@lapxo/bound 0.2.5 → 0.2.6

package/dist/host/in-process-act.js

@@ -1,3 +1,3 @@
-var _=Object.defineProperty;var o=(i,t)=>_(i,"name",{value:t,configurable:!0});import{library11_authorityAtEpoch as M}from"../vendor/runtime.js";import{library3_placeReceiptBytes as q,library3_readPlaceActContext as F}from"../vendor/runtime.js";import{library2_readingIdentity as E,library2_readingReceiptIdentity as P}from"../vendor/runtime.js";import{readContent as H,invokeFrameSigningPort as J}from"../engine/ports.js";import{transactPlaceAct as O,PlaceActCommitUnknown as U}from"./place-act-transaction.js";import{withActHost as I}from"../land/act.js";import{sha256 as a,isSha256 as z}from"./hash.js";import{BoundRefusal as v}from"./refusals.js";import{refuseHost as r}from"./host-controls.js";import{withHostInstrument as w}from"./call-context.js";import{requireEffects as Z}from"./read-only.js";async function et(i,t){return w(t.instrumentName,()=>I({name:t.instrumentName,report:o(()=>{},"report"),signal:i.signal},async()=>{try{Z("contextual host admission");const{place:e,source:c,identity:s,rootSnapshot:m,algorithm:g,signal:h}=i,N=structuredClone(i.reading),d={...i.contentLimits},y={...i.signingLimits},f={...i.storageLimits};(typeof t.instrumentName!="string"||!t.instrumentName||!/[a-zA-Z0-9]/.test(t.instrumentName)||!/^[a-zA-Z0-9._-]+$/.test(t.instrumentName)||typeof e!="string"||!e||typeof c!="string"||!c||typeof g!="string"||!g)&&r("context"),(f.acts>t.limits.storage.acts||f.bytes>t.limits.storage.bytes||y.timeoutMs>t.limits.signing.timeoutMs||y.maxBytes>t.limits.signing.maxBytes||d.timeoutMs>t.limits.content.timeoutMs||d.maxBytes>t.limits.content.maxBytes)&&r("budget");const S=E({...N,inputs:[...N.inputs,["host/place",a(e)],["host/snapshot",m],["host/act",s],["host/operation",a(JSON.stringify([g,d,y,f]))]]},a),n=t.trust();n.contract.root.snapshot!==m&&r("stale"),d.maxBytes>n.contract.budget.bytes&&r("budget");const L=await H(c,s,{read:t.read,digestBytes:a},d,h);let p;try{p=new TextDecoder("utf-8",{fatal:!0}).decode(L)}catch{return r("snapshot-format")}const b=F(p,n.contract.budget);n.contract.digest(p)!==s&&r("integrity");const A=await O(p,o(async()=>{const u=n.contract.receiptSigner,B=n.contract.signers.find(l=>l.id===u);(!B||M({scope:n.contract.receiptScope,by:u},B,Number(n.contract.root.epoch),n.contract.receiptScope,"authority").kind!=="admitted")&&r("receiver-authority");const R=await J({keyId:u,algorithm:g,bytes:b.places.map(l=>q(s,l,b.root,u,n.contract.receiptScope,n.contract.budget))},t.sign,y,h);return b.places.map((l,C)=>({place:l.place,by:u,signature:R[C].signature}))},"acquire"),n,f,t.persistence,h),k=a(JSON.stringify(A)+`
+var _=Object.defineProperty;var o=(i,t)=>_(i,"name",{value:t,configurable:!0});import{library14_authorityAtEpoch as M}from"../vendor/runtime.js";import{library6_placeReceiptBytes as q,library6_readPlaceActContext as F}from"../vendor/runtime.js";import{library5_readingIdentity as E,library5_readingReceiptIdentity as P}from"../vendor/runtime.js";import{readContent as H,invokeFrameSigningPort as J}from"../engine/ports.js";import{transactPlaceAct as O,PlaceActCommitUnknown as U}from"./place-act-transaction.js";import{withActHost as I}from"../land/act.js";import{sha256 as a,isSha256 as z}from"./hash.js";import{BoundRefusal as v}from"./refusals.js";import{refuseHost as r}from"./host-controls.js";import{withHostInstrument as w}from"./call-context.js";import{requireEffects as Z}from"./read-only.js";async function et(i,t){return w(t.instrumentName,()=>I({name:t.instrumentName,report:o(()=>{},"report"),signal:i.signal},async()=>{try{Z("contextual host admission");const{place:e,source:c,identity:s,rootSnapshot:m,algorithm:g,signal:h}=i,N=structuredClone(i.reading),d={...i.contentLimits},y={...i.signingLimits},f={...i.storageLimits};(typeof t.instrumentName!="string"||!t.instrumentName||!/[a-zA-Z0-9]/.test(t.instrumentName)||!/^[a-zA-Z0-9._-]+$/.test(t.instrumentName)||typeof e!="string"||!e||typeof c!="string"||!c||typeof g!="string"||!g)&&r("context"),(f.acts>t.limits.storage.acts||f.bytes>t.limits.storage.bytes||y.timeoutMs>t.limits.signing.timeoutMs||y.maxBytes>t.limits.signing.maxBytes||d.timeoutMs>t.limits.content.timeoutMs||d.maxBytes>t.limits.content.maxBytes)&&r("budget");const S=E({...N,inputs:[...N.inputs,["host/place",a(e)],["host/snapshot",m],["host/act",s],["host/operation",a(JSON.stringify([g,d,y,f]))]]},a),n=t.trust();n.contract.root.snapshot!==m&&r("stale"),d.maxBytes>n.contract.budget.bytes&&r("budget");const L=await H(c,s,{read:t.read,digestBytes:a},d,h);let p;try{p=new TextDecoder("utf-8",{fatal:!0}).decode(L)}catch{return r("snapshot-format")}const b=F(p,n.contract.budget);n.contract.digest(p)!==s&&r("integrity");const A=await O(p,o(async()=>{const u=n.contract.receiptSigner,B=n.contract.signers.find(l=>l.id===u);(!B||M({scope:n.contract.receiptScope,by:u},B,Number(n.contract.root.epoch),n.contract.receiptScope,"authority").kind!=="admitted")&&r("receiver-authority");const R=await J({keyId:u,algorithm:g,bytes:b.places.map(l=>q(s,l,b.root,u,n.contract.receiptScope,n.contract.budget))},t.sign,y,h);return b.places.map((l,C)=>({place:l.place,by:u,signature:R[C].signature}))},"acquire"),n,f,t.persistence,h),k=a(JSON.stringify(A)+`
 `);return{kind:"fact",value:{place:e,act:A,reading:S,result:k,commitment:P(S,k,a)}}}catch(e){return e instanceof U?{kind:"uncertain",identity:e.identity,code:e.code,diagnostic:e.message}:{kind:"refuse",code:e instanceof v?e.code:"host/failed",diagnostic:e instanceof Error?e.message:"REFUSE\xB7host/failed"}}}))}o(et,"landPlaceActInProcess");function it(i,t){return w(t.instrumentName,()=>I({name:t.instrumentName,report:o(()=>{},"report"),signal:i.signal},()=>{try{i.signal?.aborted&&r("cancelled"),(!i.place||!z(i.identity))&&r("context");const e={...i.storageLimits};(e.acts>t.limits.storage.acts||e.bytes>t.limits.storage.bytes)&&r("budget");const c=E({...structuredClone(i.reading),inputs:[...i.reading.inputs,["host/place",a(i.place)],["host/act",i.identity],["host/operation",a("historical-recovery")]]},a),s=t.persistence.result(i.identity,t.trust(),e);s||r("act-unavailable");const m=a(JSON.stringify(s)+`
 `);return{kind:"fact",value:{place:i.place,identity:i.identity,act:s,historical:!0,reading:c,result:m,commitment:P(c,m,a)}}}catch(e){return{kind:"refuse",code:e instanceof v?e.code:"host/failed",diagnostic:e instanceof Error?e.message:"REFUSE\xB7host/failed"}}}))}o(it,"recoverPlaceActInProcess");export{et as landPlaceActInProcess,it as recoverPlaceActInProcess};

package/dist/host/in-process-context.js

@@ -1,3 +1,3 @@
-var O=Object.defineProperty;var h=(r,a)=>O(r,"name",{value:a,configurable:!0});import{library11_parse as x}from"../vendor/runtime.js";import{library2_readingIdentity as A,library2_readingReceiptIdentity as C}from"../vendor/runtime.js";import{readContent as N}from"../engine/ports.js";import{sha256 as y}from"./hash.js";import{BoundRefusal as P}from"./refusals.js";import{refuseHost as e,isPlaceLockCoordinate as v,placeRegionOf as H}from"./host-controls.js";import{publicStandingProjection as w,assertStandingView as k}from"./standing-projection.js";import{rootClockSelectionOf as J,inspectPortablePlaceContexts as I}from"./root-clock-source.js";import{projectContextualStanding as R}from"./standing-carrier.js";import{authorityFor as j}from"../fold/signers.js";import{ownRecordAdmitted as E}from"../fold/signed.js";import{wordsOf as _}from"../fold/wire.js";import{fieldOf as S,isConfig as B}from"../fold/claims.js";import{signatureEraOf as F}from"./signature-era.js";function L(r,a,o){(!r||Object.keys(r).sort().join(",")!=="contexts,legacyPlaces,rootHistory"||!Array.isArray(r.rootHistory)||!Array.isArray(r.legacyPlaces)||!Array.isArray(r.contexts))&&e("snapshot-format");let i=r.rootHistory.length;i>o&&e("budget");const m=h(t=>typeof t=="string"&&x(t).kind==="fact","validLine");(!r.rootHistory.length||r.rootHistory.some(t=>!m(t)))&&e("snapshot-format");const s=w(r.rootHistory,a),f=_(s,"families");f.length&&!f.includes("view")&&e("vocabulary-unavailable"),k(s);const l=J(s,a),n=F(s).admitted;(r.legacyPlaces.length>l.resources.places||r.contexts.length>l.resources.acts)&&e("budget");const g=j(r.rootHistory,a,n).admitted;g.some(t=>!t.coverage.includes("*"))&&!f.includes("region")&&e("vocabulary-unavailable");const p=new Set;for(const t of r.legacyPlaces){(!t||!v(t.place)||p.has(t.place)||!Array.isArray(t.history))&&e("snapshot-format"),p.add(t.place),i+=t.history.length,i>o&&e("budget");const d=H(t.place);t.history.some(c=>!m(c)||!E(c,d,"region",g,n))&&e("legacy-authority")}for(const t of r.contexts){(!t||!t.authority||!Array.isArray(t.authority.history))&&e("snapshot-format"),i+=t.authority.history.length,i>o&&e("budget");const d=S(t.authority.checkpoint,"epoch"),c=r.rootHistory.filter(b=>!B(b)||Number(S(b,"epoch"))<=Number(d));JSON.stringify(c)!==JSON.stringify(t.authority.history)&&e("historical-snapshot")}const u=I(JSON.stringify(r.contexts),a,l);return R(s,r.legacyPlaces,r.contexts,u)}h(L,"authenticatedCarrier");async function tt(r,a){try{const{place:o,source:i,snapshot:m,signal:s}=r,f=structuredClone(r.anchor),l=structuredClone(r.reading),n={...r.limits};(!o||typeof o!="string"||!i||typeof i!="string"||!Number.isSafeInteger(n.records)||n.records<1)&&e("context");const g=A({...l,inputs:[...l.inputs,["host/place",y(o)],["host/anchor",y(JSON.stringify(f))],["host/snapshot",m]]},y),p=await N(i,m,{read:a.read,digestBytes:y},n,s);let u,t;try{u=new TextDecoder("utf-8",{fatal:!0}).decode(p),t=JSON.parse(u)}catch{return e("snapshot-format")}JSON.stringify(t)+`
+var O=Object.defineProperty;var h=(r,a)=>O(r,"name",{value:a,configurable:!0});import{library14_parse as x}from"../vendor/runtime.js";import{library5_readingIdentity as A,library5_readingReceiptIdentity as C}from"../vendor/runtime.js";import{readContent as N}from"../engine/ports.js";import{sha256 as y}from"./hash.js";import{BoundRefusal as P}from"./refusals.js";import{refuseHost as e,isPlaceLockCoordinate as v,placeRegionOf as H}from"./host-controls.js";import{publicStandingProjection as w,assertStandingView as k}from"./standing-projection.js";import{rootClockSelectionOf as J,inspectPortablePlaceContexts as I}from"./root-clock-source.js";import{projectContextualStanding as R}from"./standing-carrier.js";import{authorityFor as j}from"../fold/signers.js";import{ownRecordAdmitted as E}from"../fold/signed.js";import{wordsOf as _}from"../fold/wire.js";import{fieldOf as S,isConfig as B}from"../fold/claims.js";import{signatureEraOf as F}from"./signature-era.js";function L(r,a,o){(!r||Object.keys(r).sort().join(",")!=="contexts,legacyPlaces,rootHistory"||!Array.isArray(r.rootHistory)||!Array.isArray(r.legacyPlaces)||!Array.isArray(r.contexts))&&e("snapshot-format");let i=r.rootHistory.length;i>o&&e("budget");const m=h(t=>typeof t=="string"&&x(t).kind==="fact","validLine");(!r.rootHistory.length||r.rootHistory.some(t=>!m(t)))&&e("snapshot-format");const s=w(r.rootHistory,a),f=_(s,"families");f.length&&!f.includes("view")&&e("vocabulary-unavailable"),k(s);const l=J(s,a),n=F(s).admitted;(r.legacyPlaces.length>l.resources.places||r.contexts.length>l.resources.acts)&&e("budget");const g=j(r.rootHistory,a,n).admitted;g.some(t=>!t.coverage.includes("*"))&&!f.includes("region")&&e("vocabulary-unavailable");const p=new Set;for(const t of r.legacyPlaces){(!t||!v(t.place)||p.has(t.place)||!Array.isArray(t.history))&&e("snapshot-format"),p.add(t.place),i+=t.history.length,i>o&&e("budget");const d=H(t.place);t.history.some(c=>!m(c)||!E(c,d,"region",g,n))&&e("legacy-authority")}for(const t of r.contexts){(!t||!t.authority||!Array.isArray(t.authority.history))&&e("snapshot-format"),i+=t.authority.history.length,i>o&&e("budget");const d=S(t.authority.checkpoint,"epoch"),c=r.rootHistory.filter(b=>!B(b)||Number(S(b,"epoch"))<=Number(d));JSON.stringify(c)!==JSON.stringify(t.authority.history)&&e("historical-snapshot")}const u=I(JSON.stringify(r.contexts),a,l);return R(s,r.legacyPlaces,r.contexts,u)}h(L,"authenticatedCarrier");async function tt(r,a){try{const{place:o,source:i,snapshot:m,signal:s}=r,f=structuredClone(r.anchor),l=structuredClone(r.reading),n={...r.limits};(!o||typeof o!="string"||!i||typeof i!="string"||!Number.isSafeInteger(n.records)||n.records<1)&&e("context");const g=A({...l,inputs:[...l.inputs,["host/place",y(o)],["host/anchor",y(JSON.stringify(f))],["host/snapshot",m]]},y),p=await N(i,m,{read:a.read,digestBytes:y},n,s);let u,t;try{u=new TextDecoder("utf-8",{fatal:!0}).decode(p),t=JSON.parse(u)}catch{return e("snapshot-format")}JSON.stringify(t)+`
 `!==u&&e("snapshot-format"),s?.aborted&&e("cancelled");const d=L(t,f,n.records),c=y(JSON.stringify(d)+`
 `);return{kind:"fact",value:{place:o,standing:d,reading:g,result:c,commitment:C(g,c,y)}}}catch(o){return{kind:"refuse",code:o instanceof P?o.code:"host/failed",diagnostic:o instanceof Error?o.message:"REFUSE\xB7host/failed"}}}h(tt,"readContextualStandingInProcess");export{tt as readContextualStandingInProcess};

package/dist/host/in-process-root.js

@@ -1,4 +1,4 @@
-var H=Object.defineProperty;var d=(n,e)=>H(n,"name",{value:e,configurable:!0});import{library11_canonical as T,library11_parse as F}from"../vendor/runtime.js";import{library2_readingIdentity as J,library2_readingReceiptIdentity as L}from"../vendor/runtime.js";import{readContent as M}from"../engine/ports.js";import{acceptRootRecords as O}from"../cli/accept.js";import{verifiedLegacyActResult as I}from"../cli/act-result.js";import{admissionHistoryAt as U,admissionAnchor as j}from"../fold/admission-history.js";import{isConfig as P}from"../fold/claims.js";import{sha256 as s,isSha256 as R}from"./hash.js";import{BoundRefusal as A}from"./refusals.js";import{refuseHost as r}from"./host-controls.js";import{ActCommitUnknown as q}from"./commit-result.js";import{requireEffects as z}from"./read-only.js";import{withHostCall as S}from"./call-context.js";import{withActHost as D}from"../land/act.js";const w=d(n=>s(U(n,Number.MAX_SAFE_INTEGER).join(`
+var H=Object.defineProperty;var d=(n,e)=>H(n,"name",{value:e,configurable:!0});import{library14_canonical as T,library14_parse as F}from"../vendor/runtime.js";import{library5_readingIdentity as J,library5_readingReceiptIdentity as L}from"../vendor/runtime.js";import{readContent as M}from"../engine/ports.js";import{acceptRootRecords as O}from"../cli/accept.js";import{verifiedLegacyActResult as I}from"../cli/act-result.js";import{admissionHistoryAt as U,admissionAnchor as j}from"../fold/admission-history.js";import{isConfig as P}from"../fold/claims.js";import{sha256 as s,isSha256 as R}from"./hash.js";import{BoundRefusal as A}from"./refusals.js";import{refuseHost as r}from"./host-controls.js";import{ActCommitUnknown as q}from"./commit-result.js";import{requireEffects as z}from"./read-only.js";import{withHostCall as S}from"./call-context.js";import{withActHost as D}from"../land/act.js";const w=d(n=>s(U(n,Number.MAX_SAFE_INTEGER).join(`
 `)+`
 `),"rootLotSnapshot");async function se(n,e){const i=[];let f=0,o;const m=structuredClone(e.runtime),a={...n.limits};return S({instrumentName:e.instrumentName,runtime:m,output:d((t,l)=>{f+=new TextEncoder().encode(l).length,f>e.limits.diagnostics&&r("budget"),i.push({stream:t,text:l})},"output")},()=>D({name:e.instrumentName,report:d(t=>{f+=new TextEncoder().encode(t).length,f>e.limits.diagnostics&&r("budget"),i.push({stream:"error",text:t})},"report"),signal:n.signal},async()=>{try{z("Root lot admission"),(!n.place||!e.root||!e.instrumentName||!m.root||!m.entry||!m.directory||![".ts",".js"].includes(m.extension)||!Array.isArray(m.lock)||!m.lock.length)&&r("context"),(a.records>e.limits.records||a.maxBytes>e.limits.maxBytes||a.timeoutMs>e.limits.timeoutMs||!Number.isSafeInteger(a.records)||a.records<1||!Number.isSafeInteger(e.limits.diagnostics)||e.limits.diagnostics<1)&&r("budget");const{place:t,snapshot:l,source:C,digest:p,signal:y}=n,b=structuredClone(n.reading);(!R(l)||w(e.root)!==l)&&r("stale");const _=j(e.root),k=J({...b,inputs:[...b.inputs,["host/place",s(t)],["host/snapshot",l],["host/anchor",s(JSON.stringify(_))],["host/draft",p],["host/principal",s(e.signer.keyId)],["host/operation",s(JSON.stringify(["root-lot",a]))]]},s),x=await M(C,p,{read:e.read,digestBytes:s},a,y);let h;try{h=new TextDecoder("utf-8",{fatal:!0}).decode(x)}catch{return r("snapshot-format")}const g=h.endsWith(`
 `)?h.slice(0,-1).split(`

package/dist/host/in-process.js

@@ -1,4 +1,4 @@
-var I=Object.defineProperty;var m=(e,d)=>I(e,"name",{value:d,configurable:!0});import{library11_parse as R}from"../vendor/runtime.js";import{library2_readingIdentity as y,library2_readingReceiptIdentity as k}from"../vendor/runtime.js";import{readContent as C}from"../engine/ports.js";import{sha256 as a,isSha256 as v}from"./hash.js";import{BoundRefusal as w}from"./refusals.js";import{refuseHost as r}from"./host-controls.js";import{assertStandingView as E,publicStandingProjection as _}from"./standing-projection.js";async function H(e,d){try{(!e||typeof e.place!="string"||!e.place||typeof e.source!="string"||!e.source||!v(e.snapshot))&&r("context"),e.signal?.aborted&&r("cancelled");const{place:i,source:b,snapshot:g,signal:c}=e,s={...e.limits};(!Number.isSafeInteger(s.records)||s.records<1)&&r("budget");const t=structuredClone(e.anchor),l=structuredClone(e.reading);(!t||t.keyClass!=="authorize"||!t.id||!t.publicKey||!Array.isArray(t.coverage)||!t.coverage.length)&&r("context"),y(l,a);const p=y({...l,inputs:[...l.inputs,["host/place",a(i)],["host/anchor",a(JSON.stringify(t))],["host/snapshot",g]]},a),S=await C(b,g,{read:d.read,digestBytes:a},s,c);let u;try{u=new TextDecoder("utf-8",{fatal:!0}).decode(S)}catch{return r("snapshot-format")}const n=u.split(`
+var I=Object.defineProperty;var m=(e,d)=>I(e,"name",{value:d,configurable:!0});import{library14_parse as R}from"../vendor/runtime.js";import{library5_readingIdentity as y,library5_readingReceiptIdentity as k}from"../vendor/runtime.js";import{readContent as C}from"../engine/ports.js";import{sha256 as a,isSha256 as v}from"./hash.js";import{BoundRefusal as w}from"./refusals.js";import{refuseHost as r}from"./host-controls.js";import{assertStandingView as E,publicStandingProjection as _}from"./standing-projection.js";async function H(e,d){try{(!e||typeof e.place!="string"||!e.place||typeof e.source!="string"||!e.source||!v(e.snapshot))&&r("context"),e.signal?.aborted&&r("cancelled");const{place:i,source:b,snapshot:g,signal:c}=e,s={...e.limits};(!Number.isSafeInteger(s.records)||s.records<1)&&r("budget");const t=structuredClone(e.anchor),l=structuredClone(e.reading);(!t||t.keyClass!=="authorize"||!t.id||!t.publicKey||!Array.isArray(t.coverage)||!t.coverage.length)&&r("context"),y(l,a);const p=y({...l,inputs:[...l.inputs,["host/place",a(i)],["host/anchor",a(JSON.stringify(t))],["host/snapshot",g]]},a),S=await C(b,g,{read:d.read,digestBytes:a},s,c);let u;try{u=new TextDecoder("utf-8",{fatal:!0}).decode(S)}catch{return r("snapshot-format")}const n=u.split(`
 `).filter(f=>f.length>0);n.length>s.records&&r("budget"),(!n.length||n.some(f=>R(f).kind!=="fact"))&&r("snapshot-format"),c?.aborted&&r("cancelled");const o=_(n,t);E(o),c?.aborted&&r("cancelled");const h=a(o.join(`
 `)+(o.length?`
 `:""));return{kind:"fact",value:{place:i,rootStanding:o,reading:p,result:h,commitment:k(p,h,a)}}}catch(i){return{kind:"refuse",code:i instanceof w?i.code:"host/failed",diagnostic:i instanceof Error?i.message:"REFUSE\xB7host/failed"}}}m(H,"readRootStandingInProcess");export{H as readRootStandingInProcess};

package/dist/host/index.d.ts

@@ -1 +1 @@
-export {public2_HostInstrumentRuntime as HostInstrumentRuntime,public2_NativeHostInstrument as NativeHostInstrument,public2_NativeReadingIdentityContext as NativeReadingIdentityContext,public2_NativeReadingIdentityResult as NativeReadingIdentityResult,public2_NativeViewIdentityContext as NativeViewIdentityContext,public2_NativeViewIdentityResult as NativeViewIdentityResult,public2_PlaceActBudget as PlaceActBudget,public2_PlaceActHostContext as PlaceActHostContext,public2_PlaceActHostPorts as PlaceActHostPorts,public2_PlaceActPersistence as PlaceActPersistence,public2_PlaceActTrust as PlaceActTrust,public2_PreparedReading as PreparedReading,public2_PublicationStorage as PublicationStorage,public2_ReadingPreparationLimits as ReadingPreparationLimits,public2_ReadingPreparationResult as ReadingPreparationResult,public2_RootLotContext as RootLotContext,public2_RootLotPorts as RootLotPorts,public2_RootStandingHostContext as RootStandingHostContext,public2_RootStandingHostResult as RootStandingHostResult,public2_landPlaceActInProcess as landPlaceActInProcess,public2_landRootLotInProcess as landRootLotInProcess,public2_nativeHostInstrument as nativeHostInstrument,public2_nativePlaceActPersistence as nativePlaceActPersistence,public2_nativePlaceActReceiver as nativePlaceActReceiver,public2_prepareNativeReadingIdentity as prepareNativeReadingIdentity,public2_prepareNativeViewIdentity as prepareNativeViewIdentity,public2_readContextualStandingInProcess as readContextualStandingInProcess,public2_readRootStandingInProcess as readRootStandingInProcess,public2_recoverPlaceActInProcess as recoverPlaceActInProcess,public2_recoverRootActInProcess as recoverRootActInProcess,public2_rootLotSnapshot as rootLotSnapshot} from "../public-types.js";
+export {public2_HostInstrumentRuntime as HostInstrumentRuntime,public2_InstalledPackageMember as InstalledPackageMember,public2_InstalledPackagePin as InstalledPackagePin,public2_InstalledPackageRequest as InstalledPackageRequest,public2_NativeAuthorityAction as NativeAuthorityAction,public2_NativeAuthorityCardContext as NativeAuthorityCardContext,public2_NativeAuthorityCardRequest as NativeAuthorityCardRequest,public2_NativeAuthorityCardValue as NativeAuthorityCardValue,public2_NativeAuthorityJudgment as NativeAuthorityJudgment,public2_NativeCommand as NativeCommand,public2_NativeCommandHost as NativeCommandHost,public2_NativeCommandResult as NativeCommandResult,public2_NativeHostInstrument as NativeHostInstrument,public2_NativeHostLimits as NativeHostLimits,public2_NativeHostOptions as NativeHostOptions,public2_NativeProbeContext as NativeProbeContext,public2_NativeProbeCounter as NativeProbeCounter,public2_NativeProbeForm as NativeProbeForm,public2_NativeProbePort as NativeProbePort,public2_NativeProbeResult as NativeProbeResult,public2_NativeReadingIdentityContext as NativeReadingIdentityContext,public2_NativeReadingIdentityResult as NativeReadingIdentityResult,public2_NativeViewIdentitiesContext as NativeViewIdentitiesContext,public2_NativeViewIdentitiesResult as NativeViewIdentitiesResult,public2_NativeViewIdentityContext as NativeViewIdentityContext,public2_NativeViewIdentityResult as NativeViewIdentityResult,public2_PhysicalLinesPlaceInput as PhysicalLinesPlaceInput,public2_PhysicalLinesPolicy as PhysicalLinesPolicy,public2_PhysicalLinesReading as PhysicalLinesReading,public2_PhysicalLinesRegion as PhysicalLinesRegion,public2_PhysicalLinesWitnessAuthority as PhysicalLinesWitnessAuthority,public2_PlaceActBudget as PlaceActBudget,public2_PlaceActHostContext as PlaceActHostContext,public2_PlaceActHostPorts as PlaceActHostPorts,public2_PlaceActPersistence as PlaceActPersistence,public2_PlaceActTrust as PlaceActTrust,public2_PreparedReading as PreparedReading,public2_ProfileCompositionRequest as ProfileCompositionRequest,public2_ProfileFieldBinding as ProfileFieldBinding,public2_PublicationStorage as PublicationStorage,public2_ReadingPreparationLimits as ReadingPreparationLimits,public2_ReadingPreparationResult as ReadingPreparationResult,public2_ReadingProducerPolicy as ReadingProducerPolicy,public2_ReleaseCategory as ReleaseCategory,public2_RootLotContext as RootLotContext,public2_RootLotPorts as RootLotPorts,public2_RootStandingHostContext as RootStandingHostContext,public2_RootStandingHostResult as RootStandingHostResult,public2_answerNativeAuthorityCard as answerNativeAuthorityCard,public2_authenticatePhysicalLinesWitness as authenticatePhysicalLinesWitness,public2_composeProfile as composeProfile,public2_installedHostInstrument as installedHostInstrument,public2_installedPackageIdentity as installedPackageIdentity,public2_judgePhysicalLines as judgePhysicalLines,public2_landPlaceActInProcess as landPlaceActInProcess,public2_landRootLotInProcess as landRootLotInProcess,public2_nativeAuthorityCardView as nativeAuthorityCardView,public2_nativeAuthorityRequestIdentity as nativeAuthorityRequestIdentity,public2_nativeHostEnvironment as nativeHostEnvironment,public2_nativeHostInstrument as nativeHostInstrument,public2_nativePlaceActPersistence as nativePlaceActPersistence,public2_nativePlaceActReceiver as nativePlaceActReceiver,public2_parseNativeAuthorityCardRequest as parseNativeAuthorityCardRequest,public2_physicalLinesRegions as physicalLinesRegions,public2_prepareNativeAuthorityCard as prepareNativeAuthorityCard,public2_prepareNativeProbe as prepareNativeProbe,public2_prepareNativeReadingIdentity as prepareNativeReadingIdentity,public2_prepareNativeViewIdentities as prepareNativeViewIdentities,public2_prepareNativeViewIdentity as prepareNativeViewIdentity,public2_profileDigest as profileDigest,public2_readContextualStandingInProcess as readContextualStandingInProcess,public2_readPlacePhysicalLines as readPlacePhysicalLines,public2_readRootStandingInProcess as readRootStandingInProcess,public2_recoverPlaceActInProcess as recoverPlaceActInProcess,public2_recoverRootActInProcess as recoverRootActInProcess,public2_releaseCategoryPins as releaseCategoryPins,public2_rootLotSnapshot as rootLotSnapshot,public2_startNativeHost as startNativeHost} from "../public-types.js";

package/dist/host/index.js

@@ -1 +1 @@
-import{readRootStandingInProcess as o}from"./in-process.js";import{readContextualStandingInProcess as n}from"./in-process-context.js";import{landPlaceActInProcess as c,recoverPlaceActInProcess as s}from"./in-process-act.js";import{landRootLotInProcess as p,recoverRootActInProcess as P,rootLotSnapshot as d}from"./in-process-root.js";import{nativeHostInstrument as m,nativePlaceActReceiver as v}from"./native-receiver.js";import{nativePlaceActPersistence as f}from"./ports/place-act.js";import{prepareNativeReadingIdentity as A,prepareNativeViewIdentity as R}from"./reading-identity.js";export{c as landPlaceActInProcess,p as landRootLotInProcess,m as nativeHostInstrument,f as nativePlaceActPersistence,v as nativePlaceActReceiver,A as prepareNativeReadingIdentity,R as prepareNativeViewIdentity,n as readContextualStandingInProcess,o as readRootStandingInProcess,s as recoverPlaceActInProcess,P as recoverRootActInProcess,d as rootLotSnapshot};
+import{readRootStandingInProcess as r}from"./in-process.js";import{readContextualStandingInProcess as a}from"./in-process-context.js";import{landPlaceActInProcess as n,recoverPlaceActInProcess as s}from"./in-process-act.js";import{landRootLotInProcess as c,recoverRootActInProcess as d,rootLotSnapshot as l}from"./in-process-root.js";import{nativeHostInstrument as m,installedHostInstrument as v,nativePlaceActReceiver as f}from"./native-receiver.js";import{nativePlaceActPersistence as y}from"./ports/place-act.js";import{prepareNativeReadingIdentity as u,prepareNativeViewIdentity as h,prepareNativeViewIdentities as A}from"./reading-identity.js";import{prepareNativeProbe as N}from"./native/probes.js";import{physicalLinesRegions as C,readPlacePhysicalLines as L,authenticatePhysicalLinesWitness as w,judgePhysicalLines as H}from"./physical-lines.js";import{composeProfile as V,profileDigest as q,releaseCategoryPins as b}from"./profile-composition.js";import{installedPackageIdentity as k}from"./native/installed-package.js";import{prepareNativeAuthorityCard as E,answerNativeAuthorityCard as W,nativeAuthorityRequestIdentity as z,parseNativeAuthorityCardRequest as B}from"./native/authority-card.js";import{nativeAuthorityCardView as G}from"./native/authority-card-view.js";import{startNativeHost as K,nativeHostEnvironment as M}from"./persistent-host.js";export{W as answerNativeAuthorityCard,w as authenticatePhysicalLinesWitness,V as composeProfile,v as installedHostInstrument,k as installedPackageIdentity,H as judgePhysicalLines,n as landPlaceActInProcess,c as landRootLotInProcess,G as nativeAuthorityCardView,z as nativeAuthorityRequestIdentity,M as nativeHostEnvironment,m as nativeHostInstrument,y as nativePlaceActPersistence,f as nativePlaceActReceiver,B as parseNativeAuthorityCardRequest,C as physicalLinesRegions,E as prepareNativeAuthorityCard,N as prepareNativeProbe,u as prepareNativeReadingIdentity,A as prepareNativeViewIdentities,h as prepareNativeViewIdentity,q as profileDigest,a as readContextualStandingInProcess,L as readPlacePhysicalLines,r as readRootStandingInProcess,s as recoverPlaceActInProcess,d as recoverRootActInProcess,b as releaseCategoryPins,l as rootLotSnapshot,K as startNativeHost};

package/dist/host/located.js

@@ -1,6 +1,6 @@
-var I=Object.defineProperty;var n=(e,t)=>I(e,"name",{value:t,configurable:!0});var m=function(e,t){return typeof e=="string"&&/^\.\.?\//.test(e)?e.replace(/\.(tsx)$|((?:\.d)?)((?:\.[^./]+?)?)\.([cm]?)ts$/i,function(i,o,d,p,f){return o?t?".jsx":".js":d&&(!p||!f)?i:d+p+"."+f.toLowerCase()+"js"}):e};import{readFileSync as P}from"node:fs";import{join as E}from"node:path";import{pathToFileURL as L}from"node:url";import{pinExport as R,provide as W}from"./provide.js";const j=n(e=>e==="reader"?["observe","run"]:[e],"wanted"),q=n(e=>["render","receipt","observe","run"].filter(t=>!j(e).includes(t)),"foreign"),U=n((e,t)=>typeof e[t]=="function","isFn"),z=n(e=>(e instanceof Error?e.message:String(e)).replace(/\s+/g," ").trim(),"text"),k=n(async()=>{W();const[e,t]=[R("topos","./wire"),R("topos","./capsule")];if(!e||!t)throw new Error("REFUSE\xB7pin dep/topos names no wire or capsule");const[i,o]=await Promise.all([import(m(L(e).href)),import(m(L(t).href))]);return{CAPSULE:String(i.CAPSULE??""),PROTOCOL:String(i.PROTOCOL??""),parse:i.parse,declarationOf:o.declarationOf,readers:o.readers,receiptShell:o.receiptShell,shell:o.shell}},"sdk"),B=n(async(e,t)=>{const{CAPSULE:i,PROTOCOL:o,declarationOf:d,shell:p}=await k(),f=P(E(e,i),"utf8").split(`
-`).filter(a=>a.startsWith(o)),{regions:S}=d(f),g=await import(m(L(E(e,t)).href)),O=g.render??g.default?.render;if(typeof O!="function")return{};const u=Object.fromEntries(Object.entries(S).map(([a,v])=>[a,{reads:v,region:n(y=>O({...y,region:a}),"region")}]));return u&&Object.keys(u).length?{render:p(u)}:{}},"pagesOf"),G=n(async(e,t,i)=>{if(i==="render")return B(e,t);const{CAPSULE:o,PROTOCOL:d,parse:p,declarationOf:f,readers:S,receiptShell:g,shell:O}=await k(),u=P(E(e,o),"utf8").split(`
-`).filter(r=>r.startsWith(d)),a=n((r,l)=>(s=>s.kind==="fact"?s.value.fields[l]??"":"")(p(r)),"field"),{regions:v,writes:y}=f(u),T=new Set(u.filter(r=>a(r,"measure")==="writes").map(r=>a(r,"scope").slice(7))),F=n(r=>T.has(r)?"reader":y[r]??"","kind"),_=n(async(r,l,s)=>{let c;try{c=await import(m(L(E(e,t,`${r}${i}`)).href))}catch(w){process.stderr.write(`LOAD     ${r} \xB7 module error \xB7 ${z(w)}
-`);return}const h=j(s).filter(w=>U(c,w)),C=q(s).filter(w=>U(c,w));if(!h.length&&C.length){process.stderr.write(`LOAD     ${r} \xB7 role mismatch \xB7 ${s} exports ${C.join("|")}
-`);return}if(!h.length){process.stderr.write(`LOAD     ${r} \xB7 missing export \xB7 ${j(s)[0]}
-`);return}const D=s==="reader"?{observe:c.observe,run:c.run}:{region:c[s]};return[r,{reads:l,...D}]},"region"),$=n(async r=>{const l=[];for(const[s,c]of Object.entries(v)){if(F(s)!==r)continue;const h=await _(s,c,r);h&&l.push(h)}return l.length?Object.fromEntries(l):void 0},"loaded"),b=await $("render"),x=await $("receipt"),A=await $("reader");return{render:b&&O(b),receipt:x&&g(x),...A?S(A):{}}},"locate"),Q=n(()=>G(process.argv[3]??"",process.argv[4]??"",process.argv[5]??""),"load");export{Q as load,G as locate};
+var W=Object.defineProperty;var n=(e,t)=>W(e,"name",{value:t,configurable:!0});var w=function(e,t){return typeof e=="string"&&/^\.\.?\//.test(e)?e.replace(/\.(tsx)$|((?:\.d)?)((?:\.[^./]+?)?)\.([cm]?)ts$/i,function(i,o,p,d,f){return o?t?".jsx":".js":p&&(!d||!f)?i:p+d+"."+f.toLowerCase()+"js"}):e};import{hostOutput as j}from"./call-context.js";import{readFileSync as R}from"node:fs";import{join as E}from"node:path";import{pathToFileURL as L}from"node:url";import{pinExport as U,provide as q}from"./provide.js";const b=n(e=>e==="reader"?["observe","run"]:[e],"wanted"),z=n(e=>["render","receipt","observe","run"].filter(t=>!b(e).includes(t)),"foreign"),k=n((e,t)=>typeof e[t]=="function","isFn"),B=n(e=>(e instanceof Error?e.message:String(e)).replace(/\s+/g," ").trim(),"text"),T=n(async()=>{q();const[e,t]=[U("topos","./wire"),U("topos","./capsule")];if(!e||!t)throw new Error("REFUSE\xB7pin dep/topos names no wire or capsule");const[i,o]=await Promise.all([import(w(L(e).href)),import(w(L(t).href))]);return{CAPSULE:String(i.CAPSULE??""),PROTOCOL:String(i.PROTOCOL??""),parse:i.parse,declarationOf:o.declarationOf,readers:o.readers,receiptShell:o.receiptShell,shell:o.shell}},"sdk"),G=n(async(e,t)=>{const{CAPSULE:i,PROTOCOL:o,declarationOf:p,shell:d}=await T(),f=R(E(e,i),"utf8").split(`
+`).filter(a=>a.startsWith(o)),{regions:S}=p(f),O=await import(w(L(E(e,t)).href)),g=O.render??O.default?.render;if(typeof g!="function")return{};const u=Object.fromEntries(Object.entries(S).map(([a,v])=>[a,{reads:v,region:n(y=>g({...y,region:a}),"region")}]));return u&&Object.keys(u).length?{render:d(u)}:{}},"pagesOf"),H=n(async(e,t,i)=>{if(i==="render")return G(e,t);const{CAPSULE:o,PROTOCOL:p,parse:d,declarationOf:f,readers:S,receiptShell:O,shell:g}=await T(),u=R(E(e,o),"utf8").split(`
+`).filter(r=>r.startsWith(p)),a=n((r,l)=>(s=>s.kind==="fact"?s.value.fields[l]??"":"")(d(r)),"field"),{regions:v,writes:y}=f(u),F=new Set(u.filter(r=>a(r,"measure")==="writes").map(r=>a(r,"scope").slice(7))),_=n(r=>F.has(r)?"reader":y[r]??"","kind"),D=n(async(r,l,s)=>{let c;try{c=await import(w(L(E(e,t,`${r}${i}`)).href))}catch(m){j("error",`LOAD     ${r} \xB7 module error \xB7 ${B(m)}
+`);return}const h=b(s).filter(m=>k(c,m)),P=z(s).filter(m=>k(c,m));if(!h.length&&P.length){j("error",`LOAD     ${r} \xB7 role mismatch \xB7 ${s} exports ${P.join("|")}
+`);return}if(!h.length){j("error",`LOAD     ${r} \xB7 missing export \xB7 ${b(s)[0]}
+`);return}const I=s==="reader"?{observe:c.observe,run:c.run}:{region:c[s]};return[r,{reads:l,...I}]},"region"),$=n(async r=>{const l=[];for(const[s,c]of Object.entries(v)){if(_(s)!==r)continue;const h=await D(s,c,r);h&&l.push(h)}return l.length?Object.fromEntries(l):void 0},"loaded"),x=await $("render"),A=await $("receipt"),C=await $("reader");return{render:x&&g(x),receipt:A&&O(A),...C?S(C):{}}},"locate"),X=n(()=>H(process.argv[3]??"",process.argv[4]??"",process.argv[5]??""),"load");export{X as load,H as locate};

package/dist/host/native/authority-card-view.js

@@ -0,0 +1,5 @@
+var v=Object.defineProperty;var u=(r,a)=>v(r,"name",{value:a,configurable:!0});import{authenticatedStanding as S}from"../admitted-place.js";import{withoutEffects as F}from"../read-only.js";import{withHostCall as R}from"../call-context.js";import{sha256 as m,isSha256 as x}from"../hash.js";import{BoundRefusal as e}from"../refusals.js";import{fieldOf as o}from"../../fold/claims.js";import{storeOf as A,blobAt as C}from"../../land/ledger.js";import{readBoundedFile as N}from"./bounded-file.js";import{parseNativeAuthorityCardRequest as j,prepareNativeAuthorityCard as B}from"./authority-card.js";async function K(r,a,i){const f={instrumentName:a.name,runtime:structuredClone(a.runtime),output:u(()=>{},"output")},w=R(f,()=>F(()=>{if(typeof i!="string"||!i||/[\s@]/.test(i))throw new e("authority-card/selection","REFUSE\xB7authority-card/selection requires an explicit request scope");const g=S(r),E=u((t,n,h)=>{const q=g.filter(s=>o(s,"scope")===t&&o(s,"measure")===n&&o(s,"role")==="writes"&&o(s,"form")===h&&o(s,"value")!=="withdraw");if(q.length!==1)throw new e("authority-card/selection","REFUSE\xB7authority-card/selection requires one admitted "+n+" at "+t);return o(q[0],"value")},"select"),c=E(i,"authority-card-request","alphabet");if(!x(c))throw new e("authority-card/selection","REFUSE\xB7authority-card/selection requires a SHA-256 request");const b=u(t=>{const n=/^0\.\.([1-9][0-9]*)$/.exec(E(i+"/"+t,t,"interval")),h=Number(n?.[1]);if(!n||!Number.isSafeInteger(h))throw new e("authority-card/budget","REFUSE\xB7authority-card/budget requires a finite "+t+" bound");return h},"limit"),d={bytes:b("bytes"),items:b("items")};let y;try{y=N(C(A(r),c),d.bytes,i)}catch(t){throw new e("authority-card/content","REFUSE\xB7authority-card/content "+(t instanceof Error?t.message:"request bytes unavailable"))}if(m(y)!==c)throw new e("authority-card/integrity","REFUSE\xB7authority-card/integrity request bytes differ from admitted selection");let p;try{p=new TextDecoder("utf-8",{fatal:!0}).decode(y)}catch{throw new e("authority-card/integrity","REFUSE\xB7authority-card/integrity request is not UTF-8")}const l=j(p,c,d);if(l.limits.bytes>d.bytes||l.limits.items>d.items)throw new e("authority-card/budget","REFUSE\xB7authority-card/budget request exceeds admitted selector limits");return{request:l,standing:m(g.join(`
+`)+`
+`)}})),U=await B({...w.request,root:r,instrument:a});if(R(f,()=>F(()=>m(S(r).join(`
+`)+`
+`)))!==w.standing)throw new e("authority-card/selection","REFUSE\xB7authority-card/selection changed during preflight");return U}u(K,"nativeAuthorityCardView");export{K as nativeAuthorityCardView};

package/dist/host/native/authority-card.js

@@ -0,0 +1 @@
+var me=Object.defineProperty;var h=(i,y)=>me(i,"name",{value:y,configurable:!0});import{readFileSync as P,realpathSync as Q}from"node:fs";import{join as V}from"node:path";import{library14_authorityAtEpoch as le,library14_parse as pe,library14_LOCK as Y}from"../../vendor/runtime.js";import{library5_encodeAuthorityCard as ge,library5_authorityCardStatement as ye,library5_authorityCardAnswer as ke}from"../../vendor/runtime.js";import{admissionHistoryAt as Z,admissionAnchor as be}from"../../fold/admission-history.js";import{projectAuthenticatedStanding as ve}from"../standing-projection.js";import{authorityFor as we}from"../../fold/signers.js";import{ownRecordAdmitted as Ae,appliedHistoryIn as x}from"../../fold/signed.js";import{signatureEraOf as Se}from"../signature-era.js";import{epochOf as ee,localActLines as Ee}from"../../cli/owner.js";import{fieldOf as k,foldClaims as Ce,isConfig as Ne,sayingOf as te}from"../../fold/claims.js";import{admissionChecks as qe,admissionWideningChecks as Oe,configurationAdmissionGuards as Ie,configurationEpochCheck as je,admissionEvidenceResult as ze}from"../../cli/accept.js";import{wordOf as re}from"../../fold/wire.js";import{isCeiling as ie}from"../../fold/configures.js";import{installedReferenceContracts as Re}from"../reference-contracts.js";import{placesIn as _e}from"../../fold/places.js";import{sha256 as b}from"../hash.js";import{underRootAuthority as Je}from"../../land/act.js";import{storeOf as se}from"../../land/ledger.js";import{withContentStore as Fe}from"../content-store.js";import{withoutEffects as Le}from"../read-only.js";import{BoundRefusal as oe}from"../refusals.js";import{withHostCall as We}from"../call-context.js";const m=h(i=>b(JSON.stringify(i)),"hash"),u=h(i=>{throw new oe("authority-preflight/"+i,"REFUSE\xB7authority-preflight/"+i)},"fail"),Be=h(i=>m(["native-authority-request/1",i.kind,i.records]),"nativeAuthorityRequestIdentity");async function Ge(i,y){try{const n=Q(i.root);return await We({instrumentName:i.instrument.name,runtime:i.instrument.runtime,output:h(()=>{},"output")},()=>Fe(se(n),()=>Je(se(n),"authority card preflight",()=>Le(()=>{const{place:e,key:f,clock:r,limits:d}=i,a=Q(i.root);e!=="."&&(!e||e.startsWith("/")||e.includes("\\")||e.split("/").some(t=>!t||t==="."||t===".."))&&u("place"),e!=="."&&!_e(a).includes(e)&&u("place"),(!Number.isSafeInteger(r.now)||!Number.isSafeInteger(i.authorityEpoch)||!Number.isSafeInteger(d.bytes)||d.bytes<1||!Number.isSafeInteger(d.items)||d.items<1)&&u("context"),i.actions.length>d.items&&u("budget");const l=Z(a,Number.MAX_SAFE_INTEGER),q=be(a);(l.length+i.actions.reduce((t,o)=>t+o.records.length,0)>d.items||Buffer.byteLength(JSON.stringify([l,i.actions]))>d.bytes)&&u("budget"),ee(l)!==i.authorityEpoch&&u("stale-epoch");const p=ve(l,q),R=Se(p).admitted,w=we(l,q,R),O=w.admitted.find(t=>t.id===f),_=b(P(V(a,e==="."?"":e,Y))),A=i.actions.map(t=>{const o=Be(t),c=[],M=[];if(t.kind!=="record-coverage"&&t.kind!=="admission")return{request:o,decision:"deny",evidence:[{check:"unsupported-action",kind:t.kind}],needs:[]};if(!t.records.length)return{request:o,decision:"ask",evidence:[],needs:["authority-preflight/records"]};let S=!1;for(const s of t.records){const g=pe(s);if(g.kind!=="fact"){S=!0,c.push({check:"wire-parse",line:s,result:g});continue}const U=e==="."?g.value.fields.scope??"":`${re(p,"families","region")}/${e}/${g.value.fields.scope??""}`,X=O?le({...g.value.fields,by:f},O,i.authorityEpoch,U,"authority"):{kind:"refuse",why:"requested key is not admitted"};if(c.push({check:"authorityAtEpoch",line:s,scope:U,result:X}),X.kind!=="admitted"&&(S=!0),g.value.fields.sig){const D=e==="."?w.of(s).kind==="admitted":Ae(s,e,re(p,"families","region"),w.admitted,R);c.push({check:"authenticated-record",line:s,admitted:D}),(!D||g.value.fields.by!==f)&&(S=!0)}}if(S)return{request:o,decision:"deny",evidence:c,needs:M};const I=e==="."?p:Ce(x(a,e)).standing,E=Oe(a,t.records,I,p,e);if(c.push({check:"admissionWideningChecks",result:E,standing:m(I)}),E.kind==="ask")return{request:o,decision:"ask",evidence:c,needs:E.needs};if(E.kind==="refuse")return{request:o,decision:"deny",evidence:c,needs:[]};if(t.kind==="record-coverage")return{request:o,decision:"allow",evidence:c,needs:M};if(t.records.some(s=>!Ne(s)))return{request:o,decision:"deny",evidence:[...c,{check:"configuration-only",result:"unsupported-object-action"}],needs:[]};const j=t.records.filter(s=>!k(s,"sig"));if(j.length)return{request:o,decision:"ask",evidence:[...c,{check:"signature",records:j}],needs:j.map(s=>"signature:"+k(s,"scope"))};const ue=new Set((e==="."?l:x(a,e)).map(te)),H=ee(Ee(a,e==="."?[]:[e]))+1,$=je(t.records,H,s=>ue.has(te(s)));if($.length)return{request:o,decision:"deny",evidence:[...c,{check:"prospective-epoch",records:$,expected:H}],needs:[]};const C=Ie(a,t.records,e==="."?[]:[e]);if(c.push({check:"configurationAdmissionGuards",result:C}),C.kind==="refuse")return{request:o,decision:"deny",evidence:c,needs:[]};const N=qe(a,C.ownership.ledger,p);if(c.push({check:"admissionChecks",result:N}),N.kind==="ask")return{request:o,decision:"ask",evidence:c,needs:N.needs};if(N.kind==="refuse")return{request:o,decision:"deny",evidence:c,needs:[]};const v=ze(a,e==="."?C.ownership.ledger:t.records,I,r.now);if(v.kind==="refuse"){c.push({check:"admissionEvidence",result:v});const s=v.code==="admission/inert"||v.code==="admission/evidence";return{request:o,decision:s?"ask":"deny",evidence:c,needs:s?t.records.filter(ie).length?t.records.filter(ie).map(g=>"reading:"+k(g,"scope")):["admission-evidence:"+o]:[]}}const{coordinates:fe,judged:K,fold:z}=v.evidence,he=K.map(s=>s.kind==="judged"?{...s,started:void 0}:s);c.push({check:"admissionEvidence",coordinates:fe,judged:he,fold:{standing:z.standing,observed:z.observed,own:z.own}});const T=K.filter(s=>s.kind==="owed");return{request:o,decision:T.length?"ask":"allow",evidence:c,needs:T.map(s=>"demand:"+s.scope)}}),J=JSON.parse(JSON.stringify(A,(t,o)=>o instanceof Map?[...o]:o)),ne=m([q,w.admitted,l]),F=m(["native-authority-coverage/1",a,e,f,O??null,A.map(t=>t.request)]),ce=p.filter(t=>k(t,"scope").startsWith("keys/")),de=l.filter(t=>k(t,"scope").startsWith("keys/")&&k(t,"value")==="withdraw"),L=Re(),W={place:e,snapshot:_,key:f,authority:ne,coverage:F,policy:m(p),budget:m(d),catalog:L.refusals,standingContract:L.standing,grants:ce.map(b),retirements:de.map(b),demands:p.filter(t=>k(t,"role")==="demands").map(b),horizon:i.horizon,issuedAt:y??r.now,actions:A.filter(t=>t.decision!=="open").map(t=>({request:t.request,decision:t.decision})),evidence:m(J)};(m(Z(a,Number.MAX_SAFE_INTEGER))!==m(l)||b(P(V(a,e==="."?"":e,Y)))!==_)&&u("context-changed");const B=ge(W,d),ae=[...new Set(A.flatMap(t=>t.needs))],G={card:W,line:B,identity:m([a,e,F,B]),judgments:J,needs:ae};return Buffer.byteLength(JSON.stringify(G))>d.bytes&&u("budget"),{kind:"fact",value:G}}))))}catch(n){return{kind:"refuse",code:n instanceof oe?n.code:"authority-preflight/failed",diagnostic:n instanceof Error?n.message:"REFUSE\xB7authority preflight failed"}}}h(Ge,"prepareNativeAuthorityCard");async function ut(i,y,n){const e=await Ge(n,i.issuedAt);if(e.kind==="refuse")return e.code==="authority-preflight/stale-epoch"||e.code==="authority-preflight/context-changed"?{status:"refused",code:"card-stale",next:"refresh-card"}:e;const f=e.value,r=f.card;return ke(i,y,{place:r.place,snapshot:r.snapshot,key:r.key,authority:r.authority,coverage:r.coverage,policy:r.policy,budget:r.budget,catalog:r.catalog,standingContract:r.standingContract,clock:n.clock,verifiesJudgment:h((d,a)=>d===ye(r,n.limits)&&a===r.evidence,"verifiesJudgment")},n.limits)}h(ut,"answerNativeAuthorityCard");function ft(i,y,n){(!Number.isSafeInteger(n.bytes)||n.bytes<1||Buffer.byteLength(i)>n.bytes||b(i)!==y)&&u("request-integrity");const e=JSON.parse(i);(!e||Object.keys(e).sort().join(",")!=="actions,authorityEpoch,clock,horizon,key,limits,place,profile"||e.profile!=="native-authority-card-request/1"||!Array.isArray(e.actions)||e.actions.length>n.items)&&u("request-format");const f=h((r,d)=>r!==null&&typeof r=="object"&&!Array.isArray(r)&&Object.keys(r).sort().join(",")===d,"exact");(!f(e.clock,"name,now,unit")||!f(e.horizon,"clock,from,through,unit")||!f(e.limits,"bytes,items"))&&u("request-context");for(const r of[n.items,e.limits.bytes,e.limits.items])(!Number.isSafeInteger(r)||r<1)&&u("request-budget");(e.limits.bytes>n.bytes||e.limits.items>n.items||!Number.isSafeInteger(e.authorityEpoch)||e.authorityEpoch<0||!Number.isSafeInteger(e.clock.now)||!Number.isSafeInteger(e.horizon.from)||!Number.isSafeInteger(e.horizon.through)||e.horizon.from>e.horizon.through)&&u("request-context");for(const r of[e.place,e.key,e.clock.name,e.clock.unit,e.horizon.clock,e.horizon.unit])(typeof r!="string"||!r||/[\u0000-\u0020\u007f]/.test(r))&&u("request-context");return(e.clock.name!==e.horizon.clock||e.clock.unit!==e.horizon.unit||e.clock.now<e.horizon.from||e.clock.now>e.horizon.through)&&u("request-clock"),e.actions.some(r=>!r||Object.keys(r).sort().join(",")!=="kind,records"||!["record-coverage","admission"].includes(r.kind)||!Array.isArray(r.records)||r.records.some(d=>typeof d!="string"))&&u("request-action"),e.actions.reduce((r,d)=>r+d.records.length,0)>e.limits.items&&u("request-budget"),structuredClone(e)}h(ft,"parseNativeAuthorityCardRequest");export{ut as answerNativeAuthorityCard,Be as nativeAuthorityRequestIdentity,ft as parseNativeAuthorityCardRequest,Ge as prepareNativeAuthorityCard};

package/dist/host/native/command.js

@@ -1 +1 @@
-var _=Object.defineProperty;var a=(n,p)=>_(n,"name",{value:p,configurable:!0});import{spawn as k}from"node:child_process";import{channel as F}from"node:diagnostics_channel";import{isAbsolute as C}from"node:path";import{library2_checkCommandPort as M,library2_commandRequest as N,library2_commandResponse as A}from"../../vendor/runtime.js";import{requireEffects as D}from"../read-only.js";import{assertNativeRuntime as G}from"./runtime.js";import{scheduleDeadline as K}from"./deadline.js";const T=F("bound.command.refusal");async function te(n){const p=process.hrtime.bigint(),{host:b,signal:m,phase:y,accepts:$}=n,t=Object.freeze({...n.port,closure:Object.freeze([...n.port.closure]),environment:Object.freeze([...n.port.environment])}),B=Object.freeze({...n.lot,requests:Object.freeze([...n.lot.requests])}),l=Object.freeze({...n.environment});G(l,[]);const i=a(c=>{throw Error(`REFUSE\xB7port ${t.coordinate} ${c}`)},"refuse");y!=="act"&&i("invocation forbidden during "+y),D("command "+t.coordinate),m?.aborted&&i("interrupted before invocation"),M(t,b);const j=p+BigInt(t.timeoutMs)*1000000n,E=b.resolve(t),r=Object.freeze({...E,args:Object.freeze([...E.args])});(!C(r.command)||!C(r.cwd))&&i("host invocation needs absolute coordinates"),b.loaderClosure(t,r)!=="verified"&&i("runtime-loader closure unmeasured");const h=Object.keys(l).sort(),w=[...new Set(t.environment)].sort();(h.length!==w.length||h.some((c,v)=>c!==w[v])||h.some(c=>typeof l[c]!="string"||l[c].includes("\0")))&&i("environment differs from declared handoff");const x=N(t,B),d=r.hostEnvelope;d&&(!Number.isSafeInteger(r.envelopeBytes)||r.envelopeBytes<1||d.byteLength>r.envelopeBytes)&&i("host envelope byte resources"),process.hrtime.bigint()>=j&&i("timeout before invocation"),m?.aborted&&i("interrupted before invocation");const O=await new Promise((c,v)=>{const o=k(r.command,[...r.args],{cwd:r.cwd,env:{...l},shell:!1,detached:!1,stdio:d?["pipe","pipe","pipe","pipe"]:["pipe","pipe","pipe"]}),z=[],S=[];let L=0,u,R=!1;const f=a(e=>{if(!u){u=e;try{o.kill("SIGKILL")}catch{}o.stdin.destroy(),d&&o.stdio[3]?.destroy()}},"stop"),P=K(j,()=>f("timeout")),g=a(()=>f("interrupted"),"abort");m?.addEventListener("abort",g,{once:!0}),m?.aborted&&g();const q=a((e,s,U)=>{if(!u){if(L+=s.length,L>t.responseBytes){f("response-bytes exceeded");return}if(U==="stderr"&&t.stderr==="reject"){T.publish({coordinate:t.coordinate,stderr:s.subarray(0,Math.min(t.responseBytes,1024)).toString("utf8")}),f("stderr forbidden");return}e.push(s)}},"collect");o.stdout.on("data",e=>q(z,e,"stdout")),o.stderr.on("data",e=>q(S,e,"stderr")),o.stdin.on("error",()=>f("request handoff failed"));const I=a((e,s)=>{if(!R){if(R=!0,P(),m?.removeEventListener("abort",g),s||u){v(Error(`REFUSE\xB7port ${t.coordinate} ${u??s.message}`));return}c({status:e,interrupted:!1,stdout:Buffer.concat(z).toString("utf8"),stderr:Buffer.concat(S).toString("utf8")})}},"finish");if(o.once("error",e=>I(null,e)),o.once("close",e=>I(e)),d){const e=o.stdio[3],s=Buffer.alloc(8);s.writeBigUInt64BE(BigInt(d.byteLength)),e.on("error",()=>f("host envelope handoff failed")),e.end(Buffer.concat([s,Buffer.from(d)]))}o.stdin.end(x)});return{members:A(t,B,O,$),stderr:O.stderr,invocations:1}}a(te,"executeLot");export{te as executeLot};
+var _=Object.defineProperty;var a=(n,p)=>_(n,"name",{value:p,configurable:!0});import{spawn as k}from"node:child_process";import{channel as F}from"node:diagnostics_channel";import{isAbsolute as C}from"node:path";import{library5_checkCommandPort as M,library5_commandRequest as N,library5_commandResponse as A}from"../../vendor/runtime.js";import{requireEffects as D}from"../read-only.js";import{assertNativeRuntime as G}from"./runtime.js";import{scheduleDeadline as K}from"./deadline.js";const T=F("bound.command.refusal");async function te(n){const p=process.hrtime.bigint(),{host:b,signal:m,phase:y,accepts:$}=n,t=Object.freeze({...n.port,closure:Object.freeze([...n.port.closure]),environment:Object.freeze([...n.port.environment])}),B=Object.freeze({...n.lot,requests:Object.freeze([...n.lot.requests])}),l=Object.freeze({...n.environment});G(l,[]);const i=a(c=>{throw Error(`REFUSE\xB7port ${t.coordinate} ${c}`)},"refuse");y!=="act"&&i("invocation forbidden during "+y),D("command "+t.coordinate),m?.aborted&&i("interrupted before invocation"),M(t,b);const j=p+BigInt(t.timeoutMs)*1000000n,E=b.resolve(t),r=Object.freeze({...E,args:Object.freeze([...E.args])});(!C(r.command)||!C(r.cwd))&&i("host invocation needs absolute coordinates"),b.loaderClosure(t,r)!=="verified"&&i("runtime-loader closure unmeasured");const h=Object.keys(l).sort(),w=[...new Set(t.environment)].sort();(h.length!==w.length||h.some((c,v)=>c!==w[v])||h.some(c=>typeof l[c]!="string"||l[c].includes("\0")))&&i("environment differs from declared handoff");const x=N(t,B),d=r.hostEnvelope;d&&(!Number.isSafeInteger(r.envelopeBytes)||r.envelopeBytes<1||d.byteLength>r.envelopeBytes)&&i("host envelope byte resources"),process.hrtime.bigint()>=j&&i("timeout before invocation"),m?.aborted&&i("interrupted before invocation");const O=await new Promise((c,v)=>{const o=k(r.command,[...r.args],{cwd:r.cwd,env:{...l},shell:!1,detached:!1,stdio:d?["pipe","pipe","pipe","pipe"]:["pipe","pipe","pipe"]}),z=[],S=[];let L=0,u,R=!1;const f=a(e=>{if(!u){u=e;try{o.kill("SIGKILL")}catch{}o.stdin.destroy(),d&&o.stdio[3]?.destroy()}},"stop"),P=K(j,()=>f("timeout")),g=a(()=>f("interrupted"),"abort");m?.addEventListener("abort",g,{once:!0}),m?.aborted&&g();const q=a((e,s,U)=>{if(!u){if(L+=s.length,L>t.responseBytes){f("response-bytes exceeded");return}if(U==="stderr"&&t.stderr==="reject"){T.publish({coordinate:t.coordinate,stderr:s.subarray(0,Math.min(t.responseBytes,1024)).toString("utf8")}),f("stderr forbidden");return}e.push(s)}},"collect");o.stdout.on("data",e=>q(z,e,"stdout")),o.stderr.on("data",e=>q(S,e,"stderr")),o.stdin.on("error",()=>f("request handoff failed"));const I=a((e,s)=>{if(!R){if(R=!0,P(),m?.removeEventListener("abort",g),s||u){v(Error(`REFUSE\xB7port ${t.coordinate} ${u??s.message}`));return}c({status:e,interrupted:!1,stdout:Buffer.concat(z).toString("utf8"),stderr:Buffer.concat(S).toString("utf8")})}},"finish");if(o.once("error",e=>I(null,e)),o.once("close",e=>I(e)),d){const e=o.stdio[3],s=Buffer.alloc(8);s.writeBigUInt64BE(BigInt(d.byteLength)),e.on("error",()=>f("host envelope handoff failed")),e.end(Buffer.concat([s,Buffer.from(d)]))}o.stdin.end(x)});return{members:A(t,B,O,$),stderr:O.stderr,invocations:1}}a(te,"executeLot");export{te as executeLot};

package/dist/host/native/custody.js

@@ -1 +1 @@
-var _=Object.defineProperty;var h=(i,g)=>_(i,"name",{value:g,configurable:!0});import{mkdtempSync as $,writeFileSync as z,rmSync as O}from"node:fs";import{tmpdir as A}from"node:os";import{join as B,extname as G}from"node:path";import{fileURLToPath as K,pathToFileURL as Q}from"node:url";import{createHash as V}from"node:crypto";import{library11_parse as X}from"../../vendor/runtime.js";import{processOf as q,ownRoot as Y}from"../../observe/runner.js";import{selectedHostControl as Z}from"./control-selection.js";import{readBoundedFile as R}from"./bounded-file.js";import{authenticateSignedPort as ee}from"./reading.js";import{createProducerJobCustody as te}from"./generated-custodian.js";const d=h(i=>{throw Error("REFUSE\xB7native custody "+i)},"fail"),L=h(i=>"sha256:"+V("sha256").update(i).digest("hex"),"sha");function fe(i,g,p,a,c){const k=c.members.map(t=>{const o=a.locations.find(s=>s.member===t.coordinate);return o?{path:o.path,digest:t.digest}:d("literal member absent")}),F=c.libraries.map(t=>{const o=a.locations.find(s=>s.member===t.manifest);return o?{name:t.name,manifest:o.path,coordinate:t.manifest}:d("library absent")}),H=i.live.flatMap(t=>{const o=X(t);if(o.kind!=="fact"||!o.value.fields.scope.startsWith("port/"))return[];let s;try{s=JSON.parse(o.value.fields.about??"")}catch{return[]}return s?.selector?.port===g.port.coordinate?[{coordinate:o.value.fields.scope,profile:s}]:[]});return{async open(t){const o=H.filter(e=>e.profile.selector.binding===t.binding&&e.profile.selector.implementation===t.implementation),s=o.filter(e=>e.profile.profile==="host-generated-executable@3");if(s.length!==1)return d("requires one current Root producer for "+t.binding);const P=s[0];ee(i,P.coordinate);const l=Z(i,g),U=K(new URL("./generated"+G(new URL(import.meta.url).pathname),import.meta.url)),I=R(U,i.budget.bytes,U),w=a.locations.find(e=>e.member===a.runtime),f=p.members.find(e=>e.coordinate===a.runtime);if(!w||!f)return d("fixed actual runtime absent");const M=o.filter(e=>["host-native-binary@1","host-native-binary-origin@1"].includes(e.profile.profile)).map(e=>{const m=e.profile,y=a.locations.find(u=>u.member===m.entry?.path),n=p.members.find(u=>u.coordinate===m.entry?.path);return!y||!n?d("binary outside actual selected image"):{coordinate:e.coordinate,privateBinding:{coordinate:n.coordinate,path:y.path,digest:n.digest}}}),T=o.filter(e=>e.profile.profile==="host-native-program@1").map(e=>({coordinate:e.coordinate,runtimeBinding:{coordinate:a.runtime,path:w.path,digest:f.digest,members:a.locations.map(m=>({coordinate:m.member,path:m.path}))}})),b=$(B(A(),"bound-native-custody-")),j=B(b,"context.json"),C=B(b,"loader.json");let x;try{x=await te({root:i,coordinate:P.coordinate,implementationBytes:I,snapshot:{budget:{members:p.budget.members,bytes:p.budget.bytes},members:k,libraries:F,builtins:c.builtins,platform:c.platform},nativeImplementations:new Set(c.members.map(r=>r.digest)),directory:b,contextFile:j,nativeBinaries:M,programSelections:T}).open(t);const m=q("custodian"),y=R(m,t.responseBytes,m),n=new URL(Q(q("native-descendant")).href);n.searchParams.set("config",C),n.searchParams.set("bytes",String(p.budget.bytes));let u;if(l){const r=l.profile.worker,E=B(Y(),r.coordinate.slice(16)),J=R(E,r.bytes,r.coordinate);if(J.length!==r.bytes||L(J)!==r.digest)return d("sealed control worker bytes differ");if(l.profile.runtime.coordinate!==a.runtime||l.profile.runtime.digest!==f.digest)return d("sealed control runtime differs");const N=32+2*t.responseBytes;if(!Number.isSafeInteger(N)||N>l.profile.limits.sharedBytes)return d("shared control resource absent");u={profileLine:l.line,realm:l.profile.realm,worker:{...r,path:E},resources:{inputBytes:t.responseBytes,outputBytes:t.responseBytes,sharedBytes:l.profile.limits.sharedBytes}}}const v={...u?{control:u}:{},members:k,libraries:F,builtins:c.builtins,platform:c.platform,executableDigests:c.members.filter(r=>/\.(?:[mc]?js|ts)$/.test(r.coordinate)).map(r=>r.digest),metadataDigests:c.members.filter(r=>r.coordinate.endsWith(".json")).map(r=>r.digest),inputBytes:p.budget.bytes,runtimeBytes:f.bytes.byteLength,clientBytes:y.length,contextBytes:t.responseBytes,custodian:{contextFile:j,client:m,runtime:w.path,preload:n.href,runtimeDigest:f.digest,clientDigest:L(y)}},S=Buffer.from(JSON.stringify(v));if(S.length>p.budget.bytes)return d("operational descendant envelope bytes");z(C,S,{flag:"wx",mode:256}),n.searchParams.set("digest",L(S)),v.custodian.preload=n.href;const W={...v,custodian:{...v.custodian,preload:n.href}},D=x;return{descendant:W,assertClosed:h(()=>D.assertClosed(),"assertClosed"),async close(){try{await D.close()}finally{O(b,{recursive:!0,force:!0})}}}}catch(e){throw await x?.close(),O(b,{recursive:!0,force:!0}),e}}}}h(fe,"nativeRootJobCustody");export{fe as nativeRootJobCustody};
+var _=Object.defineProperty;var h=(i,g)=>_(i,"name",{value:g,configurable:!0});import{mkdtempSync as $,writeFileSync as z,rmSync as O}from"node:fs";import{tmpdir as A}from"node:os";import{join as B,extname as G}from"node:path";import{fileURLToPath as K,pathToFileURL as Q}from"node:url";import{createHash as V}from"node:crypto";import{library14_parse as X}from"../../vendor/runtime.js";import{processOf as q,ownRoot as Y}from"../../observe/runner.js";import{selectedHostControl as Z}from"./control-selection.js";import{readBoundedFile as R}from"./bounded-file.js";import{authenticateSignedPort as ee}from"./reading.js";import{createProducerJobCustody as te}from"./generated-custodian.js";const d=h(i=>{throw Error("REFUSE\xB7native custody "+i)},"fail"),L=h(i=>"sha256:"+V("sha256").update(i).digest("hex"),"sha");function fe(i,g,p,a,c){const k=c.members.map(t=>{const o=a.locations.find(s=>s.member===t.coordinate);return o?{path:o.path,digest:t.digest}:d("literal member absent")}),F=c.libraries.map(t=>{const o=a.locations.find(s=>s.member===t.manifest);return o?{name:t.name,manifest:o.path,coordinate:t.manifest}:d("library absent")}),H=i.live.flatMap(t=>{const o=X(t);if(o.kind!=="fact"||!o.value.fields.scope.startsWith("port/"))return[];let s;try{s=JSON.parse(o.value.fields.about??"")}catch{return[]}return s?.selector?.port===g.port.coordinate?[{coordinate:o.value.fields.scope,profile:s}]:[]});return{async open(t){const o=H.filter(e=>e.profile.selector.binding===t.binding&&e.profile.selector.implementation===t.implementation),s=o.filter(e=>e.profile.profile==="host-generated-executable@3");if(s.length!==1)return d("requires one current Root producer for "+t.binding);const P=s[0];ee(i,P.coordinate);const l=Z(i,g),U=K(new URL("./generated"+G(new URL(import.meta.url).pathname),import.meta.url)),I=R(U,i.budget.bytes,U),w=a.locations.find(e=>e.member===a.runtime),f=p.members.find(e=>e.coordinate===a.runtime);if(!w||!f)return d("fixed actual runtime absent");const M=o.filter(e=>["host-native-binary@1","host-native-binary-origin@1"].includes(e.profile.profile)).map(e=>{const m=e.profile,y=a.locations.find(u=>u.member===m.entry?.path),n=p.members.find(u=>u.coordinate===m.entry?.path);return!y||!n?d("binary outside actual selected image"):{coordinate:e.coordinate,privateBinding:{coordinate:n.coordinate,path:y.path,digest:n.digest}}}),T=o.filter(e=>e.profile.profile==="host-native-program@1").map(e=>({coordinate:e.coordinate,runtimeBinding:{coordinate:a.runtime,path:w.path,digest:f.digest,members:a.locations.map(m=>({coordinate:m.member,path:m.path}))}})),b=$(B(A(),"bound-native-custody-")),j=B(b,"context.json"),C=B(b,"loader.json");let x;try{x=await te({root:i,coordinate:P.coordinate,implementationBytes:I,snapshot:{budget:{members:p.budget.members,bytes:p.budget.bytes},members:k,libraries:F,builtins:c.builtins,platform:c.platform},nativeImplementations:new Set(c.members.map(r=>r.digest)),directory:b,contextFile:j,nativeBinaries:M,programSelections:T}).open(t);const m=q("custodian"),y=R(m,t.responseBytes,m),n=new URL(Q(q("native-descendant")).href);n.searchParams.set("config",C),n.searchParams.set("bytes",String(p.budget.bytes));let u;if(l){const r=l.profile.worker,E=B(Y(),r.coordinate.slice(16)),J=R(E,r.bytes,r.coordinate);if(J.length!==r.bytes||L(J)!==r.digest)return d("sealed control worker bytes differ");if(l.profile.runtime.coordinate!==a.runtime||l.profile.runtime.digest!==f.digest)return d("sealed control runtime differs");const N=32+2*t.responseBytes;if(!Number.isSafeInteger(N)||N>l.profile.limits.sharedBytes)return d("shared control resource absent");u={profileLine:l.line,realm:l.profile.realm,worker:{...r,path:E},resources:{inputBytes:t.responseBytes,outputBytes:t.responseBytes,sharedBytes:l.profile.limits.sharedBytes}}}const v={...u?{control:u}:{},members:k,libraries:F,builtins:c.builtins,platform:c.platform,executableDigests:c.members.filter(r=>/\.(?:[mc]?js|ts)$/.test(r.coordinate)).map(r=>r.digest),metadataDigests:c.members.filter(r=>r.coordinate.endsWith(".json")).map(r=>r.digest),inputBytes:p.budget.bytes,runtimeBytes:f.bytes.byteLength,clientBytes:y.length,contextBytes:t.responseBytes,custodian:{contextFile:j,client:m,runtime:w.path,preload:n.href,runtimeDigest:f.digest,clientDigest:L(y)}},S=Buffer.from(JSON.stringify(v));if(S.length>p.budget.bytes)return d("operational descendant envelope bytes");z(C,S,{flag:"wx",mode:256}),n.searchParams.set("digest",L(S)),v.custodian.preload=n.href;const W={...v,custodian:{...v.custodian,preload:n.href}},D=x;return{descendant:W,assertClosed:h(()=>D.assertClosed(),"assertClosed"),async close(){try{await D.close()}finally{O(b,{recursive:!0,force:!0})}}}}catch(e){throw await x?.close(),O(b,{recursive:!0,force:!0}),e}}}}h(fe,"nativeRootJobCustody");export{fe as nativeRootJobCustody};

package/dist/host/native/generated-custodian.js

@@ -1,4 +1,4 @@
-var Q=Object.defineProperty;var a=(e,o)=>Q(e,"name",{value:o,configurable:!0});import{sha256 as I}from"../hash.js";import{createServer as X,createConnection as V}from"node:net";import{chmodSync as Y,rmSync as D,realpathSync as A,writeFileSync as Z,renameSync as ee,existsSync as re}from"node:fs";import{join as te}from"node:path";import{randomBytes as L}from"node:crypto";import{canonicalJson as B}from"./reading.js";import{verifyNativeBinary as oe,nativeBinaryProjection as ne}from"./native-binary.js";import{library2_commandRequest as ie,library2_commandResponse as se}from"../../vendor/runtime.js";import{assertProducerInterpretation as ae,chargeProducerRequest as ce,createGeneratedProducer as de,readBounded as z,validateDescendantInvocation as G,sealGeneratedFile as ue,sealNativeEval as pe,sealInterpretation as me,recordProducerEmission as fe,recordProducerEmissions as le,registerProducerCandidates as ye,gateDerived as _,producerTransport as Ee,producerUsage as $}from"./generated.js";import{retainedNativeEvalMatches as ge}from"./node-launch.js";import{verifyNativeProgram as he,nativeProgramProjection as ve}from"./native-program.js";function Se(e,o){if(o.length>e.responseBytes||Buffer.byteLength(o)>e.responseBytes)return;const m=JSON.stringify({protocol:"command-lot/1",coordinate:e.coordinate,implementation:e.implementation,identity:e.identity,responses:[{kind:"refuse",why:o}]})+`
+var Q=Object.defineProperty;var a=(e,o)=>Q(e,"name",{value:o,configurable:!0});import{sha256 as I}from"../hash.js";import{createServer as X,createConnection as V}from"node:net";import{chmodSync as Y,rmSync as D,realpathSync as A,writeFileSync as Z,renameSync as ee,existsSync as re}from"node:fs";import{join as te}from"node:path";import{randomBytes as L}from"node:crypto";import{canonicalJson as B}from"./reading.js";import{verifyNativeBinary as oe,nativeBinaryProjection as ne}from"./native-binary.js";import{library5_commandRequest as ie,library5_commandResponse as se}from"../../vendor/runtime.js";import{assertProducerInterpretation as ae,chargeProducerRequest as ce,createGeneratedProducer as de,readBounded as z,validateDescendantInvocation as G,sealGeneratedFile as ue,sealNativeEval as pe,sealInterpretation as me,recordProducerEmission as fe,recordProducerEmissions as le,registerProducerCandidates as ye,gateDerived as _,producerTransport as Ee,producerUsage as $}from"./generated.js";import{retainedNativeEvalMatches as ge}from"./node-launch.js";import{verifyNativeProgram as he,nativeProgramProjection as ve}from"./native-program.js";function Se(e,o){if(o.length>e.responseBytes||Buffer.byteLength(o)>e.responseBytes)return;const m=JSON.stringify({protocol:"command-lot/1",coordinate:e.coordinate,implementation:e.implementation,identity:e.identity,responses:[{kind:"refuse",why:o}]})+`
 `;return Buffer.byteLength(m)<=e.responseBytes?m:void 0}a(Se,"boundedRefusalFrame");async function we(e,o,m,S,b=[]){const u=b.map(t=>({identity:t.identity,program:{...t.program}}));if(u.some(t=>!/^sha256:[0-9a-f]{64}$/.test(t.identity)||t.program.kind!=="native-binary"||typeof t.program.alias!="string"||!t.program.alias.length||!t.program.entry.startsWith("/")||!/^sha256:[0-9a-f]{64}$/.test(t.program.entryDigest)||!Number.isSafeInteger(t.program.entryBytes)||t.program.entryBytes<1||t.program.entryBytes>o.budget.bytes||!t.program.condition)||new Set(u.map(t=>t.program.alias)).size!==u.length)throw Error("REFUSE\xB7producer native program selection ambiguous/over budget");const f=Ee(e),i={...f,deadlineMs:Date.now()+f.timeoutMs,socket:te(S,"p-"+L(6).toString("hex")),token:L(32).toString("hex")},v=new Set,h=new Set,c=[],d=new Set(o.members.map(t=>t.digest)),w=new Map,P=new Map;let q=0;const C=a(t=>{const y={...t};for(const R of["invocation","edges"])if(y[R]?.retainedValue){const F=P.get(y[R].retainedValue);if(F===void 0)throw Error("REFUSE\xB7producer retained value absent");y[R]=F}return y},"reconstruct"),W=a(t=>{const y=w.get(t.identity);if(y){if(B(C(y))!==B(t))throw Error("REFUSE\xB7producer context identity collision");return}const R={...t},F=new Map;for(const p of["invocation","edges"]){const l=t[p];if(l&&typeof l=="object"){const E=B(l),n=I(E),g=P.get(n);if(g!==void 0&&B(g)!==E)throw Error("REFUSE\xB7producer retained value collision");g===void 0&&!F.has(n)&&F.set(n,JSON.parse(E)),R[p]={retainedValue:n}}}let k=Buffer.byteLength(B(R));for(const[p,l]of F)k+=Buffer.byteLength(B([p,l]));if(k>f.responseBytes-q)throw Error("REFUSE\xB7producer retained contexts bytes");for(const[p,l]of F)P.set(p,l);w.set(t.identity,R),q+=k},"retainContext"),O=X(t=>{try{if(ce(e),Date.now()>=i.deadlineMs)throw Error("REFUSE\xB7producer parent deadline")}catch(p){c.push(p instanceof Error?p.message:String(p)),t.destroy();return}v.add(t),h.add(t);const y=a(p=>{const l=a(()=>h.delete(t),"done");p===void 0?t.end(l):t.end(p,l)},"finishReply");t.once("error",()=>{c.length||c.push("REFUSE\xB7producer IPC response interrupted")}),t.setTimeout(Math.max(1,i.deadlineMs-Date.now()),()=>{c.push("REFUSE\xB7producer IPC timeout"),t.destroy()});const R=[];let F=0,k=!1;t.on("data",p=>{if(F+=p.length,F>i.responseBytes){c.push("REFUSE\xB7producer IPC request bytes"),t.destroy();return}if(R.push(p),!!p.includes(10)&&!k){k=!0,t.pause();try{const l=Buffer.concat(R).toString("utf8");if(c.length)throw Error(c[0]);const E=JSON.parse(l.trim());if(E.protocol!=="command-lot/1"||E.coordinate!==i.coordinate||E.implementation!==i.implementation||E.identity!==i.identity||!Array.isArray(E.requests)||E.requests.length!==1)throw Error("REFUSE\xB7producer IPC frame");const n=JSON.parse(E.requests[0]);if(n.token!==i.token||!["entry","emission","emission-batch","native-program","interpretation","eval-context","violation"].includes(n.operation))throw Error("REFUSE\xB7producer IPC capability");if(n.operation==="violation")throw typeof n.why!="string"||n.why.length>i.responseBytes||Buffer.byteLength(n.why)>i.responseBytes?Error("REFUSE\xB7producer violation bytes"):Error("REFUSE\xB7producer pre-entry "+n.why);let g;if(n.operation==="eval-context"){const r=n.request,s=[...w.values()].map(C).filter(U=>ge(U,r));if(s.length!==1)throw Error("REFUSE\xB7producer retained eval context "+(s.length?"ambiguous":"absent"));g=s[0]}else if(n.operation==="emission-batch"){const r=n.request;if(!r||!Array.isArray(r.outputs)||r.outputs.length>f.limits.work)throw Error("REFUSE\xB7producer emission batch context/count absent");g=le(e,r.outputs,r.invocation)}else if(n.operation==="emission"){const r=n.request;if(!r||typeof r.path!="string")throw Error("REFUSE\xB7producer emission context absent");g=fe(e,r.path,r.invocation)}else if(n.operation==="native-program"){const r=n.request;if(!r||typeof r.alias!="string"||typeof r.path!="string")throw Error("REFUSE\xB7producer native invocation absent");const s=u.find(K=>K.program.alias===r.alias);if(!s)throw Error("REFUSE\xB7producer native program alias undeclared "+r.alias);const U=G(e,r.invocation);let x;try{x=A(r.path)}catch{throw Error("REFUSE\xB7producer native program target absent")}if(x!==s.program.entry)throw Error("REFUSE\xB7producer native program route differs");const M=z(x,s.program.entryBytes),J=I(M);if(M.length!==s.program.entryBytes||J!==s.program.entryDigest)throw Error("REFUSE\xB7producer native program bytes differ");const T={kind:"native-program-transaction/1",parent:f.parent,producer:f.identity,program:s.identity,alias:s.program.alias,target:x,digest:J,byteLength:M.length,invocation:U,condition:s.program.condition};g={...T,identity:I(JSON.stringify(T))}}else if(n.operation==="interpretation"){const r=n.request;if(!r||typeof r.path!="string"||typeof r.interpretation!="string")throw Error("REFUSE\xB7producer interpretation context absent");g=me(e,r.path,r.interpretation,r.invocation)}else{const r=n.request;if(!r||!["module","commonjs"].includes(r.mode))throw Error("REFUSE\xB7producer unknown entry mode");if(r.candidates!==void 0&&ye(e,r.candidates),r.kind==="file"){if(r.interpretation!==void 0&&(ae(e,r.interpretation),r.interpretation!=="node-ambiguous-javascript@1"))throw Error("REFUSE\xB7producer entry interpretation unsupported");if(!r.path)throw Error("REFUSE\xB7producer missing path");const s=A(r.path),U=z(s,o.budget.bytes);if(U.length>o.budget.bytes)throw Error("REFUSE\xB7producer static input bytes");const x=I(U);if(d.has(x))g={kind:"mounted-executable/1",parent:f.parent,producer:f.identity,path:s,digest:x,mode:r.mode,...r.interpretation===void 0?{}:{interpretation:r.interpretation},invocation:G(e,r.invocation),identity:I(JSON.stringify([f.parent,f.identity,s,x,r.mode,r.invocation,...r.interpretation===void 0?[]:[r.interpretation]])),qualification:m.has(x)?"separately selected privileged native implementation":"same sealed content mounted at actual path"};else{const M=ue(e,s,r.mode,r.invocation,r.interpretation),J=_(e,M,{path:s},o,m);g={...M,edges:J}}}else if(r.kind==="eval"){if(!r.argv||!r.rootPrefix)throw Error("REFUSE\xB7producer missing eval binding");const s=pe(e,r.argv,r.rootPrefix,r.invocation);if(s.mode!==r.mode)throw Error("REFUSE\xB7producer eval mode differs from argv");const U=_(e,s,{argv:r.argv},o,m);g={...s,edges:U}}else throw Error("REFUSE\xB7producer unknown entry kind")}W(g);const j=JSON.stringify({protocol:"command-lot/1",coordinate:i.coordinate,implementation:i.implementation,identity:i.identity,responses:[{kind:"entry-context",context:g,usage:$(e)}]})+`
 `;if(Buffer.byteLength(j)>i.responseBytes)throw Error("REFUSE\xB7producer IPC response bytes");y(j)}catch(l){const E=l instanceof Error?l.message:String(l);c.length||c.push(E);const n=Se(i,E);if(n===void 0){y();return}y(n)}}}),t.once("close",()=>{h.delete(t)&&!c.length&&c.push("REFUSE\xB7producer IPC interrupted before bounded reply"),v.delete(t)})});await new Promise((t,y)=>{O.once("error",y),O.listen(i.socket,()=>{Y(i.socket,384),t()})});const H=setTimeout(()=>{c.push("REFUSE\xB7producer parent deadline");for(const t of v)t.destroy()},i.timeoutMs);return{endpoint:i,get contexts(){return[...w.values()].map(C)},retention:a(()=>({bytes:q,contexts:[...w.values()].map(t=>JSON.parse(B(t))),values:[...P].map(([t,y])=>[t,JSON.parse(B(y))])}),"retention"),assertClosed:a(()=>{if(Date.now()>=i.deadlineMs)throw Error("REFUSE\xB7producer parent deadline");if(c.length)throw Error(c[0]);if(h.size)throw Error("REFUSE\xB7producer IPC unfinished")},"assertClosed"),refusals:c,usage:a(()=>$(e),"usage"),close:a(async()=>{clearTimeout(H);for(const t of v)t.destroy();await new Promise(t=>O.close(()=>t())),D(i.socket,{force:!0})},"close")}}a(we,"startProducerCustodian");async function Ie(e,o){return N(e,"eval-context",o)}a(Ie,"requestRetainedEvalContext");async function Je(e,o){return N(e,"entry",o)}a(Je,"requestProducerEntry");async function Oe(e,o){return N(e,"interpretation",o)}a(Oe,"requestProducerInterpretation");async function De(e,o){return N(e,"native-program",o)}a(De,"requestNativeProgram");async function Le(e,o){return N(e,"emission",o)}a(Le,"requestProducerEmission");async function je(e,o){return N(e,"emission-batch",o)}a(je,"requestProducerEmissionBatch");async function N(e,o,m){const S={coordinate:e.coordinate,implementation:e.implementation,closure:[e.implementation],timeoutMs:e.timeoutMs,responseBytes:e.responseBytes,environment:[],stderr:"reject"},b={identity:e.identity,requests:[JSON.stringify({operation:o,token:e.token,request:m})]},u=ie(S,b);if(Buffer.byteLength(u)>e.responseBytes)throw Error("REFUSE\xB7producer IPC request bytes");const f=await new Promise((h,c)=>{const d=V(e.socket),w=[],P=setTimeout(()=>d.destroy(Error("REFUSE\xB7producer IPC timeout")),Math.max(1,Math.min(e.timeoutMs,e.deadlineMs-Date.now())));let q=0;d.on("connect",()=>d.write(u+`
 `)),d.on("data",C=>{q+=C.length,q>e.responseBytes?d.destroy(Error("REFUSE\xB7producer IPC response bytes")):w.push(C)}),d.once("error",c),d.once("close",()=>{clearTimeout(P),h(Buffer.concat(w).toString("utf8"))})}),v=se(S,b,{status:0,interrupted:!1,stdout:f,stderr:""},h=>!!h&&typeof h=="object"&&["entry-context","refuse"].includes(h.kind))[0];if(v.kind==="refuse")throw Error(v.why);return v.context}a(N,"requestProducerOperation");function Te(e){let o=!1;return{async open(m){if(o||re(e.contextFile))throw Error("REFUSE\xB7producer execution context occupied");o=!0;let S;const b=e.contextFile+"."+L(6).toString("hex");try{const u=(e.programSelections??[]).map(d=>ve(he(e.root,d.coordinate,m,d.runtimeBinding))),f=de(e.root,e.coordinate,m,e.implementationBytes),i=(e.nativeBinaries??[]).map(d=>{const w=oe(e.root,d.coordinate,m,d.privateBinding);return{identity:w.identity,program:ne(w)}});S=await we(f,e.snapshot,e.nativeImplementations,e.directory,i);const v=[...u,...i.map(d=>d.program)];if(new Set(v.map(d=>d.alias)).size!==v.length)throw Error("REFUSE\xB7producer native alias ambiguous");const h=JSON.stringify({endpoint:S.endpoint,parentExecution:m,programs:v});if(Buffer.byteLength(h)>m.responseBytes)throw Error("REFUSE\xB7producer execution context bytes");Z(b,h,{flag:"wx",mode:384}),ee(b,e.contextFile);const c=S;return{assertClosed:a(()=>c.assertClosed(),"assertClosed"),async close(){try{await c.close()}finally{D(e.contextFile,{force:!0}),o=!1}}}}catch(u){throw D(b,{force:!0}),await S?.close(),o=!1,u}}}}a(Te,"createProducerJobCustody");async function Ve(e,o){if(typeof o!="string"||o.length>e.responseBytes||Buffer.byteLength(o)>e.responseBytes)throw Error("REFUSE\xB7producer violation bytes");const m=JSON.stringify({protocol:"command-lot/1",coordinate:e.coordinate,implementation:e.implementation,identity:e.identity,requests:[JSON.stringify({operation:"violation",token:e.token,why:o})]});throw await new Promise((S,b)=>{const u=V(e.socket),f=setTimeout(()=>u.destroy(Error("REFUSE\xB7producer IPC timeout")),Math.max(1,e.deadlineMs-Date.now()));u.once("connect",()=>u.write(m+`

package/dist/host/native/installed-package.d.ts

@@ -0,0 +1 @@
+export {public3_InstalledPackageMember as InstalledPackageMember,public3_InstalledPackagePin as InstalledPackagePin,public3_InstalledPackageRequest as InstalledPackageRequest,public3_installedPackageIdentity as installedPackageIdentity} from "../../public-types.js";

package/dist/host/native/installed-package.js

@@ -0,0 +1,5 @@
+var G=Object.defineProperty;var h=(n,i)=>G(n,"name",{value:i,configurable:!0});import{lstatSync as I,readdirSync as H,realpathSync as F}from"node:fs";import{join as Q,posix as V,relative as P,sep as T,isAbsolute as X}from"node:path";import{library14_canonical as Y}from"../../vendor/runtime.js";import{library5_moduleInventory as Z,library5_inventoryBytes as $}from"../../vendor/runtime.js";import{archiveCoordinate as O}from"../archive.js";import{sha256 as l,isSha256 as _}from"../hash.js";import{compareStrings as A}from"../order.js";import{BoundRefusal as q,refuseBound as s}from"../refusals.js";import{readBoundedFile as ee}from"./bounded-file.js";import{deliverModuleClosure as te}from"./module-delivery.js";import{moduleInventory as se}from"./module-inventory.js";function ue(n){const{limits:i}=n;(!i||!Number.isSafeInteger(i.members)||i.members<1||!Number.isSafeInteger(i.bytes)||i.bytes<1||!Number.isSafeInteger(i.responseBytes)||i.responseBytes<1)&&s("installed/resources"),i.signal?.aborted&&s("installed/cancelled"),(!Array.isArray(n.members)||!n.members.length||n.members.length>i.members||!Array.isArray(n.exports)||!n.exports.length||n.exports.length>i.members||!Array.isArray(n.pins)||n.pins.length>i.members)&&s("installed/resources");const g=new Map;for(const e of n.members)(O(e.coordinate)!==e.coordinate||!_(e.digest)||g.has(e.coordinate))&&s("installed/inventory"),g.set(e.coordinate,e.digest);let b;try{(!I(n.directory).isDirectory()||I(n.directory).isSymbolicLink())&&s("installed/external-member"),b=F(n.directory)}catch(e){if(e instanceof q)throw e;return s("installed/missing-member")}const f=new Map;let v=0,z=0;function N(e){for(const t of H(e).sort(A)){i.signal?.aborted&&s("installed/cancelled"),++z>i.members*2&&s("installed/resources");const r=Q(e,t),a=P(b,r).split(T).join("/"),c=I(r);(c.isSymbolicLink()||!c.isDirectory()&&!c.isFile())&&s("installed/external-member");const M=P(b,F(r));if((X(M)||M===".."||M.startsWith(".."+T))&&s("installed/external-member"),c.isDirectory()){N(r);continue}const C=g.get(a);C===void 0&&s("installed/uninventoried-member");const j=ee(r,i.bytes-v,a);v+=j.length,l(j)!==C&&s("installed/member-integrity"),f.set(a,j)}}h(N,"walk"),N(b),f.size!==g.size&&s("installed/missing-member");const D=O(n.shape+".json"),y=f.get(D);y||s("installed/manifest");let o;try{o=JSON.parse(new TextDecoder("utf-8",{fatal:!0}).decode(y))}catch{return s("installed/manifest")}(!o||typeof o.name!="string"||!o.name||typeof o.version!="string"||!o.version||o.type!=="module")&&s("installed/manifest");const m=h((e,t,r={})=>Y({scope:e,role:"writes",form:"alphabet",measure:"digest",value:t,by:"target",at:"place:installed-package",...r}),"line"),J=[...f].sort(([e],[t])=>A(e,t)).map(([e,t])=>m("file/"+e,l(t))),R=J.join(`
+`)+`
+`,d=l(R),u=l(y),W=new Map([...f].filter(([e])=>[".js",".mjs",".cjs",".ts",".json"].includes(V.extname(e))).map(([e,t])=>{let r;try{r=new TextDecoder("utf-8",{fatal:!0,ignoreBOM:!0}).decode(t)}catch{return s("installed/text-member")}return[e,{source:r,digest:l(t)}]})),K=new Map([[u,y]]),x=new Map,U=n.exports.map(e=>{let t=o;e[0]!=="exports"&&s("installed/export");for(const c of e)(!t||typeof t!="object"||Array.isArray(t)||!Object.prototype.hasOwnProperty.call(t,c))&&s("installed/export"),t=t[c];(typeof t!="string"||!t.startsWith("./"))&&s("installed/export");const r=O(t.slice(2)),a=f.get(r);return a||s("installed/missing-member"),x.set(JSON.stringify(e),{identity:d,entry:r,members:W}),{source:o.name,version:o.version,holder:"installed-package",unitKind:"module",unit:r,reached:!0,reachedFrom:{digest:u,selector:e},moduleBytes:a}}),L=Z(U,{documents:K,digestBytes:l}),S=new Map;for(const e of n.pins){const t=JSON.stringify([e.parent==="self"?d:e.parent,e.specifier]);(S.has(t)||!_(e.snapshot)||e.module.identity!==e.snapshot)&&s("installed/pin"),S.set(t,e)}const w=new Map,p=te([...x.keys()],x,(e,t)=>{const r=JSON.stringify([t.identity,e]),a=S.get(r);return a&&w.set(r,a),a?.module},i,[{snapshot:d,coordinate:D,digest:u,source:new TextDecoder("utf-8",{fatal:!0,ignoreBOM:!0}).decode(y)}]),k=new Map([[d,{snapshot:d,source:o.name,version:o.version}]]);for(const e of w.values()){const t=k.get(e.snapshot);t&&(t.source!==e.source||t.version!==e.version)&&s("installed/pin"),k.set(e.snapshot,{snapshot:e.snapshot,source:e.source,version:e.version})}const E=se(p.bytes,p.digest,i,[...k.values()],{scope:"installed/modules",by:"target",at:"place:installed-package"}),B=[m("installed/profile","bound-installed-package@1",{measure:"id"}),m("installed/manifest",u,{about:JSON.stringify([n.shape,o.name,o.version])}),...J,m("installed/exports",l($(L))),m("installed/closure",p.closure),m("installed/delivery",p.digest),...p.manifest.libraries.map(e=>m("installed/pins/"+encodeURIComponent(JSON.stringify([e.parent==="self"?d:e.parent,e.specifier])),e.snapshot,{about:e.entry}))].sort(A).join(`
+`)+`
+`;return Buffer.byteLength(B)>i.responseBytes&&s("installed/resources"),{format:"bound-installed-package/1",digest:l(B),lines:B,snapshot:d,manifest:u,members:n.members.length,bytes:v,exportInventory:L,modules:E,delivery:p,consumedPins:[...w.values()].map(({module:e,...t})=>t)}}h(ue,"installedPackageIdentity");export{ue as installedPackageIdentity};

package/dist/host/native/module-delivery.d.ts

@@ -1 +1 @@
-export {public3_ClosureDelivery as ClosureDelivery,public3_ClosureDeliveryLimits as ClosureDeliveryLimits,public3_ClosureDeliveryManifest as ClosureDeliveryManifest,public3_ClosureNotice as ClosureNotice,public3_ModuleClosureSnapshot as ModuleClosureSnapshot,public3_deliverModuleClosure as deliverModuleClosure,public3_moduleSnapshot as moduleSnapshot,public3_verifyModuleDelivery as verifyModuleDelivery} from "../../public-types.js";
+export {public4_ClosureDelivery as ClosureDelivery,public4_ClosureDeliveryLimits as ClosureDeliveryLimits,public4_ClosureDeliveryManifest as ClosureDeliveryManifest,public4_ClosureNotice as ClosureNotice,public4_ModuleClosureSnapshot as ModuleClosureSnapshot,public4_ModuleInventory as ModuleInventory,public4_ModuleInventoryContext as ModuleInventoryContext,public4_ModuleInventoryLine as ModuleInventoryLine,public4_ModuleInventorySource as ModuleInventorySource,public4_deliverModuleClosure as deliverModuleClosure,public4_moduleInventory as moduleInventory,public4_moduleSnapshot as moduleSnapshot,public4_verifyModuleDelivery as verifyModuleDelivery} from "../../public-types.js";

package/dist/host/native/module-delivery.js

@@ -1 +1 @@
-var H=Object.defineProperty;var f=(r,a)=>H(r,"name",{value:a,configurable:!0});import{posix as k}from"node:path";import{sha256 as b,isSha256 as w}from"../hash.js";import{archiveCoordinate as R}from"../archive.js";import{compareStrings as z}from"../order.js";import{moduleClosures as q}from"./module-closure.js";import{moduleSnapshot as Z}from"./module-closure.js";const o=f(r=>{throw Error("REFUSE\xB7closure delivery "+r)},"fail"),m=f((r,a)=>JSON.stringify([r,a]),"key"),M=f((r,a)=>w(r)?"modules/"+r.slice(7)+"/"+a:o("snapshot identity is not SHA-256"),"pathOf"),C=f(r=>"./"+r.split("/").map(encodeURIComponent).join("/"),"urlOf"),I=f(r=>{(!r||!Number.isSafeInteger(r.members)||r.members<1||!Number.isSafeInteger(r.bytes)||r.bytes<1||!Number.isSafeInteger(r.responseBytes)||r.responseBytes<1)&&o("missing resources"),r.signal?.aborted&&o("cancelled")},"resourceLimits");function F(r,a,d,i,n=[]){I(i),(!Array.isArray(n)||n.length>=i.members)&&o("notice resources");let l=0;const u=new Set,B=n.map(e=>{(!e||typeof e.coordinate!="string"||R(e.coordinate)!==e.coordinate||typeof e.source!="string"||!w(e.digest)||b(e.source)!==e.digest||(l+=Buffer.byteLength(e.source))>=i.bytes)&&o("notice bytes/resources");const s="notices/"+M(e.snapshot,e.coordinate).slice(8);return u.has(s)&&o("duplicate notice"),u.add(s),{snapshot:e.snapshot,coordinate:e.coordinate,digest:e.digest,path:s}}).sort((e,s)=>z(e.path,s.path));(!Array.isArray(r)||!r.length||r.length>i.members||r.some(e=>typeof e!="string"||!e||Buffer.byteLength(e)>i.bytes))&&o("missing/oversized needs");const v=[...new Set(r)].sort(z),h=new Map,y=new Map,N=f(e=>{if(!e||!w(e.identity))return o("snapshot identity is not SHA-256");const s=h.get(e.identity);return s&&s.members!==e.members&&o("ambiguous snapshot members"),h.set(e.identity,e),e},"hold"),g=v.map(e=>{const s=a.get(e);return s?N(s):o("unknown need "+e)}),t=q(g,(e,s)=>{const O=d(e,s);if(!O)return;const S=N(O),L=m(s.identity,e),D={parent:s.identity,specifier:e,snapshot:S.identity,entry:S.entry},x=y.get(L);return x&&(x.snapshot!==S.identity||x.entry!==S.entry)&&o("ambiguous library resolution"),!x&&y.size>=i.members&&o("library resources"),y.set(L,D),S},{...i,members:i.members-n.length,bytes:i.bytes-l,portableESM:!0});n.some(e=>!t.some(s=>s.snapshot===e.snapshot))&&o("notice outside reached snapshots");const c=[...t].sort((e,s)=>z(m(e.snapshot,e.coordinate),m(s.snapshot,s.coordinate))).map(e=>({...e,path:M(e.snapshot,e.coordinate)})),p=c.map(e=>{const s=h.get(e.snapshot)?.members.get(e.coordinate)?.source;return(s===void 0||b(s)!==e.digest)&&o("snapshot changed during delivery"),{path:e.path,source:s}});for(const e of B)p.push({path:e.path,source:n.find(s=>s.snapshot===e.snapshot&&s.coordinate===e.coordinate).source});const A={format:"esm-file-closure/1",needs:v.map((e,s)=>({name:e,snapshot:g[s].identity,entry:k.normalize(g[s].entry)})),modules:c,libraries:[...y.values()].sort((e,s)=>z(m(e.parent,e.specifier),m(s.parent,s.specifier))),notices:B},U=b(JSON.stringify(A)),E=Buffer.from(JSON.stringify({manifest:A,files:p}),"utf8");E.length>i.responseBytes&&o("response resources"),i.signal?.aborted&&o("cancelled");const j=Object.fromEntries(A.needs.map(e=>[e.name,C(M(e.snapshot,e.entry))])),J={};for(const e of A.libraries){const s="./modules/"+e.parent.slice(7)+"/",O=J[s]??(J[s]=Object.create(null));O[e.specifier]=C(M(e.snapshot,k.normalize(e.entry)))}return{closure:U,digest:b(E),bytes:new Uint8Array(E),manifest:A,files:p,importMap:{imports:j,scopes:J}}}f(F,"deliverModuleClosure");function W(r,a,d){I(d),(!(r instanceof Uint8Array)||r.byteLength>d.responseBytes||!w(a)||b(r)!==a)&&o("bundle bytes differ or exceed resources");let i;try{i=JSON.parse(new TextDecoder("utf-8",{fatal:!0}).decode(r))}catch{return o("invalid JSON bytes")}const n=i?.manifest;(n?.format!=="esm-file-closure/1"||!Array.isArray(n.needs)||!Array.isArray(n.modules)||!Array.isArray(n.libraries)||!Array.isArray(n.notices)||!Array.isArray(i.files)||n.modules.length+n.notices.length>d.members||i.files.length!==n.modules.length+n.notices.length||n.needs.length>d.members||n.libraries.length>d.members)&&o("invalid manifest resources");const l=new Map,u=new Map;let B=0;for(const t of i.files)(typeof t?.path!="string"||typeof t.source!="string"||u.has(t.path)||(B+=Buffer.byteLength(t.source))>d.bytes)&&o("invalid/duplicate file resources"),u.set(t.path,t.source);for(const t of n.modules){(!t||typeof t.coordinate!="string"||typeof t.path!="string"||t.path!==M(t.snapshot,t.coordinate)||!w(t.digest))&&o("invalid module");const c=u.get(t.path);(c===void 0||b(c)!==t.digest)&&o("module bytes differ");const p=l.get(t.snapshot)??new Map;p.has(t.coordinate)&&o("duplicate module"),p.set(t.coordinate,{source:c,digest:t.digest}),l.set(t.snapshot,p)}const v=f((t,c)=>{const p=l.get(t);return!p||typeof c!="string"?o("unknown snapshot/entry"):{identity:t,entry:c,members:p}},"snapshot"),h=new Map;for(const t of n.needs)(typeof t?.name!="string"||h.has(t.name))&&o("invalid/duplicate need"),h.set(t.name,v(t.snapshot,t.entry));const y=new Map;for(const t of n.libraries)(typeof t?.parent!="string"||typeof t.specifier!="string"||y.has(m(t.parent,t.specifier)))&&o("invalid/duplicate library"),y.set(m(t.parent,t.specifier),v(t.snapshot,t.entry));const N=n.notices.map(t=>!t||typeof t.path!="string"||!u.has(t.path)?o("missing notice"):{snapshot:t.snapshot,coordinate:t.coordinate,digest:t.digest,source:u.get(t.path)}),g=F([...h.keys()],h,(t,c)=>y.get(m(c.identity,t)),d,N);return g.digest!==a&&o("noncanonical, extra or unresolved delivery members"),g}f(W,"verifyModuleDelivery");export{F as deliverModuleClosure,Z as moduleSnapshot,W as verifyModuleDelivery};
+var H=Object.defineProperty;var f=(r,a)=>H(r,"name",{value:a,configurable:!0});import{posix as L}from"node:path";import{sha256 as b,isSha256 as w}from"../hash.js";import{archiveCoordinate as R}from"../archive.js";import{compareStrings as z}from"../order.js";import{moduleClosures as q}from"./module-closure.js";import{moduleSnapshot as Z}from"./module-closure.js";import{moduleInventory as $}from"./module-inventory.js";const o=f(r=>{throw Error("REFUSE\xB7closure delivery "+r)},"fail"),m=f((r,a)=>JSON.stringify([r,a]),"key"),M=f((r,a)=>w(r)?"modules/"+r.slice(7)+"/"+a:o("snapshot identity is not SHA-256"),"pathOf"),k=f(r=>"./"+r.split("/").map(encodeURIComponent).join("/"),"urlOf"),C=f(r=>{(!r||!Number.isSafeInteger(r.members)||r.members<1||!Number.isSafeInteger(r.bytes)||r.bytes<1||!Number.isSafeInteger(r.responseBytes)||r.responseBytes<1)&&o("missing resources"),r.signal?.aborted&&o("cancelled")},"resourceLimits");function F(r,a,d,i,n=[]){C(i),(!Array.isArray(n)||n.length>=i.members)&&o("notice resources");let l=0;const u=new Set,B=n.map(e=>{(!e||typeof e.coordinate!="string"||R(e.coordinate)!==e.coordinate||typeof e.source!="string"||!w(e.digest)||b(e.source)!==e.digest||(l+=Buffer.byteLength(e.source))>=i.bytes)&&o("notice bytes/resources");const s="notices/"+M(e.snapshot,e.coordinate).slice(8);return u.has(s)&&o("duplicate notice"),u.add(s),{snapshot:e.snapshot,coordinate:e.coordinate,digest:e.digest,path:s}}).sort((e,s)=>z(e.path,s.path));(!Array.isArray(r)||!r.length||r.length>i.members||r.some(e=>typeof e!="string"||!e||Buffer.byteLength(e)>i.bytes))&&o("missing/oversized needs");const v=[...new Set(r)].sort(z),h=new Map,y=new Map,N=f(e=>{if(!e||!w(e.identity))return o("snapshot identity is not SHA-256");const s=h.get(e.identity);return s&&s.members!==e.members&&o("ambiguous snapshot members"),h.set(e.identity,e),e},"hold"),g=v.map(e=>{const s=a.get(e);return s?N(s):o("unknown need "+e)}),t=q(g,(e,s)=>{const O=d(e,s);if(!O)return;const S=N(O),J=m(s.identity,e),D={parent:s.identity,specifier:e,snapshot:S.identity,entry:S.entry},x=y.get(J);return x&&(x.snapshot!==S.identity||x.entry!==S.entry)&&o("ambiguous library resolution"),!x&&y.size>=i.members&&o("library resources"),y.set(J,D),S},{...i,members:i.members-n.length,bytes:i.bytes-l,portableESM:!0});n.some(e=>!t.some(s=>s.snapshot===e.snapshot))&&o("notice outside reached snapshots");const c=[...t].sort((e,s)=>z(m(e.snapshot,e.coordinate),m(s.snapshot,s.coordinate))).map(e=>({...e,path:M(e.snapshot,e.coordinate)})),p=c.map(e=>{const s=h.get(e.snapshot)?.members.get(e.coordinate)?.source;return(s===void 0||b(s)!==e.digest)&&o("snapshot changed during delivery"),{path:e.path,source:s}});for(const e of B)p.push({path:e.path,source:n.find(s=>s.snapshot===e.snapshot&&s.coordinate===e.coordinate).source});const A={format:"esm-file-closure/1",needs:v.map((e,s)=>({name:e,snapshot:g[s].identity,entry:L.normalize(g[s].entry)})),modules:c,libraries:[...y.values()].sort((e,s)=>z(m(e.parent,e.specifier),m(s.parent,s.specifier))),notices:B},U=b(JSON.stringify(A)),E=Buffer.from(JSON.stringify({manifest:A,files:p}),"utf8");E.length>i.responseBytes&&o("response resources"),i.signal?.aborted&&o("cancelled");const j=Object.fromEntries(A.needs.map(e=>[e.name,k(M(e.snapshot,e.entry))])),I={};for(const e of A.libraries){const s="./modules/"+e.parent.slice(7)+"/",O=I[s]??(I[s]=Object.create(null));O[e.specifier]=k(M(e.snapshot,L.normalize(e.entry)))}return{closure:U,digest:b(E),bytes:new Uint8Array(E),manifest:A,files:p,importMap:{imports:j,scopes:I}}}f(F,"deliverModuleClosure");function W(r,a,d){C(d),(!(r instanceof Uint8Array)||r.byteLength>d.responseBytes||!w(a)||b(r)!==a)&&o("bundle bytes differ or exceed resources");let i;try{i=JSON.parse(new TextDecoder("utf-8",{fatal:!0}).decode(r))}catch{return o("invalid JSON bytes")}const n=i?.manifest;(n?.format!=="esm-file-closure/1"||!Array.isArray(n.needs)||!Array.isArray(n.modules)||!Array.isArray(n.libraries)||!Array.isArray(n.notices)||!Array.isArray(i.files)||n.modules.length+n.notices.length>d.members||i.files.length!==n.modules.length+n.notices.length||n.needs.length>d.members||n.libraries.length>d.members)&&o("invalid manifest resources");const l=new Map,u=new Map;let B=0;for(const t of i.files)(typeof t?.path!="string"||typeof t.source!="string"||u.has(t.path)||(B+=Buffer.byteLength(t.source))>d.bytes)&&o("invalid/duplicate file resources"),u.set(t.path,t.source);for(const t of n.modules){(!t||typeof t.coordinate!="string"||typeof t.path!="string"||t.path!==M(t.snapshot,t.coordinate)||!w(t.digest))&&o("invalid module");const c=u.get(t.path);(c===void 0||b(c)!==t.digest)&&o("module bytes differ");const p=l.get(t.snapshot)??new Map;p.has(t.coordinate)&&o("duplicate module"),p.set(t.coordinate,{source:c,digest:t.digest}),l.set(t.snapshot,p)}const v=f((t,c)=>{const p=l.get(t);return!p||typeof c!="string"?o("unknown snapshot/entry"):{identity:t,entry:c,members:p}},"snapshot"),h=new Map;for(const t of n.needs)(typeof t?.name!="string"||h.has(t.name))&&o("invalid/duplicate need"),h.set(t.name,v(t.snapshot,t.entry));const y=new Map;for(const t of n.libraries)(typeof t?.parent!="string"||typeof t.specifier!="string"||y.has(m(t.parent,t.specifier)))&&o("invalid/duplicate library"),y.set(m(t.parent,t.specifier),v(t.snapshot,t.entry));const N=n.notices.map(t=>!t||typeof t.path!="string"||!u.has(t.path)?o("missing notice"):{snapshot:t.snapshot,coordinate:t.coordinate,digest:t.digest,source:u.get(t.path)}),g=F([...h.keys()],h,(t,c)=>y.get(m(c.identity,t)),d,N);return g.digest!==a&&o("noncanonical, extra or unresolved delivery members"),g}f(W,"verifyModuleDelivery");export{F as deliverModuleClosure,$ as moduleInventory,Z as moduleSnapshot,W as verifyModuleDelivery};

package/dist/host/native/module-inventory.js

@@ -0,0 +1,2 @@
+var p=Object.defineProperty;var u=(n,i)=>p(n,"name",{value:i,configurable:!0});import{compareStrings as f}from"../order.js";import{library14_canonical as y}from"../../vendor/runtime.js";import{verifyModuleDelivery as h}from"./module-delivery.js";function w(n,i,c,t,e){const s=h(n,i,c),a=new Map,l=new Set(s.manifest.modules.map(o=>o.snapshot));if(!e||!e.scope||!e.by||!e.at)throw Error("REFUSE\xB7module inventory missing declaration context");if(!Array.isArray(t)||t.length!==l.size)throw Error("REFUSE\xB7module inventory source coverage");for(const o of t){if(!o||!l.has(o.snapshot)||typeof o.source!="string"||!o.source||typeof o.version!="string"||!o.version||a.has(o.snapshot))throw Error("REFUSE\xB7module inventory invalid/duplicate source");a.set(o.snapshot,o)}const d=s.manifest.modules.map(o=>{const r=a.get(o.snapshot);if(!r)throw Error("REFUSE\xB7module inventory missing source "+o.snapshot);return{unit:"module",source:r.source,version:r.version,snapshot:o.snapshot,module:o.coordinate,digest:o.digest,reachedFrom:s.closure}}).sort((o,r)=>f(JSON.stringify([o.snapshot,o.module]),JSON.stringify([r.snapshot,r.module]))),m=d.map(o=>y({scope:e.scope+"/"+o.snapshot.slice(7)+"/"+encodeURIComponent(o.module),role:"writes",form:"alphabet",measure:"digest",value:o.digest,by:e.by,at:e.at,about:JSON.stringify({format:"module-inventory-record/1",...o})})+`
+`).join("");return{format:"verified-module-inventory/1",delivery:s.digest,closure:s.closure,modules:d,lines:m}}u(w,"moduleInventory");export{w as moduleInventory};

package/dist/host/native/module-syntax.js

@@ -1 +1 @@
-var g=Object.defineProperty;var l=(o,r)=>g(o,"name",{value:r,configurable:!0});import{parse as h}from"../../../vendor/syntax/parser.js";import*as D from"node:module";import{extname as b}from"node:path";const v=D.stripTypeScriptTypes,N=l(o=>{if(!o||typeof o!="object")return;const r=o;return r.type==="Literal"&&typeof r.value=="string"?r.value:void 0},"stringLiteral");function T(o,r,m){const E=b(r)===".ts"?v(o,{mode:"transform"}):o;let u;try{u=h(E,{sourceType:"module",next:!0,ranges:{start:!0,end:!1,range:!1},lexical:!0,globalReturn:!0})}catch{throw Error("REFUSE\xB7source module syntax cannot be read: "+r)}const y=new Set,a=new Set,x=N,c=l((p,t,i,f=!1)=>{if(!p||typeof p!="object")return;if(Array.isArray(p)){for(const n of p)c(n,t,i,f);return}const e=p;if(e.type==="Identifier"&&e.name==="require"){const n=t?.type==="CallExpression"&&i==="callee",d=t?.type==="MemberExpression"&&i==="property"&&!t.computed||(t?.type==="Property"||t?.type==="MethodDefinition")&&i==="key"&&!t.computed&&!t.shorthand,S=(t?.type==="ImportSpecifier"||t?.type==="ImportDefaultSpecifier"||t?.type==="ImportNamespaceSpecifier")&&(i==="imported"||i==="local")||t?.type==="FunctionDeclaration"&&i==="id",I=t?.type==="ExportSpecifier"&&(i==="exported"||i==="local"&&f);!n&&!d&&!S&&!I&&a.add("require reference at "+String(e.start))}let s;if((e.type==="ImportDeclaration"||e.type==="ExportNamedDeclaration"||e.type==="ExportAllDeclaration"||e.type==="ImportExpression")&&(s=x(e.source),e.type==="ImportExpression"&&s===void 0&&a.add("import expression at "+String(e.start))),e.type==="CallExpression"){const n=e.callee;if(n?.type==="Identifier"&&n.name==="require"){if(m?.esmOnly)throw Error("REFUSE\xB7module closure CommonJS load in ESM delivery "+r);s=x(e.arguments[0]),s===void 0&&a.add("require expression at "+String(e.start))}}s!==void 0&&(!m?.staticOnly||e.type!=="ImportExpression"&&e.type!=="CallExpression")&&y.add(s);for(const[n,d]of Object.entries(e))c(d,e,n,e.type==="ExportNamedDeclaration"?e.source!==null&&e.source!==void 0:f)},"visit");return c(u),{imports:[...y],unresolved:[...a]}}l(T,"moduleImportSyntax");function M(o,r){return T(o,r).imports}l(M,"moduleImports");export{T as moduleImportSyntax,M as moduleImports};
+var g=Object.defineProperty;var c=(o,r)=>g(o,"name",{value:r,configurable:!0});import{parse as b}from"../../../vendor/syntax/parser.js";import*as D from"node:module";import{extname as v}from"node:path";const N=D.stripTypeScriptTypes,T=c(o=>{if(!o||typeof o!="object")return;const r=o;return r.type==="Literal"&&typeof r.value=="string"?r.value:void 0},"stringLiteral");function j(o,r,u){const E=v(r)===".ts"?N(o,{mode:"transform"}):o;let m;try{m=b(E,{sourceType:"module",next:!0,ranges:{start:!0,end:!1,range:!1},lexical:!0,globalReturn:!0})}catch{throw Error("REFUSE\xB7source module syntax cannot be read: "+r)}const y=new Set,a=new Set,x=T,f=c((p,t,i,d=!1)=>{if(!p||typeof p!="object")return;if(Array.isArray(p)){for(const n of p)f(n,t,i,d);return}const e=p;if(e.type==="Identifier"&&e.name==="require"){const n=t?.type==="CallExpression"&&i==="callee",l=t?.type==="MemberExpression"&&i==="property"&&!t.computed||(t?.type==="Property"||t?.type==="MethodDefinition")&&i==="key"&&!t.computed&&!t.shorthand,I=(t?.type==="ImportSpecifier"||t?.type==="ImportDefaultSpecifier"||t?.type==="ImportNamespaceSpecifier")&&(i==="imported"||i==="local")||t?.type==="FunctionDeclaration"&&i==="id",h=t?.type==="ExportSpecifier"&&(i==="exported"||i==="local"&&d);!n&&!l&&!I&&!h&&a.add("require reference at "+String(e.start))}if(e.type==="Identifier"||e.type==="Literal")return;let s;if((e.type==="ImportDeclaration"||e.type==="ExportNamedDeclaration"||e.type==="ExportAllDeclaration"||e.type==="ImportExpression")&&(s=x(e.source),e.type==="ImportExpression"&&s===void 0&&a.add("import expression at "+String(e.start))),e.type==="CallExpression"){const n=e.callee;if(n?.type==="Identifier"&&n.name==="require"){if(u?.esmOnly)throw Error("REFUSE\xB7module closure CommonJS load in ESM delivery "+r);s=x(e.arguments[0]),s===void 0&&a.add("require expression at "+String(e.start))}}s!==void 0&&(!u?.staticOnly||e.type!=="ImportExpression"&&e.type!=="CallExpression")&&y.add(s);const S=e.type==="ExportNamedDeclaration"?e.source!==null&&e.source!==void 0:d;for(const n of Object.keys(e)){const l=e[n];l&&typeof l=="object"&&f(l,e,n,S)}},"visit");return f(m),{imports:[...y],unresolved:[...a]}}c(j,"moduleImportSyntax");function M(o,r){return j(o,r).imports}c(M,"moduleImports");export{j as moduleImportSyntax,M as moduleImports};

package/dist/host/native/native-binary.js

@@ -1 +1 @@
-var S=Object.defineProperty;var h=(e,s)=>S(e,"name",{value:s,configurable:!0});import{retainedProjection as A}from"./reading.js";import{isSha256 as E}from"../hash.js";import{fieldNames as j}from"./reading.js";import{sha256 as N}from"../hash.js";import{createHash as O}from"node:crypto";import{isAbsolute as p}from"node:path";import{realpathSync as u}from"node:fs";import{fileURLToPath as U}from"node:url";import{library11_authorityAtEpoch as I}from"../../vendor/runtime.js";import{parsedLine as w}from"../../fold/claims.js";import{authorityFor as k}from"../../fold/signers.js";import{authenticateSignedPort as z,nativeParentInputBytes as D,canonicalJson as v}from"./reading.js";import{readBounded as L}from"./generated.js";const P=N,b=j,c=E,i=h(e=>{throw Error("REFUSE\xB7native binary "+e)},"fail");function F(e,s){/^region\/[^\s]+$/.test(s)||i("origin is not a declared region");const r=e.live.filter(g=>{const f=w(g);return f.kind==="fact"&&f.value.fields.scope===s&&f.value.fields.measure==="origin"&&f.value.fields.value!=="withdraw"});r.length!==1&&i("missing/conflicting origin "+s);const n=r[0];e.history.includes(n)||i("origin absent from authenticated history");const y=w(n);if(y.kind!=="fact")return i("origin not a wire record");const t=y.value.fields;(t.role!=="writes"||t.form!=="alphabet")&&i("origin declaration meaning");const d=k(e.history,e.signer,e.eras),m=d.of(n);(m.kind!=="admitted"||m.signer!==e.signer.id)&&i("origin must be Root signed");const l=I(t,e.signer,e.epoch,s,"authority");l.kind!=="admitted"&&i("current origin authority "+l.why);let o,a;try{o=new URL(t.value)}catch{return i("origin URL invalid")}(o.protocol!=="file:"||o.username||o.password||o.search||o.hash||o.hostname&&o.hostname!=="localhost")&&i("unsupported origin transport");try{if(a=U(o),!p(a)||a.includes("\0"))return i("origin path invalid");a=u(a)}catch{return i("local origin absent/invalid")}return Object.freeze({coordinate:s,line:n,path:a})}h(F,"hostOriginPath");function _(e,s,r){if(s.profile!=="host-native-binary-origin@1")return;const n=k(e.history,e.signer,e.eras).of(r);(n.kind!=="admitted"||n.signer!==e.signer.id)&&i("origin selection must be Root signed");const y=F(e,s.origin),t=L(y.path,s.entry.bytes);return(t.byteLength!==s.entry.bytes||P(t)!==s.entry.digest)&&i("origin bytes differ"),y}h(_,"nativeBinaryOrigin");const R=new WeakMap;function Z(e,s,r,n){const y=z(e,s),t=y.profile;(!t||b(t)!==(t.profile==="host-native-binary-origin@1"?"alias,condition,coordinate,entry,limits,origin,profile,selector":"alias,condition,coordinate,entry,limits,profile,selector")||!["host-native-binary@1","host-native-binary-origin@1"].includes(t.profile)||t.coordinate!==s||typeof t.alias!="string"||!t.alias.length||t.alias.includes("\0")||typeof t.condition!="string"||!t.condition.length)&&i("selection absent/unknown"),(b(t.selector??{})!=="binding,implementation,port"||v(t.selector)!==v({port:r.port,binding:r.binding,implementation:r.implementation}))&&i("selection differs from parent"),(!c(r.identity)||!c(r.instrument)||!c(r.policy)||!c(r.authority)||!c(r.implementation)||!Array.isArray(r.inputs))&&i("parent identity absent"),(b(t.entry??{})!=="bytes,digest,path"||typeof t.entry.path!="string"||p(t.entry.path)||t.entry.path.split("/").some(f=>!f||f==="."||f==="..")||!c(t.entry.digest)||!Number.isSafeInteger(t.entry.bytes)||t.entry.bytes<1||b(t.limits??{})!=="bytes"||!Number.isSafeInteger(t.limits.bytes)||t.limits.bytes<1||t.entry.bytes>t.limits.bytes||t.limits.bytes>D(e,r))&&i("entry byte resource absent/outside Root"),(!n||typeof n.path!="string"||!p(n.path)||!c(n.digest)||t.entry.path!==n.coordinate||t.entry.digest!==n.digest||!r.inputs.some(([f,x])=>x===n.digest))&&i("private image binding absent/differs");const d=_(e,t,y.line);let m,l;try{m=u(n.path),l=u(n.path)}catch{return i("entry absent")}m!==l&&i("entry path differs from private image");let o;try{o=u(r.runtime)}catch{return i("runtime binding absent")}l===o&&i("binary aliases actual runtime"),d&&l!==d.path&&i("entry differs from declared origin");const a=L(l,t.entry.bytes);(a.byteLength!==t.entry.bytes||P(a)!==n.digest)&&i("entry bytes differ");const g=Object.freeze({identity:"sha256:"+O("sha256").update(v([y.line,r.identity,...d?[d.line]:[]])).digest("hex")});return R.set(g,{kind:"native-binary",alias:t.alias,entry:l,entryDigest:n.digest,entryBytes:a.byteLength,condition:t.condition}),g}h(Z,"verifyNativeBinary");const B=A(R,i);export{F as hostOriginPath,_ as nativeBinaryOrigin,B as nativeBinaryProjection,Z as verifyNativeBinary};
+var S=Object.defineProperty;var h=(e,s)=>S(e,"name",{value:s,configurable:!0});import{retainedProjection as A}from"./reading.js";import{isSha256 as E}from"../hash.js";import{fieldNames as j}from"./reading.js";import{sha256 as N}from"../hash.js";import{createHash as O}from"node:crypto";import{isAbsolute as p}from"node:path";import{realpathSync as u}from"node:fs";import{fileURLToPath as U}from"node:url";import{library14_authorityAtEpoch as I}from"../../vendor/runtime.js";import{parsedLine as w}from"../../fold/claims.js";import{authorityFor as k}from"../../fold/signers.js";import{authenticateSignedPort as z,nativeParentInputBytes as D,canonicalJson as v}from"./reading.js";import{readBounded as L}from"./generated.js";const P=N,b=j,c=E,i=h(e=>{throw Error("REFUSE\xB7native binary "+e)},"fail");function F(e,s){/^region\/[^\s]+$/.test(s)||i("origin is not a declared region");const r=e.live.filter(g=>{const f=w(g);return f.kind==="fact"&&f.value.fields.scope===s&&f.value.fields.measure==="origin"&&f.value.fields.value!=="withdraw"});r.length!==1&&i("missing/conflicting origin "+s);const n=r[0];e.history.includes(n)||i("origin absent from authenticated history");const y=w(n);if(y.kind!=="fact")return i("origin not a wire record");const t=y.value.fields;(t.role!=="writes"||t.form!=="alphabet")&&i("origin declaration meaning");const d=k(e.history,e.signer,e.eras),m=d.of(n);(m.kind!=="admitted"||m.signer!==e.signer.id)&&i("origin must be Root signed");const l=I(t,e.signer,e.epoch,s,"authority");l.kind!=="admitted"&&i("current origin authority "+l.why);let o,a;try{o=new URL(t.value)}catch{return i("origin URL invalid")}(o.protocol!=="file:"||o.username||o.password||o.search||o.hash||o.hostname&&o.hostname!=="localhost")&&i("unsupported origin transport");try{if(a=U(o),!p(a)||a.includes("\0"))return i("origin path invalid");a=u(a)}catch{return i("local origin absent/invalid")}return Object.freeze({coordinate:s,line:n,path:a})}h(F,"hostOriginPath");function _(e,s,r){if(s.profile!=="host-native-binary-origin@1")return;const n=k(e.history,e.signer,e.eras).of(r);(n.kind!=="admitted"||n.signer!==e.signer.id)&&i("origin selection must be Root signed");const y=F(e,s.origin),t=L(y.path,s.entry.bytes);return(t.byteLength!==s.entry.bytes||P(t)!==s.entry.digest)&&i("origin bytes differ"),y}h(_,"nativeBinaryOrigin");const R=new WeakMap;function Z(e,s,r,n){const y=z(e,s),t=y.profile;(!t||b(t)!==(t.profile==="host-native-binary-origin@1"?"alias,condition,coordinate,entry,limits,origin,profile,selector":"alias,condition,coordinate,entry,limits,profile,selector")||!["host-native-binary@1","host-native-binary-origin@1"].includes(t.profile)||t.coordinate!==s||typeof t.alias!="string"||!t.alias.length||t.alias.includes("\0")||typeof t.condition!="string"||!t.condition.length)&&i("selection absent/unknown"),(b(t.selector??{})!=="binding,implementation,port"||v(t.selector)!==v({port:r.port,binding:r.binding,implementation:r.implementation}))&&i("selection differs from parent"),(!c(r.identity)||!c(r.instrument)||!c(r.policy)||!c(r.authority)||!c(r.implementation)||!Array.isArray(r.inputs))&&i("parent identity absent"),(b(t.entry??{})!=="bytes,digest,path"||typeof t.entry.path!="string"||p(t.entry.path)||t.entry.path.split("/").some(f=>!f||f==="."||f==="..")||!c(t.entry.digest)||!Number.isSafeInteger(t.entry.bytes)||t.entry.bytes<1||b(t.limits??{})!=="bytes"||!Number.isSafeInteger(t.limits.bytes)||t.limits.bytes<1||t.entry.bytes>t.limits.bytes||t.limits.bytes>D(e,r))&&i("entry byte resource absent/outside Root"),(!n||typeof n.path!="string"||!p(n.path)||!c(n.digest)||t.entry.path!==n.coordinate||t.entry.digest!==n.digest||!r.inputs.some(([f,x])=>x===n.digest))&&i("private image binding absent/differs");const d=_(e,t,y.line);let m,l;try{m=u(n.path),l=u(n.path)}catch{return i("entry absent")}m!==l&&i("entry path differs from private image");let o;try{o=u(r.runtime)}catch{return i("runtime binding absent")}l===o&&i("binary aliases actual runtime"),d&&l!==d.path&&i("entry differs from declared origin");const a=L(l,t.entry.bytes);(a.byteLength!==t.entry.bytes||P(a)!==n.digest)&&i("entry bytes differ");const g=Object.freeze({identity:"sha256:"+O("sha256").update(v([y.line,r.identity,...d?[d.line]:[]])).digest("hex")});return R.set(g,{kind:"native-binary",alias:t.alias,entry:l,entryDigest:n.digest,entryBytes:a.byteLength,condition:t.condition}),g}h(Z,"verifyNativeBinary");const B=A(R,i);export{F as hostOriginPath,_ as nativeBinaryOrigin,B as nativeBinaryProjection,Z as verifyNativeBinary};

package/dist/host/native/probes.js

@@ -0,0 +1 @@
+var c=Object.defineProperty;var s=(t,e)=>c(t,"name",{value:e,configurable:!0});import{prepareNativeViewIdentity as g,declaredReadingIdentityLimits as l}from"../reading-identity.js";import{authenticatedStanding as m}from"../admitted-place.js";import{withoutEffects as b}from"../read-only.js";import{BoundRefusal as p}from"../refusals.js";const i=s((t,e=t)=>{throw new p(t,"REFUSE\xB7"+e)},"refuse");function E(t){try{(!t||typeof t.place!="string"||!t.place||!t.instrument?.runtime)&&i("host/context"),t.view!=="lines"&&t.view!=="evidence"&&i("reading-identity/selection","reading-identity/selection unsupported probe form "+String(t.view)+"; supports lines and evidence");const{port:e,counter:n,signal:d}=t;(!e||!/^port\/[^\s]+$/.test(e.coordinate)||!n||!(n.used instanceof Map))&&i("host/context");for(const f of[e.probes,e.responseBytes])(!Number.isSafeInteger(f)||f<1)&&i("host/budget");d?.aborted&&i("host/cancelled");const o=n.used.get(e.coordinate)??0;(!Number.isSafeInteger(o)||o<0)&&i("host/budget");const u=b(()=>l(m(t.place)));o>=Math.min(e.probes,u.probes)&&i("host/budget"),n.used.set(e.coordinate,o+1);const r=g(t);if(d?.aborted&&i("host/cancelled"),r.kind==="refuse")return r;const a={kind:"fact",form:r.view,port:e.coordinate,identity:r.identity,text:r.text,probes:1};return Buffer.byteLength(JSON.stringify(a),"utf8")>e.responseBytes&&i("host/budget"),a}catch(e){return{kind:"refuse",code:e instanceof p?e.code:"reading-identity/failed",diagnostic:e instanceof Error?e.message:"REFUSE\xB7native probe failed"}}}s(E,"prepareNativeProbe");export{E as prepareNativeProbe};

package/dist/host/native/reading-witness-admission.js

@@ -0,0 +1,5 @@
+var re=Object.defineProperty;var v=(a,t)=>re(a,"name",{value:t,configurable:!0});import{join as H}from"node:path";import{library14_canonical as K,library14_authorityAtEpoch as Q}from"../../vendor/runtime.js";import{library5_decodeReadingWitness as ne,library5_readingWitnessStatementBytes as oe,library5_readingIdentityBytes as se}from"../../vendor/runtime.js";import{fieldOf as i,fieldsOf as R}from"../../fold/claims.js";import{isCeiling as ae}from"../../fold/configures.js";import{lockLines as ce}from"../../fold/keys.js";import{authorityFor as ue,rootSigner as de}from"../../fold/signers.js";import{signaturesOf as pe}from"../../fold/digests.js";import{storeOf as le}from"../../land/ledger.js";import{widenedWithoutWitness as fe}from"../../judge/widening.js";import{sha256 as p,isSha256 as ge}from"../hash.js";import{readPlacePhysicalLines as ye,authenticatePhysicalLinesWitness as me}from"../physical-lines.js";import{verifiedReadingReceipts as he}from"../reading-closures.js";import{canonicalJson as z,authenticateNativeProfile as ve}from"./reading.js";import{readBoundedFile as we}from"./bounded-file.js";const be="bound-reading-witness-admission@1",r=v(a=>{throw Error("REFUSE\xB7reading-witness/"+a)},"fail"),y=v(a=>typeof a=="string"&&a.length>0&&!/[\\\u0000-\u0020\u007f]/.test(a)&&a.split("/").every(t=>t!==""&&t!=="."&&t!==".."),"path");function Se(a){let t;try{t=JSON.parse(i(a,"about"))}catch{return r("policy-json")}return!t||t.profile!=="bound-reading-witness-policy@1"||t.unit!=="physical-lines/utf8-lf@1"||!y(t.scope)||!(t.place==="."||y(t.place))||!y(t.producer)||!y(t.port)||!y(t.readerMapping)||!Array.isArray(t.inventory)||!t.inventory.length||!t.inventory.every(y)||!Array.isArray(t.selectors)||!t.selectors.length||!t.selectors.every(y)?r("policy-fields"):!/^(0|[1-9][0-9]*)$/.test(t.byteBudget)||!/^(0|[1-9][0-9]*)$/.test(t.rowBudget)||[t.entryBudget,t.evidenceBytes,t.receiptRows,t.authorityBytes,t.authorityLines].some(w=>!Number.isSafeInteger(w)||w<1)?r("policy-budgets"):z(t)!==i(a,"about")?r("policy-canonical"):t}v(Se,"policyOf");function je(a,t,w,k=w,V="."){const m=[];try{const l=k.filter(c=>i(c,"scope")==="wire/reading-witness-admission"&&i(c,"value")!=="withdraw");if(!l.length)return{kind:"allow",evidence:m};if(l.length!==1||i(l[0],"value")!==be)return r("profile-selection");const P=fe(t.map(c=>K({...R(c),at:"policy:unverified"})),w,ae,"witness");if(!P.length)return{kind:"allow",evidence:m};const X=k.filter(c=>i(c,"role")==="writes"&&i(c,"measure")==="reading-witness"&&i(c,"value")==="lock").map(c=>({line:c,policy:Se(c)}));for(const c of P){const B=i(c,"scope"),J=X.filter(e=>e.policy.scope===B&&e.policy.place===V);if(!J.length)continue;if(J.length!==1)return r("policy-ambiguous/"+B);const{line:Y,policy:n}=J[0],Z=t.find(e=>K({...R(e),at:"policy:unverified"})===c),D=i(Z,"at"),b=D.startsWith("witness:")?D.slice(8):"";if(!ge(b))return{kind:"ask",code:"reading-witness",needs:["reading-witness/"+B],evidence:m};const x=le(a),T=we(H(x,"cas","blobs",b.slice(7)),n.evidenceBytes,b);if(p(T)!==b)return r("evidence-integrity");const j=new TextDecoder("utf-8",{fatal:!0}).decode(T),s=JSON.parse(j);if(!s||s.profile!=="bound-reading-witness-proof@1"||z(s)+`
+`!==j||typeof s.witness!="string"||typeof s.authorization!="string"||!Array.isArray(s.receipts)||s.receipts.length>n.receiptRows||!s.receipts.every(e=>typeof e=="string"))return r("evidence-profile");const o=ne(s.witness);if(o.authentication!=="key-covered"||o.key!==n.producer||o.unit!==n.unit)return r("producer-policy");const S=ce(x);if(S.length>n.authorityLines||S.reduce((e,u)=>e+Buffer.byteLength(u),0)>n.authorityBytes)return r("authority-budget");const U=pe(x).admitted,L=de(a),h=ue(S,L,U),I=S.reduce((e,u)=>Math.max(e,Number(i(u,"epoch"))||0),0);if(h.of(Y).kind!=="admitted"||h.of(l[0]).kind!=="admitted")return r("policy-not-admitted");const f=R(s.authorization),$=h.of(s.authorization),_=h.admitted.find(e=>e.id===n.producer);if($.kind!=="admitted"||$.signer!==n.producer||!_||Q(f,_,I,n.scope,"authority").kind!=="admitted")return r("producer-not-current");if(f.scope!==n.scope||f.role!=="writes"||f.form!=="alphabet"||f.measure!=="reading-witness"||f.value!==p(oe(o))||f.restsOn!==p(z(n)+`
+`)||o.evidence!==p(s.authorization+`
+`)||o.coverage!==p(JSON.stringify(_.coverage)))return r("authorization-binding");const ee={history:S,live:k,signer:L,eras:U,epoch:I,budget:{lines:n.authorityLines,bytes:n.authorityBytes}},F=ve(ee,n.port),O=k.filter(e=>i(e,"scope")===n.readerMapping&&i(e,"value")===n.port);if(O.length!==1||o.implementation!==F.profile.selection.archive||o.reader!==F.profile.selection.archive)return r("current-native-reader");const A=h.of(O[0]),q=A.kind==="admitted"?h.admitted.find(e=>e.id===A.signer):void 0;if(A.kind!=="admitted"||A.signer!==L.id||!q||Q(R(O[0]),q,I,n.readerMapping,"authority").kind!=="admitted")return r("current-native-mapping-authority");const N=s.receipts.filter(e=>i(e,"measure")==="bytes"&&i(e,"value")===o.context&&i(e,"scope").startsWith("receipts/readings/"));if(N.length!==1||!i(N[0],"about"))return r("native-context-required");const M=i(N[0],"about"),d=JSON.parse(M);if(!Array.isArray(d)||d.length!==6||d[0]!=="reading-context@1"||p(M)!==o.context||d[2]!==o.implementation)return r("native-context-binding");if(new TextDecoder().decode(se({instrument:d[1],implementation:d[2],policy:d[3],inputs:d[4],environment:d[5]}))!==M)return r("native-context-canonical");for(const e of s.receipts.filter(u=>i(u,"measure")==="bytes"&&i(u,"scope").startsWith("receipts/readings/"))){const u=s.receipts.filter(G=>i(G,"scope")===i(e,"scope")&&i(G,"measure")==="count");if(!i(e,"about")||u.length!==1||!i(u[0],"about"))return r("native-carrier-inline")}if(!he(x,s.receipts,p,void 0,!0))return r("native-receipt");const W=new Map(d[4]);for(const e of F.profile.selection.members)if(W.get(JSON.stringify(["context","native/"+e.coordinate]))!==e.digest)return r("current-native-members");if(W.get(JSON.stringify(["context","native/reader-mapping"]))!==p(O[0]))return r("current-native-mapping");const g=ye({root:n.place==="."?a:H(a,n.place),inventory:n.inventory,regions:[{scope:n.scope,selectors:n.selectors}],policy:{entryBudget:n.entryBudget,byteBudget:n.byteBudget,rowBudget:n.rowBudget},context:o.context,reader:o.reader,implementation:o.implementation,run:o.run});if(g.status!=="read"||g.stray.length||g.reading.regions.some(e=>e.selections.some(u=>u.status!=="selected")))return r("actual-reading-unmeasured");for(const e of g.reading.inputFiles)if(W.get(JSON.stringify(["file",e.name]))!==e.digest)return r("native-input-binding");if([...W.keys()].filter(e=>{try{return JSON.parse(e)[0]==="file"}catch{return!1}}).length!==g.reading.inputFiles.length)return r("native-input-inventory");me(g,s.witness,{producers:[{authentication:"key-covered",key:n.producer,coverage:o.coverage}],verify:v(()=>!0,"verify")});const C=i(N[0],"scope");if(o.run!==C)return r("native-run-binding");const te=s.receipts.filter(e=>i(e,"scope")===C&&i(e,"measure")==="count"),ie=i(te[0],"about"),E=g.reading.regions[0];if(!E||E.status!=="measured"||!ie.split(`
+`).some(e=>i(e,"scope")===B&&i(e,"measure")==="lines"&&i(e,"value")===E.value.numerator+".."+E.value.numerator))return r("native-result-binding");m.push(b,o.context,o.reading)}return{kind:"allow",evidence:m}}catch(l){return{kind:"refuse",code:"reading-witness",why:l instanceof Error?l.message:"REFUSE\xB7reading-witness/invalid",evidence:m}}}v(je,"readingWitnessAdmission");export{be as READING_WITNESS_ADMISSION_PROFILE,je as readingWitnessAdmission};

package/dist/host/native/reading.js

@@ -1 +1 @@
-var _=Object.defineProperty;var p=(e,n)=>_(e,"name",{value:n,configurable:!0});import{sha256 as S}from"../hash.js";import{extname as H}from"node:path";import{gunzipSync as W}from"node:zlib";import{readBoundedFile as D}from"./bounded-file.js";import{members as K}from"../archive.js";import{installBoundary as B}from"./loader.js";import{nativeRootJobCustody as T}from"./custody.js";import{mountNativeImage as $}from"./image.js";import{createHash as E}from"node:crypto";import{library11_canonical as G}from"../../vendor/runtime.js";import{parsedLine as C}from"../../fold/claims.js";import{library2_answer as L}from"../../vendor/runtime.js";import{authorityFor as Q}from"../../fold/signers.js";import{library11_authorityAtEpoch as V}from"../../vendor/runtime.js";import{scheduleDeadline as X}from"./deadline.js";import{prepareNodeImage as Y,plannedJobs as Z,executeJobs as q}from"./node-jobs.js";const r=p(e=>{throw Error("REFUSE\xB7native reading "+e)},"fail"),f=p(e=>JSON.stringify(J(e)),"canonicalJson"),J=p(e=>Array.isArray(e)?e.map(J):e!==null&&typeof e=="object"?Object.fromEntries(Object.entries(e).sort(([n],[t])=>n<t?-1:n>t?1:0).map(([n,t])=>[n,J(t)])):e,"order"),A=new WeakMap;function v(e,n){(!e||!Number.isSafeInteger(e.epoch)||e.epoch<0||!Number.isSafeInteger(e.budget?.lines)||e.budget.lines<1||!Number.isSafeInteger(e.budget.bytes)||e.budget.bytes<1)&&r("missing authority/budget");const t=[...new Set([...e.history,...e.live])];t.length>e.budget.lines&&r("authority line budget");let i=0;for(const a of t)(typeof a!="string"||(i+=Buffer.byteLength(a))>e.budget.bytes)&&r("authority byte budget");/^port\/[^\s]+$/.test(n)||r("selection is not a command port");const o=e.live.filter(a=>{const d=C(a);return d.kind==="fact"&&d.value.fields.scope===n});o.length!==1&&r("missing/ambiguous signed declaration "+n);const h=o[0];e.history.includes(h)||r("port absent from authenticated admission history");const b=C(h);if(b.kind!=="fact")return r("port not a wire record");const s=b.value.fields;(s.role!=="writes"||s.form!=="alphabet"||s.measure!=="text"||s.value!=="lock"||typeof s.about!="string")&&r("unknown port projection "+n);const y=Q(e.history,e.signer,e.eras),g=y.of(h);g.kind!=="admitted"&&r("port signature/coverage "+g.why);const x=g.kind==="admitted"?g.signer:r("signature not admitted"),m=y.admitted.filter(a=>a.id===x);m.length!==1&&r("ambiguous port signer"),e.history.some(a=>{const d=C(a);return d.kind==="fact"&&d.value.fields.epoch!==void 0&&(!Number.isSafeInteger(Number(d.value.fields.epoch))||Number(d.value.fields.epoch)>e.epoch)})&&r("authority prefix exceeds current epoch");const c=V(s,m[0],e.epoch,n,"authority");c.kind!=="admitted"&&r("current port authority "+c.why);let l;try{l=JSON.parse(s.about)}catch{return r("port JSON invalid")}return(!l||typeof l!="object"||Array.isArray(l)||f(l)!==s.about)&&r("port profile invalid/noncanonical"),{line:h,profile:l}}p(v,"authenticateSignedPort");function N(e,n){const t=v(e,n),i=t.profile,o=t.line;return(!i.port||!i.selection||typeof i.selection!="object"||Array.isArray(i.selection))&&r("missing native selection"),Object.keys(i.selection).sort().join(",")!=="archive,bindings,budget,condition,entry,loaderConfig,loads,members,nativePreloadMembers,preload,reader,runtime"&&r("unknown native selection field"),(Object.keys(i).sort().join(",")!=="port,profile,selection"||i.profile!=="host-native-reading@1"||i.port?.coordinate!==n)&&r("unknown/noncanonical native profile"),{line:o,profile:i}}p(N,"selected");const z=new WeakMap;function R(e){if(e!==null&&typeof e=="object"){for(const n of Object.values(e))R(n);Object.freeze(e)}return e}p(R,"freezeProfile");function U(e,n,t){const i=Object.freeze({identity:S(f([t.line,e.epoch]))});return z.set(i,{root:{...e,history:[...e.history],live:[...e.live],eras:[...e.eras],budget:{...e.budget}},coordinate:n,profile:R(t.profile)}),i}p(U,"holdSelection");function be(e,n){const t=N(e,n),i=U(e,n,t);return Object.freeze({selection:i,line:t.line,profile:t.profile})}p(be,"authenticateNativeProfile");function ye(e,n,t){const i=N(e,n);return f(i.profile)!==f(t)&&r("expected profile differs from signature"),U(e,n,i)}p(ye,"validateSignedNativeProfile");function F(e,n,t){const i=N(e,n);f(i.profile)!==f(t.profile)&&r("resolved image/profile differs from signed selection"),(!(t.archive instanceof Uint8Array)||t.archive.byteLength>t.handoff.budget.bytes)&&r("archive exceeds declared input budget");let o;try{W(t.archive,{maxOutputLength:t.handoff.budget.bytes}),o=K(t.archive)}catch{return r("native implementation archive invalid")}const h=o.filter(c=>c.name===t.profile.selection.entry);(h.length!==1||"sha256:"+E("sha256").update(h[0].bytes).digest("hex")!==t.profile.port.implementation)&&r("archive native entry differs from implementation");const b={archive:"sha256:"+E("sha256").update(t.archive).digest("hex"),entry:t.profile.selection.entry,reader:t.profile.selection.reader,loaderConfig:t.profile.selection.loaderConfig,runtime:t.image.runtime,preload:t.image.preload??null,nativePreloadMembers:t.image.nativePreloadMembers,condition:t.image.condition,budget:t.handoff.budget,members:t.handoff.members.map(({coordinate:c,digest:l})=>({coordinate:c,digest:l})),bindings:t.handoff.bindings,loads:t.handoff.loads};f(b)!==f(t.profile.selection)&&r("resolved host bindings differ from signed selection"),t.profile.port.implementation!==t.handoff.members.find(c=>c.coordinate===t.profile.selection.entry)?.digest&&r("native implementation differs from handed member"),t.handoff.bindings.some(c=>c.limits.slots!==t.handoff.bindings[0].limits.slots)&&r("native bindings need one declared parent slots resource"),(!Number.isSafeInteger(t.profile.port.timeoutMs)||t.profile.port.timeoutMs<1||!Number.isSafeInteger(t.profile.port.responseBytes)||t.profile.port.responseBytes<1)&&r("missing parent time/bytes");const s=t.profile.port;(Object.keys(s).sort().join(",")!=="closure,coordinate,environment,implementation,responseBytes,stderr,timeoutMs"||s.stderr!=="reject"||new Set(s.closure).size!==s.closure.length||f([...s.closure].sort())!==f([...new Set(t.handoff.members.map(c=>c.digest))].sort())||t.handoff.bindings.some(c=>f(c.environment.map(([l])=>l).sort())!==f([...s.environment].sort())))&&r("command resource/environment/closure projection differs");const y=S(f([e.signer.id,e.signer.publicKey,e.eras,e.epoch,e.history,e.live])),g={...t.handoff,authoritySnapshot:y,policy:S(f([t.handoff.policy,i.line,y]))},x=Y(g,{...t.image,commandPort:s}),m=Object.freeze({identity:S(f([i.line,e.epoch,x.identity]))});return A.set(m,{root:{...e,history:[...e.history],live:[...e.live],eras:[...e.eras],budget:{...e.budget}},coordinate:n,profile:i.profile,image:x,module:Object.freeze({...t.module})}),m}p(F,"prepareSignedNativeReading");async function we(e,n,t){const i=z.get(e);return i?t.withCurrent(async o=>{const h=N(o,i.coordinate);(o.epoch!==i.root.epoch||f(h.profile)!==f(i.profile)||f(o.history)!==f(i.root.history))&&r("authority changed before load"),F(o,i.coordinate,{...n,module:{}});const b=n.image.locations.find(a=>a.member===i.profile.selection.reader),s=n.handoff.members.find(a=>a.coordinate===i.profile.selection.loaderConfig),y=n.image.locations.find(a=>a.member===i.profile.selection.loaderConfig);if(!b||b.kind!=="module"||!s||!y||!i.profile.selection.nativePreloadMembers.includes(s.coordinate))return r("reader/config not selected");const g=D(y.path,n.handoff.budget.bytes,i.profile.selection.loaderConfig);S(g.toString("utf8"))!==s.digest&&r("loader configuration changed");let x;try{x=JSON.parse(g.toString("utf8"))}catch{return r("loader configuration invalid")}const m=x;m.platform!==n.image.condition&&r("selected runtime condition differs from logical platform"),(!Array.isArray(m.members)||m.members.some(a=>n.handoff.members.find(d=>d.coordinate===a.coordinate)?.digest!==a.digest))&&r("loader target not covered by exact signed image");const c=$(m,n.image.locations.filter(a=>m.members.some(d=>d.coordinate===a.member)).map(a=>({coordinate:a.member,path:a.path})),i.profile.selection.reader,n.handoff.budget),l=B(c.declaration);try{const a=await l.loadEntry();l.assertClosed();const d=F(o,i.coordinate,{...n,image:{...n.image,hostLoader:{...c,preload:new URL("./preload"+H(new URL(import.meta.url).pathname),import.meta.url).href}},module:a});return A.get(d).loader=c.declaration,A.get(d).custody=n.custody??T(o,n.profile,n.handoff,n.image,m),d}finally{l.close()}}):r("unknown pre-load selection")}p(we,"loadSignedNativeReading");async function xe(e,n,t,i){const o=A.get(e);if(!o)return r("unknown instrument selection");i.phase!=="act"&&r("effects forbidden during "+i.phase),i.signal?.aborted&&r("interrupted before wrapper");const h=process.hrtime.bigint()+BigInt(o.profile.port.timeoutMs)*1000000n,b=new AbortController,s=b.abort.bind(b,void 0),y=X(h,s);i.signal?.addEventListener("abort",s,{once:!0});try{return await i.guard.withCurrent(async g=>{const x=N(g,o.coordinate);if((f(x.profile)!==f(o.profile)||g.epoch!==o.root.epoch||S(f(g.history))!==S(f(o.root.history)))&&r("authority changed since preparation"),!o.loader)return r("reader not loaded by fixed host boundary");const m=B(o.loader);try{const c=n.map(u=>{let w;u.verb==="read"&&o.module.commands&&(L({receipt:p(j=>(w=j,[]),"receipt")},u,t).kind!=="fact"||!w)&&r("Asked extraction refused");const M=w?o.module.commands(w):[];return{request:u,asked:w,jobs:M}}),l=c.flatMap(u=>u.jobs),a=new TextEncoder().encode(JSON.stringify(l)),d=Z(o.image,a),k=l.length?await q(o.image,a,{phase:"act",signal:b.signal,custody:o.custody}):[];(k.length!==d.length||k.some((u,w)=>u.id!==d[w].id||u.identity!==d[w].identity||u.responses.length!==1))&&r("capture identity/count differs");const P=new Map(k.map(u=>[u.id,u]));P.size!==k.length&&r("duplicate capture");const I=c.map(({request:u,jobs:w})=>{const M=w.map(O=>{const j=P.get(O.id);return j?G({scope:"command/capture/"+O.id,shape:"same",role:"reads",form:"alphabet",measure:"text",value:"lock",by:"host",at:"witness:"+j.identity,about:JSON.stringify({identity:j.identity,responses:j.responses})}):r("missing capture "+O.id)});return L(o.module,{...u,lines:[...u.lines??[],...M]},t)});return I.length!==n.length?r("incomplete pure response"):((b.signal.aborted||process.hrtime.bigint()>=h)&&r("interrupted/timeout wrapper"),Buffer.byteLength(JSON.stringify(I))>o.profile.port.responseBytes&&r("parent response bytes exceeded"),m.assertClosed(),I)}finally{m.close()}})}finally{y(),i.signal?.removeEventListener("abort",s)}}p(xe,"answerNativeReading");function Se(e,n){const t=v(e,n.port).profile,i=t?.selection?.budget?.bytes;return(t?.profile!=="host-native-reading@1"||!Number.isSafeInteger(i)||i<1)&&r("parent executable input resource absent"),i}p(Se,"nativeParentInputBytes");function je(e){return Object.keys(e).sort().join(",")}p(je,"fieldNames");function Ne(e,n){return t=>{const i=e.get(t);return i?JSON.parse(f(i)):n("unknown verified selection")}}p(Ne,"retainedProjection");export{xe as answerNativeReading,be as authenticateNativeProfile,v as authenticateSignedPort,f as canonicalJson,je as fieldNames,we as loadSignedNativeReading,Se as nativeParentInputBytes,Ne as retainedProjection,ye as validateSignedNativeProfile};
+var _=Object.defineProperty;var p=(e,n)=>_(e,"name",{value:n,configurable:!0});import{sha256 as S}from"../hash.js";import{extname as H}from"node:path";import{gunzipSync as W}from"node:zlib";import{readBoundedFile as D}from"./bounded-file.js";import{members as K}from"../archive.js";import{installBoundary as B}from"./loader.js";import{nativeRootJobCustody as T}from"./custody.js";import{mountNativeImage as $}from"./image.js";import{createHash as E}from"node:crypto";import{library14_canonical as G}from"../../vendor/runtime.js";import{parsedLine as C}from"../../fold/claims.js";import{library5_answer as L}from"../../vendor/runtime.js";import{authorityFor as Q}from"../../fold/signers.js";import{library14_authorityAtEpoch as V}from"../../vendor/runtime.js";import{scheduleDeadline as X}from"./deadline.js";import{prepareNodeImage as Y,plannedJobs as Z,executeJobs as q}from"./node-jobs.js";const r=p(e=>{throw Error("REFUSE\xB7native reading "+e)},"fail"),f=p(e=>JSON.stringify(J(e)),"canonicalJson"),J=p(e=>Array.isArray(e)?e.map(J):e!==null&&typeof e=="object"?Object.fromEntries(Object.entries(e).sort(([n],[t])=>n<t?-1:n>t?1:0).map(([n,t])=>[n,J(t)])):e,"order"),A=new WeakMap;function v(e,n){(!e||!Number.isSafeInteger(e.epoch)||e.epoch<0||!Number.isSafeInteger(e.budget?.lines)||e.budget.lines<1||!Number.isSafeInteger(e.budget.bytes)||e.budget.bytes<1)&&r("missing authority/budget");const t=[...new Set([...e.history,...e.live])];t.length>e.budget.lines&&r("authority line budget");let i=0;for(const a of t)(typeof a!="string"||(i+=Buffer.byteLength(a))>e.budget.bytes)&&r("authority byte budget");/^port\/[^\s]+$/.test(n)||r("selection is not a command port");const o=e.live.filter(a=>{const d=C(a);return d.kind==="fact"&&d.value.fields.scope===n});o.length!==1&&r("missing/ambiguous signed declaration "+n);const h=o[0];e.history.includes(h)||r("port absent from authenticated admission history");const b=C(h);if(b.kind!=="fact")return r("port not a wire record");const s=b.value.fields;(s.role!=="writes"||s.form!=="alphabet"||s.measure!=="text"||s.value!=="lock"||typeof s.about!="string")&&r("unknown port projection "+n);const y=Q(e.history,e.signer,e.eras),g=y.of(h);g.kind!=="admitted"&&r("port signature/coverage "+g.why);const x=g.kind==="admitted"?g.signer:r("signature not admitted"),m=y.admitted.filter(a=>a.id===x);m.length!==1&&r("ambiguous port signer"),e.history.some(a=>{const d=C(a);return d.kind==="fact"&&d.value.fields.epoch!==void 0&&(!Number.isSafeInteger(Number(d.value.fields.epoch))||Number(d.value.fields.epoch)>e.epoch)})&&r("authority prefix exceeds current epoch");const c=V(s,m[0],e.epoch,n,"authority");c.kind!=="admitted"&&r("current port authority "+c.why);let l;try{l=JSON.parse(s.about)}catch{return r("port JSON invalid")}return(!l||typeof l!="object"||Array.isArray(l)||f(l)!==s.about)&&r("port profile invalid/noncanonical"),{line:h,profile:l}}p(v,"authenticateSignedPort");function N(e,n){const t=v(e,n),i=t.profile,o=t.line;return(!i.port||!i.selection||typeof i.selection!="object"||Array.isArray(i.selection))&&r("missing native selection"),Object.keys(i.selection).sort().join(",")!=="archive,bindings,budget,condition,entry,loaderConfig,loads,members,nativePreloadMembers,preload,reader,runtime"&&r("unknown native selection field"),(Object.keys(i).sort().join(",")!=="port,profile,selection"||i.profile!=="host-native-reading@1"||i.port?.coordinate!==n)&&r("unknown/noncanonical native profile"),{line:o,profile:i}}p(N,"selected");const z=new WeakMap;function R(e){if(e!==null&&typeof e=="object"){for(const n of Object.values(e))R(n);Object.freeze(e)}return e}p(R,"freezeProfile");function U(e,n,t){const i=Object.freeze({identity:S(f([t.line,e.epoch]))});return z.set(i,{root:{...e,history:[...e.history],live:[...e.live],eras:[...e.eras],budget:{...e.budget}},coordinate:n,profile:R(t.profile)}),i}p(U,"holdSelection");function be(e,n){const t=N(e,n),i=U(e,n,t);return Object.freeze({selection:i,line:t.line,profile:t.profile})}p(be,"authenticateNativeProfile");function ye(e,n,t){const i=N(e,n);return f(i.profile)!==f(t)&&r("expected profile differs from signature"),U(e,n,i)}p(ye,"validateSignedNativeProfile");function F(e,n,t){const i=N(e,n);f(i.profile)!==f(t.profile)&&r("resolved image/profile differs from signed selection"),(!(t.archive instanceof Uint8Array)||t.archive.byteLength>t.handoff.budget.bytes)&&r("archive exceeds declared input budget");let o;try{W(t.archive,{maxOutputLength:t.handoff.budget.bytes}),o=K(t.archive)}catch{return r("native implementation archive invalid")}const h=o.filter(c=>c.name===t.profile.selection.entry);(h.length!==1||"sha256:"+E("sha256").update(h[0].bytes).digest("hex")!==t.profile.port.implementation)&&r("archive native entry differs from implementation");const b={archive:"sha256:"+E("sha256").update(t.archive).digest("hex"),entry:t.profile.selection.entry,reader:t.profile.selection.reader,loaderConfig:t.profile.selection.loaderConfig,runtime:t.image.runtime,preload:t.image.preload??null,nativePreloadMembers:t.image.nativePreloadMembers,condition:t.image.condition,budget:t.handoff.budget,members:t.handoff.members.map(({coordinate:c,digest:l})=>({coordinate:c,digest:l})),bindings:t.handoff.bindings,loads:t.handoff.loads};f(b)!==f(t.profile.selection)&&r("resolved host bindings differ from signed selection"),t.profile.port.implementation!==t.handoff.members.find(c=>c.coordinate===t.profile.selection.entry)?.digest&&r("native implementation differs from handed member"),t.handoff.bindings.some(c=>c.limits.slots!==t.handoff.bindings[0].limits.slots)&&r("native bindings need one declared parent slots resource"),(!Number.isSafeInteger(t.profile.port.timeoutMs)||t.profile.port.timeoutMs<1||!Number.isSafeInteger(t.profile.port.responseBytes)||t.profile.port.responseBytes<1)&&r("missing parent time/bytes");const s=t.profile.port;(Object.keys(s).sort().join(",")!=="closure,coordinate,environment,implementation,responseBytes,stderr,timeoutMs"||s.stderr!=="reject"||new Set(s.closure).size!==s.closure.length||f([...s.closure].sort())!==f([...new Set(t.handoff.members.map(c=>c.digest))].sort())||t.handoff.bindings.some(c=>f(c.environment.map(([l])=>l).sort())!==f([...s.environment].sort())))&&r("command resource/environment/closure projection differs");const y=S(f([e.signer.id,e.signer.publicKey,e.eras,e.epoch,e.history,e.live])),g={...t.handoff,authoritySnapshot:y,policy:S(f([t.handoff.policy,i.line,y]))},x=Y(g,{...t.image,commandPort:s}),m=Object.freeze({identity:S(f([i.line,e.epoch,x.identity]))});return A.set(m,{root:{...e,history:[...e.history],live:[...e.live],eras:[...e.eras],budget:{...e.budget}},coordinate:n,profile:i.profile,image:x,module:Object.freeze({...t.module})}),m}p(F,"prepareSignedNativeReading");async function we(e,n,t){const i=z.get(e);return i?t.withCurrent(async o=>{const h=N(o,i.coordinate);(o.epoch!==i.root.epoch||f(h.profile)!==f(i.profile)||f(o.history)!==f(i.root.history))&&r("authority changed before load"),F(o,i.coordinate,{...n,module:{}});const b=n.image.locations.find(a=>a.member===i.profile.selection.reader),s=n.handoff.members.find(a=>a.coordinate===i.profile.selection.loaderConfig),y=n.image.locations.find(a=>a.member===i.profile.selection.loaderConfig);if(!b||b.kind!=="module"||!s||!y||!i.profile.selection.nativePreloadMembers.includes(s.coordinate))return r("reader/config not selected");const g=D(y.path,n.handoff.budget.bytes,i.profile.selection.loaderConfig);S(g.toString("utf8"))!==s.digest&&r("loader configuration changed");let x;try{x=JSON.parse(g.toString("utf8"))}catch{return r("loader configuration invalid")}const m=x;m.platform!==n.image.condition&&r("selected runtime condition differs from logical platform"),(!Array.isArray(m.members)||m.members.some(a=>n.handoff.members.find(d=>d.coordinate===a.coordinate)?.digest!==a.digest))&&r("loader target not covered by exact signed image");const c=$(m,n.image.locations.filter(a=>m.members.some(d=>d.coordinate===a.member)).map(a=>({coordinate:a.member,path:a.path})),i.profile.selection.reader,n.handoff.budget),l=B(c.declaration);try{const a=await l.loadEntry();l.assertClosed();const d=F(o,i.coordinate,{...n,image:{...n.image,hostLoader:{...c,preload:new URL("./preload"+H(new URL(import.meta.url).pathname),import.meta.url).href}},module:a});return A.get(d).loader=c.declaration,A.get(d).custody=n.custody??T(o,n.profile,n.handoff,n.image,m),d}finally{l.close()}}):r("unknown pre-load selection")}p(we,"loadSignedNativeReading");async function xe(e,n,t,i){const o=A.get(e);if(!o)return r("unknown instrument selection");i.phase!=="act"&&r("effects forbidden during "+i.phase),i.signal?.aborted&&r("interrupted before wrapper");const h=process.hrtime.bigint()+BigInt(o.profile.port.timeoutMs)*1000000n,b=new AbortController,s=b.abort.bind(b,void 0),y=X(h,s);i.signal?.addEventListener("abort",s,{once:!0});try{return await i.guard.withCurrent(async g=>{const x=N(g,o.coordinate);if((f(x.profile)!==f(o.profile)||g.epoch!==o.root.epoch||S(f(g.history))!==S(f(o.root.history)))&&r("authority changed since preparation"),!o.loader)return r("reader not loaded by fixed host boundary");const m=B(o.loader);try{const c=n.map(u=>{let w;u.verb==="read"&&o.module.commands&&(L({receipt:p(j=>(w=j,[]),"receipt")},u,t).kind!=="fact"||!w)&&r("Asked extraction refused");const M=w?o.module.commands(w):[];return{request:u,asked:w,jobs:M}}),l=c.flatMap(u=>u.jobs),a=new TextEncoder().encode(JSON.stringify(l)),d=Z(o.image,a),k=l.length?await q(o.image,a,{phase:"act",signal:b.signal,custody:o.custody}):[];(k.length!==d.length||k.some((u,w)=>u.id!==d[w].id||u.identity!==d[w].identity||u.responses.length!==1))&&r("capture identity/count differs");const P=new Map(k.map(u=>[u.id,u]));P.size!==k.length&&r("duplicate capture");const I=c.map(({request:u,jobs:w})=>{const M=w.map(O=>{const j=P.get(O.id);return j?G({scope:"command/capture/"+O.id,shape:"same",role:"reads",form:"alphabet",measure:"text",value:"lock",by:"host",at:"witness:"+j.identity,about:JSON.stringify({identity:j.identity,responses:j.responses})}):r("missing capture "+O.id)});return L(o.module,{...u,lines:[...u.lines??[],...M]},t)});return I.length!==n.length?r("incomplete pure response"):((b.signal.aborted||process.hrtime.bigint()>=h)&&r("interrupted/timeout wrapper"),Buffer.byteLength(JSON.stringify(I))>o.profile.port.responseBytes&&r("parent response bytes exceeded"),m.assertClosed(),I)}finally{m.close()}})}finally{y(),i.signal?.removeEventListener("abort",s)}}p(xe,"answerNativeReading");function Se(e,n){const t=v(e,n.port).profile,i=t?.selection?.budget?.bytes;return(t?.profile!=="host-native-reading@1"||!Number.isSafeInteger(i)||i<1)&&r("parent executable input resource absent"),i}p(Se,"nativeParentInputBytes");function je(e){return Object.keys(e).sort().join(",")}p(je,"fieldNames");function Ne(e,n){return t=>{const i=e.get(t);return i?JSON.parse(f(i)):n("unknown verified selection")}}p(Ne,"retainedProjection");export{xe as answerNativeReading,be as authenticateNativeProfile,v as authenticateSignedPort,f as canonicalJson,je as fieldNames,we as loadSignedNativeReading,Se as nativeParentInputBytes,Ne as retainedProjection,ye as validateSignedNativeProfile};

package/dist/host/native/route.js

@@ -1 +1 @@
-var q=Object.defineProperty;var m=(t,e)=>q(t,"name",{value:e,configurable:!0});import{fieldNames as M}from"./reading.js";import{sha256 as b}from"../hash.js";import{dirname as O}from"node:path";import{realpathSync as W}from"node:fs";import{nativeBinaryOrigin as F}from"./native-binary.js";import{selectedHostControl as R}from"./control-selection.js";import{library11_authorityAtEpoch as P}from"../../vendor/runtime.js";import{parsedLine as x}from"../../fold/claims.js";import{authorityFor as E}from"../../fold/signers.js";import{authenticatedRootStanding as j}from"../admitted-place.js";import{nativeExecutorInputs as $}from"./materialize.js";import{materializeNativeRoute as Se}from"./materialize.js";import{assertNativeRuntime as G}from"./runtime.js";import{nativeReferenceInputs as H}from"./references.js";import{rootAuthorityProtection as w}from"../../land/act.js";import{currentNativeRoot as N,inheritedNativeRoot as L}from"./root.js";import{authenticateSignedPort as z,authenticateNativeProfile as A,canonicalJson as y}from"./reading.js";import{boundedProcess as U}from"../process-lifetime.js";import{validResponse as _,CapsuleProcessError as D}from"../capsule-process.js";import{processOf as K}from"../../observe/runner.js";const s=m(t=>{throw Error("REFUSE\xB7native route "+t)},"fail"),k=new WeakMap;function Q(t){const e=new Map,i=[];for(const f of t){if(!f.origin)continue;const o="native/binary-origin/"+f.origin.coordinate,g=b(f.origin.line),a=e.get(o);if(a!==void 0){a!==g&&s("conflicting binary origin input "+o);continue}e.set(o,g),i.push([o,g])}return Object.freeze(i)}m(Q,"nativeBinaryOriginInputs");function he(t,e,i){const f=w(t),o=N(t,process.pid,f);return I(t,e,i,o)}m(he,"prepareNativeRoute");function I(t,e,i,f){const{root:o,context:g}=f,a=A(o,e),c=a.profile,l=S(o,c),n=R(o,c),r=b(y([e,a.line,c,l,i??null,...n?[n]:[]])),d=[["native/selection",r],...i?[["native/reader-mapping",b(i)]]:[],...c.selection.members.map(p=>["native/"+p.coordinate,p.digest]),...l.map(p=>["native/binary/"+p.coordinate,b(p.line)])];d.push(...Q(l)),n&&d.push(["native/control-profile",b(n.line)],["native/control-worker",n.profile.worker.digest],["native/control-runtime",n.profile.runtime.digest]);const h={identity:r,profile:c,binaries:l,...n?{control:n}:{},inputs:d};return k.set(h,{store:t,coordinate:e,context:g,profile:c}),d.push(...$(h)),n&&d.find(([p])=>p===n.profile.worker.coordinate)?.[1]!==n.profile.worker.digest&&s("control worker differs from sealed executor"),Object.freeze(d),Object.freeze(h)}m(I,"prepareAtCurrentRoot");function J(t){const e=k.get(t);if(!e)return s("unknown prepared route");const i=w(e.store),f=L({store:e.store,parent:process.pid,expected:e.context},i),o=z(f,e.coordinate).profile;(y(o)!==y(e.profile)||y(S(f,e.profile))!==y(t.binaries)||y(R(f,e.profile)??null)!==y(t.control??null))&&s("current port changed")}m(J,"assertNativeRouteCurrent");function ve(t,e){const i=k.get(t);if(!i)return s("unknown prepared route");J(t),G(e.execution.env,e.execution.flags),e.execution.context.implementation!==i.profile.selection.archive&&s("reading implementation differs"),H(e.execution.context.inputs,t.inputs),(e.limits.timeoutMs>i.profile.port.timeoutMs||e.limits.responseBytes>i.profile.port.responseBytes)&&s("reader limits exceed current command grant");const f=w(i.store),o={proof:f,archive:e.archive,locations:e.locations,requests:e.requests},g=[K("native"),i.store,i.coordinate,JSON.stringify(i.context),"reserved",String(i.profile.selection.budget.bytes),"act",String(process.pid),JSON.stringify(e.execution)],a=U(process.execPath,g,JSON.stringify(o),e.limits,e.execution.cwd,e.execution.env);if(a.signal!==null||a.status!==0)throw new D("native child exited "+String(a.status??a.signal),a);let c;try{c=JSON.parse(a.stdout.trimEnd())}catch{return s("native child malformed batch")}return(!Array.isArray(c)||c.length!==e.requests.length||!c.every((l,n)=>_(l,e.requests[n])))&&s("native child invalid batch"),J(t),c}m(ve,"invokeNativeRoute");function T(t){return t.some(e=>{const i=x(e);return i.kind==="fact"&&i.value.fields.scope.startsWith("reader/")&&i.value.fields.scope.split("/").at(-1)==="port"&&i.value.fields.value!=="withdraw"})}m(T,"declaredNativeReaderPorts");function ye(t,e){const i=["reader",e.module,"port"].join("/");if(!j(O(t)).some(u=>{const v=x(u);return v.kind==="fact"&&v.value.fields.scope===i&&v.value.fields.value!=="withdraw"}))return;const o=w(t),g=N(t,process.pid,o),a=g.root,c=a.live.filter(u=>{const v=x(u);return v.kind==="fact"&&v.value.fields.scope===i});if(!c.length)return;c.length!==1&&s("ambiguous reader port "+i);const l=x(c[0]);if(l.kind!=="fact")return s("invalid reader port "+i);const n=l.value.fields;(n.role!=="writes"||n.form!=="alphabet"||n.measure!=="id"||typeof n.value!="string"||!/^port\/[^\s]+$/.test(n.value))&&s("malformed reader port "+i);const r=E(a.history,a.signer,a.eras),d=r.of(c[0]);if((d.kind!=="admitted"||d.signer!==a.signer.id)&&s("reader port is not Root signed "+i),d.kind!=="admitted")return s("reader port signature not admitted");const h=r.admitted.find(u=>u.id===d.signer);if(!h)return s("reader port signer absent");const p=P(n,h,a.epoch,i,"authority");return p.kind!=="admitted"&&s("reader port current eligibility "+p.why),I(t,n.value,c[0],g)}m(ye,"prepareNativeReaderRoute");function be(t){const e=k.get(t);return e?e.store:s("unknown prepared route")}m(be,"nativeRouteStore");function xe(t){B(t)}m(xe,"assertNativeReaderGrantsCurrent");function S(t,e){const i=[],f=new Set,o=M;for(const g of t.live){const a=x(g);if(a.kind!=="fact"||!a.value.fields.scope.startsWith("port/"))continue;let c;try{c=JSON.parse(a.value.fields.about??"")}catch{continue}if(!["host-native-binary@1","host-native-binary-origin@1"].includes(c?.profile)||c.selector?.port!==e.port.coordinate)continue;const l=a.value.fields.scope,n=z(t,l),r=n.profile;(o(r)!==(r.profile==="host-native-binary-origin@1"?"alias,condition,coordinate,entry,limits,origin,profile,selector":"alias,condition,coordinate,entry,limits,profile,selector")||r.coordinate!==l||typeof r.alias!="string"||!r.alias.length||r.alias.includes("\0")||typeof r.condition!="string"||!r.condition.length||o(r.selector??{})!=="binding,implementation,port"||r.selector.implementation!==e.port.implementation||!e.selection.bindings.some(u=>u.id===r.selector.binding))&&s("binary declaration differs from selected parent "+l);const d=r.entry,h=e.selection.members.find(u=>u.coordinate===d?.path);(o(d??{})!=="bytes,digest,path"||!h||d.path===e.selection.runtime||h.digest!==d.digest||!Number.isSafeInteger(d.bytes)||d.bytes<1||o(r.limits??{})!=="bytes"||!Number.isSafeInteger(r.limits.bytes)||r.limits.bytes<d.bytes||r.limits.bytes>e.selection.budget.bytes)&&s("binary outside selected image resources "+l),f.has(l)&&s("ambiguous binary declaration "+l),f.add(l),d.digest===e.selection.members.find(u=>u.coordinate===e.selection.runtime)?.digest&&s("binary aliases selected runtime");const p=F(t,r,n.line);p?.path===W(process.execPath)&&s("binary origin aliases actual runtime"),i.push(Object.freeze({line:n.line,coordinate:l,profile:r,...p?{origin:p}:{}}))}return Object.freeze(i)}m(S,"authenticatedNativeBinaries");function we(t,e,i){return b(y(["logical-native-image/2",t.selection,e,...i?[i]:[]]))}m(we,"nativeMountIdentity");function B(t){const e=j(O(t));if(!T(e))return[];const i=w(t),f=N(t,process.pid,i),o=f.root,g=o.live.flatMap(n=>{const r=x(n);return r.kind==="fact"&&r.value.fields.scope.startsWith("reader/")&&r.value.fields.scope.split("/").at(-1)==="port"?[{line:n,fields:r.value.fields}]:[]}),a=new Set,c=E(o.history,o.signer,o.eras),l=[];for(const{line:n,fields:r}of g){a.has(r.scope)&&s("ambiguous reader port "+r.scope),a.add(r.scope),(r.role!=="writes"||r.form!=="alphabet"||r.measure!=="id"||typeof r.value!="string"||!/^port\/[^\s]+$/.test(r.value))&&s("malformed reader port "+r.scope);const d=c.of(n);if((d.kind!=="admitted"||d.signer!==o.signer.id)&&s("reader port is not Root signed "+r.scope),d.kind!=="admitted")return s("reader mapping not admitted");const h=c.admitted.find(C=>C.id===d.signer);if(!h)return s("reader mapping signer absent");const p=P(r,h,o.epoch,r.scope,"authority");p.kind!=="admitted"&&s("reader port current eligibility "+p.why);const{profile:u}=A(o,r.value),v=R(o,u);l.push({profile:u,binaries:S(o,u),...v?{control:v}:{}})}return l}m(B,"currentNativeReaderSelections");function ke(t){return B(t).map(e=>e.profile)}m(ke,"currentNativeReaderProfiles");export{xe as assertNativeReaderGrantsCurrent,J as assertNativeRouteCurrent,S as authenticatedNativeBinaries,ke as currentNativeReaderProfiles,B as currentNativeReaderSelections,T as declaredNativeReaderPorts,ve as invokeNativeRoute,Se as materializeNativeRoute,Q as nativeBinaryOriginInputs,we as nativeMountIdentity,be as nativeRouteStore,ye as prepareNativeReaderRoute,he as prepareNativeRoute};
+var q=Object.defineProperty;var m=(t,e)=>q(t,"name",{value:e,configurable:!0});import{fieldNames as M}from"./reading.js";import{sha256 as b}from"../hash.js";import{dirname as O}from"node:path";import{realpathSync as W}from"node:fs";import{nativeBinaryOrigin as F}from"./native-binary.js";import{selectedHostControl as R}from"./control-selection.js";import{library14_authorityAtEpoch as P}from"../../vendor/runtime.js";import{parsedLine as x}from"../../fold/claims.js";import{authorityFor as E}from"../../fold/signers.js";import{authenticatedRootStanding as j}from"../admitted-place.js";import{nativeExecutorInputs as $}from"./materialize.js";import{materializeNativeRoute as Se}from"./materialize.js";import{assertNativeRuntime as G}from"./runtime.js";import{nativeReferenceInputs as H}from"./references.js";import{rootAuthorityProtection as w}from"../../land/act.js";import{currentNativeRoot as N,inheritedNativeRoot as L}from"./root.js";import{authenticateSignedPort as z,authenticateNativeProfile as A,canonicalJson as y}from"./reading.js";import{boundedProcess as U}from"../process-lifetime.js";import{validResponse as _,CapsuleProcessError as D}from"../capsule-process.js";import{processOf as K}from"../../observe/runner.js";const s=m(t=>{throw Error("REFUSE\xB7native route "+t)},"fail"),k=new WeakMap;function Q(t){const e=new Map,i=[];for(const f of t){if(!f.origin)continue;const o="native/binary-origin/"+f.origin.coordinate,g=b(f.origin.line),a=e.get(o);if(a!==void 0){a!==g&&s("conflicting binary origin input "+o);continue}e.set(o,g),i.push([o,g])}return Object.freeze(i)}m(Q,"nativeBinaryOriginInputs");function he(t,e,i){const f=w(t),o=N(t,process.pid,f);return I(t,e,i,o)}m(he,"prepareNativeRoute");function I(t,e,i,f){const{root:o,context:g}=f,a=A(o,e),c=a.profile,l=S(o,c),n=R(o,c),r=b(y([e,a.line,c,l,i??null,...n?[n]:[]])),d=[["native/selection",r],...i?[["native/reader-mapping",b(i)]]:[],...c.selection.members.map(p=>["native/"+p.coordinate,p.digest]),...l.map(p=>["native/binary/"+p.coordinate,b(p.line)])];d.push(...Q(l)),n&&d.push(["native/control-profile",b(n.line)],["native/control-worker",n.profile.worker.digest],["native/control-runtime",n.profile.runtime.digest]);const h={identity:r,profile:c,binaries:l,...n?{control:n}:{},inputs:d};return k.set(h,{store:t,coordinate:e,context:g,profile:c}),d.push(...$(h)),n&&d.find(([p])=>p===n.profile.worker.coordinate)?.[1]!==n.profile.worker.digest&&s("control worker differs from sealed executor"),Object.freeze(d),Object.freeze(h)}m(I,"prepareAtCurrentRoot");function J(t){const e=k.get(t);if(!e)return s("unknown prepared route");const i=w(e.store),f=L({store:e.store,parent:process.pid,expected:e.context},i),o=z(f,e.coordinate).profile;(y(o)!==y(e.profile)||y(S(f,e.profile))!==y(t.binaries)||y(R(f,e.profile)??null)!==y(t.control??null))&&s("current port changed")}m(J,"assertNativeRouteCurrent");function ve(t,e){const i=k.get(t);if(!i)return s("unknown prepared route");J(t),G(e.execution.env,e.execution.flags),e.execution.context.implementation!==i.profile.selection.archive&&s("reading implementation differs"),H(e.execution.context.inputs,t.inputs),(e.limits.timeoutMs>i.profile.port.timeoutMs||e.limits.responseBytes>i.profile.port.responseBytes)&&s("reader limits exceed current command grant");const f=w(i.store),o={proof:f,archive:e.archive,locations:e.locations,requests:e.requests},g=[K("native"),i.store,i.coordinate,JSON.stringify(i.context),"reserved",String(i.profile.selection.budget.bytes),"act",String(process.pid),JSON.stringify(e.execution)],a=U(process.execPath,g,JSON.stringify(o),e.limits,e.execution.cwd,e.execution.env);if(a.signal!==null||a.status!==0)throw new D("native child exited "+String(a.status??a.signal),a);let c;try{c=JSON.parse(a.stdout.trimEnd())}catch{return s("native child malformed batch")}return(!Array.isArray(c)||c.length!==e.requests.length||!c.every((l,n)=>_(l,e.requests[n])))&&s("native child invalid batch"),J(t),c}m(ve,"invokeNativeRoute");function T(t){return t.some(e=>{const i=x(e);return i.kind==="fact"&&i.value.fields.scope.startsWith("reader/")&&i.value.fields.scope.split("/").at(-1)==="port"&&i.value.fields.value!=="withdraw"})}m(T,"declaredNativeReaderPorts");function ye(t,e){const i=["reader",e.module,"port"].join("/");if(!j(O(t)).some(u=>{const v=x(u);return v.kind==="fact"&&v.value.fields.scope===i&&v.value.fields.value!=="withdraw"}))return;const o=w(t),g=N(t,process.pid,o),a=g.root,c=a.live.filter(u=>{const v=x(u);return v.kind==="fact"&&v.value.fields.scope===i});if(!c.length)return;c.length!==1&&s("ambiguous reader port "+i);const l=x(c[0]);if(l.kind!=="fact")return s("invalid reader port "+i);const n=l.value.fields;(n.role!=="writes"||n.form!=="alphabet"||n.measure!=="id"||typeof n.value!="string"||!/^port\/[^\s]+$/.test(n.value))&&s("malformed reader port "+i);const r=E(a.history,a.signer,a.eras),d=r.of(c[0]);if((d.kind!=="admitted"||d.signer!==a.signer.id)&&s("reader port is not Root signed "+i),d.kind!=="admitted")return s("reader port signature not admitted");const h=r.admitted.find(u=>u.id===d.signer);if(!h)return s("reader port signer absent");const p=P(n,h,a.epoch,i,"authority");return p.kind!=="admitted"&&s("reader port current eligibility "+p.why),I(t,n.value,c[0],g)}m(ye,"prepareNativeReaderRoute");function be(t){const e=k.get(t);return e?e.store:s("unknown prepared route")}m(be,"nativeRouteStore");function xe(t){B(t)}m(xe,"assertNativeReaderGrantsCurrent");function S(t,e){const i=[],f=new Set,o=M;for(const g of t.live){const a=x(g);if(a.kind!=="fact"||!a.value.fields.scope.startsWith("port/"))continue;let c;try{c=JSON.parse(a.value.fields.about??"")}catch{continue}if(!["host-native-binary@1","host-native-binary-origin@1"].includes(c?.profile)||c.selector?.port!==e.port.coordinate)continue;const l=a.value.fields.scope,n=z(t,l),r=n.profile;(o(r)!==(r.profile==="host-native-binary-origin@1"?"alias,condition,coordinate,entry,limits,origin,profile,selector":"alias,condition,coordinate,entry,limits,profile,selector")||r.coordinate!==l||typeof r.alias!="string"||!r.alias.length||r.alias.includes("\0")||typeof r.condition!="string"||!r.condition.length||o(r.selector??{})!=="binding,implementation,port"||r.selector.implementation!==e.port.implementation||!e.selection.bindings.some(u=>u.id===r.selector.binding))&&s("binary declaration differs from selected parent "+l);const d=r.entry,h=e.selection.members.find(u=>u.coordinate===d?.path);(o(d??{})!=="bytes,digest,path"||!h||d.path===e.selection.runtime||h.digest!==d.digest||!Number.isSafeInteger(d.bytes)||d.bytes<1||o(r.limits??{})!=="bytes"||!Number.isSafeInteger(r.limits.bytes)||r.limits.bytes<d.bytes||r.limits.bytes>e.selection.budget.bytes)&&s("binary outside selected image resources "+l),f.has(l)&&s("ambiguous binary declaration "+l),f.add(l),d.digest===e.selection.members.find(u=>u.coordinate===e.selection.runtime)?.digest&&s("binary aliases selected runtime");const p=F(t,r,n.line);p?.path===W(process.execPath)&&s("binary origin aliases actual runtime"),i.push(Object.freeze({line:n.line,coordinate:l,profile:r,...p?{origin:p}:{}}))}return Object.freeze(i)}m(S,"authenticatedNativeBinaries");function we(t,e,i){return b(y(["logical-native-image/2",t.selection,e,...i?[i]:[]]))}m(we,"nativeMountIdentity");function B(t){const e=j(O(t));if(!T(e))return[];const i=w(t),f=N(t,process.pid,i),o=f.root,g=o.live.flatMap(n=>{const r=x(n);return r.kind==="fact"&&r.value.fields.scope.startsWith("reader/")&&r.value.fields.scope.split("/").at(-1)==="port"?[{line:n,fields:r.value.fields}]:[]}),a=new Set,c=E(o.history,o.signer,o.eras),l=[];for(const{line:n,fields:r}of g){a.has(r.scope)&&s("ambiguous reader port "+r.scope),a.add(r.scope),(r.role!=="writes"||r.form!=="alphabet"||r.measure!=="id"||typeof r.value!="string"||!/^port\/[^\s]+$/.test(r.value))&&s("malformed reader port "+r.scope);const d=c.of(n);if((d.kind!=="admitted"||d.signer!==o.signer.id)&&s("reader port is not Root signed "+r.scope),d.kind!=="admitted")return s("reader mapping not admitted");const h=c.admitted.find(C=>C.id===d.signer);if(!h)return s("reader mapping signer absent");const p=P(r,h,o.epoch,r.scope,"authority");p.kind!=="admitted"&&s("reader port current eligibility "+p.why);const{profile:u}=A(o,r.value),v=R(o,u);l.push({profile:u,binaries:S(o,u),...v?{control:v}:{}})}return l}m(B,"currentNativeReaderSelections");function ke(t){return B(t).map(e=>e.profile)}m(ke,"currentNativeReaderProfiles");export{xe as assertNativeReaderGrantsCurrent,J as assertNativeRouteCurrent,S as authenticatedNativeBinaries,ke as currentNativeReaderProfiles,B as currentNativeReaderSelections,T as declaredNativeReaderPorts,ve as invokeNativeRoute,Se as materializeNativeRoute,Q as nativeBinaryOriginInputs,we as nativeMountIdentity,be as nativeRouteStore,ye as prepareNativeReaderRoute,he as prepareNativeRoute};

package/dist/host/native-place-state.js

@@ -0,0 +1 @@
+var i=Object.defineProperty;var o=(t,r)=>i(t,"name",{value:r,configurable:!0});import{existsSync as n}from"node:fs";import{storeOf as e}from"../land/ledger.js";import{admissionAnchor as a}from"../fold/admission-history.js";import{authenticatedStanding as m}from"./admitted-place.js";import{BoundRefusal as f}from"./refusals.js";function S(t){if(!n(e(t)))return"birth";try{if(a(t),!m(t).length)throw Error("no admitted history");return"admitted"}catch{throw new f("host/foundation-state","REFUSE\xB7host/foundation-state")}}o(S,"nativePlaceState");export{S as nativePlaceState};

package/dist/host/native-receiver.js

@@ -1 +1 @@
-var p=Object.defineProperty;var n=(r,e)=>p(r,"name",{value:e,configurable:!0});import{readFileSync as d,realpathSync as a}from"node:fs";import{basename as h,dirname as m,extname as b,isAbsolute as c,join as x,relative as w}from"node:path";import{library11_publicLock as R}from"../vendor/runtime.js";import{foldClaims as k,wireLinesOf as E}from"../fold/claims.js";import{declaredRootClockSource as S}from"./root-clock-source.js";import{withHostCall as l}from"./call-context.js";import{BoundRefusal as f}from"./refusals.js";function H(r,e){const t=a(r),o=a(e),i=w(t,o),s=b(o);if(!c(r)||!c(e)||i.startsWith("..")||c(i)||![".ts",".js"].includes(s))throw new f("host/context","REFUSE\xB7host/context");const u=R(E(d(x(t,"TARGET.bound"),"utf8")));if(!u)throw new f("host/context","REFUSE\xB7host requires a public instrument lock");return{name:h(t),runtime:{root:t,entry:o,directory:m(m(o)),extension:s,lock:k(u).standing}}}n(H,"nativeHostInstrument");function T(r,e){const t={instrumentName:e.name,runtime:structuredClone(e.runtime),output:n(()=>{},"output")},o=l(t,()=>S(r)),i=o.trust;return{selection:o.selection,trust:{...i,current:n(()=>l(t,()=>i.current()),"current"),historical:n(s=>l(t,()=>i.historical(s)),"historical")}}}n(T,"nativePlaceActReceiver");export{H as nativeHostInstrument,T as nativePlaceActReceiver};
+var b=Object.defineProperty;var o=(e,i)=>b(e,"name",{value:i,configurable:!0});import{readFileSync as x,realpathSync as c}from"node:fs";import{basename as w,dirname as p,extname as v,isAbsolute as a,join as E,relative as C}from"node:path";import{library14_publicLock as R}from"../vendor/runtime.js";import{foldClaims as k,wireLinesOf as S}from"../fold/claims.js";import{declaredRootClockSource as I}from"./root-clock-source.js";import{withHostCall as m}from"./call-context.js";import{BoundRefusal as d}from"./refusals.js";import{installedPackageIdentity as g}from"./native/installed-package.js";let y;function F(e,i){const t=c(e),n=c(i),r=C(t,n),s=v(n);if(!a(e)||!a(i)||r.startsWith("..")||a(r)||![".ts",".js"].includes(s))throw new d("host/context","REFUSE\xB7host/context");const l=x(E(t,"TARGET.bound"),"utf8"),u=y;if(u?.root===t&&u.file===n&&u.text===l)return structuredClone(u.value);const f=R(S(l));if(!f?.length)throw new d("host/context","REFUSE\xB7host requires a public instrument lock");const h={name:w(t),runtime:{root:t,entry:n,directory:p(p(n)),extension:s,lock:k(f).standing}};return Buffer.byteLength(l)<=2*1024*1024&&(y={root:t,file:n,text:l,value:structuredClone(h)}),h}o(F,"nativeHostInstrument");function G(e,i){const t={instrumentName:i.name,runtime:structuredClone(i.runtime),output:o(()=>{},"output")},n=m(t,()=>I(e)),r=n.trust;return{selection:n.selection,trust:{...r,current:o(()=>m(t,()=>r.current()),"current"),historical:o(s=>m(t,()=>r.historical(s)),"historical")}}}o(G,"nativePlaceActReceiver");function N(e,i){const t=e.limits?.signal,n=structuredClone({...e,limits:{...e.limits,signal:void 0}}),r={...n,limits:{...n.limits,...t?{signal:t}:{}}},s=g(r);return{...F(r.directory,i),digest:s.digest,installed:{digest:s.digest,request:r}}}o(N,"installedHostInstrument");function O(e,i){try{const t=e.installed;if(!t||!/^sha256:[a-f0-9]{64}$/.test(i)||t.digest!==i||c(t.request.directory)!==c(e.runtime.root)||g(t.request).digest!==i)throw Error("installed pin differs")}catch{throw new d("host/instrument-pin","REFUSE\xB7host/instrument-pin")}}o(O,"verifyHostInstrument");export{N as installedHostInstrument,F as nativeHostInstrument,G as nativePlaceActReceiver,O as verifyHostInstrument};