playable-lessons 0.6.4 → 0.8.0

package/out/shared/h5pExporter.js

@@ -9,19 +9,27 @@
  * a useful message) rather than silently flatten; `exportH5P` throws on
  * stateful sources for the same reason.
  *
+ * The graph comes from the compiled Ink JSON (`parseCompiledInk`), so choice
+ * text and divert targets match what the player actually executes.
+ *
  * The package is "content-only": it declares its library dependencies in
  * h5p.json but does not bundle the libraries themselves. It imports into any
  * host that already has Branching Scenario installed (an LMS with H5P, Lumi
  * via the H5P Hub). Targets H5P.BranchingScenario 1.x semantics.
  */
 Object.defineProperty(exports, "__esModule", { value: true });
+exports.bytesToBase64 = void 0;
 exports.findStateConstructs = findStateConstructs;
 exports.describeStateConstructs = describeStateConstructs;
+exports.toBranchingScenarioContentFromCompiled = toBranchingScenarioContentFromCompiled;
 exports.toBranchingScenarioContent = toBranchingScenarioContent;
 exports.exportH5P = exportH5P;
-exports.bytesToBase64 = bytesToBase64;
-const inkParser_js_1 = require("./inkParser.js");
+exports.exportH5PFromCompiled = exportH5PFromCompiled;
 const storyExport_js_1 = require("./storyExport.js");
+const inkGraph_js_1 = require("./inkGraph.js");
+const zip_js_1 = require("./zip.js");
+var zip_js_2 = require("./zip.js");
+Object.defineProperty(exports, "bytesToBase64", { enumerable: true, get: function () { return zip_js_2.bytesToBase64; } });
 /**
  * Scan Ink source for constructs Branching Scenario cannot represent:
  * VAR declarations, ~ assignments/expressions, and any { ... } logic
@@ -49,46 +57,38 @@ function findStateConstructs(source) {
     return issues;
 }
 /** One-line human summary of why a story can't convert, for error messages. */
-function describeStateConstructs(issues) {
+function describeStateConstructs(issues, target = 'H5P Branching Scenario') {
     const shown = issues
         .slice(0, 5)
         .map((c) => `  line ${c.line} (${c.kind}): ${c.snippet}`)
         .join('\n');
     const more = issues.length > 5 ? `\n  …and ${issues.length - 5} more` : '';
-    return (`This story uses state that H5P Branching Scenario cannot represent:\n${shown}${more}\n` +
+    return (`This story uses state that ${target} cannot represent:\n${shown}${more}\n` +
         `Regenerate the story with "H5P / LMS compatible" enabled to get a convertible version.`);
 }
 // ─── Ink graph → Branching Scenario content ──────────────────────────────────
 /** Divert targets that mean "the story ends here". */
 const END_TARGETS = new Set(['END', 'DONE']);
-/**
- * The passage prose shown for a knot: lines up to the first choice, minus
- * structural lines (tags, diverts, stitch markers). Returned as escaped HTML
- * paragraphs.
- */
-function passageHtml(knot) {
-    const paragraphs = [];
-    for (const raw of knot.rawContent.split('\n')) {
-        const line = raw.trim();
-        if (!line)
-            continue;
-        if (line.startsWith('*') || line.startsWith('+'))
-            break; // choices begin
-        if (line.startsWith('#') || line.startsWith('->') || line.startsWith('='))
-            continue;
-        paragraphs.push(`<p>${(0, storyExport_js_1.escapeHtml)(line)}</p>`);
+/** The passage prose for a knot, as escaped HTML, plus any resolved image. */
+function passageHtml(knot, sceneImages) {
+    const paragraphs = knot.paragraphs.map((p) => `<p>${(0, storyExport_js_1.escapeHtml)(p)}</p>`);
+    const image = resolvedImage(knot, sceneImages);
+    if (image) {
+        paragraphs.unshift(`<img src="${(0, storyExport_js_1.escapeHtml)(image.src)}" alt="${(0, storyExport_js_1.escapeHtml)(image.alt)}" style="max-width:100%">`);
     }
     return paragraphs.join('\n') || '<p></p>';
 }
-/** The knot's plain divert target (first `-> target` outside a choice), if any. */
-function plainDivertTarget(knot) {
-    for (const raw of knot.rawContent.split('\n')) {
-        const line = raw.trim();
-        if (line.startsWith('*') || line.startsWith('+'))
-            break; // choice diverts don't count
-        const m = line.match(/^->\s*(\w+)/);
-        if (m)
-            return m[1];
+/**
+ * Pick the image for a knot. `# IMAGE:` must already be a data URL or an
+ * absolute http(s) URL (H5P has no access to the project's filesystem);
+ * `# IMAGE_PROMPT:` resolves through the generated scene-image map.
+ */
+function resolvedImage(knot, sceneImages) {
+    if (knot.imagePrompt && sceneImages?.[knot.imagePrompt]) {
+        return { src: sceneImages[knot.imagePrompt], alt: knot.imagePrompt };
+    }
+    if (knot.imagePath && /^(data:|https?:)/.test(knot.imagePath)) {
+        return { src: knot.imagePath, alt: knot.id.replace(/_/g, ' ') };
     }
     return null;
 }
@@ -98,30 +98,35 @@ function subContentId(n) {
     return `00000000-0000-4000-8000-${hex}`;
 }
 /**
- * Build the Branching Scenario content.json object from Ink source.
- * Throws if the story uses state (variables/conditionals).
- *
- * Mapping: each knot becomes one screen. A knot with choices becomes a
- * Branching Question (passage prose as the question, choices as alternatives);
- * a knot without choices becomes a text screen whose "proceed" follows the
- * knot's divert. Diverts to END/DONE (or nowhere) go to the end screen (-1).
+ * Build the Branching Scenario content.json object from a compiled story.
+ * Throws if the source uses state (variables/conditionals).
+ */
+function toBranchingScenarioContentFromCompiled(compiledJson, title, sceneImages) {
+    const graph = (0, inkGraph_js_1.parseCompiledInk)(compiledJson);
+    return graphToContent(graph, title, sceneImages);
+}
+/**
+ * Compile, gate, and build the Branching Scenario content object.
+ * Throws with a construct-by-construct explanation if the story uses state.
  */
-function toBranchingScenarioContent(source, title) {
+async function toBranchingScenarioContent(source, title, sceneImages) {
     const issues = findStateConstructs(source);
-    if (issues.length > 0) {
+    if (issues.length > 0)
         throw new Error(describeStateConstructs(issues));
-    }
-    const parsed = (0, inkParser_js_1.parseInkSource)(source);
-    if (parsed.knots.length === 0) {
+    const compiled = await (0, storyExport_js_1.compileInk)(source);
+    return toBranchingScenarioContentFromCompiled(compiled, title, sceneImages);
+}
+function graphToContent(graph, title, sceneImages) {
+    if (graph.knots.length === 0) {
         throw new Error('No knots found in the Ink source — nothing to export.');
     }
     // Order knots start-first: content[0] is where Branching Scenario begins.
-    const startId = parsed.topLevelDivert && parsed.knots.some((k) => k.id === parsed.topLevelDivert)
-        ? parsed.topLevelDivert
-        : parsed.knots[0].id;
+    const startId = graph.start && graph.knots.some((k) => k.id === graph.start)
+        ? graph.start
+        : graph.knots[0].id;
     const knots = [
-        ...parsed.knots.filter((k) => k.id === startId),
-        ...parsed.knots.filter((k) => k.id !== startId)
+        ...graph.knots.filter((k) => k.id === startId),
+        ...graph.knots.filter((k) => k.id !== startId)
     ];
     const idOf = new Map();
     knots.forEach((k, i) => idOf.set(k.id, i));
@@ -140,7 +145,7 @@ function toBranchingScenarioContent(source, title) {
         };
         if (knot.choices.length > 0) {
             const alternatives = knot.choices.map((c) => ({
-                text: c.text,
+                text: (0, storyExport_js_1.escapeHtml)(c.text),
                 nextContentId: resolve(c.target),
                 addFeedback: false,
                 feedback: { title: '', subtitle: '' }
@@ -149,9 +154,13 @@ function toBranchingScenarioContent(source, title) {
                 ...common,
                 type: {
                     library: 'H5P.BranchingQuestion 1.0',
-                    params: { branchingQuestion: { question: passageHtml(knot), alternatives } },
+                    params: { branchingQuestion: { question: passageHtml(knot, sceneImages), alternatives } },
                     subContentId: subContentId(i),
-                    metadata: { contentType: 'Branching Question', license: 'U', title: knot.title }
+                    metadata: {
+                        contentType: 'Branching Question',
+                        license: 'U',
+                        title: knot.id.replace(/_/g, ' ')
+                    }
                 },
                 nextContentId: -1
             };
@@ -160,11 +169,11 @@ function toBranchingScenarioContent(source, title) {
             ...common,
             type: {
                 library: 'H5P.AdvancedText 1.1',
-                params: { text: passageHtml(knot) },
+                params: { text: passageHtml(knot, sceneImages) },
                 subContentId: subContentId(i),
-                metadata: { contentType: 'Text', license: 'U', title: knot.title }
+                metadata: { contentType: 'Text', license: 'U', title: knot.id.replace(/_/g, ' ') }
             },
-            nextContentId: resolve(plainDivertTarget(knot) ?? '')
+            nextContentId: resolve(knot.nextTarget ?? '')
         };
     });
     return {
@@ -208,79 +217,21 @@ function h5pManifest(title) {
         ]
     };
 }
-// ─── Minimal ZIP writer (store method, no compression) ───────────────────────
-const CRC_TABLE = (() => {
-    const table = new Uint32Array(256);
-    for (let n = 0; n < 256; n++) {
-        let c = n;
-        for (let k = 0; k < 8; k++)
-            c = c & 1 ? 0xedb88320 ^ (c >>> 1) : c >>> 1;
-        table[n] = c >>> 0;
-    }
-    return table;
-})();
-function crc32(data) {
-    let crc = 0xffffffff;
-    for (let i = 0; i < data.length; i++) {
-        crc = CRC_TABLE[(crc ^ data[i]) & 0xff] ^ (crc >>> 8);
-    }
-    return (crc ^ 0xffffffff) >>> 0;
-}
-// Fixed DOS timestamp (2026-01-01 00:00) keeps output byte-identical across runs.
-const DOS_DATE = ((2026 - 1980) << 9) | (1 << 5) | 1;
-const DOS_TIME = 0;
-/** Assemble a store-only (uncompressed) zip from named UTF-8 entries. */
-function zipStore(entries) {
-    const encoder = new TextEncoder();
-    const chunks = [];
-    const central = [];
-    let offset = 0;
-    const u16 = (v) => new Uint8Array([v & 0xff, (v >> 8) & 0xff]);
-    const u32 = (v) => new Uint8Array([v & 0xff, (v >>> 8) & 0xff, (v >>> 16) & 0xff, (v >>> 24) & 0xff]);
-    const cat = (...parts) => {
-        const total = parts.reduce((n, p) => n + p.length, 0);
-        const out = new Uint8Array(total);
-        let pos = 0;
-        for (const p of parts) {
-            out.set(p, pos);
-            pos += p.length;
-        }
-        return out;
-    };
-    for (const entry of entries) {
-        const name = encoder.encode(entry.name);
-        const data = encoder.encode(entry.text);
-        const crc = crc32(data);
-        // Local file header: flag bit 11 set = UTF-8 names; method 0 = store.
-        const local = cat(u32(0x04034b50), u16(20), u16(0x0800), u16(0), u16(DOS_TIME), u16(DOS_DATE), u32(crc), u32(data.length), u32(data.length), u16(name.length), u16(0), name, data);
-        central.push(cat(u32(0x02014b50), u16(20), u16(20), u16(0x0800), u16(0), u16(DOS_TIME), u16(DOS_DATE), u32(crc), u32(data.length), u32(data.length), u16(name.length), u16(0), u16(0), u16(0), u16(0), u32(0), u32(offset), name));
-        chunks.push(local);
-        offset += local.length;
-    }
-    const centralBlob = cat(...central);
-    const eocd = cat(u32(0x06054b50), u16(0), u16(0), u16(entries.length), u16(entries.length), u32(centralBlob.length), u32(offset), u16(0));
-    return cat(...chunks, centralBlob, eocd);
+/** Assemble the .h5p zip from an already-built content object. */
+function h5pZip(content, title) {
+    return (0, zip_js_1.zipStore)([
+        { name: 'h5p.json', data: JSON.stringify(h5pManifest(title)) },
+        { name: 'content/content.json', data: JSON.stringify(content) }
+    ]);
 }
-// ─── Public entry point ──────────────────────────────────────────────────────
 /**
  * Convert a pure-branching Ink story to a .h5p package (zip bytes).
  * Throws with a construct-by-construct explanation if the story uses state.
  */
-function exportH5P(inkSource, title) {
-    const content = toBranchingScenarioContent(inkSource, title);
-    return zipStore([
-        { name: 'h5p.json', text: JSON.stringify(h5pManifest(title)) },
-        { name: 'content/content.json', text: JSON.stringify(content) }
-    ]);
+async function exportH5P(inkSource, title, sceneImages) {
+    return h5pZip(await toBranchingScenarioContent(inkSource, title, sceneImages), title);
 }
-/** Base64-encode package bytes (works in both Node and the browser). */
-function bytesToBase64(bytes) {
-    const B = globalThis.Buffer;
-    if (B)
-        return B.from(bytes).toString('base64');
-    let binary = '';
-    for (let i = 0; i < bytes.length; i += 0x8000) {
-        binary += String.fromCharCode(...bytes.subarray(i, i + 0x8000));
-    }
-    return btoa(binary);
+/** Same as `exportH5P` when the caller already has the compiled JSON. */
+function exportH5PFromCompiled(compiledJson, title, sceneImages) {
+    return h5pZip(toBranchingScenarioContentFromCompiled(compiledJson, title, sceneImages), title);
 }

package/out/shared/imageClient.js

@@ -15,6 +15,8 @@ exports.isImageProviderConfigured = isImageProviderConfigured;
 exports.generateImage = generateImage;
 exports.normalizeImageBaseUrl = normalizeImageBaseUrl;
 const REQUEST_TIMEOUT_MS = 180_000; // image generation can be slow
+/** Refuse to download an image larger than this (protects renderer memory). */
+const MAX_IMAGE_BYTES = 25 * 1024 * 1024;
 /** Short style directive prepended to every scene prompt. */
 const STYLE_DIRECTIVES = {
     cartoon: 'Flat cartoon illustration: bold clean outlines, vibrant colors, simple storybook style.',
@@ -171,8 +173,16 @@ async function generateSwarmUIImage(prompt, config) {
     if (!Array.isArray(images) || typeof images[0] !== 'string') {
         throw new Error('SwarmUI returned no image');
     }
-    // 3. Fetch the generated image by its server path.
-    return fetchAsDataUrl(`${baseUrl}/${images[0].replace(/^\/+/, '')}`, headers);
+    // 3. Fetch the generated image by its server path. Only send the bearer
+    // token when the URL stays on the configured SwarmUI origin.
+    let origin;
+    try {
+        origin = new URL(baseUrl).origin;
+    }
+    catch {
+        origin = undefined;
+    }
+    return fetchAsDataUrl(`${baseUrl}/${images[0].replace(/^\/+/, '')}`, headers, origin);
 }
 /** Parse a '1024x576' size string into [width, height]; null if malformed. */
 function parseSize(size) {
@@ -206,13 +216,34 @@ async function fetchWithTimeout(url, options, timeoutMs = REQUEST_TIMEOUT_MS) {
         clearTimeout(timer);
     }
 }
-/** Download an image URL and return it as a data URL (avoids expiring URLs). */
-async function fetchAsDataUrl(url, headers = {}) {
-    const response = await fetchWithTimeout(url, { method: 'GET', headers }, 60_000);
+/**
+ * Download an image URL and return it as a data URL (avoids expiring URLs).
+ * Only absolute http(s) URLs are accepted, so a hostile custom provider
+ * cannot make the app read `file:`/`data:` URLs from the machine. Auth headers
+ * are only sent when the URL stays on `authOrigin`.
+ */
+async function fetchAsDataUrl(url, headers = {}, authOrigin) {
+    let parsed;
+    try {
+        parsed = new URL(url);
+    }
+    catch {
+        throw new Error('Image provider returned a non-absolute URL');
+    }
+    if (parsed.protocol !== 'http:' && parsed.protocol !== 'https:') {
+        throw new Error(`Refusing to fetch an image over ${parsed.protocol}`);
+    }
+    const sendHeaders = authOrigin && parsed.origin === authOrigin ? headers : {};
+    const response = await fetchWithTimeout(url, { method: 'GET', headers: sendHeaders }, 60_000);
     if (!response.ok)
         throw new Error(`Could not download image (${response.status})`);
+    const declared = Number(response.headers.get('content-length') || 0);
+    if (declared > MAX_IMAGE_BYTES)
+        throw new Error('Downloaded image is too large');
     const mime = response.headers.get('content-type')?.split(';')[0] || 'image/png';
     const buffer = await response.arrayBuffer();
+    if (buffer.byteLength > MAX_IMAGE_BYTES)
+        throw new Error('Downloaded image is too large');
     return `data:${mime};base64,${arrayBufferToBase64(buffer)}`;
 }
 /** ArrayBuffer → base64 without Node's Buffer (the renderer has no Buffer). */

package/out/shared/inkGraph.js

@@ -0,0 +1,188 @@
+"use strict";
+/**
+ * Read the story graph out of inkjs's compiled JSON instead of re-parsing the
+ * generated source with regular expressions.
+ *
+ * The compiled form is the runtime's own canonical representation, so choice
+ * text, divert targets, and tag placement are exactly what the player will
+ * see — no drifting from Ink's escaping/indentation rules.
+ *
+ * Scope: the exporters that use this (H5P, Twee, EPUB) only accept flat
+ * branching stories (see `findStateConstructs`). The reader extracts each
+ * knot's intro prose, its first-level choices, its plain divert, and its tags.
+ *
+ * Container wire format (inkjs `JsonSerialisation`):
+ *   [ ...contentItems, namedContentObjectOrNull ]
+ * Content items are `"^text"`, `"\n"`, control strings (`ev`, `str`, `end`, …),
+ * objects (`{"->": target}`, `{"*": path}`, `{"#": tag}`), or nested arrays.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.parseCompiledInk = parseCompiledInk;
+function splitContainer(arr) {
+    const content = arr.slice(0, -1);
+    const last = arr[arr.length - 1];
+    const named = last && typeof last === 'object' && !Array.isArray(last)
+        ? last
+        : null;
+    return { content, named };
+}
+/** Resolve a relative choice-body path (`".^.c-0"`) against a container's named content. */
+function namedTarget(named, relPath) {
+    const parts = String(relPath)
+        .split('.')
+        .filter((p) => p && p !== '^');
+    let obj = named;
+    for (let i = 0; i < parts.length - 1; i++) {
+        const next = obj ? obj[parts[i]] : null;
+        if (!Array.isArray(next))
+            return null;
+        obj = splitContainer(next).named;
+    }
+    const found = parts.length > 0 && obj ? obj[parts[parts.length - 1]] : null;
+    return Array.isArray(found) ? found : null;
+}
+/** First divert target anywhere in a container's content (choice bodies included). */
+function firstDivert(container) {
+    const { content } = splitContainer(container);
+    for (const item of content) {
+        if (Array.isArray(item)) {
+            const nested = firstDivert(item);
+            if (nested)
+                return nested;
+        }
+        else if (item && typeof item === 'object' && '->' in item) {
+            const target = item['->'];
+            if (typeof target === 'string')
+                return target;
+        }
+    }
+    return null;
+}
+/** First divert in a container, not descending into named content. */
+function firstDivertInContent(items) {
+    for (const item of items) {
+        if (Array.isArray(item)) {
+            const nested = firstDivert(item);
+            if (nested)
+                return nested;
+        }
+        else if (item && typeof item === 'object' && '->' in item) {
+            const target = item['->'];
+            if (typeof target === 'string')
+                return target;
+        }
+    }
+    return null;
+}
+function collectKnot(id, container) {
+    const paragraphs = [];
+    const tags = [];
+    const choices = [];
+    let nextTarget = null;
+    let prose = '';
+    let choiceText = null;
+    let tagMode = false;
+    let firstChoiceSeen = false;
+    const walk = (items, namedHere) => {
+        for (const item of items) {
+            if (typeof item === 'string') {
+                if (item === 'str') {
+                    choiceText = '';
+                }
+                else if (item === '/str' || item === 'ev' || item === '/ev') {
+                    // Choice text stays buffered until the choice point consumes it.
+                }
+                else if (item === '#') {
+                    tagMode = true;
+                }
+                else if (item === '/#') {
+                    tagMode = false;
+                }
+                else if (item === 'done' || item === 'end') {
+                    // Story terminator; nothing to record.
+                }
+                else if (item.startsWith('^')) {
+                    const text = item.slice(1);
+                    // Tags on a choice body belong to that branch, not the knot.
+                    if (tagMode) {
+                        if (!firstChoiceSeen)
+                            tags.push(text);
+                    }
+                    else if (choiceText !== null)
+                        choiceText += text;
+                    else if (!firstChoiceSeen)
+                        prose += text;
+                }
+                else if (item === '\n') {
+                    if (choiceText === null && !firstChoiceSeen)
+                        prose += '\n';
+                }
+            }
+            else if (Array.isArray(item)) {
+                const inner = splitContainer(item);
+                walk(inner.content, inner.named);
+            }
+            else if (item && typeof item === 'object') {
+                const obj = item;
+                if (typeof obj['*'] === 'string') {
+                    firstChoiceSeen = true;
+                    const body = namedTarget(namedHere, obj['*']);
+                    choices.push({ text: (choiceText ?? '').trim(), target: (body && firstDivert(body)) || '' });
+                    choiceText = null;
+                }
+                else if (typeof obj['->'] === 'string') {
+                    if (!firstChoiceSeen && nextTarget === null)
+                        nextTarget = obj['->'];
+                }
+                else if (typeof obj['#'] === 'string') {
+                    if (!firstChoiceSeen)
+                        tags.push(obj['#']);
+                }
+            }
+        }
+    };
+    const root = splitContainer(container);
+    walk(root.content, root.named);
+    for (const line of prose.split('\n')) {
+        const trimmed = line.trim();
+        if (trimmed)
+            paragraphs.push(trimmed);
+    }
+    const tagValue = (prefix) => {
+        const hit = tags.find((t) => t.startsWith(prefix));
+        return hit ? hit.slice(prefix.length).trim() || null : null;
+    };
+    return {
+        id,
+        paragraphs,
+        tags,
+        choices,
+        nextTarget,
+        imagePath: tagValue('IMAGE:'),
+        imagePrompt: tagValue('IMAGE_PROMPT:'),
+        endingType: tagValue('ENDING:')
+    };
+}
+/**
+ * Parse a compiled Ink JSON string/object into the knot-level graph the
+ * exporters need. Throws if the payload is not a compiled story.
+ */
+function parseCompiledInk(json) {
+    const data = typeof json === 'string' ? JSON.parse(json) : json;
+    if (!data || typeof data !== 'object' || !Array.isArray(data.root)) {
+        throw new Error('Not a compiled Ink story (missing root container)');
+    }
+    const root = splitContainer(data.root);
+    const start = firstDivertInContent(root.content);
+    const knots = [];
+    for (const [id, container] of Object.entries(root.named ?? {})) {
+        // `#f` and other flags are metadata, not knots.
+        if (id.startsWith('#') || !Array.isArray(container))
+            continue;
+        knots.push(collectKnot(id, container));
+    }
+    if (knots.length === 0) {
+        throw new Error('No knots found in the compiled story');
+    }
+    return { start, knots };
+}

package/out/shared/project.js

@@ -1,12 +1,6 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.projectIdFromName = projectIdFromName;
-/** A filesystem-safe, unique id derived from a name (+ short suffix). */
-function projectIdFromName(name) {
-    const slug = name
-        .toLowerCase()
-        .replace(/[^a-z0-9]+/g, '-')
-        .replace(/^-+|-+$/g, '')
-        .slice(0, 50) || 'project';
-    return `${slug}-${Date.now().toString(36)}`;
-}
+exports.projectIdFromName = exports.isSafeProjectId = void 0;
+var projectId_js_1 = require("./projectId.js");
+Object.defineProperty(exports, "isSafeProjectId", { enumerable: true, get: function () { return projectId_js_1.isSafeProjectId; } });
+Object.defineProperty(exports, "projectIdFromName", { enumerable: true, get: function () { return projectId_js_1.projectIdFromName; } });

package/out/shared/projectId.js

@@ -0,0 +1,24 @@
+"use strict";
+/**
+ * Project-id helpers with no imports, so the Electron main process can use
+ * them without pulling the renderer/AI modules into its TypeScript project.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.isSafeProjectId = isSafeProjectId;
+exports.projectIdFromName = projectIdFromName;
+/**
+ * True when a string is a project id this app created. Anything else (slashes,
+ * dots, absolute paths, empty) is rejected before it reaches a filesystem path.
+ */
+function isSafeProjectId(id) {
+    return typeof id === 'string' && /^[a-z0-9][a-z0-9-]{0,80}$/.test(id);
+}
+/** A filesystem-safe, unique id derived from a name (+ short suffix). */
+function projectIdFromName(name) {
+    const slug = name
+        .toLowerCase()
+        .replace(/[^a-z0-9]+/g, '-')
+        .replace(/^-+|-+$/g, '')
+        .slice(0, 50) || 'project';
+    return `${slug}-${Date.now().toString(36)}`;
+}