@hypequery/deployment 0.7.5 → 0.9.0

package/README.md

@@ -1,6 +1,6 @@
 # @hypequery/deployment
 
-Provider-neutral building blocks for receiving, verifying, activating, and hosting Hypequery deployment bundles.
+Provider-neutral building blocks for receiving, verifying, activating, and invoking Hypequery deployment bundles.
 
 This package is for Cloud providers and self-hosted control planes. Application teams normally use `hypequery deploy` through `@hypequery/cli` instead.
 
@@ -11,7 +11,7 @@ Every deployment is treated as immutable content. Before storage or execution, t
 - the target-bound release envelope;
 - the closed bundle manifest;
 - declared paths and byte limits;
-- every file hash and artifact reference;
+- every declared file hash and the canonical deployment JSON;
 - deployment, bundle, and release identities;
 - activation revision consistency.
 
@@ -24,10 +24,8 @@ Symbolic links, undeclared files, path traversal, missing content, and identity
 - a durable reference filesystem store;
 - compare-and-swap activation and rollback;
 - Node and Fetch control-plane adapters;
-- immutable runtime materialization;
-- readiness-gated runtime supervision;
-- named-query data-plane execution;
-- a reference single-host composition.
+- contract-driven semantic invocation with an injected dataset executor;
+- authorization-aware contract projection for discovery.
 
 ## Minimal intake
 
@@ -50,33 +48,9 @@ const intake = createDeploymentIntake({
 
 Authentication happens before upload bytes are consumed. The store receives a fully verified temporary bundle and must persist required bytes before returning.
 
-## Single-host reference
-
-```ts
-import { createFileSystemDeploymentHost } from '@hypequery/deployment';
-
-const service = createFileSystemDeploymentHost({
-  directory: '/var/lib/hypequery/deployments',
-  targets: [{ project: 'analytics', environment: 'production' }],
-  intake: {
-    authenticator: deploymentAuthenticator,
-    authorizer: deploymentAuthorizer,
-  },
-  controlPlane: {
-    authenticator: operatorAuthenticator,
-    authorizer: operatorAuthorizer,
-  },
-  configureDataPlane,
-});
-
-await service.start();
-```
-
-Distributed providers can keep the same interfaces while replacing persistence, runtime isolation, secret resolution, routing, and observability.
-
 ## Trust boundary
 
-The reference Node worker manages lifecycle and immutable generations for trusted deployment code; it is not a hostile-code sandbox. The filesystem store assumes its configured directory is controlled by the operator.
+This package validates the deployment contract and gates semantic calls, but does not execute datasets or supervise application code. Providers supply the executor, credentials, tenant resolution, routing, and runtime isolation. The filesystem store assumes its configured directory is controlled by the operator.
 
 ## Specifications
 

package/dist/activation.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"activation.d.ts","sourceRoot":"","sources":["../src/activation.ts"],"names":[],"mappings":"AAYA,OAAO,EAGL,KAAK,iCAAiC,EACtC,KAAK,+BAA+B,EACrC,MAAM,qBAAqB,CAAC;AAe7B,MAAM,MAAM,6BAA6B,GACrC,wCAAwC,GACxC,0CAA0C,GAC1C,4CAA4C,GAC5C,8CAA8C,GAC9C,0CAA0C,GAC1C,wCAAwC,GACxC,6BAA6B,CAAC;AAElC,qBAAa,yBAA0B,SAAQ,KAAK;IAClD,QAAQ,CAAC,IAAI,EAAE,6BAA6B,CAAC;gBAG3C,IAAI,EAAE,6BAA6B,EACnC,OAAO,EAAE,MAAM,EACf,OAAO,GAAE;QAAE,QAAQ,CAAC,KAAK,CAAC,EAAE,OAAO,CAAA;KAAO;CAM7C;AAED,MAAM,WAAW,0BAA0B;IACzC,QAAQ,CAAC,IAAI,EAAE,iCAAiC,CAAC;IACjD,QAAQ,CAAC,OAAO,EAAE,CAAC,CAAC;IACpB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,MAAM,EAAE,+BAA+B,CAAC;IACjD,QAAQ,CAAC,eAAe,EAAE,MAAM,CAAC;IACjC,QAAQ,CAAC,gBAAgB,EAAE,MAAM,GAAG,IAAI,CAAC;IACzC,QAAQ,CAAC,uBAAuB,EAAE,MAAM,GAAG,IAAI,CAAC;IAChD,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;CAC9B;AAED,MAAM,WAAW,2BAA2B;IAC1C,QAAQ,CAAC,MAAM,EAAE,+BAA+B,CAAC;IACjD,QAAQ,CAAC,eAAe,EAAE,MAAM,CAAC;IACjC,6EAA6E;IAC7E,QAAQ,CAAC,gBAAgB,EAAE,MAAM,GAAG,IAAI,CAAC;CAC1C;AAED,MAAM,MAAM,0BAA0B,GAClC;IACA,QAAQ,CAAC,MAAM,EAAE,WAAW,GAAG,gBAAgB,CAAC;IAChD,QAAQ,CAAC,UAAU,EAAE,0BAA0B,CAAC;CACjD,GACC;IACA,QAAQ,CAAC,MAAM,EAAE,UAAU,CAAC;IAC5B,QAAQ,CAAC,OAAO,EAAE,0BAA0B,GAAG,IAAI,CAAC;CACrD,CAAC;AAEJ,MAAM,WAAW,gCAAgC;IAC/C,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;CAC1B;AAED,MAAM,WAAW,+BAA+B;IAC9C,QAAQ,CAAC,WAAW,EAAE,SAAS,0BAA0B,EAAE,CAAC;IAC5D,QAAQ,CAAC,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;CACpC;AAED,MAAM,WAAW,2BAA2B;IAC1C,QAAQ,CAAC,OAAO,EAAE,iCAAiC,CAAC;IACpD,QAAQ,CAAC,eAAe,EAAE,MAAM,CAAC;CAClC;AAED,MAAM,WAAW,uBAAuB;IACtC,6FAA6F;IAC7F,IAAI,CAAC,eAAe,EAAE,MAAM,GAAG,OAAO,CAAC,2BAA2B,GAAG,SAAS,CAAC,CAAC;CACjF;AAED,MAAM,WAAW,6CAA6C;IAC5D,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,QAAQ,EAAE,uBAAuB,CAAC;IAC3C,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,IAAI,CAAC;CAC7B;AAED,MAAM,WAAW,4BAA4B;IAC3C,QAAQ,CAAC,OAAO,EAAE,2BAA2B,GAAG,OAAO,CAAC,0BAA0B,CAAC,CAAC;IACpF,OAAO,CACL,MAAM,EAAE,+BAA+B,GACtC,OAAO,CAAC,0BAA0B,GAAG,SAAS,CAAC,CAAC;IACnD,OAAO,CACL,MAAM,EAAE,+BAA+B,GACtC,OAAO,CAAC,SAAS,0BAA0B,EAAE,CAAC,CAAC;IAClD,WAAW,CACT,MAAM,EAAE,+BAA+B,EACvC,KAAK,EAAE,gCAAgC,GACtC,OAAO,CAAC,+BAA+B,CAAC,CAAC;CAC7C;AAuMD,wEAAwE;AACxE,wBAAgB,kCAAkC,CAAC,KAAK,EAAE,OAAO,GAAG,0BAA0B,CAE7F;AAmVD,wBAAgB,4CAA4C,CAC1D,OAAO,EAAE,6CAA6C,GACrD,4BAA4B,CAwO9B"}
+{"version":3,"file":"activation.d.ts","sourceRoot":"","sources":["../src/activation.ts"],"names":[],"mappings":"AAYA,OAAO,EAGL,KAAK,iCAAiC,EACtC,KAAK,+BAA+B,EACrC,MAAM,qBAAqB,CAAC;AAgB7B,MAAM,MAAM,6BAA6B,GACrC,wCAAwC,GACxC,0CAA0C,GAC1C,4CAA4C,GAC5C,8CAA8C,GAC9C,0CAA0C,GAC1C,wCAAwC,GACxC,6BAA6B,CAAC;AAElC,qBAAa,yBAA0B,SAAQ,KAAK;IAClD,QAAQ,CAAC,IAAI,EAAE,6BAA6B,CAAC;gBAG3C,IAAI,EAAE,6BAA6B,EACnC,OAAO,EAAE,MAAM,EACf,OAAO,GAAE;QAAE,QAAQ,CAAC,KAAK,CAAC,EAAE,OAAO,CAAA;KAAO;CAM7C;AAED,MAAM,WAAW,0BAA0B;IACzC,QAAQ,CAAC,IAAI,EAAE,iCAAiC,CAAC;IACjD,QAAQ,CAAC,OAAO,EAAE,CAAC,CAAC;IACpB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,MAAM,EAAE,+BAA+B,CAAC;IACjD,QAAQ,CAAC,eAAe,EAAE,MAAM,CAAC;IACjC,QAAQ,CAAC,gBAAgB,EAAE,MAAM,GAAG,IAAI,CAAC;IACzC,QAAQ,CAAC,uBAAuB,EAAE,MAAM,GAAG,IAAI,CAAC;IAChD,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;CAC9B;AAED,MAAM,WAAW,2BAA2B;IAC1C,QAAQ,CAAC,MAAM,EAAE,+BAA+B,CAAC;IACjD,QAAQ,CAAC,eAAe,EAAE,MAAM,CAAC;IACjC,6EAA6E;IAC7E,QAAQ,CAAC,gBAAgB,EAAE,MAAM,GAAG,IAAI,CAAC;CAC1C;AAED,MAAM,MAAM,0BAA0B,GAClC;IACA,QAAQ,CAAC,MAAM,EAAE,WAAW,GAAG,gBAAgB,CAAC;IAChD,QAAQ,CAAC,UAAU,EAAE,0BAA0B,CAAC;CACjD,GACC;IACA,QAAQ,CAAC,MAAM,EAAE,UAAU,CAAC;IAC5B,QAAQ,CAAC,OAAO,EAAE,0BAA0B,GAAG,IAAI,CAAC;CACrD,CAAC;AAEJ,MAAM,WAAW,gCAAgC;IAC/C,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;CAC1B;AAED,MAAM,WAAW,+BAA+B;IAC9C,QAAQ,CAAC,WAAW,EAAE,SAAS,0BAA0B,EAAE,CAAC;IAC5D,QAAQ,CAAC,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;CACpC;AAED,MAAM,WAAW,2BAA2B;IAC1C,QAAQ,CAAC,OAAO,EAAE,iCAAiC,CAAC;IACpD,QAAQ,CAAC,eAAe,EAAE,MAAM,CAAC;CAClC;AAED,MAAM,WAAW,uBAAuB;IACtC,6FAA6F;IAC7F,IAAI,CAAC,eAAe,EAAE,MAAM,GAAG,OAAO,CAAC,2BAA2B,GAAG,SAAS,CAAC,CAAC;CACjF;AAED,MAAM,WAAW,6CAA6C;IAC5D,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,QAAQ,EAAE,uBAAuB,CAAC;IAC3C,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,IAAI,CAAC;CAC7B;AAED,MAAM,WAAW,4BAA4B;IAC3C,QAAQ,CAAC,OAAO,EAAE,2BAA2B,GAAG,OAAO,CAAC,0BAA0B,CAAC,CAAC;IACpF,OAAO,CACL,MAAM,EAAE,+BAA+B,GACtC,OAAO,CAAC,0BAA0B,GAAG,SAAS,CAAC,CAAC;IACnD,OAAO,CACL,MAAM,EAAE,+BAA+B,GACtC,OAAO,CAAC,SAAS,0BAA0B,EAAE,CAAC,CAAC;IAClD,WAAW,CACT,MAAM,EAAE,+BAA+B,EACvC,KAAK,EAAE,gCAAgC,GACtC,OAAO,CAAC,+BAA+B,CAAC,CAAC;CAC7C;AAuMD,wEAAwE;AACxE,wBAAgB,kCAAkC,CAAC,KAAK,EAAE,OAAO,GAAG,0BAA0B,CAE7F;AAqVD,wBAAgB,4CAA4C,CAC1D,OAAO,EAAE,6CAA6C,GACrD,4BAA4B,CAwO9B"}

package/dist/activation.js

@@ -3,6 +3,7 @@ import { constants } from 'node:fs';
 import { lstat, mkdir, mkdtemp, open, readdir, rename, rm, } from 'node:fs/promises';
 import path from 'node:path';
 import { prepareProtocolDeploymentReleaseEnvelope, validateProtocolDeploymentReleaseTarget, } from '@hypequery/protocol';
+import { readBoundedFile } from './utils/read-bounded-file.js';
 const ACTIVATION_FILE = 'activation.json';
 const CLAIMS_DIRECTORY = 'claims';
 // Each predecessor has one filesystem slot for its successor. Renaming a
@@ -242,7 +243,7 @@ async function readRegularFile(filePath, maximumBytes) {
         if (!stat.isFile() || stat.size < 1 || stat.size > maximumBytes) {
             throw new Error(`Stored entry is not a bounded regular file: ${filePath}`);
         }
-        return await handle.readFile();
+        return await readBoundedFile(handle, maximumBytes, 1, `Stored entry is not a bounded regular file: ${filePath}`);
     }
     finally {
         await handle.close();

package/dist/authorized-contract.d.ts

@@ -0,0 +1,72 @@
+/**
+ * What one principal is allowed to see of a deployment contract.
+ *
+ * Discovery and execution must agree about who may reach what. The data plane
+ * already decides that per call, from the endpoint policy on the target; a
+ * gateway listing tools has to make the same decision over the whole contract,
+ * before any call exists. Restating the rule there would put an authorization
+ * predicate in two packages, and the copy that drifts is the one that leaks.
+ *
+ * The projection narrows, never widens: it can remove a target a principal may
+ * not reach, and can never add one or loosen a policy. Feeding the result to
+ * catalog projection or schema compilation therefore cannot advertise something
+ * execution would refuse.
+ */
+import type { ProtocolAccessPolicy, ProtocolDeploymentContract, ProtocolEndpointPolicy } from '@hypequery/protocol';
+import type { DeploymentDataPlanePrincipal } from './principal.js';
+/**
+ * Whether a principal satisfies an access policy.
+ *
+ * Shares `missing` with the semantic data plane rather than restating it, which
+ * is the whole point of this module existing in Core: one predicate, so
+ * discovery cannot come to answer differently than execution.
+ */
+export declare function satisfiesDeploymentAccess(access: ProtocolAccessPolicy, principal: DeploymentDataPlanePrincipal | null): boolean;
+/** Whether a principal may reach a target published under this endpoint policy. */
+export declare function isDeploymentEndpointAuthorized(endpoint: ProtocolEndpointPolicy | undefined, principal: DeploymentDataPlanePrincipal | null): boolean;
+export interface AuthorizedDeploymentProjection {
+    /**
+     * A valid contract narrowed to what the principal may see, including any
+     * dataset retained only to support a join.
+     */
+    readonly contract: ProtocolDeploymentContract;
+    /**
+     * Datasets addressable as a `query_dataset` target, in contract order.
+     *
+     * Narrower than `contract.datasets`, which also holds datasets retained only
+     * to support a join. Always read this before advertising anything: catalog
+     * projection and rehydration enumerate every dataset they are given and
+     * neither consults an endpoint, so handing them the whole contract would
+     * advertise a supporting dataset and disclose its shape to a principal with
+     * no access to it.
+     */
+    readonly queryable: readonly string[];
+}
+/**
+ * Projects the contract down to what `principal` may see.
+ *
+ * A dataset is *published* when the principal may address it directly, and
+ * *supporting* when something published still needs it to stay coherent — the
+ * target of a relationship. A supporting dataset loses its endpoint and keeps
+ * only what a join reaches, so a relationship can still be traversed exactly as
+ * execution would traverse it while the dataset itself is not offered as a
+ * target.
+ *
+ * Dropping a relationship target instead would be the tempting alternative and
+ * is wrong twice: it would invalidate the relationship that names it, and it
+ * would advertise less than the data plane permits, since a one-hop join is
+ * governed by the endpoint of the dataset being queried, not by the target's.
+ *
+ * The contract and the target list are returned separately rather than as one
+ * contract because nothing downstream reads an endpoint.
+ * `projectAgentSafeCatalog` and `rehydrateProtocolDatasets` enumerate whatever
+ * they are handed, so an unpublished dataset left in the contract they see is
+ * an advertised one.
+ *
+ * The contract is revalidated. Callers hand it to catalog projection, schema
+ * compilation, and rehydration, all of which assume a valid contract; a
+ * projection that could emit an invalid one would move that failure to whatever
+ * read it next.
+ */
+export declare function projectAuthorizedDeploymentContract(contract: ProtocolDeploymentContract, principal: DeploymentDataPlanePrincipal | null): AuthorizedDeploymentProjection;
+//# sourceMappingURL=authorized-contract.d.ts.map

package/dist/authorized-contract.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"authorized-contract.d.ts","sourceRoot":"","sources":["../src/authorized-contract.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAEH,OAAO,KAAK,EACV,oBAAoB,EACpB,0BAA0B,EAE1B,sBAAsB,EACvB,MAAM,qBAAqB,CAAC;AAE7B,OAAO,KAAK,EAAE,4BAA4B,EAAE,MAAM,gBAAgB,CAAC;AAGnE;;;;;;GAMG;AACH,wBAAgB,yBAAyB,CACvC,MAAM,EAAE,oBAAoB,EAC5B,SAAS,EAAE,4BAA4B,GAAG,IAAI,GAC7C,OAAO,CAIT;AAED,mFAAmF;AACnF,wBAAgB,8BAA8B,CAC5C,QAAQ,EAAE,sBAAsB,GAAG,SAAS,EAC5C,SAAS,EAAE,4BAA4B,GAAG,IAAI,GAC7C,OAAO,CAKT;AAkCD,MAAM,WAAW,8BAA8B;IAC7C;;;OAGG;IACH,QAAQ,CAAC,QAAQ,EAAE,0BAA0B,CAAC;IAC9C;;;;;;;;;OASG;IACH,QAAQ,CAAC,SAAS,EAAE,SAAS,MAAM,EAAE,CAAC;CACvC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,wBAAgB,mCAAmC,CACjD,QAAQ,EAAE,0BAA0B,EACpC,SAAS,EAAE,4BAA4B,GAAG,IAAI,GAC7C,8BAA8B,CA2ChC"}

package/dist/authorized-contract.js

@@ -0,0 +1,132 @@
+/**
+ * What one principal is allowed to see of a deployment contract.
+ *
+ * Discovery and execution must agree about who may reach what. The data plane
+ * already decides that per call, from the endpoint policy on the target; a
+ * gateway listing tools has to make the same decision over the whole contract,
+ * before any call exists. Restating the rule there would put an authorization
+ * predicate in two packages, and the copy that drifts is the one that leaks.
+ *
+ * The projection narrows, never widens: it can remove a target a principal may
+ * not reach, and can never add one or loosen a policy. Feeding the result to
+ * catalog projection or schema compilation therefore cannot advertise something
+ * execution would refuse.
+ */
+import { validateProtocolDeploymentContract } from '@hypequery/protocol';
+import { missing } from './utils/required-access.js';
+/**
+ * Whether a principal satisfies an access policy.
+ *
+ * Shares `missing` with the semantic data plane rather than restating it, which
+ * is the whole point of this module existing in Core: one predicate, so
+ * discovery cannot come to answer differently than execution.
+ */
+export function satisfiesDeploymentAccess(access, principal) {
+    if (access.kind === 'public')
+        return true;
+    if (!principal)
+        return false;
+    return !missing(access.roles, principal.roles) && !missing(access.scopes, principal.scopes);
+}
+/** Whether a principal may reach a target published under this endpoint policy. */
+export function isDeploymentEndpointAuthorized(endpoint, principal) {
+    // An absent endpoint is not a permissive one. A contract may describe a
+    // dataset it never published, and an unpublished target is unreachable for
+    // everyone — which is how the data plane's own target resolution reads it.
+    return endpoint !== undefined && satisfiesDeploymentAccess(endpoint.access, principal);
+}
+/**
+ * Narrows a dataset retained only to support a join.
+ *
+ * The principal cannot address this dataset, so advertising it whole would
+ * publish the name and type of every dimension, filter, and measure on it.
+ * What a join actually reaches is the target's dimensions — `resolveDataset`
+ * offers each groupable one as `<relationship>.<name>` and each filterable one
+ * under the full operator set — so those stay and everything else goes.
+ *
+ * A dataset no queryable relationship reaches keeps nothing but its time field,
+ * which the planner reads for every grained query. It is retained at all only
+ * because a relationship names it and the contract would not validate without
+ * it.
+ */
+function narrowToJoin(dataset, reachable) {
+    // `defaults` describes how to query the dataset directly, which is exactly
+    // what this principal may not do.
+    const { defaults: _defaults, endpoint: _endpoint, ...rest } = dataset;
+    const timeField = dataset.timeField === undefined ? undefined : String(dataset.timeField);
+    return {
+        ...rest,
+        dimensions: reachable
+            ? dataset.dimensions
+            : dataset.dimensions.filter(dimension => String(dimension.name) === timeField),
+        measures: [],
+        filters: [],
+    };
+}
+/**
+ * Projects the contract down to what `principal` may see.
+ *
+ * A dataset is *published* when the principal may address it directly, and
+ * *supporting* when something published still needs it to stay coherent — the
+ * target of a relationship. A supporting dataset loses its endpoint and keeps
+ * only what a join reaches, so a relationship can still be traversed exactly as
+ * execution would traverse it while the dataset itself is not offered as a
+ * target.
+ *
+ * Dropping a relationship target instead would be the tempting alternative and
+ * is wrong twice: it would invalidate the relationship that names it, and it
+ * would advertise less than the data plane permits, since a one-hop join is
+ * governed by the endpoint of the dataset being queried, not by the target's.
+ *
+ * The contract and the target list are returned separately rather than as one
+ * contract because nothing downstream reads an endpoint.
+ * `projectAgentSafeCatalog` and `rehydrateProtocolDatasets` enumerate whatever
+ * they are handed, so an unpublished dataset left in the contract they see is
+ * an advertised one.
+ *
+ * The contract is revalidated. Callers hand it to catalog projection, schema
+ * compilation, and rehydration, all of which assume a valid contract; a
+ * projection that could emit an invalid one would move that failure to whatever
+ * read it next.
+ */
+export function projectAuthorizedDeploymentContract(contract, principal) {
+    const byName = new Map(contract.datasets.map(dataset => [String(dataset.name), dataset]));
+    const published = new Set(contract.datasets
+        .filter(dataset => isDeploymentEndpointAuthorized(dataset.endpoint, principal))
+        .map(dataset => String(dataset.name)));
+    const required = new Set();
+    const require = (name) => {
+        if (required.has(name) || !byName.has(name))
+            return;
+        required.add(name);
+        // Transitive: a retained target has relationships of its own, and every
+        // target named in the contract has to still be there for it to validate.
+        for (const relationship of byName.get(name).relationships) {
+            require(String(relationship.target));
+        }
+    };
+    for (const name of published)
+        require(name);
+    // What each dataset is reachable *as a join target* for. Reach extends one
+    // queryable hop — `resolveDataset` does not recurse — and only from a dataset
+    // the principal can address, so a dataset retained purely so the contract
+    // validates passes none of it on.
+    const reachable = new Set();
+    for (const name of published) {
+        for (const relationship of byName.get(name).relationships) {
+            if (relationship.queryable)
+                reachable.add(String(relationship.target));
+        }
+    }
+    const datasets = contract.datasets
+        .filter(dataset => required.has(String(dataset.name)))
+        .map(dataset => (published.has(String(dataset.name))
+        ? dataset
+        : narrowToJoin(dataset, reachable.has(String(dataset.name)))));
+    return Object.freeze({
+        contract: validateProtocolDeploymentContract({ ...contract, datasets }),
+        queryable: Object.freeze(datasets
+            .filter(dataset => published.has(String(dataset.name)))
+            .map(dataset => String(dataset.name))),
+    });
+}

package/dist/bundle.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"bundle.d.ts","sourceRoot":"","sources":["../src/bundle.ts"],"names":[],"mappings":"AAQA,OAAO,EAKL,KAAK,gCAAgC,EACrC,KAAK,0BAA0B,EAChC,MAAM,qBAAqB,CAAC;AAE7B,eAAO,MAAM,0BAA0B,gBAAgB,CAAC;AACxD,eAAO,MAAM,0BAA0B,oBAAoB,CAAC;AAE5D,MAAM,WAAW,wBAAwB;IACvC,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,QAAQ,EAAE,gCAAgC,CAAC;IACpD,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,QAAQ,EAAE,0BAA0B,CAAC;CAC/C;AAsKD,wBAAsB,sBAAsB,CAC1C,eAAe,EAAE,MAAM,GACtB,OAAO,CAAC,wBAAwB,CAAC,CAwEnC"}
+{"version":3,"file":"bundle.d.ts","sourceRoot":"","sources":["../src/bundle.ts"],"names":[],"mappings":"AAQA,OAAO,EAIL,KAAK,gCAAgC,EACrC,KAAK,0BAA0B,EAChC,MAAM,qBAAqB,CAAC;AAG7B,eAAO,MAAM,0BAA0B,gBAAgB,CAAC;AACxD,eAAO,MAAM,0BAA0B,oBAAoB,CAAC;AAE5D,MAAM,WAAW,wBAAwB;IACvC,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,QAAQ,EAAE,gCAAgC,CAAC;IACpD,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,QAAQ,EAAE,0BAA0B,CAAC;CAC/C;AAkID,wBAAsB,sBAAsB,CAC1C,eAAe,EAAE,MAAM,GACtB,OAAO,CAAC,wBAAwB,CAAC,CAqEnC"}

package/dist/bundle.js

@@ -2,6 +2,7 @@ import { createHash } from 'node:crypto';
 import { constants, lstat, open, readdir, } from 'node:fs/promises';
 import path from 'node:path';
 import { DEFAULT_PROTOCOL_DEPLOYMENT_BUNDLE_LIMITS, prepareProtocolDeploymentBundleManifest, prepareProtocolDeploymentContract, } from '@hypequery/protocol';
+import { readBoundedFile } from './utils/read-bounded-file.js';
 export const DEPLOYMENT_BUNDLE_MANIFEST = 'bundle.json';
 export const DEPLOYMENT_BUNDLE_CONTRACT = 'deployment.json';
 const utf8Decoder = new TextDecoder('utf-8', { fatal: true });
@@ -35,7 +36,7 @@ async function readBoundedRegularFile(root, relativePath, maximum, allowEmpty =
         if (stat.size < (allowEmpty ? 0 : 1) || stat.size > maximum) {
             throw new Error(`Bundle entry exceeds its byte limit: ${relativePath}`);
         }
-        return await handle.readFile();
+        return await readBoundedFile(handle, maximum, allowEmpty ? 0 : 1, `Bundle entry exceeds its byte limit: ${relativePath}`);
     }
     catch (error) {
         if (errorCode(error) === 'ELOOP') {
@@ -58,11 +59,11 @@ function expectedDirectories(files) {
     return result;
 }
 async function verifyExactEntries(root, manifest) {
+    const source = manifest.source;
     const expectedFiles = new Set([
         DEPLOYMENT_BUNDLE_MANIFEST,
         manifest.deployment.path,
-        ...manifest.artifacts.map(artifact => artifact.path),
-        ...(manifest.source?.files.map(file => `${manifest.source.root}/${file.path}`) ?? []),
+        ...(source?.files.map(file => `${source.root}/${file.path}`) ?? []),
     ]);
     const expectedDirectoryPaths = expectedDirectories([...expectedFiles]);
     const seenFiles = new Set();
@@ -116,34 +117,6 @@ function verifyFile(bytes, file) {
         throw new Error(`Bundle entry SHA-256 does not match the manifest: ${file.path}`);
     }
 }
-function requireClosedContractArtifactSet(contract) {
-    const referenced = new Map();
-    for (const query of contract.queries) {
-        if (query.implementation.kind === 'runtime-reference') {
-            referenced.set(query.implementation.artifactSha256, query.implementation.runtime);
-        }
-    }
-    if (referenced.size !== contract.artifacts.length) {
-        throw new Error('Deployment contract contains missing or unreferenced runtime artifacts.');
-    }
-    for (const artifact of contract.artifacts) {
-        if (referenced.get(artifact.artifactSha256) !== artifact.runtime) {
-            throw new Error(`Deployment runtime artifact ${artifact.artifactSha256} is not referenced by a named query.`);
-        }
-    }
-}
-function verifyRuntimeReferences(contract, artifacts) {
-    requireClosedContractArtifactSet(contract);
-    const declared = new Map(contract.artifacts.map(artifact => [artifact.artifactSha256, artifact.runtime]));
-    if (declared.size !== artifacts.length) {
-        throw new Error('Bundle runtime artifacts do not match the deployment contract.');
-    }
-    for (const artifact of artifacts) {
-        if (declared.get(artifact.sha256) !== artifact.runtime) {
-            throw new Error(`Bundle artifact ${artifact.sha256} does not match a deployment runtime reference.`);
-        }
-    }
-}
 export async function verifyDeploymentBundle(bundleDirectory) {
     const root = path.resolve(bundleDirectory);
     const rootStat = await lstat(root);
@@ -160,6 +133,9 @@ export async function verifyDeploymentBundle(bundleDirectory) {
             + (error instanceof Error ? error.message : String(error)));
     }
     const preparedManifest = prepareProtocolDeploymentBundleManifest(input);
+    if (preparedManifest.manifest.artifacts.length > 0) {
+        throw new Error('A deployment bundle cannot contain runtime artifacts.');
+    }
     const expectedManifestBytes = utf8Encoder.encode(`${preparedManifest.canonical}\n`);
     if (!Buffer.from(manifestBytes).equals(Buffer.from(expectedManifestBytes))) {
         throw new Error('Deployment bundle manifest must contain canonical JSON followed by one newline.');
@@ -177,13 +153,12 @@ export async function verifyDeploymentBundle(bundleDirectory) {
             + (error instanceof Error ? error.message : String(error)));
     }
     const preparedContract = prepareProtocolDeploymentContract(contractInput);
+    if (!Buffer.from(deploymentBytes).equals(Buffer.from(`${preparedContract.canonical}\n`))) {
+        throw new Error('Deployment JSON must contain canonical JSON followed by one newline.');
+    }
     if (preparedContract.identity !== deployment.identity) {
         throw new Error('Deployment identity does not match the bundle manifest.');
     }
-    for (const artifact of preparedManifest.manifest.artifacts) {
-        const bytes = await readBoundedRegularFile(root, artifact.path, DEFAULT_PROTOCOL_DEPLOYMENT_BUNDLE_LIMITS.maxArtifactBytes);
-        verifyFile(bytes, artifact);
-    }
     const source = preparedManifest.manifest.source;
     if (source) {
         for (const file of source.files) {
@@ -192,7 +167,6 @@ export async function verifyDeploymentBundle(bundleDirectory) {
             verifyFile(bytes, { ...file, path: bundlePath });
         }
     }
-    verifyRuntimeReferences(preparedContract.contract, preparedManifest.manifest.artifacts);
     return Object.freeze({
         directory: root,
         manifest: preparedManifest.manifest,

package/dist/control-plane-limits.js

@@ -10,7 +10,7 @@ export function resolveDeploymentControlPlaneLimits(input = {}) {
             continue;
         if (!Number.isSafeInteger(value) || value < 1
             || value > DEFAULT_DEPLOYMENT_CONTROL_PLANE_LIMITS[key]) {
-            throw new RangeError(`${key} must be a positive safe integer no greater than the control-plane v1 maximum`);
+            throw new RangeError(`${key} must be a positive safe integer no greater than the control-plane safety ceiling`);
         }
         limits[key] = value;
     }

package/dist/filesystem-store.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"filesystem-store.d.ts","sourceRoot":"","sources":["../src/filesystem-store.ts"],"names":[],"mappings":"AAWA,OAAO,EAEL,KAAK,iCAAiC,EACvC,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EAGL,KAAK,wBAAwB,EAC9B,MAAM,aAAa,CAAC;AACrB,OAAO,KAAK,EACV,yBAAyB,EAE1B,MAAM,YAAY,CAAC;AASpB,MAAM,MAAM,kCAAkC,GAC1C,mCAAmC,GACnC,wCAAwC,GACxC,mCAAmC,GACnC,wBAAwB,CAAC;AAE7B,qBAAa,8BAA+B,SAAQ,KAAK;IACvD,QAAQ,CAAC,IAAI,EAAE,kCAAkC,CAAC;gBAGhD,IAAI,EAAE,kCAAkC,EACxC,OAAO,EAAE,MAAM,EACf,OAAO,GAAE;QAAE,QAAQ,CAAC,KAAK,CAAC,EAAE,OAAO,CAAA;KAAO;CAM7C;AAED,MAAM,WAAW,0CAA0C;IACzD,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;CAC5B;AAED,MAAM,WAAW,0BAA0B;IACzC,QAAQ,CAAC,gBAAgB,EAAE,MAAM,CAAC;IAClC,QAAQ,CAAC,OAAO,EAAE,iCAAiC,CAAC;IACpD,QAAQ,CAAC,gBAAgB,EAAE,MAAM,CAAC;IAClC,QAAQ,CAAC,eAAe,EAAE,MAAM,CAAC;IACjC,QAAQ,CAAC,MAAM,EAAE,wBAAwB,CAAC;CAC3C;AAED,MAAM,WAAW,mCAAmC,CAAC,SAAS,CAC5D,SAAQ,yBAAyB,CAAC,SAAS,CAAC;IAC5C,IAAI,CAAC,eAAe,EAAE,MAAM,GAAG,OAAO,CAAC,0BAA0B,GAAG,SAAS,CAAC,CAAC;CAChF;AAobD,wBAAgB,yCAAyC,CAAC,SAAS,GAAG,OAAO,EAC3E,OAAO,EAAE,0CAA0C,GAClD,mCAAmC,CAAC,SAAS,CAAC,CAkHhD"}
+{"version":3,"file":"filesystem-store.d.ts","sourceRoot":"","sources":["../src/filesystem-store.ts"],"names":[],"mappings":"AAWA,OAAO,EAEL,KAAK,iCAAiC,EACvC,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EAGL,KAAK,wBAAwB,EAC9B,MAAM,aAAa,CAAC;AACrB,OAAO,KAAK,EACV,yBAAyB,EAE1B,MAAM,YAAY,CAAC;AAUpB,MAAM,MAAM,kCAAkC,GAC1C,mCAAmC,GACnC,wCAAwC,GACxC,mCAAmC,GACnC,wBAAwB,CAAC;AAE7B,qBAAa,8BAA+B,SAAQ,KAAK;IACvD,QAAQ,CAAC,IAAI,EAAE,kCAAkC,CAAC;gBAGhD,IAAI,EAAE,kCAAkC,EACxC,OAAO,EAAE,MAAM,EACf,OAAO,GAAE;QAAE,QAAQ,CAAC,KAAK,CAAC,EAAE,OAAO,CAAA;KAAO;CAM7C;AAED,MAAM,WAAW,0CAA0C;IACzD,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;CAC5B;AAED,MAAM,WAAW,0BAA0B;IACzC,QAAQ,CAAC,gBAAgB,EAAE,MAAM,CAAC;IAClC,QAAQ,CAAC,OAAO,EAAE,iCAAiC,CAAC;IACpD,QAAQ,CAAC,gBAAgB,EAAE,MAAM,CAAC;IAClC,QAAQ,CAAC,eAAe,EAAE,MAAM,CAAC;IACjC,QAAQ,CAAC,MAAM,EAAE,wBAAwB,CAAC;CAC3C;AAED,MAAM,WAAW,mCAAmC,CAAC,SAAS,CAC5D,SAAQ,yBAAyB,CAAC,SAAS,CAAC;IAC5C,IAAI,CAAC,eAAe,EAAE,MAAM,GAAG,OAAO,CAAC,0BAA0B,GAAG,SAAS,CAAC,CAAC;CAChF;AAkaD,wBAAgB,yCAAyC,CAAC,SAAS,GAAG,OAAO,EAC3E,OAAO,EAAE,0CAA0C,GAClD,mCAAmC,CAAC,SAAS,CAAC,CAkHhD"}

package/dist/filesystem-store.js

@@ -3,6 +3,7 @@ import { lstat, mkdir, mkdtemp, open, readdir, rename, rm, } from 'node:fs/promi
 import path from 'node:path';
 import { prepareProtocolDeploymentReleaseEnvelope, } from '@hypequery/protocol';
 import { DEPLOYMENT_BUNDLE_MANIFEST, verifyDeploymentBundle, } from './bundle.js';
+import { readBoundedFile } from './utils/read-bounded-file.js';
 const RELEASE_FILE = 'release.json';
 const MAX_MANIFEST_BYTES = 1024 * 1024;
 const MAX_RELEASE_BYTES = 16 * 1024;
@@ -148,16 +149,17 @@ async function copyRegularFile(sourcePath, destinationPath, maximumBytes, expect
     }
 }
 function bundleFilePaths(bundle) {
+    const source = bundle.manifest.source;
     return Object.freeze([
         { path: DEPLOYMENT_BUNDLE_MANIFEST },
         {
             path: bundle.manifest.deployment.path,
             byteLength: bundle.manifest.deployment.byteLength,
         },
-        ...bundle.manifest.artifacts.map(artifact => ({
-            path: artifact.path,
-            byteLength: artifact.byteLength,
-        })),
+        ...(source?.files.map(file => ({
+            path: `${source.root}/${file.path}`,
+            byteLength: file.byteLength,
+        })) ?? []),
     ]);
 }
 async function syncBundleDirectories(bundleRoot, files) {
@@ -205,24 +207,7 @@ async function readRegularFile(filePath, maximumBytes) {
         if (!stat.isFile() || stat.size < 1 || stat.size > maximumBytes) {
             throw new Error(`Stored entry is not a bounded regular file: ${filePath}`);
         }
-        const buffer = Buffer.allocUnsafe(Math.min(COPY_BUFFER_BYTES, maximumBytes + 1));
-        const chunks = [];
-        let total = 0;
-        while (total <= maximumBytes) {
-            const remaining = maximumBytes + 1 - total;
-            const { bytesRead } = await handle.read(buffer, 0, Math.min(buffer.byteLength, remaining), null);
-            if (bytesRead === 0)
-                break;
-            total += bytesRead;
-            if (total > maximumBytes) {
-                throw new Error(`Stored entry is not a bounded regular file: ${filePath}`);
-            }
-            chunks.push(Buffer.from(buffer.subarray(0, bytesRead)));
-        }
-        if (total < 1) {
-            throw new Error(`Stored entry is not a bounded regular file: ${filePath}`);
-        }
-        return Buffer.concat(chunks, total);
+        return await readBoundedFile(handle, maximumBytes, 1, `Stored entry is not a bounded regular file: ${filePath}`);
     }
     finally {
         await handle.close();

package/dist/index.d.ts

@@ -15,23 +15,11 @@ export { DEFAULT_DEPLOYMENT_CONTROL_PLANE_LIMITS, resolveDeploymentControlPlaneL
 export type { DeploymentControlPlaneLimits } from './control-plane-limits.js';
 export { DEFAULT_DEPLOYMENT_INTAKE_LIMITS, resolveDeploymentIntakeLimits, } from './limits.js';
 export type { DeploymentIntakeLimits } from './limits.js';
-export { createNodeWorkerDeploymentRuntimeFactory, NodeDeploymentRuntimeError, } from './node-runtime-factory.js';
-export type { NodeDeploymentRuntimeEnvironment, NodeDeploymentRuntimeEnvironmentResolver, NodeDeploymentRuntimeErrorCode, NodeDeploymentRuntimeFactoryOptions, } from './node-runtime-factory.js';
-export { createDeploymentRuntimeMaterializer, DeploymentRuntimeMaterializationError, } from './runtime-materialization.js';
-export type { DeploymentRuntimeArtifactSnapshot, DeploymentRuntimeMaterializationErrorCode, DeploymentRuntimeMaterializer, DeploymentRuntimeMaterializerOptions, DeploymentRuntimeQueryBinding, DeploymentRuntimeRelease, DeploymentRuntimeReleaseReader, DeploymentRuntimeSnapshot, } from './runtime-materialization.js';
-export { createDeploymentRuntimeSupervisor, DeploymentRuntimeSupervisorError, } from './runtime-supervisor.js';
-export type { DeploymentRuntimeFactory, DeploymentRuntimeGeneration, DeploymentRuntimeInstance, DeploymentRuntimeInstanceInvocation, DeploymentRuntimeInvocation, DeploymentRuntimeReconcileResult, DeploymentRuntimeStatus, DeploymentRuntimeSupervisor, DeploymentRuntimeSupervisorErrorCode, DeploymentRuntimeSupervisorOptions, } from './runtime-supervisor.js';
 export type { DeploymentAuthenticationInput, DeploymentAuthenticator, DeploymentAuthorizationInput, DeploymentAuthorizer, DeploymentIntake, DeploymentIntakeOptions, DeploymentIntakeRequest, DeploymentIntakeResponse, DeploymentSubmissionResponse, DeploymentSubmissionStore, VerifiedDeploymentSubmission, } from './types.js';
-export { createDeploymentDataPlane, DeploymentDataPlaneError, } from './data-plane.js';
-export type { DeploymentCompiledSqlExecutionInput, DeploymentDataPlane, DeploymentDataPlaneAuthenticationInput, DeploymentDataPlaneErrorCode, DeploymentDataPlaneExecutionInput, DeploymentDataPlaneJsonRequest, DeploymentDataPlaneOptions, DeploymentDataPlanePrincipal, DeploymentDataPlaneRequest, DeploymentDataPlaneResult, DeploymentDataPlaneTenantInput, DeploymentRuntimeReferenceExecutionInput, DeploymentSemanticPlanExecutionInput, } from './data-plane.js';
-export { DEFAULT_DEPLOYMENT_DATA_PLANE_LIMITS, resolveDeploymentDataPlaneLimits, } from './data-plane-limits.js';
-export type { DeploymentDataPlaneLimits } from './data-plane-limits.js';
-export { createDeploymentRuntimeSupervisorExecutor } from './data-plane-runtime.js';
-export type { DeploymentRuntimeSupervisorExecutorOptions } from './data-plane-runtime.js';
-export { createDeploymentDataPlaneFetchHandler, createDeploymentDataPlaneNodeHandler, } from './data-plane-adapters.js';
-export type { DeploymentDataPlaneAdapterOptions, DeploymentDataPlaneAdapterRequest, DeploymentDataPlaneFetchHandler, DeploymentDataPlaneNodeHandler, } from './data-plane-adapters.js';
-export { createDeploymentHost, DeploymentHostError, } from './host.js';
-export { createFileSystemDeploymentHost } from './filesystem-host.js';
-export type { FileSystemDeploymentHost, FileSystemDeploymentHostOptions, } from './filesystem-host.js';
-export type { DeploymentHost, DeploymentHostDataPlaneConfiguration, DeploymentHostDataPlaneInput, DeploymentHostErrorCode, DeploymentHostOptions, } from './host.js';
+export type { DeploymentDataPlanePrincipal } from './principal.js';
+export { createDeploymentSemanticDataPlane, DeploymentSemanticInvocationError, toProtocolSemanticInvocationFailure, } from './semantic-data-plane.js';
+export type { DeploymentSemanticAuthenticationInput, DeploymentSemanticBudget, DeploymentSemanticDataPlane, DeploymentSemanticDataPlaneOptions, DeploymentSemanticExecutionInput, DeploymentSemanticInvocationRequest, DeploymentSemanticTenantInput, } from './semantic-data-plane.js';
+export { validateSemanticOperation } from './semantic-operation-validation.js';
+export type { SemanticOperationLimits, SemanticOperationViolation, } from './semantic-operation-validation.js';
+export { isDeploymentEndpointAuthorized, projectAuthorizedDeploymentContract, satisfiesDeploymentAccess, } from './authorized-contract.js';
 //# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,4CAA4C,EAC5C,yBAAyB,EACzB,kCAAkC,GACnC,MAAM,iBAAiB,CAAC;AACzB,YAAY,EACV,6BAA6B,EAC7B,+BAA+B,EAC/B,gCAAgC,EAChC,4BAA4B,EAC5B,2BAA2B,EAC3B,0BAA0B,EAC1B,2BAA2B,EAC3B,0BAA0B,EAC1B,uBAAuB,EACvB,6CAA6C,GAC9C,MAAM,iBAAiB,CAAC;AACzB,OAAO,EACL,0BAA0B,EAC1B,0BAA0B,EAC1B,sBAAsB,GACvB,MAAM,aAAa,CAAC;AACrB,YAAY,EAAE,wBAAwB,EAAE,MAAM,aAAa,CAAC;AAC5D,OAAO,EACL,qBAAqB,GACtB,MAAM,aAAa,CAAC;AACrB,YAAY,EAAE,yBAAyB,EAAE,MAAM,aAAa,CAAC;AAC7D,OAAO,EACL,yCAAyC,EACzC,8BAA8B,GAC/B,MAAM,uBAAuB,CAAC;AAC/B,YAAY,EACV,kCAAkC,EAClC,mCAAmC,EACnC,0CAA0C,EAC1C,0BAA0B,GAC3B,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EACL,sBAAsB,GACvB,MAAM,aAAa,CAAC;AACrB,OAAO,EACL,wCAAwC,EACxC,uCAAuC,GACxC,MAAM,6BAA6B,CAAC;AACrC,YAAY,EACV,kCAAkC,EAClC,iCAAiC,GAClC,MAAM,6BAA6B,CAAC;AACrC,OAAO,EACL,4BAA4B,GAC7B,MAAM,oBAAoB,CAAC;AAC5B,YAAY,EACV,sBAAsB,EACtB,4BAA4B,EAC5B,wCAAwC,EACxC,gCAAgC,EAChC,+BAA+B,EAC/B,6BAA6B,EAC7B,6BAA6B,EAC7B,8BAA8B,GAC/B,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EACL,uCAAuC,EACvC,mCAAmC,GACpC,MAAM,2BAA2B,CAAC;AACnC,YAAY,EAAE,4BAA4B,EAAE,MAAM,2BAA2B,CAAC;AAC9E,OAAO,EACL,gCAAgC,EAChC,6BAA6B,GAC9B,MAAM,aAAa,CAAC;AACrB,YAAY,EAAE,sBAAsB,EAAE,MAAM,aAAa,CAAC;AAC1D,OAAO,EACL,wCAAwC,EACxC,0BAA0B,GAC3B,MAAM,2BAA2B,CAAC;AACnC,YAAY,EACV,gCAAgC,EAChC,wCAAwC,EACxC,8BAA8B,EAC9B,mCAAmC,GACpC,MAAM,2BAA2B,CAAC;AACnC,OAAO,EACL,mCAAmC,EACnC,qCAAqC,GACtC,MAAM,8BAA8B,CAAC;AACtC,YAAY,EACV,iCAAiC,EACjC,yCAAyC,EACzC,6BAA6B,EAC7B,oCAAoC,EACpC,6BAA6B,EAC7B,wBAAwB,EACxB,8BAA8B,EAC9B,yBAAyB,GAC1B,MAAM,8BAA8B,CAAC;AACtC,OAAO,EACL,iCAAiC,EACjC,gCAAgC,GACjC,MAAM,yBAAyB,CAAC;AACjC,YAAY,EACV,wBAAwB,EACxB,2BAA2B,EAC3B,yBAAyB,EACzB,mCAAmC,EACnC,2BAA2B,EAC3B,gCAAgC,EAChC,uBAAuB,EACvB,2BAA2B,EAC3B,oCAAoC,EACpC,kCAAkC,GACnC,MAAM,yBAAyB,CAAC;AACjC,YAAY,EACV,6BAA6B,EAC7B,uBAAuB,EACvB,4BAA4B,EAC5B,oBAAoB,EACpB,gBAAgB,EAChB,uBAAuB,EACvB,uBAAuB,EACvB,wBAAwB,EACxB,4BAA4B,EAC5B,yBAAyB,EACzB,4BAA4B,GAC7B,MAAM,YAAY,CAAC;AACpB,OAAO,EACL,yBAAyB,EACzB,wBAAwB,GACzB,MAAM,iBAAiB,CAAC;AACzB,YAAY,EACV,mCAAmC,EACnC,mBAAmB,EACnB,sCAAsC,EACtC,4BAA4B,EAC5B,iCAAiC,EACjC,8BAA8B,EAC9B,0BAA0B,EAC1B,4BAA4B,EAC5B,0BAA0B,EAC1B,yBAAyB,EACzB,8BAA8B,EAC9B,wCAAwC,EACxC,oCAAoC,GACrC,MAAM,iBAAiB,CAAC;AACzB,OAAO,EACL,oCAAoC,EACpC,gCAAgC,GACjC,MAAM,wBAAwB,CAAC;AAChC,YAAY,EAAE,yBAAyB,EAAE,MAAM,wBAAwB,CAAC;AACxE,OAAO,EAAE,yCAAyC,EAAE,MAAM,yBAAyB,CAAC;AACpF,YAAY,EAAE,0CAA0C,EAAE,MAAM,yBAAyB,CAAC;AAC1F,OAAO,EACL,qCAAqC,EACrC,oCAAoC,GACrC,MAAM,0BAA0B,CAAC;AAClC,YAAY,EACV,iCAAiC,EACjC,iCAAiC,EACjC,+BAA+B,EAC/B,8BAA8B,GAC/B,MAAM,0BAA0B,CAAC;AAClC,OAAO,EACL,oBAAoB,EACpB,mBAAmB,GACpB,MAAM,WAAW,CAAC;AACnB,OAAO,EAAE,8BAA8B,EAAE,MAAM,sBAAsB,CAAC;AACtE,YAAY,EACV,wBAAwB,EACxB,+BAA+B,GAChC,MAAM,sBAAsB,CAAC;AAC9B,YAAY,EACV,cAAc,EACd,oCAAoC,EACpC,4BAA4B,EAC5B,uBAAuB,EACvB,qBAAqB,GACtB,MAAM,WAAW,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,4CAA4C,EAC5C,yBAAyB,EACzB,kCAAkC,GACnC,MAAM,iBAAiB,CAAC;AACzB,YAAY,EACV,6BAA6B,EAC7B,+BAA+B,EAC/B,gCAAgC,EAChC,4BAA4B,EAC5B,2BAA2B,EAC3B,0BAA0B,EAC1B,2BAA2B,EAC3B,0BAA0B,EAC1B,uBAAuB,EACvB,6CAA6C,GAC9C,MAAM,iBAAiB,CAAC;AACzB,OAAO,EACL,0BAA0B,EAC1B,0BAA0B,EAC1B,sBAAsB,GACvB,MAAM,aAAa,CAAC;AACrB,YAAY,EAAE,wBAAwB,EAAE,MAAM,aAAa,CAAC;AAC5D,OAAO,EACL,qBAAqB,GACtB,MAAM,aAAa,CAAC;AACrB,YAAY,EAAE,yBAAyB,EAAE,MAAM,aAAa,CAAC;AAC7D,OAAO,EACL,yCAAyC,EACzC,8BAA8B,GAC/B,MAAM,uBAAuB,CAAC;AAC/B,YAAY,EACV,kCAAkC,EAClC,mCAAmC,EACnC,0CAA0C,EAC1C,0BAA0B,GAC3B,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EACL,sBAAsB,GACvB,MAAM,aAAa,CAAC;AACrB,OAAO,EACL,wCAAwC,EACxC,uCAAuC,GACxC,MAAM,6BAA6B,CAAC;AACrC,YAAY,EACV,kCAAkC,EAClC,iCAAiC,GAClC,MAAM,6BAA6B,CAAC;AACrC,OAAO,EACL,4BAA4B,GAC7B,MAAM,oBAAoB,CAAC;AAC5B,YAAY,EACV,sBAAsB,EACtB,4BAA4B,EAC5B,wCAAwC,EACxC,gCAAgC,EAChC,+BAA+B,EAC/B,6BAA6B,EAC7B,6BAA6B,EAC7B,8BAA8B,GAC/B,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EACL,uCAAuC,EACvC,mCAAmC,GACpC,MAAM,2BAA2B,CAAC;AACnC,YAAY,EAAE,4BAA4B,EAAE,MAAM,2BAA2B,CAAC;AAC9E,OAAO,EACL,gCAAgC,EAChC,6BAA6B,GAC9B,MAAM,aAAa,CAAC;AACrB,YAAY,EAAE,sBAAsB,EAAE,MAAM,aAAa,CAAC;AAC1D,YAAY,EACV,6BAA6B,EAC7B,uBAAuB,EACvB,4BAA4B,EAC5B,oBAAoB,EACpB,gBAAgB,EAChB,uBAAuB,EACvB,uBAAuB,EACvB,wBAAwB,EACxB,4BAA4B,EAC5B,yBAAyB,EACzB,4BAA4B,GAC7B,MAAM,YAAY,CAAC;AACpB,YAAY,EAAE,4BAA4B,EAAE,MAAM,gBAAgB,CAAC;AAEnE,OAAO,EACL,iCAAiC,EACjC,iCAAiC,EACjC,mCAAmC,GACpC,MAAM,0BAA0B,CAAC;AAClC,YAAY,EACV,qCAAqC,EACrC,wBAAwB,EACxB,2BAA2B,EAC3B,kCAAkC,EAClC,gCAAgC,EAChC,mCAAmC,EACnC,6BAA6B,GAC9B,MAAM,0BAA0B,CAAC;AAClC,OAAO,EAAE,yBAAyB,EAAE,MAAM,oCAAoC,CAAC;AAC/E,YAAY,EACV,uBAAuB,EACvB,0BAA0B,GAC3B,MAAM,oCAAoC,CAAC;AAI5C,OAAO,EACL,8BAA8B,EAC9B,mCAAmC,EACnC,yBAAyB,GAC1B,MAAM,0BAA0B,CAAC"}

package/dist/index.js

@@ -7,12 +7,8 @@ export { createDeploymentControlPlaneFetchHandler, createDeploymentControlPlaneN
 export { createDeploymentControlPlane, } from './control-plane.js';
 export { DEFAULT_DEPLOYMENT_CONTROL_PLANE_LIMITS, resolveDeploymentControlPlaneLimits, } from './control-plane-limits.js';
 export { DEFAULT_DEPLOYMENT_INTAKE_LIMITS, resolveDeploymentIntakeLimits, } from './limits.js';
-export { createNodeWorkerDeploymentRuntimeFactory, NodeDeploymentRuntimeError, } from './node-runtime-factory.js';
-export { createDeploymentRuntimeMaterializer, DeploymentRuntimeMaterializationError, } from './runtime-materialization.js';
-export { createDeploymentRuntimeSupervisor, DeploymentRuntimeSupervisorError, } from './runtime-supervisor.js';
-export { createDeploymentDataPlane, DeploymentDataPlaneError, } from './data-plane.js';
-export { DEFAULT_DEPLOYMENT_DATA_PLANE_LIMITS, resolveDeploymentDataPlaneLimits, } from './data-plane-limits.js';
-export { createDeploymentRuntimeSupervisorExecutor } from './data-plane-runtime.js';
-export { createDeploymentDataPlaneFetchHandler, createDeploymentDataPlaneNodeHandler, } from './data-plane-adapters.js';
-export { createDeploymentHost, DeploymentHostError, } from './host.js';
-export { createFileSystemDeploymentHost } from './filesystem-host.js';
+export { createDeploymentSemanticDataPlane, DeploymentSemanticInvocationError, toProtocolSemanticInvocationFailure, } from './semantic-data-plane.js';
+export { validateSemanticOperation } from './semantic-operation-validation.js';
+// What one principal may see of a contract, for a gateway listing targets
+// before any call exists (decision 0002, CLOUD-03).
+export { isDeploymentEndpointAuthorized, projectAuthorizedDeploymentContract, satisfiesDeploymentAccess, } from './authorized-contract.js';

package/dist/intake.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"intake.d.ts","sourceRoot":"","sources":["../src/intake.ts"],"names":[],"mappings":"AA+BA,OAAO,KAAK,EACV,gBAAgB,EAChB,uBAAuB,EAIxB,MAAM,YAAY,CAAC;AAuSpB,wBAAgB,sBAAsB,CAAC,SAAS,EAC9C,OAAO,EAAE,uBAAuB,CAAC,SAAS,CAAC,GAC1C,gBAAgB,CAiIlB"}
+{"version":3,"file":"intake.d.ts","sourceRoot":"","sources":["../src/intake.ts"],"names":[],"mappings":"AA+BA,OAAO,KAAK,EACV,gBAAgB,EAChB,uBAAuB,EAIxB,MAAM,YAAY,CAAC;AAwSpB,wBAAgB,sBAAsB,CAAC,SAAS,EAC9C,OAAO,EAAE,uBAAuB,CAAC,SAAS,CAAC,GAC1C,gBAAgB,CAiIlB"}

package/dist/intake.js

@@ -85,10 +85,10 @@ function decodeJson(bytes, description) {
     }
 }
 function requireReconstructablePaths(manifest) {
+    const source = manifest.manifest.source;
     const files = [
         manifest.manifest.deployment.path,
-        ...manifest.manifest.artifacts.map(artifact => artifact.path),
-        ...(manifest.manifest.source?.files.map(file => `${manifest.manifest.source.root}/${file.path}`) ?? []),
+        ...(source?.files.map(file => `${source.root}/${file.path}`) ?? []),
     ];
     const fileSet = new Set(files);
     if (fileSet.has(DEPLOYMENT_BUNDLE_MANIFEST)) {
@@ -149,6 +149,9 @@ async function readManifest(reader, maximum) {
             throw error;
         throw badRequest('The deployment bundle manifest is invalid.', error);
     }
+    if (prepared.manifest.artifacts.length > 0) {
+        throw badRequest('A deployment bundle cannot contain runtime artifacts.');
+    }
     const canonical = Buffer.from(`${prepared.canonical}\n`);
     if (!part.bytes.equals(canonical)) {
         throw badRequest('The deployment bundle manifest must use canonical JSON followed by one newline.');
@@ -282,12 +285,12 @@ export function createDeploymentIntake(options) {
             const bundleRoot = path.join(temporaryRoot, 'bundle');
             await mkdir(bundleRoot);
             await writeFile(path.join(bundleRoot, DEPLOYMENT_BUNDLE_MANIFEST), manifest.bytes, { flag: 'wx' });
+            const source = manifest.prepared.manifest.source;
             const files = [
                 manifest.prepared.manifest.deployment,
-                ...manifest.prepared.manifest.artifacts,
-                ...(manifest.prepared.manifest.source?.files.map(file => ({
+                ...(source?.files.map(file => ({
                     ...file,
-                    path: `${manifest.prepared.manifest.source.root}/${file.path}`,
+                    path: `${source.root}/${file.path}`,
                 })) ?? []),
             ];
             for (let index = 0; index < files.length; index += 1) {

package/dist/limits.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"limits.d.ts","sourceRoot":"","sources":["../src/limits.ts"],"names":[],"mappings":"AAEA,MAAM,WAAW,sBAAsB;IACrC,QAAQ,CAAC,eAAe,EAAE,MAAM,CAAC;IACjC,QAAQ,CAAC,eAAe,EAAE,MAAM,CAAC;IACjC,QAAQ,CAAC,gBAAgB,EAAE,MAAM,CAAC;IAClC,QAAQ,CAAC,kBAAkB,EAAE,MAAM,CAAC;CACrC;AAED,eAAO,MAAM,gCAAgC,EAAE,QAAQ,CAAC,sBAAsB,CAK5E,CAAC;AAEH,wBAAgB,6BAA6B,CAC3C,KAAK,GAAE,OAAO,CAAC,sBAAsB,CAAM,GAC1C,QAAQ,CAAC,sBAAsB,CAAC,CAelC"}
+{"version":3,"file":"limits.d.ts","sourceRoot":"","sources":["../src/limits.ts"],"names":[],"mappings":"AAEA,MAAM,WAAW,sBAAsB;IACrC,QAAQ,CAAC,eAAe,EAAE,MAAM,CAAC;IACjC,QAAQ,CAAC,eAAe,EAAE,MAAM,CAAC;IACjC,QAAQ,CAAC,gBAAgB,EAAE,MAAM,CAAC;IAClC,QAAQ,CAAC,kBAAkB,EAAE,MAAM,CAAC;CACrC;AAED,eAAO,MAAM,gCAAgC,EAAE,QAAQ,CAAC,sBAAsB,CAQ5E,CAAC;AAEH,wBAAgB,6BAA6B,CAC3C,KAAK,GAAE,OAAO,CAAC,sBAAsB,CAAM,GAC1C,QAAQ,CAAC,sBAAsB,CAAC,CAelC"}

package/dist/limits.js

@@ -1,6 +1,9 @@
 import { DEFAULT_PROTOCOL_DEPLOYMENT_BUNDLE_LIMITS } from '@hypequery/protocol';
 export const DEFAULT_DEPLOYMENT_INTAKE_LIMITS = Object.freeze({
-    maxRequestBytes: DEFAULT_PROTOCOL_DEPLOYMENT_BUNDLE_LIMITS.maxTotalBytes + (2 * 1024 * 1024),
+    // Source and deployment bytes, plus the manifest and headers for up to 1,000 files.
+    maxRequestBytes: DEFAULT_PROTOCOL_DEPLOYMENT_BUNDLE_LIMITS.maxDeploymentBytes
+        + DEFAULT_PROTOCOL_DEPLOYMENT_BUNDLE_LIMITS.maxSourceBytes
+        + (10 * 1024 * 1024),
     maxReleaseBytes: 16 * 1024,
     maxManifestBytes: 1024 * 1024,
     maxPartHeaderBytes: 8 * 1024,
@@ -14,7 +17,7 @@ export function resolveDeploymentIntakeLimits(input = {}) {
         if (!Number.isSafeInteger(value) || value < 1
             || value > DEFAULT_DEPLOYMENT_INTAKE_LIMITS[key]) {
             throw new RangeError(`${key} must be a positive safe integer no greater than `
-                + `${DEFAULT_DEPLOYMENT_INTAKE_LIMITS[key]} (the deployment intake v1 maximum)`);
+                + `${DEFAULT_DEPLOYMENT_INTAKE_LIMITS[key]} (the deployment intake safety ceiling)`);
         }
         result[key] = value;
     }