@idleware/ringi 0.4.0 → 0.6.0

package/target/esm/home/index.js

@@ -1,88 +0,0 @@
-// home: where ringi keeps its state on this machine. $RINGI_HOME holds hubs (each a descriptor and a store),
-// reader state, session records and locks. Reading state fails closed; a write the sandbox denies fails with one
-// fixed instruction.
-import fs from 'node:fs';
-import os from 'node:os';
-import path from 'node:path';
-import { spawnSync } from 'node:child_process';
-import { fileURLToPath } from 'node:url';
-import { errno, fail, guardWrite, locked as lockFile, mkdirIn, note, writeJsonAtomic } from '../lib/index.js';
-const HERE = path.dirname(fileURLToPath(import.meta.url));
-// This file sits in src/main/ts/home (source) or target/esm/home (build): three levels below the package root.
-export const ROOT = path.resolve(HERE, '..', '..', '..');
-export const RESOURCES = path.join(ROOT, 'src', 'main', 'resources');
-export const VERSION = JSON.parse(fs.readFileSync(path.join(ROOT, 'package.json'), 'utf8')).version;
-export const HOME = path.resolve(process.env.RINGI_HOME || path.join(os.homedir(), '.ringi'));
-export const HOME_VERSION = 3;
-export const OPERATOR = 'operator';
-// --- writing safely ---
-export const guard = (fn) => guardWrite(HOME, fn);
-export const mkdir = (d) => mkdirIn(HOME, d);
-export const writeJson = (f, v) => guard(() => {
-    mkdir(path.dirname(f));
-    writeJsonAtomic(f, v);
-});
-// State fails closed: unreadable JSON is an error, never a silent fresh start.
-export const readJson = (f, dflt) => {
-    let raw;
-    try {
-        raw = fs.readFileSync(f, 'utf8');
-    }
-    catch (e) {
-        if (errno(e) === 'ENOENT')
-            return dflt;
-        throw e;
-    }
-    try {
-        return JSON.parse(raw);
-    }
-    catch (e) {
-        return fail(`${f} is not valid JSON (${e.message}); refusing to continue with lost state`);
-    }
-};
-// --- the home ---
-export const hubsDir = () => path.join(HOME, 'hub');
-export const hubHome = (name) => path.join(hubsDir(), name);
-// The home is created on first use; anything else at that path is refused. A home of the previous layout (each hub a
-// bare repository `hub/<name>.git` with its settings in git config) is moved into descriptor and store.
-export const ensureHome = () => {
-    const marker = path.join(HOME, 'home.json');
-    if (fs.existsSync(marker)) {
-        const h = readJson(marker, {});
-        if (h.version === 2)
-            return migrate2(marker);
-        if (h.version !== HOME_VERSION)
-            fail(`${HOME} is a ringi home of version ${h.version}; this ringi ${VERSION} needs version ${HOME_VERSION}`);
-        return;
-    }
-    if (fs.existsSync(HOME) && fs.readdirSync(HOME).length)
-        fail(`${HOME} exists and is not a ringi home (no home.json); move it away or set RINGI_HOME`);
-    mkdir(HOME);
-    writeJson(marker, { version: HOME_VERSION });
-};
-const migrate2 = (marker) => {
-    for (const f of fs.existsSync(hubsDir()) ? fs.readdirSync(hubsDir()).filter(f => f.endsWith('.git')) : []) {
-        const name = f.slice(0, -4);
-        const old = path.join(hubsDir(), f);
-        const cfg = (k) => String(spawnSync('git', ['--git-dir', old, 'config', '--get', k], { encoding: 'utf8' }).stdout ?? '').trim();
-        const signed = cfg('ringi.type') === 'remote';
-        const descriptor = { schema: 'ringi-hub/2', name, trust: signed ? 'signed' : 'asserted',
-            ...(signed ? { root: cfg('ringi.rootKey') || undefined, genesis: cfg('ringi.genesis') || undefined } : {}),
-            store: { type: 'git', path: 'store', ...(cfg('remote.origin.url') ? { remote: cfg('remote.origin.url') } : {}) } };
-        mkdir(path.join(hubHome(name), 'store'));
-        guard(() => fs.renameSync(old, path.join(hubHome(name), 'store', '.git')));
-        writeJson(path.join(hubHome(name), 'hub.json'), descriptor);
-        note(`moved hub ${name} to ${hubHome(name)} (descriptor hub.json, store/.git)`);
-    }
-    writeJson(marker, { version: HOME_VERSION });
-};
-export const locked = (name, fn) => {
-    ensureHome();
-    const dir = path.join(HOME, 'locks');
-    mkdir(dir);
-    return guard(() => lockFile(path.join(dir, `${name}.lock`), fn));
-};
-export const configFile = () => path.join(HOME, 'config.json');
-export const config = () => ({ hub: 'local', room: null, ...readJson(configFile(), {}) });
-export const setConfig = (patch) => writeJson(configFile(), { ...config(), ...patch });
-//# sourceMappingURL=index.js.map

package/target/esm/hub/index.js

@@ -1,224 +0,0 @@
-// hub: hubs and rooms on top of any store. A hub is a directory with a descriptor (hub.json: which store, where,
-// what this machine pins) beside its store. Its shared contract lives in the store (contract.json, authority.json,
-// profiles/*.json). This file reads contracts, opens rooms with their profile and authority, and decides what a reader
-// accepts: only history that extends what it accepted before, from members the store verifies (docs/spec/hub-1.md, Trust).
-import fs from 'node:fs';
-import path from 'node:path';
-import * as D from '../domain/decisions.js';
-import { CAPABILITIES, unenforceable } from '../domain/index.js';
-import { GitStore } from '../store/git/index.js';
-import { HOME, OPERATOR, RESOURCES, VERSION, ensureHome, hubHome, hubsDir, locked, mkdir, writeJson } from '../home/index.js';
-import { DEFAULT_PROFILE, PROFILES_CAPABILITY, parseProfile } from '../domain/profiles.js';
-import { HIDDEN, compose, decodeText, link, parse } from '../protocol/index.js';
-import { emit } from './signals.js';
-import { STORES } from '../store/index.js';
-import { fail, short, strictJson } from '../lib/index.js';
-export const HUB_MAJOR = 1;
-export const CAPS = new Set(Object.keys(CAPABILITIES));
-export const RESERVED_ROOMS = new Set(['main', 'archive']);
-// Whether the room's work has started: it has the quorum of agents its genesis asked for (`Quorum`), or asked for none.
-export const start = (R) => {
-    const agents = Object.values(R.members).filter(m => m.role !== 'root').length;
-    return { quorum: R.quorum, agents, started: R.quorum === null || agents >= R.quorum };
-};
-// --- hubs ---
-export const hubNames = () => {
-    try {
-        return fs.readdirSync(hubsDir()).filter(n => fs.existsSync(path.join(hubsDir(), n, 'hub.json'))).sort();
-    }
-    catch {
-        return [];
-    }
-};
-const HUB_MD = `# ringi hub
-
-The shared contract of a ringi hub (docs/spec/hub-1.md): contract.json (schema, version, protocol, trust, capabilities, the
-default profile), authority.json (who may decide what, up to which budget; the root, \`operator\`, always may) and
-profiles/ (what a piece of work is in a room: its states, and who may move it). Use \`ringi\`; never edit by hand.
-`;
-const readProfileResource = (name) => fs.readFileSync(path.join(RESOURCES, 'profiles', `${name}.json`), 'utf8');
-// A new hub: local (asserted senders), or signed, with the operator's root key generated on this machine and pinned.
-export const createHub = (name, { signed = false, url } = {}) => {
-    ensureHome();
-    const dir = hubHome(name);
-    if (fs.existsSync(dir))
-        fail(`hub ${name} exists`);
-    if (url && !signed)
-        fail('--url publishes a hub; only a --signed hub may be published');
-    const d = { schema: 'ringi-hub/2', name, trust: signed ? 'signed' : 'asserted', store: { type: 'git', path: 'store', ...(url ? { remote: url } : {}) } };
-    try {
-        mkdir(dir);
-        if (signed)
-            d.root = GitStore.rootFor(dir, d, HOME);
-        const contract = { schema: 'ringi-hub', version: '1.1', protocol: 1, trust: d.trust, capabilities: [D.CAPABILITY, PROFILES_CAPABILITY], profile: DEFAULT_PROFILE, ...(d.root ? { root: d.root } : {}) };
-        const store = GitStore.create(dir, d, HOME, {
-            'contract.json': JSON.stringify(contract, null, 2) + '\n',
-            'authority.json': JSON.stringify({ decide: {} }, null, 2) + '\n',
-            'HUB.md': HUB_MD,
-            [`profiles/${DEFAULT_PROFILE}.json`]: readProfileResource(DEFAULT_PROFILE),
-        }, compose(`hub ${name}`, [['To', '*'], ['Kind', 'hub']]));
-        if (signed)
-            d.genesis = store.contractHead();
-        writeJson(path.join(dir, 'hub.json'), d);
-    }
-    catch (e) {
-        if (!fs.existsSync(path.join(dir, 'hub.json')))
-            fs.rmSync(dir, { recursive: true, force: true });
-        throw e;
-    }
-};
-export const readDescriptor = (name) => {
-    const f = path.join(hubHome(name), 'hub.json');
-    if (!fs.existsSync(f))
-        fail(`no hub ${name}; hubs: ${hubNames().join(', ') || 'none'}`);
-    const d = strictJson(fs.readFileSync(f, 'utf8'), f);
-    if (d.schema !== 'ringi-hub/2' || d.name !== name || !['signed', 'asserted'].includes(d.trust) || !d.store?.type || !d.store.path)
-        fail(`${f} is not a ringi hub descriptor this ringi ${VERSION} reads`);
-    return d;
-};
-// The contract a tool must understand before it touches a hub or a room: known schema, major and capabilities.
-export const contractAt = (store, name, rev) => {
-    const text = store.contractFile(rev, 'contract.json') ?? store.contractFile(rev, 'hub.json') ?? fail(`hub ${name} has no contract at ${short(rev)}`);
-    const c = strictJson(text, `hub ${name}: contract`);
-    if (c.schema !== 'ringi-hub')
-        fail(`hub ${name} declares schema ${String(c.schema)}, not ringi-hub`);
-    const major = Number(String(c.version).split('.')[0]);
-    if (major !== HUB_MAJOR)
-        fail(`hub ${name} follows contract version ${c.version}; this ringi ${VERSION} supports ${HUB_MAJOR}.x. Upgrade ringi`);
-    const why = unenforceable(c.capabilities ?? []);
-    if (why)
-        fail(`hub ${name} ${why}, which this ringi ${VERSION} cannot enforce. Upgrade ringi`);
-    const a = store.contractFile(rev, 'authority.json');
-    return { ...c, authority: a === null ? {} : strictJson(a, `hub ${name}: authority.json at ${short(rev)}`) };
-};
-// A hub is opened once per process; its store syncs then (a signed store fetches and verifies), and again on refresh.
-const opened = new Map();
-export const openHub = (name, { refresh = false } = {}) => {
-    ensureHome();
-    if (!/^[a-z0-9]+(?:[._-][a-z0-9]+)*$/.test(name))
-        fail(`bad hub name ${name}`);
-    if (opened.has(name) && !refresh)
-        return opened.get(name);
-    if (name === 'local' && !fs.existsSync(path.join(hubHome(name), 'hub.json')))
-        createHub('local');
-    const d = readDescriptor(name);
-    const factory = STORES[d.store.type] ?? fail(`hub ${name} uses a ${d.store.type} store; this ringi ${VERSION} knows ${Object.keys(STORES).join(', ')}`);
-    const store = factory(hubHome(name), d, HOME);
-    store.sync();
-    const main = store.contractHead();
-    const H = { name, dir: hubHome(name), d, store, main, contract: contractAt(store, name, main), signed: d.trust === 'signed' };
-    opened.set(name, H);
-    return H;
-};
-// --- rooms ---
-export const roomNames = (H, archived = false) => H.store.roomNames(archived);
-export const openRoom = (H, name, { quiet = false } = {}) => {
-    if (!name)
-        return fail('no room: the operator creates one with ringi room create <id>, or picks one with ringi room switch <id>');
-    const s = H.store.room(name);
-    if (!s) {
-        if (quiet)
-            return null;
-        const gone = roomNames(H, true).find(a => a.startsWith(`${name}@`));
-        return fail(gone ? `room ${name} is archived as ${gone}; read it with --room ${gone}` : `no room ${name} in hub ${H.name}; rooms: ${roomNames(H).join(', ') || 'none'}`);
-    }
-    // The genesis names its room, in the root's hand: a history offered under another name is not that room.
-    const named = s.archived ? name.slice(0, name.lastIndexOf('@')) : name;
-    const subject = s.control[0]?.rev === s.genesis ? s.control[0].text.split('\n')[0] : '(none)';
-    if (subject !== `room ${named}` || (s.archived && name !== `${named}@${s.genesis.slice(0, 8)}`))
-        fail(`room ${name}: its genesis is "${subject}"; refusing a room's history under another name`);
-    // The contract in effect at each control entry: the hub contract the room was created on, then each `Contract:`
-    // the operator moved it to. A decision names the control entry it was made under (decide.ts).
-    const atControl = new Map();
-    let current = s.base;
-    for (const rec of s.control) {
-        const m = /^Contract: ([0-9a-f]{40,64})$/m.exec(rec.text);
-        if (m)
-            current = m[1];
-        atControl.set(rec.rev, current);
-    }
-    const contract = current === H.main ? H.contract : contractAt(H.store, H.name, current);
-    const tables = new Map();
-    const authorityAt = (control) => {
-        const rev = control ? atControl.get(control) : undefined;
-        if (!rev)
-            return null;
-        if (!tables.has(rev))
-            tables.set(rev, contractAt(H.store, H.name, rev).authority);
-        return tables.get(rev);
-    };
-    // The room's profile is fixed when the room is made: its content is copied into the genesis control entry, so no
-    // later change of the hub's profiles or contract reinterprets the room's history. Rooms made before this carry
-    // none and use the default profile of the contract they were created on.
-    const baseProfile = contractAt(H.store, H.name, s.base).profile ?? DEFAULT_PROFILE;
-    const profileText = H.store.controlFile(s, 'profile.json', s.genesis)
-        ?? H.store.contractFile(s.base, `profiles/${baseProfile}.json`)
-        ?? (baseProfile === DEFAULT_PROFILE ? readProfileResource(DEFAULT_PROFILE) : fail(`room ${name}: unknown profile ${baseProfile}`));
-    const roster = H.store.roster(s);
-    const members = roster?.members ?? strictJson(H.store.controlFile(s, 'members.json') ?? '{}', `room ${name}: members.json`);
-    // The root's control records set the quorum; the latest one counts.
-    let quorum = null;
-    for (const rec of s.control) {
-        const m = /^Quorum: ([1-9][0-9]?)$/m.exec(rec.text);
-        if (m)
-            quorum = Number(m[1]);
-    }
-    return { hub: H, s, name, archived: s.archived, head: s.head, genesis: s.genesis, contractRev: current, contract, authorityAt,
-        profile: parseProfile(profileText, `room ${name}: profile`), members, quorum };
-};
-export const room = (H, name) => openRoom(H, name);
-export const ROOM_MD = (name) => `# room ${name}\n\nA ringi room: members.json lists who takes part; profile.json is what a piece of work is here, fixed when the room was made.\n`;
-export const profileText = (H, name) => H.store.contractFile(H.main, `profiles/${name}.json`) ?? (name === DEFAULT_PROFILE ? readProfileResource(DEFAULT_PROFILE) : null);
-// A control change under the hub lock. In a signed room membership changes only through `room admit`.
-export const controlChange = (R, who, subject, mutate, extra = []) => locked(`hub-${R.hub.name}`, () => {
-    const s = R.hub.store.room(R.name) ?? fail(`room ${R.name} is gone`);
-    const members = strictJson(R.hub.store.controlFile(s, 'members.json') ?? '{}', `room ${R.name}: members.json`);
-    const before = JSON.stringify(members);
-    mutate(members);
-    if (R.hub.signed && JSON.stringify(members) !== before)
-        fail('in a signed room, membership changes only by ringi room admit');
-    R.head = R.hub.store.updateControl(s, who, compose(subject, [['To', '*'], ['Kind', 'room'], ...extra]), { 'members.json': JSON.stringify(members, null, 2) + '\n' });
-    R.members = members;
-});
-// --- messages and what a reader accepts ---
-export const toMessage = (R, from, x, seq) => {
-    const trust = R.hub.signed ? 'verified' : 'asserted';
-    const files = x.files.map(f => ({ path: f.path, size: null }));
-    const base = { id: x.id, from, trust, time: x.time, seq, files, refused: x.refused, reId: null, hopEff: 0 };
-    const d = decodeText(x.text);
-    if (d.invalid !== undefined) {
-        return { ...base, invalid: d.invalid, subject: '', body: '', to: [], re: null, kind: null, state: null, assign: null, roles: null, hop: 0, bad: d.invalid, trailers: {} };
-    }
-    const p = parse(d.text, s => R.hub.store.isRef(s));
-    // An extension's trailers and the room profile's states are part of a message's validity.
-    const ext = D.check(p, s => R.hub.store.isRef(s));
-    const state = !p.bad && p.state && !R.profile.states.includes(p.state) ? `State ${p.state} is not in profile ${R.profile.name}` : null;
-    return { ...base, invalid: null, ...p, bad: p.bad ?? ext ?? state };
-};
-// The room as stored, read without a reader's lock or state: for an author working out the signals of its own message
-// (append runs inside reader locks too). Readers check signals themselves.
-export const asStored = (R) => {
-    const s = R.hub.store.room(R.name) ?? R.s;
-    return link(new Map(R.hub.store.logIds(s).map(id => [id, R.hub.store.messages(s, id, R.hub.store.logHead(s, id)).map((x, seq) => toMessage(R, id, x, seq))])));
-};
-const CARRIES = (p, R) => !p.bad && (p.kind === R.profile.opens || !!p.assign || !!p.state || ['proposal', 'stamp', 'decision', 'usage'].includes(p.kind ?? ''));
-// A message on the author's log, and the signals it made (signals.ts).
-export const append = (R, who, text, entries = []) => {
-    const id = R.hub.store.append(R.s, who, text, entries);
-    if (CARRIES(parse(text, s => R.hub.store.isRef(s)), R)) {
-        const all = asStored(R);
-        const m = all.get(id);
-        if (m)
-            emit(R, who, all, m);
-    }
-    return id;
-};
-export const withSizes = (R, m) => {
-    if (!m.files.length)
-        return [];
-    const sizes = R.hub.store.sizes(m.id, m.files.map(f => f.path));
-    return m.files.map(f => ({ ...f, size: sizes.get(f.path) ?? null }));
-};
-export const pongText = (me, m, what) => compose(`pong: ${me} ${what}`, [['To', m.from], ['Re', m.id], ['Kind', 'pong'], ['Hop', String(m.hopEff + 1)]]);
-export { OPERATOR, HIDDEN };
-//# sourceMappingURL=index.js.map

package/target/esm/protocol/index.js

@@ -1,219 +0,0 @@
-// protocol: the message protocol, docs/spec/core-1.md (§3, §5–§7), independent of storage and of any task model. A store
-// turns its records into messages and hands them here: text, threads, inboxes and waking live in this file. What a
-// task is, which states it has and who may move it, is a profile (profile.ts), not part of the protocol.
-import { CC_RE } from './files.js';
-import { fail } from '../lib/index.js';
-export const ID_RE = /^(?=.{1,64}$)[a-z0-9]+(?:[._-][a-z0-9]+)*(?<!\.lock)$/;
-// An agent's id has no dot: it starts the name of its signals, `<agent>.<signal>.<message12>`.
-export const AGENT_RE = /^(?=.{1,64}$)[a-z0-9]+(?:[_-][a-z0-9]+)*$/;
-export const TOKEN_RE = /^[a-z][a-z0-9-]*$/;
-export const HOP_RE = /^(?:0|[1-9]\d{0,5})$/;
-export const TRAILER_RE = /^([A-Za-z][A-Za-z0-9-]*):[ \t]*(.*)$/;
-export const TEXT_MAX = 64 * 1024;
-// Trailers the protocol itself interprets; any other trailer belongs to an extension or a profile.
-export const KNOWN = new Set(['to', 're', 'kind', 'state', 'hop', 'assign', 'roles']);
-export const HEARTBEATS = new Set(['ping', 'pong']);
-// Kinds that are bookkeeping, never delivered to an inbox: heartbeats, usage receipts, cards, room records.
-export const HIDDEN = new Set(['ping', 'pong', 'usage', 'card', 'room']);
-export const one = (m, k) => m.trailers[k]?.[0] ?? null;
-// --- text (§3) ---
-const utf8 = new TextDecoder('utf-8', { fatal: true });
-// Invalid text is dangerous bytes: readers treat the message as absent.
-export const decodeText = (buf) => {
-    let s;
-    try {
-        s = utf8.decode(buf);
-    }
-    catch {
-        return { invalid: 'not valid UTF-8' };
-    }
-    s = s.replace(/\r\n/g, '\n');
-    if (/\r/.test(s))
-        return { invalid: 'a CR not followed by LF' };
-    if (CC_RE.test(s))
-        return { invalid: 'control characters in the text' };
-    return { text: s };
-};
-// Parses well-formed and malformed text alike; `bad` names why a message routes nowhere. `isRef` is the store's
-// grammar for message ids in `Re`.
-export const parse = (raw, isRef) => {
-    const text = raw.replace(/\r\n/g, '\n').trimEnd();
-    const cut = text.lastIndexOf('\n\n');
-    const tail = cut < 0 ? [] : text.slice(cut + 2).split('\n');
-    const has = tail.length > 0 && tail.every(l => TRAILER_RE.test(l));
-    const trailers = {};
-    if (has) {
-        for (const l of tail) {
-            const [, k, v] = TRAILER_RE.exec(l);
-            const key = k.toLowerCase();
-            trailers[key] = [...(trailers[key] ?? []), v.trim()];
-        }
-    }
-    const head = has ? text.slice(0, cut) : text;
-    const nl = head.indexOf('\n');
-    const subject = (nl < 0 ? head : head.slice(0, nl)).trim();
-    const bad = [...KNOWN].filter(k => (trailers[k]?.length ?? 0) > 1).map(k => `duplicate ${k}`);
-    const get = (k) => trailers[k]?.[0] ?? null;
-    const ids = (v) => v === null ? null : [...new Set(v.split(',').map(x => x.trim()))];
-    const to = get('to') === '*' ? ['*'] : ids(get('to'));
-    const assign = ids(get('assign'));
-    // Roles: `<id>=<label>, …`; the label `none` clears one.
-    const pairs = get('roles') === null ? null : get('roles').split(',').map(x => x.trim().split('=').map(y => y.trim()));
-    if (pairs && !pairs.every(p => p.length === 2 && ID_RE.test(p[0]) && TOKEN_RE.test(p[1])))
-        bad.push('malformed Roles');
-    if (!subject)
-        bad.push('empty subject');
-    if (Buffer.byteLength(raw) > TEXT_MAX)
-        bad.push('text over 64 KiB');
-    if (!has)
-        bad.push('no trailer block');
-    else if (!to)
-        bad.push('no To');
-    else if (to[0] !== '*' && !to.every(x => ID_RE.test(x)))
-        bad.push('malformed To');
-    if (assign && !assign.every(x => ID_RE.test(x)))
-        bad.push('malformed Assign');
-    if (get('re') !== null && !isRef(get('re')))
-        bad.push('malformed Re');
-    if (get('hop') !== null && !HOP_RE.test(get('hop')))
-        bad.push('malformed Hop');
-    // A state is a token; whether the room's profile knows it is the store's check.
-    if (get('state') !== null && !TOKEN_RE.test(get('state')))
-        bad.push('malformed State');
-    if (get('kind') !== null && !TOKEN_RE.test(get('kind')))
-        bad.push('malformed Kind');
-    const ok = !bad.length;
-    return {
-        subject,
-        body: nl < 0 ? '' : head.slice(nl + 1).replace(/^\n+/, '').trimEnd(),
-        // A malformed message is read as if it had no trailers.
-        to: ok ? to : [],
-        assign: ok ? assign : null,
-        roles: ok && pairs ? Object.fromEntries(pairs) : null,
-        re: ok ? get('re') : null,
-        kind: ok ? get('kind') : null,
-        state: ok ? get('state') : null,
-        hop: ok && get('hop') !== null ? Number(get('hop')) : 0,
-        bad: bad.join(', ') || null,
-        trailers,
-    };
-};
-export const compose = (text, trailers) => `${text}\n\n${trailers.filter(([, v]) => v).map(([k, v]) => `${k}: ${v}`).join('\n')}\n`;
-// A client refuses to write what readers would drop or ignore (§3).
-export const checkOutgoing = (text, isRef) => {
-    const d = decodeText(Buffer.from(text));
-    if (d.invalid !== undefined)
-        fail(`refusing to send: ${d.invalid}`);
-    const m = parse(d.text, isRef);
-    if (m.bad)
-        fail(`refusing to send a malformed message: ${m.bad}`);
-    return m;
-};
-// --- threads (§5) ---
-// Resolves Re and computes effective hops. Invalid messages are absent: a Re naming one does not resolve.
-export const link = (logs) => {
-    const all = new Map();
-    for (const msgs of logs.values())
-        for (const m of msgs)
-            if (!m.invalid)
-                all.set(m.id, m);
-    for (const m of all.values())
-        m.reId = m.re && all.has(m.re) ? m.re : null;
-    const eff = new Map();
-    for (const m of all.values()) {
-        const chain = [];
-        for (let x = m; x && !eff.has(x.id) && chain.length < 100000; x = x.reId ? all.get(x.reId) : undefined)
-            chain.push(x);
-        for (let i = chain.length - 1; i >= 0; i--) {
-            const c = chain[i];
-            eff.set(c.id, Math.max(c.hop, c.reId ? eff.get(c.reId) + 1 : c.re ? 1 : 0));
-        }
-        m.hopEff = eff.get(m.id);
-    }
-    return all;
-};
-// Kahn's order: the answered message before the answer, earlier before later within one log; among the ready ones,
-// the smallest (time, id) goes first.
-export const ordered = (list) => {
-    const byId = new Map(list.map(m => [m.id, m]));
-    const next = new Map(list.map(m => [m.id, []]));
-    const indeg = new Map(list.map(m => [m.id, 0]));
-    const edge = (a, b) => {
-        next.get(a.id).push(b);
-        indeg.set(b.id, indeg.get(b.id) + 1);
-    };
-    const last = new Map();
-    for (const m of [...list].sort((a, b) => a.seq - b.seq)) {
-        if (last.has(m.from))
-            edge(last.get(m.from), m);
-        last.set(m.from, m);
-        if (m.reId && byId.has(m.reId))
-            edge(byId.get(m.reId), m);
-    }
-    const ready = list.filter(m => !indeg.get(m.id));
-    const res = [];
-    while (ready.length) {
-        ready.sort((a, b) => a.time - b.time || (a.id < b.id ? -1 : 1));
-        const m = ready.shift();
-        res.push(m);
-        for (const n of next.get(m.id)) {
-            indeg.set(n.id, indeg.get(n.id) - 1);
-            if (!indeg.get(n.id))
-                ready.push(n);
-        }
-    }
-    return res;
-};
-export const chainHas = (all, m, top) => {
-    for (let x = m, i = 0; x && i < 10000; x = x.reId ? all.get(x.reId) : undefined, i++)
-        if (x === top)
-            return true;
-    return false;
-};
-export const rootOf = (all, m) => {
-    let x = m;
-    for (let i = 0; x.reId && all.has(x.reId) && i < 10000; i++)
-        x = all.get(x.reId);
-    return x;
-};
-export const under = (all, top) => ordered([...all.values()].filter(m => chainHas(all, m, top)));
-export const lookup = (all, ref) => {
-    const key = String(ref ?? '').toLowerCase();
-    if (all.has(key))
-        return all.get(key);
-    const hits = key.length >= 4 ? [...all.keys()].filter(k => k.startsWith(key)) : [];
-    if (hits.length === 1)
-        return all.get(hits[0]);
-    return fail(hits.length ? `ambiguous message id ${ref}` : `unknown message ${ref}`);
-};
-// --- reading (§6) and waking (§7) ---
-// Delivered: well-formed, not a hidden kind, addressed to `id` by name or `*`.
-export const visible = (m, id, hidden) => !m.invalid && !m.bad && !(m.kind && hidden.has(m.kind)) && (m.to.includes(id) || m.to.includes('*'));
-// Wakes: only a direct address. Broadcasts are read when the agent is awake for another reason.
-export const wakes = (m, id, hidden) => visible(m, id, hidden) && m.to.includes(id);
-// Messages for `id` after the per-log cursors; cursors advance only past what was shown.
-export const unread = (logs, id, cursors, limit = Infinity, hidden) => {
-    const fresh = [];
-    for (const [log, msgs] of logs) {
-        if (log === id)
-            continue;
-        const at = msgs.findIndex(m => m.id === cursors[log]);
-        fresh.push(...msgs.slice(at + 1).filter(m => visible(m, id, hidden)));
-    }
-    const queue = ordered(fresh);
-    const shown = queue.slice(0, limit);
-    const seen = new Set(shown.map(m => m.id));
-    const next = { ...cursors };
-    for (const [log, msgs] of logs) {
-        if (log === id)
-            continue;
-        const at = msgs.findIndex(m => m.id === cursors[log]);
-        for (const m of msgs.slice(at + 1)) {
-            if (visible(m, id, hidden) && !seen.has(m.id))
-                break;
-            next[log] = m.id;
-        }
-    }
-    return { msgs: shown, rest: queue.length - shown.length, cursors: next };
-};
-//# sourceMappingURL=index.js.map

package/target/esm/runtime/reader.js

@@ -1,65 +0,0 @@
-// reader: what one reader on this machine accepted of a room: heads, signals, cursors, alarms. Only history that
-// extends what it accepted before, verified by the store, is delivered (docs/spec/hub-1.md, Trust).
-import path from 'node:path';
-import * as Signals from '../domain/signals.js';
-import { HOME, locked, readJson, writeJson } from '../home/index.js';
-import { toMessage } from '../hub/index.js';
-import { fail, note, short } from '../lib/index.js';
-import { link } from '../protocol/index.js';
-export const readerFile = (R, reader) => path.join(HOME, 'readers', R.hub.name, R.genesis, `${reader}.json`);
-export const readerLock = (R, reader, fn) => locked(`reader-${R.hub.name}-${R.genesis.slice(0, 12)}-${reader}`, fn);
-export const loadState = (R, reader) => readJson(readerFile(R, reader), {});
-export const saveState = (R, reader, st) => writeJson(readerFile(R, reader), st);
-// Every log must keep extending what this reader accepted, and the store must verify it (a signed store: every entry
-// signed by the key the room admitted). A log that lost, rewrote or forked accepted history, or fails verification,
-// is quarantined: withheld, its accepted head pinned as evidence. Only `ringi forget` by the operator accepts a new
-// baseline.
-export const loadRoomUnlocked = (R, reader) => {
-    const st = loadState(R, reader);
-    const store = R.hub.store;
-    if (st.control && !store.extends(st.control, R.head)) {
-        fail(`ALARM room ${R.name}: its control history was rewritten (accepted ${short(st.control)}, now ${short(R.head)}). Nothing is delivered; the operator decides`);
-    }
-    st.control = R.head;
-    st.heads ??= {};
-    const alarms = [...store.alarms?.(R.s) ?? []];
-    const logs = new Map();
-    for (const id of new Set([...store.logIds(R.s), ...Object.keys(st.heads)])) {
-        const cur = store.logHead(R.s, id);
-        const acc = st.heads[id];
-        const why = !cur ? `log ${id} was deleted after ${short(acc)}`
-            : acc && !store.extends(acc, cur) ? `log ${id} was rewritten: ${short(cur)} does not extend the accepted ${short(acc)}`
-                : !store.extends(R.genesis, cur) ? `log ${id} does not descend from the room's genesis`
-                    : store.verifyLog(R.s, id, cur);
-        if (why) {
-            alarms.push(why.startsWith('log ') ? why : `log ${id}: ${why}`);
-            continue;
-        }
-        if (acc !== cur) {
-            st.heads[id] = cur;
-            store.pin(R.s, reader, id, cur);
-        }
-        logs.set(id, store.messages(R.s, id, cur).map((x, seq) => toMessage(R, id, x, seq)));
-    }
-    const records = store.signals(R.s);
-    const checked = Signals.check(R, link(logs), records);
-    const signalPins = Signals.pins(records, checked, st.signals);
-    st.signals = signalPins.accepted;
-    alarms.push(...signalPins.alarms, ...checked.filter(x => !x.ok).map(x => `signal ${x.ref}: ${x.why}`));
-    const reported = new Set(st.alarms ?? []);
-    for (const a of alarms)
-        if (!reported.has(a))
-            note(`ALARM ${a}; ${a.startsWith('signal ')
-                ? 'the messages stay the truth; the author restores a missing signal with ringi agent signals --repair'
-                : a.startsWith('commit ') ? 'it is skipped; the room reads on without it'
-                    : `it is quarantined and withheld. Restore it, or the operator runs ringi forget ${R.name}/<log>`}`);
-    st.alarms = alarms;
-    saveState(R, reader, st);
-    return { logs, st };
-};
-export const loadRoom = (R, reader) => readerLock(R, reader, () => loadRoomUnlocked(R, reader));
-export const linked = (R, reader) => {
-    const { logs } = loadRoom(R, reader);
-    return { logs, all: link(logs) };
-};
-//# sourceMappingURL=reader.js.map