@aikdna/kdna-core 0.36.0 → 0.37.1-rc.browser.1

package/README.md

@@ -1,9 +1,13 @@
 # KDNA Core — R2 candidate
 
-Unpublished `R2` source candidate: actual source package `0.36.0`, Core `kdna.core/0.8.2`, Container `0.5.0`, Payload `0.5.1`, Canonical IR `0.6.1`, with native Capsule/Plan/Host/Trace `0.3.1`. The published incumbent is `0.22.0`; this source candidate is not a published replacement. See the [specification index](../../SPEC-INDEX.md), the [execution contract](../../specs/execution-contract-0.3.md) and the [PackageSet node surface](../../specs/package-set-node.md). Implementation, independent byte-bound acceptance, installed consumer rebinding and publication are separate.
+Source candidate (unreleased): actual source package `0.37.1-rc.browser.1`, Core `kdna.core/0.8.2`, Container `0.5.0`, Payload `0.5.1`, Canonical IR `0.6.1`, with native Capsule/Plan/Host/Trace `0.3.1`. See the [specification index](../../SPEC-INDEX.md), the [execution contract](../../specs/execution-contract-0.3.md) and the [PackageSet node surface](../../specs/package-set-node.md). Implementation, independent byte-bound acceptance, installed consumer rebinding and publication are separate.
+
+Published and source coordinates are separate: `npm i @aikdna/kdna-core` resolves to the published stable `0.37.0`, while this source is the candidate `0.37.1-rc.browser.1`, addressed by its exact version or the `browser-preview` dist-tag and never carrying `latest`.
+
+The published stable release remains Core `0.37.0`, paired with Read `0.11.1`; its artifacts and release evidence remain separate from this candidate. Core `0.37.0` supersedes the `0.36.0` incumbent.
 
 This source description follows [`package.json`](package.json).
-Read source `0.11.0` declares this exact Core peer. Runtime CLI
+Read source `0.11.2-rc.browser.1` declares this exact Core peer. Runtime CLI
 0.40 and MCP 0.8.1 retain their separate Core 0.34 / Read 0.9 archives; see the
 [matching-delivery guide](../../docs/core-read-current-status.md#choose-and-obtain-one-matching-delivery).
 Editing this source README does not replace a previously fixed archive or
@@ -25,6 +29,12 @@ Core admits one immutable container, validates its Manifest and typed Payload, r
 | `/remote-runtime` | `loadRemoteRuntimeAsset` | Preserved explicit legacy 0.1 remote loader; independently declared types, no R2 conversion |
 | `/read-boundary` | `inspectSnapshot`, `isProtectedSnapshot` | Pure private-snapshot probes; availability is not current authority |
 | `/protection-node` | `getProtectionContract`, `admitProtectedNode`, `bindProtectionOperation`, `disposeProtectionOperation`, `protectSourceBytes` | Explicit Node protection, trusted provider and opaque operation |
+| `/protected-browser` | `getProtectionContract`, `admitProtectedBrowser` | Host-supplied container bytes, plaintext Payload and unlock observation; trusted provider |
+| `/protected-sections-browser` | `admitProtectedPayloadRequestJson`, `inspectProtectedPayloadRequest`, `createProtectedPayloadReadAuthorityJson`, `admitProtectedSectionBrowser`, `inspectProtectedPayloadSnapshot`, `bindProtectedPayloadRequest`, `disposeProtectedSectionOperation` | Genuine browser admission snapshot, closed JSON request and independently trusted authority |
+
+The candidate `/protected-sections-browser` entry retains one genuine accepted snapshot from `/protected-browser`'s `admitProtectedBrowser`. Admit the request JSON, create an independently trusted Read authority, then call `admitProtectedSectionBrowser(snapshot, request, authority)` and retain its returned operation and normalized request. Bind later request JSON with `bindProtectedPayloadRequest`; close the operation with `disposeProtectedSectionOperation`. The [generated declarations](src/public-contract/protected-sections-browser.d.ts) define the seven callables and closed inputs.
+
+The original input triple is container bytes, Host-supplied plaintext Payload and an unlock observation. It does not prove decryption or ciphertext/plaintext authentication. This adapter performs no new decryption or physical read; its observation and receipt preserve `host_supplied_triple` and `observation_not_authority`. It uses the independent base tuple above, including container `0.5.0` and Read `kdna.read/0.6.4`; Node native-section witnesses and serialized snapshot copies cannot establish browser origin. Disclosure additionally requires the [Read browser adapter](../kdna-read/README.md#protected-browser-read-candidate) and its independently trusted Host scope.
 
 ```js
 import { admitNode } from '@aikdna/kdna-core/node';

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@aikdna/kdna-core",
-  "version": "0.36.0",
+  "version": "0.37.1-rc.browser.1",
   "description": "Public KDNA Core with bounded component interpretation and Canonical IR.",
   "engines": {
     "node": ">=20"
@@ -60,6 +60,11 @@
       "import": "./src/public-contract/protection-node.mjs",
       "require": "./src/public-contract/protection-node.js"
     },
+    "./protected-browser": {
+      "types": "./src/public-contract/protected-browser.d.ts",
+      "import": "./src/public-contract/protected-browser.mjs",
+      "require": "./src/public-contract/protected-browser.js"
+    },
     "./protected-source-node": {
       "types": "./src/public-contract/protected-source-node.d.ts",
       "import": "./src/public-contract/protected-source-node.mjs",
@@ -124,6 +129,11 @@
       "types": "./src/public-contract/retained-sections-browser.d.ts",
       "import": "./src/public-contract/retained-sections-browser.mjs",
       "require": "./src/public-contract/retained-sections-browser.js"
+    },
+    "./protected-sections-browser": {
+      "types": "./src/public-contract/protected-sections-browser.d.ts",
+      "import": "./src/public-contract/protected-sections-browser.mjs",
+      "require": "./src/public-contract/protected-sections-browser.js"
     }
   },
   "types": "src/public-contract/types.d.ts",

package/schema/manifest.schema.json

@@ -281,7 +281,8 @@
             "kdna.encryption.licensed-entry",
             "kdna.encryption.password",
             "kdna.encryption.password.scrypt",
-            "kdna.envelope.external-grant"
+            "kdna.envelope.external-grant",
+            "kdna.envelope.aead"
           ]
         },
         "profile_version": {

package/src/public-contract/browser-native/generated-contract.json

@@ -809,12 +809,12 @@
     },
     "schema_paths": {
       "CanonicalIR": "specs/canonical-ir-0.6.1.schema.json",
-      "IssuerResultObservation": "specs/external-grant-issuer-r2-binding-7.schema.json",
+      "IssuerResultObservation": "specs/external-grant-issuer-r2-binding-8.schema.json",
       "Manifest": "schema/manifest-container-0.5.0-judgment-0.5.1.schema.json",
       "PackageSetNodeSurface": "specs/package-set-node-0.2.1.schema.json",
       "Payload": "schema/payload-profile-0.5.1.schema.json",
-      "ProtectedSourceObservation": "specs/protected-source-r2-binding-7.schema.json",
-      "ProtectionDefinitionObservation": "specs/protection-admission-r2-binding-7.schema.json",
+      "ProtectedSourceObservation": "specs/protected-source-r2-binding-8.schema.json",
+      "ProtectionDefinitionObservation": "specs/protection-admission-r2-binding-8.schema.json",
       "PublicAgentHostReceipt": "schema/agent-host-receipt-0.3.1.schema.json",
       "PublicAgentHostRequest": "schema/agent-host-request-0.3.1.schema.json",
       "PublicConsumptionPlan": "schema/consumption-plan-0.3.1.schema.json",

package/src/public-contract/browser-native/sections/contract.json

@@ -2,8 +2,8 @@
   "candidate_only": true,
   "source": {
     "path": "specs/public-semantic-source.json",
-    "bytes": 1435348,
-    "sha256": "fdcb204c8942ddc10ed5d8d6658a9317102822b5b9c500bc07e5086d5668fc9f"
+    "bytes": 1506884,
+    "sha256": "a05af27e97be03a8909375217ab353017b72a10532ad7d700b6ae278e30d1d5f"
   },
   "historical_original_source": {
     "scope": "historical_original_contract_source_identity_not_current_generator_input",

package/src/public-contract/browser-protected/request.js

@@ -0,0 +1,77 @@
+'use strict';
+const S = require('./state.js'), { C } = S;
+const fixed = n => String(n).padStart(16, '0');
+const count = value => new TextEncoder().encode(C.strict.canonicalJson(value)).length;
+const correlation = id => C.strict.identifier(id) ? {
+    state: 'validated', request_id: id
+} : {
+    state: 'unavailable', request_id: null
+};
+function failure(candidate) {
+    const id = Object.getOwnPropertyDescriptor(candidate ?? {}, 'request_id')?.value, body = {
+        contract: 'kdna.read-admission/0.1.0', code: 'READ_INPUT_INVALID', diagnostic: {
+            stage: 'admission', severity: 'error', reason: 'mode_shape_invalid', field: '$candidate'
+        }, correlation: correlation(id), control_budget: {
+            limit_bytes: 4096, actual_bytes: '0000000000000000'
+        }
+    };
+    body.control_budget.actual_bytes = fixed(count(body));
+    const out = {
+        channel: 'admission_rejection', envelope: null, admission_rejection: body, control: null, transport_failure: null
+    };
+    C.validate('BrowserProtectedRequestAdmission', out);
+    return S.frozen(out);
+}
+function versionRejection(candidate, code) {
+    const envelope = {
+        contract: 'kdna.protected-browser-read/0.1.0-candidate', request_id: candidate.request_id, status: 'rejected', tuple: null, asset: null, snapshot_id: null, digests: null, content: null, states: {
+            core: 'not_evaluated', interpretation: 'not_evaluated', writer: 'not_evaluated', confirmation: 'not_evaluated', read_permission: 'not_evaluated', action_authorization: 'not_evaluated'
+        }, diagnostics: [{
+                code, stage: 'version', severity: 'error', subject: null, field: null
+            }], omissions: [], assessment: {
+            state: 'not_evaluated', kind: null, assessor_id: null, evidence_ref: null
+        }, receipt: {
+            receipt_id: 'receipt:' + candidate.request_id, request_id: candidate.request_id, snapshot_id: null, host_id: null, host_epoch: null, decision_id: null, disclosed_at: null, delivery: 'not_delivered'
+        }, budget: {
+            limit_bytes: candidate.budget_bytes, required_bytes: '0000000000000000', actual_bytes: '0000000000000000'
+        }
+    };
+    const size = count(envelope);
+    envelope.budget.actual_bytes = fixed(size);
+    envelope.budget.required_bytes = fixed(size);
+    const out = size <= candidate.budget_bytes ? {
+        channel: 'read_envelope', envelope, admission_rejection: null, control: null, transport_failure: null
+    } : {
+        channel: 'no_body_control', envelope: null, admission_rejection: null, control: {
+            code: 'READ_RESPONSE_BUDGET_TOO_SMALL', semantic_cause: code, correlation: correlation(candidate.request_id), body_bytes: 0
+        }, transport_failure: null
+    };
+    C.validate('BrowserProtectedRequestAdmission', out);
+    return S.frozen(out);
+}
+function admit(candidateJson) {
+    let candidate;
+    try {
+        candidate = C.parseJsonText(candidateJson);
+        const data = candidate;
+        C.keys(data, ['request_id', 'tuple', 'budget_bytes', 'mode', 'selection', 'handle']);
+        C.need(C.strict.identifier(data.request_id) && C.strict.uint(data.budget_bytes), 'READ_INPUT_INVALID');
+        const t = data.tuple;
+        C.need(t && typeof t === 'object' && !Array.isArray(t) && Object.keys(t).every(k => Object.hasOwn(S.tuple, k) && typeof t[k] === 'string'), 'READ_INPUT_INVALID');
+        if (Object.keys(t).length !== Object.keys(S.tuple).length || Object.entries(S.tuple).some(([k, v]) => t[k] !== v)) {
+            const baseline = require('../generated-contract.json'), old = [baseline.versionTuple, ...baseline.types.UnsupportedVersionTuple.anyOf.map(x => Object.fromEntries(Object.entries(x.properties).map(([k, v]) => [k, v.const])))];
+            const historical = old.some(value => Object.keys(t).length === Object.keys(value).length && Object.entries(value).every(([k, v]) => t[k] === v));
+            return versionRejection(data, historical ? 'READ_UNSUPPORTED_VERSION' : Object.keys(S.tuple).some(k => k !== 'payload_profile' && t[k] === S.tuple[k]) ? 'READ_MIXED_VERSION_TUPLE' : 'READ_UNSUPPORTED_VERSION');
+        }
+        C.validate('BrowserProtectedRequest', data);
+        return Object.freeze({
+            channel: 'admitted_request', request: S.mintRequest(data)
+        });
+    }
+    catch (e) {
+        return failure(candidate);
+    }
+}
+module.exports = {
+    admit, failure
+};

package/src/public-contract/browser-protected/state.js

@@ -0,0 +1,200 @@
+'use strict';
+const strict = require('../browser-native/strict-input.js');
+const { digestCanonical } = require('../digests.js');
+const { inspectSnapshot, markProtectedSnapshot } = require('../brand.js');
+const contract = require('../protected-browser-contract/contract.json');
+const validators = require('../protected-browser-contract/validators.cjs');
+const origins = new WeakMap(), requests = new WeakMap(), authorities = new WeakMap();
+const operations = new WeakMap(), snapshots = new WeakMap(), checkpoints = new WeakMap(), failures = new WeakMap();
+const tuple = require('../generated-contract.json').versionTuple;
+const frozen = strict.freeze;
+function need(ok, code = 'READ_INPUT_INVALID') {
+  if (!ok) { const error = new Error(code); failures.set(error, code); throw error; }
+}
+function validate(name, value) {
+  strict.assertStrictJson(value);
+  need(typeof validators[name] === 'function' && validators[name](value), 'READ_INPUT_INVALID');
+  scalars(value, contract.types[name]);
+  return value;
+}
+function scalars(value, shape, depth = 0) {
+  need(depth <= 64);
+  if (shape.$ref) {
+    const name = shape.$ref.slice(8);
+    if (name === 'Identifier') need(strict.identifier(value));
+    if (['EntryName', 'RuntimeMandatoryEntryName'].includes(name)) need(strict.entryName(value));
+    if (name === 'Timestamp') need(strict.validTimestamp(value));
+    return scalars(value, contract.types[name], depth);
+  }
+  if (typeof value === 'string') need(strict.scalarString(value));
+  if (value && typeof value === 'object') {
+    for (const [key, child] of Object.entries(shape.properties ?? {}))
+      if (Object.hasOwn(value, key)) scalars(value[key], child, depth + 1);
+    if (Array.isArray(value) && shape.items) for (const child of value) scalars(child, shape.items, depth + 1);
+  }
+  for (const child of shape.allOf ?? []) scalars(value, child, depth);
+  for (const child of shape.oneOf ?? shape.anyOf ?? []) {
+    const branch = child.$ref ? contract.types[child.$ref.slice(8)] : child;
+    if (branch.type && (branch.type === 'null' ? value !== null : branch.type === 'array' ? !Array.isArray(value) : typeof value !== branch.type)) continue;
+    if (Object.entries(branch.properties ?? {}).some(([key, field]) => Object.hasOwn(field, 'const') && Object.hasOwn(value ?? {}, key) && value[key] !== field.const)) continue;
+    scalars(value, child, depth);
+  }
+}
+function parseJsonText(value) { need(typeof value === 'string'); return strict.parseJson(value); }
+function keys(value, names) {
+  need(value && typeof value === 'object' && !Array.isArray(value) && Object.keys(value).length === names.length && names.every(k => Object.hasOwn(value, k)));
+}
+const C = { strict, contract, validate, keys, need, parseJsonText, isFailure: e => failures.has(e), failureCode: e => failures.get(e) ?? null };
+function failed(code = 'PROTECTION_OPERATION_UNTRUSTED', stage = 'input') {
+  return frozen({ status: 'protection_failed', diagnostic: { code, stage }, checked_at_ms: null });
+}
+// Registration is private to successful browser admission. Public snapshot fields,
+// JSON copies and Node admissions cannot establish this provenance.
+function register(snapshot, metadata) {
+  const view = inspectSnapshot(snapshot);
+  need(view && strict.canonicalJson(view.tuple) === strict.canonicalJson(tuple), 'READ_SNAPSHOT_UNATTESTED');
+  const origin = { phase: 'available', view, metadata: frozen(metadata) };
+  origins.set(snapshot, origin);
+  markProtectedSnapshot(snapshot, () => origin.phase !== 'closed');
+}
+function mintRequest(data, sourceDigest = null) {
+  const token = Object.freeze({}), copy = frozen(strict.copyJson(data)), digest = digestCanonical(copy);
+  requests.set(token, { data: copy, digest, sourceDigest: sourceDigest ?? digest, operation: null });
+  return token;
+}
+function request(token) { const r = requests.get(token); return r && (!r.operation || operation(r.operation)) ? r : null; }
+function inspectRequest(token) { return request(token)?.data ?? null; }
+function normalized(record, view) {
+  if (record.data.mode !== 'exact_selection') return mintRequest(record.data, record.sourceDigest);
+  const s = record.data.selection;
+  need(s.asset_id === view.asset.asset_id, 'READ_ASSET_MISMATCH');
+  need(s.asset_version === view.asset.asset_version, 'READ_ASSET_VERSION_MISMATCH');
+  const wanted = new Set(s.judgment_ids), ordered = view.ir.catalog.filter(x => wanted.has(x.judgment_id)).map(x => x.judgment_id);
+  need(ordered.length === wanted.size, 'READ_SELECTION_NOT_FOUND');
+  return mintRequest({ ...record.data, selection: { ...s, judgment_ids: ordered } }, record.sourceDigest);
+}
+function createAuthority(callback, policyJson) {
+  if (typeof callback !== 'function') throw new TypeError('PROTECTED_BROWSER_AUTHORITY_CALLBACK');
+  const policy = policyJson === undefined ? { requireSignature: false, expectedPublicKeyHex: null } : parseJsonText(policyJson);
+  validate('BrowserProtectedSignaturePolicy', policy);
+  const token = Object.freeze({}); authorities.set(token, { callback, policy: frozen(policy) }); return token;
+}
+function operation(token) { const record = operations.get(token); return record && !record.disposed ? record : null; }
+function inspectProtectedSnapshot(token) { const record = snapshots.get(token); return record && !record.disposed ? record.view : null; }
+function pairRequest(token, op) {
+  const r = requests.get(token), record = operation(op);
+  need(r && record && !r.operation);
+  r.operation = op; return token;
+}
+function dispose(op) {
+  const record = operations.get(op);
+  if (!record || record.disposed) return;
+  record.disposed = true; record.generation++;
+  record.origin.phase = 'closed'; record.origin.view = null; record.origin.metadata = null;
+  for (const release of record.releases) release();
+  record.releases.clear();
+  record.view = null; record.metadata = null;
+}
+function onDispose(op, release) {
+  const record = operation(op);
+  if (!record) { release(); return () => {}; }
+  record.releases.add(release);
+  return () => record.releases.delete(release);
+}
+function clock(record, stage) {
+  need(!record.disposed, 'PROTECTION_OPERATION_DISPOSED');
+  let now;
+  try { now = record.metadata.provider.clock(); } catch { need(!record.disposed, 'PROTECTION_OPERATION_DISPOSED'); need(false, 'PROTECTION_PROVIDER_FAILED'); }
+  need(!record.disposed, 'PROTECTION_OPERATION_DISPOSED');
+  need(strict.uint(now), 'PROTECTION_PROVIDER_FAILED');
+  need(now >= record.lastTime, 'PROTECTION_STATE_ROLLBACK');
+  record.lastTime = now; return now;
+}
+function receipt(record, now) {
+  return frozen({ contract: 'kdna.protected-browser-observation/0.1.0-candidate', operation_id: record.id,
+    snapshot_id: record.view.snapshot_id, A: record.view.digests.A.observed, C: record.view.digests.C.observed,
+    E: record.view.digests.E.observed, checked_at_ms: now, proof: 'observation_not_authority', provenance: 'host_supplied_triple' });
+}
+function context(record, r, phase, policy) {
+  const view = record.view, read_intent = {
+    operation: phase, operation_id: record.id, capture_id: record.base.capture.capture_id,
+    snapshot_id: view.snapshot_id, request_digest: r.digest, mode: r.data.mode,
+    physical_reads: 'none', provenance: 'host_supplied_triple', new_decryption: false,
+    new_domain_validation: false, new_signature_verification: false
+  };
+  return frozen({ request: r.data, request_digest: r.digest, tuple: view.tuple, asset: view.asset,
+    digests: view.digests, read_intent, read_intent_digest: digestCanonical(read_intent),
+    signature_policy: policy, disclosure: record.metadata.disclosure });
+}
+async function grant(authority, r, record, phase) {
+  const a = authorities.get(authority);
+  need(a && !record.disposed, 'PROTECTION_OPERATION_UNTRUSTED');
+  const integrity = record.metadata.integrity;
+  need(!(a.policy.requireSignature || a.policy.expectedPublicKeyHex !== null) ||
+    integrity.signature !== 'absent' && (a.policy.expectedPublicKeyHex === null || integrity.public_key === a.policy.expectedPublicKeyHex), 'READ_CORE_INVALID');
+  const value = context(record, r, phase, a.policy);
+  validate('BrowserProtectedAuthorityContext', value);
+  let accepted;
+  try { accepted = await a.callback(value); } catch { need(!record.disposed, 'PROTECTION_OPERATION_DISPOSED'); need(false, 'READ_HOST_DENIED'); }
+  need(!record.disposed, 'PROTECTION_OPERATION_DISPOSED');
+  need(accepted === true, 'READ_HOST_DENIED');
+  return value;
+}
+function bind(op, authority, r) {
+  const record = operation(op);
+  if (!record || !r || r.operation !== op) return null;
+  const binding = Object.freeze({
+    observe(phase) {
+      const task = record.queue.then(async () => {
+        try {
+          clock(record, phase);
+          await grant(authority, r, record, phase);
+          const now = clock(record, phase); record.generation++;
+          const checkpoint = Object.freeze({}); checkpoints.set(checkpoint, { record, generation: record.generation, phase });
+          return Object.freeze({ status: 'current', checkpoint, receipt: receipt(record, now) });
+        } catch (e) { return failed(failures.get(e) ?? 'PROTECTION_PROVIDER_FAILED', phase); }
+      });
+      record.queue = task.then(() => undefined, () => undefined); return task;
+    },
+    assertCurrent(checkpoint) {
+      const cp = checkpoints.get(checkpoint);
+      if (!cp || cp.record !== record) return failed();
+      try {
+        const now = clock(record, cp.phase);
+        need(record.generation === cp.generation, 'PROTECTION_STATE_ROLLBACK');
+        return Object.freeze({ status: 'current', receipt: receipt(record, now) });
+      } catch (e) { return failed(failures.get(e) ?? 'PROTECTION_PROVIDER_FAILED', cp.phase); }
+    }
+  });
+  return { record, binding };
+}
+async function admit(snapshot, admitted, authority) {
+  const origin = origins.get(snapshot), raw = request(admitted);
+  if (!origin || origin.phase !== 'available' || !raw || raw.operation || raw.data.mode === 'expand' || !authorities.has(authority)) return failed();
+  // Consume the genuine origin before any clock/authority callback can reenter.
+  origin.phase = 'reserved';
+  let op;
+  try {
+    op = Object.freeze({});
+    const nativeSnapshot = Object.freeze({}), metadata = origin.metadata;
+    const view = frozen({ ...origin.view, observation: metadata.observation });
+    const record = { id: 'browser-protection:' + globalThis.crypto.randomUUID(), origin, view, metadata,
+      base: { capture: { capture_id: 'browser-origin:' + globalThis.crypto.randomUUID() } },
+      disposed: false, generation: 0, lastTime: 0, queue: Promise.resolve(), releases: new Set() };
+    operations.set(op, record); snapshots.set(nativeSnapshot, record);
+    need(strict.canonicalJson(raw.data.tuple) === strict.canonicalJson(view.tuple), 'READ_UNSUPPORTED_VERSION');
+    const token = normalized(raw, view), r = requests.get(token);
+    pairRequest(token, op);
+    await grant(authority, r, record, 'admit_retained_protected_snapshot');
+    const now = clock(record, 'authorization'); origin.phase = 'active';
+    const proof = receipt(record, now); record.receipt = proof;
+    return Object.freeze({ status: 'accepted', request: token, snapshot: nativeSnapshot, operation: op,
+      receipt: proof, observation: view.observation, disclosure: metadata.disclosure, physical_reads: 'none' });
+  } catch (e) {
+    dispose(op);
+    origin.phase = 'closed'; origin.view = null; origin.metadata = null;
+    return failed(failures.get(e) ?? 'READ_CORE_CAPABILITY_UNAVAILABLE', 'authorization');
+  }
+}
+module.exports = { C, tuple, frozen, register, mintRequest, request, inspectRequest, normalized, createAuthority,
+  operation, inspectSnapshot: inspectProtectedSnapshot, pairRequest, dispose, onDispose, grant, bind, admit };

package/src/public-contract/browserwhole06/contract.json

@@ -2,8 +2,8 @@
   "candidate_only": true,
   "source": {
     "path": "specs/public-semantic-source.json",
-    "bytes": 1435348,
-    "sha256": "fdcb204c8942ddc10ed5d8d6658a9317102822b5b9c500bc07e5086d5668fc9f"
+    "bytes": 1506884,
+    "sha256": "a05af27e97be03a8909375217ab353017b72a10532ad7d700b6ae278e30d1d5f"
   },
   "historical_original_source": {
     "scope": "historical_original_contract_source_identity_not_current_generator_input",

package/src/public-contract/creation06/contract.json

@@ -2,8 +2,8 @@
   "candidate_only": true,
   "source": {
     "path": "specs/public-semantic-source.json",
-    "bytes": 1435348,
-    "sha256": "fdcb204c8942ddc10ed5d8d6658a9317102822b5b9c500bc07e5086d5668fc9f"
+    "bytes": 1506884,
+    "sha256": "a05af27e97be03a8909375217ab353017b72a10532ad7d700b6ae278e30d1d5f"
   },
   "historical_original_source": {
     "scope": "historical_original_contract_source_identity_not_current_generator_input",

package/src/public-contract/creation06/generation-manifest.json

@@ -3,14 +3,14 @@
   "candidate_only": true,
   "source": {
     "path": "specs/public-semantic-source.json",
-    "bytes": 1435348,
-    "sha256": "fdcb204c8942ddc10ed5d8d6658a9317102822b5b9c500bc07e5086d5668fc9f"
+    "bytes": 1506884,
+    "sha256": "a05af27e97be03a8909375217ab353017b72a10532ad7d700b6ae278e30d1d5f"
   },
   "producer": {
     "recipe": {
       "path": "scripts/public-contract/native-output-recipe.json",
-      "bytes": 155707,
-      "sha256": "bea4b4a4d426e1b3b23ffb818715712b87114ce32d1db80ab2a24f8efca87a60"
+      "bytes": 164001,
+      "sha256": "076b8d75b26d3c675fb8f89768e7d3cdddc448f2f29b19adb28b768a0c4dfbfb"
     },
     "scripts": [
       {
@@ -20,8 +20,8 @@
       },
       {
         "path": "scripts/public-contract/native-renderer.mjs",
-        "bytes": 19534,
-        "sha256": "05a359837c3c61d18ecc3fe109387ade921daf25eb12a8530e7a5b7550dfe1c7"
+        "bytes": 20169,
+        "sha256": "44806a5a6dc43b141791b62b3683acd3145ac14b67ee5e6077923c5c62ca0187"
       },
       {
         "path": "scripts/public-contract/generation-writer.mjs",
@@ -30,8 +30,8 @@
       },
       {
         "path": "scripts/public-contract/generate.mjs",
-        "bytes": 72318,
-        "sha256": "cd1914a7fd684fc033f635bd331bb5491446222352097fec72dc05982e0e4661"
+        "bytes": 73563,
+        "sha256": "73f19333a9fbff08480884d8b35ade372fe8b682ea25a77d9b370dc88c740f86"
       }
     ]
   },
@@ -181,7 +181,7 @@
     {
       "path": "packages/kdna-core/src/public-contract/creation06/contract.json",
       "bytes": 71166,
-      "sha256": "3add833e9d22775b745eed8aaec2ab40872679e7338fa5a704db639f5ca53861"
+      "sha256": "bf1bb5bf0b6f3d7d38c2a3c63c413942f377c061bd01eb9b0868a2d9fdca6f8f"
     },
     {
       "path": "packages/kdna-core/src/public-contract/creation06/api.d.ts",

package/src/public-contract/execution06/contract.json

@@ -2,8 +2,8 @@
   "candidate_only": true,
   "source": {
     "path": "specs/public-semantic-source.json",
-    "bytes": 1435348,
-    "sha256": "fdcb204c8942ddc10ed5d8d6658a9317102822b5b9c500bc07e5086d5668fc9f"
+    "bytes": 1506884,
+    "sha256": "a05af27e97be03a8909375217ab353017b72a10532ad7d700b6ae278e30d1d5f"
   },
   "historical_original_source": {
     "scope": "historical_original_contract_source_identity_not_current_generator_input",

package/src/public-contract/execution06/generation-manifest.json

@@ -3,14 +3,14 @@
   "candidate_only": true,
   "source": {
     "path": "specs/public-semantic-source.json",
-    "bytes": 1435348,
-    "sha256": "fdcb204c8942ddc10ed5d8d6658a9317102822b5b9c500bc07e5086d5668fc9f"
+    "bytes": 1506884,
+    "sha256": "a05af27e97be03a8909375217ab353017b72a10532ad7d700b6ae278e30d1d5f"
   },
   "producer": {
     "recipe": {
       "path": "scripts/public-contract/native-output-recipe.json",
-      "bytes": 155707,
-      "sha256": "bea4b4a4d426e1b3b23ffb818715712b87114ce32d1db80ab2a24f8efca87a60"
+      "bytes": 164001,
+      "sha256": "076b8d75b26d3c675fb8f89768e7d3cdddc448f2f29b19adb28b768a0c4dfbfb"
     },
     "scripts": [
       {
@@ -20,8 +20,8 @@
       },
       {
         "path": "scripts/public-contract/native-renderer.mjs",
-        "bytes": 19534,
-        "sha256": "05a359837c3c61d18ecc3fe109387ade921daf25eb12a8530e7a5b7550dfe1c7"
+        "bytes": 20169,
+        "sha256": "44806a5a6dc43b141791b62b3683acd3145ac14b67ee5e6077923c5c62ca0187"
       },
       {
         "path": "scripts/public-contract/generation-writer.mjs",
@@ -30,8 +30,8 @@
       },
       {
         "path": "scripts/public-contract/generate.mjs",
-        "bytes": 72318,
-        "sha256": "cd1914a7fd684fc033f635bd331bb5491446222352097fec72dc05982e0e4661"
+        "bytes": 73563,
+        "sha256": "73f19333a9fbff08480884d8b35ade372fe8b682ea25a77d9b370dc88c740f86"
       }
     ]
   },
@@ -518,7 +518,7 @@
     {
       "path": "packages/kdna-core/src/public-contract/execution06/contract.json",
       "bytes": 225481,
-      "sha256": "b12a14fe7966acefecffe19fb4b01666951a1ba378c16181e6a3677f7552980b"
+      "sha256": "6fba0f509cb92566eb58d7298f1c58f89badf39b0b0ed37dc09820ce30cff22b"
     },
     {
       "path": "packages/kdna-core/src/public-contract/execution06/api.d.ts",

package/src/public-contract/generated-contract.json

@@ -809,12 +809,12 @@
     },
     "schema_paths": {
       "CanonicalIR": "specs/canonical-ir-0.6.1.schema.json",
-      "IssuerResultObservation": "specs/external-grant-issuer-r2-binding-7.schema.json",
+      "IssuerResultObservation": "specs/external-grant-issuer-r2-binding-8.schema.json",
       "Manifest": "schema/manifest-container-0.5.0-judgment-0.5.1.schema.json",
       "PackageSetNodeSurface": "specs/package-set-node-0.2.1.schema.json",
       "Payload": "schema/payload-profile-0.5.1.schema.json",
-      "ProtectedSourceObservation": "specs/protected-source-r2-binding-7.schema.json",
-      "ProtectionDefinitionObservation": "specs/protection-admission-r2-binding-7.schema.json",
+      "ProtectedSourceObservation": "specs/protected-source-r2-binding-8.schema.json",
+      "ProtectionDefinitionObservation": "specs/protection-admission-r2-binding-8.schema.json",
       "PublicAgentHostReceipt": "schema/agent-host-receipt-0.3.1.schema.json",
       "PublicAgentHostRequest": "schema/agent-host-request-0.3.1.schema.json",
       "PublicConsumptionPlan": "schema/consumption-plan-0.3.1.schema.json",

package/src/public-contract/issuer-contract.generated.json

@@ -1,6 +1,6 @@
 {
   "api_typescript": "export type IssuerSecrets = { readonly issuerRootKey: Uint8Array; readonly issuerSigningPrivateKeyPkcs8: Uint8Array; readonly signaturePolicy: IssuerSignaturePolicy };\nexport type IssuanceResult = (IssuerIssuedObservation & { readonly grantBytes: Uint8Array }) | IssuerCoreRejectedObservation | IssuerFailedObservation;\nexport declare function getExternalGrantIssuerContract(): IssuerDescriptor;\nexport declare function issueExternalKeyGrantForAsset(input: string | Uint8Array, options: IssuerOptions, secrets: IssuerSecrets): Promise<IssuanceResult>;\n",
-  "definition_digest": "sha256:eedb408131beb2769f8791c6372b70cf0df2dbfffc2e017d3933d52898483ae5",
+  "definition_digest": "sha256:33e91624bc825ccdbbd7b0e85f961f0b455bb72cabd1fac6397f1e3fee319329",
   "derived_runtime_enforcement": {
     "ISSUER-AUTHENTICATION": {
       "generator_machine_check": "none",
@@ -384,8 +384,8 @@
   "runtime_not_implemented": [],
   "schema_binding": {
     "package_versions": {
-      "@aikdna/kdna-core": "0.36.0",
-      "@aikdna/kdna-read": "0.11.0"
+      "@aikdna/kdna-core": "0.37.1-rc.browser.1",
+      "@aikdna/kdna-read": "0.11.2-rc.browser.1"
     },
     "version_tuple": {
       "container": "0.5.0",
@@ -400,8 +400,8 @@
       "trace": "kdna.judgment-trace/0.3.1"
     }
   },
-  "schema_id": "urn:kdna:schema:external-grant-issuer:1.0.0:binding:r2:7",
-  "schema_path": "specs/external-grant-issuer-r2-binding-7.schema.json",
+  "schema_id": "urn:kdna:schema:external-grant-issuer:1.0.0:binding:r2:8",
+  "schema_path": "specs/external-grant-issuer-r2-binding-8.schema.json",
   "status": "IMPLEMENTATION_CANDIDATE_NOT_ACCEPTED",
   "types": {
     "IssuerAdmissionObservation": {
@@ -543,7 +543,7 @@
               "type": "string"
             },
             "version": {
-              "const": "0.36.0",
+              "const": "0.37.1-rc.browser.1",
               "type": "string"
             }
           },