prae-cli 0.9.2 → 0.10.0

package/lib/pack-h5n43S0F.js

@@ -0,0 +1,448 @@
+import { t as FRAMEWORKS } from "./frameworks-BgZHGKiH.js";
+
+//#region ../kernel/src/pack.ts
+function isObject(value) {
+	return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+var Check = class {
+	errors = [];
+	fail(path, message) {
+		this.errors.push({
+			path,
+			message
+		});
+	}
+	/** Reject any key the shape does not define. */
+	keys(path, value, allowed) {
+		for (const key of Object.keys(value)) if (!allowed.includes(key)) this.fail(`${path}.${key}`, `unknown field \`${key}\`; expected one of ${allowed.map((k) => `\`${k}\``).join(", ")}`);
+	}
+	text(path, value) {
+		if (typeof value !== "string" || value.trim() === "") {
+			this.fail(path, "expected a non-empty string");
+			return;
+		}
+		return value;
+	}
+	/** A field that accepts one name or a list of them. */
+	names(path, value) {
+		if (typeof value === "string") return value;
+		if (Array.isArray(value)) {
+			const out = [];
+			value.forEach((entry, index) => {
+				const one = this.text(`${path}[${index}]`, entry);
+				if (one !== void 0) out.push(one);
+			});
+			return out;
+		}
+		this.fail(path, "expected a string or an array of strings");
+	}
+	globs(path, value) {
+		if (!Array.isArray(value)) {
+			this.fail(path, "expected an array of path globs");
+			return;
+		}
+		const out = [];
+		value.forEach((entry, index) => {
+			const one = this.text(`${path}[${index}]`, entry);
+			if (one !== void 0) out.push(one);
+		});
+		return out;
+	}
+	number(path, value) {
+		if (typeof value !== "number" || !Number.isFinite(value)) {
+			this.fail(path, "expected a finite number");
+			return;
+		}
+		return value;
+	}
+};
+function readCommandMatch(check, path, value) {
+	if (!isObject(value)) {
+		check.fail(path, "expected an object");
+		return;
+	}
+	check.keys(path, value, [
+		"name",
+		"token",
+		"anyToken",
+		"pipedTo",
+		"pipeline"
+	]);
+	if (value.name === void 0 && value.token === void 0 && value.anyToken === void 0 && value.pipedTo === void 0 && value.pipeline === void 0) check.fail(path, "expected `name`, `token`, `anyToken`, `pipedTo` or `pipeline`; a command matcher with none matches nothing");
+	const out = {};
+	if (value.token !== void 0) {
+		const tokens = check.names(`${path}.token`, value.token);
+		if (tokens !== void 0) out.token = tokens;
+	}
+	if (value.name !== void 0) {
+		const names = check.names(`${path}.name`, value.name);
+		if (names !== void 0) out.name = names;
+	}
+	if (value.anyToken !== void 0) {
+		const tokens = check.names(`${path}.anyToken`, value.anyToken);
+		if (tokens !== void 0) out.anyToken = tokens;
+	}
+	if (value.pipedTo !== void 0) {
+		const pipes = check.names(`${path}.pipedTo`, value.pipedTo);
+		if (pipes !== void 0) out.pipedTo = pipes;
+	}
+	if (value.pipeline !== void 0) {
+		const shapes = check.names(`${path}.pipeline`, value.pipeline);
+		if (shapes !== void 0) out.pipeline = shapes;
+	}
+	return out;
+}
+function readPathMatch(check, path, value) {
+	if (!isObject(value)) {
+		check.fail(path, "expected an object");
+		return;
+	}
+	check.keys(path, value, [
+		"arg",
+		"outside",
+		"inside"
+	]);
+	if (value.outside === void 0 && value.inside === void 0) check.fail(path, "expected `inside` or `outside`; a path matcher with neither matches nothing");
+	const out = {};
+	if (value.arg !== void 0) {
+		const arg = check.text(`${path}.arg`, value.arg);
+		if (arg !== void 0) out.arg = arg;
+	}
+	if (value.outside !== void 0) {
+		const globs = check.globs(`${path}.outside`, value.outside);
+		if (globs !== void 0) out.outside = globs;
+	}
+	if (value.inside !== void 0) {
+		const globs = check.globs(`${path}.inside`, value.inside);
+		if (globs !== void 0) out.inside = globs;
+	}
+	return out;
+}
+function readHostMatch(check, path, value) {
+	if (!isObject(value)) {
+		check.fail(path, "expected an object");
+		return;
+	}
+	check.keys(path, value, [
+		"arg",
+		"in",
+		"notIn"
+	]);
+	if (value.in === void 0 && value.notIn === void 0) check.fail(path, "expected `in` or `notIn`; a host matcher with neither matches nothing");
+	const out = {};
+	if (value.arg !== void 0) {
+		const arg = check.text(`${path}.arg`, value.arg);
+		if (arg !== void 0) out.arg = arg;
+	}
+	if (value.in !== void 0) {
+		const list = check.globs(`${path}.in`, value.in);
+		if (list !== void 0) out.in = list;
+	}
+	if (value.notIn !== void 0) {
+		const list = check.globs(`${path}.notIn`, value.notIn);
+		if (list !== void 0) out.notIn = list;
+	}
+	return out;
+}
+function readArgMatch(check, path, value) {
+	if (!isObject(value)) {
+		check.fail(path, "expected an object");
+		return;
+	}
+	check.keys(path, value, [
+		"name",
+		"above",
+		"below",
+		"equals",
+		"oneOf",
+		"present"
+	]);
+	const name = check.text(`${path}.name`, value.name);
+	if (name === void 0) return void 0;
+	const out = { name };
+	if (value.above !== void 0) {
+		const n = check.number(`${path}.above`, value.above);
+		if (n !== void 0) out.above = n;
+	}
+	if (value.below !== void 0) {
+		const n = check.number(`${path}.below`, value.below);
+		if (n !== void 0) out.below = n;
+	}
+	if (value.equals !== void 0) out.equals = value.equals;
+	if (value.oneOf !== void 0) if (!Array.isArray(value.oneOf)) check.fail(`${path}.oneOf`, "expected an array");
+	else out.oneOf = value.oneOf;
+	if (value.present !== void 0) if (typeof value.present !== "boolean") check.fail(`${path}.present`, "expected a boolean");
+	else out.present = value.present;
+	return out;
+}
+function readSecretsMatch(check, path, value) {
+	if (!isObject(value)) {
+		check.fail(path, "expected an object");
+		return;
+	}
+	check.keys(path, value, [
+		"types",
+		"minConfidence",
+		"atLeast"
+	]);
+	const out = {};
+	if (value.types !== void 0) {
+		const types = check.globs(`${path}.types`, value.types);
+		if (types !== void 0) out.types = types;
+	}
+	if (value.minConfidence !== void 0) {
+		const n = check.number(`${path}.minConfidence`, value.minConfidence);
+		if (n !== void 0) if (n < 0 || n > 1) check.fail(`${path}.minConfidence`, "expected a number between 0 and 1");
+		else out.minConfidence = n;
+	}
+	if (value.atLeast !== void 0) {
+		const n = check.number(`${path}.atLeast`, value.atLeast);
+		if (n !== void 0) if (!Number.isInteger(n) || n < 1) check.fail(`${path}.atLeast`, "expected an integer of at least 1");
+		else out.atLeast = n;
+	}
+	return out;
+}
+function readMatch(check, path, value) {
+	if (!isObject(value)) {
+		check.fail(path, "expected an object");
+		return {};
+	}
+	check.keys(path, value, [
+		"tool",
+		"capability",
+		"plugin",
+		"agent",
+		"command",
+		"path",
+		"host",
+		"arg",
+		"count",
+		"secrets"
+	]);
+	const out = {};
+	for (const key of [
+		"tool",
+		"capability",
+		"plugin",
+		"agent"
+	]) if (value[key] !== void 0) {
+		const names = check.names(`${path}.${key}`, value[key]);
+		if (names !== void 0) out[key] = names;
+	}
+	if (value.command !== void 0) {
+		const match = readCommandMatch(check, `${path}.command`, value.command);
+		if (match !== void 0) out.command = match;
+	}
+	if (value.path !== void 0) {
+		const match = readPathMatch(check, `${path}.path`, value.path);
+		if (match !== void 0) out.path = match;
+	}
+	if (value.host !== void 0) {
+		const match = readHostMatch(check, `${path}.host`, value.host);
+		if (match !== void 0) out.host = match;
+	}
+	if (value.arg !== void 0) if (!Array.isArray(value.arg)) check.fail(`${path}.arg`, "expected an array of argument matchers");
+	else {
+		const list = [];
+		value.arg.forEach((entry, index) => {
+			const one = readArgMatch(check, `${path}.arg[${index}]`, entry);
+			if (one !== void 0) list.push(one);
+		});
+		out.arg = list;
+	}
+	if (value.count !== void 0) if (!isObject(value.count)) check.fail(`${path}.count`, "expected an object");
+	else {
+		check.keys(`${path}.count`, value.count, ["above"]);
+		const above = check.number(`${path}.count.above`, value.count.above);
+		if (above !== void 0) out.count = { above };
+	}
+	if (value.secrets !== void 0) {
+		const match = readSecretsMatch(check, `${path}.secrets`, value.secrets);
+		if (match !== void 0) out.secrets = match;
+	}
+	return out;
+}
+function readEffect(check, path, value) {
+	if (!isObject(value)) {
+		check.fail(path, "expected an object");
+		return;
+	}
+	const kind = value.kind === "hold" ? "ask" : value.kind;
+	if (kind !== "deny" && kind !== "ask" && kind !== "correct" && kind !== "warn" && kind !== "allow") {
+		check.fail(`${path}.kind`, "expected `allow`, `deny`, `hold` (or `ask`), `correct`, or `warn`");
+		return;
+	}
+	check.keys(path, value, kind === "correct" ? [
+		"kind",
+		"set",
+		"because"
+	] : ["kind", "because"]);
+	const because = check.text(`${path}.because`, value.because);
+	if (because === void 0) return void 0;
+	if (kind === "correct") {
+		if (!isObject(value.set) || Object.keys(value.set).length === 0) {
+			check.fail(`${path}.set`, "expected a non-empty object of arguments to set");
+			return;
+		}
+		return {
+			kind,
+			set: value.set,
+			because
+		};
+	}
+	return {
+		kind,
+		because
+	};
+}
+function readRule(check, path, value) {
+	if (!isObject(value)) {
+		check.fail(path, "expected an object");
+		return;
+	}
+	check.keys(path, value, [
+		"id",
+		"title",
+		"description",
+		"when",
+		"effect",
+		"frameworks"
+	]);
+	const id = check.text(`${path}.id`, value.id);
+	const effect = readEffect(check, `${path}.effect`, value.effect);
+	if (value.when === void 0) check.fail(`${path}.when`, "expected an object");
+	const when = readMatch(check, `${path}.when`, value.when ?? {});
+	if (id === void 0 || effect === void 0) return void 0;
+	const rule = {
+		id,
+		when,
+		effect
+	};
+	if (value.title !== void 0) {
+		const title = check.text(`${path}.title`, value.title);
+		if (title !== void 0) rule.title = title;
+	}
+	if (value.description !== void 0) {
+		const description = check.text(`${path}.description`, value.description);
+		if (description !== void 0) rule.description = description;
+	}
+	if (value.frameworks !== void 0) {
+		const frameworks = readFrameworks(check, `${path}.frameworks`, value.frameworks);
+		if (frameworks !== void 0) rule.frameworks = frameworks;
+	}
+	return rule;
+}
+/**
+* A citation names a framework edition and controls the registry knows. A
+* typo here would be a rule that claims a mapping no view can render, so it
+* is a pack error rather than an ignored key — the same line the rest of the
+* parser takes.
+*/
+function readFrameworks(check, path, value) {
+	if (!isObject(value)) {
+		check.fail(path, "expected an object keyed by framework id");
+		return;
+	}
+	const out = {};
+	for (const [framework, controls] of Object.entries(value)) {
+		const known = FRAMEWORKS[framework];
+		if (known === void 0) {
+			check.fail(`${path}.${framework}`, `unknown framework; expected one of ${Object.keys(FRAMEWORKS).map((k) => `\`${k}\``).join(", ")}`);
+			continue;
+		}
+		if (!Array.isArray(controls) || !controls.every((c) => typeof c === "string")) {
+			check.fail(`${path}.${framework}`, "expected an array of control ids");
+			continue;
+		}
+		const ids = controls;
+		for (const control of ids) if (known.controls[control] === void 0) check.fail(`${path}.${framework}`, `unknown control \`${control}\` in ${known.name}`);
+		if (ids.length > 0) out[framework] = [...new Set(ids)];
+	}
+	return out;
+}
+/** Parse and validate a pack. Never throws; every problem lands in `errors`. */
+function parsePack(source) {
+	let raw;
+	try {
+		raw = JSON.parse(source);
+	} catch (error) {
+		return {
+			ok: false,
+			errors: [{
+				path: "",
+				message: `invalid JSON: ${error instanceof Error ? error.message : String(error)}`
+			}]
+		};
+	}
+	const check = new Check();
+	if (!isObject(raw)) return {
+		ok: false,
+		errors: [{
+			path: "",
+			message: "expected an object"
+		}]
+	};
+	check.keys("", raw, [
+		"prae",
+		"pack",
+		"version",
+		"description",
+		"owner",
+		"expires_at",
+		"baseline",
+		"rules"
+	]);
+	if (raw.prae !== "0.1") check.fail(".prae", "expected `\"0.1\"`; this is the only pack version this build reads");
+	const name = check.text(".pack", raw.pack);
+	const version = check.text(".version", raw.version);
+	const description = raw.description === void 0 ? void 0 : check.text(".description", raw.description);
+	const owner = raw.owner === void 0 ? void 0 : check.text(".owner", raw.owner);
+	const expires = raw.expires_at === void 0 ? void 0 : check.text(".expires_at", raw.expires_at);
+	if (expires !== void 0 && (!/^\d{4}-\d{2}-\d{2}T\d{2}:\d{2}(:\d{2}(\.\d+)?)?(Z|[+-]\d{2}:\d{2})$/.test(expires) || !Number.isFinite(Date.parse(expires)))) check.fail(".expires_at", "expected an ISO 8601 time with a zone, e.g. 2026-10-05T12:00:00Z");
+	let baseline;
+	if (raw.baseline !== void 0) if (!isObject(raw.baseline)) check.fail(".baseline", "expected an object");
+	else {
+		check.keys(".baseline", raw.baseline, ["capabilities"]);
+		const caps = check.globs(".baseline.capabilities", raw.baseline.capabilities);
+		if (caps !== void 0) baseline = { capabilities: caps };
+	}
+	const rules = [];
+	if (!Array.isArray(raw.rules)) check.fail(".rules", "expected an array");
+	else {
+		const seen = /* @__PURE__ */ new Set();
+		raw.rules.forEach((entry, index) => {
+			const rule = readRule(check, `rules[${index}]`, entry);
+			if (rule === void 0) return;
+			if (seen.has(rule.id)) {
+				check.fail(`rules[${index}].id`, `duplicate rule id \`${rule.id}\``);
+				return;
+			}
+			seen.add(rule.id);
+			rules.push(rule);
+		});
+	}
+	if (check.errors.length > 0) return {
+		ok: false,
+		errors: check.errors
+	};
+	if (name === void 0 || version === void 0) return {
+		ok: false,
+		errors: check.errors
+	};
+	return {
+		ok: true,
+		pack: {
+			prae: "0.1",
+			pack: name,
+			version,
+			...description === void 0 ? {} : { description },
+			...owner === void 0 ? {} : { owner },
+			...expires === void 0 ? {} : { expires_at: expires },
+			...baseline === void 0 ? {} : { baseline },
+			rules
+		}
+	};
+}
+
+//#endregion
+export { parsePack as t };

package/lib/playground.js

@@ -984,6 +984,7 @@
 			"version",
 			"description",
 			"owner",
+			"expires_at",
 			"baseline",
 			"rules"
 		]);
@@ -992,6 +993,8 @@
 		const version = check.text(".version", raw.version);
 		const description = raw.description === void 0 ? void 0 : check.text(".description", raw.description);
 		const owner = raw.owner === void 0 ? void 0 : check.text(".owner", raw.owner);
+		const expires = raw.expires_at === void 0 ? void 0 : check.text(".expires_at", raw.expires_at);
+		if (expires !== void 0 && (!/^\d{4}-\d{2}-\d{2}T\d{2}:\d{2}(:\d{2}(\.\d+)?)?(Z|[+-]\d{2}:\d{2})$/.test(expires) || !Number.isFinite(Date.parse(expires)))) check.fail(".expires_at", "expected an ISO 8601 time with a zone, e.g. 2026-10-05T12:00:00Z");
 		let baseline;
 		if (raw.baseline !== void 0) if (!isObject(raw.baseline)) check.fail(".baseline", "expected an object");
 		else {
@@ -1030,6 +1033,7 @@
 				version,
 				...description === void 0 ? {} : { description },
 				...owner === void 0 ? {} : { owner },
+				...expires === void 0 ? {} : { expires_at: expires },
 				...baseline === void 0 ? {} : { baseline },
 				rules
 			}

package/lib/{receipt-check-DQK_gVPc.js → receipt-check-CUuEjGHL.js}

@@ -1,4 +1,4 @@
-import { c as fingerprint, f as verifyReceipt } from "./src-LA7NdLKb.js";
+import { m as verifyReceipt, u as fingerprint } from "./src-Cy-Acrgj.js";
 
 //#region src/receipt-check.ts
 /** Shape we require before we will call it a receipt at all. */

package/lib/{src-LA7NdLKb.js → src-Cy-Acrgj.js}

@@ -1,5 +1,5 @@
 import { appendFileSync, closeSync, existsSync, fstatSync, mkdirSync, openSync, readFileSync, readSync, readdirSync, statSync, unlinkSync, writeFileSync } from "node:fs";
-import { dirname, join } from "node:path";
+import { dirname, join, resolve } from "node:path";
 import { createCipheriv, createDecipheriv, createHash, createPrivateKey, createPublicKey, generateKeyPairSync, randomBytes, scryptSync, sign, verify } from "node:crypto";
 
 //#region ../ledger/src/entry.ts
@@ -178,13 +178,16 @@ function unsealPrivateKey(sealed, passphrase) {
 	if (match === null) throw new Error("not a PRAE sealed key (an older format?): make a new one with prae keygen --role");
 	const box = JSON.parse(Buffer.from((match[1] ?? "").replace(/\s/g, ""), "base64").toString("utf8"));
 	if (box.v !== 1 || box.kdf !== "scrypt") throw new Error("unknown sealing");
-	const decipher = createDecipheriv("aes-256-gcm", scryptSync(passphrase, Buffer.from(String(box.salt), "base64"), 32, {
+	const wrap = scryptSync(passphrase, Buffer.from(String(box.salt), "base64"), 32, {
 		N: Number(box.N),
 		r: Number(box.r),
 		p: Number(box.p),
 		maxmem: SCRYPT.maxmem
-	}), Buffer.from(String(box.iv), "base64"));
-	decipher.setAuthTag(Buffer.from(String(box.tag), "base64"));
+	});
+	const tag = Buffer.from(String(box.tag), "base64");
+	if (tag.length !== 16) throw new Error("sealed key: authentication tag is not 16 bytes");
+	const decipher = createDecipheriv("aes-256-gcm", wrap, Buffer.from(String(box.iv), "base64"), { authTagLength: 16 });
+	decipher.setAuthTag(tag);
 	return createPrivateKey({
 		key: Buffer.concat([decipher.update(Buffer.from(String(box.data), "base64")), decipher.final()]),
 		format: "der",
@@ -207,14 +210,15 @@ function readEntries(text) {
 	return text.split("\n").filter((line) => line.trim() !== "").map((line) => JSON.parse(line));
 }
 /** Re-derive every hash and confirm each entry names its predecessor. */
-function verifyEntries(text) {
+function verifyEntries(text, from) {
 	const problems = [];
-	let expectedPrev = GENESIS;
-	let expectedSeq = 0;
+	let expectedPrev = from?.prev ?? GENESIS;
+	let expectedSeq = from?.seq ?? 0;
 	let count = 0;
+	const offset = from?.line ?? 0;
 	const lines = text.split("\n").filter((line) => line.trim() !== "");
 	for (const [index, line] of lines.entries()) {
-		const at = index + 1;
+		const at = offset + index + 1;
 		count += 1;
 		let entry;
 		try {
@@ -301,6 +305,16 @@ const STALE_LOCK_MS = 1e4;
 /** Run `fn` holding an exclusive lock file; synchronous, like the append. */
 function withLock(lock, fn) {
 	const deadline = Date.now() + 3e4;
+	for (;;) {
+		const done = tryLock(lock, fn);
+		if (done !== BUSY) return done;
+		if (Date.now() > deadline) throw new Error(`prae ledger: ${lock} has been held for 30 s; refusing to append without it`);
+		Atomics.wait(SLEEP, 0, 0, 2);
+	}
+}
+const BUSY = Symbol("busy");
+/** Run `fn` holding the lock if it is free now (or stale); `BUSY` if not. */
+function tryLock(lock, fn) {
 	for (;;) {
 		let fd;
 		try {
@@ -313,9 +327,7 @@ function withLock(lock, fn) {
 					continue;
 				}
 			} catch {}
-			if (Date.now() > deadline) throw new Error(`prae ledger: ${lock} has been held for 30 s; refusing to append without it`);
-			Atomics.wait(SLEEP, 0, 0, 2);
-			continue;
+			return BUSY;
 		}
 		try {
 			return fn();
@@ -361,19 +373,30 @@ var Ledger = class Ledger {
 	}
 	/** Append one decision and return the entry as written. */
 	append(record) {
-		return withLock(`${this.path}.lock`, () => {
-			const { seq, last } = tailOf(this.path);
-			const sealed = chain(record, seq, last);
-			const entry = this.signer !== void 0 ? {
-				...sealed,
-				sig: this.signer(sealed)
-			} : this.signWith === void 0 ? sealed : {
-				...sealed,
-				sig: signEntry(sealed, this.signWith)
-			};
-			appendFileSync(this.path, `${JSON.stringify(entry)}\n`);
-			return entry;
-		});
+		return withLock(`${this.path}.lock`, () => this.write(record));
+	}
+	/**
+	* Append only if no other writer holds the lock right now; `undefined`
+	* when one does. For a process that must not block while it waits —
+	* one that answers other writers' signers (PRA-143), whose writers hold
+	* the lock until it answers.
+	*/
+	tryAppend(record) {
+		const done = tryLock(`${this.path}.lock`, () => this.write(record));
+		return done === BUSY ? void 0 : done;
+	}
+	write(record) {
+		const { seq, last } = tailOf(this.path);
+		const sealed = chain(record, seq, last);
+		const entry = this.signer !== void 0 ? {
+			...sealed,
+			sig: this.signer(sealed)
+		} : this.signWith === void 0 ? sealed : {
+			...sealed,
+			sig: signEntry(sealed, this.signWith)
+		};
+		appendFileSync(this.path, `${JSON.stringify(entry)}\n`);
+		return entry;
 	}
 	/** Every entry, in order. */
 	read() {
@@ -396,4 +419,60 @@ var Ledger = class Ledger {
 const nap = new Int32Array(new SharedArrayBuffer(4));
 
 //#endregion
-export { hashEntry as _, signBytes as a, fingerprint as c, signEntry as d, verifyReceipt as f, chain as g, canonical as h, sealedKeypair as i, generateKeypair as l, GENESIS as m, readEntries as n, unsealPrivateKey as o, verifySignature as p, verifyEntries as r, verifyBytes as s, Ledger as t, makeReceipt as u, seal as v };
+//#region ../ledger/src/verify-cache.ts
+const prefixes = /* @__PURE__ */ new Map();
+const sha = (s) => createHash("sha256").update(s).digest("hex");
+function verifyGrowing(path, publicKey) {
+	const raw = readFileSync(path, "utf8");
+	const text = raw.slice(0, raw.lastIndexOf("\n") + 1);
+	const slot = `${path}\u0000${publicKey ?? ""}`;
+	const known = prefixes.get(slot);
+	const from = known !== void 0 && known.key === publicKey && text.length >= known.length && sha(text.slice(0, known.length)) === known.sha ? known : void 0;
+	const fresh = from === void 0 ? text : text.slice(from.length);
+	const verified = verifyEntries(fresh, from === void 0 ? void 0 : {
+		prev: from.head,
+		seq: from.seq,
+		line: from.entries
+	});
+	let checked = from?.checked ?? 0;
+	const failed = [...from?.failed ?? []];
+	let rows = [];
+	try {
+		rows = readEntries(fresh);
+	} catch {
+		rows = [];
+	}
+	if (publicKey !== void 0) for (const e of rows) {
+		if (e.sig === void 0) continue;
+		checked += 1;
+		if (!verifySignature(e, e.sig, publicKey)) failed.push(e.seq);
+	}
+	const entries = (from?.entries ?? 0) + verified.entries;
+	const problems = [...from?.problems ?? [], ...verified.problems];
+	const last = rows.at(-1);
+	if (rows.length === verified.entries) prefixes.set(slot, {
+		length: text.length,
+		sha: sha(text),
+		key: publicKey,
+		head: last?.hash ?? from?.head ?? GENESIS,
+		seq: last === void 0 ? from?.seq ?? 0 : last.seq + 1,
+		entries,
+		checked,
+		failed,
+		problems
+	});
+	else prefixes.delete(slot);
+	return {
+		ok: problems.length === 0,
+		entries,
+		problems,
+		signatures: publicKey === void 0 ? null : {
+			checked,
+			failed
+		},
+		text
+	};
+}
+
+//#endregion
+export { canonical as _, verifyEntries as a, seal as b, unsealPrivateKey as c, generateKeypair as d, makeReceipt as f, GENESIS as g, verifySignature as h, tailOf as i, verifyBytes as l, verifyReceipt as m, Ledger as n, sealedKeypair as o, signEntry as p, readEntries as r, signBytes as s, verifyGrowing as t, fingerprint as u, chain as v, hashEntry as y };

package/lib/{src-CwBEFhww.js → src-DMoYsdfo.js}

@@ -1,3 +1,3 @@
-import { a as scan, i as looksBinary, n as MAX_SCAN_BYTES, r as entropy, t as DETECTORS } from "./src-B25SHWcz.js";
+import { a as scan, i as looksBinary, n as MAX_SCAN_BYTES, r as entropy, t as DETECTORS } from "./src-BuaOiL2v.js";
 
 export { DETECTORS, MAX_SCAN_BYTES, entropy, looksBinary, scan };

package/lib/src-wG36kT6K.js

@@ -0,0 +1,3 @@
+import { _ as canonical, a as verifyEntries, b as seal, c as unsealPrivateKey, d as generateKeypair, f as makeReceipt, g as GENESIS, h as verifySignature, i as tailOf, l as verifyBytes, m as verifyReceipt, n as Ledger, o as sealedKeypair, p as signEntry, r as readEntries, s as signBytes, t as verifyGrowing, u as fingerprint, v as chain, y as hashEntry } from "./src-Cy-Acrgj.js";
+
+export { GENESIS, Ledger, canonical, chain, fingerprint, generateKeypair, hashEntry, makeReceipt, readEntries, seal, sealedKeypair, signBytes, signEntry, tailOf, unsealPrivateKey, verifyBytes, verifyEntries, verifyGrowing, verifyReceipt, verifySignature };

package/lib/{test-run-CCDgJ0Dp.js → test-run-C8dHjIE2.js}

@@ -1,4 +1,4 @@
-import { t as evaluate } from "./evaluate-BqLxhYiP.js";
+import { t as evaluate } from "./evaluate-DhoGQw0Z.js";
 
 //#region src/test-run.ts
 /** The path argument a scenario's call carries, if any. */