@linxiraos/pi-utils 1.0.0

package/src/ring.ts

@@ -0,0 +1,169 @@
+/**
+ * A fixed-capacity circular buffer that supports efficient push/pop/shift/unshift operations.
+ * When the buffer is full, adding new items overwrites the oldest items (FIFO behavior).
+ *
+ * @template T The type of elements stored in the buffer.
+ */
+export class RingBuffer<T> {
+	#buf: (T | undefined)[];
+	#head = 0;
+	#size = 0;
+
+	/**
+	 * Creates a new ring buffer with the specified capacity.
+	 *
+	 * @param capacity - The maximum number of elements the buffer can hold. Must be positive.
+	 */
+	constructor(public readonly capacity: number) {
+		this.#buf = new Array(capacity);
+	}
+
+	/**
+	 * The number of elements currently in the buffer.
+	 */
+	get length(): number {
+		return this.#size;
+	}
+
+	/**
+	 * Whether the buffer is at full capacity.
+	 */
+	get isFull(): boolean {
+		return this.#size === this.capacity;
+	}
+
+	/**
+	 * Whether the buffer is empty (contains no elements).
+	 */
+	get isEmpty(): boolean {
+		return this.#size === 0;
+	}
+
+	/**
+	 * Adds an item to the end of the buffer.
+	 * If the buffer is full, the oldest item is overwritten and returned.
+	 *
+	 * @param item - The item to add.
+	 * @returns The overwritten item if the buffer was full, otherwise `undefined`.
+	 */
+	push(item: T): T | undefined {
+		const idx = (this.#head + this.#size) % this.capacity;
+		const overwritten = this.#size === this.capacity ? this.#buf[idx] : undefined;
+		this.#buf[idx] = item;
+		if (this.#size === this.capacity) {
+			this.#head = (this.#head + 1) % this.capacity;
+		} else {
+			this.#size++;
+		}
+		return overwritten;
+	}
+
+	/**
+	 * Removes and returns the first (oldest) item from the buffer.
+	 *
+	 * @returns The removed item, or `undefined` if the buffer is empty.
+	 */
+	shift(): T | undefined {
+		if (this.#size === 0) return undefined;
+		const item = this.#buf[this.#head];
+		this.#buf[this.#head] = undefined;
+		this.#head = (this.#head + 1) % this.capacity;
+		this.#size--;
+		return item;
+	}
+
+	/**
+	 * Removes and returns the last (newest) item from the buffer.
+	 *
+	 * @returns The removed item, or `undefined` if the buffer is empty.
+	 */
+	pop(): T | undefined {
+		if (this.#size === 0) return undefined;
+		const idx = (this.#head + this.#size - 1) % this.capacity;
+		const item = this.#buf[idx];
+		this.#buf[idx] = undefined;
+		this.#size--;
+		return item;
+	}
+
+	/**
+	 * Adds an item to the beginning of the buffer.
+	 * If the buffer is full, the newest item is overwritten and returned.
+	 *
+	 * @param item - The item to add.
+	 * @returns The overwritten item if the buffer was full, otherwise `undefined`.
+	 */
+	unshift(item: T): T | undefined {
+		this.#head = (this.#head - 1 + this.capacity) % this.capacity;
+		const overwritten = this.#size === this.capacity ? this.#buf[this.#head] : undefined;
+		this.#buf[this.#head] = item;
+		if (this.#size < this.capacity) this.#size++;
+		return overwritten;
+	}
+
+	/**
+	 * Returns the element at the specified index without removing it.
+	 * Supports negative indices (e.g., `-1` for the last element).
+	 *
+	 * @param index - The zero-based index, or negative index from the end.
+	 * @returns The element at the index, or `undefined` if the index is out of bounds.
+	 */
+	at(index: number): T | undefined {
+		if (index < 0) index += this.#size;
+		if (index < 0 || index >= this.#size) return undefined;
+		return this.#buf[(this.#head + index) % this.capacity];
+	}
+
+	/**
+	 * Returns the first (oldest) element without removing it.
+	 *
+	 * @returns The first element, or `undefined` if the buffer is empty.
+	 */
+	peek(): T | undefined {
+		return this.at(0);
+	}
+
+	/**
+	 * Returns the last (newest) element without removing it.
+	 *
+	 * @returns The last element, or `undefined` if the buffer is empty.
+	 */
+	peekBack(): T | undefined {
+		return this.at(this.#size - 1);
+	}
+
+	/**
+	 * Removes all elements from the buffer, resetting it to an empty state.
+	 */
+	clear(): void {
+		this.#buf.fill(undefined, 0, this.capacity);
+		this.#head = 0;
+		this.#size = 0;
+	}
+
+	/**
+	 * Returns an iterator that yields elements in logical order (oldest to newest).
+	 * Allows the buffer to be used with `for...of` loops and spread syntax.
+	 *
+	 * @yields Elements in FIFO order.
+	 */
+	*[Symbol.iterator](): Iterator<T> {
+		for (let i = 0; i < this.#size; i++) {
+			yield this.#buf[(this.#head + i) % this.capacity] as T;
+		}
+	}
+
+	/**
+	 * Creates a new array containing all elements in logical order (oldest to newest).
+	 *
+	 * @returns A new array with all buffer elements.
+	 */
+	toArray(): T[] {
+		if (this.#head + this.#size <= this.capacity) {
+			return this.#buf.slice(this.#head, this.#head + this.#size) as T[];
+		}
+		const tail = this.#buf.slice(this.#head, this.capacity);
+		const head = this.#buf.slice(0, (this.#head + this.#size) % this.capacity);
+		return tail.concat(head) as T[];
+	}
+}

package/src/runtime-install.ts

@@ -0,0 +1,393 @@
+import * as fs from "node:fs";
+import * as fsp from "node:fs/promises";
+import * as Module from "node:module";
+import * as path from "node:path";
+
+/**
+ * On-demand runtime dependency support for native-heavy optional packages
+ * (Transformers.js, fastembed) that are never bundled into the CLI or the
+ * compiled binary. Consumers `bun install` a pinned dependency set into a
+ * cache directory on first use ({@link ensureRuntimeInstalled}) and load the
+ * entrypoint via `createRequire`.
+ *
+ * Bun's compiled-binary module resolver only finds `<pkg>/index.js` for bare
+ * specifiers loaded from the *real* filesystem — it ignores `main`/`exports`
+ * (issue #1763). Runtime-installed graphs (`@huggingface/transformers` →
+ * `onnxruntime-node` → `onnxruntime-common`, `fastembed` →
+ * `@anush008/tokenizers` → platform binding) all point `main`/`exports` at
+ * nested files, so the stock resolver cannot load any of them. We patch
+ * `Module._resolveFilename` to resolve those bare specifiers against the
+ * registered runtime caches ourselves, honoring `main`/`exports`.
+ *
+ * This module is filesystem-pure aside from {@link installRuntimeModuleResolver}
+ * mutating the `node:module` resolver, so the resolution logic is unit-testable
+ * without a compiled binary.
+ */
+
+/** Conditions honored when resolving an `exports` map for a CommonJS `require`. */
+const RUNTIME_CONDITIONS: Record<string, true> = { node: true, require: true, default: true };
+
+/** Extension probes appended to a `main`/`exports` target that lacks one. */
+const RUNTIME_EXTENSIONS: readonly string[] = [".js", ".cjs", ".mjs", ".json", ".node"];
+
+function isRecord(value: unknown): value is Record<string, unknown> {
+	return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+
+/**
+ * Walk a conditional `exports` target (string, array of fallbacks, or a
+ * condition object) and return the first relative path that matches a runtime
+ * condition in declaration order. Returns `null` when nothing applies (e.g.
+ * an `import`-only entry).
+ */
+export function selectConditionalTarget(target: unknown): string | null {
+	if (typeof target === "string") return target;
+	if (Array.isArray(target)) {
+		for (const entry of target) {
+			const resolved = selectConditionalTarget(entry);
+			if (resolved) return resolved;
+		}
+		return null;
+	}
+	if (isRecord(target)) {
+		for (const condition in target) {
+			if (!RUNTIME_CONDITIONS[condition]) continue;
+			const resolved = selectConditionalTarget(target[condition]);
+			if (resolved) return resolved;
+		}
+	}
+	return null;
+}
+
+/** Resolve a relative target inside a package to a concrete file path, probing extensions and `index`. */
+function resolveFileTarget(pkgDir: string, relative: string): string | null {
+	const base = path.join(pkgDir, relative);
+	const candidates = [base, ...RUNTIME_EXTENSIONS.map(ext => base + ext)];
+	for (const candidate of candidates) {
+		try {
+			const stat = fs.statSync(candidate);
+			if (stat.isFile()) return candidate;
+			if (stat.isDirectory()) {
+				const indexed = resolveFileTarget(candidate, "index");
+				if (indexed) return indexed;
+			}
+		} catch {
+			// missing candidate — keep probing
+		}
+	}
+	return null;
+}
+
+function resolveExportsEntry(
+	pkgDir: string,
+	exports: Record<string, unknown>,
+	subpath: string | undefined,
+): string | null {
+	let subpathMap = false;
+	for (const key in exports) {
+		subpathMap = key === "." || key.startsWith("./");
+		break;
+	}
+	if (subpathMap) {
+		const key = subpath ? `./${subpath}` : ".";
+		if (!(key in exports)) return null;
+		const target = selectConditionalTarget(exports[key]);
+		return target ? resolveFileTarget(pkgDir, target) : null;
+	}
+	// A bare condition map only describes the package root, so a subpath
+	// request falls through to plain path joining at the call site.
+	if (subpath) return null;
+	const target = selectConditionalTarget(exports);
+	return target ? resolveFileTarget(pkgDir, target) : null;
+}
+
+/**
+ * Split a bare specifier into its package name and optional subpath, handling
+ * scoped packages (`@scope/name/sub` → `@scope/name` + `sub`).
+ */
+export function splitBareSpecifier(specifier: string): { packageName: string; subpath: string | undefined } {
+	const segments = specifier.split("/");
+	const take = specifier.startsWith("@") ? 2 : 1;
+	const packageName = segments.slice(0, take).join("/");
+	const subpath = segments.length > take ? segments.slice(take).join("/") : undefined;
+	return { packageName, subpath };
+}
+
+/**
+ * Resolve a bare specifier against an installed `node_modules` directory,
+ * honoring `exports` (CommonJS conditions), then `main`, then `index.js`.
+ * Returns an absolute file path, or `null` when the package/entry is absent.
+ */
+export function resolveRuntimeModule(runtimeNodeModules: string, specifier: string): string | null {
+	const { packageName, subpath } = splitBareSpecifier(specifier);
+	const pkgDir = path.join(runtimeNodeModules, ...packageName.split("/"));
+	const manifest = readManifest(pkgDir);
+	if (!manifest) return subpath ? resolveFileTarget(pkgDir, subpath) : null;
+
+	const { exports } = manifest;
+	if (typeof exports === "string" || isRecord(exports)) {
+		const map = typeof exports === "string" ? { ".": exports } : exports;
+		const resolved = resolveExportsEntry(pkgDir, map, subpath);
+		if (resolved) return resolved;
+	}
+	if (subpath) return resolveFileTarget(pkgDir, subpath);
+	if (typeof manifest.main === "string") {
+		const resolved = resolveFileTarget(pkgDir, manifest.main);
+		if (resolved) return resolved;
+	}
+	return resolveFileTarget(pkgDir, "index.js");
+}
+
+function readManifest(pkgDir: string): Record<string, unknown> | null {
+	try {
+		const parsed: unknown = JSON.parse(fs.readFileSync(path.join(pkgDir, "package.json"), "utf8"));
+		return isRecord(parsed) ? parsed : null;
+	} catch {
+		return null;
+	}
+}
+
+interface ModuleResolver {
+	_resolveFilename(request: string, parent: unknown, isMain: boolean, options?: unknown): string;
+}
+
+interface ResolverRegistration {
+	runtimeNodeModules: string;
+	stubs: Record<string, string>;
+}
+
+const REGISTRY = Symbol.for("omp.runtimeModuleResolver.registry");
+const PATCHED = Symbol.for("omp.runtimeModuleResolver.patched");
+
+/**
+ * The registration list lives on `globalThis` so a bundled copy and a
+ * source copy of this module in one process share the same registry — the
+ * resolver is patched once per process, and the patched closure must see
+ * every registration.
+ */
+function resolverRegistry(): ResolverRegistration[] {
+	const holder = globalThis as { [REGISTRY]?: ResolverRegistration[] };
+	holder[REGISTRY] ??= [];
+	return holder[REGISTRY];
+}
+function pathContains(root: string, candidate: string): boolean {
+	const relative = path.relative(root, candidate);
+	return relative === "" || (!relative.startsWith("..") && !path.isAbsolute(relative));
+}
+
+function parentFilename(parent: unknown): string | null {
+	if (!isRecord(parent)) return null;
+	const filename = parent.filename;
+	return typeof filename === "string" ? filename : null;
+}
+
+export interface RuntimeResolverOptions {
+	/** Absolute path to the runtime cache's `node_modules`. */
+	runtimeNodeModules: string;
+	/** Bare specifier → absolute file path overrides (e.g. `sharp` → no-op stub). */
+	stubs?: Record<string, string>;
+}
+
+/**
+ * Patch `node:module`'s resolver (idempotently) so bare specifiers that the
+ * stock compiled-binary resolver cannot find fall back to the registered
+ * runtime caches. Stock resolution is tried first and kept for anything
+ * outside the registered roots (bundled imports, node builtins, host or
+ * extension trees). Multiple runtime roots may register; they are consulted
+ * in registration order. Returns an uninstaller that drops the registration
+ * and restores the stock resolver once no registrations remain.
+ *
+ * One stock "success" is distrusted: the compiled-binary resolver ignores
+ * `main`/`exports` for real-FS packages (Bun #1763), so a package shipping
+ * its TS source next to `dist/` (e.g. `@huggingface/hub`'s root `index.ts`)
+ * resolves to the wrong file. When the stock hit lands inside a registered
+ * runtime root, the manifest-aware resolution wins.
+ *
+ * KNOWN LIMITATION (Bun 1.3.14): while any JS override of
+ * `Module._resolveFilename` is installed, Bun routes `createRequire(...)`
+ * resolution through it with `parent === undefined` — the requester context is
+ * never passed, so relative requires from a `createRequire` require fail with
+ * "Cannot find module './x' from ''". The override cannot recover what it is
+ * never given. Keep this patch scoped to dedicated worker/runtime processes
+ * (tiny-inference, fastembed); never install it in the main agent process,
+ * where legacy-pi extensions rely on `createRequire` relative requires.
+ */
+export function installRuntimeModuleResolver({ runtimeNodeModules, stubs = {} }: RuntimeResolverOptions): () => void {
+	const registry = resolverRegistry();
+	const existing = registry.find(entry => entry.runtimeNodeModules === runtimeNodeModules);
+	if (existing) Object.assign(existing.stubs, stubs);
+	else registry.push({ runtimeNodeModules, stubs: { ...stubs } });
+
+	const resolver = (Module as unknown as { default?: ModuleResolver } & ModuleResolver).default ?? Module;
+	const target = resolver as unknown as ModuleResolver & { [PATCHED]?: () => void };
+	const uninstall = (): void => {
+		const entries = resolverRegistry();
+		const index = entries.findIndex(entry => entry.runtimeNodeModules === runtimeNodeModules);
+		if (index !== -1) entries.splice(index, 1);
+		if (entries.length === 0) target[PATCHED]?.();
+	};
+	if (target[PATCHED]) return uninstall;
+	const pristine = target._resolveFilename;
+	const original = pristine.bind(target);
+	target._resolveFilename = (request: string, parent: unknown, isMain: boolean, options?: unknown): string => {
+		let stockResolved: string | null = null;
+		let stockError: unknown;
+		try {
+			stockResolved = original(request, parent, isMain, options);
+		} catch (error) {
+			stockError = error;
+		}
+		const bare = !request.startsWith(".") && !request.startsWith("node:") && !path.isAbsolute(request);
+		if (bare) {
+			const parentFile = parentFilename(parent);
+			for (const registration of resolverRegistry()) {
+				const parentInRuntime = parentFile !== null && pathContains(registration.runtimeNodeModules, parentFile);
+				if (parentInRuntime) {
+					const stub = registration.stubs[request];
+					if (stub) return stub;
+					if (!stockResolved || !pathContains(registration.runtimeNodeModules, stockResolved)) {
+						const fallback = resolveRuntimeModule(registration.runtimeNodeModules, request);
+						if (fallback) return fallback;
+					}
+				}
+				if (stockResolved) {
+					// Correct a stock hit only inside the top-level package the
+					// request names. A hit in a nested node_modules (e.g. tar's
+					// minizlib resolving its own minipass@3 under
+					// <root>/minizlib/node_modules/) is version-correct — overriding
+					// it with the top-level instance would cross major versions.
+					const { packageName } = splitBareSpecifier(request);
+					const pkgDir = path.join(registration.runtimeNodeModules, ...packageName.split("/"));
+					if (!stockResolved.startsWith(pkgDir + path.sep)) continue;
+					if (path.relative(pkgDir, stockResolved).split(path.sep).includes("node_modules")) continue;
+					const expected = resolveRuntimeModule(registration.runtimeNodeModules, request);
+					if (expected) return expected;
+				} else {
+					const stub = registration.stubs[request];
+					if (stub) return stub;
+					const fallback = resolveRuntimeModule(registration.runtimeNodeModules, request);
+					if (fallback) return fallback;
+				}
+			}
+		}
+		if (stockResolved) return stockResolved;
+		throw stockError;
+	};
+	target[PATCHED] = () => {
+		target._resolveFilename = pristine;
+		delete target[PATCHED];
+	};
+	return uninstall;
+}
+
+/** Pinned dependency set materialized into a runtime cache directory. */
+export interface RuntimeInstallSpec {
+	dependencies: Record<string, string>;
+	/** Version pins forced across the whole runtime tree (bun `overrides`), e.g. dislodging a transitive dep. */
+	overrides?: Record<string, string>;
+	/** Packages whose lifecycle scripts bun may run during the install. */
+	trustedDependencies?: string[];
+}
+
+export type RuntimeInstallPhase = "initiate" | "download" | "done";
+
+export interface EnsureRuntimeInstalledOptions {
+	/** Directory owning the runtime `package.json` + `node_modules`. */
+	runtimeDir: string;
+	install: RuntimeInstallSpec;
+	/** Package whose installed manifest marks the runtime complete; defaults to the first dependency. */
+	probePackage?: string;
+	/** Phase notifications (progress UI); not emitted when already installed. */
+	onPhase?: (phase: RuntimeInstallPhase) => void;
+	lockAttempts?: number;
+	lockSleepMs?: number;
+}
+
+function isErrnoCode(error: unknown, code: string): boolean {
+	return typeof error === "object" && error !== null && "code" in error && error.code === code;
+}
+
+async function acquireInstallLock(runtimeDir: string, attempts: number, sleepMs: number): Promise<() => Promise<void>> {
+	const lockDir = `${runtimeDir}.lock`;
+	await fsp.mkdir(path.dirname(lockDir), { recursive: true });
+	for (let attempt = 0; attempt < attempts; attempt++) {
+		try {
+			await fsp.mkdir(lockDir);
+			return async () => {
+				await fsp.rm(lockDir, { recursive: true, force: true });
+			};
+		} catch (error) {
+			if (!isErrnoCode(error, "EEXIST")) throw error;
+			await Bun.sleep(sleepMs);
+		}
+	}
+	throw new Error(`Timed out waiting for runtime install lock: ${lockDir}`);
+}
+
+export async function writeRuntimeManifest(runtimeDir: string, install: RuntimeInstallSpec): Promise<void> {
+	await fsp.mkdir(runtimeDir, { recursive: true });
+	const manifest: Record<string, unknown> = {
+		private: true,
+		type: "module",
+		dependencies: install.dependencies,
+	};
+	if (install.overrides && Object.keys(install.overrides).length) manifest.overrides = install.overrides;
+	if (install.trustedDependencies?.length) manifest.trustedDependencies = install.trustedDependencies;
+	await Bun.write(path.join(runtimeDir, "package.json"), `${JSON.stringify(manifest, null, "\t")}\n`);
+}
+
+async function readPipe(stream: ReadableStream<Uint8Array> | null): Promise<string> {
+	if (!stream) return "";
+	return new Response(stream).text();
+}
+
+async function runRuntimeInstall(runtimeDir: string): Promise<void> {
+	// `process.execPath` is plain bun in source/bundle mode and the compiled
+	// binary otherwise; BUN_BE_BUN makes the compiled binary act as bun.
+	const proc = Bun.spawn([process.execPath, "install", "--cwd", runtimeDir, "--production"], {
+		env: { ...Bun.env, BUN_BE_BUN: "1" },
+		stdout: "pipe",
+		stderr: "pipe",
+	});
+	const [stdout, stderr, exitCode] = await Promise.all([
+		readPipe(proc.stdout as ReadableStream<Uint8Array> | null),
+		readPipe(proc.stderr as ReadableStream<Uint8Array> | null),
+		proc.exited,
+	]);
+	if (exitCode === 0) return;
+	const output = `${stdout}\n${stderr}`.trim();
+	throw new Error(
+		`Failed to install runtime at ${runtimeDir} with ${process.execPath} install (exit ${exitCode}): ${output}`,
+	);
+}
+
+/**
+ * Materialize a pinned dependency set into `runtimeDir` (idempotent,
+ * cross-process safe via a lock directory). Returns `runtimeDir`.
+ */
+export async function ensureRuntimeInstalled(options: EnsureRuntimeInstalledOptions): Promise<string> {
+	const { runtimeDir, install, onPhase, lockAttempts = 240, lockSleepMs = 250 } = options;
+	let probePackage = options.probePackage;
+	if (!probePackage) {
+		for (const name in install.dependencies) {
+			probePackage = name;
+			break;
+		}
+	}
+	if (!probePackage) throw new Error(`Runtime install at ${runtimeDir} declares no dependencies`);
+	const probeManifest = Bun.file(path.join(runtimeDir, "node_modules", ...probePackage.split("/"), "package.json"));
+	if (await probeManifest.exists()) return runtimeDir;
+
+	onPhase?.("initiate");
+	const releaseLock = await acquireInstallLock(runtimeDir, lockAttempts, lockSleepMs);
+	try {
+		if (await probeManifest.exists()) return runtimeDir;
+		await writeRuntimeManifest(runtimeDir, install);
+		onPhase?.("download");
+		await runRuntimeInstall(runtimeDir);
+		onPhase?.("done");
+		return runtimeDir;
+	} finally {
+		await releaseLock();
+	}
+}

package/src/sanitize-text.ts

@@ -0,0 +1,96 @@
+/**
+ * Strip ANSI escape sequences, remove control characters / lone surrogates,
+ * and normalize line endings.
+ *
+ * Bun-native implementation of the former native `sanitizeText` (see
+ * `crates/pi-natives/src/text.rs::sanitize_text`). JavaScript strings are
+ * already UTF-16 code-unit arrays. `toWellFormed()` handles the uncommon
+ * malformed path; when it changes the input, replacement characters are
+ * dropped and the normalized result goes through the well-formed sanitizer.
+ *
+ * Fast path: well-formed input with no controls or ANSI returns the original
+ * string after the control probe.
+ */
+
+const ESC_CHAR = "\x1b";
+
+// Well-formed strings only need control/ANSI detection: C0 (excl. \t \n),
+// CR, DEL, and C1. ESC (0x1B) is in \x0B-\x1F.
+const CONTROL_RE = /[\x00-\x08\x0B-\x1F\x7F-\x9F]/g;
+
+const REPLACEMENT_CHAR = "\ufffd";
+
+export function sanitizeText(text: string): string {
+	const wellFormed = text.toWellFormed();
+	if (wellFormed !== text) {
+		return sanitizeWellFormedText(wellFormed.replaceAll(REPLACEMENT_CHAR, ""));
+	}
+	return sanitizeWellFormedText(text);
+}
+
+function sanitizeWellFormedText(text: string): string {
+	CONTROL_RE.lastIndex = 0;
+	if (CONTROL_RE.exec(text) === null) return text;
+
+	const stripped = text.indexOf(ESC_CHAR) === -1 ? text : Bun.stripANSI(text);
+	CONTROL_RE.lastIndex = 0;
+	return stripped.replace(CONTROL_RE, "");
+}
+
+/**
+ * Escape the three XML-significant characters (`&`, `<`, `>`) in text destined
+ * for an XML/markup element body. Allocation-conscious: returns the input
+ * unchanged (same reference) when nothing needs escaping. Quotes are left as-is
+ * — use it for element text, not attribute values.
+ */
+export function escapeXmlText(input: string): string {
+	let firstEscapable = -1;
+	for (let index = 0; index < input.length; index++) {
+		const char = input.charCodeAt(index);
+		if (char === 38 || char === 60 || char === 62) {
+			firstEscapable = index;
+			break;
+		}
+	}
+	if (firstEscapable === -1) return input;
+
+	let output = input.slice(0, firstEscapable);
+	for (let index = firstEscapable; index < input.length; index++) {
+		const char = input[index];
+		if (char === "&") output += "&amp;";
+		else if (char === "<") output += "&lt;";
+		else if (char === ">") output += "&gt;";
+		else output += char;
+	}
+	return output;
+}
+
+/**
+ * Escape XML-significant characters for an attribute VALUE: the three body
+ * characters (`&`, `<`, `>`) plus the double quote (`"` → `&quot;`) that would
+ * otherwise close the attribute. Allocation-conscious: returns the input
+ * unchanged (same reference) when nothing needs escaping. Use it for attribute
+ * values; {@link escapeXmlText} is for element bodies and leaves `"` intact.
+ */
+export function escapeXmlAttribute(input: string): string {
+	let firstEscapable = -1;
+	for (let index = 0; index < input.length; index++) {
+		const char = input.charCodeAt(index);
+		if (char === 38 || char === 60 || char === 62 || char === 34) {
+			firstEscapable = index;
+			break;
+		}
+	}
+	if (firstEscapable === -1) return input;
+
+	let output = input.slice(0, firstEscapable);
+	for (let index = firstEscapable; index < input.length; index++) {
+		const char = input[index];
+		if (char === "&") output += "&amp;";
+		else if (char === "<") output += "&lt;";
+		else if (char === ">") output += "&gt;";
+		else if (char === '"') output += "&quot;";
+		else output += char;
+	}
+	return output;
+}