@cruba/crubal-host 0.0.0-stage → 0.2.0

package/dist/src/host.js

@@ -0,0 +1,808 @@
+// host.ts: the reference host (docs/design/host.md). It does what the spec hands the host and nothing a
+// business requires: who a caller is, secrets by name, acting through adapters, the clock, signing, package
+// install, the loops. It owns no model: everything goes through PgStore and PgBorder.
+import { createHash, createPrivateKey, generateKeyPairSync, randomBytes, sign as edSign } from "node:crypto";
+import { ChainedSecrets, EnvSecrets, FunctionSecrets } from "./secrets.js";
+import { readBundle, restamp, verifyBorder, versionGate } from "@cruba/crubal";
+import { Access } from "@cruba/crubal";
+import { readFileSync } from "node:fs";
+import { keyFor, publish } from "@cruba/crubal";
+import { PgBorder, borderOptions } from "@cruba/crubal-postgres";
+import { migrate as migrateStore, transaction } from "@cruba/crubal-postgres";
+import { PgStore } from "@cruba/crubal-postgres";
+import { Credentials, secretsKeyFrom } from "./credentials.js";
+import { verifyRequest, signRequest } from "./signatures.js";
+const SCHEMA_SQL = readFileSync(new URL("./schema.sql", import.meta.url), "utf8");
+export const hashKey = (key) => createHash("sha256").update(key).digest("hex");
+export class Host {
+    pool;
+    o;
+    credentials;
+    constructor(pool, o) {
+        this.pool = pool;
+        this.o = o;
+        this.credentials = new Credentials(pool, () => this.now(), secretsKeyFrom(o.secretsKey ?? process.env.CRUBAL_SECRETS_KEY));
+    }
+    now() {
+        return this.o.now ? this.o.now() : new Date().toISOString().replace(/\.\d{3}Z$/, "Z");
+    }
+    /** The store's tables and the host's. */
+    async migrate() {
+        await transaction(this.pool, async (c) => {
+            await migrateStore(c);
+            await c.query(SCHEMA_SQL);
+        });
+        // Rows stored before sealing existed are sealed once the key is at hand.
+        await this.credentials.sealAll();
+    }
+    // ─── Connections (docs/design/host.md, "Credentials"; Cashierfu brief 4) ────
+    /**
+     * Connect a service for an owner: the material sealed in the credentials store, and a `system` record of
+     * the fact within the owner's root record, written as the host's action naming the person. The person,
+     * when given, must hold admin on the root or the `connections` item; the owner's own key needs none.
+     */
+    async connect(owner, name, c) {
+        const store = await this.storeFor(owner);
+        if (c.person)
+            await this.requireConnections(store, owner, c.person);
+        const connection = await this.credentials.connect(owner, name, c.scheme, c.material, c.scopes ?? [], c.expires);
+        const record = await this.writeSystem(store, owner, name, { scheme: c.scheme, scopes: c.scopes ?? [], connection: "connected", connectedAt: this.now().slice(0, 16).replace("T", " "), ...(c.values ?? {}) }, c.person);
+        return { connection, record };
+    }
+    /** Revoke a connection: the material gone, the record marked revoked. */
+    async disconnect(owner, name, person) {
+        const store = await this.storeFor(owner);
+        if (person)
+            await this.requireConnections(store, owner, person);
+        await this.credentials.disconnect(owner, name);
+        const existing = await this.systemFor(store, name);
+        if (!existing)
+            return {};
+        const record = await this.writeSystem(store, owner, name, { connection: "revoked" }, person);
+        return { record };
+    }
+    /** Is a service connected for the owner: material held and not expired, and the record not revoked? */
+    async connected(owner, name) {
+        const c = await this.credentials.connection(owner, name);
+        if (!c || c.status !== "connected")
+            return false;
+        const r = await this.systemFor(await this.storeFor(owner), name);
+        return r?.values.connection !== "revoked";
+    }
+    async requireConnections(store, owner, person) {
+        const [p, state] = await Promise.all([store.definitions(), store.state()]);
+        const access = new Access(p.dict, p.perms, state.records, [...state.edges.values()], owner);
+        const eff = access.effective(person, this.o.rootRecord ?? "ROOT");
+        if (eff.mode !== "admin" && !eff.items.has("connections"))
+            throw Object.assign(new Error(`${person} may not manage ${owner}'s connections`), { status: 403 });
+    }
+    async systemFor(store, name) {
+        return (await store.state()).records.all().find((r) => r.kind === "system" && r.values.name === name);
+    }
+    /** The system record for a service, within ROOT, made or updated; the host's action names the person. */
+    async writeSystem(store, owner, name, values, person) {
+        const state = await store.state();
+        const existing = state.records.all().find((r) => r.kind === "system" && r.values.name === name);
+        const n = state.records.all().filter((r) => /^S-\d+$/.test(r.id)).map((r) => Number(r.id.slice(2))).reduce((a, b) => Math.max(a, b), 0);
+        const id = existing?.id ?? `S-${n + 1}`;
+        const at = this.now();
+        await store.commit({ platform: "connection", ...(person ? { person } : {}) }, (d) => {
+            const root = this.o.rootRecord ?? "ROOT";
+            const base = existing ?? { id, kind: "system", level: "system", owner, ...(state.records.get(root) ? { within: root } : {}), values: { name, systemKind: "partner" }, sources: { "*": { origin: "observed", via: "host" } } };
+            const sources = { ...(base.sources ?? {}) };
+            for (const k of Object.keys(values))
+                if (!sources[k])
+                    sources[k] = { origin: "observed", via: "host" };
+            d.records.set(id, { ...base, values: { ...base.values, ...values }, sources });
+        }, at);
+        return id;
+    }
+    // ─── Owners and keys ───────────────────────────────────────────────────────
+    /** Make an owner: a domain or a hosted person, with an Ed25519 key the host signs its chain with. */
+    async createOwner(owner) {
+        const { privateKey, publicKey } = generateKeyPairSync("ed25519");
+        const pub = publicKey.export({ format: "jwk" }).x;
+        const priv = privateKey.export({ format: "jwk" }).d;
+        await this.pool.query("insert into host_owners (owner, public, private, created) values ($1, $2, $3, $4) on conflict (owner) do nothing", [owner, pub, priv, this.now()]);
+        const { rows } = await this.pool.query("select public from host_owners where owner = $1", [owner]);
+        return { owner, public: String(rows[0].public) };
+    }
+    /**
+     * Rotate an owner's key (8.5, 11.7): a new key signs from now; the well-known file lists the old with
+     * `until` and the new with `from`, so the chain verifies across the rotation.
+     */
+    async rotateKey(owner, now = this.now()) {
+        this.forgetStore(owner);
+        const old = await this.keyOf(owner);
+        if (!old)
+            throw new Error(`${owner} has no key to rotate`);
+        const { rows } = await this.pool.query("select created from host_owners where owner = $1", [owner]);
+        const since = (await this.pool.query("select max(until) as until from host_keys where owner = $1", [owner])).rows[0];
+        await this.pool.query("insert into host_keys (owner, public, \"from\", until) values ($1, $2, $3, $4) on conflict do nothing", [owner, old.public, since.until ?? String(rows[0].created), now]);
+        const { privateKey, publicKey } = generateKeyPairSync("ed25519");
+        const pub = publicKey.export({ format: "jwk" }).x;
+        const priv = privateKey.export({ format: "jwk" }).d;
+        await this.pool.query("update host_owners set public = $2, private = $3, created = $4 where owner = $1", [owner, pub, priv, now]);
+        return { owner, public: pub, retired: old.public };
+    }
+    /** The signer for a hosted person (14.1): their key, made on first use. */
+    async hostedSigner(owner) {
+        await this.createOwner(owner);
+        const key = await this.keyOf(owner);
+        return key ? (hash) => edSign(null, Buffer.from(hash, "hex"), createPrivateKey({ key: { kty: "OKP", crv: "Ed25519", x: key.public, d: key.private }, format: "jwk" })).toString("base64url") : undefined;
+    }
+    async owners() {
+        return (await this.pool.query("select owner, public from host_owners order by created")).rows;
+    }
+    async keyOf(owner) {
+        const { rows } = await this.pool.query("select public, private from host_owners where owner = $1", [owner]);
+        const r = rows[0];
+        return r?.private ? { public: r.public, private: r.private } : undefined;
+    }
+    /** Issue an API key for a caller of an owner; the raw key is returned once and only its hash is kept. */
+    async issueKey(owner, caller, label) {
+        const raw = `ck_${randomBytes(24).toString("base64url")}`;
+        await this.pool.query("insert into host_api_keys (key_hash, owner, caller, label, created) values ($1, $2, $3, $4, $5)", [hashKey(raw), owner, caller, label ?? null, this.now()]);
+        return raw;
+    }
+    async revokeKey(raw) {
+        await this.pool.query("delete from host_api_keys where key_hash = $1", [hashKey(raw)]);
+    }
+    /** Link an identity provider's subject to a caller, for the OIDC verifier. */
+    async linkIdentity(provider, subject, owner, caller) {
+        await this.pool.query("insert into host_identities (provider, subject, owner, caller) values ($1, $2, $3, $4) on conflict (provider, subject) do update set owner = excluded.owner, caller = excluded.caller", [provider, subject, owner, caller]);
+    }
+    /** Remove an identity link (a person deleting themselves): the subject signs in as nobody from now on. */
+    async unlinkIdentity(provider, subject) {
+        const r = await this.pool.query("delete from host_identities where provider = $1 and subject = $2", [provider, subject]);
+        return (r.rowCount ?? 0) > 0;
+    }
+    /** Every identity link that names a caller, for export and delete. */
+    async identitiesOf(owner, caller) {
+        const { rows } = await this.pool.query("select provider, subject from host_identities where owner = $1 and caller = $2", [owner, caller]);
+        return rows;
+    }
+    async identity(provider, subject) {
+        const { rows } = await this.pool.query("select owner, caller from host_identities where provider = $1 and subject = $2", [provider, subject]);
+        return rows[0] ?? null;
+    }
+    /**
+     * Who is calling when the request is signed by another owner (RFC 9421 with its domain key): the signer's
+     * domain, as a caller of the owner addressed. The signer's key comes from its well-known file.
+     */
+    async whoSigned(owner, req) {
+        const v = await verifyRequest({ ...req, publicX: async (keyid) => keyFor(await this.resolveKeys(keyid), keyid, this.now())?.public, now: Math.floor(Date.parse(this.now()) / 1000) });
+        // The signing owner acts as the caller `domain:owner`: a caller of that domain (14.1), never a bare ID here.
+        return v ? { owner, caller: `${v.keyid}:owner`, via: "signature" } : null;
+    }
+    /** Who is calling: an API key, a token a verifier knows, or nobody. The store sees only the caller ID. */
+    async whoIs(authorization) {
+        if (!authorization)
+            return null;
+        const token = authorization.replace(/^Bearer\s+/i, "").trim();
+        if (token.startsWith("ck_")) {
+            const { rows } = await this.pool.query("select owner, caller from host_api_keys where key_hash = $1", [hashKey(token)]);
+            const c = rows[0];
+            return c ? { owner: c.owner, caller: c.caller, via: "key" } : null;
+        }
+        for (const v of this.o.verifiers ?? []) {
+            const c = await v(token);
+            if (c)
+                return { ...c, via: c.via ?? "identity" };
+        }
+        return null;
+    }
+    /** Does this host hold the owner (a domain, or a hosted person `domain:id`)? */
+    async hosts(owner) {
+        const { rows } = await this.pool.query("select 1 from host_owners where owner = $1", [owner]);
+        return rows.length > 0;
+    }
+    /**
+     * The caller as an owner on this host sees them (14.8): their own ID at the owner that hosts them, or
+     * themselves as that owner when they address their own chain; elsewhere on the host, a person proven by
+     * identity is `person:<domain:id>`, vouched for without a signature; a system or a stranger is nobody.
+     */
+    async callerFor(owner, who) {
+        if (!who)
+            return undefined;
+        if (who.owner === owner)
+            return who.caller;
+        const at = owner.indexOf(":");
+        if (at > 0 && who.owner === owner.slice(0, at) && who.caller === owner.slice(at + 1))
+            return owner;
+        if (who.via === "identity" && (await this.hosts(who.owner)))
+            return `person:${who.owner}:${who.caller}`;
+        return undefined;
+    }
+    // ─── Acting for a person (14.9) ────────────────────────────────────────────
+    /** A person lets a system act for them: narrowed to items, until a moment, gated until they lift it. */
+    async allowActing(person, systemOwner, system, o = {}) {
+        const { rows } = await this.pool.query("insert into host_acting_for (system_owner, system, person, items, until, gated, created) values ($1, $2, $3, $4, $5, $6, $7) returning id", [systemOwner, system, person, o.items ?? [], o.until ?? null, o.gated ?? true, this.now()]);
+        return { id: Number(rows[0].id), systemOwner, system, person, items: o.items ?? [], ...(o.until ? { until: o.until } : {}), gated: o.gated ?? true, created: this.now() };
+    }
+    /** The person revokes it: nothing is deleted, the row keeps when. */
+    async revokeActing(person, id) {
+        const r = await this.pool.query("update host_acting_for set revoked = $3 where person = $1 and id = $2 and revoked is null", [person, id, this.now()]);
+        return (r.rowCount ?? 0) > 0;
+    }
+    async actingFor(person) {
+        const { rows } = await this.pool.query("select id, system_owner, system, person, items, until, gated, created, revoked from host_acting_for where person = $1 order by id", [person]);
+        return rows.map((r) => ({ id: Number(r.id), systemOwner: r.system_owner, system: r.system, person: r.person, items: r.items, ...(r.until ? { until: r.until } : {}), gated: r.gated, created: r.created, ...(r.revoked ? { revoked: r.revoked } : {}) }));
+    }
+    /** The live permission for this system to act for this person now, or none. */
+    async mayActFor(who, person, now = this.now()) {
+        if (who.via !== "key")
+            return null;
+        const live = (await this.actingFor(person)).filter((a) => a.systemOwner === who.owner && a.system === who.caller && !a.revoked && (!a.until || a.until > now));
+        return live.at(-1) ?? null;
+    }
+    // ─── The platform index (14.8, docs/design/host.md) ───────────────────────
+    /**
+     * Every live edge a caller holds across every owner on this host, grouped by owner: who they are to
+     * each. A hosted person is named by their bare ID at home and `person:<domain:id>` elsewhere.
+     */
+    async whoami(who, now = this.now()) {
+        const names = [who.caller, `person:${who.owner}:${who.caller}`];
+        const { rows } = await this.pool.query("select owner, json from edges where json->>'who' = any($1) order by owner, ord", [names]);
+        const byOwner = {};
+        for (const r of rows) {
+            const e = r.json;
+            // Lapsed edges don't count (14.4); whether the grantor still stands is the owner's border's call at the write.
+            if (typeof e.until === "string" && e.until <= now)
+                continue;
+            if (r.owner !== who.owner && e.who === who.caller)
+                continue; // a bare ID at another owner is someone else
+            const list = byOwner[r.owner] ?? (byOwner[r.owner] = []);
+            list.push({ edge: e.edge, relation: e.relation, mode: e.mode, on: e.on, ...(Array.isArray(e.grants) && e.grants.length ? { grants: e.grants } : {}), ...(typeof e.until === "string" ? { until: e.until } : {}), ...(e.gate ? { gate: e.gate } : {}) });
+        }
+        const owners = {};
+        for (const [owner, edges] of Object.entries(byOwner)) {
+            const modes = ["none", "view", "consume", "control", "admin"];
+            const mode = edges.map((e) => String(e.mode)).sort((a, b) => modes.indexOf(b) - modes.indexOf(a))[0] ?? "none";
+            owners[owner] = { mode, relations: [...new Set(edges.map((e) => String(e.relation)))], grants: [...new Set(edges.flatMap((e) => e.grants ?? []))], edges };
+        }
+        return { caller: who.caller, home: who.owner, owners };
+    }
+    /**
+     * The rows the caller stands in a relation to, across every owner on this host (14.10, 12.6): the index
+     * rows whose record, or an ancestor, is a live edge of theirs with that relation. The feed's primitive.
+     */
+    async rowsFor(who, relation, o = {}) {
+        const me = await this.whoami(who, o.now);
+        const ons = [];
+        for (const [owner, v] of Object.entries(me.owners))
+            for (const e of v.edges)
+                if (e.relation === relation)
+                    ons.push({ owner, on: String(e.on) });
+        if (!ons.length)
+            return [];
+        const owners = [...new Set(ons.map((x) => x.owner))];
+        const targets = [...new Set(ons.map((x) => x.on))];
+        const params = [owners, targets];
+        let where = "owner = any($1) and (record = any($2) or ancestors && $2::text[])";
+        if (o.view) {
+            params.push(o.view);
+            where += ` and view = $${params.length}`;
+        }
+        params.push(o.limit ?? 100);
+        const { rows } = await this.pool.query(`select owner, view, record, row from index_rows where ${where} order by seq desc limit $${params.length}`, params);
+        // Only rows an edge of that owner covers: the same record or one of its ancestors.
+        return rows.map((r) => ({ owner: r.owner, view: r.view, record: r.record, row: r.row }));
+    }
+    // ─── Secrets ───────────────────────────────────────────────────────────────
+    /** A credential's secret: connected under the name (refreshed when OAuth and expired), a configured source, or the environment. */
+    async secret(owner, name) {
+        const connected = await this.credentials.secret(owner, name, this.o.oauth?.[name]);
+        if (connected !== undefined)
+            return connected;
+        const store = this.o.secretStore ?? new ChainedSecrets([...(this.o.secrets ? [new FunctionSecrets(this.o.secrets)] : []), new EnvSecrets()]);
+        return store.get(owner, name);
+    }
+    /** Health (docs/design/completion.md O): the database reachable, and every owner's chain head. */
+    async health() {
+        try {
+            await this.pool.query("select 1");
+        }
+        catch (e) {
+            return { ok: false, database: e instanceof Error ? e.message : String(e) };
+        }
+        const chains = (await this.pool.query("select owner, chain, head_seq from chains order by owner, chain")).rows;
+        const heads = {};
+        for (const c of chains)
+            heads[c.chain === "main" ? c.owner : `${c.owner}/${c.chain}`] = Number(c.head_seq);
+        return { ok: true, domain: this.o.domain, now: this.now(), chains: heads };
+    }
+    // ─── Stores and borders ────────────────────────────────────────────────────
+    /** An owner's store, signing with the owner's key when the host holds one. */
+    /** One store per owner for the life of the host, so its definitions and state caches outlive a call (G6). */
+    async storeFor(owner) {
+        const had = this.stores.get(owner);
+        if (had)
+            return had;
+        const key = await this.keyOf(owner);
+        const signer = key ? (hash) => edSign(null, Buffer.from(hash, "hex"), createPrivateKey({ key: { kty: "OKP", crv: "Ed25519", x: key.public, d: key.private }, format: "jwk" })).toString("base64url") : undefined;
+        const store = new PgStore(this.pool, owner, { ...(signer ? { signer } : {}), hostedSigner: (o) => this.hostedSigner(o), ...(this.o.fresh ? { fresh: this.o.fresh } : {}), ...(this.o.allowUnsigned ? { allowUnsigned: true } : {}) });
+        if (key)
+            this.stores.set(owner, store);
+        return store;
+    }
+    stores = new Map();
+    /** Drop an owner's kept store: after a key rotation (its signer changes) or a rewrite of its history. */
+    forgetStore(owner) {
+        this.stores.delete(owner);
+    }
+    /**
+     * The built-in `http` adapter: a contract with the host's part `host:url` is POSTed its payload as JSON,
+     * with the credential the contract names resolved to a secret and sent as its `auth` scheme says.
+     */
+    httpAdapter(owner) {
+        return async (c, payload) => {
+            const url = c.parts["host:url"];
+            if (!url)
+                return { acted: true };
+            const headers = { "content-type": "application/json" };
+            const credential = c.parts.credential ? await this.secret(owner, c.parts.credential) : undefined;
+            if (c.parts.credential && credential === undefined)
+                return { failed: `credential: no secret for ${c.parts.credential}` };
+            if (credential && (c.parts.auth === "apikey" || c.parts.auth === "oauth2"))
+                headers.authorization = `Bearer ${credential}`;
+            if (credential && c.parts.auth === "basic")
+                headers.authorization = `Basic ${Buffer.from(credential).toString("base64")}`;
+            const res = await fetch(url, { method: c.parts["host:method"] ?? "POST", headers, body: JSON.stringify(payload) });
+            if (res.status === 401 || res.status === 403)
+                return { failed: `credential: ${res.status}` };
+            if (!res.ok)
+                return { failed: `http ${res.status}` };
+            const body = await res.text();
+            return { acted: true, ...(body ? { body } : {}) };
+        };
+    }
+    // ─── Between owners (7.8, 12.6.2) ─────────────────────────────────────────
+    /** Another owner's host, by domain. */
+    hostOf(domain) {
+        return this.o.hostOf ? this.o.hostOf(domain) : `https://${domain}`;
+    }
+    /** A request to another owner's host, signed with this owner's domain key (RFC 9421). */
+    async signedFetch(owner, method, url, body) {
+        const key = await this.keyOf(owner);
+        if (!key)
+            throw new Error(`${owner} has no key to sign with`);
+        const headers = signRequest({ method, url, ...(body !== undefined ? { body } : {}), keyid: owner, privateD: key.private, publicX: key.public, created: Math.floor(Date.parse(this.now()) / 1000) });
+        return fetch(url, { method, headers: { ...headers, ...(body !== undefined ? { "content-type": "application/json" } : {}) }, ...(body !== undefined ? { body } : {}) });
+    }
+    /** May this caller read an offer (7.8 `to`)? Public to anyone; link by token; followers and named parties by edge or signature. */
+    async mayTake(owner, c, callerId, link) {
+        const to = (c.to ?? "private").split(",").map((s) => s.trim()).filter(Boolean);
+        if (callerId === owner)
+            return true;
+        if (to.includes("public"))
+            return true;
+        if (to.includes("link") && link) {
+            const { rows } = await this.pool.query("select 1 from host_offer_links where owner = $1 and contract = $2 and token = $3 and not revoked", [owner, c.name, link]);
+            return rows.length > 0;
+        }
+        if (!callerId)
+            return false;
+        const domain = callerId.replace(/:owner$/, "");
+        if (to.some((p) => p !== "public" && p !== "link" && p !== "followers" && p !== "private" && (p === domain || p === callerId)))
+            return true;
+        if (to.includes("followers")) {
+            const store = await this.storeFor(owner);
+            const edges = [...(await store.state()).edges.values()];
+            return edges.some((e) => (e.who === callerId || e.who === domain) && /^follow/.test(String(e.relation)));
+        }
+        return false;
+    }
+    /** Publish an offer by link (7.8): the token, minted once and kept across republishing. */
+    async offerLink(owner, contract) {
+        const { rows } = await this.pool.query("select token from host_offer_links where owner = $1 and contract = $2", [owner, contract]);
+        if (rows[0]) {
+            await this.pool.query("update host_offer_links set revoked = false where owner = $1 and contract = $2", [owner, contract]);
+            return String(rows[0].token);
+        }
+        const token = randomBytes(24).toString("base64url");
+        await this.pool.query("insert into host_offer_links (owner, contract, token) values ($1, $2, $3)", [owner, contract, token]);
+        return token;
+    }
+    /** Unpublish a link offer: the token stops working, nothing is deleted. */
+    async unpublishOffer(owner, contract) {
+        await this.pool.query("update host_offer_links set revoked = true where owner = $1 and contract = $2", [owner, contract]);
+    }
+    /**
+     * A take across hosts (7.8, 8.5.1): fetch the presenter's offer with a signed request, verify the wrapper
+     * against the presenter's keys, then take each offered record into ours: the one bound to it, or a new
+     * record bound from now on. Each take is one entry naming the presenter's.
+     */
+    async take(owner, takeName, at = this.now()) {
+        const store = await this.storeFor(owner);
+        const border = await this.borderFor(owner, store);
+        const t = border.contracts.get(takeName);
+        if (!t || t.kind !== "take")
+            throw new Error(`no take contract ${takeName}`);
+        const from = t.from;
+        if (!from)
+            throw new Error(`${takeName} names no presenter (from)`);
+        const offerName = t.parts.offer;
+        const names = offerName ? [offerName] : (await (await this.signedFetch(owner, "GET", `${this.hostOf(from)}/o/${from}/offer`)).json()).offers?.filter((o) => o.gives.some((g) => t.reads.some((m) => m.from === g))).map((o) => String(o.contract)) ?? [];
+        const taken = [];
+        for (const name of names) {
+            const res = await this.signedFetch(owner, "GET", `${this.hostOf(from)}/o/${from}/offer/${name}`);
+            if (!res.ok) {
+                taken.push({ offer: name, stopped: `http ${res.status}` });
+                continue;
+            }
+            const offer = (await res.json());
+            const verified = verifyBorder({ records: offer.records, ...(offer.log ? { log: offer.log } : {}) }, await this.resolveKeys(from));
+            if (verified.verified !== true) {
+                taken.push({ offer: name, stopped: "unverified", ...verified });
+                continue;
+            }
+            // The version gate (10.1): newer than ours is held until we upgrade; older is restamped through the recipes between.
+            const gate = versionGate(offer.package, (await store.state()).installed.map((i) => ({ package: String(i.package), version: String(i.version) })));
+            if (gate.kind === "hold") {
+                const key = `version:${gate.package}`;
+                const open = (await store.review()).some((it) => it.key === key && it.from === from && it.offer === name);
+                if (!open)
+                    await store.commit({ take: takeName, from }, (d) => { d.review.push({ key, from, offer: name, package: gate.package, theirs: gate.theirs, ours: gate.ours, reason: `written under ${gate.package} /${gate.theirs}; this store holds /${gate.ours}` }); }, at);
+                taken.push({ offer: name, stopped: "version", package: gate.package, theirs: gate.theirs, ours: gate.ours });
+                continue;
+            }
+            if (gate.kind === "restamp") {
+                const rows = (await this.pool.query("select version, json from bundles where owner = $1 and package = $2 and version > $3 and version <= $4 order by version", [owner, gate.package, gate.theirs, gate.ours])).rows;
+                const defs = await store.definitions();
+                for (const row of rows)
+                    for (const r of readBundle(row.json).recipes)
+                        offer.records = restamp(offer.records, r, defs.dict).records;
+            }
+            for (const presenter of offer.records) {
+                const key = `take|${from}|${presenter.id}`;
+                let recordId = (await store.state()).bindings.get(key);
+                if (!recordId) {
+                    // A record of ours for theirs: minted empty, bound by the presenter's id from now on.
+                    const n = (await this.pool.query("select count(*) as n from bindings where owner = $1 and key like 'take|%'", [owner])).rows[0];
+                    recordId = `T-${Number(n.n) + 1}`;
+                    const id = recordId;
+                    await store.commit({ take: takeName, from }, (d) => {
+                        d.records.set(id, { id, kind: presenter.kind, level: presenter.level, owner, values: {}, sources: {} });
+                        d.bindings.set(key, id);
+                    }, at);
+                }
+                const r = await border.take(takeName, offer, recordId, presenter, undefined, at);
+                taken.push({ offer: name, presenter: presenter.id, record: recordId, ...r });
+            }
+        }
+        return { contract: takeName, from, taken };
+    }
+    /**
+     * Push streams (12.6.2): every stream contract with `when: entry` sends its entries since the cursor to
+     * the party it names (its adapter, else a signed POST to that host's inbox), and the acknowledgement
+     * moves the cursor.
+     */
+    async push(now = this.now(), owner) {
+        const out = [];
+        for (const o of owner ? [{ owner }] : await this.owners()) {
+            const store = await this.storeFor(o.owner);
+            const border = await this.borderFor(o.owner, store);
+            for (const c of border.contracts.values()) {
+                if (!c.stream.length || c.when !== "entry")
+                    continue;
+                const r = await border.streamRun(c.name, undefined, undefined, now);
+                const entries = (r.entries ?? {});
+                if (!Object.values(entries).some((l) => l.length))
+                    continue;
+                const adapter = this.o.adapters?.[c.name];
+                const payload = { contract: c.name, from: o.owner, entries: entries };
+                let acted = false;
+                let failed;
+                if (adapter) {
+                    const a = await adapter(c, payload, String(r.log ?? ""));
+                    acted = "acted" in a && a.acted === true;
+                    if ("failed" in a)
+                        failed = a.failed;
+                }
+                else {
+                    const url = c.parts["host:url"] ?? (c.to ? `${this.hostOf(c.to)}/o/${c.to}/inbox/${c.name}` : undefined);
+                    if (!url) {
+                        failed = "nowhere to push: no to and no host:url";
+                    }
+                    else {
+                        const res = await this.signedFetch(o.owner, "POST", url, JSON.stringify(payload));
+                        acted = res.ok;
+                        if (!res.ok)
+                            failed = `http ${res.status}`;
+                    }
+                }
+                if (acted)
+                    await border.ack(c.name, r.cursor);
+                out.push({ owner: o.owner, contract: c.name, ...(acted ? { acted: true, cursor: r.cursor } : { failed: failed ?? "not acted" }) });
+            }
+        }
+        return out;
+    }
+    /** Taken values past their terms (7.8), for every owner or one. */
+    async expire(now = this.now(), owner) {
+        const out = [];
+        for (const o of owner ? [{ owner }] : await this.owners()) {
+            const border = await this.borderFor(o.owner);
+            const ids = await border.expire(now, now);
+            if (ids.length)
+                out.push({ owner: o.owner, expired: ids });
+        }
+        return out;
+    }
+    /** An owner's border over its own definitions, with the adapters. */
+    async borderFor(owner, store) {
+        const s = store ?? (await this.storeFor(owner));
+        const o = { ...(await borderOptions(s)), ...(this.o.idPrefixes ? { idPrefixes: this.o.idPrefixes } : {}) };
+        const http = this.httpAdapter(owner);
+        const adapters = {};
+        for (const c of o.contracts)
+            if (c.kind === "send" || c.kind === "form")
+                adapters[c.name] = this.o.adapters?.[c.name] ?? http;
+        return new PgBorder(s, { ...o, adapters });
+    }
+    // ─── Packages ──────────────────────────────────────────────────────────────
+    async resolveKeys(domain) {
+        if (this.o.resolveKeys)
+            return this.o.resolveKeys(domain);
+        const res = await fetch(`https://${domain}/.well-known/crubal.json`);
+        if (!res.ok)
+            throw new Error(`${domain}: no well-known file (${res.status})`);
+        const j = (await res.json());
+        return j.keys ?? {};
+    }
+    /**
+     * Install into one owner what another owner on this host already holds (brief 1: a person's chain takes
+     * the person package from the platform's own log): the bundle and what it extends, in order, each skipped
+     * when the target already has that version. The source's bundles were verified when it installed them.
+     */
+    async installFromOwner(target, source, pkg, version, at = this.now()) {
+        const have = (await (await this.storeFor(target)).state()).installed.map((i) => `${i.package} /${i.version}`);
+        const rows = (await this.pool.query("select package, version, json from bundles where owner = $1", [source])).rows;
+        const find = (id, v) => {
+            const mine = rows.filter((r) => r.package === id || r.package === id.split("/").pop());
+            const pick = v ? mine.find((r) => r.version === v) : mine.sort((a, b) => (a.version < b.version ? 1 : -1))[0];
+            if (!pick)
+                throw new Error(`${source} holds no ${id}${v ? ` /${v}` : ""} to install into ${target}`);
+            return pick;
+        };
+        const out = [];
+        const store = await this.storeFor(target);
+        const seen = new Set();
+        const put = async (id, v) => {
+            const b = find(id, v);
+            const key = `${b.json.id} /${b.version}`;
+            if (seen.has(key))
+                return;
+            seen.add(key);
+            for (const e of b.json.extends ?? []) {
+                const dep = String(e.package).includes("/") ? String(e.package) : `${b.json.owner}/${e.package}`;
+                await put(dep, String(e.version));
+            }
+            if (have.includes(key))
+                return;
+            const entry = await store.install(b.json, undefined, at);
+            out.push({ installed: String(b.json.id), version: b.version, entry: String(entry.log) });
+        };
+        await put(pkg, version);
+        return out;
+    }
+    /** Install a published version for an owner: the publisher's keys from its well-known file, then the store. */
+    async install(owner, bundle) {
+        const store = await this.storeFor(owner);
+        const keys = bundle.sig ? await this.resolveKeys(String(bundle.owner)) : undefined;
+        const entry = await store.install(bundle, keys, this.now());
+        return { installed: String(bundle.id), version: String(bundle.version), entry: String(entry.log) };
+    }
+    /** A JSON document by URL. */
+    async fetchJson(url) {
+        if (this.o.fetchJson)
+            return this.o.fetchJson(url);
+        const res = await fetch(url);
+        if (!res.ok)
+            throw new Error(`${url}: ${res.status}`);
+        return (await res.json());
+    }
+    /** A publisher's well-known file (11.7), by its domain. */
+    async wellKnownOf(domain) {
+        return this.fetchJson(`${this.hostOf(domain)}/.well-known/crubal.json`);
+    }
+    /**
+     * Install a package by name from its publisher's well-known file (11.7, release.md): the version asked
+     * for or the latest, its bundle fetched from where the file says, what it extends installed first
+     * (from their own publishers), every bundle verified against its publisher's published keys.
+     */
+    async installFrom(owner, pkg, version, seen = new Set()) {
+        const store = await this.storeFor(owner);
+        // A dependency pinned to a version the owner already holds needs no publisher at all (the standard
+        // packages a deployment took at provisioning, for one).
+        if (version && (await store.state()).installed.some((i) => i.package === pkg && String(i.version) === version))
+            return [];
+        const domain = pkg.split("/")[0];
+        const wk = await this.wellKnownOf(domain);
+        const listed = (wk.packages ?? []).find((p) => p.package === pkg);
+        if (!listed)
+            throw new Error(`${domain} doesn't publish ${pkg}`);
+        const v = version ?? String(listed.latest);
+        const url = listed.versions?.[v];
+        if (!url)
+            throw new Error(`${pkg} has no version ${v} at ${domain}`);
+        const key = `${pkg} /${v}`;
+        if (seen.has(key))
+            throw new Error(`${key} extends itself through its dependencies`);
+        seen.add(key);
+        const out = [];
+        const installed = (await store.state()).installed;
+        if (installed.some((i) => i.package === pkg && String(i.version) === v))
+            return out;
+        const bundle = await this.fetchJson(url);
+        // A bundle names what it extends by short name within its own publisher, or by id across publishers.
+        for (const e of bundle.extends ?? []) {
+            const dep = String(e.package).includes("/") ? String(e.package) : `${bundle.owner}/${e.package}`;
+            out.push(...(await this.installFrom(owner, dep, String(e.version), seen)));
+        }
+        const keys = wk.keys ?? (await this.resolveKeys(domain));
+        const entry = await store.install(bundle, bundle.sig ? keys : undefined, this.now());
+        out.push({ installed: String(bundle.id), version: String(bundle.version), from: url, entry: String(entry.log) });
+        return out;
+    }
+    // ─── Publishing packages (11.5, 11.7) ─────────────────────────────────────
+    /** Where this host serves what it publishes: the public base URL (`https://<domain>` otherwise). */
+    publicBase() {
+        return (this.o.publicBase ?? `https://${this.o.domain}`).replace(/\/$/, "");
+    }
+    /** The URL of a published version's bundle; the text sits beside it as package.crubal. */
+    bundleUrl(owner, pkg, version) {
+        return `${this.publicBase()}/packages/${owner}/${pkg}/${version}/package.json`;
+    }
+    /**
+     * Publish a package version for an owner this host holds the key of: the text becomes a bundle signed
+     * with that key, versioned against the owner's last published version of the package (so unchanged
+     * members keep their versions and a breaking change needs its recipe), kept here and listed in the
+     * well-known file. A version already published is returned as it is; a published version never changes.
+     */
+    async publishPackage(owner, source, o = {}) {
+        const key = await this.keyOf(owner);
+        if (!key)
+            throw new Error(`${owner} has no key on this host to publish with`);
+        const head = source.match(/^package: (\S+) \/(\S+)/m);
+        if (!head)
+            throw new Error("the text has no package: line");
+        const [, name, version] = head;
+        const date = o.date ?? version.split(".")[0] ?? this.now().slice(0, 10);
+        const have = (await this.pool.query("select version, json from host_published where owner = $1 and package = $2 order by version desc", [owner, name])).rows;
+        const same = have.find((r) => r.version === version || r.version.startsWith(`${date}`));
+        if (same)
+            return { bundle: same.json, changes: [], already: true };
+        const previous = have[0]?.json;
+        const { bundle, changes } = publish(source, { date, ...(previous ? { previous } : {}), ...(o.records?.length ? { records: o.records } : {}), key: { d: key.private, x: key.public } });
+        await this.pool.query("insert into host_published (owner, package, version, hash, json, text, published) values ($1, $2, $3, $4, $5, $6, $7) on conflict (owner, package, version) do nothing", [owner, name, String(bundle.version), String(bundle.hash), bundle, source, this.now()]);
+        return { bundle, changes: changes.map((c) => ({ member: c.member, kind: c.kind })), already: false };
+    }
+    /** One published version: its signed bundle and its text, or null. */
+    async publishedBundle(owner, pkg, version) {
+        const { rows } = await this.pool.query("select json, text from host_published where owner = $1 and package = $2 and version = $3", [owner, pkg, version]);
+        const r = rows[0];
+        return r ? { bundle: r.json, text: r.text } : null;
+    }
+    /** What the well-known file lists: every published package with its versions and where each bundle is. */
+    async publishedPackages(owner) {
+        const { rows } = await this.pool.query(owner ? "select owner, package, version from host_published where owner = $1 order by owner, package, version" : "select owner, package, version from host_published order by owner, package, version", owner ? [owner] : []);
+        const byId = new Map();
+        for (const r of rows) {
+            const id = `${r.owner}/${r.package}`;
+            const e = byId.get(id) ?? { owner: r.owner, pkg: r.package, versions: [] };
+            e.versions.push(r.version);
+            byId.set(id, e);
+        }
+        return [...byId.entries()].map(([id, e]) => ({ package: id, latest: e.versions[e.versions.length - 1], versions: Object.fromEntries(e.versions.map((v) => [v, this.bundleUrl(e.owner, e.pkg, v)])) }));
+    }
+    // ─── The well-known file ───────────────────────────────────────────────────
+    async wellKnown() {
+        const keys = {};
+        const retired = (await this.pool.query("select owner, public, \"from\", until from host_keys order by until")).rows;
+        for (const o of await this.owners()) {
+            const old = retired.filter((k) => k.owner === o.owner).map((k) => ({ alg: "Ed25519", public: k.public, ...(k.from ? { from: k.from } : {}), until: k.until }));
+            if (!old.length)
+                keys[o.owner] = { alg: "Ed25519", public: o.public };
+            else
+                keys[o.owner] = [...old, { alg: "Ed25519", public: o.public, from: old.at(-1).until }];
+        }
+        return { crubal: "2", owner: this.o.domain, keys, packages: await this.publishedPackages(), ...(this.o.emergency ? { emergency: this.o.emergency } : {}) };
+    }
+    async notice(owner, notice) {
+        if (this.o.notify)
+            await this.o.notify(owner, notice);
+        else
+            console.warn(`[notice ${owner}] ${JSON.stringify(notice)}`);
+    }
+    // ─── The loops ─────────────────────────────────────────────────────────────
+    /** Publish every owner's stale rows. */
+    async project(owner, now = this.now()) {
+        const out = {};
+        for (const o of owner ? [{ owner }] : await this.owners()) {
+            const store = await this.storeFor(o.owner);
+            const p = await store.projecting();
+            if (!p?.views.views.size) {
+                out[o.owner] = 0;
+                continue;
+            }
+            // A view with a delay (12.6 `fresh: 5m`) publishes when that much has passed since its last publish.
+            const last = new Map((await this.pool.query("select view, at from host_publish where owner = $1", [o.owner])).rows.map((r) => [r.view, r.at]));
+            let n = 0;
+            for (const v of p.views.views.values()) {
+                const delay = v.fresh === "write" ? 0 : durationMs(v.fresh);
+                const was = last.get(v.name);
+                if (delay && was && Date.parse(was) + delay > Date.parse(now))
+                    continue;
+                n += (await store.project(v.name)).length;
+                if (delay)
+                    await this.pool.query("insert into host_publish (owner, view, at) values ($1, $2, $3) on conflict (owner, view) do update set at = excluded.at", [o.owner, v.name, now]);
+            }
+            out[o.owner] = n;
+        }
+        return out;
+    }
+    /** Drain pending instructions (completion.md P) for every owner or one, at a rate per owner. */
+    async drain(rate = 100, owner, now = this.now()) {
+        const out = [];
+        for (const o of owner ? [{ owner }] : await this.owners()) {
+            const r = await (await this.storeFor(o.owner)).drain(rate, now);
+            if (r.applied.length || r.remaining)
+                out.push({ owner: o.owner, applied: r.applied, remaining: r.remaining });
+        }
+        return out;
+    }
+    /**
+     * Try failed runs again when their contract's retry interval has passed (7.5): a run still open after a
+     * failure, whose last attempt is `every` behind `now`. A run dead after its last attempt is noticed.
+     */
+    async retry(now = this.now(), owner) {
+        const out = [];
+        for (const o of owner ? [{ owner }] : await this.owners()) {
+            const store = await this.storeFor(o.owner);
+            const border = await this.borderFor(o.owner, store);
+            const { rows } = await this.pool.query("select run, json from runs where owner = $1 and json->>'state' = 'failed'", [o.owner]);
+            for (const r of rows) {
+                const c = border.contracts.get(String(r.json.contract));
+                const m = (c?.parts.retry ?? "").match(/^(\d+)\s+every\s+(\d+)(m|h|d)$/);
+                if (!c || !m)
+                    continue;
+                const allowed = 1 + Number(m[1]);
+                if (Number(r.json.attempt ?? 0) >= allowed)
+                    continue;
+                const every = Number(m[2]) * (m[3] === "m" ? 60_000 : m[3] === "h" ? 3_600_000 : 86_400_000);
+                const last = (await this.pool.query("select max(at) as at from log where owner = $1 and entry->'writes' @> $2::jsonb", [o.owner, JSON.stringify([{ run: r.run, state: "failed" }])])).rows[0];
+                if (last.at && Date.parse(last.at) + every > Date.parse(now))
+                    continue;
+                const result = await border.retry(r.run, undefined, now);
+                out.push({ owner: o.owner, run: r.run, ...result });
+                if (result.dead)
+                    await this.notice(o.owner, { dead: r.run, contract: c.name, review: String(result.review ?? "") });
+            }
+        }
+        return out;
+    }
+    /** Run every scheduled contract's due ticks, for one owner or all. */
+    async tick(now = this.now(), owner) {
+        const out = [];
+        for (const o of owner ? [{ owner }] : await this.owners()) {
+            const store = await this.storeFor(o.owner);
+            const border = await this.borderFor(o.owner, store);
+            for (const c of border.contracts.values()) {
+                if (!c.when || !/^every /.test(c.when))
+                    continue;
+                out.push({ owner: o.owner, ...(await border.tick(c.name, now)) });
+            }
+        }
+        return out;
+    }
+}
+/** A delay such as `5m`, `2h`, `1d` or `30s` in milliseconds; 0 when it isn't one. */
+function durationMs(s) {
+    const m = s.trim().match(/^(\d+)\s*(s|m|h|d)$/);
+    if (!m)
+        return 0;
+    return Number(m[1]) * { s: 1_000, m: 60_000, h: 3_600_000, d: 86_400_000 }[m[2]];
+}
+//# sourceMappingURL=host.js.map