@yadsh/dsh-qa-surface 0.6.0 → 0.7.0

package/lib/documents/runtime.js

@@ -1,114 +0,0 @@
-/**
- * The runtime facade the tools talk to.
- *
- * One instance lives in the plugin and survives across calls, so the backend
- * registry, the concurrency semaphores and the version caches are shared
- * instead of rebuilt per request. The four operations are the whole surface:
- * everything else in this subsystem is an implementation detail behind them.
- */
-import { ArtifactStore } from "./artifacts/store.js";
-import { applyDocumentsEnvOverrides, resolveDocumentsConfig, } from "./config.js";
-import { documentCapabilities, documentHealth, } from "./capabilities.js";
-import { DocumentError } from "./errors.js";
-import { createProviders, } from "./providers/registry.js";
-import { convertDocument } from "./orchestrator/convert-document.js";
-import { createDocument } from "./orchestrator/create-document.js";
-import { inspectDocument } from "./orchestrator/inspect-document.js";
-import { toMarkdown } from "./orchestrator/extract-document.js";
-import { createRuntimeDeps, silentDocumentLogger, } from "./orchestrator/runtime-deps.js";
-import { loadScopeTemplates, resolveDocumentScope, } from "./orchestrator/scope.js";
-import { loadTemplateRegistry } from "./templates/registry.js";
-import { CONVERSION_ROUTES } from "./orchestrator/convert-document.js";
-export class DocumentRuntime {
-    config;
-    providers;
-    deps;
-    seams;
-    constructor(options) {
-        this.config = options.config;
-        this.seams = options.seams ?? {};
-        this.providers =
-            options.providers ?? createProviders(this.config, this.seams);
-        this.deps = createRuntimeDeps({
-            config: this.config,
-            providers: this.providers,
-            logger: options.logger ?? silentDocumentLogger,
-            ...(options.now === undefined ? {} : { now: options.now }),
-        });
-    }
-    async create(input, scope) {
-        return await createDocument(this.deps, input, scope);
-    }
-    async toMarkdown(input, scope) {
-        return await toMarkdown(this.deps, input, scope);
-    }
-    async convert(input, scope) {
-        return await convertDocument(this.deps, input, scope);
-    }
-    async inspect(input, scope) {
-        return await inspectDocument(this.deps, input, scope);
-    }
-    async health(options = {}) {
-        const healthOptions = {
-            config: this.config,
-            providers: this.providers,
-            ...(options.probeProcessBackends === undefined
-                ? {}
-                : { probeProcessBackends: options.probeProcessBackends }),
-        };
-        return await documentHealth(healthOptions);
-    }
-    async capabilities(scope) {
-        const templates = scope === undefined
-            ? await loadTemplateRegistry(undefined)
-            : await loadScopeTemplates(this.config, scope.workspaceRoot);
-        return documentCapabilities({
-            config: this.config,
-            providers: this.providers,
-            templates,
-        });
-    }
-    /** Routes this runtime advertises, in documentation order. */
-    routes() {
-        return CONVERSION_ROUTES;
-    }
-    /**
-     * Retention sweep (§41). Meaningful only for a pinned storage root: with the
-     * default per-workspace layout the plugin cannot enumerate workspaces, and a
-     * sweep that guessed would delete other projects' artifacts.
-     */
-    async cleanup(options = {}) {
-        if (!this.config.retention.enabled || this.config.storage.root === null)
-            return undefined;
-        const store = new ArtifactStore({ root: this.config.storage.root });
-        const removed = await store.cleanup({
-            maxAgeDays: this.config.retention.maxAgeDays,
-            ...(options.now === undefined ? {} : { now: options.now }),
-        });
-        if (removed.removed.length > 0) {
-            this.deps.logger.info("documents.retention", {
-                removed: removed.removed.length,
-            });
-        }
-        return removed;
-    }
-}
-/** Build a runtime from raw (schema-parsed) configuration. */
-export function createDocumentRuntime(options) {
-    const withEnv = applyDocumentsEnvOverrides(options.config, options.env ?? process.env);
-    const resolved = resolveDocumentsConfig(withEnv);
-    if (!resolved.enabled) {
-        throw new DocumentError("BACKEND_UNAVAILABLE", "the document subsystem is disabled in this deployment");
-    }
-    return new DocumentRuntime({
-        config: resolved,
-        ...(options.logger === undefined ? {} : { logger: options.logger }),
-        ...(options.seams === undefined ? {} : { seams: options.seams }),
-        ...(options.providers === undefined
-            ? {}
-            : { providers: options.providers }),
-        ...(options.now === undefined ? {} : { now: options.now }),
-    });
-}
-export { resolveDocumentScope };
-//# sourceMappingURL=runtime.js.map

package/lib/documents/runtime.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"runtime.js","sourceRoot":"","sources":["../../src/documents/runtime.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAC;AACrD,OAAO,EACL,0BAA0B,EAC1B,sBAAsB,GAGvB,MAAM,aAAa,CAAC;AACrB,OAAO,EACL,oBAAoB,EACpB,cAAc,GAEf,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAC5C,OAAO,EACL,eAAe,GAGhB,MAAM,yBAAyB,CAAC;AACjC,OAAO,EAAE,eAAe,EAAE,MAAM,oCAAoC,CAAC;AACrE,OAAO,EAAE,cAAc,EAAE,MAAM,mCAAmC,CAAC;AACnE,OAAO,EAAE,eAAe,EAAE,MAAM,oCAAoC,CAAC;AACrE,OAAO,EAAE,UAAU,EAAE,MAAM,oCAAoC,CAAC;AAChE,OAAO,EACL,iBAAiB,EACjB,oBAAoB,GAGrB,MAAM,gCAAgC,CAAC;AACxC,OAAO,EACL,kBAAkB,EAClB,oBAAoB,GAErB,MAAM,yBAAyB,CAAC;AACjC,OAAO,EAAE,oBAAoB,EAAE,MAAM,yBAAyB,CAAC;AAC/D,OAAO,EAAE,iBAAiB,EAAE,MAAM,oCAAoC,CAAC;AAuBvE,MAAM,OAAO,eAAe;IACjB,MAAM,CAA4B;IAClC,SAAS,CAAc;IACf,IAAI,CAAsB;IAC1B,KAAK,CAAgB;IAEtC,YAAY,OAA+B;QACzC,IAAI,CAAC,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;QAC7B,IAAI,CAAC,KAAK,GAAG,OAAO,CAAC,KAAK,IAAI,EAAE,CAAC;QACjC,IAAI,CAAC,SAAS;YACZ,OAAO,CAAC,SAAS,IAAI,eAAe,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC;QAChE,IAAI,CAAC,IAAI,GAAG,iBAAiB,CAAC;YAC5B,MAAM,EAAE,IAAI,CAAC,MAAM;YACnB,SAAS,EAAE,IAAI,CAAC,SAAS;YACzB,MAAM,EAAE,OAAO,CAAC,MAAM,IAAI,oBAAoB;YAC9C,GAAG,CAAC,OAAO,CAAC,GAAG,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,OAAO,CAAC,GAAG,EAAE,CAAC;SAC3D,CAAC,CAAC;IACL,CAAC;IAED,KAAK,CAAC,MAAM,CACV,KAA0B,EAC1B,KAAoB;QAEpB,OAAO,MAAM,cAAc,CAAC,IAAI,CAAC,IAAI,EAAE,KAAK,EAAE,KAAK,CAAC,CAAC;IACvD,CAAC;IAED,KAAK,CAAC,UAAU,CACd,KAA8B,EAC9B,KAAoB;QAEpB,OAAO,MAAM,UAAU,CAAC,IAAI,CAAC,IAAI,EAAE,KAAK,EAAE,KAAK,CAAC,CAAC;IACnD,CAAC;IAED,KAAK,CAAC,OAAO,CACX,KAA2B,EAC3B,KAAoB;QAEpB,OAAO,MAAM,eAAe,CAAC,IAAI,CAAC,IAAI,EAAE,KAAK,EAAE,KAAK,CAAC,CAAC;IACxD,CAAC;IAED,KAAK,CAAC,OAAO,CACX,KAA2B,EAC3B,KAAoB;QAEpB,OAAO,MAAM,eAAe,CAAC,IAAI,CAAC,IAAI,EAAE,KAAK,EAAE,KAAK,CAAC,CAAC;IACxD,CAAC;IAED,KAAK,CAAC,MAAM,CACV,OAAO,GAAgD,EAAE;QAEzD,MAAM,aAAa,GAAkB;YACnC,MAAM,EAAE,IAAI,CAAC,MAAM;YACnB,SAAS,EAAE,IAAI,CAAC,SAAS;YACzB,GAAG,CAAC,OAAO,CAAC,oBAAoB,KAAK,SAAS;gBAC5C,CAAC,CAAC,EAAE;gBACJ,CAAC,CAAC,EAAE,oBAAoB,EAAE,OAAO,CAAC,oBAAoB,EAAE,CAAC;SAC5D,CAAC;QACF,OAAO,MAAM,cAAc,CAAC,aAAa,CAAC,CAAC;IAC7C,CAAC;IAED,KAAK,CAAC,YAAY,CAAC,KAAqB;QACtC,MAAM,SAAS,GACb,KAAK,KAAK,SAAS;YACjB,CAAC,CAAC,MAAM,oBAAoB,CAAC,SAAS,CAAC;YACvC,CAAC,CAAC,MAAM,kBAAkB,CAAC,IAAI,CAAC,MAAM,EAAE,KAAK,CAAC,aAAa,CAAC,CAAC;QACjE,OAAO,oBAAoB,CAAC;YAC1B,MAAM,EAAE,IAAI,CAAC,MAAM;YACnB,SAAS,EAAE,IAAI,CAAC,SAAS;YACzB,SAAS;SACV,CAAC,CAAC;IACL,CAAC;IAED,8DAA8D;IAC9D,MAAM;QACJ,OAAO,iBAAiB,CAAC;IAC3B,CAAC;IAED;;;;OAIG;IACH,KAAK,CAAC,OAAO,CACX,OAAO,GAA4B,EAAE;QAErC,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,OAAO,IAAI,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,IAAI,KAAK,IAAI;YACrE,OAAO,SAAS,CAAC;QACnB,MAAM,KAAK,GAAG,IAAI,aAAa,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC,CAAC;QACpE,MAAM,OAAO,GAAG,MAAM,KAAK,CAAC,OAAO,CAAC;YAClC,UAAU,EAAE,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,UAAU;YAC5C,GAAG,CAAC,OAAO,CAAC,GAAG,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,OAAO,CAAC,GAAG,EAAE,CAAC;SAC3D,CAAC,CAAC;QACH,IAAI,OAAO,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC/B,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,qBAAqB,EAAE;gBAC3C,OAAO,EAAE,OAAO,CAAC,OAAO,CAAC,MAAM;aAChC,CAAC,CAAC;QACL,CAAC;QACD,OAAO,OAAO,CAAC;IACjB,CAAC;CACF;AAED,8DAA8D;AAC9D,MAAM,UAAU,qBAAqB,CAAC,OAOrC;IACC,MAAM,OAAO,GAAG,0BAA0B,CACxC,OAAO,CAAC,MAAM,EACd,OAAO,CAAC,GAAG,IAAI,OAAO,CAAC,GAAG,CAC3B,CAAC;IACF,MAAM,QAAQ,GAAG,sBAAsB,CAAC,OAAO,CAAC,CAAC;IACjD,IAAI,CAAC,QAAQ,CAAC,OAAO,EAAE,CAAC;QACtB,MAAM,IAAI,aAAa,CACrB,qBAAqB,EACrB,uDAAuD,CACxD,CAAC;IACJ,CAAC;IACD,OAAO,IAAI,eAAe,CAAC;QACzB,MAAM,EAAE,QAAQ;QAChB,GAAG,CAAC,OAAO,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,CAAC;QACnE,GAAG,CAAC,OAAO,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE,CAAC;QAChE,GAAG,CAAC,OAAO,CAAC,SAAS,KAAK,SAAS;YACjC,CAAC,CAAC,EAAE;YACJ,CAAC,CAAC,EAAE,SAAS,EAAE,OAAO,CAAC,SAAS,EAAE,CAAC;QACrC,GAAG,CAAC,OAAO,CAAC,GAAG,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,OAAO,CAAC,GAAG,EAAE,CAAC;KAC3D,CAAC,CAAC;AACL,CAAC;AAED,OAAO,EAAE,oBAAoB,EAAE,CAAC"}

package/lib/documents/security/file-types.js

@@ -1,188 +0,0 @@
-/**
- * File-type identification and asset MIME policy (§26.3, §26.6, §17.1).
- *
- * The extension is a hint, never the authority: PDF is recognized by its
- * header (after a bounded scan, because a PDF may carry leading junk), OOXML
- * by its ZIP container plus the parts it holds, and macro-enabled documents by
- * the presence of a VBA project. Legacy OLE documents (`.doc`, `.xls`, `.ppt`)
- * are recognized only to be refused with a precise message.
- */
-import path from "node:path";
-import { findZipEntry, readZipEntries, readZipEntry } from "../inspect/zip.js";
-import { sanitizeBackendOutput } from "../errors.js";
-const PDF_HEADER = Buffer.from("%PDF-", "latin1");
-const ZIP_LOCAL_HEADER = Buffer.from([0x50, 0x4b, 0x03, 0x04]);
-const ZIP_EMPTY_HEADER = Buffer.from([0x50, 0x4b, 0x05, 0x06]);
-const CFB_HEADER = Buffer.from([
-    0xd0, 0xcf, 0x11, 0xe0, 0xa1, 0xb1, 0x1a, 0xe1,
-]);
-/** A PDF header may be preceded by junk; the spec fixes no bound, we use 4 KiB. */
-const PDF_HEADER_SCAN_BYTES = 4 * 1024;
-/** Bounded text sniffing window for Markdown/plain-text inputs. */
-const TEXT_SNIFF_BYTES = 4 * 1024;
-export const DOCUMENT_MEDIA_TYPES = {
-    md: "text/markdown",
-    docx: "application/vnd.openxmlformats-officedocument.wordprocessingml.document",
-    pdf: "application/pdf",
-};
-export function mediaTypeFor(format) {
-    return DOCUMENT_MEDIA_TYPES[format];
-}
-export function extensionFor(format) {
-    return format === "md" ? "md" : format;
-}
-const DOCX_PART = /^word\/(?:document|styles|settings)\.xml$/iu;
-const MACRO_PART = /^word\/vbaProject\.bin$/iu;
-const CONTENT_TYPES_PART = "[Content_Types].xml";
-const MACRO_CONTENT_TYPE = /macroEnabled/iu;
-function sniffZip(buffer) {
-    const entries = readZipEntries(buffer);
-    if (entries === undefined) {
-        return { format: "unknown", mediaType: "application/octet-stream" };
-    }
-    const word = entries.some((entry) => DOCX_PART.test(entry.name));
-    const macroPart = entries.some((entry) => MACRO_PART.test(entry.name));
-    const contentTypes = findZipEntry(entries, CONTENT_TYPES_PART);
-    let macroContentType = false;
-    if (contentTypes !== undefined && !macroPart) {
-        const payload = readZipEntry(buffer, contentTypes);
-        if (payload !== undefined) {
-            macroContentType = MACRO_CONTENT_TYPE.test(payload.toString("utf8", 0, Math.min(payload.length, 8 * 1024)));
-        }
-    }
-    if (!word && !macroPart && !macroContentType) {
-        return {
-            format: "unknown",
-            mediaType: "application/zip",
-            unsupportedOffice: true,
-        };
-    }
-    const macroEnabled = macroPart || macroContentType;
-    return {
-        format: macroEnabled ? "docm" : "docx",
-        mediaType: macroEnabled
-            ? "application/vnd.ms-word.document.macroEnabled.12"
-            : DOCUMENT_MEDIA_TYPES.docx,
-        wordprocessing: true,
-        macroEnabled,
-    };
-}
-/** Detect binary content without trusting the extension. */
-function looksLikeText(buffer) {
-    const window = buffer.subarray(0, TEXT_SNIFF_BYTES);
-    for (const byte of window) {
-        if (byte === 0)
-            return false;
-    }
-    return true;
-}
-const MARKDOWN_EXTENSIONS = new Set([
-    ".md",
-    ".markdown",
-    ".mdown",
-    ".mkd",
-    ".txt",
-]);
-export function detectFormatByExtension(filename) {
-    const extension = path.extname(filename).toLowerCase();
-    if (extension === ".pdf")
-        return "pdf";
-    if (extension === ".docx" || extension === ".docm")
-        return "docx";
-    if (MARKDOWN_EXTENSIONS.has(extension))
-        return "md";
-    return undefined;
-}
-/**
- * Identify a document from its bytes, falling back to the extension only where
- * bytes are inconclusive (plain text and Markdown are both just text).
- */
-export function sniffDocument(buffer, filename) {
-    const head = buffer.subarray(0, Math.max(PDF_HEADER_SCAN_BYTES, ZIP_LOCAL_HEADER.length));
-    if (head.includes(PDF_HEADER)) {
-        return { format: "pdf", mediaType: DOCUMENT_MEDIA_TYPES.pdf };
-    }
-    if (head.subarray(0, ZIP_LOCAL_HEADER.length).equals(ZIP_LOCAL_HEADER) ||
-        head.subarray(0, ZIP_EMPTY_HEADER.length).equals(ZIP_EMPTY_HEADER)) {
-        return sniffZip(buffer);
-    }
-    if (head.subarray(0, CFB_HEADER.length).equals(CFB_HEADER)) {
-        return { format: "unknown", mediaType: "application/x-ole-storage" };
-    }
-    const byExtension = filename === undefined ? undefined : detectFormatByExtension(filename);
-    if (byExtension === "md" && looksLikeText(buffer)) {
-        return { format: "markdown", mediaType: DOCUMENT_MEDIA_TYPES.md };
-    }
-    if (byExtension === "pdf" || byExtension === "docx") {
-        // The bytes contradict the name; the bytes win.
-        return { format: "unknown", mediaType: "application/octet-stream" };
-    }
-    if (looksLikeText(buffer)) {
-        return { format: "markdown", mediaType: DOCUMENT_MEDIA_TYPES.md };
-    }
-    return { format: "unknown", mediaType: "application/octet-stream" };
-}
-/** The supported source format behind a sniff result, or `undefined`. */
-export function supportedFormatOf(sniffed) {
-    if (sniffed.format === "pdf")
-        return "pdf";
-    if (sniffed.format === "docx")
-        return "docx";
-    if (sniffed.format === "markdown")
-        return "md";
-    return undefined;
-}
-/** Human-facing explanation of a sniff result the pipeline refuses. */
-export function describeUnsupported(sniffed, filename) {
-    if (sniffed.format === "docm") {
-        return `"${path.basename(filename)}" is a macro-enabled document; macro-enabled documents are not processed`;
-    }
-    if (sniffed.unsupportedOffice) {
-        return `"${path.basename(filename)}" is an OOXML package this pipeline does not support (supported: DOCX, PDF, Markdown)`;
-    }
-    if (sniffed.mediaType === "application/x-ole-storage") {
-        return `"${path.basename(filename)}" is a legacy OLE Office document (supported: DOCX, PDF, Markdown)`;
-    }
-    return `"${path.basename(filename)}" is not a supported document (supported: DOCX, PDF, Markdown)`;
-}
-export { DEFAULT_ASSET_MIME_TYPES, isAllowedAssetMimeType, mimeTypeForFilename, } from "./mime.js";
-/** Magic-byte MIME detection for the asset types the pipeline accepts. */
-export function mimeTypeOfBytes(buffer) {
-    if (buffer.length >= 8 &&
-        buffer
-            .subarray(0, 8)
-            .equals(Buffer.from([0x89, 0x50, 0x4e, 0x47, 0x0d, 0x0a, 0x1a, 0x0a]))) {
-        return "image/png";
-    }
-    if (buffer.length >= 3 &&
-        buffer[0] === 0xff &&
-        buffer[1] === 0xd8 &&
-        buffer[2] === 0xff) {
-        return "image/jpeg";
-    }
-    if (buffer.length >= 6 &&
-        buffer.toString("latin1", 0, 6).startsWith("GIF8")) {
-        return "image/gif";
-    }
-    if (buffer.length >= 12 &&
-        buffer.toString("latin1", 0, 4) === "RIFF" &&
-        buffer.toString("latin1", 8, 12) === "WEBP") {
-        return "image/webp";
-    }
-    if (buffer.length >= 2 && buffer.toString("latin1", 0, 2) === "BM") {
-        return "image/bmp";
-    }
-    if (buffer.length >= 4) {
-        const little = buffer.toString("latin1", 0, 4);
-        if (little === "II*\u0000" || little === "MM\u0000*")
-            return "image/tiff";
-    }
-    return undefined;
-}
-/** A short, sanitized description of the first bytes, for error messages. */
-export function describeBytes(buffer) {
-    return sanitizeBackendOutput([...buffer.subarray(0, 16)]
-        .map((byte) => byte.toString(16).padStart(2, "0"))
-        .join(" "), 120);
-}
-//# sourceMappingURL=file-types.js.map

package/lib/documents/security/file-types.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"file-types.js","sourceRoot":"","sources":["../../../src/documents/security/file-types.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,IAAI,MAAM,WAAW,CAAC;AAG7B,OAAO,EAAE,YAAY,EAAE,cAAc,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAC;AAC/E,OAAO,EAAE,qBAAqB,EAAE,MAAM,cAAc,CAAC;AAErD,MAAM,UAAU,GAAG,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC;AAClD,MAAM,gBAAgB,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC,CAAC;AAC/D,MAAM,gBAAgB,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC,CAAC;AAC/D,MAAM,UAAU,GAAG,MAAM,CAAC,IAAI,CAAC;IAC7B,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI;CAC/C,CAAC,CAAC;AACH,mFAAmF;AACnF,MAAM,qBAAqB,GAAG,CAAC,GAAG,IAAI,CAAC;AACvC,mEAAmE;AACnE,MAAM,gBAAgB,GAAG,CAAC,GAAG,IAAI,CAAC;AAElC,MAAM,CAAC,MAAM,oBAAoB,GAA6C;IAC5E,EAAE,EAAE,eAAe;IACnB,IAAI,EAAE,yEAAyE;IAC/E,GAAG,EAAE,iBAAiB;CACvB,CAAC;AAEF,MAAM,UAAU,YAAY,CAAC,MAAsB;IACjD,OAAO,oBAAoB,CAAC,MAAM,CAAC,CAAC;AACtC,CAAC;AAED,MAAM,UAAU,YAAY,CAAC,MAAsB;IACjD,OAAO,MAAM,KAAK,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC;AACzC,CAAC;AAaD,MAAM,SAAS,GAAG,6CAA6C,CAAC;AAChE,MAAM,UAAU,GAAG,2BAA2B,CAAC;AAC/C,MAAM,kBAAkB,GAAG,qBAAqB,CAAC;AACjD,MAAM,kBAAkB,GAAG,gBAAgB,CAAC;AAE5C,SAAS,QAAQ,CAAC,MAAc;IAC9B,MAAM,OAAO,GAAG,cAAc,CAAC,MAAM,CAAC,CAAC;IACvC,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;QAC1B,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,SAAS,EAAE,0BAA0B,EAAE,CAAC;IACtE,CAAC;IACD,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,SAAS,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC;IACjE,MAAM,SAAS,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC;IACvE,MAAM,YAAY,GAAG,YAAY,CAAC,OAAO,EAAE,kBAAkB,CAAC,CAAC;IAC/D,IAAI,gBAAgB,GAAG,KAAK,CAAC;IAC7B,IAAI,YAAY,KAAK,SAAS,IAAI,CAAC,SAAS,EAAE,CAAC;QAC7C,MAAM,OAAO,GAAG,YAAY,CAAC,MAAM,EAAE,YAAY,CAAC,CAAC;QACnD,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;YAC1B,gBAAgB,GAAG,kBAAkB,CAAC,IAAI,CACxC,OAAO,CAAC,QAAQ,CAAC,MAAM,EAAE,CAAC,EAAE,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,MAAM,EAAE,CAAC,GAAG,IAAI,CAAC,CAAC,CAChE,CAAC;QACJ,CAAC;IACH,CAAC;IACD,IAAI,CAAC,IAAI,IAAI,CAAC,SAAS,IAAI,CAAC,gBAAgB,EAAE,CAAC;QAC7C,OAAO;YACL,MAAM,EAAE,SAAS;YACjB,SAAS,EAAE,iBAAiB;YAC5B,iBAAiB,EAAE,IAAI;SACxB,CAAC;IACJ,CAAC;IACD,MAAM,YAAY,GAAG,SAAS,IAAI,gBAAgB,CAAC;IACnD,OAAO;QACL,MAAM,EAAE,YAAY,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM;QACtC,SAAS,EAAE,YAAY;YACrB,CAAC,CAAC,kDAAkD;YACpD,CAAC,CAAC,oBAAoB,CAAC,IAAI;QAC7B,cAAc,EAAE,IAAI;QACpB,YAAY;KACb,CAAC;AACJ,CAAC;AAED,4DAA4D;AAC5D,SAAS,aAAa,CAAC,MAAc;IACnC,MAAM,MAAM,GAAG,MAAM,CAAC,QAAQ,CAAC,CAAC,EAAE,gBAAgB,CAAC,CAAC;IACpD,KAAK,MAAM,IAAI,IAAI,MAAM,EAAE,CAAC;QAC1B,IAAI,IAAI,KAAK,CAAC;YAAE,OAAO,KAAK,CAAC;IAC/B,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,MAAM,mBAAmB,GAAG,IAAI,GAAG,CAAC;IAClC,KAAK;IACL,WAAW;IACX,QAAQ;IACR,MAAM;IACN,MAAM;CACP,CAAC,CAAC;AAEH,MAAM,UAAU,uBAAuB,CACrC,QAAgB;IAEhB,MAAM,SAAS,GAAG,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,WAAW,EAAE,CAAC;IACvD,IAAI,SAAS,KAAK,MAAM;QAAE,OAAO,KAAK,CAAC;IACvC,IAAI,SAAS,KAAK,OAAO,IAAI,SAAS,KAAK,OAAO;QAAE,OAAO,MAAM,CAAC;IAClE,IAAI,mBAAmB,CAAC,GAAG,CAAC,SAAS,CAAC;QAAE,OAAO,IAAI,CAAC;IACpD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,aAAa,CAC3B,MAAc,EACd,QAAiB;IAEjB,MAAM,IAAI,GAAG,MAAM,CAAC,QAAQ,CAC1B,CAAC,EACD,IAAI,CAAC,GAAG,CAAC,qBAAqB,EAAE,gBAAgB,CAAC,MAAM,CAAC,CACzD,CAAC;IACF,IAAI,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC,EAAE,CAAC;QAC9B,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,SAAS,EAAE,oBAAoB,CAAC,GAAG,EAAE,CAAC;IAChE,CAAC;IACD,IACE,IAAI,CAAC,QAAQ,CAAC,CAAC,EAAE,gBAAgB,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,gBAAgB,CAAC;QAClE,IAAI,CAAC,QAAQ,CAAC,CAAC,EAAE,gBAAgB,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,gBAAgB,CAAC,EAClE,CAAC;QACD,OAAO,QAAQ,CAAC,MAAM,CAAC,CAAC;IAC1B,CAAC;IACD,IAAI,IAAI,CAAC,QAAQ,CAAC,CAAC,EAAE,UAAU,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,UAAU,CAAC,EAAE,CAAC;QAC3D,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,SAAS,EAAE,2BAA2B,EAAE,CAAC;IACvE,CAAC;IACD,MAAM,WAAW,GACf,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,uBAAuB,CAAC,QAAQ,CAAC,CAAC;IACzE,IAAI,WAAW,KAAK,IAAI,IAAI,aAAa,CAAC,MAAM,CAAC,EAAE,CAAC;QAClD,OAAO,EAAE,MAAM,EAAE,UAAU,EAAE,SAAS,EAAE,oBAAoB,CAAC,EAAE,EAAE,CAAC;IACpE,CAAC;IACD,IAAI,WAAW,KAAK,KAAK,IAAI,WAAW,KAAK,MAAM,EAAE,CAAC;QACpD,gDAAgD;QAChD,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,SAAS,EAAE,0BAA0B,EAAE,CAAC;IACtE,CAAC;IACD,IAAI,aAAa,CAAC,MAAM,CAAC,EAAE,CAAC;QAC1B,OAAO,EAAE,MAAM,EAAE,UAAU,EAAE,SAAS,EAAE,oBAAoB,CAAC,EAAE,EAAE,CAAC;IACpE,CAAC;IACD,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,SAAS,EAAE,0BAA0B,EAAE,CAAC;AACtE,CAAC;AAED,yEAAyE;AACzE,MAAM,UAAU,iBAAiB,CAC/B,OAAwB;IAExB,IAAI,OAAO,CAAC,MAAM,KAAK,KAAK;QAAE,OAAO,KAAK,CAAC;IAC3C,IAAI,OAAO,CAAC,MAAM,KAAK,MAAM;QAAE,OAAO,MAAM,CAAC;IAC7C,IAAI,OAAO,CAAC,MAAM,KAAK,UAAU;QAAE,OAAO,IAAI,CAAC;IAC/C,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,uEAAuE;AACvE,MAAM,UAAU,mBAAmB,CACjC,OAAwB,EACxB,QAAgB;IAEhB,IAAI,OAAO,CAAC,MAAM,KAAK,MAAM,EAAE,CAAC;QAC9B,OAAO,IAAI,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,0EAA0E,CAAC;IAC/G,CAAC;IACD,IAAI,OAAO,CAAC,iBAAiB,EAAE,CAAC;QAC9B,OAAO,IAAI,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,uFAAuF,CAAC;IAC5H,CAAC;IACD,IAAI,OAAO,CAAC,SAAS,KAAK,2BAA2B,EAAE,CAAC;QACtD,OAAO,IAAI,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,oEAAoE,CAAC;IACzG,CAAC;IACD,OAAO,IAAI,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,gEAAgE,CAAC;AACrG,CAAC;AAED,OAAO,EACL,wBAAwB,EACxB,sBAAsB,EACtB,mBAAmB,GACpB,MAAM,WAAW,CAAC;AAEnB,0EAA0E;AAC1E,MAAM,UAAU,eAAe,CAAC,MAAc;IAC5C,IACE,MAAM,CAAC,MAAM,IAAI,CAAC;QAClB,MAAM;aACH,QAAQ,CAAC,CAAC,EAAE,CAAC,CAAC;aACd,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC,CAAC,EACxE,CAAC;QACD,OAAO,WAAW,CAAC;IACrB,CAAC;IACD,IACE,MAAM,CAAC,MAAM,IAAI,CAAC;QAClB,MAAM,CAAC,CAAC,CAAC,KAAK,IAAI;QAClB,MAAM,CAAC,CAAC,CAAC,KAAK,IAAI;QAClB,MAAM,CAAC,CAAC,CAAC,KAAK,IAAI,EAClB,CAAC;QACD,OAAO,YAAY,CAAC;IACtB,CAAC;IACD,IACE,MAAM,CAAC,MAAM,IAAI,CAAC;QAClB,MAAM,CAAC,QAAQ,CAAC,QAAQ,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC,MAAM,CAAC,EAClD,CAAC;QACD,OAAO,WAAW,CAAC;IACrB,CAAC;IACD,IACE,MAAM,CAAC,MAAM,IAAI,EAAE;QACnB,MAAM,CAAC,QAAQ,CAAC,QAAQ,EAAE,CAAC,EAAE,CAAC,CAAC,KAAK,MAAM;QAC1C,MAAM,CAAC,QAAQ,CAAC,QAAQ,EAAE,CAAC,EAAE,EAAE,CAAC,KAAK,MAAM,EAC3C,CAAC;QACD,OAAO,YAAY,CAAC;IACtB,CAAC;IACD,IAAI,MAAM,CAAC,MAAM,IAAI,CAAC,IAAI,MAAM,CAAC,QAAQ,CAAC,QAAQ,EAAE,CAAC,EAAE,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC;QACnE,OAAO,WAAW,CAAC;IACrB,CAAC;IACD,IAAI,MAAM,CAAC,MAAM,IAAI,CAAC,EAAE,CAAC;QACvB,MAAM,MAAM,GAAG,MAAM,CAAC,QAAQ,CAAC,QAAQ,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC;QAC/C,IAAI,MAAM,KAAK,WAAW,IAAI,MAAM,KAAK,WAAW;YAAE,OAAO,YAAY,CAAC;IAC5E,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,6EAA6E;AAC7E,MAAM,UAAU,aAAa,CAAC,MAAc;IAC1C,OAAO,qBAAqB,CAC1B,CAAC,GAAG,MAAM,CAAC,QAAQ,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;SACxB,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;SACjD,IAAI,CAAC,GAAG,CAAC,EACZ,GAAG,CACJ,CAAC;AACJ,CAAC"}

package/lib/documents/security/limits.js

@@ -1,78 +0,0 @@
-/**
- * Resource limits and concurrency control (§26.4, §27).
- *
- * Every expensive stage (render, extraction, OCR) runs behind a semaphore so a
- * burst of documents cannot exhaust the host, and every size/count budget is
- * checked before the work starts rather than after a backend has already spent
- * minutes on it.
- */
-import { DocumentError } from "../errors.js";
-export function assertBytesWithinBudget(bytes, maxBytes, label) {
-    if (bytes > maxBytes) {
-        throw new DocumentError("INPUT_TOO_LARGE", `${label} is ${bytes} bytes; the configured limit is ${maxBytes}`, { details: { bytes, maxBytes } });
-    }
-}
-export function assertCharsWithinBudget(chars, maxChars, label) {
-    if (chars > maxChars) {
-        throw new DocumentError("DOCUMENT_TOO_LARGE", `${label} is ${chars} characters; the configured limit is ${maxChars}`, { details: { chars, maxChars } });
-    }
-}
-export function assertCountWithinBudget(count, maxCount, label) {
-    if (count > maxCount) {
-        throw new DocumentError("DOCUMENT_TOO_LARGE", `${label} is ${count}; the configured limit is ${maxCount}`, { details: { count, maxCount } });
-    }
-}
-/**
- * Counting semaphore with FIFO fairness. An aborted waiter leaves the queue
- * without consuming a slot, so a stopped turn never leaks capacity.
- */
-export function createSemaphore(limit) {
-    const max = Math.max(1, Math.floor(limit));
-    let inUse = 0;
-    const waiters = [];
-    const releaseOnce = () => {
-        let released = false;
-        return () => {
-            if (released)
-                return;
-            released = true;
-            inUse -= 1;
-            const next = waiters.shift();
-            if (next !== undefined) {
-                inUse += 1;
-                next.signal?.removeEventListener("abort", next.reject);
-                next.resolve(releaseOnce());
-            }
-        };
-    };
-    return {
-        limit: max,
-        get inUse() {
-            return inUse;
-        },
-        async acquire(signal) {
-            if (signal?.aborted === true) {
-                throw new DocumentError("INVALID_INPUT", "the operation was cancelled");
-            }
-            if (inUse < max) {
-                inUse += 1;
-                return releaseOnce();
-            }
-            return await new Promise((resolve, reject) => {
-                const waiter = {
-                    resolve,
-                    reject,
-                    ...(signal === undefined ? {} : { signal }),
-                };
-                waiters.push(waiter);
-                signal?.addEventListener("abort", () => {
-                    const index = waiters.indexOf(waiter);
-                    if (index >= 0)
-                        waiters.splice(index, 1);
-                    reject(new DocumentError("INVALID_INPUT", "the operation was cancelled"));
-                }, { once: true });
-            });
-        },
-    };
-}
-//# sourceMappingURL=limits.js.map

package/lib/documents/security/limits.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"limits.js","sourceRoot":"","sources":["../../../src/documents/security/limits.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,EAAE,aAAa,EAAE,MAAM,cAAc,CAAC;AAE7C,MAAM,UAAU,uBAAuB,CACrC,KAAa,EACb,QAAgB,EAChB,KAAa;IAEb,IAAI,KAAK,GAAG,QAAQ,EAAE,CAAC;QACrB,MAAM,IAAI,aAAa,CACrB,iBAAiB,EACjB,GAAG,KAAK,OAAO,KAAK,mCAAmC,QAAQ,EAAE,EACjE,EAAE,OAAO,EAAE,EAAE,KAAK,EAAE,QAAQ,EAAE,EAAE,CACjC,CAAC;IACJ,CAAC;AACH,CAAC;AAED,MAAM,UAAU,uBAAuB,CACrC,KAAa,EACb,QAAgB,EAChB,KAAa;IAEb,IAAI,KAAK,GAAG,QAAQ,EAAE,CAAC;QACrB,MAAM,IAAI,aAAa,CACrB,oBAAoB,EACpB,GAAG,KAAK,OAAO,KAAK,wCAAwC,QAAQ,EAAE,EACtE,EAAE,OAAO,EAAE,EAAE,KAAK,EAAE,QAAQ,EAAE,EAAE,CACjC,CAAC;IACJ,CAAC;AACH,CAAC;AAED,MAAM,UAAU,uBAAuB,CACrC,KAAa,EACb,QAAgB,EAChB,KAAa;IAEb,IAAI,KAAK,GAAG,QAAQ,EAAE,CAAC;QACrB,MAAM,IAAI,aAAa,CACrB,oBAAoB,EACpB,GAAG,KAAK,OAAO,KAAK,6BAA6B,QAAQ,EAAE,EAC3D,EAAE,OAAO,EAAE,EAAE,KAAK,EAAE,QAAQ,EAAE,EAAE,CACjC,CAAC;IACJ,CAAC;AACH,CAAC;AAUD;;;GAGG;AACH,MAAM,UAAU,eAAe,CAAC,KAAa;IAC3C,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC;IAC3C,IAAI,KAAK,GAAG,CAAC,CAAC;IACd,MAAM,OAAO,GAIP,EAAE,CAAC;IAET,MAAM,WAAW,GAAG,GAAiB,EAAE;QACrC,IAAI,QAAQ,GAAG,KAAK,CAAC;QACrB,OAAO,GAAG,EAAE;YACV,IAAI,QAAQ;gBAAE,OAAO;YACrB,QAAQ,GAAG,IAAI,CAAC;YAChB,KAAK,IAAI,CAAC,CAAC;YACX,MAAM,IAAI,GAAG,OAAO,CAAC,KAAK,EAAE,CAAC;YAC7B,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;gBACvB,KAAK,IAAI,CAAC,CAAC;gBACX,IAAI,CAAC,MAAM,EAAE,mBAAmB,CAAC,OAAO,EAAE,IAAI,CAAC,MAAoB,CAAC,CAAC;gBACrE,IAAI,CAAC,OAAO,CAAC,WAAW,EAAE,CAAC,CAAC;YAC9B,CAAC;QACH,CAAC,CAAC;IACJ,CAAC,CAAC;IAEF,OAAO;QACL,KAAK,EAAE,GAAG;QACV,IAAI,KAAK;YACP,OAAO,KAAK,CAAC;QACf,CAAC;QACD,KAAK,CAAC,OAAO,CAAC,MAAoB;YAChC,IAAI,MAAM,EAAE,OAAO,KAAK,IAAI,EAAE,CAAC;gBAC7B,MAAM,IAAI,aAAa,CAAC,eAAe,EAAE,6BAA6B,CAAC,CAAC;YAC1E,CAAC;YACD,IAAI,KAAK,GAAG,GAAG,EAAE,CAAC;gBAChB,KAAK,IAAI,CAAC,CAAC;gBACX,OAAO,WAAW,EAAE,CAAC;YACvB,CAAC;YACD,OAAO,MAAM,IAAI,OAAO,CAAa,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;gBACvD,MAAM,MAAM,GAAG;oBACb,OAAO;oBACP,MAAM;oBACN,GAAG,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC;iBAC5C,CAAC;gBACF,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;gBACrB,MAAM,EAAE,gBAAgB,CACtB,OAAO,EACP,GAAG,EAAE;oBACH,MAAM,KAAK,GAAG,OAAO,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;oBACtC,IAAI,KAAK,IAAI,CAAC;wBAAE,OAAO,CAAC,MAAM,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC;oBACzC,MAAM,CACJ,IAAI,aAAa,CAAC,eAAe,EAAE,6BAA6B,CAAC,CAClE,CAAC;gBACJ,CAAC,EACD,EAAE,IAAI,EAAE,IAAI,EAAE,CACf,CAAC;YACJ,CAAC,CAAC,CAAC;QACL,CAAC;KACF,CAAC;AACJ,CAAC"}

package/lib/documents/security/mime.js

@@ -1,43 +0,0 @@
-/**
- * MIME policy for document assets (§17.1).
- *
- * Kept free of Node builtins on purpose: the QA settings schema reaches this
- * module from the browser bundle, so anything imported here also has to run in
- * a page. The byte sniffing stays with the pipeline's file-type module, which
- * may import whatever it needs.
- */
-/** Asset MIME types accepted by default. */
-export const DEFAULT_ASSET_MIME_TYPES = [
-    "image/png",
-    "image/jpeg",
-    "image/gif",
-    "image/webp",
-    "image/bmp",
-    "image/tiff",
-];
-const MIME_BY_EXTENSION = {
-    ".png": "image/png",
-    ".jpg": "image/jpeg",
-    ".jpeg": "image/jpeg",
-    ".gif": "image/gif",
-    ".webp": "image/webp",
-    ".bmp": "image/bmp",
-    ".tif": "image/tiff",
-    ".tiff": "image/tiff",
-    ".svg": "image/svg+xml",
-};
-/** Lowercased extension of a file name, including the dot. */
-function extensionOf(filename) {
-    const separator = Math.max(filename.lastIndexOf("/"), filename.lastIndexOf("\\"));
-    const base = separator < 0 ? filename : filename.slice(separator + 1);
-    const dot = base.lastIndexOf(".");
-    return dot <= 0 ? "" : base.slice(dot).toLowerCase();
-}
-export function mimeTypeForFilename(filename) {
-    return MIME_BY_EXTENSION[extensionOf(filename)];
-}
-export function isAllowedAssetMimeType(mimeType, allowed) {
-    const normalized = mimeType.trim().toLowerCase();
-    return allowed.some((entry) => entry.trim().toLowerCase() === normalized);
-}
-//# sourceMappingURL=mime.js.map

package/lib/documents/security/mime.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"mime.js","sourceRoot":"","sources":["../../../src/documents/security/mime.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,4CAA4C;AAC5C,MAAM,CAAC,MAAM,wBAAwB,GAAsB;IACzD,WAAW;IACX,YAAY;IACZ,WAAW;IACX,YAAY;IACZ,WAAW;IACX,YAAY;CACb,CAAC;AAEF,MAAM,iBAAiB,GAAqC;IAC1D,MAAM,EAAE,WAAW;IACnB,MAAM,EAAE,YAAY;IACpB,OAAO,EAAE,YAAY;IACrB,MAAM,EAAE,WAAW;IACnB,OAAO,EAAE,YAAY;IACrB,MAAM,EAAE,WAAW;IACnB,MAAM,EAAE,YAAY;IACpB,OAAO,EAAE,YAAY;IACrB,MAAM,EAAE,eAAe;CACxB,CAAC;AAEF,8DAA8D;AAC9D,SAAS,WAAW,CAAC,QAAgB;IACnC,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,CACxB,QAAQ,CAAC,WAAW,CAAC,GAAG,CAAC,EACzB,QAAQ,CAAC,WAAW,CAAC,IAAI,CAAC,CAC3B,CAAC;IACF,MAAM,IAAI,GAAG,SAAS,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,SAAS,GAAG,CAAC,CAAC,CAAC;IACtE,MAAM,GAAG,GAAG,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC;IAClC,OAAO,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,WAAW,EAAE,CAAC;AACvD,CAAC;AAED,MAAM,UAAU,mBAAmB,CAAC,QAAgB;IAClD,OAAO,iBAAiB,CAAC,WAAW,CAAC,QAAQ,CAAC,CAAC,CAAC;AAClD,CAAC;AAED,MAAM,UAAU,sBAAsB,CACpC,QAAgB,EAChB,OAA0B;IAE1B,MAAM,UAAU,GAAG,QAAQ,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IACjD,OAAO,OAAO,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,KAAK,UAAU,CAAC,CAAC;AAC5E,CAAC"}

package/lib/documents/security/paths.js

@@ -1,133 +0,0 @@
-/**
- * Path containment and filename hygiene (§26.2, §32).
- *
- * Two rules hold everywhere in the pipeline:
- *
- * - every path the pipeline touches is resolved against an allowed root and
- *   the resolution must stay inside it — traversal, absolute escapes and
- *   `file://` references are refused before anything is opened;
- * - a caller-supplied filename is a label, never a path: directories are
- *   dropped, separators and reserved characters collapse to `-`, and the
- *   extension is the one the operation itself chose.
- */
-import { realpath } from "node:fs/promises";
-import path from "node:path";
-import { pathToFileURL } from "node:url";
-import { DocumentError } from "../errors.js";
-/** Whether `target` is `root` or a descendant of it (no symlink resolution). */
-export function isInsideRoot(root, target) {
-    const relative = path.relative(root, target);
-    return (relative === "" ||
-        (!relative.startsWith(`..${path.sep}`) &&
-            relative !== ".." &&
-            !path.isAbsolute(relative)));
-}
-export function assertInsideRoot(root, target, label) {
-    const resolvedRoot = path.resolve(root);
-    const resolvedTarget = path.resolve(target);
-    if (!isInsideRoot(resolvedRoot, resolvedTarget)) {
-        throw new DocumentError("PATH_NOT_ALLOWED", `${label} is outside the allowed document scope`, { details: { label } });
-    }
-    return resolvedTarget;
-}
-/**
- * Canonicalize a path for containment checks: the existing prefix is resolved
- * through symlinks, the non-existent remainder is appended unresolved. A
- * symlink pointing outside the root therefore canonicalizes outside it.
- */
-export async function canonicalizeForContainment(input) {
-    const resolved = path.resolve(input);
-    let current = resolved;
-    const remainder = [];
-    for (;;) {
-        try {
-            const canonical = await realpath(current);
-            return remainder.length === 0
-                ? canonical
-                : path.join(canonical, ...remainder.reverse());
-        }
-        catch {
-            const parent = path.dirname(current);
-            if (parent === current)
-                return resolved;
-            remainder.push(path.basename(current));
-            current = parent;
-        }
-    }
-}
-/** Resolve a caller-supplied path against `root`, refusing any escape. */
-export async function resolveInsideRoot(root, requested, label) {
-    if (requested.trim() === "") {
-        throw new DocumentError("INVALID_INPUT", `${label} must be a non-empty path`);
-    }
-    if (requested.toLowerCase().startsWith("file:")) {
-        throw new DocumentError("PATH_NOT_ALLOWED", `${label} must be a filesystem path, not a file URL`);
-    }
-    const canonicalRoot = await canonicalizeForContainment(root);
-    const target = path.resolve(canonicalRoot, requested);
-    const canonicalTarget = await canonicalizeForContainment(target);
-    assertInsideRoot(canonicalRoot, canonicalTarget, label);
-    return canonicalTarget;
-}
-/**
- * Turn a caller-supplied filename into a safe file name (§32).
- * `../../foo report?.docx` becomes `foo-report.docx`.
- */
-export function sanitizeFilename(requested, fallbackStem, extension) {
-    const suffix = extension === ""
-        ? ""
-        : extension.startsWith(".")
-            ? extension
-            : `.${extension}`;
-    const source = (requested ?? "").trim();
-    let stem = "";
-    if (source !== "") {
-        // A Windows-style separator survives `path.basename` on POSIX, so both are
-        // cut explicitly before any further normalization.
-        const basename = source.split(/[\\/]+/u).pop() ?? "";
-        const withoutExtension = basename.replace(/\.[A-Za-z0-9]{1,8}$/u, "");
-        stem = withoutExtension
-            .normalize("NFC")
-            /* eslint-disable-next-line no-control-regex -- control characters are the point */
-            .replace(/[\u0000-\u001F\u007F]/gu, "")
-            .replace(/[<>:"|?*]+/gu, "")
-            .replace(/[\s._]+/gu, "-")
-            .replace(/-{2,}/gu, "-")
-            .replace(/^[-.]+|[-.]+$/gu, "");
-    }
-    const safeStem = stem === "" ? fallbackStem : stem.slice(0, 80);
-    return `${safeStem}${suffix}`;
-}
-/** `file:///...` form required by `-env:UserInstallation` and friends. */
-export function toFileUri(target) {
-    return pathToFileURL(path.resolve(target)).href;
-}
-/**
- * Assert an asset reference inside Markdown targets the assets directory and
- * nothing else: no absolute paths, no URLs, no traversal (§17.1).
- */
-export function assertRelativeAssetReference(reference) {
-    const trimmed = reference.trim();
-    if (trimmed === "") {
-        throw new DocumentError("INVALID_ASSET", "asset reference is empty");
-    }
-    if (/^[A-Za-z][A-Za-z0-9+.-]*:\/\//u.test(trimmed) ||
-        trimmed.startsWith("//") ||
-        trimmed.startsWith("\\\\") ||
-        /^(?:data|file|javascript):/iu.test(trimmed)) {
-        throw new DocumentError("INVALID_ASSET", `asset reference must be relative to the artifact assets directory (${trimmed})`);
-    }
-    const normalized = trimmed.replace(/\\/gu, "/");
-    if (normalized.startsWith("/") || normalized.split("/").includes("..")) {
-        throw new DocumentError("INVALID_ASSET", `asset reference must not leave the assets directory (${trimmed})`);
-    }
-    return normalized;
-}
-/** Recursively-size snapshot helper used by the limits guard. */
-export function assertNotBlank(value, label) {
-    if (value.trim() === "") {
-        throw new DocumentError("INVALID_INPUT", `${label} must not be blank`);
-    }
-    return value;
-}
-//# sourceMappingURL=paths.js.map

package/lib/documents/security/paths.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"paths.js","sourceRoot":"","sources":["../../../src/documents/security/paths.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,OAAO,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AAC5C,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AAEzC,OAAO,EAAE,aAAa,EAAE,MAAM,cAAc,CAAC;AAE7C,gFAAgF;AAChF,MAAM,UAAU,YAAY,CAAC,IAAY,EAAE,MAAc;IACvD,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;IAC7C,OAAO,CACL,QAAQ,KAAK,EAAE;QACf,CAAC,CAAC,QAAQ,CAAC,UAAU,CAAC,KAAK,IAAI,CAAC,GAAG,EAAE,CAAC;YACpC,QAAQ,KAAK,IAAI;YACjB,CAAC,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,CAC9B,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,gBAAgB,CAC9B,IAAY,EACZ,MAAc,EACd,KAAa;IAEb,MAAM,YAAY,GAAG,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;IACxC,MAAM,cAAc,GAAG,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;IAC5C,IAAI,CAAC,YAAY,CAAC,YAAY,EAAE,cAAc,CAAC,EAAE,CAAC;QAChD,MAAM,IAAI,aAAa,CACrB,kBAAkB,EAClB,GAAG,KAAK,wCAAwC,EAChD,EAAE,OAAO,EAAE,EAAE,KAAK,EAAE,EAAE,CACvB,CAAC;IACJ,CAAC;IACD,OAAO,cAAc,CAAC;AACxB,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,0BAA0B,CAC9C,KAAa;IAEb,MAAM,QAAQ,GAAG,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;IACrC,IAAI,OAAO,GAAG,QAAQ,CAAC;IACvB,MAAM,SAAS,GAAa,EAAE,CAAC;IAC/B,SAAS,CAAC;QACR,IAAI,CAAC;YACH,MAAM,SAAS,GAAG,MAAM,QAAQ,CAAC,OAAO,CAAC,CAAC;YAC1C,OAAO,SAAS,CAAC,MAAM,KAAK,CAAC;gBAC3B,CAAC,CAAC,SAAS;gBACX,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,GAAG,SAAS,CAAC,OAAO,EAAE,CAAC,CAAC;QACnD,CAAC;QAAC,MAAM,CAAC;YACP,MAAM,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;YACrC,IAAI,MAAM,KAAK,OAAO;gBAAE,OAAO,QAAQ,CAAC;YACxC,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC;YACvC,OAAO,GAAG,MAAM,CAAC;QACnB,CAAC;IACH,CAAC;AACH,CAAC;AAED,0EAA0E;AAC1E,MAAM,CAAC,KAAK,UAAU,iBAAiB,CACrC,IAAY,EACZ,SAAiB,EACjB,KAAa;IAEb,IAAI,SAAS,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC;QAC5B,MAAM,IAAI,aAAa,CACrB,eAAe,EACf,GAAG,KAAK,2BAA2B,CACpC,CAAC;IACJ,CAAC;IACD,IAAI,SAAS,CAAC,WAAW,EAAE,CAAC,UAAU,CAAC,OAAO,CAAC,EAAE,CAAC;QAChD,MAAM,IAAI,aAAa,CACrB,kBAAkB,EAClB,GAAG,KAAK,4CAA4C,CACrD,CAAC;IACJ,CAAC;IACD,MAAM,aAAa,GAAG,MAAM,0BAA0B,CAAC,IAAI,CAAC,CAAC;IAC7D,MAAM,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC,aAAa,EAAE,SAAS,CAAC,CAAC;IACtD,MAAM,eAAe,GAAG,MAAM,0BAA0B,CAAC,MAAM,CAAC,CAAC;IACjE,gBAAgB,CAAC,aAAa,EAAE,eAAe,EAAE,KAAK,CAAC,CAAC;IACxD,OAAO,eAAe,CAAC;AACzB,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,gBAAgB,CAC9B,SAA6B,EAC7B,YAAoB,EACpB,SAAiB;IAEjB,MAAM,MAAM,GACV,SAAS,KAAK,EAAE;QACd,CAAC,CAAC,EAAE;QACJ,CAAC,CAAC,SAAS,CAAC,UAAU,CAAC,GAAG,CAAC;YACzB,CAAC,CAAC,SAAS;YACX,CAAC,CAAC,IAAI,SAAS,EAAE,CAAC;IACxB,MAAM,MAAM,GAAG,CAAC,SAAS,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;IACxC,IAAI,IAAI,GAAG,EAAE,CAAC;IACd,IAAI,MAAM,KAAK,EAAE,EAAE,CAAC;QAClB,2EAA2E;QAC3E,mDAAmD;QACnD,MAAM,QAAQ,GAAG,MAAM,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,GAAG,EAAE,IAAI,EAAE,CAAC;QACrD,MAAM,gBAAgB,GAAG,QAAQ,CAAC,OAAO,CAAC,sBAAsB,EAAE,EAAE,CAAC,CAAC;QACtE,IAAI,GAAG,gBAAgB;aACpB,SAAS,CAAC,KAAK,CAAC;YACjB,mFAAmF;aAClF,OAAO,CAAC,yBAAyB,EAAE,EAAE,CAAC;aACtC,OAAO,CAAC,cAAc,EAAE,EAAE,CAAC;aAC3B,OAAO,CAAC,WAAW,EAAE,GAAG,CAAC;aACzB,OAAO,CAAC,SAAS,EAAE,GAAG,CAAC;aACvB,OAAO,CAAC,iBAAiB,EAAE,EAAE,CAAC,CAAC;IACpC,CAAC;IACD,MAAM,QAAQ,GAAG,IAAI,KAAK,EAAE,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;IAChE,OAAO,GAAG,QAAQ,GAAG,MAAM,EAAE,CAAC;AAChC,CAAC;AAED,0EAA0E;AAC1E,MAAM,UAAU,SAAS,CAAC,MAAc;IACtC,OAAO,aAAa,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC;AAClD,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,4BAA4B,CAAC,SAAiB;IAC5D,MAAM,OAAO,GAAG,SAAS,CAAC,IAAI,EAAE,CAAC;IACjC,IAAI,OAAO,KAAK,EAAE,EAAE,CAAC;QACnB,MAAM,IAAI,aAAa,CAAC,eAAe,EAAE,0BAA0B,CAAC,CAAC;IACvE,CAAC;IACD,IACE,gCAAgC,CAAC,IAAI,CAAC,OAAO,CAAC;QAC9C,OAAO,CAAC,UAAU,CAAC,IAAI,CAAC;QACxB,OAAO,CAAC,UAAU,CAAC,MAAM,CAAC;QAC1B,8BAA8B,CAAC,IAAI,CAAC,OAAO,CAAC,EAC5C,CAAC;QACD,MAAM,IAAI,aAAa,CACrB,eAAe,EACf,sEAAsE,OAAO,GAAG,CACjF,CAAC;IACJ,CAAC;IACD,MAAM,UAAU,GAAG,OAAO,CAAC,OAAO,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;IAChD,IAAI,UAAU,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,UAAU,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;QACvE,MAAM,IAAI,aAAa,CACrB,eAAe,EACf,wDAAwD,OAAO,GAAG,CACnE,CAAC;IACJ,CAAC;IACD,OAAO,UAAU,CAAC;AACpB,CAAC;AAED,iEAAiE;AACjE,MAAM,UAAU,cAAc,CAAC,KAAa,EAAE,KAAa;IACzD,IAAI,KAAK,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC;QACxB,MAAM,IAAI,aAAa,CAAC,eAAe,EAAE,GAAG,KAAK,oBAAoB,CAAC,CAAC;IACzE,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC"}