novahiz 0.1.0

package/bundled-skills/impeccable/scripts/impeccable

@@ -0,0 +1,206 @@
+#!/bin/sh
+# Impeccable launcher. Runs the platform binary shipped next to this script:
+#   <this dir>/bin/<os>-<arch>/impeccable
+# Order: $IMPECCABLE_BIN, the sibling binary, ~/.impeccable/bin/impeccable,
+# the version-pinned cache, then `impeccable` on PATH. Never needs Node.
+# The unversioned home binary and the PATH candidate are validated with the
+# engine-probe handshake first: the retired 3.x npm CLI also installed a bin
+# named `impeccable`, and exec'ing it would fail every verb with
+# "Unknown command". Trusted candidates (IMPECCABLE_BIN, the sibling binary,
+# the version-pinned cache) are exec'd without a probe: hooks run them on
+# every edit and must stay fast.
+set -eu
+
+# True when the candidate answers the engine handshake (prints
+# "impeccable-engine <version>", exit 0). Quiet and fast (<100ms).
+# IMPECCABLE_LAUNCHER_PROBE marks the child as a probe: a copy of this
+# launcher reached recursively (e.g. symlinked onto PATH as `impeccable`)
+# then skips its own probes and refuses to download, so probing stays cheap
+# and can never loop.
+probe_ok() {
+  case "$(IMPECCABLE_LAUNCHER_PROBE=1 "$1" engine-probe 2>/dev/null || true)" in
+    impeccable-engine*) return 0 ;;
+  esac
+  return 1
+}
+probing=${IMPECCABLE_LAUNCHER_PROBE:-}
+
+dir=$(CDPATH= cd -- "$(dirname -- "$0")" && pwd)
+
+# What the binary needs to know about its home: the skill directory (for
+# reference/*.md and command-metadata.json) and how to name itself in the
+# commands it prints. Exported BEFORE any exec below, including the
+# IMPECCABLE_BIN override: an engine binary reached with no IMPECCABLE_SKILL_DIR
+# cannot find reference/*.md (so native platform refs never inline) or read its
+# own version (so UPDATE_AVAILABLE never fires). Setting it here covers every
+# candidate the launcher can exec.
+: "${IMPECCABLE_SKILL_DIR:=$(CDPATH= cd -- "$dir/.." && pwd)}"
+: "${IMPECCABLE_SELF:=$0}"
+export IMPECCABLE_SKILL_DIR IMPECCABLE_SELF
+
+if [ -n "${IMPECCABLE_BIN:-}" ] && [ -x "${IMPECCABLE_BIN}" ]; then
+  exec "${IMPECCABLE_BIN}" "$@"
+fi
+
+case "$(uname -s 2>/dev/null || echo unknown)" in
+  Darwin) os=darwin ;;
+  Linux) os=linux ;;
+  MINGW*|MSYS*|CYGWIN*|Windows_NT) os=windows ;;
+  *) os=unknown ;;
+esac
+case "$(uname -m 2>/dev/null || echo unknown)" in
+  arm64|aarch64) arch=arm64 ;;
+  x86_64|amd64) arch=x64 ;;
+  *) arch=unknown ;;
+esac
+
+bin="$dir/bin/$os-$arch/impeccable"
+[ "$os" = windows ] && bin="$bin.exe"
+
+if [ -x "$bin" ]; then
+  exec "$bin" "$@"
+fi
+if [ -f "$bin" ]; then
+  # Lost the executable bit in transit (zip extraction, some copiers).
+  chmod +x "$bin" 2>/dev/null && exec "$bin" "$@"
+fi
+# On Windows (an MSYS/Git Bash shell) the cached names carry .exe so this
+# launcher and impeccable.cmd share one cache.
+exe=""
+[ "$os" = windows ] && exe=".exe"
+home_bin="${HOME:-/nonexistent}/.impeccable/bin/impeccable$exe"
+if [ -z "$probing" ] && [ -x "$home_bin" ] && probe_ok "$home_bin"; then
+  exec "$home_bin" "$@"
+fi
+# Version-pinned user cache, filled by the download below or by `impeccable update`.
+version=""
+[ -f "$dir/VERSION" ] && version=$(tr -d '[:space:]' < "$dir/VERSION")
+cache_root="${IMPECCABLE_HOME:-${HOME:-/nonexistent}/.impeccable}"
+cached="$cache_root/bin/$version/impeccable$exe"
+if [ -n "$version" ] && [ -x "$cached" ]; then
+  exec "$cached" "$@"
+fi
+if [ -z "$probing" ] && command -v impeccable >/dev/null 2>&1 && probe_ok impeccable; then
+  exec impeccable "$@"
+fi
+
+# Last resort: fetch this version's binary for the current platform from the
+# public release channel into the user cache. Needs network; sandboxes without
+# egress preinstall the binary on PATH instead.
+setup_help() {
+  echo "Engine $version setup needs network access and write permission to $cache_root/bin/$version." >&2
+  echo "Run this launcher ($0) with engine-probe in a terminal that has those permissions, then retry the original command." >&2
+  echo "Alternatively, set IMPECCABLE_HOME to a writable cache location, or IMPECCABLE_BIN to a preinstalled engine binary." >&2
+}
+fetch_url() {
+  if command -v curl >/dev/null 2>&1; then
+    curl -fsSL --retry 2 -o "$tmp" "$1" 2>/dev/null
+  elif command -v wget >/dev/null 2>&1; then
+    wget -q -O "$tmp" "$1" 2>/dev/null
+  else
+    return 1
+  fi
+}
+check_download() {
+  download_file=${1:-$tmp}
+  if [ ! -f "$download_file" ]; then
+    rm -f "$tmp.sha256"
+    echo "impeccable: download completed but the file was removed before execution: $url; check your antivirus quarantine or logs. Refusing to continue; do not disable protection." >&2
+    exit 127
+  fi
+  if [ ! -s "$download_file" ]; then
+    rm -f "$download_file" "$tmp.sha256"
+    echo "impeccable: downloaded file is empty: $url; refusing the unverified download" >&2
+    exit 127
+  fi
+}
+if [ -n "$probing" ]; then
+  # Inside another launcher's probe: no download, fail fast and quiet.
+  exit 127
+fi
+if [ -n "$version" ] && [ "$os" != unknown ] && [ "$arch" != unknown ]; then
+  base="${IMPECCABLE_DOWNLOAD_BASE:-https://github.com/pbakaus/impeccable/releases/download}"
+  asset="impeccable-$os-$arch"
+  [ "$os" = windows ] && asset="$asset.exe"
+  url="$base/engine-v$version/$asset"
+  tmp="$cache_root/bin/$version/.impeccable.part.$$"
+  if ! mkdir -p "$cache_root/bin/$version" 2>/dev/null; then
+    echo "impeccable: engine $version is not installed; cannot create cache directory: $cache_root/bin/$version" >&2
+    setup_help
+    exit 127
+  fi
+  # Check the actual staging file, not just directory existence: a cache from
+  # an earlier run can be readable but no longer writable inside a sandbox.
+  if ! (umask 077; : > "$tmp") 2>/dev/null; then
+    echo "impeccable: engine $version is not installed; cannot write to cache directory: $cache_root/bin/$version" >&2
+    setup_help
+    exit 127
+  fi
+  fetched=0
+  if fetch_url "$url"; then
+    fetched=1
+  elif [ "$os" = windows ] && [ "$arch" = arm64 ]; then
+    # Windows on ARM runs x64 binaries; fall back when no arm64 asset exists.
+    url="$base/engine-v$version/impeccable-windows-x64.exe"
+    fetch_url "$url" && fetched=1
+  fi
+  if [ "$fetched" = 1 ]; then
+    check_download
+    # Fail closed: a freshly downloaded binary runs only after verifying
+    # against its .sha256 sidecar. A sidecar that cannot be fetched, or a
+    # machine with no sha256 tool, refuses the download instead of exec'ing
+    # an unverified binary. (A binary already on PATH or in the cache that
+    # passes engine-probe is unaffected.)
+    sidecar_ok=0
+    if command -v curl >/dev/null 2>&1; then
+      curl -fsSL --retry 2 -o "$tmp.sha256" "$url.sha256" 2>/dev/null && sidecar_ok=1
+    elif command -v wget >/dev/null 2>&1; then
+      wget -q -O "$tmp.sha256" "$url.sha256" 2>/dev/null && sidecar_ok=1
+    fi
+    check_download
+    expected=""
+    [ "$sidecar_ok" = 1 ] && expected=$(cut -d' ' -f1 < "$tmp.sha256")
+    actual=""
+    if command -v shasum >/dev/null 2>&1; then
+      if digest=$(shasum -a 256 "$tmp" 2>/dev/null); then actual=${digest%% *}; fi
+    elif command -v sha256sum >/dev/null 2>&1; then
+      if digest=$(sha256sum "$tmp" 2>/dev/null); then actual=${digest%% *}; fi
+    fi
+    check_download
+    rm -f "$tmp.sha256"
+    if [ -z "$expected" ] || [ -z "$actual" ]; then
+      rm -f "$tmp"
+      echo "impeccable: cannot verify $url against $url.sha256 (sidecar unavailable or hashing failed); refusing the unverified download" >&2
+      exit 127
+    fi
+    if [ "$actual" != "$expected" ]; then
+      rm -f "$tmp"
+      echo "impeccable: checksum mismatch downloading $url" >&2
+      exit 127
+    fi
+    check_download
+    if ! chmod +x "$tmp" 2>/dev/null; then
+      check_download
+      rm -f "$tmp"
+      echo "impeccable: could not make the verified download executable: $url" >&2
+      exit 127
+    fi
+    check_download
+    if ! mv -f "$tmp" "$cached" 2>/dev/null; then
+      check_download
+      rm -f "$tmp"
+      echo "impeccable: could not cache the verified download: $url" >&2
+      exit 127
+    fi
+    check_download "$cached"
+    exec "$cached" "$@"
+  fi
+  rm -f "$tmp" 2>/dev/null
+  echo "impeccable: could not download engine $version from $url; check network access, the release URL, and curl or wget availability." >&2
+  setup_help
+  exit 127
+fi
+
+echo "impeccable: no engine binary for $os-$arch found (looked in $bin, $cached, PATH)." >&2
+echo "Download impeccable-$os-$arch from https://github.com/pbakaus/impeccable/releases (tag engine-v$version) into $cache_root/bin/$version/impeccable$exe (then chmod +x), or set IMPECCABLE_BIN to a preinstalled engine binary. Docs: https://impeccable.style" >&2
+exit 127

package/bundled-skills/impeccable/scripts/impeccable.cmd

@@ -0,0 +1,214 @@
+@echo off
+setlocal
+rem Impeccable launcher (Windows). Runs bin\windows-<arch>\impeccable.exe next
+rem to this file, else a cached or freshly downloaded engine binary.
+rem
+rem Structure notes (this file is exercised by dry parsing and string-level
+rem tests, not yet on a real Windows machine):
+rem - No multi-line parenthesized blocks: cmd expands %var% at block parse
+rem   time, which made the old download path read back empty %url%/%cached%.
+rem   Linear goto flow keeps every expansion on its own line, and avoids
+rem   delayed expansion eating ! characters in user arguments.
+rem - The unversioned user binary and the PATH candidate are validated with
+rem   the engine-probe handshake (see :probe) so the retired 3.x npm CLI,
+rem   whose bin is also named impeccable, is never exec'd. IMPECCABLE_BIN,
+rem   the sibling binary, and the version-pinned cache stay trusted.
+rem - Downloads are verified against the .sha256 sidecar via certutil and
+rem   fail closed: a missing sidecar or hash tool refuses the download. On
+rem   ARM64 the arm64 asset is tried first and the x64 asset is the
+rem   fallback (Windows on ARM runs x64 binaries).
+if not defined IMPECCABLE_SKILL_DIR set "IMPECCABLE_SKILL_DIR=%~dp0.."
+if not defined IMPECCABLE_SELF set "IMPECCABLE_SELF=%~f0"
+set "arch=x64"
+if /I "%PROCESSOR_ARCHITECTURE%"=="ARM64" set "arch=arm64"
+
+if not defined IMPECCABLE_BIN goto no_env_bin
+if not exist "%IMPECCABLE_BIN%" goto no_env_bin
+set "run=%IMPECCABLE_BIN%"
+goto run
+:no_env_bin
+
+set "bin=%~dp0bin\windows-%arch%\impeccable.exe"
+if not exist "%bin%" goto no_sibling
+set "run=%bin%"
+goto run
+:no_sibling
+
+set "home_bin=%USERPROFILE%\.impeccable\bin\impeccable.exe"
+if not exist "%home_bin%" goto no_home_bin
+if defined IMPECCABLE_LAUNCHER_PROBE goto no_home_bin
+call :probe "%home_bin%"
+if not "%probe_ok%"=="1" goto no_home_bin
+set "run=%home_bin%"
+goto run
+:no_home_bin
+
+set "version="
+if exist "%~dp0VERSION" set /p version=<"%~dp0VERSION"
+if not defined IMPECCABLE_HOME set "IMPECCABLE_HOME=%USERPROFILE%\.impeccable"
+set "cached=%IMPECCABLE_HOME%\bin\%version%\impeccable.exe"
+if not defined version goto no_cache
+if not exist "%cached%" goto no_cache
+set "run=%cached%"
+goto run
+:no_cache
+
+if defined IMPECCABLE_LAUNCHER_PROBE goto download
+where impeccable >nul 2>nul
+if errorlevel 1 goto download
+call :probe impeccable
+if not "%probe_ok%"=="1" goto download
+impeccable %*
+exit /b
+
+:download
+rem Last resort: fetch this version's binary from the release channel into
+rem the version-pinned user cache, verify it, then run it. Never inside
+rem another launcher's probe: fail fast and quiet instead.
+if defined IMPECCABLE_LAUNCHER_PROBE exit /b 127
+if not defined version goto fail
+where curl.exe >nul 2>nul
+if errorlevel 1 goto curl_missing
+if not defined IMPECCABLE_DOWNLOAD_BASE set "IMPECCABLE_DOWNLOAD_BASE=https://github.com/pbakaus/impeccable/releases/download"
+if exist "%IMPECCABLE_HOME%\bin\%version%\" goto cache_ready
+mkdir "%IMPECCABLE_HOME%\bin\%version%" >nul 2>nul
+if errorlevel 1 goto cache_directory_failed
+:cache_ready
+rem Check the staging file too: an existing directory may be read-only.
+rem Redirection failures do not reliably update ERRORLEVEL in cmd.exe;
+rem branch on the command's failure directly. Never treat a directory as a
+rem staging file (later del cleanup would prompt to delete its contents).
+if exist "%cached%.part\" goto cache_write_failed
+(type nul >"%cached%.part") 2>nul || goto cache_write_failed
+set "asset=impeccable-windows-%arch%.exe"
+set "url=%IMPECCABLE_DOWNLOAD_BASE%/engine-v%version%/%asset%"
+curl.exe -fsSL -o "%cached%.part" "%url%" >nul 2>nul
+if not errorlevel 1 goto verify
+if not "%arch%"=="arm64" goto download_failed
+set "asset=impeccable-windows-x64.exe"
+set "url=%IMPECCABLE_DOWNLOAD_BASE%/engine-v%version%/%asset%"
+curl.exe -fsSL -o "%cached%.part" "%url%" >nul 2>nul
+if errorlevel 1 goto download_failed
+
+:verify
+call :check_download
+if errorlevel 1 exit /b 127
+rem Mirrors the sh launcher and fails closed: a freshly downloaded binary
+rem runs only after verifying against its .sha256 sidecar. A sidecar that
+rem cannot be fetched, or an empty certutil result, refuses the download
+rem instead of running an unverified binary.
+curl.exe -fsSL -o "%cached%.sha256" "%url%.sha256" >nul 2>nul
+if errorlevel 1 goto verify_refuse
+set "expected="
+set /p expected=<"%cached%.sha256"
+for /f "tokens=1" %%h in ("%expected%") do set "expected=%%h"
+call :check_download
+if errorlevel 1 exit /b 127
+set "actual="
+rem Reuse the sidecar staging file after reading expected. Check certutil's
+rem status before parsing: its error text on stdout is not a digest.
+certutil -hashfile "%cached%.part" SHA256 >"%cached%.sha256" 2>nul
+if errorlevel 1 goto verify_refuse
+call :check_download
+if errorlevel 1 exit /b 127
+for /f "usebackq skip=1 delims=" %%h in ("%cached%.sha256") do if not defined actual set "actual=%%h"
+del "%cached%.sha256" >nul 2>nul
+if not defined expected goto verify_refuse
+if not defined actual goto verify_refuse
+set "actual=%actual: =%"
+if /I "%actual%"=="%expected%" goto place
+del "%cached%.part" >nul 2>nul
+echo impeccable: checksum mismatch downloading %url% 1>&2
+exit /b 127
+
+:verify_refuse
+call :check_download
+if errorlevel 1 exit /b 127
+del "%cached%.part" >nul 2>nul
+del "%cached%.sha256" >nul 2>nul
+echo impeccable: cannot verify %url% against %url%.sha256; refusing the unverified download 1>&2
+exit /b 127
+
+:check_download
+set "download_file=%~1"
+if not defined download_file set "download_file=%cached%.part"
+if not exist "%download_file%" goto download_missing
+for %%f in ("%download_file%") do if %%~zf==0 goto download_empty
+exit /b 0
+
+:download_missing
+del "%cached%.sha256" >nul 2>nul
+echo impeccable: download completed but the file was removed before execution: %url%; check your antivirus quarantine or logs. Refusing to continue; do not disable protection. 1>&2
+exit /b 127
+
+:download_empty
+del "%download_file%" >nul 2>nul
+del "%cached%.sha256" >nul 2>nul
+echo impeccable: downloaded file is empty: %url%; refusing the unverified download 1>&2
+exit /b 127
+
+:place
+call :check_download
+if errorlevel 1 exit /b 127
+move /y "%cached%.part" "%cached%" >nul 2>nul
+if errorlevel 1 goto place_failed
+call :check_download "%cached%"
+if errorlevel 1 exit /b 127
+set "run=%cached%"
+goto run
+
+:place_failed
+call :check_download
+if errorlevel 1 exit /b 127
+del "%cached%.part" >nul 2>nul
+echo impeccable: could not cache the verified download: %url% 1>&2
+exit /b 127
+
+:run
+"%run%" %*
+exit /b
+
+:probe
+rem Sets probe_ok=1 when %1 answers the engine handshake: prints
+rem "impeccable-engine <version>" and exits 0. The 3.x npm CLI answers any
+rem unknown verb with "Unknown command", exit 1, so it never passes.
+set "probe_ok="
+set "probe_tmp=%TEMP%\impeccable-probe-%RANDOM%%RANDOM%.txt"
+set "IMPECCABLE_LAUNCHER_PROBE=1"
+"%~1" engine-probe >"%probe_tmp%" 2>nul
+set "probe_err=%ERRORLEVEL%"
+set "IMPECCABLE_LAUNCHER_PROBE="
+if not "%probe_err%"=="0" goto probe_done
+findstr /b /c:"impeccable-engine" "%probe_tmp%" >nul 2>nul
+if not errorlevel 1 set "probe_ok=1"
+:probe_done
+del "%probe_tmp%" >nul 2>nul
+exit /b 0
+
+:cache_directory_failed
+echo impeccable: engine %version% is not installed; cannot create cache directory: "%IMPECCABLE_HOME%\bin\%version%" 1>&2
+goto setup_failed
+
+:cache_write_failed
+echo impeccable: engine %version% is not installed; cannot write to cache directory: "%IMPECCABLE_HOME%\bin\%version%" 1>&2
+goto setup_failed
+
+:curl_missing
+echo impeccable: cannot download engine %version%; curl.exe is unavailable. 1>&2
+goto setup_failed
+
+:download_failed
+del "%cached%.part" >nul 2>nul
+echo impeccable: could not download engine %version% from %url%; check network access and the release URL. 1>&2
+
+:setup_failed
+echo Engine %version% setup needs network access and write permission to "%IMPECCABLE_HOME%\bin\%version%". 1>&2
+echo Run this launcher ("%~f0") with engine-probe in a terminal that has those permissions, then retry the original command. 1>&2
+echo Alternatively, set IMPECCABLE_HOME to a writable cache location, or IMPECCABLE_BIN to a preinstalled engine binary. 1>&2
+exit /b 127
+
+:fail
+del "%cached%.part" >nul 2>nul
+echo impeccable: no engine binary found (looked in %bin%, %cached%, PATH). 1>&2
+echo Download impeccable-windows-%arch%.exe from https://github.com/pbakaus/impeccable/releases (tag engine-v%version%) and save it as %cached%, or set IMPECCABLE_BIN to a preinstalled engine binary. Docs: https://impeccable.style 1>&2
+exit /b 127

package/bundled-skills/impeccable/scripts/live-browser-dom.js

@@ -0,0 +1,167 @@
+/**
+ * Browser-side DOM helpers for Impeccable live mode.
+ *
+ * Kept separate from live-browser.js so future browser script parts can share
+ * chrome mounting, lookup, focus, and picker helpers without depending on the
+ * full overlay UI bundle.
+ */
+(function (root) {
+  'use strict';
+  if (!root) return;
+
+  function createLiveBrowserDomHelpers({
+    prefix,
+    skipTags,
+    document: doc = root.document,
+    css = root.CSS,
+    crypto = root.crypto,
+  } = {}) {
+    if (!prefix) throw new Error('prefix required');
+    if (!doc) throw new Error('document required');
+    const tagsToSkip = skipTags || new Set();
+
+    function own(el) {
+      return el && (el.id?.startsWith(prefix) || el.closest?.('[id^="' + prefix + '"]'));
+    }
+
+    function pickable(el) {
+      if (!el || el.nodeType !== 1) return false;
+      if (tagsToSkip.has(String(el.tagName || '').toLowerCase())) return false;
+      if (own(el)) return false;
+      const r = el.getBoundingClientRect();
+      return r.width >= 20 && r.height >= 20;
+    }
+
+    function desc(el) {
+      if (!el) return '';
+      let s = el.tagName.toLowerCase();
+      if (el.id) s += '#' + el.id;
+      else if (el.classList.length) s += '.' + [...el.classList].slice(0, 2).join('.');
+      return s;
+    }
+
+    function rectIsUsableAnchor(rect) {
+      return !!rect && rect.width > 0.5 && rect.height > 0.5;
+    }
+
+    function makeFrozenAnchor(el) {
+      if (!el || !el.getBoundingClientRect) return null;
+      const r = el.getBoundingClientRect();
+      if (!rectIsUsableAnchor(r)) return null;
+      const rect = {
+        x: r.x, y: r.y,
+        top: r.top, left: r.left,
+        right: r.right, bottom: r.bottom,
+        width: r.width, height: r.height,
+      };
+      return {
+        __impeccableFrozenAnchor: true,
+        tagName: el.tagName || 'DIV',
+        id: el.id || '',
+        classList: el.classList ? [...el.classList] : [],
+        hasAttribute: () => false,
+        getBoundingClientRect: () => rect,
+      };
+    }
+
+    function hasFrameworkHmrOwnership(el) {
+      for (let node = el; node; node = node.parentElement) {
+        let keys = [];
+        try { keys = Object.getOwnPropertyNames(node); } catch {}
+        if (keys.some((key) => (
+          key.startsWith('__reactFiber$')
+          || key.startsWith('__reactProps$')
+          || key.startsWith('__reactContainer$')
+          || key === '_reactRootContainer'
+          || key === '__vueParentComponent'
+          || key === '__vue_app__'
+          || key === '__vnode'
+          || key === '__svelte_meta'
+        ))) {
+          return true;
+        }
+      }
+      return false;
+    }
+
+    function id8() {
+      if (crypto?.randomUUID) return crypto.randomUUID().replace(/-/g, '').slice(0, 8);
+      return (Math.random().toString(16).slice(2) + Date.now().toString(16)).slice(0, 8);
+    }
+
+    function cssId(id) {
+      if (css?.escape) return css.escape(id);
+      return String(id).replace(/([ !"#$%&'()*+,./:;<=>?@[\\\]^`{|}~])/g, '\\$1');
+    }
+
+    function liveUiRoot() {
+      const uiRoot = root.__IMPECCABLE_LIVE_UI_ROOT__;
+      if (uiRoot && typeof uiRoot.appendChild === 'function') return uiRoot;
+      return doc.body;
+    }
+
+    function uiAppend(el) {
+      liveUiRoot().appendChild(el);
+      return el;
+    }
+
+    function uiAppendStyle(styleEl) {
+      const uiRoot = liveUiRoot();
+      if (uiRoot && uiRoot !== doc.body) uiRoot.appendChild(styleEl);
+      else doc.head.appendChild(styleEl);
+      return styleEl;
+    }
+
+    function uiGetById(id) {
+      const uiRoot = liveUiRoot();
+      if (uiRoot?.getElementById) {
+        const found = uiRoot.getElementById(id);
+        if (found) return found;
+      }
+      if (uiRoot?.querySelector) {
+        const found = uiRoot.querySelector('#' + cssId(id));
+        if (found) return found;
+      }
+      return doc.getElementById(id);
+    }
+
+    function activeElementDeep() {
+      let active = doc.activeElement;
+      while (active?.shadowRoot?.activeElement) active = active.shadowRoot.activeElement;
+      return active;
+    }
+
+    function defangOutsideHandlers(rootEl, { setPointerEvents = true } = {}) {
+      if (!rootEl) return;
+      if (setPointerEvents) {
+        rootEl.style.setProperty('pointer-events', 'auto', 'important');
+      }
+      const stop = (e) => e.stopPropagation();
+      rootEl.addEventListener('pointerdown', stop);
+      rootEl.addEventListener('mousedown', stop);
+      rootEl.addEventListener('focusin', stop);
+    }
+
+    return {
+      own,
+      pickable,
+      desc,
+      rectIsUsableAnchor,
+      makeFrozenAnchor,
+      hasFrameworkHmrOwnership,
+      id8,
+      cssId,
+      liveUiRoot,
+      uiAppend,
+      uiAppendStyle,
+      uiGetById,
+      activeElementDeep,
+      defangOutsideHandlers,
+    };
+  }
+
+  root.__IMPECCABLE_LIVE_DOM__ = {
+    version: 1,
+    createLiveBrowserDomHelpers,
+  };
+})(typeof window !== 'undefined' ? window : globalThis);