@lapxo/bound 0.2.4 → 0.2.5

package/dist/host/selected-capsules.js

@@ -1,50 +1 @@
-import { capsuleAt } from "./capsule.js";
-import { capsuleOffers, providerInputs, providerInputRegions, capsuleDescriptor, assertCapsuleDescriptor } from '@lapxo/topos/standing';
-import { fullDigest } from "./digest.js";
-import { wireAt, parse } from '@lapxo/topos/wire';
-import { selectedTopoi, toposAt } from "./selected-topos.js";
-import { canonical } from '@lapxo/topos/wire';
-import { fieldOf } from "../fold/claims.js";
-import { ownLock } from "../observe/runner.js";
-import { archiveCoordinate } from "./archive.js";
-/** Only explicit capsule offers request execution. Forms/classes/views do not need an executable alias. */
-export function selectedCapsules(pins, resolve = capsuleAt, select = toposAt, host = ownLock()) {
-    return selectedTopoi(pins, select).flatMap(({ digest, topos }) => capsuleOffers(topos).map(offer => {
-        const load = () => {
-            const projections = host.filter(line => fieldOf(line, 'scope').startsWith('dep/') && fieldOf(line, 'role') === 'writes' && fieldOf(line, 'value') === offer.value);
-            if (!projections.length || projections.some(line => !fieldOf(line, 'shape')))
-                throw Error(`REFUSE·pin ${digest} capsule ${offer.value} needs one host projection`);
-            const entries = [...new Set(projections.map(line => archiveCoordinate(fieldOf(line, 'shape'))))];
-            if (entries.length !== 1)
-                throw Error(`REFUSE·pin ${digest} capsule ${offer.value} has conflicting host projections`);
-            const loaded = resolve(offer.value, entries[0]);
-            if (loaded === undefined)
-                throw Error(`REFUSE·pin ${digest} · ${offer.scope} · offered capsule ${offer.value} unavailable`);
-            return { capsule: loaded, offer: canonical({ ...offer, shape: entries[0] }) };
-        };
-        const descriptor = capsuleDescriptor(topos, offer.scope ?? '');
-        const loaded = descriptor === undefined ? load() : undefined;
-        const supplied = loaded === undefined ? {
-            digest: offer.value, selection: `${digest} ${offer.scope}`, ...descriptor, ask: (requests, reader) => {
-                if (!requests.length)
-                    return [];
-                const actual = load();
-                assertCapsuleDescriptor(descriptor.lines, actual.capsule.lines);
-                return actual.capsule.ask(requests, reader);
-            },
-        } : { ...loaded.capsule, selection: `${digest} ${offer.scope}` };
-        const capsule = { ...supplied, selectedWorld: { standing: topos, offer: offer.scope ?? '' } };
-        const projected = loaded?.offer ?? canonical(offer);
-        if (!providerInputRegions(topos, offer.scope ?? '').length)
-            return { capsule, offer: projected };
-        const fields = ownLock().flatMap(line => { const p = parse(line); return p.kind === 'fact' ? [p.value.fields] : []; });
-        const wire = wireAt(fields, Number.MAX_SAFE_INTEGER), algorithm = wire && [...wire.digests][0];
-        if (!algorithm)
-            throw Error('REFUSE·input instrument has no admitted digest algorithm');
-        const selected = { ...capsule, selection: `${digest} ${offer.scope}`, ask: (requests, reader) => capsule.ask(requests.map(request => {
-                const provider = providerInputs(topos, digest, offer.scope ?? '', offer.value, request.region ?? '', bytes => fullDigest(bytes, algorithm));
-                return provider === undefined ? request : { ...request, provider };
-            }), reader) };
-        return { capsule: selected, offer: projected };
-    }));
-}
+var R=Object.defineProperty;var n=(l,c)=>R(l,"name",{value:c,configurable:!0});import{capsuleAt as k}from"./capsule.js";import{library7_capsuleOffers as A,library7_providerInputs as S,library7_providerInputRegions as D,library7_capsuleDescriptor as F,library7_assertCapsuleDescriptor as I}from"../vendor/runtime.js";import{fullDigest as j}from"./digest.js";import{library11_wireAt as C,library11_parse as U}from"../vendor/runtime.js";import{selectedTopoi as M,toposAt as O}from"./selected-topos.js";import{library11_canonical as $}from"../vendor/runtime.js";import{fieldOf as p}from"../fold/claims.js";import{ownLock as b}from"../observe/runner.js";import{archiveCoordinate as N}from"./archive.js";function Q(l,c=k,w=O,_=b()){return M(l,w).flatMap(({digest:o,topos:i})=>A(i).map(e=>{const h=n(()=>{const r=_.filter(t=>p(t,"scope").startsWith("dep/")&&p(t,"role")==="writes"&&p(t,"value")===e.value);if(!r.length||r.some(t=>!p(t,"shape")))throw Error(`REFUSE\xB7pin ${o} capsule ${e.value} needs one host projection`);const s=[...new Set(r.map(t=>N(p(t,"shape"))))];if(s.length!==1)throw Error(`REFUSE\xB7pin ${o} capsule ${e.value} has conflicting host projections`);const a=c(e.value,s[0]);if(a===void 0)throw Error(`REFUSE\xB7pin ${o} \xB7 ${e.scope} \xB7 offered capsule ${e.value} unavailable`);return{capsule:a,offer:$({...e,shape:s[0]})}},"load"),u=F(i,e.scope??""),d=u===void 0?h():void 0,m={...d===void 0?{digest:e.value,selection:`${o} ${e.scope}`,...u,ask:n((r,s)=>{if(!r.length)return[];const a=h();return I(u.lines,a.capsule.lines),a.capsule.ask(r,s)},"ask")}:{...d.capsule,selection:`${o} ${e.scope}`},selectedWorld:{standing:i,offer:e.scope??""}},v=d?.offer??$(e);if(!D(i,e.scope??"").length)return{capsule:m,offer:v};const g=b().flatMap(r=>{const s=U(r);return s.kind==="fact"?[s.value.fields]:[]}),f=C(g,Number.MAX_SAFE_INTEGER),E=f&&[...f.digests][0];if(!E)throw Error("REFUSE\xB7input instrument has no admitted digest algorithm");return{capsule:{...m,selection:`${o} ${e.scope}`,ask:n((r,s)=>m.ask(r.map(a=>{const t=S(i,o,e.scope??"",e.value,a.region??"",y=>j(y,E));return t===void 0?a:{...a,provider:t}}),s),"ask")},offer:v}}))}n(Q,"selectedCapsules");export{Q as selectedCapsules};

package/dist/host/selected-topos.js

@@ -1,80 +1 @@
-import { verifiedContent } from "./content-store.js";
-import { readStanding } from '@lapxo/topos/standing';
-import { parse, wireAt, fromLine } from '@lapxo/topos/wire';
-import { fieldOf } from "../fold/claims.js";
-import { moduleClosure } from "./native/module-closure.js";
-import { sha256, isSha256 } from "./hash.js";
-/** Local grammar is sufficient for locally declared records. Resolve selected
- * contracts only when a reader is missing; a local refusal remains a refusal. */
-export function admittedLine(line, local, epoch, pins, resolve = toposAt) {
-    const own = wireAt(local, epoch);
-    // A signature era alone is not a configuration grammar. An absent list
-    // must be supplied by the selected contract; an explicit local list remains
-    // authoritative and may refuse a field without opening unrelated content.
-    if (own && ['fields', 'required', 'roles', 'forms', 'at-classes'].every(name => own.lists.has(name))) {
-        const got = fromLine(line, own);
-        const needsObject = fieldOf(line, 'type') !== '' && !own.object;
-        if (got.kind === 'fact' || (got.kind === 'refuse' && !needsObject))
-            return got;
-    }
-    return fromLine(line, selectedWireAt(local, epoch, pins, resolve));
-}
-/** Resolve content using the instrument wire's admitted digest algorithms. No transport interpretation. */
-export function toposAt(digest, store) {
-    const topos = readStanding(Buffer.from(contentAt(digest, store)).toString('utf8'));
-    return topos;
-}
-export function contentAt(digest, store) {
-    return verifiedContent(digest, store).bytes;
-}
-/** The declared module runs from the store that supplied its verified bytes. No copy or live-checkout fallback. */
-export function contextModuleAt(digest, store, dependencies) {
-    if (dependencies !== undefined) {
-        if (!isSha256(digest) || !dependencies.includes(digest) || dependencies.some(pin => !isSha256(pin)))
-            throw Error('REFUSE·context module closure requires declared SHA-256 members');
-        const pins = [...new Set(dependencies)].sort(), members = new Map(pins.map(pin => [pin.slice(pin.indexOf(':') + 1), { digest: pin, source: new TextDecoder('utf-8', { fatal: true }).decode(contentAt(pin, store)) }]));
-        moduleClosure({ identity: sha256(JSON.stringify(pins)), entry: digest.slice(digest.indexOf(':') + 1), members }, () => undefined);
-    }
-    return verifiedContent(digest, store).path;
-}
-/** Selection verifies standing identity. Requested capabilities verify their artifact bytes separately. */
-export function selectedTopoi(pins, resolve = toposAt) {
-    return [...new Set(pins.map(pin => fieldOf(pin, 'value')))].map(digest => ({ digest, topos: resolve(digest) }));
-}
-/** Read a declared wire list without copying a world's claims or executing its offers.
- * Independent declarations must agree; selection order cannot choose a contract.
- */
-export function selectedWireList(local, epoch, pins, list, resolve = toposAt) {
-    const records = local.flatMap(line => { const got = parse(line); return got.kind === 'fact' ? [got.value.fields] : []; });
-    const contracts = [{ name: 'place', wire: wireAt(records, epoch) }, ...selectedTopoi(pins, resolve).map(({ digest, topos }) => ({ name: digest, wire: wireAt(topos.parts, Number.MAX_SAFE_INTEGER) }))]
-        .flatMap(({ name, wire }) => { const words = wire?.lists.get(list); return words === undefined ? [] : [{ name, words: [...words] }]; });
-    if (!contracts.length)
-        throw Error(`REFUSE·wire wire/${list} has no declared contract in the place or its selected topoi`);
-    const first = contracts[0];
-    if (contracts.some(({ words }) => words.length !== first.words.length || words.some(word => !first.words.includes(word))))
-        throw Error(`REFUSE·wire wire/${list} has conflicting contracts · ${contracts.map(one => one.name).join(' · ')}`);
-    return first.words;
-}
-/** Complete an admission snapshot from the selected standing. Local declarations
- * govern their own lists; independent selected contracts cannot choose by order. */
-export function selectedWireAt(local, epoch, pins, resolve = toposAt) {
-    const own = wireAt(local, epoch);
-    const worlds = selectedTopoi(pins, resolve).map(({ digest, topos }) => ({ digest, parts: topos.parts, wire: wireAt(topos.parts, Number.MAX_SAFE_INTEGER) }));
-    const key = (scope) => scope.startsWith('wire/') ? scope.slice(5) : scope.startsWith('audit/wire/') ? scope.slice(11) : undefined;
-    const declared = new Set(local.filter(f => Number(f.epoch ?? 0) <= epoch).map(f => key(f.scope ?? '')).filter((k) => k !== undefined));
-    const selected = new Map();
-    for (const world of worlds)
-        for (const f of world.parts) {
-            const name = key(f.scope ?? '');
-            if (name === undefined || declared.has(name))
-                continue;
-            const list = world.wire?.lists.get(name);
-            const value = list ? [...list].sort().join('|') : f.value ?? '';
-            const previous = selected.get(name);
-            if (previous && previous.value !== value)
-                throw Error(`REFUSE·wire wire/${name} has conflicting selected contracts · ${previous.digest} · ${world.digest}`);
-            if (!previous)
-                selected.set(name, { value, fields: f, digest: world.digest });
-        }
-    return selected.size ? wireAt([...selected.values()].map(one => one.fields).concat(local), epoch) : own;
-}
+var b=Object.defineProperty;var a=(t,r)=>b(t,"name",{value:r,configurable:!0});import{verifiedContent as S}from"./content-store.js";import{library7_readStanding as O}from"../vendor/runtime.js";import{library11_parse as F,library11_wireAt as m,library11_fromLine as g}from"../vendor/runtime.js";import{fieldOf as x}from"../fold/claims.js";import{moduleClosure as M}from"./native/module-closure.js";import{sha256 as N,isSha256 as y}from"./hash.js";function J(t,r,o,s,f=p){const n=m(r,o);if(n&&["fields","required","roles","forms","at-classes"].every(i=>n.lists.has(i))){const i=g(t,n),u=x(t,"type")!==""&&!n.object;if(i.kind==="fact"||i.kind==="refuse"&&!u)return i}return g(t,_(r,o,s,f))}a(J,"admittedLine");function p(t,r){return O(Buffer.from(v(t,r)).toString("utf8"))}a(p,"toposAt");function v(t,r){return S(t,r).bytes}a(v,"contentAt");function R(t,r,o){if(!Array.isArray(o)||!y(t)||!o.includes(t)||o.some(n=>!y(n)))throw Error("REFUSE\xB7context module closure requires declared SHA-256 members");const s=[...new Set(o)].sort(),f=new Map(s.map(n=>[n.slice(n.indexOf(":")+1),{digest:n,source:new TextDecoder("utf-8",{fatal:!0}).decode(v(n,r))}]));return M({identity:N(JSON.stringify(s)),entry:t.slice(t.indexOf(":")+1),members:f},()=>{},{esmOnly:!0}),S(t,r).path}a(R,"contextModuleAt");function q(t){const r=new Map;return{topos:a(o=>{const s=p(o,t);for(const f of s.parts.filter(n=>n.kind==="check"&&n.value)){const n=[...new Set((f.restsOn??"").split("|").filter(Boolean))].sort(),i=r.get(f.value);if(i&&JSON.stringify(i)!==JSON.stringify(n))throw Error("REFUSE\xB7context module has conflicting declared closures");r.set(f.value,n)}return s},"topos"),module:a(o=>{const s=r.get(o);if(s===void 0)throw Error("REFUSE\xB7context module has no declared closure");return R(o,t,s)},"module")}}a(q,"contextProviderServices");function A(t,r=p){return[...new Set(t.map(o=>x(o,"value")))].map(o=>({digest:o,topos:r(o)}))}a(A,"selectedTopoi");function B(t,r,o,s,f=p){const n=t.flatMap(c=>{const e=F(c);return e.kind==="fact"?[e.value.fields]:[]}),i=[{name:"place",wire:m(n,r)},...A(o,f).map(({digest:c,topos:e})=>({name:c,wire:m(e.parts,Number.MAX_SAFE_INTEGER)}))].flatMap(({name:c,wire:e})=>{const d=e?.lists.get(s);return d===void 0?[]:[{name:c,words:[...d]}]});if(!i.length)throw Error(`REFUSE\xB7wire wire/${s} has no declared contract in the place or its selected topoi`);const u=i[0];if(i.some(({words:c})=>c.length!==u.words.length||c.some(e=>!u.words.includes(e))))throw Error(`REFUSE\xB7wire wire/${s} has conflicting contracts \xB7 ${i.map(c=>c.name).join(" \xB7 ")}`);return u.words}a(B,"selectedWireList");function _(t,r,o,s=p){const f=m(t,r),n=A(o,s).map(({digest:e,topos:d})=>({digest:e,parts:d.parts,wire:m(d.parts,Number.MAX_SAFE_INTEGER)})),i=a(e=>e.startsWith("wire/")?e.slice(5):e.startsWith("audit/wire/")?e.slice(11):void 0,"key"),u=new Set(t.filter(e=>Number(e.epoch??0)<=r).map(e=>i(e.scope??"")).filter(e=>e!==void 0)),c=new Map;for(const e of n)for(const d of e.parts){const l=i(d.scope??"");if(l===void 0||u.has(l))continue;const E=e.wire?.lists.get(l),h=E?[...E].sort().join("|"):d.value??"",w=c.get(l);if(w&&w.value!==h)throw Error(`REFUSE\xB7wire wire/${l} has conflicting selected contracts \xB7 ${w.digest} \xB7 ${e.digest}`);w||c.set(l,{value:h,fields:d,digest:e.digest})}return c.size?m([...c.values()].map(e=>e.fields).concat(t),r):f}a(_,"selectedWireAt");export{J as admittedLine,v as contentAt,R as contextModuleAt,q as contextProviderServices,A as selectedTopoi,_ as selectedWireAt,B as selectedWireList,p as toposAt};

package/dist/host/signature-era.js

@@ -1,12 +1 @@
-import { wireLine } from "../fold/wire.js";
-import { fieldOf } from "../fold/claims.js";
-/** Pure signature vocabulary; no instrument discovery for diagnostics. */
-export function signatureEraOf(standing) {
-    const said = wireLine(standing, 'signature-algorithms');
-    const admitted = (said === undefined ? [] : fieldOf(said, 'value').split('|')).filter(Boolean);
-    const current = wireLine(standing, 'era');
-    const era = (current === undefined ? undefined : admitted.find((one) => one.endsWith(`:${fieldOf(current, 'value')}`))) ?? admitted.find((one) => one.includes(':'));
-    if (era === undefined)
-        throw new Error(`REFUSE·runtime the lock names no signature algorithm by digest: nothing can be signed here`);
-    return { admitted, era };
-}
+var s=Object.defineProperty;var d=(e,n)=>s(e,"name",{value:n,configurable:!0});import{wireLine as a}from"../fold/wire.js";import{fieldOf as f}from"../fold/claims.js";function m(e){const n=a(e,"signature-algorithms"),i=(n===void 0?[]:f(n,"value").split("|")).filter(Boolean),t=a(e,"era"),o=(t===void 0?void 0:i.find(r=>r.endsWith(`:${f(t,"value")}`)))??i.find(r=>r.includes(":"));if(o===void 0)throw new Error("REFUSE\xB7runtime the lock names no signature algorithm by digest: nothing can be signed here");return{admitted:i,era:o}}d(m,"signatureEraOf");export{m as signatureEraOf};

package/dist/host/signing.js

@@ -1,48 +1,2 @@
-import { invokeSigningPort } from "../engine/ports.js";
-import { readFileSync } from 'node:fs';
-import { parse, signerSelection, signerRequestBytes, signerResponseBytes, signerResponseOf } from '@lapxo/topos/wire';
-import { invokeSigner, SigningFailure } from "./ports/signing.js";
-/** An explicitly supplied host registry; a repository cannot supply executable bindings. */
-function binding(name, keyFile) {
-    if (name === 'file') {
-        if (!keyFile)
-            throw new SigningFailure('REFUSE·signer file needs --key-file');
-        return { kind: 'file', path: keyFile };
-    }
-    if (keyFile)
-        throw new SigningFailure('REFUSE·signer command cannot use --key-file');
-    const path = process.env['BOUND_SIGNERS'];
-    if (!path)
-        throw new SigningFailure('REFUSE·signer no host binding registry');
-    try {
-        const registry = JSON.parse(readFileSync(path, 'utf8'));
-        if (!registry || typeof registry !== 'object' || !Object.prototype.hasOwnProperty.call(registry, name))
-            throw Error();
-        const record = registry[name];
-        if (!record || typeof record !== 'object')
-            throw Error();
-        const f = record;
-        if (f['kind'] !== 'command' || typeof f['executable'] !== 'string' || !f['executable']
-            || !Array.isArray(f['args']) || !f['args'].every(a => typeof a === 'string'))
-            throw Error();
-        return { kind: 'command', executable: f['executable'], args: f['args'] };
-    }
-    catch {
-        throw new SigningFailure('REFUSE·signer host binding unavailable or invalid');
-    }
-}
-/** Resolve data before acquisition; all mechanisms use one wire protocol and verification path. */
-export function signerFor(lines, keyId, selected, keyFile, injected) {
-    const fields = lines.flatMap(line => { const got = parse(line); return got.kind === 'fact' ? [got.value.fields] : []; });
-    const declaration = signerSelection(fields, keyId);
-    if (selected !== undefined && selected !== declaration.name)
-        throw new SigningFailure(`REFUSE·signer ${keyId} CLI selection conflicts with declaration`);
-    if (injected) {
-        if (injected.name !== declaration.name || keyFile)
-            throw new SigningFailure('REFUSE·signer injected host binding conflicts with declaration or key file');
-        return (lot) => invokeSigningPort(lot, injected.sign, { timeoutMs: declaration.timeoutMs, maxBytes: declaration.responseBytes }, injected.signal);
-    }
-    const mechanism = binding(declaration.name, keyFile);
-    const protocol = { request: signerRequestBytes, response: signerResponseBytes, reply: signerResponseOf };
-    return (lot) => invokeSigner(lot, mechanism, protocol, declaration);
-}
+var d=Object.defineProperty;var a=(t,n)=>d(t,"name",{value:n,configurable:!0});import{invokeSigningPort as h}from"../engine/ports.js";import{readFileSync as w}from"node:fs";import{library11_parse as S,library11_signerSelection as b,library11_signerRequestBytes as E,library11_signerResponseBytes as l,library11_signerResponseOf as p}from"../vendor/runtime.js";import{invokeSigner as u,SigningFailure as c}from"./ports/signing.js";function y(t,n){if(t==="file"){if(!n)throw new c("REFUSE\xB7signer file needs --key-file");return{kind:"file",path:n}}if(n)throw new c("REFUSE\xB7signer command cannot use --key-file");const o=process.env.BOUND_SIGNERS;if(!o)throw new c("REFUSE\xB7signer no host binding registry");try{const i=JSON.parse(w(o,"utf8"));if(!i||typeof i!="object"||!Object.prototype.hasOwnProperty.call(i,t))throw Error();const r=i[t];if(!r||typeof r!="object")throw Error();const e=r;if(e.kind!=="command"||typeof e.executable!="string"||!e.executable||!Array.isArray(e.args)||!e.args.every(s=>typeof s=="string"))throw Error();return{kind:"command",executable:e.executable,args:e.args}}catch{throw new c("REFUSE\xB7signer host binding unavailable or invalid")}}a(y,"binding");function m(t,n,o){const i=t.flatMap(e=>{const s=S(e);return s.kind==="fact"?[s.value.fields]:[]}),r=b(i,n);if(o!==void 0&&o!==r.name)throw new c(`REFUSE\xB7signer ${n} CLI selection conflicts with declaration`);return r}a(m,"declaredSigner");function O(t,n,o,i,r){const e=m(t,n,o);if(r){if(r.name!==e.name||i)throw new c("REFUSE\xB7signer injected host binding conflicts with declaration or key file");return g=>h(g,r.sign,{timeoutMs:e.timeoutMs,maxBytes:e.responseBytes},r.signal)}const s=y(e.name,i),f={request:E,response:l,reply:p};return g=>u(g,s,f,e)}a(O,"signerFor");function U(t,n,o,i){const r=m(t,n,o),e=y(r.name,i),s={request:a(f=>JSON.stringify(f)+`
+`,"request"),response:l,reply:p};return f=>u(f,e,s,r)}a(U,"frameSignerFor");export{U as frameSignerFor,O as signerFor};

package/dist/host/source-content.js

@@ -1,111 +1,2 @@
-import { hostOutput } from "./call-context.js";
-import { transportBytes } from "./ports/transport.js";
-import { contentStore, verifiedContent } from "./content-store.js";
-import { ContentNeeded } from "./content-needed.js";
-import { createHash } from 'node:crypto';
-import { parse, wireAt } from '@lapxo/topos/wire';
-import { landBlob } from "../land/ledger.js";
-import { ownLock } from "../observe/runner.js";
-/** Transport uses declared locations; only the requested digest admits bytes into the cache. */
-export async function resolveSelectedContent(lines, port, requested) {
-    const fields = lines.flatMap(line => { const p = parse(line); return p.kind === 'fact' && p.value.fields.value !== 'withdraw' ? [p.value.fields] : []; });
-    const selectionIndex = (scope) => { const match = /(^|\/)uses\//.exec(scope); return match === null ? -1 : match.index + match[1].length; };
-    // A dependency constraint is not a content binding. Historical artifact records
-    // use measure=id; explicit digest records still validate even when malformed.
-    const bindings = fields.filter(f => selectionIndex(f.scope ?? '') >= 0 ||
-        (f.scope?.startsWith('dep/') && (f.measure === 'digest' || /^[a-zA-Z][a-zA-Z0-9-]*:[a-f0-9]+$/.test(f.value ?? ''))));
-    const locations = new Map();
-    for (const binding of bindings) {
-        const scope = binding.scope ?? '';
-        const index = selectionIndex(scope);
-        const sourceScope = index >= 0 ? scope.slice(0, index) + 'sources/' + scope.slice(index + 5) : 'sources/' + scope.slice(4);
-        const urls = fields.filter(f => f.scope === sourceScope).map(f => f.value ?? '');
-        if (urls.length)
-            locations.set(binding.value ?? '', [...new Set([...(locations.get(binding.value ?? '') ?? []), ...urls])]);
-    }
-    const received = [];
-    const validate = (digest) => {
-        const split = digest.indexOf(':');
-        const algorithm = digest.slice(0, split), hex = digest.slice(split + 1);
-        if (split < 1 || !port.algorithms.has(algorithm) || !/^[a-f0-9]+$/.test(hex))
-            throw Error(`REFUSE·pin ${digest} digest is not admitted`);
-        return { algorithm, hex };
-    };
-    const ensure = async (digest) => {
-        const { algorithm, hex } = validate(digest);
-        const verify = (bytes) => {
-            if (createHash(algorithm).update(bytes).digest('hex') !== hex)
-                throw Error(`REFUSE·pin ${digest} content hash mismatch · not laid`);
-            return bytes;
-        };
-        const cached = port.read(digest);
-        if (cached !== undefined)
-            return verify(cached);
-        const urls = locations.get(digest) ?? [];
-        if (!urls.length)
-            throw Error(`REFUSE·pin ${digest} content unavailable · no declared source · not laid`);
-        let last;
-        for (const url of urls) {
-            let bytes;
-            try {
-                bytes = await port.fetch(url, digest);
-            }
-            catch (error) {
-                last = error;
-                continue;
-            }
-            verify(bytes);
-            port.write(digest, bytes);
-            received.push(digest);
-            return bytes;
-        }
-        throw Error(`REFUSE·source ${digest} ${last instanceof Error ? last.message : 'declared sources unavailable'}`);
-    };
-    for (const digest of new Set(requested))
-        await ensure(digest);
-    return received;
-}
-/** Exact resource URLs; no repository checkout or inferred release. */
-export async function resolveSources(standing, requested) {
-    const instrument = ownLock().flatMap(line => { const p = parse(line); return p.kind === 'fact' ? [p.value.fields] : []; });
-    const wire = wireAt(instrument, Number.MAX_SAFE_INTEGER);
-    if (wire === null)
-        throw Error('REFUSE·pin instrument has no admitted wire');
-    const bindings = ownLock().filter(line => {
-        const p = parse(line);
-        if (p.kind !== 'fact')
-            return false;
-        const fields = p.value.fields;
-        return fields.scope?.startsWith('sources/') || fields.scope?.startsWith('dep/');
-    });
-    const received = await resolveSelectedContent([...standing, ...bindings], {
-        algorithms: wire.digests,
-        read: digest => { try {
-            return verifiedContent(digest).bytes;
-        }
-        catch (error) {
-            if (error instanceof ContentNeeded)
-                return undefined;
-            throw error;
-        } },
-        write: (digest, bytes) => { landBlob(contentStore(), digest, bytes); },
-        fetch: async (url, digest) => transportBytes(url, digest, [...ownLock(), ...standing]),
-    }, requested);
-    for (const digest of received)
-        hostOutput('out', `FETCHED  ${digest} · verified\n`);
-}
-/** A changed verified store is the only reason to retry. A repeated miss never loops or changes a named pin. */
-export async function resolveRequested(resolve, fold) {
-    const attempted = new Set();
-    for (;;) {
-        try {
-            return await fold();
-        }
-        catch (error) {
-            if (!(error instanceof ContentNeeded) || attempted.has(error.digest))
-                throw error;
-            attempted.add(error.digest);
-            await resolve(error.digest);
-        }
-    }
-}
+var $=Object.defineProperty;var s=(c,i)=>$(c,"name",{value:i,configurable:!0});import{hostOutput as F}from"./call-context.js";import{transportBytes as R}from"./ports/transport.js";import{contentStore as A,verifiedContent as U}from"./content-store.js";import{ContentNeeded as x}from"./content-needed.js";import{createHash as k}from"node:crypto";import{library11_parse as y,library11_wireAt as C}from"../vendor/runtime.js";import{landBlob as M}from"../land/ledger.js";import{ownLock as S}from"../observe/runner.js";async function _(c,i,u){const n=c.flatMap(e=>{const t=y(e);return t.kind==="fact"&&t.value.fields.value!=="withdraw"?[t.value.fields]:[]}),h=s(e=>{const t=/(^|\/)uses\//.exec(e);return t===null?-1:t.index+t[1].length},"selectionIndex"),E=n.filter(e=>h(e.scope??"")>=0||e.scope?.startsWith("dep/")&&(e.measure==="digest"||/^[a-zA-Z][a-zA-Z0-9-]*:[a-f0-9]+$/.test(e.value??""))),r=new Map;for(const e of E){const t=e.scope??"",a=h(t),l=a>=0?t.slice(0,a)+"sources/"+t.slice(a+5):"sources/"+t.slice(4),d=n.filter(f=>f.scope===l).map(f=>f.value??"");d.length&&r.set(e.value??"",[...new Set([...r.get(e.value??"")??[],...d])])}const o=[],p=s(e=>{const t=e.indexOf(":"),a=e.slice(0,t),l=e.slice(t+1);if(t<1||!i.algorithms.has(a)||!/^[a-f0-9]+$/.test(l))throw Error(`REFUSE\xB7pin ${e} digest is not admitted`);return{algorithm:a,hex:l}},"validate"),b=s(async e=>{const{algorithm:t,hex:a}=p(e),l=s(m=>{if(k(t).update(m).digest("hex")!==a)throw Error(`REFUSE\xB7pin ${e} content hash mismatch \xB7 not laid`);return m},"verify"),d=i.read(e);if(d!==void 0)return l(d);const f=r.get(e)??[];if(!f.length)throw Error(`REFUSE\xB7pin ${e} content unavailable \xB7 no declared source \xB7 not laid`);let v;for(const m of f){let w;try{w=await i.fetch(m,e)}catch(g){v=g;continue}return l(w),i.write(e,w),o.push(e),w}throw Error(`REFUSE\xB7source ${e} ${v instanceof Error?v.message:"declared sources unavailable"}`)},"ensure");for(const e of new Set(u))await b(e);return o}s(_,"resolveSelectedContent");async function q(c,i){const u=S().flatMap(r=>{const o=y(r);return o.kind==="fact"?[o.value.fields]:[]}),n=C(u,Number.MAX_SAFE_INTEGER);if(n===null)throw Error("REFUSE\xB7pin instrument has no admitted wire");const h=S().filter(r=>{const o=y(r);if(o.kind!=="fact")return!1;const p=o.value.fields;return p.scope?.startsWith("sources/")||p.scope?.startsWith("dep/")}),E=await _([...c,...h],{algorithms:n.digests,read:s(r=>{try{return U(r).bytes}catch(o){if(o instanceof x)return;throw o}},"read"),write:s((r,o)=>{M(A(),r,o)},"write"),fetch:s(async(r,o)=>R(r,o,[...S(),...c]),"fetch")},i);for(const r of E)F("out",`FETCHED  ${r} \xB7 verified
+`)}s(q,"resolveSources");async function D(c,i){const u=new Set;for(;;)try{return await i()}catch(n){if(!(n instanceof x)||u.has(n.digest))throw n;u.add(n.digest),await c(n.digest)}}s(D,"resolveRequested");export{D as resolveRequested,_ as resolveSelectedContent,q as resolveSources};

package/dist/host/standing-carrier.js

@@ -1,18 +1 @@
-import { PLACE_ACT_CONTEXT } from '@lapxo/topos/core';
-import { foldClaims, fieldOf } from "../fold/claims.js";
-/** Projection only, after the caller authenticates the complete carrier. The
- * CLI and in-process reader use this same fold and output shape. */
-export function projectContextualStanding(root, legacy, contexts, decoded) {
-    const groups = new Map();
-    for (const act of contexts) {
-        const context = decoded.find(one => one.identity === act.identity).context;
-        for (const p of context.places) {
-            const key = JSON.stringify([context.root.namespace, p.place]), group = groups.get(key) ?? { namespace: context.root.namespace, place: p.place, lines: [], contexts: [] };
-            group.lines.push(...p.records);
-            group.contexts.push({ identity: act.identity, context: act.context, receipts: act.receipts });
-            groups.set(key, group);
-        }
-    }
-    const legacyPlaces = legacy.map(place => ({ namespace: 'legacy-global', place: place.place, standing: foldClaims(place.history).standing.filter(line => fieldOf(line, 'value') !== 'withdraw'), history: place.history }));
-    return { profile: PLACE_ACT_CONTEXT, root, legacyPlaces, contexts, places: [...groups.values()].map(group => { const folded = foldClaims(group.lines); return { namespace: group.namespace, place: group.place, standing: folded.standing.filter(line => fieldOf(line, 'value') !== 'withdraw'), retracted: folded.retracted, superseded: folded.superseded, forks: folded.forks, contexts: group.contexts }; }) };
-}
+var y=Object.defineProperty;var l=(n,a)=>y(n,"name",{value:a,configurable:!0});import{library3_PLACE_ACT_CONTEXT as u}from"../vendor/runtime.js";import{foldClaims as p,fieldOf as d}from"../fold/claims.js";function h(n,a,r,f){const o=new Map;for(const e of r){const t=f.find(s=>s.identity===e.identity).context;for(const s of t.places){const i=JSON.stringify([t.root.namespace,s.place]),c=o.get(i)??{namespace:t.root.namespace,place:s.place,lines:[],contexts:[]};c.lines.push(...s.records),c.contexts.push({identity:e.identity,context:e.context,receipts:e.receipts}),o.set(i,c)}}const m=a.map(e=>({namespace:"legacy-global",place:e.place,standing:p(e.history).standing.filter(t=>d(t,"value")!=="withdraw"),history:e.history}));return{profile:u,root:n,legacyPlaces:m,contexts:r,places:[...o.values()].map(e=>{const t=p(e.lines);return{namespace:e.namespace,place:e.place,standing:t.standing.filter(s=>d(s,"value")!=="withdraw"),retracted:t.retracted,superseded:t.superseded,forks:t.forks,contexts:e.contexts}})}}l(h,"projectContextualStanding");export{h as projectContextualStanding};

package/dist/host/standing-projection.js

@@ -1,50 +1 @@
-import { viewsOf } from "../fold/views.js";
-import { BoundRefusal } from "./refusals.js";
-import { authorityFor } from "../fold/signers.js";
-import { signatureEraOf as eraOf } from "./signature-era.js";
-import { fieldOf, foldClaims, isConfig } from "../fold/claims.js";
-import { foldedEvidence } from '@lapxo/topos/contract';
-/** Project the supplied signed history against the host's original trust anchor.
- * No current-root selection, storage access, effects or retained authority.
- * The file host and the in-process host use this same admission-snapshot fold. */
-export function projectAuthenticatedStanding(history, anchor) {
-    const snapshots = new Map();
-    const admitted = history.filter(line => {
-        const epoch = Number(fieldOf(line, 'epoch')) || 0;
-        let authority = snapshots.get(epoch);
-        if (!authority) {
-            // This invocation has freshly read the complete signed inventory. Derive
-            // the same historical cutoff without reopening it for every epoch; the
-            // next invocation still rereads every authority input.
-            const snapshot = history.filter(record => !isConfig(record) || Number(fieldOf(record, 'epoch')) <= epoch);
-            // The signature vocabulary is configuration, not the as-yet
-            // unauthenticated evidence whose values are about to be folded.
-            const wire = snapshot.filter(record => {
-                const scope = fieldOf(record, 'scope');
-                return scope.startsWith('wire/') || scope.startsWith('audit/wire/');
-            });
-            authority = authorityFor(snapshot, anchor, eraOf(foldClaims(wire).standing).admitted);
-            snapshots.set(epoch, authority);
-        }
-        return authority.of(line).kind === 'admitted';
-    });
-    // The host authenticates against historical authority; Topos projects the
-    // authenticated history using the instrument's existing fold.
-    const { standing } = foldedEvidence(admitted, {
-        classification: () => 'local',
-        fold: lines => foldClaims(lines).standing,
-    });
-    return [...standing];
-}
-/** One check shared by the CLI and the read-only native host. */
-export function assertStandingView(lines) {
-    const view = viewsOf(lines).get('standing');
-    if (!view || view.shape || !view.regions.some(region => region.name === 'standing'))
-        throw new BoundRefusal('standing/view', 'REFUSE·view standing requires a declared standing view');
-}
-export function publicStandingProjection(history, anchor) {
-    return publishedStandingLines(projectAuthenticatedStanding(history, anchor));
-}
-export function publishedStandingLines(standing) {
-    return standing.filter(line => !isConfig(line) || fieldOf(line, 'value') !== 'withdraw');
-}
+var w=Object.defineProperty;var e=(i,t)=>w(i,"name",{value:t,configurable:!0});import{viewsOf as h}from"../fold/views.js";import{BoundRefusal as v}from"./refusals.js";import{authorityFor as b}from"../fold/signers.js";import{signatureEraOf as E}from"./signature-era.js";import{fieldOf as a,foldClaims as p,isConfig as u}from"../fold/claims.js";import{library2_foldedEvidence as S}from"../vendor/runtime.js";function x(i,t){const n=new Map,m=i.filter(o=>{const d=Number(a(o,"epoch"))||0;let r=n.get(d);if(!r){const f=i.filter(s=>!u(s)||Number(a(s,"epoch"))<=d),g=f.filter(s=>{const c=a(s,"scope");return c.startsWith("wire/")||c.startsWith("audit/wire/")});r=b(f,t,E(p(g).standing).admitted),n.set(d,r)}return r.of(o).kind==="admitted"}),{standing:l}=S(m,{classification:e(()=>"local","classification"),fold:e(o=>p(o).standing,"fold")});return[...l]}e(x,"projectAuthenticatedStanding");function k(i){const t=h(i).get("standing");if(!t||t.shape||!t.regions.some(n=>n.name==="standing"))throw new v("standing/view","REFUSE\xB7view standing requires a declared standing view")}e(k,"assertStandingView");function q(i,t){return O(x(i,t))}e(q,"publicStandingProjection");function O(i){return i.filter(t=>!u(t)||a(t,"value")!=="withdraw")}e(O,"publishedStandingLines");export{k as assertStandingView,x as projectAuthenticatedStanding,q as publicStandingProjection,O as publishedStandingLines};

package/dist/host/timing.js

@@ -1,7 +1 @@
-/** Record completed synchronous host work without changing its result or refusal. */
-export const timing = (spent) => (what, fn) => {
-    const at = Date.now();
-    const got = fn();
-    spent.push(`${what} ${Date.now() - at}`);
-    return got;
-};
+var c=Object.defineProperty;var o=(t,n)=>c(t,"name",{value:n,configurable:!0});const g=o(t=>(n,e)=>{const s=Date.now(),a=e();return t.push(`${n} ${Date.now()-s}`),a},"timing");export{g as timing};