@degenerate/generic 0.6.0 → 0.7.1

package/dist/library/library-reference.js

@@ -0,0 +1,98 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.evaluateRuleReference = exports.executeFunctionReference = exports.resolveLibraryReference = exports.findPinnedVersion = exports.referenceForRule = exports.ruleLibrarySource = exports.referenceLibraryEntity = void 0;
+const library_errors_1 = require("../errors/library/library-errors");
+const evaluate_library_1 = require("./evaluate-library");
+const library_hash_1 = require("./library-hash");
+const library_models_1 = require("./library-models");
+const pickVersion = (entity, versionHash) => {
+    if (versionHash === undefined) {
+        return entity.versions[entity.versions.length - 1]; // head
+    }
+    const version = entity.versions.find((candidate) => candidate.currentHash === versionHash);
+    if (!version) {
+        throw new library_errors_1.LibraryVersionNotFoundError(entity.id, versionHash);
+    }
+    return version;
+};
+/** Builds a reference pinning a specific version of `entity` (defaults to the head). */
+const referenceLibraryEntity = (entity, versionHash) => {
+    const version = pickVersion(entity, versionHash);
+    return { kind: entity.kind, id: entity.id, currentHash: version.currentHash };
+};
+exports.referenceLibraryEntity = referenceLibraryEntity;
+/**
+ * The canonical source string for a rule library entity: the stringified rule
+ * definition. A rule entity published with this source resolves to a reference
+ * built by {@link referenceForRule} (both hash the same bytes).
+ */
+const ruleLibrarySource = (rule) => JSON.stringify(rule);
+exports.ruleLibrarySource = ruleLibrarySource;
+/**
+ * Computes the content-addressed reference for a rule WITHOUT publishing it: the
+ * id is the hash of the rule's first (and, for a standard rule, only) version,
+ * exactly as `createLibraryEntity` would compute it. This lets a block reference
+ * a rule by hash and resolve it on demand from any store that has been seeded
+ * with the same rule definition (see `seedRuleLibrary` in `@degenerate/shareblock`).
+ */
+const referenceForRule = (rule) => {
+    const hash = (0, library_hash_1.computeVersionHash)((0, exports.ruleLibrarySource)(rule), '');
+    return { kind: library_models_1.LibraryEntityKind.RULE, id: hash, currentHash: hash };
+};
+exports.referenceForRule = referenceForRule;
+/**
+ * Locates the pinned version within an already-in-hand entity (the
+ * self-contained path). Checks the reference's `id` and `kind` match the entity
+ * and that the pinned `currentHash` exists.
+ */
+const findPinnedVersion = (entity, reference) => {
+    if (entity.id !== reference.id) {
+        throw new library_errors_1.LibraryEntityInvalidError(`reference id ${reference.id} does not match entity ${entity.id}`);
+    }
+    if (entity.kind !== reference.kind) {
+        throw new library_errors_1.LibraryKindMismatchError(entity.id, reference.kind, entity.kind);
+    }
+    const version = entity.versions.find((candidate) => candidate.currentHash === reference.currentHash);
+    if (!version) {
+        throw new library_errors_1.LibraryVersionNotFoundError(entity.id, reference.currentHash);
+    }
+    return version;
+};
+exports.findPinnedVersion = findPinnedVersion;
+/**
+ * Resolves a reference against the store (the limited-self-containment path):
+ * loads the entity by id (the store re-verifies it), then locates the pinned
+ * version. Throws {@link LibraryEntityNotFoundError} if the store lacks the id.
+ */
+const resolveLibraryReference = async (reference, store) => {
+    const entity = await store.get(reference.id); // re-verifies on read
+    if (!entity) {
+        throw new library_errors_1.LibraryEntityNotFoundError(reference.id);
+    }
+    return { entity, version: (0, exports.findPinnedVersion)(entity, reference) };
+};
+exports.resolveLibraryReference = resolveLibraryReference;
+/** Resolves a FUNCTION reference from the store and runs its pinned version. */
+const executeFunctionReference = async (reference, store, options) => {
+    const { entity } = await (0, exports.resolveLibraryReference)(reference, store);
+    return (0, evaluate_library_1.evaluateLibraryFunction)(entity, {
+        current: options.current,
+        input: options.input,
+        versionHash: reference.currentHash,
+        gasLimit: options.gasLimit,
+        executor: options.executor,
+    });
+};
+exports.executeFunctionReference = executeFunctionReference;
+/** Resolves a RULE reference from the store and evaluates its pinned version. */
+const evaluateRuleReference = async (reference, store, options) => {
+    const { entity } = await (0, exports.resolveLibraryReference)(reference, store);
+    return (0, evaluate_library_1.evaluateLibraryRule)(entity, {
+        current: options.current,
+        proposed: options.proposed,
+        versionHash: reference.currentHash,
+        gasLimit: options.gasLimit,
+        evaluator: options.evaluator,
+    });
+};
+exports.evaluateRuleReference = evaluateRuleReference;

package/dist/library/library-server.d.ts

@@ -0,0 +1,17 @@
+import { LibraryStore } from './library-store';
+import { RemoteLibraryRequest, RemoteLibraryResponse } from './remote-library-models';
+export interface LibraryServer {
+    handle(request: RemoteLibraryRequest): Promise<RemoteLibraryResponse>;
+}
+/**
+ * The transport-agnostic rules-server handler: it receives a
+ * {@link RemoteLibraryRequest} and serves it from a backing {@link LibraryStore}
+ * (any DB). The CONSUMER wires this handler to their HTTP/RPC server — the server
+ * itself takes no transport dependency, the same discipline as the sandbox server.
+ *
+ * Operational failures are returned as `{ error }` rather than thrown, so the
+ * transport carries a normal response; the client's {@link createRemoteLibraryStore}
+ * turns `error` back into a thrown error on its side.
+ */
+export declare const createLibraryServer: (store: LibraryStore) => LibraryServer;
+//# sourceMappingURL=library-server.d.ts.map

package/dist/library/library-server.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"library-server.d.ts","sourceRoot":"","sources":["../../src/library/library-server.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,MAAM,iBAAiB,CAAC;AAC/C,OAAO,EAAE,oBAAoB,EAAE,qBAAqB,EAAE,MAAM,yBAAyB,CAAC;AAEtF,MAAM,WAAW,aAAa;IAC1B,MAAM,CAAC,OAAO,EAAE,oBAAoB,GAAG,OAAO,CAAC,qBAAqB,CAAC,CAAC;CACzE;AAED;;;;;;;;;GASG;AACH,eAAO,MAAM,mBAAmB,GAAI,OAAO,YAAY,KAAG,aA6BxD,CAAC"}

package/dist/library/library-server.js

@@ -0,0 +1,45 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.createLibraryServer = void 0;
+/**
+ * The transport-agnostic rules-server handler: it receives a
+ * {@link RemoteLibraryRequest} and serves it from a backing {@link LibraryStore}
+ * (any DB). The CONSUMER wires this handler to their HTTP/RPC server — the server
+ * itself takes no transport dependency, the same discipline as the sandbox server.
+ *
+ * Operational failures are returned as `{ error }` rather than thrown, so the
+ * transport carries a normal response; the client's {@link createRemoteLibraryStore}
+ * turns `error` back into a thrown error on its side.
+ */
+const createLibraryServer = (store) => ({
+    async handle(request) {
+        try {
+            switch (request.op) {
+                case 'get': {
+                    const entity = await store.get(request.id);
+                    return { entity: entity ?? null };
+                }
+                case 'getVersion': {
+                    const version = await store.getVersion(request.id, request.currentHash);
+                    return { version: version ?? null };
+                }
+                case 'has':
+                    return { exists: await store.has(request.id) };
+                case 'list':
+                    return { entities: await store.list(request.filter) };
+                case 'search':
+                    return { entities: await store.search(request.query) };
+                case 'save':
+                    await store.save(request.entity);
+                    return {};
+                case 'delete':
+                    await store.delete(request.id);
+                    return {};
+            }
+        }
+        catch (err) {
+            return { error: err instanceof Error ? err.message : String(err) };
+        }
+    },
+});
+exports.createLibraryServer = createLibraryServer;

package/dist/library/library-store.d.ts

@@ -0,0 +1,37 @@
+import { ILibraryEntity, ILibraryVersion, LibraryEntityKind } from './library-models';
+/** Filter for {@link LibraryStore.list}. */
+export interface LibraryListFilter {
+    kind?: LibraryEntityKind;
+}
+/**
+ * Query for {@link LibraryStore.search} — discovering reusable functions/rules
+ * in the library. All supplied fields must match (AND). `text` is a
+ * case-insensitive substring match over `name` and `description`.
+ */
+export interface LibrarySearchQuery {
+    kind?: LibraryEntityKind;
+    text?: string;
+    ownerPublicKey?: string;
+}
+/**
+ * Storage-agnostic persistence for library entities. The canonical record is
+ * portable JSON (the {@link ILibraryEntity} shape), so any backend works —
+ * in-memory, Firestore, Postgres, etc.
+ *
+ * Contract: the store is a cache of proofs, NEVER a trust anchor. `save`
+ * verifies before persisting and enforces append-only growth; every read
+ * (`get` / `getVersion` / `list`) RE-VERIFIES the entity before returning it, so
+ * a tampered backend surfaces as a thrown error rather than corrupt data.
+ */
+export interface LibraryStore {
+    get(id: string): Promise<ILibraryEntity | undefined>;
+    getVersion(id: string, currentHash: string): Promise<ILibraryVersion | undefined>;
+    has(id: string): Promise<boolean>;
+    list(filter?: LibraryListFilter): Promise<ILibraryEntity[]>;
+    /** Discover entities by kind, owner, and/or name/description text. */
+    search(query: LibrarySearchQuery): Promise<ILibraryEntity[]>;
+    /** Create a new entity or append-only-extend an existing one. */
+    save(entity: ILibraryEntity): Promise<void>;
+    delete(id: string): Promise<void>;
+}
+//# sourceMappingURL=library-store.d.ts.map

package/dist/library/library-store.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"library-store.d.ts","sourceRoot":"","sources":["../../src/library/library-store.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,cAAc,EAAE,eAAe,EAAE,iBAAiB,EAAE,MAAM,kBAAkB,CAAC;AAEtF,4CAA4C;AAC5C,MAAM,WAAW,iBAAiB;IAC9B,IAAI,CAAC,EAAE,iBAAiB,CAAC;CAC5B;AAED;;;;GAIG;AACH,MAAM,WAAW,kBAAkB;IAC/B,IAAI,CAAC,EAAE,iBAAiB,CAAC;IACzB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,cAAc,CAAC,EAAE,MAAM,CAAC;CAC3B;AAED;;;;;;;;;GASG;AACH,MAAM,WAAW,YAAY;IACzB,GAAG,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,cAAc,GAAG,SAAS,CAAC,CAAC;IACrD,UAAU,CAAC,EAAE,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,eAAe,GAAG,SAAS,CAAC,CAAC;IAClF,GAAG,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IAClC,IAAI,CAAC,MAAM,CAAC,EAAE,iBAAiB,GAAG,OAAO,CAAC,cAAc,EAAE,CAAC,CAAC;IAC5D,sEAAsE;IACtE,MAAM,CAAC,KAAK,EAAE,kBAAkB,GAAG,OAAO,CAAC,cAAc,EAAE,CAAC,CAAC;IAC7D,iEAAiE;IACjE,IAAI,CAAC,MAAM,EAAE,cAAc,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC5C,MAAM,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CACrC"}

package/dist/library/library-store.js

@@ -0,0 +1,2 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });

package/dist/library/remote-library-models.d.ts

@@ -0,0 +1,135 @@
+import { z } from 'zod';
+import { ILibraryEntity, ILibraryVersion } from './library-models';
+import { LibraryListFilter, LibrarySearchQuery } from './library-store';
+/**
+ * A portable-JSON request to a remote library ("rules server"), discriminated by
+ * `op`. Mirrors the {@link LibraryStore} surface so a remote store can proxy
+ * every operation across a transport.
+ */
+export type RemoteLibraryRequest = {
+    op: 'get';
+    id: string;
+} | {
+    op: 'getVersion';
+    id: string;
+    currentHash: string;
+} | {
+    op: 'has';
+    id: string;
+} | {
+    op: 'list';
+    filter?: LibraryListFilter;
+} | {
+    op: 'search';
+    query: LibrarySearchQuery;
+} | {
+    op: 'save';
+    entity: ILibraryEntity;
+} | {
+    op: 'delete';
+    id: string;
+};
+/**
+ * Runtime validator for a {@link RemoteLibraryRequest} — used by an HTTP/RPC
+ * server (e.g. the example endpoints route) to reject a malformed wire body
+ * before dispatching to the library server.
+ */
+export declare const RemoteLibraryRequestSchema: z.ZodDiscriminatedUnion<[z.ZodObject<{
+    op: z.ZodLiteral<"get">;
+    id: z.ZodString;
+}, z.core.$strip>, z.ZodObject<{
+    op: z.ZodLiteral<"getVersion">;
+    id: z.ZodString;
+    currentHash: z.ZodString;
+}, z.core.$strip>, z.ZodObject<{
+    op: z.ZodLiteral<"has">;
+    id: z.ZodString;
+}, z.core.$strip>, z.ZodObject<{
+    op: z.ZodLiteral<"list">;
+    filter: z.ZodOptional<z.ZodObject<{
+        kind: z.ZodOptional<z.ZodEnum<{
+            function: "function";
+            rule: "rule";
+        }>>;
+    }, z.core.$strip>>;
+}, z.core.$strip>, z.ZodObject<{
+    op: z.ZodLiteral<"search">;
+    query: z.ZodObject<{
+        kind: z.ZodOptional<z.ZodEnum<{
+            function: "function";
+            rule: "rule";
+        }>>;
+        text: z.ZodOptional<z.ZodString>;
+        ownerPublicKey: z.ZodOptional<z.ZodString>;
+    }, z.core.$strip>;
+}, z.core.$strip>, z.ZodObject<{
+    op: z.ZodLiteral<"save">;
+    entity: z.ZodObject<{
+        kind: z.ZodEnum<{
+            function: "function";
+            rule: "rule";
+        }>;
+        id: z.ZodString;
+        name: z.ZodString;
+        description: z.ZodString;
+        gasLimit: z.ZodNumber;
+        owner: z.ZodObject<{
+            publicKey: z.ZodString;
+        }, z.core.$strip>;
+        delegations: z.ZodArray<z.ZodObject<{
+            signerPublicKey: z.ZodString;
+            createdAt: z.ZodNumber;
+            proof: z.ZodObject<{
+                publicKey: z.ZodString;
+                signature: z.ZodString;
+            }, z.core.$strip>;
+        }, z.core.$strip>>;
+        versions: z.ZodArray<z.ZodObject<{
+            createdAt: z.ZodNumber;
+            previousHash: z.ZodString;
+            source: z.ZodString;
+            currentHash: z.ZodString;
+            proof: z.ZodObject<{
+                publicKey: z.ZodString;
+                signature: z.ZodString;
+            }, z.core.$strip>;
+            proofType: z.ZodEnum<{
+                CRYPTOGRAPHIC_SIGNATURE: "CRYPTOGRAPHIC_SIGNATURE";
+            }>;
+        }, z.core.$strip>>;
+        head: z.ZodObject<{
+            currentHash: z.ZodString;
+            proof: z.ZodObject<{
+                publicKey: z.ZodString;
+                signature: z.ZodString;
+            }, z.core.$strip>;
+        }, z.core.$strip>;
+    }, z.core.$strip>;
+}, z.core.$strip>, z.ZodObject<{
+    op: z.ZodLiteral<"delete">;
+    id: z.ZodString;
+}, z.core.$strip>], "op">;
+/**
+ * A portable-JSON response from a remote library. Only the field relevant to the
+ * request's `op` is populated; `error` carries a server-side failure message.
+ */
+export interface RemoteLibraryResponse {
+    entity?: ILibraryEntity | null;
+    version?: ILibraryVersion | null;
+    exists?: boolean;
+    entities?: ILibraryEntity[];
+    error?: string;
+}
+/**
+ * The pluggable transport (a "port") carrying a request to a remote rules server
+ * and returning its response. The consumer wires this to their HTTP/RPC client,
+ * so `@degenerate/generic` stays dependency-free — the same discipline as
+ * {@link SandboxTransport} and the realtime Redis port.
+ *
+ * `send` may reject on a transport-level failure (network, timeout); that
+ * propagates to the caller rather than being mapped to a missing entity.
+ */
+export interface LibraryTransport {
+    send(request: RemoteLibraryRequest): Promise<RemoteLibraryResponse>;
+}
+//# sourceMappingURL=remote-library-models.d.ts.map

package/dist/library/remote-library-models.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"remote-library-models.d.ts","sourceRoot":"","sources":["../../src/library/remote-library-models.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,cAAc,EAAwB,eAAe,EAA2B,MAAM,kBAAkB,CAAC;AAClH,OAAO,EAAE,iBAAiB,EAAE,kBAAkB,EAAE,MAAM,iBAAiB,CAAC;AAExE;;;;GAIG;AACH,MAAM,MAAM,oBAAoB,GAC1B;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,EAAE,EAAE,MAAM,CAAA;CAAE,GACzB;IAAE,EAAE,EAAE,YAAY,CAAC;IAAC,EAAE,EAAE,MAAM,CAAC;IAAC,WAAW,EAAE,MAAM,CAAA;CAAE,GACrD;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,EAAE,EAAE,MAAM,CAAA;CAAE,GACzB;IAAE,EAAE,EAAE,MAAM,CAAC;IAAC,MAAM,CAAC,EAAE,iBAAiB,CAAA;CAAE,GAC1C;IAAE,EAAE,EAAE,QAAQ,CAAC;IAAC,KAAK,EAAE,kBAAkB,CAAA;CAAE,GAC3C;IAAE,EAAE,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,cAAc,CAAA;CAAE,GACtC;IAAE,EAAE,EAAE,QAAQ,CAAC;IAAC,EAAE,EAAE,MAAM,CAAA;CAAE,CAAC;AAEnC;;;;GAIG;AACH,eAAO,MAAM,0BAA0B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;yBAerC,CAAC;AAEH;;;GAGG;AACH,MAAM,WAAW,qBAAqB;IAClC,MAAM,CAAC,EAAE,cAAc,GAAG,IAAI,CAAC;IAC/B,OAAO,CAAC,EAAE,eAAe,GAAG,IAAI,CAAC;IACjC,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,QAAQ,CAAC,EAAE,cAAc,EAAE,CAAC;IAC5B,KAAK,CAAC,EAAE,MAAM,CAAC;CAClB;AAED;;;;;;;;GAQG;AACH,MAAM,WAAW,gBAAgB;IAC7B,IAAI,CAAC,OAAO,EAAE,oBAAoB,GAAG,OAAO,CAAC,qBAAqB,CAAC,CAAC;CACvE"}

package/dist/library/remote-library-models.js

@@ -0,0 +1,26 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.RemoteLibraryRequestSchema = void 0;
+const zod_1 = require("zod");
+const library_models_1 = require("./library-models");
+/**
+ * Runtime validator for a {@link RemoteLibraryRequest} — used by an HTTP/RPC
+ * server (e.g. the example endpoints route) to reject a malformed wire body
+ * before dispatching to the library server.
+ */
+exports.RemoteLibraryRequestSchema = zod_1.z.discriminatedUnion('op', [
+    zod_1.z.object({ op: zod_1.z.literal('get'), id: zod_1.z.string() }),
+    zod_1.z.object({ op: zod_1.z.literal('getVersion'), id: zod_1.z.string(), currentHash: zod_1.z.string() }),
+    zod_1.z.object({ op: zod_1.z.literal('has'), id: zod_1.z.string() }),
+    zod_1.z.object({ op: zod_1.z.literal('list'), filter: zod_1.z.object({ kind: library_models_1.LibraryEntityKindSchema.optional() }).optional() }),
+    zod_1.z.object({
+        op: zod_1.z.literal('search'),
+        query: zod_1.z.object({
+            kind: library_models_1.LibraryEntityKindSchema.optional(),
+            text: zod_1.z.string().optional(),
+            ownerPublicKey: zod_1.z.string().optional(),
+        }),
+    }),
+    zod_1.z.object({ op: zod_1.z.literal('save'), entity: library_models_1.ILibraryEntitySchema }),
+    zod_1.z.object({ op: zod_1.z.literal('delete'), id: zod_1.z.string() }),
+]);

package/dist/library/remote-library-store.d.ts

@@ -0,0 +1,15 @@
+import { LibraryStore } from './library-store';
+import { LibraryTransport } from './remote-library-models';
+/**
+ * A {@link LibraryStore} backed by a remote "rules server" reached over a
+ * {@link LibraryTransport}. Each operation is proxied across the transport, so a
+ * block can load (and only load) the exact rules it needs on demand.
+ *
+ * Trust discipline: the server is a cache of proofs, NEVER a trust anchor. Every
+ * entity that crosses the wire is re-verified here ({@link verifyLibraryEntity})
+ * before it is returned, so a tampered or malicious server surfaces as a thrown
+ * error rather than a corrupt entity. Compose with {@link createCachingLibraryStore}
+ * for "resolve once, retain in memory" on-demand loading.
+ */
+export declare const createRemoteLibraryStore: (transport: LibraryTransport) => LibraryStore;
+//# sourceMappingURL=remote-library-store.d.ts.map

package/dist/library/remote-library-store.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"remote-library-store.d.ts","sourceRoot":"","sources":["../../src/library/remote-library-store.ts"],"names":[],"mappings":"AACA,OAAO,EAAyC,YAAY,EAAE,MAAM,iBAAiB,CAAC;AACtF,OAAO,EAAE,gBAAgB,EAAyB,MAAM,yBAAyB,CAAC;AAUlF;;;;;;;;;;GAUG;AACH,eAAO,MAAM,wBAAwB,GAAI,WAAW,gBAAgB,KAAG,YAoCtE,CAAC"}

package/dist/library/remote-library-store.js

@@ -0,0 +1,59 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.createRemoteLibraryStore = void 0;
+const verify_library_1 = require("./verify-library");
+const unwrap = (response) => {
+    if (response.error) {
+        throw new Error(`remote library error: ${response.error}`);
+    }
+    return response;
+};
+/**
+ * A {@link LibraryStore} backed by a remote "rules server" reached over a
+ * {@link LibraryTransport}. Each operation is proxied across the transport, so a
+ * block can load (and only load) the exact rules it needs on demand.
+ *
+ * Trust discipline: the server is a cache of proofs, NEVER a trust anchor. Every
+ * entity that crosses the wire is re-verified here ({@link verifyLibraryEntity})
+ * before it is returned, so a tampered or malicious server surfaces as a thrown
+ * error rather than a corrupt entity. Compose with {@link createCachingLibraryStore}
+ * for "resolve once, retain in memory" on-demand loading.
+ */
+const createRemoteLibraryStore = (transport) => {
+    const verified = (entity) => {
+        (0, verify_library_1.verifyLibraryEntity)(entity); // throws on any tampering
+        return entity;
+    };
+    return {
+        async get(id) {
+            const { entity } = unwrap(await transport.send({ op: 'get', id }));
+            return entity ? verified(entity) : undefined;
+        },
+        async getVersion(id, currentHash) {
+            // Resolve the whole entity so it is re-verified, then pick the version.
+            const { entity } = unwrap(await transport.send({ op: 'get', id }));
+            if (!entity)
+                return undefined;
+            return verified(entity).versions.find((version) => version.currentHash === currentHash);
+        },
+        async has(id) {
+            const { exists } = unwrap(await transport.send({ op: 'has', id }));
+            return exists === true;
+        },
+        async list(filter) {
+            const { entities } = unwrap(await transport.send({ op: 'list', filter }));
+            return (entities ?? []).map(verified);
+        },
+        async search(query) {
+            const { entities } = unwrap(await transport.send({ op: 'search', query }));
+            return (entities ?? []).map(verified);
+        },
+        async save(entity) {
+            unwrap(await transport.send({ op: 'save', entity }));
+        },
+        async delete(id) {
+            unwrap(await transport.send({ op: 'delete', id }));
+        },
+    };
+};
+exports.createRemoteLibraryStore = createRemoteLibraryStore;

package/dist/library/verify-library.d.ts

@@ -0,0 +1,21 @@
+import { ILibraryEntity, ILibraryVersion, LibraryEntityKind } from './library-models';
+/**
+ * Verifies a single library version against its expected chain position.
+ * Returns `true`; throws on any mismatch:
+ *   1. recompute `currentHash` from `source` + `previousHash` — must match;
+ *   2. `previousHash` must equal `expectedPreviousHash` (chain intact);
+ *   3. the Ed25519 signature must verify over the reconstructed canonical,
+ *      purpose-bound payload (which also covers `createdAt`/`publicKey`).
+ */
+export declare const verifyLibraryVersion: (entityId: string, kind: LibraryEntityKind, version: ILibraryVersion, expectedPreviousHash: string) => true;
+/**
+ * Verifies a whole library entity end-to-end. Returns `true`; throws on any
+ * failure. Checks: non-empty ledger; `id` equals the first version's hash
+ * (content-addressed identity); every version verifies and chains; the `head`
+ * matches the latest version and its proof verifies.
+ *
+ * This is the "quick verify" path — it re-checks recorded hashes and
+ * signatures without executing any source.
+ */
+export declare const verifyLibraryEntity: (entity: ILibraryEntity) => true;
+//# sourceMappingURL=verify-library.d.ts.map

package/dist/library/verify-library.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"verify-library.d.ts","sourceRoot":"","sources":["../../src/library/verify-library.ts"],"names":[],"mappings":"AAUA,OAAO,EAAE,cAAc,EAAE,eAAe,EAAE,iBAAiB,EAAE,MAAM,kBAAkB,CAAC;AAQtF;;;;;;;GAOG;AACH,eAAO,MAAM,oBAAoB,GAC7B,UAAU,MAAM,EAChB,MAAM,iBAAiB,EACvB,SAAS,eAAe,EACxB,sBAAsB,MAAM,KAC7B,IAoBF,CAAC;AAEF;;;;;;;;GAQG;AACH,eAAO,MAAM,mBAAmB,GAAI,QAAQ,cAAc,KAAG,IA4C5D,CAAC"}

package/dist/library/verify-library.js

@@ -0,0 +1,86 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.verifyLibraryEntity = exports.verifyLibraryVersion = void 0;
+const verify_ed25519_signature_1 = require("../crypto/signature/verify-ed25519-signature");
+const library_errors_1 = require("../errors/library/library-errors");
+const authorize_library_1 = require("./authorize-library");
+const library_hash_1 = require("./library-hash");
+const library_proof_1 = require("./library-proof");
+/**
+ * Verifies a single library version against its expected chain position.
+ * Returns `true`; throws on any mismatch:
+ *   1. recompute `currentHash` from `source` + `previousHash` — must match;
+ *   2. `previousHash` must equal `expectedPreviousHash` (chain intact);
+ *   3. the Ed25519 signature must verify over the reconstructed canonical,
+ *      purpose-bound payload (which also covers `createdAt`/`publicKey`).
+ */
+const verifyLibraryVersion = (entityId, kind, version, expectedPreviousHash) => {
+    const recomputed = (0, library_hash_1.computeVersionHash)(version.source, version.previousHash);
+    if (recomputed !== version.currentHash) {
+        throw new library_errors_1.LibraryVersionHashMismatchError(entityId, version.currentHash, recomputed);
+    }
+    if (version.previousHash !== expectedPreviousHash) {
+        throw new library_errors_1.LibraryChainBrokenError(entityId, expectedPreviousHash, version.previousHash);
+    }
+    const payload = (0, library_proof_1.buildVersionProofPayload)({
+        id: entityId,
+        currentHash: version.currentHash,
+        previousHash: version.previousHash,
+        createdAt: version.createdAt,
+        purpose: (0, library_proof_1.versionPurpose)(kind),
+        publicKey: version.proof.publicKey,
+    });
+    if (!(0, verify_ed25519_signature_1.verifyEd25519Signature)(version.proof.publicKey, payload, version.proof.signature)) {
+        throw new library_errors_1.LibraryProofInvalidError(entityId, 'version');
+    }
+    return true;
+};
+exports.verifyLibraryVersion = verifyLibraryVersion;
+/**
+ * Verifies a whole library entity end-to-end. Returns `true`; throws on any
+ * failure. Checks: non-empty ledger; `id` equals the first version's hash
+ * (content-addressed identity); every version verifies and chains; the `head`
+ * matches the latest version and its proof verifies.
+ *
+ * This is the "quick verify" path — it re-checks recorded hashes and
+ * signatures without executing any source.
+ */
+const verifyLibraryEntity = (entity) => {
+    if (entity.versions.length === 0) {
+        throw new library_errors_1.LibraryEntityInvalidError('entity has no versions');
+    }
+    if (entity.id !== entity.versions[0].currentHash) {
+        throw new library_errors_1.LibraryEntityInvalidError(`id ${entity.id} does not equal the first version hash ${entity.versions[0].currentHash}`);
+    }
+    // Every delegation must be a genuine owner-signed grant — catches a forged
+    // delegation entry even if no version relies on it.
+    for (const delegation of entity.delegations) {
+        if (!(0, authorize_library_1.isValidLibraryDelegation)(entity, delegation)) {
+            throw new library_errors_1.LibraryProofInvalidError(entity.id, 'delegation');
+        }
+    }
+    let expectedPreviousHash = '';
+    for (const version of entity.versions) {
+        (0, exports.verifyLibraryVersion)(entity.id, entity.kind, version, expectedPreviousHash);
+        // The signature is valid; confirm the signer was actually authorized.
+        if (!(0, authorize_library_1.isLibraryAuthorizedSigner)(entity, version.proof.publicKey)) {
+            throw new library_errors_1.LibraryVersionNotAuthorizedError(entity.id, version.proof.publicKey);
+        }
+        expectedPreviousHash = version.currentHash;
+    }
+    // expectedPreviousHash now holds the latest version's currentHash.
+    if (entity.head.currentHash !== expectedPreviousHash) {
+        throw new library_errors_1.LibraryEntityInvalidError(`head ${entity.head.currentHash} does not match the latest version ${expectedPreviousHash}`);
+    }
+    const headPayload = (0, library_proof_1.buildHeadProofPayload)({
+        id: entity.id,
+        head: entity.head.currentHash,
+        purpose: (0, library_proof_1.headPurpose)(entity.kind),
+        publicKey: entity.head.proof.publicKey,
+    });
+    if (!(0, verify_ed25519_signature_1.verifyEd25519Signature)(entity.head.proof.publicKey, headPayload, entity.head.proof.signature)) {
+        throw new library_errors_1.LibraryProofInvalidError(entity.id, 'head');
+    }
+    return true;
+};
+exports.verifyLibraryEntity = verifyLibraryEntity;

package/dist/models/functions/share-data-function-models.d.ts

@@ -1,6 +1,11 @@
 import { z } from 'zod';
 /**
- * This contains the data for the share functions
+ * Function record + proof types still referenced by the runtime (the rules
+ * engine's `ITargetObject` and the `IShareDataFunction` shape used by
+ * `share-data-errors`). The earlier network-function/rule "logic library"
+ * sketches (`IShareDataNetworkFunction` / `IShareDataNetworkRule` / …) were
+ * removed — the live, signed, versioned library entities in
+ * `@degenerate/generic`'s `library/` module supersede them.
  */
 /**
  * This contains all the proof types that exist for the network.
@@ -59,77 +64,4 @@ export declare const IShareDataFunctionSchema: z.ZodObject<{
     currentHash: z.ZodString;
 }, z.core.$strip>;
 export type IShareDataFunction = z.infer<typeof IShareDataFunctionSchema>;
-/**
- * This contains a share data network function
- */
-export declare const IShareDataNetworkFunctionSchema: z.ZodObject<{
-    id: z.ZodString;
-    name: z.ZodString;
-    description: z.ZodString;
-    shareDataFunctions: z.ZodArray<z.ZodObject<{
-        proof: z.ZodObject<{
-            publicKey: z.ZodString;
-            signature: z.ZodString;
-        }, z.core.$strip>;
-        proofType: z.ZodEnum<{
-            CRYPTOGRAPHIC_SIGNATURE: "CRYPTOGRAPHIC_SIGNATURE";
-        }>;
-        createdAt: z.ZodNumber;
-        previousHash: z.ZodString;
-        stringifiedFunction: z.ZodString;
-        currentHash: z.ZodString;
-    }, z.core.$strip>>;
-    proof: z.ZodObject<{
-        publicKey: z.ZodString;
-        signature: z.ZodString;
-    }, z.core.$strip>;
-    proofType: z.ZodEnum<{
-        CRYPTOGRAPHIC_SIGNATURE: "CRYPTOGRAPHIC_SIGNATURE";
-    }>;
-}, z.core.$strip>;
-export type IShareDataNetworkFunction = z.infer<typeof IShareDataNetworkFunctionSchema>;
-/**
- * This contains the data for a share data network function descriptor.
- */
-export declare const IShareDataNetworkFunctionDescriptorSchema: z.ZodObject<{
-    functionNumber: z.ZodNumber;
-    name: z.ZodString;
-    description: z.ZodString;
-}, z.core.$strip>;
-export type IShareDataNetworkFunctionDescriptor = z.infer<typeof IShareDataNetworkFunctionDescriptorSchema>;
-/**
- * This contains the data for a share data network rule that is the basic shape.
- */
-export declare const IShareDataRuleBasicSchema: z.ZodObject<{
-    createdAt: z.ZodNumber;
-    previousHash: z.ZodString;
-    stringifiedRule: z.ZodString;
-    currentHash: z.ZodString;
-}, z.core.$strip>;
-export type IShareDataRuleBasic = z.infer<typeof IShareDataRuleBasicSchema>;
-/**
- * This contains the interface for a share function record in the share data object
- */
-export declare const IShareDataNetworkRuleSchema: z.ZodObject<{
-    id: z.ZodString;
-    shareDataRules: z.ZodArray<z.ZodObject<{
-        createdAt: z.ZodNumber;
-        previousHash: z.ZodString;
-        stringifiedRule: z.ZodString;
-        currentHash: z.ZodString;
-    }, z.core.$strip>>;
-    applicationId: z.ZodString;
-    applicationIdProof: z.ZodString;
-}, z.core.$strip>;
-export type IShareDataNetworkRule = z.infer<typeof IShareDataNetworkRuleSchema>;
-/**
- * This contains the data for a share data network rule.
- */
-export declare const IShareDataRuleSchema: z.ZodObject<{
-    createdAt: z.ZodNumber;
-    previousHash: z.ZodString;
-    stringifiedRule: z.ZodString;
-    currentHash: z.ZodString;
-}, z.core.$strip>;
-export type IShareDataRule = z.infer<typeof IShareDataRuleSchema>;
 //# sourceMappingURL=share-data-function-models.d.ts.map