@lapxo/bound 0.2.4 → 0.2.6

package/dist/host/lifetime.js

@@ -1,79 +1 @@
-import { spawn } from 'node:child_process';
-const deadline = BigInt(process.argv[2] ?? '0'), responseBytes = Number(process.argv[3]);
-if (deadline <= 0n || !Number.isSafeInteger(responseBytes) || responseBytes <= 0)
-    throw Error('REFUSE·reader invalid process limits');
-let child, finished = false, failure, size = 0;
-const stdout = [], stderr = [];
-const grouped = process.platform !== 'win32';
-const cancel = () => { if (child?.pid === undefined)
-    return; try {
-    if (grouped)
-        process.kill(-child.pid, 'SIGKILL');
-    else
-        child.kill('SIGKILL');
-}
-catch { } };
-const finish = (status, signal) => {
-    if (finished)
-        return;
-    finished = true;
-    clearTimeout(timer);
-    cancel();
-    child?.stdin?.destroy();
-    child?.stdout?.destroy();
-    child?.stderr?.destroy();
-    process.stdin.destroy();
-    const bytes = failure ? Buffer.alloc(0) : Buffer.concat(stdout);
-    const result = { stdout: bytes.toString('utf8'), stdoutBytes: bytes.toString('base64'), stderr: Buffer.concat(stderr).toString('utf8'), status, signal, ...(failure ? { failure } : {}) };
-    process.stdout.write(JSON.stringify(result));
-};
-const refuse = (why) => { if (failure && why === 'response exceeds declared byte bound' && !failure.includes(why))
-    failure += ' · ' + why;
-else
-    failure ?? (failure = why); finish(null, 'SIGKILL'); };
-// A closed input pipe can precede the queued stderr/close events of an early
-// rejecting child. Cancel immediately, but drain only until the SAME deadline.
-const inputFailed = (why) => { if (finished)
-    return; failure ?? (failure = why); stdout.length = 0; cancel(); child?.stdin?.destroy(); process.stdin.destroy(); if (process.hrtime.bigint() >= deadline)
-    finish(null, 'SIGKILL'); };
-const remaining = Number(deadline - process.hrtime.bigint()) / 1e6;
-const timer = setTimeout(() => refuse('declared timeout exhausted'), Math.max(0, remaining));
-process.once('SIGTERM', () => refuse('interrupted'));
-try {
-    if (remaining <= 0)
-        refuse('declared timeout exhausted');
-    const chunks = [];
-    for await (const chunk of process.stdin) {
-        if (finished)
-            break;
-        chunks.push(Buffer.from(chunk));
-    }
-    if (!finished) {
-        const request = JSON.parse(Buffer.concat(chunks).toString('utf8'));
-        if (request.limits.responseBytes !== responseBytes || !Number.isSafeInteger(request.limits.timeoutMs) || request.limits.timeoutMs <= 0)
-            throw Error('invalid process limits');
-        // Parsing is synchronous; recheck before spawning even if the timer has not
-        // had a turn to run. An expired handoff must never start the command.
-        if (process.hrtime.bigint() >= deadline) {
-            refuse('declared timeout exhausted');
-        }
-        else {
-            child = spawn(request.command, [...request.args], { cwd: request.cwd, env: request.env, detached: grouped, stdio: ['pipe', 'pipe', 'pipe'] });
-            const receive = (items, bytes) => { if (finished)
-                return; size += bytes.length; if (size > responseBytes)
-                refuse('response exceeds declared byte bound');
-            else if (!failure || items === stderr)
-                items.push(bytes); };
-            child.stdout.on('data', (b) => receive(stdout, b));
-            child.stderr.on('data', (b) => receive(stderr, b));
-            child.stdin.on('error', error => inputFailed('input failed: ' + error.message));
-            child.once('error', error => refuse(error.message));
-            child.once('close', finish);
-            child.stdin.end(request.input);
-        }
-    }
-}
-catch {
-    if (!finished)
-        refuse('input unavailable or malformed');
-}
+var I=Object.defineProperty;var d=(s,e)=>I(s,"name",{value:e,configurable:!0});import{spawn as y}from"node:child_process";const u=BigInt(process.argv[2]??"0"),a=Number(process.argv[3]);if(u<=0n||!Number.isSafeInteger(a)||a<=0)throw Error("REFUSE\xB7reader invalid process limits");let t,o=!1,i,g=0;const f=[],l=[],h=process.platform!=="win32",b=d(()=>{if(t?.pid!==void 0)try{h?process.kill(-t.pid,"SIGKILL"):t.kill("SIGKILL")}catch{}},"cancel"),p=d((s,e)=>{if(o)return;o=!0,clearTimeout(v),b(),t?.stdin?.destroy(),t?.stdout?.destroy(),t?.stderr?.destroy(),process.stdin.destroy();const c=i?Buffer.alloc(0):Buffer.concat(f),r={stdout:c.toString("utf8"),stdoutBytes:c.toString("base64"),stderr:Buffer.concat(l).toString("utf8"),status:s,signal:e,...i?{failure:i}:{}};process.stdout.write(JSON.stringify(r))},"finish"),n=d(s=>{i&&s==="response exceeds declared byte bound"&&!i.includes(s)?i+=" \xB7 "+s:i??(i=s),p(null,"SIGKILL")},"refuse"),B=d(s=>{o||(i??(i=s),f.length=0,b(),t?.stdin?.destroy(),process.stdin.destroy(),process.hrtime.bigint()>=u&&p(null,"SIGKILL"))},"inputFailed"),S=Number(u-process.hrtime.bigint())/1e6,v=setTimeout(()=>n("declared timeout exhausted"),Math.max(0,S));process.once("SIGTERM",()=>n("interrupted"));try{S<=0&&n("declared timeout exhausted");const s=[];for await(const e of process.stdin){if(o)break;s.push(Buffer.from(e))}if(!o){const e=JSON.parse(Buffer.concat(s).toString("utf8"));if(e.limits.responseBytes!==a||!Number.isSafeInteger(e.limits.timeoutMs)||e.limits.timeoutMs<=0)throw Error("invalid process limits");if(process.hrtime.bigint()>=u)n("declared timeout exhausted");else{t=y(e.command,[...e.args],{cwd:e.cwd,env:e.env,detached:h,stdio:["pipe","pipe","pipe"]});const c=d((r,m)=>{o||(g+=m.length,g>a?n("response exceeds declared byte bound"):(!i||r===l)&&r.push(m))},"receive");t.stdout.on("data",r=>c(f,r)),t.stderr.on("data",r=>c(l,r)),t.stdin.on("error",r=>B("input failed: "+r.message)),t.once("error",r=>n(r.message)),t.once("close",p),t.stdin.end(e.input)}}}catch{o||n("input unavailable or malformed")}

package/dist/host/located.js

@@ -1,105 +1,6 @@
-var __rewriteRelativeImportExtension = (this && this.__rewriteRelativeImportExtension) || function (path, preserveJsx) {
-    if (typeof path === "string" && /^\.\.?\//.test(path)) {
-        return path.replace(/\.(tsx)$|((?:\.d)?)((?:\.[^./]+?)?)\.([cm]?)ts$/i, function (m, tsx, d, ext, cm) {
-            return tsx ? preserveJsx ? ".jsx" : ".js" : d && (!ext || !cm) ? m : (d + ext + "." + cm.toLowerCase() + "js");
-        });
-    }
-    return path;
-};
-import { readFileSync } from 'node:fs';
-import { join } from 'node:path';
-import { pathToFileURL } from 'node:url';
-import { pinExport, provide } from "./provide.js";
-const wanted = (role) => role === 'reader' ? ['observe', 'run'] : [role];
-const foreign = (role) => ['render', 'receipt', 'observe', 'run'].filter((name) => !wanted(role).includes(name));
-const isFn = (module, name) => typeof module[name] === 'function';
-const text = (error) => (error instanceof Error ? error.message : String(error)).replace(/\s+/g, ' ').trim();
-/**
- * Wire and capsule of the world, from `dep/topos` (or the lock's `uses/topos` pin). The host never spells where that
- * package lies.
- */
-const sdk = async () => {
-    provide();
-    const [wireAt, capsuleAt] = [pinExport('topos', './wire'), pinExport('topos', './capsule')];
-    if (!wireAt || !capsuleAt)
-        throw new Error('REFUSE·pin dep/topos names no wire or capsule');
-    const [wire, capsule] = await Promise.all([import(__rewriteRelativeImportExtension(pathToFileURL(wireAt).href)), import(__rewriteRelativeImportExtension(pathToFileURL(capsuleAt).href))]);
-    return {
-        CAPSULE: String(wire['CAPSULE'] ?? ''),
-        PROTOCOL: String(wire['PROTOCOL'] ?? ''),
-        parse: wire['parse'],
-        declarationOf: capsule['declarationOf'],
-        readers: capsule['readers'],
-        receiptShell: capsule['receiptShell'],
-        shell: capsule['shell'],
-    };
-};
-/**
- * The host loads a world from its lock: the lock read once, each region imported from its one file by name and role into
- * the shell of its kind. A region that fails is one line on stderr and is left out; the regions that loaded still form
- * the shell. A world with no region of a kind has no shell of it. `load` is the host's child entry, the same load with
- * its places read from the arguments the host spawned it with.
- */
-/** A capsule that ships one render module: the host calls it per region and hands it the lines. The module does not read. */
-const pagesOf = async (root, file) => {
-    const { CAPSULE, PROTOCOL, declarationOf, shell } = await sdk();
-    const lines = readFileSync(join(root, CAPSULE), 'utf8').split('\n').filter((line) => line.startsWith(PROTOCOL));
-    const { regions } = declarationOf(lines);
-    const module = await import(__rewriteRelativeImportExtension(pathToFileURL(join(root, file)).href));
-    const render = module['render'] ?? module['default']?.['render'];
-    if (typeof render !== 'function')
-        return {};
-    const held = Object.fromEntries(Object.entries(regions).map(([name, reads]) => [name, {
-            reads,
-            region: (asked) => render({ ...asked, region: name }),
-        }]));
-    return held && Object.keys(held).length ? { render: shell(held) } : {};
-};
-export const locate = async (root, dir, ext) => {
-    if (ext === 'render')
-        return pagesOf(root, dir);
-    const { CAPSULE, PROTOCOL, parse, declarationOf, readers, receiptShell, shell } = await sdk();
-    const lines = readFileSync(join(root, CAPSULE), 'utf8').split('\n').filter((line) => line.startsWith(PROTOCOL));
-    const field = (line, name) => ((got) => (got.kind === 'fact' ? got.value.fields[name] ?? '' : ''))(parse(line));
-    const { regions, writes } = declarationOf(lines);
-    const reader = new Set(lines.filter((line) => field(line, 'measure') === 'writes').map((line) => field(line, 'scope').slice('region/'.length)));
-    const kind = (name) => (reader.has(name) ? 'reader' : writes[name] ?? '');
-    const region = async (name, reads, role) => {
-        let module;
-        try {
-            module = await import(__rewriteRelativeImportExtension(pathToFileURL(join(root, dir, `${name}${ext}`)).href));
-        }
-        catch (error) {
-            process.stderr.write(`LOAD     ${name} · module error · ${text(error)}\n`);
-            return undefined;
-        }
-        const has = wanted(role).filter((key) => isFn(module, key));
-        const exported = foreign(role).filter((key) => isFn(module, key));
-        if (!has.length && exported.length) {
-            process.stderr.write(`LOAD     ${name} · role mismatch · ${role} exports ${exported.join('|')}\n`);
-            return undefined;
-        }
-        if (!has.length) {
-            process.stderr.write(`LOAD     ${name} · missing export · ${wanted(role)[0]}\n`);
-            return undefined;
-        }
-        const picked = role === 'reader' ? { observe: module['observe'], run: module['run'] } : { region: module[role] };
-        return [name, { reads, ...picked }];
-    };
-    const loaded = async (role) => {
-        const held = [];
-        for (const [name, reads] of Object.entries(regions)) {
-            if (kind(name) !== role)
-                continue;
-            const row = await region(name, reads, role);
-            if (row)
-                held.push(row);
-        }
-        return held.length ? Object.fromEntries(held) : undefined;
-    };
-    const render = await loaded('render');
-    const receipt = await loaded('receipt');
-    const reading = await loaded('reader');
-    return { render: render && shell(render), receipt: receipt && receiptShell(receipt), ...(reading ? readers(reading) : {}) };
-};
-export const load = () => locate(process.argv[3] ?? '', process.argv[4] ?? '', process.argv[5] ?? '');
+var W=Object.defineProperty;var n=(e,t)=>W(e,"name",{value:t,configurable:!0});var w=function(e,t){return typeof e=="string"&&/^\.\.?\//.test(e)?e.replace(/\.(tsx)$|((?:\.d)?)((?:\.[^./]+?)?)\.([cm]?)ts$/i,function(i,o,p,d,f){return o?t?".jsx":".js":p&&(!d||!f)?i:p+d+"."+f.toLowerCase()+"js"}):e};import{hostOutput as j}from"./call-context.js";import{readFileSync as R}from"node:fs";import{join as E}from"node:path";import{pathToFileURL as L}from"node:url";import{pinExport as U,provide as q}from"./provide.js";const b=n(e=>e==="reader"?["observe","run"]:[e],"wanted"),z=n(e=>["render","receipt","observe","run"].filter(t=>!b(e).includes(t)),"foreign"),k=n((e,t)=>typeof e[t]=="function","isFn"),B=n(e=>(e instanceof Error?e.message:String(e)).replace(/\s+/g," ").trim(),"text"),T=n(async()=>{q();const[e,t]=[U("topos","./wire"),U("topos","./capsule")];if(!e||!t)throw new Error("REFUSE\xB7pin dep/topos names no wire or capsule");const[i,o]=await Promise.all([import(w(L(e).href)),import(w(L(t).href))]);return{CAPSULE:String(i.CAPSULE??""),PROTOCOL:String(i.PROTOCOL??""),parse:i.parse,declarationOf:o.declarationOf,readers:o.readers,receiptShell:o.receiptShell,shell:o.shell}},"sdk"),G=n(async(e,t)=>{const{CAPSULE:i,PROTOCOL:o,declarationOf:p,shell:d}=await T(),f=R(E(e,i),"utf8").split(`
+`).filter(a=>a.startsWith(o)),{regions:S}=p(f),O=await import(w(L(E(e,t)).href)),g=O.render??O.default?.render;if(typeof g!="function")return{};const u=Object.fromEntries(Object.entries(S).map(([a,v])=>[a,{reads:v,region:n(y=>g({...y,region:a}),"region")}]));return u&&Object.keys(u).length?{render:d(u)}:{}},"pagesOf"),H=n(async(e,t,i)=>{if(i==="render")return G(e,t);const{CAPSULE:o,PROTOCOL:p,parse:d,declarationOf:f,readers:S,receiptShell:O,shell:g}=await T(),u=R(E(e,o),"utf8").split(`
+`).filter(r=>r.startsWith(p)),a=n((r,l)=>(s=>s.kind==="fact"?s.value.fields[l]??"":"")(d(r)),"field"),{regions:v,writes:y}=f(u),F=new Set(u.filter(r=>a(r,"measure")==="writes").map(r=>a(r,"scope").slice(7))),_=n(r=>F.has(r)?"reader":y[r]??"","kind"),D=n(async(r,l,s)=>{let c;try{c=await import(w(L(E(e,t,`${r}${i}`)).href))}catch(m){j("error",`LOAD     ${r} \xB7 module error \xB7 ${B(m)}
+`);return}const h=b(s).filter(m=>k(c,m)),P=z(s).filter(m=>k(c,m));if(!h.length&&P.length){j("error",`LOAD     ${r} \xB7 role mismatch \xB7 ${s} exports ${P.join("|")}
+`);return}if(!h.length){j("error",`LOAD     ${r} \xB7 missing export \xB7 ${b(s)[0]}
+`);return}const I=s==="reader"?{observe:c.observe,run:c.run}:{region:c[s]};return[r,{reads:l,...I}]},"region"),$=n(async r=>{const l=[];for(const[s,c]of Object.entries(v)){if(_(s)!==r)continue;const h=await D(s,c,r);h&&l.push(h)}return l.length?Object.fromEntries(l):void 0},"loaded"),x=await $("render"),A=await $("receipt"),C=await $("reader");return{render:x&&g(x),receipt:A&&O(A),...C?S(C):{}}},"locate"),X=n(()=>H(process.argv[3]??"",process.argv[4]??"",process.argv[5]??""),"load");export{X as load,H as locate};

package/dist/host/native/authority-card-view.js

@@ -0,0 +1,5 @@
+var v=Object.defineProperty;var u=(r,a)=>v(r,"name",{value:a,configurable:!0});import{authenticatedStanding as S}from"../admitted-place.js";import{withoutEffects as F}from"../read-only.js";import{withHostCall as R}from"../call-context.js";import{sha256 as m,isSha256 as x}from"../hash.js";import{BoundRefusal as e}from"../refusals.js";import{fieldOf as o}from"../../fold/claims.js";import{storeOf as A,blobAt as C}from"../../land/ledger.js";import{readBoundedFile as N}from"./bounded-file.js";import{parseNativeAuthorityCardRequest as j,prepareNativeAuthorityCard as B}from"./authority-card.js";async function K(r,a,i){const f={instrumentName:a.name,runtime:structuredClone(a.runtime),output:u(()=>{},"output")},w=R(f,()=>F(()=>{if(typeof i!="string"||!i||/[\s@]/.test(i))throw new e("authority-card/selection","REFUSE\xB7authority-card/selection requires an explicit request scope");const g=S(r),E=u((t,n,h)=>{const q=g.filter(s=>o(s,"scope")===t&&o(s,"measure")===n&&o(s,"role")==="writes"&&o(s,"form")===h&&o(s,"value")!=="withdraw");if(q.length!==1)throw new e("authority-card/selection","REFUSE\xB7authority-card/selection requires one admitted "+n+" at "+t);return o(q[0],"value")},"select"),c=E(i,"authority-card-request","alphabet");if(!x(c))throw new e("authority-card/selection","REFUSE\xB7authority-card/selection requires a SHA-256 request");const b=u(t=>{const n=/^0\.\.([1-9][0-9]*)$/.exec(E(i+"/"+t,t,"interval")),h=Number(n?.[1]);if(!n||!Number.isSafeInteger(h))throw new e("authority-card/budget","REFUSE\xB7authority-card/budget requires a finite "+t+" bound");return h},"limit"),d={bytes:b("bytes"),items:b("items")};let y;try{y=N(C(A(r),c),d.bytes,i)}catch(t){throw new e("authority-card/content","REFUSE\xB7authority-card/content "+(t instanceof Error?t.message:"request bytes unavailable"))}if(m(y)!==c)throw new e("authority-card/integrity","REFUSE\xB7authority-card/integrity request bytes differ from admitted selection");let p;try{p=new TextDecoder("utf-8",{fatal:!0}).decode(y)}catch{throw new e("authority-card/integrity","REFUSE\xB7authority-card/integrity request is not UTF-8")}const l=j(p,c,d);if(l.limits.bytes>d.bytes||l.limits.items>d.items)throw new e("authority-card/budget","REFUSE\xB7authority-card/budget request exceeds admitted selector limits");return{request:l,standing:m(g.join(`
+`)+`
+`)}})),U=await B({...w.request,root:r,instrument:a});if(R(f,()=>F(()=>m(S(r).join(`
+`)+`
+`)))!==w.standing)throw new e("authority-card/selection","REFUSE\xB7authority-card/selection changed during preflight");return U}u(K,"nativeAuthorityCardView");export{K as nativeAuthorityCardView};

package/dist/host/native/authority-card.js

@@ -0,0 +1 @@
+var me=Object.defineProperty;var h=(i,y)=>me(i,"name",{value:y,configurable:!0});import{readFileSync as P,realpathSync as Q}from"node:fs";import{join as V}from"node:path";import{library14_authorityAtEpoch as le,library14_parse as pe,library14_LOCK as Y}from"../../vendor/runtime.js";import{library5_encodeAuthorityCard as ge,library5_authorityCardStatement as ye,library5_authorityCardAnswer as ke}from"../../vendor/runtime.js";import{admissionHistoryAt as Z,admissionAnchor as be}from"../../fold/admission-history.js";import{projectAuthenticatedStanding as ve}from"../standing-projection.js";import{authorityFor as we}from"../../fold/signers.js";import{ownRecordAdmitted as Ae,appliedHistoryIn as x}from"../../fold/signed.js";import{signatureEraOf as Se}from"../signature-era.js";import{epochOf as ee,localActLines as Ee}from"../../cli/owner.js";import{fieldOf as k,foldClaims as Ce,isConfig as Ne,sayingOf as te}from"../../fold/claims.js";import{admissionChecks as qe,admissionWideningChecks as Oe,configurationAdmissionGuards as Ie,configurationEpochCheck as je,admissionEvidenceResult as ze}from"../../cli/accept.js";import{wordOf as re}from"../../fold/wire.js";import{isCeiling as ie}from"../../fold/configures.js";import{installedReferenceContracts as Re}from"../reference-contracts.js";import{placesIn as _e}from"../../fold/places.js";import{sha256 as b}from"../hash.js";import{underRootAuthority as Je}from"../../land/act.js";import{storeOf as se}from"../../land/ledger.js";import{withContentStore as Fe}from"../content-store.js";import{withoutEffects as Le}from"../read-only.js";import{BoundRefusal as oe}from"../refusals.js";import{withHostCall as We}from"../call-context.js";const m=h(i=>b(JSON.stringify(i)),"hash"),u=h(i=>{throw new oe("authority-preflight/"+i,"REFUSE\xB7authority-preflight/"+i)},"fail"),Be=h(i=>m(["native-authority-request/1",i.kind,i.records]),"nativeAuthorityRequestIdentity");async function Ge(i,y){try{const n=Q(i.root);return await We({instrumentName:i.instrument.name,runtime:i.instrument.runtime,output:h(()=>{},"output")},()=>Fe(se(n),()=>Je(se(n),"authority card preflight",()=>Le(()=>{const{place:e,key:f,clock:r,limits:d}=i,a=Q(i.root);e!=="."&&(!e||e.startsWith("/")||e.includes("\\")||e.split("/").some(t=>!t||t==="."||t===".."))&&u("place"),e!=="."&&!_e(a).includes(e)&&u("place"),(!Number.isSafeInteger(r.now)||!Number.isSafeInteger(i.authorityEpoch)||!Number.isSafeInteger(d.bytes)||d.bytes<1||!Number.isSafeInteger(d.items)||d.items<1)&&u("context"),i.actions.length>d.items&&u("budget");const l=Z(a,Number.MAX_SAFE_INTEGER),q=be(a);(l.length+i.actions.reduce((t,o)=>t+o.records.length,0)>d.items||Buffer.byteLength(JSON.stringify([l,i.actions]))>d.bytes)&&u("budget"),ee(l)!==i.authorityEpoch&&u("stale-epoch");const p=ve(l,q),R=Se(p).admitted,w=we(l,q,R),O=w.admitted.find(t=>t.id===f),_=b(P(V(a,e==="."?"":e,Y))),A=i.actions.map(t=>{const o=Be(t),c=[],M=[];if(t.kind!=="record-coverage"&&t.kind!=="admission")return{request:o,decision:"deny",evidence:[{check:"unsupported-action",kind:t.kind}],needs:[]};if(!t.records.length)return{request:o,decision:"ask",evidence:[],needs:["authority-preflight/records"]};let S=!1;for(const s of t.records){const g=pe(s);if(g.kind!=="fact"){S=!0,c.push({check:"wire-parse",line:s,result:g});continue}const U=e==="."?g.value.fields.scope??"":`${re(p,"families","region")}/${e}/${g.value.fields.scope??""}`,X=O?le({...g.value.fields,by:f},O,i.authorityEpoch,U,"authority"):{kind:"refuse",why:"requested key is not admitted"};if(c.push({check:"authorityAtEpoch",line:s,scope:U,result:X}),X.kind!=="admitted"&&(S=!0),g.value.fields.sig){const D=e==="."?w.of(s).kind==="admitted":Ae(s,e,re(p,"families","region"),w.admitted,R);c.push({check:"authenticated-record",line:s,admitted:D}),(!D||g.value.fields.by!==f)&&(S=!0)}}if(S)return{request:o,decision:"deny",evidence:c,needs:M};const I=e==="."?p:Ce(x(a,e)).standing,E=Oe(a,t.records,I,p,e);if(c.push({check:"admissionWideningChecks",result:E,standing:m(I)}),E.kind==="ask")return{request:o,decision:"ask",evidence:c,needs:E.needs};if(E.kind==="refuse")return{request:o,decision:"deny",evidence:c,needs:[]};if(t.kind==="record-coverage")return{request:o,decision:"allow",evidence:c,needs:M};if(t.records.some(s=>!Ne(s)))return{request:o,decision:"deny",evidence:[...c,{check:"configuration-only",result:"unsupported-object-action"}],needs:[]};const j=t.records.filter(s=>!k(s,"sig"));if(j.length)return{request:o,decision:"ask",evidence:[...c,{check:"signature",records:j}],needs:j.map(s=>"signature:"+k(s,"scope"))};const ue=new Set((e==="."?l:x(a,e)).map(te)),H=ee(Ee(a,e==="."?[]:[e]))+1,$=je(t.records,H,s=>ue.has(te(s)));if($.length)return{request:o,decision:"deny",evidence:[...c,{check:"prospective-epoch",records:$,expected:H}],needs:[]};const C=Ie(a,t.records,e==="."?[]:[e]);if(c.push({check:"configurationAdmissionGuards",result:C}),C.kind==="refuse")return{request:o,decision:"deny",evidence:c,needs:[]};const N=qe(a,C.ownership.ledger,p);if(c.push({check:"admissionChecks",result:N}),N.kind==="ask")return{request:o,decision:"ask",evidence:c,needs:N.needs};if(N.kind==="refuse")return{request:o,decision:"deny",evidence:c,needs:[]};const v=ze(a,e==="."?C.ownership.ledger:t.records,I,r.now);if(v.kind==="refuse"){c.push({check:"admissionEvidence",result:v});const s=v.code==="admission/inert"||v.code==="admission/evidence";return{request:o,decision:s?"ask":"deny",evidence:c,needs:s?t.records.filter(ie).length?t.records.filter(ie).map(g=>"reading:"+k(g,"scope")):["admission-evidence:"+o]:[]}}const{coordinates:fe,judged:K,fold:z}=v.evidence,he=K.map(s=>s.kind==="judged"?{...s,started:void 0}:s);c.push({check:"admissionEvidence",coordinates:fe,judged:he,fold:{standing:z.standing,observed:z.observed,own:z.own}});const T=K.filter(s=>s.kind==="owed");return{request:o,decision:T.length?"ask":"allow",evidence:c,needs:T.map(s=>"demand:"+s.scope)}}),J=JSON.parse(JSON.stringify(A,(t,o)=>o instanceof Map?[...o]:o)),ne=m([q,w.admitted,l]),F=m(["native-authority-coverage/1",a,e,f,O??null,A.map(t=>t.request)]),ce=p.filter(t=>k(t,"scope").startsWith("keys/")),de=l.filter(t=>k(t,"scope").startsWith("keys/")&&k(t,"value")==="withdraw"),L=Re(),W={place:e,snapshot:_,key:f,authority:ne,coverage:F,policy:m(p),budget:m(d),catalog:L.refusals,standingContract:L.standing,grants:ce.map(b),retirements:de.map(b),demands:p.filter(t=>k(t,"role")==="demands").map(b),horizon:i.horizon,issuedAt:y??r.now,actions:A.filter(t=>t.decision!=="open").map(t=>({request:t.request,decision:t.decision})),evidence:m(J)};(m(Z(a,Number.MAX_SAFE_INTEGER))!==m(l)||b(P(V(a,e==="."?"":e,Y)))!==_)&&u("context-changed");const B=ge(W,d),ae=[...new Set(A.flatMap(t=>t.needs))],G={card:W,line:B,identity:m([a,e,F,B]),judgments:J,needs:ae};return Buffer.byteLength(JSON.stringify(G))>d.bytes&&u("budget"),{kind:"fact",value:G}}))))}catch(n){return{kind:"refuse",code:n instanceof oe?n.code:"authority-preflight/failed",diagnostic:n instanceof Error?n.message:"REFUSE\xB7authority preflight failed"}}}h(Ge,"prepareNativeAuthorityCard");async function ut(i,y,n){const e=await Ge(n,i.issuedAt);if(e.kind==="refuse")return e.code==="authority-preflight/stale-epoch"||e.code==="authority-preflight/context-changed"?{status:"refused",code:"card-stale",next:"refresh-card"}:e;const f=e.value,r=f.card;return ke(i,y,{place:r.place,snapshot:r.snapshot,key:r.key,authority:r.authority,coverage:r.coverage,policy:r.policy,budget:r.budget,catalog:r.catalog,standingContract:r.standingContract,clock:n.clock,verifiesJudgment:h((d,a)=>d===ye(r,n.limits)&&a===r.evidence,"verifiesJudgment")},n.limits)}h(ut,"answerNativeAuthorityCard");function ft(i,y,n){(!Number.isSafeInteger(n.bytes)||n.bytes<1||Buffer.byteLength(i)>n.bytes||b(i)!==y)&&u("request-integrity");const e=JSON.parse(i);(!e||Object.keys(e).sort().join(",")!=="actions,authorityEpoch,clock,horizon,key,limits,place,profile"||e.profile!=="native-authority-card-request/1"||!Array.isArray(e.actions)||e.actions.length>n.items)&&u("request-format");const f=h((r,d)=>r!==null&&typeof r=="object"&&!Array.isArray(r)&&Object.keys(r).sort().join(",")===d,"exact");(!f(e.clock,"name,now,unit")||!f(e.horizon,"clock,from,through,unit")||!f(e.limits,"bytes,items"))&&u("request-context");for(const r of[n.items,e.limits.bytes,e.limits.items])(!Number.isSafeInteger(r)||r<1)&&u("request-budget");(e.limits.bytes>n.bytes||e.limits.items>n.items||!Number.isSafeInteger(e.authorityEpoch)||e.authorityEpoch<0||!Number.isSafeInteger(e.clock.now)||!Number.isSafeInteger(e.horizon.from)||!Number.isSafeInteger(e.horizon.through)||e.horizon.from>e.horizon.through)&&u("request-context");for(const r of[e.place,e.key,e.clock.name,e.clock.unit,e.horizon.clock,e.horizon.unit])(typeof r!="string"||!r||/[\u0000-\u0020\u007f]/.test(r))&&u("request-context");return(e.clock.name!==e.horizon.clock||e.clock.unit!==e.horizon.unit||e.clock.now<e.horizon.from||e.clock.now>e.horizon.through)&&u("request-clock"),e.actions.some(r=>!r||Object.keys(r).sort().join(",")!=="kind,records"||!["record-coverage","admission"].includes(r.kind)||!Array.isArray(r.records)||r.records.some(d=>typeof d!="string"))&&u("request-action"),e.actions.reduce((r,d)=>r+d.records.length,0)>e.limits.items&&u("request-budget"),structuredClone(e)}h(ft,"parseNativeAuthorityCardRequest");export{ut as answerNativeAuthorityCard,Be as nativeAuthorityRequestIdentity,ft as parseNativeAuthorityCardRequest,Ge as prepareNativeAuthorityCard};

package/dist/host/native/bounded-file.js

@@ -1,32 +1 @@
-import fs from 'node:fs';
-/** The opened descriptor is bounded before allocation/read. Growth after fstat
- * is detected with one sentinel byte; no oversized buffer reaches decode/hash.
- */
-export function readBoundedFile(path, remaining, coordinate) {
-    if (!Number.isSafeInteger(remaining) || remaining < 0)
-        throw Error('REFUSE·native file missing byte budget ' + coordinate);
-    const fd = fs.openSync(path, 'r');
-    try {
-        const stat = fs.fstatSync(fd);
-        if (!stat.isFile() || !Number.isSafeInteger(stat.size) || stat.size > remaining)
-            throw Error('REFUSE·native file byte budget before read ' + coordinate);
-        const bytes = Buffer.alloc(stat.size);
-        let offset = 0;
-        while (offset < bytes.length) {
-            const count = fs.readSync(fd, bytes, offset, bytes.length - offset, null);
-            if (!count)
-                throw Error('REFUSE·native file changed during read ' + coordinate);
-            offset += count;
-        }
-        if (fs.readSync(fd, Buffer.alloc(1), 0, 1, null) !== 0)
-            throw Error('REFUSE·native file grew during read ' + coordinate);
-        return bytes;
-    }
-    finally {
-        fs.closeSync(fd);
-    }
-}
-export function readBoundedBatch(paths, budget) {
-    let bytes = 0;
-    return paths.map(file => { const data = readBoundedFile(file.path, budget - bytes, file.coordinate); bytes += data.length; return data; });
-}
+var u=Object.defineProperty;var a=(o,e)=>u(o,"name",{value:e,configurable:!0});import f from"node:fs";function c(o,e,t){if(!Number.isSafeInteger(e)||e<0)throw Error("REFUSE\xB7native file missing byte budget "+t);const r=f.openSync(o,"r");try{const n=f.fstatSync(r);if(!n.isFile()||!Number.isSafeInteger(n.size)||n.size>e)throw Error("REFUSE\xB7native file byte budget before read "+t);const i=Buffer.alloc(n.size);let l=0;for(;l<i.length;){const s=f.readSync(r,i,l,i.length-l,null);if(!s)throw Error("REFUSE\xB7native file changed during read "+t);l+=s}if(f.readSync(r,Buffer.alloc(1),0,1,null)!==0)throw Error("REFUSE\xB7native file grew during read "+t);return i}finally{f.closeSync(r)}}a(c,"readBoundedFile");function h(o,e){let t=0;return o.map(r=>{const n=c(r.path,e-t,r.coordinate);return t+=n.length,n})}a(h,"readBoundedBatch");export{h as readBoundedBatch,c as readBoundedFile};

package/dist/host/native/command.js

@@ -1,91 +1 @@
-import { spawn } from 'node:child_process';
-import { channel } from 'node:diagnostics_channel';
-import { isAbsolute } from 'node:path';
-import { checkCommandPort, commandRequest, commandResponse } from '@lapxo/topos/contract';
-import { requireEffects } from "../read-only.js";
-import { assertNativeRuntime } from "./runtime.js";
-import { scheduleDeadline } from "./deadline.js";
-const rejectedCommand = channel('bound.command.refusal');
-/** macOS prototype: bounded async invocation with POSIX child-group cancellation.
- * No acquisition or persistence on prospective paths; no partial success frames.
- * Host callbacks are trusted admission/verification operations, never signatures
- * or authority assertions supplied by the command's own output. */
-export async function executeLot(options) {
-    const start = process.hrtime.bigint();
-    const { host, signal, phase, accepts } = options;
-    // Admitted semantic configuration is snapshotted for the whole invocation;
-    // mutations of a caller's delivery object cannot alter checks mid-flight.
-    const port = Object.freeze({ ...options.port, closure: Object.freeze([...options.port.closure]), environment: Object.freeze([...options.port.environment]) });
-    const lot = Object.freeze({ ...options.lot, requests: Object.freeze([...options.lot.requests]) });
-    const environment = Object.freeze({ ...options.environment });
-    assertNativeRuntime(environment, []);
-    const refuse = (why) => { throw Error(`REFUSE·port ${port.coordinate} ${why}`); };
-    if (phase !== 'act')
-        refuse('invocation forbidden during ' + phase);
-    requireEffects('command ' + port.coordinate);
-    if (signal?.aborted)
-        refuse('interrupted before invocation');
-    checkCommandPort(port, host);
-    const deadline = start + BigInt(port.timeoutMs) * 1000000n;
-    const resolved = host.resolve(port), invocation = Object.freeze({ ...resolved, args: Object.freeze([...resolved.args]) });
-    if (!isAbsolute(invocation.command) || !isAbsolute(invocation.cwd))
-        refuse('host invocation needs absolute coordinates');
-    if (host.loaderClosure(port, invocation) !== 'verified')
-        refuse('runtime-loader closure unmeasured');
-    const names = Object.keys(environment).sort(), declared = [...new Set(port.environment)].sort();
-    if (names.length !== declared.length || names.some((name, index) => name !== declared[index]) || names.some(name => typeof environment[name] !== 'string' || environment[name].includes('\0')))
-        refuse('environment differs from declared handoff');
-    const frame = commandRequest(port, lot);
-    const envelope = invocation.hostEnvelope;
-    if (envelope && (!Number.isSafeInteger(invocation.envelopeBytes) || invocation.envelopeBytes < 1 || envelope.byteLength > invocation.envelopeBytes))
-        refuse('host envelope byte resources');
-    if (process.hrtime.bigint() >= deadline)
-        refuse('timeout before invocation');
-    if (signal?.aborted)
-        refuse('interrupted before invocation');
-    const result = await new Promise((resolve, reject) => {
-        const child = spawn(invocation.command, [...invocation.args], { cwd: invocation.cwd, env: { ...environment }, shell: false, detached: false, stdio: envelope ? ['pipe', 'pipe', 'pipe', 'pipe'] : ['pipe', 'pipe', 'pipe'] });
-        const stdout = [], stderr = [];
-        let bytes = 0, why, done = false;
-        const stop = (cause) => { if (why)
-            return; why = cause; try {
-            child.kill('SIGKILL');
-        }
-        catch { } child.stdin.destroy(); if (envelope)
-            child.stdio[3]?.destroy(); };
-        const cancelTimer = scheduleDeadline(deadline, () => stop('timeout'));
-        const abort = () => stop('interrupted');
-        signal?.addEventListener('abort', abort, { once: true });
-        if (signal?.aborted)
-            abort();
-        const collect = (target, chunk, channel) => { if (why)
-            return; bytes += chunk.length; if (bytes > port.responseBytes) {
-            stop('response-bytes exceeded');
-            return;
-        } if (channel === 'stderr' && port.stderr === 'reject') {
-            rejectedCommand.publish({ coordinate: port.coordinate, stderr: chunk.subarray(0, Math.min(port.responseBytes, 1024)).toString('utf8') });
-            stop('stderr forbidden');
-            return;
-        } target.push(chunk); };
-        child.stdout.on('data', (chunk) => collect(stdout, chunk, 'stdout'));
-        child.stderr.on('data', (chunk) => collect(stderr, chunk, 'stderr'));
-        child.stdin.on('error', () => stop('request handoff failed'));
-        const finish = (status, error) => { if (done)
-            return; done = true; cancelTimer(); signal?.removeEventListener('abort', abort); if (error || why) {
-            reject(Error(`REFUSE·port ${port.coordinate} ${why ?? error.message}`));
-            return;
-        } resolve({ status, interrupted: false, stdout: Buffer.concat(stdout).toString('utf8'), stderr: Buffer.concat(stderr).toString('utf8') }); };
-        child.once('error', error => finish(null, error));
-        child.once('close', status => finish(status));
-        if (envelope) {
-            const pipe = child.stdio[3];
-            const header = Buffer.alloc(8);
-            header.writeBigUInt64BE(BigInt(envelope.byteLength));
-            pipe.on('error', () => stop('host envelope handoff failed'));
-            pipe.end(Buffer.concat([header, Buffer.from(envelope)]));
-        }
-        child.stdin.end(frame);
-    });
-    const members = commandResponse(port, lot, result, accepts);
-    return { members, stderr: result.stderr, invocations: 1 };
-}
+var _=Object.defineProperty;var a=(n,p)=>_(n,"name",{value:p,configurable:!0});import{spawn as k}from"node:child_process";import{channel as F}from"node:diagnostics_channel";import{isAbsolute as C}from"node:path";import{library5_checkCommandPort as M,library5_commandRequest as N,library5_commandResponse as A}from"../../vendor/runtime.js";import{requireEffects as D}from"../read-only.js";import{assertNativeRuntime as G}from"./runtime.js";import{scheduleDeadline as K}from"./deadline.js";const T=F("bound.command.refusal");async function te(n){const p=process.hrtime.bigint(),{host:b,signal:m,phase:y,accepts:$}=n,t=Object.freeze({...n.port,closure:Object.freeze([...n.port.closure]),environment:Object.freeze([...n.port.environment])}),B=Object.freeze({...n.lot,requests:Object.freeze([...n.lot.requests])}),l=Object.freeze({...n.environment});G(l,[]);const i=a(c=>{throw Error(`REFUSE\xB7port ${t.coordinate} ${c}`)},"refuse");y!=="act"&&i("invocation forbidden during "+y),D("command "+t.coordinate),m?.aborted&&i("interrupted before invocation"),M(t,b);const j=p+BigInt(t.timeoutMs)*1000000n,E=b.resolve(t),r=Object.freeze({...E,args:Object.freeze([...E.args])});(!C(r.command)||!C(r.cwd))&&i("host invocation needs absolute coordinates"),b.loaderClosure(t,r)!=="verified"&&i("runtime-loader closure unmeasured");const h=Object.keys(l).sort(),w=[...new Set(t.environment)].sort();(h.length!==w.length||h.some((c,v)=>c!==w[v])||h.some(c=>typeof l[c]!="string"||l[c].includes("\0")))&&i("environment differs from declared handoff");const x=N(t,B),d=r.hostEnvelope;d&&(!Number.isSafeInteger(r.envelopeBytes)||r.envelopeBytes<1||d.byteLength>r.envelopeBytes)&&i("host envelope byte resources"),process.hrtime.bigint()>=j&&i("timeout before invocation"),m?.aborted&&i("interrupted before invocation");const O=await new Promise((c,v)=>{const o=k(r.command,[...r.args],{cwd:r.cwd,env:{...l},shell:!1,detached:!1,stdio:d?["pipe","pipe","pipe","pipe"]:["pipe","pipe","pipe"]}),z=[],S=[];let L=0,u,R=!1;const f=a(e=>{if(!u){u=e;try{o.kill("SIGKILL")}catch{}o.stdin.destroy(),d&&o.stdio[3]?.destroy()}},"stop"),P=K(j,()=>f("timeout")),g=a(()=>f("interrupted"),"abort");m?.addEventListener("abort",g,{once:!0}),m?.aborted&&g();const q=a((e,s,U)=>{if(!u){if(L+=s.length,L>t.responseBytes){f("response-bytes exceeded");return}if(U==="stderr"&&t.stderr==="reject"){T.publish({coordinate:t.coordinate,stderr:s.subarray(0,Math.min(t.responseBytes,1024)).toString("utf8")}),f("stderr forbidden");return}e.push(s)}},"collect");o.stdout.on("data",e=>q(z,e,"stdout")),o.stderr.on("data",e=>q(S,e,"stderr")),o.stdin.on("error",()=>f("request handoff failed"));const I=a((e,s)=>{if(!R){if(R=!0,P(),m?.removeEventListener("abort",g),s||u){v(Error(`REFUSE\xB7port ${t.coordinate} ${u??s.message}`));return}c({status:e,interrupted:!1,stdout:Buffer.concat(z).toString("utf8"),stderr:Buffer.concat(S).toString("utf8")})}},"finish");if(o.once("error",e=>I(null,e)),o.once("close",e=>I(e)),d){const e=o.stdio[3],s=Buffer.alloc(8);s.writeBigUInt64BE(BigInt(d.byteLength)),e.on("error",()=>f("host envelope handoff failed")),e.end(Buffer.concat([s,Buffer.from(d)]))}o.stdin.end(x)});return{members:A(t,B,O,$),stderr:O.stderr,invocations:1}}a(te,"executeLot");export{te as executeLot};

package/dist/host/native/control-bridge-worker.js

@@ -1,88 +1,2 @@
-/** Sealed Root control code: one fresh custodian connection per request. */
-import { parentPort, workerData } from 'node:worker_threads';
-import { createConnection } from 'node:net';
-const { endpoint, deadlineMs, shared, inputBytes, outputBytes } = workerData;
-const port = parentPort;
-if (!port)
-    throw Error('REFUSE·Root control transport parent absent');
-const header = new Int32Array(shared, 0, 8), input = new Uint8Array(shared, 32, inputBytes), output = new Uint8Array(shared, 32 + inputBytes, outputBytes);
-const initial = Math.min(endpoint.timeoutMs, deadlineMs - Date.now());
-const deadline = process.hrtime.bigint() + BigInt(Math.max(0, initial)) * 1000000n;
-const remaining = () => Math.max(0, Number((deadline - process.hrtime.bigint() + 999999n) / 1000000n));
-let busy = false, red, active;
-function finish(state, bytes) {
-    if (bytes.byteLength > outputBytes) {
-        state = 3;
-        bytes = Buffer.from('REFUSE·reply bytes').subarray(0, outputBytes);
-    }
-    output.set(bytes);
-    Atomics.store(header, 3, bytes.byteLength);
-    Atomics.store(header, 0, state);
-    Atomics.notify(header, 0);
-}
-// Timer slices never widen the original monotonic deadline.
-let timer;
-function arm() {
-    const left = remaining();
-    if (left > 0) {
-        timer = setTimeout(arm, Math.min(left, 2147483647));
-        timer.unref();
-        return;
-    }
-    red ?? (red = 'REFUSE·parent deadline');
-    active?.destroy(Error(red));
-    if (Atomics.load(header, 0) === 1)
-        finish(3, Buffer.from(red).subarray(0, outputBytes));
-    port.close();
-}
-arm();
-port.on('close', () => { clearTimeout(timer); active?.destroy(); });
-port.on('message', async (message) => {
-    if (busy || red || message !== Atomics.load(header, 1) || Atomics.load(header, 0) !== 1) {
-        red ?? (red = 'REFUSE·sequence/state');
-        finish(3, Buffer.from(red).subarray(0, outputBytes));
-        return;
-    }
-    busy = true;
-    try {
-        const length = Atomics.load(header, 2);
-        if (length < 1 || length > inputBytes)
-            throw Error('REFUSE·request bytes');
-        if (remaining() <= 0)
-            throw Error('REFUSE·parent deadline');
-        const frame = Buffer.from(input.slice(0, length));
-        const bytes = await new Promise((resolve, reject) => {
-            const socket = createConnection(endpoint.socket);
-            active = socket;
-            const chunks = [];
-            let size = 0, done = false;
-            const end = (error) => { if (done)
-                return; done = true; if (error)
-                reject(error);
-            else
-                resolve(Buffer.concat(chunks)); };
-            socket.once('connect', () => socket.write(Buffer.concat([frame, Buffer.from('\n')])));
-            socket.on('data', chunk => { size += chunk.length; if (size > outputBytes)
-                socket.destroy(Error('REFUSE·reply bytes'));
-            else
-                chunks.push(chunk); });
-            socket.once('error', end);
-            socket.once('close', () => end());
-        });
-        active = undefined;
-        if (!bytes.length)
-            throw Error('REFUSE·interrupted before reply');
-        if (remaining() <= 0)
-            throw Error('REFUSE·parent deadline');
-        busy = false;
-        finish(2, bytes);
-    }
-    catch (error) {
-        active = undefined;
-        red ?? (red = error instanceof Error ? error.message : String(error));
-        busy = false;
-        finish(3, Buffer.from(red).subarray(0, outputBytes));
-    }
-});
-Atomics.store(header, 5, 1);
-Atomics.notify(header, 5);
+var F=Object.defineProperty;var a=(r,e)=>F(r,"name",{value:e,configurable:!0});import{parentPort as M,workerData as k}from"node:worker_threads";import{createConnection as q}from"node:net";const{endpoint:A,deadlineMs:x,shared:l,inputBytes:d,outputBytes:s}=k,c=M;if(!c)throw Error("REFUSE\xB7Root control transport parent absent");const o=new Int32Array(l,0,8),D=new Uint8Array(l,32,d),I=new Uint8Array(l,32+d,s),L=Math.min(A.timeoutMs,x-Date.now()),P=process.hrtime.bigint()+BigInt(Math.max(0,L))*1000000n,E=a(()=>Math.max(0,Number((P-process.hrtime.bigint()+999999n)/1000000n)),"remaining");let u=!1,t,f;function m(r,e){e.byteLength>s&&(r=3,e=Buffer.from("REFUSE\xB7reply bytes").subarray(0,s)),I.set(e),Atomics.store(o,3,e.byteLength),Atomics.store(o,0,r),Atomics.notify(o,0)}a(m,"finish");let y;function B(){const r=E();if(r>0){y=setTimeout(B,Math.min(r,2147483647)),y.unref();return}t??(t="REFUSE\xB7parent deadline"),f?.destroy(Error(t)),Atomics.load(o,0)===1&&m(3,Buffer.from(t).subarray(0,s)),c.close()}a(B,"arm"),B(),c.on("close",()=>{clearTimeout(y),f?.destroy()}),c.on("message",async r=>{if(u||t||r!==Atomics.load(o,1)||Atomics.load(o,0)!==1){t??(t="REFUSE\xB7sequence/state"),m(3,Buffer.from(t).subarray(0,s));return}u=!0;try{const e=Atomics.load(o,2);if(e<1||e>d)throw Error("REFUSE\xB7request bytes");if(E()<=0)throw Error("REFUSE\xB7parent deadline");const U=Buffer.from(D.slice(0,e)),h=await new Promise((R,S)=>{const n=q(A.socket);f=n;const p=[];let b=0,w=!1;const g=a(i=>{w||(w=!0,i?S(i):R(Buffer.concat(p)))},"end");n.once("connect",()=>n.write(Buffer.concat([U,Buffer.from(`
+`)]))),n.on("data",i=>{b+=i.length,b>s?n.destroy(Error("REFUSE\xB7reply bytes")):p.push(i)}),n.once("error",g),n.once("close",()=>g())});if(f=void 0,!h.length)throw Error("REFUSE\xB7interrupted before reply");if(E()<=0)throw Error("REFUSE\xB7parent deadline");u=!1,m(2,h)}catch(e){f=void 0,t??(t=e instanceof Error?e.message:String(e)),u=!1,m(3,Buffer.from(t).subarray(0,s))}}),Atomics.store(o,5,1),Atomics.notify(o,5);

package/dist/host/native/control-bridge.js

@@ -1,110 +1 @@
-import { sha256 as digest } from "../hash.js";
-/** Root-fixed synchronous transport. It retains no grants or command results. */
-import { Worker, isMainThread } from 'node:worker_threads';
-import { readBoundedFile } from "./bounded-file.js";
-import { remainingDeadlineMs } from "./deadline.js";
-const FixedWorker = Worker;
-const HEADER_BYTES = 32;
-let controlWorkerOccupied = false;
-export function createFixedControlBridge(inputBinding) {
-    // @1 is one main-thread control worker per OS process, never a WorldWorker grant.
-    if (!isMainThread)
-        throw Error('REFUSE·Root control transport requires main-thread realm');
-    const refuse = (why) => { throw Error('REFUSE·Root control transport ' + why); };
-    const integer = (value) => Number.isSafeInteger(value) && value > 0;
-    const sourceBytes = inputBinding.workerBytes;
-    const workerSelection = Object.freeze({ ...inputBinding.worker });
-    if (!(sourceBytes instanceof Uint8Array) || !workerSelection.coordinate || !integer(workerSelection.bytes) || sourceBytes.byteLength !== workerSelection.bytes)
-        refuse('selected worker bytes/type bound differs before copy');
-    const binding = Object.freeze({ ...inputBinding,
-        endpoint: Object.freeze({ ...inputBinding.endpoint }), resources: Object.freeze({ ...inputBinding.resources }),
-        runtime: Object.freeze({ ...inputBinding.runtime }), worker: workerSelection,
-        workerBytes: Buffer.from(sourceBytes) });
-    const { endpoint, resources, runtime, worker: selected } = binding;
-    if (!selected.coordinate || !integer(selected.bytes) || binding.workerBytes.byteLength !== selected.bytes || digest(binding.workerBytes) !== selected.digest)
-        refuse('selected worker bytes differ');
-    if (runtime.path !== process.execPath || !integer(runtime.bytes) || digest(readBoundedFile(runtime.path, runtime.bytes, runtime.path)) !== runtime.digest)
-        refuse('selected runtime bytes differ');
-    if (![endpoint.timeoutMs, endpoint.responseBytes, endpoint.deadlineMs, binding.deadlineMs].every(integer) || binding.deadlineMs > endpoint.deadlineMs)
-        refuse('parent time/byte resource absent or widened');
-    // host-control-transport@1 encodes each byte length in a signed Int32 cell.
-    // Refuse an incompatible declaration; never wrap or clamp its bound.
-    if (resources.inputBytes > 2147483647 || resources.outputBytes > 2147483647)
-        refuse('host-control-transport@1 signed Int32 length representation');
-    const sharedBytes = HEADER_BYTES + resources.inputBytes + resources.outputBytes;
-    if (!Object.values(resources).every(integer) || !Number.isSafeInteger(sharedBytes) || resources.inputBytes > endpoint.responseBytes || resources.outputBytes > endpoint.responseBytes || sharedBytes > resources.sharedBytes)
-        refuse('shared/input/output resource absent or exceeded');
-    const remainingMs = Math.min(endpoint.timeoutMs, binding.deadlineMs - Date.now());
-    if (remainingMs <= 0)
-        refuse('parent deadline');
-    const deadline = process.hrtime.bigint() + BigInt(remainingMs) * 1000000n;
-    const remaining = remainingDeadlineMs.bind(undefined, deadline);
-    if (controlWorkerOccupied)
-        refuse('one live main-thread control worker resource exhausted');
-    let shared;
-    try {
-        shared = new SharedArrayBuffer(sharedBytes);
-    }
-    catch {
-        return refuse('shared resource allocation');
-    }
-    const header = new Int32Array(shared, 0, 8), input = new Uint8Array(shared, HEADER_BYTES, resources.inputBytes), output = new Uint8Array(shared, HEADER_BYTES + resources.inputBytes, resources.outputBytes);
-    // Independently sealed bytes are immutable here. A payload cannot select a path or verifier.
-    const code = Buffer.from(binding.workerBytes).toString('base64');
-    controlWorkerOccupied = true;
-    let worker;
-    try {
-        worker = new FixedWorker(new URL('data:text/javascript;base64,' + code), { execArgv: [], env: {}, workerData: { endpoint: { ...endpoint }, deadlineMs: binding.deadlineMs, shared, inputBytes: resources.inputBytes, outputBytes: resources.outputBytes } });
-    }
-    catch {
-        controlWorkerOccupied = false;
-        return refuse('worker construction interrupted');
-    }
-    let termination;
-    const stop = () => termination ?? (termination = worker.terminate().finally(() => { controlWorkerOccupied = false; }));
-    worker.once('exit', () => { controlWorkerOccupied = false; });
-    worker.unref();
-    let red, closed = false, sequence = 0;
-    const fail = (why) => { red ?? (red = 'REFUSE·Root control transport ' + why); void stop(); throw Error(red); };
-    // Error events still need a listener when a synchronous wait prevents JS callbacks.
-    worker.on('error', error => { red ?? (red = 'REFUSE·Root control transport worker interrupted: ' + error.message); });
-    if (Atomics.load(header, 5) !== 1 && Atomics.wait(header, 5, 0, remaining()) === 'timed-out')
-        fail('startup deadline/interruption');
-    return {
-        exchange(frame) {
-            if (red)
-                throw Error(red);
-            if (closed)
-                fail('closed');
-            if (remaining() <= 0)
-                fail('parent deadline');
-            if (typeof frame !== 'string' || !frame.length || Buffer.byteLength(frame, 'utf8') > resources.inputBytes)
-                fail('request bytes before copy');
-            const bytes = Buffer.from(frame, 'utf8');
-            if (Atomics.load(header, 0) !== 0 || sequence >= 2147483647)
-                fail('overlapping request/sequence');
-            input.set(bytes);
-            Atomics.store(header, 2, bytes.length);
-            Atomics.store(header, 1, ++sequence);
-            Atomics.store(header, 0, 1);
-            worker.postMessage(sequence);
-            if (Atomics.wait(header, 0, 1, remaining()) === 'timed-out' || remaining() <= 0)
-                fail('deadline/interruption');
-            const state = Atomics.load(header, 0), length = Atomics.load(header, 3);
-            if (length < 1 || length > resources.outputBytes)
-                fail('reply bytes');
-            let reply;
-            try {
-                reply = new TextDecoder('utf-8', { fatal: true }).decode(output.slice(0, length));
-            }
-            catch {
-                return fail('reply encoding');
-            }
-            if (state !== 2)
-                fail(reply);
-            Atomics.store(header, 0, 0);
-            return reply;
-        },
-        async close() { closed = true; await stop(); }
-    };
-}
+var D=Object.defineProperty;var f=(n,r)=>D(n,"name",{value:r,configurable:!0});import{sha256 as U}from"../hash.js";import{Worker as I,isMainThread as L}from"node:worker_threads";import{readBoundedFile as T}from"./bounded-file.js";import{remainingDeadlineMs as W}from"./deadline.js";const N=I,E=32;let p=!1;function G(n){if(!L)throw Error("REFUSE\xB7Root control transport requires main-thread realm");const r=f(t=>{throw Error("REFUSE\xB7Root control transport "+t)},"refuse"),l=f(t=>Number.isSafeInteger(t)&&t>0,"integer"),w=n.workerBytes,m=Object.freeze({...n.worker});(!(w instanceof Uint8Array)||!m.coordinate||!l(m.bytes)||w.byteLength!==m.bytes)&&r("selected worker bytes/type bound differs before copy");const i=Object.freeze({...n,endpoint:Object.freeze({...n.endpoint}),resources:Object.freeze({...n.resources}),runtime:Object.freeze({...n.runtime}),worker:m,workerBytes:Buffer.from(w)}),{endpoint:a,resources:e,runtime:d,worker:b}=i;(!b.coordinate||!l(b.bytes)||i.workerBytes.byteLength!==b.bytes||U(i.workerBytes)!==b.digest)&&r("selected worker bytes differ"),(d.path!==process.execPath||!l(d.bytes)||U(T(d.path,d.bytes,d.path))!==d.digest)&&r("selected runtime bytes differ"),(![a.timeoutMs,a.responseBytes,a.deadlineMs,i.deadlineMs].every(l)||i.deadlineMs>a.deadlineMs)&&r("parent time/byte resource absent or widened"),(e.inputBytes>2147483647||e.outputBytes>2147483647)&&r("host-control-transport@1 signed Int32 length representation");const B=E+e.inputBytes+e.outputBytes;(!Object.values(e).every(l)||!Number.isSafeInteger(B)||e.inputBytes>a.responseBytes||e.outputBytes>a.responseBytes||B>e.sharedBytes)&&r("shared/input/output resource absent or exceeded");const M=Math.min(a.timeoutMs,i.deadlineMs-Date.now());M<=0&&r("parent deadline");const j=process.hrtime.bigint()+BigInt(M)*1000000n,h=W.bind(void 0,j);p&&r("one live main-thread control worker resource exhausted");let y;try{y=new SharedArrayBuffer(B)}catch{return r("shared resource allocation")}const o=new Int32Array(y,0,8),F=new Uint8Array(y,E,e.inputBytes),O=new Uint8Array(y,E+e.inputBytes,e.outputBytes),q=Buffer.from(i.workerBytes).toString("base64");p=!0;let u;try{u=new N(new URL("data:text/javascript;base64,"+q),{execArgv:[],env:{},workerData:{endpoint:{...a},deadlineMs:i.deadlineMs,shared:y,inputBytes:e.inputBytes,outputBytes:e.outputBytes}})}catch{return p=!1,r("worker construction interrupted")}let x;const R=f(()=>x??(x=u.terminate().finally(()=>{p=!1})),"stop");u.once("exit",()=>{p=!1}),u.unref();let c,S=!1,g=0;const s=f(t=>{throw c??(c="REFUSE\xB7Root control transport "+t),R(),Error(c)},"fail");return u.on("error",t=>{c??(c="REFUSE\xB7Root control transport worker interrupted: "+t.message)}),Atomics.load(o,5)!==1&&Atomics.wait(o,5,0,h())==="timed-out"&&s("startup deadline/interruption"),{exchange(t){if(c)throw Error(c);S&&s("closed"),h()<=0&&s("parent deadline"),(typeof t!="string"||!t.length||Buffer.byteLength(t,"utf8")>e.inputBytes)&&s("request bytes before copy");const v=Buffer.from(t,"utf8");(Atomics.load(o,0)!==0||g>=2147483647)&&s("overlapping request/sequence"),F.set(v),Atomics.store(o,2,v.length),Atomics.store(o,1,++g),Atomics.store(o,0,1),u.postMessage(g),(Atomics.wait(o,0,1,h())==="timed-out"||h()<=0)&&s("deadline/interruption");const z=Atomics.load(o,0),k=Atomics.load(o,3);(k<1||k>e.outputBytes)&&s("reply bytes");let A;try{A=new TextDecoder("utf-8",{fatal:!0}).decode(O.slice(0,k))}catch{return s("reply encoding")}return z!==2&&s(A),Atomics.store(o,0,0),A},async close(){S=!0,await R()}}}f(G,"createFixedControlBridge");export{G as createFixedControlBridge};