skillwiki 0.10.109 → 0.10.111

package/dist/{chunk-GJC2CI3W.js → chunk-UIEQIJXP.js}

@@ -419,6 +419,106 @@ function parseVaultSyncKeyValue(key, value) {
   const first = parsed.error.issues[0];
   return { ok: false, message: first?.message ?? "invalid value" };
 }
+var clipBool = z.enum(["true", "false"]);
+var clipIntString = (min, max) => z.string().regex(/^[0-9]+$/, "must be a decimal integer").refine((s) => {
+  const n = Number(s);
+  return Number.isInteger(n) && n >= min && n <= max;
+}, { message: `must be an integer ${min}\u2013${max}` });
+var clipHttpsUrl = z.string().min(1).refine((s) => {
+  try {
+    const u = new URL(s);
+    return u.protocol === "https:" && u.username === "" && u.password === "";
+  } catch {
+    return false;
+  }
+}, { message: "must be an https URL without userinfo" });
+var clipCredentialRef = z.string().min(1).max(128).regex(
+  /^[a-zA-Z0-9_.-]+$/,
+  "must be a credential reference name, never a secret value"
+);
+var CLIP_IMAGE_TYPES = ["png", "jpeg", "gif", "webp"];
+var CLIP_ALLOWED_PREFIXES = "raw/articles,raw/assets";
+var CLIP_OUTBOX_DEFAULTS = {
+  enabled: "false",
+  vault_id: "central",
+  allowed_prefixes: CLIP_ALLOWED_PREFIXES,
+  destination: "seaweed-wiki:cloud/wiki",
+  mode: "event-watch",
+  poll_fallback_enabled: "true",
+  reconcile_seconds: "3600",
+  debounce_ms: "500",
+  stable_hash_ms: "500",
+  max_article_bytes: "2097152",
+  max_images: "64",
+  max_image_bytes: "20971520",
+  max_bundle_bytes: "104857600",
+  max_pixels: "40000000",
+  download_concurrency: "4",
+  image_types: CLIP_IMAGE_TYPES.join(","),
+  max_redirects: "5",
+  request_timeout_ms: "30000",
+  localize_timeout_ms: "120000",
+  watcher_label: "com.karlchow.skillwiki-clip-outbox"
+};
+var ClipOutboxConfigSchema = z.object({
+  "clip_outbox.enabled": clipBool,
+  "clip_outbox.root": absolutePath,
+  "clip_outbox.state_root": absolutePath,
+  "clip_outbox.mirror_root": absolutePath,
+  "clip_outbox.d8_note_root": absolutePath,
+  "clip_outbox.d8_note_absent": clipBool,
+  "clip_outbox.vault_id": z.literal("central"),
+  "clip_outbox.allowed_prefixes": z.string().refine((s) => {
+    const parts = s.split(",").map((p) => p.trim()).filter(Boolean).sort();
+    return parts.join(",") === "raw/articles,raw/assets";
+  }, { message: "must be exactly raw/articles,raw/assets" }),
+  "clip_outbox.destination": z.literal("seaweed-wiki:cloud/wiki"),
+  "clip_outbox.mode": z.literal("event-watch"),
+  "clip_outbox.poll_fallback_enabled": clipBool,
+  "clip_outbox.reconcile_seconds": clipIntString(1, 86400),
+  "clip_outbox.debounce_ms": clipIntString(100, 5e3),
+  "clip_outbox.stable_hash_ms": clipIntString(100, 5e3),
+  "clip_outbox.max_article_bytes": clipIntString(1, 2097152),
+  "clip_outbox.max_images": clipIntString(0, 64),
+  "clip_outbox.max_image_bytes": clipIntString(1, 20971520),
+  "clip_outbox.max_bundle_bytes": clipIntString(1, 104857600),
+  "clip_outbox.max_pixels": clipIntString(1, 4e7),
+  "clip_outbox.download_concurrency": clipIntString(1, 4),
+  "clip_outbox.image_types": z.string().refine((s) => {
+    const parts = s.split(",").map((p) => p.trim()).filter(Boolean);
+    if (parts.length === 0) return false;
+    const allowed = new Set(CLIP_IMAGE_TYPES);
+    const seen = /* @__PURE__ */ new Set();
+    for (const p of parts) {
+      if (!allowed.has(p) || seen.has(p)) return false;
+      seen.add(p);
+    }
+    return true;
+  }, { message: "must be a unique subset of png,jpeg,gif,webp" }),
+  "clip_outbox.max_redirects": clipIntString(0, 5),
+  "clip_outbox.request_timeout_ms": clipIntString(1, 3e4),
+  "clip_outbox.localize_timeout_ms": clipIntString(1, 12e4),
+  "clip_outbox.ready_url": clipHttpsUrl,
+  "clip_outbox.s3_credential_ref": clipCredentialRef,
+  "clip_outbox.ready_credential_ref": clipCredentialRef,
+  "clip_outbox.watcher_label": z.literal("com.karlchow.skillwiki-clip-outbox")
+}).strict();
+var CLIP_OUTBOX_KEYS = Object.keys(ClipOutboxConfigSchema.shape);
+function isClipOutboxKey(key) {
+  return CLIP_OUTBOX_KEYS.includes(key);
+}
+function parseClipOutboxKeyValue(key, value) {
+  if (!isClipOutboxKey(key)) {
+    return { ok: false, message: `unknown clip_outbox key: ${key}` };
+  }
+  const fieldSchema = ClipOutboxConfigSchema.shape[key];
+  const parsed = fieldSchema.safeParse(value);
+  if (parsed.success) {
+    return { ok: true };
+  }
+  const first = parsed.error.issues[0];
+  return { ok: false, message: first?.message ?? "invalid value" };
+}
 function detectSchema(fm) {
   const COMPOUND_TYPES = /* @__PURE__ */ new Set(["lesson", "pattern", "antipattern", "gotcha"]);
   if (typeof fm.type === "string" && COMPOUND_TYPES.has(fm.type) && "project" in fm) return { schema: "compound" };
@@ -455,6 +555,9 @@ function inRange(ip, baseStr, prefix) {
   const mask = prefix === 0 ? 0 : ~0 << 32 - prefix >>> 0;
   return (ipN & mask) === (baseN & mask);
 }
+function ipv4InCidr(ip, base, prefix) {
+  return inRange(ip, base, prefix);
+}
 function isBlockedHost(host) {
   const lower = host.toLowerCase();
   if (METADATA_HOSTS.has(lower)) return true;
@@ -498,330 +601,6 @@ function systemdPropertyFor(semantic) {
   return SYSTEMD_PROPERTY_CATALOG[semantic];
 }
 
-// src/parsers/frontmatter.ts
-import yaml from "js-yaml";
-var FM_OPEN = /^---\r?\n/;
-function splitFrontmatter(text) {
-  if (!FM_OPEN.test(text)) return ok({ rawFrontmatter: "", body: text, bodyStart: 0 });
-  const afterOpen = text.replace(FM_OPEN, "");
-  const closeIdx = afterOpen.search(/\r?\n---\r?\n/);
-  if (closeIdx === -1) return err("MISSING_CLOSING_DELIMITER");
-  const rawFrontmatter = afterOpen.slice(0, closeIdx);
-  const closeMatch = afterOpen.slice(closeIdx).match(/\r?\n---\r?\n/);
-  const bodyStart = text.length - (afterOpen.length - closeIdx - closeMatch[0].length);
-  const body = text.slice(bodyStart);
-  return ok({ rawFrontmatter, body, bodyStart });
-}
-function extractFrontmatter(text) {
-  const split = splitFrontmatter(text);
-  if (!split.ok) return split;
-  if (!split.data.rawFrontmatter) return ok({});
-  try {
-    const parsed = yaml.load(split.data.rawFrontmatter, { schema: yaml.JSON_SCHEMA });
-    if (parsed === null || typeof parsed !== "object" || Array.isArray(parsed)) return ok({});
-    return ok(parsed);
-  } catch (e) {
-    return err("INVALID_FRONTMATTER", { message: getErrorMessage(e) });
-  }
-}
-
-// src/utils/sensitive-content.ts
-import { createHash } from "crypto";
-var REDACTED_RE = /\[REDACTED:[^\]]+\]/i;
-var SYNTHETIC_RE = /^(?:<[^>]+>|\$\{[^}]+\}|REPLACE_WITH_[A-Z0-9_]+|YOUR_[A-Z0-9_]+|EXAMPLE_[A-Z0-9_]+)$/i;
-var MATCHERS = [
-  {
-    kind: "private_key",
-    re: /-----BEGIN [A-Z0-9 ]*PRIVATE KEY-----[\s\S]*?-----END [A-Z0-9 ]*PRIVATE KEY-----/g
-  },
-  {
-    kind: "authorization_header",
-    re: /\bAuthorization["']?\s*:\s*["']?(Bearer\s+[A-Za-z0-9._~+/-]{20,})["']?/gi,
-    valueGroup: 1
-  },
-  {
-    kind: "cookie",
-    re: /\b(?:Cookie|Set-Cookie)\s*:\s*([^\n]{20,})/gi,
-    valueGroup: 1
-  },
-  {
-    kind: "jwt",
-    re: /\b([A-Za-z0-9_-]{16,}\.[A-Za-z0-9_-]{12,}\.[A-Za-z0-9_-]{12,})\b/g,
-    valueGroup: 1
-  },
-  {
-    kind: "provider_key",
-    re: /\b(sk-[A-Za-z0-9_-]{20,}|xox[baprs]-[A-Za-z0-9-]{20,}|gh[pousr]_[A-Za-z0-9_=-]{20,})\b/g,
-    valueGroup: 1
-  },
-  {
-    kind: "access_key",
-    re: /\b((?:AKIA|ASIA)[A-Z0-9]{16})\b/g,
-    valueGroup: 1
-  },
-  {
-    kind: "access_key",
-    re: /\b(?:access[-_ ]?key|credential)["']?\s*[:=]\s*["']?([A-Za-z0-9._~+/-]{20,})["']?/gi,
-    valueGroup: 1
-  },
-  {
-    kind: "api_key",
-    re: /\b(?:api[-_ ]?key)["']?\s*[:=]\s*["']?([A-Za-z0-9._~+/-]{20,})["']?/gi,
-    valueGroup: 1
-  },
-  {
-    kind: "password",
-    re: /\b(?:password|passwd)["']?\s*[:=]\s*[`"']?([^\s`"']{8,})[`"']?/gi,
-    valueGroup: 1
-  },
-  {
-    kind: "secret",
-    re: /\b(?:secret|client[-_ ]?secret)["']?\s*[:=]\s*["']?([A-Za-z0-9._~+/-]{16,})["']?/gi,
-    valueGroup: 1
-  },
-  {
-    kind: "token",
-    re: /\b(?:token|session)["']?\s*[:=]\s*["']?([A-Za-z0-9._~+/-]{16,})["']?/gi,
-    valueGroup: 1
-  }
-];
-function fingerprint(value) {
-  return createHash("sha256").update(value).digest("hex").slice(0, 12);
-}
-function lineFor(text, offset) {
-  return text.slice(0, offset).split(/\r?\n/).length;
-}
-function redactMarker(kind, value) {
-  return `[REDACTED:${kind}:${fingerprint(value)}]`;
-}
-function isSyntheticPlaceholder(value) {
-  return REDACTED_RE.test(value) || SYNTHETIC_RE.test(value.trim());
-}
-function isInsideRedactedMarker(text, start, end) {
-  for (const marker of text.matchAll(new RegExp(REDACTED_RE.source, "gi"))) {
-    const markerStart = marker.index ?? 0;
-    const markerEnd = markerStart + marker[0].length;
-    if (start >= markerStart && end <= markerEnd) return true;
-  }
-  return false;
-}
-function isNonSecretTokenCapture(value) {
-  if (value.startsWith("//")) return true;
-  if (value.includes("/")) return true;
-  if (/^[a-z0-9.]+(?:-[a-z0-9.]+)+$/.test(value) && !/^[0-9a-f]+(?:-[0-9a-f]+)+$/.test(value)) return true;
-  return false;
-}
-var PASSWORD_PROSE_SENTINELS = /* @__PURE__ */ new Set([
-  "generated",
-  "configured",
-  "required",
-  "optional",
-  "provided",
-  "disabled",
-  "enabled",
-  "undefined",
-  "unspecified",
-  "unknown"
-]);
-function isNonSecretPasswordCapture(value) {
-  return PASSWORD_PROSE_SENTINELS.has(value.toLowerCase());
-}
-function collectMatches(text) {
-  const matches = [];
-  for (const matcher of MATCHERS) {
-    matcher.re.lastIndex = 0;
-    for (const m of text.matchAll(matcher.re)) {
-      const whole = m[0];
-      const start = m.index ?? 0;
-      if (REDACTED_RE.test(whole) || isInsideRedactedMarker(text, start, start + whole.length)) continue;
-      const value = matcher.valueGroup ? m[matcher.valueGroup] : whole;
-      if (isSyntheticPlaceholder(value)) continue;
-      if (matcher.kind === "token" && isNonSecretTokenCapture(value)) continue;
-      if (matcher.kind === "password" && isNonSecretPasswordCapture(value)) continue;
-      const valueOffset = whole.lastIndexOf(value);
-      const valueStart = start + Math.max(0, valueOffset);
-      matches.push({
-        start,
-        end: start + whole.length,
-        valueStart,
-        valueEnd: valueStart + value.length,
-        kind: matcher.kind
-      });
-    }
-  }
-  return matches.sort((a, b) => {
-    if (a.valueStart !== b.valueStart) return a.valueStart - b.valueStart;
-    return b.valueEnd - b.valueStart - (a.valueEnd - a.valueStart);
-  });
-}
-function collapseOverlaps(matches) {
-  const kept = [];
-  for (const match of matches) {
-    const overlaps = kept.some((k) => match.valueStart < k.valueEnd && match.valueEnd > k.valueStart);
-    if (!overlaps) kept.push(match);
-  }
-  return kept;
-}
-function scanSensitiveContent(text, opts = {}) {
-  return collapseOverlaps(collectMatches(text)).map((match) => {
-    const value = text.slice(match.valueStart, match.valueEnd);
-    const marker = redactMarker(match.kind, value);
-    const rawPreview = text.slice(Math.max(0, match.start - 24), Math.min(text.length, match.end + 24));
-    const preview = rawPreview.replace(value, marker);
-    return {
-      file: opts.file,
-      line: lineFor(text, match.valueStart),
-      kind: match.kind,
-      preview,
-      fingerprint: fingerprint(value)
-    };
-  });
-}
-function redactSensitiveContent(text, opts = {}) {
-  const matches = collapseOverlaps(collectMatches(text));
-  if (matches.length === 0) return { text, changed: false, findings: [] };
-  let out = "";
-  let cursor = 0;
-  for (const match of matches) {
-    const value = text.slice(match.valueStart, match.valueEnd);
-    out += text.slice(cursor, match.valueStart);
-    out += redactMarker(match.kind, value);
-    cursor = match.valueEnd;
-  }
-  out += text.slice(cursor);
-  return {
-    text: out,
-    changed: out !== text,
-    findings: scanSensitiveContent(text, opts)
-  };
-}
-
-// src/utils/vault.ts
-import { existsSync, readFileSync } from "fs";
-import { readFile, readdir, stat } from "fs/promises";
-import { join, relative, sep } from "path";
-import { execFileSync } from "child_process";
-var TYPED_DIRS = ["entities", "concepts", "comparisons", "queries", "meta"];
-var SKIP_DIRS = /* @__PURE__ */ new Set([".git", "node_modules"]);
-var DEFAULT_IO_CONCURRENCY = 1;
-function vaultIoConcurrency() {
-  const raw = Number.parseInt(process.env.SKILLWIKI_VAULT_IO_CONCURRENCY ?? "", 10);
-  return Number.isFinite(raw) && raw > 0 ? Math.min(raw, 64) : DEFAULT_IO_CONCURRENCY;
-}
-function decodeProcMountPath(value) {
-  return value.replace(/\\040/g, " ");
-}
-function isRcloneFuseVaultFromMounts(root, mounts) {
-  return mounts.split(/\r?\n/).some((line) => {
-    const parts = line.split(" ");
-    if (parts.length < 3) return false;
-    const mountPoint = decodeProcMountPath(parts[1]);
-    const fsType = parts[2];
-    return fsType === "fuse.rclone" && (root === mountPoint || root.startsWith(`${mountPoint}/`));
-  });
-}
-function resolveReadOnlyVaultRootWithMounts(root, mounts) {
-  if (/^(1|true|yes)$/i.test(process.env.SKILLWIKI_DISABLE_VAULT_READ_MIRROR ?? "")) {
-    return { root, mirrored: false };
-  }
-  const explicitMirror = process.env.SKILLWIKI_VAULT_READ_MIRROR;
-  if (explicitMirror && existsSync(join(explicitMirror, "SCHEMA.md"))) {
-    return { root: explicitMirror, mirrored: explicitMirror !== root };
-  }
-  const siblingMirror = `${root}-git`;
-  if (isRcloneFuseVaultFromMounts(root, mounts) && existsSync(join(siblingMirror, "SCHEMA.md"))) {
-    return { root: siblingMirror, mirrored: true };
-  }
-  return { root, mirrored: false };
-}
-function resolveReadOnlyVaultRoot(root) {
-  let mounts = "";
-  try {
-    mounts = readFileSync("/proc/mounts", "utf8");
-  } catch {
-  }
-  return resolveReadOnlyVaultRootWithMounts(root, mounts);
-}
-async function mapWithConcurrency(items, limit, mapper) {
-  const out = new Array(items.length);
-  let next = 0;
-  const workers = Array.from({ length: Math.min(Math.max(1, limit), items.length) }, async () => {
-    for (; ; ) {
-      const index = next++;
-      if (index >= items.length) return;
-      out[index] = await mapper(items[index], index);
-    }
-  });
-  await Promise.all(workers);
-  return out;
-}
-function filterGitIgnoredRelativePaths(root, relPaths) {
-  if (relPaths.length === 0 || !existsSync(join(root, ".git"))) {
-    return /* @__PURE__ */ new Set();
-  }
-  try {
-    const input = relPaths.join("\0") + "\0";
-    const stdout = execFileSync("git", ["check-ignore", "-z", "--stdin"], {
-      cwd: root,
-      input,
-      encoding: "utf8",
-      stdio: ["pipe", "pipe", "pipe"]
-    });
-    const ignored = stdout.split("\0").filter(Boolean);
-    return new Set(ignored);
-  } catch (error) {
-    if (error && typeof error === "object" && error.status === 1) {
-      return /* @__PURE__ */ new Set();
-    }
-    return /* @__PURE__ */ new Set();
-  }
-}
-async function scanVault(root) {
-  try {
-    await stat(join(root, "SCHEMA.md"));
-  } catch {
-    return err("VAULT_PATH_INVALID", { root, reason: "SCHEMA.md missing" });
-  }
-  const all = await walk(root);
-  const rawRels = all.map((p) => ({ absPath: p, relPath: relative(root, p).split(sep).join("/") }));
-  const ignored = filterGitIgnoredRelativePaths(root, rawRels.map((p) => p.relPath));
-  const rels = ignored.size > 0 ? rawRels.filter((p) => !ignored.has(p.relPath)) : rawRels;
-  return ok({
-    root,
-    allMarkdown: rels,
-    typedKnowledge: rels.filter((p) => TYPED_DIRS.some((d) => p.relPath.startsWith(d + "/"))),
-    raw: rels.filter((p) => p.relPath.startsWith("raw/")),
-    workItems: rels.filter((p) => /^projects\/[^/]+\/work\/[^/]+\/(spec|plan|log)\.md$/.test(p.relPath)),
-    compound: rels.filter((p) => /^projects\/[^/]+\/compound\//.test(p.relPath))
-  });
-}
-async function walk(dir) {
-  const entries = await readdir(dir, { withFileTypes: true });
-  const out = [];
-  const subdirs = [];
-  for (const e of entries) {
-    const p = join(dir, e.name);
-    if (e.isDirectory()) {
-      if (SKIP_DIRS.has(e.name)) continue;
-      subdirs.push(p);
-    } else if (e.isFile() && e.name.endsWith(".md")) out.push(p);
-  }
-  const nested = await mapWithConcurrency(subdirs, Math.min(8, vaultIoConcurrency()), walk);
-  for (const files of nested) out.push(...files);
-  return out;
-}
-async function readPage(p) {
-  return readFile(p.absPath, "utf8");
-}
-async function readPageCached(p, cache) {
-  if (!cache) return readPage(p);
-  const existing = cache.get(p.absPath);
-  if (existing) return existing;
-  const pending = readPage(p);
-  cache.set(p.absPath, pending);
-  return pending;
-}
-
 export {
   ExitCode,
   ok,
@@ -834,20 +613,13 @@ export {
   FleetManifestSchema,
   isVaultSyncKey,
   parseVaultSyncKeyValue,
+  CLIP_OUTBOX_DEFAULTS,
+  isClipOutboxKey,
+  parseClipOutboxKeyValue,
   detectSchema,
+  ipv4InCidr,
   isBlockedHost,
   getErrorMessage,
   resolveSessionKind,
-  systemdPropertyFor,
-  splitFrontmatter,
-  extractFrontmatter,
-  scanSensitiveContent,
-  redactSensitiveContent,
-  vaultIoConcurrency,
-  resolveReadOnlyVaultRoot,
-  mapWithConcurrency,
-  filterGitIgnoredRelativePaths,
-  scanVault,
-  readPage,
-  readPageCached
+  systemdPropertyFor
 };