halfcode-compiler.xnl 0.2.8 → 0.3.0

package/dist/{src-D3qSzGFn.js → src-jggOQtq3.js}

@@ -1,8 +1,92 @@
 import { n as wordToString, t as parseXnl } from "./dist-Bkv7YeVi.js";
-import { lstat, readFile, readdir, realpath, stat } from "node:fs/promises";
-import { dirname, extname, isAbsolute, join, relative, resolve, sep } from "node:path";
+import { lstat, readFile, readdir, realpath } from "node:fs/promises";
+import path from "node:path";
 import { parse } from "yaml";
 import { createHash } from "node:crypto";
+//#region ../resource-core/src/resource-package-read-port.ts
+var ResourcePackageSourcePathError = class extends TypeError {
+	constructor(message) {
+		super(message);
+		this.name = "ResourcePackageSourcePathError";
+	}
+};
+function canonicalResourcePackageSourcePath(input) {
+	if (!input.startsWith("/")) throw new ResourcePackageSourcePathError("ResourcePackage source paths must be POSIX absolute");
+	if (input.includes("\\") || input.includes("\0")) throw new ResourcePackageSourcePathError("ResourcePackage source paths must not contain backslashes or NUL");
+	if (input === "/") return input;
+	if (input.endsWith("/") || input.includes("//")) throw new ResourcePackageSourcePathError("ResourcePackage source paths must not contain empty segments");
+	const segments = input.slice(1).split("/");
+	if (segments.some((segment) => segment === "." || segment === ".." || segment.length === 0)) throw new ResourcePackageSourcePathError("ResourcePackage source paths must not contain dot segments");
+	return `/${segments.join("/")}`;
+}
+function joinResourcePackageSourcePath(base, ...segments) {
+	const canonicalBase = canonicalResourcePackageSourcePath(base);
+	const additions = [];
+	for (const segment of segments) {
+		if (!segment || segment === "." || segment === ".." || segment.includes("/") || segment.includes("\\") || segment.includes("\0")) throw new ResourcePackageSourcePathError("ResourcePackage source path segments must be plain names");
+		additions.push(segment);
+	}
+	if (additions.length === 0) return canonicalBase;
+	return canonicalBase === "/" ? `/${additions.join("/")}` : `${canonicalBase}/${additions.join("/")}`;
+}
+function dirnameResourcePackageSourcePath(sourcePath) {
+	const canonical = canonicalResourcePackageSourcePath(sourcePath);
+	if (canonical === "/") return canonical;
+	const boundary = canonical.lastIndexOf("/");
+	return boundary === 0 ? "/" : canonical.slice(0, boundary);
+}
+function relativeResourcePackageSourcePath(rootPath, sourcePath) {
+	const root = canonicalResourcePackageSourcePath(rootPath);
+	const source = canonicalResourcePackageSourcePath(sourcePath);
+	if (source === root) return "";
+	const prefix = root === "/" ? "/" : `${root}/`;
+	return source.startsWith(prefix) ? source.slice(prefix.length) : void 0;
+}
+//#endregion
+//#region ../resource-core/src/directory-resource-package-read-port.ts
+function entryKind(entry) {
+	if (entry.isSymbolicLink()) return "symlink";
+	if (entry.isFile()) return "file";
+	if (entry.isDirectory()) return "directory";
+	return "other";
+}
+async function createDirectoryResourcePackageReadPort(rootDir) {
+	const requestedRoot = path.resolve(rootDir);
+	const boundary = await realpath(requestedRoot).catch(() => requestedRoot);
+	const lexicalPhysicalPath = (sourcePath) => {
+		const relative = relativeResourcePackageSourcePath("/", canonicalResourcePackageSourcePath(sourcePath));
+		if (relative === void 0) throw new TypeError("ResourcePackage source path is outside the directory port");
+		return path.resolve(boundary, relative);
+	};
+	const containedRealPath = async (sourcePath) => {
+		const candidate = lexicalPhysicalPath(sourcePath);
+		const resolved = await realpath(candidate).catch(() => void 0);
+		if (!resolved) return void 0;
+		if (resolved !== boundary && !resolved.startsWith(`${boundary}${path.sep}`)) return void 0;
+		return resolved;
+	};
+	return Object.freeze({
+		async stat(sourcePath) {
+			const candidate = lexicalPhysicalPath(sourcePath);
+			const info = await lstat(candidate).catch(() => void 0);
+			return info ? Object.freeze({ kind: entryKind(info) }) : void 0;
+		},
+		async readDirectory(sourcePath) {
+			const resolved = await containedRealPath(sourcePath);
+			if (!resolved) return void 0;
+			return (await readdir(resolved, { withFileTypes: true }).catch(() => void 0))?.map((entry) => Object.freeze({
+				name: entry.name,
+				kind: entryKind(entry)
+			}));
+		},
+		async readBytes(sourcePath) {
+			const resolved = await containedRealPath(sourcePath);
+			if (!resolved) return void 0;
+			return readFile(resolved).catch(() => void 0);
+		}
+	});
+}
+//#endregion
 //#region ../resource-core/src/canonical.ts
 function compareCodeUnits(left, right) {
 	if (left < right) return -1;
@@ -362,14 +446,14 @@ function contentLocation(resourceId, key) {
 	return `content:${resourceId || "unnamed"}${key === void 0 ? "" : `:${key}`}`;
 }
 //#endregion
-//#region ../resource-core/src/loaded-resource-tree-brand.ts
-const authenticLoadedResourceTrees = /* @__PURE__ */ new WeakSet();
-function markLoadedResourceTreeAuthentic(tree) {
-	authenticLoadedResourceTrees.add(tree);
+//#region ../resource-core/src/authored-resource-tree-brand.ts
+const authenticAuthoredResourceTrees = /* @__PURE__ */ new WeakSet();
+function markAuthoredResourceTreeAuthentic(tree) {
+	authenticAuthoredResourceTrees.add(tree);
 	return tree;
 }
-function isLoadedResourceTreeAuthentic(tree) {
-	return authenticLoadedResourceTrees.has(tree);
+function isAuthoredResourceTreeAuthentic(tree) {
+	return authenticAuthoredResourceTrees.has(tree);
 }
 //#endregion
 //#region ../resource-core/src/readonly-map.ts
@@ -404,11 +488,148 @@ function readonlyMap(entries) {
 	});
 }
 //#endregion
+//#region ../resource-core/src/resource-version-contracts.ts
+const RESOURCE_ENVELOPE_VERSION = "halfcode.resource-envelope/v1";
+const CORE_BOOTSTRAP_WRITER_SPEC_VERSIONS = Object.freeze({
+	ResourcePackage: 1,
+	KindDefinition: 1
+});
+/**
+* Canonical, compiler-owned facts enforced by the v1 resource-envelope decoder.
+* Consumers may fingerprint this descriptor, but must not restate it.
+*/
+const RESOURCE_ENVELOPE_CONTRACT = Object.freeze({
+	envelopeVersion: RESOURCE_ENVELOPE_VERSION,
+	requiredFields: Object.freeze(["envelopeVersion", "specVersion"]),
+	optionalFields: Object.freeze(["lifecycle"]),
+	removedFields: Object.freeze(["apiVersion", "version"]),
+	removedFieldScopes: Object.freeze(["resource-root", "metadata"]),
+	specVersion: Object.freeze({
+		type: "integer",
+		minimum: 1,
+		maximum: Number.MAX_SAFE_INTEGER
+	}),
+	lifecycle: Object.freeze({ type: "string" }),
+	outputFields: Object.freeze([
+		"envelopeVersion",
+		"specVersion",
+		"lifecycle"
+	]),
+	bootstrapKinds: Object.freeze({
+		ResourcePackage: Object.freeze({ writerSpecVersion: CORE_BOOTSTRAP_WRITER_SPEC_VERSIONS.ResourcePackage }),
+		KindDefinition: Object.freeze({ writerSpecVersion: CORE_BOOTSTRAP_WRITER_SPEC_VERSIONS.KindDefinition })
+	}),
+	catalogTraversal: Object.freeze({
+		authority: "resource-envelope",
+		containerTag: "Catalogs",
+		entryTags: Object.freeze([
+			"Catalog",
+			"FileResourceCatalog",
+			"DirectoryResourceCatalog",
+			"ManifestResourceCatalog"
+		]),
+		sourceShapes: Object.freeze([
+			"single-file",
+			"directory",
+			"manifest"
+		]),
+		shapeFields: Object.freeze([
+			"kind",
+			"shape",
+			"root",
+			"entry",
+			"scope"
+		]),
+		phase: "authored-load-before-business-resolution"
+	}),
+	authorityFormats: Object.freeze({
+		packageManifest: "xnl",
+		resourceDocuments: Object.freeze(["xnl", "markdown"]),
+		markdownFrontmatter: "yaml",
+		markdownBody: "all-source-text-after-closing-frontmatter-and-one-separator-newline"
+	}),
+	identityProjection: Object.freeze({
+		xnl: "root-#id",
+		markdown: "frontmatter-metadata.fqn",
+		recordFields: Object.freeze(["resourceId", "fqn"])
+	}),
+	authoredSpecProjection: Object.freeze({
+		fields: Object.freeze([
+			"properties",
+			"body",
+			"subdomains",
+			"text"
+		]),
+		resourceMetadataExcluded: true,
+		markdownBodyField: "text"
+	})
+});
+const RESOURCE_ENVELOPE_FINGERPRINT = digestCanonical(RESOURCE_ENVELOPE_CONTRACT);
+function isSpecVersion(value) {
+	return typeof value === "number" && Number.isSafeInteger(value) && value > 0;
+}
+//#endregion
+//#region ../resource-core/src/resource-envelope.ts
+function decodeResourceMetadata(input) {
+	if ([input.fields, ...input.removedFieldContainers ?? []].some((container) => hasOwn(container, "apiVersion") || hasOwn(container, "version"))) return failure("RESOURCE_METADATA_FIELD_REMOVED", input, `${input.source} resources must not declare removed apiVersion or version metadata.`);
+	if (!hasOwn(input.fields, "envelopeVersion") || !hasOwn(input.fields, "specVersion")) return failure("RESOURCE_METADATA_FIELD_MISSING", input, `${input.source} resources require envelopeVersion and specVersion.`);
+	const envelopeVersion = input.fields.envelopeVersion;
+	if (typeof envelopeVersion !== "string" || envelopeVersion !== "halfcode.resource-envelope/v1") return failure("RESOURCE_ENVELOPE_VERSION_UNSUPPORTED", input, `${input.source} resource envelopeVersion must be '${RESOURCE_ENVELOPE_VERSION}'.`);
+	if (!isSpecVersion(input.fields.specVersion)) return failure("RESOURCE_SPEC_VERSION_INVALID", input, `${input.source} resource specVersion must be a positive safe integer.`);
+	if (input.lifecycle !== void 0 && typeof input.lifecycle !== "string") return failure("RESOURCE_METADATA_FIELD_INVALID", input, `${input.source} resource lifecycle must be a string when present.`);
+	return Object.freeze({ metadata: Object.freeze({
+		envelopeVersion,
+		specVersion: input.fields.specVersion,
+		...input.lifecycle === void 0 ? {} : { lifecycle: input.lifecycle }
+	}) });
+}
+function failure(code, input, message) {
+	return Object.freeze({ diagnostic: Object.freeze({
+		code,
+		location: input.location,
+		message
+	}) });
+}
+function hasOwn(value, key) {
+	return Object.prototype.hasOwnProperty.call(value, key);
+}
+//#endregion
 //#region ../resource-core/src/xnl-loader.ts
+async function safeStat(port, sourcePath) {
+	try {
+		return await port.stat(sourcePath);
+	} catch {
+		return;
+	}
+}
+async function safeReadDirectory(port, sourcePath) {
+	try {
+		return await port.readDirectory(sourcePath);
+	} catch {
+		return;
+	}
+}
+async function safeReadBytes(port, sourcePath) {
+	try {
+		return await port.readBytes(sourcePath);
+	} catch {
+		return;
+	}
+}
 async function buildXnlResourceTree(options) {
-	const requestedRoot = resolve(options.rootDir);
+	let rootPath;
+	try {
+		rootPath = canonicalResourcePackageSourcePath(options.rootPath);
+	} catch {
+		return { diagnostics: [{
+			code: "RESOURCE_SOURCE_PATH_INVALID",
+			location: "vfs://@/",
+			message: "ResourcePackage read-port rootPath must be canonical POSIX absolute."
+		}] };
+	}
 	const context = {
-		rootDir: await realpath(requestedRoot).catch(() => requestedRoot),
+		rootPath,
+		port: options.port,
 		diagnostics: [],
 		kindDefinitions: /* @__PURE__ */ new Map(),
 		resources: [],
@@ -417,7 +638,13 @@ async function buildXnlResourceTree(options) {
 		recordAuthorityDigests: /* @__PURE__ */ new WeakMap(),
 		recordContributions: /* @__PURE__ */ new WeakMap()
 	};
-	const manifest = await loadManifest(resolve(context.rootDir, options.manifestPath), "manifest", context, true);
+	const manifestFile = resolvePackageRelativePath(context.rootPath, options.manifestPath);
+	if (!manifestFile) return { diagnostics: [{
+		code: "RESOURCE_SOURCE_PATH_INVALID",
+		location: `vfs://@/${options.manifestPath}`,
+		message: "ResourcePackage manifestPath must be a canonical package-relative file path."
+	}] };
+	const manifest = await loadManifest(manifestFile, "manifest", context, true);
 	if (!manifest || context.diagnostics.length > 0) return { diagnostics: context.diagnostics };
 	const byKind = /* @__PURE__ */ new Map();
 	for (const resource of context.resources) {
@@ -430,7 +657,8 @@ async function buildXnlResourceTree(options) {
 	const contentIdentities = readonlyMap(context.resources.map((resource) => [resource.resourceId, loadedContentIdentity(resource, context)]).sort(([left], [right]) => compareCodeUnits(left, right)));
 	return {
 		diagnostics: [],
-		tree: markLoadedResourceTreeAuthentic(Object.freeze({
+		tree: markAuthoredResourceTreeAuthentic(Object.freeze({
+			stage: "authored",
 			manifest,
 			registry: Object.freeze({
 				byKind: frozenByKind,
@@ -442,10 +670,18 @@ async function buildXnlResourceTree(options) {
 	};
 }
 async function loadManifest(filePath, sourceShape, context, isRoot) {
-	const record = await loadXnlRecord(filePath, sourceShape, context);
+	let record = await loadXnlRecord(filePath, sourceShape, context);
 	if (!record) return void 0;
+	if (isRoot && record.kind === "ResourcePackage" && record.metadata.specVersion !== CORE_BOOTSTRAP_WRITER_SPEC_VERSIONS.ResourcePackage) {
+		context.diagnostics.push({
+			code: "CORE_RESOURCE_SPEC_VERSION_UNSUPPORTED",
+			location: record.documentUri,
+			message: `ResourcePackage bootstrap only admits writer specVersion ${CORE_BOOTSTRAP_WRITER_SPEC_VERSIONS.ResourcePackage}; received ${record.metadata.specVersion}.`
+		});
+		return;
+	}
 	const catalogs = readCatalogs(record, context.diagnostics);
-	for (const catalog of catalogs.filter((item) => item.kind === "KindDefinition")) await loadKindDefinitions(catalog, dirname(filePath), context);
+	for (const catalog of catalogs.filter((item) => item.kind === "KindDefinition")) await loadKindDefinitions(catalog, dirnameResourcePackageSourcePath(filePath), context);
 	if (isRoot && record.kind !== "ResourcePackage") {
 		const definition = context.kindDefinitions.get(record.kind);
 		if (!definition) {
@@ -464,12 +700,13 @@ async function loadManifest(filePath, sourceShape, context, isRoot) {
 			});
 			return;
 		}
-		validateResourceApiVersion(record, definition, context.diagnostics);
-		await validateRequiredFiles(dirname(filePath), record, definition, context.diagnostics);
+		record = bindSubject(record, definition.subjectFqn, context);
+		await validateRequiredFiles(dirnameResourcePackageSourcePath(filePath), record, definition, context);
 		validateIdentity(record, context);
 		context.resources.push(record);
 	}
-	for (const catalog of catalogs.filter((item) => item.kind !== "KindDefinition")) await loadCatalog(catalog, dirname(filePath), context);
+	if (isRoot && record.kind === "ResourcePackage") record = bindSubject(record, "Halfcode.ResourceKind.ResourcePackage", context);
+	for (const catalog of catalogs.filter((item) => item.kind !== "KindDefinition")) await loadCatalog(catalog, dirnameResourcePackageSourcePath(filePath), context);
 	if (!isRoot) {
 		validateIdentity(record, context);
 		context.resources.push(record);
@@ -488,6 +725,9 @@ async function loadKindDefinitions(catalog, manifestDir, context) {
 		const definition = normalizeKindDefinition(record, context.diagnostics);
 		if (!definition) continue;
 		context.kindDefinitions.set(definition.resourceKind, definition);
+		const authoredDefinition = bindSubject(record, "Halfcode.ResourceKind.KindDefinition", context);
+		validateIdentity(authoredDefinition, context);
+		context.resources.push(authoredDefinition);
 	}
 }
 async function loadCatalog(catalog, manifestDir, context) {
@@ -511,18 +751,18 @@ async function loadCatalog(catalog, manifestDir, context) {
 	const files = await catalogFiles(catalog, manifestDir, context);
 	for (const file of files) {
 		if (catalog.shape === "manifest") {
-			const record = await loadXnlRecord(file, "manifest", context);
+			let record = await loadXnlRecord(file, "manifest", context);
 			if (!record) continue;
 			if (record.kind !== catalog.kind) {
 				context.diagnostics.push(kindMismatch(record.kind, catalog.kind, record.documentUri));
 				continue;
 			}
-			validateResourceApiVersion(record, definition, context.diagnostics);
-			await validateRequiredFiles(dirname(file), record, definition, context.diagnostics);
+			record = bindSubject(record, definition.subjectFqn, context);
+			await validateRequiredFiles(dirnameResourcePackageSourcePath(file), record, definition, context);
 			validateIdentity(record, context);
 			context.resources.push(record);
 			const catalogs = readCatalogs(record, context.diagnostics);
-			for (const nested of catalogs.filter((item) => item.kind !== "KindDefinition")) await loadCatalog(nested, dirname(file), context);
+			for (const nested of catalogs.filter((item) => item.kind !== "KindDefinition")) await loadCatalog(nested, dirnameResourcePackageSourcePath(file), context);
 			continue;
 		}
 		if (definition.documentCardinality === "many" && catalog.shape !== "single-file") {
@@ -534,22 +774,34 @@ async function loadCatalog(catalog, manifestDir, context) {
 			continue;
 		}
 		const records = await loadResourceRecords(file, catalog.shape, context, definition.documentCardinality);
-		for (const record of records) {
+		for (let record of records) {
 			if (record.kind !== catalog.kind) {
 				context.diagnostics.push(kindMismatch(record.kind, catalog.kind, record.documentUri));
 				continue;
 			}
-			validateResourceApiVersion(record, definition, context.diagnostics);
-			await validateRequiredFiles(dirname(file), record, definition, context.diagnostics);
+			record = bindSubject(record, definition.subjectFqn, context);
+			await validateRequiredFiles(dirnameResourcePackageSourcePath(file), record, definition, context);
 			validateIdentity(record, context);
 			context.resources.push(record);
 		}
 	}
 }
+function bindSubject(record, subjectFqn, context) {
+	if (record.subjectFqn === subjectFqn) return record;
+	const bound = Object.freeze({
+		...record,
+		subjectFqn
+	});
+	const authorityDigest = context.recordAuthorityDigests.get(record);
+	if (authorityDigest) context.recordAuthorityDigests.set(bound, authorityDigest);
+	const contributions = context.recordContributions.get(record);
+	if (contributions) context.recordContributions.set(bound, contributions);
+	return bound;
+}
 async function catalogFiles(catalog, manifestDir, context) {
 	const root = await resolveCatalogDirectory(catalog.root, manifestDir, catalog.location, context);
 	if (!root) return [];
-	const entries = await readdir(root, { withFileTypes: true }).catch(() => void 0);
+	const entries = await safeReadDirectory(context.port, root);
 	if (!entries) {
 		context.diagnostics.push({
 			code: "RESOURCE_CATALOG_ROOT_MISSING",
@@ -558,6 +810,18 @@ async function catalogFiles(catalog, manifestDir, context) {
 		});
 		return [];
 	}
+	const entryNames = /* @__PURE__ */ new Set();
+	for (const entry of entries) {
+		if (!entry || typeof entry.name !== "string" || !isPlainSourceEntryName(entry.name) || !isResourcePackageEntryKind(entry.kind) || entryNames.has(entry.name)) {
+			context.diagnostics.push({
+				code: "RESOURCE_SOURCE_ENTRY_INVALID",
+				location: catalog.location,
+				message: "ResourcePackage read port returned a non-canonical or duplicate directory entry."
+			});
+			return [];
+		}
+		entryNames.add(entry.name);
+	}
 	if (catalog.shape === "single-file") {
 		if (catalog.entry) {
 			if (!isPlainEntry(catalog.entry) || !isSingleFileExtension(catalog.entry)) {
@@ -568,9 +832,9 @@ async function catalogFiles(catalog, manifestDir, context) {
 				});
 				return [];
 			}
-			return [join(root, catalog.entry)];
+			return [joinResourcePackageSourcePath(root, catalog.entry)];
 		}
-		return entries.filter((entry) => entry.isFile() && isSingleFileExtension(entry.name)).sort((left, right) => compareCodeUnits(left.name, right.name)).map((entry) => join(root, entry.name));
+		return entries.filter((entry) => entry.kind === "file" && isSingleFileExtension(entry.name)).sort((left, right) => compareCodeUnits(left.name, right.name)).map((entry) => joinResourcePackageSourcePath(root, entry.name));
 	}
 	if (!catalog.entry || !isPlainEntry(catalog.entry)) {
 		context.diagnostics.push({
@@ -581,33 +845,30 @@ async function catalogFiles(catalog, manifestDir, context) {
 		return [];
 	}
 	if (catalog.shape === "directory" && catalog.scope === "root") {
-		const directEntry = join(root, catalog.entry);
-		const directStat = await lstat(directEntry).catch((error) => {
-			if (error.code === "ENOENT") return void 0;
-			throw error;
-		});
+		const directEntry = joinResourcePackageSourcePath(root, catalog.entry);
+		const directStat = await safeStat(context.port, directEntry);
 		if (!directStat) return [directEntry];
-		if (directStat.isSymbolicLink() || !directStat.isFile()) {
+		if (directStat.kind !== "file") {
 			context.diagnostics.push({
 				code: "RESOURCE_CATALOG_ENTRY_INVALID",
-				location: documentUriFor(context.rootDir, directEntry),
+				location: documentUriFor(context.rootPath, directEntry),
 				message: "A root-scoped directory catalog entry must be a regular non-symbolic-link XNL file."
 			});
 			return [];
 		}
 		return [directEntry];
 	}
-	return entries.filter((entry) => entry.isDirectory()).sort((left, right) => compareCodeUnits(left.name, right.name)).map((entry) => join(root, entry.name, catalog.entry));
+	return entries.filter((entry) => entry.kind === "directory").sort((left, right) => compareCodeUnits(left.name, right.name)).map((entry) => joinResourcePackageSourcePath(root, entry.name, catalog.entry));
 }
 async function loadXnlRecord(filePath, sourceShape, context) {
 	return (await loadXnlRecords(filePath, sourceShape, context, "one"))[0];
 }
 async function loadResourceRecords(filePath, sourceShape, context, documentCardinality) {
-	if (extname(filePath).toLowerCase() !== ".md") return loadXnlRecords(filePath, sourceShape, context, documentCardinality);
+	if (!filePath.toLowerCase().endsWith(".md")) return loadXnlRecords(filePath, sourceShape, context, documentCardinality);
 	if (sourceShape !== "single-file" || documentCardinality !== "one") {
 		context.diagnostics.push({
 			code: "RESOURCE_MARKDOWN_SOURCE_SHAPE_INVALID",
-			location: documentUriFor(context.rootDir, filePath),
+			location: documentUriFor(context.rootPath, filePath),
 			message: "Markdown resource authority requires a single-file catalog with documentCardinality one."
 		});
 		return [];
@@ -616,7 +877,7 @@ async function loadResourceRecords(filePath, sourceShape, context, documentCardi
 	return record ? [record] : [];
 }
 async function loadMarkdownRecord(filePath, context) {
-	const documentUri = documentUriFor(context.rootDir, filePath);
+	const documentUri = documentUriFor(context.rootPath, filePath);
 	const authority = await readAuthorityFile(filePath, documentUri, context);
 	if (!authority) return void 0;
 	const match = /^---\r?\n([\s\S]*?)\r?\n---(?:\r?\n|$)/u.exec(authority.source);
@@ -650,17 +911,27 @@ async function loadMarkdownRecord(filePath, context) {
 	const metadataValue = parsed.metadata;
 	const specValue = parsed.spec;
 	const kind = stringField(parsed.kind);
-	const apiVersion = stringField(parsed.apiVersion);
 	const metadataObject = isPlainObject(metadataValue) ? metadataValue : void 0;
 	const resourceId = metadataObject ? stringField(metadataObject.fqn) : void 0;
-	if (!kind || !apiVersion || !resourceId || specValue !== void 0 && !isPlainObject(specValue)) {
+	if (!kind || !resourceId || specValue !== void 0 && !isPlainObject(specValue)) {
 		context.diagnostics.push({
 			code: "RESOURCE_MARKDOWN_METADATA_INVALID",
 			location: documentUri,
-			message: "Markdown resource frontmatter requires apiVersion, kind, metadata.fqn and an optional object spec."
+			message: "Markdown resource frontmatter requires kind, metadata.fqn and an optional object spec."
 		});
 		return;
 	}
+	const decoded = decodeResourceMetadata({
+		fields: parsed,
+		removedFieldContainers: metadataObject ? [metadataObject] : [],
+		lifecycle: metadataObject?.lifecycle,
+		location: documentUri,
+		source: "Markdown"
+	});
+	if ("diagnostic" in decoded) {
+		context.diagnostics.push(decoded.diagnostic);
+		return;
+	}
 	let properties;
 	try {
 		properties = Object.freeze(normalizeExternalMap(specValue ?? {}));
@@ -672,34 +943,33 @@ async function loadMarkdownRecord(filePath, context) {
 		});
 		return;
 	}
-	const version = metadataObject ? stringField(metadataObject.version) : void 0;
-	const lifecycle = metadataObject ? stringField(metadataObject.lifecycle) : void 0;
 	const name = metadataObject ? stringField(metadataObject.name) : void 0;
 	const description = stringField(properties.description);
 	const node = Object.freeze({
 		tag: kind,
 		resourceId,
 		metadata: Object.freeze({
-			apiVersion,
-			...version ? { version } : {}
+			envelopeVersion: decoded.metadata.envelopeVersion,
+			specVersion: decoded.metadata.specVersion
 		}),
 		properties,
 		body: Object.freeze([]),
-		subdomains: Object.freeze({})
+		subdomains: Object.freeze({}),
+		text: authority.source.slice(match[0].length)
 	});
 	const record = Object.freeze({
+		stage: "authored",
 		kind,
+		subjectFqn: kind,
 		resourceId,
 		fqn: resourceId,
 		...name ? { name } : {},
 		...description ? { description } : {},
-		metadata: Object.freeze({
-			apiVersion,
-			...lifecycle ? { lifecycle } : {},
-			...version ? { version } : {}
-		}),
+		metadata: decoded.metadata,
+		authoredSpec: authoredSpecFromNode(node),
+		sourceContentDigest: authority.authorityDigest,
 		sourceShape: "single-file",
-		logicalPath: relative(context.rootDir, filePath).split(sep).join("/"),
+		logicalPath: logicalPathFor(context.rootPath, filePath),
 		documentUri,
 		format: "markdown",
 		node
@@ -708,7 +978,7 @@ async function loadMarkdownRecord(filePath, context) {
 	return record;
 }
 async function loadXnlRecords(filePath, sourceShape, context, documentCardinality) {
-	const documentUri = documentUriFor(context.rootDir, filePath);
+	const documentUri = documentUriFor(context.rootPath, filePath);
 	const authority = await readAuthorityFile(filePath, documentUri, context);
 	if (!authority) return [];
 	let roots;
@@ -740,16 +1010,24 @@ async function loadXnlRecords(filePath, sourceShape, context, documentCardinalit
 		return [];
 	}
 	return roots.flatMap((root) => {
-		const record = resourceRecordFromRoot(root, filePath, sourceShape, context);
+		const record = resourceRecordFromRoot(root, filePath, sourceShape, authority.authorityDigest, context);
 		if (record) context.recordAuthorityDigests.set(record, authority.authorityDigest);
 		return record ? [record] : [];
 	});
 }
 async function readAuthorityFile(filePath, documentUri, context) {
-	const canonicalPath = resolve(filePath);
+	const canonicalPath = canonicalResourcePackageSourcePath(filePath);
 	let pending = context.authorityFiles.get(canonicalPath);
 	if (!pending) {
-		pending = readFile(canonicalPath).then((bytes) => {
+		pending = safeReadBytes(context.port, canonicalPath).then((bytes) => {
+			if (!bytes) {
+				context.diagnostics.push({
+					code: "RESOURCE_FILE_MISSING",
+					location: documentUri,
+					message: "Resource file does not exist."
+				});
+				return;
+			}
 			try {
 				return Object.freeze({
 					source: new TextDecoder("utf-8", { fatal: true }).decode(bytes),
@@ -783,36 +1061,38 @@ function loadedContentIdentity(resource, context) {
 		contributions: context.recordContributions.get(resource) ?? []
 	});
 }
-function resourceRecordFromRoot(root, filePath, sourceShape, context) {
-	const documentUri = documentUriFor(context.rootDir, filePath);
+function resourceRecordFromRoot(root, filePath, sourceShape, sourceContentDigest, context) {
+	const documentUri = documentUriFor(context.rootPath, filePath);
 	const node = normalizeNode(root);
 	const resourceId = node.resourceId;
-	const apiVersion = asString(node.metadata.apiVersion);
-	const lifecycle = asString(node.properties.lifecycle);
 	const description = asString(node.properties.description) ?? node.subdomains.Description?.text;
 	if (!resourceId) context.diagnostics.push({
 		code: "RESOURCE_IDENTITY_MISSING",
 		location: documentUri,
 		message: "XNL resource roots must declare a #id."
 	});
-	if (!apiVersion) context.diagnostics.push({
-		code: "RESOURCE_METADATA_FIELD_MISSING",
+	if (!resourceId) return void 0;
+	const decoded = decodeResourceMetadata({
+		fields: node.metadata,
+		lifecycle: node.properties.lifecycle,
 		location: documentUri,
-		message: "XNL resources require metadata apiVersion."
-	});
-	if (!resourceId || !apiVersion) return void 0;
-	const metadata = Object.freeze({
-		apiVersion,
-		...lifecycle ? { lifecycle } : {},
-		version: asString(node.metadata.version)
+		source: "XNL"
 	});
-	const logicalPath = relative(context.rootDir, filePath).split(sep).join("/");
+	if ("diagnostic" in decoded) {
+		context.diagnostics.push(decoded.diagnostic);
+		return;
+	}
+	const logicalPath = logicalPathFor(context.rootPath, filePath);
 	return Object.freeze({
+		stage: "authored",
 		kind: node.tag,
+		subjectFqn: node.tag,
 		resourceId,
 		fqn: resourceId,
 		...description ? { description } : {},
-		metadata,
+		metadata: decoded.metadata,
+		authoredSpec: authoredSpecFromNode(node),
+		sourceContentDigest,
 		sourceShape,
 		logicalPath,
 		documentUri,
@@ -820,6 +1100,14 @@ function resourceRecordFromRoot(root, filePath, sourceShape, context) {
 		node
 	});
 }
+function authoredSpecFromNode(node) {
+	return Object.freeze({
+		properties: node.properties,
+		body: node.body,
+		subdomains: node.subdomains,
+		...node.text === void 0 ? {} : { text: node.text }
+	});
+}
 function normalizeNode(node) {
 	const subdomains = {};
 	if (node.kind === "DataElement" && node.extend) for (const name of node.extend.order) {
@@ -894,69 +1182,127 @@ function catalogShapeForTag(tag) {
 	if (tag === "ManifestResourceCatalog") return "manifest";
 }
 function normalizeKindDefinition(record, diagnostics) {
+	if (record.metadata.specVersion !== CORE_BOOTSTRAP_WRITER_SPEC_VERSIONS.KindDefinition) {
+		diagnostics.push({
+			code: "CORE_RESOURCE_SPEC_VERSION_UNSUPPORTED",
+			location: record.documentUri,
+			message: `KindDefinition bootstrap only admits writer specVersion ${CORE_BOOTSTRAP_WRITER_SPEC_VERSIONS.KindDefinition}; received ${record.metadata.specVersion}.`
+		});
+		return;
+	}
+	if (Object.prototype.hasOwnProperty.call(record.node.properties, "currentApiVersion") || Object.prototype.hasOwnProperty.call(record.node.properties, "supportedApiVersions") || Object.prototype.hasOwnProperty.call(record.node.properties, "currentSpecVersion") || Object.prototype.hasOwnProperty.call(record.node.properties, "supportedSpecVersions")) {
+		diagnostics.push({
+			code: "KIND_DEFINITION_VERSION_FIELDS_REMOVED",
+			location: record.documentUri,
+			message: "KindDefinition must not declare current/supported API or spec version fields; declare exact SpecRevisions instead."
+		});
+		return;
+	}
 	const resourceKind = asString(record.node.properties.resourceKind) ?? record.resourceId.split(".").at(-1);
+	const subjectFqn = asString(record.node.properties.subjectFqn);
 	const shapes = record.node.properties.sourceShapes;
-	const sourceShapes = Array.isArray(shapes) ? shapes.filter(isXnlShape) : [];
-	const currentApiVersion = asString(record.node.properties.currentApiVersion);
-	const versions = record.node.properties.supportedApiVersions;
-	const supportedApiVersions = Array.isArray(versions) ? versions.filter((value) => typeof value === "string" && Boolean(value.trim())) : [];
+	const sourceShapes = Array.isArray(shapes) ? [...new Set(shapes.filter(isXnlShape))].sort(compareCodeUnits) : [];
 	const cardinalityValue = asString(record.node.properties.documentCardinality) ?? "one";
-	if (!resourceKind || sourceShapes.length === 0 || !currentApiVersion || supportedApiVersions.length === 0 || !isDocumentCardinality(cardinalityValue)) {
+	if (!resourceKind || !subjectFqn || sourceShapes.length === 0 || !isDocumentCardinality(cardinalityValue)) {
 		diagnostics.push({
 			code: "KIND_DEFINITION_INVALID",
 			location: record.documentUri,
-			message: "KindDefinition requires resourceKind (or an id suffix), sourceShapes, currentApiVersion, and supportedApiVersions."
+			message: "KindDefinition requires resourceKind, subjectFqn, sourceShapes and one or more exact SpecRevisions."
 		});
 		return;
 	}
-	if (!supportedApiVersions.includes(currentApiVersion)) {
+	if (cardinalityValue === "many" && sourceShapes.some((shape) => shape !== "single-file")) {
 		diagnostics.push({
-			code: "KIND_DEFINITION_VERSION_INVALID",
+			code: "KIND_DEFINITION_CARDINALITY_INVALID",
 			location: record.documentUri,
-			message: `Kind '${resourceKind}' currentApiVersion '${currentApiVersion}' must be included in supportedApiVersions.`
+			message: `Kind '${resourceKind}' documentCardinality 'many' requires only the single-file source shape.`
 		});
 		return;
 	}
-	if (cardinalityValue === "many" && sourceShapes.some((shape) => shape !== "single-file")) {
+	const requiredFiles = ((record.node.subdomains.DescriptorContract?.subdomains.RequiredFiles)?.body ?? []).filter(isResourceNode).filter((node) => node.tag === "File").map((node) => asString(node.properties.name)).filter((value) => Boolean(value)).sort(compareCodeUnits);
+	const specRevisions = normalizeSpecRevisions(record, diagnostics, digestCanonical({
+		sourceShapes,
+		documentCardinality: cardinalityValue,
+		requiredFiles
+	}));
+	if (specRevisions.length === 0) {
 		diagnostics.push({
-			code: "KIND_DEFINITION_CARDINALITY_INVALID",
+			code: "KIND_DEFINITION_INVALID",
 			location: record.documentUri,
-			message: `Kind '${resourceKind}' documentCardinality 'many' requires only the single-file source shape.`
+			message: "KindDefinition requires one or more exact SpecRevisions."
 		});
 		return;
 	}
-	const requiredFiles = ((record.node.subdomains.DescriptorContract?.subdomains.RequiredFiles)?.body ?? []).filter(isResourceNode).filter((node) => node.tag === "File").map((node) => asString(node.properties.name)).filter((value) => Boolean(value));
 	return Object.freeze({
 		resourceId: record.resourceId,
 		resourceKind,
+		subjectFqn,
 		sourceShapes: Object.freeze([...sourceShapes]),
+		specRevisions,
 		requiredFiles: Object.freeze([...requiredFiles]),
-		currentApiVersion,
-		supportedApiVersions: Object.freeze([...new Set(supportedApiVersions)]),
 		documentCardinality: cardinalityValue,
 		documentUri: record.documentUri
 	});
 }
-function validateResourceApiVersion(record, definition, diagnostics) {
-	if (definition.supportedApiVersions.includes(record.metadata.apiVersion)) return;
-	diagnostics.push({
-		code: "RESOURCE_API_VERSION_UNSUPPORTED",
-		location: record.documentUri,
-		message: `Kind '${record.kind}' does not support apiVersion '${record.metadata.apiVersion}'.`,
-		hint: `Current apiVersion is '${definition.currentApiVersion}'.`
-	});
+function normalizeSpecRevisions(record, diagnostics, _sourceContractFingerprint) {
+	const node = record.node.subdomains.SpecRevisions;
+	if (!node) return Object.freeze([]);
+	const revisions = [];
+	const seen = /* @__PURE__ */ new Set();
+	for (const value of node.body) {
+		if (!isResourceNode(value) || value.tag !== "SpecRevision") continue;
+		const specVersion = value.properties.specVersion;
+		const schemaRef = asString(value.properties.schemaRef);
+		const schemaFingerprint = asSha256(value.properties.schemaFingerprint);
+		const contractFingerprint = asSha256(value.properties.contractFingerprint);
+		const semanticValidatorFingerprint = asSha256(value.properties.semanticValidatorFingerprint);
+		const referenceProjectionFingerprint = asSha256(value.properties.referenceProjectionFingerprint);
+		const compilerInputFingerprint = asSha256(value.properties.compilerInputFingerprint);
+		const stability = asString(value.properties.stability);
+		if (!isSpecVersion(specVersion) || !schemaRef || !schemaFingerprint || !contractFingerprint || !semanticValidatorFingerprint || !referenceProjectionFingerprint || !compilerInputFingerprint || !isRevisionStability(stability)) {
+			diagnostics.push({
+				code: "KIND_SPEC_REVISION_INVALID",
+				location: `${record.documentUri}#SpecRevision:${value.resourceId ?? "unknown"}`,
+				message: "SpecRevision requires a positive specVersion, schemaRef, exact schema/contract/semantic fingerprints and stability."
+			});
+			continue;
+		}
+		if (seen.has(specVersion)) {
+			diagnostics.push({
+				code: "KIND_SPEC_REVISION_CONFLICT",
+				location: `${record.documentUri}#SpecRevision:${value.resourceId ?? specVersion}`,
+				message: `KindDefinition declares specVersion ${specVersion} more than once.`
+			});
+			continue;
+		}
+		seen.add(specVersion);
+		revisions.push(Object.freeze({
+			specVersion,
+			schemaRef,
+			schemaFingerprint,
+			contractFingerprint,
+			semanticContract: Object.freeze({
+				semanticValidatorFingerprint,
+				referenceProjectionFingerprint,
+				compilerInputFingerprint
+			}),
+			stability
+		}));
+	}
+	return Object.freeze(revisions.sort((left, right) => left.specVersion - right.specVersion));
 }
-async function validateRequiredFiles(resourceDir, record, definition, diagnostics) {
+async function validateRequiredFiles(resourceDir, record, definition, context) {
 	for (const name of definition.requiredFiles) {
 		if (!isPlainEntry(name)) {
-			diagnostics.push({
+			context.diagnostics.push({
 				code: "KIND_DEFINITION_REQUIRED_FILE_INVALID",
 				location: record.documentUri,
 				message: `Invalid required file '${name}'.`
 			});
 			continue;
 		}
-		if (!await stat(join(resourceDir, name)).then((info) => info.isFile()).catch(() => false)) diagnostics.push({
+		const target = joinResourcePackageSourcePath(resourceDir, name);
+		if ((await safeStat(context.port, target))?.kind !== "file") context.diagnostics.push({
 			code: "RESOURCE_REQUIRED_FILE_MISSING",
 			location: `${record.documentUri}#${name}`,
 			message: `Resource is missing required material '${name}'.`
@@ -985,7 +1331,7 @@ async function resolveCatalogDirectory(uri, manifestDir, location, context) {
 		});
 		return;
 	}
-	if (isAbsolute(decoded) || decoded.split(/[\\/]+/).includes("..") || /%2f|%5c/i.test(rawPath)) {
+	if (decoded.startsWith("/") || /^[A-Za-z]:/u.test(decoded) || decoded.split(/[\\/]+/).includes("..") || /%2f|%5c/i.test(rawPath)) {
 		context.diagnostics.push({
 			code: "RESOURCE_REF_CONTAINMENT",
 			location,
@@ -993,11 +1339,8 @@ async function resolveCatalogDirectory(uri, manifestDir, location, context) {
 		});
 		return;
 	}
-	const base = relativeMatch[1] === "@/" ? context.rootDir : manifestDir;
-	const boundary = await realpath(context.rootDir);
-	const candidate = resolve(base, decoded);
-	const resolved = await realpath(candidate).catch(() => candidate);
-	if (resolved !== boundary && !resolved.startsWith(`${boundary}${sep}`)) {
+	const candidate = resolvePackageRelativePath(relativeMatch[1] === "@/" ? context.rootPath : manifestDir, decoded);
+	if (!candidate || relativeResourcePackageSourcePath(context.rootPath, candidate) === void 0) {
 		context.diagnostics.push({
 			code: "RESOURCE_REF_CONTAINMENT",
 			location,
@@ -1005,7 +1348,7 @@ async function resolveCatalogDirectory(uri, manifestDir, location, context) {
 		});
 		return;
 	}
-	return resolved;
+	return candidate;
 }
 function validateIdentity(record, context) {
 	const prior = context.seenIdentities.get(record.resourceId);
@@ -1020,8 +1363,13 @@ function validateIdentity(record, context) {
 	}
 	context.seenIdentities.set(record.resourceId, record.documentUri);
 }
-function documentUriFor(rootDir, filePath) {
-	return `vfs://@/${relative(rootDir, filePath).split(sep).join("/")}`;
+function logicalPathFor(rootPath, filePath) {
+	const relative = relativeResourcePackageSourcePath(rootPath, filePath);
+	if (relative === void 0) throw new TypeError("Resource source path is outside the package root");
+	return relative;
+}
+function documentUriFor(rootPath, filePath) {
+	return `vfs://@/${logicalPathFor(rootPath, filePath)}`;
 }
 function kindMismatch(actual, expected, location) {
 	return {
@@ -1039,9 +1387,25 @@ function isDocumentCardinality(value) {
 function isPlainEntry(value) {
 	return Boolean(value) && !value.includes("/") && !value.includes("\\") && !value.includes("..");
 }
+function isPlainSourceEntryName(value) {
+	return Boolean(value) && value !== "." && value !== ".." && !value.includes("/") && !value.includes("\\") && !value.includes("\0");
+}
+function isResourcePackageEntryKind(value) {
+	return value === "file" || value === "directory" || value === "symlink" || value === "other";
+}
 function isSingleFileExtension(value) {
-	const extension = extname(value).toLowerCase();
-	return extension === ".xnl" || extension === ".md";
+	const lower = value.toLowerCase();
+	return lower.endsWith(".xnl") || lower.endsWith(".md");
+}
+function resolvePackageRelativePath(base, relativePath) {
+	if (relativePath.includes("\\") || relativePath.includes("\0") || relativePath.startsWith("/")) return void 0;
+	const segments = relativePath.split("/").filter((segment) => segment.length > 0);
+	if (segments.some((segment) => segment === "." || segment === "..")) return void 0;
+	try {
+		return joinResourcePackageSourcePath(base, ...segments);
+	} catch {
+		return;
+	}
 }
 function isPlainObject(value) {
 	if (typeof value !== "object" || value === null || Array.isArray(value)) return false;
@@ -1064,6 +1428,12 @@ function normalizeExternalValue(value) {
 function asString(value) {
 	return typeof value === "string" && value.trim() ? value : void 0;
 }
+function asSha256(value) {
+	return typeof value === "string" && /^sha256:[0-9a-f]{64}$/u.test(value) ? value : void 0;
+}
+function isRevisionStability(value) {
+	return value === "experimental" || value === "stable" || value === "deprecated";
+}
 function isResourceNode(value) {
 	return typeof value === "object" && value !== null && !Array.isArray(value) && "tag" in value;
 }
@@ -1094,8 +1464,8 @@ async function loadResourceTree(options) {
 	if (unsupported) throw new ResourceValidationError([unsupported]);
 	const manifestPath = options.manifestPath ?? "manifest.xnl";
 	const result = await buildXnlResourceTree({
-		...options,
-		rootDir: resolve(options.rootDir),
+		port: await createDirectoryResourcePackageReadPort(options.rootDir),
+		rootPath: "/",
 		manifestPath
 	});
 	if (result.diagnostics.length > 0 || !result.tree) throw new ResourceValidationError(result.diagnostics);
@@ -1106,11 +1476,31 @@ async function validateResourceTree(options) {
 	if (unsupported) return [unsupported];
 	const manifestPath = options.manifestPath ?? "manifest.xnl";
 	return (await buildXnlResourceTree({
-		...options,
-		rootDir: resolve(options.rootDir),
+		port: await createDirectoryResourcePackageReadPort(options.rootDir),
+		rootPath: "/",
 		manifestPath
 	})).diagnostics;
 }
+async function loadResourceTreeFromReadPort(options) {
+	const unsupported = unsupportedReadPortAuthorityDiagnostic(options);
+	if (unsupported) throw new ResourceValidationError([unsupported]);
+	const result = await buildXnlResourceTree({
+		port: options.port,
+		rootPath: options.rootPath ?? "/",
+		manifestPath: options.manifestPath ?? "manifest.xnl"
+	});
+	if (result.diagnostics.length > 0 || !result.tree) throw new ResourceValidationError(result.diagnostics);
+	return result.tree;
+}
+async function validateResourceTreeFromReadPort(options) {
+	const unsupported = unsupportedReadPortAuthorityDiagnostic(options);
+	if (unsupported) return [unsupported];
+	return (await buildXnlResourceTree({
+		port: options.port,
+		rootPath: options.rootPath ?? "/",
+		manifestPath: options.manifestPath ?? "manifest.xnl"
+	})).diagnostics;
+}
 function unsupportedAuthorityDiagnostic(options) {
 	const manifestPath = options.manifestPath ?? "manifest.xnl";
 	if (!manifestPath.toLowerCase().endsWith(".xnl")) return {
@@ -1119,5 +1509,13 @@ function unsupportedAuthorityDiagnostic(options) {
 		message: "Resource package manifests must use XNL authority."
 	};
 }
+function unsupportedReadPortAuthorityDiagnostic(options) {
+	const manifestPath = options.manifestPath ?? "manifest.xnl";
+	if (!manifestPath.toLowerCase().endsWith(".xnl")) return {
+		code: "RESOURCE_AUTHORITY_FORMAT_UNSUPPORTED",
+		location: `vfs://@/${manifestPath}`,
+		message: "Resource package manifests must use XNL authority."
+	};
+}
 //#endregion
-export { isLoadedResourceTreeAuthentic as a, sha256Digest as c, markEffectiveRegistryAuthentic as d, ResourceCompositionError as f, readonlyMap as i, effectiveRegistryLayerBindings as l, digestCanonical as m, loadResourceTree as n, buildResourceDependencySnapshot as o, compareCodeUnits as p, validateResourceTree as r, createResourceContentIdentity as s, ResourceValidationError as t, isEffectiveRegistryAuthentic as u };
+export { digestCanonical as C, dirnameResourcePackageSourcePath as D, canonicalResourcePackageSourcePath as E, joinResourcePackageSourcePath as O, compareCodeUnits as S, ResourcePackageSourcePathError as T, effectiveRegistryLayerBindings as _, validateResourceTreeFromReadPort as a, ResourceCompositionError as b, RESOURCE_ENVELOPE_CONTRACT as c, isSpecVersion as d, readonlyMap as f, sha256Digest as g, createResourceContentIdentity as h, validateResourceTree as i, relativeResourcePackageSourcePath as k, RESOURCE_ENVELOPE_FINGERPRINT as l, buildResourceDependencySnapshot as m, loadResourceTree as n, decodeResourceMetadata as o, isAuthoredResourceTreeAuthentic as p, loadResourceTreeFromReadPort as r, CORE_BOOTSTRAP_WRITER_SPEC_VERSIONS as s, ResourceValidationError as t, RESOURCE_ENVELOPE_VERSION as u, isEffectiveRegistryAuthentic as v, createDirectoryResourcePackageReadPort as w, canonicalJson as x, markEffectiveRegistryAuthentic as y };