knodin 0.12.2 → 0.13.0

package/dist/src/engine/salesforce-components.js

@@ -0,0 +1,460 @@
+const NAME = /^[A-Za-z_][\w:.-]*/;
+const VOID = new Set([
+    "area",
+    "base",
+    "br",
+    "col",
+    "embed",
+    "hr",
+    "img",
+    "input",
+    "link",
+    "meta",
+    "param",
+    "source",
+    "track",
+    "wbr",
+]);
+const UNSUPPORTED_RAW_TEXT = new Set([
+    "script",
+    "style",
+    "textarea",
+    "title",
+    "iframe",
+    "xmp",
+    "noembed",
+    "noframes",
+    "plaintext",
+]);
+const FOREIGN_CONTENT = new Set(["svg", "math"]);
+// DTDs are unsupported; no declared entities can be safely inferred or loaded.
+function validXmlText(text) {
+    for (const char of text) {
+        const code = char.charCodeAt(0);
+        if (code < 32 && code !== 9 && code !== 10 && code !== 13)
+            return false;
+    }
+    for (let offset = text.indexOf("&"); offset !== -1; offset = text.indexOf("&", offset + 1)) {
+        const entity = /^&(?:amp|lt|gt|apos|quot|#\d+|#x[\da-fA-F]+);/.exec(text.slice(offset))?.[0];
+        if (!entity)
+            return false;
+        if (entity.startsWith("&#")) {
+            const hex = entity.startsWith("&#x");
+            const code = Number.parseInt(entity.slice(hex ? 3 : 2, -1), hex ? 16 : 10);
+            if (!(code === 9 ||
+                code === 10 ||
+                code === 13 ||
+                (code >= 32 && code <= 0xd7ff) ||
+                (code >= 0xe000 && code <= 0xfffd) ||
+                (code >= 0x10000 && code <= 0x10ffff)))
+                return false;
+        }
+        offset += entity.length - 1;
+    }
+    return true;
+}
+function validAttributes(tail, html) {
+    let rest = tail.replace(/\/\s*$/, "");
+    const names = new Set();
+    const attributes = new Map();
+    while (rest.trim()) {
+        if (!/^\s/.test(rest))
+            return false;
+        rest = rest.trimStart();
+        const name = NAME.exec(rest)?.[0];
+        if (!name || names.has(name))
+            return false;
+        names.add(name);
+        rest = rest.slice(name.length);
+        const assignment = /^\s*=\s*/.exec(rest);
+        if (!assignment) {
+            if (!html)
+                return false;
+            attributes.set(name, "");
+            continue;
+        }
+        rest = rest.slice(assignment[0].length);
+        if (rest.startsWith('"') || rest.startsWith("'")) {
+            const end = rest.indexOf(rest[0], 1);
+            if (end < 0)
+                return false;
+            if (!html && (rest.slice(1, end).includes("<") || !validXmlText(rest.slice(1, end))))
+                return false;
+            attributes.set(name, rest.slice(1, end));
+            rest = rest.slice(end + 1);
+        }
+        else {
+            const value = html ? /^[^\s"'`=<>]+/.exec(rest)?.[0] : null;
+            if (!value)
+                return false;
+            attributes.set(name, value);
+            rest = rest.slice(value.length);
+        }
+    }
+    return attributes;
+}
+/** Bounded literal markup traversal. Reject unsupported declarations/malformed trees. */
+export function parseMarkup(source, html = false) {
+    const document = {
+        name: "#document",
+        attributes: new Map(),
+        children: [],
+        text: "",
+        offset: 0,
+        evidence: "",
+    };
+    const stack = [document];
+    let cursor = 0;
+    let count = 0;
+    while (cursor < source.length) {
+        const parent = stack.at(-1);
+        if (!parent)
+            return null;
+        if (source[cursor] !== "<") {
+            const end = source.indexOf("<", cursor);
+            const next = end < 0 ? source.length : end;
+            const text = source.slice(cursor, next);
+            if (!html && (!validXmlText(text) || text.includes("]]>")))
+                return null;
+            parent.text += text;
+            cursor = next;
+            continue;
+        }
+        if (source.startsWith("<!--", cursor) || source.startsWith("<![CDATA[", cursor)) {
+            const comment = source.startsWith("<!--", cursor);
+            const endToken = comment ? "-->" : "]]>";
+            const end = source.indexOf(endToken, cursor + (comment ? 4 : 9));
+            if (end < 0)
+                return null;
+            if (comment && source.slice(cursor + 4, end).includes("--"))
+                return null;
+            // Never turn a split/commented identity into a literal identifier.
+            parent.text += "\0";
+            cursor = end + endToken.length;
+            continue;
+        }
+        if (source.startsWith("<?xml", cursor) && stack.length === 1 && !document.children.length) {
+            const end = source.indexOf("?>", cursor + 5);
+            if (end < 0)
+                return null;
+            cursor = end + 2;
+            continue;
+        }
+        if (source.startsWith("<!", cursor) || source.startsWith("<?", cursor))
+            return null;
+        let end = cursor + 1;
+        let quote = "";
+        for (; end < source.length; end++) {
+            const char = source[end];
+            if (quote) {
+                if (char === quote)
+                    quote = "";
+            }
+            else if (char === '"' || char === "'")
+                quote = char;
+            else if (char === ">")
+                break;
+            else if (char === "<")
+                return null;
+        }
+        if (end === source.length || quote)
+            return null;
+        const raw = source.slice(cursor, end + 1);
+        const closing = raw.startsWith("</");
+        const body = raw.slice(closing ? 2 : 1, -1);
+        const name = NAME.exec(body)?.[0];
+        if (!name)
+            return null;
+        const tail = body.slice(name.length);
+        if (closing) {
+            if (tail.trim() || stack.length === 1 || parent.name !== name)
+                return null;
+            stack.pop();
+        }
+        else {
+            if (tail && !/^[\s/]/.test(tail))
+                return null;
+            if (/\/\s+$/.test(body))
+                return null;
+            const attributes = validAttributes(tail, html);
+            if (!attributes)
+                return null;
+            const rawText = UNSUPPORTED_RAW_TEXT.has(name.toLowerCase());
+            const node = {
+                opaque: parent.opaque || rawText || FOREIGN_CONTENT.has(name.toLowerCase()),
+                name,
+                attributes,
+                children: [],
+                text: "",
+                offset: cursor,
+                evidence: raw,
+            };
+            parent.children.push(node);
+            if (++count > 100000)
+                return null;
+            if (html && rawText) {
+                // HTML raw text is not markup, even inside quotes or comments. Stop
+                // at its literal closing tag rather than interpreting its contents.
+                // Plaintext has no reliable closing boundary in HTML.
+                if (name.toLowerCase() === "plaintext")
+                    return null;
+                const closingTag = new RegExp(`</${name}\\s*>`, "gi");
+                closingTag.lastIndex = end + 1;
+                const close = closingTag.exec(source);
+                if (!close)
+                    return null;
+                // HTML script escaped/double-escaped states can make the first
+                // apparent closing tag part of script text. We do not implement
+                // that state machine: withhold ambiguous scripts, never expose
+                // their remaining text as component markup.
+                if (name.toLowerCase() === "script" &&
+                    /<!--|<script\b/i.test(source.slice(end + 1, close.index)))
+                    return null;
+                cursor = close.index + close[0].length;
+                node.text = source.slice(end + 1, close.index);
+                continue;
+            }
+            if (!/\/\s*$/.test(body) && !(html && VOID.has(name)))
+                stack.push(node);
+            if (stack.length > 256)
+                return null;
+        }
+        cursor = end + 1;
+    }
+    if (stack.length !== 1 ||
+        document.children.length !== 1 ||
+        document.text.replaceAll("\0", "").trim())
+        return null;
+    return document.children[0];
+}
+function descendants(root) {
+    const result = [];
+    const queue = [root];
+    for (const node of queue) {
+        // SVG/MathML integration points (including foreignObject) remain opaque.
+        if (node.opaque)
+            continue;
+        result.push(node);
+        for (const child of node.children)
+            queue.push(child);
+    }
+    return result;
+}
+function localName(value) {
+    const name = /^(?:c:)?([A-Za-z]\w*)$/.exec(value)?.[1];
+    return name && !name.includes("__") ? name : null;
+}
+function literalChild(parent, name) {
+    const children = parent.children.filter((child) => child.name === name);
+    if (children.length !== 1 || children[0].children.length)
+        return null;
+    const child = children[0];
+    const value = localName(child.text.trim());
+    return value
+        ? { name: value, offset: child.offset, evidence: `${child.evidence}${child.text}</${name}>` }
+        : null;
+}
+export function componentBindings(source, format, validateXml) {
+    // XML grammar validates well-formed syntax, while local checks below cover
+    // unsupported namespaces/entities. HTML deliberately does not use XML rules.
+    if (format !== "lwc" && (!validateXml || !validateXml(source)))
+        return [];
+    const root = parseMarkup(source, format === "lwc");
+    const roots = {
+        aura: ["aura:component", "aura:application"],
+        lwc: ["template"],
+        flexipage: ["FlexiPage"],
+        flow: ["Flow"],
+        weblink: ["WebLink"],
+    };
+    if (!root || !roots[format]?.includes(root.name))
+        return [];
+    // No namespace inference: conventional unbound Salesforce source prefixes are
+    // accepted, but explicit rebinding must never masquerade as a local component.
+    for (const node of descendants(root)) {
+        for (const [name, value] of node.attributes) {
+            if (name === "xmlns") {
+                const expected = format === "flexipage" || format === "flow" || format === "weblink"
+                    ? "http://soap.sforce.com/2006/04/metadata"
+                    : format === "lwc"
+                        ? "http://www.w3.org/1999/xhtml"
+                        : null;
+                if (!expected || value !== expected)
+                    return [];
+            }
+            else if (name.startsWith("xmlns:")) {
+                // Salesforce Flow exports declare xsi for nullable, unrelated
+                // metadata fields. This does not rebind the component namespace.
+                if (!(format === "flow" &&
+                    name === "xmlns:xsi" &&
+                    value === "http://www.w3.org/2001/XMLSchema-instance"))
+                    return [];
+            }
+        }
+    }
+    const bindings = [];
+    if (format === "weblink") {
+        const type = literalChild(root, "linkType");
+        const entry = literalChild(root, "page");
+        if (type?.name === "page" &&
+            entry &&
+            ![...root.attributes.keys()].some((name) => name !== "xmlns") &&
+            !root.children
+                .filter((node) => node.name === "page" || node.name === "linkType")
+                .some((node) => node.attributes.size))
+            bindings.push({ ...entry, target: "page", kind: "weblink_visualforce_page" });
+    }
+    else if (format === "flow") {
+        const hasSchemaInstanceAttribute = (node) => [...node.attributes.keys()].some((name) => name.startsWith("xsi:"));
+        // Do not interpret nil/type annotations on identity-bearing elements.
+        // Other Flow values may be nil without suppressing independent bindings.
+        if (hasSchemaInstanceAttribute(root))
+            return [];
+        for (const screen of root.children.filter((node) => node.name === "screens")) {
+            if (hasSchemaInstanceAttribute(screen))
+                continue;
+            for (const field of screen.children.filter((node) => node.name === "fields")) {
+                if (hasSchemaInstanceAttribute(field))
+                    continue;
+                const types = field.children.filter((node) => node.name === "fieldType");
+                if (types.some(hasSchemaInstanceAttribute))
+                    continue;
+                if (types.length &&
+                    (types.length !== 1 ||
+                        types[0].children.length ||
+                        types[0].text.trim() !== "ComponentInstance"))
+                    continue;
+                const extensions = field.children.filter((node) => node.name === "extensionName");
+                if (extensions.some(hasSchemaInstanceAttribute))
+                    continue;
+                if (extensions.length !== 1 || !/^c:[A-Za-z]\w*$/.test(extensions[0].text.trim()))
+                    continue;
+                const entry = literalChild(field, "extensionName");
+                if (entry)
+                    bindings.push({ ...entry, target: "component", kind: "flow_screen_component" });
+            }
+        }
+    }
+    else if (format === "flexipage") {
+        for (const region of root.children.filter((node) => node.name === "flexiPageRegions")) {
+            for (const container of region.children) {
+                const instances = container.name === "itemInstances"
+                    ? container.children.filter((node) => node.name === "componentInstance")
+                    : container.name === "componentInstances"
+                        ? [container]
+                        : [];
+                for (const instance of instances) {
+                    const entry = literalChild(instance, "componentName");
+                    if (entry)
+                        bindings.push({ ...entry, target: "component", kind: "flexipage_component" });
+                }
+            }
+        }
+        const templates = root.children.filter((node) => node.name === "template");
+        if (templates.length === 1) {
+            const entry = literalChild(templates[0], "name");
+            if (entry)
+                bindings.push({ ...entry, target: "aura", kind: "flexipage_template" });
+        }
+    }
+    else {
+        if (format === "aura" && root.name === "aura:application") {
+            for (const node of root.children.filter((node) => node.name === "aura:dependency")) {
+                const name = /^c:([A-Za-z]\w*)$/.exec(node.attributes.get("resource") ?? "")?.[1];
+                if (name &&
+                    !name.includes("__") &&
+                    !node.children.length &&
+                    !node.text.trim() &&
+                    [...node.attributes.keys()].every((key) => key === "resource" || key === "type") &&
+                    (!node.attributes.has("type") || node.attributes.get("type") === "COMPONENT"))
+                    bindings.push({
+                        name,
+                        offset: node.offset,
+                        evidence: node.evidence,
+                        target: "component",
+                        kind: "aura_resource_component",
+                    });
+            }
+        }
+        for (const node of descendants(root)) {
+            const name = format === "aura"
+                ? /^c:([A-Za-z]\w*)$/.exec(node.name)?.[1]
+                : /^c-([a-z][a-z0-9_-]*)$/.exec(node.name)?.[1];
+            if (name && !name.includes("__"))
+                bindings.push({
+                    name,
+                    offset: node.offset,
+                    evidence: node.evidence,
+                    target: format === "aura" ? "component" : "lwc-tag",
+                    kind: format === "aura" ? "aura_component" : "lwc_template_component",
+                });
+        }
+    }
+    return bindings;
+}
+/** Real inline script regions only; foreign/raw-text descendants remain opaque. */
+export function visualforceInlineScripts(source) {
+    const root = parseMarkup(source, true);
+    if (!root || root.name !== "apex:page")
+        return null;
+    const scripts = [];
+    const queue = [root];
+    for (const node of queue) {
+        if ([...node.attributes.keys()].some((name) => name.startsWith("xmlns")))
+            return null;
+        if (node.name.toLowerCase() === "script") {
+            if (node.name !== "script" ||
+                [...node.attributes.keys()].some((name) => name !== "type") ||
+                (node.attributes.has("type") &&
+                    !["text/javascript", "application/javascript"].includes(node.attributes.get("type") ?? "")))
+                return null;
+            scripts.push(node.text);
+            continue;
+        }
+        if (!node.opaque)
+            queue.push(...node.children);
+    }
+    return scripts;
+}
+/** Input is a single pass-local source inventory; cap each ambiguity set at two. */
+export function componentCatalog(paths) {
+    const entries = new Map();
+    const add = (key, target) => {
+        const matches = entries.get(key) ?? [];
+        if (matches.length < 2 && !matches.some((match) => match.file === target.file))
+            matches.push(target);
+        entries.set(key, matches);
+    };
+    for (const file of paths) {
+        if (!file.startsWith("force-app/main/default/"))
+            continue;
+        const app = /^force-app\/main\/default\/aura\/([A-Za-z]\w*)\/\1\.app$/.exec(file);
+        const page = /^force-app\/main\/default\/pages\/([A-Za-z]\w*)\.page$/.exec(file);
+        const metadataName = (app ?? page)?.[1];
+        if (metadataName) {
+            const name = metadataName;
+            if (!name.includes("__"))
+                add(`${app ? "application" : "page"}:${name}`, {
+                    file,
+                    kind: app ? "application" : "page",
+                });
+            continue;
+        }
+        const aura = /^force-app\/main\/default\/aura\/([A-Za-z]\w*)\/\1\.cmp$/.exec(file);
+        const lwc = /^force-app\/main\/default\/lwc\/([a-z]\w*)\/\1\.js$/.exec(file);
+        const name = aura?.[1] ?? lwc?.[1];
+        if (!name || name.includes("__"))
+            continue;
+        const target = { file, kind: aura ? "aura" : "lwc" };
+        add(`${target.kind}:${name}`, target);
+        add(`component:${name}`, target);
+        if (lwc)
+            add(`lwc-tag:${name.replace(/[A-Z]/g, (char) => `-${char.toLowerCase()}`)}`, target);
+    }
+    return {
+        resolve(binding) {
+            const matches = entries.get(`${binding.target}:${binding.name}`) ?? [];
+            return matches.length === 1 ? matches[0] : null;
+        },
+    };
+}

package/dist/src/engine/seal.js

@@ -235,6 +235,9 @@ export function sealIndex(options) {
             db.run(statement);
         db.run("DELETE FROM sealed_file;");
         db.run("DELETE FROM sealed_source;");
+        // This disposable cache can contain vectors from deleted source versions.
+        // It is never part of an export, even when current embeddings are retained.
+        db.run("DROP TABLE IF EXISTS embedding_reuse_v1;");
         let removedEmbeddings = 0;
         if (stripEmbeddings) {
             removedEmbeddings =

package/dist/src/engine/sqlite.js

@@ -6,6 +6,8 @@
  * preserves the engine's existing typed `query<Row, Params>()` contract while
  * using Node's native `DatabaseSync` implementation underneath.
  */
+import fs from "node:fs";
+import path from "node:path";
 import { DatabaseSync } from "node:sqlite";
 /**
  * knodin's call sites pass bind params either spread (`stmt.all(a, b)`) or as a
@@ -42,8 +44,50 @@ class Statement {
 }
 export class Database {
     db;
+    filePath;
+    openedFileIdentity;
     constructor(databasePath, options = {}) {
         this.db = new DatabaseSync(databasePath, { readOnly: options.readonly === true });
+        this.filePath = databasePath && databasePath !== ":memory:" ? path.resolve(databasePath) : null;
+        try {
+            const stat = this.filePath ? fs.statSync(this.filePath, { bigint: true }) : null;
+            this.openedFileIdentity = stat ? `${stat.dev}:${stat.ino}` : null;
+        }
+        catch {
+            this.openedFileIdentity = null;
+        }
+    }
+    /** Read-only native capability. Unknown runtimes must use byte-scanning validation. */
+    readSnapshotIdentity() {
+        let transaction = null;
+        try {
+            const nativeState = this.db.isTransaction;
+            if (typeof nativeState === "boolean")
+                transaction = nativeState;
+        }
+        catch {
+            /* Closed or unsupported native handle. */
+        }
+        if (!this.filePath)
+            return { transaction, fileStamp: "memory", replaced: false };
+        try {
+            const stat = fs.statSync(this.filePath, { bigint: true });
+            const identity = `${stat.dev}:${stat.ino}`;
+            return {
+                transaction,
+                fileStamp: this.openedFileIdentity
+                    ? `${identity}:${stat.size}:${stat.mtimeNs}:${stat.ctimeNs}`
+                    : null,
+                replaced: this.openedFileIdentity !== null && identity !== this.openedFileIdentity,
+            };
+        }
+        catch (error) {
+            return {
+                transaction,
+                fileStamp: null,
+                replaced: error.code === "ENOENT",
+            };
+        }
     }
     query(sql) {
         return new Statement(this.db.prepare(sql));