superbee 0.4.4-pre.13 → 0.4.4-pre.15

package/dist/publication.mjs

@@ -63,8 +63,8 @@ var require_common = __commonJS({
       return target;
     }
     function repeat(string3, count) {
-      var result = "", cycle;
-      for (cycle = 0; cycle < count; cycle += 1) {
+      var result = "", cycle2;
+      for (cycle2 = 0; cycle2 < count; cycle2 += 1) {
         result += string3;
       }
       return result;
@@ -30835,6 +30835,14 @@ var InvalidInputError = class extends Error {
     this.name = "InvalidInputError";
   }
 };
+var FrontmatterRefusedError = class extends InvalidInputError {
+  code;
+  constructor(code2, detail) {
+    super(`frontmatter cannot be stored: ${detail}`);
+    this.name = "FrontmatterRefusedError";
+    this.code = code2;
+  }
+};
 var FilesystemIdentityAliasError = class extends InvalidInputError {
   rel;
   segment;
@@ -30859,12 +30867,21 @@ var ConcurrentReplacementError = class extends Error {
   }
 };
 
-// ../core/src/portable-frontmatter.ts
+// ../core/src/bounded-yaml.ts
 var import_js_yaml = __toESM(require_js_yaml2(), 1);
 
 // ../core/src/frontmatter-contract.ts
+var FrontmatterLimitError = class extends Error {
+  name = "FrontmatterLimitError";
+  code;
+  constructor(code2, message) {
+    super(message);
+    this.code = code2;
+  }
+};
 var MalformedDocumentError = class extends Error {
   name = "MalformedDocumentError";
+  code;
   context;
   detail;
   constructor(context, cause) {
@@ -30872,12 +30889,165 @@ var MalformedDocumentError = class extends Error {
     super(
       `malformed frontmatter${context ? ` in '${context}'` : ""}: ${detail} \u2014 fix the YAML or remove the file`
     );
+    this.code = cause instanceof FrontmatterLimitError ? cause.code : "FRONTMATTER_MALFORMED";
     if (context !== void 0) this.context = context;
     this.detail = detail;
     if (cause !== void 0) this.cause = cause;
   }
 };
 
+// ../core/src/bounded-yaml.ts
+var FRONTMATTER_LIMITS = Object.freeze({
+  sourceChars: 256 * 1024,
+  depth: 32,
+  aliases: 1e3,
+  expandedNodes: 1e5,
+  expandedChars: 1024 * 1024
+});
+var PARSE_NESTING_GUARD = FRONTMATTER_LIMITS.depth * 4;
+function tooDeep() {
+  return new FrontmatterLimitError("FRONTMATTER_TOO_DEEP", `YAML nesting is deeper than ${FRONTMATTER_LIMITS.depth} levels`);
+}
+function tooLarge() {
+  return new FrontmatterLimitError(
+    "FRONTMATTER_ALIAS_LIMIT",
+    `YAML aliases expand to more than ${FRONTMATTER_LIMITS.expandedNodes} nodes or ${FRONTMATTER_LIMITS.expandedChars} characters`
+  );
+}
+function cycle() {
+  return new FrontmatterLimitError("FRONTMATTER_CYCLE", "YAML aliases form a cycle");
+}
+function scalarExtent(value) {
+  const chars = typeof value === "string" ? value.length : ArrayBuffer.isView(value) ? value.byteLength : 0;
+  return { nodes: 1, chars, depth: 0 };
+}
+function isCollection(value) {
+  if (Array.isArray(value)) return true;
+  if (value === null || typeof value !== "object") return false;
+  const prototype = Object.getPrototypeOf(value);
+  return prototype === Object.prototype || prototype === null;
+}
+var ExtentMeter = class {
+  known = /* @__PURE__ */ new Map();
+  path = /* @__PURE__ */ new Set();
+  unfinished;
+  constructor(unfinished = /* @__PURE__ */ new Set()) {
+    this.unfinished = unfinished;
+  }
+  measure(value) {
+    if (!isCollection(value)) return scalarExtent(value);
+    const known = this.known.get(value);
+    if (known !== void 0) return known;
+    if (this.path.has(value) || this.unfinished.has(value)) throw cycle();
+    return this.walk(value);
+  }
+  walk(value) {
+    if (this.path.size >= FRONTMATTER_LIMITS.depth) throw tooDeep();
+    this.path.add(value);
+    const keyed = !Array.isArray(value);
+    const extent = { nodes: 1, chars: 0, depth: 1 };
+    for (const [key, child] of Object.entries(value)) {
+      const inner = this.measure(child);
+      extent.nodes += inner.nodes;
+      extent.chars += inner.chars + (keyed ? key.length : 0);
+      extent.depth = Math.max(extent.depth, inner.depth + 1);
+      if (extent.nodes > FRONTMATTER_LIMITS.expandedNodes || extent.chars > FRONTMATTER_LIMITS.expandedChars) throw tooLarge();
+      if (extent.depth > FRONTMATTER_LIMITS.depth) throw tooDeep();
+    }
+    this.path.delete(value);
+    this.known.set(value, extent);
+    return extent;
+  }
+};
+var AliasBudget = class {
+  unfinished = /* @__PURE__ */ new Set();
+  finished = /* @__PURE__ */ new Set();
+  meter = new ExtentMeter(this.unfinished);
+  aliases = 0;
+  nodes = 0;
+  chars = 0;
+  /** Wrap the parser's anchor table; the parser reads it only to resolve an alias. */
+  watch(state) {
+    state.anchorMap = new Proxy(state.anchorMap, {
+      get: (target, name, receiver) => {
+        const value = Reflect.get(target, name, receiver);
+        if (typeof name === "string") this.charge(name, value);
+        return value;
+      },
+      set: (target, name, value, receiver) => {
+        if (typeof name === "string") {
+          this.finished.delete(name);
+          if (isCollection(value)) this.unfinished.add(value);
+        }
+        return Reflect.set(target, name, value, receiver);
+      }
+    });
+  }
+  /** Called when an anchored node closes: its anchor now names a complete value. */
+  close(anchor, value) {
+    this.finished.add(anchor);
+    if (isCollection(value)) this.unfinished.delete(value);
+  }
+  charge(name, value) {
+    this.aliases += 1;
+    if (this.aliases > FRONTMATTER_LIMITS.aliases) {
+      throw new FrontmatterLimitError(
+        "FRONTMATTER_ALIAS_LIMIT",
+        `YAML aliases are used more than ${FRONTMATTER_LIMITS.aliases} times`
+      );
+    }
+    if (!this.finished.has(name) && isCollection(value)) throw cycle();
+    const extent = this.meter.measure(value);
+    this.nodes += extent.nodes;
+    this.chars += extent.chars;
+    if (this.nodes > FRONTMATTER_LIMITS.expandedNodes || this.chars > FRONTMATTER_LIMITS.expandedChars) throw tooLarge();
+  }
+};
+var MERGE_KEY_LIMIT_REASON = "merge keys exceeded maxTotalMergeKeys";
+function loadBoundedYaml(source, options = {}) {
+  if (source.length > FRONTMATTER_LIMITS.sourceChars) {
+    throw new FrontmatterLimitError(
+      "FRONTMATTER_TOO_LARGE",
+      `YAML source is longer than ${FRONTMATTER_LIMITS.sourceChars} characters`
+    );
+  }
+  const schema = options.schema === "json" ? import_js_yaml.default.JSON_SCHEMA : options.schema;
+  const budget = new AliasBudget();
+  let watched;
+  let nesting = 0;
+  let value;
+  try {
+    value = import_js_yaml.default.safeLoad(source, {
+      ...schema ? { schema } : {},
+      listener(event, rawState) {
+        const state = rawState;
+        if (state.anchorMap !== watched) {
+          budget.watch(state);
+          watched = state.anchorMap;
+        }
+        if (event === "open") {
+          nesting += 1;
+          if (nesting > PARSE_NESTING_GUARD) throw tooDeep();
+        } else {
+          nesting -= 1;
+          if (state.anchor !== null) budget.close(state.anchor, state.result);
+        }
+      }
+    });
+  } catch (error) {
+    const reason = error.reason;
+    if (typeof reason === "string" && reason.startsWith(MERGE_KEY_LIMIT_REASON)) {
+      throw new FrontmatterLimitError("FRONTMATTER_ALIAS_LIMIT", reason);
+    }
+    throw error;
+  }
+  new ExtentMeter().measure(value);
+  return value;
+}
+
+// ../core/src/frontmatter.ts
+var import_js_yaml2 = __toESM(require_js_yaml2(), 1);
+
 // ../core/src/frontmatter-splitter.ts
 function delimiterLineEnd(input, offset) {
   if (!input.startsWith("---", offset)) return null;
@@ -30907,12 +31077,106 @@ function splitLeadingFrontmatter(raw, context) {
   throw new MalformedDocumentError(context, new Error("unterminated YAML frontmatter delimiter"));
 }
 
+// ../core/src/frontmatter.ts
+var YAML_TIMESTAMP_TAG = "tag:yaml.org,2002:timestamp";
+function requireYamlTimestampType() {
+  const type = import_js_yaml2.default.DEFAULT_SAFE_SCHEMA.implicit.find(
+    (candidate) => candidate.tag === YAML_TIMESTAMP_TAG
+  );
+  if (!type) throw new Error("js-yaml safe schema is missing its timestamp type");
+  return type;
+}
+var yamlTimestampType = requireYamlTimestampType();
+var stringTimestampType = new import_js_yaml2.default.Type(YAML_TIMESTAMP_TAG, {
+  kind: "scalar",
+  resolve: (value) => yamlTimestampType.resolve(value),
+  construct: (value) => value
+});
+var losslessDateSchema = new import_js_yaml2.default.Schema({
+  include: [import_js_yaml2.default.DEFAULT_SAFE_SCHEMA],
+  implicit: [stringTimestampType]
+});
+var yamlEngine = {
+  parse(input) {
+    return loadBoundedYaml(input, { schema: losslessDateSchema }) ?? {};
+  }
+};
+function normalizeFrontmatter(data, options) {
+  const out = { ...data };
+  if (options.preserveTimestamp || options.okfVersion === "0.2") return out;
+  const value = out.timestamp;
+  if (value instanceof Date) {
+    out.timestamp = value.toISOString();
+  } else if (typeof value === "number" && Number.isFinite(value)) {
+    out.timestamp = new Date(value).toISOString();
+  } else if (typeof value === "string" && yamlTimestampType.resolve(value)) {
+    const parsed = yamlTimestampType.construct(value);
+    if (parsed instanceof Date) out.timestamp = parsed.toISOString();
+  }
+  return out;
+}
+function parseMarkdown(raw, context, options = {}) {
+  const split = splitLeadingFrontmatter(raw, context);
+  if (!("yamlSource" in split)) return { frontmatter: {}, body: split.body };
+  return { frontmatter: parseFrontmatter(split.yamlSource, context, options), body: split.body };
+}
+function parseFrontmatter(source, context, options = {}) {
+  let parsed;
+  try {
+    parsed = yamlEngine.parse(source);
+  } catch (err) {
+    throw new MalformedDocumentError(context, err);
+  }
+  return normalizeFrontmatter(parsed, options);
+}
+function isStackExhaustion(error) {
+  if (error instanceof RangeError) return /call stack/i.test(error.message);
+  return error?.name === "InternalError" && /recursion/i.test(error.message);
+}
+function stringifyFrontmatter(data) {
+  let dumped;
+  try {
+    dumped = import_js_yaml2.default.safeDump(data).trim();
+  } catch (error) {
+    if (isStackExhaustion(error)) throw new FrontmatterRefusedError("FRONTMATTER_TOO_DEEP", `YAML nesting is deeper than ${FRONTMATTER_LIMITS.depth} levels`);
+    throw error;
+  }
+  try {
+    yamlEngine.parse(`${dumped}
+`);
+  } catch (error) {
+    if (error instanceof FrontmatterLimitError) throw new FrontmatterRefusedError(error.code, error.message);
+    const detail = (error instanceof Error ? error.message : String(error)).split("\n")[0] ?? "";
+    throw new FrontmatterRefusedError("FRONTMATTER_MALFORMED", detail);
+  }
+  return dumped;
+}
+function normalizeDocumentBodyForStorage(body) {
+  return body.endsWith("\n") ? body : `${body}
+`;
+}
+function stringifyWithData(data, body) {
+  return stringifyWithSerializedFrontmatter(stringifyFrontmatter(data), body);
+}
+function stringifyWithSerializedFrontmatter(dumped, body) {
+  const content3 = body ?? "";
+  const newline = (value) => value.endsWith("\n") ? value : `${value}
+`;
+  if (dumped === "{}") return normalizeDocumentBodyForStorage(content3);
+  return `---
+${newline(dumped)}---
+${normalizeDocumentBodyForStorage(content3)}`;
+}
+function stringifyDoc(frontmatter2, body) {
+  return stringifyWithData(frontmatter2, body);
+}
+
 // ../core/src/portable-frontmatter.ts
 function parseLeadingFrontmatter(raw, context) {
   const split = splitLeadingFrontmatter(raw, context);
   if (!("yamlSource" in split)) return {};
   try {
-    const parsed = import_js_yaml.default.safeLoad(split.yamlSource);
+    const parsed = loadBoundedYaml(split.yamlSource);
     if (parsed === void 0 || parsed === null) return {};
     if (typeof parsed !== "object" || Array.isArray(parsed)) {
       throw new TypeError("YAML frontmatter must be a mapping");
@@ -30923,6 +31187,18 @@ function parseLeadingFrontmatter(raw, context) {
     throw new MalformedDocumentError(context, error);
   }
 }
+function assertStorableFrontmatter(raw) {
+  try {
+    parseLeadingFrontmatter(raw);
+    const split = splitLeadingFrontmatter(raw);
+    if ("yamlSource" in split) parseFrontmatter(split.yamlSource);
+  } catch (error) {
+    if (error instanceof MalformedDocumentError && error.code !== "FRONTMATTER_MALFORMED") {
+      throw new FrontmatterRefusedError(error.code, error.detail);
+    }
+    if (!(error instanceof MalformedDocumentError)) throw error;
+  }
+}
 
 // ../core/src/paths.ts
 var RESERVED_FILENAMES = ["index.md", "log.md"];
@@ -31282,82 +31558,6 @@ function inventoryDigest(inventory) {
   return `sha256:${sha256HexOfUtf8(JSON.stringify(inventory.map((row) => [row.id, row.version])))}`;
 }
 
-// ../core/src/frontmatter.ts
-var import_js_yaml2 = __toESM(require_js_yaml2(), 1);
-var YAML_TIMESTAMP_TAG = "tag:yaml.org,2002:timestamp";
-function requireYamlTimestampType() {
-  const type = import_js_yaml2.default.DEFAULT_SAFE_SCHEMA.implicit.find(
-    (candidate) => candidate.tag === YAML_TIMESTAMP_TAG
-  );
-  if (!type) throw new Error("js-yaml safe schema is missing its timestamp type");
-  return type;
-}
-var yamlTimestampType = requireYamlTimestampType();
-var stringTimestampType = new import_js_yaml2.default.Type(YAML_TIMESTAMP_TAG, {
-  kind: "scalar",
-  resolve: (value) => yamlTimestampType.resolve(value),
-  construct: (value) => value
-});
-var losslessDateSchema = new import_js_yaml2.default.Schema({
-  include: [import_js_yaml2.default.DEFAULT_SAFE_SCHEMA],
-  implicit: [stringTimestampType]
-});
-var yamlEngine = {
-  parse(input) {
-    return import_js_yaml2.default.safeLoad(input, { schema: losslessDateSchema }) ?? {};
-  }
-};
-function normalizeFrontmatter(data, options) {
-  const out = { ...data };
-  if (options.preserveTimestamp || options.okfVersion === "0.2") return out;
-  const value = out.timestamp;
-  if (value instanceof Date) {
-    out.timestamp = value.toISOString();
-  } else if (typeof value === "number" && Number.isFinite(value)) {
-    out.timestamp = new Date(value).toISOString();
-  } else if (typeof value === "string" && yamlTimestampType.resolve(value)) {
-    const parsed = yamlTimestampType.construct(value);
-    if (parsed instanceof Date) out.timestamp = parsed.toISOString();
-  }
-  return out;
-}
-function parseMarkdown(raw, context, options = {}) {
-  const split = splitLeadingFrontmatter(raw, context);
-  if (!("yamlSource" in split)) return { frontmatter: {}, body: split.body };
-  return { frontmatter: parseFrontmatter(split.yamlSource, context, options), body: split.body };
-}
-function parseFrontmatter(source, context, options = {}) {
-  let parsed;
-  try {
-    parsed = yamlEngine.parse(source);
-  } catch (err) {
-    throw new MalformedDocumentError(context, err);
-  }
-  return normalizeFrontmatter(parsed, options);
-}
-function stringifyFrontmatter(data) {
-  return import_js_yaml2.default.safeDump(data).trim();
-}
-function normalizeDocumentBodyForStorage(body) {
-  return body.endsWith("\n") ? body : `${body}
-`;
-}
-function stringifyWithData(data, body) {
-  return stringifyWithSerializedFrontmatter(stringifyFrontmatter(data), body);
-}
-function stringifyWithSerializedFrontmatter(dumped, body) {
-  const content3 = body ?? "";
-  const newline = (value) => value.endsWith("\n") ? value : `${value}
-`;
-  if (dumped === "{}") return normalizeDocumentBodyForStorage(content3);
-  return `---
-${newline(dumped)}---
-${normalizeDocumentBodyForStorage(content3)}`;
-}
-function stringifyDoc(frontmatter2, body) {
-  return stringifyWithData(frontmatter2, body);
-}
-
 // ../core/src/code-unit-order.ts
 function compareCodeUnits(a, b) {
   return a < b ? -1 : a > b ? 1 : 0;
@@ -31769,24 +31969,7 @@ function hasSourceIdentity(sources, identity) {
   return Array.isArray(sources) && sources.some((entry) => matchesSourceIdentity(entry, identity));
 }
 
-// ../core/src/engine.ts
-async function readBundleOkfVersion(backend) {
-  const index2 = await backend.readReserved("", "index.md");
-  if (!index2) return void 0;
-  const value = parseLeadingFrontmatter(index2.content, "index.md").okf_version;
-  return typeof value === "string" && value.trim() !== "" ? value : void 0;
-}
-function assertReadableConceptId(id) {
-  assertSafeConceptId(id);
-  const rel = pathFromConceptId(id);
-  if (isReservedFile(rel)) {
-    throw new InvalidInputError(`'${id}' is a reserved file (index.md / log.md), not a concept document.`);
-  }
-}
-async function readDocVersioned(backend, id) {
-  assertReadableConceptId(id);
-  return backend.read(id);
-}
+// ../core/src/document-scan.ts
 function isEnoent(err) {
   return typeof err === "object" && err !== null && err.code === "ENOENT";
 }
@@ -31817,6 +32000,25 @@ async function readManyExisting(backend, ids, onMalformed, onAliased) {
     return out;
   }
 }
+
+// ../core/src/engine.ts
+async function readBundleOkfVersion(backend) {
+  const index2 = await backend.readReserved("", "index.md");
+  if (!index2) return void 0;
+  const value = parseLeadingFrontmatter(index2.content, "index.md").okf_version;
+  return typeof value === "string" && value.trim() !== "" ? value : void 0;
+}
+function assertReadableConceptId(id) {
+  assertSafeConceptId(id);
+  const rel = pathFromConceptId(id);
+  if (isReservedFile(rel)) {
+    throw new InvalidInputError(`'${id}' is a reserved file (index.md / log.md), not a concept document.`);
+  }
+}
+async function readDocVersioned(backend, id) {
+  assertReadableConceptId(id);
+  return backend.read(id);
+}
 async function scanMatching(backend, filter, onSkip) {
   const ids = await backend.list(filter.prefix);
   const results = [];
@@ -31935,6 +32137,13 @@ function resolveContentType(key, override) {
   return inferContentTypeFromDocKey(key) ?? DEFAULT_BLOB_CONTENT_TYPE;
 }
 
+// ../core/src/reserved-write.ts
+function assertStorableReservedWrite(dir, name, content3) {
+  assertSafeReservedDir(dir);
+  assertSafeReservedFilename(name);
+  if (name.endsWith(".md")) assertStorableFrontmatter(content3);
+}
+
 // ../core/src/filesystem-identity.ts
 import { promises as fs2 } from "node:fs";
 import path2 from "node:path";
@@ -33289,8 +33498,7 @@ var FilesystemBackend = class _FilesystemBackend {
     return { content: content3, version: versionOfBytes(content3) };
   }
   async writeReserved(dir, name, content3, options = {}) {
-    assertSafeReservedDir(dir);
-    assertSafeReservedFilename(name);
+    assertStorableReservedWrite(dir, name, content3);
     const rel = reservedPath(dir, name);
     return this.#mutateExact(rel, async (target) => {
       if (options.expectedVersion !== void 0) {