code wiki / (root) / nx_site_publish_prepare_lib_t256.nx
`nx_site_publish_prepare_lib_t256.nx` source

↩ module page · 804 lines · 44156 B
1// nx_site_publish_lib.nx -- ARTIFACT-PUBLISH, LIBRARY half (sp_main dispatcher) capability (closes the coverage BUILD-queue gap "artifact-publish";
2// retires the ssh-cat content lane for pages). Places a NAS-local file into the live sites docroot the
3// SAFE way, composing the proven IO layer:
4//   publish <src-file> <site> <relpath>  ->  sites/<site>/<relpath>
5//     - ATOMIC placement via fsx_write (tmp+fsync+rename -- a browser never sees a torn page)
6//     - PRIOR VERSION PRESERVED: an existing target is first copied to <relpath>.prev (rename-not-delete
7//       doctrine; one-deep history -- generated artifacts, git holds sources)
8//     - DENY BY CONSTRUCTION (fsx_write_denied: secrets/device-ns/allowlist) PLUS path-traversal refusal:
9//       any ".." segment or absolute site/relpath is DENIED (an MCP caller must not escape the docroot)
10//   The organ prints the live URL; verification is the SEPARATE browser-grade organ (composition, not a
11//   built-in fallback): run nx_page_verify <url> from a WAN vantage (on-NAS bare-domain fetches hit DSM --
12//   the documented trap). The publish->verify recipe is the contract; this organ does the placement half.
13//     - THE PUBLISH GATEWAY (F763 second half, wired 2026-07-30): for a site listed in
14//       knowledge/pub_sites.conf, a <relpath> absent from that site's publishing REGISTRY -- or
15//       carrying a non-publishable status (withdrawn/redirect/debris) -- is REFUSED. This is the
16//       half that makes "random and arbitrary" impossible instead of merely visible: nx_pub_desk
17//       stated the rule in 2026-07-19 and its own header recorded that enforcement inside the
18//       publish organ was never wired, so anything could be dropped into any docroot and become
19//       site truth. MEASURED before wiring: 54 pages served on nishifamily.com were in NO registry.
20//       Sites NOT in the site table publish UNGATED (with a warning) -- onboarding is a config row,
21//       and a control that refuses everything on day one is a control someone disables by lunchtime.
22// exit: 0 ok | 2 usage | 3 src absent | 4 io | 5 DENIED  license_tier: ORIGINAL
23import "nx_fsops_lib.nx"   // fsx_write (atomic + write-deny), vw_read, vw_slen, fsx_puts, fsx_putn
24import "nx_pub_lib.nx"     // pl_site_lookup + pl_check -- the registry gateway
25import "nx_pub_release_prepare_candidate_t256.nx"
26import "nx_sha256.nx"
27import "nx_comparestale_lib.nx"
28import "nx_json.nx"
29import "json_emit.nx"
30
31const PB_ARG_VERB: i64 = 1      // argv: verb ("publish")
32const PB_RC_USAGE: i64 = 2      // exit: usage
33const PB_ARG_SRC: i64 = 2       // argv: source file (NAS-local)
34const PB_ARG_SITE: i64 = 3      // argv: site dir under sites/
35const PB_ARG_REL: i64 = 4       // argv: page path under the site
36const PB_ARGC: i64 = 5          // publish src site relpath
37const PB_STAGE_ARGC: i64 = 6    // stage src site releases/<path> sha256
38const PB_GUARDED_ARGC: i64 = PB_STAGE_ARGC + 1 // adds expected live digest
39const PB_GUARDED_SIZED_ARGC: i64 = PB_GUARDED_ARGC + 1 // optional exact artifact extent
40const PB_PATH: i64 = 1024       // destination path buffer
41const PB_CONFCAP: i64 = 65536   // site-table read buffer (the gateway)
42const PB_SPANCAP: i64 = 128     // site-table span vector
43const PB_DOT: i64 = 46          // '.'
44const PB_SLASH: i64 = 47        // '/'
45
46// any ".." path segment, or a leading '/', or empty -> traversal refusal (1 = refuse)
47func pb_traversal(s: *u8) -> i64 {
  if s[0] == (0 as u8) { return 1 }
  if s[0] == (PB_SLASH as u8) { return 1 }
  var i: i64 = 0
  while s[i] != (0 as u8) {
      if s[i] == (PB_DOT as u8) { if s[i+1] == (PB_DOT as u8) { return 1 } }
      // Reject aliases before deriving the target lock: ./ and // could name the same file
      // using different lock paths or conceal the reserved release namespace.
      if s[i] == (PB_SLASH as u8) {
          if s[i+1] == (PB_SLASH as u8) { return 1 }
          if s[i+1] == (0 as u8) { return 1 }
      }
      var segment_start: i64 = 0
      if i == 0 { segment_start = 1 } else {
          if s[i-1] == (PB_SLASH as u8) { segment_start = 1 }
      }
      if segment_start == 1 {
          if s[i] == (PB_DOT as u8) {
              if (s[i+1] == (PB_SLASH as u8)) || (s[i+1] == (0 as u8)) { return 1 }
          }
      }
      i = i + 1
  }
  return 0
71}
72// append NUL-terminated src to out at *op
73func pb_app(out: *u8, op: *i64, s: *u8) -> i64 {
  var i: i64 = 0
  var o: i64 = op[0]
  while s[i] != (0 as u8) { out[o] = s[i]; o = o + 1; i = i + 1 }
  out[o] = 0 as u8
  op[0] = o
  return 0
80}
81
82// Artifact equality is byte-counted: WASM and other binary assets contain NUL bytes.
83func pb_same_bytes(a: *u8, an: i64, b: *u8, bn: i64) -> i64 {
  if an != bn { return 0 }
  if an < 0 { return 0 }
  var i: i64 = 0
  while i < an { if a[i] != b[i] { return 0 }; i = i + 1 }
  return 1
89}
90
91const PB_LOCK_EX_NB: i64 = 6
92const PB_RC_CONFLICT: i64 = 8
93const PB_RC_BUSY: i64 = 9
94const PB_SHA_BYTES: i64 = 32
95const PB_SHA_HEX: i64 = 64
96func pb_hash(body: *u8, n: i64, hex: *u8) -> i64 {
  let raw: *u8 = sys_mmap(PB_SHA_BYTES)
  sha256_digest(body,n,raw)
  let digits: *u8 = "0123456789abcdef" as *u8
  var i: i64 = 0
  while i < PB_SHA_BYTES {
      let c: i64 = raw[i] as i64
      hex[i*2] = digits[c/16]; hex[i*2+1] = digits[c%16]
      i = i+1
  }
  hex[PB_SHA_HEX] = 0 as u8
  sys_munmap(raw,PB_SHA_BYTES)
  return 0
109}
110
111const PB_SIZED_ARGC: i64 = 7
112const PB_I64_MAX: i64 = 9223372036854775807
113func pb_sized_bytes(s: *u8) -> i64 {
  var value: i64=0
  var i: i64=0
  while s[i] != (0 as u8) {
      let c: i64=s[i] as i64
      if c < 48 || c > 57 { return 0-1 }
      if value > (PB_I64_MAX/2-1-(c-48))/10 { return 0-1 }
      value=value*10+c-48; i=i+1
  }
  if value <= 0 { return 0-1 }
  return value
124}
125func pb_read_bounded(path: *u8,b: *u8,cap: i64) -> i64 {
  let fd: i64=sys_openat_rd(path)
  if fd < 0 { return fd }
  var n: i64=0
  var go: i64=1
  while n < cap && go == 1 {
      let got: i64=sys_read(fd,((b as i64)+n) as *u8,cap-n)
      if got < 0 { sys_close(fd); return got }
      if got == 0 { go=0 } else { n=n+got }
  }
  sys_close(fd)
  return n
137}
138
139func pb_main_edge(argc: i64, argv: *i64, edge_rel: *u8, edge_sha: *u8) -> i64 {
  if argc < PB_ARGC { return pb_publish_locked_edge(argc,argv,edge_rel,edge_sha) }
  let verb: *u8 = argv[PB_ARG_VERB] as *u8
  if fsx_seq(verb,"publish" as *u8) == 0 {
      if fsx_seq(verb,"stage" as *u8) == 1 {
          if argc != PB_STAGE_ARGC { return PB_RC_USAGE }
      } else {
          if fsx_seq(verb,"publish-guarded" as *u8) == 0 { if fsx_seq(verb,"stage-sized" as *u8) == 0 { return PB_RC_USAGE } }
          if argc != PB_GUARDED_ARGC {
              if fsx_seq(verb,"publish-guarded" as *u8) == 0 || argc != PB_GUARDED_SIZED_ARGC { return PB_RC_USAGE }
          }
      }
  }
  let site: *u8 = argv[PB_ARG_SITE] as *u8
  let rel: *u8 = argv[PB_ARG_REL] as *u8
  var si: i64 = 0
  while site[si] != (0 as u8) {
      if site[si] == (PB_SLASH as u8) { return FSX_RC_DENIED }
      si = si + 1
  }
  if fsx_seq(verb,"stage" as *u8) == 1 || fsx_seq(verb,"stage-sized" as *u8) == 1 {
      if pb_release_path(rel) == 0 {
          fsx_puts("NX-PUBLISH DENIED stage requires releases/<candidate-path>; live URL is not a staging target\n" as *u8)
          return FSX_RC_DENIED
      }
  }
  if pb_traversal(site) == 1 { return FSX_RC_DENIED }
  if pb_traversal(rel) == 1 { return FSX_RC_DENIED }
  if vw_slen(site)+vw_slen(rel)+vw_slen("sites//.publish-lock" as *u8)+1 >= PB_PATH { return FSX_RC_DENIED }
  let path: *u8 = sys_mmap(PB_PATH)
  let pos: *i64 = sys_mmap(8) as *i64
  pos[0] = 0
  pb_app(path,pos,"sites/" as *u8);pb_app(path,pos,site)
  pb_app(path,pos,"/" as *u8);pb_app(path,pos,rel)
  if fsx_write_denied(path) == 1 { return FSX_RC_DENIED }
  // Keep one stable inode per target; unlinking a lock lets contenders lock different inodes.
  pb_app(path,pos,".publish-lock" as *u8)
  let fd: i64 = sys_openat_wr(path,FSX_MODE_RW)
  if fd < 0 { fsx_puts("NX-PUBLISH IO lock-parent-unavailable\n" as *u8);return FSX_RC_IO }
  if sys_flock(fd,PB_LOCK_EX_NB) != 0 {
      sys_close(fd)
      fsx_puts("NX-PUBLISH BUSY target-owned retry-after-owner-completes\n" as *u8)
      return PB_RC_BUSY
  }
  let rc: i64 = pb_publish_locked_edge(argc,argv,edge_rel,edge_sha)
  sys_close(fd)
  return rc
186}
187// Every publisher verb enforces this namespace, so a legacy publish cannot replace a tested candidate.
188// The site registry still authorizes each release path; staging does not bypass publication policy.
189func pb_release_path(rel: *u8) -> i64 {
  let prefix: *u8 = "releases/" as *u8
  var i: i64 = 0
  while prefix[i] != (0 as u8) {
      if rel[i] != prefix[i] { return 0 }
      i = i + 1
  }
  return (rel[i] != (0 as u8)) as i64
197}
198func pb_publish_locked_edge(argc: i64, argv: *i64, edge_rel: *u8, edge_sha: *u8) -> i64 {
  var okverb: i64 = 0
  if argc >= PB_ARGC { if fsx_seq(argv[PB_ARG_VERB] as *u8, "publish" as *u8) == 1 { okverb = 1 } }
  if argc == PB_GUARDED_ARGC || argc == PB_GUARDED_SIZED_ARGC { if fsx_seq(argv[PB_ARG_VERB] as *u8,"publish-guarded" as *u8) == 1 { okverb = 1 } }
  if argc == PB_STAGE_ARGC { if fsx_seq(argv[PB_ARG_VERB] as *u8,"stage" as *u8) == 1 { okverb = 1 } }
  if argc == PB_SIZED_ARGC { if fsx_seq(argv[PB_ARG_VERB] as *u8,"stage-sized" as *u8) == 1 { okverb = 1 } }
  if okverb == 0 {
      fsx_puts("usage: nx_site_publish publish <src-file> <site> <relpath>   (-> sites/<site>/<relpath>; then verify: nx_page_verify <url>)\n" as *u8)
      fsx_puts("       nx_site_publish publish-guarded <src-file> <site> <relpath> <sha256> <expected-live-sha256|absent> [exact-bytes]\n       nx_site_publish stage <src-file> <site> releases/<candidate-path> <sha256>\nStaging verifies file identity only; browser and dependency acceptance are separate evidence.\n" as *u8)
      return PB_RC_USAGE
  }
  let site: *u8 = argv[PB_ARG_SITE] as *u8
  let rel: *u8 = argv[PB_ARG_REL] as *u8
  if pb_traversal(site) == 1 {
      fsx_puts("NX-PUBLISH DENIED: site escapes the docroot ('..'/absolute/empty)\n" as *u8)
      return FSX_RC_DENIED
  }
  if pb_traversal(rel) == 1 {
      fsx_puts("NX-PUBLISH DENIED: relpath escapes the docroot ('..'/absolute/empty)\n" as *u8)
      return FSX_RC_DENIED
  }
  // ---- THE PUBLISH GATEWAY: the registry decides what may exist at this URL, not the caller ----
  let gw_conf: *u8 = sys_mmap(PB_CONFCAP)
  let gw_spans: *i64 = sys_mmap(PB_SPANCAP) as *i64
  var release_prefix: *u8 = 0 as *u8
  var registry_checked: i64 = 0
  if pl_site_lookup("knowledge/pub_sites.conf" as *u8, site, gw_conf, gw_spans) == 1 {
      registry_checked = 1
      let gw_pfx: *u8 = sys_mmap(PB_PATH)
      pl_span_cstr(gw_conf, gw_spans[2], gw_spans[3], gw_pfx)
      var row_status: i64 = 0
      if pb_release_path(rel) == 1 { release_prefix = gw_pfx } else { row_status = pl_check(gw_pfx,rel) }
      if row_status != 0 {
          fsx_puts("NX-PUBLISH REFUSED: " as *u8); fsx_puts(rel)
          fsx_puts(" is not a publishable row in this site's registry.\n" as *u8)
          fsx_puts("  The registry -- not the caller -- decides what may exist at a URL. Either the path is\n" as *u8)
          fsx_puts("  unregistered, or its status is withdrawn/redirect/debris.\n" as *u8)
          fsx_puts("  Register it (id/title/owner/status/section/path/note, status=live|asset|draft) in " as *u8)
          fsx_puts(gw_pfx); fsx_puts(" ,\n" as *u8)
          fsx_puts("  or run: nx_pub_plane adopt " as *u8); fsx_puts(site)
          fsx_puts("   to bring existing docroot entries in. Then re-run this publish.\n" as *u8)
          return FSX_RC_DENIED
      }
  } else {
      fsx_puts("NX-PUBLISH WARN: site '" as *u8); fsx_puts(site)
      fsx_puts("' is not in knowledge/pub_sites.conf -- publishing UNGATED (add a row to gate it).\n" as *u8)
  }
  // stage-sized declares its exact artifact size; the read budget is that size plus one
  // to distinguish complete bytes from truncation. Legacy verbs retain their existing cap.
  var readcap: i64 = FSX_READ_CAP
  var wanted: i64 = 0
  var size_arg: i64 = 0
  if fsx_seq(argv[PB_ARG_VERB] as *u8,"stage-sized" as *u8) == 1 {
      size_arg=6
      if (release_prefix as i64) == 0 { return FSX_RC_DENIED }
  }
  if argc == PB_GUARDED_SIZED_ARGC && fsx_seq(argv[PB_ARG_VERB] as *u8,"publish-guarded" as *u8) == 1 {
      size_arg=7
      if registry_checked != 1 { return FSX_RC_DENIED }
  }
  if size_arg > 0 {
      wanted=pb_sized_bytes(argv[size_arg] as *u8)
      if wanted < 0 { return PB_RC_USAGE }
      readcap=wanted+1
  }
  let body: *u8 = sys_mmap(readcap + 1)
  let n: i64 = pb_read_bounded(argv[PB_ARG_SRC] as *u8, body, readcap)
  if wanted > 0 { if n != wanted { fsx_puts("NX-PUBLISH REFUSED source-size-mismatch\n" as *u8); return PB_RC_CONFLICT } }
  if n <= 0 {
      fsx_puts("NX-PUBLISH ABSENT: cannot read source " as *u8); fsx_puts(argv[PB_ARG_SRC] as *u8); fsx_puts("\n" as *u8)
      return FSX_RC_ABSENT
  }
  if n == readcap { fsx_puts("NX-PUBLISH REFUSED: source at/over the 1MiB organ cap -- use the mgmt upload lane\n" as *u8); return FSX_RC_IO }
  // The owned body is checked once here and later passed unchanged to fsx_write.
  if (edge_rel as i64)>0 {
      let edge_rc: i64=pe_check(body,n,argv,edge_rel,edge_sha)
      if edge_rc!=0{return edge_rc}
  }
  // Every verb checks the registered content, including legacy publish without a caller hash.
  if (release_prefix as i64) != 0 {
      let release_hash: *u8 = sys_mmap(PB_SHA_HEX+1)
      pb_hash(body,n,release_hash)
      let registered: i64 = pr_check(release_prefix,rel,release_hash)
      sys_munmap(release_hash,PB_SHA_HEX+1)
      if registered != PR_OK {
          fsx_puts("NX-PUBLISH REFUSED release-registration code=" as *u8); fsx_putn(registered)
          fsx_puts(" path=" as *u8); fsx_puts(rel)
          fsx_puts("; verify catalogue integrity and registered digest before retrying\n" as *u8)
          if registered == PR_IO { return FSX_RC_IO }
          return PB_RC_CONFLICT
      }
  }
  // build dst = sites/<site>/<relpath>
  let dst: *u8 = sys_mmap(PB_PATH)
  let op: *i64 = sys_mmap(8) as *i64
  op[0] = 0
  pb_app(dst, op, "sites/" as *u8)
  pb_app(dst, op, site)
  pb_app(dst, op, "/" as *u8)
  pb_app(dst, op, rel)
  // preserve the prior version (one-deep; rename-not-delete doctrine)
  // The predecessor has its own extent: a smaller incoming artifact must still retain it whole.
  var priorcap: i64 = readcap
  if wanted > 0 {
      let priorfd: i64 = sys_openat_rd(dst)
      if priorfd >= 0 {
          let extent: i64 = sys_lseek(priorfd,0,FSX_SEEK_END)
          let closed: i64 = sys_close(priorfd)
          if extent < 0 || extent > PB_I64_MAX/2-1 || closed != 0 {
              fsx_puts("NX-PUBLISH REFUSED prior-extent-unavailable-or-overflow\n" as *u8)
              return FSX_RC_IO
          }
          if extent >= priorcap { priorcap=extent+1 }
      } else {
          if priorfd != (0-2) { fsx_puts("NX-PUBLISH REFUSED prior-open-error\n" as *u8);return FSX_RC_IO }
      }
  }
  let old: *u8 = sys_mmap(priorcap + 1)
  if (old as i64) <= 0 { fsx_puts("NX-PUBLISH REFUSED prior-allocation-failed\n" as *u8);return FSX_RC_IO }
  let on: i64 = pb_read_bounded(dst, old, priorcap)
  // A retry must retain the last DIFFERENT version, not replace it with the current one.
  if fsx_write_denied(dst) == 1 {
      fsx_puts("NX-PUBLISH DENIED: destination rejected before retry comparison\n" as *u8)
      return FSX_RC_DENIED
  }
  if on >= priorcap { fsx_puts("NX-PUBLISH REFUSED prior-at-read-cap\n" as *u8);return FSX_RC_IO }
  let staged: i64 = fsx_seq(argv[PB_ARG_VERB] as *u8,"stage" as *u8) | fsx_seq(argv[PB_ARG_VERB] as *u8,"stage-sized" as *u8)
  if (fsx_seq(argv[PB_ARG_VERB] as *u8,"publish-guarded" as *u8) == 1) || (staged == 1) {
      let incoming: *u8 = sys_mmap(PB_SHA_HEX+1)
      pb_hash(body,n,incoming)
      if fsx_seq(incoming,argv[5] as *u8) == 0 {
          fsx_puts("NX-PUBLISH CONFLICT artifact-sha256-mismatch\n" as *u8)
          return PB_RC_CONFLICT
      }
      // A retry with the same result succeeds after its predecessor has changed.
      if (staged == 0) && (pb_same_bytes(body,n,old,on) == 0) {
          let current: *u8 = sys_mmap(PB_SHA_HEX+1)
          if on < 0 {
              let stat: *u8 = sys_mmap(160)
              if sys_fstatat(dst,stat) != (0-2) { return FSX_RC_IO }
              if fsx_seq(argv[6] as *u8,"absent" as *u8) == 0 { return PB_RC_CONFLICT }
          } else {
              pb_hash(old,on,current)
              if fsx_seq(current,argv[6] as *u8) == 0 {
                  fsx_puts("NX-PUBLISH CONFLICT live-sha256-mismatch\n" as *u8)
                  return PB_RC_CONFLICT
              }
          }
      }
  }
  if (pb_release_path(rel) == 1) && (pb_same_bytes(body,n,old,on) == 0) {
      // A failed read is not absence. Only kernel ENOENT permits a new release path.
      let stat: *u8 = sys_mmap(160)
      let observed: i64 = sys_fstatat(dst,stat)
      if observed != (0-2) {
          if observed == 0 {
              fsx_puts("NX-PUBLISH CONFLICT immutable-release-path; retain tested bytes and stage a new candidate path\n" as *u8)
              return PB_RC_CONFLICT
          }
          fsx_puts("NX-PUBLISH IO release-target-stat errno=" as *u8);fsx_putn(observed)
          fsx_puts(" target=" as *u8);fsx_puts(dst);fsx_puts("; resolve target access before retry\n" as *u8)
          return FSX_RC_IO
      }
  }
  if pb_same_bytes(body, n, old, on) == 1 {
      fsx_puts("NX-PUBLISH UNCHANGED bytes=" as *u8); fsx_putn(n)
      fsx_puts(" -> " as *u8); fsx_puts(dst)
      fsx_puts(" prior_version=retained writes=0\n" as *u8)
      return 0
  }
  if on > 0 {
      let prev: *u8 = sys_mmap(PB_PATH)
      let pp: *i64 = sys_mmap(8) as *i64
      pp[0] = 0
      pb_app(prev, pp, dst)
      pb_app(prev, pp, ".prev" as *u8)
      let pw: i64 = fsx_write(prev, old, on)
      if pw < 0 { fsx_puts("NX-PUBLISH IO: could not preserve .prev; refusing to overwrite\n" as *u8); return FSX_RC_IO }
  }
  // atomic placement through the IO layer (write-deny classes included by construction)
  let w: i64 = fsx_write(dst, body, n)
  if w < 0 {
      // ⚠THE SILENT EXIT, FIXED (debt seq910). Every other failure path in sp_main prints
      // a diagnostic; this one returned an error code and NOT ONE WORD. Measured 2026-07-25:
      // `publish <src> nishifamily research/rt004.html` produced EMPTY output and published
      // nothing, which reads exactly like success to a caller that only sees stdout.
      // ROOT CAUSE (read, not guessed): fsx_write does NOT create parent directories --
      // sys_openat_wr fails and it returns -3 -- so any relpath containing a subdirectory
      // fails here when sites/<site>/<subdir>/ is absent. Auto-creating docroot directories
      // is a deliberate NON-goal (deny-by-construction), so the fix is to FAIL LOUD and name
      // the cause rather than to start creating directories.
      if w == 0 - (2 as i64) {
          fsx_puts("NX-PUBLISH DENIED: the IO layer refused this destination -> " as *u8)
          fsx_puts(dst); fsx_puts("\n" as *u8)
          return FSX_RC_DENIED
      }
      fsx_puts("NX-PUBLISH IO-FAIL: NOTHING WAS PUBLISHED -> " as *u8); fsx_puts(dst); fsx_puts("\n" as *u8)
      fsx_puts("  likely cause: the parent directory does not exist (this organ never creates docroot dirs).\n" as *u8)
      fsx_puts("  if <relpath> contains a subdirectory, create it first or publish to a flat relpath.\n" as *u8)
      return FSX_RC_IO
  }
  fsx_puts("NX-PUBLISH OK bytes=" as *u8); fsx_putn(w)
  fsx_puts(" -> " as *u8); fsx_puts(dst)
  fsx_puts("\nVERIFY (browser-grade, WAN vantage): nx_page_verify https://<site-domain>/" as *u8); fsx_puts(rel)
  fsx_puts("   (site->domain map: surfaces.reg)\n" as *u8)
  return 0
404}
405
406const PE_ARGC: i64=10
407// This lock coordinates only publishers honoring the immutable registered release contract.
408func pe_main(argc: i64,argv: *i64) -> i64 {
if argc!=PE_ARGC{return PB_RC_USAGE}
// Refuse a missing/nonwritable caller output before open can reuse descriptor1 for a lock.
if sys_write(1,"",0)!=0{return FSX_RC_IO}
let site: *u8=argv[3] as *u8;let rel: *u8=argv[8] as *u8
if pb_traversal(site)==1||pb_traversal(rel)==1||pr_path_ok(rel)==0||pr_hash_ok(argv[9] as *u8)==0{return FSX_RC_DENIED}
var i: i64=0;while site[i]!=0{if site[i]==47{return FSX_RC_DENIED};i=i+1}
if fsx_seq(rel,argv[4] as *u8)==1{return FSX_RC_DENIED}
if vw_slen(site)+vw_slen(rel)+vw_slen("sites//.publish-lock")+1>=PB_PATH{return FSX_RC_DENIED}
let lock: *u8=sys_mmap_shared(PB_PATH);let pos: *i64=sys_mmap_shared(8) as *i64
let normalized: *i64=sys_mmap_shared((PB_GUARDED_SIZED_ARGC+1)*8) as *i64
var rc: i64=FSX_RC_IO
if (lock as i64)>0&&(pos as i64)>0&&(normalized as i64)>0 {
pos[0]=0;pb_app(lock,pos,"sites/");pb_app(lock,pos,site);pb_app(lock,pos,"/");pb_app(lock,pos,rel)
if fsx_write_denied(lock)==0 {
 pb_app(lock,pos,".publish-lock");let fd: i64=sys_openat_wr(lock,FSX_MODE_RW)
 if fd>=0 {
  if sys_flock(fd,PB_LOCK_EX_NB)==0 {
   i=0;while i<PB_GUARDED_SIZED_ARGC{normalized[i]=argv[i];i=i+1};normalized[i]=0;normalized[1]="publish-guarded" as *u8 as i64
   rc=pb_main_edge(PB_GUARDED_SIZED_ARGC,normalized,rel,argv[9] as *u8)
  } else {rc=PB_RC_BUSY;fsx_puts("NX-PUBLISH BUSY selected-dependency-owned\n")}
  if sys_close(fd)!=0{rc=FSX_RC_IO;fsx_puts("NX-PUBLISH IO dependency-lock-close; inspect placement outcome\n")}
 }
} else {rc=FSX_RC_DENIED}
}
if (normalized as i64)>0{if sys_munmap(normalized as *u8,(PB_GUARDED_SIZED_ARGC+1)*8)!=0{rc=FSX_RC_IO}}
if (pos as i64)>0{if sys_munmap(pos as *u8,8)!=0{rc=FSX_RC_IO}}
if (lock as i64)>0{if sys_munmap(lock,PB_PATH)!=0{rc=FSX_RC_IO}}
return rc
437}
438func sp_main(argc: i64,argv: *i64) -> i64 {
if argc>1{if fsx_seq(argv[1] as *u8,"prepare-path")==1{
if argc!=4{return PB_RC_USAGE}
let rc:i64=pb_prepare_path(argv[2] as *u8,argv[3] as *u8)
fsx_puts("NX-PUBLISH PREPARE rc=");fsx_putn(rc);fsx_puts(" registered-path-only=1 published=0\n")
return rc
}}
if argc>1{if fsx_seq(argv[1] as *u8,"prepare-release")==1{return rm_prepare_main(argc,argv)}}
if argc>1{if fsx_seq(argv[1] as *u8,"release-manifest")==1{return rm_main(argc,argv)}}
if argc>1{if fsx_seq(argv[1] as *u8,"publish-guarded-edge")==1{return pe_main(argc,argv)}}
return pb_main_edge(argc,argv,0 as *u8,0 as *u8)
449}
450func pe_check(body: *u8,n: i64,argv: *i64,rel: *u8,sha: *u8) -> i64 {
let conf: *u8=sys_mmap_shared(PB_CONFCAP);let spans: *i64=sys_mmap_shared(PB_SPANCAP) as *i64
let prefix: *u8=sys_mmap_shared(PB_PATH);let path: *u8=sys_mmap_shared(PB_PATH);let token: *u8=sys_mmap_shared(PB_PATH)
let av: *i64=sys_mmap_shared(8*8) as *i64;let pos: *i64=sys_mmap_shared(8) as *i64
var rc: i64=FSX_RC_IO
if (conf as i64)>0&&(spans as i64)>0&&(prefix as i64)>0&&(path as i64)>0&&(token as i64)>0&&(av as i64)>0&&(pos as i64)>0 {
if pl_site_lookup("knowledge/pub_sites.conf",argv[3] as *u8,conf,spans)==1 {
 if spans[3]-spans[2]<PB_PATH {
  pl_span_cstr(conf,spans[2],spans[3],prefix)
  let registered: i64=pr_check(prefix,rel,sha)
  if registered==PR_OK {
   pos[0]=0;pb_app(path,pos,"sites/");pb_app(path,pos,argv[3] as *u8);pb_app(path,pos,"/");pb_app(path,pos,rel)
   pos[0]=0;pb_app(token,pos,"/");pb_app(token,pos,rel)
   av[0]="nx_comparestale" as *u8 as i64;av[1]="dependency-check" as *u8 as i64;av[2]=argv[2];av[3]=argv[5];av[4]=path as i64;av[5]=sha as i64;av[6]=token as i64;av[7]=0
   let observed: i64=cd_buffer_command(7,av,body,n)
   if observed==0{rc=0}else{if observed==1{rc=PB_RC_CONFLICT}else{rc=FSX_RC_IO}}
  } else {if registered==PR_IO{rc=FSX_RC_IO}else{rc=PB_RC_CONFLICT};fsx_puts("NX-PUBLISH REFUSED selected-dependency-registration\n")}
 }
} else {rc=FSX_RC_DENIED;fsx_puts("NX-PUBLISH DENIED selected-edge requires registered site\n")}
}
if (pos as i64)>0{if sys_munmap(pos as *u8,8)!=0{rc=FSX_RC_IO}}
if (av as i64)>0{if sys_munmap(av as *u8,64)!=0{rc=FSX_RC_IO}}
if (token as i64)>0{if sys_munmap(token,PB_PATH)!=0{rc=FSX_RC_IO}}
if (path as i64)>0{if sys_munmap(path,PB_PATH)!=0{rc=FSX_RC_IO}}
if (prefix as i64)>0{if sys_munmap(prefix,PB_PATH)!=0{rc=FSX_RC_IO}}
if (spans as i64)>0{if sys_munmap(spans as *u8,PB_SPANCAP)!=0{rc=FSX_RC_IO}}
if (conf as i64)>0{if sys_munmap(conf,PB_CONFCAP)!=0{rc=FSX_RC_IO}}
return rc
478}
479
480// Compatibility entry: callers retain the original two-argument API.
481func pb_publish_locked(argc: i64,argv: *i64) -> i64 {return pb_publish_locked_edge(argc,argv,0 as *u8,0 as *u8)}
482
483// One selected immutable dependency, matching the existing guarded-edge contract.
484// Registration is opt-in on this verb only; legacy publication authority is unchanged.
485const RM_FIELDS: i64=12
486const RM_VALUES_BYTES: i64=RM_FIELDS*8
487const RM_SCHEMA: *u8="site-release/v1"
488const RM_RECEIPT_ROOT: *u8="knowledge/gates/"
489func rm_key(k: *u8) -> i64 {
if fsx_seq(k,"schema")==1{return 0};if fsx_seq(k,"site")==1{return 1}
if fsx_seq(k,"consumer_source")==1{return 2};if fsx_seq(k,"consumer_path")==1{return 3}
if fsx_seq(k,"consumer_sha256")==1{return 4};if fsx_seq(k,"consumer_bytes")==1{return 5}
if fsx_seq(k,"expected_live")==1{return 6};if fsx_seq(k,"dependency_source")==1{return 7}
if fsx_seq(k,"dependency_path")==1{return 8};if fsx_seq(k,"dependency_sha256")==1{return 9}
if fsx_seq(k,"dependency_bytes")==1{return 10};if fsx_seq(k,"registration")==1{return 11}
return 0-1
497}
498// This path-oriented schema deliberately refuses escapes rather than interpreting them differently.
499func rm_string(t: *NxJsonTok) -> *u8 {
if nx_json_next(t)!=NX_JSON_STRING{return 0 as *u8}
let n: i64=t.tok_len-2
if n<=0||n>=PB_PATH{return 0 as *u8}
let v: *u8=sys_mmap(n+1);if (v as i64)<=0{return 0 as *u8}
var i: i64=0
while i<n{let c: i64=t.src[t.tok_off+1+i] as i64;if c==92||c<32{sys_munmap(v,n+1);return 0 as *u8};v[i]=c as u8;i=i+1}
v[n]=0;return v
507}
508func rm_parse_tokens(t: *NxJsonTok,v: *i64) -> i64 {
if nx_json_next(t)!=NX_JSON_LBRACE{return PB_RC_USAGE}
var count: i64=0
while count<RM_FIELDS {
let k: *u8=rm_string(t);if (k as i64)<=0{return PB_RC_USAGE}
let idx: i64=rm_key(k);sys_munmap(k,vw_slen(k)+1)
if idx<0{return PB_RC_USAGE};if v[idx]!=0{return PB_RC_USAGE}
if nx_json_next(t)!=NX_JSON_COLON{return PB_RC_USAGE}
let value: *u8=rm_string(t);if (value as i64)<=0{return PB_RC_USAGE}
v[idx]=value as i64;count=count+1
let separator: i64=nx_json_next(t)
if separator==NX_JSON_RBRACE{if count!=RM_FIELDS{return PB_RC_USAGE};if nx_json_next(t)!=NX_JSON_EOF{return PB_RC_USAGE};return 0}
if separator!=NX_JSON_COMMA{return PB_RC_USAGE}
}
return PB_RC_USAGE
523}
524func rm_parse(body: *u8,n: i64,v: *i64) -> i64 {
let t: *NxJsonTok=nx_json_new(body,n);if (t as i64)<=0{return FSX_RC_IO}
let rc: i64=rm_parse_tokens(t,v);sys_munmap(t as *u8,NX_JSONTOK_BYTES);return rc
527}
528
529func rm_num(out: *u8,pos: *i64,value: i64) -> i64 {
// Internal epoch/PID/exit values are bounded; digits use the caller-owned receipt buffer.
var n: i64=value
if n<0{pb_app(out,pos,"-");n=0-n}
let start: i64=pos[0]
if n==0{pb_app(out,pos,"0")}else{
while n>0{out[pos[0]]=(48+n%10) as u8;pos[0]=pos[0]+1;n=n/10}
var left: i64=start;var right: i64=pos[0]-1
while left<right{let ch: u8=out[left];out[left]=out[right];out[right]=ch;left=left+1;right=right-1}
out[pos[0]]=0
}
return 0
541}
542
543func rm_receipt(path: *u8,digest: *u8,phase: *u8,state: *u8,rc: i64) -> i64 {
let b: *u8=sys_mmap(PB_PATH);let p: *i64=sys_mmap(8) as *i64
if (b as i64)<=0||(p as i64)<=0{return FSX_RC_IO}
p[0]=0;pb_app(b,p,"{\"schema\":\"site-release-phase/v1\",\"manifest_sha256\":\"");pb_app(b,p,digest)
pb_app(b,p,"\",\"epoch\":");rm_num(b,p,sys_now_realtime_sec())
pb_app(b,p,",\"attempt_pid\":");rm_num(b,p,osp_selfpid())
pb_app(b,p,",\"phase\":\"");pb_app(b,p,phase);pb_app(b,p,"\",\"state\":\"");pb_app(b,p,state)
pb_app(b,p,"\",\"rc\":");rm_num(b,p,rc);pb_app(b,p,"}\n")
fsx_puts(b)
let written: i64=fsx_append(path,b,p[0]);var result: i64=FSX_RC_IO
if written>=p[0]{result=rm_sync(path)}
sys_munmap(b,PB_PATH);sys_munmap(p as *u8,8)
if result!=0{fsx_puts("NX-RELEASE receipt-io; inspect last recorded phase and actual artifact identity; no further phase executed\n")}
return result
557}
558func rm_finish(receipt: *u8,digest: *u8,phase: *u8,rc: i64) -> i64 {
var state: *u8="complete"
if rc!=0{state="refused";if rc==PB_RC_BUSY{state="waiting-owner-retry-required"}}
if rm_receipt(receipt,digest,phase,state,rc)!=0{return FSX_RC_IO}
return rc
563}
564func rm_artifact(src: *u8,size: *u8,hash: *u8,out: *i64) -> i64 {
let n: i64=pb_sized_bytes(size);if n<0||pr_hash_ok(hash)!=1{return PB_RC_USAGE}
let b: *u8=sys_mmap(n+1);if (b as i64)<=0{return FSX_RC_IO}
let got: i64=pb_read_bounded(src,b,n+1)
if got!=n{sys_munmap(b,n+1);return PB_RC_CONFLICT}
let h: *u8=sys_mmap(PB_SHA_HEX+1);if (h as i64)<=0{sys_munmap(b,n+1);return FSX_RC_IO}
pb_hash(b,n,h);let same: i64=fsx_seq(h,hash);sys_munmap(h,PB_SHA_HEX+1)
if same!=1{sys_munmap(b,n+1);return PB_RC_CONFLICT}
out[0]=b as i64;out[1]=n;return 0
573}
574// CLI/job scope: early preflight refusals and incumbent publisher allocations are reclaimed at process exit.
575// This entry is not a memory-stable long-lived daemon API.
576func rm_preflight(v: *i64,prefix: *u8) -> i64 {
if fsx_seq(v[0] as *u8,RM_SCHEMA)!=1{return PB_RC_USAGE}
if fsx_seq(v[11] as *u8,"allow")!=1&&fsx_seq(v[11] as *u8,"existing-only")!=1{return PB_RC_USAGE}
if pr_hash_ok(v[6] as *u8)!=1&&fsx_seq(v[6] as *u8,"absent")!=1{return PB_RC_USAGE}
let site: *u8=v[1] as *u8;let target: *u8=v[3] as *u8;let dep: *u8=v[8] as *u8
if pb_traversal(site)!=0||pb_traversal(target)!=0||pr_path_ok(dep)!=1||pb_release_path(target)==1{return FSX_RC_DENIED}
var i: i64=0;while site[i]!=0{if site[i]==47{return FSX_RC_DENIED};i=i+1}
if vw_slen(site)+vw_slen(target)+vw_slen("sites//.publish-lock")+1>=PB_PATH{return FSX_RC_DENIED}
if vw_slen(site)+vw_slen(dep)+vw_slen("sites//.publish-lock")+1>=PB_PATH{return FSX_RC_DENIED}
let conf: *u8=sys_mmap(PB_CONFCAP);let spans: *i64=sys_mmap(PB_SPANCAP) as *i64
if (conf as i64)<=0||(spans as i64)<=0{return FSX_RC_IO}
if pl_site_lookup("knowledge/pub_sites.conf",site,conf,spans)!=1{return FSX_RC_DENIED}
if spans[3]-spans[2]>=PB_PATH{return FSX_RC_DENIED}
pl_span_cstr(conf,spans[2],spans[3],prefix)
if pl_check(prefix,target)!=0{return FSX_RC_DENIED}
sys_munmap(conf,PB_CONFCAP);sys_munmap(spans as *u8,PB_SPANCAP)
let artifact: *i64=sys_mmap(16) as *i64;let asset: *i64=sys_mmap(16) as *i64
if (artifact as i64)<=0||(asset as i64)<=0{return FSX_RC_IO}
let cr: i64=rm_artifact(v[2] as *u8,v[5] as *u8,v[4] as *u8,artifact);if cr!=0{return cr}
let dr: i64=rm_artifact(v[7] as *u8,v[10] as *u8,v[9] as *u8,asset);if dr!=0{return dr}
let args: *i64=sys_mmap(8*8) as *i64;let token: *u8=sys_mmap(PB_PATH);let pos: *i64=sys_mmap(8) as *i64
if (args as i64)<=0||(token as i64)<=0||(pos as i64)<=0{return FSX_RC_IO}
pos[0]=0;pb_app(token,pos,"/");pb_app(token,pos,dep)
args[0]="nx_comparestale" as *u8 as i64;args[1]="dependency-check" as *u8 as i64;args[2]=v[2];args[3]=v[4]
args[4]=v[7];args[5]=v[9];args[6]=token as i64;args[7]=0
let checked: i64=cd_buffer_command(7,args,artifact[0] as *u8,artifact[1])
sys_munmap(artifact[0] as *u8,artifact[1]+1);sys_munmap(asset[0] as *u8,asset[1]+1)
sys_munmap(args as *u8,64);sys_munmap(token,PB_PATH);sys_munmap(pos as *u8,8)
sys_munmap(artifact as *u8,16);sys_munmap(asset as *u8,16)
if checked!=0{return PB_RC_CONFLICT};return 0
606}
607func rm_execute(v: *i64,prefix: *u8,receipt: *u8,digest: *u8) -> i64 {
if rm_receipt(receipt,digest,"preflight","started",0)!=0{return FSX_RC_IO}
var rc: i64=rm_preflight(v,prefix);rc=rm_finish(receipt,digest,"preflight",rc);if rc!=0{return rc}
if rm_receipt(receipt,digest,"registration","started",0)!=0{return FSX_RC_IO}
if fsx_seq(v[11] as *u8,"allow")==1{rc=pr_register(prefix,v[8] as *u8,v[9] as *u8);if rc==PR_CREATED{rc=0}}else{rc=pr_check(prefix,v[8] as *u8,v[9] as *u8)}
rc=rm_finish(receipt,digest,"registration",rc);if rc!=0{return rc}
let args: *i64=sys_mmap((PE_ARGC+1)*8) as *i64;if (args as i64)<=0{return FSX_RC_IO}
args[0]="nx_site_publish" as *u8 as i64;args[1]="stage-sized" as *u8 as i64;args[2]=v[7];args[3]=v[1]
args[4]=v[8];args[5]=v[9];args[6]=v[10];args[7]=0
if rm_receipt(receipt,digest,"stage","started",0)!=0{return FSX_RC_IO}
rc=pb_main_edge(PB_SIZED_ARGC,args,0 as *u8,0 as *u8);rc=rm_finish(receipt,digest,"stage",rc);if rc!=0{return rc}
// The staging lock has been released. pe_main owns dependency then consumer locks itself.
args[1]="publish-guarded-edge" as *u8 as i64;args[2]=v[2];args[3]=v[1];args[4]=v[3];args[5]=v[4]
args[6]=v[6];args[7]=v[5];args[8]=v[8];args[9]=v[9];args[10]=0
if rm_receipt(receipt,digest,"publish","started",0)!=0{return FSX_RC_IO}
rc=pe_main(PE_ARGC,args);rc=rm_finish(receipt,digest,"publish",rc);if rc!=0{return rc}
sys_munmap(args as *u8,(PE_ARGC+1)*8)
return rm_receipt(receipt,digest,"delivery","published-served-review-pending",0)
625}
626func rm_main(argc: i64,argv: *i64) -> i64 {
if argc!=4{return PB_RC_USAGE};if pr_hash_ok(argv[3] as *u8)!=1{return PB_RC_USAGE}
let body: *u8=sys_mmap(PB_CONFCAP+1);let digest: *u8=sys_mmap(PB_SHA_HEX+1)
let v: *i64=sys_mmap(RM_VALUES_BYTES) as *i64;let receipt: *u8=sys_mmap(PB_PATH)
let pos: *i64=sys_mmap(8) as *i64;let prefix: *u8=sys_mmap(PB_PATH)
if (body as i64)<=0||(digest as i64)<=0||(v as i64)<=0||(receipt as i64)<=0||(pos as i64)<=0||(prefix as i64)<=0{rm_cleanup(body,digest,v,receipt,pos,prefix);return FSX_RC_IO}
let n: i64=pb_read_bounded(argv[2] as *u8,body,PB_CONFCAP+1)
if n<=0||n>PB_CONFCAP{rm_cleanup(body,digest,v,receipt,pos,prefix);return PB_RC_USAGE}
pb_hash(body,n,digest);if fsx_seq(digest,argv[3] as *u8)!=1{rm_cleanup(body,digest,v,receipt,pos,prefix);return PB_RC_CONFLICT}
pos[0]=0;pb_app(receipt,pos,RM_RECEIPT_ROOT);pb_app(receipt,pos,"site-release-");pb_app(receipt,pos,digest);pb_app(receipt,pos,".jsonl")
var rc: i64=rm_parse(body,n,v)
if rc!=0{rc=rm_finish(receipt,digest,"manifest",rc);rm_cleanup(body,digest,v,receipt,pos,prefix);return rc}
fsx_puts("NX-RELEASE receipt=");fsx_puts(receipt);fsx_puts(" registration=");fsx_puts(v[11] as *u8);fsx_puts(" scope=one-selected-dependency no-build-no-render\n")
rc=rm_bank(body,n,digest)
if rc!=0{rc=rm_finish(receipt,digest,"manifest-bank",rc);rm_cleanup(body,digest,v,receipt,pos,prefix);return rc}
rc=rm_execute(v,prefix,receipt,digest)
rm_cleanup(body,digest,v,receipt,pos,prefix)
return rc
644}
645
646func rm_sync(path: *u8) -> i64 {
let fd: i64=sys_openat_rd(path);if fd<0{return FSX_RC_IO}
let sync: i64=sys_fsync(fd);let closed: i64=sys_close(fd)
if sync!=0||closed!=0{return FSX_RC_IO}
let dir: i64=sys_openat_rd(RM_RECEIPT_ROOT);if dir<0{return FSX_RC_IO}
let ds: i64=sys_fsync(dir);let dc: i64=sys_close(dir)
if ds!=0||dc!=0{return FSX_RC_IO};return 0
653}
654// The caller's authorization and original precondition remain available after temporary input expires.
655func rm_bank(body: *u8,n: i64,digest: *u8) -> i64 {
let path: *u8=sys_mmap(PB_PATH);let lock: *u8=sys_mmap(PB_PATH);let p: *i64=sys_mmap(8) as *i64
if (path as i64)<=0||(lock as i64)<=0||(p as i64)<=0{return FSX_RC_IO}
p[0]=0;pb_app(path,p,RM_RECEIPT_ROOT);pb_app(path,p,"site-release-");pb_app(path,p,digest);pb_app(path,p,".manifest.json")
p[0]=0;pb_app(lock,p,path);pb_app(lock,p,".lock")
if fsx_write_denied(path)==1||fsx_write_denied(lock)==1{return FSX_RC_DENIED}
let fd: i64=sys_openat_wr(lock,FSX_MODE_RW);if fd<0{return FSX_RC_IO}
if sys_flock(fd,PB_LOCK_EX_NB)!=0{sys_close(fd);return PB_RC_BUSY}
let old: *u8=sys_mmap(n+1);var rc: i64=FSX_RC_IO
if (old as i64)>0 {
let got: i64=pb_read_bounded(path,old,n+1)
if got==(0-2){if fsx_write(path,body,n)==n{rc=rm_sync(path)}}else{if pb_same_bytes(body,n,old,got)==1{rc=rm_sync(path)}else{if got>=0{rc=PB_RC_CONFLICT}}}
sys_munmap(old,n+1)
}
if sys_close(fd)!=0{rc=FSX_RC_IO}
sys_munmap(path,PB_PATH);sys_munmap(lock,PB_PATH);sys_munmap(p as *u8,8)
return rc
672}
673func rm_cleanup(body: *u8,digest: *u8,v: *i64,receipt: *u8,pos: *i64,prefix: *u8) -> i64 {
if (v as i64)>0{var i: i64=0;while i<RM_FIELDS{if v[i]!=0{sys_munmap(v[i] as *u8,vw_slen(v[i] as *u8)+1)};i=i+1};sys_munmap(v as *u8,RM_VALUES_BYTES)}
if (body as i64)>0{sys_munmap(body,PB_CONFCAP+1)};if (digest as i64)>0{sys_munmap(digest,PB_SHA_HEX+1)}
if (receipt as i64)>0{sys_munmap(receipt,PB_PATH)};if (pos as i64)>0{sys_munmap(pos as *u8,8)};if (prefix as i64)>0{sys_munmap(prefix,PB_PATH)}
return 0
678}
679
// Prepare only registered paths. Each directory is opened relative to a retained
// parent descriptor without following symlinks; file publication remains separate.
682func pb_prepare_path(site:*u8,rel:*u8)->i64 {
if pb_traversal(site)!=0||pb_traversal(rel)!=0{return FSX_RC_DENIED}
var i:i64=0
while site[i]!=0 {if site[i]==47{return FSX_RC_DENIED};i=i+1}
if i==0||vw_slen(rel)==0||vw_slen(rel)>=PB_PATH{return PB_RC_USAGE}
let conf:*u8=sys_mmap(PB_CONFCAP);let spans:*i64=sys_mmap(PB_SPANCAP) as *i64
let prefix:*u8=sys_mmap(PB_PATH);let component:*u8=sys_mmap(PB_PATH)
if (conf as i64)<=0||(spans as i64)<=0||(prefix as i64)<=0||(component as i64)<=0{return FSX_RC_IO}
var rc:i64=FSX_RC_DENIED
if pl_site_lookup("knowledge/pub_sites.conf",site,conf,spans)==1 {
if spans[3]-spans[2]<PB_PATH{
 pl_span_cstr(conf,spans[2],spans[3],prefix)
 if pl_check(prefix,rel)==PL_OK{rc=0}
}
}
sys_munmap(conf,PB_CONFCAP);sys_munmap(spans as *u8,PB_SPANCAP);sys_munmap(prefix,PB_PATH)
if rc!=0{sys_munmap(component,PB_PATH);return rc}
// Validate every component before creating any directories.
i=0;var start:i64=0
while 1 {
if rel[i]==47||rel[i]==0{
 let n:i64=i-start
 if n==0||(n==1&&rel[start]==46)||(n==2&&rel[start]==46&&rel[start+1]==46){sys_munmap(component,PB_PATH);return FSX_RC_DENIED}
 if rel[i]==0{break};start=i+1
};i=i+1
}
var parent:i64=__syscall(SYS_OPENAT,AT_FDCWD,"sites" as *u8,O_RDONLY|O_DIRECTORY|O_NOFOLLOW|O_CLOEXEC,0,0,0)
if parent<0{sys_munmap(component,PB_PATH);return FSX_RC_IO}
let sitefd:i64=__syscall(SYS_OPENAT,parent,site,O_RDONLY|O_DIRECTORY|O_NOFOLLOW|O_CLOEXEC,0,0,0)
sys_close(parent)
if sitefd<0{sys_munmap(component,PB_PATH);return FSX_RC_IO}
parent=sitefd;i=0;start=0
while rel[i]!=0{
if rel[i]==47{
 var j:i64=0;while start+j<i{component[j]=rel[start+j];j=j+1};component[j]=0 as u8
 var child:i64=__syscall(SYS_OPENAT,parent,component,O_RDONLY|O_DIRECTORY|O_NOFOLLOW|O_CLOEXEC,0,0,0)
 if child==(0-2){
  // Same Nishi mkdirat ABI as sys_mkdir; descriptor-relative variant.
  let made:i64=__syscall(34,parent,component,0x1ed,0,0,0)
  if made!=0&&made!=(0-17){rc=FSX_RC_IO;break}
  if sys_fsync(parent)!=0{rc=FSX_RC_IO;break}
  child=__syscall(SYS_OPENAT,parent,component,O_RDONLY|O_DIRECTORY|O_NOFOLLOW|O_CLOEXEC,0,0,0)
 }
 if child<0{rc=FSX_RC_IO;break}
 sys_close(parent);parent=child;start=i+1
};i=i+1
}
if sys_close(parent)!=0{rc=FSX_RC_IO}
sys_munmap(component,PB_PATH)
return rc
732}
733
734
735// je_emit_string_raw owns RFC8259 escaping; retain this writer only for one output string.
736const RM_JSON_WRITER_BYTES:i64=__size_of(JsonWriter)
737func rm_put_escaped(s:*u8)->i64{
let n:i64=vw_slen(s)
// A byte may expand to six ASCII bytes (backslash-u00XX), plus two quotes.
if n>(PB_I64_MAX-2)/6{return FSX_RC_IO}
let cap:i64=n*6+2
let b:*u8=sys_mmap_try(cap);let w:*JsonWriter=sys_mmap_try(RM_JSON_WRITER_BYTES) as *JsonWriter
var rc:i64=FSX_RC_IO
if (b as i64)>0&&(w as i64)>0{
w.buf=b;w.pos=0;w.cap=cap;w.depth=0;w.prior=0 as *u8
if je_emit_string_raw(w,s,n)==0{
 let count:i64=w.pos-2
 if sys_write(1,((b as i64)+1) as *u8,count)==count{rc=0}
}
}
if (w as i64)>0{if sys_munmap(w as *u8,RM_JSON_WRITER_BYTES)!=0{rc=FSX_RC_IO}}
if (b as i64)>0{if sys_munmap(b,cap)!=0{rc=FSX_RC_IO}}
return rc
754}
755func rm_prepare_emit(v:*i64,digest:*u8,observed:i64)->i64 {
var state:*u8="registration-conflict";var action:*u8="choose-new-immutable-dependency-path"
var planned:*u8="none";var rc:i64=PB_RC_CONFLICT
if observed==PR_OK{state="ready";action="execute-unchanged-manifest";planned="existing-only";rc=0}
if observed==PR_MISSING{
state="registration-missing";action="explicit-registration-authorization-required";planned="allow"
if fsx_seq(v[11] as *u8,"allow")==1{state="ready-registration-required";action="execute-authorized-registration";rc=0}
}
if observed==PR_IO{state="registry-unavailable";action="repair-existing-registry";rc=FSX_RC_IO}
if observed==PR_INVALID{state="invalid-registration-identity";action="correct-manifest";rc=PB_RC_USAGE}
fsx_puts("{\"schema\":\"site-release-preparation/v1\",\"state\":\"");if rm_put_escaped(state)!=0{return FSX_RC_IO}
fsx_puts("\",\"next\":\"");if rm_put_escaped(action)!=0{return FSX_RC_IO};fsx_puts("\",\"registration_observed_code\":");fsx_putn(observed)
fsx_puts(",\"registration_requested\":\"");if rm_put_escaped(v[11] as *u8)!=0{return FSX_RC_IO}
fsx_puts("\",\"registration_needed\":\"");if rm_put_escaped(planned)!=0{return FSX_RC_IO}
fsx_puts("\",\"manifest_sha256\":\"");if rm_put_escaped(digest)!=0{return FSX_RC_IO}
fsx_puts("\",\"site\":\"");if rm_put_escaped(v[1] as *u8)!=0{return FSX_RC_IO}
fsx_puts("\",\"consumer_source\":\"");if rm_put_escaped(v[2] as *u8)!=0{return FSX_RC_IO}
fsx_puts("\",\"consumer_path\":\"");if rm_put_escaped(v[3] as *u8)!=0{return FSX_RC_IO}
fsx_puts("\",\"consumer_sha256\":\"");if rm_put_escaped(v[4] as *u8)!=0{return FSX_RC_IO}
fsx_puts("\",\"consumer_bytes\":");fsx_putn(pb_sized_bytes(v[5] as *u8))
fsx_puts(",\"dependency_path\":\"");if rm_put_escaped(v[8] as *u8)!=0{return FSX_RC_IO}
fsx_puts("\",\"dependency_sha256\":\"");if rm_put_escaped(v[9] as *u8)!=0{return FSX_RC_IO}
fsx_puts("\",\"dependency_bytes\":");fsx_putn(pb_sized_bytes(v[10] as *u8))
fsx_puts(",\"expected_live\":\"");if rm_put_escaped(v[6] as *u8)!=0{return FSX_RC_IO}
fsx_puts("\",\"source_identity\":\"verified-exact-bytes-and-sha256\",\"dependency_binding\":\"identity-and-literal-reference-only\",\"build_qualification\":null,\"served_identity\":null,\"live_precondition\":\"rechecked-by-locked-publish\",\"registry_recheck\":\"required-at-execution\",\"published\":false,\"registration_writes\":0,\"publication_writes\":0,\"rc\":");fsx_putn(rc);fsx_puts("}\n")
return rc
781}
782func rm_prepare_main(argc:i64,argv:*i64)->i64 {
if argc!=4{return PB_RC_USAGE};if pr_hash_ok(argv[3] as *u8)!=1{return PB_RC_USAGE}
let body:*u8=sys_mmap_try(PB_CONFCAP+1);let digest:*u8=sys_mmap_try(PB_SHA_HEX+1)
let v:*i64=sys_mmap_try(RM_VALUES_BYTES) as *i64;let prefix:*u8=sys_mmap_try(PB_PATH)
if (v as i64)>0{var i:i64=0;while i<RM_FIELDS{v[i]=0;i=i+1}}
var rc:i64=FSX_RC_IO
if (body as i64)>0&&(digest as i64)>0&&(v as i64)>0&&(prefix as i64)>0{
let n:i64=pb_read_bounded(argv[2] as *u8,body,PB_CONFCAP+1)
if n>0&&n<=PB_CONFCAP{
 pb_hash(body,n,digest)
 if fsx_seq(digest,argv[3] as *u8)==1{
  rc=rm_parse(body,n,v)
  if rc==0{
   rc=rm_preflight(v,prefix)
   if rc==0{rc=rm_prepare_emit(v,digest,pr_observe(prefix,v[8] as *u8,v[9] as *u8))}
   else{fsx_puts("{\"schema\":\"site-release-preparation/v1\",\"state\":\"preflight-refused\",\"source_identity\":null,\"published\":false,\"rc\":");fsx_putn(rc);fsx_puts("}\n")}
  }
 }else{rc=PB_RC_CONFLICT;fsx_puts("{\"schema\":\"site-release-preparation/v1\",\"state\":\"manifest-hash-conflict\",\"published\":false}\n")}
}else{rc=PB_RC_USAGE}
}
rm_cleanup(body,digest,v,0 as *u8,0 as *i64,prefix)
return rc
804}
nx_site_publish_prepare_lib_t256.nx source

`nx_site_publish_prepare_lib_t256.nx` source
