@lapxo/bound 0.2.4 → 0.2.6

package/dist/host/place-clock-selection.js

@@ -1,124 +1,5 @@
-/** Fixed HOST construction for the opt-in SDK clock profile. No CLI activation,
- * inferred genesis, new wire fields, or packet-supplied signature verifier. */
-import { createHash } from 'node:crypto';
-import { PLACE_ACT_CONTEXT } from '@lapxo/topos/core';
-import { canonical, signedBytes, wireAt } from '@lapxo/topos/wire';
-import { foldClaims, isConfig, fieldOf, parsedLine as parse } from "../fold/claims.js";
-import { signatureEraOf as eraOf } from "./signature-era.js";
-import { authorityFor } from "../fold/signers.js";
-import { verifyBytes } from "./adapters/keys/ed25519.js";
-import { verifiesOwnerLine } from "../land/sign.js";
-import { placeActHeads } from "./ports/place-act.js";
-const fail = (why) => { throw Error('REFUSE·clock selection ' + why); };
-const digest = (s) => 'sha256:' + createHash('sha256').update(s).digest('hex');
-const text = (s) => typeof s === 'string' && s.length > 0;
-const clock = (s) => { if (typeof s !== 'string' || !/^(0|[1-9][0-9]*)$/.test(s) || !Number.isSafeInteger(Number(s)))
-    fail('unknown clock'); return Number(s); };
-// Exact-byte parsing returns frozen values. Retain only this pure syntax verdict;
-// history, signatures, authority windows, clocks and protected rereads stay fresh.
-const canonicalValues = new WeakSet();
-const f = (line) => { const got = parse(line); if (got.kind !== 'fact')
-    return fail('noncanonical history'); if (!canonicalValues.has(got.value)) {
-    if (canonical(got.value.fields, got.value.version) !== line)
-        fail('noncanonical history');
-    canonicalValues.add(got.value);
-} return got.value.fields; };
-/** Root chooses selector and anchors/resources from its authenticated standing.
- * Selection must be ROOT signed; a world's signature grants no host capability. */
-export function hostClockSelection(input) {
-    const b = input.resources;
-    if (!b || Object.keys(b).sort().join(',') !== 'bytes,lines,places' || Object.values(b).some(n => !Number.isSafeInteger(n) || n < 1))
-        fail('missing input resources');
-    const inherited = input.inherited;
-    if (!inherited?.clock || Object.keys(inherited.clock).sort().join(',') !== 'bytes,placements,policies,proofs,records,signers' || !inherited.storage || Object.keys(inherited.storage).sort().join(',') !== 'acts,bytes' || [...Object.values(inherited.clock), ...Object.values(inherited.storage)].some(n => !Number.isSafeInteger(n) || n < 1))
-        fail('missing inherited resource authority');
-    if (input.history.length + input.legacyOriginals.length > b.lines)
-        fail('input line budget');
-    let bytes = 0;
-    for (const line of [...input.history, ...input.legacyOriginals]) {
-        if (typeof line !== 'string' || line.length > b.bytes || (bytes += Buffer.byteLength(line)) > b.bytes)
-            fail('input byte budget');
-    }
-    const snapshots = new Map();
-    for (const original of input.history) {
-        const epoch = clock(f(original).epoch ?? fail('history clock absent'));
-        let authority = snapshots.get(epoch);
-        if (!authority) {
-            const before = input.history.filter(l => !isConfig(l) || clock(f(l).epoch ?? fail('history clock absent')) <= epoch);
-            authority = authorityFor(before, input.anchor, eraOf(foldClaims(before.filter(l => fieldOf(l, 'scope').startsWith('wire/'))).standing).admitted);
-            snapshots.set(epoch, authority);
-        }
-        if (authority.of(original).kind !== 'admitted')
-            fail('history not authenticated at admission');
-    }
-    const live = foldClaims(input.history.filter(isConfig)).standing.filter(l => fieldOf(l, 'value') !== 'withdraw');
-    const ids = live.filter(l => { const p = f(l); return p.scope === input.profileSelector && p.measure === 'id'; });
-    if (ids.length !== 1 || f(ids[0]).value !== PLACE_ACT_CONTEXT || f(ids[0]).role !== 'writes' || f(ids[0]).form !== 'alphabet' || f(ids[0]).by !== input.anchor.id)
-        fail('missing/ambiguous clock profile id');
-    const rows = live.filter(l => { const p = f(l); return p.scope === input.selector && p.measure === 'text'; });
-    if (rows.length !== 1)
-        fail('missing/ambiguous Root selector');
-    const line = rows[0], fields = f(line);
-    if (fields.by !== input.anchor.id || fields.role !== 'writes' || fields.form !== 'alphabet' || fields.value !== 'lock' || !verifiesOwnerLine(line, input.anchor.publicKey, input.algorithms))
-        fail('selector is not Root signed');
-    if (!fields.about || fields.about.length > b.bytes)
-        fail('missing selector body');
-    let selection;
-    try {
-        selection = JSON.parse(fields.about);
-    }
-    catch {
-        return fail('selector JSON');
-    }
-    if (!selection || Object.keys(selection).sort().join(',') !== 'budget,digestAlgorithm,initial,namespace,profile,receiptScope,receiptSigner,regionFamily,storageBudget' || selection.profile !== PLACE_ACT_CONTEXT || selection.digestAlgorithm !== 'sha256' || !text(selection.namespace) || !text(selection.regionFamily) || !text(selection.receiptSigner) || !text(selection.receiptScope) || !Array.isArray(selection.initial) || !selection.initial.length || selection.initial.length > b.places)
-        fail('unsupported selector shape');
-    if (JSON.stringify(selection) !== fields.about)
-        fail('noncanonical selector JSON');
-    if (!selection.budget || Object.keys(selection.budget).sort().join(',') !== 'bytes,placements,policies,proofs,records,signers' || Object.values(selection.budget).some(n => !Number.isSafeInteger(n) || n < 1) || !selection.storageBudget || Object.keys(selection.storageBudget).sort().join(',') !== 'acts,bytes' || Object.values(selection.storageBudget).some(n => !Number.isSafeInteger(n) || n < 1))
-        fail('missing selected resources');
-    for (const name of ['bytes', 'records', 'placements', 'policies', 'proofs', 'signers'])
-        if (selection.budget[name] > inherited.clock[name])
-            fail('clock resource exceeds inherited ' + name);
-    for (const name of ['acts', 'bytes'])
-        if (selection.storageBudget[name] > inherited.storage[name])
-            fail('storage resource exceeds inherited ' + name);
-    if (selection.budget.bytes > b.bytes || selection.storageBudget.bytes > b.bytes || selection.budget.records > b.lines || selection.budget.placements > b.places)
-        fail('selected resources exceed input authority');
-    const wire = wireAt(live.map(f), Number.MAX_SAFE_INTEGER);
-    if (!wire || !wire.digests.has(selection.digestAlgorithm))
-        fail('digest algorithm not declared');
-    const authority = authorityFor(input.history, input.anchor, input.algorithms);
-    if (!input.history.includes(input.authorityCheckpoint) || !isConfig(input.authorityCheckpoint))
-        fail('missing authenticated Root authority checkpoint');
-    const checkpointEpoch = clock(f(input.authorityCheckpoint).epoch ?? fail('Root authority clock absent'));
-    if (snapshots.get(checkpointEpoch)?.of(input.authorityCheckpoint).kind !== 'admitted')
-        fail('Root checkpoint not admitted at original epoch');
-    const epoch = clock(f(input.authorityCheckpoint).epoch ?? fail('Root authority clock absent'));
-    if (input.history.filter(isConfig).some(l => clock(f(l).epoch ?? fail('history clock absent')) > epoch))
-        fail('authority checkpoint precedes Root configuration');
-    const prefix = digest(input.history.join('\n') + '\n'), head = digest(live.join('\n') + '\n');
-    const policies = [...new Set(live.map(digest))].sort();
-    if (policies.length > selection.budget.policies)
-        fail('actual dependency budget');
-    const root = { namespace: selection.namespace, snapshot: digest(JSON.stringify([prefix, head, String(epoch)])), epoch: String(epoch), prefix, head, policies };
-    const initialHeads = selection.initial.map(i => { if (!i || !i.receiver || !i.origin || !text(i.receiver.identity) || !text(i.origin.prefix) || !text(i.place))
-        fail('unknown initial namespace'); const parts = i.place.split('/'); if (i.place !== '.' && (parts.length < 2 || parts.at(-1) !== 'TARGET.bound' || parts.some(s => s === '' || s === '.' || s === '..')))
-        fail('unknown initial namespace'); clock(i.receiver.epoch); clock(i.origin.epoch); return { place: i.place, identity: i.receiver.identity, epoch: i.receiver.epoch }; });
-    if (new Set(initialHeads.map(h => h.place)).size !== initialHeads.length)
-        fail('duplicate namespace');
-    const legacy = new Set(input.legacyOriginals.map(l => digest(signedBytes(f(l)))));
-    let heads = [];
-    const contract = { budget: selection.budget, root, signers: authority.admitted, places: initialHeads.map(h => h.place), regionFamily: selection.regionFamily, receiptSigner: selection.receiptSigner, receiptScope: selection.receiptScope, digest,
-        verifiesRootContext: c => JSON.stringify(c) === JSON.stringify(root),
-        verifiesNamespaceAdmission: p => { if (p === '.')
-            return true; const parts = p.split('/'); if (parts.length < 2 || parts.pop() !== 'TARGET.bound' || parts.some(s => s === '' || s === '.' || s === '..'))
-            return false; const n = parts.join('/'), rows = live.filter(l => f(l).scope === selection.regionFamily + '/' + n); if (rows.length !== 1)
-            return false; const v = f(rows[0]); return v.role === 'writes' && v.form === 'alphabet' && v.measure === 'coordinates' && v.value === n + '/**'; },
-        verifiesNewLocalPrefix: (p, prefix, epoch, originals) => { const h = heads.find(h => h.place === p), i = selection.initial.find(i => i.place === p); if (!h || !i || originals.some(l => legacy.has(digest(signedBytes(f(l))))))
-            return false; return h.identity === i.receiver.identity ? prefix === i.origin.prefix && epoch === i.origin.epoch : prefix === h.identity && clock(epoch) === clock(h.epoch) + 1; },
-        verifiesOriginal: (l, s) => verifiesOwnerLine(l, s.publicKey, input.algorithms),
-        verifiesProof: (text, signature, s) => verifyBytes(text, s.publicKey, signature, input.algorithms), };
-    heads = input.authenticatedReceiverHeads ?? placeActHeads(input.store, initialHeads, { contract, historical: input.historical }, selection.storageBudget);
-    const trust = { contract, initialHeads, current: () => { const fresh = hostClockSelection({ ...input, ...input.readCurrent(), authenticatedReceiverHeads: undefined }); return { root: fresh.trust.contract.root, heads: placeActHeads(input.store, fresh.trust.initialHeads, fresh.trust, fresh.selection.storageBudget) }; }, historical: input.historical };
-    return { selection, trust };
-}
+var U=Object.defineProperty;var l=(t,s)=>U(t,"name",{value:s,configurable:!0});import{createHash as V}from"node:crypto";import{library6_PLACE_ACT_CONTEXT as _}from"../vendor/runtime.js";import{library14_canonical as $,library14_signedBytes as F,library14_wireAt as q}from"../vendor/runtime.js";import{foldClaims as J,isConfig as S,fieldOf as H,parsedLine as D}from"../fold/claims.js";import{signatureEraOf as Q}from"./signature-era.js";import{authorityFor as I}from"../fold/signers.js";import{verifyBytes as Y}from"./adapters/keys/ed25519.js";import{verifiesOwnerLine as L}from"../land/sign.js";import{placeActHeads as P}from"./ports/place-act.js";const i=l(t=>{throw Error("REFUSE\xB7clock selection "+t)},"fail"),y=l(t=>"sha256:"+V("sha256").update(t).digest("hex"),"digest"),m=l(t=>typeof t=="string"&&t.length>0,"text"),h=l(t=>((typeof t!="string"||!/^(0|[1-9][0-9]*)$/.test(t)||!Number.isSafeInteger(Number(t)))&&i("unknown clock"),Number(t)),"clock"),G=new WeakSet,c=l(t=>{const s=D(t);return s.kind!=="fact"?i("noncanonical history"):(G.has(s.value)||($(s.value.fields,s.value.version)!==t&&i("noncanonical history"),G.add(s.value)),s.value.fields)},"f");function Z(t){const s=t.resources;(!s||Object.keys(s).sort().join(",")!=="bytes,lines,places"||Object.values(s).some(e=>!Number.isSafeInteger(e)||e<1))&&i("missing input resources");const f=t.inherited;(!f?.clock||Object.keys(f.clock).sort().join(",")!=="bytes,placements,policies,proofs,records,signers"||!f.storage||Object.keys(f.storage).sort().join(",")!=="acts,bytes"||[...Object.values(f.clock),...Object.values(f.storage)].some(e=>!Number.isSafeInteger(e)||e<1))&&i("missing inherited resource authority"),t.history.length+t.legacyOriginals.length>s.lines&&i("input line budget");let K=0;for(const e of[...t.history,...t.legacyOriginals])(typeof e!="string"||e.length>s.bytes||(K+=Buffer.byteLength(e))>s.bytes)&&i("input byte budget");const O=new Map;for(const e of t.history){const r=h(c(e).epoch??i("history clock absent"));let a=O.get(r);if(!a){const p=t.history.filter(n=>!S(n)||h(c(n).epoch??i("history clock absent"))<=r);a=I(p,t.anchor,Q(J(p.filter(n=>H(n,"scope").startsWith("wire/"))).standing).admitted),O.set(r,a)}a.of(e).kind!=="admitted"&&i("history not authenticated at admission")}const u=J(t.history.filter(S)).standing.filter(e=>H(e,"value")!=="withdraw"),b=u.filter(e=>{const r=c(e);return r.scope===t.profileSelector&&r.measure==="id"});(b.length!==1||c(b[0]).value!==_||c(b[0]).role!=="writes"||c(b[0]).form!=="alphabet"||c(b[0]).by!==t.anchor.id)&&i("missing/ambiguous clock profile id");const j=u.filter(e=>{const r=c(e);return r.scope===t.selector&&r.measure==="text"});j.length!==1&&i("missing/ambiguous Root selector");const N=j[0],d=c(N);(d.by!==t.anchor.id||d.role!=="writes"||d.form!=="alphabet"||d.value!=="lock"||!L(N,t.anchor.publicKey,t.algorithms))&&i("selector is not Root signed"),(!d.about||d.about.length>s.bytes)&&i("missing selector body");let o;try{o=JSON.parse(d.about)}catch{return i("selector JSON")}(!o||Object.keys(o).sort().join(",")!=="budget,digestAlgorithm,initial,namespace,profile,receiptScope,receiptSigner,regionFamily,storageBudget"||o.profile!==_||o.digestAlgorithm!=="sha256"||!m(o.namespace)||!m(o.regionFamily)||!m(o.receiptSigner)||!m(o.receiptScope)||!Array.isArray(o.initial)||!o.initial.length||o.initial.length>s.places)&&i("unsupported selector shape"),JSON.stringify(o)!==d.about&&i("noncanonical selector JSON"),(!o.budget||Object.keys(o.budget).sort().join(",")!=="bytes,placements,policies,proofs,records,signers"||Object.values(o.budget).some(e=>!Number.isSafeInteger(e)||e<1)||!o.storageBudget||Object.keys(o.storageBudget).sort().join(",")!=="acts,bytes"||Object.values(o.storageBudget).some(e=>!Number.isSafeInteger(e)||e<1))&&i("missing selected resources");for(const e of["bytes","records","placements","policies","proofs","signers"])o.budget[e]>f.clock[e]&&i("clock resource exceeds inherited "+e);for(const e of["acts","bytes"])o.storageBudget[e]>f.storage[e]&&i("storage resource exceeds inherited "+e);(o.budget.bytes>s.bytes||o.storageBudget.bytes>s.bytes||o.budget.records>s.lines||o.budget.placements>s.places)&&i("selected resources exceed input authority");const A=q(u.map(c),Number.MAX_SAFE_INTEGER);(!A||!A.digests.has(o.digestAlgorithm))&&i("digest algorithm not declared");const X=I(t.history,t.anchor,t.algorithms);(!t.history.includes(t.authorityCheckpoint)||!S(t.authorityCheckpoint))&&i("missing authenticated Root authority checkpoint");const M=h(c(t.authorityCheckpoint).epoch??i("Root authority clock absent"));O.get(M)?.of(t.authorityCheckpoint).kind!=="admitted"&&i("Root checkpoint not admitted at original epoch");const w=h(c(t.authorityCheckpoint).epoch??i("Root authority clock absent"));t.history.filter(S).some(e=>h(c(e).epoch??i("history clock absent"))>w)&&i("authority checkpoint precedes Root configuration");const C=y(t.history.join(`
+`)+`
+`),E=y(u.join(`
+`)+`
+`),R=[...new Set(u.map(y))].sort();R.length>o.budget.policies&&i("actual dependency budget");const B={namespace:o.namespace,snapshot:y(JSON.stringify([C,E,String(w)])),epoch:String(w),prefix:C,head:E,policies:R},k=o.initial.map(e=>{(!e||!e.receiver||!e.origin||!m(e.receiver.identity)||!m(e.origin.prefix)||!m(e.place))&&i("unknown initial namespace");const r=e.place.split("/");return e.place!=="."&&(r.length<2||r.at(-1)!=="TARGET.bound"||r.some(a=>a===""||a==="."||a===".."))&&i("unknown initial namespace"),h(e.receiver.epoch),h(e.origin.epoch),{place:e.place,identity:e.receiver.identity,epoch:e.receiver.epoch}});new Set(k.map(e=>e.place)).size!==k.length&&i("duplicate namespace");const W=new Set(t.legacyOriginals.map(e=>y(F(c(e)))));let x=[];const T={budget:o.budget,root:B,signers:X.admitted,places:k.map(e=>e.place),regionFamily:o.regionFamily,receiptSigner:o.receiptSigner,receiptScope:o.receiptScope,digest:y,verifiesRootContext:l(e=>JSON.stringify(e)===JSON.stringify(B),"verifiesRootContext"),verifiesNamespaceAdmission:l(e=>{if(e===".")return!0;const r=e.split("/");if(r.length<2||r.pop()!=="TARGET.bound"||r.some(g=>g===""||g==="."||g===".."))return!1;const a=r.join("/"),p=u.filter(g=>c(g).scope===o.regionFamily+"/"+a);if(p.length!==1)return!1;const n=c(p[0]);return n.role==="writes"&&n.form==="alphabet"&&n.measure==="coordinates"&&n.value===a+"/**"},"verifiesNamespaceAdmission"),verifiesNewLocalPrefix:l((e,r,a,p)=>{const n=x.find(v=>v.place===e),g=o.initial.find(v=>v.place===e);return!n||!g||p.some(v=>W.has(y(F(c(v)))))?!1:n.identity===g.receiver.identity?r===g.origin.prefix&&a===g.origin.epoch:r===n.identity&&h(a)===h(n.epoch)+1},"verifiesNewLocalPrefix"),verifiesOriginal:l((e,r)=>L(e,r.publicKey,t.algorithms),"verifiesOriginal"),verifiesProof:l((e,r,a)=>Y(e,a.publicKey,r,t.algorithms),"verifiesProof")};x=t.authenticatedReceiverHeads??P(t.store,k,{contract:T,historical:t.historical},o.storageBudget);const z={contract:T,initialHeads:k,current:l(()=>{const e=Z({...t,...t.readCurrent(),authenticatedReceiverHeads:void 0});return{root:e.trust.contract.root,heads:P(t.store,e.trust.initialHeads,e.trust,e.selection.storageBudget)}},"current"),historical:t.historical};return{selection:o,trust:z}}l(Z,"hostClockSelection");export{Z as hostClockSelection};

package/dist/host/ports/ingress.js

@@ -1,57 +1,2 @@
-import { existsSync, readFileSync, readdirSync } from 'node:fs';
-import { join } from 'node:path';
-import { requireEffects } from "../read-only.js";
-import { underTheLock } from "../../land/act.js";
-import { nativePublicationStorage, publishBundle } from "./publication.js";
-/** Directory publication makes the pair visible together; there is no later ledger append that can expose half. */
-export const nativeIngressStorage = nativePublicationStorage;
-const directory = (store) => join(store, 'ingress');
-const nameOf = (identity) => {
-    if (!identity || identity.includes('\0'))
-        throw Error('REFUSE·ingress missing import identity');
-    return 'committed-' + encodeURIComponent(identity);
-};
-const read = (at) => ({ evidence: readFileSync(join(at, 'evidence.bound'), 'utf8'), receipt: readFileSync(join(at, 'receipt.bound'), 'utf8') });
-const measured = (kind, bundle) => ({ kind, ...bundle, evidenceBytes: Buffer.byteLength(bundle.evidence), receiptBytes: Buffer.byteLength(bundle.receipt) });
-/** Native signed receipt lines only. Foreign bytes are never added to the local ledger or epoch allocator. */
-export function ingressReceipts(store) {
-    const root = directory(store);
-    if (!existsSync(root))
-        return [];
-    return readdirSync(root).filter(name => name.startsWith('committed-')).sort().flatMap(name => read(join(root, name)).receipt.split('\n').filter(Boolean));
-}
-/** Private staging directories are invisible to readers and may be discarded after host recovery. */
-export function ingressEvidence(store, identity) {
-    const at = join(directory(store), nameOf(identity));
-    return existsSync(at) ? read(at) : undefined;
-}
-export function ingressBundles(store) {
-    const root = directory(store);
-    if (!existsSync(root))
-        return [];
-    return readdirSync(root).filter(name => name.startsWith('committed-')).sort().map(name => read(join(root, name)));
-}
-/** Verification and signing complete before staging. Replay performs no signer invocation or persistent write. */
-export async function commitIngress(store, identity, prepare, verify, storage = nativeIngressStorage) {
-    requireEffects('foreign evidence ingress');
-    return underTheLock(store, 'ingress', async () => {
-        const root = directory(store), at = join(root, nameOf(identity));
-        if (existsSync(at)) {
-            const prior = read(at);
-            if (verify(prior) !== true)
-                throw Error('REFUSE·ingress committed bytes do not verify');
-            return measured('once', prior);
-        }
-        const bundle = await prepare(ingressReceipts(store));
-        if (!bundle.evidence || !bundle.receipt || verify(bundle) !== true)
-            throw Error('REFUSE·ingress evidence and receipt do not verify');
-        publishBundle(at, { 'evidence.bound': bundle.evidence, 'receipt.bound': bundle.receipt }, storage);
-        return measured('landed', bundle);
-    });
-}
-/** Costs distinguish delivered bytes from newly committed bytes; no count is called information or freedom. */
-export function ingressCost(result, deliveredBytes, protocolBytes) {
-    if (!Number.isSafeInteger(deliveredBytes) || deliveredBytes < 0 || !Number.isSafeInteger(protocolBytes) || protocolBytes < 0)
-        throw Error('REFUSE·ingress invalid exchange byte measurement');
-    return `EXCHANGE ${deliveredBytes} payload bytes · ${protocolBytes} protocol bytes · ${result.kind === 'once' ? 0 : result.evidenceBytes} new evidence bytes · ${result.kind === 'once' ? 0 : result.receiptBytes} new receipt bytes`;
-}
+var v=Object.defineProperty;var n=(e,r)=>v(e,"name",{value:r,configurable:!0});import{existsSync as s,readFileSync as m,readdirSync as p}from"node:fs";import{join as i}from"node:path";import{requireEffects as h}from"../read-only.js";import{underTheLock as S}from"../../land/act.js";import{nativePublicationStorage as l,publishBundle as x}from"./publication.js";const w=l,c=n(e=>i(e,"ingress"),"directory"),g=n(e=>{if(!e||e.includes("\0"))throw Error("REFUSE\xB7ingress missing import identity");return"committed-"+encodeURIComponent(e)},"nameOf"),d=n(e=>({evidence:m(i(e,"evidence.bound"),"utf8"),receipt:m(i(e,"receipt.bound"),"utf8")}),"read"),E=n((e,r)=>({kind:e,...r,evidenceBytes:Buffer.byteLength(r.evidence),receiptBytes:Buffer.byteLength(r.receipt)}),"measured");function R(e){const r=c(e);return s(r)?p(r).filter(t=>t.startsWith("committed-")).sort().flatMap(t=>d(i(r,t)).receipt.split(`
+`).filter(Boolean)):[]}n(R,"ingressReceipts");function C(e,r){const t=i(c(e),g(r));return s(t)?d(t):void 0}n(C,"ingressEvidence");function L(e){const r=c(e);return s(r)?p(r).filter(t=>t.startsWith("committed-")).sort().map(t=>d(i(r,t))):[]}n(L,"ingressBundles");async function N(e,r,t,u,b=w){return h("foreign evidence ingress"),S(e,"ingress",async()=>{const y=c(e),f=i(y,g(r));if(s(f)){const a=d(f);if(u(a)!==!0)throw Error("REFUSE\xB7ingress committed bytes do not verify");return E("once",a)}const o=await t(R(e));if(!o.evidence||!o.receipt||u(o)!==!0)throw Error("REFUSE\xB7ingress evidence and receipt do not verify");return x(f,{"evidence.bound":o.evidence,"receipt.bound":o.receipt},b),E("landed",o)})}n(N,"commitIngress");function W(e,r,t){if(!Number.isSafeInteger(r)||r<0||!Number.isSafeInteger(t)||t<0)throw Error("REFUSE\xB7ingress invalid exchange byte measurement");return`EXCHANGE ${r} payload bytes \xB7 ${t} protocol bytes \xB7 ${e.kind==="once"?0:e.evidenceBytes} new evidence bytes \xB7 ${e.kind==="once"?0:e.receiptBytes} new receipt bytes`}n(W,"ingressCost");export{N as commitIngress,L as ingressBundles,W as ingressCost,C as ingressEvidence,R as ingressReceipts,w as nativeIngressStorage};

package/dist/host/ports/local-act.js

@@ -1,183 +1,5 @@
-import { hashText } from "../hash.js";
-import { ActCommitUnknown } from "../commit-result.js";
-import { assertHostNotCancelled } from "../host-controls.js";
-import { existsSync, readFileSync, readdirSync } from 'node:fs';
-import { join } from 'node:path';
-import { createHash } from 'node:crypto';
-import { requireEffects } from "../read-only.js";
-import { underTheRegions } from "../../land/act.js";
-import { publishBundle, nativePublicationStorage } from "./publication.js";
-import { actIdentity, parse, canonical } from '@lapxo/topos/wire';
-import { fullDigest } from "../digest.js";
-const atOf = (store, identity) => {
-    if (!identity || identity.includes('\0'))
-        throw Error('REFUSE·act missing identity');
-    return join(store, 'ledger', 'acts', 'committed-' + encodeURIComponent(identity));
-};
-const read = (at) => {
-    try {
-        const placements = readdirSync(at).filter(name => name.startsWith('place-') && name.endsWith('.bound')).map(name => ({
-            place: decodeURIComponent(name.slice(6, -6)), records: readFileSync(join(at, name), 'utf8'),
-        }));
-        return {
-            records: readFileSync(join(at, 'records.bound'), 'utf8'),
-            receipt: readFileSync(join(at, 'receipt.bound'), 'utf8'),
-            ...(placements.length ? { placements } : {}),
-        };
-    }
-    catch (error) {
-        throw Error(`REFUSE·act committed result unreadable · ${error.code ?? 'read failed'}`);
-    }
-};
-export const actLines = (bytes) => {
-    if (!bytes.endsWith('\n'))
-        throw Error('REFUSE·act truncated committed lines');
-    return bytes.slice(0, -1).split('\n');
-};
-/** Journal integrity is not authority. Signature/coverage checks remain the
- * same admission boundary; the hash algorithm here is the stored seal's named
- * algorithm, not a new selection of the place's wire.
- */
-export function intactLocalAct(identity, bundle) {
-    if (!bundle.receipt.endsWith('\n') || bundle.receipt.slice(0, -1).includes('\n'))
-        return false;
-    const receipt = parse(bundle.receipt.slice(0, -1));
-    if (receipt.kind !== 'fact' || !bundle.placements?.length)
-        return false;
-    const f = receipt.value.fields;
-    if (canonical(f) !== bundle.receipt.slice(0, -1) || !/^(0|[1-9][0-9]*)$/.test(f['epoch'] ?? ''))
-        return false;
-    if (f['value'] !== identity || f['role'] !== 'writes' || f['form'] !== 'alphabet' || f['measure'] !== 'digest')
-        return false;
-    return actIdentity(actLines(bundle.records), { scope: f['scope'] ?? '', context: f['at'] ?? '',
-        localEpoch: Number(f['epoch']), digest: bytes => fullDigest(bytes, identity.slice(0, identity.indexOf(':'))),
-        placements: bundle.placements.map(p => ({ place: p.place, records: actLines(p.records) })),
-    }) === identity;
-}
-/** One last integrity result only. Every call rereads all exact current bytes;
- * signatures, coverage and current authority are never retained here. */
-let lastIntactInventory;
-/** Internal integrity key only, not an act identity or a wire profile. */
-export function committedInventoryFingerprint(rows) {
-    const hash = createHash('sha256');
-    const text = hashText.bind(undefined, hash);
-    text('committed-integrity-inventory');
-    text(String(rows.length));
-    for (const { identity, bundle } of rows) {
-        text(identity);
-        text(bundle.records);
-        text(bundle.receipt);
-        if (bundle.placements === undefined) {
-            text('absent');
-            continue;
-        }
-        text('present');
-        text(String(bundle.placements.length));
-        for (const placement of bundle.placements) {
-            text(placement.place);
-            text(placement.records);
-        }
-    }
-    return hash.digest('hex');
-}
-/** Committed segments are part of this ledger, not a second authority source. */
-export function committedLocalActs(store) {
-    const observed = observationAt(store);
-    if (observed)
-        return observed.rows;
-    return readCommittedLocalActs(store);
-}
-let committedObservation;
-function observationAt(store) { for (let one = committedObservation; one; one = one.parent)
-    if (one.store === store)
-        return one; return undefined; }
-/** Fixed host observation only: one synchronous, coherent committed inventory.
- * It supplies no authority, verifier or async lifetime. Each outer invocation
- * rereads exact bodies before entering; current authorization still runs inside.
- */
-export function withCommittedLocalActObservation(store, body) {
-    const prior = committedObservation, existing = observationAt(store);
-    const rows = existing?.rows ?? Object.freeze(readCommittedLocalActs(store).map(row => Object.freeze({ identity: row.identity, bundle: Object.freeze({ ...row.bundle, ...(row.bundle.placements ? { placements: Object.freeze(row.bundle.placements.map(p => Object.freeze({ ...p }))) } : {}) }) })));
-    committedObservation = { store, rows, parent: prior };
-    try {
-        const result = body();
-        if (result !== null && (typeof result === 'object' || typeof result === 'function') && typeof result.then === 'function')
-            throw Error('REFUSE·act committed observation must be synchronous');
-        return result;
-    }
-    finally {
-        committedObservation = prior;
-    }
-}
-function readCommittedLocalActs(store) {
-    const root = join(store, 'ledger', 'acts');
-    if (!existsSync(root))
-        return [];
-    const rows = readdirSync(root).filter(name => name.startsWith('committed-')).map(name => ({
-        identity: decodeURIComponent(name.slice(10)), bundle: read(join(root, name)),
-    }));
-    // Ordered tuple framing commits every record, receipt and placement. No path,
-    // mtime, authority snapshot or caller-supplied seal substitutes for bytes.
-    const fingerprint = committedInventoryFingerprint(rows);
-    if (fingerprint !== lastIntactInventory) {
-        for (const { identity, bundle } of rows)
-            if (!intactLocalAct(identity, bundle))
-                throw Error('REFUSE·act committed journal seal does not verify');
-        lastIntactInventory = fingerprint;
-    }
-    return rows.sort((a, b) => {
-        const epoch = (one) => { const p = parse(one.receipt.trim()); return p.kind === 'fact' ? Number(p.value.fields['epoch']) : 0; };
-        return epoch(a.bundle) - epoch(b.bundle);
-    });
-}
-/** A public result is available only as a verified committed pair.
- * No writer-tail guess, newest-result selection or implicit authority.
- */
-export function localActResult(store, identity, verify) {
-    const at = atOf(store, identity);
-    const observed = observationAt(store);
-    if (observed) {
-        const bundle = observed.rows.find(row => row.identity === identity)?.bundle;
-        if (!bundle)
-            return undefined;
-        if (verify(identity, bundle) !== true)
-            throw Error('REFUSE·act committed result does not verify');
-        return bundle;
-    }
-    if (!existsSync(at))
-        return undefined;
-    const bundle = read(at);
-    if (verify(identity, bundle) !== true)
-        throw Error('REFUSE·act committed result does not verify');
-    return bundle;
-}
-/** One publication point for records and their native result. Re-delivery
- * reads the original pair without preparation, signing or a new local epoch.
- * The caller must also integrate this boundary into admission-history readers;
- * this storage port alone does not activate a grammar or land authority.
- */
-export async function commitLocalAct(store, identity, regions, prepare, verify, storage = nativePublicationStorage, signal) {
-    requireEffects('local act commitment');
-    assertHostNotCancelled(signal);
-    return underTheRegions(store, regions, 'land', async () => {
-        assertHostNotCancelled(signal);
-        const prior = localActResult(store, identity, verify);
-        if (prior)
-            return { kind: 'once', ...prior };
-        const bundle = await prepare();
-        assertHostNotCancelled(signal);
-        if (!bundle.records || !bundle.receipt || verify(identity, bundle) !== true)
-            throw Error('REFUSE·act prepared result does not verify');
-        const files = { 'records.bound': bundle.records, 'receipt.bound': bundle.receipt };
-        for (const p of bundle.placements ?? [])
-            files['place-' + encodeURIComponent(p.place) + '.bound'] = p.records;
-        assertHostNotCancelled(signal);
-        try {
-            publishBundle(atOf(store, identity), files, storage);
-        }
-        catch (error) {
-            throw new ActCommitUnknown(identity, error);
-        }
-        return { kind: 'landed', ...bundle };
-    });
-}
+var U=Object.defineProperty;var i=(t,e)=>U(t,"name",{value:e,configurable:!0});import{hashText as F}from"../hash.js";import{ActCommitUnknown as I}from"../commit-result.js";import{assertHostNotCancelled as u}from"../host-controls.js";import{existsSync as E,readFileSync as m,readdirSync as y}from"node:fs";import{join as d}from"node:path";import{createHash as O}from"node:crypto";import{requireEffects as j}from"../read-only.js";import{underTheRegions as A}from"../../land/act.js";import{publishBundle as C,nativePublicationStorage as L}from"./publication.js";import{library14_actIdentity as k,library14_parse as g,library14_canonical as z}from"../../vendor/runtime.js";import{fullDigest as W}from"../digest.js";const v=i((t,e)=>{if(!e||e.includes("\0"))throw Error("REFUSE\xB7act missing identity");return d(t,"ledger","acts","committed-"+encodeURIComponent(e))},"atOf"),w=i(t=>{try{const e=y(t).filter(r=>r.startsWith("place-")&&r.endsWith(".bound")).map(r=>({place:decodeURIComponent(r.slice(6,-6)),records:m(d(t,r),"utf8")}));return{records:m(d(t,"records.bound"),"utf8"),receipt:m(d(t,"receipt.bound"),"utf8"),...e.length?{placements:e}:{}}}catch(e){throw Error(`REFUSE\xB7act committed result unreadable \xB7 ${e.code??"read failed"}`)}},"read"),x=i(t=>{if(!t.endsWith(`
+`))throw Error("REFUSE\xB7act truncated committed lines");return t.slice(0,-1).split(`
+`)},"actLines");function N(t,e){if(!e.receipt.endsWith(`
+`)||e.receipt.slice(0,-1).includes(`
+`))return!1;const r=g(e.receipt.slice(0,-1));if(r.kind!=="fact"||!e.placements?.length)return!1;const c=r.value.fields;return z(c)!==e.receipt.slice(0,-1)||!/^(0|[1-9][0-9]*)$/.test(c.epoch??"")||c.value!==t||c.role!=="writes"||c.form!=="alphabet"||c.measure!=="digest"?!1:k(x(e.records),{scope:c.scope??"",context:c.at??"",localEpoch:Number(c.epoch),digest:i(o=>W(o,t.slice(0,t.indexOf(":"))),"digest"),placements:e.placements.map(o=>({place:o.place,records:x(o.records)}))})===t}i(N,"intactLocalAct");let R;function _(t){const e=O("sha256"),r=F.bind(void 0,e);r("committed-integrity-inventory"),r(String(t.length));for(const{identity:c,bundle:o}of t){if(r(c),r(o.records),r(o.receipt),o.placements===void 0){r("absent");continue}r("present"),r(String(o.placements.length));for(const n of o.placements)r(n.place),r(n.records)}return e.digest("hex")}i(_,"committedInventoryFingerprint");function X(t){const e=h(t);return e?e.rows:S(t)}i(X,"committedLocalActs");let p;function h(t){for(let e=p;e;e=e.parent)if(e.store===t)return e}i(h,"observationAt");function Y(t,e){const r=p,o=h(t)?.rows??Object.freeze(S(t).map(n=>Object.freeze({identity:n.identity,bundle:Object.freeze({...n.bundle,...n.bundle.placements?{placements:Object.freeze(n.bundle.placements.map(s=>Object.freeze({...s})))}:{}})})));p={store:t,rows:o,parent:r};try{const n=e();if(n!==null&&(typeof n=="object"||typeof n=="function")&&typeof n.then=="function")throw Error("REFUSE\xB7act committed observation must be synchronous");return n}finally{p=r}}i(Y,"withCommittedLocalActObservation");function S(t){const e=d(t,"ledger","acts");if(!E(e))return[];const r=y(e).filter(o=>o.startsWith("committed-")).map(o=>({identity:decodeURIComponent(o.slice(10)),bundle:w(d(e,o))})),c=_(r);if(c!==R){for(const{identity:o,bundle:n}of r)if(!N(o,n))throw Error("REFUSE\xB7act committed journal seal does not verify");R=c}return r.sort((o,n)=>{const s=i(l=>{const a=g(l.receipt.trim());return a.kind==="fact"?Number(a.value.fields.epoch):0},"epoch");return s(o.bundle)-s(n.bundle)})}i(S,"readCommittedLocalActs");function H(t,e,r){const c=v(t,e),o=h(t);if(o){const s=o.rows.find(l=>l.identity===e)?.bundle;if(!s)return;if(r(e,s)!==!0)throw Error("REFUSE\xB7act committed result does not verify");return s}if(!E(c))return;const n=w(c);if(r(e,n)!==!0)throw Error("REFUSE\xB7act committed result does not verify");return n}i(H,"localActResult");async function Z(t,e,r,c,o,n=L,s){return j("local act commitment"),u(s),A(t,r,"land",async()=>{u(s);const l=H(t,e,o);if(l)return{kind:"once",...l};const a=await c();if(u(s),!a.records||!a.receipt||o(e,a)!==!0)throw Error("REFUSE\xB7act prepared result does not verify");const b={"records.bound":a.records,"receipt.bound":a.receipt};for(const f of a.placements??[])b["place-"+encodeURIComponent(f.place)+".bound"]=f.records;u(s);try{C(v(t,e),b,n)}catch(f){throw new I(e,f)}return{kind:"landed",...a}})}i(Z,"commitLocalAct");export{x as actLines,Z as commitLocalAct,_ as committedInventoryFingerprint,X as committedLocalActs,N as intactLocalAct,H as localActResult,Y as withCommittedLocalActObservation};

package/dist/host/ports/place-act.js

@@ -1,134 +1 @@
-import { existsSync, readdirSync, statSync, openSync, fstatSync, readSync, closeSync } from 'node:fs';
-import { join } from 'node:path';
-import { readPlaceActContext, placeActReceiptsOf } from '@lapxo/topos/core';
-import { transactPlaceAct } from "../place-act-transaction.js";
-import { canonicalActStore, underAuthorityRegions, underTheRegions, underRootProjection } from "../../land/act.js";
-import { requireEffects } from "../read-only.js";
-import { receiverClock } from "../host-controls.js";
-import { publishBundle, nativePublicationStorage } from "./publication.js";
-const fail = (why) => { throw Error('REFUSE·place act ' + why); };
-const budget = (b) => { if (!b || !Number.isSafeInteger(b.acts) || b.acts < 1 || !Number.isSafeInteger(b.bytes) || b.bytes < 1)
-    fail('missing storage budget'); };
-const base = (store) => join(store, 'ledger', 'place-acts');
-const at = (store, id) => { if (!id || id.includes('\0'))
-    fail('missing identity'); return join(base(store), 'committed-' + encodeURIComponent(id)); };
-function storedInventory(store, b) {
-    budget(b);
-    if (!existsSync(base(store)))
-        return { names: [], bytes: 0 };
-    const names = readdirSync(base(store)).filter(n => n.startsWith('committed-'));
-    if (names.length > b.acts)
-        fail('stored act budget');
-    let bytes = 0;
-    for (const name of names)
-        for (const member of ['context.json', 'receipts.json', 'originals.json']) {
-            const stat = statSync(join(base(store), name, member));
-            if (!stat.isFile() || (bytes += stat.size) > b.bytes)
-                fail('stored aggregate byte budget');
-        }
-    return { names, bytes };
-}
-function readBundle(path, b) {
-    budget(b);
-    let bytes = 0;
-    const read = (name) => {
-        const fd = openSync(join(path, name), 'r');
-        try {
-            const size = fstatSync(fd);
-            if (!size.isFile() || size.size > b.bytes - bytes)
-                fail('stored byte budget');
-            const data = Buffer.alloc(size.size);
-            let read = 0;
-            while (read < data.length) {
-                const count = readSync(fd, data, read, data.length - read, null);
-                if (!count)
-                    fail('stored member changed while reading');
-                read += count;
-            }
-            if (readSync(fd, Buffer.alloc(1), 0, 1, null) !== 0)
-                fail('stored member changed while reading');
-            bytes += read;
-            return new TextDecoder('utf-8', { fatal: true }).decode(data);
-        }
-        finally {
-            closeSync(fd);
-        }
-    };
-    try {
-        const context = read('context.json'), receipts = JSON.parse(read('receipts.json')), originals = JSON.parse(read('originals.json'));
-        return { context, receipts, originals };
-    }
-    catch (e) {
-        if (e instanceof Error && e.message.startsWith('REFUSE·'))
-            throw e;
-        return fail('committed bundle unreadable');
-    }
-}
-function authenticated(bundle, id, contract) {
-    const result = placeActReceiptsOf(bundle.context, bundle.receipts, contract), decoded = readPlaceActContext(bundle.context, contract.budget);
-    if (result.identity !== id || JSON.stringify(bundle.originals) !== JSON.stringify(decoded.places.map(p => p.records)))
-        fail('stored original/context identity mismatch');
-    return decoded;
-}
-/** Historical result reads never produce a current authorization permit. */
-export function placeActResult(store, id, trust, limits) {
-    const path = at(store, id);
-    if (!existsSync(path))
-        return undefined;
-    const bundle = readBundle(path, limits);
-    authenticated(bundle, id, trust.historical(bundle.context));
-    return bundle;
-}
-/** Each receiver chain advances independently. Initial heads are explicit,
- * authenticated host inputs, not inferred zero or legacy global epochs. */
-export function placeActHeads(store, initial, trust, limits) {
-    budget(limits);
-    if (!initial.length || new Set(initial.map(h => h.place)).size !== initial.length)
-        fail('missing/ambiguous initial heads');
-    const heads = new Map(initial.map(h => { receiverClock(h.epoch, fail); if (!h.identity)
-        fail('missing initial head'); return [h.place, { ...h }]; }));
-    if (!existsSync(base(store)))
-        return [...heads.values()];
-    const { names } = storedInventory(store, limits);
-    const pending = names.map(name => { const id = decodeURIComponent(name.slice(10)), bundle = readBundle(join(base(store), name), limits); const context = authenticated(bundle, id, trust.historical(bundle.context)); if (context.root.namespace !== trust.contract.root.namespace)
-        fail('stored clock namespace mismatch'); return { id, context }; });
-    while (pending.length) {
-        const next = pending.findIndex(a => a.context.places.every(p => heads.get(p.place)?.identity === p.previous));
-        if (next < 0)
-            fail('receiver chain fork or missing predecessor');
-        const act = pending.splice(next, 1)[0];
-        for (const p of act.context.places) {
-            const prior = heads.get(p.place);
-            const epoch = receiverClock(prior.epoch, fail) + 1;
-            if (!Number.isSafeInteger(epoch) || receiverClock(p.epoch, fail) !== epoch)
-                fail('receiver chain clock mismatch');
-            heads.set(p.place, { place: p.place, identity: act.id, epoch: p.epoch });
-        }
-    }
-    return [...heads.values()];
-}
-/** Context, exact original bytes and complete signed receipts have one visibility
- * point. Real Root guard exclusion spans final authority/head comparison and
- * publication; this does not activate a CLI profile or reinterpret local-act@1. */
-/** Native persistence adapter. The transaction below is also the CLI path. */
-export function nativePlaceActPersistence(store, storage = nativePublicationStorage) {
-    store = canonicalActStore(store);
-    return {
-        exclusive: (regions, run) => { const enter = regions.includes('') ? underTheRegions : underAuthorityRegions; return enter(store, regions, 'place act', () => underRootProjection(store, 'place act publication', run)); },
-        result: (identity, trust, limits) => placeActResult(store, identity, trust, limits),
-        inventory: limits => storedInventory(store, limits),
-        heads: (trust, limits) => placeActHeads(store, trust.initialHeads, trust, limits),
-        publish: (identity, files) => publishBundle(at(store, identity), files, storage),
-    };
-}
-export async function commitPlaceAct(store, encoded, receipts, trust, limits, storage = nativePublicationStorage) {
-    requireEffects('place act commitment');
-    return transactPlaceAct(encoded, receipts, trust, limits, nativePlaceActPersistence(store, storage));
-}
-/** Enumerates only committed, historically authenticated carriers. Namespace
- * projection is a caller's separate pure operation, never current permission. */
-export function committedPlaceActResults(store, trust, limits) {
-    const { names } = storedInventory(store, limits);
-    return names.map(name => { const identity = decodeURIComponent(name.slice(10)), bundle = placeActResult(store, identity, trust, limits); if (!bundle)
-        fail('committed carrier vanished'); return { identity, bundle: bundle }; });
-}
+var j=Object.defineProperty;var i=(e,c)=>j(e,"name",{value:c,configurable:!0});import{existsSync as g,readdirSync as I,statSync as E,openSync as N,fstatSync as C,readSync as S,closeSync as O}from"node:fs";import{join as f}from"node:path";import{library6_readPlaceActContext as z,library6_placeActReceiptsOf as U}from"../../vendor/runtime.js";import{transactPlaceAct as k}from"../place-act-transaction.js";import{canonicalActStore as B,underAuthorityRegions as F,underTheRegions as J,underRootProjection as H}from"../../land/act.js";import{requireEffects as T}from"../read-only.js";import{receiverClock as h}from"../host-controls.js";import{publishBundle as W,nativePublicationStorage as v}from"./publication.js";const s=i(e=>{throw Error("REFUSE\xB7place act "+e)},"fail"),y=i(e=>{(!e||!Number.isSafeInteger(e.acts)||e.acts<1||!Number.isSafeInteger(e.bytes)||e.bytes<1)&&s("missing storage budget")},"budget"),m=i(e=>f(e,"ledger","place-acts"),"base"),A=i((e,c)=>((!c||c.includes("\0"))&&s("missing identity"),f(m(e),"committed-"+encodeURIComponent(c))),"at");function b(e,c){if(y(c),!g(m(e)))return{names:[],bytes:0};const t=I(m(e)).filter(n=>n.startsWith("committed-"));t.length>c.acts&&s("stored act budget");let o=0;for(const n of t)for(const r of["context.json","receipts.json","originals.json"]){const l=E(f(m(e),n,r));(!l.isFile()||(o+=l.size)>c.bytes)&&s("stored aggregate byte budget")}return{names:t,bytes:o}}i(b,"storedInventory");function R(e,c){y(c);let t=0;const o=i(n=>{const r=N(f(e,n),"r");try{const l=C(r);(!l.isFile()||l.size>c.bytes-t)&&s("stored byte budget");const a=Buffer.alloc(l.size);let p=0;for(;p<a.length;){const d=S(r,a,p,a.length-p,null);d||s("stored member changed while reading"),p+=d}return S(r,Buffer.alloc(1),0,1,null)!==0&&s("stored member changed while reading"),t+=p,new TextDecoder("utf-8",{fatal:!0}).decode(a)}finally{O(r)}},"read");try{const n=o("context.json"),r=JSON.parse(o("receipts.json")),l=JSON.parse(o("originals.json"));return{context:n,receipts:r,originals:l}}catch(n){if(n instanceof Error&&n.message.startsWith("REFUSE\xB7"))throw n;return s("committed bundle unreadable")}}i(R,"readBundle");function w(e,c,t){const o=U(e.context,e.receipts,t),n=z(e.context,t.budget);return(o.identity!==c||JSON.stringify(e.originals)!==JSON.stringify(n.places.map(r=>r.records)))&&s("stored original/context identity mismatch"),n}i(w,"authenticated");function P(e,c,t,o){const n=A(e,c);if(!g(n))return;const r=R(n,o);return w(r,c,t.historical(r.context)),r}i(P,"placeActResult");function _(e,c,t,o){y(o),(!c.length||new Set(c.map(a=>a.place)).size!==c.length)&&s("missing/ambiguous initial heads");const n=new Map(c.map(a=>(h(a.epoch,s),a.identity||s("missing initial head"),[a.place,{...a}])));if(!g(m(e)))return[...n.values()];const{names:r}=b(e,o),l=r.map(a=>{const p=decodeURIComponent(a.slice(10)),d=R(f(m(e),a),o),u=w(d,p,t.historical(d.context));return u.root.namespace!==t.contract.root.namespace&&s("stored clock namespace mismatch"),{id:p,context:u}});for(;l.length;){const a=l.findIndex(d=>d.context.places.every(u=>n.get(u.place)?.identity===u.previous));a<0&&s("receiver chain fork or missing predecessor");const p=l.splice(a,1)[0];for(const d of p.context.places){const u=n.get(d.place),x=h(u.epoch,s)+1;(!Number.isSafeInteger(x)||h(d.epoch,s)!==x)&&s("receiver chain clock mismatch"),n.set(d.place,{place:d.place,identity:p.id,epoch:d.epoch})}}return[...n.values()]}i(_,"placeActHeads");function q(e,c=v){return e=B(e),{exclusive:i((t,o)=>(t.includes("")?J:F)(e,t,"place act",()=>H(e,"place act publication",o)),"exclusive"),result:i((t,o,n)=>P(e,t,o,n),"result"),inventory:i(t=>b(e,t),"inventory"),heads:i((t,o)=>_(e,t.initialHeads,t,o),"heads"),publish:i((t,o)=>W(A(e,t),o,c),"publish")}}i(q,"nativePlaceActPersistence");async function Z(e,c,t,o,n,r=v){return T("place act commitment"),k(c,t,o,n,q(e,r))}i(Z,"commitPlaceAct");function $(e,c,t){const{names:o}=b(e,t);return o.map(n=>{const r=decodeURIComponent(n.slice(10)),l=P(e,r,c,t);return l||s("committed carrier vanished"),{identity:r,bundle:l}})}i($,"committedPlaceActResults");export{Z as commitPlaceAct,$ as committedPlaceActResults,q as nativePlaceActPersistence,_ as placeActHeads,P as placeActResult};

package/dist/host/ports/publication.js

@@ -1,56 +1 @@
-import { randomUUID } from 'node:crypto';
-import { closeSync, fsyncSync, mkdirSync, openSync, renameSync, rmSync, writeFileSync } from 'node:fs';
-import { dirname, join } from 'node:path';
-import { requireEffects } from "../read-only.js";
-const syncDirectory = (path) => {
-    const fd = openSync(path, 'r');
-    try {
-        fsyncSync(fd);
-    }
-    finally {
-        closeSync(fd);
-    }
-};
-export const nativePublicationStorage = {
-    publish(staged, committed) { renameSync(staged, committed); syncDirectory(dirname(committed)); },
-};
-/** Publish prepared bytes as one directory. No identity, grammar or authority
- * is inferred here. Readers address the committed name, never staging files.
- * A failure after rename is not evidence of rollback: the caller must retain
- * the uncertainty and allow a verified read of the committed name.
- */
-export function publishBundle(committed, files, storage = nativePublicationStorage) {
-    requireEffects('atomic publication');
-    const entries = Object.entries(files);
-    if (!entries.length || entries.some(([name]) => !name || name === '.' || name === '..' || /[\\/\0]/.test(name))) {
-        throw Error('REFUSE·commit invalid publication members');
-    }
-    const root = dirname(committed);
-    const created = mkdirSync(root, { recursive: true });
-    // Persist newly created directory entries up to their existing parent too.
-    if (created !== undefined)
-        for (let at = root;; at = dirname(at)) {
-            syncDirectory(at);
-            if (at === dirname(created))
-                break;
-        }
-    const staged = join(root, '.stage-' + randomUUID());
-    mkdirSync(staged, { mode: 0o700 });
-    try {
-        for (const [name, bytes] of entries) {
-            const fd = openSync(join(staged, name), 'wx', 0o600);
-            try {
-                writeFileSync(fd, bytes);
-                fsyncSync(fd);
-            }
-            finally {
-                closeSync(fd);
-            }
-        }
-        syncDirectory(staged);
-        storage.publish(staged, committed);
-    }
-    finally {
-        rmSync(staged, { recursive: true, force: true });
-    }
-}
+var h=Object.defineProperty;var f=(o,t)=>h(o,"name",{value:t,configurable:!0});import{randomUUID as g}from"node:crypto";import{closeSync as a,fsyncSync as u,mkdirSync as m,openSync as p,renameSync as v,rmSync as E,writeFileSync as w}from"node:fs";import{dirname as n,join as b}from"node:path";import{requireEffects as x}from"../read-only.js";const l=f(o=>{const t=p(o,"r");try{u(t)}finally{a(t)}},"syncDirectory"),U={publish(o,t){v(o,t),l(n(t))}};function B(o,t,d=U){x("atomic publication");const i=Object.entries(t);if(!i.length||i.some(([r])=>!r||r==="."||r===".."||/[\\/\0]/.test(r)))throw Error("REFUSE\xB7commit invalid publication members");const c=n(o),y=m(c,{recursive:!0});if(y!==void 0)for(let r=c;l(r),r!==n(y);r=n(r));const e=b(c,".stage-"+g());m(e,{mode:448});try{for(const[r,S]of i){const s=p(b(e,r),"wx",384);try{w(s,S),u(s)}finally{a(s)}}l(e),d.publish(e,o)}finally{E(e,{recursive:!0,force:!0})}}f(B,"publishBundle");export{U as nativePublicationStorage,B as publishBundle};