@aigne/afs 1.11.0-beta → 1.11.0-beta.10

package/dist/path.d.mts

@@ -0,0 +1,93 @@
+//#region src/path.d.ts
+/**
+ * AFS Path Validation and Normalization
+ *
+ * All AFS paths must follow Unix filesystem semantics:
+ * - Must be absolute paths (start with /)
+ * - Use / as path separator (not Windows \)
+ * - No NUL characters in path components
+ * - Consistent semantics regardless of underlying platform
+ */
+/**
+ * Error thrown when path validation fails
+ */
+declare class AFSPathError extends Error {
+  readonly path: string;
+  constructor(message: string, path: string);
+}
+/**
+ * Normalize a path by:
+ * - Collapsing multiple consecutive slashes
+ * - Resolving . (current directory)
+ * - Resolving .. (parent directory) while preventing escape above root
+ * - Removing trailing slashes (except for root /)
+ * - Rejecting whitespace-only path segments
+ *
+ * @throws AFSPathError if a path segment is whitespace-only
+ */
+declare function normalizePath(path: string): string;
+/**
+ * Validate an AFS path
+ *
+ * @param path - The path to validate
+ * @throws AFSPathError if the path is invalid
+ * @returns The normalized path
+ */
+declare function validatePath(path: string): string;
+/**
+ * Validate a module name
+ *
+ * Module names must:
+ * - Not be empty or whitespace-only
+ * - Not contain / or \
+ * - Not contain control characters
+ * - Not be "." or ".."
+ *
+ * @param name - The module name to validate
+ * @throws Error if the name is invalid
+ */
+declare function validateModuleName(name: string): void;
+/**
+ * Parsed canonical AFS path
+ */
+interface ParsedCanonicalPath {
+  /** Namespace name, or null for default namespace */
+  namespace: string | null;
+  /** Path within the namespace (always starts with /) */
+  path: string;
+}
+/**
+ * Check if a string is a canonical AFS path
+ *
+ * Canonical paths have the format:
+ * - $afs/path (default namespace)
+ * - $afs:namespace/path (named namespace)
+ *
+ * @param input - String to check
+ * @returns true if input is a canonical AFS path
+ */
+declare function isCanonicalPath(input: string): boolean;
+/**
+ * Parse a canonical AFS path
+ *
+ * Canonical paths have the format:
+ * - $afs/path (default namespace)
+ * - $afs:namespace/path (named namespace)
+ *
+ * @param canonical - Canonical path string
+ * @returns Parsed path with namespace and path
+ * @throws AFSPathError if path format is invalid
+ */
+declare function parseCanonicalPath(canonical: string): ParsedCanonicalPath;
+/**
+ * Create a canonical AFS path from components
+ *
+ * @param namespace - Namespace name, or null for default namespace
+ * @param path - Path within namespace (must start with /)
+ * @returns Canonical path string
+ * @throws AFSPathError if namespace or path is invalid
+ */
+declare function toCanonicalPath(namespace: string | null, path: string): string;
+//#endregion
+export { AFSPathError, ParsedCanonicalPath, isCanonicalPath, normalizePath, parseCanonicalPath, toCanonicalPath, validateModuleName, validatePath };
+//# sourceMappingURL=path.d.mts.map

package/dist/path.d.mts.map

@@ -0,0 +1 @@
+{"version":3,"file":"path.d.mts","names":[],"sources":["../src/path.ts"],"mappings":";;AAaA;;;;;;;;;;;cAAa,YAAA,SAAqB,KAAA;EAAA,SAGd,IAAA;cADhB,OAAA,UACgB,IAAA;AAAA;;AAwGpB;;;;;AAyCA;;;;iBA9EgB,aAAA,CAAc,IAAA;AAiJ9B;;;;;AAuDA;;AAvDA,iBA5GgB,YAAA,CAAa,IAAA;;;AAmN7B;;;;;AAoFA;;;;;iBA9PgB,kBAAA,CAAmB,IAAA;;;;UAmElB,mBAAA;;EAEf,SAAA;;EAEA,IAAA;AAAA;;;;;;;;;;;iBAmDc,eAAA,CAAgB,KAAA;;;;;;;;;;;;iBAgDhB,kBAAA,CAAmB,SAAA,WAAoB,mBAAA;;;;;;;;;iBAoFvC,eAAA,CAAgB,SAAA,iBAA0B,IAAA"}

package/dist/path.mjs

@@ -0,0 +1,249 @@
+//#region src/path.ts
+/**
+* AFS Path Validation and Normalization
+*
+* All AFS paths must follow Unix filesystem semantics:
+* - Must be absolute paths (start with /)
+* - Use / as path separator (not Windows \)
+* - No NUL characters in path components
+* - Consistent semantics regardless of underlying platform
+*/
+/**
+* Error thrown when path validation fails
+*/
+var AFSPathError = class extends Error {
+	constructor(message, path) {
+		super(message);
+		this.path = path;
+		this.name = "AFSPathError";
+	}
+};
+/**
+* Characters that are not allowed in AFS paths
+*/
+const FORBIDDEN_CHARS = [
+	"\0",
+	"
",
+	"",
+	"",
+	"",
+	"",
+	"",
+	"\x07",
+	"\b",
+	"	",
+	"\n",
+	"\v",
+	"\f",
+	"\r",
+	"",
+	"",
+	"",
+	"",
+	"",
+	"",
+	"",
+	"",
+	"",
+	"",
+	"",
+	"",
+	"",
+	"\x1B",
+	"",
+	"",
+	"",
+	""
+];
+/**
+* Check if a string contains any forbidden control characters
+*/
+function containsForbiddenChars(str) {
+	for (const char of FORBIDDEN_CHARS) if (str.includes(char)) return true;
+	return false;
+}
+/**
+* Normalize a path by:
+* - Collapsing multiple consecutive slashes
+* - Resolving . (current directory)
+* - Resolving .. (parent directory) while preventing escape above root
+* - Removing trailing slashes (except for root /)
+* - Rejecting whitespace-only path segments
+*
+* @throws AFSPathError if a path segment is whitespace-only
+*/
+function normalizePath(path) {
+	const segments = path.split("/").filter((s) => s !== "");
+	const result = [];
+	for (const segment of segments) {
+		if (segment.trim() === "") throw new AFSPathError("Path segment cannot be whitespace-only", path);
+		if (segment === ".") continue;
+		if (segment === "..") {
+			if (result.length > 0) result.pop();
+			continue;
+		}
+		result.push(segment);
+	}
+	return `/${result.join("/")}`;
+}
+/**
+* Validate an AFS path
+*
+* @param path - The path to validate
+* @throws AFSPathError if the path is invalid
+* @returns The normalized path
+*/
+function validatePath(path) {
+	if (!path || path.trim() === "") throw new AFSPathError("Path cannot be empty or whitespace-only", path);
+	if (containsForbiddenChars(path)) throw new AFSPathError("Path contains forbidden control characters", path);
+	if (!path.startsWith("/")) throw new AFSPathError("Path must be absolute (start with /)", path);
+	if (path.replace(/^\/+/, "").startsWith("~")) throw new AFSPathError("Path cannot use tilde expansion", path);
+	return normalizePath(path);
+}
+/**
+* Validate a module name
+*
+* Module names must:
+* - Not be empty or whitespace-only
+* - Not contain / or \
+* - Not contain control characters
+* - Not be "." or ".."
+*
+* @param name - The module name to validate
+* @throws Error if the name is invalid
+*/
+function validateModuleName(name) {
+	if (!name || name.trim() === "") throw new Error("Module name cannot be empty or whitespace-only");
+	if (containsForbiddenChars(name)) throw new Error(`Invalid module name: ${name}. Module name must not contain control characters`);
+	if (name.includes("/")) throw new Error(`Invalid module name: ${name}. Module name must not contain '/'`);
+	if (name.includes("\\")) throw new Error(`Invalid module name: ${name}. Module name must not contain '\\'`);
+	if (name === ".") throw new Error("Invalid module name: '.'. Module name cannot be '.'");
+	if (name === "..") throw new Error("Invalid module name: '..'. Module name cannot be '..'");
+}
+/**
+* Canonical path prefix for AFS
+*/
+const CANONICAL_PREFIX = "$afs";
+/**
+* Characters forbidden in namespace names (security-sensitive)
+*/
+const NAMESPACE_FORBIDDEN_CHARS = [
+	"/",
+	"\\",
+	":",
+	";",
+	"|",
+	"&",
+	"`",
+	"$",
+	"(",
+	")",
+	">",
+	"<",
+	"\n",
+	"\r",
+	"	",
+	"\0",
+	...FORBIDDEN_CHARS
+];
+/**
+* Check if a string contains any namespace-forbidden characters
+*/
+function containsNamespaceForbiddenChars(str) {
+	for (const char of NAMESPACE_FORBIDDEN_CHARS) if (str.includes(char)) return true;
+	return false;
+}
+/**
+* Validate a namespace name
+*
+* @throws AFSPathError if namespace is invalid
+*/
+function validateNamespace(namespace, fullPath) {
+	if (!namespace || namespace.trim() === "") throw new AFSPathError("Namespace cannot be empty or whitespace-only", fullPath);
+	if (containsNamespaceForbiddenChars(namespace)) throw new AFSPathError(`Namespace contains forbidden characters: ${namespace}`, fullPath);
+	if (namespace === "." || namespace === "..") throw new AFSPathError("Namespace cannot be '.' or '..'", fullPath);
+	if (namespace.startsWith("..") || namespace.includes("/..") || namespace.includes("\\..")) throw new AFSPathError("Namespace cannot contain path traversal", fullPath);
+}
+/**
+* Check if a string is a canonical AFS path
+*
+* Canonical paths have the format:
+* - $afs/path (default namespace)
+* - $afs:namespace/path (named namespace)
+*
+* @param input - String to check
+* @returns true if input is a canonical AFS path
+*/
+function isCanonicalPath(input) {
+	if (!input || typeof input !== "string") return false;
+	if (!input.startsWith(CANONICAL_PREFIX)) return false;
+	const afterPrefix = input.slice(4);
+	if (afterPrefix.length === 0) return false;
+	const firstChar = afterPrefix[0];
+	if (firstChar !== "/" && firstChar !== ":") return false;
+	if (firstChar === ":") {
+		const slashIndex = afterPrefix.indexOf("/", 1);
+		if (slashIndex === -1) return false;
+		const namespace = afterPrefix.slice(1, slashIndex);
+		if (!namespace || namespace.trim() === "") return false;
+	}
+	return true;
+}
+/**
+* Parse a canonical AFS path
+*
+* Canonical paths have the format:
+* - $afs/path (default namespace)
+* - $afs:namespace/path (named namespace)
+*
+* @param canonical - Canonical path string
+* @returns Parsed path with namespace and path
+* @throws AFSPathError if path format is invalid
+*/
+function parseCanonicalPath(canonical) {
+	if (!canonical || canonical.trim() === "") throw new AFSPathError("Canonical path cannot be empty", canonical);
+	if (containsForbiddenChars(canonical)) throw new AFSPathError("Canonical path contains forbidden control characters", canonical);
+	if (!canonical.startsWith(CANONICAL_PREFIX)) throw new AFSPathError(`Canonical path must start with '${CANONICAL_PREFIX}', got: ${canonical}`, canonical);
+	const afterPrefix = canonical.slice(4);
+	if (afterPrefix.length === 0) throw new AFSPathError("Canonical path must have '/' or ':' after $afs", canonical);
+	const firstChar = afterPrefix[0];
+	if (firstChar === "/") return {
+		namespace: null,
+		path: normalizePath(afterPrefix)
+	};
+	if (firstChar === ":") {
+		const rest = afterPrefix.slice(1);
+		const slashIndex = rest.indexOf("/");
+		if (slashIndex === -1) throw new AFSPathError("Named namespace path must have '/' after namespace", canonical);
+		const namespace = rest.slice(0, slashIndex);
+		const pathPart = rest.slice(slashIndex);
+		validateNamespace(namespace, canonical);
+		if (namespace.includes(":")) throw new AFSPathError("Namespace cannot contain ':'", canonical);
+		return {
+			namespace,
+			path: normalizePath(pathPart)
+		};
+	}
+	throw new AFSPathError(`Canonical path must have '/' or ':' after $afs, got: '${firstChar}'`, canonical);
+}
+/**
+* Create a canonical AFS path from components
+*
+* @param namespace - Namespace name, or null for default namespace
+* @param path - Path within namespace (must start with /)
+* @returns Canonical path string
+* @throws AFSPathError if namespace or path is invalid
+*/
+function toCanonicalPath(namespace, path) {
+	if (!path || path.trim() === "") throw new AFSPathError("Path cannot be empty", path);
+	if (!path.startsWith("/")) throw new AFSPathError("Path must start with '/'", path);
+	if (containsForbiddenChars(path)) throw new AFSPathError("Path contains forbidden control characters", path);
+	const normalizedPath = normalizePath(path);
+	if (namespace === null || namespace === void 0) return `${CANONICAL_PREFIX}${normalizedPath}`;
+	validateNamespace(namespace, `${CANONICAL_PREFIX}:${namespace}${path}`);
+	return `${CANONICAL_PREFIX}:${namespace}${normalizedPath}`;
+}
+
+//#endregion
+export { AFSPathError, isCanonicalPath, normalizePath, parseCanonicalPath, toCanonicalPath, validateModuleName, validatePath };
+//# sourceMappingURL=path.mjs.map

package/dist/path.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"path.mjs","names":[],"sources":["../src/path.ts"],"sourcesContent":["/**\n * AFS Path Validation and Normalization\n *\n * All AFS paths must follow Unix filesystem semantics:\n * - Must be absolute paths (start with /)\n * - Use / as path separator (not Windows \\)\n * - No NUL characters in path components\n * - Consistent semantics regardless of underlying platform\n */\n\n/**\n * Error thrown when path validation fails\n */\nexport class AFSPathError extends Error {\n  constructor(\n    message: string,\n    public readonly path: string,\n  ) {\n    super(message);\n    this.name = \"AFSPathError\";\n  }\n}\n\n/**\n * Characters that are not allowed in AFS paths\n */\nconst FORBIDDEN_CHARS = [\n  \"\\x00\", // NUL\n  \"\\x01\", // SOH\n  \"\\x02\", // STX\n  \"\\x03\", // ETX\n  \"\\x04\", // EOT\n  \"\\x05\", // ENQ\n  \"\\x06\", // ACK\n  \"\\x07\", // BEL\n  \"\\x08\", // BS\n  \"\\x09\", // TAB\n  \"\\x0a\", // LF\n  \"\\x0b\", // VT\n  \"\\x0c\", // FF\n  \"\\x0d\", // CR\n  \"\\x0e\", // SO\n  \"\\x0f\", // SI\n  \"\\x10\", // DLE\n  \"\\x11\", // DC1\n  \"\\x12\", // DC2\n  \"\\x13\", // DC3\n  \"\\x14\", // DC4\n  \"\\x15\", // NAK\n  \"\\x16\", // SYN\n  \"\\x17\", // ETB\n  \"\\x18\", // CAN\n  \"\\x19\", // EM\n  \"\\x1a\", // SUB\n  \"\\x1b\", // ESC\n  \"\\x1c\", // FS\n  \"\\x1d\", // GS\n  \"\\x1e\", // RS\n  \"\\x1f\", // US\n];\n\n/**\n * Check if a string contains any forbidden control characters\n */\nfunction containsForbiddenChars(str: string): boolean {\n  for (const char of FORBIDDEN_CHARS) {\n    if (str.includes(char)) {\n      return true;\n    }\n  }\n  return false;\n}\n\n/**\n * Normalize a path by:\n * - Collapsing multiple consecutive slashes\n * - Resolving . (current directory)\n * - Resolving .. (parent directory) while preventing escape above root\n * - Removing trailing slashes (except for root /)\n * - Rejecting whitespace-only path segments\n *\n * @throws AFSPathError if a path segment is whitespace-only\n */\nexport function normalizePath(path: string): string {\n  // Split into segments, filtering out empty segments (from multiple slashes)\n  const segments = path.split(\"/\").filter((s) => s !== \"\");\n\n  const result: string[] = [];\n\n  for (const segment of segments) {\n    // Check for whitespace-only segments\n    if (segment.trim() === \"\") {\n      throw new AFSPathError(\"Path segment cannot be whitespace-only\", path);\n    }\n\n    if (segment === \".\") {\n      // Current directory - skip\n      continue;\n    }\n    if (segment === \"..\") {\n      // Parent directory - pop if possible, but never go above root\n      if (result.length > 0) {\n        result.pop();\n      }\n      // If result is empty, we're at root - don't go above\n      continue;\n    }\n    result.push(segment);\n  }\n\n  return `/${result.join(\"/\")}`;\n}\n\n/**\n * Validate an AFS path\n *\n * @param path - The path to validate\n * @throws AFSPathError if the path is invalid\n * @returns The normalized path\n */\nexport function validatePath(path: string): string {\n  // Check for empty or whitespace-only path\n  if (!path || path.trim() === \"\") {\n    throw new AFSPathError(\"Path cannot be empty or whitespace-only\", path);\n  }\n\n  // Check for forbidden control characters\n  if (containsForbiddenChars(path)) {\n    throw new AFSPathError(\"Path contains forbidden control characters\", path);\n  }\n\n  // Must start with / (absolute path)\n  if (!path.startsWith(\"/\")) {\n    throw new AFSPathError(\"Path must be absolute (start with /)\", path);\n  }\n\n  // Check for tilde expansion attempts (must check before normalization)\n  // Tilde at start of path (after any leading /) is an attack\n  const trimmedPath = path.replace(/^\\/+/, \"\");\n  if (trimmedPath.startsWith(\"~\")) {\n    throw new AFSPathError(\"Path cannot use tilde expansion\", path);\n  }\n\n  // Normalize the path\n  const normalized = normalizePath(path);\n\n  return normalized;\n}\n\n/**\n * Validate a module name\n *\n * Module names must:\n * - Not be empty or whitespace-only\n * - Not contain / or \\\n * - Not contain control characters\n * - Not be \".\" or \"..\"\n *\n * @param name - The module name to validate\n * @throws Error if the name is invalid\n */\nexport function validateModuleName(name: string): void {\n  // Check for empty or whitespace-only name\n  if (!name || name.trim() === \"\") {\n    throw new Error(\"Module name cannot be empty or whitespace-only\");\n  }\n\n  // Check for forbidden control characters\n  if (containsForbiddenChars(name)) {\n    throw new Error(\n      `Invalid module name: ${name}. Module name must not contain control characters`,\n    );\n  }\n\n  // Check for path separators\n  if (name.includes(\"/\")) {\n    throw new Error(`Invalid module name: ${name}. Module name must not contain '/'`);\n  }\n\n  if (name.includes(\"\\\\\")) {\n    throw new Error(`Invalid module name: ${name}. Module name must not contain '\\\\'`);\n  }\n\n  // Check for . and ..\n  if (name === \".\") {\n    throw new Error(\"Invalid module name: '.'. Module name cannot be '.'\");\n  }\n\n  if (name === \"..\") {\n    throw new Error(\"Invalid module name: '..'. Module name cannot be '..'\");\n  }\n}\n\n// =============================================================================\n// CANONICAL PATH PARSING\n// =============================================================================\n\n/**\n * Canonical path prefix for AFS\n */\nconst CANONICAL_PREFIX = \"$afs\";\n\n/**\n * Characters forbidden in namespace names (security-sensitive)\n */\nconst NAMESPACE_FORBIDDEN_CHARS = [\n  \"/\", // Path separator\n  \"\\\\\", // Windows path separator\n  \":\", // Namespace separator (only one allowed)\n  \";\", // Shell metachar\n  \"|\", // Shell pipe\n  \"&\", // Shell background\n  \"`\", // Shell command substitution\n  \"$\", // Shell variable (except in $afs prefix)\n  \"(\", // Shell subshell\n  \")\", // Shell subshell\n  \">\", // Shell redirect\n  \"<\", // Shell redirect\n  \"\\n\", // Newline\n  \"\\r\", // Carriage return\n  \"\\t\", // Tab\n  \"\\x00\", // NUL\n  ...FORBIDDEN_CHARS, // All control chars\n];\n\n/**\n * Parsed canonical AFS path\n */\nexport interface ParsedCanonicalPath {\n  /** Namespace name, or null for default namespace */\n  namespace: string | null;\n  /** Path within the namespace (always starts with /) */\n  path: string;\n}\n\n/**\n * Check if a string contains any namespace-forbidden characters\n */\nfunction containsNamespaceForbiddenChars(str: string): boolean {\n  for (const char of NAMESPACE_FORBIDDEN_CHARS) {\n    if (str.includes(char)) {\n      return true;\n    }\n  }\n  return false;\n}\n\n/**\n * Validate a namespace name\n *\n * @throws AFSPathError if namespace is invalid\n */\nfunction validateNamespace(namespace: string, fullPath: string): void {\n  // Check for empty or whitespace-only\n  if (!namespace || namespace.trim() === \"\") {\n    throw new AFSPathError(\"Namespace cannot be empty or whitespace-only\", fullPath);\n  }\n\n  // Check for forbidden characters\n  if (containsNamespaceForbiddenChars(namespace)) {\n    throw new AFSPathError(`Namespace contains forbidden characters: ${namespace}`, fullPath);\n  }\n\n  // Check for path traversal attempts\n  if (namespace === \".\" || namespace === \"..\") {\n    throw new AFSPathError(\"Namespace cannot be '.' or '..'\", fullPath);\n  }\n\n  if (namespace.startsWith(\"..\") || namespace.includes(\"/..\") || namespace.includes(\"\\\\..\")) {\n    throw new AFSPathError(\"Namespace cannot contain path traversal\", fullPath);\n  }\n}\n\n/**\n * Check if a string is a canonical AFS path\n *\n * Canonical paths have the format:\n * - $afs/path (default namespace)\n * - $afs:namespace/path (named namespace)\n *\n * @param input - String to check\n * @returns true if input is a canonical AFS path\n */\nexport function isCanonicalPath(input: string): boolean {\n  if (!input || typeof input !== \"string\") {\n    return false;\n  }\n\n  // Must start with $afs\n  if (!input.startsWith(CANONICAL_PREFIX)) {\n    return false;\n  }\n\n  const afterPrefix = input.slice(CANONICAL_PREFIX.length);\n\n  // After $afs, must have / or :\n  if (afterPrefix.length === 0) {\n    return false;\n  }\n\n  const firstChar = afterPrefix[0];\n  if (firstChar !== \"/\" && firstChar !== \":\") {\n    return false;\n  }\n\n  // If starts with :, must have namespace then /\n  if (firstChar === \":\") {\n    const slashIndex = afterPrefix.indexOf(\"/\", 1);\n    if (slashIndex === -1) {\n      return false; // No / after namespace\n    }\n    const namespace = afterPrefix.slice(1, slashIndex);\n    if (!namespace || namespace.trim() === \"\") {\n      return false; // Empty namespace\n    }\n  }\n\n  return true;\n}\n\n/**\n * Parse a canonical AFS path\n *\n * Canonical paths have the format:\n * - $afs/path (default namespace)\n * - $afs:namespace/path (named namespace)\n *\n * @param canonical - Canonical path string\n * @returns Parsed path with namespace and path\n * @throws AFSPathError if path format is invalid\n */\nexport function parseCanonicalPath(canonical: string): ParsedCanonicalPath {\n  // Check for empty or whitespace-only\n  if (!canonical || canonical.trim() === \"\") {\n    throw new AFSPathError(\"Canonical path cannot be empty\", canonical);\n  }\n\n  // Check for control characters in entire input\n  if (containsForbiddenChars(canonical)) {\n    throw new AFSPathError(\"Canonical path contains forbidden control characters\", canonical);\n  }\n\n  // Must start exactly with $afs (case-sensitive)\n  if (!canonical.startsWith(CANONICAL_PREFIX)) {\n    throw new AFSPathError(\n      `Canonical path must start with '${CANONICAL_PREFIX}', got: ${canonical}`,\n      canonical,\n    );\n  }\n\n  const afterPrefix = canonical.slice(CANONICAL_PREFIX.length);\n\n  // After $afs, must have / or :\n  if (afterPrefix.length === 0) {\n    throw new AFSPathError(\"Canonical path must have '/' or ':' after $afs\", canonical);\n  }\n\n  const firstChar = afterPrefix[0];\n\n  // Default namespace: $afs/path\n  if (firstChar === \"/\") {\n    const pathPart = afterPrefix; // Includes leading /\n    const normalizedPath = normalizePath(pathPart);\n    return {\n      namespace: null,\n      path: normalizedPath,\n    };\n  }\n\n  // Named namespace: $afs:namespace/path\n  if (firstChar === \":\") {\n    const rest = afterPrefix.slice(1); // Skip the :\n\n    // Find the / that separates namespace from path\n    const slashIndex = rest.indexOf(\"/\");\n    if (slashIndex === -1) {\n      throw new AFSPathError(\"Named namespace path must have '/' after namespace\", canonical);\n    }\n\n    const namespace = rest.slice(0, slashIndex);\n    const pathPart = rest.slice(slashIndex); // Includes leading /\n\n    // Validate namespace\n    validateNamespace(namespace, canonical);\n\n    // Check for multiple colons in namespace (already forbidden by validateNamespace,\n    // but explicit check for clarity)\n    if (namespace.includes(\":\")) {\n      throw new AFSPathError(\"Namespace cannot contain ':'\", canonical);\n    }\n\n    // Validate and normalize path\n    const normalizedPath = normalizePath(pathPart);\n\n    return {\n      namespace,\n      path: normalizedPath,\n    };\n  }\n\n  // Invalid character after $afs\n  throw new AFSPathError(\n    `Canonical path must have '/' or ':' after $afs, got: '${firstChar}'`,\n    canonical,\n  );\n}\n\n/**\n * Create a canonical AFS path from components\n *\n * @param namespace - Namespace name, or null for default namespace\n * @param path - Path within namespace (must start with /)\n * @returns Canonical path string\n * @throws AFSPathError if namespace or path is invalid\n */\nexport function toCanonicalPath(namespace: string | null, path: string): string {\n  // Validate path\n  if (!path || path.trim() === \"\") {\n    throw new AFSPathError(\"Path cannot be empty\", path);\n  }\n\n  if (!path.startsWith(\"/\")) {\n    throw new AFSPathError(\"Path must start with '/'\", path);\n  }\n\n  if (containsForbiddenChars(path)) {\n    throw new AFSPathError(\"Path contains forbidden control characters\", path);\n  }\n\n  // Normalize path\n  const normalizedPath = normalizePath(path);\n\n  // Default namespace\n  if (namespace === null || namespace === undefined) {\n    return `${CANONICAL_PREFIX}${normalizedPath}`;\n  }\n\n  // Validate namespace\n  validateNamespace(namespace, `${CANONICAL_PREFIX}:${namespace}${path}`);\n\n  // Named namespace\n  return `${CANONICAL_PREFIX}:${namespace}${normalizedPath}`;\n}\n"],"mappings":";;;;;;;;;;;;;AAaA,IAAa,eAAb,cAAkC,MAAM;CACtC,YACE,SACA,AAAgB,MAChB;AACA,QAAM,QAAQ;EAFE;AAGhB,OAAK,OAAO;;;;;;AAOhB,MAAM,kBAAkB;CACtB;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACD;;;;AAKD,SAAS,uBAAuB,KAAsB;AACpD,MAAK,MAAM,QAAQ,gBACjB,KAAI,IAAI,SAAS,KAAK,CACpB,QAAO;AAGX,QAAO;;;;;;;;;;;;AAaT,SAAgB,cAAc,MAAsB;CAElD,MAAM,WAAW,KAAK,MAAM,IAAI,CAAC,QAAQ,MAAM,MAAM,GAAG;CAExD,MAAM,SAAmB,EAAE;AAE3B,MAAK,MAAM,WAAW,UAAU;AAE9B,MAAI,QAAQ,MAAM,KAAK,GACrB,OAAM,IAAI,aAAa,0CAA0C,KAAK;AAGxE,MAAI,YAAY,IAEd;AAEF,MAAI,YAAY,MAAM;AAEpB,OAAI,OAAO,SAAS,EAClB,QAAO,KAAK;AAGd;;AAEF,SAAO,KAAK,QAAQ;;AAGtB,QAAO,IAAI,OAAO,KAAK,IAAI;;;;;;;;;AAU7B,SAAgB,aAAa,MAAsB;AAEjD,KAAI,CAAC,QAAQ,KAAK,MAAM,KAAK,GAC3B,OAAM,IAAI,aAAa,2CAA2C,KAAK;AAIzE,KAAI,uBAAuB,KAAK,CAC9B,OAAM,IAAI,aAAa,8CAA8C,KAAK;AAI5E,KAAI,CAAC,KAAK,WAAW,IAAI,CACvB,OAAM,IAAI,aAAa,wCAAwC,KAAK;AAMtE,KADoB,KAAK,QAAQ,QAAQ,GAAG,CAC5B,WAAW,IAAI,CAC7B,OAAM,IAAI,aAAa,mCAAmC,KAAK;AAMjE,QAFmB,cAAc,KAAK;;;;;;;;;;;;;;AAiBxC,SAAgB,mBAAmB,MAAoB;AAErD,KAAI,CAAC,QAAQ,KAAK,MAAM,KAAK,GAC3B,OAAM,IAAI,MAAM,iDAAiD;AAInE,KAAI,uBAAuB,KAAK,CAC9B,OAAM,IAAI,MACR,wBAAwB,KAAK,mDAC9B;AAIH,KAAI,KAAK,SAAS,IAAI,CACpB,OAAM,IAAI,MAAM,wBAAwB,KAAK,oCAAoC;AAGnF,KAAI,KAAK,SAAS,KAAK,CACrB,OAAM,IAAI,MAAM,wBAAwB,KAAK,qCAAqC;AAIpF,KAAI,SAAS,IACX,OAAM,IAAI,MAAM,sDAAsD;AAGxE,KAAI,SAAS,KACX,OAAM,IAAI,MAAM,wDAAwD;;;;;AAW5E,MAAM,mBAAmB;;;;AAKzB,MAAM,4BAA4B;CAChC;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA,GAAG;CACJ;;;;AAeD,SAAS,gCAAgC,KAAsB;AAC7D,MAAK,MAAM,QAAQ,0BACjB,KAAI,IAAI,SAAS,KAAK,CACpB,QAAO;AAGX,QAAO;;;;;;;AAQT,SAAS,kBAAkB,WAAmB,UAAwB;AAEpE,KAAI,CAAC,aAAa,UAAU,MAAM,KAAK,GACrC,OAAM,IAAI,aAAa,gDAAgD,SAAS;AAIlF,KAAI,gCAAgC,UAAU,CAC5C,OAAM,IAAI,aAAa,4CAA4C,aAAa,SAAS;AAI3F,KAAI,cAAc,OAAO,cAAc,KACrC,OAAM,IAAI,aAAa,mCAAmC,SAAS;AAGrE,KAAI,UAAU,WAAW,KAAK,IAAI,UAAU,SAAS,MAAM,IAAI,UAAU,SAAS,OAAO,CACvF,OAAM,IAAI,aAAa,2CAA2C,SAAS;;;;;;;;;;;;AAc/E,SAAgB,gBAAgB,OAAwB;AACtD,KAAI,CAAC,SAAS,OAAO,UAAU,SAC7B,QAAO;AAIT,KAAI,CAAC,MAAM,WAAW,iBAAiB,CACrC,QAAO;CAGT,MAAM,cAAc,MAAM,MAAM,EAAwB;AAGxD,KAAI,YAAY,WAAW,EACzB,QAAO;CAGT,MAAM,YAAY,YAAY;AAC9B,KAAI,cAAc,OAAO,cAAc,IACrC,QAAO;AAIT,KAAI,cAAc,KAAK;EACrB,MAAM,aAAa,YAAY,QAAQ,KAAK,EAAE;AAC9C,MAAI,eAAe,GACjB,QAAO;EAET,MAAM,YAAY,YAAY,MAAM,GAAG,WAAW;AAClD,MAAI,CAAC,aAAa,UAAU,MAAM,KAAK,GACrC,QAAO;;AAIX,QAAO;;;;;;;;;;;;;AAcT,SAAgB,mBAAmB,WAAwC;AAEzE,KAAI,CAAC,aAAa,UAAU,MAAM,KAAK,GACrC,OAAM,IAAI,aAAa,kCAAkC,UAAU;AAIrE,KAAI,uBAAuB,UAAU,CACnC,OAAM,IAAI,aAAa,wDAAwD,UAAU;AAI3F,KAAI,CAAC,UAAU,WAAW,iBAAiB,CACzC,OAAM,IAAI,aACR,mCAAmC,iBAAiB,UAAU,aAC9D,UACD;CAGH,MAAM,cAAc,UAAU,MAAM,EAAwB;AAG5D,KAAI,YAAY,WAAW,EACzB,OAAM,IAAI,aAAa,kDAAkD,UAAU;CAGrF,MAAM,YAAY,YAAY;AAG9B,KAAI,cAAc,IAGhB,QAAO;EACL,WAAW;EACX,MAHqB,cADN,YAC6B;EAI7C;AAIH,KAAI,cAAc,KAAK;EACrB,MAAM,OAAO,YAAY,MAAM,EAAE;EAGjC,MAAM,aAAa,KAAK,QAAQ,IAAI;AACpC,MAAI,eAAe,GACjB,OAAM,IAAI,aAAa,sDAAsD,UAAU;EAGzF,MAAM,YAAY,KAAK,MAAM,GAAG,WAAW;EAC3C,MAAM,WAAW,KAAK,MAAM,WAAW;AAGvC,oBAAkB,WAAW,UAAU;AAIvC,MAAI,UAAU,SAAS,IAAI,CACzB,OAAM,IAAI,aAAa,gCAAgC,UAAU;AAMnE,SAAO;GACL;GACA,MAJqB,cAAc,SAAS;GAK7C;;AAIH,OAAM,IAAI,aACR,yDAAyD,UAAU,IACnE,UACD;;;;;;;;;;AAWH,SAAgB,gBAAgB,WAA0B,MAAsB;AAE9E,KAAI,CAAC,QAAQ,KAAK,MAAM,KAAK,GAC3B,OAAM,IAAI,aAAa,wBAAwB,KAAK;AAGtD,KAAI,CAAC,KAAK,WAAW,IAAI,CACvB,OAAM,IAAI,aAAa,4BAA4B,KAAK;AAG1D,KAAI,uBAAuB,KAAK,CAC9B,OAAM,IAAI,aAAa,8CAA8C,KAAK;CAI5E,MAAM,iBAAiB,cAAc,KAAK;AAG1C,KAAI,cAAc,QAAQ,cAAc,OACtC,QAAO,GAAG,mBAAmB;AAI/B,mBAAkB,WAAW,GAAG,iBAAiB,GAAG,YAAY,OAAO;AAGvE,QAAO,GAAG,iBAAiB,GAAG,YAAY"}