@jarenjs/core 0.73.0 → 0.83.2

package/ARCHITECTURE.md

@@ -1234,3 +1234,7 @@ export function isNumberType(data) {
 When contributing, remember: this package is used by `@jarenjs/validate` and `@jarenjs/formats`. Changes here have downstream effects. Maintain backward compatibility, optimize for performance, and keep the API predictable.
 
 For questions about the broader architecture, see the root [`ARCHITECTURE.md`](../../docs/ARCHITECTURE.md). For development workflows, see [`HOWTO.md`](../../docs/HOWTO.md).
+
+`src/virtual/` owns DOM-free fixed and sparse measured collection geometry. It imports no presentation, app or storage owner; the visible component and injected coordinator live above it.
+
+`src/search/` owns lexical definition compilation, postings, rank statistics and derived snapshots. The [search contract](docs/SEARCH.md) fixes tokenizer, scoring and tie semantics. `src/range/` owns the structural resident array provider; app re-exports it and linq injects it without importing an upper layer.

package/README.md

@@ -1,5 +1,7 @@
 # @jarenjs/core
 
+Compose `core/virtual`, `core/range`, `core/search` and the shared retry/scheduling capabilities through the [public adoption recipes](../../docs/ADOPTION-EVIDENCE.md). The host supplies storage, workers and product policy; pure kernels own none of those resources.
+
 The zero-dependency foundation of [Jaren](https://github.com/jklarenbeek/jarenjs). Everything the rest of the suite is built on lives here — type guards, Unicode-aware string handling, a large text-validation toolbox, number range helpers, fixed-point and vector math, the calendar kernel, the spatial kernel, the vector kernel, the interval kernel, the message-catalog compiler, unit/currency conversion and a finance library.
 
 None of it depends on JSON Schema: every module can be used standalone in any JavaScript project.
@@ -202,6 +204,7 @@ Every subpath a consumer can import, derived from the manifest by
 <!--fact:exports.core-->
 | Import | Kind | Declarations |
 |---|---|---|
+| `@jarenjs/core/search` | JavaScript | declared |
 | `@jarenjs/core` | JavaScript | declared |
 | `@jarenjs/core/array` | JavaScript | declared |
 | `@jarenjs/core/async` | JavaScript | declared |
@@ -296,8 +299,20 @@ Every subpath a consumer can import, derived from the manifest by
 | `@jarenjs/core/convert/index` | JavaScript | declared |
 | `@jarenjs/core/convert/registry` | JavaScript | declared |
 | `@jarenjs/core/package.json` | metadata | — |
+| `@jarenjs/core/virtual` | JavaScript | declared |
+| `@jarenjs/core/range` | JavaScript | declared |
+| `@jarenjs/core/retry` | JavaScript | declared |
+| `@jarenjs/core/schedule` | JavaScript | declared |
 <!--/fact-->
 
 ## Development
 
 Unit tests live in `test/core/` at the repository root (`npm run test:core`). This package's internals are described in its own [ARCHITECTURE](./ARCHITECTURE.md) document, with per-module references under [docs/](./docs/) (`MATH`, `CONVERT`, `FINANCE`, `DATES`, `GEO`); see the repository [README](../../README.md) and [ARCHITECTURE](../../docs/ARCHITECTURE.md) for the monorepo picture, and the [ROADMAP](../../docs/ROADMAP.md) for planned work.
+
+See [virtual geometry](docs/VIRTUAL.md) for opt-in constant-work fixed ranges and bounded sparse measured axes.
+
+See [lexical search](docs/SEARCH.md) for the opt-in resident ranker and bounded source-derived snapshots. `@jarenjs/core/range` owns the structural resident array provider shared by app and linq.
+
+[Bounded scheduling and retry](docs/SCHEDULING.md) describes `core/schedule` and
+`core/retry`: fair per-scope admission, drained shutdown, shared attempt budgets
+and explicit strict/AI/contract compatibility policies.

package/dist/types/range/index.d.ts

@@ -0,0 +1,81 @@
+/** JSON wire byte cost. @param {any} value */
+export declare const rangeBytes: (value: any) => number;
+/** Echo request identity. @param {any} request */
+export declare const rangeIdentity: (request: any) => {
+    [k: string]: any;
+};
+/** Validate finite request credits. @param {any} credits */
+export declare const validRangeCredits: (credits: any) => boolean;
+/** Validate a half-open logical range. @param {any} range */
+export declare const validLogicalRange: (range: any) => any;
+/**
+ * A resident-array provider. The immutable source copy and key index are reported separately
+ * from requested pages; virtual DOM does not make this resident source bounded by page credits.
+ * @param {any[]} initialRows @param {any} [options]
+ */
+export declare function createArrayRangeProvider(initialRows: any[], options?: any): {
+    query: any;
+    readonly snapshot: any;
+    capabilities: Readonly<{
+        seekIndex: boolean;
+        seekKey: true;
+        continuation: true;
+        exactTotal: boolean;
+        live: true;
+        completeExport: true;
+    }>;
+    indexOf(key: any): any;
+    stats(): {
+        rows: number;
+        bytes: number;
+        pages: number;
+        pending: number;
+        subscriptions: number;
+    };
+    replace(next: any, identity: any): void;
+    subscribe(fn: any): () => boolean;
+    request(input: any, signal: any): Promise<{
+        state: any;
+        reason: any;
+        used: {
+            pages: number;
+            rows: number;
+            bytes: number;
+            work: number;
+        };
+    } | {
+        state: string;
+        rows: any[];
+        keys: any[];
+        continuation: string | null;
+        total: {
+            kind: string;
+            value: number;
+        } | {
+            value?: undefined;
+            kind: string;
+        };
+        used: {
+            pages: number;
+            rows: number;
+            bytes: number;
+            work: number;
+        };
+    }>;
+    export(request: any, signal: any): AsyncGenerator<{
+        state: string;
+        rows: any[];
+        keys: any[];
+        query: any;
+        snapshot: any;
+        total?: undefined;
+    } | {
+        rows?: undefined;
+        keys?: undefined;
+        state: string;
+        total: number;
+        query: any;
+        snapshot: any;
+    }, void, unknown>;
+    dispose(): Promise<void>;
+};

package/dist/types/retry.d.ts

@@ -0,0 +1,43 @@
+/** Shared backoff arithmetic, abortable waits and an explicit dispatch budget. */
+/**
+ * Calculate a delay; strict never shortens the server's minimum wait.
+ * Compatibility policies retain the published clients' distinct jitter shapes.
+ * @param {{ policy?: 'strict' | 'ai-compat' | 'contract-compat', baseMs?: number, maxMs?: number, random?: () => number }} options
+ * @param {number} attempt - failed attempt, counted from one
+ * @param {number} [retryAfterMs]
+ * @returns {number}
+ */
+export declare function backoffDelay(options: {
+    policy?: 'strict' | 'ai-compat' | 'contract-compat';
+    baseMs?: number;
+    maxMs?: number;
+    random?: () => number;
+}, attempt: number, retryAfterMs?: number): number;
+/**
+ * Parse only the selected header dialect. HTTP accepts seconds or HTTP-date;
+ * milliseconds accepts nonnegative numbers only; none ignores the header.
+ * @param {string | null | undefined} raw
+ * @param {{ dialect?: 'http' | 'milliseconds' | 'none', now?: number }} [options]
+ * @returns {number | undefined}
+ */
+export declare function parseRetryAfter(raw: string | null | undefined, { dialect, now }?: {
+    dialect?: 'http' | 'milliseconds' | 'none';
+    now?: number;
+}): number | undefined;
+/** @param {AbortSignal | null | undefined} signal @returns {any} */
+export declare function abortError(signal: AbortSignal | null | undefined): any;
+/** Abortable timer with listener cleanup on either settlement.
+ * @param {number} ms @param {AbortSignal} [signal] @returns {Promise<void>} */
+export declare function sleep(ms: number, signal?: AbortSignal): Promise<void>;
+/**
+ * A host-private total budget reused across SDK, workflow and job callbacks.
+ * The single-attempt transport takes a credit immediately before dispatch.
+ * @param {number} attempts
+ * @param {'safe-read' | 'provider-idempotent' | 'single-send'} [safety]
+ */
+export declare function createAttemptBudget(attempts: number, safety?: 'safe-read' | 'provider-idempotent' | 'single-send'): Readonly<{
+    safety: "provider-idempotent" | "safe-read" | "single-send";
+    readonly used: number;
+    readonly remaining: number;
+    take(): boolean;
+}>;

package/dist/types/schedule.d.ts

@@ -0,0 +1,43 @@
+export type ScheduleOptions = {
+    concurrency?: number;
+    maxQueue?: number;
+    spacingMs?: number;
+    maxScopes?: number;
+    now?: () => number;
+    sleep?: (ms: number, signal?: AbortSignal) => Promise<void>;
+};
+/**
+ * @typedef {Object} ScheduleOptions
+ * @property {number} [concurrency]
+ * @property {number} [maxQueue]
+ * @property {number} [spacingMs]
+ * @property {number} [maxScopes]
+ * @property {() => number} [now]
+ * @property {(ms: number, signal?: AbortSignal) => Promise<void>} [sleep]
+ */
+/**
+ * Round-robin admission among ready scopes; FIFO inside each scope. Closing
+ * stops admission immediately and waits for admitted work, including workers
+ * which ignore cancellation. A host must keep resources until close settles.
+ * @param {ScheduleOptions} [options]
+ */
+export declare function createScheduler(options?: ScheduleOptions): Readonly<{
+    /** @template T @param {() => T | Promise<T>} worker
+     * @param {{ scope?: string, signal?: AbortSignal, deadline?: number }} [context]
+     * @returns {Promise<T>} */
+    run<T>(worker: () => T | Promise<T>, { scope, signal, deadline }?: {
+        scope?: string;
+        signal?: AbortSignal;
+        deadline?: number;
+    }): Promise<T>;
+    /** A server observation delays all following work in its scope.
+     * @param {string} scope @param {number} delayMs */
+    observe(scope: string, delayMs: number): void;
+    /** @returns {Promise<void>} */
+    close(): Promise<void>;
+    stats: () => {
+        active: number;
+        queued: number;
+        closed: boolean;
+    };
+}>;

package/dist/types/search/config.d.ts

@@ -0,0 +1,69 @@
+export type LexicalDefinition = {
+    version: number;
+    fields: string[];
+    profile?: string;
+    prefix?: boolean;
+    fuzzy?: number;
+    combineWith?: string;
+    boost?: Record<string, number>;
+    normalization?: string;
+    limits?: Partial<typeof SEARCH_LIMITS>;
+};
+/** @typedef {{version: number, fields: string[], profile?: string, prefix?: boolean,
+ * fuzzy?: number, combineWith?: string, boost?: Record<string, number>,
+ * normalization?: string, limits?: Partial<typeof SEARCH_LIMITS>}} LexicalDefinition */
+/** Finite logical allocation and work credits, independent of output truncation. */
+export declare const SEARCH_LIMITS: Readonly<{
+    maxDocuments: 100000;
+    maxSourceBytes: number;
+    maxIndexBytes: number;
+    maxTemporaryBytes: number;
+    maxTokens: 4000000;
+    maxPostings: 4000000;
+    maxVocabulary: 300000;
+    maxFieldBytes: 65536;
+    maxTokenLength: 128;
+    maxQueryBytes: 4096;
+    maxExpansions: 16384;
+    maxCandidates: 100000;
+    maxResults: 1000;
+    maxWork: 100000000;
+    maxBatchWork: 100000;
+}>;
+/** @param {LexicalDefinition} input */
+export declare function lexicalConfig(input: LexicalDefinition): {
+    version: number;
+    fields: string[];
+    profile: string;
+    prefix: boolean;
+    fuzzy: number;
+    combineWith: string;
+    boost: {
+        [x: string]: number;
+    };
+    normalization: string;
+    limits: {
+        maxDocuments: 100000;
+        maxSourceBytes: number;
+        maxIndexBytes: number;
+        maxTemporaryBytes: number;
+        maxTokens: 4000000;
+        maxPostings: 4000000;
+        maxVocabulary: 300000;
+        maxFieldBytes: 65536;
+        maxTokenLength: 128;
+        maxQueryBytes: 4096;
+        maxExpansions: 16384;
+        maxCandidates: 100000;
+        maxResults: 1000;
+        maxWork: 100000000;
+        maxBatchWork: 100000;
+    };
+};
+/** Token boundaries intentionally preserve the oracle's tab and accent behavior.
+ * @param {string} value @returns {string[]} */
+export declare function lexicalTokens(value: string): string[];
+/** Banded Levenshtein in UTF-16 units, matching the named compatibility profile.
+ * @param {string} a @param {string} b @param {number} limit @param {() => void} step
+ * @param {Uint16Array} previous @param {Uint16Array} current */
+export declare function lexicalDistance(a: string, b: string, limit: number, step: () => void, previous: Uint16Array, current: Uint16Array): number;

package/dist/types/search/index.d.ts

@@ -0,0 +1,145 @@
+export { SEARCH_LIMITS } from './config.js';
+export type LexicalDefinition = import('./config.js').LexicalDefinition;
+export type LexicalIdentity = {
+    generation?: number;
+    sourceRevision?: string;
+};
+export type LexicalHit = {
+    id: string;
+    score: number;
+};
+/** @typedef {import('./config.js').LexicalDefinition} LexicalDefinition */
+/** @typedef {{generation?:number, sourceRevision?:string}} LexicalIdentity */
+/** @typedef {{id:string, score:number}} LexicalHit */
+/** Compile a versioned definition once. Each create() owns an isolated resident index.
+ * @param {LexicalDefinition} definition */
+export declare function compileLexical(definition: LexicalDefinition): Readonly<{
+    config: {
+        version: number;
+        fields: string[];
+        profile: string;
+        prefix: boolean;
+        fuzzy: number;
+        combineWith: string;
+        boost: {
+            [x: string]: number;
+        };
+        normalization: string;
+        limits: {
+            maxDocuments: 100000;
+            maxSourceBytes: number;
+            maxIndexBytes: number;
+            maxTemporaryBytes: number;
+            maxTokens: 4000000;
+            maxPostings: 4000000;
+            maxVocabulary: 300000;
+            maxFieldBytes: 65536;
+            maxTokenLength: 128;
+            maxQueryBytes: 4096;
+            maxExpansions: 16384;
+            maxCandidates: 100000;
+            maxResults: 1000;
+            maxWork: 100000000;
+            maxBatchWork: 100000;
+        };
+    };
+    identity: string;
+    create: () => {
+        config: any;
+        identity: any;
+        stats: () => {
+            documents: number;
+            vocabulary: number;
+            postings: number;
+            tokens: number;
+            sourceBytes: number;
+            indexBytes: number;
+            tombstones: number;
+            fieldLengths: any[];
+            generation: number;
+            sourceRevision: string;
+            disposed: boolean;
+        };
+        search: (text: string, options?: any) => {
+            state: any;
+            reason?: any;
+            generation: number;
+            sourceRevision: string;
+            identity: any;
+        };
+        /** Serialize a complete derived snapshot. The checksum detects corruption, not forgery.
+         * @returns {string} */
+        snapshot(): string;
+        /** Validate format, configuration and authoritative source before atomic publication.
+         * Recovery always rebuilds postings through the same bounded engine.
+         * @param {string} serialized @param {LexicalIdentity & {sourceRevision:string}} request */
+        restore(serialized: string, request: LexicalIdentity & {
+            sourceRevision: string;
+        }): {
+            state: any;
+            reason?: any;
+            generation: number;
+            sourceRevision: string;
+            identity: any;
+        };
+        /** Atomically build from authoritative text rows. @param {Iterable<any>} rows @param {LexicalIdentity} [request] */
+        rebuild: (rows: Iterable<any>, request?: LexicalIdentity) => {
+            state: any;
+            reason?: any;
+            generation: number;
+            sourceRevision: string;
+            identity: any;
+        };
+        /** Replace/remove by stable ID; unchanged text is a no-op. @param {{put?:Iterable<any>, remove?:Iterable<string>}} changes @param {LexicalIdentity} [request] */
+        update: (changes: {
+            put?: Iterable<any>;
+            remove?: Iterable<string>;
+        }, request?: LexicalIdentity) => {
+            state: any;
+            reason?: any;
+            generation: number;
+            sourceRevision: string;
+            identity: any;
+        };
+        /** Clear all postings without retaining tombstones. @param {LexicalIdentity} [request] */
+        clear: (request?: LexicalIdentity) => {
+            state: any;
+            reason?: any;
+            generation: number;
+            sourceRevision: string;
+            identity: any;
+        };
+        /** Cooperative atomic build. The host yields to its event loop and owns cancellation.
+         * @param {Iterable<any>} rows @param {LexicalIdentity & {yield:()=>Promise<void>, signal?:AbortSignal, onProgress?:(value:any)=>void}} request */
+        rebuildAsync: (rows: Iterable<any>, request: LexicalIdentity & {
+            yield: () => Promise<void>;
+            signal?: AbortSignal;
+            onProgress?: (value: any) => void;
+        }) => Promise<{
+            state: any;
+            reason?: any;
+            generation: number;
+            sourceRevision: string;
+            identity: any;
+        }>;
+        /** Cooperative atomic replacement/removal using the same staging engine.
+         * @param {{put?:Iterable<any>, remove?:Iterable<string>}} changes
+         * @param {LexicalIdentity & {yield:()=>Promise<void>, signal?:AbortSignal, onProgress?:(value:any)=>void}} request */
+        updateAsync: (changes: {
+            put?: Iterable<any>;
+            remove?: Iterable<string>;
+        }, request: LexicalIdentity & {
+            yield: () => Promise<void>;
+            signal?: AbortSignal;
+            onProgress?: (value: any) => void;
+        }) => Promise<{
+            state: any;
+            reason?: any;
+            generation: number;
+            sourceRevision: string;
+            identity: any;
+        }>;
+        /** Idempotently free every resident reference and fence staged work. */
+        dispose(): void;
+    };
+}>;

package/dist/types/search/vocabulary.d.ts

@@ -0,0 +1,9 @@
+/** Compact traversal orders preserve the compatibility profile without retaining a trie. */
+/** Build traversal ordinals from first occurrence in authoritative document order.
+ * The temporary compressed tree is released before publication; only two arrays of
+ * term references remain. Splitting a branch appends that branch at its parent.
+ * @param {Iterable<string>} words @param {()=>void} step */
+export declare function lexicalVocabulary(words: Iterable<string>, step: () => void): Generator<undefined, {
+    forward: any[];
+    reverse: any[];
+}, unknown>;

package/dist/types/virtual/index.d.ts

@@ -0,0 +1,86 @@
+/** DOM-free virtual geometry. Work and retained state depend on the viewport and credits. */
+/**
+ * A half-open fixed-size window, with no source access. Hidden viewports are empty.
+ * @param {{count:number, size:number, viewport:number, offset?:number, overscan?:number}} options
+ */
+export declare function fixedRange({ count, size, viewport, offset, overscan }: {
+    count: number;
+    size: number;
+    viewport: number;
+    offset?: number;
+    overscan?: number;
+}): {
+    start: number;
+    end: number;
+    offset: number;
+    extent: number;
+};
+/**
+ * Sparse measured axis. Only credited measurements are retained; evicted sizes become estimates.
+ * Prefix summaries rebuild on measurement, never by enumerating logical items.
+ * @param {{count:number, estimateSize:number, maxMeasurements?:number, maxBytes?:number}} options
+ */
+export declare function createVirtualAxis({ count, estimateSize, maxMeasurements, maxBytes }: {
+    count: number;
+    estimateSize: number;
+    maxMeasurements?: number;
+    maxBytes?: number;
+}): {
+    position: (index: any) => any;
+    size: (index: any) => any;
+    indexAt: (offset: any) => number;
+    extent(): any;
+    range({ offset, viewport, overscan }?: {
+        offset?: number | undefined;
+        overscan?: number | undefined;
+        viewport?: number | undefined;
+    }): {
+        start: number;
+        end: number;
+        offset: number;
+        extent: any;
+    };
+    measure(index: any, key: any, value: any): {
+        state: string;
+        reason: string;
+    } | {
+        reason?: undefined;
+        state: string;
+    };
+    anchor(offset: any, keyAt: any, query?: string): {
+        key: string;
+        index: number;
+        offset: number;
+        query: string;
+    } | null;
+    restore(anchor: any, indexOf: any, query?: string): {
+        state: string;
+        offset: any;
+        fallback: boolean;
+    };
+    update(next: any): void;
+    clear(): void;
+    stats(): {
+        measurements: number;
+        bytes: number;
+        summaries: number;
+    };
+    dispose(): void;
+};
+/** Add finite pinned indices to a window; pins count against the same mounted budget.
+ * @param {{start:number,end:number}} range @param {number[]} pins @param {number} count @param {number} budget */
+export declare function virtualIndices(range: {
+    start: number;
+    end: number;
+}, pins: number[], count: number, budget: number): {
+    state: string;
+    reason: string;
+    indices: never[];
+} | {
+    reason?: undefined;
+    state: string;
+    indices: number[];
+};
+/** Normalize a browser RTL scroll offset at the DOM boundary. Modern engines use negative offsets.
+ * @param {number} value @param {number} maximum @param {'ltr'|'negative'|'reverse'|'default'} [mode] */
+export declare function logicalScrollOffset(value: number, maximum: number, mode?: 'ltr' | 'negative' | 'reverse' | 'default'): number;

package/docs/SCHEDULING.md

@@ -0,0 +1,62 @@
+# Bounded scheduling and retry policy
+
+`@jarenjs/core/schedule` exports `createScheduler`. It owns admission, finite
+concurrency and queues, fair service among ready scopes, start spacing and rate
+observations. It does not perform network I/O or decide whether a request is safe
+to retry. `@jarenjs/core/retry` owns shared delay arithmetic, header parsing,
+abortable sleep and total dispatch credits.
+
+```js
+import { createScheduler } from '@jarenjs/core/schedule';
+import { createAttemptBudget, backoffDelay } from '@jarenjs/core/retry';
+
+const scheduler = createScheduler({ concurrency: 4, maxQueue: 64,
+  maxScopes: 256, spacingMs: 25 });
+const budget = createAttemptBudget(3, 'safe-read');
+await scheduler.run(() => {
+  if (!budget.take()) throw new Error('attempt budget exhausted');
+  return doOneAttempt();
+}, { scope: 'origin/account', signal, deadline: Date.now() + 1000 });
+await scheduler.close();
+const delay = backoffDelay({ policy: 'strict', maxMs: 1000 }, 1, 10000);
+// delay is 10000: the caller must wait that long or refuse the retry.
+```
+
+The defaults are concurrency `4`, waiting queue `64`, retained rate scopes
+`256`, and spacing `0` milliseconds. Bounds must be finite integers, with
+positive concurrency/queue/scopes and nonnegative spacing. `now` and `sleep` are
+injectable. `run(worker, {scope, signal, deadline})` returns the worker's value;
+expired, cancelled or closed work never starts. Ready scopes take turns, and
+each scope retains FIFO order. A waiting scope does not occupy a worker.
+`observe(scope, delayMs)` delays subsequent starts in that scope by at least the
+observation, including requests queued by other callers. Rate scopes are bounded
+and expired records are discarded on activity.
+
+`stats()` reports active and queued counts and closed state. `close()` stops
+admission, rejects queued work and drains admitted work before resolving.
+Workers which ignore cancellation can delay that resolution: resource owners
+must wait, and transports must support abort for timely cleanup. Refusals are
+errors with messages `closed`, `cancelled`, `deadline`, `queue-full` or
+`scope-limit`; malformed options are `TypeError`s. A worker rejection preserves
+its error and does not close the shared scheduler.
+
+`backoffDelay({policy,baseMs,maxMs,random}, attempt, retryAfterMs)` uses an attempt
+count starting at one. Strict exponential backoff uses full jitter up to its
+cap, while an explicit server delay is honored without clamping. `ai-compat`
+preserves the AI clients' half-to-full jitter and clamps server delays to the
+cap. `contract-compat` preserves the HTTP client's additive integer jitter.
+The published AI/contract attempt counts and wire semantics remain unchanged;
+their transport-specific outcome loops are deliberate wrappers around this
+shared arithmetic. Strict deadline refusal belongs to the provider executor.
+
+`parseRetryAfter(raw, {dialect,now})` accepts HTTP seconds/date by default,
+numeric milliseconds under `milliseconds`, or nothing under `none`.
+`sleep(ms, signal)` removes its timer and listener on settlement. `abortError`
+returns the signal's reason, or a platform-shaped AbortError.
+
+`createAttemptBudget(totalAttempts, safety)` returns a private frozen capability
+with `take()`, `used` and `remaining`. Categories are `safe-read`,
+`provider-idempotent` and `single-send`; single-send caps the budget at one.
+Reuse the same capability across outer SDK/workflow/job callbacks for the same
+request. Disable SDK transport retries: one transport invocation must mean one
+wire attempt. A method or timeout does not establish replay safety.