@lapxo/bound 0.2.3 → 0.2.5

package/dist/host/ports/local-act.js

@@ -1,172 +1,5 @@
-import { hashText } from "../hash.js";
-import { existsSync, readFileSync, readdirSync } from 'node:fs';
-import { join } from 'node:path';
-import { createHash } from 'node:crypto';
-import { requireEffects } from "../read-only.js";
-import { underTheRegions } from "../../land/act.js";
-import { publishBundle, nativePublicationStorage } from "./publication.js";
-import { actIdentity, parse, canonical } from '@lapxo/topos/wire';
-import { fullDigest } from "../digest.js";
-const atOf = (store, identity) => {
-    if (!identity || identity.includes('\0'))
-        throw Error('REFUSE·act missing identity');
-    return join(store, 'ledger', 'acts', 'committed-' + encodeURIComponent(identity));
-};
-const read = (at) => {
-    try {
-        const placements = readdirSync(at).filter(name => name.startsWith('place-') && name.endsWith('.bound')).map(name => ({
-            place: decodeURIComponent(name.slice(6, -6)), records: readFileSync(join(at, name), 'utf8'),
-        }));
-        return {
-            records: readFileSync(join(at, 'records.bound'), 'utf8'),
-            receipt: readFileSync(join(at, 'receipt.bound'), 'utf8'),
-            ...(placements.length ? { placements } : {}),
-        };
-    }
-    catch (error) {
-        throw Error(`REFUSE·act committed result unreadable · ${error.code ?? 'read failed'}`);
-    }
-};
-export const actLines = (bytes) => {
-    if (!bytes.endsWith('\n'))
-        throw Error('REFUSE·act truncated committed lines');
-    return bytes.slice(0, -1).split('\n');
-};
-/** Journal integrity is not authority. Signature/coverage checks remain the
- * same admission boundary; the hash algorithm here is the stored seal's named
- * algorithm, not a new selection of the place's wire.
- */
-export function intactLocalAct(identity, bundle) {
-    if (!bundle.receipt.endsWith('\n') || bundle.receipt.slice(0, -1).includes('\n'))
-        return false;
-    const receipt = parse(bundle.receipt.slice(0, -1));
-    if (receipt.kind !== 'fact' || !bundle.placements?.length)
-        return false;
-    const f = receipt.value.fields;
-    if (canonical(f) !== bundle.receipt.slice(0, -1) || !/^(0|[1-9][0-9]*)$/.test(f['epoch'] ?? ''))
-        return false;
-    if (f['value'] !== identity || f['role'] !== 'writes' || f['form'] !== 'alphabet' || f['measure'] !== 'digest')
-        return false;
-    return actIdentity(actLines(bundle.records), { scope: f['scope'] ?? '', context: f['at'] ?? '',
-        localEpoch: Number(f['epoch']), digest: bytes => fullDigest(bytes, identity.slice(0, identity.indexOf(':'))),
-        placements: bundle.placements.map(p => ({ place: p.place, records: actLines(p.records) })),
-    }) === identity;
-}
-/** One last integrity result only. Every call rereads all exact current bytes;
- * signatures, coverage and current authority are never retained here. */
-let lastIntactInventory;
-/** Internal integrity key only, not an act identity or a wire profile. */
-export function committedInventoryFingerprint(rows) {
-    const hash = createHash('sha256');
-    const text = hashText.bind(undefined, hash);
-    text('committed-integrity-inventory');
-    text(String(rows.length));
-    for (const { identity, bundle } of rows) {
-        text(identity);
-        text(bundle.records);
-        text(bundle.receipt);
-        if (bundle.placements === undefined) {
-            text('absent');
-            continue;
-        }
-        text('present');
-        text(String(bundle.placements.length));
-        for (const placement of bundle.placements) {
-            text(placement.place);
-            text(placement.records);
-        }
-    }
-    return hash.digest('hex');
-}
-/** Committed segments are part of this ledger, not a second authority source. */
-export function committedLocalActs(store) {
-    const observed = observationAt(store);
-    if (observed)
-        return observed.rows;
-    return readCommittedLocalActs(store);
-}
-let committedObservation;
-function observationAt(store) { for (let one = committedObservation; one; one = one.parent)
-    if (one.store === store)
-        return one; return undefined; }
-/** Fixed host observation only: one synchronous, coherent committed inventory.
- * It supplies no authority, verifier or async lifetime. Each outer invocation
- * rereads exact bodies before entering; current authorization still runs inside.
- */
-export function withCommittedLocalActObservation(store, body) {
-    const prior = committedObservation, existing = observationAt(store);
-    const rows = existing?.rows ?? Object.freeze(readCommittedLocalActs(store).map(row => Object.freeze({ identity: row.identity, bundle: Object.freeze({ ...row.bundle, ...(row.bundle.placements ? { placements: Object.freeze(row.bundle.placements.map(p => Object.freeze({ ...p }))) } : {}) }) })));
-    committedObservation = { store, rows, parent: prior };
-    try {
-        const result = body();
-        if (result !== null && (typeof result === 'object' || typeof result === 'function') && typeof result.then === 'function')
-            throw Error('REFUSE·act committed observation must be synchronous');
-        return result;
-    }
-    finally {
-        committedObservation = prior;
-    }
-}
-function readCommittedLocalActs(store) {
-    const root = join(store, 'ledger', 'acts');
-    if (!existsSync(root))
-        return [];
-    const rows = readdirSync(root).filter(name => name.startsWith('committed-')).map(name => ({
-        identity: decodeURIComponent(name.slice(10)), bundle: read(join(root, name)),
-    }));
-    // Ordered tuple framing commits every record, receipt and placement. No path,
-    // mtime, authority snapshot or caller-supplied seal substitutes for bytes.
-    const fingerprint = committedInventoryFingerprint(rows);
-    if (fingerprint !== lastIntactInventory) {
-        for (const { identity, bundle } of rows)
-            if (!intactLocalAct(identity, bundle))
-                throw Error('REFUSE·act committed journal seal does not verify');
-        lastIntactInventory = fingerprint;
-    }
-    return rows.sort((a, b) => {
-        const epoch = (one) => { const p = parse(one.receipt.trim()); return p.kind === 'fact' ? Number(p.value.fields['epoch']) : 0; };
-        return epoch(a.bundle) - epoch(b.bundle);
-    });
-}
-/** A public result is available only as a verified committed pair.
- * No writer-tail guess, newest-result selection or implicit authority.
- */
-export function localActResult(store, identity, verify) {
-    const at = atOf(store, identity);
-    const observed = observationAt(store);
-    if (observed) {
-        const bundle = observed.rows.find(row => row.identity === identity)?.bundle;
-        if (!bundle)
-            return undefined;
-        if (verify(identity, bundle) !== true)
-            throw Error('REFUSE·act committed result does not verify');
-        return bundle;
-    }
-    if (!existsSync(at))
-        return undefined;
-    const bundle = read(at);
-    if (verify(identity, bundle) !== true)
-        throw Error('REFUSE·act committed result does not verify');
-    return bundle;
-}
-/** One publication point for records and their native result. Re-delivery
- * reads the original pair without preparation, signing or a new local epoch.
- * The caller must also integrate this boundary into admission-history readers;
- * this storage port alone does not activate a grammar or land authority.
- */
-export async function commitLocalAct(store, identity, regions, prepare, verify, storage = nativePublicationStorage) {
-    requireEffects('local act commitment');
-    return underTheRegions(store, regions, 'land', async () => {
-        const prior = localActResult(store, identity, verify);
-        if (prior)
-            return { kind: 'once', ...prior };
-        const bundle = await prepare();
-        if (!bundle.records || !bundle.receipt || verify(identity, bundle) !== true)
-            throw Error('REFUSE·act prepared result does not verify');
-        const files = { 'records.bound': bundle.records, 'receipt.bound': bundle.receipt };
-        for (const p of bundle.placements ?? [])
-            files['place-' + encodeURIComponent(p.place) + '.bound'] = p.records;
-        publishBundle(atOf(store, identity), files, storage);
-        return { kind: 'landed', ...bundle };
-    });
-}
+var U=Object.defineProperty;var i=(t,e)=>U(t,"name",{value:e,configurable:!0});import{hashText as F}from"../hash.js";import{ActCommitUnknown as I}from"../commit-result.js";import{assertHostNotCancelled as u}from"../host-controls.js";import{existsSync as E,readFileSync as m,readdirSync as y}from"node:fs";import{join as d}from"node:path";import{createHash as O}from"node:crypto";import{requireEffects as j}from"../read-only.js";import{underTheRegions as A}from"../../land/act.js";import{publishBundle as C,nativePublicationStorage as L}from"./publication.js";import{library11_actIdentity as k,library11_parse as g,library11_canonical as z}from"../../vendor/runtime.js";import{fullDigest as W}from"../digest.js";const v=i((t,e)=>{if(!e||e.includes("\0"))throw Error("REFUSE\xB7act missing identity");return d(t,"ledger","acts","committed-"+encodeURIComponent(e))},"atOf"),w=i(t=>{try{const e=y(t).filter(r=>r.startsWith("place-")&&r.endsWith(".bound")).map(r=>({place:decodeURIComponent(r.slice(6,-6)),records:m(d(t,r),"utf8")}));return{records:m(d(t,"records.bound"),"utf8"),receipt:m(d(t,"receipt.bound"),"utf8"),...e.length?{placements:e}:{}}}catch(e){throw Error(`REFUSE\xB7act committed result unreadable \xB7 ${e.code??"read failed"}`)}},"read"),x=i(t=>{if(!t.endsWith(`
+`))throw Error("REFUSE\xB7act truncated committed lines");return t.slice(0,-1).split(`
+`)},"actLines");function N(t,e){if(!e.receipt.endsWith(`
+`)||e.receipt.slice(0,-1).includes(`
+`))return!1;const r=g(e.receipt.slice(0,-1));if(r.kind!=="fact"||!e.placements?.length)return!1;const c=r.value.fields;return z(c)!==e.receipt.slice(0,-1)||!/^(0|[1-9][0-9]*)$/.test(c.epoch??"")||c.value!==t||c.role!=="writes"||c.form!=="alphabet"||c.measure!=="digest"?!1:k(x(e.records),{scope:c.scope??"",context:c.at??"",localEpoch:Number(c.epoch),digest:i(o=>W(o,t.slice(0,t.indexOf(":"))),"digest"),placements:e.placements.map(o=>({place:o.place,records:x(o.records)}))})===t}i(N,"intactLocalAct");let R;function _(t){const e=O("sha256"),r=F.bind(void 0,e);r("committed-integrity-inventory"),r(String(t.length));for(const{identity:c,bundle:o}of t){if(r(c),r(o.records),r(o.receipt),o.placements===void 0){r("absent");continue}r("present"),r(String(o.placements.length));for(const n of o.placements)r(n.place),r(n.records)}return e.digest("hex")}i(_,"committedInventoryFingerprint");function X(t){const e=h(t);return e?e.rows:S(t)}i(X,"committedLocalActs");let p;function h(t){for(let e=p;e;e=e.parent)if(e.store===t)return e}i(h,"observationAt");function Y(t,e){const r=p,o=h(t)?.rows??Object.freeze(S(t).map(n=>Object.freeze({identity:n.identity,bundle:Object.freeze({...n.bundle,...n.bundle.placements?{placements:Object.freeze(n.bundle.placements.map(s=>Object.freeze({...s})))}:{}})})));p={store:t,rows:o,parent:r};try{const n=e();if(n!==null&&(typeof n=="object"||typeof n=="function")&&typeof n.then=="function")throw Error("REFUSE\xB7act committed observation must be synchronous");return n}finally{p=r}}i(Y,"withCommittedLocalActObservation");function S(t){const e=d(t,"ledger","acts");if(!E(e))return[];const r=y(e).filter(o=>o.startsWith("committed-")).map(o=>({identity:decodeURIComponent(o.slice(10)),bundle:w(d(e,o))})),c=_(r);if(c!==R){for(const{identity:o,bundle:n}of r)if(!N(o,n))throw Error("REFUSE\xB7act committed journal seal does not verify");R=c}return r.sort((o,n)=>{const s=i(l=>{const a=g(l.receipt.trim());return a.kind==="fact"?Number(a.value.fields.epoch):0},"epoch");return s(o.bundle)-s(n.bundle)})}i(S,"readCommittedLocalActs");function H(t,e,r){const c=v(t,e),o=h(t);if(o){const s=o.rows.find(l=>l.identity===e)?.bundle;if(!s)return;if(r(e,s)!==!0)throw Error("REFUSE\xB7act committed result does not verify");return s}if(!E(c))return;const n=w(c);if(r(e,n)!==!0)throw Error("REFUSE\xB7act committed result does not verify");return n}i(H,"localActResult");async function Z(t,e,r,c,o,n=L,s){return j("local act commitment"),u(s),A(t,r,"land",async()=>{u(s);const l=H(t,e,o);if(l)return{kind:"once",...l};const a=await c();if(u(s),!a.records||!a.receipt||o(e,a)!==!0)throw Error("REFUSE\xB7act prepared result does not verify");const b={"records.bound":a.records,"receipt.bound":a.receipt};for(const f of a.placements??[])b["place-"+encodeURIComponent(f.place)+".bound"]=f.records;u(s);try{C(v(t,e),b,n)}catch(f){throw new I(e,f)}return{kind:"landed",...a}})}i(Z,"commitLocalAct");export{x as actLines,Z as commitLocalAct,_ as committedInventoryFingerprint,X as committedLocalActs,N as intactLocalAct,H as localActResult,Y as withCommittedLocalActObservation};

package/dist/host/ports/place-act.js

@@ -1,169 +1 @@
-import { existsSync, readdirSync, statSync, openSync, fstatSync, readSync, closeSync } from 'node:fs';
-import { join } from 'node:path';
-import { readPlaceActContext, verifyPlaceActContext, placeActReceiptsOf } from '@lapxo/topos/core';
-import { underAuthorityRegions, underTheRegions, underRootProjection } from "../../land/act.js";
-import { requireEffects } from "../read-only.js";
-import { publishBundle, nativePublicationStorage } from "./publication.js";
-const fail = (why) => { throw Error('REFUSE·place act ' + why); };
-const clock = (n) => { if (!/^(0|[1-9][0-9]*)$/.test(n) || !Number.isSafeInteger(Number(n)))
-    fail('unknown receiver clock'); return Number(n); };
-const rootBytes = (r) => JSON.stringify([r.namespace, r.snapshot, r.epoch, r.prefix, r.head, r.policies]);
-const budget = (b) => { if (!b || !Number.isSafeInteger(b.acts) || b.acts < 1 || !Number.isSafeInteger(b.bytes) || b.bytes < 1)
-    fail('missing storage budget'); };
-const base = (store) => join(store, 'ledger', 'place-acts');
-const at = (store, id) => { if (!id || id.includes('\0'))
-    fail('missing identity'); return join(base(store), 'committed-' + encodeURIComponent(id)); };
-function storedInventory(store, b) {
-    budget(b);
-    if (!existsSync(base(store)))
-        return { names: [], bytes: 0 };
-    const names = readdirSync(base(store)).filter(n => n.startsWith('committed-'));
-    if (names.length > b.acts)
-        fail('stored act budget');
-    let bytes = 0;
-    for (const name of names)
-        for (const member of ['context.json', 'receipts.json', 'originals.json']) {
-            const stat = statSync(join(base(store), name, member));
-            if (!stat.isFile() || (bytes += stat.size) > b.bytes)
-                fail('stored aggregate byte budget');
-        }
-    return { names, bytes };
-}
-function readBundle(path, b) {
-    budget(b);
-    let bytes = 0;
-    const read = (name) => {
-        const fd = openSync(join(path, name), 'r');
-        try {
-            const size = fstatSync(fd);
-            if (!size.isFile() || size.size > b.bytes - bytes)
-                fail('stored byte budget');
-            const data = Buffer.alloc(size.size);
-            let read = 0;
-            while (read < data.length) {
-                const count = readSync(fd, data, read, data.length - read, null);
-                if (!count)
-                    fail('stored member changed while reading');
-                read += count;
-            }
-            if (readSync(fd, Buffer.alloc(1), 0, 1, null) !== 0)
-                fail('stored member changed while reading');
-            bytes += read;
-            return new TextDecoder('utf-8', { fatal: true }).decode(data);
-        }
-        finally {
-            closeSync(fd);
-        }
-    };
-    try {
-        const context = read('context.json'), receipts = JSON.parse(read('receipts.json')), originals = JSON.parse(read('originals.json'));
-        return { context, receipts, originals };
-    }
-    catch (e) {
-        if (e instanceof Error && e.message.startsWith('REFUSE·'))
-            throw e;
-        return fail('committed bundle unreadable');
-    }
-}
-function authenticated(bundle, id, contract) {
-    const result = placeActReceiptsOf(bundle.context, bundle.receipts, contract), decoded = readPlaceActContext(bundle.context, contract.budget);
-    if (result.identity !== id || JSON.stringify(bundle.originals) !== JSON.stringify(decoded.places.map(p => p.records)))
-        fail('stored original/context identity mismatch');
-    return decoded;
-}
-/** Historical result reads never produce a current authorization permit. */
-export function placeActResult(store, id, trust, limits) {
-    const path = at(store, id);
-    if (!existsSync(path))
-        return undefined;
-    const bundle = readBundle(path, limits);
-    authenticated(bundle, id, trust.historical(bundle.context));
-    return bundle;
-}
-/** Each receiver chain advances independently. Initial heads are explicit,
- * authenticated host inputs, not inferred zero or legacy global epochs. */
-export function placeActHeads(store, initial, trust, limits) {
-    budget(limits);
-    if (!initial.length || new Set(initial.map(h => h.place)).size !== initial.length)
-        fail('missing/ambiguous initial heads');
-    const heads = new Map(initial.map(h => { clock(h.epoch); if (!h.identity)
-        fail('missing initial head'); return [h.place, { ...h }]; }));
-    if (!existsSync(base(store)))
-        return [...heads.values()];
-    const { names } = storedInventory(store, limits);
-    const pending = names.map(name => { const id = decodeURIComponent(name.slice(10)), bundle = readBundle(join(base(store), name), limits); const context = authenticated(bundle, id, trust.historical(bundle.context)); if (context.root.namespace !== trust.contract.root.namespace)
-        fail('stored clock namespace mismatch'); return { id, context }; });
-    while (pending.length) {
-        const next = pending.findIndex(a => a.context.places.every(p => heads.get(p.place)?.identity === p.previous));
-        if (next < 0)
-            fail('receiver chain fork or missing predecessor');
-        const act = pending.splice(next, 1)[0];
-        for (const p of act.context.places) {
-            const prior = heads.get(p.place);
-            const epoch = clock(prior.epoch) + 1;
-            if (!Number.isSafeInteger(epoch) || clock(p.epoch) !== epoch)
-                fail('receiver chain clock mismatch');
-            heads.set(p.place, { place: p.place, identity: act.id, epoch: p.epoch });
-        }
-    }
-    return [...heads.values()];
-}
-/** Context, exact original bytes and complete signed receipts have one visibility
- * point. Real Root guard exclusion spans final authority/head comparison and
- * publication; this does not activate a CLI profile or reinterpret local-act@1. */
-export async function commitPlaceAct(store, encoded, receipts, trust, limits, storage = nativePublicationStorage) {
-    requireEffects('place act commitment');
-    budget(limits);
-    const decoded = readPlaceActContext(encoded, trust.contract.budget), id = trust.contract.digest(encoded);
-    const regions = decoded.places.map(p => { if (p.place === '.')
-        return ''; const parts = p.place.split('/'); if (parts.length < 2 || parts.pop() !== 'TARGET.bound' || parts.some(s => s === '' || s === '.' || s === '..'))
-        fail('unknown place namespace'); return parts.join('/'); });
-    const enter = regions.includes('') ? underTheRegions : underAuthorityRegions;
-    return enter(store, regions, 'place act', () => underRootProjection(store, 'place act publication', () => {
-        const prior = placeActResult(store, id, trust, limits);
-        if (prior) {
-            if (prior.context !== encoded)
-                fail('replay bytes differ');
-            // Replay authenticates the supplied evidence too. Historical authentication
-            // grants no current authority and leaves the committed result unchanged.
-            placeActReceiptsOf(encoded, receipts, trust.historical(encoded));
-            return { ...prior, identity: id, kind: 'once' };
-        }
-        const verified = verifyPlaceActContext(encoded, trust.contract);
-        placeActReceiptsOf(encoded, receipts, trust.contract);
-        const originals = decoded.places.map(p => p.records), files = { 'context.json': encoded, 'receipts.json': JSON.stringify(receipts) + '\n', 'originals.json': JSON.stringify(originals) + '\n' };
-        const inventory = storedInventory(store, limits);
-        if (inventory.bytes + Object.values(files).reduce((n, v) => n + Buffer.byteLength(v), 0) > limits.bytes)
-            fail('publication byte budget');
-        if (inventory.names.length >= limits.acts)
-            fail('publication act budget');
-        const current = trust.current();
-        if (rootBytes(current.root) !== rootBytes(verified.dependencies))
-            fail('authority changed before publication');
-        if (new Set(current.heads.map(h => h.place)).size !== current.heads.length)
-            fail('ambiguous receiver heads');
-        const storedHeads = placeActHeads(store, trust.initialHeads, trust, limits);
-        for (const p of decoded.places) {
-            const actual = storedHeads.find(h => h.place === p.place), selected = current.heads.find(h => h.place === p.place);
-            if (!actual || !selected || actual.identity !== selected.identity || actual.epoch !== selected.epoch)
-                fail('receiver snapshot is not committed head ' + p.place);
-        }
-        for (const p of decoded.places) {
-            const head = current.heads.find(h => h.place === p.place) ?? fail('missing receiver head ' + p.place);
-            if (head.identity !== p.previous)
-                fail('receiver head moved ' + p.place);
-            const next = clock(head.epoch) + 1;
-            if (!Number.isSafeInteger(next) || clock(p.epoch) !== next)
-                fail('receiver epoch not next ' + p.place);
-        }
-        publishBundle(at(store, id), files, storage);
-        return { context: encoded, receipts, originals, identity: id, kind: 'landed' };
-    }));
-}
-/** Enumerates only committed, historically authenticated carriers. Namespace
- * projection is a caller's separate pure operation, never current permission. */
-export function committedPlaceActResults(store, trust, limits) {
-    const { names } = storedInventory(store, limits);
-    return names.map(name => { const identity = decodeURIComponent(name.slice(10)), bundle = placeActResult(store, identity, trust, limits); if (!bundle)
-        fail('committed carrier vanished'); return { identity, bundle: bundle }; });
-}
+var j=Object.defineProperty;var i=(e,c)=>j(e,"name",{value:c,configurable:!0});import{existsSync as g,readdirSync as I,statSync as E,openSync as N,fstatSync as C,readSync as S,closeSync as O}from"node:fs";import{join as f}from"node:path";import{library3_readPlaceActContext as z,library3_placeActReceiptsOf as U}from"../../vendor/runtime.js";import{transactPlaceAct as k}from"../place-act-transaction.js";import{canonicalActStore as B,underAuthorityRegions as F,underTheRegions as J,underRootProjection as H}from"../../land/act.js";import{requireEffects as T}from"../read-only.js";import{receiverClock as h}from"../host-controls.js";import{publishBundle as W,nativePublicationStorage as v}from"./publication.js";const s=i(e=>{throw Error("REFUSE\xB7place act "+e)},"fail"),y=i(e=>{(!e||!Number.isSafeInteger(e.acts)||e.acts<1||!Number.isSafeInteger(e.bytes)||e.bytes<1)&&s("missing storage budget")},"budget"),m=i(e=>f(e,"ledger","place-acts"),"base"),A=i((e,c)=>((!c||c.includes("\0"))&&s("missing identity"),f(m(e),"committed-"+encodeURIComponent(c))),"at");function b(e,c){if(y(c),!g(m(e)))return{names:[],bytes:0};const t=I(m(e)).filter(n=>n.startsWith("committed-"));t.length>c.acts&&s("stored act budget");let o=0;for(const n of t)for(const r of["context.json","receipts.json","originals.json"]){const l=E(f(m(e),n,r));(!l.isFile()||(o+=l.size)>c.bytes)&&s("stored aggregate byte budget")}return{names:t,bytes:o}}i(b,"storedInventory");function R(e,c){y(c);let t=0;const o=i(n=>{const r=N(f(e,n),"r");try{const l=C(r);(!l.isFile()||l.size>c.bytes-t)&&s("stored byte budget");const a=Buffer.alloc(l.size);let p=0;for(;p<a.length;){const d=S(r,a,p,a.length-p,null);d||s("stored member changed while reading"),p+=d}return S(r,Buffer.alloc(1),0,1,null)!==0&&s("stored member changed while reading"),t+=p,new TextDecoder("utf-8",{fatal:!0}).decode(a)}finally{O(r)}},"read");try{const n=o("context.json"),r=JSON.parse(o("receipts.json")),l=JSON.parse(o("originals.json"));return{context:n,receipts:r,originals:l}}catch(n){if(n instanceof Error&&n.message.startsWith("REFUSE\xB7"))throw n;return s("committed bundle unreadable")}}i(R,"readBundle");function w(e,c,t){const o=U(e.context,e.receipts,t),n=z(e.context,t.budget);return(o.identity!==c||JSON.stringify(e.originals)!==JSON.stringify(n.places.map(r=>r.records)))&&s("stored original/context identity mismatch"),n}i(w,"authenticated");function P(e,c,t,o){const n=A(e,c);if(!g(n))return;const r=R(n,o);return w(r,c,t.historical(r.context)),r}i(P,"placeActResult");function _(e,c,t,o){y(o),(!c.length||new Set(c.map(a=>a.place)).size!==c.length)&&s("missing/ambiguous initial heads");const n=new Map(c.map(a=>(h(a.epoch,s),a.identity||s("missing initial head"),[a.place,{...a}])));if(!g(m(e)))return[...n.values()];const{names:r}=b(e,o),l=r.map(a=>{const p=decodeURIComponent(a.slice(10)),d=R(f(m(e),a),o),u=w(d,p,t.historical(d.context));return u.root.namespace!==t.contract.root.namespace&&s("stored clock namespace mismatch"),{id:p,context:u}});for(;l.length;){const a=l.findIndex(d=>d.context.places.every(u=>n.get(u.place)?.identity===u.previous));a<0&&s("receiver chain fork or missing predecessor");const p=l.splice(a,1)[0];for(const d of p.context.places){const u=n.get(d.place),x=h(u.epoch,s)+1;(!Number.isSafeInteger(x)||h(d.epoch,s)!==x)&&s("receiver chain clock mismatch"),n.set(d.place,{place:d.place,identity:p.id,epoch:d.epoch})}}return[...n.values()]}i(_,"placeActHeads");function q(e,c=v){return e=B(e),{exclusive:i((t,o)=>(t.includes("")?J:F)(e,t,"place act",()=>H(e,"place act publication",o)),"exclusive"),result:i((t,o,n)=>P(e,t,o,n),"result"),inventory:i(t=>b(e,t),"inventory"),heads:i((t,o)=>_(e,t.initialHeads,t,o),"heads"),publish:i((t,o)=>W(A(e,t),o,c),"publish")}}i(q,"nativePlaceActPersistence");async function Z(e,c,t,o,n,r=v){return T("place act commitment"),k(c,t,o,n,q(e,r))}i(Z,"commitPlaceAct");function $(e,c,t){const{names:o}=b(e,t);return o.map(n=>{const r=decodeURIComponent(n.slice(10)),l=P(e,r,c,t);return l||s("committed carrier vanished"),{identity:r,bundle:l}})}i($,"committedPlaceActResults");export{Z as commitPlaceAct,$ as committedPlaceActResults,q as nativePlaceActPersistence,_ as placeActHeads,P as placeActResult};

package/dist/host/ports/publication.js

@@ -1,56 +1 @@
-import { randomUUID } from 'node:crypto';
-import { closeSync, fsyncSync, mkdirSync, openSync, renameSync, rmSync, writeFileSync } from 'node:fs';
-import { dirname, join } from 'node:path';
-import { requireEffects } from "../read-only.js";
-const syncDirectory = (path) => {
-    const fd = openSync(path, 'r');
-    try {
-        fsyncSync(fd);
-    }
-    finally {
-        closeSync(fd);
-    }
-};
-export const nativePublicationStorage = {
-    publish(staged, committed) { renameSync(staged, committed); syncDirectory(dirname(committed)); },
-};
-/** Publish prepared bytes as one directory. No identity, grammar or authority
- * is inferred here. Readers address the committed name, never staging files.
- * A failure after rename is not evidence of rollback: the caller must retain
- * the uncertainty and allow a verified read of the committed name.
- */
-export function publishBundle(committed, files, storage = nativePublicationStorage) {
-    requireEffects('atomic publication');
-    const entries = Object.entries(files);
-    if (!entries.length || entries.some(([name]) => !name || name === '.' || name === '..' || /[\\/\0]/.test(name))) {
-        throw Error('REFUSE·commit invalid publication members');
-    }
-    const root = dirname(committed);
-    const created = mkdirSync(root, { recursive: true });
-    // Persist newly created directory entries up to their existing parent too.
-    if (created !== undefined)
-        for (let at = root;; at = dirname(at)) {
-            syncDirectory(at);
-            if (at === dirname(created))
-                break;
-        }
-    const staged = join(root, '.stage-' + randomUUID());
-    mkdirSync(staged, { mode: 0o700 });
-    try {
-        for (const [name, bytes] of entries) {
-            const fd = openSync(join(staged, name), 'wx', 0o600);
-            try {
-                writeFileSync(fd, bytes);
-                fsyncSync(fd);
-            }
-            finally {
-                closeSync(fd);
-            }
-        }
-        syncDirectory(staged);
-        storage.publish(staged, committed);
-    }
-    finally {
-        rmSync(staged, { recursive: true, force: true });
-    }
-}
+var h=Object.defineProperty;var f=(o,t)=>h(o,"name",{value:t,configurable:!0});import{randomUUID as g}from"node:crypto";import{closeSync as a,fsyncSync as u,mkdirSync as m,openSync as p,renameSync as v,rmSync as E,writeFileSync as w}from"node:fs";import{dirname as n,join as b}from"node:path";import{requireEffects as x}from"../read-only.js";const l=f(o=>{const t=p(o,"r");try{u(t)}finally{a(t)}},"syncDirectory"),U={publish(o,t){v(o,t),l(n(t))}};function B(o,t,d=U){x("atomic publication");const i=Object.entries(t);if(!i.length||i.some(([r])=>!r||r==="."||r===".."||/[\\/\0]/.test(r)))throw Error("REFUSE\xB7commit invalid publication members");const c=n(o),y=m(c,{recursive:!0});if(y!==void 0)for(let r=c;l(r),r!==n(y);r=n(r));const e=b(c,".stage-"+g());m(e,{mode:448});try{for(const[r,S]of i){const s=p(b(e,r),"wx",384);try{w(s,S),u(s)}finally{a(s)}}l(e),d.publish(e,o)}finally{E(e,{recursive:!0,force:!0})}}f(B,"publishBundle");export{U as nativePublicationStorage,B as publishBundle};

package/dist/host/ports/signing.js

@@ -1,74 +1 @@
-import { spawn } from 'node:child_process';
-import { readFileSync } from 'node:fs';
-import { signBytes } from "../adapters/keys/ed25519.js";
-/** Contains only host-controlled diagnostics, never child output. */
-export class SigningFailure extends Error {
-}
-/** Host-approved mechanism only. Repository declarations do not authorize execution. */
-export async function invokeSigner(lot, mechanism, protocol, limits) {
-    if (!Number.isSafeInteger(limits.timeoutMs) || limits.timeoutMs <= 0
-        || !Number.isSafeInteger(limits.responseBytes) || limits.responseBytes <= 0) {
-        throw new SigningFailure(`REFUSE·signer ${lot.keyId} has no valid declared limits`);
-    }
-    const request = protocol.request(lot);
-    let output;
-    if (mechanism.kind === 'file') {
-        try {
-            const key = readFileSync(mechanism.path, 'utf8');
-            output = protocol.response(lot.bytes.map(bytes => ({ keyId: lot.keyId, signature: signBytes(bytes, key, lot.algorithm) })));
-        }
-        catch {
-            throw new SigningFailure(`REFUSE·signer ${lot.keyId} file mechanism failed`);
-        }
-    }
-    else
-        output = await new Promise((resolve, reject) => {
-            const child = spawn(mechanism.executable, [...mechanism.args], { stdio: ['pipe', 'pipe', 'pipe'], shell: false });
-            let size = 0;
-            const chunks = [];
-            let failure;
-            const refuse = (why) => {
-                if (failure)
-                    return;
-                failure = why;
-                child.kill('SIGKILL');
-                clearTimeout(timer);
-                child.stdin.destroy();
-                child.stdout.destroy();
-                child.stderr.destroy();
-                reject(new SigningFailure(`REFUSE·signer ${lot.keyId} ${why} · status=none · signal=SIGKILL`));
-            };
-            const timer = setTimeout(() => refuse('timeout'), limits.timeoutMs);
-            child.stdout.on('data', (chunk) => {
-                size += chunk.length;
-                if (size > limits.responseBytes)
-                    refuse('response exceeds declared limit');
-                if (!failure)
-                    chunks.push(chunk);
-            });
-            // Drain, never forward or retain signer diagnostics.
-            child.stderr.on('data', () => { });
-            child.stdin.on('error', () => refuse('input delivery failed'));
-            child.on('error', () => {
-                clearTimeout(timer);
-                reject(new SigningFailure(`REFUSE·signer ${lot.keyId} command could not start`));
-            });
-            child.on('close', (status, signal) => {
-                clearTimeout(timer);
-                if (failure || status !== 0) {
-                    reject(new SigningFailure(`REFUSE·signer ${lot.keyId} ${failure ?? 'command failed'} · status=${status ?? 'none'} · signal=${signal ?? 'none'}`));
-                }
-                else
-                    resolve(Buffer.concat(chunks).toString('utf8'));
-            });
-            child.stdin.end(request);
-        });
-    if (Buffer.byteLength(output) > limits.responseBytes)
-        throw new SigningFailure(`REFUSE·signer ${lot.keyId} response exceeds declared limit`);
-    try {
-        return protocol.reply(output, lot);
-    }
-    catch {
-        throw new SigningFailure(`REFUSE·signer ${lot.keyId} invalid response`);
-    }
-}
+var I=Object.defineProperty;var u=(e,i)=>I(e,"name",{value:i,configurable:!0});import{spawn as S}from"node:child_process";import{readFileSync as k}from"node:fs";import{signBytes as w}from"../adapters/keys/ed25519.js";class t extends Error{static{u(this,"SigningFailure")}}async function R(e,i,f,n){if(!Number.isSafeInteger(n.timeoutMs)||n.timeoutMs<=0||!Number.isSafeInteger(n.responseBytes)||n.responseBytes<=0)throw new t(`REFUSE\xB7signer ${e.keyId} has no valid declared limits`);const m=f.request(e);let a;if(i.kind==="file")try{const y=k(i.path,"utf8");a=f.response(e.bytes.map(o=>({keyId:e.keyId,signature:w(o,y,e.algorithm)})))}catch{throw new t(`REFUSE\xB7signer ${e.keyId} file mechanism failed`)}else a=await new Promise((y,o)=>{const r=S(i.executable,[...i.args],{stdio:["pipe","pipe","pipe"],shell:!1});let g=0;const l=[];let d;const c=u(s=>{d||(d=s,r.kill("SIGKILL"),clearTimeout(p),r.stdin.destroy(),r.stdout.destroy(),r.stderr.destroy(),o(new t(`REFUSE\xB7signer ${e.keyId} ${s} \xB7 status=none \xB7 signal=SIGKILL`)))},"refuse"),p=setTimeout(()=>c("timeout"),n.timeoutMs);r.stdout.on("data",s=>{g+=s.length,g>n.responseBytes&&c("response exceeds declared limit"),d||l.push(s)}),r.stderr.on("data",()=>{}),r.stdin.on("error",()=>c("input delivery failed")),r.on("error",()=>{clearTimeout(p),o(new t(`REFUSE\xB7signer ${e.keyId} command could not start`))}),r.on("close",(s,E)=>{clearTimeout(p),d||s!==0?o(new t(`REFUSE\xB7signer ${e.keyId} ${d??"command failed"} \xB7 status=${s??"none"} \xB7 signal=${E??"none"}`)):y(Buffer.concat(l).toString("utf8"))}),r.stdin.end(m)});if(Buffer.byteLength(a)>n.responseBytes)throw new t(`REFUSE\xB7signer ${e.keyId} response exceeds declared limit`);try{return f.reply(a,e)}catch{throw new t(`REFUSE\xB7signer ${e.keyId} invalid response`)}}u(R,"invokeSigner");export{t as SigningFailure,R as invokeSigner};

package/dist/host/ports/store.js

@@ -1,18 +1 @@
-/** The store root is the tree that holds a TARGET.bound beside its .bound store. */
-import { existsSync, readdirSync } from 'node:fs';
-import { dirname, join, resolve } from 'node:path';
-import { EXTENSION, LOCK } from '@lapxo/topos/wire';
-export function storeRoot(from) {
-    const abs = resolve(from || '.');
-    let at = abs;
-    for (let i = 0; i < 64; i += 1) {
-        if (existsSync(join(at, LOCK)) && existsSync(join(at, EXTENSION)))
-            return at;
-        const parent = dirname(at);
-        if (parent === at)
-            break;
-        at = parent;
-    }
-    return abs;
-}
-export const storeDirs = (store) => existsSync(store) ? readdirSync(store, { withFileTypes: true }).filter((entry) => entry.isDirectory()).length : 0;
+var f=Object.defineProperty;var i=(r,t)=>f(r,"name",{value:t,configurable:!0});import{existsSync as o,readdirSync as l}from"node:fs";import{dirname as c,join as a,resolve as m}from"node:path";import{library11_EXTENSION as p,library11_LOCK as y}from"../../vendor/runtime.js";function O(r){const t=m(r||".");let e=t;for(let n=0;n<64;n+=1){if(o(a(e,y))&&o(a(e,p)))return e;const s=c(e);if(s===e)break;e=s}return t}i(O,"storeRoot");const S=i(r=>o(r)?l(r,{withFileTypes:!0}).filter(t=>t.isDirectory()).length:0,"storeDirs");export{S as storeDirs,O as storeRoot};

package/dist/host/ports/transport.js

@@ -1,48 +1 @@
-import { readFileSync } from 'node:fs';
-import { contentRequest, transportSelection, parse } from '@lapxo/topos/wire';
-import { boundedProcess } from "../process-lifetime.js";
-import { fetchBytes } from "../adapters/transport/http.js";
-export async function transportBytes(location, digest, lines) {
-    const scheme = new URL(location).protocol.slice(0, -1);
-    const fields = lines.flatMap(line => { const p = parse(line); return p.kind === 'fact' ? [p.value.fields] : []; });
-    const selected = transportSelection(fields, scheme);
-    if (selected === undefined)
-        throw Error(`REFUSE·transport ${scheme} no admitted content-request/1 policy`);
-    if (selected.name === 'fetch') {
-        if (!['http', 'https'].includes(scheme))
-            throw Error(`REFUSE·transport ${scheme} is not supported by this host adapter`);
-        return fetchBytes(location, selected);
-    }
-    const registryPath = process.env['BOUND_TRANSPORTS'];
-    if (!registryPath)
-        throw Error(`REFUSE·transport ${scheme} no host binding for ${selected.name}`);
-    let record;
-    try {
-        const registry = JSON.parse(readFileSync(registryPath, 'utf8'));
-        if (!registry || typeof registry !== 'object' || !Object.prototype.hasOwnProperty.call(registry, selected.name))
-            throw Error();
-        const value = registry[selected.name];
-        if (!value || typeof value !== 'object')
-            throw Error();
-        const f = value;
-        if (f.kind !== 'command' || typeof f.executable !== 'string' || !f.executable || !Array.isArray(f.args) || !f.args.every(x => typeof x === 'string'))
-            throw Error();
-        if (f.environment !== undefined && (!Array.isArray(f.environment) || !f.environment.every(x => typeof x === 'string')))
-            throw Error();
-        const names = (f.environment ?? []);
-        const env = {};
-        if (process.env.PATH !== undefined)
-            env.PATH = process.env.PATH;
-        for (const name of names)
-            if (process.env[name] !== undefined)
-                env[name] = process.env[name];
-        record = { executable: f.executable, args: f.args, env };
-    }
-    catch {
-        throw Error(`REFUSE·transport ${scheme} host binding unavailable or invalid`);
-    }
-    const result = boundedProcess(record.executable, record.args, contentRequest(location, digest, selected), selected, undefined, record.env);
-    if (result.status !== 0 || result.signal !== null)
-        throw Error(`REFUSE·transport ${scheme} failed · status ${result.status ?? result.signal}`);
-    return Buffer.from(result.stdoutBytes ?? '', 'base64');
-}
+var h=Object.defineProperty;var u=(a,f)=>h(a,"name",{value:f,configurable:!0});import{readFileSync as E}from"node:fs";import{library11_contentRequest as b,library11_transportSelection as v,library11_parse as g}from"../../vendor/runtime.js";import{boundedProcess as w}from"../process-lifetime.js";import{fetchBytes as S}from"../adapters/transport/http.js";async function x(a,f,d){const t=new URL(a).protocol.slice(0,-1),y=d.flatMap(o=>{const s=g(o);return s.kind==="fact"?[s.value.fields]:[]}),e=v(y,t);if(e===void 0)throw Error(`REFUSE\xB7transport ${t} no admitted content-request/1 policy`);if(e.name==="fetch"){if(!["http","https"].includes(t))throw Error(`REFUSE\xB7transport ${t} is not supported by this host adapter`);return S(a,e)}const l=process.env.BOUND_TRANSPORTS;if(!l)throw Error(`REFUSE\xB7transport ${t} no host binding for ${e.name}`);let c;try{const o=JSON.parse(E(l,"utf8"));if(!o||typeof o!="object"||!Object.prototype.hasOwnProperty.call(o,e.name))throw Error();const s=o[e.name];if(!s||typeof s!="object")throw Error();const r=s;if(r.kind!=="command"||typeof r.executable!="string"||!r.executable||!Array.isArray(r.args)||!r.args.every(n=>typeof n=="string")||r.environment!==void 0&&(!Array.isArray(r.environment)||!r.environment.every(n=>typeof n=="string")))throw Error();const m=r.environment??[],p={};process.env.PATH!==void 0&&(p.PATH=process.env.PATH);for(const n of m)process.env[n]!==void 0&&(p[n]=process.env[n]);c={executable:r.executable,args:r.args,env:p}}catch{throw Error(`REFUSE\xB7transport ${t} host binding unavailable or invalid`)}const i=w(c.executable,c.args,b(a,f,e),e,void 0,c.env);if(i.status!==0||i.signal!==null)throw Error(`REFUSE\xB7transport ${t} failed \xB7 status ${i.status??i.signal}`);return Buffer.from(i.stdoutBytes??"","base64")}u(x,"transportBytes");export{x as transportBytes};

package/dist/host/process-lifetime.js

@@ -1,17 +1 @@
-import { spawnSync } from 'node:child_process';
-import { processOf } from "../observe/runner.js";
-/** A synchronous fold waits on a supervising host process; the supervisor owns cancellation of its child group. */
-export function boundedProcess(command, args, input, limits, cwd, env) {
-    if (!Number.isSafeInteger(limits.timeoutMs) || limits.timeoutMs <= 0 || !Number.isSafeInteger(limits.responseBytes) || limits.responseBytes <= 0)
-        throw Error('REFUSE·reader invalid process limits');
-    // The same monotonic deadline covers handoff, input and execution. Starting a
-    // fresh timer after stdin closes would leave the handoff outside the policy.
-    const deadline = process.hrtime.bigint() + BigInt(limits.timeoutMs) * 1000000n;
-    const run = spawnSync(process.execPath, [processOf('lifetime', 'host'), String(deadline), String(limits.responseBytes)], { input: JSON.stringify({ command, args, input, limits, cwd, env }), encoding: 'utf8', maxBuffer: limits.responseBytes * 12 + 4096 });
-    if (run.error || run.status !== 0)
-        throw Error(`REFUSE·reader lifetime supervisor ${run.error?.message ?? run.signal ?? run.status}`);
-    const result = JSON.parse(run.stdout);
-    if (result.failure)
-        throw Error(`REFUSE·reader ${result.failure} · status ${result.status ?? result.signal ?? 'cancelled'}${result.stderr ? ' · child stderr: ' + result.stderr : ''}`);
-    return result;
-}
+var c=Object.defineProperty;var n=(t,o)=>c(t,"name",{value:o,configurable:!0});import{spawnSync as d}from"node:child_process";import{processOf as p}from"../observe/runner.js";function m(t,o,i,e,a,u){if(!Number.isSafeInteger(e.timeoutMs)||e.timeoutMs<=0||!Number.isSafeInteger(e.responseBytes)||e.responseBytes<=0)throw Error("REFUSE\xB7reader invalid process limits");const f=process.hrtime.bigint()+BigInt(e.timeoutMs)*1000000n,s=d(process.execPath,[p("lifetime","host"),String(f),String(e.responseBytes)],{input:JSON.stringify({command:t,args:o,input:i,limits:e,cwd:a,env:u}),encoding:"utf8",maxBuffer:e.responseBytes*12+4096});if(s.error||s.status!==0)throw Error(`REFUSE\xB7reader lifetime supervisor ${s.error?.message??s.signal??s.status}`);const r=JSON.parse(s.stdout);if(r.failure)throw Error(`REFUSE\xB7reader ${r.failure} \xB7 status ${r.status??r.signal??"cancelled"}${r.stderr?" \xB7 child stderr: "+r.stderr:""}`);return r}n(m,"boundedProcess");export{m as boundedProcess};