iterate 0.2.7 → 0.3.0

package/dist/next/expression.mjs

@@ -0,0 +1,399 @@
+import { codedError, jsonEqual } from "./lib.mjs";
+import { RpcTarget } from "capnweb";
+import JSON5 from "json5";
+//#region src/next/expression.ts
+/** A STRING expression is for what a person types: short. Anything bigger — a worker's source, a large
+*  literal — rides the PARSED form (`["itx","workers",["get",{ source }]]`), which is plain data and never
+*  meets json5. The cap is O(1), before any parsing (stock json5 allocates per character and a
+*  multi-megabyte literal kills a 128 MiB isolate — the 2026-09-07 wave-0 plan, issue 2). */
+const ITX_EXPRESSION_STRING_MAX_CHARS = 2048;
+/** The name a step carries: the property itself, or a call step's method. */
+const itxExpressionStepName = (step) => Array.isArray(step) ? step[0] : step;
+const IDENT = /^[A-Za-z_$][A-Za-z0-9_$-]*/;
+const RESERVED = new Set([
+	"__proto__",
+	"constructor",
+	"prototype"
+]);
+/** The marker's array-half spelling, the one reserved literal. */
+const ITX_EXPRESSION_HOLE = { "@": true };
+/** The merge entry's key — `...@` — read by rule 7. */
+const ITX_EXPRESSION_MERGE_KEY = "...@";
+/** A single- or double-quoted string literal (escapes honored) or a JSON5 comment (block or line):
+*  THE one pattern every walk that must skip what is inside them is built from — the marker lex, the
+*  marker print, the paren matcher. In an alternation a span is consumed whole, so nothing inside one
+*  (a quote in a comment, an `@` in a string) is ever seen by the other alternatives. */
+const STRING_OR_COMMENT = String.raw`"(?:[^"\\]|\\[\s\S])*"|'(?:[^'\\]|\\[\s\S])*'|/\*[\s\S]*?\*/|//[^\n]*`;
+const isStringOrComment = (match) => match[0] === "\"" || match[0] === "'" || match[0] === "/";
+/** In call args: a literal (kept verbatim) or a marker — `...@` before `@`, so the merge form wins. */
+const MARKERS_IN_ARGS = new RegExp(`${STRING_OR_COMMENT}|\\.\\.\\.@|@`, "g");
+/** In JSON5's printed output: the marker literal `{'@':true}` and the merge entry `'...@':true` are
+*  spelled with a single-quoted key and matched on those exact boundaries — listed BEFORE the literal
+*  alternative so the entry's `'...@'` is read as the entry, not as a string. A user's string that
+*  merely contains those characters is emitted by JSON5 as a longer (double-quoted) literal and is
+*  consumed whole. */
+const MARKERS_IN_PRINT = new RegExp(`\\{'@':true\\}|'\\.\\.\\.@':true|${STRING_OR_COMMENT}`, "g");
+/** A bracket outside a literal. */
+const BRACKETS = new RegExp(`${STRING_OR_COMMENT}|[()[\\]{}]`, "g");
+/** Is `value` the marker literal `{ "@": true }`? */
+const isItxExpressionHole = (value) => jsonEqual(value, ITX_EXPRESSION_HOLE);
+/** Does `value` (a step, an arg tree, a whole expression) hold the marker or a merge entry anywhere? */
+function containsItxExpressionHole(value) {
+	if (isItxExpressionHole(value)) return true;
+	if (Array.isArray(value)) return value.some(containsItxExpressionHole);
+	if (value !== null && typeof value === "object") return value["...@"] === true || Object.values(value).some(containsItxExpressionHole);
+	return false;
+}
+/** Index of the `)` closing the `(` at `open`; tracks bracket depth, skipping quoted string args. */
+function matchingParen(source, open) {
+	let depth = 0;
+	BRACKETS.lastIndex = open;
+	for (let bracket = BRACKETS.exec(source); bracket; bracket = BRACKETS.exec(source)) {
+		if (isStringOrComment(bracket[0])) continue;
+		if ("([{".includes(bracket[0])) depth++;
+		else if (--depth === 0) return bracket.index;
+	}
+	throw new Error(`expression: unbalanced "(" in ${JSON.stringify(source)}`);
+}
+/** Parse the STRING half: dotted names + `.method(args)` calls (args JSON5-parsed); rejects reserved
+*  names + bare scope calls. `holes: true` — a rewrite rule's TARGET only — lexes `@` / `...@` into
+*  the marker literals; anywhere else a bare `@` is refused. */
+function parse(source, options) {
+	if (source.length > ITX_EXPRESSION_STRING_MAX_CHARS) throw codedError("EXPRESSION_TOO_LONG", `itx expression: ${source.length} chars is over the ${ITX_EXPRESSION_STRING_MAX_CHARS}-char limit for the string form — a string expression is for what a person types; pass the parsed form instead: ["itx","workers",["get",{ source: … }]]`);
+	const s = source.trim();
+	const steps = [];
+	let i = 0;
+	function fail(m) {
+		throw new Error(`expression: ${m} in ${JSON.stringify(source)}`);
+	}
+	const readName = () => {
+		const m = IDENT.exec(s.slice(i));
+		if (!m) fail(`name expected at ${i}`);
+		if (RESERVED.has(m[0])) fail(`reserved name "${m[0]}"`);
+		i += m[0].length;
+		return m[0];
+	};
+	steps.push(readName());
+	while (i < s.length) {
+		const c = s[i];
+		if (/\s/.test(c)) i++;
+		else if (c === ".") steps.push((i++, readName()));
+		else if (c === "(") {
+			const end = matchingParen(s, i);
+			const inner = s.slice(i + 1, end).trim().replace(MARKERS_IN_ARGS, (match) => {
+				if (isStringOrComment(match)) return match;
+				if (!options?.holes) fail("`@` (the caller's input) is legal only in a rewrite rule's target");
+				return match === "@" ? JSON.stringify(ITX_EXPRESSION_HOLE) : `${JSON.stringify(ITX_EXPRESSION_MERGE_KEY)}:true`;
+			});
+			let args = [];
+			try {
+				if (inner !== "") args = JSON5.parse(`[${inner}]`);
+			} catch (e) {
+				fail(`call args are not JSON5 (${e.message})`);
+			}
+			const previous = steps.at(-1);
+			if (Array.isArray(previous)) steps.push(["", ...args]);
+			else {
+				const name = steps.pop();
+				if (typeof name !== "string") fail("a call must follow a name");
+				if (steps.length === 0) fail("cannot call the scope symbol itself");
+				steps.push([name, ...args]);
+			}
+			i = end + 1;
+		} else fail(`unexpected ${JSON.stringify(c)} at ${i}`);
+	}
+	return steps;
+}
+/** The array half, checked the way the parser checks the string half — every name step an identifier
+*  that is not reserved, every call step `[method, ...args]` with an identifier method (or `""`, the
+*  anonymous call, only right after a call) — WITHOUT printing and re-parsing: a stored target carries a worker's whole source as
+*  data, and that data must never meet the string codec (the 2 KiB cap, json5). Throws in the
+*  parser's words. */
+function assertItxExpressionShape(expression) {
+	const fail = (m) => {
+		throw new Error(`expression: ${m} in ${JSON.stringify(expression).slice(0, 200)}`);
+	};
+	if (!Array.isArray(expression) || expression.length === 0) fail("an expression is a non-empty array");
+	const name = (step, what) => {
+		if (!IDENT.test(step) || IDENT.exec(step)[0] !== step) fail(`${what} ${JSON.stringify(step)} is not an identifier`);
+		if (RESERVED.has(step)) fail(`reserved name "${step}"`);
+	};
+	expression.forEach((step, i) => {
+		if (typeof step === "string") {
+			name(step, i === 0 ? "the root" : "a name step");
+			return;
+		}
+		if (!Array.isArray(step) || typeof step[0] !== "string") fail(`step ${i} is neither a name nor [method, ...args]`);
+		const [method] = step;
+		if (method === "") {
+			if (i === 0 || !Array.isArray(expression[i - 1])) fail("the anonymous call `f(x)(y)` follows a call");
+		} else name(method, "a method");
+		if (i === 0) fail("a call on the root itself");
+	});
+}
+/** THE ONE NORMALIZING DOOR: either half, normalized to the array half and checked — a string is
+*  parsed (short by rule), an array is shape-checked in place. Every door that takes an
+*  `ItxExpressionInput` (the edge `invoke`, the resolver, the event builders, the prefix parser
+*  below) enters through it. */
+function normalizedItxExpression(input, options) {
+	if (typeof input === "string") return parse(input, options);
+	assertItxExpressionShape(input);
+	return input;
+}
+/** Object args print with their keys SORTED, so two spellings of one object are one canonical string
+*  — one rewrite-rule row, one facet memo, one library connection memo (library.ts) — the way
+*  `jsonEqual` already matches them. A `JSON.stringify` / `JSON5.stringify` replacer. */
+const keySortedForPrint = (_key, value) => value !== null && typeof value === "object" && !Array.isArray(value) ? Object.fromEntries(Object.keys(value).sort().map((k) => [k, value[k]])) : value;
+/** Canonical stored form: dotted path + `.method(args)` calls (args `JSON5.stringify`d, object keys
+*  sorted). `holes: true` — a rewrite rule's TARGET only — spells the marker literals back as `@` /
+*  `...@`, and `parse(print(e, { holes: true }), { holes: true })` round-trips; without it the
+*  reserved literals print as the plain JSON5 they are, so a CALL that happens to carry `{ "@": true }`
+*  as data round-trips through `parse` (no holes) unchanged — the resolve/invoke law holds for it. */
+function print(expr, options) {
+	return expr.map((step, i) => {
+		const dot = i ? "." : "";
+		if (typeof step === "string") return dot + step;
+		const json = JSON5.stringify(step.slice(1), keySortedForPrint).slice(1, -1);
+		const args = options?.holes ? json.replace(MARKERS_IN_PRINT, (match) => match === "{'@':true}" ? "@" : match === "'...@':true" ? "...@" : match) : json;
+		return step[0] === "" ? `(${args})` : `${dot}${step[0]}(${args})`;
+	}).join("");
+}
+/** Parse an itx-expression prefix (either codec half) — `normalizedItxExpression` (so every step is
+*  an identifier that is not reserved, in either half) plus the two refusals only a PREFIX has: the
+*  anonymous call step (`f(x)(y)` — a prefix cannot call a result), and a call step with NO args,
+*  which pins nothing and is the same prefix as the plain name: spell `itx.ai.run`. */
+function parseItxExpressionPrefix(source) {
+	const expr = normalizedItxExpression(source);
+	const spelled = typeof source === "string" ? source : print(expr);
+	for (const step of expr) {
+		if (!Array.isArray(step)) continue;
+		if (step[0] === "") throw new Error(`an itx-expression prefix cannot call a result — ${JSON.stringify(spelled)}`);
+		if (step.length === 1) throw new Error(`an itx-expression prefix pins literal args with a call step — ${JSON.stringify(spelled)} has "${step[0]}()" with none; spell "${step[0]}"`);
+	}
+	return expr;
+}
+/** THE ONE canonical spelling of an itx-expression prefix — the rewrite-rule table's key, what a lent
+*  stub is keyed by through `provide`'s sugar: parsed, then printed (dotted names; pinned args as JSON5
+*  literals). */
+function canonicalItxExpressionPrefix(source) {
+	return print(parseItxExpressionPrefix(source));
+}
+const PIPELINED_RPC_BRANDS = [];
+/** Register a pipelinable promise brand (the workerd entrypoint's two calls at boot). */
+function registerPipelinedRpcBrand(brand) {
+	PIPELINED_RPC_BRANDS.push(brand);
+}
+const pipelined = (v) => PIPELINED_RPC_BRANDS.some((b) => v instanceof b);
+/** Resolve one step's property. `__proto__` / `constructor` / `prototype` never resolve — `constructor`
+*  would hand out the class itself (trusted clients or not, that is not a step anyone means). */
+function stepGet(value, key) {
+	if (key === "__proto__" || key === "constructor" || key === "prototype") return void 0;
+	return Reflect.get(value, key);
+}
+/**
+* THE step walk: property steps `Reflect.get` with the receiver carried; call steps `Reflect.apply`
+* ON that receiver (detaching a method from a Workers-RPC receiver breaks it); an ordinary promise
+* is awaited between steps, a branded one (PIPELINED_RPC_BRANDS, above) is not.
+*
+* ⚠️  DataCloneError LEARNING:
+* invoke facet/RPC-stub methods with `Reflect.apply(fn, receiver, args)`, NEVER `stub[m].apply(stub,
+* args)`. Reading `.apply` off an RPC stub's method proxy is a capnweb PIPELINED REMOTE PATH;
+* calling it passes the stub as an argument, so workerd serializes it — and a Worker-Loader facet
+* stub may never be serialized (`requireAllowsTransfer()` throws unconditionally) → `DataCloneError:
+* Durable Object Facet stubs cannot be transferred between Workers`. Do not "simplify" this away.
+*/
+async function walkSteps(start, steps) {
+	let { value, receiver } = start;
+	for (const [stepIndex, step] of steps.entries()) {
+		if (!pipelined(value)) value = await value;
+		if (value == null) throw new Error(`hit ${String(value)} at step ${stepIndex + 1} of ${print(steps)} (${JSON.stringify(step)})`);
+		if (typeof step === "string") {
+			receiver = value;
+			value = stepGet(value, step);
+		} else {
+			const [method, ...args] = step;
+			if (method === "") {
+				value = callOn(value, receiver, args);
+				receiver = void 0;
+				if (!pipelined(value)) value = await value;
+				continue;
+			}
+			const fn = stepGet(value, method);
+			if (typeof fn !== "function") throw codedError("NOT_A_METHOD", `${JSON.stringify(method)} is not a method at step ${stepIndex + 1} of ${print(steps)}`);
+			receiver = void 0;
+			value = Reflect.apply(fn, value, args);
+			if (!pipelined(value)) value = await value;
+		}
+	}
+	return {
+		value: pipelined(value) ? value : await value,
+		receiver
+	};
+}
+/** Apply `args` to a resolved value on its carried receiver, or a LOUD error if it is not callable
+*  (never the silent arg-drop apps/os shipped). An `InvokeHandle` is NOT a JS function (a real
+*  RpcTarget so dotted access pipelines — the invoke handle section), so ROOT-calling it dispatches
+*  those args at its EMPTY path: `handle(events,range)` ⇒ the bare callback the handle fronts. The one
+*  bridge between "callable capability" and "pipelinable RpcTarget". */
+async function callOn(value, receiver, args) {
+	if (typeof value === "function") return Reflect.apply(value, receiver, args);
+	if (value instanceof InvokeHandle) return value.applyRoot(args);
+	throw codedError("NOT_A_METHOD", `target is not callable but ${args.length} arg(s) were passed`);
+}
+/** Names that must NEVER become dynamic capability segments — a dispatcher answering them would turn
+*  a plain property probe into a live capability call. Enforced at the prototype-chain hop and at
+*  every depth of the path proxies it hands out. Two kinds, one set: */
+const RESERVED_SEGMENT_NAMES = new Set([
+	"__defineGetter__",
+	"__defineSetter__",
+	"__lookupGetter__",
+	"__lookupSetter__",
+	"__proto__",
+	"apply",
+	"bind",
+	"call",
+	"catch",
+	"constructor",
+	"dup",
+	"finally",
+	"hasOwnProperty",
+	"isPrototypeOf",
+	"map",
+	"onRpcBroken",
+	"propertyIsEnumerable",
+	"prototype",
+	"then",
+	"toLocaleString",
+	"toString",
+	"valueOf",
+	"toJSON",
+	"asymmetricMatch"
+]);
+/** The path proxy: a function-backed Proxy (not an RpcTarget instance) — each missing property
+*  extends `path`, and applying the function reduces the whole accumulated access into ONE
+*  `invoke(expression)` call, `[...root, ...path.slice(0, -1), [path.at(-1), ...args]]`. */
+function createItxExpressionPathProxy(invoker, root, path) {
+	const valueFor = (key) => createItxExpressionPathProxy(invoker, root, [...path, key]);
+	return new Proxy(function() {}, {
+		apply(_target, _thisArg, args) {
+			const method = path[path.length - 1];
+			const expr = [
+				...root,
+				...path.slice(0, -1),
+				[method, ...args]
+			];
+			return invoker.invoke(expr);
+		},
+		get(target, key, receiver) {
+			if (typeof key === "symbol") return Reflect.get(target, key, receiver);
+			if (RESERVED_SEGMENT_NAMES.has(key)) return void 0;
+			return valueFor(key);
+		},
+		getOwnPropertyDescriptor(target, key) {
+			const descriptor = Reflect.getOwnPropertyDescriptor(target, key);
+			if (descriptor) return descriptor;
+			if (typeof key === "symbol" || RESERVED_SEGMENT_NAMES.has(key)) return void 0;
+			return {
+				configurable: true,
+				enumerable: true,
+				value: valueFor(key),
+				writable: false
+			};
+		},
+		has(target, key) {
+			if (typeof key === "symbol") return key in target;
+			return !RESERVED_SEGMENT_NAMES.has(key);
+		}
+	});
+}
+/** Install the hop drawn in the header on a class's PROTOTYPE CHAIN, with the scope `root` (`["itx"]`
+*  for the edge context, `[]` for a handle). Call ONCE per class. Constructor inheritance is
+*  untouched — only `Class.prototype`'s parent link changes, and the hop forwards everything it does
+*  not intercept. */
+function installPrototypeInvokeFallback(cls, root) {
+	const parentPrototype = Object.getPrototypeOf(cls.prototype);
+	const hop = new Proxy(Object.create(parentPrototype), { get(hopTarget, key, receiver) {
+		if (typeof key === "symbol" || key in hopTarget) return Reflect.get(hopTarget, key, receiver);
+		if (RESERVED_SEGMENT_NAMES.has(key)) return void 0;
+		if (!(receiver instanceof cls)) return;
+		return createItxExpressionPathProxy(receiver, root, [key]);
+	} });
+	Object.setPrototypeOf(cls.prototype, hop);
+}
+/** A branded, pipelinable handle for a MID-CHAIN capability (`facets.get(name)`, `cd(path)`,
+*  `workers.get(spec)`, a lent stub) whose unknown dotted members reduce into ONE dispatch of the
+*  itx-expression STEPS relative to it; the constructor's `dispatch` routes those steps into the
+*  underlying object. Declared members (`invoke` / `applyRoot`) win over the fallback, so a
+*  capability cannot be named either — the two reserved words this wrapper adds. */
+var InvokeHandle = class extends RpcTarget {
+	#dispatchItxExpressionSteps;
+	constructor(dispatchItxExpressionSteps) {
+		super();
+		this.#dispatchItxExpressionSteps = dispatchItxExpressionSteps;
+	}
+	/** THE reduce door the prototype hop dispatches onto; the expression is RELATIVE to this handle. */
+	invoke(itxExpressionSteps) {
+		return this.#dispatchItxExpressionSteps(itxExpressionSteps);
+	}
+	/** Call the bare capability this handle fronts — the ANONYMOUS call step (`callOn` in the dispatch section
+	*  uses it when a rewritten call's target IS a handle: `handle(events, range)`). */
+	applyRoot(args) {
+		return this.#dispatchItxExpressionSteps([["", ...args]]);
+	}
+};
+installPrototypeInvokeFallback(InvokeHandle, []);
+/** Walk itx-expression steps off a capnweb stub; the ANONYMOUS call step (`""`) calls the value
+*  itself (a bare function lent as a capability). NO await inside the loop: on a capnweb stub every
+*  step is a PIPELINED path, so an n-step chain costs ONE round trip, flushed by the caller's single
+*  await. A DIRECT call on the stub, never `.apply`: reading `.apply` off a capnweb stub's method is
+*  itself a pipelined remote path (`walkSteps`'s DataCloneError learning). Exported for the library
+*  tier, which may import this module only. */
+function walkStepsOnRpcStub(stub, steps) {
+	let value = stub;
+	for (const step of steps) if (typeof step === "string") value = value[step];
+	else {
+		const [method, ...args] = step;
+		value = method === "" ? value(...args) : value[method](...args);
+	}
+	return value;
+}
+/** `itx.facets.get(name)` / `itx.facets.get(name, { source, className })` — a facet of this context. */
+var FacetHandle = class extends InvokeHandle {};
+/** A HANDLE ON THE WIRE IS THE EXPRESSION THAT NAMES IT. An `InvokeHandle` a context mints (`repos.get(path)`,
+*  `workspaces.get(path)`, `facets.get(name)`, `cd(path)`, `workers.get(spec)`) holds no state — it is a
+*  dispatch closure over a path — yet as a Workers-RPC result it would cross a hop as a LIVE stub whose
+*  session keeps the context's actor resident for as long as the holder keeps it (prd 2026-09-22: ~125
+*  such sessions parked around the clock). So the context's RPC door answers with THIS instead: the
+*  caller's own expression, which from the caller's root denotes the same handle; the caller mints its
+*  own handle over it (`materializeItxHandleReference`), and every later verb is one whole call the
+*  context resolves from scratch. Nothing outlives a call. A lent client stub (`RpcStubHandle`) is the
+*  one handle that IS live and crosses as itself. */
+const ITX_HANDLE_REFERENCE_KEY = "$itxHandleExpression";
+const isItxHandleReference = (value) => Boolean(value) && typeof value === "object" && Array.isArray(value["$itxHandleExpression"]);
+/** What a context's RPC door hands back for `expression`'s result: a reference when the result is a
+*  path-shaped handle (an `InvokeHandle` that is not a lent stub) or a reference from a hop below —
+*  re-rooted, since `expression` is how THIS caller reached it — else nothing (the result crosses as it
+*  is). Runtime args that fold into a terminal NAME fold here exactly as the resolver folds them, so the
+*  reference is the call the resolver ran; args left over apply to the value and never name a handle. */
+function itxHandleReferenceOf(result, expression, args = []) {
+	const last = expression.at(-1);
+	const folded = args.length > 0 && typeof last === "string" && expression.length > 1 ? [...expression.slice(0, -1), [last, ...args]] : args.length > 0 ? void 0 : expression;
+	if (!folded) return void 0;
+	if (!(result instanceof InvokeHandle && !(result instanceof RpcStubHandle)) && !isItxHandleReference(result)) return void 0;
+	return { [ITX_HANDLE_REFERENCE_KEY]: folded };
+}
+/** The holder's side: a reference becomes a handle of the HOLDER's own whose every dotted call is one
+*  whole expression through `invoke` — the reference's expression plus the steps. Anything else passes
+*  through untouched. The proxy hands relative steps; a caller's own `.invoke("itx.whoami()")` is a
+*  whole call, spelled from the root. */
+function materializeItxHandleReference(result, invoke) {
+	if (!isItxHandleReference(result)) return result;
+	const expression = result[ITX_HANDLE_REFERENCE_KEY];
+	return new InvokeHandle((steps) => invoke(typeof steps === "string" || steps[0] === "itx" ? normalizedItxExpression(steps) : [...expression, ...steps]));
+}
+/** `itx.rpcStubs.get(key)` — a live stub lent to the registry. */
+var RpcStubHandle = class extends InvokeHandle {};
+//#endregion
+export { FacetHandle, ITX_EXPRESSION_MERGE_KEY, ITX_HANDLE_REFERENCE_KEY, InvokeHandle, RpcStubHandle, callOn, canonicalItxExpressionPrefix, containsItxExpressionHole, installPrototypeInvokeFallback, isItxExpressionHole, isItxHandleReference, itxExpressionStepName, itxHandleReferenceOf, keySortedForPrint, materializeItxHandleReference, normalizedItxExpression, parse, parseItxExpressionPrefix, print, registerPipelinedRpcBrand, walkSteps, walkStepsOnRpcStub };
+
+//# sourceMappingURL=expression.mjs.map

package/dist/next/expression.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"expression.mjs","names":["#dispatchItxExpressionSteps"],"sources":["../../src/next/expression.ts"],"sourcesContent":["// context/expression.ts — THE expression codec: the STRING half (itx.facets.get(\"core\")) ⇄ the\n// STRUCTURED half ([\"itx\", \"facets\", [\"get\", \"core\"]]). Args are ONE JSON5 grammar, comments included\n// (no hand-rolled number/object parser; __proto__-safe); expressions are persisted NAMES, so deleting\n// one IS revocation. The rewrite rules (match, rank, rewrite) are ./itx-expression-rewriting.ts. Two more concepts\n// ride with the codec, the only platform primitives the library tier may import:\n//   dispatch      — `walkSteps` / `callOn`: EXECUTE a rewritten call's steps against a live object graph\n//   invoke handle — `InvokeHandle` + the prototype hop: the DOTTED DOOR, every unknown chain one `invoke(expression)`\nimport JSON5 from \"json5\";\nimport { RpcTarget } from \"capnweb\";\nimport { codedError, jsonEqual } from \"./lib.ts\";\n\n/** A STRING expression is for what a person types: short. Anything bigger — a worker's source, a large\n *  literal — rides the PARSED form (`[\"itx\",\"workers\",[\"get\",{ source }]]`), which is plain data and never\n *  meets json5. The cap is O(1), before any parsing (stock json5 allocates per character and a\n *  multi-megabyte literal kills a 128 MiB isolate — the 2026-09-07 wave-0 plan, issue 2). */\nconst ITX_EXPRESSION_STRING_MAX_CHARS = 2048;\n\n/** One step: a property read (string) or a call (`[method, ...args]`). Args are plain JSON. The\n *  method `\"\"` is the ANONYMOUS call — call the value itself: `itx.builtins.rpcStubs.get('cam')(1, 2)`\n *  is `[\"itx\",\"builtins\",\"rpcStubs\",[\"get\",\"cam\"],[\"\",1,2]]` — what a `provide(stub)` rule spells when\n *  the lent stub is called with args. */\nexport type ItxExpressionStep = string | [method: string, ...args: unknown[]];\n/** An itx expression as data: the scope root (`itx`) then get/call steps. THE parsed form every door\n *  works on. */\nexport type ItxExpression = ItxExpressionStep[];\n/** THE dispatch target, in EITHER codec half — a dotted string that starts with the scope root\n *  (`\"itx.facets.get('core')\"`) OR the parsed structured form (`[\"itx\",\"facets\",[\"get\",\"core\"]]`).\n *  Both carry call args (the string via `.method(args)`), and `normalizedItxExpression` normalizes\n *  either to the structured form — so either works wherever one works, at every door that dispatches. */\nexport type ItxExpressionInput = string | ItxExpression;\n/** An itx-expression PREFIX — a rewrite rule's `match`: dotted names, any of which may be a call step\n *  PINNING literal args — `itx.ai.run` or `itx.ai.run('gpt-5')` or `itx.repo.get('main').files`. A\n *  pinned arg must equal the call's arg at that position for the rule to match, and is CONSUMED by\n *  the match (partial application): `itx.ai.run('gpt-5') ⇒ itx.openai.chat` makes\n *  `itx.ai.run('gpt-5', inputs)` into `itx.openai.chat(inputs)`. */\nexport type ItxExpressionPrefix = ItxExpression;\n/** The name a step carries: the property itself, or a call step's method. */\nexport const itxExpressionStepName = (step: ItxExpressionStep | undefined): string | undefined =>\n  Array.isArray(step) ? step[0] : step;\n\nconst IDENT = /^[A-Za-z_$][A-Za-z0-9_$-]*/;\nconst RESERVED = new Set([\"__proto__\", \"constructor\", \"prototype\"]);\n\n// ── `@`, THE CALLER'S INPUT — a rewrite rule's target may hold it, nothing else may ──\n// In the string half a bare `@` outside a string literal is the marker (`'@cf/…'` inside quotes is a\n// string like any other); `...@` as an object-literal entry is the merge form. In the array half the\n// marker is ONE reserved literal, `{ \"@\": true }`, and the merge entry the key `\"...@\"` with the value\n// `true` — so the stored form is plain JSON, and those two spellings are unspellable as literals in a\n// target (the codec's one reservation). What `@` MEANS is rule 7 in ./itx-expression-rewriting.ts; here\n// it is only lexed (parse, targets only) and printed back (print, targets only).\n/** The marker's array-half spelling, the one reserved literal. */\nconst ITX_EXPRESSION_HOLE = { \"@\": true } as const;\n/** The merge entry's key — `...@` — read by rule 7. */\nexport const ITX_EXPRESSION_MERGE_KEY = \"...@\";\n\n/** A single- or double-quoted string literal (escapes honored) or a JSON5 comment (block or line):\n *  THE one pattern every walk that must skip what is inside them is built from — the marker lex, the\n *  marker print, the paren matcher. In an alternation a span is consumed whole, so nothing inside one\n *  (a quote in a comment, an `@` in a string) is ever seen by the other alternatives. */\nconst STRING_OR_COMMENT = String.raw`\"(?:[^\"\\\\]|\\\\[\\s\\S])*\"|'(?:[^'\\\\]|\\\\[\\s\\S])*'|/\\*[\\s\\S]*?\\*/|//[^\\n]*`;\nconst isStringOrComment = (match: string): boolean =>\n  match[0] === '\"' || match[0] === \"'\" || match[0] === \"/\";\n/** In call args: a literal (kept verbatim) or a marker — `...@` before `@`, so the merge form wins. */\nconst MARKERS_IN_ARGS = new RegExp(`${STRING_OR_COMMENT}|\\\\.\\\\.\\\\.@|@`, \"g\");\n/** In JSON5's printed output: the marker literal `{'@':true}` and the merge entry `'...@':true` are\n *  spelled with a single-quoted key and matched on those exact boundaries — listed BEFORE the literal\n *  alternative so the entry's `'...@'` is read as the entry, not as a string. A user's string that\n *  merely contains those characters is emitted by JSON5 as a longer (double-quoted) literal and is\n *  consumed whole. */\nconst MARKERS_IN_PRINT = new RegExp(`\\\\{'@':true\\\\}|'\\\\.\\\\.\\\\.@':true|${STRING_OR_COMMENT}`, \"g\");\n/** A bracket outside a literal. */\nconst BRACKETS = new RegExp(`${STRING_OR_COMMENT}|[()[\\\\]{}]`, \"g\");\n\n/** Is `value` the marker literal `{ \"@\": true }`? */\nexport const isItxExpressionHole = (value: unknown): boolean =>\n  jsonEqual(value, ITX_EXPRESSION_HOLE);\n\n/** Does `value` (a step, an arg tree, a whole expression) hold the marker or a merge entry anywhere? */\nexport function containsItxExpressionHole(value: unknown): boolean {\n  if (isItxExpressionHole(value)) return true;\n  if (Array.isArray(value)) return value.some(containsItxExpressionHole);\n  // oxlint-disable-next-line iterate/simple-truthiness-check -- `value` is `unknown`; the typeof separates real objects from primitives (a bare truthiness check would recurse into strings/numbers)\n  if (value !== null && typeof value === \"object\")\n    return (\n      (value as Record<string, unknown>)[ITX_EXPRESSION_MERGE_KEY] === true ||\n      Object.values(value).some(containsItxExpressionHole)\n    );\n  return false;\n}\n\n/** Index of the `)` closing the `(` at `open`; tracks bracket depth, skipping quoted string args. */\nfunction matchingParen(source: string, open: number): number {\n  let depth = 0;\n  BRACKETS.lastIndex = open;\n  for (let bracket = BRACKETS.exec(source); bracket; bracket = BRACKETS.exec(source)) {\n    if (isStringOrComment(bracket[0])) continue;\n    if (\"([{\".includes(bracket[0])) depth++;\n    else if (--depth === 0) return bracket.index;\n  }\n  throw new Error(`expression: unbalanced \"(\" in ${JSON.stringify(source)}`);\n}\n\n/** Parse the STRING half: dotted names + `.method(args)` calls (args JSON5-parsed); rejects reserved\n *  names + bare scope calls. `holes: true` — a rewrite rule's TARGET only — lexes `@` / `...@` into\n *  the marker literals; anywhere else a bare `@` is refused. */\nexport function parse(source: string, options?: { holes?: boolean }): ItxExpression {\n  if (source.length > ITX_EXPRESSION_STRING_MAX_CHARS)\n    throw codedError(\n      \"EXPRESSION_TOO_LONG\",\n      `itx expression: ${source.length} chars is over the ${ITX_EXPRESSION_STRING_MAX_CHARS}-char limit for the string form — a string expression is for what a person types; pass the parsed form instead: [\"itx\",\"workers\",[\"get\",{ source: … }]]`,\n    );\n  const s = source.trim();\n  const steps: ItxExpression = [];\n  let i = 0;\n  function fail(m: string): never {\n    throw new Error(`expression: ${m} in ${JSON.stringify(source)}`); // decl, not arrow: TS never-narrows\n  }\n  const readName = (): string => {\n    const m = IDENT.exec(s.slice(i));\n    if (!m) fail(`name expected at ${i}`);\n    if (RESERVED.has(m[0])) fail(`reserved name \"${m[0]}\"`);\n    i += m[0].length;\n    return m[0];\n  };\n  steps.push(readName()); // the scope root (itx)\n  while (i < s.length) {\n    const c = s[i];\n    if (/\\s/.test(c)) i++;\n    else if (c === \".\") steps.push((i++, readName()));\n    else if (c === \"(\") {\n      const end = matchingParen(s, i);\n      const raw = s.slice(i + 1, end).trim();\n      // `@` outside a string literal: the marker (targets only), a refusal everywhere else.\n      const inner = raw.replace(MARKERS_IN_ARGS, (match) => {\n        if (isStringOrComment(match)) return match;\n        if (!options?.holes)\n          fail(\"`@` (the caller's input) is legal only in a rewrite rule's target\");\n        return match === \"@\"\n          ? JSON.stringify(ITX_EXPRESSION_HOLE)\n          : `${JSON.stringify(ITX_EXPRESSION_MERGE_KEY)}:true`;\n      });\n      let args: unknown[] = [];\n      try {\n        if (inner !== \"\") args = JSON5.parse(`[${inner}]`) as unknown[];\n      } catch (e) {\n        fail(`call args are not JSON5 (${(e as Error).message})`);\n      }\n      const previous = steps.at(-1);\n      if (Array.isArray(previous))\n        steps.push([\"\", ...args]); // `f(x)(y)`: call the result itself\n      else {\n        const name = steps.pop();\n        if (typeof name !== \"string\") fail(\"a call must follow a name\");\n        if (steps.length === 0) fail(\"cannot call the scope symbol itself\");\n        steps.push([name, ...args]);\n      }\n      i = end + 1;\n    } else fail(`unexpected ${JSON.stringify(c)} at ${i}`);\n  }\n  return steps;\n}\n\n/** The array half, checked the way the parser checks the string half — every name step an identifier\n *  that is not reserved, every call step `[method, ...args]` with an identifier method (or `\"\"`, the\n *  anonymous call, only right after a call) — WITHOUT printing and re-parsing: a stored target carries a worker's whole source as\n *  data, and that data must never meet the string codec (the 2 KiB cap, json5). Throws in the\n *  parser's words. */\nfunction assertItxExpressionShape(expression: ItxExpression): void {\n  const fail = (m: string): never => {\n    throw new Error(`expression: ${m} in ${JSON.stringify(expression).slice(0, 200)}`);\n  };\n  // oxlint-disable-next-line iterate/simple-truthiness-check -- runtime shape validation of wire/stored data; the ItxExpression array type is a claim here, not a guarantee\n  if (!Array.isArray(expression) || expression.length === 0)\n    fail(\"an expression is a non-empty array\");\n  const name = (step: string, what: string) => {\n    if (!IDENT.test(step) || IDENT.exec(step)![0] !== step)\n      fail(`${what} ${JSON.stringify(step)} is not an identifier`);\n    if (RESERVED.has(step)) fail(`reserved name \"${step}\"`);\n  };\n  expression.forEach((step, i) => {\n    if (typeof step === \"string\") {\n      name(step, i === 0 ? \"the root\" : \"a name step\");\n      return;\n    }\n    // oxlint-disable-next-line iterate/simple-truthiness-check -- runtime shape validation of wire/stored data; the step's static array type is a claim here, not a guarantee\n    if (!Array.isArray(step) || typeof step[0] !== \"string\")\n      fail(`step ${i} is neither a name nor [method, ...args]`);\n    const [method] = step;\n    if (method === \"\") {\n      if (i === 0 || !Array.isArray(expression[i - 1]))\n        fail(\"the anonymous call `f(x)(y)` follows a call\");\n    } else name(method, \"a method\");\n    if (i === 0) fail(\"a call on the root itself\");\n  });\n  // No hole check on the array half: `{ \"@\": true }` carried as DATA is data (edge#6) — only the\n  // STRING form lexes a bare `@` into the marker, and only for a rule's target.\n}\n\n/** THE ONE NORMALIZING DOOR: either half, normalized to the array half and checked — a string is\n *  parsed (short by rule), an array is shape-checked in place. Every door that takes an\n *  `ItxExpressionInput` (the edge `invoke`, the resolver, the event builders, the prefix parser\n *  below) enters through it. */\nexport function normalizedItxExpression(\n  input: ItxExpressionInput,\n  options?: { holes?: boolean },\n): ItxExpression {\n  if (typeof input === \"string\") return parse(input, options);\n  assertItxExpressionShape(input);\n  return input;\n}\n\n/** Object args print with their keys SORTED, so two spellings of one object are one canonical string\n *  — one rewrite-rule row, one facet memo, one library connection memo (library.ts) — the way\n *  `jsonEqual` already matches them. A `JSON.stringify` / `JSON5.stringify` replacer. */\nexport const keySortedForPrint = (_key: string, value: unknown): unknown =>\n  // oxlint-disable-next-line iterate/simple-truthiness-check -- `value` is `unknown` (a JSON replacer arg); the typeof discriminates real objects from primitive values\n  value !== null && typeof value === \"object\" && !Array.isArray(value)\n    ? Object.fromEntries(\n        Object.keys(value as Record<string, unknown>)\n          .sort()\n          .map((k) => [k, (value as Record<string, unknown>)[k]]),\n      )\n    : value;\n\n/** Canonical stored form: dotted path + `.method(args)` calls (args `JSON5.stringify`d, object keys\n *  sorted). `holes: true` — a rewrite rule's TARGET only — spells the marker literals back as `@` /\n *  `...@`, and `parse(print(e, { holes: true }), { holes: true })` round-trips; without it the\n *  reserved literals print as the plain JSON5 they are, so a CALL that happens to carry `{ \"@\": true }`\n *  as data round-trips through `parse` (no holes) unchanged — the resolve/invoke law holds for it. */\nexport function print(expr: ItxExpression, options?: { holes?: boolean }): string {\n  return expr\n    .map((step, i) => {\n      const dot = i ? \".\" : \"\";\n      if (typeof step === \"string\") return dot + step;\n      const json = JSON5.stringify(step.slice(1), keySortedForPrint).slice(1, -1);\n      const args = options?.holes\n        ? json.replace(MARKERS_IN_PRINT, (match) =>\n            match === \"{'@':true}\" ? \"@\" : match === \"'...@':true\" ? \"...@\" : match,\n          )\n        : json;\n      return step[0] === \"\" ? `(${args})` : `${dot}${step[0]}(${args})`;\n    })\n    .join(\"\");\n}\n\n/** Parse an itx-expression prefix (either codec half) — `normalizedItxExpression` (so every step is\n *  an identifier that is not reserved, in either half) plus the two refusals only a PREFIX has: the\n *  anonymous call step (`f(x)(y)` — a prefix cannot call a result), and a call step with NO args,\n *  which pins nothing and is the same prefix as the plain name: spell `itx.ai.run`. */\nexport function parseItxExpressionPrefix(source: ItxExpressionInput): ItxExpressionPrefix {\n  const expr = normalizedItxExpression(source);\n  const spelled = typeof source === \"string\" ? source : print(expr);\n  for (const step of expr) {\n    if (!Array.isArray(step)) continue;\n    if (step[0] === \"\")\n      throw new Error(`an itx-expression prefix cannot call a result — ${JSON.stringify(spelled)}`);\n    if (step.length === 1)\n      throw new Error(\n        `an itx-expression prefix pins literal args with a call step — ${JSON.stringify(spelled)} has \"${step[0]}()\" with none; spell \"${step[0]}\"`,\n      );\n  }\n  return expr;\n}\n\n/** THE ONE canonical spelling of an itx-expression prefix — the rewrite-rule table's key, what a lent\n *  stub is keyed by through `provide`'s sugar: parsed, then printed (dotted names; pinned args as JSON5\n *  literals). */\nexport function canonicalItxExpressionPrefix(source: ItxExpressionInput): string {\n  return print(parseItxExpressionPrefix(source));\n}\n\n// ── dispatch ── EXECUTE a rewritten call's steps against a LIVE object graph (the codec that\n// turns strings ⇄ these structures is above; the rules that rewrite a call to a built-in\n// root are ./itx-expression-rewriting.ts). `walkSteps` is THE step walk — `ItxExpressionResolver`\n// replays the steps after the root with it; the facet door and the delivery loop walk steps on a\n// local object with it. `callOn` applies args to a resolved value. The dotted write-half (a handle\n// whose dotted access reduces into one dispatch) is `InvokeHandle` (the next section) — the\n// ONE such primitive, pipelinable over Workers RPC.\n\n// Promise brands the step walk threads UNAWAITED: property access and calls pipeline on them\n// natively, so the whole chain reduces into one round trip and the caller's terminal await is the\n// single flush. os-next iterate-context.ts registers the native cloudflare:workers brands and capnweb's at boot — that\n// import can't live here because the unit lane runs this module in Node, where the list stays empty\n// and every step is simply awaited.\nconst PIPELINED_RPC_BRANDS: (abstract new (...args: never[]) => unknown)[] = [];\n/** Register a pipelinable promise brand (the workerd entrypoint's two calls at boot). */\nexport function registerPipelinedRpcBrand(brand: abstract new (...args: never[]) => unknown): void {\n  PIPELINED_RPC_BRANDS.push(brand);\n}\nconst pipelined = (v: unknown): boolean => PIPELINED_RPC_BRANDS.some((b) => v instanceof b);\n\n/** Resolve one step's property. `__proto__` / `constructor` / `prototype` never resolve — `constructor`\n *  would hand out the class itself (trusted clients or not, that is not a step anyone means). */\nfunction stepGet(value: object, key: string): unknown {\n  if (key === \"__proto__\" || key === \"constructor\" || key === \"prototype\") return undefined;\n  return Reflect.get(value, key);\n}\n\n/**\n * THE step walk: property steps `Reflect.get` with the receiver carried; call steps `Reflect.apply`\n * ON that receiver (detaching a method from a Workers-RPC receiver breaks it); an ordinary promise\n * is awaited between steps, a branded one (PIPELINED_RPC_BRANDS, above) is not.\n *\n * ⚠️  DataCloneError LEARNING:\n * invoke facet/RPC-stub methods with `Reflect.apply(fn, receiver, args)`, NEVER `stub[m].apply(stub,\n * args)`. Reading `.apply` off an RPC stub's method proxy is a capnweb PIPELINED REMOTE PATH;\n * calling it passes the stub as an argument, so workerd serializes it — and a Worker-Loader facet\n * stub may never be serialized (`requireAllowsTransfer()` throws unconditionally) → `DataCloneError:\n * Durable Object Facet stubs cannot be transferred between Workers`. Do not \"simplify\" this away.\n */\nexport async function walkSteps(\n  start: { value: unknown; receiver: unknown },\n  steps: ItxExpression,\n): Promise<{ value: unknown; receiver: unknown }> {\n  let { value, receiver } = start;\n  for (const [stepIndex, step] of steps.entries()) {\n    if (!pipelined(value)) value = await value;\n    if (value == null)\n      throw new Error(\n        `hit ${String(value)} at step ${stepIndex + 1} of ${print(steps)} (${JSON.stringify(step)})`,\n      );\n    if (typeof step === \"string\") {\n      receiver = value;\n      value = stepGet(value as object, step);\n    } else {\n      const [method, ...args] = step;\n      if (method === \"\") {\n        // the ANONYMOUS call step (expression.ts): call the value itself — a live stub's root call\n        value = callOn(value, receiver, args);\n        receiver = undefined;\n        if (!pipelined(value)) value = await value;\n        continue;\n      }\n      const fn = stepGet(value as object, method);\n      if (typeof fn !== \"function\")\n        throw codedError(\n          \"NOT_A_METHOD\",\n          `${JSON.stringify(method)} is not a method at step ${stepIndex + 1} of ${print(steps)}`,\n        );\n      receiver = undefined;\n      value = Reflect.apply(fn, value, args);\n      if (!pipelined(value)) value = await value;\n    }\n  }\n  return { value: pipelined(value) ? value : await value, receiver };\n}\n\n/** Apply `args` to a resolved value on its carried receiver, or a LOUD error if it is not callable\n *  (never the silent arg-drop apps/os shipped). An `InvokeHandle` is NOT a JS function (a real\n *  RpcTarget so dotted access pipelines — the invoke handle section), so ROOT-calling it dispatches\n *  those args at its EMPTY path: `handle(events,range)` ⇒ the bare callback the handle fronts. The one\n *  bridge between \"callable capability\" and \"pipelinable RpcTarget\". */\nexport async function callOn(value: unknown, receiver: unknown, args: unknown[]): Promise<unknown> {\n  if (typeof value === \"function\") return Reflect.apply(value, receiver, args);\n  if (value instanceof InvokeHandle) return value.applyRoot(args);\n  throw codedError(\"NOT_A_METHOD\", `target is not callable but ${args.length} arg(s) were passed`);\n}\n\n// ── invoke handle ── THE DOTTED DOOR: how a surface that declares only fixed methods is\n// spoken as deep dotted access (`itx.slack.chat.postMessage({...})`), every unknown segment\n// accumulating into ONE `invoke(expression)` dispatch, `[...root, ...prefix, [method, ...args]]`.\n// Declared members always win. The pieces: the reserved names, the function-backed PATH PROXY, the\n// PROTOTYPE HOP that installs the fallback on a class, `InvokeHandle` (the genuine RpcTarget a\n// mid-chain capability is handed back as), and `walkStepsOnRpcStub`.\n//\n// WHY A PROTOTYPE HOP AND NOT A PROXY AROUND THE INSTANCE (tried FIRST and reverted): workerd RPC\n// classifies a call's RESULT for promise pipelining with native brand checks a JS Proxy can never\n// pass (`serializeJsValueWithPipeline` in worker-rpc.c++ → `NonPipelinable`; cloudflare/workerd#6873).\n// So a surface returned FROM A METHOD must hand back a REAL, unproxied instance or every pipelined\n// call on it dies with \"The RPC receiver does not implement the method ...\". A mid-chain call\n// returns its handle ACROSS an RPC boundary (`itx.facets.get('b').hello()` is two dispatches), and\n// capnweb's RpcTarget IS the native `cloudflare:workers` RpcTarget on workerd, so a real RpcTarget\n// passes on both hops. The hop squares that with dynamic dispatch by inserting one proxied link\n// BETWEEN `Class.prototype` and its parent:\n//\n//   instance ──proto──▶ Class.prototype ──proto──▶ Proxy(hop) ──proto──▶ parent\n//\n// - The instance is a genuine, natively-branded RpcTarget → the pipeline classifier accepts it.\n// - Declared members resolve BEFORE the hop — built-ins win, so a dynamic capability can never\n//   shadow a declared name (the deliberate trade-off).\n// - Unknown string keys reach the hop's `get` trap and become path proxies, dispatched via the\n//   receiver's own `invoke`; the receiver IS the invoker, so it wires with zero glue.\n// - Instances stay clean of own properties, so Workers RPC's instance-property protection needs\n//   no `getOwnPropertyDescriptor` help.\n//\n// KNOWN QUIRKS (accepted, by parity with apps/os): no `has` trap on the hop, so `\"x\" in instance`\n// reflects DECLARED members only while `instance.x` conjures a dispatcher — feature-detect with\n// access, not `in`; a typo'd built-in (`itx.strems`) is a syntactically valid dynamic dispatch that\n// fails at the capability table, not a crisp missing-method error.\n//\n// The library tier may import this module and the codec only (library.test.ts).\n\n/** The dispatch door every dotted miss collapses onto. `IterateContextRpcTarget` implements it directly (root\n *  `itx`); a mid-chain `InvokeHandle` implements it relative to itself (empty root). */\ntype InvokeTarget = {\n  invoke(itxExpression: ItxExpression): unknown;\n};\n\n/** Names that must NEVER become dynamic capability segments — a dispatcher answering them would turn\n *  a plain property probe into a live capability call. Enforced at the prototype-chain hop and at\n *  every depth of the path proxies it hands out. Two kinds, one set: */\nconst RESERVED_SEGMENT_NAMES: ReadonlySet<string> = new Set([\n  // JS/RPC protocol machinery a framework or capnweb probes on any object (`then` above all: an\n  // instance must never look thenable, or every `await` of it would resolve a capability).\n  \"__defineGetter__\",\n  \"__defineSetter__\",\n  \"__lookupGetter__\",\n  \"__lookupSetter__\",\n  \"__proto__\",\n  \"apply\",\n  \"bind\",\n  \"call\",\n  \"catch\",\n  \"constructor\",\n  \"dup\",\n  \"finally\",\n  \"hasOwnProperty\",\n  \"isPrototypeOf\",\n  \"map\",\n  \"onRpcBroken\",\n  \"propertyIsEnumerable\",\n  \"prototype\",\n  \"then\",\n  \"toLocaleString\",\n  \"toString\",\n  \"valueOf\",\n  // Names common protocols LOOK UP on arbitrary objects and CALL if callable: JSON.stringify\n  // (toJSON) and vitest/jest equality (asymmetricMatch). The asymmetricMatch case is worse than\n  // noise — vitest treats any object with a callable asymmetricMatch as an asymmetric matcher, and\n  // a dispatcher returning a (truthy) Promise makes the equality SPURIOUSLY PASS. The bar for this\n  // half is HIGH (these names become unreachable as dotted segments; explicit invoke still\n  // reaches them): probed-and-called by ubiquitous protocols AND implausible as capability names.\n  \"toJSON\",\n  \"asymmetricMatch\",\n]);\n\n/** The path proxy: a function-backed Proxy (not an RpcTarget instance) — each missing property\n *  extends `path`, and applying the function reduces the whole accumulated access into ONE\n *  `invoke(expression)` call, `[...root, ...path.slice(0, -1), [path.at(-1), ...args]]`. */\nfunction createItxExpressionPathProxy(\n  invoker: InvokeTarget,\n  root: readonly string[],\n  path: string[],\n): unknown {\n  const valueFor = (key: string) => createItxExpressionPathProxy(invoker, root, [...path, key]);\n  return new Proxy(function () {}, {\n    apply(_target, _thisArg, args) {\n      const method = path[path.length - 1];\n      const expr: ItxExpression = [...root, ...path.slice(0, -1), [method, ...(args as unknown[])]];\n      return invoker.invoke(expr);\n    },\n    get(target, key, receiver) {\n      if (typeof key === \"symbol\") return Reflect.get(target, key, receiver);\n      if (RESERVED_SEGMENT_NAMES.has(key)) return undefined;\n      return valueFor(key);\n    },\n    getOwnPropertyDescriptor(target, key) {\n      const descriptor = Reflect.getOwnPropertyDescriptor(target, key);\n      if (descriptor) return descriptor;\n      if (typeof key === \"symbol\" || RESERVED_SEGMENT_NAMES.has(key)) return undefined;\n      // Cap'n Web's server-side path traversal probes own descriptors before reading a segment, so\n      // dynamic roots must look discoverable here to reach the apply trap.\n      return { configurable: true, enumerable: true, value: valueFor(key), writable: false };\n    },\n    has(target, key) {\n      if (typeof key === \"symbol\") return key in target;\n      return !RESERVED_SEGMENT_NAMES.has(key);\n    },\n  });\n}\n\n/** Install the hop drawn in the header on a class's PROTOTYPE CHAIN, with the scope `root` (`[\"itx\"]`\n *  for the edge context, `[]` for a handle). Call ONCE per class. Constructor inheritance is\n *  untouched — only `Class.prototype`'s parent link changes, and the hop forwards everything it does\n *  not intercept. */\nexport function installPrototypeInvokeFallback<T extends abstract new (...args: never[]) => object>(\n  cls: T,\n  root: readonly string[],\n): void {\n  const parentPrototype = Object.getPrototypeOf(cls.prototype) as object;\n  const hop = new Proxy(Object.create(parentPrototype) as object, {\n    get(hopTarget, key, receiver) {\n      // Symbols and anything the parent chain already answers (dispose protocol, capnweb\n      // internals, Object.prototype) pass through with the instance as receiver.\n      if (typeof key === \"symbol\" || key in hopTarget) {\n        return Reflect.get(hopTarget, key, receiver);\n      }\n      if (RESERVED_SEGMENT_NAMES.has(key)) return undefined;\n      // The dynamic fallback exists for INSTANCES. A lookup whose receiver is not one — someone\n      // probing `Class.prototype.foo` directly, a framework walking prototypes — must see plain\n      // \"undefined\", not conjure a dispatcher over an uninitialized receiver.\n      if (!(receiver instanceof (cls as unknown as abstract new (...args: never[]) => object))) {\n        return undefined;\n      }\n      // The receiver IS the invoker (it implements invoke). Its method resolves at CALL\n      // time, so a trap firing mid-construction (a property miss on `this` before field initializers\n      // ran) can't bake a dispatcher over half-initialized state into the path proxy.\n      return createItxExpressionPathProxy(receiver as unknown as InvokeTarget, root, [key]);\n    },\n  });\n  Object.setPrototypeOf(cls.prototype, hop);\n}\n\n/** A branded, pipelinable handle for a MID-CHAIN capability (`facets.get(name)`, `cd(path)`,\n *  `workers.get(spec)`, a lent stub) whose unknown dotted members reduce into ONE dispatch of the\n *  itx-expression STEPS relative to it; the constructor's `dispatch` routes those steps into the\n *  underlying object. Declared members (`invoke` / `applyRoot`) win over the fallback, so a\n *  capability cannot be named either — the two reserved words this wrapper adds. */\nexport class InvokeHandle extends RpcTarget {\n  readonly #dispatchItxExpressionSteps: (itxExpressionSteps: ItxExpression) => unknown;\n  constructor(dispatchItxExpressionSteps: (itxExpressionSteps: ItxExpression) => unknown) {\n    super();\n    this.#dispatchItxExpressionSteps = dispatchItxExpressionSteps;\n  }\n  /** THE reduce door the prototype hop dispatches onto; the expression is RELATIVE to this handle. */\n  invoke(itxExpressionSteps: ItxExpression): unknown {\n    return this.#dispatchItxExpressionSteps(itxExpressionSteps);\n  }\n  /** Call the bare capability this handle fronts — the ANONYMOUS call step (`callOn` in the dispatch section\n   *  uses it when a rewritten call's target IS a handle: `handle(events, range)`). */\n  applyRoot(args: unknown[]): unknown {\n    return this.#dispatchItxExpressionSteps([[\"\", ...args]]);\n  }\n}\ninstallPrototypeInvokeFallback(InvokeHandle, []);\n\n/** Walk itx-expression steps off a capnweb stub; the ANONYMOUS call step (`\"\"`) calls the value\n *  itself (a bare function lent as a capability). NO await inside the loop: on a capnweb stub every\n *  step is a PIPELINED path, so an n-step chain costs ONE round trip, flushed by the caller's single\n *  await. A DIRECT call on the stub, never `.apply`: reading `.apply` off a capnweb stub's method is\n *  itself a pipelined remote path (`walkSteps`'s DataCloneError learning). Exported for the library\n *  tier, which may import this module only. */\nexport function walkStepsOnRpcStub(stub: unknown, steps: ItxExpression): unknown {\n  let value: unknown = stub;\n  for (const step of steps) {\n    if (typeof step === \"string\") value = (value as Record<string, unknown>)[step];\n    else {\n      const [method, ...args] = step;\n      value =\n        method === \"\"\n          ? (value as (...a: unknown[]) => unknown)(...args)\n          : (value as Record<string, (...a: unknown[]) => unknown>)[method](...args);\n    }\n  }\n  return value;\n}\n\n// ── the two BRANDS the subscription delivery loop reads: the kinds that OWN THEIR PROGRESS, so a push\n// needs no cursor on the stream side (subscription-delivery.ts). Nothing is declared on any event;\n// the brand is minted where the built-in mints the handle. ──\n\n/** `itx.facets.get(name)` / `itx.facets.get(name, { source, className })` — a facet of this context. */\nexport class FacetHandle extends InvokeHandle {}\n\n/** A HANDLE ON THE WIRE IS THE EXPRESSION THAT NAMES IT. An `InvokeHandle` a context mints (`repos.get(path)`,\n *  `workspaces.get(path)`, `facets.get(name)`, `cd(path)`, `workers.get(spec)`) holds no state — it is a\n *  dispatch closure over a path — yet as a Workers-RPC result it would cross a hop as a LIVE stub whose\n *  session keeps the context's actor resident for as long as the holder keeps it (prd 2026-09-22: ~125\n *  such sessions parked around the clock). So the context's RPC door answers with THIS instead: the\n *  caller's own expression, which from the caller's root denotes the same handle; the caller mints its\n *  own handle over it (`materializeItxHandleReference`), and every later verb is one whole call the\n *  context resolves from scratch. Nothing outlives a call. A lent client stub (`RpcStubHandle`) is the\n *  one handle that IS live and crosses as itself. */\nexport const ITX_HANDLE_REFERENCE_KEY = \"$itxHandleExpression\";\nexport type ItxHandleReference = { [ITX_HANDLE_REFERENCE_KEY]: ItxExpression };\n\nexport const isItxHandleReference = (value: unknown): value is ItxHandleReference =>\n  Boolean(value) &&\n  typeof value === \"object\" &&\n  Array.isArray((value as Record<string, unknown>)[ITX_HANDLE_REFERENCE_KEY]);\n\n/** What a context's RPC door hands back for `expression`'s result: a reference when the result is a\n *  path-shaped handle (an `InvokeHandle` that is not a lent stub) or a reference from a hop below —\n *  re-rooted, since `expression` is how THIS caller reached it — else nothing (the result crosses as it\n *  is). Runtime args that fold into a terminal NAME fold here exactly as the resolver folds them, so the\n *  reference is the call the resolver ran; args left over apply to the value and never name a handle. */\nexport function itxHandleReferenceOf(\n  result: unknown,\n  expression: ItxExpression,\n  args: unknown[] = [],\n): ItxHandleReference | undefined {\n  const last = expression.at(-1);\n  const folded =\n    args.length > 0 && typeof last === \"string\" && expression.length > 1\n      ? [...expression.slice(0, -1), [last, ...args] as ItxExpressionStep]\n      : args.length > 0\n        ? undefined\n        : expression;\n  if (!folded) return undefined;\n  const isPathShapedHandle = result instanceof InvokeHandle && !(result instanceof RpcStubHandle);\n  if (!isPathShapedHandle && !isItxHandleReference(result)) return undefined;\n  return { [ITX_HANDLE_REFERENCE_KEY]: folded };\n}\n\n/** The holder's side: a reference becomes a handle of the HOLDER's own whose every dotted call is one\n *  whole expression through `invoke` — the reference's expression plus the steps. Anything else passes\n *  through untouched. The proxy hands relative steps; a caller's own `.invoke(\"itx.whoami()\")` is a\n *  whole call, spelled from the root. */\nexport function materializeItxHandleReference(\n  result: unknown,\n  invoke: (expression: ItxExpression) => unknown,\n): unknown {\n  if (!isItxHandleReference(result)) return result;\n  const expression = result[ITX_HANDLE_REFERENCE_KEY];\n  return new InvokeHandle((steps) =>\n    invoke(\n      typeof steps === \"string\" || steps[0] === \"itx\"\n        ? normalizedItxExpression(steps as ItxExpressionInput)\n        : [...expression, ...steps],\n    ),\n  );\n}\n/** `itx.rpcStubs.get(key)` — a live stub lent to the registry. */\nexport class RpcStubHandle extends InvokeHandle {}\n"],"mappings":";;;;;;;;AAeA,MAAM,kCAAkC;;AAsBxC,MAAa,yBAAyB,SACpC,MAAM,QAAQ,IAAI,IAAI,KAAK,KAAK;AAElC,MAAM,QAAQ;AACd,MAAM,WAAW,IAAI,IAAI;CAAC;CAAa;CAAe;AAAW,CAAC;;AAUlE,MAAM,sBAAsB,EAAE,KAAK,KAAK;;AAExC,MAAa,2BAA2B;;;;;AAMxC,MAAM,oBAAoB,OAAO,GAAG;AACpC,MAAM,qBAAqB,UACzB,MAAM,OAAO,QAAO,MAAM,OAAO,OAAO,MAAM,OAAO;;AAEvD,MAAM,kBAAkB,IAAI,OAAO,GAAG,kBAAkB,gBAAgB,GAAG;;;;;;AAM3E,MAAM,mBAAmB,IAAI,OAAO,oCAAoC,qBAAqB,GAAG;;AAEhG,MAAM,WAAW,IAAI,OAAO,GAAG,kBAAkB,cAAc,GAAG;;AAGlE,MAAa,uBAAuB,UAClC,UAAU,OAAO,mBAAmB;;AAGtC,SAAgB,0BAA0B,OAAyB;CACjE,IAAI,oBAAoB,KAAK,GAAG,OAAO;CACvC,IAAI,MAAM,QAAQ,KAAK,GAAG,OAAO,MAAM,KAAK,yBAAyB;CAErE,IAAI,UAAU,QAAQ,OAAO,UAAU,UACrC,OACG,MAAA,YAAgE,QACjE,OAAO,OAAO,KAAK,CAAC,CAAC,KAAK,yBAAyB;CAEvD,OAAO;AACT;;AAGA,SAAS,cAAc,QAAgB,MAAsB;CAC3D,IAAI,QAAQ;CACZ,SAAS,YAAY;CACrB,KAAK,IAAI,UAAU,SAAS,KAAK,MAAM,GAAG,SAAS,UAAU,SAAS,KAAK,MAAM,GAAG;EAClF,IAAI,kBAAkB,QAAQ,EAAE,GAAG;EACnC,IAAI,MAAM,SAAS,QAAQ,EAAE,GAAG;OAC3B,IAAI,EAAE,UAAU,GAAG,OAAO,QAAQ;CACzC;CACA,MAAM,IAAI,MAAM,iCAAiC,KAAK,UAAU,MAAM,GAAG;AAC3E;;;;AAKA,SAAgB,MAAM,QAAgB,SAA8C;CAClF,IAAI,OAAO,SAAS,iCAClB,MAAM,WACJ,uBACA,mBAAmB,OAAO,OAAO,qBAAqB,gCAAgC,wJACxF;CACF,MAAM,IAAI,OAAO,KAAK;CACtB,MAAM,QAAuB,CAAC;CAC9B,IAAI,IAAI;CACR,SAAS,KAAK,GAAkB;EAC9B,MAAM,IAAI,MAAM,eAAe,EAAE,MAAM,KAAK,UAAU,MAAM,GAAG;CACjE;CACA,MAAM,iBAAyB;EAC7B,MAAM,IAAI,MAAM,KAAK,EAAE,MAAM,CAAC,CAAC;EAC/B,IAAI,CAAC,GAAG,KAAK,oBAAoB,GAAG;EACpC,IAAI,SAAS,IAAI,EAAE,EAAE,GAAG,KAAK,kBAAkB,EAAE,GAAG,EAAE;EACtD,KAAK,EAAE,EAAE,CAAC;EACV,OAAO,EAAE;CACX;CACA,MAAM,KAAK,SAAS,CAAC;CACrB,OAAO,IAAI,EAAE,QAAQ;EACnB,MAAM,IAAI,EAAE;EACZ,IAAI,KAAK,KAAK,CAAC,GAAG;OACb,IAAI,MAAM,KAAK,MAAM,MAAM,KAAK,SAAS,EAAE;OAC3C,IAAI,MAAM,KAAK;GAClB,MAAM,MAAM,cAAc,GAAG,CAAC;GAG9B,MAAM,QAFM,EAAE,MAAM,IAAI,GAAG,GAAG,CAAC,CAAC,KAEhB,CAAC,CAAC,QAAQ,kBAAkB,UAAU;IACpD,IAAI,kBAAkB,KAAK,GAAG,OAAO;IACrC,IAAI,CAAC,SAAS,OACZ,KAAK,mEAAmE;IAC1E,OAAO,UAAU,MACb,KAAK,UAAU,mBAAmB,IAClC,GAAG,KAAK,UAAU,wBAAwB,EAAE;GAClD,CAAC;GACD,IAAI,OAAkB,CAAC;GACvB,IAAI;IACF,IAAI,UAAU,IAAI,OAAO,MAAM,MAAM,IAAI,MAAM,EAAE;GACnD,SAAS,GAAG;IACV,KAAK,4BAA6B,EAAY,QAAQ,EAAE;GAC1D;GACA,MAAM,WAAW,MAAM,GAAG,EAAE;GAC5B,IAAI,MAAM,QAAQ,QAAQ,GACxB,MAAM,KAAK,CAAC,IAAI,GAAG,IAAI,CAAC;QACrB;IACH,MAAM,OAAO,MAAM,IAAI;IACvB,IAAI,OAAO,SAAS,UAAU,KAAK,2BAA2B;IAC9D,IAAI,MAAM,WAAW,GAAG,KAAK,qCAAqC;IAClE,MAAM,KAAK,CAAC,MAAM,GAAG,IAAI,CAAC;GAC5B;GACA,IAAI,MAAM;EACZ,OAAO,KAAK,cAAc,KAAK,UAAU,CAAC,EAAE,MAAM,GAAG;CACvD;CACA,OAAO;AACT;;;;;;AAOA,SAAS,yBAAyB,YAAiC;CACjE,MAAM,QAAQ,MAAqB;EACjC,MAAM,IAAI,MAAM,eAAe,EAAE,MAAM,KAAK,UAAU,UAAU,CAAC,CAAC,MAAM,GAAG,GAAG,GAAG;CACnF;CAEA,IAAI,CAAC,MAAM,QAAQ,UAAU,KAAK,WAAW,WAAW,GACtD,KAAK,oCAAoC;CAC3C,MAAM,QAAQ,MAAc,SAAiB;EAC3C,IAAI,CAAC,MAAM,KAAK,IAAI,KAAK,MAAM,KAAK,IAAI,CAAC,CAAE,OAAO,MAChD,KAAK,GAAG,KAAK,GAAG,KAAK,UAAU,IAAI,EAAE,sBAAsB;EAC7D,IAAI,SAAS,IAAI,IAAI,GAAG,KAAK,kBAAkB,KAAK,EAAE;CACxD;CACA,WAAW,SAAS,MAAM,MAAM;EAC9B,IAAI,OAAO,SAAS,UAAU;GAC5B,KAAK,MAAM,MAAM,IAAI,aAAa,aAAa;GAC/C;EACF;EAEA,IAAI,CAAC,MAAM,QAAQ,IAAI,KAAK,OAAO,KAAK,OAAO,UAC7C,KAAK,QAAQ,EAAE,yCAAyC;EAC1D,MAAM,CAAC,UAAU;EACjB,IAAI,WAAW;OACT,MAAM,KAAK,CAAC,MAAM,QAAQ,WAAW,IAAI,EAAE,GAC7C,KAAK,6CAA6C;EAAA,OAC/C,KAAK,QAAQ,UAAU;EAC9B,IAAI,MAAM,GAAG,KAAK,2BAA2B;CAC/C,CAAC;AAGH;;;;;AAMA,SAAgB,wBACd,OACA,SACe;CACf,IAAI,OAAO,UAAU,UAAU,OAAO,MAAM,OAAO,OAAO;CAC1D,yBAAyB,KAAK;CAC9B,OAAO;AACT;;;;AAKA,MAAa,qBAAqB,MAAc,UAE9C,UAAU,QAAQ,OAAO,UAAU,YAAY,CAAC,MAAM,QAAQ,KAAK,IAC/D,OAAO,YACL,OAAO,KAAK,KAAgC,CAAC,CAC1C,KAAK,CAAC,CACN,KAAK,MAAM,CAAC,GAAI,MAAkC,EAAE,CAAC,CAC1D,IACA;;;;;;AAON,SAAgB,MAAM,MAAqB,SAAuC;CAChF,OAAO,KACJ,KAAK,MAAM,MAAM;EAChB,MAAM,MAAM,IAAI,MAAM;EACtB,IAAI,OAAO,SAAS,UAAU,OAAO,MAAM;EAC3C,MAAM,OAAO,MAAM,UAAU,KAAK,MAAM,CAAC,GAAG,iBAAiB,CAAC,CAAC,MAAM,GAAG,EAAE;EAC1E,MAAM,OAAO,SAAS,QAClB,KAAK,QAAQ,mBAAmB,UAC9B,UAAU,eAAe,MAAM,UAAU,gBAAgB,SAAS,KACpE,IACA;EACJ,OAAO,KAAK,OAAO,KAAK,IAAI,KAAK,KAAK,GAAG,MAAM,KAAK,GAAG,GAAG,KAAK;CACjE,CAAC,CAAC,CACD,KAAK,EAAE;AACZ;;;;;AAMA,SAAgB,yBAAyB,QAAiD;CACxF,MAAM,OAAO,wBAAwB,MAAM;CAC3C,MAAM,UAAU,OAAO,WAAW,WAAW,SAAS,MAAM,IAAI;CAChE,KAAK,MAAM,QAAQ,MAAM;EACvB,IAAI,CAAC,MAAM,QAAQ,IAAI,GAAG;EAC1B,IAAI,KAAK,OAAO,IACd,MAAM,IAAI,MAAM,mDAAmD,KAAK,UAAU,OAAO,GAAG;EAC9F,IAAI,KAAK,WAAW,GAClB,MAAM,IAAI,MACR,iEAAiE,KAAK,UAAU,OAAO,EAAE,QAAQ,KAAK,GAAG,wBAAwB,KAAK,GAAG,EAC3I;CACJ;CACA,OAAO;AACT;;;;AAKA,SAAgB,6BAA6B,QAAoC;CAC/E,OAAO,MAAM,yBAAyB,MAAM,CAAC;AAC/C;AAeA,MAAM,uBAAuE,CAAC;;AAE9E,SAAgB,0BAA0B,OAAyD;CACjG,qBAAqB,KAAK,KAAK;AACjC;AACA,MAAM,aAAa,MAAwB,qBAAqB,MAAM,MAAM,aAAa,CAAC;;;AAI1F,SAAS,QAAQ,OAAe,KAAsB;CACpD,IAAI,QAAQ,eAAe,QAAQ,iBAAiB,QAAQ,aAAa,OAAO,KAAA;CAChF,OAAO,QAAQ,IAAI,OAAO,GAAG;AAC/B;;;;;;;;;;;;;AAcA,eAAsB,UACpB,OACA,OACgD;CAChD,IAAI,EAAE,OAAO,aAAa;CAC1B,KAAK,MAAM,CAAC,WAAW,SAAS,MAAM,QAAQ,GAAG;EAC/C,IAAI,CAAC,UAAU,KAAK,GAAG,QAAQ,MAAM;EACrC,IAAI,SAAS,MACX,MAAM,IAAI,MACR,OAAO,OAAO,KAAK,EAAE,WAAW,YAAY,EAAE,MAAM,MAAM,KAAK,EAAE,IAAI,KAAK,UAAU,IAAI,EAAE,EAC5F;EACF,IAAI,OAAO,SAAS,UAAU;GAC5B,WAAW;GACX,QAAQ,QAAQ,OAAiB,IAAI;EACvC,OAAO;GACL,MAAM,CAAC,QAAQ,GAAG,QAAQ;GAC1B,IAAI,WAAW,IAAI;IAEjB,QAAQ,OAAO,OAAO,UAAU,IAAI;IACpC,WAAW,KAAA;IACX,IAAI,CAAC,UAAU,KAAK,GAAG,QAAQ,MAAM;IACrC;GACF;GACA,MAAM,KAAK,QAAQ,OAAiB,MAAM;GAC1C,IAAI,OAAO,OAAO,YAChB,MAAM,WACJ,gBACA,GAAG,KAAK,UAAU,MAAM,EAAE,2BAA2B,YAAY,EAAE,MAAM,MAAM,KAAK,GACtF;GACF,WAAW,KAAA;GACX,QAAQ,QAAQ,MAAM,IAAI,OAAO,IAAI;GACrC,IAAI,CAAC,UAAU,KAAK,GAAG,QAAQ,MAAM;EACvC;CACF;CACA,OAAO;EAAE,OAAO,UAAU,KAAK,IAAI,QAAQ,MAAM;EAAO;CAAS;AACnE;;;;;;AAOA,eAAsB,OAAO,OAAgB,UAAmB,MAAmC;CACjG,IAAI,OAAO,UAAU,YAAY,OAAO,QAAQ,MAAM,OAAO,UAAU,IAAI;CAC3E,IAAI,iBAAiB,cAAc,OAAO,MAAM,UAAU,IAAI;CAC9D,MAAM,WAAW,gBAAgB,8BAA8B,KAAK,OAAO,oBAAoB;AACjG;;;;AA6CA,MAAM,yBAA8C,IAAI,IAAI;CAG1D;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CAOA;CACA;AACF,CAAC;;;;AAKD,SAAS,6BACP,SACA,MACA,MACS;CACT,MAAM,YAAY,QAAgB,6BAA6B,SAAS,MAAM,CAAC,GAAG,MAAM,GAAG,CAAC;CAC5F,OAAO,IAAI,MAAM,WAAY,CAAC,GAAG;EAC/B,MAAM,SAAS,UAAU,MAAM;GAC7B,MAAM,SAAS,KAAK,KAAK,SAAS;GAClC,MAAM,OAAsB;IAAC,GAAG;IAAM,GAAG,KAAK,MAAM,GAAG,EAAE;IAAG,CAAC,QAAQ,GAAI,IAAkB;GAAC;GAC5F,OAAO,QAAQ,OAAO,IAAI;EAC5B;EACA,IAAI,QAAQ,KAAK,UAAU;GACzB,IAAI,OAAO,QAAQ,UAAU,OAAO,QAAQ,IAAI,QAAQ,KAAK,QAAQ;GACrE,IAAI,uBAAuB,IAAI,GAAG,GAAG,OAAO,KAAA;GAC5C,OAAO,SAAS,GAAG;EACrB;EACA,yBAAyB,QAAQ,KAAK;GACpC,MAAM,aAAa,QAAQ,yBAAyB,QAAQ,GAAG;GAC/D,IAAI,YAAY,OAAO;GACvB,IAAI,OAAO,QAAQ,YAAY,uBAAuB,IAAI,GAAG,GAAG,OAAO,KAAA;GAGvE,OAAO;IAAE,cAAc;IAAM,YAAY;IAAM,OAAO,SAAS,GAAG;IAAG,UAAU;GAAM;EACvF;EACA,IAAI,QAAQ,KAAK;GACf,IAAI,OAAO,QAAQ,UAAU,OAAO,OAAO;GAC3C,OAAO,CAAC,uBAAuB,IAAI,GAAG;EACxC;CACF,CAAC;AACH;;;;;AAMA,SAAgB,+BACd,KACA,MACM;CACN,MAAM,kBAAkB,OAAO,eAAe,IAAI,SAAS;CAC3D,MAAM,MAAM,IAAI,MAAM,OAAO,OAAO,eAAe,GAAa,EAC9D,IAAI,WAAW,KAAK,UAAU;EAG5B,IAAI,OAAO,QAAQ,YAAY,OAAO,WACpC,OAAO,QAAQ,IAAI,WAAW,KAAK,QAAQ;EAE7C,IAAI,uBAAuB,IAAI,GAAG,GAAG,OAAO,KAAA;EAI5C,IAAI,EAAE,oBAAqB,MACzB;EAKF,OAAO,6BAA6B,UAAqC,MAAM,CAAC,GAAG,CAAC;CACtF,EACF,CAAC;CACD,OAAO,eAAe,IAAI,WAAW,GAAG;AAC1C;;;;;;AAOA,IAAa,eAAb,cAAkC,UAAU;CAC1C;CACA,YAAY,4BAA4E;EACtF,MAAM;EACN,KAAKA,8BAA8B;CACrC;;CAEA,OAAO,oBAA4C;EACjD,OAAO,KAAKA,4BAA4B,kBAAkB;CAC5D;;;CAGA,UAAU,MAA0B;EAClC,OAAO,KAAKA,4BAA4B,CAAC,CAAC,IAAI,GAAG,IAAI,CAAC,CAAC;CACzD;AACF;AACA,+BAA+B,cAAc,CAAC,CAAC;;;;;;;AAQ/C,SAAgB,mBAAmB,MAAe,OAA+B;CAC/E,IAAI,QAAiB;CACrB,KAAK,MAAM,QAAQ,OACjB,IAAI,OAAO,SAAS,UAAU,QAAS,MAAkC;MACpE;EACH,MAAM,CAAC,QAAQ,GAAG,QAAQ;EAC1B,QACE,WAAW,KACN,MAAuC,GAAG,IAAI,IAC9C,MAAuD,OAAO,CAAC,GAAG,IAAI;CAC/E;CAEF,OAAO;AACT;;AAOA,IAAa,cAAb,cAAiC,aAAa,CAAC;;;;;;;;;;AAW/C,MAAa,2BAA2B;AAGxC,MAAa,wBAAwB,UACnC,QAAQ,KAAK,KACb,OAAO,UAAU,YACjB,MAAM,QAAS,MAAA,uBAA2D;;;;;;AAO5E,SAAgB,qBACd,QACA,YACA,OAAkB,CAAC,GACa;CAChC,MAAM,OAAO,WAAW,GAAG,EAAE;CAC7B,MAAM,SACJ,KAAK,SAAS,KAAK,OAAO,SAAS,YAAY,WAAW,SAAS,IAC/D,CAAC,GAAG,WAAW,MAAM,GAAG,EAAE,GAAG,CAAC,MAAM,GAAG,IAAI,CAAsB,IACjE,KAAK,SAAS,IACZ,KAAA,IACA;CACR,IAAI,CAAC,QAAQ,OAAO,KAAA;CAEpB,IAAI,EADuB,kBAAkB,gBAAgB,EAAE,kBAAkB,mBACtD,CAAC,qBAAqB,MAAM,GAAG,OAAO,KAAA;CACjE,OAAO,GAAG,2BAA2B,OAAO;AAC9C;;;;;AAMA,SAAgB,8BACd,QACA,QACS;CACT,IAAI,CAAC,qBAAqB,MAAM,GAAG,OAAO;CAC1C,MAAM,aAAa,OAAO;CAC1B,OAAO,IAAI,cAAc,UACvB,OACE,OAAO,UAAU,YAAY,MAAM,OAAO,QACtC,wBAAwB,KAA2B,IACnD,CAAC,GAAG,YAAY,GAAG,KAAK,CAC9B,CACF;AACF;;AAEA,IAAa,gBAAb,cAAmC,aAAa,CAAC"}

package/dist/next/lib.d.ts

@@ -0,0 +1,56 @@
+/** The stable machine-readable codes — SCREAMING_SNAKE, defined once, both ends import this. */
+type ErrorCode = "SCHEDULE_LIMIT" | "INVALID_INPUT" | "IDENTITY_CONFLICT" | "GRANT_NOT_FOUND" | "NO_ITX_EXPRESSION_MATCH" | "IDEMPOTENCY_CONFLICT" | "OFFSET_CONFLICT" | "EVENT_TOO_LARGE" | "REDUCE_CHECKPOINT_TOO_LARGE" | "EVENT_UNREADABLE" | "STREAM_PAUSED" | "INVALID_CONTEXT" | "EXPRESSION_TOO_LONG" | "FACET_SOURCE_TOO_LARGE" | "INVALID_CREDENTIALS" | "UNAUTHENTICATED" | "FORBIDDEN" | "PROJECT_NAME_TAKEN" | "RPC_STUB_OFFLINE" | "NOT_A_METHOD" | "NO_FACET" | "FACET_NO_UPGRADE" | "WAIT_TIMEOUT" | "TIMEOUT";
+/** A plain Error carrying `code` (+ optional `data`) as own enumerable properties. */
+export declare function codedError(code: ErrorCode, message: string, data?: unknown): Error;
+/** The code of an error that crossed any number of hops — undefined for uncoded errors. */
+export declare function errorCode(error: unknown): ErrorCode | undefined;
+type Scalar = string | number | boolean | null;
+/** Print ONE bounded console.error line for an unexpected failure; never throws. */
+export declare function reportIssue(failureSite: string, caught: unknown, attributes?: Record<string, Scalar | undefined>): void;
+export type PatchOp = {
+    op: "add";
+    path: string;
+    value: unknown;
+} | {
+    op: "replace";
+    path: string;
+    value: unknown;
+} | {
+    op: "remove";
+    path: string;
+};
+/** Structural deep-equal over plain JSON values — order-insensitive, unbudgeted (JSON is acyclic).
+ *  THE one deep-equal: the live-state diff's "don't emit" test AND the idempotency-body compare
+ *  (re-exported through stream/processor.ts). The `Object.hasOwn(b, k)` guard is load-bearing — without
+ *  it, two objects with the same key COUNT but different key SETS compare equal. */
+export declare function jsonEqual(a: unknown, b: unknown): boolean;
+/** Structural diff `a → b`, or undefined when deep-equal (the producer's "don't emit" signal).
+ *  Objects recurse per key; arrays get the chat-log fast paths (pure append → `add …/-` ops,
+ *  pure tail-truncate → `remove` ops) and are replaced wholesale on any middle divergence —
+ *  the LiveView trade: optimize the growing log, full-render the rewrite.
+ *  Both sides are JSON-normalized first — the wire is JSON, so the diff must see exactly what
+ *  the wire will carry: undefined-valued keys vanish, Dates become their ISO strings, array
+ *  holes become null. Diffing what you didn't normalize is how a Date change goes silent. */
+export declare function diff(a: unknown, b: unknown): PatchOp[] | undefined;
+/** Apply a patch non-mutatingly (clone-then-mutate). The client half of `diff` — exported
+ *  through the SDK so subscribers need no third-party json-patch dependency. */
+export declare function applyPatch<T>(doc: T, ops: PatchOp[]): T;
+export declare function withTimeout<T>(promise: Promise<T>, ms: number, what: string | (() => string)): Promise<T>;
+/** Whether `request` may spend the cookies it carries: its `Origin` header is this origin, or absent
+ *  (a non-browser client — curl, a script). A browser stamps the page's origin on every WebSocket
+ *  handshake, every cross-site fetch and every form POST, so a foreign origin means a foreign site
+ *  drove the request with the visitor's cookie riding along. A malformed `Origin` (the literal
+ *  `null` of a sandboxed document included) is foreign. */
+export declare function isSameOriginBrowserRequest(request: Pick<Request, "url" | "headers">): boolean;
+/** `next` as a path on `origin`, else "/" — a redirect never leaves the host: `//evil.example`,
+ *  `/\evil.example` and an absolute URL all resolve to a foreign origin and fall back to "/". The
+ *  issuer's login redirect uses it too (os-next issuer-pages.ts). */
+export declare function sameOriginPath(next: string, origin: string): string;
+/** Only plain HTTP loopback origins use development login and client registration. */
+export declare function isLocalOrigin(origin: string): boolean;
+/** Resolve a `cd` target against a context's own path — the one resolver every `cd` (the edge
+ *  method, the built-in root, the library's relative handles) shares. Absolute ("/agents/x") stands alone; relative
+ *  ("agents/x", "../inbox", ".") joins onto `base`. `.` and `..` resolve; the root cannot be
+ *  escaped ("/.." is "/"). The result is canonical: leading slash, no trailing slash but for "/". */
+export declare function resolveContextPath(basePath: string, contextPath: string): string;
+export {};