@lapxo/bound 0.2.4 → 0.2.5

package/dist/host/lifetime.js

@@ -1,79 +1 @@
-import { spawn } from 'node:child_process';
-const deadline = BigInt(process.argv[2] ?? '0'), responseBytes = Number(process.argv[3]);
-if (deadline <= 0n || !Number.isSafeInteger(responseBytes) || responseBytes <= 0)
-    throw Error('REFUSE·reader invalid process limits');
-let child, finished = false, failure, size = 0;
-const stdout = [], stderr = [];
-const grouped = process.platform !== 'win32';
-const cancel = () => { if (child?.pid === undefined)
-    return; try {
-    if (grouped)
-        process.kill(-child.pid, 'SIGKILL');
-    else
-        child.kill('SIGKILL');
-}
-catch { } };
-const finish = (status, signal) => {
-    if (finished)
-        return;
-    finished = true;
-    clearTimeout(timer);
-    cancel();
-    child?.stdin?.destroy();
-    child?.stdout?.destroy();
-    child?.stderr?.destroy();
-    process.stdin.destroy();
-    const bytes = failure ? Buffer.alloc(0) : Buffer.concat(stdout);
-    const result = { stdout: bytes.toString('utf8'), stdoutBytes: bytes.toString('base64'), stderr: Buffer.concat(stderr).toString('utf8'), status, signal, ...(failure ? { failure } : {}) };
-    process.stdout.write(JSON.stringify(result));
-};
-const refuse = (why) => { if (failure && why === 'response exceeds declared byte bound' && !failure.includes(why))
-    failure += ' · ' + why;
-else
-    failure ?? (failure = why); finish(null, 'SIGKILL'); };
-// A closed input pipe can precede the queued stderr/close events of an early
-// rejecting child. Cancel immediately, but drain only until the SAME deadline.
-const inputFailed = (why) => { if (finished)
-    return; failure ?? (failure = why); stdout.length = 0; cancel(); child?.stdin?.destroy(); process.stdin.destroy(); if (process.hrtime.bigint() >= deadline)
-    finish(null, 'SIGKILL'); };
-const remaining = Number(deadline - process.hrtime.bigint()) / 1e6;
-const timer = setTimeout(() => refuse('declared timeout exhausted'), Math.max(0, remaining));
-process.once('SIGTERM', () => refuse('interrupted'));
-try {
-    if (remaining <= 0)
-        refuse('declared timeout exhausted');
-    const chunks = [];
-    for await (const chunk of process.stdin) {
-        if (finished)
-            break;
-        chunks.push(Buffer.from(chunk));
-    }
-    if (!finished) {
-        const request = JSON.parse(Buffer.concat(chunks).toString('utf8'));
-        if (request.limits.responseBytes !== responseBytes || !Number.isSafeInteger(request.limits.timeoutMs) || request.limits.timeoutMs <= 0)
-            throw Error('invalid process limits');
-        // Parsing is synchronous; recheck before spawning even if the timer has not
-        // had a turn to run. An expired handoff must never start the command.
-        if (process.hrtime.bigint() >= deadline) {
-            refuse('declared timeout exhausted');
-        }
-        else {
-            child = spawn(request.command, [...request.args], { cwd: request.cwd, env: request.env, detached: grouped, stdio: ['pipe', 'pipe', 'pipe'] });
-            const receive = (items, bytes) => { if (finished)
-                return; size += bytes.length; if (size > responseBytes)
-                refuse('response exceeds declared byte bound');
-            else if (!failure || items === stderr)
-                items.push(bytes); };
-            child.stdout.on('data', (b) => receive(stdout, b));
-            child.stderr.on('data', (b) => receive(stderr, b));
-            child.stdin.on('error', error => inputFailed('input failed: ' + error.message));
-            child.once('error', error => refuse(error.message));
-            child.once('close', finish);
-            child.stdin.end(request.input);
-        }
-    }
-}
-catch {
-    if (!finished)
-        refuse('input unavailable or malformed');
-}
+var I=Object.defineProperty;var d=(s,e)=>I(s,"name",{value:e,configurable:!0});import{spawn as y}from"node:child_process";const u=BigInt(process.argv[2]??"0"),a=Number(process.argv[3]);if(u<=0n||!Number.isSafeInteger(a)||a<=0)throw Error("REFUSE\xB7reader invalid process limits");let t,o=!1,i,g=0;const f=[],l=[],h=process.platform!=="win32",b=d(()=>{if(t?.pid!==void 0)try{h?process.kill(-t.pid,"SIGKILL"):t.kill("SIGKILL")}catch{}},"cancel"),p=d((s,e)=>{if(o)return;o=!0,clearTimeout(v),b(),t?.stdin?.destroy(),t?.stdout?.destroy(),t?.stderr?.destroy(),process.stdin.destroy();const c=i?Buffer.alloc(0):Buffer.concat(f),r={stdout:c.toString("utf8"),stdoutBytes:c.toString("base64"),stderr:Buffer.concat(l).toString("utf8"),status:s,signal:e,...i?{failure:i}:{}};process.stdout.write(JSON.stringify(r))},"finish"),n=d(s=>{i&&s==="response exceeds declared byte bound"&&!i.includes(s)?i+=" \xB7 "+s:i??(i=s),p(null,"SIGKILL")},"refuse"),B=d(s=>{o||(i??(i=s),f.length=0,b(),t?.stdin?.destroy(),process.stdin.destroy(),process.hrtime.bigint()>=u&&p(null,"SIGKILL"))},"inputFailed"),S=Number(u-process.hrtime.bigint())/1e6,v=setTimeout(()=>n("declared timeout exhausted"),Math.max(0,S));process.once("SIGTERM",()=>n("interrupted"));try{S<=0&&n("declared timeout exhausted");const s=[];for await(const e of process.stdin){if(o)break;s.push(Buffer.from(e))}if(!o){const e=JSON.parse(Buffer.concat(s).toString("utf8"));if(e.limits.responseBytes!==a||!Number.isSafeInteger(e.limits.timeoutMs)||e.limits.timeoutMs<=0)throw Error("invalid process limits");if(process.hrtime.bigint()>=u)n("declared timeout exhausted");else{t=y(e.command,[...e.args],{cwd:e.cwd,env:e.env,detached:h,stdio:["pipe","pipe","pipe"]});const c=d((r,m)=>{o||(g+=m.length,g>a?n("response exceeds declared byte bound"):(!i||r===l)&&r.push(m))},"receive");t.stdout.on("data",r=>c(f,r)),t.stderr.on("data",r=>c(l,r)),t.stdin.on("error",r=>B("input failed: "+r.message)),t.once("error",r=>n(r.message)),t.once("close",p),t.stdin.end(e.input)}}}catch{o||n("input unavailable or malformed")}

package/dist/host/located.js

@@ -1,105 +1,6 @@
-var __rewriteRelativeImportExtension = (this && this.__rewriteRelativeImportExtension) || function (path, preserveJsx) {
-    if (typeof path === "string" && /^\.\.?\//.test(path)) {
-        return path.replace(/\.(tsx)$|((?:\.d)?)((?:\.[^./]+?)?)\.([cm]?)ts$/i, function (m, tsx, d, ext, cm) {
-            return tsx ? preserveJsx ? ".jsx" : ".js" : d && (!ext || !cm) ? m : (d + ext + "." + cm.toLowerCase() + "js");
-        });
-    }
-    return path;
-};
-import { readFileSync } from 'node:fs';
-import { join } from 'node:path';
-import { pathToFileURL } from 'node:url';
-import { pinExport, provide } from "./provide.js";
-const wanted = (role) => role === 'reader' ? ['observe', 'run'] : [role];
-const foreign = (role) => ['render', 'receipt', 'observe', 'run'].filter((name) => !wanted(role).includes(name));
-const isFn = (module, name) => typeof module[name] === 'function';
-const text = (error) => (error instanceof Error ? error.message : String(error)).replace(/\s+/g, ' ').trim();
-/**
- * Wire and capsule of the world, from `dep/topos` (or the lock's `uses/topos` pin). The host never spells where that
- * package lies.
- */
-const sdk = async () => {
-    provide();
-    const [wireAt, capsuleAt] = [pinExport('topos', './wire'), pinExport('topos', './capsule')];
-    if (!wireAt || !capsuleAt)
-        throw new Error('REFUSE·pin dep/topos names no wire or capsule');
-    const [wire, capsule] = await Promise.all([import(__rewriteRelativeImportExtension(pathToFileURL(wireAt).href)), import(__rewriteRelativeImportExtension(pathToFileURL(capsuleAt).href))]);
-    return {
-        CAPSULE: String(wire['CAPSULE'] ?? ''),
-        PROTOCOL: String(wire['PROTOCOL'] ?? ''),
-        parse: wire['parse'],
-        declarationOf: capsule['declarationOf'],
-        readers: capsule['readers'],
-        receiptShell: capsule['receiptShell'],
-        shell: capsule['shell'],
-    };
-};
-/**
- * The host loads a world from its lock: the lock read once, each region imported from its one file by name and role into
- * the shell of its kind. A region that fails is one line on stderr and is left out; the regions that loaded still form
- * the shell. A world with no region of a kind has no shell of it. `load` is the host's child entry, the same load with
- * its places read from the arguments the host spawned it with.
- */
-/** A capsule that ships one render module: the host calls it per region and hands it the lines. The module does not read. */
-const pagesOf = async (root, file) => {
-    const { CAPSULE, PROTOCOL, declarationOf, shell } = await sdk();
-    const lines = readFileSync(join(root, CAPSULE), 'utf8').split('\n').filter((line) => line.startsWith(PROTOCOL));
-    const { regions } = declarationOf(lines);
-    const module = await import(__rewriteRelativeImportExtension(pathToFileURL(join(root, file)).href));
-    const render = module['render'] ?? module['default']?.['render'];
-    if (typeof render !== 'function')
-        return {};
-    const held = Object.fromEntries(Object.entries(regions).map(([name, reads]) => [name, {
-            reads,
-            region: (asked) => render({ ...asked, region: name }),
-        }]));
-    return held && Object.keys(held).length ? { render: shell(held) } : {};
-};
-export const locate = async (root, dir, ext) => {
-    if (ext === 'render')
-        return pagesOf(root, dir);
-    const { CAPSULE, PROTOCOL, parse, declarationOf, readers, receiptShell, shell } = await sdk();
-    const lines = readFileSync(join(root, CAPSULE), 'utf8').split('\n').filter((line) => line.startsWith(PROTOCOL));
-    const field = (line, name) => ((got) => (got.kind === 'fact' ? got.value.fields[name] ?? '' : ''))(parse(line));
-    const { regions, writes } = declarationOf(lines);
-    const reader = new Set(lines.filter((line) => field(line, 'measure') === 'writes').map((line) => field(line, 'scope').slice('region/'.length)));
-    const kind = (name) => (reader.has(name) ? 'reader' : writes[name] ?? '');
-    const region = async (name, reads, role) => {
-        let module;
-        try {
-            module = await import(__rewriteRelativeImportExtension(pathToFileURL(join(root, dir, `${name}${ext}`)).href));
-        }
-        catch (error) {
-            process.stderr.write(`LOAD     ${name} · module error · ${text(error)}\n`);
-            return undefined;
-        }
-        const has = wanted(role).filter((key) => isFn(module, key));
-        const exported = foreign(role).filter((key) => isFn(module, key));
-        if (!has.length && exported.length) {
-            process.stderr.write(`LOAD     ${name} · role mismatch · ${role} exports ${exported.join('|')}\n`);
-            return undefined;
-        }
-        if (!has.length) {
-            process.stderr.write(`LOAD     ${name} · missing export · ${wanted(role)[0]}\n`);
-            return undefined;
-        }
-        const picked = role === 'reader' ? { observe: module['observe'], run: module['run'] } : { region: module[role] };
-        return [name, { reads, ...picked }];
-    };
-    const loaded = async (role) => {
-        const held = [];
-        for (const [name, reads] of Object.entries(regions)) {
-            if (kind(name) !== role)
-                continue;
-            const row = await region(name, reads, role);
-            if (row)
-                held.push(row);
-        }
-        return held.length ? Object.fromEntries(held) : undefined;
-    };
-    const render = await loaded('render');
-    const receipt = await loaded('receipt');
-    const reading = await loaded('reader');
-    return { render: render && shell(render), receipt: receipt && receiptShell(receipt), ...(reading ? readers(reading) : {}) };
-};
-export const load = () => locate(process.argv[3] ?? '', process.argv[4] ?? '', process.argv[5] ?? '');
+var I=Object.defineProperty;var n=(e,t)=>I(e,"name",{value:t,configurable:!0});var m=function(e,t){return typeof e=="string"&&/^\.\.?\//.test(e)?e.replace(/\.(tsx)$|((?:\.d)?)((?:\.[^./]+?)?)\.([cm]?)ts$/i,function(i,o,d,p,f){return o?t?".jsx":".js":d&&(!p||!f)?i:d+p+"."+f.toLowerCase()+"js"}):e};import{readFileSync as P}from"node:fs";import{join as E}from"node:path";import{pathToFileURL as L}from"node:url";import{pinExport as R,provide as W}from"./provide.js";const j=n(e=>e==="reader"?["observe","run"]:[e],"wanted"),q=n(e=>["render","receipt","observe","run"].filter(t=>!j(e).includes(t)),"foreign"),U=n((e,t)=>typeof e[t]=="function","isFn"),z=n(e=>(e instanceof Error?e.message:String(e)).replace(/\s+/g," ").trim(),"text"),k=n(async()=>{W();const[e,t]=[R("topos","./wire"),R("topos","./capsule")];if(!e||!t)throw new Error("REFUSE\xB7pin dep/topos names no wire or capsule");const[i,o]=await Promise.all([import(m(L(e).href)),import(m(L(t).href))]);return{CAPSULE:String(i.CAPSULE??""),PROTOCOL:String(i.PROTOCOL??""),parse:i.parse,declarationOf:o.declarationOf,readers:o.readers,receiptShell:o.receiptShell,shell:o.shell}},"sdk"),B=n(async(e,t)=>{const{CAPSULE:i,PROTOCOL:o,declarationOf:d,shell:p}=await k(),f=P(E(e,i),"utf8").split(`
+`).filter(a=>a.startsWith(o)),{regions:S}=d(f),g=await import(m(L(E(e,t)).href)),O=g.render??g.default?.render;if(typeof O!="function")return{};const u=Object.fromEntries(Object.entries(S).map(([a,v])=>[a,{reads:v,region:n(y=>O({...y,region:a}),"region")}]));return u&&Object.keys(u).length?{render:p(u)}:{}},"pagesOf"),G=n(async(e,t,i)=>{if(i==="render")return B(e,t);const{CAPSULE:o,PROTOCOL:d,parse:p,declarationOf:f,readers:S,receiptShell:g,shell:O}=await k(),u=P(E(e,o),"utf8").split(`
+`).filter(r=>r.startsWith(d)),a=n((r,l)=>(s=>s.kind==="fact"?s.value.fields[l]??"":"")(p(r)),"field"),{regions:v,writes:y}=f(u),T=new Set(u.filter(r=>a(r,"measure")==="writes").map(r=>a(r,"scope").slice(7))),F=n(r=>T.has(r)?"reader":y[r]??"","kind"),_=n(async(r,l,s)=>{let c;try{c=await import(m(L(E(e,t,`${r}${i}`)).href))}catch(w){process.stderr.write(`LOAD     ${r} \xB7 module error \xB7 ${z(w)}
+`);return}const h=j(s).filter(w=>U(c,w)),C=q(s).filter(w=>U(c,w));if(!h.length&&C.length){process.stderr.write(`LOAD     ${r} \xB7 role mismatch \xB7 ${s} exports ${C.join("|")}
+`);return}if(!h.length){process.stderr.write(`LOAD     ${r} \xB7 missing export \xB7 ${j(s)[0]}
+`);return}const D=s==="reader"?{observe:c.observe,run:c.run}:{region:c[s]};return[r,{reads:l,...D}]},"region"),$=n(async r=>{const l=[];for(const[s,c]of Object.entries(v)){if(F(s)!==r)continue;const h=await _(s,c,r);h&&l.push(h)}return l.length?Object.fromEntries(l):void 0},"loaded"),b=await $("render"),x=await $("receipt"),A=await $("reader");return{render:b&&O(b),receipt:x&&g(x),...A?S(A):{}}},"locate"),Q=n(()=>G(process.argv[3]??"",process.argv[4]??"",process.argv[5]??""),"load");export{Q as load,G as locate};

package/dist/host/native/bounded-file.js

@@ -1,32 +1 @@
-import fs from 'node:fs';
-/** The opened descriptor is bounded before allocation/read. Growth after fstat
- * is detected with one sentinel byte; no oversized buffer reaches decode/hash.
- */
-export function readBoundedFile(path, remaining, coordinate) {
-    if (!Number.isSafeInteger(remaining) || remaining < 0)
-        throw Error('REFUSE·native file missing byte budget ' + coordinate);
-    const fd = fs.openSync(path, 'r');
-    try {
-        const stat = fs.fstatSync(fd);
-        if (!stat.isFile() || !Number.isSafeInteger(stat.size) || stat.size > remaining)
-            throw Error('REFUSE·native file byte budget before read ' + coordinate);
-        const bytes = Buffer.alloc(stat.size);
-        let offset = 0;
-        while (offset < bytes.length) {
-            const count = fs.readSync(fd, bytes, offset, bytes.length - offset, null);
-            if (!count)
-                throw Error('REFUSE·native file changed during read ' + coordinate);
-            offset += count;
-        }
-        if (fs.readSync(fd, Buffer.alloc(1), 0, 1, null) !== 0)
-            throw Error('REFUSE·native file grew during read ' + coordinate);
-        return bytes;
-    }
-    finally {
-        fs.closeSync(fd);
-    }
-}
-export function readBoundedBatch(paths, budget) {
-    let bytes = 0;
-    return paths.map(file => { const data = readBoundedFile(file.path, budget - bytes, file.coordinate); bytes += data.length; return data; });
-}
+var u=Object.defineProperty;var a=(o,e)=>u(o,"name",{value:e,configurable:!0});import f from"node:fs";function c(o,e,t){if(!Number.isSafeInteger(e)||e<0)throw Error("REFUSE\xB7native file missing byte budget "+t);const r=f.openSync(o,"r");try{const n=f.fstatSync(r);if(!n.isFile()||!Number.isSafeInteger(n.size)||n.size>e)throw Error("REFUSE\xB7native file byte budget before read "+t);const i=Buffer.alloc(n.size);let l=0;for(;l<i.length;){const s=f.readSync(r,i,l,i.length-l,null);if(!s)throw Error("REFUSE\xB7native file changed during read "+t);l+=s}if(f.readSync(r,Buffer.alloc(1),0,1,null)!==0)throw Error("REFUSE\xB7native file grew during read "+t);return i}finally{f.closeSync(r)}}a(c,"readBoundedFile");function h(o,e){let t=0;return o.map(r=>{const n=c(r.path,e-t,r.coordinate);return t+=n.length,n})}a(h,"readBoundedBatch");export{h as readBoundedBatch,c as readBoundedFile};

package/dist/host/native/command.js

@@ -1,91 +1 @@
-import { spawn } from 'node:child_process';
-import { channel } from 'node:diagnostics_channel';
-import { isAbsolute } from 'node:path';
-import { checkCommandPort, commandRequest, commandResponse } from '@lapxo/topos/contract';
-import { requireEffects } from "../read-only.js";
-import { assertNativeRuntime } from "./runtime.js";
-import { scheduleDeadline } from "./deadline.js";
-const rejectedCommand = channel('bound.command.refusal');
-/** macOS prototype: bounded async invocation with POSIX child-group cancellation.
- * No acquisition or persistence on prospective paths; no partial success frames.
- * Host callbacks are trusted admission/verification operations, never signatures
- * or authority assertions supplied by the command's own output. */
-export async function executeLot(options) {
-    const start = process.hrtime.bigint();
-    const { host, signal, phase, accepts } = options;
-    // Admitted semantic configuration is snapshotted for the whole invocation;
-    // mutations of a caller's delivery object cannot alter checks mid-flight.
-    const port = Object.freeze({ ...options.port, closure: Object.freeze([...options.port.closure]), environment: Object.freeze([...options.port.environment]) });
-    const lot = Object.freeze({ ...options.lot, requests: Object.freeze([...options.lot.requests]) });
-    const environment = Object.freeze({ ...options.environment });
-    assertNativeRuntime(environment, []);
-    const refuse = (why) => { throw Error(`REFUSE·port ${port.coordinate} ${why}`); };
-    if (phase !== 'act')
-        refuse('invocation forbidden during ' + phase);
-    requireEffects('command ' + port.coordinate);
-    if (signal?.aborted)
-        refuse('interrupted before invocation');
-    checkCommandPort(port, host);
-    const deadline = start + BigInt(port.timeoutMs) * 1000000n;
-    const resolved = host.resolve(port), invocation = Object.freeze({ ...resolved, args: Object.freeze([...resolved.args]) });
-    if (!isAbsolute(invocation.command) || !isAbsolute(invocation.cwd))
-        refuse('host invocation needs absolute coordinates');
-    if (host.loaderClosure(port, invocation) !== 'verified')
-        refuse('runtime-loader closure unmeasured');
-    const names = Object.keys(environment).sort(), declared = [...new Set(port.environment)].sort();
-    if (names.length !== declared.length || names.some((name, index) => name !== declared[index]) || names.some(name => typeof environment[name] !== 'string' || environment[name].includes('\0')))
-        refuse('environment differs from declared handoff');
-    const frame = commandRequest(port, lot);
-    const envelope = invocation.hostEnvelope;
-    if (envelope && (!Number.isSafeInteger(invocation.envelopeBytes) || invocation.envelopeBytes < 1 || envelope.byteLength > invocation.envelopeBytes))
-        refuse('host envelope byte resources');
-    if (process.hrtime.bigint() >= deadline)
-        refuse('timeout before invocation');
-    if (signal?.aborted)
-        refuse('interrupted before invocation');
-    const result = await new Promise((resolve, reject) => {
-        const child = spawn(invocation.command, [...invocation.args], { cwd: invocation.cwd, env: { ...environment }, shell: false, detached: false, stdio: envelope ? ['pipe', 'pipe', 'pipe', 'pipe'] : ['pipe', 'pipe', 'pipe'] });
-        const stdout = [], stderr = [];
-        let bytes = 0, why, done = false;
-        const stop = (cause) => { if (why)
-            return; why = cause; try {
-            child.kill('SIGKILL');
-        }
-        catch { } child.stdin.destroy(); if (envelope)
-            child.stdio[3]?.destroy(); };
-        const cancelTimer = scheduleDeadline(deadline, () => stop('timeout'));
-        const abort = () => stop('interrupted');
-        signal?.addEventListener('abort', abort, { once: true });
-        if (signal?.aborted)
-            abort();
-        const collect = (target, chunk, channel) => { if (why)
-            return; bytes += chunk.length; if (bytes > port.responseBytes) {
-            stop('response-bytes exceeded');
-            return;
-        } if (channel === 'stderr' && port.stderr === 'reject') {
-            rejectedCommand.publish({ coordinate: port.coordinate, stderr: chunk.subarray(0, Math.min(port.responseBytes, 1024)).toString('utf8') });
-            stop('stderr forbidden');
-            return;
-        } target.push(chunk); };
-        child.stdout.on('data', (chunk) => collect(stdout, chunk, 'stdout'));
-        child.stderr.on('data', (chunk) => collect(stderr, chunk, 'stderr'));
-        child.stdin.on('error', () => stop('request handoff failed'));
-        const finish = (status, error) => { if (done)
-            return; done = true; cancelTimer(); signal?.removeEventListener('abort', abort); if (error || why) {
-            reject(Error(`REFUSE·port ${port.coordinate} ${why ?? error.message}`));
-            return;
-        } resolve({ status, interrupted: false, stdout: Buffer.concat(stdout).toString('utf8'), stderr: Buffer.concat(stderr).toString('utf8') }); };
-        child.once('error', error => finish(null, error));
-        child.once('close', status => finish(status));
-        if (envelope) {
-            const pipe = child.stdio[3];
-            const header = Buffer.alloc(8);
-            header.writeBigUInt64BE(BigInt(envelope.byteLength));
-            pipe.on('error', () => stop('host envelope handoff failed'));
-            pipe.end(Buffer.concat([header, Buffer.from(envelope)]));
-        }
-        child.stdin.end(frame);
-    });
-    const members = commandResponse(port, lot, result, accepts);
-    return { members, stderr: result.stderr, invocations: 1 };
-}
+var _=Object.defineProperty;var a=(n,p)=>_(n,"name",{value:p,configurable:!0});import{spawn as k}from"node:child_process";import{channel as F}from"node:diagnostics_channel";import{isAbsolute as C}from"node:path";import{library2_checkCommandPort as M,library2_commandRequest as N,library2_commandResponse as A}from"../../vendor/runtime.js";import{requireEffects as D}from"../read-only.js";import{assertNativeRuntime as G}from"./runtime.js";import{scheduleDeadline as K}from"./deadline.js";const T=F("bound.command.refusal");async function te(n){const p=process.hrtime.bigint(),{host:b,signal:m,phase:y,accepts:$}=n,t=Object.freeze({...n.port,closure:Object.freeze([...n.port.closure]),environment:Object.freeze([...n.port.environment])}),B=Object.freeze({...n.lot,requests:Object.freeze([...n.lot.requests])}),l=Object.freeze({...n.environment});G(l,[]);const i=a(c=>{throw Error(`REFUSE\xB7port ${t.coordinate} ${c}`)},"refuse");y!=="act"&&i("invocation forbidden during "+y),D("command "+t.coordinate),m?.aborted&&i("interrupted before invocation"),M(t,b);const j=p+BigInt(t.timeoutMs)*1000000n,E=b.resolve(t),r=Object.freeze({...E,args:Object.freeze([...E.args])});(!C(r.command)||!C(r.cwd))&&i("host invocation needs absolute coordinates"),b.loaderClosure(t,r)!=="verified"&&i("runtime-loader closure unmeasured");const h=Object.keys(l).sort(),w=[...new Set(t.environment)].sort();(h.length!==w.length||h.some((c,v)=>c!==w[v])||h.some(c=>typeof l[c]!="string"||l[c].includes("\0")))&&i("environment differs from declared handoff");const x=N(t,B),d=r.hostEnvelope;d&&(!Number.isSafeInteger(r.envelopeBytes)||r.envelopeBytes<1||d.byteLength>r.envelopeBytes)&&i("host envelope byte resources"),process.hrtime.bigint()>=j&&i("timeout before invocation"),m?.aborted&&i("interrupted before invocation");const O=await new Promise((c,v)=>{const o=k(r.command,[...r.args],{cwd:r.cwd,env:{...l},shell:!1,detached:!1,stdio:d?["pipe","pipe","pipe","pipe"]:["pipe","pipe","pipe"]}),z=[],S=[];let L=0,u,R=!1;const f=a(e=>{if(!u){u=e;try{o.kill("SIGKILL")}catch{}o.stdin.destroy(),d&&o.stdio[3]?.destroy()}},"stop"),P=K(j,()=>f("timeout")),g=a(()=>f("interrupted"),"abort");m?.addEventListener("abort",g,{once:!0}),m?.aborted&&g();const q=a((e,s,U)=>{if(!u){if(L+=s.length,L>t.responseBytes){f("response-bytes exceeded");return}if(U==="stderr"&&t.stderr==="reject"){T.publish({coordinate:t.coordinate,stderr:s.subarray(0,Math.min(t.responseBytes,1024)).toString("utf8")}),f("stderr forbidden");return}e.push(s)}},"collect");o.stdout.on("data",e=>q(z,e,"stdout")),o.stderr.on("data",e=>q(S,e,"stderr")),o.stdin.on("error",()=>f("request handoff failed"));const I=a((e,s)=>{if(!R){if(R=!0,P(),m?.removeEventListener("abort",g),s||u){v(Error(`REFUSE\xB7port ${t.coordinate} ${u??s.message}`));return}c({status:e,interrupted:!1,stdout:Buffer.concat(z).toString("utf8"),stderr:Buffer.concat(S).toString("utf8")})}},"finish");if(o.once("error",e=>I(null,e)),o.once("close",e=>I(e)),d){const e=o.stdio[3],s=Buffer.alloc(8);s.writeBigUInt64BE(BigInt(d.byteLength)),e.on("error",()=>f("host envelope handoff failed")),e.end(Buffer.concat([s,Buffer.from(d)]))}o.stdin.end(x)});return{members:A(t,B,O,$),stderr:O.stderr,invocations:1}}a(te,"executeLot");export{te as executeLot};

package/dist/host/native/control-bridge-worker.js

@@ -1,88 +1,2 @@
-/** Sealed Root control code: one fresh custodian connection per request. */
-import { parentPort, workerData } from 'node:worker_threads';
-import { createConnection } from 'node:net';
-const { endpoint, deadlineMs, shared, inputBytes, outputBytes } = workerData;
-const port = parentPort;
-if (!port)
-    throw Error('REFUSE·Root control transport parent absent');
-const header = new Int32Array(shared, 0, 8), input = new Uint8Array(shared, 32, inputBytes), output = new Uint8Array(shared, 32 + inputBytes, outputBytes);
-const initial = Math.min(endpoint.timeoutMs, deadlineMs - Date.now());
-const deadline = process.hrtime.bigint() + BigInt(Math.max(0, initial)) * 1000000n;
-const remaining = () => Math.max(0, Number((deadline - process.hrtime.bigint() + 999999n) / 1000000n));
-let busy = false, red, active;
-function finish(state, bytes) {
-    if (bytes.byteLength > outputBytes) {
-        state = 3;
-        bytes = Buffer.from('REFUSE·reply bytes').subarray(0, outputBytes);
-    }
-    output.set(bytes);
-    Atomics.store(header, 3, bytes.byteLength);
-    Atomics.store(header, 0, state);
-    Atomics.notify(header, 0);
-}
-// Timer slices never widen the original monotonic deadline.
-let timer;
-function arm() {
-    const left = remaining();
-    if (left > 0) {
-        timer = setTimeout(arm, Math.min(left, 2147483647));
-        timer.unref();
-        return;
-    }
-    red ?? (red = 'REFUSE·parent deadline');
-    active?.destroy(Error(red));
-    if (Atomics.load(header, 0) === 1)
-        finish(3, Buffer.from(red).subarray(0, outputBytes));
-    port.close();
-}
-arm();
-port.on('close', () => { clearTimeout(timer); active?.destroy(); });
-port.on('message', async (message) => {
-    if (busy || red || message !== Atomics.load(header, 1) || Atomics.load(header, 0) !== 1) {
-        red ?? (red = 'REFUSE·sequence/state');
-        finish(3, Buffer.from(red).subarray(0, outputBytes));
-        return;
-    }
-    busy = true;
-    try {
-        const length = Atomics.load(header, 2);
-        if (length < 1 || length > inputBytes)
-            throw Error('REFUSE·request bytes');
-        if (remaining() <= 0)
-            throw Error('REFUSE·parent deadline');
-        const frame = Buffer.from(input.slice(0, length));
-        const bytes = await new Promise((resolve, reject) => {
-            const socket = createConnection(endpoint.socket);
-            active = socket;
-            const chunks = [];
-            let size = 0, done = false;
-            const end = (error) => { if (done)
-                return; done = true; if (error)
-                reject(error);
-            else
-                resolve(Buffer.concat(chunks)); };
-            socket.once('connect', () => socket.write(Buffer.concat([frame, Buffer.from('\n')])));
-            socket.on('data', chunk => { size += chunk.length; if (size > outputBytes)
-                socket.destroy(Error('REFUSE·reply bytes'));
-            else
-                chunks.push(chunk); });
-            socket.once('error', end);
-            socket.once('close', () => end());
-        });
-        active = undefined;
-        if (!bytes.length)
-            throw Error('REFUSE·interrupted before reply');
-        if (remaining() <= 0)
-            throw Error('REFUSE·parent deadline');
-        busy = false;
-        finish(2, bytes);
-    }
-    catch (error) {
-        active = undefined;
-        red ?? (red = error instanceof Error ? error.message : String(error));
-        busy = false;
-        finish(3, Buffer.from(red).subarray(0, outputBytes));
-    }
-});
-Atomics.store(header, 5, 1);
-Atomics.notify(header, 5);
+var F=Object.defineProperty;var a=(r,e)=>F(r,"name",{value:e,configurable:!0});import{parentPort as M,workerData as k}from"node:worker_threads";import{createConnection as q}from"node:net";const{endpoint:A,deadlineMs:x,shared:l,inputBytes:d,outputBytes:s}=k,c=M;if(!c)throw Error("REFUSE\xB7Root control transport parent absent");const o=new Int32Array(l,0,8),D=new Uint8Array(l,32,d),I=new Uint8Array(l,32+d,s),L=Math.min(A.timeoutMs,x-Date.now()),P=process.hrtime.bigint()+BigInt(Math.max(0,L))*1000000n,E=a(()=>Math.max(0,Number((P-process.hrtime.bigint()+999999n)/1000000n)),"remaining");let u=!1,t,f;function m(r,e){e.byteLength>s&&(r=3,e=Buffer.from("REFUSE\xB7reply bytes").subarray(0,s)),I.set(e),Atomics.store(o,3,e.byteLength),Atomics.store(o,0,r),Atomics.notify(o,0)}a(m,"finish");let y;function B(){const r=E();if(r>0){y=setTimeout(B,Math.min(r,2147483647)),y.unref();return}t??(t="REFUSE\xB7parent deadline"),f?.destroy(Error(t)),Atomics.load(o,0)===1&&m(3,Buffer.from(t).subarray(0,s)),c.close()}a(B,"arm"),B(),c.on("close",()=>{clearTimeout(y),f?.destroy()}),c.on("message",async r=>{if(u||t||r!==Atomics.load(o,1)||Atomics.load(o,0)!==1){t??(t="REFUSE\xB7sequence/state"),m(3,Buffer.from(t).subarray(0,s));return}u=!0;try{const e=Atomics.load(o,2);if(e<1||e>d)throw Error("REFUSE\xB7request bytes");if(E()<=0)throw Error("REFUSE\xB7parent deadline");const U=Buffer.from(D.slice(0,e)),h=await new Promise((R,S)=>{const n=q(A.socket);f=n;const p=[];let b=0,w=!1;const g=a(i=>{w||(w=!0,i?S(i):R(Buffer.concat(p)))},"end");n.once("connect",()=>n.write(Buffer.concat([U,Buffer.from(`
+`)]))),n.on("data",i=>{b+=i.length,b>s?n.destroy(Error("REFUSE\xB7reply bytes")):p.push(i)}),n.once("error",g),n.once("close",()=>g())});if(f=void 0,!h.length)throw Error("REFUSE\xB7interrupted before reply");if(E()<=0)throw Error("REFUSE\xB7parent deadline");u=!1,m(2,h)}catch(e){f=void 0,t??(t=e instanceof Error?e.message:String(e)),u=!1,m(3,Buffer.from(t).subarray(0,s))}}),Atomics.store(o,5,1),Atomics.notify(o,5);

package/dist/host/native/control-bridge.js

@@ -1,110 +1 @@
-import { sha256 as digest } from "../hash.js";
-/** Root-fixed synchronous transport. It retains no grants or command results. */
-import { Worker, isMainThread } from 'node:worker_threads';
-import { readBoundedFile } from "./bounded-file.js";
-import { remainingDeadlineMs } from "./deadline.js";
-const FixedWorker = Worker;
-const HEADER_BYTES = 32;
-let controlWorkerOccupied = false;
-export function createFixedControlBridge(inputBinding) {
-    // @1 is one main-thread control worker per OS process, never a WorldWorker grant.
-    if (!isMainThread)
-        throw Error('REFUSE·Root control transport requires main-thread realm');
-    const refuse = (why) => { throw Error('REFUSE·Root control transport ' + why); };
-    const integer = (value) => Number.isSafeInteger(value) && value > 0;
-    const sourceBytes = inputBinding.workerBytes;
-    const workerSelection = Object.freeze({ ...inputBinding.worker });
-    if (!(sourceBytes instanceof Uint8Array) || !workerSelection.coordinate || !integer(workerSelection.bytes) || sourceBytes.byteLength !== workerSelection.bytes)
-        refuse('selected worker bytes/type bound differs before copy');
-    const binding = Object.freeze({ ...inputBinding,
-        endpoint: Object.freeze({ ...inputBinding.endpoint }), resources: Object.freeze({ ...inputBinding.resources }),
-        runtime: Object.freeze({ ...inputBinding.runtime }), worker: workerSelection,
-        workerBytes: Buffer.from(sourceBytes) });
-    const { endpoint, resources, runtime, worker: selected } = binding;
-    if (!selected.coordinate || !integer(selected.bytes) || binding.workerBytes.byteLength !== selected.bytes || digest(binding.workerBytes) !== selected.digest)
-        refuse('selected worker bytes differ');
-    if (runtime.path !== process.execPath || !integer(runtime.bytes) || digest(readBoundedFile(runtime.path, runtime.bytes, runtime.path)) !== runtime.digest)
-        refuse('selected runtime bytes differ');
-    if (![endpoint.timeoutMs, endpoint.responseBytes, endpoint.deadlineMs, binding.deadlineMs].every(integer) || binding.deadlineMs > endpoint.deadlineMs)
-        refuse('parent time/byte resource absent or widened');
-    // host-control-transport@1 encodes each byte length in a signed Int32 cell.
-    // Refuse an incompatible declaration; never wrap or clamp its bound.
-    if (resources.inputBytes > 2147483647 || resources.outputBytes > 2147483647)
-        refuse('host-control-transport@1 signed Int32 length representation');
-    const sharedBytes = HEADER_BYTES + resources.inputBytes + resources.outputBytes;
-    if (!Object.values(resources).every(integer) || !Number.isSafeInteger(sharedBytes) || resources.inputBytes > endpoint.responseBytes || resources.outputBytes > endpoint.responseBytes || sharedBytes > resources.sharedBytes)
-        refuse('shared/input/output resource absent or exceeded');
-    const remainingMs = Math.min(endpoint.timeoutMs, binding.deadlineMs - Date.now());
-    if (remainingMs <= 0)
-        refuse('parent deadline');
-    const deadline = process.hrtime.bigint() + BigInt(remainingMs) * 1000000n;
-    const remaining = remainingDeadlineMs.bind(undefined, deadline);
-    if (controlWorkerOccupied)
-        refuse('one live main-thread control worker resource exhausted');
-    let shared;
-    try {
-        shared = new SharedArrayBuffer(sharedBytes);
-    }
-    catch {
-        return refuse('shared resource allocation');
-    }
-    const header = new Int32Array(shared, 0, 8), input = new Uint8Array(shared, HEADER_BYTES, resources.inputBytes), output = new Uint8Array(shared, HEADER_BYTES + resources.inputBytes, resources.outputBytes);
-    // Independently sealed bytes are immutable here. A payload cannot select a path or verifier.
-    const code = Buffer.from(binding.workerBytes).toString('base64');
-    controlWorkerOccupied = true;
-    let worker;
-    try {
-        worker = new FixedWorker(new URL('data:text/javascript;base64,' + code), { execArgv: [], env: {}, workerData: { endpoint: { ...endpoint }, deadlineMs: binding.deadlineMs, shared, inputBytes: resources.inputBytes, outputBytes: resources.outputBytes } });
-    }
-    catch {
-        controlWorkerOccupied = false;
-        return refuse('worker construction interrupted');
-    }
-    let termination;
-    const stop = () => termination ?? (termination = worker.terminate().finally(() => { controlWorkerOccupied = false; }));
-    worker.once('exit', () => { controlWorkerOccupied = false; });
-    worker.unref();
-    let red, closed = false, sequence = 0;
-    const fail = (why) => { red ?? (red = 'REFUSE·Root control transport ' + why); void stop(); throw Error(red); };
-    // Error events still need a listener when a synchronous wait prevents JS callbacks.
-    worker.on('error', error => { red ?? (red = 'REFUSE·Root control transport worker interrupted: ' + error.message); });
-    if (Atomics.load(header, 5) !== 1 && Atomics.wait(header, 5, 0, remaining()) === 'timed-out')
-        fail('startup deadline/interruption');
-    return {
-        exchange(frame) {
-            if (red)
-                throw Error(red);
-            if (closed)
-                fail('closed');
-            if (remaining() <= 0)
-                fail('parent deadline');
-            if (typeof frame !== 'string' || !frame.length || Buffer.byteLength(frame, 'utf8') > resources.inputBytes)
-                fail('request bytes before copy');
-            const bytes = Buffer.from(frame, 'utf8');
-            if (Atomics.load(header, 0) !== 0 || sequence >= 2147483647)
-                fail('overlapping request/sequence');
-            input.set(bytes);
-            Atomics.store(header, 2, bytes.length);
-            Atomics.store(header, 1, ++sequence);
-            Atomics.store(header, 0, 1);
-            worker.postMessage(sequence);
-            if (Atomics.wait(header, 0, 1, remaining()) === 'timed-out' || remaining() <= 0)
-                fail('deadline/interruption');
-            const state = Atomics.load(header, 0), length = Atomics.load(header, 3);
-            if (length < 1 || length > resources.outputBytes)
-                fail('reply bytes');
-            let reply;
-            try {
-                reply = new TextDecoder('utf-8', { fatal: true }).decode(output.slice(0, length));
-            }
-            catch {
-                return fail('reply encoding');
-            }
-            if (state !== 2)
-                fail(reply);
-            Atomics.store(header, 0, 0);
-            return reply;
-        },
-        async close() { closed = true; await stop(); }
-    };
-}
+var D=Object.defineProperty;var f=(n,r)=>D(n,"name",{value:r,configurable:!0});import{sha256 as U}from"../hash.js";import{Worker as I,isMainThread as L}from"node:worker_threads";import{readBoundedFile as T}from"./bounded-file.js";import{remainingDeadlineMs as W}from"./deadline.js";const N=I,E=32;let p=!1;function G(n){if(!L)throw Error("REFUSE\xB7Root control transport requires main-thread realm");const r=f(t=>{throw Error("REFUSE\xB7Root control transport "+t)},"refuse"),l=f(t=>Number.isSafeInteger(t)&&t>0,"integer"),w=n.workerBytes,m=Object.freeze({...n.worker});(!(w instanceof Uint8Array)||!m.coordinate||!l(m.bytes)||w.byteLength!==m.bytes)&&r("selected worker bytes/type bound differs before copy");const i=Object.freeze({...n,endpoint:Object.freeze({...n.endpoint}),resources:Object.freeze({...n.resources}),runtime:Object.freeze({...n.runtime}),worker:m,workerBytes:Buffer.from(w)}),{endpoint:a,resources:e,runtime:d,worker:b}=i;(!b.coordinate||!l(b.bytes)||i.workerBytes.byteLength!==b.bytes||U(i.workerBytes)!==b.digest)&&r("selected worker bytes differ"),(d.path!==process.execPath||!l(d.bytes)||U(T(d.path,d.bytes,d.path))!==d.digest)&&r("selected runtime bytes differ"),(![a.timeoutMs,a.responseBytes,a.deadlineMs,i.deadlineMs].every(l)||i.deadlineMs>a.deadlineMs)&&r("parent time/byte resource absent or widened"),(e.inputBytes>2147483647||e.outputBytes>2147483647)&&r("host-control-transport@1 signed Int32 length representation");const B=E+e.inputBytes+e.outputBytes;(!Object.values(e).every(l)||!Number.isSafeInteger(B)||e.inputBytes>a.responseBytes||e.outputBytes>a.responseBytes||B>e.sharedBytes)&&r("shared/input/output resource absent or exceeded");const M=Math.min(a.timeoutMs,i.deadlineMs-Date.now());M<=0&&r("parent deadline");const j=process.hrtime.bigint()+BigInt(M)*1000000n,h=W.bind(void 0,j);p&&r("one live main-thread control worker resource exhausted");let y;try{y=new SharedArrayBuffer(B)}catch{return r("shared resource allocation")}const o=new Int32Array(y,0,8),F=new Uint8Array(y,E,e.inputBytes),O=new Uint8Array(y,E+e.inputBytes,e.outputBytes),q=Buffer.from(i.workerBytes).toString("base64");p=!0;let u;try{u=new N(new URL("data:text/javascript;base64,"+q),{execArgv:[],env:{},workerData:{endpoint:{...a},deadlineMs:i.deadlineMs,shared:y,inputBytes:e.inputBytes,outputBytes:e.outputBytes}})}catch{return p=!1,r("worker construction interrupted")}let x;const R=f(()=>x??(x=u.terminate().finally(()=>{p=!1})),"stop");u.once("exit",()=>{p=!1}),u.unref();let c,S=!1,g=0;const s=f(t=>{throw c??(c="REFUSE\xB7Root control transport "+t),R(),Error(c)},"fail");return u.on("error",t=>{c??(c="REFUSE\xB7Root control transport worker interrupted: "+t.message)}),Atomics.load(o,5)!==1&&Atomics.wait(o,5,0,h())==="timed-out"&&s("startup deadline/interruption"),{exchange(t){if(c)throw Error(c);S&&s("closed"),h()<=0&&s("parent deadline"),(typeof t!="string"||!t.length||Buffer.byteLength(t,"utf8")>e.inputBytes)&&s("request bytes before copy");const v=Buffer.from(t,"utf8");(Atomics.load(o,0)!==0||g>=2147483647)&&s("overlapping request/sequence"),F.set(v),Atomics.store(o,2,v.length),Atomics.store(o,1,++g),Atomics.store(o,0,1),u.postMessage(g),(Atomics.wait(o,0,1,h())==="timed-out"||h()<=0)&&s("deadline/interruption");const z=Atomics.load(o,0),k=Atomics.load(o,3);(k<1||k>e.outputBytes)&&s("reply bytes");let A;try{A=new TextDecoder("utf-8",{fatal:!0}).decode(O.slice(0,k))}catch{return s("reply encoding")}return z!==2&&s(A),Atomics.store(o,0,0),A},async close(){S=!0,await R()}}}f(G,"createFixedControlBridge");export{G as createFixedControlBridge};

package/dist/host/native/control-selection.js

@@ -1,32 +1 @@
-/** Optional Root-selected control transport. This is fixed host machinery,
- * never a world's worker permission or a change to producer message/work caps.
- * One retained control worker belongs only to the main thread of each process;
- * other Node realms keep the existing bounded fixed-client transport. */
-import { parsedLine as parse } from "../../fold/claims.js";
-import { authenticateSignedPort } from "./reading.js";
-const fail = (why) => { throw Error('REFUSE·host control ' + why); };
-const keys = (value) => value && typeof value === 'object' && !Array.isArray(value) ? Object.keys(value).sort().join(',') : '';
-const digest = (value) => typeof value === 'string' && /^sha256:[a-f0-9]{64}$/.test(value);
-export function selectedHostControl(root, parent) {
-    const coordinate = [parent.port.coordinate, 'control'].join('/'), rows = root.live.filter(line => { const got = parse(line); return got.kind === 'fact' && got.value.fields.scope === coordinate; });
-    if (!rows.length)
-        return undefined;
-    const selected = authenticateSignedPort(root, coordinate), profile = selected.profile, parsed = parse(selected.line);
-    if (parsed.kind !== 'fact' || parsed.value.fields.by !== root.signer.id)
-        fail('selection is not Root signed ' + coordinate);
-    if (keys(profile) !== 'coordinate,limits,profile,realm,runtime,selector,worker' || profile.profile !== 'host-control-transport@1' || profile.realm !== 'main-thread' || profile.coordinate !== coordinate || keys(profile.selector) !== 'implementation,port' || profile.selector.port !== parent.port.coordinate || profile.selector.implementation !== parent.port.implementation)
-        fail('profile selector differs ' + coordinate);
-    if (keys(profile.worker) !== 'bytes,coordinate,digest' || !/^native\/executor\/(?:dist|src)\/host\/native\/control-bridge-worker\.(?:js|ts)$/.test(profile.worker.coordinate) || !digest(profile.worker.digest) || !Number.isSafeInteger(profile.worker.bytes) || profile.worker.bytes < 1)
-        fail('fixed worker binding absent ' + coordinate);
-    const runtime = parent.selection.members.find(member => member.coordinate === parent.selection.runtime);
-    if (keys(profile.runtime) !== 'coordinate,digest' || !runtime || profile.runtime.coordinate !== runtime.coordinate || profile.runtime.digest !== runtime.digest)
-        fail('fixed runtime selection differs ' + coordinate);
-    if (keys(profile.limits) !== 'inFlight,sharedBytes,workersPerProcess' || profile.limits.workersPerProcess !== 1 || profile.limits.inFlight !== 1 || !Number.isSafeInteger(profile.limits.sharedBytes) || profile.limits.sharedBytes < 32)
-        fail('named resource invalid ' + coordinate);
-    if (!Number.isSafeInteger(parent.port.responseBytes) || parent.port.responseBytes < 1 || parent.port.responseBytes > 2147483647)
-        fail('message cap outside declared signed Int32 representation ' + coordinate);
-    const required = 32 + 2 * parent.port.responseBytes;
-    if (!Number.isSafeInteger(required) || profile.limits.sharedBytes < required)
-        fail('shared resource cannot preserve message caps ' + coordinate);
-    return Object.freeze({ line: selected.line, profile });
-}
+var g=Object.defineProperty;var s=(r,t)=>g(r,"name",{value:t,configurable:!0});import{parsedLine as p}from"../../fold/claims.js";import{authenticateSignedPort as u}from"./reading.js";const o=s(r=>{throw Error("REFUSE\xB7host control "+r)},"fail"),n=s(r=>r&&typeof r=="object"&&!Array.isArray(r)?Object.keys(r).sort().join(","):"","keys"),y=s(r=>typeof r=="string"&&/^sha256:[a-f0-9]{64}$/.test(r),"digest");function B(r,t){const i=[t.port.coordinate,"control"].join("/");if(!r.live.filter(l=>{const m=p(l);return m.kind==="fact"&&m.value.fields.scope===i}).length)return;const c=u(r,i),e=c.profile,a=p(c.line);(a.kind!=="fact"||a.value.fields.by!==r.signer.id)&&o("selection is not Root signed "+i),(n(e)!=="coordinate,limits,profile,realm,runtime,selector,worker"||e.profile!=="host-control-transport@1"||e.realm!=="main-thread"||e.coordinate!==i||n(e.selector)!=="implementation,port"||e.selector.port!==t.port.coordinate||e.selector.implementation!==t.port.implementation)&&o("profile selector differs "+i),(n(e.worker)!=="bytes,coordinate,digest"||!/^native\/executor\/(?:dist|src)\/host\/native\/control-bridge-worker\.(?:js|ts)$/.test(e.worker.coordinate)||!y(e.worker.digest)||!Number.isSafeInteger(e.worker.bytes)||e.worker.bytes<1)&&o("fixed worker binding absent "+i);const d=t.selection.members.find(l=>l.coordinate===t.selection.runtime);(n(e.runtime)!=="coordinate,digest"||!d||e.runtime.coordinate!==d.coordinate||e.runtime.digest!==d.digest)&&o("fixed runtime selection differs "+i),(n(e.limits)!=="inFlight,sharedBytes,workersPerProcess"||e.limits.workersPerProcess!==1||e.limits.inFlight!==1||!Number.isSafeInteger(e.limits.sharedBytes)||e.limits.sharedBytes<32)&&o("named resource invalid "+i),(!Number.isSafeInteger(t.port.responseBytes)||t.port.responseBytes<1||t.port.responseBytes>2147483647)&&o("message cap outside declared signed Int32 representation "+i);const f=32+2*t.port.responseBytes;return(!Number.isSafeInteger(f)||e.limits.sharedBytes<f)&&o("shared resource cannot preserve message caps "+i),Object.freeze({line:c.line,profile:e})}s(B,"selectedHostControl");export{B as selectedHostControl};