@lapxo/bound 0.2.3 → 0.2.5

package/dist/host/native/control-bridge-worker.js

@@ -1,88 +1,2 @@
-/** Sealed Root control code: one fresh custodian connection per request. */
-import { parentPort, workerData } from 'node:worker_threads';
-import { createConnection } from 'node:net';
-const { endpoint, deadlineMs, shared, inputBytes, outputBytes } = workerData;
-const port = parentPort;
-if (!port)
-    throw Error('REFUSE·Root control transport parent absent');
-const header = new Int32Array(shared, 0, 8), input = new Uint8Array(shared, 32, inputBytes), output = new Uint8Array(shared, 32 + inputBytes, outputBytes);
-const initial = Math.min(endpoint.timeoutMs, deadlineMs - Date.now());
-const deadline = process.hrtime.bigint() + BigInt(Math.max(0, initial)) * 1000000n;
-const remaining = () => Math.max(0, Number((deadline - process.hrtime.bigint() + 999999n) / 1000000n));
-let busy = false, red, active;
-function finish(state, bytes) {
-    if (bytes.byteLength > outputBytes) {
-        state = 3;
-        bytes = Buffer.from('REFUSE·reply bytes').subarray(0, outputBytes);
-    }
-    output.set(bytes);
-    Atomics.store(header, 3, bytes.byteLength);
-    Atomics.store(header, 0, state);
-    Atomics.notify(header, 0);
-}
-// Timer slices never widen the original monotonic deadline.
-let timer;
-function arm() {
-    const left = remaining();
-    if (left > 0) {
-        timer = setTimeout(arm, Math.min(left, 2147483647));
-        timer.unref();
-        return;
-    }
-    red ?? (red = 'REFUSE·parent deadline');
-    active?.destroy(Error(red));
-    if (Atomics.load(header, 0) === 1)
-        finish(3, Buffer.from(red).subarray(0, outputBytes));
-    port.close();
-}
-arm();
-port.on('close', () => { clearTimeout(timer); active?.destroy(); });
-port.on('message', async (message) => {
-    if (busy || red || message !== Atomics.load(header, 1) || Atomics.load(header, 0) !== 1) {
-        red ?? (red = 'REFUSE·sequence/state');
-        finish(3, Buffer.from(red).subarray(0, outputBytes));
-        return;
-    }
-    busy = true;
-    try {
-        const length = Atomics.load(header, 2);
-        if (length < 1 || length > inputBytes)
-            throw Error('REFUSE·request bytes');
-        if (remaining() <= 0)
-            throw Error('REFUSE·parent deadline');
-        const frame = Buffer.from(input.slice(0, length));
-        const bytes = await new Promise((resolve, reject) => {
-            const socket = createConnection(endpoint.socket);
-            active = socket;
-            const chunks = [];
-            let size = 0, done = false;
-            const end = (error) => { if (done)
-                return; done = true; if (error)
-                reject(error);
-            else
-                resolve(Buffer.concat(chunks)); };
-            socket.once('connect', () => socket.write(Buffer.concat([frame, Buffer.from('\n')])));
-            socket.on('data', chunk => { size += chunk.length; if (size > outputBytes)
-                socket.destroy(Error('REFUSE·reply bytes'));
-            else
-                chunks.push(chunk); });
-            socket.once('error', end);
-            socket.once('close', () => end());
-        });
-        active = undefined;
-        if (!bytes.length)
-            throw Error('REFUSE·interrupted before reply');
-        if (remaining() <= 0)
-            throw Error('REFUSE·parent deadline');
-        busy = false;
-        finish(2, bytes);
-    }
-    catch (error) {
-        active = undefined;
-        red ?? (red = error instanceof Error ? error.message : String(error));
-        busy = false;
-        finish(3, Buffer.from(red).subarray(0, outputBytes));
-    }
-});
-Atomics.store(header, 5, 1);
-Atomics.notify(header, 5);
+var F=Object.defineProperty;var a=(r,e)=>F(r,"name",{value:e,configurable:!0});import{parentPort as M,workerData as k}from"node:worker_threads";import{createConnection as q}from"node:net";const{endpoint:A,deadlineMs:x,shared:l,inputBytes:d,outputBytes:s}=k,c=M;if(!c)throw Error("REFUSE\xB7Root control transport parent absent");const o=new Int32Array(l,0,8),D=new Uint8Array(l,32,d),I=new Uint8Array(l,32+d,s),L=Math.min(A.timeoutMs,x-Date.now()),P=process.hrtime.bigint()+BigInt(Math.max(0,L))*1000000n,E=a(()=>Math.max(0,Number((P-process.hrtime.bigint()+999999n)/1000000n)),"remaining");let u=!1,t,f;function m(r,e){e.byteLength>s&&(r=3,e=Buffer.from("REFUSE\xB7reply bytes").subarray(0,s)),I.set(e),Atomics.store(o,3,e.byteLength),Atomics.store(o,0,r),Atomics.notify(o,0)}a(m,"finish");let y;function B(){const r=E();if(r>0){y=setTimeout(B,Math.min(r,2147483647)),y.unref();return}t??(t="REFUSE\xB7parent deadline"),f?.destroy(Error(t)),Atomics.load(o,0)===1&&m(3,Buffer.from(t).subarray(0,s)),c.close()}a(B,"arm"),B(),c.on("close",()=>{clearTimeout(y),f?.destroy()}),c.on("message",async r=>{if(u||t||r!==Atomics.load(o,1)||Atomics.load(o,0)!==1){t??(t="REFUSE\xB7sequence/state"),m(3,Buffer.from(t).subarray(0,s));return}u=!0;try{const e=Atomics.load(o,2);if(e<1||e>d)throw Error("REFUSE\xB7request bytes");if(E()<=0)throw Error("REFUSE\xB7parent deadline");const U=Buffer.from(D.slice(0,e)),h=await new Promise((R,S)=>{const n=q(A.socket);f=n;const p=[];let b=0,w=!1;const g=a(i=>{w||(w=!0,i?S(i):R(Buffer.concat(p)))},"end");n.once("connect",()=>n.write(Buffer.concat([U,Buffer.from(`
+`)]))),n.on("data",i=>{b+=i.length,b>s?n.destroy(Error("REFUSE\xB7reply bytes")):p.push(i)}),n.once("error",g),n.once("close",()=>g())});if(f=void 0,!h.length)throw Error("REFUSE\xB7interrupted before reply");if(E()<=0)throw Error("REFUSE\xB7parent deadline");u=!1,m(2,h)}catch(e){f=void 0,t??(t=e instanceof Error?e.message:String(e)),u=!1,m(3,Buffer.from(t).subarray(0,s))}}),Atomics.store(o,5,1),Atomics.notify(o,5);

package/dist/host/native/control-bridge.js

@@ -1,110 +1 @@
-import { sha256 as digest } from "../hash.js";
-/** Root-fixed synchronous transport. It retains no grants or command results. */
-import { Worker, isMainThread } from 'node:worker_threads';
-import { readBoundedFile } from "./bounded-file.js";
-import { remainingDeadlineMs } from "./deadline.js";
-const FixedWorker = Worker;
-const HEADER_BYTES = 32;
-let controlWorkerOccupied = false;
-export function createFixedControlBridge(inputBinding) {
-    // @1 is one main-thread control worker per OS process, never a WorldWorker grant.
-    if (!isMainThread)
-        throw Error('REFUSE·Root control transport requires main-thread realm');
-    const refuse = (why) => { throw Error('REFUSE·Root control transport ' + why); };
-    const integer = (value) => Number.isSafeInteger(value) && value > 0;
-    const sourceBytes = inputBinding.workerBytes;
-    const workerSelection = Object.freeze({ ...inputBinding.worker });
-    if (!(sourceBytes instanceof Uint8Array) || !workerSelection.coordinate || !integer(workerSelection.bytes) || sourceBytes.byteLength !== workerSelection.bytes)
-        refuse('selected worker bytes/type bound differs before copy');
-    const binding = Object.freeze({ ...inputBinding,
-        endpoint: Object.freeze({ ...inputBinding.endpoint }), resources: Object.freeze({ ...inputBinding.resources }),
-        runtime: Object.freeze({ ...inputBinding.runtime }), worker: workerSelection,
-        workerBytes: Buffer.from(sourceBytes) });
-    const { endpoint, resources, runtime, worker: selected } = binding;
-    if (!selected.coordinate || !integer(selected.bytes) || binding.workerBytes.byteLength !== selected.bytes || digest(binding.workerBytes) !== selected.digest)
-        refuse('selected worker bytes differ');
-    if (runtime.path !== process.execPath || !integer(runtime.bytes) || digest(readBoundedFile(runtime.path, runtime.bytes, runtime.path)) !== runtime.digest)
-        refuse('selected runtime bytes differ');
-    if (![endpoint.timeoutMs, endpoint.responseBytes, endpoint.deadlineMs, binding.deadlineMs].every(integer) || binding.deadlineMs > endpoint.deadlineMs)
-        refuse('parent time/byte resource absent or widened');
-    // host-control-transport@1 encodes each byte length in a signed Int32 cell.
-    // Refuse an incompatible declaration; never wrap or clamp its bound.
-    if (resources.inputBytes > 2147483647 || resources.outputBytes > 2147483647)
-        refuse('host-control-transport@1 signed Int32 length representation');
-    const sharedBytes = HEADER_BYTES + resources.inputBytes + resources.outputBytes;
-    if (!Object.values(resources).every(integer) || !Number.isSafeInteger(sharedBytes) || resources.inputBytes > endpoint.responseBytes || resources.outputBytes > endpoint.responseBytes || sharedBytes > resources.sharedBytes)
-        refuse('shared/input/output resource absent or exceeded');
-    const remainingMs = Math.min(endpoint.timeoutMs, binding.deadlineMs - Date.now());
-    if (remainingMs <= 0)
-        refuse('parent deadline');
-    const deadline = process.hrtime.bigint() + BigInt(remainingMs) * 1000000n;
-    const remaining = remainingDeadlineMs.bind(undefined, deadline);
-    if (controlWorkerOccupied)
-        refuse('one live main-thread control worker resource exhausted');
-    let shared;
-    try {
-        shared = new SharedArrayBuffer(sharedBytes);
-    }
-    catch {
-        return refuse('shared resource allocation');
-    }
-    const header = new Int32Array(shared, 0, 8), input = new Uint8Array(shared, HEADER_BYTES, resources.inputBytes), output = new Uint8Array(shared, HEADER_BYTES + resources.inputBytes, resources.outputBytes);
-    // Independently sealed bytes are immutable here. A payload cannot select a path or verifier.
-    const code = Buffer.from(binding.workerBytes).toString('base64');
-    controlWorkerOccupied = true;
-    let worker;
-    try {
-        worker = new FixedWorker(new URL('data:text/javascript;base64,' + code), { execArgv: [], env: {}, workerData: { endpoint: { ...endpoint }, deadlineMs: binding.deadlineMs, shared, inputBytes: resources.inputBytes, outputBytes: resources.outputBytes } });
-    }
-    catch {
-        controlWorkerOccupied = false;
-        return refuse('worker construction interrupted');
-    }
-    let termination;
-    const stop = () => termination ?? (termination = worker.terminate().finally(() => { controlWorkerOccupied = false; }));
-    worker.once('exit', () => { controlWorkerOccupied = false; });
-    worker.unref();
-    let red, closed = false, sequence = 0;
-    const fail = (why) => { red ?? (red = 'REFUSE·Root control transport ' + why); void stop(); throw Error(red); };
-    // Error events still need a listener when a synchronous wait prevents JS callbacks.
-    worker.on('error', error => { red ?? (red = 'REFUSE·Root control transport worker interrupted: ' + error.message); });
-    if (Atomics.load(header, 5) !== 1 && Atomics.wait(header, 5, 0, remaining()) === 'timed-out')
-        fail('startup deadline/interruption');
-    return {
-        exchange(frame) {
-            if (red)
-                throw Error(red);
-            if (closed)
-                fail('closed');
-            if (remaining() <= 0)
-                fail('parent deadline');
-            if (typeof frame !== 'string' || !frame.length || Buffer.byteLength(frame, 'utf8') > resources.inputBytes)
-                fail('request bytes before copy');
-            const bytes = Buffer.from(frame, 'utf8');
-            if (Atomics.load(header, 0) !== 0 || sequence >= 2147483647)
-                fail('overlapping request/sequence');
-            input.set(bytes);
-            Atomics.store(header, 2, bytes.length);
-            Atomics.store(header, 1, ++sequence);
-            Atomics.store(header, 0, 1);
-            worker.postMessage(sequence);
-            if (Atomics.wait(header, 0, 1, remaining()) === 'timed-out' || remaining() <= 0)
-                fail('deadline/interruption');
-            const state = Atomics.load(header, 0), length = Atomics.load(header, 3);
-            if (length < 1 || length > resources.outputBytes)
-                fail('reply bytes');
-            let reply;
-            try {
-                reply = new TextDecoder('utf-8', { fatal: true }).decode(output.slice(0, length));
-            }
-            catch {
-                return fail('reply encoding');
-            }
-            if (state !== 2)
-                fail(reply);
-            Atomics.store(header, 0, 0);
-            return reply;
-        },
-        async close() { closed = true; await stop(); }
-    };
-}
+var D=Object.defineProperty;var f=(n,r)=>D(n,"name",{value:r,configurable:!0});import{sha256 as U}from"../hash.js";import{Worker as I,isMainThread as L}from"node:worker_threads";import{readBoundedFile as T}from"./bounded-file.js";import{remainingDeadlineMs as W}from"./deadline.js";const N=I,E=32;let p=!1;function G(n){if(!L)throw Error("REFUSE\xB7Root control transport requires main-thread realm");const r=f(t=>{throw Error("REFUSE\xB7Root control transport "+t)},"refuse"),l=f(t=>Number.isSafeInteger(t)&&t>0,"integer"),w=n.workerBytes,m=Object.freeze({...n.worker});(!(w instanceof Uint8Array)||!m.coordinate||!l(m.bytes)||w.byteLength!==m.bytes)&&r("selected worker bytes/type bound differs before copy");const i=Object.freeze({...n,endpoint:Object.freeze({...n.endpoint}),resources:Object.freeze({...n.resources}),runtime:Object.freeze({...n.runtime}),worker:m,workerBytes:Buffer.from(w)}),{endpoint:a,resources:e,runtime:d,worker:b}=i;(!b.coordinate||!l(b.bytes)||i.workerBytes.byteLength!==b.bytes||U(i.workerBytes)!==b.digest)&&r("selected worker bytes differ"),(d.path!==process.execPath||!l(d.bytes)||U(T(d.path,d.bytes,d.path))!==d.digest)&&r("selected runtime bytes differ"),(![a.timeoutMs,a.responseBytes,a.deadlineMs,i.deadlineMs].every(l)||i.deadlineMs>a.deadlineMs)&&r("parent time/byte resource absent or widened"),(e.inputBytes>2147483647||e.outputBytes>2147483647)&&r("host-control-transport@1 signed Int32 length representation");const B=E+e.inputBytes+e.outputBytes;(!Object.values(e).every(l)||!Number.isSafeInteger(B)||e.inputBytes>a.responseBytes||e.outputBytes>a.responseBytes||B>e.sharedBytes)&&r("shared/input/output resource absent or exceeded");const M=Math.min(a.timeoutMs,i.deadlineMs-Date.now());M<=0&&r("parent deadline");const j=process.hrtime.bigint()+BigInt(M)*1000000n,h=W.bind(void 0,j);p&&r("one live main-thread control worker resource exhausted");let y;try{y=new SharedArrayBuffer(B)}catch{return r("shared resource allocation")}const o=new Int32Array(y,0,8),F=new Uint8Array(y,E,e.inputBytes),O=new Uint8Array(y,E+e.inputBytes,e.outputBytes),q=Buffer.from(i.workerBytes).toString("base64");p=!0;let u;try{u=new N(new URL("data:text/javascript;base64,"+q),{execArgv:[],env:{},workerData:{endpoint:{...a},deadlineMs:i.deadlineMs,shared:y,inputBytes:e.inputBytes,outputBytes:e.outputBytes}})}catch{return p=!1,r("worker construction interrupted")}let x;const R=f(()=>x??(x=u.terminate().finally(()=>{p=!1})),"stop");u.once("exit",()=>{p=!1}),u.unref();let c,S=!1,g=0;const s=f(t=>{throw c??(c="REFUSE\xB7Root control transport "+t),R(),Error(c)},"fail");return u.on("error",t=>{c??(c="REFUSE\xB7Root control transport worker interrupted: "+t.message)}),Atomics.load(o,5)!==1&&Atomics.wait(o,5,0,h())==="timed-out"&&s("startup deadline/interruption"),{exchange(t){if(c)throw Error(c);S&&s("closed"),h()<=0&&s("parent deadline"),(typeof t!="string"||!t.length||Buffer.byteLength(t,"utf8")>e.inputBytes)&&s("request bytes before copy");const v=Buffer.from(t,"utf8");(Atomics.load(o,0)!==0||g>=2147483647)&&s("overlapping request/sequence"),F.set(v),Atomics.store(o,2,v.length),Atomics.store(o,1,++g),Atomics.store(o,0,1),u.postMessage(g),(Atomics.wait(o,0,1,h())==="timed-out"||h()<=0)&&s("deadline/interruption");const z=Atomics.load(o,0),k=Atomics.load(o,3);(k<1||k>e.outputBytes)&&s("reply bytes");let A;try{A=new TextDecoder("utf-8",{fatal:!0}).decode(O.slice(0,k))}catch{return s("reply encoding")}return z!==2&&s(A),Atomics.store(o,0,0),A},async close(){S=!0,await R()}}}f(G,"createFixedControlBridge");export{G as createFixedControlBridge};

package/dist/host/native/control-selection.js

@@ -1,32 +1 @@
-/** Optional Root-selected control transport. This is fixed host machinery,
- * never a world's worker permission or a change to producer message/work caps.
- * One retained control worker belongs only to the main thread of each process;
- * other Node realms keep the existing bounded fixed-client transport. */
-import { parsedLine as parse } from "../../fold/claims.js";
-import { authenticateSignedPort } from "./reading.js";
-const fail = (why) => { throw Error('REFUSE·host control ' + why); };
-const keys = (value) => value && typeof value === 'object' && !Array.isArray(value) ? Object.keys(value).sort().join(',') : '';
-const digest = (value) => typeof value === 'string' && /^sha256:[a-f0-9]{64}$/.test(value);
-export function selectedHostControl(root, parent) {
-    const coordinate = [parent.port.coordinate, 'control'].join('/'), rows = root.live.filter(line => { const got = parse(line); return got.kind === 'fact' && got.value.fields.scope === coordinate; });
-    if (!rows.length)
-        return undefined;
-    const selected = authenticateSignedPort(root, coordinate), profile = selected.profile, parsed = parse(selected.line);
-    if (parsed.kind !== 'fact' || parsed.value.fields.by !== root.signer.id)
-        fail('selection is not Root signed ' + coordinate);
-    if (keys(profile) !== 'coordinate,limits,profile,realm,runtime,selector,worker' || profile.profile !== 'host-control-transport@1' || profile.realm !== 'main-thread' || profile.coordinate !== coordinate || keys(profile.selector) !== 'implementation,port' || profile.selector.port !== parent.port.coordinate || profile.selector.implementation !== parent.port.implementation)
-        fail('profile selector differs ' + coordinate);
-    if (keys(profile.worker) !== 'bytes,coordinate,digest' || !/^native\/executor\/(?:dist|src)\/host\/native\/control-bridge-worker\.(?:js|ts)$/.test(profile.worker.coordinate) || !digest(profile.worker.digest) || !Number.isSafeInteger(profile.worker.bytes) || profile.worker.bytes < 1)
-        fail('fixed worker binding absent ' + coordinate);
-    const runtime = parent.selection.members.find(member => member.coordinate === parent.selection.runtime);
-    if (keys(profile.runtime) !== 'coordinate,digest' || !runtime || profile.runtime.coordinate !== runtime.coordinate || profile.runtime.digest !== runtime.digest)
-        fail('fixed runtime selection differs ' + coordinate);
-    if (keys(profile.limits) !== 'inFlight,sharedBytes,workersPerProcess' || profile.limits.workersPerProcess !== 1 || profile.limits.inFlight !== 1 || !Number.isSafeInteger(profile.limits.sharedBytes) || profile.limits.sharedBytes < 32)
-        fail('named resource invalid ' + coordinate);
-    if (!Number.isSafeInteger(parent.port.responseBytes) || parent.port.responseBytes < 1 || parent.port.responseBytes > 2147483647)
-        fail('message cap outside declared signed Int32 representation ' + coordinate);
-    const required = 32 + 2 * parent.port.responseBytes;
-    if (!Number.isSafeInteger(required) || profile.limits.sharedBytes < required)
-        fail('shared resource cannot preserve message caps ' + coordinate);
-    return Object.freeze({ line: selected.line, profile });
-}
+var g=Object.defineProperty;var s=(r,t)=>g(r,"name",{value:t,configurable:!0});import{parsedLine as p}from"../../fold/claims.js";import{authenticateSignedPort as u}from"./reading.js";const o=s(r=>{throw Error("REFUSE\xB7host control "+r)},"fail"),n=s(r=>r&&typeof r=="object"&&!Array.isArray(r)?Object.keys(r).sort().join(","):"","keys"),y=s(r=>typeof r=="string"&&/^sha256:[a-f0-9]{64}$/.test(r),"digest");function B(r,t){const i=[t.port.coordinate,"control"].join("/");if(!r.live.filter(l=>{const m=p(l);return m.kind==="fact"&&m.value.fields.scope===i}).length)return;const c=u(r,i),e=c.profile,a=p(c.line);(a.kind!=="fact"||a.value.fields.by!==r.signer.id)&&o("selection is not Root signed "+i),(n(e)!=="coordinate,limits,profile,realm,runtime,selector,worker"||e.profile!=="host-control-transport@1"||e.realm!=="main-thread"||e.coordinate!==i||n(e.selector)!=="implementation,port"||e.selector.port!==t.port.coordinate||e.selector.implementation!==t.port.implementation)&&o("profile selector differs "+i),(n(e.worker)!=="bytes,coordinate,digest"||!/^native\/executor\/(?:dist|src)\/host\/native\/control-bridge-worker\.(?:js|ts)$/.test(e.worker.coordinate)||!y(e.worker.digest)||!Number.isSafeInteger(e.worker.bytes)||e.worker.bytes<1)&&o("fixed worker binding absent "+i);const d=t.selection.members.find(l=>l.coordinate===t.selection.runtime);(n(e.runtime)!=="coordinate,digest"||!d||e.runtime.coordinate!==d.coordinate||e.runtime.digest!==d.digest)&&o("fixed runtime selection differs "+i),(n(e.limits)!=="inFlight,sharedBytes,workersPerProcess"||e.limits.workersPerProcess!==1||e.limits.inFlight!==1||!Number.isSafeInteger(e.limits.sharedBytes)||e.limits.sharedBytes<32)&&o("named resource invalid "+i),(!Number.isSafeInteger(t.port.responseBytes)||t.port.responseBytes<1||t.port.responseBytes>2147483647)&&o("message cap outside declared signed Int32 representation "+i);const f=32+2*t.port.responseBytes;return(!Number.isSafeInteger(f)||e.limits.sharedBytes<f)&&o("shared resource cannot preserve message caps "+i),Object.freeze({line:c.line,profile:e})}s(B,"selectedHostControl");export{B as selectedHostControl};

package/dist/host/native/custody.js

@@ -1,91 +1 @@
-/** Fixed Root constructor for finite descendant custody. It selects only current
- * authenticated Root records matching the already planned native parent job.
- */
-import { mkdtempSync, writeFileSync, rmSync } from 'node:fs';
-import { tmpdir } from 'node:os';
-import { join, extname } from 'node:path';
-import { fileURLToPath, pathToFileURL } from 'node:url';
-import { createHash } from 'node:crypto';
-import { parse } from '@lapxo/topos/wire';
-import { processOf, ownRoot } from "../../observe/runner.js";
-import { selectedHostControl } from "./control-selection.js";
-import { readBoundedFile } from "./bounded-file.js";
-import { authenticateSignedPort } from "./reading.js";
-import { createProducerJobCustody } from "./generated-custodian.js";
-const fail = (why) => { throw Error('REFUSE·native custody ' + why); };
-const sha = (raw) => 'sha256:' + createHash('sha256').update(raw).digest('hex');
-export function nativeRootJobCustody(root, profile, handoff, image, logical) {
-    const data = logical.members.map(member => { const location = image.locations.find(loc => loc.member === member.coordinate); if (!location)
-        return fail('literal member absent'); return { path: location.path, digest: member.digest }; }), libraries = logical.libraries.map(lib => { const location = image.locations.find(loc => loc.member === lib.manifest); if (!location)
-        return fail('library absent'); return { name: lib.name, manifest: location.path, coordinate: lib.manifest }; });
-    const candidates = root.live.flatMap(line => { const row = parse(line); if (row.kind !== 'fact' || !row.value.fields.scope.startsWith('port/'))
-        return []; let p; try {
-        p = JSON.parse(row.value.fields.about ?? '');
-    }
-    catch {
-        return [];
-    } return p?.selector?.port === profile.port.coordinate ? [{ coordinate: row.value.fields.scope, profile: p }] : []; });
-    return { async open(parent) {
-            const matching = candidates.filter(candidate => candidate.profile.selector.binding === parent.binding && candidate.profile.selector.implementation === parent.implementation);
-            const producers = matching.filter(candidate => candidate.profile.profile === 'host-generated-executable@3');
-            if (producers.length !== 1)
-                return fail('requires one current Root producer for ' + parent.binding);
-            const selected = producers[0];
-            authenticateSignedPort(root, selected.coordinate);
-            const control = selectedHostControl(root, profile);
-            const implementation = fileURLToPath(new URL('./generated' + extname(new URL(import.meta.url).pathname), import.meta.url)), implementationBytes = readBoundedFile(implementation, root.budget.bytes, implementation);
-            const runtime = image.locations.find(location => location.member === image.runtime), runtimeMember = handoff.members.find(member => member.coordinate === image.runtime);
-            if (!runtime || !runtimeMember)
-                return fail('fixed actual runtime absent');
-            const binaries = matching.filter(candidate => ['host-native-binary@1', 'host-native-binary-origin@1'].includes(candidate.profile.profile)).map(candidate => { const p = candidate.profile, location = image.locations.find(loc => loc.member === p.entry?.path), member = handoff.members.find(m => m.coordinate === p.entry?.path); if (!location || !member)
-                return fail('binary outside actual selected image'); return { coordinate: candidate.coordinate, privateBinding: { coordinate: member.coordinate, path: location.path, digest: member.digest } }; });
-            const programs = matching.filter(candidate => candidate.profile.profile === 'host-native-program@1').map(candidate => ({ coordinate: candidate.coordinate, runtimeBinding: { coordinate: image.runtime, path: runtime.path, digest: runtimeMember.digest, members: image.locations.map(location => ({ coordinate: location.member, path: location.path })) } }));
-            const directory = mkdtempSync(join(tmpdir(), 'bound-native-custody-')), contextFile = join(directory, 'context.json'), configFile = join(directory, 'loader.json');
-            let acquired;
-            try {
-                const service = createProducerJobCustody({ root, coordinate: selected.coordinate, implementationBytes, snapshot: { budget: { members: handoff.budget.members, bytes: handoff.budget.bytes }, members: data, libraries, builtins: logical.builtins, platform: logical.platform }, nativeImplementations: new Set(logical.members.map(member => member.digest)), directory, contextFile, nativeBinaries: binaries, programSelections: programs });
-                acquired = await service.open(parent);
-                const client = processOf('custodian'), clientBytes = readBoundedFile(client, parent.responseBytes, client), preload = new URL(pathToFileURL(processOf('native-descendant')).href);
-                preload.searchParams.set('config', configFile);
-                preload.searchParams.set('bytes', String(handoff.budget.bytes));
-                let controlEnvelope;
-                if (control) {
-                    const worker = control.profile.worker, path = join(ownRoot(), worker.coordinate.slice('native/executor/'.length)), raw = readBoundedFile(path, worker.bytes, worker.coordinate);
-                    if (raw.length !== worker.bytes || sha(raw) !== worker.digest)
-                        return fail('sealed control worker bytes differ');
-                    if (control.profile.runtime.coordinate !== image.runtime || control.profile.runtime.digest !== runtimeMember.digest)
-                        return fail('sealed control runtime differs');
-                    const shared = 32 + 2 * parent.responseBytes;
-                    if (!Number.isSafeInteger(shared) || shared > control.profile.limits.sharedBytes)
-                        return fail('shared control resource absent');
-                    controlEnvelope = { profileLine: control.line, realm: control.profile.realm, worker: { ...worker, path }, resources: { inputBytes: parent.responseBytes, outputBytes: parent.responseBytes, sharedBytes: control.profile.limits.sharedBytes } };
-                }
-                const config = { ...(controlEnvelope ? { control: controlEnvelope } : {}), members: data, libraries, builtins: logical.builtins, platform: logical.platform, executableDigests: logical.members.filter(member => /\.(?:[mc]?js|ts)$/.test(member.coordinate)).map(member => member.digest), metadataDigests: logical.members.filter(member => member.coordinate.endsWith('.json')).map(member => member.digest), inputBytes: handoff.budget.bytes, runtimeBytes: runtimeMember.bytes.byteLength, clientBytes: clientBytes.length, contextBytes: parent.responseBytes, custodian: { contextFile, client, runtime: runtime.path, preload: preload.href, runtimeDigest: runtimeMember.digest, clientDigest: sha(clientBytes) } };
-                // Loader metadata describes the authenticated input image, not the command's
-                // stdout. Its declared input budget stays separate from responseBytes.
-                const raw = Buffer.from(JSON.stringify(config));
-                if (raw.length > handoff.budget.bytes)
-                    return fail('operational descendant envelope bytes');
-                writeFileSync(configFile, raw, { flag: 'wx', mode: 0o400 });
-                // The URL carries an independently fixed expected digest of the private host
-                // envelope. This is operational custody, never authority from JSON.
-                preload.searchParams.set('digest', sha(raw));
-                config.custodian.preload = preload.href;
-                // The recursive preload URL excludes its own digest while writing the file;
-                // its fixed child validates the exact file before installing any hook.
-                const descendant = { ...config, custodian: { ...config.custodian, preload: preload.href } };
-                const held = acquired;
-                return { descendant, assertClosed: () => held.assertClosed(), async close() { try {
-                        await held.close();
-                    }
-                    finally {
-                        rmSync(directory, { recursive: true, force: true });
-                    } } };
-            }
-            catch (error) {
-                await acquired?.close();
-                rmSync(directory, { recursive: true, force: true });
-                throw error;
-            }
-        } };
-}
+var _=Object.defineProperty;var h=(i,g)=>_(i,"name",{value:g,configurable:!0});import{mkdtempSync as $,writeFileSync as z,rmSync as O}from"node:fs";import{tmpdir as A}from"node:os";import{join as B,extname as G}from"node:path";import{fileURLToPath as K,pathToFileURL as Q}from"node:url";import{createHash as V}from"node:crypto";import{library11_parse as X}from"../../vendor/runtime.js";import{processOf as q,ownRoot as Y}from"../../observe/runner.js";import{selectedHostControl as Z}from"./control-selection.js";import{readBoundedFile as R}from"./bounded-file.js";import{authenticateSignedPort as ee}from"./reading.js";import{createProducerJobCustody as te}from"./generated-custodian.js";const d=h(i=>{throw Error("REFUSE\xB7native custody "+i)},"fail"),L=h(i=>"sha256:"+V("sha256").update(i).digest("hex"),"sha");function fe(i,g,p,a,c){const k=c.members.map(t=>{const o=a.locations.find(s=>s.member===t.coordinate);return o?{path:o.path,digest:t.digest}:d("literal member absent")}),F=c.libraries.map(t=>{const o=a.locations.find(s=>s.member===t.manifest);return o?{name:t.name,manifest:o.path,coordinate:t.manifest}:d("library absent")}),H=i.live.flatMap(t=>{const o=X(t);if(o.kind!=="fact"||!o.value.fields.scope.startsWith("port/"))return[];let s;try{s=JSON.parse(o.value.fields.about??"")}catch{return[]}return s?.selector?.port===g.port.coordinate?[{coordinate:o.value.fields.scope,profile:s}]:[]});return{async open(t){const o=H.filter(e=>e.profile.selector.binding===t.binding&&e.profile.selector.implementation===t.implementation),s=o.filter(e=>e.profile.profile==="host-generated-executable@3");if(s.length!==1)return d("requires one current Root producer for "+t.binding);const P=s[0];ee(i,P.coordinate);const l=Z(i,g),U=K(new URL("./generated"+G(new URL(import.meta.url).pathname),import.meta.url)),I=R(U,i.budget.bytes,U),w=a.locations.find(e=>e.member===a.runtime),f=p.members.find(e=>e.coordinate===a.runtime);if(!w||!f)return d("fixed actual runtime absent");const M=o.filter(e=>["host-native-binary@1","host-native-binary-origin@1"].includes(e.profile.profile)).map(e=>{const m=e.profile,y=a.locations.find(u=>u.member===m.entry?.path),n=p.members.find(u=>u.coordinate===m.entry?.path);return!y||!n?d("binary outside actual selected image"):{coordinate:e.coordinate,privateBinding:{coordinate:n.coordinate,path:y.path,digest:n.digest}}}),T=o.filter(e=>e.profile.profile==="host-native-program@1").map(e=>({coordinate:e.coordinate,runtimeBinding:{coordinate:a.runtime,path:w.path,digest:f.digest,members:a.locations.map(m=>({coordinate:m.member,path:m.path}))}})),b=$(B(A(),"bound-native-custody-")),j=B(b,"context.json"),C=B(b,"loader.json");let x;try{x=await te({root:i,coordinate:P.coordinate,implementationBytes:I,snapshot:{budget:{members:p.budget.members,bytes:p.budget.bytes},members:k,libraries:F,builtins:c.builtins,platform:c.platform},nativeImplementations:new Set(c.members.map(r=>r.digest)),directory:b,contextFile:j,nativeBinaries:M,programSelections:T}).open(t);const m=q("custodian"),y=R(m,t.responseBytes,m),n=new URL(Q(q("native-descendant")).href);n.searchParams.set("config",C),n.searchParams.set("bytes",String(p.budget.bytes));let u;if(l){const r=l.profile.worker,E=B(Y(),r.coordinate.slice(16)),J=R(E,r.bytes,r.coordinate);if(J.length!==r.bytes||L(J)!==r.digest)return d("sealed control worker bytes differ");if(l.profile.runtime.coordinate!==a.runtime||l.profile.runtime.digest!==f.digest)return d("sealed control runtime differs");const N=32+2*t.responseBytes;if(!Number.isSafeInteger(N)||N>l.profile.limits.sharedBytes)return d("shared control resource absent");u={profileLine:l.line,realm:l.profile.realm,worker:{...r,path:E},resources:{inputBytes:t.responseBytes,outputBytes:t.responseBytes,sharedBytes:l.profile.limits.sharedBytes}}}const v={...u?{control:u}:{},members:k,libraries:F,builtins:c.builtins,platform:c.platform,executableDigests:c.members.filter(r=>/\.(?:[mc]?js|ts)$/.test(r.coordinate)).map(r=>r.digest),metadataDigests:c.members.filter(r=>r.coordinate.endsWith(".json")).map(r=>r.digest),inputBytes:p.budget.bytes,runtimeBytes:f.bytes.byteLength,clientBytes:y.length,contextBytes:t.responseBytes,custodian:{contextFile:j,client:m,runtime:w.path,preload:n.href,runtimeDigest:f.digest,clientDigest:L(y)}},S=Buffer.from(JSON.stringify(v));if(S.length>p.budget.bytes)return d("operational descendant envelope bytes");z(C,S,{flag:"wx",mode:256}),n.searchParams.set("digest",L(S)),v.custodian.preload=n.href;const W={...v,custodian:{...v.custodian,preload:n.href}},D=x;return{descendant:W,assertClosed:h(()=>D.assertClosed(),"assertClosed"),async close(){try{await D.close()}finally{O(b,{recursive:!0,force:!0})}}}}catch(e){throw await x?.close(),O(b,{recursive:!0,force:!0}),e}}}}h(fe,"nativeRootJobCustody");export{fe as nativeRootJobCustody};

package/dist/host/native/deadline.js

@@ -1,28 +1 @@
-const TIMER_MAX_MS = 2147483647;
-/** Remaining monotonic lease, rounded up for host APIs that accept milliseconds. */
-export function remainingDeadlineMs(deadline) {
-    return Math.max(0, Number((deadline - process.hrtime.bigint() + 999999n) / 1000000n));
-}
-const native = { now: () => process.hrtime.bigint(), schedule: (callback, delay) => setTimeout(callback, delay), cancel: handle => clearTimeout(handle) };
-/** The admitted deadline is never clamped to the platform timer range. Each
- * timer is merely a wake-up slice; expiry checks the original monotonic clock.
- * Injected clock exists only for deterministic platform-boundary vectors. */
-export function scheduleDeadline(deadline, expire, clock = native) {
-    let active = true, handle;
-    const arm = () => {
-        if (!active)
-            return;
-        const remaining = deadline - clock.now();
-        if (remaining <= 0n) {
-            active = false;
-            expire();
-            return;
-        }
-        const ceilMs = (remaining + 999999n) / 1000000n;
-        const slice = ceilMs > BigInt(TIMER_MAX_MS) ? TIMER_MAX_MS : Number(ceilMs);
-        handle = clock.schedule(arm, slice);
-    };
-    arm();
-    return () => { active = false; if (handle !== undefined)
-        clock.cancel(handle); };
-}
+var l=Object.defineProperty;var n=(e,t)=>l(e,"name",{value:t,configurable:!0});const d=2147483647;function f(e){return Math.max(0,Number((e-process.hrtime.bigint()+999999n)/1000000n))}n(f,"remainingDeadlineMs");const M={now:n(()=>process.hrtime.bigint(),"now"),schedule:n((e,t)=>setTimeout(e,t),"schedule"),cancel:n(e=>clearTimeout(e),"cancel")};function h(e,t,i=M){let r=!0,s;const c=n(()=>{if(!r)return;const a=e-i.now();if(a<=0n){r=!1,t();return}const u=(a+999999n)/1000000n,o=u>BigInt(2147483647)?2147483647:Number(u);s=i.schedule(c,o)},"arm");return c(),()=>{r=!1,s!==void 0&&i.cancel(s)}}n(h,"scheduleDeadline");export{f as remainingDeadlineMs,h as scheduleDeadline};