@lapxo/bound 0.2.3 → 0.2.5

package/dist/host/release.js

@@ -1,256 +1,4 @@
-import { ContentNeeded } from "./content-needed.js";
-import { createHash } from 'node:crypto';
-import { existsSync, lstatSync, mkdirSync, realpathSync, renameSync, rmSync, writeFileSync } from 'node:fs';
-import { dirname, join, sep } from 'node:path';
-import { canonical } from '@lapxo/topos/wire';
-import { fieldOf, isWire, isConfig } from "../fold/claims.js";
-import { archiveCoordinate, archiveDestination, members } from "./archive.js";
-import { blobAt, holdStore, landBlob, replaceWhole, storeAt } from "../land/ledger.js";
-import { coordinatesUnder, observeFile, observeText } from "../observe/files.js";
-export const laidAt = (store, digest) => storeAt(store, 'cas', 'laid', digest.replace(/^[^:]*:/, ''));
-/** A host artifact binding, not a measured ceiling or an object act. */
-export const isReleaseBinding = (line) => isConfig(line)
-    && fieldOf(line, 'scope').startsWith('dep/') && fieldOf(line, 'role') === 'reads'
-    && fieldOf(line, 'value') !== 'withdraw'
-    && (fieldOf(line, 'measure') === 'digest' || /^[a-zA-Z][a-zA-Z0-9-]*:[a-f0-9]+$/.test(fieldOf(line, 'value')));
-export const releasesOf = (lock) => lock.filter(isReleaseBinding);
-const laidMark = '.laid';
-const digestOf = (bytes) => `sha256:${createHash('sha256').update(bytes).digest('hex')}`;
-const hashed = (digest, bytes) => createHash(digest.includes(':') ? digest.slice(0, digest.indexOf(':')) : 'sha256').update(bytes).digest('hex') === digest.replace(/^[^:]*:/, '');
-const snapshotOf = (text) => text.split('\n').filter(isWire).filter((line) => fieldOf(line, 'measure') === 'digest' && fieldOf(line, 'scope').startsWith('file/'))
-    .map((line) => [fieldOf(line, 'scope').slice('file/'.length), fieldOf(line, 'value')]);
-/** Mount an explicitly declared archive coordinate; never infer a package root. */
-function mountedFiles(files, root) {
-    if (!root)
-        return files;
-    const prefix = archiveCoordinate(root) + '/';
-    if (!files.length || files.some(([name]) => !name.startsWith(prefix)))
-        throw new Error(`REFUSE·release archive root ${root} does not contain every member`);
-    return files.map(([name, digest]) => [archiveCoordinate(name.slice(prefix.length)), digest]);
-}
-function snapshotLines(files) {
-    return files.map(([coord, digest]) => canonical({
-        scope: `file/${coord}`, role: 'writes', form: 'alphabet', measure: 'digest', value: digest, at: `place:${digest}`, by: 'target',
-    })).join('\n') + (files.length ? '\n' : '');
-}
-function layDir(from, into) {
-    for (const coord of coordinatesUnder(from, from)) {
-        if (coord === laidMark)
-            continue;
-        const src = join(from, coord);
-        const dest = archiveDestination(into, coord);
-        mkdirSync(dirname(dest), { recursive: true });
-        if (existsSync(dest))
-            continue;
-        const bytes = observeFile(src);
-        if (bytes === undefined)
-            throw new Error(`REFUSE·release unreadable historical member ${coord}`);
-        writeFileSync(dest, bytes, { flag: 'wx' });
-    }
-}
-function swapPlace(place, next, digest, ready) {
-    const old = `${next}.old`;
-    if (lstatSync(old, { throwIfNoEntry: false }) !== undefined)
-        throw new Error(`REFUSE·release recovery required for ${old}`);
-    writeFileSync(join(next, laidMark), digest, { flag: 'wx' });
-    if (ready !== undefined) {
-        // Digest-addressed trees publish once. A verified concurrent winner is reused,
-        // never moved aside while another process may be importing its members.
-        if (ready()) {
-            rmSync(next, { recursive: true, force: true });
-            return;
-        }
-        try {
-            renameSync(next, place);
-            return;
-        }
-        catch (error) {
-            const code = error.code;
-            if (code !== 'EEXIST' && code !== 'ENOTEMPTY')
-                throw error;
-            if (ready()) {
-                rmSync(next, { recursive: true, force: true });
-                return;
-            }
-            // An existing invalid cache retains the repair/rollback path below.
-        }
-    }
-    let moved = false;
-    try {
-        if (lstatSync(place, { throwIfNoEntry: false }) !== undefined) {
-            renameSync(place, old);
-            moved = true;
-        }
-        renameSync(next, place);
-    }
-    catch (error) {
-        if (moved && lstatSync(place, { throwIfNoEntry: false }) === undefined)
-            renameSync(old, place);
-        throw error;
-    }
-    if (moved)
-        rmSync(old, { recursive: true, force: true });
-}
-function nextPlace(place) {
-    const next = `${place}.${process.pid}`;
-    mkdirSync(dirname(place), { recursive: true });
-    mkdirSync(next); // An abandoned staging directory is never silently reused.
-    return next;
-}
-function layFiles(store, own, files, into) {
-    const held = files.map(([coordinate, digest]) => {
-        const coord = archiveCoordinate(coordinate);
-        const dest = archiveDestination(into, coord);
-        const src = [blobAt(own, digest), blobAt(store, digest)].find(existsSync);
-        if (src === undefined)
-            throw new Error(`REFUSE·release missing blob ${digest} for ${coord}`);
-        const bytes = observeFile(src);
-        if (bytes === undefined || !hashed(digest, bytes))
-            throw new Error(`REFUSE·release blob ${digest} for ${coord} does not hold`);
-        return { dest, bytes };
-    });
-    for (const { dest, bytes } of held) {
-        mkdirSync(dirname(dest), { recursive: true });
-        // Materialized files may be edited by their consumer; never share writable inodes with the CAS.
-        writeFileSync(dest, bytes, { flag: 'wx' });
-    }
-}
-function layoutMatches(place, files) {
-    return files.every(([coord, digest]) => {
-        const path = join(place, archiveCoordinate(coord));
-        const st = lstatSync(path, { throwIfNoEntry: false });
-        const bytes = st?.isFile() ? observeFile(path) : undefined;
-        return bytes !== undefined && hashed(digest, bytes);
-    });
-}
-function sameSnapshot(actual, expected) {
-    const named = new Map(actual);
-    return named.size === actual.length && actual.length === expected.length && expected.every(([name, digest]) => named.get(name) === digest);
-}
-function keepSnapshot(store, digest, bytes) {
-    const files = members(bytes).map((one) => {
-        const file = digestOf(one.bytes);
-        landBlob(store, file, one.bytes);
-        return [one.name, file];
-    });
-    const text = snapshotLines(files);
-    replaceWhole(laidAt(store, digest), text);
-    holdStore(store, 'laid', digest, Buffer.byteLength(text));
-    return files;
-}
-/**
- * What the host does before anything runs: each release the instrument's own lock names by digest is a snapshot of
- * lines and digests, kept by digest, and the place the line needs is a materialization of verified CAS bytes. Materialized files do not share writable inodes with the store. A blob is laid only when its bytes hash to the digest that names it. What stands laid is
- * said by resolvedOf: a line for each release whose blob hashes to its name and whose place, or the cas when its line
- * needs none, holds it.
- */
-export function layReleases(store, own, lock, contentStore = own) {
-    let laid = 0;
-    for (const line of releasesOf(lock)) {
-        // A release catalog entry without a mount is materialized only when requested.
-        // Its absence must not block an unrelated place's fold.
-        const needs = fieldOf(line, 'needs');
-        if (!needs)
-            continue;
-        const digest = fieldOf(line, 'value');
-        const at = laidAt(store, digest);
-        const dir = lstatSync(at, { throwIfNoEntry: false })?.isDirectory() ?? false;
-        const bytes = observeFile(blobAt(contentStore, digest));
-        const named = digest.replace(/^[^:]*:/, '');
-        if (bytes !== undefined && !hashed(digest, bytes)) {
-            throw new Error(`REFUSE·release ${fieldOf(line, 'scope')} · blob ${named.slice(0, 12)} hashes to ${digestOf(bytes).slice(7, 19)} · not laid`);
-        }
-        if (bytes !== undefined && !dir && observeText(at) === undefined)
-            keepSnapshot(store, digest, bytes);
-        const current = observeText(at);
-        if (bytes !== undefined && current !== undefined && !dir && !sameSnapshot(snapshotOf(current), members(bytes).map((one) => [one.name, digestOf(one.bytes)])))
-            throw new Error(`REFUSE·release snapshot for ${digest} omits or changes archive members; explicit rebuild required`);
-        if (bytes === undefined && !dir && current === undefined)
-            throw new ContentNeeded(digest, `REFUSE·release ${fieldOf(line, 'scope')} has no available archive or snapshot`);
-        const root = fieldOf(line, 'shape');
-        const place = join(own, archiveCoordinate(needs));
-        const link = lstatSync(place, { throwIfNoEntry: false });
-        if (link?.isSymbolicLink() && !realpathSync(place).includes(`${sep}cas${sep}laid${sep}`))
-            continue;
-        if (dir) {
-            const files = bytes === undefined ? undefined : mountedFiles(members(bytes).map((one) => [one.name, digestOf(one.bytes)]), root);
-            if (!lstatSync(place, { throwIfNoEntry: false })?.isSymbolicLink() && observeText(join(place, laidMark)) === digest && files !== undefined && layoutMatches(place, files))
-                continue;
-            const next = nextPlace(place);
-            try {
-                layDir(root ? join(at, archiveCoordinate(root)) : at, next);
-                swapPlace(place, next, digest);
-            }
-            catch (error) {
-                rmSync(next, { recursive: true, force: true });
-                throw error;
-            }
-            laid += 1;
-            continue;
-        }
-        const snap = observeText(at);
-        if (snap === undefined)
-            throw new Error(`REFUSE·release ${fieldOf(line, 'scope')} has no available snapshot`);
-        const mounted = mountedFiles(snapshotOf(snap), root);
-        if (!lstatSync(place, { throwIfNoEntry: false })?.isSymbolicLink() && observeText(join(place, laidMark)) === digest && layoutMatches(place, mounted))
-            continue;
-        const next = nextPlace(place);
-        try {
-            layFiles(store, contentStore, mounted, next);
-            swapPlace(place, next, digest);
-        }
-        catch (error) {
-            rmSync(next, { recursive: true, force: true });
-            throw error;
-        }
-        laid += 1;
-    }
-    return laid;
-}
-export const resolvedOf = (store, own, lock, contentStore = own) => releasesOf(lock).flatMap((line) => {
-    const digest = fieldOf(line, 'value');
-    const bytes = observeFile(blobAt(contentStore, digest));
-    const ok = bytes !== undefined && hashed(digest, bytes);
-    const needs = fieldOf(line, 'needs');
-    const place = needs ? join(own, archiveCoordinate(needs)) : '';
-    const at = laidAt(store, digest);
-    const laid = needs
-        ? observeText(join(place, laidMark)) === digest || (existsSync(place) && existsSync(at) && realpathSync(place) === realpathSync(at))
-        : existsSync(at);
-    const expected = ok ? members(bytes).map((one) => [one.name, digestOf(one.bytes)]) : undefined;
-    const historicalDirectory = lstatSync(at, { throwIfNoEntry: false })?.isDirectory() === true;
-    const snapshot = observeText(at);
-    const complete = expected !== undefined && (needs
-        ? layoutMatches(place, mountedFiles(expected, fieldOf(line, 'shape')))
-        : historicalDirectory ? layoutMatches(at, expected) : snapshot !== undefined && sameSnapshot(snapshotOf(snapshot), expected));
-    return ok && laid && complete ? [canonical({ scope: `resolved/${fieldOf(line, 'scope').slice('dep/'.length)}`, role: 'writes', form: 'alphabet', measure: 'digest', value: digest, at: `place:${digest}`, by: 'target' })] : [];
-});
-/** A host loads verified release bytes from a runtime tree, never interprets a snapshot file as a directory. */
-export function runtimeTreeAt(store, own, digest, contentStore = own, root = '') {
-    const named = /^([a-zA-Z0-9-]+):([a-fA-F0-9]+)$/.exec(digest);
-    if (named === null)
-        throw new Error(`REFUSE·release invalid digest ${digest}`);
-    const bytes = observeFile(blobAt(contentStore, digest));
-    if (bytes === undefined)
-        return undefined;
-    if (!hashed(digest, bytes))
-        throw new Error(`REFUSE·release ${digest} does not name its available bytes`);
-    const files = members(bytes).map((one) => [one.name, digestOf(one.bytes)]);
-    mountedFiles(files, root); // Validate the same declared projection used for installation.
-    const place = storeAt(store, 'cas', 'runtime', named[1], named[2]);
-    const selected = root ? join(place, archiveCoordinate(root)) : place;
-    if (observeText(join(place, laidMark)) === digest && layoutMatches(place, files))
-        return selected;
-    for (const member of members(bytes))
-        landBlob(store, digestOf(member.bytes), member.bytes);
-    const next = nextPlace(place);
-    try {
-        layFiles(store, own, files, next);
-        swapPlace(place, next, digest, () => observeText(join(place, laidMark)) === digest && layoutMatches(place, files));
-    }
-    catch (error) {
-        rmSync(next, { recursive: true, force: true });
-        throw error;
-    }
-    return selected;
-}
+var te=Object.defineProperty;var l=(e,r)=>te(e,"name",{value:r,configurable:!0});import{ContentNeeded as ne}from"./content-needed.js";import{createHash as _}from"node:crypto";import{existsSync as I,lstatSync as y,mkdirSync as D,realpathSync as z,renameSync as L,rmSync as F,writeFileSync as B}from"node:fs";import{dirname as C,join as m,sep as P}from"node:path";import{library11_canonical as G}from"../vendor/runtime.js";import{fieldOf as u,isWire as oe,isConfig as se}from"../fold/claims.js";import{archiveCoordinate as w,archiveDestination as J,members as g}from"./archive.js";import{blobAt as k,holdStore as ie,landBlob as K,replaceWhole as ce,storeAt as Q}from"../land/ledger.js";import{coordinatesUnder as ae,observeFile as R,observeText as b}from"../observe/files.js";const Z=l((e,r)=>Q(e,"cas","laid",r.replace(/^[^:]*:/,"")),"laidAt"),fe=l(e=>se(e)&&u(e,"scope").startsWith("dep/")&&u(e,"role")==="reads"&&u(e,"value")!=="withdraw"&&(u(e,"measure")==="digest"||/^[a-zA-Z][a-zA-Z0-9-]*:[a-f0-9]+$/.test(u(e,"value"))),"isReleaseBinding"),V=l(e=>e.filter(fe),"releasesOf"),$=".laid",S=l(e=>`sha256:${_("sha256").update(e).digest("hex")}`,"digestOf"),A=l((e,r)=>_(e.includes(":")?e.slice(0,e.indexOf(":")):"sha256").update(r).digest("hex")===e.replace(/^[^:]*:/,""),"hashed"),j=l(e=>e.split(`
+`).filter(oe).filter(r=>u(r,"measure")==="digest"&&u(r,"scope").startsWith("file/")).map(r=>[u(r,"scope").slice(5),u(r,"value")]),"snapshotOf");function M(e,r){if(!r)return e;const t=w(r)+"/";if(!e.length||e.some(([c])=>!c.startsWith(t)))throw new Error(`REFUSE\xB7release archive root ${r} does not contain every member`);return e.map(([c,n])=>[w(c.slice(t.length)),n])}l(M,"mountedFiles");function le(e){return e.map(([r,t])=>G({scope:`file/${r}`,role:"writes",form:"alphabet",measure:"digest",value:t,at:`place:${t}`,by:"target"})).join(`
+`)+(e.length?`
+`:"")}l(le,"snapshotLines");function ue(e,r){for(const t of ae(e,e)){if(t===$)continue;const c=m(e,t),n=J(r,t);if(D(C(n),{recursive:!0}),I(n))continue;const o=R(c);if(o===void 0)throw new Error(`REFUSE\xB7release unreadable historical member ${t}`);B(n,o,{flag:"wx"})}}l(ue,"layDir");function q(e,r,t,c){const n=`${r}.old`;if(y(n,{throwIfNoEntry:!1})!==void 0)throw new Error(`REFUSE\xB7release recovery required for ${n}`);if(B(m(r,$),t,{flag:"wx"}),c!==void 0){if(c()){F(r,{recursive:!0,force:!0});return}try{L(r,e);return}catch(s){const i=s.code;if(i!=="EEXIST"&&i!=="ENOTEMPTY")throw s;if(c()){F(r,{recursive:!0,force:!0});return}}}let o=!1;try{y(e,{throwIfNoEntry:!1})!==void 0&&(L(e,n),o=!0),L(r,e)}catch(s){throw o&&y(e,{throwIfNoEntry:!1})===void 0&&L(n,e),s}o&&F(n,{recursive:!0,force:!0})}l(q,"swapPlace");function H(e){const r=`${e}.${process.pid}`;return D(C(e),{recursive:!0}),D(r),r}l(H,"nextPlace");function ee(e,r,t,c){const n=t.map(([o,s])=>{const i=w(o),f=J(c,i),d=[k(r,s),k(e,s)].find(I);if(d===void 0)throw new Error(`REFUSE\xB7release missing blob ${s} for ${i}`);const a=R(d);if(a===void 0||!A(s,a))throw new Error(`REFUSE\xB7release blob ${s} for ${i} does not hold`);return{dest:f,bytes:a}});for(const{dest:o,bytes:s}of n)D(C(o),{recursive:!0}),B(o,s,{flag:"wx"})}l(ee,"layFiles");function U(e,r){return r.every(([t,c])=>{const n=m(e,w(t)),s=y(n,{throwIfNoEntry:!1})?.isFile()?R(n):void 0;return s!==void 0&&A(c,s)})}l(U,"layoutMatches");function re(e,r){const t=new Map(e);return t.size===e.length&&e.length===r.length&&r.every(([c,n])=>t.get(c)===n)}l(re,"sameSnapshot");function de(e,r,t){const c=g(t).map(o=>{const s=S(o.bytes);return K(e,s,o.bytes),[o.name,s]}),n=le(c);return ce(Z(e,r),n),ie(e,"laid",r,Buffer.byteLength(n)),c}l(de,"keepSnapshot");function xe(e,r,t,c=r){let n=0;for(const o of V(t)){const s=u(o,"needs");if(!s)continue;const i=u(o,"value"),f=Z(e,i),d=y(f,{throwIfNoEntry:!1})?.isDirectory()??!1,a=R(k(c,i)),p=i.replace(/^[^:]*:/,"");if(a!==void 0&&!A(i,a))throw new Error(`REFUSE\xB7release ${u(o,"scope")} \xB7 blob ${p.slice(0,12)} hashes to ${S(a).slice(7,19)} \xB7 not laid`);a!==void 0&&!d&&b(f)===void 0&&de(e,i,a);const E=b(f);if(a!==void 0&&E!==void 0&&!d&&!re(j(E),g(a).map(v=>[v.name,S(v.bytes)])))throw new Error(`REFUSE\xB7release snapshot for ${i} omits or changes archive members; explicit rebuild required`);if(a===void 0&&!d&&E===void 0)throw new ne(i,`REFUSE\xB7release ${u(o,"scope")} has no available archive or snapshot`);const x=u(o,"shape"),h=m(r,w(s));if(y(h,{throwIfNoEntry:!1})?.isSymbolicLink()&&!z(h).includes(`${P}cas${P}laid${P}`))continue;if(d){const v=a===void 0?void 0:M(g(a).map(O=>[O.name,S(O.bytes)]),x);if(!y(h,{throwIfNoEntry:!1})?.isSymbolicLink()&&b(m(h,$))===i&&v!==void 0&&U(h,v))continue;const W=H(h);try{ue(x?m(f,w(x)):f,W),q(h,W,i)}catch(O){throw F(W,{recursive:!0,force:!0}),O}n+=1;continue}const N=b(f);if(N===void 0)throw new Error(`REFUSE\xB7release ${u(o,"scope")} has no available snapshot`);const Y=M(j(N),x);if(!y(h,{throwIfNoEntry:!1})?.isSymbolicLink()&&b(m(h,$))===i&&U(h,Y))continue;const T=H(h);try{ee(e,c,Y,T),q(h,T,i)}catch(v){throw F(T,{recursive:!0,force:!0}),v}n+=1}return n}l(xe,"layReleases");const Fe=l((e,r,t,c=r)=>V(t).flatMap(n=>{const o=u(n,"value"),s=R(k(c,o)),i=s!==void 0&&A(o,s),f=u(n,"needs"),d=f?m(r,w(f)):"",a=Z(e,o),p=f?b(m(d,$))===o||I(d)&&I(a)&&z(d)===z(a):I(a),E=i?g(s).map(N=>[N.name,S(N.bytes)]):void 0,x=y(a,{throwIfNoEntry:!1})?.isDirectory()===!0,h=b(a),X=E!==void 0&&(f?U(d,M(E,u(n,"shape"))):x?U(a,E):h!==void 0&&re(j(h),E));return i&&p&&X?[G({scope:`resolved/${u(n,"scope").slice(4)}`,role:"writes",form:"alphabet",measure:"digest",value:o,at:`place:${o}`,by:"target"})]:[]}),"resolvedOf");function ge(e,r,t,c=r,n=""){const o=/^([a-zA-Z0-9-]+):([a-fA-F0-9]+)$/.exec(t);if(o===null)throw new Error(`REFUSE\xB7release invalid digest ${t}`);const s=R(k(c,t));if(s===void 0)return;if(!A(t,s))throw new Error(`REFUSE\xB7release ${t} does not name its available bytes`);const i=g(s).map(p=>[p.name,S(p.bytes)]);M(i,n);const f=Q(e,"cas","runtime",o[1],o[2]),d=n?m(f,w(n)):f;if(b(m(f,$))===t&&U(f,i))return d;for(const p of g(s))K(e,S(p.bytes),p.bytes);const a=H(f);try{ee(e,r,i,a),q(f,a,t,()=>b(m(f,$))===t&&U(f,i))}catch(p){throw F(a,{recursive:!0,force:!0}),p}return d}l(ge,"runtimeTreeAt");export{fe as isReleaseBinding,Z as laidAt,xe as layReleases,V as releasesOf,Fe as resolvedOf,ge as runtimeTreeAt};

package/dist/host/root-clock-source.js

@@ -1,305 +1 @@
-import { existsSync, opendirSync, statSync } from 'node:fs';
-import { join, basename } from 'node:path';
-/** Actual stored Root cursor. Inputs are fixed host selections from admitted
- * lines, never packet epochs, receipt maxima, or caller-supplied verification. */
-import { committedLocalActs, actLines } from "./ports/local-act.js";
-import { verifiedLegacyActResult } from "../cli/act-result.js";
-import { admissionAnchor, admissionHistoryAt } from "../fold/admission-history.js";
-import { authorityFor } from "../fold/signers.js";
-import { eraOf } from "../fold/digests.js";
-import { fieldOf, foldClaims, isConfig, selfName } from "../fold/claims.js";
-import { authenticatedRootStanding } from "./admitted-place.js";
-import { verifiesOwnerLine } from "../land/sign.js";
-import { placesIn } from "../fold/places.js";
-import { appliedHistoryIn } from "../fold/signed.js";
-import { storeOf } from "../land/ledger.js";
-import { hostClockSelection } from "./place-clock-selection.js";
-import { readPlaceActContext, placeActReceiptsOf } from '@lapxo/topos/core';
-import { placeActResult, placeActHeads } from "./ports/place-act.js";
-import { rootAuthorityProtection } from "../land/act.js";
-import { readOnly } from "./read-only.js";
-const fail = (s) => { throw Error('REFUSE·Root cursor ' + s); };
-function sourceSelection(selected) {
-    const b = selected?.resources;
-    if (!b || Object.keys(b).sort().join(',') !== 'acts,bytes,lines,places' || Object.values(b).some(n => !Number.isSafeInteger(n) || n < 1) || typeof selected.selector !== 'string' || !selected.selector || typeof selected.profileSelector !== 'string' || !selected.profileSelector || !selected.bootstrapCheckpoint || Object.keys(selected.bootstrapCheckpoint).sort().join(',') !== 'measure,scope' || typeof selected.bootstrapCheckpoint.scope !== 'string' || !selected.bootstrapCheckpoint.scope || typeof selected.bootstrapCheckpoint.measure !== 'string' || !selected.bootstrapCheckpoint.measure)
-        fail('missing admitted source selection');
-    if (!selected.inherited?.clock || Object.keys(selected.inherited.clock).sort().join(',') !== 'bytes,placements,policies,proofs,records,signers' || !selected.inherited.storage || Object.keys(selected.inherited.storage).sort().join(',') !== 'acts,bytes' || [...Object.values(selected.inherited.clock), ...Object.values(selected.inherited.storage)].some(n => !Number.isSafeInteger(n) || n < 1))
-        fail('missing inherited source budgets');
-    return b;
-}
-function boundedInventory(root, selected) {
-    const b = sourceSelection(selected), store = storeOf(root);
-    let bytes = 0, files = 0, entries = 0;
-    const limit = b.acts * (b.places + 2) + b.lines;
-    if (!Number.isSafeInteger(limit))
-        fail('source file bound');
-    const visit = (path) => { if (!existsSync(path))
-        return; const s = statSync(path); if (s.isDirectory()) {
-        const directory = opendirSync(path);
-        try {
-            for (let entry = directory.readSync(); entry; entry = directory.readSync()) {
-                if (++entries > limit)
-                    fail('source entry budget');
-                if (basename(path) === 'ledger' && entry.name === 'place-acts')
-                    continue;
-                visit(join(path, entry.name));
-            }
-        }
-        finally {
-            directory.closeSync();
-        }
-    }
-    else {
-        if (!s.isFile() || ++files > limit || (bytes += s.size) > b.bytes)
-            fail('source file/byte budget');
-    } };
-    visit(join(store, 'ledger'));
-    visit(join(store, selfName() + '.keys'));
-}
-function current(root, selected) {
-    const b = sourceSelection(selected);
-    boundedInventory(root, selected);
-    const history = admissionHistoryAt(root, Number.MAX_SAFE_INTEGER);
-    if (history.length > b.lines)
-        fail('history line budget');
-    let bytes = 0;
-    for (const line of history)
-        if ((bytes += Buffer.byteLength(line)) > b.bytes)
-            fail('history byte budget');
-    const acts = committedLocalActs(storeOf(root));
-    if (acts.length > b.acts)
-        fail('act inventory budget');
-    const rooted = acts.flatMap(a => { const roots = a.bundle.placements?.filter(p => p.place === '.') ?? []; if (!roots.some(p => actLines(p.records).some(isConfig)))
-        return []; const verified = verifiedLegacyActResult(root, a.identity); return [{ ...verified, identity: a.identity, roots }]; });
-    // Comparison is over verified committed Root CONFIGURATION acts only. This
-    // is the existing local-act cursor, not a new maximum over arbitrary records.
-    rooted.sort((a, b) => a.epoch - b.epoch);
-    if (rooted.some((a, i) => i > 0 && a.epoch === rooted[i - 1].epoch && a.identity !== rooted[i - 1].identity))
-        fail('ambiguous committed Root cursor');
-    const latest = rooted.at(-1), anchor = admissionAnchor(root);
-    let checkpoint;
-    if (latest) {
-        const rows = latest.roots.flatMap(p => actLines(p.records)).filter(isConfig);
-        if (!rows.length)
-            fail('verified Root act has no configuration checkpoint');
-        checkpoint = rows[0];
-    }
-    else {
-        const rows = history.filter(l => fieldOf(l, 'scope') === selected.bootstrapCheckpoint.scope && fieldOf(l, 'measure') === selected.bootstrapCheckpoint.measure);
-        if (rows.length !== 1)
-            fail('bootstrap checkpoint missing/ambiguous');
-        checkpoint = rows[0];
-    }
-    const epoch = Number(fieldOf(checkpoint, 'epoch'));
-    if (!Number.isSafeInteger(epoch) || epoch < 0)
-        fail('unknown committed Root epoch');
-    // This synchronous observation already read the full current inventory. Select
-    // its admission prefix without opening that same inventory a second time;
-    // the next current() invocation still reads and authenticates fresh bytes.
-    const prefix = history.filter(line => !isConfig(line) || Number(fieldOf(line, 'epoch')) <= epoch), algorithms = eraOf(foldClaims(prefix.filter(l => fieldOf(l, 'scope').startsWith('wire/'))).standing).admitted;
-    const auth = authorityFor(prefix, anchor, algorithms);
-    if (auth.of(checkpoint).kind !== 'admitted')
-        fail('checkpoint is not authenticated');
-    const places = placesIn(root);
-    if (places.length > b.places)
-        fail('legacy namespace inventory budget');
-    const legacy = [...new Set([...history, ...places.flatMap(p => appliedHistoryIn(root, p))])];
-    if (legacy.length + prefix.length > b.lines || legacy.reduce((n, l) => n + Buffer.byteLength(l), 0) + prefix.reduce((n, l) => n + Buffer.byteLength(l), 0) > b.bytes)
-        fail('legacy origin inventory budget');
-    return { history: prefix, anchor, algorithms, authorityCheckpoint: checkpoint, legacyOriginals: legacy };
-}
-export function rootClockSource(root, selected) {
-    const state = current(root, selected), visiting = new Set(), cache = new Map();
-    const historical = (encoded) => {
-        const cached = cache.get(encoded);
-        if (cached)
-            return cached;
-        if (visiting.has(encoded) || visiting.size >= selected.resources.acts)
-            fail('historical predecessor cycle/budget');
-        visiting.add(encoded);
-        try {
-            const context = readPlaceActContext(encoded, selected.inherited.clock), epoch = context.root.epoch;
-            const saved = admissionHistoryAt(root, Number(epoch));
-            const rows = saved.filter(l => isConfig(l) && fieldOf(l, 'epoch') === epoch);
-            if (!rows.length)
-                fail('historical checkpoint absent');
-            // First obtain the explicitly declared historical genesis, without scanning
-            // current receiver chains. Each non-genesis predecessor is then authenticated
-            // through its stored signed receipt before supplying these HOST-only heads.
-            const basic = hostClockSelection({ ...input, history: saved, authorityCheckpoint: rows[0], legacyOriginals: saved, authenticatedReceiverHeads: [], readCurrent: () => current(root, selected) });
-            const heads = context.places.map(p => {
-                const initial = basic.trust.initialHeads.find(h => h.place === p.place);
-                if (initial?.identity === p.previous)
-                    return initial;
-                const prior = placeActResult(input.store, p.previous, { historical }, basic.selection.storageBudget);
-                if (!prior)
-                    fail('historical predecessor absent');
-                const decoded = readPlaceActContext(prior.context, selected.inherited.clock), place = decoded.places.find(one => one.place === p.place);
-                if (!place)
-                    fail('historical predecessor namespace absent');
-                return { place: p.place, identity: p.previous, epoch: place.epoch };
-            });
-            const result = hostClockSelection({ ...input, history: saved, authorityCheckpoint: rows[0], legacyOriginals: saved, authenticatedReceiverHeads: heads, readCurrent: () => current(root, selected) }).trust.contract;
-            cache.set(encoded, result);
-            return result;
-        }
-        finally {
-            visiting.delete(encoded);
-        }
-    };
-    const input = { store: storeOf(root), selector: selected.selector, profileSelector: selected.profileSelector, ...state, resources: { bytes: selected.resources.bytes, lines: selected.resources.lines, places: selected.resources.places }, inherited: selected.inherited, readCurrent: () => current(root, selected), historical };
-    const resolved = hostClockSelection(input);
-    // Host-only bytes from this exact authenticated constructor observation. This
-    // is not a retained authority cache: every constructor calls current() again.
-    const observedAnchor = Object.freeze({ ...state.anchor, coverage: Object.freeze([...state.anchor.coverage]), depth: Object.freeze({ ...state.anchor.depth }), admittedBy: Object.freeze([...state.anchor.admittedBy]) });
-    const observation = Object.freeze({ history: Object.freeze([...state.history]), anchor: observedAnchor, algorithms: Object.freeze([...state.algorithms]) });
-    return { ...resolved, observation, resources: Object.freeze({ ...selected.resources }), authority: (encoded) => { const context = readPlaceActContext(encoded, selected.inherited.clock), saved = admissionHistoryAt(root, Number(context.root.epoch)); const rows = saved.filter(l => isConfig(l) && fieldOf(l, 'epoch') === context.root.epoch); if (!rows.length)
-            fail('public historical checkpoint absent'); return { anchor: state.anchor, history: saved, checkpoint: rows[0] }; } };
-}
-/** Source mapping is an explicit Root declaration; absence never means a zero
- * clock or an inferred cursor. Existing legacy callers do not request it. */
-export function declaredRootClockSource(root) {
-    const live = authenticatedRootStanding(root), rows = live.filter(l => fieldOf(l, 'scope') === 'wire/place-act-context-source' && fieldOf(l, 'measure') === 'text' && fieldOf(l, 'value') !== 'withdraw');
-    if (rows.length !== 1)
-        fail('requires one admitted source mapping');
-    const line = rows[0], anchor = admissionAnchor(root), algorithms = eraOf(live).admitted;
-    if (fieldOf(line, 'by') !== anchor.id || fieldOf(line, 'role') !== 'writes' || fieldOf(line, 'form') !== 'alphabet' || fieldOf(line, 'value') !== 'lock' || !verifiesOwnerLine(line, anchor.publicKey, algorithms))
-        fail('mapping is not Root signed');
-    const about = fieldOf(line, 'about');
-    let value;
-    try {
-        value = JSON.parse(about);
-    }
-    catch {
-        return fail('mapping JSON invalid');
-    }
-    if (!value || Object.keys(value).sort().join(',') !== 'bootstrapCheckpoint,inherited,profile,profileSelector,resources,selector' || value.profile !== 'place-act-context@1' || JSON.stringify(value) !== about)
-        fail('unknown/noncanonical mapping');
-    return rootClockSource(root, value);
-}
-export function hasRootClockSource(root) { return authenticatedRootStanding(root).some(l => fieldOf(l, 'scope') === 'wire/place-act-context-source' && fieldOf(l, 'measure') === 'text' && fieldOf(l, 'value') !== 'withdraw'); }
-/** Historical inspection ONLY. The expected acting Root anchor and resource
- * selection come from the consumer's selected place, never from this packet.
- * This function returns data and cannot construct a current command permit. */
-export function inspectPortablePlaceContexts(encoded, expectedAnchor, selected) {
-    sourceSelection(selected);
-    if (typeof encoded !== 'string' || Buffer.byteLength(encoded) > selected.resources.bytes)
-        fail('portable byte budget');
-    let rows;
-    try {
-        rows = JSON.parse(encoded);
-    }
-    catch {
-        return fail('portable JSON');
-    }
-    if (!Array.isArray(rows) || rows.length > selected.resources.acts)
-        fail('portable context inventory budget');
-    const byId = new Map();
-    for (const row of rows) {
-        if (!row || typeof row.identity !== 'string' || typeof row.context !== 'string' || !row.authority || JSON.stringify(row.authority.anchor) !== JSON.stringify(expectedAnchor) || !Array.isArray(row.authority.history) || !Array.isArray(row.receipts) || byId.has(row.identity))
-            fail('portable anchor/shape/identity');
-        byId.set(row.identity, row);
-    }
-    const done = new Map(), visiting = new Set();
-    const inspect = (id) => {
-        const saved = done.get(id);
-        if (saved)
-            return saved;
-        const row = byId.get(id);
-        if (!row || visiting.has(id))
-            fail('portable predecessor missing/cyclic');
-        visiting.add(id);
-        try {
-            const context = readPlaceActContext(row.context, selected.inherited.clock), input = { store: '', selector: selected.selector, profileSelector: selected.profileSelector, history: row.authority.history, anchor: expectedAnchor, algorithms: eraOf(foldClaims(row.authority.history.filter(l => fieldOf(l, 'scope').startsWith('wire/'))).standing).admitted, legacyOriginals: row.authority.history, authorityCheckpoint: row.authority.checkpoint, resources: { bytes: selected.resources.bytes, lines: selected.resources.lines, places: selected.resources.places }, inherited: selected.inherited, authenticatedReceiverHeads: [], readCurrent: () => fail('portable inspection has no current Root authority'), historical: () => fail('portable inspection uses declared predecessor graph') };
-            const basic = hostClockSelection(input), heads = context.places.map(p => { const initial = basic.trust.initialHeads.find(h => h.place === p.place); if (initial?.identity === p.previous)
-                return initial; const parent = inspect(p.previous), place = parent.context.places.find(one => one.place === p.place); if (!place)
-                fail('portable predecessor namespace'); return { place: p.place, identity: p.previous, epoch: place.epoch }; });
-            const contract = hostClockSelection({ ...input, authenticatedReceiverHeads: heads }).trust.contract, result = placeActReceiptsOf(row.context, row.receipts, contract);
-            if (result.identity !== id)
-                fail('portable identity differs');
-            const value = { contract, context };
-            done.set(id, value);
-            return value;
-        }
-        finally {
-            visiting.delete(id);
-        }
-    };
-    for (const id of byId.keys())
-        inspect(id);
-    return [...done].map(([identity, value]) => ({ identity, context: value.context }));
-}
-/** Prospective configuration is checked as authenticated Root history, never
- * against a prose birth condition. Initial heads are explicit typed selections;
- * stored committed chains cannot disappear when a selection is activated or
- * replaced. Preview reads only; the real admission repeats under its Root lock. */
-export function assertProspectiveRootClockSelection(root, signed) {
-    const sourceScope = 'wire/place-act-context-source';
-    const before = admissionHistoryAt(root, Number.MAX_SAFE_INTEGER);
-    const selectors = [sourceScope, 'wire/place-act-context-selection', 'wire/place-act-context'];
-    // Ordinary lots need no clock projection, including bootstrap before an
-    // admission anchor exists. Raw stored delivery is not authenticated claims.
-    if (!before.some(l => fieldOf(l, 'scope') === sourceScope) && !signed.some(l => selectors.includes(fieldOf(l, 'scope'))))
-        return;
-    const oldLive = authenticatedRootStanding(root).filter(l => fieldOf(l, 'value') !== 'withdraw');
-    const oldMapping = oldLive.find(l => fieldOf(l, 'scope') === sourceScope && fieldOf(l, 'measure') === 'text');
-    if (oldMapping) {
-        const anchor = admissionAnchor(root), algorithms = eraOf(oldLive.filter(l => fieldOf(l, 'scope').startsWith('wire/'))).admitted;
-        if (fieldOf(oldMapping, 'by') !== anchor.id || !verifiesOwnerLine(oldMapping, anchor.publicKey, algorithms))
-            fail('existing source mapping is not Root signed');
-        let old;
-        try {
-            old = JSON.parse(fieldOf(oldMapping, 'about'));
-        }
-        catch {
-            return fail('existing source mapping JSON invalid');
-        }
-        selectors.push(old.selector, old.profileSelector);
-    }
-    if (!signed.some(l => selectors.includes(fieldOf(l, 'scope'))))
-        return;
-    if (signed.every(line => before.includes(line)))
-        return;
-    const store = storeOf(root);
-    if (!readOnly())
-        rootAuthorityProtection(store);
-    const history = [...new Set([...before, ...signed])], live = foldClaims([...oldLive, ...signed].filter(isConfig)).standing.filter(l => fieldOf(l, 'value') !== 'withdraw'), rows = live.filter(l => fieldOf(l, 'scope') === sourceScope && fieldOf(l, 'measure') === 'text');
-    if (!rows.length) {
-        if (signed.some(l => fieldOf(l, 'scope') === sourceScope && fieldOf(l, 'value') === 'withdraw'))
-            return;
-        return fail('activation requires source and selection together');
-    }
-    if (rows.length !== 1)
-        fail('prospective source mapping ambiguous');
-    const line = rows[0], anchor = admissionAnchor(root), algorithms = eraOf(live.filter(l => fieldOf(l, 'scope').startsWith('wire/'))).admitted;
-    if (fieldOf(line, 'by') !== anchor.id || fieldOf(line, 'role') !== 'writes' || fieldOf(line, 'form') !== 'alphabet' || fieldOf(line, 'value') !== 'lock' || !verifiesOwnerLine(line, anchor.publicKey, algorithms))
-        fail('prospective mapping is not Root signed');
-    const about = fieldOf(line, 'about');
-    let selected;
-    try {
-        selected = JSON.parse(about);
-    }
-    catch {
-        return fail('prospective source mapping JSON invalid');
-    }
-    if (!selected || Object.keys(selected).sort().join(',') !== 'bootstrapCheckpoint,inherited,profile,profileSelector,resources,selector' || selected.profile !== 'place-act-context@1' || JSON.stringify(selected) !== about)
-        fail('unsupported prospective source mapping');
-    sourceSelection(selected);
-    const positive = (scope, measure) => signed.filter(l => fieldOf(l, 'scope') === scope && fieldOf(l, 'measure') === measure && fieldOf(l, 'value') !== 'withdraw');
-    if (!oldMapping && (positive(sourceScope, 'text').length !== 1 || positive(selected.selector, 'text').length !== 1))
-        fail('activation requires source and selection together');
-    const checkpoint = signed.filter(isConfig).at(-1) ?? fail('prospective authority checkpoint absent');
-    if (!oldMapping && positive(selected.bootstrapCheckpoint.scope, selected.bootstrapCheckpoint.measure).length !== 1)
-        fail('initial authority checkpoint must land with selection');
-    const old = oldMapping ? declaredRootClockSource(root) : undefined;
-    const actualLegacy = [...new Set([...before, ...placesIn(root).flatMap(place => appliedHistoryIn(root, place))])];
-    const observed = { history, anchor, algorithms, authorityCheckpoint: checkpoint, legacyOriginals: actualLegacy };
-    const resolved = hostClockSelection({ store, selector: selected.selector, profileSelector: selected.profileSelector, ...observed, resources: { bytes: selected.resources.bytes, lines: selected.resources.lines, places: selected.resources.places }, inherited: selected.inherited, readCurrent: () => observed, historical: encoded => { if (!old)
-            return fail('committed receiver history precedes initial selection'); return old.trust.historical(encoded); } });
-    const heads = placeActHeads(store, resolved.trust.initialHeads, resolved.trust, resolved.selection.storageBudget), expected = old ? old.trust.current().heads : resolved.trust.initialHeads;
-    for (const head of expected) {
-        const actual = heads.find(one => one.place === head.place);
-        if (!actual || actual.identity !== head.identity || actual.epoch !== head.epoch)
-            fail('prospective selection resets committed receiver ' + head.place);
-    }
-}
+var D=Object.defineProperty;var y=(e,t)=>D(e,"name",{value:t,configurable:!0});import{existsSync as U,opendirSync as Q,statSync as V}from"node:fs";import{join as _,basename as Y}from"node:path";import{committedLocalActs as Z,actLines as K}from"./ports/local-act.js";import{verifiedLegacyActResult as $}from"../cli/act-result.js";import{admissionAnchor as I,admissionHistoryAt as L}from"../fold/admission-history.js";import{authorityFor as ee}from"../fold/signers.js";import{signatureEraOf as H}from"./signature-era.js";import{fieldOf as i,foldClaims as F,isConfig as A,selfName as te}from"../fold/claims.js";import{authenticatedRootStanding as W}from"./admitted-place.js";import{verifiesOwnerLine as q}from"../land/sign.js";import{placesIn as G}from"../fold/places.js";import{appliedHistoryIn as T}from"../fold/signed.js";import{storeOf as M}from"../land/ledger.js";import{hostClockSelection as J}from"./place-clock-selection.js";import{library3_readPlaceActContext as B,library3_placeActReceiptsOf as re}from"../vendor/runtime.js";import{placeActResult as oe,placeActHeads as ie}from"./ports/place-act.js";import{rootAuthorityProtection as se}from"../land/act.js";import{readOnly as ce}from"./read-only.js";const o=y(e=>{throw Error("REFUSE\xB7Root cursor "+e)},"fail");function z(e){const t=e?.resources;return(!t||Object.keys(t).sort().join(",")!=="acts,bytes,lines,places"||Object.values(t).some(r=>!Number.isSafeInteger(r)||r<1)||typeof e.selector!="string"||!e.selector||typeof e.profileSelector!="string"||!e.profileSelector||!e.bootstrapCheckpoint||Object.keys(e.bootstrapCheckpoint).sort().join(",")!=="measure,scope"||typeof e.bootstrapCheckpoint.scope!="string"||!e.bootstrapCheckpoint.scope||typeof e.bootstrapCheckpoint.measure!="string"||!e.bootstrapCheckpoint.measure)&&o("missing admitted source selection"),(!e.inherited?.clock||Object.keys(e.inherited.clock).sort().join(",")!=="bytes,placements,policies,proofs,records,signers"||!e.inherited.storage||Object.keys(e.inherited.storage).sort().join(",")!=="acts,bytes"||[...Object.values(e.inherited.clock),...Object.values(e.inherited.storage)].some(r=>!Number.isSafeInteger(r)||r<1))&&o("missing inherited source budgets"),t}y(z,"sourceSelection");function ne(e,t){const r=z(t),p=M(e);let k=0,g=0,a=0;const b=r.acts*(r.places+2)+r.lines;Number.isSafeInteger(b)||o("source file bound");const n=y(d=>{if(!U(d))return;const l=V(d);if(l.isDirectory()){const f=Q(d);try{for(let m=f.readSync();m;m=f.readSync())++a>b&&o("source entry budget"),!(Y(d)==="ledger"&&m.name==="place-acts")&&n(_(d,m.name))}finally{f.closeSync()}}else(!l.isFile()||++g>b||(k+=l.size)>r.bytes)&&o("source file/byte budget")},"visit");n(_(p,"ledger")),n(_(p,te()+".keys"))}y(ne,"boundedInventory");function P(e,t){const r=z(t);ne(e,t);const p=L(e,Number.MAX_SAFE_INTEGER);p.length>r.lines&&o("history line budget");let k=0;for(const c of p)(k+=Buffer.byteLength(c))>r.bytes&&o("history byte budget");const g=Z(M(e));g.length>r.acts&&o("act inventory budget");const a=g.flatMap(c=>{const h=c.bundle.placements?.filter(v=>v.place===".")??[];return h.some(v=>K(v.records).some(A))?[{...$(e,c.identity),identity:c.identity,roots:h}]:[]});a.sort((c,h)=>c.epoch-h.epoch),a.some((c,h)=>h>0&&c.epoch===a[h-1].epoch&&c.identity!==a[h-1].identity)&&o("ambiguous committed Root cursor");const b=a.at(-1),n=I(e);let d;if(b){const c=b.roots.flatMap(h=>K(h.records)).filter(A);c.length||o("verified Root act has no configuration checkpoint"),d=c[0]}else{const c=p.filter(h=>i(h,"scope")===t.bootstrapCheckpoint.scope&&i(h,"measure")===t.bootstrapCheckpoint.measure);c.length!==1&&o("bootstrap checkpoint missing/ambiguous"),d=c[0]}const l=Number(i(d,"epoch"));(!Number.isSafeInteger(l)||l<0)&&o("unknown committed Root epoch");const f=p.filter(c=>!A(c)||Number(i(c,"epoch"))<=l),m=H(F(f.filter(c=>i(c,"scope").startsWith("wire/"))).standing).admitted;ee(f,n,m).of(d).kind!=="admitted"&&o("checkpoint is not authenticated");const w=G(e);w.length>r.places&&o("legacy namespace inventory budget");const u=[...new Set([...p,...w.flatMap(c=>T(e,c))])];return(u.length+f.length>r.lines||u.reduce((c,h)=>c+Buffer.byteLength(h),0)+f.reduce((c,h)=>c+Buffer.byteLength(h),0)>r.bytes)&&o("legacy origin inventory budget"),{history:f,anchor:n,algorithms:m,authorityCheckpoint:d,legacyOriginals:u}}y(P,"current");function ae(e,t){const r=P(e,t),p=new Set,k=new Map,g=y(l=>{const f=k.get(l);if(f)return f;(p.has(l)||p.size>=t.resources.acts)&&o("historical predecessor cycle/budget"),p.add(l);try{const m=B(l,t.inherited.clock),O=m.root.epoch,w=L(e,Number(O)),u=w.filter(v=>A(v)&&i(v,"epoch")===O);u.length||o("historical checkpoint absent");const c=J({...a,history:w,authorityCheckpoint:u[0],legacyOriginals:w,authenticatedReceiverHeads:[],readCurrent:y(()=>P(e,t),"readCurrent")}),h=m.places.map(v=>{const N=c.trust.initialHeads.find(s=>s.place===v.place);if(N?.identity===v.previous)return N;const x=oe(a.store,v.previous,{historical:g},c.selection.storageBudget);x||o("historical predecessor absent");const j=B(x.context,t.inherited.clock),E=j.places.find(s=>s.place===v.place);return E||o("historical predecessor namespace absent"),{place:v.place,identity:v.previous,epoch:E.epoch}}),S=J({...a,history:w,authorityCheckpoint:u[0],legacyOriginals:w,authenticatedReceiverHeads:h,readCurrent:y(()=>P(e,t),"readCurrent")}).trust.contract;return k.set(l,S),S}finally{p.delete(l)}},"historical"),a={store:M(e),selector:t.selector,profileSelector:t.profileSelector,...r,resources:{bytes:t.resources.bytes,lines:t.resources.lines,places:t.resources.places},inherited:t.inherited,readCurrent:y(()=>P(e,t),"readCurrent"),historical:g},b=J(a),n=Object.freeze({...r.anchor,coverage:Object.freeze([...r.anchor.coverage]),depth:Object.freeze({...r.anchor.depth}),admittedBy:Object.freeze([...r.anchor.admittedBy])}),d=Object.freeze({history:Object.freeze([...r.history]),anchor:n,algorithms:Object.freeze([...r.algorithms])});return{...b,observation:d,resources:Object.freeze({...t.resources}),authority:y(l=>{const f=B(l,t.inherited.clock),m=L(e,Number(f.root.epoch)),O=m.filter(w=>A(w)&&i(w,"epoch")===f.root.epoch);return O.length||o("public historical checkpoint absent"),{anchor:r.anchor,history:m,checkpoint:O[0]}},"authority")}}y(ae,"rootClockSource");function pe(e,t){const r=e.filter(b=>i(b,"scope")==="wire/place-act-context-source"&&i(b,"measure")==="text"&&i(b,"value")!=="withdraw");r.length!==1&&o("requires one admitted source mapping");const p=r[0],k=H(e).admitted;(i(p,"by")!==t.id||i(p,"role")!=="writes"||i(p,"form")!=="alphabet"||i(p,"value")!=="lock"||!q(p,t.publicKey,k))&&o("mapping is not Root signed");const g=i(p,"about");let a;try{a=JSON.parse(g)}catch{return o("mapping JSON invalid")}return(!a||Object.keys(a).sort().join(",")!=="bootstrapCheckpoint,inherited,profile,profileSelector,resources,selector"||a.profile!=="place-act-context@1"||JSON.stringify(a)!==g)&&o("unknown/noncanonical mapping"),z(a),a}y(pe,"rootClockSelectionOf");function le(e){return ae(e,pe(W(e),I(e)))}y(le,"declaredRootClockSource");function Je(e){return W(e).some(t=>i(t,"scope")==="wire/place-act-context-source"&&i(t,"measure")==="text"&&i(t,"value")!=="withdraw")}y(Je,"hasRootClockSource");function He(e,t,r){z(r),(typeof e!="string"||Buffer.byteLength(e)>r.resources.bytes)&&o("portable byte budget");let p;try{p=JSON.parse(e)}catch{return o("portable JSON")}(!Array.isArray(p)||p.length>r.resources.acts)&&o("portable context inventory budget");const k=new Map;for(const n of p)(!n||typeof n.identity!="string"||typeof n.context!="string"||!n.authority||JSON.stringify(n.authority.anchor)!==JSON.stringify(t)||!Array.isArray(n.authority.history)||!Array.isArray(n.receipts)||k.has(n.identity))&&o("portable anchor/shape/identity"),k.set(n.identity,n);const g=new Map,a=new Set,b=y(n=>{const d=g.get(n);if(d)return d;const l=k.get(n);(!l||a.has(n))&&o("portable predecessor missing/cyclic"),a.add(n);try{const f=B(l.context,r.inherited.clock),m={store:"",selector:r.selector,profileSelector:r.profileSelector,history:l.authority.history,anchor:t,algorithms:H(F(l.authority.history.filter(S=>i(S,"scope").startsWith("wire/"))).standing).admitted,legacyOriginals:l.authority.history,authorityCheckpoint:l.authority.checkpoint,resources:{bytes:r.resources.bytes,lines:r.resources.lines,places:r.resources.places},inherited:r.inherited,authenticatedReceiverHeads:[],readCurrent:y(()=>o("portable inspection has no current Root authority"),"readCurrent"),historical:y(()=>o("portable inspection uses declared predecessor graph"),"historical")},O=J(m),w=f.places.map(S=>{const v=O.trust.initialHeads.find(j=>j.place===S.place);if(v?.identity===S.previous)return v;const N=b(S.previous),x=N.context.places.find(j=>j.place===S.place);return x||o("portable predecessor namespace"),{place:S.place,identity:S.previous,epoch:x.epoch}}),u=J({...m,authenticatedReceiverHeads:w}).trust.contract;re(l.context,l.receipts,u).identity!==n&&o("portable identity differs");const h={contract:u,context:f};return g.set(n,h),h}finally{a.delete(n)}},"inspect");for(const n of k.keys())b(n);return[...g].map(([n,d])=>({identity:n,context:d.context}))}y(He,"inspectPortablePlaceContexts");function ze(e,t){const r="wire/place-act-context-source",p=L(e,Number.MAX_SAFE_INTEGER),k=[r,"wire/place-act-context-selection","wire/place-act-context"];if(!p.some(s=>i(s,"scope")===r)&&!t.some(s=>k.includes(i(s,"scope"))))return;const g=W(e).filter(s=>i(s,"value")!=="withdraw"),a=g.find(s=>i(s,"scope")===r&&i(s,"measure")==="text");if(a){const s=I(e),R=H(g.filter(X=>i(X,"scope").startsWith("wire/"))).admitted;(i(a,"by")!==s.id||!q(a,s.publicKey,R))&&o("existing source mapping is not Root signed");let C;try{C=JSON.parse(i(a,"about"))}catch{return o("existing source mapping JSON invalid")}k.push(C.selector,C.profileSelector)}if(!t.some(s=>k.includes(i(s,"scope")))||t.every(s=>p.includes(s)))return;const b=M(e);ce()||se(b);const n=[...new Set([...p,...t])],d=F([...g,...t].filter(A)).standing.filter(s=>i(s,"value")!=="withdraw"),l=d.filter(s=>i(s,"scope")===r&&i(s,"measure")==="text");if(!l.length)return t.some(s=>i(s,"scope")===r&&i(s,"value")==="withdraw")?void 0:o("activation requires source and selection together");l.length!==1&&o("prospective source mapping ambiguous");const f=l[0],m=I(e),O=H(d.filter(s=>i(s,"scope").startsWith("wire/"))).admitted;(i(f,"by")!==m.id||i(f,"role")!=="writes"||i(f,"form")!=="alphabet"||i(f,"value")!=="lock"||!q(f,m.publicKey,O))&&o("prospective mapping is not Root signed");const w=i(f,"about");let u;try{u=JSON.parse(w)}catch{return o("prospective source mapping JSON invalid")}(!u||Object.keys(u).sort().join(",")!=="bootstrapCheckpoint,inherited,profile,profileSelector,resources,selector"||u.profile!=="place-act-context@1"||JSON.stringify(u)!==w)&&o("unsupported prospective source mapping"),z(u);const c=y((s,R)=>t.filter(C=>i(C,"scope")===s&&i(C,"measure")===R&&i(C,"value")!=="withdraw"),"positive");!a&&(c(r,"text").length!==1||c(u.selector,"text").length!==1)&&o("activation requires source and selection together");const h=t.filter(A).at(-1)??o("prospective authority checkpoint absent");!a&&c(u.bootstrapCheckpoint.scope,u.bootstrapCheckpoint.measure).length!==1&&o("initial authority checkpoint must land with selection");const S=a?le(e):void 0,v=[...new Set([...p,...G(e).flatMap(s=>T(e,s))])],N={history:n,anchor:m,algorithms:O,authorityCheckpoint:h,legacyOriginals:v},x=J({store:b,selector:u.selector,profileSelector:u.profileSelector,...N,resources:{bytes:u.resources.bytes,lines:u.resources.lines,places:u.resources.places},inherited:u.inherited,readCurrent:y(()=>N,"readCurrent"),historical:y(s=>S?S.trust.historical(s):o("committed receiver history precedes initial selection"),"historical")}),j=ie(b,x.trust.initialHeads,x.trust,x.selection.storageBudget),E=S?S.trust.current().heads:x.trust.initialHeads;for(const s of E){const R=j.find(C=>C.place===s.place);(!R||R.identity!==s.identity||R.epoch!==s.epoch)&&o("prospective selection resets committed receiver "+s.place)}}y(ze,"assertProspectiveRootClockSelection");export{ze as assertProspectiveRootClockSelection,le as declaredRootClockSource,Je as hasRootClockSource,He as inspectPortablePlaceContexts,pe as rootClockSelectionOf,ae as rootClockSource};