@the-40-thieves/obsidian-tc-shared 0.0.1 → 1.0.1

package/dist/result.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"result.js","sourceRoot":"","sources":["../src/result.ts"],"names":[],"mappings":""}

package/dist/schemas/primitives.d.ts

@@ -0,0 +1,37 @@
+import { z } from "zod";
+/** Vault registry id: lowercase slug. */
+export declare const VaultId: z.ZodString;
+/**
+ * Vault-relative path. Rejects absolute paths (POSIX and Windows drive paths)
+ * and any ".." segment. Backslashes are tolerated on input and normalized by
+ * the resolver; the byte-level guard stays conservative per G2.1.
+ */
+export declare const VaultPath: z.ZodEffects<z.ZodEffects<z.ZodString, string, string>, string, string>;
+/** 32-char hex HITL elicit token (matches issueElicitToken: randomBytes(16).hex). */
+export declare const ElicitToken: z.ZodString;
+/** Cursor pagination inputs (G2.1 convention). */
+export declare const Pagination: z.ZodObject<{
+    limit: z.ZodOptional<z.ZodNumber>;
+    cursor: z.ZodOptional<z.ZodString>;
+}, "strip", z.ZodTypeAny, {
+    limit?: number | undefined;
+    cursor?: string | undefined;
+}, {
+    limit?: number | undefined;
+    cursor?: string | undefined;
+}>;
+export type PaginationInput = z.infer<typeof Pagination>;
+/** Shared write options. `idempotency_key` is accepted as a forward-compat
+ *  surface in M1 (replay lands with the Policy layer in a later milestone). */
+export declare const WriteOptions: z.ZodObject<{
+    idempotency_key: z.ZodOptional<z.ZodString>;
+    create_dirs: z.ZodDefault<z.ZodBoolean>;
+}, "strip", z.ZodTypeAny, {
+    create_dirs: boolean;
+    idempotency_key?: string | undefined;
+}, {
+    idempotency_key?: string | undefined;
+    create_dirs?: boolean | undefined;
+}>;
+export type WriteOptionsInput = z.infer<typeof WriteOptions>;
+//# sourceMappingURL=primitives.d.ts.map

package/dist/schemas/primitives.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"primitives.d.ts","sourceRoot":"","sources":["../../src/schemas/primitives.ts"],"names":[],"mappings":"AAIA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,yCAAyC;AACzC,eAAO,MAAM,OAAO,aAI0C,CAAC;AAE/D;;;;GAIG;AACH,eAAO,MAAM,SAAS,yEAQnB,CAAC;AAEJ,qFAAqF;AACrF,eAAO,MAAM,WAAW,aAA+D,CAAC;AAExF,kDAAkD;AAClD,eAAO,MAAM,UAAU;;;;;;;;;EAGrB,CAAC;AACH,MAAM,MAAM,eAAe,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,UAAU,CAAC,CAAC;AAEzD;+EAC+E;AAC/E,eAAO,MAAM,YAAY;;;;;;;;;EAGvB,CAAC;AACH,MAAM,MAAM,iBAAiB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,YAAY,CAAC,CAAC"}

package/dist/schemas/primitives.js

@@ -0,0 +1,36 @@
+// Shared Zod primitives for the tool surface (G2.1 "Standard primitives").
+// Reused across every vault-touching tool so path-safety and pagination are
+// uniform. The traversal guard here is defense-in-depth; the filesystem
+// resolver (packages/server/src/vault/paths.ts) re-checks real-path containment.
+import { z } from "zod";
+/** Vault registry id: lowercase slug. */
+export const VaultId = z
+    .string()
+    .min(1)
+    .max(64)
+    .regex(/^[a-z0-9_-]+$/, "vault id must be a lowercase slug");
+/**
+ * Vault-relative path. Rejects absolute paths (POSIX and Windows drive paths)
+ * and any ".." segment. Backslashes are tolerated on input and normalized by
+ * the resolver; the byte-level guard stays conservative per G2.1.
+ */
+export const VaultPath = z
+    .string()
+    .min(1)
+    .max(1024)
+    .refine((p) => !p.includes(".."), "path traversal rejected")
+    .refine((p) => !p.startsWith("/") && !p.startsWith("\\") && !/^[A-Za-z]:[\\/]/.test(p), "absolute paths rejected");
+/** 32-char hex HITL elicit token (matches issueElicitToken: randomBytes(16).hex). */
+export const ElicitToken = z.string().regex(/^[a-f0-9]{32}$/, "malformed elicit token");
+/** Cursor pagination inputs (G2.1 convention). */
+export const Pagination = z.object({
+    limit: z.number().int().positive().max(1000).optional(),
+    cursor: z.string().optional(),
+});
+/** Shared write options. `idempotency_key` is accepted as a forward-compat
+ *  surface in M1 (replay lands with the Policy layer in a later milestone). */
+export const WriteOptions = z.object({
+    idempotency_key: z.string().min(1).max(128).optional(),
+    create_dirs: z.boolean().default(true),
+});
+//# sourceMappingURL=primitives.js.map

package/dist/schemas/primitives.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"primitives.js","sourceRoot":"","sources":["../../src/schemas/primitives.ts"],"names":[],"mappings":"AAAA,2EAA2E;AAC3E,4EAA4E;AAC5E,wEAAwE;AACxE,iFAAiF;AACjF,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,yCAAyC;AACzC,MAAM,CAAC,MAAM,OAAO,GAAG,CAAC;KACrB,MAAM,EAAE;KACR,GAAG,CAAC,CAAC,CAAC;KACN,GAAG,CAAC,EAAE,CAAC;KACP,KAAK,CAAC,eAAe,EAAE,mCAAmC,CAAC,CAAC;AAE/D;;;;GAIG;AACH,MAAM,CAAC,MAAM,SAAS,GAAG,CAAC;KACvB,MAAM,EAAE;KACR,GAAG,CAAC,CAAC,CAAC;KACN,GAAG,CAAC,IAAI,CAAC;KACT,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,yBAAyB,CAAC;KAC3D,MAAM,CACL,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,iBAAiB,CAAC,IAAI,CAAC,CAAC,CAAC,EAC9E,yBAAyB,CAC1B,CAAC;AAEJ,qFAAqF;AACrF,MAAM,CAAC,MAAM,WAAW,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,gBAAgB,EAAE,wBAAwB,CAAC,CAAC;AAExF,kDAAkD;AAClD,MAAM,CAAC,MAAM,UAAU,GAAG,CAAC,CAAC,MAAM,CAAC;IACjC,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE;IACvD,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;CAC9B,CAAC,CAAC;AAGH;+EAC+E;AAC/E,MAAM,CAAC,MAAM,YAAY,GAAG,CAAC,CAAC,MAAM,CAAC;IACnC,eAAe,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE;IACtD,WAAW,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC;CACvC,CAAC,CAAC"}

package/dist/scopes.d.ts

@@ -0,0 +1,16 @@
+export declare const SCOPE_FAMILIES: readonly ["read", "write", "delete", "execute", "admin", "bulk"];
+export type ScopeFamily = (typeof SCOPE_FAMILIES)[number];
+export type Scope = string;
+export declare const HITL_FLOOR_SCOPES: ReadonlySet<Scope>;
+export declare const HITL_FLOOR_FAMILIES: readonly string[];
+export declare function parseScope(s: Scope): {
+    family: string;
+    resource: string;
+};
+export declare function grantsScope(granted: Iterable<Scope>, required: Scope): boolean;
+export declare function grantsAll(granted: Iterable<Scope>, required: readonly Scope[]): boolean;
+export declare function scopeRequiresHitl(scope: Scope): boolean;
+export declare const MUTATING_FAMILIES: readonly string[];
+export declare function isMutatingScope(scope: Scope): boolean;
+export declare function scopeClassOf(requiredScopes: readonly Scope[]): string;
+//# sourceMappingURL=scopes.d.ts.map

package/dist/scopes.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"scopes.d.ts","sourceRoot":"","sources":["../src/scopes.ts"],"names":[],"mappings":"AAAA,eAAO,MAAM,cAAc,kEAAmE,CAAC;AAC/F,MAAM,MAAM,WAAW,GAAG,CAAC,OAAO,cAAc,CAAC,CAAC,MAAM,CAAC,CAAC;AAC1D,MAAM,MAAM,KAAK,GAAG,MAAM,CAAC;AAG3B,eAAO,MAAM,iBAAiB,EAAE,WAAW,CAAC,KAAK,CAG/C,CAAC;AAGH,eAAO,MAAM,mBAAmB,EAAE,SAAS,MAAM,EAAwB,CAAC;AAE1E,wBAAgB,UAAU,CAAC,CAAC,EAAE,KAAK,GAAG;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAA;CAAE,CAKzE;AAGD,wBAAgB,WAAW,CAAC,OAAO,EAAE,QAAQ,CAAC,KAAK,CAAC,EAAE,QAAQ,EAAE,KAAK,GAAG,OAAO,CAS9E;AAGD,wBAAgB,SAAS,CAAC,OAAO,EAAE,QAAQ,CAAC,KAAK,CAAC,EAAE,QAAQ,EAAE,SAAS,KAAK,EAAE,GAAG,OAAO,CAGvF;AAED,wBAAgB,iBAAiB,CAAC,KAAK,EAAE,KAAK,GAAG,OAAO,CAGvD;AAGD,eAAO,MAAM,iBAAiB,EAAE,SAAS,MAAM,EAA2C,CAAC;AAE3F,wBAAgB,eAAe,CAAC,KAAK,EAAE,KAAK,GAAG,OAAO,CAErD;AAUD,wBAAgB,YAAY,CAAC,cAAc,EAAE,SAAS,KAAK,EAAE,GAAG,MAAM,CAIrE"}

package/dist/scopes.js

@@ -0,0 +1,60 @@
+export const SCOPE_FAMILIES = ["read", "write", "delete", "execute", "admin", "bulk"];
+// Scopes that always require a HITL elicit confirmation (G2.4 A.3 hardcoded floors).
+export const HITL_FLOOR_SCOPES = new Set([
+    "admin:auth",
+    "write:templater",
+]);
+// Families where every member is a HITL floor.
+export const HITL_FLOOR_FAMILIES = ["execute", "bulk"];
+export function parseScope(s) {
+    if (s === "*")
+        return { family: "*", resource: "*" };
+    const i = s.indexOf(":");
+    if (i < 0)
+        return { family: s, resource: "*" };
+    return { family: s.slice(0, i), resource: s.slice(i + 1) };
+}
+// Does the granted set satisfy one required scope, honoring family/global wildcards?
+export function grantsScope(granted, required) {
+    const req = parseScope(required);
+    for (const g of granted) {
+        if (g === "*")
+            return true;
+        const gp = parseScope(g);
+        if (gp.family !== "*" && gp.family !== req.family)
+            continue;
+        if (gp.resource === "*" || gp.resource === req.resource)
+            return true;
+    }
+    return false;
+}
+// AND across all required scopes.
+export function grantsAll(granted, required) {
+    const set = granted instanceof Set ? granted : new Set(granted);
+    return required.every((r) => grantsScope(set, r));
+}
+export function scopeRequiresHitl(scope) {
+    if (HITL_FLOOR_SCOPES.has(scope))
+        return true;
+    return HITL_FLOOR_FAMILIES.includes(parseScope(scope).family);
+}
+// Scope families that mutate the vault; denied when an ACL is read-only.
+export const MUTATING_FAMILIES = ["write", "delete", "bulk", "execute"];
+export function isMutatingScope(scope) {
+    return MUTATING_FAMILIES.includes(parseScope(scope).family);
+}
+// Scope-class precedence for the dispatch rate-limiter gate (THE-210) and the `scope_class`
+// metric label (G2.4). A tool's governing class is the most operationally significant family
+// among its required scopes: a bulk_* tool (write:notes + bulk:notes) is governed by `bulk`,
+// an execute tool by `execute`, an admin tool by `admin`, and so on. Tools whose families
+// carry no throttle tier (e.g. a delete-only tool) resolve to their first declared family and
+// are treated as unlimited by the limiter (an unknown tier is never throttled).
+const SCOPE_CLASS_PRECEDENCE = ["bulk", "execute", "admin", "write", "read"];
+export function scopeClassOf(requiredScopes) {
+    const families = new Set(requiredScopes.map((s) => parseScope(s).family));
+    for (const cls of SCOPE_CLASS_PRECEDENCE)
+        if (families.has(cls))
+            return cls;
+    return requiredScopes[0] ? parseScope(requiredScopes[0]).family : "unknown";
+}
+//# sourceMappingURL=scopes.js.map

package/dist/scopes.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"scopes.js","sourceRoot":"","sources":["../src/scopes.ts"],"names":[],"mappings":"AAAA,MAAM,CAAC,MAAM,cAAc,GAAG,CAAC,MAAM,EAAE,OAAO,EAAE,QAAQ,EAAE,SAAS,EAAE,OAAO,EAAE,MAAM,CAAU,CAAC;AAI/F,qFAAqF;AACrF,MAAM,CAAC,MAAM,iBAAiB,GAAuB,IAAI,GAAG,CAAQ;IAClE,YAAY;IACZ,iBAAiB;CAClB,CAAC,CAAC;AAEH,+CAA+C;AAC/C,MAAM,CAAC,MAAM,mBAAmB,GAAsB,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC;AAE1E,MAAM,UAAU,UAAU,CAAC,CAAQ;IACjC,IAAI,CAAC,KAAK,GAAG;QAAE,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,QAAQ,EAAE,GAAG,EAAE,CAAC;IACrD,MAAM,CAAC,GAAG,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IACzB,IAAI,CAAC,GAAG,CAAC;QAAE,OAAO,EAAE,MAAM,EAAE,CAAC,EAAE,QAAQ,EAAE,GAAG,EAAE,CAAC;IAC/C,OAAO,EAAE,MAAM,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC;AAC7D,CAAC;AAED,qFAAqF;AACrF,MAAM,UAAU,WAAW,CAAC,OAAwB,EAAE,QAAe;IACnE,MAAM,GAAG,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC;IACjC,KAAK,MAAM,CAAC,IAAI,OAAO,EAAE,CAAC;QACxB,IAAI,CAAC,KAAK,GAAG;YAAE,OAAO,IAAI,CAAC;QAC3B,MAAM,EAAE,GAAG,UAAU,CAAC,CAAC,CAAC,CAAC;QACzB,IAAI,EAAE,CAAC,MAAM,KAAK,GAAG,IAAI,EAAE,CAAC,MAAM,KAAK,GAAG,CAAC,MAAM;YAAE,SAAS;QAC5D,IAAI,EAAE,CAAC,QAAQ,KAAK,GAAG,IAAI,EAAE,CAAC,QAAQ,KAAK,GAAG,CAAC,QAAQ;YAAE,OAAO,IAAI,CAAC;IACvE,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,kCAAkC;AAClC,MAAM,UAAU,SAAS,CAAC,OAAwB,EAAE,QAA0B;IAC5E,MAAM,GAAG,GAAG,OAAO,YAAY,GAAG,CAAC,CAAC,CAAE,OAAsB,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC,OAAO,CAAC,CAAC;IAChF,OAAO,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,WAAW,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC;AACpD,CAAC;AAED,MAAM,UAAU,iBAAiB,CAAC,KAAY;IAC5C,IAAI,iBAAiB,CAAC,GAAG,CAAC,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IAC9C,OAAO,mBAAmB,CAAC,QAAQ,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,CAAC;AAChE,CAAC;AAED,yEAAyE;AACzE,MAAM,CAAC,MAAM,iBAAiB,GAAsB,CAAC,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,SAAS,CAAC,CAAC;AAE3F,MAAM,UAAU,eAAe,CAAC,KAAY;IAC1C,OAAO,iBAAiB,CAAC,QAAQ,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,CAAC;AAC9D,CAAC;AAED,4FAA4F;AAC5F,6FAA6F;AAC7F,6FAA6F;AAC7F,0FAA0F;AAC1F,8FAA8F;AAC9F,gFAAgF;AAChF,MAAM,sBAAsB,GAAG,CAAC,MAAM,EAAE,SAAS,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,CAAU,CAAC;AAEtF,MAAM,UAAU,YAAY,CAAC,cAAgC;IAC3D,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,cAAc,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC;IAC1E,KAAK,MAAM,GAAG,IAAI,sBAAsB;QAAE,IAAI,QAAQ,CAAC,GAAG,CAAC,GAAG,CAAC;YAAE,OAAO,GAAG,CAAC;IAC5E,OAAO,cAAc,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,cAAc,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC;AAC9E,CAAC"}

package/package.json

@@ -1,18 +1,34 @@
 {
   "name": "@the-40-thieves/obsidian-tc-shared",
-  "version": "0.0.1",
-  "description": "Reserved. Shared TypeScript types and Zod schemas for obsidian-tc. v1.0 ships Q3 2026.",
+  "version": "1.0.1",
+  "description": "Shared Zod schemas and types for obsidian-tc",
   "license": "Apache-2.0",
-  "author": "Suavecito (Mohammed Islam)",
-  "homepage": "https://github.com/suavecito585/obsidian-tc",
+  "type": "module",
+  "main": "./dist/index.js",
+  "types": "./dist/index.d.ts",
+  "files": ["dist", "README.md", "LICENSE"],
+  "scripts": {
+    "build": "tsc",
+    "typecheck": "tsc --noEmit",
+    "test": "vitest run --passWithNoTests"
+  },
+  "dependencies": {
+    "zod": "^3.23.0"
+  },
+  "devDependencies": {
+    "typescript": "^5.7.0",
+    "vitest": "^2.1.0"
+  },
   "repository": {
     "type": "git",
-    "url": "git+https://github.com/suavecito585/obsidian-tc.git"
-  },
-  "bugs": {
-    "url": "https://github.com/suavecito585/obsidian-tc/issues"
+    "url": "https://github.com/The-40-Thieves/obsidian-tc.git",
+    "directory": "packages/shared"
   },
-  "keywords": ["obsidian", "mcp", "model-context-protocol", "ai", "knowledge-management", "second-brain"],
-  "publishConfig": { "access": "public" },
-  "private": false
+  "exports": {
+    ".": {
+      "types": "./dist/index.d.ts",
+      "import": "./dist/index.js"
+    },
+    "./package.json": "./package.json"
+  }
 }