mewkit 1.11.2 → 1.12.1

package/dist/wiki/domain/write-decision.js

@@ -0,0 +1,71 @@
+// Write-decision logic. Maps a salience score + scan verdict + dup
+// check onto a write decision. By construction this NEVER decides to write a
+// canonical page — the strongest outcome is a candidate. Canonical pages come
+// only from the human approve path in the application layer.
+import { isClean } from "./types.js";
+/** Salience thresholds, kept in one place for tuning. */
+export const SALIENCE_THRESHOLDS = {
+    /** Total ≥ this proposes a candidate for human approval. */
+    proposeCandidate: 8,
+    /** Total ≥ this, with a strong verified signal, may auto-append to
+     * candidates.jsonl (still never a canonical page). */
+    appendCandidate: 10,
+};
+/** Minimum scan passes for a "clean" verdict to be trusted. A clean
+ * verdict with fewer passes is treated as
+ * incompletely scanned and quarantined — `isClean` reports findings only, it
+ * does NOT imply the content was scanned enough to write. */
+export const MIN_SCAN_PASSES = 2;
+/** A "strong verified signal" (accepted fix + passing tests +
+ * human-authored note) is encoded as the verified_outcome component at its max.
+ * Callers set verified_outcome to 3 only when that bundle holds. */
+function hasStrongVerifiedSignal(score) {
+    return score.components.verified_outcome >= 3;
+}
+/**
+ * Decide what to do with a proposed write. Precedence:
+ *  1. Any injection/secret finding → quarantine (security wins over salience).
+ *  2. A clean verdict with too few scan passes → quarantine (incompletely scanned).
+ *  3. High duplication → link to the existing page, never a new one.
+ *  4. Total ≥ 10 with a strong verified signal → append to candidates.jsonl.
+ *  5. Total ≥ 8 and scan clean → propose a candidate for approval.
+ *  6. Otherwise → discard.
+ */
+export function decideWrite(score, verdict, dup) {
+    if (!isClean(verdict)) {
+        return {
+            kind: "quarantine",
+            reason: `scan found ${verdict.status}; quarantined`,
+        };
+    }
+    if (verdict.passes < MIN_SCAN_PASSES) {
+        return {
+            kind: "quarantine",
+            reason: `scan incomplete (${verdict.passes} < ${MIN_SCAN_PASSES} passes); quarantined pending full scan`,
+        };
+    }
+    if (dup.isHighDuplicate && dup.existingPageId) {
+        return {
+            kind: "link-existing",
+            existingPageId: dup.existingPageId,
+            reason: "high duplication; linked to existing page",
+        };
+    }
+    if (score.total >= SALIENCE_THRESHOLDS.appendCandidate && hasStrongVerifiedSignal(score)) {
+        return {
+            kind: "append-candidate",
+            reason: `salience ${score.total} ≥ ${SALIENCE_THRESHOLDS.appendCandidate} with verified signal`,
+        };
+    }
+    if (score.total >= SALIENCE_THRESHOLDS.proposeCandidate) {
+        return {
+            kind: "propose-candidate",
+            reason: `salience ${score.total} ≥ ${SALIENCE_THRESHOLDS.proposeCandidate}`,
+        };
+    }
+    return {
+        kind: "discard",
+        reason: `salience ${score.total} below threshold ${SALIENCE_THRESHOLDS.proposeCandidate}`,
+    };
+}
+//# sourceMappingURL=write-decision.js.map

package/dist/wiki/domain/write-decision.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"write-decision.js","sourceRoot":"","sources":["../../../src/wiki/domain/write-decision.ts"],"names":[],"mappings":"AAAA,mEAAmE;AACnE,6EAA6E;AAC7E,8EAA8E;AAC9E,6DAA6D;AAQ7D,OAAO,EAAE,OAAO,EAAE,MAAM,YAAY,CAAC;AAErC,yDAAyD;AACzD,MAAM,CAAC,MAAM,mBAAmB,GAAG;IAClC,4DAA4D;IAC5D,gBAAgB,EAAE,CAAC;IACnB;0DACsD;IACtD,eAAe,EAAE,EAAE;CACV,CAAC;AAEX;;;6DAG6D;AAC7D,MAAM,CAAC,MAAM,eAAe,GAAG,CAAC,CAAC;AAEjC;;oEAEoE;AACpE,SAAS,uBAAuB,CAAC,KAAoB;IACpD,OAAO,KAAK,CAAC,UAAU,CAAC,gBAAgB,IAAI,CAAC,CAAC;AAC/C,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,WAAW,CAC1B,KAAoB,EACpB,OAAyB,EACzB,GAAa;IAEb,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;QACvB,OAAO;YACN,IAAI,EAAE,YAAY;YAClB,MAAM,EAAE,cAAc,OAAO,CAAC,MAAM,eAAe;SACnD,CAAC;IACH,CAAC;IAED,IAAI,OAAO,CAAC,MAAM,GAAG,eAAe,EAAE,CAAC;QACtC,OAAO;YACN,IAAI,EAAE,YAAY;YAClB,MAAM,EAAE,oBAAoB,OAAO,CAAC,MAAM,MAAM,eAAe,yCAAyC;SACxG,CAAC;IACH,CAAC;IAED,IAAI,GAAG,CAAC,eAAe,IAAI,GAAG,CAAC,cAAc,EAAE,CAAC;QAC/C,OAAO;YACN,IAAI,EAAE,eAAe;YACrB,cAAc,EAAE,GAAG,CAAC,cAAc;YAClC,MAAM,EAAE,2CAA2C;SACnD,CAAC;IACH,CAAC;IAED,IAAI,KAAK,CAAC,KAAK,IAAI,mBAAmB,CAAC,eAAe,IAAI,uBAAuB,CAAC,KAAK,CAAC,EAAE,CAAC;QAC1F,OAAO;YACN,IAAI,EAAE,kBAAkB;YACxB,MAAM,EAAE,YAAY,KAAK,CAAC,KAAK,MAAM,mBAAmB,CAAC,eAAe,uBAAuB;SAC/F,CAAC;IACH,CAAC;IAED,IAAI,KAAK,CAAC,KAAK,IAAI,mBAAmB,CAAC,gBAAgB,EAAE,CAAC;QACzD,OAAO;YACN,IAAI,EAAE,mBAAmB;YACzB,MAAM,EAAE,YAAY,KAAK,CAAC,KAAK,MAAM,mBAAmB,CAAC,gBAAgB,EAAE;SAC3E,CAAC;IACH,CAAC;IAED,OAAO;QACN,IAAI,EAAE,SAAS;QACf,MAAM,EAAE,YAAY,KAAK,CAAC,KAAK,oBAAoB,mBAAmB,CAAC,gBAAgB,EAAE;KACzF,CAAC;AACH,CAAC"}

package/dist/wiki/infrastructure/fetcher-adapter.d.ts

@@ -0,0 +1,45 @@
+import type { WikiSeed } from "../domain/index.js";
+import type { Fetcher, FetchedDoc } from "../application/ports.js";
+interface FetchResponse {
+    status: number;
+    ok: boolean;
+    headers: {
+        get(name: string): string | null;
+    };
+    body: {
+        getReader(): {
+            read(): Promise<{
+                done: boolean;
+                value?: Uint8Array;
+            }>;
+            cancel(): Promise<void>;
+        };
+    } | null;
+    text(): Promise<string>;
+}
+export type FetchImpl = (url: string, init: {
+    redirect: "manual";
+    signal: unknown;
+    headers: Record<string, string>;
+}) => Promise<FetchResponse>;
+export interface FetcherOptions {
+    fetchImpl?: FetchImpl;
+    maxBytes?: number;
+    maxHops?: number;
+    timeoutMs?: number;
+}
+export declare class FetcherAdapter implements Fetcher {
+    private readonly fetchImpl;
+    private readonly maxBytes;
+    private readonly maxHops;
+    private readonly timeoutMs;
+    constructor(opts?: FetcherOptions);
+    /** Map a seed to a fetch URL. Web seeds carry a URL; arXiv/GitHub map to their public APIs. */
+    buildUrl(seed: WikiSeed): string;
+    fetch(seed: WikiSeed): Promise<FetchedDoc>;
+    /** url-guard at EVERY hop; manual redirects; size cap; timeout. */
+    private safeGet;
+    private readCapped;
+}
+export {};
+//# sourceMappingURL=fetcher-adapter.d.ts.map

package/dist/wiki/infrastructure/fetcher-adapter.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"fetcher-adapter.d.ts","sourceRoot":"","sources":["../../../src/wiki/infrastructure/fetcher-adapter.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,QAAQ,EAAc,MAAM,oBAAoB,CAAC;AAC/D,OAAO,KAAK,EAAE,OAAO,EAAE,UAAU,EAAE,MAAM,yBAAyB,CAAC;AAUnE,UAAU,aAAa;IACtB,MAAM,EAAE,MAAM,CAAC;IACf,EAAE,EAAE,OAAO,CAAC;IACZ,OAAO,EAAE;QAAE,GAAG,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAAA;KAAE,CAAC;IAC9C,IAAI,EAAE;QAAE,SAAS,IAAI;YAAE,IAAI,IAAI,OAAO,CAAC;gBAAE,IAAI,EAAE,OAAO,CAAC;gBAAC,KAAK,CAAC,EAAE,UAAU,CAAA;aAAE,CAAC,CAAC;YAAC,MAAM,IAAI,OAAO,CAAC,IAAI,CAAC,CAAA;SAAE,CAAA;KAAE,GAAG,IAAI,CAAC;IAClH,IAAI,IAAI,OAAO,CAAC,MAAM,CAAC,CAAC;CACxB;AACD,MAAM,MAAM,SAAS,GAAG,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE;IAAE,QAAQ,EAAE,QAAQ,CAAC;IAAC,MAAM,EAAE,OAAO,CAAC;IAAC,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;CAAE,KAAK,OAAO,CAAC,aAAa,CAAC,CAAC;AAEhJ,MAAM,WAAW,cAAc;IAC9B,SAAS,CAAC,EAAE,SAAS,CAAC;IACtB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,SAAS,CAAC,EAAE,MAAM,CAAC;CACnB;AAMD,qBAAa,cAAe,YAAW,OAAO;IAC7C,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAY;IACtC,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAS;IAClC,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAS;IACjC,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAS;gBAEvB,IAAI,GAAE,cAAmB;IAQrC,+FAA+F;IAC/F,QAAQ,CAAC,IAAI,EAAE,QAAQ,GAAG,MAAM;IAa1B,KAAK,CAAC,IAAI,EAAE,QAAQ,GAAG,OAAO,CAAC,UAAU,CAAC;IAahD,mEAAmE;YACrD,OAAO;YA2BP,UAAU;CAqBxB"}

package/dist/wiki/infrastructure/fetcher-adapter.js

@@ -0,0 +1,99 @@
+import { createHash } from "node:crypto";
+import { isSafeSourceUrl, MAX_CONTENT_BYTES } from "./scanner-adapter.js";
+function sha16(s) {
+    return createHash("sha256").update(s).digest("hex").slice(0, 16);
+}
+export class FetcherAdapter {
+    fetchImpl;
+    maxBytes;
+    maxHops;
+    timeoutMs;
+    constructor(opts = {}) {
+        // Builtin fetch is structurally compatible with FetchResponse (undici). Cast at the boundary.
+        this.fetchImpl = opts.fetchImpl ?? globalThis.fetch;
+        this.maxBytes = opts.maxBytes ?? MAX_CONTENT_BYTES;
+        this.maxHops = opts.maxHops ?? 3;
+        this.timeoutMs = opts.timeoutMs ?? 15000;
+    }
+    /** Map a seed to a fetch URL. Web seeds carry a URL; arXiv/GitHub map to their public APIs. */
+    buildUrl(seed) {
+        switch (seed.kind) {
+            case "web":
+                return seed.query;
+            case "arxiv":
+                return "http://export.arxiv.org/api/query?search_query=all:" + encodeURIComponent(seed.query) + "&max_results=1";
+            case "github":
+                return "https://api.github.com/search/repositories?q=" + encodeURIComponent(seed.query) + "&per_page=1";
+            default:
+                throw new Error("seed kind is not fetchable: " + seed.kind);
+        }
+    }
+    async fetch(seed) {
+        const url = this.buildUrl(seed);
+        const content = await this.safeGet(url);
+        const source = {
+            id: "src-" + sha16(url),
+            kind: seed.kind,
+            url,
+            fetchedAt: new Date().toISOString(),
+            contentHash: sha16(content),
+        };
+        return { content, sourceUrl: url, source };
+    }
+    /** url-guard at EVERY hop; manual redirects; size cap; timeout. */
+    async safeGet(startUrl) {
+        let url = startUrl;
+        for (let hop = 0; hop <= this.maxHops; hop++) {
+            if (!isSafeSourceUrl(url))
+                throw new Error("blocked unsafe URL: " + url);
+            const ctrl = new AbortController();
+            const timer = setTimeout(() => ctrl.abort(), this.timeoutMs);
+            let res;
+            try {
+                res = await this.fetchImpl(url, { redirect: "manual", signal: ctrl.signal, headers: { "user-agent": "mewkit-wiki-research" } });
+            }
+            finally {
+                clearTimeout(timer);
+            }
+            if (res.status >= 300 && res.status < 400) {
+                const loc = res.headers.get("location");
+                if (!loc)
+                    throw new Error("redirect without Location header");
+                url = new URL(loc, url).toString(); // resolve relative; re-validated at loop top
+                continue;
+            }
+            if (!res.ok)
+                throw new Error("fetch failed: HTTP " + res.status);
+            const cl = Number(res.headers.get("content-length") ?? "0");
+            // Finite-guard: a non-numeric header coerces to NaN; the streaming cap is the real backstop.
+            if (Number.isFinite(cl) && cl > this.maxBytes)
+                throw new Error("size cap exceeded (content-length)");
+            return await this.readCapped(res);
+        }
+        throw new Error("too many redirects (> " + this.maxHops + ")");
+    }
+    async readCapped(res) {
+        // Fail closed on a body-less response — res.text() would read unbounded into memory with
+        // no streaming cap. A normal GET 200 always exposes a readable body.
+        if (!res.body)
+            throw new Error("response has no readable body");
+        const reader = res.body.getReader();
+        const chunks = [];
+        let total = 0;
+        for (;;) {
+            const { done, value } = await reader.read();
+            if (done)
+                break;
+            if (value) {
+                total += value.length;
+                if (total > this.maxBytes) {
+                    await reader.cancel();
+                    throw new Error("size cap exceeded during stream");
+                }
+                chunks.push(value);
+            }
+        }
+        return Buffer.concat(chunks).toString("utf-8");
+    }
+}
+//# sourceMappingURL=fetcher-adapter.js.map

package/dist/wiki/infrastructure/fetcher-adapter.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"fetcher-adapter.js","sourceRoot":"","sources":["../../../src/wiki/infrastructure/fetcher-adapter.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAGzC,OAAO,EAAE,eAAe,EAAE,iBAAiB,EAAE,MAAM,sBAAsB,CAAC;AAyB1E,SAAS,KAAK,CAAC,CAAS;IACvB,OAAO,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;AAClE,CAAC;AAED,MAAM,OAAO,cAAc;IACT,SAAS,CAAY;IACrB,QAAQ,CAAS;IACjB,OAAO,CAAS;IAChB,SAAS,CAAS;IAEnC,YAAY,OAAuB,EAAE;QACpC,8FAA8F;QAC9F,IAAI,CAAC,SAAS,GAAG,IAAI,CAAC,SAAS,IAAK,UAAU,CAAC,KAA8B,CAAC;QAC9E,IAAI,CAAC,QAAQ,GAAG,IAAI,CAAC,QAAQ,IAAI,iBAAiB,CAAC;QACnD,IAAI,CAAC,OAAO,GAAG,IAAI,CAAC,OAAO,IAAI,CAAC,CAAC;QACjC,IAAI,CAAC,SAAS,GAAG,IAAI,CAAC,SAAS,IAAI,KAAK,CAAC;IAC1C,CAAC;IAED,+FAA+F;IAC/F,QAAQ,CAAC,IAAc;QACtB,QAAQ,IAAI,CAAC,IAAI,EAAE,CAAC;YACnB,KAAK,KAAK;gBACT,OAAO,IAAI,CAAC,KAAK,CAAC;YACnB,KAAK,OAAO;gBACX,OAAO,qDAAqD,GAAG,kBAAkB,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,gBAAgB,CAAC;YAClH,KAAK,QAAQ;gBACZ,OAAO,+CAA+C,GAAG,kBAAkB,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,aAAa,CAAC;YACzG;gBACC,MAAM,IAAI,KAAK,CAAC,8BAA8B,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC;QAC9D,CAAC;IACF,CAAC;IAED,KAAK,CAAC,KAAK,CAAC,IAAc;QACzB,MAAM,GAAG,GAAG,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;QAChC,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QACxC,MAAM,MAAM,GAAe;YAC1B,EAAE,EAAE,MAAM,GAAG,KAAK,CAAC,GAAG,CAAC;YACvB,IAAI,EAAE,IAAI,CAAC,IAAI;YACf,GAAG;YACH,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;YACnC,WAAW,EAAE,KAAK,CAAC,OAAO,CAAC;SAC3B,CAAC;QACF,OAAO,EAAE,OAAO,EAAE,SAAS,EAAE,GAAG,EAAE,MAAM,EAAE,CAAC;IAC5C,CAAC;IAED,mEAAmE;IAC3D,KAAK,CAAC,OAAO,CAAC,QAAgB;QACrC,IAAI,GAAG,GAAG,QAAQ,CAAC;QACnB,KAAK,IAAI,GAAG,GAAG,CAAC,EAAE,GAAG,IAAI,IAAI,CAAC,OAAO,EAAE,GAAG,EAAE,EAAE,CAAC;YAC9C,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC;gBAAE,MAAM,IAAI,KAAK,CAAC,sBAAsB,GAAG,GAAG,CAAC,CAAC;YACzE,MAAM,IAAI,GAAG,IAAI,eAAe,EAAE,CAAC;YACnC,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,KAAK,EAAE,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC;YAC7D,IAAI,GAAkB,CAAC;YACvB,IAAI,CAAC;gBACJ,GAAG,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,QAAQ,EAAE,QAAQ,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,OAAO,EAAE,EAAE,YAAY,EAAE,sBAAsB,EAAE,EAAE,CAAC,CAAC;YACjI,CAAC;oBAAS,CAAC;gBACV,YAAY,CAAC,KAAK,CAAC,CAAC;YACrB,CAAC;YACD,IAAI,GAAG,CAAC,MAAM,IAAI,GAAG,IAAI,GAAG,CAAC,MAAM,GAAG,GAAG,EAAE,CAAC;gBAC3C,MAAM,GAAG,GAAG,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;gBACxC,IAAI,CAAC,GAAG;oBAAE,MAAM,IAAI,KAAK,CAAC,kCAAkC,CAAC,CAAC;gBAC9D,GAAG,GAAG,IAAI,GAAG,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC,QAAQ,EAAE,CAAC,CAAC,6CAA6C;gBACjF,SAAS;YACV,CAAC;YACD,IAAI,CAAC,GAAG,CAAC,EAAE;gBAAE,MAAM,IAAI,KAAK,CAAC,qBAAqB,GAAG,GAAG,CAAC,MAAM,CAAC,CAAC;YACjE,MAAM,EAAE,GAAG,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,gBAAgB,CAAC,IAAI,GAAG,CAAC,CAAC;YAC5D,6FAA6F;YAC7F,IAAI,MAAM,CAAC,QAAQ,CAAC,EAAE,CAAC,IAAI,EAAE,GAAG,IAAI,CAAC,QAAQ;gBAAE,MAAM,IAAI,KAAK,CAAC,oCAAoC,CAAC,CAAC;YACrG,OAAO,MAAM,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC;QACnC,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,wBAAwB,GAAG,IAAI,CAAC,OAAO,GAAG,GAAG,CAAC,CAAC;IAChE,CAAC;IAEO,KAAK,CAAC,UAAU,CAAC,GAAkB;QAC1C,yFAAyF;QACzF,qEAAqE;QACrE,IAAI,CAAC,GAAG,CAAC,IAAI;YAAE,MAAM,IAAI,KAAK,CAAC,+BAA+B,CAAC,CAAC;QAChE,MAAM,MAAM,GAAG,GAAG,CAAC,IAAI,CAAC,SAAS,EAAE,CAAC;QACpC,MAAM,MAAM,GAAiB,EAAE,CAAC;QAChC,IAAI,KAAK,GAAG,CAAC,CAAC;QACd,SAAS,CAAC;YACT,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,MAAM,MAAM,CAAC,IAAI,EAAE,CAAC;YAC5C,IAAI,IAAI;gBAAE,MAAM;YAChB,IAAI,KAAK,EAAE,CAAC;gBACX,KAAK,IAAI,KAAK,CAAC,MAAM,CAAC;gBACtB,IAAI,KAAK,GAAG,IAAI,CAAC,QAAQ,EAAE,CAAC;oBAC3B,MAAM,MAAM,CAAC,MAAM,EAAE,CAAC;oBACtB,MAAM,IAAI,KAAK,CAAC,iCAAiC,CAAC,CAAC;gBACpD,CAAC;gBACD,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;YACpB,CAAC;QACF,CAAC;QACD,OAAO,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;IAChD,CAAC;CACD"}

package/dist/wiki/infrastructure/inventory-adapter.d.ts

@@ -0,0 +1,13 @@
+import type { InventoryRegistrar } from "../application/ports.js";
+/** The wiki serves the existing "project-memory" responsibility (see core/substrate.ts TAXONOMY). */
+export declare const WIKI_RESPONSIBILITY = "project-memory";
+export declare class InventoryAdapter implements InventoryRegistrar {
+    private readonly claudeDir;
+    constructor(claudeDir: string);
+    private file;
+    register(artifactPath: string, meta?: {
+        criticality?: string;
+        status?: string;
+    }): void;
+}
+//# sourceMappingURL=inventory-adapter.d.ts.map

package/dist/wiki/infrastructure/inventory-adapter.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"inventory-adapter.d.ts","sourceRoot":"","sources":["../../../src/wiki/infrastructure/inventory-adapter.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,yBAAyB,CAAC;AAOlE,qGAAqG;AACrG,eAAO,MAAM,mBAAmB,mBAAmB,CAAC;AAOpD,qBAAa,gBAAiB,YAAW,kBAAkB;IAC9C,OAAO,CAAC,QAAQ,CAAC,SAAS;gBAAT,SAAS,EAAE,MAAM;IAE9C,OAAO,CAAC,IAAI;IAIZ,QAAQ,CAAC,YAAY,EAAE,MAAM,EAAE,IAAI,GAAE;QAAE,WAAW,CAAC,EAAE,MAAM,CAAC;QAAC,MAAM,CAAC,EAAE,MAAM,CAAA;KAAO,GAAG,IAAI;CA0B1F"}

package/dist/wiki/infrastructure/inventory-adapter.js

@@ -0,0 +1,46 @@
+import fs from "node:fs";
+import path from "node:path";
+// Registers wiki harness artifacts into .claude/harness-inventory.json under an existing
+// taxonomy value. The wiki IS long-term project memory, so it reuses "project-memory" — no
+// new taxonomy enum value is needed (decided, not assumed). Idempotent: re-registering the
+// same path is a no-op, so `mewkit inventory --substrate` shows no drift on repeat runs.
+/** The wiki serves the existing "project-memory" responsibility (see core/substrate.ts TAXONOMY). */
+export const WIKI_RESPONSIBILITY = "project-memory";
+export class InventoryAdapter {
+    claudeDir;
+    constructor(claudeDir) {
+        this.claudeDir = claudeDir;
+    }
+    file() {
+        return path.join(this.claudeDir, "harness-inventory.json");
+    }
+    register(artifactPath, meta = {}) {
+        const file = this.file();
+        if (!fs.existsSync(file))
+            return; // no registry in this tree — nothing to tag
+        let parsed;
+        try {
+            parsed = JSON.parse(fs.readFileSync(file, "utf-8"));
+        }
+        catch {
+            return; // tolerant: a malformed registry is not this adapter's to repair
+        }
+        if (!parsed.artifacts || typeof parsed.artifacts !== "object")
+            return;
+        const desired = {
+            owner: "lifecycle",
+            criticality: meta.criticality ?? "medium",
+            status: meta.status ?? "active",
+            runtime: "portable",
+            responsibility: WIKI_RESPONSIBILITY,
+        };
+        const existing = parsed.artifacts[artifactPath];
+        if (existing && JSON.stringify(existing) === JSON.stringify(desired))
+            return; // idempotent
+        parsed.artifacts[artifactPath] = desired;
+        const tmp = file + ".tmp-" + process.pid;
+        fs.writeFileSync(tmp, JSON.stringify(parsed, null, 2) + "\n", "utf-8");
+        fs.renameSync(tmp, file);
+    }
+}
+//# sourceMappingURL=inventory-adapter.js.map

package/dist/wiki/infrastructure/inventory-adapter.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"inventory-adapter.js","sourceRoot":"","sources":["../../../src/wiki/infrastructure/inventory-adapter.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,IAAI,MAAM,WAAW,CAAC;AAG7B,yFAAyF;AACzF,2FAA2F;AAC3F,2FAA2F;AAC3F,yFAAyF;AAEzF,qGAAqG;AACrG,MAAM,CAAC,MAAM,mBAAmB,GAAG,gBAAgB,CAAC;AAOpD,MAAM,OAAO,gBAAgB;IACC;IAA7B,YAA6B,SAAiB;QAAjB,cAAS,GAAT,SAAS,CAAQ;IAAG,CAAC;IAE1C,IAAI;QACX,OAAO,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,wBAAwB,CAAC,CAAC;IAC5D,CAAC;IAED,QAAQ,CAAC,YAAoB,EAAE,OAAkD,EAAE;QAClF,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;QACzB,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC;YAAE,OAAO,CAAC,4CAA4C;QAC9E,IAAI,MAAqB,CAAC;QAC1B,IAAI,CAAC;YACJ,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,YAAY,CAAC,IAAI,EAAE,OAAO,CAAC,CAAkB,CAAC;QACtE,CAAC;QAAC,MAAM,CAAC;YACR,OAAO,CAAC,iEAAiE;QAC1E,CAAC;QACD,IAAI,CAAC,MAAM,CAAC,SAAS,IAAI,OAAO,MAAM,CAAC,SAAS,KAAK,QAAQ;YAAE,OAAO;QAEtE,MAAM,OAAO,GAAG;YACf,KAAK,EAAE,WAAW;YAClB,WAAW,EAAE,IAAI,CAAC,WAAW,IAAI,QAAQ;YACzC,MAAM,EAAE,IAAI,CAAC,MAAM,IAAI,QAAQ;YAC/B,OAAO,EAAE,UAAU;YACnB,cAAc,EAAE,mBAAmB;SACnC,CAAC;QACF,MAAM,QAAQ,GAAG,MAAM,CAAC,SAAS,CAAC,YAAY,CAAC,CAAC;QAChD,IAAI,QAAQ,IAAI,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,KAAK,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC;YAAE,OAAO,CAAC,aAAa;QAE3F,MAAM,CAAC,SAAS,CAAC,YAAY,CAAC,GAAG,OAAO,CAAC;QACzC,MAAM,GAAG,GAAG,IAAI,GAAG,OAAO,GAAG,OAAO,CAAC,GAAG,CAAC;QACzC,EAAE,CAAC,aAAa,CAAC,GAAG,EAAE,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,GAAG,IAAI,EAAE,OAAO,CAAC,CAAC;QACvE,EAAE,CAAC,UAAU,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;IAC1B,CAAC;CACD"}

package/dist/wiki/infrastructure/markdown-repository.d.ts

@@ -0,0 +1,23 @@
+import type { InjectionVerdict, WikiCandidate, WikiIntervention, WikiPage, WikiSeed, WikiSlug, WikiSource } from "../domain/index.js";
+import type { ApprovedWrite, WikiRepository } from "../application/ports.js";
+export declare class MarkdownWikiRepository implements WikiRepository {
+    private readonly projectRoot;
+    constructor(projectRoot: string);
+    private wikiDir;
+    /** Resolve a repo-relative sub-path inside a slug dir, rejecting traversal. */
+    private resolveInSlug;
+    createWiki(slug: WikiSlug, title: string): void;
+    writePage(token: ApprovedWrite): void;
+    readPage(slug: WikiSlug, file: string): WikiPage | null;
+    listPages(slug: WikiSlug): string[];
+    private appendJsonl;
+    private readJsonl;
+    appendCandidate(candidate: WikiCandidate): void;
+    appendIntervention(slug: WikiSlug, intervention: WikiIntervention): void;
+    appendSeed(slug: WikiSlug, seed: WikiSeed): void;
+    appendSource(slug: WikiSlug, source: WikiSource): void;
+    listCandidates(slug: WikiSlug): WikiCandidate[];
+    getCandidate(slug: WikiSlug, id: string): WikiCandidate | null;
+    quarantine(slug: WikiSlug, content: string, verdict: InjectionVerdict): string;
+}
+//# sourceMappingURL=markdown-repository.d.ts.map

package/dist/wiki/infrastructure/markdown-repository.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"markdown-repository.d.ts","sourceRoot":"","sources":["../../../src/wiki/infrastructure/markdown-repository.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EACX,gBAAgB,EAChB,aAAa,EACb,gBAAgB,EAChB,QAAQ,EACR,QAAQ,EACR,QAAQ,EACR,UAAU,EACV,MAAM,oBAAoB,CAAC;AAE5B,OAAO,KAAK,EAAE,aAAa,EAAE,cAAc,EAAE,MAAM,yBAAyB,CAAC;AAwC7E,qBAAa,sBAAuB,YAAW,cAAc;IAChD,OAAO,CAAC,QAAQ,CAAC,WAAW;gBAAX,WAAW,EAAE,MAAM;IAEhD,OAAO,CAAC,OAAO;IAIf,+EAA+E;IAC/E,OAAO,CAAC,aAAa;IAUrB,UAAU,CAAC,IAAI,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,GAAG,IAAI;IAK/C,SAAS,CAAC,KAAK,EAAE,aAAa,GAAG,IAAI;IAqBrC,QAAQ,CAAC,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,GAAG,QAAQ,GAAG,IAAI;IAwBvD,SAAS,CAAC,IAAI,EAAE,QAAQ,GAAG,MAAM,EAAE;IAMnC,OAAO,CAAC,WAAW;IAMnB,OAAO,CAAC,SAAS;IAgBjB,eAAe,CAAC,SAAS,EAAE,aAAa,GAAG,IAAI;IAI/C,kBAAkB,CAAC,IAAI,EAAE,QAAQ,EAAE,YAAY,EAAE,gBAAgB,GAAG,IAAI;IAIxE,UAAU,CAAC,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,QAAQ,GAAG,IAAI;IAIhD,YAAY,CAAC,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,UAAU,GAAG,IAAI;IAItD,cAAc,CAAC,IAAI,EAAE,QAAQ,GAAG,aAAa,EAAE;IAM/C,YAAY,CAAC,IAAI,EAAE,QAAQ,EAAE,EAAE,EAAE,MAAM,GAAG,aAAa,GAAG,IAAI;IAI9D,UAAU,CAAC,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,gBAAgB,GAAG,MAAM;CAQ9E"}

package/dist/wiki/infrastructure/markdown-repository.js

@@ -0,0 +1,168 @@
+import fs from "node:fs";
+import path from "node:path";
+import { createHash } from "node:crypto";
+import yaml from "js-yaml";
+import { assertCanonicalComplete, assertNoTraversal, makeWikiPageId, makeWikiSlug } from "../domain/index.js";
+// Canonical Markdown repository for tasks/wikis/<slug>/. All writes are atomic (temp-file +
+// rename) via a LOCAL helper — there is no shared IO wrapper and no-direct-io does not cover
+// src/wiki/, so the safety property is type-enforced: writePage accepts ONLY an ApprovedWrite
+// token. Quarantined content lands in a read-blocked .quarantined file.
+function atomicWriteText(filePath, text) {
+    fs.mkdirSync(path.dirname(filePath), { recursive: true });
+    const tmp = filePath + ".tmp-" + process.pid;
+    fs.writeFileSync(tmp, text, "utf-8");
+    fs.renameSync(tmp, filePath);
+}
+/** Minimal runtime shape check for a candidate record from JSONL. The required string fields
+ * + a salience object are what the approve path and index ingest rely on; malformed records
+ * (incl. anything an untrusted producer might emit) are dropped. */
+function isCandidateRecord(r) {
+    if (!r || typeof r !== "object")
+        return false;
+    const o = r;
+    return (typeof o["id"] === "string" &&
+        typeof o["slug"] === "string" &&
+        typeof o["title"] === "string" &&
+        typeof o["content"] === "string" &&
+        typeof o["state"] === "string" &&
+        typeof o["salience"] === "object" &&
+        o["salience"] !== null);
+}
+function parseFrontmatter(raw) {
+    if (!raw.startsWith("---"))
+        return { meta: {}, body: raw };
+    const end = raw.indexOf("\n---", 3);
+    if (end === -1)
+        return { meta: {}, body: raw };
+    const loaded = yaml.load(raw.slice(3, end).trim());
+    const meta = loaded && typeof loaded === "object" ? loaded : {};
+    return { meta, body: raw.slice(end + 4).replace(/^\r?\n/, "") };
+}
+export class MarkdownWikiRepository {
+    projectRoot;
+    constructor(projectRoot) {
+        this.projectRoot = projectRoot;
+    }
+    wikiDir(slug) {
+        return path.join(this.projectRoot, "tasks", "wikis", slug);
+    }
+    /** Resolve a repo-relative sub-path inside a slug dir, rejecting traversal. */
+    resolveInSlug(slug, relative) {
+        assertNoTraversal(relative);
+        const base = this.wikiDir(slug);
+        const target = path.resolve(base, relative);
+        if (target !== base && !target.startsWith(base + path.sep)) {
+            throw new Error("path escapes the wiki directory: " + JSON.stringify(relative));
+        }
+        return target;
+    }
+    createWiki(slug, title) {
+        const meta = { slug, title, createdAt: new Date().toISOString(), updatedAt: new Date().toISOString() };
+        atomicWriteText(path.join(this.wikiDir(slug), "wiki.json"), JSON.stringify(meta, null, 2) + "\n");
+    }
+    writePage(token) {
+        const page = token.page;
+        assertCanonicalComplete(page); // re-assert invariants at the write boundary
+        const target = this.resolveInSlug(page.slug, page.path);
+        // `origin` stays top-level so the ingest reads it; full provenance is persisted too.
+        const meta = {
+            id: page.id,
+            slug: page.slug,
+            title: page.title,
+            state: page.state,
+            origin: page.provenance.origin,
+            createdAt: page.createdAt,
+            updatedAt: page.updatedAt,
+            links: page.links,
+            sourceIds: page.provenance.sourceIds,
+        };
+        if (page.provenance.approvedBy)
+            meta["approvedBy"] = page.provenance.approvedBy;
+        if (page.provenance.candidateId)
+            meta["candidateId"] = page.provenance.candidateId;
+        atomicWriteText(target, "---\n" + yaml.dump(meta) + "---\n" + page.content + "\n");
+    }
+    readPage(slug, file) {
+        const target = this.resolveInSlug(slug, path.join("pages", file));
+        if (!fs.existsSync(target))
+            return null;
+        const { meta, body } = parseFrontmatter(fs.readFileSync(target, "utf-8"));
+        const origin = meta["origin"] === "agent" || meta["origin"] === "system" ? meta["origin"] : "human";
+        return {
+            id: makeWikiPageId(typeof meta["id"] === "string" ? meta["id"] : slug + "/" + file),
+            slug: makeWikiSlug(typeof meta["slug"] === "string" ? meta["slug"] : slug),
+            title: typeof meta["title"] === "string" ? meta["title"] : file.replace(/\.md$/, ""),
+            path: path.join("pages", file),
+            content: body,
+            state: typeof meta["state"] === "string" ? meta["state"] : "committed",
+            createdAt: typeof meta["createdAt"] === "string" ? meta["createdAt"] : "",
+            updatedAt: typeof meta["updatedAt"] === "string" ? meta["updatedAt"] : "",
+            provenance: {
+                origin,
+                sourceIds: Array.isArray(meta["sourceIds"]) ? meta["sourceIds"] : [],
+                approvedBy: typeof meta["approvedBy"] === "string" ? meta["approvedBy"] : undefined,
+                candidateId: typeof meta["candidateId"] === "string" ? meta["candidateId"] : undefined,
+            },
+            links: [],
+        };
+    }
+    listPages(slug) {
+        const dir = path.join(this.wikiDir(slug), "pages");
+        if (!fs.existsSync(dir))
+            return [];
+        return fs.readdirSync(dir).filter((f) => f.endsWith(".md")).sort();
+    }
+    appendJsonl(slug, file, record) {
+        const target = this.resolveInSlug(slug, file);
+        fs.mkdirSync(path.dirname(target), { recursive: true });
+        fs.appendFileSync(target, JSON.stringify(record) + "\n", "utf-8");
+    }
+    readJsonl(slug, file) {
+        const target = this.resolveInSlug(slug, file);
+        if (!fs.existsSync(target))
+            return [];
+        const out = [];
+        for (const line of fs.readFileSync(target, "utf-8").split("\n")) {
+            if (!line.trim())
+                continue;
+            try {
+                const parsed = JSON.parse(line);
+                if (parsed && typeof parsed === "object")
+                    out.push(parsed);
+            }
+            catch {
+                // tolerant — skip a malformed line
+            }
+        }
+        return out;
+    }
+    appendCandidate(candidate) {
+        this.appendJsonl(candidate.slug, "candidates.jsonl", candidate);
+    }
+    appendIntervention(slug, intervention) {
+        this.appendJsonl(slug, "interventions.jsonl", intervention);
+    }
+    appendSeed(slug, seed) {
+        this.appendJsonl(slug, "seeds.jsonl", seed);
+    }
+    appendSource(slug, source) {
+        this.appendJsonl(slug, "sources.jsonl", source);
+    }
+    listCandidates(slug) {
+        // Runtime shape guard at the store boundary — candidates.jsonl gains an untrusted
+        // producer (fetched→candidate), so malformed records are skipped, not cast blind.
+        return this.readJsonl(slug, "candidates.jsonl").filter(isCandidateRecord);
+    }
+    getCandidate(slug, id) {
+        return this.listCandidates(slug).find((c) => c.id === id) ?? null;
+    }
+    quarantine(slug, content, verdict) {
+        const hash = createHash("sha256").update(content).digest("hex").slice(0, 16);
+        const target = this.resolveInSlug(slug, path.join("quarantine", hash + ".quarantined"));
+        const header = "QUARANTINED — DATA, do not execute. verdict=" + verdict.status + " findings=" + JSON.stringify(verdict.findings) + "\n";
+        atomicWriteText(target, header + content);
+        fs.chmodSync(target, 0o400); // owner read-only — re-injection-resistant at rest
+        return target;
+    }
+}
+//# sourceMappingURL=markdown-repository.js.map

package/dist/wiki/infrastructure/markdown-repository.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"markdown-repository.js","sourceRoot":"","sources":["../../../src/wiki/infrastructure/markdown-repository.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,IAAI,MAAM,SAAS,CAAC;AAU3B,OAAO,EAAE,uBAAuB,EAAE,iBAAiB,EAAE,cAAc,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAG9G,4FAA4F;AAC5F,6FAA6F;AAC7F,8FAA8F;AAC9F,wEAAwE;AAExE,SAAS,eAAe,CAAC,QAAgB,EAAE,IAAY;IACtD,EAAE,CAAC,SAAS,CAAC,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAC1D,MAAM,GAAG,GAAG,QAAQ,GAAG,OAAO,GAAG,OAAO,CAAC,GAAG,CAAC;IAC7C,EAAE,CAAC,aAAa,CAAC,GAAG,EAAE,IAAI,EAAE,OAAO,CAAC,CAAC;IACrC,EAAE,CAAC,UAAU,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC;AAC9B,CAAC;AAED;;oEAEoE;AACpE,SAAS,iBAAiB,CAAC,CAAU;IACpC,IAAI,CAAC,CAAC,IAAI,OAAO,CAAC,KAAK,QAAQ;QAAE,OAAO,KAAK,CAAC;IAC9C,MAAM,CAAC,GAAG,CAA4B,CAAC;IACvC,OAAO,CACN,OAAO,CAAC,CAAC,IAAI,CAAC,KAAK,QAAQ;QAC3B,OAAO,CAAC,CAAC,MAAM,CAAC,KAAK,QAAQ;QAC7B,OAAO,CAAC,CAAC,OAAO,CAAC,KAAK,QAAQ;QAC9B,OAAO,CAAC,CAAC,SAAS,CAAC,KAAK,QAAQ;QAChC,OAAO,CAAC,CAAC,OAAO,CAAC,KAAK,QAAQ;QAC9B,OAAO,CAAC,CAAC,UAAU,CAAC,KAAK,QAAQ;QACjC,CAAC,CAAC,UAAU,CAAC,KAAK,IAAI,CACtB,CAAC;AACH,CAAC;AAED,SAAS,gBAAgB,CAAC,GAAW;IACpC,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,KAAK,CAAC;QAAE,OAAO,EAAE,IAAI,EAAE,EAAE,EAAE,IAAI,EAAE,GAAG,EAAE,CAAC;IAC3D,MAAM,GAAG,GAAG,GAAG,CAAC,OAAO,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC;IACpC,IAAI,GAAG,KAAK,CAAC,CAAC;QAAE,OAAO,EAAE,IAAI,EAAE,EAAE,EAAE,IAAI,EAAE,GAAG,EAAE,CAAC;IAC/C,MAAM,MAAM,GAAY,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;IAC5D,MAAM,IAAI,GAAG,MAAM,IAAI,OAAO,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAE,MAAkC,CAAC,CAAC,CAAC,EAAE,CAAC;IAC7F,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,GAAG,CAAC,KAAK,CAAC,GAAG,GAAG,CAAC,CAAC,CAAC,OAAO,CAAC,QAAQ,EAAE,EAAE,CAAC,EAAE,CAAC;AACjE,CAAC;AAED,MAAM,OAAO,sBAAsB;IACL;IAA7B,YAA6B,WAAmB;QAAnB,gBAAW,GAAX,WAAW,CAAQ;IAAG,CAAC;IAE5C,OAAO,CAAC,IAAc;QAC7B,OAAO,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,OAAO,EAAE,OAAO,EAAE,IAAI,CAAC,CAAC;IAC5D,CAAC;IAED,+EAA+E;IACvE,aAAa,CAAC,IAAc,EAAE,QAAgB;QACrD,iBAAiB,CAAC,QAAQ,CAAC,CAAC;QAC5B,MAAM,IAAI,GAAG,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;QAChC,MAAM,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;QAC5C,IAAI,MAAM,KAAK,IAAI,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC,IAAI,GAAG,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;YAC5D,MAAM,IAAI,KAAK,CAAC,mCAAmC,GAAG,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC,CAAC;QACjF,CAAC;QACD,OAAO,MAAM,CAAC;IACf,CAAC;IAED,UAAU,CAAC,IAAc,EAAE,KAAa;QACvC,MAAM,IAAI,GAAG,EAAE,IAAI,EAAE,KAAK,EAAE,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,EAAE,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,EAAE,CAAC;QACvG,eAAe,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,WAAW,CAAC,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC;IACnG,CAAC;IAED,SAAS,CAAC,KAAoB;QAC7B,MAAM,IAAI,GAAG,KAAK,CAAC,IAAI,CAAC;QACxB,uBAAuB,CAAC,IAAI,CAAC,CAAC,CAAC,6CAA6C;QAC5E,MAAM,MAAM,GAAG,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC;QACxD,qFAAqF;QACrF,MAAM,IAAI,GAA4B;YACrC,EAAE,EAAE,IAAI,CAAC,EAAE;YACX,IAAI,EAAE,IAAI,CAAC,IAAI;YACf,KAAK,EAAE,IAAI,CAAC,KAAK;YACjB,KAAK,EAAE,IAAI,CAAC,KAAK;YACjB,MAAM,EAAE,IAAI,CAAC,UAAU,CAAC,MAAM;YAC9B,SAAS,EAAE,IAAI,CAAC,SAAS;YACzB,SAAS,EAAE,IAAI,CAAC,SAAS;YACzB,KAAK,EAAE,IAAI,CAAC,KAAK;YACjB,SAAS,EAAE,IAAI,CAAC,UAAU,CAAC,SAAS;SACpC,CAAC;QACF,IAAI,IAAI,CAAC,UAAU,CAAC,UAAU;YAAE,IAAI,CAAC,YAAY,CAAC,GAAG,IAAI,CAAC,UAAU,CAAC,UAAU,CAAC;QAChF,IAAI,IAAI,CAAC,UAAU,CAAC,WAAW;YAAE,IAAI,CAAC,aAAa,CAAC,GAAG,IAAI,CAAC,UAAU,CAAC,WAAW,CAAC;QACnF,eAAe,CAAC,MAAM,EAAE,OAAO,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,OAAO,GAAG,IAAI,CAAC,OAAO,GAAG,IAAI,CAAC,CAAC;IACpF,CAAC;IAED,QAAQ,CAAC,IAAc,EAAE,IAAY;QACpC,MAAM,MAAM,GAAG,IAAI,CAAC,aAAa,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC,CAAC;QAClE,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,MAAM,CAAC;YAAE,OAAO,IAAI,CAAC;QACxC,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,GAAG,gBAAgB,CAAC,EAAE,CAAC,YAAY,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;QAC1E,MAAM,MAAM,GAAG,IAAI,CAAC,QAAQ,CAAC,KAAK,OAAO,IAAI,IAAI,CAAC,QAAQ,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC;QACpG,OAAO;YACN,EAAE,EAAE,cAAc,CAAC,OAAO,IAAI,CAAC,IAAI,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,GAAG,GAAG,GAAG,IAAI,CAAC;YACnF,IAAI,EAAE,YAAY,CAAC,OAAO,IAAI,CAAC,MAAM,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;YAC1E,KAAK,EAAE,OAAO,IAAI,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,OAAO,EAAE,EAAE,CAAC;YACpF,IAAI,EAAE,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,IAAI,CAAC;YAC9B,OAAO,EAAE,IAAI;YACb,KAAK,EAAE,OAAO,IAAI,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAE,IAAI,CAAC,OAAO,CAAuB,CAAC,CAAC,CAAC,WAAW;YAC7F,SAAS,EAAE,OAAO,IAAI,CAAC,WAAW,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,EAAE;YACzE,SAAS,EAAE,OAAO,IAAI,CAAC,WAAW,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,EAAE;YACzE,UAAU,EAAE;gBACX,MAAM;gBACN,SAAS,EAAE,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,CAAE,IAAI,CAAC,WAAW,CAAc,CAAC,CAAC,CAAC,EAAE;gBAClF,UAAU,EAAE,OAAO,IAAI,CAAC,YAAY,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,SAAS;gBACnF,WAAW,EAAE,OAAO,IAAI,CAAC,aAAa,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,SAAS;aACtF;YACD,KAAK,EAAE,EAAE;SACT,CAAC;IACH,CAAC;IAED,SAAS,CAAC,IAAc;QACvB,MAAM,GAAG,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,OAAO,CAAC,CAAC;QACnD,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,GAAG,CAAC;YAAE,OAAO,EAAE,CAAC;QACnC,OAAO,EAAE,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;IACpE,CAAC;IAEO,WAAW,CAAC,IAAc,EAAE,IAAY,EAAE,MAAe;QAChE,MAAM,MAAM,GAAG,IAAI,CAAC,aAAa,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;QAC9C,EAAE,CAAC,SAAS,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QACxD,EAAE,CAAC,cAAc,CAAC,MAAM,EAAE,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,GAAG,IAAI,EAAE,OAAO,CAAC,CAAC;IACnE,CAAC;IAEO,SAAS,CAAC,IAAc,EAAE,IAAY;QAC7C,MAAM,MAAM,GAAG,IAAI,CAAC,aAAa,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;QAC9C,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,MAAM,CAAC;YAAE,OAAO,EAAE,CAAC;QACtC,MAAM,GAAG,GAAc,EAAE,CAAC;QAC1B,KAAK,MAAM,IAAI,IAAI,EAAE,CAAC,YAAY,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;YACjE,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE;gBAAE,SAAS;YAC3B,IAAI,CAAC;gBACJ,MAAM,MAAM,GAAY,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;gBACzC,IAAI,MAAM,IAAI,OAAO,MAAM,KAAK,QAAQ;oBAAE,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;YAC5D,CAAC;YAAC,MAAM,CAAC;gBACR,mCAAmC;YACpC,CAAC;QACF,CAAC;QACD,OAAO,GAAG,CAAC;IACZ,CAAC;IAED,eAAe,CAAC,SAAwB;QACvC,IAAI,CAAC,WAAW,CAAC,SAAS,CAAC,IAAI,EAAE,kBAAkB,EAAE,SAAS,CAAC,CAAC;IACjE,CAAC;IAED,kBAAkB,CAAC,IAAc,EAAE,YAA8B;QAChE,IAAI,CAAC,WAAW,CAAC,IAAI,EAAE,qBAAqB,EAAE,YAAY,CAAC,CAAC;IAC7D,CAAC;IAED,UAAU,CAAC,IAAc,EAAE,IAAc;QACxC,IAAI,CAAC,WAAW,CAAC,IAAI,EAAE,aAAa,EAAE,IAAI,CAAC,CAAC;IAC7C,CAAC;IAED,YAAY,CAAC,IAAc,EAAE,MAAkB;QAC9C,IAAI,CAAC,WAAW,CAAC,IAAI,EAAE,eAAe,EAAE,MAAM,CAAC,CAAC;IACjD,CAAC;IAED,cAAc,CAAC,IAAc;QAC5B,kFAAkF;QAClF,kFAAkF;QAClF,OAAO,IAAI,CAAC,SAAS,CAAC,IAAI,EAAE,kBAAkB,CAAC,CAAC,MAAM,CAAC,iBAAiB,CAAC,CAAC;IAC3E,CAAC;IAED,YAAY,CAAC,IAAc,EAAE,EAAU;QACtC,OAAO,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,IAAI,IAAI,CAAC;IACnE,CAAC;IAED,UAAU,CAAC,IAAc,EAAE,OAAe,EAAE,OAAyB;QACpE,MAAM,IAAI,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;QAC7E,MAAM,MAAM,GAAG,IAAI,CAAC,aAAa,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI,CAAC,YAAY,EAAE,IAAI,GAAG,cAAc,CAAC,CAAC,CAAC;QACxF,MAAM,MAAM,GAAG,8CAA8C,GAAG,OAAO,CAAC,MAAM,GAAG,YAAY,GAAG,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,QAAQ,CAAC,GAAG,IAAI,CAAC;QACxI,eAAe,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,CAAC;QAC1C,EAAE,CAAC,SAAS,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC,CAAC,mDAAmD;QAChF,OAAO,MAAM,CAAC;IACf,CAAC;CACD"}

package/dist/wiki/infrastructure/scan-patterns.d.ts

@@ -0,0 +1,20 @@
+/** Injection patterns. First 8 are verbatim from validate-content.cjs; the rest are the
+ * web-to-markdown Layer 5 local additions (tool-call hijack, memory poisoning, role-play). */
+export declare const INJECTION_PATTERNS: readonly RegExp[];
+export interface ContentValidation {
+    valid: boolean;
+    pattern?: string;
+    match?: string;
+}
+/** Mirror of validate-content.cjs: {valid:true} on pass (no pattern/match);
+ * {valid:false, pattern, match} on the first hit. */
+export declare function validateContent(text: string): ContentValidation;
+/** Secret patterns, ported verbatim from secret-scrub.cjs. Conservative: false positives
+ * accepted, missed secrets are not. Each entry is [matcher, replacement]. */
+export declare const SECRET_PATTERNS: readonly (readonly [RegExp, string])[];
+/** Mirror of secret-scrub.cjs scrubSecrets. */
+export declare function scrubSecrets(input: string): string;
+/** Strip zero-width chars and apply NFKC (catches homoglyph/zero-width obfuscation),
+ * per web-to-markdown Layer 5 pass 1. */
+export declare function normalizeForScan(text: string): string;
+//# sourceMappingURL=scan-patterns.d.ts.map

package/dist/wiki/infrastructure/scan-patterns.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"scan-patterns.d.ts","sourceRoot":"","sources":["../../../src/wiki/infrastructure/scan-patterns.ts"],"names":[],"mappings":"AASA;8FAC8F;AAC9F,eAAO,MAAM,kBAAkB,EAAE,SAAS,MAAM,EA8C/C,CAAC;AAEF,MAAM,WAAW,iBAAiB;IACjC,KAAK,EAAE,OAAO,CAAC;IACf,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,KAAK,CAAC,EAAE,MAAM,CAAC;CACf;AAED;qDACqD;AACrD,wBAAgB,eAAe,CAAC,IAAI,EAAE,MAAM,GAAG,iBAAiB,CAO/D;AAED;6EAC6E;AAC7E,eAAO,MAAM,eAAe,EAAE,SAAS,CAAC,SAAS,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,EAmBjE,CAAC;AAEF,+CAA+C;AAC/C,wBAAgB,YAAY,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAKlD;AAED;yCACyC;AACzC,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAErD"}