@astrosheep/keiyaku 2.9.8 → 2.9.10

package/build/core/repository-ledger/accepted-fold-read.js

@@ -0,0 +1,19 @@
+import { resolveLocalBranchHead } from "../../git/refs.js";
+import { foldRepositoryLedger } from "./fold-repository.js";
+import { REPOSITORY_LEDGER_REF } from "./codec.js";
+import { traverseRepositoryLedger } from "./traversal.js";
+export async function observeRepositoryLedgerHead(cwd) {
+    return (await resolveLocalBranchHead(cwd, REPOSITORY_LEDGER_REF))?.head ?? null;
+}
+/** The shared current-head typed traversal and fold used by full and targeted reads. */
+export async function readAcceptedRepositoryFold(cwd, options = {}) {
+    const observedLedgerHead = await (options.observeHead ?? observeRepositoryLedgerHead)(cwd);
+    if (observedLedgerHead === null)
+        return { observedLedgerHead: null, traversed: null, folded: null };
+    const traversed = await traverseRepositoryLedger(cwd, observedLedgerHead, options.signal, { historicalSemanticEvidence: false });
+    return {
+        observedLedgerHead,
+        traversed,
+        folded: foldRepositoryLedger(traversed),
+    };
+}

package/build/core/repository-ledger/accepted-tail.js

@@ -0,0 +1,116 @@
+import { validateTransactionMembership, } from "./transaction-membership.js";
+function topologyParents(node) {
+    return node.type === "transaction" || node.type === "join" || node.type === "disease"
+        ? node.ledgerParents
+        : [];
+}
+function reachableLedgerNodes(head, nodes) {
+    const objectIds = new Set();
+    const pending = [head];
+    while (pending.length > 0) {
+        const objectId = pending.pop();
+        if (objectIds.has(objectId))
+            continue;
+        const node = nodes.get(objectId);
+        if (!node)
+            return { status: "malformed", detail: `ledger topology is missing ${objectId}` };
+        if (node.type === "lifecycle") {
+            return { status: "malformed", detail: `lifecycle entry ${objectId} occupies a ledger-topology edge` };
+        }
+        if (node.type === "disease") {
+            return { status: "malformed", detail: `diseased node ${objectId} occupies ledger topology` };
+        }
+        objectIds.add(objectId);
+        pending.push(...topologyParents(node));
+    }
+    return { status: "reachable", objectIds };
+}
+function acceptedRows(read) {
+    const rows = new Map();
+    for (const model of read.contracts) {
+        for (const row of model.history) {
+            if (rows.has(row.objectId))
+                return null;
+            rows.set(row.objectId, row);
+        }
+    }
+    return rows;
+}
+/** Resolve one immutable mutation identity from its containing transaction node. */
+export function resolveAcceptedLifecycleTransaction(input) {
+    const { read, transactionObjectId } = input;
+    if (transactionObjectId.length === 0)
+        return { status: "refused", reason: "missing", transactionObjectId };
+    const nodes = new Map();
+    for (const node of read.topology.nodes) {
+        if (nodes.has(node.objectId)) {
+            return { status: "refused", reason: "malformed", transactionObjectId, detail: `duplicate topology identity ${node.objectId}` };
+        }
+        nodes.set(node.objectId, node);
+    }
+    const node = nodes.get(transactionObjectId);
+    if (!node)
+        return { status: "refused", reason: "missing", transactionObjectId };
+    if (read.topology.head === null)
+        return { status: "refused", reason: "unreachable", transactionObjectId };
+    const reachable = reachableLedgerNodes(read.topology.head, nodes);
+    if (reachable.status === "malformed") {
+        return { status: "refused", reason: "malformed", transactionObjectId, detail: reachable.detail };
+    }
+    if (!reachable.objectIds.has(transactionObjectId)) {
+        return { status: "refused", reason: "unreachable", transactionObjectId };
+    }
+    if (node.type === "disease") {
+        return { status: "refused", reason: "malformed", transactionObjectId, detail: "transaction boundary is diseased" };
+    }
+    if (node.type !== "transaction") {
+        return { status: "refused", reason: "nonconforming", transactionObjectId, detail: "accepted identity is not a transaction node" };
+    }
+    if (node.entryObjectIds.length === 0 || node.finalEntryObjectId !== node.entryObjectIds.at(-1)) {
+        return { status: "refused", reason: "malformed", transactionObjectId, detail: "transaction has no coherent ordered final member" };
+    }
+    if (new Set(node.entryObjectIds).size !== node.entryObjectIds.length) {
+        return { status: "refused", reason: "malformed", transactionObjectId, detail: "transaction repeats a member link" };
+    }
+    if (input.expectedContract !== undefined && input.expectedContract !== node.contract) {
+        return {
+            status: "refused",
+            reason: "wrong-contract",
+            transactionObjectId,
+            expectedContract: input.expectedContract,
+            actualContract: node.contract,
+        };
+    }
+    const rows = acceptedRows(read);
+    if (!rows) {
+        return { status: "refused", reason: "malformed", transactionObjectId, detail: "accepted fold repeats an entry identity" };
+    }
+    const entries = [];
+    for (const entryObjectId of node.entryObjectIds) {
+        const row = rows.get(entryObjectId);
+        if (!row) {
+            return {
+                status: "refused",
+                reason: "nonconforming",
+                transactionObjectId,
+                detail: `transaction member ${entryObjectId} was not accepted by fold`,
+            };
+        }
+        if (row.entry.contract !== node.contract) {
+            return { status: "refused", reason: "malformed", transactionObjectId, detail: "transaction contract disagrees with an accepted member" };
+        }
+        entries.push(row.entry);
+    }
+    const validation = validateTransactionMembership(node.verb, entries);
+    if (validation.status === "invalid") {
+        return { status: "refused", reason: "nonconforming", transactionObjectId, detail: validation.detail };
+    }
+    return {
+        status: "accepted",
+        transactionObjectId,
+        predecessor: node.ledgerParents[0] ?? null,
+        contract: node.contract,
+        entryObjectIds: [...node.entryObjectIds],
+        ...validation.membership,
+    };
+}

package/build/core/repository-ledger/admission.js

@@ -0,0 +1,38 @@
+import { lookupCurrentContract, } from "./read-model.js";
+export function admitRepositoryLifecycleContract(read, contract) {
+    const outcome = lookupCurrentContract(read, contract);
+    switch (outcome.status) {
+        case "healthy":
+            return {
+                status: "healthy",
+                contract,
+                model: outcome.model,
+                diagnostics: outcome.diagnostics,
+            };
+        case "diseased":
+            return {
+                status: "diseased",
+                contract,
+                model: outcome.model,
+                diagnostics: outcome.diagnostics,
+            };
+        case "isolated":
+            return {
+                status: "isolated",
+                contract,
+                diagnostics: outcome.diagnostics,
+            };
+        case "indeterminate":
+            return {
+                status: "indeterminate",
+                contract,
+                diagnostics: outcome.diagnostics,
+            };
+        case "absent":
+            return {
+                status: "absent",
+                contract,
+                diagnostics: outcome.diagnostics,
+            };
+    }
+}

package/build/core/repository-ledger/authoritative-transaction.js

@@ -0,0 +1 @@
+export {};

package/build/core/repository-ledger/claim-evidence.js

@@ -0,0 +1,147 @@
+import fs from "node:fs/promises";
+import os from "node:os";
+import path from "node:path";
+import { runGitProcess } from "../../git/core.js";
+import { assertReadableCommit, deriveHostGitCoordinates, readCommitObject, RepositoryObjectError, writeCommitObject, } from "./git-object-store.js";
+export class ClaimEvidenceMismatchError extends Error {
+    constructor(message, options) {
+        super(message, options);
+        this.name = "ClaimEvidenceMismatchError";
+    }
+}
+export class ClaimEvidenceOperationalError extends Error {
+    retryable = true;
+    constructor(message, options) {
+        super(message, options);
+        this.name = "ClaimEvidenceOperationalError";
+    }
+}
+function claimCommitReadError(error) {
+    if (error instanceof RepositoryObjectError &&
+        (error.reason === "commit-format" || error.reason === "object-id")) {
+        return new ClaimEvidenceMismatchError("claim merge commit has malformed persisted structure", { cause: error });
+    }
+    return new ClaimEvidenceOperationalError("cannot read claim merge commit for verification", { cause: error });
+}
+function claimCommitClosureError(error) {
+    if (error instanceof RepositoryObjectError && error.reason === "incomplete-commit-closure") {
+        return new ClaimEvidenceMismatchError("claim merge commit has incomplete persisted object closure", { cause: error });
+    }
+    return new ClaimEvidenceOperationalError("cannot verify claim merge commit object closure", { cause: error });
+}
+async function honestMergeTree(cwd, coordinates) {
+    const result = await runGitProcess(cwd, [
+        "merge-tree",
+        "--write-tree",
+        "--merge-base",
+        coordinates.base,
+        coordinates.targetHead,
+        coordinates.deliveryHead,
+    ]);
+    if (result.status !== 0 || result.error) {
+        const detail = result.stderr.trim() || result.error?.message || `exit ${String(result.status)}`;
+        throw new Error(`claim frozen three-way merge is not conflict-free: ${detail}`, { cause: result.error });
+    }
+    return result.stdout.trim();
+}
+export async function repositoryObjectDirectory(cwd, signal) {
+    const result = await runGitProcess(cwd, ["rev-parse", "--path-format=absolute", "--git-path", "objects"], { signal });
+    if (result.error?.name === "AbortError")
+        throw result.error;
+    if (result.status !== 0 || result.error || !path.isAbsolute(result.stdout.trim())) {
+        const detail = result.stderr.trim() || result.error?.message || "Git did not return an absolute object directory";
+        throw new ClaimEvidenceOperationalError(`cannot resolve repository object storage for claim verification: ${detail}`, { cause: result.error });
+    }
+    return result.stdout.trim();
+}
+async function isolatedHonestMergeTree(cwd, coordinates, objectDirectory, signal) {
+    let temporaryRoot;
+    try {
+        const repositoryObjects = objectDirectory ?? await repositoryObjectDirectory(cwd, signal);
+        temporaryRoot = await fs.mkdtemp(path.join(os.tmpdir(), "keiyaku-claim-evidence-"));
+        const temporaryObjects = path.join(temporaryRoot, "objects");
+        await fs.mkdir(temporaryObjects);
+        const result = await runGitProcess(cwd, [
+            "merge-tree",
+            "--write-tree",
+            "--merge-base",
+            coordinates.base,
+            coordinates.targetHead,
+            coordinates.deliveryHead,
+        ], {
+            env: {
+                GIT_OBJECT_DIRECTORY: temporaryObjects,
+                GIT_ALTERNATE_OBJECT_DIRECTORIES: repositoryObjects,
+            },
+            signal,
+        });
+        if (result.error?.name === "AbortError")
+            throw result.error;
+        if (result.status !== 0 || result.error || result.stdout.trim() === "") {
+            const detail = result.stderr.trim() || result.error?.message || `exit ${String(result.status)}`;
+            throw new ClaimEvidenceOperationalError(`cannot compute frozen claim merge for verification: ${detail}`, { cause: result.error });
+        }
+        return result.stdout.trim();
+    }
+    catch (error) {
+        if (error instanceof ClaimEvidenceOperationalError)
+            throw error;
+        throw new ClaimEvidenceOperationalError("cannot prepare isolated claim evidence verification", { cause: error });
+    }
+    finally {
+        if (temporaryRoot !== undefined) {
+            try {
+                await fs.rm(temporaryRoot, { recursive: true, force: true });
+            }
+            catch (error) {
+                throw new ClaimEvidenceOperationalError("cannot clean isolated claim evidence verification storage", { cause: error });
+            }
+        }
+    }
+}
+export async function buildHonestClaimMerge(input) {
+    const mergeTree = await honestMergeTree(input.cwd, input.coordinates);
+    const host = await deriveHostGitCoordinates(input.cwd);
+    const identity = { name: input.actor, email: "keiyaku@localhost", date: input.at };
+    const mergeCommit = await writeCommitObject({
+        cwd: input.cwd,
+        coordinates: host,
+        tree: mergeTree,
+        parents: [input.coordinates.targetHead, input.coordinates.deliveryHead],
+        author: identity,
+        committer: identity,
+        message: `keiyaku: claim ${input.contractId}\n\nMerge contract ${input.contractId} into ${input.coordinates.target.slice("refs/heads/".length)}.\n`,
+    });
+    await assertHonestClaimEvidence(input.cwd, { ...input.coordinates, mergeCommit });
+    return { mergeTree, mergeCommit };
+}
+export async function assertHonestClaimEvidence(cwd, evidence, readContext) {
+    let merge;
+    try {
+        const coordinates = readContext?.coordinates ?? await deriveHostGitCoordinates(cwd);
+        merge = readContext === undefined
+            ? await readCommitObject(cwd, coordinates, evidence.mergeCommit)
+            : await readContext.reader.read(evidence.mergeCommit);
+    }
+    catch (error) {
+        throw claimCommitReadError(error);
+    }
+    if (merge.parents.length !== 2 ||
+        merge.parents[0] !== evidence.targetHead ||
+        merge.parents[1] !== evidence.deliveryHead) {
+        throw new ClaimEvidenceMismatchError("claim merge commit must have exactly targetHead then deliveryHead as parents");
+    }
+    const expectedTree = await isolatedHonestMergeTree(cwd, evidence, readContext?.objectDirectory, readContext?.signal);
+    if (merge.tree !== expectedTree) {
+        throw new ClaimEvidenceMismatchError(`claim merge tree ${merge.tree} does not equal honest frozen merge tree ${expectedTree}`);
+    }
+}
+export async function assertHonestClaimEvidenceClosure(cwd, mergeCommit) {
+    try {
+        const coordinates = await deriveHostGitCoordinates(cwd);
+        await assertReadableCommit(cwd, coordinates, mergeCommit);
+    }
+    catch (error) {
+        throw claimCommitClosureError(error);
+    }
+}

package/build/core/repository-ledger/codec.js

@@ -0,0 +1,297 @@
+import { z } from "zod";
+export const REPOSITORY_LEDGER_REF = "refs/heads/keiyaku-ledger";
+export const REPOSITORY_DELIVERY_REF_PREFIX = "refs/heads/keiyaku/";
+export function repositoryDeliveryRef(contract) {
+    return `${REPOSITORY_DELIVERY_REF_PREFIX}${contract}`;
+}
+const UTC_RFC3339_RE = /^\d{4}-\d{2}-\d{2}T\d{2}:\d{2}:\d{2}(?:\.\d{3})?Z$/;
+const CONTRACT_RE = /^\S+$/;
+const LIFECYCLE_SUBJECT_RE = /^keiyaku: (bind|bootstrap|arc|seal|amend|renew|petition|verdict|claim|forfeit) (\S+)$/;
+const JOIN_SUBJECT = "keiyaku: join";
+const TRANSACTION_SUBJECT = "keiyaku: transaction";
+const nonblank = z.string().refine((value) => value.trim().length > 0, "expected a nonblank string");
+const contractId = z.string().regex(CONTRACT_RE, "contract ID must be nonempty and contain no whitespace");
+const timestamp = z.string()
+    .regex(UTC_RFC3339_RE, "expected UTC RFC-3339 seconds or milliseconds")
+    .refine((value) => {
+    const milliseconds = Date.parse(value);
+    if (!Number.isFinite(milliseconds))
+        return false;
+    const canonical = new Date(milliseconds).toISOString();
+    return value.includes(".") ? canonical === value : canonical.replace(".000Z", "Z") === value;
+}, "expected a real UTC calendar date and time");
+export const fullBranchRefSchema = z.string().regex(/^refs\/heads\/\S+$/, "expected a full refs/heads name");
+const safePositiveInteger = z.number().int().positive().refine(Number.isSafeInteger, "expected a positive safe integer");
+const safeNonnegativeInteger = z.number().int().nonnegative().refine(Number.isSafeInteger, "expected a nonnegative safe integer");
+const place = z.string().regex(/^[a-z]{2,13}(?:[2-9]|[1-9][0-9]+)?$/, "expected a canonical worktree place");
+function utf8Length(value) {
+    return new TextEncoder().encode(value).byteLength;
+}
+function objectIdSchema(format) {
+    const length = format === "sha1" ? 40 : 64;
+    return z.string().regex(new RegExp(`^[0-9a-f]{${length}}$`, "i"), `expected a full ${format} object ID`);
+}
+function lifecycleEnvelope(kind, version, data) {
+    return z.object({
+        v: z.literal(version),
+        kind: z.literal(kind),
+        contract: contractId,
+        at: timestamp,
+        actor: nonblank,
+        data,
+    }).strict();
+}
+function buildLifecycleEntrySchema(format) {
+    const oid = objectIdSchema(format);
+    const extension = z.object({ title: nonblank, content: z.string() }).strict();
+    const bootstrapPlan = z.object({
+        command: z.array(nonblank).min(1),
+        timeoutMs: safePositiveInteger.max(3_600_000),
+    }).strict();
+    const bootstrapResult = z.discriminatedUnion("kind", [
+        z.object({ kind: z.literal("exit"), code: z.number().int().min(0).max(255) }).strict(),
+        z.object({ kind: z.literal("signal"), signal: nonblank }).strict(),
+        z.object({ kind: z.literal("timeout") }).strict(),
+        z.object({ kind: z.literal("spawn"), message: z.string() }).strict(),
+    ]);
+    const bindCommon = {
+        title: nonblank,
+        context: nonblank,
+        objective: nonblank,
+        design: nonblank,
+        scope: z.array(nonblank).min(1),
+        criteria: z.array(nonblank),
+        verification: z.array(nonblank),
+        extensions: z.array(extension),
+        base: oid,
+        target: fullBranchRefSchema,
+    };
+    const bindData = z.discriminatedUnion("workspace", [
+        z.object({
+            ...bindCommon,
+            workspace: z.literal("worktree"),
+            after: z.array(contractId).min(1).optional(),
+            place,
+            bootstrap: bootstrapPlan.optional(),
+            taskIds: z.array(nonblank).min(1).optional(),
+        }).strict(),
+        z.object({
+            ...bindCommon,
+            workspace: z.literal("here"),
+            after: z.array(contractId).min(1).optional(),
+            taskIds: z.array(nonblank).min(1).optional(),
+        }).strict(),
+    ]);
+    const bootstrapData = z.object({
+        result: bootstrapResult,
+        durationMs: safeNonnegativeInteger,
+        stderrTail: z.string().optional(),
+        stderrTruncated: z.boolean().optional(),
+    }).strict().superRefine((value, context) => {
+        if (value.stderrTail !== undefined && utf8Length(value.stderrTail) > 2048) {
+            context.addIssue({ code: "custom", path: ["stderrTail"], message: "stderrTail exceeds 2048 UTF-8 bytes" });
+        }
+        if (value.result.kind === "spawn" && utf8Length(value.result.message) > 2048) {
+            context.addIssue({ code: "custom", path: ["result", "message"], message: "spawn message exceeds 2048 UTF-8 bytes" });
+        }
+        const successful = value.result.kind === "exit" && value.result.code === 0;
+        if (successful && (value.stderrTail !== undefined || value.stderrTruncated !== undefined)) {
+            context.addIssue({ code: "custom", message: "successful bootstrap must discard stderr facts" });
+        }
+        if (value.stderrTruncated === true && value.stderrTail === undefined) {
+            context.addIssue({ code: "custom", path: ["stderrTruncated"], message: "truncated stderr requires a retained tail" });
+        }
+    });
+    return z.discriminatedUnion("kind", [
+        lifecycleEnvelope("bind", 2, bindData),
+        lifecycleEnvelope("bootstrap", 1, bootstrapData),
+        lifecycleEnvelope("arc", 1, z.object({
+            arc: safePositiveInteger,
+            title: nonblank,
+            objective: nonblank,
+            brief: nonblank,
+        }).strict()),
+        lifecycleEnvelope("seal", 2, z.object({
+            arc: safeNonnegativeInteger,
+            sealedBy: z.enum(["arc", "renew", "petition"]),
+            oldFence: oid,
+            receipts: z.array(oid),
+            newFence: oid,
+            diffstat: z.object({
+                files: safeNonnegativeInteger,
+                insertions: safeNonnegativeInteger,
+                deletions: safeNonnegativeInteger,
+            }).strict(),
+            scopeAudit: z.object({ violations: z.array(nonblank) }).strict(),
+        }).strict()),
+        lifecycleEnvelope("amend", 1, z.object({
+            amendment: nonblank,
+            scopeDelta: z.object({ add: z.array(nonblank).min(1) }).strict().optional(),
+        }).strict()),
+        lifecycleEnvelope("renew", 1, z.object({
+            oldBase: oid,
+            newBase: oid,
+            oldHead: oid,
+            newHead: oid,
+        }).strict()),
+        lifecycleEnvelope("petition", 2, z.discriminatedUnion("intent", [
+            z.object({
+                intent: z.literal("claim"),
+                oath: nonblank,
+                target: fullBranchRefSchema,
+                targetHead: oid,
+                seat: safePositiveInteger,
+            }).strict(),
+            z.object({
+                intent: z.literal("forfeit"),
+                target: fullBranchRefSchema,
+                seat: safePositiveInteger,
+            }).strict(),
+        ])),
+        lifecycleEnvelope("verdict", 1, z.object({
+            result: z.enum(["approved", "rejected"]),
+            summary: nonblank,
+        }).strict()),
+        lifecycleEnvelope("claim", 2, z.object({
+            target: fullBranchRefSchema,
+            base: oid,
+            targetHead: oid,
+            deliveryHead: oid,
+            mergeCommit: oid,
+        }).strict()),
+        lifecycleEnvelope("forfeit", 2, z.object({
+            reason: z.enum(["manual", "bind-failed"]),
+            actor: nonblank,
+            finalHead: oid,
+            note: nonblank.optional(),
+        }).strict()),
+    ]);
+}
+const lifecycleEntrySchemas = new Map();
+export function createLifecycleEntrySchema(format) {
+    const cached = lifecycleEntrySchemas.get(format);
+    if (cached)
+        return cached;
+    const schema = buildLifecycleEntrySchema(format);
+    lifecycleEntrySchemas.set(format, schema);
+    return schema;
+}
+export const structuralJoinSchema = z.object({
+    v: z.literal(1),
+    kind: z.literal("join"),
+    at: timestamp,
+    actor: nonblank,
+}).strict();
+export const lifecycleTransactionSchema = z.object({
+    v: z.literal(1),
+    kind: z.literal("transaction"),
+    verb: z.enum(["bind", "bootstrap", "amend", "arc", "seal", "renew", "petition", "verdict", "claim", "forfeit"]),
+    predecessor: z.enum(["none", "p1"]),
+}).strict();
+export class RepositoryLedgerCodecError extends Error {
+    reason;
+    code = "INVALID_REPOSITORY_LEDGER_CODEC";
+    constructor(reason, message, options) {
+        super(message, options);
+        this.reason = reason;
+        this.name = "RepositoryLedgerCodecError";
+    }
+}
+function canonicalMessage(subject, value) {
+    return `${subject}\n\n${JSON.stringify(value, null, 2)}\n`;
+}
+export function classifyRepositoryLedgerSubject(message) {
+    const end = message.indexOf("\n");
+    const subject = end < 0 ? message : message.slice(0, end);
+    if (subject === JOIN_SUBJECT)
+        return { type: "join" };
+    if (subject === TRANSACTION_SUBJECT)
+        return { type: "transaction" };
+    const match = LIFECYCLE_SUBJECT_RE.exec(subject);
+    if (!match)
+        return { type: "unknown" };
+    return { type: "lifecycle", kind: match[1], contract: match[2] };
+}
+export function formatLifecycleEntry(entry, format) {
+    const parsed = createLifecycleEntrySchema(format).safeParse(entry);
+    if (!parsed.success) {
+        throw new RepositoryLedgerCodecError("schema", `lifecycle schema validation failed: ${parsed.error.message}`, { cause: parsed.error });
+    }
+    return canonicalMessage(`keiyaku: ${parsed.data.kind} ${parsed.data.contract}`, parsed.data);
+}
+export function formatStructuralJoin(join) {
+    const parsed = structuralJoinSchema.safeParse(join);
+    if (!parsed.success) {
+        throw new RepositoryLedgerCodecError("schema", `join schema validation failed: ${parsed.error.message}`, { cause: parsed.error });
+    }
+    return canonicalMessage(JOIN_SUBJECT, parsed.data);
+}
+export function formatLifecycleTransaction(transaction) {
+    const parsed = lifecycleTransactionSchema.safeParse(transaction);
+    if (!parsed.success) {
+        throw new RepositoryLedgerCodecError("schema", `transaction schema validation failed: ${parsed.error.message}`, { cause: parsed.error });
+    }
+    return canonicalMessage(TRANSACTION_SUBJECT, parsed.data);
+}
+export function parseRepositoryLedgerMessage(message, format) {
+    if (message.startsWith("\uFEFF") || message.includes("\r")) {
+        throw new RepositoryLedgerCodecError("format", "ledger message must be canonical UTF-8 with LF line endings and no BOM");
+    }
+    const separator = message.indexOf("\n\n");
+    if (separator < 0 || !message.endsWith("\n")) {
+        throw new RepositoryLedgerCodecError("format", "ledger message must contain one subject, one blank line, JSON, and a final LF");
+    }
+    const subject = message.slice(0, separator);
+    const body = message.slice(separator + 2, -1);
+    let json;
+    try {
+        json = JSON.parse(body);
+    }
+    catch (error) {
+        throw new RepositoryLedgerCodecError("format", "ledger JSON is invalid", { cause: error });
+    }
+    if (subject === JOIN_SUBJECT) {
+        const parsed = structuralJoinSchema.safeParse(json);
+        if (!parsed.success) {
+            throw new RepositoryLedgerCodecError("schema", `join schema validation failed: ${parsed.error.message}`, { cause: parsed.error });
+        }
+        if (message !== canonicalMessage(JOIN_SUBJECT, parsed.data)) {
+            throw new RepositoryLedgerCodecError("noncanonical", "join message bytes are not canonical");
+        }
+        return parsed.data;
+    }
+    if (subject === TRANSACTION_SUBJECT) {
+        const parsed = lifecycleTransactionSchema.safeParse(json);
+        if (!parsed.success) {
+            throw new RepositoryLedgerCodecError("schema", `transaction schema validation failed: ${parsed.error.message}`, { cause: parsed.error });
+        }
+        if (message !== canonicalMessage(TRANSACTION_SUBJECT, parsed.data)) {
+            throw new RepositoryLedgerCodecError("noncanonical", "transaction message bytes are not canonical");
+        }
+        return parsed.data;
+    }
+    const subjectMatch = LIFECYCLE_SUBJECT_RE.exec(subject);
+    if (!subjectMatch) {
+        throw new RepositoryLedgerCodecError("format", "ledger subject is not a lifecycle entry, transaction, or structural join");
+    }
+    const parsed = createLifecycleEntrySchema(format).safeParse(json);
+    if (!parsed.success) {
+        throw new RepositoryLedgerCodecError("schema", `lifecycle schema validation failed: ${parsed.error.message}`, { cause: parsed.error });
+    }
+    if (parsed.data.kind !== subjectMatch[1] || parsed.data.contract !== subjectMatch[2]) {
+        throw new RepositoryLedgerCodecError("format", "lifecycle subject does not match its JSON body");
+    }
+    if (message !== canonicalMessage(`keiyaku: ${parsed.data.kind} ${parsed.data.contract}`, parsed.data)) {
+        throw new RepositoryLedgerCodecError("noncanonical", "lifecycle message bytes are not canonical");
+    }
+    return parsed.data;
+}
+export function evidenceObjectId(entry) {
+    switch (entry.kind) {
+        case "seal": return entry.data.newFence;
+        case "renew": return entry.data.oldHead;
+        case "claim": return entry.data.mergeCommit;
+        case "forfeit": return entry.data.finalHead;
+        default: return null;
+    }
+}