@lapxo/bound 0.2.4 → 0.2.5

package/dist/host/content-store.js

@@ -1,31 +1 @@
-import { AsyncLocalStorage } from 'node:async_hooks';
-import { createHash } from 'node:crypto';
-import { blobAt } from "../land/ledger.js";
-import { observeFile } from "../observe/files.js";
-import { ownLock, ownStore } from "../observe/runner.js";
-import { parse, wireAt } from '@lapxo/topos/wire';
-import { ContentNeeded } from "./content-needed.js";
-// Each invocation carries its place explicitly; asynchronous requests cannot share a mutable current root.
-const requested = new AsyncLocalStorage();
-export const withContentStore = (store, run, policy = () => []) => requested.run({ store, policy }, run);
-export const contentPolicy = () => requested.getStore()?.policy() ?? [];
-export const contentStore = () => requested.getStore()?.store ?? ownStore();
-/** Only immutable verified bytes may be shared with the instrument. Local corruption is never hidden by fallback. */
-export function verifiedContent(digest, store = contentStore(), instrument = ownStore()) {
-    const fields = ownLock().flatMap(line => { const p = parse(line); return p.kind === 'fact' ? [p.value.fields] : []; });
-    const wire = wireAt(fields, Number.MAX_SAFE_INTEGER);
-    if (!wire)
-        throw Error('REFUSE·pin instrument has no admitted wire');
-    const split = digest.indexOf(':'), algorithm = digest.slice(0, split), hex = digest.slice(split + 1);
-    if (split < 1 || !wire.digests.has(algorithm) || !/^[a-f0-9]+$/.test(hex))
-        throw Error(`REFUSE·pin ${digest} digest is not admitted`);
-    for (const at of new Set([store, instrument])) {
-        const path = blobAt(at, digest), bytes = observeFile(path);
-        if (bytes === undefined)
-            continue;
-        if (createHash(algorithm).update(bytes).digest('hex') !== hex)
-            throw Error(`REFUSE·pin ${digest} content hash mismatch · store ${at} · not laid`);
-        return { bytes, path };
-    }
-    throw new ContentNeeded(digest);
-}
+var w=Object.defineProperty;var e=(t,o)=>w(t,"name",{value:o,configurable:!0});import{AsyncLocalStorage as d}from"node:async_hooks";import{createHash as E}from"node:crypto";import{blobAt as u}from"../land/ledger.js";import{observeFile as S}from"../observe/files.js";import{ownLock as b,ownStore as l}from"../observe/runner.js";import{library11_parse as x,library11_wireAt as y}from"../vendor/runtime.js";import{ContentNeeded as A}from"./content-needed.js";const c=new d,L=e((t,o,i=()=>[])=>c.run({store:t,policy:i},o),"withContentStore"),M=e(()=>c.getStore()?.policy()??[],"contentPolicy"),F=e(()=>c.getStore()?.store??l(),"contentStore");function g(t,o=F(),i=l()){const h=b().flatMap(n=>{const r=x(n);return r.kind==="fact"?[r.value.fields]:[]}),f=y(h,Number.MAX_SAFE_INTEGER);if(!f)throw Error("REFUSE\xB7pin instrument has no admitted wire");const s=t.indexOf(":"),p=t.slice(0,s),m=t.slice(s+1);if(s<1||!f.digests.has(p)||!/^[a-f0-9]+$/.test(m))throw Error(`REFUSE\xB7pin ${t} digest is not admitted`);for(const n of new Set([o,i])){const r=u(n,t),a=S(r);if(a!==void 0){if(E(p).update(a).digest("hex")!==m)throw Error(`REFUSE\xB7pin ${t} content hash mismatch \xB7 store ${n} \xB7 not laid`);return{bytes:a,path:r}}}throw new A(t)}e(g,"verifiedContent");export{M as contentPolicy,F as contentStore,g as verifiedContent,L as withContentStore};

package/dist/host/contextual-place.js

@@ -1,72 +1,2 @@
-import { openSync, fstatSync, readSync, closeSync } from 'node:fs';
-import { readPlaceActContext, PLACE_ACT_CONTEXT } from '@lapxo/topos/core';
-import { declaredRootClockSource, hasRootClockSource } from "./root-clock-source.js";
-import { commitPlaceAct, placeActResult, committedPlaceActResults } from "./ports/place-act.js";
-import { placesIn } from "../fold/places.js";
-import { appliedHistoryIn } from "../fold/signed.js";
-import { storeOf } from "../land/ledger.js";
-import { publicStandingLines } from "./admitted-place.js";
-import { projectContextualStanding } from "./standing-carrier.js";
-import { admissionHistoryAt } from "../fold/admission-history.js";
-const fail = (s) => { throw Error('REFUSE·contextual place ' + s); };
-function read(path, limit) {
-    const fd = openSync(path, 'r');
-    try {
-        const stat = fstatSync(fd);
-        if (!stat.isFile() || stat.size > limit)
-            fail('batch byte budget');
-        const data = Buffer.alloc(stat.size);
-        let n = 0;
-        while (n < data.length) {
-            const got = readSync(fd, data, n, data.length - n, null);
-            if (!got)
-                fail('batch changed during read');
-            n += got;
-        }
-        if (readSync(fd, Buffer.alloc(1), 0, 1, null))
-            fail('batch changed during read');
-        return new TextDecoder('utf8', { fatal: true }).decode(data);
-    }
-    finally {
-        closeSync(fd);
-    }
-}
-export function hasContextualPlace(root) { return hasRootClockSource(root); }
-/** Exact selected SDK frame plus complete pre-signed receiver statements. No
- * executable/verifier/epoch selection can be supplied by this envelope. */
-export async function landContextualPlace(root, file) {
-    const selected = declaredRootClockSource(root), raw = read(file, selected.selection.budget.bytes);
-    let packet;
-    try {
-        packet = JSON.parse(raw);
-    }
-    catch {
-        return fail('invalid batch JSON');
-    }
-    if (!packet || Object.keys(packet).sort().join(',') !== 'context,profile,receipts' || packet.profile !== PLACE_ACT_CONTEXT || typeof packet.context !== 'string' || !Array.isArray(packet.receipts) || JSON.stringify(packet) + '\n' !== raw)
-        fail('unsupported/noncanonical batch envelope');
-    return commitPlaceAct(storeOf(root), packet.context, packet.receipts, selected.trust, selected.selection.storageBudget);
-}
-export function contextualAct(root, identity) {
-    const selected = declaredRootClockSource(root), bundle = placeActResult(storeOf(root), identity, selected.trust, selected.selection.storageBudget);
-    if (!bundle)
-        return undefined;
-    const all = new Map(committedPlaceActResults(storeOf(root), selected.trust, selected.selection.storageBudget).map(a => [a.identity, a])), kept = new Set(), contexts = [];
-    const visit = (id) => { if (kept.has(id))
-        return; const a = all.get(id); if (!a)
-        return; kept.add(id); const decoded = readPlaceActContext(a.bundle.context, selected.selection.budget); for (const p of decoded.places)
-        visit(p.previous); contexts.push({ identity: a.identity, context: a.bundle.context, receipts: a.bundle.receipts, authority: selected.authority(a.bundle.context) }); };
-    visit(identity);
-    return { profile: PLACE_ACT_CONTEXT, identity, context: bundle.context, receipts: bundle.receipts, contexts };
-}
-/** Carriers retain exact originals and authenticated context/receipts. Each
- * namespace folds independently; labels assert no statistical independence. */
-/** Native snapshot collection preserves every existing authentication boundary. */
-export function contextualStandingSnapshot(root) {
-    const selected = declaredRootClockSource(root), acts = committedPlaceActResults(storeOf(root), selected.trust, selected.selection.storageBudget);
-    return { rootHistory: admissionHistoryAt(root, Number.MAX_SAFE_INTEGER), legacyPlaces: placesIn(root).map(place => ({ place: [place, 'TARGET.bound'].join('/'), history: appliedHistoryIn(root, place) })), contexts: acts.map(a => ({ identity: a.identity, context: a.bundle.context, receipts: a.bundle.receipts, authority: selected.authority(a.bundle.context) })) };
-}
-export function contextualStanding(root) {
-    const snapshot = contextualStandingSnapshot(root), selected = declaredRootClockSource(root);
-    return projectContextualStanding(publicStandingLines(root), snapshot.legacyPlaces, snapshot.contexts, snapshot.contexts.map(a => ({ identity: a.identity, context: readPlaceActContext(a.context, selected.selection.budget) })));
-}
+var S=Object.defineProperty;var r=(t,c)=>S(t,"name",{value:c,configurable:!0});import{openSync as A,fstatSync as C,readSync as x,closeSync as E}from"node:fs";import{library3_readPlaceActContext as y,library3_PLACE_ACT_CONTEXT as m}from"../vendor/runtime.js";import{declaredRootClockSource as d,hasRootClockSource as P}from"./root-clock-source.js";import{commitPlaceAct as T,placeActResult as _,committedPlaceActResults as g}from"./ports/place-act.js";import{placesIn as N}from"../fold/places.js";import{appliedHistoryIn as O}from"../fold/signed.js";import{storeOf as p}from"../land/ledger.js";import{publicStandingLines as R}from"./admitted-place.js";import{projectContextualStanding as w}from"./standing-carrier.js";import{admissionHistoryAt as B}from"../fold/admission-history.js";const u=r(t=>{throw Error("REFUSE\xB7contextual place "+t)},"fail");function k(t,c){const n=A(t,"r");try{const e=C(n);(!e.isFile()||e.size>c)&&u("batch byte budget");const o=Buffer.alloc(e.size);let i=0;for(;i<o.length;){const l=x(n,o,i,o.length-i,null);l||u("batch changed during read"),i+=l}return x(n,Buffer.alloc(1),0,1,null)&&u("batch changed during read"),new TextDecoder("utf8",{fatal:!0}).decode(o)}finally{E(n)}}r(k,"read");function U(t){return P(t)}r(U,"hasContextualPlace");async function q(t,c){const n=d(t),e=k(c,n.selection.budget.bytes);let o;try{o=JSON.parse(e)}catch{return u("invalid batch JSON")}return(!o||Object.keys(o).sort().join(",")!=="context,profile,receipts"||o.profile!==m||typeof o.context!="string"||!Array.isArray(o.receipts)||JSON.stringify(o)+`
+`!==e)&&u("unsupported/noncanonical batch envelope"),T(p(t),o.context,o.receipts,n.trust,n.selection.storageBudget)}r(q,"landContextualPlace");function K(t,c){const n=d(t),e=_(p(t),c,n.trust,n.selection.storageBudget);if(!e)return;const o=new Map(g(p(t),n.trust,n.selection.storageBudget).map(s=>[s.identity,s])),i=new Set,l=[],f=r(s=>{if(i.has(s))return;const a=o.get(s);if(!a)return;i.add(s);const b=y(a.bundle.context,n.selection.budget);for(const h of b.places)f(h.previous);l.push({identity:a.identity,context:a.bundle.context,receipts:a.bundle.receipts,authority:n.authority(a.bundle.context)})},"visit");return f(c),{profile:m,identity:c,context:e.context,receipts:e.receipts,contexts:l}}r(K,"contextualAct");function j(t){const c=d(t),n=g(p(t),c.trust,c.selection.storageBudget);return{rootHistory:B(t,Number.MAX_SAFE_INTEGER),legacyPlaces:N(t).map(e=>({place:[e,"TARGET.bound"].join("/"),history:O(t,e)})),contexts:n.map(e=>({identity:e.identity,context:e.bundle.context,receipts:e.bundle.receipts,authority:c.authority(e.bundle.context)}))}}r(j,"contextualStandingSnapshot");function Q(t){const c=j(t),n=d(t);return w(R(t),c.legacyPlaces,c.contexts,c.contexts.map(e=>({identity:e.identity,context:y(e.context,n.selection.budget)})))}r(Q,"contextualStanding");export{K as contextualAct,Q as contextualStanding,j as contextualStandingSnapshot,U as hasContextualPlace,q as landContextualPlace};

package/dist/host/digest.js

@@ -1,15 +1,2 @@
-import { createHash } from 'node:crypto';
-import { byBytes } from '@lapxo/topos/wire';
-import { selfName } from "../fold/claims.js";
-/** Sorted by UTF-8 bytes; the algorithm is a field (`sha256:…`), never bare hex. */
-export function fullDigest(input, algorithm) {
-    if (!algorithm)
-        throw new Error(`${selfName()}: REFUSE·runtime a digest was asked for before the lock said which algorithm`);
-    const text = typeof input === 'string' ? input : [...input].sort(byBytes).join('\n');
-    return `${algorithm}:${createHash(algorithm).update(text).digest('hex')}`;
-}
-export function bytesDigest(bytes, algorithm) {
-    if (!algorithm)
-        throw new Error(`${selfName()}: REFUSE·runtime a digest was asked for before the lock said which algorithm`);
-    return `${algorithm}:${createHash(algorithm).update(bytes).digest('hex')}`;
-}
+var f=Object.defineProperty;var t=(r,e)=>f(r,"name",{value:e,configurable:!0});import{createHash as o}from"node:crypto";import{library11_byBytes as a}from"../vendor/runtime.js";import{selfName as s}from"../fold/claims.js";function w(r,e){if(!e)throw new Error(`${s()}: REFUSE\xB7runtime a digest was asked for before the lock said which algorithm`);const i=typeof r=="string"?r:[...r].sort(a).join(`
+`);return`${e}:${o(e).update(i).digest("hex")}`}t(w,"fullDigest");function m(r,e){if(!e)throw new Error(`${s()}: REFUSE\xB7runtime a digest was asked for before the lock said which algorithm`);return`${e}:${o(e).update(r).digest("hex")}`}t(m,"bytesDigest");export{m as bytesDigest,w as fullDigest};

package/dist/host/hash.js

@@ -1,9 +1 @@
-import { createHash } from 'node:crypto';
-/** SHA-256 byte hashing for host formats that explicitly name this algorithm. */
-export const sha = (bytes) => createHash('sha256').update(bytes).digest('hex');
-/** Typed digest spelling shared by fixed host boundaries; hashes identical bytes. */
-export const sha256 = (bytes) => 'sha256:' + sha(bytes);
-/** Length-delimited UTF-8 fields for existing host history identities. */
-export function hashText(hash, value) { hash.update(String(Buffer.byteLength(value, 'utf8')) + ':'); hash.update(value, 'utf8'); }
-/** Exact typed SHA-256 spelling used by fixed host declarations. */
-export const isSha256 = (value) => typeof value === 'string' && /^sha256:[0-9a-f]{64}$/.test(value);
+var o=Object.defineProperty;var e=(t,s)=>o(t,"name",{value:s,configurable:!0});import{createHash as a}from"node:crypto";const r=e(t=>a("sha256").update(t).digest("hex"),"sha"),f=e(t=>"sha256:"+r(t),"sha256");function n(t,s){t.update(String(Buffer.byteLength(s,"utf8"))+":"),t.update(s,"utf8")}e(n,"hashText");const i=e(t=>typeof t=="string"&&/^sha256:[0-9a-f]{64}$/.test(t),"isSha256");export{n as hashText,i as isSha256,r as sha,f as sha256};

package/dist/host/host-controls.js

@@ -1,19 +1 @@
-import { LOCK } from '@lapxo/topos/wire';
-import { BoundRefusal } from "./refusals.js";
-/** Shared host refusals preserve the public code and diagnostic at every port. */
-export function refuseHost(code) {
-    throw new BoundRefusal('host/' + code, 'REFUSE·host/' + code);
-}
-export function assertHostNotCancelled(signal) {
-    if (signal?.aborted)
-        refuseHost('cancelled');
-}
-/** Clock validation is shared; each boundary keeps its own refusal producer. */
-export function receiverClock(text, refuse) {
-    if (!/^(0|[1-9][0-9]*)$/.test(text) || !Number.isSafeInteger(Number(text)))
-        refuse('unknown receiver clock');
-    return Number(text);
-}
-/** Coordinates use the wire's lock name, never a second spelling in a host. */
-export const isPlaceLockCoordinate = (coordinate) => typeof coordinate === 'string' && coordinate.endsWith('/' + LOCK) && !coordinate.startsWith('/') && !coordinate.split('/').some(part => !part || part === '.' || part === '..');
-export const placeRegionOf = (coordinate) => coordinate === '.' ? '' : coordinate.slice(0, -(LOCK.length + 1));
+var s=Object.defineProperty;var o=(e,t)=>s(e,"name",{value:t,configurable:!0});import{library11_LOCK as r}from"../vendor/runtime.js";import{BoundRefusal as n}from"./refusals.js";function i(e){throw new n("host/"+e,"REFUSE\xB7host/"+e)}o(i,"refuseHost");function u(e){e?.aborted&&i("cancelled")}o(u,"assertHostNotCancelled");function m(e,t){return(!/^(0|[1-9][0-9]*)$/.test(e)||!Number.isSafeInteger(Number(e)))&&t("unknown receiver clock"),Number(e)}o(m,"receiverClock");const p=o(e=>typeof e=="string"&&e.endsWith("/"+r)&&!e.startsWith("/")&&!e.split("/").some(t=>!t||t==="."||t===".."),"isPlaceLockCoordinate"),a=o(e=>e==="."?"":e.slice(0,-(r.length+1)),"placeRegionOf");export{u as assertHostNotCancelled,p as isPlaceLockCoordinate,a as placeRegionOf,m as receiverClock,i as refuseHost};

package/dist/host/in-process-act.js

@@ -1,84 +1,3 @@
-import { authorityAtEpoch } from '@lapxo/topos/wire';
-import { placeReceiptBytes, readPlaceActContext } from '@lapxo/topos/core';
-import { readingIdentity, readingReceiptIdentity } from '@lapxo/topos/contract';
-import { readContent, invokeFrameSigningPort } from "../engine/ports.js";
-import { transactPlaceAct, PlaceActCommitUnknown } from "./place-act-transaction.js";
-import { withActHost } from "../land/act.js";
-import { sha256, isSha256 } from "./hash.js";
-import { BoundRefusal } from "./refusals.js";
-import { refuseHost as fail } from "./host-controls.js";
-import { withHostInstrument } from "./call-context.js";
-import { requireEffects } from "./read-only.js";
-/** Signs receiver receipts through the bounded existing signer protocol. Exact
- * original declarations/proofs remain unchanged. Replay is historical recovery,
- * never a new permission. A refusal after visibility is not a rollback claim. */
-export async function landPlaceActInProcess(context, ports) {
-    return withHostInstrument(ports.instrumentName, () => withActHost({ name: ports.instrumentName, report: () => { }, signal: context.signal }, async () => {
-        try {
-            requireEffects('contextual host admission');
-            const { place, source, identity, rootSnapshot, algorithm, signal } = context, reading = structuredClone(context.reading), contentLimits = { ...context.contentLimits }, signingLimits = { ...context.signingLimits }, storageLimits = { ...context.storageLimits };
-            if (typeof ports.instrumentName !== 'string' || !ports.instrumentName || !/[a-zA-Z0-9]/.test(ports.instrumentName) || !/^[a-zA-Z0-9._-]+$/.test(ports.instrumentName) || typeof place !== 'string' || !place || typeof source !== 'string' || !source || typeof algorithm !== 'string' || !algorithm)
-                fail('context');
-            if (storageLimits.acts > ports.limits.storage.acts || storageLimits.bytes > ports.limits.storage.bytes || signingLimits.timeoutMs > ports.limits.signing.timeoutMs || signingLimits.maxBytes > ports.limits.signing.maxBytes || contentLimits.timeoutMs > ports.limits.content.timeoutMs || contentLimits.maxBytes > ports.limits.content.maxBytes)
-                fail('budget');
-            const key = readingIdentity({ ...reading, inputs: [...reading.inputs, ['host/place', sha256(place)], ['host/snapshot', rootSnapshot], ['host/act', identity], ['host/operation', sha256(JSON.stringify([algorithm, contentLimits, signingLimits, storageLimits]))]] }, sha256);
-            const trust = ports.trust();
-            if (trust.contract.root.snapshot !== rootSnapshot)
-                fail('stale');
-            if (contentLimits.maxBytes > trust.contract.budget.bytes)
-                fail('budget');
-            const bytes = await readContent(source, identity, { read: ports.read, digestBytes: sha256 }, contentLimits, signal);
-            let encoded;
-            try {
-                encoded = new TextDecoder('utf-8', { fatal: true }).decode(bytes);
-            }
-            catch {
-                return fail('snapshot-format');
-            }
-            const decoded = readPlaceActContext(encoded, trust.contract.budget);
-            if (trust.contract.digest(encoded) !== identity)
-                fail('integrity');
-            const acquire = async () => {
-                const by = trust.contract.receiptSigner, signer = trust.contract.signers.find(s => s.id === by);
-                if (!signer || authorityAtEpoch({ scope: trust.contract.receiptScope, by }, signer, Number(trust.contract.root.epoch), trust.contract.receiptScope, 'authority').kind !== 'admitted')
-                    fail('receiver-authority');
-                const signed = await invokeFrameSigningPort({ keyId: by, algorithm, bytes: decoded.places.map(p => placeReceiptBytes(identity, p, decoded.root, by, trust.contract.receiptScope, trust.contract.budget)) }, ports.sign, signingLimits, signal);
-                return decoded.places.map((p, i) => ({ place: p.place, by, signature: signed[i].signature }));
-            };
-            const act = await transactPlaceAct(encoded, acquire, trust, storageLimits, ports.persistence, signal);
-            const result = sha256(JSON.stringify(act) + '\n');
-            return { kind: 'fact', value: { place, act, reading: key, result, commitment: readingReceiptIdentity(key, result, sha256) } };
-        }
-        catch (error) {
-            if (error instanceof PlaceActCommitUnknown)
-                return { kind: 'uncertain', identity: error.identity, code: error.code, diagnostic: error.message };
-            return { kind: 'refuse', code: error instanceof BoundRefusal ? error.code : 'host/failed', diagnostic: error instanceof Error ? error.message : 'REFUSE·host/failed' };
-        }
-        ;
-    }));
-}
-/** Historical recovery after a lost response. No signer, current authorization
- * or publication callback is invoked and the result grants no new act. */
-export function recoverPlaceActInProcess(context, ports) {
-    return withHostInstrument(ports.instrumentName, () => withActHost({ name: ports.instrumentName, report: () => { }, signal: context.signal }, () => {
-        try {
-            if (context.signal?.aborted)
-                fail('cancelled');
-            if (!context.place || !isSha256(context.identity))
-                fail('context');
-            const limits = { ...context.storageLimits };
-            if (limits.acts > ports.limits.storage.acts || limits.bytes > ports.limits.storage.bytes)
-                fail('budget');
-            const reading = readingIdentity({ ...structuredClone(context.reading), inputs: [...context.reading.inputs, ['host/place', sha256(context.place)], ['host/act', context.identity], ['host/operation', sha256('historical-recovery')]] }, sha256);
-            const act = ports.persistence.result(context.identity, ports.trust(), limits);
-            if (!act)
-                fail('act-unavailable');
-            const result = sha256(JSON.stringify(act) + '\n');
-            return { kind: 'fact', value: { place: context.place, identity: context.identity, act, historical: true, reading, result, commitment: readingReceiptIdentity(reading, result, sha256) } };
-        }
-        catch (error) {
-            return { kind: 'refuse', code: error instanceof BoundRefusal ? error.code : 'host/failed', diagnostic: error instanceof Error ? error.message : 'REFUSE·host/failed' };
-        }
-        ;
-    }));
-}
+var _=Object.defineProperty;var o=(i,t)=>_(i,"name",{value:t,configurable:!0});import{library11_authorityAtEpoch as M}from"../vendor/runtime.js";import{library3_placeReceiptBytes as q,library3_readPlaceActContext as F}from"../vendor/runtime.js";import{library2_readingIdentity as E,library2_readingReceiptIdentity as P}from"../vendor/runtime.js";import{readContent as H,invokeFrameSigningPort as J}from"../engine/ports.js";import{transactPlaceAct as O,PlaceActCommitUnknown as U}from"./place-act-transaction.js";import{withActHost as I}from"../land/act.js";import{sha256 as a,isSha256 as z}from"./hash.js";import{BoundRefusal as v}from"./refusals.js";import{refuseHost as r}from"./host-controls.js";import{withHostInstrument as w}from"./call-context.js";import{requireEffects as Z}from"./read-only.js";async function et(i,t){return w(t.instrumentName,()=>I({name:t.instrumentName,report:o(()=>{},"report"),signal:i.signal},async()=>{try{Z("contextual host admission");const{place:e,source:c,identity:s,rootSnapshot:m,algorithm:g,signal:h}=i,N=structuredClone(i.reading),d={...i.contentLimits},y={...i.signingLimits},f={...i.storageLimits};(typeof t.instrumentName!="string"||!t.instrumentName||!/[a-zA-Z0-9]/.test(t.instrumentName)||!/^[a-zA-Z0-9._-]+$/.test(t.instrumentName)||typeof e!="string"||!e||typeof c!="string"||!c||typeof g!="string"||!g)&&r("context"),(f.acts>t.limits.storage.acts||f.bytes>t.limits.storage.bytes||y.timeoutMs>t.limits.signing.timeoutMs||y.maxBytes>t.limits.signing.maxBytes||d.timeoutMs>t.limits.content.timeoutMs||d.maxBytes>t.limits.content.maxBytes)&&r("budget");const S=E({...N,inputs:[...N.inputs,["host/place",a(e)],["host/snapshot",m],["host/act",s],["host/operation",a(JSON.stringify([g,d,y,f]))]]},a),n=t.trust();n.contract.root.snapshot!==m&&r("stale"),d.maxBytes>n.contract.budget.bytes&&r("budget");const L=await H(c,s,{read:t.read,digestBytes:a},d,h);let p;try{p=new TextDecoder("utf-8",{fatal:!0}).decode(L)}catch{return r("snapshot-format")}const b=F(p,n.contract.budget);n.contract.digest(p)!==s&&r("integrity");const A=await O(p,o(async()=>{const u=n.contract.receiptSigner,B=n.contract.signers.find(l=>l.id===u);(!B||M({scope:n.contract.receiptScope,by:u},B,Number(n.contract.root.epoch),n.contract.receiptScope,"authority").kind!=="admitted")&&r("receiver-authority");const R=await J({keyId:u,algorithm:g,bytes:b.places.map(l=>q(s,l,b.root,u,n.contract.receiptScope,n.contract.budget))},t.sign,y,h);return b.places.map((l,C)=>({place:l.place,by:u,signature:R[C].signature}))},"acquire"),n,f,t.persistence,h),k=a(JSON.stringify(A)+`
+`);return{kind:"fact",value:{place:e,act:A,reading:S,result:k,commitment:P(S,k,a)}}}catch(e){return e instanceof U?{kind:"uncertain",identity:e.identity,code:e.code,diagnostic:e.message}:{kind:"refuse",code:e instanceof v?e.code:"host/failed",diagnostic:e instanceof Error?e.message:"REFUSE\xB7host/failed"}}}))}o(et,"landPlaceActInProcess");function it(i,t){return w(t.instrumentName,()=>I({name:t.instrumentName,report:o(()=>{},"report"),signal:i.signal},()=>{try{i.signal?.aborted&&r("cancelled"),(!i.place||!z(i.identity))&&r("context");const e={...i.storageLimits};(e.acts>t.limits.storage.acts||e.bytes>t.limits.storage.bytes)&&r("budget");const c=E({...structuredClone(i.reading),inputs:[...i.reading.inputs,["host/place",a(i.place)],["host/act",i.identity],["host/operation",a("historical-recovery")]]},a),s=t.persistence.result(i.identity,t.trust(),e);s||r("act-unavailable");const m=a(JSON.stringify(s)+`
+`);return{kind:"fact",value:{place:i.place,identity:i.identity,act:s,historical:!0,reading:c,result:m,commitment:P(c,m,a)}}}catch(e){return{kind:"refuse",code:e instanceof v?e.code:"host/failed",diagnostic:e instanceof Error?e.message:"REFUSE\xB7host/failed"}}}))}o(it,"recoverPlaceActInProcess");export{et as landPlaceActInProcess,it as recoverPlaceActInProcess};

package/dist/host/in-process-context.js

@@ -1,91 +1,3 @@
-import { parse } from '@lapxo/topos/wire';
-import { readingIdentity, readingReceiptIdentity } from '@lapxo/topos/contract';
-import { readContent } from "../engine/ports.js";
-import { sha256 } from "./hash.js";
-import { BoundRefusal } from "./refusals.js";
-import { refuseHost as fail, isPlaceLockCoordinate, placeRegionOf } from "./host-controls.js";
-import { publicStandingProjection, assertStandingView } from "./standing-projection.js";
-import { rootClockSelectionOf, inspectPortablePlaceContexts } from "./root-clock-source.js";
-import { projectContextualStanding } from "./standing-carrier.js";
-import { authorityFor } from "../fold/signers.js";
-import { ownRecordAdmitted } from "../fold/signed.js";
-import { wordsOf } from "../fold/wire.js";
-import { fieldOf, isConfig } from "../fold/claims.js";
-import { signatureEraOf } from "./signature-era.js";
-function authenticatedCarrier(snapshot, anchor, records) {
-    if (!snapshot || Object.keys(snapshot).sort().join(',') !== 'contexts,legacyPlaces,rootHistory' || !Array.isArray(snapshot.rootHistory) || !Array.isArray(snapshot.legacyPlaces) || !Array.isArray(snapshot.contexts))
-        fail('snapshot-format');
-    let count = snapshot.rootHistory.length;
-    if (count > records)
-        fail('budget');
-    const validLine = (line) => typeof line === 'string' && parse(line).kind === 'fact';
-    if (!snapshot.rootHistory.length || snapshot.rootHistory.some(l => !validLine(l)))
-        fail('snapshot-format');
-    const root = publicStandingProjection(snapshot.rootHistory, anchor), families = wordsOf(root, 'families');
-    // Unsupported vocabulary resolution must not discover a provider in the CLI host.
-    if (families.length && !families.includes('view'))
-        fail('vocabulary-unavailable');
-    assertStandingView(root);
-    const selection = rootClockSelectionOf(root, anchor), algorithms = signatureEraOf(root).admitted;
-    if (snapshot.legacyPlaces.length > selection.resources.places || snapshot.contexts.length > selection.resources.acts)
-        fail('budget');
-    const signers = authorityFor(snapshot.rootHistory, anchor, algorithms).admitted;
-    if (signers.some(s => !s.coverage.includes('*')) && !families.includes('region'))
-        fail('vocabulary-unavailable');
-    const names = new Set();
-    for (const place of snapshot.legacyPlaces) {
-        if (!place || !isPlaceLockCoordinate(place.place) || names.has(place.place) || !Array.isArray(place.history))
-            fail('snapshot-format');
-        names.add(place.place);
-        count += place.history.length;
-        if (count > records)
-            fail('budget');
-        const path = placeRegionOf(place.place);
-        if (place.history.some((l) => !validLine(l) || !ownRecordAdmitted(l, path, 'region', signers, algorithms)))
-            fail('legacy-authority');
-    }
-    for (const row of snapshot.contexts) {
-        if (!row || !row.authority || !Array.isArray(row.authority.history))
-            fail('snapshot-format');
-        count += row.authority.history.length;
-        if (count > records)
-            fail('budget');
-        // Historical authority must belong to this exact Root history, not a second
-        // signed Root fork silently substituted in the carrier.
-        const epoch = fieldOf(row.authority.checkpoint, 'epoch');
-        const expected = snapshot.rootHistory.filter(l => !isConfig(l) || Number(fieldOf(l, 'epoch')) <= Number(epoch));
-        if (JSON.stringify(expected) !== JSON.stringify(row.authority.history))
-            fail('historical-snapshot');
-    }
-    const decoded = inspectPortablePlaceContexts(JSON.stringify(snapshot.contexts), anchor, selection);
-    return projectContextualStanding(root, snapshot.legacyPlaces, snapshot.contexts, decoded);
-}
-/** Full contextual carrier, authenticated against receiver inputs only. It is a
- * data projection, not a current admission permit or a signed receipt. */
-export async function readContextualStandingInProcess(context, ports) {
-    try {
-        const { place, source, snapshot, signal } = context, anchor = structuredClone(context.anchor), reading = structuredClone(context.reading), limits = { ...context.limits };
-        if (!place || typeof place !== 'string' || !source || typeof source !== 'string' || !Number.isSafeInteger(limits.records) || limits.records < 1)
-            fail('context');
-        const identity = readingIdentity({ ...reading, inputs: [...reading.inputs, ['host/place', sha256(place)], ['host/anchor', sha256(JSON.stringify(anchor))], ['host/snapshot', snapshot]] }, sha256);
-        const bytes = await readContent(source, snapshot, { read: ports.read, digestBytes: sha256 }, limits, signal);
-        let text, value;
-        try {
-            text = new TextDecoder('utf-8', { fatal: true }).decode(bytes);
-            value = JSON.parse(text);
-        }
-        catch {
-            return fail('snapshot-format');
-        }
-        if (JSON.stringify(value) + '\n' !== text)
-            fail('snapshot-format');
-        if (signal?.aborted)
-            fail('cancelled');
-        const standing = authenticatedCarrier(value, anchor, limits.records), result = sha256(JSON.stringify(standing) + '\n');
-        return { kind: 'fact', value: { place, standing, reading: identity, result, commitment: readingReceiptIdentity(identity, result, sha256) } };
-    }
-    catch (error) {
-        return { kind: 'refuse', code: error instanceof BoundRefusal ? error.code : 'host/failed', diagnostic: error instanceof Error ? error.message : 'REFUSE·host/failed' };
-    }
-    ;
-}
+var O=Object.defineProperty;var h=(r,a)=>O(r,"name",{value:a,configurable:!0});import{library11_parse as x}from"../vendor/runtime.js";import{library2_readingIdentity as A,library2_readingReceiptIdentity as C}from"../vendor/runtime.js";import{readContent as N}from"../engine/ports.js";import{sha256 as y}from"./hash.js";import{BoundRefusal as P}from"./refusals.js";import{refuseHost as e,isPlaceLockCoordinate as v,placeRegionOf as H}from"./host-controls.js";import{publicStandingProjection as w,assertStandingView as k}from"./standing-projection.js";import{rootClockSelectionOf as J,inspectPortablePlaceContexts as I}from"./root-clock-source.js";import{projectContextualStanding as R}from"./standing-carrier.js";import{authorityFor as j}from"../fold/signers.js";import{ownRecordAdmitted as E}from"../fold/signed.js";import{wordsOf as _}from"../fold/wire.js";import{fieldOf as S,isConfig as B}from"../fold/claims.js";import{signatureEraOf as F}from"./signature-era.js";function L(r,a,o){(!r||Object.keys(r).sort().join(",")!=="contexts,legacyPlaces,rootHistory"||!Array.isArray(r.rootHistory)||!Array.isArray(r.legacyPlaces)||!Array.isArray(r.contexts))&&e("snapshot-format");let i=r.rootHistory.length;i>o&&e("budget");const m=h(t=>typeof t=="string"&&x(t).kind==="fact","validLine");(!r.rootHistory.length||r.rootHistory.some(t=>!m(t)))&&e("snapshot-format");const s=w(r.rootHistory,a),f=_(s,"families");f.length&&!f.includes("view")&&e("vocabulary-unavailable"),k(s);const l=J(s,a),n=F(s).admitted;(r.legacyPlaces.length>l.resources.places||r.contexts.length>l.resources.acts)&&e("budget");const g=j(r.rootHistory,a,n).admitted;g.some(t=>!t.coverage.includes("*"))&&!f.includes("region")&&e("vocabulary-unavailable");const p=new Set;for(const t of r.legacyPlaces){(!t||!v(t.place)||p.has(t.place)||!Array.isArray(t.history))&&e("snapshot-format"),p.add(t.place),i+=t.history.length,i>o&&e("budget");const d=H(t.place);t.history.some(c=>!m(c)||!E(c,d,"region",g,n))&&e("legacy-authority")}for(const t of r.contexts){(!t||!t.authority||!Array.isArray(t.authority.history))&&e("snapshot-format"),i+=t.authority.history.length,i>o&&e("budget");const d=S(t.authority.checkpoint,"epoch"),c=r.rootHistory.filter(b=>!B(b)||Number(S(b,"epoch"))<=Number(d));JSON.stringify(c)!==JSON.stringify(t.authority.history)&&e("historical-snapshot")}const u=I(JSON.stringify(r.contexts),a,l);return R(s,r.legacyPlaces,r.contexts,u)}h(L,"authenticatedCarrier");async function tt(r,a){try{const{place:o,source:i,snapshot:m,signal:s}=r,f=structuredClone(r.anchor),l=structuredClone(r.reading),n={...r.limits};(!o||typeof o!="string"||!i||typeof i!="string"||!Number.isSafeInteger(n.records)||n.records<1)&&e("context");const g=A({...l,inputs:[...l.inputs,["host/place",y(o)],["host/anchor",y(JSON.stringify(f))],["host/snapshot",m]]},y),p=await N(i,m,{read:a.read,digestBytes:y},n,s);let u,t;try{u=new TextDecoder("utf-8",{fatal:!0}).decode(p),t=JSON.parse(u)}catch{return e("snapshot-format")}JSON.stringify(t)+`
+`!==u&&e("snapshot-format"),s?.aborted&&e("cancelled");const d=L(t,f,n.records),c=y(JSON.stringify(d)+`
+`);return{kind:"fact",value:{place:o,standing:d,reading:g,result:c,commitment:C(g,c,y)}}}catch(o){return{kind:"refuse",code:o instanceof P?o.code:"host/failed",diagnostic:o instanceof Error?o.message:"REFUSE\xB7host/failed"}}}h(tt,"readContextualStandingInProcess");export{tt as readContextualStandingInProcess};

package/dist/host/in-process-root.js

@@ -1,84 +1,6 @@
-import { canonical, parse } from '@lapxo/topos/wire';
-import { readingIdentity, readingReceiptIdentity } from '@lapxo/topos/contract';
-import { readContent } from "../engine/ports.js";
-import { acceptRootRecords } from "../cli/accept.js";
-import { verifiedLegacyActResult } from "../cli/act-result.js";
-import { admissionHistoryAt, admissionAnchor } from "../fold/admission-history.js";
-import { isConfig } from "../fold/claims.js";
-import { sha256, isSha256 } from "./hash.js";
-import { BoundRefusal } from "./refusals.js";
-import { refuseHost as fail } from "./host-controls.js";
-import { ActCommitUnknown } from "./commit-result.js";
-import { requireEffects } from "./read-only.js";
-import { withHostCall } from "./call-context.js";
-import { withActHost } from "../land/act.js";
-/** Snapshot identity, not a new wire, authority algorithm or current permit. */
-export const rootLotSnapshot = (root) => sha256(admissionHistoryAt(root, Number.MAX_SAFE_INTEGER).join('\n') + '\n');
-export async function landRootLotInProcess(context, ports) {
-    const diagnostics = [];
-    let size = 0;
-    let committed;
-    const runtime = structuredClone(ports.runtime), limits = { ...context.limits };
-    return withHostCall({ instrumentName: ports.instrumentName, runtime, output: (stream, text) => { size += new TextEncoder().encode(text).length; if (size > ports.limits.diagnostics)
-            fail('budget'); diagnostics.push({ stream, text }); } }, () => withActHost({ name: ports.instrumentName, report: text => { size += new TextEncoder().encode(text).length; if (size > ports.limits.diagnostics)
-            fail('budget'); diagnostics.push({ stream: 'error', text }); }, signal: context.signal }, async () => {
-        try {
-            requireEffects('Root lot admission');
-            if (!context.place || !ports.root || !ports.instrumentName || !runtime.root || !runtime.entry || !runtime.directory || !['.ts', '.js'].includes(runtime.extension) || !Array.isArray(runtime.lock) || !runtime.lock.length)
-                fail('context');
-            if (limits.records > ports.limits.records || limits.maxBytes > ports.limits.maxBytes || limits.timeoutMs > ports.limits.timeoutMs || !Number.isSafeInteger(limits.records) || limits.records < 1 || !Number.isSafeInteger(ports.limits.diagnostics) || ports.limits.diagnostics < 1)
-                fail('budget');
-            const { place, snapshot, source, digest, signal } = context, reading = structuredClone(context.reading);
-            if (!isSha256(snapshot) || rootLotSnapshot(ports.root) !== snapshot)
-                fail('stale');
-            const anchor = admissionAnchor(ports.root);
-            const identity = readingIdentity({ ...reading, inputs: [...reading.inputs, ['host/place', sha256(place)], ['host/snapshot', snapshot], ['host/anchor', sha256(JSON.stringify(anchor))], ['host/draft', digest], ['host/principal', sha256(ports.signer.keyId)], ['host/operation', sha256(JSON.stringify(['root-lot', limits]))]] }, sha256);
-            const bytes = await readContent(source, digest, { read: ports.read, digestBytes: sha256 }, limits, signal);
-            let text;
-            try {
-                text = new TextDecoder('utf-8', { fatal: true }).decode(bytes);
-            }
-            catch {
-                return fail('snapshot-format');
-            }
-            const records = text.endsWith('\n') ? text.slice(0, -1).split('\n') : [];
-            if (!records.length || records.length > limits.records)
-                fail('budget');
-            for (const line of records) {
-                const parsed = parse(line);
-                if (parsed.kind !== 'fact' || canonical(parsed.value.fields, parsed.value.version) !== line || !isConfig(line) || parsed.value.fields.by !== 'target' || parsed.value.fields.epoch !== undefined || parsed.value.fields.sig !== undefined)
-                    fail('root-lot-format');
-            }
-            if (rootLotSnapshot(ports.root) !== snapshot)
-                fail('stale');
-            const code = await acceptRootRecords(ports.root, { records, keyId: ports.signer.keyId, signer: { name: ports.signer.name, sign: ports.signer.sign, signal }, signal, storage: ports.storage, prepared: ports.prepared, committed: (identity, bundle, status) => { committed = { identity, bundle, status }; } });
-            if (code !== 0 && !committed)
-                return { kind: 'refuse', code: 'host/act', diagnostics };
-            const value = { place, status: committed?.status ?? 'already-held', ...(committed ? { identity: committed.identity, act: verifiedLegacyActResult(ports.root, committed.identity).result } : {}), conformance: code === 0 ? 'complete' : 'refused', reading: identity };
-            const result = sha256(JSON.stringify(value) + '\n');
-            return { kind: 'fact', value: { ...value, result, commitment: readingReceiptIdentity(identity, result, sha256) }, diagnostics };
-        }
-        catch (error) {
-            if (error instanceof ActCommitUnknown)
-                return { kind: 'uncertain', identity: error.identity, code: error.code, diagnostic: error.message, diagnostics };
-            if (committed)
-                return { kind: 'fact', value: { place: context.place, status: committed.status, identity: committed.identity, conformance: 'incomplete' }, diagnostic: error instanceof Error ? error.message : 'post-commit failure', diagnostics };
-            return { kind: 'refuse', code: error instanceof BoundRefusal ? error.code : 'host/failed', diagnostic: error instanceof Error ? error.message : 'REFUSE·host/failed', diagnostics };
-        }
-    }));
-}
-/** Authenticated historical query only; never revives authority or signs. */
-export function recoverRootActInProcess(identity, ports) {
-    return withHostCall({ instrumentName: ports.instrumentName, runtime: structuredClone(ports.runtime), output: () => { } }, () => {
-        try {
-            if (!isSha256(identity))
-                fail('context');
-            const recovered = verifiedLegacyActResult(ports.root, identity);
-            return { kind: 'fact', value: { historical: true, act: recovered.result, bundle: recovered.bundle } };
-        }
-        catch (error) {
-            return { kind: 'refuse', code: error instanceof BoundRefusal ? error.code : 'host/failed', diagnostic: error instanceof Error ? error.message : 'REFUSE·host/failed' };
-        }
-        ;
-    });
-}
+var H=Object.defineProperty;var d=(n,e)=>H(n,"name",{value:e,configurable:!0});import{library11_canonical as T,library11_parse as F}from"../vendor/runtime.js";import{library2_readingIdentity as J,library2_readingReceiptIdentity as L}from"../vendor/runtime.js";import{readContent as M}from"../engine/ports.js";import{acceptRootRecords as O}from"../cli/accept.js";import{verifiedLegacyActResult as I}from"../cli/act-result.js";import{admissionHistoryAt as U,admissionAnchor as j}from"../fold/admission-history.js";import{isConfig as P}from"../fold/claims.js";import{sha256 as s,isSha256 as R}from"./hash.js";import{BoundRefusal as A}from"./refusals.js";import{refuseHost as r}from"./host-controls.js";import{ActCommitUnknown as q}from"./commit-result.js";import{requireEffects as z}from"./read-only.js";import{withHostCall as S}from"./call-context.js";import{withActHost as D}from"../land/act.js";const w=d(n=>s(U(n,Number.MAX_SAFE_INTEGER).join(`
+`)+`
+`),"rootLotSnapshot");async function se(n,e){const i=[];let f=0,o;const m=structuredClone(e.runtime),a={...n.limits};return S({instrumentName:e.instrumentName,runtime:m,output:d((t,l)=>{f+=new TextEncoder().encode(l).length,f>e.limits.diagnostics&&r("budget"),i.push({stream:t,text:l})},"output")},()=>D({name:e.instrumentName,report:d(t=>{f+=new TextEncoder().encode(t).length,f>e.limits.diagnostics&&r("budget"),i.push({stream:"error",text:t})},"report"),signal:n.signal},async()=>{try{z("Root lot admission"),(!n.place||!e.root||!e.instrumentName||!m.root||!m.entry||!m.directory||![".ts",".js"].includes(m.extension)||!Array.isArray(m.lock)||!m.lock.length)&&r("context"),(a.records>e.limits.records||a.maxBytes>e.limits.maxBytes||a.timeoutMs>e.limits.timeoutMs||!Number.isSafeInteger(a.records)||a.records<1||!Number.isSafeInteger(e.limits.diagnostics)||e.limits.diagnostics<1)&&r("budget");const{place:t,snapshot:l,source:C,digest:p,signal:y}=n,b=structuredClone(n.reading);(!R(l)||w(e.root)!==l)&&r("stale");const _=j(e.root),k=J({...b,inputs:[...b.inputs,["host/place",s(t)],["host/snapshot",l],["host/anchor",s(JSON.stringify(_))],["host/draft",p],["host/principal",s(e.signer.keyId)],["host/operation",s(JSON.stringify(["root-lot",a]))]]},s),x=await M(C,p,{read:e.read,digestBytes:s},a,y);let h;try{h=new TextDecoder("utf-8",{fatal:!0}).decode(x)}catch{return r("snapshot-format")}const g=h.endsWith(`
+`)?h.slice(0,-1).split(`
+`):[];(!g.length||g.length>a.records)&&r("budget");for(const u of g){const c=F(u);(c.kind!=="fact"||T(c.value.fields,c.value.version)!==u||!P(u)||c.value.fields.by!=="target"||c.value.fields.epoch!==void 0||c.value.fields.sig!==void 0)&&r("root-lot-format")}w(e.root)!==l&&r("stale");const v=await O(e.root,{records:g,keyId:e.signer.keyId,signer:{name:e.signer.name,sign:e.signer.sign,signal:y},signal:y,storage:e.storage,prepared:e.prepared,committed:d((u,c,B)=>{o={identity:u,bundle:c,status:B}},"committed")});if(v!==0&&!o)return{kind:"refuse",code:"host/act",diagnostics:i};const E={place:t,status:o?.status??"already-held",...o?{identity:o.identity,act:I(e.root,o.identity).result}:{},conformance:v===0?"complete":"refused",reading:k},N=s(JSON.stringify(E)+`
+`);return{kind:"fact",value:{...E,result:N,commitment:L(k,N,s)},diagnostics:i}}catch(t){return t instanceof q?{kind:"uncertain",identity:t.identity,code:t.code,diagnostic:t.message,diagnostics:i}:o?{kind:"fact",value:{place:n.place,status:o.status,identity:o.identity,conformance:"incomplete"},diagnostic:t instanceof Error?t.message:"post-commit failure",diagnostics:i}:{kind:"refuse",code:t instanceof A?t.code:"host/failed",diagnostic:t instanceof Error?t.message:"REFUSE\xB7host/failed",diagnostics:i}}}))}d(se,"landRootLotInProcess");function ae(n,e){return S({instrumentName:e.instrumentName,runtime:structuredClone(e.runtime),output:d(()=>{},"output")},()=>{try{R(n)||r("context");const i=I(e.root,n);return{kind:"fact",value:{historical:!0,act:i.result,bundle:i.bundle}}}catch(i){return{kind:"refuse",code:i instanceof A?i.code:"host/failed",diagnostic:i instanceof Error?i.message:"REFUSE\xB7host/failed"}}})}d(ae,"recoverRootActInProcess");export{se as landRootLotInProcess,ae as recoverRootActInProcess,w as rootLotSnapshot};

package/dist/host/in-process.js

@@ -1,55 +1,4 @@
-import { parse } from '@lapxo/topos/wire';
-import { readingIdentity, readingReceiptIdentity } from '@lapxo/topos/contract';
-import { readContent } from "../engine/ports.js";
-import { sha256, isSha256 } from "./hash.js";
-import { BoundRefusal } from "./refusals.js";
-import { refuseHost as refuse } from "./host-controls.js";
-import { assertStandingView, publicStandingProjection } from "./standing-projection.js";
-/** Uses the existing bounded content port, authority evaluator and projection.
- * It projects the Root component of a complete signed Root wire snapshot; it has no persistence callback,
- * current-root global, console output, process entry point or CLI subprocess.
- * Contextual places and their carriers are not this Root-only projection.
- * The returned commitment is unsigned and is not a paid native receipt.
- */
-export async function readRootStandingInProcess(context, ports) {
-    try {
-        if (!context || typeof context.place !== 'string' || !context.place || typeof context.source !== 'string' || !context.source || !isSha256(context.snapshot))
-            refuse('context');
-        if (context.signal?.aborted)
-            refuse('cancelled');
-        const { place, source, snapshot, signal } = context, limits = { ...context.limits };
-        if (!Number.isSafeInteger(limits.records) || limits.records < 1)
-            refuse('budget');
-        const anchor = structuredClone(context.anchor), reading = structuredClone(context.reading);
-        if (!anchor || anchor.keyClass !== 'authorize' || !anchor.id || !anchor.publicKey || !Array.isArray(anchor.coverage) || !anchor.coverage.length)
-            refuse('context');
-        // Validate the complete declared environment before invoking a host port.
-        readingIdentity(reading, sha256);
-        const identity = readingIdentity({ ...reading, inputs: [...reading.inputs, ['host/place', sha256(place)], ['host/anchor', sha256(JSON.stringify(anchor))], ['host/snapshot', snapshot]] }, sha256);
-        const bytes = await readContent(source, snapshot, { read: ports.read, digestBytes: sha256 }, limits, signal);
-        let text;
-        try {
-            text = new TextDecoder('utf-8', { fatal: true }).decode(bytes);
-        }
-        catch {
-            return refuse('snapshot-format');
-        }
-        const history = text.split('\n').filter(line => line.length > 0);
-        if (history.length > limits.records)
-            refuse('budget');
-        if (!history.length || history.some(line => parse(line).kind !== 'fact'))
-            refuse('snapshot-format');
-        if (signal?.aborted)
-            refuse('cancelled');
-        const standing = publicStandingProjection(history, anchor);
-        assertStandingView(standing);
-        if (signal?.aborted)
-            refuse('cancelled');
-        const result = sha256(standing.join('\n') + (standing.length ? '\n' : ''));
-        return { kind: 'fact', value: { place, rootStanding: standing, reading: identity, result, commitment: readingReceiptIdentity(identity, result, sha256) } };
-    }
-    catch (error) {
-        return { kind: 'refuse', code: error instanceof BoundRefusal ? error.code : 'host/failed', diagnostic: error instanceof Error ? error.message : 'REFUSE·host/failed' };
-    }
-    ;
-}
+var I=Object.defineProperty;var m=(e,d)=>I(e,"name",{value:d,configurable:!0});import{library11_parse as R}from"../vendor/runtime.js";import{library2_readingIdentity as y,library2_readingReceiptIdentity as k}from"../vendor/runtime.js";import{readContent as C}from"../engine/ports.js";import{sha256 as a,isSha256 as v}from"./hash.js";import{BoundRefusal as w}from"./refusals.js";import{refuseHost as r}from"./host-controls.js";import{assertStandingView as E,publicStandingProjection as _}from"./standing-projection.js";async function H(e,d){try{(!e||typeof e.place!="string"||!e.place||typeof e.source!="string"||!e.source||!v(e.snapshot))&&r("context"),e.signal?.aborted&&r("cancelled");const{place:i,source:b,snapshot:g,signal:c}=e,s={...e.limits};(!Number.isSafeInteger(s.records)||s.records<1)&&r("budget");const t=structuredClone(e.anchor),l=structuredClone(e.reading);(!t||t.keyClass!=="authorize"||!t.id||!t.publicKey||!Array.isArray(t.coverage)||!t.coverage.length)&&r("context"),y(l,a);const p=y({...l,inputs:[...l.inputs,["host/place",a(i)],["host/anchor",a(JSON.stringify(t))],["host/snapshot",g]]},a),S=await C(b,g,{read:d.read,digestBytes:a},s,c);let u;try{u=new TextDecoder("utf-8",{fatal:!0}).decode(S)}catch{return r("snapshot-format")}const n=u.split(`
+`).filter(f=>f.length>0);n.length>s.records&&r("budget"),(!n.length||n.some(f=>R(f).kind!=="fact"))&&r("snapshot-format"),c?.aborted&&r("cancelled");const o=_(n,t);E(o),c?.aborted&&r("cancelled");const h=a(o.join(`
+`)+(o.length?`
+`:""));return{kind:"fact",value:{place:i,rootStanding:o,reading:p,result:h,commitment:k(p,h,a)}}}catch(i){return{kind:"refuse",code:i instanceof w?i.code:"host/failed",diagnostic:i instanceof Error?i.message:"REFUSE\xB7host/failed"}}}m(H,"readRootStandingInProcess");export{H as readRootStandingInProcess};

package/dist/host/index.d.ts

@@ -1,15 +1 @@
-/** Native host boundary. Uses the same admission and projection as the CLI. */
-export { readRootStandingInProcess } from './in-process.ts';
-export type { RootStandingHostContext, RootStandingHostResult } from './in-process.ts';
-export { readContextualStandingInProcess } from './in-process-context.ts';
-export { landPlaceActInProcess, recoverPlaceActInProcess } from './in-process-act.ts';
-export type { PlaceActHostContext, PlaceActHostPorts } from './in-process-act.ts';
-export { landRootLotInProcess, recoverRootActInProcess, rootLotSnapshot } from './in-process-root.ts';
-export type { RootLotContext, RootLotPorts } from './in-process-root.ts';
-export { nativeHostInstrument, nativePlaceActReceiver } from './native-receiver.ts';
-export type { NativeHostInstrument } from './native-receiver.ts';
-export type { HostInstrumentRuntime } from './call-context.ts';
-export { nativePlaceActPersistence } from './ports/place-act.ts';
-export type { PlaceActTrust, PlaceActBudget } from './ports/place-act.ts';
-export type { PlaceActPersistence } from './place-act-transaction.ts';
-export type { PublicationStorage } from './ports/publication.ts';
+export {public2_HostInstrumentRuntime as HostInstrumentRuntime,public2_NativeHostInstrument as NativeHostInstrument,public2_NativeReadingIdentityContext as NativeReadingIdentityContext,public2_NativeReadingIdentityResult as NativeReadingIdentityResult,public2_NativeViewIdentityContext as NativeViewIdentityContext,public2_NativeViewIdentityResult as NativeViewIdentityResult,public2_PlaceActBudget as PlaceActBudget,public2_PlaceActHostContext as PlaceActHostContext,public2_PlaceActHostPorts as PlaceActHostPorts,public2_PlaceActPersistence as PlaceActPersistence,public2_PlaceActTrust as PlaceActTrust,public2_PreparedReading as PreparedReading,public2_PublicationStorage as PublicationStorage,public2_ReadingPreparationLimits as ReadingPreparationLimits,public2_ReadingPreparationResult as ReadingPreparationResult,public2_RootLotContext as RootLotContext,public2_RootLotPorts as RootLotPorts,public2_RootStandingHostContext as RootStandingHostContext,public2_RootStandingHostResult as RootStandingHostResult,public2_landPlaceActInProcess as landPlaceActInProcess,public2_landRootLotInProcess as landRootLotInProcess,public2_nativeHostInstrument as nativeHostInstrument,public2_nativePlaceActPersistence as nativePlaceActPersistence,public2_nativePlaceActReceiver as nativePlaceActReceiver,public2_prepareNativeReadingIdentity as prepareNativeReadingIdentity,public2_prepareNativeViewIdentity as prepareNativeViewIdentity,public2_readContextualStandingInProcess as readContextualStandingInProcess,public2_readRootStandingInProcess as readRootStandingInProcess,public2_recoverPlaceActInProcess as recoverPlaceActInProcess,public2_recoverRootActInProcess as recoverRootActInProcess,public2_rootLotSnapshot as rootLotSnapshot} from "../public-types.js";

package/dist/host/index.js

@@ -1,7 +1 @@
-/** Native host boundary. Uses the same admission and projection as the CLI. */
-export { readRootStandingInProcess } from "./in-process.js";
-export { readContextualStandingInProcess } from "./in-process-context.js";
-export { landPlaceActInProcess, recoverPlaceActInProcess } from "./in-process-act.js";
-export { landRootLotInProcess, recoverRootActInProcess, rootLotSnapshot } from "./in-process-root.js";
-export { nativeHostInstrument, nativePlaceActReceiver } from "./native-receiver.js";
-export { nativePlaceActPersistence } from "./ports/place-act.js";
+import{readRootStandingInProcess as o}from"./in-process.js";import{readContextualStandingInProcess as n}from"./in-process-context.js";import{landPlaceActInProcess as c,recoverPlaceActInProcess as s}from"./in-process-act.js";import{landRootLotInProcess as p,recoverRootActInProcess as P,rootLotSnapshot as d}from"./in-process-root.js";import{nativeHostInstrument as m,nativePlaceActReceiver as v}from"./native-receiver.js";import{nativePlaceActPersistence as f}from"./ports/place-act.js";import{prepareNativeReadingIdentity as A,prepareNativeViewIdentity as R}from"./reading-identity.js";export{c as landPlaceActInProcess,p as landRootLotInProcess,m as nativeHostInstrument,f as nativePlaceActPersistence,v as nativePlaceActReceiver,A as prepareNativeReadingIdentity,R as prepareNativeViewIdentity,n as readContextualStandingInProcess,o as readRootStandingInProcess,s as recoverPlaceActInProcess,P as recoverRootActInProcess,d as rootLotSnapshot};

package/dist/host/io.js

@@ -1,11 +1 @@
-/** The host's node surface: kernel folders import here, never `node:`. World reads still go through observeFile. */
-export { spawn, spawnSync } from 'node:child_process';
-export { createHash } from 'node:crypto';
-export { appendFileSync, closeSync, existsSync, linkSync, lstatSync, mkdirSync, mkdtempSync, openSync, readFileSync, readSync, readdirSync, realpathSync, renameSync, rmSync, statSync, writeFileSync, } from 'node:fs';
-export { tmpdir } from 'node:os';
-export { basename, dirname, join, relative, resolve } from 'node:path';
-export { fileURLToPath } from 'node:url';
-export { parentPort, workerData } from 'node:worker_threads';
-export { gzipSync } from 'node:zlib';
-/** UTF-8 encoding is shared with host-free protocol ports. */
-export { encodeUTF8 } from "../engine/encoding.js";
+import{spawn as n,spawnSync as o}from"node:child_process";import{createHash as a}from"node:crypto";import{appendFileSync as p,closeSync as y,existsSync as S,linkSync as m,lstatSync as i,mkdirSync as d,mkdtempSync as f,openSync as l,readFileSync as s,readSync as x,readdirSync as k,realpathSync as w,renameSync as F,rmSync as h,statSync as v,writeFileSync as P}from"node:fs";import{tmpdir as U}from"node:os";import{basename as g,dirname as j,join as z,relative as D,resolve as H}from"node:path";import{fileURLToPath as R}from"node:url";import{parentPort as u,workerData as A}from"node:worker_threads";import{gzipSync as C}from"node:zlib";import{encodeUTF8 as G}from"../engine/encoding.js";export{p as appendFileSync,g as basename,y as closeSync,a as createHash,j as dirname,G as encodeUTF8,S as existsSync,R as fileURLToPath,C as gzipSync,z as join,m as linkSync,i as lstatSync,d as mkdirSync,f as mkdtempSync,l as openSync,u as parentPort,s as readFileSync,x as readSync,k as readdirSync,w as realpathSync,D as relative,F as renameSync,H as resolve,h as rmSync,n as spawn,o as spawnSync,v as statSync,U as tmpdir,A as workerData,P as writeFileSync};