@lapxo/bound 0.2.4 → 0.2.6

package/dist/host/ports/signing.js

@@ -1,74 +1 @@
-import { spawn } from 'node:child_process';
-import { readFileSync } from 'node:fs';
-import { signBytes } from "../adapters/keys/ed25519.js";
-/** Contains only host-controlled diagnostics, never child output. */
-export class SigningFailure extends Error {
-}
-/** Host-approved mechanism only. Repository declarations do not authorize execution. */
-export async function invokeSigner(lot, mechanism, protocol, limits) {
-    if (!Number.isSafeInteger(limits.timeoutMs) || limits.timeoutMs <= 0
-        || !Number.isSafeInteger(limits.responseBytes) || limits.responseBytes <= 0) {
-        throw new SigningFailure(`REFUSE·signer ${lot.keyId} has no valid declared limits`);
-    }
-    const request = protocol.request(lot);
-    let output;
-    if (mechanism.kind === 'file') {
-        try {
-            const key = readFileSync(mechanism.path, 'utf8');
-            output = protocol.response(lot.bytes.map(bytes => ({ keyId: lot.keyId, signature: signBytes(bytes, key, lot.algorithm) })));
-        }
-        catch {
-            throw new SigningFailure(`REFUSE·signer ${lot.keyId} file mechanism failed`);
-        }
-    }
-    else
-        output = await new Promise((resolve, reject) => {
-            const child = spawn(mechanism.executable, [...mechanism.args], { stdio: ['pipe', 'pipe', 'pipe'], shell: false });
-            let size = 0;
-            const chunks = [];
-            let failure;
-            const refuse = (why) => {
-                if (failure)
-                    return;
-                failure = why;
-                child.kill('SIGKILL');
-                clearTimeout(timer);
-                child.stdin.destroy();
-                child.stdout.destroy();
-                child.stderr.destroy();
-                reject(new SigningFailure(`REFUSE·signer ${lot.keyId} ${why} · status=none · signal=SIGKILL`));
-            };
-            const timer = setTimeout(() => refuse('timeout'), limits.timeoutMs);
-            child.stdout.on('data', (chunk) => {
-                size += chunk.length;
-                if (size > limits.responseBytes)
-                    refuse('response exceeds declared limit');
-                if (!failure)
-                    chunks.push(chunk);
-            });
-            // Drain, never forward or retain signer diagnostics.
-            child.stderr.on('data', () => { });
-            child.stdin.on('error', () => refuse('input delivery failed'));
-            child.on('error', () => {
-                clearTimeout(timer);
-                reject(new SigningFailure(`REFUSE·signer ${lot.keyId} command could not start`));
-            });
-            child.on('close', (status, signal) => {
-                clearTimeout(timer);
-                if (failure || status !== 0) {
-                    reject(new SigningFailure(`REFUSE·signer ${lot.keyId} ${failure ?? 'command failed'} · status=${status ?? 'none'} · signal=${signal ?? 'none'}`));
-                }
-                else
-                    resolve(Buffer.concat(chunks).toString('utf8'));
-            });
-            child.stdin.end(request);
-        });
-    if (Buffer.byteLength(output) > limits.responseBytes)
-        throw new SigningFailure(`REFUSE·signer ${lot.keyId} response exceeds declared limit`);
-    try {
-        return protocol.reply(output, lot);
-    }
-    catch {
-        throw new SigningFailure(`REFUSE·signer ${lot.keyId} invalid response`);
-    }
-}
+var I=Object.defineProperty;var u=(e,i)=>I(e,"name",{value:i,configurable:!0});import{spawn as S}from"node:child_process";import{readFileSync as k}from"node:fs";import{signBytes as w}from"../adapters/keys/ed25519.js";class t extends Error{static{u(this,"SigningFailure")}}async function R(e,i,f,n){if(!Number.isSafeInteger(n.timeoutMs)||n.timeoutMs<=0||!Number.isSafeInteger(n.responseBytes)||n.responseBytes<=0)throw new t(`REFUSE\xB7signer ${e.keyId} has no valid declared limits`);const m=f.request(e);let a;if(i.kind==="file")try{const y=k(i.path,"utf8");a=f.response(e.bytes.map(o=>({keyId:e.keyId,signature:w(o,y,e.algorithm)})))}catch{throw new t(`REFUSE\xB7signer ${e.keyId} file mechanism failed`)}else a=await new Promise((y,o)=>{const r=S(i.executable,[...i.args],{stdio:["pipe","pipe","pipe"],shell:!1});let g=0;const l=[];let d;const c=u(s=>{d||(d=s,r.kill("SIGKILL"),clearTimeout(p),r.stdin.destroy(),r.stdout.destroy(),r.stderr.destroy(),o(new t(`REFUSE\xB7signer ${e.keyId} ${s} \xB7 status=none \xB7 signal=SIGKILL`)))},"refuse"),p=setTimeout(()=>c("timeout"),n.timeoutMs);r.stdout.on("data",s=>{g+=s.length,g>n.responseBytes&&c("response exceeds declared limit"),d||l.push(s)}),r.stderr.on("data",()=>{}),r.stdin.on("error",()=>c("input delivery failed")),r.on("error",()=>{clearTimeout(p),o(new t(`REFUSE\xB7signer ${e.keyId} command could not start`))}),r.on("close",(s,E)=>{clearTimeout(p),d||s!==0?o(new t(`REFUSE\xB7signer ${e.keyId} ${d??"command failed"} \xB7 status=${s??"none"} \xB7 signal=${E??"none"}`)):y(Buffer.concat(l).toString("utf8"))}),r.stdin.end(m)});if(Buffer.byteLength(a)>n.responseBytes)throw new t(`REFUSE\xB7signer ${e.keyId} response exceeds declared limit`);try{return f.reply(a,e)}catch{throw new t(`REFUSE\xB7signer ${e.keyId} invalid response`)}}u(R,"invokeSigner");export{t as SigningFailure,R as invokeSigner};

package/dist/host/ports/store.js

@@ -1,18 +1 @@
-/** The store root is the tree that holds a TARGET.bound beside its .bound store. */
-import { existsSync, readdirSync } from 'node:fs';
-import { dirname, join, resolve } from 'node:path';
-import { EXTENSION, LOCK } from '@lapxo/topos/wire';
-export function storeRoot(from) {
-    const abs = resolve(from || '.');
-    let at = abs;
-    for (let i = 0; i < 64; i += 1) {
-        if (existsSync(join(at, LOCK)) && existsSync(join(at, EXTENSION)))
-            return at;
-        const parent = dirname(at);
-        if (parent === at)
-            break;
-        at = parent;
-    }
-    return abs;
-}
-export const storeDirs = (store) => existsSync(store) ? readdirSync(store, { withFileTypes: true }).filter((entry) => entry.isDirectory()).length : 0;
+var f=Object.defineProperty;var i=(r,t)=>f(r,"name",{value:t,configurable:!0});import{existsSync as o,readdirSync as l}from"node:fs";import{dirname as c,join as a,resolve as m}from"node:path";import{library14_EXTENSION as p,library14_LOCK as y}from"../../vendor/runtime.js";function O(r){const t=m(r||".");let e=t;for(let n=0;n<64;n+=1){if(o(a(e,y))&&o(a(e,p)))return e;const s=c(e);if(s===e)break;e=s}return t}i(O,"storeRoot");const S=i(r=>o(r)?l(r,{withFileTypes:!0}).filter(t=>t.isDirectory()).length:0,"storeDirs");export{S as storeDirs,O as storeRoot};

package/dist/host/ports/transport.js

@@ -1,48 +1 @@
-import { readFileSync } from 'node:fs';
-import { contentRequest, transportSelection, parse } from '@lapxo/topos/wire';
-import { boundedProcess } from "../process-lifetime.js";
-import { fetchBytes } from "../adapters/transport/http.js";
-export async function transportBytes(location, digest, lines) {
-    const scheme = new URL(location).protocol.slice(0, -1);
-    const fields = lines.flatMap(line => { const p = parse(line); return p.kind === 'fact' ? [p.value.fields] : []; });
-    const selected = transportSelection(fields, scheme);
-    if (selected === undefined)
-        throw Error(`REFUSE·transport ${scheme} no admitted content-request/1 policy`);
-    if (selected.name === 'fetch') {
-        if (!['http', 'https'].includes(scheme))
-            throw Error(`REFUSE·transport ${scheme} is not supported by this host adapter`);
-        return fetchBytes(location, selected);
-    }
-    const registryPath = process.env['BOUND_TRANSPORTS'];
-    if (!registryPath)
-        throw Error(`REFUSE·transport ${scheme} no host binding for ${selected.name}`);
-    let record;
-    try {
-        const registry = JSON.parse(readFileSync(registryPath, 'utf8'));
-        if (!registry || typeof registry !== 'object' || !Object.prototype.hasOwnProperty.call(registry, selected.name))
-            throw Error();
-        const value = registry[selected.name];
-        if (!value || typeof value !== 'object')
-            throw Error();
-        const f = value;
-        if (f.kind !== 'command' || typeof f.executable !== 'string' || !f.executable || !Array.isArray(f.args) || !f.args.every(x => typeof x === 'string'))
-            throw Error();
-        if (f.environment !== undefined && (!Array.isArray(f.environment) || !f.environment.every(x => typeof x === 'string')))
-            throw Error();
-        const names = (f.environment ?? []);
-        const env = {};
-        if (process.env.PATH !== undefined)
-            env.PATH = process.env.PATH;
-        for (const name of names)
-            if (process.env[name] !== undefined)
-                env[name] = process.env[name];
-        record = { executable: f.executable, args: f.args, env };
-    }
-    catch {
-        throw Error(`REFUSE·transport ${scheme} host binding unavailable or invalid`);
-    }
-    const result = boundedProcess(record.executable, record.args, contentRequest(location, digest, selected), selected, undefined, record.env);
-    if (result.status !== 0 || result.signal !== null)
-        throw Error(`REFUSE·transport ${scheme} failed · status ${result.status ?? result.signal}`);
-    return Buffer.from(result.stdoutBytes ?? '', 'base64');
-}
+var g=Object.defineProperty;var u=(o,l)=>g(o,"name",{value:l,configurable:!0});import{readFileSync as w}from"node:fs";import{library14_contentRequest as b,library14_transportSelection as v,library14_parse as R}from"../../vendor/runtime.js";import{boundedProcess as S}from"../process-lifetime.js";import{BoundRefusal as y}from"../refusals.js";import{fetchBytes as U}from"../adapters/transport/http.js";async function B(o,l,m,c={}){const t=new URL(o).protocol.slice(0,-1);if(c.allowedOrigins&&!c.allowedOrigins.includes(new URL(o).origin))throw new y("reference/transport","REFUSE\xB7transport origin is not allowed");if(c.signal?.aborted)throw new y("reference/cancelled","REFUSE\xB7reference cancelled");const h=m.flatMap(s=>{const a=R(s);return a.kind==="fact"?[a.value.fields]:[]}),e=v(h,t);if(e===void 0)throw Error(`REFUSE\xB7transport ${t} no admitted content-request/1 policy`);if(e.name==="fetch"){if(!["http","https"].includes(t))throw Error(`REFUSE\xB7transport ${t} is not supported by this host adapter`);return U(o,e,c)}const p=process.env.BOUND_TRANSPORTS;if(!p)throw Error(`REFUSE\xB7transport ${t} no host binding for ${e.name}`);let f;try{const s=JSON.parse(w(p,"utf8"));if(!s||typeof s!="object"||!Object.prototype.hasOwnProperty.call(s,e.name))throw Error();const a=s[e.name];if(!a||typeof a!="object")throw Error();const r=a;if(r.kind!=="command"||typeof r.executable!="string"||!r.executable||!Array.isArray(r.args)||!r.args.every(n=>typeof n=="string")||r.environment!==void 0&&(!Array.isArray(r.environment)||!r.environment.every(n=>typeof n=="string")))throw Error();const E=r.environment??[],d={};process.env.PATH!==void 0&&(d.PATH=process.env.PATH);for(const n of E)process.env[n]!==void 0&&(d[n]=process.env[n]);f={executable:r.executable,args:r.args,env:d}}catch{throw Error(`REFUSE\xB7transport ${t} host binding unavailable or invalid`)}const i=S(f.executable,f.args,b(o,l,e),e,void 0,f.env);if(i.status!==0||i.signal!==null)throw Error(`REFUSE\xB7transport ${t} failed \xB7 status ${i.status??i.signal}`);return Buffer.from(i.stdoutBytes??"","base64")}u(B,"transportBytes");export{B as transportBytes};

package/dist/host/process-lifetime.js

@@ -1,17 +1 @@
-import { spawnSync } from 'node:child_process';
-import { processOf } from "../observe/runner.js";
-/** A synchronous fold waits on a supervising host process; the supervisor owns cancellation of its child group. */
-export function boundedProcess(command, args, input, limits, cwd, env) {
-    if (!Number.isSafeInteger(limits.timeoutMs) || limits.timeoutMs <= 0 || !Number.isSafeInteger(limits.responseBytes) || limits.responseBytes <= 0)
-        throw Error('REFUSE·reader invalid process limits');
-    // The same monotonic deadline covers handoff, input and execution. Starting a
-    // fresh timer after stdin closes would leave the handoff outside the policy.
-    const deadline = process.hrtime.bigint() + BigInt(limits.timeoutMs) * 1000000n;
-    const run = spawnSync(process.execPath, [processOf('lifetime', 'host'), String(deadline), String(limits.responseBytes)], { input: JSON.stringify({ command, args, input, limits, cwd, env }), encoding: 'utf8', maxBuffer: limits.responseBytes * 12 + 4096 });
-    if (run.error || run.status !== 0)
-        throw Error(`REFUSE·reader lifetime supervisor ${run.error?.message ?? run.signal ?? run.status}`);
-    const result = JSON.parse(run.stdout);
-    if (result.failure)
-        throw Error(`REFUSE·reader ${result.failure} · status ${result.status ?? result.signal ?? 'cancelled'}${result.stderr ? ' · child stderr: ' + result.stderr : ''}`);
-    return result;
-}
+var c=Object.defineProperty;var n=(t,o)=>c(t,"name",{value:o,configurable:!0});import{spawnSync as d}from"node:child_process";import{processOf as p}from"../observe/runner.js";function m(t,o,i,e,a,u){if(!Number.isSafeInteger(e.timeoutMs)||e.timeoutMs<=0||!Number.isSafeInteger(e.responseBytes)||e.responseBytes<=0)throw Error("REFUSE\xB7reader invalid process limits");const f=process.hrtime.bigint()+BigInt(e.timeoutMs)*1000000n,s=d(process.execPath,[p("lifetime","host"),String(f),String(e.responseBytes)],{input:JSON.stringify({command:t,args:o,input:i,limits:e,cwd:a,env:u}),encoding:"utf8",maxBuffer:e.responseBytes*12+4096});if(s.error||s.status!==0)throw Error(`REFUSE\xB7reader lifetime supervisor ${s.error?.message??s.signal??s.status}`);const r=JSON.parse(s.stdout);if(r.failure)throw Error(`REFUSE\xB7reader ${r.failure} \xB7 status ${r.status??r.signal??"cancelled"}${r.stderr?" \xB7 child stderr: "+r.stderr:""}`);return r}n(m,"boundedProcess");export{m as boundedProcess};

package/dist/host/profile-composition.d.ts

@@ -0,0 +1 @@
+export {public6_ProfileCompositionRequest as ProfileCompositionRequest,public6_ProfileFieldBinding as ProfileFieldBinding,public6_ReleaseCategory as ReleaseCategory,public6_composeProfile as composeProfile,public6_profileDigest as profileDigest,public6_releaseCategoryPins as releaseCategoryPins} from "../public-types.js";

package/dist/host/profile-composition.js

@@ -0,0 +1,2 @@
+var z=Object.defineProperty;var u=(o,n)=>z(o,"name",{value:n,configurable:!0});import{sha256 as S}from"./hash.js";import{library5_decodeProfileComposition as B,library5_encodeProfileComposition as W,library5_inspectProfileComposition as A}from"../vendor/runtime.js";import{fieldOf as r}from"../fold/claims.js";import{lockLines as D,lockStanding as L}from"../fold/keys.js";import{authorityFor as T,rootSigner as U}from"../fold/signers.js";import{ownRecordAdmitted as j}from"../fold/signed.js";import{signaturesOf as G}from"../fold/digests.js";import{wordOf as x}from"../fold/wire.js";import{storeOf as H}from"../land/ledger.js";import{widenedWithoutWitness as I}from"../judge/widening.js";import{BoundRefusal as J,refuseBound as t}from"./refusals.js";const K=u(o=>S(o+`
+`),"profileDigest");function se(o){const{profile:n,profiles:h,budget:m}=o,a=new Map(o.fields.map(e=>[e.contract,e]));a.size!==o.fields.length&&t("profile/ambiguous-field");let s;try{s=A(n,{profiles:h,fields:new Map(o.fields.map(e=>[e.contract,e.field])),digest:S},m)}catch(e){throw new J("profile/declaration","REFUSE\xB7profile/declaration "+(e instanceof Error?e.message:"Topos declaration refused"))}s.status==="open"&&t("profile/missing-parent"),s.fields.some(e=>e.composition!=="compatible")&&t("profile/incompatible");const l=H(o.root),d=D(l),f=L(l),w=G(l).admitted,P=T(d,U(o.root),w).admitted,E=P.some(e=>!e.coverage.includes("*"))?x(f,"families","region"):"",C=o.statements.filter(e=>j(e,o.place,E,P,w)),y=new Map;function v(e){if(y.has(e))return;const c=h.get(e);c===void 0&&t("profile/missing-parent");const i=B(c,m);y.set(e,i);for(const p of i.parents)v(p)}u(v,"visit");for(const e of n.parents)v(e);const b=K(W(n,m));y.set(b,n);const O=u((e,c)=>{const i=a.get(e.contract);if(!i||i.field.coordinate!==e.coordinate)return t("profile/undeclared-field");const p=C.filter(g=>r(g,"scope")===i.scope&&r(g,"role")===i.role&&r(g,"form")===i.form&&r(g,"measure")===i.measure&&r(g,"value")===e.value&&r(g,"restsOn")===c);return p.length!==1?t(p.length?"profile/ambiguous-authority":"profile/authority-required"):p[0]},"lineFor"),F=[...y].filter(([e])=>e!==b).flatMap(([e,c])=>c.fields.map(i=>O(i,e))),M=n.fields.map(e=>O(e,b)),R=x(f,"at-classes","witness");for(const e of F){const c=M.filter(i=>["scope","role","form","measure"].every(p=>r(i,p)===r(e,p)));I(c,[e],()=>!0,R).length&&t("profile/widening-witness-required")}const _=[...F,...M],k=N(s.pins,o.categories,C);return{status:"prepared",digest:b,inspection:s,lines:_,pins:s.pins,releases:k}}u(se,"composeProfile");function N(o,n,h){const m=[];for(const a of o){const s=n.filter(f=>f.category===a.category);s.length||t("release/category-missing"),s.length!==1&&t("release/category-ambiguous");const l=s[0];(l.class!==a.class||a.algorithm!=="sha256")&&t("release/category-class");const d=h.filter(f=>r(f,"scope")===l.scope&&r(f,"role")===l.role&&r(f,"form")==="alphabet"&&r(f,"measure")===l.measure);d.length||t("release/pin-missing"),d.length!==1&&t("release/pin-ambiguous"),r(d[0],"value")!==a.digest&&t("release/pin-integrity"),m.push(d[0])}return new Set(o.map(a=>a.category)).size!==o.length&&t("release/category-ambiguous"),m}u(N,"releaseCategoryPins");export{se as composeProfile,K as profileDigest,N as releaseCategoryPins};

package/dist/host/provide.js

@@ -1,183 +1 @@
-import * as nodeModule from 'node:module';
-import { realpathSync } from 'node:fs';
-import { join, relative, isAbsolute, sep } from 'node:path';
-import { pathToFileURL } from 'node:url';
-import { fieldOf } from "../fold/claims.js";
-import { observeText } from "../observe/files.js";
-import { ownLock, ownStore, ownRoot } from "../observe/runner.js";
-import { runtimeTreeAt } from "./release.js";
-import { ContentNeeded } from "./content-needed.js";
-import { theWord } from "../fold/wire.js";
-const findPackageJSON = nodeModule.findPackageJSON;
-const registerHooks = nodeModule.registerHooks;
-const taken = (exp) => (typeof exp === 'string' ? exp : exp && typeof exp === 'object' && 'default' in exp && typeof exp.default === 'string' ? exp.default : '');
-/**
- * Resolve declared library bytes for this host. A library's shape may select an
- * archive coordinate; world selection remains the standing contract.
- */
-export function pinPlace(name) {
-    const lock = ownLock();
-    const line = lock.find((one) => fieldOf(one, 'scope') === `dep/${name}` && fieldOf(one, 'role') === 'reads')
-        ?? lock.find((one) => fieldOf(one, 'scope') === `uses/${name}`);
-    if (line === undefined)
-        return '';
-    const digest = fieldOf(line, 'value');
-    return digest ? runtimeTreeAt(ownStore(), ownRoot(), digest, ownStore(), fieldOf(line, 'role') === 'reads' ? fieldOf(line, 'shape') : '') ?? '' : '';
-}
-export function pinExport(name, sub) {
-    const at = pinPlace(name);
-    const file = taken(JSON.parse(observeText(join(at, manifestOf())) ?? '{}').exports?.[sub]);
-    return at && file ? join(at, file) : '';
-}
-export function pinName(name) {
-    const at = pinPlace(name);
-    return at ? (JSON.parse(observeText(join(at, manifestOf())) ?? '{}').name ?? '') : '';
-}
-const manifestOf = () => `${theWord(ownLock(), 'pin-shape')}.json`;
-/** Node package resolution at a digest-laid library; exports remain authoritative. */
-export function resolvePinned(specifier, context, nextResolve, pin) {
-    if (pin.exports)
-        return nextResolve(specifier, { ...context, parentURL: pin.json });
-    const sub = specifier === pin.pkg ? '' : specifier.slice(pin.pkg.length + 1);
-    const requested = join(pin.at, sub);
-    const coordinate = relative(pin.at, requested);
-    if (isAbsolute(coordinate) || coordinate === '..' || coordinate.startsWith(`..${sep}`))
-        throw new Error('REFUSE·pin library import leaves its laid tree');
-    const file = nodeModule.createRequire(pin.json).resolve(requested);
-    const entry = relative(realpathSync(pin.at), realpathSync(file));
-    if (isAbsolute(entry) || entry === '..' || entry.startsWith(`..${sep}`))
-        throw new Error('REFUSE·pin library entry leaves its laid tree');
-    return nextResolve(pathToFileURL(file).href, context);
-}
-/**
- * A blob stays self-contained. The one thing it does not carry is the SDK the host provides: an import whose package
- * the instrument's own lock names at dep/<name> resolves at the place pinPlace delivers. Nothing is linked into the
- * blob's folder.
- */
-let hooked = false;
-function nativeResolution() {
-    const installed = Object.getOwnPropertyDescriptor(globalThis, Symbol.for('bound.native.resolution@1'));
-    if (!installed)
-        return undefined;
-    const capability = installed.value;
-    if (installed.configurable !== false || installed.writable !== false || !capability || !Object.isFrozen(capability) || capability.profile !== 'fixed-native-resolution@1' || !Array.isArray(capability.libraryNames) || !Object.isFrozen(capability.libraryNames) || capability.libraryNames.some(name => typeof name !== 'string') || !Array.isArray(capability.libraries) || !Object.isFrozen(capability.libraries) || capability.libraries.some(lib => !lib || !Object.isFrozen(lib) || typeof lib.name !== 'string' || typeof lib.manifest !== 'string') || typeof capability.assertPins !== 'function')
-        throw Error('REFUSE·pin fixed resolution capability invalid');
-    return capability;
-}
-/** Fixed execution selects libraries by the instrument's explicit local mount,
- * before opening any artifact. An alias or package-name guess grants nothing. */
-export function selectNativeDependencies(root, dependencies, manifest) {
-    const capability = nativeResolution();
-    if (!capability)
-        return undefined;
-    if (dependencies.length && capability.libraries.some(library => typeof library.coordinate !== 'string' || !library.coordinate))
-        throw Error('REFUSE·pin fixed resolution logical library coordinate missing');
-    const selected = new Map(capability.libraries.map(library => [library.coordinate, library]));
-    return dependencies.flatMap(line => {
-        const mount = fieldOf(line, 'needs');
-        if (!mount)
-            return [];
-        const library = selected.get(mount.replace(/\/+$/, '') + '/' + manifest);
-        if (!library)
-            return [];
-        let actual;
-        try {
-            actual = realpathSync(join(root, mount, manifest));
-        }
-        catch {
-            throw Error('REFUSE·pin selected library mount absent ' + library.name);
-        }
-        if (actual !== library.manifest)
-            throw Error('REFUSE·pin selected library mount differs ' + library.name);
-        return [{ line, library }];
-    });
-}
-/** A declared artifact is not automatically an active Node library. This fixed
- * assertion reuses only the packages selected by the actual host boundary. */
-export function reuseNativeResolution(pins) {
-    const capability = nativeResolution();
-    if (!capability)
-        return false;
-    const selected = new Set(capability.libraryNames);
-    // The fixed preload owns this closed assertion. Package names select which
-    // declared pins participate; exact manifests and member bytes still decide.
-    capability.assertPins(pins.filter(pin => selected.has(pin.pkg)).map(pin => ({ name: pin.pkg, at: pin.at })));
-    return true;
-}
-/** Read one resolved archive's manifest; a selected fixed library cannot vanish
- * into the optional historical provider path when its archive is absent. */
-export function readProvidedPin(name, at, file, requiredName) {
-    if (!at) {
-        if (requiredName !== undefined)
-            throw Error('REFUSE·pin fixed resolution requires declared library ' + name);
-        return undefined;
-    }
-    const manifest = JSON.parse(observeText(join(at, file)) ?? '{}'), pkg = typeof manifest.name === 'string' ? manifest.name : '';
-    if (requiredName !== undefined && pkg !== requiredName)
-        throw Error('REFUSE·pin fixed resolution library name differs ' + name);
-    return pkg ? { at, pkg, exports: Object.prototype.hasOwnProperty.call(manifest, 'exports'), href: pathToFileURL(at).href, json: pathToFileURL(join(at, file)).href } : undefined;
-}
-export function provide() {
-    if (hooked)
-        return;
-    const dependencies = ownLock().filter((line) => fieldOf(line, 'scope').startsWith('dep/') && fieldOf(line, 'role') === 'reads');
-    const file = manifestOf(), selected = selectNativeDependencies(ownRoot(), dependencies, file);
-    const load = (line, requiredName) => {
-        const name = fieldOf(line, 'scope').slice('dep/'.length), at = pinPlace(name);
-        if (!at)
-            throw new ContentNeeded(fieldOf(line, 'value'), 'REFUSE·pin declared library unavailable ' + name);
-        const pin = readProvidedPin(name, at, file, requiredName);
-        if (!pin)
-            throw Error('REFUSE·pin declared library unavailable ' + name);
-        return pin;
-    };
-    if (selected !== undefined) {
-        reuseNativeResolution(selected.map(({ line, library }) => load(line, library.name)));
-        hooked = true;
-        return;
-    }
-    // A mount selects a library, but its manifest is only a routing hint until
-    // an import requests it. The selected archive alone supplies executable bytes.
-    const mounts = dependencies.filter(line => fieldOf(line, 'needs') !== '').map(line => {
-        const mount = join(ownRoot(), fieldOf(line, 'needs'));
-        const manifest = JSON.parse(observeText(join(mount, file)) ?? '{}');
-        return { line, mount, pkg: typeof manifest.name === 'string' ? manifest.name : '' };
-    });
-    const verified = new Map();
-    registerHooks({
-        resolve(specifier, context, nextResolve) {
-            if (specifier.startsWith('.') || specifier.startsWith('/') || specifier.includes(':'))
-                return nextResolve(specifier, context);
-            let selected = mounts.find(one => one.pkg && (specifier === one.pkg || specifier.startsWith(one.pkg + '/')));
-            if (!selected) {
-                // Identify the installed package before following its executable entry:
-                // a renamed manifest and an escaping entry cannot bypass the declared mount.
-                let manifest;
-                try {
-                    manifest = findPackageJSON(specifier, pathToFileURL(join(ownRoot(), file)).href);
-                }
-                catch { }
-                if (manifest)
-                    selected = mounts.find(one => {
-                        try {
-                            return realpathSync(join(one.mount, file)) === realpathSync(manifest);
-                        }
-                        catch {
-                            return false;
-                        }
-                    });
-            }
-            if (!selected)
-                return nextResolve(specifier, context);
-            let pin = verified.get(selected.line);
-            if (!pin) {
-                pin = load(selected.line);
-                verified.set(selected.line, pin);
-            }
-            if (specifier !== pin.pkg && !specifier.startsWith(pin.pkg + '/'))
-                throw Error('REFUSE·pin selected library name differs');
-            return resolvePinned(specifier, context, nextResolve, pin);
-        },
-    });
-    hooked = true;
-}
+var P=Object.defineProperty;var f=(r,e)=>P(r,"name",{value:e,configurable:!0});import*as E from"node:module";import{realpathSync as y}from"node:fs";import{join as d,relative as F,isAbsolute as O,sep as R}from"node:path";import{pathToFileURL as h}from"node:url";import{fieldOf as c}from"../fold/claims.js";import{observeText as b}from"../observe/files.js";import{ownLock as w,ownStore as U,ownRoot as g}from"../observe/runner.js";import{runtimeTreeAt as W}from"./release.js";import{ContentNeeded as x}from"./content-needed.js";import{theWord as A}from"../fold/wire.js";const J=E.findPackageJSON,$=E.registerHooks,z=f(r=>typeof r=="string"?r:r&&typeof r=="object"&&"default"in r&&typeof r.default=="string"?r.default:"","taken");function S(r){const e=w(),o=e.find(l=>c(l,"scope")===`dep/${r}`&&c(l,"role")==="reads")??e.find(l=>c(l,"scope")===`uses/${r}`);if(o===void 0)return"";const n=c(o,"value");return n?W(U(),g(),n,U(),c(o,"role")==="reads"?c(o,"shape"):"")??"":""}f(S,"pinPlace");function Y(r,e){const o=S(r),n=z(JSON.parse(b(d(o,k()))??"{}").exports?.[e]);return o&&n?d(o,n):""}f(Y,"pinExport");function Z(r){const e=S(r);return e?JSON.parse(b(d(e,k()))??"{}").name??"":""}f(Z,"pinName");const k=f(()=>`${A(w(),"pin-shape")}.json`,"manifestOf");function M(r,e,o,n){if(n.exports)return o(r,{...e,parentURL:n.json});const l=r===n.pkg?"":r.slice(n.pkg.length+1),s=d(n.at,l),t=F(n.at,s);if(O(t)||t===".."||t.startsWith(`..${R}`))throw new Error("REFUSE\xB7pin library import leaves its laid tree");const i=E.createRequire(n.json).resolve(s),a=F(y(n.at),y(i));if(O(a)||a===".."||a.startsWith(`..${R}`))throw new Error("REFUSE\xB7pin library entry leaves its laid tree");return o(h(i).href,e)}f(M,"resolvePinned");let v=!1;function j(){const r=Object.getOwnPropertyDescriptor(globalThis,Symbol.for("bound.native.resolution@1"));if(!r)return;const e=r.value;if(r.configurable!==!1||r.writable!==!1||!e||!Object.isFrozen(e)||e.profile!=="fixed-native-resolution@1"||!Array.isArray(e.libraryNames)||!Object.isFrozen(e.libraryNames)||e.libraryNames.some(o=>typeof o!="string")||!Array.isArray(e.libraries)||!Object.isFrozen(e.libraries)||e.libraries.some(o=>!o||!Object.isFrozen(o)||typeof o.name!="string"||typeof o.manifest!="string")||typeof e.assertPins!="function")throw Error("REFUSE\xB7pin fixed resolution capability invalid");return e}f(j,"nativeResolution");function T(r,e,o){const n=j();if(!n)return;if(e.length&&n.libraries.some(s=>typeof s.coordinate!="string"||!s.coordinate))throw Error("REFUSE\xB7pin fixed resolution logical library coordinate missing");const l=new Map(n.libraries.map(s=>[s.coordinate,s]));return e.flatMap(s=>{const t=c(s,"needs");if(!t)return[];const i=l.get(t.replace(/\/+$/,"")+"/"+o);if(!i)return[];let a;try{a=y(d(r,t,o))}catch{throw Error("REFUSE\xB7pin selected library mount absent "+i.name)}if(a!==i.manifest)throw Error("REFUSE\xB7pin selected library mount differs "+i.name);return[{line:s,library:i}]})}f(T,"selectNativeDependencies");function L(r){const e=j();if(!e)return!1;const o=new Set(e.libraryNames);return e.assertPins(r.filter(n=>o.has(n.pkg)).map(n=>({name:n.pkg,at:n.at}))),!0}f(L,"reuseNativeResolution");function D(r,e,o,n){if(!e){if(n!==void 0)throw Error("REFUSE\xB7pin fixed resolution requires declared library "+r);return}const l=JSON.parse(b(d(e,o))??"{}"),s=typeof l.name=="string"?l.name:"";if(n!==void 0&&s!==n)throw Error("REFUSE\xB7pin fixed resolution library name differs "+r);return s?{at:e,pkg:s,exports:Object.prototype.hasOwnProperty.call(l,"exports"),href:h(e).href,json:h(d(e,o)).href}:void 0}f(D,"readProvidedPin");function _(){if(v)return;const r=w().filter(t=>c(t,"scope").startsWith("dep/")&&c(t,"role")==="reads"),e=k(),o=T(g(),r,e),n=f((t,i)=>{const a=c(t,"scope").slice(4),u=S(a);if(!u)throw new x(c(t,"value"),"REFUSE\xB7pin declared library unavailable "+a);const p=D(a,u,e,i);if(!p)throw Error("REFUSE\xB7pin declared library unavailable "+a);return p},"load");if(o!==void 0){L(o.map(({line:t,library:i})=>n(t,i.name))),v=!0;return}const l=r.filter(t=>c(t,"needs")!=="").map(t=>{const i=d(g(),c(t,"needs")),a=JSON.parse(b(d(i,e))??"{}");return{line:t,mount:i,pkg:typeof a.name=="string"?a.name:""}}),s=new Map;$({resolve(t,i,a){if(t.startsWith(".")||t.startsWith("/")||t.includes(":"))return a(t,i);let u=l.find(m=>m.pkg&&(t===m.pkg||t.startsWith(m.pkg+"/")));if(!u){let m;try{m=J(t,h(d(g(),e)).href)}catch{}m&&(u=l.find(N=>{try{return y(d(N.mount,e))===y(m)}catch{return!1}}))}if(!u)return a(t,i);let p=s.get(u.line);if(p||(p=n(u.line),s.set(u.line,p)),t!==p.pkg&&!t.startsWith(p.pkg+"/"))throw Error("REFUSE\xB7pin selected library name differs");return M(t,i,a,p)}}),v=!0}f(_,"provide");export{Y as pinExport,Z as pinName,S as pinPlace,_ as provide,D as readProvidedPin,M as resolvePinned,L as reuseNativeResolution,T as selectNativeDependencies};

package/dist/host/read-only.js

@@ -1,9 +1 @@
-import { AsyncLocalStorage } from 'node:async_hooks';
-/** Prospective evaluation may read existing evidence and calculate values, but cannot acquire evidence or persist caches. */
-const mode = new AsyncLocalStorage();
-export const readOnly = () => mode.getStore() === true;
-export const withoutEffects = (evaluate) => mode.run(true, evaluate);
-export function requireEffects(operation) {
-    if (readOnly())
-        throw Error(`REFUSE·preview ${operation} requires an act; fold the declared inputs first`);
-}
+var n=Object.defineProperty;var r=(e,o)=>n(e,"name",{value:o,configurable:!0});import{AsyncLocalStorage as c}from"node:async_hooks";const t=new c,f=r(()=>t.getStore()===!0,"readOnly"),u=r(e=>t.run(!0,e),"withoutEffects");function a(e){if(f())throw Error(`REFUSE\xB7preview ${e} requires an act; fold the declared inputs first`)}r(a,"requireEffects");export{f as readOnly,a as requireEffects,u as withoutEffects};