dotmd-cli 0.71.3 → 0.71.4

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "dotmd-cli",
-  "version": "0.71.3",
+  "version": "0.71.4",
   "description": "CLI for managing markdown documents with YAML frontmatter — index, query, validate, graph, export, lifecycle, and AI summaries.",
   "type": "module",
   "license": "MIT",

package/src/reference-planner.mjs

@@ -1,10 +1,21 @@
-import { realpathSync } from 'node:fs';
+import { realpathSync, statSync } from 'node:fs';
 import path from 'node:path';
 import { extractFrontmatter } from './frontmatter.mjs';
 
 function slash(value) { return value.split(path.sep).join('/'); }
 
-function canonicalExisting(filePath) {
+function canonicalExisting(filePath, memo = null) {
+  const key = memo ? path.resolve(filePath) : null;
+  if (memo) {
+    const hit = memo.get(key);
+    if (hit !== undefined) return hit;
+  }
+  const identity = resolveCanonical(filePath);
+  if (memo) memo.set(key, identity);
+  return identity;
+}
+
+function resolveCanonical(filePath) {
   try { return realpathSync(filePath); }
   catch {
     const suffix = [];
@@ -36,31 +47,118 @@ export function configuredReferenceFields(config) {
   ])];
 }
 
+// Marks a case fold shared by two corpus documents. On a case-sensitive
+// filesystem those are genuinely two files, and nothing may collapse them.
+const AMBIGUOUS_FOLD = Symbol('ambiguous case fold');
+
+// The set carries four indexes beside the identities themselves:
+//   canonical — memoized path resolution. Resolving one reference costs two
+//     `canonicalExisting` calls, and the repository-relative spelling usually
+//     does NOT exist, which sends it up the tree doing a realpath per ancestor.
+//     Over a corpus-wide sweep that is tens of thousands of syscalls across a
+//     few hundred distinct paths, and it dominated the reference rewrite. The
+//     memo lives here so it is scoped to one sweep and cannot outlive a
+//     mutation — `dotmd bulk` builds a fresh set per move. Within a sweep it is
+//     also more consistent than re-resolving per token, which could observe the
+//     filesystem changing midway.
+//   paths     — identity to the spelling the corpus used.
+//   names     — identity to every basename it answers to (symlink aliases).
+//   folded    — case fold to identity, for filesystems that fold case.
 export function createReferenceIdentitySet(filePaths) {
   const identities = new Set();
   identities.paths = new Map();
-  for (const filePath of filePaths) {
-    const identity = canonicalExisting(filePath);
-    identities.add(identity);
-    identities.paths.set(identity, path.resolve(filePath));
-  }
+  identities.canonical = new Map();
+  identities.names = new Map();
+  identities.folded = new Map();
+  identities.symlinked = false;
+  for (const filePath of filePaths) registerIdentity(identities, filePath);
   return identities;
 }
 
+function registerIdentity(identities, filePath) {
+  const resolved = path.resolve(filePath);
+  const identity = canonicalExisting(filePath, identities.canonical);
+  // A corpus path whose realpath differs is a symlink, so one document can be
+  // reachable under more than one name. `names` records every one of them —
+  // and `symlinked` warns the candidate prefilter that names are not a
+  // reliable signal in this repo at all.
+  if (identity !== resolved) identities.symlinked = true;
+  identities.add(identity);
+  identities.paths.set(identity, resolved);
+  let names = identities.names.get(identity);
+  if (!names) identities.names.set(identity, names = new Set());
+  names.add(path.basename(resolved).toLowerCase());
+  const key = identity.toLowerCase();
+  const seen = identities.folded.get(key);
+  identities.folded.set(key, seen === undefined || seen === identity ? identity : AMBIGUOUS_FOLD);
+  return identity;
+}
+
+// Can this document possibly hold a reference to `oldIdentity`? Every token the
+// rewriter will touch has to survive `/\.md$/i` and then resolve to the moved
+// file, so the document must spell one of that file's names somewhere. Checking
+// that first skips the fence-aware walk for the ~99% of a corpus that never
+// mentions the file — the measured difference on a 2,000-doc repo is 950ms of
+// rewriting versus 120ms.
+//
+// The comparison mirrors the resolver: case-folded (a case-insensitive
+// filesystem resolves `FOO.MD` to `foo.md`, and folding can only over-include),
+// and with the same backslash escapes unwound, so `my\ plan.md` still matches
+// `my plan.md`. Percent-encoding needs no handling — the resolver does not
+// decode it either, so `foo%20bar.md` never resolves in the first place.
+//
+// The boundary: a symlink whose name differs from its target's. Aliases inside
+// the corpus are covered by `names`; a symlink that is NOT itself a collected
+// doc is not, so any repo that symlinks docs at all fails open to the full walk.
+function mayReferenceIdentity(content, oldIdentity, oldPath, identities) {
+  if (!identities?.names || identities.symlinked) return true;
+  const names = identities.names.get(oldIdentity);
+  const haystack = (content.includes('\\') ? content.replace(/\\([\s()[\]<>])/g, '$1') : content).toLowerCase();
+  if (haystack.includes(path.basename(oldPath).toLowerCase())) return true;
+  if (names) for (const name of names) if (haystack.includes(name)) return true;
+  return false;
+}
+
 // Both interpretations are evaluated. A local document wins only when the
 // repo-relative spelling is absent or names the same identity; disagreement is
 // rejected rather than guessed.
 export function resolveReferenceIdentity(token, documentPath, repoRoot, identities) {
   if (!token || /^(?:[a-z][a-z\d+.-]*:|\/\/|#)/i.test(token)) return null;
   const clean = token.replace(/[?#].*$/, '').replace(/\\([\s()[\]<>])/g, '$1');
-  const local = canonicalExisting(path.resolve(path.dirname(documentPath), clean));
-  const repository = canonicalExisting(path.resolve(repoRoot, clean.replace(/^\/+/, '')));
-  const localExists = identities.has(local);
-  const repositoryExists = identities.has(repository);
-  if (localExists && repositoryExists && local !== repository) {
+  const memo = identities?.canonical ?? null;
+  const local = matchIdentity(canonicalExisting(path.resolve(path.dirname(documentPath), clean), memo), identities);
+  const repository = matchIdentity(canonicalExisting(path.resolve(repoRoot, clean.replace(/^\/+/, '')), memo), identities);
+  if (local && repository && local !== repository) {
     throw new AmbiguousReferenceError(token, documentPath, local, repository);
   }
-  return localExists ? local : (repositoryExists ? repository : null);
+  return local ?? repository ?? null;
+}
+
+// `realpath` resolves symlinks but NOT case: on a case-insensitive filesystem
+// `realpath("CASING.MD")` hands back the caller's spelling, so an exact compare
+// misses a link that names a real document. Validation disagreed — it resolves
+// with `existsSync`, which does not care about case — so `dotmd check` called
+// such a link fine, a move silently left it pointing at the old path, and only
+// THEN did check call it broken.
+//
+// The tie-break is the inode, not a guess about the filesystem: same device and
+// inode means the two spellings are one file, which is only ever true where the
+// filesystem itself folds case. On a case-sensitive filesystem `Foo.md` and
+// `foo.md` are separate inodes and stay separate here, and two corpus documents
+// that differ only by case poison their shared fold so neither is guessed at.
+function matchIdentity(candidate, identities) {
+  if (identities.has(candidate)) return candidate;
+  const folded = identities.folded?.get(candidate.toLowerCase());
+  if (folded === undefined || folded === AMBIGUOUS_FOLD) return null;
+  return sameFileOnDisk(candidate, folded) ? folded : null;
+}
+
+function sameFileOnDisk(left, right) {
+  try {
+    const a = statSync(left);
+    const b = statSync(right);
+    return a.dev === b.dev && a.ino === b.ino && a.ino !== 0;
+  } catch { return false; }
 }
 
 function rewriteToken(token, sourcePath, outputPath, repoRoot, identities, oldIdentity, newPath, rebaseAll, format = 'plain') {
@@ -264,7 +362,10 @@ export function rewriteDocumentReferences(content, {
 }) {
   const { frontmatter, body } = extractFrontmatter(content);
   if (!frontmatter) return content;
-  const oldIdentity = canonicalExisting(oldPath);
+  const oldIdentity = canonicalExisting(oldPath, identities?.canonical ?? null);
+  // `rebaseAll` rewrites every reference the document holds because the
+  // document itself moved, so no single name can gate it.
+  if (!rebaseAll && !mayReferenceIdentity(content, oldIdentity, oldPath, identities)) return content;
   const args = [sourcePath, outputPath, repoRoot, identities, oldIdentity, newPath, rebaseAll];
   const nextFrontmatter = rewriteFrontmatter(frontmatter, referenceFields, args);
   const nextBody = rewriteMarkdown(body, args);
@@ -273,8 +374,9 @@ export function rewriteDocumentReferences(content, {
 
 export function planReferenceMove({ documents, oldPath, newPath, repoRoot, referenceFields = [] }) {
   const identities = createReferenceIdentitySet(documents.map(document => document.path));
-  const oldIdentity = canonicalExisting(oldPath);
-  identities.add(oldIdentity);
+  // Register rather than bare-add: the case fold and name index have to know
+  // about the moved document too, or a differently-cased link to it misses.
+  const oldIdentity = registerIdentity(identities, oldPath);
   const source = documents.find(document => path.resolve(document.path) === path.resolve(oldPath));
   if (!source) throw new Error(`Reference move plan is missing source content: ${oldPath}`);
   const movedContent = rewriteDocumentReferences(source.content, {