@yourtechtribe-labs/koncept-core 0.2.0-alpha.6 → 0.2.0-alpha.7

package/dist/index.d.ts

@@ -19,6 +19,7 @@ export { runChecks } from './checker.js';
 export type { CheckOptions, CheckStatus, InvariantCheckResult, CheckResult, } from './checker.js';
 export { parseVerdict, reviewAffected, buildPrompt } from './review.js';
 export type { Verdict, InvariantReview, ReviewResult, ReviewOptions, } from './review.js';
+export { normalizeForward, resolveWithinRoot } from './paths.js';
 export { collectNamingCandidates, judgeCandidates, buildNamingPrompt, parseNamingVerdict, parseAddedLines, } from './lint-naming.js';
 export type { ScannedLine, ScannedFile, LintCandidate, LintCandidatesResult, LintFinding, NamingVerdict, } from './lint-naming.js';
 //# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAIA,OAAO,EAAE,OAAO,EAAE,MAAM,cAAc,CAAA;AAItC,OAAO,EACL,aAAa,EACb,gBAAgB,EAChB,QAAQ,EACR,eAAe,EACf,YAAY,EACZ,UAAU,EACV,oBAAoB,EACpB,yBAAyB,EACzB,YAAY,EACZ,YAAY,EACZ,aAAa,GACd,MAAM,aAAa,CAAA;AACpB,YAAY,EACV,OAAO,EACP,UAAU,EACV,WAAW,EACX,SAAS,EACT,aAAa,EACb,MAAM,EACN,IAAI,EACJ,WAAW,EACX,QAAQ,EACR,MAAM,EACN,cAAc,EACd,mBAAmB,EACnB,QAAQ,EACR,OAAO,GACR,MAAM,aAAa,CAAA;AAGpB,OAAO,EAAE,kBAAkB,EAAE,gBAAgB,EAAE,MAAM,aAAa,CAAA;AAClE,YAAY,EAAE,WAAW,EAAE,UAAU,EAAE,cAAc,EAAE,MAAM,aAAa,CAAA;AAG1E,OAAO,EAAE,aAAa,EAAE,UAAU,EAAE,YAAY,EAAE,MAAM,cAAc,CAAA;AACtE,YAAY,EACV,WAAW,EACX,eAAe,EACf,WAAW,EACX,iBAAiB,EACjB,WAAW,GACZ,MAAM,cAAc,CAAA;AAGrB,OAAO,EAAE,aAAa,EAAE,MAAM,aAAa,CAAA;AAC3C,YAAY,EAAE,SAAS,EAAE,UAAU,EAAE,MAAM,aAAa,CAAA;AAGxD,OAAO,EAAE,eAAe,EAAE,iBAAiB,EAAE,MAAM,eAAe,CAAA;AAClE,YAAY,EACV,cAAc,EACd,eAAe,EACf,iBAAiB,EACjB,WAAW,GACZ,MAAM,eAAe,CAAA;AAGtB,OAAO,EAAE,aAAa,EAAE,MAAM,EAAE,MAAM,eAAe,CAAA;AACrD,YAAY,EAAE,cAAc,EAAE,eAAe,EAAE,MAAM,eAAe,CAAA;AAGpE,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAA;AACjD,YAAY,EAAE,kBAAkB,EAAE,MAAM,oBAAoB,CAAA;AAG5D,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAA;AACjD,YAAY,EAAE,cAAc,EAAE,mBAAmB,EAAE,MAAM,oBAAoB,CAAA;AAG7E,OAAO,EAAE,SAAS,EAAE,MAAM,cAAc,CAAA;AACxC,YAAY,EACV,YAAY,EACZ,WAAW,EACX,oBAAoB,EACpB,WAAW,GACZ,MAAM,cAAc,CAAA;AAGrB,OAAO,EAAE,YAAY,EAAE,cAAc,EAAE,WAAW,EAAE,MAAM,aAAa,CAAA;AACvE,YAAY,EACV,OAAO,EACP,eAAe,EACf,YAAY,EACZ,aAAa,GACd,MAAM,aAAa,CAAA;AAGpB,OAAO,EACL,uBAAuB,EACvB,eAAe,EACf,iBAAiB,EACjB,kBAAkB,EAClB,eAAe,GAChB,MAAM,kBAAkB,CAAA;AACzB,YAAY,EACV,WAAW,EACX,WAAW,EACX,aAAa,EACb,oBAAoB,EACpB,WAAW,EACX,aAAa,GACd,MAAM,kBAAkB,CAAA"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAIA,OAAO,EAAE,OAAO,EAAE,MAAM,cAAc,CAAA;AAItC,OAAO,EACL,aAAa,EACb,gBAAgB,EAChB,QAAQ,EACR,eAAe,EACf,YAAY,EACZ,UAAU,EACV,oBAAoB,EACpB,yBAAyB,EACzB,YAAY,EACZ,YAAY,EACZ,aAAa,GACd,MAAM,aAAa,CAAA;AACpB,YAAY,EACV,OAAO,EACP,UAAU,EACV,WAAW,EACX,SAAS,EACT,aAAa,EACb,MAAM,EACN,IAAI,EACJ,WAAW,EACX,QAAQ,EACR,MAAM,EACN,cAAc,EACd,mBAAmB,EACnB,QAAQ,EACR,OAAO,GACR,MAAM,aAAa,CAAA;AAGpB,OAAO,EAAE,kBAAkB,EAAE,gBAAgB,EAAE,MAAM,aAAa,CAAA;AAClE,YAAY,EAAE,WAAW,EAAE,UAAU,EAAE,cAAc,EAAE,MAAM,aAAa,CAAA;AAG1E,OAAO,EAAE,aAAa,EAAE,UAAU,EAAE,YAAY,EAAE,MAAM,cAAc,CAAA;AACtE,YAAY,EACV,WAAW,EACX,eAAe,EACf,WAAW,EACX,iBAAiB,EACjB,WAAW,GACZ,MAAM,cAAc,CAAA;AAGrB,OAAO,EAAE,aAAa,EAAE,MAAM,aAAa,CAAA;AAC3C,YAAY,EAAE,SAAS,EAAE,UAAU,EAAE,MAAM,aAAa,CAAA;AAGxD,OAAO,EAAE,eAAe,EAAE,iBAAiB,EAAE,MAAM,eAAe,CAAA;AAClE,YAAY,EACV,cAAc,EACd,eAAe,EACf,iBAAiB,EACjB,WAAW,GACZ,MAAM,eAAe,CAAA;AAGtB,OAAO,EAAE,aAAa,EAAE,MAAM,EAAE,MAAM,eAAe,CAAA;AACrD,YAAY,EAAE,cAAc,EAAE,eAAe,EAAE,MAAM,eAAe,CAAA;AAGpE,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAA;AACjD,YAAY,EAAE,kBAAkB,EAAE,MAAM,oBAAoB,CAAA;AAG5D,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAA;AACjD,YAAY,EAAE,cAAc,EAAE,mBAAmB,EAAE,MAAM,oBAAoB,CAAA;AAG7E,OAAO,EAAE,SAAS,EAAE,MAAM,cAAc,CAAA;AACxC,YAAY,EACV,YAAY,EACZ,WAAW,EACX,oBAAoB,EACpB,WAAW,GACZ,MAAM,cAAc,CAAA;AAGrB,OAAO,EAAE,YAAY,EAAE,cAAc,EAAE,WAAW,EAAE,MAAM,aAAa,CAAA;AACvE,YAAY,EACV,OAAO,EACP,eAAe,EACf,YAAY,EACZ,aAAa,GACd,MAAM,aAAa,CAAA;AAGpB,OAAO,EAAE,gBAAgB,EAAE,iBAAiB,EAAE,MAAM,YAAY,CAAA;AAGhE,OAAO,EACL,uBAAuB,EACvB,eAAe,EACf,iBAAiB,EACjB,kBAAkB,EAClB,eAAe,GAChB,MAAM,kBAAkB,CAAA;AACzB,YAAY,EACV,WAAW,EACX,WAAW,EACX,aAAa,EACb,oBAAoB,EACpB,WAAW,EACX,aAAa,GACd,MAAM,kBAAkB,CAAA"}

package/dist/index.js

@@ -23,6 +23,8 @@ export { suggestLinks } from './suggest-links.js';
 export { runChecks } from './checker.js';
 // Review (LLM semantic reviewer — pure; llm + diff injected by the CLI)
 export { parseVerdict, reviewAffected, buildPrompt } from './review.js';
+// Paths (cross-platform helpers; resolveWithinRoot guards caller-supplied paths)
+export { normalizeForward, resolveWithinRoot } from './paths.js';
 // lint-naming (K4 — DR-1 enforcement; deterministic pre-filter + injected judge)
 export { collectNamingCandidates, judgeCandidates, buildNamingPrompt, parseNamingVerdict, parseAddedLines, } from './lint-naming.js';
 //# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,iDAAiD;AACjD,uEAAuE;AACvE,4CAA4C;AAE5C,OAAO,EAAE,OAAO,EAAE,MAAM,cAAc,CAAA;AAEtC,gFAAgF;AAChF,uDAAuD;AACvD,OAAO,EACL,aAAa,EACb,gBAAgB,EAChB,QAAQ,EACR,eAAe,EACf,YAAY,EACZ,UAAU,EACV,oBAAoB,EACpB,yBAAyB,EACzB,YAAY,EACZ,YAAY,EACZ,aAAa,GACd,MAAM,aAAa,CAAA;AAkBpB,SAAS;AACT,OAAO,EAAE,kBAAkB,EAAE,gBAAgB,EAAE,MAAM,aAAa,CAAA;AAGlE,UAAU;AACV,OAAO,EAAE,aAAa,EAAE,UAAU,EAAE,YAAY,EAAE,MAAM,cAAc,CAAA;AAStE,SAAS;AACT,OAAO,EAAE,aAAa,EAAE,MAAM,aAAa,CAAA;AAG3C,6BAA6B;AAC7B,OAAO,EAAE,eAAe,EAAE,iBAAiB,EAAE,MAAM,eAAe,CAAA;AAQlE,mDAAmD;AACnD,OAAO,EAAE,aAAa,EAAE,MAAM,EAAE,MAAM,eAAe,CAAA;AAGrD,0DAA0D;AAC1D,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAA;AAGjD,sBAAsB;AACtB,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAA;AAGjD,qCAAqC;AACrC,OAAO,EAAE,SAAS,EAAE,MAAM,cAAc,CAAA;AAQxC,wEAAwE;AACxE,OAAO,EAAE,YAAY,EAAE,cAAc,EAAE,WAAW,EAAE,MAAM,aAAa,CAAA;AAQvE,iFAAiF;AACjF,OAAO,EACL,uBAAuB,EACvB,eAAe,EACf,iBAAiB,EACjB,kBAAkB,EAClB,eAAe,GAChB,MAAM,kBAAkB,CAAA"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,iDAAiD;AACjD,uEAAuE;AACvE,4CAA4C;AAE5C,OAAO,EAAE,OAAO,EAAE,MAAM,cAAc,CAAA;AAEtC,gFAAgF;AAChF,uDAAuD;AACvD,OAAO,EACL,aAAa,EACb,gBAAgB,EAChB,QAAQ,EACR,eAAe,EACf,YAAY,EACZ,UAAU,EACV,oBAAoB,EACpB,yBAAyB,EACzB,YAAY,EACZ,YAAY,EACZ,aAAa,GACd,MAAM,aAAa,CAAA;AAkBpB,SAAS;AACT,OAAO,EAAE,kBAAkB,EAAE,gBAAgB,EAAE,MAAM,aAAa,CAAA;AAGlE,UAAU;AACV,OAAO,EAAE,aAAa,EAAE,UAAU,EAAE,YAAY,EAAE,MAAM,cAAc,CAAA;AAStE,SAAS;AACT,OAAO,EAAE,aAAa,EAAE,MAAM,aAAa,CAAA;AAG3C,6BAA6B;AAC7B,OAAO,EAAE,eAAe,EAAE,iBAAiB,EAAE,MAAM,eAAe,CAAA;AAQlE,mDAAmD;AACnD,OAAO,EAAE,aAAa,EAAE,MAAM,EAAE,MAAM,eAAe,CAAA;AAGrD,0DAA0D;AAC1D,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAA;AAGjD,sBAAsB;AACtB,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAA;AAGjD,qCAAqC;AACrC,OAAO,EAAE,SAAS,EAAE,MAAM,cAAc,CAAA;AAQxC,wEAAwE;AACxE,OAAO,EAAE,YAAY,EAAE,cAAc,EAAE,WAAW,EAAE,MAAM,aAAa,CAAA;AAQvE,iFAAiF;AACjF,OAAO,EAAE,gBAAgB,EAAE,iBAAiB,EAAE,MAAM,YAAY,CAAA;AAEhE,iFAAiF;AACjF,OAAO,EACL,uBAAuB,EACvB,eAAe,EACf,iBAAiB,EACjB,kBAAkB,EAClB,eAAe,GAChB,MAAM,kBAAkB,CAAA"}

package/dist/paths.d.ts

@@ -20,6 +20,16 @@ export declare function normalizeForward(p: string): string;
  * normalized absolute path.
  */
 export declare function resolveRelative(rootDir: string, relative: string): string;
+/**
+ * Resolve `relative` against `rootDir` and return the absolute path ONLY if it
+ * stays within `rootDir`. Returns `null` for path-traversal escapes (`../`) or
+ * absolute paths pointing outside the root.
+ *
+ * Guard for tools that read CALLER-supplied paths (e.g. the lint-naming MCP
+ * tool): a `../..` segment in `readFileSync(join(rootDir, file))` would escape
+ * the project. `resolve` collapses `..` first, then we check containment.
+ */
+export declare function resolveWithinRoot(rootDir: string, relative: string): string | null;
 /**
  * Cross-platform basename. Stripped of extension if `stripExt` is true.
  */

package/dist/paths.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"paths.d.ts","sourceRoot":"","sources":["../src/paths.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAIH;;;;;;;;GAQG;AACH,wBAAgB,gBAAgB,CAAC,CAAC,EAAE,MAAM,GAAG,MAAM,CAGlD;AAED;;;GAGG;AACH,wBAAgB,eAAe,CAAC,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,MAAM,CAGzE;AAED;;GAEG;AACH,wBAAgB,QAAQ,CAAC,CAAC,EAAE,MAAM,EAAE,QAAQ,UAAQ,GAAG,MAAM,CAK5D"}
+{"version":3,"file":"paths.d.ts","sourceRoot":"","sources":["../src/paths.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAIH;;;;;;;;GAQG;AACH,wBAAgB,gBAAgB,CAAC,CAAC,EAAE,MAAM,GAAG,MAAM,CAGlD;AAED;;;GAGG;AACH,wBAAgB,eAAe,CAAC,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,MAAM,CAGzE;AAED;;;;;;;;GAQG;AACH,wBAAgB,iBAAiB,CAAC,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAIlF;AAED;;GAEG;AACH,wBAAgB,QAAQ,CAAC,CAAC,EAAE,MAAM,EAAE,QAAQ,UAAQ,GAAG,MAAM,CAK5D"}

package/dist/paths.js

@@ -5,7 +5,7 @@
  * (Unix-style). On Windows the filesystem returns backslashes; we normalize
  * everywhere we read/write paths so equality + globs are consistent.
  */
-import { resolve, basename as nodeBasename, isAbsolute } from 'node:path';
+import { resolve, basename as nodeBasename, isAbsolute, sep } from 'node:path';
 /**
  * Convert all backslashes to forward slashes and strip the Windows
  * extended-length path prefix (`\\?\` → empty).
@@ -27,6 +27,20 @@ export function resolveRelative(rootDir, relative) {
     const absolute = isAbsolute(relative) ? relative : resolve(rootDir, relative);
     return normalizeForward(absolute);
 }
+/**
+ * Resolve `relative` against `rootDir` and return the absolute path ONLY if it
+ * stays within `rootDir`. Returns `null` for path-traversal escapes (`../`) or
+ * absolute paths pointing outside the root.
+ *
+ * Guard for tools that read CALLER-supplied paths (e.g. the lint-naming MCP
+ * tool): a `../..` segment in `readFileSync(join(rootDir, file))` would escape
+ * the project. `resolve` collapses `..` first, then we check containment.
+ */
+export function resolveWithinRoot(rootDir, relative) {
+    const root = resolve(rootDir);
+    const abs = resolve(root, relative);
+    return abs === root || abs.startsWith(root + sep) ? abs : null;
+}
 /**
  * Cross-platform basename. Stripped of extension if `stripExt` is true.
  */

package/dist/paths.js.map

@@ -1 +1 @@
-{"version":3,"file":"paths.js","sourceRoot":"","sources":["../src/paths.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,EAAE,OAAO,EAAE,QAAQ,IAAI,YAAY,EAAE,UAAU,EAAE,MAAM,WAAW,CAAA;AAEzE;;;;;;;;GAQG;AACH,MAAM,UAAU,gBAAgB,CAAC,CAAS;IACxC,MAAM,OAAO,GAAG,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAA;IACrC,OAAO,OAAO,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAA;AAChE,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,eAAe,CAAC,OAAe,EAAE,QAAgB;IAC/D,MAAM,QAAQ,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAA;IAC7E,OAAO,gBAAgB,CAAC,QAAQ,CAAC,CAAA;AACnC,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,QAAQ,CAAC,CAAS,EAAE,QAAQ,GAAG,KAAK;IAClD,MAAM,IAAI,GAAG,YAAY,CAAC,gBAAgB,CAAC,CAAC,CAAC,CAAC,CAAA;IAC9C,IAAI,CAAC,QAAQ;QAAE,OAAO,IAAI,CAAA;IAC1B,MAAM,GAAG,GAAG,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,CAAA;IACjC,OAAO,GAAG,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAA;AAC5C,CAAC"}
+{"version":3,"file":"paths.js","sourceRoot":"","sources":["../src/paths.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,EAAE,OAAO,EAAE,QAAQ,IAAI,YAAY,EAAE,UAAU,EAAE,GAAG,EAAE,MAAM,WAAW,CAAA;AAE9E;;;;;;;;GAQG;AACH,MAAM,UAAU,gBAAgB,CAAC,CAAS;IACxC,MAAM,OAAO,GAAG,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAA;IACrC,OAAO,OAAO,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAA;AAChE,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,eAAe,CAAC,OAAe,EAAE,QAAgB;IAC/D,MAAM,QAAQ,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAA;IAC7E,OAAO,gBAAgB,CAAC,QAAQ,CAAC,CAAA;AACnC,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,iBAAiB,CAAC,OAAe,EAAE,QAAgB;IACjE,MAAM,IAAI,GAAG,OAAO,CAAC,OAAO,CAAC,CAAA;IAC7B,MAAM,GAAG,GAAG,OAAO,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAA;IACnC,OAAO,GAAG,KAAK,IAAI,IAAI,GAAG,CAAC,UAAU,CAAC,IAAI,GAAG,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAA;AAChE,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,QAAQ,CAAC,CAAS,EAAE,QAAQ,GAAG,KAAK;IAClD,MAAM,IAAI,GAAG,YAAY,CAAC,gBAAgB,CAAC,CAAC,CAAC,CAAC,CAAA;IAC9C,IAAI,CAAC,QAAQ;QAAE,OAAO,IAAI,CAAA;IAC1B,MAAM,GAAG,GAAG,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,CAAA;IACjC,OAAO,GAAG,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAA;AAC5C,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@yourtechtribe-labs/koncept-core",
-  "version": "0.2.0-alpha.6",
+  "version": "0.2.0-alpha.7",
   "description": "Core schema, parser, and indexer for koncepto semantic concept graphs.",
   "keywords": [
     "yaml",