halfcode-compiler.xnl 0.2.1 → 0.2.3

package/dist/src-DCRih45n.js

@@ -0,0 +1,947 @@
+import { n as wordToString, t as parseXnl } from "./dist-Bkv7YeVi.js";
+import { readFile, readdir, realpath, stat } from "node:fs/promises";
+import { dirname, isAbsolute, join, relative, resolve, sep } from "node:path";
+import { createHash } from "node:crypto";
+//#region ../resource-core/src/canonical.ts
+function compareCodeUnits(left, right) {
+	if (left < right) return -1;
+	if (left > right) return 1;
+	return 0;
+}
+function sha256Digest$1(value) {
+	return `sha256:${createHash("sha256").update(value).digest("hex")}`;
+}
+function digestCanonical(value) {
+	return sha256Digest$1(canonicalJson(value));
+}
+function canonicalJson(value) {
+	return JSON.stringify(normalizeCanonical(value));
+}
+function normalizeCanonical(value) {
+	if (value === null || typeof value === "string" || typeof value === "boolean") return value;
+	if (typeof value === "number") {
+		if (!Number.isFinite(value)) throw new TypeError("Canonical values must contain only finite numbers");
+		return Object.is(value, -0) ? 0 : value;
+	}
+	if (Array.isArray(value)) return value.map(normalizeCanonical);
+	if (value instanceof Map) return [...value.entries()].map(([key, item]) => [String(key), normalizeCanonical(item)]).sort(([left], [right]) => compareCodeUnits(left, right));
+	if (typeof value === "object") {
+		const normalized = {};
+		for (const key of Object.keys(value).sort(compareCodeUnits)) {
+			const item = value[key];
+			if (item !== void 0) normalized[key] = normalizeCanonical(item);
+		}
+		return normalized;
+	}
+	throw new TypeError(`Unsupported canonical value type: ${typeof value}`);
+}
+//#endregion
+//#region ../resource-core/src/composition-error.ts
+var ResourceCompositionError = class extends Error {
+	diagnostics;
+	constructor(diagnostics) {
+		super(`Resource composition failed with ${diagnostics.length} diagnostic(s)`);
+		this.name = "ResourceCompositionError";
+		this.diagnostics = Object.freeze([...diagnostics]);
+	}
+};
+//#endregion
+//#region ../resource-core/src/effective-registry-brand.ts
+const authenticEffectiveRegistries = /* @__PURE__ */ new WeakSet();
+const effectiveRegistryLayers = /* @__PURE__ */ new WeakMap();
+function markEffectiveRegistryAuthentic(registry, layers = []) {
+	authenticEffectiveRegistries.add(registry);
+	effectiveRegistryLayers.set(registry, Object.freeze(layers.map((layer) => Object.freeze({ ...layer }))));
+	return registry;
+}
+function isEffectiveRegistryAuthentic(registry) {
+	return authenticEffectiveRegistries.has(registry);
+}
+function effectiveRegistryLayerBindings(registry) {
+	return effectiveRegistryLayers.get(registry);
+}
+//#endregion
+//#region ../resource-core/src/dependency-snapshot.ts
+function sha256Digest(value) {
+	return sha256Digest$1(value);
+}
+function createResourceContentIdentity(input) {
+	const diagnostics = [];
+	const identity = normalizeContentIdentity(input, diagnostics, {
+		requireContributions: false,
+		strictCanonicalInput: false,
+		validateClaimedDigest: false
+	});
+	if (diagnostics.length > 0 || !identity) throw new ResourceCompositionError(stableDiagnostics(diagnostics));
+	return identity;
+}
+function buildResourceDependencySnapshot(input) {
+	const diagnostics = [];
+	if (!isEffectiveRegistryAuthentic(input.registry) || input.registry.revision !== input.registry.compositionRevision) throw new ResourceCompositionError(Object.freeze([diagnostic("RESOURCE_EFFECTIVE_REGISTRY_UNTRUSTED", "effective-registry:revision", "Dependency snapshots require an authentic immutable registry returned by composeLayeredResourceRegistry().")]));
+	const roots = validateRoots(input.roots, input.registry, diagnostics);
+	const edges = validateEdges(input.edges, input.registry, diagnostics);
+	validateContentIdentityIndex(input.contentIdentities, diagnostics);
+	const validatedIdentities = validateEffectiveContentIdentities(input.registry, input.contentIdentities, diagnostics);
+	if (diagnostics.length > 0) throw new ResourceCompositionError(stableDiagnostics(diagnostics));
+	const registryRevision = digestCanonical({
+		compositionRevision: input.registry.compositionRevision,
+		resources: [...validatedIdentities.values()].sort((left, right) => compareCodeUnits(left.resourceId, right.resourceId)).map((identity) => ({
+			resourceId: identity.resourceId,
+			contentDigest: identity.contentDigest
+		}))
+	});
+	const adjacency = /* @__PURE__ */ new Map();
+	for (const edge of edges) {
+		const values = adjacency.get(edge.fromResourceId) ?? [];
+		values.push(edge);
+		adjacency.set(edge.fromResourceId, values);
+	}
+	for (const values of adjacency.values()) values.sort(compareEdges);
+	const reachable = /* @__PURE__ */ new Set();
+	const participating = /* @__PURE__ */ new Map();
+	const visiting = /* @__PURE__ */ new Set();
+	const visited = /* @__PURE__ */ new Set();
+	const path = [];
+	const visit = (resourceId) => {
+		if (visiting.has(resourceId)) {
+			const cycleStart = path.indexOf(resourceId);
+			const cycle = [...path.slice(cycleStart), resourceId];
+			diagnostics.push(diagnostic("RESOURCE_DEPENDENCY_CYCLE", dependencyLocation(resourceId), `Resource dependency cycle detected: ${cycle.join(" -> ")}.`));
+			return;
+		}
+		if (visited.has(resourceId)) return;
+		visiting.add(resourceId);
+		path.push(resourceId);
+		reachable.add(resourceId);
+		for (const edge of adjacency.get(resourceId) ?? []) {
+			participating.set(edgeKey(edge), edge);
+			visit(edge.toResourceId);
+		}
+		path.pop();
+		visiting.delete(resourceId);
+		visited.add(resourceId);
+	};
+	for (const root of roots) visit(root);
+	if (diagnostics.length > 0) throw new ResourceCompositionError(stableDiagnostics(diagnostics));
+	const closure = Object.freeze([...reachable].sort(compareCodeUnits).map((resourceId) => {
+		const entry = input.registry.byId.get(resourceId);
+		const identity = validatedIdentities.get(resourceId);
+		return Object.freeze({
+			resourceId,
+			kind: entry.kind,
+			contentDigest: identity.contentDigest,
+			origin: cloneOrigin(entry.effectiveOrigin)
+		});
+	}));
+	const snapshotEdges = Object.freeze([...participating.values()].sort(compareEdges));
+	const frozenRoots = Object.freeze([...roots]);
+	const snapshotRevision = digestCanonical({
+		roots: frozenRoots,
+		closure: closure.map((resource) => ({
+			resourceId: resource.resourceId,
+			kind: resource.kind,
+			contentDigest: resource.contentDigest,
+			origin: stableOriginFact(resource.origin)
+		})),
+		edges: snapshotEdges,
+		registryRevision
+	});
+	return Object.freeze({
+		roots: frozenRoots,
+		closure,
+		edges: snapshotEdges,
+		registryRevision,
+		snapshotRevision
+	});
+}
+function validateRoots(inputRoots, registry, diagnostics) {
+	const roots = [];
+	const seen = /* @__PURE__ */ new Set();
+	for (const value of inputRoots) {
+		const resourceId = value.trim();
+		if (resourceId.length === 0) {
+			diagnostics.push(diagnostic("RESOURCE_DEPENDENCY_ROOT_EMPTY", "dependency-root:unnamed", "Dependency snapshot roots must be non-empty resource ids."));
+			continue;
+		}
+		if (seen.has(resourceId)) {
+			diagnostics.push(diagnostic("RESOURCE_DEPENDENCY_ROOT_DUPLICATE", dependencyLocation(resourceId), `Dependency snapshot root '${resourceId}' is declared more than once.`));
+			continue;
+		}
+		seen.add(resourceId);
+		roots.push(resourceId);
+		const entry = registry.byId.get(resourceId);
+		if (!entry || !entry.resource) diagnostics.push(diagnostic("RESOURCE_DEPENDENCY_ROOT_MISSING", dependencyLocation(resourceId), `Dependency snapshot root '${resourceId}' is not an effective resource.`));
+	}
+	if (roots.length === 0 && diagnostics.length === 0) diagnostics.push(diagnostic("RESOURCE_DEPENDENCY_ROOTS_EMPTY", "dependency-root:none", "Dependency snapshot requires at least one explicit root."));
+	return roots;
+}
+function validateEdges(inputEdges, registry, diagnostics) {
+	const values = /* @__PURE__ */ new Map();
+	inputEdges.forEach((inputEdge, index) => {
+		const edge = Object.freeze({
+			fromResourceId: inputEdge.fromResourceId.trim(),
+			toResourceId: inputEdge.toResourceId.trim(),
+			relation: inputEdge.relation.trim(),
+			declaredBy: inputEdge.declaredBy.trim()
+		});
+		if (!edge.fromResourceId || !edge.toResourceId || !edge.relation || !edge.declaredBy) {
+			diagnostics.push(diagnostic("RESOURCE_DEPENDENCY_EDGE_INVALID", `dependency-edge:${index}`, "Dependency edges require non-empty fromResourceId, toResourceId, relation, and declaredBy fields."));
+			return;
+		}
+		const source = registry.byId.get(edge.fromResourceId);
+		const target = registry.byId.get(edge.toResourceId);
+		if (!source?.resource) diagnostics.push(diagnostic("RESOURCE_DEPENDENCY_SOURCE_MISSING", dependencyLocation(edge.fromResourceId), `Dependency edge source '${edge.fromResourceId}' is not an effective resource.`));
+		if (!target?.resource) diagnostics.push(diagnostic("RESOURCE_DEPENDENCY_TARGET_MISSING", dependencyLocation(edge.toResourceId), `Dependency edge target '${edge.toResourceId}' is not an effective resource.`));
+		values.set(edgeKey(edge), edge);
+	});
+	return [...values.values()].sort(compareEdges);
+}
+function normalizeContentIdentity(input, diagnostics, options) {
+	const initialDiagnosticCount = diagnostics.length;
+	if (!isRecord(input)) {
+		diagnostics.push(diagnostic("RESOURCE_CONTENT_IDENTITY_INVALID", contentLocation(""), "Resource content identity must be an object fact."));
+		return;
+	}
+	const rawResourceId = input.resourceId;
+	const resourceId = typeof rawResourceId === "string" ? rawResourceId.trim() : "";
+	if (resourceId.length === 0) diagnostics.push(diagnostic("RESOURCE_CONTENT_IDENTITY_ID_EMPTY", contentLocation(""), "Resource content identity requires a non-empty resource id."));
+	else if (options.strictCanonicalInput && rawResourceId !== resourceId) diagnostics.push(diagnostic("RESOURCE_CONTENT_IDENTITY_NON_CANONICAL", contentLocation(resourceId), `Resource content identity '${resourceId}' must use its canonical id without surrounding whitespace.`));
+	const authorityDigest = typeof input.authorityDigest === "string" ? input.authorityDigest : "";
+	if (!isSha256Digest(authorityDigest)) diagnostics.push(diagnostic("RESOURCE_CONTENT_AUTHORITY_DIGEST_INVALID", contentLocation(resourceId), `Resource '${resourceId || "unnamed"}' has an invalid authority digest.`));
+	const rawContributions = input.contributions;
+	let contributionFacts = [];
+	if (rawContributions === void 0 && !options.requireContributions) contributionFacts = [];
+	else if (!Array.isArray(rawContributions)) diagnostics.push(diagnostic("RESOURCE_DIGEST_CONTRIBUTIONS_INVALID", contentLocation(resourceId), `Resource '${resourceId || "unnamed"}' must provide an explicit digest contribution array.`));
+	else contributionFacts = rawContributions;
+	const contributions = /* @__PURE__ */ new Map();
+	for (const fact of contributionFacts) {
+		if (!isRecord(fact)) {
+			diagnostics.push(diagnostic("RESOURCE_DIGEST_CONTRIBUTION_INVALID", contentLocation(resourceId), `Resource '${resourceId || "unnamed"}' has a non-object digest contribution.`));
+			continue;
+		}
+		const rawKey = fact.key;
+		const key = typeof rawKey === "string" ? rawKey.trim() : "";
+		if (key.length === 0) {
+			diagnostics.push(diagnostic("RESOURCE_DIGEST_CONTRIBUTION_KEY_EMPTY", contentLocation(resourceId), `Resource '${resourceId || "unnamed"}' has a digest contribution with an empty key.`));
+			continue;
+		}
+		if (options.strictCanonicalInput && rawKey !== key) diagnostics.push(diagnostic("RESOURCE_DIGEST_CONTRIBUTION_NON_CANONICAL", contentLocation(resourceId, key), `Digest contribution '${key}' for resource '${resourceId}' must use its canonical key.`));
+		const digest = typeof fact.digest === "string" ? fact.digest : "";
+		if (!isSha256Digest(digest)) {
+			diagnostics.push(diagnostic("RESOURCE_DIGEST_CONTRIBUTION_INVALID", contentLocation(resourceId, key), `Digest contribution '${key}' for resource '${resourceId || "unnamed"}' is invalid.`));
+			continue;
+		}
+		const sourceUri = fact.sourceUri;
+		if (sourceUri !== void 0 && typeof sourceUri !== "string") {
+			diagnostics.push(diagnostic("RESOURCE_DIGEST_CONTRIBUTION_SOURCE_INVALID", contentLocation(resourceId, key), `Digest contribution '${key}' for resource '${resourceId}' has an invalid source URI.`));
+			continue;
+		}
+		const contribution = Object.freeze({
+			key,
+			digest,
+			...sourceUri === void 0 ? {} : { sourceUri }
+		});
+		const current = contributions.get(key);
+		if (current) {
+			const conflicting = current.digest !== digest;
+			diagnostics.push(diagnostic(conflicting ? "RESOURCE_DIGEST_CONTRIBUTION_CONFLICT" : "RESOURCE_DIGEST_CONTRIBUTION_DUPLICATE", contentLocation(resourceId, key), conflicting ? `Digest contribution '${key}' for resource '${resourceId || "unnamed"}' has conflicting digests.` : `Digest contribution '${key}' for resource '${resourceId || "unnamed"}' is declared more than once.`));
+			continue;
+		}
+		contributions.set(key, contribution);
+	}
+	if (diagnostics.length > initialDiagnosticCount) return void 0;
+	const ordered = Object.freeze([...contributions.values()].sort(compareContributions));
+	const contentDigest = digestCanonical({
+		resourceId,
+		authorityDigest,
+		contributions: ordered.map((contribution) => ({
+			key: contribution.key,
+			digest: contribution.digest
+		}))
+	});
+	if (options.validateClaimedDigest) {
+		const claimedDigest = input.contentDigest;
+		if (typeof claimedDigest !== "string" || !isSha256Digest(claimedDigest)) {
+			diagnostics.push(diagnostic("RESOURCE_CONTENT_DIGEST_INVALID", contentLocation(resourceId), `Resource '${resourceId}' has an invalid claimed content digest.`));
+			return;
+		}
+		if (claimedDigest !== contentDigest) {
+			diagnostics.push(diagnostic("RESOURCE_CONTENT_DIGEST_MISMATCH", contentLocation(resourceId), `Resource '${resourceId}' claimed a content digest that does not match its explicit authority and contributions.`));
+			return;
+		}
+	}
+	return Object.freeze({
+		resourceId,
+		authorityDigest,
+		contributions: ordered,
+		contentDigest
+	});
+}
+function validateEffectiveContentIdentities(registry, identities, diagnostics) {
+	const validated = /* @__PURE__ */ new Map();
+	const effectiveEntries = [...registry.byId.values()].filter((entry) => entry.resource !== void 0).sort((left, right) => compareCodeUnits(left.resourceId, right.resourceId));
+	for (const entry of effectiveEntries) {
+		const input = identities.get(entry.resourceId);
+		if (input === void 0) {
+			diagnostics.push(diagnostic("RESOURCE_CONTENT_IDENTITY_MISSING", dependencyLocation(entry.resourceId), `Effective resource '${entry.resourceId}' has no explicit content identity.`));
+			continue;
+		}
+		const identity = normalizeContentIdentity(input, diagnostics, {
+			requireContributions: true,
+			strictCanonicalInput: true,
+			validateClaimedDigest: true
+		});
+		if (identity) validated.set(entry.resourceId, identity);
+	}
+	return validated;
+}
+function validateContentIdentityIndex(identities, diagnostics) {
+	for (const [key, identity] of [...identities.entries()].sort(([left], [right]) => compareCodeUnits(left, right))) {
+		const identityResourceId = isRecord(identity) && typeof identity.resourceId === "string" ? identity.resourceId : void 0;
+		if (key !== identityResourceId) diagnostics.push(diagnostic("RESOURCE_CONTENT_IDENTITY_KEY_MISMATCH", dependencyLocation(key), `Content identity index key '${key}' does not match identity '${identityResourceId ?? "invalid"}'.`));
+	}
+}
+function isSha256Digest(value) {
+	return /^sha256:[0-9a-f]{64}$/.test(value);
+}
+function isRecord(value) {
+	return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function compareEdges(left, right) {
+	return compareCodeUnits(left.fromResourceId, right.fromResourceId) || compareCodeUnits(left.toResourceId, right.toResourceId) || compareCodeUnits(left.relation, right.relation) || compareCodeUnits(left.declaredBy, right.declaredBy);
+}
+function compareContributions(left, right) {
+	const semanticOrder = compareCodeUnits(left.key, right.key) || compareCodeUnits(left.digest, right.digest);
+	if (semanticOrder !== 0) return semanticOrder;
+	if (left.sourceUri === right.sourceUri) return 0;
+	if (left.sourceUri === void 0) return 1;
+	if (right.sourceUri === void 0) return -1;
+	return compareCodeUnits(left.sourceUri, right.sourceUri);
+}
+function edgeKey(edge) {
+	return JSON.stringify([
+		edge.fromResourceId,
+		edge.toResourceId,
+		edge.relation,
+		edge.declaredBy
+	]);
+}
+function stableOriginFact(origin) {
+	return {
+		layerId: origin.layerId,
+		layerIndex: origin.layerIndex,
+		packageId: origin.packageId,
+		documentUri: origin.documentUri,
+		logicalPath: origin.logicalPath
+	};
+}
+function cloneOrigin(origin) {
+	return Object.freeze({
+		layerId: origin.layerId,
+		layerIndex: origin.layerIndex,
+		packageId: origin.packageId,
+		documentUri: origin.documentUri,
+		...origin.logicalPath === void 0 ? {} : { logicalPath: origin.logicalPath }
+	});
+}
+function stableDiagnostics(diagnostics) {
+	return Object.freeze([...diagnostics].sort((left, right) => compareCodeUnits(left.location, right.location) || compareCodeUnits(left.code, right.code)));
+}
+function diagnostic(code, location, message) {
+	return Object.freeze({
+		code,
+		location,
+		message
+	});
+}
+function dependencyLocation(resourceId) {
+	return `dependency:${resourceId || "unnamed"}`;
+}
+function contentLocation(resourceId, key) {
+	return `content:${resourceId || "unnamed"}${key === void 0 ? "" : `:${key}`}`;
+}
+//#endregion
+//#region ../resource-core/src/loaded-resource-tree-brand.ts
+const authenticLoadedResourceTrees = /* @__PURE__ */ new WeakSet();
+function markLoadedResourceTreeAuthentic(tree) {
+	authenticLoadedResourceTrees.add(tree);
+	return tree;
+}
+function isLoadedResourceTreeAuthentic(tree) {
+	return authenticLoadedResourceTrees.has(tree);
+}
+//#endregion
+//#region ../resource-core/src/readonly-map.ts
+function readonlyMap(entries) {
+	const values = new Map(entries);
+	return Object.freeze({
+		get size() {
+			return values.size;
+		},
+		get(key) {
+			return values.get(key);
+		},
+		has(key) {
+			return values.has(key);
+		},
+		entries() {
+			return values.entries();
+		},
+		keys() {
+			return values.keys();
+		},
+		values() {
+			return values.values();
+		},
+		forEach(callback, thisArg) {
+			const view = this;
+			values.forEach((value, key) => callback.call(thisArg, value, key, view));
+		},
+		[Symbol.iterator]() {
+			return values[Symbol.iterator]();
+		}
+	});
+}
+//#endregion
+//#region ../resource-core/src/xnl-loader.ts
+async function buildXnlResourceTree(options) {
+	const requestedRoot = resolve(options.rootDir);
+	const context = {
+		rootDir: await realpath(requestedRoot).catch(() => requestedRoot),
+		diagnostics: [],
+		kindDefinitions: /* @__PURE__ */ new Map(),
+		resources: [],
+		seenIdentities: /* @__PURE__ */ new Map(),
+		authorityFiles: /* @__PURE__ */ new Map(),
+		recordAuthorityDigests: /* @__PURE__ */ new WeakMap()
+	};
+	const manifest = await loadManifest(resolve(context.rootDir, options.manifestPath), "manifest", context, true);
+	if (!manifest || context.diagnostics.length > 0) return { diagnostics: context.diagnostics };
+	const byKind = /* @__PURE__ */ new Map();
+	for (const resource of context.resources) {
+		const records = byKind.get(resource.kind) ?? [];
+		records.push(resource);
+		byKind.set(resource.kind, records);
+	}
+	const frozenByKind = readonlyMap([...byKind.entries()].sort(([left], [right]) => compareCodeUnits(left, right)).map(([kind, records]) => [kind, Object.freeze([...records].sort((left, right) => compareCodeUnits(left.resourceId, right.resourceId)))]));
+	const frozenKindDefinitions = readonlyMap([...context.kindDefinitions.entries()].sort(([left], [right]) => compareCodeUnits(left, right)));
+	const contentIdentities = readonlyMap(context.resources.map((resource) => [resource.resourceId, loadedContentIdentity(resource, context)]).sort(([left], [right]) => compareCodeUnits(left, right)));
+	return {
+		diagnostics: [],
+		tree: markLoadedResourceTreeAuthentic(Object.freeze({
+			manifest,
+			registry: Object.freeze({
+				byKind: frozenByKind,
+				kindDefinitions: frozenKindDefinitions
+			}),
+			diagnostics: Object.freeze([]),
+			contentIdentities
+		}))
+	};
+}
+async function loadManifest(filePath, sourceShape, context, isRoot) {
+	const record = await loadXnlRecord(filePath, sourceShape, context);
+	if (!record) return void 0;
+	if (isRoot && record.kind !== "ResourcePackage") {
+		context.diagnostics.push({
+			code: "RESOURCE_XNL_ROOT_INVALID",
+			location: record.documentUri,
+			message: "The root manifest.xnl must contain one ResourcePackage root."
+		});
+		return;
+	}
+	const catalogs = readCatalogs(record, context.diagnostics);
+	for (const catalog of catalogs.filter((item) => item.kind === "KindDefinition")) await loadKindDefinitions(catalog, dirname(filePath), context);
+	for (const catalog of catalogs.filter((item) => item.kind !== "KindDefinition")) await loadCatalog(catalog, dirname(filePath), context);
+	if (!isRoot) {
+		validateIdentity(record, context);
+		context.resources.push(record);
+	}
+	return record;
+}
+async function loadKindDefinitions(catalog, manifestDir, context) {
+	const files = await catalogFiles(catalog, manifestDir, context);
+	for (const file of files) {
+		const record = await loadXnlRecord(file, catalog.shape, context);
+		if (!record) continue;
+		if (record.kind !== "KindDefinition") {
+			context.diagnostics.push(kindMismatch(record.kind, "KindDefinition", record.documentUri));
+			continue;
+		}
+		const definition = normalizeKindDefinition(record, context.diagnostics);
+		if (!definition) continue;
+		context.kindDefinitions.set(definition.resourceKind, definition);
+	}
+}
+async function loadCatalog(catalog, manifestDir, context) {
+	const definition = context.kindDefinitions.get(catalog.kind);
+	if (!definition) {
+		context.diagnostics.push({
+			code: "KIND_DEFINITION_MISSING",
+			location: catalog.location,
+			message: `No KindDefinition is registered for catalog kind '${catalog.kind}'.`
+		});
+		return;
+	}
+	if (!definition.sourceShapes.includes(catalog.shape)) {
+		context.diagnostics.push({
+			code: "RESOURCE_SOURCE_SHAPE_NOT_ALLOWED",
+			location: catalog.location,
+			message: `Kind '${catalog.kind}' does not allow source shape '${catalog.shape}'.`
+		});
+		return;
+	}
+	const files = await catalogFiles(catalog, manifestDir, context);
+	for (const file of files) {
+		if (catalog.shape === "manifest") {
+			const record = await loadXnlRecord(file, "manifest", context);
+			if (!record) continue;
+			if (record.kind !== catalog.kind) {
+				context.diagnostics.push(kindMismatch(record.kind, catalog.kind, record.documentUri));
+				continue;
+			}
+			validateResourceApiVersion(record, definition, context.diagnostics);
+			await validateRequiredFiles(dirname(file), record, definition, context.diagnostics);
+			validateIdentity(record, context);
+			context.resources.push(record);
+			const catalogs = readCatalogs(record, context.diagnostics);
+			for (const nested of catalogs.filter((item) => item.kind !== "KindDefinition")) await loadCatalog(nested, dirname(file), context);
+			continue;
+		}
+		if (definition.documentCardinality === "many" && catalog.shape !== "single-file") {
+			context.diagnostics.push({
+				code: "RESOURCE_DOCUMENT_CARDINALITY_UNSUPPORTED",
+				location: catalog.location,
+				message: `Kind '${catalog.kind}' allows multiple document roots only in a single-file catalog.`
+			});
+			continue;
+		}
+		const records = await loadXnlRecords(file, catalog.shape, context, definition.documentCardinality);
+		for (const record of records) {
+			if (record.kind !== catalog.kind) {
+				context.diagnostics.push(kindMismatch(record.kind, catalog.kind, record.documentUri));
+				continue;
+			}
+			validateResourceApiVersion(record, definition, context.diagnostics);
+			await validateRequiredFiles(dirname(file), record, definition, context.diagnostics);
+			validateIdentity(record, context);
+			context.resources.push(record);
+		}
+	}
+}
+async function catalogFiles(catalog, manifestDir, context) {
+	const root = await resolveCatalogDirectory(catalog.root, manifestDir, catalog.location, context);
+	if (!root) return [];
+	const entries = await readdir(root, { withFileTypes: true }).catch(() => void 0);
+	if (!entries) {
+		context.diagnostics.push({
+			code: "RESOURCE_CATALOG_ROOT_MISSING",
+			location: catalog.location,
+			message: "Catalog root does not exist or is not readable."
+		});
+		return [];
+	}
+	if (catalog.shape === "single-file") {
+		if (catalog.entry) {
+			if (!isPlainEntry(catalog.entry) || !catalog.entry.toLowerCase().endsWith(".xnl")) {
+				context.diagnostics.push({
+					code: "RESOURCE_CATALOG_ENTRY_INVALID",
+					location: catalog.location,
+					message: "A single-file catalog entry must be a plain XNL filename."
+				});
+				return [];
+			}
+			return [join(root, catalog.entry)];
+		}
+		return entries.filter((entry) => entry.isFile() && entry.name.toLowerCase().endsWith(".xnl")).sort((left, right) => compareCodeUnits(left.name, right.name)).map((entry) => join(root, entry.name));
+	}
+	if (!catalog.entry || !isPlainEntry(catalog.entry)) {
+		context.diagnostics.push({
+			code: "RESOURCE_CATALOG_ENTRY_INVALID",
+			location: catalog.location,
+			message: "Directory and manifest catalogs require a plain XNL entry filename."
+		});
+		return [];
+	}
+	return entries.filter((entry) => entry.isDirectory()).sort((left, right) => compareCodeUnits(left.name, right.name)).map((entry) => join(root, entry.name, catalog.entry));
+}
+async function loadXnlRecord(filePath, sourceShape, context) {
+	return (await loadXnlRecords(filePath, sourceShape, context, "one"))[0];
+}
+async function loadXnlRecords(filePath, sourceShape, context, documentCardinality) {
+	const documentUri = documentUriFor(context.rootDir, filePath);
+	const authority = await readAuthorityFile(filePath, documentUri, context);
+	if (!authority) return [];
+	let roots;
+	try {
+		const parsed = parseXnl(authority.source, { textBlockStyle: true });
+		if (parsed.warnings?.length) {
+			context.diagnostics.push({
+				code: "RESOURCE_XNL_WARNING",
+				location: documentUri,
+				message: parsed.warnings.map((warning) => warning.message).join("; ")
+			});
+			return [];
+		}
+		if (parsed.nodes.length === 0 || parsed.nodes.some((node) => !isDataElement(node)) || documentCardinality === "one" && parsed.nodes.length !== 1) {
+			context.diagnostics.push({
+				code: "RESOURCE_XNL_ROOT_INVALID",
+				location: documentUri,
+				message: documentCardinality === "one" ? "XNL resource documents must contain exactly one data-element root." : "XNL resource forests must contain one or more data-element roots."
+			});
+			return [];
+		}
+		roots = parsed.nodes;
+	} catch (error) {
+		context.diagnostics.push({
+			code: "RESOURCE_XNL_SYNTAX",
+			location: documentUri,
+			message: `Invalid XNL resource document: ${error instanceof Error ? error.message : String(error)}`
+		});
+		return [];
+	}
+	return roots.flatMap((root) => {
+		const record = resourceRecordFromRoot(root, filePath, sourceShape, context);
+		if (record) context.recordAuthorityDigests.set(record, authority.authorityDigest);
+		return record ? [record] : [];
+	});
+}
+async function readAuthorityFile(filePath, documentUri, context) {
+	const canonicalPath = resolve(filePath);
+	let pending = context.authorityFiles.get(canonicalPath);
+	if (!pending) {
+		pending = readFile(canonicalPath).then((bytes) => {
+			try {
+				return Object.freeze({
+					source: new TextDecoder("utf-8", { fatal: true }).decode(bytes),
+					authorityDigest: sha256Digest(bytes)
+				});
+			} catch {
+				context.diagnostics.push({
+					code: "RESOURCE_XNL_UTF8_INVALID",
+					location: documentUri,
+					message: "XNL resource authority must be valid UTF-8."
+				});
+				return;
+			}
+		}).catch(() => {
+			context.diagnostics.push({
+				code: "RESOURCE_FILE_MISSING",
+				location: documentUri,
+				message: "Resource file does not exist."
+			});
+		});
+		context.authorityFiles.set(canonicalPath, pending);
+	}
+	return pending;
+}
+function loadedContentIdentity(resource, context) {
+	const authorityDigest = context.recordAuthorityDigests.get(resource);
+	if (!authorityDigest) throw new Error(`Loader authority digest is missing for ${resource.resourceId}`);
+	return createResourceContentIdentity({
+		resourceId: resource.resourceId,
+		authorityDigest
+	});
+}
+function resourceRecordFromRoot(root, filePath, sourceShape, context) {
+	const documentUri = documentUriFor(context.rootDir, filePath);
+	const node = normalizeNode(root);
+	const resourceId = node.resourceId;
+	const apiVersion = asString(node.metadata.apiVersion);
+	const lifecycle = asString(node.properties.lifecycle);
+	const description = asString(node.properties.description) ?? node.subdomains.Description?.text;
+	if (!resourceId) context.diagnostics.push({
+		code: "RESOURCE_IDENTITY_MISSING",
+		location: documentUri,
+		message: "XNL resource roots must declare a #id."
+	});
+	if (!apiVersion) context.diagnostics.push({
+		code: "RESOURCE_METADATA_FIELD_MISSING",
+		location: documentUri,
+		message: "XNL resources require metadata apiVersion."
+	});
+	if (!resourceId || !apiVersion) return void 0;
+	const metadata = Object.freeze({
+		apiVersion,
+		...lifecycle ? { lifecycle } : {},
+		version: asString(node.metadata.version)
+	});
+	const logicalPath = relative(context.rootDir, filePath).split(sep).join("/");
+	return Object.freeze({
+		kind: node.tag,
+		resourceId,
+		fqn: resourceId,
+		...description ? { description } : {},
+		metadata,
+		sourceShape,
+		logicalPath,
+		documentUri,
+		format: "xnl",
+		node
+	});
+}
+function normalizeNode(node) {
+	const subdomains = {};
+	if (node.kind === "DataElement" && node.extend) for (const name of node.extend.order) {
+		const child = node.extend.children[name];
+		if (child) subdomains[name] = normalizeNode(child);
+	}
+	const resourceId = wordToString(node.id);
+	return Object.freeze({
+		tag: node.tag,
+		...resourceId === void 0 ? {} : { resourceId },
+		metadata: Object.freeze(normalizeMap(node.metadata)),
+		properties: Object.freeze(normalizeMap(node.attributes)),
+		body: Object.freeze(node.kind === "DataElement" ? (node.body ?? []).map(normalizeValue) : []),
+		subdomains: Object.freeze(subdomains),
+		...node.kind === "TextElement" ? { text: node.text ?? "" } : {}
+	});
+}
+function normalizeMap(map) {
+	return Object.fromEntries(Object.entries(map ?? {}).map(([key, value]) => [key, normalizeValue(value)]));
+}
+function normalizeValue(value) {
+	if (value === null || typeof value === "string" || typeof value === "number" || typeof value === "boolean") return value;
+	if (Array.isArray(value)) return Object.freeze(value.map(normalizeValue));
+	if (isElement(value)) return normalizeNode(value);
+	if (isWord(value)) return wordToString(value) ?? "";
+	if (isComment(value)) return value.value;
+	return Object.freeze(Object.fromEntries(Object.entries(value).map(([key, child]) => [key, normalizeValue(child)])));
+}
+function readCatalogs(record, diagnostics) {
+	const catalogs = record.node.subdomains.Catalogs;
+	if (!catalogs) return [];
+	const out = [];
+	for (const value of catalogs.body) {
+		if (!isResourceNode(value) || value.tag !== "Catalog") continue;
+		const id = value.resourceId;
+		const kind = asString(value.properties.kind);
+		const root = asString(value.properties.root);
+		const entry = asString(value.properties.entry);
+		const shapeValue = asString(value.properties.shape) ?? (entry ? "directory" : "single-file");
+		const location = `${record.documentUri}#Catalog:${id ?? "unknown"}`;
+		if (!id || !kind || !root || !isXnlShape(shapeValue)) {
+			diagnostics.push({
+				code: "RESOURCE_CATALOG_INVALID",
+				location,
+				message: "Catalog requires #id, kind, root and a valid shape."
+			});
+			continue;
+		}
+		out.push({
+			id,
+			kind,
+			root,
+			entry,
+			shape: shapeValue,
+			location
+		});
+	}
+	return out;
+}
+function normalizeKindDefinition(record, diagnostics) {
+	const resourceKind = asString(record.node.properties.resourceKind) ?? record.resourceId.split(".").at(-1);
+	const shapes = record.node.properties.sourceShapes;
+	const sourceShapes = Array.isArray(shapes) ? shapes.filter(isXnlShape) : [];
+	const currentApiVersion = asString(record.node.properties.currentApiVersion);
+	const versions = record.node.properties.supportedApiVersions;
+	const supportedApiVersions = Array.isArray(versions) ? versions.filter((value) => typeof value === "string" && Boolean(value.trim())) : [];
+	const cardinalityValue = asString(record.node.properties.documentCardinality) ?? "one";
+	if (!resourceKind || sourceShapes.length === 0 || !currentApiVersion || supportedApiVersions.length === 0 || !isDocumentCardinality(cardinalityValue)) {
+		diagnostics.push({
+			code: "KIND_DEFINITION_INVALID",
+			location: record.documentUri,
+			message: "KindDefinition requires resourceKind (or an id suffix), sourceShapes, currentApiVersion, and supportedApiVersions."
+		});
+		return;
+	}
+	if (!supportedApiVersions.includes(currentApiVersion)) {
+		diagnostics.push({
+			code: "KIND_DEFINITION_VERSION_INVALID",
+			location: record.documentUri,
+			message: `Kind '${resourceKind}' currentApiVersion '${currentApiVersion}' must be included in supportedApiVersions.`
+		});
+		return;
+	}
+	if (cardinalityValue === "many" && sourceShapes.some((shape) => shape !== "single-file")) {
+		diagnostics.push({
+			code: "KIND_DEFINITION_CARDINALITY_INVALID",
+			location: record.documentUri,
+			message: `Kind '${resourceKind}' documentCardinality 'many' requires only the single-file source shape.`
+		});
+		return;
+	}
+	const requiredFiles = ((record.node.subdomains.DescriptorContract?.subdomains.RequiredFiles)?.body ?? []).filter(isResourceNode).filter((node) => node.tag === "File").map((node) => asString(node.properties.name)).filter((value) => Boolean(value));
+	return Object.freeze({
+		resourceId: record.resourceId,
+		resourceKind,
+		sourceShapes: Object.freeze([...sourceShapes]),
+		requiredFiles: Object.freeze([...requiredFiles]),
+		currentApiVersion,
+		supportedApiVersions: Object.freeze([...new Set(supportedApiVersions)]),
+		documentCardinality: cardinalityValue,
+		documentUri: record.documentUri
+	});
+}
+function validateResourceApiVersion(record, definition, diagnostics) {
+	if (definition.supportedApiVersions.includes(record.metadata.apiVersion)) return;
+	diagnostics.push({
+		code: "RESOURCE_API_VERSION_UNSUPPORTED",
+		location: record.documentUri,
+		message: `Kind '${record.kind}' does not support apiVersion '${record.metadata.apiVersion}'.`,
+		hint: `Current apiVersion is '${definition.currentApiVersion}'.`
+	});
+}
+async function validateRequiredFiles(resourceDir, record, definition, diagnostics) {
+	for (const name of definition.requiredFiles) {
+		if (!isPlainEntry(name)) {
+			diagnostics.push({
+				code: "KIND_DEFINITION_REQUIRED_FILE_INVALID",
+				location: record.documentUri,
+				message: `Invalid required file '${name}'.`
+			});
+			continue;
+		}
+		if (!await stat(join(resourceDir, name)).then((info) => info.isFile()).catch(() => false)) diagnostics.push({
+			code: "RESOURCE_REQUIRED_FILE_MISSING",
+			location: `${record.documentUri}#${name}`,
+			message: `Resource is missing required material '${name}'.`
+		});
+	}
+}
+async function resolveCatalogDirectory(uri, manifestDir, location, context) {
+	const relativeMatch = /^vfs:\/\/(\.\/|@\/)(.*)$/.exec(uri);
+	if (!relativeMatch || !uri.endsWith("/")) {
+		context.diagnostics.push({
+			code: "RESOURCE_REF_UNSUPPORTED",
+			location,
+			message: "Catalog roots must be directory vfs://./ or vfs://@/ references."
+		});
+		return;
+	}
+	const rawPath = relativeMatch[2];
+	let decoded;
+	try {
+		decoded = decodeURIComponent(rawPath);
+	} catch {
+		context.diagnostics.push({
+			code: "RESOURCE_REF_CONTAINMENT",
+			location,
+			message: "VFS reference contains invalid encoding."
+		});
+		return;
+	}
+	if (isAbsolute(decoded) || decoded.split(/[\\/]+/).includes("..") || /%2f|%5c/i.test(rawPath)) {
+		context.diagnostics.push({
+			code: "RESOURCE_REF_CONTAINMENT",
+			location,
+			message: "VFS reference escapes the owning package boundary."
+		});
+		return;
+	}
+	const base = relativeMatch[1] === "@/" ? context.rootDir : manifestDir;
+	const boundary = await realpath(context.rootDir);
+	const candidate = resolve(base, decoded);
+	const resolved = await realpath(candidate).catch(() => candidate);
+	if (resolved !== boundary && !resolved.startsWith(`${boundary}${sep}`)) {
+		context.diagnostics.push({
+			code: "RESOURCE_REF_CONTAINMENT",
+			location,
+			message: "VFS reference resolves outside the owning package boundary."
+		});
+		return;
+	}
+	return resolved;
+}
+function validateIdentity(record, context) {
+	const prior = context.seenIdentities.get(record.resourceId);
+	if (prior) {
+		context.diagnostics.push({
+			code: "RESOURCE_IDENTITY_DUPLICATE",
+			location: record.documentUri,
+			message: `Duplicate resource identity '${record.resourceId}'.`,
+			hint: `First seen at ${prior}.`
+		});
+		return;
+	}
+	context.seenIdentities.set(record.resourceId, record.documentUri);
+}
+function documentUriFor(rootDir, filePath) {
+	return `vfs://@/${relative(rootDir, filePath).split(sep).join("/")}`;
+}
+function kindMismatch(actual, expected, location) {
+	return {
+		code: "RESOURCE_KIND_MISMATCH",
+		location,
+		message: `Resource kind '${actual}' does not match catalog kind '${expected}'.`
+	};
+}
+function isXnlShape(value) {
+	return value === "single-file" || value === "directory" || value === "manifest";
+}
+function isDocumentCardinality(value) {
+	return value === "one" || value === "many";
+}
+function isPlainEntry(value) {
+	return Boolean(value) && !value.includes("/") && !value.includes("\\") && !value.includes("..");
+}
+function asString(value) {
+	return typeof value === "string" && value.trim() ? value : void 0;
+}
+function isResourceNode(value) {
+	return typeof value === "object" && value !== null && !Array.isArray(value) && "tag" in value;
+}
+function isDataElement(value) {
+	return typeof value === "object" && value !== null && !Array.isArray(value) && "kind" in value && value.kind === "DataElement";
+}
+function isElement(value) {
+	return typeof value === "object" && value !== null && !Array.isArray(value) && "kind" in value && (value.kind === "DataElement" || value.kind === "TextElement");
+}
+function isWord(value) {
+	return typeof value === "object" && value !== null && !Array.isArray(value) && "kind" in value && value.kind === "Word";
+}
+function isComment(value) {
+	return typeof value === "object" && value !== null && !Array.isArray(value) && "kind" in value && value.kind === "Comment";
+}
+//#endregion
+//#region ../resource-core/src/index.ts
+var ResourceValidationError = class extends Error {
+	diagnostics;
+	constructor(diagnostics) {
+		super(`Resource validation failed with ${diagnostics.length} diagnostic(s)`);
+		this.name = "ResourceValidationError";
+		this.diagnostics = diagnostics;
+	}
+};
+async function loadResourceTree(options) {
+	const unsupported = unsupportedAuthorityDiagnostic(options);
+	if (unsupported) throw new ResourceValidationError([unsupported]);
+	const manifestPath = options.manifestPath ?? "manifest.xnl";
+	const result = await buildXnlResourceTree({
+		...options,
+		rootDir: resolve(options.rootDir),
+		manifestPath
+	});
+	if (result.diagnostics.length > 0 || !result.tree) throw new ResourceValidationError(result.diagnostics);
+	return result.tree;
+}
+async function validateResourceTree(options) {
+	const unsupported = unsupportedAuthorityDiagnostic(options);
+	if (unsupported) return [unsupported];
+	const manifestPath = options.manifestPath ?? "manifest.xnl";
+	return (await buildXnlResourceTree({
+		...options,
+		rootDir: resolve(options.rootDir),
+		manifestPath
+	})).diagnostics;
+}
+function unsupportedAuthorityDiagnostic(options) {
+	const manifestPath = options.manifestPath ?? "manifest.xnl";
+	if (!manifestPath.toLowerCase().endsWith(".xnl")) return {
+		code: "RESOURCE_AUTHORITY_FORMAT_UNSUPPORTED",
+		location: `vfs://@/${manifestPath}`,
+		message: "Resource package manifests must use XNL authority."
+	};
+}
+//#endregion
+export { isLoadedResourceTreeAuthentic as a, sha256Digest as c, markEffectiveRegistryAuthentic as d, ResourceCompositionError as f, readonlyMap as i, effectiveRegistryLayerBindings as l, digestCanonical as m, loadResourceTree as n, buildResourceDependencySnapshot as o, compareCodeUnits as p, validateResourceTree as r, createResourceContentIdentity as s, ResourceValidationError as t, isEffectiveRegistryAuthentic as u };