@lapxo/bound 0.2.4 → 0.2.6

package/dist/host/reading-closures.js

@@ -1,227 +1,7 @@
-import { actCosts } from "./act-cost.js";
-import { mkdirSync, readFileSync, existsSync } from 'node:fs';
-import { join, dirname } from 'node:path';
-import { canonical, parse, PROTOCOL, byBytes } from '@lapxo/topos/wire';
-import { replaceWhole, landShard, shardLines } from "../land/ledger.js";
-import { fieldOf } from "../fold/claims.js";
-import { readOnly } from "./read-only.js";
-import { readingIdentityBytes, readingReceiptIdentity, responseIdentity, snapshotAccess, placeInputs, withPlaceInputs } from '@lapxo/topos/contract';
-import { withReadingBoundary } from "./reading-context.js";
-const receiptScope = (scope) => [scope, 'identity'].join('/');
-const fields = (line) => { const got = parse(line); if (got.kind !== 'fact')
-    throw Error('REFUSE·input projection contains a non-wire line'); return got.value.fields; };
-export const inputLines = (files) => files.map(file => canonical({ scope: file.place, form: 'alphabet', measure: 'text', role: 'writes', value: 'lock', shape: file.place, about: file.text, by: 'host', at: 'policy:handed-input' }));
-/** One portable native receipt carrier shared by file plans and native capsule batches. */
-export function portableReadingReceipt(scope, by, closure, output, hash, modern = true, costs = []) {
-    const input = hash(closure), payload = hash(output), rows = output.split('\n').filter(Boolean);
-    return [...(modern ? [canonical({ scope: receiptScope(scope), role: 'writes', form: 'alphabet', measure: 'digest', value: readingReceiptIdentity(input, payload, bytes => hash(new TextDecoder().decode(bytes))), by, at: 'place:' + input })] : []), canonical({ scope, role: 'writes', form: 'alphabet', measure: 'observed', value: payload, by, at: 'place:' + payload }), canonical({ scope, role: 'writes', form: 'alphabet', measure: 'bytes', value: input, by, at: 'place:' + input, about: closure }), canonical({ scope, role: 'writes', form: 'interval', measure: 'count', value: `${rows.length}..${rows.length}`, by, at: 'place:' + payload, about: output }), ...costs];
-}
-/** The selected world owns input projection and reading. The host only verifies closures and keeps native count/bytes receipts. */
-export function readingClosures(options) {
-    const { root, store, reader, speaker, digest: hash, capsule, region, projection, files } = options, emit = options.emit ?? (() => { });
-    options.assertCurrent?.();
-    if (options.context)
-        readingIdentityBytes(options.context);
-    let access = [];
-    if (options.current) {
-        if (!options.context)
-            throw Error('REFUSE·current reading requires a declared identity');
-        const { snapshot, kept, current, permission } = options.current;
-        if (current.implementation !== options.context.implementation)
-            throw Error('REFUSE·current reading implementation differs from its verified context');
-        const response = responseIdentity(snapshot, current, hash), allowed = snapshotAccess(snapshot, kept, current, permission, hash);
-        if (!allowed.inspect || !allowed.reuse)
-            throw Error('REFUSE·current reading is not admitted for reuse');
-        access = [['response', response], ['permission', hash(JSON.stringify([permission.inspect, permission.reuse, permission.freshness]))]];
-    }
-    if (options.execution && (!options.context || JSON.stringify(readingIdentityBytes(options.execution.context)) !== JSON.stringify(readingIdentityBytes(options.context))))
-        throw Error('REFUSE·reading execution differs from declared context');
-    const projectionFor = (name) => {
-        if (!capsule.selectedWorld)
-            return undefined;
-        const { standing, offer } = capsule.selectedWorld;
-        const selectors = standing.parts.some(part => part.scope === `${offer}/place-inputs/${name}` && part.measure === 'reads');
-        if (!selectors)
-            return undefined;
-        if (!options.context || !options.execution || !options.livePlace)
-            throw Error('REFUSE·place inputs require authenticated shadow and reading context ' + name);
-        return placeInputs(standing, offer, name, options.livePlace(), bytes => hash(new TextDecoder().decode(bytes)));
-    };
-    const projectedPlace = projectionFor(projection), readingPlace = projectionFor(region);
-    const commit = (context, name, place) => place && context ? withPlaceInputs(context, JSON.stringify(['place-inputs', capsule.selectedWorld.offer, name]), place) : context;
-    const ask = (identity, requests, context = options.context) => withReadingBoundary(identity, options.execution && context ? { ...options.execution, context } : options.execution, () => capsule.ask(requests, options.readerReference));
-    const projectionContext = commit(options.context, projection, projectedPlace);
-    const base = projectionContext ? hash(new TextDecoder().decode(readingIdentityBytes(projectionContext))) : '';
-    const algorithm = hash('').split(':')[0], handed = new Map(files.map(file => [file.place, file.text]));
-    if (handed.size !== files.length)
-        throw Error('REFUSE·input projection has duplicate handed coordinates');
-    const verify = () => { for (const file of files)
-        if (!readFileSync(join(root, file.place)).equals(Buffer.from(file.text)))
-            throw Error('REFUSE·input changed ' + file.place); };
-    verify();
-    const projected = ask(base, [{ ...(projectedPlace ? { place: projectedPlace } : {}), protocol: PROTOCOL, verb: 'render', rootScope: '', region: projection, at: 1, reads: ['**'], lines: inputLines(files), files: [] }], projectionContext)[0];
-    if (projected?.kind !== 'fact' || !Array.isArray(projected.lines))
-        throw Error('REFUSE·input projection ' + (projected?.why ?? 'no lines'));
-    const plans = new Map();
-    for (const line of projected.lines) {
-        const f = fields(line), scope = f.scope ?? '', resolution = /^receipt:(\d+)$/.exec(f.at ?? '');
-        if (!scope || plans.has(scope) || f.form !== 'alphabet' || f.measure !== 'reads' || f.role !== 'reads' || !resolution)
-            throw Error('REFUSE·input projection ambiguous reading ' + scope);
-        const inputs = (f.value ?? '').split('|').filter(Boolean), needs = (f.needs ?? '').split('|').filter(Boolean);
-        // An aggregate reads its declared receipts; it need not reread a leaf file.
-        if ((!inputs.length && !needs.length) || new Set(inputs).size !== inputs.length || inputs.some(input => !handed.has(input)) || new Set(needs).size !== needs.length)
-            throw Error('REFUSE·input projection has unhanded or duplicate dependencies ' + scope);
-        const n = Number(resolution[1]);
-        if (!Number.isSafeInteger(n))
-            throw Error('REFUSE·input projection invalid resolution ' + scope);
-        plans.set(scope, { scope, inputs, needs, resolution: n, line: canonical({ scope, form: f.form, measure: f.measure, role: f.role, value: inputs.join('|'), needs: needs.join('|'), at: f.at }) });
-    }
-    if (!plans.size)
-        throw Error('REFUSE·input projection returned no readings');
-    const ordered = [], visiting = new Set(), done = new Set();
-    const visit = (scope) => { if (done.has(scope))
-        return; if (visiting.has(scope))
-        throw Error('REFUSE·input projection dependency cycle ' + scope); const p = plans.get(scope); if (!p)
-        throw Error('REFUSE·input projection missing reading ' + scope); visiting.add(scope); for (const need of p.needs)
-        visit(need); visiting.delete(scope); done.add(scope); ordered.push(p); };
-    for (const scope of plans.keys())
-        visit(scope);
-    const identity = hash([capsule.selection ?? '', capsule.digest, region, projection, ...(options.lifetime === undefined ? [] : [JSON.stringify(options.lifetime)])].join('\n')), by = speaker + ':' + identity.split(':')[1].slice(0, 12), journal = 'reading-closures/' + identity.split(':')[1];
-    const prior = shardLines(store, speaker, journal), results = new Map(), out = [];
-    const carried = (digest) => join(store, 'cas', 'carried', digest.split(':')[1] ?? '');
-    const saved = (text) => { const digest = hash(text), path = carried(digest); mkdirSync(dirname(path), { recursive: true }); if (!existsSync(path) || hash(readFileSync(path, 'utf8')) !== digest)
-        replaceWhole(path, text); return digest; };
-    const load = (digest) => { if (!digest.startsWith(algorithm + ':') || !/^[a-f0-9]+$/.test(digest.split(':')[1] ?? ''))
-        return; const path = carried(digest); if (!existsSync(path))
-        return; const text = readFileSync(path, 'utf8'); return hash(text) === digest ? text : undefined; };
-    let read = 0, opened = 0, executed = 0;
-    for (const plan of ordered) {
-        actCosts.measure(() => {
-            // Retained evidence does not authorize a current answer.
-            options.assertCurrent?.();
-            const legacyClosure = [plan.line, canonical({ scope: 'implementation', role: 'writes', form: 'alphabet', measure: 'digest', value: identity, by: 'host', at: 'policy:input-identity' }), ...plan.inputs.map(input => canonical({ scope: input, role: 'writes', form: 'alphabet', measure: 'digest', value: hash(handed.get(input)), by: 'host', at: 'policy:input-identity' })), ...plan.needs.map(need => canonical({ scope: need, role: 'writes', form: 'alphabet', measure: 'digest', value: results.get(need).digest, by: 'host', at: 'policy:input-identity' }))].sort(byBytes).join('\n') + '\n';
-            const leafContext = commit(options.context, region, readingPlace);
-            const context = leafContext && { ...leafContext, policy: hash(JSON.stringify([leafContext.policy, options.allowsEmpty === true, options.lifetime ?? null, options.readerReference ?? null, capsule.selection ?? null, capsule.lines])), inputs: [...[...leafContext.inputs, ...access].map(([name, digest]) => [JSON.stringify(['context', name]), digest]), [JSON.stringify(['plan']), hash(plan.line)], ...plan.inputs.map(input => [JSON.stringify(['file', input]), hash(handed.get(input))]), ...plan.needs.map(need => [JSON.stringify(['receipt', need]), results.get(need).digest])] };
-            const closure = context ? new TextDecoder().decode(readingIdentityBytes(context)) : legacyClosure;
-            const input = hash(closure), scope = 'receipts/readings/' + hash(plan.scope).split(':')[1] + '/' + input.split(':')[1], matching = prior.filter(line => fieldOf(line, 'scope') === scope && fieldOf(line, 'measure') === 'bytes' && fieldOf(line, 'value') === input).at(-1);
-            const count = matching && prior.filter(line => fieldOf(line, 'scope') === scope && fieldOf(line, 'measure') === 'count' && fieldOf(line, 'by') === by).at(-1);
-            const heldOutput = count && load(fieldOf(count, 'at').replace(/^place:/, ''));
-            const heldLines = heldOutput?.split('\n').filter(Boolean);
-            const output = heldLines !== undefined && fieldOf(count, 'value') === `${heldLines.length}..${heldLines.length}` && heldLines.every(line => { const f = fields(line); return f.by === by && f.at === 'place:' + input; }) ? heldOutput : undefined;
-            let lines, payload;
-            if (output !== undefined && load(input) === closure) {
-                if (output === '' && !options.allowsEmpty)
-                    throw Error('REFUSE·reading empty response is not admitted ' + plan.scope);
-                lines = output.split('\n').filter(Boolean);
-                for (const line of lines)
-                    fields(line);
-                payload = fieldOf(count, 'at').replace(/^place:/, '');
-            }
-            else {
-                if (readOnly())
-                    throw Error('REFUSE·preview reading closure is unpaid ' + plan.scope);
-                const started = process.hrtime.bigint();
-                const dependencies = plan.needs.flatMap(need => results.get(need).lines), answer = ask(input, [{ ...(readingPlace ? { place: readingPlace } : {}), protocol: PROTOCOL, verb: 'read', rootScope: plan.scope, name: plan.scope, region, at: plan.resolution, reads: ['**'], lines: [...inputLines(plan.inputs.map(place => ({ place, text: handed.get(place) }))), ...dependencies], files: [] }], context)[0];
-                if (answer?.kind !== 'fact' || !Array.isArray(answer.claims))
-                    throw Error('REFUSE·reading ' + plan.scope + ' · ' + (answer?.why ?? 'no claims'));
-                lines = answer.claims.map((unknown) => { if (typeof unknown?.scope !== 'string' || typeof unknown?.measure !== 'string' || typeof unknown?.role !== 'string' || !unknown.bound || !['interval', 'enumerated'].includes(unknown.bound.kind))
-                    throw Error('REFUSE·reading malformed claim ' + plan.scope); const span = unknown.bound; const text = canonical({ scope: unknown.scope, measure: unknown.measure, role: unknown.role, form: span.kind === 'interval' ? 'interval' : 'alphabet', value: span.kind === 'interval' ? `${span.lo}..${span.hi}` : Array.isArray(span.values) ? span.values.join('|') : '', by, at: 'place:' + input }); fields(text); return text; });
-                if (!lines.length && !options.allowsEmpty)
-                    throw Error('REFUSE·reading empty response is not admitted ' + plan.scope);
-                executed++;
-                verify();
-                options.assertCurrent?.();
-                payload = saved(lines.length ? [...lines].sort(byBytes).join('\n') + '\n' : '');
-                if (saved(closure) !== input)
-                    throw Error('REFUSE·receipt input closure mismatch');
-                const seconds = (Number(process.hrtime.bigint() - started) / 1e9).toFixed(6);
-                landShard(store, speaker, journal, [canonical({ scope, role: 'writes', form: 'interval', measure: 'count', value: `${lines.length}..${lines.length}`, by, at: 'place:' + payload }), canonical({ scope, role: 'writes', form: 'alphabet', measure: 'bytes', value: input, by, at: 'place:' + input }), canonical({ scope, role: 'writes', form: 'interval', measure: 's', value: seconds + '..' + seconds, by, at: 'place:' + input })]);
-                if (plan.resolution === 1)
-                    opened++;
-            }
-            const receipt = context ? readingReceiptIdentity(input, payload, bytes => hash(new TextDecoder().decode(bytes))) : payload;
-            if (context && plan.resolution !== 1)
-                out.push(canonical({ scope: receiptScope(scope), role: 'writes', form: 'alphabet', measure: 'digest', value: receipt, by, at: 'place:' + input }));
-            results.set(plan.scope, { digest: receipt, lines });
-            out.push(canonical({ scope: plan.scope, role: 'writes', form: 'alphabet', measure: 'observed', value: input, by, at: 'place:' + input }), 
-            // A logical reading name is not a physical input coordinate. Preserve the
-            // host-verified handoff beside the result so portable file seals retain
-            // every input, including explicitly read foreign files.
-            // Input witnesses do not locate the result at each input. Result attribution
-            // remains the logical reading's place; two inputs are not two new origins.
-            ...plan.inputs.map(coordinate => canonical({ scope: coordinate, role: 'writes', form: 'alphabet', measure: 'observed', value: hash(handed.get(coordinate)), by, at: 'witness:' + input })), ...lines);
-            if (plan.resolution === 1) {
-                read++;
-                const output = load(payload);
-                if (output === undefined)
-                    throw Error('REFUSE·receipt missing verified carrier ' + payload);
-                const costs = shardLines(store, speaker, journal).filter(line => fieldOf(line, 'scope') === scope && fieldOf(line, 'measure') === 's' && fieldOf(line, 'at') === 'place:' + input);
-                out.push(...portableReadingReceipt(scope, by, closure, output, hash, !!context, costs));
-            }
-        });
-    }
-    verify();
-    emit(`RECEIPTS ${read} read · ${opened} opened · reading closures`);
-    return { lines: out, read, opened, executed };
-}
-/** Verify the native reading carriers before a file seal may reuse them. These are semantic receipts, not file-region seals. */
-export function verifiedReadingReceipts(store, lines, digest, environment, requireContext = false) {
-    const units = lines.filter(line => fieldOf(line, 'scope').startsWith('receipts/readings/') && fieldOf(line, 'measure') === 'bytes' && fieldOf(line, 'role') === 'writes');
-    const load = (id, row) => {
-        const hex = id.split(':')[1];
-        if (!hex || !/^[a-f0-9]+$/.test(hex))
-            return;
-        const supplied = fields(row).about;
-        // A supplied carrier must authenticate even if an old local copy still exists.
-        if (supplied !== undefined)
-            return digest(supplied) === id ? supplied : undefined;
-        const path = join(store, 'cas', 'carried', hex);
-        if (!existsSync(path))
-            return;
-        const bytes = readFileSync(path, 'utf8');
-        return digest(bytes) === id ? bytes : undefined;
-    };
-    for (const unit of units) {
-        const input = fieldOf(unit, 'value'), scope = fieldOf(unit, 'scope'), by = fieldOf(unit, 'by'), counts = lines.filter(line => fieldOf(line, 'scope') === scope && fieldOf(line, 'measure') === 'count' && fieldOf(line, 'by') === by && fieldOf(line, 'role') === 'writes');
-        if (counts.length !== 1 || load(input, unit) === undefined)
-            return;
-        const count = counts[0], output = load(fieldOf(count, 'at').replace(/^place:/, ''), count);
-        if (output === undefined)
-            return;
-        const inputBytes = load(input, unit);
-        if (inputBytes.trimStart().startsWith('[')) {
-            let context;
-            try {
-                context = JSON.parse(inputBytes);
-            }
-            catch {
-                return;
-            }
-            if (!Array.isArray(context) || context.length !== 6 || context[0] !== 'reading-context@1')
-                return;
-            const canonicalContext = { instrument: context[1], implementation: context[2], policy: context[3], inputs: context[4], environment: context[5] };
-            try {
-                if (new TextDecoder().decode(readingIdentityBytes(canonicalContext)) !== inputBytes)
-                    return;
-            }
-            catch {
-                return;
-            }
-            if (environment) {
-                const expected = typeof environment === 'function' ? environment(canonicalContext) : environment;
-                if (expected === undefined || JSON.stringify([...expected].sort((a, b) => byBytes(a[0], b[0]))) !== JSON.stringify(context[5]))
-                    return;
-            }
-            const identity = lines.filter(line => fieldOf(line, 'scope') === receiptScope(scope) && fieldOf(line, 'measure') === 'digest' && fieldOf(line, 'by') === by && fieldOf(line, 'role') === 'writes' && fieldOf(line, 'at') === 'place:' + input);
-            const expected = readingReceiptIdentity(input, fieldOf(count, 'at').replace(/^place:/, ''), bytes => digest(new TextDecoder().decode(bytes)));
-            if (identity.length !== 1 || fieldOf(identity[0], 'value') !== expected)
-                return;
-        }
-        else if (requireContext || !inputBytes.endsWith('\n') || inputBytes.split('\n').filter(Boolean).some(line => parse(line).kind !== 'fact'))
-            return;
-        const rows = output.split('\n').filter(Boolean);
-        if (fieldOf(count, 'value') !== `${rows.length}..${rows.length}` || rows.some(line => fieldOf(line, 'by') !== by || fieldOf(line, 'at') !== 'place:' + input))
-            return;
-    }
-    return units.length;
-}
+var q=Object.defineProperty;var R=(o,g)=>q(o,"name",{value:g,configurable:!0});import{actCosts as ee}from"./act-cost.js";import{readFileSync as te,existsSync as re}from"node:fs";import{join as se}from"node:path";import{library14_canonical as u,library14_parse as ie,library14_PROTOCOL as ae,library14_byBytes as Y}from"../vendor/runtime.js";import{landShard as oe,shardLines as ne}from"../land/ledger.js";import{fieldOf as s}from"../fold/claims.js";import{readOnly as le}from"./read-only.js";import{library5_readingIdentityBytes as ce,library5_readingReceiptIdentity as G}from"../vendor/runtime.js";import{readingPreparation as pe,inputLines as de,readingFields as Z}from"./reading-preparation.js";import{inputLines as Fe}from"./reading-preparation.js";const W=R(o=>[o,"identity"].join("/"),"receiptScope");function ue(o,g,f,m,h,b=!0,j=[]){const y=h(f),p=h(m),B=m.split(`
+`).filter(Boolean);return[...b?[u({scope:W(o),role:"writes",form:"alphabet",measure:"digest",value:G(y,p,F=>h(new TextDecoder().decode(F))),by:g,at:"place:"+y})]:[],u({scope:o,role:"writes",form:"alphabet",measure:"observed",value:p,by:g,at:"place:"+p}),u({scope:o,role:"writes",form:"alphabet",measure:"bytes",value:y,by:g,at:"place:"+y,about:f}),u({scope:o,role:"writes",form:"interval",measure:"count",value:`${B.length}..${B.length}`,by:g,at:"place:"+p,about:m}),...j]}R(ue,"portableReadingReceipt");function Re(o){const{root:g,store:f,reader:m,speaker:h,digest:b,capsule:j,region:y,projection:p,files:B}=o,F=o.emit??(()=>{}),{ordered:t,identity:r,by:e,journal:i,prior:I,prepare:d,retained:E,verify:A,ask:z,load:T,saved:U,handed:a,readingPlace:L}=pe(o),_=new Map,C=[];let x=0,D=0,P=0;for(const n of t)ee.measure(()=>{o.assertCurrent?.();const{context:J,closure:K,input:c,scope:O}=d(n,_),V=E({context:J,closure:K,input:c,scope:O});let v,$;if(V)v=V.lines,$=V.payload;else{if(le())throw Error("REFUSE\xB7preview reading closure is unpaid "+n.scope);const w=process.hrtime.bigint(),k=n.needs.flatMap(l=>_.get(l).lines),S=z(c,[{...L?{place:L}:{},protocol:ae,verb:"read",rootScope:n.scope,name:n.scope,region:y,at:n.resolution,reads:["**"],lines:[...de(n.inputs.map(l=>({place:l,text:a.get(l)}))),...k],files:[]}],J)[0];if(S?.kind!=="fact"||!Array.isArray(S.claims))throw Error("REFUSE\xB7reading "+n.scope+" \xB7 "+(S?.why??"no claims"));if(v=S.claims.map(l=>{if(typeof l?.scope!="string"||typeof l?.measure!="string"||typeof l?.role!="string"||!l.bound||!["interval","enumerated"].includes(l.bound.kind))throw Error("REFUSE\xB7reading malformed claim "+n.scope);const N=l.bound,X=u({scope:l.scope,measure:l.measure,role:l.role,form:N.kind==="interval"?"interval":"alphabet",value:N.kind==="interval"?`${N.lo}..${N.hi}`:Array.isArray(N.values)?N.values.join("|"):"",by:e,at:"place:"+c});return Z(X),X}),!v.length&&!o.allowsEmpty)throw Error("REFUSE\xB7reading empty response is not admitted "+n.scope);if(P++,A(),o.assertCurrent?.(),$=U(v.length?[...v].sort(Y).join(`
+`)+`
+`:""),U(K)!==c)throw Error("REFUSE\xB7receipt input closure mismatch");const Q=(Number(process.hrtime.bigint()-w)/1e9).toFixed(6);oe(f,h,i,[u({scope:O,role:"writes",form:"interval",measure:"count",value:`${v.length}..${v.length}`,by:e,at:"place:"+$}),u({scope:O,role:"writes",form:"alphabet",measure:"bytes",value:c,by:e,at:"place:"+c}),u({scope:O,role:"writes",form:"interval",measure:"s",value:Q+".."+Q,by:e,at:"place:"+c})]),n.resolution===1&&D++}const H=J?G(c,$,w=>b(new TextDecoder().decode(w))):$;if(J&&n.resolution!==1&&C.push(u({scope:W(O),role:"writes",form:"alphabet",measure:"digest",value:H,by:e,at:"place:"+c})),_.set(n.scope,{digest:H,lines:v}),C.push(u({scope:n.scope,role:"writes",form:"alphabet",measure:"observed",value:c,by:e,at:"place:"+c}),...n.inputs.map(w=>u({scope:w,role:"writes",form:"alphabet",measure:"observed",value:b(a.get(w)),by:e,at:"witness:"+c})),...v),n.resolution===1){x++;const w=T($);if(w===void 0)throw Error("REFUSE\xB7receipt missing verified carrier "+$);const k=ne(f,h,i).filter(S=>s(S,"scope")===O&&s(S,"measure")==="s"&&s(S,"at")==="place:"+c);C.push(...ue(O,e,K,w,b,!!J,k))}});return A(),F(`RECEIPTS ${x} read \xB7 ${D} opened \xB7 reading closures`),{lines:C,read:x,opened:D,executed:P}}R(Re,"readingClosures");const M=new Set,fe=1024;function Oe(o,g,f,m,h=!1){const b=[],j=new Map,y=new Map,p=R((t,r,e)=>JSON.stringify(e===void 0?[t,r]:[t,r,e]),"key"),B=R((t,r,e)=>{const i=t.get(r);i?i.push(e):t.set(r,[e])},"add");for(const t of g){const r=s(t,"scope");if(!r.startsWith("receipts/readings/")||s(t,"role")!=="writes")continue;const e=s(t,"measure"),i=s(t,"by");e==="bytes"?b.push(t):e==="count"?B(j,p(r,i),t):e==="digest"&&B(y,p(r,i,s(t,"at")),t)}const F=R((t,r)=>{const e=t.split(":")[1];if(!e||!/^[a-f0-9]+$/.test(e))return;const i=Z(r).about;if(i!==void 0)return f(i)===t?i:void 0;const I=se(o,"cas","carried",e);if(!re(I))return;const d=te(I,"utf8");return f(d)===t?d:void 0},"load");for(const t of b){const r=s(t,"value"),e=s(t,"scope"),i=s(t,"by"),I=j.get(p(e,i))??[],d=F(r,t);if(I.length!==1||d===void 0)return;const E=I[0],A=F(s(E,"at").replace(/^place:/,""),E);if(A===void 0)return;const z=y.get(p(W(e),i,"place:"+r))??[],T=m?void 0:f(JSON.stringify([r,s(E,"at"),e,i,s(E,"value"),z,h]));if(T&&M.has(T))continue;if(d.trimStart().startsWith("[")){let a;try{a=JSON.parse(d)}catch{return}if(!Array.isArray(a)||a.length!==6||a[0]!=="reading-context@1")return;const L={instrument:a[1],implementation:a[2],policy:a[3],inputs:a[4],environment:a[5]};try{if(new TextDecoder().decode(ce(L))!==d)return}catch{return}if(m){const x=typeof m=="function"?m(L):m;if(x===void 0||JSON.stringify([...x].sort((D,P)=>Y(D[0],P[0])))!==JSON.stringify(a[5]))return}const _=y.get(p(W(e),i,"place:"+r))??[],C=G(r,s(E,"at").replace(/^place:/,""),x=>f(new TextDecoder().decode(x)));if(_.length!==1||s(_[0],"value")!==C)return}else if(h||!d.endsWith(`
+`)||d.split(`
+`).filter(Boolean).some(a=>ie(a).kind!=="fact"))return;const U=A.split(`
+`).filter(Boolean);if(s(E,"value")!==`${U.length}..${U.length}`||U.some(a=>s(a,"by")!==i||s(a,"at")!=="place:"+r))return;T&&(M.size>=fe&&M.delete(M.values().next().value),M.add(T))}return b.length}R(Oe,"verifiedReadingReceipts");export{Fe as inputLines,ue as portableReadingReceipt,Re as readingClosures,Oe as verifiedReadingReceipts};

package/dist/host/reading-context.js

@@ -1,53 +1 @@
-import { AsyncLocalStorage } from 'node:async_hooks';
-import { createHash } from 'node:crypto';
-import { readFileSync, realpathSync } from 'node:fs';
-import { release } from 'node:os';
-import { readingIdentityBytes } from '@lapxo/topos/contract';
-const active = new AsyncLocalStorage();
-export const readingBoundary = active.getStore.bind(active);
-export function withReadingBoundary(identity, execution, run) {
-    if (execution) {
-        const algorithm = identity.split(':')[0];
-        const hash = (text) => algorithm + ':' + createHash(algorithm).update(text).digest('hex');
-        const expected = readingEnvironment(hash, execution.env, execution.cwd, execution.flags);
-        const named = [...execution.context.environment].sort(([a], [b]) => Buffer.compare(Buffer.from(a), Buffer.from(b)));
-        if (JSON.stringify([...expected].sort(([a], [b]) => Buffer.compare(Buffer.from(a), Buffer.from(b)))) !== JSON.stringify(named))
-            throw Error('REFUSE·reading execution environment differs from its identity');
-    }
-    return active.run({ identity, execution }, run);
-}
-/** References commit the actual inherited boundary. Values are hashed, never
- * carried as environment secrets. No empty map is substituted for unknown input. */
-// The running runtime is resolved once for this act; mutable input bytes are not
-// stored in this slot. Later processes establish their own runtime reference.
-const runtimes = new Map();
-const runtimeOf = (algorithm) => { const held = runtimes.get(algorithm); if (held)
-    return held; const digest = algorithm + ':' + createHash(algorithm).update(readFileSync(process.execPath)).digest('hex'); runtimes.set(algorithm, digest); return digest; };
-export function readingEnvironment(hash, env = process.env, cwd = process.cwd(), flags = process.execArgv) {
-    const inherited = Object.entries(env).filter((entry) => entry[1] !== undefined);
-    return [
-        ['variables', hash(JSON.stringify(inherited.sort(([a], [b]) => Buffer.compare(Buffer.from(a), Buffer.from(b)))))],
-        ['cwd', hash(realpathSync(cwd))], ['flags', hash(JSON.stringify(flags))],
-        ['runtime', runtimeOf(hash('').split(':')[0])],
-        ['platform', hash(JSON.stringify([process.platform, process.arch, process.versions, release()]))],
-    ];
-}
-export function readingProfile(lines, field) {
-    const values = (scope) => lines.filter(line => field(line, 'scope') === scope && field(line, 'role') === 'writes' && field(line, 'value') !== 'withdraw');
-    const contexts = values('wire/reading-context'), receipts = values('wire/reading-receipt');
-    if (!contexts.length && !receipts.length)
-        return false;
-    if (contexts.length !== 1 || receipts.length !== 1 || field(contexts[0], 'value') !== 'reading-context@1' || field(receipts[0], 'value') !== 'reading-receipt@1')
-        throw Error('REFUSE·reading identity ambiguous or incomplete profiles');
-    return true;
-}
-/** The caller supplies verified implementation and transitive references. This
- * constructor adds the process boundary that the host will actually hand over. */
-export function readingExecution(input, hash, boundary = { env: process.env, cwd: process.cwd(), flags: process.execArgv }) {
-    const env = Object.fromEntries(Object.entries(boundary.env).filter((entry) => entry[1] !== undefined));
-    const cwd = boundary.cwd, flags = Object.freeze([...boundary.flags]);
-    Object.freeze(env);
-    const context = { ...input, environment: readingEnvironment(hash, env, cwd, flags) };
-    readingIdentityBytes(context);
-    return { context, env, cwd, flags };
-}
+var N=Object.defineProperty;var f=(e,t)=>N(e,"name",{value:t,configurable:!0});import{BoundRefusal as a}from"./refusals.js";import{sha256 as R}from"./hash.js";import{AsyncLocalStorage as y}from"node:async_hooks";import{createHash as v}from"node:crypto";import{readFileSync as J,realpathSync as j}from"node:fs";import{release as F}from"node:os";import{library5_readingIdentityBytes as A}from"../vendor/runtime.js";const w=new y,H=w.getStore.bind(w);function K(e,t,n){if(t){const r=e.split(":")[0],i=b(f(c=>r+":"+v(r).update(c).digest("hex"),"hash"),t.env,t.cwd,t.flags),s=[...t.context.environment].sort(([c],[u])=>Buffer.compare(Buffer.from(c),Buffer.from(u)));if(JSON.stringify([...i].sort(([c],[u])=>Buffer.compare(Buffer.from(c),Buffer.from(u))))!==JSON.stringify(s))throw Error("REFUSE\xB7reading execution environment differs from its identity")}return w.run({identity:e,execution:t},n)}f(K,"withReadingBoundary");const x=new Map,z=f(e=>{const t=x.get(e);if(t)return t;const n=e+":"+v(e).update(J(process.execPath)).digest("hex");return x.set(e,n),n},"runtimeOf");function b(e,t=process.env,n=process.cwd(),r=process.execArgv){const o=Object.entries(t).filter(i=>i[1]!==void 0);return[["variables",e(JSON.stringify(o.sort(([i],[s])=>Buffer.compare(Buffer.from(i),Buffer.from(s)))))],["cwd",e(j(n))],["flags",e(JSON.stringify(r))],["runtime",z(e("").split(":")[0])],["platform",e(JSON.stringify([process.platform,process.arch,process.versions,F()]))]]}f(b,"readingEnvironment");function W(e,t){const n=f(i=>e.filter(s=>t(s,"scope")===i&&t(s,"role")==="writes"&&t(s,"value")!=="withdraw"),"values"),r=n("wire/reading-context"),o=n("wire/reading-receipt");if(!r.length&&!o.length)return!1;if(r.length!==1||o.length!==1||t(r[0],"value")!=="reading-context@1"||t(o[0],"value")!=="reading-receipt@1")throw Error("REFUSE\xB7reading identity ambiguous or incomplete profiles");return!0}f(W,"readingProfile");function q(e,t,n={env:process.env,cwd:process.cwd(),flags:process.execArgv}){const r=Object.fromEntries(Object.entries(n.env).filter(c=>c[1]!==void 0)),o=n.cwd,i=Object.freeze([...n.flags]);Object.freeze(r);const s={...e,environment:b(t,r,o,i)};return A(s),{context:s,env:r,cwd:o,flags:i}}f(q,"readingExecution");const g=new y,p=new y,l=new y,E=new WeakMap,d=new Map;let m=0;const O=16*1024*1024,L=512;function h(e){return{encoded:e,digest:R(e),cost:Buffer.byteLength(e)}}f(h,"encoding");function B(e){if(typeof e=="string"){const t=d.get(e);if(t)return t;const n=h(JSON.stringify(e)),r=Buffer.byteLength(e)+n.cost;if(r<=O){for(;d.size>=L||m+r>O;){const o=d.keys().next().value;m-=Buffer.byteLength(o)+d.get(o).cost,d.delete(o)}d.set(e,n),m+=r}return n}if(Array.isArray(e)&&Object.isFrozen(e)&&Object.getPrototypeOf(e)===Array.prototype&&e.toJSON===void 0){const t=E.get(e);if(t)return t;if(Reflect.ownKeys(e).length===e.length+1&&Array.from({length:e.length},(n,r)=>Object.getOwnPropertyDescriptor(e,String(r))).every(n=>n&&"value"in n&&typeof n.value=="string")){const n=h(JSON.stringify(e));return E.set(e,n),n}}return h(JSON.stringify(e)??"null")}f(B,"encodeObserved");const M=f(e=>B(e()).encoded,"encodedInput"),I=f(e=>{if(g.exit(()=>p.exit(()=>M(e.read)))!==e.encoded)throw new a("reading-identity/context","REFUSE\xB7reading-identity/context view inputs changed during preparation")},"verifyInput");function Q(e){if(p.getStore())return e();const t=new Map;return p.run(t,()=>{const n=e();if(n&&typeof n.then=="function")throw new a("reading-identity/context","REFUSE\xB7reading-identity/context input observation must be synchronous");for(const r of t.values())I(r);return n})}f(Q,"withViewInputObservation");const X=f(()=>g.getStore()!==void 0,"preparingView");function U(e,t,n=!0){const r=g.getStore();if(!r)return t();l.getStore()?.add(e);const o=r.inputs.get(e);if(o)return o.value;const i=p.getStore(),s=i?.get(e),c=s?s.value:t(),u=s??B(c);if(r.inputs.size>=r.files||(r.used+=Buffer.byteLength(e)+u.cost)>r.bytes)throw new a("reading-identity/budget","REFUSE\xB7reading-identity/budget view inputs");const S={value:c,encoded:u.encoded,digest:u.digest,cost:u.cost,read:t,identity:n};return r.inputs.set(e,S),i&&!s&&i.set(e,S),c}f(U,"viewInput");function Y(e,t){const n={inputs:new Map,...e,used:0};return g.run(n,()=>{const r=t();if(!p.getStore())for(const o of n.inputs.values())I(o);return{value:r,inputs:[...n.inputs].filter(([,o])=>o.identity).map(([o,i])=>[o,i.digest]).sort(([o],[i])=>o<i?-1:o>i?1:0)}})}f(Y,"captureViewInputs");function Z(e){let t;return()=>{const n=g.getStore(),r=p.getStore();if(!n||!r)return e();if(t?.observation===r){for(const[c,u]of t.inputs)U(c,u.read,u.identity);return t.value}const o=new Set,i=l.getStore(),s=l.run(o,e);if(s&&typeof s.then=="function")throw new a("reading-identity/context","REFUSE\xB7reading-identity/context shared preparation must be synchronous");for(const c of o)i?.add(c);return t={value:s,inputs:[...o].map(c=>[c,n.inputs.get(c)]),observation:r},s}}f(Z,"sharedViewInputs");export{Y as captureViewInputs,X as preparingView,H as readingBoundary,b as readingEnvironment,q as readingExecution,W as readingProfile,Z as sharedViewInputs,U as viewInput,K as withReadingBoundary,Q as withViewInputObservation};

package/dist/host/reading-identity.js

@@ -0,0 +1,3 @@
+var V=Object.defineProperty;var c=(e,t)=>V(e,"name",{value:t,configurable:!0});import{readFileSync as j}from"node:fs";import{sha256 as w}from"./hash.js";import{captureViewInputs as q,viewInput as E,readingEnvironment as F,withViewInputObservation as B,sharedViewInputs as D}from"./reading-context.js";import{withoutEffects as K}from"./read-only.js";import{committedInventoryFingerprint as I,committedLocalActs as O,withCommittedLocalActObservation as z}from"./ports/local-act.js";import{ingressBundles as H}from"./ports/ingress.js";import{instrumentCoordinates as M}from"../fold/digests.js";import{viewsOf as W}from"../fold/views.js";import{standingOf as _}from"../cli/place.js";import{evidenceLines as $}from"../render/view.js";import{resolve as U,join as x}from"node:path";import{library14_LOCK as G}from"../vendor/runtime.js";import{fieldOf as y,isWire as P}from"../fold/claims.js";import{storeOf as N}from"../land/ledger.js";import{underRootAuthority as Q}from"../land/act.js";import{prepareObservedReadings as T}from"../fold/observed.js";import{authenticatedStanding as h}from"./admitted-place.js";import{withHostCall as k}from"./call-context.js";import{withContentStore as X}from"./content-store.js";import{BoundRefusal as i}from"./refusals.js";async function Se(e){try{if(!e||typeof e.place!="string"||!e.place||!e.instrument?.runtime)throw new i("host/context","REFUSE\xB7host/context");const t={...e.limits};for(const n of[t.bytes,t.files,t.readings,t.probes])if(!Number.isSafeInteger(n)||n<1)throw new i("host/budget","REFUSE\xB7host/budget");if(t.signal?.aborted)throw new i("host/cancelled","REFUSE\xB7host/cancelled");const d=U(e.place),r=N(d),s=structuredClone(e.instrument),a=e.reader;return await k({instrumentName:s.name,runtime:s.runtime,output:c(()=>{},"output")},()=>X(r,()=>Q(r,"prepare reading identity",()=>{const n=S(h(d));for(const u of["bytes","files","readings","probes"])t[u]=Math.min(t[u],n[u]);return{kind:"fact",preparations:T(d,r,t,a)}}),()=>h(d)))}catch(t){return{kind:"refuse",code:t instanceof i?t.code:"reading-identity/failed",diagnostic:t instanceof Error?t.message:"REFUSE\xB7reading identity failed"}}}c(Se,"prepareNativeReadingIdentity");function S(e){const t=c(d=>{const r=e.filter(n=>y(n,"scope")==="reading-identity/"+d&&y(n,"role")==="writes"&&y(n,"value")!=="withdraw");if(r.length!==1)throw new i("reading-identity/budget","REFUSE\xB7reading identity requires one declared "+d+" limit");const s=/^0\.\.([1-9][0-9]*)$/.exec(y(r[0],"value")),a=Number(s?.[1]);if(!s||!Number.isSafeInteger(a))throw new i("reading-identity/budget","REFUSE\xB7invalid reading identity "+d+" limit");return a},"limit");return{bytes:t("bytes"),files:t("files"),readings:t("readings"),probes:t("probes")}}c(S,"declaredReadingIdentityLimits");function be(e){const t=Y(e&&{place:e.place,instrument:e.instrument,views:[e.view],...e.expectedIdentity===void 0?{}:{expectedIdentities:{[e.view]:e.expectedIdentity}}});return t.kind==="refuse"?t:t.views[0]}c(be,"prepareNativeViewIdentity");function Y(e){try{if(!e||!e.instrument?.runtime||typeof e.place!="string"||!e.place)throw new i("host/context","REFUSE\xB7host/context");if(!Array.isArray(e.views)||!e.views.length||new Set(e.views).size!==e.views.length||e.views.some(n=>n!=="lines"&&n!=="evidence"))throw new i("reading-identity/selection","REFUSE\xB7reading-identity/selection requires distinct supported native views");if(e.expectedIdentities&&Object.keys(e.expectedIdentities).some(n=>!e.views.includes(n)))throw new i("reading-identity/selection","REFUSE\xB7reading-identity/selection expected identity names an unselected view");const t=[...e.views],d={...e.expectedIdentities},r=U(e.place),s=N(r),a=structuredClone(e.instrument);return k({instrumentName:a.name,runtime:a.runtime,output:c(()=>{},"output")},()=>K(()=>{const n=I(O(s)),p=S(h(r)),u=new Date().toISOString().slice(0,10),b=F(w);if(t.length>p.readings)throw new i("reading-identity/budget","REFUSE\xB7reading-identity/budget selected views exceed admitted readings");const L=D(()=>{const o=_(r).standing,m=[...M(s,a.runtime.entry,[],a.runtime.root,[],!0)].map(([g,v])=>[g,v]);if(!m.length)throw new i("reading-identity/failed","REFUSE\xB7reading-identity/failed is unavailable");const f=w(E("instrument-lock:"+a.runtime.root,()=>j(x(a.runtime.root,G),"utf8")));return{standing:o,implementation:m,instrumentLock:f}}),C=B(()=>z(s,()=>t.map(o=>{const m=q(p,()=>{const f=S(E("authenticated-configuration:"+r,()=>h(r)));if(JSON.stringify(f)!==JSON.stringify(p))throw new i("reading-identity/context","REFUSE\xB7reading-identity/context identity budget changed");if(o==="evidence"&&E("foreign-ingress:"+s,()=>H(s)).length)throw new i("reading-identity/selection","REFUSE\xB7reading-identity/selection foreign view identity requires a transport snapshot");const{standing:g,implementation:v,instrumentLock:J}=L();if(o==="evidence"){const l=W(g).get(o);if(!l||l.shape||l.regions.length!==1||l.regions[0]?.name!=="evidence")throw new i("reading-identity/selection","REFUSE\xB7reading-identity/selection requires the native evidence projection")}const R=o==="lines"?g.filter(P):$(r,s);return{text:R.length?R.join(`
+`)+`
+`:"",implementation:v,instrumentLock:J}});return{view:o,captured:m}}))),A=I(O(s));if(n!==A||u!==new Date().toISOString().slice(0,10)||JSON.stringify(b)!==JSON.stringify(F(w)))throw new i("reading-identity/context","REFUSE\xB7reading-identity/context committed inputs changed during preparation");return{kind:"fact",views:C.map(({view:o,captured:m})=>{const f=w(JSON.stringify(["native-view-inputs@1",r,o,n,m.inputs,m.value.implementation,m.value.instrumentLock,b,u]));if(d[o]!==void 0&&d[o]!==f)throw new i("reading-identity/context","REFUSE\xB7reading-identity/context view identity differs from the expected snapshot");return{kind:"fact",view:o,identity:f,text:m.value.text}})}}))}catch(t){return{kind:"refuse",code:t instanceof i?t.code:"reading-identity/failed",diagnostic:t instanceof Error?t.message:"REFUSE\xB7view identity failed"}}}c(Y,"prepareNativeViewIdentities");export{S as declaredReadingIdentityLimits,Se as prepareNativeReadingIdentity,Y as prepareNativeViewIdentities,be as prepareNativeViewIdentity};

package/dist/host/reading-preparation.js

@@ -0,0 +1,6 @@
+var ae=Object.defineProperty;var d=(t,r)=>ae(t,"name",{value:r,configurable:!0});import{mkdirSync as ce,readFileSync as T,existsSync as $}from"node:fs";import{join as W,dirname as de}from"node:path";import{library14_canonical as j,library14_parse as le,library14_PROTOCOL as ue,library14_byBytes as fe}from"../vendor/runtime.js";import{replaceWhole as pe,shardLines as he}from"../land/ledger.js";import{fieldOf as g}from"../fold/claims.js";import{library5_readingIdentityBytes as O,library5_readingReceiptIdentity as ge,library5_responseIdentity as ye,library5_snapshotAccess as me,library5_placeInputs as Ee,library5_withPlaceInputs as we}from"../vendor/runtime.js";import{withReadingBoundary as be}from"./reading-context.js";import{BoundRefusal as y}from"./refusals.js";class ee extends Error{static{d(this,"ReadingNeeds")}constructor(r){super("Reading inputs missing"),this.coordinates=r}}const te=d(t=>t.reduce((r,m)=>r+Buffer.byteLength(m.text,"utf8"),0),"filesBytes"),q=d(t=>{const r=le(t);if(r.kind!=="fact")throw Error("REFUSE\xB7input projection contains a non-wire line");return r.value.fields},"readingFields"),xe=d(t=>t.map(r=>j({scope:r.place,form:"alphabet",measure:"text",role:"writes",value:"lock",shape:r.place,about:r.text,by:"host",at:"policy:handed-input"})),"inputLines");function Se(t){const r=t.preparationLimits;if(r){for(const e of[r.bytes,r.files,r.readings,r.probes])if(!Number.isSafeInteger(e)||e<1)throw new y("host/budget","REFUSE\xB7host/budget");if(te(t.files)>r.bytes||t.files.length>r.files||r.probes<1)throw new y("host/budget","REFUSE\xB7host/budget")}const{root:m,store:b,speaker:S,digest:s,capsule:f,region:E,projection:h,files:w}=t;t.assertCurrent?.(),t.context&&O(t.context);let z=[];if(t.current){if(!t.context)throw Error("REFUSE\xB7current reading requires a declared identity");const{snapshot:e,kept:n,current:i,permission:o}=t.current;if(i.implementation!==t.context.implementation)throw Error("REFUSE\xB7current reading implementation differs from its verified context");const a=ye(e,i,s),u=me(e,n,i,o,s);if(!u.inspect||!u.reuse)throw Error("REFUSE\xB7current reading is not admitted for reuse");z=[["response",a],["permission",s(JSON.stringify([o.inspect,o.reuse,o.freshness]))]]}if(t.execution&&(!t.context||JSON.stringify(O(t.execution.context))!==JSON.stringify(O(t.context))))throw Error("REFUSE\xB7reading execution differs from declared context");const A=d(e=>{if(!f.selectedWorld)return;const{standing:n,offer:i}=f.selectedWorld;if(n.parts.some(a=>a.scope===`${i}/place-inputs/${e}`&&a.measure==="reads")){if(!t.context||!t.execution||!t.livePlace)throw Error("REFUSE\xB7place inputs require authenticated shadow and reading context "+e);return Ee(n,i,e,t.livePlace(),a=>s(new TextDecoder().decode(a)))}},"projectionFor"),k=A(h),D=A(E),M=d((e,n,i)=>i&&e?we(e,JSON.stringify(["place-inputs",f.selectedWorld.offer,n]),i):e,"commit"),G=d((e,n,i=t.context)=>be(e,t.execution&&i?{...t.execution,context:i}:t.execution,()=>f.ask(n,t.readerReference)),"ask"),N=M(t.context,h,k),re=N?s(new TextDecoder().decode(O(N))):"",ne=s("").split(":")[0],R=new Map(w.map(e=>[e.place,e.text]));if(R.size!==w.length)throw Error("REFUSE\xB7input projection has duplicate handed coordinates");const I=d(()=>{if(r?.signal?.aborted)throw new y("host/cancelled","REFUSE\xB7host/cancelled");for(const e of w){if(!$(W(m,e.place)))throw new ee([e.place]);if(!T(W(m,e.place)).equals(Buffer.from(e.text)))throw new y("reading-identity/integrity","REFUSE\xB7input changed "+e.place)}},"verify");if(I(),r?.signal?.aborted)throw new y("host/cancelled","REFUSE\xB7host/cancelled");const F=G(re,[{...k?{place:k}:{},protocol:ue,verb:"render",rootScope:"",region:h,at:1,reads:["**"],lines:xe(w),files:[]}],N)[0];if(F?.kind!=="fact"||!Array.isArray(F.lines))throw Error("REFUSE\xB7input projection "+(F?.why??"no lines"));if(r&&F.lines.length>r.readings)throw new y("host/budget","REFUSE\xB7host/budget");const v=new Map;for(const e of F.lines){const n=q(e),i=n.scope??"",o=/^receipt:(\d+)$/.exec(n.at??"");if(!i||v.has(i)||n.form!=="alphabet"||n.measure!=="reads"||n.role!=="reads"||!o)throw Error("REFUSE\xB7input projection ambiguous reading "+i);const a=(n.value??"").split("|").filter(Boolean),u=(n.needs??"").split("|").filter(Boolean);if(!a.length&&!u.length||new Set(a).size!==a.length||a.some(x=>!R.has(x))||new Set(u).size!==u.length)throw Error("REFUSE\xB7input projection has unhanded or duplicate dependencies "+i);const p=Number(o[1]);if(!Number.isSafeInteger(p))throw Error("REFUSE\xB7input projection invalid resolution "+i);v.set(i,{scope:i,inputs:a,needs:u,resolution:p,line:j({scope:i,form:n.form,measure:n.measure,role:n.role,value:a.join("|"),needs:u.join("|"),at:n.at})})}if(!v.size)throw Error("REFUSE\xB7input projection returned no readings");const H=[],J=new Set,K=new Set,Q=d(e=>{if(K.has(e))return;if(J.has(e))throw Error("REFUSE\xB7input projection dependency cycle "+e);const n=v.get(e);if(!n)throw Error("REFUSE\xB7input projection missing reading "+e);J.add(e);for(const i of n.needs)Q(i);J.delete(e),K.add(e),H.push(n)},"visit");for(const e of v.keys())Q(e);const B=s([f.selection??"",f.digest,E,h,...t.lifetime===void 0?[]:[JSON.stringify(t.lifetime)]].join(`
+`)),_=S+":"+B.split(":")[1].slice(0,12),V="reading-closures/"+B.split(":")[1],P=he(b,S,V),X=d(e=>W(b,"cas","carried",e.split(":")[1]??""),"carried"),ie=d(e=>{const n=s(e),i=X(n);return ce(de(i),{recursive:!0}),(!$(i)||s(T(i,"utf8"))!==n)&&pe(i,e),n},"saved"),C=d((e,n=!1)=>{if(!e.startsWith(ne+":")||!/^[a-f0-9]+$/.test(e.split(":")[1]??""))return;const i=X(e);if(!$(i))return;const o=T(i,"utf8");if(s(o)!==e){if(n)throw new y("reading-identity/integrity","REFUSE\xB7reading carrier bytes differ");return}return o},"load"),se=d((e,n)=>{const i=[e.line,j({scope:"implementation",role:"writes",form:"alphabet",measure:"digest",value:B,by:"host",at:"policy:input-identity"}),...e.inputs.map(c=>j({scope:c,role:"writes",form:"alphabet",measure:"digest",value:s(R.get(c)),by:"host",at:"policy:input-identity"})),...e.needs.map(c=>j({scope:c,role:"writes",form:"alphabet",measure:"digest",value:n.get(c).digest,by:"host",at:"policy:input-identity"}))].sort(fe).join(`
+`)+`
+`,o=M(t.context,E,D),a=o&&{...o,policy:s(JSON.stringify([o.policy,t.allowsEmpty===!0,t.lifetime??null,t.readerReference??null,f.selection??null,f.lines])),inputs:[...[...o.inputs,...z].map(([c,U])=>[JSON.stringify(["context",c]),U]),[JSON.stringify(["plan"]),s(e.line)],...e.inputs.map(c=>[JSON.stringify(["file",c]),s(R.get(c))]),...e.needs.map(c=>[JSON.stringify(["receipt",c]),n.get(c).digest])]},u=a?new TextDecoder().decode(O(a)):i,p=s(u),x="receipts/readings/"+s(e.scope).split(":")[1]+"/"+p.split(":")[1];return{context:a,closure:u,input:p,scope:x}},"prepare"),oe=d((e,n=!1)=>{const{scope:i,input:o,closure:a}=e,p=P.filter(l=>g(l,"scope")===i&&g(l,"measure")==="bytes"&&g(l,"value")===o).at(-1)&&P.filter(l=>g(l,"scope")===i&&g(l,"measure")==="count"&&g(l,"by")===_).at(-1),x=p&&C(g(p,"at").replace(/^place:/,""),n),c=x?.split(`
+`).filter(Boolean),U=c!==void 0&&g(p,"value")===`${c.length}..${c.length}`&&c.every(l=>{const Z=q(l);return Z.by===_&&Z.at==="place:"+o})?x:void 0;if(U===void 0||C(o,n)!==a)return;if(U===""&&!t.allowsEmpty)throw Error("REFUSE\xB7reading empty response is not admitted");const Y=U.split(`
+`).filter(Boolean);for(const l of Y)q(l);const L=g(p,"at").replace(/^place:/,"");return{lines:Y,payload:L,digest:e.context?ge(o,L,l=>s(new TextDecoder().decode(l))):L}},"retained");return I(),{ordered:H,identity:B,by:_,journal:V,prior:P,prepare:se,retained:oe,verify:I,ask:G,load:C,saved:ie,handed:R,readingPlace:D,verifiedBytes:te(w)}}d(Se,"readingPreparation");function Ie(t){try{if(!t.context||!t.execution)throw new y("reading-identity/context","REFUSE\xB7reading preparation requires its actual execution context");const r=Se(t),m=new Map,b=[];let S=0;for(const s of r.ordered){t.assertCurrent?.(),r.verify();const f=s.needs.filter(w=>!m.has(w));if(f.length){b.push({scope:s.scope,kind:"needs",needs:f});continue}const E=r.prepare(s,m),h=r.retained(E,!0);h&&(m.set(s.scope,h),S++),b.push({scope:s.scope,kind:"ready",identity:E.input,context:E.context,...h?{receipt:h.digest}:{}})}return r.verify(),t.assertCurrent?.(),{kind:"fact",readings:b,probes:1,verifiedBytes:r.verifiedBytes,retained:S}}catch(r){return r instanceof ee?{kind:"needs",needs:r.coordinates}:{kind:"refuse",code:r instanceof y?r.code:"reading-identity/failed",diagnostic:r instanceof Error?r.message:"REFUSE\xB7reading preparation failed"}}}d(Ie,"prepareReadingIdentities");export{xe as inputLines,Ie as prepareReadingIdentities,q as readingFields,Se as readingPreparation};

package/dist/host/reference-authenticated.d.ts

@@ -1,40 +1 @@
-import { authorityOf, validateObjectContext } from '@lapxo/topos/wire';
-type ObjectContext = Parameters<typeof validateObjectContext>[1];
-type Signer = Parameters<typeof authorityOf>[1][number];
-export interface ReferenceTrust {
-    readonly snapshot: string;
-    readonly epoch: number;
-    readonly proofScope: string;
-    readonly policy: string;
-    readonly formImplementation: string;
-    readonly signers: readonly Signer[];
-    readonly algorithms: readonly string[];
-    readonly contracts?: {
-        readonly refusals: string;
-        readonly standing: string;
-    };
-    readonly objects: ObjectContext;
-    readonly maxBytes: number;
-    readonly maxRecords: number;
-    readonly digestBytes: (bytes: Uint8Array) => string | Promise<string>;
-    readonly verifyBytes: (bytes: string, key: string, signature: string, algorithms: readonly string[]) => boolean | Promise<boolean>;
-    readonly fetchBytes: (source: string, blob: string) => Promise<Uint8Array>;
-}
-/** Prospective authenticated-standing@1 host composition; no effects and no authority from transport. */
-export declare function inspectAuthenticatedReference(fragment: string, trust: ReferenceTrust): Promise<{
-    contracts?: {
-        refusals: string;
-        standing: string;
-    } | undefined;
-    reference: import("./reference-profile.ts").StandingReference;
-    records: readonly import("@lapxo/topos/wire").ObjectRecord[];
-    semanticIdentity: string;
-    authorityContextIdentity: string;
-    semanticStanding: string;
-    originalRecords: readonly string[];
-}>;
-export { encodeReference, decodeReference } from './reference-profile.ts';
-export { BoundRefusal, readRefusalCatalog, describeRefusal } from './refusals.ts';
-export type { RefusalEntry } from './refusals.ts';
-export { readContent, retainContent, invokeSigningPort } from '../engine/ports.ts';
-export type { PortLimits, ContentReadPort, PersistencePort, DigestPort, SigningPort, SigningLot, SignatureRecord } from '../engine/ports.ts';
+export {public7_BoundRefusal as BoundRefusal,public7_ContentReadPort as ContentReadPort,public7_DigestPort as DigestPort,public7_PersistencePort as PersistencePort,public7_PortLimits as PortLimits,public7_ReferenceTrust as ReferenceTrust,public7_RefusalEntry as RefusalEntry,public7_SignatureRecord as SignatureRecord,public7_SigningLot as SigningLot,public7_SigningPort as SigningPort,public7_decodeReference as decodeReference,public7_describeRefusal as describeRefusal,public7_encodeReference as encodeReference,public7_inspectAuthenticatedReference as inspectAuthenticatedReference,public7_invokeSigningPort as invokeSigningPort,public7_readContent as readContent,public7_readRefusalCatalog as readRefusalCatalog,public7_retainContent as retainContent} from "../public-types.js";

package/dist/host/reference-authenticated.js

@@ -1,100 +1,3 @@
-import { BoundRefusal } from "./refusals.js";
-import { parse, canonical, authorityOf, authorityAtEpoch, signedBytes, objectHistory, validateObjectContext } from '@lapxo/topos/wire';
-import { decodeReference } from "./reference-profile.js";
-import { referenceStanding, referenceContracts, referenceContextBytes } from "./reference-standing.js";
-function fail(code, why) { throw new BoundRefusal('authenticated-reference/' + code, 'REFUSE·authenticated-reference ' + why); }
-const utf8 = (s) => new TextEncoder().encode(s);
-/** Prospective authenticated-standing@1 host composition; no effects and no authority from transport. */
-export async function inspectAuthenticatedReference(fragment, trust) {
-    if (new Set(trust.signers.map(s => s.id)).size !== trust.signers.length)
-        fail('context', 'duplicate host signer');
-    const reference = decodeReference(fragment);
-    if (!Number.isSafeInteger(trust.maxBytes) || trust.maxBytes < 1 || !Number.isSafeInteger(trust.maxRecords) || trust.maxRecords < 1)
-        fail('budget', 'resource budget');
-    if (trust.contracts !== undefined) {
-        if (!referenceContracts(trust.contracts))
-            fail('context', 'contract identities');
-        const snapshot = await trust.digestBytes(referenceContextBytes({ ...trust, semanticIdentity: 'sha256:' + reference.digest, contracts: trust.contracts }));
-        if (snapshot !== trust.snapshot)
-            fail('context', 'context snapshot');
-    }
-    let received;
-    try {
-        received = await trust.fetchBytes(reference.source, reference.blob);
-    }
-    catch {
-        return fail('transport', 'content port failed');
-    }
-    if (received.byteLength > trust.maxBytes)
-        fail('budget', 'bytes budget');
-    if (typeof SharedArrayBuffer !== 'undefined' && received.buffer instanceof SharedArrayBuffer)
-        fail('transport', 'shared transport bytes');
-    const bytes = new Uint8Array(received);
-    if (await trust.digestBytes(bytes) !== reference.blob)
-        fail('integrity', 'blob integrity');
-    let text;
-    try {
-        text = new TextDecoder('utf-8', { fatal: true }).decode(bytes);
-    }
-    catch {
-        return fail('framing', 'carrier UTF-8');
-    }
-    let packet;
-    try {
-        packet = JSON.parse(text);
-    }
-    catch {
-        fail('framing', 'carrier framing');
-    }
-    if (!Array.isArray(packet) || packet.length !== 3 || packet[0] !== 'authenticated-standing@1' || !Array.isArray(packet[1]) || packet[1].length < 1 || packet[1].length > trust.maxRecords || packet[1].some((x) => typeof x !== 'string') || typeof packet[2] !== 'string' || JSON.stringify(packet) + '\n' !== text)
-        fail('framing', 'carrier framing');
-    const originals = packet[1], proofLine = packet[2];
-    const parsed = [...originals, proofLine].map(line => { const p = parse(line); if (p.kind !== 'fact' || canonical(p.value.fields) !== line)
-        fail('wire', 'original canonical'); return p.value.fields; });
-    const proof = parsed[parsed.length - 1];
-    if (proof.scope !== trust.proofScope || proof.at !== 'witness:' + trust.snapshot || proof.role !== 'writes' || proof.form !== 'alphabet' || proof.measure !== 'digest' || proof.epoch !== String(trust.epoch))
-        fail('context', 'untrusted snapshot binding');
-    if (proof.value !== await trust.digestBytes(utf8(JSON.stringify(['authenticated-standing@1', originals]) + '\n')))
-        fail('integrity', 'snapshot commitment');
-    // Async crypto port is called on exact native signed bytes; authorityOf consumes only those results.
-    const verifiedCrypto = new Set();
-    const key = (f, pub) => JSON.stringify([signedBytes(f), pub, f.sig, trust.algorithms]);
-    for (const f of parsed)
-        for (const s of trust.signers)
-            if (s.id === f.by && await trust.verifyBytes(signedBytes(f), s.publicKey, f.sig, trust.algorithms))
-                verifiedCrypto.add(key(f, s.publicKey));
-    const verifies = (f, pub) => verifiedCrypto.has(key(f, pub));
-    const authentic = authorityOf(proof, trust.signers, verifies);
-    if (authentic.kind !== 'admitted')
-        fail('authority', 'proof ' + authentic.kind + ' ' + authentic.why);
-    const signer = trust.signers.find(s => s.id === proof.by);
-    if (!signer)
-        fail('authority', 'proof signer');
-    const current = authorityAtEpoch(proof, signer, trust.epoch, trust.proofScope, 'authority');
-    if (current.kind !== 'admitted')
-        fail('authority', 'current proof ' + current.kind + ' ' + current.why);
-    const verified = new Set();
-    for (let i = 0; i < originals.length; i++) {
-        const admitted = authorityOf(parsed[i], trust.signers, verifies);
-        if (admitted.kind !== 'admitted')
-            fail('authority', 'original ' + admitted.kind + ' ' + admitted.why);
-        verified.add(originals[i]);
-    }
-    const history = objectHistory(originals);
-    if (history.kind !== 'fact')
-        fail('wire', 'wire ' + history.why);
-    if (history.value.configuration.some(f => f.value === 'withdraw'))
-        fail('history', 'configuration history requires admitted standing fold');
-    const context = { ...trust.objects, admit: (r) => verified.has(canonical(r.fields)) && trust.objects.admit(r) };
-    const checked = validateObjectContext(history.value.objects, context);
-    if (checked.kind !== 'fact')
-        throw new BoundRefusal('authenticated-reference/object-context', 'REFUSE·' + checked.why);
-    const semantic = referenceStanding(originals, checked.value), semanticIdentity = await trust.digestBytes(utf8(semantic));
-    if (semanticIdentity !== 'sha256:' + reference.digest)
-        fail('identity', 'standing identity');
-    const authorityContextIdentity = await trust.digestBytes(utf8(JSON.stringify(trust.contracts ? ['reference-inspection-trust@2', trust.snapshot, trust.epoch, trust.proofScope, trust.policy, trust.formImplementation, trust.signers, trust.algorithms, trust.contracts] : ['reference-inspection-trust@1', trust.snapshot, trust.epoch, trust.proofScope, trust.policy, trust.formImplementation, trust.signers, trust.algorithms])));
-    return { reference, records: checked.value, semanticIdentity, authorityContextIdentity, semanticStanding: semantic, originalRecords: originals, ...(trust.contracts ? { contracts: { ...trust.contracts } } : {}) };
-}
-export { encodeReference, decodeReference } from "./reference-profile.js";
-export { BoundRefusal, readRefusalCatalog, describeRefusal } from "./refusals.js";
-export { readContent, retainContent, invokeSigningPort } from "../engine/ports.js";
+var _=Object.defineProperty;var s=(r,e)=>_(r,"name",{value:e,configurable:!0});import{BoundRefusal as A}from"./refusals.js";import{library14_parse as J,library14_canonical as C,library14_authorityOf as O,library14_authorityAtEpoch as U,library14_signedBytes as j,library14_objectHistory as F,library14_validateObjectContext as T}from"../vendor/runtime.js";import{decodeReference as H}from"./reference-profile.js";import{referenceStanding as K,referenceContracts as L,referenceContextBytes as q}from"./reference-standing.js";function t(r,e){throw new A("authenticated-reference/"+r,"REFUSE\xB7authenticated-reference "+e)}s(t,"fail");const b=s(r=>new TextEncoder().encode(r),"utf8");async function Q(r,e){new Set(e.signers.map(i=>i.id)).size!==e.signers.length&&t("context","duplicate host signer");const f=H(r);(!Number.isSafeInteger(e.maxBytes)||e.maxBytes<1||!Number.isSafeInteger(e.maxRecords)||e.maxRecords<1)&&t("budget","resource budget"),e.contracts!==void 0&&(L(e.contracts)||t("context","contract identities"),await e.digestBytes(q({...e,semanticIdentity:"sha256:"+f.digest,contracts:e.contracts}))!==e.snapshot&&t("context","context snapshot"));let d;try{d=await e.fetchBytes(f.source,f.blob)}catch{return t("transport","content port failed")}d.byteLength>e.maxBytes&&t("budget","bytes budget"),typeof SharedArrayBuffer<"u"&&d.buffer instanceof SharedArrayBuffer&&t("transport","shared transport bytes");const w=new Uint8Array(d);await e.digestBytes(w)!==f.blob&&t("integrity","blob integrity");let p;try{p=new TextDecoder("utf-8",{fatal:!0}).decode(w)}catch{return t("framing","carrier UTF-8")}let o;try{o=JSON.parse(p)}catch{t("framing","carrier framing")}(!Array.isArray(o)||o.length!==3||o[0]!=="authenticated-standing@1"||!Array.isArray(o[1])||o[1].length<1||o[1].length>e.maxRecords||o[1].some(i=>typeof i!="string")||typeof o[2]!="string"||JSON.stringify(o)+`
+`!==p)&&t("framing","carrier framing");const c=o[1],E=o[2],y=[...c,E].map(i=>{const n=J(i);return(n.kind!=="fact"||C(n.value.fields)!==i)&&t("wire","original canonical"),n.value.fields}),a=y[y.length-1];(a.scope!==e.proofScope||a.at!=="witness:"+e.snapshot||a.role!=="writes"||a.form!=="alphabet"||a.measure!=="digest"||a.epoch!==String(e.epoch))&&t("context","untrusted snapshot binding"),a.value!==await e.digestBytes(b(JSON.stringify(["authenticated-standing@1",c])+`
+`))&&t("integrity","snapshot commitment");const x=new Set,S=s((i,n)=>JSON.stringify([j(i),n,i.sig,e.algorithms]),"key");for(const i of y)for(const n of e.signers)n.id===i.by&&await e.verifyBytes(j(i),n.publicKey,i.sig,e.algorithms)&&x.add(S(i,n.publicKey));const B=s((i,n)=>x.has(S(i,n)),"verifies"),l=O(a,e.signers,B);l.kind!=="admitted"&&t("authority","proof "+l.kind+" "+l.why);const u=e.signers.find(i=>i.id===a.by);u||t("authority","proof signer");const m=U(a,u,e.epoch,e.proofScope,"authority");m.kind!=="admitted"&&t("authority","current proof "+m.kind+" "+m.why);const v=new Set;for(let i=0;i<c.length;i++){const n=O(y[i],e.signers,B);n.kind!=="admitted"&&t("authority","original "+n.kind+" "+n.why),v.add(c[i])}const g=F(c);g.kind!=="fact"&&t("wire","wire "+g.why),g.value.configuration.some(i=>i.value==="withdraw")&&t("history","configuration history requires admitted standing fold");const I={...e.objects,admit:s(i=>v.has(C(i.fields))&&e.objects.admit(i),"admit")},h=T(g.value.objects,I);if(h.kind!=="fact")throw new A("authenticated-reference/object-context","REFUSE\xB7"+h.why);const R=K(c,h.value),k=await e.digestBytes(b(R));k!=="sha256:"+f.digest&&t("identity","standing identity");const N=await e.digestBytes(b(JSON.stringify(e.contracts?["reference-inspection-trust@2",e.snapshot,e.epoch,e.proofScope,e.policy,e.formImplementation,e.signers,e.algorithms,e.contracts]:["reference-inspection-trust@1",e.snapshot,e.epoch,e.proofScope,e.policy,e.formImplementation,e.signers,e.algorithms])));return{reference:f,records:h.value,semanticIdentity:k,authorityContextIdentity:N,semanticStanding:R,originalRecords:c,...e.contracts?{contracts:{...e.contracts}}:{}}}s(Q,"inspectAuthenticatedReference");import{encodeReference as X,decodeReference as Y}from"./reference-profile.js";import{BoundRefusal as $,readRefusalCatalog as ee,describeRefusal as ie}from"./refusals.js";import{readContent as ne,retainContent as oe,invokeSigningPort as ae}from"../engine/ports.js";export{$ as BoundRefusal,Y as decodeReference,ie as describeRefusal,X as encodeReference,Q as inspectAuthenticatedReference,ae as invokeSigningPort,ne as readContent,ee as readRefusalCatalog,oe as retainContent};

package/dist/host/reference-contracts.js

@@ -1,6 +1 @@
-import { readFileSync } from 'node:fs';
-import { sha256 } from "./hash.js";
-/** Exact shipped interpretation contracts; this helper grants no authority. */
-export function installedReferenceContracts() {
-    return { refusals: sha256(readFileSync(new URL('../../docs/contracts/refusals.bound', import.meta.url))), standing: sha256(readFileSync(new URL('../../docs/contracts/standing.bound', import.meta.url))) };
-}
+var s=Object.defineProperty;var r=(e,o)=>s(e,"name",{value:o,configurable:!0});import{readFileSync as t}from"node:fs";import{sha256 as n}from"./hash.js";function d(){return{refusals:n(t(new URL("../../docs/contracts/refusals.bound",import.meta.url))),standing:n(t(new URL("../../docs/contracts/standing.bound",import.meta.url)))}}r(d,"installedReferenceContracts");export{d as installedReferenceContracts};