@githolon/dsl 0.117.1 → 0.119.9

package/src/reception_unit_artifact_contract.ts

@@ -0,0 +1,220 @@
+/** Additive CAP-884 prototype. Content checks do not authenticate law provenance:
+ * the caller must obtain this exact unit/template association from installed law. */
+import { receptionSha256, RECEPTION_RUNTIME_CONTRACT, type ReceptionOperation, type ReceptionTemplate } from "./reception_artifact_contract.js";
+export { receptionSha256, RECEPTION_RUNTIME_CONTRACT };
+export const RECEPTION_UNIT_GENERATOR = "nomos-typescript-unit-reception-v1";
+export const UNIT_RECEPTION_ARTIFACT_FORMAT = "nomos.reception-unit-artifact.v1";
+export const CLOSURE_RECEPTION_MANIFEST_FORMAT = "nomos.reception-closure-manifest.v1";
+export const UNIT_RECEPTION_SOURCE_LIMIT = 16 * 1024 * 1024;
+export interface UnitReceptionInput {
+  readonly unitKey: string;
+  readonly unitHash: string;
+  readonly domain: string;
+  readonly generator: string;
+  readonly runtimeContract: string;
+  readonly template: ReceptionTemplate;
+}
+export interface UnitReceptionManifest {
+  readonly format: typeof UNIT_RECEPTION_ARTIFACT_FORMAT;
+  readonly artifactId: string;
+  readonly unitKey: string;
+  readonly unitHash: string;
+  readonly domain: string;
+  readonly generator: string;
+  readonly runtimeContract: string;
+  readonly entrypoint: "reception-unit.mjs";
+  readonly moduleSha256: string;
+  readonly factory: string;
+  readonly factorySha256: string;
+  readonly sourceSha256: string;
+  readonly bindingSha256: string;
+  readonly protoSha256: string;
+  readonly operations: readonly ReceptionOperation[];
+}
+export interface UnitReceptionArtifact { readonly manifest: UnitReceptionManifest; readonly moduleSource: string }
+export interface ClosureReceptionOperation extends ReceptionOperation {
+  readonly domain: string;
+  readonly unitKey: string;
+  readonly unitHash: string;
+  readonly artifactId: string;
+  readonly moduleSha256: string;
+}
+export interface ClosureReceptionManifest {
+  readonly format: typeof CLOSURE_RECEPTION_MANIFEST_FORMAT;
+  readonly manifestId: string;
+  readonly closure: string;
+  readonly generator: string;
+  readonly runtimeContract: string;
+  readonly units: readonly UnitReceptionManifest[];
+  readonly operations: readonly ClosureReceptionOperation[];
+}
+export interface ClosureReceptionManifestInput {
+  readonly closure: string;
+  readonly generator: string;
+  readonly runtimeContract: string;
+  readonly units: readonly UnitReceptionManifest[];
+  /** Exact public facet coverage supplied by authoritative installed declarations. */
+  readonly domains: readonly string[];
+}
+export interface UnitReceptionSelection {
+  readonly closure: string;
+  readonly domain: string;
+  readonly member: string;
+}
+export interface UnitReceptionInvocationBinding extends ClosureReceptionOperation { readonly closure: string }
+export interface PreparedUnitReceptionBinding {
+  readonly closure: string;
+  readonly unit: UnitReceptionManifest;
+  bind(selection: UnitReceptionSelection): UnitReceptionInvocationBinding;
+}
+type UnitExpectation = Pick<UnitReceptionManifest, "unitKey" | "unitHash" | "domain" | "generator" | "runtimeContract">;
+type ClosureExpectation = Pick<ClosureReceptionManifest, "closure" | "generator" | "runtimeContract">;
+const HEX = /^[0-9a-f]{64}$/;
+const compare = (a: string, b: string) => a < b ? -1 : a > b ? 1 : 0;
+const dangerous = new Set(["constructor", "prototype", "__proto__"]);
+export function unitReceptionUnavailable(message: string): never {
+  throw Object.assign(new Error(message), { code: "nomos.reception.unit.unavailable" });
+}
+/** Detach before the first await. No getters, inherited state or mutable caller aliases. */
+export function snapshotUnitReceptionValue<T>(input: T): T {
+  const visit = (value: unknown, depth: number): unknown => {
+    if (depth > 64) unitReceptionUnavailable("Reception metadata nesting exceeds runtime safety limit");
+    if (value === null || value === undefined || ["string", "boolean"].includes(typeof value)) return value;
+    if (typeof value === "number" && Number.isFinite(value)) return value;
+    if (!value || typeof value !== "object" || ![Object.prototype, Array.prototype, null].includes(Object.getPrototypeOf(value))) unitReceptionUnavailable("invalid Reception metadata value");
+    const descriptors = Object.getOwnPropertyDescriptors(value);
+    for (const key of Reflect.ownKeys(value)) {
+      if (typeof key !== "string" || dangerous.has(key) || descriptors[key]!.get || descriptors[key]!.set) unitReceptionUnavailable("unsafe Reception metadata property");
+    }
+    if (Array.isArray(value)) {
+      const keys = Object.keys(descriptors).filter(key => key !== "length");
+      if (keys.some(key => !/^(0|[1-9][0-9]*)$/.test(key) || Number(key) >= value.length)) unitReceptionUnavailable("invalid Reception array property");
+      // Refuse sparse lengths before allocating a second array of that length.
+      if (keys.length !== value.length) unitReceptionUnavailable("sparse Reception array");
+      return Object.freeze(Array.from({ length: value.length }, (_item, index) => {
+        const item = descriptors[String(index)];
+        if (!item) unitReceptionUnavailable("sparse Reception array");
+        return visit(item.value, depth + 1);
+      }));
+    }
+    return Object.freeze(Object.fromEntries(Object.entries(descriptors).map(([key, descriptor]) => [key, visit(descriptor.value, depth + 1)])));
+  };
+  return visit(input, 0) as T;
+}
+function record(value: unknown, keys: readonly string[]): asserts value is Record<string, unknown> {
+  if (!value || typeof value !== "object" || Array.isArray(value) ||
+    ![Object.prototype, null].includes(Object.getPrototypeOf(value))) unitReceptionUnavailable("invalid Reception record");
+  const descriptors = Object.getOwnPropertyDescriptors(value);
+  if (Reflect.ownKeys(value).some(key => typeof key !== "string" || !keys.includes(key) || descriptors[key]!.get || descriptors[key]!.set) ||
+    keys.some(key => !Object.hasOwn(descriptors, key))) unitReceptionUnavailable("Reception record has missing or unknown fields");
+}
+export { record as assertUnitReceptionRecord };
+function text(value: unknown, pattern: RegExp, name: string): asserts value is string {
+  if (typeof value !== "string" || value.length > 256 || !pattern.test(value) || dangerous.has(value)) unitReceptionUnavailable(`invalid Reception ${name}`);
+}
+function digest(value: unknown): asserts value is string {
+  if (typeof value !== "string" || !HEX.test(value)) unitReceptionUnavailable("invalid Reception digest");
+}
+export function validateUnitReceptionIdentity(value: UnitExpectation): void {
+  text(value.unitKey, /^[A-Za-z0-9][A-Za-z0-9._:-]*$/, "unit key");
+  text(value.domain, /^[A-Za-z0-9][A-Za-z0-9_.-]*$/, "domain");
+  digest(value.unitHash);
+  if (value.generator !== RECEPTION_UNIT_GENERATOR || value.runtimeContract !== RECEPTION_RUNTIME_CONTRACT) unitReceptionUnavailable("unsupported unit Reception generator/runtime");
+}
+export function canonicalReceptionOperations(value: readonly ReceptionOperation[]): readonly ReceptionOperation[] {
+  if (!Array.isArray(value)) unitReceptionUnavailable("invalid Reception operation inventory");
+  const seen = new Set<string>();
+  const result = value.map(operation => {
+    record(operation, ["member", "kind", "selector"]);
+    text(operation.member, /^[A-Za-z0-9_][A-Za-z0-9_.-]*$/, "member");
+    if (operation.member.split(".").some(part => !part || dangerous.has(part) || part.startsWith("__") || part.startsWith("watch"))) unitReceptionUnavailable("unsupported stateless Reception member");
+    if (typeof operation.selector !== "string" || !operation.selector || operation.selector.length > 256 || dangerous.has(operation.selector)) unitReceptionUnavailable("invalid Reception selector");
+    if (typeof operation.kind !== "string" || !["offer", "query", "byType", "byId"].includes(operation.kind) || seen.has(operation.member)) unitReceptionUnavailable("duplicate or invalid Reception operation");
+    seen.add(operation.member);
+    return { member: operation.member, kind: operation.kind, selector: operation.selector } as ReceptionOperation;
+  });
+  return result.sort((a, b) => compare(a.member, b.member));
+}
+const unitKeys = ["format", "artifactId", "unitKey", "unitHash", "domain", "generator", "runtimeContract", "entrypoint", "moduleSha256", "factory", "factorySha256", "sourceSha256", "bindingSha256", "protoSha256", "operations"];
+function unitPreimage(unit: Omit<UnitReceptionManifest, "artifactId">): unknown {
+  return [unit.format, unit.unitKey, unit.unitHash, unit.domain, unit.generator, unit.runtimeContract, unit.entrypoint,
+    unit.moduleSha256, unit.factory, unit.factorySha256, unit.sourceSha256, unit.bindingSha256, unit.protoSha256,
+    unit.operations.map(operation => [operation.member, operation.kind, operation.selector])];
+}
+export async function unitReceptionArtifactIdentity(unit: Omit<UnitReceptionManifest, "artifactId">): Promise<string> {
+  return receptionSha256(JSON.stringify(unitPreimage(unit)));
+}
+export async function verifyUnitReceptionManifest(unit: UnitReceptionManifest, expected?: UnitExpectation): Promise<void> {
+  unit = snapshotUnitReceptionValue(unit);
+  if (expected) expected = snapshotUnitReceptionValue(expected);
+  record(unit, unitKeys);
+  validateUnitReceptionIdentity(unit);
+  if (unit.format !== UNIT_RECEPTION_ARTIFACT_FORMAT || unit.entrypoint !== "reception-unit.mjs") unitReceptionUnavailable("unsupported unit Reception format");
+  text(unit.factory, /^[A-Za-z_$][A-Za-z0-9_$]*$/, "factory");
+  for (const hash of [unit.artifactId, unit.moduleSha256, unit.factorySha256, unit.sourceSha256, unit.bindingSha256, unit.protoSha256]) digest(hash);
+  const operations = canonicalReceptionOperations(unit.operations);
+  if (operations.some((operation, index) => operation.member !== unit.operations[index]!.member)) unitReceptionUnavailable("noncanonical Reception operations");
+  if (unit.artifactId !== await unitReceptionArtifactIdentity(unit)) unitReceptionUnavailable("unit Reception identity mismatch");
+  if (expected && (["unitKey", "unitHash", "domain", "generator", "runtimeContract"] as const).some(key => unit[key] !== expected[key])) unitReceptionUnavailable("unit Reception provenance mismatch");
+}
+export async function verifyUnitReceptionArtifact(artifact: UnitReceptionArtifact, expected?: UnitExpectation): Promise<void> {
+  artifact = snapshotUnitReceptionValue(artifact);
+  if (expected) expected = snapshotUnitReceptionValue(expected);
+  record(artifact, ["manifest", "moduleSource"]);
+  await verifyUnitReceptionManifest(artifact.manifest, expected);
+  if (typeof artifact.moduleSource !== "string" || artifact.moduleSource.length > UNIT_RECEPTION_SOURCE_LIMIT || new TextEncoder().encode(artifact.moduleSource).byteLength > UNIT_RECEPTION_SOURCE_LIMIT ||
+    await receptionSha256(artifact.moduleSource) !== artifact.manifest.moduleSha256) unitReceptionUnavailable("unit Reception module digest mismatch");
+}
+export function closureReceptionOperations(units: readonly UnitReceptionManifest[]): readonly ClosureReceptionOperation[] {
+  return units.flatMap(unit => unit.operations.map(operation => ({ domain: unit.domain, ...operation,
+    unitKey: unit.unitKey, unitHash: unit.unitHash, artifactId: unit.artifactId, moduleSha256: unit.moduleSha256 })))
+    .sort((a, b) => compare(a.domain, b.domain) || compare(a.member, b.member));
+}
+export async function closureReceptionManifestIdentity(manifest: Omit<ClosureReceptionManifest, "manifestId">): Promise<string> {
+  return receptionSha256(JSON.stringify([manifest.format, manifest.closure, manifest.generator, manifest.runtimeContract,
+    manifest.units.map(unit => unit.artifactId), manifest.operations.map(operation => [operation.domain, operation.member, operation.kind,
+      operation.selector, operation.unitKey, operation.unitHash, operation.artifactId, operation.moduleSha256])]));
+}
+export async function verifyClosureReceptionManifest(manifest: ClosureReceptionManifest, expected?: ClosureExpectation): Promise<void> {
+  manifest = snapshotUnitReceptionValue(manifest);
+  if (expected) expected = snapshotUnitReceptionValue(expected);
+  record(manifest, ["format", "manifestId", "closure", "generator", "runtimeContract", "units", "operations"]);
+  digest(manifest.closure); digest(manifest.manifestId);
+  if (manifest.format !== CLOSURE_RECEPTION_MANIFEST_FORMAT || manifest.generator !== RECEPTION_UNIT_GENERATOR || manifest.runtimeContract !== RECEPTION_RUNTIME_CONTRACT) unitReceptionUnavailable("unsupported closure Reception format");
+  if (!Array.isArray(manifest.units) || manifest.units.length === 0) unitReceptionUnavailable("invalid closure Reception units");
+  const keys = new Set<string>(), domains = new Set<string>();
+  for (const unit of manifest.units) {
+    await verifyUnitReceptionManifest(unit);
+    if (unit.generator !== manifest.generator || unit.runtimeContract !== manifest.runtimeContract || keys.has(unit.unitKey) || domains.has(unit.domain)) unitReceptionUnavailable("duplicate or mismatched closure Reception unit/domain");
+    keys.add(unit.unitKey); domains.add(unit.domain);
+  }
+  if (manifest.units.some((unit, index) => index > 0 && compare(manifest.units[index - 1]!.unitKey, unit.unitKey) >= 0)) unitReceptionUnavailable("noncanonical closure Reception units");
+  if (!Array.isArray(manifest.operations)) unitReceptionUnavailable("invalid closure Reception operations");
+  for (const operation of manifest.operations) record(operation, ["domain", "member", "kind", "selector", "unitKey", "unitHash", "artifactId", "moduleSha256"]);
+  const tuple = (operation: ClosureReceptionOperation) => [operation.domain, operation.member, operation.kind, operation.selector, operation.unitKey, operation.unitHash, operation.artifactId, operation.moduleSha256];
+  if (JSON.stringify(closureReceptionOperations(manifest.units).map(tuple)) !== JSON.stringify(manifest.operations.map(tuple))) unitReceptionUnavailable("closure Reception operation membership mismatch");
+  if (manifest.manifestId !== await closureReceptionManifestIdentity(manifest)) unitReceptionUnavailable("closure Reception identity mismatch");
+  if (expected && (["closure", "generator", "runtimeContract"] as const).some(key => manifest[key] !== expected[key])) unitReceptionUnavailable("closure Reception provenance mismatch");
+}
+/** Load-boundary verification; the returned lookup captures a detached immutable snapshot. */
+export async function prepareUnitReceptionBinding(manifest: ClosureReceptionManifest, artifact: UnitReceptionArtifact): Promise<PreparedUnitReceptionBinding> {
+  manifest = snapshotUnitReceptionValue(manifest);
+  artifact = snapshotUnitReceptionValue(artifact);
+  await verifyClosureReceptionManifest(manifest);
+  await verifyUnitReceptionArtifact(artifact);
+  const found = manifest.units.find(unit => unit.unitKey === artifact.manifest.unitKey);
+  if (!found || found.artifactId !== artifact.manifest.artifactId) unitReceptionUnavailable("unit Reception is absent from closure membership");
+  const unit = Object.freeze({ ...artifact.manifest, operations: Object.freeze(artifact.manifest.operations.map(operation => Object.freeze({ ...operation }))) });
+  const closure = manifest.closure;
+  const lookup = new Map(manifest.operations.filter(operation => operation.unitKey === unit.unitKey)
+    .map(operation => [operation.member, Object.freeze({ ...operation, closure })]));
+  return Object.freeze({ closure, unit, bind(selection: UnitReceptionSelection) {
+    if (selection.closure !== closure || selection.domain !== unit.domain) unitReceptionUnavailable("unit Reception invocation closure/domain mismatch");
+    const selected = lookup.get(selection.member);
+    if (!selected) unitReceptionUnavailable("unit Reception invocation member is absent");
+    return selected;
+  } });
+}
+export function bindUnitReceptionInvocation(prepared: PreparedUnitReceptionBinding, selection: UnitReceptionSelection): UnitReceptionInvocationBinding {
+  return prepared.bind(selection);
+}

package/src/reception_unit_context.ts

@@ -0,0 +1,47 @@
+// A unit Reception's ABI requirements follow the compiler's resolved nominal dependency
+// edges. Package membership alone never makes an unrelated domain part of its context.
+import type { DomainModule } from "./codegen_dart.js";
+import type { LawGraph } from "./law_graph.js";
+import type { LawDependencyIndex } from "./law_dependency_index.js";
+import { requiredKernelContracts } from "./kernel_capabilities.js";
+
+type Node = LawGraph["nodes"][number];
+
+/** Reuse the exact graphs, emitted paths and resolver-backed dependency index used to lower
+ * the composed package. Ownership is by graph/node identity, never a first matching label.
+ * This selects compiler context only; it changes no law identities or admission decisions. */
+export class ReceptionUnitContextIndex {
+  private readonly owners = new Map<Node, DomainModule>();
+  private readonly modules = new Map<LawGraph, DomainModule>();
+
+  constructor(
+    composition: readonly { readonly module: DomainModule; readonly graph: LawGraph }[],
+    private readonly dependencies: LawDependencyIndex,
+    private readonly emittedPaths: ReadonlyMap<Node, string>,
+  ) {
+    for (const { module, graph } of composition) {
+      if (this.modules.has(graph)) throw new Error("Reception unit context has duplicate graph ownership");
+      this.modules.set(graph, module);
+      for (const node of graph.nodes) {
+        if (this.owners.has(node)) throw new Error("Reception unit context has duplicate node ownership");
+        this.owners.set(node, module);
+      }
+    }
+  }
+
+  forGraph(graph: LawGraph) {
+    const owner = this.modules.get(graph);
+    if (!owner) throw new Error("Reception unit context requires an owned compiler graph");
+    // Source-only anonymous occurrences do not emit prims. The shared dependency index still
+    // refuses any semantic edge that reaches one without an emitted path.
+    const slice = this.dependencies.select(graph.nodes.filter(node => this.emittedPaths.has(node)), true);
+    const modules = new Set<DomainModule>([owner]);
+    for (const node of slice.nodes) {
+      const dependency = this.owners.get(node);
+      if (!dependency) throw new Error("Reception unit dependency has no exact module owner");
+      modules.add(dependency);
+    }
+    const selectedModules = [...modules].sort((a, b) => a.name.localeCompare(b.name));
+    return { modules: selectedModules, kernelContracts: requiredKernelContracts(selectedModules) };
+  }
+}

package/src/reception_unit_source.ts

@@ -0,0 +1,205 @@
+/** Verify compiler metadata from one actually installed law unit. Installed membership/head
+ * authentication belongs to the source port; this verifier binds its opaque key/hash to the
+ * canonical manifest and owned asset bytes. It never executes source or infers a unit from a domain. */
+import { lawUnitHashOf, parseUnitManifest, sha256Hex } from "./release_publication.js";
+import { RECEPTION_GENERATOR, RECEPTION_RUNTIME_CONTRACT, RECEPTION_SOURCE_BYTES_LIMIT,
+  validateReceptionGenerationInput } from "./reception_artifact_contract.js";
+import { RECEPTION_UNIT_GENERATOR, snapshotUnitReceptionValue, type UnitReceptionInput } from "./reception_unit_artifact_contract.js";
+import { usdaUnquote } from "./usda_text.js";
+
+export interface InstalledReceptionUnit { readonly unitKey: string; readonly unitHash: string }
+export interface UnitReceptionSourceLimits {
+  readonly maxManifestBytes: number;
+  readonly maxDomainAssetBytes: number;
+  /** Per-unit decoded compiler sources; the existing template decoder also enforces its 16MiB ceiling. */
+  readonly maxDecodedSourceBytes: number;
+}
+export interface InspectInstalledUnitReceptionManifestInput {
+  readonly installed: InstalledReceptionUnit;
+  readonly expectedDomain?: string;
+  readonly manifestBytes: Uint8Array;
+  readonly limits: UnitReceptionSourceLimits;
+}
+interface InspectedUnitBase {
+  readonly unitKey: string;
+  readonly unitHash: string;
+  readonly manifestSha256: string;
+  readonly manifestBytes: number;
+  readonly assets: readonly { readonly logicalPath: string; readonly sha256: string }[];
+  readonly routes: readonly { readonly selector: string; readonly planSha256: string }[];
+}
+export type InspectedUnitReceptionManifest = InspectedUnitBase & (
+  { readonly kind: "domain"; readonly domain: string; readonly domainAsset: { readonly logicalPath: string; readonly sha256: string } }
+  | { readonly kind: "framework" | "composition" }
+);
+export interface VerifyInstalledUnitReceptionSourceInput extends InspectInstalledUnitReceptionManifestInput {
+  readonly generator: string;
+  readonly runtimeContract: string;
+  readonly domainAsset?: { readonly logicalPath: string; readonly bytes: Uint8Array };
+}
+export type VerifiedInstalledUnitReceptionSource =
+  | { readonly kind: "public"; readonly unit: InspectedUnitReceptionManifest & { readonly kind: "domain" }; readonly domainAssetBytes: number; readonly input: UnitReceptionInput }
+  | { readonly kind: "private"; readonly unit: InspectedUnitReceptionManifest & { readonly kind: "domain" }; readonly domainAssetBytes: number }
+  | { readonly kind: "no-runtime"; readonly unit: InspectedUnitReceptionManifest & { readonly kind: "framework" | "composition" } };
+export type UnitReceptionSourceFailureCode = "input" | "limit" | "manifest" | "membership" | "asset" | "domain" | "template-unavailable" | "metadata";
+export class UnitReceptionSourceUnavailable extends Error {
+  readonly code: UnitReceptionSourceFailureCode;
+  constructor(code: UnitReceptionSourceFailureCode) {
+    super(`nomos.reception.unit_source_${code}`);
+    this.code = code;
+  }
+}
+function refuse(code: UnitReceptionSourceFailureCode): never { throw new UnitReceptionSourceUnavailable(code); }
+const HEX = /^[0-9a-f]{64}$/;
+const DOMAIN = /^[A-Za-z_][A-Za-z0-9_.-]{0,127}$/;
+const safePath = (path: string) => path.length > 0 && path.length <= 512 && !path.startsWith("/") && !path.includes("\\")
+  && !/[\x00-\x1f\x7f]/.test(path) && path.split("/").every(part => part !== "" && part !== "." && part !== "..");
+function record(value: unknown, keys: readonly string[]): void {
+  if (!value || typeof value !== "object" || Array.isArray(value) || ![Object.prototype, null].includes(Object.getPrototypeOf(value))) refuse("input");
+  const properties = Object.getOwnPropertyDescriptors(value);
+  if (Reflect.ownKeys(properties).some(key => typeof key !== "string" || !keys.includes(key)) || keys.some(key => !Object.hasOwn(properties, key))
+    || Object.values(properties).some(property => property.get || property.set)) refuse("input");
+}
+function limitsOf(input: UnitReceptionSourceLimits): UnitReceptionSourceLimits {
+  record(input, ["maxManifestBytes", "maxDomainAssetBytes", "maxDecodedSourceBytes"]);
+  const result = snapshotUnitReceptionValue(input);
+  if (Object.values(result).some(value => !Number.isSafeInteger(value) || value <= 0) || result.maxDecodedSourceBytes > RECEPTION_SOURCE_BYTES_LIMIT) refuse("limit");
+  return result;
+}
+function bytesOf(value: Uint8Array, limit: number): Uint8Array {
+  if (!ArrayBuffer.isView(value) || !(value instanceof Uint8Array)) refuse("input");
+  // Read/copy internal typed-array storage, never a caller's iterator, slice, buffer or
+  // byteLength accessor. Enumerating every byte's property descriptor would amplify memory.
+  const size = Object.getOwnPropertyDescriptor(Object.getPrototypeOf(Uint8Array.prototype), "byteLength")!.get!.call(value) as number;
+  if (size === 0 || size > limit) refuse("limit");
+  return new Uint8Array(value);
+}
+function detached(input: InspectInstalledUnitReceptionManifestInput, verify: boolean) {
+  if (!input || typeof input !== "object") refuse("input");
+  const keys = ["installed", "manifestBytes", "limits", ...(Object.hasOwn(input, "expectedDomain") ? ["expectedDomain"] : []),
+    ...(verify ? ["generator", "runtimeContract", ...(Object.hasOwn(input, "domainAsset") ? ["domainAsset"] : [])] : [])];
+  record(input, keys);
+  record(input.installed, ["unitKey", "unitHash"]);
+  const installed = snapshotUnitReceptionValue(input.installed);
+  if (typeof installed.unitKey !== "string" || !installed.unitKey || installed.unitKey.length > 256 || typeof installed.unitHash !== "string" || !HEX.test(installed.unitHash)) refuse("membership");
+  const limits = limitsOf(input.limits);
+  const expectedDomain = input.expectedDomain;
+  if (expectedDomain !== undefined && (typeof expectedDomain !== "string" || !DOMAIN.test(expectedDomain))) refuse("domain");
+  const manifestBytes = bytesOf(input.manifestBytes, limits.maxManifestBytes);
+  return { installed, limits, manifestBytes, expectedDomain };
+}
+const decode = (bytes: Uint8Array, code: UnitReceptionSourceFailureCode): string => {
+  // Preserve a BOM so the canonical manifest round trip refuses those extra bytes.
+  try { return new TextDecoder("utf-8", { fatal: true, ignoreBOM: true }).decode(bytes); } catch { return refuse(code); }
+};
+/** Inspect the manifest before the source port fetches its explicitly inventoried domain asset. */
+export async function inspectInstalledUnitReceptionManifest(input: InspectInstalledUnitReceptionManifestInput): Promise<InspectedUnitReceptionManifest> {
+  const source = detached(input, false);
+  let parsed: Awaited<ReturnType<typeof parseUnitManifest>>;
+  try { parsed = await parseUnitManifest(decode(source.manifestBytes, "manifest"), source.installed.unitKey); } catch { return refuse("manifest"); }
+  if (parsed.key !== source.installed.unitKey || parsed.hash !== source.installed.unitHash) refuse("membership");
+  const ordered = (names: readonly string[]) => names.every((name, index) => index === 0 || names[index - 1]! < name);
+  if (!HEX.test(parsed.hash) || !ordered(parsed.assets.map(asset => asset.logicalPath)) || !ordered(parsed.routes.map(route => route.selector))
+    || parsed.assets.some(asset => !safePath(asset.logicalPath) || asset.logicalPath === "unit.usda" || !HEX.test(asset.sha256))
+    || parsed.routes.some(route => !route.selector || route.selector.length > 512 || /[\x00-\x1f\x7f]/.test(route.selector) || !HEX.test(route.planSha256))) refuse("manifest");
+  if (await lawUnitHashOf(parsed.key, parsed.assets, parsed.routes) !== source.installed.unitHash) refuse("membership");
+  const base: InspectedUnitBase = { unitKey: parsed.key, unitHash: parsed.hash, manifestSha256: await sha256Hex(source.manifestBytes),
+    manifestBytes: source.manifestBytes.byteLength, assets: parsed.assets, routes: parsed.routes };
+  const layers = parsed.assets.filter(asset => /^domains\/[^/]+\.usda$/.test(asset.logicalPath));
+  if (parsed.kind !== "domain") {
+    if (source.expectedDomain !== undefined || layers.length !== 0) refuse("domain");
+    return snapshotUnitReceptionValue({ ...base, kind: parsed.kind });
+  }
+  if (!parsed.domain || !DOMAIN.test(parsed.domain) || layers.length !== 1 || (source.expectedDomain !== undefined && source.expectedDomain !== parsed.domain)) refuse("domain");
+  return snapshotUnitReceptionValue({ ...base, kind: "domain", domain: parsed.domain, domainAsset: layers[0]! });
+}
+/** Inspect only the owning domain's compiler metadata declarations, in the same USDA dialect
+ * the existing template validator accepts. There is no tenant expression or business-plan parsing. */
+function domainMetadata(layer: string): { label: string; private: boolean; hasTemplate: boolean } {
+  const frames: string[] = [];
+  let pending: { name: string; type: string } | undefined;
+  let dictionaryDepth = 0;
+  let hasTemplate = false;
+  const domains = new Map<string, { label?: string; visibility?: string }>();
+  for (const raw of layer.split("\n")) {
+    const line = raw.trim();
+    if (line.endsWith("= {")) { dictionaryDepth++; continue; }
+    if (dictionaryDepth) { if (line === "}") dictionaryDepth--; continue; }
+    const prim = /^(?:def|over)\s+(?:(\w+)\s+)?"([^"\\]+)"(?:\s*\()?\s*$/.exec(line);
+    if (prim) { pending = { name: prim[2]!, type: prim[1] ?? "" }; continue; }
+    if (line === "{") {
+      if (!pending) continue;
+      frames.push(pending.name);
+      if (pending.type === "NomosReceptionTemplate") hasTemplate = true;
+      pending = undefined;
+      const path = `/${frames.join("/")}`;
+      if (/^\/Nomos\/Domains\/d_[0-9a-f]{16}$/.test(path)) {
+        if (domains.has(path)) refuse("domain");
+        domains.set(path, {});
+      }
+      continue;
+    }
+    if (line === "}") { frames.pop(); continue; }
+    const domain = domains.get(`/${frames.join("/")}`);
+    if (!domain) continue;
+    const field = /^(?:custom\s+)?(?:uniform\s+)?(?:string|token)\s+nomos:(label|receptionVisibility)\s*=\s*("(?:[^"\\]|\\.)*")$/.exec(line);
+    if (field) {
+      const key = field[1] === "label" ? "label" : "visibility";
+      if (domain[key] !== undefined) refuse("domain");
+      domain[key] = usdaUnquote(field[2]!);
+    }
+  }
+  const domain = [...domains.values()][0];
+  if (domains.size !== 1 || !domain?.label || (domain.visibility !== undefined && domain.visibility !== "private" && domain.visibility !== "public")) refuse("domain");
+  return { label: domain.label, private: domain.visibility === "private", hasTemplate };
+}
+function preflightSources(layer: string, limit: number): void {
+  let total = 0;
+  for (const match of layer.matchAll(/^\s*(?:custom\s+)?(?:uniform\s+)?string\s+nomos:(sourcesDecodedBytes|factorySourceBase64|clientSourceBase64|operationBindingBase64|operationProtoBase64)\s*=\s*("(?:[^"\\]|\\.)*")\s*$/gm)) {
+    const value = usdaUnquote(match[2]!);
+    const bytes = match[1] === "sourcesDecodedBytes" ? Number(value) : Math.ceil(value.length * 3 / 4);
+    if ((match[1] === "sourcesDecodedBytes" && !/^[1-9][0-9]*$/.test(value)) || !Number.isSafeInteger(bytes) || bytes > limit - total) refuse("limit");
+    total += bytes;
+  }
+}
+/** Reverify the raw manifest instead of trusting an arbitrary caller's inspected object. */
+export async function verifyInstalledUnitReceptionSource(input: VerifyInstalledUnitReceptionSourceInput): Promise<VerifiedInstalledUnitReceptionSource> {
+  const source = detached(input, true);
+  const generator = input.generator, runtimeContract = input.runtimeContract;
+  if (generator !== RECEPTION_UNIT_GENERATOR || runtimeContract !== RECEPTION_RUNTIME_CONTRACT) refuse("input");
+  let domainAsset: { logicalPath: string; bytes: Uint8Array } | undefined;
+  if (input.domainAsset !== undefined) {
+    record(input.domainAsset, ["logicalPath", "bytes"]);
+    if (typeof input.domainAsset.logicalPath !== "string" || !safePath(input.domainAsset.logicalPath)) refuse("asset");
+    domainAsset = { logicalPath: input.domainAsset.logicalPath, bytes: bytesOf(input.domainAsset.bytes, source.limits.maxDomainAssetBytes) };
+  }
+  const unit = await inspectInstalledUnitReceptionManifest({ installed: source.installed, manifestBytes: source.manifestBytes, limits: source.limits,
+    ...(source.expectedDomain === undefined ? {} : { expectedDomain: source.expectedDomain }) });
+  if (unit.kind !== "domain") {
+    if (domainAsset !== undefined) refuse("asset");
+    return snapshotUnitReceptionValue({ kind: "no-runtime", unit });
+  }
+  if (!domainAsset || domainAsset.logicalPath !== unit.domainAsset.logicalPath || await sha256Hex(domainAsset.bytes) !== unit.domainAsset.sha256) refuse("asset");
+  const layer = decode(domainAsset.bytes, "metadata");
+  const declaration = domainMetadata(layer);
+  if (declaration.label !== unit.domain) refuse("domain");
+  if (declaration.private) return snapshotUnitReceptionValue({ kind: "private", unit, domainAssetBytes: domainAsset.bytes.byteLength });
+  if (!declaration.hasTemplate) refuse("template-unavailable");
+  preflightSources(layer, source.limits.maxDecodedSourceBytes);
+  try {
+    // This existing validator only shape-checks its identity argument. The unit hash
+    // is a local validation placeholder, never a claimed installed closure binding.
+    const templates = await validateReceptionGenerationInput({ closure: unit.unitHash, generator: RECEPTION_GENERATOR,
+      runtimeContract, semanticLayer: layer, domains: [unit.domain] });
+    if (templates.length !== 1 || templates[0]!.domain !== unit.domain) refuse("metadata");
+    const template = templates[0]!;
+    const decoded = [template.factorySource, template.clientSource, template.operationBinding, template.operationProto]
+      .reduce((total, text) => total + new TextEncoder().encode(text).byteLength, 0);
+    if (decoded > source.limits.maxDecodedSourceBytes) refuse("limit");
+    return snapshotUnitReceptionValue({ kind: "public", unit, domainAssetBytes: domainAsset.bytes.byteLength,
+      input: { unitKey: unit.unitKey, unitHash: unit.unitHash, domain: unit.domain, generator, runtimeContract, template } });
+  } catch (error) {
+    if (error instanceof UnitReceptionSourceUnavailable) throw error;
+    return refuse("metadata");
+  }
+}