@ultimat3/core 24.0.0 → 25.1.0

package/src/secrets-store.ts

@@ -3,17 +3,17 @@
 // each value into the process environment, under its own name, only where the real environment has
 // nothing. `secrets.ts` owns the envelope; this owns the filesystem and `process.env`.
 
-// `node:fs` sync, by necessity twice over: Bun.write takes no mode, and a world-readable master key
-// is the whole failure this file exists to prevent — and `installSecrets()` runs once, at boot,
-// before the process is serving anything, so there is nothing for an async read to overlap with.
-// `renameSync` because Bun has no atomic-replace primitive, and `rmSync` to clear the temp file.
-import { existsSync, readFileSync, renameSync, rmSync, writeFileSync } from 'node:fs';
+// why: Bun has no synchronous file read or exists check, and `installSecrets()` runs once, at boot,
+// before the process serves anything, so an async read has nothing to overlap with. Writing the
+// key is `secrets-key-file.ts`'s.
+import { existsSync, readFileSync } from 'node:fs';
 // Bun exposes no path-join primitive.
 import { join } from 'node:path';
 import { isUltimateError } from './errors';
 import type { SecretValues } from './secrets';
 import { masterKeyId, openSecrets, parseMasterKey, sealSecrets } from './secrets';
 import { SecretsFileMissingError, SecretsKeyMissingError } from './secrets-errors';
+import { OWNER_ONLY_MODE, renameOver, writeOwnerOnlyFile } from './secrets-key-file';
 
 /** Committed. Encrypted at rest, diffable, and the only file `x secrets` writes into the repo. */
 export const SECRETS_FILE = 'secrets.enc.json';
@@ -21,8 +21,11 @@ export const SECRETS_FILE = 'secrets.enc.json';
 export const SECRETS_KEY_FILE = '.secrets.key';
 /** Read first, so a container gets its key from the platform's secret store and never from a file. */
 export const SECRETS_KEY_ENV = 'ULTIMATE_SECRETS_KEY';
-/** Owner read/write. A key file the rest of the box can read is a key file that has leaked. */
-export const SECRETS_KEY_MODE = 0o600;
+/**
+ * Owner read/write. A key file the rest of the box can read is a key file that has leaked. On
+ * Windows the mode is not what keeps other accounts out — the ACL is, and the writers set it.
+ */
+export const SECRETS_KEY_MODE = OWNER_ONLY_MODE;
 
 export type MasterKeySource = 'env' | 'file';
 
@@ -118,7 +121,9 @@ export async function writeSecretsFile(
 }
 
 /**
- * Write the master key at 0600. Callers must have made the ignore rule true first.
+ * Write the master key at 0600 — on Windows, with an ACL granting the current account alone
+ * (`X_SECRETS_KEY_ACL_FAILED` when `icacls` refuses). Callers must have made the ignore rule true
+ * first.
  *
  * Through a fresh temp file renamed over the target, never a write in place: `mode` applies only
  * when a write CREATES the file, so rotating over a key that was 0644 left the new key 0644. The
@@ -126,14 +131,25 @@ export async function writeSecretsFile(
  */
 export function writeMasterKeyFile(root: string, keyHex: string): string {
   const path = masterKeyPath(root);
-  const temp = `${path}.${crypto.randomUUID()}.tmp`;
-  try {
-    writeFileSync(temp, `${keyHex}\n`, { encoding: 'utf-8', mode: SECRETS_KEY_MODE, flag: 'wx' });
-    renameSync(temp, path);
-  } catch (error) {
-    rmSync(temp, { force: true });
-    throw error;
-  }
+  writeOwnerOnlyFile(path, `${keyHex}\n`);
+  return path;
+}
+
+/** Stage a rotation's new key at `stagedMasterKeyPath`, owner-only like the live one. */
+export function stageMasterKeyFile(root: string, keyHex: string): string {
+  const path = stagedMasterKeyPath(root);
+  writeOwnerOnlyFile(path, `${keyHex}\n`);
+  return path;
+}
+
+/**
+ * Make a staged key live: rename it over the key file. Retried briefly when Windows refuses the
+ * rename because something holds the old key open (EPERM/EBUSY) — the last step of a rotation is
+ * the wrong one to lose to an editor or a virus scan.
+ */
+export function promoteStagedMasterKey(root: string): string {
+  const path = masterKeyPath(root);
+  renameOver(stagedMasterKeyPath(root), path);
   return path;
 }
 

package/src/service.ts

@@ -1,20 +1,20 @@
-// Single responsibility: named service factories that `createContext` installs automatically,
+// Single responsibility: named service factories that `ctxOf` installs automatically,
 // bound to the exact ctx (actor, clock, tz) they were built for.
 //
 // A service closes over the `ctx` it was constructed with — `ctx.actor.orgId` inside it means
 // "the actor this service was built for", not "whoever is calling right now". So a factory
-// cannot be built once and cached: it has to run again every time `createContext` produces a
+// cannot be built once and cached: it has to run again every time `ctxOf` produces a
 // ctx with a different actor, or an impersonated call would read the wrong tenant. Registering
-// with `defineService` is what lets `createContext` do that automatically instead of every
+// with `defineService` is what lets `ctxOf` do that automatically instead of every
 // caller wiring `services: { posts: postsService(ctx) }` by hand at every call site.
 
 import type { CtxFacts, ServiceBag } from './context';
 import { UltimateError } from './errors';
 
 /**
- * `CtxFacts` and not `Ctx`: this factory runs INSIDE `createContext`, against a preview that
+ * `CtxFacts` and not `Ctx`: this factory runs INSIDE `ctxOf`, against a preview that
  * carries no other registered service — which the paragraph above has always said and the type
- * now enforces. It is also what lets `createContext` build that preview without an assertion.
+ * now enforces. It is also what lets `ctxOf` build that preview without an assertion.
  */
 export type ServiceFactory<T = unknown> = (ctx: CtxFacts) => T;
 

package/src/single-flight.ts

@@ -56,7 +56,7 @@ const defaultScheduler: Scheduler = (fn, ms) => {
   };
 };
 
-export function createSingleFlight(options?: SingleFlightOptions): SingleFlight {
+export function singleFlight(options?: SingleFlightOptions): SingleFlight {
   const inflight = new Map<string, Flight>();
   const schedule = options?.schedule ?? defaultScheduler;
   const deadlineMs = options?.deadlineMs;

package/src/telemetry.ts

@@ -340,7 +340,7 @@ const TRACEPARENT_RE = /^00-([0-9a-f]{32})-([0-9a-f]{16})-([0-9a-f]{2})$/;
 
 /**
  * Round-trips with `traceId()` / `spanId()` from `ids.ts` and with nothing else. A context whose
- * `traceId` came from `uuid()` renders a 36-character dashed header here that `parseTraceparent`
+ * `traceId` came from `uuidV7()` renders a 36-character dashed header here that `parseTraceparent`
  * — and every OTLP collector — rejects, so mint the pair with those two generators.
  */
 export function traceparent(context: SpanContext): string {

package/src/theme-storage.ts

@@ -0,0 +1,12 @@
+/**
+ * The `localStorage` key a visitor's light/dark choice lives under. Tier 0 because the WRITER is
+ * `@ultimat3/ui`'s `ThemeToggle` and the READER is `@ultimat3/render`'s inlined boot script — two
+ * tier-4 packages that cannot import each other.
+ */
+
+/**
+ * One declaration, imported by both. Until 25.0.0 each package carried its own literal, pinned
+ * equal by a test: the two disagreeing was exactly the bug — the boot read one key, the toggle
+ * wrote another, and a visitor's choice never survived a reload.
+ */
+export const THEME_STORAGE_KEY = 'ultimate.theme';

package/src/type-pins.ts

@@ -6,8 +6,16 @@
 
 import type { Actor, ActorFactMap, FactKeysOf, FactMapOf } from './actor';
 import type { CacheTierName } from './cache-vocabulary';
-import type { AppConfigInput, CacheConfig, DatabaseConfig, RealtimeConfig } from './config';
+import type {
+  AppConfig,
+  AppConfigInput,
+  CacheConfig,
+  DatabaseConfig,
+  RealtimeConfig,
+  ThemeConfig,
+} from './config';
 import type { CtxPatch } from './context';
+import type { Page } from './cursor-page';
 import type { HydrateStrategy, OfflineStrategy, RenderMode } from './route-vocabulary';
 
 /** Fails to compile when `T` is anything but `true`. The whole mechanism. */
@@ -102,6 +110,29 @@ type _DatabaseInputCarriesNoDeadField = Assert<
     : false
 >;
 
+/**
+ * The five keys deleted in 25.0.0 stay deleted — on the config an app reads AND the input it
+ * writes. `defineConfig` refuses each by name at run time (`config-removed.ts`); this is the build
+ * error, so re-declaring one fails `tsc -b` before any test runs. `locales` / `defaultLocale` were
+ * a second declaration of `defineCatalogs({ default })`; `defaultTimeZone` / `defaultCurrency`
+ * and `theme.tokens` were read by nothing.
+ */
+type RemovedTopLevelKey = 'locales' | 'defaultLocale' | 'defaultTimeZone' | 'defaultCurrency';
+
+type _AppConfigCarriesNoRemovedKey = Assert<
+  Extract<keyof AppConfig, RemovedTopLevelKey> extends never ? true : false
+>;
+
+type _AppConfigInputCarriesNoRemovedKey = Assert<
+  Extract<keyof AppConfigInput, RemovedTopLevelKey> extends never ? true : false
+>;
+
+type _ThemeConfigIsDefaultModeAlone = Assert<Exact<keyof ThemeConfig, 'defaultMode'>>;
+
+type _ThemeInputCarriesNoTokens = Assert<
+  'tokens' extends keyof NonNullable<AppConfigInput['theme']> ? false : true
+>;
+
 /**
  * The two `config.cache` fields deleted 2026-08-22, held down for the reason the `database` three
  * are: `cache.tiers` is what BUILDS the ladder, so `driver: 'redis'` was a second selector that
@@ -219,3 +250,22 @@ type _CacheConfigNamesTheLadder = Assert<Exact<CacheConfig['tiers'], readonly Ca
 type _CacheInputNamesTheLadder = Assert<
   Exact<NonNullable<AppConfigInput['cache']>['tiers'], readonly CacheTierName[] | undefined>
 >;
+
+// The one page shape (`cursor-page.ts`): the two facts cannot disagree in a value that
+// typechecks, and `hasMore` narrows `nextCursor`.
+
+// @ts-expect-error — `hasMore: true` with no cursor is not a page: "more" must say where.
+export const _MoreWithoutCursor: Page<number> = { rows: [], nextCursor: null, hasMore: true };
+
+// @ts-expect-error — a cursor on the last page is not a page: it would continue a `while` loop.
+export const _LastWithCursor: Page<number> = { rows: [], nextCursor: 'c', hasMore: false };
+
+/** On the `hasMore` side `nextCursor` is a `string` — a loop passes it on with no `?? ''`. */
+export type _HasMoreNarrowsCursor = Assert<
+  Extract<Page<number>, { readonly hasMore: true }>['nextCursor'] extends string ? true : false
+>;
+
+/** On the last page it is exactly `null` — `while (page.nextCursor !== null)` is the same loop. */
+export type _LastPageHasNoCursor = Assert<
+  Extract<Page<number>, { readonly hasMore: false }>['nextCursor'] extends null ? true : false
+>;

package/src/image/fixtures.ts

@@ -1,263 +0,0 @@
-// Single responsibility: byte-exact image fixtures produced by an INDEPENDENT encoder
-// (Pillow 10.2 and ffmpeg), plus the pixels they must decode to. A codec that only
-// round-trips against itself proves nothing — these bytes are the outside reference, so a
-// decoder bug shows up as a pixel mismatch rather than a mutually agreed hallucination.
-
-export interface ImageFixture {
-  /** The encoded file, base64. */
-  readonly base64: string;
-  readonly width: number;
-  readonly height: number;
-  /** Expected RGBA decode, row-major. Omitted for probe-only and lossy fixtures. */
-  readonly pixels?: readonly number[] | undefined;
-}
-
-export const fixtureBytes = (fixture: ImageFixture): Uint8Array =>
-  Uint8Array.from(atob(fixture.base64), (c) => c.charCodeAt(0));
-
-/** Truecolour + alpha (PNG colour type 6), including fully transparent and premature zeros. */
-export const PNG_RGBA_4X4: ImageFixture = {
-  base64:
-    'iVBORw0KGgoAAAANSUhEUgAAAAQAAAAECAYAAACp8Z5+AAAAQUlEQVR4nAXBKQGAABAAweU5Po1GE4I4hEBeCpIQ' +
-    'gjjoM8sMgIJIgqC6rNv+3qdN2/VkpoqookREVFUd1/PN0zj84AIej7U060EAAAAASUVORK5CYII=',
-  width: 4,
-  height: 4,
-  pixels: [
-    0, 0, 0, 255, 255, 0, 0, 255, 0, 255, 0, 128, 0, 0, 255, 0, 255, 255, 255, 255, 10, 20, 30, 40,
-    200, 150, 100, 255, 1, 2, 3, 4, 128, 128, 128, 255, 255, 255, 0, 255, 0, 255, 255, 255, 255, 0,
-    255, 255, 5, 5, 5, 5, 250, 250, 250, 250, 60, 120, 180, 240, 9, 8, 7, 6,
-  ],
-};
-
-/** Truecolour, no alpha (colour type 2) — alpha must be synthesised as 255. */
-export const PNG_RGB_3X2: ImageFixture = {
-  base64:
-    'iVBORw0KGgoAAAANSUhEUgAAAAMAAAACCAIAAAASFvFNAAAAF0lEQVR4nGP4z8DAAMFcInInUowYGBgANh8EmGKC' +
-    'N2kAAAAASUVORK5CYII=',
-  width: 3,
-  height: 2,
-  pixels: [
-    255, 0, 0, 255, 0, 255, 0, 255, 0, 0, 255, 255, 10, 20, 30, 255, 200, 100, 50, 255, 0, 0, 0,
-    255,
-  ],
-};
-
-/** Greyscale (colour type 0) — one channel replicated across RGB. */
-export const PNG_GRAY_2X2: ImageFixture = {
-  base64:
-    'iVBORw0KGgoAAAANSUhEUgAAAAIAAAACCAAAAABX3VL4AAAADklEQVR4nGNgCGVY9R8AA60B/2f7ygkAAAAASUVO' +
-    'RK5CYII=',
-  width: 2,
-  height: 2,
-  pixels: [0, 0, 0, 255, 85, 85, 85, 255, 170, 170, 170, 255, 255, 255, 255, 255],
-};
-
-/** Indexed colour (type 3) with a `tRNS` alpha table — the entry PNG readers forget. */
-export const PNG_PALETTE_4X1: ImageFixture = {
-  base64:
-    'iVBORw0KGgoAAAANSUhEUgAAAAQAAAABCAMAAADO4v//AAADAFBMVEX/AAAA/wAAAP///wAAAAAAAAAAAAAAAAAA' +
-    'AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA' +
-    'AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA' +
-    'AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA' +
-    'AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA' +
-    'AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA' +
-    'AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA' +
-    'AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA' +
-    'AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA' +
-    'AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA' +
-    'AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA' +
-    'AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA' +
-    'AAAAAAAAAAAAAAAAAAAAAAAX3fWLAAAABHRSTlP/gAD/oaGUZgAAAA1JREFUeJxjYGBkYgYAAA8AB4SOmW0AAAAA' +
-    'SUVORK5CYII=',
-  width: 4,
-  height: 1,
-  pixels: [255, 0, 0, 255, 0, 255, 0, 128, 0, 0, 255, 0, 255, 255, 0, 255],
-};
-
-/** Greyscale + alpha (colour type 4). */
-export const PNG_GRAY_ALPHA_2X2: ImageFixture = {
-  base64:
-    'iVBORw0KGgoAAAANSUhEUgAAAAIAAAACCAQAAADYv8WvAAAAEklEQVR4nGNk+N/QyHCC4b8DABPwBAkrfI8bAAAA' +
-    'AElFTkSuQmCC',
-  width: 2,
-  height: 2,
-  pixels: [0, 0, 0, 255, 128, 128, 128, 128, 200, 200, 200, 0, 255, 255, 255, 64],
-};
-
-/** 16 bits per channel — must be reduced to 8 by taking the high byte. */
-export const PNG_GRAY16_2X2: ImageFixture = {
-  base64:
-    'iVBORw0KGgoAAAANSUhEUgAAAAIAAAACEAAAAAAHTY67AAAAEklEQVR4nGNgYHBgYGhg+P8fAAbHAr89RY6RAAAA' +
-    'AElFTkSuQmCC',
-  width: 2,
-  height: 2,
-  pixels: [0, 0, 0, 255, 64, 64, 64, 255, 128, 128, 128, 255, 255, 255, 255, 255],
-};
-
-/** Big enough that Pillow picks a different row filter per scanline — all five must work. */
-export const PNG_GRADIENT_32X24: ImageFixture = {
-  base64:
-    'iVBORw0KGgoAAAANSUhEUgAAACAAAAAYCAIAAAAUMWhjAAAAuklEQVR4nLXSyw6DIBCF4WNrr/aiaNHamL7/W3aB' +
-    'GFDEgQ7JtxjGxR/UDMAppRwFgCydKbBLxAzsU5gFcnbLwIGXM3BktBZg+1E9gTMLf+Dyv83ANdagBkqgCNHPNsTA' +
-    'jaBz7umB+zrpeRoUeCw0rqUlNPA01PbRLSJQAiUg9LAhLlDRRQQEUAGC5hsaqPUNBFB7DWoICjTGK1KBxuVjHqO/' +
-    'wRR42frZhh6Q6wGpvY15xHIDCbRAB7RLPwPnHDcTUr+XAAAAAElFTkSuQmCC',
-  width: 32,
-  height: 24,
-};
-
-/** The exact source of `PNG_GRADIENT_32X24` and the JPEG fixtures, as a formula. */
-export const gradientPixel = (x: number, y: number): readonly [number, number, number] => [
-  (x * 7) % 256,
-  (y * 11) % 256,
-  (x * y) % 256,
-];
-
-/**
- * A genuine Adam7 interlaced PNG (written by ImageMagick — Pillow's writer silently ignores
- * `interlace=True`, which is why this one is not generated with the others). The pipeline
- * refuses it with a coded error rather than garbling it.
- */
-export const PNG_INTERLACED_8X8: ImageFixture = {
-  base64:
-    'iVBORw0KGgoAAAANSUhEUgAAAAgAAAAICAIAAAE8ahlKAAAAS0lEQVQI12NgYGBgqGFQYWQoUalhUGGwYxDaxWDG' +
-    'wlCiwsCgwshgJWTHAEUQMSEIYpRn4ESSsRKCy+DmMDLIcsozYEEQVZyYiHQJAE1EC4Be7arJAAAAAElFTkSuQmCC',
-  width: 8,
-  height: 8,
-};
-
-/** Baseline JPEG, 4:4:4, quality 95 — the closest a lossy codec gets to exact. */
-export const JPEG_444_16X16: ImageFixture = {
-  base64:
-    '/9j/4AAQSkZJRgABAQAAAQABAAD/2wBDAAIBAQEBAQIBAQECAgICAgQDAgICAgUEBAMEBgUGBgYFBgYGBwkIBgcJ' +
-    'BwYGCAsICQoKCgoKBggLDAsKDAkKCgr/2wBDAQICAgICAgUDAwUKBwYHCgoKCgoKCgoKCgoKCgoKCgoKCgoKCgoK' +
-    'CgoKCgoKCgoKCgoKCgoKCgoKCgoKCgoKCgr/wAARCAAQABADAREAAhEBAxEB/8QAHwAAAQUBAQEBAQEAAAAAAAAA' +
-    'AAECAwQFBgcICQoL/8QAtRAAAgEDAwIEAwUFBAQAAAF9AQIDAAQRBRIhMUEGE1FhByJxFDKBkaEII0KxwRVS0fAk' +
-    'M2JyggkKFhcYGRolJicoKSo0NTY3ODk6Q0RFRkdISUpTVFVWV1hZWmNkZWZnaGlqc3R1dnd4eXqDhIWGh4iJipKT' +
-    'lJWWl5iZmqKjpKWmp6ipqrKztLW2t7i5usLDxMXGx8jJytLT1NXW19jZ2uHi4+Tl5ufo6erx8vP09fb3+Pn6/8QA' +
-    'HwEAAwEBAQEBAQEBAQAAAAAAAAECAwQFBgcICQoL/8QAtREAAgECBAQDBAcFBAQAAQJ3AAECAxEEBSExBhJBUQdh' +
-    'cRMiMoEIFEKRobHBCSMzUvAVYnLRChYkNOEl8RcYGRomJygpKjU2Nzg5OkNERUZHSElKU1RVVldYWVpjZGVmZ2hp' +
-    'anN0dXZ3eHl6goOEhYaHiImKkpOUlZaXmJmaoqOkpaanqKmqsrO0tba3uLm6wsPExcbHyMnK0tPU1dbX2Nna4uPk' +
-    '5ebn6Onq8vP09fb3+Pn6/9oADAMBAAIRAxEAPwD83/gx+yH/AKr/AIlfp/BRg8Z5h4eeIfwe+fW3wX/ZDz5X/Er9' +
-    'P4K+qweM21P7r8PPEP4PfPpT4L/sh48r/iV+n8FfleDxm2p/hT4eeIfwe+fW3wY/ZD/1X/Er9P4K+qweM8z+6/Dz' +
-    'xD+D3z//2Q==',
-  width: 16,
-  height: 16,
-};
-
-/** Baseline JPEG, 4:2:0 — chroma is half resolution and must be upsampled. */
-export const JPEG_420_16X16: ImageFixture = {
-  base64:
-    '/9j/4AAQSkZJRgABAQAAAQABAAD/2wBDAAMCAgMCAgMDAwMEAwMEBQgFBQQEBQoHBwYIDAoMDAsKCwsNDhIQDQ4R' +
-    'DgsLEBYQERMUFRUVDA8XGBYUGBIUFRT/2wBDAQMEBAUEBQkFBQkUDQsNFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQU' +
-    'FBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBT/wAARCAAQABADASIAAhEBAxEB/8QAHwAAAQUBAQEBAQEAAAAAAAAA' +
-    'AAECAwQFBgcICQoL/8QAtRAAAgEDAwIEAwUFBAQAAAF9AQIDAAQRBRIhMUEGE1FhByJxFDKBkaEII0KxwRVS0fAk' +
-    'M2JyggkKFhcYGRolJicoKSo0NTY3ODk6Q0RFRkdISUpTVFVWV1hZWmNkZWZnaGlqc3R1dnd4eXqDhIWGh4iJipKT' +
-    'lJWWl5iZmqKjpKWmp6ipqrKztLW2t7i5usLDxMXGx8jJytLT1NXW19jZ2uHi4+Tl5ufo6erx8vP09fb3+Pn6/8QA' +
-    'HwEAAwEBAQEBAQEBAQAAAAAAAAECAwQFBgcICQoL/8QAtREAAgECBAQDBAcFBAQAAQJ3AAECAxEEBSExBhJBUQdh' +
-    'cRMiMoEIFEKRobHBCSMzUvAVYnLRChYkNOEl8RcYGRomJygpKjU2Nzg5OkNERUZHSElKU1RVVldYWVpjZGVmZ2hp' +
-    'anN0dXZ3eHl6goOEhYaHiImKkpOUlZaXmJmaoqOkpaanqKmqsrO0tba3uLm6wsPExcbHyMnK0tPU1dbX2Nna4uPk' +
-    '5ebn6Onq8vP09fb3+Pn6/9oADAMBAAIRAxEAPwD4/wDBfwh/1f7j9K958F/CH/V/uP0r2PwX8If9X+4/SvefBfwh' +
-    '/wBX+4/SjB4zbUPDzxD+D3z/2Q==',
-  width: 16,
-  height: 16,
-};
-
-/** The exact source of the 16x16 JPEG fixtures, as a formula. */
-export const jpegPixel = (x: number, y: number): readonly [number, number, number] => [
-  (x * 16) % 256,
-  (y * 16) % 256,
-  ((x + y) * 8) % 256,
-];
-
-/** Odd dimensions with 4:2:0: the last MCU column and row are padded and must be cropped. */
-export const JPEG_420_ODD_33X17: ImageFixture = {
-  base64:
-    '/9j/4AAQSkZJRgABAQAAAQABAAD/2wBDAAQDAwMDAgQDAwMEBAQFBgoGBgUFBgwICQcKDgwPDg4MDQ0PERYTDxAV' +
-    'EQ0NExoTFRcYGRkZDxIbHRsYHRYYGRj/2wBDAQQEBAYFBgsGBgsYEA0QGBgYGBgYGBgYGBgYGBgYGBgYGBgYGBgY' +
-    'GBgYGBgYGBgYGBgYGBgYGBgYGBgYGBgYGBj/wAARCAARACEDASIAAhEBAxEB/8QAHwAAAQUBAQEBAQEAAAAAAAAA' +
-    'AAECAwQFBgcICQoL/8QAtRAAAgEDAwIEAwUFBAQAAAF9AQIDAAQRBRIhMUEGE1FhByJxFDKBkaEII0KxwRVS0fAk' +
-    'M2JyggkKFhcYGRolJicoKSo0NTY3ODk6Q0RFRkdISUpTVFVWV1hZWmNkZWZnaGlqc3R1dnd4eXqDhIWGh4iJipKT' +
-    'lJWWl5iZmqKjpKWmp6ipqrKztLW2t7i5usLDxMXGx8jJytLT1NXW19jZ2uHi4+Tl5ufo6erx8vP09fb3+Pn6/8QA' +
-    'HwEAAwEBAQEBAQEBAQAAAAAAAAECAwQFBgcICQoL/8QAtREAAgECBAQDBAcFBAQAAQJ3AAECAxEEBSExBhJBUQdh' +
-    'cRMiMoEIFEKRobHBCSMzUvAVYnLRChYkNOEl8RcYGRomJygpKjU2Nzg5OkNERUZHSElKU1RVVldYWVpjZGVmZ2hp' +
-    'anN0dXZ3eHl6goOEhYaHiImKkpOUlZaXmJmaoqOkpaanqKmqsrO0tba3uLm6wsPExcbHyMnK0tPU1dbX2Nna4uPk' +
-    '5ebn6Onq8vP09fb3+Pn6/9oADAMBAAIRAxEAPwD5Q0fwT5u39z+ld1pvw/iSISTIqL6nvXp/h3weiW/nSRfKoyeO' +
-    'tdhpvg/di6uot8jcJGBjPsPQf561rgMVg4YSnWrQU5zV9X7sY931d3oktZO6Tvv4XDfG0nJJTPLNO8D2h4hs5JTx' +
-    'g7dqn+v6VR+JHgq2Hgu0AtIUYX6AgkyEfu5OwGRX0dZeEGLhZ4ix2gmJDtRQOef59/5VQ+InhLb4LtDs+UXyZ8v5' +
-    'F/1cnAPU9OlZ0M4w6xkI8kY66+7HTfpZyVutpuS+0lu/1vNuNH/q7ivf+x380fHP/CERf8+8H/fl6K96/wCEIi/5' +
-    '94P+/L0V9J/bf/Til/4Gfz7/AK6f32eh6N/yA3/4D/6EK7LTv+Qlb/8AXIfzNFFfmMP4OE/wUv8A0uofC8M7/f8A' +
-    'kjpNG/5Ab/8AAf8A0IVB8RP+QBp3/XxH/wCgy0UV8/k/8bAf4aX/AKXUP2DOf+Sexv8Ahf6HjNFFFfmh+Hn/2Q==',
-  width: 33,
-  height: 17,
-};
-
-/** The exact source of `JPEG_420_ODD_33X17`, as a formula. */
-export const oddJpegPixel = (x: number, y: number): readonly [number, number, number] => [
-  (x * 9) % 256,
-  (y * 13) % 256,
-  (x * y * 3) % 256,
-];
-
-/** Single-component (greyscale) JPEG. */
-export const JPEG_GRAY_16X16: ImageFixture = {
-  base64:
-    '/9j/4AAQSkZJRgABAQAAAQABAAD/2wBDAAMCAgICAgMCAgIDAwMDBAYEBAQEBAgGBgUGCQgKCgkICQkKDA8MCgsO' +
-    'CwkJDRENDg8QEBEQCgwSExIQEw8QEBD/wAALCAAQABABAREA/8QAHwAAAQUBAQEBAQEAAAAAAAAAAAECAwQFBgcI' +
-    'CQoL/8QAtRAAAgEDAwIEAwUFBAQAAAF9AQIDAAQRBRIhMUEGE1FhByJxFDKBkaEII0KxwRVS0fAkM2JyggkKFhcY' +
-    'GRolJicoKSo0NTY3ODk6Q0RFRkdISUpTVFVWV1hZWmNkZWZnaGlqc3R1dnd4eXqDhIWGh4iJipKTlJWWl5iZmqKj' +
-    'pKWmp6ipqrKztLW2t7i5usLDxMXGx8jJytLT1NXW19jZ2uHi4+Tl5ufo6erx8vP09fb3+Pn6/9oACAEBAAA/APzK' +
-    '8P8Ah/8AtXb8mc+1el+H/gt/au3/AETOf9mj4LeH/wC1fI+TOcdq+9fgt8Fv7V8j/RM5x/DX/9k=',
-  width: 16,
-  height: 16,
-};
-
-/** Progressive JPEG — refused with a coded error, never decoded as noise. */
-export const JPEG_PROGRESSIVE_16X16: ImageFixture = {
-  base64:
-    '/9j/4AAQSkZJRgABAQAAAQABAAD/2wBDAAMCAgMCAgMDAwMEAwMEBQgFBQQEBQoHBwYIDAoMDAsKCwsNDhIQDQ4R' +
-    'DgsLEBYQERMUFRUVDA8XGBYUGBIUFRT/2wBDAQMEBAUEBQkFBQkUDQsNFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQU' +
-    'FBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBT/wgARCAAQABADASIAAhEBAxEB/8QAFQABAQAAAAAAAAAAAAAAAAAA' +
-    'Bgf/xAAUAQEAAAAAAAAAAAAAAAAAAAAA/9oADAMBAAIQAxAAAAGPvGTw/8QAFhAAAwAAAAAAAAAAAAAAAAAAAAQF' +
-    '/9oACAEBAAEFAkpAlIEpAlIP/8QAFxEBAAMAAAAAAAAAAAAAAAAABgAhMf/aAAgBAwEBPwE8hy5//8QAFREBAQAA' +
-    'AAAAAAAAAAAAAAAAAwD/2gAIAQIBAT8BFr//xAAWEAADAAAAAAAAAAAAAAAAAAAAASH/2gAIAQEABj8CUFBQUP/E' +
-    'ABQQAQAAAAAAAAAAAAAAAAAAACD/2gAIAQEAAT8hCqq//9oADAMBAAIAAwAAABBT/8QAFBEBAAAAAAAAAAAAAAAA' +
-    'AAAAAP/aAAgBAwEBPxB//8QAFhEAAwAAAAAAAAAAAAAAAAAAACEx/9oACAECAQE/EIM//8QAFRABAQAAAAAAAAAA' +
-    'AAAAAAAAAPH/2gAIAQEAAT8QgoKCgv/Z',
-  width: 16,
-  height: 16,
-};
-
-/** Probe-only: GIF87a/89a header. */
-export const GIF_5X7: ImageFixture = {
-  base64: 'R0lGODdhBQAHAIEAAAAAAAAAAAAAAAAAACwAAAAABQAHAAAIDAABCBxIsKDBgwcDAgA7',
-  width: 5,
-  height: 7,
-};
-
-/** Probe-only: lossy VP8 inside RIFF/WEBP. */
-export const WEBP_9X11: ImageFixture = {
-  base64: 'UklGRiQAAABXRUJQVlA4IBgAAAAwAQCdASoJAAsAAUAmJaQAA3AA/v02aAA=',
-  width: 9,
-  height: 11,
-};
-
-/** Probe-only: AVIF, dimensions read from the `ispe` property box. */
-export const AVIF_12X16: ImageFixture = {
-  base64:
-    'AAAAIGZ0eXBhdmlmAAAAAGF2aWZtaWYxbWlhZk1BMUIAAAD5bWV0YQAAAAAAAAAvaGRscgAAAAAAAAAAcGljdAAA' +
-    'AAAAAAAAAAAAAFBpY3R1cmVIYW5kbGVyAAAAAA5waXRtAAAAAAABAAAAHmlsb2MAAAAARAAAAQABAAAAAQAAASEA' +
-    'AAAiAAAAKGlpbmYAAAAAAAEAAAAaaW5mZQIAAAAAAQAAYXYwMUNvbG9yAAAAAGppcHJwAAAAS2lwY28AAAAUaXNw' +
-    'ZQAAAAAAAAAMAAAAEAAAABBwaXhpAAAAAAMICAgAAAAMYXYxQ4EADAAAAAATY29scm5jbHgAAgACAAIAAAAAF2lw' +
-    'bWEAAAAAAAAAAQABBAECgwQAAAAqbWRhdAoKAAAAAZ35//MAgDIUEADAAAACgAAAAKmObLaqsca2hUA=',
-  width: 12,
-  height: 16,
-};
-
-/** Probe-only: SVG is vector — it has a declared box but no raster to decode. */
-export const SVG_120X45: ImageFixture = {
-  base64:
-    'PHN2ZyB4bWxucz0iaHR0cDovL3d3dy53My5vcmcvMjAwMC9zdmciIHdpZHRoPSIxMjAiIGhlaWdodD0iNDUiIHZp' +
-    'ZXdCb3g9IjAgMCAxMjAgNDUiPjwvc3ZnPg==',
-  width: 120,
-  height: 45,
-};

package/src/time-zone-name.ts

@@ -1,14 +0,0 @@
-// Single responsibility: re-export `@ultimat3/schema`'s IANA zone-name predicate, so `app.config.ts`
-// and `t.timezone` judge a zone with ONE function.
-//
-// This file held a character-for-character copy of it until 2026-08-27 — `core` and `schema` are
-// both tier 0 and neither could import the other — kept equal by a 123-line pin test in
-// `@ultimat3/cli`, a tier-5 package pinning a tier-0 invariant that no rule required to exist.
-// `core -> schema` is now a declared edge (`scripts/lib/tiers.ts`), so the copy is gone.
-//
-// The rule itself, and why a bare `new Intl.DateTimeFormat(…)` probe is not it — ICU 78 resolves
-// `CET`, `EST`, `Japan`, `GMT` and `Zulu`, so `defaultTimeZone: 'CET'` passed validation at boot
-// and threw `X_TIMEZONE_INVALID` on the first `format` call (issue #257) — is written down in
-// `packages/schema/src/time-zone-name.ts` and in `packages/time/src/zone-canonical.ts`.
-
-export { isIanaZoneName } from '@ultimat3/schema';