@6reduk/workspace-pipeline 0.1.0

package/src/commands/launch.js

@@ -0,0 +1,69 @@
+import { lstat } from 'node:fs/promises';
+import { spawn } from 'node:child_process';
+import { fail } from '../contracts/parse.js';
+import { absoluteRoot, resolveChild } from '../workspace/paths.js';
+import { readState } from '../operations/state.js';
+import { inspectInstallation } from '../operations/doctor.js';
+import { grokEnvironment } from '../launch/grok.js';
+
+export function parseLaunch(args) {
+  if (args[0] !== 'launch' || args[1] !== 'grok') fail('cli.arguments');
+  const result = { command: 'launch', provider: 'grok', execute: false, inspect: false }, seen = new Set();
+  for (let i = 2; i < args.length; i++) {
+    const flag = args[i];
+    if (!['--workspace', '--executable', '--execute', '--inspect'].includes(flag) || seen.has(flag)) fail('cli.arguments');
+    seen.add(flag);
+    if (flag === '--execute') { result.execute = true; continue; }
+    if (flag === '--inspect') { result.inspect = true; continue; }
+    const value = args[++i];
+    if (value === undefined || value.startsWith('--')) fail('cli.arguments');
+    result[flag === '--workspace' ? 'workspace' : 'executable'] = absoluteRoot(value);
+  }
+  if (!result.workspace) fail('cli.workspace-required');
+  if (!result.executable) fail('launch.executable-required');
+  return result;
+}
+
+function spawnNative(executable, args, options) {
+  return new Promise((resolve, reject) => {
+    const child = spawn(executable, args, { ...options, shell: false, stdio: 'inherit' });
+    child.once('error', () => reject(new Error('launch.spawn')));
+    child.once('exit', (code, signal) => resolve({ code, signal }));
+  });
+}
+
+// Dependencies are trusted embedding/test functions, never package data.
+export async function runLaunch(command, stdout, stderr, dependencies = {}) {
+  const doctor = dependencies.doctor ?? inspectInstallation;
+  const state = dependencies.state ?? (wrapper => readState(resolveChild(wrapper, '.pipeline/state.json')));
+  const stat = dependencies.stat ?? lstat;
+  const start = dependencies.start ?? spawnNative;
+  const platform = dependencies.platform ?? process.platform;
+  const parentEnv = dependencies.env ?? process.env;
+  const tty = dependencies.tty ?? Boolean(process.stdin.isTTY && process.stdout.isTTY);
+  // No arbitrary harness arguments: --cwd, worktrees or prompt/config overrides
+  // must not silently change the verified launch scope.
+  const before = await state(command.workspace);
+  const report = await doctor(command.workspace);
+  const after = await state(command.workspace);
+  if (before.digest !== after.digest) fail('launch.state-drift');
+  if (!report.ready || !report.pipeline?.providers.includes('grok')) fail('launch.not-ready');
+  if (!after.value.active?.providers.includes('grok') || after.value.pending !== null) fail('launch.not-ready');
+  if (platform === 'win32' && !/\.exe$/i.test(command.executable)) fail('launch.executable-format');
+  const executable = await stat(command.executable);
+  if (!executable.isFile() || executable.isSymbolicLink()) fail('launch.executable-format');
+  const args = command.inspect ? ['inspect', '--json'] : [];
+  const overlay = grokEnvironment({}, platform);
+  const preview = { command: 'launch', provider: 'grok', workspace: command.workspace,
+    executable: command.executable, args, environmentOverrides: overlay,
+    stateHash: after.digest, configuration: 'verified', runtime: 'not-run',
+    warning: 'Close pipeline configuration editors/updaters during launch. No ongoing configuration lock or runtime certification. Harness may start configured MCP servers.' };
+  if (!command.execute) { await stdout(JSON.stringify(preview) + '\n'); return 0; }
+  if (!command.inspect && !tty) fail('launch.terminal-required');
+  await stderr(JSON.stringify(preview) + '\n');
+  // Fail if a concurrent installer changed state while the launch report was emitted.
+  if ((await state(command.workspace)).digest !== after.digest) fail('launch.state-drift');
+  const result = await start(command.executable, args, { cwd: command.workspace, env: grokEnvironment(parentEnv, platform) });
+  // Process exit is not a statement about model-visible skills or task acceptance.
+  return Number.isInteger(result.code) && result.code >= 0 && result.code <= 255 ? result.code : 1;
+}

package/src/commands/migration-apply.js

@@ -0,0 +1,53 @@
+import path from 'node:path';
+import {readRecord} from '../operations/state.js';
+import {verifyMigrationInstaller} from '../operations/installer-identity.js';
+import {beginLegacyUnityMigration} from '../migrations/legacy-unity-begin.js';
+import {applyLegacyUnityDeactivationResume} from '../migrations/legacy-unity-deactivation-resume-apply.js';
+import {applyLegacyUnityInstallResume} from '../migrations/legacy-unity-install-resume.js';
+import {applyLegacyUnityInstallRecovery} from '../migrations/legacy-unity-install-recovery.js';
+import {applyLegacyUnityCloseoutResume} from '../migrations/legacy-unity-resume-apply.js';
+import {applyLegacyUnityCompensation} from '../migrations/legacy-unity-compensate.js';
+import {fail} from '../contracts/parse.js';
+
+const writers={
+ 'legacy-unity-deactivation-resume-preview':applyLegacyUnityDeactivationResume,
+ 'legacy-unity-install-resume-preview':applyLegacyUnityInstallResume,
+ 'legacy-unity-install-recovery-preview':applyLegacyUnityInstallRecovery,
+ 'legacy-unity-closeout-preview':applyLegacyUnityCloseoutResume,
+ 'legacy-unity-compensation-preview':applyLegacyUnityCompensation
+};
+export async function runMigrationApply(command,stdout,stderr){
+ const envelope=(await readRecord(command.previewFile)).value;
+ const preview=await verifyMigrationInstaller(envelope);
+ if(!preview||preview.workspace!==command.workspace||typeof preview.digest!=='string')fail('migration.preview-binding');
+ if(preview.kind!=='legacy-unity-preview'&&!Object.hasOwn(writers,preview.kind))fail('migration.preview-binding');
+ const approval={decision:'approve',previewDigest:preview.digest};
+ await stderr('Applying the exact saved migration preview. Stop harness sessions and config editors. No automatic rollback.\n');
+ let result;
+ if(preview.kind==='legacy-unity-preview'){
+  const begun=await beginLegacyUnityMigration(preview,approval,command.workspace);
+  try{
+   await stderr(JSON.stringify({recovery:path.resolve(command.workspace,begun.recoveryPath),
+    logs:path.resolve(command.workspace,path.dirname(begun.recoveryPath))})+'\n');
+   await verifyMigrationInstaller(envelope);
+   const phase=await begun.deactivate();
+   if(phase.outcome!=='completed')result={...phase,recoveryPath:begun.recoveryPath};
+   else{
+    await verifyMigrationInstaller(envelope);
+    const installed=await begun.install();
+    if(installed.installationStatus!=='ready')result={...installed,migrationRecoveryPath:begun.recoveryPath};
+    else{
+     await verifyMigrationInstaller(envelope);
+     result={...await begun.finalize(),migrationRecoveryPath:begun.recoveryPath};
+    }
+   }
+  }finally{await begun.lock.release();}
+ }else{
+  await stderr(JSON.stringify({recovery:path.resolve(command.workspace,preview.recoveryPath),
+   logs:path.resolve(command.workspace,path.dirname(preview.recoveryPath))})+'\n');
+  await verifyMigrationInstaller(envelope);
+  result=await writers[preview.kind](preview,approval,command.workspace);
+ }
+ await stdout(JSON.stringify(result)+'\n');
+ return ['completed','legacy-restored'].includes(result.status)?0:1;
+}

package/src/commands/migration.js

@@ -0,0 +1,50 @@
+import {absoluteRoot} from '../workspace/paths.js';
+import {fail} from '../contracts/parse.js';
+import {prepareLegacyUnityPreview} from '../migrations/legacy-unity-preview.js';
+import {prepareLegacyUnityDeactivationResume} from '../migrations/legacy-unity-deactivation-resume.js';
+import {prepareLegacyUnityInstallResume} from '../migrations/legacy-unity-install-resume.js';
+import {prepareLegacyUnityInstallRecovery} from '../migrations/legacy-unity-install-recovery.js';
+import {prepareLegacyUnityCloseoutResume} from '../migrations/legacy-unity-resume.js';
+import {prepareLegacyUnityCompensation} from '../migrations/legacy-unity-compensate.js';
+import {bindMigrationInstaller,readInstallerIdentity} from '../operations/installer-identity.js';
+import {contractDigest} from '../contracts/semantic.js';
+import {runMigrationApply} from './migration-apply.js';
+import {mkdtemp} from 'node:fs/promises';
+import {tmpdir} from 'node:os';
+import path from 'node:path';
+
+const inspectors={deactivation:prepareLegacyUnityDeactivationResume,installation:prepareLegacyUnityInstallResume,
+ recovery:prepareLegacyUnityInstallRecovery,closeout:prepareLegacyUnityCloseoutResume,compensation:prepareLegacyUnityCompensation};
+export function parseMigrationCommand(args){
+ if(args[1]!=='unity'||!['preview','inspect','apply'].includes(args[2]))fail('cli.arguments');
+ const result={command:'migration',action:args[2]},seen=new Set();
+ const allowed=result.action==='apply'?['--workspace','--preview','--json']:result.action==='preview'?['--workspace','--manifest','--network','--json']:['--workspace','--recovery','--phase','--json'];
+ for(let i=3;i<args.length;i++){
+  const flag=args[i];if(!allowed.includes(flag)||seen.has(flag))fail('cli.arguments');seen.add(flag);
+  if(flag==='--json')continue;
+  if(flag==='--network'){result.network=true;continue;}
+  const value=args[++i];if(value===undefined||value.startsWith('--'))fail('cli.arguments');
+  if(flag==='--workspace')result.workspace=absoluteRoot(value);
+  if(flag==='--manifest')result.manifestPath=absoluteRoot(value);
+  if(flag==='--recovery')result.recoveryPath=value;
+  if(flag==='--phase')result.phase=value;
+  if(flag==='--preview')result.previewFile=absoluteRoot(value);
+ }
+ if(!result.workspace)fail('cli.workspace-required');
+ if(result.action==='preview'&&!result.manifestPath)fail('cli.arguments');
+ if(result.action==='apply'&&!result.previewFile)fail('cli.arguments');
+ if(result.action==='inspect'&&(!Object.hasOwn(inspectors,result.phase??'')||typeof result.recoveryPath!=='string'||
+  !/^\.pipeline\/migrations\/[a-f0-9-]{36}\/recovery\.json$/.test(result.recoveryPath)))fail('cli.arguments');
+ return result;
+}
+export async function runMigrationCommand(command,stdout,stderr){
+ if(command.action==='apply')return runMigrationApply(command,stdout,stderr);
+ await stderr('Migration preview may contain private configuration bytes. Save it locally; do not publish it. Inspect before explicit apply.\n');
+ const before=await readInstallerIdentity();
+ const result=command.action==='preview'?await prepareLegacyUnityPreview({wrapper:command.workspace,manifestPath:command.manifestPath,network:command.network===true,
+  tempRoot:await mkdtemp(path.join(tmpdir(),'wpc-migration-prepare-'))}):
+  await inspectors[command.phase](command.workspace,command.recoveryPath);
+ const bound=await bindMigrationInstaller(result);
+ if(contractDigest(before)!==contractDigest(bound.installer))fail('installer.changed');
+ await stdout(JSON.stringify(bound)+'\n');return result.status==='blocked'?1:0;
+}

package/src/commands/repositories.js

@@ -0,0 +1,61 @@
+import path from 'node:path';
+import {lstat} from 'node:fs/promises';
+import {absoluteRoot,resolveChild} from '../workspace/paths.js';
+import {readRecord} from '../operations/state.js';
+import {readRepositoryInputs} from '../operations/repository-inputs.js';
+import {contractDigest} from '../contracts/semantic.js';
+import {fail} from '../contracts/parse.js';
+import {bootstrapLockDirectory} from '../operations/bootstrap-lock.js';
+import {withRecoveryLease,assertRecoveryLeaseHeld} from '../operations/recovery-lease.js';
+import {inspectRepositoryReconciliation,finalizeRepositoryOperations,resumeRepositoryFinalization} from '../operations/repository-reconcile.js';
+
+async function exists(p){try{await lstat(p);return true;}catch(e){if(e.code==='ENOENT')return false;throw e;}}
+export async function prepareRepositoryFinalization(wrapper) {
+  wrapper=absoluteRoot(wrapper);
+  const markerPath=resolveChild(wrapper,'.pipeline/repository-operation.json');
+  const bootstrap=bootstrapLockDirectory(wrapper),blockers=[];
+  for(const p of [bootstrap,bootstrap+'.recovery',bootstrap+'.recovery-resume',resolveChild(wrapper,'.pipeline/lock')])
+    if(await exists(p))blockers.push({code:'repositories.recovery-lock-present',path:p});
+  if(!await exists(markerPath))return {status:'no-pending-marker',wrapper,blockers,executionAuthorized:false,
+    completionVerified:false,pipelineActivated:false};
+  const marker=await readRecord(markerPath);
+  const input=await readRepositoryInputs(wrapper,marker.value.journal,marker.value.previewDigest);
+  const checked=await inspectRepositoryReconciliation(wrapper,input.previewText,input.previewDigest);
+  if(!checked.canFinalize)blockers.push({code:'repositories.effects-unresolved'});
+  const receiptPath=resolveChild(wrapper,'.pipeline/repository-completions/'+path.basename(checked.journal)+'.json');
+  const receipt=await exists(receiptPath)?await readRecord(receiptPath):null;
+  if(receipt && contractDigest(receipt.value)!==contractDigest({schemaVersion:1,status:'repository-effects-verified',
+    reconciliation:checked,pipelineActivated:false}))fail('repositories.recovery-receipt');
+  if((await readRecord(markerPath)).digest!==marker.digest ||
+    (await readRecord(input.path)).digest!==input.recordDigest)fail('repositories.recovery-drift');
+  const body={schemaVersion:1,kind:'repository-finalization-preview',wrapper,
+    status:blockers.length?'blocked':'review-only',blockers,action:receipt?'resume-finalization':'finalize',
+    inputDigest:input.recordDigest,markerDigest:marker.digest,reconciliation:checked,
+    receiptDigest:receipt?.digest??null,executionAuthorized:false,pipelineActivated:false};
+  return {...body,digest:contractDigest(body)};
+}
+export async function applyRepositoryFinalization(wrapper,preview) {
+  wrapper=absoluteRoot(wrapper);
+  const {digest,...body}=preview??{};
+  if(body.kind!=='repository-finalization-preview' || body.wrapper!==wrapper ||
+    body.status!=='review-only' || contractDigest(body)!==digest)fail('repositories.recovery-approval');
+  return withRecoveryLease(wrapper,async lease=>{
+    assertRecoveryLeaseHeld(lease);
+    const fresh=await prepareRepositoryFinalization(wrapper);
+    if(contractDigest(fresh)!==contractDigest(preview))fail('repositories.recovery-stale');
+    const input=await readRepositoryInputs(wrapper,fresh.reconciliation.journal,fresh.reconciliation.previewDigest);
+    const run=fresh.action==='resume-finalization'?resumeRepositoryFinalization:finalizeRepositoryOperations;
+    return run({wrapper,lease,previewText:input.previewText,previewDigest:input.previewDigest,
+      approval:{decision:'approve',reconciliationDigest:fresh.reconciliation.digest}});
+  });
+}
+export async function runRepositoryRecovery(command,stdout) {
+  if(command.apply) {
+    const preview=(await readRecord(command.previewFile)).value;
+    const result=await applyRepositoryFinalization(command.workspace,preview);
+    await stdout(JSON.stringify(result)+'\n');return 0;
+  }
+  const result=await prepareRepositoryFinalization(command.workspace);
+  await stdout(JSON.stringify(result)+'\n');
+  return result.status==='review-only' || (result.status==='no-pending-marker' && !result.blockers.length)?0:1;
+}

package/src/commands/repository-abandon.js

@@ -0,0 +1,16 @@
+import {prepareRepositoryAbandon,inspectRepositoryAbandon,applyRepositoryAbandon} from '../operations/repository-abandon.js';
+import {readRecord} from '../operations/state.js';
+import {fail} from '../contracts/parse.js';
+
+export async function runRepositoryAbandon(command,stdout){
+  const continuation=command.action==='continue-abandon';
+  if(command.apply){
+    const preview=(await readRecord(command.previewFile)).value;
+    if(continuation && preview.attempt!==command.attempt)fail('repository-abandon.attempt');
+    const result=await applyRepositoryAbandon(command.workspace,preview,{continuation});
+    await stdout(JSON.stringify(result)+'\n');return 0;
+  }
+  const result=continuation?await inspectRepositoryAbandon(command.workspace,command.attempt):
+    await prepareRepositoryAbandon(command.workspace);
+  await stdout(JSON.stringify(result)+'\n');return 0;
+}

package/src/commands/repository-ancestors.js

@@ -0,0 +1,21 @@
+import {prepareRepositoryAncestors,applyRepositoryAncestors,inspectRepositoryAncestors,finishRepositoryAncestors} from '../operations/repository-ancestors.js';
+import {readRecord} from '../operations/state.js';
+import {contractDigest} from '../contracts/semantic.js';
+import {fail} from '../contracts/parse.js';
+
+export async function runRepositoryAncestors(c,stdout){
+  let result;
+  if(c.action==='prepare-parent'){
+    if(c.apply){const p=(await readRecord(c.previewFile)).value;if(p.wrapper!==c.workspace)fail('ancestors.workspace');result=await applyRepositoryAncestors(p);}
+    else result=await prepareRepositoryAncestors(c.workspace);
+  }else if(!c.apply){
+    const p=(await readRecord(c.parentPreview)).value;if(p.wrapper!==c.workspace)fail('ancestors.workspace');
+    const observation=await inspectRepositoryAncestors(p),body={kind:'repository-parent-continuation-preview',wrapper:c.workspace,parent:p,observation,executionAuthorized:false};
+    result={...body,digest:contractDigest(body)};
+  }else{
+    const p=(await readRecord(c.previewFile)).value,{digest,...body}=p;
+    if(p.kind!=='repository-parent-continuation-preview' || p.wrapper!==c.workspace || p.parent?.wrapper!==c.workspace || contractDigest(body)!==digest)fail('ancestors.approval');
+    result=await finishRepositoryAncestors(p.parent,p.observation?.digest);
+  }
+  await stdout(JSON.stringify(result)+'\n');return 0;
+}

package/src/commands/repository-locks.js

@@ -0,0 +1,77 @@
+import path from 'node:path';
+import {lstat} from 'node:fs/promises';
+import {absoluteRoot,resolveChild} from '../workspace/paths.js';
+import {fail} from '../contracts/parse.js';
+import {contractDigest} from '../contracts/semantic.js';
+import {readRecord} from '../operations/state.js';
+import {readRepositoryInputs} from '../operations/repository-inputs.js';
+import {bootstrapLockDirectory} from '../operations/bootstrap-lock.js';
+import {inspectRepositoryReconciliation,verifyRepositoryCompletion} from '../operations/repository-reconcile.js';
+import {inspectRepositoryLocks,inspectRepositoryLockRecovery,inspectRepositoryLockResumption,
+  recoverRepositoryLocks,finishRepositoryLockRecovery} from '../operations/repository-lock-reconcile.js';
+
+const uuid=/^[a-f0-9]{8}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{12}$/;
+async function exists(filename){try{await lstat(filename);return true;}catch(e){if(e.code==='ENOENT')return false;throw e;}}
+
+// Explicit journal selection: never guess the newest operation from timestamps,
+// UUID ordering or equal desired-state hashes. All recovery uses retained inputs.
+async function prepare(wrapper,journalId) {
+  wrapper=absoluteRoot(wrapper);if(!uuid.test(journalId??''))fail('repositories.journal-required');
+  const journal='.pipeline/repository-journals/'+journalId;
+  const raw=await readRecord(resolveChild(wrapper,'.pipeline/repository-inputs/'+journalId+'.json'));
+  const input=await readRepositoryInputs(wrapper,journal,raw.value?.preview?.digest);
+  const args={wrapper,journal,previewText:input.previewText,previewDigest:input.previewDigest};
+  if(await exists(resolveChild(wrapper,'.pipeline/repository-operation.json'))) {
+    const subject=await inspectRepositoryReconciliation(wrapper,input.previewText,input.previewDigest);
+    if(subject.journal!==journal || !subject.canFinalize)fail('repositories.effects-unresolved');
+    args.reconciliationDigest=subject.digest;
+  } else {
+    const receipt=await readRecord(resolveChild(wrapper,'.pipeline/repository-completions/'+journalId+'.json'));
+    args.reconciliationDigest=receipt.value?.reconciliation?.digest;
+    await verifyRepositoryCompletion(args);
+  }
+  const base=bootstrapLockDirectory(wrapper);let action,observation;
+  if(await exists(base+'.recovery-resume')) {
+    const approval=await readRecord(path.join(base+'.recovery-resume','approval.json'));
+    args.lockDigest=approval.value?.observation?.lockDigest;
+    args.recoveryDigest=approval.value?.observation?.digest;
+    action='continue';observation=await inspectRepositoryLockResumption(args);
+  } else if(await exists(base+'.recovery')) {
+    const owner=await readRecord(path.join(base+'.recovery','owner.json'));
+    args.lockDigest=owner.value?.lockDigest;
+    action='resume';observation=await inspectRepositoryLockRecovery(args);
+  } else {
+    action='retire';observation=await inspectRepositoryLocks(args);
+  }
+  const stopped=action==='retire'?observation.ownerLiveness==='local-pid-absent':
+    action==='resume'?observation.recoveryOwnerLiveness==='local-pid-absent' &&
+      observation.locations.every(l=>l.ownerLiveness==='local-pid-absent'):
+      observation.resumptionOwnerLiveness==='local-pid-absent' &&
+      observation.current.recoveryOwnerLiveness==='local-pid-absent' &&
+      observation.current.locations.every(l=>l.ownerLiveness==='local-pid-absent');
+  if((await readRecord(input.path)).digest!==input.recordDigest)fail('repositories.recovery-drift');
+  const body={schemaVersion:1,kind:'repository-lock-recovery-preview',wrapper,journalId,action,
+    inputDigest:input.recordDigest,observation,status:stopped?'review-only':'blocked',
+    blockers:stopped?[]:[{code:'repositories.recovery-owner-unconfirmed'}],executionAuthorized:false,pipelineActivated:false};
+  return {preview:{...body,digest:contractDigest(body)},args};
+}
+export async function prepareRepositoryLockRecovery(wrapper,journalId){return (await prepare(wrapper,journalId)).preview;}
+
+export async function applyRepositoryLockRecovery(wrapper,journalId,preview) {
+  wrapper=absoluteRoot(wrapper);const {digest,...body}=preview??{};
+  if(body.kind!=='repository-lock-recovery-preview' || body.wrapper!==wrapper || body.journalId!==journalId ||
+    body.status!=='review-only' || contractDigest(body)!==digest)fail('repositories.recovery-approval');
+  const fresh=await prepare(wrapper,journalId);
+  if(contractDigest(fresh.preview)!==contractDigest(preview))fail('repositories.recovery-stale');
+  // Native writers acquire the kernel lease and independently recompute the exact
+  // approved observation before mutation. Do not acquire a competing nested lease.
+  const key={retire:'lockDigest',resume:'recoveryDigest',continue:'resumptionDigest'}[body.action];
+  const run=body.action==='retire'?recoverRepositoryLocks:finishRepositoryLockRecovery;
+  return run({...fresh.args,approval:{decision:'approve',[key]:fresh.preview.observation.digest}});
+}
+
+export async function runRepositoryLockRecovery(command,stdout) {
+  const result=command.apply?await applyRepositoryLockRecovery(command.workspace,command.journalId,
+    (await readRecord(command.previewFile)).value):await prepareRepositoryLockRecovery(command.workspace,command.journalId);
+  await stdout(JSON.stringify(result)+'\n');return result.status==='blocked'?1:0;
+}

package/src/contracts/parse.js

@@ -0,0 +1,57 @@
+import { parseAllDocuments, isMap, isSeq, isScalar, isAlias } from 'yaml';
+
+export class ContractError extends Error {
+  constructor(code) { super(code); this.name = 'ContractError'; this.code = code; }
+}
+export const fail = code => { throw new ContractError(code); };
+export const MAX_INPUT_BYTES = 2 * 1024 * 1024;
+
+// Do not expose parser messages: they can contain source values and credentials.
+export function parse(text, format = 'yaml') {
+  if (typeof text !== 'string' || !['json', 'yaml'].includes(format)) fail('parse.input');
+  if (Buffer.byteLength(text, 'utf8') > MAX_INPUT_BYTES) fail('parse.size');
+  if (text.charCodeAt(0) === 0xfeff) text = text.slice(1);
+  if (format === 'json') {
+    try { JSON.parse(text); } catch { fail('parse.syntax'); }
+  }
+  let docs;
+  try {
+    docs = parseAllDocuments(text, { version: '1.2', schema: 'core', uniqueKeys: true,
+      strict: true, prettyErrors: false, merge: false, logLevel: 'silent' });
+  } catch { fail('parse.syntax'); }
+  if (docs.length !== 1) fail('parse.documents');
+  const doc = docs[0];
+  if (doc.errors.length || doc.warnings.length) fail('parse.syntax');
+  if (doc.directives.yaml.explicit && doc.directives.yaml.version !== '1.2') fail('parse.version');
+  let count = 0;
+  function inspect(node, depth) {
+    if (++count > 50000 || depth > 64) fail('parse.complexity');
+    if (node === null) return;
+    if (isAlias(node) || node.anchor) fail('parse.alias');
+    if (node.tag) fail('parse.tag');
+  }
+  function convert(node, depth) {
+    inspect(node, depth);
+    if (node === null) return null;
+    if (isMap(node)) {
+      const result = Object.create(null), keys = new Set();
+      for (const pair of node.items) {
+        inspect(pair.key, depth + 1);
+        if (!isScalar(pair.key) || typeof pair.key.value !== 'string') fail('parse.key');
+        const key = pair.key.value;
+        if (keys.has(key)) fail('parse.duplicate');
+        if (['__proto__', 'constructor', 'prototype', '<<'].includes(key)) fail('parse.key');
+        keys.add(key);
+        result[key] = convert(pair.value, depth + 1);
+      }
+      return result;
+    }
+    if (isSeq(node)) return node.items.map(n => convert(n, depth + 1));
+    if (!isScalar(node)) fail('parse.type');
+    const v = node.value;
+    if (typeof v === 'number' && (!Number.isFinite(v) || (Number.isInteger(v) && !Number.isSafeInteger(v)))) fail('parse.number');
+    if (v !== null && !['string', 'boolean', 'number'].includes(typeof v)) fail('parse.type');
+    return v;
+  }
+  return convert(doc.contents, 0);
+}