@lapxo/bound 0.2.4 → 0.2.5

package/dist/wasm/adapter.js

@@ -1,180 +1 @@
-var __rewriteRelativeImportExtension = (this && this.__rewriteRelativeImportExtension) || function (path, preserveJsx) {
-    if (typeof path === "string" && /^\.\.?\//.test(path)) {
-        return path.replace(/\.(tsx)$|((?:\.d)?)((?:\.[^./]+?)?)\.([cm]?)ts$/i, function (m, tsx, d, ext, cm) {
-            return tsx ? preserveJsx ? ".jsx" : ".js" : d && (!ext || !cm) ? m : (d + ext + "." + cm.toLowerCase() + "js");
-        });
-    }
-    return path;
-};
-const owns = (object, key) => Object.prototype.hasOwnProperty.call(object, key);
-const assetNames = ['runtime', 'wasm'], limitNames = ['memoryBytes', 'stackBytes', 'executionMs'];
-// Host adapter only. Source integrity grants neither admission nor authority.
-function refuse(cause) { throw Error('REFUSE·wasm ' + cause); }
-export async function digest(bytes) { return 'sha256:' + Array.from(new Uint8Array(await crypto.subtle.digest('SHA-256', bytes.slice().buffer))).map(x => x.toString(16).padStart(2, '0')).join(''); }
-async function verified(bytes, expected) { if (typeof SharedArrayBuffer !== 'undefined' && (bytes instanceof SharedArrayBuffer || (ArrayBuffer.isView(bytes) && bytes.buffer instanceof SharedArrayBuffer)))
-    refuse('shared assets unsupported'); const copy = (bytes instanceof Uint8Array ? new Uint8Array(bytes) : new Uint8Array(bytes)).slice(); if (!/^sha256:[a-f0-9]{64}$/.test(expected) || await digest(copy) !== expected)
-    refuse('integrity'); return copy; }
-const text = new TextEncoder();
-// Exact host-declared sizes bound copies, hashing and worker handoff before work.
-export function preflight(request) {
-    if (!request || Object.keys(request).some(k => !['trusted', 'assets', 'modules', 'aliases', 'entry', 'limits'].includes(k)))
-        refuse('request fields');
-    const { trusted, assets, modules, entry, aliases = {}, limits } = request, sizes = trusted?.byteLengths;
-    if (!sizes || !modules || !assets)
-        refuse('declared byte sizes');
-    if (Object.keys(assets).length !== 2 || Object.keys(assets).some(k => !['runtime', 'wasm'].includes(k)))
-        refuse('asset fields');
-    if (!limits || Object.keys(limits).length !== 3 || Object.keys(limits).some(k => !['memoryBytes', 'stackBytes', 'executionMs'].includes(k)))
-        refuse('limit fields');
-    for (const name of limitNames)
-        if (!Number.isSafeInteger(limits[name]) || limits[name] <= 0 || limits[name] !== trusted.limits?.[name])
-            refuse('limit ' + name);
-    if (typeof entry !== 'string' || entry !== trusted.entry || !aliases || Object.values(aliases).some(v => typeof v !== 'string') || JSON.stringify(Object.entries(aliases).sort()) !== JSON.stringify(Object.entries(trusted.aliases ?? {}).sort()))
-        refuse('entry or aliases differ from trusted context');
-    const names = Object.keys(modules), expected = Object.keys(trusted.modules ?? {});
-    if (names.length !== expected.length || names.some(n => !owns(trusted.modules, n)))
-        refuse('module count');
-    const size = (n, want) => { if (!Number.isSafeInteger(want) || want < 0)
-        refuse('declared size ' + n); return want; };
-    for (const name of assetNames) {
-        const v = assets[name];
-        if (typeof SharedArrayBuffer !== 'undefined' && (v instanceof SharedArrayBuffer || (ArrayBuffer.isView(v) && v.buffer instanceof SharedArrayBuffer)))
-            refuse('shared assets unsupported');
-        if (!(v instanceof Uint8Array || v instanceof ArrayBuffer) || v.byteLength !== size(name, sizes[name]))
-            refuse('asset bytes ' + name);
-    }
-    for (const name of names) {
-        const source = modules[name], want = size(name, sizes.modules?.[name]);
-        if (typeof source !== 'string' || source.length > want)
-            refuse('module bytes ' + name);
-        let bytes = 0;
-        for (let i = 0; i < source.length; i++) {
-            const c = source.charCodeAt(i);
-            bytes += c < 128 ? 1 : c < 2048 ? 2 : c >= 55296 && c <= 56319 && i + 1 < source.length && source.charCodeAt(i + 1) >= 56320 && source.charCodeAt(i + 1) <= 57343 ? (i++, 4) : 3;
-            if (bytes > want)
-                refuse('module bytes ' + name);
-        }
-        if (bytes !== want)
-            refuse('module bytes ' + name);
-    }
-}
-export async function runWasmRequest(request) {
-    preflight(request);
-    try {
-        request = structuredClone(request);
-    }
-    catch {
-        refuse('request is not cloneable');
-    }
-    const { trusted, assets, modules, aliases = {}, entry, limits } = request;
-    for (const name of limitNames)
-        if (!Number.isSafeInteger(limits?.[name]) || limits[name] <= 0 || limits[name] !== trusted?.limits?.[name])
-            refuse('limit ' + name);
-    if (entry !== trusted.entry || JSON.stringify(Object.entries(aliases).sort()) !== JSON.stringify(Object.entries(trusted.aliases ?? {}).sort()))
-        refuse('entry or aliases differ from trusted context');
-    const runtime = await verified(assets.runtime, trusted.runtime), wasm = await verified(assets.wasm, trusted.wasm), sources = {};
-    for (const [id, source] of Object.entries(modules)) {
-        if (!owns(trusted.modules, id))
-            refuse('undeclared module ' + id);
-        sources[id] = new TextDecoder('utf-8', { fatal: true }).decode(await verified(text.encode(source), trusted.modules[id]));
-    }
-    if (Object.keys(trusted.modules).some(id => !owns(sources, id)))
-        refuse('missing module');
-    if (!owns(sources, entry))
-        refuse('entry');
-    // The runtime is a closed esbuild ESM bundle: no imports and no second fetch.
-    const url = 'data:text/javascript;base64,' + bytesBase64(runtime), factory = await import(__rewriteRelativeImportExtension(url));
-    const started = performance.now(), quick = await factory.createQuickJS(wasm);
-    const rt = quick.newRuntime();
-    let context;
-    try {
-        context = rt.newContext();
-        const memory = rt.computeMemoryUsage();
-        let initializedMemory;
-        try {
-            initializedMemory = context.dump(memory);
-        }
-        finally {
-            memory.dispose();
-        }
-        const used = typeof initializedMemory === 'object' && initializedMemory !== null ? initializedMemory.memory_used_size : undefined;
-        if (typeof used !== 'number' || !Number.isSafeInteger(used) || used < 0)
-            refuse('initialized memory measurement unavailable');
-        if (used > limits.memoryBytes)
-            refuse('initialized memory ' + used + ' exceeds declared memory ' + limits.memoryBytes);
-        const initializedMs = performance.now() - started;
-        rt.setMemoryLimit(limits.memoryBytes);
-        rt.setMaxStackSize(limits.stackBytes);
-        const start = performance.now();
-        rt.setInterruptHandler(() => performance.now() - start > limits.executionMs);
-        rt.setModuleLoader(id => { if (!owns(sources, id))
-            refuse('undeclared import ' + id); return sources[id]; }, (parent, name) => { if (owns(aliases, name))
-            return aliases[name]; if (name.startsWith('.'))
-            return new URL(name, new URL(parent, 'file:///')).pathname; if (owns(sources, name))
-            return name; refuse('undeclared import ' + name); });
-        const result = context.evalCode(sources[entry], entry, { type: 'module' });
-        if (result.error) {
-            const e = context.dump(result.error);
-            result.error.dispose();
-            refuse('guest ' + JSON.stringify(e));
-        }
-        result.value.dispose();
-        const value = context.evalCode('globalThis.result');
-        if (value.error) {
-            const e = context.dump(value.error);
-            value.error.dispose();
-            refuse('result ' + JSON.stringify(e));
-        }
-        const output = context.dump(value.value);
-        value.value.dispose();
-        if (typeof output !== 'string')
-            refuse('result must be declared text');
-        return { output, initializedMs, executionMs: performance.now() - start };
-    }
-    finally {
-        context?.dispose();
-        rt.dispose();
-    }
-}
-function bytesBase64(bytes) { let binary = ''; for (const b of bytes)
-    binary += String.fromCharCode(b); return btoa(binary); }
-// A separate worker makes external abort possible while synchronous WASM executes.
-export async function evaluateWasm(request, { workerFactory = () => new Worker(new URL('./worker.js', import.meta.url), { type: 'module' }), signal, lifetimeMs }) {
-    if (!Number.isSafeInteger(lifetimeMs) || lifetimeMs <= 0)
-        refuse('worker lifetime');
-    if (signal?.aborted)
-        refuse('cancelled');
-    preflight(request);
-    return new Promise((resolve, reject) => { const worker = workerFactory(); let done = false; const finish = (error, value) => { if (done)
-        return; done = true; clearTimeout(timer); signal?.removeEventListener('abort', abort); worker.terminate(); error ? reject(error) : resolve(value); }; const abort = () => finish(Error('REFUSE·wasm cancelled')); const timer = setTimeout(() => finish(Error('REFUSE·wasm worker lifetime')), lifetimeMs); signal?.addEventListener('abort', abort, { once: true }); const message = (raw) => { const data = raw; if (!data || typeof data !== 'object' || typeof data.ok !== 'boolean') {
-        finish(Error('REFUSE·wasm malformed worker result'));
-        return;
-    } if (data.ok) {
-        if (!data.result || typeof data.result.output !== 'string') {
-            finish(Error('REFUSE·wasm malformed worker output'));
-            return;
-        }
-        finish(null, data.result);
-    }
-    else
-        finish(Error(typeof data.error === 'string' ? data.error : 'REFUSE·wasm worker failure')); }; if (typeof worker.addEventListener === 'function') {
-        worker.addEventListener('message', e => message(e.data));
-        worker.addEventListener('error', e => finish(Error('REFUSE·wasm worker ' + e.message)));
-    }
-    else {
-        if (!worker.on) {
-            finish(Error('REFUSE·wasm worker event port'));
-            return;
-        }
-        worker.on('message', message);
-        worker.on('error', e => finish(e instanceof Error ? e : Error(String(e))));
-    } if (signal?.aborted) {
-        abort();
-        return;
-    } try {
-        worker.postMessage(request);
-    }
-    catch {
-        finish(Error('REFUSE·wasm request is not cloneable'));
-    } });
-}
+var N=Object.defineProperty;var m=(t,s)=>N(t,"name",{value:s,configurable:!0});var z=function(t,s){return typeof t=="string"&&/^\.\.?\//.test(t)?t.replace(/\.(tsx)$|((?:\.d)?)((?:\.[^./]+?)?)\.([cm]?)ts$/i,function(a,y,p,l,n){return y?s?".jsx":".js":p&&(!l||!n)?a:p+l+"."+n.toLowerCase()+"js"}):t};const S=m((t,s)=>Object.prototype.hasOwnProperty.call(t,s),"owns"),C=["runtime","wasm"],U=["memoryBytes","stackBytes","executionMs"];function o(t){throw Error("REFUSE\xB7wasm "+t)}m(o,"refuse");async function F(t){return"sha256:"+Array.from(new Uint8Array(await crypto.subtle.digest("SHA-256",t.slice().buffer))).map(s=>s.toString(16).padStart(2,"0")).join("")}m(F,"digest");async function O(t,s){typeof SharedArrayBuffer<"u"&&(t instanceof SharedArrayBuffer||ArrayBuffer.isView(t)&&t.buffer instanceof SharedArrayBuffer)&&o("shared assets unsupported");const a=(t instanceof Uint8Array?new Uint8Array(t):new Uint8Array(t)).slice();return(!/^sha256:[a-f0-9]{64}$/.test(s)||await F(a)!==s)&&o("integrity"),a}m(O,"verified");const M=new TextEncoder;function R(t){(!t||Object.keys(t).some(e=>!["trusted","assets","modules","aliases","entry","limits"].includes(e)))&&o("request fields");const{trusted:s,assets:a,modules:y,entry:p,aliases:l={},limits:n}=t,g=s?.byteLengths;(!g||!y||!a)&&o("declared byte sizes"),(Object.keys(a).length!==2||Object.keys(a).some(e=>!["runtime","wasm"].includes(e)))&&o("asset fields"),(!n||Object.keys(n).length!==3||Object.keys(n).some(e=>!["memoryBytes","stackBytes","executionMs"].includes(e)))&&o("limit fields");for(const e of U)(!Number.isSafeInteger(n[e])||n[e]<=0||n[e]!==s.limits?.[e])&&o("limit "+e);(typeof p!="string"||p!==s.entry||!l||Object.values(l).some(e=>typeof e!="string")||JSON.stringify(Object.entries(l).sort())!==JSON.stringify(Object.entries(s.aliases??{}).sort()))&&o("entry or aliases differ from trusted context");const f=Object.keys(y),d=Object.keys(s.modules??{});(f.length!==d.length||f.some(e=>!S(s.modules,e)))&&o("module count");const h=m((e,r)=>((!Number.isSafeInteger(r)||r<0)&&o("declared size "+e),r),"size");for(const e of C){const r=a[e];typeof SharedArrayBuffer<"u"&&(r instanceof SharedArrayBuffer||ArrayBuffer.isView(r)&&r.buffer instanceof SharedArrayBuffer)&&o("shared assets unsupported"),(!(r instanceof Uint8Array||r instanceof ArrayBuffer)||r.byteLength!==h(e,g[e]))&&o("asset bytes "+e)}for(const e of f){const r=y[e],u=h(e,g.modules?.[e]);(typeof r!="string"||r.length>u)&&o("module bytes "+e);let w=0;for(let c=0;c<r.length;c++){const i=r.charCodeAt(c);w+=i<128?1:i<2048?2:i>=55296&&i<=56319&&c+1<r.length&&r.charCodeAt(c+1)>=56320&&r.charCodeAt(c+1)<=57343?(c++,4):3,w>u&&o("module bytes "+e)}w!==u&&o("module bytes "+e)}}m(R,"preflight");async function _(t){R(t);try{t=structuredClone(t)}catch{o("request is not cloneable")}const{trusted:s,assets:a,modules:y,aliases:p={},entry:l,limits:n}=t;for(const i of U)(!Number.isSafeInteger(n?.[i])||n[i]<=0||n[i]!==s?.limits?.[i])&&o("limit "+i);(l!==s.entry||JSON.stringify(Object.entries(p).sort())!==JSON.stringify(Object.entries(s.aliases??{}).sort()))&&o("entry or aliases differ from trusted context");const g=await O(a.runtime,s.runtime),f=await O(a.wasm,s.wasm),d={};for(const[i,k]of Object.entries(y))S(s.modules,i)||o("undeclared module "+i),d[i]=new TextDecoder("utf-8",{fatal:!0}).decode(await O(M.encode(k),s.modules[i]));Object.keys(s.modules).some(i=>!S(d,i))&&o("missing module"),S(d,l)||o("entry");const h="data:text/javascript;base64,"+I(g),e=await import(z(h)),r=performance.now(),w=(await e.createQuickJS(f)).newRuntime();let c;try{c=w.newContext();const i=w.computeMemoryUsage();let k;try{k=c.dump(i)}finally{i.dispose()}const j=typeof k=="object"&&k!==null?k.memory_used_size:void 0;(typeof j!="number"||!Number.isSafeInteger(j)||j<0)&&o("initialized memory measurement unavailable"),j>n.memoryBytes&&o("initialized memory "+j+" exceeds declared memory "+n.memoryBytes);const L=performance.now()-r;w.setMemoryLimit(n.memoryBytes),w.setMaxStackSize(n.stackBytes);const A=performance.now();w.setInterruptHandler(()=>performance.now()-A>n.executionMs),w.setModuleLoader(b=>(S(d,b)||o("undeclared import "+b),d[b]),(b,E)=>{if(S(p,E))return p[E];if(E.startsWith("."))return new URL(E,new URL(b,"file:///")).pathname;if(S(d,E))return E;o("undeclared import "+E)});const x=c.evalCode(d[l],l,{type:"module"});if(x.error){const b=c.dump(x.error);x.error.dispose(),o("guest "+JSON.stringify(b))}x.value.dispose();const v=c.evalCode("globalThis.result");if(v.error){const b=c.dump(v.error);v.error.dispose(),o("result "+JSON.stringify(b))}const B=c.dump(v.value);return v.value.dispose(),typeof B!="string"&&o("result must be declared text"),{output:B,initializedMs:L,executionMs:performance.now()-A}}finally{c?.dispose(),w.dispose()}}m(_,"runWasmRequest");function I(t){let s="";for(const a of t)s+=String.fromCharCode(a);return btoa(s)}m(I,"bytesBase64");async function T(t,{workerFactory:s=m(()=>new Worker(new URL("./worker.js",import.meta.url),{type:"module"}),"workerFactory"),signal:a,lifetimeMs:y}){return(!Number.isSafeInteger(y)||y<=0)&&o("worker lifetime"),a?.aborted&&o("cancelled"),R(t),new Promise((p,l)=>{const n=s();let g=!1;const f=m((r,u)=>{g||(g=!0,clearTimeout(h),a?.removeEventListener("abort",d),n.terminate(),r?l(r):p(u))},"finish"),d=m(()=>f(Error("REFUSE\xB7wasm cancelled")),"abort"),h=setTimeout(()=>f(Error("REFUSE\xB7wasm worker lifetime")),y);a?.addEventListener("abort",d,{once:!0});const e=m(r=>{const u=r;if(!u||typeof u!="object"||typeof u.ok!="boolean"){f(Error("REFUSE\xB7wasm malformed worker result"));return}if(u.ok){if(!u.result||typeof u.result.output!="string"){f(Error("REFUSE\xB7wasm malformed worker output"));return}f(null,u.result)}else f(Error(typeof u.error=="string"?u.error:"REFUSE\xB7wasm worker failure"))},"message");if(typeof n.addEventListener=="function")n.addEventListener("message",r=>e(r.data)),n.addEventListener("error",r=>f(Error("REFUSE\xB7wasm worker "+r.message)));else{if(!n.on){f(Error("REFUSE\xB7wasm worker event port"));return}n.on("message",e),n.on("error",r=>f(r instanceof Error?r:Error(String(r))))}if(a?.aborted){d();return}try{n.postMessage(t)}catch{f(Error("REFUSE\xB7wasm request is not cloneable"))}})}m(T,"evaluateWasm");export{F as digest,T as evaluateWasm,R as preflight,_ as runWasmRequest};

package/dist/wasm/node-worker.js

@@ -1,13 +1 @@
-import { parentPort } from 'node:worker_threads';
-import { runWasmRequest } from "./adapter.js";
-if (!parentPort)
-    throw Error('REFUSE·wasm worker port missing');
-const port = parentPort;
-port.once('message', async (request) => {
-    try {
-        port.postMessage({ ok: true, result: await runWasmRequest(request) });
-    }
-    catch (error) {
-        port.postMessage({ ok: false, error: error instanceof Error ? error.message : String(error) });
-    }
-});
+import{parentPort as s}from"node:worker_threads";import{runWasmRequest as t}from"./adapter.js";if(!s)throw Error("REFUSE\xB7wasm worker port missing");const o=s;o.once("message",async e=>{try{o.postMessage({ok:!0,result:await t(e)})}catch(r){o.postMessage({ok:!1,error:r instanceof Error?r.message:String(r)})}});

package/dist/wasm/object.js

@@ -1,76 +1 @@
-import { readFileSync } from 'node:fs';
-import { Worker } from 'node:worker_threads';
-import { sha256 } from "../host/hash.js";
-import { toposAt } from "../host/selected-topos.js";
-import { storeOf } from "../land/ledger.js";
-import { evaluateWasm } from "./adapter.js";
-function refuse(cause) { throw Error('REFUSE·wasm object ' + cause); }
-/** Configuration is the caller's already authenticated, live standing; selection grants no authority. */
-export function usesWasmObject(configuration) {
-    const rows = configuration.filter(f => f.scope === 'engine/object' && f.value !== 'withdraw');
-    if (!rows.length)
-        return false;
-    if (rows.length !== 1 || rows[0].role !== 'writes' || rows[0].measure !== 'id' || rows[0].form !== 'alphabet' || !['esm@1', 'wasm@1'].includes(rows[0].value ?? ''))
-        refuse('unique declared backend required');
-    return rows[0].value === 'wasm@1';
-}
-function limit(configuration, name, measure) {
-    const rows = configuration.filter(f => f.scope === 'engine/wasm/' + name && f.value !== 'withdraw');
-    if (rows.length !== 1 || rows[0].form !== 'interval' || rows[0].measure !== measure || rows[0].role !== 'writes')
-        refuse('missing or ambiguous ' + name + ' limit');
-    const span = /^(0|[1-9][0-9]*)\.\.(0|[1-9][0-9]*)$/.exec(rows[0].value ?? '');
-    if (!span || !Number.isSafeInteger(Number(span[1])) || !Number.isSafeInteger(Number(span[2])) || Number(span[1]) > Number(span[2]) || Number(span[2]) < 1)
-        refuse('invalid ' + name + ' limit');
-    return Number(span[2]);
-}
-/** The installed instrument owns the asset/form closure; place input cannot choose executable bytes. */
-export async function foldObjectsWithWasm(root, records, context, configuration, signal) {
-    if (!usesWasmObject(configuration))
-        refuse('backend not selected');
-    const limits = { memoryBytes: limit(configuration, 'memory', 'bytes'), stackBytes: limit(configuration, 'stack', 'bytes'), executionMs: limit(configuration, 'execution', 'milliseconds') }, lifetimeMs = limit(configuration, 'worker-lifetime', 'milliseconds'), responseBytes = limit(configuration, 'response', 'bytes');
-    const assets = new URL('../../assets/wasm/', import.meta.url), manifest = JSON.parse(readFileSync(new URL('manifest.json', assets), 'utf8'));
-    if (!manifest.forms)
-        refuse('installed form closure missing');
-    const codecs = {};
-    for (const record of records.filter(r => r.record === 'cell')) {
-        const pin = record.fields.topos, binding = manifest.forms[pin];
-        if (!binding || !['intervalForm', 'alphabetOfForm'].includes(binding.export) || binding.form !== record.fields.form)
-            refuse('unsupported form standing ' + pin);
-        const standing = toposAt(pin, storeOf(root)), selector = standing.parts.filter(f => f.scope === 'wire/topos/context-view');
-        if (selector.length !== 1)
-            refuse('context selection ' + pin);
-        const offers = standing.parts.filter(f => f.kind === 'check' && f.view === selector[0].value);
-        if (offers.length !== 1 || offers[0].value !== binding.contextArtifact || !(offers[0].restsOn ?? '').split('|').includes(binding.contextArtifact))
-            refuse('context implementation differs ' + pin);
-        const selected = context.resolve(record);
-        if (selected.digest !== pin || selected.form.id !== binding.form)
-            refuse('prepared form differs ' + record.fields.scope);
-        codecs[record.fields.scope] = { digest: pin, export: binding.export, params: selected.params };
-    }
-    const guestNames = Object.keys(manifest.modules);
-    if (guestNames.length !== 1)
-        refuse('installed guest module map');
-    const guestName = guestNames[0];
-    let program;
-    try {
-        program = `import{objectFold,intervalForm,alphabetOfForm}from${JSON.stringify(guestName)};const forms={intervalForm,alphabetOfForm},codecs=${JSON.stringify(codecs)},records=${JSON.stringify(records)};const context={resolve:cell=>{const c=codecs[cell.fields.scope];if(!c)throw Error('REFUSE unknown prepared cell');return{digest:c.digest,form:forms[c.export],params:c.params}}};globalThis.result=JSON.stringify(objectFold(records,context));`;
-    }
-    catch {
-        return refuse('context is not serializable');
-    }
-    const entry = guestName + '.entry', programDigest = sha256(program);
-    const guest = readFileSync(new URL('guest.js', assets), 'utf8'), modules = { [guestName]: guest, [entry]: program }, request = { trusted: { ...manifest, modules: { ...manifest.modules, [entry]: programDigest }, entry, aliases: {}, limits, byteLengths: { ...manifest.byteLengths, modules: { ...manifest.byteLengths.modules, [entry]: Buffer.byteLength(program) } } }, assets: { runtime: new Uint8Array(readFileSync(new URL('runtime.js', assets))), wasm: new Uint8Array(readFileSync(new URL('runtime.wasm', assets))) }, modules, entry, aliases: {}, limits };
-    const result = await evaluateWasm(request, { workerFactory: () => new Worker(new URL('./node-worker.js', import.meta.url)), lifetimeMs, ...(signal ? { signal } : {}) });
-    if (Buffer.byteLength(result.output) > responseBytes)
-        refuse('response bytes limit');
-    let readings;
-    try {
-        readings = JSON.parse(result.output);
-    }
-    catch {
-        return refuse('invalid projection text');
-    }
-    if (!Array.isArray(readings) || readings.some(r => !r || typeof r.cell !== 'string' || typeof r.state !== 'string'))
-        refuse('invalid projection shape');
-    return readings;
-}
+var J=Object.defineProperty;var c=(o,e)=>J(o,"name",{value:e,configurable:!0});import{readFileSync as y}from"node:fs";import{Worker as B}from"node:worker_threads";import{sha256 as W}from"../host/hash.js";import{toposAt as $}from"../host/selected-topos.js";import{storeOf as q}from"../land/ledger.js";import{evaluateWasm as I}from"./adapter.js";function t(o){throw Error("REFUSE\xB7wasm object "+o)}c(t,"refuse");function M(o){const e=o.filter(a=>a.scope==="engine/object"&&a.value!=="withdraw");return e.length?((e.length!==1||e[0].role!=="writes"||e[0].measure!=="id"||e[0].form!=="alphabet"||!["esm@1","wasm@1"].includes(e[0].value??""))&&t("unique declared backend required"),e[0].value==="wasm@1"):!1}c(M,"usesWasmObject");function d(o,e,a){const s=o.filter(f=>f.scope==="engine/wasm/"+e&&f.value!=="withdraw");(s.length!==1||s[0].form!=="interval"||s[0].measure!==a||s[0].role!=="writes")&&t("missing or ambiguous "+e+" limit");const r=/^(0|[1-9][0-9]*)\.\.(0|[1-9][0-9]*)$/.exec(s[0].value??"");return(!r||!Number.isSafeInteger(Number(r[1]))||!Number.isSafeInteger(Number(r[2]))||Number(r[1])>Number(r[2])||Number(r[2])<1)&&t("invalid "+e+" limit"),Number(r[2])}c(d,"limit");async function P(o,e,a,s,r){M(s)||t("backend not selected");const f={memoryBytes:d(s,"memory","bytes"),stackBytes:d(s,"stack","bytes"),executionMs:d(s,"execution","milliseconds")},L=d(s,"worker-lifetime","milliseconds"),S=d(s,"response","bytes"),p=new URL("../../assets/wasm/",import.meta.url),l=JSON.parse(y(new URL("manifest.json",p),"utf8"));l.forms||t("installed form closure missing");const N={};for(const i of e.filter(n=>n.record==="cell")){const n=i.fields.topos,m=l.forms[n];(!m||!["intervalForm","alphabetOfForm"].includes(m.export)||m.form!==i.fields.form)&&t("unsupported form standing "+n);const k=$(n,q(o)),F=k.parts.filter(w=>w.scope==="wire/topos/context-view");F.length!==1&&t("context selection "+n);const v=k.parts.filter(w=>w.kind==="check"&&w.view===F[0].value);(v.length!==1||v[0].value!==m.contextArtifact||!(v[0].restsOn??"").split("|").includes(m.contextArtifact))&&t("context implementation differs "+n);const x=a.resolve(i);(x.digest!==n||x.form.id!==m.form)&&t("prepared form differs "+i.fields.scope),N[i.fields.scope]={digest:n,export:m.export,params:x.params}}const O=Object.keys(l.modules);O.length!==1&&t("installed guest module map");const h=O[0];let g;try{g=`import{objectFold,intervalForm,alphabetOfForm}from${JSON.stringify(h)};const forms={intervalForm,alphabetOfForm},codecs=${JSON.stringify(N)},records=${JSON.stringify(e)};const context={resolve:cell=>{const c=codecs[cell.fields.scope];if(!c)throw Error('REFUSE unknown prepared cell');return{digest:c.digest,form:forms[c.export],params:c.params}}};globalThis.result=JSON.stringify(objectFold(records,context));`}catch{return t("context is not serializable")}const u=h+".entry",U=W(g),R=y(new URL("guest.js",p),"utf8"),A={[h]:R,[u]:g},E={trusted:{...l,modules:{...l.modules,[u]:U},entry:u,aliases:{},limits:f,byteLengths:{...l.byteLengths,modules:{...l.byteLengths.modules,[u]:Buffer.byteLength(g)}}},assets:{runtime:new Uint8Array(y(new URL("runtime.js",p))),wasm:new Uint8Array(y(new URL("runtime.wasm",p)))},modules:A,entry:u,aliases:{},limits:f},j=await I(E,{workerFactory:c(()=>new B(new URL("./node-worker.js",import.meta.url)),"workerFactory"),lifetimeMs:L,...r?{signal:r}:{}});Buffer.byteLength(j.output)>S&&t("response bytes limit");let b;try{b=JSON.parse(j.output)}catch{return t("invalid projection text")}return(!Array.isArray(b)||b.some(i=>!i||typeof i.cell!="string"||typeof i.state!="string"))&&t("invalid projection shape"),b}c(P,"foldObjectsWithWasm");export{P as foldObjectsWithWasm,M as usesWasmObject};

package/dist/wasm/worker.js

@@ -1,7 +1 @@
-import { runWasmRequest } from "./adapter.js";
-self.onmessage = async ({ data }) => { try {
-    self.postMessage({ ok: true, result: await runWasmRequest(data) });
-}
-catch (error) {
-    self.postMessage({ ok: false, error: String(error) });
-} };
+import{runWasmRequest as r}from"./adapter.js";self.onmessage=async({data:e})=>{try{self.postMessage({ok:!0,result:await r(e)})}catch(s){self.postMessage({ok:!1,error:String(s)})}};

package/docs/contracts/closure-delivery.md

@@ -18,6 +18,6 @@ Consumer verifies the expected container digest and repeats the same closure pre
 
 The host must verify actual mounted bytes again before execution; the test host demonstrates this but is not a public browser host.
 
-Existing native, program and worker custody remain unchanged. Acorn routes stay explicitly retained under A-F gate.
+Native, program and worker custody remains in force. A pinned syntax analyzer detects unsupported loading expressions before execution; Node inventories and links the executable modules. Authenticated world loads require a declared closure and verified mounted bytes. This preflight is not a JavaScript execution sandbox.
 
 No external fetch or general demand resolver is introduced. Missing bytes remain outside completed delivery and must be resolved by the existing host contract.

package/docs/contracts/closure-delivery.publication.json

@@ -4,7 +4,7 @@
     {
       "role": "contract",
       "path": "docs/contracts/closure-delivery.md",
-      "digest": "sha256:bdadeefcf8042749e642a453adc7d07944ceab3fbd62de46209ea3ed25d05c2e"
+      "digest": "sha256:e670a83d76a7c9d0558ff1f4f830c313497c9e809da409cece1caa5d2a079c8e"
     },
     {
       "role": "yes",