@lapxo/bound 0.2.4 → 0.2.6

package/dist/host/native/control-selection.js

@@ -1,32 +1 @@
-/** Optional Root-selected control transport. This is fixed host machinery,
- * never a world's worker permission or a change to producer message/work caps.
- * One retained control worker belongs only to the main thread of each process;
- * other Node realms keep the existing bounded fixed-client transport. */
-import { parsedLine as parse } from "../../fold/claims.js";
-import { authenticateSignedPort } from "./reading.js";
-const fail = (why) => { throw Error('REFUSE·host control ' + why); };
-const keys = (value) => value && typeof value === 'object' && !Array.isArray(value) ? Object.keys(value).sort().join(',') : '';
-const digest = (value) => typeof value === 'string' && /^sha256:[a-f0-9]{64}$/.test(value);
-export function selectedHostControl(root, parent) {
-    const coordinate = [parent.port.coordinate, 'control'].join('/'), rows = root.live.filter(line => { const got = parse(line); return got.kind === 'fact' && got.value.fields.scope === coordinate; });
-    if (!rows.length)
-        return undefined;
-    const selected = authenticateSignedPort(root, coordinate), profile = selected.profile, parsed = parse(selected.line);
-    if (parsed.kind !== 'fact' || parsed.value.fields.by !== root.signer.id)
-        fail('selection is not Root signed ' + coordinate);
-    if (keys(profile) !== 'coordinate,limits,profile,realm,runtime,selector,worker' || profile.profile !== 'host-control-transport@1' || profile.realm !== 'main-thread' || profile.coordinate !== coordinate || keys(profile.selector) !== 'implementation,port' || profile.selector.port !== parent.port.coordinate || profile.selector.implementation !== parent.port.implementation)
-        fail('profile selector differs ' + coordinate);
-    if (keys(profile.worker) !== 'bytes,coordinate,digest' || !/^native\/executor\/(?:dist|src)\/host\/native\/control-bridge-worker\.(?:js|ts)$/.test(profile.worker.coordinate) || !digest(profile.worker.digest) || !Number.isSafeInteger(profile.worker.bytes) || profile.worker.bytes < 1)
-        fail('fixed worker binding absent ' + coordinate);
-    const runtime = parent.selection.members.find(member => member.coordinate === parent.selection.runtime);
-    if (keys(profile.runtime) !== 'coordinate,digest' || !runtime || profile.runtime.coordinate !== runtime.coordinate || profile.runtime.digest !== runtime.digest)
-        fail('fixed runtime selection differs ' + coordinate);
-    if (keys(profile.limits) !== 'inFlight,sharedBytes,workersPerProcess' || profile.limits.workersPerProcess !== 1 || profile.limits.inFlight !== 1 || !Number.isSafeInteger(profile.limits.sharedBytes) || profile.limits.sharedBytes < 32)
-        fail('named resource invalid ' + coordinate);
-    if (!Number.isSafeInteger(parent.port.responseBytes) || parent.port.responseBytes < 1 || parent.port.responseBytes > 2147483647)
-        fail('message cap outside declared signed Int32 representation ' + coordinate);
-    const required = 32 + 2 * parent.port.responseBytes;
-    if (!Number.isSafeInteger(required) || profile.limits.sharedBytes < required)
-        fail('shared resource cannot preserve message caps ' + coordinate);
-    return Object.freeze({ line: selected.line, profile });
-}
+var g=Object.defineProperty;var s=(r,t)=>g(r,"name",{value:t,configurable:!0});import{parsedLine as p}from"../../fold/claims.js";import{authenticateSignedPort as u}from"./reading.js";const o=s(r=>{throw Error("REFUSE\xB7host control "+r)},"fail"),n=s(r=>r&&typeof r=="object"&&!Array.isArray(r)?Object.keys(r).sort().join(","):"","keys"),y=s(r=>typeof r=="string"&&/^sha256:[a-f0-9]{64}$/.test(r),"digest");function B(r,t){const i=[t.port.coordinate,"control"].join("/");if(!r.live.filter(l=>{const m=p(l);return m.kind==="fact"&&m.value.fields.scope===i}).length)return;const c=u(r,i),e=c.profile,a=p(c.line);(a.kind!=="fact"||a.value.fields.by!==r.signer.id)&&o("selection is not Root signed "+i),(n(e)!=="coordinate,limits,profile,realm,runtime,selector,worker"||e.profile!=="host-control-transport@1"||e.realm!=="main-thread"||e.coordinate!==i||n(e.selector)!=="implementation,port"||e.selector.port!==t.port.coordinate||e.selector.implementation!==t.port.implementation)&&o("profile selector differs "+i),(n(e.worker)!=="bytes,coordinate,digest"||!/^native\/executor\/(?:dist|src)\/host\/native\/control-bridge-worker\.(?:js|ts)$/.test(e.worker.coordinate)||!y(e.worker.digest)||!Number.isSafeInteger(e.worker.bytes)||e.worker.bytes<1)&&o("fixed worker binding absent "+i);const d=t.selection.members.find(l=>l.coordinate===t.selection.runtime);(n(e.runtime)!=="coordinate,digest"||!d||e.runtime.coordinate!==d.coordinate||e.runtime.digest!==d.digest)&&o("fixed runtime selection differs "+i),(n(e.limits)!=="inFlight,sharedBytes,workersPerProcess"||e.limits.workersPerProcess!==1||e.limits.inFlight!==1||!Number.isSafeInteger(e.limits.sharedBytes)||e.limits.sharedBytes<32)&&o("named resource invalid "+i),(!Number.isSafeInteger(t.port.responseBytes)||t.port.responseBytes<1||t.port.responseBytes>2147483647)&&o("message cap outside declared signed Int32 representation "+i);const f=32+2*t.port.responseBytes;return(!Number.isSafeInteger(f)||e.limits.sharedBytes<f)&&o("shared resource cannot preserve message caps "+i),Object.freeze({line:c.line,profile:e})}s(B,"selectedHostControl");export{B as selectedHostControl};

package/dist/host/native/custody.js

@@ -1,91 +1 @@
-/** Fixed Root constructor for finite descendant custody. It selects only current
- * authenticated Root records matching the already planned native parent job.
- */
-import { mkdtempSync, writeFileSync, rmSync } from 'node:fs';
-import { tmpdir } from 'node:os';
-import { join, extname } from 'node:path';
-import { fileURLToPath, pathToFileURL } from 'node:url';
-import { createHash } from 'node:crypto';
-import { parse } from '@lapxo/topos/wire';
-import { processOf, ownRoot } from "../../observe/runner.js";
-import { selectedHostControl } from "./control-selection.js";
-import { readBoundedFile } from "./bounded-file.js";
-import { authenticateSignedPort } from "./reading.js";
-import { createProducerJobCustody } from "./generated-custodian.js";
-const fail = (why) => { throw Error('REFUSE·native custody ' + why); };
-const sha = (raw) => 'sha256:' + createHash('sha256').update(raw).digest('hex');
-export function nativeRootJobCustody(root, profile, handoff, image, logical) {
-    const data = logical.members.map(member => { const location = image.locations.find(loc => loc.member === member.coordinate); if (!location)
-        return fail('literal member absent'); return { path: location.path, digest: member.digest }; }), libraries = logical.libraries.map(lib => { const location = image.locations.find(loc => loc.member === lib.manifest); if (!location)
-        return fail('library absent'); return { name: lib.name, manifest: location.path, coordinate: lib.manifest }; });
-    const candidates = root.live.flatMap(line => { const row = parse(line); if (row.kind !== 'fact' || !row.value.fields.scope.startsWith('port/'))
-        return []; let p; try {
-        p = JSON.parse(row.value.fields.about ?? '');
-    }
-    catch {
-        return [];
-    } return p?.selector?.port === profile.port.coordinate ? [{ coordinate: row.value.fields.scope, profile: p }] : []; });
-    return { async open(parent) {
-            const matching = candidates.filter(candidate => candidate.profile.selector.binding === parent.binding && candidate.profile.selector.implementation === parent.implementation);
-            const producers = matching.filter(candidate => candidate.profile.profile === 'host-generated-executable@3');
-            if (producers.length !== 1)
-                return fail('requires one current Root producer for ' + parent.binding);
-            const selected = producers[0];
-            authenticateSignedPort(root, selected.coordinate);
-            const control = selectedHostControl(root, profile);
-            const implementation = fileURLToPath(new URL('./generated' + extname(new URL(import.meta.url).pathname), import.meta.url)), implementationBytes = readBoundedFile(implementation, root.budget.bytes, implementation);
-            const runtime = image.locations.find(location => location.member === image.runtime), runtimeMember = handoff.members.find(member => member.coordinate === image.runtime);
-            if (!runtime || !runtimeMember)
-                return fail('fixed actual runtime absent');
-            const binaries = matching.filter(candidate => ['host-native-binary@1', 'host-native-binary-origin@1'].includes(candidate.profile.profile)).map(candidate => { const p = candidate.profile, location = image.locations.find(loc => loc.member === p.entry?.path), member = handoff.members.find(m => m.coordinate === p.entry?.path); if (!location || !member)
-                return fail('binary outside actual selected image'); return { coordinate: candidate.coordinate, privateBinding: { coordinate: member.coordinate, path: location.path, digest: member.digest } }; });
-            const programs = matching.filter(candidate => candidate.profile.profile === 'host-native-program@1').map(candidate => ({ coordinate: candidate.coordinate, runtimeBinding: { coordinate: image.runtime, path: runtime.path, digest: runtimeMember.digest, members: image.locations.map(location => ({ coordinate: location.member, path: location.path })) } }));
-            const directory = mkdtempSync(join(tmpdir(), 'bound-native-custody-')), contextFile = join(directory, 'context.json'), configFile = join(directory, 'loader.json');
-            let acquired;
-            try {
-                const service = createProducerJobCustody({ root, coordinate: selected.coordinate, implementationBytes, snapshot: { budget: { members: handoff.budget.members, bytes: handoff.budget.bytes }, members: data, libraries, builtins: logical.builtins, platform: logical.platform }, nativeImplementations: new Set(logical.members.map(member => member.digest)), directory, contextFile, nativeBinaries: binaries, programSelections: programs });
-                acquired = await service.open(parent);
-                const client = processOf('custodian'), clientBytes = readBoundedFile(client, parent.responseBytes, client), preload = new URL(pathToFileURL(processOf('native-descendant')).href);
-                preload.searchParams.set('config', configFile);
-                preload.searchParams.set('bytes', String(handoff.budget.bytes));
-                let controlEnvelope;
-                if (control) {
-                    const worker = control.profile.worker, path = join(ownRoot(), worker.coordinate.slice('native/executor/'.length)), raw = readBoundedFile(path, worker.bytes, worker.coordinate);
-                    if (raw.length !== worker.bytes || sha(raw) !== worker.digest)
-                        return fail('sealed control worker bytes differ');
-                    if (control.profile.runtime.coordinate !== image.runtime || control.profile.runtime.digest !== runtimeMember.digest)
-                        return fail('sealed control runtime differs');
-                    const shared = 32 + 2 * parent.responseBytes;
-                    if (!Number.isSafeInteger(shared) || shared > control.profile.limits.sharedBytes)
-                        return fail('shared control resource absent');
-                    controlEnvelope = { profileLine: control.line, realm: control.profile.realm, worker: { ...worker, path }, resources: { inputBytes: parent.responseBytes, outputBytes: parent.responseBytes, sharedBytes: control.profile.limits.sharedBytes } };
-                }
-                const config = { ...(controlEnvelope ? { control: controlEnvelope } : {}), members: data, libraries, builtins: logical.builtins, platform: logical.platform, executableDigests: logical.members.filter(member => /\.(?:[mc]?js|ts)$/.test(member.coordinate)).map(member => member.digest), metadataDigests: logical.members.filter(member => member.coordinate.endsWith('.json')).map(member => member.digest), inputBytes: handoff.budget.bytes, runtimeBytes: runtimeMember.bytes.byteLength, clientBytes: clientBytes.length, contextBytes: parent.responseBytes, custodian: { contextFile, client, runtime: runtime.path, preload: preload.href, runtimeDigest: runtimeMember.digest, clientDigest: sha(clientBytes) } };
-                // Loader metadata describes the authenticated input image, not the command's
-                // stdout. Its declared input budget stays separate from responseBytes.
-                const raw = Buffer.from(JSON.stringify(config));
-                if (raw.length > handoff.budget.bytes)
-                    return fail('operational descendant envelope bytes');
-                writeFileSync(configFile, raw, { flag: 'wx', mode: 0o400 });
-                // The URL carries an independently fixed expected digest of the private host
-                // envelope. This is operational custody, never authority from JSON.
-                preload.searchParams.set('digest', sha(raw));
-                config.custodian.preload = preload.href;
-                // The recursive preload URL excludes its own digest while writing the file;
-                // its fixed child validates the exact file before installing any hook.
-                const descendant = { ...config, custodian: { ...config.custodian, preload: preload.href } };
-                const held = acquired;
-                return { descendant, assertClosed: () => held.assertClosed(), async close() { try {
-                        await held.close();
-                    }
-                    finally {
-                        rmSync(directory, { recursive: true, force: true });
-                    } } };
-            }
-            catch (error) {
-                await acquired?.close();
-                rmSync(directory, { recursive: true, force: true });
-                throw error;
-            }
-        } };
-}
+var _=Object.defineProperty;var h=(i,g)=>_(i,"name",{value:g,configurable:!0});import{mkdtempSync as $,writeFileSync as z,rmSync as O}from"node:fs";import{tmpdir as A}from"node:os";import{join as B,extname as G}from"node:path";import{fileURLToPath as K,pathToFileURL as Q}from"node:url";import{createHash as V}from"node:crypto";import{library14_parse as X}from"../../vendor/runtime.js";import{processOf as q,ownRoot as Y}from"../../observe/runner.js";import{selectedHostControl as Z}from"./control-selection.js";import{readBoundedFile as R}from"./bounded-file.js";import{authenticateSignedPort as ee}from"./reading.js";import{createProducerJobCustody as te}from"./generated-custodian.js";const d=h(i=>{throw Error("REFUSE\xB7native custody "+i)},"fail"),L=h(i=>"sha256:"+V("sha256").update(i).digest("hex"),"sha");function fe(i,g,p,a,c){const k=c.members.map(t=>{const o=a.locations.find(s=>s.member===t.coordinate);return o?{path:o.path,digest:t.digest}:d("literal member absent")}),F=c.libraries.map(t=>{const o=a.locations.find(s=>s.member===t.manifest);return o?{name:t.name,manifest:o.path,coordinate:t.manifest}:d("library absent")}),H=i.live.flatMap(t=>{const o=X(t);if(o.kind!=="fact"||!o.value.fields.scope.startsWith("port/"))return[];let s;try{s=JSON.parse(o.value.fields.about??"")}catch{return[]}return s?.selector?.port===g.port.coordinate?[{coordinate:o.value.fields.scope,profile:s}]:[]});return{async open(t){const o=H.filter(e=>e.profile.selector.binding===t.binding&&e.profile.selector.implementation===t.implementation),s=o.filter(e=>e.profile.profile==="host-generated-executable@3");if(s.length!==1)return d("requires one current Root producer for "+t.binding);const P=s[0];ee(i,P.coordinate);const l=Z(i,g),U=K(new URL("./generated"+G(new URL(import.meta.url).pathname),import.meta.url)),I=R(U,i.budget.bytes,U),w=a.locations.find(e=>e.member===a.runtime),f=p.members.find(e=>e.coordinate===a.runtime);if(!w||!f)return d("fixed actual runtime absent");const M=o.filter(e=>["host-native-binary@1","host-native-binary-origin@1"].includes(e.profile.profile)).map(e=>{const m=e.profile,y=a.locations.find(u=>u.member===m.entry?.path),n=p.members.find(u=>u.coordinate===m.entry?.path);return!y||!n?d("binary outside actual selected image"):{coordinate:e.coordinate,privateBinding:{coordinate:n.coordinate,path:y.path,digest:n.digest}}}),T=o.filter(e=>e.profile.profile==="host-native-program@1").map(e=>({coordinate:e.coordinate,runtimeBinding:{coordinate:a.runtime,path:w.path,digest:f.digest,members:a.locations.map(m=>({coordinate:m.member,path:m.path}))}})),b=$(B(A(),"bound-native-custody-")),j=B(b,"context.json"),C=B(b,"loader.json");let x;try{x=await te({root:i,coordinate:P.coordinate,implementationBytes:I,snapshot:{budget:{members:p.budget.members,bytes:p.budget.bytes},members:k,libraries:F,builtins:c.builtins,platform:c.platform},nativeImplementations:new Set(c.members.map(r=>r.digest)),directory:b,contextFile:j,nativeBinaries:M,programSelections:T}).open(t);const m=q("custodian"),y=R(m,t.responseBytes,m),n=new URL(Q(q("native-descendant")).href);n.searchParams.set("config",C),n.searchParams.set("bytes",String(p.budget.bytes));let u;if(l){const r=l.profile.worker,E=B(Y(),r.coordinate.slice(16)),J=R(E,r.bytes,r.coordinate);if(J.length!==r.bytes||L(J)!==r.digest)return d("sealed control worker bytes differ");if(l.profile.runtime.coordinate!==a.runtime||l.profile.runtime.digest!==f.digest)return d("sealed control runtime differs");const N=32+2*t.responseBytes;if(!Number.isSafeInteger(N)||N>l.profile.limits.sharedBytes)return d("shared control resource absent");u={profileLine:l.line,realm:l.profile.realm,worker:{...r,path:E},resources:{inputBytes:t.responseBytes,outputBytes:t.responseBytes,sharedBytes:l.profile.limits.sharedBytes}}}const v={...u?{control:u}:{},members:k,libraries:F,builtins:c.builtins,platform:c.platform,executableDigests:c.members.filter(r=>/\.(?:[mc]?js|ts)$/.test(r.coordinate)).map(r=>r.digest),metadataDigests:c.members.filter(r=>r.coordinate.endsWith(".json")).map(r=>r.digest),inputBytes:p.budget.bytes,runtimeBytes:f.bytes.byteLength,clientBytes:y.length,contextBytes:t.responseBytes,custodian:{contextFile:j,client:m,runtime:w.path,preload:n.href,runtimeDigest:f.digest,clientDigest:L(y)}},S=Buffer.from(JSON.stringify(v));if(S.length>p.budget.bytes)return d("operational descendant envelope bytes");z(C,S,{flag:"wx",mode:256}),n.searchParams.set("digest",L(S)),v.custodian.preload=n.href;const W={...v,custodian:{...v.custodian,preload:n.href}},D=x;return{descendant:W,assertClosed:h(()=>D.assertClosed(),"assertClosed"),async close(){try{await D.close()}finally{O(b,{recursive:!0,force:!0})}}}}catch(e){throw await x?.close(),O(b,{recursive:!0,force:!0}),e}}}}h(fe,"nativeRootJobCustody");export{fe as nativeRootJobCustody};

package/dist/host/native/deadline.js

@@ -1,28 +1 @@
-const TIMER_MAX_MS = 2147483647;
-/** Remaining monotonic lease, rounded up for host APIs that accept milliseconds. */
-export function remainingDeadlineMs(deadline) {
-    return Math.max(0, Number((deadline - process.hrtime.bigint() + 999999n) / 1000000n));
-}
-const native = { now: () => process.hrtime.bigint(), schedule: (callback, delay) => setTimeout(callback, delay), cancel: handle => clearTimeout(handle) };
-/** The admitted deadline is never clamped to the platform timer range. Each
- * timer is merely a wake-up slice; expiry checks the original monotonic clock.
- * Injected clock exists only for deterministic platform-boundary vectors. */
-export function scheduleDeadline(deadline, expire, clock = native) {
-    let active = true, handle;
-    const arm = () => {
-        if (!active)
-            return;
-        const remaining = deadline - clock.now();
-        if (remaining <= 0n) {
-            active = false;
-            expire();
-            return;
-        }
-        const ceilMs = (remaining + 999999n) / 1000000n;
-        const slice = ceilMs > BigInt(TIMER_MAX_MS) ? TIMER_MAX_MS : Number(ceilMs);
-        handle = clock.schedule(arm, slice);
-    };
-    arm();
-    return () => { active = false; if (handle !== undefined)
-        clock.cancel(handle); };
-}
+var l=Object.defineProperty;var n=(e,t)=>l(e,"name",{value:t,configurable:!0});const d=2147483647;function f(e){return Math.max(0,Number((e-process.hrtime.bigint()+999999n)/1000000n))}n(f,"remainingDeadlineMs");const M={now:n(()=>process.hrtime.bigint(),"now"),schedule:n((e,t)=>setTimeout(e,t),"schedule"),cancel:n(e=>clearTimeout(e),"cancel")};function h(e,t,i=M){let r=!0,s;const c=n(()=>{if(!r)return;const a=e-i.now();if(a<=0n){r=!1,t();return}const u=(a+999999n)/1000000n,o=u>BigInt(2147483647)?2147483647:Number(u);s=i.schedule(c,o)},"arm");return c(),()=>{r=!1,s!==void 0&&i.cancel(s)}}n(h,"scheduleDeadline");export{f as remainingDeadlineMs,h as scheduleDeadline};