cursedbelt 2.7.0 → 3.0.0

package/dist/core/wire/marshalWorker.js

@@ -1,274 +0,0 @@
-/**
- * The marshalling Worker (05 §B1, second half) — `validate` + `transform` for a
- * large inbound payload, off the thread that has to answer requests.
- *
- * `marshalling.ts` has always had the SIZE BOUNDARY and the injection seam; what
- * it never had was anything to hand a large payload to, so a >512KB webhook body
- * got a 503 with no documentation anywhere that a limit existed. This module is
- * the missing half: a real, long-lived worker with a request/response protocol,
- * on both runtimes cursedbelt ships to.
- *
- * ## Why the marshaller names its own worker entry
- *
- * A marshaller is mostly FUNCTIONS (`validate`, `transform`, a Zod schema), and
- * functions do not survive structured clone — a worker cannot be handed one, it
- * has to `import` it. The obvious design (one shared worker that resolves any
- * marshaller by id from a registry module) needs the host to declare, register
- * and keep in sync a second module listing every marshaller, and it gives that
- * one worker the authority to run all of them.
- *
- * Instead each marshaller declares `workerEntry`: the module that constructs
- * exactly that marshaller and calls {@link serveMarshalWorker}. The worker can
- * therefore only ever run the one marshaller it was built for, the host wires
- * nothing, and — the part that matters for the gate — "can this marshaller
- * offload?" stops being a boolean somebody remembered to set and becomes a
- * question about an artifact that either exists or does not. V3 checks it
- * statically (`marshaller-worker-offload-missing`), so the 503 path below is
- * unreachable in any app that passed verification.
- *
- * ## The two runtimes
- *
- * Server (Bun/Node) uses `node:worker_threads`; the browser uses a module
- * `Worker`. The import of `node:worker_threads` is deliberately DYNAMIC and
- * inside the server branch — a static import would put a Node builtin in the
- * module graph of every client bundle that touches wire code.
- */
-import { AppError } from '../../shared/errors';
-import { MARSHALLER_SCHEMA_VIOLATION, MARSHALLER_VALIDATION_FAILED, } from './marshalling';
-export const MARSHALLER_WORKER_FAILED = 'MARSHALLER_WORKER_FAILED';
-export const MARSHALLER_WORKER_TIMEOUT = 'MARSHALLER_WORKER_TIMEOUT';
-/** How long one payload may occupy the worker before the host gives up. */
-export const MARSHAL_WORKER_DEFAULT_TIMEOUT_MS = 30_000;
-async function resolveWorkerChannel() {
-    // Browser/Web Worker: `self` has postMessage and no `window`.
-    const maybeSelf = globalThis;
-    if (maybeSelf.window === undefined &&
-        typeof maybeSelf.postMessage === 'function' &&
-        typeof maybeSelf.addEventListener === 'function') {
-        const post = maybeSelf.postMessage.bind(globalThis);
-        const listen = maybeSelf.addEventListener.bind(globalThis);
-        return {
-            onMessage: (handler) => listen('message', (event) => handler(event.data)),
-            post,
-        };
-    }
-    const { parentPort } = await import('node:worker_threads');
-    if (!parentPort)
-        throw new AppError('serveMarshalWorker was called outside a worker thread.', {
-            code: MARSHALLER_WORKER_FAILED,
-            status: 500,
-        });
-    return {
-        onMessage: (handler) => parentPort.on('message', handler),
-        post: (data) => parentPort.postMessage(data),
-    };
-}
-/**
- * Run `marshaller` inside a worker, answering one payload per message.
- *
- * A worker entry is three lines:
- *
- * ```ts
- * import { serveMarshalWorker } from 'cursedbelt/wire';
- * import { sheetRowsMarshaller } from './sheetRows';
- * await serveMarshalWorker(sheetRowsMarshaller);
- * ```
- *
- * **The schema check is deliberately NOT run here.** `marshalInbound` re-checks
- * every worker result against the token's canonical schema on the host side,
- * because a worker is a thread boundary, not a trust boundary — a result that
- * validated itself is exactly the kind of assurance that stops being true the
- * day someone edits the worker entry. Doing it in both places would also mean
- * two implementations of one law, and the worker's copy is the one no test
- * would cover.
- */
-export async function serveMarshalWorker(marshaller) {
-    const channel = await resolveWorkerChannel();
-    channel.onMessage((data) => {
-        const request = data;
-        if (typeof request?.id !== 'number')
-            return; // not ours; ignore rather than crash the worker
-        try {
-            if (!marshaller.validate(request.payload)) {
-                channel.post({
-                    id: request.id,
-                    ok: false,
-                    code: MARSHALLER_VALIDATION_FAILED,
-                    message: `Inbound payload rejected by marshaller '${marshaller.id}'.`,
-                });
-                return;
-            }
-            const value = marshaller.transform(request.payload);
-            channel.post({ id: request.id, ok: true, value });
-        }
-        catch (error) {
-            // A throwing transform must not take the worker down with it: the next
-            // payload is a different payload, and a dead worker turns one bad webhook
-            // into an outage.
-            channel.post({
-                id: request.id,
-                ok: false,
-                code: MARSHALLER_WORKER_FAILED,
-                message: error instanceof Error ? error.message : String(error),
-            });
-        }
-    });
-}
-function spawnHostWorker(entry) {
-    const WebWorker = globalThis
-        .Worker;
-    // A browser (or Bun's web-Worker shim) — `type: 'module'` so the entry may use
-    // static imports, which every entry will.
-    if (typeof WebWorker === 'function') {
-        const worker = new WebWorker(entry, { type: 'module' });
-        return {
-            post: (data) => worker.postMessage(data),
-            onMessage: (handler) => worker.addEventListener('message', (event) => handler(event.data)),
-            onError: (handler) => worker.addEventListener('error', (event) => handler(event.message ?? event)),
-            terminate: () => worker.terminate(),
-        };
-    }
-    // Node/Bun worker_threads. Constructed lazily and synchronously-wrapped: the
-    // client below queues sends until the thread exists, so callers never see the
-    // construction race.
-    let pending = [];
-    let realPost = null;
-    let terminated = false;
-    const messageHandlers = [];
-    const errorHandlers = [];
-    let terminateReal = null;
-    void (async () => {
-        try {
-            const { Worker } = await import('node:worker_threads');
-            if (terminated)
-                return;
-            const worker = new Worker(entry);
-            worker.on('message', (data) => {
-                for (const handler of messageHandlers)
-                    handler(data);
-            });
-            worker.on('error', (error) => {
-                for (const handler of errorHandlers)
-                    handler(error);
-            });
-            // ANY exit is a failure for this client: the worker is long-lived by
-            // design, so it should outlive every payload. Gating this on `code !== 0`
-            // left a cleanly-exited thread invisible — payloads in flight waited out
-            // their full timeout instead of failing at once, and every later `run()`
-            // posted into a dead thread and did the same.
-            worker.on('exit', (code) => {
-                const how = code === 0 ? 'exited cleanly while still in use' : `exited with code ${code}`;
-                for (const handler of errorHandlers)
-                    handler(new Error(`marshal worker ${how}`));
-            });
-            // `unref` would let the process exit with payloads in flight; the client's
-            // own timeout is the liveness backstop instead.
-            realPost = (data) => worker.postMessage(data);
-            terminateReal = () => void worker.terminate();
-            for (const queued of pending)
-                realPost(queued);
-            pending = [];
-        }
-        catch (error) {
-            for (const handler of errorHandlers)
-                handler(error);
-        }
-    })();
-    return {
-        post: (data) => (realPost ? realPost(data) : pending.push(data)),
-        onMessage: (handler) => messageHandlers.push(handler),
-        onError: (handler) => errorHandlers.push(handler),
-        terminate: () => {
-            terminated = true;
-            terminateReal?.();
-        },
-    };
-}
-/**
- * A long-lived worker for ONE marshaller, multiplexing concurrent payloads.
- *
- * Long-lived rather than one-worker-per-payload deliberately: thread startup
- * plus module load is tens of milliseconds, which on a burst of imports would
- * cost more than the parse it is avoiding, and a spawn-per-payload design lets
- * an import storm fork unbounded threads.
- */
-export function createMarshalWorkerClient(options) {
-    const timeoutMs = options.timeoutMs ?? MARSHAL_WORKER_DEFAULT_TIMEOUT_MS;
-    const worker = (options.spawn ?? spawnHostWorker)(options.entry);
-    const pending = new Map();
-    let nextId = 1;
-    let disposed = false;
-    const settle = (id, apply) => {
-        const entry = pending.get(id);
-        if (!entry)
-            return; // already timed out — the late reply is discarded
-        pending.delete(id);
-        clearTimeout(entry.timer);
-        apply(entry);
-    };
-    worker.onMessage((data) => {
-        const response = data;
-        if (typeof response?.id !== 'number')
-            return;
-        settle(response.id, (p) => {
-            if (response.ok) {
-                p.resolve(response.value);
-                return;
-            }
-            p.reject(new AppError(response.message, {
-                // A validation failure is the CALLER's fault (400) and must keep its
-                // own code; anything else the worker reports is ours (500).
-                code: response.code,
-                status: response.code === MARSHALLER_VALIDATION_FAILED ? 400 : 500,
-                context: { worker: String(options.entry) },
-            }));
-        });
-    });
-    // A worker that dies takes every payload in flight with it — failing them all
-    // now beats each one waiting out its own timeout.
-    worker.onError((error) => {
-        const message = error instanceof Error ? error.message : String(error);
-        for (const id of [...pending.keys()])
-            settle(id, (p) => p.reject(new AppError(`Marshalling worker failed: ${message}`, {
-                code: MARSHALLER_WORKER_FAILED,
-                status: 500,
-                context: { worker: String(options.entry) },
-            })));
-    });
-    return {
-        run(_marshallerId, payload) {
-            if (disposed)
-                return Promise.reject(new AppError('Marshalling worker has been disposed.', {
-                    code: MARSHALLER_WORKER_FAILED,
-                    status: 500,
-                    context: { worker: String(options.entry) },
-                }));
-            const id = nextId++;
-            return new Promise((resolve, reject) => {
-                const timer = setTimeout(() => {
-                    pending.delete(id);
-                    reject(new AppError(`Marshalling worker did not answer within ${timeoutMs}ms.`, {
-                        code: MARSHALLER_WORKER_TIMEOUT,
-                        status: 504,
-                        context: { worker: String(options.entry), timeoutMs },
-                    }));
-                }, timeoutMs);
-                pending.set(id, { resolve: resolve, reject, timer });
-                worker.post({ id, payload });
-            });
-        },
-        async dispose() {
-            disposed = true;
-            for (const id of [...pending.keys()])
-                settle(id, (p) => p.reject(new AppError('Marshalling worker was disposed while a payload was in flight.', {
-                    code: MARSHALLER_WORKER_FAILED,
-                    status: 503,
-                    context: { worker: String(options.entry) },
-                })));
-            worker.terminate();
-        },
-    };
-}
-/** Re-exported so a caller catching worker failures needs one import. */
-export { MARSHALLER_SCHEMA_VIOLATION, MARSHALLER_VALIDATION_FAILED };
-//# sourceMappingURL=marshalWorker.js.map

package/dist/core/wire/marshalWorker.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"marshalWorker.js","sourceRoot":"","sources":["../../../src/core/wire/marshalWorker.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAkCG;AACH,OAAO,EAAE,QAAQ,EAAE,MAAM,qBAAqB,CAAC;AAC/C,OAAO,EAEL,2BAA2B,EAC3B,4BAA4B,GAE7B,MAAM,eAAe,CAAC;AAEvB,MAAM,CAAC,MAAM,wBAAwB,GAAG,0BAA0B,CAAC;AACnE,MAAM,CAAC,MAAM,yBAAyB,GAAG,2BAA2B,CAAC;AAErE,2EAA2E;AAC3E,MAAM,CAAC,MAAM,iCAAiC,GAAG,MAAM,CAAC;AAuBxD,KAAK,UAAU,oBAAoB;IACjC,8DAA8D;IAC9D,MAAM,SAAS,GAAG,UAIjB,CAAC;IACF,IACE,SAAS,CAAC,MAAM,KAAK,SAAS;QAC9B,OAAO,SAAS,CAAC,WAAW,KAAK,UAAU;QAC3C,OAAO,SAAS,CAAC,gBAAgB,KAAK,UAAU,EAChD,CAAC;QACD,MAAM,IAAI,GAAG,SAAS,CAAC,WAAW,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;QACpD,MAAM,MAAM,GAAG,SAAS,CAAC,gBAAgB,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;QAC3D,OAAO;YACL,SAAS,EAAE,CAAC,OAAO,EAAE,EAAE,CAAC,MAAM,CAAC,SAAS,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;YACzE,IAAI;SACL,CAAC;IACJ,CAAC;IAED,MAAM,EAAE,UAAU,EAAE,GAAG,MAAM,MAAM,CAAC,qBAAqB,CAAC,CAAC;IAC3D,IAAI,CAAC,UAAU;QACb,MAAM,IAAI,QAAQ,CAAC,wDAAwD,EAAE;YAC3E,IAAI,EAAE,wBAAwB;YAC9B,MAAM,EAAE,GAAG;SACZ,CAAC,CAAC;IACL,OAAO;QACL,SAAS,EAAE,CAAC,OAAO,EAAE,EAAE,CAAC,UAAU,CAAC,EAAE,CAAC,SAAS,EAAE,OAAO,CAAC;QACzD,IAAI,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,UAAU,CAAC,WAAW,CAAC,IAAI,CAAC;KAC7C,CAAC;AACJ,CAAC;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAM,CAAC,KAAK,UAAU,kBAAkB,CACtC,UAAiF;IAEjF,MAAM,OAAO,GAAG,MAAM,oBAAoB,EAAE,CAAC;IAE7C,OAAO,CAAC,SAAS,CAAC,CAAC,IAAI,EAAE,EAAE;QACzB,MAAM,OAAO,GAAG,IAA4B,CAAC;QAC7C,IAAI,OAAO,OAAO,EAAE,EAAE,KAAK,QAAQ;YAAE,OAAO,CAAC,gDAAgD;QAC7F,IAAI,CAAC;YACH,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,OAAO,CAAC,OAAkB,CAAC,EAAE,CAAC;gBACrD,OAAO,CAAC,IAAI,CAAC;oBACX,EAAE,EAAE,OAAO,CAAC,EAAE;oBACd,EAAE,EAAE,KAAK;oBACT,IAAI,EAAE,4BAA4B;oBAClC,OAAO,EAAE,2CAA2C,UAAU,CAAC,EAAE,IAAI;iBACtC,CAAC,CAAC;gBACnC,OAAO;YACT,CAAC;YACD,MAAM,KAAK,GAAG,UAAU,CAAC,SAAS,CAAC,OAAO,CAAC,OAAkB,CAAC,CAAC;YAC/D,OAAO,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,OAAO,CAAC,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE,KAAK,EAAkC,CAAC,CAAC;QACpF,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,uEAAuE;YACvE,0EAA0E;YAC1E,kBAAkB;YAClB,OAAO,CAAC,IAAI,CAAC;gBACX,EAAE,EAAE,OAAO,CAAC,EAAE;gBACd,EAAE,EAAE,KAAK;gBACT,IAAI,EAAE,wBAAwB;gBAC9B,OAAO,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC;aAChC,CAAC,CAAC;QACrC,CAAC;IACH,CAAC,CAAC,CAAC;AACL,CAAC;AA0BD,SAAS,eAAe,CAAC,KAAmB;IAC1C,MAAM,SAAS,GAAI,UAA0F;SAC1G,MAAM,CAAC;IACV,+EAA+E;IAC/E,0CAA0C;IAC1C,IAAI,OAAO,SAAS,KAAK,UAAU,EAAE,CAAC;QACpC,MAAM,MAAM,GAAG,IAAI,SAAS,CAAC,KAAK,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,CAIrD,CAAC;QACF,OAAO;YACL,IAAI,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,MAAM,CAAC,WAAW,CAAC,IAAI,CAAC;YACxC,SAAS,EAAE,CAAC,OAAO,EAAE,EAAE,CAAC,MAAM,CAAC,gBAAgB,CAAC,SAAS,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;YAC1F,OAAO,EAAE,CAAC,OAAO,EAAE,EAAE,CAAC,MAAM,CAAC,gBAAgB,CAAC,OAAO,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC,OAAO,IAAI,KAAK,CAAC,CAAC;YAClG,SAAS,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,SAAS,EAAE;SACpC,CAAC;IACJ,CAAC;IAED,6EAA6E;IAC7E,8EAA8E;IAC9E,qBAAqB;IACrB,IAAI,OAAO,GAAc,EAAE,CAAC;IAC5B,IAAI,QAAQ,GAAqC,IAAI,CAAC;IACtD,IAAI,UAAU,GAAG,KAAK,CAAC;IACvB,MAAM,eAAe,GAAgC,EAAE,CAAC;IACxD,MAAM,aAAa,GAAiC,EAAE,CAAC;IACvD,IAAI,aAAa,GAAwB,IAAI,CAAC;IAE9C,KAAK,CAAC,KAAK,IAAI,EAAE;QACf,IAAI,CAAC;YACH,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,MAAM,CAAC,qBAAqB,CAAC,CAAC;YACvD,IAAI,UAAU;gBAAE,OAAO;YACvB,MAAM,MAAM,GAAG,IAAI,MAAM,CAAC,KAAqB,CAAC,CAAC;YACjD,MAAM,CAAC,EAAE,CAAC,SAAS,EAAE,CAAC,IAAa,EAAE,EAAE;gBACrC,KAAK,MAAM,OAAO,IAAI,eAAe;oBAAE,OAAO,CAAC,IAAI,CAAC,CAAC;YACvD,CAAC,CAAC,CAAC;YACH,MAAM,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,KAAc,EAAE,EAAE;gBACpC,KAAK,MAAM,OAAO,IAAI,aAAa;oBAAE,OAAO,CAAC,KAAK,CAAC,CAAC;YACtD,CAAC,CAAC,CAAC;YACH,qEAAqE;YACrE,0EAA0E;YAC1E,yEAAyE;YACzE,yEAAyE;YACzE,8CAA8C;YAC9C,MAAM,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,IAAY,EAAE,EAAE;gBACjC,MAAM,GAAG,GAAG,IAAI,KAAK,CAAC,CAAC,CAAC,CAAC,mCAAmC,CAAC,CAAC,CAAC,oBAAoB,IAAI,EAAE,CAAC;gBAC1F,KAAK,MAAM,OAAO,IAAI,aAAa;oBAAE,OAAO,CAAC,IAAI,KAAK,CAAC,kBAAkB,GAAG,EAAE,CAAC,CAAC,CAAC;YACnF,CAAC,CAAC,CAAC;YACH,2EAA2E;YAC3E,gDAAgD;YAChD,QAAQ,GAAG,CAAC,IAAI,EAAE,EAAE,CAAC,MAAM,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC;YAC9C,aAAa,GAAG,GAAG,EAAE,CAAC,KAAK,MAAM,CAAC,SAAS,EAAE,CAAC;YAC9C,KAAK,MAAM,MAAM,IAAI,OAAO;gBAAE,QAAQ,CAAC,MAAM,CAAC,CAAC;YAC/C,OAAO,GAAG,EAAE,CAAC;QACf,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,KAAK,MAAM,OAAO,IAAI,aAAa;gBAAE,OAAO,CAAC,KAAK,CAAC,CAAC;QACtD,CAAC;IACH,CAAC,CAAC,EAAE,CAAC;IAEL,OAAO;QACL,IAAI,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAChE,SAAS,EAAE,CAAC,OAAO,EAAE,EAAE,CAAC,eAAe,CAAC,IAAI,CAAC,OAAO,CAAC;QACrD,OAAO,EAAE,CAAC,OAAO,EAAE,EAAE,CAAC,aAAa,CAAC,IAAI,CAAC,OAAO,CAAC;QACjD,SAAS,EAAE,GAAG,EAAE;YACd,UAAU,GAAG,IAAI,CAAC;YAClB,aAAa,EAAE,EAAE,CAAC;QACpB,CAAC;KACF,CAAC;AACJ,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,yBAAyB,CAAC,OAAmC;IAC3E,MAAM,SAAS,GAAG,OAAO,CAAC,SAAS,IAAI,iCAAiC,CAAC;IACzE,MAAM,MAAM,GAAG,CAAC,OAAO,CAAC,KAAK,IAAI,eAAe,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;IAOjE,MAAM,OAAO,GAAG,IAAI,GAAG,EAAmB,CAAC;IAC3C,IAAI,MAAM,GAAG,CAAC,CAAC;IACf,IAAI,QAAQ,GAAG,KAAK,CAAC;IAErB,MAAM,MAAM,GAAG,CAAC,EAAU,EAAE,KAA2B,EAAQ,EAAE;QAC/D,MAAM,KAAK,GAAG,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAC9B,IAAI,CAAC,KAAK;YAAE,OAAO,CAAC,kDAAkD;QACtE,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;QACnB,YAAY,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;QAC1B,KAAK,CAAC,KAAK,CAAC,CAAC;IACf,CAAC,CAAC;IAEF,MAAM,CAAC,SAAS,CAAC,CAAC,IAAI,EAAE,EAAE;QACxB,MAAM,QAAQ,GAAG,IAA6B,CAAC;QAC/C,IAAI,OAAO,QAAQ,EAAE,EAAE,KAAK,QAAQ;YAAE,OAAO;QAC7C,MAAM,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,EAAE;YACxB,IAAI,QAAQ,CAAC,EAAE,EAAE,CAAC;gBAChB,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;gBAC1B,OAAO;YACT,CAAC;YACD,CAAC,CAAC,MAAM,CACN,IAAI,QAAQ,CAAC,QAAQ,CAAC,OAAO,EAAE;gBAC7B,qEAAqE;gBACrE,4DAA4D;gBAC5D,IAAI,EAAE,QAAQ,CAAC,IAAI;gBACnB,MAAM,EAAE,QAAQ,CAAC,IAAI,KAAK,4BAA4B,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG;gBAClE,OAAO,EAAE,EAAE,MAAM,EAAE,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE;aAC3C,CAAC,CACH,CAAC;QACJ,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,8EAA8E;IAC9E,kDAAkD;IAClD,MAAM,CAAC,OAAO,CAAC,CAAC,KAAK,EAAE,EAAE;QACvB,MAAM,OAAO,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QACvE,KAAK,MAAM,EAAE,IAAI,CAAC,GAAG,OAAO,CAAC,IAAI,EAAE,CAAC;YAClC,MAAM,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,EAAE,CACf,CAAC,CAAC,MAAM,CACN,IAAI,QAAQ,CAAC,8BAA8B,OAAO,EAAE,EAAE;gBACpD,IAAI,EAAE,wBAAwB;gBAC9B,MAAM,EAAE,GAAG;gBACX,OAAO,EAAE,EAAE,MAAM,EAAE,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE;aAC3C,CAAC,CACH,CACF,CAAC;IACN,CAAC,CAAC,CAAC;IAEH,OAAO;QACL,GAAG,CAAe,aAAqB,EAAE,OAAgB;YACvD,IAAI,QAAQ;gBACV,OAAO,OAAO,CAAC,MAAM,CACnB,IAAI,QAAQ,CAAC,uCAAuC,EAAE;oBACpD,IAAI,EAAE,wBAAwB;oBAC9B,MAAM,EAAE,GAAG;oBACX,OAAO,EAAE,EAAE,MAAM,EAAE,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE;iBAC3C,CAAC,CACH,CAAC;YACJ,MAAM,EAAE,GAAG,MAAM,EAAE,CAAC;YACpB,OAAO,IAAI,OAAO,CAAM,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;gBAC1C,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE;oBAC5B,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;oBACnB,MAAM,CACJ,IAAI,QAAQ,CAAC,4CAA4C,SAAS,KAAK,EAAE;wBACvE,IAAI,EAAE,yBAAyB;wBAC/B,MAAM,EAAE,GAAG;wBACX,OAAO,EAAE,EAAE,MAAM,EAAE,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,SAAS,EAAE;qBACtD,CAAC,CACH,CAAC;gBACJ,CAAC,EAAE,SAAS,CAAC,CAAC;gBACd,OAAO,CAAC,GAAG,CAAC,EAAE,EAAE,EAAE,OAAO,EAAE,OAAmC,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC;gBACjF,MAAM,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,OAAO,EAAiC,CAAC,CAAC;YAC9D,CAAC,CAAC,CAAC;QACL,CAAC;QAED,KAAK,CAAC,OAAO;YACX,QAAQ,GAAG,IAAI,CAAC;YAChB,KAAK,MAAM,EAAE,IAAI,CAAC,GAAG,OAAO,CAAC,IAAI,EAAE,CAAC;gBAClC,MAAM,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,EAAE,CACf,CAAC,CAAC,MAAM,CACN,IAAI,QAAQ,CAAC,gEAAgE,EAAE;oBAC7E,IAAI,EAAE,wBAAwB;oBAC9B,MAAM,EAAE,GAAG;oBACX,OAAO,EAAE,EAAE,MAAM,EAAE,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE;iBAC3C,CAAC,CACH,CACF,CAAC;YACJ,MAAM,CAAC,SAAS,EAAE,CAAC;QACrB,CAAC;KACF,CAAC;AACJ,CAAC;AAED,yEAAyE;AACzE,OAAO,EAAE,2BAA2B,EAAE,4BAA4B,EAAE,CAAC"}

package/dist/core/wire/marshalling.d.ts

@@ -1,123 +0,0 @@
-/**
- * Port marshalling + the 512KB worker gate (02 §7.1).
- *
- * External payloads — webhooks, third-party feeds, spreadsheet imports — never
- * touch component code. A marshaller registered on the token is the only entry,
- * and its `transform` output is checked against the token's canonical Zod schema
- * (V3 asserts this statically; here it is enforced at runtime too, because a
- * provider can change its shape without anyone recompiling).
- *
- * **The size boundary is the interesting part.** Inbound payloads over 512KB are
- * never validated or transformed on the main thread: a 4MB webhook body running
- * a synchronous Zod parse blocks the request loop on the server and the render
- * thread in the browser, and the symptom — "the app freezes sometimes" —
- * is nearly impossible to trace back to one large payload. Above the threshold
- * the work is offloaded to a Worker (structured-clone in, validated result out).
- */
-import type { z } from 'zod';
-/** Above this, `validate` + `transform` are offloaded to a Worker (02 §7.1). */
-export declare const MARSHALLER_WORKER_OFFLOAD_BYTES: number;
-/**
- * The ONE marshaller contract (05 §B1, unified 2026-07-26).
- *
- * There were TWO interfaces of this name in this package: this one, and a
- * divergent copy in `core/tokens/registry.ts` that additionally required
- * `tokenId` and `workerOffload` — with `MARSHALLER_WORKER_OFFLOAD_BYTES`
- * declared twice alongside them. The verify pipeline (V3, `verify/types.ts`, the
- * fixtures) read the registry's shape; `marshalInbound` below read this one. So a
- * value that satisfied the runtime could be rejected by the type the pipeline
- * checks, and the two thresholds could drift apart silently. The registry's
- * shape won — it is the one the pipeline enforces — and `registry.ts` now
- * re-exports both symbols from here.
- */
-export interface CCWireMarshaller<Inbound = unknown, Out = unknown> {
-    id: string;
-    /** The wire token this marshaller feeds — V3 resolves it against the registry. */
-    tokenId: string;
-    /** REQUIRED — V3 `marshaller-payload-unbounded` when absent or non-positive. */
-    maxPayloadBytes: number;
-    /**
-     * The module that runs this marshaller's `validate`+`transform` off the main
-     * thread — an entry calling `serveMarshalWorker` (`core/wire/marshalWorker.ts`).
-     *
-     * **This replaced a `workerOffload: boolean` in the Worker commit (05 §B1).**
-     * That flag was authored by hand and asserted a capability the codebase did
-     * not have: every marshaller in the repo set it `true` while no worker
-     * existed anywhere, so the V3 gate it fed was checking that someone had
-     * remembered to type `true`. Whether a marshaller can offload is now a
-     * question about an ARTIFACT — this entry either exists or it does not — and
-     * whether it NEEDS to is {@link requiresWorkerOffload}, derived from
-     * `maxPayloadBytes`. Neither is a promise anyone can make by hand.
-     *
-     * Optional because a marshaller whose `maxPayloadBytes` sits under the
-     * main-thread limit can never reach the offload path; V3 requires it of
-     * exactly those that can.
-     */
-    workerEntry?: string;
-    validate(inbound: Inbound): boolean;
-    transform(inbound: Inbound): Out;
-    /** V3 checks `transform` output against the token's canonical schema. */
-    targetZodSchema: z.ZodType<Out>;
-}
-/**
- * Can this marshaller ever reach the offload path? A DERIVED fact (05 §B1).
- *
- * A marshaller that refuses anything over 256KB can never produce a payload
- * above the 512KB main-thread limit, so it needs no worker and demanding one
- * would be noise. One whose ceiling is 2MB certainly can, and without a
- * `workerEntry` its large payloads are a guaranteed 503 — which is why V3
- * refuses to verify that combination rather than letting it surface in
- * production as an intermittent failure on the biggest imports.
- */
-export declare function requiresWorkerOffload(marshaller: Pick<CCWireMarshaller, 'maxPayloadBytes'>, thresholdBytes?: number): boolean;
-export declare const MARSHALLER_PAYLOAD_TOO_LARGE = "MARSHALLER_PAYLOAD_TOO_LARGE";
-export declare const MARSHALLER_VALIDATION_FAILED = "MARSHALLER_VALIDATION_FAILED";
-export declare const MARSHALLER_SCHEMA_VIOLATION = "MARSHALLER_SCHEMA_VIOLATION";
-/**
- * Measure a payload's wire size.
- *
- * Uses the UTF-8 byte length, not `string.length`: a 400k-character document of
- * CJK text is ~1.2MB on the wire, and sizing it by character count would sail
- * past the offload threshold on the main thread.
- */
-export declare function payloadBytes(payload: unknown): number;
-/** The worker seam — injected so tests and SSR can run without a real Worker. */
-export interface MarshalWorker {
-    run<Inbound, Out>(marshallerId: string, payload: Inbound): Promise<Out>;
-}
-export interface MarshalOptions {
-    /**
-     * Use THIS worker instead of the one the marshaller's `workerEntry` names.
-     * Left unset in production: offload is the default path, resolved from the
-     * marshaller itself, so an ingress route needs no worker wiring of its own.
-     */
-    worker?: MarshalWorker;
-    /**
-     * Resolves a worker for a marshaller that declares a `workerEntry`. The host
-     * supplies this once (`createMarshalWorkerClient`, cached per entry) — it is a
-     * parameter rather than a module-level singleton because a worker is a live
-     * OS thread, and something has to own disposing of it.
-     */
-    resolveWorker?: (marshaller: CCWireMarshaller<never, never>) => MarshalWorker | undefined;
-    /** Override the offload threshold (tests drive it down to exercise the path). */
-    offloadThresholdBytes?: number;
-}
-/**
- * Run a payload through its marshaller, offloading past the size gate.
- *
- * Order matters: the marshaller's OWN `maxPayloadBytes` is checked first, so an
- * oversized payload is refused with a typed diagnostic before any work — worker
- * or otherwise — is scheduled for it.
- */
-export declare function marshalInbound<Inbound, Out>(marshaller: CCWireMarshaller<Inbound, Out>, payload: Inbound, options?: MarshalOptions): Promise<Out>;
-/** The registry of marshallers, keyed by token id (02 §7.1: registered ON the token). */
-export interface MarshallerRegistry {
-    register(tokenId: string, marshaller: CCWireMarshaller): void;
-    forToken(tokenId: string): CCWireMarshaller | undefined;
-    all(): readonly {
-        tokenId: string;
-        marshaller: CCWireMarshaller;
-    }[];
-}
-export declare function createMarshallerRegistry(): MarshallerRegistry;
-//# sourceMappingURL=marshalling.d.ts.map

package/dist/core/wire/marshalling.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"marshalling.d.ts","sourceRoot":"","sources":["../../../src/core/wire/marshalling.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AACH,OAAO,KAAK,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAG7B,gFAAgF;AAChF,eAAO,MAAM,+BAA+B,QAAa,CAAC;AAE1D;;;;;;;;;;;;GAYG;AACH,MAAM,WAAW,gBAAgB,CAAC,OAAO,GAAG,OAAO,EAAE,GAAG,GAAG,OAAO;IAChE,EAAE,EAAE,MAAM,CAAC;IACX,kFAAkF;IAClF,OAAO,EAAE,MAAM,CAAC;IAChB,gFAAgF;IAChF,eAAe,EAAE,MAAM,CAAC;IACxB;;;;;;;;;;;;;;;;OAgBG;IACH,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,OAAO,EAAE,OAAO,GAAG,OAAO,CAAC;IACpC,SAAS,CAAC,OAAO,EAAE,OAAO,GAAG,GAAG,CAAC;IACjC,yEAAyE;IACzE,eAAe,EAAE,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;CACjC;AAED;;;;;;;;;GASG;AACH,wBAAgB,qBAAqB,CACnC,UAAU,EAAE,IAAI,CAAC,gBAAgB,EAAE,iBAAiB,CAAC,EACrD,cAAc,GAAE,MAAwC,GACvD,OAAO,CAET;AAED,eAAO,MAAM,4BAA4B,iCAAiC,CAAC;AAC3E,eAAO,MAAM,4BAA4B,iCAAiC,CAAC;AAC3E,eAAO,MAAM,2BAA2B,gCAAgC,CAAC;AAEzE;;;;;;GAMG;AACH,wBAAgB,YAAY,CAAC,OAAO,EAAE,OAAO,GAAG,MAAM,CAWrD;AAED,iFAAiF;AACjF,MAAM,WAAW,aAAa;IAC5B,GAAG,CAAC,OAAO,EAAE,GAAG,EAAE,YAAY,EAAE,MAAM,EAAE,OAAO,EAAE,OAAO,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC;CACzE;AAED,MAAM,WAAW,cAAc;IAC7B;;;;OAIG;IACH,MAAM,CAAC,EAAE,aAAa,CAAC;IACvB;;;;;OAKG;IACH,aAAa,CAAC,EAAE,CAAC,UAAU,EAAE,gBAAgB,CAAC,KAAK,EAAE,KAAK,CAAC,KAAK,aAAa,GAAG,SAAS,CAAC;IAC1F,iFAAiF;IACjF,qBAAqB,CAAC,EAAE,MAAM,CAAC;CAChC;AAED;;;;;;GAMG;AACH,wBAAsB,cAAc,CAAC,OAAO,EAAE,GAAG,EAC/C,UAAU,EAAE,gBAAgB,CAAC,OAAO,EAAE,GAAG,CAAC,EAC1C,OAAO,EAAE,OAAO,EAChB,OAAO,GAAE,cAAmB,GAC3B,OAAO,CAAC,GAAG,CAAC,CAsDd;AAqBD,yFAAyF;AACzF,MAAM,WAAW,kBAAkB;IACjC,QAAQ,CAAC,OAAO,EAAE,MAAM,EAAE,UAAU,EAAE,gBAAgB,GAAG,IAAI,CAAC;IAC9D,QAAQ,CAAC,OAAO,EAAE,MAAM,GAAG,gBAAgB,GAAG,SAAS,CAAC;IACxD,GAAG,IAAI,SAAS;QAAE,OAAO,EAAE,MAAM,CAAC;QAAC,UAAU,EAAE,gBAAgB,CAAA;KAAE,EAAE,CAAC;CACrE;AAED,wBAAgB,wBAAwB,IAAI,kBAAkB,CAe7D"}

package/dist/core/wire/marshalling.js

@@ -1,127 +0,0 @@
-import { AppError } from '../../shared/errors';
-/** Above this, `validate` + `transform` are offloaded to a Worker (02 §7.1). */
-export const MARSHALLER_WORKER_OFFLOAD_BYTES = 512 * 1024;
-/**
- * Can this marshaller ever reach the offload path? A DERIVED fact (05 §B1).
- *
- * A marshaller that refuses anything over 256KB can never produce a payload
- * above the 512KB main-thread limit, so it needs no worker and demanding one
- * would be noise. One whose ceiling is 2MB certainly can, and without a
- * `workerEntry` its large payloads are a guaranteed 503 — which is why V3
- * refuses to verify that combination rather than letting it surface in
- * production as an intermittent failure on the biggest imports.
- */
-export function requiresWorkerOffload(marshaller, thresholdBytes = MARSHALLER_WORKER_OFFLOAD_BYTES) {
-    return marshaller.maxPayloadBytes > thresholdBytes;
-}
-export const MARSHALLER_PAYLOAD_TOO_LARGE = 'MARSHALLER_PAYLOAD_TOO_LARGE';
-export const MARSHALLER_VALIDATION_FAILED = 'MARSHALLER_VALIDATION_FAILED';
-export const MARSHALLER_SCHEMA_VIOLATION = 'MARSHALLER_SCHEMA_VIOLATION';
-/**
- * Measure a payload's wire size.
- *
- * Uses the UTF-8 byte length, not `string.length`: a 400k-character document of
- * CJK text is ~1.2MB on the wire, and sizing it by character count would sail
- * past the offload threshold on the main thread.
- */
-export function payloadBytes(payload) {
-    if (typeof payload === 'string')
-        return new TextEncoder().encode(payload).length;
-    if (payload instanceof ArrayBuffer)
-        return payload.byteLength;
-    if (ArrayBuffer.isView(payload))
-        return payload.byteLength;
-    try {
-        return new TextEncoder().encode(JSON.stringify(payload) ?? '').length;
-    }
-    catch {
-        // A cyclic or non-serializable payload cannot be structured-cloned into a
-        // worker either, so treat it as over-threshold and let the caller refuse.
-        return Number.POSITIVE_INFINITY;
-    }
-}
-/**
- * Run a payload through its marshaller, offloading past the size gate.
- *
- * Order matters: the marshaller's OWN `maxPayloadBytes` is checked first, so an
- * oversized payload is refused with a typed diagnostic before any work — worker
- * or otherwise — is scheduled for it.
- */
-export async function marshalInbound(marshaller, payload, options = {}) {
-    const bytes = payloadBytes(payload);
-    if (bytes > marshaller.maxPayloadBytes)
-        throw new AppError(`Payload of ${bytes} bytes exceeds marshaller '${marshaller.id}' limit of ${marshaller.maxPayloadBytes}.`, {
-            code: MARSHALLER_PAYLOAD_TOO_LARGE,
-            status: 413,
-            context: { marshaller: marshaller.id, bytes, maxPayloadBytes: marshaller.maxPayloadBytes },
-        });
-    const threshold = options.offloadThresholdBytes ?? MARSHALLER_WORKER_OFFLOAD_BYTES;
-    if (bytes > threshold) {
-        // Offload is the DEFAULT path (05 §B1): an explicitly injected worker wins,
-        // otherwise the marshaller's own `workerEntry` is resolved through the host's
-        // resolver. Neither present means this marshaller has no offload path at all
-        // — which V3 refuses to verify, so a verified app never reaches this throw.
-        const worker = options.worker ??
-            (marshaller.workerEntry ? options.resolveWorker?.(marshaller) : undefined);
-        if (!worker)
-            throw new AppError(`Payload of ${bytes} bytes exceeds the ${threshold}-byte main-thread limit and marshaller '${marshaller.id}' has no marshalling worker.`, {
-                code: MARSHALLER_PAYLOAD_TOO_LARGE,
-                status: 503,
-                context: {
-                    marshaller: marshaller.id,
-                    bytes,
-                    threshold,
-                    workerEntry: marshaller.workerEntry ?? null,
-                    hint: marshaller.workerEntry
-                        ? 'The marshaller declares a workerEntry but no resolveWorker was supplied — pass createMarshalWorkerClient through MarshalOptions.resolveWorker.'
-                        : 'Give the marshaller a workerEntry (a module calling serveMarshalWorker), or lower maxPayloadBytes below the main-thread limit.',
-                },
-            });
-        // The worker validates AND transforms; the result still gets schema-checked
-        // below, because a worker is a thread boundary, not a trust boundary.
-        const result = await worker.run(marshaller.id, payload);
-        return assertSchema(marshaller, result);
-    }
-    if (!marshaller.validate(payload))
-        throw new AppError(`Inbound payload rejected by marshaller '${marshaller.id}'.`, {
-            code: MARSHALLER_VALIDATION_FAILED,
-            status: 400,
-            context: { marshaller: marshaller.id },
-        });
-    return assertSchema(marshaller, marshaller.transform(payload));
-}
-/**
- * The canonical-schema check every path funnels through. Running it on the
- * worker result too is what stops a drifting provider shape from entering the
- * hub as a well-typed lie.
- */
-function assertSchema(marshaller, value) {
-    const parsed = marshaller.targetZodSchema.safeParse(value);
-    if (!parsed.success)
-        throw new AppError(`Marshaller '${marshaller.id}' produced output that violates its token's schema.`, {
-            code: MARSHALLER_SCHEMA_VIOLATION,
-            status: 502,
-            context: {
-                marshaller: marshaller.id,
-                issues: parsed.error.issues.map((i) => `${i.path.join('.')}: ${i.message}`),
-            },
-        });
-    return parsed.data;
-}
-export function createMarshallerRegistry() {
-    const byToken = new Map();
-    return {
-        register(tokenId, marshaller) {
-            if (marshaller.maxPayloadBytes === undefined || marshaller.maxPayloadBytes <= 0)
-                throw new AppError(`Marshaller '${marshaller.id}' must declare a positive maxPayloadBytes.`, {
-                    code: 'marshaller-payload-unbounded',
-                    status: 500,
-                    context: { marshaller: marshaller.id, tokenId },
-                });
-            byToken.set(tokenId, marshaller);
-        },
-        forToken: (tokenId) => byToken.get(tokenId),
-        all: () => [...byToken.entries()].map(([tokenId, marshaller]) => ({ tokenId, marshaller })),
-    };
-}
-//# sourceMappingURL=marshalling.js.map

package/dist/core/wire/marshalling.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"marshalling.js","sourceRoot":"","sources":["../../../src/core/wire/marshalling.ts"],"names":[],"mappings":"AAiBA,OAAO,EAAE,QAAQ,EAAE,MAAM,qBAAqB,CAAC;AAE/C,gFAAgF;AAChF,MAAM,CAAC,MAAM,+BAA+B,GAAG,GAAG,GAAG,IAAI,CAAC;AA6C1D;;;;;;;;;GASG;AACH,MAAM,UAAU,qBAAqB,CACnC,UAAqD,EACrD,iBAAyB,+BAA+B;IAExD,OAAO,UAAU,CAAC,eAAe,GAAG,cAAc,CAAC;AACrD,CAAC;AAED,MAAM,CAAC,MAAM,4BAA4B,GAAG,8BAA8B,CAAC;AAC3E,MAAM,CAAC,MAAM,4BAA4B,GAAG,8BAA8B,CAAC;AAC3E,MAAM,CAAC,MAAM,2BAA2B,GAAG,6BAA6B,CAAC;AAEzE;;;;;;GAMG;AACH,MAAM,UAAU,YAAY,CAAC,OAAgB;IAC3C,IAAI,OAAO,OAAO,KAAK,QAAQ;QAAE,OAAO,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,MAAM,CAAC;IACjF,IAAI,OAAO,YAAY,WAAW;QAAE,OAAO,OAAO,CAAC,UAAU,CAAC;IAC9D,IAAI,WAAW,CAAC,MAAM,CAAC,OAAO,CAAC;QAAE,OAAO,OAAO,CAAC,UAAU,CAAC;IAC3D,IAAI,CAAC;QACH,OAAO,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC;IACxE,CAAC;IAAC,MAAM,CAAC;QACP,0EAA0E;QAC1E,0EAA0E;QAC1E,OAAO,MAAM,CAAC,iBAAiB,CAAC;IAClC,CAAC;AACH,CAAC;AAyBD;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,cAAc,CAClC,UAA0C,EAC1C,OAAgB,EAChB,UAA0B,EAAE;IAE5B,MAAM,KAAK,GAAG,YAAY,CAAC,OAAO,CAAC,CAAC;IAEpC,IAAI,KAAK,GAAG,UAAU,CAAC,eAAe;QACpC,MAAM,IAAI,QAAQ,CAChB,cAAc,KAAK,8BAA8B,UAAU,CAAC,EAAE,cAAc,UAAU,CAAC,eAAe,GAAG,EACzG;YACE,IAAI,EAAE,4BAA4B;YAClC,MAAM,EAAE,GAAG;YACX,OAAO,EAAE,EAAE,UAAU,EAAE,UAAU,CAAC,EAAE,EAAE,KAAK,EAAE,eAAe,EAAE,UAAU,CAAC,eAAe,EAAE;SAC3F,CACF,CAAC;IAEJ,MAAM,SAAS,GAAG,OAAO,CAAC,qBAAqB,IAAI,+BAA+B,CAAC;IAEnF,IAAI,KAAK,GAAG,SAAS,EAAE,CAAC;QACtB,4EAA4E;QAC5E,8EAA8E;QAC9E,6EAA6E;QAC7E,4EAA4E;QAC5E,MAAM,MAAM,GACV,OAAO,CAAC,MAAM;YACd,CAAC,UAAU,CAAC,WAAW,CAAC,CAAC,CAAC,OAAO,CAAC,aAAa,EAAE,CAAC,UAA4C,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;QAC/G,IAAI,CAAC,MAAM;YACT,MAAM,IAAI,QAAQ,CAChB,cAAc,KAAK,sBAAsB,SAAS,2CAA2C,UAAU,CAAC,EAAE,8BAA8B,EACxI;gBACE,IAAI,EAAE,4BAA4B;gBAClC,MAAM,EAAE,GAAG;gBACX,OAAO,EAAE;oBACP,UAAU,EAAE,UAAU,CAAC,EAAE;oBACzB,KAAK;oBACL,SAAS;oBACT,WAAW,EAAE,UAAU,CAAC,WAAW,IAAI,IAAI;oBAC3C,IAAI,EAAE,UAAU,CAAC,WAAW;wBAC1B,CAAC,CAAC,gJAAgJ;wBAClJ,CAAC,CAAC,gIAAgI;iBACrI;aACF,CACF,CAAC;QACJ,4EAA4E;QAC5E,sEAAsE;QACtE,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,GAAG,CAAe,UAAU,CAAC,EAAE,EAAE,OAAO,CAAC,CAAC;QACtE,OAAO,YAAY,CAAC,UAAU,EAAE,MAAM,CAAC,CAAC;IAC1C,CAAC;IAED,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,OAAO,CAAC;QAC/B,MAAM,IAAI,QAAQ,CAAC,2CAA2C,UAAU,CAAC,EAAE,IAAI,EAAE;YAC/E,IAAI,EAAE,4BAA4B;YAClC,MAAM,EAAE,GAAG;YACX,OAAO,EAAE,EAAE,UAAU,EAAE,UAAU,CAAC,EAAE,EAAE;SACvC,CAAC,CAAC;IAEL,OAAO,YAAY,CAAC,UAAU,EAAE,UAAU,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC,CAAC;AACjE,CAAC;AAED;;;;GAIG;AACH,SAAS,YAAY,CAAe,UAA0C,EAAE,KAAU;IACxF,MAAM,MAAM,GAAG,UAAU,CAAC,eAAe,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;IAC3D,IAAI,CAAC,MAAM,CAAC,OAAO;QACjB,MAAM,IAAI,QAAQ,CAAC,eAAe,UAAU,CAAC,EAAE,qDAAqD,EAAE;YACpG,IAAI,EAAE,2BAA2B;YACjC,MAAM,EAAE,GAAG;YACX,OAAO,EAAE;gBACP,UAAU,EAAE,UAAU,CAAC,EAAE;gBACzB,MAAM,EAAE,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,OAAO,EAAE,CAAC;aAC5E;SACF,CAAC,CAAC;IACL,OAAO,MAAM,CAAC,IAAI,CAAC;AACrB,CAAC;AASD,MAAM,UAAU,wBAAwB;IACtC,MAAM,OAAO,GAAG,IAAI,GAAG,EAA4B,CAAC;IACpD,OAAO;QACL,QAAQ,CAAC,OAAO,EAAE,UAAU;YAC1B,IAAI,UAAU,CAAC,eAAe,KAAK,SAAS,IAAI,UAAU,CAAC,eAAe,IAAI,CAAC;gBAC7E,MAAM,IAAI,QAAQ,CAAC,eAAe,UAAU,CAAC,EAAE,4CAA4C,EAAE;oBAC3F,IAAI,EAAE,8BAA8B;oBACpC,MAAM,EAAE,GAAG;oBACX,OAAO,EAAE,EAAE,UAAU,EAAE,UAAU,CAAC,EAAE,EAAE,OAAO,EAAE;iBAChD,CAAC,CAAC;YACL,OAAO,CAAC,GAAG,CAAC,OAAO,EAAE,UAAU,CAAC,CAAC;QACnC,CAAC;QACD,QAAQ,EAAE,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC;QAC3C,GAAG,EAAE,GAAG,EAAE,CAAC,CAAC,GAAG,OAAO,CAAC,OAAO,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,OAAO,EAAE,UAAU,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,OAAO,EAAE,UAAU,EAAE,CAAC,CAAC;KAC5F,CAAC;AACJ,CAAC"}

package/dist/core/wire/wireHub.d.ts

@@ -1,81 +0,0 @@
-/**
- * The port hub and instance lifecycle (03 §6.1–§6.2) — the two primitives V7's
- * wire-smoke and lifecycle probes assert against.
- *
- * **Settle by revision, not identity (R-5).** Every value emission is a
- * `WireEnvelope { rev, at, payload }` and a delivery whose `rev` equals the last
- * delivered one for that channel is dropped. Object identity is irrelevant,
- * which is what makes a server that re-allocates an equal payload on every tick
- * inert instead of a delivery storm.
- *
- * **Two subscription tiers (R-4 ∧ J3-3).** Instance-level intake lives from
- * `onReady` to `onUnmount` and writes only `{dirty, lastRev}` into a ledger —
- * never a payload copy, so an unrendered feature costs O(1) regardless of
- * traffic. Pane-level listeners live only while a pane is mounted and are torn
- * down on unmount, so navigation cannot accumulate dangling listeners. On mount
- * a pane compares the ledger's `lastRev` against what it rendered and pulls the
- * retained envelope if it is behind — no signal is lost, no payload is buffered.
- *
- * **Abort interception.** `InstanceRuntime.signal` fans into everything the
- * instance starts; `onSuspend` aborts the view scope and `onUnmount` the instance
- * scope. State setters routed through `guarded()` no-op after abort, so a late
- * async result is structurally unable to write into an unmounted instance.
- */
-export interface WireEnvelope<T = unknown> {
-    /** Monotonic per (instance, port); bump ONLY on content change. */
-    rev: number;
-    scope?: string;
-    at: number;
-    payload: T;
-}
-export interface LedgerEntry {
-    dirty: boolean;
-    lastRev: number;
-}
-export interface StormBreakerTrip {
-    channel: string;
-    count: number;
-}
-export interface WireHubOptions {
-    /** Deliveries per channel per window before the breaker trips (04 §2 V4). */
-    stormBudget?: number;
-    windowMs?: number;
-    now?: () => number;
-}
-export interface WireHub {
-    emit<T>(channel: string, envelope: WireEnvelope<T>): 'delivered' | 'settled' | 'breaker-tripped';
-    /** Pane-level listener: live re-render while mounted; returns its teardown. */
-    subscribe<T>(channel: string, listener: (envelope: WireEnvelope<T>) => void): () => void;
-    retained<T>(channel: string): WireEnvelope<T> | undefined;
-    listenerCount(channel: string): number;
-    breakerTrips(): readonly StormBreakerTrip[];
-}
-export declare function createWireHub(options?: WireHubOptions): WireHub;
-export type LifecyclePhase = 'created' | 'loaded' | 'ready' | 'suspended' | 'unmounted';
-export interface InstanceRuntime {
-    id: string;
-    phase(): LifecyclePhase;
-    /** Order is strict and verified: onLoad → onReady before the first view render. */
-    onLoad(): Promise<void>;
-    onReady(): Promise<void>;
-    onSuspend(): void;
-    onUnmount(): void;
-    /** Instance-scoped abort signal — fans into every fetch and background loop. */
-    signal: AbortSignal;
-    /** View-scoped signal; aborted by onSuspend and re-created on the next render. */
-    viewSignal(): AbortSignal;
-    /** Wraps a state setter so a late async result cannot write after abort. */
-    guarded<T>(apply: (value: T) => void): (value: T) => boolean;
-    ledger(): ReadonlyMap<string, LedgerEntry>;
-    /** Pane mount: pull the retained envelope iff the ledger is ahead of what was rendered. */
-    pullIfDirty<T>(channel: string, renderedRev: number): WireEnvelope<T> | undefined;
-    lifecycleErrors(): readonly string[];
-}
-export interface InstanceRuntimeOptions {
-    id: string;
-    hub: WireHub;
-    /** Channels the instance takes intake on at onReady (`subscribesAtMount` ports). */
-    intakeChannels: readonly string[];
-}
-export declare function createInstanceRuntime(options: InstanceRuntimeOptions): InstanceRuntime;
-//# sourceMappingURL=wireHub.d.ts.map

package/dist/core/wire/wireHub.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"wireHub.d.ts","sourceRoot":"","sources":["../../../src/core/wire/wireHub.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,MAAM,WAAW,YAAY,CAAC,CAAC,GAAG,OAAO;IACvC,mEAAmE;IACnE,GAAG,EAAE,MAAM,CAAC;IACZ,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,EAAE,EAAE,MAAM,CAAC;IACX,OAAO,EAAE,CAAC,CAAC;CACZ;AAED,MAAM,WAAW,WAAW;IAC1B,KAAK,EAAE,OAAO,CAAC;IACf,OAAO,EAAE,MAAM,CAAC;CACjB;AAED,MAAM,WAAW,gBAAgB;IAC/B,OAAO,EAAE,MAAM,CAAC;IAChB,KAAK,EAAE,MAAM,CAAC;CACf;AAED,MAAM,WAAW,cAAc;IAC7B,6EAA6E;IAC7E,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,GAAG,CAAC,EAAE,MAAM,MAAM,CAAC;CACpB;AAED,MAAM,WAAW,OAAO;IACtB,IAAI,CAAC,CAAC,EAAE,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,YAAY,CAAC,CAAC,CAAC,GAAG,WAAW,GAAG,SAAS,GAAG,iBAAiB,CAAC;IACjG,+EAA+E;IAC/E,SAAS,CAAC,CAAC,EAAE,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC,QAAQ,EAAE,YAAY,CAAC,CAAC,CAAC,KAAK,IAAI,GAAG,MAAM,IAAI,CAAC;IACzF,QAAQ,CAAC,CAAC,EAAE,OAAO,EAAE,MAAM,GAAG,YAAY,CAAC,CAAC,CAAC,GAAG,SAAS,CAAC;IAC1D,aAAa,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,CAAC;IACvC,YAAY,IAAI,SAAS,gBAAgB,EAAE,CAAC;CAC7C;AAED,wBAAgB,aAAa,CAAC,OAAO,GAAE,cAAmB,GAAG,OAAO,CA+CnE;AAED,MAAM,MAAM,cAAc,GAAG,SAAS,GAAG,QAAQ,GAAG,OAAO,GAAG,WAAW,GAAG,WAAW,CAAC;AAExF,MAAM,WAAW,eAAe;IAC9B,EAAE,EAAE,MAAM,CAAC;IACX,KAAK,IAAI,cAAc,CAAC;IACxB,mFAAmF;IACnF,MAAM,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;IACxB,OAAO,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;IACzB,SAAS,IAAI,IAAI,CAAC;IAClB,SAAS,IAAI,IAAI,CAAC;IAClB,gFAAgF;IAChF,MAAM,EAAE,WAAW,CAAC;IACpB,kFAAkF;IAClF,UAAU,IAAI,WAAW,CAAC;IAC1B,4EAA4E;IAC5E,OAAO,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,KAAK,EAAE,CAAC,KAAK,IAAI,GAAG,CAAC,KAAK,EAAE,CAAC,KAAK,OAAO,CAAC;IAC7D,MAAM,IAAI,WAAW,CAAC,MAAM,EAAE,WAAW,CAAC,CAAC;IAC3C,2FAA2F;IAC3F,WAAW,CAAC,CAAC,EAAE,OAAO,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,GAAG,YAAY,CAAC,CAAC,CAAC,GAAG,SAAS,CAAC;IAClF,eAAe,IAAI,SAAS,MAAM,EAAE,CAAC;CACtC;AAED,MAAM,WAAW,sBAAsB;IACrC,EAAE,EAAE,MAAM,CAAC;IACX,GAAG,EAAE,OAAO,CAAC;IACb,oFAAoF;IACpF,cAAc,EAAE,SAAS,MAAM,EAAE,CAAC;CACnC;AAED,wBAAgB,qBAAqB,CAAC,OAAO,EAAE,sBAAsB,GAAG,eAAe,CA6EtF"}