mewkit 1.11.1 → 1.12.0

package/dist/wiki/infrastructure/inventory-adapter.js

@@ -0,0 +1,46 @@
+import fs from "node:fs";
+import path from "node:path";
+// Registers wiki harness artifacts into .claude/harness-inventory.json under an existing
+// taxonomy value. The wiki IS long-term project memory, so it reuses "project-memory" — no
+// new taxonomy enum value is needed (decided, not assumed). Idempotent: re-registering the
+// same path is a no-op, so `mewkit inventory --substrate` shows no drift on repeat runs.
+/** The wiki serves the existing "project-memory" responsibility (see core/substrate.ts TAXONOMY). */
+export const WIKI_RESPONSIBILITY = "project-memory";
+export class InventoryAdapter {
+    claudeDir;
+    constructor(claudeDir) {
+        this.claudeDir = claudeDir;
+    }
+    file() {
+        return path.join(this.claudeDir, "harness-inventory.json");
+    }
+    register(artifactPath, meta = {}) {
+        const file = this.file();
+        if (!fs.existsSync(file))
+            return; // no registry in this tree — nothing to tag
+        let parsed;
+        try {
+            parsed = JSON.parse(fs.readFileSync(file, "utf-8"));
+        }
+        catch {
+            return; // tolerant: a malformed registry is not this adapter's to repair
+        }
+        if (!parsed.artifacts || typeof parsed.artifacts !== "object")
+            return;
+        const desired = {
+            owner: "lifecycle",
+            criticality: meta.criticality ?? "medium",
+            status: meta.status ?? "active",
+            runtime: "portable",
+            responsibility: WIKI_RESPONSIBILITY,
+        };
+        const existing = parsed.artifacts[artifactPath];
+        if (existing && JSON.stringify(existing) === JSON.stringify(desired))
+            return; // idempotent
+        parsed.artifacts[artifactPath] = desired;
+        const tmp = file + ".tmp-" + process.pid;
+        fs.writeFileSync(tmp, JSON.stringify(parsed, null, 2) + "\n", "utf-8");
+        fs.renameSync(tmp, file);
+    }
+}
+//# sourceMappingURL=inventory-adapter.js.map

package/dist/wiki/infrastructure/inventory-adapter.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"inventory-adapter.js","sourceRoot":"","sources":["../../../src/wiki/infrastructure/inventory-adapter.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,IAAI,MAAM,WAAW,CAAC;AAG7B,yFAAyF;AACzF,2FAA2F;AAC3F,2FAA2F;AAC3F,yFAAyF;AAEzF,qGAAqG;AACrG,MAAM,CAAC,MAAM,mBAAmB,GAAG,gBAAgB,CAAC;AAOpD,MAAM,OAAO,gBAAgB;IACC;IAA7B,YAA6B,SAAiB;QAAjB,cAAS,GAAT,SAAS,CAAQ;IAAG,CAAC;IAE1C,IAAI;QACX,OAAO,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,wBAAwB,CAAC,CAAC;IAC5D,CAAC;IAED,QAAQ,CAAC,YAAoB,EAAE,OAAkD,EAAE;QAClF,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;QACzB,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC;YAAE,OAAO,CAAC,4CAA4C;QAC9E,IAAI,MAAqB,CAAC;QAC1B,IAAI,CAAC;YACJ,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,YAAY,CAAC,IAAI,EAAE,OAAO,CAAC,CAAkB,CAAC;QACtE,CAAC;QAAC,MAAM,CAAC;YACR,OAAO,CAAC,iEAAiE;QAC1E,CAAC;QACD,IAAI,CAAC,MAAM,CAAC,SAAS,IAAI,OAAO,MAAM,CAAC,SAAS,KAAK,QAAQ;YAAE,OAAO;QAEtE,MAAM,OAAO,GAAG;YACf,KAAK,EAAE,WAAW;YAClB,WAAW,EAAE,IAAI,CAAC,WAAW,IAAI,QAAQ;YACzC,MAAM,EAAE,IAAI,CAAC,MAAM,IAAI,QAAQ;YAC/B,OAAO,EAAE,UAAU;YACnB,cAAc,EAAE,mBAAmB;SACnC,CAAC;QACF,MAAM,QAAQ,GAAG,MAAM,CAAC,SAAS,CAAC,YAAY,CAAC,CAAC;QAChD,IAAI,QAAQ,IAAI,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,KAAK,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC;YAAE,OAAO,CAAC,aAAa;QAE3F,MAAM,CAAC,SAAS,CAAC,YAAY,CAAC,GAAG,OAAO,CAAC;QACzC,MAAM,GAAG,GAAG,IAAI,GAAG,OAAO,GAAG,OAAO,CAAC,GAAG,CAAC;QACzC,EAAE,CAAC,aAAa,CAAC,GAAG,EAAE,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,GAAG,IAAI,EAAE,OAAO,CAAC,CAAC;QACvE,EAAE,CAAC,UAAU,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;IAC1B,CAAC;CACD"}

package/dist/wiki/infrastructure/markdown-repository.d.ts

@@ -0,0 +1,23 @@
+import type { InjectionVerdict, WikiCandidate, WikiIntervention, WikiPage, WikiSeed, WikiSlug, WikiSource } from "../domain/index.js";
+import type { ApprovedWrite, WikiRepository } from "../application/ports.js";
+export declare class MarkdownWikiRepository implements WikiRepository {
+    private readonly projectRoot;
+    constructor(projectRoot: string);
+    private wikiDir;
+    /** Resolve a repo-relative sub-path inside a slug dir, rejecting traversal. */
+    private resolveInSlug;
+    createWiki(slug: WikiSlug, title: string): void;
+    writePage(token: ApprovedWrite): void;
+    readPage(slug: WikiSlug, file: string): WikiPage | null;
+    listPages(slug: WikiSlug): string[];
+    private appendJsonl;
+    private readJsonl;
+    appendCandidate(candidate: WikiCandidate): void;
+    appendIntervention(slug: WikiSlug, intervention: WikiIntervention): void;
+    appendSeed(slug: WikiSlug, seed: WikiSeed): void;
+    appendSource(slug: WikiSlug, source: WikiSource): void;
+    listCandidates(slug: WikiSlug): WikiCandidate[];
+    getCandidate(slug: WikiSlug, id: string): WikiCandidate | null;
+    quarantine(slug: WikiSlug, content: string, verdict: InjectionVerdict): string;
+}
+//# sourceMappingURL=markdown-repository.d.ts.map

package/dist/wiki/infrastructure/markdown-repository.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"markdown-repository.d.ts","sourceRoot":"","sources":["../../../src/wiki/infrastructure/markdown-repository.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EACX,gBAAgB,EAChB,aAAa,EACb,gBAAgB,EAChB,QAAQ,EACR,QAAQ,EACR,QAAQ,EACR,UAAU,EACV,MAAM,oBAAoB,CAAC;AAE5B,OAAO,KAAK,EAAE,aAAa,EAAE,cAAc,EAAE,MAAM,yBAAyB,CAAC;AAwC7E,qBAAa,sBAAuB,YAAW,cAAc;IAChD,OAAO,CAAC,QAAQ,CAAC,WAAW;gBAAX,WAAW,EAAE,MAAM;IAEhD,OAAO,CAAC,OAAO;IAIf,+EAA+E;IAC/E,OAAO,CAAC,aAAa;IAUrB,UAAU,CAAC,IAAI,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,GAAG,IAAI;IAK/C,SAAS,CAAC,KAAK,EAAE,aAAa,GAAG,IAAI;IAqBrC,QAAQ,CAAC,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,GAAG,QAAQ,GAAG,IAAI;IAwBvD,SAAS,CAAC,IAAI,EAAE,QAAQ,GAAG,MAAM,EAAE;IAMnC,OAAO,CAAC,WAAW;IAMnB,OAAO,CAAC,SAAS;IAgBjB,eAAe,CAAC,SAAS,EAAE,aAAa,GAAG,IAAI;IAI/C,kBAAkB,CAAC,IAAI,EAAE,QAAQ,EAAE,YAAY,EAAE,gBAAgB,GAAG,IAAI;IAIxE,UAAU,CAAC,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,QAAQ,GAAG,IAAI;IAIhD,YAAY,CAAC,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,UAAU,GAAG,IAAI;IAItD,cAAc,CAAC,IAAI,EAAE,QAAQ,GAAG,aAAa,EAAE;IAM/C,YAAY,CAAC,IAAI,EAAE,QAAQ,EAAE,EAAE,EAAE,MAAM,GAAG,aAAa,GAAG,IAAI;IAI9D,UAAU,CAAC,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,gBAAgB,GAAG,MAAM;CAQ9E"}

package/dist/wiki/infrastructure/markdown-repository.js

@@ -0,0 +1,168 @@
+import fs from "node:fs";
+import path from "node:path";
+import { createHash } from "node:crypto";
+import yaml from "js-yaml";
+import { assertCanonicalComplete, assertNoTraversal, makeWikiPageId, makeWikiSlug } from "../domain/index.js";
+// Canonical Markdown repository for tasks/wikis/<slug>/. All writes are atomic (temp-file +
+// rename) via a LOCAL helper — there is no shared IO wrapper and no-direct-io does not cover
+// src/wiki/, so the safety property is type-enforced: writePage accepts ONLY an ApprovedWrite
+// token. Quarantined content lands in a read-blocked .quarantined file.
+function atomicWriteText(filePath, text) {
+    fs.mkdirSync(path.dirname(filePath), { recursive: true });
+    const tmp = filePath + ".tmp-" + process.pid;
+    fs.writeFileSync(tmp, text, "utf-8");
+    fs.renameSync(tmp, filePath);
+}
+/** Minimal runtime shape check for a candidate record from JSONL. The required string fields
+ * + a salience object are what the approve path and index ingest rely on; malformed records
+ * (incl. anything an untrusted producer might emit) are dropped. */
+function isCandidateRecord(r) {
+    if (!r || typeof r !== "object")
+        return false;
+    const o = r;
+    return (typeof o["id"] === "string" &&
+        typeof o["slug"] === "string" &&
+        typeof o["title"] === "string" &&
+        typeof o["content"] === "string" &&
+        typeof o["state"] === "string" &&
+        typeof o["salience"] === "object" &&
+        o["salience"] !== null);
+}
+function parseFrontmatter(raw) {
+    if (!raw.startsWith("---"))
+        return { meta: {}, body: raw };
+    const end = raw.indexOf("\n---", 3);
+    if (end === -1)
+        return { meta: {}, body: raw };
+    const loaded = yaml.load(raw.slice(3, end).trim());
+    const meta = loaded && typeof loaded === "object" ? loaded : {};
+    return { meta, body: raw.slice(end + 4).replace(/^\r?\n/, "") };
+}
+export class MarkdownWikiRepository {
+    projectRoot;
+    constructor(projectRoot) {
+        this.projectRoot = projectRoot;
+    }
+    wikiDir(slug) {
+        return path.join(this.projectRoot, "tasks", "wikis", slug);
+    }
+    /** Resolve a repo-relative sub-path inside a slug dir, rejecting traversal. */
+    resolveInSlug(slug, relative) {
+        assertNoTraversal(relative);
+        const base = this.wikiDir(slug);
+        const target = path.resolve(base, relative);
+        if (target !== base && !target.startsWith(base + path.sep)) {
+            throw new Error("path escapes the wiki directory: " + JSON.stringify(relative));
+        }
+        return target;
+    }
+    createWiki(slug, title) {
+        const meta = { slug, title, createdAt: new Date().toISOString(), updatedAt: new Date().toISOString() };
+        atomicWriteText(path.join(this.wikiDir(slug), "wiki.json"), JSON.stringify(meta, null, 2) + "\n");
+    }
+    writePage(token) {
+        const page = token.page;
+        assertCanonicalComplete(page); // re-assert invariants at the write boundary
+        const target = this.resolveInSlug(page.slug, page.path);
+        // `origin` stays top-level so the ingest reads it; full provenance is persisted too.
+        const meta = {
+            id: page.id,
+            slug: page.slug,
+            title: page.title,
+            state: page.state,
+            origin: page.provenance.origin,
+            createdAt: page.createdAt,
+            updatedAt: page.updatedAt,
+            links: page.links,
+            sourceIds: page.provenance.sourceIds,
+        };
+        if (page.provenance.approvedBy)
+            meta["approvedBy"] = page.provenance.approvedBy;
+        if (page.provenance.candidateId)
+            meta["candidateId"] = page.provenance.candidateId;
+        atomicWriteText(target, "---\n" + yaml.dump(meta) + "---\n" + page.content + "\n");
+    }
+    readPage(slug, file) {
+        const target = this.resolveInSlug(slug, path.join("pages", file));
+        if (!fs.existsSync(target))
+            return null;
+        const { meta, body } = parseFrontmatter(fs.readFileSync(target, "utf-8"));
+        const origin = meta["origin"] === "agent" || meta["origin"] === "system" ? meta["origin"] : "human";
+        return {
+            id: makeWikiPageId(typeof meta["id"] === "string" ? meta["id"] : slug + "/" + file),
+            slug: makeWikiSlug(typeof meta["slug"] === "string" ? meta["slug"] : slug),
+            title: typeof meta["title"] === "string" ? meta["title"] : file.replace(/\.md$/, ""),
+            path: path.join("pages", file),
+            content: body,
+            state: typeof meta["state"] === "string" ? meta["state"] : "committed",
+            createdAt: typeof meta["createdAt"] === "string" ? meta["createdAt"] : "",
+            updatedAt: typeof meta["updatedAt"] === "string" ? meta["updatedAt"] : "",
+            provenance: {
+                origin,
+                sourceIds: Array.isArray(meta["sourceIds"]) ? meta["sourceIds"] : [],
+                approvedBy: typeof meta["approvedBy"] === "string" ? meta["approvedBy"] : undefined,
+                candidateId: typeof meta["candidateId"] === "string" ? meta["candidateId"] : undefined,
+            },
+            links: [],
+        };
+    }
+    listPages(slug) {
+        const dir = path.join(this.wikiDir(slug), "pages");
+        if (!fs.existsSync(dir))
+            return [];
+        return fs.readdirSync(dir).filter((f) => f.endsWith(".md")).sort();
+    }
+    appendJsonl(slug, file, record) {
+        const target = this.resolveInSlug(slug, file);
+        fs.mkdirSync(path.dirname(target), { recursive: true });
+        fs.appendFileSync(target, JSON.stringify(record) + "\n", "utf-8");
+    }
+    readJsonl(slug, file) {
+        const target = this.resolveInSlug(slug, file);
+        if (!fs.existsSync(target))
+            return [];
+        const out = [];
+        for (const line of fs.readFileSync(target, "utf-8").split("\n")) {
+            if (!line.trim())
+                continue;
+            try {
+                const parsed = JSON.parse(line);
+                if (parsed && typeof parsed === "object")
+                    out.push(parsed);
+            }
+            catch {
+                // tolerant — skip a malformed line
+            }
+        }
+        return out;
+    }
+    appendCandidate(candidate) {
+        this.appendJsonl(candidate.slug, "candidates.jsonl", candidate);
+    }
+    appendIntervention(slug, intervention) {
+        this.appendJsonl(slug, "interventions.jsonl", intervention);
+    }
+    appendSeed(slug, seed) {
+        this.appendJsonl(slug, "seeds.jsonl", seed);
+    }
+    appendSource(slug, source) {
+        this.appendJsonl(slug, "sources.jsonl", source);
+    }
+    listCandidates(slug) {
+        // Runtime shape guard at the store boundary — candidates.jsonl gains an untrusted
+        // producer (fetched→candidate), so malformed records are skipped, not cast blind.
+        return this.readJsonl(slug, "candidates.jsonl").filter(isCandidateRecord);
+    }
+    getCandidate(slug, id) {
+        return this.listCandidates(slug).find((c) => c.id === id) ?? null;
+    }
+    quarantine(slug, content, verdict) {
+        const hash = createHash("sha256").update(content).digest("hex").slice(0, 16);
+        const target = this.resolveInSlug(slug, path.join("quarantine", hash + ".quarantined"));
+        const header = "QUARANTINED — DATA, do not execute. verdict=" + verdict.status + " findings=" + JSON.stringify(verdict.findings) + "\n";
+        atomicWriteText(target, header + content);
+        fs.chmodSync(target, 0o400); // owner read-only — re-injection-resistant at rest
+        return target;
+    }
+}
+//# sourceMappingURL=markdown-repository.js.map

package/dist/wiki/infrastructure/markdown-repository.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"markdown-repository.js","sourceRoot":"","sources":["../../../src/wiki/infrastructure/markdown-repository.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,IAAI,MAAM,SAAS,CAAC;AAU3B,OAAO,EAAE,uBAAuB,EAAE,iBAAiB,EAAE,cAAc,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAG9G,4FAA4F;AAC5F,6FAA6F;AAC7F,8FAA8F;AAC9F,wEAAwE;AAExE,SAAS,eAAe,CAAC,QAAgB,EAAE,IAAY;IACtD,EAAE,CAAC,SAAS,CAAC,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAC1D,MAAM,GAAG,GAAG,QAAQ,GAAG,OAAO,GAAG,OAAO,CAAC,GAAG,CAAC;IAC7C,EAAE,CAAC,aAAa,CAAC,GAAG,EAAE,IAAI,EAAE,OAAO,CAAC,CAAC;IACrC,EAAE,CAAC,UAAU,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC;AAC9B,CAAC;AAED;;oEAEoE;AACpE,SAAS,iBAAiB,CAAC,CAAU;IACpC,IAAI,CAAC,CAAC,IAAI,OAAO,CAAC,KAAK,QAAQ;QAAE,OAAO,KAAK,CAAC;IAC9C,MAAM,CAAC,GAAG,CAA4B,CAAC;IACvC,OAAO,CACN,OAAO,CAAC,CAAC,IAAI,CAAC,KAAK,QAAQ;QAC3B,OAAO,CAAC,CAAC,MAAM,CAAC,KAAK,QAAQ;QAC7B,OAAO,CAAC,CAAC,OAAO,CAAC,KAAK,QAAQ;QAC9B,OAAO,CAAC,CAAC,SAAS,CAAC,KAAK,QAAQ;QAChC,OAAO,CAAC,CAAC,OAAO,CAAC,KAAK,QAAQ;QAC9B,OAAO,CAAC,CAAC,UAAU,CAAC,KAAK,QAAQ;QACjC,CAAC,CAAC,UAAU,CAAC,KAAK,IAAI,CACtB,CAAC;AACH,CAAC;AAED,SAAS,gBAAgB,CAAC,GAAW;IACpC,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,KAAK,CAAC;QAAE,OAAO,EAAE,IAAI,EAAE,EAAE,EAAE,IAAI,EAAE,GAAG,EAAE,CAAC;IAC3D,MAAM,GAAG,GAAG,GAAG,CAAC,OAAO,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC;IACpC,IAAI,GAAG,KAAK,CAAC,CAAC;QAAE,OAAO,EAAE,IAAI,EAAE,EAAE,EAAE,IAAI,EAAE,GAAG,EAAE,CAAC;IAC/C,MAAM,MAAM,GAAY,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;IAC5D,MAAM,IAAI,GAAG,MAAM,IAAI,OAAO,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAE,MAAkC,CAAC,CAAC,CAAC,EAAE,CAAC;IAC7F,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,GAAG,CAAC,KAAK,CAAC,GAAG,GAAG,CAAC,CAAC,CAAC,OAAO,CAAC,QAAQ,EAAE,EAAE,CAAC,EAAE,CAAC;AACjE,CAAC;AAED,MAAM,OAAO,sBAAsB;IACL;IAA7B,YAA6B,WAAmB;QAAnB,gBAAW,GAAX,WAAW,CAAQ;IAAG,CAAC;IAE5C,OAAO,CAAC,IAAc;QAC7B,OAAO,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,OAAO,EAAE,OAAO,EAAE,IAAI,CAAC,CAAC;IAC5D,CAAC;IAED,+EAA+E;IACvE,aAAa,CAAC,IAAc,EAAE,QAAgB;QACrD,iBAAiB,CAAC,QAAQ,CAAC,CAAC;QAC5B,MAAM,IAAI,GAAG,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;QAChC,MAAM,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;QAC5C,IAAI,MAAM,KAAK,IAAI,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC,IAAI,GAAG,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;YAC5D,MAAM,IAAI,KAAK,CAAC,mCAAmC,GAAG,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC,CAAC;QACjF,CAAC;QACD,OAAO,MAAM,CAAC;IACf,CAAC;IAED,UAAU,CAAC,IAAc,EAAE,KAAa;QACvC,MAAM,IAAI,GAAG,EAAE,IAAI,EAAE,KAAK,EAAE,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,EAAE,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,EAAE,CAAC;QACvG,eAAe,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,WAAW,CAAC,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC;IACnG,CAAC;IAED,SAAS,CAAC,KAAoB;QAC7B,MAAM,IAAI,GAAG,KAAK,CAAC,IAAI,CAAC;QACxB,uBAAuB,CAAC,IAAI,CAAC,CAAC,CAAC,6CAA6C;QAC5E,MAAM,MAAM,GAAG,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC;QACxD,qFAAqF;QACrF,MAAM,IAAI,GAA4B;YACrC,EAAE,EAAE,IAAI,CAAC,EAAE;YACX,IAAI,EAAE,IAAI,CAAC,IAAI;YACf,KAAK,EAAE,IAAI,CAAC,KAAK;YACjB,KAAK,EAAE,IAAI,CAAC,KAAK;YACjB,MAAM,EAAE,IAAI,CAAC,UAAU,CAAC,MAAM;YAC9B,SAAS,EAAE,IAAI,CAAC,SAAS;YACzB,SAAS,EAAE,IAAI,CAAC,SAAS;YACzB,KAAK,EAAE,IAAI,CAAC,KAAK;YACjB,SAAS,EAAE,IAAI,CAAC,UAAU,CAAC,SAAS;SACpC,CAAC;QACF,IAAI,IAAI,CAAC,UAAU,CAAC,UAAU;YAAE,IAAI,CAAC,YAAY,CAAC,GAAG,IAAI,CAAC,UAAU,CAAC,UAAU,CAAC;QAChF,IAAI,IAAI,CAAC,UAAU,CAAC,WAAW;YAAE,IAAI,CAAC,aAAa,CAAC,GAAG,IAAI,CAAC,UAAU,CAAC,WAAW,CAAC;QACnF,eAAe,CAAC,MAAM,EAAE,OAAO,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,OAAO,GAAG,IAAI,CAAC,OAAO,GAAG,IAAI,CAAC,CAAC;IACpF,CAAC;IAED,QAAQ,CAAC,IAAc,EAAE,IAAY;QACpC,MAAM,MAAM,GAAG,IAAI,CAAC,aAAa,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC,CAAC;QAClE,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,MAAM,CAAC;YAAE,OAAO,IAAI,CAAC;QACxC,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,GAAG,gBAAgB,CAAC,EAAE,CAAC,YAAY,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;QAC1E,MAAM,MAAM,GAAG,IAAI,CAAC,QAAQ,CAAC,KAAK,OAAO,IAAI,IAAI,CAAC,QAAQ,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC;QACpG,OAAO;YACN,EAAE,EAAE,cAAc,CAAC,OAAO,IAAI,CAAC,IAAI,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,GAAG,GAAG,GAAG,IAAI,CAAC;YACnF,IAAI,EAAE,YAAY,CAAC,OAAO,IAAI,CAAC,MAAM,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;YAC1E,KAAK,EAAE,OAAO,IAAI,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,OAAO,EAAE,EAAE,CAAC;YACpF,IAAI,EAAE,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,IAAI,CAAC;YAC9B,OAAO,EAAE,IAAI;YACb,KAAK,EAAE,OAAO,IAAI,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAE,IAAI,CAAC,OAAO,CAAuB,CAAC,CAAC,CAAC,WAAW;YAC7F,SAAS,EAAE,OAAO,IAAI,CAAC,WAAW,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,EAAE;YACzE,SAAS,EAAE,OAAO,IAAI,CAAC,WAAW,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,EAAE;YACzE,UAAU,EAAE;gBACX,MAAM;gBACN,SAAS,EAAE,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,CAAE,IAAI,CAAC,WAAW,CAAc,CAAC,CAAC,CAAC,EAAE;gBAClF,UAAU,EAAE,OAAO,IAAI,CAAC,YAAY,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,SAAS;gBACnF,WAAW,EAAE,OAAO,IAAI,CAAC,aAAa,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,SAAS;aACtF;YACD,KAAK,EAAE,EAAE;SACT,CAAC;IACH,CAAC;IAED,SAAS,CAAC,IAAc;QACvB,MAAM,GAAG,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,OAAO,CAAC,CAAC;QACnD,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,GAAG,CAAC;YAAE,OAAO,EAAE,CAAC;QACnC,OAAO,EAAE,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;IACpE,CAAC;IAEO,WAAW,CAAC,IAAc,EAAE,IAAY,EAAE,MAAe;QAChE,MAAM,MAAM,GAAG,IAAI,CAAC,aAAa,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;QAC9C,EAAE,CAAC,SAAS,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QACxD,EAAE,CAAC,cAAc,CAAC,MAAM,EAAE,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,GAAG,IAAI,EAAE,OAAO,CAAC,CAAC;IACnE,CAAC;IAEO,SAAS,CAAC,IAAc,EAAE,IAAY;QAC7C,MAAM,MAAM,GAAG,IAAI,CAAC,aAAa,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;QAC9C,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,MAAM,CAAC;YAAE,OAAO,EAAE,CAAC;QACtC,MAAM,GAAG,GAAc,EAAE,CAAC;QAC1B,KAAK,MAAM,IAAI,IAAI,EAAE,CAAC,YAAY,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;YACjE,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE;gBAAE,SAAS;YAC3B,IAAI,CAAC;gBACJ,MAAM,MAAM,GAAY,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;gBACzC,IAAI,MAAM,IAAI,OAAO,MAAM,KAAK,QAAQ;oBAAE,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;YAC5D,CAAC;YAAC,MAAM,CAAC;gBACR,mCAAmC;YACpC,CAAC;QACF,CAAC;QACD,OAAO,GAAG,CAAC;IACZ,CAAC;IAED,eAAe,CAAC,SAAwB;QACvC,IAAI,CAAC,WAAW,CAAC,SAAS,CAAC,IAAI,EAAE,kBAAkB,EAAE,SAAS,CAAC,CAAC;IACjE,CAAC;IAED,kBAAkB,CAAC,IAAc,EAAE,YAA8B;QAChE,IAAI,CAAC,WAAW,CAAC,IAAI,EAAE,qBAAqB,EAAE,YAAY,CAAC,CAAC;IAC7D,CAAC;IAED,UAAU,CAAC,IAAc,EAAE,IAAc;QACxC,IAAI,CAAC,WAAW,CAAC,IAAI,EAAE,aAAa,EAAE,IAAI,CAAC,CAAC;IAC7C,CAAC;IAED,YAAY,CAAC,IAAc,EAAE,MAAkB;QAC9C,IAAI,CAAC,WAAW,CAAC,IAAI,EAAE,eAAe,EAAE,MAAM,CAAC,CAAC;IACjD,CAAC;IAED,cAAc,CAAC,IAAc;QAC5B,kFAAkF;QAClF,kFAAkF;QAClF,OAAO,IAAI,CAAC,SAAS,CAAC,IAAI,EAAE,kBAAkB,CAAC,CAAC,MAAM,CAAC,iBAAiB,CAAC,CAAC;IAC3E,CAAC;IAED,YAAY,CAAC,IAAc,EAAE,EAAU;QACtC,OAAO,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,IAAI,IAAI,CAAC;IACnE,CAAC;IAED,UAAU,CAAC,IAAc,EAAE,OAAe,EAAE,OAAyB;QACpE,MAAM,IAAI,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;QAC7E,MAAM,MAAM,GAAG,IAAI,CAAC,aAAa,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI,CAAC,YAAY,EAAE,IAAI,GAAG,cAAc,CAAC,CAAC,CAAC;QACxF,MAAM,MAAM,GAAG,8CAA8C,GAAG,OAAO,CAAC,MAAM,GAAG,YAAY,GAAG,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,QAAQ,CAAC,GAAG,IAAI,CAAC;QACxI,eAAe,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,CAAC;QAC1C,EAAE,CAAC,SAAS,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC,CAAC,mDAAmD;QAChF,OAAO,MAAM,CAAC;IACf,CAAC;CACD"}

package/dist/wiki/infrastructure/scan-patterns.d.ts

@@ -0,0 +1,20 @@
+/** Injection patterns. First 8 are verbatim from validate-content.cjs; the rest are the
+ * web-to-markdown Layer 5 local additions (tool-call hijack, memory poisoning, role-play). */
+export declare const INJECTION_PATTERNS: readonly RegExp[];
+export interface ContentValidation {
+    valid: boolean;
+    pattern?: string;
+    match?: string;
+}
+/** Mirror of validate-content.cjs: {valid:true} on pass (no pattern/match);
+ * {valid:false, pattern, match} on the first hit. */
+export declare function validateContent(text: string): ContentValidation;
+/** Secret patterns, ported verbatim from secret-scrub.cjs. Conservative: false positives
+ * accepted, missed secrets are not. Each entry is [matcher, replacement]. */
+export declare const SECRET_PATTERNS: readonly (readonly [RegExp, string])[];
+/** Mirror of secret-scrub.cjs scrubSecrets. */
+export declare function scrubSecrets(input: string): string;
+/** Strip zero-width chars and apply NFKC (catches homoglyph/zero-width obfuscation),
+ * per web-to-markdown Layer 5 pass 1. */
+export declare function normalizeForScan(text: string): string;
+//# sourceMappingURL=scan-patterns.d.ts.map

package/dist/wiki/infrastructure/scan-patterns.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"scan-patterns.d.ts","sourceRoot":"","sources":["../../../src/wiki/infrastructure/scan-patterns.ts"],"names":[],"mappings":"AASA;8FAC8F;AAC9F,eAAO,MAAM,kBAAkB,EAAE,SAAS,MAAM,EA8C/C,CAAC;AAEF,MAAM,WAAW,iBAAiB;IACjC,KAAK,EAAE,OAAO,CAAC;IACf,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,KAAK,CAAC,EAAE,MAAM,CAAC;CACf;AAED;qDACqD;AACrD,wBAAgB,eAAe,CAAC,IAAI,EAAE,MAAM,GAAG,iBAAiB,CAO/D;AAED;6EAC6E;AAC7E,eAAO,MAAM,eAAe,EAAE,SAAS,CAAC,SAAS,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,EAmBjE,CAAC;AAEF,+CAA+C;AAC/C,wBAAgB,YAAY,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAKlD;AAED;yCACyC;AACzC,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAErD"}

package/dist/wiki/infrastructure/scan-patterns.js

@@ -0,0 +1,106 @@
+// TS port of the MeowKit scanners so the wiki gate ships in dist/ (the repo-root
+// .cjs files live outside this package's rootDir and would NOT be emitted).
+// MIRROR these sources pattern-for-pattern when they change:
+//   - plugin/hooks/lib/validate-content.cjs   → INJECTION_PATTERNS + validateContent
+//   - plugin/hooks/lib/secret-scrub.cjs       → SECRET_PATTERNS + scrubSecrets
+// Local additions cite web-to-markdown security.md Layer 5 (injection) / Layer 7 (secrets).
+// A parity test (scanner-adapter.test.ts) asserts a shared payload set behaves identically
+// in the .cjs source and this port.
+/** Injection patterns. First 8 are verbatim from validate-content.cjs; the rest are the
+ * web-to-markdown Layer 5 local additions (tool-call hijack, memory poisoning, role-play). */
+export const INJECTION_PATTERNS = [
+    /ignore\s+(?:previous|all)\s+instructions/i,
+    /disregard\s+(?:rules|instructions|safety)/i,
+    /you\s+are\s+now/i,
+    /forget\s+your/i,
+    /new\s+system\s+prompt/i,
+    /<\/?memory-data[^>]*>/i,
+    /pretend\s+you\s+are/i,
+    /act\s+as\s+if/i,
+    // web-to-markdown Layer 5 local additions:
+    /your\s+(?:previous\s+)?instructions\s+(?:have\s+been\s+)?updated/i,
+    /call\s+the\s+\w+\s+tool/i,
+    /use\s+the\s+(?:bash|write|edit|read)\s+tool/i,
+    /add\s+this\s+to\s+your\s+memory/i,
+    /\bDAN\s+mode\b/i,
+    /you'?re\s+an?\s+uncensored/i,
+    // Security-audit additions (instruction-override / exfil / jailbreak / role-play):
+    /\bjailbreak\b/i,
+    /(?:reveal|print|repeat|show)\s+(?:your|the)\s+(?:system\s+)?(?:prompt|instructions)/i,
+    /(?:override|bypass|ignore)\s+(?:the\s+)?(?:safety|security|content)\s+(?:filter|policy|guidelines)/i,
+    /without\s+(?:any\s+)?restrictions?/i,
+    /exfiltrat/i,
+    /(?:send|post|upload|leak)\s+(?:the\s+)?(?:secret|token|password|api[_-]?key|env|credentials?)/i,
+    /do\s+not\s+(?:tell|inform|alert|warn)\s+(?:the\s+)?(?:user|human)/i,
+    /system\s*:\s*you\s+(?:are|must)/i,
+    /developer\s+mode\s+(?:enabled|on)/i,
+    // Expansion toward web-to-markdown Layer-5 parity. Scoped to ASSISTANT-DIRECTED
+    // phrasings only — generic shell/code terms (curl, rm -rf, execute) are intentionally NOT
+    // here, since a dev-knowledge wiki carries legitimate shell examples (avoid false-positive
+    // quarantine of real content).
+    /from\s+now\s+on[, ]+you\s+(?:are|will|must|should)/i,
+    /stay\s+in\s+character/i,
+    /roleplay\s+as/i,
+    /act\s+as\s+(?:an?\s+)?(?:dan|jailbroken|unfiltered|uncensored)/i,
+    /this\s+is\s+(?:just\s+)?a\s+test\s+of\s+your/i,
+    /decode\s+the\s+following\s+(?:base64|rot13|text|string)/i,
+    /\bsudo\s+mode\b/i,
+    /disable\s+(?:your\s+)?(?:safety|guardrails?|filters?)/i,
+    /turn\s+off\s+(?:your\s+)?safety/i,
+    /send\s+(?:it|this|them|the\s+\w+)\s+to\s+https?:\/\//i,
+    /(?:post|upload)\s+(?:the\s+)?(?:secret|token|key|data|env|file)\s+to\b/i,
+    /what\s+(?:is|are)\s+your\s+(?:initial\s+|original\s+)?instructions/i,
+    /repeat\s+the\s+(?:words|text|content)\s+above/i,
+    /ignore\s+(?:the\s+)?(?:above|preceding|prior)\b/i,
+    /override\s+(?:your\s+)?(?:prior|previous)\s+(?:directives|rules|instructions)/i,
+    /new\s+persona\b/i,
+];
+/** Mirror of validate-content.cjs: {valid:true} on pass (no pattern/match);
+ * {valid:false, pattern, match} on the first hit. */
+export function validateContent(text) {
+    if (!text)
+        return { valid: true };
+    for (const pattern of INJECTION_PATTERNS) {
+        const match = text.match(pattern);
+        if (match)
+            return { valid: false, pattern: pattern.source, match: match[0] };
+    }
+    return { valid: true };
+}
+/** Secret patterns, ported verbatim from secret-scrub.cjs. Conservative: false positives
+ * accepted, missed secrets are not. Each entry is [matcher, replacement]. */
+export const SECRET_PATTERNS = [
+    [/sk-ant-[A-Za-z0-9_-]{20,}/g, "[REDACTED-ANTHROPIC-KEY]"],
+    [/sk-[A-Za-z0-9_-]{20,}/g, "[REDACTED-OPENAI-KEY]"],
+    [/sk_(live|test)_[A-Za-z0-9]{16,}/g, "[REDACTED-STRIPE-KEY]"],
+    [/rk_(live|test)_[A-Za-z0-9]{16,}/g, "[REDACTED-STRIPE-RESTRICTED-KEY]"],
+    [/pk_(live|test)_[A-Za-z0-9]{16,}/g, "[REDACTED-STRIPE-PUB-KEY]"],
+    [/AKIA[0-9A-Z]{16}/g, "[REDACTED-AWS-KEY]"],
+    [/ghp_[A-Za-z0-9]{30,}/g, "[REDACTED-GH-TOKEN]"],
+    [/gho_[A-Za-z0-9]{30,}/g, "[REDACTED-GH-OAUTH]"],
+    [/glpat-[A-Za-z0-9_-]{20,}/g, "[REDACTED-GITLAB-PAT]"],
+    [/xox[bpars]-[0-9]+-[0-9]+-[0-9]+-[A-Za-z0-9]{24,}/g, "[REDACTED-SLACK-TOKEN]"],
+    [/https:\/\/hooks\.slack\.com\/services\/[A-Z0-9/]+/g, "[REDACTED-SLACK-WEBHOOK]"],
+    [/eyJ[A-Za-z0-9_-]{20,}\.[A-Za-z0-9_-]{20,}\.[A-Za-z0-9_-]{20,}/g, "[REDACTED-JWT]"],
+    [/-----BEGIN [A-Z ]*PRIVATE KEY-----[^-]*-----END [A-Z ]*PRIVATE KEY-----/g, "[REDACTED-PRIVATE-KEY]"],
+    [/(api[_-]?key|apikey|password|passwd|secret|token)(\s*[:=]\s*)["']?[A-Za-z0-9_/+=.-]{16,}["']?/gi, "$1$2[REDACTED]"],
+    [/Bearer [A-Za-z0-9_/+=.-]{20,}/g, "Bearer [REDACTED]"],
+    [/(mysql|postgres|postgresql|mongodb|redis):\/\/[^\s"']+/gi, "$1://[REDACTED-DB-URL]"],
+    [/[A-Za-z0-9._%+-]{3,}@[A-Za-z0-9.-]{3,}\.[A-Za-z]{2,}/g, "[REDACTED-EMAIL]"],
+    [/(MEOWKIT_[A-Z_]*(?:KEY|SECRET|TOKEN|PASSWORD))(\s*=\s*)\S{8,}/g, "$1$2[REDACTED]"],
+];
+/** Mirror of secret-scrub.cjs scrubSecrets. */
+export function scrubSecrets(input) {
+    if (typeof input !== "string" || !input)
+        return "";
+    let out = input;
+    for (const [re, replacement] of SECRET_PATTERNS)
+        out = out.replace(re, replacement);
+    return out;
+}
+/** Strip zero-width chars and apply NFKC (catches homoglyph/zero-width obfuscation),
+ * per web-to-markdown Layer 5 pass 1. */
+export function normalizeForScan(text) {
+    return text.replace(/[​‌‍]/g, "").normalize("NFKC");
+}
+//# sourceMappingURL=scan-patterns.js.map

package/dist/wiki/infrastructure/scan-patterns.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"scan-patterns.js","sourceRoot":"","sources":["../../../src/wiki/infrastructure/scan-patterns.ts"],"names":[],"mappings":"AAAA,iFAAiF;AACjF,4EAA4E;AAC5E,6DAA6D;AAC7D,qFAAqF;AACrF,+EAA+E;AAC/E,4FAA4F;AAC5F,2FAA2F;AAC3F,oCAAoC;AAEpC;8FAC8F;AAC9F,MAAM,CAAC,MAAM,kBAAkB,GAAsB;IACpD,2CAA2C;IAC3C,4CAA4C;IAC5C,kBAAkB;IAClB,gBAAgB;IAChB,wBAAwB;IACxB,wBAAwB;IACxB,sBAAsB;IACtB,gBAAgB;IAChB,2CAA2C;IAC3C,mEAAmE;IACnE,0BAA0B;IAC1B,8CAA8C;IAC9C,kCAAkC;IAClC,iBAAiB;IACjB,6BAA6B;IAC7B,mFAAmF;IACnF,gBAAgB;IAChB,sFAAsF;IACtF,qGAAqG;IACrG,qCAAqC;IACrC,YAAY;IACZ,gGAAgG;IAChG,oEAAoE;IACpE,kCAAkC;IAClC,oCAAoC;IACpC,gFAAgF;IAChF,0FAA0F;IAC1F,2FAA2F;IAC3F,+BAA+B;IAC/B,qDAAqD;IACrD,wBAAwB;IACxB,gBAAgB;IAChB,iEAAiE;IACjE,+CAA+C;IAC/C,0DAA0D;IAC1D,kBAAkB;IAClB,wDAAwD;IACxD,kCAAkC;IAClC,uDAAuD;IACvD,yEAAyE;IACzE,qEAAqE;IACrE,gDAAgD;IAChD,kDAAkD;IAClD,gFAAgF;IAChF,kBAAkB;CAClB,CAAC;AAQF;qDACqD;AACrD,MAAM,UAAU,eAAe,CAAC,IAAY;IAC3C,IAAI,CAAC,IAAI;QAAE,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC;IAClC,KAAK,MAAM,OAAO,IAAI,kBAAkB,EAAE,CAAC;QAC1C,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;QAClC,IAAI,KAAK;YAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,OAAO,EAAE,OAAO,CAAC,MAAM,EAAE,KAAK,EAAE,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC;IAC9E,CAAC;IACD,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC;AACxB,CAAC;AAED;6EAC6E;AAC7E,MAAM,CAAC,MAAM,eAAe,GAA2C;IACtE,CAAC,4BAA4B,EAAE,0BAA0B,CAAC;IAC1D,CAAC,wBAAwB,EAAE,uBAAuB,CAAC;IACnD,CAAC,kCAAkC,EAAE,uBAAuB,CAAC;IAC7D,CAAC,kCAAkC,EAAE,kCAAkC,CAAC;IACxE,CAAC,kCAAkC,EAAE,2BAA2B,CAAC;IACjE,CAAC,mBAAmB,EAAE,oBAAoB,CAAC;IAC3C,CAAC,uBAAuB,EAAE,qBAAqB,CAAC;IAChD,CAAC,uBAAuB,EAAE,qBAAqB,CAAC;IAChD,CAAC,2BAA2B,EAAE,uBAAuB,CAAC;IACtD,CAAC,mDAAmD,EAAE,wBAAwB,CAAC;IAC/E,CAAC,oDAAoD,EAAE,0BAA0B,CAAC;IAClF,CAAC,gEAAgE,EAAE,gBAAgB,CAAC;IACpF,CAAC,0EAA0E,EAAE,wBAAwB,CAAC;IACtG,CAAC,iGAAiG,EAAE,gBAAgB,CAAC;IACrH,CAAC,gCAAgC,EAAE,mBAAmB,CAAC;IACvD,CAAC,0DAA0D,EAAE,wBAAwB,CAAC;IACtF,CAAC,uDAAuD,EAAE,kBAAkB,CAAC;IAC7E,CAAC,gEAAgE,EAAE,gBAAgB,CAAC;CACpF,CAAC;AAEF,+CAA+C;AAC/C,MAAM,UAAU,YAAY,CAAC,KAAa;IACzC,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,KAAK;QAAE,OAAO,EAAE,CAAC;IACnD,IAAI,GAAG,GAAG,KAAK,CAAC;IAChB,KAAK,MAAM,CAAC,EAAE,EAAE,WAAW,CAAC,IAAI,eAAe;QAAE,GAAG,GAAG,GAAG,CAAC,OAAO,CAAC,EAAE,EAAE,WAAW,CAAC,CAAC;IACpF,OAAO,GAAG,CAAC;AACZ,CAAC;AAED;yCACyC;AACzC,MAAM,UAAU,gBAAgB,CAAC,IAAY;IAC5C,OAAO,IAAI,CAAC,OAAO,CAAC,SAAS,EAAE,EAAE,CAAC,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC;AACtD,CAAC"}

package/dist/wiki/infrastructure/scanner-adapter.d.ts

@@ -0,0 +1,10 @@
+import type { Scanner, ScanInput, ScanOutput } from "../application/ports.js";
+/** Wiki draft size ceiling (bytes). Smaller than the 10MB web-fetch cap — a single page draft. */
+export declare const MAX_CONTENT_BYTES = 1000000;
+/** Port of web-to-markdown Layer 2 `_safe_url`: http(s) only, no credentials-in-URL, no
+ * private/loopback/link-local/metadata hosts (IPv4, IPv6, IPv4-mapped, bare-decimal, octal). */
+export declare function isSafeSourceUrl(raw: string): boolean;
+export declare class ScannerAdapter implements Scanner {
+    scan(input: ScanInput): ScanOutput;
+}
+//# sourceMappingURL=scanner-adapter.d.ts.map

package/dist/wiki/infrastructure/scanner-adapter.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"scanner-adapter.d.ts","sourceRoot":"","sources":["../../../src/wiki/infrastructure/scanner-adapter.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,OAAO,EAAE,SAAS,EAAE,UAAU,EAAE,MAAM,yBAAyB,CAAC;AAU9E,kGAAkG;AAClG,eAAO,MAAM,iBAAiB,UAAY,CAAC;AAkC3C;gGACgG;AAChG,wBAAgB,eAAe,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAcpD;AAqDD,qBAAa,cAAe,YAAW,OAAO;IAC7C,IAAI,CAAC,KAAK,EAAE,SAAS,GAAG,UAAU;CAyBlC"}

package/dist/wiki/infrastructure/scanner-adapter.js

@@ -0,0 +1,147 @@
+import { normalizeForScan, scrubSecrets, validateContent } from "./scan-patterns.js";
+// The security gate (web-to-markdown layers): URL-guard → size cap → normalize
+// → multi-pass injection scan (plaintext + base64 + ROT13 + percent-decode) → flood check
+// → secret scrub. Detection only — quarantine IO and the write-token mint happen in the
+// repository/application so this stays pure and unit-testable. External + agent content is DATA.
+// Carry-forward to the fetcher re-audit: hex IP encodings, redirect re-validation, and
+// full web-to-markdown Layer-5 pattern parity (this layer has no live network egress yet).
+/** Wiki draft size ceiling (bytes). Smaller than the 10MB web-fetch cap — a single page draft. */
+export const MAX_CONTENT_BYTES = 1_000_000;
+/** Scan passes performed on clean content — satisfies the domain MIN_SCAN_PASSES floor. */
+const SCAN_PASSES = 4;
+const BLOCKED_V4 = /^(10\.|127\.|169\.254\.|192\.168\.|172\.(1[6-9]|2\d|3[01])\.|100\.(6[4-9]|[7-9]\d|1[01]\d|12[0-7])\.|198\.1[89]\.)/;
+function isBlockedIpv4(host) {
+    if (/^0x/i.test(host))
+        return true; // hex IP encoding (e.g. 0x7f000001) — no legit host starts 0x
+    if (/^\d+$/.test(host))
+        return true; // bare-decimal IP encoding (e.g. 2130706433 = 127.0.0.1)
+    if (/^0[0-9.]/.test(host))
+        return true; // octal leading-zero encoding (e.g. 0177.0.0.1)
+    if (/^\d{1,3}(\.\d{1,3}){3}$/.test(host))
+        return host === "0.0.0.0" || BLOCKED_V4.test(host);
+    return false;
+}
+function isBlockedIpv6(addr) {
+    const a = addr.toLowerCase();
+    if (a === "::1")
+        return true; // loopback
+    if (a.startsWith("fe80:"))
+        return true; // link-local
+    if (/^f[cd][0-9a-f]{0,2}:/.test(a))
+        return true; // ULA fc00::/7 (colon-anchored — no longer matches fcc.com)
+    // IPv4-mapped, dotted form: ::ffff:169.254.169.254
+    const dotted = a.match(/::ffff:(\d{1,3}(?:\.\d{1,3}){3})$/);
+    if (dotted)
+        return isBlockedIpv4(dotted[1]);
+    // IPv4-mapped, hex-compressed form the URL parser emits: ::ffff:a9fe:a9fe
+    const hex = a.match(/::ffff:([0-9a-f]{1,4}):([0-9a-f]{1,4})$/);
+    if (hex) {
+        const hi = parseInt(hex[1], 16);
+        const lo = parseInt(hex[2], 16);
+        const v4 = ((hi >> 8) & 0xff) + "." + (hi & 0xff) + "." + ((lo >> 8) & 0xff) + "." + (lo & 0xff);
+        return isBlockedIpv4(v4);
+    }
+    return false;
+}
+/** Port of web-to-markdown Layer 2 `_safe_url`: http(s) only, no credentials-in-URL, no
+ * private/loopback/link-local/metadata hosts (IPv4, IPv6, IPv4-mapped, bare-decimal, octal). */
+export function isSafeSourceUrl(raw) {
+    let url;
+    try {
+        url = new URL(raw);
+    }
+    catch {
+        return false;
+    }
+    if (url.protocol !== "http:" && url.protocol !== "https:")
+        return false;
+    if (url.username || url.password)
+        return false;
+    const host = url.hostname.toLowerCase();
+    if (host.startsWith("[") && host.endsWith("]"))
+        return !isBlockedIpv6(host.slice(1, -1));
+    if (host === "localhost" || host.endsWith(".localhost"))
+        return false;
+    if (host === "metadata.google.internal" || /^metadata\./.test(host))
+        return false;
+    return !isBlockedIpv4(host);
+}
+function rot13(text) {
+    return text.replace(/[a-zA-Z]/g, (c) => {
+        const base = c <= "Z" ? 65 : 97;
+        return String.fromCharCode(((c.charCodeAt(0) - base + 13) % 26) + base);
+    });
+}
+function percentDecode(text) {
+    try {
+        return decodeURIComponent(text);
+    }
+    catch {
+        return text; // malformed %-sequence — scan the raw form instead
+    }
+}
+/** Extract HTML-comment bodies so injection hidden in <!-- ... --> is scanned, not skipped. */
+function extractHtmlComments(text) {
+    return [...text.matchAll(/<!--([\s\S]*?)-->/g)].map((m) => m[1]);
+}
+/** Decode base64 blocks (≥16 chars catches short payloads) and return decoded strings to re-scan. */
+function decodeBase64Blocks(text) {
+    const out = [];
+    for (const m of text.matchAll(/[A-Za-z0-9+/]{16,}={0,2}/g)) {
+        try {
+            const decoded = Buffer.from(m[0], "base64").toString("utf-8");
+            if (decoded && /[ -~]/.test(decoded))
+                out.push(decoded);
+        }
+        catch {
+            // not valid base64 — ignore
+        }
+    }
+    return out;
+}
+/** Context-flooding heuristic (injection-rules R9): large + highly repetitive content. */
+function isFlood(text) {
+    if (text.length <= 5000)
+        return false;
+    const lines = text.split("\n");
+    if (lines.length >= 10)
+        return 1 - new Set(lines).size / lines.length > 0.3;
+    return new Set(text).size / text.length < 0.05;
+}
+function findInjection(passes) {
+    const findings = [];
+    for (const text of passes) {
+        const result = validateContent(text);
+        if (!result.valid && result.pattern)
+            findings.push(result.pattern);
+    }
+    return findings;
+}
+export class ScannerAdapter {
+    scan(input) {
+        const fail = (finding) => ({
+            verdict: { status: "injection", passes: SCAN_PASSES, findings: [finding] },
+            scrubbed: "",
+            secretsFound: false,
+        });
+        if (input.sourceUrl && !isSafeSourceUrl(input.sourceUrl))
+            return fail("unsafe-source-url");
+        if (Buffer.byteLength(input.content, "utf-8") > MAX_CONTENT_BYTES)
+            return fail("size-cap-exceeded");
+        const normalized = normalizeForScan(input.content);
+        const findings = findInjection([
+            normalized,
+            percentDecode(normalized),
+            rot13(normalized),
+            ...decodeBase64Blocks(normalized),
+            ...extractHtmlComments(normalized),
+        ]);
+        if (isFlood(normalized))
+            findings.push("context-flood");
+        const status = findings.length > 0 ? "injection" : "clean";
+        const scrubbed = scrubSecrets(normalized);
+        const verdict = { status, passes: SCAN_PASSES, findings };
+        return { verdict, scrubbed, secretsFound: scrubbed !== normalized };
+    }
+}
+//# sourceMappingURL=scanner-adapter.js.map

package/dist/wiki/infrastructure/scanner-adapter.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"scanner-adapter.js","sourceRoot":"","sources":["../../../src/wiki/infrastructure/scanner-adapter.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,gBAAgB,EAAE,YAAY,EAAE,eAAe,EAAE,MAAM,oBAAoB,CAAC;AAErF,+EAA+E;AAC/E,0FAA0F;AAC1F,wFAAwF;AACxF,iGAAiG;AACjG,uFAAuF;AACvF,2FAA2F;AAE3F,kGAAkG;AAClG,MAAM,CAAC,MAAM,iBAAiB,GAAG,SAAS,CAAC;AAE3C,2FAA2F;AAC3F,MAAM,WAAW,GAAG,CAAC,CAAC;AAEtB,MAAM,UAAU,GAAG,oHAAoH,CAAC;AAExI,SAAS,aAAa,CAAC,IAAY;IAClC,IAAI,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC;QAAE,OAAO,IAAI,CAAC,CAAC,8DAA8D;IAClG,IAAI,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC;QAAE,OAAO,IAAI,CAAC,CAAC,yDAAyD;IAC9F,IAAI,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC;QAAE,OAAO,IAAI,CAAC,CAAC,gDAAgD;IACxF,IAAI,yBAAyB,CAAC,IAAI,CAAC,IAAI,CAAC;QAAE,OAAO,IAAI,KAAK,SAAS,IAAI,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC7F,OAAO,KAAK,CAAC;AACd,CAAC;AAED,SAAS,aAAa,CAAC,IAAY;IAClC,MAAM,CAAC,GAAG,IAAI,CAAC,WAAW,EAAE,CAAC;IAC7B,IAAI,CAAC,KAAK,KAAK;QAAE,OAAO,IAAI,CAAC,CAAC,WAAW;IACzC,IAAI,CAAC,CAAC,UAAU,CAAC,OAAO,CAAC;QAAE,OAAO,IAAI,CAAC,CAAC,aAAa;IACrD,IAAI,sBAAsB,CAAC,IAAI,CAAC,CAAC,CAAC;QAAE,OAAO,IAAI,CAAC,CAAC,4DAA4D;IAC7G,mDAAmD;IACnD,MAAM,MAAM,GAAG,CAAC,CAAC,KAAK,CAAC,mCAAmC,CAAC,CAAC;IAC5D,IAAI,MAAM;QAAE,OAAO,aAAa,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC;IAC5C,0EAA0E;IAC1E,MAAM,GAAG,GAAG,CAAC,CAAC,KAAK,CAAC,yCAAyC,CAAC,CAAC;IAC/D,IAAI,GAAG,EAAE,CAAC;QACT,MAAM,EAAE,GAAG,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;QAChC,MAAM,EAAE,GAAG,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;QAChC,MAAM,EAAE,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC,GAAG,IAAI,CAAC,GAAG,GAAG,GAAG,CAAC,EAAE,GAAG,IAAI,CAAC,GAAG,GAAG,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC,GAAG,IAAI,CAAC,GAAG,GAAG,GAAG,CAAC,EAAE,GAAG,IAAI,CAAC,CAAC;QACjG,OAAO,aAAa,CAAC,EAAE,CAAC,CAAC;IAC1B,CAAC;IACD,OAAO,KAAK,CAAC;AACd,CAAC;AAED;gGACgG;AAChG,MAAM,UAAU,eAAe,CAAC,GAAW;IAC1C,IAAI,GAAQ,CAAC;IACb,IAAI,CAAC;QACJ,GAAG,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC;IACpB,CAAC;IAAC,MAAM,CAAC;QACR,OAAO,KAAK,CAAC;IACd,CAAC;IACD,IAAI,GAAG,CAAC,QAAQ,KAAK,OAAO,IAAI,GAAG,CAAC,QAAQ,KAAK,QAAQ;QAAE,OAAO,KAAK,CAAC;IACxE,IAAI,GAAG,CAAC,QAAQ,IAAI,GAAG,CAAC,QAAQ;QAAE,OAAO,KAAK,CAAC;IAC/C,MAAM,IAAI,GAAG,GAAG,CAAC,QAAQ,CAAC,WAAW,EAAE,CAAC;IACxC,IAAI,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC;QAAE,OAAO,CAAC,aAAa,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;IACzF,IAAI,IAAI,KAAK,WAAW,IAAI,IAAI,CAAC,QAAQ,CAAC,YAAY,CAAC;QAAE,OAAO,KAAK,CAAC;IACtE,IAAI,IAAI,KAAK,0BAA0B,IAAI,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC;QAAE,OAAO,KAAK,CAAC;IAClF,OAAO,CAAC,aAAa,CAAC,IAAI,CAAC,CAAC;AAC7B,CAAC;AAED,SAAS,KAAK,CAAC,IAAY;IAC1B,OAAO,IAAI,CAAC,OAAO,CAAC,WAAW,EAAE,CAAC,CAAC,EAAE,EAAE;QACtC,MAAM,IAAI,GAAG,CAAC,IAAI,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAChC,OAAO,MAAM,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,GAAG,IAAI,GAAG,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,IAAI,CAAC,CAAC;IACzE,CAAC,CAAC,CAAC;AACJ,CAAC;AAED,SAAS,aAAa,CAAC,IAAY;IAClC,IAAI,CAAC;QACJ,OAAO,kBAAkB,CAAC,IAAI,CAAC,CAAC;IACjC,CAAC;IAAC,MAAM,CAAC;QACR,OAAO,IAAI,CAAC,CAAC,mDAAmD;IACjE,CAAC;AACF,CAAC;AAED,+FAA+F;AAC/F,SAAS,mBAAmB,CAAC,IAAY;IACxC,OAAO,CAAC,GAAG,IAAI,CAAC,QAAQ,CAAC,oBAAoB,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AAClE,CAAC;AAED,qGAAqG;AACrG,SAAS,kBAAkB,CAAC,IAAY;IACvC,MAAM,GAAG,GAAa,EAAE,CAAC;IACzB,KAAK,MAAM,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,2BAA2B,CAAC,EAAE,CAAC;QAC5D,IAAI,CAAC;YACJ,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,QAAQ,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;YAC9D,IAAI,OAAO,IAAI,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC;gBAAE,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QACzD,CAAC;QAAC,MAAM,CAAC;YACR,4BAA4B;QAC7B,CAAC;IACF,CAAC;IACD,OAAO,GAAG,CAAC;AACZ,CAAC;AAED,0FAA0F;AAC1F,SAAS,OAAO,CAAC,IAAY;IAC5B,IAAI,IAAI,CAAC,MAAM,IAAI,IAAI;QAAE,OAAO,KAAK,CAAC;IACtC,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IAC/B,IAAI,KAAK,CAAC,MAAM,IAAI,EAAE;QAAE,OAAO,CAAC,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC,IAAI,GAAG,KAAK,CAAC,MAAM,GAAG,GAAG,CAAC;IAC5E,OAAO,IAAI,GAAG,CAAC,IAAI,CAAC,CAAC,IAAI,GAAG,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC;AAChD,CAAC;AAED,SAAS,aAAa,CAAC,MAAgB;IACtC,MAAM,QAAQ,GAAa,EAAE,CAAC;IAC9B,KAAK,MAAM,IAAI,IAAI,MAAM,EAAE,CAAC;QAC3B,MAAM,MAAM,GAAG,eAAe,CAAC,IAAI,CAAC,CAAC;QACrC,IAAI,CAAC,MAAM,CAAC,KAAK,IAAI,MAAM,CAAC,OAAO;YAAE,QAAQ,CAAC,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;IACpE,CAAC;IACD,OAAO,QAAQ,CAAC;AACjB,CAAC;AAED,MAAM,OAAO,cAAc;IAC1B,IAAI,CAAC,KAAgB;QACpB,MAAM,IAAI,GAAG,CAAC,OAAe,EAAc,EAAE,CAAC,CAAC;YAC9C,OAAO,EAAE,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,EAAE,WAAW,EAAE,QAAQ,EAAE,CAAC,OAAO,CAAC,EAAE;YAC1E,QAAQ,EAAE,EAAE;YACZ,YAAY,EAAE,KAAK;SACnB,CAAC,CAAC;QAEH,IAAI,KAAK,CAAC,SAAS,IAAI,CAAC,eAAe,CAAC,KAAK,CAAC,SAAS,CAAC;YAAE,OAAO,IAAI,CAAC,mBAAmB,CAAC,CAAC;QAC3F,IAAI,MAAM,CAAC,UAAU,CAAC,KAAK,CAAC,OAAO,EAAE,OAAO,CAAC,GAAG,iBAAiB;YAAE,OAAO,IAAI,CAAC,mBAAmB,CAAC,CAAC;QAEpG,MAAM,UAAU,GAAG,gBAAgB,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;QACnD,MAAM,QAAQ,GAAG,aAAa,CAAC;YAC9B,UAAU;YACV,aAAa,CAAC,UAAU,CAAC;YACzB,KAAK,CAAC,UAAU,CAAC;YACjB,GAAG,kBAAkB,CAAC,UAAU,CAAC;YACjC,GAAG,mBAAmB,CAAC,UAAU,CAAC;SAClC,CAAC,CAAC;QACH,IAAI,OAAO,CAAC,UAAU,CAAC;YAAE,QAAQ,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC;QACxD,MAAM,MAAM,GAAG,QAAQ,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,OAAO,CAAC;QAE3D,MAAM,QAAQ,GAAG,YAAY,CAAC,UAAU,CAAC,CAAC;QAC1C,MAAM,OAAO,GAAqB,EAAE,MAAM,EAAE,MAAM,EAAE,WAAW,EAAE,QAAQ,EAAE,CAAC;QAC5E,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,YAAY,EAAE,QAAQ,KAAK,UAAU,EAAE,CAAC;IACrE,CAAC;CACD"}

package/dist/wiki/infrastructure/sqlite-index.d.ts

@@ -0,0 +1,9 @@
+import type { WikiPage } from "../domain/index.js";
+import type { WikiIndex, WikiSearchHit } from "../application/ports.js";
+export declare class SqliteWikiIndex implements WikiIndex {
+    private readonly dbFile;
+    constructor(dbFile: string);
+    upsertPage(page: WikiPage): void;
+    searchFts(query: string, limit?: number): WikiSearchHit[];
+}
+//# sourceMappingURL=sqlite-index.d.ts.map

package/dist/wiki/infrastructure/sqlite-index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sqlite-index.d.ts","sourceRoot":"","sources":["../../../src/wiki/infrastructure/sqlite-index.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,oBAAoB,CAAC;AACnD,OAAO,KAAK,EAAE,SAAS,EAAE,aAAa,EAAE,MAAM,yBAAyB,CAAC;AASxE,qBAAa,eAAgB,YAAW,SAAS;IACpC,OAAO,CAAC,QAAQ,CAAC,MAAM;gBAAN,MAAM,EAAE,MAAM;IAE3C,UAAU,CAAC,IAAI,EAAE,QAAQ,GAAG,IAAI;IA8BhC,SAAS,CAAC,KAAK,EAAE,MAAM,EAAE,KAAK,SAAK,GAAG,aAAa,EAAE;CAGrD"}

package/dist/wiki/infrastructure/sqlite-index.js

@@ -0,0 +1,36 @@
+import { DatabaseSync } from "node:sqlite";
+import { searchWiki } from "./wiki-query.js";
+// Live read/upsert adapter over the consolidated wiki-index.db. Reads go
+// through the read-only searchWiki helper; the single live mutation is page upsert. Upsert is
+// an explicit DELETE then INSERT (not INSERT OR REPLACE): the explicit DELETE always fires the
+// wiki_page AFTER DELETE trigger, keeping wiki_fts in sync — REPLACE's implicit delete would
+// not fire it under the default recursive_triggers=off and would strand a duplicate FTS row.
+export class SqliteWikiIndex {
+    dbFile;
+    constructor(dbFile) {
+        this.dbFile = dbFile;
+    }
+    upsertPage(page) {
+        const db = new DatabaseSync(this.dbFile);
+        try {
+            db.exec("PRAGMA journal_mode = WAL");
+            db.exec("BEGIN IMMEDIATE");
+            try {
+                db.prepare("DELETE FROM wiki_page WHERE id = ?").run(page.id);
+                db.prepare("INSERT INTO wiki_page (id, slug, title, path, content, state, origin, created_at, updated_at) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?)").run(page.id, page.slug, page.title, page.path, page.content, page.state, page.provenance.origin, page.createdAt, page.updatedAt);
+                db.exec("COMMIT");
+            }
+            catch (err) {
+                db.exec("ROLLBACK");
+                throw err;
+            }
+        }
+        finally {
+            db.close();
+        }
+    }
+    searchFts(query, limit = 10) {
+        return searchWiki(this.dbFile, query, limit);
+    }
+}
+//# sourceMappingURL=sqlite-index.js.map

package/dist/wiki/infrastructure/sqlite-index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sqlite-index.js","sourceRoot":"","sources":["../../../src/wiki/infrastructure/sqlite-index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAG3C,OAAO,EAAE,UAAU,EAAE,MAAM,iBAAiB,CAAC;AAE7C,yEAAyE;AACzE,8FAA8F;AAC9F,+FAA+F;AAC/F,6FAA6F;AAC7F,6FAA6F;AAE7F,MAAM,OAAO,eAAe;IACE;IAA7B,YAA6B,MAAc;QAAd,WAAM,GAAN,MAAM,CAAQ;IAAG,CAAC;IAE/C,UAAU,CAAC,IAAc;QACxB,MAAM,EAAE,GAAG,IAAI,YAAY,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QACzC,IAAI,CAAC;YACJ,EAAE,CAAC,IAAI,CAAC,2BAA2B,CAAC,CAAC;YACrC,EAAE,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAC;YAC3B,IAAI,CAAC;gBACJ,EAAE,CAAC,OAAO,CAAC,oCAAoC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;gBAC9D,EAAE,CAAC,OAAO,CACT,kIAAkI,CAClI,CAAC,GAAG,CACJ,IAAI,CAAC,EAAE,EACP,IAAI,CAAC,IAAI,EACT,IAAI,CAAC,KAAK,EACV,IAAI,CAAC,IAAI,EACT,IAAI,CAAC,OAAO,EACZ,IAAI,CAAC,KAAK,EACV,IAAI,CAAC,UAAU,CAAC,MAAM,EACtB,IAAI,CAAC,SAAS,EACd,IAAI,CAAC,SAAS,CACd,CAAC;gBACF,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;YACnB,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACd,EAAE,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;gBACpB,MAAM,GAAG,CAAC;YACX,CAAC;QACF,CAAC;gBAAS,CAAC;YACV,EAAE,CAAC,KAAK,EAAE,CAAC;QACZ,CAAC;IACF,CAAC;IAED,SAAS,CAAC,KAAa,EAAE,KAAK,GAAG,EAAE;QAClC,OAAO,UAAU,CAAC,IAAI,CAAC,MAAM,EAAE,KAAK,EAAE,KAAK,CAAC,CAAC;IAC9C,CAAC;CACD"}