@usegraft/compiler 0.2.0 → 1.0.0-beta.1

package/README.md

@@ -41,4 +41,4 @@ Set `export const mdxTrust = "full"` in `graft.config.ts` to allow full MDX. Tha
 
 ---
 
-MIT. [Repository](https://github.com/AndersonDesign1/graft) · [Changelog](https://github.com/AndersonDesign1/graft/blob/feat/core/packages/compiler/CHANGELOG.md)
+MIT. [Repository](https://github.com/AndersonDesign1/graft) · [Changelog](https://github.com/AndersonDesign1/graft/blob/main/packages/compiler/CHANGELOG.md)

package/dist/index.d.ts

@@ -142,8 +142,18 @@ declare function resolveGitSha(cwd: string): string | null;
  * a Studio or MCP write served from one fails deep inside fs with an opaque
  * errno; authored content being files is the whole model, so the fix is to run
  * the writing surface where the checkout is writable.
+ *
+ * Takes a root and a relative path rather than a resolved one, and contains it
+ * here, because this sink previously trusted whatever path it was handed and
+ * `.greptile/rules.md` told reviewers that every sink in this package did its
+ * own containment. Studio resolved carefully; MCP's `write_content` did not,
+ * and a slug of `"../../escaped"` wrote outside the content tree — the exact
+ * bug the rule claimed was impossible. A guarantee that lives in each caller is
+ * one a new caller does not inherit.
+ *
+ * Returns the resolved path, so a caller that needs it does not re-derive it.
  */
-declare function writeDocumentFile(fullPath: string, raw: string): void;
+declare function writeDocumentFile(root: string, sourcePath: string, raw: string): string;
 /**
  * The bytes to write for a document.
  *

package/dist/index.js

@@ -310,10 +310,12 @@ import { dirname } from "path";
 import { GraftError as GraftError5 } from "@usegraft/contracts";
 import matter2 from "gray-matter";
 var READ_ONLY_CODES = /* @__PURE__ */ new Set(["EROFS", "EACCES", "EPERM"]);
-function writeDocumentFile(fullPath, raw) {
+function writeDocumentFile(root, sourcePath, raw) {
+  const fullPath = resolveContained(root, sourcePath, { label: "document" });
   try {
     mkdirSync(dirname(fullPath), { recursive: true });
     writeFileSync(fullPath, raw);
+    return fullPath;
   } catch (error) {
     const code = error.code ?? "";
     if (!READ_ONLY_CODES.has(code)) throw error;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@usegraft/compiler",
-  "version": "0.2.0",
+  "version": "1.0.0-beta.1",
   "description": "Validate authored MDX against your collections and project it into the content index.",
   "keywords": [
     "agent",
@@ -39,10 +39,10 @@
     "access": "public"
   },
   "dependencies": {
-    "@usegraft/contracts": "0.2.0",
-    "@usegraft/core": "0.2.0",
-    "@usegraft/db": "0.2.0",
-    "@usegraft/mdx-safety": "0.2.0",
+    "@usegraft/contracts": "1.0.0-beta.1",
+    "@usegraft/core": "1.0.0-beta.1",
+    "@usegraft/db": "1.0.0-beta.1",
+    "@usegraft/mdx-safety": "1.0.0-beta.1",
     "gray-matter": "^4.0.3"
   },
   "engines": {