skillwiki 0.10.109 → 0.10.111

package/dist/chunk-I2J3IJB7.js

@@ -0,0 +1,54 @@
+#!/usr/bin/env node
+import {
+  ExitCode,
+  err,
+  isBlockedHost,
+  ok
+} from "./chunk-UIEQIJXP.js";
+
+// src/commands/fetch-guard.ts
+var REDACT_PARAMS = /* @__PURE__ */ new Set(["api_key", "token", "key", "auth", "password", "secret", "access_token"]);
+var PATH_TOKEN_RE = /[A-Fa-f0-9]{32,}|[A-Za-z0-9_\-]{40,}/g;
+function runFetchGuard(input) {
+  return Promise.resolve(runFetchGuardSync(input));
+}
+function runFetchGuardSync(input) {
+  let u;
+  try {
+    u = new URL(input.url);
+  } catch {
+    return { exitCode: ExitCode.MALFORMED_URL, result: err("MALFORMED_URL", { url: input.url }) };
+  }
+  const sanitized = sanitizeUrl(u);
+  if (u.protocol !== "https:") {
+    return {
+      exitCode: ExitCode.SCHEME_REJECTED,
+      result: err("SCHEME_REJECTED", { sanitized_url: sanitized, scheme: u.protocol })
+    };
+  }
+  if (isBlockedHost(u.hostname)) {
+    return {
+      exitCode: ExitCode.HOST_BLOCKED,
+      result: err("HOST_BLOCKED", { sanitized_url: sanitized, host: u.hostname })
+    };
+  }
+  return { exitCode: ExitCode.OK, result: ok({ allowed: true, sanitized_url: sanitized, humanHint: `ALLOWED: ${sanitized}` }) };
+}
+function sanitizeUrl(u) {
+  const clone = new URL(u.toString());
+  if (clone.username || clone.password) {
+    clone.username = "";
+    clone.password = "";
+  }
+  for (const k of Array.from(clone.searchParams.keys())) {
+    if (REDACT_PARAMS.has(k.toLowerCase())) clone.searchParams.set(k, "REDACTED");
+  }
+  let s = clone.toString();
+  s = s.replace(PATH_TOKEN_RE, "REDACTED");
+  return s;
+}
+
+export {
+  runFetchGuard,
+  runFetchGuardSync
+};

package/dist/{chunk-HMHMCPCE.js → chunk-I6IRJCUJ.js}

@@ -1,67 +1,23 @@
 #!/usr/bin/env node
+import {
+  extractFrontmatter,
+  scanSensitiveContent,
+  scanVault
+} from "./chunk-X5GL2FCU.js";
 import {
   MetaSchema,
   TypedKnowledgeSchema,
   detectSchema,
   err,
-  extractFrontmatter,
-  ok,
-  scanSensitiveContent,
-  scanVault
-} from "./chunk-GJC2CI3W.js";
-
-// src/utils/atomic-write.ts
-import { randomBytes } from "crypto";
-import { open, readFile, rename, unlink } from "fs/promises";
-import { basename, dirname, join } from "path";
-async function readExisting(path) {
-  try {
-    return await readFile(path, "utf8");
-  } catch (error) {
-    if (error.code === "ENOENT") return null;
-    throw error;
-  }
-}
-async function atomicWriteText(path, text) {
-  let existing;
-  try {
-    existing = await readExisting(path);
-  } catch (error) {
-    return err("WRITE_FAILED", { path, phase: "read-existing", message: String(error) });
-  }
-  if (existing === text) return ok({ changed: false, existed: true });
-  const tmp = join(
-    dirname(path),
-    `.${basename(path)}.${process.pid}.${randomBytes(8).toString("hex")}.tmp`
-  );
-  try {
-    const handle = await open(tmp, "wx");
-    try {
-      await handle.writeFile(text, "utf8");
-      try {
-        await handle.sync();
-      } catch {
-      }
-    } finally {
-      await handle.close();
-    }
-    await rename(tmp, path);
-    return ok({ changed: true, existed: existing !== null });
-  } catch (error) {
-    try {
-      await unlink(tmp);
-    } catch {
-    }
-    return err("WRITE_FAILED", { path, phase: "atomic-write", message: String(error) });
-  }
-}
+  ok
+} from "./chunk-UIEQIJXP.js";
 
 // src/utils/index-universe.ts
-import { readFile as readFile2 } from "fs/promises";
+import { readFile } from "fs/promises";
 
 // src/utils/typed-page.ts
 import { lstatSync, realpathSync } from "fs";
-import { dirname as dirname2, posix, relative, resolve, sep } from "path";
+import { dirname, posix, relative, resolve, sep } from "path";
 var TYPE_DIRECTORY = {
   entity: "entities",
   concept: "concepts",
@@ -86,7 +42,7 @@ function assertTargetInsideVault(vault, target) {
     return err("VAULT_PATH_INVALID", { target, message: "vault realpath failed" });
   }
   const absolutePath = resolve(vaultReal, target);
-  const parent = dirname2(absolutePath);
+  const parent = dirname(absolutePath);
   let parentReal;
   try {
     parentReal = realpathSync(parent);
@@ -201,7 +157,7 @@ async function buildRootIndexUniverse(input) {
   for (const page of typedPages) {
     let text;
     try {
-      text = await readFile2(page.absPath, "utf8");
+      text = await readFile(page.absPath, "utf8");
     } catch {
       continue;
     }
@@ -247,7 +203,7 @@ async function buildRootIndexUniverse(input) {
   for (const readme of projectReadmes) {
     let text;
     try {
-      text = await readFile2(readme.absPath, "utf8");
+      text = await readFile(readme.absPath, "utf8");
     } catch {
       continue;
     }
@@ -286,7 +242,6 @@ async function buildRootIndexUniverse(input) {
 }
 
 export {
-  atomicWriteText,
   assertTargetInsideVault,
   prepareTypedPage,
   ROOT_INDEX_SECTION_ORDER,

package/dist/{chunk-QU2IXZRN.js → chunk-JQV5KNPT.js}

@@ -8,18 +8,20 @@ import {
   readLogEvents,
   resolveExistingRegularFileInsideVault,
   writeLogEvent
-} from "./chunk-JCDAEZVD.js";
+} from "./chunk-5IBLXGLY.js";
 import {
-  ExitCode,
-  RawSourceSchema,
-  err,
   extractFrontmatter,
-  ok,
   readPage,
   scanSensitiveContent,
   scanVault,
   splitFrontmatter
-} from "./chunk-GJC2CI3W.js";
+} from "./chunk-X5GL2FCU.js";
+import {
+  ExitCode,
+  RawSourceSchema,
+  err,
+  ok
+} from "./chunk-UIEQIJXP.js";
 
 // src/commands/sources.ts
 import { readFile as readFile4 } from "fs/promises";

package/dist/chunk-KWEYA3OE.js

@@ -0,0 +1,60 @@
+#!/usr/bin/env node
+import {
+  atomicWriteText
+} from "./chunk-GQWCTJTU.js";
+
+// src/clip-outbox/journal.ts
+import { mkdir, readFile, open } from "fs/promises";
+import { dirname, join } from "path";
+import { z } from "zod";
+async function readJournal(stateRoot) {
+  let raw;
+  try {
+    raw = await readFile(join(stateRoot, "journal.json"), "utf8");
+  } catch (e) {
+    if (e.code === "ENOENT") return [];
+    throw e;
+  }
+  const key = z.string().regex(/^raw\/(articles|assets)\/[A-Za-z0-9._/-]+$/).refine((s) => s.split("/").every((p) => p && p !== "." && p !== ".."));
+  const schema = z.object({
+    captureId: z.string().regex(/^[a-f0-9]{16,32}$/),
+    snapshotId: z.string().regex(/^[a-f0-9]{16}$/).optional(),
+    source: z.string().optional(),
+    sourceSha256: z.string().regex(/^[a-f0-9]{64}$/).optional(),
+    articleKey: key.refine((s) => s.startsWith("raw/articles/")),
+    assetKeys: z.array(key.refine((s) => s.startsWith("raw/assets/"))),
+    sha256: z.record(z.string().regex(/^[a-f0-9]{64}$/)),
+    sizes: z.record(z.number().int().nonnegative()).optional(),
+    receipts: z.record(z.enum(["created", "idempotent"])).optional(),
+    state: z.enum(["discovered", "preparing", "sealed", "assets-verified", "article-verified", "notify-pending", "central-visible", "mirrored", "conflict", "held"]),
+    reason: z.string().optional(),
+    attempts: z.number().int().nonnegative().optional(),
+    updatedAt: z.string().optional(),
+    retryAt: z.number().finite().optional()
+  }).refine((e) => !e.sourceSha256 || e.snapshotId && [e.articleKey, ...e.assetKeys].every((k) => e.sha256[k] && e.sizes?.[k] !== void 0));
+  const result = z.array(schema).safeParse(JSON.parse(raw));
+  if (!result.success) throw new Error("invalid clip journal; retain and inspect it before restarting");
+  return result.data;
+}
+async function writeJournal(stateRoot, entries) {
+  await mkdir(stateRoot, { recursive: true, mode: 448 });
+  const result = await atomicWriteText(join(stateRoot, "journal.json"), JSON.stringify(entries, null, 2));
+  if (!result.ok) throw new Error("journal write failed");
+  for (const path of [stateRoot, dirname(stateRoot)]) {
+    const dir = await open(path, "r");
+    try {
+      await dir.sync();
+    } finally {
+      await dir.close();
+    }
+  }
+}
+function upsertJournal(entries, next) {
+  return [...entries.filter((e) => e.captureId !== next.captureId), next];
+}
+
+export {
+  readJournal,
+  writeJournal,
+  upsertJournal
+};

package/dist/{chunk-DTTKCCQ4.js → chunk-MRPJ7X7W.js}

@@ -1,13 +1,15 @@
 #!/usr/bin/env node
 import {
   ROOT_INDEX_SECTION_ORDER,
-  atomicWriteText,
   buildRootIndexUniverse
-} from "./chunk-HMHMCPCE.js";
+} from "./chunk-I6IRJCUJ.js";
+import {
+  atomicWriteText
+} from "./chunk-GQWCTJTU.js";
 import {
   err,
   ok
-} from "./chunk-GJC2CI3W.js";
+} from "./chunk-UIEQIJXP.js";
 
 // src/utils/index-projection.ts
 import { readFile } from "fs/promises";