@earendil-works/chord 1.5.0 → 1.5.1

package/dist/next/link/message.js

@@ -1,123 +0,0 @@
-// Messages (§22, R1, R4, 2b): the one `Message` type every link carries, defined as a schema and checked after every
-// decode, and the codecs that turn it into bytes.
-import { obj as openObj } from "@earendil-works/pi-schema";
-import { arr, int, lit, obj, oneOf, opt, str, union, unknown } from "../contracts/index.js";
-import { validatorFor } from "../data/internal.js";
-/** A link-local id, chosen by its origin: a counter, unique per link, direction and origin while in use. */
-const id = int({ min: 0 });
-/**
- * Whose work a message is (decision "Relay flow control per origin"): a relay's number for one downstream link (and
- * the origin that link's messages carried), never reused on a link; absent for the sender's own work. Holds, calls,
- * windows and acks are keyed by (origin, id), and replies carry the origin of what they answer.
- */
-const origin = int({ min: 1 });
-/** A name as an index into the hold's bound version (each variant's names sorted). */
-const index = int({ min: 0 });
-/** An error that may come from plugin code: a ChordError's JSON (checked by L1), or a plugin's code and message. */
-const wireError = union([
-    obj({ kind: lit("chord"), error: unknown() }),
-    obj({ kind: lit("plugin"), code: str(), message: str(), details: opt(unknown()) }),
-]);
-/** The members of a hold that failed with this message (W1). */
-const failed = arr(obj({ member: index, error: wireError }));
-/** A part's envelope: the codec built it, so any value passes (its content is the owner's to parse). */
-const part = unknown();
-/**
- * The byte segments of a payload part whose method's schema has a `bytes()` leaf, referenced from its JSON by
- * `{"$bytes": i}`; absent for every other payload. Built by the codec, like the part.
- */
-const segments = opt(unknown());
-/** An address as a hold names it: its host kind and params, checked against the kind where it is routed. */
-const address = obj({ kind: str(), params: unknown() });
-/** A principal on a hold: JSON with a `kind`, honoured only on a parent link. */
-const principal = openObj({ kind: str() }, { open: true });
-/** A uuidv7 as text. */
-const incarnation = str({ pattern: "^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$" });
-/** The longest activation chain a hold carries (Q5): a longer one keeps its last entries. */
-export const CHAIN = 32;
-/** A `retry`'s hop budget as the first host sends it (dependency model §3.7, audit A5): one less per host after it. */
-export const RETRY_HOPS = 16;
-/** The kinds of a `failed` message's cause, in their codes' order (the binary codec's byte, the text codec's letter). */
-export const CAUSE_KINDS = ["transient", "broken", "waiting"];
-/** The protocol's messages, one tagged union. Parts are opaque here (the owners parse them). */
-const MESSAGE = union([
-    // `calls`: how many concurrent calls this side accepts (the call window).
-    obj({ kind: lit("hello"), protocol: int({ min: 0 }), incarnation, calls: int({ min: 1 }) }),
-    obj({
-        kind: lit("hold"),
-        origin: opt(origin),
-        hold: id,
-        type: str(),
-        version: int({ min: 1 }),
-        fingerprint: str({ pattern: "^[0-9a-f]{16}$" }),
-        params: part,
-        // The address the caller computed with the type's `hostAddress`: it routes the hold.
-        address,
-        // Whom the hold acts for and the origin's incarnation; read only on a parent link.
-        principal: opt(principal),
-        incarnation: opt(incarnation),
-        // The instance ids of the activations waiting for this hold (Q5); read only on a trusted link.
-        chain: opt(arr(incarnation, { max: CHAIN })),
-        // The decoded limit per part of the link the hold was admitted on (Q2); read only on a parent link.
-        limit: opt(int({ min: 0 })),
-    }),
-    obj({ kind: lit("release"), origin: opt(origin), hold: id }),
-    obj({ kind: lit("call"), origin: opt(origin), call: id, hold: id, method: index, args: opt(part), segments }),
-    obj({ kind: lit("abort"), origin: opt(origin), call: id }),
-    // Asks the provider for an attempt of a failed hold's object now (`ref.retry()`); `hops` is its budget: the host
-    // there passes it on to its remote dependencies with one less, never at 0, so a waiting ring of hosts stops. Relays
-    // forward it as it is.
-    obj({ kind: lit("retry"), origin: opt(origin), hold: id, hops: int({ min: 1, max: RETRY_HOPS }) }),
-    // Binds several holds at once (first bindings, re-holds), applied in one batch.
-    obj({
-        kind: lit("bound"),
-        origin: opt(origin),
-        holds: arr(obj({ hold: id, variant: index, members: arr(obj({ member: index, value: part })), failed })),
-    }),
-    obj({
-        kind: lit("state"),
-        origin: opt(origin),
-        // `retired`: the members whose document was retired since the hold's last message (decision "One retirement
-        // mechanism"); a `bound` snapshot carries no flag.
-        holds: arr(obj({ hold: id, members: arr(obj({ member: index, ops: part })), failed, retired: arr(index) })),
-    }),
-    // One per applied `bound` or `state` message of its origin (the window).
-    obj({ kind: lit("ack"), origin: opt(origin) }),
-    // A relay's downstream link closed: the origin's holds are released and its calls aborted.
-    obj({ kind: lit("closed"), origin }),
-    // A revocation from the parent, applied with this host's own `revokedBy` (no origin).
-    obj({ kind: lit("revoke"), revocation: unknown() }),
-    obj({ kind: lit("ping") }),
-    obj({ kind: lit("pong") }),
-    obj({
-        kind: lit("failed"),
-        origin: opt(origin),
-        hold: id,
-        // A failure cause's error in the wire error format (a ChordError, checked by L1's envelope check, or a plugin's).
-        // `waiting`: not the object's fault (no provider, no fitting version, a dependency failed); an event wakes it.
-        cause: obj({ kind: oneOf(...CAUSE_KINDS), error: wireError }),
-        // The rest of the object's backoff window in milliseconds: when it retries by itself (absent: broken, waiting).
-        retryIn: opt(int({ min: 0 })),
-    }),
-    // The failed object of a hold started a new attempt.
-    obj({ kind: lit("loading"), origin: opt(origin), hold: id }),
-    obj({ kind: lit("result"), origin: opt(origin), call: id, value: opt(part), segments }),
-    obj({ kind: lit("error"), origin: opt(origin), call: id, error: wireError }),
-    obj({ kind: lit("gone"), origin: opt(origin), hold: id, error: wireError }),
-]);
-/** The `retired` list of a state entry without retirements, shared (no allocation per message). */
-export const NO_RETIRED = [];
-const MESSAGE_SCHEMA = { schema: MESSAGE };
-/**
- * Checks a decoded message's envelope with the compiled schema (the wire is a trust boundary, after any codec): kinds,
- * ids and indexes, lists and error shapes; not the parts. Throws on a mismatch (a protocol error). Counted in
- * `chord.link.checks`.
- */
-export function checkMessage(message, context) {
-    context.telemetry.metrics?.counter("chord.link.checks").add(1);
-    if (!validatorFor(MESSAGE_SCHEMA, context).check(message))
-        throw new Error("message: fails the message schema");
-    // The check above establishes the type.
-    return message;
-}
-//# sourceMappingURL=message.js.map

package/dist/next/link/message.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"message.js","sourceRoot":"","sources":["../../../src/next/link/message.ts"],"names":[],"mappings":"AAAA,qHAAqH;AACrH,kDAAkD;AAElD,OAAO,EAAE,GAAG,IAAI,OAAO,EAAe,MAAM,2BAA2B,CAAC;AAExE,OAAO,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,KAAK,EAAE,GAAG,EAAe,GAAG,EAAE,KAAK,EAAE,OAAO,EAAE,MAAM,uBAAuB,CAAC;AACzG,OAAO,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAC;AAGnD,4GAA4G;AAC5G,MAAM,EAAE,GAAG,GAAG,CAAC,EAAE,GAAG,EAAE,CAAC,EAAE,CAAC,CAAC;AAE3B;;;;GAIG;AACH,MAAM,MAAM,GAAG,GAAG,CAAC,EAAE,GAAG,EAAE,CAAC,EAAE,CAAC,CAAC;AAE/B,sFAAsF;AACtF,MAAM,KAAK,GAAG,GAAG,CAAC,EAAE,GAAG,EAAE,CAAC,EAAE,CAAC,CAAC;AAE9B,oHAAoH;AACpH,MAAM,SAAS,GAAG,KAAK,CAAC;IACvB,GAAG,CAAC,EAAE,IAAI,EAAE,GAAG,CAAC,OAAO,CAAC,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE,CAAC;IAC7C,GAAG,CAAC,EAAE,IAAI,EAAE,GAAG,CAAC,QAAQ,CAAC,EAAE,IAAI,EAAE,GAAG,EAAE,EAAE,OAAO,EAAE,GAAG,EAAE,EAAE,OAAO,EAAE,GAAG,CAAC,OAAO,EAAE,CAAC,EAAE,CAAC;CAClF,CAAC,CAAC;AAEH,gEAAgE;AAChE,MAAM,MAAM,GAAG,GAAG,CAAC,GAAG,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,KAAK,EAAE,SAAS,EAAE,CAAC,CAAC,CAAC;AAE7D,wGAAwG;AACxG,MAAM,IAAI,GAAG,OAAO,EAAkB,CAAC;AAEvC;;;GAGG;AACH,MAAM,QAAQ,GAAG,GAAG,CAAC,OAAO,EAAmC,CAAC,CAAC;AAEjE,4GAA4G;AAC5G,MAAM,OAAO,GAAG,GAAG,CAAC,EAAE,IAAI,EAAE,GAAG,EAAE,EAAE,MAAM,EAAE,OAAO,EAAE,EAAE,CAAC,CAAC;AAExD,iFAAiF;AACjF,MAAM,SAAS,GAAG,OAAO,CAAC,EAAE,IAAI,EAAE,GAAG,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;AAE3D,wBAAwB;AACxB,MAAM,WAAW,GAAG,GAAG,CAAC,EAAE,OAAO,EAAE,gEAAgE,EAAE,CAAC,CAAC;AAEvG,6FAA6F;AAC7F,MAAM,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;AAExB,uHAAuH;AACvH,MAAM,CAAC,MAAM,UAAU,GAAG,EAAE,CAAC;AAE7B,yHAAyH;AACzH,MAAM,CAAC,MAAM,WAAW,GAAuC,CAAC,WAAW,EAAE,QAAQ,EAAE,SAAS,CAAC,CAAC;AAElG,gGAAgG;AAChG,MAAM,OAAO,GAAG,KAAK,CAAC;IACrB,0EAA0E;IAC1E,GAAG,CAAC,EAAE,IAAI,EAAE,GAAG,CAAC,OAAO,CAAC,EAAE,QAAQ,EAAE,GAAG,CAAC,EAAE,GAAG,EAAE,CAAC,EAAE,CAAC,EAAE,WAAW,EAAE,KAAK,EAAE,GAAG,CAAC,EAAE,GAAG,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC;IAC3F,GAAG,CAAC;QACH,IAAI,EAAE,GAAG,CAAC,MAAM,CAAC;QACjB,MAAM,EAAE,GAAG,CAAC,MAAM,CAAC;QACnB,IAAI,EAAE,EAAE;QACR,IAAI,EAAE,GAAG,EAAE;QACX,OAAO,EAAE,GAAG,CAAC,EAAE,GAAG,EAAE,CAAC,EAAE,CAAC;QACxB,WAAW,EAAE,GAAG,CAAC,EAAE,OAAO,EAAE,gBAAgB,EAAE,CAAC;QAC/C,MAAM,EAAE,IAAI;QACZ,qFAAqF;QACrF,OAAO;QACP,mFAAmF;QACnF,SAAS,EAAE,GAAG,CAAC,SAAS,CAAC;QACzB,WAAW,EAAE,GAAG,CAAC,WAAW,CAAC;QAC7B,+FAA+F;QAC/F,KAAK,EAAE,GAAG,CAAC,GAAG,CAAC,WAAW,EAAE,EAAE,GAAG,EAAE,KAAK,EAAE,CAAC,CAAC;QAC5C,oGAAoG;QACpG,KAAK,EAAE,GAAG,CAAC,GAAG,CAAC,EAAE,GAAG,EAAE,CAAC,EAAE,CAAC,CAAC;KAC3B,CAAC;IACF,GAAG,CAAC,EAAE,IAAI,EAAE,GAAG,CAAC,SAAS,CAAC,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC;IAC5D,GAAG,CAAC,EAAE,IAAI,EAAE,GAAG,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,EAAE,EAAE,IAAI,EAAE,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,GAAG,CAAC,IAAI,CAAC,EAAE,QAAQ,EAAE,CAAC;IAC7G,GAAG,CAAC,EAAE,IAAI,EAAE,GAAG,CAAC,OAAO,CAAC,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC;IAC1D,iHAAiH;IACjH,oHAAoH;IACpH,uBAAuB;IACvB,GAAG,CAAC,EAAE,IAAI,EAAE,GAAG,CAAC,OAAO,CAAC,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,EAAE,EAAE,IAAI,EAAE,GAAG,CAAC,EAAE,GAAG,EAAE,CAAC,EAAE,GAAG,EAAE,UAAU,EAAE,CAAC,EAAE,CAAC;IAClG,gFAAgF;IAChF,GAAG,CAAC;QACH,IAAI,EAAE,GAAG,CAAC,OAAO,CAAC;QAClB,MAAM,EAAE,GAAG,CAAC,MAAM,CAAC;QACnB,KAAK,EAAE,GAAG,CAAC,GAAG,CAAC,EAAE,IAAI,EAAE,EAAE,EAAE,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,GAAG,CAAC,GAAG,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC;KACxG,CAAC;IACF,GAAG,CAAC;QACH,IAAI,EAAE,GAAG,CAAC,OAAO,CAAC;QAClB,MAAM,EAAE,GAAG,CAAC,MAAM,CAAC;QACnB,4GAA4G;QAC5G,mDAAmD;QACnD,KAAK,EAAE,GAAG,CAAC,GAAG,CAAC,EAAE,IAAI,EAAE,EAAE,EAAE,OAAO,EAAE,GAAG,CAAC,GAAG,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,GAAG,EAAE,IAAI,EAAE,CAAC,CAAC,EAAE,MAAM,EAAE,OAAO,EAAE,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;KAC3G,CAAC;IACF,yEAAyE;IACzE,GAAG,CAAC,EAAE,IAAI,EAAE,GAAG,CAAC,KAAK,CAAC,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC;IAC9C,2FAA2F;IAC3F,GAAG,CAAC,EAAE,IAAI,EAAE,GAAG,CAAC,QAAQ,CAAC,EAAE,MAAM,EAAE,CAAC;IACpC,sFAAsF;IACtF,GAAG,CAAC,EAAE,IAAI,EAAE,GAAG,CAAC,QAAQ,CAAC,EAAE,UAAU,EAAE,OAAO,EAAE,EAAE,CAAC;IACnD,GAAG,CAAC,EAAE,IAAI,EAAE,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC;IAC1B,GAAG,CAAC,EAAE,IAAI,EAAE,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC;IAC1B,GAAG,CAAC;QACH,IAAI,EAAE,GAAG,CAAC,QAAQ,CAAC;QACnB,MAAM,EAAE,GAAG,CAAC,MAAM,CAAC;QACnB,IAAI,EAAE,EAAE;QACR,kHAAkH;QAClH,+GAA+G;QAC/G,KAAK,EAAE,GAAG,CAAC,EAAE,IAAI,EAAE,KAAK,CAAC,GAAG,WAAW,CAAC,EAAE,KAAK,EAAE,SAAS,EAAE,CAAC;QAC7D,gHAAgH;QAChH,OAAO,EAAE,GAAG,CAAC,GAAG,CAAC,EAAE,GAAG,EAAE,CAAC,EAAE,CAAC,CAAC;KAC7B,CAAC;IACF,qDAAqD;IACrD,GAAG,CAAC,EAAE,IAAI,EAAE,GAAG,CAAC,SAAS,CAAC,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC;IAC5D,GAAG,CAAC,EAAE,IAAI,EAAE,GAAG,CAAC,QAAQ,CAAC,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,EAAE,EAAE,KAAK,EAAE,GAAG,CAAC,IAAI,CAAC,EAAE,QAAQ,EAAE,CAAC;IACvF,GAAG,CAAC,EAAE,IAAI,EAAE,GAAG,CAAC,OAAO,CAAC,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,EAAE,EAAE,KAAK,EAAE,SAAS,EAAE,CAAC;IAC5E,GAAG,CAAC,EAAE,IAAI,EAAE,GAAG,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,EAAE,EAAE,KAAK,EAAE,SAAS,EAAE,CAAC;CAC3E,CAAC,CAAC;AAsCH,mGAAmG;AACnG,MAAM,CAAC,MAAM,UAAU,GAAsB,EAAE,CAAC;AAgBhD,MAAM,cAAc,GAAG,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC;AAE3C;;;;GAIG;AACH,MAAM,UAAU,YAAY,CAAC,OAAgB,EAAE,OAAgB;IAC9D,OAAO,CAAC,SAAS,CAAC,OAAO,EAAE,OAAO,CAAC,mBAAmB,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;IAC/D,IAAI,CAAC,YAAY,CAAC,cAAc,EAAE,OAAO,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,mCAAmC,CAAC,CAAC;IAChH,wCAAwC;IACxC,OAAO,OAAkB,CAAC;AAC3B,CAAC","sourcesContent":["// Messages (§22, R1, R4, 2b): the one `Message` type every link carries, defined as a schema and checked after every\n// decode, and the codecs that turn it into bytes.\n\nimport { obj as openObj, type Schema } from \"@earendil-works/pi-schema\";\nimport type { Context } from \"../../context/index.ts\";\nimport { arr, int, lit, obj, oneOf, opt, type Static, str, union, unknown } from \"../contracts/index.ts\";\nimport { validatorFor } from \"../data/internal.ts\";\nimport type { Part } from \"./part.ts\";\n\n/** A link-local id, chosen by its origin: a counter, unique per link, direction and origin while in use. */\nconst id = int({ min: 0 });\n\n/**\n * Whose work a message is (decision \"Relay flow control per origin\"): a relay's number for one downstream link (and\n * the origin that link's messages carried), never reused on a link; absent for the sender's own work. Holds, calls,\n * windows and acks are keyed by (origin, id), and replies carry the origin of what they answer.\n */\nconst origin = int({ min: 1 });\n\n/** A name as an index into the hold's bound version (each variant's names sorted). */\nconst index = int({ min: 0 });\n\n/** An error that may come from plugin code: a ChordError's JSON (checked by L1), or a plugin's code and message. */\nconst wireError = union([\n\tobj({ kind: lit(\"chord\"), error: unknown() }),\n\tobj({ kind: lit(\"plugin\"), code: str(), message: str(), details: opt(unknown()) }),\n]);\n\n/** The members of a hold that failed with this message (W1). */\nconst failed = arr(obj({ member: index, error: wireError }));\n\n/** A part's envelope: the codec built it, so any value passes (its content is the owner's to parse). */\nconst part = unknown() as Schema<Part>;\n\n/**\n * The byte segments of a payload part whose method's schema has a `bytes()` leaf, referenced from its JSON by\n * `{\"$bytes\": i}`; absent for every other payload. Built by the codec, like the part.\n */\nconst segments = opt(unknown() as Schema<readonly Uint8Array[]>);\n\n/** An address as a hold names it: its host kind and params, checked against the kind where it is routed. */\nconst address = obj({ kind: str(), params: unknown() });\n\n/** A principal on a hold: JSON with a `kind`, honoured only on a parent link. */\nconst principal = openObj({ kind: str() }, { open: true });\n\n/** A uuidv7 as text. */\nconst incarnation = str({ pattern: \"^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$\" });\n\n/** The longest activation chain a hold carries (Q5): a longer one keeps its last entries. */\nexport const CHAIN = 32;\n\n/** A `retry`'s hop budget as the first host sends it (dependency model §3.7, audit A5): one less per host after it. */\nexport const RETRY_HOPS = 16;\n\n/** The kinds of a `failed` message's cause, in their codes' order (the binary codec's byte, the text codec's letter). */\nexport const CAUSE_KINDS: [\"transient\", \"broken\", \"waiting\"] = [\"transient\", \"broken\", \"waiting\"];\n\n/** The protocol's messages, one tagged union. Parts are opaque here (the owners parse them). */\nconst MESSAGE = union([\n\t// `calls`: how many concurrent calls this side accepts (the call window).\n\tobj({ kind: lit(\"hello\"), protocol: int({ min: 0 }), incarnation, calls: int({ min: 1 }) }),\n\tobj({\n\t\tkind: lit(\"hold\"),\n\t\torigin: opt(origin),\n\t\thold: id,\n\t\ttype: str(),\n\t\tversion: int({ min: 1 }),\n\t\tfingerprint: str({ pattern: \"^[0-9a-f]{16}$\" }),\n\t\tparams: part,\n\t\t// The address the caller computed with the type's `hostAddress`: it routes the hold.\n\t\taddress,\n\t\t// Whom the hold acts for and the origin's incarnation; read only on a parent link.\n\t\tprincipal: opt(principal),\n\t\tincarnation: opt(incarnation),\n\t\t// The instance ids of the activations waiting for this hold (Q5); read only on a trusted link.\n\t\tchain: opt(arr(incarnation, { max: CHAIN })),\n\t\t// The decoded limit per part of the link the hold was admitted on (Q2); read only on a parent link.\n\t\tlimit: opt(int({ min: 0 })),\n\t}),\n\tobj({ kind: lit(\"release\"), origin: opt(origin), hold: id }),\n\tobj({ kind: lit(\"call\"), origin: opt(origin), call: id, hold: id, method: index, args: opt(part), segments }),\n\tobj({ kind: lit(\"abort\"), origin: opt(origin), call: id }),\n\t// Asks the provider for an attempt of a failed hold's object now (`ref.retry()`); `hops` is its budget: the host\n\t// there passes it on to its remote dependencies with one less, never at 0, so a waiting ring of hosts stops. Relays\n\t// forward it as it is.\n\tobj({ kind: lit(\"retry\"), origin: opt(origin), hold: id, hops: int({ min: 1, max: RETRY_HOPS }) }),\n\t// Binds several holds at once (first bindings, re-holds), applied in one batch.\n\tobj({\n\t\tkind: lit(\"bound\"),\n\t\torigin: opt(origin),\n\t\tholds: arr(obj({ hold: id, variant: index, members: arr(obj({ member: index, value: part })), failed })),\n\t}),\n\tobj({\n\t\tkind: lit(\"state\"),\n\t\torigin: opt(origin),\n\t\t// `retired`: the members whose document was retired since the hold's last message (decision \"One retirement\n\t\t// mechanism\"); a `bound` snapshot carries no flag.\n\t\tholds: arr(obj({ hold: id, members: arr(obj({ member: index, ops: part })), failed, retired: arr(index) })),\n\t}),\n\t// One per applied `bound` or `state` message of its origin (the window).\n\tobj({ kind: lit(\"ack\"), origin: opt(origin) }),\n\t// A relay's downstream link closed: the origin's holds are released and its calls aborted.\n\tobj({ kind: lit(\"closed\"), origin }),\n\t// A revocation from the parent, applied with this host's own `revokedBy` (no origin).\n\tobj({ kind: lit(\"revoke\"), revocation: unknown() }),\n\tobj({ kind: lit(\"ping\") }),\n\tobj({ kind: lit(\"pong\") }),\n\tobj({\n\t\tkind: lit(\"failed\"),\n\t\torigin: opt(origin),\n\t\thold: id,\n\t\t// A failure cause's error in the wire error format (a ChordError, checked by L1's envelope check, or a plugin's).\n\t\t// `waiting`: not the object's fault (no provider, no fitting version, a dependency failed); an event wakes it.\n\t\tcause: obj({ kind: oneOf(...CAUSE_KINDS), error: wireError }),\n\t\t// The rest of the object's backoff window in milliseconds: when it retries by itself (absent: broken, waiting).\n\t\tretryIn: opt(int({ min: 0 })),\n\t}),\n\t// The failed object of a hold started a new attempt.\n\tobj({ kind: lit(\"loading\"), origin: opt(origin), hold: id }),\n\tobj({ kind: lit(\"result\"), origin: opt(origin), call: id, value: opt(part), segments }),\n\tobj({ kind: lit(\"error\"), origin: opt(origin), call: id, error: wireError }),\n\tobj({ kind: lit(\"gone\"), origin: opt(origin), hold: id, error: wireError }),\n]);\n\n/**\n * A protocol message. `args` absent: a method without arguments; `value` absent: `null`. A `state` entry's `retired`\n * list is read-only (the schema's type is mutable): entries without retirements share `NO_RETIRED`.\n */\nexport type Message =\n\t| Exclude<WireMessage, WireState>\n\t| (Omit<WireState, \"holds\"> & { readonly holds: readonly StateEntry[] });\n\ntype WireMessage = Static<typeof MESSAGE>;\n\ntype WireState = Extract<WireMessage, { readonly kind: \"state\" }>;\n\n/** An error as it crosses a link. */\nexport type WireError = Static<typeof wireError>;\n\n/** A message that may carry an origin (every kind but `hello`, `revoke`, `ping` and `pong`). */\nexport type OriginMessage = Exclude<Message, { readonly kind: \"hello\" | \"revoke\" | \"ping\" | \"pong\" }>;\n\n/** A message for a provider side: the direction from the consumer (`closed` is the link's). */\nexport type ProviderMessage = Extract<\n\tMessage,\n\t{ readonly kind: \"hold\" | \"release\" | \"call\" | \"abort\" | \"retry\" | \"ack\" }\n>;\n\n/** A message for a consumer side: the direction from the provider. */\nexport type ConsumerMessage = Extract<\n\tMessage,\n\t{ readonly kind: \"bound\" | \"state\" | \"failed\" | \"loading\" | \"result\" | \"error\" | \"gone\" }\n>;\n\n/** One hold's entry of a `bound` message. */\nexport type BoundEntry = Extract<Message, { readonly kind: \"bound\" }>[\"holds\"][number];\n\n/** One hold's entry of a `state` message. */\nexport type StateEntry = Omit<WireState[\"holds\"][number], \"retired\"> & { readonly retired: readonly number[] };\n\n/** The `retired` list of a state entry without retirements, shared (no allocation per message). */\nexport const NO_RETIRED: readonly number[] = [];\n\n/** An address as a `hold` carries it. */\nexport type WireAddress = Static<typeof address>;\n\n/** A member of a hold that failed, by index, as `bound` and `state` list it. */\nexport type FailedMember = Static<typeof failed>[number];\n\n/** How a link turns messages into bytes and back; both ends of a link use the same one. */\nexport interface Codec {\n\treadonly name: string;\n\tencode(message: Message): Uint8Array;\n\t/** Throws on bytes that are no message of this codec (a protocol error); the envelope is checked afterwards. */\n\tdecode(bytes: Uint8Array): Message;\n}\n\nconst MESSAGE_SCHEMA = { schema: MESSAGE };\n\n/**\n * Checks a decoded message's envelope with the compiled schema (the wire is a trust boundary, after any codec): kinds,\n * ids and indexes, lists and error shapes; not the parts. Throws on a mismatch (a protocol error). Counted in\n * `chord.link.checks`.\n */\nexport function checkMessage(message: unknown, context: Context): Message {\n\tcontext.telemetry.metrics?.counter(\"chord.link.checks\").add(1);\n\tif (!validatorFor(MESSAGE_SCHEMA, context).check(message)) throw new Error(\"message: fails the message schema\");\n\t// The check above establishes the type.\n\treturn message as Message;\n}\n"]}

package/dist/next/link/part.d.ts

@@ -1,80 +0,0 @@
-import type { Context } from "../../context/index.ts";
-import { ChordError } from "../data/index.ts";
-/**
- * A part (R1): a value as JSON text at its origin (and after a text decode), its UTF-8 bytes once a binary codec
- * received it (or at an origin that encoded it already), or those bytes deflated by an origin that compresses. Opaque
- * on the way: only the end that owns it opens and parses it, while handling its message (a malformed part is a protocol
- * error then), so a relay forwards it unparsed and still deflated.
- */
-export type Part = string | Uint8Array | DeflatedPart;
-/** What inflating a deflated part gave: its JSON bytes, more than the decoded limit, or data that is no raw deflate. */
-export type Inflated = {
-    readonly kind: "bytes";
-    readonly bytes: Uint8Array;
-} | {
-    readonly kind: "too_large";
-} | {
-    readonly kind: "corrupt";
-    readonly error: unknown;
-};
-/**
- * A JSON part deflated (raw deflate) by its origin. A host without a synchronous compressor inflates it before its
- * owner handles the message (`inflateAsync`) and keeps the outcome here for the owner to open.
- */
-export declare class DeflatedPart {
-    readonly bytes: Uint8Array;
-    /** The asynchronous inflate's outcome; `undefined` until one ran. */
-    inflated: Inflated | undefined;
-    constructor(bytes: Uint8Array);
-}
-/**
- * A synchronous compressor (`createHost({ compression })`; `nodeCompression` for Node). `deflate` is raw deflate at
- * level 1. `inflate` gives at most `limit` bytes (`Infinity`: no limit; 0 allowed), `too_large` when the output would
- * be larger, `corrupt` for data that is no raw deflate stream.
- */
-export interface Compression {
-    deflate(bytes: Uint8Array): Uint8Array;
-    inflate(bytes: Uint8Array, limit: number): Inflated;
-}
-/** A link's limits per part as `accept`, `connect` and `resolve` take them, in bytes. */
-export type PartLimits = {
-    /** A part's size on the wire. */
-    readonly part?: number;
-    /** A part's size after inflating it. */
-    readonly decoded?: number;
-};
-/** A link's limits in force; `Infinity` for none. */
-export type Limits = {
-    readonly part: number;
-    readonly decoded: number;
-};
-/** The limits of a link: the ones set, the defaults of its trust for the others. */
-export declare function linkLimits(trusted: boolean, limits?: PartLimits): Limits;
-/** JSON parts above this many UTF-8 bytes are compressed at their origin (a protocol constant). */
-export declare const COMPRESS_ABOVE: number;
-/**
- * A JSON part at its origin: deflated when the host compresses, its UTF-8 bytes are above `COMPRESS_ABOVE` and
- * deflating made it smaller; otherwise the text, or its bytes once they were encoded (never encoded twice). Counts one
- * deflate (`chord.link.deflates`).
- */
-export declare function originPart(json: string, compression: Compression | undefined, context: Context): Part;
-/**
- * The `too_large/part` error of a part whose size on the wire (its UTF-8 bytes; a deflated part's deflated bytes) is
- * above `limit`; `undefined` within it. Nothing is parsed or inflated.
- */
-export declare function oversized(part: Part, limit: number): ChordError | undefined;
-/**
- * The JSON of a part its owner is about to parse: its size checked against `limits.part` first, then its decoded size
- * against `limits.decoded`, a deflated part inflated within it (synchronously with `compression`, or by the
- * asynchronous inflate that ran ahead of its owner). Throws `too_large/part` past a limit; throws a plain error for a
- * deflated part nothing inflated or that is no raw deflate stream (a protocol error). Counts one synchronous inflate
- * (`chord.link.inflates`).
- */
-export declare function openPart(part: Part, limits: Limits, compression: Compression | undefined, context: Context): string | Uint8Array;
-/**
- * Inflates `part` with the web `DecompressionStream` (a host without a synchronous compressor), counting output bytes
- * and stopping past `limit`; the outcome is kept on the part. `signal` (the link's close) cancels the stream at once,
- * leaving no outcome. Counts one inflate (`chord.link.inflates`).
- */
-export declare function inflateAsync(part: DeflatedPart, limit: number, signal: AbortSignal, context: Context): Promise<void>;
-//# sourceMappingURL=part.d.ts.map

package/dist/next/link/part.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"part.d.ts","sourceRoot":"","sources":["../../../src/next/link/part.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,wBAAwB,CAAC;AACtD,OAAO,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AAE9C;;;;;GAKG;AACH,MAAM,MAAM,IAAI,GAAG,MAAM,GAAG,UAAU,GAAG,YAAY,CAAC;AAEtD,wHAAwH;AACxH,MAAM,MAAM,QAAQ,GACjB;IAAE,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAC;IAAC,QAAQ,CAAC,KAAK,EAAE,UAAU,CAAA;CAAE,GACtD;IAAE,QAAQ,CAAC,IAAI,EAAE,WAAW,CAAA;CAAE,GAC9B;IAAE,QAAQ,CAAC,IAAI,EAAE,SAAS,CAAC;IAAC,QAAQ,CAAC,KAAK,EAAE,OAAO,CAAA;CAAE,CAAC;AAEzD;;;GAGG;AACH,qBAAa,YAAY;IACxB,QAAQ,CAAC,KAAK,EAAE,UAAU,CAAC;IAC3B,qEAAqE;IACrE,QAAQ,EAAE,QAAQ,GAAG,SAAS,CAAC;IAE/B,YAAY,KAAK,EAAE,UAAU,EAE5B;CACD;AAED;;;;GAIG;AACH,MAAM,WAAW,WAAW;IAC3B,OAAO,CAAC,KAAK,EAAE,UAAU,GAAG,UAAU,CAAC;IACvC,OAAO,CAAC,KAAK,EAAE,UAAU,EAAE,KAAK,EAAE,MAAM,GAAG,QAAQ,CAAC;CACpD;AAED,yFAAyF;AACzF,MAAM,MAAM,UAAU,GAAG;IACxB,iCAAiC;IACjC,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC;IACvB,wCAAwC;IACxC,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC;CAC1B,CAAC;AAEF,qDAAqD;AACrD,MAAM,MAAM,MAAM,GAAG;IAAE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAA;CAAE,CAAC;AASzE,oFAAoF;AACpF,wBAAgB,UAAU,CAAC,OAAO,EAAE,OAAO,EAAE,MAAM,GAAE,UAAe,GAAG,MAAM,CAG5E;AAED,mGAAmG;AACnG,eAAO,MAAM,cAAc,QAAY,CAAC;AAIxC;;;;GAIG;AACH,wBAAgB,UAAU,CAAC,IAAI,EAAE,MAAM,EAAE,WAAW,EAAE,WAAW,GAAG,SAAS,EAAE,OAAO,EAAE,OAAO,GAAG,IAAI,CAQrG;AAED;;;GAGG;AACH,wBAAgB,SAAS,CAAC,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,MAAM,GAAG,UAAU,GAAG,SAAS,CAI3E;AAED;;;;;;GAMG;AACH,wBAAgB,QAAQ,CACvB,IAAI,EAAE,IAAI,EACV,MAAM,EAAE,MAAM,EACd,WAAW,EAAE,WAAW,GAAG,SAAS,EACpC,OAAO,EAAE,OAAO,GACd,MAAM,GAAG,UAAU,CAuBrB;AAED;;;;GAIG;AACH,wBAAsB,YAAY,CACjC,IAAI,EAAE,YAAY,EAClB,KAAK,EAAE,MAAM,EACb,MAAM,EAAE,WAAW,EACnB,OAAO,EAAE,OAAO,GACd,OAAO,CAAC,IAAI,CAAC,CAqCf"}

package/dist/next/link/part.js

@@ -1,164 +0,0 @@
-// Parts on links (R1, R2, Q2, §22): a value as it crosses a link (JSON text at its origin, its bytes once received, or
-// deflated by its origin), the size limits per part, compression at the origin, and opening a part where it is owned:
-// its size checked before anything is parsed or inflated, a deflated part inflated within the decoded limit.
-import { ChordError } from "../data/index.js";
-/**
- * A JSON part deflated (raw deflate) by its origin. A host without a synchronous compressor inflates it before its
- * owner handles the message (`inflateAsync`) and keeps the outcome here for the owner to open.
- */
-export class DeflatedPart {
-    bytes;
-    /** The asynchronous inflate's outcome; `undefined` until one ran. */
-    inflated;
-    constructor(bytes) {
-        this.bytes = bytes;
-    }
-}
-const MiB = 1024 * 1024;
-/** The limits of untrusted links unless set (Q2); trusted links (IPC) have none. */
-const UNTRUSTED = { part: 16 * MiB, decoded: 64 * MiB };
-const NONE = { part: Number.POSITIVE_INFINITY, decoded: Number.POSITIVE_INFINITY };
-/** The limits of a link: the ones set, the defaults of its trust for the others. */
-export function linkLimits(trusted, limits = {}) {
-    const defaults = trusted ? NONE : UNTRUSTED;
-    return { part: limits.part ?? defaults.part, decoded: limits.decoded ?? defaults.decoded };
-}
-/** JSON parts above this many UTF-8 bytes are compressed at their origin (a protocol constant). */
-export const COMPRESS_ABOVE = 16 * 1024;
-const UTF8 = new TextEncoder();
-/**
- * A JSON part at its origin: deflated when the host compresses, its UTF-8 bytes are above `COMPRESS_ABOVE` and
- * deflating made it smaller; otherwise the text, or its bytes once they were encoded (never encoded twice). Counts one
- * deflate (`chord.link.deflates`).
- */
-export function originPart(json, compression, context) {
-    // A UTF-16 unit is at most three UTF-8 bytes: a text this short is within the threshold without encoding it.
-    if (compression === undefined || json.length * 3 <= COMPRESS_ABOVE)
-        return json;
-    const bytes = UTF8.encode(json);
-    if (bytes.byteLength <= COMPRESS_ABOVE)
-        return bytes;
-    context.telemetry.metrics?.counter("chord.link.deflates").add(1);
-    const deflated = compression.deflate(bytes);
-    return deflated.byteLength < bytes.byteLength ? new DeflatedPart(deflated) : bytes;
-}
-/**
- * The `too_large/part` error of a part whose size on the wire (its UTF-8 bytes; a deflated part's deflated bytes) is
- * above `limit`; `undefined` within it. Nothing is parsed or inflated.
- */
-export function oversized(part, limit) {
-    if (limit === Number.POSITIVE_INFINITY)
-        return undefined;
-    const size = sizeOf(part);
-    return size > limit ? tooLarge(size, limit, "wire") : undefined;
-}
-/**
- * The JSON of a part its owner is about to parse: its size checked against `limits.part` first, then its decoded size
- * against `limits.decoded`, a deflated part inflated within it (synchronously with `compression`, or by the
- * asynchronous inflate that ran ahead of its owner). Throws `too_large/part` past a limit; throws a plain error for a
- * deflated part nothing inflated or that is no raw deflate stream (a protocol error). Counts one synchronous inflate
- * (`chord.link.inflates`).
- */
-export function openPart(part, limits, compression, context) {
-    const wire = oversized(part, limits.part);
-    if (wire !== undefined)
-        throw wire;
-    if (!(part instanceof DeflatedPart)) {
-        // Not deflated: its decoded size is its size.
-        const size = limits.decoded === Number.POSITIVE_INFINITY ? 0 : sizeOf(part);
-        if (size > limits.decoded)
-            throw tooLarge(size, limits.decoded, "decoded");
-        return part;
-    }
-    let inflated = part.inflated;
-    if (inflated === undefined) {
-        if (compression === undefined)
-            throw new Error("part: a deflated part this host did not inflate");
-        context.telemetry.metrics?.counter("chord.link.inflates").add(1);
-        inflated = compression.inflate(part.bytes, limits.decoded);
-    }
-    switch (inflated.kind) {
-        case "bytes":
-            return inflated.bytes;
-        case "too_large":
-            throw tooLarge(undefined, limits.decoded, "decoded");
-        case "corrupt":
-            throw new Error("part: no raw deflate stream", { cause: inflated.error });
-    }
-}
-/**
- * Inflates `part` with the web `DecompressionStream` (a host without a synchronous compressor), counting output bytes
- * and stopping past `limit`; the outcome is kept on the part. `signal` (the link's close) cancels the stream at once,
- * leaving no outcome. Counts one inflate (`chord.link.inflates`).
- */
-export async function inflateAsync(part, limit, signal, context) {
-    context.telemetry.metrics?.counter("chord.link.inflates").add(1);
-    const reader = new Blob([part.bytes])
-        .stream()
-        .pipeThrough(new DecompressionStream("deflate-raw"))
-        .getReader();
-    // A pending read settles once cancelled: nothing of the stream outlives the link.
-    const cancel = () => void reader.cancel().catch(() => { });
-    signal.addEventListener("abort", cancel, { once: true });
-    const chunks = [];
-    let length = 0;
-    try {
-        for (;;) {
-            const { done, value } = await reader.read();
-            if (done || signal.aborted)
-                break;
-            length += value.byteLength;
-            if (length > limit) {
-                cancel();
-                part.inflated = { kind: "too_large" };
-                return;
-            }
-            chunks.push(value);
-        }
-    }
-    catch (error) {
-        if (!signal.aborted)
-            part.inflated = { kind: "corrupt", error };
-        return;
-    }
-    finally {
-        signal.removeEventListener("abort", cancel);
-    }
-    if (signal.aborted)
-        return;
-    const bytes = new Uint8Array(length);
-    let offset = 0;
-    for (const chunk of chunks) {
-        bytes.set(chunk, offset);
-        offset += chunk.byteLength;
-    }
-    part.inflated = { kind: "bytes", bytes };
-}
-/** A part's size on the wire: its UTF-8 bytes (counted for text, without encoding it). */
-function sizeOf(part) {
-    if (typeof part !== "string")
-        return part instanceof DeflatedPart ? part.bytes.byteLength : part.byteLength;
-    let size = part.length;
-    for (let index = 0; index < part.length; index++) {
-        const unit = part.charCodeAt(index);
-        if (unit < 0x80)
-            continue;
-        if (unit < 0x800)
-            size += 1;
-        else if (unit >= 0xd800 && unit < 0xdc00 && (part.charCodeAt(index + 1) & 0xfc00) === 0xdc00) {
-            // A surrogate pair: four bytes for two units.
-            size += 2;
-            index++;
-        }
-        else
-            size += 2;
-    }
-    return size;
-}
-/** The error of a part past a limit (`size` unknown while inflating). */
-function tooLarge(size, limit, measure) {
-    const what = size === undefined ? "a part" : `a part of ${size} bytes`;
-    const message = `${what} is over the ${measure} limit of ${limit} bytes`;
-    return new ChordError({ code: "too_large", reason: "part", message });
-}
-//# sourceMappingURL=part.js.map

package/dist/next/link/part.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"part.js","sourceRoot":"","sources":["../../../src/next/link/part.ts"],"names":[],"mappings":"AAAA,uHAAuH;AACvH,sHAAsH;AACtH,6GAA6G;AAG7G,OAAO,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AAgB9C;;;GAGG;AACH,MAAM,OAAO,YAAY;IACf,KAAK,CAAa;IAC3B,qEAAqE;IACrE,QAAQ,CAAuB;IAE/B,YAAY,KAAiB;QAC5B,IAAI,CAAC,KAAK,GAAG,KAAK,CAAC;IACpB,CAAC;CACD;AAuBD,MAAM,GAAG,GAAG,IAAI,GAAG,IAAI,CAAC;AAExB,oFAAoF;AACpF,MAAM,SAAS,GAAW,EAAE,IAAI,EAAE,EAAE,GAAG,GAAG,EAAE,OAAO,EAAE,EAAE,GAAG,GAAG,EAAE,CAAC;AAEhE,MAAM,IAAI,GAAW,EAAE,IAAI,EAAE,MAAM,CAAC,iBAAiB,EAAE,OAAO,EAAE,MAAM,CAAC,iBAAiB,EAAE,CAAC;AAE3F,oFAAoF;AACpF,MAAM,UAAU,UAAU,CAAC,OAAgB,EAAE,MAAM,GAAe,EAAE;IACnE,MAAM,QAAQ,GAAG,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC;IAC5C,OAAO,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,IAAI,QAAQ,CAAC,IAAI,EAAE,OAAO,EAAE,MAAM,CAAC,OAAO,IAAI,QAAQ,CAAC,OAAO,EAAE,CAAC;AAC5F,CAAC;AAED,mGAAmG;AACnG,MAAM,CAAC,MAAM,cAAc,GAAG,EAAE,GAAG,IAAI,CAAC;AAExC,MAAM,IAAI,GAAG,IAAI,WAAW,EAAE,CAAC;AAE/B;;;;GAIG;AACH,MAAM,UAAU,UAAU,CAAC,IAAY,EAAE,WAAoC,EAAE,OAAgB;IAC9F,6GAA6G;IAC7G,IAAI,WAAW,KAAK,SAAS,IAAI,IAAI,CAAC,MAAM,GAAG,CAAC,IAAI,cAAc;QAAE,OAAO,IAAI,CAAC;IAChF,MAAM,KAAK,GAAG,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;IAChC,IAAI,KAAK,CAAC,UAAU,IAAI,cAAc;QAAE,OAAO,KAAK,CAAC;IACrD,OAAO,CAAC,SAAS,CAAC,OAAO,EAAE,OAAO,CAAC,qBAAqB,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;IACjE,MAAM,QAAQ,GAAG,WAAW,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;IAC5C,OAAO,QAAQ,CAAC,UAAU,GAAG,KAAK,CAAC,UAAU,CAAC,CAAC,CAAC,IAAI,YAAY,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC;AACpF,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,SAAS,CAAC,IAAU,EAAE,KAAa;IAClD,IAAI,KAAK,KAAK,MAAM,CAAC,iBAAiB;QAAE,OAAO,SAAS,CAAC;IACzD,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC;IAC1B,OAAO,IAAI,GAAG,KAAK,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,EAAE,KAAK,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;AACjE,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,QAAQ,CACvB,IAAU,EACV,MAAc,EACd,WAAoC,EACpC,OAAgB;IAEhB,MAAM,IAAI,GAAG,SAAS,CAAC,IAAI,EAAE,MAAM,CAAC,IAAI,CAAC,CAAC;IAC1C,IAAI,IAAI,KAAK,SAAS;QAAE,MAAM,IAAI,CAAC;IACnC,IAAI,CAAC,CAAC,IAAI,YAAY,YAAY,CAAC,EAAE,CAAC;QACrC,8CAA8C;QAC9C,MAAM,IAAI,GAAG,MAAM,CAAC,OAAO,KAAK,MAAM,CAAC,iBAAiB,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;QAC5E,IAAI,IAAI,GAAG,MAAM,CAAC,OAAO;YAAE,MAAM,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC,OAAO,EAAE,SAAS,CAAC,CAAC;QAC3E,OAAO,IAAI,CAAC;IACb,CAAC;IACD,IAAI,QAAQ,GAAG,IAAI,CAAC,QAAQ,CAAC;IAC7B,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;QAC5B,IAAI,WAAW,KAAK,SAAS;YAAE,MAAM,IAAI,KAAK,CAAC,iDAAiD,CAAC,CAAC;QAClG,OAAO,CAAC,SAAS,CAAC,OAAO,EAAE,OAAO,CAAC,qBAAqB,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;QACjE,QAAQ,GAAG,WAAW,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,EAAE,MAAM,CAAC,OAAO,CAAC,CAAC;IAC5D,CAAC;IACD,QAAQ,QAAQ,CAAC,IAAI,EAAE,CAAC;QACvB,KAAK,OAAO;YACX,OAAO,QAAQ,CAAC,KAAK,CAAC;QACvB,KAAK,WAAW;YACf,MAAM,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC,OAAO,EAAE,SAAS,CAAC,CAAC;QACtD,KAAK,SAAS;YACb,MAAM,IAAI,KAAK,CAAC,6BAA6B,EAAE,EAAE,KAAK,EAAE,QAAQ,CAAC,KAAK,EAAE,CAAC,CAAC;IAC5E,CAAC;AACF,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,YAAY,CACjC,IAAkB,EAClB,KAAa,EACb,MAAmB,EACnB,OAAgB;IAEhB,OAAO,CAAC,SAAS,CAAC,OAAO,EAAE,OAAO,CAAC,qBAAqB,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;IACjE,MAAM,MAAM,GAAG,IAAI,IAAI,CAAC,CAAC,IAAI,CAAC,KAAgC,CAAC,CAAC;SAC9D,MAAM,EAAE;SACR,WAAW,CAAC,IAAI,mBAAmB,CAAC,aAAa,CAAC,CAAC;SACnD,SAAS,EAAE,CAAC;IACd,kFAAkF;IAClF,MAAM,MAAM,GAAG,GAAS,EAAE,CAAC,KAAK,MAAM,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;IAChE,MAAM,CAAC,gBAAgB,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;IACzD,MAAM,MAAM,GAAiB,EAAE,CAAC;IAChC,IAAI,MAAM,GAAG,CAAC,CAAC;IACf,IAAI,CAAC;QACJ,SAAS,CAAC;YACT,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,MAAM,MAAM,CAAC,IAAI,EAAE,CAAC;YAC5C,IAAI,IAAI,IAAI,MAAM,CAAC,OAAO;gBAAE,MAAM;YAClC,MAAM,IAAI,KAAK,CAAC,UAAU,CAAC;YAC3B,IAAI,MAAM,GAAG,KAAK,EAAE,CAAC;gBACpB,MAAM,EAAE,CAAC;gBACT,IAAI,CAAC,QAAQ,GAAG,EAAE,IAAI,EAAE,WAAW,EAAE,CAAC;gBACtC,OAAO;YACR,CAAC;YACD,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACpB,CAAC;IACF,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QAChB,IAAI,CAAC,MAAM,CAAC,OAAO;YAAE,IAAI,CAAC,QAAQ,GAAG,EAAE,IAAI,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC;QAChE,OAAO;IACR,CAAC;YAAS,CAAC;QACV,MAAM,CAAC,mBAAmB,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;IAC7C,CAAC;IACD,IAAI,MAAM,CAAC,OAAO;QAAE,OAAO;IAC3B,MAAM,KAAK,GAAG,IAAI,UAAU,CAAC,MAAM,CAAC,CAAC;IACrC,IAAI,MAAM,GAAG,CAAC,CAAC;IACf,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;QAC5B,KAAK,CAAC,GAAG,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;QACzB,MAAM,IAAI,KAAK,CAAC,UAAU,CAAC;IAC5B,CAAC;IACD,IAAI,CAAC,QAAQ,GAAG,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;AAC1C,CAAC;AAED,0FAA0F;AAC1F,SAAS,MAAM,CAAC,IAAU;IACzB,IAAI,OAAO,IAAI,KAAK,QAAQ;QAAE,OAAO,IAAI,YAAY,YAAY,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC;IAC5G,IAAI,IAAI,GAAG,IAAI,CAAC,MAAM,CAAC;IACvB,KAAK,IAAI,KAAK,GAAG,CAAC,EAAE,KAAK,GAAG,IAAI,CAAC,MAAM,EAAE,KAAK,EAAE,EAAE,CAAC;QAClD,MAAM,IAAI,GAAG,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC;QACpC,IAAI,IAAI,GAAG,IAAI;YAAE,SAAS;QAC1B,IAAI,IAAI,GAAG,KAAK;YAAE,IAAI,IAAI,CAAC,CAAC;aACvB,IAAI,IAAI,IAAI,MAAM,IAAI,IAAI,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,KAAK,GAAG,CAAC,CAAC,GAAG,MAAM,CAAC,KAAK,MAAM,EAAE,CAAC;YAC9F,8CAA8C;YAC9C,IAAI,IAAI,CAAC,CAAC;YACV,KAAK,EAAE,CAAC;QACT,CAAC;;YAAM,IAAI,IAAI,CAAC,CAAC;IAClB,CAAC;IACD,OAAO,IAAI,CAAC;AACb,CAAC;AAED,yEAAyE;AACzE,SAAS,QAAQ,CAAC,IAAwB,EAAE,KAAa,EAAE,OAA2B;IACrF,MAAM,IAAI,GAAG,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,aAAa,IAAI,QAAQ,CAAC;IACvE,MAAM,OAAO,GAAG,GAAG,IAAI,gBAAgB,OAAO,aAAa,KAAK,QAAQ,CAAC;IACzE,OAAO,IAAI,UAAU,CAAC,EAAE,IAAI,EAAE,WAAW,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC,CAAC;AACvE,CAAC","sourcesContent":["// Parts on links (R1, R2, Q2, §22): a value as it crosses a link (JSON text at its origin, its bytes once received, or\n// deflated by its origin), the size limits per part, compression at the origin, and opening a part where it is owned:\n// its size checked before anything is parsed or inflated, a deflated part inflated within the decoded limit.\n\nimport type { Context } from \"../../context/index.ts\";\nimport { ChordError } from \"../data/index.ts\";\n\n/**\n * A part (R1): a value as JSON text at its origin (and after a text decode), its UTF-8 bytes once a binary codec\n * received it (or at an origin that encoded it already), or those bytes deflated by an origin that compresses. Opaque\n * on the way: only the end that owns it opens and parses it, while handling its message (a malformed part is a protocol\n * error then), so a relay forwards it unparsed and still deflated.\n */\nexport type Part = string | Uint8Array | DeflatedPart;\n\n/** What inflating a deflated part gave: its JSON bytes, more than the decoded limit, or data that is no raw deflate. */\nexport type Inflated =\n\t| { readonly kind: \"bytes\"; readonly bytes: Uint8Array }\n\t| { readonly kind: \"too_large\" }\n\t| { readonly kind: \"corrupt\"; readonly error: unknown };\n\n/**\n * A JSON part deflated (raw deflate) by its origin. A host without a synchronous compressor inflates it before its\n * owner handles the message (`inflateAsync`) and keeps the outcome here for the owner to open.\n */\nexport class DeflatedPart {\n\treadonly bytes: Uint8Array;\n\t/** The asynchronous inflate's outcome; `undefined` until one ran. */\n\tinflated: Inflated | undefined;\n\n\tconstructor(bytes: Uint8Array) {\n\t\tthis.bytes = bytes;\n\t}\n}\n\n/**\n * A synchronous compressor (`createHost({ compression })`; `nodeCompression` for Node). `deflate` is raw deflate at\n * level 1. `inflate` gives at most `limit` bytes (`Infinity`: no limit; 0 allowed), `too_large` when the output would\n * be larger, `corrupt` for data that is no raw deflate stream.\n */\nexport interface Compression {\n\tdeflate(bytes: Uint8Array): Uint8Array;\n\tinflate(bytes: Uint8Array, limit: number): Inflated;\n}\n\n/** A link's limits per part as `accept`, `connect` and `resolve` take them, in bytes. */\nexport type PartLimits = {\n\t/** A part's size on the wire. */\n\treadonly part?: number;\n\t/** A part's size after inflating it. */\n\treadonly decoded?: number;\n};\n\n/** A link's limits in force; `Infinity` for none. */\nexport type Limits = { readonly part: number; readonly decoded: number };\n\nconst MiB = 1024 * 1024;\n\n/** The limits of untrusted links unless set (Q2); trusted links (IPC) have none. */\nconst UNTRUSTED: Limits = { part: 16 * MiB, decoded: 64 * MiB };\n\nconst NONE: Limits = { part: Number.POSITIVE_INFINITY, decoded: Number.POSITIVE_INFINITY };\n\n/** The limits of a link: the ones set, the defaults of its trust for the others. */\nexport function linkLimits(trusted: boolean, limits: PartLimits = {}): Limits {\n\tconst defaults = trusted ? NONE : UNTRUSTED;\n\treturn { part: limits.part ?? defaults.part, decoded: limits.decoded ?? defaults.decoded };\n}\n\n/** JSON parts above this many UTF-8 bytes are compressed at their origin (a protocol constant). */\nexport const COMPRESS_ABOVE = 16 * 1024;\n\nconst UTF8 = new TextEncoder();\n\n/**\n * A JSON part at its origin: deflated when the host compresses, its UTF-8 bytes are above `COMPRESS_ABOVE` and\n * deflating made it smaller; otherwise the text, or its bytes once they were encoded (never encoded twice). Counts one\n * deflate (`chord.link.deflates`).\n */\nexport function originPart(json: string, compression: Compression | undefined, context: Context): Part {\n\t// A UTF-16 unit is at most three UTF-8 bytes: a text this short is within the threshold without encoding it.\n\tif (compression === undefined || json.length * 3 <= COMPRESS_ABOVE) return json;\n\tconst bytes = UTF8.encode(json);\n\tif (bytes.byteLength <= COMPRESS_ABOVE) return bytes;\n\tcontext.telemetry.metrics?.counter(\"chord.link.deflates\").add(1);\n\tconst deflated = compression.deflate(bytes);\n\treturn deflated.byteLength < bytes.byteLength ? new DeflatedPart(deflated) : bytes;\n}\n\n/**\n * The `too_large/part` error of a part whose size on the wire (its UTF-8 bytes; a deflated part's deflated bytes) is\n * above `limit`; `undefined` within it. Nothing is parsed or inflated.\n */\nexport function oversized(part: Part, limit: number): ChordError | undefined {\n\tif (limit === Number.POSITIVE_INFINITY) return undefined;\n\tconst size = sizeOf(part);\n\treturn size > limit ? tooLarge(size, limit, \"wire\") : undefined;\n}\n\n/**\n * The JSON of a part its owner is about to parse: its size checked against `limits.part` first, then its decoded size\n * against `limits.decoded`, a deflated part inflated within it (synchronously with `compression`, or by the\n * asynchronous inflate that ran ahead of its owner). Throws `too_large/part` past a limit; throws a plain error for a\n * deflated part nothing inflated or that is no raw deflate stream (a protocol error). Counts one synchronous inflate\n * (`chord.link.inflates`).\n */\nexport function openPart(\n\tpart: Part,\n\tlimits: Limits,\n\tcompression: Compression | undefined,\n\tcontext: Context,\n): string | Uint8Array {\n\tconst wire = oversized(part, limits.part);\n\tif (wire !== undefined) throw wire;\n\tif (!(part instanceof DeflatedPart)) {\n\t\t// Not deflated: its decoded size is its size.\n\t\tconst size = limits.decoded === Number.POSITIVE_INFINITY ? 0 : sizeOf(part);\n\t\tif (size > limits.decoded) throw tooLarge(size, limits.decoded, \"decoded\");\n\t\treturn part;\n\t}\n\tlet inflated = part.inflated;\n\tif (inflated === undefined) {\n\t\tif (compression === undefined) throw new Error(\"part: a deflated part this host did not inflate\");\n\t\tcontext.telemetry.metrics?.counter(\"chord.link.inflates\").add(1);\n\t\tinflated = compression.inflate(part.bytes, limits.decoded);\n\t}\n\tswitch (inflated.kind) {\n\t\tcase \"bytes\":\n\t\t\treturn inflated.bytes;\n\t\tcase \"too_large\":\n\t\t\tthrow tooLarge(undefined, limits.decoded, \"decoded\");\n\t\tcase \"corrupt\":\n\t\t\tthrow new Error(\"part: no raw deflate stream\", { cause: inflated.error });\n\t}\n}\n\n/**\n * Inflates `part` with the web `DecompressionStream` (a host without a synchronous compressor), counting output bytes\n * and stopping past `limit`; the outcome is kept on the part. `signal` (the link's close) cancels the stream at once,\n * leaving no outcome. Counts one inflate (`chord.link.inflates`).\n */\nexport async function inflateAsync(\n\tpart: DeflatedPart,\n\tlimit: number,\n\tsignal: AbortSignal,\n\tcontext: Context,\n): Promise<void> {\n\tcontext.telemetry.metrics?.counter(\"chord.link.inflates\").add(1);\n\tconst reader = new Blob([part.bytes as Uint8Array<ArrayBuffer>])\n\t\t.stream()\n\t\t.pipeThrough(new DecompressionStream(\"deflate-raw\"))\n\t\t.getReader();\n\t// A pending read settles once cancelled: nothing of the stream outlives the link.\n\tconst cancel = (): void => void reader.cancel().catch(() => {});\n\tsignal.addEventListener(\"abort\", cancel, { once: true });\n\tconst chunks: Uint8Array[] = [];\n\tlet length = 0;\n\ttry {\n\t\tfor (;;) {\n\t\t\tconst { done, value } = await reader.read();\n\t\t\tif (done || signal.aborted) break;\n\t\t\tlength += value.byteLength;\n\t\t\tif (length > limit) {\n\t\t\t\tcancel();\n\t\t\t\tpart.inflated = { kind: \"too_large\" };\n\t\t\t\treturn;\n\t\t\t}\n\t\t\tchunks.push(value);\n\t\t}\n\t} catch (error) {\n\t\tif (!signal.aborted) part.inflated = { kind: \"corrupt\", error };\n\t\treturn;\n\t} finally {\n\t\tsignal.removeEventListener(\"abort\", cancel);\n\t}\n\tif (signal.aborted) return;\n\tconst bytes = new Uint8Array(length);\n\tlet offset = 0;\n\tfor (const chunk of chunks) {\n\t\tbytes.set(chunk, offset);\n\t\toffset += chunk.byteLength;\n\t}\n\tpart.inflated = { kind: \"bytes\", bytes };\n}\n\n/** A part's size on the wire: its UTF-8 bytes (counted for text, without encoding it). */\nfunction sizeOf(part: Part): number {\n\tif (typeof part !== \"string\") return part instanceof DeflatedPart ? part.bytes.byteLength : part.byteLength;\n\tlet size = part.length;\n\tfor (let index = 0; index < part.length; index++) {\n\t\tconst unit = part.charCodeAt(index);\n\t\tif (unit < 0x80) continue;\n\t\tif (unit < 0x800) size += 1;\n\t\telse if (unit >= 0xd800 && unit < 0xdc00 && (part.charCodeAt(index + 1) & 0xfc00) === 0xdc00) {\n\t\t\t// A surrogate pair: four bytes for two units.\n\t\t\tsize += 2;\n\t\t\tindex++;\n\t\t} else size += 2;\n\t}\n\treturn size;\n}\n\n/** The error of a part past a limit (`size` unknown while inflating). */\nfunction tooLarge(size: number | undefined, limit: number, measure: \"wire\" | \"decoded\"): ChordError {\n\tconst what = size === undefined ? \"a part\" : `a part of ${size} bytes`;\n\tconst message = `${what} is over the ${measure} limit of ${limit} bytes`;\n\treturn new ChordError({ code: \"too_large\", reason: \"part\", message });\n}\n"]}

package/dist/next/link/text.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"text.d.ts","sourceRoot":"","sources":["../../../src/next/link/text.ts"],"names":[],"mappings":"AAQA,OAAO,EAGN,KAAK,KAAK,EAEV,KAAK,OAAO,EAGZ,MAAM,cAAc,CAAC;AAMtB,0EAA0E;AAC1E,eAAO,MAAM,SAAS,EAAE,KA0BvB,CAAC;AAEF,4GAA4G;AAC5G,wBAAgB,eAAe,CAAC,OAAO,EAAE,OAAO,GAAG,MAAM,CAExD"}