@lapxo/bound 0.2.3 → 0.2.5

package/dist/host/selected-capsules.js

@@ -1,50 +1 @@
-import { capsuleAt } from "./capsule.js";
-import { capsuleOffers, providerInputs, providerInputRegions, capsuleDescriptor, assertCapsuleDescriptor } from '@lapxo/topos/standing';
-import { fullDigest } from "./digest.js";
-import { wireAt, parse } from '@lapxo/topos/wire';
-import { selectedTopoi, toposAt } from "./selected-topos.js";
-import { canonical } from '@lapxo/topos/wire';
-import { fieldOf } from "../fold/claims.js";
-import { ownLock } from "../observe/runner.js";
-import { archiveCoordinate } from "./archive.js";
-/** Only explicit capsule offers request execution. Forms/classes/views do not need an executable alias. */
-export function selectedCapsules(pins, resolve = capsuleAt, select = toposAt, host = ownLock()) {
-    return selectedTopoi(pins, select).flatMap(({ digest, topos }) => capsuleOffers(topos).map(offer => {
-        const load = () => {
-            const projections = host.filter(line => fieldOf(line, 'scope').startsWith('dep/') && fieldOf(line, 'role') === 'writes' && fieldOf(line, 'value') === offer.value);
-            if (!projections.length || projections.some(line => !fieldOf(line, 'shape')))
-                throw Error(`REFUSE·pin ${digest} capsule ${offer.value} needs one host projection`);
-            const entries = [...new Set(projections.map(line => archiveCoordinate(fieldOf(line, 'shape'))))];
-            if (entries.length !== 1)
-                throw Error(`REFUSE·pin ${digest} capsule ${offer.value} has conflicting host projections`);
-            const loaded = resolve(offer.value, entries[0]);
-            if (loaded === undefined)
-                throw Error(`REFUSE·pin ${digest} · ${offer.scope} · offered capsule ${offer.value} unavailable`);
-            return { capsule: loaded, offer: canonical({ ...offer, shape: entries[0] }) };
-        };
-        const descriptor = capsuleDescriptor(topos, offer.scope ?? '');
-        const loaded = descriptor === undefined ? load() : undefined;
-        const supplied = loaded === undefined ? {
-            digest: offer.value, selection: `${digest} ${offer.scope}`, ...descriptor, ask: (requests, reader) => {
-                if (!requests.length)
-                    return [];
-                const actual = load();
-                assertCapsuleDescriptor(descriptor.lines, actual.capsule.lines);
-                return actual.capsule.ask(requests, reader);
-            },
-        } : { ...loaded.capsule, selection: `${digest} ${offer.scope}` };
-        const capsule = { ...supplied, selectedWorld: { standing: topos, offer: offer.scope ?? '' } };
-        const projected = loaded?.offer ?? canonical(offer);
-        if (!providerInputRegions(topos, offer.scope ?? '').length)
-            return { capsule, offer: projected };
-        const fields = ownLock().flatMap(line => { const p = parse(line); return p.kind === 'fact' ? [p.value.fields] : []; });
-        const wire = wireAt(fields, Number.MAX_SAFE_INTEGER), algorithm = wire && [...wire.digests][0];
-        if (!algorithm)
-            throw Error('REFUSE·input instrument has no admitted digest algorithm');
-        const selected = { ...capsule, selection: `${digest} ${offer.scope}`, ask: (requests, reader) => capsule.ask(requests.map(request => {
-                const provider = providerInputs(topos, digest, offer.scope ?? '', offer.value, request.region ?? '', bytes => fullDigest(bytes, algorithm));
-                return provider === undefined ? request : { ...request, provider };
-            }), reader) };
-        return { capsule: selected, offer: projected };
-    }));
-}
+var R=Object.defineProperty;var n=(l,c)=>R(l,"name",{value:c,configurable:!0});import{capsuleAt as k}from"./capsule.js";import{library7_capsuleOffers as A,library7_providerInputs as S,library7_providerInputRegions as D,library7_capsuleDescriptor as F,library7_assertCapsuleDescriptor as I}from"../vendor/runtime.js";import{fullDigest as j}from"./digest.js";import{library11_wireAt as C,library11_parse as U}from"../vendor/runtime.js";import{selectedTopoi as M,toposAt as O}from"./selected-topos.js";import{library11_canonical as $}from"../vendor/runtime.js";import{fieldOf as p}from"../fold/claims.js";import{ownLock as b}from"../observe/runner.js";import{archiveCoordinate as N}from"./archive.js";function Q(l,c=k,w=O,_=b()){return M(l,w).flatMap(({digest:o,topos:i})=>A(i).map(e=>{const h=n(()=>{const r=_.filter(t=>p(t,"scope").startsWith("dep/")&&p(t,"role")==="writes"&&p(t,"value")===e.value);if(!r.length||r.some(t=>!p(t,"shape")))throw Error(`REFUSE\xB7pin ${o} capsule ${e.value} needs one host projection`);const s=[...new Set(r.map(t=>N(p(t,"shape"))))];if(s.length!==1)throw Error(`REFUSE\xB7pin ${o} capsule ${e.value} has conflicting host projections`);const a=c(e.value,s[0]);if(a===void 0)throw Error(`REFUSE\xB7pin ${o} \xB7 ${e.scope} \xB7 offered capsule ${e.value} unavailable`);return{capsule:a,offer:$({...e,shape:s[0]})}},"load"),u=F(i,e.scope??""),d=u===void 0?h():void 0,m={...d===void 0?{digest:e.value,selection:`${o} ${e.scope}`,...u,ask:n((r,s)=>{if(!r.length)return[];const a=h();return I(u.lines,a.capsule.lines),a.capsule.ask(r,s)},"ask")}:{...d.capsule,selection:`${o} ${e.scope}`},selectedWorld:{standing:i,offer:e.scope??""}},v=d?.offer??$(e);if(!D(i,e.scope??"").length)return{capsule:m,offer:v};const g=b().flatMap(r=>{const s=U(r);return s.kind==="fact"?[s.value.fields]:[]}),f=C(g,Number.MAX_SAFE_INTEGER),E=f&&[...f.digests][0];if(!E)throw Error("REFUSE\xB7input instrument has no admitted digest algorithm");return{capsule:{...m,selection:`${o} ${e.scope}`,ask:n((r,s)=>m.ask(r.map(a=>{const t=S(i,o,e.scope??"",e.value,a.region??"",y=>j(y,E));return t===void 0?a:{...a,provider:t}}),s),"ask")},offer:v}}))}n(Q,"selectedCapsules");export{Q as selectedCapsules};

package/dist/host/selected-topos.js

@@ -1,80 +1 @@
-import { verifiedContent } from "./content-store.js";
-import { readStanding } from '@lapxo/topos/standing';
-import { parse, wireAt, fromLine } from '@lapxo/topos/wire';
-import { fieldOf } from "../fold/claims.js";
-import { moduleClosure } from "./native/module-closure.js";
-import { sha256, isSha256 } from "./hash.js";
-/** Local grammar is sufficient for locally declared records. Resolve selected
- * contracts only when a reader is missing; a local refusal remains a refusal. */
-export function admittedLine(line, local, epoch, pins, resolve = toposAt) {
-    const own = wireAt(local, epoch);
-    // A signature era alone is not a configuration grammar. An absent list
-    // must be supplied by the selected contract; an explicit local list remains
-    // authoritative and may refuse a field without opening unrelated content.
-    if (own && ['fields', 'required', 'roles', 'forms', 'at-classes'].every(name => own.lists.has(name))) {
-        const got = fromLine(line, own);
-        const needsObject = fieldOf(line, 'type') !== '' && !own.object;
-        if (got.kind === 'fact' || (got.kind === 'refuse' && !needsObject))
-            return got;
-    }
-    return fromLine(line, selectedWireAt(local, epoch, pins, resolve));
-}
-/** Resolve content using the instrument wire's admitted digest algorithms. No transport interpretation. */
-export function toposAt(digest, store) {
-    const topos = readStanding(Buffer.from(contentAt(digest, store)).toString('utf8'));
-    return topos;
-}
-export function contentAt(digest, store) {
-    return verifiedContent(digest, store).bytes;
-}
-/** The declared module runs from the store that supplied its verified bytes. No copy or live-checkout fallback. */
-export function contextModuleAt(digest, store, dependencies) {
-    if (dependencies !== undefined) {
-        if (!isSha256(digest) || !dependencies.includes(digest) || dependencies.some(pin => !isSha256(pin)))
-            throw Error('REFUSE·context module closure requires declared SHA-256 members');
-        const pins = [...new Set(dependencies)].sort(), members = new Map(pins.map(pin => [pin.slice(pin.indexOf(':') + 1), { digest: pin, source: new TextDecoder('utf-8', { fatal: true }).decode(contentAt(pin, store)) }]));
-        moduleClosure({ identity: sha256(JSON.stringify(pins)), entry: digest.slice(digest.indexOf(':') + 1), members }, () => undefined);
-    }
-    return verifiedContent(digest, store).path;
-}
-/** Selection verifies standing identity. Requested capabilities verify their artifact bytes separately. */
-export function selectedTopoi(pins, resolve = toposAt) {
-    return [...new Set(pins.map(pin => fieldOf(pin, 'value')))].map(digest => ({ digest, topos: resolve(digest) }));
-}
-/** Read a declared wire list without copying a world's claims or executing its offers.
- * Independent declarations must agree; selection order cannot choose a contract.
- */
-export function selectedWireList(local, epoch, pins, list, resolve = toposAt) {
-    const records = local.flatMap(line => { const got = parse(line); return got.kind === 'fact' ? [got.value.fields] : []; });
-    const contracts = [{ name: 'place', wire: wireAt(records, epoch) }, ...selectedTopoi(pins, resolve).map(({ digest, topos }) => ({ name: digest, wire: wireAt(topos.parts, Number.MAX_SAFE_INTEGER) }))]
-        .flatMap(({ name, wire }) => { const words = wire?.lists.get(list); return words === undefined ? [] : [{ name, words: [...words] }]; });
-    if (!contracts.length)
-        throw Error(`REFUSE·wire wire/${list} has no declared contract in the place or its selected topoi`);
-    const first = contracts[0];
-    if (contracts.some(({ words }) => words.length !== first.words.length || words.some(word => !first.words.includes(word))))
-        throw Error(`REFUSE·wire wire/${list} has conflicting contracts · ${contracts.map(one => one.name).join(' · ')}`);
-    return first.words;
-}
-/** Complete an admission snapshot from the selected standing. Local declarations
- * govern their own lists; independent selected contracts cannot choose by order. */
-export function selectedWireAt(local, epoch, pins, resolve = toposAt) {
-    const own = wireAt(local, epoch);
-    const worlds = selectedTopoi(pins, resolve).map(({ digest, topos }) => ({ digest, parts: topos.parts, wire: wireAt(topos.parts, Number.MAX_SAFE_INTEGER) }));
-    const key = (scope) => scope.startsWith('wire/') ? scope.slice(5) : scope.startsWith('audit/wire/') ? scope.slice(11) : undefined;
-    const declared = new Set(local.filter(f => Number(f.epoch ?? 0) <= epoch).map(f => key(f.scope ?? '')).filter((k) => k !== undefined));
-    const selected = new Map();
-    for (const world of worlds)
-        for (const f of world.parts) {
-            const name = key(f.scope ?? '');
-            if (name === undefined || declared.has(name))
-                continue;
-            const list = world.wire?.lists.get(name);
-            const value = list ? [...list].sort().join('|') : f.value ?? '';
-            const previous = selected.get(name);
-            if (previous && previous.value !== value)
-                throw Error(`REFUSE·wire wire/${name} has conflicting selected contracts · ${previous.digest} · ${world.digest}`);
-            if (!previous)
-                selected.set(name, { value, fields: f, digest: world.digest });
-        }
-    return selected.size ? wireAt([...selected.values()].map(one => one.fields).concat(local), epoch) : own;
-}
+var b=Object.defineProperty;var a=(t,r)=>b(t,"name",{value:r,configurable:!0});import{verifiedContent as S}from"./content-store.js";import{library7_readStanding as O}from"../vendor/runtime.js";import{library11_parse as F,library11_wireAt as m,library11_fromLine as g}from"../vendor/runtime.js";import{fieldOf as x}from"../fold/claims.js";import{moduleClosure as M}from"./native/module-closure.js";import{sha256 as N,isSha256 as y}from"./hash.js";function J(t,r,o,s,f=p){const n=m(r,o);if(n&&["fields","required","roles","forms","at-classes"].every(i=>n.lists.has(i))){const i=g(t,n),u=x(t,"type")!==""&&!n.object;if(i.kind==="fact"||i.kind==="refuse"&&!u)return i}return g(t,_(r,o,s,f))}a(J,"admittedLine");function p(t,r){return O(Buffer.from(v(t,r)).toString("utf8"))}a(p,"toposAt");function v(t,r){return S(t,r).bytes}a(v,"contentAt");function R(t,r,o){if(!Array.isArray(o)||!y(t)||!o.includes(t)||o.some(n=>!y(n)))throw Error("REFUSE\xB7context module closure requires declared SHA-256 members");const s=[...new Set(o)].sort(),f=new Map(s.map(n=>[n.slice(n.indexOf(":")+1),{digest:n,source:new TextDecoder("utf-8",{fatal:!0}).decode(v(n,r))}]));return M({identity:N(JSON.stringify(s)),entry:t.slice(t.indexOf(":")+1),members:f},()=>{},{esmOnly:!0}),S(t,r).path}a(R,"contextModuleAt");function q(t){const r=new Map;return{topos:a(o=>{const s=p(o,t);for(const f of s.parts.filter(n=>n.kind==="check"&&n.value)){const n=[...new Set((f.restsOn??"").split("|").filter(Boolean))].sort(),i=r.get(f.value);if(i&&JSON.stringify(i)!==JSON.stringify(n))throw Error("REFUSE\xB7context module has conflicting declared closures");r.set(f.value,n)}return s},"topos"),module:a(o=>{const s=r.get(o);if(s===void 0)throw Error("REFUSE\xB7context module has no declared closure");return R(o,t,s)},"module")}}a(q,"contextProviderServices");function A(t,r=p){return[...new Set(t.map(o=>x(o,"value")))].map(o=>({digest:o,topos:r(o)}))}a(A,"selectedTopoi");function B(t,r,o,s,f=p){const n=t.flatMap(c=>{const e=F(c);return e.kind==="fact"?[e.value.fields]:[]}),i=[{name:"place",wire:m(n,r)},...A(o,f).map(({digest:c,topos:e})=>({name:c,wire:m(e.parts,Number.MAX_SAFE_INTEGER)}))].flatMap(({name:c,wire:e})=>{const d=e?.lists.get(s);return d===void 0?[]:[{name:c,words:[...d]}]});if(!i.length)throw Error(`REFUSE\xB7wire wire/${s} has no declared contract in the place or its selected topoi`);const u=i[0];if(i.some(({words:c})=>c.length!==u.words.length||c.some(e=>!u.words.includes(e))))throw Error(`REFUSE\xB7wire wire/${s} has conflicting contracts \xB7 ${i.map(c=>c.name).join(" \xB7 ")}`);return u.words}a(B,"selectedWireList");function _(t,r,o,s=p){const f=m(t,r),n=A(o,s).map(({digest:e,topos:d})=>({digest:e,parts:d.parts,wire:m(d.parts,Number.MAX_SAFE_INTEGER)})),i=a(e=>e.startsWith("wire/")?e.slice(5):e.startsWith("audit/wire/")?e.slice(11):void 0,"key"),u=new Set(t.filter(e=>Number(e.epoch??0)<=r).map(e=>i(e.scope??"")).filter(e=>e!==void 0)),c=new Map;for(const e of n)for(const d of e.parts){const l=i(d.scope??"");if(l===void 0||u.has(l))continue;const E=e.wire?.lists.get(l),h=E?[...E].sort().join("|"):d.value??"",w=c.get(l);if(w&&w.value!==h)throw Error(`REFUSE\xB7wire wire/${l} has conflicting selected contracts \xB7 ${w.digest} \xB7 ${e.digest}`);w||c.set(l,{value:h,fields:d,digest:e.digest})}return c.size?m([...c.values()].map(e=>e.fields).concat(t),r):f}a(_,"selectedWireAt");export{J as admittedLine,v as contentAt,R as contextModuleAt,q as contextProviderServices,A as selectedTopoi,_ as selectedWireAt,B as selectedWireList,p as toposAt};

package/dist/host/signature-era.js

@@ -0,0 +1 @@
+var s=Object.defineProperty;var d=(e,n)=>s(e,"name",{value:n,configurable:!0});import{wireLine as a}from"../fold/wire.js";import{fieldOf as f}from"../fold/claims.js";function m(e){const n=a(e,"signature-algorithms"),i=(n===void 0?[]:f(n,"value").split("|")).filter(Boolean),t=a(e,"era"),o=(t===void 0?void 0:i.find(r=>r.endsWith(`:${f(t,"value")}`)))??i.find(r=>r.includes(":"));if(o===void 0)throw new Error("REFUSE\xB7runtime the lock names no signature algorithm by digest: nothing can be signed here");return{admitted:i,era:o}}d(m,"signatureEraOf");export{m as signatureEraOf};

package/dist/host/signing.js

@@ -1,48 +1,2 @@
-import { invokeSigningPort } from "../engine/ports.js";
-import { readFileSync } from 'node:fs';
-import { parse, signerSelection, signerRequestBytes, signerResponseBytes, signerResponseOf } from '@lapxo/topos/wire';
-import { invokeSigner, SigningFailure } from "./ports/signing.js";
-/** An explicitly supplied host registry; a repository cannot supply executable bindings. */
-function binding(name, keyFile) {
-    if (name === 'file') {
-        if (!keyFile)
-            throw new SigningFailure('REFUSE·signer file needs --key-file');
-        return { kind: 'file', path: keyFile };
-    }
-    if (keyFile)
-        throw new SigningFailure('REFUSE·signer command cannot use --key-file');
-    const path = process.env['BOUND_SIGNERS'];
-    if (!path)
-        throw new SigningFailure('REFUSE·signer no host binding registry');
-    try {
-        const registry = JSON.parse(readFileSync(path, 'utf8'));
-        if (!registry || typeof registry !== 'object' || !Object.prototype.hasOwnProperty.call(registry, name))
-            throw Error();
-        const record = registry[name];
-        if (!record || typeof record !== 'object')
-            throw Error();
-        const f = record;
-        if (f['kind'] !== 'command' || typeof f['executable'] !== 'string' || !f['executable']
-            || !Array.isArray(f['args']) || !f['args'].every(a => typeof a === 'string'))
-            throw Error();
-        return { kind: 'command', executable: f['executable'], args: f['args'] };
-    }
-    catch {
-        throw new SigningFailure('REFUSE·signer host binding unavailable or invalid');
-    }
-}
-/** Resolve data before acquisition; all mechanisms use one wire protocol and verification path. */
-export function signerFor(lines, keyId, selected, keyFile, injected) {
-    const fields = lines.flatMap(line => { const got = parse(line); return got.kind === 'fact' ? [got.value.fields] : []; });
-    const declaration = signerSelection(fields, keyId);
-    if (selected !== undefined && selected !== declaration.name)
-        throw new SigningFailure(`REFUSE·signer ${keyId} CLI selection conflicts with declaration`);
-    if (injected) {
-        if (injected.name !== declaration.name || keyFile)
-            throw new SigningFailure('REFUSE·signer injected host binding conflicts with declaration or key file');
-        return (lot) => invokeSigningPort(lot, injected.sign, { timeoutMs: declaration.timeoutMs, maxBytes: declaration.responseBytes });
-    }
-    const mechanism = binding(declaration.name, keyFile);
-    const protocol = { request: signerRequestBytes, response: signerResponseBytes, reply: signerResponseOf };
-    return (lot) => invokeSigner(lot, mechanism, protocol, declaration);
-}
+var d=Object.defineProperty;var a=(t,n)=>d(t,"name",{value:n,configurable:!0});import{invokeSigningPort as h}from"../engine/ports.js";import{readFileSync as w}from"node:fs";import{library11_parse as S,library11_signerSelection as b,library11_signerRequestBytes as E,library11_signerResponseBytes as l,library11_signerResponseOf as p}from"../vendor/runtime.js";import{invokeSigner as u,SigningFailure as c}from"./ports/signing.js";function y(t,n){if(t==="file"){if(!n)throw new c("REFUSE\xB7signer file needs --key-file");return{kind:"file",path:n}}if(n)throw new c("REFUSE\xB7signer command cannot use --key-file");const o=process.env.BOUND_SIGNERS;if(!o)throw new c("REFUSE\xB7signer no host binding registry");try{const i=JSON.parse(w(o,"utf8"));if(!i||typeof i!="object"||!Object.prototype.hasOwnProperty.call(i,t))throw Error();const r=i[t];if(!r||typeof r!="object")throw Error();const e=r;if(e.kind!=="command"||typeof e.executable!="string"||!e.executable||!Array.isArray(e.args)||!e.args.every(s=>typeof s=="string"))throw Error();return{kind:"command",executable:e.executable,args:e.args}}catch{throw new c("REFUSE\xB7signer host binding unavailable or invalid")}}a(y,"binding");function m(t,n,o){const i=t.flatMap(e=>{const s=S(e);return s.kind==="fact"?[s.value.fields]:[]}),r=b(i,n);if(o!==void 0&&o!==r.name)throw new c(`REFUSE\xB7signer ${n} CLI selection conflicts with declaration`);return r}a(m,"declaredSigner");function O(t,n,o,i,r){const e=m(t,n,o);if(r){if(r.name!==e.name||i)throw new c("REFUSE\xB7signer injected host binding conflicts with declaration or key file");return g=>h(g,r.sign,{timeoutMs:e.timeoutMs,maxBytes:e.responseBytes},r.signal)}const s=y(e.name,i),f={request:E,response:l,reply:p};return g=>u(g,s,f,e)}a(O,"signerFor");function U(t,n,o,i){const r=m(t,n,o),e=y(r.name,i),s={request:a(f=>JSON.stringify(f)+`
+`,"request"),response:l,reply:p};return f=>u(f,e,s,r)}a(U,"frameSignerFor");export{U as frameSignerFor,O as signerFor};

package/dist/host/source-content.js

@@ -1,110 +1,2 @@
-import { transportBytes } from "./ports/transport.js";
-import { contentStore, verifiedContent } from "./content-store.js";
-import { ContentNeeded } from "./content-needed.js";
-import { createHash } from 'node:crypto';
-import { parse, wireAt } from '@lapxo/topos/wire';
-import { landBlob } from "../land/ledger.js";
-import { ownLock } from "../observe/runner.js";
-/** Transport uses declared locations; only the requested digest admits bytes into the cache. */
-export async function resolveSelectedContent(lines, port, requested) {
-    const fields = lines.flatMap(line => { const p = parse(line); return p.kind === 'fact' && p.value.fields.value !== 'withdraw' ? [p.value.fields] : []; });
-    const selectionIndex = (scope) => { const match = /(^|\/)uses\//.exec(scope); return match === null ? -1 : match.index + match[1].length; };
-    // A dependency constraint is not a content binding. Historical artifact records
-    // use measure=id; explicit digest records still validate even when malformed.
-    const bindings = fields.filter(f => selectionIndex(f.scope ?? '') >= 0 ||
-        (f.scope?.startsWith('dep/') && (f.measure === 'digest' || /^[a-zA-Z][a-zA-Z0-9-]*:[a-f0-9]+$/.test(f.value ?? ''))));
-    const locations = new Map();
-    for (const binding of bindings) {
-        const scope = binding.scope ?? '';
-        const index = selectionIndex(scope);
-        const sourceScope = index >= 0 ? scope.slice(0, index) + 'sources/' + scope.slice(index + 5) : 'sources/' + scope.slice(4);
-        const urls = fields.filter(f => f.scope === sourceScope).map(f => f.value ?? '');
-        if (urls.length)
-            locations.set(binding.value ?? '', [...new Set([...(locations.get(binding.value ?? '') ?? []), ...urls])]);
-    }
-    const received = [];
-    const validate = (digest) => {
-        const split = digest.indexOf(':');
-        const algorithm = digest.slice(0, split), hex = digest.slice(split + 1);
-        if (split < 1 || !port.algorithms.has(algorithm) || !/^[a-f0-9]+$/.test(hex))
-            throw Error(`REFUSE·pin ${digest} digest is not admitted`);
-        return { algorithm, hex };
-    };
-    const ensure = async (digest) => {
-        const { algorithm, hex } = validate(digest);
-        const verify = (bytes) => {
-            if (createHash(algorithm).update(bytes).digest('hex') !== hex)
-                throw Error(`REFUSE·pin ${digest} content hash mismatch · not laid`);
-            return bytes;
-        };
-        const cached = port.read(digest);
-        if (cached !== undefined)
-            return verify(cached);
-        const urls = locations.get(digest) ?? [];
-        if (!urls.length)
-            throw Error(`REFUSE·pin ${digest} content unavailable · no declared source · not laid`);
-        let last;
-        for (const url of urls) {
-            let bytes;
-            try {
-                bytes = await port.fetch(url, digest);
-            }
-            catch (error) {
-                last = error;
-                continue;
-            }
-            verify(bytes);
-            port.write(digest, bytes);
-            received.push(digest);
-            return bytes;
-        }
-        throw Error(`REFUSE·source ${digest} ${last instanceof Error ? last.message : 'declared sources unavailable'}`);
-    };
-    for (const digest of new Set(requested))
-        await ensure(digest);
-    return received;
-}
-/** Exact resource URLs; no repository checkout or inferred release. */
-export async function resolveSources(standing, requested) {
-    const instrument = ownLock().flatMap(line => { const p = parse(line); return p.kind === 'fact' ? [p.value.fields] : []; });
-    const wire = wireAt(instrument, Number.MAX_SAFE_INTEGER);
-    if (wire === null)
-        throw Error('REFUSE·pin instrument has no admitted wire');
-    const bindings = ownLock().filter(line => {
-        const p = parse(line);
-        if (p.kind !== 'fact')
-            return false;
-        const fields = p.value.fields;
-        return fields.scope?.startsWith('sources/') || fields.scope?.startsWith('dep/');
-    });
-    const received = await resolveSelectedContent([...standing, ...bindings], {
-        algorithms: wire.digests,
-        read: digest => { try {
-            return verifiedContent(digest).bytes;
-        }
-        catch (error) {
-            if (error instanceof ContentNeeded)
-                return undefined;
-            throw error;
-        } },
-        write: (digest, bytes) => { landBlob(contentStore(), digest, bytes); },
-        fetch: async (url, digest) => transportBytes(url, digest, [...ownLock(), ...standing]),
-    }, requested);
-    for (const digest of received)
-        process.stdout.write(`FETCHED  ${digest} · verified\n`);
-}
-/** A changed verified store is the only reason to retry. A repeated miss never loops or changes a named pin. */
-export async function resolveRequested(resolve, fold) {
-    const attempted = new Set();
-    for (;;) {
-        try {
-            return await fold();
-        }
-        catch (error) {
-            if (!(error instanceof ContentNeeded) || attempted.has(error.digest))
-                throw error;
-            attempted.add(error.digest);
-            await resolve(error.digest);
-        }
-    }
-}
+var $=Object.defineProperty;var s=(c,i)=>$(c,"name",{value:i,configurable:!0});import{hostOutput as F}from"./call-context.js";import{transportBytes as R}from"./ports/transport.js";import{contentStore as A,verifiedContent as U}from"./content-store.js";import{ContentNeeded as x}from"./content-needed.js";import{createHash as k}from"node:crypto";import{library11_parse as y,library11_wireAt as C}from"../vendor/runtime.js";import{landBlob as M}from"../land/ledger.js";import{ownLock as S}from"../observe/runner.js";async function _(c,i,u){const n=c.flatMap(e=>{const t=y(e);return t.kind==="fact"&&t.value.fields.value!=="withdraw"?[t.value.fields]:[]}),h=s(e=>{const t=/(^|\/)uses\//.exec(e);return t===null?-1:t.index+t[1].length},"selectionIndex"),E=n.filter(e=>h(e.scope??"")>=0||e.scope?.startsWith("dep/")&&(e.measure==="digest"||/^[a-zA-Z][a-zA-Z0-9-]*:[a-f0-9]+$/.test(e.value??""))),r=new Map;for(const e of E){const t=e.scope??"",a=h(t),l=a>=0?t.slice(0,a)+"sources/"+t.slice(a+5):"sources/"+t.slice(4),d=n.filter(f=>f.scope===l).map(f=>f.value??"");d.length&&r.set(e.value??"",[...new Set([...r.get(e.value??"")??[],...d])])}const o=[],p=s(e=>{const t=e.indexOf(":"),a=e.slice(0,t),l=e.slice(t+1);if(t<1||!i.algorithms.has(a)||!/^[a-f0-9]+$/.test(l))throw Error(`REFUSE\xB7pin ${e} digest is not admitted`);return{algorithm:a,hex:l}},"validate"),b=s(async e=>{const{algorithm:t,hex:a}=p(e),l=s(m=>{if(k(t).update(m).digest("hex")!==a)throw Error(`REFUSE\xB7pin ${e} content hash mismatch \xB7 not laid`);return m},"verify"),d=i.read(e);if(d!==void 0)return l(d);const f=r.get(e)??[];if(!f.length)throw Error(`REFUSE\xB7pin ${e} content unavailable \xB7 no declared source \xB7 not laid`);let v;for(const m of f){let w;try{w=await i.fetch(m,e)}catch(g){v=g;continue}return l(w),i.write(e,w),o.push(e),w}throw Error(`REFUSE\xB7source ${e} ${v instanceof Error?v.message:"declared sources unavailable"}`)},"ensure");for(const e of new Set(u))await b(e);return o}s(_,"resolveSelectedContent");async function q(c,i){const u=S().flatMap(r=>{const o=y(r);return o.kind==="fact"?[o.value.fields]:[]}),n=C(u,Number.MAX_SAFE_INTEGER);if(n===null)throw Error("REFUSE\xB7pin instrument has no admitted wire");const h=S().filter(r=>{const o=y(r);if(o.kind!=="fact")return!1;const p=o.value.fields;return p.scope?.startsWith("sources/")||p.scope?.startsWith("dep/")}),E=await _([...c,...h],{algorithms:n.digests,read:s(r=>{try{return U(r).bytes}catch(o){if(o instanceof x)return;throw o}},"read"),write:s((r,o)=>{M(A(),r,o)},"write"),fetch:s(async(r,o)=>R(r,o,[...S(),...c]),"fetch")},i);for(const r of E)F("out",`FETCHED  ${r} \xB7 verified
+`)}s(q,"resolveSources");async function D(c,i){const u=new Set;for(;;)try{return await i()}catch(n){if(!(n instanceof x)||u.has(n.digest))throw n;u.add(n.digest),await c(n.digest)}}s(D,"resolveRequested");export{D as resolveRequested,_ as resolveSelectedContent,q as resolveSources};

package/dist/host/standing-carrier.js

@@ -0,0 +1 @@
+var y=Object.defineProperty;var l=(n,a)=>y(n,"name",{value:a,configurable:!0});import{library3_PLACE_ACT_CONTEXT as u}from"../vendor/runtime.js";import{foldClaims as p,fieldOf as d}from"../fold/claims.js";function h(n,a,r,f){const o=new Map;for(const e of r){const t=f.find(s=>s.identity===e.identity).context;for(const s of t.places){const i=JSON.stringify([t.root.namespace,s.place]),c=o.get(i)??{namespace:t.root.namespace,place:s.place,lines:[],contexts:[]};c.lines.push(...s.records),c.contexts.push({identity:e.identity,context:e.context,receipts:e.receipts}),o.set(i,c)}}const m=a.map(e=>({namespace:"legacy-global",place:e.place,standing:p(e.history).standing.filter(t=>d(t,"value")!=="withdraw"),history:e.history}));return{profile:u,root:n,legacyPlaces:m,contexts:r,places:[...o.values()].map(e=>{const t=p(e.lines);return{namespace:e.namespace,place:e.place,standing:t.standing.filter(s=>d(s,"value")!=="withdraw"),retracted:t.retracted,superseded:t.superseded,forks:t.forks,contexts:e.contexts}})}}l(h,"projectContextualStanding");export{h as projectContextualStanding};

package/dist/host/standing-projection.js

@@ -0,0 +1 @@
+var w=Object.defineProperty;var e=(i,t)=>w(i,"name",{value:t,configurable:!0});import{viewsOf as h}from"../fold/views.js";import{BoundRefusal as v}from"./refusals.js";import{authorityFor as b}from"../fold/signers.js";import{signatureEraOf as E}from"./signature-era.js";import{fieldOf as a,foldClaims as p,isConfig as u}from"../fold/claims.js";import{library2_foldedEvidence as S}from"../vendor/runtime.js";function x(i,t){const n=new Map,m=i.filter(o=>{const d=Number(a(o,"epoch"))||0;let r=n.get(d);if(!r){const f=i.filter(s=>!u(s)||Number(a(s,"epoch"))<=d),g=f.filter(s=>{const c=a(s,"scope");return c.startsWith("wire/")||c.startsWith("audit/wire/")});r=b(f,t,E(p(g).standing).admitted),n.set(d,r)}return r.of(o).kind==="admitted"}),{standing:l}=S(m,{classification:e(()=>"local","classification"),fold:e(o=>p(o).standing,"fold")});return[...l]}e(x,"projectAuthenticatedStanding");function k(i){const t=h(i).get("standing");if(!t||t.shape||!t.regions.some(n=>n.name==="standing"))throw new v("standing/view","REFUSE\xB7view standing requires a declared standing view")}e(k,"assertStandingView");function q(i,t){return O(x(i,t))}e(q,"publicStandingProjection");function O(i){return i.filter(t=>!u(t)||a(t,"value")!=="withdraw")}e(O,"publishedStandingLines");export{k as assertStandingView,x as projectAuthenticatedStanding,q as publicStandingProjection,O as publishedStandingLines};

package/dist/host/timing.js

@@ -1,7 +1 @@
-/** Record completed synchronous host work without changing its result or refusal. */
-export const timing = (spent) => (what, fn) => {
-    const at = Date.now();
-    const got = fn();
-    spent.push(`${what} ${Date.now() - at}`);
-    return got;
-};
+var c=Object.defineProperty;var o=(t,n)=>c(t,"name",{value:n,configurable:!0});const g=o(t=>(n,e)=>{const s=Date.now(),a=e();return t.push(`${n} ${Date.now()-s}`),a},"timing");export{g as timing};

package/dist/host/walk.js

@@ -1,193 +1,20 @@
-import { walkProjection, walkAt, walkSnapshot, walkHeaders, readWalkHeaders, readForeignWalk, walkAuthority, walkOrigin, walkInventory, walkSelection, isWalkHeader } from '@lapxo/topos/walk';
-import { canonical, parse, fromLine, wireAt, matches, objectHistory, validateObjectContext } from '@lapxo/topos/wire';
-import { objectProvider } from '@lapxo/topos/object-provider';
-import { standingBytes } from '@lapxo/topos/standing';
-import { fieldOf } from "../fold/claims.js";
-import { lockStanding, lockLines } from "../fold/keys.js";
-import { authorityFor, rootSigner } from "../fold/signers.js";
-import { publicKeyOf } from "../fold/signers.js";
-import { signaturesOf } from "../fold/digests.js";
-import { fullDigest } from "./digest.js";
-import { toposAt, contextModuleAt } from "./selected-topos.js";
-import { signerFor } from "./signing.js";
-import { signConsentLot, verifiesFields } from "../land/sign.js";
-import { storeOf } from "../land/ledger.js";
-import { signedOwnerLines, epochOf, localActLines, ownerOf } from "../cli/owner.js";
-import { commitIngress, ingressBundles, ingressCost } from "./ports/ingress.js";
-const refuse = (why) => { throw Error('REFUSE·walk ' + why); };
-const fields = (line) => { const p = parse(line); if (p.kind !== 'fact')
-    return refuse('not a wire line'); return p.value.fields; };
-const one = (lines, scope, measure) => {
-    const rows = lines.filter(line => fieldOf(line, 'scope') === scope && fieldOf(line, 'measure') === measure && fieldOf(line, 'value') !== 'withdraw');
-    if (rows.length !== 1)
-        return refuse('missing or conflicting ' + scope + ' ' + measure);
-    return fieldOf(rows[0], 'value');
-};
-function policy(root) {
-    const store = storeOf(root), standing = lockStanding(store), contract = walkSelection(standing);
-    const view = one(standing, 'view/walk', 'id');
-    if (view !== 'walk@*')
-        refuse('view/walk must declare walk@*');
-    const masks = standing.filter(line => fieldOf(line, 'scope') === 'view/walk').flatMap(line => fieldOf(line, 'needs').split('|')).filter(Boolean);
-    if (!masks.length)
-        refuse('view/walk has no declared history inputs');
-    const wire = wireAt(standing.map(fields), Number.MAX_SAFE_INTEGER), algorithm = wire?.digests.values().next().value;
-    if (!algorithm)
-        refuse('no admitted digest algorithm');
-    return { store, standing, contract, masks, digest: (bytes) => fullDigest(bytes, algorithm) };
-}
-function context(root, pin, own = false) {
-    const p = policy(root);
-    if (!own && !p.standing.some(line => fieldOf(line, 'scope').startsWith('uses/') && fieldOf(line, 'value') === pin))
-        refuse('origin context is not selected by digest');
-    const topos = toposAt(pin, p.store), authority = walkAuthority(topos.parts, verifiesFields);
-    const configuration = topos.parts.map(f => canonical({ ...f, by: 'target', epoch: '0' }));
-    return { pin, topos, authority, configuration, origin: walkOrigin(topos.parts), contract: walkSelection(topos.lines) };
-}
-function local(root) {
-    const p = policy(root), authority = authorityFor(lockLines(p.store), rootSigner(root), signaturesOf(p.store).admitted);
-    const history = signedOwnerLines(p.store).filter(line => p.masks.some(mask => matches(mask, fieldOf(line, 'scope'))));
-    if (history.some(line => authority.of(line).kind !== 'admitted'))
-        refuse('local history is not authenticated');
-    const selected = context(root, one(p.standing, 'walk/context', 'digest'), true);
-    return walkSnapshot(history, selected.contract.fields, p.digest, selected.origin, selected.contract.partition);
-}
-const headerInfo = (lines) => {
-    const roots = lines.filter(line => isWalkHeader(line) && fieldOf(line, 'scope') === 'walk/root');
-    if (roots.length !== 1)
-        return refuse('one signed root is required');
-    const at = fieldOf(roots[0], 'at');
-    if (!at.startsWith('receipt:'))
-        return refuse('root has no declared context');
-    return { pin: at.slice(8), base: fieldOf(roots[0], 'condition') };
-};
-async function validateHistory(root, selected, history) {
-    if (!selected.authority.authenticate(history))
-        refuse('origin history is not authenticated');
-    for (const line of history) {
-        const f = fields(line), decoded = fromLine(line, wireAt(selected.topos.parts, Number(f.epoch)));
-        if (decoded.kind !== 'fact')
-            refuse('origin wire ' + decoded.why);
-    }
-    const decoded = objectHistory([...selected.configuration, ...history]);
-    if (decoded.kind !== 'fact')
-        return refuse('origin history ' + decoded.why);
-    if (!decoded.value.objects.length)
-        return;
-    const pinned = new Set(selected.topos.lines);
-    const admit = (f) => Boolean(f.sig) ? selected.authority.of(canonical(f)).kind === 'admitted' : pinned.has(standingBytes([canonical(f)]).trim());
-    const provider = await objectProvider(decoded.value.objects, decoded.value.configuration, { admit, emit: () => { }, topos: pin => toposAt(pin, storeOf(root)), module: pin => contextModuleAt(pin, storeOf(root)) });
-    const checked = validateObjectContext(decoded.value.objects, provider);
-    if (checked.kind !== 'fact')
-        refuse('origin context ' + checked.why);
-}
-async function readBundle(root, bundle, earlier = []) {
-    const lines = bundle.evidence.split('\n').filter(Boolean), info = headerInfo(lines), p = policy(root);
-    const receipts = bundle.receipt.split('\n').filter(Boolean), authority = authorityFor(lockLines(p.store), rootSigner(root), signaturesOf(p.store).admitted);
-    if (receipts.length !== 1 || fieldOf(receipts[0], 'scope') !== 'receipts' || fieldOf(receipts[0], 'role') !== 'writes' || fieldOf(receipts[0], 'form') !== 'alphabet' || fieldOf(receipts[0], 'measure') !== 'digest' || fieldOf(receipts[0], 'at') !== 'receipt:' + info.pin || authority.of(receipts[0]).kind !== 'admitted')
-        refuse('retained import receipt is not authenticated');
-    const selected = context(root, info.pin);
-    const got = readForeignWalk(lines, { origin: selected.origin, regionOrigin: selected.origin, context: info.pin, base: info.base, fields: selected.contract.fields, partition: selected.contract.partition, digest: p.digest, previousPrefixes: [], authenticatePrefix: selected.authority.authenticate, authenticateEvidence: selected.authority.authenticate, validateOriginHistory: () => true });
-    if (fieldOf(receipts[0], 'value') !== got.identity)
-        refuse('retained import receipt does not authenticate this ingress');
-    await validateHistory(root, selected, [...new Set([...earlier, ...got.records])]);
-    return { ...got, context: info.pin, regions: walkSnapshot(got.records, selected.contract.fields, p.digest, got.origin, selected.contract.partition).regions };
-}
-async function verifiedIngress(root) {
-    const result = [], history = new Map();
-    const bundles = [...ingressBundles(storeOf(root))].sort((a, b) => epochOf(a.receipt.split('\n')) - epochOf(b.receipt.split('\n')));
-    for (const bundle of bundles) {
-        const info = headerInfo(bundle.evidence.split('\n').filter(Boolean)), origin = context(root, info.pin).origin;
-        if (result.some(prior => prior.origin === origin && prior.context !== info.pin))
-            refuse('origin context changed without declared lineage');
-        const prior = history.get(origin) ?? new Set();
-        const got = await readBundle(root, bundle, [...prior]);
-        for (const line of got.records)
-            prior.add(line);
-        history.set(origin, prior);
-        result.push(got);
-    }
-    return result;
-}
-async function inventory(root) {
-    const p = policy(root), regions = new Map(local(root).regions.map(region => [region.scope, region]));
-    for (const got of (await verifiedIngress(root)).sort((a, b) => a.senderEpoch - b.senderEpoch))
-        for (const region of got.regions)
-            regions.set(region.scope, region);
-    return walkInventory([[...regions.values()]], p.digest, context(root, one(p.standing, 'walk/context', 'digest'), true).contract.partition);
-}
-/** Verified foreign histories stay separate from the local authority and local epoch inputs. */
-export async function foreignWalkLines(root) {
-    const verified = await verifiedIngress(root);
-    return [...new Set(verified.flatMap(got => got.records))];
-}
-/** A declared origin exports its own signed history. Foreign packets are retained with their contexts, never re-signed as local history. */
-export async function renderWalk(root, resolution, peer, key, keyFile, signer) {
-    const p = policy(root), pin = one(p.standing, 'walk/context', 'digest'), selected = context(root, pin, true), own = local(root);
-    const known = peer.length ? (() => { const info = headerInfo(peer), remote = context(root, info.pin); return readWalkHeaders(peer, info.pin, info.base, remote.authority.authenticate); })() : walkSnapshot([], p.contract.fields, p.digest);
-    const projection = walkProjection(selected.contract.projections, resolution);
-    const ownInventory = projection === 'history' ? own : await inventory(root);
-    const selectedPacket = walkAt(ownInventory, known, resolution, selected.contract.projections), by = key ?? ownerOf(p.store), publicKey = publicKeyOf(root, by);
-    if (!publicKey)
-        refuse('unknown local signer ' + by);
-    const drafted = walkHeaders(selectedPacket, pin, known.root, projection !== 'inventory'), epoch = epochOf(localActLines(root));
-    const got = await signConsentLot(drafted, { by, epoch, algorithm: signaturesOf(p.store).era }, publicKey, signaturesOf(p.store).admitted, signerFor(p.standing, by, signer, keyFile));
-    if (got.kind !== 'fact')
-        return refuse(got.why);
-    if (!selected.authority.authenticate(got.lines) || !selected.authority.authenticate(selectedPacket.records))
-        refuse('local context does not authenticate exported history');
-    return [...got.lines, ...selectedPacket.records, `EXCHANGE ${selectedPacket.touched} touched regions · ${selectedPacket.open} open regions · ${Buffer.byteLength(selectedPacket.records.join('\n') + (selectedPacket.records.length ? '\n' : ''))} payload bytes`];
-}
-/** The SDK proves the foreign prefix; the host admits the pair at one publication point. */
-export async function landWalk(root, lines, key, keyFile, signer) {
-    const p = policy(root), info = headerInfo(lines), selected = context(root, info.pin);
-    const retained = await verifiedIngress(root);
-    if (retained.some(prior => prior.origin === selected.origin && prior.context !== info.pin))
-        refuse('origin context changed without declared lineage');
-    const previous = (verified) => { const prefixes = new Map(); for (const prior of verified.filter(got => got.origin === selected.origin).sort((a, b) => a.senderEpoch - b.senderEpoch))
-        for (const region of prior.regions)
-            prefixes.set(region.scope, { ...region, senderEpoch: prior.senderEpoch }); return [...prefixes.values()]; };
-    const payload = lines.filter(line => !isWalkHeader(line));
-    const proof = (prefixes) => readForeignWalk(lines, { origin: selected.origin, regionOrigin: selected.origin, context: info.pin, base: info.base, fields: selected.contract.fields, partition: selected.contract.partition, digest: p.digest, previousPrefixes: prefixes, authenticatePrefix: selected.authority.authenticate, authenticateEvidence: selected.authority.authenticate, validateOriginHistory: () => true });
-    const raw = proof([]), known = retained.find(prior => prior.identity === raw.identity), got = known ? raw : proof(previous(retained));
-    const history = (prior) => [...new Set([...prior.filter(item => item.origin === selected.origin).flatMap(item => item.records), ...payload])];
-    await validateHistory(root, selected, history(retained));
-    if (!known && info.base !== (await inventory(root)).root)
-        refuse('stale receiver base');
-    if (!payload.length && !readWalkHeaders(lines, info.pin, info.base, selected.authority.authenticate).regions.length)
-        return ['ONCE 0 new evidence lines · 0 import receipts · no regions offered', `EXCHANGE 0 payload bytes · ${Buffer.byteLength(lines.join('\n') + '\n')} protocol bytes · 0 new evidence bytes · 0 new receipt bytes`];
-    const by = key ?? ownerOf(p.store), pub = publicKeyOf(root, by);
-    if (!pub)
-        refuse('unknown receiver signer ' + by);
-    const result = await commitIngress(p.store, got.identity, async () => {
-        if (info.base !== (await inventory(root)).root)
-            refuse('receiver changed before ingress');
-        const current = await verifiedIngress(root);
-        proof(previous(current));
-        await validateHistory(root, selected, history(current));
-        const next = epochOf(localActLines(root)) + 1;
-        const signed = await signConsentLot([got.importReceiptProposal], { by, epoch: next, algorithm: signaturesOf(p.store).era }, pub, signaturesOf(p.store).admitted, signerFor(p.standing, by, signer, keyFile));
-        if (signed.kind !== 'fact')
-            return refuse(signed.why);
-        const authority = authorityFor(lockLines(p.store), rootSigner(root), signaturesOf(p.store).admitted);
-        if (authority.of(signed.lines[0]).kind !== 'admitted')
-            refuse('receiver signer does not cover the import receipt');
-        const grammar = fromLine(signed.lines[0], wireAt(p.standing.map(fields), next));
-        if (grammar.kind !== 'fact')
-            refuse('receiver receipt wire ' + grammar.why);
-        return { evidence: lines.join('\n') + '\n', receipt: signed.lines.join('\n') + '\n' };
-    }, bundle => {
-        try {
-            const retainedLines = bundle.evidence.split('\n').filter(Boolean), retainedInfo = headerInfo(retainedLines);
-            if (retainedInfo.pin !== info.pin)
-                return false;
-            const retainedProof = readForeignWalk(retainedLines, { origin: selected.origin, regionOrigin: selected.origin, context: info.pin, base: retainedInfo.base, fields: selected.contract.fields, partition: selected.contract.partition, digest: p.digest, previousPrefixes: [], authenticatePrefix: selected.authority.authenticate, authenticateEvidence: selected.authority.authenticate, validateOriginHistory: () => true });
-            const receipts = bundle.receipt.split('\n').filter(Boolean), receipt = receipts[0] ?? '';
-            return receipts.length === 1 && retainedProof.identity === got.identity && fieldOf(receipt, 'scope') === 'receipts' && fieldOf(receipt, 'value') === got.identity && fieldOf(receipt, 'at') === 'receipt:' + info.pin && authorityFor(lockLines(p.store), rootSigner(root), signaturesOf(p.store).admitted).of(receipt).kind === 'admitted';
-        }
-        catch {
-            return false;
-        }
-    });
-    return [`${result.kind === 'once' ? 'ONCE' : 'INGRESS'} ${result.kind === 'once' ? 0 : got.records.length} new evidence lines · 1 ${result.kind === 'once' ? 'retained' : 'signed local'} import receipt`, result.receipt.trim(), ingressCost(result, Buffer.byteLength(payload.join('\n') + (payload.length ? '\n' : '')), Buffer.byteLength(lines.filter(isWalkHeader).join('\n') + '\n'))];
-}
+var it=Object.defineProperty;var l=(t,e)=>it(t,"name",{value:e,configurable:!0});import{library10_walkProjection as nt,library10_walkAt as rt,library10_walkSnapshot as M,library10_walkHeaders as ot,library10_readWalkHeaders as U,library10_readForeignWalk as $,library10_walkAuthority as at,library10_walkOrigin as st,library10_walkInventory as ct,library10_walkSelection as z,library10_isWalkHeader as G}from"../vendor/runtime.js";import{library11_canonical as R,library11_parse as dt,library11_fromLine as J,library11_wireAt as X,library11_matches as lt,library11_objectHistory as ft,library11_validateObjectContext as pt}from"../vendor/runtime.js";import{objectProvider as gt}from"../vendor/object-provider.js";import{library7_standingBytes as ut}from"../vendor/runtime.js";import{fieldOf as p}from"../fold/claims.js";import{lockStanding as ht,lockLines as L}from"../fold/keys.js";import{authorityFor as W,rootSigner as I}from"../fold/signers.js";import{publicKeyOf as Q}from"../fold/signers.js";import{signaturesOf as v}from"../fold/digests.js";import{fullDigest as yt}from"./digest.js";import{toposAt as wt,contextProviderServices as mt}from"./selected-topos.js";import{signerFor as V}from"./signing.js";import{signConsentLot as Y,verifiesFields as kt}from"../land/sign.js";import{storeOf as K}from"../land/ledger.js";import{signedOwnerLines as bt,epochOf as C,localActLines as Z,ownerOf as tt}from"../cli/owner.js";import{commitIngress as vt,ingressBundles as xt,ingressCost as Et}from"./ports/ingress.js";const d=l(t=>{throw Error("REFUSE\xB7walk "+t)},"refuse"),q=l(t=>{const e=dt(t);return e.kind!=="fact"?d("not a wire line"):e.value.fields},"fields"),N=l((t,e,a)=>{const c=t.filter(o=>p(o,"scope")===e&&p(o,"measure")===a&&p(o,"value")!=="withdraw");return c.length!==1?d("missing or conflicting "+e+" "+a):p(c[0],"value")},"one");function O(t){const e=K(t),a=ht(e),c=z(a);N(a,"view/walk","id")!=="walk@*"&&d("view/walk must declare walk@*");const r=a.filter(s=>p(s,"scope")==="view/walk").flatMap(s=>p(s,"needs").split("|")).filter(Boolean);r.length||d("view/walk has no declared history inputs");const i=X(a.map(q),Number.MAX_SAFE_INTEGER),n=i?.digests.values().next().value;return n||d("no admitted digest algorithm"),{store:e,standing:a,contract:c,masks:r,digest:l(s=>yt(s,n),"digest")}}l(O,"policy");function E(t,e,a=!1){const c=O(t);!a&&!c.standing.some(n=>p(n,"scope").startsWith("uses/")&&p(n,"value")===e)&&d("origin context is not selected by digest");const o=wt(e,c.store),r=at(o.parts,kt),i=o.parts.map(n=>R({...n,by:"target",epoch:"0"}));return{pin:e,topos:o,authority:r,configuration:i,origin:st(o.parts),contract:z(o.lines)}}l(E,"context");function et(t){const e=O(t),a=W(L(e.store),I(t),v(e.store).admitted),c=bt(e.store).filter(r=>e.masks.some(i=>lt(i,p(r,"scope"))));c.some(r=>a.of(r).kind!=="admitted")&&d("local history is not authenticated");const o=E(t,N(e.standing,"walk/context","digest"),!0);return M(c,o.contract.fields,e.digest,o.origin,o.contract.partition)}l(et,"local");const B=l(t=>{const e=t.filter(c=>G(c)&&p(c,"scope")==="walk/root");if(e.length!==1)return d("one signed root is required");const a=p(e[0],"at");return a.startsWith("receipt:")?{pin:a.slice(8),base:p(e[0],"condition")}:d("root has no declared context")},"headerInfo");async function D(t,e,a){e.authority.authenticate(a)||d("origin history is not authenticated");for(const s of a){const g=q(s),y=J(s,X(e.topos.parts,Number(g.epoch)));y.kind!=="fact"&&d("origin wire "+y.why)}const c=ft([...e.configuration,...a]);if(c.kind!=="fact")return d("origin history "+c.why);if(!c.value.objects.length)return;const o=new Set(e.topos.lines),r=l(s=>s.sig?e.authority.of(R(s)).kind==="admitted":o.has(ut([R(s)]).trim()),"admit"),i=await gt(c.value.objects,c.value.configuration,{admit:r,emit:l(()=>{},"emit"),...mt(K(t))}),n=pt(c.value.objects,i);n.kind!=="fact"&&d("origin context "+n.why)}l(D,"validateHistory");async function _t(t,e,a=[]){const c=e.evidence.split(`
+`).filter(Boolean),o=B(c),r=O(t),i=e.receipt.split(`
+`).filter(Boolean),n=W(L(r.store),I(t),v(r.store).admitted);(i.length!==1||p(i[0],"scope")!=="receipts"||p(i[0],"role")!=="writes"||p(i[0],"form")!=="alphabet"||p(i[0],"measure")!=="digest"||p(i[0],"at")!=="receipt:"+o.pin||n.of(i[0]).kind!=="admitted")&&d("retained import receipt is not authenticated");const s=E(t,o.pin),g=$(c,{origin:s.origin,regionOrigin:s.origin,context:o.pin,base:o.base,fields:s.contract.fields,partition:s.contract.partition,digest:r.digest,previousPrefixes:[],authenticatePrefix:s.authority.authenticate,authenticateEvidence:s.authority.authenticate,validateOriginHistory:l(()=>!0,"validateOriginHistory")});return p(i[0],"value")!==g.identity&&d("retained import receipt does not authenticate this ingress"),await D(t,s,[...new Set([...a,...g.records])]),{...g,context:o.pin,regions:M(g.records,s.contract.fields,r.digest,g.origin,s.contract.partition).regions}}l(_t,"readBundle");async function F(t){const e=[],a=new Map,c=[...xt(K(t))].sort((o,r)=>C(o.receipt.split(`
+`))-C(r.receipt.split(`
+`)));for(const o of c){const r=B(o.evidence.split(`
+`).filter(Boolean)),i=E(t,r.pin).origin;e.some(g=>g.origin===i&&g.context!==r.pin)&&d("origin context changed without declared lineage");const n=a.get(i)??new Set,s=await _t(t,o,[...n]);for(const g of s.records)n.add(g);a.set(i,n),e.push(s)}return e}l(F,"verifiedIngress");async function T(t){const e=O(t),a=new Map(et(t).regions.map(c=>[c.scope,c]));for(const c of(await F(t)).sort((o,r)=>o.senderEpoch-r.senderEpoch))for(const o of c.regions)a.set(o.scope,o);return ct([[...a.values()]],e.digest,E(t,N(e.standing,"walk/context","digest"),!0).contract.partition)}l(T,"inventory");async function Xt(t){const e=await F(t);return[...new Set(e.flatMap(a=>a.records))]}l(Xt,"foreignWalkLines");async function Kt(t,e,a,c,o,r){const i=O(t),n=N(i.standing,"walk/context","digest"),s=E(t,n,!0),g=et(t),y=a.length?(()=>{const f=B(a),u=E(t,f.pin);return U(a,f.pin,f.base,u.authority.authenticate)})():M([],i.contract.fields,i.digest),_=nt(s.contract.projections,e),H=_==="history"?g:await T(t),w=rt(H,y,e,s.contract.projections),m=c??tt(i.store),S=Q(t,m);S||d("unknown local signer "+m);const j=ot(w,n,y.root,_!=="inventory"),P=C(Z(t)),k=await Y(j,{by:m,epoch:P,algorithm:v(i.store).era},S,v(i.store).admitted,V(i.standing,m,r,o));return k.kind!=="fact"?d(k.why):((!s.authority.authenticate(k.lines)||!s.authority.authenticate(w.records))&&d("local context does not authenticate exported history"),[...k.lines,...w.records,`EXCHANGE ${w.touched} touched regions \xB7 ${w.open} open regions \xB7 ${Buffer.byteLength(w.records.join(`
+`)+(w.records.length?`
+`:""))} payload bytes`])}l(Kt,"renderWalk");async function qt(t,e,a,c,o){const r=O(t),i=B(e),n=E(t,i.pin),s=await F(t);s.some(f=>f.origin===n.origin&&f.context!==i.pin)&&d("origin context changed without declared lineage");const g=l(f=>{const u=new Map;for(const h of f.filter(b=>b.origin===n.origin).sort((b,x)=>b.senderEpoch-x.senderEpoch))for(const b of h.regions)u.set(b.scope,{...b,senderEpoch:h.senderEpoch});return[...u.values()]},"previous"),y=e.filter(f=>!G(f)),_=l(f=>$(e,{origin:n.origin,regionOrigin:n.origin,context:i.pin,base:i.base,fields:n.contract.fields,partition:n.contract.partition,digest:r.digest,previousPrefixes:f,authenticatePrefix:n.authority.authenticate,authenticateEvidence:n.authority.authenticate,validateOriginHistory:l(()=>!0,"validateOriginHistory")}),"proof"),H=_([]),w=s.find(f=>f.identity===H.identity),m=w?H:_(g(s)),S=l(f=>[...new Set([...f.filter(u=>u.origin===n.origin).flatMap(u=>u.records),...y])],"history");if(await D(t,n,S(s)),!w&&i.base!==(await T(t)).root&&d("stale receiver base"),!y.length&&!U(e,i.pin,i.base,n.authority.authenticate).regions.length)return["ONCE 0 new evidence lines \xB7 0 import receipts \xB7 no regions offered",`EXCHANGE 0 payload bytes \xB7 ${Buffer.byteLength(e.join(`
+`)+`
+`)} protocol bytes \xB7 0 new evidence bytes \xB7 0 new receipt bytes`];const j=a??tt(r.store),P=Q(t,j);P||d("unknown receiver signer "+j);const k=await vt(r.store,m.identity,async()=>{i.base!==(await T(t)).root&&d("receiver changed before ingress");const f=await F(t);_(g(f)),await D(t,n,S(f));const u=C(Z(t))+1,h=await Y([m.importReceiptProposal],{by:j,epoch:u,algorithm:v(r.store).era},P,v(r.store).admitted,V(r.standing,j,o,c));if(h.kind!=="fact")return d(h.why);W(L(r.store),I(t),v(r.store).admitted).of(h.lines[0]).kind!=="admitted"&&d("receiver signer does not cover the import receipt");const x=J(h.lines[0],X(r.standing.map(q),u));return x.kind!=="fact"&&d("receiver receipt wire "+x.why),{evidence:e.join(`
+`)+`
+`,receipt:h.lines.join(`
+`)+`
+`}},f=>{try{const u=f.evidence.split(`
+`).filter(Boolean),h=B(u);if(h.pin!==i.pin)return!1;const b=$(u,{origin:n.origin,regionOrigin:n.origin,context:i.pin,base:h.base,fields:n.contract.fields,partition:n.contract.partition,digest:r.digest,previousPrefixes:[],authenticatePrefix:n.authority.authenticate,authenticateEvidence:n.authority.authenticate,validateOriginHistory:l(()=>!0,"validateOriginHistory")}),x=f.receipt.split(`
+`).filter(Boolean),A=x[0]??"";return x.length===1&&b.identity===m.identity&&p(A,"scope")==="receipts"&&p(A,"value")===m.identity&&p(A,"at")==="receipt:"+i.pin&&W(L(r.store),I(t),v(r.store).admitted).of(A).kind==="admitted"}catch{return!1}});return[`${k.kind==="once"?"ONCE":"INGRESS"} ${k.kind==="once"?0:m.records.length} new evidence lines \xB7 1 ${k.kind==="once"?"retained":"signed local"} import receipt`,k.receipt.trim(),Et(k,Buffer.byteLength(y.join(`
+`)+(y.length?`
+`:"")),Buffer.byteLength(e.filter(G).join(`
+`)+`
+`))]}l(qt,"landWalk");export{Xt as foreignWalkLines,qt as landWalk,Kt as renderWalk};