@lapxo/bound 0.2.4 → 0.2.6

package/dist/land/act.js

@@ -1,336 +1,8 @@
-import { AsyncLocalStorage } from 'node:async_hooks';
-import { randomUUID } from 'node:crypto';
-import { basename, dirname, existsSync, join, mkdirSync, rmSync, writeFileSync, realpathSync, resolve } from "../host/io.js";
-import { BoundRefusal } from "../host/refusals.js";
-import { selfName } from "../fold/claims.js";
-import { placesIn } from "../fold/places.js";
-import { coordinatesUnder, observeText } from "../observe/files.js";
-const hostContext = new AsyncLocalStorage();
-export const withActHost = (host, run) => hostContext.run(host, run);
-const actName = () => hostContext.getStore()?.name ?? selfName();
-const report = (text) => { const host = hostContext.getStore(); if (host)
-    host.report(text);
-else
-    process.stderr.write(text); };
-const checkCancellation = () => { if (hostContext.getStore()?.signal?.aborted)
-    throw new BoundRefusal('host/cancelled', 'REFUSE·host/cancelled'); };
-/** Resolve aliases before acquiring the same native lock protocol as the CLI. */
-export function canonicalActStore(store) {
-    let at = resolve(store);
-    const tail = [];
-    while (!existsSync(at)) {
-        const parent = dirname(at);
-        if (parent === at)
-            break;
-        tail.unshift(basename(at));
-        at = parent;
-    }
-    return join(realpathSync(at), ...tail);
-}
-const context = new AsyncLocalStorage();
-const held = new Map();
-const pauseFor = (ms) => new Promise((resolve) => { setTimeout(resolve, ms); });
-const ROOT = '_root';
-const MINUTE = 60000;
-const holderOf = (at) => {
-    const text = observeText(at);
-    if (text === undefined)
-        return undefined;
-    const [pid, what, since, token] = text.trim().split(' ');
-    return { pid: Number(pid), what: what ?? '', since: since ?? '', token: token ?? '' };
-};
-function overAMinute(at, began, holder) {
-    if (Date.now() - began < MINUTE)
-        return;
-    const who = holder === undefined ? 'a process' : `${holder.pid} · ${holder.what} since ${holder.since}`;
-    report(`RED      wait · ${named(at)} is held by ${who} · a wait over a minute is a red, not a pause\n`);
-    throw new Error(`${actName()}: REFUSE·stale nothing landed · a wait over a minute is a red, not a pause`);
-}
-const alive = (pid) => {
-    if (!Number.isSafeInteger(pid) || pid <= 0)
-        return true;
-    try {
-        process.kill(pid, 0);
-        return true;
-    }
-    catch (error) {
-        return error.code !== 'ESRCH';
-    }
-};
-const regionAt = (store, region) => {
-    const coordinate = region.replace(/\/+$/, '');
-    if ((coordinate && coordinate.split('/').some((step) => step === '..' || step === '.' || step === '')) || coordinate.startsWith('/'))
-        throw new Error(`${actName()}: REFUSE·lock invalid region coordinate`);
-    return join(store, 'locks', coordinate ? encodeURIComponent(coordinate).replace(/^\./, '%2E').replace(/^_root$/, '%5Froot') : ROOT);
-};
-const coordinateOf = (file) => {
-    if (file === ROOT)
-        return '';
-    try {
-        return decodeURIComponent(file);
-    }
-    catch {
-        return file;
-    }
-};
-const lockFiles = (locks) => coordinatesUnder(locks, locks).filter((file) => {
-    if (file !== '.act')
-        return true;
-    // The legacy marker lists paths, while an actual region named .act has a numeric lock owner.
-    const holder = holderOf(join(locks, file));
-    return holder !== undefined && Number.isSafeInteger(holder.pid) && holder.pid > 0;
-});
-const overlaps = (a, b) => !a || !b || a === b || a.startsWith(`${b}/`) || b.startsWith(`${a}/`);
-const treeAt = (store) => join(store, 'lock');
-const named = (at) => (basename(at) === 'lock' ? 'the store' : basename(at).startsWith('@authority-') ? 'root authority' : basename(at) === '@projection' ? 'root projection' : `region ${basename(at) === ROOT ? '.' : basename(at)}`);
-const owns = (at) => {
-    for (let frame = context.getStore(); frame !== undefined; frame = frame.parent) {
-        const token = frame.locks.get(at);
-        if (token !== undefined && held.get(at) === token)
-            return true;
-    }
-    return false;
-};
-const ownsRegion = (store) => [...held.keys()].some((at) => at.startsWith(`${join(store, 'locks')}/`) && owns(at));
-const ownsAuthority = (store) => [...held.keys()].some((at) => dirname(at) === join(store, 'locks') && basename(at).startsWith('@authority-') && owns(at));
-const projectionAt = (store) => join(store, 'locks', '@projection');
-/** Reentry belongs to an awaited act's context. Another process or async act has no inherited authority. */
-async function hold(at, what) {
-    if (owns(at))
-        return;
-    const frame = context.getStore();
-    if (frame === undefined)
-        throw new Error(`${actName()}: REFUSE·lock no act owns this request`);
-    const began = Date.now();
-    const token = randomUUID();
-    let told = false;
-    mkdirSync(dirname(at), { recursive: true });
-    for (;;) {
-        checkCancellation();
-        try {
-            writeFileSync(at, `${process.pid} ${what.replace(/\s+/g, '_')} ${new Date().toISOString()} ${token}\n`, { flag: 'wx' });
-            break;
-        }
-        catch (error) {
-            const code = error.code;
-            if (code === 'ENOENT')
-                mkdirSync(dirname(at), { recursive: true });
-            else if (code !== 'EEXIST')
-                throw error;
-        }
-        const holder = holderOf(at);
-        // Removing a dead owner's lock here would race with another process's recovery. Recovery is a separate host act.
-        if (holder !== undefined && !alive(holder.pid)) {
-            throw new Error(`${actName()}: REFUSE·stale ${named(at)} belongs to exited process ${holder.pid}; host recovery required`);
-        }
-        overAMinute(at, began, holder);
-        if (!told && holder !== undefined) {
-            report(`WAIT     ${named(at)} is held by ${holder.pid} · ${holder.what} since ${holder.since}\n`);
-            told = true;
-        }
-        await pauseFor(250);
-    }
-    if (told)
-        report(`HELD     ${named(at)} after ${Date.now() - began} ms waiting\n`);
-    held.set(at, token);
-    frame.locks.set(at, token);
-    if (!process.listeners('exit').includes(releaseAll))
-        process.once('exit', releaseAll);
-}
-function release(at, token) {
-    if (held.get(at) !== token)
-        return;
-    held.delete(at);
-    const holder = holderOf(at);
-    if (holder?.pid === process.pid && holder.token === token && existsSync(at))
-        rmSync(at, { force: true });
-}
-function releaseAll() {
-    for (const [at, token] of [...held])
-        release(at, token);
-}
-/** Only the CLI installs process termination behavior. Importing a host does not. */
-export function installActSignalHandler() {
-    process.once('SIGTERM', () => { report(`${actName()}: REFUSE·crash signal\n`); releaseAll(); process.exit(1); });
-}
-async function framed(takes, act) {
-    const frame = { parent: context.getStore(), locks: new Map() };
-    return context.run(frame, async () => {
-        try {
-            checkCancellation();
-            await takes();
-            checkCancellation();
-            return await act();
-        }
-        finally {
-            for (const [at, token] of [...frame.locks].reverse())
-                release(at, token);
-            frame.locks.clear();
-        }
-    });
-}
-function guardedRegions(store, regions, what, act, rootAuthority) {
-    return framed(async () => {
-        const tree = treeAt(store);
-        const asked = [...new Set((regions.length ? regions : ['']).map((one) => one.replace(/\/+$/, '')))];
-        if (rootAuthority && (asked.includes('') || (ownsRegion(store) && !owns(tree) && !ownsAuthority(store))))
-            throw new Error(`${actName()}: REFUSE·lock authority dependencies and child regions must be declared together`);
-        if (owns(tree) || asked.every((region) => owns(regionAt(store, region)))) {
-            for (const region of asked)
-                await hold(regionAt(store, region), what);
-            return;
-        }
-        if (ownsRegion(store))
-            throw new Error(`${actName()}: REFUSE·lock declare every region before entering an act`);
-        const already = owns(tree);
-        // The tree lock is the acquisition gate. A whole-tree act cannot enter between checking it and taking regions.
-        await hold(tree, what);
-        try {
-            const locks = join(store, 'locks');
-            for (;;) {
-                const conflict = lockFiles(locks).find((file) => !owns(join(locks, file))
-                    && (file.startsWith('@authority-') || file === '@projection' ? asked.includes('')
-                        : asked.some((region) => overlaps(region, file) || overlaps(region, coordinateOf(file)))));
-                if (conflict === undefined)
-                    break;
-                const at = join(locks, conflict);
-                const began = Date.now();
-                let told = false;
-                for (let holder = holderOf(at); holder !== undefined; holder = holderOf(at)) {
-                    checkCancellation();
-                    if (!alive(holder.pid))
-                        throw new Error(`${actName()}: REFUSE·stale ${named(at)} belongs to exited process ${holder.pid}; host recovery required`);
-                    overAMinute(at, began, holder);
-                    if (!told) {
-                        report(`WAIT     ${named(at)} is held by ${holder.pid} · ${holder.what} since ${holder.since}\n`);
-                        told = true;
-                    }
-                    await pauseFor(250);
-                }
-                if (told)
-                    report(`HELD     ${named(at)} after ${Date.now() - began} ms waiting\n`);
-            }
-            // Registered under the same acquisition gate as every legacy writer.
-            // Root writes overlap all locks; siblings keep distinct region locks.
-            // '@' is encoded for real region coordinates, so this is host bookkeeping.
-            if (rootAuthority)
-                await hold(join(store, 'locks', `@authority-${randomUUID()}`), what);
-            for (const region of asked.filter(Boolean).sort())
-                await hold(regionAt(store, region), what);
-            if (asked.includes(''))
-                await hold(regionAt(store, ''), what);
-        }
-        finally {
-            if (!already) {
-                const frame = context.getStore();
-                const token = frame.locks.get(tree);
-                if (token !== undefined) {
-                    release(tree, token);
-                    frame.locks.delete(tree);
-                }
-            }
-        }
-    }, act);
-}
-export function underTheRegions(store, regions, what, act) {
-    store = canonicalActStore(store);
-    return guardedRegions(store, regions, what, act, false);
-}
-/** Protect the root authority/policy read through child publication. This is
- * exclusion only: callers must authenticate contexts and compare prepared heads
- * while held. It creates no grant, clock advance, lease or automatic recovery. */
-export function underAuthorityRegions(store, regions, what, act) {
-    store = canonicalActStore(store);
-    return guardedRegions(store, regions, what, act, true);
-}
-/** Protect an authority snapshot without taking a child region. The acquisition
- * gate and temporary root marker exclude a root mutation while registering the
- * shared read; existing child acts continue independently. This is exclusion,
- * never authorization or a clock advance. */
-export function underRootAuthority(store, what, act) {
-    store = canonicalActStore(store);
-    return framed(async () => {
-        const tree = treeAt(store), root = regionAt(store, '');
-        if (owns(tree) || owns(root) || ownsAuthority(store))
-            return;
-        if (ownsRegion(store))
-            throw new Error(`${actName()}: REFUSE·lock authority dependencies must be declared before entering a region act`);
-        await hold(tree, what);
-        try {
-            await hold(root, what);
-            await hold(join(store, 'locks', `@authority-${randomUUID()}`), what);
-        }
-        finally {
-            const frame = context.getStore();
-            for (const at of [root, tree]) {
-                const token = frame.locks.get(at);
-                if (token !== undefined) {
-                    release(at, token);
-                    frame.locks.delete(at);
-                }
-            }
-        }
-    }, act);
-}
-/** The fixed host may hand its child evidence of an actual held exclusion.
- * It is an operational envelope, not a grant, signer or receipt identity. */
-export function rootAuthorityProtection(store) {
-    store = canonicalActStore(store);
-    const locks = [treeAt(store), regionAt(store, ''), ...held.keys()].filter(at => at === treeAt(store) || at === regionAt(store, '') || dirname(at) === join(store, 'locks') && basename(at).startsWith('@authority-'));
-    const lock = locks.find(owns);
-    if (lock === undefined)
-        throw Error(`${actName()}: REFUSE·lock root authority is not protected`);
-    const holder = holderOf(lock);
-    if (holder?.pid !== process.pid || holder.token !== held.get(lock))
-        throw Error(`${actName()}: REFUSE·lock authority protection changed`);
-    return Object.freeze({ store, lock, pid: holder.pid, token: holder.token });
-}
-/** expectedStore and expectedParent come from the fixed host's inheritance
- * channel, never from world data. Matching a live lock proves exclusion only;
- * signature, coverage and current context still require verification. */
-export function assertRootAuthorityProtection(proof, expectedStore, expectedParent) {
-    expectedStore = canonicalActStore(expectedStore);
-    if (!proof || proof.store !== expectedStore || !Number.isSafeInteger(expectedParent) || expectedParent <= 0 || proof.pid !== expectedParent
-        || typeof proof.lock !== 'string' || typeof proof.token !== 'string' || !proof.token
-        || !(proof.lock === treeAt(expectedStore) || proof.lock === regionAt(expectedStore, '')
-            || dirname(proof.lock) === join(expectedStore, 'locks') && basename(proof.lock).startsWith('@authority-'))) {
-        throw Error(`${actName()}: REFUSE·lock invalid inherited authority protection`);
-    }
-    const holder = holderOf(proof.lock);
-    if (!alive(expectedParent) || holder?.pid !== proof.pid || holder.token !== proof.token)
-        throw Error(`${actName()}: REFUSE·lock inherited authority protection ended`);
-}
-/** A child can publish independently, but the joined root projection and its
- * derived ledger appends have one writer. Authority protection already excludes
- * root mutations, so this lock needs no acquisition-gate upgrade. */
-export function underRootProjection(store, what, act) {
-    store = canonicalActStore(store);
-    return framed(async () => {
-        if (owns(treeAt(store)) || owns(regionAt(store, '')))
-            return;
-        if (!ownsAuthority(store))
-            throw new Error(`${actName()}: REFUSE·lock root projection requires authority protection`);
-        await hold(projectionAt(store), what);
-    }, act);
-}
-export const holdRoot = async (store, what) => {
-    store = canonicalActStore(store);
-    if (!owns(treeAt(store)))
-        await hold(regionAt(store, ''), what);
-};
-export function underTheLock(store, what, act) {
-    store = canonicalActStore(store);
-    return framed(async () => {
-        if (!owns(treeAt(store)) && ownsRegion(store))
-            throw new Error(`${actName()}: REFUSE·lock a region act cannot upgrade to the tree; declare the tree before entering`);
-        await hold(treeAt(store), what);
-        const locks = join(store, 'locks');
-        const active = lockFiles(locks);
-        for (const file of [...active].sort())
-            await hold(join(locks, file), what);
-        for (const region of [...placesIn(dirname(store))].sort())
-            await hold(regionAt(store, region), what);
-        await hold(regionAt(store, ''), what);
-    }, act);
-}
-export const holds = (store, region) => { store = canonicalActStore(store); return [treeAt(store), regionAt(store, region)].some(owns); };
+var J=Object.defineProperty;var r=(e,t)=>J(e,"name",{value:t,configurable:!0});import{AsyncLocalStorage as q}from"node:async_hooks";import{randomUUID as D}from"node:crypto";import{basename as w,dirname as $,existsSync as L,join as a,mkdirSync as _,rmSync as K,writeFileSync as Q,realpathSync as V,resolve as Y}from"../host/io.js";import{BoundRefusal as Z}from"../host/refusals.js";import{selfName as ee}from"../fold/claims.js";import{placesIn as te}from"../fold/places.js";import{coordinatesUnder as ne,observeText as oe}from"../observe/files.js";const v=new q,pe=r((e,t)=>v.run(e,t),"withActHost"),d=r(()=>v.getStore()?.name??ee(),"actName"),b=r(e=>{const t=v.getStore();t?t.report(e):process.stderr.write(e)},"report"),we=r(()=>v.getStore()?.signal,"currentActSignal"),A=r(()=>{if(v.getStore()?.signal?.aborted)throw new Z("host/cancelled","REFUSE\xB7host/cancelled")},"checkCancellation");function E(e){let t=Y(e);const n=[];for(;!L(t);){const o=$(t);if(o===t)break;n.unshift(w(t)),t=o}return a(V(t),...n)}r(E,"canonicalActStore");const F=new q,g=new Map,B=r(e=>new Promise(t=>{setTimeout(t,e)}),"pauseFor"),j="_root",re=6e4,S=r(e=>{const t=oe(e);if(t===void 0)return;const[n,o,i,c]=t.trim().split(" ");return{pid:Number(n),what:o??"",since:i??"",token:c??""}},"holderOf");function z(e,t,n){if(Date.now()-t<re)return;const o=n===void 0?"a process":`${n.pid} \xB7 ${n.what} since ${n.since}`;throw b(`RED      wait \xB7 ${R(e)} is held by ${o} \xB7 a wait over a minute is a red, not a pause
+`),new Error(`${d()}: REFUSE\xB7stale nothing landed \xB7 a wait over a minute is a red, not a pause`)}r(z,"overAMinute");const N=r(e=>{if(!Number.isSafeInteger(e)||e<=0)return!0;try{return process.kill(e,0),!0}catch(t){return t.code!=="ESRCH"}},"alive"),k=r((e,t)=>{const n=t.replace(/\/+$/,"");if(n&&n.split("/").some(o=>o===".."||o==="."||o==="")||n.startsWith("/"))throw new Error(`${d()}: REFUSE\xB7lock invalid region coordinate`);return a(e,"locks",n?encodeURIComponent(n).replace(/^\./,"%2E").replace(/^_root$/,"%5Froot"):j)},"regionAt"),ie=r(e=>{if(e===j)return"";try{return decodeURIComponent(e)}catch{return e}},"coordinateOf"),G=r(e=>ne(e,e).filter(t=>{if(t!==".act")return!0;const n=S(a(e,t));return n!==void 0&&Number.isSafeInteger(n.pid)&&n.pid>0}),"lockFiles"),P=r((e,t)=>!e||!t||e===t||e.startsWith(`${t}/`)||t.startsWith(`${e}/`),"overlaps"),p=r(e=>a(e,"lock"),"treeAt"),R=r(e=>w(e)==="lock"?"the store":w(e).startsWith("@authority-")?"root authority":w(e)==="@projection"?"root projection":`region ${w(e)===j?".":w(e)}`,"named"),l=r(e=>{for(let t=F.getStore();t!==void 0;t=t.parent){const n=t.locks.get(e);if(n!==void 0&&g.get(e)===n)return!0}return!1},"owns"),x=r(e=>[...g.keys()].some(t=>t.startsWith(`${a(e,"locks")}/`)&&l(t)),"ownsRegion"),O=r(e=>[...g.keys()].some(t=>$(t)===a(e,"locks")&&w(t).startsWith("@authority-")&&l(t)),"ownsAuthority"),ce=r(e=>a(e,"locks","@projection"),"projectionAt");async function h(e,t){if(l(e))return;const n=F.getStore();if(n===void 0)throw new Error(`${d()}: REFUSE\xB7lock no act owns this request`);const o=Date.now(),i=D();let c=!1;for(_($(e),{recursive:!0});;){A();try{Q(e,`${process.pid} ${t.replace(/\s+/g,"_")} ${new Date().toISOString()} ${i}
+`,{flag:"wx"});break}catch(y){const u=y.code;if(u==="ENOENT")_($(e),{recursive:!0});else if(u!=="EEXIST")throw y}const s=S(e);if(s!==void 0&&!N(s.pid))throw new Error(`${d()}: REFUSE\xB7stale ${R(e)} belongs to exited process ${s.pid}; host recovery required`);z(e,o,s),!c&&s!==void 0&&(b(`WAIT     ${R(e)} is held by ${s.pid} \xB7 ${s.what} since ${s.since}
+`),c=!0),await B(250)}c&&b(`HELD     ${R(e)} after ${Date.now()-o} ms waiting
+`),g.set(e,i),n.locks.set(e,i),process.listeners("exit").includes(C)||process.once("exit",C)}r(h,"hold");function I(e,t){if(g.get(e)!==t)return;g.delete(e);const n=S(e);n?.pid===process.pid&&n.token===t&&L(e)&&K(e,{force:!0})}r(I,"release");function C(){for(const[e,t]of[...g])I(e,t)}r(C,"releaseAll");function Ee(){process.once("SIGTERM",()=>{b(`${d()}: REFUSE\xB7crash signal
+`),C(),process.exit(1)})}r(Ee,"installActSignalHandler");async function T(e,t){const n={parent:F.getStore(),locks:new Map};return F.run(n,async()=>{try{return A(),await e(),A(),await t()}finally{for(const[o,i]of[...n.locks].reverse())I(o,i);n.locks.clear()}})}r(T,"framed");function X(e,t,n,o,i){return T(async()=>{const c=p(e),s=[...new Set((t.length?t:[""]).map(u=>u.replace(/\/+$/,"")))];if(i&&(s.includes("")||x(e)&&!l(c)&&!O(e)))throw new Error(`${d()}: REFUSE\xB7lock authority dependencies and child regions must be declared together`);if(l(c)||s.every(u=>l(k(e,u)))){for(const u of s)await h(k(e,u),n);return}if(x(e))throw new Error(`${d()}: REFUSE\xB7lock declare every region before entering an act`);const y=l(c);await h(c,n);try{const u=a(e,"locks");for(;;){const m=G(u).find(f=>!l(a(u,f))&&(f.startsWith("@authority-")||f==="@projection"?s.includes(""):s.some(M=>P(M,f)||P(M,ie(f)))));if(m===void 0)break;const U=a(u,m),H=Date.now();let W=!1;for(let f=S(U);f!==void 0;f=S(U)){if(A(),!N(f.pid))throw new Error(`${d()}: REFUSE\xB7stale ${R(U)} belongs to exited process ${f.pid}; host recovery required`);z(U,H,f),W||(b(`WAIT     ${R(U)} is held by ${f.pid} \xB7 ${f.what} since ${f.since}
+`),W=!0),await B(250)}W&&b(`HELD     ${R(U)} after ${Date.now()-H} ms waiting
+`)}i&&await h(a(e,"locks",`@authority-${D()}`),n);for(const m of s.filter(Boolean).sort())await h(k(e,m),n);s.includes("")&&await h(k(e,""),n)}finally{if(!y){const u=F.getStore(),m=u.locks.get(c);m!==void 0&&(I(c,m),u.locks.delete(c))}}},o)}r(X,"guardedRegions");function ge(e,t,n,o){return e=E(e),X(e,t,n,o,!1)}r(ge,"underTheRegions");function ye(e,t,n,o){return e=E(e),X(e,t,n,o,!0)}r(ye,"underAuthorityRegions");function me(e,t,n){return e=E(e),T(async()=>{const o=p(e),i=k(e,"");if(!(l(o)||l(i)||O(e))){if(x(e))throw new Error(`${d()}: REFUSE\xB7lock authority dependencies must be declared before entering a region act`);await h(o,t);try{await h(i,t),await h(a(e,"locks",`@authority-${D()}`),t)}finally{const c=F.getStore();for(const s of[i,o]){const y=c.locks.get(s);y!==void 0&&(I(s,y),c.locks.delete(s))}}}},n)}r(me,"underRootAuthority");function $e(e){e=E(e);const n=[p(e),k(e,""),...g.keys()].filter(i=>i===p(e)||i===k(e,"")||$(i)===a(e,"locks")&&w(i).startsWith("@authority-")).find(l);if(n===void 0)throw Error(`${d()}: REFUSE\xB7lock root authority is not protected`);const o=S(n);if(o?.pid!==process.pid||o.token!==g.get(n))throw Error(`${d()}: REFUSE\xB7lock authority protection changed`);return Object.freeze({store:e,lock:n,pid:o.pid,token:o.token})}r($e,"rootAuthorityProtection");function Se(e,t,n){if(t=E(t),!e||e.store!==t||!Number.isSafeInteger(n)||n<=0||e.pid!==n||typeof e.lock!="string"||typeof e.token!="string"||!e.token||!(e.lock===p(t)||e.lock===k(t,"")||$(e.lock)===a(t,"locks")&&w(e.lock).startsWith("@authority-")))throw Error(`${d()}: REFUSE\xB7lock invalid inherited authority protection`);const o=S(e.lock);if(!N(n)||o?.pid!==e.pid||o.token!==e.token)throw Error(`${d()}: REFUSE\xB7lock inherited authority protection ended`)}r(Se,"assertRootAuthorityProtection");function Re(e,t,n){return e=E(e),T(async()=>{if(!(l(p(e))||l(k(e,"")))){if(!O(e))throw new Error(`${d()}: REFUSE\xB7lock root projection requires authority protection`);await h(ce(e),t)}},n)}r(Re,"underRootProjection");const Ue=r(async(e,t)=>{e=E(e),l(p(e))||await h(k(e,""),t)},"holdRoot");function be(e,t,n){return e=E(e),T(async()=>{if(!l(p(e))&&x(e))throw new Error(`${d()}: REFUSE\xB7lock a region act cannot upgrade to the tree; declare the tree before entering`);await h(p(e),t);const o=a(e,"locks"),i=G(o);for(const c of[...i].sort())await h(a(o,c),t);for(const c of[...te($(e))].sort())await h(k(e,c),t);await h(k(e,""),t)},n)}r(be,"underTheLock");const Fe=r((e,t)=>(e=E(e),[p(e),k(e,t)].some(l)),"holds");export{Se as assertRootAuthorityProtection,E as canonicalActStore,we as currentActSignal,Ue as holdRoot,Fe as holds,Ee as installActSignalHandler,$e as rootAuthorityProtection,ye as underAuthorityRegions,me as underRootAuthority,Re as underRootProjection,be as underTheLock,ge as underTheRegions,pe as withActHost};

package/dist/land/alias.js

@@ -1,41 +1 @@
-import { ENVELOPE } from '@lapxo/topos/wire';
-import { fieldOf, fieldsOf } from "../fold/claims.js";
-import { lockStanding } from "../fold/keys.js";
-import { worldsIn } from "../fold/places.js";
-import { ownLockOf } from "../fold/signed.js";
-import { storeOf } from "./ledger.js";
-const retracts = (withdraw, line) => Object.keys(withdraw).filter((key) => !ENVELOPE.has(key) && key !== 'value').every((key) => line[key] === withdraw[key]);
-const pinScope = (scope) => scope === 'uses' || scope.startsWith('uses/') || scope.split('/').slice(1, -1).includes('uses');
-const aliasWithdraw = (line) => fieldOf(line, 'value') === 'withdraw' && fieldOf(line, 'scope').startsWith('dep/') && fieldOf(line, 'role') !== 'reads';
-/**
- * An alias is gone only when no pin will still name its digest. The pins are the root's uses lines and each world's own,
- * minus the pins this batch itself withdraws, plus the pins it adds. Checked before the trial, so a batch that would
- * orphan a pin lands nothing.
- */
-export function aliasPinned(root, signed) {
-    const aliases = lockStanding(storeOf(root)).filter((line) => fieldOf(line, 'scope').startsWith('dep/') && fieldOf(line, 'role') !== 'reads' && fieldOf(line, 'value') !== 'withdraw');
-    const digests = new Map();
-    for (const withdraw of signed.filter(aliasWithdraw)) {
-        const fields = fieldsOf(withdraw);
-        for (const line of aliases) {
-            if (!retracts(fields, fieldsOf(line)))
-                continue;
-            const digest = fieldOf(line, 'value');
-            const kept = signed.some((one) => fieldOf(one, 'scope') === fieldOf(line, 'scope') && fieldOf(one, 'value') === digest);
-            if (!kept)
-                digests.set(`${fieldOf(line, 'scope')}\0${digest}`, { scope: fieldOf(line, 'scope'), digest });
-        }
-    }
-    if (!digests.size)
-        return [];
-    const named = [
-        ...lockStanding(storeOf(root)).filter((line) => pinScope(fieldOf(line, 'scope')) && fieldOf(line, 'value') !== 'withdraw').map((line) => ({ scope: fieldOf(line, 'scope'), value: fieldOf(line, 'value'), fields: fieldsOf(line) })),
-        ...worldsIn(root).flatMap((place) => ownLockOf(root, place).filter((line) => pinScope(fieldOf(line, 'scope')) && fieldOf(line, 'value') !== 'withdraw').map((line) => ({ scope: `${place}/${fieldOf(line, 'scope')}`, value: fieldOf(line, 'value'), fields: fieldsOf(line) }))),
-    ];
-    const still = named.filter((pin) => !signed.some((line) => fieldOf(line, 'value') === 'withdraw' && retracts(fieldsOf(line), pin.fields)));
-    const added = signed.filter((line) => pinScope(fieldOf(line, 'scope')) && fieldOf(line, 'value') !== 'withdraw').map((line) => ({ scope: fieldOf(line, 'scope'), value: fieldOf(line, 'value') }));
-    return [...digests.values()].flatMap((alias) => {
-        const by = [...still.filter((pin) => pin.value === alias.digest).map((pin) => pin.scope), ...added.filter((pin) => pin.value === alias.digest).map((pin) => pin.scope)];
-        return by.length ? [{ scope: alias.scope, digest: alias.digest, by }] : [];
-    });
-}
+var O=Object.defineProperty;var p=(t,a)=>O(t,"name",{value:a,configurable:!0});import{library14_ENVELOPE as E}from"../vendor/runtime.js";import{fieldOf as s,fieldsOf as i}from"../fold/claims.js";import{lockStanding as m}from"../fold/keys.js";import{worldsIn as g}from"../fold/places.js";import{ownLockOf as W}from"../fold/signed.js";import{storeOf as v}from"./ledger.js";const n=p((t,a)=>Object.keys(t).filter(c=>!E.has(c)&&c!=="value").every(c=>a[c]===t[c]),"retracts"),d=p(t=>t==="uses"||t.startsWith("uses/")||t.split("/").slice(1,-1).includes("uses"),"pinScope"),$=p(t=>s(t,"value")==="withdraw"&&s(t,"scope").startsWith("dep/")&&s(t,"role")!=="reads","aliasWithdraw");function j(t,a){const c=m(v(t)).filter(e=>s(e,"scope").startsWith("dep/")&&s(e,"role")!=="reads"&&s(e,"value")!=="withdraw"),f=new Map;for(const e of a.filter($)){const o=i(e);for(const r of c){if(!n(o,i(r)))continue;const l=s(r,"value");a.some(u=>s(u,"scope")===s(r,"scope")&&s(u,"value")===l)||f.set(`${s(r,"scope")}\0${l}`,{scope:s(r,"scope"),digest:l})}}if(!f.size)return[];const w=[...m(v(t)).filter(e=>d(s(e,"scope"))&&s(e,"value")!=="withdraw").map(e=>({scope:s(e,"scope"),value:s(e,"value"),fields:i(e)})),...g(t).flatMap(e=>W(t,e).filter(o=>d(s(o,"scope"))&&s(o,"value")!=="withdraw").map(o=>({scope:`${e}/${s(o,"scope")}`,value:s(o,"value"),fields:i(o)})))].filter(e=>!a.some(o=>s(o,"value")==="withdraw"&&n(i(o),e.fields))),h=a.filter(e=>d(s(e,"scope"))&&s(e,"value")!=="withdraw").map(e=>({scope:s(e,"scope"),value:s(e,"value")}));return[...f.values()].flatMap(e=>{const o=[...w.filter(r=>r.value===e.digest).map(r=>r.scope),...h.filter(r=>r.value===e.digest).map(r=>r.scope)];return o.length?[{scope:e.scope,digest:e.digest,by:o}]:[]})}p(j,"aliasPinned");export{j as aliasPinned};

package/dist/land/held.js

@@ -1,23 +1 @@
-import { fieldOf } from "../fold/claims.js";
-import { spanOf } from '@lapxo/topos/forms';
-import { blobAt, ledgerLines, storeAt } from "./ledger.js";
-const STORE = 'store';
-const pathOf = (store, scope) => {
-    const name = scope.split('/').pop() ?? '';
-    if (scope.startsWith('cas/blobs/'))
-        return blobAt(store, name);
-    if (scope.startsWith('cas/laid/'))
-        return storeAt(store, 'cas', 'laid', name);
-    if (scope.startsWith('cas/answers/'))
-        return storeAt(store, 'cas', 'answers', name);
-    return storeAt(store, ...scope.split('/'));
-};
-const sizeOf = (line) => spanOf(fieldOf(line, 'value'))?.hi ?? 0;
-function inventory(store) {
-    return ledgerLines(store, STORE).filter((line) => fieldOf(line, 'value') !== 'withdraw').map((line) => {
-        const scope = fieldOf(line, 'scope');
-        return { scope, bytes: sizeOf(line), at: pathOf(store, scope) };
-    });
-}
-/** Bytes the store receipts name: a byte lives only while a standing line names it, and the receipts list what is there. */
-export const heldBytes = (_root, store, _standing) => inventory(store).reduce((sum, one) => sum + one.bytes, 0);
+var f=Object.defineProperty;var a=(r,t)=>f(r,"name",{value:t,configurable:!0});import{fieldOf as n}from"../fold/claims.js";import{library7_spanOf as l}from"../vendor/runtime.js";import{blobAt as c,ledgerLines as p,storeAt as i}from"./ledger.js";const u="store",d=a((r,t)=>{const s=t.split("/").pop()??"";return t.startsWith("cas/blobs/")?c(r,s):t.startsWith("cas/laid/")?i(r,"cas","laid",s):t.startsWith("cas/answers/")?i(r,"cas","answers",s):i(r,...t.split("/"))},"pathOf"),m=a(r=>l(n(r,"value"))?.hi??0,"sizeOf");function b(r){return p(r,u).filter(t=>n(t,"value")!=="withdraw").map(t=>{const s=n(t,"scope");return{scope:s,bytes:m(t),at:d(r,s)}})}a(b,"inventory");const v=a((r,t,s)=>b(t).reduce((e,o)=>e+o.bytes,0),"heldBytes");export{v as heldBytes};

package/dist/land/inert.js

@@ -1,33 +1 @@
-import { foldCeilings } from "../fold/ceilings.js";
-import { fieldOf } from "../fold/claims.js";
-import { isCeiling } from "../fold/configures.js";
-import { placedReadings } from "../fold/observed.js";
-import { boundOf, rankOf, regionsOf } from "../fold/region.js";
-/**
- * The ceilings of a batch that would stand unread: no reading meets them and no reading of the instrument's own
- * carries their measure. A batch that also signs a reader goes through whole, since what a reader reads is known only
- * once it runs, and so does a ceiling a gate of the same act reads, whose reading lands with it or refuses it.
- */
-export function inertIn(batch, input) {
-    if (input.signsReader)
-        return [];
-    const folded = foldCeilings({ standing: input.standing, ceilings: batch.filter(input.ceiling), observed: input.observed, own: input.own, epoch: input.epoch });
-    return [...folded.unread, ...folded.vacuous];
-}
-/** What each ceiling of a batch would bite, read off the summaries of the cone before anything lands. */
-export function rankedIn(batch, fold) {
-    const regions = regionsOf(fold.standing, [...fold.standing.filter(isCeiling), ...batch], placedReadings(fold.observed));
-    return batch.map((line) => {
-        const bound = boundOf(regions.named, line);
-        const got = rankOf(regions, bound, fold.own);
-        const bite = got.cells ? `bites ${got.cells} cells in ${got.bars} bars, ${got.fresh} no ceiling above bites` : got.sums ? `bites ${got.sums} sums` : `bites nothing of ${got.met} met`;
-        return `RANK     ${fieldOf(line, 'scope')} · ${bite} · region ${bound.region || '.'}`;
-    });
-}
-/** Every ceiling asked, at resolution one: what the fold reads for it, beside its bound, or unmeasured where no reading answers it. */
-export function readingsIn(ceilings, fold) {
-    const got = foldCeilings({ standing: fold.standing, ceilings, observed: fold.observed, own: fold.own, epoch: fold.epoch });
-    const outside = new Map(got.over.map((one) => [one.ceiling, `${one.side} ${one.got}`]));
-    return ceilings.map((line) => ((scope, read) => `RANK@1   ${scope} · ${fieldOf(line, 'measure')} ${fieldOf(line, 'value')} · ${read === undefined ? 'unmeasured'
-        : `read ${read.length > 3 ? `${read.slice(0, 3).join(' · ')} +${read.length - 3}` : read.join(' · ')}`}${outside.has(scope) ? ` · ${outside.get(scope)}` : read === undefined ? '' : ' · met'}`)(fieldOf(line, 'scope'), got.readings.get(fieldOf(line, 'scope'))));
-}
+var d=Object.defineProperty;var c=(o,e)=>d(o,"name",{value:e,configurable:!0});import{foldCeilings as a}from"../fold/ceilings.js";import{fieldOf as g}from"../fold/claims.js";import{isCeiling as m}from"../fold/configures.js";import{placedReadings as $}from"../fold/observed.js";import{boundOf as u,rankOf as f,regionsOf as b}from"../fold/region.js";function R(o,e){if(e.signsReader)return[];const i=a({standing:e.standing,ceilings:o.filter(e.ceiling),observed:e.observed,own:e.own,epoch:e.epoch});return[...i.unread,...i.vacuous]}c(R,"inertIn");function x(o,e){const i=b(e.standing,[...e.standing.filter(m),...o],$(e.observed));return o.map(t=>{const n=u(i.named,t),s=f(i,n,e.own),r=s.cells?`bites ${s.cells} cells in ${s.bars} bars, ${s.fresh} no ceiling above bites`:s.sums?`bites ${s.sums} sums`:`bites nothing of ${s.met} met`;return`RANK     ${g(t,"scope")} \xB7 ${r} \xB7 region ${n.region||"."}`})}c(x,"rankedIn");function I(o,e){const i=a({standing:e.standing,ceilings:o,observed:e.observed,own:e.own,epoch:e.epoch}),t=new Map(i.over.map(n=>[n.ceiling,`${n.side} ${n.got}`]));return o.map(n=>((s,r)=>`RANK@1   ${s} \xB7 ${g(n,"measure")} ${g(n,"value")} \xB7 ${r===void 0?"unmeasured":`read ${r.length>3?`${r.slice(0,3).join(" \xB7 ")} +${r.length-3}`:r.join(" \xB7 ")}`}${t.has(s)?` \xB7 ${t.get(s)}`:r===void 0?"":" \xB7 met"}`)(g(n,"scope"),i.readings.get(g(n,"scope"))))}c(I,"readingsIn");export{R as inertIn,x as rankedIn,I as readingsIn};

package/dist/land/leaving.js

@@ -1,55 +1 @@
-import { readOnly } from "../host/read-only.js";
-import { meets } from "../fold/closed.js";
-import { fieldOf } from "../fold/claims.js";
-import { sourced } from "./vouched.js";
-import { observedClaims } from "../fold/observed.js";
-/**
- * A file goes from the tree through a line, never through a hand: its path withdrawn in the family the lock sources files
- * by is the only way a file goes, and the fold refuses it while a block still reads the file — what a run depends on is judged by the run's
- * own memo, which names every file each block read, and not by a search for the file's name in a test. A search misses
- * a name built in a loop; the memo does not. A test file goes with its own blocks, and is refused while one of them
- * is the only run of a vector or a sample, which it names.
- */
-export function coordinatesWithdrawn(root, store, signed, standing) {
-    const family = sourced(standing);
-    const asked = signed.filter((line) => fieldOf(line, 'scope').startsWith(`${family}/`) && fieldOf(line, 'value') === 'withdraw')
-        .map((line) => fieldOf(line, 'scope').slice(family.length + 1));
-    if (!asked.length)
-        return { taken: [], refused: [] };
-    if (readOnly() && !meets(root, store, ''))
-        throw Error('REFUSE·withdraw current native receipts are required to judge file removal; fold the declared inputs first');
-    /** A run rewrites every block of a test file under one observation, so a block whose title moved still holds a row
-     * from an older one: what reads a file now is what the latest run of each test file wrote, and nothing older. */
-    const memo = observedClaims(root, store, { wait: false }).filter((line) => fieldOf(line, 'measure') === 'memo');
-    const fileOf = (scope) => scope.split('/').slice(0, 2).join('/');
-    const last = new Map();
-    for (const line of memo)
-        last.set(fileOf(fieldOf(line, 'scope')), fieldOf(line, 'at'));
-    const latest = new Map();
-    for (const line of memo) {
-        const scope = fieldOf(line, 'scope');
-        if (fieldOf(line, 'at') === last.get(fileOf(scope)))
-            latest.set(scope, fieldOf(line, 'value'));
-    }
-    const refused = [];
-    const taken = [];
-    const ownOf = (inside) => (/^test\/[^/]+\.test\.ts$/.test(inside) ? `vector-memo/${inside.slice('test/'.length)}/` : undefined);
-    const leaving = asked.map((path) => ownOf(path.slice(path.indexOf('/') + 1))).filter((own) => own !== undefined);
-    const runs = (value) => value.split('|').filter((token) => token.startsWith('read:') && !token.includes('#')).map((token) => token.slice('read:'.length));
-    for (const path of asked) {
-        const inside = path.slice(path.indexOf('/') + 1);
-        const own = ownOf(inside);
-        const reads = (value) => value.split('|').some((token) => token.startsWith(`in:${inside}:`) && /^[0-9a-f]{12}$/.test(token.slice(`in:${inside}:`.length)));
-        const by = [...latest].find(([scope, value]) => (own === undefined || !scope.startsWith(own)) && reads(value))?.[0];
-        const elsewhere = new Set([...latest].filter(([scope]) => !leaving.some((one) => scope.startsWith(one))).flatMap(([, value]) => runs(value)));
-        const only = own === undefined ? undefined : [...latest].filter(([scope]) => scope.startsWith(own))
-            .flatMap(([scope, value]) => runs(value).filter((name) => !elsewhere.has(name)).map((name) => `${scope}, the only run of ${name}`))[0];
-        if (by !== undefined)
-            refused.push({ path, by });
-        else if (only !== undefined)
-            refused.push({ path, by: only });
-        else
-            taken.push(path);
-    }
-    return { taken, refused };
-}
+var j=Object.defineProperty;var o=(r,f)=>j(r,"name",{value:f,configurable:!0});import{readOnly as S}from"../host/read-only.js";import{meets as k}from"../fold/closed.js";import{fieldOf as n}from"../fold/claims.js";import{sourced as q}from"./vouched.js";import{observedClaims as C}from"../fold/observed.js";function D(r,f,O,M){const p=q(M),c=O.filter(e=>n(e,"scope").startsWith(`${p}/`)&&n(e,"value")==="withdraw").map(e=>n(e,"scope").slice(p.length+1));if(!c.length)return{taken:[],refused:[]};if(S()&&!k(r,f,""))throw Error("REFUSE\xB7withdraw current native receipts are required to judge file removal; fold the declared inputs first");const u=C(r,f,{wait:!1}).filter(e=>n(e,"measure")==="memo"),h=o(e=>e.split("/").slice(0,2).join("/"),"fileOf"),w=new Map;for(const e of u)w.set(h(n(e,"scope")),n(e,"at"));const l=new Map;for(const e of u){const t=n(e,"scope");n(e,"at")===w.get(h(t))&&l.set(t,n(e,"value"))}const d=[],g=[],$=o(e=>/^test\/[^/]+\.test\.ts$/.test(e)?`vector-memo/${e.slice(5)}/`:void 0,"ownOf"),b=c.map(e=>$(e.slice(e.indexOf("/")+1))).filter(e=>e!==void 0),v=o(e=>e.split("|").filter(t=>t.startsWith("read:")&&!t.includes("#")).map(t=>t.slice(5)),"runs");for(const e of c){const t=e.slice(e.indexOf("/")+1),a=$(t),x=o(s=>s.split("|").some(i=>i.startsWith(`in:${t}:`)&&/^[0-9a-f]{12}$/.test(i.slice(`in:${t}:`.length))),"reads"),W=[...l].find(([s,i])=>(a===void 0||!s.startsWith(a))&&x(i))?.[0],E=new Set([...l].filter(([s])=>!b.some(i=>s.startsWith(i))).flatMap(([,s])=>v(s))),y=a===void 0?void 0:[...l].filter(([s])=>s.startsWith(a)).flatMap(([s,i])=>v(i).filter(m=>!E.has(m)).map(m=>`${s}, the only run of ${m}`))[0];W!==void 0?d.push({path:e,by:W}):y!==void 0?d.push({path:e,by:y}):g.push(e)}return{taken:g,refused:d}}o(D,"coordinatesWithdrawn");export{D as coordinatesWithdrawn};