@tinkerlandai/indiana-iam 0.2.0 → 0.4.0

package/src/render-index.mjs

@@ -5,7 +5,7 @@ export function flattenComposition(root) {
   const entries = [];
   function visit(branch) {
     if (!branch) return;
-    entries.push({ lane: branch.lane, file: branch.file, layers: branch.layers.map(layer => ({ file: layer.file, slots: layer.slots.map(slot => ({ name: slot.name, lane: slot.branch?.lane ?? null })) })) });
+    entries.push({ lane: branch.lane, file: branch.file, ...(branch.symbol ? { symbol: branch.symbol } : {}), layers: branch.layers.map(layer => ({ file: layer.file, ...(layer.symbol ? { symbol: layer.symbol } : {}), slots: layer.slots.map(slot => ({ name: slot.name, lane: slot.branch?.lane ?? null })) })) });
     for (const layer of branch.layers) for (const slot of layer.slots) visit(slot.branch);
   }
   visit(root);
@@ -36,6 +36,7 @@ export function renderTreeSchema(base) {
   p.renderNavigation=array(object({fromRenderKey:str,toRenderKey:str}),512);
   p.guards = array(object({ routeKey: str, selectorKeys: array({type:"integer",minimum:0,maximum:511}, 512) }), 200);
   p.compositions = array(object({ compositionKey: str, entries: array(object({ lane: str, file: str, layers: array(object({ file: str, slots: array(object({ name: str, lane: nullable(str) }), 32) }), 32) }), 128) }), 1000);
+  for (const shape of [p.compositions.items.properties.entries.items, p.compositions.items.properties.entries.items.properties.layers.items]) shape.properties.symbol = str;
   schema.required.push("renders", "guards", "compositions", "selectorPool", "renderNavigation");
   return schema;
 }
@@ -85,7 +86,7 @@ export function attachRenderIndex(graph, manifest, definitions, navigation=[]) {
 }
 
 export function validateRenderIndex(graph, manifest) {
-  const contained = (file, lane) => lane === "." && ["react-router", "react-spa"].includes(manifest.routing.framework)
+  const contained = (file, lane) => lane === "." && ["react-router", "react-spa", "tanstack-router"].includes(manifest.routing.framework)
     ? !file.startsWith("/") && !file.split("/").includes("..")
     : file.startsWith(lane + "/");
   const unique = (rows, key) => {
@@ -95,14 +96,15 @@ export function validateRenderIndex(graph, manifest) {
   };
   const renders = unique(graph.renders, "renderKey"), compositions = unique(graph.compositions, "compositionKey"), guards = unique(graph.guards, "routeKey");
   const files = new Set(manifest.sourceFiles.map(file => file.file));
+  const knownSymbol = entry => !entry.symbol || manifest.components.some(component => component.file === entry.file && component.name === entry.symbol);
   for (const composition of compositions.values()) {
     if (composition.compositionKey !== compositionIdentity(composition.entries)) throw new Error("Composition identity mismatch");
     const lanes = new Set();
     for (const entry of composition.entries) {
-      if (lanes.has(entry.lane) || !files.has(entry.file) || !contained(entry.file, entry.lane)) throw new Error("Invalid composition entry");
+      if (lanes.has(entry.lane) || !files.has(entry.file) || !contained(entry.file, entry.lane) || !knownSymbol(entry)) throw new Error("Invalid composition entry");
       lanes.add(entry.lane);
       for (const layer of entry.layers) {
-        if (!files.has(layer.file) || !contained(layer.file, entry.lane)) throw new Error("Invalid composition layout");
+        if (!files.has(layer.file) || !contained(layer.file, entry.lane) || !knownSymbol(layer)) throw new Error("Invalid composition layout");
         const folder = layer.file.slice(0, layer.file.lastIndexOf("/"));
         for (const slot of layer.slots) if (slot.lane !== null && slot.lane !== folder + "/@" + slot.name) throw new Error("Invalid composition slot");
       }

package/src/route-lazy.mjs

@@ -0,0 +1,80 @@
+/** Resolve a lazy route's component by AST proof only. No importer, mapper or loader is called. */
+export function routeLazyComponent(node, module, { ts, resolution, resolveModule }) {
+  const unwrap = node => {
+    while (node && (ts.isParenthesizedExpression(node) || ts.isAsExpression(node) || ts.isSatisfiesExpression(node) || ts.isAwaitExpression(node))) node = node.expression;
+    return node;
+  };
+  const fn = node => {
+    node = unwrap(node);
+    return node && !node.asteriskToken && (ts.isArrowFunction(node) || ts.isFunctionExpression(node) || ts.isFunctionDeclaration(node) || ts.isMethodDeclaration(node)) ? node : null;
+  };
+  const returned = node => node?.body && (ts.isBlock(node.body)
+    ? node.body.statements.length === 1 && ts.isReturnStatement(node.body.statements[0]) ? node.body.statements[0].expression : null
+    : node.body);
+  const plainParameter = parameter => parameter && ts.isIdentifier(parameter.name) && !parameter.initializer && !parameter.dotDotDotToken;
+  const reference = resolution.reference(node, module);
+  const lazy = reference && fn(reference.node);
+  if (!lazy || lazy.parameters.length) return null;
+  module = reference.module;
+  let body = unwrap(returned(lazy)), mapper;
+  if (body && ts.isCallExpression(body) && ts.isPropertyAccessExpression(body.expression) && body.expression.name.text === "then") {
+    if (body.arguments.length !== 1) return null;
+    mapper = resolution.reference(body.arguments[0], module);
+    if (!mapper) return null;
+    body = unwrap(body.expression.expression);
+  }
+  if (!body || !ts.isCallExpression(body) || body.expression.kind !== ts.SyntaxKind.ImportKeyword || body.arguments.length !== 1 || !ts.isStringLiteral(body.arguments[0])) return null;
+  const target = resolveModule(module.file, body.arguments[0].text);
+  if (!target) return null;
+  let exported = "Component";
+  if (mapper) {
+    let callback = fn(mapper.node);
+    if (!callback && ts.isCallExpression(unwrap(mapper.node))) {
+      const call = unwrap(mapper.node), factory = resolution.reference(call.expression, mapper.module), outer = factory && fn(factory.node);
+      if (!outer || outer.parameters.length !== call.arguments.length || outer.parameters.some(parameter => !plainParameter(parameter)) || outer.modifiers?.some(modifier => modifier.kind === ts.SyntaxKind.AsyncKeyword)) return null;
+      callback = fn(returned(outer));
+    }
+    if (!callback || callback.parameters.length !== 1 || !plainParameter(callback.parameters[0]) || callback.modifiers?.some(modifier => modifier.kind === ts.SyntaxKind.AsyncKeyword)) return null;
+    const namespace = callback.parameters[0].name.text, aliases = new Map();
+    let result = callback.body;
+    if (ts.isBlock(result)) {
+      const statements = result.statements;
+      if (!statements.length || !ts.isReturnStatement(statements.at(-1))) return null;
+      for (const statement of statements.slice(0, -1)) {
+        if (!ts.isVariableStatement(statement) || !(statement.declarationList.flags & ts.NodeFlags.Const)) return null;
+        for (const declaration of statement.declarationList.declarations) {
+          const value = unwrap(declaration.initializer);
+          if (!ts.isObjectBindingPattern(declaration.name) || !value || !ts.isIdentifier(value) || value.text !== namespace) return null;
+          for (const element of declaration.name.elements) {
+            if (!ts.isIdentifier(element.name) || element.initializer || element.name.text === namespace || aliases.has(element.name.text) || element.propertyName && ts.isComputedPropertyName(element.propertyName)) return null;
+            aliases.set(element.name.text, element.dotDotDotToken ? null : (element.propertyName?.text ?? element.name.text));
+          }
+        }
+      }
+      result = statements.at(-1).expression;
+    }
+    result = unwrap(result);
+    if (!result || !ts.isObjectLiteralExpression(result)) return null;
+    let selected, captured = false, unsafeBefore = false;
+    const effectful = node => {
+      if (ts.isCallExpression(node) || ts.isNewExpression(node) || ts.isAwaitExpression(node) || ts.isBinaryExpression(node) && node.operatorToken.kind >= ts.SyntaxKind.FirstAssignment && node.operatorToken.kind <= ts.SyntaxKind.LastAssignment || ts.isPrefixUnaryExpression(node) || ts.isPostfixUnaryExpression(node)) return true;
+      return Boolean(ts.forEachChild(node, effectful));
+    };
+    for (const property of result.properties) {
+      if (ts.isSpreadAssignment(property)) { if (selected) return null; unsafeBefore = true; continue; }
+      if (!(ts.isPropertyAssignment(property) || ts.isShorthandPropertyAssignment(property)) || ts.isComputedPropertyName(property.name)) return null;
+      if (property.name.text !== "Component") { if (!selected && ts.isPropertyAssignment(property) && effectful(property.initializer)) unsafeBefore = true; continue; }
+      if (selected) return null;
+      const value = unwrap(ts.isShorthandPropertyAssignment(property) ? property.name : property.initializer);
+      if (!value) return null;
+      if (ts.isIdentifier(value)) { selected = aliases.get(value.text); captured = Boolean(selected); }
+      else if (ts.isPropertyAccessExpression(value) && ts.isIdentifier(value.expression) && value.expression.text === namespace && !value.questionDotToken) selected = value.name.text;
+      if (!selected || unsafeBefore && !captured) return null;
+    }
+    if (!selected) return null;
+    exported = selected;
+  }
+  const local = exported === "default" ? target.defaultName : target.exports.get(exported);
+  const component = local && resolution.component(target, local);
+  return component ? { file: component.module.file, symbol: component.name } : null;
+}

package/src/route-tree.mjs

@@ -4,6 +4,8 @@ import { dependency } from "./dependencies.mjs";
 import { canonical } from "./integrity.mjs";
 import { documentNodes } from './node-hashes.mjs';
 import { renderTreeSchema, attachRenderIndex, validateRenderIndex, routeIndexDigest } from "./render-index.mjs";
+import { uiStructureSchema, validateUiStructure } from './ui-structure.mjs';
+import {graphSource} from './graph-sources.mjs';
 const str = { type: "string", minLength: 1, maxLength: 2048 };
 const arr = (items, maxItems = 20000) => ({ type: "array", items, maxItems });
 const obj = properties => ({ type: "object", properties, required: Object.keys(properties), additionalProperties: false });
@@ -36,6 +38,12 @@ const routeTreeShape = obj({
 routeTreeShape.properties.targets.items.required=routeTreeShape.properties.targets.items.required.filter(key=>key!=='source');
 routeTreeShape.properties.targets.items.properties.subtreeHash = { type: "string", pattern: "^[a-f0-9]{64}$" };
 export const routeTreeSchema = renderTreeSchema(routeTreeShape);
+routeTreeSchema.properties.sourcePool=arr(source,20000);
+routeTreeSchema.properties.scopePool=arr(str,20000);
+routeTreeSchema.properties.variables.items.properties.scopeKey={anyOf:[str,{type:'integer',minimum:0,maximum:19999}]};
+for(const field of ['variables','bindings','transitions','states','navigation','uncovered'])routeTreeSchema.properties[field].items.properties.source={anyOf:[source,{type:'integer',minimum:0,maximum:19999}]};
+routeTreeSchema.properties.navigation.items.properties.interactionKey={anyOf:[str,{type:'integer',minimum:0,maximum:19999}]};
+routeTreeSchema.properties.ui=uiStructureSchema;
 const Ajv = dependency("ajv").value;
 const check = new Ajv({ allErrors: true }).compile({ ...routeTreeSchema, definitions: { uiExpression } });
 export function validateRouteTree(graph, manifest, verifiedSelectors, concreteDocuments = manifest.documents.map(d => ({...d, nodes:documentNodes(d)}))) {
@@ -54,7 +62,8 @@ export function validateRouteTree(graph, manifest, verifiedSelectors, concreteDo
     return node;
   }
   function sourceCheck(row) {
-    const node=nodes.get(row.nodeId),source=row.source??node?.source??manifest.elements.find(e=>e.elementKey===node?.elementKey)?.source;
+    if(typeof row.source==='number'&&(!Number.isInteger(row.source)||!graph.sourcePool?.[row.source]))throw Error('Invalid pooled graph source');
+    const node=nodes.get(row.nodeId),source=graphSource(graph,row)??node?.source??manifest.elements.find(e=>e.elementKey===node?.elementKey)?.source;
     if (!source||!manifest.sourceFiles.some(file => file.file === source.file && file.sha256 === source.fileHash)) throw new Error("Route tree source mismatch");
   }
   for (const route of graph.routes) {
@@ -106,8 +115,8 @@ export function validateRouteTree(graph, manifest, verifiedSelectors, concreteDo
   }
   for (const navigation of graph.navigation) {
     mapped(navigation); require(maps.routes, navigation.targetRouteKey);
-    const original = manifest.interactions.find(i => i.interactionKey === navigation.interactionKey);
-    if (!original || original.pageKey !== navigation.routeKey || original.targetPageKey !== navigation.targetRouteKey || original.targetUrl !== navigation.targetUrl || canonical(original.targetParams) !== canonical(navigation.targetParams)) throw new Error("Route tree navigation mismatch");
+    const original = typeof navigation.interactionKey==='number'?manifest.interactions[navigation.interactionKey]:manifest.interactions.find(i => i.interactionKey === navigation.interactionKey);
+    if (!original || original.pageKey !== navigation.routeKey || original.nodeId !== navigation.nodeId || original.targetPageKey !== navigation.targetRouteKey || original.targetUrl !== navigation.targetUrl || canonical(original.targetParams) !== canonical(navigation.targetParams)) throw new Error("Route tree navigation mismatch");
   }
   const { JSDOM } = dependency("jsdom").value, documents = new Map(), targetIds = new Set();
   try {
@@ -124,7 +133,10 @@ export function validateRouteTree(graph, manifest, verifiedSelectors, concreteDo
     }
   } finally { for (const dom of documents.values()) dom.window.close(); }
   for (const collection of [graph.routes, graph.variables, graph.states, graph.bindings, graph.transitions, graph.navigation, graph.uncovered, graph.targets]) for (const row of collection) sourceCheck(row);
+  const refs=new Set([...graph.variables,...graph.bindings,...graph.transitions,...graph.states,...graph.navigation,...graph.uncovered].map(r=>r.source).filter(s=>typeof s==='number'));if(refs.size!==(graph.sourcePool?.length??0)||new Set((graph.sourcePool??[]).map(canonical)).size!==(graph.sourcePool?.length??0))throw Error('Invalid graph source pool');
+  const scopeRefs=new Set(graph.variables.map(v=>v.scopeKey).filter(k=>typeof k==='number'));if(scopeRefs.size!==(graph.scopePool?.length??0)||[...scopeRefs].some(k=>!Number.isInteger(k)||!graph.scopePool?.[k])||new Set(graph.scopePool??[]).size!==(graph.scopePool?.length??0))throw Error('Invalid graph scope pool');
   validateRenderIndex(graph, {...manifest, documents:concreteDocuments});
+  validateUiStructure(graph,manifest,concreteDocuments);
   return { routes: graph.routes.length, renders: graph.renders.length, transitions: graph.transitions.length, bindings: graph.bindings.length, digest: routeIndexDigest(graph) };
 }
 

package/src/routing.mjs

@@ -26,7 +26,7 @@ export function pagesRoute(file) {
 
 /** Router configuration provenance is explicit for source-declared React routes. */
 export function sourcePageRoute(page, routing) {
-  if (["react-router", "react-spa"].includes(routing.framework)) {
+  if (["react-router", "react-spa", "tanstack-router"].includes(routing.framework)) {
     const rows = routing.routeSources?.filter(
       (row) =>
         row.path === page.route &&

package/src/schema-definition.mjs

@@ -39,7 +39,7 @@ export const schema = {
       platforms: array({ enum: ["web", "ios", "android"] }, 3),
     }),
     routing: object({
-      framework: { enum: ["next-app-router", "next-pages-router", "react-router", "react-spa"] },
+      framework: { enum: ["next-app-router", "next-pages-router", "react-router", "react-spa", "tanstack-router"] },
       basePath: str,
       trailingSlash: { type: "boolean" },
       routeSources: array(object({ path: str, source, componentFile: str, componentSymbol: str }), 200),
@@ -176,3 +176,10 @@ schema.properties.styles=array(object({styleKey:{type:'string',pattern:'^style_[
 schema.properties.documents.items.properties.styleKeys=array({type:'string',pattern:'^style_[a-f0-9]{64}$'},16);
 schema.properties.scripts=array(object({scriptKey:{type:'string',pattern:'^script_[a-f0-9]{64}$'},sha256:hash,js:{type:'string',maxLength:100000}}),8);
 schema.properties.documents.items.properties.scriptKey={type:'string',pattern:'^script_[a-f0-9]{64}$'};
+
+// HTML and preorder mappings may use bounded lossless storage compression.
+schema.properties.documents.items.properties.domPayload = object({
+  encoding: { const: "gzip-json-v1" },
+  bytes: { type: "integer", minimum: 1, maximum: 8_388_608 },
+  data: { type: "string", minLength: 1, maxLength: 11_184_812 },
+});

package/src/source-attributes.mjs

@@ -0,0 +1,24 @@
+/** Finite source-derived attributes. Only presentation text and classes can change. */
+export function applySourceAttributes(doc, ui, renderKey, values) {
+  const sets = new Map((ui?.attributeSets ?? []).map((s) => [s.setKey, s])),
+    nodes = new Map(
+      [...doc.querySelectorAll("[data-iam-node]")].map((n) => [
+        n.getAttribute("data-iam-node"),
+        n,
+      ]),
+    );
+  for (const row of ui?.attributes ?? []) {
+    if (row.renderKey !== renderKey) continue;
+    const set = sets.get(row.setKey),
+      node = nodes.get(row.nodeId),
+      chosen = set?.cases.find((c) => c.value === values[row.variableKey]);
+    if (!node || !chosen) continue;
+    if (
+      !["class", "placeholder", "aria-label"].includes(set.property) ||
+      typeof chosen.text !== "string" ||
+      chosen.text.length > 4000
+    )
+      throw Error("Invalid source presentation attribute");
+    node.setAttribute(set.property, chosen.text);
+  }
+}

package/src/source-charts.mjs

@@ -0,0 +1,38 @@
+// Bounded inert geometry from source data. Never imports a chart library or runs callbacks.
+const number=v=>typeof v==='number'&&Number.isFinite(v)&&Math.abs(v)<=1e12;
+const color=(v,fallback)=>typeof v==='string'&&/^(?:#[\da-f]{3,8}|[a-z]{1,24}|var\(--[a-z0-9-]+\)|rgba?\([\d.,% /]+\))$/i.test(v)?v:fallback;
+const palette=['#8b5cf6','#94a3b8','#38bdf8','#22c55e','#f59e0b','#ef4444'];
+const shape=(tag,attrs={},children=[])=>({tag,attrs,children});
+export function chartGeometry({type,data,width=640,height=280,axes=true}){
+ width=number(width)&&width>=80&&width<=4096?width:640;height=number(height)&&height>=40&&height<=2048?height:280;
+ const labels=Array.isArray(data?.labels)?data.labels:[],sets=Array.isArray(data?.datasets)?data.datasets:[];
+ const valid=labels.length>0&&labels.length<=256&&sets.length>0&&sets.length<=16&&labels.every(v=>typeof v==='string'||number(v))&&sets.every(s=>Array.isArray(s?.data)&&s.data.length===labels.length&&s.data.every(number));
+ const children=[],text=(x,y,value,extra={})=>shape('text',{x,y,fill:'#888888','font-size':11,'font-family':'sans-serif',...extra},[String(value)]);
+ const pad=axes?{l:52,r:16,t:16,b:30}:{l:20,r:20,t:16,b:16},w=width-pad.l-pad.r,h=height-pad.t-pad.b;
+ if(!valid){children.push(shape('rect',{x:1,y:1,width:width-2,height:height-2,fill:'none',stroke:'#cbd5e1','stroke-dasharray':'5 5'}),text(width/2,height/2,'数据未观测 / Unobserved data',{'text-anchor':'middle'}));return {width,height,children,unobserved:true};}
+ if(!['line','bar','doughnut','pie','area'].includes(type))return null;
+ if(type==='doughnut'||type==='pie'){
+  const values=sets[0].data,total=values.reduce((a,b)=>a+b,0);if(total<=0||values.some(v=>v<0))return null;
+  const cx=width/2,cy=height/2,r=Math.max(1,Math.min(width,height)/2-16),inner=type==='pie'?0:r*.7;let start=-Math.PI/2;
+  values.forEach((v,i)=>{if(!v)return;const end=start+v/total*Math.PI*2,angle=Math.min(end-start,Math.PI*2-1e-7),e=start+angle,p=(radius,a)=>[cx+Math.cos(a)*radius,cy+Math.sin(a)*radius].map(n=>+n.toFixed(3)).join(' '),d=inner?`M ${p(r,start)} A ${r} ${r} 0 ${angle>Math.PI?1:0} 1 ${p(r,e)} L ${p(inner,e)} A ${inner} ${inner} 0 ${angle>Math.PI?1:0} 0 ${p(inner,start)} Z`:`M ${cx} ${cy} L ${p(r,start)} A ${r} ${r} 0 ${angle>Math.PI?1:0} 1 ${p(r,e)} Z`;children.push(shape('path',{d,fill:color(sets[0].backgroundColor?.[i],palette[i%palette.length])}));start=end;});
+ }else{
+  const values=sets.flatMap(s=>s.data),min=Math.min(0,...values),max=Math.max(1,...values),y=v=>pad.t+(max-v)/(max-min)*h,x=i=>pad.l+i/Math.max(1,labels.length-1)*w;
+  if(axes){for(let i=0;i<=4;i++){const v=min+(max-min)*i/4,at=y(v);children.push(shape('line',{x1:pad.l,x2:width-pad.r,y1:at,y2:at,stroke:'#e2e8f0','stroke-width':.5}),text(pad.l-8,at+4,Math.round(v),{'text-anchor':'end'}));}labels.forEach((label,i)=>{if(i%Math.max(1,Math.ceil(labels.length/12))===0)children.push(text(type==='bar'?pad.l+(i+.5)*w/labels.length:x(i),height-8,String(label).slice(0,18),{'text-anchor':'middle'}));});}
+  sets.forEach((set,j)=>{const stroke=color(set.borderColor,palette[j%palette.length]),fill=color(set.backgroundColor,stroke);if(type==='bar'){const band=w/labels.length,bw=band*.7/sets.length;set.data.forEach((v,i)=>children.push(shape('rect',{x:pad.l+i*band+band*.15+j*bw,y:Math.min(y(v),y(0)),width:bw,height:Math.abs(y(v)-y(0)),fill,rx:2})));}else{const points=set.data.map((v,i)=>`${+x(i).toFixed(3)},${+y(v).toFixed(3)}`).join(' ');if(set.fill===true||type==='area')children.push(shape('polygon',{points:`${pad.l},${y(0)} ${points} ${x(labels.length-1)},${y(0)}`,fill:stroke,'fill-opacity':.1}));children.push(shape('polyline',{points,fill:'none',stroke,'stroke-width':number(set.borderWidth)?Math.max(.5,Math.min(8,set.borderWidth)):2,'stroke-linejoin':'round'}));}});
+ }
+ return {width,height,children,unobserved:false};
+}
+export function sourceChart({ts,node,tag,owner,context,evaluate,imported}){
+ const module=owner.module,ev=n=>evaluate(n,module,context),primitive=imported(module,tag),props=opening=>Object.fromEntries(opening.attributes.properties.filter(a=>ts.isJsxAttribute(a)).map(a=>[a.name.text,!a.initializer?true:ts.isStringLiteral(a.initializer)?a.initializer.text:ts.isJsxExpression(a.initializer)?ev(a.initializer.expression):undefined]));
+ if(tag==='canvas'){
+  const configs=[];function visit(n){if(ts.isNewExpression(n)&&imported(module,n.expression.getText(module.source))?.specifier==='chart.js'&&imported(module,n.expression.getText(module.source))?.name==='Chart'&&n.arguments?.length===2&&ts.isObjectLiteralExpression(n.arguments[1]))configs.push(n.arguments[1]);ts.forEachChild(n,visit);}visit(owner.fn);
+  if(configs.length!==1)return null;
+  const config=ev(configs[0]),p=props(node),type=config?.type;if(typeof type!=='string')return null;
+  return chartGeometry({type,data:config.data,width:p.width,height:p.height,axes:config.options?.scales?.x?.display!==false||config.options?.scales?.y?.display!==false});
+ }
+ if(primitive?.specifier!=='recharts'||!['BarChart','LineChart','AreaChart','PieChart'].includes(primitive.name))return null;
+ const p=props(node),children=node.parent&&ts.isJsxElement(node.parent)?node.parent.children:[],parts=children.filter(c=>ts.isJsxElement(c)||ts.isJsxSelfClosingElement(c)).map(c=>ts.isJsxElement(c)?c.openingElement:c),series=[],type=primitive.name==='BarChart'?'bar':primitive.name==='AreaChart'?'area':primitive.name==='PieChart'?'pie':'line';let key;
+ for(const part of parts){const imp=imported(module,part.tagName.getText(module.source)),v=props(part);if(imp?.specifier!=='recharts')continue;if(imp.name==='XAxis')key=v.dataKey;if(['Bar','Line','Area','Pie'].includes(imp.name))series.push(v);}
+ const data=p.data,labels=Array.isArray(data)?data.map((r,i)=>key?r?.[key]:i+1):[];
+ return chartGeometry({type,data:{labels,datasets:series.map(s=>({data:Array.isArray(data)?data.map(r=>r?.[s.dataKey]):[],borderColor:s.stroke,backgroundColor:s.fill,fill:type==='area'}))},width:p.width,height:p.height??350});
+}

package/src/source-collections.mjs

@@ -0,0 +1,241 @@
+import { JSDOM, VirtualConsole } from "jsdom";
+import { identity } from "./integrity.mjs";
+
+/** Read state dependencies from local AST aliases. This never invokes source functions. */
+export function collectionStateReads(ts, node, ctx) {
+  const reads = new Set(),
+    seen = new Set();
+  let steps = 0;
+  function visit(n) {
+    if (!n || ++steps > 3000) return;
+    if (ts.isIdentifier(n)) {
+      if (ctx.__iamVariableKeys[n.text])
+        reads.add(ctx.__iamVariableKeys[n.text]);
+      else if (ctx.__iamPropBindings?.has(n.text)) {
+        const walk = (e) => {
+          if (e?.op === "var") reads.add(e.key);
+          for (const v of Object.values(e ?? {}))
+            if (v && typeof v === "object") {
+              if (Array.isArray(v)) v.forEach(walk);
+              else walk(v);
+            }
+        };
+        walk(ctx.__iamPropBindings.get(n.text));
+      } else if (ctx.__iamLocals.has(n.text) && !seen.has(n.text)) {
+        seen.add(n.text);
+        visit(ctx.__iamLocals.get(n.text));
+      }
+    }
+    ts.forEachChild(n, visit);
+  }
+  visit(node);
+  return [...reads];
+}
+
+/** Store one inert source list, shared by its repeated source instances. No SDK targets or handlers. */
+export function sourceCollectionFragment(html, source, itemCount, record) {
+  const dom = new JSDOM("<body>" + html + "</body>", {
+    virtualConsole: new VirtualConsole(),
+  });
+  try {
+    const body = dom.window.document.body,
+      elementKeys = [],
+      sourceElements = [],
+      classNames = [];
+    for (const node of body.querySelectorAll("*")) {
+      const mapped = record.get(node.getAttribute("data-iam-node"));
+      if (!mapped) throw Error("Collection source node is unmapped");
+      let ref = sourceElements.indexOf(mapped.elementKey);
+      if (ref < 0) {
+        ref = sourceElements.length;
+        sourceElements.push(mapped.elementKey);
+      }
+      elementKeys.push(ref);
+      for (const attr of [...node.attributes])
+        if (
+          attr.name.startsWith("data-iam-") ||
+          [
+            "id",
+            "data-indiana-id",
+            "data-testid",
+            "data-test",
+            "data-qa",
+          ].includes(attr.name)
+        )
+          node.removeAttribute(attr.name);
+      const classes = node.getAttribute("class");
+      if (classes && classes.length > 64) {
+        let index = classNames.indexOf(classes);
+        if (index < 0) {
+          index = classNames.length;
+          classNames.push(classes);
+        }
+        node.removeAttribute("class");
+        node.setAttribute("data-iam-fragment-class", String(index));
+      }
+    }
+    const fragment = {
+      html: body.innerHTML,
+      elementKeys,
+      sourceElements,
+      classNames,
+      source,
+      itemCount,
+    };
+    return { fragmentKey: identity("ui-fragment", fragment), ...fragment };
+  } finally {
+    dom.window.close();
+  }
+}
+
+/** Restore presentation only; injected rows deliberately have no canonical DOM identity. */
+export function checkedCollectionFragment(doc, fragment) {
+  if (
+    typeof fragment?.html !== "string" ||
+    fragment.html.length > 262144 ||
+    !Array.isArray(fragment.elementKeys) ||
+    !Array.isArray(fragment.sourceElements) ||
+    !Array.isArray(fragment.classNames) ||
+    fragment.sourceElements.length > 2000 ||
+    fragment.classNames.length > 128 ||
+    fragment.classNames.some((s) => typeof s !== "string" || s.length > 4000) ||
+    fragment.elementKeys.some(
+      (i) =>
+        !Number.isInteger(i) || i < 0 || i >= fragment.sourceElements.length,
+    ) ||
+    fragment.elementKeys.length > 2000
+  )
+    throw Error("Invalid shared source fragment");
+  const template = doc.createElement("template");
+  template.innerHTML = fragment.html;
+  const nodes = [...template.content.querySelectorAll("*")],
+    allowed = new Set(
+      "div span p button input svg path circle rect line polyline polygon ellipse g title".split(
+        " ",
+      ),
+    );
+  if (nodes.length !== fragment.elementKeys.length)
+    throw Error("Shared source fragment mapping mismatch");
+  for (const node of nodes) {
+    if (node.hasAttribute("data-iam-fragment-class")) {
+      const raw = node.getAttribute("data-iam-fragment-class"),
+        index = Number(raw);
+      if (
+        String(index) !== raw ||
+        !Number.isInteger(index) ||
+        index < 0 ||
+        index >= fragment.classNames.length
+      )
+        throw Error("Invalid source fragment class");
+      node.setAttribute("class", fragment.classNames[index]);
+      node.removeAttribute("data-iam-fragment-class");
+    }
+    if (!allowed.has(node.tagName.toLowerCase()))
+      throw Error("Active shared source fragment element");
+    for (const attr of node.attributes)
+      if (
+        !/^(?:class|title|type|value|placeholder|disabled|hidden|checked|tabindex|width|height|viewBox|viewbox|xmlns|d|fill|stroke|stroke-width|stroke-linecap|stroke-linejoin|cx|cy|r|rx|ry|x|y|x1|x2|y1|y2|points|aria-[a-z-]+|data-(?:slot|state|active|disabled|pressed))$/.test(
+          attr.name,
+        )
+      )
+        throw Error("Active shared source fragment attribute: " + attr.name);
+    for (const key of ["fill", "stroke"])
+      if (
+        node.hasAttribute(key) &&
+        !/^(?:none|currentColor|transparent|#[a-f\d]{3,8})$/i.test(
+          node.getAttribute(key),
+        )
+      )
+        throw Error("External source fragment paint");
+    if (
+      node.hasAttribute("xmlns") &&
+      node.getAttribute("xmlns") !== "http://www.w3.org/2000/svg"
+    )
+      throw Error("Invalid source fragment namespace");
+  }
+  return { content: template.content, nodes };
+}
+export function applySourceCollections(doc, ui, renderKey, values, enabled) {
+  const choices = [],
+    fragments = new Map((ui?.fragments ?? []).map((f) => [f.fragmentKey, f]));
+  for (const row of ui?.collections ?? []) {
+    if (row.renderKey !== renderKey) continue;
+    const root = [...doc.querySelectorAll("[data-iam-node]")].find(
+      (n) => n.getAttribute("data-iam-node") === row.nodeId,
+    );
+    if (!root) continue;
+    root.replaceChildren();
+    if (!enabled) continue;
+    if (root.parentElement?.closest("[hidden]")) continue;
+    const selected = row.cases.find((c) => c.value === values[row.variableKey]),
+      satisfied = row.requires.every((r) => values[r.variableKey] === r.value);
+    root.hidden = false;
+    root.setAttribute("inert", "");
+    if (!selected || !satisfied) {
+      root.textContent = "未观测 · 此筛选组合未重建";
+      root.setAttribute("data-iam-observation", "unobserved-collection");
+      continue;
+    }
+    const fragment = fragments.get(selected.fragmentKey);
+    if (!fragment) throw Error("Missing source collection fragment");
+    const parsed = checkedCollectionFragment(doc, fragment);
+    root.replaceChildren(parsed.content);
+    parsed.nodes.forEach((n, index) => {
+      n.setAttribute("data-iam-preview-only", "true");
+      n.setAttribute(
+        "data-iam-source-element",
+        fragment.sourceElements[fragment.elementKeys[index]],
+      );
+    });
+    choices.push({
+      collectionKey: row.collectionKey,
+      value: selected.value,
+      itemCount: fragment.itemCount,
+      source: row.source,
+    });
+  }
+  return choices;
+}
+
+/** Result, error and empty branches of an unexecuted query are all unobserved. */
+export function markUnobservedData(doc, ui, enabled, selections = new Map()) {
+  doc.querySelectorAll("[data-iam-preview-note]").forEach((n) => n.remove());
+  const unobserved = [];
+  if (!enabled) return unobserved;
+  const source = new Map(
+    (ui?.conditions ?? []).map((c) => [c.conditionKey, c]),
+  );
+  for (const root of doc.querySelectorAll(
+    '[data-iam-condition][data-iam-alternative="true"]',
+  )) {
+    const condition = source.get(root.getAttribute("data-iam-condition")),
+      id = root.getAttribute("data-iam-node");
+    if (!condition?.observation || selections.has(id)) continue;
+    const note = doc.createElement("div");
+    note.setAttribute("data-iam-preview-note", "unobserved");
+    note.className = "iam-observation-note";
+    note.setAttribute("role", "status");
+    note.textContent =
+      condition.observation === "remote" ? "远程数据未观测" : "数据未观测";
+    note.title = condition.expression;
+    root.before(note);
+    if (!note.closest("[hidden]"))
+      unobserved.push({
+        groupKey: id,
+        expression: condition.expression,
+        source: condition.source,
+      });
+  }
+  for (const root of doc.querySelectorAll(
+    '[data-iam-observation="remote"],[data-iam-observation="unobserved"]',
+  )) {
+    root.hidden = false;
+    root.textContent = "未观测";
+    root.classList.add("iam-unobserved-value");
+  }
+  for (const field of doc.querySelectorAll("[data-iam-input-unobserved]")) {
+    field.setAttribute("placeholder", "未观测");
+    field.setAttribute("title", "此字段的数据未观测");
+  }
+  return unobserved;
+}

package/src/source-entry.mjs

@@ -0,0 +1,50 @@
+import fs from "node:fs/promises";
+import path from "node:path";
+import { dependency } from "./dependencies.mjs";
+import { sha256 } from "./integrity.mjs";
+
+/** Select a browser import graph without evaluating the entry or its configuration. */
+export async function sourceEntry({ root, modules, resolveModule, ts, entry }) {
+  let htmlSource;
+  if (entry === undefined) {
+    const file = path.join(root, "index.html");
+    let stat;
+    try { stat = await fs.lstat(file); }
+    catch (error) { if (error.code !== "ENOENT") throw error; }
+    if (stat) {
+      if (!stat.isFile() || stat.isSymbolicLink() || stat.size > 256_000)
+        throw Error("Browser entry HTML must be a bounded local file");
+      const bytes = await fs.readFile(file), text = new TextDecoder("utf-8", { fatal: true }).decode(bytes);
+      const { JSDOM } = dependency("jsdom").value;
+      const dom = new JSDOM(text);
+      try {
+        const scripts = [...dom.window.document.querySelectorAll('script[type="module"]')];
+        if (scripts.length !== 1 || !scripts[0].hasAttribute("src") || scripts[0].textContent.trim() || dom.window.document.querySelector("base[href]"))
+          throw Error("Ambiguous browser entry: set entry to one local source module");
+        entry = scripts[0].getAttribute("src").replace(/^\/(?!\/)/, "");
+        htmlSource = { file: "index.html", sha256: sha256(bytes), bytes: bytes.length };
+      } finally { dom.window.close(); }
+    }
+  }
+  if (entry === undefined) return { discoveryModules: modules };
+  if (typeof entry !== "string" || !entry || entry.startsWith("/") || /[\\?#:\s]/.test(entry) || entry.split("/").some(part => !part || part === "." || part === "..") || !modules.has(entry))
+    throw Error("entry must name one source module relative to the scanned root");
+  const selected = new Map();
+  function visit(module) {
+    if (selected.has(module.file)) return;
+    selected.set(module.file, module);
+    const dependencies = new Set([...module.imports.values()].map(ref => ref.specifier));
+    function imports(node) {
+      if ((ts.isImportDeclaration(node) || ts.isExportDeclaration(node)) && node.moduleSpecifier && ts.isStringLiteral(node.moduleSpecifier)) dependencies.add(node.moduleSpecifier.text);
+      if (ts.isCallExpression(node) && node.expression.kind === ts.SyntaxKind.ImportKeyword && node.arguments.length === 1 && ts.isStringLiteral(node.arguments[0])) dependencies.add(node.arguments[0].text);
+      ts.forEachChild(node, imports);
+    }
+    imports(module.source);
+    for (const specifier of dependencies) {
+      const target = resolveModule(module.file, specifier);
+      if (target) visit(target);
+    }
+  }
+  visit(modules.get(entry));
+  return { discoveryModules: selected, htmlSource, entry };
+}

package/src/source-environment.mjs

@@ -0,0 +1,26 @@
+// Reviewable UI environment projections. No browser globals or merchant callbacks are accessed.
+export function uiEnvironmentPrimitive({ts,node,module,binding,imported,evaluate}){
+ const returned=fn=>!fn?.body?null:ts.isArrowFunction(fn)&&!ts.isBlock(fn.body)?fn.body:ts.isBlock(fn?.body)&&fn.body.statements.length===1&&ts.isReturnStatement(fn.body.statements[0])?fn.body.statements[0].expression:null;
+ const call=node&&ts.isCallExpression(node)?node:null;if(!call)return null;
+ const ref=ts.isIdentifier(call.expression)&&binding(module,call.expression.text),fn=ref?.node;
+ const expression=fn&&returned(fn),store=expression&&ts.isCallExpression(expression)?expression:call,owner=expression?ref.module:module;
+ const primitive=imported(owner,store.expression.getText(owner.source));
+ if(primitive?.specifier==='react'&&primitive.name==='useSyncExternalStore'&&store.arguments.length===3){
+  const snapshot=returned(store.arguments[1]),fallback=returned(store.arguments[2]);
+  if(!snapshot||!ts.isPropertyAccessExpression(snapshot)||snapshot.name.text!=='matches'||!ts.isCallExpression(snapshot.expression))return null;
+  const media=snapshot.expression;if(media.expression.getText(owner.source)!=='window.matchMedia'||media.arguments.length!==1||fallback?.kind!==ts.SyntaxKind.FalseKeyword)return null;
+  const query=evaluate(media.arguments[0],owner,{});
+  if(typeof query!=='string'||!/^\((?:max|min)-width: [1-9]\d{1,3}px\)$/.test(query))return null;
+  return {kind:'viewport',query};
+ }
+ // Only presentation preference names, with an explicit source SSR guard. Auth/session cookies stay opaque.
+ if(ref&&ts.isFunctionDeclaration(fn)&&fn.body&&ts.isBlock(fn.body)&&call.arguments.length===1){
+  const key=evaluate(call.arguments[0],module,{}),guard=fn.body.statements[0];
+  if(typeof key!=='string'||!/^(?:sidebar_state|layout_(?:variant|collapsible)|theme|color_scheme)$/.test(key))return null;
+  if(!guard||!ts.isIfStatement(guard)||guard.expression.getText(ref.module.source).replace(/\s+/g,'')!=="typeofdocument==='undefined'"&&guard.expression.getText(ref.module.source).replace(/\s+/g,'')!=='typeofdocument==="undefined"')return null;
+  const branch=ts.isBlock(guard.thenStatement)?guard.thenStatement.statements[0]:guard.thenStatement;
+  if(!branch||!ts.isReturnStatement(branch)||branch.expression?.getText(ref.module.source)!=='undefined')return null;
+  return {kind:'empty-preference'};
+ }
+ return null;
+}

package/src/source-media.mjs

@@ -0,0 +1,21 @@
+import fs from 'node:fs/promises';
+import path from 'node:path';
+import {sha256} from './integrity.mjs';
+/** Only literal raster references in projected JSX. No crawling, URL fetch or symlink expansion. */
+export async function referencedRasterSources(root,urls){
+ const files=[],seen=new Set();let total=0;
+ for(const url of [...urls].sort()){
+  if(typeof url!=='string'||!/^\/(?!\/)[A-Za-z0-9_./-]+\.(?:png|jpe?g|webp|gif)$/i.test(url))continue;
+  const file=url.startsWith('/__iam_source__/')?url.slice('/__iam_source__/'.length):'public'+url;
+  if(seen.has(file))continue;seen.add(file);
+  if(file.split('/').some(p=>!p||p.startsWith('.'))||/(?:^|\/)(?:api|server|secrets?|credentials)(?:\/|\.)/i.test(file))throw Error('Unsafe referenced image path');
+  try{
+   let current=root;for(const part of file.split('/')){current=path.join(current,part);if((await fs.lstat(current)).isSymbolicLink())throw Error('Referenced image symlinks are not admitted');}
+   const real=await fs.realpath(current),stat=await fs.stat(real);
+   if(!real.startsWith(root+path.sep)||!stat.isFile()||stat.size>1048576||(total+=stat.size)>6291456||files.length>=128)throw Error('Referenced image scope or budget exceeded');
+   const bytes=await fs.readFile(real);if(bytes.length!==stat.size)throw Error('Referenced image changed while reading');
+   files.push({file,sha256:sha256(bytes),bytes:bytes.length});
+  }catch(error){if(error.code!=='ENOENT')throw error;}
+ }
+ return files;
+}