@litfamily/litopencode 1.0.0

package/skills/frontend-ui-ux/scripts/import-design-intelligence.mjs

@@ -0,0 +1,193 @@
+#!/usr/bin/env node
+import { createHash } from "node:crypto";
+import fs from "node:fs/promises";
+import path from "node:path";
+import process from "node:process";
+import { fileURLToPath, pathToFileURL } from "node:url";
+import { canonicalJson } from "./canonical-json.mjs";
+import { parseRfc4180 } from "./csv.mjs";
+import { parseStrictJson } from "./strict-json.mjs";
+
+const exactCommit = "1307d97a72e6c1cda572cb65471ae5ce82995218";
+const exactDatasetSha = "a89011236a6ff14e12ec55fccbfab1bbd40ae34614cea5710c022121aa841bb8";
+const decoder = new TextDecoder("utf-8", { fatal: true });
+const scriptDir = path.dirname(fileURLToPath(import.meta.url));
+const provenancePath = path.resolve(scriptDir, "../data/PROVENANCE.json");
+const datasetPath = path.resolve(scriptDir, "../data/design-intelligence.json");
+
+function sha256(value) {
+  return createHash("sha256").update(value).digest("hex");
+}
+
+function parseArgs(argv) {
+  const options = {};
+  for (let index = 0; index < argv.length; index += 1) {
+    const flag = argv[index];
+    if (flag === "--check") options.check = true;
+    else if (["--source-root", "--expect-records", "--max-bytes"].includes(flag)) {
+      if (argv[index + 1] === undefined) throw new Error(`${flag} requires a value`);
+      options[flag.slice(2).replaceAll("-", "_")] = argv[++index];
+    } else {
+      throw new Error(`unknown option: ${flag}`);
+    }
+  }
+  if (!options.source_root || !options.check) {
+    throw new Error("usage: import-design-intelligence.mjs --source-root ROOT --check --expect-records N --max-bytes N");
+  }
+  options.expect_records = Number(options.expect_records);
+  options.max_bytes = Number(options.max_bytes);
+  if (!Number.isSafeInteger(options.expect_records) || options.expect_records < 1) {
+    throw new Error("--expect-records must be a positive integer");
+  }
+  if (!Number.isSafeInteger(options.max_bytes) || options.max_bytes < 1) {
+    throw new Error("--max-bytes must be a positive integer");
+  }
+  return options;
+}
+
+function contained(root, candidate) {
+  const relative = path.relative(root, candidate);
+  return relative !== ".." && !relative.startsWith(`..${path.sep}`) && !path.isAbsolute(relative);
+}
+
+export async function resolveContainedRegularFile(filePath, root) {
+  const canonicalRoot = await fs.realpath(path.resolve(root));
+  const absolute = path.resolve(canonicalRoot, filePath);
+  const relative = path.relative(canonicalRoot, absolute);
+  if (relative.startsWith(`..${path.sep}`) || relative === ".." || path.isAbsolute(relative)) {
+    throw new Error(`source path escapes root: ${filePath}`);
+  }
+  let parent = canonicalRoot;
+  for (const segment of relative.split(path.sep).slice(0, -1)) {
+    parent = path.join(parent, segment);
+    const parentStat = await fs.lstat(parent);
+    if (parentStat.isSymbolicLink() || !parentStat.isDirectory()) {
+      throw new Error(`source parent must be a contained non-symlink directory: ${filePath}`);
+    }
+  }
+  const stat = await fs.lstat(absolute);
+  if (stat.isSymbolicLink() || !stat.isFile()) throw new Error(`source must be a regular non-symlink file: ${filePath}`);
+  const resolved = await fs.realpath(absolute);
+  if (!contained(canonicalRoot, resolved)) throw new Error(`resolved source escapes root: ${filePath}`);
+  return resolved;
+}
+
+function normalizeSource(raw, entry) {
+  if (raw.includes(0)) throw new Error(`NUL byte: ${entry.path}`);
+  let text;
+  try {
+    text = decoder.decode(raw);
+  } catch {
+    throw new Error(`invalid UTF-8: ${entry.path}`);
+  }
+  text = text.replaceAll("\r\n", "\n").replaceAll("\r", "\n");
+  if (entry.repair) {
+    const exactRepair =
+      entry.path === "src/ui-ux-pro-max/data/stacks/javafx.csv" &&
+      entry.repair.rule === "backslash_quote_to_rfc4180_double_quote" &&
+      entry.repair.occurrences === 18;
+    if (!exactRepair || text.split('\\"').length - 1 !== 18) throw new Error(`unapproved repair: ${entry.path}`);
+    text = text.replaceAll('\\"', '""');
+    if (sha256(Buffer.from(text)) !== entry.repair.repaired_sha256) throw new Error(`repair hash mismatch: ${entry.path}`);
+  }
+  return text;
+}
+
+function entryRecords(rows, entry) {
+  const header = rows[0];
+  if (new Set(header).size !== header.length || JSON.stringify(header) !== JSON.stringify(entry.header)) {
+    throw new Error(`header drift: ${entry.path}`);
+  }
+  if (rows.length - 1 !== entry.data_row_count) throw new Error(`row count drift: ${entry.path}`);
+  const positions = Object.fromEntries(entry.selected_columns.map((column) => [column, header.indexOf(column)]));
+  if (Object.values(positions).some((position) => position < 0)) throw new Error(`selected-column drift: ${entry.path}`);
+  const stack = entry.path.includes("/stacks/") ? path.basename(entry.path, ".csv") : undefined;
+  const domain = stack ? `stack/${stack}` : path.basename(entry.path, ".csv");
+  const records = rows.slice(1).map((row, rowIndex) => {
+    const record = Object.fromEntries(
+      entry.selected_columns.map((column) => [column, row[positions[column]].trim()])
+    );
+    const number = Number(record.No);
+    if (!Number.isSafeInteger(number) || number < 1 || String(number) !== record.No) {
+      throw new Error(`non-canonical No: ${entry.path}:${rowIndex + 2}`);
+    }
+    record.No = number;
+    record.domain = domain;
+    record.record_id = `${domain}/${number}`;
+    if (stack) record.stack = stack;
+    return record;
+  });
+  if (records.length !== entry.normalized_record_count) throw new Error(`normalized count drift: ${entry.path}`);
+  return records;
+}
+
+async function loadContract() {
+  const provenance = parseStrictJson(await fs.readFile(provenancePath, "utf8"));
+  if (
+    provenance.source?.commit !== exactCommit ||
+    provenance.import_manifest?.source_count !== 34 ||
+    !Array.isArray(provenance.sources) ||
+    provenance.sources.length !== 34 ||
+    new Set(provenance.sources.map((entry) => entry.path)).size !== 34
+  ) throw new Error("packaged provenance contract mismatch");
+  return provenance;
+}
+
+export async function importDesignIntelligence(options) {
+  const root = await fs.realpath(path.resolve(options.source_root));
+  const provenance = await loadContract();
+  const records = [];
+  const ids = new Set();
+  for (const entry of provenance.sources) {
+    const file = await resolveContainedRegularFile(entry.path, root);
+    const raw = await fs.readFile(file);
+    if (sha256(raw) !== entry.raw_sha256) throw new Error(`source hash mismatch: ${entry.path}`);
+    const rows = parseRfc4180(normalizeSource(raw, entry), entry.path);
+    for (const record of entryRecords(rows, entry)) {
+      if (ids.has(record.record_id)) throw new Error(`duplicate record id: ${record.record_id}`);
+      ids.add(record.record_id);
+      records.push(record);
+    }
+  }
+  if (records.length !== options.expect_records) throw new Error(`record count mismatch: ${records.length}`);
+  const bytes = Buffer.from(canonicalJson({
+    records,
+    schema_version: "litfamily.design-intelligence/v1",
+    source_commit: exactCommit
+  }));
+  if (bytes.length > options.max_bytes) throw new Error(`payload exceeds byte limit: ${bytes.length}`);
+  if (sha256(bytes) !== exactDatasetSha) throw new Error(`canonical dataset hash mismatch: ${sha256(bytes)}`);
+  if (!(await fs.readFile(datasetPath)).equals(bytes)) throw new Error("packaged canonical dataset differs from import");
+  return { bytes: bytes.length, records: records.length, sha256: exactDatasetSha };
+}
+
+export async function main(argv = process.argv.slice(2)) {
+  const result = await importDesignIntelligence(parseArgs(argv));
+  process.stdout.write(
+    `status=SOURCE_CONTRACT_PASS records=${result.records} bytes=${result.bytes} sha256=${result.sha256}\n`
+  );
+}
+
+export async function isDirectExecution(
+  argvPath = process.argv[1],
+  modulePath = fileURLToPath(import.meta.url),
+  filesystem = fs
+) {
+  if (!argvPath) return false;
+  const canonicalPath = (value) =>
+    path.resolve(value)
+      .replace(/^\/tmp\//u, "/private/tmp/")
+      .replace(/^\/private\/(?:private\/)+tmp\//u, "/private/tmp/");
+  try {
+    return canonicalPath(await filesystem.realpath(argvPath)) === canonicalPath(await filesystem.realpath(modulePath));
+  } catch {
+    return canonicalPath(argvPath) === canonicalPath(modulePath);
+  }
+}
+
+if (await isDirectExecution()) {
+  main().catch((error) => {
+    process.stderr.write(`status=SOURCE_CONTRACT_FAIL error=${error instanceof Error ? error.message : String(error)}\n`);
+    process.exitCode = 2;
+  });
+}

package/skills/frontend-ui-ux/scripts/retrieval.mjs

@@ -0,0 +1,92 @@
+import { canonicalJson, canonicalizeValue } from "./canonical-json.mjs";
+import { readCanonicalDesignIntelligence } from "./dataset.mjs";
+
+const maximumQueryBytes = 4096;
+const maximumRecordsPerDomain = 20;
+const maximumOutputBytes = 256 * 1024;
+const domainAliases = Object.freeze({
+  components: ["app-interface", "icons", "ui-reasoning", "ux-guidelines"]
+});
+
+function normalizeRequest(request) {
+  if (request === null || typeof request !== "object" || Array.isArray(request)) {
+    throw new TypeError("Retrieval request must be an object");
+  }
+  if (typeof request.query !== "string") throw new TypeError("Retrieval query must be a string");
+  if (Buffer.byteLength(request.query, "utf8") > maximumQueryBytes) {
+    throw new Error("Retrieval query exceeds 4 KiB (4096 UTF-8 bytes)");
+  }
+  if (!Array.isArray(request.domains) || request.domains.length === 0) {
+    throw new Error("Retrieval request must name at least one domain");
+  }
+  const domains = [...new Set(request.domains)];
+  if (domains.some((domain) => typeof domain !== "string" || domain === "")) {
+    throw new Error("Retrieval domains must be non-empty strings");
+  }
+  const limit = request.limit === undefined ? maximumRecordsPerDomain : request.limit;
+  if (!Number.isInteger(limit) || limit < 1 || limit > maximumRecordsPerDomain) {
+    throw new Error(`Retrieval limit must be an integer from 1 to ${maximumRecordsPerDomain}`);
+  }
+  return {
+    query: request.query.normalize("NFKC").trim().toLocaleLowerCase("en-US"),
+    domains,
+    limit
+  };
+}
+
+function searchableText(record) {
+  return Object.entries(record)
+    .filter(([key]) => key !== "record_id")
+    .map(([, value]) => (typeof value === "string" || typeof value === "number" ? String(value) : ""))
+    .join(" ")
+    .normalize("NFKC")
+    .toLocaleLowerCase("en-US");
+}
+
+function rankedRecords(records, domain, query, limit) {
+  const sourceDomains = domainAliases[domain] ?? [domain];
+  const tokens = query.split(/\s+/u).filter(Boolean);
+  if (tokens.length === 0) return [];
+  return records
+    .filter((record) => sourceDomains.includes(record.domain))
+    .map((record) => {
+      const text = searchableText(record);
+      const score = tokens.reduce((total, token) => total + (text.includes(token) ? 1 : 0), 0);
+      return { record, score };
+    })
+    .filter((entry) => entry.score > 0)
+    .sort((left, right) => right.score - left.score || left.record.record_id.localeCompare(right.record.record_id))
+    .slice(0, limit)
+    .map(({ record, score }) =>
+      canonicalizeValue({
+        ...record,
+        domain,
+        source_domain: record.domain,
+        relevance: score
+      })
+    );
+}
+
+export async function retrieveDesignIntelligence(request) {
+  const normalized = normalizeRequest(request);
+  const dataset = await readCanonicalDesignIntelligence();
+  const knownDomains = new Set(dataset.records.map((record) => record.domain));
+  for (const domain of normalized.domains) {
+    if (!(domain in domainAliases) && !knownDomains.has(domain)) throw new Error(`Unknown domain: ${domain}`);
+  }
+  const records = normalized.domains.flatMap((domain) =>
+    rankedRecords(dataset.records, domain, normalized.query, normalized.limit)
+  );
+  const output = canonicalizeValue({
+    fabricated: false,
+    fallbackApplied: false,
+    query: normalized.query,
+    records,
+    schema_version: "litfamily.design-intelligence-retrieval/v1alpha1",
+    total: records.length
+  });
+  if (Buffer.byteLength(canonicalJson(output), "utf8") > maximumOutputBytes) {
+    throw new Error("Retrieval output exceeds 256 KiB");
+  }
+  return output;
+}

package/skills/frontend-ui-ux/scripts/stable-file-read.mjs

@@ -0,0 +1,237 @@
+import { createHash } from "node:crypto";
+import { constants } from "node:fs";
+import fs from "node:fs/promises";
+import path from "node:path";
+
+function identity(stat) {
+  return Object.freeze({
+    dev: stat.dev,
+    ino: stat.ino,
+    ctimeNs: stat.ctimeNs,
+    mtimeNs: stat.mtimeNs,
+    size: stat.size,
+    mode: stat.mode
+  });
+}
+
+function sameDirectory(left, right) {
+  return left.dev === right.dev
+    && left.ino === right.ino
+    && left.ctimeNs === right.ctimeNs
+    && left.mtimeNs === right.mtimeNs;
+}
+
+function sameFile(left, right) {
+  return sameDirectory(left, right)
+    && left.size === right.size
+    && left.mode === right.mode;
+}
+
+function containedTarget(root, relativePath) {
+  if (typeof relativePath !== "string" || relativePath === "" || path.isAbsolute(relativePath)) {
+    throw new Error("stable file path must be a relative path");
+  }
+  const absoluteRoot = path.resolve(root);
+  const absoluteTarget = path.resolve(absoluteRoot, relativePath);
+  const relative = path.relative(absoluteRoot, absoluteTarget);
+  if (relative === "" || path.isAbsolute(relative) || relative === ".." || relative.startsWith(`..${path.sep}`)) {
+    throw new Error("stable file path escapes its root");
+  }
+  return { absoluteRoot, absoluteTarget };
+}
+
+function directoryChain(root, directory) {
+  const relative = path.relative(root, directory);
+  if (path.isAbsolute(relative) || relative === ".." || relative.startsWith(`..${path.sep}`)) {
+    throw new Error("stable file ancestor escapes its root");
+  }
+  const chain = [root];
+  let current = root;
+  for (const part of relative.split(path.sep).filter(Boolean)) {
+    current = path.join(current, part);
+    chain.push(current);
+  }
+  return chain;
+}
+
+async function closeAll(entries) {
+  for (const entry of [...entries].reverse()) await entry.handle.close().catch(() => {});
+}
+
+async function openAncestorChain(root, directory) {
+  if (typeof constants.O_NOFOLLOW !== "number" || typeof constants.O_DIRECTORY !== "number") {
+    throw new Error("no-follow directory reads are unavailable");
+  }
+  const opened = [];
+  try {
+    for (const absolutePath of directoryChain(root, directory)) {
+      const before = await fs.lstat(absolutePath, { bigint: true });
+      if (before.isSymbolicLink() || !before.isDirectory()) {
+        throw new Error(`canonical ancestor is not a regular directory: ${absolutePath}`);
+      }
+      const handle = await fs.open(
+        absolutePath,
+        constants.O_RDONLY | constants.O_DIRECTORY | constants.O_NOFOLLOW
+      );
+      const descriptor = await handle.stat({ bigint: true });
+      if (!descriptor.isDirectory() || !sameDirectory(identity(before), identity(descriptor))) {
+        await handle.close();
+        throw new Error(`canonical ancestor identity changed before open: ${absolutePath}`);
+      }
+      opened.push({ absolutePath, handle, snapshot: identity(descriptor) });
+    }
+    return opened;
+  } catch (error) {
+    await closeAll(opened);
+    throw error;
+  }
+}
+
+async function assertAncestorsStable(opened) {
+  for (const entry of opened) {
+    const descriptor = await entry.handle.stat({ bigint: true });
+    const named = await fs.lstat(entry.absolutePath, { bigint: true });
+    if (
+      !descriptor.isDirectory()
+      || named.isSymbolicLink()
+      || !named.isDirectory()
+      || !sameDirectory(entry.snapshot, identity(descriptor))
+      || !sameDirectory(entry.snapshot, identity(named))
+    ) {
+      throw new Error(`canonical ancestor identity changed during read: ${entry.absolutePath}`);
+    }
+  }
+}
+
+async function readBounded(handle, size) {
+  const bytes = Buffer.alloc(size);
+  let offset = 0;
+  while (offset < size) {
+    const { bytesRead } = await handle.read(bytes, offset, size - offset, offset);
+    if (bytesRead === 0) break;
+    offset += bytesRead;
+  }
+  const probe = Buffer.alloc(1);
+  const { bytesRead: grew } = await handle.read(probe, 0, 1, size);
+  if (offset !== size || grew !== 0) throw new Error("canonical file size changed during bounded read");
+  return bytes;
+}
+
+export async function readStableRegularFile(root, relativePath, options = {}) {
+  const maxBytes = options.maxBytes;
+  if (!Number.isSafeInteger(maxBytes) || maxBytes < 0) throw new Error("stable file maxBytes must be a non-negative safe integer");
+  if (typeof constants.O_NOFOLLOW !== "number") throw new Error("no-follow file reads are unavailable");
+
+  const { absoluteRoot, absoluteTarget } = containedTarget(root, relativePath);
+  const ancestors = await openAncestorChain(absoluteRoot, path.dirname(absoluteTarget));
+  let handle;
+  try {
+    const before = await fs.lstat(absoluteTarget, { bigint: true });
+    if (before.isSymbolicLink()) throw new Error(`canonical file is a symbolic link: ${relativePath}`);
+    if (!before.isFile()) throw new Error(`canonical file is a special file: ${relativePath}`);
+    if ((before.mode & 0o444n) === 0n) throw new Error(`canonical file is unreadable: ${relativePath}`);
+    if (before.size > BigInt(maxBytes) || before.size > BigInt(Number.MAX_SAFE_INTEGER)) {
+      throw new Error(`canonical file exceeds the ${maxBytes}-byte read limit: ${relativePath}`);
+    }
+
+    handle = await fs.open(absoluteTarget, constants.O_RDONLY | constants.O_NOFOLLOW);
+    const opened = await handle.stat({ bigint: true });
+    if (!opened.isFile() || !sameFile(identity(before), identity(opened))) {
+      throw new Error(`canonical file identity changed before descriptor read: ${relativePath}`);
+    }
+    const bytes = await readBounded(handle, Number(opened.size));
+    if (typeof options.afterRead === "function") await options.afterRead(relativePath);
+
+    const descriptorAfter = await handle.stat({ bigint: true });
+    if (!descriptorAfter.isFile() || !sameFile(identity(opened), identity(descriptorAfter))) {
+      throw new Error(`canonical file identity changed during descriptor read: ${relativePath}`);
+    }
+    const namedAfter = await fs.lstat(absoluteTarget, { bigint: true });
+    if (namedAfter.isSymbolicLink() || !namedAfter.isFile() || !sameFile(identity(opened), identity(namedAfter))) {
+      throw new Error(`canonical file identity changed after descriptor read: ${relativePath}`);
+    }
+    await assertAncestorsStable(ancestors);
+
+    if (options.expectedSize !== undefined && bytes.byteLength !== options.expectedSize) {
+      throw new Error(`canonical file size changed: ${relativePath}`);
+    }
+    const sha256 = createHash("sha256").update(bytes).digest("hex");
+    if (options.expectedSha256 !== undefined && sha256 !== options.expectedSha256) {
+      throw new Error(`canonical file SHA-256 changed: ${relativePath}`);
+    }
+    const snapshot = Object.freeze({
+      root: absoluteRoot,
+      relativePath,
+      file: Object.freeze({ absolutePath: absoluteTarget, ...identity(opened) }),
+      ancestors: Object.freeze(ancestors.map((entry) => Object.freeze({
+        absolutePath: entry.absolutePath,
+        ...entry.snapshot
+      })))
+    });
+    return { bytes, sha256, snapshot };
+  } finally {
+    await handle?.close().catch(() => {});
+    await closeAll(ancestors);
+  }
+}
+
+export async function revalidateStableRegularFile(snapshot) {
+  if (
+    !snapshot
+    || typeof snapshot !== "object"
+    || typeof snapshot.root !== "string"
+    || typeof snapshot.relativePath !== "string"
+    || !snapshot.file
+    || !Array.isArray(snapshot.ancestors)
+  ) {
+    throw new Error("canonical snapshot is malformed");
+  }
+  if (!Object.isFrozen(snapshot) || !Object.isFrozen(snapshot.file) || !Object.isFrozen(snapshot.ancestors)) {
+    throw new Error("canonical snapshot is not immutable");
+  }
+
+  const { absoluteRoot, absoluteTarget } = containedTarget(snapshot.root, snapshot.relativePath);
+  if (absoluteRoot !== snapshot.root || absoluteTarget !== snapshot.file.absolutePath) {
+    throw new Error(`canonical snapshot path changed: ${snapshot.relativePath}`);
+  }
+  const ancestors = await openAncestorChain(absoluteRoot, path.dirname(absoluteTarget));
+  let handle;
+  try {
+    if (ancestors.length !== snapshot.ancestors.length) {
+      throw new Error(`canonical ancestor chain changed after consumption: ${snapshot.relativePath}`);
+    }
+    for (let index = 0; index < ancestors.length; index += 1) {
+      const current = ancestors[index];
+      const expected = snapshot.ancestors[index];
+      if (current.absolutePath !== expected.absolutePath || !sameDirectory(current.snapshot, expected)) {
+        throw new Error(`canonical ancestor identity changed after consumption: ${snapshot.relativePath}`);
+      }
+    }
+
+    const before = await fs.lstat(absoluteTarget, { bigint: true });
+    if (before.isSymbolicLink() || !before.isFile() || !sameFile(identity(before), snapshot.file)) {
+      throw new Error(`canonical file identity changed after consumption: ${snapshot.relativePath}`);
+    }
+    handle = await fs.open(absoluteTarget, constants.O_RDONLY | constants.O_NOFOLLOW);
+    const opened = await handle.stat({ bigint: true });
+    if (!opened.isFile() || !sameFile(identity(before), identity(opened)) || !sameFile(identity(opened), snapshot.file)) {
+      throw new Error(`canonical file descriptor identity changed after consumption: ${snapshot.relativePath}`);
+    }
+    const descriptorAfter = await handle.stat({ bigint: true });
+    const namedAfter = await fs.lstat(absoluteTarget, { bigint: true });
+    if (
+      !descriptorAfter.isFile()
+      || namedAfter.isSymbolicLink()
+      || !namedAfter.isFile()
+      || !sameFile(identity(opened), identity(descriptorAfter))
+      || !sameFile(identity(opened), identity(namedAfter))
+    ) {
+      throw new Error(`canonical file identity changed during revalidation: ${snapshot.relativePath}`);
+    }
+    await assertAncestorsStable(ancestors);
+    return true;
+  } finally {
+    await handle?.close().catch(() => {});
+    await closeAll(ancestors);
+  }
+}

package/skills/frontend-ui-ux/scripts/stdin-json.mjs

@@ -0,0 +1,16 @@
+import { parseBoundedJson } from "./bounded-json.mjs";
+import { jsonInvalid } from "./contract-error.mjs";
+
+export const maximumStdinBytes = 1024 * 1024;
+
+export async function readBoundedJsonStream(stream, { maxBytes = maximumStdinBytes } = {}) {
+  const chunks = [];
+  let total = 0;
+  for await (const chunk of stream) {
+    const bytes = Buffer.isBuffer(chunk) ? chunk : Buffer.from(chunk);
+    total += bytes.length;
+    if (total > maxBytes) throw jsonInvalid(`stdin size ${total} bytes exceeds ${maxBytes} bytes`);
+    chunks.push(bytes);
+  }
+  return parseBoundedJson(Buffer.concat(chunks, total), { maxBytes });
+}

package/skills/frontend-ui-ux/scripts/strict-json.mjs

@@ -0,0 +1,102 @@
+import { argumentInvalid, jsonInvalid } from "./contract-error.mjs";
+
+function fail(message, offset) {
+  throw jsonInvalid(`Malformed JSON at byte ${Buffer.byteLength(message.slice(0, offset), "utf8")}: ${message}`);
+}
+
+export function parseStrictJson(text) {
+  if (typeof text !== "string") throw argumentInvalid("JSON payload must be a UTF-8 string");
+  if (text.includes("\0")) throw jsonInvalid("Malformed JSON: NUL bytes are forbidden");
+  let index = 0;
+
+  function whitespace() {
+    while (index < text.length && /\s/u.test(text[index])) index += 1;
+  }
+
+  function string() {
+    const start = index;
+    index += 1;
+    while (index < text.length) {
+      if (text[index] === '"') {
+        index += 1;
+        try {
+          return JSON.parse(text.slice(start, index));
+        } catch {
+          fail("invalid string escape", start);
+        }
+      }
+      if (text[index] === "\\") index += 1;
+      index += 1;
+    }
+    fail("unterminated string", start);
+  }
+
+  function value() {
+    whitespace();
+    const token = text[index];
+    if (token === '"') return string();
+    if (token === "{") return object();
+    if (token === "[") return array();
+    const match = text.slice(index).match(/^(?:-?(?:0|[1-9]\d*)(?:\.\d+)?(?:[eE][+-]?\d+)?|true|false|null)/u);
+    if (match === null) fail("invalid value", index);
+    index += match[0].length;
+    return JSON.parse(match[0]);
+  }
+
+  function object() {
+    index += 1;
+    whitespace();
+    const output = {};
+    const keys = new Set();
+    if (text[index] === "}") {
+      index += 1;
+      return output;
+    }
+    while (index < text.length) {
+      if (text[index] !== '"') fail("object key must be a string", index);
+      const key = string();
+      if (keys.has(key)) throw jsonInvalid(`Malformed JSON: duplicate key ${JSON.stringify(key)}`);
+      keys.add(key);
+      whitespace();
+      if (text[index] !== ":") fail("missing colon", index);
+      index += 1;
+      output[key] = value();
+      whitespace();
+      if (text[index] === "}") {
+        index += 1;
+        return output;
+      }
+      if (text[index] !== ",") fail("missing comma", index);
+      index += 1;
+      whitespace();
+    }
+    fail("unterminated object", index);
+  }
+
+  function array() {
+    index += 1;
+    whitespace();
+    const output = [];
+    if (text[index] === "]") {
+      index += 1;
+      return output;
+    }
+    while (index < text.length) {
+      output.push(value());
+      whitespace();
+      if (text[index] === "]") {
+        index += 1;
+        return output;
+      }
+      if (text[index] !== ",") fail("missing comma", index);
+      index += 1;
+      whitespace();
+    }
+    fail("unterminated array", index);
+  }
+
+  const parsed = value();
+  whitespace();
+  if (index !== text.length) fail("trailing non-whitespace", index);
+  return parsed;
+}