@opengeni/artifact-tool 0.2.2

package/dist/chunk-U5G2BKM2.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/runtime-development.ts","../src/runtime-receipt.ts"],"sourcesContent":["import { createHash } from \"node:crypto\";\nimport { open, realpath, stat } from \"node:fs/promises\";\nimport { isAbsolute, relative, resolve } from \"node:path\";\nimport { pathToFileURL } from \"node:url\";\n\nimport {\n  canonicalArtifactKernelBuildReceiptBytes,\n  validateArtifactKernelBuildReceipt,\n  type ArtifactKernelBuildReceipt,\n} from \"./runtime-receipt\";\nimport {\n  ARTIFACT_RUNTIME_ENVIRONMENT,\n  ArtifactRuntimeError,\n  loadArtifactKernelRuntime,\n  validateArtifactKernelPackageManifest,\n  type ArtifactKernelPackageManifest,\n  type ArtifactKernelRuntime,\n  type ArtifactRuntimeKernelDependencies,\n  type NativeArtifactRuntimeTarget,\n} from \"./runtime\";\nimport {\n  doctorVerifiedArtifactRuntime,\n  loadVerifiedArtifactKernelRuntime,\n  probeVerifiedArtifactSkillFacade,\n  resolveCurrentArtifactRuntimeTarget,\n  runArtifactRuntimeCli,\n  type VerifiedArtifactRuntimeLocation,\n} from \"./runtime-cli\";\n\nexport const DEVELOPMENT_ARTIFACT_RUNTIME_ENVIRONMENT = {\n  manifest: \"OPENGENI_ARTIFACT_DEVELOPMENT_RUNTIME_MANIFEST\",\n} as const;\n\nconst MAX_MANIFEST_BYTES = 256 * 1024;\nconst MAX_IDENTITY_BYTES = 64 * 1024;\nconst MAX_RECEIPT_BYTES = 256 * 1024;\nconst MAX_JAVASCRIPT_BYTES = 32 * 1024 * 1024;\nconst MAX_KERNEL_ASSET_BYTES = 512 * 1024 * 1024;\nconst MAX_MATERIALIZER_EXECUTABLE_BYTES = 512 * 1024 * 1024;\n\ntype RuntimeEnvironment = Readonly<Record<string, string | undefined>>;\ntype FileDescriptor = Readonly<{\n  path: string;\n  bytes: number;\n  sha256: `sha256:${string}`;\n}>;\n\nexport type DevelopmentArtifactRuntimeManifest = Readonly<{\n  schemaVersion: 1;\n  mode: \"development-current-host\";\n  target: NativeArtifactRuntimeTarget;\n  sourceFingerprint: `sha256:${string}`;\n  artifactTool: Readonly<{\n    packageName: \"@opengeni/artifact-tool\";\n    packageVersion: string;\n  }>;\n  artifactToolIdentity: FileDescriptor;\n  receipt: FileDescriptor;\n  skillFacadeEntrypoint: FileDescriptor;\n  materializerExecutable: FileDescriptor;\n  kernelPackageRoot: string;\n  kernel: ArtifactKernelPackageManifest;\n}>;\n\nexport type VerifiedDevelopmentArtifactRuntimeLocation = Readonly<{\n  schemaVersion: 1;\n  mode: \"development-current-host\";\n  target: NativeArtifactRuntimeTarget;\n  manifestPath: string;\n  receiptPath: string;\n  artifactTool: DevelopmentArtifactRuntimeManifest[\"artifactTool\"];\n  skillFacadeEntrypoint: string;\n  materializerExecutable: string;\n  kernel: Readonly<{\n    packageName: string;\n    packageVersion: string;\n    entrypoint: string;\n    asset: string;\n    supportFiles: readonly string[];\n    buildIdentity: string;\n  }>;\n}>;\n\nexport type ConfiguredArtifactRuntimeLocation =\n  | VerifiedArtifactRuntimeLocation\n  | VerifiedDevelopmentArtifactRuntimeLocation;\n\nexport type VerifiedConfiguredArtifactKernelRuntime = Readonly<{\n  location: ConfiguredArtifactRuntimeLocation;\n  runtime: ArtifactKernelRuntime;\n}>;\n\n/** True when any production/development runtime authority was explicitly supplied. */\nexport function isArtifactRuntimeConfigured(\n  environment: RuntimeEnvironment = process.env,\n): boolean {\n  return [\n    ARTIFACT_RUNTIME_ENVIRONMENT.manifest,\n    ARTIFACT_RUNTIME_ENVIRONMENT.toolEntrypoint,\n    DEVELOPMENT_ARTIFACT_RUNTIME_ENVIRONMENT.manifest,\n  ].some((name) => typeof environment[name] === \"string\");\n}\n\nexport function validateDevelopmentArtifactRuntimeManifest(\n  value: unknown,\n  expectedTarget?: NativeArtifactRuntimeTarget,\n): DevelopmentArtifactRuntimeManifest {\n  const record = exactRecord(\n    value,\n    [\n      \"schemaVersion\",\n      \"mode\",\n      \"target\",\n      \"sourceFingerprint\",\n      \"artifactTool\",\n      \"artifactToolIdentity\",\n      \"receipt\",\n      \"skillFacadeEntrypoint\",\n      \"materializerExecutable\",\n      \"kernelPackageRoot\",\n      \"kernel\",\n    ],\n    \"development runtime manifest\",\n  );\n  if (record.schemaVersion !== 1 || record.mode !== \"development-current-host\") {\n    invalid(\"development runtime schema/mode is invalid\");\n  }\n  if (record.target === \"wasm-web\") invalid(\"development server runtime must be native\");\n  const kernel = validateArtifactKernelPackageManifest(record.kernel);\n  if (kernel.kind !== \"native\" || kernel.target !== record.target) {\n    invalid(\"development runtime target differs from its native kernel\");\n  }\n  if (expectedTarget && kernel.target !== expectedTarget) {\n    invalid(`development runtime target ${kernel.target} does not match ${expectedTarget}`);\n  }\n  const artifactTool = exactRecord(\n    record.artifactTool,\n    [\"packageName\", \"packageVersion\"],\n    \"development artifact-tool identity\",\n  );\n  if (\n    artifactTool.packageName !== \"@opengeni/artifact-tool\" ||\n    artifactTool.packageVersion !== kernel.artifactToolVersion\n  ) {\n    invalid(\"development artifact-tool identity differs from its kernel\");\n  }\n  return Object.freeze({\n    schemaVersion: 1,\n    mode: \"development-current-host\",\n    target: kernel.target as NativeArtifactRuntimeTarget,\n    sourceFingerprint: digest(record.sourceFingerprint, \"development source fingerprint\"),\n    artifactTool: Object.freeze({\n      packageName: \"@opengeni/artifact-tool\",\n      packageVersion: kernel.artifactToolVersion,\n    }),\n    artifactToolIdentity: fileDescriptor(\n      record.artifactToolIdentity,\n      \"development artifact-tool identity file\",\n    ),\n    receipt: fileDescriptor(record.receipt, \"development build receipt\"),\n    skillFacadeEntrypoint: fileDescriptor(record.skillFacadeEntrypoint, \"development skill facade\"),\n    materializerExecutable: fileDescriptor(\n      record.materializerExecutable,\n      \"development materializer executable\",\n    ),\n    kernelPackageRoot: safeRelativePath(record.kernelPackageRoot, \"development kernel root\"),\n    kernel,\n  });\n}\n\nexport function canonicalDevelopmentArtifactRuntimeManifestBytes(value: unknown): Uint8Array {\n  const manifest = validateDevelopmentArtifactRuntimeManifest(value);\n  return new TextEncoder().encode(`${JSON.stringify(manifest, null, 2)}\\n`);\n}\n\nexport function canonicalDevelopmentArtifactToolIdentityBytes(\n  artifactTool: DevelopmentArtifactRuntimeManifest[\"artifactTool\"],\n): Uint8Array {\n  if (\n    artifactTool.packageName !== \"@opengeni/artifact-tool\" ||\n    !stableVersion(artifactTool.packageVersion)\n  ) {\n    invalid(\"development artifact-tool identity is invalid\");\n  }\n  return new TextEncoder().encode(`${JSON.stringify(artifactTool, null, 2)}\\n`);\n}\n\nexport async function locateVerifiedDevelopmentArtifactRuntime(\n  options: {\n    environment?: RuntimeEnvironment;\n    expectedTarget?: NativeArtifactRuntimeTarget;\n  } = {},\n): Promise<VerifiedDevelopmentArtifactRuntimeLocation> {\n  const environment = options.environment ?? process.env;\n  assertDevelopmentEnvironment(environment);\n  const expectedTarget = options.expectedTarget ?? currentNativeTarget();\n  const manifestInput = requiredPath(\n    environment,\n    DEVELOPMENT_ARTIFACT_RUNTIME_ENVIRONMENT.manifest,\n  );\n  const facadeInput = requiredPath(environment, ARTIFACT_RUNTIME_ENVIRONMENT.toolEntrypoint);\n  const manifestPath = await canonicalFile(manifestInput, \"development runtime manifest\");\n  const manifestBytes = await readBoundedFile(\n    manifestPath,\n    MAX_MANIFEST_BYTES,\n    \"development runtime manifest\",\n  );\n  const manifest = validateDevelopmentArtifactRuntimeManifest(\n    parseJson(manifestBytes, \"development runtime manifest\"),\n    expectedTarget,\n  );\n  if (!sameBytes(manifestBytes, canonicalDevelopmentArtifactRuntimeManifestBytes(manifest))) {\n    integrity(\"Development runtime manifest is not canonical\");\n  }\n  const root = await realpath(resolve(manifestPath, \"..\"));\n  const identityPath = await confinedFile(\n    root,\n    manifest.artifactToolIdentity.path,\n    \"artifact-tool identity\",\n  );\n  const receiptPath = await confinedFile(root, manifest.receipt.path, \"kernel build receipt\");\n  const skillFacadeEntrypoint = await confinedFile(\n    root,\n    manifest.skillFacadeEntrypoint.path,\n    \"development skill facade\",\n  );\n  const materializerExecutable = await confinedFile(\n    root,\n    manifest.materializerExecutable.path,\n    \"development materializer executable\",\n  );\n  const configuredFacade = await canonicalFile(facadeInput, \"configured development skill facade\");\n  if (configuredFacade !== skillFacadeEntrypoint) {\n    integrity(\n      `${ARTIFACT_RUNTIME_ENVIRONMENT.toolEntrypoint} differs from the development manifest`,\n    );\n  }\n  const kernelRoot = await confinedDirectory(\n    root,\n    manifest.kernelPackageRoot,\n    \"kernel package root\",\n  );\n  const kernelEntrypoint = await confinedFile(\n    kernelRoot,\n    manifest.kernel.entrypoint.path,\n    \"kernel entrypoint\",\n  );\n  const kernelAsset = await confinedFile(kernelRoot, manifest.kernel.asset.path, \"kernel asset\");\n  const kernelSupportFiles = await Promise.all(\n    manifest.kernel.supportFiles.map((file, index) =>\n      confinedFile(kernelRoot, file.path, `kernel support file ${index}`),\n    ),\n  );\n\n  const identityBytes = await readAndVerify(\n    identityPath,\n    manifest.artifactToolIdentity,\n    MAX_IDENTITY_BYTES,\n    \"artifact-tool identity\",\n  );\n  if (\n    !sameBytes(identityBytes, canonicalDevelopmentArtifactToolIdentityBytes(manifest.artifactTool))\n  ) {\n    integrity(\"Development artifact-tool identity bytes differ from the manifest\");\n  }\n  const receiptBytes = await readAndVerify(\n    receiptPath,\n    manifest.receipt,\n    MAX_RECEIPT_BYTES,\n    \"kernel build receipt\",\n  );\n  const receipt = validateArtifactKernelBuildReceipt(\n    parseJson(receiptBytes, \"kernel build receipt\"),\n    manifest.target,\n  );\n  if (!sameBytes(receiptBytes, canonicalArtifactKernelBuildReceiptBytes(receipt))) {\n    integrity(\"Development kernel receipt is not canonical\");\n  }\n  assertReceiptMatchesKernel(receipt, manifest.kernel);\n  await verifyFile(\n    skillFacadeEntrypoint,\n    manifest.skillFacadeEntrypoint,\n    MAX_JAVASCRIPT_BYTES,\n    \"development skill facade\",\n  );\n  await verifyFile(\n    materializerExecutable,\n    manifest.materializerExecutable,\n    MAX_MATERIALIZER_EXECUTABLE_BYTES,\n    \"development materializer executable\",\n  );\n  await verifyFile(\n    kernelEntrypoint,\n    manifest.kernel.entrypoint,\n    MAX_JAVASCRIPT_BYTES,\n    \"kernel entrypoint\",\n  );\n  await verifyFile(kernelAsset, manifest.kernel.asset, MAX_KERNEL_ASSET_BYTES, \"kernel asset\");\n  for (const [index, path] of kernelSupportFiles.entries()) {\n    await verifyFile(\n      path,\n      manifest.kernel.supportFiles[index]!,\n      MAX_JAVASCRIPT_BYTES,\n      `kernel support file ${index}`,\n    );\n  }\n  return Object.freeze({\n    schemaVersion: 1,\n    mode: \"development-current-host\",\n    target: manifest.target,\n    manifestPath,\n    receiptPath,\n    artifactTool: Object.freeze({ ...manifest.artifactTool }),\n    skillFacadeEntrypoint,\n    materializerExecutable,\n    kernel: Object.freeze({\n      packageName: manifest.kernel.packageName,\n      packageVersion: manifest.kernel.packageVersion,\n      entrypoint: kernelEntrypoint,\n      asset: kernelAsset,\n      supportFiles: Object.freeze(kernelSupportFiles),\n      buildIdentity: manifest.kernel.buildIdentity,\n    }),\n  });\n}\n\nexport async function doctorVerifiedDevelopmentArtifactRuntime(\n  options: {\n    environment?: RuntimeEnvironment;\n    expectedTarget?: NativeArtifactRuntimeTarget;\n    importer?: (specifier: string) => unknown | Promise<unknown>;\n    probe?: (module: Record<string, unknown>) => void | Promise<void>;\n  } = {},\n): Promise<VerifiedDevelopmentArtifactRuntimeLocation> {\n  const location = await locateVerifiedDevelopmentArtifactRuntime(options);\n  let imported: unknown;\n  try {\n    imported = await (options.importer ?? defaultImporter)(\n      pathToFileURL(location.skillFacadeEntrypoint).href,\n    );\n  } catch (cause) {\n    throw new ArtifactRuntimeError(\n      \"ARTIFACT_RUNTIME_UNAVAILABLE\",\n      \"Verified development skill facade could not be evaluated\",\n      { cause },\n    );\n  }\n  if (!isRecord(imported)) incompatible(\"development skill facade returned an invalid module\");\n  if (options.probe) await options.probe(imported);\n  else probeVerifiedArtifactSkillFacade(imported, location);\n  return location;\n}\n\nexport async function loadVerifiedDevelopmentArtifactKernelRuntime(\n  options: {\n    environment?: RuntimeEnvironment;\n    expectedTarget?: NativeArtifactRuntimeTarget;\n  } = {},\n): Promise<VerifiedConfiguredArtifactKernelRuntime> {\n  const environment = options.environment ?? process.env;\n  const expectedTarget = options.expectedTarget ?? currentNativeTarget();\n  const before = await locateVerifiedDevelopmentArtifactRuntime({ environment, expectedTarget });\n  const manifest = validateDevelopmentArtifactRuntimeManifest(\n    parseJson(\n      await readBoundedFile(\n        before.manifestPath,\n        MAX_MANIFEST_BYTES,\n        \"development runtime manifest\",\n      ),\n      \"development runtime manifest\",\n    ),\n    expectedTarget,\n  );\n  const kernelRoot = pathToFileURL(\n    `${resolve(before.manifestPath, \"..\", manifest.kernelPackageRoot)}/`,\n  );\n  const dependencies: ArtifactRuntimeKernelDependencies = {\n    target: {\n      target: manifest.target,\n      kind: \"native\",\n      packageName: manifest.kernel.packageName,\n      platform: manifest.target.startsWith(\"darwin-\")\n        ? \"darwin\"\n        : manifest.target.startsWith(\"linux-\")\n          ? \"linux\"\n          : \"win32\",\n      arch: manifest.target.includes(\"arm64\") ? \"arm64\" : \"x64\",\n      ...(manifest.target.includes(\"-gnu\")\n        ? { libc: \"gnu\" as const }\n        : manifest.target.includes(\"-musl\")\n          ? { libc: \"musl\" as const }\n          : {}),\n    },\n    kernelEntrypoint: new URL(manifest.kernel.entrypoint.path, kernelRoot),\n    manifest: {\n      kernel: manifest.kernel,\n    },\n  };\n  const runtime = await loadArtifactKernelRuntime(dependencies);\n  const after = await locateVerifiedDevelopmentArtifactRuntime({ environment, expectedTarget });\n  if (\n    !sameJson(before, after) ||\n    runtime.kind !== \"native\" ||\n    runtime.target !== after.target ||\n    runtime.buildIdentity !== after.kernel.buildIdentity\n  ) {\n    integrity(\"Loaded development kernel differs from its verified installation\");\n  }\n  return Object.freeze({ location: after, runtime });\n}\n\nexport async function doctorConfiguredArtifactRuntime(\n  environment: RuntimeEnvironment = process.env,\n): Promise<ConfiguredArtifactRuntimeLocation> {\n  return usesDevelopmentRuntime(environment)\n    ? await doctorVerifiedDevelopmentArtifactRuntime({ environment })\n    : await doctorVerifiedArtifactRuntime({ environment });\n}\n\nexport async function loadConfiguredArtifactKernelRuntime(\n  environment: RuntimeEnvironment = process.env,\n): Promise<VerifiedConfiguredArtifactKernelRuntime> {\n  return usesDevelopmentRuntime(environment)\n    ? await loadVerifiedDevelopmentArtifactKernelRuntime({ environment })\n    : await loadVerifiedArtifactKernelRuntime({ environment });\n}\n\nexport async function runConfiguredArtifactRuntimeCli(\n  args: readonly string[],\n  environment: RuntimeEnvironment = process.env,\n): Promise<string> {\n  if (!usesDevelopmentRuntime(environment)) return await runArtifactRuntimeCli(args, environment);\n  const [command, format, ...rest] = args;\n  if ((command !== \"locate\" && command !== \"doctor\") || format !== \"--json\" || rest.length > 0) {\n    invalid(\"Usage: opengeni-artifact-runtime <locate|doctor> --json\");\n  }\n  const location =\n    command === \"doctor\"\n      ? await doctorVerifiedDevelopmentArtifactRuntime({ environment })\n      : await locateVerifiedDevelopmentArtifactRuntime({ environment });\n  return `${JSON.stringify(location)}\\n`;\n}\n\nfunction usesDevelopmentRuntime(environment: RuntimeEnvironment): boolean {\n  return Boolean(environment[DEVELOPMENT_ARTIFACT_RUNTIME_ENVIRONMENT.manifest]);\n}\n\nfunction assertDevelopmentEnvironment(environment: RuntimeEnvironment): void {\n  if (environment.NODE_ENV === \"production\") {\n    throw new ArtifactRuntimeError(\n      \"ARTIFACT_RUNTIME_UNAVAILABLE\",\n      \"Development artifact runtime is forbidden when NODE_ENV=production\",\n    );\n  }\n  if (environment[ARTIFACT_RUNTIME_ENVIRONMENT.manifest]) {\n    invalid(\"Production and development artifact runtime manifests cannot both be configured\");\n  }\n}\n\nfunction currentNativeTarget(): NativeArtifactRuntimeTarget {\n  const target = resolveCurrentArtifactRuntimeTarget();\n  if (target === \"wasm-web\") {\n    throw new ArtifactRuntimeError(\n      \"ARTIFACT_RUNTIME_UNSUPPORTED_TARGET\",\n      \"Development server runtime requires a native host\",\n    );\n  }\n  return target;\n}\n\nfunction assertReceiptMatchesKernel(\n  receipt: ArtifactKernelBuildReceipt,\n  kernel: ArtifactKernelPackageManifest,\n): void {\n  const runtimeFiles = [kernel.asset, ...kernel.supportFiles].sort((left, right) =>\n    left.path < right.path ? -1 : left.path > right.path ? 1 : 0,\n  );\n  if (\n    receipt.buildIdentity !== kernel.buildIdentity ||\n    !sameJson(receipt.runtimeFiles, runtimeFiles)\n  ) {\n    integrity(\"Development build receipt differs from its kernel manifest\");\n  }\n}\n\nasync function confinedFile(root: string, path: string, name: string): Promise<string> {\n  return await confined(root, path, name, \"file\");\n}\n\nasync function confinedDirectory(root: string, path: string, name: string): Promise<string> {\n  return await confined(root, path, name, \"directory\");\n}\n\nasync function confined(\n  root: string,\n  path: string,\n  name: string,\n  kind: \"file\" | \"directory\",\n): Promise<string> {\n  const candidate = await realpath(resolve(root, path)).catch((cause) => {\n    throw new ArtifactRuntimeError(\"ARTIFACT_RUNTIME_UNAVAILABLE\", `${name} is unavailable`, {\n      cause,\n    });\n  });\n  const fromRoot = relative(root, candidate);\n  if (\n    fromRoot === \"..\" ||\n    fromRoot.startsWith(`..${process.platform === \"win32\" ? \"\\\\\" : \"/\"}`) ||\n    isAbsolute(fromRoot)\n  ) {\n    invalid(`${name} resolves outside the development installation`);\n  }\n  const metadata = await stat(candidate);\n  if (\n    (kind === \"file\" && !metadata.isFile()) ||\n    (kind === \"directory\" && !metadata.isDirectory())\n  ) {\n    throw new ArtifactRuntimeError(\"ARTIFACT_RUNTIME_UNAVAILABLE\", `${name} is not a ${kind}`);\n  }\n  return candidate;\n}\n\nasync function canonicalFile(input: string, name: string): Promise<string> {\n  if (!isAbsolute(input)) invalid(`${name} path must be absolute`);\n  try {\n    const path = await realpath(input);\n    if (!(await stat(path)).isFile()) throw new Error(\"not a file\");\n    return path;\n  } catch (cause) {\n    throw new ArtifactRuntimeError(\"ARTIFACT_RUNTIME_UNAVAILABLE\", `${name} is unavailable`, {\n      cause,\n    });\n  }\n}\n\nasync function readAndVerify(\n  path: string,\n  expected: FileDescriptor,\n  maximumBytes: number,\n  name: string,\n): Promise<Uint8Array> {\n  const bytes = await readBoundedFile(path, maximumBytes, name);\n  if (bytes.byteLength !== expected.bytes || sha256(bytes) !== expected.sha256) {\n    integrity(`${name} differs from the development manifest`);\n  }\n  return bytes;\n}\n\nasync function verifyFile(\n  path: string,\n  expected: FileDescriptor,\n  maximumBytes: number,\n  name: string,\n): Promise<void> {\n  await readAndVerify(path, expected, maximumBytes, name);\n}\n\nasync function readBoundedFile(\n  path: string,\n  maximumBytes: number,\n  name: string,\n): Promise<Uint8Array> {\n  let handle;\n  try {\n    handle = await open(path, \"r\");\n    const before = await handle.stat();\n    if (!before.isFile() || before.size <= 0 || before.size > maximumBytes) {\n      integrity(`${name} size is invalid`);\n    }\n    const bytes = new Uint8Array(await handle.readFile());\n    const after = await handle.stat();\n    if (after.size !== before.size || bytes.byteLength !== before.size) {\n      integrity(`${name} changed while reading`);\n    }\n    return bytes;\n  } catch (cause) {\n    if (cause instanceof ArtifactRuntimeError) throw cause;\n    throw new ArtifactRuntimeError(\"ARTIFACT_RUNTIME_UNAVAILABLE\", `Could not read ${name}`, {\n      cause,\n    });\n  } finally {\n    await handle?.close();\n  }\n}\n\nfunction fileDescriptor(value: unknown, name: string): FileDescriptor {\n  const record = exactRecord(value, [\"path\", \"bytes\", \"sha256\"], name);\n  if (!Number.isSafeInteger(record.bytes) || (record.bytes as number) <= 0) {\n    invalid(`${name} byte size is invalid`);\n  }\n  return Object.freeze({\n    path: safeRelativePath(record.path, `${name} path`),\n    bytes: record.bytes as number,\n    sha256: digest(record.sha256, `${name} digest`),\n  });\n}\n\nfunction safeRelativePath(value: unknown, name: string): string {\n  if (\n    typeof value !== \"string\" ||\n    value.length === 0 ||\n    value.length > 1024 ||\n    value.startsWith(\"/\") ||\n    value.startsWith(\"\\\\\") ||\n    value.includes(\"\\\\\") ||\n    value.split(\"/\").some((part) => part === \"\" || part === \".\" || part === \"..\") ||\n    /[%?#\\0]/u.test(value)\n  ) {\n    invalid(`${name} must be a normalized relative path`);\n  }\n  return value;\n}\n\nfunction digest(value: unknown, name: string): `sha256:${string}` {\n  if (typeof value !== \"string\" || !/^sha256:[0-9a-f]{64}$/u.test(value)) {\n    invalid(`${name} is invalid`);\n  }\n  return value as `sha256:${string}`;\n}\n\nfunction stableVersion(value: unknown): value is string {\n  return (\n    typeof value === \"string\" && /^(?:0|[1-9]\\d*)\\.(?:0|[1-9]\\d*)\\.(?:0|[1-9]\\d*)$/u.test(value)\n  );\n}\n\nfunction requiredPath(environment: RuntimeEnvironment, name: string): string {\n  const value = environment[name];\n  if (!value) {\n    throw new ArtifactRuntimeError(\"ARTIFACT_RUNTIME_UNAVAILABLE\", `${name} is required`);\n  }\n  return value;\n}\n\nfunction parseJson(bytes: Uint8Array, name: string): unknown {\n  try {\n    return JSON.parse(new TextDecoder(\"utf-8\", { fatal: true }).decode(bytes));\n  } catch (cause) {\n    throw new ArtifactRuntimeError(\n      \"ARTIFACT_RUNTIME_MANIFEST_INVALID\",\n      `${name} is not strict UTF-8 JSON`,\n      { cause },\n    );\n  }\n}\n\nfunction exactRecord(\n  value: unknown,\n  keys: readonly string[],\n  name: string,\n): Record<string, unknown> {\n  if (!isRecord(value)) invalid(`${name} is invalid`);\n  if (JSON.stringify(Object.keys(value).sort()) !== JSON.stringify([...keys].sort())) {\n    invalid(`${name} has unexpected fields`);\n  }\n  return value;\n}\n\nfunction isRecord(value: unknown): value is Record<string, unknown> {\n  return typeof value === \"object\" && value !== null && !Array.isArray(value);\n}\n\nfunction sha256(value: Uint8Array): `sha256:${string}` {\n  return `sha256:${createHash(\"sha256\").update(value).digest(\"hex\")}`;\n}\n\nfunction sameJson(left: unknown, right: unknown): boolean {\n  return JSON.stringify(left) === JSON.stringify(right);\n}\n\nfunction sameBytes(left: Uint8Array, right: Uint8Array): boolean {\n  return left.byteLength === right.byteLength && left.every((byte, index) => byte === right[index]);\n}\n\nfunction defaultImporter(specifier: string): Promise<unknown> {\n  return import(/* @vite-ignore */ specifier);\n}\n\nfunction invalid(message: string): never {\n  throw new ArtifactRuntimeError(\"ARTIFACT_RUNTIME_MANIFEST_INVALID\", message);\n}\n\nfunction integrity(message: string): never {\n  throw new ArtifactRuntimeError(\"ARTIFACT_RUNTIME_INTEGRITY\", message);\n}\n\nfunction incompatible(message: string): never {\n  throw new ArtifactRuntimeError(\"ARTIFACT_RUNTIME_INCOMPATIBLE\", message);\n}\n","import {\n  ARTIFACT_RUNTIME_TARGETS,\n  ArtifactRuntimeError,\n  artifactRuntimeTarget,\n  type ArtifactRuntimeTarget,\n} from \"./runtime\";\n\nconst NATIVE_ASSET = \"opengeni_artifact_kernel.node\";\nconst WASM_RUNTIME_FILES = [\n  \"artifact_kernel.js\",\n  \"artifact_kernel_bg.wasm\",\n  \"artifact_kernel_document.js\",\n  \"artifact_kernel_document_bg.wasm\",\n  \"artifact_kernel_presentation.js\",\n  \"artifact_kernel_presentation_bg.wasm\",\n  \"artifact_kernel_spreadsheet.js\",\n  \"artifact_kernel_spreadsheet_bg.wasm\",\n] as const;\nconst MAX_CAPABILITIES_BYTES = 1024 * 1024;\n\nexport type ArtifactKernelBuildReceipt = Readonly<{\n  schemaVersion: 1;\n  producer: \"opengeni-artifact-kernel-smoke-v1\";\n  target: ArtifactRuntimeTarget;\n  kind: \"native\" | \"wasm\";\n  buildIdentity: string;\n  capabilities: Readonly<{\n    bytes: number;\n    sha256: `sha256:${string}`;\n  }>;\n  runtimeFiles: readonly Readonly<{\n    path: string;\n    bytes: number;\n    sha256: `sha256:${string}`;\n  }>[];\n}>;\n\nexport function validateArtifactKernelBuildReceipt(\n  value: unknown,\n  expectedTarget?: ArtifactRuntimeTarget,\n): ArtifactKernelBuildReceipt {\n  const record = exactRecord(\n    value,\n    [\n      \"schemaVersion\",\n      \"producer\",\n      \"target\",\n      \"kind\",\n      \"buildIdentity\",\n      \"capabilities\",\n      \"runtimeFiles\",\n    ],\n    \"target build receipt\",\n  );\n  if (record.schemaVersion !== 1 || record.producer !== \"opengeni-artifact-kernel-smoke-v1\") {\n    invalid(\"target build receipt schema/producer is invalid\");\n  }\n  if (\n    typeof record.target !== \"string\" ||\n    !ARTIFACT_RUNTIME_TARGETS.includes(record.target as ArtifactRuntimeTarget)\n  ) {\n    invalid(\"target build receipt target is invalid\");\n  }\n  const descriptor = artifactRuntimeTarget(record.target as ArtifactRuntimeTarget);\n  if (expectedTarget !== undefined && descriptor.target !== expectedTarget) {\n    invalid(`target build receipt ${descriptor.target} does not match ${expectedTarget}`);\n  }\n  if (record.kind !== descriptor.kind) invalid(\"target build receipt kind is invalid\");\n  if (\n    typeof record.buildIdentity !== \"string\" ||\n    record.buildIdentity.length === 0 ||\n    record.buildIdentity.length > 512\n  ) {\n    invalid(\"target build receipt identity is invalid\");\n  }\n  const capabilities = fileProof(record.capabilities, \"target build capabilities\", false);\n  if (capabilities.bytes > MAX_CAPABILITIES_BYTES) {\n    invalid(\"target build capabilities exceed their maximum size\");\n  }\n  if (\n    !Array.isArray(record.runtimeFiles) ||\n    record.runtimeFiles.length === 0 ||\n    record.runtimeFiles.length > 8\n  ) {\n    invalid(\"target build receipt runtimeFiles is invalid\");\n  }\n  const runtimeFiles = record.runtimeFiles.map((entry, index) =>\n    fileProof(entry, `target build runtime file ${index}`, true),\n  );\n  if (\n    !runtimeFiles.every((entry, index) => index === 0 || runtimeFiles[index - 1]!.path < entry.path)\n  ) {\n    invalid(\"target build receipt runtimeFiles must be strictly sorted\");\n  }\n  const expectedPaths = descriptor.kind === \"native\" ? [NATIVE_ASSET] : WASM_RUNTIME_FILES;\n  if (JSON.stringify(runtimeFiles.map(({ path }) => path)) !== JSON.stringify(expectedPaths)) {\n    invalid(\"target build receipt runtimeFiles do not match the target package\");\n  }\n  return {\n    schemaVersion: 1,\n    producer: \"opengeni-artifact-kernel-smoke-v1\",\n    target: descriptor.target,\n    kind: descriptor.kind,\n    buildIdentity: record.buildIdentity,\n    capabilities: { bytes: capabilities.bytes, sha256: capabilities.sha256 },\n    runtimeFiles,\n  };\n}\n\nexport function canonicalArtifactKernelBuildReceiptBytes(value: unknown): Uint8Array {\n  const receipt = validateArtifactKernelBuildReceipt(value);\n  return new TextEncoder().encode(`${JSON.stringify(receipt, null, 2)}\\n`);\n}\n\nfunction fileProof(\n  value: unknown,\n  name: string,\n  includePath: true,\n): { path: string; bytes: number; sha256: `sha256:${string}` };\nfunction fileProof(\n  value: unknown,\n  name: string,\n  includePath: false,\n): { bytes: number; sha256: `sha256:${string}` };\nfunction fileProof(value: unknown, name: string, includePath: boolean) {\n  const record = exactRecord(\n    value,\n    includePath ? [\"path\", \"bytes\", \"sha256\"] : [\"bytes\", \"sha256\"],\n    name,\n  );\n  const bytes = record.bytes;\n  const digest = record.sha256;\n  if (!Number.isSafeInteger(bytes) || (bytes as number) <= 0) invalid(`${name} bytes is invalid`);\n  if (typeof digest !== \"string\" || !/^sha256:[0-9a-f]{64}$/u.test(digest)) {\n    invalid(`${name} digest is invalid`);\n  }\n  if (!includePath) return { bytes: bytes as number, sha256: digest as `sha256:${string}` };\n  const path = record.path;\n  if (\n    typeof path !== \"string\" ||\n    path.length === 0 ||\n    path.includes(\"/\") ||\n    path.includes(\"\\\\\") ||\n    path === \".\" ||\n    path === \"..\"\n  ) {\n    invalid(`${name} path is invalid`);\n  }\n  return { path, bytes: bytes as number, sha256: digest as `sha256:${string}` };\n}\n\nfunction exactRecord(\n  value: unknown,\n  keys: readonly string[],\n  name: string,\n): Record<string, unknown> {\n  if (typeof value !== \"object\" || value === null || Array.isArray(value)) {\n    invalid(`${name} is invalid`);\n  }\n  const record = value as Record<string, unknown>;\n  if (JSON.stringify(Object.keys(record).sort()) !== JSON.stringify([...keys].sort())) {\n    invalid(`${name} has unexpected fields`);\n  }\n  return record;\n}\n\nfunction invalid(message: string): never {\n  throw new ArtifactRuntimeError(\"ARTIFACT_RUNTIME_MANIFEST_INVALID\", message);\n}\n"],"mappings":";;;;;;;;;;;;;;;;;AAAA,SAAS,kBAAkB;AAC3B,SAAS,MAAM,UAAU,YAAY;AACrC,SAAS,YAAY,UAAU,eAAe;AAC9C,SAAS,qBAAqB;;;ACI9B,IAAM,eAAe;AACrB,IAAM,qBAAqB;AAAA,EACzB;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF;AACA,IAAM,yBAAyB,OAAO;AAmB/B,SAAS,mCACd,OACA,gBAC4B;AAC5B,QAAM,SAAS;AAAA,IACb;AAAA,IACA;AAAA,MACE;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,IACF;AAAA,IACA;AAAA,EACF;AACA,MAAI,OAAO,kBAAkB,KAAK,OAAO,aAAa,qCAAqC;AACzF,YAAQ,iDAAiD;AAAA,EAC3D;AACA,MACE,OAAO,OAAO,WAAW,YACzB,CAAC,yBAAyB,SAAS,OAAO,MAA+B,GACzE;AACA,YAAQ,wCAAwC;AAAA,EAClD;AACA,QAAM,aAAa,sBAAsB,OAAO,MAA+B;AAC/E,MAAI,mBAAmB,UAAa,WAAW,WAAW,gBAAgB;AACxE,YAAQ,wBAAwB,WAAW,MAAM,mBAAmB,cAAc,EAAE;AAAA,EACtF;AACA,MAAI,OAAO,SAAS,WAAW,KAAM,SAAQ,sCAAsC;AACnF,MACE,OAAO,OAAO,kBAAkB,YAChC,OAAO,cAAc,WAAW,KAChC,OAAO,cAAc,SAAS,KAC9B;AACA,YAAQ,0CAA0C;AAAA,EACpD;AACA,QAAM,eAAe,UAAU,OAAO,cAAc,6BAA6B,KAAK;AACtF,MAAI,aAAa,QAAQ,wBAAwB;AAC/C,YAAQ,qDAAqD;AAAA,EAC/D;AACA,MACE,CAAC,MAAM,QAAQ,OAAO,YAAY,KAClC,OAAO,aAAa,WAAW,KAC/B,OAAO,aAAa,SAAS,GAC7B;AACA,YAAQ,8CAA8C;AAAA,EACxD;AACA,QAAM,eAAe,OAAO,aAAa;AAAA,IAAI,CAAC,OAAO,UACnD,UAAU,OAAO,6BAA6B,KAAK,IAAI,IAAI;AAAA,EAC7D;AACA,MACE,CAAC,aAAa,MAAM,CAAC,OAAO,UAAU,UAAU,KAAK,aAAa,QAAQ,CAAC,EAAG,OAAO,MAAM,IAAI,GAC/F;AACA,YAAQ,2DAA2D;AAAA,EACrE;AACA,QAAM,gBAAgB,WAAW,SAAS,WAAW,CAAC,YAAY,IAAI;AACtE,MAAI,KAAK,UAAU,aAAa,IAAI,CAAC,EAAE,KAAK,MAAM,IAAI,CAAC,MAAM,KAAK,UAAU,aAAa,GAAG;AAC1F,YAAQ,mEAAmE;AAAA,EAC7E;AACA,SAAO;AAAA,IACL,eAAe;AAAA,IACf,UAAU;AAAA,IACV,QAAQ,WAAW;AAAA,IACnB,MAAM,WAAW;AAAA,IACjB,eAAe,OAAO;AAAA,IACtB,cAAc,EAAE,OAAO,aAAa,OAAO,QAAQ,aAAa,OAAO;AAAA,IACvE;AAAA,EACF;AACF;AAEO,SAAS,yCAAyC,OAA4B;AACnF,QAAM,UAAU,mCAAmC,KAAK;AACxD,SAAO,IAAI,YAAY,EAAE,OAAO,GAAG,KAAK,UAAU,SAAS,MAAM,CAAC,CAAC;AAAA,CAAI;AACzE;AAYA,SAAS,UAAU,OAAgB,MAAc,aAAsB;AACrE,QAAM,SAAS;AAAA,IACb;AAAA,IACA,cAAc,CAAC,QAAQ,SAAS,QAAQ,IAAI,CAAC,SAAS,QAAQ;AAAA,IAC9D;AAAA,EACF;AACA,QAAM,QAAQ,OAAO;AACrB,QAAMA,UAAS,OAAO;AACtB,MAAI,CAAC,OAAO,cAAc,KAAK,KAAM,SAAoB,EAAG,SAAQ,GAAG,IAAI,mBAAmB;AAC9F,MAAI,OAAOA,YAAW,YAAY,CAAC,yBAAyB,KAAKA,OAAM,GAAG;AACxE,YAAQ,GAAG,IAAI,oBAAoB;AAAA,EACrC;AACA,MAAI,CAAC,YAAa,QAAO,EAAE,OAAwB,QAAQA,QAA6B;AACxF,QAAM,OAAO,OAAO;AACpB,MACE,OAAO,SAAS,YAChB,KAAK,WAAW,KAChB,KAAK,SAAS,GAAG,KACjB,KAAK,SAAS,IAAI,KAClB,SAAS,OACT,SAAS,MACT;AACA,YAAQ,GAAG,IAAI,kBAAkB;AAAA,EACnC;AACA,SAAO,EAAE,MAAM,OAAwB,QAAQA,QAA6B;AAC9E;AAEA,SAAS,YACP,OACA,MACA,MACyB;AACzB,MAAI,OAAO,UAAU,YAAY,UAAU,QAAQ,MAAM,QAAQ,KAAK,GAAG;AACvE,YAAQ,GAAG,IAAI,aAAa;AAAA,EAC9B;AACA,QAAM,SAAS;AACf,MAAI,KAAK,UAAU,OAAO,KAAK,MAAM,EAAE,KAAK,CAAC,MAAM,KAAK,UAAU,CAAC,GAAG,IAAI,EAAE,KAAK,CAAC,GAAG;AACnF,YAAQ,GAAG,IAAI,wBAAwB;AAAA,EACzC;AACA,SAAO;AACT;AAEA,SAAS,QAAQ,SAAwB;AACvC,QAAM,IAAI,qBAAqB,qCAAqC,OAAO;AAC7E;;;AD3IO,IAAM,2CAA2C;AAAA,EACtD,UAAU;AACZ;AAEA,IAAM,qBAAqB,MAAM;AACjC,IAAM,qBAAqB,KAAK;AAChC,IAAM,oBAAoB,MAAM;AAChC,IAAM,uBAAuB,KAAK,OAAO;AACzC,IAAM,yBAAyB,MAAM,OAAO;AAC5C,IAAM,oCAAoC,MAAM,OAAO;AAuDhD,SAAS,4BACd,cAAkC,QAAQ,KACjC;AACT,SAAO;AAAA,IACL,6BAA6B;AAAA,IAC7B,6BAA6B;AAAA,IAC7B,yCAAyC;AAAA,EAC3C,EAAE,KAAK,CAAC,SAAS,OAAO,YAAY,IAAI,MAAM,QAAQ;AACxD;AAEO,SAAS,2CACd,OACA,gBACoC;AACpC,QAAM,SAASC;AAAA,IACb;AAAA,IACA;AAAA,MACE;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,IACF;AAAA,IACA;AAAA,EACF;AACA,MAAI,OAAO,kBAAkB,KAAK,OAAO,SAAS,4BAA4B;AAC5E,IAAAC,SAAQ,4CAA4C;AAAA,EACtD;AACA,MAAI,OAAO,WAAW,WAAY,CAAAA,SAAQ,2CAA2C;AACrF,QAAM,SAAS,sCAAsC,OAAO,MAAM;AAClE,MAAI,OAAO,SAAS,YAAY,OAAO,WAAW,OAAO,QAAQ;AAC/D,IAAAA,SAAQ,2DAA2D;AAAA,EACrE;AACA,MAAI,kBAAkB,OAAO,WAAW,gBAAgB;AACtD,IAAAA,SAAQ,8BAA8B,OAAO,MAAM,mBAAmB,cAAc,EAAE;AAAA,EACxF;AACA,QAAM,eAAeD;AAAA,IACnB,OAAO;AAAA,IACP,CAAC,eAAe,gBAAgB;AAAA,IAChC;AAAA,EACF;AACA,MACE,aAAa,gBAAgB,6BAC7B,aAAa,mBAAmB,OAAO,qBACvC;AACA,IAAAC,SAAQ,4DAA4D;AAAA,EACtE;AACA,SAAO,OAAO,OAAO;AAAA,IACnB,eAAe;AAAA,IACf,MAAM;AAAA,IACN,QAAQ,OAAO;AAAA,IACf,mBAAmB,OAAO,OAAO,mBAAmB,gCAAgC;AAAA,IACpF,cAAc,OAAO,OAAO;AAAA,MAC1B,aAAa;AAAA,MACb,gBAAgB,OAAO;AAAA,IACzB,CAAC;AAAA,IACD,sBAAsB;AAAA,MACpB,OAAO;AAAA,MACP;AAAA,IACF;AAAA,IACA,SAAS,eAAe,OAAO,SAAS,2BAA2B;AAAA,IACnE,uBAAuB,eAAe,OAAO,uBAAuB,0BAA0B;AAAA,IAC9F,wBAAwB;AAAA,MACtB,OAAO;AAAA,MACP;AAAA,IACF;AAAA,IACA,mBAAmB,iBAAiB,OAAO,mBAAmB,yBAAyB;AAAA,IACvF;AAAA,EACF,CAAC;AACH;AAEO,SAAS,iDAAiD,OAA4B;AAC3F,QAAM,WAAW,2CAA2C,KAAK;AACjE,SAAO,IAAI,YAAY,EAAE,OAAO,GAAG,KAAK,UAAU,UAAU,MAAM,CAAC,CAAC;AAAA,CAAI;AAC1E;AAEO,SAAS,8CACd,cACY;AACZ,MACE,aAAa,gBAAgB,6BAC7B,CAAC,cAAc,aAAa,cAAc,GAC1C;AACA,IAAAA,SAAQ,+CAA+C;AAAA,EACzD;AACA,SAAO,IAAI,YAAY,EAAE,OAAO,GAAG,KAAK,UAAU,cAAc,MAAM,CAAC,CAAC;AAAA,CAAI;AAC9E;AAEA,eAAsB,yCACpB,UAGI,CAAC,GACgD;AACrD,QAAM,cAAc,QAAQ,eAAe,QAAQ;AACnD,+BAA6B,WAAW;AACxC,QAAM,iBAAiB,QAAQ,kBAAkB,oBAAoB;AACrE,QAAM,gBAAgB;AAAA,IACpB;AAAA,IACA,yCAAyC;AAAA,EAC3C;AACA,QAAM,cAAc,aAAa,aAAa,6BAA6B,cAAc;AACzF,QAAM,eAAe,MAAM,cAAc,eAAe,8BAA8B;AACtF,QAAM,gBAAgB,MAAM;AAAA,IAC1B;AAAA,IACA;AAAA,IACA;AAAA,EACF;AACA,QAAM,WAAW;AAAA,IACf,UAAU,eAAe,8BAA8B;AAAA,IACvD;AAAA,EACF;AACA,MAAI,CAAC,UAAU,eAAe,iDAAiD,QAAQ,CAAC,GAAG;AACzF,cAAU,+CAA+C;AAAA,EAC3D;AACA,QAAM,OAAO,MAAM,SAAS,QAAQ,cAAc,IAAI,CAAC;AACvD,QAAM,eAAe,MAAM;AAAA,IACzB;AAAA,IACA,SAAS,qBAAqB;AAAA,IAC9B;AAAA,EACF;AACA,QAAM,cAAc,MAAM,aAAa,MAAM,SAAS,QAAQ,MAAM,sBAAsB;AAC1F,QAAM,wBAAwB,MAAM;AAAA,IAClC;AAAA,IACA,SAAS,sBAAsB;AAAA,IAC/B;AAAA,EACF;AACA,QAAM,yBAAyB,MAAM;AAAA,IACnC;AAAA,IACA,SAAS,uBAAuB;AAAA,IAChC;AAAA,EACF;AACA,QAAM,mBAAmB,MAAM,cAAc,aAAa,qCAAqC;AAC/F,MAAI,qBAAqB,uBAAuB;AAC9C;AAAA,MACE,GAAG,6BAA6B,cAAc;AAAA,IAChD;AAAA,EACF;AACA,QAAM,aAAa,MAAM;AAAA,IACvB;AAAA,IACA,SAAS;AAAA,IACT;AAAA,EACF;AACA,QAAM,mBAAmB,MAAM;AAAA,IAC7B;AAAA,IACA,SAAS,OAAO,WAAW;AAAA,IAC3B;AAAA,EACF;AACA,QAAM,cAAc,MAAM,aAAa,YAAY,SAAS,OAAO,MAAM,MAAM,cAAc;AAC7F,QAAM,qBAAqB,MAAM,QAAQ;AAAA,IACvC,SAAS,OAAO,aAAa;AAAA,MAAI,CAAC,MAAM,UACtC,aAAa,YAAY,KAAK,MAAM,uBAAuB,KAAK,EAAE;AAAA,IACpE;AAAA,EACF;AAEA,QAAM,gBAAgB,MAAM;AAAA,IAC1B;AAAA,IACA,SAAS;AAAA,IACT;AAAA,IACA;AAAA,EACF;AACA,MACE,CAAC,UAAU,eAAe,8CAA8C,SAAS,YAAY,CAAC,GAC9F;AACA,cAAU,mEAAmE;AAAA,EAC/E;AACA,QAAM,eAAe,MAAM;AAAA,IACzB;AAAA,IACA,SAAS;AAAA,IACT;AAAA,IACA;AAAA,EACF;AACA,QAAM,UAAU;AAAA,IACd,UAAU,cAAc,sBAAsB;AAAA,IAC9C,SAAS;AAAA,EACX;AACA,MAAI,CAAC,UAAU,cAAc,yCAAyC,OAAO,CAAC,GAAG;AAC/E,cAAU,6CAA6C;AAAA,EACzD;AACA,6BAA2B,SAAS,SAAS,MAAM;AACnD,QAAM;AAAA,IACJ;AAAA,IACA,SAAS;AAAA,IACT;AAAA,IACA;AAAA,EACF;AACA,QAAM;AAAA,IACJ;AAAA,IACA,SAAS;AAAA,IACT;AAAA,IACA;AAAA,EACF;AACA,QAAM;AAAA,IACJ;AAAA,IACA,SAAS,OAAO;AAAA,IAChB;AAAA,IACA;AAAA,EACF;AACA,QAAM,WAAW,aAAa,SAAS,OAAO,OAAO,wBAAwB,cAAc;AAC3F,aAAW,CAAC,OAAO,IAAI,KAAK,mBAAmB,QAAQ,GAAG;AACxD,UAAM;AAAA,MACJ;AAAA,MACA,SAAS,OAAO,aAAa,KAAK;AAAA,MAClC;AAAA,MACA,uBAAuB,KAAK;AAAA,IAC9B;AAAA,EACF;AACA,SAAO,OAAO,OAAO;AAAA,IACnB,eAAe;AAAA,IACf,MAAM;AAAA,IACN,QAAQ,SAAS;AAAA,IACjB;AAAA,IACA;AAAA,IACA,cAAc,OAAO,OAAO,EAAE,GAAG,SAAS,aAAa,CAAC;AAAA,IACxD;AAAA,IACA;AAAA,IACA,QAAQ,OAAO,OAAO;AAAA,MACpB,aAAa,SAAS,OAAO;AAAA,MAC7B,gBAAgB,SAAS,OAAO;AAAA,MAChC,YAAY;AAAA,MACZ,OAAO;AAAA,MACP,cAAc,OAAO,OAAO,kBAAkB;AAAA,MAC9C,eAAe,SAAS,OAAO;AAAA,IACjC,CAAC;AAAA,EACH,CAAC;AACH;AAEA,eAAsB,yCACpB,UAKI,CAAC,GACgD;AACrD,QAAM,WAAW,MAAM,yCAAyC,OAAO;AACvE,MAAI;AACJ,MAAI;AACF,eAAW,OAAO,QAAQ,YAAY;AAAA,MACpC,cAAc,SAAS,qBAAqB,EAAE;AAAA,IAChD;AAAA,EACF,SAAS,OAAO;AACd,UAAM,IAAI;AAAA,MACR;AAAA,MACA;AAAA,MACA,EAAE,MAAM;AAAA,IACV;AAAA,EACF;AACA,MAAI,CAAC,SAAS,QAAQ,EAAG,cAAa,qDAAqD;AAC3F,MAAI,QAAQ,MAAO,OAAM,QAAQ,MAAM,QAAQ;AAAA,MAC1C,kCAAiC,UAAU,QAAQ;AACxD,SAAO;AACT;AAEA,eAAsB,6CACpB,UAGI,CAAC,GAC6C;AAClD,QAAM,cAAc,QAAQ,eAAe,QAAQ;AACnD,QAAM,iBAAiB,QAAQ,kBAAkB,oBAAoB;AACrE,QAAM,SAAS,MAAM,yCAAyC,EAAE,aAAa,eAAe,CAAC;AAC7F,QAAM,WAAW;AAAA,IACf;AAAA,MACE,MAAM;AAAA,QACJ,OAAO;AAAA,QACP;AAAA,QACA;AAAA,MACF;AAAA,MACA;AAAA,IACF;AAAA,IACA;AAAA,EACF;AACA,QAAM,aAAa;AAAA,IACjB,GAAG,QAAQ,OAAO,cAAc,MAAM,SAAS,iBAAiB,CAAC;AAAA,EACnE;AACA,QAAM,eAAkD;AAAA,IACtD,QAAQ;AAAA,MACN,QAAQ,SAAS;AAAA,MACjB,MAAM;AAAA,MACN,aAAa,SAAS,OAAO;AAAA,MAC7B,UAAU,SAAS,OAAO,WAAW,SAAS,IAC1C,WACA,SAAS,OAAO,WAAW,QAAQ,IACjC,UACA;AAAA,MACN,MAAM,SAAS,OAAO,SAAS,OAAO,IAAI,UAAU;AAAA,MACpD,GAAI,SAAS,OAAO,SAAS,MAAM,IAC/B,EAAE,MAAM,MAAe,IACvB,SAAS,OAAO,SAAS,OAAO,IAC9B,EAAE,MAAM,OAAgB,IACxB,CAAC;AAAA,IACT;AAAA,IACA,kBAAkB,IAAI,IAAI,SAAS,OAAO,WAAW,MAAM,UAAU;AAAA,IACrE,UAAU;AAAA,MACR,QAAQ,SAAS;AAAA,IACnB;AAAA,EACF;AACA,QAAM,UAAU,MAAM,0BAA0B,YAAY;AAC5D,QAAM,QAAQ,MAAM,yCAAyC,EAAE,aAAa,eAAe,CAAC;AAC5F,MACE,CAAC,SAAS,QAAQ,KAAK,KACvB,QAAQ,SAAS,YACjB,QAAQ,WAAW,MAAM,UACzB,QAAQ,kBAAkB,MAAM,OAAO,eACvC;AACA,cAAU,kEAAkE;AAAA,EAC9E;AACA,SAAO,OAAO,OAAO,EAAE,UAAU,OAAO,QAAQ,CAAC;AACnD;AAEA,eAAsB,gCACpB,cAAkC,QAAQ,KACE;AAC5C,SAAO,uBAAuB,WAAW,IACrC,MAAM,yCAAyC,EAAE,YAAY,CAAC,IAC9D,MAAM,8BAA8B,EAAE,YAAY,CAAC;AACzD;AAEA,eAAsB,oCACpB,cAAkC,QAAQ,KACQ;AAClD,SAAO,uBAAuB,WAAW,IACrC,MAAM,6CAA6C,EAAE,YAAY,CAAC,IAClE,MAAM,kCAAkC,EAAE,YAAY,CAAC;AAC7D;AAEA,eAAsB,gCACpB,MACA,cAAkC,QAAQ,KACzB;AACjB,MAAI,CAAC,uBAAuB,WAAW,EAAG,QAAO,MAAM,sBAAsB,MAAM,WAAW;AAC9F,QAAM,CAAC,SAAS,QAAQ,GAAG,IAAI,IAAI;AACnC,MAAK,YAAY,YAAY,YAAY,YAAa,WAAW,YAAY,KAAK,SAAS,GAAG;AAC5F,IAAAA,SAAQ,yDAAyD;AAAA,EACnE;AACA,QAAM,WACJ,YAAY,WACR,MAAM,yCAAyC,EAAE,YAAY,CAAC,IAC9D,MAAM,yCAAyC,EAAE,YAAY,CAAC;AACpE,SAAO,GAAG,KAAK,UAAU,QAAQ,CAAC;AAAA;AACpC;AAEA,SAAS,uBAAuB,aAA0C;AACxE,SAAO,QAAQ,YAAY,yCAAyC,QAAQ,CAAC;AAC/E;AAEA,SAAS,6BAA6B,aAAuC;AAC3E,MAAI,YAAY,aAAa,cAAc;AACzC,UAAM,IAAI;AAAA,MACR;AAAA,MACA;AAAA,IACF;AAAA,EACF;AACA,MAAI,YAAY,6BAA6B,QAAQ,GAAG;AACtD,IAAAA,SAAQ,iFAAiF;AAAA,EAC3F;AACF;AAEA,SAAS,sBAAmD;AAC1D,QAAM,SAAS,oCAAoC;AACnD,MAAI,WAAW,YAAY;AACzB,UAAM,IAAI;AAAA,MACR;AAAA,MACA;AAAA,IACF;AAAA,EACF;AACA,SAAO;AACT;AAEA,SAAS,2BACP,SACA,QACM;AACN,QAAM,eAAe,CAAC,OAAO,OAAO,GAAG,OAAO,YAAY,EAAE;AAAA,IAAK,CAAC,MAAM,UACtE,KAAK,OAAO,MAAM,OAAO,KAAK,KAAK,OAAO,MAAM,OAAO,IAAI;AAAA,EAC7D;AACA,MACE,QAAQ,kBAAkB,OAAO,iBACjC,CAAC,SAAS,QAAQ,cAAc,YAAY,GAC5C;AACA,cAAU,4DAA4D;AAAA,EACxE;AACF;AAEA,eAAe,aAAa,MAAc,MAAc,MAA+B;AACrF,SAAO,MAAM,SAAS,MAAM,MAAM,MAAM,MAAM;AAChD;AAEA,eAAe,kBAAkB,MAAc,MAAc,MAA+B;AAC1F,SAAO,MAAM,SAAS,MAAM,MAAM,MAAM,WAAW;AACrD;AAEA,eAAe,SACb,MACA,MACA,MACA,MACiB;AACjB,QAAM,YAAY,MAAM,SAAS,QAAQ,MAAM,IAAI,CAAC,EAAE,MAAM,CAAC,UAAU;AACrE,UAAM,IAAI,qBAAqB,gCAAgC,GAAG,IAAI,mBAAmB;AAAA,MACvF;AAAA,IACF,CAAC;AAAA,EACH,CAAC;AACD,QAAM,WAAW,SAAS,MAAM,SAAS;AACzC,MACE,aAAa,QACb,SAAS,WAAW,KAAK,QAAQ,aAAa,UAAU,OAAO,GAAG,EAAE,KACpE,WAAW,QAAQ,GACnB;AACA,IAAAA,SAAQ,GAAG,IAAI,gDAAgD;AAAA,EACjE;AACA,QAAM,WAAW,MAAM,KAAK,SAAS;AACrC,MACG,SAAS,UAAU,CAAC,SAAS,OAAO,KACpC,SAAS,eAAe,CAAC,SAAS,YAAY,GAC/C;AACA,UAAM,IAAI,qBAAqB,gCAAgC,GAAG,IAAI,aAAa,IAAI,EAAE;AAAA,EAC3F;AACA,SAAO;AACT;AAEA,eAAe,cAAc,OAAe,MAA+B;AACzE,MAAI,CAAC,WAAW,KAAK,EAAG,CAAAA,SAAQ,GAAG,IAAI,wBAAwB;AAC/D,MAAI;AACF,UAAM,OAAO,MAAM,SAAS,KAAK;AACjC,QAAI,EAAE,MAAM,KAAK,IAAI,GAAG,OAAO,EAAG,OAAM,IAAI,MAAM,YAAY;AAC9D,WAAO;AAAA,EACT,SAAS,OAAO;AACd,UAAM,IAAI,qBAAqB,gCAAgC,GAAG,IAAI,mBAAmB;AAAA,MACvF;AAAA,IACF,CAAC;AAAA,EACH;AACF;AAEA,eAAe,cACb,MACA,UACA,cACA,MACqB;AACrB,QAAM,QAAQ,MAAM,gBAAgB,MAAM,cAAc,IAAI;AAC5D,MAAI,MAAM,eAAe,SAAS,SAAS,OAAO,KAAK,MAAM,SAAS,QAAQ;AAC5E,cAAU,GAAG,IAAI,wCAAwC;AAAA,EAC3D;AACA,SAAO;AACT;AAEA,eAAe,WACb,MACA,UACA,cACA,MACe;AACf,QAAM,cAAc,MAAM,UAAU,cAAc,IAAI;AACxD;AAEA,eAAe,gBACb,MACA,cACA,MACqB;AACrB,MAAI;AACJ,MAAI;AACF,aAAS,MAAM,KAAK,MAAM,GAAG;AAC7B,UAAM,SAAS,MAAM,OAAO,KAAK;AACjC,QAAI,CAAC,OAAO,OAAO,KAAK,OAAO,QAAQ,KAAK,OAAO,OAAO,cAAc;AACtE,gBAAU,GAAG,IAAI,kBAAkB;AAAA,IACrC;AACA,UAAM,QAAQ,IAAI,WAAW,MAAM,OAAO,SAAS,CAAC;AACpD,UAAM,QAAQ,MAAM,OAAO,KAAK;AAChC,QAAI,MAAM,SAAS,OAAO,QAAQ,MAAM,eAAe,OAAO,MAAM;AAClE,gBAAU,GAAG,IAAI,wBAAwB;AAAA,IAC3C;AACA,WAAO;AAAA,EACT,SAAS,OAAO;AACd,QAAI,iBAAiB,qBAAsB,OAAM;AACjD,UAAM,IAAI,qBAAqB,gCAAgC,kBAAkB,IAAI,IAAI;AAAA,MACvF;AAAA,IACF,CAAC;AAAA,EACH,UAAE;AACA,UAAM,QAAQ,MAAM;AAAA,EACtB;AACF;AAEA,SAAS,eAAe,OAAgB,MAA8B;AACpE,QAAM,SAASD,aAAY,OAAO,CAAC,QAAQ,SAAS,QAAQ,GAAG,IAAI;AACnE,MAAI,CAAC,OAAO,cAAc,OAAO,KAAK,KAAM,OAAO,SAAoB,GAAG;AACxE,IAAAC,SAAQ,GAAG,IAAI,uBAAuB;AAAA,EACxC;AACA,SAAO,OAAO,OAAO;AAAA,IACnB,MAAM,iBAAiB,OAAO,MAAM,GAAG,IAAI,OAAO;AAAA,IAClD,OAAO,OAAO;AAAA,IACd,QAAQ,OAAO,OAAO,QAAQ,GAAG,IAAI,SAAS;AAAA,EAChD,CAAC;AACH;AAEA,SAAS,iBAAiB,OAAgB,MAAsB;AAC9D,MACE,OAAO,UAAU,YACjB,MAAM,WAAW,KACjB,MAAM,SAAS,QACf,MAAM,WAAW,GAAG,KACpB,MAAM,WAAW,IAAI,KACrB,MAAM,SAAS,IAAI,KACnB,MAAM,MAAM,GAAG,EAAE,KAAK,CAAC,SAAS,SAAS,MAAM,SAAS,OAAO,SAAS,IAAI,KAC5E,WAAW,KAAK,KAAK,GACrB;AACA,IAAAA,SAAQ,GAAG,IAAI,qCAAqC;AAAA,EACtD;AACA,SAAO;AACT;AAEA,SAAS,OAAO,OAAgB,MAAkC;AAChE,MAAI,OAAO,UAAU,YAAY,CAAC,yBAAyB,KAAK,KAAK,GAAG;AACtE,IAAAA,SAAQ,GAAG,IAAI,aAAa;AAAA,EAC9B;AACA,SAAO;AACT;AAEA,SAAS,cAAc,OAAiC;AACtD,SACE,OAAO,UAAU,YAAY,oDAAoD,KAAK,KAAK;AAE/F;AAEA,SAAS,aAAa,aAAiC,MAAsB;AAC3E,QAAM,QAAQ,YAAY,IAAI;AAC9B,MAAI,CAAC,OAAO;AACV,UAAM,IAAI,qBAAqB,gCAAgC,GAAG,IAAI,cAAc;AAAA,EACtF;AACA,SAAO;AACT;AAEA,SAAS,UAAU,OAAmB,MAAuB;AAC3D,MAAI;AACF,WAAO,KAAK,MAAM,IAAI,YAAY,SAAS,EAAE,OAAO,KAAK,CAAC,EAAE,OAAO,KAAK,CAAC;AAAA,EAC3E,SAAS,OAAO;AACd,UAAM,IAAI;AAAA,MACR;AAAA,MACA,GAAG,IAAI;AAAA,MACP,EAAE,MAAM;AAAA,IACV;AAAA,EACF;AACF;AAEA,SAASD,aACP,OACA,MACA,MACyB;AACzB,MAAI,CAAC,SAAS,KAAK,EAAG,CAAAC,SAAQ,GAAG,IAAI,aAAa;AAClD,MAAI,KAAK,UAAU,OAAO,KAAK,KAAK,EAAE,KAAK,CAAC,MAAM,KAAK,UAAU,CAAC,GAAG,IAAI,EAAE,KAAK,CAAC,GAAG;AAClF,IAAAA,SAAQ,GAAG,IAAI,wBAAwB;AAAA,EACzC;AACA,SAAO;AACT;AAEA,SAAS,SAAS,OAAkD;AAClE,SAAO,OAAO,UAAU,YAAY,UAAU,QAAQ,CAAC,MAAM,QAAQ,KAAK;AAC5E;AAEA,SAAS,OAAO,OAAuC;AACrD,SAAO,UAAU,WAAW,QAAQ,EAAE,OAAO,KAAK,EAAE,OAAO,KAAK,CAAC;AACnE;AAEA,SAAS,SAAS,MAAe,OAAyB;AACxD,SAAO,KAAK,UAAU,IAAI,MAAM,KAAK,UAAU,KAAK;AACtD;AAEA,SAAS,UAAU,MAAkB,OAA4B;AAC/D,SAAO,KAAK,eAAe,MAAM,cAAc,KAAK,MAAM,CAAC,MAAM,UAAU,SAAS,MAAM,KAAK,CAAC;AAClG;AAEA,SAAS,gBAAgB,WAAqC;AAC5D,SAAO;AAAA;AAAA,IAA0B;AAAA;AACnC;AAEA,SAASA,SAAQ,SAAwB;AACvC,QAAM,IAAI,qBAAqB,qCAAqC,OAAO;AAC7E;AAEA,SAAS,UAAU,SAAwB;AACzC,QAAM,IAAI,qBAAqB,8BAA8B,OAAO;AACtE;AAEA,SAAS,aAAa,SAAwB;AAC5C,QAAM,IAAI,qBAAqB,iCAAiC,OAAO;AACzE;","names":["digest","exactRecord","invalid"]}

package/dist/chunk-VOJHMSM3.js

@@ -0,0 +1,39 @@
+import {
+  spreadsheetFidelityReport,
+  spreadsheetLossPreservationEnvelope
+} from "./chunk-J6N7IR44.js";
+
+// src/spreadsheet-file.ts
+var SpreadsheetFile = class {
+  static async importXlsx(input, options = {}) {
+    const { SpreadsheetXlsxCodec } = await loadSpreadsheetXlsxCodec();
+    return SpreadsheetXlsxCodec.importXlsx(input, options);
+  }
+  static async exportXlsx(workbook, options = {}) {
+    const { SpreadsheetXlsxCodec } = await loadSpreadsheetXlsxCodec();
+    return SpreadsheetXlsxCodec.exportXlsx(workbook, options);
+  }
+  static fidelityReport(workbook) {
+    return spreadsheetFidelityReport(workbook);
+  }
+  /**
+   * Returns a portable copy of the opaque original-package envelope.
+   * Persist it beside Workbook.toJSON(); the Workbook JSON intentionally does not contain Office bytes.
+   */
+  static lossPreservationEnvelope(workbook) {
+    return spreadsheetLossPreservationEnvelope(workbook);
+  }
+  /** Reattaches a separately persisted envelope to a restored canonical workbook snapshot. */
+  static async attachLossPreservationEnvelope(workbook, envelope, options = {}) {
+    const { SpreadsheetXlsxCodec } = await loadSpreadsheetXlsxCodec();
+    return SpreadsheetXlsxCodec.attachLossPreservationEnvelope(workbook, envelope, options);
+  }
+};
+function loadSpreadsheetXlsxCodec() {
+  return import("@opengeni/artifact-tool/spreadsheet/xlsx");
+}
+
+export {
+  SpreadsheetFile
+};
+//# sourceMappingURL=chunk-VOJHMSM3.js.map

package/dist/chunk-VOJHMSM3.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/spreadsheet-file.ts"],"sourcesContent":["import type { FileBlob } from \"./file-blob\";\nimport type { Workbook } from \"./spreadsheet\";\nimport {\n  SpreadsheetFidelityError,\n  SpreadsheetSecurityError,\n  type SpreadsheetFidelityIssue,\n  type SpreadsheetLossPreservationEnvelope,\n  type SpreadsheetXlsxExportOptions,\n  type SpreadsheetXlsxImportLimits,\n  type SpreadsheetXlsxImportOptions,\n} from \"./spreadsheet-xlsx-api\";\nimport {\n  spreadsheetFidelityReport,\n  spreadsheetLossPreservationEnvelope,\n} from \"./spreadsheet-xlsx-state\";\n\nexport {\n  SpreadsheetFidelityError,\n  SpreadsheetSecurityError,\n  type SpreadsheetFidelityIssue,\n  type SpreadsheetLossPreservationEnvelope,\n  type SpreadsheetXlsxExportOptions,\n  type SpreadsheetXlsxImportLimits,\n  type SpreadsheetXlsxImportOptions,\n};\n\n/** Lazily loaded XLSX codec around the canonical Workbook model. */\n// eslint-disable-next-line typescript/no-extraneous-class -- Skill-compatible static facade.\nexport class SpreadsheetFile {\n  static async importXlsx(\n    input: FileBlob | Blob | ArrayBuffer | Uint8Array,\n    options: SpreadsheetXlsxImportOptions = {},\n  ): Promise<Workbook> {\n    const { SpreadsheetXlsxCodec } = await loadSpreadsheetXlsxCodec();\n    return SpreadsheetXlsxCodec.importXlsx(input, options);\n  }\n\n  static async exportXlsx(\n    workbook: Workbook,\n    options: SpreadsheetXlsxExportOptions = {},\n  ): Promise<FileBlob> {\n    const { SpreadsheetXlsxCodec } = await loadSpreadsheetXlsxCodec();\n    return SpreadsheetXlsxCodec.exportXlsx(workbook, options);\n  }\n\n  static fidelityReport(workbook: Workbook): readonly SpreadsheetFidelityIssue[] {\n    return spreadsheetFidelityReport(workbook);\n  }\n\n  /**\n   * Returns a portable copy of the opaque original-package envelope.\n   * Persist it beside Workbook.toJSON(); the Workbook JSON intentionally does not contain Office bytes.\n   */\n  static lossPreservationEnvelope(workbook: Workbook): SpreadsheetLossPreservationEnvelope | null {\n    return spreadsheetLossPreservationEnvelope(workbook);\n  }\n\n  /** Reattaches a separately persisted envelope to a restored canonical workbook snapshot. */\n  static async attachLossPreservationEnvelope(\n    workbook: Workbook,\n    envelope: SpreadsheetLossPreservationEnvelope,\n    options: Pick<SpreadsheetXlsxImportOptions, \"limits\"> = {},\n  ): Promise<void> {\n    const { SpreadsheetXlsxCodec } = await loadSpreadsheetXlsxCodec();\n    return SpreadsheetXlsxCodec.attachLossPreservationEnvelope(workbook, envelope, options);\n  }\n}\n\nfunction loadSpreadsheetXlsxCodec() {\n  return import(\"@opengeni/artifact-tool/spreadsheet/xlsx\");\n}\n"],"mappings":";;;;;;AA4BO,IAAM,kBAAN,MAAsB;AAAA,EAC3B,aAAa,WACX,OACA,UAAwC,CAAC,GACtB;AACnB,UAAM,EAAE,qBAAqB,IAAI,MAAM,yBAAyB;AAChE,WAAO,qBAAqB,WAAW,OAAO,OAAO;AAAA,EACvD;AAAA,EAEA,aAAa,WACX,UACA,UAAwC,CAAC,GACtB;AACnB,UAAM,EAAE,qBAAqB,IAAI,MAAM,yBAAyB;AAChE,WAAO,qBAAqB,WAAW,UAAU,OAAO;AAAA,EAC1D;AAAA,EAEA,OAAO,eAAe,UAAyD;AAC7E,WAAO,0BAA0B,QAAQ;AAAA,EAC3C;AAAA;AAAA;AAAA;AAAA;AAAA,EAMA,OAAO,yBAAyB,UAAgE;AAC9F,WAAO,oCAAoC,QAAQ;AAAA,EACrD;AAAA;AAAA,EAGA,aAAa,+BACX,UACA,UACA,UAAwD,CAAC,GAC1C;AACf,UAAM,EAAE,qBAAqB,IAAI,MAAM,yBAAyB;AAChE,WAAO,qBAAqB,+BAA+B,UAAU,UAAU,OAAO;AAAA,EACxF;AACF;AAEA,SAAS,2BAA2B;AAClC,SAAO,OAAO,0CAA0C;AAC1D;","names":[]}

package/dist/chunk-VUNV25KB.js

@@ -0,0 +1,16 @@
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __require = /* @__PURE__ */ ((x) => typeof require !== "undefined" ? require : typeof Proxy !== "undefined" ? new Proxy(x, {
+  get: (a, b) => (typeof require !== "undefined" ? require : a)[b]
+}) : x)(function(x) {
+  if (typeof require !== "undefined") return require.apply(this, arguments);
+  throw Error('Dynamic require of "' + x + '" is not supported');
+});
+var __commonJS = (cb, mod) => function __require2() {
+  return mod || (0, cb[__getOwnPropNames(cb)[0]])((mod = { exports: {} }).exports, mod), mod.exports;
+};
+
+export {
+  __require,
+  __commonJS
+};
+//# sourceMappingURL=chunk-VUNV25KB.js.map

package/dist/chunk-VUNV25KB.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":[],"sourcesContent":[],"mappings":"","names":[]}

package/dist/chunk-XIFUNVBO.js

@@ -0,0 +1,101 @@
+// src/native-raster.ts
+var FONT_FILES_ENV = "OPENGENI_ARTIFACT_RASTER_FONT_FILES";
+var DEFAULT_FONT_FAMILY_ENV = "OPENGENI_ARTIFACT_RASTER_DEFAULT_FONT_FAMILY";
+var MAX_FONT_FILES = 16;
+var MAX_FONT_FILE_BYTES = 32 * 1024 * 1024;
+var cachedFontAuthority;
+async function rasterizeSvgToPng(svg, options = {}) {
+  const [{ Resvg }, font] = await Promise.all([
+    importNativeRuntime("@resvg/resvg-js"),
+    rasterFontAuthority()
+  ]);
+  const resvgOptions = {
+    ...options.background === void 0 ? {} : { background: options.background },
+    ...options.zoom === void 0 ? {} : { fitTo: { mode: "zoom", value: options.zoom } },
+    font
+  };
+  return Uint8Array.from(new Resvg(svg, resvgOptions).render().asPng());
+}
+async function importNativeRuntime(specifier) {
+  return await import(
+    /* @vite-ignore */
+    specifier
+  );
+}
+async function rasterFontAuthority() {
+  const environment = typeof process === "undefined" ? void 0 : process.env;
+  const filesJson = environment?.[FONT_FILES_ENV];
+  const defaultFontFamily = environment?.[DEFAULT_FONT_FAMILY_ENV];
+  if (filesJson === void 0 && defaultFontFamily === void 0) {
+    return { loadSystemFonts: true };
+  }
+  if (!filesJson || filesJson.length > 8192 || !defaultFontFamily?.trim() || defaultFontFamily.length > 128 || /[\u0000-\u001f\u007f]/u.test(defaultFontFamily)) {
+    throw new Error(`${FONT_FILES_ENV} and ${DEFAULT_FONT_FAMILY_ENV} must be configured together`);
+  }
+  const key = `${filesJson}\0${defaultFontFamily}`;
+  if (cachedFontAuthority?.key === key) return await cachedFontAuthority.value;
+  const value = validateConfiguredFontAuthority(filesJson, defaultFontFamily.trim());
+  cachedFontAuthority = { key, value };
+  return await value;
+}
+async function validateConfiguredFontAuthority(filesJson, defaultFontFamily) {
+  let requested;
+  try {
+    requested = JSON.parse(filesJson);
+  } catch {
+    throw new Error(`${FONT_FILES_ENV} must be a JSON array of absolute font file paths`);
+  }
+  if (!Array.isArray(requested) || requested.length === 0 || requested.length > MAX_FONT_FILES || requested.some((path) => typeof path !== "string" || path.length === 0)) {
+    throw new Error(`${FONT_FILES_ENV} must contain 1-${MAX_FONT_FILES} font file paths`);
+  }
+  const fileSystemSpecifier = "node:fs/promises";
+  const pathSpecifier = "node:path";
+  const [{ open, realpath, stat }, { isAbsolute }] = await Promise.all([
+    import(
+      /* @vite-ignore */
+      fileSystemSpecifier
+    ),
+    import(
+      /* @vite-ignore */
+      pathSpecifier
+    )
+  ]);
+  const fontFiles = await Promise.all(
+    requested.map(async (path) => {
+      if (!isAbsolute(path)) throw new Error(`${FONT_FILES_ENV} paths must be absolute`);
+      const canonical = await realpath(path);
+      const metadata = await stat(canonical);
+      if (!metadata.isFile() || metadata.size === 0 || metadata.size > MAX_FONT_FILE_BYTES) {
+        throw new Error(`Configured artifact raster font is not a bounded regular file: ${path}`);
+      }
+      const handle = await open(canonical, "r");
+      try {
+        const signature = new Uint8Array(4);
+        const { bytesRead } = await handle.read(signature, 0, signature.byteLength, 0);
+        const tag = new TextDecoder().decode(signature);
+        if (bytesRead !== 4 || tag !== "OTTO" && tag !== "ttcf" && !sameBytes(signature, [0, 1, 0, 0])) {
+          throw new Error(`Configured artifact raster font has an unsupported signature: ${path}`);
+        }
+      } finally {
+        await handle.close();
+      }
+      return canonical;
+    })
+  );
+  if (new Set(fontFiles).size !== fontFiles.length) {
+    throw new Error(`${FONT_FILES_ENV} must not contain duplicate files`);
+  }
+  return {
+    defaultFontFamily,
+    fontFiles,
+    loadSystemFonts: false
+  };
+}
+function sameBytes(actual, expected) {
+  return actual.length === expected.length && actual.every((value, index) => value === expected[index]);
+}
+
+export {
+  rasterizeSvgToPng
+};
+//# sourceMappingURL=chunk-XIFUNVBO.js.map

package/dist/chunk-XIFUNVBO.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/native-raster.ts"],"sourcesContent":["const FONT_FILES_ENV = \"OPENGENI_ARTIFACT_RASTER_FONT_FILES\";\nconst DEFAULT_FONT_FAMILY_ENV = \"OPENGENI_ARTIFACT_RASTER_DEFAULT_FONT_FAMILY\";\nconst MAX_FONT_FILES = 16;\nconst MAX_FONT_FILE_BYTES = 32 * 1024 * 1024;\n\ntype ResvgOptions = {\n  background?: string;\n  fitTo?: { mode: \"zoom\"; value: number };\n  font: {\n    defaultFontFamily?: string;\n    fontFiles?: string[];\n    loadSystemFonts: boolean;\n  };\n};\n\ntype ResvgRuntime = {\n  Resvg: new (svg: string, options: ResvgOptions) => { render(): { asPng(): Uint8Array } };\n};\n\ntype FontAuthority = ResvgOptions[\"font\"];\n\nlet cachedFontAuthority: { key: string; value: Promise<FontAuthority> } | undefined;\n\n/**\n * Rasterize with an explicit font authority when the host configures one.\n * Resvg otherwise succeeds while silently dropping every glyph on minimal\n * Linux images. Sandboxes pin regular/bold/italic-capable Liberation faces;\n * desktop installs retain their native system-font fallback.\n */\nexport async function rasterizeSvgToPng(\n  svg: string,\n  options: Readonly<{ background?: string; zoom?: number }> = {},\n): Promise<Uint8Array> {\n  const [{ Resvg }, font] = await Promise.all([\n    importNativeRuntime<ResvgRuntime>(\"@resvg/resvg-js\"),\n    rasterFontAuthority(),\n  ]);\n  const resvgOptions: ResvgOptions = {\n    ...(options.background === undefined ? {} : { background: options.background }),\n    ...(options.zoom === undefined\n      ? {}\n      : { fitTo: { mode: \"zoom\" as const, value: options.zoom } }),\n    font,\n  };\n  return Uint8Array.from(new Resvg(svg, resvgOptions).render().asPng());\n}\n\nasync function importNativeRuntime<T>(specifier: string): Promise<T> {\n  return (await import(/* @vite-ignore */ specifier)) as T;\n}\n\nasync function rasterFontAuthority(): Promise<FontAuthority> {\n  const environment = typeof process === \"undefined\" ? undefined : process.env;\n  const filesJson = environment?.[FONT_FILES_ENV];\n  const defaultFontFamily = environment?.[DEFAULT_FONT_FAMILY_ENV];\n  if (filesJson === undefined && defaultFontFamily === undefined) {\n    return { loadSystemFonts: true };\n  }\n  if (\n    !filesJson ||\n    filesJson.length > 8_192 ||\n    !defaultFontFamily?.trim() ||\n    defaultFontFamily.length > 128 ||\n    /[\\u0000-\\u001f\\u007f]/u.test(defaultFontFamily)\n  ) {\n    throw new Error(`${FONT_FILES_ENV} and ${DEFAULT_FONT_FAMILY_ENV} must be configured together`);\n  }\n  const key = `${filesJson}\\u0000${defaultFontFamily}`;\n  if (cachedFontAuthority?.key === key) return await cachedFontAuthority.value;\n  const value = validateConfiguredFontAuthority(filesJson, defaultFontFamily.trim());\n  cachedFontAuthority = { key, value };\n  return await value;\n}\n\nasync function validateConfiguredFontAuthority(\n  filesJson: string,\n  defaultFontFamily: string,\n): Promise<FontAuthority> {\n  let requested: unknown;\n  try {\n    requested = JSON.parse(filesJson);\n  } catch {\n    throw new Error(`${FONT_FILES_ENV} must be a JSON array of absolute font file paths`);\n  }\n  if (\n    !Array.isArray(requested) ||\n    requested.length === 0 ||\n    requested.length > MAX_FONT_FILES ||\n    requested.some((path) => typeof path !== \"string\" || path.length === 0)\n  ) {\n    throw new Error(`${FONT_FILES_ENV} must contain 1-${MAX_FONT_FILES} font file paths`);\n  }\n\n  // Keep browser HTML/SVG render paths free of Node builtins. This function is\n  // reached only by the native PNG/WebP branches with an explicit authority.\n  const fileSystemSpecifier = \"node:fs/promises\";\n  const pathSpecifier = \"node:path\";\n  const [{ open, realpath, stat }, { isAbsolute }] = await Promise.all([\n    import(/* @vite-ignore */ fileSystemSpecifier) as Promise<typeof import(\"node:fs/promises\")>,\n    import(/* @vite-ignore */ pathSpecifier) as Promise<typeof import(\"node:path\")>,\n  ]);\n  const fontFiles = await Promise.all(\n    requested.map(async (path) => {\n      if (!isAbsolute(path)) throw new Error(`${FONT_FILES_ENV} paths must be absolute`);\n      const canonical = await realpath(path);\n      const metadata = await stat(canonical);\n      if (!metadata.isFile() || metadata.size === 0 || metadata.size > MAX_FONT_FILE_BYTES) {\n        throw new Error(`Configured artifact raster font is not a bounded regular file: ${path}`);\n      }\n      const handle = await open(canonical, \"r\");\n      try {\n        const signature = new Uint8Array(4);\n        const { bytesRead } = await handle.read(signature, 0, signature.byteLength, 0);\n        const tag = new TextDecoder().decode(signature);\n        if (\n          bytesRead !== 4 ||\n          (tag !== \"OTTO\" && tag !== \"ttcf\" && !sameBytes(signature, [0, 1, 0, 0]))\n        ) {\n          throw new Error(`Configured artifact raster font has an unsupported signature: ${path}`);\n        }\n      } finally {\n        await handle.close();\n      }\n      return canonical;\n    }),\n  );\n  if (new Set(fontFiles).size !== fontFiles.length) {\n    throw new Error(`${FONT_FILES_ENV} must not contain duplicate files`);\n  }\n  return {\n    defaultFontFamily,\n    fontFiles,\n    loadSystemFonts: false,\n  };\n}\n\nfunction sameBytes(actual: Uint8Array, expected: readonly number[]): boolean {\n  return (\n    actual.length === expected.length && actual.every((value, index) => value === expected[index])\n  );\n}\n"],"mappings":";AAAA,IAAM,iBAAiB;AACvB,IAAM,0BAA0B;AAChC,IAAM,iBAAiB;AACvB,IAAM,sBAAsB,KAAK,OAAO;AAkBxC,IAAI;AAQJ,eAAsB,kBACpB,KACA,UAA4D,CAAC,GACxC;AACrB,QAAM,CAAC,EAAE,MAAM,GAAG,IAAI,IAAI,MAAM,QAAQ,IAAI;AAAA,IAC1C,oBAAkC,iBAAiB;AAAA,IACnD,oBAAoB;AAAA,EACtB,CAAC;AACD,QAAM,eAA6B;AAAA,IACjC,GAAI,QAAQ,eAAe,SAAY,CAAC,IAAI,EAAE,YAAY,QAAQ,WAAW;AAAA,IAC7E,GAAI,QAAQ,SAAS,SACjB,CAAC,IACD,EAAE,OAAO,EAAE,MAAM,QAAiB,OAAO,QAAQ,KAAK,EAAE;AAAA,IAC5D;AAAA,EACF;AACA,SAAO,WAAW,KAAK,IAAI,MAAM,KAAK,YAAY,EAAE,OAAO,EAAE,MAAM,CAAC;AACtE;AAEA,eAAe,oBAAuB,WAA+B;AACnE,SAAQ,MAAM;AAAA;AAAA,IAA0B;AAAA;AAC1C;AAEA,eAAe,sBAA8C;AAC3D,QAAM,cAAc,OAAO,YAAY,cAAc,SAAY,QAAQ;AACzE,QAAM,YAAY,cAAc,cAAc;AAC9C,QAAM,oBAAoB,cAAc,uBAAuB;AAC/D,MAAI,cAAc,UAAa,sBAAsB,QAAW;AAC9D,WAAO,EAAE,iBAAiB,KAAK;AAAA,EACjC;AACA,MACE,CAAC,aACD,UAAU,SAAS,QACnB,CAAC,mBAAmB,KAAK,KACzB,kBAAkB,SAAS,OAC3B,yBAAyB,KAAK,iBAAiB,GAC/C;AACA,UAAM,IAAI,MAAM,GAAG,cAAc,QAAQ,uBAAuB,8BAA8B;AAAA,EAChG;AACA,QAAM,MAAM,GAAG,SAAS,KAAS,iBAAiB;AAClD,MAAI,qBAAqB,QAAQ,IAAK,QAAO,MAAM,oBAAoB;AACvE,QAAM,QAAQ,gCAAgC,WAAW,kBAAkB,KAAK,CAAC;AACjF,wBAAsB,EAAE,KAAK,MAAM;AACnC,SAAO,MAAM;AACf;AAEA,eAAe,gCACb,WACA,mBACwB;AACxB,MAAI;AACJ,MAAI;AACF,gBAAY,KAAK,MAAM,SAAS;AAAA,EAClC,QAAQ;AACN,UAAM,IAAI,MAAM,GAAG,cAAc,mDAAmD;AAAA,EACtF;AACA,MACE,CAAC,MAAM,QAAQ,SAAS,KACxB,UAAU,WAAW,KACrB,UAAU,SAAS,kBACnB,UAAU,KAAK,CAAC,SAAS,OAAO,SAAS,YAAY,KAAK,WAAW,CAAC,GACtE;AACA,UAAM,IAAI,MAAM,GAAG,cAAc,mBAAmB,cAAc,kBAAkB;AAAA,EACtF;AAIA,QAAM,sBAAsB;AAC5B,QAAM,gBAAgB;AACtB,QAAM,CAAC,EAAE,MAAM,UAAU,KAAK,GAAG,EAAE,WAAW,CAAC,IAAI,MAAM,QAAQ,IAAI;AAAA,IACnE;AAAA;AAAA,MAA0B;AAAA;AAAA,IAC1B;AAAA;AAAA,MAA0B;AAAA;AAAA,EAC5B,CAAC;AACD,QAAM,YAAY,MAAM,QAAQ;AAAA,IAC9B,UAAU,IAAI,OAAO,SAAS;AAC5B,UAAI,CAAC,WAAW,IAAI,EAAG,OAAM,IAAI,MAAM,GAAG,cAAc,yBAAyB;AACjF,YAAM,YAAY,MAAM,SAAS,IAAI;AACrC,YAAM,WAAW,MAAM,KAAK,SAAS;AACrC,UAAI,CAAC,SAAS,OAAO,KAAK,SAAS,SAAS,KAAK,SAAS,OAAO,qBAAqB;AACpF,cAAM,IAAI,MAAM,kEAAkE,IAAI,EAAE;AAAA,MAC1F;AACA,YAAM,SAAS,MAAM,KAAK,WAAW,GAAG;AACxC,UAAI;AACF,cAAM,YAAY,IAAI,WAAW,CAAC;AAClC,cAAM,EAAE,UAAU,IAAI,MAAM,OAAO,KAAK,WAAW,GAAG,UAAU,YAAY,CAAC;AAC7E,cAAM,MAAM,IAAI,YAAY,EAAE,OAAO,SAAS;AAC9C,YACE,cAAc,KACb,QAAQ,UAAU,QAAQ,UAAU,CAAC,UAAU,WAAW,CAAC,GAAG,GAAG,GAAG,CAAC,CAAC,GACvE;AACA,gBAAM,IAAI,MAAM,iEAAiE,IAAI,EAAE;AAAA,QACzF;AAAA,MACF,UAAE;AACA,cAAM,OAAO,MAAM;AAAA,MACrB;AACA,aAAO;AAAA,IACT,CAAC;AAAA,EACH;AACA,MAAI,IAAI,IAAI,SAAS,EAAE,SAAS,UAAU,QAAQ;AAChD,UAAM,IAAI,MAAM,GAAG,cAAc,mCAAmC;AAAA,EACtE;AACA,SAAO;AAAA,IACL;AAAA,IACA;AAAA,IACA,iBAAiB;AAAA,EACnB;AACF;AAEA,SAAS,UAAU,QAAoB,UAAsC;AAC3E,SACE,OAAO,WAAW,SAAS,UAAU,OAAO,MAAM,CAAC,OAAO,UAAU,UAAU,SAAS,KAAK,CAAC;AAEjG;","names":[]}