@lapxo/bound 0.2.3 → 0.2.5

package/dist/host/contextual-place.js

@@ -1,77 +1,2 @@
-import { openSync, fstatSync, readSync, closeSync } from 'node:fs';
-import { readPlaceActContext, PLACE_ACT_CONTEXT } from '@lapxo/topos/core';
-import { declaredRootClockSource, hasRootClockSource } from "./root-clock-source.js";
-import { commitPlaceAct, placeActResult, committedPlaceActResults } from "./ports/place-act.js";
-import { placesIn } from "../fold/places.js";
-import { appliedHistoryIn } from "../fold/signed.js";
-import { storeOf } from "../land/ledger.js";
-import { publicStandingLines } from "./admitted-place.js";
-import { foldClaims, fieldOf } from "../fold/claims.js";
-const fail = (s) => { throw Error('REFUSE·contextual place ' + s); };
-function read(path, limit) {
-    const fd = openSync(path, 'r');
-    try {
-        const stat = fstatSync(fd);
-        if (!stat.isFile() || stat.size > limit)
-            fail('batch byte budget');
-        const data = Buffer.alloc(stat.size);
-        let n = 0;
-        while (n < data.length) {
-            const got = readSync(fd, data, n, data.length - n, null);
-            if (!got)
-                fail('batch changed during read');
-            n += got;
-        }
-        if (readSync(fd, Buffer.alloc(1), 0, 1, null))
-            fail('batch changed during read');
-        return new TextDecoder('utf8', { fatal: true }).decode(data);
-    }
-    finally {
-        closeSync(fd);
-    }
-}
-export function hasContextualPlace(root) { return hasRootClockSource(root); }
-/** Exact selected SDK frame plus complete pre-signed receiver statements. No
- * executable/verifier/epoch selection can be supplied by this envelope. */
-export async function landContextualPlace(root, file) {
-    const selected = declaredRootClockSource(root), raw = read(file, selected.selection.budget.bytes);
-    let packet;
-    try {
-        packet = JSON.parse(raw);
-    }
-    catch {
-        return fail('invalid batch JSON');
-    }
-    if (!packet || Object.keys(packet).sort().join(',') !== 'context,profile,receipts' || packet.profile !== PLACE_ACT_CONTEXT || typeof packet.context !== 'string' || !Array.isArray(packet.receipts) || JSON.stringify(packet) + '\n' !== raw)
-        fail('unsupported/noncanonical batch envelope');
-    return commitPlaceAct(storeOf(root), packet.context, packet.receipts, selected.trust, selected.selection.storageBudget);
-}
-export function contextualAct(root, identity) {
-    const selected = declaredRootClockSource(root), bundle = placeActResult(storeOf(root), identity, selected.trust, selected.selection.storageBudget);
-    if (!bundle)
-        return undefined;
-    const all = new Map(committedPlaceActResults(storeOf(root), selected.trust, selected.selection.storageBudget).map(a => [a.identity, a])), kept = new Set(), contexts = [];
-    const visit = (id) => { if (kept.has(id))
-        return; const a = all.get(id); if (!a)
-        return; kept.add(id); const decoded = readPlaceActContext(a.bundle.context, selected.selection.budget); for (const p of decoded.places)
-        visit(p.previous); contexts.push({ identity: a.identity, context: a.bundle.context, receipts: a.bundle.receipts, authority: selected.authority(a.bundle.context) }); };
-    visit(identity);
-    return { profile: PLACE_ACT_CONTEXT, identity, context: bundle.context, receipts: bundle.receipts, contexts };
-}
-/** Carriers retain exact originals and authenticated context/receipts. Each
- * namespace folds independently; labels assert no statistical independence. */
-export function contextualStanding(root) {
-    const selected = declaredRootClockSource(root), acts = committedPlaceActResults(storeOf(root), selected.trust, selected.selection.storageBudget);
-    const groups = new Map();
-    for (const act of acts) {
-        const decoded = readPlaceActContext(act.bundle.context, selected.selection.budget);
-        for (const p of decoded.places) {
-            const key = JSON.stringify([decoded.root.namespace, p.place]), group = groups.get(key) ?? { namespace: decoded.root.namespace, place: p.place, lines: [], contexts: [] };
-            group.lines.push(...p.records);
-            group.contexts.push({ identity: act.identity, context: act.bundle.context, receipts: act.bundle.receipts });
-            groups.set(key, group);
-        }
-    }
-    const legacyPlaces = placesIn(root).map(place => { const history = appliedHistoryIn(root, place), folded = foldClaims(history); return { namespace: 'legacy-global', place: [place, 'TARGET.bound'].join('/'), standing: folded.standing.filter(line => fieldOf(line, 'value') !== 'withdraw'), history }; });
-    return { profile: PLACE_ACT_CONTEXT, root: publicStandingLines(root), legacyPlaces, contexts: acts.map(a => ({ identity: a.identity, context: a.bundle.context, receipts: a.bundle.receipts, authority: selected.authority(a.bundle.context) })), places: [...groups.values()].map(group => { const folded = foldClaims(group.lines); return { namespace: group.namespace, place: group.place, standing: folded.standing.filter(line => fieldOf(line, 'value') !== 'withdraw'), retracted: folded.retracted, superseded: folded.superseded, forks: folded.forks, contexts: group.contexts }; }) };
-}
+var S=Object.defineProperty;var r=(t,c)=>S(t,"name",{value:c,configurable:!0});import{openSync as A,fstatSync as C,readSync as x,closeSync as E}from"node:fs";import{library3_readPlaceActContext as y,library3_PLACE_ACT_CONTEXT as m}from"../vendor/runtime.js";import{declaredRootClockSource as d,hasRootClockSource as P}from"./root-clock-source.js";import{commitPlaceAct as T,placeActResult as _,committedPlaceActResults as g}from"./ports/place-act.js";import{placesIn as N}from"../fold/places.js";import{appliedHistoryIn as O}from"../fold/signed.js";import{storeOf as p}from"../land/ledger.js";import{publicStandingLines as R}from"./admitted-place.js";import{projectContextualStanding as w}from"./standing-carrier.js";import{admissionHistoryAt as B}from"../fold/admission-history.js";const u=r(t=>{throw Error("REFUSE\xB7contextual place "+t)},"fail");function k(t,c){const n=A(t,"r");try{const e=C(n);(!e.isFile()||e.size>c)&&u("batch byte budget");const o=Buffer.alloc(e.size);let i=0;for(;i<o.length;){const l=x(n,o,i,o.length-i,null);l||u("batch changed during read"),i+=l}return x(n,Buffer.alloc(1),0,1,null)&&u("batch changed during read"),new TextDecoder("utf8",{fatal:!0}).decode(o)}finally{E(n)}}r(k,"read");function U(t){return P(t)}r(U,"hasContextualPlace");async function q(t,c){const n=d(t),e=k(c,n.selection.budget.bytes);let o;try{o=JSON.parse(e)}catch{return u("invalid batch JSON")}return(!o||Object.keys(o).sort().join(",")!=="context,profile,receipts"||o.profile!==m||typeof o.context!="string"||!Array.isArray(o.receipts)||JSON.stringify(o)+`
+`!==e)&&u("unsupported/noncanonical batch envelope"),T(p(t),o.context,o.receipts,n.trust,n.selection.storageBudget)}r(q,"landContextualPlace");function K(t,c){const n=d(t),e=_(p(t),c,n.trust,n.selection.storageBudget);if(!e)return;const o=new Map(g(p(t),n.trust,n.selection.storageBudget).map(s=>[s.identity,s])),i=new Set,l=[],f=r(s=>{if(i.has(s))return;const a=o.get(s);if(!a)return;i.add(s);const b=y(a.bundle.context,n.selection.budget);for(const h of b.places)f(h.previous);l.push({identity:a.identity,context:a.bundle.context,receipts:a.bundle.receipts,authority:n.authority(a.bundle.context)})},"visit");return f(c),{profile:m,identity:c,context:e.context,receipts:e.receipts,contexts:l}}r(K,"contextualAct");function j(t){const c=d(t),n=g(p(t),c.trust,c.selection.storageBudget);return{rootHistory:B(t,Number.MAX_SAFE_INTEGER),legacyPlaces:N(t).map(e=>({place:[e,"TARGET.bound"].join("/"),history:O(t,e)})),contexts:n.map(e=>({identity:e.identity,context:e.bundle.context,receipts:e.bundle.receipts,authority:c.authority(e.bundle.context)}))}}r(j,"contextualStandingSnapshot");function Q(t){const c=j(t),n=d(t);return w(R(t),c.legacyPlaces,c.contexts,c.contexts.map(e=>({identity:e.identity,context:y(e.context,n.selection.budget)})))}r(Q,"contextualStanding");export{K as contextualAct,Q as contextualStanding,j as contextualStandingSnapshot,U as hasContextualPlace,q as landContextualPlace};

package/dist/host/digest.js

@@ -1,15 +1,2 @@
-import { createHash } from 'node:crypto';
-import { byBytes } from '@lapxo/topos/wire';
-import { selfName } from "../fold/claims.js";
-/** Sorted by UTF-8 bytes; the algorithm is a field (`sha256:…`), never bare hex. */
-export function fullDigest(input, algorithm) {
-    if (!algorithm)
-        throw new Error(`${selfName()}: REFUSE·runtime a digest was asked for before the lock said which algorithm`);
-    const text = typeof input === 'string' ? input : [...input].sort(byBytes).join('\n');
-    return `${algorithm}:${createHash(algorithm).update(text).digest('hex')}`;
-}
-export function bytesDigest(bytes, algorithm) {
-    if (!algorithm)
-        throw new Error(`${selfName()}: REFUSE·runtime a digest was asked for before the lock said which algorithm`);
-    return `${algorithm}:${createHash(algorithm).update(bytes).digest('hex')}`;
-}
+var f=Object.defineProperty;var t=(r,e)=>f(r,"name",{value:e,configurable:!0});import{createHash as o}from"node:crypto";import{library11_byBytes as a}from"../vendor/runtime.js";import{selfName as s}from"../fold/claims.js";function w(r,e){if(!e)throw new Error(`${s()}: REFUSE\xB7runtime a digest was asked for before the lock said which algorithm`);const i=typeof r=="string"?r:[...r].sort(a).join(`
+`);return`${e}:${o(e).update(i).digest("hex")}`}t(w,"fullDigest");function m(r,e){if(!e)throw new Error(`${s()}: REFUSE\xB7runtime a digest was asked for before the lock said which algorithm`);return`${e}:${o(e).update(r).digest("hex")}`}t(m,"bytesDigest");export{m as bytesDigest,w as fullDigest};

package/dist/host/hash.js

@@ -1,9 +1 @@
-import { createHash } from 'node:crypto';
-/** SHA-256 byte hashing for host formats that explicitly name this algorithm. */
-export const sha = (bytes) => createHash('sha256').update(bytes).digest('hex');
-/** Typed digest spelling shared by fixed host boundaries; hashes identical bytes. */
-export const sha256 = (bytes) => 'sha256:' + sha(bytes);
-/** Length-delimited UTF-8 fields for existing host history identities. */
-export function hashText(hash, value) { hash.update(String(Buffer.byteLength(value, 'utf8')) + ':'); hash.update(value, 'utf8'); }
-/** Exact typed SHA-256 spelling used by fixed host declarations. */
-export const isSha256 = (value) => typeof value === 'string' && /^sha256:[0-9a-f]{64}$/.test(value);
+var o=Object.defineProperty;var e=(t,s)=>o(t,"name",{value:s,configurable:!0});import{createHash as a}from"node:crypto";const r=e(t=>a("sha256").update(t).digest("hex"),"sha"),f=e(t=>"sha256:"+r(t),"sha256");function n(t,s){t.update(String(Buffer.byteLength(s,"utf8"))+":"),t.update(s,"utf8")}e(n,"hashText");const i=e(t=>typeof t=="string"&&/^sha256:[0-9a-f]{64}$/.test(t),"isSha256");export{n as hashText,i as isSha256,r as sha,f as sha256};

package/dist/host/host-controls.js

@@ -0,0 +1 @@
+var s=Object.defineProperty;var o=(e,t)=>s(e,"name",{value:t,configurable:!0});import{library11_LOCK as r}from"../vendor/runtime.js";import{BoundRefusal as n}from"./refusals.js";function i(e){throw new n("host/"+e,"REFUSE\xB7host/"+e)}o(i,"refuseHost");function u(e){e?.aborted&&i("cancelled")}o(u,"assertHostNotCancelled");function m(e,t){return(!/^(0|[1-9][0-9]*)$/.test(e)||!Number.isSafeInteger(Number(e)))&&t("unknown receiver clock"),Number(e)}o(m,"receiverClock");const p=o(e=>typeof e=="string"&&e.endsWith("/"+r)&&!e.startsWith("/")&&!e.split("/").some(t=>!t||t==="."||t===".."),"isPlaceLockCoordinate"),a=o(e=>e==="."?"":e.slice(0,-(r.length+1)),"placeRegionOf");export{u as assertHostNotCancelled,p as isPlaceLockCoordinate,a as placeRegionOf,m as receiverClock,i as refuseHost};

package/dist/host/in-process-act.js

@@ -0,0 +1,3 @@
+var _=Object.defineProperty;var o=(i,t)=>_(i,"name",{value:t,configurable:!0});import{library11_authorityAtEpoch as M}from"../vendor/runtime.js";import{library3_placeReceiptBytes as q,library3_readPlaceActContext as F}from"../vendor/runtime.js";import{library2_readingIdentity as E,library2_readingReceiptIdentity as P}from"../vendor/runtime.js";import{readContent as H,invokeFrameSigningPort as J}from"../engine/ports.js";import{transactPlaceAct as O,PlaceActCommitUnknown as U}from"./place-act-transaction.js";import{withActHost as I}from"../land/act.js";import{sha256 as a,isSha256 as z}from"./hash.js";import{BoundRefusal as v}from"./refusals.js";import{refuseHost as r}from"./host-controls.js";import{withHostInstrument as w}from"./call-context.js";import{requireEffects as Z}from"./read-only.js";async function et(i,t){return w(t.instrumentName,()=>I({name:t.instrumentName,report:o(()=>{},"report"),signal:i.signal},async()=>{try{Z("contextual host admission");const{place:e,source:c,identity:s,rootSnapshot:m,algorithm:g,signal:h}=i,N=structuredClone(i.reading),d={...i.contentLimits},y={...i.signingLimits},f={...i.storageLimits};(typeof t.instrumentName!="string"||!t.instrumentName||!/[a-zA-Z0-9]/.test(t.instrumentName)||!/^[a-zA-Z0-9._-]+$/.test(t.instrumentName)||typeof e!="string"||!e||typeof c!="string"||!c||typeof g!="string"||!g)&&r("context"),(f.acts>t.limits.storage.acts||f.bytes>t.limits.storage.bytes||y.timeoutMs>t.limits.signing.timeoutMs||y.maxBytes>t.limits.signing.maxBytes||d.timeoutMs>t.limits.content.timeoutMs||d.maxBytes>t.limits.content.maxBytes)&&r("budget");const S=E({...N,inputs:[...N.inputs,["host/place",a(e)],["host/snapshot",m],["host/act",s],["host/operation",a(JSON.stringify([g,d,y,f]))]]},a),n=t.trust();n.contract.root.snapshot!==m&&r("stale"),d.maxBytes>n.contract.budget.bytes&&r("budget");const L=await H(c,s,{read:t.read,digestBytes:a},d,h);let p;try{p=new TextDecoder("utf-8",{fatal:!0}).decode(L)}catch{return r("snapshot-format")}const b=F(p,n.contract.budget);n.contract.digest(p)!==s&&r("integrity");const A=await O(p,o(async()=>{const u=n.contract.receiptSigner,B=n.contract.signers.find(l=>l.id===u);(!B||M({scope:n.contract.receiptScope,by:u},B,Number(n.contract.root.epoch),n.contract.receiptScope,"authority").kind!=="admitted")&&r("receiver-authority");const R=await J({keyId:u,algorithm:g,bytes:b.places.map(l=>q(s,l,b.root,u,n.contract.receiptScope,n.contract.budget))},t.sign,y,h);return b.places.map((l,C)=>({place:l.place,by:u,signature:R[C].signature}))},"acquire"),n,f,t.persistence,h),k=a(JSON.stringify(A)+`
+`);return{kind:"fact",value:{place:e,act:A,reading:S,result:k,commitment:P(S,k,a)}}}catch(e){return e instanceof U?{kind:"uncertain",identity:e.identity,code:e.code,diagnostic:e.message}:{kind:"refuse",code:e instanceof v?e.code:"host/failed",diagnostic:e instanceof Error?e.message:"REFUSE\xB7host/failed"}}}))}o(et,"landPlaceActInProcess");function it(i,t){return w(t.instrumentName,()=>I({name:t.instrumentName,report:o(()=>{},"report"),signal:i.signal},()=>{try{i.signal?.aborted&&r("cancelled"),(!i.place||!z(i.identity))&&r("context");const e={...i.storageLimits};(e.acts>t.limits.storage.acts||e.bytes>t.limits.storage.bytes)&&r("budget");const c=E({...structuredClone(i.reading),inputs:[...i.reading.inputs,["host/place",a(i.place)],["host/act",i.identity],["host/operation",a("historical-recovery")]]},a),s=t.persistence.result(i.identity,t.trust(),e);s||r("act-unavailable");const m=a(JSON.stringify(s)+`
+`);return{kind:"fact",value:{place:i.place,identity:i.identity,act:s,historical:!0,reading:c,result:m,commitment:P(c,m,a)}}}catch(e){return{kind:"refuse",code:e instanceof v?e.code:"host/failed",diagnostic:e instanceof Error?e.message:"REFUSE\xB7host/failed"}}}))}o(it,"recoverPlaceActInProcess");export{et as landPlaceActInProcess,it as recoverPlaceActInProcess};

package/dist/host/in-process-context.js

@@ -0,0 +1,3 @@
+var O=Object.defineProperty;var h=(r,a)=>O(r,"name",{value:a,configurable:!0});import{library11_parse as x}from"../vendor/runtime.js";import{library2_readingIdentity as A,library2_readingReceiptIdentity as C}from"../vendor/runtime.js";import{readContent as N}from"../engine/ports.js";import{sha256 as y}from"./hash.js";import{BoundRefusal as P}from"./refusals.js";import{refuseHost as e,isPlaceLockCoordinate as v,placeRegionOf as H}from"./host-controls.js";import{publicStandingProjection as w,assertStandingView as k}from"./standing-projection.js";import{rootClockSelectionOf as J,inspectPortablePlaceContexts as I}from"./root-clock-source.js";import{projectContextualStanding as R}from"./standing-carrier.js";import{authorityFor as j}from"../fold/signers.js";import{ownRecordAdmitted as E}from"../fold/signed.js";import{wordsOf as _}from"../fold/wire.js";import{fieldOf as S,isConfig as B}from"../fold/claims.js";import{signatureEraOf as F}from"./signature-era.js";function L(r,a,o){(!r||Object.keys(r).sort().join(",")!=="contexts,legacyPlaces,rootHistory"||!Array.isArray(r.rootHistory)||!Array.isArray(r.legacyPlaces)||!Array.isArray(r.contexts))&&e("snapshot-format");let i=r.rootHistory.length;i>o&&e("budget");const m=h(t=>typeof t=="string"&&x(t).kind==="fact","validLine");(!r.rootHistory.length||r.rootHistory.some(t=>!m(t)))&&e("snapshot-format");const s=w(r.rootHistory,a),f=_(s,"families");f.length&&!f.includes("view")&&e("vocabulary-unavailable"),k(s);const l=J(s,a),n=F(s).admitted;(r.legacyPlaces.length>l.resources.places||r.contexts.length>l.resources.acts)&&e("budget");const g=j(r.rootHistory,a,n).admitted;g.some(t=>!t.coverage.includes("*"))&&!f.includes("region")&&e("vocabulary-unavailable");const p=new Set;for(const t of r.legacyPlaces){(!t||!v(t.place)||p.has(t.place)||!Array.isArray(t.history))&&e("snapshot-format"),p.add(t.place),i+=t.history.length,i>o&&e("budget");const d=H(t.place);t.history.some(c=>!m(c)||!E(c,d,"region",g,n))&&e("legacy-authority")}for(const t of r.contexts){(!t||!t.authority||!Array.isArray(t.authority.history))&&e("snapshot-format"),i+=t.authority.history.length,i>o&&e("budget");const d=S(t.authority.checkpoint,"epoch"),c=r.rootHistory.filter(b=>!B(b)||Number(S(b,"epoch"))<=Number(d));JSON.stringify(c)!==JSON.stringify(t.authority.history)&&e("historical-snapshot")}const u=I(JSON.stringify(r.contexts),a,l);return R(s,r.legacyPlaces,r.contexts,u)}h(L,"authenticatedCarrier");async function tt(r,a){try{const{place:o,source:i,snapshot:m,signal:s}=r,f=structuredClone(r.anchor),l=structuredClone(r.reading),n={...r.limits};(!o||typeof o!="string"||!i||typeof i!="string"||!Number.isSafeInteger(n.records)||n.records<1)&&e("context");const g=A({...l,inputs:[...l.inputs,["host/place",y(o)],["host/anchor",y(JSON.stringify(f))],["host/snapshot",m]]},y),p=await N(i,m,{read:a.read,digestBytes:y},n,s);let u,t;try{u=new TextDecoder("utf-8",{fatal:!0}).decode(p),t=JSON.parse(u)}catch{return e("snapshot-format")}JSON.stringify(t)+`
+`!==u&&e("snapshot-format"),s?.aborted&&e("cancelled");const d=L(t,f,n.records),c=y(JSON.stringify(d)+`
+`);return{kind:"fact",value:{place:o,standing:d,reading:g,result:c,commitment:C(g,c,y)}}}catch(o){return{kind:"refuse",code:o instanceof P?o.code:"host/failed",diagnostic:o instanceof Error?o.message:"REFUSE\xB7host/failed"}}}h(tt,"readContextualStandingInProcess");export{tt as readContextualStandingInProcess};

package/dist/host/in-process-root.js

@@ -0,0 +1,6 @@
+var H=Object.defineProperty;var d=(n,e)=>H(n,"name",{value:e,configurable:!0});import{library11_canonical as T,library11_parse as F}from"../vendor/runtime.js";import{library2_readingIdentity as J,library2_readingReceiptIdentity as L}from"../vendor/runtime.js";import{readContent as M}from"../engine/ports.js";import{acceptRootRecords as O}from"../cli/accept.js";import{verifiedLegacyActResult as I}from"../cli/act-result.js";import{admissionHistoryAt as U,admissionAnchor as j}from"../fold/admission-history.js";import{isConfig as P}from"../fold/claims.js";import{sha256 as s,isSha256 as R}from"./hash.js";import{BoundRefusal as A}from"./refusals.js";import{refuseHost as r}from"./host-controls.js";import{ActCommitUnknown as q}from"./commit-result.js";import{requireEffects as z}from"./read-only.js";import{withHostCall as S}from"./call-context.js";import{withActHost as D}from"../land/act.js";const w=d(n=>s(U(n,Number.MAX_SAFE_INTEGER).join(`
+`)+`
+`),"rootLotSnapshot");async function se(n,e){const i=[];let f=0,o;const m=structuredClone(e.runtime),a={...n.limits};return S({instrumentName:e.instrumentName,runtime:m,output:d((t,l)=>{f+=new TextEncoder().encode(l).length,f>e.limits.diagnostics&&r("budget"),i.push({stream:t,text:l})},"output")},()=>D({name:e.instrumentName,report:d(t=>{f+=new TextEncoder().encode(t).length,f>e.limits.diagnostics&&r("budget"),i.push({stream:"error",text:t})},"report"),signal:n.signal},async()=>{try{z("Root lot admission"),(!n.place||!e.root||!e.instrumentName||!m.root||!m.entry||!m.directory||![".ts",".js"].includes(m.extension)||!Array.isArray(m.lock)||!m.lock.length)&&r("context"),(a.records>e.limits.records||a.maxBytes>e.limits.maxBytes||a.timeoutMs>e.limits.timeoutMs||!Number.isSafeInteger(a.records)||a.records<1||!Number.isSafeInteger(e.limits.diagnostics)||e.limits.diagnostics<1)&&r("budget");const{place:t,snapshot:l,source:C,digest:p,signal:y}=n,b=structuredClone(n.reading);(!R(l)||w(e.root)!==l)&&r("stale");const _=j(e.root),k=J({...b,inputs:[...b.inputs,["host/place",s(t)],["host/snapshot",l],["host/anchor",s(JSON.stringify(_))],["host/draft",p],["host/principal",s(e.signer.keyId)],["host/operation",s(JSON.stringify(["root-lot",a]))]]},s),x=await M(C,p,{read:e.read,digestBytes:s},a,y);let h;try{h=new TextDecoder("utf-8",{fatal:!0}).decode(x)}catch{return r("snapshot-format")}const g=h.endsWith(`
+`)?h.slice(0,-1).split(`
+`):[];(!g.length||g.length>a.records)&&r("budget");for(const u of g){const c=F(u);(c.kind!=="fact"||T(c.value.fields,c.value.version)!==u||!P(u)||c.value.fields.by!=="target"||c.value.fields.epoch!==void 0||c.value.fields.sig!==void 0)&&r("root-lot-format")}w(e.root)!==l&&r("stale");const v=await O(e.root,{records:g,keyId:e.signer.keyId,signer:{name:e.signer.name,sign:e.signer.sign,signal:y},signal:y,storage:e.storage,prepared:e.prepared,committed:d((u,c,B)=>{o={identity:u,bundle:c,status:B}},"committed")});if(v!==0&&!o)return{kind:"refuse",code:"host/act",diagnostics:i};const E={place:t,status:o?.status??"already-held",...o?{identity:o.identity,act:I(e.root,o.identity).result}:{},conformance:v===0?"complete":"refused",reading:k},N=s(JSON.stringify(E)+`
+`);return{kind:"fact",value:{...E,result:N,commitment:L(k,N,s)},diagnostics:i}}catch(t){return t instanceof q?{kind:"uncertain",identity:t.identity,code:t.code,diagnostic:t.message,diagnostics:i}:o?{kind:"fact",value:{place:n.place,status:o.status,identity:o.identity,conformance:"incomplete"},diagnostic:t instanceof Error?t.message:"post-commit failure",diagnostics:i}:{kind:"refuse",code:t instanceof A?t.code:"host/failed",diagnostic:t instanceof Error?t.message:"REFUSE\xB7host/failed",diagnostics:i}}}))}d(se,"landRootLotInProcess");function ae(n,e){return S({instrumentName:e.instrumentName,runtime:structuredClone(e.runtime),output:d(()=>{},"output")},()=>{try{R(n)||r("context");const i=I(e.root,n);return{kind:"fact",value:{historical:!0,act:i.result,bundle:i.bundle}}}catch(i){return{kind:"refuse",code:i instanceof A?i.code:"host/failed",diagnostic:i instanceof Error?i.message:"REFUSE\xB7host/failed"}}})}d(ae,"recoverRootActInProcess");export{se as landRootLotInProcess,ae as recoverRootActInProcess,w as rootLotSnapshot};

package/dist/host/in-process.js

@@ -0,0 +1,4 @@
+var I=Object.defineProperty;var m=(e,d)=>I(e,"name",{value:d,configurable:!0});import{library11_parse as R}from"../vendor/runtime.js";import{library2_readingIdentity as y,library2_readingReceiptIdentity as k}from"../vendor/runtime.js";import{readContent as C}from"../engine/ports.js";import{sha256 as a,isSha256 as v}from"./hash.js";import{BoundRefusal as w}from"./refusals.js";import{refuseHost as r}from"./host-controls.js";import{assertStandingView as E,publicStandingProjection as _}from"./standing-projection.js";async function H(e,d){try{(!e||typeof e.place!="string"||!e.place||typeof e.source!="string"||!e.source||!v(e.snapshot))&&r("context"),e.signal?.aborted&&r("cancelled");const{place:i,source:b,snapshot:g,signal:c}=e,s={...e.limits};(!Number.isSafeInteger(s.records)||s.records<1)&&r("budget");const t=structuredClone(e.anchor),l=structuredClone(e.reading);(!t||t.keyClass!=="authorize"||!t.id||!t.publicKey||!Array.isArray(t.coverage)||!t.coverage.length)&&r("context"),y(l,a);const p=y({...l,inputs:[...l.inputs,["host/place",a(i)],["host/anchor",a(JSON.stringify(t))],["host/snapshot",g]]},a),S=await C(b,g,{read:d.read,digestBytes:a},s,c);let u;try{u=new TextDecoder("utf-8",{fatal:!0}).decode(S)}catch{return r("snapshot-format")}const n=u.split(`
+`).filter(f=>f.length>0);n.length>s.records&&r("budget"),(!n.length||n.some(f=>R(f).kind!=="fact"))&&r("snapshot-format"),c?.aborted&&r("cancelled");const o=_(n,t);E(o),c?.aborted&&r("cancelled");const h=a(o.join(`
+`)+(o.length?`
+`:""));return{kind:"fact",value:{place:i,rootStanding:o,reading:p,result:h,commitment:k(p,h,a)}}}catch(i){return{kind:"refuse",code:i instanceof w?i.code:"host/failed",diagnostic:i instanceof Error?i.message:"REFUSE\xB7host/failed"}}}m(H,"readRootStandingInProcess");export{H as readRootStandingInProcess};

package/dist/host/index.d.ts

@@ -0,0 +1 @@
+export {public2_HostInstrumentRuntime as HostInstrumentRuntime,public2_NativeHostInstrument as NativeHostInstrument,public2_NativeReadingIdentityContext as NativeReadingIdentityContext,public2_NativeReadingIdentityResult as NativeReadingIdentityResult,public2_NativeViewIdentityContext as NativeViewIdentityContext,public2_NativeViewIdentityResult as NativeViewIdentityResult,public2_PlaceActBudget as PlaceActBudget,public2_PlaceActHostContext as PlaceActHostContext,public2_PlaceActHostPorts as PlaceActHostPorts,public2_PlaceActPersistence as PlaceActPersistence,public2_PlaceActTrust as PlaceActTrust,public2_PreparedReading as PreparedReading,public2_PublicationStorage as PublicationStorage,public2_ReadingPreparationLimits as ReadingPreparationLimits,public2_ReadingPreparationResult as ReadingPreparationResult,public2_RootLotContext as RootLotContext,public2_RootLotPorts as RootLotPorts,public2_RootStandingHostContext as RootStandingHostContext,public2_RootStandingHostResult as RootStandingHostResult,public2_landPlaceActInProcess as landPlaceActInProcess,public2_landRootLotInProcess as landRootLotInProcess,public2_nativeHostInstrument as nativeHostInstrument,public2_nativePlaceActPersistence as nativePlaceActPersistence,public2_nativePlaceActReceiver as nativePlaceActReceiver,public2_prepareNativeReadingIdentity as prepareNativeReadingIdentity,public2_prepareNativeViewIdentity as prepareNativeViewIdentity,public2_readContextualStandingInProcess as readContextualStandingInProcess,public2_readRootStandingInProcess as readRootStandingInProcess,public2_recoverPlaceActInProcess as recoverPlaceActInProcess,public2_recoverRootActInProcess as recoverRootActInProcess,public2_rootLotSnapshot as rootLotSnapshot} from "../public-types.js";

package/dist/host/index.js

@@ -0,0 +1 @@
+import{readRootStandingInProcess as o}from"./in-process.js";import{readContextualStandingInProcess as n}from"./in-process-context.js";import{landPlaceActInProcess as c,recoverPlaceActInProcess as s}from"./in-process-act.js";import{landRootLotInProcess as p,recoverRootActInProcess as P,rootLotSnapshot as d}from"./in-process-root.js";import{nativeHostInstrument as m,nativePlaceActReceiver as v}from"./native-receiver.js";import{nativePlaceActPersistence as f}from"./ports/place-act.js";import{prepareNativeReadingIdentity as A,prepareNativeViewIdentity as R}from"./reading-identity.js";export{c as landPlaceActInProcess,p as landRootLotInProcess,m as nativeHostInstrument,f as nativePlaceActPersistence,v as nativePlaceActReceiver,A as prepareNativeReadingIdentity,R as prepareNativeViewIdentity,n as readContextualStandingInProcess,o as readRootStandingInProcess,s as recoverPlaceActInProcess,P as recoverRootActInProcess,d as rootLotSnapshot};

package/dist/host/io.js

@@ -1,11 +1 @@
-/** The host's node surface: kernel folders import here, never `node:`. World reads still go through observeFile. */
-export { spawn, spawnSync } from 'node:child_process';
-export { createHash } from 'node:crypto';
-export { appendFileSync, closeSync, existsSync, linkSync, lstatSync, mkdirSync, mkdtempSync, openSync, readFileSync, readSync, readdirSync, realpathSync, renameSync, rmSync, statSync, writeFileSync, } from 'node:fs';
-export { tmpdir } from 'node:os';
-export { basename, dirname, join, relative, resolve } from 'node:path';
-export { fileURLToPath } from 'node:url';
-export { parentPort, workerData } from 'node:worker_threads';
-export { gzipSync } from 'node:zlib';
-/** UTF-8 encoding is shared with host-free protocol ports. */
-export { encodeUTF8 } from "../engine/encoding.js";
+import{spawn as n,spawnSync as o}from"node:child_process";import{createHash as a}from"node:crypto";import{appendFileSync as p,closeSync as y,existsSync as S,linkSync as m,lstatSync as i,mkdirSync as d,mkdtempSync as f,openSync as l,readFileSync as s,readSync as x,readdirSync as k,realpathSync as w,renameSync as F,rmSync as h,statSync as v,writeFileSync as P}from"node:fs";import{tmpdir as U}from"node:os";import{basename as g,dirname as j,join as z,relative as D,resolve as H}from"node:path";import{fileURLToPath as R}from"node:url";import{parentPort as u,workerData as A}from"node:worker_threads";import{gzipSync as C}from"node:zlib";import{encodeUTF8 as G}from"../engine/encoding.js";export{p as appendFileSync,g as basename,y as closeSync,a as createHash,j as dirname,G as encodeUTF8,S as existsSync,R as fileURLToPath,C as gzipSync,z as join,m as linkSync,i as lstatSync,d as mkdirSync,f as mkdtempSync,l as openSync,u as parentPort,s as readFileSync,x as readSync,k as readdirSync,w as realpathSync,D as relative,F as renameSync,H as resolve,h as rmSync,n as spawn,o as spawnSync,v as statSync,U as tmpdir,A as workerData,P as writeFileSync};

package/dist/host/lifetime.js

@@ -1,79 +1 @@
-import { spawn } from 'node:child_process';
-const deadline = BigInt(process.argv[2] ?? '0'), responseBytes = Number(process.argv[3]);
-if (deadline <= 0n || !Number.isSafeInteger(responseBytes) || responseBytes <= 0)
-    throw Error('REFUSE·reader invalid process limits');
-let child, finished = false, failure, size = 0;
-const stdout = [], stderr = [];
-const grouped = process.platform !== 'win32';
-const cancel = () => { if (child?.pid === undefined)
-    return; try {
-    if (grouped)
-        process.kill(-child.pid, 'SIGKILL');
-    else
-        child.kill('SIGKILL');
-}
-catch { } };
-const finish = (status, signal) => {
-    if (finished)
-        return;
-    finished = true;
-    clearTimeout(timer);
-    cancel();
-    child?.stdin?.destroy();
-    child?.stdout?.destroy();
-    child?.stderr?.destroy();
-    process.stdin.destroy();
-    const bytes = failure ? Buffer.alloc(0) : Buffer.concat(stdout);
-    const result = { stdout: bytes.toString('utf8'), stdoutBytes: bytes.toString('base64'), stderr: Buffer.concat(stderr).toString('utf8'), status, signal, ...(failure ? { failure } : {}) };
-    process.stdout.write(JSON.stringify(result));
-};
-const refuse = (why) => { if (failure && why === 'response exceeds declared byte bound' && !failure.includes(why))
-    failure += ' · ' + why;
-else
-    failure ?? (failure = why); finish(null, 'SIGKILL'); };
-// A closed input pipe can precede the queued stderr/close events of an early
-// rejecting child. Cancel immediately, but drain only until the SAME deadline.
-const inputFailed = (why) => { if (finished)
-    return; failure ?? (failure = why); stdout.length = 0; cancel(); child?.stdin?.destroy(); process.stdin.destroy(); if (process.hrtime.bigint() >= deadline)
-    finish(null, 'SIGKILL'); };
-const remaining = Number(deadline - process.hrtime.bigint()) / 1e6;
-const timer = setTimeout(() => refuse('declared timeout exhausted'), Math.max(0, remaining));
-process.once('SIGTERM', () => refuse('interrupted'));
-try {
-    if (remaining <= 0)
-        refuse('declared timeout exhausted');
-    const chunks = [];
-    for await (const chunk of process.stdin) {
-        if (finished)
-            break;
-        chunks.push(Buffer.from(chunk));
-    }
-    if (!finished) {
-        const request = JSON.parse(Buffer.concat(chunks).toString('utf8'));
-        if (request.limits.responseBytes !== responseBytes || !Number.isSafeInteger(request.limits.timeoutMs) || request.limits.timeoutMs <= 0)
-            throw Error('invalid process limits');
-        // Parsing is synchronous; recheck before spawning even if the timer has not
-        // had a turn to run. An expired handoff must never start the command.
-        if (process.hrtime.bigint() >= deadline) {
-            refuse('declared timeout exhausted');
-        }
-        else {
-            child = spawn(request.command, [...request.args], { cwd: request.cwd, env: request.env, detached: grouped, stdio: ['pipe', 'pipe', 'pipe'] });
-            const receive = (items, bytes) => { if (finished)
-                return; size += bytes.length; if (size > responseBytes)
-                refuse('response exceeds declared byte bound');
-            else if (!failure || items === stderr)
-                items.push(bytes); };
-            child.stdout.on('data', (b) => receive(stdout, b));
-            child.stderr.on('data', (b) => receive(stderr, b));
-            child.stdin.on('error', error => inputFailed('input failed: ' + error.message));
-            child.once('error', error => refuse(error.message));
-            child.once('close', finish);
-            child.stdin.end(request.input);
-        }
-    }
-}
-catch {
-    if (!finished)
-        refuse('input unavailable or malformed');
-}
+var I=Object.defineProperty;var d=(s,e)=>I(s,"name",{value:e,configurable:!0});import{spawn as y}from"node:child_process";const u=BigInt(process.argv[2]??"0"),a=Number(process.argv[3]);if(u<=0n||!Number.isSafeInteger(a)||a<=0)throw Error("REFUSE\xB7reader invalid process limits");let t,o=!1,i,g=0;const f=[],l=[],h=process.platform!=="win32",b=d(()=>{if(t?.pid!==void 0)try{h?process.kill(-t.pid,"SIGKILL"):t.kill("SIGKILL")}catch{}},"cancel"),p=d((s,e)=>{if(o)return;o=!0,clearTimeout(v),b(),t?.stdin?.destroy(),t?.stdout?.destroy(),t?.stderr?.destroy(),process.stdin.destroy();const c=i?Buffer.alloc(0):Buffer.concat(f),r={stdout:c.toString("utf8"),stdoutBytes:c.toString("base64"),stderr:Buffer.concat(l).toString("utf8"),status:s,signal:e,...i?{failure:i}:{}};process.stdout.write(JSON.stringify(r))},"finish"),n=d(s=>{i&&s==="response exceeds declared byte bound"&&!i.includes(s)?i+=" \xB7 "+s:i??(i=s),p(null,"SIGKILL")},"refuse"),B=d(s=>{o||(i??(i=s),f.length=0,b(),t?.stdin?.destroy(),process.stdin.destroy(),process.hrtime.bigint()>=u&&p(null,"SIGKILL"))},"inputFailed"),S=Number(u-process.hrtime.bigint())/1e6,v=setTimeout(()=>n("declared timeout exhausted"),Math.max(0,S));process.once("SIGTERM",()=>n("interrupted"));try{S<=0&&n("declared timeout exhausted");const s=[];for await(const e of process.stdin){if(o)break;s.push(Buffer.from(e))}if(!o){const e=JSON.parse(Buffer.concat(s).toString("utf8"));if(e.limits.responseBytes!==a||!Number.isSafeInteger(e.limits.timeoutMs)||e.limits.timeoutMs<=0)throw Error("invalid process limits");if(process.hrtime.bigint()>=u)n("declared timeout exhausted");else{t=y(e.command,[...e.args],{cwd:e.cwd,env:e.env,detached:h,stdio:["pipe","pipe","pipe"]});const c=d((r,m)=>{o||(g+=m.length,g>a?n("response exceeds declared byte bound"):(!i||r===l)&&r.push(m))},"receive");t.stdout.on("data",r=>c(f,r)),t.stderr.on("data",r=>c(l,r)),t.stdin.on("error",r=>B("input failed: "+r.message)),t.once("error",r=>n(r.message)),t.once("close",p),t.stdin.end(e.input)}}}catch{o||n("input unavailable or malformed")}

package/dist/host/located.js

@@ -1,105 +1,6 @@
-var __rewriteRelativeImportExtension = (this && this.__rewriteRelativeImportExtension) || function (path, preserveJsx) {
-    if (typeof path === "string" && /^\.\.?\//.test(path)) {
-        return path.replace(/\.(tsx)$|((?:\.d)?)((?:\.[^./]+?)?)\.([cm]?)ts$/i, function (m, tsx, d, ext, cm) {
-            return tsx ? preserveJsx ? ".jsx" : ".js" : d && (!ext || !cm) ? m : (d + ext + "." + cm.toLowerCase() + "js");
-        });
-    }
-    return path;
-};
-import { readFileSync } from 'node:fs';
-import { join } from 'node:path';
-import { pathToFileURL } from 'node:url';
-import { pinExport, provide } from "./provide.js";
-const wanted = (role) => role === 'reader' ? ['observe', 'run'] : [role];
-const foreign = (role) => ['render', 'receipt', 'observe', 'run'].filter((name) => !wanted(role).includes(name));
-const isFn = (module, name) => typeof module[name] === 'function';
-const text = (error) => (error instanceof Error ? error.message : String(error)).replace(/\s+/g, ' ').trim();
-/**
- * Wire and capsule of the world, from `dep/topos` (or the lock's `uses/topos` pin). The host never spells where that
- * package lies.
- */
-const sdk = async () => {
-    provide();
-    const [wireAt, capsuleAt] = [pinExport('topos', './wire'), pinExport('topos', './capsule')];
-    if (!wireAt || !capsuleAt)
-        throw new Error('REFUSE·pin dep/topos names no wire or capsule');
-    const [wire, capsule] = await Promise.all([import(__rewriteRelativeImportExtension(pathToFileURL(wireAt).href)), import(__rewriteRelativeImportExtension(pathToFileURL(capsuleAt).href))]);
-    return {
-        CAPSULE: String(wire['CAPSULE'] ?? ''),
-        PROTOCOL: String(wire['PROTOCOL'] ?? ''),
-        parse: wire['parse'],
-        declarationOf: capsule['declarationOf'],
-        readers: capsule['readers'],
-        receiptShell: capsule['receiptShell'],
-        shell: capsule['shell'],
-    };
-};
-/**
- * The host loads a world from its lock: the lock read once, each region imported from its one file by name and role into
- * the shell of its kind. A region that fails is one line on stderr and is left out; the regions that loaded still form
- * the shell. A world with no region of a kind has no shell of it. `load` is the host's child entry, the same load with
- * its places read from the arguments the host spawned it with.
- */
-/** A capsule that ships one render module: the host calls it per region and hands it the lines. The module does not read. */
-const pagesOf = async (root, file) => {
-    const { CAPSULE, PROTOCOL, declarationOf, shell } = await sdk();
-    const lines = readFileSync(join(root, CAPSULE), 'utf8').split('\n').filter((line) => line.startsWith(PROTOCOL));
-    const { regions } = declarationOf(lines);
-    const module = await import(__rewriteRelativeImportExtension(pathToFileURL(join(root, file)).href));
-    const render = module['render'] ?? module['default']?.['render'];
-    if (typeof render !== 'function')
-        return {};
-    const held = Object.fromEntries(Object.entries(regions).map(([name, reads]) => [name, {
-            reads,
-            region: (asked) => render({ ...asked, region: name }),
-        }]));
-    return held && Object.keys(held).length ? { render: shell(held) } : {};
-};
-export const locate = async (root, dir, ext) => {
-    if (ext === 'render')
-        return pagesOf(root, dir);
-    const { CAPSULE, PROTOCOL, parse, declarationOf, readers, receiptShell, shell } = await sdk();
-    const lines = readFileSync(join(root, CAPSULE), 'utf8').split('\n').filter((line) => line.startsWith(PROTOCOL));
-    const field = (line, name) => ((got) => (got.kind === 'fact' ? got.value.fields[name] ?? '' : ''))(parse(line));
-    const { regions, writes } = declarationOf(lines);
-    const reader = new Set(lines.filter((line) => field(line, 'measure') === 'writes').map((line) => field(line, 'scope').slice('region/'.length)));
-    const kind = (name) => (reader.has(name) ? 'reader' : writes[name] ?? '');
-    const region = async (name, reads, role) => {
-        let module;
-        try {
-            module = await import(__rewriteRelativeImportExtension(pathToFileURL(join(root, dir, `${name}${ext}`)).href));
-        }
-        catch (error) {
-            process.stderr.write(`LOAD     ${name} · module error · ${text(error)}\n`);
-            return undefined;
-        }
-        const has = wanted(role).filter((key) => isFn(module, key));
-        const exported = foreign(role).filter((key) => isFn(module, key));
-        if (!has.length && exported.length) {
-            process.stderr.write(`LOAD     ${name} · role mismatch · ${role} exports ${exported.join('|')}\n`);
-            return undefined;
-        }
-        if (!has.length) {
-            process.stderr.write(`LOAD     ${name} · missing export · ${wanted(role)[0]}\n`);
-            return undefined;
-        }
-        const picked = role === 'reader' ? { observe: module['observe'], run: module['run'] } : { region: module[role] };
-        return [name, { reads, ...picked }];
-    };
-    const loaded = async (role) => {
-        const held = [];
-        for (const [name, reads] of Object.entries(regions)) {
-            if (kind(name) !== role)
-                continue;
-            const row = await region(name, reads, role);
-            if (row)
-                held.push(row);
-        }
-        return held.length ? Object.fromEntries(held) : undefined;
-    };
-    const render = await loaded('render');
-    const receipt = await loaded('receipt');
-    const reading = await loaded('reader');
-    return { render: render && shell(render), receipt: receipt && receiptShell(receipt), ...(reading ? readers(reading) : {}) };
-};
-export const load = () => locate(process.argv[3] ?? '', process.argv[4] ?? '', process.argv[5] ?? '');
+var I=Object.defineProperty;var n=(e,t)=>I(e,"name",{value:t,configurable:!0});var m=function(e,t){return typeof e=="string"&&/^\.\.?\//.test(e)?e.replace(/\.(tsx)$|((?:\.d)?)((?:\.[^./]+?)?)\.([cm]?)ts$/i,function(i,o,d,p,f){return o?t?".jsx":".js":d&&(!p||!f)?i:d+p+"."+f.toLowerCase()+"js"}):e};import{readFileSync as P}from"node:fs";import{join as E}from"node:path";import{pathToFileURL as L}from"node:url";import{pinExport as R,provide as W}from"./provide.js";const j=n(e=>e==="reader"?["observe","run"]:[e],"wanted"),q=n(e=>["render","receipt","observe","run"].filter(t=>!j(e).includes(t)),"foreign"),U=n((e,t)=>typeof e[t]=="function","isFn"),z=n(e=>(e instanceof Error?e.message:String(e)).replace(/\s+/g," ").trim(),"text"),k=n(async()=>{W();const[e,t]=[R("topos","./wire"),R("topos","./capsule")];if(!e||!t)throw new Error("REFUSE\xB7pin dep/topos names no wire or capsule");const[i,o]=await Promise.all([import(m(L(e).href)),import(m(L(t).href))]);return{CAPSULE:String(i.CAPSULE??""),PROTOCOL:String(i.PROTOCOL??""),parse:i.parse,declarationOf:o.declarationOf,readers:o.readers,receiptShell:o.receiptShell,shell:o.shell}},"sdk"),B=n(async(e,t)=>{const{CAPSULE:i,PROTOCOL:o,declarationOf:d,shell:p}=await k(),f=P(E(e,i),"utf8").split(`
+`).filter(a=>a.startsWith(o)),{regions:S}=d(f),g=await import(m(L(E(e,t)).href)),O=g.render??g.default?.render;if(typeof O!="function")return{};const u=Object.fromEntries(Object.entries(S).map(([a,v])=>[a,{reads:v,region:n(y=>O({...y,region:a}),"region")}]));return u&&Object.keys(u).length?{render:p(u)}:{}},"pagesOf"),G=n(async(e,t,i)=>{if(i==="render")return B(e,t);const{CAPSULE:o,PROTOCOL:d,parse:p,declarationOf:f,readers:S,receiptShell:g,shell:O}=await k(),u=P(E(e,o),"utf8").split(`
+`).filter(r=>r.startsWith(d)),a=n((r,l)=>(s=>s.kind==="fact"?s.value.fields[l]??"":"")(p(r)),"field"),{regions:v,writes:y}=f(u),T=new Set(u.filter(r=>a(r,"measure")==="writes").map(r=>a(r,"scope").slice(7))),F=n(r=>T.has(r)?"reader":y[r]??"","kind"),_=n(async(r,l,s)=>{let c;try{c=await import(m(L(E(e,t,`${r}${i}`)).href))}catch(w){process.stderr.write(`LOAD     ${r} \xB7 module error \xB7 ${z(w)}
+`);return}const h=j(s).filter(w=>U(c,w)),C=q(s).filter(w=>U(c,w));if(!h.length&&C.length){process.stderr.write(`LOAD     ${r} \xB7 role mismatch \xB7 ${s} exports ${C.join("|")}
+`);return}if(!h.length){process.stderr.write(`LOAD     ${r} \xB7 missing export \xB7 ${j(s)[0]}
+`);return}const D=s==="reader"?{observe:c.observe,run:c.run}:{region:c[s]};return[r,{reads:l,...D}]},"region"),$=n(async r=>{const l=[];for(const[s,c]of Object.entries(v)){if(F(s)!==r)continue;const h=await _(s,c,r);h&&l.push(h)}return l.length?Object.fromEntries(l):void 0},"loaded"),b=await $("render"),x=await $("receipt"),A=await $("reader");return{render:b&&O(b),receipt:x&&g(x),...A?S(A):{}}},"locate"),Q=n(()=>G(process.argv[3]??"",process.argv[4]??"",process.argv[5]??""),"load");export{Q as load,G as locate};

package/dist/host/native/bounded-file.js

@@ -1,32 +1 @@
-import fs from 'node:fs';
-/** The opened descriptor is bounded before allocation/read. Growth after fstat
- * is detected with one sentinel byte; no oversized buffer reaches decode/hash.
- */
-export function readBoundedFile(path, remaining, coordinate) {
-    if (!Number.isSafeInteger(remaining) || remaining < 0)
-        throw Error('REFUSE·native file missing byte budget ' + coordinate);
-    const fd = fs.openSync(path, 'r');
-    try {
-        const stat = fs.fstatSync(fd);
-        if (!stat.isFile() || !Number.isSafeInteger(stat.size) || stat.size > remaining)
-            throw Error('REFUSE·native file byte budget before read ' + coordinate);
-        const bytes = Buffer.alloc(stat.size);
-        let offset = 0;
-        while (offset < bytes.length) {
-            const count = fs.readSync(fd, bytes, offset, bytes.length - offset, null);
-            if (!count)
-                throw Error('REFUSE·native file changed during read ' + coordinate);
-            offset += count;
-        }
-        if (fs.readSync(fd, Buffer.alloc(1), 0, 1, null) !== 0)
-            throw Error('REFUSE·native file grew during read ' + coordinate);
-        return bytes;
-    }
-    finally {
-        fs.closeSync(fd);
-    }
-}
-export function readBoundedBatch(paths, budget) {
-    let bytes = 0;
-    return paths.map(file => { const data = readBoundedFile(file.path, budget - bytes, file.coordinate); bytes += data.length; return data; });
-}
+var u=Object.defineProperty;var a=(o,e)=>u(o,"name",{value:e,configurable:!0});import f from"node:fs";function c(o,e,t){if(!Number.isSafeInteger(e)||e<0)throw Error("REFUSE\xB7native file missing byte budget "+t);const r=f.openSync(o,"r");try{const n=f.fstatSync(r);if(!n.isFile()||!Number.isSafeInteger(n.size)||n.size>e)throw Error("REFUSE\xB7native file byte budget before read "+t);const i=Buffer.alloc(n.size);let l=0;for(;l<i.length;){const s=f.readSync(r,i,l,i.length-l,null);if(!s)throw Error("REFUSE\xB7native file changed during read "+t);l+=s}if(f.readSync(r,Buffer.alloc(1),0,1,null)!==0)throw Error("REFUSE\xB7native file grew during read "+t);return i}finally{f.closeSync(r)}}a(c,"readBoundedFile");function h(o,e){let t=0;return o.map(r=>{const n=c(r.path,e-t,r.coordinate);return t+=n.length,n})}a(h,"readBoundedBatch");export{h as readBoundedBatch,c as readBoundedFile};

package/dist/host/native/command.js

@@ -1,91 +1 @@
-import { spawn } from 'node:child_process';
-import { channel } from 'node:diagnostics_channel';
-import { isAbsolute } from 'node:path';
-import { checkCommandPort, commandRequest, commandResponse } from '@lapxo/topos/contract';
-import { requireEffects } from "../read-only.js";
-import { assertNativeRuntime } from "./runtime.js";
-import { scheduleDeadline } from "./deadline.js";
-const rejectedCommand = channel('bound.command.refusal');
-/** macOS prototype: bounded async invocation with POSIX child-group cancellation.
- * No acquisition or persistence on prospective paths; no partial success frames.
- * Host callbacks are trusted admission/verification operations, never signatures
- * or authority assertions supplied by the command's own output. */
-export async function executeLot(options) {
-    const start = process.hrtime.bigint();
-    const { host, signal, phase, accepts } = options;
-    // Admitted semantic configuration is snapshotted for the whole invocation;
-    // mutations of a caller's delivery object cannot alter checks mid-flight.
-    const port = Object.freeze({ ...options.port, closure: Object.freeze([...options.port.closure]), environment: Object.freeze([...options.port.environment]) });
-    const lot = Object.freeze({ ...options.lot, requests: Object.freeze([...options.lot.requests]) });
-    const environment = Object.freeze({ ...options.environment });
-    assertNativeRuntime(environment, []);
-    const refuse = (why) => { throw Error(`REFUSE·port ${port.coordinate} ${why}`); };
-    if (phase !== 'act')
-        refuse('invocation forbidden during ' + phase);
-    requireEffects('command ' + port.coordinate);
-    if (signal?.aborted)
-        refuse('interrupted before invocation');
-    checkCommandPort(port, host);
-    const deadline = start + BigInt(port.timeoutMs) * 1000000n;
-    const resolved = host.resolve(port), invocation = Object.freeze({ ...resolved, args: Object.freeze([...resolved.args]) });
-    if (!isAbsolute(invocation.command) || !isAbsolute(invocation.cwd))
-        refuse('host invocation needs absolute coordinates');
-    if (host.loaderClosure(port, invocation) !== 'verified')
-        refuse('runtime-loader closure unmeasured');
-    const names = Object.keys(environment).sort(), declared = [...new Set(port.environment)].sort();
-    if (names.length !== declared.length || names.some((name, index) => name !== declared[index]) || names.some(name => typeof environment[name] !== 'string' || environment[name].includes('\0')))
-        refuse('environment differs from declared handoff');
-    const frame = commandRequest(port, lot);
-    const envelope = invocation.hostEnvelope;
-    if (envelope && (!Number.isSafeInteger(invocation.envelopeBytes) || invocation.envelopeBytes < 1 || envelope.byteLength > invocation.envelopeBytes))
-        refuse('host envelope byte resources');
-    if (process.hrtime.bigint() >= deadline)
-        refuse('timeout before invocation');
-    if (signal?.aborted)
-        refuse('interrupted before invocation');
-    const result = await new Promise((resolve, reject) => {
-        const child = spawn(invocation.command, [...invocation.args], { cwd: invocation.cwd, env: { ...environment }, shell: false, detached: false, stdio: envelope ? ['pipe', 'pipe', 'pipe', 'pipe'] : ['pipe', 'pipe', 'pipe'] });
-        const stdout = [], stderr = [];
-        let bytes = 0, why, done = false;
-        const stop = (cause) => { if (why)
-            return; why = cause; try {
-            child.kill('SIGKILL');
-        }
-        catch { } child.stdin.destroy(); if (envelope)
-            child.stdio[3]?.destroy(); };
-        const cancelTimer = scheduleDeadline(deadline, () => stop('timeout'));
-        const abort = () => stop('interrupted');
-        signal?.addEventListener('abort', abort, { once: true });
-        if (signal?.aborted)
-            abort();
-        const collect = (target, chunk, channel) => { if (why)
-            return; bytes += chunk.length; if (bytes > port.responseBytes) {
-            stop('response-bytes exceeded');
-            return;
-        } if (channel === 'stderr' && port.stderr === 'reject') {
-            rejectedCommand.publish({ coordinate: port.coordinate, stderr: chunk.subarray(0, Math.min(port.responseBytes, 1024)).toString('utf8') });
-            stop('stderr forbidden');
-            return;
-        } target.push(chunk); };
-        child.stdout.on('data', (chunk) => collect(stdout, chunk, 'stdout'));
-        child.stderr.on('data', (chunk) => collect(stderr, chunk, 'stderr'));
-        child.stdin.on('error', () => stop('request handoff failed'));
-        const finish = (status, error) => { if (done)
-            return; done = true; cancelTimer(); signal?.removeEventListener('abort', abort); if (error || why) {
-            reject(Error(`REFUSE·port ${port.coordinate} ${why ?? error.message}`));
-            return;
-        } resolve({ status, interrupted: false, stdout: Buffer.concat(stdout).toString('utf8'), stderr: Buffer.concat(stderr).toString('utf8') }); };
-        child.once('error', error => finish(null, error));
-        child.once('close', status => finish(status));
-        if (envelope) {
-            const pipe = child.stdio[3];
-            const header = Buffer.alloc(8);
-            header.writeBigUInt64BE(BigInt(envelope.byteLength));
-            pipe.on('error', () => stop('host envelope handoff failed'));
-            pipe.end(Buffer.concat([header, Buffer.from(envelope)]));
-        }
-        child.stdin.end(frame);
-    });
-    const members = commandResponse(port, lot, result, accepts);
-    return { members, stderr: result.stderr, invocations: 1 };
-}
+var _=Object.defineProperty;var a=(n,p)=>_(n,"name",{value:p,configurable:!0});import{spawn as k}from"node:child_process";import{channel as F}from"node:diagnostics_channel";import{isAbsolute as C}from"node:path";import{library2_checkCommandPort as M,library2_commandRequest as N,library2_commandResponse as A}from"../../vendor/runtime.js";import{requireEffects as D}from"../read-only.js";import{assertNativeRuntime as G}from"./runtime.js";import{scheduleDeadline as K}from"./deadline.js";const T=F("bound.command.refusal");async function te(n){const p=process.hrtime.bigint(),{host:b,signal:m,phase:y,accepts:$}=n,t=Object.freeze({...n.port,closure:Object.freeze([...n.port.closure]),environment:Object.freeze([...n.port.environment])}),B=Object.freeze({...n.lot,requests:Object.freeze([...n.lot.requests])}),l=Object.freeze({...n.environment});G(l,[]);const i=a(c=>{throw Error(`REFUSE\xB7port ${t.coordinate} ${c}`)},"refuse");y!=="act"&&i("invocation forbidden during "+y),D("command "+t.coordinate),m?.aborted&&i("interrupted before invocation"),M(t,b);const j=p+BigInt(t.timeoutMs)*1000000n,E=b.resolve(t),r=Object.freeze({...E,args:Object.freeze([...E.args])});(!C(r.command)||!C(r.cwd))&&i("host invocation needs absolute coordinates"),b.loaderClosure(t,r)!=="verified"&&i("runtime-loader closure unmeasured");const h=Object.keys(l).sort(),w=[...new Set(t.environment)].sort();(h.length!==w.length||h.some((c,v)=>c!==w[v])||h.some(c=>typeof l[c]!="string"||l[c].includes("\0")))&&i("environment differs from declared handoff");const x=N(t,B),d=r.hostEnvelope;d&&(!Number.isSafeInteger(r.envelopeBytes)||r.envelopeBytes<1||d.byteLength>r.envelopeBytes)&&i("host envelope byte resources"),process.hrtime.bigint()>=j&&i("timeout before invocation"),m?.aborted&&i("interrupted before invocation");const O=await new Promise((c,v)=>{const o=k(r.command,[...r.args],{cwd:r.cwd,env:{...l},shell:!1,detached:!1,stdio:d?["pipe","pipe","pipe","pipe"]:["pipe","pipe","pipe"]}),z=[],S=[];let L=0,u,R=!1;const f=a(e=>{if(!u){u=e;try{o.kill("SIGKILL")}catch{}o.stdin.destroy(),d&&o.stdio[3]?.destroy()}},"stop"),P=K(j,()=>f("timeout")),g=a(()=>f("interrupted"),"abort");m?.addEventListener("abort",g,{once:!0}),m?.aborted&&g();const q=a((e,s,U)=>{if(!u){if(L+=s.length,L>t.responseBytes){f("response-bytes exceeded");return}if(U==="stderr"&&t.stderr==="reject"){T.publish({coordinate:t.coordinate,stderr:s.subarray(0,Math.min(t.responseBytes,1024)).toString("utf8")}),f("stderr forbidden");return}e.push(s)}},"collect");o.stdout.on("data",e=>q(z,e,"stdout")),o.stderr.on("data",e=>q(S,e,"stderr")),o.stdin.on("error",()=>f("request handoff failed"));const I=a((e,s)=>{if(!R){if(R=!0,P(),m?.removeEventListener("abort",g),s||u){v(Error(`REFUSE\xB7port ${t.coordinate} ${u??s.message}`));return}c({status:e,interrupted:!1,stdout:Buffer.concat(z).toString("utf8"),stderr:Buffer.concat(S).toString("utf8")})}},"finish");if(o.once("error",e=>I(null,e)),o.once("close",e=>I(e)),d){const e=o.stdio[3],s=Buffer.alloc(8);s.writeBigUInt64BE(BigInt(d.byteLength)),e.on("error",()=>f("host envelope handoff failed")),e.end(Buffer.concat([s,Buffer.from(d)]))}o.stdin.end(x)});return{members:A(t,B,O,$),stderr:O.stderr,invocations:1}}a(te,"executeLot");export{te as executeLot};