@lapxo/bound 0.2.4 → 0.2.5

package/dist/host/native/route.js

@@ -1,216 +1 @@
-import { fieldNames } from "./reading.js";
-import { sha256 as hash } from "../hash.js";
-/** Instrument-only native route. The caller holds the existing Root lease
- * across selection, cache authorization and this complete bounded child act.
- */
-import { dirname } from 'node:path';
-import { realpathSync } from 'node:fs';
-import { nativeBinaryOrigin } from "./native-binary.js";
-import { selectedHostControl } from "./control-selection.js";
-import { authorityAtEpoch } from '@lapxo/topos/wire';
-import { parsedLine as parse } from "../../fold/claims.js";
-import { authorityFor } from "../../fold/signers.js";
-import { authenticatedRootStanding } from "../admitted-place.js";
-import { nativeExecutorInputs } from "./materialize.js";
-export { materializeNativeRoute } from "./materialize.js";
-import { assertNativeRuntime } from "./runtime.js";
-import { nativeReferenceInputs } from "./references.js";
-import { rootAuthorityProtection } from "../../land/act.js";
-import { currentNativeRoot, inheritedNativeRoot } from "./root.js";
-import { authenticateSignedPort, authenticateNativeProfile, canonicalJson } from "./reading.js";
-import { boundedProcess } from "../process-lifetime.js";
-import { validResponse, CapsuleProcessError } from "../capsule-process.js";
-import { processOf } from "../../observe/runner.js";
-const fail = (why) => { throw Error('REFUSE·native route ' + why); };
-const routes = new WeakMap();
-/** Shared origins are one exact input; individual signed selectors remain separate. */
-export function nativeBinaryOriginInputs(binaries) {
-    const seen = new Map(), inputs = [];
-    for (const binary of binaries) {
-        if (!binary.origin)
-            continue;
-        const coordinate = 'native/binary-origin/' + binary.origin.coordinate, digest = hash(binary.origin.line), prior = seen.get(coordinate);
-        if (prior !== undefined) {
-            if (prior !== digest)
-                fail('conflicting binary origin input ' + coordinate);
-            continue;
-        }
-        seen.set(coordinate, digest);
-        inputs.push([coordinate, digest]);
-    }
-    return Object.freeze(inputs);
-}
-/** Inputs are semantic logical references. Fixed instrument/host graph and
- * runtime-supervisor chain must also be supplied by the calling identity builder.
- * Locations and lock-token/PID are operational custody, never these inputs.
- */
-export function prepareNativeRoute(store, coordinate, readerMapping) {
-    const proof = rootAuthorityProtection(store), current = currentNativeRoot(store, process.pid, proof);
-    return prepareAtCurrentRoot(store, coordinate, readerMapping, current);
-}
-/** Private same-call reuse only: callers cannot supply a standing as authority. */
-function prepareAtCurrentRoot(store, coordinate, readerMapping, current) {
-    const { root, context } = current, selected = authenticateNativeProfile(root, coordinate), profile = selected.profile;
-    // The Root cursor authorizes today's act under the held lease. It is not a
-    // semantic input to every program: unrelated Root acts do not reopen it.
-    // Exact selected grants and the authenticated reader mapping remain inputs.
-    const binaries = authenticatedNativeBinaries(root, profile), control = selectedHostControl(root, profile), identity = hash(canonicalJson([coordinate, selected.line, profile, binaries, readerMapping ?? null, ...(control ? [control] : [])])), inputs = [['native/selection', identity], ...(readerMapping ? [['native/reader-mapping', hash(readerMapping)]] : []), ...profile.selection.members.map(m => ['native/' + m.coordinate, m.digest]), ...binaries.map(b => ['native/binary/' + b.coordinate, hash(b.line)])];
-    inputs.push(...nativeBinaryOriginInputs(binaries));
-    if (control)
-        inputs.push(['native/control-profile', hash(control.line)], ['native/control-worker', control.profile.worker.digest], ['native/control-runtime', control.profile.runtime.digest]);
-    const route = { identity, profile, binaries, ...(control ? { control } : {}), inputs: inputs };
-    routes.set(route, { store, coordinate, context, profile });
-    inputs.push(...nativeExecutorInputs(route));
-    if (control && inputs.find(([name]) => name === control.profile.worker.coordinate)?.[1] !== control.profile.worker.digest)
-        fail('control worker differs from sealed executor');
-    Object.freeze(inputs);
-    return Object.freeze(route);
-}
-/** Recheck authority before both a current retained answer and fresh execution.
- * Historical public --check uses the existing receipt-inspection path, not this
- * command authorization route.
- */
-export function assertNativeRouteCurrent(route) {
-    const held = routes.get(route);
-    if (!held)
-        return fail('unknown prepared route');
-    const proof = rootAuthorityProtection(held.store), root = inheritedNativeRoot({ store: held.store, parent: process.pid, expected: held.context }, proof);
-    const profile = authenticateSignedPort(root, held.coordinate).profile;
-    if (canonicalJson(profile) !== canonicalJson(held.profile) || canonicalJson(authenticatedNativeBinaries(root, held.profile)) !== canonicalJson(route.binaries) || canonicalJson(selectedHostControl(root, held.profile) ?? null) !== canonicalJson(route.control ?? null))
-        fail('current port changed');
-}
-export function invokeNativeRoute(route, input) {
-    const held = routes.get(route);
-    if (!held)
-        return fail('unknown prepared route');
-    assertNativeRouteCurrent(route);
-    assertNativeRuntime(input.execution.env, input.execution.flags);
-    if (input.execution.context.implementation !== held.profile.selection.archive)
-        fail('reading implementation differs');
-    nativeReferenceInputs(input.execution.context.inputs, route.inputs);
-    if (input.limits.timeoutMs > held.profile.port.timeoutMs || input.limits.responseBytes > held.profile.port.responseBytes)
-        fail('reader limits exceed current command grant');
-    const proof = rootAuthorityProtection(held.store), frame = { proof, archive: input.archive, locations: input.locations, requests: input.requests };
-    const args = [processOf('native'), held.store, held.coordinate, JSON.stringify(held.context), 'reserved', String(held.profile.selection.budget.bytes), 'act', String(process.pid), JSON.stringify(input.execution)];
-    const result = boundedProcess(process.execPath, args, JSON.stringify(frame), input.limits, input.execution.cwd, input.execution.env);
-    if (result.signal !== null || result.status !== 0)
-        throw new CapsuleProcessError('native child exited ' + String(result.status ?? result.signal), result);
-    let values;
-    try {
-        values = JSON.parse(result.stdout.trimEnd());
-    }
-    catch {
-        return fail('native child malformed batch');
-    }
-    if (!Array.isArray(values) || values.length !== input.requests.length || !values.every((value, index) => validResponse(value, input.requests[index])))
-        fail('native child invalid batch');
-    assertNativeRouteCurrent(route);
-    return values;
-}
-/** This predicate only schedules an outer lease. It grants no command. */
-export function declaredNativeReaderPorts(lines) { return lines.some(line => { const got = parse(line); return got.kind === 'fact' && got.value.fields.scope.startsWith('reader/') && got.value.fields.scope.split('/').at(-1) === 'port' && got.value.fields.value !== 'withdraw'; }); }
-export function prepareNativeReaderRoute(store, reader) {
-    const expectedScope = ['reader', reader.module, 'port'].join('/');
-    const declared = authenticatedRootStanding(dirname(store));
-    if (!declared.some(line => { const got = parse(line); return got.kind === 'fact' && got.value.fields.scope === expectedScope && got.value.fields.value !== 'withdraw'; }))
-        return undefined;
-    const proof = rootAuthorityProtection(store), currentRoot = currentNativeRoot(store, process.pid, proof), root = currentRoot.root;
-    const rows = root.live.filter(line => { const got = parse(line); return got.kind === 'fact' && got.value.fields.scope === expectedScope; });
-    if (!rows.length)
-        return undefined;
-    if (rows.length !== 1)
-        fail('ambiguous reader port ' + expectedScope);
-    const got = parse(rows[0]);
-    if (got.kind !== 'fact')
-        return fail('invalid reader port ' + expectedScope);
-    const f = got.value.fields;
-    if (f.role !== 'writes' || f.form !== 'alphabet' || f.measure !== 'id' || typeof f.value !== 'string' || !/^port\/[^\s]+$/.test(f.value))
-        fail('malformed reader port ' + expectedScope);
-    const auth = authorityFor(root.history, root.signer, root.eras), signed = auth.of(rows[0]);
-    if (signed.kind !== 'admitted' || signed.signer !== root.signer.id)
-        fail('reader port is not Root signed ' + expectedScope);
-    if (signed.kind !== 'admitted')
-        return fail('reader port signature not admitted');
-    const signer = auth.admitted.find(one => one.id === signed.signer);
-    if (!signer)
-        return fail('reader port signer absent');
-    const current = authorityAtEpoch(f, signer, root.epoch, expectedScope, 'authority');
-    if (current.kind !== 'admitted')
-        fail('reader port current eligibility ' + current.why);
-    return prepareAtCurrentRoot(store, f.value, rows[0], currentRoot);
-}
-export function nativeRouteStore(route) { const held = routes.get(route); if (!held)
-    return fail('unknown prepared route'); return held.store; }
-/** Quiet-pass gate: authenticate grants/cursor only, no image/materialization or
- * program execution. Historical --check remains its separate receipt path. */
-export function assertNativeReaderGrantsCurrent(store) { currentNativeReaderSelections(store); }
-/** Executable kinds come only from current authenticated Root declarations. A
- * matching JSON hint identifies a candidate, but is never permission to execute. */
-export function authenticatedNativeBinaries(root, profile) {
-    const out = [], names = new Set();
-    const keys = fieldNames;
-    for (const line of root.live) {
-        const row = parse(line);
-        if (row.kind !== 'fact' || !row.value.fields.scope.startsWith('port/'))
-            continue;
-        let hint;
-        try {
-            hint = JSON.parse(row.value.fields.about ?? '');
-        }
-        catch {
-            continue;
-        }
-        if (!['host-native-binary@1', 'host-native-binary-origin@1'].includes(hint?.profile) || hint.selector?.port !== profile.port.coordinate)
-            continue;
-        const coordinate = row.value.fields.scope, auth = authenticateSignedPort(root, coordinate), p = auth.profile;
-        if (keys(p) !== (p.profile === 'host-native-binary-origin@1' ? 'alias,condition,coordinate,entry,limits,origin,profile,selector' : 'alias,condition,coordinate,entry,limits,profile,selector') || p.coordinate !== coordinate || typeof p.alias !== 'string' || !p.alias.length || p.alias.includes('\0') || typeof p.condition !== 'string' || !p.condition.length || keys(p.selector ?? {}) !== 'binding,implementation,port' || p.selector.implementation !== profile.port.implementation || !profile.selection.bindings.some(b => b.id === p.selector.binding))
-            fail('binary declaration differs from selected parent ' + coordinate);
-        const entry = p.entry, member = profile.selection.members.find(m => m.coordinate === entry?.path);
-        if (keys(entry ?? {}) !== 'bytes,digest,path' || !member || entry.path === profile.selection.runtime || member.digest !== entry.digest || !Number.isSafeInteger(entry.bytes) || entry.bytes < 1 || keys(p.limits ?? {}) !== 'bytes' || !Number.isSafeInteger(p.limits.bytes) || p.limits.bytes < entry.bytes || p.limits.bytes > profile.selection.budget.bytes)
-            fail('binary outside selected image resources ' + coordinate);
-        if (names.has(coordinate))
-            fail('ambiguous binary declaration ' + coordinate);
-        names.add(coordinate);
-        if (entry.digest === profile.selection.members.find(m => m.coordinate === profile.selection.runtime)?.digest)
-            fail('binary aliases selected runtime');
-        const origin = nativeBinaryOrigin(root, p, auth.line);
-        if (origin?.path === realpathSync(process.execPath))
-            fail('binary origin aliases actual runtime');
-        out.push(Object.freeze({ line: auth.line, coordinate, profile: p, ...(origin ? { origin } : {}) }));
-    }
-    return Object.freeze(out);
-}
-/** Same semantic image identity for preparation, retained mount and quiet checks. */
-export function nativeMountIdentity(profile, binaries, control) { return hash(canonicalJson(['logical-native-image/2', profile.selection, binaries, ...(control ? [control] : [])])); }
-/** Current eligibility only: no executor graph, image load or materialization. */
-export function currentNativeReaderSelections(store) {
-    const declared = authenticatedRootStanding(dirname(store));
-    if (!declaredNativeReaderPorts(declared))
-        return [];
-    const proof = rootAuthorityProtection(store), currentRoot = currentNativeRoot(store, process.pid, proof), root = currentRoot.root;
-    const mappings = root.live.flatMap(line => { const row = parse(line); return row.kind === 'fact' && row.value.fields.scope.startsWith('reader/') && row.value.fields.scope.split('/').at(-1) === 'port' ? [{ line, fields: row.value.fields }] : []; });
-    const seen = new Set(), auth = authorityFor(root.history, root.signer, root.eras), out = [];
-    for (const { line, fields: f } of mappings) {
-        if (seen.has(f.scope))
-            fail('ambiguous reader port ' + f.scope);
-        seen.add(f.scope);
-        if (f.role !== 'writes' || f.form !== 'alphabet' || f.measure !== 'id' || typeof f.value !== 'string' || !/^port\/[^\s]+$/.test(f.value))
-            fail('malformed reader port ' + f.scope);
-        const signed = auth.of(line);
-        if (signed.kind !== 'admitted' || signed.signer !== root.signer.id)
-            fail('reader port is not Root signed ' + f.scope);
-        if (signed.kind !== 'admitted')
-            return fail('reader mapping not admitted');
-        const signer = auth.admitted.find(one => one.id === signed.signer);
-        if (!signer)
-            return fail('reader mapping signer absent');
-        const current = authorityAtEpoch(f, signer, root.epoch, f.scope, 'authority');
-        if (current.kind !== 'admitted')
-            fail('reader port current eligibility ' + current.why);
-        const { profile } = authenticateNativeProfile(root, f.value);
-        const control = selectedHostControl(root, profile);
-        out.push({ profile, binaries: authenticatedNativeBinaries(root, profile), ...(control ? { control } : {}) });
-    }
-    return out;
-}
-export function currentNativeReaderProfiles(store) { return currentNativeReaderSelections(store).map(selection => selection.profile); }
+var q=Object.defineProperty;var m=(t,e)=>q(t,"name",{value:e,configurable:!0});import{fieldNames as M}from"./reading.js";import{sha256 as b}from"../hash.js";import{dirname as O}from"node:path";import{realpathSync as W}from"node:fs";import{nativeBinaryOrigin as F}from"./native-binary.js";import{selectedHostControl as R}from"./control-selection.js";import{library11_authorityAtEpoch as P}from"../../vendor/runtime.js";import{parsedLine as x}from"../../fold/claims.js";import{authorityFor as E}from"../../fold/signers.js";import{authenticatedRootStanding as j}from"../admitted-place.js";import{nativeExecutorInputs as $}from"./materialize.js";import{materializeNativeRoute as Se}from"./materialize.js";import{assertNativeRuntime as G}from"./runtime.js";import{nativeReferenceInputs as H}from"./references.js";import{rootAuthorityProtection as w}from"../../land/act.js";import{currentNativeRoot as N,inheritedNativeRoot as L}from"./root.js";import{authenticateSignedPort as z,authenticateNativeProfile as A,canonicalJson as y}from"./reading.js";import{boundedProcess as U}from"../process-lifetime.js";import{validResponse as _,CapsuleProcessError as D}from"../capsule-process.js";import{processOf as K}from"../../observe/runner.js";const s=m(t=>{throw Error("REFUSE\xB7native route "+t)},"fail"),k=new WeakMap;function Q(t){const e=new Map,i=[];for(const f of t){if(!f.origin)continue;const o="native/binary-origin/"+f.origin.coordinate,g=b(f.origin.line),a=e.get(o);if(a!==void 0){a!==g&&s("conflicting binary origin input "+o);continue}e.set(o,g),i.push([o,g])}return Object.freeze(i)}m(Q,"nativeBinaryOriginInputs");function he(t,e,i){const f=w(t),o=N(t,process.pid,f);return I(t,e,i,o)}m(he,"prepareNativeRoute");function I(t,e,i,f){const{root:o,context:g}=f,a=A(o,e),c=a.profile,l=S(o,c),n=R(o,c),r=b(y([e,a.line,c,l,i??null,...n?[n]:[]])),d=[["native/selection",r],...i?[["native/reader-mapping",b(i)]]:[],...c.selection.members.map(p=>["native/"+p.coordinate,p.digest]),...l.map(p=>["native/binary/"+p.coordinate,b(p.line)])];d.push(...Q(l)),n&&d.push(["native/control-profile",b(n.line)],["native/control-worker",n.profile.worker.digest],["native/control-runtime",n.profile.runtime.digest]);const h={identity:r,profile:c,binaries:l,...n?{control:n}:{},inputs:d};return k.set(h,{store:t,coordinate:e,context:g,profile:c}),d.push(...$(h)),n&&d.find(([p])=>p===n.profile.worker.coordinate)?.[1]!==n.profile.worker.digest&&s("control worker differs from sealed executor"),Object.freeze(d),Object.freeze(h)}m(I,"prepareAtCurrentRoot");function J(t){const e=k.get(t);if(!e)return s("unknown prepared route");const i=w(e.store),f=L({store:e.store,parent:process.pid,expected:e.context},i),o=z(f,e.coordinate).profile;(y(o)!==y(e.profile)||y(S(f,e.profile))!==y(t.binaries)||y(R(f,e.profile)??null)!==y(t.control??null))&&s("current port changed")}m(J,"assertNativeRouteCurrent");function ve(t,e){const i=k.get(t);if(!i)return s("unknown prepared route");J(t),G(e.execution.env,e.execution.flags),e.execution.context.implementation!==i.profile.selection.archive&&s("reading implementation differs"),H(e.execution.context.inputs,t.inputs),(e.limits.timeoutMs>i.profile.port.timeoutMs||e.limits.responseBytes>i.profile.port.responseBytes)&&s("reader limits exceed current command grant");const f=w(i.store),o={proof:f,archive:e.archive,locations:e.locations,requests:e.requests},g=[K("native"),i.store,i.coordinate,JSON.stringify(i.context),"reserved",String(i.profile.selection.budget.bytes),"act",String(process.pid),JSON.stringify(e.execution)],a=U(process.execPath,g,JSON.stringify(o),e.limits,e.execution.cwd,e.execution.env);if(a.signal!==null||a.status!==0)throw new D("native child exited "+String(a.status??a.signal),a);let c;try{c=JSON.parse(a.stdout.trimEnd())}catch{return s("native child malformed batch")}return(!Array.isArray(c)||c.length!==e.requests.length||!c.every((l,n)=>_(l,e.requests[n])))&&s("native child invalid batch"),J(t),c}m(ve,"invokeNativeRoute");function T(t){return t.some(e=>{const i=x(e);return i.kind==="fact"&&i.value.fields.scope.startsWith("reader/")&&i.value.fields.scope.split("/").at(-1)==="port"&&i.value.fields.value!=="withdraw"})}m(T,"declaredNativeReaderPorts");function ye(t,e){const i=["reader",e.module,"port"].join("/");if(!j(O(t)).some(u=>{const v=x(u);return v.kind==="fact"&&v.value.fields.scope===i&&v.value.fields.value!=="withdraw"}))return;const o=w(t),g=N(t,process.pid,o),a=g.root,c=a.live.filter(u=>{const v=x(u);return v.kind==="fact"&&v.value.fields.scope===i});if(!c.length)return;c.length!==1&&s("ambiguous reader port "+i);const l=x(c[0]);if(l.kind!=="fact")return s("invalid reader port "+i);const n=l.value.fields;(n.role!=="writes"||n.form!=="alphabet"||n.measure!=="id"||typeof n.value!="string"||!/^port\/[^\s]+$/.test(n.value))&&s("malformed reader port "+i);const r=E(a.history,a.signer,a.eras),d=r.of(c[0]);if((d.kind!=="admitted"||d.signer!==a.signer.id)&&s("reader port is not Root signed "+i),d.kind!=="admitted")return s("reader port signature not admitted");const h=r.admitted.find(u=>u.id===d.signer);if(!h)return s("reader port signer absent");const p=P(n,h,a.epoch,i,"authority");return p.kind!=="admitted"&&s("reader port current eligibility "+p.why),I(t,n.value,c[0],g)}m(ye,"prepareNativeReaderRoute");function be(t){const e=k.get(t);return e?e.store:s("unknown prepared route")}m(be,"nativeRouteStore");function xe(t){B(t)}m(xe,"assertNativeReaderGrantsCurrent");function S(t,e){const i=[],f=new Set,o=M;for(const g of t.live){const a=x(g);if(a.kind!=="fact"||!a.value.fields.scope.startsWith("port/"))continue;let c;try{c=JSON.parse(a.value.fields.about??"")}catch{continue}if(!["host-native-binary@1","host-native-binary-origin@1"].includes(c?.profile)||c.selector?.port!==e.port.coordinate)continue;const l=a.value.fields.scope,n=z(t,l),r=n.profile;(o(r)!==(r.profile==="host-native-binary-origin@1"?"alias,condition,coordinate,entry,limits,origin,profile,selector":"alias,condition,coordinate,entry,limits,profile,selector")||r.coordinate!==l||typeof r.alias!="string"||!r.alias.length||r.alias.includes("\0")||typeof r.condition!="string"||!r.condition.length||o(r.selector??{})!=="binding,implementation,port"||r.selector.implementation!==e.port.implementation||!e.selection.bindings.some(u=>u.id===r.selector.binding))&&s("binary declaration differs from selected parent "+l);const d=r.entry,h=e.selection.members.find(u=>u.coordinate===d?.path);(o(d??{})!=="bytes,digest,path"||!h||d.path===e.selection.runtime||h.digest!==d.digest||!Number.isSafeInteger(d.bytes)||d.bytes<1||o(r.limits??{})!=="bytes"||!Number.isSafeInteger(r.limits.bytes)||r.limits.bytes<d.bytes||r.limits.bytes>e.selection.budget.bytes)&&s("binary outside selected image resources "+l),f.has(l)&&s("ambiguous binary declaration "+l),f.add(l),d.digest===e.selection.members.find(u=>u.coordinate===e.selection.runtime)?.digest&&s("binary aliases selected runtime");const p=F(t,r,n.line);p?.path===W(process.execPath)&&s("binary origin aliases actual runtime"),i.push(Object.freeze({line:n.line,coordinate:l,profile:r,...p?{origin:p}:{}}))}return Object.freeze(i)}m(S,"authenticatedNativeBinaries");function we(t,e,i){return b(y(["logical-native-image/2",t.selection,e,...i?[i]:[]]))}m(we,"nativeMountIdentity");function B(t){const e=j(O(t));if(!T(e))return[];const i=w(t),f=N(t,process.pid,i),o=f.root,g=o.live.flatMap(n=>{const r=x(n);return r.kind==="fact"&&r.value.fields.scope.startsWith("reader/")&&r.value.fields.scope.split("/").at(-1)==="port"?[{line:n,fields:r.value.fields}]:[]}),a=new Set,c=E(o.history,o.signer,o.eras),l=[];for(const{line:n,fields:r}of g){a.has(r.scope)&&s("ambiguous reader port "+r.scope),a.add(r.scope),(r.role!=="writes"||r.form!=="alphabet"||r.measure!=="id"||typeof r.value!="string"||!/^port\/[^\s]+$/.test(r.value))&&s("malformed reader port "+r.scope);const d=c.of(n);if((d.kind!=="admitted"||d.signer!==o.signer.id)&&s("reader port is not Root signed "+r.scope),d.kind!=="admitted")return s("reader mapping not admitted");const h=c.admitted.find(C=>C.id===d.signer);if(!h)return s("reader mapping signer absent");const p=P(r,h,o.epoch,r.scope,"authority");p.kind!=="admitted"&&s("reader port current eligibility "+p.why);const{profile:u}=A(o,r.value),v=R(o,u);l.push({profile:u,binaries:S(o,u),...v?{control:v}:{}})}return l}m(B,"currentNativeReaderSelections");function ke(t){return B(t).map(e=>e.profile)}m(ke,"currentNativeReaderProfiles");export{xe as assertNativeReaderGrantsCurrent,J as assertNativeRouteCurrent,S as authenticatedNativeBinaries,ke as currentNativeReaderProfiles,B as currentNativeReaderSelections,T as declaredNativeReaderPorts,ve as invokeNativeRoute,Se as materializeNativeRoute,Q as nativeBinaryOriginInputs,we as nativeMountIdentity,be as nativeRouteStore,ye as prepareNativeReaderRoute,he as prepareNativeRoute};

package/dist/host/native/runtime.js

@@ -1,9 +1 @@
-/** Environment identity is not permission to bootstrap arbitrary executable
- * preloads. The fixed native entry currently has no ambient loader contract.
- */
-export function assertNativeRuntime(environment, flags) {
-    if ((environment.NODE_OPTIONS ?? '').trim() !== '')
-        throw Error('REFUSE·native runtime NODE_OPTIONS has no fixed verified loader configuration');
-    if (flags.length)
-        throw Error('REFUSE·native runtime startup flags differ from the fixed dispatcher');
-}
+var e=Object.defineProperty;var t=(r,i)=>e(r,"name",{value:i,configurable:!0});function n(r,i){if((r.NODE_OPTIONS??"").trim()!=="")throw Error("REFUSE\xB7native runtime NODE_OPTIONS has no fixed verified loader configuration");if(i.length)throw Error("REFUSE\xB7native runtime startup flags differ from the fixed dispatcher")}t(n,"assertNativeRuntime");export{n as assertNativeRuntime};

package/dist/host/native-reader-context.js

@@ -1,8 +1 @@
-import { AsyncLocalStorage } from 'node:async_hooks';
-// An opaque instrument selection travels with one observation. A request or a
-// world's response cannot select its executor or replace another reader's port.
-const active = new AsyncLocalStorage();
-export const nativeReaderRoute = active.getStore.bind(active);
-export function withNativeReaderRoute(route, run) {
-    return route === undefined ? run() : active.run(route, run);
-}
+var r=Object.defineProperty;var o=(e,t)=>r(e,"name",{value:t,configurable:!0});import{AsyncLocalStorage as i}from"node:async_hooks";const n=new i,d=n.getStore.bind(n);function u(e,t){return e===void 0?t():n.run(e,t)}o(u,"withNativeReaderRoute");export{d as nativeReaderRoute,u as withNativeReaderRoute};

package/dist/host/native-receiver.js

@@ -1,25 +1 @@
-import { readFileSync, realpathSync } from 'node:fs';
-import { basename, dirname, extname, isAbsolute, join, relative } from 'node:path';
-import { publicLock } from '@lapxo/topos/wire';
-import { foldClaims, wireLinesOf } from "../fold/claims.js";
-import { declaredRootClockSource } from "./root-clock-source.js";
-import { withHostCall } from "./call-context.js";
-import { BoundRefusal } from "./refusals.js";
-/** Explicit installed/source ESM selection, never consumer argv or packet data.
- * Identity and public configuration do not certify implementation correctness. */
-export function nativeHostInstrument(root, entry) {
-    const at = realpathSync(root), file = realpathSync(entry), inside = relative(at, file), extension = extname(file);
-    if (!isAbsolute(root) || !isAbsolute(entry) || inside.startsWith('..') || isAbsolute(inside) || !['.ts', '.js'].includes(extension))
-        throw new BoundRefusal('host/context', 'REFUSE·host/context');
-    const published = publicLock(wireLinesOf(readFileSync(join(at, 'TARGET.bound'), 'utf8')));
-    if (!published)
-        throw new BoundRefusal('host/context', 'REFUSE·host requires a public instrument lock');
-    return { name: basename(at), runtime: { root: at, entry: file, directory: dirname(dirname(file)), extension: extension, lock: foldClaims(published).standing } };
-}
-/** Bind existing native authority construction to an explicit instrument for
- * every later current/historical observation, not only the constructor call. */
-export function nativePlaceActReceiver(root, instrument) {
-    const call = { instrumentName: instrument.name, runtime: structuredClone(instrument.runtime), output: () => { } };
-    const selected = withHostCall(call, () => declaredRootClockSource(root)), original = selected.trust;
-    return { selection: selected.selection, trust: { ...original, current: () => withHostCall(call, () => original.current()), historical: (encoded) => withHostCall(call, () => original.historical(encoded)) } };
-}
+var p=Object.defineProperty;var n=(r,e)=>p(r,"name",{value:e,configurable:!0});import{readFileSync as d,realpathSync as a}from"node:fs";import{basename as h,dirname as m,extname as b,isAbsolute as c,join as x,relative as w}from"node:path";import{library11_publicLock as R}from"../vendor/runtime.js";import{foldClaims as k,wireLinesOf as E}from"../fold/claims.js";import{declaredRootClockSource as S}from"./root-clock-source.js";import{withHostCall as l}from"./call-context.js";import{BoundRefusal as f}from"./refusals.js";function H(r,e){const t=a(r),o=a(e),i=w(t,o),s=b(o);if(!c(r)||!c(e)||i.startsWith("..")||c(i)||![".ts",".js"].includes(s))throw new f("host/context","REFUSE\xB7host/context");const u=R(E(d(x(t,"TARGET.bound"),"utf8")));if(!u)throw new f("host/context","REFUSE\xB7host requires a public instrument lock");return{name:h(t),runtime:{root:t,entry:o,directory:m(m(o)),extension:s,lock:k(u).standing}}}n(H,"nativeHostInstrument");function T(r,e){const t={instrumentName:e.name,runtime:structuredClone(e.runtime),output:n(()=>{},"output")},o=l(t,()=>S(r)),i=o.trust;return{selection:o.selection,trust:{...i,current:n(()=>l(t,()=>i.current()),"current"),historical:n(s=>l(t,()=>i.historical(s)),"historical")}}}n(T,"nativePlaceActReceiver");export{H as nativeHostInstrument,T as nativePlaceActReceiver};

package/dist/host/objects.js

@@ -1,38 +1 @@
-import { canonical, parse, objectHistory, validateObjectContext } from '@lapxo/topos/wire';
-import { objectProvider } from '@lapxo/topos/object-provider';
-import { authorityFor, rootSigner } from "../fold/signers.js";
-import { signaturesOf } from "../fold/digests.js";
-import { storeOf } from "../land/ledger.js";
-import { toposAt, contextModuleAt } from "./selected-topos.js";
-import { foldClaims } from "../fold/claims.js";
-import { usesWasmObject } from "../wasm/object.js";
-/** Bound supplies host authority and I/O; topos owns grammar, selection and context validation. */
-export async function admittedObjects(root, lines, emit = () => { }, requireContextClosure = false) {
-    const history = objectHistory(lines);
-    if (history.kind !== 'fact')
-        throw Error(`REFUSE·wire ${history.why}`);
-    const authority = authorityFor(lines, rootSigner(root), signaturesOf(storeOf(root)).admitted);
-    const admittedConfiguration = history.value.configuration.filter(fields => authority.of(canonical(fields)).kind === 'admitted').map(fields => canonical(fields));
-    const configuration = foldClaims(admittedConfiguration).standing.flatMap(line => { const got = parse(line); return got.kind === 'fact' ? [got.value.fields] : []; });
-    const verifyClosure = requireContextClosure || usesWasmObject(configuration), declaredModules = new Map();
-    const context = await objectProvider(history.value.objects, history.value.configuration, { admit: fields => authority.of(canonical(fields)).kind === 'admitted', emit, topos: digest => {
-            const selected = toposAt(digest, storeOf(root));
-            if (verifyClosure)
-                for (const offer of selected.parts.filter(fields => fields.kind === 'check' && fields.value)) {
-                    const dependencies = [...new Set((offer.restsOn ?? '').split('|').filter(Boolean))].sort(), prior = declaredModules.get(offer.value);
-                    if (prior && JSON.stringify(prior) !== JSON.stringify(dependencies))
-                        throw Error('REFUSE·context module has conflicting declared closures');
-                    declaredModules.set(offer.value, dependencies);
-                }
-            return selected;
-        }, module: digest => {
-            const dependencies = declaredModules.get(digest);
-            if (verifyClosure && dependencies === undefined)
-                throw Error('REFUSE·context module has no declared closure');
-            return contextModuleAt(digest, storeOf(root), verifyClosure ? dependencies : undefined);
-        } });
-    const checked = validateObjectContext(history.value.objects, context);
-    if (checked.kind !== 'fact')
-        throw Error(`REFUSE·context ${checked.why}`);
-    return { records: checked.value, context, configuration };
-}
+var b=Object.defineProperty;var e=(r,i)=>b(r,"name",{value:i,configurable:!0});import{library11_canonical as n,library11_parse as p,library11_objectHistory as y,library11_validateObjectContext as v}from"../vendor/runtime.js";import{objectProvider as g}from"../vendor/object-provider.js";import{authorityFor as h,rootSigner as j}from"../fold/signers.js";import{signaturesOf as x}from"../fold/digests.js";import{storeOf as d}from"../land/ledger.js";import{contextProviderServices as k}from"./selected-topos.js";import{foldClaims as w}from"../fold/claims.js";async function U(r,i,m=()=>{},C=!1){const o=y(i);if(o.kind!=="fact")throw Error(`REFUSE\xB7wire ${o.why}`);const c=h(i,j(r),x(d(r)).admitted),l=o.value.configuration.filter(t=>c.of(n(t)).kind==="admitted").map(t=>n(t)),u=w(l).standing.flatMap(t=>{const f=p(t);return f.kind==="fact"?[f.value.fields]:[]}),s=await g(o.value.objects,o.value.configuration,{admit:e(t=>c.of(n(t)).kind==="admitted","admit"),emit:m,...k(d(r))}),a=v(o.value.objects,s);if(a.kind!=="fact")throw Error(`REFUSE\xB7context ${a.why}`);return{records:a.value,context:s,configuration:u}}e(U,"admittedObjects");export{U as admittedObjects};

package/dist/host/order.js

@@ -1,2 +1 @@
-/** Locale-independent UTF-16 code-unit ordering, shared by host delivery formats. */
-export const compareStrings = (a, b) => a < b ? -1 : a > b ? 1 : 0;
+var c=Object.defineProperty;var t=(o,r)=>c(o,"name",{value:r,configurable:!0});const n=t((o,r)=>o<r?-1:o>r?1:0,"compareStrings");export{n as compareStrings};

package/dist/host/place-act-transaction.js

@@ -1,78 +1,4 @@
-import { readPlaceActContext, verifyPlaceActContext, placeActReceiptsOf } from '@lapxo/topos/core';
-import { requireEffects } from "./read-only.js";
-import { BoundRefusal } from "./refusals.js";
-import { ActCommitUnknown } from "./commit-result.js";
-import { assertHostNotCancelled as cancelled, receiverClock, placeRegionOf } from "./host-controls.js";
-export { ActCommitUnknown as PlaceActCommitUnknown } from "./commit-result.js";
-/** The visibility point may have happened. Only an authenticated result query
- * or replay can resolve this; the error never asserts rollback. */
-const fail = (why) => { throw new BoundRefusal('host/act', 'REFUSE·place act ' + why); };
-const rootBytes = (r) => JSON.stringify([r.namespace, r.snapshot, r.epoch, r.prefix, r.head, r.policies]);
-/** Shared transaction, including historical replay, current authorization and
- * atomic publication. Signing may await; current Root and receiver heads are
- * checked again afterwards while the same exclusion remains held. */
-export async function transactPlaceAct(encoded, source, trust, limits, persistence, signal) {
-    requireEffects('place act commitment');
-    cancelled(signal);
-    if (!limits || !Number.isSafeInteger(limits.acts) || limits.acts < 1 || !Number.isSafeInteger(limits.bytes) || limits.bytes < 1)
-        fail('missing storage budget');
-    const decoded = readPlaceActContext(encoded, trust.contract.budget), id = trust.contract.digest(encoded);
-    const regions = decoded.places.map(p => placeRegionOf(p.place));
-    return persistence.exclusive(regions, async () => {
-        cancelled(signal);
-        const prior = persistence.result(id, trust, limits);
-        if (prior) {
-            if (prior.context !== encoded)
-                fail('replay bytes differ');
-            // A signing callback is never invoked for a historically authenticated replay.
-            if (typeof source !== 'function')
-                placeActReceiptsOf(encoded, source, trust.historical(encoded));
-            return { ...prior, identity: id, kind: 'once' };
-        }
-        const verified = verifyPlaceActContext(encoded, trust.contract);
-        const originals = decoded.places.map(p => p.records);
-        const capacity = (size) => {
-            const inventory = persistence.inventory(limits);
-            if (inventory.bytes + size > limits.bytes)
-                fail('publication byte budget');
-            if (inventory.names.length >= limits.acts)
-                fail('publication act budget');
-        };
-        const sizeOf = (files) => Object.values(files).reduce((n, v) => n + new TextEncoder().encode(v).length, 0);
-        capacity(sizeOf({ 'context.json': encoded, 'originals.json': JSON.stringify(originals) + '\n' }));
-        const assertCurrent = () => {
-            const current = trust.current();
-            if (rootBytes(current.root) !== rootBytes(verified.dependencies))
-                fail('authority changed before publication');
-            if (new Set(current.heads.map(h => h.place)).size !== current.heads.length)
-                fail('ambiguous receiver heads');
-            const stored = persistence.heads(trust, limits);
-            for (const p of decoded.places) {
-                const actual = stored.find(h => h.place === p.place), selected = current.heads.find(h => h.place === p.place);
-                if (!actual || !selected || actual.identity !== selected.identity || actual.epoch !== selected.epoch)
-                    fail('receiver snapshot is not committed head ' + p.place);
-                if (selected.identity !== p.previous)
-                    fail('receiver head moved ' + p.place);
-                const next = receiverClock(selected.epoch, fail) + 1;
-                if (!Number.isSafeInteger(next) || receiverClock(p.epoch, fail) !== next)
-                    fail('receiver epoch not next ' + p.place);
-            }
-        };
-        assertCurrent();
-        cancelled(signal);
-        const receipts = structuredClone(typeof source === 'function' ? await source() : source);
-        cancelled(signal);
-        placeActReceiptsOf(encoded, receipts, trust.contract);
-        const files = { 'context.json': encoded, 'receipts.json': JSON.stringify(receipts) + '\n', 'originals.json': JSON.stringify(originals) + '\n' };
-        capacity(sizeOf(files));
-        assertCurrent();
-        cancelled(signal);
-        try {
-            persistence.publish(id, files);
-        }
-        catch (error) {
-            throw new ActCommitUnknown(id, error);
-        }
-        return { context: encoded, receipts, originals, identity: id, kind: 'landed' };
-    });
-}
+var R=Object.defineProperty;var r=(e,i)=>R(e,"name",{value:i,configurable:!0});import{library3_readPlaceActContext as E,library3_verifyPlaceActContext as J,library3_placeActReceiptsOf as S}from"../vendor/runtime.js";import{requireEffects as U}from"./read-only.js";import{BoundRefusal as I}from"./refusals.js";import{ActCommitUnknown as _}from"./commit-result.js";import{assertHostNotCancelled as h,receiverClock as N,placeRegionOf as z}from"./host-controls.js";import{ActCommitUnknown as M}from"./commit-result.js";const n=r(e=>{throw new I("host/act","REFUSE\xB7place act "+e)},"fail"),j=r(e=>JSON.stringify([e.namespace,e.snapshot,e.epoch,e.prefix,e.head,e.policies]),"rootBytes");async function G(e,i,a,o,p,f){U("place act commitment"),h(f),(!o||!Number.isSafeInteger(o.acts)||o.acts<1||!Number.isSafeInteger(o.bytes)||o.bytes<1)&&n("missing storage budget");const m=E(e,a.contract.budget),l=a.contract.digest(e),k=m.places.map(y=>z(y.place));return p.exclusive(k,async()=>{h(f);const y=p.result(l,a,o);if(y)return y.context!==e&&n("replay bytes differ"),typeof i!="function"&&S(e,i,a.historical(e)),{...y,identity:l,kind:"once"};const P=J(e,a.contract),b=m.places.map(t=>t.records),v=r(t=>{const s=p.inventory(o);s.bytes+t>o.bytes&&n("publication byte budget"),s.names.length>=o.acts&&n("publication act budget")},"capacity"),C=r(t=>Object.values(t).reduce((s,c)=>s+new TextEncoder().encode(c).length,0),"sizeOf");v(C({"context.json":e,"originals.json":JSON.stringify(b)+`
+`}));const w=r(()=>{const t=a.current();j(t.root)!==j(P.dependencies)&&n("authority changed before publication"),new Set(t.heads.map(c=>c.place)).size!==t.heads.length&&n("ambiguous receiver heads");const s=p.heads(a,o);for(const c of m.places){const g=s.find(x=>x.place===c.place),d=t.heads.find(x=>x.place===c.place);(!g||!d||g.identity!==d.identity||g.epoch!==d.epoch)&&n("receiver snapshot is not committed head "+c.place),d.identity!==c.previous&&n("receiver head moved "+c.place);const O=N(d.epoch,n)+1;(!Number.isSafeInteger(O)||N(c.epoch,n)!==O)&&n("receiver epoch not next "+c.place)}},"assertCurrent");w(),h(f);const u=structuredClone(typeof i=="function"?await i():i);h(f),S(e,u,a.contract);const A={"context.json":e,"receipts.json":JSON.stringify(u)+`
+`,"originals.json":JSON.stringify(b)+`
+`};v(C(A)),w(),h(f);try{p.publish(l,A)}catch(t){throw new _(l,t)}return{context:e,receipts:u,originals:b,identity:l,kind:"landed"}})}r(G,"transactPlaceAct");export{M as PlaceActCommitUnknown,G as transactPlaceAct};

package/dist/host/place-clock-selection.js

@@ -1,124 +1,5 @@
-/** Fixed HOST construction for the opt-in SDK clock profile. No CLI activation,
- * inferred genesis, new wire fields, or packet-supplied signature verifier. */
-import { createHash } from 'node:crypto';
-import { PLACE_ACT_CONTEXT } from '@lapxo/topos/core';
-import { canonical, signedBytes, wireAt } from '@lapxo/topos/wire';
-import { foldClaims, isConfig, fieldOf, parsedLine as parse } from "../fold/claims.js";
-import { signatureEraOf as eraOf } from "./signature-era.js";
-import { authorityFor } from "../fold/signers.js";
-import { verifyBytes } from "./adapters/keys/ed25519.js";
-import { verifiesOwnerLine } from "../land/sign.js";
-import { placeActHeads } from "./ports/place-act.js";
-const fail = (why) => { throw Error('REFUSE·clock selection ' + why); };
-const digest = (s) => 'sha256:' + createHash('sha256').update(s).digest('hex');
-const text = (s) => typeof s === 'string' && s.length > 0;
-const clock = (s) => { if (typeof s !== 'string' || !/^(0|[1-9][0-9]*)$/.test(s) || !Number.isSafeInteger(Number(s)))
-    fail('unknown clock'); return Number(s); };
-// Exact-byte parsing returns frozen values. Retain only this pure syntax verdict;
-// history, signatures, authority windows, clocks and protected rereads stay fresh.
-const canonicalValues = new WeakSet();
-const f = (line) => { const got = parse(line); if (got.kind !== 'fact')
-    return fail('noncanonical history'); if (!canonicalValues.has(got.value)) {
-    if (canonical(got.value.fields, got.value.version) !== line)
-        fail('noncanonical history');
-    canonicalValues.add(got.value);
-} return got.value.fields; };
-/** Root chooses selector and anchors/resources from its authenticated standing.
- * Selection must be ROOT signed; a world's signature grants no host capability. */
-export function hostClockSelection(input) {
-    const b = input.resources;
-    if (!b || Object.keys(b).sort().join(',') !== 'bytes,lines,places' || Object.values(b).some(n => !Number.isSafeInteger(n) || n < 1))
-        fail('missing input resources');
-    const inherited = input.inherited;
-    if (!inherited?.clock || Object.keys(inherited.clock).sort().join(',') !== 'bytes,placements,policies,proofs,records,signers' || !inherited.storage || Object.keys(inherited.storage).sort().join(',') !== 'acts,bytes' || [...Object.values(inherited.clock), ...Object.values(inherited.storage)].some(n => !Number.isSafeInteger(n) || n < 1))
-        fail('missing inherited resource authority');
-    if (input.history.length + input.legacyOriginals.length > b.lines)
-        fail('input line budget');
-    let bytes = 0;
-    for (const line of [...input.history, ...input.legacyOriginals]) {
-        if (typeof line !== 'string' || line.length > b.bytes || (bytes += Buffer.byteLength(line)) > b.bytes)
-            fail('input byte budget');
-    }
-    const snapshots = new Map();
-    for (const original of input.history) {
-        const epoch = clock(f(original).epoch ?? fail('history clock absent'));
-        let authority = snapshots.get(epoch);
-        if (!authority) {
-            const before = input.history.filter(l => !isConfig(l) || clock(f(l).epoch ?? fail('history clock absent')) <= epoch);
-            authority = authorityFor(before, input.anchor, eraOf(foldClaims(before.filter(l => fieldOf(l, 'scope').startsWith('wire/'))).standing).admitted);
-            snapshots.set(epoch, authority);
-        }
-        if (authority.of(original).kind !== 'admitted')
-            fail('history not authenticated at admission');
-    }
-    const live = foldClaims(input.history.filter(isConfig)).standing.filter(l => fieldOf(l, 'value') !== 'withdraw');
-    const ids = live.filter(l => { const p = f(l); return p.scope === input.profileSelector && p.measure === 'id'; });
-    if (ids.length !== 1 || f(ids[0]).value !== PLACE_ACT_CONTEXT || f(ids[0]).role !== 'writes' || f(ids[0]).form !== 'alphabet' || f(ids[0]).by !== input.anchor.id)
-        fail('missing/ambiguous clock profile id');
-    const rows = live.filter(l => { const p = f(l); return p.scope === input.selector && p.measure === 'text'; });
-    if (rows.length !== 1)
-        fail('missing/ambiguous Root selector');
-    const line = rows[0], fields = f(line);
-    if (fields.by !== input.anchor.id || fields.role !== 'writes' || fields.form !== 'alphabet' || fields.value !== 'lock' || !verifiesOwnerLine(line, input.anchor.publicKey, input.algorithms))
-        fail('selector is not Root signed');
-    if (!fields.about || fields.about.length > b.bytes)
-        fail('missing selector body');
-    let selection;
-    try {
-        selection = JSON.parse(fields.about);
-    }
-    catch {
-        return fail('selector JSON');
-    }
-    if (!selection || Object.keys(selection).sort().join(',') !== 'budget,digestAlgorithm,initial,namespace,profile,receiptScope,receiptSigner,regionFamily,storageBudget' || selection.profile !== PLACE_ACT_CONTEXT || selection.digestAlgorithm !== 'sha256' || !text(selection.namespace) || !text(selection.regionFamily) || !text(selection.receiptSigner) || !text(selection.receiptScope) || !Array.isArray(selection.initial) || !selection.initial.length || selection.initial.length > b.places)
-        fail('unsupported selector shape');
-    if (JSON.stringify(selection) !== fields.about)
-        fail('noncanonical selector JSON');
-    if (!selection.budget || Object.keys(selection.budget).sort().join(',') !== 'bytes,placements,policies,proofs,records,signers' || Object.values(selection.budget).some(n => !Number.isSafeInteger(n) || n < 1) || !selection.storageBudget || Object.keys(selection.storageBudget).sort().join(',') !== 'acts,bytes' || Object.values(selection.storageBudget).some(n => !Number.isSafeInteger(n) || n < 1))
-        fail('missing selected resources');
-    for (const name of ['bytes', 'records', 'placements', 'policies', 'proofs', 'signers'])
-        if (selection.budget[name] > inherited.clock[name])
-            fail('clock resource exceeds inherited ' + name);
-    for (const name of ['acts', 'bytes'])
-        if (selection.storageBudget[name] > inherited.storage[name])
-            fail('storage resource exceeds inherited ' + name);
-    if (selection.budget.bytes > b.bytes || selection.storageBudget.bytes > b.bytes || selection.budget.records > b.lines || selection.budget.placements > b.places)
-        fail('selected resources exceed input authority');
-    const wire = wireAt(live.map(f), Number.MAX_SAFE_INTEGER);
-    if (!wire || !wire.digests.has(selection.digestAlgorithm))
-        fail('digest algorithm not declared');
-    const authority = authorityFor(input.history, input.anchor, input.algorithms);
-    if (!input.history.includes(input.authorityCheckpoint) || !isConfig(input.authorityCheckpoint))
-        fail('missing authenticated Root authority checkpoint');
-    const checkpointEpoch = clock(f(input.authorityCheckpoint).epoch ?? fail('Root authority clock absent'));
-    if (snapshots.get(checkpointEpoch)?.of(input.authorityCheckpoint).kind !== 'admitted')
-        fail('Root checkpoint not admitted at original epoch');
-    const epoch = clock(f(input.authorityCheckpoint).epoch ?? fail('Root authority clock absent'));
-    if (input.history.filter(isConfig).some(l => clock(f(l).epoch ?? fail('history clock absent')) > epoch))
-        fail('authority checkpoint precedes Root configuration');
-    const prefix = digest(input.history.join('\n') + '\n'), head = digest(live.join('\n') + '\n');
-    const policies = [...new Set(live.map(digest))].sort();
-    if (policies.length > selection.budget.policies)
-        fail('actual dependency budget');
-    const root = { namespace: selection.namespace, snapshot: digest(JSON.stringify([prefix, head, String(epoch)])), epoch: String(epoch), prefix, head, policies };
-    const initialHeads = selection.initial.map(i => { if (!i || !i.receiver || !i.origin || !text(i.receiver.identity) || !text(i.origin.prefix) || !text(i.place))
-        fail('unknown initial namespace'); const parts = i.place.split('/'); if (i.place !== '.' && (parts.length < 2 || parts.at(-1) !== 'TARGET.bound' || parts.some(s => s === '' || s === '.' || s === '..')))
-        fail('unknown initial namespace'); clock(i.receiver.epoch); clock(i.origin.epoch); return { place: i.place, identity: i.receiver.identity, epoch: i.receiver.epoch }; });
-    if (new Set(initialHeads.map(h => h.place)).size !== initialHeads.length)
-        fail('duplicate namespace');
-    const legacy = new Set(input.legacyOriginals.map(l => digest(signedBytes(f(l)))));
-    let heads = [];
-    const contract = { budget: selection.budget, root, signers: authority.admitted, places: initialHeads.map(h => h.place), regionFamily: selection.regionFamily, receiptSigner: selection.receiptSigner, receiptScope: selection.receiptScope, digest,
-        verifiesRootContext: c => JSON.stringify(c) === JSON.stringify(root),
-        verifiesNamespaceAdmission: p => { if (p === '.')
-            return true; const parts = p.split('/'); if (parts.length < 2 || parts.pop() !== 'TARGET.bound' || parts.some(s => s === '' || s === '.' || s === '..'))
-            return false; const n = parts.join('/'), rows = live.filter(l => f(l).scope === selection.regionFamily + '/' + n); if (rows.length !== 1)
-            return false; const v = f(rows[0]); return v.role === 'writes' && v.form === 'alphabet' && v.measure === 'coordinates' && v.value === n + '/**'; },
-        verifiesNewLocalPrefix: (p, prefix, epoch, originals) => { const h = heads.find(h => h.place === p), i = selection.initial.find(i => i.place === p); if (!h || !i || originals.some(l => legacy.has(digest(signedBytes(f(l))))))
-            return false; return h.identity === i.receiver.identity ? prefix === i.origin.prefix && epoch === i.origin.epoch : prefix === h.identity && clock(epoch) === clock(h.epoch) + 1; },
-        verifiesOriginal: (l, s) => verifiesOwnerLine(l, s.publicKey, input.algorithms),
-        verifiesProof: (text, signature, s) => verifyBytes(text, s.publicKey, signature, input.algorithms), };
-    heads = input.authenticatedReceiverHeads ?? placeActHeads(input.store, initialHeads, { contract, historical: input.historical }, selection.storageBudget);
-    const trust = { contract, initialHeads, current: () => { const fresh = hostClockSelection({ ...input, ...input.readCurrent(), authenticatedReceiverHeads: undefined }); return { root: fresh.trust.contract.root, heads: placeActHeads(input.store, fresh.trust.initialHeads, fresh.trust, fresh.selection.storageBudget) }; }, historical: input.historical };
-    return { selection, trust };
-}
+var U=Object.defineProperty;var l=(t,s)=>U(t,"name",{value:s,configurable:!0});import{createHash as V}from"node:crypto";import{library3_PLACE_ACT_CONTEXT as _}from"../vendor/runtime.js";import{library11_canonical as $,library11_signedBytes as F,library11_wireAt as q}from"../vendor/runtime.js";import{foldClaims as J,isConfig as S,fieldOf as H,parsedLine as D}from"../fold/claims.js";import{signatureEraOf as Q}from"./signature-era.js";import{authorityFor as I}from"../fold/signers.js";import{verifyBytes as Y}from"./adapters/keys/ed25519.js";import{verifiesOwnerLine as L}from"../land/sign.js";import{placeActHeads as P}from"./ports/place-act.js";const i=l(t=>{throw Error("REFUSE\xB7clock selection "+t)},"fail"),y=l(t=>"sha256:"+V("sha256").update(t).digest("hex"),"digest"),m=l(t=>typeof t=="string"&&t.length>0,"text"),h=l(t=>((typeof t!="string"||!/^(0|[1-9][0-9]*)$/.test(t)||!Number.isSafeInteger(Number(t)))&&i("unknown clock"),Number(t)),"clock"),G=new WeakSet,c=l(t=>{const s=D(t);return s.kind!=="fact"?i("noncanonical history"):(G.has(s.value)||($(s.value.fields,s.value.version)!==t&&i("noncanonical history"),G.add(s.value)),s.value.fields)},"f");function Z(t){const s=t.resources;(!s||Object.keys(s).sort().join(",")!=="bytes,lines,places"||Object.values(s).some(e=>!Number.isSafeInteger(e)||e<1))&&i("missing input resources");const f=t.inherited;(!f?.clock||Object.keys(f.clock).sort().join(",")!=="bytes,placements,policies,proofs,records,signers"||!f.storage||Object.keys(f.storage).sort().join(",")!=="acts,bytes"||[...Object.values(f.clock),...Object.values(f.storage)].some(e=>!Number.isSafeInteger(e)||e<1))&&i("missing inherited resource authority"),t.history.length+t.legacyOriginals.length>s.lines&&i("input line budget");let K=0;for(const e of[...t.history,...t.legacyOriginals])(typeof e!="string"||e.length>s.bytes||(K+=Buffer.byteLength(e))>s.bytes)&&i("input byte budget");const O=new Map;for(const e of t.history){const r=h(c(e).epoch??i("history clock absent"));let a=O.get(r);if(!a){const p=t.history.filter(n=>!S(n)||h(c(n).epoch??i("history clock absent"))<=r);a=I(p,t.anchor,Q(J(p.filter(n=>H(n,"scope").startsWith("wire/"))).standing).admitted),O.set(r,a)}a.of(e).kind!=="admitted"&&i("history not authenticated at admission")}const u=J(t.history.filter(S)).standing.filter(e=>H(e,"value")!=="withdraw"),b=u.filter(e=>{const r=c(e);return r.scope===t.profileSelector&&r.measure==="id"});(b.length!==1||c(b[0]).value!==_||c(b[0]).role!=="writes"||c(b[0]).form!=="alphabet"||c(b[0]).by!==t.anchor.id)&&i("missing/ambiguous clock profile id");const j=u.filter(e=>{const r=c(e);return r.scope===t.selector&&r.measure==="text"});j.length!==1&&i("missing/ambiguous Root selector");const N=j[0],d=c(N);(d.by!==t.anchor.id||d.role!=="writes"||d.form!=="alphabet"||d.value!=="lock"||!L(N,t.anchor.publicKey,t.algorithms))&&i("selector is not Root signed"),(!d.about||d.about.length>s.bytes)&&i("missing selector body");let o;try{o=JSON.parse(d.about)}catch{return i("selector JSON")}(!o||Object.keys(o).sort().join(",")!=="budget,digestAlgorithm,initial,namespace,profile,receiptScope,receiptSigner,regionFamily,storageBudget"||o.profile!==_||o.digestAlgorithm!=="sha256"||!m(o.namespace)||!m(o.regionFamily)||!m(o.receiptSigner)||!m(o.receiptScope)||!Array.isArray(o.initial)||!o.initial.length||o.initial.length>s.places)&&i("unsupported selector shape"),JSON.stringify(o)!==d.about&&i("noncanonical selector JSON"),(!o.budget||Object.keys(o.budget).sort().join(",")!=="bytes,placements,policies,proofs,records,signers"||Object.values(o.budget).some(e=>!Number.isSafeInteger(e)||e<1)||!o.storageBudget||Object.keys(o.storageBudget).sort().join(",")!=="acts,bytes"||Object.values(o.storageBudget).some(e=>!Number.isSafeInteger(e)||e<1))&&i("missing selected resources");for(const e of["bytes","records","placements","policies","proofs","signers"])o.budget[e]>f.clock[e]&&i("clock resource exceeds inherited "+e);for(const e of["acts","bytes"])o.storageBudget[e]>f.storage[e]&&i("storage resource exceeds inherited "+e);(o.budget.bytes>s.bytes||o.storageBudget.bytes>s.bytes||o.budget.records>s.lines||o.budget.placements>s.places)&&i("selected resources exceed input authority");const A=q(u.map(c),Number.MAX_SAFE_INTEGER);(!A||!A.digests.has(o.digestAlgorithm))&&i("digest algorithm not declared");const X=I(t.history,t.anchor,t.algorithms);(!t.history.includes(t.authorityCheckpoint)||!S(t.authorityCheckpoint))&&i("missing authenticated Root authority checkpoint");const M=h(c(t.authorityCheckpoint).epoch??i("Root authority clock absent"));O.get(M)?.of(t.authorityCheckpoint).kind!=="admitted"&&i("Root checkpoint not admitted at original epoch");const w=h(c(t.authorityCheckpoint).epoch??i("Root authority clock absent"));t.history.filter(S).some(e=>h(c(e).epoch??i("history clock absent"))>w)&&i("authority checkpoint precedes Root configuration");const C=y(t.history.join(`
+`)+`
+`),E=y(u.join(`
+`)+`
+`),R=[...new Set(u.map(y))].sort();R.length>o.budget.policies&&i("actual dependency budget");const B={namespace:o.namespace,snapshot:y(JSON.stringify([C,E,String(w)])),epoch:String(w),prefix:C,head:E,policies:R},k=o.initial.map(e=>{(!e||!e.receiver||!e.origin||!m(e.receiver.identity)||!m(e.origin.prefix)||!m(e.place))&&i("unknown initial namespace");const r=e.place.split("/");return e.place!=="."&&(r.length<2||r.at(-1)!=="TARGET.bound"||r.some(a=>a===""||a==="."||a===".."))&&i("unknown initial namespace"),h(e.receiver.epoch),h(e.origin.epoch),{place:e.place,identity:e.receiver.identity,epoch:e.receiver.epoch}});new Set(k.map(e=>e.place)).size!==k.length&&i("duplicate namespace");const W=new Set(t.legacyOriginals.map(e=>y(F(c(e)))));let x=[];const T={budget:o.budget,root:B,signers:X.admitted,places:k.map(e=>e.place),regionFamily:o.regionFamily,receiptSigner:o.receiptSigner,receiptScope:o.receiptScope,digest:y,verifiesRootContext:l(e=>JSON.stringify(e)===JSON.stringify(B),"verifiesRootContext"),verifiesNamespaceAdmission:l(e=>{if(e===".")return!0;const r=e.split("/");if(r.length<2||r.pop()!=="TARGET.bound"||r.some(g=>g===""||g==="."||g===".."))return!1;const a=r.join("/"),p=u.filter(g=>c(g).scope===o.regionFamily+"/"+a);if(p.length!==1)return!1;const n=c(p[0]);return n.role==="writes"&&n.form==="alphabet"&&n.measure==="coordinates"&&n.value===a+"/**"},"verifiesNamespaceAdmission"),verifiesNewLocalPrefix:l((e,r,a,p)=>{const n=x.find(v=>v.place===e),g=o.initial.find(v=>v.place===e);return!n||!g||p.some(v=>W.has(y(F(c(v)))))?!1:n.identity===g.receiver.identity?r===g.origin.prefix&&a===g.origin.epoch:r===n.identity&&h(a)===h(n.epoch)+1},"verifiesNewLocalPrefix"),verifiesOriginal:l((e,r)=>L(e,r.publicKey,t.algorithms),"verifiesOriginal"),verifiesProof:l((e,r,a)=>Y(e,a.publicKey,r,t.algorithms),"verifiesProof")};x=t.authenticatedReceiverHeads??P(t.store,k,{contract:T,historical:t.historical},o.storageBudget);const z={contract:T,initialHeads:k,current:l(()=>{const e=Z({...t,...t.readCurrent(),authenticatedReceiverHeads:void 0});return{root:e.trust.contract.root,heads:P(t.store,e.trust.initialHeads,e.trust,e.selection.storageBudget)}},"current"),historical:t.historical};return{selection:o,trust:z}}l(Z,"hostClockSelection");export{Z as hostClockSelection};