datanotes 2.0.0 → 2.0.1

package/SECURITY.md

@@ -2,8 +2,8 @@
 
 ## Reporting a vulnerability
 
-Please report vulnerabilities privately, through GitHub's **Report a vulnerability** button on this
-repository (Security → Advisories), not in a public issue. You will get an answer within a week.
+Please report vulnerabilities privately, by email to the maintainer listed on the npm package
+page ([npmjs.com/package/datanotes](https://www.npmjs.com/package/datanotes)), not in public. You will get an answer within a week.
 Include the version, how to reproduce it and what an attacker gains.
 
 ## Security model

package/dist/api/index.cjs

@@ -7649,7 +7649,7 @@ var OPERATIONS = [
   },
   {
     "name": "infer_table",
-    "description": "Read-only schema inference from notes' frontmatter.\n- `folder` (recursive; \"\" = whole vault) and/or `paths`: notes not yet in a table. Returns\n  `columns` (type, enum `values`, link `ref` to the table most targets belong to, `required`,\n  `unique`, `dense`, `from` when the property name is not a valid column name, `stats`),\n  `proposal` ready for create_table (`name`, `options.filename` or `timeColumn`, `columns`) and\n  `adopt` ready for adopt_rows (`paths`, `rename`, `relocate: false`), plus `notes` to read.\n  Review the proposal (names, enums, required) before creating; ask the user when unsure.\n- `table`: keys the table's rows use but the table does not declare (candidates for add_column,\n  or keys to drop from rows).\nA string column becomes an enum with at most `max_enum_values` distinct values (default 12).",
+    "description": "Read-only schema inference from notes' frontmatter.\n- `folder` (recursive; \"\" = whole vault) and/or `paths`: notes not yet in a table. Returns\n  `columns` (type, enum `values`, link `ref` to the table most targets belong to, `required`,\n  `unique`, `dense`, `from` when the property name is not a valid column name, `stats`),\n  `proposal` ready for create_table (`name`, `options.filename` or `timeColumn`, `columns`) and\n  `adopt` ready for adopt_rows (`paths`, `rename`, `relocate: false`), plus `notes` to read.\n  Review the proposal (names, enums, required) before creating; ask the user when unsure.\n- `table`: keys the table's rows use but the table does not declare (candidates for add_column,\n  or keys to drop from rows).\nA string column becomes an enum when its values repeat: at least 3 notes, at most `max_enum_values`\ndistinct values (default 12), each used twice on average, short texts.",
     "inputSchema": {
       "additionalProperties": false,
       "properties": {
@@ -12331,7 +12331,7 @@ function describeRefusal(data) {
   const op = data.op ?? "operation";
   const failed = (data.failed ?? []).length > 0;
   let head = failed ? `${op} failed` : `${op} refused \u2014 nothing was written`;
-  if (data.migrationId) head += ` (journal ${String(data.migrationId)}; use undo_migration to revert what was applied)`;
+  if (failed && data.migrationId) head += ` (journal ${String(data.migrationId)}; use undo_migration to revert what was applied)`;
   return head + (shown.length ? `:
 ${shown.join("\n")}` : "");
 }

package/dist/api/index.js

@@ -7607,7 +7607,7 @@ var OPERATIONS = [
   },
   {
     "name": "infer_table",
-    "description": "Read-only schema inference from notes' frontmatter.\n- `folder` (recursive; \"\" = whole vault) and/or `paths`: notes not yet in a table. Returns\n  `columns` (type, enum `values`, link `ref` to the table most targets belong to, `required`,\n  `unique`, `dense`, `from` when the property name is not a valid column name, `stats`),\n  `proposal` ready for create_table (`name`, `options.filename` or `timeColumn`, `columns`) and\n  `adopt` ready for adopt_rows (`paths`, `rename`, `relocate: false`), plus `notes` to read.\n  Review the proposal (names, enums, required) before creating; ask the user when unsure.\n- `table`: keys the table's rows use but the table does not declare (candidates for add_column,\n  or keys to drop from rows).\nA string column becomes an enum with at most `max_enum_values` distinct values (default 12).",
+    "description": "Read-only schema inference from notes' frontmatter.\n- `folder` (recursive; \"\" = whole vault) and/or `paths`: notes not yet in a table. Returns\n  `columns` (type, enum `values`, link `ref` to the table most targets belong to, `required`,\n  `unique`, `dense`, `from` when the property name is not a valid column name, `stats`),\n  `proposal` ready for create_table (`name`, `options.filename` or `timeColumn`, `columns`) and\n  `adopt` ready for adopt_rows (`paths`, `rename`, `relocate: false`), plus `notes` to read.\n  Review the proposal (names, enums, required) before creating; ask the user when unsure.\n- `table`: keys the table's rows use but the table does not declare (candidates for add_column,\n  or keys to drop from rows).\nA string column becomes an enum when its values repeat: at least 3 notes, at most `max_enum_values`\ndistinct values (default 12), each used twice on average, short texts.",
     "inputSchema": {
       "additionalProperties": false,
       "properties": {
@@ -12289,7 +12289,7 @@ function describeRefusal(data) {
   const op = data.op ?? "operation";
   const failed = (data.failed ?? []).length > 0;
   let head = failed ? `${op} failed` : `${op} refused \u2014 nothing was written`;
-  if (data.migrationId) head += ` (journal ${String(data.migrationId)}; use undo_migration to revert what was applied)`;
+  if (failed && data.migrationId) head += ` (journal ${String(data.migrationId)}; use undo_migration to revert what was applied)`;
   return head + (shown.length ? `:
 ${shown.join("\n")}` : "");
 }

package/dist/datanotes.cjs

@@ -10310,6 +10310,25 @@ function resolveDateTokens(where, tz, now) {
   const walk = (v) => Array.isArray(v) ? v.map(walk) : v && typeof v === "object" ? Object.fromEntries(Object.entries(v).map(([k, x]) => [k, walk(x)])) : resolveDateToken(v, tz, now);
   return walk(where);
 }
+function wallClock(now, tz) {
+  const parts = new Intl.DateTimeFormat("en-CA", {
+    timeZone: tz || "UTC",
+    year: "numeric",
+    month: "2-digit",
+    day: "2-digit",
+    hour: "2-digit",
+    minute: "2-digit",
+    second: "2-digit",
+    hourCycle: "h23"
+  }).formatToParts(now);
+  const g = (type) => parts.find((p) => p.type === type)?.value ?? "00";
+  return `${g("year")}-${g("month")}-${g("day")}T${g("hour")}:${g("minute")}:${g("second")}`;
+}
+function resolveDefault(value, now, tz) {
+  if (value === DEFAULT_NOW) return tz === "" ? `${now.toISOString().slice(0, 19)}Z` : normalizeDatetime(wallClock(now, tz), tz);
+  if (value === DEFAULT_TODAY) return wallClock(now, tz).slice(0, 10);
+  return value;
+}
 
 // src/core/database.ts
 var DatabaseConfigError = class extends Error {
@@ -10914,7 +10933,8 @@ async function createTableImpl(app, settings, input, opts = {}) {
         throw new OperationInputError(`"time_column" must be a date or datetime column of the table`);
       }
       if (cfg.default_partition !== "") extra.partition = `{${tc.name}:${cfg.default_partition}}`;
-      extra.filename = `{${tc.name}:${cfg.filename}}`;
+      const format = tc.type === "date" ? cfg.filename.replace(/\s*(\[[^\]]*\])?\s*[Hh]{1,2}.*$/, "") || "YYYY-MM-DD" : cfg.filename;
+      extra.filename = `{${tc.name}:${format}}`;
     }
     const given = { ...input.options ?? {} };
     if ("path" in given) throw new OperationInputError(`database tables take "partition", not "path"`);
@@ -10991,10 +11011,11 @@ async function addColumnImpl(app, settings, input, opts = {}) {
   const cs = emptyChangeSet("add_column", `add column ${spec.name} to ${t.def.name}`, t.file.path);
   addSchemaChange(cs, t, after, settings);
   const violations = [];
+  const fill = resolveDefault(spec.default, /* @__PURE__ */ new Date(), (await readDatabaseConfig(app, settings)).timezone);
   for (const r of await loadRows(app, settings, t)) {
     const cur = fmGet(r.ordered, spec.name);
     const has = r.ordered.some(([k]) => k === spec.name);
-    const value = has ? cur : spec.default;
+    const value = has ? cur : fill;
     if (isEmptyValue(value)) {
       if (spec.required) {
         violations.push({
@@ -11009,7 +11030,7 @@ async function addColumnImpl(app, settings, input, opts = {}) {
       cs.edits.push({
         path: r.file.path,
         before: r.ordered,
-        after: fmAdd(r.ordered, spec.name, spec.default ?? null)
+        after: fmAdd(r.ordered, spec.name, fill ?? null)
       });
     }
   }
@@ -11128,6 +11149,7 @@ async function alterColumnImpl(app, settings, input, opts = {}) {
   const widen = old.type === "date" && spec.type === "datetime";
   const tz = widen ? (await readDatabaseConfig(app, settings)).timezone : "";
   const violations = spec.unique ? uniqueViolations([spec], existing.map((r) => ({ path: r.file.path, ordered: r.ordered }))) : [];
+  const fill = makeDense ? resolveDefault(spec.default, /* @__PURE__ */ new Date(), (await readDatabaseConfig(app, settings)).timezone) : void 0;
   for (const r of existing) {
     const has = r.ordered.some(([k]) => k === spec.name);
     let v = fmGet(r.ordered, spec.name);
@@ -11144,7 +11166,7 @@ async function alterColumnImpl(app, settings, input, opts = {}) {
       violations.push({ path: r.file.path, violations: validateValue(spec, v, validationContextFor(app, settings, r.file.path)) });
     }
     if (makeDense && !has) {
-      cs.edits.push({ path: r.file.path, before: r.ordered, after: fmAdd(r.ordered, spec.name, spec.default ?? null) });
+      cs.edits.push({ path: r.file.path, before: r.ordered, after: fmAdd(r.ordered, spec.name, fill ?? null) });
     }
   }
   return finish(app, settings, cs, [], violations, opts);
@@ -11896,9 +11918,11 @@ async function planInheritedRows(app, settings, model, text2, refs, rewrite, cs)
     checkColumnRefs(model, ref2.full, effectiveColumns(model, ref2, t.catalog.entry).filter((c) => !own.has(String(c.name))), ref2.full);
     const old = await loadTable(app, settings, ref2.full);
     const dense = t.def.columns.filter((c) => c.dense);
+    const now = /* @__PURE__ */ new Date();
+    const tz = (await readDatabaseConfig(app, settings)).timezone;
     for (const r of await loadRows(app, settings, old)) {
       let after = rewrite(r.ordered);
-      for (const c of dense) if (!after.some(([k]) => k === c.name)) after = fmSet(after, c.name, c.default ?? null);
+      for (const c of dense) if (!after.some(([k]) => k === c.name)) after = fmSet(after, c.name, resolveDefault(c.default, now, tz) ?? null);
       after = await fillIdentities(app, settings, t, after, r.file.path);
       const v = validateRow(t.def, after, { tableProperty: settings.tableProperty }, validationContextFor(app, settings, r.file.path));
       if (v.length > 0) violations.push({ path: r.file.path, violations: v });
@@ -12157,25 +12181,6 @@ function renderPathTemplate(template, values) {
     return sanitizeFileName(scalarForPath(v));
   });
 }
-function wallClock(now, tz) {
-  const parts = new Intl.DateTimeFormat("en-CA", {
-    timeZone: tz || "UTC",
-    year: "numeric",
-    month: "2-digit",
-    day: "2-digit",
-    hour: "2-digit",
-    minute: "2-digit",
-    second: "2-digit",
-    hourCycle: "h23"
-  }).formatToParts(now);
-  const g = (type) => parts.find((p) => p.type === type)?.value ?? "00";
-  return `${g("year")}-${g("month")}-${g("day")}T${g("hour")}:${g("minute")}:${g("second")}`;
-}
-function resolveDefault(value, now, tz) {
-  if (value === DEFAULT_NOW) return tz === "" ? `${now.toISOString().slice(0, 19)}Z` : normalizeDatetime(wallClock(now, tz), tz);
-  if (value === DEFAULT_TODAY) return wallClock(now, tz).slice(0, 10);
-  return value;
-}
 function computedColumnNames(t) {
   return new Set(t.def.columns.filter((c) => c.generated !== void 0 || c.identity !== void 0).map((c) => c.name));
 }
@@ -12811,6 +12816,7 @@ function planInsert(app, settings, t, input, env) {
     if (!known.has(k)) throw new OperationInputError(`unknown column "${k}" for table "${t.def.name}"`);
   }
   const computed = computedColumnNames(t);
+  for (const c of t.def.columns) if (c.identity === "filename") computed.delete(c.name);
   for (const k of Object.keys(input.values)) {
     if (computed.has(k)) throw new OperationInputError(`"${k}" is a generated column: its value is computed`);
   }
@@ -13223,12 +13229,23 @@ async function deleteRowsImpl(app, settings, input, opts = {}) {
     sources.forEach((s) => referrers.add(s));
   }
   if (policy === "set_null") {
+    const model = cachedMetastore(app, settings);
     for (const src of [...referrers].sort()) {
       const f = app.vault.getAbstractFileByPath(src);
       if (!f || !("extension" in f) || f.extension !== "md") continue;
       const text2 = await app.vault.read(f);
       const before = readOrderedFromMarkdown(text2).ordered;
-      cs.edits.push({ path: src, before, after: clearLinksTo(app, src, before, doomed) });
+      const after = clearLinksTo(app, src, before, doomed);
+      const owner = model ? rowTableFull(model, fmGet(after, settings.tableProperty)) : null;
+      const ot = owner ? await loadTable(app, settings, owner) : null;
+      if (ot && !src.startsWith(`${archiveFolder(ot.def)}/`)) {
+        for (const c of ot.def.columns) {
+          if (c.required && !isEmptyValue(fmGet(before, c.name)) && isEmptyValue(fmGet(after, c.name))) {
+            conflicts.push({ path: src, message: `"${c.name}" is required and would be left empty: change or delete this row first, or use on_referenced "ignore"` });
+          }
+        }
+      }
+      cs.edits.push({ path: src, before, after });
     }
   }
   const folder = archiveFolder(t.def);
@@ -13304,6 +13321,9 @@ async function retargetRows(app, settings, dst, notes, r, cs, opts) {
       }
       try {
         const values = new Map(after);
+        for (const c of dst.def.columns) {
+          if (c.identity === "filename" && isEmptyValue(values.get(c.name))) values.set(c.name, basenameOf(n.path));
+        }
         const base = `${renderPathTemplate(dst.def.layout.rowPath, values)}/${renderPathTemplate(dst.def.options.filename, values)}`;
         to = `${base}.md`;
         for (let k = 2; to !== n.path && (taken.has(to) || app.vault.getAbstractFileByPath(to) != null) && k <= MAX_NAME_SUFFIX; k++) {
@@ -13647,6 +13667,10 @@ async function adoptCreatedNote(app, settings, file) {
   const present = new Set(ordered.map(([k]) => k));
   const values = Object.fromEntries(Object.entries(target.values).filter(([k]) => !present.has(k)));
   for (const c of (await loadTable(app, settings, target.table)).def.columns) {
+    if (c.generated !== void 0 || c.identity !== void 0) {
+      delete values[c.name];
+      continue;
+    }
     if (c.external_default !== void 0 && !present.has(c.name) && values[c.name] === void 0) values[c.name] = c.external_default;
   }
   const r = await adoptRows(app, settings, { table: target.table, paths: [file.path], perRow: { [file.path]: values }, relocate: false });
@@ -23348,7 +23372,7 @@ var OPERATIONS = [
   },
   {
     "name": "infer_table",
-    "description": "Read-only schema inference from notes' frontmatter.\n- `folder` (recursive; \"\" = whole vault) and/or `paths`: notes not yet in a table. Returns\n  `columns` (type, enum `values`, link `ref` to the table most targets belong to, `required`,\n  `unique`, `dense`, `from` when the property name is not a valid column name, `stats`),\n  `proposal` ready for create_table (`name`, `options.filename` or `timeColumn`, `columns`) and\n  `adopt` ready for adopt_rows (`paths`, `rename`, `relocate: false`), plus `notes` to read.\n  Review the proposal (names, enums, required) before creating; ask the user when unsure.\n- `table`: keys the table's rows use but the table does not declare (candidates for add_column,\n  or keys to drop from rows).\nA string column becomes an enum with at most `max_enum_values` distinct values (default 12).",
+    "description": "Read-only schema inference from notes' frontmatter.\n- `folder` (recursive; \"\" = whole vault) and/or `paths`: notes not yet in a table. Returns\n  `columns` (type, enum `values`, link `ref` to the table most targets belong to, `required`,\n  `unique`, `dense`, `from` when the property name is not a valid column name, `stats`),\n  `proposal` ready for create_table (`name`, `options.filename` or `timeColumn`, `columns`) and\n  `adopt` ready for adopt_rows (`paths`, `rename`, `relocate: false`), plus `notes` to read.\n  Review the proposal (names, enums, required) before creating; ask the user when unsure.\n- `table`: keys the table's rows use but the table does not declare (candidates for add_column,\n  or keys to drop from rows).\nA string column becomes an enum when its values repeat: at least 3 notes, at most `max_enum_values`\ndistinct values (default 12), each used twice on average, short texts.",
     "inputSchema": {
       "additionalProperties": false,
       "properties": {
@@ -30682,6 +30706,16 @@ var NodeVault = class {
     this.files = /* @__PURE__ */ new Map();
     this.folders = /* @__PURE__ */ new Map();
     this.root = new NodeFolder("");
+    /**
+     * Bring one path of the index in line with the disk (for the watcher). Emits create / modify /
+     * delete when something changed; returns what happened.
+     */
+    /**
+     * Paths the vault is writing right now (and the folders above them). Between the change on disk
+     * and the index update there is an `await`: a rescan landing there must not take the vault's own
+     * write for a change made outside (a moved file would be dropped as deleted and added again).
+     */
+    this.busy = /* @__PURE__ */ new Map();
     this.adapter = new NodeAdapter(basePath);
     this.events.setMaxListeners(0);
     this.folders.set("", this.root);
@@ -30767,12 +30801,25 @@ var NodeVault = class {
   async refreshStat(f) {
     f.stat = statsOf(await import_promises.default.stat(this.abs(f.path)));
   }
-  /**
-   * Bring one path of the index in line with the disk (for the watcher). Emits create / modify /
-   * delete when something changed; returns what happened.
-   */
+  async guarded(paths, fn) {
+    for (const p of paths) this.busy.set(p, (this.busy.get(p) ?? 0) + 1);
+    try {
+      return await fn();
+    } finally {
+      for (const p of paths) {
+        const n = (this.busy.get(p) ?? 1) - 1;
+        if (n <= 0) this.busy.delete(p);
+        else this.busy.set(p, n);
+      }
+    }
+  }
+  isBusy(rel) {
+    for (const p of this.busy.keys()) if (rel === p || rel.startsWith(`${p}/`) || p.startsWith(`${rel}/`)) return true;
+    return false;
+  }
   syncPath(rel) {
     if (rel === "" || hidden(rel)) return null;
+    if (this.isBusy(rel)) return null;
     let st = null;
     try {
       st = import_node_fs3.default.statSync(this.abs(rel));
@@ -30864,8 +30911,10 @@ var NodeVault = class {
   }
   /** Write a file's text (internal: also used by the file manager). */
   async writeText(file, data) {
-    await atomicWrite(this.abs(file.path), data);
-    await this.refreshStat(file);
+    await this.guarded([file.path], async () => {
+      await atomicWrite(this.abs(file.path), data);
+      await this.refreshStat(file);
+    });
     this.emit("modify", file);
   }
   async process(file, fn) {
@@ -30878,9 +30927,11 @@ var NodeVault = class {
   async create(p, data) {
     const rel = p.replace(/^\/+/, "");
     if (import_node_fs3.default.existsSync(this.abs(rel))) throw new Error(`File already exists: ${rel}`);
-    await this.ensureFolder(dirname(rel));
-    await atomicWrite(this.abs(rel), data);
-    const f = this.addFile(rel, statsOf(await import_promises.default.stat(this.abs(rel))));
+    const f = await this.guarded([rel], async () => {
+      await this.ensureFolder(dirname(rel));
+      await atomicWrite(this.abs(rel), data);
+      return this.addFile(rel, statsOf(await import_promises.default.stat(this.abs(rel))));
+    });
     this.emit("create", f);
     return f;
   }
@@ -30897,6 +30948,9 @@ var NodeVault = class {
     return this.folders.get(rel);
   }
   async delete(file, force) {
+    return this.guarded([file.path], () => this.deleteNow(file, force));
+  }
+  async deleteNow(file, force) {
     const rel = file.path;
     if (this.folders.has(rel)) {
       const gone = [...this.files.values()].filter((f2) => f2.path.startsWith(`${rel}/`));
@@ -30911,8 +30965,11 @@ var NodeVault = class {
     if (f) this.emit("delete", f);
   }
   /** Move to `.trash/` (Obsidian's local trash; also for "system", which Node cannot reach) or delete. */
-  async trash(file, _system) {
+  async trash(file, system) {
     if (this.config.trashOption === "none") return this.delete(file, true);
+    return this.guarded([file.path], () => this.trashNow(file, system));
+  }
+  async trashNow(file, _system) {
     const target = await this.freeName(`.trash/${basename2(file.path)}`);
     const isFolder = this.folders.has(file.path);
     const gone = isFolder ? [...this.files.values()].filter((f) => f.path.startsWith(`${file.path}/`)) : [];
@@ -30944,6 +31001,9 @@ var NodeVault = class {
     const from = item.path;
     const to = newPath.replace(/^\/+|\/+$/g, "");
     if (from === to) return /* @__PURE__ */ new Map();
+    return this.guarded([from, to], () => this.moveNow(item, from, to));
+  }
+  async moveNow(item, from, to) {
     if (import_node_fs3.default.existsSync(this.abs(to)) && from.toLowerCase() !== to.toLowerCase()) throw new Error(`Destination exists: ${to}`);
     await this.ensureFolder(dirname(to));
     await import_promises.default.rename(this.abs(from), this.abs(to));
@@ -31264,7 +31324,7 @@ var NodeWatcher = class {
 };
 
 // src/node/service.ts
-var VERSION = true ? "2.0.0" : "dev";
+var VERSION = true ? "2.0.1" : "dev";
 function parseArgs(argv, env = process.env) {
   const get = (name) => {
     const i = argv.indexOf(`--${name}`);
@@ -31439,7 +31499,7 @@ Docs: https://datanotes.dev`;
 }
 
 // src/node/cli.ts
-var VERSION2 = true ? "2.0.0" : "dev";
+var VERSION2 = true ? "2.0.1" : "dev";
 async function main2(argv = process.argv.slice(2)) {
   const [command, ...rest] = argv;
   if (command === "--version" || command === "-v" || command === "version") return void process.stdout.write(`${VERSION2}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "datanotes",
-  "version": "2.0.0",
+  "version": "2.0.1",
   "description": "The engine of your second brain: Markdown notes as database tables, for you and your agents.",
   "keywords": [
     "markdown",
@@ -65,7 +65,8 @@
     "build:service": "node scripts/check-layers.mjs && tsc -noEmit -skipLibCheck && node esbuild.service.mjs && npm run build:api",
     "prepack": "npm run build:service",
     "build:api": "tsc -p tsconfig.api.json && node esbuild.api.mjs",
-    "build": "npm run build:service"
+    "build": "npm run build:service",
+    "prepublishOnly": "node scripts/release-window.mjs"
   },
   "devDependencies": {
     "@types/node": "^22.10.0",