@lapxo/bound 0.2.4 → 0.2.6

package/dist/host/walk.js

@@ -1,193 +1,20 @@
-import { walkProjection, walkAt, walkSnapshot, walkHeaders, readWalkHeaders, readForeignWalk, walkAuthority, walkOrigin, walkInventory, walkSelection, isWalkHeader } from '@lapxo/topos/walk';
-import { canonical, parse, fromLine, wireAt, matches, objectHistory, validateObjectContext } from '@lapxo/topos/wire';
-import { objectProvider } from '@lapxo/topos/object-provider';
-import { standingBytes } from '@lapxo/topos/standing';
-import { fieldOf } from "../fold/claims.js";
-import { lockStanding, lockLines } from "../fold/keys.js";
-import { authorityFor, rootSigner } from "../fold/signers.js";
-import { publicKeyOf } from "../fold/signers.js";
-import { signaturesOf } from "../fold/digests.js";
-import { fullDigest } from "./digest.js";
-import { toposAt, contextModuleAt } from "./selected-topos.js";
-import { signerFor } from "./signing.js";
-import { signConsentLot, verifiesFields } from "../land/sign.js";
-import { storeOf } from "../land/ledger.js";
-import { signedOwnerLines, epochOf, localActLines, ownerOf } from "../cli/owner.js";
-import { commitIngress, ingressBundles, ingressCost } from "./ports/ingress.js";
-const refuse = (why) => { throw Error('REFUSE·walk ' + why); };
-const fields = (line) => { const p = parse(line); if (p.kind !== 'fact')
-    return refuse('not a wire line'); return p.value.fields; };
-const one = (lines, scope, measure) => {
-    const rows = lines.filter(line => fieldOf(line, 'scope') === scope && fieldOf(line, 'measure') === measure && fieldOf(line, 'value') !== 'withdraw');
-    if (rows.length !== 1)
-        return refuse('missing or conflicting ' + scope + ' ' + measure);
-    return fieldOf(rows[0], 'value');
-};
-function policy(root) {
-    const store = storeOf(root), standing = lockStanding(store), contract = walkSelection(standing);
-    const view = one(standing, 'view/walk', 'id');
-    if (view !== 'walk@*')
-        refuse('view/walk must declare walk@*');
-    const masks = standing.filter(line => fieldOf(line, 'scope') === 'view/walk').flatMap(line => fieldOf(line, 'needs').split('|')).filter(Boolean);
-    if (!masks.length)
-        refuse('view/walk has no declared history inputs');
-    const wire = wireAt(standing.map(fields), Number.MAX_SAFE_INTEGER), algorithm = wire?.digests.values().next().value;
-    if (!algorithm)
-        refuse('no admitted digest algorithm');
-    return { store, standing, contract, masks, digest: (bytes) => fullDigest(bytes, algorithm) };
-}
-function context(root, pin, own = false) {
-    const p = policy(root);
-    if (!own && !p.standing.some(line => fieldOf(line, 'scope').startsWith('uses/') && fieldOf(line, 'value') === pin))
-        refuse('origin context is not selected by digest');
-    const topos = toposAt(pin, p.store), authority = walkAuthority(topos.parts, verifiesFields);
-    const configuration = topos.parts.map(f => canonical({ ...f, by: 'target', epoch: '0' }));
-    return { pin, topos, authority, configuration, origin: walkOrigin(topos.parts), contract: walkSelection(topos.lines) };
-}
-function local(root) {
-    const p = policy(root), authority = authorityFor(lockLines(p.store), rootSigner(root), signaturesOf(p.store).admitted);
-    const history = signedOwnerLines(p.store).filter(line => p.masks.some(mask => matches(mask, fieldOf(line, 'scope'))));
-    if (history.some(line => authority.of(line).kind !== 'admitted'))
-        refuse('local history is not authenticated');
-    const selected = context(root, one(p.standing, 'walk/context', 'digest'), true);
-    return walkSnapshot(history, selected.contract.fields, p.digest, selected.origin, selected.contract.partition);
-}
-const headerInfo = (lines) => {
-    const roots = lines.filter(line => isWalkHeader(line) && fieldOf(line, 'scope') === 'walk/root');
-    if (roots.length !== 1)
-        return refuse('one signed root is required');
-    const at = fieldOf(roots[0], 'at');
-    if (!at.startsWith('receipt:'))
-        return refuse('root has no declared context');
-    return { pin: at.slice(8), base: fieldOf(roots[0], 'condition') };
-};
-async function validateHistory(root, selected, history) {
-    if (!selected.authority.authenticate(history))
-        refuse('origin history is not authenticated');
-    for (const line of history) {
-        const f = fields(line), decoded = fromLine(line, wireAt(selected.topos.parts, Number(f.epoch)));
-        if (decoded.kind !== 'fact')
-            refuse('origin wire ' + decoded.why);
-    }
-    const decoded = objectHistory([...selected.configuration, ...history]);
-    if (decoded.kind !== 'fact')
-        return refuse('origin history ' + decoded.why);
-    if (!decoded.value.objects.length)
-        return;
-    const pinned = new Set(selected.topos.lines);
-    const admit = (f) => Boolean(f.sig) ? selected.authority.of(canonical(f)).kind === 'admitted' : pinned.has(standingBytes([canonical(f)]).trim());
-    const provider = await objectProvider(decoded.value.objects, decoded.value.configuration, { admit, emit: () => { }, topos: pin => toposAt(pin, storeOf(root)), module: pin => contextModuleAt(pin, storeOf(root)) });
-    const checked = validateObjectContext(decoded.value.objects, provider);
-    if (checked.kind !== 'fact')
-        refuse('origin context ' + checked.why);
-}
-async function readBundle(root, bundle, earlier = []) {
-    const lines = bundle.evidence.split('\n').filter(Boolean), info = headerInfo(lines), p = policy(root);
-    const receipts = bundle.receipt.split('\n').filter(Boolean), authority = authorityFor(lockLines(p.store), rootSigner(root), signaturesOf(p.store).admitted);
-    if (receipts.length !== 1 || fieldOf(receipts[0], 'scope') !== 'receipts' || fieldOf(receipts[0], 'role') !== 'writes' || fieldOf(receipts[0], 'form') !== 'alphabet' || fieldOf(receipts[0], 'measure') !== 'digest' || fieldOf(receipts[0], 'at') !== 'receipt:' + info.pin || authority.of(receipts[0]).kind !== 'admitted')
-        refuse('retained import receipt is not authenticated');
-    const selected = context(root, info.pin);
-    const got = readForeignWalk(lines, { origin: selected.origin, regionOrigin: selected.origin, context: info.pin, base: info.base, fields: selected.contract.fields, partition: selected.contract.partition, digest: p.digest, previousPrefixes: [], authenticatePrefix: selected.authority.authenticate, authenticateEvidence: selected.authority.authenticate, validateOriginHistory: () => true });
-    if (fieldOf(receipts[0], 'value') !== got.identity)
-        refuse('retained import receipt does not authenticate this ingress');
-    await validateHistory(root, selected, [...new Set([...earlier, ...got.records])]);
-    return { ...got, context: info.pin, regions: walkSnapshot(got.records, selected.contract.fields, p.digest, got.origin, selected.contract.partition).regions };
-}
-async function verifiedIngress(root) {
-    const result = [], history = new Map();
-    const bundles = [...ingressBundles(storeOf(root))].sort((a, b) => epochOf(a.receipt.split('\n')) - epochOf(b.receipt.split('\n')));
-    for (const bundle of bundles) {
-        const info = headerInfo(bundle.evidence.split('\n').filter(Boolean)), origin = context(root, info.pin).origin;
-        if (result.some(prior => prior.origin === origin && prior.context !== info.pin))
-            refuse('origin context changed without declared lineage');
-        const prior = history.get(origin) ?? new Set();
-        const got = await readBundle(root, bundle, [...prior]);
-        for (const line of got.records)
-            prior.add(line);
-        history.set(origin, prior);
-        result.push(got);
-    }
-    return result;
-}
-async function inventory(root) {
-    const p = policy(root), regions = new Map(local(root).regions.map(region => [region.scope, region]));
-    for (const got of (await verifiedIngress(root)).sort((a, b) => a.senderEpoch - b.senderEpoch))
-        for (const region of got.regions)
-            regions.set(region.scope, region);
-    return walkInventory([[...regions.values()]], p.digest, context(root, one(p.standing, 'walk/context', 'digest'), true).contract.partition);
-}
-/** Verified foreign histories stay separate from the local authority and local epoch inputs. */
-export async function foreignWalkLines(root) {
-    const verified = await verifiedIngress(root);
-    return [...new Set(verified.flatMap(got => got.records))];
-}
-/** A declared origin exports its own signed history. Foreign packets are retained with their contexts, never re-signed as local history. */
-export async function renderWalk(root, resolution, peer, key, keyFile, signer) {
-    const p = policy(root), pin = one(p.standing, 'walk/context', 'digest'), selected = context(root, pin, true), own = local(root);
-    const known = peer.length ? (() => { const info = headerInfo(peer), remote = context(root, info.pin); return readWalkHeaders(peer, info.pin, info.base, remote.authority.authenticate); })() : walkSnapshot([], p.contract.fields, p.digest);
-    const projection = walkProjection(selected.contract.projections, resolution);
-    const ownInventory = projection === 'history' ? own : await inventory(root);
-    const selectedPacket = walkAt(ownInventory, known, resolution, selected.contract.projections), by = key ?? ownerOf(p.store), publicKey = publicKeyOf(root, by);
-    if (!publicKey)
-        refuse('unknown local signer ' + by);
-    const drafted = walkHeaders(selectedPacket, pin, known.root, projection !== 'inventory'), epoch = epochOf(localActLines(root));
-    const got = await signConsentLot(drafted, { by, epoch, algorithm: signaturesOf(p.store).era }, publicKey, signaturesOf(p.store).admitted, signerFor(p.standing, by, signer, keyFile));
-    if (got.kind !== 'fact')
-        return refuse(got.why);
-    if (!selected.authority.authenticate(got.lines) || !selected.authority.authenticate(selectedPacket.records))
-        refuse('local context does not authenticate exported history');
-    return [...got.lines, ...selectedPacket.records, `EXCHANGE ${selectedPacket.touched} touched regions · ${selectedPacket.open} open regions · ${Buffer.byteLength(selectedPacket.records.join('\n') + (selectedPacket.records.length ? '\n' : ''))} payload bytes`];
-}
-/** The SDK proves the foreign prefix; the host admits the pair at one publication point. */
-export async function landWalk(root, lines, key, keyFile, signer) {
-    const p = policy(root), info = headerInfo(lines), selected = context(root, info.pin);
-    const retained = await verifiedIngress(root);
-    if (retained.some(prior => prior.origin === selected.origin && prior.context !== info.pin))
-        refuse('origin context changed without declared lineage');
-    const previous = (verified) => { const prefixes = new Map(); for (const prior of verified.filter(got => got.origin === selected.origin).sort((a, b) => a.senderEpoch - b.senderEpoch))
-        for (const region of prior.regions)
-            prefixes.set(region.scope, { ...region, senderEpoch: prior.senderEpoch }); return [...prefixes.values()]; };
-    const payload = lines.filter(line => !isWalkHeader(line));
-    const proof = (prefixes) => readForeignWalk(lines, { origin: selected.origin, regionOrigin: selected.origin, context: info.pin, base: info.base, fields: selected.contract.fields, partition: selected.contract.partition, digest: p.digest, previousPrefixes: prefixes, authenticatePrefix: selected.authority.authenticate, authenticateEvidence: selected.authority.authenticate, validateOriginHistory: () => true });
-    const raw = proof([]), known = retained.find(prior => prior.identity === raw.identity), got = known ? raw : proof(previous(retained));
-    const history = (prior) => [...new Set([...prior.filter(item => item.origin === selected.origin).flatMap(item => item.records), ...payload])];
-    await validateHistory(root, selected, history(retained));
-    if (!known && info.base !== (await inventory(root)).root)
-        refuse('stale receiver base');
-    if (!payload.length && !readWalkHeaders(lines, info.pin, info.base, selected.authority.authenticate).regions.length)
-        return ['ONCE 0 new evidence lines · 0 import receipts · no regions offered', `EXCHANGE 0 payload bytes · ${Buffer.byteLength(lines.join('\n') + '\n')} protocol bytes · 0 new evidence bytes · 0 new receipt bytes`];
-    const by = key ?? ownerOf(p.store), pub = publicKeyOf(root, by);
-    if (!pub)
-        refuse('unknown receiver signer ' + by);
-    const result = await commitIngress(p.store, got.identity, async () => {
-        if (info.base !== (await inventory(root)).root)
-            refuse('receiver changed before ingress');
-        const current = await verifiedIngress(root);
-        proof(previous(current));
-        await validateHistory(root, selected, history(current));
-        const next = epochOf(localActLines(root)) + 1;
-        const signed = await signConsentLot([got.importReceiptProposal], { by, epoch: next, algorithm: signaturesOf(p.store).era }, pub, signaturesOf(p.store).admitted, signerFor(p.standing, by, signer, keyFile));
-        if (signed.kind !== 'fact')
-            return refuse(signed.why);
-        const authority = authorityFor(lockLines(p.store), rootSigner(root), signaturesOf(p.store).admitted);
-        if (authority.of(signed.lines[0]).kind !== 'admitted')
-            refuse('receiver signer does not cover the import receipt');
-        const grammar = fromLine(signed.lines[0], wireAt(p.standing.map(fields), next));
-        if (grammar.kind !== 'fact')
-            refuse('receiver receipt wire ' + grammar.why);
-        return { evidence: lines.join('\n') + '\n', receipt: signed.lines.join('\n') + '\n' };
-    }, bundle => {
-        try {
-            const retainedLines = bundle.evidence.split('\n').filter(Boolean), retainedInfo = headerInfo(retainedLines);
-            if (retainedInfo.pin !== info.pin)
-                return false;
-            const retainedProof = readForeignWalk(retainedLines, { origin: selected.origin, regionOrigin: selected.origin, context: info.pin, base: retainedInfo.base, fields: selected.contract.fields, partition: selected.contract.partition, digest: p.digest, previousPrefixes: [], authenticatePrefix: selected.authority.authenticate, authenticateEvidence: selected.authority.authenticate, validateOriginHistory: () => true });
-            const receipts = bundle.receipt.split('\n').filter(Boolean), receipt = receipts[0] ?? '';
-            return receipts.length === 1 && retainedProof.identity === got.identity && fieldOf(receipt, 'scope') === 'receipts' && fieldOf(receipt, 'value') === got.identity && fieldOf(receipt, 'at') === 'receipt:' + info.pin && authorityFor(lockLines(p.store), rootSigner(root), signaturesOf(p.store).admitted).of(receipt).kind === 'admitted';
-        }
-        catch {
-            return false;
-        }
-    });
-    return [`${result.kind === 'once' ? 'ONCE' : 'INGRESS'} ${result.kind === 'once' ? 0 : got.records.length} new evidence lines · 1 ${result.kind === 'once' ? 'retained' : 'signed local'} import receipt`, result.receipt.trim(), ingressCost(result, Buffer.byteLength(payload.join('\n') + (payload.length ? '\n' : '')), Buffer.byteLength(lines.filter(isWalkHeader).join('\n') + '\n'))];
-}
+var it=Object.defineProperty;var l=(t,e)=>it(t,"name",{value:e,configurable:!0});import{library13_walkProjection as nt,library13_walkAt as rt,library13_walkSnapshot as M,library13_walkHeaders as ot,library13_readWalkHeaders as U,library13_readForeignWalk as $,library13_walkAuthority as at,library13_walkOrigin as st,library13_walkInventory as ct,library13_walkSelection as z,library13_isWalkHeader as G}from"../vendor/runtime.js";import{library14_canonical as R,library14_parse as dt,library14_fromLine as J,library14_wireAt as X,library14_matches as lt,library14_objectHistory as ft,library14_validateObjectContext as pt}from"../vendor/runtime.js";import{objectProvider as gt}from"../vendor/object-provider.js";import{library10_standingBytes as ut}from"../vendor/runtime.js";import{fieldOf as p}from"../fold/claims.js";import{lockStanding as ht,lockLines as L}from"../fold/keys.js";import{authorityFor as W,rootSigner as I}from"../fold/signers.js";import{publicKeyOf as Q}from"../fold/signers.js";import{signaturesOf as v}from"../fold/digests.js";import{fullDigest as yt}from"./digest.js";import{toposAt as wt,contextProviderServices as mt}from"./selected-topos.js";import{signerFor as V}from"./signing.js";import{signConsentLot as Y,verifiesFields as kt}from"../land/sign.js";import{storeOf as K}from"../land/ledger.js";import{signedOwnerLines as bt,epochOf as C,localActLines as Z,ownerOf as tt}from"../cli/owner.js";import{commitIngress as vt,ingressBundles as xt,ingressCost as Et}from"./ports/ingress.js";const d=l(t=>{throw Error("REFUSE\xB7walk "+t)},"refuse"),q=l(t=>{const e=dt(t);return e.kind!=="fact"?d("not a wire line"):e.value.fields},"fields"),N=l((t,e,a)=>{const c=t.filter(o=>p(o,"scope")===e&&p(o,"measure")===a&&p(o,"value")!=="withdraw");return c.length!==1?d("missing or conflicting "+e+" "+a):p(c[0],"value")},"one");function O(t){const e=K(t),a=ht(e),c=z(a);N(a,"view/walk","id")!=="walk@*"&&d("view/walk must declare walk@*");const r=a.filter(s=>p(s,"scope")==="view/walk").flatMap(s=>p(s,"needs").split("|")).filter(Boolean);r.length||d("view/walk has no declared history inputs");const i=X(a.map(q),Number.MAX_SAFE_INTEGER),n=i?.digests.values().next().value;return n||d("no admitted digest algorithm"),{store:e,standing:a,contract:c,masks:r,digest:l(s=>yt(s,n),"digest")}}l(O,"policy");function E(t,e,a=!1){const c=O(t);!a&&!c.standing.some(n=>p(n,"scope").startsWith("uses/")&&p(n,"value")===e)&&d("origin context is not selected by digest");const o=wt(e,c.store),r=at(o.parts,kt),i=o.parts.map(n=>R({...n,by:"target",epoch:"0"}));return{pin:e,topos:o,authority:r,configuration:i,origin:st(o.parts),contract:z(o.lines)}}l(E,"context");function et(t){const e=O(t),a=W(L(e.store),I(t),v(e.store).admitted),c=bt(e.store).filter(r=>e.masks.some(i=>lt(i,p(r,"scope"))));c.some(r=>a.of(r).kind!=="admitted")&&d("local history is not authenticated");const o=E(t,N(e.standing,"walk/context","digest"),!0);return M(c,o.contract.fields,e.digest,o.origin,o.contract.partition)}l(et,"local");const B=l(t=>{const e=t.filter(c=>G(c)&&p(c,"scope")==="walk/root");if(e.length!==1)return d("one signed root is required");const a=p(e[0],"at");return a.startsWith("receipt:")?{pin:a.slice(8),base:p(e[0],"condition")}:d("root has no declared context")},"headerInfo");async function D(t,e,a){e.authority.authenticate(a)||d("origin history is not authenticated");for(const s of a){const g=q(s),y=J(s,X(e.topos.parts,Number(g.epoch)));y.kind!=="fact"&&d("origin wire "+y.why)}const c=ft([...e.configuration,...a]);if(c.kind!=="fact")return d("origin history "+c.why);if(!c.value.objects.length)return;const o=new Set(e.topos.lines),r=l(s=>s.sig?e.authority.of(R(s)).kind==="admitted":o.has(ut([R(s)]).trim()),"admit"),i=await gt(c.value.objects,c.value.configuration,{admit:r,emit:l(()=>{},"emit"),...mt(K(t))}),n=pt(c.value.objects,i);n.kind!=="fact"&&d("origin context "+n.why)}l(D,"validateHistory");async function _t(t,e,a=[]){const c=e.evidence.split(`
+`).filter(Boolean),o=B(c),r=O(t),i=e.receipt.split(`
+`).filter(Boolean),n=W(L(r.store),I(t),v(r.store).admitted);(i.length!==1||p(i[0],"scope")!=="receipts"||p(i[0],"role")!=="writes"||p(i[0],"form")!=="alphabet"||p(i[0],"measure")!=="digest"||p(i[0],"at")!=="receipt:"+o.pin||n.of(i[0]).kind!=="admitted")&&d("retained import receipt is not authenticated");const s=E(t,o.pin),g=$(c,{origin:s.origin,regionOrigin:s.origin,context:o.pin,base:o.base,fields:s.contract.fields,partition:s.contract.partition,digest:r.digest,previousPrefixes:[],authenticatePrefix:s.authority.authenticate,authenticateEvidence:s.authority.authenticate,validateOriginHistory:l(()=>!0,"validateOriginHistory")});return p(i[0],"value")!==g.identity&&d("retained import receipt does not authenticate this ingress"),await D(t,s,[...new Set([...a,...g.records])]),{...g,context:o.pin,regions:M(g.records,s.contract.fields,r.digest,g.origin,s.contract.partition).regions}}l(_t,"readBundle");async function F(t){const e=[],a=new Map,c=[...xt(K(t))].sort((o,r)=>C(o.receipt.split(`
+`))-C(r.receipt.split(`
+`)));for(const o of c){const r=B(o.evidence.split(`
+`).filter(Boolean)),i=E(t,r.pin).origin;e.some(g=>g.origin===i&&g.context!==r.pin)&&d("origin context changed without declared lineage");const n=a.get(i)??new Set,s=await _t(t,o,[...n]);for(const g of s.records)n.add(g);a.set(i,n),e.push(s)}return e}l(F,"verifiedIngress");async function T(t){const e=O(t),a=new Map(et(t).regions.map(c=>[c.scope,c]));for(const c of(await F(t)).sort((o,r)=>o.senderEpoch-r.senderEpoch))for(const o of c.regions)a.set(o.scope,o);return ct([[...a.values()]],e.digest,E(t,N(e.standing,"walk/context","digest"),!0).contract.partition)}l(T,"inventory");async function Xt(t){const e=await F(t);return[...new Set(e.flatMap(a=>a.records))]}l(Xt,"foreignWalkLines");async function Kt(t,e,a,c,o,r){const i=O(t),n=N(i.standing,"walk/context","digest"),s=E(t,n,!0),g=et(t),y=a.length?(()=>{const f=B(a),u=E(t,f.pin);return U(a,f.pin,f.base,u.authority.authenticate)})():M([],i.contract.fields,i.digest),_=nt(s.contract.projections,e),H=_==="history"?g:await T(t),w=rt(H,y,e,s.contract.projections),m=c??tt(i.store),S=Q(t,m);S||d("unknown local signer "+m);const j=ot(w,n,y.root,_!=="inventory"),P=C(Z(t)),k=await Y(j,{by:m,epoch:P,algorithm:v(i.store).era},S,v(i.store).admitted,V(i.standing,m,r,o));return k.kind!=="fact"?d(k.why):((!s.authority.authenticate(k.lines)||!s.authority.authenticate(w.records))&&d("local context does not authenticate exported history"),[...k.lines,...w.records,`EXCHANGE ${w.touched} touched regions \xB7 ${w.open} open regions \xB7 ${Buffer.byteLength(w.records.join(`
+`)+(w.records.length?`
+`:""))} payload bytes`])}l(Kt,"renderWalk");async function qt(t,e,a,c,o){const r=O(t),i=B(e),n=E(t,i.pin),s=await F(t);s.some(f=>f.origin===n.origin&&f.context!==i.pin)&&d("origin context changed without declared lineage");const g=l(f=>{const u=new Map;for(const h of f.filter(b=>b.origin===n.origin).sort((b,x)=>b.senderEpoch-x.senderEpoch))for(const b of h.regions)u.set(b.scope,{...b,senderEpoch:h.senderEpoch});return[...u.values()]},"previous"),y=e.filter(f=>!G(f)),_=l(f=>$(e,{origin:n.origin,regionOrigin:n.origin,context:i.pin,base:i.base,fields:n.contract.fields,partition:n.contract.partition,digest:r.digest,previousPrefixes:f,authenticatePrefix:n.authority.authenticate,authenticateEvidence:n.authority.authenticate,validateOriginHistory:l(()=>!0,"validateOriginHistory")}),"proof"),H=_([]),w=s.find(f=>f.identity===H.identity),m=w?H:_(g(s)),S=l(f=>[...new Set([...f.filter(u=>u.origin===n.origin).flatMap(u=>u.records),...y])],"history");if(await D(t,n,S(s)),!w&&i.base!==(await T(t)).root&&d("stale receiver base"),!y.length&&!U(e,i.pin,i.base,n.authority.authenticate).regions.length)return["ONCE 0 new evidence lines \xB7 0 import receipts \xB7 no regions offered",`EXCHANGE 0 payload bytes \xB7 ${Buffer.byteLength(e.join(`
+`)+`
+`)} protocol bytes \xB7 0 new evidence bytes \xB7 0 new receipt bytes`];const j=a??tt(r.store),P=Q(t,j);P||d("unknown receiver signer "+j);const k=await vt(r.store,m.identity,async()=>{i.base!==(await T(t)).root&&d("receiver changed before ingress");const f=await F(t);_(g(f)),await D(t,n,S(f));const u=C(Z(t))+1,h=await Y([m.importReceiptProposal],{by:j,epoch:u,algorithm:v(r.store).era},P,v(r.store).admitted,V(r.standing,j,o,c));if(h.kind!=="fact")return d(h.why);W(L(r.store),I(t),v(r.store).admitted).of(h.lines[0]).kind!=="admitted"&&d("receiver signer does not cover the import receipt");const x=J(h.lines[0],X(r.standing.map(q),u));return x.kind!=="fact"&&d("receiver receipt wire "+x.why),{evidence:e.join(`
+`)+`
+`,receipt:h.lines.join(`
+`)+`
+`}},f=>{try{const u=f.evidence.split(`
+`).filter(Boolean),h=B(u);if(h.pin!==i.pin)return!1;const b=$(u,{origin:n.origin,regionOrigin:n.origin,context:i.pin,base:h.base,fields:n.contract.fields,partition:n.contract.partition,digest:r.digest,previousPrefixes:[],authenticatePrefix:n.authority.authenticate,authenticateEvidence:n.authority.authenticate,validateOriginHistory:l(()=>!0,"validateOriginHistory")}),x=f.receipt.split(`
+`).filter(Boolean),A=x[0]??"";return x.length===1&&b.identity===m.identity&&p(A,"scope")==="receipts"&&p(A,"value")===m.identity&&p(A,"at")==="receipt:"+i.pin&&W(L(r.store),I(t),v(r.store).admitted).of(A).kind==="admitted"}catch{return!1}});return[`${k.kind==="once"?"ONCE":"INGRESS"} ${k.kind==="once"?0:m.records.length} new evidence lines \xB7 1 ${k.kind==="once"?"retained":"signed local"} import receipt`,k.receipt.trim(),Et(k,Buffer.byteLength(y.join(`
+`)+(y.length?`
+`:"")),Buffer.byteLength(e.filter(G).join(`
+`)+`
+`))]}l(qt,"landWalk");export{Xt as foreignWalkLines,qt as landWalk,Kt as renderWalk};

package/dist/host/work-trace.js

@@ -0,0 +1 @@
+var v=Object.defineProperty;var d=(r,o)=>v(r,"name",{value:o,configurable:!0});import{AsyncLocalStorage as y}from"node:async_hooks";const f=new y,M=1e4;function S(r,o){const i=f.getStore();if(!i)return o();const{trace:e,parent:c}=i;if(e.spans.length>=M)return e.truncated=!0,o();const l={id:e.spans.length,parent:c,name:r,start:e.clock()};e.spans.push(l);const m=d(()=>{l.end=e.clock()},"close");return f.run({trace:e,parent:l.id},()=>{try{const s=o();return s&&typeof s.then=="function"?Promise.resolve(s).finally(m):(m(),s)}catch(s){throw m(),s}})}d(S,"traceWork");function g(r,o,i=!1){const e=r[0],c=r.flatMap(t=>[{time:t.start,id:t.id,start:!0},{time:t.end??o,id:t.id,start:!1}]).sort((t,n)=>t.time-n.time||Number(t.start)-Number(n.start)),l=new Set,m=new Map,s=r.map(t=>{let n=0,a=t.parent;for(;a>=0;)n++,a=r[a].parent;return n});let p=e.start;for(const t of c){const n=Math.min(o,Math.max(e.start,t.time));if(n>p){let a=0;for(const u of l)(s[u]>s[a]||s[u]===s[a]&&u>a)&&(a=u);const w=r[a].name;m.set(w,(m.get(w)??0)+n-p),p=n}t.start?l.add(t.id):l.delete(t.id)}const h=[...m].map(([t,n])=>({name:t,milliseconds:n}));return{profile:"bound-work-trace@1",clock:"performance.now monotonic milliseconds",totalMilliseconds:o-e.start,exclusiveMilliseconds:h.reduce((t,n)=>t+n.milliseconds,0),phases:h,inclusive:r.map(t=>({name:t.name,milliseconds:(t.end??o)-t.start})),complete:!i}}d(g,"workReport");async function b(r,o,i=()=>performance.now()){if(f.getStore())return r();const e={id:0,parent:-1,name:"command/dispatch",start:i()},c={clock:i,spans:[e],truncated:!1};try{return await f.run({trace:c,parent:0},r)}finally{e.end=i(),o(g(c.spans,e.end,c.truncated))}}d(b,"withWorkTrace");export{S as traceWork,b as withWorkTrace,g as workReport};

package/dist/judge/late.js

@@ -1,33 +1 @@
-import { canonical } from '@lapxo/topos/wire';
-import { fieldOf } from "../fold/claims.js";
-import { fullDigest } from "../fold/digests.js";
-import { inside, locationsOf, vouchedCoordinates } from "../land/vouched.js";
-import { wordOf } from "../fold/wire.js";
-import { holdsCases } from "../fold/paid.js";
-/**
- * A demand that landed after its coordinates. A take judges what moved, because it assumes the demand came first and the
- * tree after it; a demand that arrives second has nothing left to move — its cone is already in the ledger, every coordinate
- * of it vouched at a digest. Judging that is reading, not observing, so it is answered where it lands and no file is
- * touched to force it. A demand whose cone holds no vouched coordinate is not late, it is unlanded, and it waits for a take.
- */
-export function lateFacts(store, signed, answered) {
-    const vouched = [...vouchedCoordinates(store)];
-    const views = `${wordOf(signed, 'families', 'view')}/`;
-    const out = [];
-    for (const line of signed) {
-        const scope = fieldOf(line, 'scope');
-        const value = fieldOf(line, 'value') || 'present';
-        if (fieldOf(line, 'role') !== 'demands' || value === 'withdraw' || answered.has(scope))
-            continue;
-        const asked = locationsOf(fieldOf(line, 'needs')).locations;
-        if (!asked.length || (!scope.startsWith(views) && !asked.some(holdsCases)))
-            continue;
-        const cone = asked.map((where) => vouched.filter(([coordinate]) => inside(coordinate, where)));
-        if (cone.some((held) => !held.length))
-            continue;
-        const held = cone.flat();
-        const at = `cone:${fullDigest(store, held.map(([coordinate, digest]) => `${coordinate} ${digest}`).sort()).replace(/^sha256:/, '')}`;
-        out.push(canonical({ scope, role: 'writes', form: 'alphabet', measure: fieldOf(line, 'measure') || 'status', value, by: 'judge', at }), canonical({ scope, role: 'writes', form: 'alphabet', measure: 'cone', value: held.map(([coordinate]) => coordinate).join('|'), by: 'judge', at }));
-    }
-    return out;
-}
+var b=Object.defineProperty;var p=(s,a)=>b(s,"name",{value:a,configurable:!0});import{library14_canonical as d}from"../vendor/runtime.js";import{fieldOf as t}from"../fold/claims.js";import{fullDigest as g}from"../fold/digests.js";import{inside as $,locationsOf as j,vouchedCoordinates as y}from"../land/vouched.js";import{wordOf as O}from"../fold/wire.js";import{holdsCases as C}from"../fold/paid.js";function z(s,a,h){const v=[...y(s)],w=`${O(a,"families","view")}/`,c=[];for(const e of a){const n=t(e,"scope"),l=t(e,"value")||"present";if(t(e,"role")!=="demands"||l==="withdraw"||h.has(n))continue;const r=j(t(e,"needs")).locations;if(!r.length||!n.startsWith(w)&&!r.some(C))continue;const m=r.map(o=>v.filter(([i])=>$(i,o)));if(m.some(o=>!o.length))continue;const f=m.flat(),u=`cone:${g(s,f.map(([o,i])=>`${o} ${i}`).sort()).replace(/^sha256:/,"")}`;c.push(d({scope:n,role:"writes",form:"alphabet",measure:t(e,"measure")||"status",value:l,by:"judge",at:u}),d({scope:n,role:"writes",form:"alphabet",measure:"cone",value:f.map(([o])=>o).join("|"),by:"judge",at:u}))}return c}p(z,"lateFacts");export{z as lateFacts};

package/dist/judge/take.js

@@ -1,75 +1,2 @@
-import { createHash, existsSync, join } from "../host/io.js";
-import { fullDigest } from "../fold/digests.js";
-import { answers, point, region } from '@lapxo/obligations/field';
-import { parse, PROTOCOL } from '@lapxo/topos/wire';
-import { observeText } from "../observe/files.js";
-import { storeOf } from "../land/ledger.js";
-import { holdsCases } from "../fold/paid.js";
-/** A demanded location is a region: it is there when some place of the tree answers to it, file or directory alike. */
-function located(root, location) {
-    return existsSync(join(root, location.replace(/\/+$/, '')));
-}
-function namedEffects(_root, _changed, _ROOTS) {
-    return [];
-}
-export function judgeTake(input) {
-    const { root, scope, value, locations, before, after } = input;
-    const paths = [...new Set([...before.keys(), ...after.keys()])].sort();
-    const moved = paths.filter((p) => before.get(p) !== after.get(p));
-    const notOwned = moved.filter((coordinate) => {
-        if (before.has(coordinate) || locations.includes(coordinate) || !input.witnessOf || !input.law)
-            return false;
-        const named = input.witnessOf(coordinate);
-        return named !== undefined && !input.law.includes(named);
-    });
-    const changed = moved.filter((coordinate) => !notOwned.includes(coordinate));
-    const absent = value === 'present' ? locations.filter((l) => !located(root, l)) : [];
-    const effects = changed.length && !absent.length ? namedEffects(root, changed, input.template) : [];
-    const envelope = {
-        scope,
-        cone: [...locations],
-        before: Object.fromEntries([...before].sort()),
-        after: Object.fromEntries([...after].filter(([coordinate]) => !notOwned.includes(coordinate)).sort()),
-        effects,
-    };
-    const digest = fullDigest(storeOf(root), JSON.stringify({ ...envelope, effects: effects.map((e) => ({ kind: e.kind, status: e.status, at: e.at })) }));
-    const refuse = (why) => ({ kind: 'refuse', why, envelope, digest, changed, notOwned });
-    const met = (why) => ({ kind: 'fact', why, envelope, digest, changed, notOwned });
-    if (!changed.length && !input.unpaid)
-        return refuse('nothing in the cone moved against what was vouched');
-    const cone = locations.map((l) => region(l));
-    const outside = changed.filter((coordinate) => !answers([point(coordinate)], cone));
-    if (outside.length)
-        return refuse(`outside the cone: ${outside.join(', ')}`);
-    if (absent.length)
-        return refuse(`demanded locations absent: ${absent.join(', ')}`);
-    if (input.shape === 'lock' || input.shape === 'render') {
-        const lines = locations.map((l) => ({ at: l, text: observeText(join(root, l)) }));
-        const absent = lines.filter((one) => one.text === undefined).map((one) => one.at);
-        if (absent.length)
-            return refuse(`a lock the demand names is not here: ${absent.join(', ')}`);
-        const said = lines.flatMap((one) => (one.text ?? '').split('\n').filter((line) => line.startsWith(PROTOCOL)));
-        const unread = said.filter((line) => parse(line).kind !== 'fact');
-        if (input.shape === 'lock' && (!said.length || unread.length)) {
-            return refuse(`a lock the demand names holds ${said.length ? `${unread.length} lines the wire does not read` : 'no claim'}`);
-        }
-        const rests = input.restsOn ?? '';
-        const digest = rests ? `sha256:${createHash('sha256').update(lines.map((one) => one.text ?? '').join('')).digest('hex')}` : rests;
-        if (rests && digest !== rests)
-            return refuse(`the lock moved: it rests on ${rests} and is ${digest}`);
-        return met(input.shape === 'lock' ? `${said.length} lines of the lock read, at the digest it rests on` : 'the region is here, at the digest it rests on');
-    }
-    const vectors = locations.filter((l) => holdsCases(l) && located(root, l));
-    if (!vectors.length)
-        return refuse('no vector location in the cone exists');
-    const red = effects.filter((e) => e.status === 'red' && e.admitted);
-    if (red.length)
-        return refuse(`effects red: ${red.map((e) => `${e.kind}@${e.at}`).join(', ')}`);
-    return met('demand met in its cone');
-}
-/** A take that met its cone carries the gates its batch passed: their runs join its envelope, and its receipt is sealed with them. */
-export function sealed(root, verdict, gates) {
-    const envelope = { ...verdict.envelope, effects: [...verdict.envelope.effects, ...gates.map(({ kind, status, ms, at, admitted }) => ({ kind, status, ms, at, admitted }))] };
-    const digest = fullDigest(storeOf(root), JSON.stringify({ ...envelope, effects: envelope.effects.map((e) => ({ kind: e.kind, status: e.status, at: e.at })) }));
-    return { ...verdict, envelope, digest };
-}
+var L=Object.defineProperty;var i=(t,s)=>L(t,"name",{value:s,configurable:!0});import{createHash as N,existsSync as P,join as S}from"../host/io.js";import{fullDigest as T}from"../fold/digests.js";import{library0_answers as D,library0_point as H,library0_region as M}from"../vendor/runtime.js";import{library14_parse as W,library14_PROTOCOL as q}from"../vendor/runtime.js";import{observeText as z}from"../observe/files.js";import{storeOf as C}from"../land/ledger.js";import{holdsCases as A}from"../fold/paid.js";function E(t,s){return P(S(t,s.replace(/\/+$/,"")))}i(E,"located");function B(t,s,g){return[]}i(B,"namedEffects");function Z(t){const{root:s,scope:g,value:l,locations:o,before:r,after:d}=t,u=[...new Set([...r.keys(),...d.keys()])].sort().filter(e=>r.get(e)!==d.get(e)),f=u.filter(e=>{if(r.has(e)||o.includes(e)||!t.witnessOf||!t.law)return!1;const h=t.witnessOf(e);return h!==void 0&&!t.law.includes(h)}),c=u.filter(e=>!f.includes(e)),k=l==="present"?o.filter(e=>!E(s,e)):[],O=c.length&&!k.length?B(s,c,t.template):[],b={scope:g,cone:[...o],before:Object.fromEntries([...r].sort()),after:Object.fromEntries([...d].filter(([e])=>!f.includes(e)).sort()),effects:O},v=T(C(s),JSON.stringify({...b,effects:O.map(e=>({kind:e.kind,status:e.status,at:e.at}))})),a=i(e=>({kind:"refuse",why:e,envelope:b,digest:v,changed:c,notOwned:f}),"refuse"),w=i(e=>({kind:"fact",why:e,envelope:b,digest:v,changed:c,notOwned:f}),"met");if(!c.length&&!t.unpaid)return a("nothing in the cone moved against what was vouched");const R=o.map(e=>M(e)),x=c.filter(e=>!D([H(e)],R));if(x.length)return a(`outside the cone: ${x.join(", ")}`);if(k.length)return a(`demanded locations absent: ${k.join(", ")}`);if(t.shape==="lock"||t.shape==="render"){const e=o.map(n=>({at:n,text:z(S(s,n))})),h=e.filter(n=>n.text===void 0).map(n=>n.at);if(h.length)return a(`a lock the demand names is not here: ${h.join(", ")}`);const p=e.flatMap(n=>(n.text??"").split(`
+`).filter(J=>J.startsWith(q))),j=p.filter(n=>W(n).kind!=="fact");if(t.shape==="lock"&&(!p.length||j.length))return a(`a lock the demand names holds ${p.length?`${j.length} lines the wire does not read`:"no claim"}`);const m=t.restsOn??"",_=m&&`sha256:${N("sha256").update(e.map(n=>n.text??"").join("")).digest("hex")}`;return m&&_!==m?a(`the lock moved: it rests on ${m} and is ${_}`):w(t.shape==="lock"?`${p.length} lines of the lock read, at the digest it rests on`:"the region is here, at the digest it rests on")}if(!o.filter(e=>A(e)&&E(s,e)).length)return a("no vector location in the cone exists");const y=O.filter(e=>e.status==="red"&&e.admitted);return y.length?a(`effects red: ${y.map(e=>`${e.kind}@${e.at}`).join(", ")}`):w("demand met in its cone")}i(Z,"judgeTake");function ee(t,s,g){const l={...s.envelope,effects:[...s.envelope.effects,...g.map(({kind:r,status:d,ms:$,at:u,admitted:f})=>({kind:r,status:d,ms:$,at:u,admitted:f}))]},o=T(C(t),JSON.stringify({...l,effects:l.effects.map(r=>({kind:r.kind,status:r.status,at:r.at}))}));return{...s,envelope:l,digest:o}}i(ee,"sealed");export{Z as judgeTake,ee as sealed};

package/dist/judge/widening.js

@@ -1,25 +1 @@
-import { fieldOf } from "../fold/claims.js";
-import { ALPHABETS, idsOf, INTERVALS, spanOf } from '@lapxo/topos/forms';
-/**
- * A ceiling that admits more than it did is not a revision of the same kind as one that admits less: narrowing costs
- * the signer nothing anyone else can dispute, while widening gives back freedom the tree had already spent. So a line
- * that widens what it replaces is refused unless it says what forced it — an `at` of the witness class, which names
- * the reading or the case that made the old bound wrong. Policy may narrow; only a witness may widen. A list of what is
- * forbidden narrows as it grows.
- */
-function widens(now, before) {
-    const [was, held] = [spanOf(fieldOf(before, 'value')), spanOf(fieldOf(now, 'value'))];
-    if (was && held)
-        return INTERVALS.leq(was, held) && !INTERVALS.leq(held, was);
-    const [old, fresh] = [idsOf(fieldOf(before, 'value')), idsOf(fieldOf(now, 'value'))];
-    return old.polarity === fresh.polarity && ALPHABETS.leq(old, fresh) && !ALPHABETS.leq(fresh, old);
-}
-export function widenedWithoutWitness(proposed, standing, isCeiling, witness) {
-    const held = new Map(standing.filter(isCeiling).map((line) => [fieldOf(line, 'scope'), line]));
-    return proposed.filter((line) => {
-        const before = held.get(fieldOf(line, 'scope'));
-        if (!before || !isCeiling(line) || !widens(line, before))
-            return false;
-        return !fieldOf(line, 'at').startsWith(`${witness}:`);
-    });
-}
+var c=Object.defineProperty;var o=(e,a)=>c(e,"name",{value:a,configurable:!0});import{fieldOf as t}from"../fold/claims.js";import{library7_ALPHABETS as n,library7_idsOf as u,library7_INTERVALS as p,library7_spanOf as d}from"../vendor/runtime.js";function y(e,a){const[s,f]=[d(t(a,"value")),d(t(e,"value"))];if(s&&f)return p.leq(s,f)&&!p.leq(f,s);const[l,r]=[u(t(a,"value")),u(t(e,"value"))];return l.polarity===r.polarity&&n.leq(l,r)&&!n.leq(r,l)}o(y,"widens");function O(e,a,s,f){const l=new Map(a.filter(s).map(r=>[t(r,"scope"),r]));return e.filter(r=>{const i=l.get(t(r,"scope"));return!i||!s(r)||!y(r,i)?!1:!t(r,"at").startsWith(`${f}:`)})}o(O,"widenedWithoutWitness");export{O as widenedWithoutWitness};