@ontrails/core 1.0.0-beta.30 → 1.0.0-beta.39

package/src/resource-config.ts

@@ -585,7 +585,7 @@ const withResolvedResources = (
 /**
  * Resolved trail context plus lease release for resources used by the run.
  */
-interface ResolvedResourceScope {
+export interface ResolvedResourceScope {
   readonly ctx: TrailContext;
   release(): void;
 }
@@ -593,14 +593,26 @@ interface ResolvedResourceScope {
 const releaseNoResources = (): undefined => undefined;
 
 /**
- * Resolve all declared resources for a trail.
+ * Resolve all declared resources for a resource-bearing declaration.
  *
  * Validates per-resource config, checks overrides and caches, and creates
  * new instances as needed. Returns an enriched context with all resource
- * instances injected into extensions.
+ * instances injected into extensions. Callers own the returned `release`.
+ *
+ * @example
+ * ```ts
+ * const scope = await createResources(
+ *   { resources: [secretsStore] },
+ *   createTrailContext()
+ * );
+ * if (scope.isOk()) {
+ *   const secrets = secretsStore.from(scope.value.ctx);
+ *   scope.value.release();
+ * }
+ * ```
  */
 export const createResources = async (
-  trail: AnyTrail,
+  trail: Pick<AnyTrail, 'resources'>,
   ctx: TrailContext,
   overrides?: ResourceOverrideMap,
   configValues?: ConfigValues

package/src/runtime-builtins.ts

@@ -0,0 +1,69 @@
+/**
+ * Lazy runtime-builtin loading for the execution-portable core barrel.
+ *
+ * Core tooling modules that need Bun or Node capabilities (`bun:sqlite`,
+ * `node:fs`, `node:os`, `node:path`) must not import them eagerly: the
+ * core barrel sits on the execution path of every surface, and edge
+ * runtimes such as workerd refuse module graphs that import `bun:`
+ * builtins and gate `node:` builtins behind compatibility flags
+ * (TRL-1198). Loading through `process.getBuiltinModule` keeps the
+ * specifier out of bundler module graphs entirely and defers the
+ * capability requirement to first use, so runtimes that never call a
+ * tooling helper never pay for it.
+ */
+
+import type * as BunSqlite from 'bun:sqlite';
+import type * as NodeFs from 'node:fs';
+import type * as NodeOs from 'node:os';
+import type * as NodePath from 'node:path';
+
+import { InternalError } from './errors.js';
+
+interface BuiltinModules {
+  readonly 'bun:sqlite': typeof BunSqlite;
+  readonly 'node:fs': typeof NodeFs;
+  readonly 'node:os': typeof NodeOs;
+  readonly 'node:path': typeof NodePath;
+}
+
+const loadedBuiltins = new Map<keyof BuiltinModules, unknown>();
+
+/**
+ * Load a Bun/Node builtin module at first use.
+ *
+ * @throws {InternalError} When the runtime does not expose the builtin
+ * (for example workerd without `nodejs_compat`). Trail execution never
+ * reaches this loader; only tooling helpers (trails-db, workspace
+ * discovery) do.
+ */
+export const loadRuntimeBuiltin = <TName extends keyof BuiltinModules>(
+  name: TName
+): BuiltinModules[TName] => {
+  const cached = loadedBuiltins.get(name);
+  if (cached !== undefined) {
+    return cached as BuiltinModules[TName];
+  }
+
+  const proc = (
+    globalThis as {
+      readonly process?: {
+        readonly getBuiltinModule?: (id: string) => unknown;
+      };
+    }
+  ).process;
+  if (typeof proc?.getBuiltinModule !== 'function') {
+    throw new InternalError(
+      `Runtime builtin "${name}" is unavailable: this runtime does not expose process.getBuiltinModule. Trails tooling helpers need a Bun or Node runtime; the trail execution path never loads them.`
+    );
+  }
+
+  const loaded = proc.getBuiltinModule(name);
+  if (loaded === undefined || loaded === null) {
+    throw new InternalError(
+      `Runtime builtin "${name}" is unavailable on this runtime.`
+    );
+  }
+
+  loadedBuiltins.set(name, loaded);
+  return loaded as BuiltinModules[TName];
+};

package/src/sha256.ts

@@ -0,0 +1,136 @@
+/**
+ * Pure synchronous SHA-256 for runtime-portable fingerprints.
+ *
+ * `node:crypto`'s `createHash` is unavailable on edge runtimes without
+ * compatibility flags, and Web Crypto's `subtle.digest` is asynchronous,
+ * which does not fit the synchronous summary paths that need a digest
+ * (signal payload summaries, per-project store keys). This implementation
+ * follows FIPS 180-4 and produces output identical to
+ * `createHash('sha256').update(text).digest('hex')`.
+ */
+
+/* oxlint-disable no-bitwise, unicorn/prefer-math-trunc, unicorn/number-literal-case -- SHA-256 is defined over 32-bit words: rotations, xor, and `>>> 0` unsigned wrapping are the specified operations, and `Math.trunc()` is not equivalent to `>>> 0` (it neither wraps to 32 bits nor coerces to unsigned). number-literal-case is disabled because oxfmt normalizes hex digits to lowercase, which the rule rejects — the formatter wins. */
+
+// FIPS 180-4 §4.2.2: first 32 bits of the fractional parts of the cube
+// roots of the first 64 primes.
+const K = Uint32Array.from([
+  0x42_8a_2f_98, 0x71_37_44_91, 0xb5_c0_fb_cf, 0xe9_b5_db_a5, 0x39_56_c2_5b,
+  0x59_f1_11_f1, 0x92_3f_82_a4, 0xab_1c_5e_d5, 0xd8_07_aa_98, 0x12_83_5b_01,
+  0x24_31_85_be, 0x55_0c_7d_c3, 0x72_be_5d_74, 0x80_de_b1_fe, 0x9b_dc_06_a7,
+  0xc1_9b_f1_74, 0xe4_9b_69_c1, 0xef_be_47_86, 0x0f_c1_9d_c6, 0x24_0c_a1_cc,
+  0x2d_e9_2c_6f, 0x4a_74_84_aa, 0x5c_b0_a9_dc, 0x76_f9_88_da, 0x98_3e_51_52,
+  0xa8_31_c6_6d, 0xb0_03_27_c8, 0xbf_59_7f_c7, 0xc6_e0_0b_f3, 0xd5_a7_91_47,
+  0x06_ca_63_51, 0x14_29_29_67, 0x27_b7_0a_85, 0x2e_1b_21_38, 0x4d_2c_6d_fc,
+  0x53_38_0d_13, 0x65_0a_73_54, 0x76_6a_0a_bb, 0x81_c2_c9_2e, 0x92_72_2c_85,
+  0xa2_bf_e8_a1, 0xa8_1a_66_4b, 0xc2_4b_8b_70, 0xc7_6c_51_a3, 0xd1_92_e8_19,
+  0xd6_99_06_24, 0xf4_0e_35_85, 0x10_6a_a0_70, 0x19_a4_c1_16, 0x1e_37_6c_08,
+  0x27_48_77_4c, 0x34_b0_bc_b5, 0x39_1c_0c_b3, 0x4e_d8_aa_4a, 0x5b_9c_ca_4f,
+  0x68_2e_6f_f3, 0x74_8f_82_ee, 0x78_a5_63_6f, 0x84_c8_78_14, 0x8c_c7_02_08,
+  0x90_be_ff_fa, 0xa4_50_6c_eb, 0xbe_f9_a3_f7, 0xc6_71_78_f2,
+]);
+
+const rotr = (value: number, bits: number): number =>
+  (value >>> bits) | (value << (32 - bits));
+
+/**
+ * Total array accessor: every read in the compression loop is provably in
+ * range, so the fallback never fires — it only satisfies
+ * `noUncheckedIndexedAccess` without an assertion.
+ */
+const wordAt = (words: Uint32Array, index: number): number => words[index] ?? 0;
+
+const padMessage = (bytes: Uint8Array): Uint8Array => {
+  const bitLength = bytes.length * 8;
+  // Message + 0x80 marker, padded to 56 mod 64, then a 64-bit big-endian
+  // bit length. Message sizes here are far below 2^32 bits, so the high
+  // word of the length is derived from the float division.
+  const paddedLength = (Math.floor((bytes.length + 8) / 64) + 1) * 64;
+  const padded = new Uint8Array(paddedLength);
+  padded.set(bytes);
+  padded[bytes.length] = 0x80;
+  const view = new DataView(padded.buffer);
+  view.setUint32(paddedLength - 8, Math.floor(bitLength / 0x1_00_00_00_00));
+  view.setUint32(paddedLength - 4, bitLength >>> 0);
+  return padded;
+};
+
+const fillSchedule = (w: Uint32Array, view: DataView, offset: number): void => {
+  for (let i = 0; i < 16; i += 1) {
+    w[i] = view.getUint32(offset + i * 4);
+  }
+  for (let i = 16; i < 64; i += 1) {
+    const w15 = wordAt(w, i - 15);
+    const w2 = wordAt(w, i - 2);
+    const s0 = rotr(w15, 7) ^ rotr(w15, 18) ^ (w15 >>> 3);
+    const s1 = rotr(w2, 17) ^ rotr(w2, 19) ^ (w2 >>> 10);
+    w[i] = (wordAt(w, i - 16) + s0 + wordAt(w, i - 7) + s1) >>> 0;
+  }
+};
+
+// oxlint-disable-next-line max-statements -- the FIPS 180-4 compression loop reads more clearly as one block than split across helpers
+const digestHex = (padded: Uint8Array): string => {
+  // FIPS 180-4 §5.3.3 initial hash value.
+  let h0 = 0x6a_09_e6_67;
+  let h1 = 0xbb_67_ae_85;
+  let h2 = 0x3c_6e_f3_72;
+  let h3 = 0xa5_4f_f5_3a;
+  let h4 = 0x51_0e_52_7f;
+  let h5 = 0x9b_05_68_8c;
+  let h6 = 0x1f_83_d9_ab;
+  let h7 = 0x5b_e0_cd_19;
+
+  const view = new DataView(padded.buffer);
+  const w = new Uint32Array(64);
+
+  for (let offset = 0; offset < padded.length; offset += 64) {
+    fillSchedule(w, view, offset);
+
+    let a = h0;
+    let b = h1;
+    let c = h2;
+    let d = h3;
+    let e = h4;
+    let f = h5;
+    let g = h6;
+    let h = h7;
+
+    for (let i = 0; i < 64; i += 1) {
+      const s1 = rotr(e, 6) ^ rotr(e, 11) ^ rotr(e, 25);
+      const ch = (e & f) ^ (~e & g);
+      const temp1 = (h + s1 + ch + wordAt(K, i) + wordAt(w, i)) >>> 0;
+      const s0 = rotr(a, 2) ^ rotr(a, 13) ^ rotr(a, 22);
+      const maj = (a & b) ^ (a & c) ^ (b & c);
+      const temp2 = (s0 + maj) >>> 0;
+
+      h = g;
+      g = f;
+      f = e;
+      e = (d + temp1) >>> 0;
+      d = c;
+      c = b;
+      b = a;
+      a = (temp1 + temp2) >>> 0;
+    }
+
+    h0 = (h0 + a) >>> 0;
+    h1 = (h1 + b) >>> 0;
+    h2 = (h2 + c) >>> 0;
+    h3 = (h3 + d) >>> 0;
+    h4 = (h4 + e) >>> 0;
+    h5 = (h5 + f) >>> 0;
+    h6 = (h6 + g) >>> 0;
+    h7 = (h7 + h) >>> 0;
+  }
+
+  return [h0, h1, h2, h3, h4, h5, h6, h7]
+    .map((word) => word.toString(16).padStart(8, '0'))
+    .join('');
+};
+
+/**
+ * SHA-256 of the UTF-8 encoding of `text`, as lowercase hex.
+ *
+ * Output-identical to `createHash('sha256').update(text).digest('hex')`.
+ */
+export const sha256Hex = (text: string): string =>
+  digestHex(padMessage(new TextEncoder().encode(text)));

package/src/signal-diagnostics.ts

@@ -5,11 +5,10 @@
  * observable without changing the best-effort producer API.
  */
 
-import { createHash } from 'node:crypto';
-
 import type { z } from 'zod';
 
 import type { ActivationProvenance } from './activation-provenance.js';
+import { sha256Hex } from './sha256.js';
 import type { Logger } from './types.js';
 
 export const SIGNAL_DIAGNOSTICS_SINK_KEY =
@@ -349,8 +348,9 @@ const stableJson = (value: unknown): string => {
   }
 };
 
-const hashText = (text: string): string =>
-  createHash('sha256').update(text).digest('hex');
+// Pure sha256 keeps payload summarization on the execution path portable:
+// node:crypto is unavailable on edge runtimes without compat flags.
+const hashText = (text: string): string => sha256Hex(text);
 
 export const summarizeSignalPayload = (
   payload: unknown

package/src/surface-filter.ts

@@ -1,4 +1,5 @@
 import type { Intent, Trail } from './trail.js';
+import { matchesAnyTrailIdGlob, matchesTrailIdGlob } from './trail-id-glob.js';
 import type { SurfaceSelectionOptions } from './surface-derivation.js';
 
 // ---------------------------------------------------------------------------
@@ -7,84 +8,10 @@ import type { SurfaceSelectionOptions } from './surface-derivation.js';
 
 export type SurfaceFilterOptions = SurfaceSelectionOptions;
 
-// ---------------------------------------------------------------------------
-// Glob matching
-// ---------------------------------------------------------------------------
-
-const trailIdSegments = (trailId: string): readonly string[] =>
-  trailId.split('.');
-
-const patternSegments = (pattern: string): readonly string[] =>
-  pattern.split('.');
-
-type SegmentMatcher = (
-  trail: readonly string[],
-  pattern: readonly string[],
-  trailIndex: number,
-  patternIndex: number
-) => boolean;
-
-const matchesDoubleStar = (
-  trail: readonly string[],
-  pattern: readonly string[],
-  trailIndex: number,
-  patternIndex: number,
-  matchSegments: SegmentMatcher
-): boolean =>
-  patternIndex === pattern.length - 1 ||
-  Array.from(
-    { length: trail.length - trailIndex + 1 },
-    (_, offset) => trailIndex + offset
-  ).some((index) => matchSegments(trail, pattern, index, patternIndex + 1));
-
-const matchesSingleSegment = (
-  trail: readonly string[],
-  pattern: readonly string[],
-  trailIndex: number,
-  patternIndex: number,
-  current: string,
-  matchSegments: SegmentMatcher
-): boolean =>
-  trailIndex < trail.length &&
-  (current === '*' || current === trail[trailIndex]) &&
-  matchSegments(trail, pattern, trailIndex + 1, patternIndex + 1);
-
-const matchesFrom = function matchesFrom(
-  trail: readonly string[],
-  pattern: readonly string[],
-  trailIndex: number,
-  patternIndex: number
-): boolean {
-  if (patternIndex >= pattern.length) {
-    return trailIndex >= trail.length;
-  }
-
-  const current = pattern[patternIndex];
-  if (current === undefined) {
-    return false;
-  }
-
-  return current === '**'
-    ? matchesDoubleStar(trail, pattern, trailIndex, patternIndex, matchesFrom)
-    : matchesSingleSegment(
-        trail,
-        pattern,
-        trailIndex,
-        patternIndex,
-        current,
-        matchesFrom
-      );
-};
-
 export const matchesTrailPattern = (
   trailId: string,
   pattern: string
-): boolean => {
-  if (pattern === trailId) {
-    return true;
-  }
-  return matchesFrom(trailIdSegments(trailId), patternSegments(pattern), 0, 0);
-};
+): boolean => matchesTrailIdGlob(trailId, pattern);
 
 // ---------------------------------------------------------------------------
 // Surface filtering
@@ -93,9 +20,7 @@ export const matchesTrailPattern = (
 const matchesAnyPattern = (
   trailId: string,
   patterns: readonly string[] | undefined
-): boolean =>
-  patterns !== undefined &&
-  patterns.some((pattern) => matchesTrailPattern(trailId, pattern));
+): boolean => matchesAnyTrailIdGlob(trailId, patterns);
 
 const isExplicitInternalInclude = (
   trailId: string,