@cogenta/render 0.1.0

package/dist/theme/verify/forbidden.d.ts

@@ -0,0 +1,39 @@
+/**
+ * What a theme may not import, from contract D, "Isolation, vérifiée à
+ * l'installation".
+ *
+ * The lists below are the contract's, not a superset: refusing more than the
+ * frozen contract announces would break themes that are legitimate under it.
+ * What *is* added is the unprefixed spelling of each builtin — `import 'fs'`
+ * and `import 'node:fs'` load the same module, and a check that only knows one
+ * of the two spellings protects nothing.
+ */
+/** Builtins the contract names, in their `node:` spelling. */
+export declare const FORBIDDEN_NODE_BUILTINS: readonly ['node:fs', 'node:child_process', 'node:net', 'node:http', 'node:https', 'node:dgram', 'node:worker_threads', 'node:vm', 'node:process'];
+/** Cogenta packages that carry the database, the secrets, or both. */
+export declare const FORBIDDEN_COGENTA_PACKAGES: readonly ['@cogenta/core', '@cogenta/schema'];
+/**
+ * Database driver packages: "tout paquet de driver de base" made explicit.
+ *
+ * Named one by one rather than pattern-matched, because a refusal must be able
+ * to say *which* driver it saw, and because a pattern loose enough to catch
+ * them all also catches innocent package names.
+ */
+export declare const FORBIDDEN_DATABASE_PACKAGES: readonly ['drizzle-orm', 'pg', 'pg-native', 'postgres', 'mysql', 'mysql2', 'mariadb', 'sqlite3', 'better-sqlite3', 'node:sqlite', 'sqlite', '@libsql/client', '@neondatabase/serverless', '@planetscale/database', '@vercel/postgres', 'knex', 'kysely', 'typeorm', 'sequelize', 'prisma', '@prisma/client', 'mongodb', 'ioredis', 'redis', '@redis/client'];
+export type ForbiddenKind = 'node-builtin' | 'cogenta-package' | 'database-driver';
+interface ForbiddenModule {
+    readonly specifier: string;
+    readonly kind: ForbiddenKind;
+}
+/**
+ * Resolves a module specifier to the forbidden module it reaches, or null.
+ *
+ * Subpaths count: `node:fs/promises` is `node:fs`, `@cogenta/core/db` is
+ * `@cogenta/core`, and `drizzle-orm/postgres-js` is `drizzle-orm`. So does a
+ * relative path that walks out of the theme into one of them — but that is not
+ * a specifier question, it is caught by the scan covering every source file.
+ */
+export declare function matchForbidden(specifier: string): ForbiddenModule | null;
+export declare function describeKind(kind: ForbiddenKind): string;
+export {};
+//# sourceMappingURL=forbidden.d.ts.map

package/dist/theme/verify/forbidden.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"forbidden.d.ts","sourceRoot":"","sources":["../../../src/theme/verify/forbidden.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,8DAA8D;AAC9D,eAAO,MAAM,uBAAuB,YAClC,SAAS,EACT,oBAAoB,EACpB,UAAU,EACV,WAAW,EACX,YAAY,EACZ,YAAY,EACZ,qBAAqB,EACrB,SAAS,EACT,cAAc,CACN,CAAA;AAEV,sEAAsE;AACtE,eAAO,MAAM,0BAA0B,YAAI,eAAe,EAAE,iBAAiB,CAAU,CAAA;AAEvF;;;;;;GAMG;AACH,eAAO,MAAM,2BAA2B,YACtC,aAAa,EACb,IAAI,EACJ,WAAW,EACX,UAAU,EACV,OAAO,EACP,QAAQ,EACR,SAAS,EACT,SAAS,EACT,gBAAgB,EAChB,aAAa,EACb,QAAQ,EACR,gBAAgB,EAChB,0BAA0B,EAC1B,uBAAuB,EACvB,kBAAkB,EAClB,MAAM,EACN,QAAQ,EACR,SAAS,EACT,WAAW,EACX,QAAQ,EACR,gBAAgB,EAChB,SAAS,EACT,SAAS,EACT,OAAO,EACP,eAAe,CACP,CAAA;AAEV,MAAM,MAAM,aAAa,GAAG,cAAc,GAAG,iBAAiB,GAAG,iBAAiB,CAAA;AAElF,UAAU,eAAe;IACvB,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAA;IAC1B,QAAQ,CAAC,IAAI,EAAE,aAAa,CAAA;CAC7B;AAmBD;;;;;;;GAOG;AACH,wBAAgB,cAAc,CAAC,SAAS,EAAE,MAAM,GAAG,eAAe,GAAG,IAAI,CAcxE;AAED,wBAAgB,YAAY,CAAC,IAAI,EAAE,aAAa,GAAG,MAAM,CASxD"}

package/dist/theme/verify/forbidden.js

@@ -0,0 +1,107 @@
+/**
+ * What a theme may not import, from contract D, "Isolation, vérifiée à
+ * l'installation".
+ *
+ * The lists below are the contract's, not a superset: refusing more than the
+ * frozen contract announces would break themes that are legitimate under it.
+ * What *is* added is the unprefixed spelling of each builtin — `import 'fs'`
+ * and `import 'node:fs'` load the same module, and a check that only knows one
+ * of the two spellings protects nothing.
+ */
+/** Builtins the contract names, in their `node:` spelling. */
+export const FORBIDDEN_NODE_BUILTINS = [
+    'node:fs',
+    'node:child_process',
+    'node:net',
+    'node:http',
+    'node:https',
+    'node:dgram',
+    'node:worker_threads',
+    'node:vm',
+    'node:process',
+];
+/** Cogenta packages that carry the database, the secrets, or both. */
+export const FORBIDDEN_COGENTA_PACKAGES = ['@cogenta/core', '@cogenta/schema'];
+/**
+ * Database driver packages: "tout paquet de driver de base" made explicit.
+ *
+ * Named one by one rather than pattern-matched, because a refusal must be able
+ * to say *which* driver it saw, and because a pattern loose enough to catch
+ * them all also catches innocent package names.
+ */
+export const FORBIDDEN_DATABASE_PACKAGES = [
+    'drizzle-orm',
+    'pg',
+    'pg-native',
+    'postgres',
+    'mysql',
+    'mysql2',
+    'mariadb',
+    'sqlite3',
+    'better-sqlite3',
+    'node:sqlite',
+    'sqlite',
+    '@libsql/client',
+    '@neondatabase/serverless',
+    '@planetscale/database',
+    '@vercel/postgres',
+    'knex',
+    'kysely',
+    'typeorm',
+    'sequelize',
+    'prisma',
+    '@prisma/client',
+    'mongodb',
+    'ioredis',
+    'redis',
+    '@redis/client',
+];
+/** Every spelling that resolves to a forbidden module, mapped to why it is forbidden. */
+const FORBIDDEN = new Map();
+for (const specifier of FORBIDDEN_NODE_BUILTINS) {
+    const bare = specifier.slice('node:'.length);
+    FORBIDDEN.set(specifier, { specifier, kind: 'node-builtin' });
+    FORBIDDEN.set(bare, { specifier, kind: 'node-builtin' });
+}
+for (const specifier of FORBIDDEN_COGENTA_PACKAGES) {
+    FORBIDDEN.set(specifier, { specifier, kind: 'cogenta-package' });
+}
+for (const specifier of FORBIDDEN_DATABASE_PACKAGES) {
+    FORBIDDEN.set(specifier, { specifier, kind: 'database-driver' });
+    if (!specifier.startsWith('node:'))
+        FORBIDDEN.set(`node:${specifier}`, { specifier, kind: 'database-driver' });
+}
+/**
+ * Resolves a module specifier to the forbidden module it reaches, or null.
+ *
+ * Subpaths count: `node:fs/promises` is `node:fs`, `@cogenta/core/db` is
+ * `@cogenta/core`, and `drizzle-orm/postgres-js` is `drizzle-orm`. So does a
+ * relative path that walks out of the theme into one of them — but that is not
+ * a specifier question, it is caught by the scan covering every source file.
+ */
+export function matchForbidden(specifier) {
+    const clean = specifier.trim();
+    if (clean.length === 0)
+        return null;
+    const exact = FORBIDDEN.get(clean);
+    if (exact !== undefined)
+        return exact;
+    // A scoped package owns two segments, everything else owns one.
+    const segments = clean.split('/');
+    const rootLength = clean.startsWith('@') ? 2 : 1;
+    if (segments.length <= rootLength)
+        return null;
+    const root = segments.slice(0, rootLength).join('/');
+    return FORBIDDEN.get(root) ?? null;
+}
+export function describeKind(kind) {
+    switch (kind) {
+        case 'node-builtin':
+            return 'a Node builtin the theme sandbox does not grant';
+        case 'cogenta-package':
+            return 'a Cogenta core package, which carries the database and the secrets';
+        case 'database-driver':
+            return 'a database driver';
+    }
+}
+//# sourceMappingURL=forbidden.js.map

package/dist/theme/verify/forbidden.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"forbidden.js","sourceRoot":"","sources":["../../../src/theme/verify/forbidden.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,8DAA8D;AAC9D,MAAM,CAAC,MAAM,uBAAuB,GAAG;IACrC,SAAS;IACT,oBAAoB;IACpB,UAAU;IACV,WAAW;IACX,YAAY;IACZ,YAAY;IACZ,qBAAqB;IACrB,SAAS;IACT,cAAc;CACN,CAAA;AAEV,sEAAsE;AACtE,MAAM,CAAC,MAAM,0BAA0B,GAAG,CAAC,eAAe,EAAE,iBAAiB,CAAU,CAAA;AAEvF;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,2BAA2B,GAAG;IACzC,aAAa;IACb,IAAI;IACJ,WAAW;IACX,UAAU;IACV,OAAO;IACP,QAAQ;IACR,SAAS;IACT,SAAS;IACT,gBAAgB;IAChB,aAAa;IACb,QAAQ;IACR,gBAAgB;IAChB,0BAA0B;IAC1B,uBAAuB;IACvB,kBAAkB;IAClB,MAAM;IACN,QAAQ;IACR,SAAS;IACT,WAAW;IACX,QAAQ;IACR,gBAAgB;IAChB,SAAS;IACT,SAAS;IACT,OAAO;IACP,eAAe;CACP,CAAA;AASV,yFAAyF;AACzF,MAAM,SAAS,GAAG,IAAI,GAAG,EAA2B,CAAA;AAEpD,KAAK,MAAM,SAAS,IAAI,uBAAuB,EAAE,CAAC;IAChD,MAAM,IAAI,GAAG,SAAS,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,CAAA;IAC5C,SAAS,CAAC,GAAG,CAAC,SAAS,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,cAAc,EAAE,CAAC,CAAA;IAC7D,SAAS,CAAC,GAAG,CAAC,IAAI,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,cAAc,EAAE,CAAC,CAAA;AAC1D,CAAC;AACD,KAAK,MAAM,SAAS,IAAI,0BAA0B,EAAE,CAAC;IACnD,SAAS,CAAC,GAAG,CAAC,SAAS,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,iBAAiB,EAAE,CAAC,CAAA;AAClE,CAAC;AACD,KAAK,MAAM,SAAS,IAAI,2BAA2B,EAAE,CAAC;IACpD,SAAS,CAAC,GAAG,CAAC,SAAS,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,iBAAiB,EAAE,CAAC,CAAA;IAChE,IAAI,CAAC,SAAS,CAAC,UAAU,CAAC,OAAO,CAAC;QAChC,SAAS,CAAC,GAAG,CAAC,QAAQ,SAAS,EAAE,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,iBAAiB,EAAE,CAAC,CAAA;AAC9E,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,cAAc,CAAC,SAAiB;IAC9C,MAAM,KAAK,GAAG,SAAS,CAAC,IAAI,EAAE,CAAA;IAC9B,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAA;IAEnC,MAAM,KAAK,GAAG,SAAS,CAAC,GAAG,CAAC,KAAK,CAAC,CAAA;IAClC,IAAI,KAAK,KAAK,SAAS;QAAE,OAAO,KAAK,CAAA;IAErC,gEAAgE;IAChE,MAAM,QAAQ,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAA;IACjC,MAAM,UAAU,GAAG,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAA;IAChD,IAAI,QAAQ,CAAC,MAAM,IAAI,UAAU;QAAE,OAAO,IAAI,CAAA;IAE9C,MAAM,IAAI,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC,EAAE,UAAU,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;IACpD,OAAO,SAAS,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,IAAI,CAAA;AACpC,CAAC;AAED,MAAM,UAAU,YAAY,CAAC,IAAmB;IAC9C,QAAQ,IAAI,EAAE,CAAC;QACb,KAAK,cAAc;YACjB,OAAO,iDAAiD,CAAA;QAC1D,KAAK,iBAAiB;YACpB,OAAO,oEAAoE,CAAA;QAC7E,KAAK,iBAAiB;YACpB,OAAO,mBAAmB,CAAA;IAC9B,CAAC;AACH,CAAC"}

package/dist/theme/verify/scan-file.d.ts

@@ -0,0 +1,15 @@
+import { type SourceFinding } from './scanner.js';
+/**
+ * Which files are scanned. Everything a bundler would turn into code.
+ *
+ * `.astro`, `.ts`, `.js` and their variants are obvious. `.md`/`.mdx` are not
+ * scanned here: MDX imports are a real vector, but MDX is not part of the
+ * theme structure contract D fixes, and scanning it would need a Markdown
+ * reader this check does not have.
+ */
+export declare const SCANNED_EXTENSIONS: readonly ['.astro', '.ts', '.tsx', '.mts', '.cts', '.js', '.jsx', '.mjs', '.cjs'];
+/** Directories never scanned: not theme source, and enormous. */
+export declare const IGNORED_DIRECTORIES: string[];
+/** Findings of one source file, deduplicated by position and kind. */
+export declare function scanSource(path: string, source: string): SourceFinding[];
+//# sourceMappingURL=scan-file.d.ts.map

package/dist/theme/verify/scan-file.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"scan-file.d.ts","sourceRoot":"","sources":["../../../src/theme/verify/scan-file.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,aAAa,EAAY,MAAM,cAAc,CAAA;AAE3D;;;;;;;GAOG;AACH,eAAO,MAAM,kBAAkB,YAC7B,QAAQ,EACR,KAAK,EACL,MAAM,EACN,MAAM,EACN,MAAM,EACN,KAAK,EACL,MAAM,EACN,MAAM,EACN,MAAM,CACE,CAAA;AAEV,iEAAiE;AACjE,eAAO,MAAM,mBAAmB,UAAyD,CAAA;AAmIzF,sEAAsE;AACtE,wBAAgB,UAAU,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,aAAa,EAAE,CAiBxE"}

package/dist/theme/verify/scan-file.js

@@ -0,0 +1,151 @@
+import { scanCode } from './scanner.js';
+/**
+ * Which files are scanned. Everything a bundler would turn into code.
+ *
+ * `.astro`, `.ts`, `.js` and their variants are obvious. `.md`/`.mdx` are not
+ * scanned here: MDX imports are a real vector, but MDX is not part of the
+ * theme structure contract D fixes, and scanning it would need a Markdown
+ * reader this check does not have.
+ */
+export const SCANNED_EXTENSIONS = [
+    '.astro',
+    '.ts',
+    '.tsx',
+    '.mts',
+    '.cts',
+    '.js',
+    '.jsx',
+    '.mjs',
+    '.cjs',
+];
+/** Directories never scanned: not theme source, and enormous. */
+export const IGNORED_DIRECTORIES = ['node_modules', 'dist', '.git', '.astro', 'coverage'];
+/** Position of an absolute offset in the source, both 1-based. */
+function positionAt(source, offset) {
+    let line = 1;
+    let lastBreak = -1;
+    for (let i = 0; i < offset && i < source.length; i += 1) {
+        if (source[i] === '\n') {
+            line += 1;
+            lastBreak = i;
+        }
+    }
+    return { line, column: offset - lastBreak };
+}
+/**
+ * The code inside an `.astro` file: the frontmatter, every `{…}` expression of
+ * the template, and every `<script>` body.
+ *
+ * The template markup itself is skipped rather than lexed, because prose is
+ * full of apostrophes and an apostrophe read as a quote would swallow the rest
+ * of the line — which is how a scanner ends up missing the import it was
+ * written to catch.
+ */
+function astroChunks(source) {
+    const chunks = [];
+    let templateStart = 0;
+    // Astro's own rule: the frontmatter is fenced by `---` at the very start.
+    const fence = /^?\s*---\r?\n/u.exec(source);
+    if (fence !== null) {
+        const bodyStart = fence[0].length;
+        const close = /^---[ \t]*\r?$/mu.exec(source.slice(bodyStart));
+        const bodyEnd = close === null ? source.length : bodyStart + (close.index ?? 0);
+        chunks.push({ code: source.slice(bodyStart, bodyEnd), offset: bodyStart });
+        templateStart = close === null ? source.length : bodyEnd + close[0].length;
+    }
+    for (const chunk of braceExpressions(source, templateStart))
+        chunks.push(chunk);
+    for (const chunk of scriptBodies(source, templateStart))
+        chunks.push(chunk);
+    return chunks;
+}
+/**
+ * Every `{…}` region of the template, brace-matched while respecting the
+ * strings and comments inside it.
+ */
+function braceExpressions(source, from) {
+    const chunks = [];
+    for (let i = from; i < source.length; i += 1) {
+        if (source[i] !== '{')
+            continue;
+        const start = i + 1;
+        let depth = 1;
+        let cursor = start;
+        while (cursor < source.length && depth > 0) {
+            const char = source[cursor];
+            if (char === '"' || char === "'" || char === '`') {
+                cursor = endOfString(source, cursor, char);
+                continue;
+            }
+            if (char === '/' && source[cursor + 1] === '/') {
+                while (cursor < source.length && source[cursor] !== '\n')
+                    cursor += 1;
+                continue;
+            }
+            if (char === '/' && source[cursor + 1] === '*') {
+                const end = source.indexOf('*/', cursor + 2);
+                cursor = end === -1 ? source.length : end + 2;
+                continue;
+            }
+            if (char === '{')
+                depth += 1;
+            else if (char === '}')
+                depth -= 1;
+            cursor += 1;
+        }
+        const end = depth === 0 ? cursor - 1 : source.length;
+        chunks.push({ code: source.slice(start, end), offset: start });
+        i = end;
+    }
+    return chunks;
+}
+/** Index just past a string literal that starts at `start`. */
+function endOfString(source, start, quote) {
+    let cursor = start + 1;
+    while (cursor < source.length) {
+        const char = source[cursor];
+        if (char === '\\') {
+            cursor += 2;
+            continue;
+        }
+        if (char === quote)
+            return cursor + 1;
+        if (quote !== '`' && char === '\n')
+            return cursor;
+        cursor += 1;
+    }
+    return cursor;
+}
+const SCRIPT_TAG = /<script\b[^>]*>/giu;
+function scriptBodies(source, from) {
+    const chunks = [];
+    SCRIPT_TAG.lastIndex = from;
+    let opening = SCRIPT_TAG.exec(source);
+    while (opening !== null) {
+        const start = opening.index + opening[0].length;
+        const end = source.toLowerCase().indexOf('</script', start);
+        const stop = end === -1 ? source.length : end;
+        chunks.push({ code: source.slice(start, stop), offset: start });
+        SCRIPT_TAG.lastIndex = stop;
+        opening = SCRIPT_TAG.exec(source);
+    }
+    return chunks;
+}
+/** Findings of one source file, deduplicated by position and kind. */
+export function scanSource(path, source) {
+    const chunks = path.endsWith('.astro') ? astroChunks(source) : [{ code: source, offset: 0 }];
+    const seen = new Set();
+    const findings = [];
+    for (const chunk of chunks) {
+        const at = positionAt(source, chunk.offset);
+        for (const finding of scanCode(chunk.code, { line: at.line, column: at.column })) {
+            const key = `${finding.kind}:${finding.line}:${finding.column}:${finding.specifier ?? ''}`;
+            if (seen.has(key))
+                continue;
+            seen.add(key);
+            findings.push(finding);
+        }
+    }
+    return findings.sort((a, b) => a.line - b.line || a.column - b.column);
+}
+//# sourceMappingURL=scan-file.js.map

package/dist/theme/verify/scan-file.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"scan-file.js","sourceRoot":"","sources":["../../../src/theme/verify/scan-file.ts"],"names":[],"mappings":"AAAA,OAAO,EAAsB,QAAQ,EAAE,MAAM,cAAc,CAAA;AAE3D;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,kBAAkB,GAAG;IAChC,QAAQ;IACR,KAAK;IACL,MAAM;IACN,MAAM;IACN,MAAM;IACN,KAAK;IACL,MAAM;IACN,MAAM;IACN,MAAM;CACE,CAAA;AAEV,iEAAiE;AACjE,MAAM,CAAC,MAAM,mBAAmB,GAAG,CAAC,cAAc,EAAE,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,UAAU,CAAC,CAAA;AAOzF,kEAAkE;AAClE,SAAS,UAAU,CAAC,MAAc,EAAE,MAAc;IAChD,IAAI,IAAI,GAAG,CAAC,CAAA;IACZ,IAAI,SAAS,GAAG,CAAC,CAAC,CAAA;IAClB,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,MAAM,IAAI,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC;QACxD,IAAI,MAAM,CAAC,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC;YACvB,IAAI,IAAI,CAAC,CAAA;YACT,SAAS,GAAG,CAAC,CAAA;QACf,CAAC;IACH,CAAC;IACD,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,GAAG,SAAS,EAAE,CAAA;AAC7C,CAAC;AAOD;;;;;;;;GAQG;AACH,SAAS,WAAW,CAAC,MAAc;IACjC,MAAM,MAAM,GAAY,EAAE,CAAA;IAC1B,IAAI,aAAa,GAAG,CAAC,CAAA;IAErB,0EAA0E;IAC1E,MAAM,KAAK,GAAG,iBAAiB,CAAC,IAAI,CAAC,MAAM,CAAC,CAAA;IAC5C,IAAI,KAAK,KAAK,IAAI,EAAE,CAAC;QACnB,MAAM,SAAS,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,CAAA;QACjC,MAAM,KAAK,GAAG,kBAAkB,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,CAAA;QAC9D,MAAM,OAAO,GAAG,KAAK,KAAK,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS,GAAG,CAAC,KAAK,CAAC,KAAK,IAAI,CAAC,CAAC,CAAA;QAC/E,MAAM,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,MAAM,CAAC,KAAK,CAAC,SAAS,EAAE,OAAO,CAAC,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC,CAAA;QAC1E,aAAa,GAAG,KAAK,KAAK,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,OAAO,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,CAAA;IAC5E,CAAC;IAED,KAAK,MAAM,KAAK,IAAI,gBAAgB,CAAC,MAAM,EAAE,aAAa,CAAC;QAAE,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;IAC/E,KAAK,MAAM,KAAK,IAAI,YAAY,CAAC,MAAM,EAAE,aAAa,CAAC;QAAE,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;IAE3E,OAAO,MAAM,CAAA;AACf,CAAC;AAED;;;GAGG;AACH,SAAS,gBAAgB,CAAC,MAAc,EAAE,IAAY;IACpD,MAAM,MAAM,GAAY,EAAE,CAAA;IAE1B,KAAK,IAAI,CAAC,GAAG,IAAI,EAAE,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC;QAC7C,IAAI,MAAM,CAAC,CAAC,CAAC,KAAK,GAAG;YAAE,SAAQ;QAE/B,MAAM,KAAK,GAAG,CAAC,GAAG,CAAC,CAAA;QACnB,IAAI,KAAK,GAAG,CAAC,CAAA;QACb,IAAI,MAAM,GAAG,KAAK,CAAA;QAElB,OAAO,MAAM,GAAG,MAAM,CAAC,MAAM,IAAI,KAAK,GAAG,CAAC,EAAE,CAAC;YAC3C,MAAM,IAAI,GAAG,MAAM,CAAC,MAAM,CAAC,CAAA;YAC3B,IAAI,IAAI,KAAK,GAAG,IAAI,IAAI,KAAK,GAAG,IAAI,IAAI,KAAK,GAAG,EAAE,CAAC;gBACjD,MAAM,GAAG,WAAW,CAAC,MAAM,EAAE,MAAM,EAAE,IAAI,CAAC,CAAA;gBAC1C,SAAQ;YACV,CAAC;YACD,IAAI,IAAI,KAAK,GAAG,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC,CAAC,KAAK,GAAG,EAAE,CAAC;gBAC/C,OAAO,MAAM,GAAG,MAAM,CAAC,MAAM,IAAI,MAAM,CAAC,MAAM,CAAC,KAAK,IAAI;oBAAE,MAAM,IAAI,CAAC,CAAA;gBACrE,SAAQ;YACV,CAAC;YACD,IAAI,IAAI,KAAK,GAAG,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC,CAAC,KAAK,GAAG,EAAE,CAAC;gBAC/C,MAAM,GAAG,GAAG,MAAM,CAAC,OAAO,CAAC,IAAI,EAAE,MAAM,GAAG,CAAC,CAAC,CAAA;gBAC5C,MAAM,GAAG,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,GAAG,GAAG,CAAC,CAAA;gBAC7C,SAAQ;YACV,CAAC;YACD,IAAI,IAAI,KAAK,GAAG;gBAAE,KAAK,IAAI,CAAC,CAAA;iBACvB,IAAI,IAAI,KAAK,GAAG;gBAAE,KAAK,IAAI,CAAC,CAAA;YACjC,MAAM,IAAI,CAAC,CAAA;QACb,CAAC;QAED,MAAM,GAAG,GAAG,KAAK,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAA;QACpD,MAAM,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,MAAM,CAAC,KAAK,CAAC,KAAK,EAAE,GAAG,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAA;QAC9D,CAAC,GAAG,GAAG,CAAA;IACT,CAAC;IAED,OAAO,MAAM,CAAA;AACf,CAAC;AAED,+DAA+D;AAC/D,SAAS,WAAW,CAAC,MAAc,EAAE,KAAa,EAAE,KAAa;IAC/D,IAAI,MAAM,GAAG,KAAK,GAAG,CAAC,CAAA;IACtB,OAAO,MAAM,GAAG,MAAM,CAAC,MAAM,EAAE,CAAC;QAC9B,MAAM,IAAI,GAAG,MAAM,CAAC,MAAM,CAAC,CAAA;QAC3B,IAAI,IAAI,KAAK,IAAI,EAAE,CAAC;YAClB,MAAM,IAAI,CAAC,CAAA;YACX,SAAQ;QACV,CAAC;QACD,IAAI,IAAI,KAAK,KAAK;YAAE,OAAO,MAAM,GAAG,CAAC,CAAA;QACrC,IAAI,KAAK,KAAK,GAAG,IAAI,IAAI,KAAK,IAAI;YAAE,OAAO,MAAM,CAAA;QACjD,MAAM,IAAI,CAAC,CAAA;IACb,CAAC;IACD,OAAO,MAAM,CAAA;AACf,CAAC;AAED,MAAM,UAAU,GAAG,oBAAoB,CAAA;AAEvC,SAAS,YAAY,CAAC,MAAc,EAAE,IAAY;IAChD,MAAM,MAAM,GAAY,EAAE,CAAA;IAC1B,UAAU,CAAC,SAAS,GAAG,IAAI,CAAA;IAE3B,IAAI,OAAO,GAAG,UAAU,CAAC,IAAI,CAAC,MAAM,CAAC,CAAA;IACrC,OAAO,OAAO,KAAK,IAAI,EAAE,CAAC;QACxB,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC,MAAM,CAAA;QAC/C,MAAM,GAAG,GAAG,MAAM,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,UAAU,EAAE,KAAK,CAAC,CAAA;QAC3D,MAAM,IAAI,GAAG,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,GAAG,CAAA;QAC7C,MAAM,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,MAAM,CAAC,KAAK,CAAC,KAAK,EAAE,IAAI,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAA;QAC/D,UAAU,CAAC,SAAS,GAAG,IAAI,CAAA;QAC3B,OAAO,GAAG,UAAU,CAAC,IAAI,CAAC,MAAM,CAAC,CAAA;IACnC,CAAC;IAED,OAAO,MAAM,CAAA;AACf,CAAC;AAED,sEAAsE;AACtE,MAAM,UAAU,UAAU,CAAC,IAAY,EAAE,MAAc;IACrD,MAAM,MAAM,GAAG,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC,EAAE,CAAC,CAAA;IAE5F,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAA;IAC9B,MAAM,QAAQ,GAAoB,EAAE,CAAA;IAEpC,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;QAC3B,MAAM,EAAE,GAAG,UAAU,CAAC,MAAM,EAAE,KAAK,CAAC,MAAM,CAAC,CAAA;QAC3C,KAAK,MAAM,OAAO,IAAI,QAAQ,CAAC,KAAK,CAAC,IAAI,EAAE,EAAE,IAAI,EAAE,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,EAAE,CAAC,MAAM,EAAE,CAAC,EAAE,CAAC;YACjF,MAAM,GAAG,GAAG,GAAG,OAAO,CAAC,IAAI,IAAI,OAAO,CAAC,IAAI,IAAI,OAAO,CAAC,MAAM,IAAI,OAAO,CAAC,SAAS,IAAI,EAAE,EAAE,CAAA;YAC1F,IAAI,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC;gBAAE,SAAQ;YAC3B,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAA;YACb,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,CAAA;QACxB,CAAC;IACH,CAAC;IAED,OAAO,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,MAAM,CAAC,CAAA;AACxE,CAAC"}

package/dist/theme/verify/scanner.d.ts

@@ -0,0 +1,52 @@
+import { type ForbiddenKind } from './forbidden.js';
+/**
+ * The static analysis contract D requires, written by hand and on purpose.
+ *
+ * Rule R9 asks for a justification before any dependency, and here there is
+ * none to buy: TypeScript 7 ships a native compiler with no JavaScript parser
+ * API (`typescript.createSourceFile` no longer exists), and Astro's bundled
+ * compiler parses `.astro` files, not the TypeScript inside them. Adding a full
+ * parser — `@babel/parser`, `oxc-parser`, `acorn` + a TS plugin — to answer
+ * three questions about module specifiers would be a large dependency, and a
+ * *native* one in two of the three cases, which rule R10 forbids outright.
+ *
+ * So this is a lexer, not a parser. It never needs the syntax tree: it needs
+ * string literals that sit in module-specifier position, plus two shapes that
+ * are refused whatever they contain. Being a lexer also means it does not
+ * choke on syntax it has never seen, which matters when the input is a theme
+ * written against a newer TypeScript than the one that shipped this check.
+ *
+ * What it deliberately does **not** claim: soundness against a determined
+ * attacker. Nothing static is. It refuses every path that can be recognised —
+ * and refuses outright the paths that cannot be *read*, which is what closes
+ * the aliasing hole: an `import()` whose specifier is computed is refused for
+ * being unreadable, not for what it computes.
+ */
+export type FindingKind = 
+/** A specifier that reaches a module the contract forbids. */
+'forbidden-import'
+/** An `import()` whose specifier cannot be read statically. */
+ | 'unanalysable-import'
+/** CommonJS, which no theme may use — and the usual door back to `fs`. */
+ | 'commonjs-require';
+export interface SourceFinding {
+    readonly kind: FindingKind;
+    /** 1-based, in the file as it is on disk. */
+    readonly line: number;
+    /** 1-based. */
+    readonly column: number;
+    /** The specifier as written, when one could be read. */
+    readonly specifier: string | null;
+    /** The forbidden module the specifier reaches, in its canonical spelling. */
+    readonly resolved: string | null;
+    readonly forbiddenKind: ForbiddenKind | null;
+}
+export interface ScanOptions {
+    /** Line the snippet starts on in the file, 1-based. */
+    readonly line?: number;
+    /** Column the snippet starts on, 1-based. */
+    readonly column?: number;
+}
+/** Scans a fragment of TypeScript or JavaScript. */
+export declare function scanCode(code: string, options?: ScanOptions): SourceFinding[];
+//# sourceMappingURL=scanner.d.ts.map

package/dist/theme/verify/scanner.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"scanner.d.ts","sourceRoot":"","sources":["../../../src/theme/verify/scanner.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,aAAa,EAAkB,MAAM,gBAAgB,CAAA;AAEnE;;;;;;;;;;;;;;;;;;;;;;GAsBG;AAEH,MAAM,MAAM,WAAW;AACrB,8DAA8D;AAC5D,kBAAkB;AACpB,+DAA+D;GAC7D,qBAAqB;AACvB,0EAA0E;GACxE,kBAAkB,CAAA;AAEtB,MAAM,WAAW,aAAa;IAC5B,QAAQ,CAAC,IAAI,EAAE,WAAW,CAAA;IAC1B,6CAA6C;IAC7C,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;IACrB,eAAe;IACf,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;IACvB,wDAAwD;IACxD,QAAQ,CAAC,SAAS,EAAE,MAAM,GAAG,IAAI,CAAA;IACjC,6EAA6E;IAC7E,QAAQ,CAAC,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAA;IAChC,QAAQ,CAAC,aAAa,EAAE,aAAa,GAAG,IAAI,CAAA;CAC7C;AA0TD,MAAM,WAAW,WAAW;IAC1B,uDAAuD;IACvD,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAA;IACtB,6CAA6C;IAC7C,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAA;CACzB;AAED,oDAAoD;AACpD,wBAAgB,QAAQ,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,GAAE,WAAgB,GAAG,aAAa,EAAE,CAEjF"}