@williamzujkowski/live-coding-music-mcp 3.0.0 → 4.1.0

package/dist/services/StrudelEngine.js

@@ -13,8 +13,21 @@
  * @module services/StrudelEngine
  */
 import * as strudelCore from '@strudel/core';
+// Imported for its side effects as well as its exports: Strudel's
+// register() attaches .scale()/.voicing()/.transpose() onto
+// Pattern.prototype at module load. Without this, local validation
+// rejected `n("0 2 4").scale("C:minor")` — an idiom that appears
+// throughout this project's own docs — with the misleading
+// "n(...).scale is not a function", while the browser path accepted it
+// (#232). Local and browser validation disagreeing about the same
+// pattern is worse than either being wrong consistently.
+import * as strudelTonal from '@strudel/tonal';
 import { mini } from '@strudel/mini';
 import { transpiler } from '@strudel/transpiler';
+import { assertPatternIsSafe, runPatternCode, PatternSafetyError } from './PatternSandbox.js';
+import { clarifyEngineError, explainBrowserOnly, findBrowserOnlyCall } from './BrowserOnlyFunctions.js';
+import { probeEventDensity } from './EventDensityProbe.js';
+import { TransientError, ValidationError } from '../utils/CategorisedError.js';
 import { calculateComplexity, checkCommonIssues, extractBpm, extractFunctionsUsed, getSuggestionsForError, parseErrorLocation, } from './StrudelEngineHelpers.js';
 /**
  * Local Strudel pattern engine - executes patterns without browser.
@@ -35,16 +48,61 @@ import { calculateComplexity, checkCommonIssues, extractBpm, extractFunctionsUse
  * console.log(`Found ${events.length} events in 2 cycles`);
  * ```
  */
+/**
+ * Strudel exports that compile or evaluate source at runtime.
+ *
+ * Removed from the sandbox context. Each is a route from pattern text
+ * to main-realm execution that no legitimate pattern needs: patterns
+ * build and combine Strudel values, they do not evaluate new source.
+ *
+ * @nist si-10 "Information input validation"
+ * @nist ac-6 "Least privilege"
+ */
+/**
+ * Most events `queryEvents` will materialize.
+ *
+ * ~1.5 KB per event in practice, so this bounds a query at roughly
+ * 75 MB. Well above any musical pattern: a dense 16-cycle drum pattern
+ * is a few thousand events.
+ */
+export const MAX_QUERY_EVENTS = 50_000;
+export const EVALUATOR_EXPORTS = [
+    'evaluate',
+    'evalScope',
+    'safeEval',
+    'webaudioEvaluate',
+    'transpiler',
+    'transpile',
+    'Function',
+    'eval',
+    'require',
+    'process',
+    'globalThis',
+];
 export class StrudelEngine {
     /** Execution context with Strudel functions */
     context;
     constructor() {
         // Build execution context with all Strudel functions
-        this.context = {
+        const context = {
             ...strudelCore,
+            ...strudelTonal,
             m: mini,
             mini,
         };
+        // Strip the evaluators before anything can reach them.
+        //
+        // @strudel/core exports its own transpile-and-`new Function` under
+        // several names. Spreading the module put them in the sandbox
+        // context, and every context key is automatically an allowed
+        // identifier — so a pattern could call one directly, with no banned
+        // syntax, no member access and no destructuring, and run arbitrary
+        // JavaScript in the main realm. The AST allowlist cannot defend a
+        // context function that is itself an evaluator; the only fix is for
+        // it not to be there.
+        for (const name of EVALUATOR_EXPORTS)
+            delete context[name];
+        this.context = context;
     }
     /**
      * Transpile a Strudel pattern to JavaScript
@@ -60,6 +118,23 @@ export class StrudelEngine {
      * }
      * ```
      */
+    /**
+     * Validates then executes pattern code inside the sandbox.
+     *
+     * Replaces the bare `new Function(...)` this class used at three sites,
+     * which executed caller-supplied JavaScript directly in the server
+     * process (#229).
+     *
+     * @param code - Original pattern source, for the AST allowlist
+     * @param transpiledCode - Transpiler output, actually executed
+     * @returns The Pattern the code produced
+     * @throws {PatternSafetyError} When the pattern is rejected pre-execution
+     * @nist si-10 "Information input validation"
+     */
+    evaluatePattern(code, transpiledCode) {
+        assertPatternIsSafe(code, Object.keys(this.context));
+        return runPatternCode(transpiledCode, this.context);
+    }
     transpile(code) {
         if (!code || code.trim().length === 0) {
             return {
@@ -86,7 +161,11 @@ export class StrudelEngine {
         }
     }
     /**
-     * Validate pattern syntax without execution
+     * Validate a pattern by building it in the sandbox
+     *
+     * Note: this *does* execute the pattern (that is the only way to learn
+     * whether it produces a Pattern), but inside PatternSandbox rather than
+     * in the server process. The JSDoc previously claimed no execution.
      *
      * @param code - Strudel pattern code
      * @returns Validation result with errors and suggestions
@@ -114,9 +193,17 @@ export class StrudelEngine {
         }
         const transpileResult = this.transpile(code);
         if (!transpileResult.success) {
+            // A browser-only call can fail here rather than at execution:
+            // samples("github:...") dies as "Invalid argument" because the
+            // transpiler rewrites every double-quoted string into mini(), and a
+            // URL is not mini notation (#232).
+            const browserOnlyAtTranspile = findBrowserOnlyCall(code);
+            const transpileError = browserOnlyAtTranspile !== null
+                ? (explainBrowserOnly(browserOnlyAtTranspile) ?? transpileResult.error ?? 'Syntax error')
+                : (transpileResult.error ?? 'Syntax error');
             return {
                 valid: false,
-                errors: [transpileResult.error || 'Syntax error'],
+                errors: [transpileError],
                 warnings,
                 suggestions: getSuggestionsForError(transpileResult.error || ''),
                 errorLocation: transpileResult.errorLocation
@@ -125,16 +212,36 @@ export class StrudelEngine {
             };
         }
         try {
-            const fn = new Function(...Object.keys(this.context), transpileResult.transpiledCode);
-            const pattern = fn(...Object.values(this.context));
+            const pattern = this.evaluatePattern(code, transpileResult.transpiledCode);
             if (!pattern || typeof pattern.queryArc !== 'function') {
                 errors.push('Code did not produce a valid pattern');
                 suggestions.push('Ensure your code returns a pattern (e.g., s("bd"), note("c3"), stack(...))');
             }
         }
         catch (error) {
-            errors.push(`Runtime error: ${error.message}`);
-            suggestions.push(...getSuggestionsForError(error.message));
+            // A browser-only function is not a broken pattern. Saying
+            // "unknown identifier 'setcpm'" about a core Strudel function
+            // reads as "you typo'd" when the truth is "this validator cannot
+            // see it" (#232).
+            // Check the source too: samples("github:...") fails as "Invalid
+            // argument" because the transpiler rewrites the URL into mini(),
+            // so the error never names the function.
+            const browserOnly = findBrowserOnlyCall(code);
+            const clarified = browserOnly !== null
+                ? (explainBrowserOnly(browserOnly) ?? error.message)
+                : clarifyEngineError(error.message);
+            if (clarified !== error.message) {
+                errors.push(clarified);
+            }
+            else if (error instanceof PatternSafetyError) {
+                // Rejected before execution — report it as such rather than as a
+                // runtime error, so callers can tell "unsafe" from "buggy" (#229).
+                errors.push(`Pattern rejected: ${error.message}`);
+            }
+            else {
+                errors.push(`Runtime error: ${error.message}`);
+                suggestions.push(...getSuggestionsForError(error.message));
+            }
         }
         checkCommonIssues(code, warnings, suggestions);
         return {
@@ -167,15 +274,84 @@ export class StrudelEngine {
             throw new Error(`Transpilation failed: ${transpileResult.error}`);
         }
         try {
-            const fn = new Function(...Object.keys(this.context), transpileResult.transpiledCode);
-            const pattern = fn(...Object.values(this.context));
+            const pattern = this.evaluatePattern(code, transpileResult.transpiledCode);
             if (!pattern || typeof pattern.queryArc !== 'function') {
                 throw new Error('Code did not produce a valid pattern');
             }
+            // Probe before materializing.
+            //
+            // queryArc builds the whole array, so a cap applied to its result
+            // is applied after the memory is already gone: `s('bd').fast(1e5)`
+            // over one cycle is 100,000 events and 153 MB from a 20-character
+            // pattern, and a slightly larger multiplier ends in V8
+            // FatalProcessOutOfMemory — which no try/catch can intercept, so
+            // the server dies and takes every open browser session with it
+            // (#307). The cycle range was capped at 16; events per cycle were
+            // not capped at all.
+            //
+            // The single leading window this used to sample had two holes,
+            // both measured: it died on patterns dense enough that 1e-4 of the
+            // range was itself too big, and it saw nothing at all when the
+            // pattern opened with a rest. See EventDensityProbe (#360).
+            const span = end - start;
+            const verdict = probeEventDensity((begin, until) => pattern.queryArc(begin, until), start, end, { maxEvents: MAX_QUERY_EVENTS });
+            if (verdict.kind === 'refuse') {
+                throw new ValidationError(`Pattern produces roughly ${String(verdict.projected)} events over ` +
+                    `${String(span)} cycle(s), above the ${String(MAX_QUERY_EVENTS)} cap. ` +
+                    'Narrow the range, or reduce the pattern density (a large .fast() ' +
+                    'multiplier is the usual cause).');
+            }
             const haps = pattern.queryArc(start, end);
+            // The probe found events; the full query found none. That is not a
+            // silent pattern, it is a query that failed and said nothing —
+            // Strudel answers a large enough `.fast()` with an internal
+            // "Maximum call stack size exceeded" and an EMPTY array, and
+            // reporting that as a successful zero-event result tells an agent
+            // its working pattern produces nothing (the #276 mistake again).
+            // A stricter bar than "saw anything": a pattern whose sub-arc
+            // behaviour genuinely differs from its full-arc behaviour (a mask
+            // or a span-conditional transform) could show a stray onset in a
+            // probe and legitimately none over the whole range. Requiring a
+            // real sample keeps that from being reported as a crash.
+            if (verdict.observedOnsets >= 32 && verdict.windowsWithOnsets >= 2 && haps.length === 0) {
+                throw new TransientError('The pattern produced no events, but sampling it found some — the query ' +
+                    'failed inside Strudel rather than returning an empty result. A very large ' +
+                    '.fast() or `*` multiplier is the usual cause; reduce it.');
+            }
+            // Belt and braces: the projection is an extrapolation from a
+            // sample, so a pattern whose density is wildly uneven could still
+            // land above the cap. Truncating beats returning 40 MB of JSON.
+            if (haps.length > MAX_QUERY_EVENTS) {
+                throw new ValidationError(`Pattern produced ${String(haps.length)} events, above the ` +
+                    `${String(MAX_QUERY_EVENTS)} cap. Narrow the range.`);
+            }
             return haps.map((hap) => this.hapToEvent(hap));
         }
         catch (error) {
+            // Same clarification validate() applies. Without it, queryEvents and
+            // compile still emit "references unknown identifier 'setcpm'" — the
+            // exact "reads as a typo" wording #232 was filed to remove — and
+            // flatten a pre-execution PatternSafetyError into an execution
+            // failure, which it is not.
+            const browserOnly = findBrowserOnlyCall(code);
+            if (browserOnly !== null) {
+                // The caller used a function the local engine cannot run. That
+                // is their pattern to change — the message even says which tool
+                // to use instead — and it was landing in `internal`, which tells
+                // an agent the server is broken and not to retry (#382).
+                throw new ValidationError(explainBrowserOnly(browserOnly) ?? error.message);
+            }
+            // Already categorised: the density caps above throw
+            // ValidationError, and flattening them here into a generic
+            // "Pattern execution failed" was the third time in one day that a
+            // verdict was destroyed one frame above the code that reads it.
+            if (error instanceof ValidationError || error instanceof TransientError)
+                throw error;
+            if (error instanceof PatternSafetyError) {
+                // The caller's pattern was refused before it ran. That is their
+                // input to change, not an internal failure.
+                throw new ValidationError(`Pattern rejected: ${error.message}`);
+            }
             throw new Error(`Pattern execution failed: ${error.message}`);
         }
     }
@@ -192,14 +368,37 @@ export class StrudelEngine {
             throw new Error(`Transpilation failed: ${transpileResult.error}`);
         }
         try {
-            const fn = new Function(...Object.keys(this.context), transpileResult.transpiledCode);
-            const pattern = fn(...Object.values(this.context));
+            const pattern = this.evaluatePattern(code, transpileResult.transpiledCode);
             if (!pattern || typeof pattern.queryArc !== 'function') {
                 throw new Error('Code did not produce a valid pattern');
             }
             return pattern;
         }
         catch (error) {
+            // Same clarification validate() applies. Without it, queryEvents and
+            // compile still emit "references unknown identifier 'setcpm'" — the
+            // exact "reads as a typo" wording #232 was filed to remove — and
+            // flatten a pre-execution PatternSafetyError into an execution
+            // failure, which it is not.
+            const browserOnly = findBrowserOnlyCall(code);
+            if (browserOnly !== null) {
+                // The caller used a function the local engine cannot run. That
+                // is their pattern to change — the message even says which tool
+                // to use instead — and it was landing in `internal`, which tells
+                // an agent the server is broken and not to retry (#382).
+                throw new ValidationError(explainBrowserOnly(browserOnly) ?? error.message);
+            }
+            // Already categorised: the density caps above throw
+            // ValidationError, and flattening them here into a generic
+            // "Pattern execution failed" was the third time in one day that a
+            // verdict was destroyed one frame above the code that reads it.
+            if (error instanceof ValidationError || error instanceof TransientError)
+                throw error;
+            if (error instanceof PatternSafetyError) {
+                // The caller's pattern was refused before it ran. That is their
+                // input to change, not an internal failure.
+                throw new ValidationError(`Pattern rejected: ${error.message}`);
+            }
             throw new Error(`Pattern execution failed: ${error.message}`);
         }
     }
@@ -225,6 +424,7 @@ export class StrudelEngine {
             isStack: /\bstack\s*\(/.test(code),
             functionsUsed: extractFunctionsUsed(code),
             complexity: 0,
+            evaluated: false,
         };
         const bpm = extractBpm(code);
         if (bpm !== undefined) {
@@ -246,14 +446,20 @@ export class StrudelEngine {
                 isStack: metadata.isStack,
                 codeLength: code.length,
             }, events.length);
+            metadata.evaluated = true;
         }
-        catch {
+        catch (error) {
+            // Complexity from the static signals only. eventsPerCycle and
+            // uniqueValues stay at their defaults, and `evaluated: false` says
+            // so — the caller can tell "I could not run this" from "this
+            // produces nothing", which sharing the value 0 made impossible.
             metadata.complexity = calculateComplexity({
                 uniqueValues: metadata.uniqueValues,
                 functionsUsed: metadata.functionsUsed,
                 isStack: metadata.isStack,
                 codeLength: code.length,
             });
+            metadata.evaluationError = clarifyEngineError(String(error?.message ?? error));
         }
         return metadata;
     }

package/dist/services/StrudelEngineHelpers.js

@@ -8,6 +8,7 @@
  *
  * @module services/StrudelEngineHelpers
  */
+import { declaredBpm } from '../utils/Tempo.js';
 /**
  * Parse an error location from the assortment of shapes the Strudel
  * stack produces:
@@ -101,14 +102,15 @@ export function checkCommonIssues(code, warnings, suggestions) {
     }
 }
 /**
- * Extract BPM from a `setcpm(<number>)` call. Returns undefined when
- * absent — Strudel's default tempo is documented elsewhere; this helper
- * stays narrow (no fallback) so callers can distinguish "not set" from
- * "set to default".
+ * Extract the BPM a pattern declares, or undefined when it declares none.
+ *
+ * Thin wrapper over the canonical parser, kept because callers import it
+ * from here. It used to carry its own regex, which #341 taught to read
+ * `setcpm(130/4)` — a lesson the two other copies of that regex never
+ * got (#397).
  */
 export function extractBpm(code) {
-    const match = code.match(/setcpm\s*\(\s*(\d+(?:\.\d+)?)\s*\)/);
-    return match ? parseFloat(match[1]) : undefined;
+    return declaredBpm(code);
 }
 /**
  * Extract unique function-call names from pattern code. Matches the
@@ -134,10 +136,24 @@ export function extractFunctionsUsed(code) {
  * with truly dense patterns reaching 1.0. Changing them shifts every
  * downstream "complexity" report — bump cautiously.
  */
+/**
+ * Code length at which the length term reaches its maximum.
+ *
+ * The term was `codeLength / 500` UNCAPPED while the other four factors
+ * were all `Math.min(..., 1)`. Any pattern past ~1700 characters
+ * therefore pinned the whole score to 1.0 regardless of what was in it,
+ * and the shipped corpus spans 388 to 7216 characters — an 18x range
+ * that scored identically. The docstring promised "typical patterns
+ * around 0.3-0.7 with truly dense patterns reaching 1.0" (#341).
+ *
+ * 2000 puts the shipped examples across a usable spread rather than
+ * bunched at either end.
+ */
+const LENGTH_SATURATION = 2000;
 export function calculateComplexity(input, eventCount) {
     if (eventCount === undefined) {
         return Math.min((input.functionsUsed.length / 10) * 0.5 +
-            (input.codeLength / 500) * 0.3 +
+            Math.min(input.codeLength / LENGTH_SATURATION, 1) * 0.3 +
             (input.isStack ? 0.2 : 0), 1);
     }
     const factors = [
@@ -145,7 +161,7 @@ export function calculateComplexity(input, eventCount) {
         Math.min(input.uniqueValues.length / 8, 1) * 0.2,
         Math.min(input.functionsUsed.length / 10, 1) * 0.3,
         input.isStack ? 0.1 : 0,
-        (input.codeLength / 500) * 0.1,
+        Math.min(input.codeLength / LENGTH_SATURATION, 1) * 0.1,
     ];
     return Math.min(factors.reduce((a, b) => a + b, 0), 1);
 }

package/dist/services/StyleRegistry.js

@@ -0,0 +1,204 @@
+/**
+ * Which styles exist, and what a caller actually gets when they ask for
+ * one that doesn't.
+ *
+ * This lives apart from PatternGenerator on purpose. It is pure data
+ * plus one lookup — the tool layer needs it to *describe* a result
+ * honestly, which is a different job from generating the result. Keeping
+ * it separate also means a test that mocks the generator still gets real
+ * style facts rather than `undefined`.
+ *
+ * Background (#279): an unknown genre silently fell back to techno while
+ * every layer above echoed the requested style back, so an agent asking
+ * for vaporwave was told it received vaporwave — in the metadata, the
+ * message, and the pattern's own header comment.
+ */
+/**
+ * Alias → canonical style.
+ *
+ * Three near-copies of this table lived inline in generateDrumPattern /
+ * generateBassline / generateCompletePattern, and they had drifted: the
+ * bassline copy was missing `atmospheric`, `flying_lotus`, `alchemist`,
+ * `daringer` and `hitboy`, so compose("flying_lotus") produced trip-hop
+ * drums over a techno bassline.
+ */
+export const STYLE_ALIASES = {
+    liquid_dnb: 'intelligent_dnb',
+    atmospheric_dnb: 'intelligent_dnb',
+    intelligent: 'intelligent_dnb',
+    liquid: 'intelligent_dnb',
+    atmospheric: 'intelligent_dnb',
+    bukem: 'intelligent_dnb',
+    triphop: 'trip_hop',
+    portishead: 'trip_hop',
+    massive_attack: 'trip_hop',
+    flying_lotus: 'trip_hop',
+    'drum and bass': 'dnb',
+    'drum-and-bass': 'dnb',
+    boombap: 'boom_bap',
+    golden_era: 'boom_bap',
+    premier: 'boom_bap',
+    alchemist: 'boom_bap',
+    daringer: 'boom_bap',
+    hitboy: 'boom_bap',
+};
+/**
+ * Styles with a drum pattern of their own. Anything else — `jazz`
+ * included, despite being documented as a style — takes techno drums.
+ */
+export const DRUM_STYLES = [
+    'techno', 'house', 'dnb', 'breakbeat', 'trap', 'jungle',
+    'ambient', 'experimental', 'intelligent_dnb', 'trip_hop', 'boom_bap',
+];
+/**
+ * Styles with a bassline of their own. A different set from
+ * `DRUM_STYLES`, which is the whole problem: `jazz` has a bassline but
+ * no drums, and `breakbeat` / `trap` / `jungle` / `experimental` have
+ * drums but no bassline. Reporting one collapsed `style` had to lie in
+ * one direction or the other (#294).
+ */
+export const BASS_STYLES = [
+    'techno', 'house', 'dnb', 'acid', 'dub', 'funk', 'jazz', 'ambient',
+    'intelligent_dnb', 'trip_hop', 'boom_bap',
+];
+/**
+ * Resolves a caller's style to one that actually has drums.
+ *
+ * @param style - Style or alias the caller asked for
+ * @returns The request, what will really be used, and whether they match
+ * @example
+ * resolveDrumStyle('bukem');     // → intelligent_dnb, supported
+ * resolveDrumStyle('vaporwave'); // → techno, not supported
+ */
+export function resolveDrumStyle(style) {
+    const lower = String(style ?? '').toLowerCase();
+    // hasOwn, not `?? lower`: STYLE_ALIASES is a plain object literal, so
+    // STYLE_ALIASES['constructor'] returns Object and STYLE_ALIASES['__proto__']
+    // returns the prototype — neither is nullish, so `??` never fires (#295).
+    const resolved = Object.hasOwn(STYLE_ALIASES, lower) ? STYLE_ALIASES[lower] : lower;
+    const supported = DRUM_STYLES.includes(resolved);
+    return { requested: style, resolved: supported ? resolved : 'techno', supported };
+}
+/**
+ * Resolves a caller's style for the bassline layer.
+ *
+ * @param style - Style or alias the caller asked for
+ * @returns The request, the bassline that will really play, and whether they match
+ */
+export function resolveBassStyle(style) {
+    const lower = String(style ?? '').toLowerCase();
+    const resolved = Object.hasOwn(STYLE_ALIASES, lower) ? STYLE_ALIASES[lower] : lower;
+    const supported = BASS_STYLES.includes(resolved);
+    return { requested: style, resolved: supported ? resolved : 'techno', supported };
+}
+/**
+ * Describes what a requested style really produces, layer by layer.
+ *
+ * `compose` assembles a pattern from four independently-resolved
+ * layers, each falling back on its own. One `style` field cannot
+ * describe that: reporting the drum resolution called
+ * compose({style:'jazz'}) "techno" even though the bassline, Dorian
+ * scale and jazz chord progression are all genuinely jazz, while
+ * `breakbeat` reported itself supported with a techno bassline
+ * underneath (#294).
+ *
+ * @param style - Style or alias the caller asked for
+ * @returns What each layer will actually use, and which ones were substituted
+ * @example
+ * resolveLayers('jazz');
+ * // layers: { drums: 'techno', bass: 'jazz', chords: 'jazz', scale: 'dorian' }
+ * // substituted: ['drums']
+ */
+export function resolveLayers(style) {
+    const drums = resolveDrumStyle(style);
+    const bass = resolveBassStyle(style);
+    const canonical = drums.supported ? drums.resolved : bass.resolved;
+    // Mirrors PatternGenerator.generateCompletePattern: chord family and
+    // scale are derived from the resolved style, not looked up, so they
+    // never "fall back" — but the caller still wants to know what they are.
+    const lower = String(style ?? '').toLowerCase();
+    const resolved = Object.hasOwn(STYLE_ALIASES, lower) ? STYLE_ALIASES[lower] : lower;
+    const chords = resolved === 'jazz' ? 'jazz' : resolved === 'house' ? 'pop'
+        : resolved === 'techno' ? 'edm' : 'pop';
+    const scale = resolved === 'jazz' ? 'dorian' : 'minor';
+    const substituted = [];
+    if (!drums.supported)
+        substituted.push('drums');
+    if (!bass.supported)
+        substituted.push('bass');
+    void canonical;
+    return {
+        requested: style,
+        layers: { drums: drums.resolved, bass: bass.resolved, chords, scale },
+        substituted,
+    };
+}
+/**
+ * Default BPM per canonical style.
+ *
+ * This lived in compose.ts and disagreed with the style tables in both
+ * directions (#296). It had no entry for `intelligent_dnb`, `trip_hop`
+ * or `boom_bap`, so those three fell to 120 — and because compose
+ * passes that 120 down, the generator's own `bpm || 170` fallback was
+ * never reached: compose({style:'bukem'}) produced
+ * "// Intelligent DnB in C at 120 BPM". Meanwhile it carried
+ * 'drum and bass' at 174, a style STYLE_ALIASES had never heard of, so
+ * that request became 174-BPM techno.
+ *
+ * Lookup happens after alias resolution now, so `bukem` gets
+ * intelligent_dnb's tempo. A test asserts every key here is a style the
+ * registry actually knows.
+ */
+export const TEMPO_BY_STYLE = {
+    techno: 130,
+    house: 125,
+    dnb: 174,
+    ambient: 80,
+    trap: 140,
+    jungle: 160,
+    jazz: 110,
+    experimental: 120,
+    breakbeat: 130,
+    // The three specialized genres, which had no entry at all.
+    intelligent_dnb: 170,
+    trip_hop: 90,
+    boom_bap: 92,
+    // Styles with a bassline but no drums of their own.
+    acid: 130,
+    dub: 140,
+    funk: 110,
+    // Tempo-only: see TEMPO_ONLY_STYLES.
+    dubstep: 140,
+    trance: 138,
+    garage: 130,
+    electro: 128,
+    downtempo: 90,
+    idm: 115,
+};
+/**
+ * Styles that have a sensible tempo but no drums or bassline of their
+ * own. A caller asking for one gets that tempo with techno material,
+ * and `resolveLayers` reports both layers as substituted — so the
+ * result is honest, and these are listed rather than left to look like
+ * an oversight.
+ *
+ * Anything here is a candidate for real content; adding it to
+ * DRUM_STYLES or BASS_STYLES without the content will fail the registry
+ * accuracy test in PerLayerStyleReporting.
+ */
+export const TEMPO_ONLY_STYLES = [
+    'dubstep', 'trance', 'garage', 'electro', 'downtempo', 'idm',
+];
+/** Default BPM for a style, resolving aliases first. */
+export function defaultTempoFor(style) {
+    const lower = String(style ?? '').toLowerCase();
+    const resolved = Object.hasOwn(STYLE_ALIASES, lower) ? STYLE_ALIASES[lower] : lower;
+    // hasOwn throughout, for the reason in #295: TEMPO_BY_STYLE is a plain
+    // object literal, so TEMPO_BY_STYLE['__proto__'] returns the prototype
+    // and `?? 120` never fires.
+    if (Object.hasOwn(TEMPO_BY_STYLE, resolved))
+        return TEMPO_BY_STYLE[resolved];
+    if (Object.hasOwn(TEMPO_BY_STYLE, lower))
+        return TEMPO_BY_STYLE[lower];
+    return 120;
+}