@the-40-thieves/obsidian-tc-native 1.3.4 → 1.3.5

package/index.d.ts

@@ -16,6 +16,15 @@ export declare function bm25Score(
   docCount: number,
 ): number;
 
+/** THE-272: symlink-safe, TOCTOU-free note read — opens following no symlink in any path component,
+ *  rejects a non-regular or hard-linked file, returns the bytes. Present only on the native module
+ *  (undefined on the pure-JS fallback). */
+export declare function safeReadNote(abs: string): Buffer;
+
+/** THE-272: symlink-safe atomic note write (randomized O_EXCL|O_NOFOLLOW temp + rename, no symlink
+ *  followed in any component). The parent directory must exist. Native module only. */
+export declare function safeWriteNoteAtomic(abs: string, data: Buffer): void;
+
 /** True when the compiled native binary is active; false when on the pure-JS fallback. */
 export declare const nativeLoaded: boolean;
 

package/index.js

@@ -140,6 +140,11 @@ module.exports.nativeLoaded = native !== null;
 module.exports.cosineSimilarity = impl.cosineSimilarity;
 module.exports.tokenize = impl.tokenize;
 module.exports.bm25Score = impl.bm25Score;
+// THE-272: symlink-safe, TOCTOU-free vault I/O. Present only when the compiled native module is
+// loaded; on the pure-JS fallback these are undefined and the server's vault layer keeps its own
+// JS read/write path.
+module.exports.safeReadNote = impl.safeReadNote;
+module.exports.safeWriteNoteAtomic = impl.safeWriteNoteAtomic;
 // Exported for the loader unit test (packages/server/test/native-triple.test.ts).
 module.exports.hostTriple = hostTriple;
 module.exports.isMusl = isMusl;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@the-40-thieves/obsidian-tc-native",
-  "version": "1.3.4",
+  "version": "1.3.5",
   "description": "Native perf module for obsidian-tc — vector ops, BM25, sqlite-vec, V2 clustering hooks",
   "license": "AGPL-3.0-only",
   "publishConfig": {
@@ -53,13 +53,13 @@
     "./package.json": "./package.json"
   },
   "optionalDependencies": {
-    "@the-40-thieves/obsidian-tc-native-linux-x64-gnu": "1.3.4",
-    "@the-40-thieves/obsidian-tc-native-linux-arm64-gnu": "1.3.4",
-    "@the-40-thieves/obsidian-tc-native-linux-x64-musl": "1.3.4",
-    "@the-40-thieves/obsidian-tc-native-linux-arm64-musl": "1.3.4",
-    "@the-40-thieves/obsidian-tc-native-darwin-x64": "1.3.4",
-    "@the-40-thieves/obsidian-tc-native-darwin-arm64": "1.3.4",
-    "@the-40-thieves/obsidian-tc-native-win32-x64-msvc": "1.3.4",
-    "@the-40-thieves/obsidian-tc-native-win32-arm64-msvc": "1.3.4"
+    "@the-40-thieves/obsidian-tc-native-linux-x64-gnu": "1.3.5",
+    "@the-40-thieves/obsidian-tc-native-linux-arm64-gnu": "1.3.5",
+    "@the-40-thieves/obsidian-tc-native-linux-x64-musl": "1.3.5",
+    "@the-40-thieves/obsidian-tc-native-linux-arm64-musl": "1.3.5",
+    "@the-40-thieves/obsidian-tc-native-darwin-x64": "1.3.5",
+    "@the-40-thieves/obsidian-tc-native-darwin-arm64": "1.3.5",
+    "@the-40-thieves/obsidian-tc-native-win32-x64-msvc": "1.3.5",
+    "@the-40-thieves/obsidian-tc-native-win32-arm64-msvc": "1.3.5"
   }
 }