@lapxo/bound 0.2.4 → 0.2.6

package/dist/host/archive.js

@@ -1,152 +1 @@
-import { lstatSync, mkdirSync, writeFileSync } from 'node:fs';
-import { dirname, join, resolve } from 'node:path';
-import { gunzipSync } from 'node:zlib';
-const BLOCK = 512; // POSIX tar record size.
-const refuse = (why) => { throw new Error(`REFUSE·archive ${why}`); };
-/** POSIX archive coordinates; normalization cannot make two members share one destination. */
-export function archiveCoordinate(name) {
-    if (!name || name.startsWith('/') || /^[A-Za-z]:/.test(name) || name.includes('\\') || name.includes('\0'))
-        refuse(`invalid coordinate ${JSON.stringify(name)}`);
-    const parts = name.replace(/\/+$/, '').split('/');
-    while (parts[0] === '.')
-        parts.shift();
-    if (!parts.length || parts.some((part) => !part || part === '.' || part === '..'))
-        refuse(`invalid coordinate ${JSON.stringify(name)}`);
-    return parts.join('/');
-}
-function pax(bytes) {
-    const fields = {};
-    for (let at = 0; at < bytes.length;) {
-        const space = bytes.indexOf(32, at);
-        if (space < 0)
-            refuse('malformed PAX record length');
-        const lengthText = new TextDecoder().decode(bytes.subarray(at, space));
-        if (!/^\d+$/.test(lengthText))
-            refuse('malformed PAX record length');
-        const length = Number(lengthText);
-        const end = at + length;
-        if (!Number.isSafeInteger(length) || length <= space - at + 1 || end > bytes.length || bytes[end - 1] !== 10)
-            refuse('truncated PAX record');
-        const record = new TextDecoder().decode(bytes.subarray(space + 1, end - 1));
-        const equals = record.indexOf('=');
-        if (equals < 1)
-            refuse('malformed PAX attribute');
-        const key = record.slice(0, equals);
-        if (key.startsWith('GNU.sparse') || key.startsWith('SCHILY.realsize'))
-            refuse('sparse PAX members are unsupported');
-        fields[key] = record.slice(equals + 1);
-        at = end;
-    }
-    return fields;
-}
-/** The gzip/POSIX tar adapter reads regular files, directories and PAX attributes, or rejects the whole archive. */
-export function members(archive) {
-    const bytes = gunzipSync(archive);
-    const text = (at, length) => bytes.subarray(at, at + length).toString('utf8').replace(/\0[\s\S]*$/, '');
-    const octal = (at, length) => {
-        const raw = text(at, length).trim();
-        if (!/^[0-7]+$/.test(raw))
-            refuse(`invalid octal field at ${at}`);
-        const n = Number.parseInt(raw, 8);
-        if (!Number.isSafeInteger(n) || n < 0)
-            refuse(`unrepresentable field at ${at}`);
-        return n;
-    };
-    const out = [];
-    const files = new Set();
-    const directories = new Set();
-    let global = {};
-    let local;
-    for (let at = 0;;) {
-        if (at + BLOCK > bytes.length)
-            refuse('missing complete end records');
-        const header = bytes.subarray(at, at + BLOCK);
-        if (header.every((byte) => byte === 0)) {
-            if (local !== undefined)
-                refuse('PAX attributes have no following member');
-            if (at + 2 * BLOCK > bytes.length || !bytes.subarray(at).every((byte) => byte === 0))
-                refuse('invalid end records or trailing data');
-            return out;
-        }
-        const checksum = header.reduce((sum, byte, i) => sum + (i >= 148 && i < 156 ? 32 : byte), 0);
-        if (octal(at + 148, 8) !== checksum)
-            refuse(`header checksum mismatch at ${at}`);
-        const magic = text(at + 257, 6);
-        if (magic && magic !== 'ustar' && magic !== 'ustar ')
-            refuse(`unsupported tar format ${magic}`);
-        const type = text(at + 156, 1);
-        const attrs = { ...global, ...local };
-        let size = octal(at + 124, 12);
-        if (type !== 'x' && type !== 'g' && attrs['size'] !== undefined) {
-            if (!/^\d+$/.test(attrs['size']))
-                refuse('invalid PAX size');
-            size = Number(attrs['size']);
-            if (!Number.isSafeInteger(size))
-                refuse('unrepresentable PAX size');
-        }
-        const next = at + BLOCK + Math.ceil(size / BLOCK) * BLOCK;
-        if (next > bytes.length)
-            refuse(`truncated member at ${at}`);
-        const body = bytes.subarray(at + BLOCK, at + BLOCK + size);
-        if (type === 'x' || type === 'g') {
-            const fields = pax(body);
-            if (type === 'g')
-                global = { ...global, ...fields };
-            else
-                local = { ...local, ...fields };
-        }
-        else {
-            const rawName = attrs['path'] ?? [magic ? text(at + 345, 155) : '', text(at, 100)].filter(Boolean).join('/');
-            local = undefined;
-            if (type === '5' && /^\.\/?$/.test(rawName) && size === 0) {
-                at = next;
-                continue;
-            }
-            const name = archiveCoordinate(rawName);
-            if (!['', '0', '5'].includes(type))
-                refuse(`unsupported member type ${type} at ${name}`);
-            const steps = name.split('/');
-            if (steps.slice(0, -1).some((_, i) => files.has(steps.slice(0, i + 1).join('/'))))
-                refuse(`file is an ancestor of ${name}`);
-            if (type === '5') {
-                if (size !== 0 || files.has(name))
-                    refuse(`invalid directory ${name}`);
-                directories.add(name);
-            }
-            else {
-                if (files.has(name) || directories.has(name))
-                    refuse(`duplicate or conflicting member ${name}`);
-                files.add(name);
-                steps.slice(0, -1).forEach((_, i) => directories.add(steps.slice(0, i + 1).join('/')));
-                out.push({ name, bytes: body });
-            }
-        }
-        at = next;
-    }
-}
-/** Existing links or files are never followed or overwritten by extraction. */
-export function archiveDestination(into, name) {
-    const root = resolve(into);
-    const parts = archiveCoordinate(name).split('/');
-    let at = root;
-    const base = lstatSync(at, { throwIfNoEntry: false });
-    if (base !== undefined && !base.isDirectory())
-        refuse(`destination is not a directory: ${root}`);
-    for (let i = 0; i < parts.length; i += 1) {
-        at = join(at, parts[i]);
-        const st = lstatSync(at, { throwIfNoEntry: false });
-        if (st !== undefined && (i === parts.length - 1 || !st.isDirectory()))
-            refuse(`destination already occupied: ${at}`);
-    }
-    return at;
-}
-export function unpack(archive, into) {
-    const files = members(archive);
-    const destinations = files.map((one) => archiveDestination(into, one.name));
-    for (const [i, one] of files.entries()) {
-        const at = destinations[i];
-        mkdirSync(dirname(at), { recursive: true });
-        writeFileSync(at, one.bytes, { flag: 'wx' });
-    }
-    return files.map((one) => one.name);
-}
+var X=Object.defineProperty;var p=(t,r)=>X(t,"name",{value:r,configurable:!0});import{lstatSync as z,mkdirSync as I,writeFileSync as E}from"node:fs";import{dirname as j,join as k,resolve as D}from"node:path";import{gunzipSync as O}from"node:zlib";const g=512,n=p(t=>{throw new Error(`REFUSE\xB7archive ${t}`)},"refuse");function A(t){(!t||t.startsWith("/")||/^[A-Za-z]:/.test(t)||t.includes("\\")||t.includes("\0"))&&n(`invalid coordinate ${JSON.stringify(t)}`);const r=t.replace(/\/+$/,"").split("/");for(;r[0]===".";)r.shift();return(!r.length||r.some(i=>!i||i==="."||i===".."))&&n(`invalid coordinate ${JSON.stringify(t)}`),r.join("/")}p(A,"archiveCoordinate");function C(t){const r={};for(let i=0;i<t.length;){const c=t.indexOf(32,i);c<0&&n("malformed PAX record length");const s=new TextDecoder().decode(t.subarray(i,c));/^\d+$/.test(s)||n("malformed PAX record length");const a=Number(s),o=i+a;(!Number.isSafeInteger(a)||a<=c-i+1||o>t.length||t[o-1]!==10)&&n("truncated PAX record");const d=new TextDecoder().decode(t.subarray(c+1,o-1)),u=d.indexOf("=");u<1&&n("malformed PAX attribute");const e=d.slice(0,u);(e.startsWith("GNU.sparse")||e.startsWith("SCHILY.realsize"))&&n("sparse PAX members are unsupported"),r[e]=d.slice(u+1),i=o}return r}p(C,"pax");function T(t){const r=O(t),i=p((e,y)=>r.subarray(e,e+y).toString("utf8").replace(/\0[\s\S]*$/,""),"text"),c=p((e,y)=>{const x=i(e,y).trim();/^[0-7]+$/.test(x)||n(`invalid octal field at ${e}`);const m=Number.parseInt(x,8);return(!Number.isSafeInteger(m)||m<0)&&n(`unrepresentable field at ${e}`),m},"octal"),s=[],a=new Set,o=new Set;let d={},u;for(let e=0;;){e+g>r.length&&n("missing complete end records");const y=r.subarray(e,e+g);if(y.every(f=>f===0))return u!==void 0&&n("PAX attributes have no following member"),(e+2*g>r.length||!r.subarray(e).every(f=>f===0))&&n("invalid end records or trailing data"),s;const x=y.reduce((f,l,b)=>f+(b>=148&&b<156?32:l),0);c(e+148,8)!==x&&n(`header checksum mismatch at ${e}`);const m=i(e+257,6);m&&m!=="ustar"&&m!=="ustar "&&n(`unsupported tar format ${m}`);const h=i(e+156,1),S={...d,...u};let $=c(e+124,12);h!=="x"&&h!=="g"&&S.size!==void 0&&(/^\d+$/.test(S.size)||n("invalid PAX size"),$=Number(S.size),Number.isSafeInteger($)||n("unrepresentable PAX size"));const v=e+g+Math.ceil($/g)*g;v>r.length&&n(`truncated member at ${e}`);const N=r.subarray(e+g,e+g+$);if(h==="x"||h==="g"){const f=C(N);h==="g"?d={...d,...f}:u={...u,...f}}else{const f=S.path??[m?i(e+345,155):"",i(e,100)].filter(Boolean).join("/");if(u=void 0,h==="5"&&/^\.\/?$/.test(f)&&$===0){e=v;continue}const l=A(f);["","0","5"].includes(h)||n(`unsupported member type ${h} at ${l}`);const b=l.split("/");b.slice(0,-1).some((P,w)=>a.has(b.slice(0,w+1).join("/")))&&n(`file is an ancestor of ${l}`),h==="5"?(($!==0||a.has(l))&&n(`invalid directory ${l}`),o.add(l)):((a.has(l)||o.has(l))&&n(`duplicate or conflicting member ${l}`),a.add(l),b.slice(0,-1).forEach((P,w)=>o.add(b.slice(0,w+1).join("/"))),s.push({name:l,bytes:N}))}e=v}}p(T,"members");function W(t,r){const i=D(t),c=A(r).split("/");let s=i;const a=z(s,{throwIfNoEntry:!1});a!==void 0&&!a.isDirectory()&&n(`destination is not a directory: ${i}`);for(let o=0;o<c.length;o+=1){s=k(s,c[o]);const d=z(s,{throwIfNoEntry:!1});d!==void 0&&(o===c.length-1||!d.isDirectory())&&n(`destination already occupied: ${s}`)}return s}p(W,"archiveDestination");function U(t,r){const i=T(t),c=i.map(s=>W(r,s.name));for(const[s,a]of i.entries()){const o=c[s];I(j(o),{recursive:!0}),E(o,a.bytes,{flag:"wx"})}return i.map(s=>s.name)}p(U,"unpack");export{A as archiveCoordinate,W as archiveDestination,T as members,U as unpack};

package/dist/host/call-context.js

@@ -1,14 +1 @@
-import { AsyncLocalStorage } from 'node:async_hooks';
-const calls = new AsyncLocalStorage();
-export const hostInstrumentName = () => calls.getStore()?.instrumentName;
-export const hostInstrumentRuntime = () => calls.getStore()?.runtime;
-export const withHostInstrument = (instrumentName, run) => calls.run({ ...calls.getStore(), instrumentName }, run);
-export const withHostCall = (call, run) => calls.run(call, run);
-/** No stream monkey-patching: diagnostics follow only this asynchronous call. */
-export function hostOutput(stream, text) {
-    const output = calls.getStore()?.output;
-    if (output)
-        output(stream, text);
-    else
-        (stream === 'out' ? process.stdout : process.stderr).write(text);
-}
+var n=Object.defineProperty;var o=(t,e)=>n(t,"name",{value:e,configurable:!0});import{AsyncLocalStorage as u}from"node:async_hooks";const s=new u,m=o(()=>s.getStore()?.freshBytes===!0,"hostRequiresFreshBytes"),i=o(()=>s.getStore()?.arguments,"hostArguments"),g=o(()=>s.getStore()?.instrumentName,"hostInstrumentName"),h=o(()=>s.getStore()?.runtime,"hostInstrumentRuntime"),S=o((t,e)=>s.run({...s.getStore(),instrumentName:t},e),"withHostInstrument"),a=o((t,e)=>s.run(t,e),"withHostCall");function l(t,e){const r=s.getStore()?.output;r?r(t,e):(t==="out"?process.stdout:process.stderr).write(e)}o(l,"hostOutput");export{i as hostArguments,g as hostInstrumentName,h as hostInstrumentRuntime,l as hostOutput,m as hostRequiresFreshBytes,a as withHostCall,S as withHostInstrument};

package/dist/host/capsule-process.js

@@ -1,62 +1,2 @@
-import { hostOutput } from "./call-context.js";
-import { actCosts } from "./act-cost.js";
-import { fileURLToPath } from 'node:url';
-import { boundedProcess } from "./process-lifetime.js";
-import { spawnSync } from 'node:child_process';
-import { PROTOCOL } from '@lapxo/topos/wire';
-/** Operational process failure, distinct from a valid contract refusal or abstention. */
-export class CapsuleProcessError extends Error {
-    constructor(reason, result) {
-        const stdout = result.stdout ?? '';
-        const stderr = result.stderr ?? '';
-        super(`REFUSE·capsule process ${reason}\n${stderr}${stdout}`);
-        this.name = 'CapsuleProcessError';
-        this.stdout = stdout;
-        this.stderr = stderr;
-        this.status = result.status;
-        this.signal = result.signal;
-        this.cause = result.error;
-    }
-}
-export function validResponse(value, request) {
-    if (value === null || typeof value !== 'object' || Array.isArray(value))
-        return false;
-    const one = value;
-    if (one['protocol'] !== PROTOCOL)
-        return false;
-    if (one['kind'] === 'refuse' || one['kind'] === 'abstain')
-        return typeof one['why'] === 'string';
-    if (one['kind'] !== 'fact')
-        return false;
-    if (request.verb === 'render')
-        return Array.isArray(one['lines']) && one['lines'].every((line) => typeof line === 'string');
-    if (request.verb === 'read')
-        return Array.isArray(one['claims']);
-    return true;
-}
-/** Last-line JSON is the wire framing. No partial batch, failed exit or synthetic missing response is accepted. */
-export function executeCapsule(command, args, requests, limits = {}, lifetime) {
-    return actCosts.measure(() => {
-        const cwd = limits.cwd;
-        const directory = cwd === undefined ? undefined : typeof cwd === 'string' ? cwd : fileURLToPath(cwd);
-        const run = lifetime === undefined ? spawnSync(command, args, { input: JSON.stringify(requests), encoding: 'utf8', maxBuffer: 1 << 26, ...limits }) : boundedProcess(command, args, JSON.stringify(requests), lifetime, directory, limits.env);
-        if ('error' in run && run.error)
-            throw new CapsuleProcessError(`failed: ${run.error.message}`, run);
-        if (run.signal !== null || run.status !== 0)
-            throw new CapsuleProcessError(`exited ${run.status ?? `with signal ${run.signal}`}`, run);
-        const last = /(?:^|\n)([^\n]*)$/.exec(run.stdout.trimEnd())?.[1] ?? '';
-        let values;
-        try {
-            values = JSON.parse(last);
-        }
-        catch (error) {
-            throw new CapsuleProcessError('returned malformed or absent JSON', { ...run, error });
-        }
-        if (!Array.isArray(values) || values.length !== requests.length || !values.every((value, i) => validResponse(value, requests[i]))) {
-            throw new CapsuleProcessError(`returned an invalid batch; expected ${requests.length} responses`, run);
-        }
-        if (run.stderr)
-            hostOutput('error', run.stderr);
-        return values;
-    });
-}
+var y=Object.defineProperty;var f=(e,n)=>y(e,"name",{value:n,configurable:!0});import{hostOutput as h}from"./call-context.js";import{actCosts as m}from"./act-cost.js";import{fileURLToPath as g}from"node:url";import{boundedProcess as w}from"./process-lifetime.js";import{spawnSync as O}from"node:child_process";import{library14_PROTOCOL as x}from"../vendor/runtime.js";class d extends Error{static{f(this,"CapsuleProcessError")}constructor(n,r){const s=r.stdout??"",o=r.stderr??"";super(`REFUSE\xB7capsule process ${n}
+${o}${s}`),this.name="CapsuleProcessError",this.stdout=s,this.stderr=o,this.status=r.status,this.signal=r.signal,this.cause=r.error}}function b(e,n){if(e===null||typeof e!="object"||Array.isArray(e))return!1;const r=e;return r.protocol!==x?!1:r.kind==="refuse"||r.kind==="abstain"?typeof r.why=="string":r.kind!=="fact"?!1:n.verb==="render"?Array.isArray(r.lines)&&r.lines.every(s=>typeof s=="string"):n.verb==="read"?Array.isArray(r.claims):!0}f(b,"validResponse");function R(e,n,r,s={},o){return m.measure(()=>{const a=s.cwd,u=a===void 0?void 0:typeof a=="string"?a:g(a),t=o===void 0?O(e,n,{input:JSON.stringify(r),encoding:"utf8",maxBuffer:1<<26,...s}):w(e,n,JSON.stringify(r),o,u,s.env);if("error"in t&&t.error)throw new d(`failed: ${t.error.message}`,t);if(t.signal!==null||t.status!==0)throw new d(`exited ${t.status??`with signal ${t.signal}`}`,t);const p=/(?:^|\n)([^\n]*)$/.exec(t.stdout.trimEnd())?.[1]??"";let i;try{i=JSON.parse(p)}catch(c){throw new d("returned malformed or absent JSON",{...t,error:c})}if(!Array.isArray(i)||i.length!==r.length||!i.every((c,l)=>b(c,r[l])))throw new d(`returned an invalid batch; expected ${r.length} responses`,t);return t.stderr&&h("error",t.stderr),i})}f(R,"executeCapsule");export{d as CapsuleProcessError,R as executeCapsule,b as validResponse};

package/dist/host/capsule.js

@@ -1,171 +1,9 @@
-import { hostOutput } from "./call-context.js";
-import { readerLifetime, parse } from '@lapxo/topos/wire';
-import { contentStore, verifiedContent, contentPolicy } from "./content-store.js";
-import { readOnly } from "./read-only.js";
-import { readingBoundary } from "./reading-context.js";
-import { nativeReaderRoute } from "./native-reader-context.js";
-import { assertNativeRouteCurrent, invokeNativeRoute, materializeNativeRoute } from "./native/route.js";
-import { sha } from "./hash.js";
-import { wireLinesOf as linesOf } from "../fold/claims.js";
-import { createHash } from 'node:crypto';
-import { mkdtempSync, rmSync, statSync } from 'node:fs';
-import { tmpdir } from 'node:os';
-import { basename, join, resolve, relative, isAbsolute, sep } from 'node:path';
-import { CAPSULE } from '@lapxo/topos/wire';
-import { declarationOf } from '@lapxo/topos/capsule';
-import { unpack } from "./archive.js";
-import { executeCapsule, validResponse } from "./capsule-process.js";
-import { holdStore, replaceWhole, storeAt } from "../land/ledger.js";
-import { coordinatesUnder, observeFile, observeText } from "../observe/files.js";
-import { hostOf } from "../observe/run.js";
-import { ownLock, ownRoot, ownStore, processOf } from "../observe/runner.js";
-import { said } from "../fold/wire.js";
-const declared = new Map();
-const laid = new Map();
-const releaseLaid = () => { for (const at of laid.values())
-    rmSync(at, { recursive: true, force: true }); };
-/** A blob is unpacked once in a process, where every run of it the process asks for reads it. */
-function unpacked(digest, bytes) {
-    const held = laid.get(digest);
-    if (held !== undefined)
-        return held;
-    const at = mkdtempSync(join(tmpdir(), `${basename(ownRoot())}-capsule-`));
-    try {
-        unpack(bytes, at);
-    }
-    catch (error) {
-        rmSync(at, { recursive: true, force: true });
-        throw error;
-    }
-    laid.set(digest, at);
-    if (!process.listeners('exit').includes(releaseLaid))
-        process.once('exit', releaseLaid);
-    return at;
-}
-/**
- * A capsule is the bytes a digest names in the instrument's own store, and only when they hash to it: its own lock is
- * read from them, and the coordinate a lock names runs as a process of its own, like a reader. Each answer is kept by the
- * digest of its complete declared request and implementation; distinct views retain distinct answers, and the same
- * request reads its verified answer without running again. Operational failures never enter the cache; refusals and abstentions are asked again.
- */
-const capsules = new Map();
-/** A blob is loaded once in an act. A later ask for the same digest reads that capsule, and does not hash or unpack it again. */
-export function capsuleAt(digest, entry, store) {
-    const cacheStore = store ?? contentStore();
-    const { bytes } = verifiedContent(digest, cacheStore);
-    const identity = `${cacheStore}\0${digest}\0${entry}`;
-    const held = capsules.get(identity);
-    if (held !== undefined)
-        return held;
-    const known = declared.get(digest) ?? ((lines) => ({ lines, declaration: declarationOf(lines) }))(linesOf(observeText(join(unpacked(digest, bytes), CAPSULE))));
-    declared.set(digest, known);
-    const names = Object.keys(known.declaration.regions);
-    const root = unpacked(digest, bytes);
-    const module = resolve(root, entry);
-    const coordinate = relative(root, module);
-    if (!entry || isAbsolute(entry) || (coordinate === '..' || coordinate.startsWith(`..${sep}`)) || entry.split(/[\\/]/).includes('..')) {
-        throw new Error(`REFUSE·capsule ${digest} declared entry ${entry || '(absent)'} unavailable`);
-    }
-    const capsule = { digest, ...known, ask: (requests, reader) => {
-            if (!statSync(module, { throwIfNoEntry: false })?.isFile())
-                throw new Error(`REFUSE·capsule ${digest} declared entry ${entry} unavailable`);
-            return answered(digest, bytes, requests, names, root, cacheStore, module, reader);
-        } };
-    capsules.set(identity, capsule);
-    return capsule;
-}
-const layoutsOf = () => said(ownLock(), 'release/layout')
-    .map((token) => token.split(':')).filter((pair) => pair.length === 2 && pair[0] !== undefined && pair[1] !== undefined);
-const oneModule = (at) => {
-    const files = coordinatesUnder(at, at).filter((one) => one.endsWith('.js'));
-    return files.length === 1 ? files[0] : undefined;
-};
-const split = new Map();
-const spawnOf = (at, names) => {
-    const held = split.get(at);
-    if (held !== undefined)
-        return held;
-    const layout = names.length === 0 ? undefined : layoutsOf().find(([dir, ext]) => names.some((name) => observeText(join(at, dir, `${name}${ext}`)) !== undefined));
-    const child = layout !== undefined ? [processOf('located', 'host'), at, layout[0], layout[1]]
-        : ((file) => (file === undefined ? [] : [processOf('located', 'host'), at, file, 'render']))(oneModule(at));
-    split.set(at, child);
-    return child;
-};
-export const childFlags = (argv = process.execArgv) => argv.filter((flag, i) => !/^(-e|-p|--eval|--print)$/.test(argv[i - 1] ?? '') && !/^(-e|-p|--eval|--print|--input-type)(=|$)/.test(flag));
-function answered(digest, bytes, requests, names, tree, cacheStore = ownStore(), entry, reader) {
-    const boundary = readingBoundary();
-    const native = nativeReaderRoute();
-    if (native) {
-        if (!boundary?.execution || digest !== native.profile.selection.archive)
-            throw Error('REFUSE·native reader lacks its complete implementation identity');
-        assertNativeRouteCurrent(native);
-    }
-    const child = entry === undefined ? spawnOf(tree ?? unpacked(digest, bytes), names) : [entry];
-    if (!child.length) {
-        hostOutput('error', `LOAD     regions · none of ${names.length} under the directories release/layout names\n`);
-        return requests.map(() => undefined);
-    }
-    const loader = entry !== undefined ? `${createHash('sha256').update(`${relative(tree, entry)}\n`).digest('hex')}\n` : child.length > 1 ? `${createHash('sha256').update(observeFile(child[0]) ?? new Uint8Array()).digest('hex')}\n` : '';
-    const lifetime = readerLifetime(contentPolicy().flatMap(line => { const p = parse(line); return p.kind === 'fact' ? [p.value.fields] : []; }), reader ?? digest);
-    const policy = lifetime === undefined ? '' : JSON.stringify(lifetime) + '\n';
-    const hitOf = (request) => sha(`${digest}\n${loader}${policy}${boundary === undefined ? '' : boundary.identity + '\n'}${JSON.stringify(request)}`);
-    const hits = requests.map(hitOf);
-    const kept = hits.map(hit => storeAt(cacheStore, 'cas', 'answers', hit));
-    const held = kept.map((at, i) => {
-        const text = observeText(at);
-        if (text === undefined)
-            return undefined;
-        try {
-            const got = JSON.parse(text);
-            return got.format === 'capsule-answer/2' && got.hit === hits[i] && validResponse(got.said, requests[i]) && got.said.kind === 'fact' ? got.said : undefined;
-        }
-        catch (error) {
-            throw new Error(`${at}: ${error instanceof Error ? error.message : String(error)}`);
-        }
-    });
-    const missing = requests.filter((_, i) => held[i] === undefined);
-    if (missing.length && readOnly())
-        throw Error(`REFUSE·preview capsule ${digest} has no verified answer for the proposed inputs; fold the declared inputs first`);
-    if (missing.length)
-        hostOutput('error', `CAPSULE  ${digest.slice(7, 19)} · ${requests.length} asked · ${missing.length} run · ${missing.map((one) => `${one.rootScope}${one.region}`).join(' ')}\n`);
-    // Execute and validate the entire batch before committing any answer to the cache.
-    if (native && !lifetime)
-        throw Error('REFUSE·native reader missing declared lifetime');
-    const ran = !missing.length ? [] : native
-        ? invokeNativeRoute(native, { ...materializeNativeRoute(native), requests: missing, execution: boundary.execution, limits: lifetime })
-        : executeCapsule(process.execPath, [...childFlags(boundary?.execution?.flags), hostOf(), ...child], missing, boundary?.execution ? { env: boundary.execution.env, cwd: boundary.execution.cwd } : {}, lifetime);
-    return requests.map((request, i) => {
-        if (held[i] !== undefined)
-            return held[i];
-        const said = ran[missing.indexOf(request)];
-        if (said?.kind === 'fact') {
-            const text = JSON.stringify({ format: 'capsule-answer/2', hit: hits[i], said });
-            replaceWhole(kept[i], text);
-            holdStore(cacheStore, 'answers', hits[i], Buffer.byteLength(text));
-        }
-        return said;
-    });
-}
-/** The host may supply its cache store independently of the located executable. */
-export function locatedAt(tree, place, cacheStore = ownStore()) {
-    const at = join(tree, place);
-    const lines = linesOf(observeText(join(at, CAPSULE)));
-    if (!lines.length)
-        return undefined;
-    const known = { lines, declaration: declarationOf(lines) };
-    const names = Object.keys(known.declaration.regions);
-    if (!spawnOf(at, names).length)
-        return undefined;
-    const hash = createHash('sha256');
-    hash.update(observeFile(join(at, CAPSULE)) ?? new Uint8Array());
-    for (const name of names)
-        for (const [dir, ext] of layoutsOf()) {
-            const bytes = observeFile(join(at, dir, `${name}${ext}`));
-            if (bytes !== undefined) {
-                hash.update(bytes);
-                break;
-            }
-        }
-    const digest = `sha256:${hash.digest('hex')}`;
-    return { digest, ...known, ask: (requests, reader) => answered(digest, new Uint8Array(), requests, names, at, cacheStore, undefined, reader) };
-}
+var G=Object.defineProperty;var l=(e,n)=>G(e,"name",{value:n,configurable:!0});import{hostOutput as F}from"./call-context.js";import{library14_readerLifetime as K,library14_parse as Q}from"../vendor/runtime.js";import{contentStore as V,verifiedContent as X,contentPolicy as Y}from"./content-store.js";import{readOnly as Z}from"./read-only.js";import{readingBoundary as q}from"./reading-context.js";import{nativeReaderRoute as ee}from"./native-reader-context.js";import{assertNativeRouteCurrent as ne,invokeNativeRoute as te,materializeNativeRoute as re}from"./native/route.js";import{sha as oe}from"./hash.js";import{wireLinesOf as N}from"../fold/claims.js";import{createHash as b}from"node:crypto";import{mkdtempSync as ie,rmSync as C,statSync as se}from"node:fs";import{tmpdir as ae}from"node:os";import{basename as ce,join as $,resolve as de,relative as M,isAbsolute as fe,sep as le}from"node:path";import{library14_CAPSULE as k}from"../vendor/runtime.js";import{library4_declarationOf as j}from"../vendor/runtime.js";import{unpack as ue}from"./archive.js";import{executeCapsule as pe,validResponse as me}from"./capsule-process.js";import{holdStore as he,replaceWhole as we,storeAt as $e}from"../land/ledger.js";import{coordinatesUnder as ve,observeFile as A,observeText as E}from"../observe/files.js";import{hostOf as ye}from"../observe/run.js";import{ownLock as xe,ownRoot as ge,ownStore as P,processOf as _}from"../observe/runner.js";import{said as Ee}from"../fold/wire.js";const J=new Map,R=new Map,W=l(()=>{for(const e of R.values())C(e,{recursive:!0,force:!0})},"releaseLaid");function U(e,n){const r=R.get(e);if(r!==void 0)return r;const t=ie($(ae(),`${ce(ge())}-capsule-`));try{ue(n,t)}catch(o){throw C(t,{recursive:!0,force:!0}),o}return R.set(e,t),process.listeners("exit").includes(W)||process.once("exit",W),t}l(U,"unpacked");const B=new Map;function Qe(e,n,r){const t=r??V(),{bytes:o}=X(e,t),a=`${t}\0${e}\0${n}`,c=B.get(a);if(c!==void 0)return c;const m=J.get(e)??(y=>({lines:y,declaration:j(y)}))(N(E($(U(e,o),k))));J.set(e,m);const d=Object.keys(m.declaration.regions),i=U(e,o),u=de(i,n),v=M(i,u);if(!n||fe(n)||v===".."||v.startsWith(`..${le}`)||n.split(/[\\/]/).includes(".."))throw new Error(`REFUSE\xB7capsule ${e} declared entry ${n||"(absent)"} unavailable`);const h={digest:e,...m,ask:l((y,S)=>{if(!se(u,{throwIfNoEntry:!1})?.isFile())throw new Error(`REFUSE\xB7capsule ${e} declared entry ${n} unavailable`);return I(e,o,y,d,i,t,u,S)},"ask")};return B.set(a,h),h}l(Qe,"capsuleAt");const z=l(()=>Ee(xe(),"release/layout").map(e=>e.split(":")).filter(e=>e.length===2&&e[0]!==void 0&&e[1]!==void 0),"layoutsOf"),Se=l(e=>{const n=ve(e,e).filter(r=>r.endsWith(".js"));return n.length===1?n[0]:void 0},"oneModule"),D=new Map,H=l((e,n)=>{const r=D.get(e);if(r!==void 0)return r;const t=n.length===0?void 0:z().find(([a,c])=>n.some(m=>E($(e,a,`${m}${c}`))!==void 0)),o=t!==void 0?[_("located","host"),e,t[0],t[1]]:(a=>a===void 0?[]:[_("located","host"),e,a,"render"])(Se(e));return D.set(e,o),o},"spawnOf"),Oe=l((e=process.execArgv)=>e.filter((n,r)=>!/^(-e|-p|--eval|--print)$/.test(e[r-1]??"")&&!/^(-e|-p|--eval|--print|--input-type)(=|$)/.test(n)),"childFlags");function I(e,n,r,t,o,a=P(),c,m){const d=q(),i=ee();if(i){if(!d?.execution||e!==i.profile.selection.archive)throw Error("REFUSE\xB7native reader lacks its complete implementation identity");ne(i)}const u=c===void 0?H(o??U(e,n),t):[c];if(!u.length)return F("error",`LOAD     regions \xB7 none of ${t.length} under the directories release/layout names
+`),r.map(()=>{});const v=c!==void 0?`${b("sha256").update(`${M(o,c)}
+`).digest("hex")}
+`:u.length>1?`${b("sha256").update(A(u[0])??new Uint8Array).digest("hex")}
+`:"",h=K(Y().flatMap(s=>{const f=Q(s);return f.kind==="fact"?[f.value.fields]:[]}),m??e),y=h===void 0?"":JSON.stringify(h)+`
+`,S=l(s=>oe(`${e}
+${v}${y}${d===void 0?"":d.identity+`
+`}${JSON.stringify(s)}`),"hitOf"),g=r.map(S),L=g.map(s=>$e(a,"cas","answers",s)),O=L.map((s,f)=>{const x=E(s);if(x!==void 0)try{const p=JSON.parse(x);return p.format==="capsule-answer/2"&&p.hit===g[f]&&me(p.said,r[f])&&p.said.kind==="fact"?p.said:void 0}catch(p){throw new Error(`${s}: ${p instanceof Error?p.message:String(p)}`)}}),w=r.filter((s,f)=>O[f]===void 0);if(w.length&&Z())throw Error(`REFUSE\xB7preview capsule ${e} has no verified answer for the proposed inputs; fold the declared inputs first`);if(w.length&&F("error",`CAPSULE  ${e.slice(7,19)} \xB7 ${r.length} asked \xB7 ${w.length} run \xB7 ${w.map(s=>`${s.rootScope}${s.region}`).join(" ")}
+`),i&&!h)throw Error("REFUSE\xB7native reader missing declared lifetime");const T=w.length?i?te(i,{...re(i),requests:w,execution:d.execution,limits:h}):pe(process.execPath,[...Oe(d?.execution?.flags),ye(),...u],w,d?.execution?{env:d.execution.env,cwd:d.execution.cwd}:{},h):[];return r.map((s,f)=>{if(O[f]!==void 0)return O[f];const x=T[w.indexOf(s)];if(x?.kind==="fact"){const p=JSON.stringify({format:"capsule-answer/2",hit:g[f],said:x});we(L[f],p),he(a,"answers",g[f],Buffer.byteLength(p))}return x})}l(I,"answered");function Ve(e,n,r=P()){const t=$(e,n),o=N(E($(t,k)));if(!o.length)return;const a={lines:o,declaration:j(o)},c=Object.keys(a.declaration.regions);if(!H(t,c).length)return;const m=b("sha256");m.update(A($(t,k))??new Uint8Array);for(const i of c)for(const[u,v]of z()){const h=A($(t,u,`${i}${v}`));if(h!==void 0){m.update(h);break}}const d=`sha256:${m.digest("hex")}`;return{digest:d,...a,ask:l((i,u)=>I(d,new Uint8Array,i,c,t,r,void 0,u),"ask")}}l(Ve,"locatedAt");export{Qe as capsuleAt,Oe as childFlags,Ve as locatedAt};

package/dist/host/cell-receipts.js

@@ -1,128 +1,12 @@
-import { readFileSync, writeFileSync, existsSync, mkdirSync } from 'node:fs';
-import { join, dirname } from 'node:path';
-import { performance } from 'node:perf_hooks';
-import { fileURLToPath } from 'node:url';
-import { canonical, objectHistory, parse, byBytes, wireAt, RECEIPTS } from '@lapxo/topos/wire';
-import { cellInputs, cellReceiptContract, cellInputProfile } from '@lapxo/topos/cell-inputs';
-import { renderCells } from '@lapxo/topos/cells-view';
-import { admittedObjects } from "./objects.js";
-import { objectFold } from "../engine/index.js";
-import { fullDigest, bytesDigest } from "./digest.js";
-import { closeReceipts, noteIdle } from "../fold/closed.js";
-import { authorityFor, rootSigner } from "../fold/signers.js";
-import { signaturesOf } from "../fold/digests.js";
-import { storeOf } from "../land/ledger.js";
-import { ownLock } from "../observe/runner.js";
-import { toposAt } from "./selected-topos.js";
-const fields = (line) => { const p = parse(line); return p.kind === 'fact' ? p.value.fields : {}; };
-/** Only Topos input/render entry bytes enter region identity; host locations do not. */
-function implementation(algorithm) {
-    return ['@lapxo/topos/cell-inputs', '@lapxo/topos/cells-view'].map(member => bytesDigest(readFileSync(fileURLToPath(import.meta.resolve(member))), algorithm)).sort(byBytes);
-}
-/** Native count/bytes receipt lines; carried render blobs are separate verified cache payloads. */
-export async function cellsWithReceipts(root, history, emit) {
-    const started = performance.now(), store = storeOf(root), parsed = objectHistory(history);
-    if (parsed.kind !== 'fact')
-        throw Error(`REFUSE·wire ${parsed.why}`);
-    const authority = authorityFor(history, rootSigner(root), signaturesOf(store).admitted);
-    for (const record of parsed.value.objects)
-        if (authority.of(canonical(record.fields)).kind !== 'admitted')
-            throw Error(`REFUSE·authority receipt input ${record.fields.id}`);
-    const config = parsed.value.configuration.filter(f => authority.of(canonical(f)).kind === 'admitted');
-    cellReceiptContract(config);
-    const profile = cellInputProfile(config);
-    const instrument = ownLock().map(fields);
-    const wire = wireAt(instrument, Number.MAX_SAFE_INTEGER);
-    if (!wire)
-        throw Error('REFUSE·receipt no admitted digest algorithm');
-    const algorithm = [...wire.digests][0];
-    if (!algorithm)
-        throw Error('REFUSE·receipt no digest algorithm');
-    const code = implementation(algorithm);
-    const inputs = cellInputs(parsed.value.objects, profile), semantic = new Map(), inputBytes = new Map();
-    const pins = new Map();
-    for (const record of parsed.value.objects.filter(r => r.record === 'cell')) {
-        const pin = record.fields.topos;
-        if (!pins.has(pin)) {
-            const top = toposAt(pin, store);
-            pins.set(pin, [pin, ...top.dependencies]);
-        }
-        const scope = `receipts/cells/${record.fields.scope}`;
-        const ownInputs = inputs.get(record.fields.scope);
-        const metadata = [...pins.get(pin), ...code, 'resolution=1'];
-        const bytes = profile === 'semantic-live@1' ? [...ownInputs, ...metadata].sort(byBytes).join('\n') :
-            [...ownInputs, ...metadata.sort(byBytes), `receipt-inputs=${profile}`].join('\n');
-        inputBytes.set(scope, bytes);
-        semantic.set(scope, fullDigest(bytes, algorithm));
-    }
-    // The context stamp is a cache validity guard, not any cell's semantic receipt identity.
-    const contextStamp = fullDigest([...history, ...code].sort(byBytes), algorithm);
-    const at = join(root, RECEIPTS), raw = existsSync(at) ? readFileSync(at, 'utf8').split('\n').filter(Boolean) : [], native = raw.filter(l => parse(l).kind === 'fact');
-    const headers = native.filter(l => fields(l).scope === 'receipts' && fields(l).measure === 'digest');
-    const carried = (digest) => join(store, 'cas', 'carried', digest.slice(digest.indexOf(':') + 1));
-    const readVerified = (digest) => {
-        if (!digest.startsWith(algorithm + ':') || !/^[a-f0-9]+$/.test(digest.split(':')[1] ?? ''))
-            return;
-        const file = carried(digest);
-        if (!existsSync(file))
-            return;
-        const bytes = readFileSync(file);
-        const got = bytesDigest(bytes, algorithm);
-        if (got !== digest) {
-            emit(`RECEIPT invalid ${digest} · got ${got} · recompute`);
-            return;
-        }
-        return bytes.toString('utf8');
-    };
-    const opened = new Set(await closeReceipts(root, store, semantic));
-    const bodyLines = native.filter(l => fields(l).scope !== 'receipts').sort(byBytes).join('\n') + '\n';
-    const intact = raw.length === native.length && headers.length === 1 && readVerified(fields(headers[0]).at.replace(/^place:/, '')) === bodyLines;
-    if (!intact)
-        for (const scope of semantic.keys())
-            opened.add(scope);
-    const cached = new Map();
-    for (const [scope, digest] of semantic) {
-        const bytes = native.filter(l => fields(l).scope === scope && fields(l).measure === 'bytes');
-        const counts = native.filter(l => fields(l).scope === scope && fields(l).measure === 'count');
-        if (bytes.length !== 1 || counts.length !== 1 || fields(bytes[0]).value !== digest || fields(counts[0]).value !== '1..1') {
-            opened.add(scope);
-            continue;
-        }
-        const output = readVerified(fields(counts[0]).at.replace(/^place:/, ''));
-        if (output === undefined) {
-            opened.add(scope);
-            continue;
-        }
-        cached.set(scope, output);
-    }
-    const idle = headers.length === 1 && fields(headers[0]).value === contextStamp && readVerified(fields(headers[0]).at.replace(/^place:/, '')) !== undefined && opened.size === 0;
-    let readings;
-    if (!idle) {
-        const held = await admittedObjects(root, history, emit);
-        readings = objectFold(held.records, held.context);
-    }
-    const newLines = [], outputs = [];
-    const save = (text) => { const digest = bytesDigest(Buffer.from(text), algorithm); const path = carried(digest); mkdirSync(dirname(path), { recursive: true }); if (!existsSync(path) || readFileSync(path, 'utf8') !== text)
-        writeFileSync(path, text); return digest; };
-    for (const [scope, digest] of semantic) {
-        const cellName = scope.slice('receipts/cells/'.length);
-        const output = (!opened.has(scope) && cached.has(scope)) ? cached.get(scope) : renderCells([readings.find(c => c.cell === cellName)]).join('\n') + '\n';
-        outputs.push(output.trimEnd());
-        const payload = save(output);
-        if (save(inputBytes.get(scope)) !== digest)
-            throw Error('REFUSE·receipt input closure hash mismatch');
-        newLines.push(canonical({ scope, role: 'writes', form: 'interval', measure: 'count', value: '1..1', at: `place:${payload}`, by: 'bound' }), canonical({ scope, role: 'writes', form: 'alphabet', measure: 'bytes', value: digest, at: `place:${digest}`, by: 'bound' }));
-        emit(`RECEIPT ${scope}@1 · ${digest} · ${opened.has(scope) ? 'opened' : 'same'}`);
-    }
-    const nativeBody = newLines.sort(byBytes).join('\n') + '\n', body = save(nativeBody);
-    // One native header names carried count/bytes lines; at closes the exact carried bytes.
-    const next = [canonical({ scope: 'receipts', role: 'writes', form: 'alphabet', measure: 'digest', value: contextStamp, at: `place:${body}`, by: 'bound' }), ...newLines.sort(byBytes)].join('\n') + '\n';
-    if (!existsSync(at) || readFileSync(at, 'utf8') !== next)
-        writeFileSync(at, next);
-    if (idle)
-        noteIdle();
-    emit(`RECEIPTS ${semantic.size} read · ${opened.size} opened · ${idle ? 'idle' : 'context checked'} · provider ${idle ? 0 : pins.size}`);
-    for (const output of outputs)
-        emit(output);
-    emit(`COST cells@1 · ${(performance.now() - started).toFixed(3)} ms · admission/context/receipt/render included`);
-}
+var ee=Object.defineProperty;var f=(n,i)=>ee(n,"name",{value:i,configurable:!0});import{readFileSync as w,writeFileSync as D,existsSync as R,mkdirSync as te}from"node:fs";import{join as H,dirname as oe}from"node:path";import{performance as W}from"node:perf_hooks";import{fileURLToPath as re}from"node:url";import{library14_canonical as g,library14_objectHistory as se,library14_parse as G,library14_byBytes as d,library14_wireAt as ne,library14_RECEIPTS as ie}from"../vendor/runtime.js";import{library11_cellInputs as ce,library11_cellReceiptContract as ae,library11_cellInputProfile as le}from"../vendor/runtime.js";import{library12_renderCells as pe}from"../vendor/runtime.js";import{admittedObjects as fe}from"./objects.js";import{objectFold as de}from"../engine/index.js";import{fullDigest as V,bytesDigest as k}from"./digest.js";import{closeReceipts as ue,noteIdle as me}from"../fold/closed.js";import{authorityFor as ye,rootSigner as be}from"../fold/signers.js";import{signaturesOf as he}from"../fold/digests.js";import{storeOf as Ee}from"../land/ledger.js";import{ownLock as we}from"../observe/runner.js";import{toposAt as ge}from"./selected-topos.js";const r=f(n=>{const i=G(n);return i.kind==="fact"?i.value.fields:{}},"fields");function ve(n){return["@lapxo/topos/cell-inputs","@lapxo/topos/cells-view"].map(i=>k(w(re(import.meta.resolve(i))),n)).sort(d)}f(ve,"implementation");async function Le(n,i,u){const X=W.now(),v=Ee(n),m=se(i);if(m.kind!=="fact")throw Error(`REFUSE\xB7wire ${m.why}`);const x=ye(i,be(n),he(v).admitted);for(const e of m.value.objects)if(x.of(g(e.fields)).kind!=="admitted")throw Error(`REFUSE\xB7authority receipt input ${e.fields.id}`);const P=m.value.configuration.filter(e=>x.of(g(e)).kind==="admitted");ae(P);const j=le(P),q=we().map(r),T=ne(q,Number.MAX_SAFE_INTEGER);if(!T)throw Error("REFUSE\xB7receipt no admitted digest algorithm");const a=[...T.digests][0];if(!a)throw Error("REFUSE\xB7receipt no digest algorithm");const B=ve(a),J=ce(m.value.objects,j),y=new Map,U=new Map,S=new Map;for(const e of m.value.objects.filter(t=>t.record==="cell")){const t=e.fields.topos;if(!S.has(t)){const Z=ge(t,v);S.set(t,[t,...Z.dependencies])}const o=`receipts/cells/${e.fields.scope}`,s=J.get(e.fields.scope),p=[...S.get(t),...B,"resolution=1"],c=j==="semantic-live@1"?[...s,...p].sort(d).join(`
+`):[...s,...p.sort(d),`receipt-inputs=${j}`].join(`
+`);U.set(o,c),y.set(o,V(c,a))}const A=V([...i,...B].sort(d),a),b=H(n,ie),M=R(b)?w(b,"utf8").split(`
+`).filter(Boolean):[],h=M.filter(e=>G(e).kind==="fact"),E=h.filter(e=>r(e).scope==="receipts"&&r(e).measure==="digest"),O=f(e=>H(v,"cas","carried",e.slice(e.indexOf(":")+1)),"carried"),I=f(e=>{if(!e.startsWith(a+":")||!/^[a-f0-9]+$/.test(e.split(":")[1]??""))return;const t=O(e);if(!R(t))return;const o=w(t),s=k(o,a);if(s!==e){u(`RECEIPT invalid ${e} \xB7 got ${s} \xB7 recompute`);return}return o.toString("utf8")},"readVerified"),l=new Set(await ue(n,v,y)),K=h.filter(e=>r(e).scope!=="receipts").sort(d).join(`
+`)+`
+`;if(!(M.length===h.length&&E.length===1&&I(r(E[0]).at.replace(/^place:/,""))===K))for(const e of y.keys())l.add(e);const _=new Map;for(const[e,t]of y){const o=h.filter(c=>r(c).scope===e&&r(c).measure==="bytes"),s=h.filter(c=>r(c).scope===e&&r(c).measure==="count");if(o.length!==1||s.length!==1||r(o[0]).value!==t||r(s[0]).value!=="1..1"){l.add(e);continue}const p=I(r(s[0]).at.replace(/^place:/,""));if(p===void 0){l.add(e);continue}_.set(e,p)}const $=E.length===1&&r(E[0]).value===A&&I(r(E[0]).at.replace(/^place:/,""))!==void 0&&l.size===0;let z;if(!$){const e=await fe(n,i,u);z=de(e.records,e.context)}const F=[],L=[],C=f(e=>{const t=k(Buffer.from(e),a),o=O(t);return te(oe(o),{recursive:!0}),(!R(o)||w(o,"utf8")!==e)&&D(o,e),t},"save");for(const[e,t]of y){const o=e.slice(15),s=!l.has(e)&&_.has(e)?_.get(e):pe([z.find(c=>c.cell===o)]).join(`
+`)+`
+`;L.push(s.trimEnd());const p=C(s);if(C(U.get(e))!==t)throw Error("REFUSE\xB7receipt input closure hash mismatch");F.push(g({scope:e,role:"writes",form:"interval",measure:"count",value:"1..1",at:`place:${p}`,by:"bound"}),g({scope:e,role:"writes",form:"alphabet",measure:"bytes",value:t,at:`place:${t}`,by:"bound"})),u(`RECEIPT ${e}@1 \xB7 ${t} \xB7 ${l.has(e)?"opened":"same"}`)}const Q=F.sort(d).join(`
+`)+`
+`,Y=C(Q),N=[g({scope:"receipts",role:"writes",form:"alphabet",measure:"digest",value:A,at:`place:${Y}`,by:"bound"}),...F.sort(d)].join(`
+`)+`
+`;(!R(b)||w(b,"utf8")!==N)&&D(b,N),$&&me(),u(`RECEIPTS ${y.size} read \xB7 ${l.size} opened \xB7 ${$?"idle":"context checked"} \xB7 provider ${$?0:S.size}`);for(const e of L)u(e);u(`COST cells@1 \xB7 ${(W.now()-X).toFixed(3)} ms \xB7 admission/context/receipt/render included`)}f(Le,"cellsWithReceipts");export{Le as cellsWithReceipts};

package/dist/host/command-server.js

@@ -0,0 +1,4 @@
+var I=Object.defineProperty;var s=(m,d)=>I(m,"name",{value:d,configurable:!0});import{withActCosts as H}from"./act-cost.js";import{mkdtempSync as O,writeFileSync as P,rmSync as N,realpathSync as w}from"node:fs";import{join as x}from"node:path";import{nativeHostInstrument as T}from"./native-receiver.js";import{withHostCall as z}from"./call-context.js";import{withActHost as G,underTheLock as J}from"../land/act.js";import{storeOf as M}from"../land/ledger.js";import{withNativeSigning as Z}from"./signing.js";import{BoundRefusal as c,refusalRecord as W}from"./refusals.js";import{readFileSync as _}from"node:fs";import{sha256 as $}from"./hash.js";import{nativePlaceState as D}from"./native-place-state.js";function dt(m){let d,o,E=!1,a;const h=s(t=>{process.connected&&process.send(t)},"send"),f=s(()=>{E=!0,o?.abort.abort(),a?.reject(new c("host/cancelled","REFUSE\xB7host/cancelled")),o||(d&&N(d.scratch,{recursive:!0,force:!0}),process.removeListener("message",v),process.connected&&process.disconnect())},"stop"),v=s(t=>{if(t?.kind==="configure"&&!d){d={place:w(t.place),scratch:w(t.scratch),limits:t.limits,instrumentName:t.instrumentName,instrumentRoot:w(t.instrumentRoot),instrumentEntry:w(process.argv[1])},h({kind:"ready",pid:process.pid});return}if(t?.kind==="close"){f();return}if(t?.kind==="cancel"&&o&&o.id===t.id){o.abort.abort(),a?.reject(new c("host/cancelled","REFUSE\xB7host/cancelled"));return}if(t?.kind==="signed"&&o?.id===t.id&&a){const u=a;if(a=void 0,t.error){const l=["host/signer-mismatch","host/unbound-signer"].includes(t.error.code)?t.error.code:"host-port/failed";u.reject(new c(l,"REFUSE\xB7"+l))}else u.resolve(t.records);return}if(t?.kind!=="request"||!d||E)return;if(o){h({kind:"result",id:t.id,status:1,stdout:"",stderr:`REFUSE\xB7host/busy
+`});return}const n=d,S=new AbortController,g=t.id,A=s(async()=>{let u,l="",p="",F=0,k=1;const U=s((e,i)=>{if(F+=Buffer.byteLength(i),F>n.limits.responseBytes)throw new c("host/budget","REFUSE\xB7host/budget");e==="out"?l+=i:p+=i},"output");try{const e=t.command;if(Buffer.byteLength(JSON.stringify(e))>n.limits.requestBytes||!["fold","sign","land"].includes(e.verb)||!Array.isArray(e.args)||e.args.some(r=>typeof r!="string"))throw new c("host/context","REFUSE\xB7host/context");const i=D(n.place);if(i==="birth"&&e.verb!=="land")throw new c("host/foundation-required","REFUSE\xB7host/foundation-required");u=O(x(n.scratch,"request-"));const b=new Map;for(const r of e.inputs??[]){if(!/^[a-zA-Z0-9][a-zA-Z0-9._-]*$/.test(r.name)||b.has(r.name)||typeof r.text!="string")throw new c("host/context","REFUSE\xB7host/context");const y=x(u,r.name);P(y,r.text,{mode:384,flag:"wx"}),b.set(r.name,y)}const B=e.args.map(r=>r.startsWith("@input/")?b.get(r.slice(7))??(()=>{throw new c("host/context","REFUSE\xB7host/context")})():r),R=[e.verb,n.place,...B],L=t.signer?{...t.signer,signal:S.signal,sign:s(async r=>new Promise((y,C)=>{a={resolve:y,reject:C},h({kind:"sign",id:g,lot:r})}),"sign")}:void 0,j=T(n.instrumentRoot,n.instrumentEntry).runtime;k=await z({instrumentName:n.instrumentName,runtime:j,freshBytes:!0,arguments:R,output:U},()=>G({name:n.instrumentName,report:s(r=>U("error",r),"report"),signal:S.signal},()=>Z(L,()=>e.verb==="land"&&i==="admitted"?J(M(n.place),"host land",()=>m(R)):m(R))))}catch(e){if(p+=(e instanceof Error?e.message:"REFUSE\xB7host/failed")+`
+`,e instanceof c){let i="";try{i=_(new URL("../../docs/contracts/refusals.bound",import.meta.url),"utf8")}catch{}p+=JSON.stringify(W(e,i,$))+`
+`}}finally{a=void 0,u&&N(u,{recursive:!0,force:!0})}h({kind:"result",id:g,status:k,stdout:l,stderr:p})},"run"),q=Promise.resolve().then(()=>H(A)).finally(()=>{o=void 0,E&&f()});o={id:g,abort:S,done:q}},"receive");process.on("message",v),process.once("disconnect",f),process.once("SIGTERM",f),process.once("SIGINT",f)}s(dt,"serveNativeCommands");export{dt as serveNativeCommands};

package/dist/host/commit-result.js

@@ -1,5 +1 @@
-import { BoundRefusal } from "./refusals.js";
-/** Visibility may precede a failed publication response; never asserts rollback. */
-export class ActCommitUnknown extends BoundRefusal {
-    constructor(identity, cause) { super('host/commit-unknown', `REFUSE·act publication uncertain · ${cause instanceof Error ? cause.message : 'storage failure'}`); this.identity = identity; }
-}
+var e=Object.defineProperty;var r=(n,t)=>e(n,"name",{value:t,configurable:!0});import{BoundRefusal as i}from"./refusals.js";class c extends i{static{r(this,"ActCommitUnknown")}constructor(t,o){super("host/commit-unknown",`REFUSE\xB7act publication uncertain \xB7 ${o instanceof Error?o.message:"storage failure"}`),this.identity=t}}export{c as ActCommitUnknown};

package/dist/host/content-needed.js

@@ -1,8 +1 @@
-/** The synchronous host names unavailable content; the enclosing fold resolves exactly that request. */
-export class ContentNeeded extends Error {
-    constructor(digest, why = `REFUSE·pin ${digest} content unavailable · not laid`) {
-        super(why);
-        this.digest = digest;
-        this.name = 'ContentNeeded';
-    }
-}
+var r=Object.defineProperty;var n=(t,e)=>r(t,"name",{value:e,configurable:!0});class a extends Error{static{n(this,"ContentNeeded")}constructor(e,o=`REFUSE\xB7pin ${e} content unavailable \xB7 not laid`){super(o),this.digest=e,this.name="ContentNeeded"}}export{a as ContentNeeded};