
@@ -358,6 +363,11 @@ export async function createViewApp(ctx, options = {}) {
                 try {
                     const body = await store.getDocumentResource(resourcePath);
                     res.setHeader('Cache-Control', 'no-cache');
+                    res.setHeader('Content-Security-Policy', RESOURCE_CONTENT_SECURITY_POLICY);
+                    res.setHeader('Cross-Origin-Resource-Policy', 'same-origin');
+                    if (/\.(?:html?|xhtml|xml|[cm]?js)$/i.test(resourcePath)) {
+                        res.setHeader('Content-Disposition', 'attachment');
+                    }
                     send(res, 200, contentType(resourcePath), body, headOnly);
                 }
                 catch (error) {

package/dist/src/view/source-target.js

@@ -1,6 +1,6 @@
 import { extname } from 'node:path';
-import { normalizeRepositoryPath } from '../repository-path.js';
-import { isSourceFileExtension } from '../source-formats.js';
+import { normalizeRepositoryPath } from '@plebeiantech/lat.md-core/repository-path';
+import { isSourceFileExtension } from '@plebeiantech/lat.md-core/source-formats';
 import { rewriteDocumentLink } from './document-route.js';
 /** Resolve ordinary code links relative to their Markdown file, not the vault root. */
 export function rewriteLocalFileLink(value, sourcePath) {

package/dist/src/view/static-build.d.ts

@@ -1,5 +1,5 @@
 import { rename } from 'node:fs/promises';
-import type { CmdContext } from '../context.js';
+import type { CmdContext } from '@plebeiantech/lat.md-core/context';
 export type StaticViewBuildOptions = {
     basePath?: string;
     clientDir?: string;

package/dist/src/view/static-build.js

@@ -1,8 +1,9 @@
+import { createPublicationPolicy } from './publication.js';
 import { createHash } from 'node:crypto';
 import { cp, lstat, mkdir, mkdtemp, readFile, rename, rm, writeFile, } from 'node:fs/promises';
 import { dirname, join, parse, relative, resolve, sep } from 'node:path';
 import { fileURLToPath } from 'node:url';
-import { isDocumentPath } from '../document-formats.js';
+import { isDocumentPath } from '@plebeiantech/lat.md-core/document-formats';
 import { DEFAULT_VIEW_LOGO_TEXT } from './protocol.js';
 import { documentTreeUrls, rewriteDocumentTreeUrls } from './document-tree.js';
 import { VIEW_STATIC_BOOTSTRAP_ID, viewStaticDocumentRequest, viewStaticSourceKey, } from './static-protocol.js';
@@ -182,8 +183,14 @@ function positiveInteger(value) {
     return Number.isInteger(parsed) && parsed > 0 ? parsed : 0;
 }
 function sourceRequest(value) {
-    const url = new URL(decodeHtmlUrlAttribute(value), 'http://lat.local');
-    if (!url.pathname.startsWith('/code/'))
+    let url;
+    try {
+        url = new URL(decodeHtmlUrlAttribute(value), 'http://lat.local');
+    }
+    catch {
+        return null;
+    }
+    if (url.origin !== 'http://lat.local' || !url.pathname.startsWith('/code/'))
         return null;
     let path;
     let symbol;
@@ -193,6 +200,14 @@ function sourceRequest(value) {
             .split('/')
             .map(decodeURIComponent)
             .join('/');
+        if (path.split('/').some((part) => !part || part === '.' || part === '..') ||
+            path.includes('\\') ||
+            path.includes('\0') ||
+            /^[a-z]:/i.test(path))
+            return null;
+        // Encoded separators cannot create extra route components after decoding.
+        if (/%(?:2f|5c)/i.test(url.pathname))
+            return null;
         symbol = decodeURIComponent(url.hash.slice(1));
     }
     catch {
@@ -214,7 +229,8 @@ function externalRequest(value, external) {
     catch {
         return null;
     }
-    if (!url.pathname.startsWith('/external/'))
+    if (url.origin !== 'http://lat.local' ||
+        !url.pathname.startsWith('/external/'))
         return null;
     try {
         const parts = url.pathname
@@ -441,8 +457,24 @@ function redirectShell(target, basePath) {
 </html>
 `;
 }
+/** All authored route writes must remain strictly below the payload root. */
+function publicationOutputPath(root, ...parts) {
+    if (parts.some((part) => part.includes('\\') ||
+        part.includes('\0') ||
+        part.split('/').some((segment) => segment === '..' || segment === '.')))
+        throw new Error('Unsafe export route');
+    const path = resolve(root, ...parts);
+    const rel = relative(root, path);
+    if (!rel ||
+        rel.startsWith(`..${sep}`) ||
+        rel === '..' ||
+        /^[a-z]:/i.test(rel) ||
+        rel.startsWith(sep))
+        throw new Error('Export route is outside the output directory');
+    return path;
+}
 async function writeRouteShell(outputDir, route, shell) {
-    const path = join(outputDir, ...route.split('/'), 'index.html');
+    const path = publicationOutputPath(outputDir, route, 'index.html');
     await mkdir(dirname(path), { recursive: true });
     await writeFile(path, shell);
 }
@@ -455,14 +487,16 @@ export async function buildStaticView(ctx, requestedOutput, options = {}) {
     await validateViewBuildOutput(outputDir, ctx.projectRoot, 'Static', options.force);
     await mkdir(dirname(outputDir), { recursive: true });
     const stagingDir = await mkdtemp(join(dirname(outputDir), '.lat-static-staging-'));
-    const store = await createViewStore(ctx.latDir, ctx.projectRoot, {
-        codeExcludePaths: [outputDir, ...(options.codeExcludePaths ?? [])],
-        git: false,
-        watch: false,
-        externalIgnoreLocal: true,
-        externalCa: options.externalCa,
-    });
+    let store;
     try {
+        store = await createViewStore(ctx.latDir, ctx.projectRoot, {
+            codeExcludePaths: [outputDir, ...(options.codeExcludePaths ?? [])],
+            git: false,
+            watch: false,
+            externalIgnoreLocal: true,
+            externalCa: options.externalCa,
+            publishable: await createPublicationPolicy(ctx.projectRoot),
+        });
         const clientHtml = await readFile(join(clientDir, 'index.html'), 'utf8');
         const payloadDir = staticViewPayloadDir(stagingDir, basePath);
         await mkdir(payloadDir, { recursive: true });
@@ -523,11 +557,9 @@ export async function buildStaticView(ctx, requestedOutput, options = {}) {
             externals.set(target, external);
             const before = externalRequests.size;
             if (external.kind === 'markdown') {
-                sourceRequestsFromDocument(external.document, sourceRequests);
                 externalRequestsFromDocument(external.document, externalRequests, store.snapshot.external, external.document.path);
             }
             else {
-                sourceRequestsFromSource(external.source, sourceRequests);
                 externalRequestsFromSource(external.source, externalRequests, store.snapshot.external);
             }
             if (externalRequests.size > before) {
@@ -580,7 +612,7 @@ export async function buildStaticView(ctx, requestedOutput, options = {}) {
             const rewritten = rewriteDocument(document, basePath, index.entry, sectionPaths, documentPaths);
             manifest.documents[path] = await writeDataJson(payloadDir, 'documents', rewritten);
             const source = await store.getDocumentSource(path);
-            const rawPath = join(payloadDir, ...path.split('/'));
+            const rawPath = publicationOutputPath(payloadDir, path);
             await mkdir(dirname(rawPath), { recursive: true });
             await writeFile(rawPath, source.content);
             const route = path.slice(0, -'.md'.length);
@@ -597,7 +629,7 @@ export async function buildStaticView(ctx, requestedOutput, options = {}) {
             catch (error) {
                 throw new Error(`Could not export document resource ${path}: ${error.message}`);
             }
-            const outputPath = join(payloadDir, 'resources', ...path.split('/'));
+            const outputPath = publicationOutputPath(payloadDir, 'resources', path);
             await mkdir(dirname(outputPath), { recursive: true });
             await writeFile(outputPath, content);
         }
@@ -704,6 +736,6 @@ export async function buildStaticView(ctx, requestedOutput, options = {}) {
         throw error;
     }
     finally {
-        await store.close();
+        await store?.close();
     }
 }

package/dist/src/view/store.d.ts

@@ -1,5 +1,5 @@
-import { type ExternalResolver } from '../external-sources.js';
-import type { Section } from '../lattice-model.js';
+import { type ExternalResolver } from '@plebeiantech/lat.md-core/external-sources';
+import type { Section } from '@plebeiantech/lat.md-core/lattice-model';
 import { type ViewGitRepository, type ViewGitSnapshot } from './git.js';
 import type { ViewDocument, ViewDocumentEditResponse, ViewDocumentError, ViewDocumentSource, ViewExternalDocument, ViewGraph, ViewIndex, ViewProjectGeneration, ViewDocumentTree, ViewSourceDocument } from './protocol.js';
 import { type ViewCodeReferenceFile, type ViewParsedMarkdownFile, type ViewReferenceIndex } from './references.js';
@@ -16,6 +16,8 @@ export type ViewProjectSnapshot = {
     external: ExternalResolver;
 };
 export type ViewStoreOptions = {
+    /** Export-only allowlist, applied before source/backlink/resource reads. */
+    publishable?: (path: string) => Promise<boolean>;
     codeExcludePaths?: string[];
     debounceMs?: number;
     git?: boolean;