@pipelex/mthds-form 0.8.0 → 0.10.0

package/dist/{chunk-R7B7ID25.js → chunk-IUWLOSAM.js}

@@ -2,8 +2,8 @@ import { pruneEmptyOptionals, healStringWrappers } from './chunk-GCXV76WU.js';
 import { prepareSchemaForRjsf } from './chunk-LBFZXYCY.js';
 import { isFilled, mustBeFilled, fieldFilled } from './chunk-PM55AHRO.js';
 import { validateRunInputsSchema } from './chunk-VTPUDBSJ.js';
-import { gatingFieldsFromInputs } from './chunk-YEVVR6FE.js';
-import { inputMustBeFilled, isOptionalInput, isPluralInput } from './chunk-XYQ7NXQZ.js';
+import { gatingFieldsFromInputs } from './chunk-Y2ND6W4W.js';
+import { inputMustBeFilled, isOptionalInput, isPluralInput } from './chunk-WYH56SOZ.js';
 import { ownProp } from './chunk-V3OV2XQT.js';
 
 // src/core/gate.ts
@@ -95,5 +95,5 @@ function gateRunInputs(contract, data) {
 }
 
 export { apiInputsFromSchemaData, buildRunInputsSchema, gateRunInputs, prepareRunInputs, validateRunInputs };
-//# sourceMappingURL=chunk-R7B7ID25.js.map
-//# sourceMappingURL=chunk-R7B7ID25.js.map
+//# sourceMappingURL=chunk-IUWLOSAM.js.map
+//# sourceMappingURL=chunk-IUWLOSAM.js.map

package/dist/{chunk-R7B7ID25.js.map → chunk-IUWLOSAM.js.map}

@@ -1 +1 @@
-{"version":3,"sources":["../src/core/gate.ts"],"names":[],"mappings":";;;;;;;;;AAqDO,SAAS,qBAAqB,MAAA,EAAiD;AACpF,EAAA,MAAM,aAAmB,EAAC;AAC1B,EAAA,MAAM,WAAqB,EAAC;AAE5B,EAAA,KAAA,MAAW,CAAC,OAAA,EAAS,KAAK,KAAK,MAAA,CAAO,OAAA,CAAQ,MAAM,CAAA,EAAG;AACrD,IAAA,MAAM,WAAA,GAAc,EAAE,GAAG,KAAA,CAAM,WAAA,EAAY;AAC3C,IAAA,WAAA,CAAY,KAAA,GAAQ,OAAA;AACpB,IAAA,IAAI,KAAA,CAAM,WAAA,IAAe,KAAA,CAAM,WAAA,KAAgB,OAAA,EAAS;AACtD,MAAA,WAAA,CAAY,cAAc,KAAA,CAAM,WAAA;AAAA,IAClC;AACA,IAAA,UAAA,CAAW,OAAO,CAAA,GAAI,WAAA;AACtB,IAAA,IAAI,iBAAA,CAAkB,KAAK,CAAA,EAAG,QAAA,CAAS,KAAK,OAAO,CAAA;AAAA,EACrD;AAEA,EAAA,OAAO,qBAAqB,EAAE,IAAA,EAAM,QAAA,EAAU,UAAA,EAAY,UAAU,CAAA;AACtE;AAaO,SAAS,gBAAA,CAAiB,MAAY,MAAA,EAAoB;AAC/D,EAAA,OAAO,mBAAA,CAAoB,kBAAA,CAAmB,IAAA,EAAM,MAAM,GAAG,MAAM,CAAA;AACrE;AA8BO,SAAS,iBAAA,CACd,YAAA,EACA,MAAA,EACA,MAAA,EACkB;AAClB,EAAA,MAAM,MAAA,GAAS,uBAAA,CAAwB,YAAA,EAAc,MAAM,CAAA;AAC3D,EAAA,IAAI,MAAA,CAAO,MAAA,KAAW,CAAA,EAAG,OAAO,EAAE,OAAA,EAAS,IAAA,EAAM,aAAA,EAAe,EAAC,EAAG,MAAA,EAAQ,EAAC,EAAE;AAE/E,EAAA,MAAM,OAAA,GACJ,OAAO,YAAA,KAAiB,QAAA,IAAY,YAAA,KAAiB,IAAA,IAAQ,CAAC,KAAA,CAAM,OAAA,CAAQ,YAAY,CAAA,GACnF,YAAA,GACD,MAAA;AACN,EAAA,MAAM,gBAA0B,EAAC;AACjC,EAAA,KAAA,MAAW,CAAC,OAAA,EAAS,KAAK,KAAK,MAAA,CAAO,OAAA,CAAQ,MAAM,CAAA,EAAG;AACrD,IAAA,IAAI,CAAC,iBAAA,CAAkB,KAAK,CAAA,EAAG;AAC/B,IAAA,MAAM,OAAA,GAAU,OAAA,CAAQ,OAAA,EAAS,OAAO,CAAA;AAMxC,IAAA,IAAI,WAAW,IAAA,EAAM;AACnB,MAAA,aAAA,CAAc,KAAK,OAAO,CAAA;AAC1B,MAAA;AAAA,IACF;AACA,IAAA,MAAM,cAAc,KAAA,CAAM,WAAA;AAC1B,IAAA,MAAM,cAAA,GAAkB,WAAA,CAAY,QAAA,IAAyB,EAAC;AAC9D,IAAA,IAAI,cAAA,CAAe,WAAW,CAAA,EAAG;AACjC,IAAA,IAAI,OAAO,YAAY,QAAA,EAAU;AAC/B,MAAA,aAAA,CAAc,KAAK,OAAO,CAAA;AAC1B,MAAA;AAAA,IACF;AACA,IAAA,MAAM,MAAA,GAAS,OAAA;AACf,IAAA,IACE,cAAA,CAAe,IAAA,CAAK,CAAC,CAAA,KAAM;AACzB,MAAA,MAAM,KAAA,GAAQ,OAAA,CAAQ,MAAA,EAAQ,CAAC,CAAA;AAC/B,MAAA,OAAO,KAAA,KAAU,UAAa,KAAA,KAAU,EAAA;AAAA,IAC1C,CAAC,CAAA,EACD;AACA,MAAA,aAAA,CAAc,KAAK,OAAO,CAAA;AAAA,IAC5B;AAAA,EACF;AAEA,EAAA,OAAO,EAAE,OAAA,EAAS,KAAA,EAAO,aAAA,EAAe,MAAA,EAAO;AACjD;AAyBO,SAAS,uBAAA,CACd,cACA,MAAA,EACM;AACN,EAAA,MAAM,MAAY,EAAC;AACnB,EAAA,KAAA,MAAW,CAAC,OAAA,EAAS,KAAK,KAAK,MAAA,CAAO,OAAA,CAAQ,MAAM,CAAA,EAAG;AACrD,IAAA,MAAM,GAAA,GAAM,OAAA,CAAQ,YAAA,EAAc,OAAO,CAAA;AACzC,IAAA,IAAI,gBAAgB,KAAK,CAAA,IAAK,CAAC,QAAA,CAAS,GAAG,CAAA,EAAG;AAC9C,IAAA,IAAI,cAAc,KAAK,CAAA,IAAK,CAAC,QAAA,CAAS,GAAG,CAAA,EAAG;AAC1C,MAAA,GAAA,CAAI,OAAO,IAAI,EAAC;AAChB,MAAA;AAAA,IACF;AACA,IAAA,MAAM,OAAA,GAAU,aAAA,CAAc,KAAK,CAAA,IAAK,CAAC,MAAM,OAAA,CAAQ,GAAG,CAAA,GAAI,EAAC,GAAI,GAAA;AACnE,IAAA,GAAA,CAAI,OAAO,CAAA,GAAI,EAAE,OAAA,EAAS,KAAA,CAAM,aAAa,OAAA,EAAQ;AAAA,EACvD;AACA,EAAA,OAAO,GAAA;AACT;AAkCA,IAAM,YAAA,uBAAmB,OAAA,EAA8B;AAEvD,SAAS,kBAAkB,QAAA,EAAgC;AACzD,EAAA,MAAM,MAAA,GAAS,YAAA,CAAa,GAAA,CAAI,QAAQ,CAAA;AACxC,EAAA,IAAI,QAAQ,OAAO,MAAA;AACnB,EAAA,MAAM,MAAA,GAAS,oBAAA,CAAqB,QAAA,CAAS,MAAM,CAAA;AACnD,EAAA,YAAA,CAAa,GAAA,CAAI,UAAU,MAAM,CAAA;AACjC,EAAA,OAAO,MAAA;AACT;AA+CO,SAAS,aAAA,CAAc,UAA0B,IAAA,EAAoC;AAC1F,EAAA,MAAM,QAAA,GAAW,OAAO,IAAA,KAAS,QAAA,IAAY,SAAS,IAAA,IAAQ,CAAC,KAAA,CAAM,OAAA,CAAQ,IAAI,CAAA;AACjF,EAAA,MAAM,OAAA,GAAU,QAAA,GAAY,IAAA,GAAgB,EAAC;AAC7C,EAAA,MAAM,MAAA,GAAS,kBAAkB,QAAQ,CAAA;AACzC,EAAA,MAAM,YAAA,GAAe,gBAAA,CAAiB,OAAA,EAAS,MAAM,CAAA;AAGrD,EAAA,MAAM,UAAU,iBAAA,CAAkB,QAAA,GAAW,eAAe,IAAA,EAAM,QAAA,CAAS,QAAQ,MAAM,CAAA;AACzF,EAAA,IAAI,CAAC,QAAQ,OAAA,EAAS;AACpB,IAAA,OAAO;AAAA,MACL,EAAA,EAAI,KAAA;AAAA,MACJ,eAAe,OAAA,CAAQ,aAAA;AAAA,MACvB,QAAQ,OAAA,CAAQ,MAAA;AAAA,MAChB;AAAA,KACF;AAAA,EACF;AAmBA,EAAA,MAAM,gBAAgB,sBAAA,CAAuB,QAAA,CAAS,MAAM,CAAA,CACzD,OAAO,CAAC,KAAA,KAAU,YAAA,CAAa,KAAK,KAAK,QAAA,CAAS,OAAA,CAAQ,YAAA,EAAc,KAAA,CAAM,IAAI,CAAC,CAAC,CAAA,CACpF,MAAA,CAAO,CAAC,KAAA,KAAU,CAAC,WAAA,CAAY,KAAA,EAAO,QAAQ,YAAA,EAAc,KAAA,CAAM,IAAI,CAAC,CAAC,CAAA,CACxE,GAAA,CAAI,CAAC,KAAA,KAAU,MAAM,IAAI,CAAA;AAC5B,EAAA,IAAI,aAAA,CAAc,MAAA,EAAQ,OAAO,EAAE,EAAA,EAAI,OAAO,aAAA,EAAe,MAAA,EAAQ,EAAC,EAAG,YAAA,EAAa;AAEtF,EAAA,OAAO,EAAE,IAAI,IAAA,EAAM,MAAA,EAAQ,wBAAwB,YAAA,EAAc,QAAA,CAAS,MAAM,CAAA,EAAE;AACpF","file":"chunk-R7B7ID25.js","sourcesContent":["/**\n * The gate every run passes through, whichever surface starts it.\n *\n * A host may offer more than one place to run a method - a schema-driven\n * inputs panel (an RJSF form) and a standalone run page (a bespoke field\n * renderer), say. **Only the rendering of inputs differs.** Everything between\n * \"the user pressed Run\" and \"the payload goes on the wire\" lives here, so\n * those surfaces cannot drift:\n *\n *   1. `buildRunInputsSchema` - the combined JSON Schema, whose `required` list\n *      is `inputMustBeFilled` (optional `?` and variable-plural `[]` never\n *      block; a fixed-count `[N]` list does).\n *   2. `prepareRunInputs` - heal legacy wrappers, then prune empty optionals.\n *   3. `validateRunInputs` - ajv, plus the missing-input scan that names the\n *      VARIABLE at fault.\n *   4. `apiInputsFromSchemaData` - the `{concept, content}` payload, built from\n *      the PREPARED data so the pruning reaches the wire too.\n *\n * **`gateRunInputs` is that whole chain as one call**, and it is what a server\n * should use. The four steps stay exported because a host that renders its own\n * panel needs the schema and the verdict separately, but assembling them is not\n * a host's job: the step between validation and the payload is an emptiness\n * check with four look-alike predicates to choose from, only two of which are\n * the ones the Run button reads, and choosing the near-miss pair produces a\n * server that is more permissive than the button in front of it.\n *\n * This module is pure: no React, no toasts, no i18n. Each caller renders the\n * verdict in its own idiom.\n */\nimport { inputMustBeFilled, isOptionalInput, isPluralInput } from './contracts';\nimport { gatingFieldsFromInputs } from './gating-fields';\nimport { fieldFilled, isFilled, mustBeFilled } from './readiness';\nimport { validateRunInputsSchema, type RunInputError } from './gate-validator';\nimport { healStringWrappers, pruneEmptyOptionals } from './wire-format';\nimport { prepareSchemaForRjsf } from './normalize-schema';\nimport { ownProp } from './own-property';\nimport type { PipeIOContract, PipeInputContract } from './contracts';\n\ntype Dict = Record<string, unknown>;\n\n/**\n * Combine the per-input schemas into one object schema.\n *\n * Each input variable becomes a property, titled with the variable name and\n * described with the concept code. Only the inputs the method actually demands\n * land in `required` - an optional (`?`) or variable-plural (`[]`) input must\n * not block the form (see `inputMustBeFilled`).\n *\n * The per-input schema travels verbatim, which is how a fixed-count (`[N]`)\n * list's declared count reaches ajv: pipelex states it as `minItems`/`maxItems`\n * on the array wrapper, so the count is enforced here without the kernel\n * restating it.\n */\nexport function buildRunInputsSchema(inputs: Record<string, PipeInputContract>): Dict {\n  const properties: Dict = {};\n  const required: string[] = [];\n\n  for (const [varName, input] of Object.entries(inputs)) {\n    const inputSchema = { ...input.json_schema } as Dict;\n    inputSchema.title = varName;\n    if (input.concept_ref && input.concept_ref !== varName) {\n      inputSchema.description = input.concept_ref;\n    }\n    properties[varName] = inputSchema;\n    if (inputMustBeFilled(input)) required.push(varName);\n  }\n\n  return prepareSchemaForRjsf({ type: 'object', properties, required });\n}\n\n/**\n * Last-gate repair, in two passes against the exact schema ajv validates.\n *\n * 1. **HEAL** - persisted `inputData` may still carry the legacy double-wrapped\n *    `{ text: { text } }` shape (or a form's state may lag a store fix).\n * 2. **PRUNE** - RJSF fills every unset string with `\"\"` on mount, which an\n *    optional CONSTRAINED field rejects (`DateContent.time` is `format: \"time\"`)\n *    - blocking a run on a field the user never opened. An absent optional field\n *    is what pipelex means by `None` anyway, so dropping it is the semantically\n *    correct repair, not a validation dodge.\n */\nexport function prepareRunInputs(data: Dict, schema: Dict): Dict {\n  return pruneEmptyOptionals(healStringWrappers(data, schema), schema) as Dict;\n}\n\nexport interface RunInputsVerdict {\n  isValid: boolean;\n  /** Variable names the scan could pin a missing required field on. */\n  missingInputs: string[];\n  /** Raw ajv errors, for when the scan cannot name anything. */\n  errors: RunInputError[];\n}\n\n/**\n * Validate PREPARED data against the combined schema.\n *\n * `missingInputs` is reported by VARIABLE NAME - the name on the node the user\n * clicks - never by `concept_ref`, which used to produce \"Missing required\n * fields in: native.Text\" and named neither the input at fault nor, when several\n * inputs share a concept, which of them. Inputs the method declared omittable\n * are skipped: an empty `?` input is not a missing one.\n *\n * The scan can come up empty even on an invalid form (a wrong value shape, a\n * nested mismatch); `errors` is what the caller falls back to then, so a failure\n * is never undiagnosable.\n *\n * `preparedData` is `unknown` for the same reason `gateRunInputs`' `data` is: on\n * a public endpoint the body is whatever was sent, and ajv must be shown that\n * rather than a repair of it, or `must be object` is a verdict no caller can\n * ever receive. The name-the-variable scan below needs something indexable, so\n * a body that is not a record scans against nothing and names every input the\n * method demands - which is the honest answer for a body that carried none.\n */\nexport function validateRunInputs(\n  preparedData: unknown,\n  inputs: Record<string, PipeInputContract>,\n  schema: Dict,\n): RunInputsVerdict {\n  const errors = validateRunInputsSchema(preparedData, schema);\n  if (errors.length === 0) return { isValid: true, missingInputs: [], errors: [] };\n\n  const record0 =\n    typeof preparedData === 'object' && preparedData !== null && !Array.isArray(preparedData)\n      ? (preparedData as Dict)\n      : undefined;\n  const missingInputs: string[] = [];\n  for (const [varName, input] of Object.entries(inputs)) {\n    if (!inputMustBeFilled(input)) continue;\n    const varData = ownProp(record0, varName);\n    // A demanded input that is not there at all is missing whatever its concept\n    // declares inside. The check has to come BEFORE the required-children one:\n    // a struct whose concept demands no child used to fall out of the scan\n    // here, so the run was refused by the combined schema's `required` list\n    // while the scan named nothing and the caller could only quote ajv.\n    if (varData == null) {\n      missingInputs.push(varName);\n      continue;\n    }\n    const inputSchema = input.json_schema as Dict;\n    const requiredFields = (inputSchema.required as string[]) || [];\n    if (requiredFields.length === 0) continue;\n    if (typeof varData !== 'object') {\n      missingInputs.push(varName);\n      continue;\n    }\n    const record = varData as Dict;\n    if (\n      requiredFields.some((f) => {\n        const child = ownProp(record, f);\n        return child === undefined || child === '';\n      })\n    ) {\n      missingInputs.push(varName);\n    }\n  }\n\n  return { isValid: false, missingInputs, errors };\n}\n\n/**\n * Build the `{ concept, content }` map a run expects, from PREPARED data.\n *\n * The two ways a method says \"this may be nothing\" land differently on the wire:\n * - an **optional (`?`)** input left blank is OMITTED, so the runtime records a\n *   real absence the method can branch on - sending `{ text: \"\" }` would look\n *   like the caller supplied an empty string;\n * - a **plural (`[]`)** input keeps its key, because a plural slot is never\n *   absent - its empty form IS the empty list, and the runtime requires the key.\n *   When that list is EMPTY it is sent BARE, without the envelope: the envelope\n *   is the runtime's \"explicit form\", which bypasses the top-down shaper and\n *   hands the value to the bottom-up factory, and that factory types a list from\n *   its first item - so an empty list there raises \"Cannot create Stuff from\n *   empty list in content\". The bare form keeps the shaper, which reads the\n *   DECLARED concept and builds the empty list correctly. (pipelex/#1096 makes\n *   the envelope agree; the bare form runs today and stays correct after.)\n *\n * A fixed-count (`[N]`) list takes that same empty-list path, and an empty one\n * is not a payload the method can accept. It is unreachable through the gate,\n * which demands the input and rejects a short list on `minItems`; building the\n * payload straight from unvalidated data is what would reach it, and inventing\n * a different absence here would only hide that.\n */\nexport function apiInputsFromSchemaData(\n  preparedData: Dict,\n  inputs: Record<string, PipeInputContract>,\n): Dict {\n  const out: Dict = {};\n  for (const [varName, input] of Object.entries(inputs)) {\n    const raw = ownProp(preparedData, varName);\n    if (isOptionalInput(input) && !isFilled(raw)) continue;\n    if (isPluralInput(input) && !isFilled(raw)) {\n      out[varName] = [];\n      continue;\n    }\n    const content = isPluralInput(input) && !Array.isArray(raw) ? [] : raw;\n    out[varName] = { concept: input.concept_ref, content };\n  }\n  return out;\n}\n\n// ─── The whole chain, as one call ────────────────────────────────────────────\n\n/** The gate's verdict: the payload to send, or why the run may not start. */\nexport type RunInputsGateResult =\n  | { ok: true; inputs: Dict }\n  | {\n      ok: false;\n      /** Variable names the caller left empty or short. */\n      missingInputs: string[];\n      /** Raw ajv errors, for when the scan cannot name anything. */\n      errors: RunInputError[];\n      /** The repaired data the verdict was reached on - what\n       *  `describeValidationError` needs to quote the value it received. */\n      preparedData: Dict;\n    };\n\n/**\n * One schema object per contract, for the lifetime of the process.\n *\n * `buildRunInputsSchema` is a pure function of the contract, so rebuilding it is\n * *semantically* free - but validation runs through a module-level ajv whose\n * compiled-schema cache is keyed on **schema object identity** and is never\n * evicted. A fresh object per call therefore misses every time and retains\n * another compiled validator. On a publicly callable server endpoint that is\n * unbounded growth driven by the cheapest request there is: an empty body,\n * rejected in a fraction of a millisecond, costing nothing to send.\n *\n * Weakly keyed so the map never pins a contract that goes out of scope. The\n * schema a run has been gated against is pinned for the process lifetime anyway\n * by ajv's own cache; the point is that the NUMBER of them is bounded by the\n * number of distinct contracts rather than by traffic.\n */\nconst SCHEMA_CACHE = new WeakMap<PipeIOContract, Dict>();\n\nfunction schemaForContract(contract: PipeIOContract): Dict {\n  const cached = SCHEMA_CACHE.get(contract);\n  if (cached) return cached;\n  const schema = buildRunInputsSchema(contract.inputs);\n  SCHEMA_CACHE.set(contract, schema);\n  return schema;\n}\n\n/**\n * Gate a run: repair the caller's data, validate it against the contract,\n * refuse anything the Run button would have refused, and build the payload.\n *\n * Returns a verdict rather than throwing. A server endpoint must not throw\n * across the boundary to its client - frameworks routinely strip the message to\n * an opaque digest in a production build - and a rejection here is an ordinary\n * outcome, not an exceptional one.\n *\n * **`data` is `unknown` because that is what it is.** A run endpoint is public\n * and no framework enforces a declared parameter type, so the argument is\n * whatever the caller put in the body. The chain indexes the payload by\n * variable name without first checking it is indexable, so a `null` body would\n * throw *after* ajv had already reported `must be object` and before any\n * verdict came back.\n *\n * So the two uses are separated rather than collapsed into one repair. **ajv\n * judges the value the caller actually sent**, which is what makes `must be\n * object` the verdict for a body that is not one; the indexing that follows\n * uses a safe `{}` stand-in, which is what keeps the gate from throwing. Repair\n * FIRST - coercing a non-object to `{}` before validating - is the shape that\n * looks equivalent and is not: a contract whose inputs are all optional has an\n * empty `required` list, so `{}` validates, and `gateRunInputs(\"garbage\", …)`\n * came back `ok: true` on a body the caller never meant as a run. Fail-closed\n * costs a malformed caller an error it earned; the other direction bills a run.\n *\n * **The schema alone is not the rule.** ajv's `required` asserts only that a\n * key is PRESENT, and a content model carries no `minLength` - so a required\n * input that arrived empty (`{document: {url: \"\"}}`, `{text: {text: \"\"}}`)\n * satisfies the schema. That is the natural payload, not a contrived one:\n * `rjsfDataFromRunValues({}, fields)` emits exactly that when nothing is\n * selected. So the gate re-applies the emptiness rule using\n * `computeReadiness`'s OWN two functions over the same derived fields, which is\n * the only way to be sure the two sides cannot disagree.\n *\n * Picking a pair that merely looks equivalent is not enough, and this is the\n * whole reason the assembly lives here rather than in each host: the obvious\n * choice, `inputMustBeFilled` + `isFilled`, agrees on every leaf kind and\n * diverges on a structured concept in BOTH directions - `isFilled` on an object\n * is `some(child filled)` where `fieldFilled` is `every(required child\n * filled)`. That accepts a half-filled struct the browser refuses (a paid run\n * past a disabled button) and rejects a filled all-optional struct the browser\n * accepts. A host whose methods happen to use only native concepts has no test\n * that can catch either.\n */\nexport function gateRunInputs(contract: PipeIOContract, data: unknown): RunInputsGateResult {\n  const isRecord = typeof data === 'object' && data !== null && !Array.isArray(data);\n  const payload = isRecord ? (data as Dict) : {};\n  const schema = schemaForContract(contract);\n  const preparedData = prepareRunInputs(payload, schema);\n\n  // The value ajv is shown is the caller's, not the stand-in - see above.\n  const verdict = validateRunInputs(isRecord ? preparedData : data, contract.inputs, schema);\n  if (!verdict.isValid) {\n    return {\n      ok: false,\n      missingInputs: verdict.missingInputs,\n      errors: verdict.errors,\n      preparedData,\n    };\n  }\n\n  // The SELECTION is half the rule, and leaving it out is what made the two\n  // halves disagree. `computeReadiness` reckons with an input the method\n  // demands AND one it left optional that the user has touched - because a\n  // structure with something in it owes its concept every field the concept\n  // declares. Filtering on `mustBeFilled` alone dropped the second kind, so a\n  // half-filled optional struct was refused by the button and accepted here.\n  //\n  // ajv cannot cover for it: a required child that is a plain string arrives as\n  // `''`, which satisfies `required`. And the payload builder below then SENDS\n  // that input, because `isFilled` is exactly what it tests. Which is the rule\n  // stated properly: the gate holds to its concept precisely the inputs it is\n  // about to put on the wire, and nothing it will omit.\n  //\n  // The tree the predicates run over is the gate's own, walked structurally\n  // from the same `json_schema` ajv just validated - NOT the render tree, which\n  // is built from the input-form descriptor. A server validating a payload must\n  // never need that presentation artifact; see `gating-fields.ts`.\n  const missingInputs = gatingFieldsFromInputs(contract.inputs)\n    .filter((field) => mustBeFilled(field) || isFilled(ownProp(preparedData, field.name)))\n    .filter((field) => !fieldFilled(field, ownProp(preparedData, field.name)))\n    .map((field) => field.name);\n  if (missingInputs.length) return { ok: false, missingInputs, errors: [], preparedData };\n\n  return { ok: true, inputs: apiInputsFromSchemaData(preparedData, contract.inputs) };\n}\n"]}
+{"version":3,"sources":["../src/core/gate.ts"],"names":[],"mappings":";;;;;;;;;AAqDO,SAAS,qBAAqB,MAAA,EAAiD;AACpF,EAAA,MAAM,aAAmB,EAAC;AAC1B,EAAA,MAAM,WAAqB,EAAC;AAE5B,EAAA,KAAA,MAAW,CAAC,OAAA,EAAS,KAAK,KAAK,MAAA,CAAO,OAAA,CAAQ,MAAM,CAAA,EAAG;AACrD,IAAA,MAAM,WAAA,GAAc,EAAE,GAAG,KAAA,CAAM,WAAA,EAAY;AAC3C,IAAA,WAAA,CAAY,KAAA,GAAQ,OAAA;AACpB,IAAA,IAAI,KAAA,CAAM,WAAA,IAAe,KAAA,CAAM,WAAA,KAAgB,OAAA,EAAS;AACtD,MAAA,WAAA,CAAY,cAAc,KAAA,CAAM,WAAA;AAAA,IAClC;AACA,IAAA,UAAA,CAAW,OAAO,CAAA,GAAI,WAAA;AACtB,IAAA,IAAI,iBAAA,CAAkB,KAAK,CAAA,EAAG,QAAA,CAAS,KAAK,OAAO,CAAA;AAAA,EACrD;AAEA,EAAA,OAAO,qBAAqB,EAAE,IAAA,EAAM,QAAA,EAAU,UAAA,EAAY,UAAU,CAAA;AACtE;AAaO,SAAS,gBAAA,CAAiB,MAAY,MAAA,EAAoB;AAC/D,EAAA,OAAO,mBAAA,CAAoB,kBAAA,CAAmB,IAAA,EAAM,MAAM,GAAG,MAAM,CAAA;AACrE;AA8BO,SAAS,iBAAA,CACd,YAAA,EACA,MAAA,EACA,MAAA,EACkB;AAClB,EAAA,MAAM,MAAA,GAAS,uBAAA,CAAwB,YAAA,EAAc,MAAM,CAAA;AAC3D,EAAA,IAAI,MAAA,CAAO,MAAA,KAAW,CAAA,EAAG,OAAO,EAAE,OAAA,EAAS,IAAA,EAAM,aAAA,EAAe,EAAC,EAAG,MAAA,EAAQ,EAAC,EAAE;AAE/E,EAAA,MAAM,OAAA,GACJ,OAAO,YAAA,KAAiB,QAAA,IAAY,YAAA,KAAiB,IAAA,IAAQ,CAAC,KAAA,CAAM,OAAA,CAAQ,YAAY,CAAA,GACnF,YAAA,GACD,MAAA;AACN,EAAA,MAAM,gBAA0B,EAAC;AACjC,EAAA,KAAA,MAAW,CAAC,OAAA,EAAS,KAAK,KAAK,MAAA,CAAO,OAAA,CAAQ,MAAM,CAAA,EAAG;AACrD,IAAA,IAAI,CAAC,iBAAA,CAAkB,KAAK,CAAA,EAAG;AAC/B,IAAA,MAAM,OAAA,GAAU,OAAA,CAAQ,OAAA,EAAS,OAAO,CAAA;AAMxC,IAAA,IAAI,WAAW,IAAA,EAAM;AACnB,MAAA,aAAA,CAAc,KAAK,OAAO,CAAA;AAC1B,MAAA;AAAA,IACF;AACA,IAAA,MAAM,cAAc,KAAA,CAAM,WAAA;AAC1B,IAAA,MAAM,cAAA,GAAkB,WAAA,CAAY,QAAA,IAAyB,EAAC;AAC9D,IAAA,IAAI,cAAA,CAAe,WAAW,CAAA,EAAG;AACjC,IAAA,IAAI,OAAO,YAAY,QAAA,EAAU;AAC/B,MAAA,aAAA,CAAc,KAAK,OAAO,CAAA;AAC1B,MAAA;AAAA,IACF;AACA,IAAA,MAAM,MAAA,GAAS,OAAA;AACf,IAAA,IACE,cAAA,CAAe,IAAA,CAAK,CAAC,CAAA,KAAM;AACzB,MAAA,MAAM,KAAA,GAAQ,OAAA,CAAQ,MAAA,EAAQ,CAAC,CAAA;AAC/B,MAAA,OAAO,KAAA,KAAU,UAAa,KAAA,KAAU,EAAA;AAAA,IAC1C,CAAC,CAAA,EACD;AACA,MAAA,aAAA,CAAc,KAAK,OAAO,CAAA;AAAA,IAC5B;AAAA,EACF;AAEA,EAAA,OAAO,EAAE,OAAA,EAAS,KAAA,EAAO,aAAA,EAAe,MAAA,EAAO;AACjD;AAyBO,SAAS,uBAAA,CACd,cACA,MAAA,EACM;AACN,EAAA,MAAM,MAAY,EAAC;AACnB,EAAA,KAAA,MAAW,CAAC,OAAA,EAAS,KAAK,KAAK,MAAA,CAAO,OAAA,CAAQ,MAAM,CAAA,EAAG;AACrD,IAAA,MAAM,GAAA,GAAM,OAAA,CAAQ,YAAA,EAAc,OAAO,CAAA;AACzC,IAAA,IAAI,gBAAgB,KAAK,CAAA,IAAK,CAAC,QAAA,CAAS,GAAG,CAAA,EAAG;AAC9C,IAAA,IAAI,cAAc,KAAK,CAAA,IAAK,CAAC,QAAA,CAAS,GAAG,CAAA,EAAG;AAC1C,MAAA,GAAA,CAAI,OAAO,IAAI,EAAC;AAChB,MAAA;AAAA,IACF;AACA,IAAA,MAAM,OAAA,GAAU,aAAA,CAAc,KAAK,CAAA,IAAK,CAAC,MAAM,OAAA,CAAQ,GAAG,CAAA,GAAI,EAAC,GAAI,GAAA;AACnE,IAAA,GAAA,CAAI,OAAO,CAAA,GAAI,EAAE,OAAA,EAAS,KAAA,CAAM,aAAa,OAAA,EAAQ;AAAA,EACvD;AACA,EAAA,OAAO,GAAA;AACT;AAkCA,IAAM,YAAA,uBAAmB,OAAA,EAA8B;AAEvD,SAAS,kBAAkB,QAAA,EAAgC;AACzD,EAAA,MAAM,MAAA,GAAS,YAAA,CAAa,GAAA,CAAI,QAAQ,CAAA;AACxC,EAAA,IAAI,QAAQ,OAAO,MAAA;AACnB,EAAA,MAAM,MAAA,GAAS,oBAAA,CAAqB,QAAA,CAAS,MAAM,CAAA;AACnD,EAAA,YAAA,CAAa,GAAA,CAAI,UAAU,MAAM,CAAA;AACjC,EAAA,OAAO,MAAA;AACT;AA+CO,SAAS,aAAA,CAAc,UAA0B,IAAA,EAAoC;AAC1F,EAAA,MAAM,QAAA,GAAW,OAAO,IAAA,KAAS,QAAA,IAAY,SAAS,IAAA,IAAQ,CAAC,KAAA,CAAM,OAAA,CAAQ,IAAI,CAAA;AACjF,EAAA,MAAM,OAAA,GAAU,QAAA,GAAY,IAAA,GAAgB,EAAC;AAC7C,EAAA,MAAM,MAAA,GAAS,kBAAkB,QAAQ,CAAA;AACzC,EAAA,MAAM,YAAA,GAAe,gBAAA,CAAiB,OAAA,EAAS,MAAM,CAAA;AAGrD,EAAA,MAAM,UAAU,iBAAA,CAAkB,QAAA,GAAW,eAAe,IAAA,EAAM,QAAA,CAAS,QAAQ,MAAM,CAAA;AACzF,EAAA,IAAI,CAAC,QAAQ,OAAA,EAAS;AACpB,IAAA,OAAO;AAAA,MACL,EAAA,EAAI,KAAA;AAAA,MACJ,eAAe,OAAA,CAAQ,aAAA;AAAA,MACvB,QAAQ,OAAA,CAAQ,MAAA;AAAA,MAChB;AAAA,KACF;AAAA,EACF;AAmBA,EAAA,MAAM,gBAAgB,sBAAA,CAAuB,QAAA,CAAS,MAAM,CAAA,CACzD,OAAO,CAAC,KAAA,KAAU,YAAA,CAAa,KAAK,KAAK,QAAA,CAAS,OAAA,CAAQ,YAAA,EAAc,KAAA,CAAM,IAAI,CAAC,CAAC,CAAA,CACpF,MAAA,CAAO,CAAC,KAAA,KAAU,CAAC,WAAA,CAAY,KAAA,EAAO,QAAQ,YAAA,EAAc,KAAA,CAAM,IAAI,CAAC,CAAC,CAAA,CACxE,GAAA,CAAI,CAAC,KAAA,KAAU,MAAM,IAAI,CAAA;AAC5B,EAAA,IAAI,aAAA,CAAc,MAAA,EAAQ,OAAO,EAAE,EAAA,EAAI,OAAO,aAAA,EAAe,MAAA,EAAQ,EAAC,EAAG,YAAA,EAAa;AAEtF,EAAA,OAAO,EAAE,IAAI,IAAA,EAAM,MAAA,EAAQ,wBAAwB,YAAA,EAAc,QAAA,CAAS,MAAM,CAAA,EAAE;AACpF","file":"chunk-IUWLOSAM.js","sourcesContent":["/**\n * The gate every run passes through, whichever surface starts it.\n *\n * A host may offer more than one place to run a method - a schema-driven\n * inputs panel (an RJSF form) and a standalone run page (a bespoke field\n * renderer), say. **Only the rendering of inputs differs.** Everything between\n * \"the user pressed Run\" and \"the payload goes on the wire\" lives here, so\n * those surfaces cannot drift:\n *\n *   1. `buildRunInputsSchema` - the combined JSON Schema, whose `required` list\n *      is `inputMustBeFilled` (optional `?` and variable-plural `[]` never\n *      block; a fixed-count `[N]` list does).\n *   2. `prepareRunInputs` - heal legacy wrappers, then prune empty optionals.\n *   3. `validateRunInputs` - ajv, plus the missing-input scan that names the\n *      VARIABLE at fault.\n *   4. `apiInputsFromSchemaData` - the `{concept, content}` payload, built from\n *      the PREPARED data so the pruning reaches the wire too.\n *\n * **`gateRunInputs` is that whole chain as one call**, and it is what a server\n * should use. The four steps stay exported because a host that renders its own\n * panel needs the schema and the verdict separately, but assembling them is not\n * a host's job: the step between validation and the payload is an emptiness\n * check with four look-alike predicates to choose from, only two of which are\n * the ones the Run button reads, and choosing the near-miss pair produces a\n * server that is more permissive than the button in front of it.\n *\n * This module is pure: no React, no toasts, no i18n. Each caller renders the\n * verdict in its own idiom.\n */\nimport { inputMustBeFilled, isOptionalInput, isPluralInput } from './contracts';\nimport { gatingFieldsFromInputs } from './gating-fields';\nimport { fieldFilled, isFilled, mustBeFilled } from './readiness';\nimport { validateRunInputsSchema, type RunInputError } from './gate-validator';\nimport { healStringWrappers, pruneEmptyOptionals } from './wire-format';\nimport { prepareSchemaForRjsf } from './normalize-schema';\nimport { ownProp } from './own-property';\nimport type { PipeIOContract, PipeInputContract } from './contracts';\n\ntype Dict = Record<string, unknown>;\n\n/**\n * Combine the per-input schemas into one object schema.\n *\n * Each input variable becomes a property, titled with the variable name and\n * described with the concept code. Only the inputs the method actually demands\n * land in `required` - an optional (`?`) or variable-plural (`[]`) input must\n * not block the form (see `inputMustBeFilled`).\n *\n * The per-input schema travels verbatim, which is how a fixed-count (`[N]`)\n * list's declared count reaches ajv: pipelex states it as `minItems`/`maxItems`\n * on the array wrapper, so the count is enforced here without the kernel\n * restating it.\n */\nexport function buildRunInputsSchema(inputs: Record<string, PipeInputContract>): Dict {\n  const properties: Dict = {};\n  const required: string[] = [];\n\n  for (const [varName, input] of Object.entries(inputs)) {\n    const inputSchema = { ...input.json_schema } as Dict;\n    inputSchema.title = varName;\n    if (input.concept_ref && input.concept_ref !== varName) {\n      inputSchema.description = input.concept_ref;\n    }\n    properties[varName] = inputSchema;\n    if (inputMustBeFilled(input)) required.push(varName);\n  }\n\n  return prepareSchemaForRjsf({ type: 'object', properties, required });\n}\n\n/**\n * Last-gate repair, in two passes against the exact schema ajv validates.\n *\n * 1. **HEAL** - persisted `inputData` may still carry the legacy double-wrapped\n *    `{ text: { text } }` shape (or a form's state may lag a store fix).\n * 2. **PRUNE** - RJSF fills every unset string with `\"\"` on mount, which an\n *    optional CONSTRAINED field rejects (`DateContent.time` is `format: \"time\"`)\n *    - blocking a run on a field the user never opened. An absent optional field\n *    is what pipelex means by `None` anyway, so dropping it is the semantically\n *    correct repair, not a validation dodge.\n */\nexport function prepareRunInputs(data: Dict, schema: Dict): Dict {\n  return pruneEmptyOptionals(healStringWrappers(data, schema), schema) as Dict;\n}\n\nexport interface RunInputsVerdict {\n  isValid: boolean;\n  /** Variable names the scan could pin a missing required field on. */\n  missingInputs: string[];\n  /** Raw ajv errors, for when the scan cannot name anything. */\n  errors: RunInputError[];\n}\n\n/**\n * Validate PREPARED data against the combined schema.\n *\n * `missingInputs` is reported by VARIABLE NAME - the name on the node the user\n * clicks - never by `concept_ref`, which used to produce \"Missing required\n * fields in: native.Text\" and named neither the input at fault nor, when several\n * inputs share a concept, which of them. Inputs the method declared omittable\n * are skipped: an empty `?` input is not a missing one.\n *\n * The scan can come up empty even on an invalid form (a wrong value shape, a\n * nested mismatch); `errors` is what the caller falls back to then, so a failure\n * is never undiagnosable.\n *\n * `preparedData` is `unknown` for the same reason `gateRunInputs`' `data` is: on\n * a public endpoint the body is whatever was sent, and ajv must be shown that\n * rather than a repair of it, or `must be object` is a verdict no caller can\n * ever receive. The name-the-variable scan below needs something indexable, so\n * a body that is not a record scans against nothing and names every input the\n * method demands - which is the honest answer for a body that carried none.\n */\nexport function validateRunInputs(\n  preparedData: unknown,\n  inputs: Record<string, PipeInputContract>,\n  schema: Dict,\n): RunInputsVerdict {\n  const errors = validateRunInputsSchema(preparedData, schema);\n  if (errors.length === 0) return { isValid: true, missingInputs: [], errors: [] };\n\n  const record0 =\n    typeof preparedData === 'object' && preparedData !== null && !Array.isArray(preparedData)\n      ? (preparedData as Dict)\n      : undefined;\n  const missingInputs: string[] = [];\n  for (const [varName, input] of Object.entries(inputs)) {\n    if (!inputMustBeFilled(input)) continue;\n    const varData = ownProp(record0, varName);\n    // A demanded input that is not there at all is missing whatever its concept\n    // declares inside. The check has to come BEFORE the required-children one:\n    // a struct whose concept demands no child used to fall out of the scan\n    // here, so the run was refused by the combined schema's `required` list\n    // while the scan named nothing and the caller could only quote ajv.\n    if (varData == null) {\n      missingInputs.push(varName);\n      continue;\n    }\n    const inputSchema = input.json_schema as Dict;\n    const requiredFields = (inputSchema.required as string[]) || [];\n    if (requiredFields.length === 0) continue;\n    if (typeof varData !== 'object') {\n      missingInputs.push(varName);\n      continue;\n    }\n    const record = varData as Dict;\n    if (\n      requiredFields.some((f) => {\n        const child = ownProp(record, f);\n        return child === undefined || child === '';\n      })\n    ) {\n      missingInputs.push(varName);\n    }\n  }\n\n  return { isValid: false, missingInputs, errors };\n}\n\n/**\n * Build the `{ concept, content }` map a run expects, from PREPARED data.\n *\n * The two ways a method says \"this may be nothing\" land differently on the wire:\n * - an **optional (`?`)** input left blank is OMITTED, so the runtime records a\n *   real absence the method can branch on - sending `{ text: \"\" }` would look\n *   like the caller supplied an empty string;\n * - a **plural (`[]`)** input keeps its key, because a plural slot is never\n *   absent - its empty form IS the empty list, and the runtime requires the key.\n *   When that list is EMPTY it is sent BARE, without the envelope: the envelope\n *   is the runtime's \"explicit form\", which bypasses the top-down shaper and\n *   hands the value to the bottom-up factory, and that factory types a list from\n *   its first item - so an empty list there raises \"Cannot create Stuff from\n *   empty list in content\". The bare form keeps the shaper, which reads the\n *   DECLARED concept and builds the empty list correctly. (pipelex/#1096 makes\n *   the envelope agree; the bare form runs today and stays correct after.)\n *\n * A fixed-count (`[N]`) list takes that same empty-list path, and an empty one\n * is not a payload the method can accept. It is unreachable through the gate,\n * which demands the input and rejects a short list on `minItems`; building the\n * payload straight from unvalidated data is what would reach it, and inventing\n * a different absence here would only hide that.\n */\nexport function apiInputsFromSchemaData(\n  preparedData: Dict,\n  inputs: Record<string, PipeInputContract>,\n): Dict {\n  const out: Dict = {};\n  for (const [varName, input] of Object.entries(inputs)) {\n    const raw = ownProp(preparedData, varName);\n    if (isOptionalInput(input) && !isFilled(raw)) continue;\n    if (isPluralInput(input) && !isFilled(raw)) {\n      out[varName] = [];\n      continue;\n    }\n    const content = isPluralInput(input) && !Array.isArray(raw) ? [] : raw;\n    out[varName] = { concept: input.concept_ref, content };\n  }\n  return out;\n}\n\n// ─── The whole chain, as one call ────────────────────────────────────────────\n\n/** The gate's verdict: the payload to send, or why the run may not start. */\nexport type RunInputsGateResult =\n  | { ok: true; inputs: Dict }\n  | {\n      ok: false;\n      /** Variable names the caller left empty or short. */\n      missingInputs: string[];\n      /** Raw ajv errors, for when the scan cannot name anything. */\n      errors: RunInputError[];\n      /** The repaired data the verdict was reached on - what\n       *  `describeValidationError` needs to quote the value it received. */\n      preparedData: Dict;\n    };\n\n/**\n * One schema object per contract, for the lifetime of the process.\n *\n * `buildRunInputsSchema` is a pure function of the contract, so rebuilding it is\n * *semantically* free - but validation runs through a module-level ajv whose\n * compiled-schema cache is keyed on **schema object identity** and is never\n * evicted. A fresh object per call therefore misses every time and retains\n * another compiled validator. On a publicly callable server endpoint that is\n * unbounded growth driven by the cheapest request there is: an empty body,\n * rejected in a fraction of a millisecond, costing nothing to send.\n *\n * Weakly keyed so the map never pins a contract that goes out of scope. The\n * schema a run has been gated against is pinned for the process lifetime anyway\n * by ajv's own cache; the point is that the NUMBER of them is bounded by the\n * number of distinct contracts rather than by traffic.\n */\nconst SCHEMA_CACHE = new WeakMap<PipeIOContract, Dict>();\n\nfunction schemaForContract(contract: PipeIOContract): Dict {\n  const cached = SCHEMA_CACHE.get(contract);\n  if (cached) return cached;\n  const schema = buildRunInputsSchema(contract.inputs);\n  SCHEMA_CACHE.set(contract, schema);\n  return schema;\n}\n\n/**\n * Gate a run: repair the caller's data, validate it against the contract,\n * refuse anything the Run button would have refused, and build the payload.\n *\n * Returns a verdict rather than throwing. A server endpoint must not throw\n * across the boundary to its client - frameworks routinely strip the message to\n * an opaque digest in a production build - and a rejection here is an ordinary\n * outcome, not an exceptional one.\n *\n * **`data` is `unknown` because that is what it is.** A run endpoint is public\n * and no framework enforces a declared parameter type, so the argument is\n * whatever the caller put in the body. The chain indexes the payload by\n * variable name without first checking it is indexable, so a `null` body would\n * throw *after* ajv had already reported `must be object` and before any\n * verdict came back.\n *\n * So the two uses are separated rather than collapsed into one repair. **ajv\n * judges the value the caller actually sent**, which is what makes `must be\n * object` the verdict for a body that is not one; the indexing that follows\n * uses a safe `{}` stand-in, which is what keeps the gate from throwing. Repair\n * FIRST - coercing a non-object to `{}` before validating - is the shape that\n * looks equivalent and is not: a contract whose inputs are all optional has an\n * empty `required` list, so `{}` validates, and `gateRunInputs(\"garbage\", …)`\n * came back `ok: true` on a body the caller never meant as a run. Fail-closed\n * costs a malformed caller an error it earned; the other direction bills a run.\n *\n * **The schema alone is not the rule.** ajv's `required` asserts only that a\n * key is PRESENT, and a content model carries no `minLength` - so a required\n * input that arrived empty (`{document: {url: \"\"}}`, `{text: {text: \"\"}}`)\n * satisfies the schema. That is the natural payload, not a contrived one:\n * `rjsfDataFromRunValues({}, fields)` emits exactly that when nothing is\n * selected. So the gate re-applies the emptiness rule using\n * `computeReadiness`'s OWN two functions over the same derived fields, which is\n * the only way to be sure the two sides cannot disagree.\n *\n * Picking a pair that merely looks equivalent is not enough, and this is the\n * whole reason the assembly lives here rather than in each host: the obvious\n * choice, `inputMustBeFilled` + `isFilled`, agrees on every leaf kind and\n * diverges on a structured concept in BOTH directions - `isFilled` on an object\n * is `some(child filled)` where `fieldFilled` is `every(required child\n * filled)`. That accepts a half-filled struct the browser refuses (a paid run\n * past a disabled button) and rejects a filled all-optional struct the browser\n * accepts. A host whose methods happen to use only native concepts has no test\n * that can catch either.\n */\nexport function gateRunInputs(contract: PipeIOContract, data: unknown): RunInputsGateResult {\n  const isRecord = typeof data === 'object' && data !== null && !Array.isArray(data);\n  const payload = isRecord ? (data as Dict) : {};\n  const schema = schemaForContract(contract);\n  const preparedData = prepareRunInputs(payload, schema);\n\n  // The value ajv is shown is the caller's, not the stand-in - see above.\n  const verdict = validateRunInputs(isRecord ? preparedData : data, contract.inputs, schema);\n  if (!verdict.isValid) {\n    return {\n      ok: false,\n      missingInputs: verdict.missingInputs,\n      errors: verdict.errors,\n      preparedData,\n    };\n  }\n\n  // The SELECTION is half the rule, and leaving it out is what made the two\n  // halves disagree. `computeReadiness` reckons with an input the method\n  // demands AND one it left optional that the user has touched - because a\n  // structure with something in it owes its concept every field the concept\n  // declares. Filtering on `mustBeFilled` alone dropped the second kind, so a\n  // half-filled optional struct was refused by the button and accepted here.\n  //\n  // ajv cannot cover for it: a required child that is a plain string arrives as\n  // `''`, which satisfies `required`. And the payload builder below then SENDS\n  // that input, because `isFilled` is exactly what it tests. Which is the rule\n  // stated properly: the gate holds to its concept precisely the inputs it is\n  // about to put on the wire, and nothing it will omit.\n  //\n  // The tree the predicates run over is the gate's own, walked structurally\n  // from the same `json_schema` ajv just validated - NOT the render tree, which\n  // is built from the input-form descriptor. A server validating a payload must\n  // never need that presentation artifact; see `gating-fields.ts`.\n  const missingInputs = gatingFieldsFromInputs(contract.inputs)\n    .filter((field) => mustBeFilled(field) || isFilled(ownProp(preparedData, field.name)))\n    .filter((field) => !fieldFilled(field, ownProp(preparedData, field.name)))\n    .map((field) => field.name);\n  if (missingInputs.length) return { ok: false, missingInputs, errors: [], preparedData };\n\n  return { ok: true, inputs: apiInputsFromSchemaData(preparedData, contract.inputs) };\n}\n"]}

package/dist/chunk-TID7ZN63.js

@@ -0,0 +1,198 @@
+import { ownProp, hasOwnProp } from './chunk-V3OV2XQT.js';
+
+// src/core/native-content.ts
+function isRecord(value) {
+  return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function readText(record, key) {
+  const value = ownProp(record, key);
+  return typeof value === "string" && value.length > 0 ? value : void 0;
+}
+function readNumber(record, key) {
+  const value = ownProp(record, key);
+  return typeof value === "number" && Number.isFinite(value) ? value : void 0;
+}
+function readDocumentContent(value) {
+  if (!isRecord(value)) return void 0;
+  const url = readText(value, "url");
+  if (url === void 0) return void 0;
+  return {
+    url,
+    publicUrl: readText(value, "public_url"),
+    mimeType: readText(value, "mime_type"),
+    filename: readText(value, "filename"),
+    title: readText(value, "title"),
+    snippet: readText(value, "snippet")
+  };
+}
+function readImageContent(value) {
+  if (!isRecord(value)) return void 0;
+  const url = readText(value, "url");
+  if (url === void 0) return void 0;
+  return {
+    url,
+    publicUrl: readText(value, "public_url"),
+    caption: readText(value, "caption"),
+    mimeType: readText(value, "mime_type"),
+    filename: readText(value, "filename"),
+    width: readNumber(value, "width"),
+    height: readNumber(value, "height"),
+    sourcePrompt: readText(value, "source_prompt")
+  };
+}
+function readHtmlContent(value) {
+  if (!isRecord(value)) return void 0;
+  const innerHtml = readText(value, "inner_html");
+  if (innerHtml === void 0) return void 0;
+  return { innerHtml, cssClass: readText(value, "css_class") };
+}
+var NATIVE_HTML_CONCEPT_REF = "native.Html";
+var NATIVE_DATE_CONCEPT_REF = "native.Date";
+var NATIVE_COMPOSITE_CONCEPT_REF = "native.Composite";
+function readCompositeContent(value) {
+  if (!isRecord(value)) return void 0;
+  return Object.entries(value).map(([name, member]) => ({ name, value: member }));
+}
+function isNativeHtmlNode(node) {
+  return refinesNative(node, NATIVE_HTML_CONCEPT_REF);
+}
+function isNativeDateNode(node) {
+  return refinesNative(node, NATIVE_DATE_CONCEPT_REF);
+}
+function isNativeCompositeNode(node) {
+  return refinesNative(node, NATIVE_COMPOSITE_CONCEPT_REF);
+}
+function isNativeValueNode(node) {
+  return isNativeDateNode(node) || isNativeHtmlNode(node) || isNativeCompositeNode(node);
+}
+function refinesNative(node, ref) {
+  if (node.kind === "list") return false;
+  if (node.conceptRef === ref) return true;
+  return node.refines?.includes(ref) ?? false;
+}
+function readDateContent(value) {
+  if (typeof value === "string") {
+    return value.length > 0 ? { date: value } : void 0;
+  }
+  if (!isRecord(value)) return void 0;
+  const inner = ownProp(value, "date");
+  const date = typeof inner === "string" ? inner : isRecord(inner) ? readText(inner, "date") : void 0;
+  if (date === void 0) return void 0;
+  return { date, time: readText(value, "time") };
+}
+function formatDateContent(content) {
+  return content.time ? `${content.date} ${content.time}` : content.date;
+}
+var VIEWABLE_DATA_MEDIA_TYPES = /* @__PURE__ */ new Set([
+  "image/png",
+  "image/jpeg",
+  "image/gif",
+  "image/webp",
+  "image/avif",
+  "application/pdf"
+]);
+var RELATIVE_SENTINEL_ORIGIN = "https://url-gate.invalid";
+var OWN_SCHEME_RE = /^[a-z][a-z0-9+.-]*:/i;
+function stripUrlWhitespace(candidate) {
+  let start = 0;
+  let end = candidate.length;
+  while (start < end && candidate.charCodeAt(start) <= 32) start += 1;
+  while (end > start && candidate.charCodeAt(end - 1) <= 32) end -= 1;
+  for (let index = start; index < end; index += 1) {
+    const code = candidate.charCodeAt(index);
+    if (code === 9 || code === 10 || code === 13) {
+      let stripped = candidate.slice(start, index);
+      for (let rest = index; rest < end; rest += 1) {
+        const restCode = candidate.charCodeAt(rest);
+        if (restCode !== 9 && restCode !== 10 && restCode !== 13)
+          stripped += candidate[rest];
+      }
+      return stripped;
+    }
+  }
+  return start === 0 && end === candidate.length ? candidate : candidate.slice(start, end);
+}
+function readDataUrl(candidate) {
+  const url = candidate.trimStart();
+  if (!/^data:/i.test(url)) return void 0;
+  const comma = url.indexOf(",");
+  if (comma === -1) return void 0;
+  const [declared = "", ...parameters] = url.slice("data:".length, comma).split(";");
+  const trimmed = declared.trim().toLowerCase();
+  const fragment = url.indexOf("#", comma);
+  const payload = fragment === -1 ? url.slice(comma + 1) : url.slice(comma + 1, fragment);
+  const base64 = parameters.some((parameter) => parameter.trim().toLowerCase() === "base64");
+  return {
+    mediaType: trimmed === "" ? "text/plain" : trimmed,
+    bytes: base64 ? base64Bytes(payload) : percentEncodedBytes(payload)
+  };
+}
+function base64Bytes(payload) {
+  let symbols = 0;
+  for (let index = 0; index < payload.length; index += 1) {
+    let code = payload.charCodeAt(index);
+    if (code === 37) {
+      const escaped = Number.parseInt(payload.slice(index + 1, index + 3), 16);
+      if (!Number.isNaN(escaped) && index + 2 < payload.length) {
+        code = escaped;
+        index += 2;
+      }
+    }
+    if (code >= 65 && code <= 90 || code >= 97 && code <= 122 || code >= 48 && code <= 57 || code === 43 || code === 47 || code === 45 || code === 95)
+      symbols += 1;
+  }
+  return Math.floor(symbols * 3 / 4);
+}
+function percentEncodedBytes(payload) {
+  const escapes = payload.match(/%[0-9a-f]{2}/gi)?.length ?? 0;
+  return new TextEncoder().encode(payload).length - escapes * 2;
+}
+function dataUrlMediaType(parsed) {
+  const declared = parsed.pathname.split(/[;,]/, 1)[0] ?? "";
+  const trimmed = declared.trim().toLowerCase();
+  return trimmed === "" ? "text/plain" : trimmed;
+}
+function viewableUrl(candidate) {
+  if (!candidate) return void 0;
+  const stripped = stripUrlWhitespace(candidate);
+  if (stripped === "") return void 0;
+  if (OWN_SCHEME_RE.test(stripped)) {
+    let parsed2;
+    try {
+      parsed2 = new URL(stripped);
+    } catch {
+      return void 0;
+    }
+    switch (parsed2.protocol) {
+      case "http:":
+      case "https:":
+      case "blob:":
+        return parsed2.href;
+      case "data:":
+        return VIEWABLE_DATA_MEDIA_TYPES.has(dataUrlMediaType(parsed2)) ? parsed2.href : void 0;
+      default:
+        return void 0;
+    }
+  }
+  if (!stripped.startsWith("/")) return void 0;
+  const afterSlash = stripped.charCodeAt(1);
+  if (afterSlash === 47 || afterSlash === 92) return void 0;
+  let parsed;
+  try {
+    parsed = new URL(stripped, RELATIVE_SENTINEL_ORIGIN);
+  } catch {
+    return void 0;
+  }
+  return parsed.origin === RELATIVE_SENTINEL_ORIGIN ? stripped : void 0;
+}
+function isViewableUrl(url) {
+  return viewableUrl(url) !== void 0;
+}
+var TYPED_SCALAR_MARKERS = ["__class__", "__module__"];
+function hasTypedScalarMarkers(value) {
+  return isRecord(value) && TYPED_SCALAR_MARKERS.every((marker) => hasOwnProp(value, marker));
+}
+
+export { NATIVE_COMPOSITE_CONCEPT_REF, NATIVE_DATE_CONCEPT_REF, NATIVE_HTML_CONCEPT_REF, TYPED_SCALAR_MARKERS, formatDateContent, hasTypedScalarMarkers, isNativeCompositeNode, isNativeDateNode, isNativeHtmlNode, isNativeValueNode, isViewableUrl, readCompositeContent, readDataUrl, readDateContent, readDocumentContent, readHtmlContent, readImageContent, viewableUrl };
+//# sourceMappingURL=chunk-TID7ZN63.js.map
+//# sourceMappingURL=chunk-TID7ZN63.js.map

package/dist/chunk-TID7ZN63.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/core/native-content.ts"],"names":["parsed"],"mappings":";;;AA4CA,SAAS,SAAS,KAAA,EAAkD;AAClE,EAAA,OAAO,OAAO,UAAU,QAAA,IAAY,KAAA,KAAU,QAAQ,CAAC,KAAA,CAAM,QAAQ,KAAK,CAAA;AAC5E;AAGA,SAAS,QAAA,CAAS,QAAiC,GAAA,EAAiC;AAClF,EAAA,MAAM,KAAA,GAAQ,OAAA,CAAQ,MAAA,EAAQ,GAAG,CAAA;AACjC,EAAA,OAAO,OAAO,KAAA,KAAU,QAAA,IAAY,KAAA,CAAM,MAAA,GAAS,IAAI,KAAA,GAAQ,MAAA;AACjE;AAEA,SAAS,UAAA,CAAW,QAAiC,GAAA,EAAiC;AACpF,EAAA,MAAM,KAAA,GAAQ,OAAA,CAAQ,MAAA,EAAQ,GAAG,CAAA;AACjC,EAAA,OAAO,OAAO,KAAA,KAAU,QAAA,IAAY,OAAO,QAAA,CAAS,KAAK,IAAI,KAAA,GAAQ,MAAA;AACvE;AA2CO,SAAS,oBAAoB,KAAA,EAAiD;AACnF,EAAA,IAAI,CAAC,QAAA,CAAS,KAAK,CAAA,EAAG,OAAO,MAAA;AAC7B,EAAA,MAAM,GAAA,GAAM,QAAA,CAAS,KAAA,EAAO,KAAK,CAAA;AACjC,EAAA,IAAI,GAAA,KAAQ,QAAW,OAAO,MAAA;AAC9B,EAAA,OAAO;AAAA,IACL,GAAA;AAAA,IACA,SAAA,EAAW,QAAA,CAAS,KAAA,EAAO,YAAY,CAAA;AAAA,IACvC,QAAA,EAAU,QAAA,CAAS,KAAA,EAAO,WAAW,CAAA;AAAA,IACrC,QAAA,EAAU,QAAA,CAAS,KAAA,EAAO,UAAU,CAAA;AAAA,IACpC,KAAA,EAAO,QAAA,CAAS,KAAA,EAAO,OAAO,CAAA;AAAA,IAC9B,OAAA,EAAS,QAAA,CAAS,KAAA,EAAO,SAAS;AAAA,GACpC;AACF;AAGO,SAAS,iBAAiB,KAAA,EAA8C;AAC7E,EAAA,IAAI,CAAC,QAAA,CAAS,KAAK,CAAA,EAAG,OAAO,MAAA;AAC7B,EAAA,MAAM,GAAA,GAAM,QAAA,CAAS,KAAA,EAAO,KAAK,CAAA;AACjC,EAAA,IAAI,GAAA,KAAQ,QAAW,OAAO,MAAA;AAC9B,EAAA,OAAO;AAAA,IACL,GAAA;AAAA,IACA,SAAA,EAAW,QAAA,CAAS,KAAA,EAAO,YAAY,CAAA;AAAA,IACvC,OAAA,EAAS,QAAA,CAAS,KAAA,EAAO,SAAS,CAAA;AAAA,IAClC,QAAA,EAAU,QAAA,CAAS,KAAA,EAAO,WAAW,CAAA;AAAA,IACrC,QAAA,EAAU,QAAA,CAAS,KAAA,EAAO,UAAU,CAAA;AAAA,IACpC,KAAA,EAAO,UAAA,CAAW,KAAA,EAAO,OAAO,CAAA;AAAA,IAChC,MAAA,EAAQ,UAAA,CAAW,KAAA,EAAO,QAAQ,CAAA;AAAA,IAClC,YAAA,EAAc,QAAA,CAAS,KAAA,EAAO,eAAe;AAAA,GAC/C;AACF;AA0BO,SAAS,gBAAgB,KAAA,EAA6C;AAC3E,EAAA,IAAI,CAAC,QAAA,CAAS,KAAK,CAAA,EAAG,OAAO,MAAA;AAC7B,EAAA,MAAM,SAAA,GAAY,QAAA,CAAS,KAAA,EAAO,YAAY,CAAA;AAC9C,EAAA,IAAI,SAAA,KAAc,QAAW,OAAO,MAAA;AACpC,EAAA,OAAO,EAAE,SAAA,EAAW,QAAA,EAAU,QAAA,CAAS,KAAA,EAAO,WAAW,CAAA,EAAE;AAC7D;AAGO,IAAM,uBAAA,GAA0B;AAChC,IAAM,uBAAA,GAA0B;AAChC,IAAM,4BAAA,GAA+B;AAiBrC,SAAS,qBAAqB,KAAA,EAA+C;AAClF,EAAA,IAAI,CAAC,QAAA,CAAS,KAAK,CAAA,EAAG,OAAO,MAAA;AAC7B,EAAA,OAAO,MAAA,CAAO,OAAA,CAAQ,KAAK,CAAA,CAAE,IAAI,CAAC,CAAC,IAAA,EAAM,MAAM,CAAA,MAAO,EAAE,IAAA,EAAM,KAAA,EAAO,QAAO,CAAE,CAAA;AAChF;AAWO,SAAS,iBAAiB,IAAA,EAA2B;AAC1D,EAAA,OAAO,aAAA,CAAc,MAAM,uBAAuB,CAAA;AACpD;AAgBO,SAAS,iBAAiB,IAAA,EAA2B;AAC1D,EAAA,OAAO,aAAA,CAAc,MAAM,uBAAuB,CAAA;AACpD;AAgBO,SAAS,sBAAsB,IAAA,EAA2B;AAC/D,EAAA,OAAO,aAAA,CAAc,MAAM,4BAA4B,CAAA;AACzD;AAaO,SAAS,kBAAkB,IAAA,EAA2B;AAC3D,EAAA,OAAO,iBAAiB,IAAI,CAAA,IAAK,iBAAiB,IAAI,CAAA,IAAK,sBAAsB,IAAI,CAAA;AACvF;AAsBA,SAAS,aAAA,CAAc,MAAkB,GAAA,EAAsB;AAC7D,EAAA,IAAI,IAAA,CAAK,IAAA,KAAS,MAAA,EAAQ,OAAO,KAAA;AACjC,EAAA,IAAI,IAAA,CAAK,UAAA,KAAe,GAAA,EAAK,OAAO,IAAA;AACpC,EAAA,OAAO,IAAA,CAAK,OAAA,EAAS,QAAA,CAAS,GAAG,CAAA,IAAK,KAAA;AACxC;AAWO,SAAS,gBAAgB,KAAA,EAA6C;AAC3E,EAAA,IAAI,OAAO,UAAU,QAAA,EAAU;AAC7B,IAAA,OAAO,MAAM,MAAA,GAAS,CAAA,GAAI,EAAE,IAAA,EAAM,OAAM,GAAI,MAAA;AAAA,EAC9C;AACA,EAAA,IAAI,CAAC,QAAA,CAAS,KAAK,CAAA,EAAG,OAAO,MAAA;AAE7B,EAAA,MAAM,KAAA,GAAQ,OAAA,CAAQ,KAAA,EAAO,MAAM,CAAA;AACnC,EAAA,MAAM,IAAA,GACJ,OAAO,KAAA,KAAU,QAAA,GAAW,KAAA,GAAQ,QAAA,CAAS,KAAK,CAAA,GAAI,QAAA,CAAS,KAAA,EAAO,MAAM,CAAA,GAAI,MAAA;AAClF,EAAA,IAAI,IAAA,KAAS,QAAW,OAAO,MAAA;AAC/B,EAAA,OAAO,EAAE,IAAA,EAAM,IAAA,EAAM,QAAA,CAAS,KAAA,EAAO,MAAM,CAAA,EAAE;AAC/C;AAGO,SAAS,kBAAkB,OAAA,EAAkC;AAClE,EAAA,OAAO,OAAA,CAAQ,OAAO,CAAA,EAAG,OAAA,CAAQ,IAAI,CAAA,CAAA,EAAI,OAAA,CAAQ,IAAI,CAAA,CAAA,GAAK,OAAA,CAAQ,IAAA;AACpE;AAgBA,IAAM,yBAAA,uBAAgC,GAAA,CAAI;AAAA,EACxC,WAAA;AAAA,EACA,YAAA;AAAA,EACA,WAAA;AAAA,EACA,YAAA;AAAA,EACA,YAAA;AAAA,EACA;AACF,CAAC,CAAA;AASD,IAAM,wBAAA,GAA2B,0BAAA;AAQjC,IAAM,aAAA,GAAgB,sBAAA;AAYtB,SAAS,mBAAmB,SAAA,EAA2B;AAGrD,EAAA,IAAI,KAAA,GAAQ,CAAA;AACZ,EAAA,IAAI,MAAM,SAAA,CAAU,MAAA;AACpB,EAAA,OAAO,QAAQ,GAAA,IAAO,SAAA,CAAU,WAAW,KAAK,CAAA,IAAK,IAAM,KAAA,IAAS,CAAA;AACpE,EAAA,OAAO,GAAA,GAAM,SAAS,SAAA,CAAU,UAAA,CAAW,MAAM,CAAC,CAAA,IAAK,IAAM,GAAA,IAAO,CAAA;AAOpE,EAAA,KAAA,IAAS,KAAA,GAAQ,KAAA,EAAO,KAAA,GAAQ,GAAA,EAAK,SAAS,CAAA,EAAG;AAC/C,IAAA,MAAM,IAAA,GAAO,SAAA,CAAU,UAAA,CAAW,KAAK,CAAA;AAGvC,IAAA,IAAI,IAAA,KAAS,CAAA,IAAQ,IAAA,KAAS,EAAA,IAAQ,SAAS,EAAA,EAAM;AACnD,MAAA,IAAI,QAAA,GAAW,SAAA,CAAU,KAAA,CAAM,KAAA,EAAO,KAAK,CAAA;AAC3C,MAAA,KAAA,IAAS,IAAA,GAAO,KAAA,EAAO,IAAA,GAAO,GAAA,EAAK,QAAQ,CAAA,EAAG;AAC5C,QAAA,MAAM,QAAA,GAAW,SAAA,CAAU,UAAA,CAAW,IAAI,CAAA;AAC1C,QAAA,IAAI,QAAA,KAAa,CAAA,IAAQ,QAAA,KAAa,EAAA,IAAQ,QAAA,KAAa,EAAA;AACzD,UAAA,QAAA,IAAY,UAAU,IAAI,CAAA;AAAA,MAC9B;AACA,MAAA,OAAO,QAAA;AAAA,IACT;AAAA,EACF;AACA,EAAA,OAAO,KAAA,KAAU,KAAK,GAAA,KAAQ,SAAA,CAAU,SAAS,SAAA,GAAY,SAAA,CAAU,KAAA,CAAM,KAAA,EAAO,GAAG,CAAA;AACzF;AAwBO,SAAS,YAAY,SAAA,EAA4C;AACtE,EAAA,MAAM,GAAA,GAAM,UAAU,SAAA,EAAU;AAChC,EAAA,IAAI,CAAC,SAAA,CAAU,IAAA,CAAK,GAAG,GAAG,OAAO,MAAA;AACjC,EAAA,MAAM,KAAA,GAAQ,GAAA,CAAI,OAAA,CAAQ,GAAG,CAAA;AAC7B,EAAA,IAAI,KAAA,KAAU,IAAI,OAAO,MAAA;AACzB,EAAA,MAAM,CAAC,QAAA,GAAW,EAAA,EAAI,GAAG,UAAU,CAAA,GAAI,GAAA,CAAI,KAAA,CAAM,OAAA,CAAQ,MAAA,EAAQ,KAAK,CAAA,CAAE,MAAM,GAAG,CAAA;AACjF,EAAA,MAAM,OAAA,GAAU,QAAA,CAAS,IAAA,EAAK,CAAE,WAAA,EAAY;AAG5C,EAAA,MAAM,QAAA,GAAW,GAAA,CAAI,OAAA,CAAQ,GAAA,EAAK,KAAK,CAAA;AACvC,EAAA,MAAM,OAAA,GAAU,QAAA,KAAa,EAAA,GAAK,GAAA,CAAI,KAAA,CAAM,KAAA,GAAQ,CAAC,CAAA,GAAI,GAAA,CAAI,KAAA,CAAM,KAAA,GAAQ,CAAA,EAAG,QAAQ,CAAA;AACtF,EAAA,MAAM,MAAA,GAAS,UAAA,CAAW,IAAA,CAAK,CAAC,SAAA,KAAc,UAAU,IAAA,EAAK,CAAE,WAAA,EAAY,KAAM,QAAQ,CAAA;AACzF,EAAA,OAAO;AAAA,IACL,SAAA,EAAW,OAAA,KAAY,EAAA,GAAK,YAAA,GAAe,OAAA;AAAA,IAC3C,OAAO,MAAA,GAAS,WAAA,CAAY,OAAO,CAAA,GAAI,oBAAoB,OAAO;AAAA,GACpE;AACF;AAWA,SAAS,YAAY,OAAA,EAAyB;AAC5C,EAAA,IAAI,OAAA,GAAU,CAAA;AACd,EAAA,KAAA,IAAS,QAAQ,CAAA,EAAG,KAAA,GAAQ,OAAA,CAAQ,MAAA,EAAQ,SAAS,CAAA,EAAG;AACtD,IAAA,IAAI,IAAA,GAAO,OAAA,CAAQ,UAAA,CAAW,KAAK,CAAA;AACnC,IAAA,IAAI,SAAS,EAAA,EAAM;AACjB,MAAA,MAAM,OAAA,GAAU,MAAA,CAAO,QAAA,CAAS,OAAA,CAAQ,KAAA,CAAM,QAAQ,CAAA,EAAG,KAAA,GAAQ,CAAC,CAAA,EAAG,EAAE,CAAA;AACvE,MAAA,IAAI,CAAC,OAAO,KAAA,CAAM,OAAO,KAAK,KAAA,GAAQ,CAAA,GAAI,QAAQ,MAAA,EAAQ;AACxD,QAAA,IAAA,GAAO,OAAA;AACP,QAAA,KAAA,IAAS,CAAA;AAAA,MACX;AAAA,IACF;AACA,IAAA,IACG,QAAQ,EAAA,IAAQ,IAAA,IAAQ,MACxB,IAAA,IAAQ,EAAA,IAAQ,QAAQ,GAAA,IACxB,IAAA,IAAQ,EAAA,IAAQ,IAAA,IAAQ,MACzB,IAAA,KAAS,EAAA,IACT,SAAS,EAAA,IACT,IAAA,KAAS,MACT,IAAA,KAAS,EAAA;AAET,MAAA,OAAA,IAAW,CAAA;AAAA,EACf;AACA,EAAA,OAAO,IAAA,CAAK,KAAA,CAAO,OAAA,GAAU,CAAA,GAAK,CAAC,CAAA;AACrC;AAGA,SAAS,oBAAoB,OAAA,EAAyB;AACpD,EAAA,MAAM,OAAA,GAAU,OAAA,CAAQ,KAAA,CAAM,gBAAgB,GAAG,MAAA,IAAU,CAAA;AAC3D,EAAA,OAAO,IAAI,WAAA,EAAY,CAAE,OAAO,OAAO,CAAA,CAAE,SAAS,OAAA,GAAU,CAAA;AAC9D;AAGA,SAAS,iBAAiB,MAAA,EAAqB;AAC7C,EAAA,MAAM,QAAA,GAAW,OAAO,QAAA,CAAS,KAAA,CAAM,QAAQ,CAAC,CAAA,CAAE,CAAC,CAAA,IAAK,EAAA;AACxD,EAAA,MAAM,OAAA,GAAU,QAAA,CAAS,IAAA,EAAK,CAAE,WAAA,EAAY;AAC5C,EAAA,OAAO,OAAA,KAAY,KAAK,YAAA,GAAe,OAAA;AACzC;AAuCO,SAAS,YAAY,SAAA,EAAmD;AAC7E,EAAA,IAAI,CAAC,WAAW,OAAO,MAAA;AACvB,EAAA,MAAM,QAAA,GAAW,mBAAmB,SAAS,CAAA;AAC7C,EAAA,IAAI,QAAA,KAAa,IAAI,OAAO,MAAA;AAU5B,EAAA,IAAI,aAAA,CAAc,IAAA,CAAK,QAAQ,CAAA,EAAG;AAChC,IAAA,IAAIA,OAAAA;AACJ,IAAA,IAAI;AACF,MAAAA,OAAAA,GAAS,IAAI,GAAA,CAAI,QAAQ,CAAA;AAAA,IAC3B,CAAA,CAAA,MAAQ;AACN,MAAA,OAAO,MAAA;AAAA,IACT;AACA,IAAA,QAAQA,QAAO,QAAA;AAAU,MACvB,KAAK,OAAA;AAAA,MACL,KAAK,QAAA;AAAA,MACL,KAAK,OAAA;AACH,QAAA,OAAOA,OAAAA,CAAO,IAAA;AAAA,MAChB,KAAK,OAAA;AACH,QAAA,OAAO,0BAA0B,GAAA,CAAI,gBAAA,CAAiBA,OAAM,CAAC,CAAA,GAAIA,QAAO,IAAA,GAAO,MAAA;AAAA,MACjF;AACE,QAAA,OAAO,MAAA;AAAA;AACX,EACF;AAIA,EAAA,IAAI,CAAC,QAAA,CAAS,UAAA,CAAW,GAAG,GAAG,OAAO,MAAA;AAItC,EAAA,MAAM,UAAA,GAAa,QAAA,CAAS,UAAA,CAAW,CAAC,CAAA;AACxC,EAAA,IAAI,UAAA,KAAe,EAAA,IAAQ,UAAA,KAAe,EAAA,EAAM,OAAO,MAAA;AACvD,EAAA,IAAI,MAAA;AACJ,EAAA,IAAI;AACF,IAAA,MAAA,GAAS,IAAI,GAAA,CAAI,QAAA,EAAU,wBAAwB,CAAA;AAAA,EACrD,CAAA,CAAA,MAAQ;AACN,IAAA,OAAO,MAAA;AAAA,EACT;AACA,EAAA,OAAO,MAAA,CAAO,MAAA,KAAW,wBAAA,GAA2B,QAAA,GAAW,MAAA;AACjE;AASO,SAAS,cAAc,GAAA,EAAwC;AACpE,EAAA,OAAO,WAAA,CAAY,GAAG,CAAA,KAAM,MAAA;AAC9B;AASO,IAAM,oBAAA,GAAuB,CAAC,WAAA,EAAa,YAAY;AAGvD,SAAS,sBAAsB,KAAA,EAAyB;AAC7D,EAAA,OAAO,QAAA,CAAS,KAAK,CAAA,IAAK,oBAAA,CAAqB,KAAA,CAAM,CAAC,MAAA,KAAW,UAAA,CAAW,KAAA,EAAO,MAAM,CAAC,CAAA;AAC5F","file":"chunk-TID7ZN63.js","sourcesContent":["/**\n * How to READ the native content models — the result side's twin of\n * `./file-formats`.\n *\n * A renderer handed a result knows the field's `kind` from the descriptor, and\n * for the kinds whose value is a structured content model rather than a bare\n * scalar (`document`, `image`, `date`) it must then read that model's members.\n * **That is reading the standard, not sniffing at it.** The distinction is the\n * whole reason this module exists as data rather than as heuristics inside a\n * control: a reader keyed by a STATED kind consults a pinned definition, where\n * a reader that works out *which* kind it is holding by counting properties is\n * guessing — and guessing is exactly what [../../docs/derivation-swap.md]\n * records removing from the input side.\n *\n * ## Where each shape comes from\n *\n * `native.Image` and `native.Document` are pinned by the standard, in\n * `docs/spec/native-concepts.md` § \"The Pinned Set (MTHDS 1.0.0)\". Both carry a\n * required `url` — a storage URI, an HTTP(S) URL, or a base64 data URL — and\n * optional presentation members beside it. Nothing here adds a member the spec\n * does not state.\n *\n * `native.Date` is pinned the same way (`{date, time}`), but a `date` FIELD\n * inside a structured concept is not a `native.Date` value: it is a python\n * `datetime.date`, and the serialization layer stamps it with its class. So a\n * date arrives in one of three legal shapes, all three of which a run really\n * produces:\n *\n *   \"2026-03-14\"                                             a plain ISO string\n *   { date: \"2026-03-14\", __class__: \"date\", … }             a typed scalar\n *   { date: \"2026-03-14\", time: \"15:40:00\" }                 native.Date\n *\n * The typed-scalar envelope is the one shape the standard does NOT pin — it is\n * a serialization fact, measured off a real run rather than read off a spec —\n * and it is called out as such here so nobody mistakes it for normative.\n *\n * This module lives in core, not beside the control that renders it, for the\n * reason `file-formats.ts` established: a host that shows a result its own way\n * needs the same answer the control uses, and two copies of an answer is two\n * places for it to drift. Pure data and pure functions — no React.\n */\n\nimport { hasOwnProp, ownProp } from './own-property';\n\nfunction isRecord(value: unknown): value is Record<string, unknown> {\n  return typeof value === 'object' && value !== null && !Array.isArray(value);\n}\n\n/** A member the content models declare as `type = \"text\"`, when it is one. */\nfunction readText(record: Record<string, unknown>, key: string): string | undefined {\n  const value = ownProp(record, key);\n  return typeof value === 'string' && value.length > 0 ? value : undefined;\n}\n\nfunction readNumber(record: Record<string, unknown>, key: string): number | undefined {\n  const value = ownProp(record, key);\n  return typeof value === 'number' && Number.isFinite(value) ? value : undefined;\n}\n\n/**\n * `native.Document`, read.\n *\n * `url` is the only required member; everything else is a producer's courtesy,\n * so a reader that demands any of them describes a value the standard permits\n * as malformed.\n */\nexport interface DocumentContentView {\n  url: string;\n  publicUrl?: string;\n  mimeType?: string;\n  filename?: string;\n  title?: string;\n  snippet?: string;\n}\n\n/** `native.Image`, read. `width`/`height` are optional but PAIRED by the spec. */\nexport interface ImageContentView {\n  url: string;\n  publicUrl?: string;\n  caption?: string;\n  mimeType?: string;\n  filename?: string;\n  width?: number;\n  height?: number;\n  sourcePrompt?: string;\n}\n\n/** `native.Date` (and the typed-scalar envelope a nested `date` field arrives in). */\nexport interface DateContentView {\n  /** ISO 8601 calendar date, `YYYY-MM-DD`. */\n  date: string;\n  /** ISO 8601 time of day, present only when the source stated one. */\n  time?: string;\n}\n\n/**\n * Read a `document`-kind value. `undefined` when the value carries no `url`,\n * which is the one member the standard requires — a caller renders its own\n * absence rather than being handed a half-value to test.\n */\nexport function readDocumentContent(value: unknown): DocumentContentView | undefined {\n  if (!isRecord(value)) return undefined;\n  const url = readText(value, 'url');\n  if (url === undefined) return undefined;\n  return {\n    url,\n    publicUrl: readText(value, 'public_url'),\n    mimeType: readText(value, 'mime_type'),\n    filename: readText(value, 'filename'),\n    title: readText(value, 'title'),\n    snippet: readText(value, 'snippet'),\n  };\n}\n\n/** Read an `image`-kind value. Same contract as `readDocumentContent`. */\nexport function readImageContent(value: unknown): ImageContentView | undefined {\n  if (!isRecord(value)) return undefined;\n  const url = readText(value, 'url');\n  if (url === undefined) return undefined;\n  return {\n    url,\n    publicUrl: readText(value, 'public_url'),\n    caption: readText(value, 'caption'),\n    mimeType: readText(value, 'mime_type'),\n    filename: readText(value, 'filename'),\n    width: readNumber(value, 'width'),\n    height: readNumber(value, 'height'),\n    sourcePrompt: readText(value, 'source_prompt'),\n  };\n}\n\n/**\n * `native.Html`, read.\n *\n * The only content model here that is NOT reached by a field kind, and the\n * reason is a deliberate decision of the standard: the kind vocabulary has no\n * `html` member, so a `native.Html` value is an `object` node over its two\n * declared fields. That is right for the descriptor — the kinds name how a value\n * is ENTERED, and markup is entered as text — and wrong for a result view, which\n * would otherwise print a page's source at a reader.\n *\n * So this one is keyed by CONCEPT rather than by kind, through\n * `isNativeHtmlNode` below. That is a membership test on facts the descriptor\n * states (`concept_ref`, `refines`), which the standard's own page calls out as\n * the supported way to ask \"does this refine `native.X`?\" — the opposite of\n * inspecting a value to guess what it is.\n */\nexport interface HtmlContentView {\n  /** The markup itself. The one required member. */\n  innerHtml: string;\n  /** A class name for a wrapper a consumer may put around it, when stated. */\n  cssClass?: string;\n}\n\n/** Read an `native.Html` value. `undefined` when it carries no markup. */\nexport function readHtmlContent(value: unknown): HtmlContentView | undefined {\n  if (!isRecord(value)) return undefined;\n  const innerHtml = readText(value, 'inner_html');\n  if (innerHtml === undefined) return undefined;\n  return { innerHtml, cssClass: readText(value, 'css_class') };\n}\n\n/** The concept refs whose content model is multi-property, spelled once each. */\nexport const NATIVE_HTML_CONCEPT_REF = 'native.Html';\nexport const NATIVE_DATE_CONCEPT_REF = 'native.Date';\nexport const NATIVE_COMPOSITE_CONCEPT_REF = 'native.Composite';\n\n/** One member of a composite: the name it was composed under, and its content. */\nexport interface CompositeMember {\n  name: string;\n  value: unknown;\n}\n\n/**\n * Read a `native.Composite` — a named composition of contents.\n *\n * The members are returned in the order the payload states them, which is the\n * order the method composed them in and the only order there is: a composite\n * declares no fields, so there is no authored order to prefer over it.\n *\n * `undefined` for anything that is not a record, so the caller falls back.\n */\nexport function readCompositeContent(value: unknown): CompositeMember[] | undefined {\n  if (!isRecord(value)) return undefined;\n  return Object.entries(value).map(([name, member]) => ({ name, value: member }));\n}\n\n/**\n * Whether a descriptor node carries markup — its concept IS `native.Html`, or\n * refines it.\n *\n * The refinement chain is checked, not just the leaf, because a method may\n * declare `legal.ClauseMarkup` refining `native.Html` and a reader of that result\n * wants the markup rendered just the same. `refines` is on the wire for exactly\n * this question.\n */\nexport function isNativeHtmlNode(node: NativeNode): boolean {\n  return refinesNative(node, NATIVE_HTML_CONCEPT_REF);\n}\n\n/**\n * Whether a node IS a `native.Date` — the other content model the kind\n * vocabulary cannot name.\n *\n * `native.Date` is `{date, time}`, two properties, so nothing unwraps it and its\n * node is an `object`. Correct for the descriptor and wrong for a reader: a date\n * result rendered structurally is a two-field card whose second field says \"not\n * provided\", where the answer is a date. The `date` ARM already reads exactly\n * this model — `readDateContent` takes `{date, time}` — it just never fires,\n * because the kind says `object`.\n *\n * A `date` FIELD inside a structure is a different thing and needs none of this:\n * it carries `kind: \"date\"` already.\n */\nexport function isNativeDateNode(node: NativeNode): boolean {\n  return refinesNative(node, NATIVE_DATE_CONCEPT_REF);\n}\n\n/**\n * Whether a node is a `native.Composite` — a named bag of contents.\n *\n * The third concept the kind vocabulary cannot name, and the one where it is\n * least able to: a composite declares no members at all, so its descriptor is\n * `kind: \"unknown\"` and its payload schema is `{additionalProperties: true}`\n * with no properties. Both are TRUE — the standard's escape hatch, honestly\n * used — and both leave a renderer with nothing to read, so the default\n * fallback prints the whole thing as a JSON blob.\n *\n * That is the worst available answer to a value that is, by definition, a map\n * of ordinary `StuffContent`s. Keyed by concept, a renderer can at least show\n * the members as the named things they are. See `CompositeValue`.\n */\nexport function isNativeCompositeNode(node: NativeNode): boolean {\n  return refinesNative(node, NATIVE_COMPOSITE_CONCEPT_REF);\n}\n\n/**\n * Whether a node is one of the three natives the kind vocabulary cannot name —\n * a date, a page, a composite — which a renderer reads by CONCEPT before it\n * reads the kind. A list of one answers no (the predicates refuse a `list`\n * node), and its item answers yes.\n *\n * One answer, read twice: the result view renders a list whose item answers yes\n * one value per line rather than as a table, and the generative layer delegates\n * that list to the kernel, because no catalog component reads a native value.\n * Not re-exported: a host asks the three predicates it needs.\n */\nexport function isNativeValueNode(node: NativeNode): boolean {\n  return isNativeDateNode(node) || isNativeHtmlNode(node) || isNativeCompositeNode(node);\n}\n\n/** What the native predicates read off a node: its stated kind and its concept. */\ninterface NativeNode {\n  kind?: string;\n  conceptRef?: string;\n  refines?: readonly string[];\n}\n\n/**\n * The node IS one of the named native, or of a concept refining it.\n *\n * **A list of them is not one of them.** Plurality is not on the concept: a\n * plural node's `concept_ref` is its ELEMENT's, with the multiplicity stripped,\n * so a `native.Date[]` result is a `list` node whose concept reads\n * `native.Date`. Asking the concept alone answered yes for the whole list, and\n * every caller then treated the list as ONE date, one page or one composite: a\n * list of dates rendered as a single absent date, and a list of pages collected\n * no page at all. So a node whose stated kind is `list`\n * answers no, and its `item` answers for itself. The kind is the descriptor's\n * own statement, so this reads a stated fact and inspects no value.\n */\nfunction refinesNative(node: NativeNode, ref: string): boolean {\n  if (node.kind === 'list') return false;\n  if (node.conceptRef === ref) return true;\n  return node.refines?.includes(ref) ?? false;\n}\n\n/**\n * Read a `date`-kind value, in any of the three shapes a run produces.\n *\n * The `date` member is read one level deep, because `native.Date`'s own `date`\n * member is a `datetime.date` and therefore arrives inside the same typed-scalar\n * envelope the whole value may already be wrapped in. One level is enough and\n * the recursion is bounded on purpose: a second envelope would be a\n * serialization bug, and following it forever would turn one into a hang.\n */\nexport function readDateContent(value: unknown): DateContentView | undefined {\n  if (typeof value === 'string') {\n    return value.length > 0 ? { date: value } : undefined;\n  }\n  if (!isRecord(value)) return undefined;\n\n  const inner = ownProp(value, 'date');\n  const date =\n    typeof inner === 'string' ? inner : isRecord(inner) ? readText(inner, 'date') : undefined;\n  if (date === undefined) return undefined;\n  return { date, time: readText(value, 'time') };\n}\n\n/** `{date}` / `{date, time}` as one line, which is how both are read aloud. */\nexport function formatDateContent(content: DateContentView): string {\n  return content.time ? `${content.date} ${content.time}` : content.date;\n}\n\n/**\n * The media types a `data:` URL may carry and still be viewable.\n *\n * An allow-list rather than a deny-list, because the question a sink asks is\n * \"can this paint without executing\", and only a closed set answers it. The\n * raster types are the ones the preview arms already name; `application/pdf` is\n * here because the input control previews a `data:application/pdf` value a\n * storage-less host wrote back, through an `<object>`, and reads this same\n * predicate to decide.\n *\n * `image/svg+xml` is deliberately absent: an SVG paints as a picture and\n * EXECUTES as a document the moment it is opened in a tab, which is one click\n * away from every image this package paints.\n */\nconst VIEWABLE_DATA_MEDIA_TYPES = new Set([\n  'image/png',\n  'image/jpeg',\n  'image/gif',\n  'image/webp',\n  'image/avif',\n  'application/pdf',\n]);\n\n/**\n * An origin no host can be, to resolve a relative reference against.\n *\n * `.invalid` is reserved by RFC 2606 and resolves nowhere, so nothing can be\n * fetched from it by accident. It exists only so a path can be parsed at all;\n * the answer taken from the parse is whether the reference STAYED on it.\n */\nconst RELATIVE_SENTINEL_ORIGIN = 'https://url-gate.invalid';\n\n/**\n * A scheme, by RFC 3986's grammar: a letter, then letters, digits, `+`, `-`, `.`\n *\n * Read off the string rather than inferred from a parse, because a parse needs a\n * base and the base is what makes the answer wrong — see {@link viewableUrl}.\n */\nconst OWN_SCHEME_RE = /^[a-z][a-z0-9+.-]*:/i;\n\n/**\n * What the WHATWG URL parser strips before it parses, applied before we judge.\n *\n * Leading and trailing C0 controls and spaces are removed, and every internal\n * tab, line feed and carriage return. This is not tidying: a scheme test run on\n * the raw string and a browser running on the parsed one disagree about\n * `\" https://cdn/x.png\"` — `new URL()` reads it as `https:` and `/^https?:/`\n * does not — and a host that validated a member by parsing while this gate\n * prefix-matched would have judged a different string than the one painted.\n */\nfunction stripUrlWhitespace(candidate: string): string {\n  // Written out rather than as a character-class regex: the range IS the control\n  // characters, which is exactly what a regex may not spell (`no-control-regex`).\n  let start = 0;\n  let end = candidate.length;\n  while (start < end && candidate.charCodeAt(start) <= 0x20) start += 1;\n  while (end > start && candidate.charCodeAt(end - 1) <= 0x20) end -= 1;\n  // Scan before rebuilding, and rebuild only from the first character that has\n  // to go. Almost every URL has nothing to strip inside it, and the one that\n  // does is the one that is huge: an inline `data:` image is judged three or\n  // four times per render, and a per-character rebuild of a megabyte-long\n  // payload each time is hundreds of milliseconds of frozen main thread for a\n  // string that comes back identical.\n  for (let index = start; index < end; index += 1) {\n    const code = candidate.charCodeAt(index);\n    // Tab, line feed, carriage return - removed wherever they appear, not only\n    // at the edges, which is what the parser does with them.\n    if (code === 0x09 || code === 0x0a || code === 0x0d) {\n      let stripped = candidate.slice(start, index);\n      for (let rest = index; rest < end; rest += 1) {\n        const restCode = candidate.charCodeAt(rest);\n        if (restCode !== 0x09 && restCode !== 0x0a && restCode !== 0x0d)\n          stripped += candidate[rest];\n      }\n      return stripped;\n    }\n  }\n  return start === 0 && end === candidate.length ? candidate : candidate.slice(start, end);\n}\n\n/** What a `data:` URL says about the bytes it carries. */\nexport interface DataUrlView {\n  /** Lowercased, without its parameters; `text/plain` when the URL declares none. */\n  mediaType: string;\n  /** The size of the DECODED payload, in bytes. */\n  bytes: number;\n}\n\n/**\n * A `data:` URL's media type and decoded size, or `undefined` for any other URL.\n *\n * A host that encodes a picked file in the browser writes the file itself into\n * the value's `url`, so a thirty-kilobyte PDF is a forty-thousand-character\n * string, and printed where a reference would be it tells a person nothing. Its\n * type and its size are what they can read.\n *\n * The size is COUNTED rather than decoded. A base64 payload's size follows from\n * how many symbols it holds, and decoding a megabyte to measure it would be the\n * frozen main thread {@link stripUrlWhitespace} is written to avoid. This is a\n * reading for display, not a gate: whether the URL may be painted is still\n * {@link viewableUrl}'s answer alone.\n */\nexport function readDataUrl(candidate: string): DataUrlView | undefined {\n  const url = candidate.trimStart();\n  if (!/^data:/i.test(url)) return undefined;\n  const comma = url.indexOf(',');\n  if (comma === -1) return undefined;\n  const [declared = '', ...parameters] = url.slice('data:'.length, comma).split(';');\n  const trimmed = declared.trim().toLowerCase();\n  // A fragment is not payload. `#page=2` on an inline PDF is the viewer's, and\n  // counting it as bytes is counting the URL rather than the file.\n  const fragment = url.indexOf('#', comma);\n  const payload = fragment === -1 ? url.slice(comma + 1) : url.slice(comma + 1, fragment);\n  const base64 = parameters.some((parameter) => parameter.trim().toLowerCase() === 'base64');\n  return {\n    mediaType: trimmed === '' ? 'text/plain' : trimmed,\n    bytes: base64 ? base64Bytes(payload) : percentEncodedBytes(payload),\n  };\n}\n\n/**\n * Three bytes for every four symbols, ignoring what is not one: the `=`\n * padding, and the line breaks a MIME encoder wraps its output at. Both\n * alphabets count, the standard one and the URL-safe one.\n *\n * A percent-escape is resolved to the character it stands for before it is\n * judged, because a payload may be escaped anywhere — `YQ%3D%3D` is `YQ==`,\n * one byte, and counting `3` and `D` as symbols made it four.\n */\nfunction base64Bytes(payload: string): number {\n  let symbols = 0;\n  for (let index = 0; index < payload.length; index += 1) {\n    let code = payload.charCodeAt(index);\n    if (code === 0x25) {\n      const escaped = Number.parseInt(payload.slice(index + 1, index + 3), 16);\n      if (!Number.isNaN(escaped) && index + 2 < payload.length) {\n        code = escaped;\n        index += 2;\n      }\n    }\n    if (\n      (code >= 0x41 && code <= 0x5a) ||\n      (code >= 0x61 && code <= 0x7a) ||\n      (code >= 0x30 && code <= 0x39) ||\n      code === 0x2b ||\n      code === 0x2f ||\n      code === 0x2d ||\n      code === 0x5f\n    )\n      symbols += 1;\n  }\n  return Math.floor((symbols * 3) / 4);\n}\n\n/** A percent-escape is one byte; any other character is its UTF-8 length. */\nfunction percentEncodedBytes(payload: string): number {\n  const escapes = payload.match(/%[0-9a-f]{2}/gi)?.length ?? 0;\n  return new TextEncoder().encode(payload).length - escapes * 2;\n}\n\n/** The media type a `data:` URL declares, lowercased; `text/plain` when it declares none. */\nfunction dataUrlMediaType(parsed: URL): string {\n  const declared = parsed.pathname.split(/[;,]/, 1)[0] ?? '';\n  const trimmed = declared.trim().toLowerCase();\n  return trimmed === '' ? 'text/plain' : trimmed;\n}\n\n/**\n * The URL a browser can paint, normalised — or `undefined` when there is none.\n *\n * **The string this returns is the string a sink must use.** That is the whole\n * point of returning one rather than answering yes or no: the gate judges a\n * normalised URL, so handing the caller back the raw member would let the two\n * diverge again on exactly the whitespace the parser strips.\n *\n * The gate parses rather than prefix-matches, and branches on the protocol the\n * parser reports:\n *\n * - `http:` and `https:` are viewable.\n * - `blob:` is viewable. A blob URL is bound to the origin that minted it, so a\n *   payload cannot forge one that points anywhere else.\n * - `data:` is viewable only for a media type in {@link VIEWABLE_DATA_MEDIA_TYPES}.\n *   `data:text/html` is a document at the EMBEDDING page's own origin, which is\n *   what made an unsandboxed frame over a payload URL a real hole.\n * - Everything else is not: `javascript:`, `file:` (a run on a developer's\n *   machine writes one, and a browser refuses to load it from an http page) and\n *   `pipelex-storage://`, which cannot be resolved client-side at all — that is\n *   the upload seam's job (see [../../docs/upload-seam.md]), and a renderer with\n *   no resolver must show the reference rather than a broken `<img>`.\n *\n * **A root-relative path counts**, and leaving it out was a real bug rather\n * than an omission. A host's URL resolver naturally hands back a path on its\n * OWN origin — `/api/assets/…`, an authenticated route that streams the object\n * — which is the whole point of resolving rather than exposing storage. This\n * predicate rejected it for having no scheme, so the resolved URL was thrown\n * away and the arms fell back to the payload's `public_url`: a presigned URL\n * that had already expired. The image stayed broken with the fix in place.\n *\n * A path is rejected when it is protocol-relative — `//host/x`, and the two\n * backslash spellings the parser reads the same way (`\\\\host\\x`, `/\\host/x`) —\n * and then checked against the sentinel as well. An accepted path is returned\n * relative, because making it absolute against a sentinel would point it at\n * nowhere.\n */\nexport function viewableUrl(candidate: string | undefined): string | undefined {\n  if (!candidate) return undefined;\n  const stripped = stripUrlWhitespace(candidate);\n  if (stripped === '') return undefined;\n\n  // Whether the string carries a scheme is read OFF THE STRING, before any base\n  // is applied, because the parser reads a candidate whose scheme equals the\n  // base's as relative to that base. Deciding it with a second, base-less parse\n  // let the two disagree: `https:cdn.example/x.png` was judged absolute and\n  // resolved against the sentinel, so the gate handed a sink\n  // `https://url-gate.invalid/cdn.example/x.png` — an internal placeholder, in a\n  // real `<img src>`, in place of a URL that had worked. The grammar is RFC\n  // 3986's, and it agrees with the parser on every string either accepts.\n  if (OWN_SCHEME_RE.test(stripped)) {\n    let parsed: URL;\n    try {\n      parsed = new URL(stripped);\n    } catch {\n      return undefined;\n    }\n    switch (parsed.protocol) {\n      case 'http:':\n      case 'https:':\n      case 'blob:':\n        return parsed.href;\n      case 'data:':\n        return VIEWABLE_DATA_MEDIA_TYPES.has(dataUrlMediaType(parsed)) ? parsed.href : undefined;\n      default:\n        return undefined;\n    }\n  }\n\n  // No scheme of its own: a reference relative to wherever the page is. Only a\n  // root-relative path qualifies.\n  if (!stripped.startsWith('/')) return undefined;\n  // Protocol-relative, rejected on the SPELLING. \"Did it stay on the sentinel\"\n  // reads as the same rule and is blind in exactly one place — the sentinel's\n  // own host — so `//url-gate.invalid/x` passed the test written to stop it.\n  const afterSlash = stripped.charCodeAt(1);\n  if (afterSlash === 0x2f || afterSlash === 0x5c) return undefined;\n  let parsed: URL;\n  try {\n    parsed = new URL(stripped, RELATIVE_SENTINEL_ORIGIN);\n  } catch {\n    return undefined;\n  }\n  return parsed.origin === RELATIVE_SENTINEL_ORIGIN ? stripped : undefined;\n}\n\n/**\n * Whether a browser can paint this URL as-is — {@link viewableUrl} as a guard.\n *\n * Prefer `viewableUrl` wherever the URL is then USED: this answers the question\n * without handing back the normalised string, so a caller that acts on the raw\n * candidate acts on a string the gate did not judge.\n */\nexport function isViewableUrl(url: string | undefined): url is string {\n  return viewableUrl(url) !== undefined;\n}\n\n/**\n * The typed-scalar markers the serialization layer stamps onto a value.\n *\n * Exported so a host can recognise (and strip) them; nothing in the kernel\n * BRANCHES on them, which is the point — a reader keyed by these would be\n * reading the serializer instead of the standard.\n */\nexport const TYPED_SCALAR_MARKERS = ['__class__', '__module__'] as const;\n\n/** Whether a record carries the typed-scalar markers. Informational. */\nexport function hasTypedScalarMarkers(value: unknown): boolean {\n  return isRecord(value) && TYPED_SCALAR_MARKERS.every((marker) => hasOwnProp(value, marker));\n}\n"]}

package/dist/{chunk-XYQ7NXQZ.js → chunk-WYH56SOZ.js}

@@ -27,5 +27,5 @@ function inputMustBeFilled(input) {
 }
 
 export { buildPipeRef, getPipeIOContract, inputMustBeFilled, isFixedCountInput, isOptionalInput, isPluralInput };
-//# sourceMappingURL=chunk-XYQ7NXQZ.js.map
-//# sourceMappingURL=chunk-XYQ7NXQZ.js.map
+//# sourceMappingURL=chunk-WYH56SOZ.js.map
+//# sourceMappingURL=chunk-WYH56SOZ.js.map

package/dist/chunk-WYH56SOZ.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/core/contracts.ts"],"names":[],"mappings":";;;AA4DO,SAAS,YAAA,CAAa,QAAgB,QAAA,EAA0B;AACrE,EAAA,OAAO,CAAA,EAAG,MAAM,CAAA,CAAA,EAAI,QAAQ,CAAA,CAAA;AAC9B;AAkBO,SAAS,iBAAA,CACd,eAAA,EACA,MAAA,EACA,QAAA,EAC4B;AAC5B,EAAA,IAAI,CAAC,eAAA,IAAmB,CAAC,QAAA,EAAU,OAAO,MAAA;AAC1C,EAAA,IAAI,MAAA,EAAQ;AACV,IAAA,MAAM,QAAQ,OAAA,CAAQ,eAAA,EAAiB,YAAA,CAAa,MAAA,EAAQ,QAAQ,CAAC,CAAA;AACrE,IAAA,IAAI,OAAO,OAAO,KAAA;AAAA,EACpB;AACA,EAAA,OAAO,OAAA,CAAQ,iBAAiB,QAAQ,CAAA;AAC1C;AAWO,SAAS,gBAAgB,KAAA,EAAmC;AACjE,EAAA,OAAO,MAAM,QAAA,KAAa,UAAA;AAC5B;AAcO,SAAS,cAAc,KAAA,EAAmC;AAC/D,EAAA,OAAQ,KAAA,CAAM,aAAgD,IAAA,KAAS,OAAA;AACzE;AASO,SAAS,kBAAkB,KAAA,EAAmC;AACnE,EAAA,OAAO,MAAM,YAAA,KAAiB,OAAA;AAChC;AAqBO,SAAS,kBAAkB,KAAA,EAAmC;AACnE,EAAA,IAAI,eAAA,CAAgB,KAAK,CAAA,EAAG,OAAO,KAAA;AACnC,EAAA,OAAO,CAAC,aAAA,CAAc,KAAK,CAAA,IAAK,kBAAkB,KAAK,CAAA;AACzD","file":"chunk-WYH56SOZ.js","sourcesContent":["/**\n * The `pipe_io_contracts` types and the kernel's gating predicates over them.\n *\n * The types are the STANDARD'S, imported from `mthds/protocol` and re-exported\n * under the names this package has always exported. `pipe_io_contracts` is an\n * MTHDS artifact - the standard specifies it (the \"Pipe I/O Contracts\" page)\n * and its TypeScript client declares it - so this module states no shape of its\n * own any more. What it keeps is the half that is genuinely the kernel's: the\n * predicates that turn a declared slot into a gating answer, and the lookup\n * that tolerates both key conventions a real payload arrives with.\n *\n * `mthds` is a TYPES-ONLY dependency: every import here is `import type`,\n * so nothing survives into `dist/` and no consumer ships the standard's CLI.\n * `scripts/assert-bundle.mjs` holds that on the built graph and lint holds it\n * on the source. See docs/dependency-budget.md.\n *\n * The map itself is keyed by namespaced pipe ref (`<domain>.<pipe_code>`),\n * NOT bare pipe code - use `getPipeIOContract` to look entries up by the bare\n * codes the UI tracks.\n */\n\nimport type {\n  IOMultiplicity,\n  PipeInputContract,\n  PipeIOContract,\n  PipeIOContracts,\n  PipeOutputContract,\n  PresenceMarker,\n} from 'mthds/protocol';\n\nimport { ownProp } from './own-property';\n\nexport type {\n  IOMultiplicity,\n  PipeInputContract,\n  PipeIOContract,\n  PipeIOContracts,\n  PipeOutputContract,\n};\n\n/**\n * The authored presence marker on an input slot, verbatim - the standard's\n * `PresenceMarker` under the name this package exports.\n *\n * - `plain` - no marker: the caller must supply the input.\n * - `optional` (`?`) - the caller may omit it and the pipe handles the absence\n *   itself.\n * - `force` (`!`) - a use-site assertion that the value IS present. It must be\n *   supplied, exactly like `plain`; the distinction is the authored assertion,\n *   which lint and graph surfaces read and a form does not.\n *\n * Kept as an alias rather than renamed because a consumer imports it by this\n * name; a host that would rather read the standard's spelling gets `mthds`\n * installed alongside this package and can import `PresenceMarker` straight\n * from `mthds/protocol`.\n */\nexport type InputPresence = PresenceMarker;\n\n/** Namespaced pipe ref (`<domain>.<pipe_code>`) - the identity convention the\n *  validate artifacts key on. */\nexport function buildPipeRef(domain: string, pipeCode: string): string {\n  return `${domain}.${pipeCode}`;\n}\n\n/**\n * Look up a pipe's IO contract by pipe code, tolerant of both key conventions.\n *\n * The map may be keyed by namespaced `pipe_ref` (`<domain>.<code>`, the\n * canonical convention) OR by bare pipe code - the current hosted `/validate`\n * keys `pipe_structures` by bare code, and methods persisted before the\n * pipe_ref re-keying also carry bare-code keys. Try the namespaced ref first\n * (when the caller supplies a domain), then fall back to the bare code.\n * Returns `undefined` (never crashes) when neither matches.\n *\n * Both lookups read OWN properties only. A bare index returned the inherited\n * `Object` constructor for a pipe code named `constructor` (or `toString`, …) -\n * a truthy non-contract that sailed straight through the `if (!contract)` guard\n * hosts are shown writing, so a pipe that does not exist rendered as one taking\n * no inputs instead of reaching the host's not-found path. See `ownProp`.\n */\nexport function getPipeIOContract(\n  pipeIoContracts: PipeIOContracts | null | undefined,\n  domain: string | null | undefined,\n  pipeCode: string | null | undefined,\n): PipeIOContract | undefined {\n  if (!pipeIoContracts || !pipeCode) return undefined;\n  if (domain) {\n    const byRef = ownProp(pipeIoContracts, buildPipeRef(domain, pipeCode));\n    if (byRef) return byRef;\n  }\n  return ownProp(pipeIoContracts, pipeCode);\n}\n\n/**\n * True when the method declared the input omittable (`?`).\n *\n * The ONE reader of `presence` in the package: everything that asks \"may this\n * be absent?\" - the descriptor's `required`, the gate's `required` list, the\n * payload builders that omit an unfilled input - goes through here, so a\n * marker the wire adds later cannot mean one thing on one surface and another\n * elsewhere. `force` (`!`) reads as NOT optional, like `plain`.\n */\nexport function isOptionalInput(input: PipeInputContract): boolean {\n  return input.presence === 'optional';\n}\n\n/**\n * True when the input carries a plural concept (`Image[]`, `Image[3]`): its\n * JSON Schema is an array wrapper.\n *\n * Deliberately a SCHEMA test rather than a read of the declared `multiplicity`,\n * even though the wire now states both. The schema is what `buildRunFields`\n * maps and therefore what the user is shown; a predicate reading the other\n * field could disagree with the rendered control, which is the exact failure\n * mode `mustBeFilled` (readiness.ts) exists to prevent. The two agree by\n * construction upstream - the engine wraps the schema in an array exactly when\n * it reports `variable` or `fixed`.\n */\nexport function isPluralInput(input: PipeInputContract): boolean {\n  return (input.json_schema as { type?: unknown } | undefined)?.type === 'array';\n}\n\n/**\n * True when the slot declares an EXACT number of items (`Concept[N]`), whose\n * count is `item_count`.\n *\n * The distinction that matters to the gate: a variable list can legitimately be\n * empty, a fixed one cannot.\n */\nexport function isFixedCountInput(input: PipeInputContract): boolean {\n  return input.multiplicity === 'fixed';\n}\n\n/**\n * True when the user MUST put a value in before a run can start.\n *\n * Two declarations relieve an input of that duty, for different reasons:\n * - **optional (`?`)** - the method itself states the caller may omit it;\n * - **variable-plural (`[]`)** - the empty list is a legitimate value and the\n *   language cannot declare \"at least one\", so gating on it would invent a\n *   constraint the method never made.\n *\n * Everything else gates: `plain`, `force` (`!`), and a **fixed-count** list\n * (`[N]`), which is a list whose empty form the method has explicitly ruled out.\n * This is the derivation the input-form descriptor spec states for `gating`.\n *\n * Emptiness is all this predicate answers for - WHETHER a slot gates, never how\n * much it needs. A fixed-count list that holds fewer items than it declares\n * gates here and is refused by `fieldFilled`, which reads the declared count off\n * the descriptor's `itemCount`, and by the gate's ajv pass on the schema's\n * `minItems`. All three read the one number the method stated.\n */\nexport function inputMustBeFilled(input: PipeInputContract): boolean {\n  if (isOptionalInput(input)) return false;\n  return !isPluralInput(input) || isFixedCountInput(input);\n}\n"]}

package/dist/chunk-XCO6GTEC.js

@@ -0,0 +1,38 @@
+// src/core/file-formats.ts
+var DOCUMENT_FORMATS = [
+  { mimeType: "application/pdf", extensions: [".pdf"], label: "PDF" },
+  { mimeType: "image/jpeg", extensions: [".jpg", ".jpeg"], label: "JPG" },
+  { mimeType: "image/png", extensions: [".png"], label: "PNG" }
+];
+var IMAGE_FORMATS = [
+  { mimeType: "image/png", extensions: [".png"], label: "PNG" },
+  { mimeType: "image/jpeg", extensions: [".jpg", ".jpeg"], label: "JPG" },
+  { mimeType: "image/webp", extensions: [".webp"], label: "WEBP" }
+];
+function formatsForKind(kind) {
+  return kind === "image" ? IMAGE_FORMATS : DOCUMENT_FORMATS;
+}
+function normalizeMimeType(type) {
+  return type.split(";", 1)[0]?.trim().toLowerCase() ?? "";
+}
+function acceptLabel(formats) {
+  return formats.map((format) => format.label).join(", ");
+}
+function formatOfFilename(formats, filename) {
+  const name = filename.toLowerCase();
+  return formats.find((format) => format.extensions.some((ext) => name.endsWith(ext)));
+}
+function isAcceptedFile(formats, file) {
+  const mimeType = normalizeMimeType(file.type);
+  if (mimeType) return formats.some((format) => format.mimeType === mimeType);
+  return formatOfFilename(formats, file.name) !== void 0;
+}
+function acceptMap(formats) {
+  const map = {};
+  for (const format of formats) map[format.mimeType] = [...format.extensions];
+  return map;
+}
+
+export { DOCUMENT_FORMATS, IMAGE_FORMATS, acceptLabel, acceptMap, formatOfFilename, formatsForKind, isAcceptedFile, normalizeMimeType };
+//# sourceMappingURL=chunk-XCO6GTEC.js.map
+//# sourceMappingURL=chunk-XCO6GTEC.js.map

package/dist/chunk-XCO6GTEC.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/core/file-formats.ts"],"names":[],"mappings":";AA2EO,IAAM,gBAAA,GAA0C;AAAA,EACrD,EAAE,UAAU,iBAAA,EAAmB,UAAA,EAAY,CAAC,MAAM,CAAA,EAAG,OAAO,KAAA,EAAM;AAAA,EAClE,EAAE,UAAU,YAAA,EAAc,UAAA,EAAY,CAAC,MAAA,EAAQ,OAAO,CAAA,EAAG,KAAA,EAAO,KAAA,EAAM;AAAA,EACtE,EAAE,UAAU,WAAA,EAAa,UAAA,EAAY,CAAC,MAAM,CAAA,EAAG,OAAO,KAAA;AACxD;AAUO,IAAM,aAAA,GAAuC;AAAA,EAClD,EAAE,UAAU,WAAA,EAAa,UAAA,EAAY,CAAC,MAAM,CAAA,EAAG,OAAO,KAAA,EAAM;AAAA,EAC5D,EAAE,UAAU,YAAA,EAAc,UAAA,EAAY,CAAC,MAAA,EAAQ,OAAO,CAAA,EAAG,KAAA,EAAO,KAAA,EAAM;AAAA,EACtE,EAAE,UAAU,YAAA,EAAc,UAAA,EAAY,CAAC,OAAO,CAAA,EAAG,OAAO,MAAA;AAC1D;AASO,SAAS,eAAe,IAAA,EAAmD;AAChF,EAAA,OAAO,IAAA,KAAS,UAAU,aAAA,GAAgB,gBAAA;AAC5C;AAMO,SAAS,kBAAkB,IAAA,EAAsB;AACtD,EAAA,OAAO,IAAA,CAAK,KAAA,CAAM,GAAA,EAAK,CAAC,CAAA,CAAE,CAAC,CAAA,EAAG,IAAA,EAAK,CAAE,WAAA,EAAY,IAAK,EAAA;AACxD;AAGO,SAAS,YAAY,OAAA,EAAwC;AAClE,EAAA,OAAO,OAAA,CAAQ,IAAI,CAAC,MAAA,KAAW,OAAO,KAAK,CAAA,CAAE,KAAK,IAAI,CAAA;AACxD;AAMO,SAAS,gBAAA,CACd,SACA,QAAA,EACwB;AACxB,EAAA,MAAM,IAAA,GAAO,SAAS,WAAA,EAAY;AAClC,EAAA,OAAO,OAAA,CAAQ,IAAA,CAAK,CAAC,MAAA,KAAW,MAAA,CAAO,UAAA,CAAW,IAAA,CAAK,CAAC,GAAA,KAAQ,IAAA,CAAK,QAAA,CAAS,GAAG,CAAC,CAAC,CAAA;AACrF;AAcO,SAAS,cAAA,CACd,SACA,IAAA,EACS;AACT,EAAA,MAAM,QAAA,GAAW,iBAAA,CAAkB,IAAA,CAAK,IAAI,CAAA;AAC5C,EAAA,IAAI,QAAA,SAAiB,OAAA,CAAQ,IAAA,CAAK,CAAC,MAAA,KAAW,MAAA,CAAO,aAAa,QAAQ,CAAA;AAC1E,EAAA,OAAO,gBAAA,CAAiB,OAAA,EAAS,IAAA,CAAK,IAAI,CAAA,KAAM,MAAA;AAClD;AASO,SAAS,UAAU,OAAA,EAA0D;AAClF,EAAA,MAAM,MAAgC,EAAC;AACvC,EAAA,KAAA,MAAW,MAAA,IAAU,SAAS,GAAA,CAAI,MAAA,CAAO,QAAQ,CAAA,GAAI,CAAC,GAAG,MAAA,CAAO,UAAU,CAAA;AAC1E,EAAA,OAAO,GAAA;AACT","file":"chunk-XCO6GTEC.js","sourcesContent":["/**\n * What a `document` or an `image` slot actually accepts.\n *\n * **This is a client-side mirror of a runtime fact, and the fact was measured\n * rather than read off a list.** The wire says a slot's kind is `document` or\n * `image` and stops there — which bytes a runtime can decode is a property of\n * that runtime, not of the method — so the list has to live on this side, and\n * the only honest place is one module that says where it came from.\n *\n * There is no single enum to copy. In `pipelex`, what a slot accepts is derived\n * per model:\n *\n *   ModelSpec.supported_document_types = {\"pdf\",\"docx\",\"pptx\"} & set(inputs)\n *   ModelSpec.is_vision_supported      = \"images\" in inputs\n *\n * so the effective set is that vocabulary intersected with the **model deck's**\n * declared `inputs`. No model in the shipped deck declares `docx` or `pptx`;\n * every LLM entry is `[\"text\", \"images\", \"pdf\"]`, and the default extract model\n * (`azure-document-intelligence`) is `[\"image\", \"pdf\"]`.\n *\n * Confirmed by running each format end to end:\n *\n * | Format | PipeExtract | PipeLLM |\n * | --- | --- | --- |\n * | PDF  | yes | yes |\n * | PNG  | yes | n/a |\n * | JPEG | yes | n/a |\n * | WEBP | no  | no  |\n * | DOCX | no  | no — `does not support docx documents` |\n * | PPTX | no  | no — detected as `zip`, so it never even reaches the check |\n *\n * The gateway states its own list in the failure: *\"Supported formats:\n * application/pdf, image/jpeg, image/png as base64 data URLs.\"*\n *\n * Images were measured the same way: PNG, JPEG and WEBP pass; BMP and TIFF fail\n * on the provider's image enum; GIF fails too, though it is *in* that enum — it\n * arrives at the provider as a document block rather than an image one, which\n * looks like a routing bug upstream rather than an unsupported format.\n *\n * **A document slot's PNG and JPEG only work in an extract pipe.** The\n * descriptor never says which operator consumes the slot, so this table cannot\n * distinguish them; it matches the extract model's declared inputs, because\n * extraction is the operator that actually reads a document's bytes.\n *\n * What was here before was built on `DocumentFormat` (PDF/DOCX/PPTX), an enum\n * that is referenced nowhere in the runtime outside commented-out code and is\n * being deleted. A dead enum is the worst kind of source: it reads exactly like\n * a live one.\n *\n * A stale entry here is worse than no list at all, because it refuses a file the\n * runtime would have taken. If the deck grows a format, this table moves with it.\n *\n * **The table is the source; a field's `formats` is what gets read.** The\n * helpers below take a format LIST rather than a kind, because what a given\n * slot accepts can be narrower than its kind: a host whose server takes only\n * some of these types narrows the field tree once (`narrowFileFormats`), and\n * the dropzone's hint, its picker filter and its check all read the narrowed\n * list, so the three cannot disagree with each other or with that server.\n *\n * Pure data and pure functions over it. No React, no ajv, nothing imported.\n */\n\n/** One accepted format: its MIME type and the extensions that carry it. */\nexport interface FileFormat {\n  mimeType: string;\n  /** Leading dot, lowercase — the shape a file input's `accept` wants. */\n  extensions: string[];\n  /** How the format is named to a user, uppercase. */\n  label: string;\n}\n\n/**\n * What a `document` slot takes: PDF, plus the two image formats the extract\n * model reads as a single-page document.\n */\nexport const DOCUMENT_FORMATS: readonly FileFormat[] = [\n  { mimeType: 'application/pdf', extensions: ['.pdf'], label: 'PDF' },\n  { mimeType: 'image/jpeg', extensions: ['.jpg', '.jpeg'], label: 'JPG' },\n  { mimeType: 'image/png', extensions: ['.png'], label: 'PNG' },\n];\n\n/**\n * What an `image` slot takes: PNG, JPEG, WEBP — all three measured through the\n * vision path.\n *\n * `.jpg` and `.jpeg` both ride `image/jpeg`. `JPG` is the label because that is\n * the spelling the runtime uses, but a file named `.jpeg` is the same bytes and\n * must not be refused over its spelling.\n */\nexport const IMAGE_FORMATS: readonly FileFormat[] = [\n  { mimeType: 'image/png', extensions: ['.png'], label: 'PNG' },\n  { mimeType: 'image/jpeg', extensions: ['.jpg', '.jpeg'], label: 'JPG' },\n  { mimeType: 'image/webp', extensions: ['.webp'], label: 'WEBP' },\n];\n\n/**\n * The source table: every format a slot of this kind can take, before a host\n * narrows it. `buildRunFields` stamps this onto each `document` and `image`\n * field as its `formats`, and everything downstream reads the field's list\n * rather than coming back here - which is what lets a host narrow one list and\n * have the hint, the picker and the check all follow it.\n */\nexport function formatsForKind(kind: 'document' | 'image'): readonly FileFormat[] {\n  return kind === 'image' ? IMAGE_FORMATS : DOCUMENT_FORMATS;\n}\n\n/**\n * A MIME type as the table spells it: no parameters, no surrounding space,\n * lowercase. `APPLICATION/PDF; version=1.7` is `application/pdf`.\n */\nexport function normalizeMimeType(type: string): string {\n  return type.split(';', 1)[0]?.trim().toLowerCase() ?? '';\n}\n\n/** `\"PDF, JPG, PNG\"` - the hint shown under a dropzone. */\nexport function acceptLabel(formats: readonly FileFormat[]): string {\n  return formats.map((format) => format.label).join(', ');\n}\n\n/**\n * The format a filename's extension names, among these formats, or `undefined`\n * when it names none of them. Case-insensitive, because `PHOTO.PNG` is a PNG.\n */\nexport function formatOfFilename(\n  formats: readonly FileFormat[],\n  filename: string,\n): FileFormat | undefined {\n  const name = filename.toLowerCase();\n  return formats.find((format) => format.extensions.some((ext) => name.endsWith(ext)));\n}\n\n/**\n * Whether a picked file is one of these formats.\n *\n * Checks the MIME type first and falls back to the extension, because a\n * browser's `File.type` is empty often enough to matter: an OS with no handler\n * registered for `.docx` reports `''`, and refusing that file would be refusing\n * a valid one over a fact about the user's machine. A wrong-but-present MIME\n * type is still a rejection — that is the case this exists for.\n *\n * It takes the field's own list, never the kind's, so a slot a host narrowed\n * refuses exactly what its hint no longer names.\n */\nexport function isAcceptedFile(\n  formats: readonly FileFormat[],\n  file: { name: string; type: string },\n): boolean {\n  const mimeType = normalizeMimeType(file.type);\n  if (mimeType) return formats.some((format) => format.mimeType === mimeType);\n  return formatOfFilename(formats, file.name) !== undefined;\n}\n\n/**\n * The accept map a file input wants: MIME type to extensions.\n *\n * Shaped for `react-dropzone`'s `accept`, which is the same shape the DOM's\n * `accept` attribute is built from. Listing extensions BESIDE the MIME type is\n * what makes the empty-`File.type` case above work in the OS picker too.\n */\nexport function acceptMap(formats: readonly FileFormat[]): Record<string, string[]> {\n  const map: Record<string, string[]> = {};\n  for (const format of formats) map[format.mimeType] = [...format.extensions];\n  return map;\n}\n"]}

package/dist/{chunk-YEVVR6FE.js → chunk-Y2ND6W4W.js}

@@ -1,5 +1,5 @@
 import { collectSchemaDefs, collapseNullable, derefSchema, schemaTypeOf } from './chunk-OD3VYXUY.js';
-import { isOptionalInput, inputMustBeFilled } from './chunk-XYQ7NXQZ.js';
+import { isOptionalInput, inputMustBeFilled } from './chunk-WYH56SOZ.js';
 
 // src/core/gating-fields.ts
 function numOrUndef(v) {
@@ -62,5 +62,5 @@ function gatingFieldsFromInputs(inputs) {
 }
 
 export { gatingFieldsFromInputs };
-//# sourceMappingURL=chunk-YEVVR6FE.js.map
-//# sourceMappingURL=chunk-YEVVR6FE.js.map
+//# sourceMappingURL=chunk-Y2ND6W4W.js.map
+//# sourceMappingURL=chunk-Y2ND6W4W.js.map

package/dist/{chunk-YEVVR6FE.js.map → chunk-Y2ND6W4W.js.map}

@@ -1 +1 @@
-{"version":3,"sources":["../src/core/gating-fields.ts"],"names":[],"mappings":";;;;AAoCA,SAAS,WAAW,CAAA,EAAgC;AAClD,EAAA,OAAO,OAAO,CAAA,KAAM,QAAA,GAAW,CAAA,GAAI,MAAA;AACrC;AAEA,SAAS,UAAA,CACP,IAAA,EACA,SAAA,EACA,QAAA,EACA,MACA,MAAA,EACU;AAgBV,EAAA,IAAI,MAAA,GAAS,SAAA;AACb,EAAA,IAAI,IAAA,GAAO,MAAA;AACX,EAAA,WAAS;AACP,IAAA,MAAM,MAAM,MAAA,CAAO,IAAA;AACnB,IAAA,IAAI,OAAO,QAAQ,QAAA,EAAU;AAC3B,MAAA,IAAI,IAAA,CAAK,IAAI,GAAG,CAAA,SAAU,EAAE,IAAA,EAAM,QAAA,EAAU,IAAA,EAAM,SAAA,EAAU;AAC5D,MAAA,IAAA,GAAO,IAAI,GAAA,CAAI,IAAI,CAAA,CAAE,IAAI,GAAG,CAAA;AAAA,IAC9B;AACA,IAAA,MAAM,IAAA,GAAO,gBAAA,CAAiB,WAAA,CAAY,MAAA,EAAQ,IAAI,CAAC,CAAA;AACvD,IAAA,IAAI,SAAS,MAAA,EAAQ;AACrB,IAAA,MAAA,GAAS,IAAA;AAAA,EACX;AACA,EAAA,MAAM,IAAA,GAAO,aAAa,MAAM,CAAA;AAEhC,EAAA,IAAI,SAAS,OAAA,EAAS;AACpB,IAAA,MAAM,IAAA,GAAO,WAAW,IAAA,EAAO,MAAA,CAAO,SAAwB,EAAC,EAAG,IAAA,EAAM,IAAA,EAAM,IAAI,CAAA;AAClF,IAAA,MAAM,SAAA,GAAY,UAAA,CAAW,MAAA,CAAO,QAAQ,CAAA;AAC5C,IAAA,MAAM,YAAA,GAAe,UAAA,CAAW,MAAA,CAAO,QAAQ,CAAA;AAC/C,IAAA,OAAO;AAAA,MACL,IAAA;AAAA,MACA,QAAA;AAAA,MACA,IAAA,EAAM,MAAA;AAAA,MACN,IAAA;AAAA,MACA,GAAI,SAAA,KAAc,MAAA,GAAY,EAAC,GAAI,EAAE,SAAA,EAAU;AAAA,MAC/C,GAAI,YAAA,KAAiB,MAAA,GAAY,EAAC,GAAI,EAAE,YAAA;AAAa,KACvD;AAAA,EACF;AACA,EAAA,IAAI,SAAS,QAAA,EAAU;AACrB,IAAA,MAAM,KAAA,GAAS,MAAA,CAAO,UAAA,IAA6C,EAAC;AACpE,IAAA,MAAM,GAAA,GAAM,IAAI,GAAA,CAAI,KAAA,CAAM,OAAA,CAAQ,MAAA,CAAO,QAAQ,CAAA,GAAK,MAAA,CAAO,QAAA,GAAwB,EAAE,CAAA;AACvF,IAAA,OAAO;AAAA,MACL,IAAA;AAAA,MACA,QAAA;AAAA,MACA,IAAA,EAAM,QAAA;AAAA,MACN,MAAA,EAAQ,MAAA,CAAO,OAAA,CAAQ,KAAK,CAAA,CAAE,GAAA;AAAA,QAAI,CAAC,CAAC,SAAA,EAAW,WAAW,MACxD,UAAA,CAAW,SAAA,EAAW,WAAA,IAAe,IAAI,GAAA,CAAI,GAAA,CAAI,SAAS,CAAA,EAAG,MAAM,IAAI;AAAA;AACzE,KACF;AAAA,EACF;AAIA,EAAA,OAAO,EAAE,IAAA,EAAM,QAAA,EAAU,IAAA,EAAM,SAAA,EAAU;AAC3C;AAOO,SAAS,uBAAuB,MAAA,EAAuD;AAC5F,EAAA,OAAO,MAAA,CAAO,QAAQ,MAAM,CAAA,CAAE,IAAI,CAAC,CAAC,IAAA,EAAM,KAAK,CAAA,KAAM;AACnD,IAAA,MAAM,OAAmC,EAAC;AAC1C,IAAA,iBAAA,CAAkB,MAAM,WAAA,EAAa,IAAA,EAAM,EAAE,cAAA,EAAgB,MAAM,CAAA;AACnE,IAAA,MAAM,IAAA,GAAO,UAAA;AAAA,MACX,IAAA;AAAA,MACC,KAAA,CAAM,eAA8B,EAAC;AAAA,MACtC,CAAC,gBAAgB,KAAK,CAAA;AAAA,MACtB,IAAA;AAAA,0BACI,GAAA;AAAI,KACV;AACA,IAAA,OAAO,EAAE,GAAG,IAAA,EAAM,MAAA,EAAQ,iBAAA,CAAkB,KAAK,CAAA,EAAE;AAAA,EACrD,CAAC,CAAA;AACH","file":"chunk-YEVVR6FE.js","sourcesContent":["/**\n * The gate's own field tree - structural, schema-derived, and private.\n *\n * `gateRunInputs` re-applies the Run button's emptiness rule with\n * `mustBeFilled`/`fieldFilled`, which read a `RunField` tree. The RENDER tree\n * is built from the wire input-form descriptor - but the gate must not require\n * that artifact: the descriptor is a presentation view, and the workspace\n * doctrine is that a machine consumer never needs it to validate a payload -\n * `json_schema` keeps that job. A server holds contracts; it may never have\n * asked for the view.\n *\n * So the gate walks the contract's `json_schema` into the MINIMAL tree the\n * emptiness predicates read: `object` nodes with their required children,\n * `list` nodes with their declared bounds, and opaque leaves. This is not a\n * revival of the deleted heuristics - it reads exactly the keywords ajv itself\n * enforces (`type`, `properties`, `required`, `items`, `minItems`, `maxItems`)\n * and decides nothing about what a field IS. No kind here ever reaches a\n * renderer: the tree exists for one call inside `gateRunInputs` and is not\n * exported from the package.\n *\n * Agreement with the browser's readiness (which runs over the render tree) is\n * held by construction - both trees take required children and list bounds\n * from the same model the engine derived both artifacts from - and asserted in\n * `gate-agreement.test.ts`, which runs both sides over one table.\n */\n\nimport { inputMustBeFilled, isOptionalInput, type PipeInputContract } from './contracts';\nimport type { RunField } from './descriptor';\nimport {\n  collapseNullable,\n  collectSchemaDefs,\n  derefSchema,\n  schemaTypeOf,\n  type JsonSchema,\n} from './schema-utils';\n\nfunction numOrUndef(v: unknown): number | undefined {\n  return typeof v === 'number' ? v : undefined;\n}\n\nfunction gatingNode(\n  name: string,\n  rawSchema: JsonSchema,\n  required: boolean,\n  defs: Record<string, JsonSchema>,\n  active: ReadonlySet<string>,\n): RunField {\n  // Resolve `$ref` / nullable-`anyOf` layers to a fixpoint - one pass of\n  // either helper cannot see through pydantic's Optional concept-typed shape,\n  // `anyOf: [{$ref}, {type:'null'}]` - keeping the set of references OPEN ON\n  // THIS PATH. A reference met again while still open is a self-referencing\n  // model: expanding it has no floor, so the node degrades to the opaque leaf\n  // instead of overflowing the stack - the gate returns a verdict, never a\n  // throw. Open on this path, not seen anywhere: two siblings referencing one\n  // definition are ordinary composition and both expand in full. The degrade\n  // is OPEN, and deliberately so: ajv - which resolves recursion natively,\n  // bounded by the data - has already enforced PRESENCE of required children\n  // at every depth, but presence is all it enforces, so a required scalar\n  // that is present-but-blank below the cycle point is caught by neither\n  // side. That residual leniency is a recorded follow-up, not a safety\n  // property; failing CLOSED here would refuse every legitimate recursive\n  // payload, which is the worse defect.\n  let schema = rawSchema;\n  let path = active;\n  for (;;) {\n    const ref = schema.$ref;\n    if (typeof ref === 'string') {\n      if (path.has(ref)) return { name, required, kind: 'unknown' };\n      path = new Set(path).add(ref);\n    }\n    const next = collapseNullable(derefSchema(schema, defs));\n    if (next === schema) break;\n    schema = next;\n  }\n  const type = schemaTypeOf(schema);\n\n  if (type === 'array') {\n    const item = gatingNode(name, (schema.items as JsonSchema) ?? {}, true, defs, path);\n    const itemCount = numOrUndef(schema.minItems);\n    const maxItemCount = numOrUndef(schema.maxItems);\n    return {\n      name,\n      required,\n      kind: 'list',\n      item,\n      ...(itemCount === undefined ? {} : { itemCount }),\n      ...(maxItemCount === undefined ? {} : { maxItemCount }),\n    };\n  }\n  if (type === 'object') {\n    const props = (schema.properties as Record<string, JsonSchema>) ?? {};\n    const req = new Set(Array.isArray(schema.required) ? (schema.required as string[]) : []);\n    return {\n      name,\n      required,\n      kind: 'object',\n      fields: Object.entries(props).map(([childName, childSchema]) =>\n        gatingNode(childName, childSchema ?? {}, req.has(childName), defs, path),\n      ),\n    };\n  }\n  // Everything else is a leaf to the emptiness rule: `fieldFilled` answers it\n  // with `isFilled` alone, whatever kind it carries. `unknown` states that\n  // honestly.\n  return { name, required, kind: 'unknown' };\n}\n\n/**\n * The tree `gateRunInputs`' emptiness re-check runs over, one node per input,\n * with `gating` stamped from the contract - the same `inputMustBeFilled` the\n * Run button's `required` list is built from.\n */\nexport function gatingFieldsFromInputs(inputs: Record<string, PipeInputContract>): RunField[] {\n  return Object.entries(inputs).map(([name, input]) => {\n    const defs: Record<string, JsonSchema> = {};\n    collectSchemaDefs(input.json_schema, defs, { traverseArrays: true });\n    const node = gatingNode(\n      name,\n      (input.json_schema as JsonSchema) ?? {},\n      !isOptionalInput(input),\n      defs,\n      new Set(),\n    );\n    return { ...node, gating: inputMustBeFilled(input) };\n  });\n}\n"]}
+{"version":3,"sources":["../src/core/gating-fields.ts"],"names":[],"mappings":";;;;AAoCA,SAAS,WAAW,CAAA,EAAgC;AAClD,EAAA,OAAO,OAAO,CAAA,KAAM,QAAA,GAAW,CAAA,GAAI,MAAA;AACrC;AAEA,SAAS,UAAA,CACP,IAAA,EACA,SAAA,EACA,QAAA,EACA,MACA,MAAA,EACU;AAgBV,EAAA,IAAI,MAAA,GAAS,SAAA;AACb,EAAA,IAAI,IAAA,GAAO,MAAA;AACX,EAAA,WAAS;AACP,IAAA,MAAM,MAAM,MAAA,CAAO,IAAA;AACnB,IAAA,IAAI,OAAO,QAAQ,QAAA,EAAU;AAC3B,MAAA,IAAI,IAAA,CAAK,IAAI,GAAG,CAAA,SAAU,EAAE,IAAA,EAAM,QAAA,EAAU,IAAA,EAAM,SAAA,EAAU;AAC5D,MAAA,IAAA,GAAO,IAAI,GAAA,CAAI,IAAI,CAAA,CAAE,IAAI,GAAG,CAAA;AAAA,IAC9B;AACA,IAAA,MAAM,IAAA,GAAO,gBAAA,CAAiB,WAAA,CAAY,MAAA,EAAQ,IAAI,CAAC,CAAA;AACvD,IAAA,IAAI,SAAS,MAAA,EAAQ;AACrB,IAAA,MAAA,GAAS,IAAA;AAAA,EACX;AACA,EAAA,MAAM,IAAA,GAAO,aAAa,MAAM,CAAA;AAEhC,EAAA,IAAI,SAAS,OAAA,EAAS;AACpB,IAAA,MAAM,IAAA,GAAO,WAAW,IAAA,EAAO,MAAA,CAAO,SAAwB,EAAC,EAAG,IAAA,EAAM,IAAA,EAAM,IAAI,CAAA;AAClF,IAAA,MAAM,SAAA,GAAY,UAAA,CAAW,MAAA,CAAO,QAAQ,CAAA;AAC5C,IAAA,MAAM,YAAA,GAAe,UAAA,CAAW,MAAA,CAAO,QAAQ,CAAA;AAC/C,IAAA,OAAO;AAAA,MACL,IAAA;AAAA,MACA,QAAA;AAAA,MACA,IAAA,EAAM,MAAA;AAAA,MACN,IAAA;AAAA,MACA,GAAI,SAAA,KAAc,MAAA,GAAY,EAAC,GAAI,EAAE,SAAA,EAAU;AAAA,MAC/C,GAAI,YAAA,KAAiB,MAAA,GAAY,EAAC,GAAI,EAAE,YAAA;AAAa,KACvD;AAAA,EACF;AACA,EAAA,IAAI,SAAS,QAAA,EAAU;AACrB,IAAA,MAAM,KAAA,GAAS,MAAA,CAAO,UAAA,IAA6C,EAAC;AACpE,IAAA,MAAM,GAAA,GAAM,IAAI,GAAA,CAAI,KAAA,CAAM,OAAA,CAAQ,MAAA,CAAO,QAAQ,CAAA,GAAK,MAAA,CAAO,QAAA,GAAwB,EAAE,CAAA;AACvF,IAAA,OAAO;AAAA,MACL,IAAA;AAAA,MACA,QAAA;AAAA,MACA,IAAA,EAAM,QAAA;AAAA,MACN,MAAA,EAAQ,MAAA,CAAO,OAAA,CAAQ,KAAK,CAAA,CAAE,GAAA;AAAA,QAAI,CAAC,CAAC,SAAA,EAAW,WAAW,MACxD,UAAA,CAAW,SAAA,EAAW,WAAA,IAAe,IAAI,GAAA,CAAI,GAAA,CAAI,SAAS,CAAA,EAAG,MAAM,IAAI;AAAA;AACzE,KACF;AAAA,EACF;AAIA,EAAA,OAAO,EAAE,IAAA,EAAM,QAAA,EAAU,IAAA,EAAM,SAAA,EAAU;AAC3C;AAOO,SAAS,uBAAuB,MAAA,EAAuD;AAC5F,EAAA,OAAO,MAAA,CAAO,QAAQ,MAAM,CAAA,CAAE,IAAI,CAAC,CAAC,IAAA,EAAM,KAAK,CAAA,KAAM;AACnD,IAAA,MAAM,OAAmC,EAAC;AAC1C,IAAA,iBAAA,CAAkB,MAAM,WAAA,EAAa,IAAA,EAAM,EAAE,cAAA,EAAgB,MAAM,CAAA;AACnE,IAAA,MAAM,IAAA,GAAO,UAAA;AAAA,MACX,IAAA;AAAA,MACC,KAAA,CAAM,eAA8B,EAAC;AAAA,MACtC,CAAC,gBAAgB,KAAK,CAAA;AAAA,MACtB,IAAA;AAAA,0BACI,GAAA;AAAI,KACV;AACA,IAAA,OAAO,EAAE,GAAG,IAAA,EAAM,MAAA,EAAQ,iBAAA,CAAkB,KAAK,CAAA,EAAE;AAAA,EACrD,CAAC,CAAA;AACH","file":"chunk-Y2ND6W4W.js","sourcesContent":["/**\n * The gate's own field tree - structural, schema-derived, and private.\n *\n * `gateRunInputs` re-applies the Run button's emptiness rule with\n * `mustBeFilled`/`fieldFilled`, which read a `RunField` tree. The RENDER tree\n * is built from the wire input-form descriptor - but the gate must not require\n * that artifact: the descriptor is a presentation view, and the workspace\n * doctrine is that a machine consumer never needs it to validate a payload -\n * `json_schema` keeps that job. A server holds contracts; it may never have\n * asked for the view.\n *\n * So the gate walks the contract's `json_schema` into the MINIMAL tree the\n * emptiness predicates read: `object` nodes with their required children,\n * `list` nodes with their declared bounds, and opaque leaves. This is not a\n * revival of the deleted heuristics - it reads exactly the keywords ajv itself\n * enforces (`type`, `properties`, `required`, `items`, `minItems`, `maxItems`)\n * and decides nothing about what a field IS. No kind here ever reaches a\n * renderer: the tree exists for one call inside `gateRunInputs` and is not\n * exported from the package.\n *\n * Agreement with the browser's readiness (which runs over the render tree) is\n * held by construction - both trees take required children and list bounds\n * from the same model the engine derived both artifacts from - and asserted in\n * `gate-agreement.test.ts`, which runs both sides over one table.\n */\n\nimport { inputMustBeFilled, isOptionalInput, type PipeInputContract } from './contracts';\nimport type { RunField } from './descriptor';\nimport {\n  collapseNullable,\n  collectSchemaDefs,\n  derefSchema,\n  schemaTypeOf,\n  type JsonSchema,\n} from './schema-utils';\n\nfunction numOrUndef(v: unknown): number | undefined {\n  return typeof v === 'number' ? v : undefined;\n}\n\nfunction gatingNode(\n  name: string,\n  rawSchema: JsonSchema,\n  required: boolean,\n  defs: Record<string, JsonSchema>,\n  active: ReadonlySet<string>,\n): RunField {\n  // Resolve `$ref` / nullable-`anyOf` layers to a fixpoint - one pass of\n  // either helper cannot see through pydantic's Optional concept-typed shape,\n  // `anyOf: [{$ref}, {type:'null'}]` - keeping the set of references OPEN ON\n  // THIS PATH. A reference met again while still open is a self-referencing\n  // model: expanding it has no floor, so the node degrades to the opaque leaf\n  // instead of overflowing the stack - the gate returns a verdict, never a\n  // throw. Open on this path, not seen anywhere: two siblings referencing one\n  // definition are ordinary composition and both expand in full. The degrade\n  // is OPEN, and deliberately so: ajv - which resolves recursion natively,\n  // bounded by the data - has already enforced PRESENCE of required children\n  // at every depth, but presence is all it enforces, so a required scalar\n  // that is present-but-blank below the cycle point is caught by neither\n  // side. That residual leniency is a recorded follow-up, not a safety\n  // property; failing CLOSED here would refuse every legitimate recursive\n  // payload, which is the worse defect.\n  let schema = rawSchema;\n  let path = active;\n  for (;;) {\n    const ref = schema.$ref;\n    if (typeof ref === 'string') {\n      if (path.has(ref)) return { name, required, kind: 'unknown' };\n      path = new Set(path).add(ref);\n    }\n    const next = collapseNullable(derefSchema(schema, defs));\n    if (next === schema) break;\n    schema = next;\n  }\n  const type = schemaTypeOf(schema);\n\n  if (type === 'array') {\n    const item = gatingNode(name, (schema.items as JsonSchema) ?? {}, true, defs, path);\n    const itemCount = numOrUndef(schema.minItems);\n    const maxItemCount = numOrUndef(schema.maxItems);\n    return {\n      name,\n      required,\n      kind: 'list',\n      item,\n      ...(itemCount === undefined ? {} : { itemCount }),\n      ...(maxItemCount === undefined ? {} : { maxItemCount }),\n    };\n  }\n  if (type === 'object') {\n    const props = (schema.properties as Record<string, JsonSchema>) ?? {};\n    const req = new Set(Array.isArray(schema.required) ? (schema.required as string[]) : []);\n    return {\n      name,\n      required,\n      kind: 'object',\n      fields: Object.entries(props).map(([childName, childSchema]) =>\n        gatingNode(childName, childSchema ?? {}, req.has(childName), defs, path),\n      ),\n    };\n  }\n  // Everything else is a leaf to the emptiness rule: `fieldFilled` answers it\n  // with `isFilled` alone, whatever kind it carries. `unknown` states that\n  // honestly.\n  return { name, required, kind: 'unknown' };\n}\n\n/**\n * The tree `gateRunInputs`' emptiness re-check runs over, one node per input,\n * with `gating` stamped from the contract - the same `inputMustBeFilled` the\n * Run button's `required` list is built from.\n */\nexport function gatingFieldsFromInputs(inputs: Record<string, PipeInputContract>): RunField[] {\n  return Object.entries(inputs).map(([name, input]) => {\n    const defs: Record<string, JsonSchema> = {};\n    collectSchemaDefs(input.json_schema, defs, { traverseArrays: true });\n    const node = gatingNode(\n      name,\n      (input.json_schema as JsonSchema) ?? {},\n      !isOptionalInput(input),\n      defs,\n      new Set(),\n    );\n    return { ...node, gating: inputMustBeFilled(input) };\n  });\n}\n"]}

package/dist/{chunk-J4L32LD6.js → chunk-ZB4RYUKV.js}

@@ -1,6 +1,6 @@
-import { acceptLabelForKind } from './chunk-2JWRG53S.js';
+import { formatsForKind } from './chunk-XCO6GTEC.js';
 import { collectSchemaDefs, resolveSchemaNode } from './chunk-OD3VYXUY.js';
-import { buildPipeRef } from './chunk-XYQ7NXQZ.js';
+import { buildPipeRef } from './chunk-WYH56SOZ.js';
 import { ownProp } from './chunk-V3OV2XQT.js';
 
 // src/core/derive.ts
@@ -85,7 +85,7 @@ function mapNode(node, name, rawSchema, defs) {
       return { ...common, kind: "enum", options: node.choices.map(String) };
     case "document":
     case "image":
-      return { ...common, kind: node.kind, accept: acceptLabelForKind(node.kind) };
+      return { ...common, kind: node.kind, formats: formatsForKind(node.kind) };
     case "object": {
       const props = schema?.properties;
       return {
@@ -133,5 +133,5 @@ function buildRunFields(descriptor, inputs) {
 }
 
 export { buildResultField, buildRunFields, getPipeInputForm };
-//# sourceMappingURL=chunk-J4L32LD6.js.map
-//# sourceMappingURL=chunk-J4L32LD6.js.map
+//# sourceMappingURL=chunk-ZB4RYUKV.js.map
+//# sourceMappingURL=chunk-ZB4RYUKV.js.map