@lapxo/bound 0.2.3 → 0.2.5

package/dist/host/provide.js

@@ -1,183 +1 @@
-import * as nodeModule from 'node:module';
-import { realpathSync } from 'node:fs';
-import { join, relative, isAbsolute, sep } from 'node:path';
-import { pathToFileURL } from 'node:url';
-import { fieldOf } from "../fold/claims.js";
-import { observeText } from "../observe/files.js";
-import { ownLock, ownStore, ownRoot } from "../observe/runner.js";
-import { runtimeTreeAt } from "./release.js";
-import { ContentNeeded } from "./content-needed.js";
-import { theWord } from "../fold/wire.js";
-const findPackageJSON = nodeModule.findPackageJSON;
-const registerHooks = nodeModule.registerHooks;
-const taken = (exp) => (typeof exp === 'string' ? exp : exp && typeof exp === 'object' && 'default' in exp && typeof exp.default === 'string' ? exp.default : '');
-/**
- * Resolve declared library bytes for this host. A library's shape may select an
- * archive coordinate; world selection remains the standing contract.
- */
-export function pinPlace(name) {
-    const lock = ownLock();
-    const line = lock.find((one) => fieldOf(one, 'scope') === `dep/${name}` && fieldOf(one, 'role') === 'reads')
-        ?? lock.find((one) => fieldOf(one, 'scope') === `uses/${name}`);
-    if (line === undefined)
-        return '';
-    const digest = fieldOf(line, 'value');
-    return digest ? runtimeTreeAt(ownStore(), ownRoot(), digest, ownStore(), fieldOf(line, 'role') === 'reads' ? fieldOf(line, 'shape') : '') ?? '' : '';
-}
-export function pinExport(name, sub) {
-    const at = pinPlace(name);
-    const file = taken(JSON.parse(observeText(join(at, manifestOf())) ?? '{}').exports?.[sub]);
-    return at && file ? join(at, file) : '';
-}
-export function pinName(name) {
-    const at = pinPlace(name);
-    return at ? (JSON.parse(observeText(join(at, manifestOf())) ?? '{}').name ?? '') : '';
-}
-const manifestOf = () => `${theWord(ownLock(), 'pin-shape')}.json`;
-/** Node package resolution at a digest-laid library; exports remain authoritative. */
-export function resolvePinned(specifier, context, nextResolve, pin) {
-    if (pin.exports)
-        return nextResolve(specifier, { ...context, parentURL: pin.json });
-    const sub = specifier === pin.pkg ? '' : specifier.slice(pin.pkg.length + 1);
-    const requested = join(pin.at, sub);
-    const coordinate = relative(pin.at, requested);
-    if (isAbsolute(coordinate) || coordinate === '..' || coordinate.startsWith(`..${sep}`))
-        throw new Error('REFUSE·pin library import leaves its laid tree');
-    const file = nodeModule.createRequire(pin.json).resolve(requested);
-    const entry = relative(realpathSync(pin.at), realpathSync(file));
-    if (isAbsolute(entry) || entry === '..' || entry.startsWith(`..${sep}`))
-        throw new Error('REFUSE·pin library entry leaves its laid tree');
-    return nextResolve(pathToFileURL(file).href, context);
-}
-/**
- * A blob stays self-contained. The one thing it does not carry is the SDK the host provides: an import whose package
- * the instrument's own lock names at dep/<name> resolves at the place pinPlace delivers. Nothing is linked into the
- * blob's folder.
- */
-let hooked = false;
-function nativeResolution() {
-    const installed = Object.getOwnPropertyDescriptor(globalThis, Symbol.for('bound.native.resolution@1'));
-    if (!installed)
-        return undefined;
-    const capability = installed.value;
-    if (installed.configurable !== false || installed.writable !== false || !capability || !Object.isFrozen(capability) || capability.profile !== 'fixed-native-resolution@1' || !Array.isArray(capability.libraryNames) || !Object.isFrozen(capability.libraryNames) || capability.libraryNames.some(name => typeof name !== 'string') || !Array.isArray(capability.libraries) || !Object.isFrozen(capability.libraries) || capability.libraries.some(lib => !lib || !Object.isFrozen(lib) || typeof lib.name !== 'string' || typeof lib.manifest !== 'string') || typeof capability.assertPins !== 'function')
-        throw Error('REFUSE·pin fixed resolution capability invalid');
-    return capability;
-}
-/** Fixed execution selects libraries by the instrument's explicit local mount,
- * before opening any artifact. An alias or package-name guess grants nothing. */
-export function selectNativeDependencies(root, dependencies, manifest) {
-    const capability = nativeResolution();
-    if (!capability)
-        return undefined;
-    if (dependencies.length && capability.libraries.some(library => typeof library.coordinate !== 'string' || !library.coordinate))
-        throw Error('REFUSE·pin fixed resolution logical library coordinate missing');
-    const selected = new Map(capability.libraries.map(library => [library.coordinate, library]));
-    return dependencies.flatMap(line => {
-        const mount = fieldOf(line, 'needs');
-        if (!mount)
-            return [];
-        const library = selected.get(mount.replace(/\/+$/, '') + '/' + manifest);
-        if (!library)
-            return [];
-        let actual;
-        try {
-            actual = realpathSync(join(root, mount, manifest));
-        }
-        catch {
-            throw Error('REFUSE·pin selected library mount absent ' + library.name);
-        }
-        if (actual !== library.manifest)
-            throw Error('REFUSE·pin selected library mount differs ' + library.name);
-        return [{ line, library }];
-    });
-}
-/** A declared artifact is not automatically an active Node library. This fixed
- * assertion reuses only the packages selected by the actual host boundary. */
-export function reuseNativeResolution(pins) {
-    const capability = nativeResolution();
-    if (!capability)
-        return false;
-    const selected = new Set(capability.libraryNames);
-    // The fixed preload owns this closed assertion. Package names select which
-    // declared pins participate; exact manifests and member bytes still decide.
-    capability.assertPins(pins.filter(pin => selected.has(pin.pkg)).map(pin => ({ name: pin.pkg, at: pin.at })));
-    return true;
-}
-/** Read one resolved archive's manifest; a selected fixed library cannot vanish
- * into the optional historical provider path when its archive is absent. */
-export function readProvidedPin(name, at, file, requiredName) {
-    if (!at) {
-        if (requiredName !== undefined)
-            throw Error('REFUSE·pin fixed resolution requires declared library ' + name);
-        return undefined;
-    }
-    const manifest = JSON.parse(observeText(join(at, file)) ?? '{}'), pkg = typeof manifest.name === 'string' ? manifest.name : '';
-    if (requiredName !== undefined && pkg !== requiredName)
-        throw Error('REFUSE·pin fixed resolution library name differs ' + name);
-    return pkg ? { at, pkg, exports: Object.prototype.hasOwnProperty.call(manifest, 'exports'), href: pathToFileURL(at).href, json: pathToFileURL(join(at, file)).href } : undefined;
-}
-export function provide() {
-    if (hooked)
-        return;
-    const dependencies = ownLock().filter((line) => fieldOf(line, 'scope').startsWith('dep/') && fieldOf(line, 'role') === 'reads');
-    const file = manifestOf(), selected = selectNativeDependencies(ownRoot(), dependencies, file);
-    const load = (line, requiredName) => {
-        const name = fieldOf(line, 'scope').slice('dep/'.length), at = pinPlace(name);
-        if (!at)
-            throw new ContentNeeded(fieldOf(line, 'value'), 'REFUSE·pin declared library unavailable ' + name);
-        const pin = readProvidedPin(name, at, file, requiredName);
-        if (!pin)
-            throw Error('REFUSE·pin declared library unavailable ' + name);
-        return pin;
-    };
-    if (selected !== undefined) {
-        reuseNativeResolution(selected.map(({ line, library }) => load(line, library.name)));
-        hooked = true;
-        return;
-    }
-    // A mount selects a library, but its manifest is only a routing hint until
-    // an import requests it. The selected archive alone supplies executable bytes.
-    const mounts = dependencies.filter(line => fieldOf(line, 'needs') !== '').map(line => {
-        const mount = join(ownRoot(), fieldOf(line, 'needs'));
-        const manifest = JSON.parse(observeText(join(mount, file)) ?? '{}');
-        return { line, mount, pkg: typeof manifest.name === 'string' ? manifest.name : '' };
-    });
-    const verified = new Map();
-    registerHooks({
-        resolve(specifier, context, nextResolve) {
-            if (specifier.startsWith('.') || specifier.startsWith('/') || specifier.includes(':'))
-                return nextResolve(specifier, context);
-            let selected = mounts.find(one => one.pkg && (specifier === one.pkg || specifier.startsWith(one.pkg + '/')));
-            if (!selected) {
-                // Identify the installed package before following its executable entry:
-                // a renamed manifest and an escaping entry cannot bypass the declared mount.
-                let manifest;
-                try {
-                    manifest = findPackageJSON(specifier, pathToFileURL(join(ownRoot(), file)).href);
-                }
-                catch { }
-                if (manifest)
-                    selected = mounts.find(one => {
-                        try {
-                            return realpathSync(join(one.mount, file)) === realpathSync(manifest);
-                        }
-                        catch {
-                            return false;
-                        }
-                    });
-            }
-            if (!selected)
-                return nextResolve(specifier, context);
-            let pin = verified.get(selected.line);
-            if (!pin) {
-                pin = load(selected.line);
-                verified.set(selected.line, pin);
-            }
-            if (specifier !== pin.pkg && !specifier.startsWith(pin.pkg + '/'))
-                throw Error('REFUSE·pin selected library name differs');
-            return resolvePinned(specifier, context, nextResolve, pin);
-        },
-    });
-    hooked = true;
-}
+var P=Object.defineProperty;var f=(r,e)=>P(r,"name",{value:e,configurable:!0});import*as E from"node:module";import{realpathSync as y}from"node:fs";import{join as d,relative as F,isAbsolute as O,sep as R}from"node:path";import{pathToFileURL as h}from"node:url";import{fieldOf as c}from"../fold/claims.js";import{observeText as b}from"../observe/files.js";import{ownLock as w,ownStore as U,ownRoot as g}from"../observe/runner.js";import{runtimeTreeAt as W}from"./release.js";import{ContentNeeded as x}from"./content-needed.js";import{theWord as A}from"../fold/wire.js";const J=E.findPackageJSON,$=E.registerHooks,z=f(r=>typeof r=="string"?r:r&&typeof r=="object"&&"default"in r&&typeof r.default=="string"?r.default:"","taken");function S(r){const e=w(),o=e.find(l=>c(l,"scope")===`dep/${r}`&&c(l,"role")==="reads")??e.find(l=>c(l,"scope")===`uses/${r}`);if(o===void 0)return"";const n=c(o,"value");return n?W(U(),g(),n,U(),c(o,"role")==="reads"?c(o,"shape"):"")??"":""}f(S,"pinPlace");function Y(r,e){const o=S(r),n=z(JSON.parse(b(d(o,k()))??"{}").exports?.[e]);return o&&n?d(o,n):""}f(Y,"pinExport");function Z(r){const e=S(r);return e?JSON.parse(b(d(e,k()))??"{}").name??"":""}f(Z,"pinName");const k=f(()=>`${A(w(),"pin-shape")}.json`,"manifestOf");function M(r,e,o,n){if(n.exports)return o(r,{...e,parentURL:n.json});const l=r===n.pkg?"":r.slice(n.pkg.length+1),s=d(n.at,l),t=F(n.at,s);if(O(t)||t===".."||t.startsWith(`..${R}`))throw new Error("REFUSE\xB7pin library import leaves its laid tree");const i=E.createRequire(n.json).resolve(s),a=F(y(n.at),y(i));if(O(a)||a===".."||a.startsWith(`..${R}`))throw new Error("REFUSE\xB7pin library entry leaves its laid tree");return o(h(i).href,e)}f(M,"resolvePinned");let v=!1;function j(){const r=Object.getOwnPropertyDescriptor(globalThis,Symbol.for("bound.native.resolution@1"));if(!r)return;const e=r.value;if(r.configurable!==!1||r.writable!==!1||!e||!Object.isFrozen(e)||e.profile!=="fixed-native-resolution@1"||!Array.isArray(e.libraryNames)||!Object.isFrozen(e.libraryNames)||e.libraryNames.some(o=>typeof o!="string")||!Array.isArray(e.libraries)||!Object.isFrozen(e.libraries)||e.libraries.some(o=>!o||!Object.isFrozen(o)||typeof o.name!="string"||typeof o.manifest!="string")||typeof e.assertPins!="function")throw Error("REFUSE\xB7pin fixed resolution capability invalid");return e}f(j,"nativeResolution");function T(r,e,o){const n=j();if(!n)return;if(e.length&&n.libraries.some(s=>typeof s.coordinate!="string"||!s.coordinate))throw Error("REFUSE\xB7pin fixed resolution logical library coordinate missing");const l=new Map(n.libraries.map(s=>[s.coordinate,s]));return e.flatMap(s=>{const t=c(s,"needs");if(!t)return[];const i=l.get(t.replace(/\/+$/,"")+"/"+o);if(!i)return[];let a;try{a=y(d(r,t,o))}catch{throw Error("REFUSE\xB7pin selected library mount absent "+i.name)}if(a!==i.manifest)throw Error("REFUSE\xB7pin selected library mount differs "+i.name);return[{line:s,library:i}]})}f(T,"selectNativeDependencies");function L(r){const e=j();if(!e)return!1;const o=new Set(e.libraryNames);return e.assertPins(r.filter(n=>o.has(n.pkg)).map(n=>({name:n.pkg,at:n.at}))),!0}f(L,"reuseNativeResolution");function D(r,e,o,n){if(!e){if(n!==void 0)throw Error("REFUSE\xB7pin fixed resolution requires declared library "+r);return}const l=JSON.parse(b(d(e,o))??"{}"),s=typeof l.name=="string"?l.name:"";if(n!==void 0&&s!==n)throw Error("REFUSE\xB7pin fixed resolution library name differs "+r);return s?{at:e,pkg:s,exports:Object.prototype.hasOwnProperty.call(l,"exports"),href:h(e).href,json:h(d(e,o)).href}:void 0}f(D,"readProvidedPin");function _(){if(v)return;const r=w().filter(t=>c(t,"scope").startsWith("dep/")&&c(t,"role")==="reads"),e=k(),o=T(g(),r,e),n=f((t,i)=>{const a=c(t,"scope").slice(4),u=S(a);if(!u)throw new x(c(t,"value"),"REFUSE\xB7pin declared library unavailable "+a);const p=D(a,u,e,i);if(!p)throw Error("REFUSE\xB7pin declared library unavailable "+a);return p},"load");if(o!==void 0){L(o.map(({line:t,library:i})=>n(t,i.name))),v=!0;return}const l=r.filter(t=>c(t,"needs")!=="").map(t=>{const i=d(g(),c(t,"needs")),a=JSON.parse(b(d(i,e))??"{}");return{line:t,mount:i,pkg:typeof a.name=="string"?a.name:""}}),s=new Map;$({resolve(t,i,a){if(t.startsWith(".")||t.startsWith("/")||t.includes(":"))return a(t,i);let u=l.find(m=>m.pkg&&(t===m.pkg||t.startsWith(m.pkg+"/")));if(!u){let m;try{m=J(t,h(d(g(),e)).href)}catch{}m&&(u=l.find(N=>{try{return y(d(N.mount,e))===y(m)}catch{return!1}}))}if(!u)return a(t,i);let p=s.get(u.line);if(p||(p=n(u.line),s.set(u.line,p)),t!==p.pkg&&!t.startsWith(p.pkg+"/"))throw Error("REFUSE\xB7pin selected library name differs");return M(t,i,a,p)}}),v=!0}f(_,"provide");export{Y as pinExport,Z as pinName,S as pinPlace,_ as provide,D as readProvidedPin,M as resolvePinned,L as reuseNativeResolution,T as selectNativeDependencies};

package/dist/host/read-only.js

@@ -1,9 +1 @@
-import { AsyncLocalStorage } from 'node:async_hooks';
-/** Prospective evaluation may read existing evidence and calculate values, but cannot acquire evidence or persist caches. */
-const mode = new AsyncLocalStorage();
-export const readOnly = () => mode.getStore() === true;
-export const withoutEffects = (evaluate) => mode.run(true, evaluate);
-export function requireEffects(operation) {
-    if (readOnly())
-        throw Error(`REFUSE·preview ${operation} requires an act; fold the declared inputs first`);
-}
+var n=Object.defineProperty;var r=(e,o)=>n(e,"name",{value:o,configurable:!0});import{AsyncLocalStorage as c}from"node:async_hooks";const t=new c,f=r(()=>t.getStore()===!0,"readOnly"),u=r(e=>t.run(!0,e),"withoutEffects");function a(e){if(f())throw Error(`REFUSE\xB7preview ${e} requires an act; fold the declared inputs first`)}r(a,"requireEffects");export{f as readOnly,a as requireEffects,u as withoutEffects};

package/dist/host/reading-closures.js

@@ -1,227 +1,7 @@
-import { actCosts } from "./act-cost.js";
-import { mkdirSync, readFileSync, existsSync } from 'node:fs';
-import { join, dirname } from 'node:path';
-import { canonical, parse, PROTOCOL, byBytes } from '@lapxo/topos/wire';
-import { replaceWhole, landShard, shardLines } from "../land/ledger.js";
-import { fieldOf } from "../fold/claims.js";
-import { readOnly } from "./read-only.js";
-import { readingIdentityBytes, readingReceiptIdentity, responseIdentity, snapshotAccess, placeInputs, withPlaceInputs } from '@lapxo/topos/contract';
-import { withReadingBoundary } from "./reading-context.js";
-const receiptScope = (scope) => [scope, 'identity'].join('/');
-const fields = (line) => { const got = parse(line); if (got.kind !== 'fact')
-    throw Error('REFUSE·input projection contains a non-wire line'); return got.value.fields; };
-export const inputLines = (files) => files.map(file => canonical({ scope: file.place, form: 'alphabet', measure: 'text', role: 'writes', value: 'lock', shape: file.place, about: file.text, by: 'host', at: 'policy:handed-input' }));
-/** One portable native receipt carrier shared by file plans and native capsule batches. */
-export function portableReadingReceipt(scope, by, closure, output, hash, modern = true, costs = []) {
-    const input = hash(closure), payload = hash(output), rows = output.split('\n').filter(Boolean);
-    return [...(modern ? [canonical({ scope: receiptScope(scope), role: 'writes', form: 'alphabet', measure: 'digest', value: readingReceiptIdentity(input, payload, bytes => hash(new TextDecoder().decode(bytes))), by, at: 'place:' + input })] : []), canonical({ scope, role: 'writes', form: 'alphabet', measure: 'observed', value: payload, by, at: 'place:' + payload }), canonical({ scope, role: 'writes', form: 'alphabet', measure: 'bytes', value: input, by, at: 'place:' + input, about: closure }), canonical({ scope, role: 'writes', form: 'interval', measure: 'count', value: `${rows.length}..${rows.length}`, by, at: 'place:' + payload, about: output }), ...costs];
-}
-/** The selected world owns input projection and reading. The host only verifies closures and keeps native count/bytes receipts. */
-export function readingClosures(options) {
-    const { root, store, reader, speaker, digest: hash, capsule, region, projection, files } = options, emit = options.emit ?? (() => { });
-    options.assertCurrent?.();
-    if (options.context)
-        readingIdentityBytes(options.context);
-    let access = [];
-    if (options.current) {
-        if (!options.context)
-            throw Error('REFUSE·current reading requires a declared identity');
-        const { snapshot, kept, current, permission } = options.current;
-        if (current.implementation !== options.context.implementation)
-            throw Error('REFUSE·current reading implementation differs from its verified context');
-        const response = responseIdentity(snapshot, current, hash), allowed = snapshotAccess(snapshot, kept, current, permission, hash);
-        if (!allowed.inspect || !allowed.reuse)
-            throw Error('REFUSE·current reading is not admitted for reuse');
-        access = [['response', response], ['permission', hash(JSON.stringify([permission.inspect, permission.reuse, permission.freshness]))]];
-    }
-    if (options.execution && (!options.context || JSON.stringify(readingIdentityBytes(options.execution.context)) !== JSON.stringify(readingIdentityBytes(options.context))))
-        throw Error('REFUSE·reading execution differs from declared context');
-    const projectionFor = (name) => {
-        if (!capsule.selectedWorld)
-            return undefined;
-        const { standing, offer } = capsule.selectedWorld;
-        const selectors = standing.parts.some(part => part.scope === `${offer}/place-inputs/${name}` && part.measure === 'reads');
-        if (!selectors)
-            return undefined;
-        if (!options.context || !options.execution || !options.livePlace)
-            throw Error('REFUSE·place inputs require authenticated shadow and reading context ' + name);
-        return placeInputs(standing, offer, name, options.livePlace(), bytes => hash(new TextDecoder().decode(bytes)));
-    };
-    const projectedPlace = projectionFor(projection), readingPlace = projectionFor(region);
-    const commit = (context, name, place) => place && context ? withPlaceInputs(context, JSON.stringify(['place-inputs', capsule.selectedWorld.offer, name]), place) : context;
-    const ask = (identity, requests, context = options.context) => withReadingBoundary(identity, options.execution && context ? { ...options.execution, context } : options.execution, () => capsule.ask(requests, options.readerReference));
-    const projectionContext = commit(options.context, projection, projectedPlace);
-    const base = projectionContext ? hash(new TextDecoder().decode(readingIdentityBytes(projectionContext))) : '';
-    const algorithm = hash('').split(':')[0], handed = new Map(files.map(file => [file.place, file.text]));
-    if (handed.size !== files.length)
-        throw Error('REFUSE·input projection has duplicate handed coordinates');
-    const verify = () => { for (const file of files)
-        if (!readFileSync(join(root, file.place)).equals(Buffer.from(file.text)))
-            throw Error('REFUSE·input changed ' + file.place); };
-    verify();
-    const projected = ask(base, [{ ...(projectedPlace ? { place: projectedPlace } : {}), protocol: PROTOCOL, verb: 'render', rootScope: '', region: projection, at: 1, reads: ['**'], lines: inputLines(files), files: [] }], projectionContext)[0];
-    if (projected?.kind !== 'fact' || !Array.isArray(projected.lines))
-        throw Error('REFUSE·input projection ' + (projected?.why ?? 'no lines'));
-    const plans = new Map();
-    for (const line of projected.lines) {
-        const f = fields(line), scope = f.scope ?? '', resolution = /^receipt:(\d+)$/.exec(f.at ?? '');
-        if (!scope || plans.has(scope) || f.form !== 'alphabet' || f.measure !== 'reads' || f.role !== 'reads' || !resolution)
-            throw Error('REFUSE·input projection ambiguous reading ' + scope);
-        const inputs = (f.value ?? '').split('|').filter(Boolean), needs = (f.needs ?? '').split('|').filter(Boolean);
-        // An aggregate reads its declared receipts; it need not reread a leaf file.
-        if ((!inputs.length && !needs.length) || new Set(inputs).size !== inputs.length || inputs.some(input => !handed.has(input)) || new Set(needs).size !== needs.length)
-            throw Error('REFUSE·input projection has unhanded or duplicate dependencies ' + scope);
-        const n = Number(resolution[1]);
-        if (!Number.isSafeInteger(n))
-            throw Error('REFUSE·input projection invalid resolution ' + scope);
-        plans.set(scope, { scope, inputs, needs, resolution: n, line: canonical({ scope, form: f.form, measure: f.measure, role: f.role, value: inputs.join('|'), needs: needs.join('|'), at: f.at }) });
-    }
-    if (!plans.size)
-        throw Error('REFUSE·input projection returned no readings');
-    const ordered = [], visiting = new Set(), done = new Set();
-    const visit = (scope) => { if (done.has(scope))
-        return; if (visiting.has(scope))
-        throw Error('REFUSE·input projection dependency cycle ' + scope); const p = plans.get(scope); if (!p)
-        throw Error('REFUSE·input projection missing reading ' + scope); visiting.add(scope); for (const need of p.needs)
-        visit(need); visiting.delete(scope); done.add(scope); ordered.push(p); };
-    for (const scope of plans.keys())
-        visit(scope);
-    const identity = hash([capsule.selection ?? '', capsule.digest, region, projection, ...(options.lifetime === undefined ? [] : [JSON.stringify(options.lifetime)])].join('\n')), by = speaker + ':' + identity.split(':')[1].slice(0, 12), journal = 'reading-closures/' + identity.split(':')[1];
-    const prior = shardLines(store, speaker, journal), results = new Map(), out = [];
-    const carried = (digest) => join(store, 'cas', 'carried', digest.split(':')[1] ?? '');
-    const saved = (text) => { const digest = hash(text), path = carried(digest); mkdirSync(dirname(path), { recursive: true }); if (!existsSync(path) || hash(readFileSync(path, 'utf8')) !== digest)
-        replaceWhole(path, text); return digest; };
-    const load = (digest) => { if (!digest.startsWith(algorithm + ':') || !/^[a-f0-9]+$/.test(digest.split(':')[1] ?? ''))
-        return; const path = carried(digest); if (!existsSync(path))
-        return; const text = readFileSync(path, 'utf8'); return hash(text) === digest ? text : undefined; };
-    let read = 0, opened = 0, executed = 0;
-    for (const plan of ordered) {
-        actCosts.measure(() => {
-            // Retained evidence does not authorize a current answer.
-            options.assertCurrent?.();
-            const legacyClosure = [plan.line, canonical({ scope: 'implementation', role: 'writes', form: 'alphabet', measure: 'digest', value: identity, by: 'host', at: 'policy:input-identity' }), ...plan.inputs.map(input => canonical({ scope: input, role: 'writes', form: 'alphabet', measure: 'digest', value: hash(handed.get(input)), by: 'host', at: 'policy:input-identity' })), ...plan.needs.map(need => canonical({ scope: need, role: 'writes', form: 'alphabet', measure: 'digest', value: results.get(need).digest, by: 'host', at: 'policy:input-identity' }))].sort(byBytes).join('\n') + '\n';
-            const leafContext = commit(options.context, region, readingPlace);
-            const context = leafContext && { ...leafContext, policy: hash(JSON.stringify([leafContext.policy, options.allowsEmpty === true, options.lifetime ?? null, options.readerReference ?? null, capsule.selection ?? null, capsule.lines])), inputs: [...[...leafContext.inputs, ...access].map(([name, digest]) => [JSON.stringify(['context', name]), digest]), [JSON.stringify(['plan']), hash(plan.line)], ...plan.inputs.map(input => [JSON.stringify(['file', input]), hash(handed.get(input))]), ...plan.needs.map(need => [JSON.stringify(['receipt', need]), results.get(need).digest])] };
-            const closure = context ? new TextDecoder().decode(readingIdentityBytes(context)) : legacyClosure;
-            const input = hash(closure), scope = 'receipts/readings/' + hash(plan.scope).split(':')[1] + '/' + input.split(':')[1], matching = prior.filter(line => fieldOf(line, 'scope') === scope && fieldOf(line, 'measure') === 'bytes' && fieldOf(line, 'value') === input).at(-1);
-            const count = matching && prior.filter(line => fieldOf(line, 'scope') === scope && fieldOf(line, 'measure') === 'count' && fieldOf(line, 'by') === by).at(-1);
-            const heldOutput = count && load(fieldOf(count, 'at').replace(/^place:/, ''));
-            const heldLines = heldOutput?.split('\n').filter(Boolean);
-            const output = heldLines !== undefined && fieldOf(count, 'value') === `${heldLines.length}..${heldLines.length}` && heldLines.every(line => { const f = fields(line); return f.by === by && f.at === 'place:' + input; }) ? heldOutput : undefined;
-            let lines, payload;
-            if (output !== undefined && load(input) === closure) {
-                if (output === '' && !options.allowsEmpty)
-                    throw Error('REFUSE·reading empty response is not admitted ' + plan.scope);
-                lines = output.split('\n').filter(Boolean);
-                for (const line of lines)
-                    fields(line);
-                payload = fieldOf(count, 'at').replace(/^place:/, '');
-            }
-            else {
-                if (readOnly())
-                    throw Error('REFUSE·preview reading closure is unpaid ' + plan.scope);
-                const started = process.hrtime.bigint();
-                const dependencies = plan.needs.flatMap(need => results.get(need).lines), answer = ask(input, [{ ...(readingPlace ? { place: readingPlace } : {}), protocol: PROTOCOL, verb: 'read', rootScope: plan.scope, name: plan.scope, region, at: plan.resolution, reads: ['**'], lines: [...inputLines(plan.inputs.map(place => ({ place, text: handed.get(place) }))), ...dependencies], files: [] }], context)[0];
-                if (answer?.kind !== 'fact' || !Array.isArray(answer.claims))
-                    throw Error('REFUSE·reading ' + plan.scope + ' · ' + (answer?.why ?? 'no claims'));
-                lines = answer.claims.map((unknown) => { if (typeof unknown?.scope !== 'string' || typeof unknown?.measure !== 'string' || typeof unknown?.role !== 'string' || !unknown.bound || !['interval', 'enumerated'].includes(unknown.bound.kind))
-                    throw Error('REFUSE·reading malformed claim ' + plan.scope); const span = unknown.bound; const text = canonical({ scope: unknown.scope, measure: unknown.measure, role: unknown.role, form: span.kind === 'interval' ? 'interval' : 'alphabet', value: span.kind === 'interval' ? `${span.lo}..${span.hi}` : Array.isArray(span.values) ? span.values.join('|') : '', by, at: 'place:' + input }); fields(text); return text; });
-                if (!lines.length && !options.allowsEmpty)
-                    throw Error('REFUSE·reading empty response is not admitted ' + plan.scope);
-                executed++;
-                verify();
-                options.assertCurrent?.();
-                payload = saved(lines.length ? [...lines].sort(byBytes).join('\n') + '\n' : '');
-                if (saved(closure) !== input)
-                    throw Error('REFUSE·receipt input closure mismatch');
-                const seconds = (Number(process.hrtime.bigint() - started) / 1e9).toFixed(6);
-                landShard(store, speaker, journal, [canonical({ scope, role: 'writes', form: 'interval', measure: 'count', value: `${lines.length}..${lines.length}`, by, at: 'place:' + payload }), canonical({ scope, role: 'writes', form: 'alphabet', measure: 'bytes', value: input, by, at: 'place:' + input }), canonical({ scope, role: 'writes', form: 'interval', measure: 's', value: seconds + '..' + seconds, by, at: 'place:' + input })]);
-                if (plan.resolution === 1)
-                    opened++;
-            }
-            const receipt = context ? readingReceiptIdentity(input, payload, bytes => hash(new TextDecoder().decode(bytes))) : payload;
-            if (context && plan.resolution !== 1)
-                out.push(canonical({ scope: receiptScope(scope), role: 'writes', form: 'alphabet', measure: 'digest', value: receipt, by, at: 'place:' + input }));
-            results.set(plan.scope, { digest: receipt, lines });
-            out.push(canonical({ scope: plan.scope, role: 'writes', form: 'alphabet', measure: 'observed', value: input, by, at: 'place:' + input }), 
-            // A logical reading name is not a physical input coordinate. Preserve the
-            // host-verified handoff beside the result so portable file seals retain
-            // every input, including explicitly read foreign files.
-            // Input witnesses do not locate the result at each input. Result attribution
-            // remains the logical reading's place; two inputs are not two new origins.
-            ...plan.inputs.map(coordinate => canonical({ scope: coordinate, role: 'writes', form: 'alphabet', measure: 'observed', value: hash(handed.get(coordinate)), by, at: 'witness:' + input })), ...lines);
-            if (plan.resolution === 1) {
-                read++;
-                const output = load(payload);
-                if (output === undefined)
-                    throw Error('REFUSE·receipt missing verified carrier ' + payload);
-                const costs = shardLines(store, speaker, journal).filter(line => fieldOf(line, 'scope') === scope && fieldOf(line, 'measure') === 's' && fieldOf(line, 'at') === 'place:' + input);
-                out.push(...portableReadingReceipt(scope, by, closure, output, hash, !!context, costs));
-            }
-        });
-    }
-    verify();
-    emit(`RECEIPTS ${read} read · ${opened} opened · reading closures`);
-    return { lines: out, read, opened, executed };
-}
-/** Verify the native reading carriers before a file seal may reuse them. These are semantic receipts, not file-region seals. */
-export function verifiedReadingReceipts(store, lines, digest, environment, requireContext = false) {
-    const units = lines.filter(line => fieldOf(line, 'scope').startsWith('receipts/readings/') && fieldOf(line, 'measure') === 'bytes' && fieldOf(line, 'role') === 'writes');
-    const load = (id, row) => {
-        const hex = id.split(':')[1];
-        if (!hex || !/^[a-f0-9]+$/.test(hex))
-            return;
-        const supplied = fields(row).about;
-        // A supplied carrier must authenticate even if an old local copy still exists.
-        if (supplied !== undefined)
-            return digest(supplied) === id ? supplied : undefined;
-        const path = join(store, 'cas', 'carried', hex);
-        if (!existsSync(path))
-            return;
-        const bytes = readFileSync(path, 'utf8');
-        return digest(bytes) === id ? bytes : undefined;
-    };
-    for (const unit of units) {
-        const input = fieldOf(unit, 'value'), scope = fieldOf(unit, 'scope'), by = fieldOf(unit, 'by'), counts = lines.filter(line => fieldOf(line, 'scope') === scope && fieldOf(line, 'measure') === 'count' && fieldOf(line, 'by') === by && fieldOf(line, 'role') === 'writes');
-        if (counts.length !== 1 || load(input, unit) === undefined)
-            return;
-        const count = counts[0], output = load(fieldOf(count, 'at').replace(/^place:/, ''), count);
-        if (output === undefined)
-            return;
-        const inputBytes = load(input, unit);
-        if (inputBytes.trimStart().startsWith('[')) {
-            let context;
-            try {
-                context = JSON.parse(inputBytes);
-            }
-            catch {
-                return;
-            }
-            if (!Array.isArray(context) || context.length !== 6 || context[0] !== 'reading-context@1')
-                return;
-            const canonicalContext = { instrument: context[1], implementation: context[2], policy: context[3], inputs: context[4], environment: context[5] };
-            try {
-                if (new TextDecoder().decode(readingIdentityBytes(canonicalContext)) !== inputBytes)
-                    return;
-            }
-            catch {
-                return;
-            }
-            if (environment) {
-                const expected = typeof environment === 'function' ? environment(canonicalContext) : environment;
-                if (expected === undefined || JSON.stringify([...expected].sort((a, b) => byBytes(a[0], b[0]))) !== JSON.stringify(context[5]))
-                    return;
-            }
-            const identity = lines.filter(line => fieldOf(line, 'scope') === receiptScope(scope) && fieldOf(line, 'measure') === 'digest' && fieldOf(line, 'by') === by && fieldOf(line, 'role') === 'writes' && fieldOf(line, 'at') === 'place:' + input);
-            const expected = readingReceiptIdentity(input, fieldOf(count, 'at').replace(/^place:/, ''), bytes => digest(new TextDecoder().decode(bytes)));
-            if (identity.length !== 1 || fieldOf(identity[0], 'value') !== expected)
-                return;
-        }
-        else if (requireContext || !inputBytes.endsWith('\n') || inputBytes.split('\n').filter(Boolean).some(line => parse(line).kind !== 'fact'))
-            return;
-        const rows = output.split('\n').filter(Boolean);
-        if (fieldOf(count, 'value') !== `${rows.length}..${rows.length}` || rows.some(line => fieldOf(line, 'by') !== by || fieldOf(line, 'at') !== 'place:' + input))
-            return;
-    }
-    return units.length;
-}
+var Z=Object.defineProperty;var B=(s,c)=>Z(s,"name",{value:c,configurable:!0});import{actCosts as k}from"./act-cost.js";import{readFileSync as ee,existsSync as re}from"node:fs";import{join as te}from"node:path";import{library11_canonical as u,library11_parse as se,library11_PROTOCOL as ae,library11_byBytes as X}from"../vendor/runtime.js";import{landShard as oe,shardLines as ie}from"../land/ledger.js";import{fieldOf as e}from"../fold/claims.js";import{readOnly as ne}from"./read-only.js";import{library2_readingIdentityBytes as le,library2_readingReceiptIdentity as q}from"../vendor/runtime.js";import{readingPreparation as ce,inputLines as pe,readingFields as Y}from"./reading-preparation.js";import{inputLines as $e}from"./reading-preparation.js";const z=B(s=>[s,"identity"].join("/"),"receiptScope");function de(s,c,m,y,b,v=!0,$=[]){const t=b(m),i=b(y),f=y.split(`
+`).filter(Boolean);return[...v?[u({scope:z(s),role:"writes",form:"alphabet",measure:"digest",value:q(t,i,p=>b(new TextDecoder().decode(p))),by:c,at:"place:"+t})]:[],u({scope:s,role:"writes",form:"alphabet",measure:"observed",value:i,by:c,at:"place:"+i}),u({scope:s,role:"writes",form:"alphabet",measure:"bytes",value:t,by:c,at:"place:"+t,about:m}),u({scope:s,role:"writes",form:"interval",measure:"count",value:`${f.length}..${f.length}`,by:c,at:"place:"+i,about:y}),...$]}B(de,"portableReadingReceipt");function xe(s){const{root:c,store:m,reader:y,speaker:b,digest:v,capsule:$,region:t,projection:i,files:f}=s,p=s.emit??(()=>{}),{ordered:S,identity:w,by:d,journal:E,prior:j,prepare:r,retained:A,verify:C,ask:L,load:l,saved:U,handed:_,readingPlace:G}=ce(s),P=new Map,I=[];let D=0,N=0,H=0;for(const a of S)k.measure(()=>{s.assertCurrent?.();const{context:T,closure:J,input:n,scope:R}=r(a,P),W=A({context:T,closure:J,input:n,scope:R});let g,O;if(W)g=W.lines,O=W.payload;else{if(ne())throw Error("REFUSE\xB7preview reading closure is unpaid "+a.scope);const h=process.hrtime.bigint(),M=a.needs.flatMap(o=>P.get(o).lines),x=L(n,[{...G?{place:G}:{},protocol:ae,verb:"read",rootScope:a.scope,name:a.scope,region:t,at:a.resolution,reads:["**"],lines:[...pe(a.inputs.map(o=>({place:o,text:_.get(o)}))),...M],files:[]}],T)[0];if(x?.kind!=="fact"||!Array.isArray(x.claims))throw Error("REFUSE\xB7reading "+a.scope+" \xB7 "+(x?.why??"no claims"));if(g=x.claims.map(o=>{if(typeof o?.scope!="string"||typeof o?.measure!="string"||typeof o?.role!="string"||!o.bound||!["interval","enumerated"].includes(o.bound.kind))throw Error("REFUSE\xB7reading malformed claim "+a.scope);const F=o.bound,V=u({scope:o.scope,measure:o.measure,role:o.role,form:F.kind==="interval"?"interval":"alphabet",value:F.kind==="interval"?`${F.lo}..${F.hi}`:Array.isArray(F.values)?F.values.join("|"):"",by:d,at:"place:"+n});return Y(V),V}),!g.length&&!s.allowsEmpty)throw Error("REFUSE\xB7reading empty response is not admitted "+a.scope);if(H++,C(),s.assertCurrent?.(),O=U(g.length?[...g].sort(X).join(`
+`)+`
+`:""),U(J)!==n)throw Error("REFUSE\xB7receipt input closure mismatch");const Q=(Number(process.hrtime.bigint()-h)/1e9).toFixed(6);oe(m,b,E,[u({scope:R,role:"writes",form:"interval",measure:"count",value:`${g.length}..${g.length}`,by:d,at:"place:"+O}),u({scope:R,role:"writes",form:"alphabet",measure:"bytes",value:n,by:d,at:"place:"+n}),u({scope:R,role:"writes",form:"interval",measure:"s",value:Q+".."+Q,by:d,at:"place:"+n})]),a.resolution===1&&N++}const K=T?q(n,O,h=>v(new TextDecoder().decode(h))):O;if(T&&a.resolution!==1&&I.push(u({scope:z(R),role:"writes",form:"alphabet",measure:"digest",value:K,by:d,at:"place:"+n})),P.set(a.scope,{digest:K,lines:g}),I.push(u({scope:a.scope,role:"writes",form:"alphabet",measure:"observed",value:n,by:d,at:"place:"+n}),...a.inputs.map(h=>u({scope:h,role:"writes",form:"alphabet",measure:"observed",value:v(_.get(h)),by:d,at:"witness:"+n})),...g),a.resolution===1){D++;const h=l(O);if(h===void 0)throw Error("REFUSE\xB7receipt missing verified carrier "+O);const M=ie(m,b,E).filter(x=>e(x,"scope")===R&&e(x,"measure")==="s"&&e(x,"at")==="place:"+n);I.push(...de(R,d,J,h,v,!!T,M))}});return C(),p(`RECEIPTS ${D} read \xB7 ${N} opened \xB7 reading closures`),{lines:I,read:D,opened:N,executed:H}}B(xe,"readingClosures");function Se(s,c,m,y,b=!1){const v=c.filter(t=>e(t,"scope").startsWith("receipts/readings/")&&e(t,"measure")==="bytes"&&e(t,"role")==="writes"),$=B((t,i)=>{const f=t.split(":")[1];if(!f||!/^[a-f0-9]+$/.test(f))return;const p=Y(i).about;if(p!==void 0)return m(p)===t?p:void 0;const S=te(s,"cas","carried",f);if(!re(S))return;const w=ee(S,"utf8");return m(w)===t?w:void 0},"load");for(const t of v){const i=e(t,"value"),f=e(t,"scope"),p=e(t,"by"),S=c.filter(r=>e(r,"scope")===f&&e(r,"measure")==="count"&&e(r,"by")===p&&e(r,"role")==="writes");if(S.length!==1||$(i,t)===void 0)return;const w=S[0],d=$(e(w,"at").replace(/^place:/,""),w);if(d===void 0)return;const E=$(i,t);if(E.trimStart().startsWith("[")){let r;try{r=JSON.parse(E)}catch{return}if(!Array.isArray(r)||r.length!==6||r[0]!=="reading-context@1")return;const A={instrument:r[1],implementation:r[2],policy:r[3],inputs:r[4],environment:r[5]};try{if(new TextDecoder().decode(le(A))!==E)return}catch{return}if(y){const l=typeof y=="function"?y(A):y;if(l===void 0||JSON.stringify([...l].sort((U,_)=>X(U[0],_[0])))!==JSON.stringify(r[5]))return}const C=c.filter(l=>e(l,"scope")===z(f)&&e(l,"measure")==="digest"&&e(l,"by")===p&&e(l,"role")==="writes"&&e(l,"at")==="place:"+i),L=q(i,e(w,"at").replace(/^place:/,""),l=>m(new TextDecoder().decode(l)));if(C.length!==1||e(C[0],"value")!==L)return}else if(b||!E.endsWith(`
+`)||E.split(`
+`).filter(Boolean).some(r=>se(r).kind!=="fact"))return;const j=d.split(`
+`).filter(Boolean);if(e(w,"value")!==`${j.length}..${j.length}`||j.some(r=>e(r,"by")!==p||e(r,"at")!=="place:"+i))return}return v.length}B(Se,"verifiedReadingReceipts");export{$e as inputLines,de as portableReadingReceipt,xe as readingClosures,Se as verifiedReadingReceipts};

package/dist/host/reading-context.js

@@ -1,53 +1 @@
-import { AsyncLocalStorage } from 'node:async_hooks';
-import { createHash } from 'node:crypto';
-import { readFileSync, realpathSync } from 'node:fs';
-import { release } from 'node:os';
-import { readingIdentityBytes } from '@lapxo/topos/contract';
-const active = new AsyncLocalStorage();
-export const readingBoundary = active.getStore.bind(active);
-export function withReadingBoundary(identity, execution, run) {
-    if (execution) {
-        const algorithm = identity.split(':')[0];
-        const hash = (text) => algorithm + ':' + createHash(algorithm).update(text).digest('hex');
-        const expected = readingEnvironment(hash, execution.env, execution.cwd, execution.flags);
-        const named = [...execution.context.environment].sort(([a], [b]) => Buffer.compare(Buffer.from(a), Buffer.from(b)));
-        if (JSON.stringify([...expected].sort(([a], [b]) => Buffer.compare(Buffer.from(a), Buffer.from(b)))) !== JSON.stringify(named))
-            throw Error('REFUSE·reading execution environment differs from its identity');
-    }
-    return active.run({ identity, execution }, run);
-}
-/** References commit the actual inherited boundary. Values are hashed, never
- * carried as environment secrets. No empty map is substituted for unknown input. */
-// The running runtime is resolved once for this act; mutable input bytes are not
-// stored in this slot. Later processes establish their own runtime reference.
-const runtimes = new Map();
-const runtimeOf = (algorithm) => { const held = runtimes.get(algorithm); if (held)
-    return held; const digest = algorithm + ':' + createHash(algorithm).update(readFileSync(process.execPath)).digest('hex'); runtimes.set(algorithm, digest); return digest; };
-export function readingEnvironment(hash, env = process.env, cwd = process.cwd(), flags = process.execArgv) {
-    const inherited = Object.entries(env).filter((entry) => entry[1] !== undefined);
-    return [
-        ['variables', hash(JSON.stringify(inherited.sort(([a], [b]) => Buffer.compare(Buffer.from(a), Buffer.from(b)))))],
-        ['cwd', hash(realpathSync(cwd))], ['flags', hash(JSON.stringify(flags))],
-        ['runtime', runtimeOf(hash('').split(':')[0])],
-        ['platform', hash(JSON.stringify([process.platform, process.arch, process.versions, release()]))],
-    ];
-}
-export function readingProfile(lines, field) {
-    const values = (scope) => lines.filter(line => field(line, 'scope') === scope && field(line, 'role') === 'writes' && field(line, 'value') !== 'withdraw');
-    const contexts = values('wire/reading-context'), receipts = values('wire/reading-receipt');
-    if (!contexts.length && !receipts.length)
-        return false;
-    if (contexts.length !== 1 || receipts.length !== 1 || field(contexts[0], 'value') !== 'reading-context@1' || field(receipts[0], 'value') !== 'reading-receipt@1')
-        throw Error('REFUSE·reading identity ambiguous or incomplete profiles');
-    return true;
-}
-/** The caller supplies verified implementation and transitive references. This
- * constructor adds the process boundary that the host will actually hand over. */
-export function readingExecution(input, hash, boundary = { env: process.env, cwd: process.cwd(), flags: process.execArgv }) {
-    const env = Object.fromEntries(Object.entries(boundary.env).filter((entry) => entry[1] !== undefined));
-    const cwd = boundary.cwd, flags = Object.freeze([...boundary.flags]);
-    Object.freeze(env);
-    const context = { ...input, environment: readingEnvironment(hash, env, cwd, flags) };
-    readingIdentityBytes(context);
-    return { context, env, cwd, flags };
-}
+var v=Object.defineProperty;var c=(t,e)=>v(t,"name",{value:e,configurable:!0});import{BoundRefusal as d}from"./refusals.js";import{sha256 as y}from"./hash.js";import{AsyncLocalStorage as g}from"node:async_hooks";import{createHash as l}from"node:crypto";import{readFileSync as x,realpathSync as S}from"node:fs";import{release as h}from"node:os";import{library2_readingIdentityBytes as B}from"../vendor/runtime.js";const a=new g,U=a.getStore.bind(a);function z(t,e,i){if(e){const r=t.split(":")[0],o=w(c(f=>r+":"+l(r).update(f).digest("hex"),"hash"),e.env,e.cwd,e.flags),s=[...e.context.environment].sort(([f],[p])=>Buffer.compare(Buffer.from(f),Buffer.from(p)));if(JSON.stringify([...o].sort(([f],[p])=>Buffer.compare(Buffer.from(f),Buffer.from(p))))!==JSON.stringify(s))throw Error("REFUSE\xB7reading execution environment differs from its identity")}return a.run({identity:t,execution:e},i)}c(z,"withReadingBoundary");const m=new Map,E=c(t=>{const e=m.get(t);if(e)return e;const i=t+":"+l(t).update(x(process.execPath)).digest("hex");return m.set(t,i),i},"runtimeOf");function w(t,e=process.env,i=process.cwd(),r=process.execArgv){const n=Object.entries(e).filter(o=>o[1]!==void 0);return[["variables",t(JSON.stringify(n.sort(([o],[s])=>Buffer.compare(Buffer.from(o),Buffer.from(s)))))],["cwd",t(S(i))],["flags",t(JSON.stringify(r))],["runtime",E(t("").split(":")[0])],["platform",t(JSON.stringify([process.platform,process.arch,process.versions,h()]))]]}c(w,"readingEnvironment");function A(t,e){const i=c(o=>t.filter(s=>e(s,"scope")===o&&e(s,"role")==="writes"&&e(s,"value")!=="withdraw"),"values"),r=i("wire/reading-context"),n=i("wire/reading-receipt");if(!r.length&&!n.length)return!1;if(r.length!==1||n.length!==1||e(r[0],"value")!=="reading-context@1"||e(n[0],"value")!=="reading-receipt@1")throw Error("REFUSE\xB7reading identity ambiguous or incomplete profiles");return!0}c(A,"readingProfile");function L(t,e,i={env:process.env,cwd:process.cwd(),flags:process.execArgv}){const r=Object.fromEntries(Object.entries(i.env).filter(f=>f[1]!==void 0)),n=i.cwd,o=Object.freeze([...i.flags]);Object.freeze(r);const s={...t,environment:w(e,r,n,o)};return B(s),{context:s,env:r,cwd:n,flags:o}}c(L,"readingExecution");const u=new g,M=c(()=>u.getStore()!==void 0,"preparingView");function P(t,e,i=!0){const r=u.getStore();if(!r)return e();const n=r.inputs.get(t);if(n)return n.value;const o=e(),s=JSON.stringify(o)??"null";if(r.inputs.size>=r.files||(r.used+=Buffer.byteLength(t)+Buffer.byteLength(s))>r.bytes)throw new d("reading-identity/budget","REFUSE\xB7reading-identity/budget view inputs");return r.inputs.set(t,{value:o,encoded:s,read:e,identity:i}),o}c(P,"viewInput");function V(t,e){const i={inputs:new Map,...t,used:0};return u.run(i,()=>{const r=e();for(const n of i.inputs.values())if((JSON.stringify(u.exit(n.read))??"null")!==n.encoded)throw new d("reading-identity/context","REFUSE\xB7reading-identity/context view inputs changed during preparation");return{value:r,inputs:[...i.inputs].filter(([,n])=>n.identity).map(([n,o])=>[n,y(o.encoded)]).sort(([n],[o])=>n<o?-1:n>o?1:0)}})}c(V,"captureViewInputs");export{V as captureViewInputs,M as preparingView,U as readingBoundary,w as readingEnvironment,L as readingExecution,A as readingProfile,P as viewInput,z as withReadingBoundary};

package/dist/host/reading-identity.js

@@ -0,0 +1,3 @@
+var k=Object.defineProperty;var a=(t,e)=>k(t,"name",{value:e,configurable:!0});import{readFileSync as J}from"node:fs";import{sha256 as u}from"./hash.js";import{captureViewInputs as j,viewInput as y,readingEnvironment as b}from"./reading-context.js";import{withoutEffects as q}from"./read-only.js";import{committedInventoryFingerprint as R,committedLocalActs as F,withCommittedLocalActObservation as x}from"./ports/local-act.js";import{ingressBundles as A}from"./ports/ingress.js";import{instrumentCoordinates as B}from"../fold/digests.js";import{viewsOf as D}from"../fold/views.js";import{standingOf as K}from"../cli/place.js";import{evidenceLines as V}from"../render/view.js";import{resolve as O,join as H}from"node:path";import{library11_LOCK as M}from"../vendor/runtime.js";import{fieldOf as p,isWire as W}from"../fold/claims.js";import{storeOf as U}from"../land/ledger.js";import{underRootAuthority as _}from"../land/act.js";import{prepareObservedReadings as $}from"../fold/observed.js";import{authenticatedStanding as g}from"./admitted-place.js";import{withHostCall as I}from"./call-context.js";import{withContentStore as z}from"./content-store.js";import{BoundRefusal as n}from"./refusals.js";async function ge(t){try{if(!t||typeof t.place!="string"||!t.place||!t.instrument?.runtime)throw new n("host/context","REFUSE\xB7host/context");const e={...t.limits};for(const s of[e.bytes,e.files,e.readings,e.probes])if(!Number.isSafeInteger(s)||s<1)throw new n("host/budget","REFUSE\xB7host/budget");if(e.signal?.aborted)throw new n("host/cancelled","REFUSE\xB7host/cancelled");const i=O(t.place),r=U(i),o=structuredClone(t.instrument),d=t.reader;return await I({instrumentName:o.name,runtime:o.runtime,output:a(()=>{},"output")},()=>z(r,()=>_(r,"prepare reading identity",()=>{const s=w(g(i));for(const m of["bytes","files","readings","probes"])e[m]=Math.min(e[m],s[m]);return{kind:"fact",preparations:$(i,r,e,d)}}),()=>g(i)))}catch(e){return{kind:"refuse",code:e instanceof n?e.code:"reading-identity/failed",diagnostic:e instanceof Error?e.message:"REFUSE\xB7reading identity failed"}}}a(ge,"prepareNativeReadingIdentity");function w(t){const e=a(i=>{const r=t.filter(s=>p(s,"scope")==="reading-identity/"+i&&p(s,"role")==="writes"&&p(s,"value")!=="withdraw");if(r.length!==1)throw new n("reading-identity/budget","REFUSE\xB7reading identity requires one declared "+i+" limit");const o=/^0\.\.([1-9][0-9]*)$/.exec(p(r[0],"value")),d=Number(o?.[1]);if(!o||!Number.isSafeInteger(d))throw new n("reading-identity/budget","REFUSE\xB7invalid reading identity "+i+" limit");return d},"limit");return{bytes:e("bytes"),files:e("files"),readings:e("readings"),probes:e("probes")}}a(w,"declaredReadingIdentityLimits");function le(t){try{if(!t||!t.instrument?.runtime||typeof t.place!="string"||!t.place)throw new n("host/context","REFUSE\xB7host/context");if(t.view!=="lines"&&t.view!=="evidence")throw new n("reading-identity/selection","REFUSE\xB7reading-identity/selection supports lines and evidence");const e=t.view,i=O(t.place),r=U(i),o=t.instrument;return I({instrumentName:o.name,runtime:structuredClone(o.runtime),output:a(()=>{},"output")},()=>q(()=>{const d=R(F(r)),s=w(g(i)),l=new Date().toISOString().slice(0,10),m=b(u),f=j(s,()=>x(r,()=>{const C=w(y("authenticated-configuration:"+i,()=>g(i)));if(JSON.stringify(C)!==JSON.stringify(s))throw new n("reading-identity/context","REFUSE\xB7reading-identity/context identity budget changed");if(e==="evidence"&&y("foreign-ingress:"+r,()=>A(r)).length)throw new n("reading-identity/selection","REFUSE\xB7reading-identity/selection foreign view identity requires a transport snapshot");const v=K(i).standing;if(e==="evidence"){const c=D(v).get(e);if(!c||c.shape||c.regions.length!==1||c.regions[0]?.name!=="evidence")throw new n("reading-identity/selection","REFUSE\xB7reading-identity/selection requires the native evidence projection")}const E=e==="lines"?v.filter(W):V(i,r),S=[...B(r,o.runtime.entry,[],o.runtime.root,[],!0)].map(([c,L])=>[c,L]);if(!S.length)throw new n("reading-identity/failed","REFUSE\xB7reading-identity/failed is unavailable");return{text:E.length?E.join(`
+`)+`
+`:"",implementation:S,instrumentLock:u(y("instrument-lock:"+o.runtime.root,()=>J(H(o.runtime.root,M),"utf8")))}})),N=R(F(r));if(d!==N||l!==new Date().toISOString().slice(0,10)||JSON.stringify(m)!==JSON.stringify(b(u)))throw new n("reading-identity/context","REFUSE\xB7reading-identity/context committed inputs changed during preparation");const h=u(JSON.stringify(["native-view-inputs@1",i,e,d,f.inputs,f.value.implementation,f.value.instrumentLock,m,l]));if(t.expectedIdentity!==void 0&&t.expectedIdentity!==h)throw new n("reading-identity/context","REFUSE\xB7reading-identity/context view identity differs from the expected snapshot");return{kind:"fact",view:e,identity:h,text:f.value.text}}))}catch(e){return{kind:"refuse",code:e instanceof n?e.code:"reading-identity/failed",diagnostic:e instanceof Error?e.message:"REFUSE\xB7view identity failed"}}}a(le,"prepareNativeViewIdentity");export{w as declaredReadingIdentityLimits,ge as prepareNativeReadingIdentity,le as prepareNativeViewIdentity};

package/dist/host/reading-preparation.js

@@ -0,0 +1,6 @@
+var ae=Object.defineProperty;var d=(t,r)=>ae(t,"name",{value:r,configurable:!0});import{mkdirSync as ce,readFileSync as T,existsSync as $}from"node:fs";import{join as W,dirname as de}from"node:path";import{library11_canonical as j,library11_parse as le,library11_PROTOCOL as ue,library11_byBytes as fe}from"../vendor/runtime.js";import{replaceWhole as pe,shardLines as he}from"../land/ledger.js";import{fieldOf as g}from"../fold/claims.js";import{library2_readingIdentityBytes as O,library2_readingReceiptIdentity as ge,library2_responseIdentity as ye,library2_snapshotAccess as me,library2_placeInputs as Ee,library2_withPlaceInputs as we}from"../vendor/runtime.js";import{withReadingBoundary as be}from"./reading-context.js";import{BoundRefusal as y}from"./refusals.js";class ee extends Error{static{d(this,"ReadingNeeds")}constructor(r){super("Reading inputs missing"),this.coordinates=r}}const te=d(t=>t.reduce((r,m)=>r+Buffer.byteLength(m.text,"utf8"),0),"filesBytes"),q=d(t=>{const r=le(t);if(r.kind!=="fact")throw Error("REFUSE\xB7input projection contains a non-wire line");return r.value.fields},"readingFields"),xe=d(t=>t.map(r=>j({scope:r.place,form:"alphabet",measure:"text",role:"writes",value:"lock",shape:r.place,about:r.text,by:"host",at:"policy:handed-input"})),"inputLines");function Se(t){const r=t.preparationLimits;if(r){for(const e of[r.bytes,r.files,r.readings,r.probes])if(!Number.isSafeInteger(e)||e<1)throw new y("host/budget","REFUSE\xB7host/budget");if(te(t.files)>r.bytes||t.files.length>r.files||r.probes<1)throw new y("host/budget","REFUSE\xB7host/budget")}const{root:m,store:b,speaker:S,digest:s,capsule:f,region:E,projection:h,files:w}=t;t.assertCurrent?.(),t.context&&O(t.context);let z=[];if(t.current){if(!t.context)throw Error("REFUSE\xB7current reading requires a declared identity");const{snapshot:e,kept:n,current:i,permission:o}=t.current;if(i.implementation!==t.context.implementation)throw Error("REFUSE\xB7current reading implementation differs from its verified context");const a=ye(e,i,s),u=me(e,n,i,o,s);if(!u.inspect||!u.reuse)throw Error("REFUSE\xB7current reading is not admitted for reuse");z=[["response",a],["permission",s(JSON.stringify([o.inspect,o.reuse,o.freshness]))]]}if(t.execution&&(!t.context||JSON.stringify(O(t.execution.context))!==JSON.stringify(O(t.context))))throw Error("REFUSE\xB7reading execution differs from declared context");const A=d(e=>{if(!f.selectedWorld)return;const{standing:n,offer:i}=f.selectedWorld;if(n.parts.some(a=>a.scope===`${i}/place-inputs/${e}`&&a.measure==="reads")){if(!t.context||!t.execution||!t.livePlace)throw Error("REFUSE\xB7place inputs require authenticated shadow and reading context "+e);return Ee(n,i,e,t.livePlace(),a=>s(new TextDecoder().decode(a)))}},"projectionFor"),k=A(h),D=A(E),M=d((e,n,i)=>i&&e?we(e,JSON.stringify(["place-inputs",f.selectedWorld.offer,n]),i):e,"commit"),G=d((e,n,i=t.context)=>be(e,t.execution&&i?{...t.execution,context:i}:t.execution,()=>f.ask(n,t.readerReference)),"ask"),N=M(t.context,h,k),re=N?s(new TextDecoder().decode(O(N))):"",ne=s("").split(":")[0],R=new Map(w.map(e=>[e.place,e.text]));if(R.size!==w.length)throw Error("REFUSE\xB7input projection has duplicate handed coordinates");const I=d(()=>{if(r?.signal?.aborted)throw new y("host/cancelled","REFUSE\xB7host/cancelled");for(const e of w){if(!$(W(m,e.place)))throw new ee([e.place]);if(!T(W(m,e.place)).equals(Buffer.from(e.text)))throw new y("reading-identity/integrity","REFUSE\xB7input changed "+e.place)}},"verify");if(I(),r?.signal?.aborted)throw new y("host/cancelled","REFUSE\xB7host/cancelled");const F=G(re,[{...k?{place:k}:{},protocol:ue,verb:"render",rootScope:"",region:h,at:1,reads:["**"],lines:xe(w),files:[]}],N)[0];if(F?.kind!=="fact"||!Array.isArray(F.lines))throw Error("REFUSE\xB7input projection "+(F?.why??"no lines"));if(r&&F.lines.length>r.readings)throw new y("host/budget","REFUSE\xB7host/budget");const v=new Map;for(const e of F.lines){const n=q(e),i=n.scope??"",o=/^receipt:(\d+)$/.exec(n.at??"");if(!i||v.has(i)||n.form!=="alphabet"||n.measure!=="reads"||n.role!=="reads"||!o)throw Error("REFUSE\xB7input projection ambiguous reading "+i);const a=(n.value??"").split("|").filter(Boolean),u=(n.needs??"").split("|").filter(Boolean);if(!a.length&&!u.length||new Set(a).size!==a.length||a.some(x=>!R.has(x))||new Set(u).size!==u.length)throw Error("REFUSE\xB7input projection has unhanded or duplicate dependencies "+i);const p=Number(o[1]);if(!Number.isSafeInteger(p))throw Error("REFUSE\xB7input projection invalid resolution "+i);v.set(i,{scope:i,inputs:a,needs:u,resolution:p,line:j({scope:i,form:n.form,measure:n.measure,role:n.role,value:a.join("|"),needs:u.join("|"),at:n.at})})}if(!v.size)throw Error("REFUSE\xB7input projection returned no readings");const H=[],J=new Set,K=new Set,Q=d(e=>{if(K.has(e))return;if(J.has(e))throw Error("REFUSE\xB7input projection dependency cycle "+e);const n=v.get(e);if(!n)throw Error("REFUSE\xB7input projection missing reading "+e);J.add(e);for(const i of n.needs)Q(i);J.delete(e),K.add(e),H.push(n)},"visit");for(const e of v.keys())Q(e);const B=s([f.selection??"",f.digest,E,h,...t.lifetime===void 0?[]:[JSON.stringify(t.lifetime)]].join(`
+`)),_=S+":"+B.split(":")[1].slice(0,12),V="reading-closures/"+B.split(":")[1],P=he(b,S,V),X=d(e=>W(b,"cas","carried",e.split(":")[1]??""),"carried"),ie=d(e=>{const n=s(e),i=X(n);return ce(de(i),{recursive:!0}),(!$(i)||s(T(i,"utf8"))!==n)&&pe(i,e),n},"saved"),C=d((e,n=!1)=>{if(!e.startsWith(ne+":")||!/^[a-f0-9]+$/.test(e.split(":")[1]??""))return;const i=X(e);if(!$(i))return;const o=T(i,"utf8");if(s(o)!==e){if(n)throw new y("reading-identity/integrity","REFUSE\xB7reading carrier bytes differ");return}return o},"load"),se=d((e,n)=>{const i=[e.line,j({scope:"implementation",role:"writes",form:"alphabet",measure:"digest",value:B,by:"host",at:"policy:input-identity"}),...e.inputs.map(c=>j({scope:c,role:"writes",form:"alphabet",measure:"digest",value:s(R.get(c)),by:"host",at:"policy:input-identity"})),...e.needs.map(c=>j({scope:c,role:"writes",form:"alphabet",measure:"digest",value:n.get(c).digest,by:"host",at:"policy:input-identity"}))].sort(fe).join(`
+`)+`
+`,o=M(t.context,E,D),a=o&&{...o,policy:s(JSON.stringify([o.policy,t.allowsEmpty===!0,t.lifetime??null,t.readerReference??null,f.selection??null,f.lines])),inputs:[...[...o.inputs,...z].map(([c,U])=>[JSON.stringify(["context",c]),U]),[JSON.stringify(["plan"]),s(e.line)],...e.inputs.map(c=>[JSON.stringify(["file",c]),s(R.get(c))]),...e.needs.map(c=>[JSON.stringify(["receipt",c]),n.get(c).digest])]},u=a?new TextDecoder().decode(O(a)):i,p=s(u),x="receipts/readings/"+s(e.scope).split(":")[1]+"/"+p.split(":")[1];return{context:a,closure:u,input:p,scope:x}},"prepare"),oe=d((e,n=!1)=>{const{scope:i,input:o,closure:a}=e,p=P.filter(l=>g(l,"scope")===i&&g(l,"measure")==="bytes"&&g(l,"value")===o).at(-1)&&P.filter(l=>g(l,"scope")===i&&g(l,"measure")==="count"&&g(l,"by")===_).at(-1),x=p&&C(g(p,"at").replace(/^place:/,""),n),c=x?.split(`
+`).filter(Boolean),U=c!==void 0&&g(p,"value")===`${c.length}..${c.length}`&&c.every(l=>{const Z=q(l);return Z.by===_&&Z.at==="place:"+o})?x:void 0;if(U===void 0||C(o,n)!==a)return;if(U===""&&!t.allowsEmpty)throw Error("REFUSE\xB7reading empty response is not admitted");const Y=U.split(`
+`).filter(Boolean);for(const l of Y)q(l);const L=g(p,"at").replace(/^place:/,"");return{lines:Y,payload:L,digest:e.context?ge(o,L,l=>s(new TextDecoder().decode(l))):L}},"retained");return I(),{ordered:H,identity:B,by:_,journal:V,prior:P,prepare:se,retained:oe,verify:I,ask:G,load:C,saved:ie,handed:R,readingPlace:D,verifiedBytes:te(w)}}d(Se,"readingPreparation");function Ie(t){try{if(!t.context||!t.execution)throw new y("reading-identity/context","REFUSE\xB7reading preparation requires its actual execution context");const r=Se(t),m=new Map,b=[];let S=0;for(const s of r.ordered){t.assertCurrent?.(),r.verify();const f=s.needs.filter(w=>!m.has(w));if(f.length){b.push({scope:s.scope,kind:"needs",needs:f});continue}const E=r.prepare(s,m),h=r.retained(E,!0);h&&(m.set(s.scope,h),S++),b.push({scope:s.scope,kind:"ready",identity:E.input,context:E.context,...h?{receipt:h.digest}:{}})}return r.verify(),t.assertCurrent?.(),{kind:"fact",readings:b,probes:1,verifiedBytes:r.verifiedBytes,retained:S}}catch(r){return r instanceof ee?{kind:"needs",needs:r.coordinates}:{kind:"refuse",code:r instanceof y?r.code:"reading-identity/failed",diagnostic:r instanceof Error?r.message:"REFUSE\xB7reading preparation failed"}}}d(Ie,"prepareReadingIdentities");export{xe as inputLines,Ie as prepareReadingIdentities,q as readingFields,Se as readingPreparation};

package/dist/host/reference-authenticated.d.ts

@@ -1,40 +1 @@
-import { authorityOf, validateObjectContext } from '@lapxo/topos/wire';
-type ObjectContext = Parameters<typeof validateObjectContext>[1];
-type Signer = Parameters<typeof authorityOf>[1][number];
-export interface ReferenceTrust {
-    readonly snapshot: string;
-    readonly epoch: number;
-    readonly proofScope: string;
-    readonly policy: string;
-    readonly formImplementation: string;
-    readonly signers: readonly Signer[];
-    readonly algorithms: readonly string[];
-    readonly contracts?: {
-        readonly refusals: string;
-        readonly standing: string;
-    };
-    readonly objects: ObjectContext;
-    readonly maxBytes: number;
-    readonly maxRecords: number;
-    readonly digestBytes: (bytes: Uint8Array) => string | Promise<string>;
-    readonly verifyBytes: (bytes: string, key: string, signature: string, algorithms: readonly string[]) => boolean | Promise<boolean>;
-    readonly fetchBytes: (source: string, blob: string) => Promise<Uint8Array>;
-}
-/** Prospective authenticated-standing@1 host composition; no effects and no authority from transport. */
-export declare function inspectAuthenticatedReference(fragment: string, trust: ReferenceTrust): Promise<{
-    contracts?: {
-        refusals: string;
-        standing: string;
-    } | undefined;
-    reference: import("./reference-profile.ts").StandingReference;
-    records: readonly import("@lapxo/topos/wire").ObjectRecord[];
-    semanticIdentity: string;
-    authorityContextIdentity: string;
-    semanticStanding: string;
-    originalRecords: readonly string[];
-}>;
-export { encodeReference, decodeReference } from './reference-profile.ts';
-export { BoundRefusal, readRefusalCatalog, describeRefusal } from './refusals.ts';
-export type { RefusalEntry } from './refusals.ts';
-export { readContent, retainContent, invokeSigningPort } from '../engine/ports.ts';
-export type { PortLimits, ContentReadPort, PersistencePort, DigestPort, SigningPort, SigningLot, SignatureRecord } from '../engine/ports.ts';
+export {public4_BoundRefusal as BoundRefusal,public4_ContentReadPort as ContentReadPort,public4_DigestPort as DigestPort,public4_PersistencePort as PersistencePort,public4_PortLimits as PortLimits,public4_ReferenceTrust as ReferenceTrust,public4_RefusalEntry as RefusalEntry,public4_SignatureRecord as SignatureRecord,public4_SigningLot as SigningLot,public4_SigningPort as SigningPort,public4_decodeReference as decodeReference,public4_describeRefusal as describeRefusal,public4_encodeReference as encodeReference,public4_inspectAuthenticatedReference as inspectAuthenticatedReference,public4_invokeSigningPort as invokeSigningPort,public4_readContent as readContent,public4_readRefusalCatalog as readRefusalCatalog,public4_retainContent as retainContent} from "../public-types.js";