@amalgm/shell 0.1.164-preview.36072132286 → 0.1.164-preview.36809057014

package/dist/detection/apply-ownership.js

@@ -0,0 +1,232 @@
+/** Detect and Apply cannot adopt the intermediate effects of another
+ * durable operation. This is a scoped read of Apply's existing receipts,
+ * never another journal or a source of physical identity. */
+import { createHash } from "node:crypto";
+import { lstatSync } from "node:fs";
+import { resolve, sep } from "node:path";
+import { assertApplyIntent } from "@amalgm/live";
+import { applyControlRoot, readApplyRecovery } from "../apply-recovery.js";
+import { physicalKey } from "../source-signature.js";
+import { cachedStatement } from "../sqlite.js";
+import { unreadReason } from "./unreadable.js";
+/** An object an Apply may own, named within the root that holds it. An owner
+ * protects its objects so that one moved outside its cones keeps its identity
+ * question for the Apply. Identity continuity is root-local, so an object
+ * that leaves its root is a new identity wherever it lands, Apply or not, and
+ * an inode number the Apply freed and the filesystem gave a file in another
+ * root names nothing this Apply owns. */
+export const ownedObject = (root, physicalKey) => JSON.stringify([resolve(root), physicalKey]);
+/** What an Apply attempt waits on while other unfinished operations own its
+ * scope. An attempt that already holds bound effects cannot simply wait: the
+ * overlap needs explicit repair. */
+export function ownershipWait(owners, bound) {
+    if (owners.length === 0)
+        return null;
+    return { kind: "dependency", reason: bound ? "Overlapping Apply recovery obligations require explicit repair."
+            : "Another unfinished Apply operation owns this ground.",
+        waitFor: { producer: bound ? "capability" : "apply", entityIds: [...new Set(owners.map(owner => owner.intent.entityId))] } };
+}
+export class ApplyAttributionDeferred extends Error {
+    owners;
+    moving;
+    unavailable;
+    /** `moving` and `unavailable` name roots the same attempt found still
+     * moving or could not read: separate causes that travel with the owners
+     * and are never erased by them. */
+    constructor(owners, moving = [], unavailable = []) {
+        const blocked = owners.flatMap(owner => owner.unsafe ? [owner.unsafe] : owner.inaccessible ? [owner.inaccessible.reason] : []);
+        super(blocked.length ? `Detect attribution is waiting for Apply recovery: ${blocked.join("; ")}`
+            : "Detect attribution is waiting for an unfinished Apply operation");
+        this.owners = owners;
+        this.moving = moving;
+        this.unavailable = unavailable;
+    }
+}
+const contains = (cone, path) => cone === path
+    || path.startsWith(cone.endsWith(sep) ? cone : `${cone}${sep}`);
+const NONE = new Set();
+const normalize = (scope) => Object.freeze({
+    entries: Object.freeze(scope.entries?.map(path => resolve(path)) ?? []),
+    subtrees: Object.freeze(scope.subtrees?.map(path => resolve(path)) ?? []),
+    uuids: scope.uuids ?? NONE,
+    physical: scope.physical ?? NONE,
+});
+const intersects = (owner, scope) => owner.uuids.some(uuid => scope.uuids.has(uuid))
+    || owner.physical.some(key => scope.physical.has(key))
+    || owner.cones.some(cone => scope.entries.some(path => contains(cone, path))
+        || scope.subtrees.some(path => contains(cone, path) || contains(path, cone)));
+/** Codes that say only that the bound path cannot be resolved or read now. */
+const INACCESSIBLE = new Set(["ENOENT", "ENOTDIR", "EACCES", "EPERM"]);
+/** Cannot inspect is not proved wrong: a binding that cannot be resolved or
+ * read now is inaccessible, and any other failure to read it is unsafe. */
+function inspect(path) {
+    try {
+        return lstatSync(path, { bigint: true });
+    }
+    catch (error) {
+        return INACCESSIBLE.has(error?.code ?? "")
+            ? { inaccessible: { directory: path, reason: unreadReason(path, error) } }
+            : { unsafe: `Apply attribution owner's binding could not be read: ${error instanceof Error ? error.message : String(error)}` };
+    }
+}
+/** Only a binding that resolves to another object, or cannot be read for
+ * another reason, is unsafe. */
+function bindingState(recovery) {
+    const actual = inspect(recovery.binding.path);
+    if (!("isDirectory" in actual))
+        return actual;
+    return actual.isDirectory() && !actual.isSymbolicLink() && physicalKey(actual) === recovery.binding.physical
+        ? {} : { unsafe: "Apply attribution owner has a replaced binding" };
+}
+/** Shared by Detect admission and the host's post-terminal wake. Original
+ * receipt participants remain known even if a row already moved or vanished. */
+export function applyRecoveryFootprint(recovery) {
+    const preimages = [recovery.source, ...recovery.moves.map(move => move.source),
+        ...recovery.relocated.map(move => move.source)].filter(value => value !== null);
+    return {
+        cones: Object.freeze([...new Set([recovery.targetPath, ...preimages.map(source => source.path),
+                ...recovery.moves.map(move => move.destination)].map(path => resolve(path)))].sort()),
+        uuids: Object.freeze([...new Set([recovery.intent.entityId,
+                ...preimages.flatMap(source => source.rows.map(row => row.record.uuid))])].sort()),
+    };
+}
+/** One host adapter reads bound, nonterminal receipts. Unbound preparation
+ * owns no effects; terminal cleanup owns no live filesystem attribution. */
+export function sqliteApplyOwnership(database) {
+    const owners = cachedStatement(database, `SELECT intent_json AS intentJson, recovery_location AS control
+    FROM entity_apply_intents WHERE retirement_json IS NULL AND recovery_location IS NOT NULL
+    ORDER BY authority_id, entity_id`);
+    const physical = cachedStatement(database, "SELECT absolute_path AS path, physical_key AS physical FROM entities WHERE uuid = ?");
+    const incarnation = cachedStatement(database, "SELECT identity FROM ground_incarnation WHERE singleton = 1");
+    return {
+        incarnation: () => {
+            const row = incarnation.get();
+            if (!row)
+                throw new Error("Apply attribution read has no database incarnation");
+            return row.identity;
+        },
+        read: () => owners.all().map(row => {
+            const intent = JSON.parse(row.intentJson);
+            assertApplyIntent(intent);
+            // The receipt lives in its binding's control tree. While that binding
+            // cannot be reached, the durable intent still owns everything bound
+            // there and the receipt stays unread: neither its presence nor its
+            // usability is proved, and absent is not proved lost.
+            const root = applyControlRoot(row.control);
+            const reached = inspect(root);
+            if (!("isDirectory" in reached)) {
+                const current = physical.get(intent.entityId);
+                return Object.freeze({ intent: Object.freeze(intent), control: row.control, receipt: "",
+                    cones: Object.freeze([...new Set([resolve(root), ...(current ? [current.path] : [])])].sort()),
+                    uuids: Object.freeze([intent.entityId]),
+                    physical: Object.freeze(current ? [ownedObject(root, current.physical)] : []), ...reached });
+            }
+            const recovery = readApplyRecovery(row.control, intent);
+            if (!recovery)
+                throw new Error("Apply attribution owner lost its referenced receipt");
+            // A readable immutable receipt still names its original obligation when
+            // its binding cannot serve it. Keep that state with its actual scopes;
+            // it cannot make an unrelated root fail ownership collection.
+            const binding = bindingState(recovery);
+            const footprint = applyRecoveryFootprint(recovery);
+            const attributed = footprint.uuids.flatMap(uuid => {
+                const candidate = physical.get(uuid);
+                return candidate ? [candidate] : [];
+            });
+            const identities = attributed.map(row => row.physical);
+            for (const preimage of [recovery.source, ...recovery.moves.map(move => move.source),
+                ...recovery.relocated.map(move => move.source)]) {
+                for (const row of preimage?.rows ?? [])
+                    if (row.physical) {
+                        identities.push(row.physical);
+                    }
+            }
+            return Object.freeze({ intent: Object.freeze(intent), control: row.control,
+                receipt: createHash("sha256").update(JSON.stringify(recovery)).digest("hex"),
+                physical: Object.freeze([...new Set(identities.map(key => ownedObject(recovery.binding.path, key)))].sort()),
+                ...footprint,
+                // Original participant UUIDs also protect their currently attributed
+                // addresses. A subtree effect cannot bypass ownership by moving one
+                // of those participants outside the original receipt's path cone.
+                cones: Object.freeze([...new Set([...footprint.cones, ...attributed.map(row => row.path)])].sort()),
+                ...binding });
+        }),
+    };
+}
+/** One ownership collection serves every scope in an observation. Admission
+ * rechecks complete intersecting answers, including the initially empty set.
+ * Unrelated owners do not invalidate this scope. Source/SQL/lease proof is
+ * still required: active-owner equality alone cannot prove an effect-free gap. */
+export class ApplyOwnershipSnapshot {
+    #reader;
+    #excluding;
+    #incarnation;
+    #owners;
+    #answers = [];
+    #physical = new Set();
+    #closed = false;
+    #failed = false;
+    constructor(reader, excluding) {
+        this.#reader = reader;
+        this.#excluding = excluding;
+        this.#incarnation = reader.incarnation();
+        this.#owners = this.#read();
+    }
+    #read() {
+        return this.#reader.read().filter(owner => !this.#excluding
+            || owner.intent.attemptId !== this.#excluding.attemptId
+            || owner.intent.authorityId !== this.#excluding.authorityId
+            || owner.intent.entityId !== this.#excluding.entityId);
+    }
+    use(input) {
+        if (this.#closed || this.#failed)
+            throw new Error("Apply ownership observation is closed or failed");
+        try {
+            const scope = normalize(input);
+            const owners = this.#owners.filter(owner => intersects(owner, scope));
+            this.#answers.push({ scope, answer: signature(owners) });
+            return Object.freeze(owners);
+        }
+        catch (error) {
+            this.#failed = true;
+            throw error;
+        }
+    }
+    /** Owners of one object (ownedObject), collected once, including negative
+     * answers. A protected directory moved outside its old cone cannot become a
+     * new UUID in its root. */
+    physical(object) {
+        if (this.#closed || this.#failed)
+            throw new Error("Apply ownership observation is closed or failed");
+        this.#physical.add(object);
+        return this.#owners.filter(owner => owner.physical.includes(object));
+    }
+    seal() {
+        if (this.#closed || this.#failed)
+            throw new Error("Apply ownership observation is closed or failed");
+        this.#closed = true;
+        const answers = [...this.#answers];
+        if (this.#physical.size) {
+            const scope = normalize({ physical: this.#physical });
+            answers.push({ scope, answer: signature(this.#owners.filter(owner => intersects(owner, scope))) });
+        }
+        return Object.freeze({ assertCurrent: () => {
+                if (this.#reader.incarnation() !== this.#incarnation)
+                    throw new Error("Apply ownership database changed");
+                const owners = this.#read();
+                for (const { scope, answer } of answers) {
+                    if (signature(owners.filter(owner => intersects(owner, scope))) !== answer) {
+                        throw new Error("Apply ownership changed before Detect admission");
+                    }
+                }
+            } });
+    }
+}
+function signature(owners) {
+    return JSON.stringify(owners.map(owner => [owner.intent.attemptId, owner.intent.authorityId, owner.intent.entityId,
+        owner.intent.fromSequence, owner.intent.throughSequence, owner.intent.targetMutationId,
+        owner.intent.targetState, owner.intent.targetType, owner.intent.createdAt,
+        owner.control, owner.receipt, owner.cones, owner.uuids, owner.physical,
+        owner.inaccessible?.reason ?? null, owner.unsafe ?? null]).sort((a, b) => JSON.stringify(a).localeCompare(JSON.stringify(b))));
+}
+//# sourceMappingURL=apply-ownership.js.map

package/dist/detection/apply-ownership.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"apply-ownership.js","sourceRoot":"","sources":["../../src/detection/apply-ownership.ts"],"names":[],"mappings":"AAAA;;6DAE6D;AAC7D,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,SAAS,EAAoB,MAAM,SAAS,CAAC;AACtD,OAAO,EAAE,OAAO,EAAE,GAAG,EAAE,MAAM,WAAW,CAAC;AACzC,OAAO,EAAE,iBAAiB,EAA2C,MAAM,cAAc,CAAC;AAE1F,OAAO,EAAE,gBAAgB,EAAE,iBAAiB,EAAsB,MAAM,sBAAsB,CAAC;AAC/F,OAAO,EAAE,WAAW,EAAE,MAAM,wBAAwB,CAAC;AACrD,OAAO,EAAE,eAAe,EAAE,MAAM,cAAc,CAAC;AAC/C,OAAO,EAAE,YAAY,EAAwB,MAAM,iBAAiB,CAAC;AAarE;;;;;yCAKyC;AACzC,MAAM,CAAC,MAAM,WAAW,GAAG,CAAC,IAAY,EAAE,WAAmB,EAAU,EAAE,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,WAAW,CAAC,CAAC,CAAC;AAsBvH;;oCAEoC;AACpC,MAAM,UAAU,aAAa,CAAC,MAAwC,EAAE,KAAc;IACpF,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IACrC,OAAO,EAAE,IAAI,EAAE,YAAY,EAAE,MAAM,EAAE,KAAK,CAAC,CAAC,CAAC,iEAAiE;YAC5G,CAAC,CAAC,sDAAsD;QACxD,OAAO,EAAE,EAAE,QAAQ,EAAE,KAAK,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,OAAO,EAAE,SAAS,EAAE,CAAC,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC;AACjI,CAAC;AAMD,MAAM,OAAO,wBAAyB,SAAQ,KAAK;IAI5B;IAAmD;IAC7D;IAJX;;uCAEmC;IACnC,YAAqB,MAAwC,EAAW,SAA4B,EAAE,EAC3F,cAA0C,EAAE;QACrD,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,YAAY,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;QAC/H,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,qDAAqD,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE;YAC9F,CAAC,CAAC,iEAAiE,CAAC,CAAC;QAJpD,WAAM,GAAN,MAAM,CAAkC;QAAW,WAAM,GAAN,MAAM,CAAwB;QAC3F,gBAAW,GAAX,WAAW,CAAiC;IAIvD,CAAC;CACF;AAED,MAAM,QAAQ,GAAG,CAAC,IAAY,EAAE,IAAY,EAAW,EAAE,CAAC,IAAI,KAAK,IAAI;OAClE,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,IAAI,GAAG,GAAG,EAAE,CAAC,CAAC;AAElE,MAAM,IAAI,GAAwB,IAAI,GAAG,EAAE,CAAC;AAE5C,MAAM,SAAS,GAAG,CAAC,KAAuB,EAA8B,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC;IACvF,OAAO,EAAE,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,OAAO,EAAE,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,CAAC;IACvE,QAAQ,EAAE,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,QAAQ,EAAE,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,CAAC;IACzE,KAAK,EAAE,KAAK,CAAC,KAAK,IAAI,IAAI;IAC1B,QAAQ,EAAE,KAAK,CAAC,QAAQ,IAAI,IAAI;CACjC,CAAC,CAAC;AAEH,MAAM,UAAU,GAAG,CAAC,KAA4B,EAAE,KAAiC,EAAW,EAAE,CAC9F,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;OAC5C,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;OACnD,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,QAAQ,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;WACvE,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,QAAQ,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI,QAAQ,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC;AAElF,8EAA8E;AAC9E,MAAM,YAAY,GAAG,IAAI,GAAG,CAAC,CAAC,QAAQ,EAAE,SAAS,EAAE,QAAQ,EAAE,OAAO,CAAC,CAAC,CAAC;AAIvE;2EAC2E;AAC3E,SAAS,OAAO,CAAC,IAAY;IAC3B,IAAI,CAAC;QACH,OAAO,SAAS,CAAC,IAAI,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC;IAC3C,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,OAAO,YAAY,CAAC,GAAG,CAAE,KAAsC,EAAE,IAAI,IAAI,EAAE,CAAC;YAC1E,CAAC,CAAC,EAAE,YAAY,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,MAAM,EAAE,YAAY,CAAC,IAAI,EAAE,KAAK,CAAC,EAAE,EAAE;YAC1E,CAAC,CAAC,EAAE,MAAM,EAAE,wDAAwD,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,EAAE,CAAC;IACnI,CAAC;AACH,CAAC;AAED;gCACgC;AAChC,SAAS,YAAY,CAAC,QAAuB;IAC3C,MAAM,MAAM,GAAG,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;IAC9C,IAAI,CAAC,CAAC,aAAa,IAAI,MAAM,CAAC;QAAE,OAAO,MAAM,CAAC;IAC9C,OAAO,MAAM,CAAC,WAAW,EAAE,IAAI,CAAC,MAAM,CAAC,cAAc,EAAE,IAAI,WAAW,CAAC,MAAM,CAAC,KAAK,QAAQ,CAAC,OAAO,CAAC,QAAQ;QAC1G,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,gDAAgD,EAAE,CAAC;AACxE,CAAC;AAED;gFACgF;AAChF,MAAM,UAAU,sBAAsB,CAAC,QAAuB;IAC5D,MAAM,SAAS,GAAG,CAAC,QAAQ,CAAC,MAAM,EAAE,GAAG,QAAQ,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC;QAC5E,GAAG,QAAQ,CAAC,SAAS,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,KAAK,IAAI,CAAC,CAAC;IAClF,OAAO;QACL,KAAK,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC,GAAG,IAAI,GAAG,CAAC,CAAC,QAAQ,CAAC,UAAU,EAAE,GAAG,SAAS,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC;gBAC5F,GAAG,QAAQ,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;QACvF,KAAK,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC,GAAG,IAAI,GAAG,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,QAAQ;gBACxD,GAAG,SAAS,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;KACrF,CAAC;AACJ,CAAC;AAOD;4EAC4E;AAC5E,MAAM,UAAU,oBAAoB,CAAC,QAA2B;IAC9D,MAAM,MAAM,GAAG,eAAe,CAAC,QAAQ,EAAE;;qCAEN,CAAC,CAAC;IACrC,MAAM,QAAQ,GAAG,eAAe,CAAC,QAAQ,EAAE,qFAAqF,CAAC,CAAC;IAClI,MAAM,WAAW,GAAG,eAAe,CAAC,QAAQ,EAAE,6DAA6D,CAAC,CAAC;IAC7G,OAAO;QACL,WAAW,EAAE,GAAG,EAAE;YAChB,MAAM,GAAG,GAAG,WAAW,CAAC,GAAG,EAAsC,CAAC;YAClE,IAAI,CAAC,GAAG;gBAAE,MAAM,IAAI,KAAK,CAAC,oDAAoD,CAAC,CAAC;YAChF,OAAO,GAAG,CAAC,QAAQ,CAAC;QACtB,CAAC;QACD,IAAI,EAAE,GAAG,EAAE,CAAE,MAAM,CAAC,GAAG,EAAqD,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE;YACrF,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,UAAU,CAAsB,CAAC;YAAC,iBAAiB,CAAC,MAAM,CAAC,CAAC;YAC1F,sEAAsE;YACtE,oEAAoE;YACpE,mEAAmE;YACnE,sDAAsD;YACtD,MAAM,IAAI,GAAG,gBAAgB,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;YAC3C,MAAM,OAAO,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;YAC9B,IAAI,CAAC,CAAC,aAAa,IAAI,OAAO,CAAC,EAAE,CAAC;gBAChC,MAAM,OAAO,GAAG,QAAQ,CAAC,GAAG,CAAC,MAAM,CAAC,QAAQ,CAAmD,CAAC;gBAChG,OAAO,MAAM,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,OAAO,EAAE,GAAG,CAAC,OAAO,EAAE,OAAO,EAAE,EAAE;oBACrF,KAAK,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC,GAAG,IAAI,GAAG,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;oBAC9F,KAAK,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;oBACvC,QAAQ,EAAE,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC,IAAI,EAAE,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,GAAG,OAAO,EAAE,CAAC,CAAC;YACjG,CAAC;YACD,MAAM,QAAQ,GAAG,iBAAiB,CAAC,GAAG,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;YACxD,IAAI,CAAC,QAAQ;gBAAE,MAAM,IAAI,KAAK,CAAC,qDAAqD,CAAC,CAAC;YACtF,wEAAwE;YACxE,uEAAuE;YACvE,8DAA8D;YAC9D,MAAM,OAAO,GAAG,YAAY,CAAC,QAAQ,CAAC,CAAC;YACvC,MAAM,SAAS,GAAG,sBAAsB,CAAC,QAAQ,CAAC,CAAC;YACnD,MAAM,UAAU,GAAG,SAAS,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE;gBAChD,MAAM,SAAS,GAAG,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAmD,CAAC;gBACvF,OAAO,SAAS,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;YACtC,CAAC,CAAC,CAAC;YACH,MAAM,UAAU,GAAG,UAAU,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;YACvD,KAAK,MAAM,QAAQ,IAAI,CAAC,QAAQ,CAAC,MAAM,EAAE,GAAG,QAAQ,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC;gBACjF,GAAG,QAAQ,CAAC,SAAS,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,EAAE,CAAC;gBAClD,KAAK,MAAM,GAAG,IAAI,QAAQ,EAAE,IAAI,IAAI,EAAE;oBAAE,IAAI,GAAG,CAAC,QAAQ,EAAE,CAAC;wBACzD,UAAU,CAAC,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;oBAChC,CAAC;YACH,CAAC;YACD,OAAO,MAAM,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,OAAO,EAAE,GAAG,CAAC,OAAO;gBACxE,OAAO,EAAE,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC;gBAC5E,QAAQ,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC,GAAG,IAAI,GAAG,CAAC,UAAU,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC,WAAW,CAAC,QAAQ,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;gBAC5G,GAAG,SAAS;gBACZ,qEAAqE;gBACrE,oEAAoE;gBACpE,kEAAkE;gBAClE,KAAK,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC,GAAG,IAAI,GAAG,CAAC,CAAC,GAAG,SAAS,CAAC,KAAK,EAAE,GAAG,UAAU,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;gBACnG,GAAG,OAAO,EAAE,CAAC,CAAC;QAClB,CAAC,CAAC;KACH,CAAC;AACJ,CAAC;AAED;;;kFAGkF;AAClF,MAAM,OAAO,sBAAsB;IACxB,OAAO,CAAuB;IAC9B,UAAU,CAAqB;IAC/B,YAAY,CAAS;IACrB,OAAO,CAAmC;IAC1C,QAAQ,GAA8E,EAAE,CAAC;IACzF,SAAS,GAAG,IAAI,GAAG,EAAU,CAAC;IACvC,OAAO,GAAG,KAAK,CAAC;IAChB,OAAO,GAAG,KAAK,CAAC;IAEhB,YAAY,MAA4B,EAAE,SAA6B;QACrE,IAAI,CAAC,OAAO,GAAG,MAAM,CAAC;QAAC,IAAI,CAAC,UAAU,GAAG,SAAS,CAAC;QAAC,IAAI,CAAC,YAAY,GAAG,MAAM,CAAC,WAAW,EAAE,CAAC;QAC7F,IAAI,CAAC,OAAO,GAAG,IAAI,CAAC,KAAK,EAAE,CAAC;IAC9B,CAAC;IAED,KAAK;QACH,OAAO,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,UAAU;eACtD,KAAK,CAAC,MAAM,CAAC,SAAS,KAAK,IAAI,CAAC,UAAU,CAAC,SAAS;eACpD,KAAK,CAAC,MAAM,CAAC,WAAW,KAAK,IAAI,CAAC,UAAU,CAAC,WAAW;eACxD,KAAK,CAAC,MAAM,CAAC,QAAQ,KAAK,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC;IAC3D,CAAC;IAED,GAAG,CAAC,KAAuB;QACzB,IAAI,IAAI,CAAC,OAAO,IAAI,IAAI,CAAC,OAAO;YAAE,MAAM,IAAI,KAAK,CAAC,iDAAiD,CAAC,CAAC;QACrG,IAAI,CAAC;YACH,MAAM,KAAK,GAAG,SAAS,CAAC,KAAK,CAAC,CAAC;YAC/B,MAAM,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,UAAU,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC,CAAC;YACtE,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,MAAM,EAAE,SAAS,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;YACzD,OAAO,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;QAC/B,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YAAC,IAAI,CAAC,OAAO,GAAG,IAAI,CAAC;YAAC,MAAM,KAAK,CAAC;QAAC,CAAC;IACvD,CAAC;IAED;;+BAE2B;IAC3B,QAAQ,CAAC,MAAc;QACrB,IAAI,IAAI,CAAC,OAAO,IAAI,IAAI,CAAC,OAAO;YAAE,MAAM,IAAI,KAAK,CAAC,iDAAiD,CAAC,CAAC;QACrG,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QAC3B,OAAO,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,QAAQ,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC;IACvE,CAAC;IAED,IAAI;QACF,IAAI,IAAI,CAAC,OAAO,IAAI,IAAI,CAAC,OAAO;YAAE,MAAM,IAAI,KAAK,CAAC,iDAAiD,CAAC,CAAC;QACrG,IAAI,CAAC,OAAO,GAAG,IAAI,CAAC;QACpB,MAAM,OAAO,GAAG,CAAC,GAAG,IAAI,CAAC,QAAQ,CAAC,CAAC;QACnC,IAAI,IAAI,CAAC,SAAS,CAAC,IAAI,EAAE,CAAC;YACxB,MAAM,KAAK,GAAG,SAAS,CAAC,EAAE,QAAQ,EAAE,IAAI,CAAC,SAAS,EAAE,CAAC,CAAC;YACtD,OAAO,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,MAAM,EAAE,SAAS,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,UAAU,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;QACrG,CAAC;QACD,OAAO,MAAM,CAAC,MAAM,CAAC,EAAE,aAAa,EAAE,GAAG,EAAE;gBACzC,IAAI,IAAI,CAAC,OAAO,CAAC,WAAW,EAAE,KAAK,IAAI,CAAC,YAAY;oBAAE,MAAM,IAAI,KAAK,CAAC,kCAAkC,CAAC,CAAC;gBAC1G,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,EAAE,CAAC;gBAC5B,KAAK,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,IAAI,OAAO,EAAE,CAAC;oBACxC,IAAI,SAAS,CAAC,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,UAAU,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC,CAAC,KAAK,MAAM,EAAE,CAAC;wBAC3E,MAAM,IAAI,KAAK,CAAC,iDAAiD,CAAC,CAAC;oBACrE,CAAC;gBACH,CAAC;YACH,CAAC,EAAE,CAAC,CAAC;IACP,CAAC;CACF;AAED,SAAS,SAAS,CAAC,MAAwC;IACzD,OAAO,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,SAAS,EAAE,KAAK,CAAC,MAAM,CAAC,WAAW,EAAE,KAAK,CAAC,MAAM,CAAC,QAAQ;QAChH,KAAK,CAAC,MAAM,CAAC,YAAY,EAAE,KAAK,CAAC,MAAM,CAAC,eAAe,EAAE,KAAK,CAAC,MAAM,CAAC,gBAAgB;QACtF,KAAK,CAAC,MAAM,CAAC,WAAW,EAAE,KAAK,CAAC,MAAM,CAAC,UAAU,EAAE,KAAK,CAAC,MAAM,CAAC,SAAS;QACzE,KAAK,CAAC,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,KAAK,CAAC,KAAK,EAAE,KAAK,CAAC,KAAK,EAAE,KAAK,CAAC,QAAQ;QACtE,KAAK,CAAC,YAAY,EAAE,MAAM,IAAI,IAAI,EAAE,KAAK,CAAC,MAAM,IAAI,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CACvE,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,aAAa,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AAC3D,CAAC"}

package/dist/detection/basis-advanced.d.ts

@@ -0,0 +1,11 @@
+/** The verified notebook, a Watch binding or a Git writer advanced while
+ * Detect was observing. The complete generation stays pending and re-reads
+ * fresh truth on its next ring. A basis that knows when it settles without
+ * one, as a Git writer's lock does, says so, and is re-read then. */
+export declare class DetectionBasisAdvancedError extends Error {
+    readonly settlesInMs: number | null;
+    constructor(message?: string, settlesInMs?: number | null);
+}
+export declare function detectionBasisAdvanced(error: unknown): boolean;
+/** When moved evidence settles if nothing rings, where its basis knows. */
+export declare function basisSettlesInMs(error: unknown): number | null;

package/dist/detection/basis-advanced.js

@@ -0,0 +1,26 @@
+/** The verified notebook, a Watch binding or a Git writer advanced while
+ * Detect was observing. The complete generation stays pending and re-reads
+ * fresh truth on its next ring. A basis that knows when it settles without
+ * one, as a Git writer's lock does, says so, and is re-read then. */
+export class DetectionBasisAdvancedError extends Error {
+    settlesInMs;
+    constructor(message = "the verified notebook advanced while Detect was observing; retrying fresh truth", settlesInMs = null) {
+        super(message);
+        this.settlesInMs = settlesInMs;
+    }
+}
+function advancedBasis(error) {
+    for (let link = error; link instanceof Error; link = link.cause) {
+        if (link instanceof DetectionBasisAdvancedError)
+            return link;
+    }
+    return null;
+}
+export function detectionBasisAdvanced(error) {
+    return advancedBasis(error) !== null;
+}
+/** When moved evidence settles if nothing rings, where its basis knows. */
+export function basisSettlesInMs(error) {
+    return advancedBasis(error)?.settlesInMs ?? null;
+}
+//# sourceMappingURL=basis-advanced.js.map

package/dist/detection/basis-advanced.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"basis-advanced.js","sourceRoot":"","sources":["../../src/detection/basis-advanced.ts"],"names":[],"mappings":"AAAA;;;qEAGqE;AACrE,MAAM,OAAO,2BAA4B,SAAQ,KAAK;IAGzC;IAFX,YACE,OAAO,GAAG,iFAAiF,EAClF,cAA6B,IAAI;QAE1C,KAAK,CAAC,OAAO,CAAC,CAAC;QAFN,gBAAW,GAAX,WAAW,CAAsB;IAG5C,CAAC;CACF;AAED,SAAS,aAAa,CAAC,KAAc;IACnC,KAAK,IAAI,IAAI,GAAG,KAAK,EAAE,IAAI,YAAY,KAAK,EAAE,IAAI,GAAG,IAAI,CAAC,KAAK,EAAE,CAAC;QAChE,IAAI,IAAI,YAAY,2BAA2B;YAAE,OAAO,IAAI,CAAC;IAC/D,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,MAAM,UAAU,sBAAsB,CAAC,KAAc;IACnD,OAAO,aAAa,CAAC,KAAK,CAAC,KAAK,IAAI,CAAC;AACvC,CAAC;AAED,2EAA2E;AAC3E,MAAM,UAAU,gBAAgB,CAAC,KAAc;IAC7C,OAAO,aAAa,CAAC,KAAK,CAAC,EAAE,WAAW,IAAI,IAAI,CAAC;AACnD,CAAC"}

package/dist/detection/capture-outcome.d.ts

@@ -0,0 +1,16 @@
+import type { LocalCaptureResult } from "@amalgm/live";
+import type Database from "better-sqlite3";
+import { type GroundRow } from "../ground-row.js";
+/** Settled ground may still hold local remainder, which an effect that
+ * displaces its directory must not destroy. */
+export interface SettledGround {
+    readonly kind: "settled";
+    readonly remainder: readonly GroundRow[];
+}
+export declare function settledCaptureOutcome(database: Database.Database, input: {
+    readonly authorityId: string;
+    readonly entityId: string;
+    readonly addresses: readonly string[];
+}): Extract<LocalCaptureResult, {
+    readonly kind: "local-only" | "retry";
+}> | SettledGround;

package/dist/detection/capture-outcome.js

@@ -0,0 +1,92 @@
+/** Apply asks this only after its exact Watch generation has settled. This
+ * comparison reports observed local divergence from the committed
+ * inventories; it neither proves disk state nor treats observation as a
+ * durable backup or permission to overwrite it.
+ *
+ * It reads committed facts only: O, B and repository seals. An observed
+ * identity sharing never held is local remainder: no incoming result names
+ * it and nothing else holds a copy, so Apply keeps it and never waits for
+ * it. Any other difference between O and B is divergence unless selection
+ * explains it: a container whose membership differs only by remainder, or a
+ * repository whose seal derives O's result and B's from one examination. */
+import { sep, resolve } from "node:path";
+import { effectivelyActive, GROUND_ROW_PROJECTION } from "../ground-row.js";
+import { readSealedRepositoryEvidence, sealDerives } from "./seal-law.js";
+const INVENTORIES = ["entities", "detection_notebook"];
+export function settledCaptureOutcome(database, input) {
+    if (input.addresses.length === 0)
+        return { kind: "retry", reason: "Apply capture has no proven address scope." };
+    const remainder = [];
+    const divergent = database.transaction(() => {
+        const affected = new Set([input.entityId]);
+        const roots = [];
+        for (const path of [...new Set(input.addresses.map(path => resolve(path)))].sort()) {
+            const last = roots.at(-1);
+            if (!last || !path.startsWith(last.endsWith(sep) ? last : `${last}${sep}`))
+                roots.push(path);
+        }
+        for (const inventory of INVENTORIES) {
+            const query = database.prepare(`
+        SELECT uuid FROM ${inventory} WHERE absolute_path = ? AND resource_id = ?
+        UNION ALL
+        SELECT uuid FROM ${inventory} WHERE absolute_path >= ? AND absolute_path < ? AND resource_id = ?
+      `);
+            for (const path of roots) {
+                const prefix = path.endsWith(sep) ? path : `${path}${sep}`;
+                const upper = prefix.slice(0, -1) + String.fromCharCode(sep.charCodeAt(0) + 1);
+                for (const row of query.all(path, input.authorityId, prefix, upper, input.authorityId)) {
+                    affected.add(row.uuid);
+                }
+            }
+        }
+        const readers = Object.fromEntries(INVENTORIES.map(inventory => {
+            const statement = database.prepare(`SELECT ${GROUND_ROW_PROJECTION} FROM ${inventory} WHERE uuid = ? AND resource_id = ?`);
+            const cache = new Map();
+            return [inventory, (uuid) => {
+                    if (!cache.has(uuid))
+                        cache.set(uuid, statement.get(uuid, input.authorityId));
+                    return cache.get(uuid);
+                }];
+        }));
+        const members = Object.fromEntries(INVENTORIES.map(inventory => {
+            const statement = database.prepare(`SELECT uuid, name FROM ${inventory} WHERE parent_uuid = ? AND resource_id = ? AND status = 'active'`);
+            return [inventory, (uuid) => statement.all(uuid, input.authorityId)];
+        }));
+        const active = (row, inventory) => row !== undefined
+            && effectivelyActive(row, readers[inventory]);
+        // Both rows are active; selection explains a difference of payload alone.
+        const explained = (observed, shared) => {
+            if (observed.type !== shared.type || observed.parentUUID !== shared.parentUUID || observed.name !== shared.name)
+                return false;
+            if (observed.type === "workspace" || observed.type === "folder") {
+                // Membership is the stored-active children by (uuid, name).
+                const key = (member) => `${member.uuid}\0${member.name}`;
+                const held = new Set(members.detection_notebook(observed.uuid).map(key));
+                const kept = members.entities(observed.uuid).filter(child => readers.detection_notebook(child.uuid) !== undefined);
+                return kept.length === held.size && kept.every(child => held.has(key(child)));
+            }
+            return observed.type === "repo.git" && sealDerives(readSealedRepositoryEvidence(database, observed.uuid), observed, shared);
+        };
+        const divergent = [];
+        for (const uuid of affected) {
+            const physical = readers.entities(uuid), shared = readers.detection_notebook(uuid);
+            const present = active(physical, "entities"), admitted = active(shared, "detection_notebook");
+            // A different pack for the same logical result is not local divergence.
+            // Filesystem metadata and machine addresses are not portable state either.
+            if (present === admitted && (!present || physical.version === shared.version))
+                continue;
+            if (present && shared === undefined) {
+                remainder.push(physical);
+                continue;
+            }
+            if (!present || !admitted || !explained(physical, shared))
+                divergent.push(uuid);
+        }
+        return divergent;
+    })();
+    return divergent.length ? {
+        kind: "local-only", entityIds: divergent.sort(),
+        reason: "Observed local changes have not been selected for sharing. Waiting for those changes to be shared or explicitly resolved before replacing them.",
+    } : { kind: "settled", remainder };
+}
+//# sourceMappingURL=capture-outcome.js.map

package/dist/detection/capture-outcome.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"capture-outcome.js","sourceRoot":"","sources":["../../src/detection/capture-outcome.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;4EAU4E;AAC5E,OAAO,EAAE,GAAG,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAGzC,OAAO,EAAE,iBAAiB,EAAE,qBAAqB,EAAkB,MAAM,kBAAkB,CAAC;AAC5F,OAAO,EAAE,4BAA4B,EAAE,WAAW,EAAE,MAAM,eAAe,CAAC;AAS1E,MAAM,WAAW,GAAG,CAAC,UAAU,EAAE,oBAAoB,CAAU,CAAC;AAIhE,MAAM,UAAU,qBAAqB,CAAC,QAA2B,EAAE,KAIlE;IACC,IAAI,KAAK,CAAC,SAAS,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,EAAE,4CAA4C,EAAE,CAAC;IACjH,MAAM,SAAS,GAAgB,EAAE,CAAC;IAClC,MAAM,SAAS,GAAG,QAAQ,CAAC,WAAW,CAAC,GAAa,EAAE;QACpD,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC;QAC3C,MAAM,KAAK,GAAa,EAAE,CAAC;QAC3B,KAAK,MAAM,IAAI,IAAI,CAAC,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,SAAS,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC;YACnF,MAAM,IAAI,GAAG,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;YAC1B,IAAI,CAAC,IAAI,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,IAAI,GAAG,GAAG,EAAE,CAAC;gBAAE,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC/F,CAAC;QACD,KAAK,MAAM,SAAS,IAAI,WAAW,EAAE,CAAC;YACpC,MAAM,KAAK,GAAG,QAAQ,CAAC,OAAO,CAAC;2BACV,SAAS;;2BAET,SAAS;OAC7B,CAAC,CAAC;YACH,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;gBACzB,MAAM,MAAM,GAAG,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,IAAI,GAAG,GAAG,EAAE,CAAC;gBAC3D,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,MAAM,CAAC,YAAY,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;gBAC/E,KAAK,MAAM,GAAG,IAAI,KAAK,CAAC,GAAG,CAAC,IAAI,EAAE,KAAK,CAAC,WAAW,EAAE,MAAM,EAAE,KAAK,EAAE,KAAK,CAAC,WAAW,CAAuB,EAAE,CAAC;oBAC7G,QAAQ,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;gBACzB,CAAC;YACH,CAAC;QACH,CAAC;QACD,MAAM,OAAO,GAAG,MAAM,CAAC,WAAW,CAAC,WAAW,CAAC,GAAG,CAAC,SAAS,CAAC,EAAE;YAC7D,MAAM,SAAS,GAAG,QAAQ,CAAC,OAAO,CAAC,UAAU,qBAAqB,SAAS,SAAS,qCAAqC,CAAC,CAAC;YAC3H,MAAM,KAAK,GAAG,IAAI,GAAG,EAAiC,CAAC;YACvD,OAAO,CAAC,SAAS,EAAE,CAAC,IAAY,EAAyB,EAAE;oBACzD,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC;wBAAE,KAAK,CAAC,GAAG,CAAC,IAAI,EAAE,SAAS,CAAC,GAAG,CAAC,IAAI,EAAE,KAAK,CAAC,WAAW,CAA0B,CAAC,CAAC;oBACvG,OAAO,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;gBACzB,CAAC,CAAC,CAAC;QACL,CAAC,CAAC,CAA+D,CAAC;QAClE,MAAM,OAAO,GAAG,MAAM,CAAC,WAAW,CAAC,WAAW,CAAC,GAAG,CAAC,SAAS,CAAC,EAAE;YAC7D,MAAM,SAAS,GAAG,QAAQ,CAAC,OAAO,CAChC,0BAA0B,SAAS,kEAAkE,CAAC,CAAC;YACzG,OAAO,CAAC,SAAS,EAAE,CAAC,IAAY,EAAY,EAAE,CAAC,SAAS,CAAC,GAAG,CAAC,IAAI,EAAE,KAAK,CAAC,WAAW,CAAa,CAAC,CAAC;QACrG,CAAC,CAAC,CAAkD,CAAC;QACrD,MAAM,MAAM,GAAG,CAAC,GAA0B,EAAE,SAAoB,EAAW,EAAE,CAAC,GAAG,KAAK,SAAS;eAC1F,iBAAiB,CAAC,GAAG,EAAE,OAAO,CAAC,SAAS,CAAC,CAAC,CAAC;QAChD,0EAA0E;QAC1E,MAAM,SAAS,GAAG,CAAC,QAAmB,EAAE,MAAiB,EAAW,EAAE;YACpE,IAAI,QAAQ,CAAC,IAAI,KAAK,MAAM,CAAC,IAAI,IAAI,QAAQ,CAAC,UAAU,KAAK,MAAM,CAAC,UAAU,IAAI,QAAQ,CAAC,IAAI,KAAK,MAAM,CAAC,IAAI;gBAAE,OAAO,KAAK,CAAC;YAC9H,IAAI,QAAQ,CAAC,IAAI,KAAK,WAAW,IAAI,QAAQ,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;gBAChE,4DAA4D;gBAC5D,MAAM,GAAG,GAAG,CAAC,MAAc,EAAU,EAAE,CAAC,GAAG,MAAM,CAAC,IAAI,KAAK,MAAM,CAAC,IAAI,EAAE,CAAC;gBACzE,MAAM,IAAI,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,kBAAkB,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC;gBACzE,MAAM,IAAI,GAAG,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,OAAO,CAAC,kBAAkB,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,SAAS,CAAC,CAAC;gBACnH,OAAO,IAAI,CAAC,MAAM,KAAK,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;YAChF,CAAC;YACD,OAAO,QAAQ,CAAC,IAAI,KAAK,UAAU,IAAI,WAAW,CAAC,4BAA4B,CAAC,QAAQ,EAAE,QAAQ,CAAC,IAAI,CAAC,EAAE,QAAQ,EAAE,MAAM,CAAC,CAAC;QAC9H,CAAC,CAAC;QACF,MAAM,SAAS,GAAa,EAAE,CAAC;QAC/B,KAAK,MAAM,IAAI,IAAI,QAAQ,EAAE,CAAC;YAC5B,MAAM,QAAQ,GAAG,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,kBAAkB,CAAC,IAAI,CAAC,CAAC;YACnF,MAAM,OAAO,GAAG,MAAM,CAAC,QAAQ,EAAE,UAAU,CAAC,EAAE,QAAQ,GAAG,MAAM,CAAC,MAAM,EAAE,oBAAoB,CAAC,CAAC;YAC9F,wEAAwE;YACxE,2EAA2E;YAC3E,IAAI,OAAO,KAAK,QAAQ,IAAI,CAAC,CAAC,OAAO,IAAI,QAAS,CAAC,OAAO,KAAK,MAAO,CAAC,OAAO,CAAC;gBAAE,SAAS;YAC1F,IAAI,OAAO,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;gBAAC,SAAS,CAAC,IAAI,CAAC,QAAS,CAAC,CAAC;gBAAC,SAAS;YAAC,CAAC;YAC7E,IAAI,CAAC,OAAO,IAAI,CAAC,QAAQ,IAAI,CAAC,SAAS,CAAC,QAAS,EAAE,MAAO,CAAC;gBAAE,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACpF,CAAC;QACD,OAAO,SAAS,CAAC;IACnB,CAAC,CAAC,EAAE,CAAC;IACL,OAAO,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC;QACxB,IAAI,EAAE,YAAY,EAAE,SAAS,EAAE,SAAS,CAAC,IAAI,EAAE;QAC/C,MAAM,EAAE,iJAAiJ;KAC1J,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,SAAS,EAAE,CAAC;AACrC,CAAC"}

package/dist/detection/container-membership.d.ts

@@ -0,0 +1,32 @@
+/**
+ * A container's version is its portable fields plus the membership hash of
+ * its active children. A child counts toward its parent by its UUID and name
+ * while active, so only a create, move, rename or lifecycle change affects a
+ * parent; a content change leaves every parent as it is. A named unit
+ * re-derives each affected parent from that parent's complete stored child
+ * set with the unit's own rows substituted. Observation (O) and sharing (S)
+ * are derived separately: O from every observed result, S from the selected
+ * result only. A membership-only container change is local; it never
+ * becomes a Record.
+ */
+import { type Sha256Hex } from "@amalgm/live";
+import { type GroundRow } from "../ground-row.js";
+type Member = Pick<GroundRow, "uuid" | "parentUUID" | "name" | "status">;
+/** The parents whose membership changes between each identity's stored row
+ * and its row after a unit: the parent it leaves and the parent it joins. */
+export declare function membershipParents(changes: Iterable<{
+    readonly before: Member | null | undefined;
+    readonly after: Member | null | undefined;
+}>): Set<string>;
+export declare function finalizeContainers(input: {
+    /** Each affected parent's own row in this inventory. */
+    readonly parents: readonly GroundRow[];
+    /** The complete stored children of a parent in this inventory. */
+    readonly children: (parentUUID: string) => readonly Member[];
+    /** Every identity the unit examined; their stored placement is replaced. */
+    readonly targets: ReadonlySet<string>;
+    /** The unit's rows in this inventory, wherever they now belong. */
+    readonly results: readonly Member[];
+    readonly sha256Hex: Sha256Hex;
+}): GroundRow[];
+export {};

package/dist/detection/container-membership.js

@@ -0,0 +1,49 @@
+/**
+ * A container's version is its portable fields plus the membership hash of
+ * its active children. A child counts toward its parent by its UUID and name
+ * while active, so only a create, move, rename or lifecycle change affects a
+ * parent; a content change leaves every parent as it is. A named unit
+ * re-derives each affected parent from that parent's complete stored child
+ * set with the unit's own rows substituted. Observation (O) and sharing (S)
+ * are derived separately: O from every observed result, S from the selected
+ * result only. A membership-only container change is local; it never
+ * becomes a Record.
+ */
+import { canonicalVersion, membershipHash } from "@amalgm/live";
+import { portableGroundRecord as portable } from "../ground-row.js";
+/** The parents whose membership changes between each identity's stored row
+ * and its row after a unit: the parent it leaves and the parent it joins. */
+export function membershipParents(changes) {
+    const parents = new Set();
+    for (const { before, after } of changes) {
+        const left = counted(before);
+        const joined = counted(after);
+        if (left?.parentUUID === joined?.parentUUID && left?.name === joined?.name)
+            continue;
+        if (left)
+            parents.add(left.parentUUID);
+        if (joined)
+            parents.add(joined.parentUUID);
+    }
+    return parents;
+}
+const counted = (row) => row?.status === "active" && row.parentUUID ? row : null;
+export function finalizeContainers(input) {
+    const changed = [];
+    for (const parent of input.parents) {
+        // A repository's payload is its Card + Checkpoint, never a membership hash.
+        if (parent.type !== "workspace" && parent.type !== "folder") {
+            throw new Error(`named membership parent ${parent.uuid} is not a folder`);
+        }
+        const members = input.children(parent.uuid).filter(child => !input.targets.has(child.uuid))
+            .concat(input.results.filter(row => row.parentUUID === parent.uuid))
+            .filter(child => child.status === "active")
+            .map(({ uuid, name }) => ({ uuid, name }));
+        const version = canonicalVersion({ ...portable(parent),
+            payloadVersion: membershipHash(members, input.sha256Hex) }, input.sha256Hex);
+        if (version !== parent.version)
+            changed.push({ ...parent, version });
+    }
+    return changed;
+}
+//# sourceMappingURL=container-membership.js.map

package/dist/detection/container-membership.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"container-membership.js","sourceRoot":"","sources":["../../src/detection/container-membership.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,OAAO,EAAE,gBAAgB,EAAE,cAAc,EAAkB,MAAM,cAAc,CAAC;AAEhF,OAAO,EAAE,oBAAoB,IAAI,QAAQ,EAAkB,MAAM,kBAAkB,CAAC;AAIpF;6EAC6E;AAC7E,MAAM,UAAU,iBAAiB,CAAC,OAGhC;IACA,MAAM,OAAO,GAAG,IAAI,GAAG,EAAU,CAAC;IAClC,KAAK,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,OAAO,EAAE,CAAC;QACxC,MAAM,IAAI,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;QAC7B,MAAM,MAAM,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC;QAC9B,IAAI,IAAI,EAAE,UAAU,KAAK,MAAM,EAAE,UAAU,IAAI,IAAI,EAAE,IAAI,KAAK,MAAM,EAAE,IAAI;YAAE,SAAS;QACrF,IAAI,IAAI;YAAE,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,UAAW,CAAC,CAAC;QACxC,IAAI,MAAM;YAAE,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,UAAW,CAAC,CAAC;IAC9C,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,MAAM,OAAO,GAAG,CAAC,GAA8B,EAAiB,EAAE,CAChE,GAAG,EAAE,MAAM,KAAK,QAAQ,IAAI,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC;AAE1D,MAAM,UAAU,kBAAkB,CAAC,KAUlC;IACC,MAAM,OAAO,GAAgB,EAAE,CAAC;IAChC,KAAK,MAAM,MAAM,IAAI,KAAK,CAAC,OAAO,EAAE,CAAC;QACnC,4EAA4E;QAC5E,IAAI,MAAM,CAAC,IAAI,KAAK,WAAW,IAAI,MAAM,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;YAC5D,MAAM,IAAI,KAAK,CAAC,2BAA2B,MAAM,CAAC,IAAI,kBAAkB,CAAC,CAAC;QAC5E,CAAC;QACD,MAAM,OAAO,GAAG,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;aACxF,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,UAAU,KAAK,MAAM,CAAC,IAAI,CAAC,CAAC;aACnE,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,MAAM,KAAK,QAAQ,CAAC;aAC1C,GAAG,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC;QAC7C,MAAM,OAAO,GAAG,gBAAgB,CAAC,EAAE,GAAG,QAAQ,CAAC,MAAM,CAAC;YACpD,cAAc,EAAE,cAAc,CAAC,OAAO,EAAE,KAAK,CAAC,SAAS,CAAC,EAAE,EAAE,KAAK,CAAC,SAAS,CAAC,CAAC;QAC/E,IAAI,OAAO,KAAK,MAAM,CAAC,OAAO;YAAE,OAAO,CAAC,IAAI,CAAC,EAAE,GAAG,MAAM,EAAE,OAAO,EAAE,CAAC,CAAC;IACvE,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC"}

package/dist/detection/detect-cancelled.d.ts

@@ -0,0 +1,6 @@
+/** Shutdown ended this examination. It is neither a source failure nor a
+ * completed observation; the next startup suspects the ground again. */
+export declare class DetectCancelled extends Error {
+    constructor();
+}
+export declare function isDetectCancelled(error: unknown): boolean;

package/dist/detection/detect-cancelled.js

@@ -0,0 +1,10 @@
+/** Shutdown ended this examination. It is neither a source failure nor a
+ * completed observation; the next startup suspects the ground again. */
+export class DetectCancelled extends Error {
+    constructor() { super("Detect examination cancelled by shutdown"); }
+}
+export function isDetectCancelled(error) {
+    return error instanceof DetectCancelled
+        || (error instanceof Error && isDetectCancelled(error.cause));
+}
+//# sourceMappingURL=detect-cancelled.js.map

package/dist/detection/detect-cancelled.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"detect-cancelled.js","sourceRoot":"","sources":["../../src/detection/detect-cancelled.ts"],"names":[],"mappings":"AAAA;wEACwE;AACxE,MAAM,OAAO,eAAgB,SAAQ,KAAK;IACxC,gBAAgB,KAAK,CAAC,0CAA0C,CAAC,CAAC,CAAC,CAAC;CACrE;AAED,MAAM,UAAU,iBAAiB,CAAC,KAAc;IAC9C,OAAO,KAAK,YAAY,eAAe;WAClC,CAAC,KAAK,YAAY,KAAK,IAAI,iBAAiB,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC;AAClE,CAAC"}

package/dist/detection/directory-proof.d.ts

@@ -0,0 +1,47 @@
+/** Physical directory associations used by one named observation. */
+export interface DirectoryBasis {
+    readonly uuid: string;
+    readonly type: string;
+    readonly parentUUID: string | null;
+    readonly physicalKey: string;
+}
+export interface DirectoryPhysical {
+    readonly physicalKey: string;
+    readonly repository: boolean;
+}
+interface DirectoryProofPorts<Row> {
+    /** The indexed row at a container address. Beneath a proved parent every
+     * ancestor is already proved active, so only the row's own lifecycle and
+     * its parent remain to decide; the root is decided along its whole chain. */
+    readonly lookup: (path: string, parent: Row | undefined) => Row | undefined;
+    readonly read: (path: string) => DirectoryPhysical | null;
+}
+/**
+ * A named path can reuse an indexed identity only while its directory chain
+ * still names the same indexed physical containers. This proof owns no
+ * identity decisions: a mismatch or an unindexed container asks the complete
+ * Live reconciliation to decide. Directory timestamps are intentionally
+ * irrelevant; sibling writes do not change the parent association. Each
+ * container is read physically again at admission; the rows it was matched
+ * against are facts of the admission basis.
+ */
+export declare class NamedDirectoryProof<Row extends DirectoryBasis> {
+    #private;
+    /** Distinct containers this pass read; the commit's recheck is closure. */
+    metadataReads: number;
+    constructor(ports: DirectoryProofPorts<Row>);
+    private read;
+    /**
+     * Prove the directory chain containing a named path, even when Watch
+     * supplies only a child or Git notice. The name itself is read once, by
+     * the caller that classifies it; a Git notice's repository is one of its
+     * containers.
+     */
+    named(path: string): boolean;
+    /** One indexed container, proved beneath its proved parent from the root
+     * down, so a chain costs one lookup per container however deep it runs.
+     * Each is read once per pass and retained for commit. */
+    directory(path: string): Row | undefined;
+    unchanged(): boolean;
+}
+export {};