@entelekheia/ref-id 0.2.0 → 0.4.0

package/README.md

@@ -7,7 +7,20 @@ The package embeds `spec/ref-id.json` and is held to it by that file's conforman
 ref:[<version>:]<type>:<locator>[;<qualifier>=<value>]*[#<declared-name-path>[;<refinement>=<value>]*]
 ```
 
-<!-- PROOF PLACEHOLDER: copy the smallest runnable example from test/ once the vectors pass. -->
+```ts
+import { parse } from "@entelekheia/ref-id"
+
+parse("ref:pkg:npm/@acme/scanner-core@0.1.0#Observation")
+// => {
+//   status: "ok",
+//   type: "pkg",
+//   locator: "npm/@acme/scanner-core@0.1.0",
+//   fragment: { path: "Observation", refinements: [] },
+//   delegated: "pkg:npm/@acme/scanner-core@0.1.0",
+//   canonical: "pkg:npm/%40acme/scanner-core@0.1.0",
+//   ...
+// }
+```
 
 ## Why
 
@@ -25,13 +38,66 @@ npm install @entelekheia/ref-id
 
 ## Usage
 
-The entry points are `parse`, `serialise`, `digest` and `validateEnvelope`; their contracts are the
-vectors in `spec/ref-id.json` (`parse`, `roundtrip`, `digest`, `envelope`). An unknown locator type parses
-and degrades to `uncovered`; it never throws.
+The entry points are `parse`, `serialise`, `digest`, `validateEnvelope`, `samePackage` and `covers`; their
+contracts are the vectors in `spec/ref-id.json` (`parse`, `roundtrip`, `digest`, `envelope`,
+`comparison`). An unknown locator type parses and degrades to `uncovered`; it never throws.
+
+Three questions get three answers, and they are not interchangeable:
+
+```ts
+import { covers, sameIdentifier, samePackage } from "@entelekheia/ref-id"
+
+sameIdentifier("pkg:npm/x@1.0.0", "pkg:npm/x@2.0.0") // false — two identifiers, compared byte for byte
+samePackage("ref:pkg:npm/x@1.0.0", "ref:pkg:npm/x@2.0.0") // true  — one released thing, two versions
+covers("ref:pkg:npm/x", "ref:pkg:npm/x@1.0.0") // true  — the general covers the specific
+covers("ref:pkg:npm/x@1.0.0", "ref:pkg:npm/x") // false — and never the reverse
+```
+
+`sameIdentifier` is what a digest and an envelope are built on, so it stays strict. `samePackage` is
+symmetric and ignores the locator's version, and only where the type declares it carries one — a mailbox's
+`@` and a served model's quantisation key are not versions. `covers` is **asymmetric**: what the first
+identifier leaves undeclared, the second may declare freely; what the first declares, the second must
+declare identically. That is what makes a partial identifier a query over a store keyed by identifier.
+
+## Environments
+
+**Node.js 22 or later, and any browser reached through a bundler.** The package ships two builds of one
+source, and `exports` picks between them: a bundler that honours the `browser` condition takes the browser
+build, everything else takes the default. Nothing to configure, and the public API is the same either way.
+
+|  | Node | Browser |
+|---|---|---|
+| Where the specification comes from | `spec/ref-id.json`, read from disk on first use | a constant compiled into the build |
+| When its integrity is established | at load — the bytes are hashed and compared with the sidecar, and a mismatch throws | at build — the generator refuses to emit from a specification that fails its sidecar, and a staleness check refuses a compiled constant that no longer matches the file |
+| sha256 for `digest()` | Node's `crypto` | `@noble/hashes` (pure JavaScript, no dependencies) |
+
+**What the browser build gives up**, stated rather than discovered:
+
+- **No integrity check at runtime.** There is no file to compare the constant against, and hashing it
+  against a digest compiled from the same source in the same build would be a check that cannot fail —
+  which reads as a guarantee and is a tautology. The build exports `SPEC_DIGEST`, the digest
+  `spec/ref-id.json` carried when the constant was generated; it is a statement about provenance, not a
+  verification, and it is labelled as one.
+- **No `loadSpecFrom`.** It takes a directory to read a specification and its sidecar from. A browser has
+  neither, so the browser build does not export it; every other export is present and identical.
+  **TypeScript will not warn you about that on the default configuration.** Under
+  `"moduleResolution": "bundler"` without `customConditions`, the compiler resolves types through the
+  default condition — which does declare `loadSpecFrom` — while the bundler picks the browser build at
+  build time. `tsc --noEmit` then passes on an import that fails when the bundle is produced. Add
+  `"customConditions": ["browser"]` to your `tsconfig.json` and the compiler sees the same surface your
+  bundler does.
+- **`digest()` is sha256 only.** The algorithm is specification data, and the browser implementation
+  honours `sha256` alone: a specification naming another one throws a `SpecVersionError` naming it, where
+  Node would honour whatever its own `crypto` honours.
+- **The compiled-in specification costs bundle size.** It is the whole published file, including the parts
+  a given consumer never reads.
 
-## Requirements
+The two builds are held to each other by `npm run test:differential`, which runs the browser build as a
+fourth implementation beside Node, Rust and Swift over every input the specification names, and fails on
+the first disagreement. `npm run build` additionally walks the emitted browser module graph and refuses it
+if any Node builtin — or anything resolving a path against a module's own location — survives into it.
 
-Node.js 22 or later. Runtime dependency: `packageurl-js` (pure JavaScript). No native modules.
+Runtime dependencies: `packageurl-js` and `@noble/hashes`, both pure JavaScript. No native modules.
 
 ## License
 

package/dist/canonical.d.ts

@@ -0,0 +1,17 @@
+import type { ParseResult } from "./types.ts";
+/**
+ * The canonical form of an identifier: the same identifier with its qualifiers sorted by key.
+ *
+ * Sorting is by UTF-16 code unit, the order this specification already uses for its own file, and it is
+ * the cheapest canonicalisation rather than the point. What is load-bearing is that one deterministic
+ * order exists, so any two implementations reach the same answer about whether two identifiers are one.
+ *
+ * Every other part is left exactly as parsed. **Refinements are not sorted** — they sit on the fragment
+ * side and are positional, `lines=1,20` being a range, so reordering them would change what is named.
+ *
+ * A malformed identifier has no canonical form and is refused, for the reason `serialise` gives: there is
+ * no faithful way to write back a string whose failing part was never decomposed.
+ */
+export declare function canonical(identifier: string | ParseResult): string;
+/** Whether two identifiers name one thing. Order of qualifiers does not distinguish; everything else does. */
+export declare function sameIdentifier(a: string | ParseResult, b: string | ParseResult): boolean;

package/dist/canonical.js

@@ -0,0 +1,33 @@
+// SPDX-License-Identifier: Apache-2.0
+//
+// The form two identifiers are compared in. `;a=1;b=2` and `;b=2;a=1` name one thing, so identity is
+// judged on this rather than on the bytes a producer happened to write.
+import { parse } from "./parse.js";
+import { serialise } from "./serialise.js";
+import { loadSpec, status } from "./spec.js";
+/**
+ * The canonical form of an identifier: the same identifier with its qualifiers sorted by key.
+ *
+ * Sorting is by UTF-16 code unit, the order this specification already uses for its own file, and it is
+ * the cheapest canonicalisation rather than the point. What is load-bearing is that one deterministic
+ * order exists, so any two implementations reach the same answer about whether two identifiers are one.
+ *
+ * Every other part is left exactly as parsed. **Refinements are not sorted** — they sit on the fragment
+ * side and are positional, `lines=1,20` being a range, so reordering them would change what is named.
+ *
+ * A malformed identifier has no canonical form and is refused, for the reason `serialise` gives: there is
+ * no faithful way to write back a string whose failing part was never decomposed.
+ */
+export function canonical(identifier) {
+    const spec = loadSpec();
+    const parsed = typeof identifier === "string" ? parse(identifier) : identifier;
+    if (parsed.status === status(spec, "malformed"))
+        return serialise(parsed); // throws, naming the failing part
+    const sorted = [...parsed.qualifiers].sort(([a], [b]) => (a < b ? -1 : a > b ? 1 : 0));
+    return serialise({ ...parsed, qualifiers: sorted });
+}
+/** Whether two identifiers name one thing. Order of qualifiers does not distinguish; everything else does. */
+export function sameIdentifier(a, b) {
+    return canonical(a) === canonical(b);
+}
+//# sourceMappingURL=canonical.js.map

package/dist/canonical.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"canonical.js","sourceRoot":"","sources":["../src/canonical.ts"],"names":[],"mappings":"AAAA,sCAAsC;AACtC,EAAE;AACF,qGAAqG;AACrG,wEAAwE;AAExE,OAAO,EAAE,KAAK,EAAE,MAAM,YAAY,CAAA;AAClC,OAAO,EAAE,SAAS,EAAE,MAAM,gBAAgB,CAAA;AAC1C,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,WAAW,CAAA;AAG5C;;;;;;;;;;;;GAYG;AACH,MAAM,UAAU,SAAS,CAAC,UAAgC;IACxD,MAAM,IAAI,GAAG,QAAQ,EAAE,CAAA;IACvB,MAAM,MAAM,GAAG,OAAO,UAAU,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,UAAU,CAAA;IAC9E,IAAI,MAAM,CAAC,MAAM,KAAK,MAAM,CAAC,IAAI,EAAE,WAAW,CAAC;QAAE,OAAO,SAAS,CAAC,MAAM,CAAC,CAAA,CAAC,kCAAkC;IAC5G,MAAM,MAAM,GAAG,CAAC,GAAG,MAAM,CAAC,UAAU,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAA;IACtF,OAAO,SAAS,CAAC,EAAE,GAAG,MAAM,EAAE,UAAU,EAAE,MAAM,EAAE,CAAC,CAAA;AACrD,CAAC;AAED,8GAA8G;AAC9G,MAAM,UAAU,cAAc,CAAC,CAAuB,EAAE,CAAuB;IAC7E,OAAO,SAAS,CAAC,CAAC,CAAC,KAAK,SAAS,CAAC,CAAC,CAAC,CAAA;AACtC,CAAC"}

package/dist/digest.js

@@ -3,7 +3,7 @@
 // sha256 over the UTF-8 bytes of the joined identifier strings, per `spec.digest`: declared order,
 // no deduplication, and a refusal for a member that carries the join character — without it two
 // different sequences could share one digest, and the envelope invariant would admit both.
-import { createHash } from "node:crypto";
+import { hashHex } from "./hash.js";
 import { DigestError } from "./errors.js";
 import { FIELD } from "./grammar.js";
 import { loadSpec, part } from "./spec.js";
@@ -20,7 +20,7 @@ export function digest(members) {
         }
     }
     const joined = snapshot.join(spec.digest.join);
-    const hex = createHash(spec.digest.algorithm).update(joined, spec.digest.encoding).digest("hex");
+    const hex = hashHex(spec.digest.algorithm, spec.digest.encoding, joined);
     return `${spec.digest.algorithm}${FIELD}${hex}`;
 }
 //# sourceMappingURL=digest.js.map

package/dist/digest.js.map

@@ -1 +1 @@
-{"version":3,"file":"digest.js","sourceRoot":"","sources":["../src/digest.ts"],"names":[],"mappings":"AAAA,sCAAsC;AACtC,EAAE;AACF,mGAAmG;AACnG,gGAAgG;AAChG,2FAA2F;AAE3F,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAA;AACxC,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAA;AACzC,OAAO,EAAE,KAAK,EAAE,MAAM,cAAc,CAAA;AACpC,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,WAAW,CAAA;AAE1C,2EAA2E;AAC3E,MAAM,UAAU,MAAM,CAAC,OAA0B;IAC/C,MAAM,IAAI,GAAG,QAAQ,EAAE,CAAA;IACvB,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;QAC5B,MAAM,IAAI,WAAW,CAAC,IAAI,CAAC,IAAI,EAAE,QAAQ,CAAC,EAAE,qCAAqC,CAAC,CAAA;IACpF,CAAC;IACD,MAAM,QAAQ,GAAG,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,CAAA;IACpC,KAAK,MAAM,MAAM,IAAI,QAAQ,EAAE,CAAC;QAC9B,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC;YACpE,MAAM,IAAI,WAAW,CAAC,IAAI,CAAC,IAAI,EAAE,QAAQ,CAAC,EAAE,kEAAkE,CAAC,CAAA;QACjH,CAAC;IACH,CAAC;IACD,MAAM,MAAM,GAAG,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,CAAA;IAC9C,MAAM,GAAG,GAAG,UAAU,CAAC,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,MAAM,CAAC,MAAM,EAAE,IAAI,CAAC,MAAM,CAAC,QAA0B,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAA;IAClH,OAAO,GAAG,IAAI,CAAC,MAAM,CAAC,SAAS,GAAG,KAAK,GAAG,GAAG,EAAE,CAAA;AACjD,CAAC"}
+{"version":3,"file":"digest.js","sourceRoot":"","sources":["../src/digest.ts"],"names":[],"mappings":"AAAA,sCAAsC;AACtC,EAAE;AACF,mGAAmG;AACnG,gGAAgG;AAChG,2FAA2F;AAE3F,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAA;AACnC,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAA;AACzC,OAAO,EAAE,KAAK,EAAE,MAAM,cAAc,CAAA;AACpC,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,WAAW,CAAA;AAE1C,2EAA2E;AAC3E,MAAM,UAAU,MAAM,CAAC,OAA0B;IAC/C,MAAM,IAAI,GAAG,QAAQ,EAAE,CAAA;IACvB,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;QAC5B,MAAM,IAAI,WAAW,CAAC,IAAI,CAAC,IAAI,EAAE,QAAQ,CAAC,EAAE,qCAAqC,CAAC,CAAA;IACpF,CAAC;IACD,MAAM,QAAQ,GAAG,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,CAAA;IACpC,KAAK,MAAM,MAAM,IAAI,QAAQ,EAAE,CAAC;QAC9B,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC;YACpE,MAAM,IAAI,WAAW,CAAC,IAAI,CAAC,IAAI,EAAE,QAAQ,CAAC,EAAE,kEAAkE,CAAC,CAAA;QACjH,CAAC;IACH,CAAC;IACD,MAAM,MAAM,GAAG,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,CAAA;IAC9C,MAAM,GAAG,GAAG,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,SAAS,EAAE,IAAI,CAAC,MAAM,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAA;IACxE,OAAO,GAAG,IAAI,CAAC,MAAM,CAAC,SAAS,GAAG,KAAK,GAAG,GAAG,EAAE,CAAA;AACjD,CAAC"}

package/dist/hash.browser.d.ts

@@ -0,0 +1,9 @@
+import type { HashHex } from "./hash.ts";
+/**
+ * sha256 only, and it refuses the rest by name.
+ *
+ * Refusing rather than substituting is the same contract `status()` and `part()` hold: the code names
+ * what it can do, the spec owns the list, and a spec naming something this build cannot honour is a
+ * version mismatch reported as one — never a different answer computed quietly.
+ */
+export declare const hashHexBrowser: HashHex;

package/dist/hash.browser.js

@@ -0,0 +1,27 @@
+// SPDX-License-Identifier: Apache-2.0
+//
+// The browser hash: @noble/hashes, a pure-JavaScript sha256 with no dependencies and no native
+// runtime. Installed by index.browser.ts; index.ts installs hash.node.ts instead and never imports
+// this file, so neither implementation reaches the other's build.
+import { sha256 } from "@noble/hashes/sha2.js";
+import { bytesToHex, utf8ToBytes } from "@noble/hashes/utils.js";
+import { SpecVersionError } from "./spec.js";
+/** The encodings this implementation can read a member string as. Both spellings of UTF-8 are accepted. */
+const ENCODINGS = new Set(["utf-8", "utf8"]);
+/**
+ * sha256 only, and it refuses the rest by name.
+ *
+ * Refusing rather than substituting is the same contract `status()` and `part()` hold: the code names
+ * what it can do, the spec owns the list, and a spec naming something this build cannot honour is a
+ * version mismatch reported as one — never a different answer computed quietly.
+ */
+export const hashHexBrowser = (algorithm, encoding, text) => {
+    if (algorithm !== "sha256") {
+        throw new SpecVersionError(`the browser build implements sha256 only; spec.digest.algorithm declares "${algorithm}"`);
+    }
+    if (!ENCODINGS.has(encoding)) {
+        throw new SpecVersionError(`the browser build reads members as UTF-8 only; spec.digest.encoding declares "${encoding}"`);
+    }
+    return bytesToHex(sha256(utf8ToBytes(text)));
+};
+//# sourceMappingURL=hash.browser.js.map

package/dist/hash.browser.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"hash.browser.js","sourceRoot":"","sources":["../src/hash.browser.ts"],"names":[],"mappings":"AAAA,sCAAsC;AACtC,EAAE;AACF,+FAA+F;AAC/F,mGAAmG;AACnG,kEAAkE;AAElE,OAAO,EAAE,MAAM,EAAE,MAAM,uBAAuB,CAAA;AAC9C,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,MAAM,wBAAwB,CAAA;AAEhE,OAAO,EAAE,gBAAgB,EAAE,MAAM,WAAW,CAAA;AAE5C,2GAA2G;AAC3G,MAAM,SAAS,GAAG,IAAI,GAAG,CAAC,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC,CAAA;AAE5C;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,cAAc,GAAY,CAAC,SAAS,EAAE,QAAQ,EAAE,IAAI,EAAE,EAAE;IACnE,IAAI,SAAS,KAAK,QAAQ,EAAE,CAAC;QAC3B,MAAM,IAAI,gBAAgB,CACxB,6EAA6E,SAAS,GAAG,CAC1F,CAAA;IACH,CAAC;IACD,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC;QAC7B,MAAM,IAAI,gBAAgB,CACxB,iFAAiF,QAAQ,GAAG,CAC7F,CAAA;IACH,CAAC;IACD,OAAO,UAAU,CAAC,MAAM,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA;AAC9C,CAAC,CAAA"}

package/dist/hash.d.ts

@@ -0,0 +1,10 @@
+/**
+ * Hashes `text` under a spec-declared algorithm and encoding, returning lowercase hex. The algorithm
+ * and encoding are passed through from `spec.digest` rather than fixed here: the spec owns the choice,
+ * and an implementation that cannot honour it says so instead of substituting one it can.
+ */
+export type HashHex = (algorithm: string, encoding: string, text: string) => string;
+/** Installs the hash `digest()` uses. Called exactly once, by an entry point. */
+export declare function installHash(hash: HashHex): void;
+/** Hashes through the installed implementation. */
+export declare function hashHex(algorithm: string, encoding: string, text: string): string;

package/dist/hash.js

@@ -0,0 +1,34 @@
+// SPDX-License-Identifier: Apache-2.0
+//
+// The seam through which the digest's hash function reaches this package, for the same reason
+// spec.ts has one: `node:crypto` is not available in a browser, and `digest()` is synchronous.
+//
+// WHY NOT WebCrypto. `crypto.subtle.digest` is the only hash the web platform publishes and it is
+// asynchronous, so using it would make `digest()` and `validateEnvelope()` return promises — a change
+// to the public API, which Plan-004 puts out of scope, and one that would leave the two builds with
+// different surfaces to compare. Blocking on it is not available either: `Atomics.wait` throws on a
+// browser's main thread by specification. So the browser build carries a synchronous implementation
+// instead (hash.browser.ts, @noble/hashes), and Node keeps `node:crypto` (hash.node.ts).
+//
+// WHERE THE TWO CAN DIVERGE, SAID OUT LOUD. The algorithm is spec data (`spec.digest.algorithm`), and
+// the two implementations do not honour the same set: Node honours everything `node:crypto` does,
+// the browser honours sha256 alone. A specification that moved to another algorithm would therefore
+// keep working in Node and throw a SpecVersionError in the browser. That is disagreement discovered
+// loudly, at the first call, naming the algorithm — the failure mode Plan-004 rejects is the silent
+// one, where both builds answer and answer differently.
+import { SpecVersionError } from "./spec.js";
+let implementation;
+/** Installs the hash `digest()` uses. Called exactly once, by an entry point. */
+export function installHash(hash) {
+    implementation = hash;
+}
+/** Hashes through the installed implementation. */
+export function hashHex(algorithm, encoding, text) {
+    if (!implementation) {
+        // Same unreachable-by-accident case as loadSpec(): `exports` publishes no deep path into this
+        // package, so arriving here means a module was imported directly rather than an entry point.
+        throw new SpecVersionError("no hash implementation is installed; import this package through its entry point rather than a module inside it");
+    }
+    return implementation(algorithm, encoding, text);
+}
+//# sourceMappingURL=hash.js.map

package/dist/hash.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"hash.js","sourceRoot":"","sources":["../src/hash.ts"],"names":[],"mappings":"AAAA,sCAAsC;AACtC,EAAE;AACF,8FAA8F;AAC9F,+FAA+F;AAC/F,EAAE;AACF,kGAAkG;AAClG,sGAAsG;AACtG,oGAAoG;AACpG,oGAAoG;AACpG,oGAAoG;AACpG,yFAAyF;AACzF,EAAE;AACF,sGAAsG;AACtG,kGAAkG;AAClG,oGAAoG;AACpG,oGAAoG;AACpG,oGAAoG;AACpG,wDAAwD;AAExD,OAAO,EAAE,gBAAgB,EAAE,MAAM,WAAW,CAAA;AAS5C,IAAI,cAAmC,CAAA;AAEvC,iFAAiF;AACjF,MAAM,UAAU,WAAW,CAAC,IAAa;IACvC,cAAc,GAAG,IAAI,CAAA;AACvB,CAAC;AAED,mDAAmD;AACnD,MAAM,UAAU,OAAO,CAAC,SAAiB,EAAE,QAAgB,EAAE,IAAY;IACvE,IAAI,CAAC,cAAc,EAAE,CAAC;QACpB,8FAA8F;QAC9F,6FAA6F;QAC7F,MAAM,IAAI,gBAAgB,CACxB,iHAAiH,CAClH,CAAA;IACH,CAAC;IACD,OAAO,cAAc,CAAC,SAAS,EAAE,QAAQ,EAAE,IAAI,CAAC,CAAA;AAClD,CAAC"}

package/dist/hash.node.d.ts

@@ -0,0 +1,7 @@
+import type { HashHex } from "./hash.ts";
+/**
+ * Whatever `node:crypto` honours, honoured. No allow-list of algorithms is imposed here: this is the
+ * behaviour the package already had, and narrowing it would refuse specs Node can serve in order to
+ * match a limit that belongs to the other build.
+ */
+export declare const hashHexNode: HashHex;

package/dist/hash.node.js

@@ -0,0 +1,12 @@
+// SPDX-License-Identifier: Apache-2.0
+//
+// The Node hash: `node:crypto`, exactly as digest.ts called it before the seam existed. Installed by
+// index.ts; index.browser.ts installs hash.browser.ts instead and never imports this file.
+import { createHash } from "node:crypto";
+/**
+ * Whatever `node:crypto` honours, honoured. No allow-list of algorithms is imposed here: this is the
+ * behaviour the package already had, and narrowing it would refuse specs Node can serve in order to
+ * match a limit that belongs to the other build.
+ */
+export const hashHexNode = (algorithm, encoding, text) => createHash(algorithm).update(text, encoding).digest("hex");
+//# sourceMappingURL=hash.node.js.map

package/dist/hash.node.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"hash.node.js","sourceRoot":"","sources":["../src/hash.node.ts"],"names":[],"mappings":"AAAA,sCAAsC;AACtC,EAAE;AACF,qGAAqG;AACrG,2FAA2F;AAE3F,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAA;AAGxC;;;;GAIG;AACH,MAAM,CAAC,MAAM,WAAW,GAAY,CAAC,SAAS,EAAE,QAAQ,EAAE,IAAI,EAAE,EAAE,CAChE,UAAU,CAAC,SAAS,CAAC,CAAC,MAAM,CAAC,IAAI,EAAE,QAA0B,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAA"}

package/dist/index.browser.d.ts

@@ -0,0 +1,11 @@
+export { build } from "./build.ts";
+export { canonical, sameIdentifier } from "./canonical.ts";
+export { digest } from "./digest.ts";
+export { validateEnvelope } from "./envelope.ts";
+export { BuildError, DigestError, RefIdError, SerialiseError } from "./errors.ts";
+export { parse } from "./parse.ts";
+export { covers, samePackage } from "./relations.ts";
+export { serialise } from "./serialise.ts";
+export { canonicalise, loadSpec, SpecIntegrityError, SpecVersionError, type RefIdSpec } from "./spec.ts";
+export { SPEC_DIGEST } from "./spec.browser.ts";
+export type { BuildParts, EnvelopeResult, NestedQualifierValue, Pair, ParsedFragment, ParseResult, ParseStatus } from "./types.ts";

package/dist/index.browser.js

@@ -0,0 +1,41 @@
+// SPDX-License-Identifier: Apache-2.0
+//
+// The browser entry point (Plan-004, Track 2). Served through the `browser` condition of this
+// package's `exports`, so a bundler picks it up and a consumer changes nothing.
+//
+// It differs from index.ts in exactly two lines — the spec source and the hash it installs — and in
+// one export it does not carry (`loadSpecFrom`, which takes a directory to read from). What it buys
+// is a module graph that reaches no Node builtin and nothing that resolves a path against the
+// module's own location, which scripts/check-browser-purity.mjs proves over the built closure rather
+// than by reading.
+//
+// THE TWO NAMES ARE SPELLED OUT NOWHERE IN THIS FILE, ON PURPOSE. Plan-004's success criteria grep
+// this emitted module for the builtin prefix and for the meta-URL expression, and a comment carrying
+// either literal turns that criterion red while describing their absence. The honest check is the
+// closure walk, which reads code rather than prose; this file simply refuses to lie to the grep.
+//
+// The spec here is a constant that scripts/gen-spec.mjs compiled in, having first verified
+// spec/ref-id.json against its sidecar. Nothing recomputes that digest at import time: it would hash
+// a constant against a digest compiled from it in the same build, a check that cannot fail. The
+// guarantee lives in the generator and in the staleness guard that regenerates and diffs
+// (Plan-004's Decision Log).
+import { installHash } from "./hash.js";
+import { hashHexBrowser } from "./hash.browser.js";
+import { installSpecSource } from "./spec.js";
+import { SPEC } from "./spec.browser.js";
+installSpecSource(() => SPEC);
+installHash(hashHexBrowser);
+export { build } from "./build.js";
+export { canonical, sameIdentifier } from "./canonical.js";
+export { digest } from "./digest.js";
+export { validateEnvelope } from "./envelope.js";
+export { BuildError, DigestError, RefIdError, SerialiseError } from "./errors.js";
+export { parse } from "./parse.js";
+export { covers, samePackage } from "./relations.js";
+export { serialise } from "./serialise.js";
+export { canonicalise, loadSpec, SpecIntegrityError, SpecVersionError } from "./spec.js";
+// The digest spec/ref-id.json carried when this build's constant was generated. A statement about
+// provenance, not a verification — spec.browser.ts says so at length, and re-exporting it here does
+// not make it one.
+export { SPEC_DIGEST } from "./spec.browser.js";
+//# sourceMappingURL=index.browser.js.map

package/dist/index.browser.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.browser.js","sourceRoot":"","sources":["../src/index.browser.ts"],"names":[],"mappings":"AAAA,sCAAsC;AACtC,EAAE;AACF,8FAA8F;AAC9F,gFAAgF;AAChF,EAAE;AACF,oGAAoG;AACpG,oGAAoG;AACpG,8FAA8F;AAC9F,qGAAqG;AACrG,mBAAmB;AACnB,EAAE;AACF,mGAAmG;AACnG,qGAAqG;AACrG,kGAAkG;AAClG,iGAAiG;AACjG,EAAE;AACF,2FAA2F;AAC3F,qGAAqG;AACrG,gGAAgG;AAChG,yFAAyF;AACzF,6BAA6B;AAE7B,OAAO,EAAE,WAAW,EAAE,MAAM,WAAW,CAAA;AACvC,OAAO,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAA;AAClD,OAAO,EAAE,iBAAiB,EAAE,MAAM,WAAW,CAAA;AAC7C,OAAO,EAAE,IAAI,EAAE,MAAM,mBAAmB,CAAA;AAExC,iBAAiB,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAAA;AAC7B,WAAW,CAAC,cAAc,CAAC,CAAA;AAE3B,OAAO,EAAE,KAAK,EAAE,MAAM,YAAY,CAAA;AAClC,OAAO,EAAE,SAAS,EAAE,cAAc,EAAE,MAAM,gBAAgB,CAAA;AAC1D,OAAO,EAAE,MAAM,EAAE,MAAM,aAAa,CAAA;AACpC,OAAO,EAAE,gBAAgB,EAAE,MAAM,eAAe,CAAA;AAChD,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,UAAU,EAAE,cAAc,EAAE,MAAM,aAAa,CAAA;AACjF,OAAO,EAAE,KAAK,EAAE,MAAM,YAAY,CAAA;AAClC,OAAO,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,gBAAgB,CAAA;AACpD,OAAO,EAAE,SAAS,EAAE,MAAM,gBAAgB,CAAA;AAC1C,OAAO,EAAE,YAAY,EAAE,QAAQ,EAAE,kBAAkB,EAAE,gBAAgB,EAAkB,MAAM,WAAW,CAAA;AACxG,kGAAkG;AAClG,oGAAoG;AACpG,mBAAmB;AACnB,OAAO,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAA"}

package/dist/index.d.ts

@@ -1,8 +1,11 @@
 export { build } from "./build.ts";
+export { canonical, sameIdentifier } from "./canonical.ts";
 export { digest } from "./digest.ts";
 export { validateEnvelope } from "./envelope.ts";
 export { BuildError, DigestError, RefIdError, SerialiseError } from "./errors.ts";
 export { parse } from "./parse.ts";
+export { covers, samePackage } from "./relations.ts";
 export { serialise } from "./serialise.ts";
-export { canonicalise, loadSpec, loadSpecFrom, SpecIntegrityError, SpecVersionError, type RefIdSpec } from "./spec.ts";
+export { canonicalise, loadSpec, SpecIntegrityError, SpecVersionError, type RefIdSpec } from "./spec.ts";
+export { loadSpecFrom } from "./spec.node.ts";
 export type { BuildParts, EnvelopeResult, NestedQualifierValue, Pair, ParsedFragment, ParseResult, ParseStatus } from "./types.ts";

package/dist/index.js

@@ -1,9 +1,23 @@
 // SPDX-License-Identifier: Apache-2.0
+//
+// The Node entry point. It differs from index.browser.ts in exactly two lines: which spec source and
+// which hash it installs. Everything below is the same public surface, served by the same modules.
+import { installHash } from "./hash.js";
+import { hashHexNode } from "./hash.node.js";
+import { installSpecSource } from "./spec.js";
+import { loadSpecFrom, loadSpecFromDisk } from "./spec.node.js";
+installSpecSource(loadSpecFromDisk);
+installHash(hashHexNode);
 export { build } from "./build.js";
+export { canonical, sameIdentifier } from "./canonical.js";
 export { digest } from "./digest.js";
 export { validateEnvelope } from "./envelope.js";
 export { BuildError, DigestError, RefIdError, SerialiseError } from "./errors.js";
 export { parse } from "./parse.js";
+export { covers, samePackage } from "./relations.js";
 export { serialise } from "./serialise.js";
-export { canonicalise, loadSpec, loadSpecFrom, SpecIntegrityError, SpecVersionError } from "./spec.js";
+export { canonicalise, loadSpec, SpecIntegrityError, SpecVersionError } from "./spec.js";
+// Disk-only, and therefore the one export the browser build does not carry: it takes a directory to
+// read a spec + sidecar pair from, which is a thing a browser does not have.
+export { loadSpecFrom } from "./spec.node.js";
 //# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,sCAAsC;AAEtC,OAAO,EAAE,KAAK,EAAE,MAAM,YAAY,CAAA;AAClC,OAAO,EAAE,MAAM,EAAE,MAAM,aAAa,CAAA;AACpC,OAAO,EAAE,gBAAgB,EAAE,MAAM,eAAe,CAAA;AAChD,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,UAAU,EAAE,cAAc,EAAE,MAAM,aAAa,CAAA;AACjF,OAAO,EAAE,KAAK,EAAE,MAAM,YAAY,CAAA;AAClC,OAAO,EAAE,SAAS,EAAE,MAAM,gBAAgB,CAAA;AAC1C,OAAO,EAAE,YAAY,EAAE,QAAQ,EAAE,YAAY,EAAE,kBAAkB,EAAE,gBAAgB,EAAkB,MAAM,WAAW,CAAA"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,sCAAsC;AACtC,EAAE;AACF,qGAAqG;AACrG,mGAAmG;AAEnG,OAAO,EAAE,WAAW,EAAE,MAAM,WAAW,CAAA;AACvC,OAAO,EAAE,WAAW,EAAE,MAAM,gBAAgB,CAAA;AAC5C,OAAO,EAAE,iBAAiB,EAAE,MAAM,WAAW,CAAA;AAC7C,OAAO,EAAE,YAAY,EAAE,gBAAgB,EAAE,MAAM,gBAAgB,CAAA;AAE/D,iBAAiB,CAAC,gBAAgB,CAAC,CAAA;AACnC,WAAW,CAAC,WAAW,CAAC,CAAA;AAExB,OAAO,EAAE,KAAK,EAAE,MAAM,YAAY,CAAA;AAClC,OAAO,EAAE,SAAS,EAAE,cAAc,EAAE,MAAM,gBAAgB,CAAA;AAC1D,OAAO,EAAE,MAAM,EAAE,MAAM,aAAa,CAAA;AACpC,OAAO,EAAE,gBAAgB,EAAE,MAAM,eAAe,CAAA;AAChD,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,UAAU,EAAE,cAAc,EAAE,MAAM,aAAa,CAAA;AACjF,OAAO,EAAE,KAAK,EAAE,MAAM,YAAY,CAAA;AAClC,OAAO,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,gBAAgB,CAAA;AACpD,OAAO,EAAE,SAAS,EAAE,MAAM,gBAAgB,CAAA;AAC1C,OAAO,EAAE,YAAY,EAAE,QAAQ,EAAE,kBAAkB,EAAE,gBAAgB,EAAkB,MAAM,WAAW,CAAA;AACxG,oGAAoG;AACpG,6EAA6E;AAC7E,OAAO,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAA"}

package/dist/relations.d.ts

@@ -0,0 +1,29 @@
+import type { ParseResult } from "./types.ts";
+/**
+ * Whether two identifiers name the same released thing, at whatever version each declares.
+ *
+ * Symmetric, and version-blind in exactly one place: the locator of a type that declares it carries a
+ * version. Everything else still distinguishes — the declared name, its refinements, and every
+ * qualifier — because two readings taken at different moments are two readings of one trait rather than
+ * one reading, and collapsing them is the defect `when` exists to prevent.
+ *
+ * A malformed identifier, and one at an identifier version this package does not implement, name nothing
+ * here and so are the same as nothing, including themselves.
+ */
+export declare function samePackage(a: string | ParseResult, b: string | ParseResult): boolean;
+/**
+ * Whether the first identifier is the second with less declared — the general covering the specific.
+ *
+ * **Asymmetric, and the direction is the whole point.** `pkg:npm/x` covers `pkg:npm/x@1.0.0`, and
+ * `pkg:npm/x@1.0.0` does not cover `pkg:npm/x`: a name that declares no version stands for every version
+ * of itself, while a name that declares one stands for that version alone. The same holds for the
+ * declared name, for each of its refinements, and for each qualifier — what the first leaves unsaid, the
+ * second may say freely; what the first says, the second must say identically.
+ *
+ * This is what makes a partial identifier a query. A store keyed by identifier answers "every reading of
+ * this trait" by asking which of its keys a trait-only identifier covers, with no query language at all.
+ *
+ * Every identifier this package vouches for covers itself; one it does not — malformed, or at an
+ * identifier version it does not implement — covers nothing, itself included.
+ */
+export declare function covers(general: string | ParseResult, specific: string | ParseResult): boolean;

package/dist/relations.js

@@ -0,0 +1,135 @@
+// SPDX-License-Identifier: Apache-2.0
+//
+// The two questions equality cannot answer. `sameIdentifier` says whether two strings name one thing,
+// which is what a digest and an envelope need and is deliberately strict. A store wants two other
+// answers: whether two identifiers name the same released thing at different versions, and whether a
+// partial identifier stands for a whole family of complete ones. Neither is equality, and neither can be
+// expressed by relaxing it, because they disagree with each other on direction.
+import { parse } from "./parse.js";
+import { loadSpec, status } from "./spec.js";
+/**
+ * The locator without its version, and the version it carried.
+ *
+ * **Whether a locator carries a version at all is the type's business, not this function's**, so it is
+ * read from `dispatch.<type>.versionTail` rather than guessed from the punctuation. An `@` means a
+ * released version in a Package URL and a host path; it separates a mailbox from its domain, keys a
+ * quantisation on a served model, and appears in neither a telephone number nor an article number.
+ * Guessing reported two different mailboxes as one thing.
+ *
+ * Within a type that does carry one, an `@` that opens a segment — preceded by `/`, or first — belongs
+ * to a namespace, so `npm/@acme/x` has no version. An `@` inside a segment closes the name: the version
+ * runs from it to the next `/`, and whatever follows that `/` is a path inside the named thing.
+ *
+ * **The path stays in the stem, and only the version leaves it.** The stem answers *which thing*, and a
+ * file at two releases is one file — so `npm/x@1.0.0/docs/guide.md` and `npm/x@2.0.0/docs/guide.md`
+ * share the stem `npm/x/docs/guide.md` and are the same package, while two files in one release do not.
+ */
+function split(spec, type, locator) {
+    if (!spec.dispatch[type]?.versionTail)
+        return { stem: locator };
+    for (let index = 1; index < locator.length; index += 1) {
+        if (locator[index] !== "@" || locator[index - 1] === "/")
+            continue;
+        const slash = locator.indexOf("/", index);
+        if (slash < 0)
+            return { stem: locator.slice(0, index), version: locator.slice(index + 1) };
+        return { stem: locator.slice(0, index) + locator.slice(slash), version: locator.slice(index + 1, slash) };
+    }
+    return { stem: locator };
+}
+/**
+ * Whether the general identifier's stem reaches the specific one's.
+ *
+ * Equal stems name one thing. Otherwise the general one covers the specific when its stem is a whole
+ * **segment** prefix of it — `acme-tools` reaching `acme-tools/docs/guide.md`. The segment boundary is
+ * the whole of the rule: a bare string prefix would make `acme-tools` cover `acme-tools-extra`, two
+ * corpora that share nothing but their first characters.
+ */
+function stemReaches(general, specific) {
+    return general === specific || specific.startsWith(`${general}/`);
+}
+/**
+ * The identifier, when this package vouches for how it was decomposed.
+ *
+ * `ok` and `uncovered` both carry a decomposition this grammar produced — an uncovered type parses, and
+ * only its locator's own grammar is unknown. `malformed` has no decomposition to compare, and
+ * `unsupported` has one produced by the wrong grammar: a later identifier version is minted for a change
+ * to normalisation, percent-encoding, separators or shape, so its parts read through this version's
+ * expression are not reliably its parts.
+ */
+function read(identifier) {
+    const spec = loadSpec();
+    const parsed = typeof identifier === "string" ? parse(identifier) : identifier;
+    const usable = [status(spec, "ok"), status(spec, "uncovered")];
+    return usable.includes(parsed.status) ? parsed : undefined;
+}
+/** Whether every pair the first declares appears identically in the second. */
+function subsumes(theirs, mine) {
+    const map = new Map(theirs);
+    return mine.every(([key, value]) => map.get(key) === value);
+}
+/** Whether two pair lists hold the same pairs, order aside. */
+function equal(a, b) {
+    return a.length === b.length && subsumes(b, a);
+}
+/**
+ * Whether two identifiers name the same released thing, at whatever version each declares.
+ *
+ * Symmetric, and version-blind in exactly one place: the locator of a type that declares it carries a
+ * version. Everything else still distinguishes — the declared name, its refinements, and every
+ * qualifier — because two readings taken at different moments are two readings of one trait rather than
+ * one reading, and collapsing them is the defect `when` exists to prevent.
+ *
+ * A malformed identifier, and one at an identifier version this package does not implement, name nothing
+ * here and so are the same as nothing, including themselves.
+ */
+export function samePackage(a, b) {
+    const spec = loadSpec();
+    const [x, y] = [read(a), read(b)];
+    if (!x || !y)
+        return false;
+    if (x.type !== y.type || x.version !== y.version)
+        return false;
+    if (split(spec, x.type, x.locator).stem !== split(spec, y.type, y.locator).stem)
+        return false;
+    if ((x.fragment?.path ?? null) !== (y.fragment?.path ?? null))
+        return false;
+    if (!equal(x.fragment?.refinements ?? [], y.fragment?.refinements ?? []))
+        return false;
+    return equal(x.qualifiers, y.qualifiers);
+}
+/**
+ * Whether the first identifier is the second with less declared — the general covering the specific.
+ *
+ * **Asymmetric, and the direction is the whole point.** `pkg:npm/x` covers `pkg:npm/x@1.0.0`, and
+ * `pkg:npm/x@1.0.0` does not cover `pkg:npm/x`: a name that declares no version stands for every version
+ * of itself, while a name that declares one stands for that version alone. The same holds for the
+ * declared name, for each of its refinements, and for each qualifier — what the first leaves unsaid, the
+ * second may say freely; what the first says, the second must say identically.
+ *
+ * This is what makes a partial identifier a query. A store keyed by identifier answers "every reading of
+ * this trait" by asking which of its keys a trait-only identifier covers, with no query language at all.
+ *
+ * Every identifier this package vouches for covers itself; one it does not — malformed, or at an
+ * identifier version it does not implement — covers nothing, itself included.
+ */
+export function covers(general, specific) {
+    const spec = loadSpec();
+    const [x, y] = [read(general), read(specific)];
+    if (!x || !y)
+        return false;
+    if (x.type !== y.type || x.version !== y.version)
+        return false;
+    const [gen, spe] = [split(spec, x.type, x.locator), split(spec, y.type, y.locator)];
+    if (!stemReaches(gen.stem, spe.stem))
+        return false;
+    if (gen.version !== undefined && gen.version !== spe.version)
+        return false;
+    const path = x.fragment?.path;
+    if (path !== undefined && path !== y.fragment?.path)
+        return false;
+    if (!subsumes(y.fragment?.refinements ?? [], x.fragment?.refinements ?? []))
+        return false;
+    return subsumes(y.qualifiers, x.qualifiers);
+}
+//# sourceMappingURL=relations.js.map

package/dist/relations.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"relations.js","sourceRoot":"","sources":["../src/relations.ts"],"names":[],"mappings":"AAAA,sCAAsC;AACtC,EAAE;AACF,sGAAsG;AACtG,kGAAkG;AAClG,qGAAqG;AACrG,yGAAyG;AACzG,gFAAgF;AAEhF,OAAO,EAAE,KAAK,EAAE,MAAM,YAAY,CAAA;AAClC,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAkB,MAAM,WAAW,CAAA;AAG5D;;;;;;;;;;;;;;;;GAgBG;AACH,SAAS,KAAK,CAAC,IAAe,EAAE,IAAY,EAAE,OAAe;IAC3D,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,WAAW;QAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,CAAA;IAC/D,KAAK,IAAI,KAAK,GAAG,CAAC,EAAE,KAAK,GAAG,OAAO,CAAC,MAAM,EAAE,KAAK,IAAI,CAAC,EAAE,CAAC;QACvD,IAAI,OAAO,CAAC,KAAK,CAAC,KAAK,GAAG,IAAI,OAAO,CAAC,KAAK,GAAG,CAAC,CAAC,KAAK,GAAG;YAAE,SAAQ;QAClE,MAAM,KAAK,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,EAAE,KAAK,CAAC,CAAA;QACzC,IAAI,KAAK,GAAG,CAAC;YAAE,OAAO,EAAE,IAAI,EAAE,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC,EAAE,OAAO,EAAE,OAAO,CAAC,KAAK,CAAC,KAAK,GAAG,CAAC,CAAC,EAAE,CAAA;QAC1F,OAAO,EAAE,IAAI,EAAE,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC,GAAG,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,EAAE,OAAO,EAAE,OAAO,CAAC,KAAK,CAAC,KAAK,GAAG,CAAC,EAAE,KAAK,CAAC,EAAE,CAAA;IAC3G,CAAC;IACD,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,CAAA;AAC1B,CAAC;AAED;;;;;;;GAOG;AACH,SAAS,WAAW,CAAC,OAAe,EAAE,QAAgB;IACpD,OAAO,OAAO,KAAK,QAAQ,IAAI,QAAQ,CAAC,UAAU,CAAC,GAAG,OAAO,GAAG,CAAC,CAAA;AACnE,CAAC;AAED;;;;;;;;GAQG;AACH,SAAS,IAAI,CAAC,UAAgC;IAC5C,MAAM,IAAI,GAAG,QAAQ,EAAE,CAAA;IACvB,MAAM,MAAM,GAAG,OAAO,UAAU,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,UAAU,CAAA;IAC9E,MAAM,MAAM,GAAG,CAAC,MAAM,CAAC,IAAI,EAAE,IAAI,CAAC,EAAE,MAAM,CAAC,IAAI,EAAE,WAAW,CAAC,CAAC,CAAA;IAC9D,OAAO,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS,CAAA;AAC5D,CAAC;AAED,+EAA+E;AAC/E,SAAS,QAAQ,CAAC,MAAc,EAAE,IAAY;IAC5C,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,CAAA;IAC3B,OAAO,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,GAAG,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,KAAK,KAAK,CAAC,CAAA;AAC7D,CAAC;AAED,+DAA+D;AAC/D,SAAS,KAAK,CAAC,CAAS,EAAE,CAAS;IACjC,OAAO,CAAC,CAAC,MAAM,KAAK,CAAC,CAAC,MAAM,IAAI,QAAQ,CAAC,CAAC,EAAE,CAAC,CAAC,CAAA;AAChD,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,UAAU,WAAW,CAAC,CAAuB,EAAE,CAAuB;IAC1E,MAAM,IAAI,GAAG,QAAQ,EAAE,CAAA;IACvB,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC,CAAA;IACjC,IAAI,CAAC,CAAC,IAAI,CAAC,CAAC;QAAE,OAAO,KAAK,CAAA;IAC1B,IAAI,CAAC,CAAC,IAAI,KAAK,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC,OAAO,KAAK,CAAC,CAAC,OAAO;QAAE,OAAO,KAAK,CAAA;IAC9D,IAAI,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,IAAI,KAAK,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,IAAI;QAAE,OAAO,KAAK,CAAA;IAC7F,IAAI,CAAC,CAAC,CAAC,QAAQ,EAAE,IAAI,IAAI,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,QAAQ,EAAE,IAAI,IAAI,IAAI,CAAC;QAAE,OAAO,KAAK,CAAA;IAC3E,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,QAAQ,EAAE,WAAW,IAAI,EAAE,EAAE,CAAC,CAAC,QAAQ,EAAE,WAAW,IAAI,EAAE,CAAC;QAAE,OAAO,KAAK,CAAA;IACtF,OAAO,KAAK,CAAC,CAAC,CAAC,UAAU,EAAE,CAAC,CAAC,UAAU,CAAC,CAAA;AAC1C,CAAC;AAED;;;;;;;;;;;;;;GAcG;AACH,MAAM,UAAU,MAAM,CAAC,OAA6B,EAAE,QAA8B;IAClF,MAAM,IAAI,GAAG,QAAQ,EAAE,CAAA;IACvB,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAA;IAC9C,IAAI,CAAC,CAAC,IAAI,CAAC,CAAC;QAAE,OAAO,KAAK,CAAA;IAC1B,IAAI,CAAC,CAAC,IAAI,KAAK,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC,OAAO,KAAK,CAAC,CAAC,OAAO;QAAE,OAAO,KAAK,CAAA;IAE9D,MAAM,CAAC,GAAG,EAAE,GAAG,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,EAAE,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,CAAA;IACnF,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,IAAI,EAAE,GAAG,CAAC,IAAI,CAAC;QAAE,OAAO,KAAK,CAAA;IAClD,IAAI,GAAG,CAAC,OAAO,KAAK,SAAS,IAAI,GAAG,CAAC,OAAO,KAAK,GAAG,CAAC,OAAO;QAAE,OAAO,KAAK,CAAA;IAE1E,MAAM,IAAI,GAAG,CAAC,CAAC,QAAQ,EAAE,IAAI,CAAA;IAC7B,IAAI,IAAI,KAAK,SAAS,IAAI,IAAI,KAAK,CAAC,CAAC,QAAQ,EAAE,IAAI;QAAE,OAAO,KAAK,CAAA;IACjE,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,QAAQ,EAAE,WAAW,IAAI,EAAE,EAAE,CAAC,CAAC,QAAQ,EAAE,WAAW,IAAI,EAAE,CAAC;QAAE,OAAO,KAAK,CAAA;IAEzF,OAAO,QAAQ,CAAC,CAAC,CAAC,UAAU,EAAE,CAAC,CAAC,UAAU,CAAC,CAAA;AAC7C,CAAC"}

package/dist/spec.browser.d.ts

@@ -0,0 +1,12 @@
+import type { RefIdSpec } from "./spec.ts";
+/**
+ * The sidecar digest `spec/ref-id.json.sha256` carried at the moment this file was generated.
+ *
+ * This is a STATEMENT about provenance, not a verification: nothing in this module recomputes it,
+ * and there is no live spec/ref-id.json here to recompute it against. The guarantee that this digest
+ * is the one that was actually verified belongs to the generator (scripts/gen-spec.mjs, which refuses
+ * to emit from a spec that fails its sidecar) and to the staleness guard that regenerates and diffs
+ * this file in CI. Reading this field as a check performed at import time would be a mistake.
+ */
+export declare const SPEC_DIGEST: string;
+export declare const SPEC: RefIdSpec;