@poe-platform/safe-bash 0.1.803 → 0.1.804

package/dist/remote-execution/protocol.js

@@ -1,208 +0,0 @@
-import { validateWire } from './wire-validation.js';
-export { validateWire };
-export { validateCallbackResult } from './callback-result.js';
-/** Readiness is more than a schema-shaped state label. Use the same progress
- * semantics on server results and recovered SDK observations. */
-export function validateDependencyMaterialization(value) {
-    validateWire('DependencyMaterialization', value);
-    const status = value;
-    if (new Set(status.callbackGrantIds).size !== status.callbackGrantIds.length
-        || status.entries.some((entry, index) => entry.index !== index || entry.state === 'applied' && entry.revision === null)
-        || status.state === 'ready' && (status.directoryRevision === null || status.error !== undefined || status.entries.some(entry => entry.state !== 'applied')))
-        throw new TypeError('Invalid dependency preparation progress or readiness');
-}
-function reject() { throw new TypeError('Invalid dependency manifest'); }
-function record(value, keys) {
-    if (!value || typeof value !== 'object' || Array.isArray(value))
-        reject();
-    const result = value;
-    if (Object.keys(result).some(key => !keys.includes(key)))
-        reject();
-    return result;
-}
-function id(value) {
-    if (typeof value !== 'string' || value.length === 0 || value.length > 256)
-        reject();
-}
-function bytes(value, limit) {
-    if (!Array.isArray(value) || !value.length || value.length > limit)
-        reject();
-    // Iteration visits holes as undefined; Array#some skips them and would admit
-    // SDK values whose JSON wire representation contains invalid null octets.
-    for (const n of value)
-        if (!Number.isInteger(n) || n < 1 || n > 255)
-            reject();
-}
-function decimal(value, signed = false) {
-    if (typeof value !== 'string' || !value.length || value.length > 20)
-        reject();
-    const digits = signed && value.startsWith('-') ? value.slice(1) : value;
-    if (!digits.length || (digits.length > 1 && digits[0] === '0') || value === '-0'
-        || Array.from(digits).some(c => c < '0' || c > '9'))
-        reject();
-    const n = BigInt(value);
-    if (n < (signed ? -9223372036854775808n : 0n) || n > 9223372036854775807n)
-        reject();
-}
-/** Pure wire/structural validation shared by REST and SDK. Does no IO and grants
- * no authority. Server admission must additionally verify bindings, collisions,
- * blobs, snapshot guarantees and callback rights using authenticated host state. */
-/** Preparation accepts host-issued identities, never caller-selected physical
- * destinations. Scope and revision authority are separately checked by the host. */
-export function validateDependencyMaterializeRequest(value) {
-    const request = record(value, ['sessionId', 'epoch', 'manifestId', 'manifestRevision', 'bindingId', 'expectedDirectoryRevision', 'operationKey']);
-    for (const field of ['sessionId', 'epoch', 'manifestId', 'manifestRevision', 'bindingId', 'operationKey'])
-        id(request[field]);
-    if (request.expectedDirectoryRevision !== null)
-        id(request.expectedDirectoryRevision);
-}
-export function validateDependencyManifest(value, limits) {
-    if (!Number.isSafeInteger(limits.maxEntries) || limits.maxEntries < 0
-        || !Number.isSafeInteger(limits.maxPathBytes) || limits.maxPathBytes < 1)
-        reject();
-    const m = record(value, ['version', 'sessionId', 'epoch', 'namespaceId', 'revision', 'logicalRoot', 'cwd', 'sourceAuthorityId', 'entries']);
-    if (m.version !== 1)
-        reject();
-    for (const key of ['sessionId', 'epoch', 'namespaceId', 'revision', 'sourceAuthorityId'])
-        id(m[key]);
-    for (const key of ['logicalRoot', 'cwd']) {
-        bytes(m[key], limits.maxPathBytes);
-        if (m[key][0] !== 47)
-            reject();
-    }
-    if (!Array.isArray(m.entries) || m.entries.length > limits.maxEntries)
-        reject();
-    const paths = new Map();
-    const identities = new Map();
-    let previous;
-    for (const raw of m.entries) {
-        const kind = record(raw, ['kind', 'path', 'source', 'metadata', 'blob', 'identityRef', 'target', 'operations']).kind;
-        const fields = { directory: [], file: ['blob', 'identityRef'], symlink: ['target'], hardlink: ['identityRef'], 'output-intent': ['operations'] };
-        if (typeof kind !== 'string' || !Object.hasOwn(fields, kind))
-            reject();
-        const entry = record(raw, ['kind', 'path', 'source', 'metadata', ...fields[kind]]);
-        if (!Array.isArray(entry.path) || !entry.path.length)
-            reject();
-        const components = [];
-        for (const component of entry.path) {
-            bytes(component, limits.maxPathBytes);
-            if (component.includes(47) || (component.every(n => n === 46) && component.length <= 2))
-                reject();
-            components.push(component);
-        }
-        const flat = components.flatMap((c, i) => i === 0 ? c : [47, ...c]);
-        if (flat.length > limits.maxPathBytes)
-            reject();
-        const key = JSON.stringify(components);
-        if (paths.has(key))
-            reject();
-        if (components.length > 1 && paths.get(JSON.stringify(components.slice(0, -1))) !== 'directory')
-            reject();
-        if (previous) {
-            const different = flat.findIndex((n, i) => n !== previous?.[i]);
-            if (different < 0 || flat[different] < (previous[different] ?? -1))
-                reject();
-        }
-        previous = flat;
-        paths.set(key, kind);
-        const source = record(entry.source, ['authorityId', 'path', 'freshness', 'observedVersion', 'retainedIdentity', 'snapshotId', 'callbackGrantId']);
-        id(source.authorityId);
-        if (source.authorityId !== m.sourceAuthorityId)
-            reject();
-        bytes(source.path, limits.maxPathBytes);
-        if (source.path[0] !== 47)
-            reject();
-        for (const k of ['observedVersion', 'retainedIdentity'])
-            if (source[k] !== null)
-                id(source[k]);
-        if (source.freshness === 'immutable')
-            id(source.snapshotId);
-        else if (source.freshness === 'live' || source.freshness === 'revalidate-on-open')
-            id(source.callbackGrantId);
-        else
-            reject();
-        if (source.snapshotId !== undefined)
-            id(source.snapshotId);
-        if (source.callbackGrantId !== undefined)
-            id(source.callbackGrantId);
-        if (entry.metadata !== undefined) {
-            const meta = record(entry.metadata, ['mode', 'atimeNs', 'mtimeNs']);
-            if (meta.mode !== undefined && (typeof meta.mode !== 'number' || !Number.isInteger(meta.mode) || meta.mode < 0 || meta.mode > 0o7777))
-                reject();
-            for (const k of ['atimeNs', 'mtimeNs'])
-                if (meta[k] !== undefined)
-                    decimal(meta[k], true);
-        }
-        if (kind === 'file') {
-            const blob = record(entry.blob, ['blobId', 'size', 'sha256']);
-            id(blob.blobId);
-            decimal(blob.size);
-            if (typeof blob.sha256 !== 'string' || blob.sha256.length !== 64
-                || Array.from(blob.sha256).some(c => !'0123456789abcdef'.includes(c)))
-                reject();
-            if (entry.identityRef !== undefined) {
-                id(entry.identityRef);
-                if (identities.has(entry.identityRef))
-                    reject();
-                identities.set(entry.identityRef, {});
-            }
-        }
-        if (kind === 'hardlink') {
-            id(entry.identityRef);
-            if (!identities.has(entry.identityRef))
-                reject();
-        }
-        if ((kind === 'file' || kind === 'hardlink') && entry.identityRef !== undefined && entry.metadata !== undefined) {
-            const metadata = entry.metadata;
-            const requested = identities.get(entry.identityRef);
-            for (const field of ['mode', 'atimeNs', 'mtimeNs']) {
-                if (metadata[field] === undefined)
-                    continue;
-                if (requested[field] !== undefined && requested[field] !== metadata[field])
-                    reject();
-                requested[field] = metadata[field];
-            }
-        }
-        if (kind === 'symlink')
-            bytes(entry.target, limits.maxPathBytes);
-        if (kind === 'output-intent') {
-            if (!Array.isArray(entry.operations) || !entry.operations.length
-                || new Set(entry.operations).size !== entry.operations.length)
-                reject();
-            for (const op of entry.operations)
-                if (!['create', 'truncate', 'append', 'replace'].includes(op))
-                    reject();
-            if (entry.metadata !== undefined || source.freshness === 'immutable')
-                reject();
-        }
-    }
-}
-/** Pure invocation admission. Host admission must separately match the manifest,
- * ready revision and canonical cwd, and qualify the native launcher's byte support.
- * maxArgvBytes includes one native NUL terminator per argument, never pointer bytes. */
-export function validateManifestInvocation(value, limits) {
-    for (const limit of [limits.maxArguments, limits.maxArgvBytes]) {
-        if (!Number.isSafeInteger(limit) || limit < 0)
-            reject();
-    }
-    if (!Number.isSafeInteger(limits.maxPathBytes) || limits.maxPathBytes < 1)
-        reject();
-    const invocation = record(value, ['manifestId', 'manifestRevision', 'directoryRevision', 'cwd', 'originalArgv']);
-    for (const field of ['manifestId', 'manifestRevision', 'directoryRevision'])
-        id(invocation[field]);
-    bytes(invocation.cwd, limits.maxPathBytes);
-    if (invocation.cwd[0] !== 47)
-        reject();
-    if (!Array.isArray(invocation.originalArgv) || invocation.originalArgv.length > limits.maxArguments)
-        reject();
-    let remaining = limits.maxArgvBytes;
-    for (const argument of invocation.originalArgv) {
-        if (!Array.isArray(argument) || argument.length >= remaining)
-            reject();
-        // Empty arguments are valid; holes and NUL octets are never empty arguments.
-        if (argument.length > 0)
-            bytes(argument, remaining - 1);
-        remaining -= argument.length + 1;
-    }
-}
-export { uploadInteger, validateUploadRequest } from './upload-protocol.js';

package/dist/remote-execution/relay.js

@@ -1,91 +0,0 @@
-/** Transport-only forwarding. Native retains TLS, HTTP, redirects, cookies,
- * ranges, retries and live reads. A runtime socket bridge is required to restore
- * endpoint metadata; merely forwarding packets does not qualify peer identity.
- * Frames are bounded to 1 MiB. Stream adapters may frame a larger byte stream;
- * datagram adapters must reject oversized packets without splitting them. */
-export async function relayTransport(semantics, left, right, signal) {
-    // Retain the authenticated adapters and their retirement methods before any
-    // I/O yields. Later producer mutation must not substitute a different port.
-    [left, right] = [left, right].map(port => ({
-        receive: port.receive.bind(port),
-        send: port.send.bind(port),
-        close: port.close.bind(port),
-    }));
-    const controller = new AbortController();
-    // AbortController replaces an undefined reason with AbortError. Retain the
-    // first adapter failure separately so cancellation cannot rewrite it.
-    let transportFailure;
-    const abort = () => controller.abort(signal?.reason);
-    signal?.addEventListener('abort', abort, { once: true });
-    if (signal?.aborted)
-        abort();
-    async function forward(source, target) {
-        let ended = false;
-        try {
-            for (;;) {
-                controller.signal.throwIfAborted();
-                const received = await source.receive(controller.signal);
-                controller.signal.throwIfAborted();
-                if (received === null)
-                    return;
-                // Validate and forward the same metadata, even for adapter accessors.
-                const frame = { ...received };
-                if (semantics === 'datagram' ? frame.kind !== 'datagram' : frame.kind !== 'bytes' && frame.kind !== 'end') {
-                    throw new Error('Relay frame violates admitted transport semantics');
-                }
-                if (frame.kind !== 'end' && !(frame.payload instanceof Uint8Array)) {
-                    throw new Error('Relay frame requires native payload bytes');
-                }
-                // Typed-array metadata can be shadowed by an adapter. Bound the native
-                // buffer before allocation; datagrams must never be split to fit.
-                if (frame.kind !== 'end' && Object.getOwnPropertyDescriptor(Object.getPrototypeOf(Uint8Array.prototype), 'byteLength').get.call(frame.payload) > 1024 * 1024) {
-                    throw new Error('Relay frame exceeds transport limit');
-                }
-                if (frame.kind === 'datagram' && (typeof frame.source !== 'string' || !frame.source
-                    || typeof frame.destination !== 'string' || !frame.destination)) {
-                    throw new Error('Relay frame requires native endpoint identities');
-                }
-                if (ended)
-                    throw new Error('Relay received data after stream half-close');
-                if (frame.kind === 'end')
-                    ended = true;
-                // Native metadata accessors can cancel while the frame is captured.
-                // Do not hand canceled work to a transport adapter after validation.
-                controller.signal.throwIfAborted();
-                await target.send(frame.kind === 'end' ? { kind: 'end' } : { ...frame, payload: new Uint8Array(frame.payload) }, controller.signal);
-            }
-        }
-        catch (error) {
-            if (!controller.signal.aborted)
-                transportFailure = { cause: error };
-            controller.abort(error);
-            throw error;
-        }
-    }
-    const failures = [];
-    try {
-        if (semantics !== 'stream' && semantics !== 'datagram') {
-            throw new Error('Relay transport requires supported semantics');
-        }
-        const results = await Promise.allSettled([forward(left, right), forward(right, left)]);
-        if (controller.signal.aborted)
-            throw transportFailure ? transportFailure.cause : controller.signal.reason;
-        for (const result of results)
-            if (result.status === 'rejected')
-                throw result.reason;
-    }
-    catch (error) {
-        failures.push(error);
-    }
-    finally {
-        signal?.removeEventListener('abort', abort);
-        const cleanup = await Promise.allSettled([left, right].map(port => Promise.resolve().then(() => port.close())));
-        for (const result of cleanup)
-            if (result.status === 'rejected')
-                failures.push(result.reason);
-    }
-    if (failures.length === 1)
-        throw failures[0];
-    if (failures.length > 1)
-        throw new AggregateError(failures, 'Relay transport retirement failed');
-}

package/dist/remote-execution/rest-driver.js

@@ -1,93 +0,0 @@
-import { boundedTransfer } from './hosting-stream.js';
-import { hostingRequest } from './hosting-request.js';
-import { hostingOperation } from './hosting-operation.js';
-/** The trusted resolver binds tenancy and readiness. Resolving on each request
- * permits token/tunnel rotation and restart without replaying a request body.
- * Existing servers are never provisioned or destroyed by this driver. */
-export function createRestExecutionDriver(config, resolve, fetch = globalThis.fetch, now = Date.now, retire) {
-    if (config.transport !== 'https')
-        throw new TypeError('HTTPS transport required');
-    if (!resolve && !config.endpoints)
-        throw new TypeError('Existing-server bindings or resolver required');
-    const bindings = new Map(Object.entries(config.endpoints ?? {}).map(([namespaceId, endpoint]) => [namespaceId, { ...endpoint }]));
-    const endpoints = new Map();
-    const cleanups = new Map();
-    return {
-        async acquire(namespaceId) {
-            if (!namespaceId)
-                throw new TypeError('Trusted namespace identity required');
-            await cleanups.get(namespaceId);
-            let entry = endpoints.get(namespaceId);
-            if (!entry) {
-                entry = { retired: false, abort: new AbortController() };
-                endpoints.set(namespaceId, entry);
-            }
-            const lease = entry;
-            if (lease.retired)
-                throw new Error('Endpoint retired');
-            return { async fetch(request) {
-                    if (lease.retired)
-                        throw new Error('Endpoint retired');
-                    request.signal.throwIfAborted();
-                    const signal = AbortSignal.any([request.signal, lease.abort.signal]);
-                    const endpoint = await hostingOperation(signal, async () => {
-                        if (resolve)
-                            return resolve(namespaceId, signal);
-                        const binding = bindings.get(namespaceId);
-                        if (!binding)
-                            throw new Error('Existing-server tenant binding required');
-                        return binding;
-                    });
-                    signal.throwIfAborted();
-                    if (lease.retired)
-                        throw new Error('Endpoint retired');
-                    const remaining = endpoint.expiresAt - now();
-                    if (!Number.isFinite(endpoint.expiresAt) || remaining <= 0)
-                        throw new Error('Endpoint lease expired');
-                    const origin = new URL(endpoint.origin);
-                    if (origin.protocol !== 'https:' || origin.username || origin.password || origin.pathname !== '/' || origin.search || origin.hash)
-                        throw new TypeError('Credential-free HTTPS origin required');
-                    const incoming = new URL(request.url);
-                    const target = new URL(origin);
-                    target.pathname = incoming.pathname;
-                    target.search = incoming.search;
-                    // Retain the original stream and protocol headers without eager stdin pulls.
-                    // Keep the deadline attached to the transport after headers arrive, so
-                    // native fetch also cancels streaming request and response bodies at expiry.
-                    const abort = new AbortController();
-                    const transportSignal = AbortSignal.any([signal, abort.signal, AbortSignal.timeout(Math.min(Math.ceil(remaining), 2147483647))]);
-                    const body = request.body ? boundedTransfer(request.body, undefined, transportSignal, abort, false, false) : null;
-                    try {
-                        const response = await hostingOperation(transportSignal, () => fetch(hostingRequest(request, target, { body, signal: transportSignal, redirect: 'manual' })), response => response.body?.cancel(transportSignal.reason));
-                        const output = response.body ? boundedTransfer(response.body, undefined, transportSignal, abort) : null;
-                        return new Response(output, { status: response.status, statusText: response.statusText, headers: response.headers });
-                    }
-                    catch (error) {
-                        abort.abort(error);
-                        throw error;
-                    }
-                } };
-        },
-        async destroy(namespaceId) {
-            if (!namespaceId)
-                throw new TypeError('Trusted namespace identity required');
-            const pending = cleanups.get(namespaceId);
-            if (pending)
-                return pending;
-            // Old handles cannot attach to a replacement tenant binding. Failed
-            // cleanup stays quarantined until the operator explicitly retries it.
-            const entry = endpoints.get(namespaceId) ?? { retired: false, abort: new AbortController() };
-            entry.retired = true;
-            endpoints.set(namespaceId, entry);
-            entry.abort.abort(new Error('Endpoint retired'));
-            const cleanup = Promise.resolve().then(() => retire?.(namespaceId)).then(() => { endpoints.delete(namespaceId); });
-            cleanups.set(namespaceId, cleanup);
-            try {
-                await cleanup;
-            }
-            finally {
-                cleanups.delete(namespaceId);
-            }
-        },
-    };
-}

package/dist/remote-execution/upload-descriptor.js

@@ -1,201 +0,0 @@
-import { UploadError, uploadInteger, uploadRouteId, validateUploadRequest } from './upload-protocol.js';
-/** The caller owns descriptor admission/accounting and close. This function never
- * opens paths, replaces descriptors, or upgrades a live read to a snapshot.
- * A rejected chunk/commit request has an unknown remote outcome: retain the
- * upload for inspection instead of destroying resumable progress. Recovery must
- * inspect its offset and validate the same canonical freshness binding. */
-export async function uploadDescriptor(client, descriptor, declaration, options) {
-    // Host callbacks may await or mutate borrowed configuration. Retain the
-    // admitted bounds and recovery cursor for this capture.
-    options = { ...options, resume: options.resume ? { ...options.resume, source: { ...options.resume.source } } : undefined };
-    options.signal?.throwIfAborted();
-    if (!declaration || typeof declaration !== 'object' || Array.isArray(declaration))
-        throw new UploadError(400, 'Invalid upload request');
-    // Validate the same owned size/digest later sent and checked against receipts.
-    // Host getters cannot substitute a second declaration after admission.
-    declaration = { ...declaration };
-    validateUploadRequest(declaration);
-    const size = uploadInteger(declaration.size);
-    let offset = uploadInteger(options.resume?.offset ?? '0');
-    if (options.resume)
-        uploadRouteId(options.resume.uploadId);
-    if (offset > size)
-        throw new UploadError(400, 'Resume exceeds declared size');
-    if (!Number.isSafeInteger(options.maxChunkBytes) || options.maxChunkBytes < 1)
-        throw new UploadError(400, 'Invalid chunk bound');
-    const exact = descriptor.exact;
-    if (!exact && size > BigInt(Number.MAX_SAFE_INTEGER))
-        throw new UploadError(422, 'Canonical exact descriptor required');
-    if (size > 9223372036854775807n)
-        throw new UploadError(422, 'Canonical descriptor offset exceeds signed 64-bit profile');
-    if (!options.freshness || !['immutable', 'revalidate-on-open'].includes(options.freshness.profile))
-        throw new UploadError(422, 'Stable source freshness binding required');
-    const { signal, freshness } = options;
-    const { descriptor: authorizedDescriptor, identity, version, profile } = freshness;
-    if (authorizedDescriptor !== descriptor || identity === null || !['object', 'symbol'].includes(typeof identity)
-        || typeof version !== 'string' || !version.length || version.length > 256
-        || typeof freshness.assertCurrent !== 'function' || typeof freshness.invalidate !== 'function') {
-        throw new UploadError(422, 'Qualified retained source identity and version required');
-    }
-    if (options.resume && (options.resume.source.identity !== identity || options.resume.source.version !== version)) {
-        throw new UploadError(422, 'Resume belongs to another canonical object or content version');
-    }
-    // Retain the authorized capabilities before host callbacks can await. Keeping
-    // their receivers preserves backend revision state without allowing method or
-    // exact-facet replacement to change this capture's reader or freshness guard.
-    const read = descriptor.read.bind(descriptor);
-    const exactRead = exact?.read.bind(exact);
-    const assertCurrent = freshness.assertCurrent.bind(freshness);
-    const invalidate = freshness.invalidate.bind(freshness);
-    // Keep this capture on its admitted authenticated transport, including recovery
-    // and retirement. Awaited host guards cannot substitute another client facet.
-    client = Object.freeze({
-        beginUpload: client.beginUpload.bind(client), inspectUpload: client.inspectUpload.bind(client),
-        uploadChunk: client.uploadChunk.bind(client), commitUpload: client.commitUpload.bind(client),
-        abortUpload: client.abortUpload.bind(client),
-    });
-    let id = options.resume?.uploadId;
-    let admitted = false;
-    let unknownOutcome = false;
-    let stale = false;
-    function invalidateSource(cause) {
-        stale = true;
-        try {
-            invalidate(cause);
-        }
-        catch (failure) {
-            throw new AggregateError([cause, failure], 'Source freshness and manifest invalidation failed', { cause });
-        }
-        throw cause;
-    }
-    async function current() {
-        signal?.throwIfAborted();
-        try {
-            if (freshness.descriptor !== authorizedDescriptor || freshness.identity !== identity || freshness.version !== version || freshness.profile !== profile)
-                throw new UploadError(409, 'Canonical capture binding changed');
-            await assertCurrent(signal);
-            if (freshness.descriptor !== authorizedDescriptor || freshness.identity !== identity || freshness.version !== version || freshness.profile !== profile)
-                throw new UploadError(409, 'Canonical capture binding changed');
-        }
-        catch (error) {
-            // A canceled guard did not establish that the canonical source changed.
-            // Preserve resumable staging until this capture has actually admitted it.
-            signal?.throwIfAborted();
-            invalidateSource(error);
-        }
-        signal?.throwIfAborted();
-    }
-    try {
-        await current();
-        if (id) {
-            const { uploadId, state, size: receiptSize, digest, committedOffset, blobId } = await client.inspectUpload(id, signal);
-            const receipt = { uploadId, state, size: receiptSize, digest, committedOffset, blobId };
-            await current();
-            if (receipt.uploadId !== id || !['open', 'committed'].includes(receipt.state) || receipt.size !== declaration.size
-                || receipt.digest !== declaration.digest || receipt.committedOffset !== String(offset))
-                throw new UploadError(409, 'Resume declaration or acknowledged offset mismatch');
-            if (receipt.state === 'committed') {
-                if (offset !== size || typeof receipt.blobId !== 'string' || !receipt.blobId.length || receipt.blobId.length > 256)
-                    throw new UploadError(409, 'Committed upload acknowledgement mismatch');
-                try {
-                    uploadRouteId(receipt.blobId);
-                }
-                catch {
-                    throw new UploadError(409, 'Unroutable committed upload acknowledgement');
-                }
-                return { size: declaration.size, digest: declaration.digest, blobId: receipt.blobId };
-            }
-        }
-        else {
-            unknownOutcome = true;
-            // Acquisition borrows its own copy. The capture's admitted size/digest
-            // remain authoritative for every subsequent read and acknowledgment.
-            const { uploadId, state, size: receiptSize, digest, committedOffset } = await client.beginUpload({ ...declaration }, signal);
-            const receipt = { uploadId, state, size: receiptSize, digest, committedOffset };
-            id = receipt.uploadId;
-            admitted = true;
-            if (typeof id !== 'string' || !id.length || id.length > 256 || receipt.state !== 'open'
-                || receipt.size !== declaration.size || receipt.digest !== declaration.digest || receipt.committedOffset !== '0') {
-                throw new UploadError(502, 'Upload acquisition acknowledgement mismatch');
-            }
-            try {
-                uploadRouteId(id);
-            }
-            catch {
-                throw new UploadError(502, 'Unroutable upload acquisition acknowledgement');
-            }
-            unknownOutcome = false;
-            signal?.throwIfAborted();
-        }
-        admitted = true;
-        while (offset < size) {
-            await current();
-            const count = Number(size - offset > BigInt(options.maxChunkBytes) ? BigInt(options.maxChunkBytes) : size - offset);
-            const data = exactRead
-                ? await exactRead(offset, count, { signal })
-                : await read(Number(offset), count, { signal });
-            if (!(data instanceof Uint8Array))
-                throw new UploadError(503, 'Invalid canonical read response');
-            const span = Object.getOwnPropertyDescriptor(Object.getPrototypeOf(Uint8Array.prototype), 'byteLength').get.call(data);
-            if (span > count)
-                throw new UploadError(503, 'Invalid canonical read response');
-            // Own the fragment before calling another asynchronous provider hook.
-            const owned = new Uint8Array(data);
-            await current();
-            if (!owned.length) {
-                invalidateSource(new UploadError(409, 'Unstable source length'));
-            }
-            const end = offset + BigInt(owned.length);
-            unknownOutcome = true;
-            const { uploadId, state, size: receiptSize, digest, committedOffset } = await client.uploadChunk(id, String(offset), owned, signal);
-            const receipt = { uploadId, state, size: receiptSize, digest, committedOffset };
-            if (receipt.uploadId !== id || receipt.state !== 'open' || receipt.size !== declaration.size
-                || receipt.digest !== declaration.digest || receipt.committedOffset !== String(end)) {
-                throw new UploadError(502, 'Upload chunk acknowledgement mismatch; inspect before recovery');
-            }
-            unknownOutcome = false;
-            offset = end;
-        }
-        await current();
-        const extra = exactRead ? await exactRead(size, 1, { signal }) : await read(Number(size), 1, { signal });
-        if (!(extra instanceof Uint8Array))
-            throw new UploadError(503, 'Invalid canonical read response');
-        const extraSpan = Object.getOwnPropertyDescriptor(Object.getPrototypeOf(Uint8Array.prototype), 'byteLength').get.call(extra);
-        if (extraSpan > 1)
-            throw new UploadError(503, 'Invalid canonical read response');
-        if (extraSpan)
-            invalidateSource(new UploadError(409, 'Source exceeds declaration'));
-        await current();
-        unknownOutcome = true;
-        // A transport receipt is borrowed. Validate and return the same captured
-        // identity, including across the final asynchronous freshness check.
-        const { size: blobSize, digest, blobId } = await client.commitUpload(id, signal);
-        const blob = { size: blobSize, digest, blobId };
-        if (blob.size !== declaration.size || blob.digest !== declaration.digest
-            || typeof blob.blobId !== 'string' || !blob.blobId.length || blob.blobId.length > 256)
-            throw new UploadError(502, 'Committed blob declaration or handle mismatch');
-        try {
-            uploadRouteId(blob.blobId);
-        }
-        catch {
-            throw new UploadError(502, 'Unroutable committed blob acknowledgement');
-        }
-        unknownOutcome = false;
-        await current();
-        return blob;
-    }
-    catch (error) {
-        // Await cooperative cleanup with a fresh request; preserve original failure.
-        if (id && (admitted || stale) && !unknownOutcome) {
-            try {
-                await client.abortUpload(id);
-            }
-            catch (cleanup) {
-                signal?.throwIfAborted();
-                throw new AggregateError([error, cleanup], 'Upload capture and staging retirement failed', { cause: error });
-            }
-        }
-        signal?.throwIfAborted();
-        throw error;
-    }
-}

package/dist/remote-execution/upload-protocol.js

@@ -1,62 +0,0 @@
-/** Opaque IDs occupy one URL segment. URL dot-segment normalization must never
- * redirect an authenticated transfer to another resource or lifecycle route. */
-export function uploadRouteId(value) {
-    if (typeof value !== 'string' || !value.length || value.length > 256 || value === '.' || value === '..') {
-        throw new UploadError(400, 'Invalid upload resource ID');
-    }
-    return encodeURIComponent(value);
-}
-export class UploadError extends Error {
-    status;
-    code;
-    constructor(status, message, code) {
-        super(message);
-        this.status = status;
-        this.code = code;
-        this.name = 'UploadError';
-    }
-}
-export function uploadInteger(value) {
-    if (typeof value !== 'string' || !value.length || value.length > 20
-        || (value.length > 1 && value[0] === '0') || [...value].some(c => c < '0' || c > '9')) {
-        throw new UploadError(400, 'Invalid v1 uint64');
-    }
-    const n = BigInt(value);
-    if (n > 18446744073709551615n)
-        throw new UploadError(400, 'Invalid v1 uint64');
-    return n;
-}
-export function validateUploadRequest(value) {
-    if (!value || typeof value !== 'object' || Array.isArray(value)
-        || Object.keys(value).some(k => k !== 'size' && k !== 'digest'))
-        throw new UploadError(400, 'Invalid upload request');
-    const v = value;
-    uploadInteger(v.size);
-    if (typeof v.digest !== 'string' || v.digest.length !== 64 || [...v.digest].some(c => !'0123456789abcdef'.includes(c))) {
-        throw new UploadError(400, 'Invalid SHA-256');
-    }
-}
-/** Semantic checks after the v1 control record's shape has been validated. */
-export function validateUploadState(upload, creationReplayed) {
-    try {
-        uploadRouteId(upload.uploadId);
-        if (upload.blobId !== undefined)
-            uploadRouteId(upload.blobId);
-    }
-    catch {
-        throw new UploadError(502, 'Unroutable upload acknowledgement');
-    }
-    if (uploadInteger(upload.committedOffset) > uploadInteger(upload.size)
-        || (creationReplayed === false && (upload.state !== 'open' || upload.committedOffset !== '0'))
-        || (upload.state !== 'committed' && upload.blobId !== undefined)
-        || (upload.state === 'committed' && (!upload.blobId || upload.committedOffset !== upload.size))) {
-        throw new UploadError(502, 'Incomplete or inconsistent upload acknowledgement');
-    }
-}
-export function digestHeader(digest) {
-    return `sha-256=:${btoa(String.fromCharCode(...digest))}:`;
-}
-/** Read actual typed-array storage without producer-owned length properties. */
-export function uploadByteLength(bytes) {
-    return Object.getOwnPropertyDescriptor(Object.getPrototypeOf(Uint8Array.prototype), 'byteLength').get.call(bytes);
-}