@lapxo/bound 0.2.4 → 0.2.6

package/dist/host/native/route.js

@@ -1,216 +1 @@
-import { fieldNames } from "./reading.js";
-import { sha256 as hash } from "../hash.js";
-/** Instrument-only native route. The caller holds the existing Root lease
- * across selection, cache authorization and this complete bounded child act.
- */
-import { dirname } from 'node:path';
-import { realpathSync } from 'node:fs';
-import { nativeBinaryOrigin } from "./native-binary.js";
-import { selectedHostControl } from "./control-selection.js";
-import { authorityAtEpoch } from '@lapxo/topos/wire';
-import { parsedLine as parse } from "../../fold/claims.js";
-import { authorityFor } from "../../fold/signers.js";
-import { authenticatedRootStanding } from "../admitted-place.js";
-import { nativeExecutorInputs } from "./materialize.js";
-export { materializeNativeRoute } from "./materialize.js";
-import { assertNativeRuntime } from "./runtime.js";
-import { nativeReferenceInputs } from "./references.js";
-import { rootAuthorityProtection } from "../../land/act.js";
-import { currentNativeRoot, inheritedNativeRoot } from "./root.js";
-import { authenticateSignedPort, authenticateNativeProfile, canonicalJson } from "./reading.js";
-import { boundedProcess } from "../process-lifetime.js";
-import { validResponse, CapsuleProcessError } from "../capsule-process.js";
-import { processOf } from "../../observe/runner.js";
-const fail = (why) => { throw Error('REFUSE·native route ' + why); };
-const routes = new WeakMap();
-/** Shared origins are one exact input; individual signed selectors remain separate. */
-export function nativeBinaryOriginInputs(binaries) {
-    const seen = new Map(), inputs = [];
-    for (const binary of binaries) {
-        if (!binary.origin)
-            continue;
-        const coordinate = 'native/binary-origin/' + binary.origin.coordinate, digest = hash(binary.origin.line), prior = seen.get(coordinate);
-        if (prior !== undefined) {
-            if (prior !== digest)
-                fail('conflicting binary origin input ' + coordinate);
-            continue;
-        }
-        seen.set(coordinate, digest);
-        inputs.push([coordinate, digest]);
-    }
-    return Object.freeze(inputs);
-}
-/** Inputs are semantic logical references. Fixed instrument/host graph and
- * runtime-supervisor chain must also be supplied by the calling identity builder.
- * Locations and lock-token/PID are operational custody, never these inputs.
- */
-export function prepareNativeRoute(store, coordinate, readerMapping) {
-    const proof = rootAuthorityProtection(store), current = currentNativeRoot(store, process.pid, proof);
-    return prepareAtCurrentRoot(store, coordinate, readerMapping, current);
-}
-/** Private same-call reuse only: callers cannot supply a standing as authority. */
-function prepareAtCurrentRoot(store, coordinate, readerMapping, current) {
-    const { root, context } = current, selected = authenticateNativeProfile(root, coordinate), profile = selected.profile;
-    // The Root cursor authorizes today's act under the held lease. It is not a
-    // semantic input to every program: unrelated Root acts do not reopen it.
-    // Exact selected grants and the authenticated reader mapping remain inputs.
-    const binaries = authenticatedNativeBinaries(root, profile), control = selectedHostControl(root, profile), identity = hash(canonicalJson([coordinate, selected.line, profile, binaries, readerMapping ?? null, ...(control ? [control] : [])])), inputs = [['native/selection', identity], ...(readerMapping ? [['native/reader-mapping', hash(readerMapping)]] : []), ...profile.selection.members.map(m => ['native/' + m.coordinate, m.digest]), ...binaries.map(b => ['native/binary/' + b.coordinate, hash(b.line)])];
-    inputs.push(...nativeBinaryOriginInputs(binaries));
-    if (control)
-        inputs.push(['native/control-profile', hash(control.line)], ['native/control-worker', control.profile.worker.digest], ['native/control-runtime', control.profile.runtime.digest]);
-    const route = { identity, profile, binaries, ...(control ? { control } : {}), inputs: inputs };
-    routes.set(route, { store, coordinate, context, profile });
-    inputs.push(...nativeExecutorInputs(route));
-    if (control && inputs.find(([name]) => name === control.profile.worker.coordinate)?.[1] !== control.profile.worker.digest)
-        fail('control worker differs from sealed executor');
-    Object.freeze(inputs);
-    return Object.freeze(route);
-}
-/** Recheck authority before both a current retained answer and fresh execution.
- * Historical public --check uses the existing receipt-inspection path, not this
- * command authorization route.
- */
-export function assertNativeRouteCurrent(route) {
-    const held = routes.get(route);
-    if (!held)
-        return fail('unknown prepared route');
-    const proof = rootAuthorityProtection(held.store), root = inheritedNativeRoot({ store: held.store, parent: process.pid, expected: held.context }, proof);
-    const profile = authenticateSignedPort(root, held.coordinate).profile;
-    if (canonicalJson(profile) !== canonicalJson(held.profile) || canonicalJson(authenticatedNativeBinaries(root, held.profile)) !== canonicalJson(route.binaries) || canonicalJson(selectedHostControl(root, held.profile) ?? null) !== canonicalJson(route.control ?? null))
-        fail('current port changed');
-}
-export function invokeNativeRoute(route, input) {
-    const held = routes.get(route);
-    if (!held)
-        return fail('unknown prepared route');
-    assertNativeRouteCurrent(route);
-    assertNativeRuntime(input.execution.env, input.execution.flags);
-    if (input.execution.context.implementation !== held.profile.selection.archive)
-        fail('reading implementation differs');
-    nativeReferenceInputs(input.execution.context.inputs, route.inputs);
-    if (input.limits.timeoutMs > held.profile.port.timeoutMs || input.limits.responseBytes > held.profile.port.responseBytes)
-        fail('reader limits exceed current command grant');
-    const proof = rootAuthorityProtection(held.store), frame = { proof, archive: input.archive, locations: input.locations, requests: input.requests };
-    const args = [processOf('native'), held.store, held.coordinate, JSON.stringify(held.context), 'reserved', String(held.profile.selection.budget.bytes), 'act', String(process.pid), JSON.stringify(input.execution)];
-    const result = boundedProcess(process.execPath, args, JSON.stringify(frame), input.limits, input.execution.cwd, input.execution.env);
-    if (result.signal !== null || result.status !== 0)
-        throw new CapsuleProcessError('native child exited ' + String(result.status ?? result.signal), result);
-    let values;
-    try {
-        values = JSON.parse(result.stdout.trimEnd());
-    }
-    catch {
-        return fail('native child malformed batch');
-    }
-    if (!Array.isArray(values) || values.length !== input.requests.length || !values.every((value, index) => validResponse(value, input.requests[index])))
-        fail('native child invalid batch');
-    assertNativeRouteCurrent(route);
-    return values;
-}
-/** This predicate only schedules an outer lease. It grants no command. */
-export function declaredNativeReaderPorts(lines) { return lines.some(line => { const got = parse(line); return got.kind === 'fact' && got.value.fields.scope.startsWith('reader/') && got.value.fields.scope.split('/').at(-1) === 'port' && got.value.fields.value !== 'withdraw'; }); }
-export function prepareNativeReaderRoute(store, reader) {
-    const expectedScope = ['reader', reader.module, 'port'].join('/');
-    const declared = authenticatedRootStanding(dirname(store));
-    if (!declared.some(line => { const got = parse(line); return got.kind === 'fact' && got.value.fields.scope === expectedScope && got.value.fields.value !== 'withdraw'; }))
-        return undefined;
-    const proof = rootAuthorityProtection(store), currentRoot = currentNativeRoot(store, process.pid, proof), root = currentRoot.root;
-    const rows = root.live.filter(line => { const got = parse(line); return got.kind === 'fact' && got.value.fields.scope === expectedScope; });
-    if (!rows.length)
-        return undefined;
-    if (rows.length !== 1)
-        fail('ambiguous reader port ' + expectedScope);
-    const got = parse(rows[0]);
-    if (got.kind !== 'fact')
-        return fail('invalid reader port ' + expectedScope);
-    const f = got.value.fields;
-    if (f.role !== 'writes' || f.form !== 'alphabet' || f.measure !== 'id' || typeof f.value !== 'string' || !/^port\/[^\s]+$/.test(f.value))
-        fail('malformed reader port ' + expectedScope);
-    const auth = authorityFor(root.history, root.signer, root.eras), signed = auth.of(rows[0]);
-    if (signed.kind !== 'admitted' || signed.signer !== root.signer.id)
-        fail('reader port is not Root signed ' + expectedScope);
-    if (signed.kind !== 'admitted')
-        return fail('reader port signature not admitted');
-    const signer = auth.admitted.find(one => one.id === signed.signer);
-    if (!signer)
-        return fail('reader port signer absent');
-    const current = authorityAtEpoch(f, signer, root.epoch, expectedScope, 'authority');
-    if (current.kind !== 'admitted')
-        fail('reader port current eligibility ' + current.why);
-    return prepareAtCurrentRoot(store, f.value, rows[0], currentRoot);
-}
-export function nativeRouteStore(route) { const held = routes.get(route); if (!held)
-    return fail('unknown prepared route'); return held.store; }
-/** Quiet-pass gate: authenticate grants/cursor only, no image/materialization or
- * program execution. Historical --check remains its separate receipt path. */
-export function assertNativeReaderGrantsCurrent(store) { currentNativeReaderSelections(store); }
-/** Executable kinds come only from current authenticated Root declarations. A
- * matching JSON hint identifies a candidate, but is never permission to execute. */
-export function authenticatedNativeBinaries(root, profile) {
-    const out = [], names = new Set();
-    const keys = fieldNames;
-    for (const line of root.live) {
-        const row = parse(line);
-        if (row.kind !== 'fact' || !row.value.fields.scope.startsWith('port/'))
-            continue;
-        let hint;
-        try {
-            hint = JSON.parse(row.value.fields.about ?? '');
-        }
-        catch {
-            continue;
-        }
-        if (!['host-native-binary@1', 'host-native-binary-origin@1'].includes(hint?.profile) || hint.selector?.port !== profile.port.coordinate)
-            continue;
-        const coordinate = row.value.fields.scope, auth = authenticateSignedPort(root, coordinate), p = auth.profile;
-        if (keys(p) !== (p.profile === 'host-native-binary-origin@1' ? 'alias,condition,coordinate,entry,limits,origin,profile,selector' : 'alias,condition,coordinate,entry,limits,profile,selector') || p.coordinate !== coordinate || typeof p.alias !== 'string' || !p.alias.length || p.alias.includes('\0') || typeof p.condition !== 'string' || !p.condition.length || keys(p.selector ?? {}) !== 'binding,implementation,port' || p.selector.implementation !== profile.port.implementation || !profile.selection.bindings.some(b => b.id === p.selector.binding))
-            fail('binary declaration differs from selected parent ' + coordinate);
-        const entry = p.entry, member = profile.selection.members.find(m => m.coordinate === entry?.path);
-        if (keys(entry ?? {}) !== 'bytes,digest,path' || !member || entry.path === profile.selection.runtime || member.digest !== entry.digest || !Number.isSafeInteger(entry.bytes) || entry.bytes < 1 || keys(p.limits ?? {}) !== 'bytes' || !Number.isSafeInteger(p.limits.bytes) || p.limits.bytes < entry.bytes || p.limits.bytes > profile.selection.budget.bytes)
-            fail('binary outside selected image resources ' + coordinate);
-        if (names.has(coordinate))
-            fail('ambiguous binary declaration ' + coordinate);
-        names.add(coordinate);
-        if (entry.digest === profile.selection.members.find(m => m.coordinate === profile.selection.runtime)?.digest)
-            fail('binary aliases selected runtime');
-        const origin = nativeBinaryOrigin(root, p, auth.line);
-        if (origin?.path === realpathSync(process.execPath))
-            fail('binary origin aliases actual runtime');
-        out.push(Object.freeze({ line: auth.line, coordinate, profile: p, ...(origin ? { origin } : {}) }));
-    }
-    return Object.freeze(out);
-}
-/** Same semantic image identity for preparation, retained mount and quiet checks. */
-export function nativeMountIdentity(profile, binaries, control) { return hash(canonicalJson(['logical-native-image/2', profile.selection, binaries, ...(control ? [control] : [])])); }
-/** Current eligibility only: no executor graph, image load or materialization. */
-export function currentNativeReaderSelections(store) {
-    const declared = authenticatedRootStanding(dirname(store));
-    if (!declaredNativeReaderPorts(declared))
-        return [];
-    const proof = rootAuthorityProtection(store), currentRoot = currentNativeRoot(store, process.pid, proof), root = currentRoot.root;
-    const mappings = root.live.flatMap(line => { const row = parse(line); return row.kind === 'fact' && row.value.fields.scope.startsWith('reader/') && row.value.fields.scope.split('/').at(-1) === 'port' ? [{ line, fields: row.value.fields }] : []; });
-    const seen = new Set(), auth = authorityFor(root.history, root.signer, root.eras), out = [];
-    for (const { line, fields: f } of mappings) {
-        if (seen.has(f.scope))
-            fail('ambiguous reader port ' + f.scope);
-        seen.add(f.scope);
-        if (f.role !== 'writes' || f.form !== 'alphabet' || f.measure !== 'id' || typeof f.value !== 'string' || !/^port\/[^\s]+$/.test(f.value))
-            fail('malformed reader port ' + f.scope);
-        const signed = auth.of(line);
-        if (signed.kind !== 'admitted' || signed.signer !== root.signer.id)
-            fail('reader port is not Root signed ' + f.scope);
-        if (signed.kind !== 'admitted')
-            return fail('reader mapping not admitted');
-        const signer = auth.admitted.find(one => one.id === signed.signer);
-        if (!signer)
-            return fail('reader mapping signer absent');
-        const current = authorityAtEpoch(f, signer, root.epoch, f.scope, 'authority');
-        if (current.kind !== 'admitted')
-            fail('reader port current eligibility ' + current.why);
-        const { profile } = authenticateNativeProfile(root, f.value);
-        const control = selectedHostControl(root, profile);
-        out.push({ profile, binaries: authenticatedNativeBinaries(root, profile), ...(control ? { control } : {}) });
-    }
-    return out;
-}
-export function currentNativeReaderProfiles(store) { return currentNativeReaderSelections(store).map(selection => selection.profile); }
+var q=Object.defineProperty;var m=(t,e)=>q(t,"name",{value:e,configurable:!0});import{fieldNames as M}from"./reading.js";import{sha256 as b}from"../hash.js";import{dirname as O}from"node:path";import{realpathSync as W}from"node:fs";import{nativeBinaryOrigin as F}from"./native-binary.js";import{selectedHostControl as R}from"./control-selection.js";import{library14_authorityAtEpoch as P}from"../../vendor/runtime.js";import{parsedLine as x}from"../../fold/claims.js";import{authorityFor as E}from"../../fold/signers.js";import{authenticatedRootStanding as j}from"../admitted-place.js";import{nativeExecutorInputs as $}from"./materialize.js";import{materializeNativeRoute as Se}from"./materialize.js";import{assertNativeRuntime as G}from"./runtime.js";import{nativeReferenceInputs as H}from"./references.js";import{rootAuthorityProtection as w}from"../../land/act.js";import{currentNativeRoot as N,inheritedNativeRoot as L}from"./root.js";import{authenticateSignedPort as z,authenticateNativeProfile as A,canonicalJson as y}from"./reading.js";import{boundedProcess as U}from"../process-lifetime.js";import{validResponse as _,CapsuleProcessError as D}from"../capsule-process.js";import{processOf as K}from"../../observe/runner.js";const s=m(t=>{throw Error("REFUSE\xB7native route "+t)},"fail"),k=new WeakMap;function Q(t){const e=new Map,i=[];for(const f of t){if(!f.origin)continue;const o="native/binary-origin/"+f.origin.coordinate,g=b(f.origin.line),a=e.get(o);if(a!==void 0){a!==g&&s("conflicting binary origin input "+o);continue}e.set(o,g),i.push([o,g])}return Object.freeze(i)}m(Q,"nativeBinaryOriginInputs");function he(t,e,i){const f=w(t),o=N(t,process.pid,f);return I(t,e,i,o)}m(he,"prepareNativeRoute");function I(t,e,i,f){const{root:o,context:g}=f,a=A(o,e),c=a.profile,l=S(o,c),n=R(o,c),r=b(y([e,a.line,c,l,i??null,...n?[n]:[]])),d=[["native/selection",r],...i?[["native/reader-mapping",b(i)]]:[],...c.selection.members.map(p=>["native/"+p.coordinate,p.digest]),...l.map(p=>["native/binary/"+p.coordinate,b(p.line)])];d.push(...Q(l)),n&&d.push(["native/control-profile",b(n.line)],["native/control-worker",n.profile.worker.digest],["native/control-runtime",n.profile.runtime.digest]);const h={identity:r,profile:c,binaries:l,...n?{control:n}:{},inputs:d};return k.set(h,{store:t,coordinate:e,context:g,profile:c}),d.push(...$(h)),n&&d.find(([p])=>p===n.profile.worker.coordinate)?.[1]!==n.profile.worker.digest&&s("control worker differs from sealed executor"),Object.freeze(d),Object.freeze(h)}m(I,"prepareAtCurrentRoot");function J(t){const e=k.get(t);if(!e)return s("unknown prepared route");const i=w(e.store),f=L({store:e.store,parent:process.pid,expected:e.context},i),o=z(f,e.coordinate).profile;(y(o)!==y(e.profile)||y(S(f,e.profile))!==y(t.binaries)||y(R(f,e.profile)??null)!==y(t.control??null))&&s("current port changed")}m(J,"assertNativeRouteCurrent");function ve(t,e){const i=k.get(t);if(!i)return s("unknown prepared route");J(t),G(e.execution.env,e.execution.flags),e.execution.context.implementation!==i.profile.selection.archive&&s("reading implementation differs"),H(e.execution.context.inputs,t.inputs),(e.limits.timeoutMs>i.profile.port.timeoutMs||e.limits.responseBytes>i.profile.port.responseBytes)&&s("reader limits exceed current command grant");const f=w(i.store),o={proof:f,archive:e.archive,locations:e.locations,requests:e.requests},g=[K("native"),i.store,i.coordinate,JSON.stringify(i.context),"reserved",String(i.profile.selection.budget.bytes),"act",String(process.pid),JSON.stringify(e.execution)],a=U(process.execPath,g,JSON.stringify(o),e.limits,e.execution.cwd,e.execution.env);if(a.signal!==null||a.status!==0)throw new D("native child exited "+String(a.status??a.signal),a);let c;try{c=JSON.parse(a.stdout.trimEnd())}catch{return s("native child malformed batch")}return(!Array.isArray(c)||c.length!==e.requests.length||!c.every((l,n)=>_(l,e.requests[n])))&&s("native child invalid batch"),J(t),c}m(ve,"invokeNativeRoute");function T(t){return t.some(e=>{const i=x(e);return i.kind==="fact"&&i.value.fields.scope.startsWith("reader/")&&i.value.fields.scope.split("/").at(-1)==="port"&&i.value.fields.value!=="withdraw"})}m(T,"declaredNativeReaderPorts");function ye(t,e){const i=["reader",e.module,"port"].join("/");if(!j(O(t)).some(u=>{const v=x(u);return v.kind==="fact"&&v.value.fields.scope===i&&v.value.fields.value!=="withdraw"}))return;const o=w(t),g=N(t,process.pid,o),a=g.root,c=a.live.filter(u=>{const v=x(u);return v.kind==="fact"&&v.value.fields.scope===i});if(!c.length)return;c.length!==1&&s("ambiguous reader port "+i);const l=x(c[0]);if(l.kind!=="fact")return s("invalid reader port "+i);const n=l.value.fields;(n.role!=="writes"||n.form!=="alphabet"||n.measure!=="id"||typeof n.value!="string"||!/^port\/[^\s]+$/.test(n.value))&&s("malformed reader port "+i);const r=E(a.history,a.signer,a.eras),d=r.of(c[0]);if((d.kind!=="admitted"||d.signer!==a.signer.id)&&s("reader port is not Root signed "+i),d.kind!=="admitted")return s("reader port signature not admitted");const h=r.admitted.find(u=>u.id===d.signer);if(!h)return s("reader port signer absent");const p=P(n,h,a.epoch,i,"authority");return p.kind!=="admitted"&&s("reader port current eligibility "+p.why),I(t,n.value,c[0],g)}m(ye,"prepareNativeReaderRoute");function be(t){const e=k.get(t);return e?e.store:s("unknown prepared route")}m(be,"nativeRouteStore");function xe(t){B(t)}m(xe,"assertNativeReaderGrantsCurrent");function S(t,e){const i=[],f=new Set,o=M;for(const g of t.live){const a=x(g);if(a.kind!=="fact"||!a.value.fields.scope.startsWith("port/"))continue;let c;try{c=JSON.parse(a.value.fields.about??"")}catch{continue}if(!["host-native-binary@1","host-native-binary-origin@1"].includes(c?.profile)||c.selector?.port!==e.port.coordinate)continue;const l=a.value.fields.scope,n=z(t,l),r=n.profile;(o(r)!==(r.profile==="host-native-binary-origin@1"?"alias,condition,coordinate,entry,limits,origin,profile,selector":"alias,condition,coordinate,entry,limits,profile,selector")||r.coordinate!==l||typeof r.alias!="string"||!r.alias.length||r.alias.includes("\0")||typeof r.condition!="string"||!r.condition.length||o(r.selector??{})!=="binding,implementation,port"||r.selector.implementation!==e.port.implementation||!e.selection.bindings.some(u=>u.id===r.selector.binding))&&s("binary declaration differs from selected parent "+l);const d=r.entry,h=e.selection.members.find(u=>u.coordinate===d?.path);(o(d??{})!=="bytes,digest,path"||!h||d.path===e.selection.runtime||h.digest!==d.digest||!Number.isSafeInteger(d.bytes)||d.bytes<1||o(r.limits??{})!=="bytes"||!Number.isSafeInteger(r.limits.bytes)||r.limits.bytes<d.bytes||r.limits.bytes>e.selection.budget.bytes)&&s("binary outside selected image resources "+l),f.has(l)&&s("ambiguous binary declaration "+l),f.add(l),d.digest===e.selection.members.find(u=>u.coordinate===e.selection.runtime)?.digest&&s("binary aliases selected runtime");const p=F(t,r,n.line);p?.path===W(process.execPath)&&s("binary origin aliases actual runtime"),i.push(Object.freeze({line:n.line,coordinate:l,profile:r,...p?{origin:p}:{}}))}return Object.freeze(i)}m(S,"authenticatedNativeBinaries");function we(t,e,i){return b(y(["logical-native-image/2",t.selection,e,...i?[i]:[]]))}m(we,"nativeMountIdentity");function B(t){const e=j(O(t));if(!T(e))return[];const i=w(t),f=N(t,process.pid,i),o=f.root,g=o.live.flatMap(n=>{const r=x(n);return r.kind==="fact"&&r.value.fields.scope.startsWith("reader/")&&r.value.fields.scope.split("/").at(-1)==="port"?[{line:n,fields:r.value.fields}]:[]}),a=new Set,c=E(o.history,o.signer,o.eras),l=[];for(const{line:n,fields:r}of g){a.has(r.scope)&&s("ambiguous reader port "+r.scope),a.add(r.scope),(r.role!=="writes"||r.form!=="alphabet"||r.measure!=="id"||typeof r.value!="string"||!/^port\/[^\s]+$/.test(r.value))&&s("malformed reader port "+r.scope);const d=c.of(n);if((d.kind!=="admitted"||d.signer!==o.signer.id)&&s("reader port is not Root signed "+r.scope),d.kind!=="admitted")return s("reader mapping not admitted");const h=c.admitted.find(C=>C.id===d.signer);if(!h)return s("reader mapping signer absent");const p=P(r,h,o.epoch,r.scope,"authority");p.kind!=="admitted"&&s("reader port current eligibility "+p.why);const{profile:u}=A(o,r.value),v=R(o,u);l.push({profile:u,binaries:S(o,u),...v?{control:v}:{}})}return l}m(B,"currentNativeReaderSelections");function ke(t){return B(t).map(e=>e.profile)}m(ke,"currentNativeReaderProfiles");export{xe as assertNativeReaderGrantsCurrent,J as assertNativeRouteCurrent,S as authenticatedNativeBinaries,ke as currentNativeReaderProfiles,B as currentNativeReaderSelections,T as declaredNativeReaderPorts,ve as invokeNativeRoute,Se as materializeNativeRoute,Q as nativeBinaryOriginInputs,we as nativeMountIdentity,be as nativeRouteStore,ye as prepareNativeReaderRoute,he as prepareNativeRoute};

package/dist/host/native/runtime.js

@@ -1,9 +1 @@
-/** Environment identity is not permission to bootstrap arbitrary executable
- * preloads. The fixed native entry currently has no ambient loader contract.
- */
-export function assertNativeRuntime(environment, flags) {
-    if ((environment.NODE_OPTIONS ?? '').trim() !== '')
-        throw Error('REFUSE·native runtime NODE_OPTIONS has no fixed verified loader configuration');
-    if (flags.length)
-        throw Error('REFUSE·native runtime startup flags differ from the fixed dispatcher');
-}
+var e=Object.defineProperty;var t=(r,i)=>e(r,"name",{value:i,configurable:!0});function n(r,i){if((r.NODE_OPTIONS??"").trim()!=="")throw Error("REFUSE\xB7native runtime NODE_OPTIONS has no fixed verified loader configuration");if(i.length)throw Error("REFUSE\xB7native runtime startup flags differ from the fixed dispatcher")}t(n,"assertNativeRuntime");export{n as assertNativeRuntime};

package/dist/host/native-place-state.js

@@ -0,0 +1 @@
+var i=Object.defineProperty;var o=(t,r)=>i(t,"name",{value:r,configurable:!0});import{existsSync as n}from"node:fs";import{storeOf as e}from"../land/ledger.js";import{admissionAnchor as a}from"../fold/admission-history.js";import{authenticatedStanding as m}from"./admitted-place.js";import{BoundRefusal as f}from"./refusals.js";function S(t){if(!n(e(t)))return"birth";try{if(a(t),!m(t).length)throw Error("no admitted history");return"admitted"}catch{throw new f("host/foundation-state","REFUSE\xB7host/foundation-state")}}o(S,"nativePlaceState");export{S as nativePlaceState};

package/dist/host/native-reader-context.js

@@ -1,8 +1 @@
-import { AsyncLocalStorage } from 'node:async_hooks';
-// An opaque instrument selection travels with one observation. A request or a
-// world's response cannot select its executor or replace another reader's port.
-const active = new AsyncLocalStorage();
-export const nativeReaderRoute = active.getStore.bind(active);
-export function withNativeReaderRoute(route, run) {
-    return route === undefined ? run() : active.run(route, run);
-}
+var r=Object.defineProperty;var o=(e,t)=>r(e,"name",{value:t,configurable:!0});import{AsyncLocalStorage as i}from"node:async_hooks";const n=new i,d=n.getStore.bind(n);function u(e,t){return e===void 0?t():n.run(e,t)}o(u,"withNativeReaderRoute");export{d as nativeReaderRoute,u as withNativeReaderRoute};

package/dist/host/native-receiver.js

@@ -1,25 +1 @@
-import { readFileSync, realpathSync } from 'node:fs';
-import { basename, dirname, extname, isAbsolute, join, relative } from 'node:path';
-import { publicLock } from '@lapxo/topos/wire';
-import { foldClaims, wireLinesOf } from "../fold/claims.js";
-import { declaredRootClockSource } from "./root-clock-source.js";
-import { withHostCall } from "./call-context.js";
-import { BoundRefusal } from "./refusals.js";
-/** Explicit installed/source ESM selection, never consumer argv or packet data.
- * Identity and public configuration do not certify implementation correctness. */
-export function nativeHostInstrument(root, entry) {
-    const at = realpathSync(root), file = realpathSync(entry), inside = relative(at, file), extension = extname(file);
-    if (!isAbsolute(root) || !isAbsolute(entry) || inside.startsWith('..') || isAbsolute(inside) || !['.ts', '.js'].includes(extension))
-        throw new BoundRefusal('host/context', 'REFUSE·host/context');
-    const published = publicLock(wireLinesOf(readFileSync(join(at, 'TARGET.bound'), 'utf8')));
-    if (!published)
-        throw new BoundRefusal('host/context', 'REFUSE·host requires a public instrument lock');
-    return { name: basename(at), runtime: { root: at, entry: file, directory: dirname(dirname(file)), extension: extension, lock: foldClaims(published).standing } };
-}
-/** Bind existing native authority construction to an explicit instrument for
- * every later current/historical observation, not only the constructor call. */
-export function nativePlaceActReceiver(root, instrument) {
-    const call = { instrumentName: instrument.name, runtime: structuredClone(instrument.runtime), output: () => { } };
-    const selected = withHostCall(call, () => declaredRootClockSource(root)), original = selected.trust;
-    return { selection: selected.selection, trust: { ...original, current: () => withHostCall(call, () => original.current()), historical: (encoded) => withHostCall(call, () => original.historical(encoded)) } };
-}
+var b=Object.defineProperty;var o=(e,i)=>b(e,"name",{value:i,configurable:!0});import{readFileSync as x,realpathSync as c}from"node:fs";import{basename as w,dirname as p,extname as v,isAbsolute as a,join as E,relative as C}from"node:path";import{library14_publicLock as R}from"../vendor/runtime.js";import{foldClaims as k,wireLinesOf as S}from"../fold/claims.js";import{declaredRootClockSource as I}from"./root-clock-source.js";import{withHostCall as m}from"./call-context.js";import{BoundRefusal as d}from"./refusals.js";import{installedPackageIdentity as g}from"./native/installed-package.js";let y;function F(e,i){const t=c(e),n=c(i),r=C(t,n),s=v(n);if(!a(e)||!a(i)||r.startsWith("..")||a(r)||![".ts",".js"].includes(s))throw new d("host/context","REFUSE\xB7host/context");const l=x(E(t,"TARGET.bound"),"utf8"),u=y;if(u?.root===t&&u.file===n&&u.text===l)return structuredClone(u.value);const f=R(S(l));if(!f?.length)throw new d("host/context","REFUSE\xB7host requires a public instrument lock");const h={name:w(t),runtime:{root:t,entry:n,directory:p(p(n)),extension:s,lock:k(f).standing}};return Buffer.byteLength(l)<=2*1024*1024&&(y={root:t,file:n,text:l,value:structuredClone(h)}),h}o(F,"nativeHostInstrument");function G(e,i){const t={instrumentName:i.name,runtime:structuredClone(i.runtime),output:o(()=>{},"output")},n=m(t,()=>I(e)),r=n.trust;return{selection:n.selection,trust:{...r,current:o(()=>m(t,()=>r.current()),"current"),historical:o(s=>m(t,()=>r.historical(s)),"historical")}}}o(G,"nativePlaceActReceiver");function N(e,i){const t=e.limits?.signal,n=structuredClone({...e,limits:{...e.limits,signal:void 0}}),r={...n,limits:{...n.limits,...t?{signal:t}:{}}},s=g(r);return{...F(r.directory,i),digest:s.digest,installed:{digest:s.digest,request:r}}}o(N,"installedHostInstrument");function O(e,i){try{const t=e.installed;if(!t||!/^sha256:[a-f0-9]{64}$/.test(i)||t.digest!==i||c(t.request.directory)!==c(e.runtime.root)||g(t.request).digest!==i)throw Error("installed pin differs")}catch{throw new d("host/instrument-pin","REFUSE\xB7host/instrument-pin")}}o(O,"verifyHostInstrument");export{N as installedHostInstrument,F as nativeHostInstrument,G as nativePlaceActReceiver,O as verifyHostInstrument};

package/dist/host/objects.js

@@ -1,38 +1 @@
-import { canonical, parse, objectHistory, validateObjectContext } from '@lapxo/topos/wire';
-import { objectProvider } from '@lapxo/topos/object-provider';
-import { authorityFor, rootSigner } from "../fold/signers.js";
-import { signaturesOf } from "../fold/digests.js";
-import { storeOf } from "../land/ledger.js";
-import { toposAt, contextModuleAt } from "./selected-topos.js";
-import { foldClaims } from "../fold/claims.js";
-import { usesWasmObject } from "../wasm/object.js";
-/** Bound supplies host authority and I/O; topos owns grammar, selection and context validation. */
-export async function admittedObjects(root, lines, emit = () => { }, requireContextClosure = false) {
-    const history = objectHistory(lines);
-    if (history.kind !== 'fact')
-        throw Error(`REFUSE·wire ${history.why}`);
-    const authority = authorityFor(lines, rootSigner(root), signaturesOf(storeOf(root)).admitted);
-    const admittedConfiguration = history.value.configuration.filter(fields => authority.of(canonical(fields)).kind === 'admitted').map(fields => canonical(fields));
-    const configuration = foldClaims(admittedConfiguration).standing.flatMap(line => { const got = parse(line); return got.kind === 'fact' ? [got.value.fields] : []; });
-    const verifyClosure = requireContextClosure || usesWasmObject(configuration), declaredModules = new Map();
-    const context = await objectProvider(history.value.objects, history.value.configuration, { admit: fields => authority.of(canonical(fields)).kind === 'admitted', emit, topos: digest => {
-            const selected = toposAt(digest, storeOf(root));
-            if (verifyClosure)
-                for (const offer of selected.parts.filter(fields => fields.kind === 'check' && fields.value)) {
-                    const dependencies = [...new Set((offer.restsOn ?? '').split('|').filter(Boolean))].sort(), prior = declaredModules.get(offer.value);
-                    if (prior && JSON.stringify(prior) !== JSON.stringify(dependencies))
-                        throw Error('REFUSE·context module has conflicting declared closures');
-                    declaredModules.set(offer.value, dependencies);
-                }
-            return selected;
-        }, module: digest => {
-            const dependencies = declaredModules.get(digest);
-            if (verifyClosure && dependencies === undefined)
-                throw Error('REFUSE·context module has no declared closure');
-            return contextModuleAt(digest, storeOf(root), verifyClosure ? dependencies : undefined);
-        } });
-    const checked = validateObjectContext(history.value.objects, context);
-    if (checked.kind !== 'fact')
-        throw Error(`REFUSE·context ${checked.why}`);
-    return { records: checked.value, context, configuration };
-}
+var b=Object.defineProperty;var e=(r,i)=>b(r,"name",{value:i,configurable:!0});import{library14_canonical as n,library14_parse as p,library14_objectHistory as y,library14_validateObjectContext as v}from"../vendor/runtime.js";import{objectProvider as g}from"../vendor/object-provider.js";import{authorityFor as h,rootSigner as j}from"../fold/signers.js";import{signaturesOf as x}from"../fold/digests.js";import{storeOf as d}from"../land/ledger.js";import{contextProviderServices as k}from"./selected-topos.js";import{foldClaims as w}from"../fold/claims.js";async function U(r,i,m=()=>{},C=!1){const o=y(i);if(o.kind!=="fact")throw Error(`REFUSE\xB7wire ${o.why}`);const c=h(i,j(r),x(d(r)).admitted),l=o.value.configuration.filter(t=>c.of(n(t)).kind==="admitted").map(t=>n(t)),u=w(l).standing.flatMap(t=>{const f=p(t);return f.kind==="fact"?[f.value.fields]:[]}),s=await g(o.value.objects,o.value.configuration,{admit:e(t=>c.of(n(t)).kind==="admitted","admit"),emit:m,...k(d(r))}),a=v(o.value.objects,s);if(a.kind!=="fact")throw Error(`REFUSE\xB7context ${a.why}`);return{records:a.value,context:s,configuration:u}}e(U,"admittedObjects");export{U as admittedObjects};

package/dist/host/order.js

@@ -1,2 +1 @@
-/** Locale-independent UTF-16 code-unit ordering, shared by host delivery formats. */
-export const compareStrings = (a, b) => a < b ? -1 : a > b ? 1 : 0;
+var c=Object.defineProperty;var t=(o,r)=>c(o,"name",{value:r,configurable:!0});const n=t((o,r)=>o<r?-1:o>r?1:0,"compareStrings");export{n as compareStrings};

package/dist/host/persistent-host.js

@@ -0,0 +1 @@
+var A=Object.defineProperty;var u=(t,i)=>A(t,"name",{value:i,configurable:!0});import{spawn as C}from"node:child_process";import{mkdtempSync as D,rmSync as N,realpathSync as V}from"node:fs";import{tmpdir as K}from"node:os";import{join as Q,basename as W}from"node:path";import{BoundRefusal as s}from"./refusals.js";import{nativePlaceState as X}from"./native-place-state.js";import{invokeSigningPort as Y}from"../engine/ports.js";import{verifyHostInstrument as T}from"./native-receiver.js";function Z(t){return Object.fromEntries(Object.entries(t).filter(i=>i[1]!==void 0&&!/^(NODE_|UV_)/.test(i[0])))}u(Z,"nativeHostEnvironment");const b=new Set;async function ce(t){T(t.instrument,t.expectedInstrument);const i=V(t.place),o={...t.limits};X(i);const a=new Map(t.signers??[]);if(t.signer){if(a.has(t.signer.keyId))throw new s("host/context","REFUSE\xB7host/context");a.set(t.signer.keyId,{name:t.signer.name,sign:t.signer.sign})}for(const[e,r]of a)if(typeof e!="string"||!e||typeof r.name!="string"||!r.name||typeof r.sign!="function")throw new s("host/context","REFUSE\xB7host/context");for(const e of Object.values(o))if(!Number.isSafeInteger(e)||e<1)throw new s("host/budget","REFUSE\xB7host/budget");if(o.timeoutMs>2147483647||o.heapMiB<16||o.heapMiB>4096)throw new s("host/budget","REFUSE\xB7host/budget");if(b.has(i))throw new s("host/busy","REFUSE\xB7host/busy");b.add(i);const R=Object.freeze(Z(t.environment)),v=Object.freeze(["--max-old-space-size="+o.heapMiB]),g=D(Q(t.scratchParent??K(),"bound-native-host-"));let n;try{n=C(process.execPath,[...v,t.instrument.runtime.entry],{cwd:i,env:R,stdio:["ignore","pipe","pipe","ipc"],serialization:"advanced",shell:!1})}catch(e){throw b.delete(i),N(g,{recursive:!0,force:!0}),e}let m=!1,z=0,y=0,w=0,k=Promise.resolve(),d,U,h;const L=new Promise((e,r)=>{U=e,h=r});let x;const F=new Promise(e=>{x=e}),B=u(()=>{m=!0,b.delete(i),N(g,{recursive:!0,force:!0}),d?.abort.abort(),d?.dispose(),d?.reject(new s("host/closed","REFUSE\xB7host/closed")),d=void 0,x()},"cleanup");n.once("error",e=>{h(e),B()}),n.once("exit",()=>{h(new s("host/closed","REFUSE\xB7host/closed")),B()});let I=0;const M=u(e=>{I+=e.length,I>o.responseBytes&&n.kill("SIGTERM")},"drain");n.stdout.on("data",M),n.stderr.on("data",M),n.on("message",async e=>{if(e?.kind==="ready"){U();return}const r=d;if(!(!r||e?.id!==r.id)){if(e.kind==="sign"){try{if(e.lot?.keyId!==r.signer)throw new s("host/signer-mismatch","REFUSE\xB7host/signer-mismatch");const c=r.signer===void 0?void 0:a.get(r.signer);if(!c)throw new s("host/unbound-signer","REFUSE\xB7host/unbound-signer");const f=await Y(e.lot,c.sign,{timeoutMs:o.timeoutMs,maxBytes:o.responseBytes},r.abort.signal);n.connected&&n.send({kind:"signed",id:r.id,records:f})}catch(c){n.connected&&n.send({kind:"signed",id:r.id,error:{code:c instanceof s?c.code:"host-port/failed"}})}return}if(e.kind==="result"){if(r.dispose(),d=void 0,typeof e.stdout!="string"||typeof e.stderr!="string"||!Number.isSafeInteger(e.status)||Buffer.byteLength(e.stdout)+Buffer.byteLength(e.stderr)>o.responseBytes){r.reject(new s("host/budget","REFUSE\xB7host/budget"));return}r.resolve({status:e.status,stdout:e.stdout,stderr:e.stderr})}}});const G=setTimeout(()=>{h(new s("host/timeout","REFUSE\xB7host/timeout")),n.kill("SIGTERM")},o.timeoutMs);n.send({kind:"configure",place:i,scratch:g,limits:o,instrumentName:W(t.instrument.runtime.root),instrumentRoot:t.instrument.runtime.root});try{await L,T(t.instrument,t.expectedInstrument)}catch(e){throw n.kill("SIGTERM"),await F,e}finally{clearTimeout(G)}return{pid:n.pid,environment:R,flags:v,request(e,r){const c=JSON.stringify(e),f=Buffer.byteLength(c);if(y>=o.queuedRequests||w+f>o.requestBytes)return Promise.reject(new s("host/budget","REFUSE\xB7host/budget"));const q=JSON.parse(c);y++,w+=f;const H=u(()=>new Promise((J,E)=>{if(m||!n.connected){E(new s("host/closed","REFUSE\xB7host/closed"));return}if(r?.aborted){E(new s("host/cancelled","REFUSE\xB7host/cancelled"));return}const p=++z,j=new AbortController,S=u(()=>{j.abort(),n.connected&&n.send({kind:"cancel",id:p})},"cancel"),_=setTimeout(S,o.timeoutMs);r?.addEventListener("abort",S,{once:!0});const l=q.signer,O=l===void 0?void 0:a.get(l);d={id:p,signer:l,resolve:J,reject:E,abort:j,dispose:u(()=>{clearTimeout(_),r?.removeEventListener("abort",S)},"dispose")},n.send({kind:"request",id:p,command:q,...l!==void 0||a.size?{signer:{keyId:l??"",name:O?.name??"",bound:!!O}}:{}})}),"run"),P=k.then(H).finally(()=>{y--,w-=f});return k=P.catch(()=>{}),P},async close(){m||(m=!0,d?.abort.abort(),n.connected&&n.send({kind:"close"})),await F}}}u(ce,"startNativeHost");export{Z as nativeHostEnvironment,ce as startNativeHost};

package/dist/host/physical-lines.d.ts

@@ -0,0 +1 @@
+export {public5_PhysicalLinesPlaceInput as PhysicalLinesPlaceInput,public5_PhysicalLinesPolicy as PhysicalLinesPolicy,public5_PhysicalLinesReading as PhysicalLinesReading,public5_PhysicalLinesRegion as PhysicalLinesRegion,public5_PhysicalLinesWitnessAuthority as PhysicalLinesWitnessAuthority,public5_ReadingProducerPolicy as ReadingProducerPolicy,public5_authenticatePhysicalLinesWitness as authenticatePhysicalLinesWitness,public5_judgePhysicalLines as judgePhysicalLines,public5_physicalLinesRegions as physicalLinesRegions,public5_readPlacePhysicalLines as readPlacePhysicalLines} from "../public-types.js";

package/dist/host/physical-lines.js

@@ -0,0 +1 @@
+var $=Object.defineProperty;var w=(e,t)=>$(e,"name",{value:t,configurable:!0});import{BoundRefusal as k}from"./refusals.js";import{sha256 as h,isSha256 as G}from"./hash.js";import{lstatSync as j,opendirSync as K,readSync as T,realpathSync as A,openSync as X,closeSync as Q,fstatSync as V,constants as M}from"node:fs";import{join as W,relative as Z,resolve as ee,sep as R}from"node:path";import{library5_PHYSICAL_LINES_PROFILE as D,library5_PHYSICAL_LINES_MODEL as C,library5_readPhysicalLines as J,library5_encodeReadingWitness as te,library5_decodeReadingWitness as ne,library5_readingWitnessStatementBytes as re}from"../vendor/runtime.js";import{library14_canonical as se,library14_byBytes as P,library14_steps as Y}from"../vendor/runtime.js";import{fieldOf as c,fieldsOf as ie}from"../fold/claims.js";import{foldCeilings as oe}from"../fold/ceilings.js";import{widenedWithoutWitness as ae}from"../judge/widening.js";const x=new WeakSet;function U(e){if(e&&typeof e=="object"){Object.freeze(e);for(const t of Object.values(e))U(t)}return e}w(U,"freeze");const a=w(e=>{const t=e.split("/")[0],o=["inventory-policy","inventory-boundary","context","run","outside-inventory","inventory-size"].includes(t)?"context":["region-declaration","region-selectors"].includes(t)?"selection":["inventory-moved","per-file-reading","witness-binding"].includes(t)?"integrity":t==="actual-reading-required"||t.startsWith("witness-")?"witness":"failed";throw new k("physical-lines/"+o,"REFUSE\xB7physical-lines/"+e)},"fail"),ce=w(e=>typeof e=="string"&&e.length>0&&!e.includes("\\")&&!/[\u0000-\u001f\u007f]/.test(e)&&e.split("/").every(t=>t!==""&&t!=="."&&t!==".."&&!t.includes("*")),"named");function Se(e){const t=e.filter(o=>c(o,"scope").startsWith("region/")&&c(o,"measure")==="coordinates"&&c(o,"value")!=="withdraw");return e.filter(o=>c(o,"role")==="reads"&&c(o,"form")==="interval"&&["lines","file-lines"].includes(c(o,"measure"))).map(o=>{const r=c(o,"scope"),u=Y(r),i=u.length>1&&u.at(-1)==="lines"?Y(u.slice(0,-1)):r,l=t.filter(s=>c(s,"scope")==="region/"+i);if(l.length!==1)return a("region-declaration/"+r);const B=c(l[0],"value").split("|").filter(Boolean);return B.length?{scope:r,selectors:B}:a("region-selectors/"+r)})}w(Se,"physicalLinesRegions");function Be(e){try{return le(e)}catch(t){throw t instanceof k?t:new k("physical-lines/failed","REFUSE\xB7physical-lines/failed "+(t instanceof Error?t.message:"native inventory unavailable"))}}w(Be,"readPlacePhysicalLines");function le(e){if(!e||!e.policy||!Number.isSafeInteger(e.policy.entryBudget)||e.policy.entryBudget<0||!/^\d+$/.test(e.policy.byteBudget)||!/^\d+$/.test(e.policy.rowBudget))return a("inventory-policy");if(!Array.isArray(e.inventory)||!e.inventory.length||!e.inventory.every(ce)||new Set(e.inventory).size!==e.inventory.length)return a("inventory-boundary");for(const n of[e.context,e.reader,e.implementation])if(!G(n))return a("context");if(typeof e.run!="string"||!e.run||/\s/.test(e.run))return a("run");const t=A(e.root),o=[],r=new Set;let u=0,i=0n;const l=[];function B(n){if(r.has(n))return;if(r.add(n),++u>e.policy.entryBudget){l.push({name:n,cause:"entry-budget"});return}const g=ee(t,n),N=Z(t,g);if(N===".."||N.startsWith(".."+R))return a("outside-inventory");let d;try{d=j(g)}catch{l.push({name:n,cause:"inventory-absent"});return}if(d.isSymbolicLink()){l.push({name:n,cause:"inventory-link"});return}if(d.isDirectory()){const O=K(g),S=[];try{let b;for(;(b=O.readSync())!==null;){if(S.length>=e.policy.entryBudget-u){l.push({name:W(n,b.name).split(R).join("/"),cause:"entry-budget"});return}S.push(b.name)}}finally{O.closeSync()}S.sort(P);for(const b of S){if(u>=e.policy.entryBudget){l.push({name:W(n,b).split(R).join("/"),cause:"entry-budget"});break}B(W(n,b).split(R).join("/"))}const m=j(g);if(m.isSymbolicLink()||d.dev!==m.dev||d.ino!==m.ino||d.mtimeMs!==m.mtimeMs)return a("inventory-moved")}else if(d.isFile()){if(!Number.isSafeInteger(d.size)||d.size<0)return a("inventory-size");if(i+BigInt(d.size)>BigInt(e.policy.byteBudget)){l.push({name:n,cause:"byte-budget"});return}if(A(g)!==g)return a("inventory-link");const O=X(g,M.O_RDONLY|M.O_NOFOLLOW);let S,m;try{const b=Buffer.alloc(d.size+1);let _=0,F=0;for(;_<b.length&&(F=T(O,b,_,b.length-_,null))>0;)_+=F;S=b.subarray(0,_),m=V(O)}finally{Q(O)}if(m.isSymbolicLink()||d.dev!==m.dev||d.ino!==m.ino||d.size!==m.size||d.mtimeMs!==m.mtimeMs||S.length!==m.size||(i+=BigInt(S.length),i>BigInt(e.policy.byteBudget)))return a("inventory-moved");o.push({name:n,digest:h(S),bytes:S})}else l.push({name:n,cause:"inventory-special-file"})}w(B,"visit");for(const n of[...e.inventory].sort(P))B(n);if(l.length)return{status:"unmeasured",cause:"inventory-incomplete",unavailable:l};o.sort((n,g)=>P(n.name,g.name));const s=h(JSON.stringify(o.map(({name:n,digest:g})=>({name:n,digest:g})))),f=J({profile:D,snapshot:s,files:o,regions:e.regions,policy:{byteBudget:e.policy.byteBudget,rowBudget:e.policy.rowBudget}},h);if(f.status!=="read")return f;const p=h(JSON.stringify(f.regions.map(({scope:n,selectors:g,selections:N,members:d})=>({scope:n,selectors:g,selections:N,members:d})))),L=h(JSON.stringify({inventory:[...e.inventory].sort(P),policy:e.policy,textDomain:f.textDomain})),E=J({profile:D,snapshot:s,files:o,regions:o.map(n=>({scope:n.name,selectors:[n.name]})),policy:{byteBudget:e.policy.byteBudget,rowBudget:e.policy.rowBudget}},h);if(E.status!=="read")return E;const y=h(JSON.stringify({reading:f,perFile:E})),v={contract:C.contract,model:h(JSON.stringify(C)),params:L,inputs:s,selection:p,unit:"physical-lines/utf8-lf@1",scale:h("finite-nonnegative-atomic-valuation@1"),resolution:h("whole-physical-lines@1"),reader:e.reader,implementation:e.implementation,context:e.context,run:e.run,result:y},I=h(JSON.stringify(v)),H=new Set(f.regions.flatMap(n=>n.members)),q=f.inputFiles.filter(n=>!H.has(n.name)).map(n=>n.name),z=U({status:"read",identity:I,bindings:{reading:I,...v},reading:f,perFile:E,stray:q});return x.add(z),z}w(le,"readPhysicalLinesInPlace");function de(e,t,o){if(!x.has(e))return a("actual-reading-required");let r;try{r=ne(t)}catch(i){throw new k("physical-lines/witness","REFUSE\xB7physical-lines/witness "+(i instanceof Error?i.message:"invalid witness record"))}for(const[i,l]of Object.entries(e.bindings))if(r[i]!==l)return a("witness-binding/"+i);const u=o.producers.find(i=>i.authentication!==r.authentication?!1:i.authentication==="key-covered"&&r.authentication==="key-covered"?i.key===r.key&&i.coverage===r.coverage:i.authentication==="ci-run-unkeyed"&&r.authentication==="ci-run-unkeyed"?i.repository===r.repository&&i.commit===r.commit&&i.workflow===r.workflow&&i.run===r.run&&i.attempt===r.attempt:!1);return u?o.verify({witness:r,statementBytes:re(r),producer:u})!==!0?a("witness-authentication"):"attest:"+h(te(r)):a("witness-producer-not-admitted")}w(de,"authenticatePhysicalLinesWitness");function Le(e){if(!x.has(e.reading))return a("actual-reading-required");const t=w(s=>c(s,"form")==="interval"&&c(s,"role")==="reads"&&["lines","file-lines"].includes(c(s,"measure")),"isLineCeiling");let o;if(e.witness!==void 0){if(!e.authority)return a("witness-authority-absent");o=de(e.reading,e.witness,e.authority)}const r=e.proposed.filter(s=>{const f=e.standing.find(L=>c(L,"scope")===c(s,"scope"));if(!f||!t(s))return!1;const p=se({...ie(s),at:"none"});return ae([p],[f],t,"attest").length>0&&(!o||c(s,"at")!==o)}),u=new Map(e.standing.filter(t).map(s=>[c(s,"scope"),s]));for(const s of e.proposed.filter(t))r.includes(s)||u.set(c(s,"scope"),s);const i=[],l=[],B=[];for(const s of u.values()){const f=c(s,"scope"),p=e.reading.reading.regions.find(y=>y.scope===f);if(!p||p.status!=="measured"||p.selections.some(y=>y.status==="unmeasured")){B.push({scope:f,cause:"selector-no-match",selectors:p?.selections.filter(y=>y.status==="unmeasured").map(y=>y.selector)??[]});continue}const L=c(s,"measure"),E=L==="file-lines"?p.members.map(y=>{const v=e.reading.perFile.regions.find(I=>I.scope===y);return!v||v.status!=="measured"?a("per-file-reading"):v.value}):[p.value];for(const[y,v]of E.entries()){if(l.push({scope:f,...L==="file-lines"?{file:p.members[y]}:{},value:v.numerator}),v.denominator!=="1"||BigInt(v.numerator)>BigInt(Number.MAX_SAFE_INTEGER))return a("threshold-number-resolution");i.push(oe({standing:e.standing,ceilings:[s],observed:[],own:{[L]:Number(v.numerator)},epoch:0}))}}return{status:r.length||i.some(s=>s.over.length)?"BLOCK":!u.size||B.length||e.reading.stray.length?"UNMEASURED":"READY",rejected:r,unmeasured:B,stray:e.reading.stray,observations:l,thresholds:i,reading:e.reading.identity}}w(Le,"judgePhysicalLines");export{de as authenticatePhysicalLinesWitness,Le as judgePhysicalLines,Se as physicalLinesRegions,Be as readPlacePhysicalLines};

package/dist/host/place-act-transaction.js

@@ -1,78 +1,4 @@
-import { readPlaceActContext, verifyPlaceActContext, placeActReceiptsOf } from '@lapxo/topos/core';
-import { requireEffects } from "./read-only.js";
-import { BoundRefusal } from "./refusals.js";
-import { ActCommitUnknown } from "./commit-result.js";
-import { assertHostNotCancelled as cancelled, receiverClock, placeRegionOf } from "./host-controls.js";
-export { ActCommitUnknown as PlaceActCommitUnknown } from "./commit-result.js";
-/** The visibility point may have happened. Only an authenticated result query
- * or replay can resolve this; the error never asserts rollback. */
-const fail = (why) => { throw new BoundRefusal('host/act', 'REFUSE·place act ' + why); };
-const rootBytes = (r) => JSON.stringify([r.namespace, r.snapshot, r.epoch, r.prefix, r.head, r.policies]);
-/** Shared transaction, including historical replay, current authorization and
- * atomic publication. Signing may await; current Root and receiver heads are
- * checked again afterwards while the same exclusion remains held. */
-export async function transactPlaceAct(encoded, source, trust, limits, persistence, signal) {
-    requireEffects('place act commitment');
-    cancelled(signal);
-    if (!limits || !Number.isSafeInteger(limits.acts) || limits.acts < 1 || !Number.isSafeInteger(limits.bytes) || limits.bytes < 1)
-        fail('missing storage budget');
-    const decoded = readPlaceActContext(encoded, trust.contract.budget), id = trust.contract.digest(encoded);
-    const regions = decoded.places.map(p => placeRegionOf(p.place));
-    return persistence.exclusive(regions, async () => {
-        cancelled(signal);
-        const prior = persistence.result(id, trust, limits);
-        if (prior) {
-            if (prior.context !== encoded)
-                fail('replay bytes differ');
-            // A signing callback is never invoked for a historically authenticated replay.
-            if (typeof source !== 'function')
-                placeActReceiptsOf(encoded, source, trust.historical(encoded));
-            return { ...prior, identity: id, kind: 'once' };
-        }
-        const verified = verifyPlaceActContext(encoded, trust.contract);
-        const originals = decoded.places.map(p => p.records);
-        const capacity = (size) => {
-            const inventory = persistence.inventory(limits);
-            if (inventory.bytes + size > limits.bytes)
-                fail('publication byte budget');
-            if (inventory.names.length >= limits.acts)
-                fail('publication act budget');
-        };
-        const sizeOf = (files) => Object.values(files).reduce((n, v) => n + new TextEncoder().encode(v).length, 0);
-        capacity(sizeOf({ 'context.json': encoded, 'originals.json': JSON.stringify(originals) + '\n' }));
-        const assertCurrent = () => {
-            const current = trust.current();
-            if (rootBytes(current.root) !== rootBytes(verified.dependencies))
-                fail('authority changed before publication');
-            if (new Set(current.heads.map(h => h.place)).size !== current.heads.length)
-                fail('ambiguous receiver heads');
-            const stored = persistence.heads(trust, limits);
-            for (const p of decoded.places) {
-                const actual = stored.find(h => h.place === p.place), selected = current.heads.find(h => h.place === p.place);
-                if (!actual || !selected || actual.identity !== selected.identity || actual.epoch !== selected.epoch)
-                    fail('receiver snapshot is not committed head ' + p.place);
-                if (selected.identity !== p.previous)
-                    fail('receiver head moved ' + p.place);
-                const next = receiverClock(selected.epoch, fail) + 1;
-                if (!Number.isSafeInteger(next) || receiverClock(p.epoch, fail) !== next)
-                    fail('receiver epoch not next ' + p.place);
-            }
-        };
-        assertCurrent();
-        cancelled(signal);
-        const receipts = structuredClone(typeof source === 'function' ? await source() : source);
-        cancelled(signal);
-        placeActReceiptsOf(encoded, receipts, trust.contract);
-        const files = { 'context.json': encoded, 'receipts.json': JSON.stringify(receipts) + '\n', 'originals.json': JSON.stringify(originals) + '\n' };
-        capacity(sizeOf(files));
-        assertCurrent();
-        cancelled(signal);
-        try {
-            persistence.publish(id, files);
-        }
-        catch (error) {
-            throw new ActCommitUnknown(id, error);
-        }
-        return { context: encoded, receipts, originals, identity: id, kind: 'landed' };
-    });
-}
+var R=Object.defineProperty;var r=(e,i)=>R(e,"name",{value:i,configurable:!0});import{library6_readPlaceActContext as E,library6_verifyPlaceActContext as J,library6_placeActReceiptsOf as S}from"../vendor/runtime.js";import{requireEffects as U}from"./read-only.js";import{BoundRefusal as I}from"./refusals.js";import{ActCommitUnknown as _}from"./commit-result.js";import{assertHostNotCancelled as h,receiverClock as N,placeRegionOf as z}from"./host-controls.js";import{ActCommitUnknown as M}from"./commit-result.js";const n=r(e=>{throw new I("host/act","REFUSE\xB7place act "+e)},"fail"),j=r(e=>JSON.stringify([e.namespace,e.snapshot,e.epoch,e.prefix,e.head,e.policies]),"rootBytes");async function G(e,i,a,o,p,f){U("place act commitment"),h(f),(!o||!Number.isSafeInteger(o.acts)||o.acts<1||!Number.isSafeInteger(o.bytes)||o.bytes<1)&&n("missing storage budget");const m=E(e,a.contract.budget),l=a.contract.digest(e),k=m.places.map(y=>z(y.place));return p.exclusive(k,async()=>{h(f);const y=p.result(l,a,o);if(y)return y.context!==e&&n("replay bytes differ"),typeof i!="function"&&S(e,i,a.historical(e)),{...y,identity:l,kind:"once"};const P=J(e,a.contract),b=m.places.map(t=>t.records),v=r(t=>{const s=p.inventory(o);s.bytes+t>o.bytes&&n("publication byte budget"),s.names.length>=o.acts&&n("publication act budget")},"capacity"),C=r(t=>Object.values(t).reduce((s,c)=>s+new TextEncoder().encode(c).length,0),"sizeOf");v(C({"context.json":e,"originals.json":JSON.stringify(b)+`
+`}));const w=r(()=>{const t=a.current();j(t.root)!==j(P.dependencies)&&n("authority changed before publication"),new Set(t.heads.map(c=>c.place)).size!==t.heads.length&&n("ambiguous receiver heads");const s=p.heads(a,o);for(const c of m.places){const g=s.find(x=>x.place===c.place),d=t.heads.find(x=>x.place===c.place);(!g||!d||g.identity!==d.identity||g.epoch!==d.epoch)&&n("receiver snapshot is not committed head "+c.place),d.identity!==c.previous&&n("receiver head moved "+c.place);const O=N(d.epoch,n)+1;(!Number.isSafeInteger(O)||N(c.epoch,n)!==O)&&n("receiver epoch not next "+c.place)}},"assertCurrent");w(),h(f);const u=structuredClone(typeof i=="function"?await i():i);h(f),S(e,u,a.contract);const A={"context.json":e,"receipts.json":JSON.stringify(u)+`
+`,"originals.json":JSON.stringify(b)+`
+`};v(C(A)),w(),h(f);try{p.publish(l,A)}catch(t){throw new _(l,t)}return{context:e,receipts:u,originals:b,identity:l,kind:"landed"}})}r(G,"transactPlaceAct");export{M as PlaceActCommitUnknown,G as transactPlaceAct};