@astrosheep/keiyaku 4.0.0 → 4.0.2

package/build/src/akuma/requests.js

@@ -1,11 +1,13 @@
 import { randomUUID } from "node:crypto";
-import { existsSync, mkdirSync, readFileSync, readdirSync, renameSync, rmSync, writeFileSync, } from "node:fs";
+import { access, mkdir, readFile, readdir, rename, rm, writeFile } from "node:fs/promises";
 import { isAbsolute, join, resolve } from "node:path";
 import { HeldAkumaLeash, admitRequest, readNonterminalRequests, readRequest, readSoul, refuseRequest, reserveRequest, serveRequest, voidRequest, } from "./heart/index.js";
 import { parseAkuId, pathsForAkuId, archetypeName, worldRootForAkumaPaths, } from "./identity.js";
 import { BIRTH_TIMEOUT_MS, publishAkuma } from "./publication.js";
-import { AKUMA_REQUESTS_ENV, decodeProviderOptions } from "./provider.js";
-import { decodeProviderExecution, providerNamed } from "./providers/index.js";
+import { abortableDelay } from "./abort.js";
+import { AKUMA_REQUESTS_ENV } from "./provider.js";
+import { decodeProviderOptions, decodeReadonlyRestraint } from "./provider-recipe.js";
+import { resolveProviderExecution } from "./providers/index.js";
 const POLL_MS = 25;
 const UUID = /^[0-9a-f]{8}-[0-9a-f]{4}-4[0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/u;
 export class AkumaBodyRequestError extends Error {
@@ -19,9 +21,6 @@ export class AkumaBodyRequestError extends Error {
         this.name = "AkumaBodyRequestError";
     }
 }
-function wait(milliseconds) {
-    return new Promise((resolveWait) => setTimeout(resolveWait, milliseconds));
-}
 function diagnostic(error) {
     return error instanceof Error ? error.message : String(error);
 }
@@ -57,6 +56,7 @@ function decodeRecipe(value, cwd) {
         ...(recipe.description === undefined ? [] : ["description"]),
         "options",
         "provider",
+        ...(recipe.readonly === undefined ? [] : ["readonly"]),
     ];
     if (!exactKeys(recipe, expectedKeys))
         return null;
@@ -64,19 +64,21 @@ function decodeRecipe(value, cwd) {
         && (typeof recipe.description !== "string" || recipe.description.trim().length === 0))
         return null;
     try {
-        const provider = decodeProviderExecution(recipe.provider);
-        const adapter = providerNamed(provider);
+        const selected = resolveProviderExecution(recipe.provider);
+        const provider = selected.execution;
+        const adapter = selected.adapter;
         const decodedOptions = decodeProviderOptions(recipe.options);
-        const admission = adapter.admitOptions(decodedOptions);
-        if (admission.kind === "refused")
+        const readonly = recipe.readonly === undefined ? undefined : decodeReadonlyRestraint(recipe.readonly);
+        if ((decodedOptions.readonly === true) !== (readonly !== undefined))
             return null;
-        const confinement = adapter.confinement({ cwd, options: admission.options });
+        const confinement = adapter.confinement({ cwd, options: decodedOptions });
         if (!matchingConfinement(recipe.confinement, confinement))
             return null;
         return Object.freeze({
             ...(recipe.description === undefined ? {} : { description: recipe.description }),
             provider,
-            options: admission.options,
+            options: decodedOptions,
+            ...(readonly === undefined ? {} : { readonly }),
             confinement,
         });
     }
@@ -158,14 +160,14 @@ function decodeReceipt(bytes, requestId) {
     }
     return null;
 }
-function atomicJson(path, value) {
+async function atomicJson(path, value) {
     const temporary = `${path}.${randomUUID()}.tmp`;
     try {
-        writeFileSync(temporary, `${JSON.stringify(value)}\n`, { flag: "wx" });
-        renameSync(temporary, path);
+        await writeFile(temporary, `${JSON.stringify(value)}\n`, { flag: "wx" });
+        await rename(temporary, path);
     }
     finally {
-        rmSync(temporary, { force: true });
+        await rm(temporary, { force: true });
     }
 }
 function receiptFor(fact) {
@@ -177,10 +179,10 @@ function receiptFor(fact) {
         return { id: fact.id, state: fact.state, evidence: fact.evidence };
     return null;
 }
-function projectReceipt(directory, fact) {
+async function projectReceipt(directory, fact) {
     const receipt = receiptFor(fact);
     if (receipt !== null)
-        atomicJson(join(directory, `${fact.id}.receipt.json`), receipt);
+        await atomicJson(join(directory, `${fact.id}.receipt.json`), receipt);
 }
 export function injectedBodyRequests() {
     const directory = process.env[AKUMA_REQUESTS_ENV];
@@ -191,7 +193,7 @@ export function injectedBodyRequests() {
     return directory;
 }
 export async function requestBodyCall(input) {
-    atomicJson(join(input.directory, `${input.id}.request.json`), {
+    await atomicJson(join(input.directory, `${input.id}.request.json`), {
         id: input.id,
         world: input.world,
         archetype: input.archetype,
@@ -202,7 +204,7 @@ export async function requestBodyCall(input) {
     const receiptPath = join(input.directory, `${input.id}.receipt.json`);
     for (;;) {
         try {
-            const receipt = decodeReceipt(readFileSync(receiptPath, "utf8"), input.id);
+            const receipt = decodeReceipt(await readFile(receiptPath, "utf8"), input.id);
             if (receipt === null)
                 throw new Error(`Akuma body request ${input.id} has an invalid receipt`);
             if (receipt.state === "served")
@@ -215,14 +217,16 @@ export async function requestBodyCall(input) {
             if (error.code !== "ENOENT")
                 throw error;
         }
-        await wait(POLL_MS);
+        await abortableDelay(POLL_MS);
     }
 }
 async function serveClaim(input) {
-    let fact = admitRequest(input.paths, { ...input.claim, admittedAt: input.now() });
+    input.signal.throwIfAborted();
+    let fact = await admitRequest(input.paths, { ...input.claim, admittedAt: input.now() });
     const existing = receiptFor(fact);
     if (existing !== null) {
-        projectReceipt(input.directory, fact);
+        if (!input.signal.aborted)
+            await projectReceipt(input.directory, fact);
         return;
     }
     if (fact.state !== "admitted")
@@ -230,17 +234,19 @@ async function serveClaim(input) {
     const request = fact;
     const servingWorld = worldRootForAkumaPaths(input.paths);
     if (request.world !== servingWorld) {
-        fact = refuseRequest(input.paths, request.id, `request world ${request.world} does not match ${servingWorld}`);
-        projectReceipt(input.directory, fact);
+        fact = await refuseRequest(input.paths, request.id, `request world ${request.world} does not match ${servingWorld}`);
+        await projectReceipt(input.directory, fact);
         return;
     }
     const cwd = resolve(request.cwd ?? servingWorld);
     let child;
     try {
+        input.signal.throwIfAborted();
         const published = await publishAkuma({
             worldPath: servingWorld,
             archetype: request.archetype,
-            reserve: (allocated) => { fact = reserveRequest(input.paths, request.id, allocated.id); },
+            reserve: async (allocated) => { fact = await reserveRequest(input.paths, request.id, allocated.id); },
+            signal: input.signal,
             launch: async (allocated) => await input.spawn({
                 paths: allocated.paths,
                 seed: {
@@ -249,8 +255,9 @@ async function serveClaim(input) {
                     ...(request.recipe.description === undefined ? {} : { description: request.recipe.description }),
                     provider: request.recipe.provider,
                     options: request.recipe.options,
+                    ...(request.recipe.readonly === undefined ? {} : { readonly: request.recipe.readonly }),
                     cwd,
-                    origin: { kind: "request", parentId: input.parent.id, requestId: request.id },
+                    origin: { kind: "request", parent: input.parent.id, requestId: request.id },
                     confinement: request.recipe.confinement,
                 },
                 initialBody: request.body,
@@ -259,21 +266,23 @@ async function serveClaim(input) {
         child = published.id;
     }
     catch (error) {
-        const current = readRequest(input.paths, request.id);
+        if (input.signal.aborted)
+            return;
+        const current = await readRequest(input.paths, request.id);
         if (current === null)
             throw error;
         fact = current.state === "admitted" || current.state === "reserved"
-            ? voidRequest(input.paths, request.id, diagnostic(error))
+            ? await voidRequest(input.paths, request.id, diagnostic(error))
             : current;
-        projectReceipt(input.directory, fact);
+        await projectReceipt(input.directory, fact);
         return;
     }
-    fact = serveRequest(input.paths, request.id, child);
-    projectReceipt(input.directory, fact);
+    fact = await serveRequest(input.paths, request.id, child);
+    await projectReceipt(input.directory, fact);
 }
-function requestFiles(directory) {
+async function requestFiles(directory) {
     try {
-        return readdirSync(directory)
+        return (await readdir(directory))
             .filter((name) => name.endsWith(".request.json"))
             .sort();
     }
@@ -287,35 +296,47 @@ export class BodyRequestPump {
     input;
     directory;
     failure;
-    closed = false;
+    closeSignal = new AbortController();
     handled = new Set();
     running;
+    cancelAdmission;
     constructor(input) {
         this.input = input;
         this.directory = join(input.paths.directory, "requests", String(input.bodySequence));
-        mkdirSync(this.directory, { recursive: true });
+        this.cancelAdmission = () => this.stopAdmission();
+        input.signal.addEventListener("abort", this.cancelAdmission, { once: true });
+        if (input.signal.aborted)
+            this.cancelAdmission();
         this.running = this.run();
         this.failure = this.running.then(() => new Promise(() => { }), (error) => Promise.reject(error));
     }
+    static async open(input) {
+        const directory = join(input.paths.directory, "requests", String(input.bodySequence));
+        await mkdir(directory, { recursive: true });
+        return new BodyRequestPump(input);
+    }
     async run() {
-        while (!this.closed) {
-            for (const name of requestFiles(this.directory)) {
-                if (this.closed)
+        while (!this.closeSignal.signal.aborted) {
+            for (const name of await requestFiles(this.directory)) {
+                if (this.closeSignal.signal.aborted)
                     return;
                 const id = name.slice(0, -".request.json".length);
                 if (this.handled.has(id))
                     continue;
-                const claim = decodeClaim(readFileSync(join(this.directory, name), "utf8"), id);
+                const claim = decodeClaim(await readFile(join(this.directory, name), "utf8"), id);
                 if (claim === null) {
                     this.handled.add(id);
                     continue;
                 }
-                if (this.closed)
-                    return;
-                await serveClaim({ directory: this.directory, claim, ...this.input });
+                await serveClaim({ directory: this.directory, claim, ...this.input, signal: this.closeSignal.signal });
                 this.handled.add(id);
             }
-            await wait(POLL_MS);
+            try {
+                await abortableDelay(POLL_MS, this.closeSignal.signal);
+            }
+            catch {
+                return;
+            }
         }
     }
     async close() {
@@ -324,45 +345,53 @@ export class BodyRequestPump {
             await this.running;
         }
         finally {
-            rmSync(this.directory, { recursive: true, force: true });
+            this.input.signal.removeEventListener("abort", this.cancelAdmission);
+            await rm(this.directory, { recursive: true, force: true });
         }
     }
-    stopAdmission() { this.closed = true; }
+    stopAdmission() {
+        if (!this.closeSignal.signal.aborted)
+            this.closeSignal.abort(new Error("Body request pump closed"));
+    }
+}
+export async function clearBodyRequestTransport(paths) {
+    await rm(join(paths.directory, "requests"), { recursive: true, force: true });
 }
 function matchingRequestOrigin(soul, parent, requestId) {
     return soul.origin.kind === "request"
-        && soul.origin.parentId === parent
+        && soul.origin.parent === parent
         && soul.origin.requestId === requestId;
 }
-function settleObservedSoul(paths, parent, request, soul) {
+async function settleObservedSoul(paths, parent, request, soul) {
     if (matchingRequestOrigin(soul, parent.id, request.id))
-        serveRequest(paths, request.id, request.child);
+        await serveRequest(paths, request.id, request.child);
     else
-        voidRequest(paths, request.id, "reserved child origin does not match the request");
+        await voidRequest(paths, request.id, "reserved child origin does not match the request");
 }
-async function settleReserved(paths, parent, request, now) {
+async function settleReserved(paths, parent, request, now, signal) {
     const childPaths = pathsForAkuId(request.world, request.child);
     const deadline = performance.now() + BIRTH_TIMEOUT_MS;
     for (;;) {
-        if (!existsSync(childPaths.directory)) {
-            voidRequest(paths, request.id, "reserved child directory is absent");
+        signal?.throwIfAborted();
+        if (!await access(childPaths.directory).then(() => true, () => false)) {
+            await voidRequest(paths, request.id, "reserved child directory is absent");
             return true;
         }
-        const childSoul = readSoul(childPaths);
+        const childSoul = await readSoul(childPaths);
         if (childSoul !== null) {
-            settleObservedSoul(paths, parent, request, childSoul);
+            await settleObservedSoul(paths, parent, request, childSoul);
             return true;
         }
-        const leash = HeldAkumaLeash.try(childPaths);
+        const leash = await HeldAkumaLeash.try(childPaths);
         if (leash !== null) {
             try {
-                const settledSoul = readSoul(childPaths);
+                const settledSoul = await readSoul(childPaths);
                 if (settledSoul !== null) {
-                    settleObservedSoul(paths, parent, request, settledSoul);
+                    await settleObservedSoul(paths, parent, request, settledSoul);
                 }
                 else {
-                    leash.sealIfUnborn(childPaths, { evidence: "request settlement", at: now() });
-                    voidRequest(paths, request.id, "reserved child was sealed unborn");
+                    await leash.sealIfUnborn(childPaths, { evidence: "request settlement", at: now() });
+                    await voidRequest(paths, request.id, "reserved child was sealed unborn");
                 }
             }
             finally {
@@ -372,16 +401,17 @@ async function settleReserved(paths, parent, request, now) {
         }
         if (performance.now() >= deadline)
             return false;
-        await wait(POLL_MS);
+        await abortableDelay(POLL_MS, signal);
     }
 }
-export async function settleBodyRequests(paths, parent, now) {
+export async function settleBodyRequests(paths, parent, now, signal) {
     let pending = false;
-    for (const request of readNonterminalRequests(paths)) {
+    for (const request of await readNonterminalRequests(paths)) {
+        signal?.throwIfAborted();
         if (request.state === "admitted") {
-            voidRequest(paths, request.id, "body died before serving the request");
+            await voidRequest(paths, request.id, "body died before serving the request");
         }
-        else if (request.state === "reserved" && !await settleReserved(paths, parent, request, now))
+        else if (request.state === "reserved" && !await settleReserved(paths, parent, request, now, signal))
             pending = true;
     }
     return pending ? "pending" : "settled";

package/build/src/alias/index.d.ts

@@ -1,5 +1,6 @@
 import { type AkuId } from "../akuma/identity.js";
 import { type AkumaAlias } from "../identity/selector.js";
+import type { WorldRoot } from "../world.js";
 export type AliasBinding = Readonly<{
     alias: AkumaAlias;
     akuId: AkuId;
@@ -8,10 +9,10 @@ export type AliasMove = Readonly<{
     alias: AliasBinding;
     previous: AkuId | null;
 }>;
-export declare function readAliases(world: string): readonly AliasBinding[];
-export declare function resolveAlias(world: string, value: AkumaAlias): AkuId | null;
+export declare function readAliases(world: WorldRoot): Promise<readonly AliasBinding[]>;
+export declare function resolveAlias(world: WorldRoot, value: AkumaAlias): Promise<AkuId | null>;
 export declare function moveAlias(input: Readonly<{
-    world: string;
+    world: WorldRoot;
     alias: AkumaAlias;
     akuId: AkuId;
 }>): Promise<AliasMove>;

package/build/src/alias/index.js

@@ -1,4 +1,4 @@
-import { mkdirSync, readFileSync } from "node:fs";
+import { mkdir, readFile } from "node:fs/promises";
 import { dirname, resolve } from "node:path";
 import { parseAkuId } from "../akuma/identity.js";
 import { replaceFileDurably } from "../coordination/durable-file.js";
@@ -10,10 +10,9 @@ function paths(world) {
     if (typeof world !== "string" || world.trim().length === 0) {
         throw new TypeError("Alias world must be a nonblank path");
     }
-    const root = resolve(world);
     return {
-        authority: resolve(root, ".keiyaku", "akuma", "alias.json"),
-        lock: resolve(root, ".keiyaku", "locks", "akuma-alias.sqlite"),
+        authority: resolve(world, ".keiyaku", "akuma", "alias.json"),
+        lock: resolve(world, ".keiyaku", "locks", "akuma-alias.sqlite"),
     };
 }
 function canonical(bindings) {
@@ -68,9 +67,9 @@ function decode(path, bytes) {
         corruption(`Alias bytes are not canonical: ${path}`);
     return bindings;
 }
-function read(path) {
+async function read(path) {
     try {
-        return decode(path, readFileSync(path, "utf8"));
+        return decode(path, await readFile(path, "utf8"));
     }
     catch (error) {
         if (error.code === "ENOENT")
@@ -78,12 +77,12 @@ function read(path) {
         throw error;
     }
 }
-export function readAliases(world) {
-    return read(paths(world).authority);
+export async function readAliases(world) {
+    return await read(paths(world).authority);
 }
-export function resolveAlias(world, value) {
+export async function resolveAlias(world, value) {
     const alias = parseAkumaAlias(value);
-    return readAliases(world).find((binding) => binding.alias === alias)?.akuId ?? null;
+    return (await readAliases(world)).find((binding) => binding.alias === alias)?.akuId ?? null;
 }
 export async function moveAlias(input) {
     const alias = parseAkumaAlias(input.alias);
@@ -91,11 +90,11 @@ export async function moveAlias(input) {
     const location = paths(input.world);
     const held = await acquireSqliteTransactionLock({ path: location.lock, mode: "immediate" });
     try {
-        const current = read(location.authority);
+        const current = await read(location.authority);
         const previous = current.find((binding) => binding.alias === alias)?.akuId ?? null;
         const next = [...current.filter((binding) => binding.alias !== alias), { alias, akuId }];
-        mkdirSync(dirname(location.authority), { recursive: true });
-        replaceFileDurably(location.authority, canonical(next));
+        await mkdir(dirname(location.authority), { recursive: true });
+        await replaceFileDurably(location.authority, canonical(next));
         return { alias: { alias, akuId }, previous };
     }
     finally {

package/build/src/body/decode.js

@@ -91,7 +91,13 @@ function verification(document, section) {
     }
 }
 export function decodeContractDocument(source) {
-    const document = parseToAST(source);
+    let document;
+    try {
+        document = parseToAST(source);
+    }
+    catch (error) {
+        refusal(error instanceof Error ? error.message : String(error));
+    }
     if (document.frontmatter !== undefined)
         refusal("contract document may not contain frontmatter");
     const titles = indexedHeadings(indexDocument(document), { level: 1 })

package/build/src/body/region.d.ts

@@ -2,5 +2,7 @@ import type { DocumentNode, SectionNode } from "../markdown/types.js";
 export declare class RegionDocumentError extends Error {
     constructor(message: string);
 }
+export declare function assertCanonicalRegionPath(path: string): void;
 export declare function decodeRegion(document: DocumentNode, section: SectionNode): readonly string[];
 export declare function regionsOverlap(mine: readonly string[], theirs: readonly string[]): readonly [string, string][];
+export declare function regionPatternsMatchPath(patterns: readonly string[], path: string): readonly string[];

package/build/src/body/region.js

@@ -28,15 +28,79 @@ function compileRegionPattern(pattern) {
         refusal(`Region pattern '${pattern}' contains a forbidden glob form`);
     if (pattern.startsWith("/"))
         refusal(`Region pattern '${pattern}' must be repository-relative`);
-    if (pattern.endsWith("/"))
-        refusal(`Region pattern '${pattern}' may not end with /`);
     if (pattern.includes(".."))
         refusal(`Region pattern '${pattern}' may not contain ..`);
     const segments = pattern.split("/");
-    if (segments.some((segment) => segment.length === 0)) {
+    const directory = pattern.endsWith("/");
+    if (segments.some((segment, index) => segment.length === 0 && !(directory && index === segments.length - 1))) {
         refusal(`Region pattern '${pattern}' may not contain an empty segment`);
     }
-    return { source: pattern, segments: segments.map((segment) => compileSegment(segment, pattern)) };
+    const source = directory ? `${pattern}**` : pattern;
+    const canonical = directory ? [...segments.slice(0, -1), "**"] : segments;
+    return { source, segments: canonical.map((segment) => compileSegment(segment, pattern)) };
+}
+export function assertCanonicalRegionPath(path) {
+    if (path.length === 0 || /[\r\n\0]/u.test(path) || path.startsWith("/") || path.endsWith("/")) {
+        refusal(`Region path '${path}' must be a canonical repository-relative path`);
+    }
+    if (path.split("/").some((segment) => segment.length === 0 || segment === "." || segment === "..")) {
+        refusal(`Region path '${path}' must be a canonical repository-relative path`);
+    }
+}
+function segmentMatchesPath(pattern, path) {
+    const queue = [[0, 0]];
+    const visited = new Set();
+    let cursor = 0;
+    while (cursor < queue.length) {
+        const [patternIndex, pathIndex] = queue[cursor++];
+        const key = `${patternIndex}:${pathIndex}`;
+        if (visited.has(key))
+            continue;
+        visited.add(key);
+        if (patternIndex === pattern.length && pathIndex === path.length)
+            return true;
+        const character = pattern[patternIndex];
+        if (character === "*") {
+            queue.push([patternIndex + 1, pathIndex]);
+            if (pathIndex < path.length)
+                queue.push([patternIndex, pathIndex + 1]);
+            continue;
+        }
+        if (character === "?") {
+            if (pathIndex < path.length)
+                queue.push([patternIndex + 1, pathIndex + 1]);
+            continue;
+        }
+        if (character !== undefined && character === path[pathIndex])
+            queue.push([patternIndex + 1, pathIndex + 1]);
+    }
+    return false;
+}
+function patternMatchesPath(pattern, path) {
+    const queue = [[0, 0]];
+    const visited = new Set();
+    let cursor = 0;
+    while (cursor < queue.length) {
+        const [patternIndex, pathIndex] = queue[cursor++];
+        const key = `${patternIndex}:${pathIndex}`;
+        if (visited.has(key))
+            continue;
+        visited.add(key);
+        if (patternIndex === pattern.length && pathIndex === path.length)
+            return true;
+        const segment = pattern[patternIndex];
+        if (segment?.kind === "deep") {
+            queue.push([patternIndex + 1, pathIndex]);
+            if (pathIndex < path.length)
+                queue.push([patternIndex, pathIndex + 1]);
+            continue;
+        }
+        if (segment === undefined || path[pathIndex] === undefined)
+            continue;
+        if (segmentMatchesPath(segment.characters, Array.from(path[pathIndex])))
+            queue.push([patternIndex + 1, pathIndex + 1]);
+    }
+    return false;
 }
 function segmentTransition(characters, index) {
     const character = characters[index];
@@ -120,9 +184,7 @@ export function decodeRegion(document, section) {
     const patterns = blocks[0].lines.slice(1, -1).filter((line) => line.trim().length > 0);
     if (patterns.length === 0)
         refusal("Region must declare at least one path pattern");
-    for (const pattern of patterns)
-        compileRegionPattern(pattern);
-    return patterns;
+    return patterns.map((pattern) => compileRegionPattern(pattern).source);
 }
 export function regionsOverlap(mine, theirs) {
     const myPatterns = mine.map((pattern) => compileRegionPattern(pattern));
@@ -137,3 +199,11 @@ export function regionsOverlap(mine, theirs) {
     }
     return overlaps;
 }
+export function regionPatternsMatchPath(patterns, path) {
+    assertCanonicalRegionPath(path);
+    const pathSegments = path.split("/");
+    return patterns
+        .map((pattern) => compileRegionPattern(pattern))
+        .filter((pattern) => patternMatchesPath(pattern.segments, pathSegments))
+        .map((pattern) => pattern.source);
+}

package/build/src/body/render.js

@@ -1,3 +1,4 @@
+import { formatDuration } from "../duration.js";
 import { parseToAST } from "../markdown/parse.js";
 import { indexDocument, indexedHeadings, normalizeTitle, rawSlice } from "../markdown/query.js";
 import { CONTRACT_SECTIONS } from "./shape.js";
@@ -21,7 +22,7 @@ function fenced(value, info = "") {
     return `${boundary}${info}\n${value}\n${boundary}`;
 }
 function verificationFence(declaration) {
-    return fenced(declaration.script, declaration.executor);
+    return fenced(declaration.script, `${declaration.executor}${declaration.timeoutMs === undefined ? "" : ` timeout=${formatDuration(declaration.timeoutMs)}`}`);
 }
 function arcSection(arc) {
     return [

package/build/src/body/shape.js

@@ -6,7 +6,13 @@ export const CONTRACT_SECTIONS = {
     criteria: { title: "Criteria", required: true },
     verification: { title: "Verification", required: false },
 };
-export const RESERVED_SECTIONS = new Set(["gates", "pipeline", "after"]);
+export const RESERVED_SECTIONS = new Set([
+    "gates",
+    "pipeline",
+    "after",
+    "arc",
+    "fulfillment",
+]);
 export function contractSectionName(title) {
     for (const name of Object.keys(CONTRACT_SECTIONS)) {
         if (CONTRACT_SECTIONS[name].title === title)

package/build/src/body/verification.js

@@ -1,4 +1,5 @@
 import { directChildren, rawSlice } from "../markdown/query.js";
+import { parseDuration } from "../duration.js";
 export class VerificationDocumentError extends Error {
     constructor(message) {
         super(message);
@@ -13,13 +14,27 @@ export function decodeVerificationDeclarations(document, section) {
     if (other.length > 0)
         throw new VerificationDocumentError("Verification may contain only fenced executor declarations");
     return blocks.map((block) => {
-        const executor = block.info.trim();
-        if (!block.closed || (executor !== "bash" && executor !== "zsh" && executor !== "pwsh")) {
-            throw new VerificationDocumentError("Verification fences must be closed and use bash, zsh, or pwsh");
+        const info = /^(bash|zsh|pwsh)(?: timeout=([^ ]+))?$/.exec(block.info);
+        if (!block.closed || info === null) {
+            throw new VerificationDocumentError("Verification fences must be closed and use bash, zsh, or pwsh with optional timeout=<duration>");
         }
         const script = block.lines.slice(1, -1).join("\n");
         if (script.trim().length === 0)
             throw new VerificationDocumentError("Verification scripts must be nonblank");
-        return { executor, script };
+        const duration = info[2] === undefined ? undefined : parseDuration(info[2]);
+        if (duration?.kind === "invalid") {
+            throw new VerificationDocumentError("Verification timeout must be an integer duration with unit ms, s, m, or h");
+        }
+        if (duration?.kind === "overflow" || (duration?.kind === "parsed" && duration.milliseconds > 2_147_483_647)) {
+            throw new VerificationDocumentError("Verification timeout exceeds the supported process duration");
+        }
+        if (duration?.kind === "parsed" && duration.milliseconds === 0) {
+            throw new VerificationDocumentError("Verification timeout must be positive");
+        }
+        return {
+            executor: info[1],
+            script,
+            ...(duration === undefined ? {} : { timeoutMs: duration.milliseconds }),
+        };
     });
 }