skillwiki 0.10.49 → 0.10.51

package/dist/{chunk-UHZBOOMK.js → chunk-74OSLCXE.js}

@@ -8,7 +8,7 @@ import {
   ok,
   scanSensitiveContent,
   scanVault
-} from "./chunk-EVQASYII.js";
+} from "./chunk-IJ7DD7QZ.js";
 
 // src/utils/atomic-write.ts
 import { randomBytes } from "crypto";

package/dist/{chunk-PLUHIOCQ.js → chunk-GAHMWLWU.js}

@@ -6,7 +6,102 @@ import {
   readPage,
   scanSensitiveContent,
   splitFrontmatter
-} from "./chunk-EVQASYII.js";
+} from "./chunk-IJ7DD7QZ.js";
+
+// src/utils/vault-path-safety.ts
+import { lstatSync, realpathSync } from "fs";
+import { lstat, realpath } from "fs/promises";
+import { dirname, relative, resolve, sep } from "path";
+function vaultRelative(vaultReal, candidate) {
+  return relative(vaultReal, candidate).split(sep).join("/");
+}
+function isInside(vaultReal, candidate) {
+  const rel = vaultRelative(vaultReal, candidate);
+  return rel === "" || rel !== ".." && !rel.startsWith("../");
+}
+function existingRegularFileInsideVaultSync(vault, target) {
+  try {
+    const vaultReal = realpathSync(vault);
+    const absolutePath = resolve(vaultReal, target);
+    const rel = vaultRelative(vaultReal, absolutePath);
+    if (!isInside(vaultReal, absolutePath) || rel === "") return false;
+    let current = vaultReal;
+    for (const part of rel.split("/").filter(Boolean)) {
+      current = resolve(current, part);
+      if (lstatSync(current).isSymbolicLink()) return false;
+    }
+    const info = lstatSync(absolutePath);
+    return info.isFile() && !info.isSymbolicLink() && realpathSync(absolutePath) === absolutePath;
+  } catch {
+    return false;
+  }
+}
+async function canonicalVault(vault, target) {
+  try {
+    return ok(await realpath(vault));
+  } catch (error) {
+    return err("VAULT_PATH_INVALID", { target, message: "vault realpath failed", cause: String(error) });
+  }
+}
+async function rejectSymlinkedComponents(vaultReal, absolutePath, target) {
+  const rel = vaultRelative(vaultReal, absolutePath);
+  if (!isInside(vaultReal, absolutePath) || rel === "") {
+    return err("VAULT_PATH_INVALID", { target, message: "target escapes vault" });
+  }
+  const parts = rel.split("/").filter(Boolean);
+  let current = vaultReal;
+  for (const part of parts) {
+    current = resolve(current, part);
+    try {
+      const info = await lstat(current);
+      if (info.isSymbolicLink()) {
+        return err("VAULT_PATH_INVALID", { target, message: "target path may not contain symlink aliases" });
+      }
+    } catch (error) {
+      if (error.code === "ENOENT") break;
+      return err("VAULT_PATH_INVALID", { target, message: "target lstat failed", cause: String(error) });
+    }
+  }
+  return ok(true);
+}
+async function resolveExistingRegularFileInsideVault(vault, target) {
+  const vaultResult = await canonicalVault(vault, target);
+  if (!vaultResult.ok) return vaultResult;
+  const vaultReal = vaultResult.data;
+  const absolutePath = resolve(vaultReal, target);
+  const components = await rejectSymlinkedComponents(vaultReal, absolutePath, target);
+  if (!components.ok) return components;
+  try {
+    const info = await lstat(absolutePath);
+    if (!info.isFile() || info.isSymbolicLink()) {
+      return err("VAULT_PATH_INVALID", { target, message: "target must be a regular non-symlink file" });
+    }
+    const targetReal = await realpath(absolutePath);
+    if (!isInside(vaultReal, targetReal) || targetReal !== absolutePath) {
+      return err("VAULT_PATH_INVALID", { target, message: "target realpath escapes vault or uses an alias" });
+    }
+    return ok(absolutePath);
+  } catch (error) {
+    return err("FILE_NOT_FOUND", { path: target, message: String(error) });
+  }
+}
+async function resolveAbsentTargetInsideVault(vault, target) {
+  const vaultResult = await canonicalVault(vault, target);
+  if (!vaultResult.ok) return vaultResult;
+  const vaultReal = vaultResult.data;
+  const absolutePath = resolve(vaultReal, target);
+  const components = await rejectSymlinkedComponents(vaultReal, dirname(absolutePath), target);
+  if (!components.ok) return components;
+  try {
+    await lstat(absolutePath);
+    return err("RAW_DESTINATION_EXISTS", { path: target });
+  } catch (error) {
+    if (error.code !== "ENOENT") {
+      return err("VAULT_PATH_INVALID", { target, message: "destination lstat failed", cause: String(error) });
+    }
+  }
+  return ok(absolutePath);
+}
 
 // src/utils/log-events.ts
 import { mkdir, open, readFile, readdir } from "fs/promises";
@@ -252,6 +347,74 @@ function hasWikilinkCitations(body) {
   return /\[\[raw\/[^\]]+\]\]/.test(stripped);
 }
 
+// src/utils/raw-operation-policy.ts
+import { posix } from "path";
+var SOURCE_CATEGORIES = /* @__PURE__ */ new Set(["articles", "papers", "transcripts"]);
+function classifyRawPath(value) {
+  const path = value.replaceAll("\\", "/");
+  if (path !== posix.normalize(path) || path.startsWith("/") || path.includes("\0") || path.split("/").includes("..")) {
+    return err("RAW_PATH_INVALID", { path: value });
+  }
+  const parts = path.split("/");
+  if (parts[0] !== "raw") return err("RAW_PATH_OUTSIDE_LAYER", { path });
+  if (parts[1] === "assets" && parts.length > 2) {
+    return ok({ path, category: "assets", storage: "asset", relativeWithinCategory: parts.slice(2).join("/") });
+  }
+  if ((parts[1] === "archived" || parts[1] === "duplicates") && SOURCE_CATEGORIES.has(parts[2] ?? "") && parts.length > 3) {
+    return ok({
+      path,
+      category: parts[2],
+      storage: parts[1] === "archived" ? "archived" : "duplicate",
+      relativeWithinCategory: parts.slice(3).join("/")
+    });
+  }
+  if (SOURCE_CATEGORIES.has(parts[1] ?? "") && parts.length > 2) {
+    return ok({
+      path,
+      category: parts[1],
+      storage: "active",
+      relativeWithinCategory: parts.slice(2).join("/")
+    });
+  }
+  return err("RAW_PATH_UNSUPPORTED", { path });
+}
+function lifecycleDestination(source, operation) {
+  const parsed = classifyRawPath(source);
+  if (!parsed.ok) return parsed;
+  if (parsed.data.category === "assets") {
+    return err("RAW_ASSET_PATH_FROZEN", { path: source, message: "asset lifecycle is logical by default" });
+  }
+  if (parsed.data.storage !== "active") return err("RAW_SOURCE_NOT_ACTIVE", { path: source, storage: parsed.data.storage });
+  if (operation === "archive") return ok(`raw/archived/${parsed.data.category}/${parsed.data.relativeWithinCategory}`);
+  if (operation === "deduplicate") return ok(`raw/duplicates/${parsed.data.category}/${parsed.data.relativeWithinCategory}`);
+  return ok(source);
+}
+function authorizeRawOperation(input) {
+  if (input.operationClass === "read") return ok(true);
+  if (input.operationClass === "rewrite") return err("RAW_REWRITE_FORBIDDEN", { source: input.source });
+  if (input.operationClass === "destructive-remove") {
+    return input.trigger === "attended-apply" && input.explicitExactTarget === true ? ok(true) : err("RAW_DISPOSAL_REQUIRES_EXACT_TARGET_APPROVAL", { source: input.source });
+  }
+  if (input.operationClass === "preserve-move") {
+    if (input.trigger === "report-only") return err("RAW_STRUCTURAL_REPORT_ONLY", { source: input.source, destination: input.destination });
+    if (!input.source || !input.destination) return err("RAW_PATH_INVALID", { source: input.source, destination: input.destination });
+    const source = classifyRawPath(input.source);
+    if (!source.ok) return source;
+    const destination = classifyRawPath(input.destination);
+    if (!destination.ok) return destination;
+    return ok(true);
+  }
+  return ok(true);
+}
+
+// src/utils/operation-id.ts
+import { createHash } from "crypto";
+function operationId(namespace, parts) {
+  const hash = createHash("sha256").update(namespace).update("\0");
+  for (const part of parts) hash.update(part).update("\0");
+  return hash.digest("hex");
+}
+
 // src/utils/source-relocations.ts
 function parse(event) {
   if (event.kind !== "source-relocation") return ok(null);
@@ -311,109 +474,12 @@ function resolveRelocatedSource(target, projection) {
 }
 
 // src/utils/raw-source.ts
-import { join as join2, posix, relative as relative2 } from "path";
-
-// src/utils/vault-path-safety.ts
-import { lstatSync, realpathSync } from "fs";
-import { lstat, realpath } from "fs/promises";
-import { dirname, relative, resolve, sep } from "path";
-function vaultRelative(vaultReal, candidate) {
-  return relative(vaultReal, candidate).split(sep).join("/");
-}
-function isInside(vaultReal, candidate) {
-  const rel = vaultRelative(vaultReal, candidate);
-  return rel === "" || rel !== ".." && !rel.startsWith("../");
-}
-function existingRegularFileInsideVaultSync(vault, target) {
-  try {
-    const vaultReal = realpathSync(vault);
-    const absolutePath = resolve(vaultReal, target);
-    const rel = vaultRelative(vaultReal, absolutePath);
-    if (!isInside(vaultReal, absolutePath) || rel === "") return false;
-    let current = vaultReal;
-    for (const part of rel.split("/").filter(Boolean)) {
-      current = resolve(current, part);
-      if (lstatSync(current).isSymbolicLink()) return false;
-    }
-    const info = lstatSync(absolutePath);
-    return info.isFile() && !info.isSymbolicLink() && realpathSync(absolutePath) === absolutePath;
-  } catch {
-    return false;
-  }
-}
-async function canonicalVault(vault, target) {
-  try {
-    return ok(await realpath(vault));
-  } catch (error) {
-    return err("VAULT_PATH_INVALID", { target, message: "vault realpath failed", cause: String(error) });
-  }
-}
-async function rejectSymlinkedComponents(vaultReal, absolutePath, target) {
-  const rel = vaultRelative(vaultReal, absolutePath);
-  if (!isInside(vaultReal, absolutePath) || rel === "") {
-    return err("VAULT_PATH_INVALID", { target, message: "target escapes vault" });
-  }
-  const parts = rel.split("/").filter(Boolean);
-  let current = vaultReal;
-  for (const part of parts) {
-    current = resolve(current, part);
-    try {
-      const info = await lstat(current);
-      if (info.isSymbolicLink()) {
-        return err("VAULT_PATH_INVALID", { target, message: "target path may not contain symlink aliases" });
-      }
-    } catch (error) {
-      if (error.code === "ENOENT") break;
-      return err("VAULT_PATH_INVALID", { target, message: "target lstat failed", cause: String(error) });
-    }
-  }
-  return ok(true);
-}
-async function resolveExistingRegularFileInsideVault(vault, target) {
-  const vaultResult = await canonicalVault(vault, target);
-  if (!vaultResult.ok) return vaultResult;
-  const vaultReal = vaultResult.data;
-  const absolutePath = resolve(vaultReal, target);
-  const components = await rejectSymlinkedComponents(vaultReal, absolutePath, target);
-  if (!components.ok) return components;
-  try {
-    const info = await lstat(absolutePath);
-    if (!info.isFile() || info.isSymbolicLink()) {
-      return err("VAULT_PATH_INVALID", { target, message: "target must be a regular non-symlink file" });
-    }
-    const targetReal = await realpath(absolutePath);
-    if (!isInside(vaultReal, targetReal) || targetReal !== absolutePath) {
-      return err("VAULT_PATH_INVALID", { target, message: "target realpath escapes vault or uses an alias" });
-    }
-    return ok(absolutePath);
-  } catch (error) {
-    return err("FILE_NOT_FOUND", { path: target, message: String(error) });
-  }
-}
-async function resolveAbsentTargetInsideVault(vault, target) {
-  const vaultResult = await canonicalVault(vault, target);
-  if (!vaultResult.ok) return vaultResult;
-  const vaultReal = vaultResult.data;
-  const absolutePath = resolve(vaultReal, target);
-  const components = await rejectSymlinkedComponents(vaultReal, dirname(absolutePath), target);
-  if (!components.ok) return components;
-  try {
-    await lstat(absolutePath);
-    return err("RAW_DESTINATION_EXISTS", { path: target });
-  } catch (error) {
-    if (error.code !== "ENOENT") {
-      return err("VAULT_PATH_INVALID", { target, message: "destination lstat failed", cause: String(error) });
-    }
-  }
-  return ok(absolutePath);
-}
-
-// src/utils/raw-source.ts
+import { join as join2, posix as posix2, relative as relative2 } from "path";
 function normalizeRawSourceTarget(entry) {
   let target = entry.trim().replace(/^"/, "").replace(/"$/, "").replace(/^'/, "").replace(/'$/, "");
   target = target.replace(/^\^\[/, "").replace(/\]$/, "");
-  if (!target || target.includes("\0") || target.includes("\\") || posix.isAbsolute(target)) return null;
-  if (posix.normalize(target) !== target || target.split("/").some((part) => part === "" || part === "." || part === "..")) return null;
+  if (!target || target.includes("\0") || target.includes("\\") || posix2.isAbsolute(target)) return null;
+  if (posix2.normalize(target) !== target || target.split("/").some((part) => part === "" || part === "." || part === "..")) return null;
   if (!target.startsWith("raw/") && !target.startsWith("_archive/raw/")) return null;
   return target;
 }
@@ -457,74 +523,6 @@ async function rawSourceTargetExists(vault, target) {
   return false;
 }
 
-// src/utils/raw-operation-policy.ts
-import { posix as posix2 } from "path";
-var SOURCE_CATEGORIES = /* @__PURE__ */ new Set(["articles", "papers", "transcripts"]);
-function classifyRawPath(value) {
-  const path = value.replaceAll("\\", "/");
-  if (path !== posix2.normalize(path) || path.startsWith("/") || path.includes("\0") || path.split("/").includes("..")) {
-    return err("RAW_PATH_INVALID", { path: value });
-  }
-  const parts = path.split("/");
-  if (parts[0] !== "raw") return err("RAW_PATH_OUTSIDE_LAYER", { path });
-  if (parts[1] === "assets" && parts.length > 2) {
-    return ok({ path, category: "assets", storage: "asset", relativeWithinCategory: parts.slice(2).join("/") });
-  }
-  if ((parts[1] === "archived" || parts[1] === "duplicates") && SOURCE_CATEGORIES.has(parts[2] ?? "") && parts.length > 3) {
-    return ok({
-      path,
-      category: parts[2],
-      storage: parts[1] === "archived" ? "archived" : "duplicate",
-      relativeWithinCategory: parts.slice(3).join("/")
-    });
-  }
-  if (SOURCE_CATEGORIES.has(parts[1] ?? "") && parts.length > 2) {
-    return ok({
-      path,
-      category: parts[1],
-      storage: "active",
-      relativeWithinCategory: parts.slice(2).join("/")
-    });
-  }
-  return err("RAW_PATH_UNSUPPORTED", { path });
-}
-function lifecycleDestination(source, operation) {
-  const parsed = classifyRawPath(source);
-  if (!parsed.ok) return parsed;
-  if (parsed.data.category === "assets") {
-    return err("RAW_ASSET_PATH_FROZEN", { path: source, message: "asset lifecycle is logical by default" });
-  }
-  if (parsed.data.storage !== "active") return err("RAW_SOURCE_NOT_ACTIVE", { path: source, storage: parsed.data.storage });
-  if (operation === "archive") return ok(`raw/archived/${parsed.data.category}/${parsed.data.relativeWithinCategory}`);
-  if (operation === "deduplicate") return ok(`raw/duplicates/${parsed.data.category}/${parsed.data.relativeWithinCategory}`);
-  return ok(source);
-}
-function authorizeRawOperation(input) {
-  if (input.operationClass === "read") return ok(true);
-  if (input.operationClass === "rewrite") return err("RAW_REWRITE_FORBIDDEN", { source: input.source });
-  if (input.operationClass === "destructive-remove") {
-    return input.trigger === "attended-apply" && input.explicitExactTarget === true ? ok(true) : err("RAW_DISPOSAL_REQUIRES_EXACT_TARGET_APPROVAL", { source: input.source });
-  }
-  if (input.operationClass === "preserve-move") {
-    if (input.trigger === "report-only") return err("RAW_STRUCTURAL_REPORT_ONLY", { source: input.source, destination: input.destination });
-    if (!input.source || !input.destination) return err("RAW_PATH_INVALID", { source: input.source, destination: input.destination });
-    const source = classifyRawPath(input.source);
-    if (!source.ok) return source;
-    const destination = classifyRawPath(input.destination);
-    if (!destination.ok) return destination;
-    return ok(true);
-  }
-  return ok(true);
-}
-
-// src/utils/operation-id.ts
-import { createHash } from "crypto";
-function operationId(namespace, parts) {
-  const hash = createHash("sha256").update(namespace).update("\0");
-  for (const part of parts) hash.update(part).update("\0");
-  return hash.digest("hex");
-}
-
 // src/utils/source-reference-index.ts
 function canonicalTarget(value) {
   const normalized = normalizeRawSourceTarget(value);
@@ -598,17 +596,18 @@ export {
   isLegacyCitationStyle,
   hasOrphanedCitations,
   hasWikilinkCitations,
+  classifyRawPath,
+  lifecycleDestination,
+  authorizeRawOperation,
+  operationId,
+  resolveExistingRegularFileInsideVault,
+  resolveAbsentTargetInsideVault,
   projectSourceRelocations,
   readSourceRelocations,
   buildSourceRelocationProjection,
-  resolveExistingRegularFileInsideVault,
-  resolveAbsentTargetInsideVault,
   normalizeRawSourceTarget,
   rawSourceTargetExistsSync,
   rawSourceTargetExists,
-  classifyRawPath,
-  lifecycleDestination,
-  authorizeRawOperation,
-  operationId,
+  referencesFromText,
   buildSourceReferenceIndex
 };