@morit/cli 1.6.0 → 1.9.1

package/src/script-runtime.js

@@ -0,0 +1,252 @@
+import { assertSchema, validateValueSchema } from './script-schema.js';
+import { SCRIPT_CONTRACT, validateAst } from './script-contract.js';
+// JSON-only interpreter. No host object or native callable enters the scope.
+export class RuntimeError extends Error {
+  constructor(code, message, span) { super(message); this.name = 'RuntimeError'; this.code = code; this.span = span; }
+  toJSON() { return { code: this.code, message: this.message, span: this.span }; }
+}
+const forbidden = new Set(['__proto__', 'prototype', 'constructor']);
+const encoder = new TextEncoder();
+const size = value => encoder.encode(value).length;
+const own = (value, key) => Object.prototype.hasOwnProperty.call(value, key);
+
+const same = (a, b) => {
+  if (a === b) return true;
+  if (!a || !b || typeof a !== 'object' || typeof b !== 'object' || Array.isArray(a) !== Array.isArray(b)) return false;
+  const keys = Object.keys(a); return keys.length === Object.keys(b).length && keys.every(k => own(b, k) && same(a[k], b[k]));
+};
+const truth = value => value !== null && value !== false && value !== 0 && value !== '';
+
+export class ScriptRuntime {
+  constructor({ modules = {}, profile = 'ui' } = {}) {
+    this.modules = modules; this.profile = SCRIPT_CONTRACT.profiles[profile];
+    for (const module of Object.values(modules)) {
+      validateAst(module.ast || module);
+      for (const schema of Object.values(module.exports ?? {})) { validateValueSchema(schema.input_schema); validateValueSchema(schema.output_schema); }
+    }
+    this.inline = profile === 'inline';
+    if (!this.profile) throw new RuntimeError('PROFILE', 'Unknown execution profile');
+  }
+  start(scope) {
+    this.started = performance.now(); this.steps = 0; this.memory = 0; this.stack = [];
+    this.checkValue(scope); this.scope = structuredClone(scope);
+  }
+  error(code, message, node) { throw new RuntimeError(code, message, node?.span); }
+  tick(node) {
+    if (++this.steps > this.profile.steps) this.error('STEP_LIMIT', 'Execution step limit exceeded', node);
+    if (performance.now() - this.started > this.profile.timeout) this.error('TIMEOUT', 'Execution timed out', node);
+  }
+  checkValue(value, depth = 0) {
+    this.memory += 8;
+    if (depth > 20 || this.memory > this.profile.memory) this.error('MEMORY_LIMIT', 'Value budget exceeded');
+    if (value === null || typeof value === 'boolean') return value;
+    if (typeof value === 'number') { if (!Number.isFinite(value) || Math.abs(value) > Number.MAX_SAFE_INTEGER) this.error('TYPE', 'Number outside portable range'); return value; }
+    if (typeof value === 'string') {
+      const length = size(value); this.memory += length;
+      if (length > 32768 || this.memory > this.profile.memory) this.error('MEMORY_LIMIT', 'String budget exceeded'); return value;
+    }
+    if (Array.isArray(value)) {
+      if (value.length > 1000) this.error('MEMORY_LIMIT', 'Array exceeds 1000 entries');
+      for (const item of value) this.checkValue(item, depth + 1); return value;
+    }
+    if (value && typeof value === 'object' && [Object.prototype, null].includes(Object.getPrototypeOf(value))) {
+      const keys = Object.keys(value); if (keys.length > 512) this.error('MEMORY_LIMIT', 'Object exceeds 512 keys');
+      for (const key of keys) {
+        if (forbidden.has(key)) this.error('FORBIDDEN', 'Forbidden object key');
+        this.checkValue(key, depth + 1); this.checkValue(value[key], depth + 1);
+      }
+      return value;
+    }
+    this.error('TYPE', 'Runtime values must be finite JSON');
+  }
+  finish(value) {
+    this.tick();
+    this.checkValue(value);
+    if (size(JSON.stringify(value)) > 262144) this.error('OUTPUT_LIMIT', 'Result exceeds 256 KiB');
+    return { value, diagnostics: { steps: this.steps, allocated_bytes: this.memory, elapsed_ms: performance.now() - this.started } };
+  }
+  evaluate(ast, scope = {}) { validateAst(ast, {inline: this.inline}); this.start(scope); return this.finish(this.expr(ast, [new Map(Object.entries(this.scope))])); }
+  invoke(moduleId, name, input, scope = {}) {
+    this.start(scope); this.checkValue(input);
+    return this.finish(this.callModule(moduleId, name, [input], [new Map(Object.entries(this.scope))]));
+  }
+  find(env, name) { return env.findLast(frame => frame.has(name)); }
+  callModule(moduleId, name, args, env) {
+    const module = this.modules[moduleId]?.ast || this.modules[moduleId];
+    const fn = module?.functions?.find(value => value.name === name && value.exported);
+    if (!fn) this.error('FUNCTION', `Unknown export ${moduleId}.${name}`);
+    const schema = this.modules[moduleId]?.exports?.[name];
+    if (schema) assertSchema(args[0], schema.input_schema);
+    const result = this.callFunction(fn, args, env, moduleId);
+    if (schema) assertSchema(result, schema.output_schema);
+    return result;
+  }
+  callFunction(fn, args, env, moduleId) {
+    if (this.stack.includes(fn) || this.stack.length >= 24) this.error('CALL_LIMIT', 'Recursion or call depth exceeded', fn);
+    this.stack.push(fn);
+    const frame = new Map(fn.params.map((name, index) => [name, args[index] ?? null]));
+    frame.set('$module', moduleId);
+    try { return this.block(fn.body, [...env, frame])?.value ?? null; }
+    finally { this.stack.pop(); }
+  }
+  block(body, env) {
+    const local = [...env, new Map()];
+    for (const node of body) {
+      this.tick(node);
+      if (node.type === 'return') return { value: this.expr(node.value, local) };
+      if (node.type === 'declare') {
+        if (local.at(-1).has(node.name)) this.error('NAME', 'Duplicate variable', node);
+        local.at(-1).set(node.name, this.expr(node.value, local));
+        local.at(-1).set(`$mutable:${node.name}`, node.mutable);
+      } else if (node.type === 'assign') {
+        const frame = this.find(local, node.name);
+        if (!frame?.get(`$mutable:${node.name}`)) this.error('ASSIGN', 'Assignment requires local let variable', node);
+        frame.set(node.name, this.expr(node.value, local));
+      } else if (node.type === 'if') {
+        const result = this.block(truth(this.expr(node.condition, local)) ? node.then : node.else, local); if (result) return result;
+      } else if (node.type === 'for') {
+        const items = this.expr(node.items, local); if (!Array.isArray(items) || items.length > 1000) this.error('TYPE', 'for requires bounded array', node);
+        for (const item of items) { this.tick(node); const result = this.block(node.body, [...local, new Map([[node.name, item]])]); if (result) return result; }
+      } else if (node.type === 'expression') this.expr(node.value, local);
+      else if (node.type !== 'declare') this.error('AST', 'Unknown statement', node);
+    }
+    return null;
+  }
+  expr(node, env) {
+    this.tick(node);
+    switch (node?.type) {
+      case 'literal': return this.checkValue(node.value);
+      case 'ref': return node.path.slice(1).split('/').reduce((value, key) => this.member(value, key.replaceAll('~1', '/').replaceAll('~0', '~')), this.scope);
+      case 'identifier': {
+        const frame = this.find(env, node.name); if (!frame) this.error('NAME', `Unknown variable ${node.name}`, node); return frame.get(node.name);
+      }
+      case 'array': return this.checkValue(node.items.map(item => this.expr(item, env)));
+      case 'object': return this.checkValue(Object.fromEntries(node.entries.map(entry => [entry.key, this.expr(entry.value, env)])));
+      case 'member': return this.member(this.expr(node.target, env), this.expr(node.key, env));
+      case 'conditional': return this.expr(truth(this.expr(node.condition, env)) ? node.then : node.else, env);
+      case 'unary': {
+        const value = this.expr(node.value, env); if (node.op === '!') return !truth(value);
+        if (typeof value !== 'number') this.error('TYPE', 'Unary arithmetic requires number', node);
+        return node.op === '-' ? -value : value;
+      }
+      case 'binary': return this.binary(node, env);
+      case 'call': return this.call(node, env);
+      default: this.error('AST', `Unknown expression ${node?.type}`, node);
+    }
+  }
+  member(value, key) {
+    if (typeof key !== 'string' && !Number.isInteger(key)) this.error('TYPE', 'Invalid member key');
+    if (forbidden.has(String(key))) this.error('FORBIDDEN', 'Forbidden member');
+    if (key === 'length' && (typeof value === 'string' || Array.isArray(value))) return typeof value === 'string' ? [...value].length : value.length;
+    if (Array.isArray(value)) return Number.isInteger(key) && key >= 0 ? value[key] ?? null : null;
+    return value && typeof value === 'object' && own(value, key) ? value[key] : null;
+  }
+  binary(node, env) {
+    const a = this.expr(node.left, env);
+    if (node.op === '&&') return truth(a) ? this.expr(node.right, env) : a;
+    if (node.op === '||') return truth(a) ? a : this.expr(node.right, env);
+    if (node.op === '??') return a === null ? this.expr(node.right, env) : a;
+    const b = this.expr(node.right, env);
+    if (['==', '==='].includes(node.op)) return same(a, b);
+    if (['!=', '!=='].includes(node.op)) return !same(a, b);
+    if (typeof a !== typeof b || !['number', 'string'].includes(typeof a)) this.error('TYPE', 'Operands must have matching scalar types', node);
+    if (node.op === '<') return a < b; if (node.op === '>') return a > b;
+    if (node.op === '<=') return a <= b; if (node.op === '>=') return a >= b;
+    if (node.op === '+') return this.checkValue(a + b);
+    if (typeof a !== 'number') this.error('TYPE', 'Arithmetic requires numbers', node);
+    if ((node.op === '/' || node.op === '%') && b === 0) this.error('ARITHMETIC', 'Division by zero', node);
+    return this.checkValue(({ '-': () => a - b, '*': () => a * b, '/': () => a / b, '%': () => a % b })[node.op]?.());
+  }
+  call(node, env) {
+    const target = node.target;
+    if (target.type === 'identifier') {
+      const moduleId = this.find(env, '$module')?.get('$module');
+      const module = this.modules[moduleId]?.ast || this.modules[moduleId];
+      const fn = module?.functions?.find(value => value.name === target.name);
+      if (!fn) this.error('FUNCTION', 'Unknown function', node);
+      return this.callFunction(fn, node.args.map(arg => this.expr(arg, env)), env.slice(0, 1), moduleId);
+    }
+    if (target.type !== 'member' || target.key.type !== 'literal') this.error('FUNCTION', 'Only named calls allowed', node);
+    const name = target.key.value;
+    if (forbidden.has(name)) this.error('FORBIDDEN', 'Forbidden call', node);
+    const namespace = target.target.type === 'identifier' ? target.target.name : null;
+    if (own(this.modules, namespace)) return this.callModule(namespace, name, node.args.map(arg => this.expr(arg, env)), env.slice(0, 1));
+    if (['html', 'date', 'string', 'object', 'array', 'number'].includes(namespace)) {
+      return this.checkValue(this.builtin(namespace, name, node.args.map(arg => this.expr(arg, env))));
+    }
+    const receiver = this.expr(target.target, env);
+    if (Array.isArray(receiver) && ['map', 'filter', 'reduce'].includes(name)) {
+      const lambda = node.args[0]; if (lambda?.type !== 'lambda') this.error('FUNCTION', 'Collection operation requires local lambda', node);
+      const moduleId = this.find(env, '$module')?.get('$module');
+      if (name === 'reduce') {
+        if (node.args.length !== 2) this.error('TYPE', 'reduce requires initial value', node);
+        let value = this.expr(node.args[1], env);
+        for (let i = 0; i < receiver.length; i++) { this.tick(node); value = this.callFunction(lambda, [value, receiver[i], i], env, moduleId); }
+        return this.checkValue(value);
+      }
+      const result = [];
+      for (let i = 0; i < receiver.length; i++) {
+        this.tick(node); const value = this.callFunction(lambda, [receiver[i], i], env, moduleId);
+        if (name === 'map') result.push(value); else if (truth(value)) result.push(receiver[i]);
+      }
+      return this.checkValue(result);
+    }
+    return this.checkValue(this.builtin(Array.isArray(receiver) ? 'array' : typeof receiver, name, [receiver, ...node.args.map(arg => this.expr(arg, env))]));
+  }
+  builtin(namespace, name, args) {
+    const [value, a, b] = args;
+    if (namespace === 'html' && typeof value === 'string') {
+      const decode = text => text.replace(/&(#x[0-9a-f]+|#\d+|amp|lt|gt|quot|apos|nbsp);/gi, (whole, code) => {
+        const named = { amp: '&', lt: '<', gt: '>', quot: '"', apos: "'", nbsp: ' ' };
+        if (own(named, code.toLowerCase())) return named[code.toLowerCase()];
+        const n = code[1].toLowerCase() === 'x' ? parseInt(code.slice(2), 16) : parseInt(code.slice(1), 10);
+        return n > 0 && n <= 0x10ffff && !(n >= 0xd800 && n <= 0xdfff) ? String.fromCodePoint(n) : '\ufffd';
+      });
+      if (name === 'decodeEntities') return decode(value);
+      const text = decode(value.replace(/<(script|style)\b[^>]*>[\s\S]*?<\/\1\s*>/gi, '').replace(/<br\s*\/?\s*>|<\/(?:p|div|li)>/gi, '\n').replace(/<[^>]*>/g, '')).trim();
+      if (name === 'toText') return text; if (name === 'lines') return text.split(/\r?\n/).map(s => s.trim()).filter(Boolean);
+    }
+    if (namespace === 'string') {
+      if (name === 'from') return value === null ? '' : typeof value === 'object' ? JSON.stringify(value) : String(value);
+      if (typeof value !== 'string') this.error('TYPE', 'String operation requires string');
+      if (name === 'trim') return value.trim(); if (name === 'toLowerCase') return value.toLowerCase(); if (name === 'toUpperCase') return value.toUpperCase();
+      if (name === 'includes' && typeof a === 'string') return value.includes(a);
+      if (name === 'split' && typeof a === 'string') { if (a === '') return [...value]; return value.split(a); }
+      if (name === 'replaceAll' && typeof a === 'string' && typeof b === 'string' && a !== '') {
+        const count = value.split(a).length - 1;
+        if (size(value) + count * size(b) > 32768) this.error('MEMORY_LIMIT', 'Replacement exceeds string budget');
+        return value.split(a).join(b);
+      }
+      if (name === 'slice' && Number.isInteger(a) && (b === undefined || Number.isInteger(b))) return [...value].slice(a, b).join('');
+    }
+    if (namespace === 'array' && Array.isArray(value)) {
+      if (name === 'join' && (a === undefined || typeof a === 'string')) {
+        if (value.some(v => !['string', 'number', 'boolean'].includes(typeof v) && v !== null)) this.error('TYPE', 'join requires scalar values');
+        const separator = a ?? ',';
+        if (value.reduce((n, v) => n + size(String(v ?? '')), 0) + Math.max(0, value.length - 1) * size(separator) > 32768) this.error('MEMORY_LIMIT', 'join exceeds string budget');
+        return value.join(separator);
+      }
+      if (name === 'slice' && Number.isInteger(a) && (b === undefined || Number.isInteger(b))) return value.slice(a, b);
+      if (name === 'includes') return value.some(v => same(v, a));
+      if (name === 'concat' && Array.isArray(a) && value.length + a.length <= 1000) return [...value, ...a];
+    }
+    if (namespace === 'object' && value && typeof value === 'object' && !Array.isArray(value)) {
+      if (name === 'keys') return Object.keys(value).sort(); if (name === 'values') return Object.keys(value).sort().map(k => value[k]);
+      if (name === 'has' && typeof a === 'string' && !forbidden.has(a)) return own(value, a);
+    }
+    if (namespace === 'number') {
+      if (name === 'from' && typeof value === 'string' && value.trim() !== '') return Number(value);
+      if (typeof value === 'number') {
+        if (name === 'round') return Math.floor(value + 0.5); if (name === 'floor') return Math.floor(value); if (name === 'ceil') return Math.ceil(value); if (name === 'abs') return Math.abs(value);
+        if (name === 'min' && typeof a === 'number') return Math.min(value, a); if (name === 'max' && typeof a === 'number') return Math.max(value, a);
+      }
+    }
+    if (namespace === 'date' && typeof value === 'string' && /^\d{4}-\d\d-\d\d(?:T.*(?:Z|[+-]\d\d:\d\d))?$/.test(value)) {
+      const date = new Date(value); const calendar = new Date(value.slice(0, 10) + 'T00:00:00Z'); if (!Number.isFinite(date.valueOf()) || !Number.isFinite(calendar.valueOf()) || calendar.toISOString().slice(0, 10) !== value.slice(0, 10)) this.error('DATE', 'Invalid ISO date');
+      if (name === 'iso') return date.toISOString();
+      if (name === 'addDays' && Number.isInteger(a)) { date.setUTCDate(date.getUTCDate() + a); return date.toISOString().slice(0, 10); }
+      if (name === 'weekday') return date.getUTCDay();
+    }
+    this.error('FUNCTION', `Unsupported operation ${namespace}.${name}`);
+  }
+}

package/src/script-schema.js

@@ -0,0 +1,32 @@
+const fail = message => { const error = new Error(`Morit Script: ${message}`); error.code = "SCHEMA"; throw error; };
+export function validateValueSchema(schema, depth = 0) {
+  if (!schema || typeof schema !== 'object' || Array.isArray(schema) || depth > 20) fail('invalid value schema');
+  const allowed = new Set(['type','properties','required','items','additionalProperties','enum','minimum','maximum','minLength','maxLength','minItems','maxItems','description']);
+  if (Object.keys(schema).some(key => !allowed.has(key))) fail('unsupported value schema keyword');
+  if (!['null','boolean','number','integer','string','array','object'].includes(schema.type)) fail('value schema requires concrete type');
+  if (schema.properties) for (const child of Object.values(schema.properties)) validateValueSchema(child,depth+1);
+  if (schema.items) validateValueSchema(schema.items,depth+1);
+  if (schema.type === 'array' && !schema.items) fail('array schema requires items');
+  if (schema.required && (!Array.isArray(schema.required) || schema.required.some(key => !Object.hasOwn(schema.properties ?? {},key)))) fail('required keys must be declared');
+  if (schema.additionalProperties !== undefined && typeof schema.additionalProperties !== 'boolean') fail('additionalProperties must be boolean');
+  for (const key of ['minimum','maximum','minLength','maxLength','minItems','maxItems']) if (schema[key] !== undefined && (typeof schema[key] !== 'number' || !Number.isFinite(schema[key]))) fail('invalid schema bound');
+}
+
+export function assertSchema(value, schema, path = '$') {
+  const type = value === null ? 'null' : Array.isArray(value) ? 'array' : typeof value;
+  if (schema.type === 'integer' ? !Number.isInteger(value) : schema.type !== type) fail(`${path} must be ${schema.type}`);
+  if (schema.enum && !schema.enum.some(item => JSON.stringify(item) === JSON.stringify(value))) fail(`${path} is not an allowed value`);
+  if (typeof value === 'number' && ((schema.minimum !== undefined && value < schema.minimum) || (schema.maximum !== undefined && value > schema.maximum))) fail(`${path} is outside numeric bounds`);
+  if (typeof value === 'string' && ((schema.minLength !== undefined && [...value].length < schema.minLength) || (schema.maxLength !== undefined && [...value].length > schema.maxLength))) fail(`${path} is outside string bounds`);
+  if (Array.isArray(value)) {
+    if ((schema.minItems !== undefined && value.length < schema.minItems) || (schema.maxItems !== undefined && value.length > schema.maxItems)) fail(`${path} is outside array bounds`);
+    value.forEach((item,index) => assertSchema(item,schema.items,`${path}[${index}]`));
+  } else if (value && typeof value === 'object') {
+    for (const key of schema.required ?? []) if (!Object.hasOwn(value,key)) fail(`${path}.${key} is required`);
+    for (const [key,item] of Object.entries(value)) {
+      if (schema.properties?.[key]) assertSchema(item,schema.properties[key],`${path}.${key}`);
+      else if (schema.additionalProperties === false) fail(`${path}.${key} is undeclared`);
+    }
+  }
+  return value;
+}

package/src/script-spec.js

@@ -0,0 +1,113 @@
+// Generated by sync-script-contract.mjs; edit the backend canonical contract.
+export const SCRIPT_CONTRACT = Object.freeze({
+  "version": 1,
+  "limits": {
+    "modules": 16,
+    "module_bytes": 32768,
+    "source_bytes": 131072,
+    "ast_nodes": 2048,
+    "inline_bytes": 256,
+    "inline_nodes": 64,
+    "call_depth": 24,
+    "array_items": 1000,
+    "object_keys": 512,
+    "value_depth": 20,
+    "string_bytes": 32768,
+    "output_bytes": 262144
+  },
+  "profiles": {
+    "inline": {
+      "steps": 10000,
+      "memory": 2097152,
+      "timeout": 16
+    },
+    "ui": {
+      "steps": 50000,
+      "memory": 8388608,
+      "timeout": 100
+    },
+    "server": {
+      "steps": 100000,
+      "memory": 16777216,
+      "timeout": 250
+    }
+  },
+  "nodes": {
+    "module": [
+      "version",
+      "functions"
+    ],
+    "function": [
+      "name",
+      "params",
+      "body",
+      "exported"
+    ],
+    "literal": [
+      "value"
+    ],
+    "ref": [
+      "path"
+    ],
+    "identifier": [
+      "name"
+    ],
+    "array": [
+      "items"
+    ],
+    "object": [
+      "entries"
+    ],
+    "member": [
+      "target",
+      "key"
+    ],
+    "binary": [
+      "op",
+      "left",
+      "right"
+    ],
+    "unary": [
+      "op",
+      "value"
+    ],
+    "conditional": [
+      "condition",
+      "then",
+      "else"
+    ],
+    "call": [
+      "target",
+      "args"
+    ],
+    "lambda": [
+      "params",
+      "body"
+    ],
+    "declare": [
+      "name",
+      "mutable",
+      "value"
+    ],
+    "assign": [
+      "name",
+      "value"
+    ],
+    "return": [
+      "value"
+    ],
+    "expression": [
+      "value"
+    ],
+    "if": [
+      "condition",
+      "then",
+      "else"
+    ],
+    "for": [
+      "name",
+      "items",
+      "body"
+    ]
+  }
+});

package/src/ui-v3.js

@@ -0,0 +1,159 @@
+import {compileExpression} from './morit-script.js';
+import { canonicalJson } from './archive.js';
+import {compileScriptProject} from './script-project.js';
+import {dependencyOrder} from './script-data.js';
+import {validateValueSchema} from './script-schema.js';
+
+const fail = message => {throw new Error(`UI Runtime v3: ${message}`);};
+const identifier = value => typeof value === 'string' && /^[A-Za-z][A-Za-z0-9_]{0,63}$/.test(value);
+export function uiV3AllowedProps(type, runtimeContract = {}, baseRuntimeContract = {}) {
+  return new Set([
+    ...(baseRuntimeContract.component_props?.[type] ?? []),
+    ...(runtimeContract.node_props?.[type] ?? []),
+    ...(baseRuntimeContract.common_props_excluded_components?.includes(type) ? [] : baseRuntimeContract.common_props ?? []),
+    ...(runtimeContract.common_props ?? []),
+    ...(runtimeContract.responsive_props ?? []),
+  ]);
+}
+
+export function requiresMorit19(config, runtimeContract) {
+  if (config?.ui_schema !== 3) return false;
+  const commonProps = new Set(runtimeContract.common_props);
+  if ((config.data_sources ?? []).some(source => source.retry)) return true;
+  if (Object.values(config.components ?? {}).some(component => component.default_props || component.slots || component.events)) return true;
+  let required = false;
+  const visit = value => {
+    if (required || value == null) return;
+    if (typeof value === 'string') { if (value.includes('runtime.screen')) required = true; return; }
+    if (Array.isArray(value)) { value.forEach(visit); return; }
+    if (typeof value !== 'object') return;
+    if (value.type === 'slot' || value.action?.type === 'emit') { required = true; return; }
+    const props = value.props ?? {};
+    if (Object.keys(props).some(key => commonProps.has(key)) || props.events || props.curve || props.main_axis_alignment || props.cross_axis_alignment ||
+      (['date_field','time_field'].includes(value.type) && Object.keys(props).some(key => !['state_key','label'].includes(key))) ||
+      (value.type === 'skeleton' && Object.keys(props).length)) { required = true; return; }
+    Object.values(value).forEach(visit);
+  };
+  visit(config.view); visit(config.bottom_bar); visit(config.app_bar); visit(config.navigation);
+  return required;
+}
+export function compileUiV3(config, files, {capabilities = new Set(), routes = new Set(), nodeTypes = [], runtimeContract = {}, baseRuntimeContract = {}} = {}) {
+  const allowed = new Set(runtimeContract.config_fields ?? ['ui_schema','icon','description','placement','app_bar','navigation','theme','initial_state','computed_state','logic_modules','components','data_sources','view','bottom_bar','a2ui','compiled']);
+  if (Object.keys(config).some(key => !allowed.has(key))) fail('unknown configuration field');
+  const source = {...config}; delete source.compiled;
+  const compiled = compileScriptProject(JSON.parse(canonicalJson(source).toString()), files);
+  const state = config.initial_state ?? {}, computed = config.computed_state ?? {}, components = config.components ?? {};
+  if (Object.keys(state).length > 32 || Object.keys(computed).length > 32 || Object.keys(components).length > 32) fail('too many state keys or components');
+  for (const key of [...Object.keys(state), ...Object.keys(computed)]) if (!identifier(key)) fail('invalid state name');
+  for (const [name,definition] of Object.entries(components)) {
+    if (!identifier(name) || !definition || typeof definition !== 'object' || Array.isArray(definition)) fail('invalid component');
+    if (Object.keys(definition).some(k=>!(runtimeContract.component_fields??['props_schema','default_props','slots','events','initial_state','computed_state','view']).includes(k))) fail('unknown component field');
+    for (const slot of Object.values(definition.slots??{})) if(!slot||typeof slot!=='object'||Array.isArray(slot)||Object.keys(slot).some(k=>!(runtimeContract.component_slot_fields??['required']).includes(k))||('required' in slot&&typeof slot.required!=='boolean'))fail('invalid component slot');
+    if(definition.props_schema)validateValueSchema(definition.props_schema);
+    for (const event of Object.values(definition.events??{})) {if(!event||typeof event!=='object'||Array.isArray(event)||Object.keys(event).some(k=>!(runtimeContract.component_event_fields??['payload_schema']).includes(k))||!event.payload_schema)fail('invalid component event');validateValueSchema(event.payload_schema);}
+  }
+  function order(values) {
+    function dependencies(value) {
+      const result = new Set();
+      function ast(n) {
+        if (!n || typeof n !== 'object') return;
+        if (n.type === 'member' && n.target?.type === 'identifier' && n.target.name === 'computed') {
+          if (n.key?.type !== 'literal' || typeof n.key.value !== 'string') fail('computed dependency must use a static key');
+          result.add(n.key.value);
+        }
+        for (const child of Object.values(n)) ast(child);
+      }
+      function visit(v) {
+        if (typeof v === 'string') for (const m of v.matchAll(/\{\{=([\s\S]*?)\}\}/g)) ast(compileExpression(m[1].trim()));
+        else if (v && typeof v === 'object') for (const child of Object.values(v)) visit(child);
+      }
+      visit(value); return [...result];
+    }
+    const graph = Object.fromEntries(Object.entries(values).sort(([left], [right]) => left.localeCompare(right)).map(([key,value]) => [key,dependencies(value)]));
+    return dependencyOrder(graph);
+  }
+  const sources = config.data_sources ?? [];
+  if (!Array.isArray(sources) || sources.length > 8) fail('at most eight data sources allowed');
+  const ids = new Set(sources.map(s => s.id));
+  if (ids.size !== sources.length) fail('duplicate source id');
+  const graph = {};
+  for (const s of sources) {
+    if (!identifier(s.id) || !capabilities.has(s.capability)) fail('invalid source or capability');
+    if (Object.keys(s).some(k => !(runtimeContract.data_source_fields ?? ['id','capability','trigger','query','arguments','refresh_seconds','depends_on','when','result_mode','transform','refresh','cache']).includes(k))) fail('unknown source field');
+    if (s.trigger && !(runtimeContract.data_source_triggers ?? ['load','manual']).includes(s.trigger)) fail('invalid trigger');
+    if (s.result_mode && !(runtimeContract.result_modes ?? ['raw','envelope']).includes(s.result_mode)) fail('invalid result mode');
+    if (s.cache && (!(runtimeContract.cache_policies ?? ['none','memory','stale_while_revalidate']).includes(s.cache.policy) || !Number.isInteger(s.cache.ttl_seconds ?? 60) || (s.cache.ttl_seconds ?? 60) < 0 || (s.cache.ttl_seconds ?? 60) > 86400)) fail('invalid cache policy');
+    if (s.retry && (!Number.isInteger(s.retry.max_attempts??0)||(s.retry.max_attempts??0)<0||(s.retry.max_attempts??0)>2||!Number.isInteger(s.retry.delay_ms??200)||(s.retry.delay_ms??200)<200||(s.retry.delay_ms??200)>5000||(s.retry.on??[]).some(v=>!(runtimeContract.retry_events??['timeout','network','server']).includes(v)))) fail('invalid retry policy');
+    const interval = s.refresh?.interval_seconds ?? s.refresh_seconds;
+    if (interval !== undefined && (!Number.isInteger(interval) || interval < 30 || interval > 86400)) fail('invalid refresh interval');
+    if (s.refresh?.on?.some(v => !(runtimeContract.refresh_events ?? ['load','dependency_change','resume','manual']).includes(v))) fail('invalid refresh trigger');
+    const deps = s.depends_on ?? [];
+    if (!Array.isArray(deps) || deps.some(d => !ids.has(d) && !Object.hasOwn(state,d) && !Object.hasOwn(computed,d))) fail('unknown dependency');
+    graph[s.id] = deps.filter(d => ids.has(d));
+    const transforms=Array.isArray(s.transform) ? s.transform : s.transform ? [s.transform] : [];
+    if(transforms.length>(runtimeContract.max_transform_steps??8))fail('too many transforms');
+    for (const transform of transforms) {
+      if (!compiled.modules[transform.module]?.exports?.[transform.export]) fail('unknown transform export');
+    }
+  }
+  const validTypes = new Set([...nodeTypes,...(runtimeContract.nodes ?? ['component','repeat','if','data_state','date_field','time_field','skeleton','animated','flex'])]);
+  function action(a, stateKeys = new Set(Object.keys(state)), componentEvents = new Set()) {
+    if (!a || typeof a !== 'object' || Array.isArray(a)) fail('invalid action');
+    if (a.type === 'emit') {
+      if(!componentEvents.has(a.event)||a.payload!==undefined&&(!a.payload||typeof a.payload!=='object'||Array.isArray(a.payload)))fail('invalid component event');
+    } else if (a.type === 'flow') {
+      if (!Array.isArray(a.actions) || !a.actions.length || a.actions.length > 8) fail('invalid action flow');
+      for (const child of a.actions) action(child, stateKeys, componentEvents);
+    } else if (a.type === 'invoke' && !capabilities.has(a.capability)) fail('unknown action capability');
+    else if (a.type === 'navigate' && !routes.has(a.target)) fail('unknown action route');
+    else if (a.type === 'refresh' && !ids.has(a.source)) fail('unknown action source');
+    else if (a.type === 'set_state' && (!a.values || Object.keys(a.values).some(key => !(a.scope === 'root' ? Object.hasOwn(state,key) : stateKeys.has(key))))) fail('unknown action state');
+    else if (!['invoke','navigate','refresh','set_state','back','flow'].includes(a.type)) fail('unknown action type');
+  }
+  let count = 0;
+  function node(n, depth = 0, componentStack = [], scroll = false, stateKeys = new Set(Object.keys(state)), componentEvents = new Set(), componentSlots = new Set()) {
+    if (!n || typeof n !== 'object' || Array.isArray(n) || ++count > 320 || depth > 16) fail('invalid or excessive node tree');
+    if (!validTypes.has(n.type)) fail(`unknown node ${n.type}`);
+    if (Object.keys(n).some(k => !(runtimeContract.node_fields ?? ['id','type','props','children','action','visible_when','slots']).includes(k))) fail('unknown node field');
+    const p=n.props??{};
+    if (!p || typeof p!=='object' || Array.isArray(p)) fail('invalid props');
+    const allowedProps=uiV3AllowedProps(n.type,runtimeContract,baseRuntimeContract);
+    if(allowedProps.size&&Object.keys(p).some(k=>!allowedProps.has(k)))fail(`unknown ${n.type} prop`);
+    for (const k of ['width','height','min_width','max_width','min_height','max_height','gap','spacing','padding','margin','basis']) {
+      const v=p[k]; for (const x of Array.isArray(v)?v:v && typeof v==='object'?Object.values(v):[v]) if (typeof x==='number' && (!Number.isFinite(x)||x<0||x>4096)) fail(`invalid ${k}`);
+    }
+    for(const axis of ['width','height']) if(typeof p[`min_${axis}`]==='number'&&typeof p[`max_${axis}`]==='number'&&p[`min_${axis}`]>p[`max_${axis}`]) fail(`conflicting ${axis} bounds`);
+    if(n.type==='scroll'&&scroll) fail('nested scroll is not allowed');
+    if(n.type==='repeat'&&(!identifier(p.as)||!identifier(p.index_as??'index')||p.items===undefined||p.key===undefined)) fail('repeat requires items, alias and stable key');
+    if(n.type==='data_state'&&!ids.has(p.source)) fail('unknown data_state source');
+    if(['date_field','time_field'].includes(n.type)){
+      const spec=runtimeContract.picker_specs?.[n.type];
+      if(!spec)fail('missing Material picker contract');
+      const pattern=new RegExp(spec.value_pattern);
+      const modes=spec.entry_modes;
+      if(!identifier(p.state_key)||!stateKeys.has(p.state_key)||(p.label!==undefined&&typeof p.label!=='string')||p.minimum!==undefined&&!pattern.test(p.minimum)||p.maximum!==undefined&&!pattern.test(p.maximum)||p.minimum&&p.maximum&&p.minimum>p.maximum||p.initial_entry_mode!==undefined&&!modes.includes(p.initial_entry_mode))fail('invalid Material picker');
+    }
+    if(n.type==='component') {
+      const def=components[p.component]; if(!def||componentStack.includes(p.component)) fail('unknown or recursive component');
+      const declaredSlots=def.slots??{}, supplied=n.slots??{};
+      if(Object.keys(supplied).some(name=>!Object.hasOwn(declaredSlots,name))||Object.entries(declaredSlots).some(([name,spec])=>spec.required&&!Object.hasOwn(supplied,name)))fail('invalid component slots');
+      const handlers=p.events??{};if(!handlers||typeof handlers!=='object'||Array.isArray(handlers)||Object.keys(handlers).some(name=>!Object.hasOwn(def.events??{},name)))fail('invalid component handlers');
+      for(const handler of Object.values(handlers))action(handler,stateKeys);
+      node(def.view,depth+1,[...componentStack,p.component],scroll,new Set(Object.keys(def.initial_state??{})),new Set(Object.keys(def.events??{})),new Set(Object.keys(def.slots??{})));
+    }
+    if(n.type==='slot'&&(!identifier(p.name)||!componentSlots.has(p.name)))fail('invalid component slot');
+    if(n.type==='animated' && ((p.duration_ms??200)>1000||!(runtimeContract.animation_transitions??[]).includes(p.transition??'fade')||!(runtimeContract.animation_curves??[]).includes(p.curve??'standard'))) fail('invalid animation');
+    if(n.type==='skeleton'&&!(runtimeContract.skeleton_variants??[]).includes(p.variant??'line'))fail('invalid skeleton');
+    if(n.action)action(n.action,stateKeys,componentEvents);
+    if((n.children??[]).length>32) fail('too many static children');
+    for(const c of n.children??[]) node(c,depth+1,componentStack,scroll||n.type==='scroll',stateKeys,componentEvents,componentSlots);
+    for(const slot of Object.values(n.slots??{})) for(const child of Array.isArray(slot)?slot:[slot]) node(child,depth+1,componentStack,scroll||n.type==='scroll',stateKeys,componentEvents,componentSlots);
+  }
+  node(config.view); if(config.bottom_bar)node(config.bottom_bar);
+  for(const item of [config.app_bar?.leading,...(config.app_bar?.actions??[]),...(config.navigation?.items??[])])if(item?.action)action(item.action);
+  for(const component of Object.values(components))order(component.computed_state??{});
+  const bundle={version:1, modules:compiled.modules, expressions:compiled.expressions, computed_order:order(computed), source_order:dependencyOrder(graph)};
+  if(config.compiled&&!canonicalJson(config.compiled).equals(canonicalJson(bundle)))fail('compiled bundle differs from source; rebuild the package');
+  config.compiled=bundle;
+  return compiled;
+}