pikelet-wasm 0.8.0 → 0.9.0

package/complete/layer-locator.mjs

@@ -0,0 +1,228 @@
+// Parent resolution — LAYERED_PROFILE.md 5.1.1.
+//
+// Identity verification (3.2) prevents substitution of bytes. It does NOT
+// prevent a hostile manifest from directing a reader's fetches: a layer's
+// `parent.locator` is publisher-supplied, and the publisher is the adversary
+// for a distributed artifact. So a locator is confined before any fetch, and
+// every redirect hop is confined again with the same rule, never a weaker one.
+//
+// The governing principle of 5.1.1, which shapes every rule below:
+//
+//   "Normalization defects live in the disagreements between a validator and
+//    the server that finally interprets the path, so the reader refuses every
+//    form on which the two could disagree rather than picking one reading."
+//
+// That is why this module rejects rather than normalizes: an encoded separator
+// (%2f), an encoded or literal backslash, an encoded dot segment, or a doubled
+// slash all fail outright even though a normalizer could pick a reading for
+// each. Picking a reading is how these bugs happen.
+
+/** Forms on which a validator and a server could disagree. Checked on the raw
+ *  string, before any decoding, because decoding is itself a reading. */
+const FORBIDDEN_RAW = [
+    { re: /%2f/i, why: 'an encoded path separator (%2f)' },
+    { re: /%5c/i, why: 'an encoded backslash (%5c)' },
+    { re: /\\/, why: 'a literal backslash' },
+    { re: /%2e/i, why: 'an encoded dot segment (%2e)' },
+    { re: /\/\//, why: 'a doubled slash' },
+    { re: /%00/i, why: 'an encoded NUL' },
+    { re: /[\u0000-\u001f\u007f]/, why: 'a control character' },
+];
+
+/**
+ * Validate a `layer.parent.locator` as a relative reference, textually, before
+ * anything is fetched or resolved. 5.1.1: "A reader MUST reject a locator that
+ * violates this, at the manifest, before any fetch."
+ */
+export function validateLocatorShape(locator) {
+    if (typeof locator !== 'string' || locator.length === 0) {
+        throw new Error('locator must be a non-empty string');
+    }
+    if (locator.length > 1024) {
+        throw new Error('locator is implausibly long');
+    }
+    // Shape first, so the refusal names the actual violation: an absolute URL
+    // also trips the doubled-slash rule, and "contains a doubled slash" would
+    // be a confusing reason to reject "https://evil.example/x".
+    // MUST be a relative reference: no scheme, no authority.
+    if (/^[a-z][a-z0-9+.-]*:/i.test(locator)) {
+        throw new Error('locator must be a relative reference with no scheme');
+    }
+    if (locator.startsWith('//')) {
+        throw new Error('locator must have no authority');
+    }
+    for (const { re, why } of FORBIDDEN_RAW) {
+        if (re.test(locator)) throw new Error(`locator contains ${why}; refused rather than normalized`);
+    }
+    // An absolute path escapes the child's directory by construction.
+    if (locator.startsWith('/')) {
+        throw new Error('locator must be relative, not root-absolute');
+    }
+    // Dot segments in any form: a locator names a sibling, never a traversal.
+    const segments = locator.split('/');
+    for (const seg of segments) {
+        if (seg === '..' || seg === '.') {
+            throw new Error(`locator contains the dot segment ${JSON.stringify(seg)}`);
+        }
+    }
+    if (locator.endsWith('/')) {
+        throw new Error('locator must name a file, not a directory');
+    }
+    if (locator.includes('?') || locator.includes('#')) {
+        throw new Error('locator must carry no query or fragment');
+    }
+    return true;
+}
+
+/** The directory part of a URL path, with its trailing slash. */
+function directoryOf(pathname) {
+    const at = pathname.lastIndexOf('/');
+    return at === -1 ? '/' : pathname.slice(0, at + 1);
+}
+
+/**
+ * Resolve a locator against the child's own URL and confirm the result stays
+ * within the child's origin and directory.
+ *
+ * @param {string} locator  a locator that already passed validateLocatorShape
+ * @param {string} childUrl the URL the CHILD's bytes were fetched from
+ * @returns {string} the absolute URL to fetch the parent from
+ */
+export function resolveLocatorUrl(locator, childUrl) {
+    validateLocatorShape(locator);
+    let child;
+    try { child = new URL(childUrl); } catch (err) {
+        throw new Error(`child location ${JSON.stringify(childUrl)} is not a URL`, { cause: err });
+    }
+    if (child.protocol !== 'http:' && child.protocol !== 'https:') {
+        throw new Error(`parent resolution supports http and https only, not ${child.protocol}`);
+    }
+    const resolved = new URL(locator, child);
+    // Canonical comparison: URL already lowercases scheme and host and removes
+    // dot segments. The shape check above refused the forms where that
+    // normalization could disagree with a server's reading.
+    assertConfined(resolved, child, 'locator');
+    return resolved.href;
+}
+
+/**
+ * The confinement rule, applied to a locator's result and to EVERY redirect
+ * hop. 5.1.1: "Redirects encountered while fetching a parent are subject to the
+ * same confinement as the locator, not a weaker one ... and the check is
+ * repeated at every hop before the redirected request is issued."
+ *
+ * A same-origin redirect to a path outside the directory fails exactly as a
+ * cross-origin one does.
+ */
+export function assertConfined(target, child, what = 'redirect target') {
+    const t = target instanceof URL ? target : new URL(target);
+    const c = child instanceof URL ? child : new URL(child);
+    if (t.protocol !== c.protocol) {
+        throw new Error(`${what} changes scheme from ${c.protocol} to ${t.protocol}`);
+    }
+    if (t.host !== c.host) {
+        throw new Error(`${what} leaves the child's origin: ${t.host} is not ${c.host}`);
+    }
+    if (t.username || t.password) {
+        throw new Error(`${what} carries credentials`);
+    }
+    for (const { re, why } of FORBIDDEN_RAW) {
+        // Re-checked on the resolved href: a redirect's Location header is a
+        // fresh string from the network, not the validated locator.
+        if (re.test(t.pathname)) throw new Error(`${what} contains ${why}`);
+    }
+    const dir = directoryOf(c.pathname);
+    if (!t.pathname.startsWith(dir)) {
+        throw new Error(`${what} path ${t.pathname} is not under the child's directory ${dir}`);
+    }
+    if (t.pathname.length === dir.length) {
+        throw new Error(`${what} names the directory itself, not a file`);
+    }
+    return true;
+}
+
+/**
+ * The file-source analogue. 5.1.1 requires the check to run on the REAL path,
+ * "with every symbolic link followed", so a symlink cannot escape the
+ * directory. The caller supplies a realpath function because this module stays
+ * environment-neutral (no node:fs import in a file the browser bundle pulls in).
+ *
+ * @param {string} locator
+ * @param {string} childPath  the child artifact's path
+ * @param {{realpath: (p: string) => Promise<string>, dirname: (p: string) => string,
+ *          join: (...p: string[]) => string, sep?: string}} fsops
+ */
+export async function resolveLocatorPath(locator, childPath, fsops) {
+    validateLocatorShape(locator);
+    if (!fsops || typeof fsops.realpath !== 'function') {
+        throw new Error('resolveLocatorPath needs a realpath implementation');
+    }
+    const childDir = fsops.dirname(childPath);
+    // The child's own directory, resolved through links first: comparing against
+    // an unresolved directory would let a link in the PARENT position pass.
+    const realChildDir = await fsops.realpath(childDir);
+    const candidate = fsops.join(childDir, locator);
+    let realCandidate;
+    try {
+        realCandidate = await fsops.realpath(candidate);
+    } catch (err) {
+        // A locator naming something that does not exist is an availability
+        // failure (3.2), reported as such rather than as a security refusal.
+        throw new Error(`parent named by locator ${JSON.stringify(locator)} cannot be located`, { cause: err });
+    }
+    const sep = fsops.sep || '/';
+    const prefix = realChildDir.endsWith(sep) ? realChildDir : realChildDir + sep;
+    if (!realCandidate.startsWith(prefix)) {
+        throw new Error(`locator resolves to ${realCandidate}, outside the child's real directory ${realChildDir}`);
+    }
+    return realCandidate;
+}
+
+/**
+ * Resolution order of 5.1.1: lineage listing, then locator, then host resolver.
+ * Whatever located the bytes, the identity check of 3.2 is what admits them —
+ * so this returns a *candidate location only*, never a verdict on the bytes.
+ *
+ * A lineage listing is operator-supplied (the operator chose the shelf) and MAY
+ * name any origin the operator trusts; a manifest locator is publisher-supplied
+ * and gets the confinement above. That asymmetry is deliberate.
+ *
+ * @param {{identity: string, locator: string|null}} want
+ * @param {{lineage?: Map<string,string>|null, childLocation?: string|null,
+ *          kind?: 'url'|'file', resolveParents?: boolean,
+ *          hostResolver?: ((identity: string) => string|null)|null,
+ *          fsops?: object|null}} opts
+ */
+export async function resolveParentLocation(want, opts = {}) {
+    const {
+        lineage = null, childLocation = null, kind = 'url',
+        resolveParents = true, hostResolver = null, fsops = null,
+    } = opts;
+    if (!want || typeof want.identity !== 'string') throw new Error('resolveParentLocation needs the wanted identity');
+
+    // 1. Lineage listing: operator-supplied, trusted for location.
+    if (lineage && lineage.has(want.identity)) {
+        return { location: lineage.get(want.identity), via: 'lineage' };
+    }
+    // 2. Manifest locator: publisher-supplied, confined.
+    if (want.locator) {
+        if (!resolveParents) {
+            throw new Error('locator resolution is disabled (resolveParents: false) and no lineage listing names this parent');
+        }
+        if (!childLocation) {
+            throw new Error('a locator needs the child\'s own location to resolve against');
+        }
+        const location = kind === 'file'
+            ? await resolveLocatorPath(want.locator, childLocation, fsops)
+            : resolveLocatorUrl(want.locator, childLocation);
+        return { location, via: 'locator' };
+    }
+    // 3. Host resolver.
+    if (typeof hostResolver === 'function') {
+        const location = hostResolver(want.identity);
+        if (location) return { location, via: 'host' };
+    }
+    // 3.2: a reader that cannot locate an ancestor MUST fail the mount
+    // explicitly — never serve the layers it did reach as a partial corpus.
+    throw new Error(`cannot locate chain member ${want.identity.slice(0, 12)}…: no lineage entry, no locator and no host resolver`);
+}

package/complete/layer-manifest.mjs

@@ -0,0 +1,271 @@
+// Layer manifest validation — LAYERED_PROFILE.md 4.1, 4.2, 3.3.
+//
+// A layer is a complete-profile container with a `layer` object and profile
+// string `pikelet-layer-v1`. This module validates that object's shape
+// standalone, and then validates it against the parent a reader ACTUALLY
+// OPENED (3.3): locators are hints, identities are the truth, and every
+// arithmetic relation is re-derived rather than trusted.
+//
+// Nothing here reads bytes. The caller supplies a parsed manifest and, for the
+// relational checks, the parent's parsed manifest plus the identity the parent
+// was actually verified under. Keeping it pure makes the whole hostile-chain
+// family of section 10 testable without building files.
+
+export const LAYER_PROFILE = 'pikelet-layer-v1';
+// 2.7: 1 <= depth <= 16. The producer default is lower (8, still unmeasured —
+// see 13.5); this is the format ceiling a reader must refuse past.
+export const MAX_DEPTH = 16;
+// 3.3: a chain holds at most 2^31 - 1 records, ids 0 .. 2^31 - 2.
+export const MAX_RECORDS = 2 ** 31 - 1;
+// 3.3: warn once a chain's row total passes 2^30 so compaction can be
+// scheduled before appends start failing.
+export const ROW_TOTAL_WARN = 2 ** 30;
+
+const isHex64 = (v) => typeof v === 'string' && /^[0-9a-f]{64}$/.test(v);
+const isCount = (v, max = MAX_RECORDS) => Number.isSafeInteger(v) && v >= 0 && v <= max;
+
+/**
+ * Canonical JSON, for the equality comparisons 4.1 requires on `encoder` and
+ * `layer.ingest`. Object keys sorted, no insignificant whitespace. Must match
+ * the builder's canonicalization or the equality checks are meaningless.
+ */
+export function canonicalJson(value) {
+    if (value === null || typeof value !== 'object') return JSON.stringify(value);
+    if (Array.isArray(value)) return `[${value.map(canonicalJson).join(',')}]`;
+    const keys = Object.keys(value).filter((k) => value[k] !== undefined).sort();
+    return `{${keys.map((k) => `${JSON.stringify(k)}:${canonicalJson(value[k])}`).join(',')}}`;
+}
+
+/**
+ * Validate a layer manifest's own `layer` object — everything checkable
+ * without the parent. Throws on the first violation; the message names the
+ * field so a hostile chain's refusal says which rule it broke.
+ *
+ * @returns {{identityFields: {parentIdentity: string, baseIdentity: string},
+ *            depth: number, rowBase: number, records: number,
+ *            tombstones: number, supersessions: number,
+ *            tombstoneOnly: boolean, locator: string|null}}
+ */
+export function validateLayerObject(manifest) {
+    if (!manifest || typeof manifest !== 'object') throw new Error('layer manifest is not an object');
+    if (manifest.profile !== LAYER_PROFILE) {
+        throw new Error(`layer manifest profile is ${JSON.stringify(manifest.profile)}, expected ${LAYER_PROFILE}`);
+    }
+    const layer = manifest.layer;
+    if (!layer || typeof layer !== 'object' || Array.isArray(layer)) {
+        throw new Error('layer manifest has no layer object');
+    }
+    const parent = layer.parent;
+    if (!parent || typeof parent !== 'object' || Array.isArray(parent)) {
+        throw new Error('layer.parent is missing');
+    }
+    if (!isHex64(parent.identity)) {
+        throw new Error('layer.parent.identity must be 64 lowercase hex characters');
+    }
+    if (parent.locator !== undefined && typeof parent.locator !== 'string') {
+        throw new Error('layer.parent.locator, when present, must be a string');
+    }
+    if (!isHex64(layer.baseIdentity)) {
+        throw new Error('layer.baseIdentity must be 64 lowercase hex characters');
+    }
+    if (!Number.isSafeInteger(layer.depth) || layer.depth < 1 || layer.depth > MAX_DEPTH) {
+        throw new Error(`layer.depth must be an integer in [1, ${MAX_DEPTH}], got ${layer.depth}`);
+    }
+    if (!isCount(layer.rowBase)) {
+        throw new Error(`layer.rowBase must be an integer in [0, ${MAX_RECORDS}], got ${layer.rowBase}`);
+    }
+    if (!isCount(layer.records)) {
+        throw new Error(`layer.records must be an integer in [0, ${MAX_RECORDS}], got ${layer.records}`);
+    }
+    // 3.3: every rowBase + records sum is bounded by the id ceiling.
+    if (layer.rowBase + layer.records > MAX_RECORDS) {
+        throw new Error(`layer.rowBase + layer.records (${layer.rowBase + layer.records}) exceeds ${MAX_RECORDS}`);
+    }
+    // 3.4: the cumulative bitset covers [0, rowBase), so it cannot hold more
+    // bits than that, and a layer cannot tombstone its own rows.
+    if (!isCount(layer.tombstones) || layer.tombstones > layer.rowBase) {
+        throw new Error(`layer.tombstones must be an integer in [0, rowBase=${layer.rowBase}], got ${layer.tombstones}`);
+    }
+    if (!isCount(layer.supersessions, layer.rowBase)) {
+        throw new Error(`layer.supersessions must be an integer in [0, rowBase=${layer.rowBase}], got ${layer.supersessions}`);
+    }
+    // 3.5: each supersession's oldId must be tombstoned in this layer's
+    // bitset, and oldId is unique within a layer, so there cannot be more
+    // edges than tombstones.
+    if (layer.supersessions > layer.tombstones) {
+        throw new Error(`layer.supersessions (${layer.supersessions}) exceeds layer.tombstones (${layer.tombstones}); every oldId must be tombstoned and is unique per layer`);
+    }
+    // 3.5: newId lies in this layer's own id range, so a layer with no
+    // records of its own can record no supersession.
+    if (layer.records === 0 && layer.supersessions > 0) {
+        throw new Error('a tombstone-only layer cannot record a supersession: newId must lie in its own id range');
+    }
+    if (layer.ingest === undefined || layer.ingest === null || typeof layer.ingest !== 'object' || Array.isArray(layer.ingest)) {
+        throw new Error('layer.ingest is missing; appendability requires an ingestion declaration (6.1)');
+    }
+    // 4.1: ingestAsserted is a SIBLING of layer.ingest, never a member of it.
+    // If it were a member, asserting a declaration would change its canonical
+    // form and a compacted base's corpus.ingest would not be byte-identical to
+    // the declaration the chain carried (6.3).
+    if ('ingestAsserted' in layer.ingest) {
+        throw new Error('layer.ingest must not contain ingestAsserted; it is a sibling field inside layer, not part of the declaration');
+    }
+    if (layer.ingestAsserted !== undefined && typeof layer.ingestAsserted !== 'boolean') {
+        throw new Error('layer.ingestAsserted, when present, must be a boolean');
+    }
+
+    // 4.1: corpus.records MUST equal layer.records. A tombstone-only layer
+    // still carries a corpus object, with records 0 and provenance, and MUST
+    // omit the layout fields and the index object.
+    const corpus = manifest.corpus;
+    if (!corpus || typeof corpus !== 'object' || Array.isArray(corpus)) {
+        throw new Error('layer manifest has no corpus block');
+    }
+    if (corpus.records !== layer.records) {
+        throw new Error(`manifest corpus.records (${corpus.records}) must equal layer.records (${layer.records})`);
+    }
+    const tombstoneOnly = layer.records === 0;
+    const layoutFields = ['layout', 'pageRecords', 'pages', 'recordDigest', 'pageTableSha256'];
+    if (tombstoneOnly) {
+        for (const f of layoutFields) {
+            if (corpus[f] !== undefined) {
+                throw new Error(`a tombstone-only layer must omit corpus.${f}: it has no corpus segment to describe`);
+            }
+        }
+        if (manifest.index !== undefined) {
+            throw new Error('a tombstone-only layer must omit the index object: it has no index segment');
+        }
+    } else {
+        if (typeof corpus.layout !== 'string') {
+            throw new Error('a layer with records must declare corpus.layout');
+        }
+        if (!manifest.index || typeof manifest.index !== 'object') {
+            throw new Error('a layer with records must carry an index object');
+        }
+    }
+
+    return {
+        identityFields: { parentIdentity: parent.identity, baseIdentity: layer.baseIdentity },
+        depth: layer.depth,
+        rowBase: layer.rowBase,
+        records: layer.records,
+        tombstones: layer.tombstones,
+        supersessions: layer.supersessions,
+        tombstoneOnly,
+        locator: typeof parent.locator === 'string' ? parent.locator : null,
+    };
+}
+
+/**
+ * The relational checks of 3.3 and 4.1, against the parent a reader actually
+ * opened and verified. `parentIdentity` is the identity the parent's own bytes
+ * hashed to — never a value read out of the child.
+ *
+ * @param {object} childManifest
+ * @param {{manifest: object, identity: string, isBase: boolean}} parent
+ */
+export function validateAgainstParent(childManifest, parent) {
+    const child = validateLayerObject(childManifest);
+    if (!parent || typeof parent !== 'object') throw new Error('no parent supplied');
+    const { manifest: pm, identity: parentIdentity, isBase } = parent;
+    if (!isHex64(parentIdentity)) throw new Error('parent identity must be 64 lowercase hex characters');
+
+    // 3.2: refuse a chain in which any opened parent's identity differs from
+    // the identity its child committed to. This is the hash-chain link.
+    if (child.identityFields.parentIdentity !== parentIdentity) {
+        throw new Error(`layer commits to parent identity ${child.identityFields.parentIdentity.slice(0, 12)}… but the opened parent is ${parentIdentity.slice(0, 12)}…`);
+    }
+
+    const parentDepth = isBase ? 0 : pm?.layer?.depth;
+    const parentRowBase = isBase ? 0 : pm?.layer?.rowBase;
+    const parentRecords = pm?.corpus?.records;
+    if (!isBase) {
+        if (!Number.isSafeInteger(parentDepth)) throw new Error('parent layer.depth is not an integer');
+        if (!Number.isSafeInteger(parentRowBase)) throw new Error('parent layer.rowBase is not an integer');
+    }
+    if (!Number.isSafeInteger(parentRecords)) throw new Error('parent corpus.records is not an integer');
+
+    // 3.3, verified against the parent actually opened:
+    //   layer.rowBase == parent.layer.rowBase + parent.corpus.records  (parent a layer)
+    //   layer.rowBase == parent.corpus.records                         (parent the base)
+    const expectedRowBase = isBase ? parentRecords : parentRowBase + parentRecords;
+    if (child.rowBase !== expectedRowBase) {
+        throw new Error(`layer.rowBase is ${child.rowBase} but the opened parent implies ${expectedRowBase}`);
+    }
+    if (child.depth !== parentDepth + 1) {
+        throw new Error(`layer.depth is ${child.depth} but the opened parent is at depth ${parentDepth}`);
+    }
+    // layer.baseIdentity == parent.layer.baseIdentity, or the parent's own
+    // identity when the parent is the base.
+    const expectedBase = isBase ? parentIdentity : pm?.layer?.baseIdentity;
+    if (child.identityFields.baseIdentity !== expectedBase) {
+        throw new Error(`layer.baseIdentity is ${String(child.identityFields.baseIdentity).slice(0, 12)}… but the chain's base is ${String(expectedBase).slice(0, 12)}…`);
+    }
+
+    // 4.1: encoder, dim and metric MUST equal the base's. Checked against the
+    // parent here, which gives the same result transitively along the chain and
+    // catches the difference at the layer that introduced it.
+    if (canonicalJson(childManifest.encoder) !== canonicalJson(pm?.encoder)) {
+        throw new Error('layer encoder object differs from its parent\'s; a chain may not change the encoder');
+    }
+    if (childManifest.dim !== pm?.dim) {
+        throw new Error(`layer dim ${childManifest.dim} differs from its parent's ${pm?.dim}`);
+    }
+    if (childManifest.metric !== pm?.metric) {
+        throw new Error(`layer metric ${JSON.stringify(childManifest.metric)} differs from its parent's ${JSON.stringify(pm?.metric)}`);
+    }
+
+    return child;
+}
+
+/**
+ * The chain ingestion declaration of 4.1/6.1: the base's `corpus.ingest` when
+ * the base carries one; otherwise the depth-1 layer's `layer.ingest`, which
+ * must then be marked `ingestAsserted`. Returns the canonical form to compare
+ * every layer against, plus whether the chain is asserted.
+ */
+export function chainIngestDeclaration(baseManifest, depth1Manifest) {
+    const baseIngest = baseManifest?.corpus?.ingest;
+    if (baseIngest !== undefined && baseIngest !== null) {
+        return { canonical: canonicalJson(baseIngest), asserted: false, source: 'base' };
+    }
+    if (!depth1Manifest) {
+        throw new Error('the base carries no corpus.ingest and no depth-1 layer was supplied: the chain has no ingestion declaration (6.1)');
+    }
+    const layer = depth1Manifest.layer || {};
+    if (layer.ingestAsserted !== true) {
+        throw new Error('the base carries no corpus.ingest, so the depth-1 layer must set layer.ingestAsserted true to introduce one (6.1)');
+    }
+    return { canonical: canonicalJson(layer.ingest), asserted: true, source: 'depth-1' };
+}
+
+/**
+ * Check one layer's declaration against the chain's. Only the depth-1 layer of
+ * an assertion-bearing chain can introduce the assertion; no later layer may
+ * introduce, drop or change one.
+ */
+export function validateIngestAgainstChain(layerManifest, chainDecl) {
+    const layer = layerManifest?.layer || {};
+    if (canonicalJson(layer.ingest) !== chainDecl.canonical) {
+        throw new Error(`layer at depth ${layer.depth} carries an ingestion declaration that differs from the chain's (6.1)`);
+    }
+    const asserted = layer.ingestAsserted === true;
+    if (chainDecl.asserted && !asserted) {
+        throw new Error(`layer at depth ${layer.depth} must carry ingestAsserted true on an asserted chain`);
+    }
+    if (!chainDecl.asserted && asserted) {
+        throw new Error(`layer at depth ${layer.depth} asserts an ingestion declaration, but the chain's base declares one`);
+    }
+    return true;
+}
+
+/**
+ * `rowTotal(A) = A.rowBase + A.records` (3.1) — the number of ids that existed
+ * when A was the head. For a base it is just its record count.
+ */
+export function rowTotal(manifest) {
+    const rb = manifest?.layer?.rowBase;
+    const records = manifest?.corpus?.records;
+    if (!Number.isSafeInteger(records)) throw new Error('manifest corpus.records is not an integer');
+    return (Number.isSafeInteger(rb) ? rb : 0) + records;
+}