@canonical/pragma-cli 0.34.0 → 0.36.0

package/dist/src/kernel/runtime/graphpack/embedded/pack.index.generated.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"pack.index.generated.js","sourceRoot":"","sources":["../../../../../../src/kernel/runtime/graphpack/embedded/pack.index.generated.ts"],"names":[],"mappings":"AAAA,6DAA6D;AAC7D,uEAAuE;AACvE,MAAM,CAAC,MAAM,SAAS,GAAG,ot9OAAot9O,CAAC"}

package/dist/src/kernel/runtime/graphpack/embedded/pack.stories.generated.js

@@ -0,0 +1,4 @@
+// AUTO-GENERATED by scripts/bundle.ts — do not edit by hand.
+// Regenerate from the packs pragma.conf.ts declares: `bun run bundle`.
+export const storiesJson = "[]";
+//# sourceMappingURL=pack.stories.generated.js.map

package/dist/src/kernel/runtime/graphpack/embedded/pack.stories.generated.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"pack.stories.generated.js","sourceRoot":"","sources":["../../../../../../src/kernel/runtime/graphpack/embedded/pack.stories.generated.ts"],"names":[],"mappings":"AAAA,6DAA6D;AAC7D,uEAAuE;AACvE,MAAM,CAAC,MAAM,WAAW,GAAG,IAAI,CAAC"}

package/dist/src/kernel/runtime/graphpack/embedded.js

@@ -0,0 +1,82 @@
+/**
+ * The embedded pack: the distribution's own graph, compiled from the packs
+ * `pragma.conf.ts` declares and inlined into the source as escaped strings
+ * (`pack.generated.ts`, produced by `scripts/bundle.ts`). It is the store the
+ * CLI boots when the user has not pinned their own packs and has not built
+ * anything yet — so a fresh install answers real store-backed reads with no
+ * network, no cache, and no git credentials.
+ *
+ * It is a SNAPSHOT, not a substitute for `sources update`: the manifest records
+ * which upstream revisions it was compiled from, and both `sources status` and
+ * `doctor` report that rather than claiming the store is up to date. A project
+ * that declares its own packs and has not built them is never served this graph:
+ * every read, `info`, `sources status`, `doctor` and the MCP prompt/resource
+ * surfaces take {@link resolveSources}' answer and refuse. The one exception is
+ * the shell-completion fast path, which cannot read config at all (see
+ * `kernel/completion/entitySource.ts`) and so still offers this graph's names as
+ * completion candidates — candidates, never content.
+ *
+ * The inlined strings are materialized into the ordinary content-addressed pack
+ * cache on first use and then read back through {@link readPack}, so the
+ * embedded pack and a built pack share one boot path. The story records live in
+ * their OWN generated module (like the index): dispatch reads them on every
+ * command, and pulling them out of `pack.generated.ts` would load its ~1.9 MB
+ * of n-quads with them — a measured +28 ms on every invocation. Inlining as JS strings
+ * (rather than file assets) means the pack travels with the emitted modules —
+ * it needs no asset step in any build, and no file lookup at run time.
+ */
+import { existsSync, mkdirSync, mkdtempSync, renameSync, rmSync, writeFileSync, } from "node:fs";
+import { join } from "node:path";
+import { packDir, packsCacheDir } from "../paths.js";
+import { dataNq, manifestJson, schemaJson } from "./embedded/pack.generated.js";
+import { indexJson } from "./embedded/pack.index.generated.js";
+import { storiesJson } from "./embedded/pack.stories.generated.js";
+import { packIsComplete } from "./manifest.js";
+import { manifestSchema } from "./schemas.js";
+import { DATA_FILE, INDEX_FILE, MANIFEST_FILE, SCHEMA_FILE, STORIES_FILE, } from "./types.js";
+/**
+ * The embedded pack's manifest, parsed from the inlined string.
+ *
+ * Carries the provenance `sources status` and `doctor` report — `sourceRef`
+ * (which upstream revisions the snapshot was compiled from), `createdAt`, the
+ * counts — plus the `contentHash` that names its cache directory. Reading it
+ * costs one `JSON.parse` of a ~1 KB string, so neither surface has to
+ * materialize the 1.9 MB pack just to describe it.
+ */
+export function embeddedManifest() {
+    return manifestSchema.parse(JSON.parse(manifestJson));
+}
+/**
+ * Materialize the embedded pack into the pack cache and return its directory.
+ *
+ * Idempotent: if the content-addressed directory already holds a complete pack
+ * (this or a previous run, or a build with identical sources), it is reused.
+ *
+ * @returns The pack directory, ready for {@link readPack}.
+ * @note Impure — writes the inlined pack files into the cache.
+ */
+export function materializeEmbeddedPack() {
+    const dir = packDir(embeddedManifest().contentHash);
+    if (packIsComplete(dir))
+        return dir;
+    mkdirSync(packsCacheDir(), { recursive: true });
+    const temp = mkdtempSync(join(packsCacheDir(), ".embed-"));
+    try {
+        writeFileSync(join(temp, DATA_FILE), dataNq);
+        writeFileSync(join(temp, SCHEMA_FILE), schemaJson);
+        writeFileSync(join(temp, INDEX_FILE), indexJson);
+        writeFileSync(join(temp, STORIES_FILE), storiesJson);
+        // Written last — the completeness marker.
+        writeFileSync(join(temp, MANIFEST_FILE), manifestJson);
+        if (!packIsComplete(dir)) {
+            rmSync(dir, { recursive: true, force: true });
+            renameSync(temp, dir);
+        }
+    }
+    finally {
+        if (existsSync(temp))
+            rmSync(temp, { recursive: true, force: true });
+    }
+    return dir;
+}
+//# sourceMappingURL=embedded.js.map

package/dist/src/kernel/runtime/graphpack/embedded.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"embedded.js","sourceRoot":"","sources":["../../../../../src/kernel/runtime/graphpack/embedded.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AAEH,OAAO,EACL,UAAU,EACV,SAAS,EACT,WAAW,EACX,UAAU,EACV,MAAM,EACN,aAAa,GACd,MAAM,SAAS,CAAC;AACjB,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,OAAO,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AACrD,OAAO,EAAE,MAAM,EAAE,YAAY,EAAE,UAAU,EAAE,MAAM,8BAA8B,CAAC;AAChF,OAAO,EAAE,SAAS,EAAE,MAAM,oCAAoC,CAAC;AAC/D,OAAO,EAAE,WAAW,EAAE,MAAM,sCAAsC,CAAC;AACnE,OAAO,EAAE,cAAc,EAAE,MAAM,eAAe,CAAC;AAC/C,OAAO,EAAE,cAAc,EAAE,MAAM,cAAc,CAAC;AAC9C,OAAO,EACL,SAAS,EACT,UAAU,EACV,aAAa,EAEb,WAAW,EACX,YAAY,GACb,MAAM,YAAY,CAAC;AAEpB;;;;;;;;GAQG;AACH,MAAM,UAAU,gBAAgB;IAC9B,OAAO,cAAc,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC,CAAC;AACxD,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,uBAAuB;IACrC,MAAM,GAAG,GAAG,OAAO,CAAC,gBAAgB,EAAE,CAAC,WAAW,CAAC,CAAC;IACpD,IAAI,cAAc,CAAC,GAAG,CAAC;QAAE,OAAO,GAAG,CAAC;IAEpC,SAAS,CAAC,aAAa,EAAE,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAChD,MAAM,IAAI,GAAG,WAAW,CAAC,IAAI,CAAC,aAAa,EAAE,EAAE,SAAS,CAAC,CAAC,CAAC;IAC3D,IAAI,CAAC;QACH,aAAa,CAAC,IAAI,CAAC,IAAI,EAAE,SAAS,CAAC,EAAE,MAAM,CAAC,CAAC;QAC7C,aAAa,CAAC,IAAI,CAAC,IAAI,EAAE,WAAW,CAAC,EAAE,UAAU,CAAC,CAAC;QACnD,aAAa,CAAC,IAAI,CAAC,IAAI,EAAE,UAAU,CAAC,EAAE,SAAS,CAAC,CAAC;QACjD,aAAa,CAAC,IAAI,CAAC,IAAI,EAAE,YAAY,CAAC,EAAE,WAAW,CAAC,CAAC;QACrD,0CAA0C;QAC1C,aAAa,CAAC,IAAI,CAAC,IAAI,EAAE,aAAa,CAAC,EAAE,YAAY,CAAC,CAAC;QACvD,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC,EAAE,CAAC;YACzB,MAAM,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;YAC9C,UAAU,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;QACxB,CAAC;IACH,CAAC;YAAS,CAAC;QACT,IAAI,UAAU,CAAC,IAAI,CAAC;YAAE,MAAM,CAAC,IAAI,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;IACvE,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC"}

package/dist/src/kernel/runtime/graphpack/hash.js

@@ -0,0 +1,38 @@
+/**
+ * The two content hashes a pack carries — kept in distinct roles, never
+ * conflated.
+ *
+ * 1. {@link contentHash} — a SHA-256 (ke-graphql's `sha256Hex`) over the
+ *    canonicalized *source inputs* (sorted by path, path + content joined with
+ *    fixed delimiters). It names the pack's cache directory and is what a
+ *    project's active-pack pointer holds, so the same sources always resolve to
+ *    the same directory and a
+ *    changed source is a new directory (free invalidation). Hashing the sorted
+ *    TTL *inputs* — never the `data.nq` dump, whose n-quads line order is not
+ *    canonical — keeps it deterministic.
+ * 2. `hashSources` (re-exported from ke-graphql) — an order-independent FNV-1a
+ *    64 fingerprint stored *inside* `schema.json` as the extraction's freshness
+ *    token. ke-graphql compares it against the loaded sources to detect a stale
+ *    artifact. It is a staleness signal, not a cache key.
+ */
+import { hashSources, sha256Hex } from "@canonical/ke-graphql";
+/** Delimiter between a source's path and its content. */
+const FIELD_SEP = "\n<<<pragma-pack:content>>>\n";
+/** Delimiter between successive sources. */
+const RECORD_SEP = "\n<<<pragma-pack:next>>>\n";
+/**
+ * The pack's content hash: SHA-256 over the canonicalized source inputs.
+ *
+ * @param inputs - The source inputs (path + content).
+ * @returns The lowercase hex SHA-256 — the pack's cache-directory name.
+ * @note Async — SHA-256 via Web Crypto.
+ */
+export function contentHash(inputs) {
+    const canonical = [...inputs]
+        .sort((a, b) => (a.path < b.path ? -1 : a.path > b.path ? 1 : 0))
+        .map((input) => `${input.path}${FIELD_SEP}${input.content}`)
+        .join(RECORD_SEP);
+    return sha256Hex(canonical);
+}
+export { hashSources };
+//# sourceMappingURL=hash.js.map

package/dist/src/kernel/runtime/graphpack/hash.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"hash.js","sourceRoot":"","sources":["../../../../../src/kernel/runtime/graphpack/hash.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAEH,OAAO,EAAE,WAAW,EAAE,SAAS,EAAE,MAAM,uBAAuB,CAAC;AAQ/D,yDAAyD;AACzD,MAAM,SAAS,GAAG,+BAA+B,CAAC;AAClD,4CAA4C;AAC5C,MAAM,UAAU,GAAG,4BAA4B,CAAC;AAEhD;;;;;;GAMG;AACH,MAAM,UAAU,WAAW,CAAC,MAA4B;IACtD,MAAM,SAAS,GAAG,CAAC,GAAG,MAAM,CAAC;SAC1B,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;SAChE,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,GAAG,KAAK,CAAC,IAAI,GAAG,SAAS,GAAG,KAAK,CAAC,OAAO,EAAE,CAAC;SAC3D,IAAI,CAAC,UAAU,CAAC,CAAC;IACpB,OAAO,SAAS,CAAC,SAAS,CAAC,CAAC;AAC9B,CAAC;AAED,OAAO,EAAE,WAAW,EAAE,CAAC"}

package/dist/src/kernel/runtime/graphpack/index.js

@@ -0,0 +1,11 @@
+/**
+ * Graphpack barrel — the content-addressed pack cache: build, read, embedded
+ * fallback, and the artifact contracts.
+ */
+export { buildPack } from "./build.js";
+export { buildIndex } from "./buildIndex.js";
+export { embeddedManifest, materializeEmbeddedPack } from "./embedded.js";
+export { contentHash, hashSources } from "./hash.js";
+export { packIsComplete, readManifest } from "./manifest.js";
+export { readPack } from "./read.js";
+//# sourceMappingURL=index.js.map

package/dist/src/kernel/runtime/graphpack/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../../../src/kernel/runtime/graphpack/index.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAOH,OAAO,EAAE,SAAS,EAAE,MAAM,YAAY,CAAC;AACvC,OAAO,EAAE,UAAU,EAAE,MAAM,iBAAiB,CAAC;AAC7C,OAAO,EAAE,gBAAgB,EAAE,uBAAuB,EAAE,MAAM,eAAe,CAAC;AAC1E,OAAO,EAAE,WAAW,EAAkB,WAAW,EAAE,MAAM,WAAW,CAAC;AACrE,OAAO,EAAE,cAAc,EAAE,YAAY,EAAE,MAAM,eAAe,CAAC;AAC7D,OAAO,EAAE,QAAQ,EAAE,MAAM,WAAW,CAAC"}

package/dist/src/kernel/runtime/graphpack/manifest.js

@@ -0,0 +1,145 @@
+/**
+ * Read a pack's `manifest.json`. Its presence is the completeness marker: a
+ * directory without a valid manifest is a torn build (writes land in a temp
+ * directory and the manifest is renamed in last), so an absent or invalid
+ * manifest means "treat the pack as not there".
+ *
+ * This module is on the storeless FAST PATH (`resolveSources` → `packIsComplete`
+ * → here, while `__complete` builds the command tree), so it validates the ~1 KB
+ * manifest structurally instead of importing zod to do it — that import was
+ * ~3–4 ms of a ~30 ms budget. {@link validateManifest} is held to the schema's
+ * behaviour by `graphpack.test.ts`, which pins the two to accept the same inputs
+ * in both directions; `schemas.ts` remains the executable specification.
+ */
+import { existsSync, readFileSync, statSync } from "node:fs";
+import { join } from "node:path";
+import { DATA_FILE, INDEX_FILE, MANIFEST_FILE, SCHEMA_FILE, STORIES_FILE, } from "./types.js";
+/** Whether `value` is a plain object of strings — the `prefixes` map's shape. */
+function isStringRecord(value) {
+    return (typeof value === "object" &&
+        value !== null &&
+        !Array.isArray(value) &&
+        Object.values(value).every((entry) => typeof entry === "string"));
+}
+/**
+ * Validate a parsed `manifest.json` payload structurally.
+ *
+ * Mirrors `manifestSchema` exactly, including its STRIP semantics: a valid
+ * manifest is reconstructed field by field, so an unknown key in the file is
+ * dropped rather than carried into the returned object (zod's `z.object`
+ * default, which several callers rely on when they re-serialize a manifest).
+ *
+ * @param value - The `JSON.parse` result to validate.
+ * @returns The manifest, or `undefined` when the payload does not conform.
+ */
+export function validateManifest(value) {
+    if (typeof value !== "object" || value === null || Array.isArray(value)) {
+        return undefined;
+    }
+    const raw = value;
+    const { tripleCount, entityCount } = raw;
+    if (typeof raw.name !== "string" ||
+        typeof raw.version !== "string" ||
+        typeof raw.sourceRef !== "string" ||
+        typeof raw.contentHash !== "string" ||
+        typeof raw.createdAt !== "string" ||
+        !isStringRecord(raw.prefixes) ||
+        (tripleCount !== undefined && typeof tripleCount !== "number") ||
+        (entityCount !== undefined && typeof entityCount !== "number")) {
+        return undefined;
+    }
+    return {
+        name: raw.name,
+        version: raw.version,
+        sourceRef: raw.sourceRef,
+        contentHash: raw.contentHash,
+        prefixes: raw.prefixes,
+        createdAt: raw.createdAt,
+        ...(tripleCount === undefined ? {} : { tripleCount }),
+        ...(entityCount === undefined ? {} : { entityCount }),
+    };
+}
+/**
+ * Read and validate a pack directory's manifest.
+ *
+ * @param dir - The pack directory.
+ * @returns The parsed manifest, or `undefined` when absent or invalid.
+ * @note Impure — reads from disk.
+ */
+export function readManifest(dir) {
+    const path = join(dir, MANIFEST_FILE);
+    if (!existsSync(path))
+        return undefined;
+    try {
+        return validateManifest(JSON.parse(readFileSync(path, "utf-8")));
+    }
+    catch {
+        return undefined;
+    }
+}
+/** Whether a pack directory holds a complete pack: a valid manifest AND every
+ * non-empty content artifact — the `data.nq` dump, the extracted `schema.json`,
+ * the entity `index.json`, and the carried `stories.json`. The manifest alone is
+ * not enough: an intact manifest beside a missing/truncated `data.nq` boots
+ * EMPTY (a silent, then permanent, loss), and a torn or evicted
+ * `schema.json`/`index.json` (manifest + dump intact) would be REUSED by
+ * `buildPack` and then fail at BOOT as an internal error. `stories.json` is
+ * gated for the same reason and unconditionally: it is written even when empty
+ * (as `[]`, which is non-empty text), so a pack directory lacking it is one
+ * whose content hash covers stories the directory does not hold — reusing it
+ * would silently drop every package-declared noun. Requiring all four present +
+ * non-empty makes `buildPack` rebuild a torn pack and makes the boot decision
+ * surface STORE_UNAVAILABLE (the ordinary "not built" recovery) instead of a
+ * "report this" crash. `stories.json` is additionally gated on its SHAPE
+ * — see {@link storiesAreReadable} for why it, and only it, is parsed here. */
+export function packIsComplete(dir) {
+    if (readManifest(dir) === undefined)
+        return false;
+    for (const file of [DATA_FILE, SCHEMA_FILE, INDEX_FILE, STORIES_FILE]) {
+        try {
+            if (statSync(join(dir, file)).size <= 0)
+                return false;
+        }
+        catch {
+            return false;
+        }
+    }
+    return storiesAreReadable(dir);
+}
+/**
+ * Whether `stories.json` holds what its reader expects: a JSON ARRAY.
+ *
+ * Size alone was not enough, and stories are the one artifact where that gap is
+ * SILENT. A non-empty but non-array `stories.json` passed the size gate, so
+ * `buildPack` REUSED the directory and every package-declared noun vanished
+ * while `sources update` reported success — with `parseRecords`' fix, without
+ * even an error line to attribute. Parsing it turns that into an incomplete
+ * pack: the boot decision reports the ordinary STORE_UNAVAILABLE and the next
+ * `buildPack` rebuilds, which is the recovery the other three artifacts already
+ * get.
+ *
+ * SHAPE ONLY, deliberately: `Array.isArray`, not a check of the records inside.
+ * A malformed or schema-invalid RECORD is the one guard in
+ * `packs/collect.validateStories`, which names it on stderr and under `doctor`
+ * — a story a third party got wrong must not make the whole pack unreadable.
+ *
+ * `data.nq` and `schema.json` stay SIZE-gated on purpose. A truncated `data.nq`
+ * is caught downstream by `readPack`'s A9 triple-count cross-check, which is
+ * stronger than any parse here; a corrupt `schema.json` still surfaces
+ * unclassified, and that gap is pinned separately rather than absorbed into this
+ * one — this is the fast path, and it parses only the artifact whose failure is
+ * otherwise invisible.
+ *
+ * @param dir - The pack directory.
+ * @returns Whether the stories artifact parses as an array.
+ * @note Impure — reads from disk.
+ */
+function storiesAreReadable(dir) {
+    try {
+        return Array.isArray(JSON.parse(readFileSync(join(dir, STORIES_FILE), "utf-8")));
+    }
+    catch {
+        return false;
+    }
+}
+//# sourceMappingURL=manifest.js.map

package/dist/src/kernel/runtime/graphpack/manifest.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"manifest.js","sourceRoot":"","sources":["../../../../../src/kernel/runtime/graphpack/manifest.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AAC7D,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EACL,SAAS,EACT,UAAU,EACV,aAAa,EAEb,WAAW,EACX,YAAY,GACb,MAAM,YAAY,CAAC;AAEpB,iFAAiF;AACjF,SAAS,cAAc,CAAC,KAAc;IACpC,OAAO,CACL,OAAO,KAAK,KAAK,QAAQ;QACzB,KAAK,KAAK,IAAI;QACd,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QACrB,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,OAAO,KAAK,KAAK,QAAQ,CAAC,CACjE,CAAC;AACJ,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,UAAU,gBAAgB,CAAC,KAAc;IAC7C,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QACxE,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,MAAM,GAAG,GAAG,KAAgC,CAAC;IAC7C,MAAM,EAAE,WAAW,EAAE,WAAW,EAAE,GAAG,GAAG,CAAC;IACzC,IACE,OAAO,GAAG,CAAC,IAAI,KAAK,QAAQ;QAC5B,OAAO,GAAG,CAAC,OAAO,KAAK,QAAQ;QAC/B,OAAO,GAAG,CAAC,SAAS,KAAK,QAAQ;QACjC,OAAO,GAAG,CAAC,WAAW,KAAK,QAAQ;QACnC,OAAO,GAAG,CAAC,SAAS,KAAK,QAAQ;QACjC,CAAC,cAAc,CAAC,GAAG,CAAC,QAAQ,CAAC;QAC7B,CAAC,WAAW,KAAK,SAAS,IAAI,OAAO,WAAW,KAAK,QAAQ,CAAC;QAC9D,CAAC,WAAW,KAAK,SAAS,IAAI,OAAO,WAAW,KAAK,QAAQ,CAAC,EAC9D,CAAC;QACD,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,OAAO;QACL,IAAI,EAAE,GAAG,CAAC,IAAI;QACd,OAAO,EAAE,GAAG,CAAC,OAAO;QACpB,SAAS,EAAE,GAAG,CAAC,SAAS;QACxB,WAAW,EAAE,GAAG,CAAC,WAAW;QAC5B,QAAQ,EAAE,GAAG,CAAC,QAAQ;QACtB,SAAS,EAAE,GAAG,CAAC,SAAS;QACxB,GAAG,CAAC,WAAW,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,CAAC;QACrD,GAAG,CAAC,WAAW,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,CAAC;KACtD,CAAC;AACJ,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,YAAY,CAAC,GAAW;IACtC,MAAM,IAAI,GAAG,IAAI,CAAC,GAAG,EAAE,aAAa,CAAC,CAAC;IACtC,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC;QAAE,OAAO,SAAS,CAAC;IACxC,IAAI,CAAC;QACH,OAAO,gBAAgB,CAAC,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC;IACnE,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;AACH,CAAC;AAED;;;;;;;;;;;;;;+EAc+E;AAC/E,MAAM,UAAU,cAAc,CAAC,GAAW;IACxC,IAAI,YAAY,CAAC,GAAG,CAAC,KAAK,SAAS;QAAE,OAAO,KAAK,CAAC;IAClD,KAAK,MAAM,IAAI,IAAI,CAAC,SAAS,EAAE,WAAW,EAAE,UAAU,EAAE,YAAY,CAAC,EAAE,CAAC;QACtE,IAAI,CAAC;YACH,IAAI,QAAQ,CAAC,IAAI,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC;gBAAE,OAAO,KAAK,CAAC;QACxD,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,KAAK,CAAC;QACf,CAAC;IACH,CAAC;IACD,OAAO,kBAAkB,CAAC,GAAG,CAAC,CAAC;AACjC,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AACH,SAAS,kBAAkB,CAAC,GAAW;IACrC,IAAI,CAAC;QACH,OAAO,KAAK,CAAC,OAAO,CAClB,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,IAAI,CAAC,GAAG,EAAE,YAAY,CAAC,EAAE,OAAO,CAAC,CAAC,CAC3D,CAAC;IACJ,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC"}

package/dist/src/kernel/runtime/graphpack/read.js

@@ -0,0 +1,92 @@
+/**
+ * Boot a {@link StoreSession} from a built pack directory — the perf keystone.
+ *
+ * The store loads from `data.nq` through ke's cache path (no TTL parse), and
+ * the executable GraphQL schema is rebuilt from `schema.json` via ke-graphql's
+ * `compileFromExtraction` — passes 2-7, pure JS, no store, no SPARQL. The live
+ * 7-pass `compile` is NEVER called here; that only runs at build time. The
+ * entity index is a plain `JSON.parse`. The result is an immutable session the
+ * lazy store memoizes for the process's lifetime.
+ *
+ * Reached only behind a dynamic import (store boot), never on the storeless
+ * fast path.
+ */
+import { readFileSync } from "node:fs";
+import { join } from "node:path";
+import { createStore } from "@canonical/ke";
+import { compileFromExtraction } from "@canonical/ke-graphql";
+import { cliRecovery, PragmaError } from "../../error/index.js";
+import { readManifest } from "./manifest.js";
+import { packIndexSchema } from "./schemas.js";
+import { DATA_FILE, INDEX_FILE, SCHEMA_FILE } from "./types.js";
+/** STORE_UNAVAILABLE with the canonical `pragma sources update` recovery (CLI + MCP). */
+function packUnavailable(reason) {
+    return PragmaError.storeUnavailable(reason, {
+        recovery: cliRecovery("sources update", "Rebuild the local store from the configured packs.", 
+        // An agent recovers by calling the tool, then retrying (PR9 C1 cold-store
+        // retry makes the post-update retry succeed).
+        { tool: "sources_update" }),
+    });
+}
+/**
+ * Read a pack directory into a bootable store session.
+ *
+ * @param dir - The pack directory (must hold a complete pack).
+ * @returns The store session: store, schema, context factory, prefixes, index.
+ * @throws PragmaError STORE_UNAVAILABLE when the pack is incomplete.
+ * @note Impure — creates a store from the cached n-quads dump.
+ */
+export async function readPack(dir) {
+    const manifest = readManifest(dir);
+    if (!manifest) {
+        throw packUnavailable(`The pack at ${dir} is incomplete.`);
+    }
+    const store = await createStore({
+        // Cache hit loads the n-quads dump directly — no sources are re-parsed.
+        sources: [],
+        prefixes: manifest.prefixes,
+        cache: join(dir, DATA_FILE),
+    });
+    // `loaderCache: "process"` shares the DataLoader caches across every context
+    // for this immutable store's lifetime (the MCP p95 win) — sound because the
+    // store never mutates between reloads. PR7 relies on it.
+    const compiled = compileFromExtraction(readFileSync(join(dir, SCHEMA_FILE), "utf-8"), { loaderCache: "process" });
+    const index = packIndexSchema.parse(JSON.parse(readFileSync(join(dir, INDEX_FILE), "utf-8")));
+    // Guard against a corrupt or TRUNCATED `data.nq` beside an intact manifest:
+    // ke silently serves whatever loaded (falling back to an EMPTY store on a
+    // parse failure, and rewriting an empty dump). When the manifest records the
+    // build-time triple count (A9), require the booted store to hold AT LEAST it:
+    // a SHORTFALL means the dump was truncated (fewer triples than were built) —
+    // it passes the mere size>0 completeness gate yet would serve a partial graph
+    // silently, so it must surface STORE_UNAVAILABLE here. A benign SUPERSET (more
+    // triples than recorded — e.g. a future ke counting change) is TOLERATED
+    // rather than treated as corruption, so such a change can't trip a fleet-wide
+    // false STORE_UNAVAILABLE. Older packs without the count fall back to the
+    // "populated index but empty store" check (via the now-empty dump,
+    // `packIsComplete` turns false so recovery rebuilds) rather than serving an
+    // empty graph as the pack.
+    const actualTriples = await countTriples(store);
+    if (manifest.tripleCount !== undefined) {
+        if (actualTriples < manifest.tripleCount) {
+            store.dispose();
+            throw packUnavailable(`The pack at ${dir} has a corrupt data cache (expected at least ${manifest.tripleCount} triples, loaded ${actualTriples}).`);
+        }
+    }
+    else if (index.entities.length > 0 && actualTriples === 0) {
+        store.dispose();
+        throw packUnavailable(`The pack at ${dir} has a corrupt data cache.`);
+    }
+    return {
+        store,
+        schema: compiled.schema,
+        createContext: compiled.createContext,
+        prefixes: manifest.prefixes,
+        index,
+    };
+}
+/** Count the booted store's triples (a cheap aggregate over the union graph). */
+async function countTriples(store) {
+    const result = (await store.query("SELECT (COUNT(*) AS ?n) WHERE { ?s ?p ?o }"));
+    return Number(result.bindings.at(0)?.n ?? 0);
+}
+//# sourceMappingURL=read.js.map

package/dist/src/kernel/runtime/graphpack/read.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"read.js","sourceRoot":"","sources":["../../../../../src/kernel/runtime/graphpack/read.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH,OAAO,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AACvC,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,WAAW,EAAE,MAAM,eAAe,CAAC;AAC5C,OAAO,EAAE,qBAAqB,EAAE,MAAM,uBAAuB,CAAC;AAC9D,OAAO,EAAE,WAAW,EAAE,WAAW,EAAE,MAAM,sBAAsB,CAAC;AAEhE,OAAO,EAAE,YAAY,EAAE,MAAM,eAAe,CAAC;AAC7C,OAAO,EAAE,eAAe,EAAE,MAAM,cAAc,CAAC;AAC/C,OAAO,EAAE,SAAS,EAAE,UAAU,EAAE,WAAW,EAAE,MAAM,YAAY,CAAC;AAEhE,yFAAyF;AACzF,SAAS,eAAe,CAAC,MAAc;IACrC,OAAO,WAAW,CAAC,gBAAgB,CAAC,MAAM,EAAE;QAC1C,QAAQ,EAAE,WAAW,CACnB,gBAAgB,EAChB,oDAAoD;QACpD,0EAA0E;QAC1E,8CAA8C;QAC9C,EAAE,IAAI,EAAE,gBAAgB,EAAE,CAC3B;KACF,CAAC,CAAC;AACL,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,CAAC,KAAK,UAAU,QAAQ,CAAC,GAAW;IACxC,MAAM,QAAQ,GAAG,YAAY,CAAC,GAAG,CAAC,CAAC;IACnC,IAAI,CAAC,QAAQ,EAAE,CAAC;QACd,MAAM,eAAe,CAAC,eAAe,GAAG,iBAAiB,CAAC,CAAC;IAC7D,CAAC;IAED,MAAM,KAAK,GAAG,MAAM,WAAW,CAAC;QAC9B,wEAAwE;QACxE,OAAO,EAAE,EAAE;QACX,QAAQ,EAAE,QAAQ,CAAC,QAAQ;QAC3B,KAAK,EAAE,IAAI,CAAC,GAAG,EAAE,SAAS,CAAC;KAC5B,CAAC,CAAC;IAEH,6EAA6E;IAC7E,4EAA4E;IAC5E,yDAAyD;IACzD,MAAM,QAAQ,GAAG,qBAAqB,CACpC,YAAY,CAAC,IAAI,CAAC,GAAG,EAAE,WAAW,CAAC,EAAE,OAAO,CAAC,EAC7C,EAAE,WAAW,EAAE,SAAS,EAAE,CAC3B,CAAC;IACF,MAAM,KAAK,GAAG,eAAe,CAAC,KAAK,CACjC,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,IAAI,CAAC,GAAG,EAAE,UAAU,CAAC,EAAE,OAAO,CAAC,CAAC,CACzD,CAAC;IAEF,4EAA4E;IAC5E,0EAA0E;IAC1E,6EAA6E;IAC7E,8EAA8E;IAC9E,6EAA6E;IAC7E,8EAA8E;IAC9E,+EAA+E;IAC/E,yEAAyE;IACzE,8EAA8E;IAC9E,0EAA0E;IAC1E,mEAAmE;IACnE,4EAA4E;IAC5E,2BAA2B;IAC3B,MAAM,aAAa,GAAG,MAAM,YAAY,CAAC,KAAK,CAAC,CAAC;IAChD,IAAI,QAAQ,CAAC,WAAW,KAAK,SAAS,EAAE,CAAC;QACvC,IAAI,aAAa,GAAG,QAAQ,CAAC,WAAW,EAAE,CAAC;YACzC,KAAK,CAAC,OAAO,EAAE,CAAC;YAChB,MAAM,eAAe,CACnB,eAAe,GAAG,gDAAgD,QAAQ,CAAC,WAAW,oBAAoB,aAAa,IAAI,CAC5H,CAAC;QACJ,CAAC;IACH,CAAC;SAAM,IAAI,KAAK,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC,IAAI,aAAa,KAAK,CAAC,EAAE,CAAC;QAC5D,KAAK,CAAC,OAAO,EAAE,CAAC;QAChB,MAAM,eAAe,CAAC,eAAe,GAAG,4BAA4B,CAAC,CAAC;IACxE,CAAC;IAED,OAAO;QACL,KAAK;QACL,MAAM,EAAE,QAAQ,CAAC,MAAM;QACvB,aAAa,EAAE,QAAQ,CAAC,aAAa;QACrC,QAAQ,EAAE,QAAQ,CAAC,QAAQ;QAC3B,KAAK;KACN,CAAC;AACJ,CAAC;AAED,iFAAiF;AACjF,KAAK,UAAU,YAAY,CAAC,KAA4B;IACtD,MAAM,MAAM,GAAG,CAAC,MAAM,KAAK,CAAC,KAAK,CAC/B,4CAAqD,CACtD,CAAyC,CAAC;IAC3C,OAAO,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC;AAC/C,CAAC"}

package/dist/src/kernel/runtime/graphpack/schemas.js

@@ -0,0 +1,70 @@
+/**
+ * The zod schemas validating a pack's persisted artifacts.
+ *
+ * They live HERE, apart from the contracts in `types.ts`, for one reason: zod is
+ * a value dependency, and `types.ts` is reachable from the storeless fast path.
+ * `capabilities/index.ts` → `resolveSources` → `packIsComplete` → `readManifest`
+ * put `manifest.json`'s schema on the graph `bin.ts` evaluates for `__complete`,
+ * costing ~3–4 ms of a ~30 ms budget to build a validator for a ~1 KB file the
+ * boot decision only needs to look at. `readManifest` now validates that file
+ * structurally, by hand, and this module is imported only by the two readers
+ * that are already off the fast path (`read.ts` boots the store; `embedded.ts`
+ * materializes the 1.9 MB embedded pack).
+ *
+ * The schemas remain the EXECUTABLE SPECIFICATION of what a valid artifact is:
+ * `graphpack.test.ts` pins `readManifest`'s hand validator to accept exactly
+ * what {@link manifestSchema} accepts, in both directions, so the two cannot
+ * drift. Change a rule here and that test fails until the hand validator
+ * follows. `capabilities/lazy.test.ts` pins the other half — that NO module on
+ * the storeless graph imports zod at all — so this split cannot silently close.
+ *
+ * Each schema is annotated `z.ZodType<T>` against the hand-written contract it
+ * validates, so a field added to one and not the other is a type error here
+ * rather than a runtime surprise at a read.
+ */
+import { z } from "zod";
+/** zod schema validating a persisted {@link PackIndexEntity}. */
+export const packIndexEntitySchema = z.object({
+    name: z.string(),
+    type: z.string(),
+    uri: z.string().optional(),
+    prefixed: z.string().optional(),
+    types: z.array(z.string()).optional(),
+    label: z.string().nullable().optional(),
+    altNames: z.array(z.string()).optional(),
+    box: z.enum(["tbox", "abox"]).optional(),
+    description: z.string().nullable().optional(),
+});
+/** zod schema validating a persisted {@link PackIndex}. */
+export const packIndexSchema = z.object({
+    version: z.union([z.literal(1), z.literal(2)]),
+    contentHash: z.string(),
+    prefixes: z.record(z.string(), z.string()),
+    entities: z.array(packIndexEntitySchema),
+    instanceCountByType: z.record(z.string(), z.number()),
+});
+/** zod schema validating a persisted `manifest.json`. */
+export const manifestSchema = z.object({
+    name: z.string(),
+    version: z.string(),
+    /** The config `packs` ref this pack was built from (verbatim), or a label. */
+    sourceRef: z.string(),
+    contentHash: z.string(),
+    prefixes: z.record(z.string(), z.string()),
+    createdAt: z.string(),
+    /**
+     * The store's triple count at build time. Cross-checked against the booted
+     * store so a truncated-but-non-empty `data.nq` (a partial graph that passes
+     * the mere size>0 completeness gate) surfaces as STORE_UNAVAILABLE rather
+     * than being served silently (A9). Optional — packs built before this field
+     * skip the check.
+     */
+    tripleCount: z.number().optional(),
+    /**
+     * The distinct abox entity count (matches `entityTotal`). Lets
+     * `sources status` report the figure without parsing the whole `index.json`
+     * (A10). Optional — packs built before this field fall back to the index read.
+     */
+    entityCount: z.number().optional(),
+});
+//# sourceMappingURL=schemas.js.map

package/dist/src/kernel/runtime/graphpack/schemas.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"schemas.js","sourceRoot":"","sources":["../../../../../src/kernel/runtime/graphpack/schemas.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAGxB,iEAAiE;AACjE,MAAM,CAAC,MAAM,qBAAqB,GAA+B,CAAC,CAAC,MAAM,CAAC;IACxE,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE;IAChB,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE;IAChB,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC1B,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC/B,KAAK,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE;IACrC,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;IACvC,QAAQ,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE;IACxC,GAAG,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC,QAAQ,EAAE;IACxC,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;CAC9C,CAAC,CAAC;AAEH,2DAA2D;AAC3D,MAAM,CAAC,MAAM,eAAe,GAAyB,CAAC,CAAC,MAAM,CAAC;IAC5D,OAAO,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC;IAC9C,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE;IACvB,QAAQ,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC;IAC1C,QAAQ,EAAE,CAAC,CAAC,KAAK,CAAC,qBAAqB,CAAC;IACxC,mBAAmB,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC;CACtD,CAAC,CAAC;AAEH,yDAAyD;AACzD,MAAM,CAAC,MAAM,cAAc,GAAwB,CAAC,CAAC,MAAM,CAAC;IAC1D,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE;IAChB,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE;IACnB,8EAA8E;IAC9E,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;IACrB,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE;IACvB,QAAQ,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC;IAC1C,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;IACrB;;;;;;OAMG;IACH,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAClC;;;;OAIG;IACH,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;CACnC,CAAC,CAAC"}

package/dist/src/kernel/runtime/graphpack/stories.js

@@ -0,0 +1,68 @@
+/**
+ * Read the read stories the ANSWERING pack carries.
+ *
+ * It CONSUMES the one boot decision ({@link resolveSources}) rather than
+ * re-deriving it, so the nouns a project's reads answer with can never differ
+ * from the nouns its pack carries: a project pointed at its own pack gets that
+ * pack's stories, a fresh install gets the embedded snapshot's, and a
+ * configured-but-unbuilt project gets none (its reads refuse too).
+ *
+ * Total: any unreadable or unparseable `stories.json` yields `[]`. The records
+ * are RAW TEXT — validating them is `kernel/packs/collect.validateStories`'s
+ * job, behind one guard, because a third-party story must never break a command.
+ *
+ * The embedded snapshot's records come from their OWN generated module, so
+ * reading them costs a small string and never loads `pack.generated.ts`'s
+ * ~1.9 MB of n-quads (a measured +28 ms on every invocation).
+ */
+import { readFileSync } from "node:fs";
+import { join } from "node:path";
+import { storiesJson } from "./embedded/pack.stories.generated.js";
+import { STORIES_FILE } from "./types.js";
+/** A record shaped as this module promises — the file is a user-writable cache. */
+function isRecord(value) {
+    return (typeof value === "object" &&
+        value !== null &&
+        typeof value.source === "string" &&
+        typeof value.content === "string");
+}
+/**
+ * Parse a `stories.json` body; anything malformed degrades to no stories.
+ *
+ * The elements are checked, not just the container: a record that is not
+ * `{ source, content }` would otherwise reach `validateStories` and be reported
+ * as `Ignored story undefined: …` — a diagnostic that names no file.
+ */
+function parseRecords(json) {
+    try {
+        const parsed = JSON.parse(json);
+        return Array.isArray(parsed) ? parsed.filter(isRecord) : [];
+    }
+    catch {
+        return [];
+    }
+}
+/**
+ * The read stories the answering pack carries.
+ *
+ * @param decision - The boot decision from `resolveSources`.
+ * @returns The carried story records — `[]` when the pack carries none, no pack
+ *   answers, or the file is unreadable.
+ * @note Impure — reads `stories.json` from the answering pack directory.
+ */
+export function activeStories(decision) {
+    switch (decision.kind) {
+        case "pack":
+            try {
+                return parseRecords(readFileSync(join(decision.dir, STORIES_FILE), "utf-8"));
+            }
+            catch {
+                return [];
+            }
+        case "embedded":
+            return parseRecords(storiesJson);
+        case "unavailable":
+            return [];
+    }
+}
+//# sourceMappingURL=stories.js.map

package/dist/src/kernel/runtime/graphpack/stories.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"stories.js","sourceRoot":"","sources":["../../../../../src/kernel/runtime/graphpack/stories.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAEH,OAAO,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AACvC,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAEjC,OAAO,EAAE,WAAW,EAAE,MAAM,sCAAsC,CAAC;AACnE,OAAO,EAAE,YAAY,EAAE,MAAM,YAAY,CAAC;AAU1C,mFAAmF;AACnF,SAAS,QAAQ,CAAC,KAAc;IAC9B,OAAO,CACL,OAAO,KAAK,KAAK,QAAQ;QACzB,KAAK,KAAK,IAAI;QACd,OAAQ,KAAyB,CAAC,MAAM,KAAK,QAAQ;QACrD,OAAQ,KAAyB,CAAC,OAAO,KAAK,QAAQ,CACvD,CAAC;AACJ,CAAC;AAED;;;;;;GAMG;AACH,SAAS,YAAY,CAAC,IAAY;IAChC,IAAI,CAAC;QACH,MAAM,MAAM,GAAY,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QACzC,OAAO,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IAC9D,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,CAAC;IACZ,CAAC;AACH,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,aAAa,CAC3B,QAAyB;IAEzB,QAAQ,QAAQ,CAAC,IAAI,EAAE,CAAC;QACtB,KAAK,MAAM;YACT,IAAI,CAAC;gBACH,OAAO,YAAY,CACjB,YAAY,CAAC,IAAI,CAAC,QAAQ,CAAC,GAAG,EAAE,YAAY,CAAC,EAAE,OAAO,CAAC,CACxD,CAAC;YACJ,CAAC;YAAC,MAAM,CAAC;gBACP,OAAO,EAAE,CAAC;YACZ,CAAC;QACH,KAAK,UAAU;YACb,OAAO,YAAY,CAAC,WAAW,CAAC,CAAC;QACnC,KAAK,aAAa;YAChB,OAAO,EAAE,CAAC;IACd,CAAC;AACH,CAAC"}

package/dist/src/kernel/runtime/graphpack/types.js

@@ -0,0 +1,55 @@
+/**
+ * Graphpack artifact contracts — the five files a built pack directory holds,
+ * as hand-written types with NO runtime dependency.
+ *
+ * A pack is the content-addressed, boot-ready form of a set of RDF sources:
+ * `data.nq` (the store's n-quads dump — boots via ke's cache path, no TTL
+ * parse), `schema.json` (the serialized ke-graphql extraction — boots via
+ * `compileFromExtraction`, no live 7-pass compile), `index.json` (the storeless
+ * entity index the completion tier and reads consume), `stories.json` (the read
+ * stories the packages ship, carried verbatim as raw text), and `manifest.json`
+ * (provenance + the prefixes the store was built with). A directory missing
+ * `manifest.json` is treated as absent (a torn build), so writes are always
+ * temp-dir + atomic rename.
+ *
+ * FIVE AND ONLY FIVE: the constants below are the single place the artifact set
+ * is named, and three modules must agree with them — `buildPack` writes them,
+ * `packIsComplete` gates on them, and `materializeEmbeddedPack` writes them back
+ * out. A sixth artifact added to only some of those makes a pack whose content
+ * hash claims more than its directory holds, which the next build then reuses,
+ * silently dropping the difference. The agreement is pinned by `graphpack.test.ts`'s
+ * "the committed embedded pack (PROTECTED) > materializes exactly the files
+ * buildPack produces" — extend the set here and that test fails until every
+ * side follows.
+ *
+ * This module is on the STORELESS FAST PATH — `capabilities/index.ts` →
+ * `resolveSources` → `packIsComplete` → `readManifest` reaches it while
+ * `__complete` builds the command tree — so it carries NO runtime import at
+ * all. It used to hold the zod schemas too, which put zod on that graph through
+ * a genuine value import and cost ~3–4 ms of a ~30 ms budget; they now live in
+ * `schemas.ts`, imported only by the two readers that are already off the fast
+ * path. `capabilities/lazy.test.ts` pins the result — no module on that graph
+ * imports zod — so the split cannot silently close.
+ */
+/** The n-quads store dump — ke boots it via `createStore({ cache })`. */
+export const DATA_FILE = "data.nq";
+/** The serialized ke-graphql extraction — boots via `compileFromExtraction`. */
+export const SCHEMA_FILE = "schema.json";
+/** The storeless entity index (PR-C's dynamic-completion contract). */
+export const INDEX_FILE = "index.json";
+/**
+ * The read stories the packages shipped, as raw text: one
+ * `{ source, content }` record per `stories/*.json` file, in a JSON array.
+ *
+ * Written ALWAYS, even as `[]`, and gated by `packIsComplete` alongside the
+ * other three — an optional artifact would put the same condition in all three
+ * modules below, which is exactly how a pack ends up claiming stories its
+ * directory does not hold. Raw text rather than parsed definitions so the pack stays a
+ * faithful carrier of the package's bytes and EVERY interpretation failure
+ * (malformed JSON and schema-invalid JSON alike) is caught behind the one guard
+ * in `kernel/packs/collect.validateStories`.
+ */
+export const STORIES_FILE = "stories.json";
+/** Provenance + prefixes; its presence marks a pack directory as complete. */
+export const MANIFEST_FILE = "manifest.json";
+//# sourceMappingURL=types.js.map

package/dist/src/kernel/runtime/graphpack/types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../../../../../src/kernel/runtime/graphpack/types.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgCG;AAEH,yEAAyE;AACzE,MAAM,CAAC,MAAM,SAAS,GAAG,SAAS,CAAC;AACnC,gFAAgF;AAChF,MAAM,CAAC,MAAM,WAAW,GAAG,aAAa,CAAC;AACzC,uEAAuE;AACvE,MAAM,CAAC,MAAM,UAAU,GAAG,YAAY,CAAC;AACvC;;;;;;;;;;;GAWG;AACH,MAAM,CAAC,MAAM,YAAY,GAAG,cAAc,CAAC;AAC3C,8EAA8E;AAC9E,MAAM,CAAC,MAAM,aAAa,GAAG,eAAe,CAAC"}

package/dist/src/kernel/runtime/index.js

@@ -0,0 +1,8 @@
+/**
+ * Runtime kernel barrel — the per-invocation context, its builder, and the
+ * lazy store / query facade the store-backed capabilities reach through.
+ */
+export { bootRuntime } from "./boot.js";
+export { createQueryFacade } from "./facade.js";
+export { createLazyStore } from "./store.js";
+//# sourceMappingURL=index.js.map

package/dist/src/kernel/runtime/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../../src/kernel/runtime/index.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,EAAE,WAAW,EAAE,MAAM,WAAW,CAAC;AACxC,OAAO,EAAE,iBAAiB,EAAE,MAAM,aAAa,CAAC;AAChD,OAAO,EAAE,eAAe,EAAyB,MAAM,YAAY,CAAC"}