halfcode-compiler.xnl 0.2.2 → 0.2.4

package/dist/{src-DCRih45n.js → src-Bj7BZokJ.js}

@@ -1,7 +1,8 @@
 import { n as wordToString, t as parseXnl } from "./dist-Bkv7YeVi.js";
 import { readFile, readdir, realpath, stat } from "node:fs/promises";
-import { dirname, isAbsolute, join, relative, resolve, sep } from "node:path";
+import { dirname, extname, isAbsolute, join, posix, relative, resolve, sep } from "node:path";
 import { createHash } from "node:crypto";
+import { Buffer } from "node:buffer";
 //#region ../resource-core/src/canonical.ts
 function compareCodeUnits(left, right) {
 	if (left < right) return -1;
@@ -72,17 +73,17 @@ function createResourceContentIdentity(input) {
 		strictCanonicalInput: false,
 		validateClaimedDigest: false
 	});
-	if (diagnostics.length > 0 || !identity) throw new ResourceCompositionError(stableDiagnostics(diagnostics));
+	if (diagnostics.length > 0 || !identity) throw new ResourceCompositionError(stableDiagnostics$1(diagnostics));
 	return identity;
 }
 function buildResourceDependencySnapshot(input) {
 	const diagnostics = [];
-	if (!isEffectiveRegistryAuthentic(input.registry) || input.registry.revision !== input.registry.compositionRevision) throw new ResourceCompositionError(Object.freeze([diagnostic("RESOURCE_EFFECTIVE_REGISTRY_UNTRUSTED", "effective-registry:revision", "Dependency snapshots require an authentic immutable registry returned by composeLayeredResourceRegistry().")]));
+	if (!isEffectiveRegistryAuthentic(input.registry) || input.registry.revision !== input.registry.compositionRevision) throw new ResourceCompositionError(Object.freeze([diagnostic$1("RESOURCE_EFFECTIVE_REGISTRY_UNTRUSTED", "effective-registry:revision", "Dependency snapshots require an authentic immutable registry returned by composeLayeredResourceRegistry().")]));
 	const roots = validateRoots(input.roots, input.registry, diagnostics);
 	const edges = validateEdges(input.edges, input.registry, diagnostics);
 	validateContentIdentityIndex(input.contentIdentities, diagnostics);
 	const validatedIdentities = validateEffectiveContentIdentities(input.registry, input.contentIdentities, diagnostics);
-	if (diagnostics.length > 0) throw new ResourceCompositionError(stableDiagnostics(diagnostics));
+	if (diagnostics.length > 0) throw new ResourceCompositionError(stableDiagnostics$1(diagnostics));
 	const registryRevision = digestCanonical({
 		compositionRevision: input.registry.compositionRevision,
 		resources: [...validatedIdentities.values()].sort((left, right) => compareCodeUnits(left.resourceId, right.resourceId)).map((identity) => ({
@@ -106,7 +107,7 @@ function buildResourceDependencySnapshot(input) {
 		if (visiting.has(resourceId)) {
 			const cycleStart = path.indexOf(resourceId);
 			const cycle = [...path.slice(cycleStart), resourceId];
-			diagnostics.push(diagnostic("RESOURCE_DEPENDENCY_CYCLE", dependencyLocation(resourceId), `Resource dependency cycle detected: ${cycle.join(" -> ")}.`));
+			diagnostics.push(diagnostic$1("RESOURCE_DEPENDENCY_CYCLE", dependencyLocation(resourceId), `Resource dependency cycle detected: ${cycle.join(" -> ")}.`));
 			return;
 		}
 		if (visited.has(resourceId)) return;
@@ -122,7 +123,7 @@ function buildResourceDependencySnapshot(input) {
 		visited.add(resourceId);
 	};
 	for (const root of roots) visit(root);
-	if (diagnostics.length > 0) throw new ResourceCompositionError(stableDiagnostics(diagnostics));
+	if (diagnostics.length > 0) throw new ResourceCompositionError(stableDiagnostics$1(diagnostics));
 	const closure = Object.freeze([...reachable].sort(compareCodeUnits).map((resourceId) => {
 		const entry = input.registry.byId.get(resourceId);
 		const identity = validatedIdentities.get(resourceId);
@@ -160,19 +161,19 @@ function validateRoots(inputRoots, registry, diagnostics) {
 	for (const value of inputRoots) {
 		const resourceId = value.trim();
 		if (resourceId.length === 0) {
-			diagnostics.push(diagnostic("RESOURCE_DEPENDENCY_ROOT_EMPTY", "dependency-root:unnamed", "Dependency snapshot roots must be non-empty resource ids."));
+			diagnostics.push(diagnostic$1("RESOURCE_DEPENDENCY_ROOT_EMPTY", "dependency-root:unnamed", "Dependency snapshot roots must be non-empty resource ids."));
 			continue;
 		}
 		if (seen.has(resourceId)) {
-			diagnostics.push(diagnostic("RESOURCE_DEPENDENCY_ROOT_DUPLICATE", dependencyLocation(resourceId), `Dependency snapshot root '${resourceId}' is declared more than once.`));
+			diagnostics.push(diagnostic$1("RESOURCE_DEPENDENCY_ROOT_DUPLICATE", dependencyLocation(resourceId), `Dependency snapshot root '${resourceId}' is declared more than once.`));
 			continue;
 		}
 		seen.add(resourceId);
 		roots.push(resourceId);
 		const entry = registry.byId.get(resourceId);
-		if (!entry || !entry.resource) diagnostics.push(diagnostic("RESOURCE_DEPENDENCY_ROOT_MISSING", dependencyLocation(resourceId), `Dependency snapshot root '${resourceId}' is not an effective resource.`));
+		if (!entry || !entry.resource) diagnostics.push(diagnostic$1("RESOURCE_DEPENDENCY_ROOT_MISSING", dependencyLocation(resourceId), `Dependency snapshot root '${resourceId}' is not an effective resource.`));
 	}
-	if (roots.length === 0 && diagnostics.length === 0) diagnostics.push(diagnostic("RESOURCE_DEPENDENCY_ROOTS_EMPTY", "dependency-root:none", "Dependency snapshot requires at least one explicit root."));
+	if (roots.length === 0 && diagnostics.length === 0) diagnostics.push(diagnostic$1("RESOURCE_DEPENDENCY_ROOTS_EMPTY", "dependency-root:none", "Dependency snapshot requires at least one explicit root."));
 	return roots;
 }
 function validateEdges(inputEdges, registry, diagnostics) {
@@ -185,13 +186,13 @@ function validateEdges(inputEdges, registry, diagnostics) {
 			declaredBy: inputEdge.declaredBy.trim()
 		});
 		if (!edge.fromResourceId || !edge.toResourceId || !edge.relation || !edge.declaredBy) {
-			diagnostics.push(diagnostic("RESOURCE_DEPENDENCY_EDGE_INVALID", `dependency-edge:${index}`, "Dependency edges require non-empty fromResourceId, toResourceId, relation, and declaredBy fields."));
+			diagnostics.push(diagnostic$1("RESOURCE_DEPENDENCY_EDGE_INVALID", `dependency-edge:${index}`, "Dependency edges require non-empty fromResourceId, toResourceId, relation, and declaredBy fields."));
 			return;
 		}
 		const source = registry.byId.get(edge.fromResourceId);
 		const target = registry.byId.get(edge.toResourceId);
-		if (!source?.resource) diagnostics.push(diagnostic("RESOURCE_DEPENDENCY_SOURCE_MISSING", dependencyLocation(edge.fromResourceId), `Dependency edge source '${edge.fromResourceId}' is not an effective resource.`));
-		if (!target?.resource) diagnostics.push(diagnostic("RESOURCE_DEPENDENCY_TARGET_MISSING", dependencyLocation(edge.toResourceId), `Dependency edge target '${edge.toResourceId}' is not an effective resource.`));
+		if (!source?.resource) diagnostics.push(diagnostic$1("RESOURCE_DEPENDENCY_SOURCE_MISSING", dependencyLocation(edge.fromResourceId), `Dependency edge source '${edge.fromResourceId}' is not an effective resource.`));
+		if (!target?.resource) diagnostics.push(diagnostic$1("RESOURCE_DEPENDENCY_TARGET_MISSING", dependencyLocation(edge.toResourceId), `Dependency edge target '${edge.toResourceId}' is not an effective resource.`));
 		values.set(edgeKey(edge), edge);
 	});
 	return [...values.values()].sort(compareEdges);
@@ -199,41 +200,41 @@ function validateEdges(inputEdges, registry, diagnostics) {
 function normalizeContentIdentity(input, diagnostics, options) {
 	const initialDiagnosticCount = diagnostics.length;
 	if (!isRecord(input)) {
-		diagnostics.push(diagnostic("RESOURCE_CONTENT_IDENTITY_INVALID", contentLocation(""), "Resource content identity must be an object fact."));
+		diagnostics.push(diagnostic$1("RESOURCE_CONTENT_IDENTITY_INVALID", contentLocation(""), "Resource content identity must be an object fact."));
 		return;
 	}
 	const rawResourceId = input.resourceId;
 	const resourceId = typeof rawResourceId === "string" ? rawResourceId.trim() : "";
-	if (resourceId.length === 0) diagnostics.push(diagnostic("RESOURCE_CONTENT_IDENTITY_ID_EMPTY", contentLocation(""), "Resource content identity requires a non-empty resource id."));
-	else if (options.strictCanonicalInput && rawResourceId !== resourceId) diagnostics.push(diagnostic("RESOURCE_CONTENT_IDENTITY_NON_CANONICAL", contentLocation(resourceId), `Resource content identity '${resourceId}' must use its canonical id without surrounding whitespace.`));
+	if (resourceId.length === 0) diagnostics.push(diagnostic$1("RESOURCE_CONTENT_IDENTITY_ID_EMPTY", contentLocation(""), "Resource content identity requires a non-empty resource id."));
+	else if (options.strictCanonicalInput && rawResourceId !== resourceId) diagnostics.push(diagnostic$1("RESOURCE_CONTENT_IDENTITY_NON_CANONICAL", contentLocation(resourceId), `Resource content identity '${resourceId}' must use its canonical id without surrounding whitespace.`));
 	const authorityDigest = typeof input.authorityDigest === "string" ? input.authorityDigest : "";
-	if (!isSha256Digest(authorityDigest)) diagnostics.push(diagnostic("RESOURCE_CONTENT_AUTHORITY_DIGEST_INVALID", contentLocation(resourceId), `Resource '${resourceId || "unnamed"}' has an invalid authority digest.`));
+	if (!isSha256Digest(authorityDigest)) diagnostics.push(diagnostic$1("RESOURCE_CONTENT_AUTHORITY_DIGEST_INVALID", contentLocation(resourceId), `Resource '${resourceId || "unnamed"}' has an invalid authority digest.`));
 	const rawContributions = input.contributions;
 	let contributionFacts = [];
 	if (rawContributions === void 0 && !options.requireContributions) contributionFacts = [];
-	else if (!Array.isArray(rawContributions)) diagnostics.push(diagnostic("RESOURCE_DIGEST_CONTRIBUTIONS_INVALID", contentLocation(resourceId), `Resource '${resourceId || "unnamed"}' must provide an explicit digest contribution array.`));
+	else if (!Array.isArray(rawContributions)) diagnostics.push(diagnostic$1("RESOURCE_DIGEST_CONTRIBUTIONS_INVALID", contentLocation(resourceId), `Resource '${resourceId || "unnamed"}' must provide an explicit digest contribution array.`));
 	else contributionFacts = rawContributions;
 	const contributions = /* @__PURE__ */ new Map();
 	for (const fact of contributionFacts) {
 		if (!isRecord(fact)) {
-			diagnostics.push(diagnostic("RESOURCE_DIGEST_CONTRIBUTION_INVALID", contentLocation(resourceId), `Resource '${resourceId || "unnamed"}' has a non-object digest contribution.`));
+			diagnostics.push(diagnostic$1("RESOURCE_DIGEST_CONTRIBUTION_INVALID", contentLocation(resourceId), `Resource '${resourceId || "unnamed"}' has a non-object digest contribution.`));
 			continue;
 		}
 		const rawKey = fact.key;
 		const key = typeof rawKey === "string" ? rawKey.trim() : "";
 		if (key.length === 0) {
-			diagnostics.push(diagnostic("RESOURCE_DIGEST_CONTRIBUTION_KEY_EMPTY", contentLocation(resourceId), `Resource '${resourceId || "unnamed"}' has a digest contribution with an empty key.`));
+			diagnostics.push(diagnostic$1("RESOURCE_DIGEST_CONTRIBUTION_KEY_EMPTY", contentLocation(resourceId), `Resource '${resourceId || "unnamed"}' has a digest contribution with an empty key.`));
 			continue;
 		}
-		if (options.strictCanonicalInput && rawKey !== key) diagnostics.push(diagnostic("RESOURCE_DIGEST_CONTRIBUTION_NON_CANONICAL", contentLocation(resourceId, key), `Digest contribution '${key}' for resource '${resourceId}' must use its canonical key.`));
+		if (options.strictCanonicalInput && rawKey !== key) diagnostics.push(diagnostic$1("RESOURCE_DIGEST_CONTRIBUTION_NON_CANONICAL", contentLocation(resourceId, key), `Digest contribution '${key}' for resource '${resourceId}' must use its canonical key.`));
 		const digest = typeof fact.digest === "string" ? fact.digest : "";
 		if (!isSha256Digest(digest)) {
-			diagnostics.push(diagnostic("RESOURCE_DIGEST_CONTRIBUTION_INVALID", contentLocation(resourceId, key), `Digest contribution '${key}' for resource '${resourceId || "unnamed"}' is invalid.`));
+			diagnostics.push(diagnostic$1("RESOURCE_DIGEST_CONTRIBUTION_INVALID", contentLocation(resourceId, key), `Digest contribution '${key}' for resource '${resourceId || "unnamed"}' is invalid.`));
 			continue;
 		}
 		const sourceUri = fact.sourceUri;
 		if (sourceUri !== void 0 && typeof sourceUri !== "string") {
-			diagnostics.push(diagnostic("RESOURCE_DIGEST_CONTRIBUTION_SOURCE_INVALID", contentLocation(resourceId, key), `Digest contribution '${key}' for resource '${resourceId}' has an invalid source URI.`));
+			diagnostics.push(diagnostic$1("RESOURCE_DIGEST_CONTRIBUTION_SOURCE_INVALID", contentLocation(resourceId, key), `Digest contribution '${key}' for resource '${resourceId}' has an invalid source URI.`));
 			continue;
 		}
 		const contribution = Object.freeze({
@@ -244,7 +245,7 @@ function normalizeContentIdentity(input, diagnostics, options) {
 		const current = contributions.get(key);
 		if (current) {
 			const conflicting = current.digest !== digest;
-			diagnostics.push(diagnostic(conflicting ? "RESOURCE_DIGEST_CONTRIBUTION_CONFLICT" : "RESOURCE_DIGEST_CONTRIBUTION_DUPLICATE", contentLocation(resourceId, key), conflicting ? `Digest contribution '${key}' for resource '${resourceId || "unnamed"}' has conflicting digests.` : `Digest contribution '${key}' for resource '${resourceId || "unnamed"}' is declared more than once.`));
+			diagnostics.push(diagnostic$1(conflicting ? "RESOURCE_DIGEST_CONTRIBUTION_CONFLICT" : "RESOURCE_DIGEST_CONTRIBUTION_DUPLICATE", contentLocation(resourceId, key), conflicting ? `Digest contribution '${key}' for resource '${resourceId || "unnamed"}' has conflicting digests.` : `Digest contribution '${key}' for resource '${resourceId || "unnamed"}' is declared more than once.`));
 			continue;
 		}
 		contributions.set(key, contribution);
@@ -262,11 +263,11 @@ function normalizeContentIdentity(input, diagnostics, options) {
 	if (options.validateClaimedDigest) {
 		const claimedDigest = input.contentDigest;
 		if (typeof claimedDigest !== "string" || !isSha256Digest(claimedDigest)) {
-			diagnostics.push(diagnostic("RESOURCE_CONTENT_DIGEST_INVALID", contentLocation(resourceId), `Resource '${resourceId}' has an invalid claimed content digest.`));
+			diagnostics.push(diagnostic$1("RESOURCE_CONTENT_DIGEST_INVALID", contentLocation(resourceId), `Resource '${resourceId}' has an invalid claimed content digest.`));
 			return;
 		}
 		if (claimedDigest !== contentDigest) {
-			diagnostics.push(diagnostic("RESOURCE_CONTENT_DIGEST_MISMATCH", contentLocation(resourceId), `Resource '${resourceId}' claimed a content digest that does not match its explicit authority and contributions.`));
+			diagnostics.push(diagnostic$1("RESOURCE_CONTENT_DIGEST_MISMATCH", contentLocation(resourceId), `Resource '${resourceId}' claimed a content digest that does not match its explicit authority and contributions.`));
 			return;
 		}
 	}
@@ -283,7 +284,7 @@ function validateEffectiveContentIdentities(registry, identities, diagnostics) {
 	for (const entry of effectiveEntries) {
 		const input = identities.get(entry.resourceId);
 		if (input === void 0) {
-			diagnostics.push(diagnostic("RESOURCE_CONTENT_IDENTITY_MISSING", dependencyLocation(entry.resourceId), `Effective resource '${entry.resourceId}' has no explicit content identity.`));
+			diagnostics.push(diagnostic$1("RESOURCE_CONTENT_IDENTITY_MISSING", dependencyLocation(entry.resourceId), `Effective resource '${entry.resourceId}' has no explicit content identity.`));
 			continue;
 		}
 		const identity = normalizeContentIdentity(input, diagnostics, {
@@ -298,7 +299,7 @@ function validateEffectiveContentIdentities(registry, identities, diagnostics) {
 function validateContentIdentityIndex(identities, diagnostics) {
 	for (const [key, identity] of [...identities.entries()].sort(([left], [right]) => compareCodeUnits(left, right))) {
 		const identityResourceId = isRecord(identity) && typeof identity.resourceId === "string" ? identity.resourceId : void 0;
-		if (key !== identityResourceId) diagnostics.push(diagnostic("RESOURCE_CONTENT_IDENTITY_KEY_MISMATCH", dependencyLocation(key), `Content identity index key '${key}' does not match identity '${identityResourceId ?? "invalid"}'.`));
+		if (key !== identityResourceId) diagnostics.push(diagnostic$1("RESOURCE_CONTENT_IDENTITY_KEY_MISMATCH", dependencyLocation(key), `Content identity index key '${key}' does not match identity '${identityResourceId ?? "invalid"}'.`));
 	}
 }
 function isSha256Digest(value) {
@@ -344,10 +345,10 @@ function cloneOrigin(origin) {
 		...origin.logicalPath === void 0 ? {} : { logicalPath: origin.logicalPath }
 	});
 }
-function stableDiagnostics(diagnostics) {
+function stableDiagnostics$1(diagnostics) {
 	return Object.freeze([...diagnostics].sort((left, right) => compareCodeUnits(left.location, right.location) || compareCodeUnits(left.code, right.code)));
 }
-function diagnostic(code, location, message) {
+function diagnostic$1(code, location, message) {
 	return Object.freeze({
 		code,
 		location,
@@ -371,6 +372,184 @@ function isLoadedResourceTreeAuthentic(tree) {
 	return authenticLoadedResourceTrees.has(tree);
 }
 //#endregion
+//#region ../resource-core/src/code-package.ts
+const CODE_PACKAGE_ENTRY_CONTRIBUTION_KEY = "code-binding:module";
+/** @internal Node effect implementation bound by the public facade. */
+const nodeCodePackageRuntime = Object.freeze({
+	realpath,
+	readFile,
+	stat,
+	importModule: async (url) => import(url)
+});
+var CodePackageLoadError = class extends Error {
+	diagnostics;
+	constructor(diagnostics) {
+		super(`CodePackage loading failed with ${diagnostics.length} diagnostic(s)`);
+		this.name = "CodePackageLoadError";
+		this.diagnostics = Object.freeze([...diagnostics]);
+	}
+};
+/** @internal Used by the canonical XNL loader before it brands the completed tree. */
+function normalizeCodePackageBinding(record) {
+	const diagnostics = [];
+	if (record.sourceShape !== "code-package") {
+		diagnostics.push(diagnostic("RESOURCE_CODE_PACKAGE_SHAPE_INVALID", record.documentUri, `Resource '${record.resourceId}' does not use the code-package source shape.`));
+		return { diagnostics };
+	}
+	const node = record.node.subdomains.CodeBinding;
+	if (!node || node.tag !== "CodeBinding") {
+		diagnostics.push(diagnostic("RESOURCE_CODE_PACKAGE_BINDING_MISSING", record.documentUri, `CodePackage resource '${record.resourceId}' requires one CodeBinding.`));
+		return { diagnostics };
+	}
+	if (node.properties.package !== void 0) diagnostics.push(diagnostic("RESOURCE_CODE_PACKAGE_BINDING_INVALID", record.documentUri, `CodePackage resource '${record.resourceId}' must bind a package-local module, not an external package.`));
+	const rawModule = stringValue(node.properties.module);
+	const moduleUri = rawModule === void 0 ? void 0 : normalizeModuleUri(rawModule);
+	if (!moduleUri) diagnostics.push(diagnostic("RESOURCE_CODE_PACKAGE_MODULE_INVALID", record.documentUri, `CodePackage resource '${record.resourceId}' requires a canonical package-local .js or .mjs module URI.`));
+	const rawExport = node.properties.export;
+	const exportName = stringValue(rawExport);
+	if (rawExport !== void 0 && (!exportName || !/^[A-Za-z_$][A-Za-z0-9_$]*$/.test(exportName))) diagnostics.push(diagnostic("RESOURCE_CODE_PACKAGE_EXPORT_INVALID", record.documentUri, `CodePackage resource '${record.resourceId}' has an invalid named export binding.`));
+	if (diagnostics.length > 0 || !moduleUri) return { diagnostics: stableDiagnostics(diagnostics) };
+	return {
+		binding: Object.freeze({
+			resourceId: record.resourceId,
+			moduleUri,
+			...exportName ? { exportName } : {}
+		}),
+		diagnostics: Object.freeze([])
+	};
+}
+/** @internal Resolves and reads the exact entry bytes under the descriptor directory. */
+async function readCodePackageEntry(runtime, rootDir, record, binding) {
+	const diagnostics = [];
+	const realRoot = await runtime.realpath(resolve(rootDir)).catch(() => void 0);
+	if (!realRoot) return { diagnostics: [diagnostic("RESOURCE_CODE_PACKAGE_ROOT_MISSING", record.documentUri, `The resource root for '${record.resourceId}' is missing or unreadable.`)] };
+	if (!isSafeLogicalPath(record.logicalPath)) return { diagnostics: [diagnostic("RESOURCE_CODE_PACKAGE_PROVENANCE_INVALID", record.documentUri, `CodePackage resource '${record.resourceId}' has unsafe logical provenance.`)] };
+	const descriptorPath = resolve(realRoot, record.logicalPath);
+	const descriptorDirectory = await runtime.realpath(dirname(descriptorPath)).catch(() => void 0);
+	if (!descriptorDirectory || !isWithin(realRoot, descriptorDirectory)) return { diagnostics: [diagnostic("RESOURCE_CODE_PACKAGE_ENTRY_CONTAINMENT", record.documentUri, `CodePackage resource '${record.resourceId}' resolves outside the resource root.`)] };
+	const localPath = moduleLocalPath(binding.moduleUri);
+	if (!localPath) return { diagnostics: [diagnostic("RESOURCE_CODE_PACKAGE_MODULE_INVALID", record.documentUri, `CodePackage resource '${record.resourceId}' has an invalid module URI.`)] };
+	const entryPath = await runtime.realpath(resolve(descriptorDirectory, ...localPath.split("/"))).catch(() => void 0);
+	if (!entryPath) return { diagnostics: [diagnostic("RESOURCE_CODE_PACKAGE_ENTRY_MISSING", `${record.documentUri}#CodeBinding`, `CodePackage entry is missing for '${record.resourceId}'.`)] };
+	if (!isWithin(descriptorDirectory, entryPath) || entryPath === descriptorDirectory) diagnostics.push(diagnostic("RESOURCE_CODE_PACKAGE_ENTRY_CONTAINMENT", `${record.documentUri}#CodeBinding`, `CodePackage entry for '${record.resourceId}' resolves outside its package directory.`));
+	if (!(await runtime.stat(entryPath).catch(() => void 0))?.isFile()) diagnostics.push(diagnostic("RESOURCE_CODE_PACKAGE_ENTRY_INVALID", `${record.documentUri}#CodeBinding`, `CodePackage entry for '${record.resourceId}' must be a regular file.`));
+	if (diagnostics.length > 0) return { diagnostics: stableDiagnostics(diagnostics) };
+	const bytes = await runtime.readFile(entryPath).catch(() => void 0);
+	if (!bytes) return { diagnostics: [diagnostic("RESOURCE_CODE_PACKAGE_ENTRY_MISSING", `${record.documentUri}#CodeBinding`, `CodePackage entry is unreadable for '${record.resourceId}'.`)] };
+	const resourceDirectory = posix.dirname(record.logicalPath);
+	return {
+		entryPath,
+		bytes,
+		sourceUri: `vfs://@/${resourceDirectory === "." ? localPath : `${resourceDirectory}/${localPath}`}`,
+		diagnostics: Object.freeze([])
+	};
+}
+async function loadCodePackageModule(input) {
+	return loadCodePackageModuleWithRuntime(nodeCodePackageRuntime, input);
+}
+/** @internal Pure orchestration over an injected effect runtime; hidden by the package facade. */
+async function loadCodePackageModuleWithRuntime(runtime, input) {
+	if (!isLoadedResourceTreeAuthentic(input.tree)) throw loadError("RESOURCE_CODE_PACKAGE_TREE_UNTRUSTED", `code-package:${input.resourceId}`, "CodePackage modules require an authentic LoadedResourceTree.");
+	const record = findResource(input.tree, input.resourceId);
+	const binding = input.tree.codePackageBindings.get(input.resourceId);
+	const identity = input.tree.contentIdentities.get(input.resourceId);
+	if (!record || record.sourceShape !== "code-package" || !binding || !identity) throw loadError("RESOURCE_CODE_PACKAGE_RESOURCE_INVALID", `code-package:${input.resourceId}`, `Resource '${input.resourceId}' is not a loaded CodePackage.`);
+	const entry = await readCodePackageEntry(runtime, input.rootDir, record, binding);
+	if (entry.diagnostics.length > 0 || !entry.entryPath || !entry.bytes) throw new CodePackageLoadError(entry.diagnostics);
+	const contribution = identity.contributions.find((item) => item.key === CODE_PACKAGE_ENTRY_CONTRIBUTION_KEY);
+	if (!contribution || contribution.digest !== sha256Digest(entry.bytes) || contribution.sourceUri !== entry.sourceUri) throw loadError("RESOURCE_CODE_PACKAGE_REVISION_STALE", `${record.documentUri}#CodeBinding`, `CodePackage entry for '${record.resourceId}' changed after its ResourceTree was loaded.`);
+	const url = `data:text/javascript;base64,${Buffer.concat([Buffer.from(entry.bytes), Buffer.from(`\n/* halfcode_revision=${identity.contentDigest} */\n`)]).toString("base64")}`;
+	let moduleNamespace;
+	try {
+		moduleNamespace = await runtime.importModule(url);
+	} catch {
+		throw loadError("RESOURCE_CODE_PACKAGE_IMPORT_FAILED", `${record.documentUri}#CodeBinding`, `CodePackage entry for '${record.resourceId}' could not be imported.`);
+	}
+	if (binding.exportName && !(binding.exportName in moduleNamespace)) throw loadError("RESOURCE_CODE_PACKAGE_EXPORT_MISSING", `${record.documentUri}#CodeBinding`, `CodePackage entry for '${record.resourceId}' does not export '${binding.exportName}'.`);
+	const currentBytes = await runtime.readFile(entry.entryPath).catch(() => void 0);
+	if (!currentBytes || sha256Digest(currentBytes) !== contribution.digest) throw loadError("RESOURCE_CODE_PACKAGE_REVISION_STALE", `${record.documentUri}#CodeBinding`, `CodePackage entry for '${record.resourceId}' changed while it was being imported.`);
+	const frozenNamespace = Object.freeze(Object.fromEntries(Object.keys(moduleNamespace).sort(compareCodeUnits).map((name) => [name, moduleNamespace[name]])));
+	return Object.freeze({
+		resourceId: record.resourceId,
+		binding,
+		revision: identity.contentDigest,
+		moduleNamespace: frozenNamespace
+	});
+}
+function admitCodePackageExports(loaded, contract) {
+	return admitCandidates([{
+		loaded,
+		contract
+	}]);
+}
+function admitCodePackages(loaded, contract) {
+	return admitCandidates(loaded.map((item) => ({
+		loaded: item,
+		contract
+	})));
+}
+function admitCandidates(packages) {
+	const definitions = /* @__PURE__ */ new Map();
+	for (const { loaded, contract } of packages) {
+		const names = loaded.binding.exportName ? [loaded.binding.exportName] : Object.keys(loaded.moduleNamespace).sort(compareCodeUnits);
+		for (const name of names) {
+			const exported = loaded.moduleNamespace[name];
+			const candidates = Array.isArray(exported) ? exported : [exported];
+			for (const candidate of candidates) {
+				if (!contract.isDefinition(candidate)) continue;
+				const identity = contract.identityOf(candidate).trim();
+				if (!identity) throw new TypeError(`CodePackage definition from '${loaded.resourceId}' has an empty identity`);
+				if (definitions.has(identity)) throw new TypeError(`Duplicate CodePackage definition identity '${identity}'`);
+				definitions.set(identity, candidate);
+			}
+		}
+	}
+	return Object.freeze([...definitions.entries()].sort(([left], [right]) => compareCodeUnits(left, right)).map(([, definition]) => definition));
+}
+function normalizeModuleUri(value) {
+	const prefix = "vfs://./";
+	if (!value.startsWith(prefix) || value !== value.trim() || value.includes("%") || value.includes("\\") || value.includes("?") || value.includes("#")) return void 0;
+	const localPath = value.slice(8);
+	if (!localPath || isAbsolute(localPath) || posix.isAbsolute(localPath)) return void 0;
+	const parts = localPath.split("/");
+	if (parts.some((part) => !part || part === "." || part === "..")) return void 0;
+	const extension = extname(localPath).toLowerCase();
+	if (extension !== ".js" && extension !== ".mjs") return void 0;
+	return `${prefix}${parts.join("/")}`;
+}
+function moduleLocalPath(moduleUri) {
+	return normalizeModuleUri(moduleUri)?.slice(8);
+}
+function findResource(tree, resourceId) {
+	for (const records of tree.registry.byKind.values()) {
+		const record = records.find((item) => item.resourceId === resourceId);
+		if (record) return record;
+	}
+}
+function isSafeLogicalPath(value) {
+	return Boolean(value) && !isAbsolute(value) && !value.includes("\\") && !value.split("/").some((part) => !part || part === "." || part === "..");
+}
+function isWithin(boundary, candidate) {
+	const path = relative(boundary, candidate);
+	return path === "" || !path.startsWith(`..${sep}`) && path !== ".." && !isAbsolute(path);
+}
+function stringValue(value) {
+	return typeof value === "string" && value.trim() ? value.trim() : void 0;
+}
+function loadError(code, location, message) {
+	return new CodePackageLoadError([diagnostic(code, location, message)]);
+}
+function stableDiagnostics(diagnostics) {
+	return Object.freeze([...diagnostics].sort((left, right) => compareCodeUnits(left.location, right.location) || compareCodeUnits(left.code, right.code)));
+}
+function diagnostic(code, location, message) {
+	return Object.freeze({
+		code,
+		location,
+		message
+	});
+}
+//#endregion
 //#region ../resource-core/src/readonly-map.ts
 function readonlyMap(entries) {
 	const values = new Map(entries);
@@ -413,7 +592,9 @@ async function buildXnlResourceTree(options) {
 		resources: [],
 		seenIdentities: /* @__PURE__ */ new Map(),
 		authorityFiles: /* @__PURE__ */ new Map(),
-		recordAuthorityDigests: /* @__PURE__ */ new WeakMap()
+		recordAuthorityDigests: /* @__PURE__ */ new WeakMap(),
+		recordContributions: /* @__PURE__ */ new WeakMap(),
+		codePackageBindings: /* @__PURE__ */ new Map()
 	};
 	const manifest = await loadManifest(resolve(context.rootDir, options.manifestPath), "manifest", context, true);
 	if (!manifest || context.diagnostics.length > 0) return { diagnostics: context.diagnostics };
@@ -426,6 +607,7 @@ async function buildXnlResourceTree(options) {
 	const frozenByKind = readonlyMap([...byKind.entries()].sort(([left], [right]) => compareCodeUnits(left, right)).map(([kind, records]) => [kind, Object.freeze([...records].sort((left, right) => compareCodeUnits(left.resourceId, right.resourceId)))]));
 	const frozenKindDefinitions = readonlyMap([...context.kindDefinitions.entries()].sort(([left], [right]) => compareCodeUnits(left, right)));
 	const contentIdentities = readonlyMap(context.resources.map((resource) => [resource.resourceId, loadedContentIdentity(resource, context)]).sort(([left], [right]) => compareCodeUnits(left, right)));
+	const codePackageBindings = readonlyMap([...context.codePackageBindings.entries()].sort(([left], [right]) => compareCodeUnits(left, right)));
 	return {
 		diagnostics: [],
 		tree: markLoadedResourceTreeAuthentic(Object.freeze({
@@ -435,7 +617,8 @@ async function buildXnlResourceTree(options) {
 				kindDefinitions: frozenKindDefinitions
 			}),
 			diagnostics: Object.freeze([]),
-			contentIdentities
+			contentIdentities,
+			codePackageBindings
 		}))
 	};
 }
@@ -524,6 +707,7 @@ async function loadCatalog(catalog, manifestDir, context) {
 			}
 			validateResourceApiVersion(record, definition, context.diagnostics);
 			await validateRequiredFiles(dirname(file), record, definition, context.diagnostics);
+			if (catalog.shape === "code-package" && !await prepareCodePackageRecord(record, context)) continue;
 			validateIdentity(record, context);
 			context.resources.push(record);
 		}
@@ -559,7 +743,7 @@ async function catalogFiles(catalog, manifestDir, context) {
 		context.diagnostics.push({
 			code: "RESOURCE_CATALOG_ENTRY_INVALID",
 			location: catalog.location,
-			message: "Directory and manifest catalogs require a plain XNL entry filename."
+			message: "Directory, manifest and code-package catalogs require a plain XNL entry filename."
 		});
 		return [];
 	}
@@ -640,8 +824,25 @@ function loadedContentIdentity(resource, context) {
 	if (!authorityDigest) throw new Error(`Loader authority digest is missing for ${resource.resourceId}`);
 	return createResourceContentIdentity({
 		resourceId: resource.resourceId,
-		authorityDigest
+		authorityDigest,
+		contributions: context.recordContributions.get(resource) ?? []
+	});
+}
+async function prepareCodePackageRecord(record, context) {
+	const normalized = normalizeCodePackageBinding(record);
+	context.diagnostics.push(...normalized.diagnostics);
+	if (!normalized.binding) return false;
+	const entry = await readCodePackageEntry(nodeCodePackageRuntime, context.rootDir, record, normalized.binding);
+	context.diagnostics.push(...entry.diagnostics);
+	if (!entry.bytes || !entry.sourceUri) return false;
+	const contribution = Object.freeze({
+		key: CODE_PACKAGE_ENTRY_CONTRIBUTION_KEY,
+		digest: sha256Digest(entry.bytes),
+		sourceUri: entry.sourceUri
 	});
+	context.recordContributions.set(record, Object.freeze([contribution]));
+	context.codePackageBindings.set(record.resourceId, normalized.binding);
+	return true;
 }
 function resourceRecordFromRoot(root, filePath, sourceShape, context) {
 	const documentUri = documentUriFor(context.rootDir, filePath);
@@ -877,7 +1078,7 @@ function kindMismatch(actual, expected, location) {
 	};
 }
 function isXnlShape(value) {
-	return value === "single-file" || value === "directory" || value === "manifest";
+	return value === "single-file" || value === "directory" || value === "manifest" || value === "code-package";
 }
 function isDocumentCardinality(value) {
 	return value === "one" || value === "many";
@@ -944,4 +1145,4 @@ function unsupportedAuthorityDiagnostic(options) {
 	};
 }
 //#endregion
-export { isLoadedResourceTreeAuthentic as a, sha256Digest as c, markEffectiveRegistryAuthentic as d, ResourceCompositionError as f, readonlyMap as i, effectiveRegistryLayerBindings as l, digestCanonical as m, loadResourceTree as n, buildResourceDependencySnapshot as o, compareCodeUnits as p, validateResourceTree as r, createResourceContentIdentity as s, ResourceValidationError as t, isEffectiveRegistryAuthentic as u };
+export { ResourceCompositionError as _, CODE_PACKAGE_ENTRY_CONTRIBUTION_KEY as a, admitCodePackages as c, buildResourceDependencySnapshot as d, createResourceContentIdentity as f, markEffectiveRegistryAuthentic as g, isEffectiveRegistryAuthentic as h, readonlyMap as i, loadCodePackageModule as l, effectiveRegistryLayerBindings as m, loadResourceTree as n, CodePackageLoadError as o, sha256Digest as p, validateResourceTree as r, admitCodePackageExports as s, ResourceValidationError as t, isLoadedResourceTreeAuthentic as u, compareCodeUnits as v, digestCanonical as y };

package/dist/{src-D1Bmq7Lo.js → src-ClihwpeP.js}

@@ -1,4 +1,4 @@
-import { l as resourceRefToFqn, u as resolveObjectOperationCompilation } from "./src-DRIws6tY.js";
+import { l as resourceRefToFqn, u as resolveObjectOperationCompilation } from "./src-6nezdi57.js";
 import { c as unsafeUnicodeCodeUnitIssue, i as planResourceMappings, o as safePathLexicalIssue, r as parseResourceMappings, t as ResourceMappingPathError } from "./src-25wZPUyX.js";
 import { lstat, mkdir, mkdtemp, readFile, readdir, rename, rm, writeFile } from "node:fs/promises";
 import { basename, dirname, join, posix, resolve } from "node:path";

package/dist/system-skills/resource-dsl/KindDefinitions/SkillCapsule/manifest.xnl

@@ -0,0 +1,21 @@
+<KindDefinition #Halfcode.ResourceDsl.KindDefinition.SkillCapsule apiVersion="halfcode.resources/v1" version="1.0.0" {
+  lifecycle = "Stable"
+  description = "Kind definition for the versioned Resource DSL consumer SkillCapsule."
+  resourceKind = "SkillCapsule"
+  sourceShapes = ["directory"]
+  currentApiVersion = "halfcode.resources/v1"
+  supportedApiVersions = ["halfcode.resources/v1"]
+} (
+  <DescriptorContract (
+    <RequiredFiles [
+      <File { name = "SKILL.metadata.yaml" }>
+      <File { name = "SKILL.template.ejs" }>
+      <File { name = "resource-mappings.xnl" }>
+    ]>
+    <IncludeContract {
+      collection = "Includes"
+      relation = "compiled-resource-selection"
+      dependencySemantics = false
+    }>
+  )>
+)>

package/dist/system-skills/resource-dsl/KindDefinitions/WikiPage/manifest.xnl

@@ -0,0 +1,10 @@
+<KindDefinition #Halfcode.ResourceDsl.KindDefinition.WikiPage apiVersion="halfcode.resources/v1" version="1.0.0" {
+  lifecycle = "Stable"
+  description = "Kind definition for canonical documentation pages referenced from the Resource DSL package root."
+  resourceKind = "WikiPage"
+  sourceShapes = ["directory"]
+  currentApiVersion = "halfcode.resources/v1"
+  supportedApiVersions = ["halfcode.resources/v1"]
+} (
+  <DescriptorContract>
+)>

package/dist/system-skills/resource-dsl/SkillCapsules/System/SKILL.metadata.yaml

@@ -0,0 +1,2 @@
+title: Halfcode Resource DSL
+description: Author and review XNL ResourcePackages, catalogs, KindDefinitions, VFS materials, projections and SkillCapsules using the canonical Halfcode Resource DSL.

package/dist/system-skills/resource-dsl/SkillCapsules/System/SKILL.template.ejs

@@ -0,0 +1,20 @@
+---
+name: <%= metadata.name %>
+description: <%= metadata.description %>
+---
+
+# <%= metadata.title %>
+
+Use this Skill for the generic XNL resource language and its deterministic compiler contracts. Product-specific authoring and runtime operations belong to their owner Skills.
+
+## Progressive loading
+
+1. Start with `references/resource-dsl/index.md`.
+2. For XNL channels and source syntax, read `references/resource-dsl/language.md` and only the needed file under `references/resource-dsl/examples/`.
+3. For ResourcePackage, Catalog or KindDefinition work, read `references/resource-dsl/documents.md` and `references/resource-dsl/files.md`.
+4. For layered registries, content identities or snapshots, read `references/resource-dsl/projections.md`.
+5. For SkillCapsule dependency/distribution work, read `references/resource-dsl/skill-capsules.md`.
+6. Read `references/resource-dsl/migration.md` only for migration work.
+7. Use `references/.halfcode/provenance.json` to verify source identity, version and payload digests.
+
+Do not infer resource relationships from ordinary text. Use explicit catalogs, typed references and Kind-owned contracts, then rely on deterministic validation and compilation.

package/dist/system-skills/resource-dsl/SkillCapsules/System/manifest.xnl

@@ -0,0 +1,18 @@
+<SkillCapsule #Halfcode.ResourceDsl.Skill.System apiVersion="halfcode.resources/v1" version="1.0.0" {
+  name = "sys-halfcode-resource-dsl"
+  lifecycle = "Stable"
+  description = "Author and review XNL ResourcePackages, catalogs, KindDefinitions, VFS materials, projections and SkillCapsules using the canonical Halfcode Resource DSL."
+} (
+  <SkillMetadata { href = "vfs://./SKILL.metadata.yaml" format = "yaml" }>
+  <Template { href = "vfs://./SKILL.template.ejs" format = "ejs" }>
+  <ResourceMappings { href = "vfs://./resource-mappings.xnl" format = "xnl" }>
+  <Includes [
+    <Include { kind = "WikiPage" ref = "resource://Halfcode.ResourceDsl.Wiki.index" }>
+    <Include { kind = "WikiPage" ref = "resource://Halfcode.ResourceDsl.Wiki.language" }>
+    <Include { kind = "WikiPage" ref = "resource://Halfcode.ResourceDsl.Wiki.documents" }>
+    <Include { kind = "WikiPage" ref = "resource://Halfcode.ResourceDsl.Wiki.files" }>
+    <Include { kind = "WikiPage" ref = "resource://Halfcode.ResourceDsl.Wiki.projections" }>
+    <Include { kind = "WikiPage" ref = "resource://Halfcode.ResourceDsl.Wiki.skill-capsules" }>
+    <Include { kind = "WikiPage" ref = "resource://Halfcode.ResourceDsl.Wiki.migration" }>
+  ]>
+)>

package/dist/system-skills/resource-dsl/SkillCapsules/System/resource-mappings.xnl

@@ -0,0 +1,10 @@
+<ResourceMappings #Halfcode.ResourceDsl.ResourceMappings.System apiVersion="halfcode.resources/v1" version="1.0.0" (
+  <ReferenceTargets [
+    <ReferenceTarget { kind = "WikiPage" target = "references/resource-dsl/" }>
+  ]>
+  <SourceRoots [
+    <SourceRoot #CanonicalExamples { sourceRoot = "vfs://module/ResourceDsl/" } [
+      <CopyDirectory { from = "examples" to = "references/resource-dsl/examples" }>
+    ]>
+  ]>
+)>

package/dist/system-skills/resource-dsl/WikiPages/documents/manifest.xnl

@@ -0,0 +1,6 @@
+<WikiPage #Halfcode.ResourceDsl.Wiki.documents apiVersion="halfcode.resources/v1" version="1.0.0" {
+  lifecycle = "Stable"
+  description = "Resource documents, package catalogs and KindDefinition contracts."
+} (
+  <Instruction { href = "vfs://@/documents.md" format = "markdown" }>
+)>

package/dist/system-skills/resource-dsl/WikiPages/files/manifest.xnl

@@ -0,0 +1,6 @@
+<WikiPage #Halfcode.ResourceDsl.Wiki.files apiVersion="halfcode.resources/v1" version="1.0.0" {
+  lifecycle = "Stable"
+  description = "Resource source shapes, VFS containment and file provenance."
+} (
+  <Instruction { href = "vfs://@/files.md" format = "markdown" }>
+)>

package/dist/system-skills/resource-dsl/WikiPages/index/manifest.xnl

@@ -0,0 +1,6 @@
+<WikiPage #Halfcode.ResourceDsl.Wiki.index apiVersion="halfcode.resources/v1" version="1.0.0" {
+  lifecycle = "Stable"
+  description = "Resource DSL overview and progressive documentation index."
+} (
+  <Instruction { href = "vfs://@/index.md" format = "markdown" }>
+)>

package/dist/system-skills/resource-dsl/WikiPages/language/manifest.xnl

@@ -0,0 +1,6 @@
+<WikiPage #Halfcode.ResourceDsl.Wiki.language apiVersion="halfcode.resources/v1" version="1.0.0" {
+  lifecycle = "Stable"
+  description = "XNL language channels and authority projection rules."
+} (
+  <Instruction { href = "vfs://@/language.md" format = "markdown" }>
+)>

package/dist/system-skills/resource-dsl/WikiPages/migration/manifest.xnl

@@ -0,0 +1,6 @@
+<WikiPage #Halfcode.ResourceDsl.Wiki.migration apiVersion="halfcode.resources/v1" version="1.0.0" {
+  lifecycle = "Stable"
+  description = "Migration guidance from non-canonical resource representations."
+} (
+  <Instruction { href = "vfs://@/migration.md" format = "markdown" }>
+)>

package/dist/system-skills/resource-dsl/WikiPages/projections/manifest.xnl

@@ -0,0 +1,6 @@
+<WikiPage #Halfcode.ResourceDsl.Wiki.projections apiVersion="halfcode.resources/v1" version="1.0.0" {
+  lifecycle = "Stable"
+  description = "Normalized, layered, content identity and dependency snapshot projections."
+} (
+  <Instruction { href = "vfs://@/projections.md" format = "markdown" }>
+)>

package/dist/system-skills/resource-dsl/WikiPages/skill-capsules/manifest.xnl

@@ -0,0 +1,6 @@
+<WikiPage #Halfcode.ResourceDsl.Wiki.skill-capsules apiVersion="halfcode.resources/v1" version="1.0.0" {
+  lifecycle = "Stable"
+  description = "SkillCapsule dependencies, deterministic plans and atomic distribution."
+} (
+  <Instruction { href = "vfs://@/skill-capsules.md" format = "markdown" }>
+)>