@lapxo/bound 0.2.4 → 0.2.5

package/dist/host/native/custody.js

@@ -1,91 +1 @@
-/** Fixed Root constructor for finite descendant custody. It selects only current
- * authenticated Root records matching the already planned native parent job.
- */
-import { mkdtempSync, writeFileSync, rmSync } from 'node:fs';
-import { tmpdir } from 'node:os';
-import { join, extname } from 'node:path';
-import { fileURLToPath, pathToFileURL } from 'node:url';
-import { createHash } from 'node:crypto';
-import { parse } from '@lapxo/topos/wire';
-import { processOf, ownRoot } from "../../observe/runner.js";
-import { selectedHostControl } from "./control-selection.js";
-import { readBoundedFile } from "./bounded-file.js";
-import { authenticateSignedPort } from "./reading.js";
-import { createProducerJobCustody } from "./generated-custodian.js";
-const fail = (why) => { throw Error('REFUSE·native custody ' + why); };
-const sha = (raw) => 'sha256:' + createHash('sha256').update(raw).digest('hex');
-export function nativeRootJobCustody(root, profile, handoff, image, logical) {
-    const data = logical.members.map(member => { const location = image.locations.find(loc => loc.member === member.coordinate); if (!location)
-        return fail('literal member absent'); return { path: location.path, digest: member.digest }; }), libraries = logical.libraries.map(lib => { const location = image.locations.find(loc => loc.member === lib.manifest); if (!location)
-        return fail('library absent'); return { name: lib.name, manifest: location.path, coordinate: lib.manifest }; });
-    const candidates = root.live.flatMap(line => { const row = parse(line); if (row.kind !== 'fact' || !row.value.fields.scope.startsWith('port/'))
-        return []; let p; try {
-        p = JSON.parse(row.value.fields.about ?? '');
-    }
-    catch {
-        return [];
-    } return p?.selector?.port === profile.port.coordinate ? [{ coordinate: row.value.fields.scope, profile: p }] : []; });
-    return { async open(parent) {
-            const matching = candidates.filter(candidate => candidate.profile.selector.binding === parent.binding && candidate.profile.selector.implementation === parent.implementation);
-            const producers = matching.filter(candidate => candidate.profile.profile === 'host-generated-executable@3');
-            if (producers.length !== 1)
-                return fail('requires one current Root producer for ' + parent.binding);
-            const selected = producers[0];
-            authenticateSignedPort(root, selected.coordinate);
-            const control = selectedHostControl(root, profile);
-            const implementation = fileURLToPath(new URL('./generated' + extname(new URL(import.meta.url).pathname), import.meta.url)), implementationBytes = readBoundedFile(implementation, root.budget.bytes, implementation);
-            const runtime = image.locations.find(location => location.member === image.runtime), runtimeMember = handoff.members.find(member => member.coordinate === image.runtime);
-            if (!runtime || !runtimeMember)
-                return fail('fixed actual runtime absent');
-            const binaries = matching.filter(candidate => ['host-native-binary@1', 'host-native-binary-origin@1'].includes(candidate.profile.profile)).map(candidate => { const p = candidate.profile, location = image.locations.find(loc => loc.member === p.entry?.path), member = handoff.members.find(m => m.coordinate === p.entry?.path); if (!location || !member)
-                return fail('binary outside actual selected image'); return { coordinate: candidate.coordinate, privateBinding: { coordinate: member.coordinate, path: location.path, digest: member.digest } }; });
-            const programs = matching.filter(candidate => candidate.profile.profile === 'host-native-program@1').map(candidate => ({ coordinate: candidate.coordinate, runtimeBinding: { coordinate: image.runtime, path: runtime.path, digest: runtimeMember.digest, members: image.locations.map(location => ({ coordinate: location.member, path: location.path })) } }));
-            const directory = mkdtempSync(join(tmpdir(), 'bound-native-custody-')), contextFile = join(directory, 'context.json'), configFile = join(directory, 'loader.json');
-            let acquired;
-            try {
-                const service = createProducerJobCustody({ root, coordinate: selected.coordinate, implementationBytes, snapshot: { budget: { members: handoff.budget.members, bytes: handoff.budget.bytes }, members: data, libraries, builtins: logical.builtins, platform: logical.platform }, nativeImplementations: new Set(logical.members.map(member => member.digest)), directory, contextFile, nativeBinaries: binaries, programSelections: programs });
-                acquired = await service.open(parent);
-                const client = processOf('custodian'), clientBytes = readBoundedFile(client, parent.responseBytes, client), preload = new URL(pathToFileURL(processOf('native-descendant')).href);
-                preload.searchParams.set('config', configFile);
-                preload.searchParams.set('bytes', String(handoff.budget.bytes));
-                let controlEnvelope;
-                if (control) {
-                    const worker = control.profile.worker, path = join(ownRoot(), worker.coordinate.slice('native/executor/'.length)), raw = readBoundedFile(path, worker.bytes, worker.coordinate);
-                    if (raw.length !== worker.bytes || sha(raw) !== worker.digest)
-                        return fail('sealed control worker bytes differ');
-                    if (control.profile.runtime.coordinate !== image.runtime || control.profile.runtime.digest !== runtimeMember.digest)
-                        return fail('sealed control runtime differs');
-                    const shared = 32 + 2 * parent.responseBytes;
-                    if (!Number.isSafeInteger(shared) || shared > control.profile.limits.sharedBytes)
-                        return fail('shared control resource absent');
-                    controlEnvelope = { profileLine: control.line, realm: control.profile.realm, worker: { ...worker, path }, resources: { inputBytes: parent.responseBytes, outputBytes: parent.responseBytes, sharedBytes: control.profile.limits.sharedBytes } };
-                }
-                const config = { ...(controlEnvelope ? { control: controlEnvelope } : {}), members: data, libraries, builtins: logical.builtins, platform: logical.platform, executableDigests: logical.members.filter(member => /\.(?:[mc]?js|ts)$/.test(member.coordinate)).map(member => member.digest), metadataDigests: logical.members.filter(member => member.coordinate.endsWith('.json')).map(member => member.digest), inputBytes: handoff.budget.bytes, runtimeBytes: runtimeMember.bytes.byteLength, clientBytes: clientBytes.length, contextBytes: parent.responseBytes, custodian: { contextFile, client, runtime: runtime.path, preload: preload.href, runtimeDigest: runtimeMember.digest, clientDigest: sha(clientBytes) } };
-                // Loader metadata describes the authenticated input image, not the command's
-                // stdout. Its declared input budget stays separate from responseBytes.
-                const raw = Buffer.from(JSON.stringify(config));
-                if (raw.length > handoff.budget.bytes)
-                    return fail('operational descendant envelope bytes');
-                writeFileSync(configFile, raw, { flag: 'wx', mode: 0o400 });
-                // The URL carries an independently fixed expected digest of the private host
-                // envelope. This is operational custody, never authority from JSON.
-                preload.searchParams.set('digest', sha(raw));
-                config.custodian.preload = preload.href;
-                // The recursive preload URL excludes its own digest while writing the file;
-                // its fixed child validates the exact file before installing any hook.
-                const descendant = { ...config, custodian: { ...config.custodian, preload: preload.href } };
-                const held = acquired;
-                return { descendant, assertClosed: () => held.assertClosed(), async close() { try {
-                        await held.close();
-                    }
-                    finally {
-                        rmSync(directory, { recursive: true, force: true });
-                    } } };
-            }
-            catch (error) {
-                await acquired?.close();
-                rmSync(directory, { recursive: true, force: true });
-                throw error;
-            }
-        } };
-}
+var _=Object.defineProperty;var h=(i,g)=>_(i,"name",{value:g,configurable:!0});import{mkdtempSync as $,writeFileSync as z,rmSync as O}from"node:fs";import{tmpdir as A}from"node:os";import{join as B,extname as G}from"node:path";import{fileURLToPath as K,pathToFileURL as Q}from"node:url";import{createHash as V}from"node:crypto";import{library11_parse as X}from"../../vendor/runtime.js";import{processOf as q,ownRoot as Y}from"../../observe/runner.js";import{selectedHostControl as Z}from"./control-selection.js";import{readBoundedFile as R}from"./bounded-file.js";import{authenticateSignedPort as ee}from"./reading.js";import{createProducerJobCustody as te}from"./generated-custodian.js";const d=h(i=>{throw Error("REFUSE\xB7native custody "+i)},"fail"),L=h(i=>"sha256:"+V("sha256").update(i).digest("hex"),"sha");function fe(i,g,p,a,c){const k=c.members.map(t=>{const o=a.locations.find(s=>s.member===t.coordinate);return o?{path:o.path,digest:t.digest}:d("literal member absent")}),F=c.libraries.map(t=>{const o=a.locations.find(s=>s.member===t.manifest);return o?{name:t.name,manifest:o.path,coordinate:t.manifest}:d("library absent")}),H=i.live.flatMap(t=>{const o=X(t);if(o.kind!=="fact"||!o.value.fields.scope.startsWith("port/"))return[];let s;try{s=JSON.parse(o.value.fields.about??"")}catch{return[]}return s?.selector?.port===g.port.coordinate?[{coordinate:o.value.fields.scope,profile:s}]:[]});return{async open(t){const o=H.filter(e=>e.profile.selector.binding===t.binding&&e.profile.selector.implementation===t.implementation),s=o.filter(e=>e.profile.profile==="host-generated-executable@3");if(s.length!==1)return d("requires one current Root producer for "+t.binding);const P=s[0];ee(i,P.coordinate);const l=Z(i,g),U=K(new URL("./generated"+G(new URL(import.meta.url).pathname),import.meta.url)),I=R(U,i.budget.bytes,U),w=a.locations.find(e=>e.member===a.runtime),f=p.members.find(e=>e.coordinate===a.runtime);if(!w||!f)return d("fixed actual runtime absent");const M=o.filter(e=>["host-native-binary@1","host-native-binary-origin@1"].includes(e.profile.profile)).map(e=>{const m=e.profile,y=a.locations.find(u=>u.member===m.entry?.path),n=p.members.find(u=>u.coordinate===m.entry?.path);return!y||!n?d("binary outside actual selected image"):{coordinate:e.coordinate,privateBinding:{coordinate:n.coordinate,path:y.path,digest:n.digest}}}),T=o.filter(e=>e.profile.profile==="host-native-program@1").map(e=>({coordinate:e.coordinate,runtimeBinding:{coordinate:a.runtime,path:w.path,digest:f.digest,members:a.locations.map(m=>({coordinate:m.member,path:m.path}))}})),b=$(B(A(),"bound-native-custody-")),j=B(b,"context.json"),C=B(b,"loader.json");let x;try{x=await te({root:i,coordinate:P.coordinate,implementationBytes:I,snapshot:{budget:{members:p.budget.members,bytes:p.budget.bytes},members:k,libraries:F,builtins:c.builtins,platform:c.platform},nativeImplementations:new Set(c.members.map(r=>r.digest)),directory:b,contextFile:j,nativeBinaries:M,programSelections:T}).open(t);const m=q("custodian"),y=R(m,t.responseBytes,m),n=new URL(Q(q("native-descendant")).href);n.searchParams.set("config",C),n.searchParams.set("bytes",String(p.budget.bytes));let u;if(l){const r=l.profile.worker,E=B(Y(),r.coordinate.slice(16)),J=R(E,r.bytes,r.coordinate);if(J.length!==r.bytes||L(J)!==r.digest)return d("sealed control worker bytes differ");if(l.profile.runtime.coordinate!==a.runtime||l.profile.runtime.digest!==f.digest)return d("sealed control runtime differs");const N=32+2*t.responseBytes;if(!Number.isSafeInteger(N)||N>l.profile.limits.sharedBytes)return d("shared control resource absent");u={profileLine:l.line,realm:l.profile.realm,worker:{...r,path:E},resources:{inputBytes:t.responseBytes,outputBytes:t.responseBytes,sharedBytes:l.profile.limits.sharedBytes}}}const v={...u?{control:u}:{},members:k,libraries:F,builtins:c.builtins,platform:c.platform,executableDigests:c.members.filter(r=>/\.(?:[mc]?js|ts)$/.test(r.coordinate)).map(r=>r.digest),metadataDigests:c.members.filter(r=>r.coordinate.endsWith(".json")).map(r=>r.digest),inputBytes:p.budget.bytes,runtimeBytes:f.bytes.byteLength,clientBytes:y.length,contextBytes:t.responseBytes,custodian:{contextFile:j,client:m,runtime:w.path,preload:n.href,runtimeDigest:f.digest,clientDigest:L(y)}},S=Buffer.from(JSON.stringify(v));if(S.length>p.budget.bytes)return d("operational descendant envelope bytes");z(C,S,{flag:"wx",mode:256}),n.searchParams.set("digest",L(S)),v.custodian.preload=n.href;const W={...v,custodian:{...v.custodian,preload:n.href}},D=x;return{descendant:W,assertClosed:h(()=>D.assertClosed(),"assertClosed"),async close(){try{await D.close()}finally{O(b,{recursive:!0,force:!0})}}}}catch(e){throw await x?.close(),O(b,{recursive:!0,force:!0}),e}}}}h(fe,"nativeRootJobCustody");export{fe as nativeRootJobCustody};

package/dist/host/native/deadline.js

@@ -1,28 +1 @@
-const TIMER_MAX_MS = 2147483647;
-/** Remaining monotonic lease, rounded up for host APIs that accept milliseconds. */
-export function remainingDeadlineMs(deadline) {
-    return Math.max(0, Number((deadline - process.hrtime.bigint() + 999999n) / 1000000n));
-}
-const native = { now: () => process.hrtime.bigint(), schedule: (callback, delay) => setTimeout(callback, delay), cancel: handle => clearTimeout(handle) };
-/** The admitted deadline is never clamped to the platform timer range. Each
- * timer is merely a wake-up slice; expiry checks the original monotonic clock.
- * Injected clock exists only for deterministic platform-boundary vectors. */
-export function scheduleDeadline(deadline, expire, clock = native) {
-    let active = true, handle;
-    const arm = () => {
-        if (!active)
-            return;
-        const remaining = deadline - clock.now();
-        if (remaining <= 0n) {
-            active = false;
-            expire();
-            return;
-        }
-        const ceilMs = (remaining + 999999n) / 1000000n;
-        const slice = ceilMs > BigInt(TIMER_MAX_MS) ? TIMER_MAX_MS : Number(ceilMs);
-        handle = clock.schedule(arm, slice);
-    };
-    arm();
-    return () => { active = false; if (handle !== undefined)
-        clock.cancel(handle); };
-}
+var l=Object.defineProperty;var n=(e,t)=>l(e,"name",{value:t,configurable:!0});const d=2147483647;function f(e){return Math.max(0,Number((e-process.hrtime.bigint()+999999n)/1000000n))}n(f,"remainingDeadlineMs");const M={now:n(()=>process.hrtime.bigint(),"now"),schedule:n((e,t)=>setTimeout(e,t),"schedule"),cancel:n(e=>clearTimeout(e),"cancel")};function h(e,t,i=M){let r=!0,s;const c=n(()=>{if(!r)return;const a=e-i.now();if(a<=0n){r=!1,t();return}const u=(a+999999n)/1000000n,o=u>BigInt(2147483647)?2147483647:Number(u);s=i.schedule(c,o)},"arm");return c(),()=>{r=!1,s!==void 0&&i.cancel(s)}}n(h,"scheduleDeadline");export{f as remainingDeadlineMs,h as scheduleDeadline};