.gitignore

@@ -1,2 +1,4 @@
-.core/
 .idea/
+.vscode/
+*.log
+.core/

CLAUDE.md

@@ -4,7 +4,7 @@ This file provides guidance to Claude Code (claude.ai/code) when working with co
 
 ## Project Overview
 
-`go-cache` is a storage-agnostic, JSON-based caching library for Go. Module path: `forge.lthn.ai/core/go-cache`. The entire package is two files: `cache.go` and `cache_test.go`.
+`go-cache` is a storage-agnostic, JSON-based caching library for Go. Module path: `dappco.re/go/core/cache`. The entire package is two files: `cache.go` and `cache_test.go`.
 
 ## Commands
 
@@ -31,7 +31,7 @@ core go cov --open
 
 ## Key Architecture Details
 
-- All I/O is delegated to the `io.Medium` interface from `forge.lthn.ai/core/go-io` — the cache never reads/writes files directly. This makes it backend-swappable (local FS, SQLite, S3, in-memory mock).
+- All I/O is delegated to the `io.Medium` interface from `dappco.re/go/core/io` — the cache never reads/writes files directly. This makes it backend-swappable (local FS, SQLite, S3, in-memory mock).
 - `Cache.Path()` enforces path-traversal protection on every public method — keys like `../../etc/passwd` are rejected before any I/O occurs.
 - Expired entries are not eagerly deleted; they remain on disk until overwritten or explicitly removed.
 - The struct has no mutex. Concurrent reads are safe, but concurrent writes to the same key need external synchronization.
@@ -49,5 +49,5 @@ Conventional commits: `feat(cache):`, `fix(cache):`, `refactor:`, etc. The relea
 ## Environment
 
 - Go 1.26+
-- Private modules: `GOPRIVATE=forge.lthn.ai/*`
+- Private modules: `GOPRIVATE=dappco.re/*,forge.lthn.ai/*`
 - Licence: EUPL-1.2

cache.go

@@ -1,4 +1,4 @@
-// Package cache provides a file-based cache for GitHub API responses.
+// Package cache provides a storage-agnostic, JSON-based cache backed by any io.Medium.
 package cache
 
 import (
@@ -9,8 +9,8 @@ import (
 	"strings"
 	"time"
 
-	coreio "forge.lthn.ai/core/go-io"
-	coreerr "forge.lthn.ai/core/go-log"
+	coreio "dappco.re/go/core/io"
+	coreerr "dappco.re/go/core/log"
 )
 
 // DefaultTTL is the default cache expiry time.
@@ -78,7 +78,7 @@ func (c *Cache) Path(key string) (string, error) {
 		return "", coreerr.E("cache.Path", "failed to get absolute path for key", err)
 	}
 
-	if !strings.HasPrefix(absPath, absBase) {
+	if !strings.HasPrefix(absPath, absBase+string(filepath.Separator)) && absPath != absBase {
 		return "", coreerr.E("cache.Path", "invalid cache key: path traversal attempt", nil)
 	}
 

cache_test.go

@@ -4,8 +4,8 @@ import (
 	"testing"
 	"time"
 
-	"forge.lthn.ai/core/go-cache"
-	coreio "forge.lthn.ai/core/go-io"
+	"dappco.re/go/core/cache"
+	coreio "dappco.re/go/core/io"
 )
 
 func TestCache(t *testing.T) {

go.mod

@@ -1,8 +1,10 @@
-module forge.lthn.ai/core/go-cache
+module dappco.re/go/core/cache
 
 go 1.26.0
 
 require (
-	forge.lthn.ai/core/go-io v0.1.7
-	forge.lthn.ai/core/go-log v0.0.4
+	dappco.re/go/core/io v0.2.0
+	dappco.re/go/core/log v0.1.0
 )
+
+require forge.lthn.ai/core/go-log v0.0.4 // indirect

go.sum

@@ -1,5 +1,7 @@
-forge.lthn.ai/core/go-io v0.1.7 h1:Tdb6sqh+zz1lsGJaNX9RFWM6MJ/RhSAyxfulLXrJsbk=
-forge.lthn.ai/core/go-io v0.1.7/go.mod h1:8lRLFk4Dnp5cR/Cyzh9WclD5566TbpdRgwcH7UZLWn4=
+dappco.re/go/core/io v0.2.0 h1:zuudgIiTsQQ5ipVt97saWdGLROovbEB/zdVyy9/l+I4=
+dappco.re/go/core/io v0.2.0/go.mod h1:1QnQV6X9LNgFKfm8SkOtR9LLaj3bDcsOIeJOOyjbL5E=
+dappco.re/go/core/log v0.1.0 h1:pa71Vq2TD2aoEUQWFKwNcaJ3GBY8HbaNGqtE688Unyc=
+dappco.re/go/core/log v0.1.0/go.mod h1:Nkqb8gsXhZAO8VLpx7B8i1iAmohhzqA20b9Zr8VUcJs=
 forge.lthn.ai/core/go-log v0.0.4 h1:KTuCEPgFmuM8KJfnyQ8vPOU1Jg654W74h8IJvfQMfv0=
 forge.lthn.ai/core/go-log v0.0.4/go.mod h1:r14MXKOD3LF/sI8XUJQhRk/SZHBE7jAFVuCfgkXoZPw=
 github.com/davecgh/go-spew v1.1.2-0.20180830191138-d8f796af33cc h1:U9qPSI2PIWSS1VwoXQT9A3Wy9MM3WgvqSxFWenqJduM=