@cotal-ai/core 0.11.6 → 0.13.0

package/dist/endpoint-contract-store.js

@@ -0,0 +1,348 @@
+/**
+ * The CONTRACT STORE (SPEC §13.7): content-addressed, public, immutable, permanent. One
+ * artifact per digest-keyed subject `cotal.<space>.epc.<digest-hex>`, published as a SINGLE
+ * message (bounded at 256 KiB; the §13.12 operator floor asserts `max_payload` covers it) —
+ * deliberately NOT a chunked object store, whose chunk replay needs a consumer with a
+ * body-selected delivery target (§13.9 forbids that shape). A closure is fetched
+ * artifact-by-artifact through its digest references, never as one blob.
+ *
+ * CONTENT IDENTITY (§13.7 "Content addressing"): an artifact is its STRICT RFC 8785 CANONICAL
+ * JSON — the digest is computed over the canonical bytes, publication REFUSES bytes that are
+ * not already the canonical serialization of their own parse (a noncanonical encoding of an
+ * equivalent value never gets its own identity; non-JSON bytes are never artifacts), and
+ * verify-on-read re-proves BOTH the digest and the canonical form (a garbled store never
+ * serves). TWO DIGESTS, NEVER CONFLATED: an ARTIFACT digest identifies one document's
+ * canonical bytes; a CLOSURE digest identifies a whole resolved bundle and is the artifact
+ * digest of that bundle's MANIFEST `{ v: 1, root, members }` — `members` being every artifact
+ * transitively reachable THROUGH BY-DIGEST REFERENCES from `root` (the root itself is named by
+ * its own field and appears in `members` only if a reference re-reaches it), sorted
+ * lexicographically and deduplicated. The manifest is itself an ordinary artifact on its own
+ * digest subject. Closure verification fetches the manifest BY the closure digest, walks the
+ * references from `root`, and PROVES the walked set equals `members` EXACTLY — a manifest that
+ * under- or over-names its closure never verifies.
+ *
+ * Reads are the subject-scoped last-by-subject Direct Get on the exact digest subject — no
+ * consumer, no replay machinery, nothing body-selected. Publication is mediated and
+ * create-only (`Nats-Expected-Last-Subject-Sequence: 0`): a digest subject is written at most
+ * once, and the digest is computed HERE from the canonical bytes (never a caller claim). The
+ * store seams run on a space-bonded BRANDED context (§13.4): JS + JSM derive from ONE
+ * connection, so a lost publish CAS can never validate its "recorded artifact" through a
+ * different broker. Every walk is BOUNDED by the frozen §13.7 registration bounds (closure
+ * <= 1 MiB, ref chain <= 32, document <= 256 KiB, plus the artifact-count ceiling) and ONE
+ * total monotonic time budget — the ceilings are non-raiseable (a caller may narrow, never
+ * widen) and a truncated closure never verifies as complete.
+ */
+import { jetstream, jetstreamManager } from "@nats-io/jetstream";
+import { headers as natsHeaders } from "@nats-io/transport-node";
+import { createHash } from "node:crypto";
+import { canonicalJson } from "./canonical.js";
+import { EpEnvelopeError } from "./endpoint-envelope.js";
+import { epcSubject } from "./endpoint-subjects.js";
+import { epcStreamName } from "./endpoint-binding.js";
+/** The §13.7 artifact bound: a document above it cannot ride one message and is refused. */
+export const CONTRACT_ARTIFACT_MAX_BYTES = 256 * 1024;
+/** The §13.7 closure byte bound: the sum of every fetched artifact's canonical bytes. */
+export const CONTRACT_CLOSURE_MAX_BYTES = 1024 * 1024;
+/** The §13.7 reference-chain bound: the walk's depth from the root. */
+export const CONTRACT_CLOSURE_MAX_REF_DEPTH = 32;
+/** The artifact-count ceiling: a walk that would exceed it fails loud, never truncates. */
+export const CONTRACT_CLOSURE_MAX_ARTIFACTS = 64;
+const HEX64 = /^[0-9a-f]{64}$/;
+/** The resources, unreachable from the context token itself. A structural look-alike never
+ *  appears in this map (so never authorizes); and `ctx.js`/`ctx.jsm` do not exist to reassign. */
+const STORE_RESOURCES = new WeakMap();
+/** Bond the resources to one space by CONSTRUCTION (frozen token + WeakMap-private resources, the
+ *  shared context discipline): a hand-assembled structural look-alike is rejected at every seam,
+ *  and the broker cannot be rebound out from under a live operation. */
+export async function contractStoreContext(nc, space) {
+    if (nc === null || typeof nc !== "object" || typeof nc.close !== "function")
+        throw new EpEnvelopeError("failed-precondition", "a contract-store context is constructed from ONE binding-layer connection; separate resources are never accepted (SPEC 13.4)");
+    if (typeof space !== "string" || space.length === 0)
+        throw new EpEnvelopeError("failed-precondition", "a contract-store context needs a space");
+    const js = jetstream(nc);
+    const jsm = await jetstreamManager(nc);
+    const ctx = Object.freeze({ space });
+    STORE_RESOURCES.set(ctx, { js, jsm });
+    return ctx;
+}
+/** The brand check AND the resource fetch in one: a context not minted by contractStoreContext()
+ *  is absent from the map and never authorizes. */
+function resources(ctx) {
+    const r = ctx === null || typeof ctx !== "object" ? undefined : STORE_RESOURCES.get(ctx);
+    if (r === undefined)
+        throw new EpEnvelopeError("failed-precondition", `the contract-store context was not constructed by contractStoreContext(); a hand-assembled resource bundle never authorizes - the space bond is constructed, not asserted (SPEC 13.4)`);
+    return r;
+}
+/** The artifact's subject token: SHA-256 hex over the artifact's CANONICAL bytes (§13.7: the
+ *  `sha256:` prefix is not a subject token). The bytes handed here MUST already be canonical —
+ *  publication and verify-on-read enforce that ({@link assertCanonicalArtifactBytes}). */
+export function contractArtifactDigestHex(bytes) {
+    return createHash("sha256").update(bytes).digest("hex");
+}
+/** Normalize a digest reference (`<hex>` or `sha256:<hex>`) to the bare subject token; a
+ *  malformed reference fails loud (a garbled ref never fetches an unintended subject). */
+export function contractRefToHex(ref) {
+    const hex = ref.startsWith("sha256:") ? ref.slice("sha256:".length) : ref;
+    if (!HEX64.test(hex))
+        throw new EpEnvelopeError("contract-invalid", `contract reference ${JSON.stringify(ref)} is not a sha256 digest; a garbled reference never resolves (SPEC 13.7)`);
+    return hex;
+}
+/** A value's canonical artifact bytes (strict RFC 8785 over I-JSON): what publication stores
+ *  and what the digest identifies. Non-interchangeable values refuse. */
+export function contractArtifactCanonicalBytes(value) {
+    try {
+        return new TextEncoder().encode(canonicalJson(value));
+    }
+    catch (e) {
+        throw new EpEnvelopeError("contract-invalid", `the value is not interchangeable JSON (${e.message}); only strict I-JSON is a contract artifact (SPEC 13.7)`);
+    }
+}
+/** Prove presented bytes ARE their own parse's strict RFC 8785 canonical serialization and
+ *  return the parsed value (§13.7 content identity): invalid UTF-8, non-JSON, and every
+ *  noncanonical encoding (reordered keys, whitespace, duplicate keys, noncanonical numbers)
+ *  refuse — an equivalent value in a different encoding never gets its own identity, so two
+ *  implementations can never disagree on an artifact's digest. */
+export function assertCanonicalArtifactBytes(bytes, what) {
+    let text;
+    try {
+        text = new TextDecoder("utf-8", { fatal: true }).decode(bytes);
+    }
+    catch {
+        throw new EpEnvelopeError("contract-invalid", `${what} is not valid UTF-8; only strict canonical JSON is a contract artifact (SPEC 13.7)`);
+    }
+    let value;
+    try {
+        value = JSON.parse(text);
+    }
+    catch (e) {
+        throw new EpEnvelopeError("contract-invalid", `${what} does not parse as JSON (${e.message}); only strict canonical JSON is a contract artifact (SPEC 13.7)`);
+    }
+    let canonical;
+    try {
+        canonical = canonicalJson(value);
+    }
+    catch (e) {
+        throw new EpEnvelopeError("contract-invalid", `${what} is not interchangeable I-JSON (${e.message}); only strict canonical JSON is a contract artifact (SPEC 13.7)`);
+    }
+    if (canonical !== text)
+        throw new EpEnvelopeError("contract-invalid", `${what} is not its own RFC 8785 canonical serialization; a noncanonical encoding never gets its own content identity (SPEC 13.7)`);
+    return value;
+}
+/** Publish one artifact at its content address, create-only. The bytes are DETACHED at entry
+ *  (a caller mutating the buffer across the publish await changes nothing), PROVEN canonical
+ *  ({@link assertCanonicalArtifactBytes}), and the digest is computed FROM that snapshot; a
+ *  lost CAS fetches the recorded artifact and — because the subject IS the digest and the
+ *  fetch verifies — the loss is an idempotent no-op ({won: false}). Oversize refuses. */
+export async function publishContractArtifact(ctx, bytes) {
+    const { js } = resources(ctx);
+    if (!(bytes instanceof Uint8Array) || bytes.length === 0)
+        throw new EpEnvelopeError("contract-invalid", "a contract artifact is non-empty canonical JSON bytes (SPEC 13.7)");
+    if (bytes.length > CONTRACT_ARTIFACT_MAX_BYTES)
+        throw new EpEnvelopeError("contract-invalid", `a contract artifact is bounded at ${CONTRACT_ARTIFACT_MAX_BYTES} bytes (got ${bytes.length}); a document above the bound cannot ride one message and is refused, never chunked (SPEC 13.7/13.12)`);
+    const snapshot = new Uint8Array(bytes); // detached at entry (a real copy — Buffer.slice would ALIAS): validated, digested, and published as ONE value
+    assertCanonicalArtifactBytes(snapshot, "the artifact");
+    const digestHex = contractArtifactDigestHex(snapshot);
+    const subject = epcSubject(ctx.space, digestHex);
+    const h = natsHeaders();
+    h.set("Nats-Expected-Last-Subject-Sequence", "0");
+    try {
+        await js.publish(subject, snapshot, { headers: h });
+        return { digestHex, won: true };
+    }
+    catch (e) {
+        const code = e?.code;
+        if (code !== 10071 && code !== 10164)
+            throw e;
+        // The subject is the digest: a prior write with this address holds these bytes (verified
+        // on fetch). The loss is idempotent; an unreadable prior write is loud.
+        const prior = await fetchContractArtifact(ctx, digestHex);
+        if (prior === undefined)
+            throw new EpEnvelopeError("internal", `the artifact CAS for ${subject} was lost but the recorded artifact is not readable (SPEC 13.4)`);
+        return { digestHex, won: false };
+    }
+}
+/** Fetch one artifact by digest (`undefined` = not published). VERIFY-ON-READ is unconditional
+ *  and TWO-PROOF: the fetched bytes must recompute the digest AND be strict canonical JSON —
+ *  content addressing is the tamper boundary and a garbled store never serves (§13.7). */
+export async function fetchContractArtifact(ctx, digestHex) {
+    const { jsm } = resources(ctx);
+    const subject = epcSubject(ctx.space, digestHex); // validates the token
+    let stored;
+    try {
+        stored = await jsm.direct.getMessage(epcStreamName(ctx.space), { last_by_subj: subject });
+    }
+    catch (e) {
+        if (e?.code === 10037)
+            return undefined; // the ONLY "genuinely absent" result
+        throw new EpEnvelopeError("unavailable", `the contract-store read for ${digestHex} failed (a failed observation is never absence, SPEC 13.7): ${e?.message ?? String(e)}`);
+    }
+    if (stored === null)
+        return undefined;
+    // The 256 KiB document bound is enforced on EVERY consuming read, not just publication (distsys
+    // 8dcad72 M2): a directly-planted oversize artifact (bypassing publishContractArtifact) must
+    // never be served, and the closure walk (which reads through here) inherits the per-document cap.
+    if (stored.data.length > CONTRACT_ARTIFACT_MAX_BYTES)
+        throw new EpEnvelopeError("internal", `the artifact at ${subject} is ${stored.data.length} bytes, above the ${CONTRACT_ARTIFACT_MAX_BYTES} document bound; a store that admitted an oversize artifact never serves it (SPEC 13.7)`);
+    if (contractArtifactDigestHex(stored.data) !== digestHex)
+        throw new EpEnvelopeError("internal", `the artifact at ${subject} does not recompute its digest; verify-on-read is the tamper boundary and fails loud (SPEC 13.7)`);
+    try {
+        assertCanonicalArtifactBytes(stored.data, `the artifact at ${subject}`);
+    }
+    catch {
+        throw new EpEnvelopeError("internal", `the artifact at ${subject} is not strict canonical JSON; a garbled store never serves (SPEC 13.7)`);
+    }
+    return stored.data;
+}
+const sha256Ref = (hex) => `sha256:${hex}`;
+/** A manifest digest field is EXACTLY `sha256:<64-hex>` (frozen SPEC 13.7:1858-1861), never a
+ *  bare `<hex>` or any other spelling (distsys 8dcad72 HIGH): two manifests differing only in
+ *  digest spelling are both canonical JSON, receive DIFFERENT closure digests, yet verify the same
+ *  walked graph - so one closure would have two identities. Normalization belongs in the BUILDER's
+ *  input; the consuming parse requires the canonical prefixed form and refuses anything else. */
+const SHA256_REF = /^sha256:[0-9a-f]{64}$/;
+function assertManifestDigest(ref, what) {
+    if (typeof ref !== "string" || !SHA256_REF.test(ref))
+        throw new EpEnvelopeError("contract-invalid", `${what} must be exactly "sha256:<64-hex>" (SPEC 13.7); a bare-hex or otherwise-spelled digest gives one closure two identities and never names it`);
+}
+/** Build the canonical manifest for a walked closure: refs normalize, members sort + dedup.
+ *  The ROOT is named by its own field and belongs in `members` only when a reference
+ *  re-reaches it (the §13.7 "reachable THROUGH references" rule, pinned here so two
+ *  implementations always mint the identical manifest). */
+export function buildContractClosureManifest(rootRef, memberRefs) {
+    const root = sha256Ref(contractRefToHex(rootRef));
+    const members = [...new Set(memberRefs.map((r) => sha256Ref(contractRefToHex(r))))].sort();
+    return { v: 1, root, members };
+}
+function parseClosureManifest(value, what) {
+    if (value === null || typeof value !== "object" || Array.isArray(value))
+        throw new EpEnvelopeError("contract-invalid", `${what} is not a manifest object (SPEC 13.7)`);
+    const o = value;
+    for (const k of Object.keys(o))
+        if (!["v", "root", "members"].includes(k))
+            throw new EpEnvelopeError("contract-invalid", `${what} carries the unknown field "${k}"; the manifest schema is closed (SPEC 13.7)`);
+    if (o.v !== 1 || typeof o.root !== "string" || !Array.isArray(o.members))
+        throw new EpEnvelopeError("contract-invalid", `${what} is not { v: 1, root, members } (SPEC 13.7)`);
+    assertManifestDigest(o.root, `${what} root`);
+    if (o.members.length > CONTRACT_CLOSURE_MAX_ARTIFACTS)
+        throw new EpEnvelopeError("contract-invalid", `${what} names ${o.members.length} members, above the ${CONTRACT_CLOSURE_MAX_ARTIFACTS}-artifact ceiling (SPEC 13.7)`);
+    for (let i = 0; i < o.members.length; i++) {
+        const m = o.members[i];
+        assertManifestDigest(m, `${what} member ${i}`);
+        // The canonical form IS sorted + deduplicated: an unsorted or duplicated members list is a
+        // DIFFERENT byte sequence claiming the same closure — refused, never silently normalized.
+        if (i > 0 && o.members[i - 1] >= m)
+            throw new EpEnvelopeError("contract-invalid", `${what} members are not strictly sorted/deduplicated at index ${i}; a noncanonical manifest never names a closure (SPEC 13.7)`);
+    }
+    return { v: 1, root: o.root, members: o.members };
+}
+/** Publish a closure's manifest as an ordinary canonical artifact; the returned digest IS the
+ *  closure digest (§13.7). */
+export async function publishContractClosureManifest(ctx, manifest) {
+    resources(ctx); // brand-check (resources unused here; the delegated publish/fetch use them)
+    const value = parseClosureManifest(manifest, "the manifest");
+    const res = await publishContractArtifact(ctx, contractArtifactCanonicalBytes(value));
+    return { closureDigestHex: res.digestHex, won: res.won };
+}
+/** Fetch and VERIFY a closure by its CLOSURE digest (§13.7): fetch the manifest artifact at
+ *  that digest (its identity is proven by the fetch), then walk the by-digest references from
+ *  `root` through the `extractRefs` resolution seam and PROVE the walked set equals
+ *  `manifest.members` exactly — an under-naming manifest (the walk reaches an unlisted
+ *  artifact) and an over-naming one (a listed member is never reached) both refuse; a missing
+ *  artifact anywhere is all-or-nothing loud. The walk is BOUNDED: the frozen closure byte
+ *  bound, the reference-chain depth, the artifact-count ceiling (non-raiseable; a caller may
+ *  narrow), a per-artifact reference cap, and ONE total monotonic time budget. `extractRefs`
+ *  receives a DETACHED copy of each artifact's bytes (a mutating seam cannot poison the
+ *  returned map) and its answer is size-capped. Returns digest → bytes (manifest excluded;
+ *  root first, then first-visit order) plus the parsed manifest. */
+export async function fetchContractClosure(ctx, closureDigestRef, extractRefs, opts = {}) {
+    resources(ctx); // brand-check (resources unused here; the delegated publish/fetch use them)
+    const max = opts.maxArtifacts ?? CONTRACT_CLOSURE_MAX_ARTIFACTS;
+    if (!Number.isSafeInteger(max) || max <= 0 || max > CONTRACT_CLOSURE_MAX_ARTIFACTS)
+        throw new EpEnvelopeError("failed-precondition", `maxArtifacts must be a positive integer at or below the frozen ${CONTRACT_CLOSURE_MAX_ARTIFACTS}-artifact ceiling (a caller narrows, never widens); got ${JSON.stringify(opts.maxArtifacts)} (SPEC 13.7)`);
+    const budgetMs = opts.walkBudgetMs ?? 30_000;
+    if (!Number.isSafeInteger(budgetMs) || budgetMs <= 0)
+        throw new EpEnvelopeError("failed-precondition", `walkBudgetMs must be a positive integer; got ${JSON.stringify(opts.walkBudgetMs)}`);
+    if (typeof extractRefs !== "function")
+        throw new EpEnvelopeError("failed-precondition", "a closure fetch requires the reference-resolution seam (extractRefs); the store never guesses a document's reference shape (SPEC 13.7)");
+    const startedAt = performance.now();
+    const overBudget = () => performance.now() - startedAt > budgetMs;
+    // The ONE monotonic budget bounds the WHOLE walk, including the awaited reads and the synchronous
+    // extractor (distsys 8dcad72 M1): every Direct Get is raced against the REMAINING budget (a stuck
+    // read is a bounded deadline, never a hang), and overBudget() is checked after each extractRefs
+    // and before returning, so a slow synchronous seam cannot blow the budget and still return success.
+    const raceBudget = async (p, what) => {
+        const rem = budgetMs - (performance.now() - startedAt);
+        if (rem <= 0)
+            throw new EpEnvelopeError("deadline-exceeded", `the closure walk exhausted its ${budgetMs}ms budget before ${what} (SPEC 13.7/13.8)`);
+        let timer;
+        const deadline = new Promise((_, reject) => { timer = setTimeout(() => reject(new EpEnvelopeError("deadline-exceeded", `the closure walk exceeded its ${budgetMs}ms budget during ${what}; a closure fetch is bounded and fails loud, never hangs (SPEC 13.7/13.8)`)), rem); });
+        try {
+            return await Promise.race([p, deadline]);
+        }
+        finally {
+            clearTimeout(timer);
+        }
+    };
+    const closureHex = contractRefToHex(closureDigestRef);
+    const manifestBytes = await raceBudget(fetchContractArtifact(ctx, closureHex), `the manifest fetch for ${closureHex}`);
+    if (manifestBytes === undefined)
+        throw new EpEnvelopeError("failed-precondition", `the closure manifest ${closureHex} is not published; a closure digest names its manifest artifact (SPEC 13.7)`);
+    const manifest = parseClosureManifest(assertCanonicalArtifactBytes(manifestBytes, `the manifest ${closureHex}`), `the manifest ${closureHex}`);
+    const rootHex = contractRefToHex(manifest.root);
+    const out = new Map();
+    let totalBytes = 0;
+    let rootReReached = false; // a reference naming the root makes it reference-reachable (a member)
+    // BFS with depth tracking: the queue carries (hex, depth); depth is the reference-chain
+    // length from the root (§13.7 ref chain <= 32).
+    const queue = [{ hex: rootHex, depth: 0 }];
+    while (queue.length > 0) {
+        if (overBudget())
+            throw new EpEnvelopeError("deadline-exceeded", `the closure walk for ${closureHex} exceeded its ${budgetMs}ms budget; a closure fetch is bounded and fails loud, never hangs (SPEC 13.7/13.8)`);
+        const { hex, depth } = queue.shift();
+        // The reference-chain depth is checked on EVERY dequeued edge, BEFORE the visited dedupe
+        // (distsys 8dcad72 M4): an over-depth edge that happens to re-reach an already-visited node
+        // (e.g. a 33-deep cycle back to the root) must still trip the bound, never be silently skipped.
+        if (depth > CONTRACT_CLOSURE_MAX_REF_DEPTH)
+            throw new EpEnvelopeError("contract-invalid", `the closure walk for ${closureHex} exceeds the ${CONTRACT_CLOSURE_MAX_REF_DEPTH}-deep reference chain bound (SPEC 13.7)`);
+        if (out.has(hex))
+            continue; // cycle/diamond-safe (after the depth bound)
+        if (out.size >= max)
+            throw new EpEnvelopeError("failed-precondition", `the contract closure exceeds the ${max}-artifact bound; a truncated closure never verifies as complete (SPEC 13.7)`);
+        const bytes = await raceBudget(fetchContractArtifact(ctx, hex), `the fetch of ${hex}`);
+        if (bytes === undefined)
+            throw new EpEnvelopeError("failed-precondition", `the closure references artifact ${hex} but it is not published; a closure is fetched all-or-nothing (SPEC 13.7)`);
+        totalBytes += bytes.length;
+        if (totalBytes > CONTRACT_CLOSURE_MAX_BYTES)
+            throw new EpEnvelopeError("contract-invalid", `the closure for ${closureHex} exceeds the ${CONTRACT_CLOSURE_MAX_BYTES}-byte bound (SPEC 13.7)`);
+        out.set(hex, bytes);
+        const refs = extractRefs(new Uint8Array(bytes), hex); // DETACHED copy (a real copy — Buffer.slice would ALIAS the stored bytes): a mutating seam cannot poison the returned map
+        if (!Array.isArray(refs) || !refs.every((r) => typeof r === "string"))
+            throw new EpEnvelopeError("internal", `the reference-resolution seam returned a non-string-array for ${hex}; a garbled resolution never extends a closure (SPEC 13.7)`);
+        if (refs.length > CONTRACT_CLOSURE_MAX_ARTIFACTS)
+            throw new EpEnvelopeError("contract-invalid", `artifact ${hex} names ${refs.length} references, above the ${CONTRACT_CLOSURE_MAX_ARTIFACTS}-reference cap; an unbounded reference list never extends a closure (SPEC 13.7)`);
+        if (overBudget()) // a slow synchronous extractRefs cannot be interrupted mid-run, but it must not blow the budget and still return success (M1)
+            throw new EpEnvelopeError("deadline-exceeded", `the closure walk for ${closureHex} exceeded its ${budgetMs}ms budget resolving references for ${hex} (SPEC 13.7/13.8)`);
+        for (const r of refs) {
+            const rHex = contractRefToHex(r);
+            if (rHex === rootHex)
+                rootReReached = true; // a cycle back makes the root a member too
+            queue.push({ hex: rHex, depth: depth + 1 });
+        }
+    }
+    // The walked reachable-THROUGH-references set must equal the manifest's members EXACTLY
+    // (§13.7): the root belongs iff a reference re-reached it — tracked during the walk, so
+    // exactly ONE manifest (one closure digest) names any given closure, never two.
+    const walked = new Set();
+    for (const hex of out.keys())
+        if (hex !== rootHex || rootReReached)
+            walked.add(sha256Ref(hex));
+    const memberSet = new Set(manifest.members);
+    for (const m of walked)
+        if (!memberSet.has(m))
+            throw new EpEnvelopeError("contract-invalid", `the closure walk reached ${m} but the manifest ${closureHex} does not name it; an under-naming manifest never verifies (SPEC 13.7)`);
+    for (const m of memberSet)
+        if (!walked.has(m))
+            throw new EpEnvelopeError("contract-invalid", `the manifest ${closureHex} names ${m} but the walk never reached it; an over-naming manifest never verifies (SPEC 13.7)`);
+    return { manifest, artifacts: out };
+}
+//# sourceMappingURL=endpoint-contract-store.js.map

package/dist/endpoint-contract-store.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"endpoint-contract-store.js","sourceRoot":"","sources":["../src/endpoint-contract-store.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiCG;AACH,OAAO,EAAE,SAAS,EAAE,gBAAgB,EAA+C,MAAM,oBAAoB,CAAC;AAC9G,OAAO,EAAE,OAAO,IAAI,WAAW,EAAuB,MAAM,yBAAyB,CAAC;AACtF,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,aAAa,EAAE,MAAM,gBAAgB,CAAC;AAC/C,OAAO,EAAE,eAAe,EAAE,MAAM,wBAAwB,CAAC;AACzD,OAAO,EAAE,UAAU,EAAE,MAAM,wBAAwB,CAAC;AACpD,OAAO,EAAE,aAAa,EAAE,MAAM,uBAAuB,CAAC;AAEtD,4FAA4F;AAC5F,MAAM,CAAC,MAAM,2BAA2B,GAAG,GAAG,GAAG,IAAI,CAAC;AACtD,yFAAyF;AACzF,MAAM,CAAC,MAAM,0BAA0B,GAAG,IAAI,GAAG,IAAI,CAAC;AACtD,uEAAuE;AACvE,MAAM,CAAC,MAAM,8BAA8B,GAAG,EAAE,CAAC;AACjD,2FAA2F;AAC3F,MAAM,CAAC,MAAM,8BAA8B,GAAG,EAAE,CAAC;AAEjD,MAAM,KAAK,GAAG,gBAAgB,CAAC;AAa/B;kGACkG;AAClG,MAAM,eAAe,GAAG,IAAI,OAAO,EAAwC,CAAC;AAE5E;;wEAEwE;AACxE,MAAM,CAAC,KAAK,UAAU,oBAAoB,CAAC,EAAkB,EAAE,KAAa;IAC1E,IAAI,EAAE,KAAK,IAAI,IAAI,OAAO,EAAE,KAAK,QAAQ,IAAI,OAAQ,EAAqC,CAAC,KAAK,KAAK,UAAU;QAC7G,MAAM,IAAI,eAAe,CAAC,qBAAqB,EAAE,8HAA8H,CAAC,CAAC;IACnL,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;QACjD,MAAM,IAAI,eAAe,CAAC,qBAAqB,EAAE,wCAAwC,CAAC,CAAC;IAC7F,MAAM,EAAE,GAAG,SAAS,CAAC,EAAE,CAAC,CAAC;IACzB,MAAM,GAAG,GAAG,MAAM,gBAAgB,CAAC,EAAE,CAAC,CAAC;IACvC,MAAM,GAAG,GAAyB,MAAM,CAAC,MAAM,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC;IAC3D,eAAe,CAAC,GAAG,CAAC,GAAG,EAAE,EAAE,EAAE,EAAE,GAAG,EAAE,CAAC,CAAC;IACtC,OAAO,GAAG,CAAC;AACb,CAAC;AAED;mDACmD;AACnD,SAAS,SAAS,CAAC,GAAyB;IAC1C,MAAM,CAAC,GAAG,GAAG,KAAK,IAAI,IAAI,OAAO,GAAG,KAAK,QAAQ,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,eAAe,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IACzF,IAAI,CAAC,KAAK,SAAS;QACjB,MAAM,IAAI,eAAe,CAAC,qBAAqB,EAAE,uLAAuL,CAAC,CAAC;IAC5O,OAAO,CAAC,CAAC;AACX,CAAC;AAED;;0FAE0F;AAC1F,MAAM,UAAU,yBAAyB,CAAC,KAAiB;IACzD,OAAO,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AAC1D,CAAC;AAED;0FAC0F;AAC1F,MAAM,UAAU,gBAAgB,CAAC,GAAW;IAC1C,MAAM,GAAG,GAAG,GAAG,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC;IAC1E,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC;QAClB,MAAM,IAAI,eAAe,CAAC,kBAAkB,EAAE,sBAAsB,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,yEAAyE,CAAC,CAAC;IACpK,OAAO,GAAG,CAAC;AACb,CAAC;AAED;yEACyE;AACzE,MAAM,UAAU,8BAA8B,CAAC,KAAc;IAC3D,IAAI,CAAC;QAAC,OAAO,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,aAAa,CAAC,KAAK,CAAC,CAAC,CAAC;IAAC,CAAC;IAC9D,OAAO,CAAC,EAAE,CAAC;QAAC,MAAM,IAAI,eAAe,CAAC,kBAAkB,EAAE,0CAA2C,CAAW,CAAC,OAAO,0DAA0D,CAAC,CAAC;IAAC,CAAC;AACxL,CAAC;AAED;;;;kEAIkE;AAClE,MAAM,UAAU,4BAA4B,CAAC,KAAiB,EAAE,IAAY;IAC1E,IAAI,IAAY,CAAC;IACjB,IAAI,CAAC;QAAC,IAAI,GAAG,IAAI,WAAW,CAAC,OAAO,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IAAC,CAAC;IACvE,MAAM,CAAC;QAAC,MAAM,IAAI,eAAe,CAAC,kBAAkB,EAAE,GAAG,IAAI,oFAAoF,CAAC,CAAC;IAAC,CAAC;IACrJ,IAAI,KAAc,CAAC;IACnB,IAAI,CAAC;QAAC,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IAAC,CAAC;IACjC,OAAO,CAAC,EAAE,CAAC;QAAC,MAAM,IAAI,eAAe,CAAC,kBAAkB,EAAE,GAAG,IAAI,4BAA6B,CAAW,CAAC,OAAO,kEAAkE,CAAC,CAAC;IAAC,CAAC;IACvL,IAAI,SAAiB,CAAC;IACtB,IAAI,CAAC;QAAC,SAAS,GAAG,aAAa,CAAC,KAAK,CAAC,CAAC;IAAC,CAAC;IACzC,OAAO,CAAC,EAAE,CAAC;QAAC,MAAM,IAAI,eAAe,CAAC,kBAAkB,EAAE,GAAG,IAAI,mCAAoC,CAAW,CAAC,OAAO,kEAAkE,CAAC,CAAC;IAAC,CAAC;IAC9L,IAAI,SAAS,KAAK,IAAI;QACpB,MAAM,IAAI,eAAe,CAAC,kBAAkB,EAAE,GAAG,IAAI,2HAA2H,CAAC,CAAC;IACpL,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;;yFAIyF;AACzF,MAAM,CAAC,KAAK,UAAU,uBAAuB,CAC3C,GAAyB,EACzB,KAAiB;IAEjB,MAAM,EAAE,EAAE,EAAE,GAAG,SAAS,CAAC,GAAG,CAAC,CAAC;IAC9B,IAAI,CAAC,CAAC,KAAK,YAAY,UAAU,CAAC,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;QACtD,MAAM,IAAI,eAAe,CAAC,kBAAkB,EAAE,mEAAmE,CAAC,CAAC;IACrH,IAAI,KAAK,CAAC,MAAM,GAAG,2BAA2B;QAC5C,MAAM,IAAI,eAAe,CAAC,kBAAkB,EAAE,qCAAqC,2BAA2B,eAAe,KAAK,CAAC,MAAM,uGAAuG,CAAC,CAAC;IACpP,MAAM,QAAQ,GAAG,IAAI,UAAU,CAAC,KAAK,CAAC,CAAC,CAAC,8GAA8G;IACtJ,4BAA4B,CAAC,QAAQ,EAAE,cAAc,CAAC,CAAC;IACvD,MAAM,SAAS,GAAG,yBAAyB,CAAC,QAAQ,CAAC,CAAC;IACtD,MAAM,OAAO,GAAG,UAAU,CAAC,GAAG,CAAC,KAAK,EAAE,SAAS,CAAC,CAAC;IACjD,MAAM,CAAC,GAAG,WAAW,EAAE,CAAC;IACxB,CAAC,CAAC,GAAG,CAAC,qCAAqC,EAAE,GAAG,CAAC,CAAC;IAClD,IAAI,CAAC;QACH,MAAM,EAAE,CAAC,OAAO,CAAC,OAAO,EAAE,QAAQ,EAAE,EAAE,OAAO,EAAE,CAAC,EAAE,CAAC,CAAC;QACpD,OAAO,EAAE,SAAS,EAAE,GAAG,EAAE,IAAI,EAAE,CAAC;IAClC,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,MAAM,IAAI,GAAI,CAAwB,EAAE,IAAI,CAAC;QAC7C,IAAI,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,KAAK;YAAE,MAAM,CAAC,CAAC;QAC9C,yFAAyF;QACzF,wEAAwE;QACxE,MAAM,KAAK,GAAG,MAAM,qBAAqB,CAAC,GAAG,EAAE,SAAS,CAAC,CAAC;QAC1D,IAAI,KAAK,KAAK,SAAS;YACrB,MAAM,IAAI,eAAe,CAAC,UAAU,EAAE,wBAAwB,OAAO,iEAAiE,CAAC,CAAC;QAC1I,OAAO,EAAE,SAAS,EAAE,GAAG,EAAE,KAAK,EAAE,CAAC;IACnC,CAAC;AACH,CAAC;AAED;;0FAE0F;AAC1F,MAAM,CAAC,KAAK,UAAU,qBAAqB,CACzC,GAAyB,EACzB,SAAiB;IAEjB,MAAM,EAAE,GAAG,EAAE,GAAG,SAAS,CAAC,GAAG,CAAC,CAAC;IAC/B,MAAM,OAAO,GAAG,UAAU,CAAC,GAAG,CAAC,KAAK,EAAE,SAAS,CAAC,CAAC,CAAC,sBAAsB;IACxE,IAAI,MAAM,CAAC;IACX,IAAI,CAAC;QACH,MAAM,GAAG,MAAM,GAAG,CAAC,MAAM,CAAC,UAAU,CAAC,aAAa,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,EAAE,YAAY,EAAE,OAAO,EAAE,CAAC,CAAC;IAC5F,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,IAAK,CAAwB,EAAE,IAAI,KAAK,KAAK;YAAE,OAAO,SAAS,CAAC,CAAC,qCAAqC;QACtG,MAAM,IAAI,eAAe,CAAC,aAAa,EAAE,+BAA+B,SAAS,+DAAgE,CAAW,EAAE,OAAO,IAAI,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;IACxL,CAAC;IACD,IAAI,MAAM,KAAK,IAAI;QAAE,OAAO,SAAS,CAAC;IACtC,gGAAgG;IAChG,6FAA6F;IAC7F,kGAAkG;IAClG,IAAI,MAAM,CAAC,IAAI,CAAC,MAAM,GAAG,2BAA2B;QAClD,MAAM,IAAI,eAAe,CAAC,UAAU,EAAE,mBAAmB,OAAO,OAAO,MAAM,CAAC,IAAI,CAAC,MAAM,qBAAqB,2BAA2B,yFAAyF,CAAC,CAAC;IACtO,IAAI,yBAAyB,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,SAAS;QACtD,MAAM,IAAI,eAAe,CAAC,UAAU,EAAE,mBAAmB,OAAO,kGAAkG,CAAC,CAAC;IACtK,IAAI,CAAC;QAAC,4BAA4B,CAAC,MAAM,CAAC,IAAI,EAAE,mBAAmB,OAAO,EAAE,CAAC,CAAC;IAAC,CAAC;IAChF,MAAM,CAAC;QAAC,MAAM,IAAI,eAAe,CAAC,UAAU,EAAE,mBAAmB,OAAO,yEAAyE,CAAC,CAAC;IAAC,CAAC;IACrJ,OAAO,MAAM,CAAC,IAAI,CAAC;AACrB,CAAC;AAeD,MAAM,SAAS,GAAG,CAAC,GAAW,EAAU,EAAE,CAAC,UAAU,GAAG,EAAE,CAAC;AAE3D;;;;iGAIiG;AACjG,MAAM,UAAU,GAAG,uBAAuB,CAAC;AAC3C,SAAS,oBAAoB,CAAC,GAAY,EAAE,IAAY;IACtD,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,GAAG,CAAC;QAClD,MAAM,IAAI,eAAe,CAAC,kBAAkB,EAAE,GAAG,IAAI,4IAA4I,CAAC,CAAC;AACvM,CAAC;AAED;;;2DAG2D;AAC3D,MAAM,UAAU,4BAA4B,CAAC,OAAe,EAAE,UAA6B;IACzF,MAAM,IAAI,GAAG,SAAS,CAAC,gBAAgB,CAAC,OAAO,CAAC,CAAC,CAAC;IAClD,MAAM,OAAO,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,SAAS,CAAC,gBAAgB,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;IAC3F,OAAO,EAAE,CAAC,EAAE,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC;AACjC,CAAC;AAED,SAAS,oBAAoB,CAAC,KAAc,EAAE,IAAY;IACxD,IAAI,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QACrE,MAAM,IAAI,eAAe,CAAC,kBAAkB,EAAE,GAAG,IAAI,uCAAuC,CAAC,CAAC;IAChG,MAAM,CAAC,GAAG,KAAgC,CAAC;IAC3C,KAAK,MAAM,CAAC,IAAI,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC;QAC5B,IAAI,CAAC,CAAC,GAAG,EAAE,MAAM,EAAE,SAAS,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC;YACvC,MAAM,IAAI,eAAe,CAAC,kBAAkB,EAAE,GAAG,IAAI,+BAA+B,CAAC,8CAA8C,CAAC,CAAC;IACzI,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,OAAO,CAAC,CAAC,IAAI,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC;QACtE,MAAM,IAAI,eAAe,CAAC,kBAAkB,EAAE,GAAG,IAAI,6CAA6C,CAAC,CAAC;IACtG,oBAAoB,CAAC,CAAC,CAAC,IAAI,EAAE,GAAG,IAAI,OAAO,CAAC,CAAC;IAC7C,IAAI,CAAC,CAAC,OAAO,CAAC,MAAM,GAAG,8BAA8B;QACnD,MAAM,IAAI,eAAe,CAAC,kBAAkB,EAAE,GAAG,IAAI,UAAU,CAAC,CAAC,OAAO,CAAC,MAAM,uBAAuB,8BAA8B,+BAA+B,CAAC,CAAC;IACvK,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QAC1C,MAAM,CAAC,GAAG,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;QACvB,oBAAoB,CAAC,CAAC,EAAE,GAAG,IAAI,WAAW,CAAC,EAAE,CAAC,CAAC;QAC/C,2FAA2F;QAC3F,0FAA0F;QAC1F,IAAI,CAAC,GAAG,CAAC,IAAK,CAAC,CAAC,OAAO,CAAC,CAAC,GAAG,CAAC,CAAY,IAAI,CAAC;YAC5C,MAAM,IAAI,eAAe,CAAC,kBAAkB,EAAE,GAAG,IAAI,0DAA0D,CAAC,6DAA6D,CAAC,CAAC;IACnL,CAAC;IACD,OAAO,EAAE,CAAC,EAAE,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,OAAO,EAAE,CAAC,CAAC,OAAmB,EAAE,CAAC;AAChE,CAAC;AAED;8BAC8B;AAC9B,MAAM,CAAC,KAAK,UAAU,8BAA8B,CAClD,GAAyB,EACzB,QAAiC;IAEjC,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,4EAA4E;IAC5F,MAAM,KAAK,GAAG,oBAAoB,CAAC,QAAQ,EAAE,cAAc,CAAC,CAAC;IAC7D,MAAM,GAAG,GAAG,MAAM,uBAAuB,CAAC,GAAG,EAAE,8BAA8B,CAAC,KAAK,CAAC,CAAC,CAAC;IACtF,OAAO,EAAE,gBAAgB,EAAE,GAAG,CAAC,SAAS,EAAE,GAAG,EAAE,GAAG,CAAC,GAAG,EAAE,CAAC;AAC3D,CAAC;AAED;;;;;;;;;;oEAUoE;AACpE,MAAM,CAAC,KAAK,UAAU,oBAAoB,CACxC,GAAyB,EACzB,gBAAwB,EACxB,WAA+D,EAC/D,OAAyD,EAAE;IAE3D,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,4EAA4E;IAC5F,MAAM,GAAG,GAAG,IAAI,CAAC,YAAY,IAAI,8BAA8B,CAAC;IAChE,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,GAAG,CAAC,IAAI,GAAG,IAAI,CAAC,IAAI,GAAG,GAAG,8BAA8B;QAChF,MAAM,IAAI,eAAe,CAAC,qBAAqB,EAAE,kEAAkE,8BAA8B,2DAA2D,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,YAAY,CAAC,cAAc,CAAC,CAAC;IAC/P,MAAM,QAAQ,GAAG,IAAI,CAAC,YAAY,IAAI,MAAM,CAAC;IAC7C,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,QAAQ,CAAC,IAAI,QAAQ,IAAI,CAAC;QAClD,MAAM,IAAI,eAAe,CAAC,qBAAqB,EAAE,gDAAgD,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,YAAY,CAAC,EAAE,CAAC,CAAC;IACxI,IAAI,OAAO,WAAW,KAAK,UAAU;QACnC,MAAM,IAAI,eAAe,CAAC,qBAAqB,EAAE,wIAAwI,CAAC,CAAC;IAC7L,MAAM,SAAS,GAAG,WAAW,CAAC,GAAG,EAAE,CAAC;IACpC,MAAM,UAAU,GAAG,GAAY,EAAE,CAAC,WAAW,CAAC,GAAG,EAAE,GAAG,SAAS,GAAG,QAAQ,CAAC;IAC3E,kGAAkG;IAClG,kGAAkG;IAClG,gGAAgG;IAChG,oGAAoG;IACpG,MAAM,UAAU,GAAG,KAAK,EAAK,CAAa,EAAE,IAAY,EAAc,EAAE;QACtE,MAAM,GAAG,GAAG,QAAQ,GAAG,CAAC,WAAW,CAAC,GAAG,EAAE,GAAG,SAAS,CAAC,CAAC;QACvD,IAAI,GAAG,IAAI,CAAC;YACV,MAAM,IAAI,eAAe,CAAC,mBAAmB,EAAE,kCAAkC,QAAQ,oBAAoB,IAAI,mBAAmB,CAAC,CAAC;QACxI,IAAI,KAAgD,CAAC;QACrD,MAAM,QAAQ,GAAG,IAAI,OAAO,CAAQ,CAAC,CAAC,EAAE,MAAM,EAAE,EAAE,GAAG,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,MAAM,CAAC,IAAI,eAAe,CAAC,mBAAmB,EAAE,iCAAiC,QAAQ,oBAAoB,IAAI,2EAA2E,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QACvR,IAAI,CAAC;YAAC,OAAO,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,QAAQ,CAAC,CAAC,CAAC;QAAC,CAAC;gBAAS,CAAC;YAAC,YAAY,CAAC,KAAK,CAAC,CAAC;QAAC,CAAC;IACpF,CAAC,CAAC;IAEF,MAAM,UAAU,GAAG,gBAAgB,CAAC,gBAAgB,CAAC,CAAC;IACtD,MAAM,aAAa,GAAG,MAAM,UAAU,CAAC,qBAAqB,CAAC,GAAG,EAAE,UAAU,CAAC,EAAE,0BAA0B,UAAU,EAAE,CAAC,CAAC;IACvH,IAAI,aAAa,KAAK,SAAS;QAC7B,MAAM,IAAI,eAAe,CAAC,qBAAqB,EAAE,wBAAwB,UAAU,6EAA6E,CAAC,CAAC;IACpK,MAAM,QAAQ,GAAG,oBAAoB,CAAC,4BAA4B,CAAC,aAAa,EAAE,gBAAgB,UAAU,EAAE,CAAC,EAAE,gBAAgB,UAAU,EAAE,CAAC,CAAC;IAE/I,MAAM,OAAO,GAAG,gBAAgB,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;IAChD,MAAM,GAAG,GAAG,IAAI,GAAG,EAAsB,CAAC;IAC1C,IAAI,UAAU,GAAG,CAAC,CAAC;IACnB,IAAI,aAAa,GAAG,KAAK,CAAC,CAAC,sEAAsE;IACjG,wFAAwF;IACxF,gDAAgD;IAChD,MAAM,KAAK,GAA0C,CAAC,EAAE,GAAG,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC,EAAE,CAAC,CAAC;IAClF,OAAO,KAAK,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACxB,IAAI,UAAU,EAAE;YACd,MAAM,IAAI,eAAe,CAAC,mBAAmB,EAAE,wBAAwB,UAAU,iBAAiB,QAAQ,oFAAoF,CAAC,CAAC;QAClM,MAAM,EAAE,GAAG,EAAE,KAAK,EAAE,GAAG,KAAK,CAAC,KAAK,EAAG,CAAC;QACtC,yFAAyF;QACzF,4FAA4F;QAC5F,gGAAgG;QAChG,IAAI,KAAK,GAAG,8BAA8B;YACxC,MAAM,IAAI,eAAe,CAAC,kBAAkB,EAAE,wBAAwB,UAAU,gBAAgB,8BAA8B,yCAAyC,CAAC,CAAC;QAC3K,IAAI,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC;YAAE,SAAS,CAAC,6CAA6C;QACzE,IAAI,GAAG,CAAC,IAAI,IAAI,GAAG;YACjB,MAAM,IAAI,eAAe,CAAC,qBAAqB,EAAE,oCAAoC,GAAG,6EAA6E,CAAC,CAAC;QACzK,MAAM,KAAK,GAAG,MAAM,UAAU,CAAC,qBAAqB,CAAC,GAAG,EAAE,GAAG,CAAC,EAAE,gBAAgB,GAAG,EAAE,CAAC,CAAC;QACvF,IAAI,KAAK,KAAK,SAAS;YACrB,MAAM,IAAI,eAAe,CAAC,qBAAqB,EAAE,mCAAmC,GAAG,2EAA2E,CAAC,CAAC;QACtK,UAAU,IAAI,KAAK,CAAC,MAAM,CAAC;QAC3B,IAAI,UAAU,GAAG,0BAA0B;YACzC,MAAM,IAAI,eAAe,CAAC,kBAAkB,EAAE,mBAAmB,UAAU,gBAAgB,0BAA0B,yBAAyB,CAAC,CAAC;QAClJ,GAAG,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;QACpB,MAAM,IAAI,GAAG,WAAW,CAAC,IAAI,UAAU,CAAC,KAAK,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC,0HAA0H;QAChL,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC;YACnE,MAAM,IAAI,eAAe,CAAC,UAAU,EAAE,iEAAiE,GAAG,4DAA4D,CAAC,CAAC;QAC1K,IAAI,IAAI,CAAC,MAAM,GAAG,8BAA8B;YAC9C,MAAM,IAAI,eAAe,CAAC,kBAAkB,EAAE,YAAY,GAAG,UAAU,IAAI,CAAC,MAAM,0BAA0B,8BAA8B,iFAAiF,CAAC,CAAC;QAC/N,IAAI,UAAU,EAAE,EAAE,8HAA8H;YAC9I,MAAM,IAAI,eAAe,CAAC,mBAAmB,EAAE,wBAAwB,UAAU,iBAAiB,QAAQ,sCAAsC,GAAG,mBAAmB,CAAC,CAAC;QAC1K,KAAK,MAAM,CAAC,IAAI,IAAI,EAAE,CAAC;YACrB,MAAM,IAAI,GAAG,gBAAgB,CAAC,CAAC,CAAC,CAAC;YACjC,IAAI,IAAI,KAAK,OAAO;gBAAE,aAAa,GAAG,IAAI,CAAC,CAAC,2CAA2C;YACvF,KAAK,CAAC,IAAI,CAAC,EAAE,GAAG,EAAE,IAAI,EAAE,KAAK,EAAE,KAAK,GAAG,CAAC,EAAE,CAAC,CAAC;QAC9C,CAAC;IACH,CAAC;IAED,wFAAwF;IACxF,wFAAwF;IACxF,gFAAgF;IAChF,MAAM,MAAM,GAAG,IAAI,GAAG,EAAU,CAAC;IACjC,KAAK,MAAM,GAAG,IAAI,GAAG,CAAC,IAAI,EAAE;QAAE,IAAI,GAAG,KAAK,OAAO,IAAI,aAAa;YAAE,MAAM,CAAC,GAAG,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC;IAC/F,MAAM,SAAS,GAAG,IAAI,GAAG,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;IAC5C,KAAK,MAAM,CAAC,IAAI,MAAM;QACpB,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC;YACnB,MAAM,IAAI,eAAe,CAAC,kBAAkB,EAAE,4BAA4B,CAAC,qBAAqB,UAAU,wEAAwE,CAAC,CAAC;IACxL,KAAK,MAAM,CAAC,IAAI,SAAS;QACvB,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC;YAChB,MAAM,IAAI,eAAe,CAAC,kBAAkB,EAAE,gBAAgB,UAAU,UAAU,CAAC,oFAAoF,CAAC,CAAC;IAC7K,OAAO,EAAE,QAAQ,EAAE,SAAS,EAAE,GAAG,EAAE,CAAC;AACtC,CAAC"}

package/dist/endpoint-envelope.d.ts

@@ -0,0 +1,165 @@
+/**
+ * v0.4 endpoint control-surface envelope (SPEC §13.3) — the versioned typed shapes riding the
+ * §13.2 rails (`EndpointRequest`/`EndpointReply`/`EndpointEvent`), the structured error catalog,
+ * W3C Trace Context correlation, and the consuming-boundary validators.
+ *
+ * Validation is FAIL-LOUD with the exact catalog code the spec assigns to each violation
+ * (`unsupported-version`, `bad-request`, `contract-mismatch`, `op-mismatch`, `target-mismatch`,
+ * `sender-mismatch`) so a rejecting boundary never invents a classification. Unknown object
+ * fields are ignored (§5); the parsers return a picked copy carrying exactly the defined fields,
+ * so nothing downstream can quietly grow a dependency on an undeclared one. Contract-schema
+ * validation of `args`/`data` is §13.7's job ({@link import("./schema-profile.js")}); the helpers
+ * here only map its outcome to the invocation-time code (`bad-request`, distinct from
+ * registration-time `contract-invalid`).
+ */
+import type { ValidateFunction } from "ajv/dist/2020.js";
+import { type ParsedEpRequest } from "./endpoint-subjects.js";
+import type { EndpointRef } from "./types.js";
+/** The envelope schema version — independent of the wire `protocolVersion`; starts at its own
+ *  v1 inside the v0.4 revision. Other values are rejected (`unsupported-version`). */
+export declare const EP_ENVELOPE_V = 1;
+/** The §13.3 error catalog. Extensions add codes only under reverse-DNS; any code (catalog or
+ *  extension) is one token of at most 64 bytes. */
+export declare const EP_ERROR_CODES: readonly ["bad-request", "unsupported-version", "op-mismatch", "class-mismatch", "target-mismatch", "sender-mismatch", "unauthenticated", "permission-denied", "not-found", "already-exists", "conflict", "contract-mismatch", "contract-invalid", "failed-precondition", "deadline-exceeded", "cancelled", "expired", "unavailable", "unimplemented", "resource-exhausted", "internal"];
+export type EpErrorCode = (typeof EP_ERROR_CODES)[number];
+/** True iff `code` is a catalog token or a reverse-DNS extension token within the 64-byte bound. */
+export declare function isEpErrorCode(code: string): boolean;
+/** One `details[]` entry: `kind` is reverse-DNS-namespaced (§13.3), the rest is open. */
+export interface EpErrorDetail {
+    kind: string;
+    [key: string]: unknown;
+}
+/** The `EndpointReply.error` shape. */
+export interface EpError {
+    code: string;
+    message: string;
+    details?: EpErrorDetail[];
+}
+/** A consuming-boundary rejection: the catalog code plus a human message. Boundaries convert it
+ *  to an `EndpointReply` error via {@link EpEnvelopeError.toEpError} (or, on reply-less planes,
+ *  to the §13.4 decision/quarantine fact carrying the same code). */
+export declare class EpEnvelopeError extends Error {
+    readonly code: EpErrorCode;
+    readonly details?: EpErrorDetail[] | undefined;
+    constructor(code: EpErrorCode, message: string, details?: EpErrorDetail[] | undefined);
+    toEpError(): EpError;
+}
+/** W3C Trace Context correlation slot, propagated to downstream calls, events, facts, receipts. */
+export interface EpCorrelation {
+    traceparent?: string;
+    tracestate?: string;
+    baggage?: string;
+}
+/** The invocation binding: endpoint + command MUST agree with the subject (`op-mismatch`); the
+ *  digests pin the described contract and are REQUIRED on every command except `describe`
+ *  (`contract-mismatch` when missing — a payload-free side pins the void schema's digest). */
+export interface EpOp {
+    endpoint: string;
+    command: string;
+    inputDigest?: string;
+    outputDigest?: string;
+}
+/** The body target block (§13.3): present exactly for the targeted modes, `owner` pinned to the
+ *  subject token; `actor`/`lifecycleUid` are validator-compared against the current mapping. */
+export interface EpTargetBlock {
+    owner: string;
+    actor: string;
+    lifecycleUid: string;
+    mappingRevision?: number;
+}
+/** A submission's declared delivery contract (`record` is a state contract, never a request
+ *  class; an action command's submissions are `journal`). */
+export type EpClass = "ephemeral" | "journal";
+export interface EndpointRequest {
+    v: typeof EP_ENVELOPE_V;
+    id: string;
+    op: EpOp;
+    class: EpClass;
+    /** The verb: `true` = call (reply expected, `deadlineMs` required), `false` = cast. The
+     *  subject shape is identical for both; the verb never changes the grammar. */
+    replyExpected: boolean;
+    /** MUST for a command whose contract declares the action composite (a contract-level rule the
+     *  serve machinery enforces with the contract in hand); shape-checked here when present. */
+    goalId?: string;
+    target?: EpTargetBlock;
+    /** The input payload: a JSON object, or explicit `null` — a canonical-void side's payload is
+     *  absent OR `null` (§13.7), so `null` must survive parsing for the command's own schema
+     *  validator to decide (an object-input contract still rejects it there, as `bad-request`). */
+    args?: Record<string, unknown> | null;
+    from: EndpointRef;
+    /** Caller deadline budget, bounded never unbounded: required for calls and for journal-class
+     *  submissions (there it is the decision deadline, §13.4). */
+    deadlineMs?: number;
+    correlation?: EpCorrelation;
+    /** Opaque signed authorization-context slot; identity never rides it. Its fingerprint binding
+     *  is {@link authDigest} over these bytes exactly as carried. */
+    auth?: string;
+}
+export interface EndpointReply {
+    v: typeof EP_ENVELOPE_V;
+    id: string;
+    ok: boolean;
+    data?: unknown;
+    error?: EpError;
+    /** Opaque signed receipt slot (§13.10). */
+    receipt?: string;
+}
+/** An event (incl. per-goal progress) on the `epe` plane. The publishing instance and epoch are
+ *  read from the SUBJECT (§13.2), never from payload fields. */
+export interface EndpointEvent {
+    v: typeof EP_ENVELOPE_V;
+    topic: string;
+    ts: number;
+    data: unknown;
+    correlation?: EpCorrelation;
+}
+/** `authDigest`: `sha256:<hex>` over the UTF-8 bytes of the `auth` slot EXACTLY as carried. The
+ *  slot is already a canonical signed artifact, so it is digested as bytes, never
+ *  re-canonicalized; absent from the §13.4 fingerprint iff `auth` is absent. A malformed-UTF-16
+ *  slot is refused (`bad-request`): a lone surrogate has no UTF-8 encoding, so its "digest"
+ *  would be over a substituted value and two distinct slots could share one fingerprint. */
+export declare function authDigest(auth: string): string;
+/** Shape-validate an incoming request envelope (the pre-subject half of the consuming boundary;
+ *  {@link checkRequestSubjectAgreement} is the other half). Throws {@link EpEnvelopeError} with
+ *  the exact catalog code; returns a picked copy with exactly the §13.3 fields. */
+export declare function parseEndpointRequest(raw: unknown): EndpointRequest;
+/** The body↔subject agreement half of the consuming boundary (§13.3): `op` MUST agree with the
+ *  subject (`op-mismatch`); the body target is ABSENT for `self`/untargeted forms (a supplied
+ *  one is `target-mismatch`, never ignored) and REQUIRED with a subject-equal owner (and, in
+ *  `handle` mode, subject-equal actor + lifecycleUid) for the targeted forms; `from.id` MUST
+ *  equal the subject sender principal (`sender-mismatch`). Currency of `target.actor`/
+ *  `target.lifecycleUid` against the live mapping is the handler's fresh-read (`expired`),
+ *  deliberately not checkable here. */
+export declare function checkRequestSubjectAgreement(env: EndpointRequest, subject: ParsedEpRequest): void;
+/** The contract-class agreement check (`class-mismatch`): the envelope's declared class MUST
+ *  equal the command's contract class. Split out because it needs the contract in hand. */
+export declare function assertClassMatches(env: EndpointRequest, declaredClass: EpClass): void;
+/** Shape-validate a reply at the caller's consuming boundary. `data` is schema-validated by the
+ *  caller against its PINNED output digest (§13.7), not here. */
+export declare function parseEndpointReply(raw: unknown): EndpointReply;
+/** Shape-validate an event at its consuming boundary (§13.3: every plane is runtime-validated).
+ *  The publishing instance and epoch come from the SUBJECT; payload claims are display data. */
+export declare function parseEndpointEvent(raw: unknown): EndpointEvent;
+/** Validate `args` against the command's compiled input schema BEFORE any effect: failure is the
+ *  invocation-time `bad-request` (registration-time violations are `contract-invalid`,
+ *  {@link import("./schema-profile.js").ContractInvalidError}). Against the void schema the
+ *  payload is absent or `null` (§13.7), so `undefined` args validate as `null` here and only
+ *  here; an explicit `null` passes through unchanged, and it is the SCHEMA (an object-typed
+ *  input contract) that rejects null for non-void commands. The §13.8 validation budget is the
+ *  PROFILE's fixed 10ms, read internally so no caller
+ *  can tune it away, and is enforced post-hoc, fail-loud as `bad-request` (the spec's
+ *  over-budget code for validate time, distinct from compile's `contract-invalid`). Post-hoc
+ *  measurement classifies, it cannot preempt — the pre-emptive defense is the registration-time
+ *  bounded-pattern gate (schema-profile), which keeps the exponential backtracking class out of
+ *  registered contracts in the first place. */
+export declare function assertArgsValid(validate: ValidateFunction, args: Record<string, unknown> | null | undefined): unknown;
+/** Validate an output payload against the command's compiled output schema at EITHER §13.7
+ *  boundary — the responder's, before the success publish, or the caller's, on the consumed
+ *  reply — the symmetric budgeted half of {@link assertArgsValid}, under the SAME fixed
+ *  §13.8 `validateBudgetMs` (read internally, never caller-tunable). Both failure classes are
+ *  structured `internal`: an invalid output is a responder bug (§13.3/§13.7) whichever side
+ *  detects it, and an over-budget output validation is the same bug class, never the caller's
+ *  `bad-request`. A void output is `undefined`, validated as `null` against the void schema,
+ *  mirroring the args side. */
+export declare function assertOutputValid(validate: ValidateFunction, data: unknown): void;
+//# sourceMappingURL=endpoint-envelope.d.ts.map

package/dist/endpoint-envelope.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"endpoint-envelope.d.ts","sourceRoot":"","sources":["../src/endpoint-envelope.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AACH,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,kBAAkB,CAAC;AAEzD,OAAO,EAA0E,KAAK,eAAe,EAAE,MAAM,wBAAwB,CAAC;AAEtI,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,YAAY,CAAC;AAE9C;sFACsF;AACtF,eAAO,MAAM,aAAa,IAAI,CAAC;AAI/B;mDACmD;AACnD,eAAO,MAAM,cAAc,0XAMhB,CAAC;AACZ,MAAM,MAAM,WAAW,GAAG,CAAC,OAAO,cAAc,CAAC,CAAC,MAAM,CAAC,CAAC;AAO1D,oGAAoG;AACpG,wBAAgB,aAAa,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAGnD;AAED,yFAAyF;AACzF,MAAM,WAAW,aAAa;IAC5B,IAAI,EAAE,MAAM,CAAC;IACb,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;CACxB;AAED,uCAAuC;AACvC,MAAM,WAAW,OAAO;IACtB,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;IAChB,OAAO,CAAC,EAAE,aAAa,EAAE,CAAC;CAC3B;AAED;;qEAEqE;AACrE,qBAAa,eAAgB,SAAQ,KAAK;IAC5B,QAAQ,CAAC,IAAI,EAAE,WAAW;IAAmB,QAAQ,CAAC,OAAO,CAAC,EAAE,aAAa,EAAE;gBAAtE,IAAI,EAAE,WAAW,EAAE,OAAO,EAAE,MAAM,EAAW,OAAO,CAAC,EAAE,aAAa,EAAE,YAAA;IAI3F,SAAS,IAAI,OAAO;CAGrB;AAQD,mGAAmG;AACnG,MAAM,WAAW,aAAa;IAC5B,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAED;;8FAE8F;AAC9F,MAAM,WAAW,IAAI;IACnB,QAAQ,EAAE,MAAM,CAAC;IACjB,OAAO,EAAE,MAAM,CAAC;IAChB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB;AAED;gGACgG;AAChG,MAAM,WAAW,aAAa;IAC5B,KAAK,EAAE,MAAM,CAAC;IACd,KAAK,EAAE,MAAM,CAAC;IACd,YAAY,EAAE,MAAM,CAAC;IACrB,eAAe,CAAC,EAAE,MAAM,CAAC;CAC1B;AAED;6DAC6D;AAC7D,MAAM,MAAM,OAAO,GAAG,WAAW,GAAG,SAAS,CAAC;AAE9C,MAAM,WAAW,eAAe;IAC9B,CAAC,EAAE,OAAO,aAAa,CAAC;IACxB,EAAE,EAAE,MAAM,CAAC;IACX,EAAE,EAAE,IAAI,CAAC;IACT,KAAK,EAAE,OAAO,CAAC;IACf;mFAC+E;IAC/E,aAAa,EAAE,OAAO,CAAC;IACvB;gGAC4F;IAC5F,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,MAAM,CAAC,EAAE,aAAa,CAAC;IACvB;;mGAE+F;IAC/F,IAAI,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,CAAC;IACtC,IAAI,EAAE,WAAW,CAAC;IAClB;kEAC8D;IAC9D,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,WAAW,CAAC,EAAE,aAAa,CAAC;IAC5B;qEACiE;IACjE,IAAI,CAAC,EAAE,MAAM,CAAC;CACf;AAED,MAAM,WAAW,aAAa;IAC5B,CAAC,EAAE,OAAO,aAAa,CAAC;IACxB,EAAE,EAAE,MAAM,CAAC;IACX,EAAE,EAAE,OAAO,CAAC;IACZ,IAAI,CAAC,EAAE,OAAO,CAAC;IACf,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB,2CAA2C;IAC3C,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAED;gEACgE;AAChE,MAAM,WAAW,aAAa;IAC5B,CAAC,EAAE,OAAO,aAAa,CAAC;IACxB,KAAK,EAAE,MAAM,CAAC;IACd,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,OAAO,CAAC;IACd,WAAW,CAAC,EAAE,aAAa,CAAC;CAC7B;AAID;;;;4FAI4F;AAC5F,wBAAgB,UAAU,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAI/C;AA8ED;;mFAEmF;AACnF,wBAAgB,oBAAoB,CAAC,GAAG,EAAE,OAAO,GAAG,eAAe,CA4ElE;AAED;;;;;;uCAMuC;AACvC,wBAAgB,4BAA4B,CAAC,GAAG,EAAE,eAAe,EAAE,OAAO,EAAE,eAAe,GAAG,IAAI,CA0BjG;AAED;2FAC2F;AAC3F,wBAAgB,kBAAkB,CAAC,GAAG,EAAE,eAAe,EAAE,aAAa,EAAE,OAAO,GAAG,IAAI,CAGrF;AAoBD;iEACiE;AACjE,wBAAgB,kBAAkB,CAAC,GAAG,EAAE,OAAO,GAAG,aAAa,CAe9D;AAED;gGACgG;AAChG,wBAAgB,kBAAkB,CAAC,GAAG,EAAE,OAAO,GAAG,aAAa,CAS9D;AAID;;;;;;;;;;;+CAW+C;AAC/C,wBAAgB,eAAe,CAAC,QAAQ,EAAE,gBAAgB,EAAE,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,GAAG,SAAS,GAAG,OAAO,CAYrH;AAED;;;;;;;+BAO+B;AAC/B,wBAAgB,iBAAiB,CAAC,QAAQ,EAAE,gBAAgB,EAAE,IAAI,EAAE,OAAO,GAAG,IAAI,CAWjF"}