@lapxo/bound 0.1.0 → 0.1.1

package/dist/cli/accept.js

@@ -1,20 +1,22 @@
+import { selectedWireAt } from "../host/selected-topos.js";
 import { timing } from "../host/timing.js";
 import { admittedObjects } from "../host/objects.js";
 import { existsSync, rmdirSync, rmSync } from 'node:fs';
 import { dirname, join, basename } from 'node:path';
 import { closeReceipts, instrumentKeep, instrumentKept } from "../fold/closed.js";
 import { bytesDigest, fullDigest, instrumentOf, signaturesOf } from "../fold/digests.js";
-import { canonical, fromLine, LOCK, parse, wireAt } from '@lapxo/topos/wire';
+import { canonical, fromLine, LOCK, parse } from '@lapxo/topos/wire';
 import { fieldOf, isConfig, foldClaims, sayingOf, selfName } from "../fold/claims.js";
 import { isReaderLock } from "../fold/observed.js";
 import { authorityFor, publicKeyOf, rootSigner, writerFor } from "../fold/signers.js";
 import { lockLines, lockStanding } from "../fold/keys.js";
 import { keepVerdict, keptVerdict, land, landBlob, storeOf } from "../land/ledger.js";
-import { signConsentLine, verifiesOwnerLine } from "../land/sign.js";
-import { appliedIn } from "../fold/signed.js";
+import { signConsentLot, verifiesOwnerLine } from "../land/sign.js";
+import { signerFor } from "../host/signing.js";
+import { appliedIn, ownLockOf } from "../fold/signed.js";
 import { wordOf } from "../fold/wire.js";
 import { hasVouchedTree, landCoordinates, locationsOf, vouchedCoordinates } from "../land/vouched.js";
-import { entriesIn, observeFile, observeText } from "../observe/files.js";
+import { entriesIn, observeFile } from "../observe/files.js";
 import { coneOf, standingOf } from "./place.js";
 import { ownLock, ownRoot, ownStore } from "../observe/runner.js";
 import { widenedWithoutWitness } from "../judge/widening.js";
@@ -85,40 +87,47 @@ export async function signedBatch(root, args, files) {
     }
     const keyFile = valueOf(args, FLAGS.keyFile);
     const keyId = valueOf(args, FLAGS.key) ?? ownerOf(store);
-    if (drafted.length && (!keyFile || !existsSync(keyFile))) {
-        process.stderr.write(`${selfName()}: a drafted batch is signed with --key-file (PKCS8 PEM)\n`);
-        return { kind: 'exit', code: 2 };
-    }
     const publicKey = drafted.length ? publicKeyOf(root, keyId) : undefined;
     if (drafted.length && !publicKey) {
         process.stderr.write(`${selfName()}: unknown key ${keyId} — name it in ${selfName()}.keys\n`);
         return { kind: 'exit', code: 2 };
     }
-    const privateKeyPem = keyFile ? observeText(keyFile) ?? '' : '';
-    const signed = proposed.filter((line) => fieldOf(line, 'sig'));
-    for (const line of drafted) {
-        const got = signConsentLine(line, privateKeyPem, { epoch, by: keyId, algorithm: signaturesOf(store).era });
-        if (got.kind === 'refuse') {
-            process.stderr.write(`${selfName()}: ${got.why}\n`);
+    let signed = proposed.filter((line) => fieldOf(line, 'sig'));
+    if (drafted.length) {
+        let invoke;
+        try {
+            invoke = signerFor([...lockStanding(store), ...destinations.flatMap(place => ownLockOf(root, place))], keyId, valueOf(args, FLAGS.signer), keyFile);
+        }
+        catch (error) {
+            process.stderr.write(`${selfName()}: ${error instanceof Error ? error.message : 'REFUSE·signer unavailable'}\n`);
             return { kind: 'exit', code: 1 };
         }
-        if (!verifiesOwnerLine(got.line, publicKey, signaturesOf(store).admitted)) {
-            process.stderr.write(`${selfName()}: REFUSE·accept the signature does not hold for ${keyId}\n`);
+        const got = await signConsentLot(drafted, { epoch, by: keyId, algorithm: signaturesOf(store).era }, publicKey, signaturesOf(store).admitted, invoke);
+        if (got.kind === 'refuse') {
+            process.stderr.write(`${selfName()}: ${got.why}\n`);
             return { kind: 'exit', code: 1 };
         }
-        signed.push(got.line);
+        let index = 0;
+        signed = proposed.map(line => fieldOf(line, 'sig') ? line : got.lines[index++]);
     }
     const wireLines = [...signedOwnerLines(store), ...signed].flatMap((line) => {
         const got = parse(line);
         return got.kind === 'fact' ? [got.value.fields] : [];
     });
     for (const line of signed) {
-        const got = fromLine(line, wireAt(wireLines, Number(fieldOf(line, 'epoch'))));
+        const got = fromLine(line, selectedWireAt(wireLines, Number(fieldOf(line, 'epoch')), foldClaims(signedOwnerLines(store)).standing.filter(one => fieldOf(one, 'scope').startsWith('uses/') && fieldOf(one, 'value') !== 'withdraw')));
         if (got.kind !== 'fact') {
             process.stderr.write(`${selfName()}: REFUSE·wire ${fieldOf(line, 'scope')} · ${got.why} · nothing landed\n`);
             return { kind: 'exit', code: 1 };
         }
     }
+    const authority = authorityFor([...lockLines(store), ...signed], rootSigner(root), signaturesOf(store).admitted);
+    const ownership = ownedOf(root, signed, line => authority.of(line).kind === 'admitted', by => authority.admitted.find(one => one.id === by)?.coverage ?? [], named, line => { const heads = byFile.flatMap(([heads, lines]) => lines.some(draft => sayingOf(draft) === sayingOf(line)) ? heads : []); return heads.length ? heads : undefined; });
+    if (ownership.nowhere.length) {
+        for (const line of ownership.nowhere)
+            process.stderr.write(`${selfName()}: REFUSE·signer ${keyId} uncovered ${fieldOf(line, 'scope')} · nothing signed for delivery\n`);
+        return { kind: 'exit', code: 1 };
+    }
     if (signed.some(line => !isConfig(line))) {
         try {
             await admittedObjects(root, [...signedOwnerLines(store), ...signed], text => process.stdout.write(text + '\n'));

package/dist/cli/args.js

@@ -1,7 +1,7 @@
 import { relative, sep } from 'node:path';
 import { observeText } from "../observe/files.js";
 import { sourceOf } from "../observe/runner.js";
-import { PROTOCOL } from '@lapxo/topos/wire';
+import { PROTOCOL, parse } from '@lapxo/topos/wire';
 import { FLAGS, VALUED } from "./names.js";
 export { VALUED };
 /** What the loop runs that is not source: its entry, the packages it imports and the readers it loads, read by where they lie. */
@@ -30,5 +30,12 @@ export function positionalsOf(args) {
 export const placesOfFile = (file) => (observeText(file) ?? '').split('\n').map((line) => line.trim())
     .filter((line) => line.startsWith('# place ')).map((line) => line.slice('# place '.length).trim().replace(/\/$/, '')).filter(Boolean);
 export function claimLinesIn(file) {
-    return (observeText(file) ?? '').split('\n').map((line) => line.trim()).filter((line) => line.startsWith(PROTOCOL));
+    const lines = (observeText(file) ?? '').split('\n').map(line => line.trim())
+        .filter(line => line.startsWith(`${PROTOCOL.split('/')[0]}/`));
+    for (const line of lines) {
+        const got = parse(line);
+        if (got.kind !== 'fact')
+            throw new Error(`REFUSE·wire batch ${got.why} · nothing signed or landed`);
+    }
+    return lines;
 }

package/dist/cli/names.d.ts

@@ -7,7 +7,7 @@ export declare const FLAGS: {
     readonly check: "--check";
     readonly key: "--key";
     readonly keyFile: "--key-file";
-    readonly out: "--out";
+    readonly signer: "--signer";
     readonly place: "--place";
 };
 export declare const VALUED: readonly string[];

package/dist/cli/names.js

@@ -1,8 +1,8 @@
 /** The verbs bound answers by name: fold reads, land writes signed lines, sign is a key's act. A directory with no verb is a fold of that place. */
 export const VERB_NAMES = ['fold', 'land', 'sign'];
 /** Every flag the CLI reads, spelled once; a valued flag takes the argument after it. */
-export const FLAGS = { as: '--as', check: '--check', key: '--key', keyFile: '--key-file', out: '--out', place: '--place' };
-export const VALUED = [FLAGS.keyFile, FLAGS.key, FLAGS.out, FLAGS.as, FLAGS.place];
+export const FLAGS = { as: '--as', check: '--check', key: '--key', keyFile: '--key-file', signer: '--signer', place: '--place' };
+export const VALUED = [FLAGS.keyFile, FLAGS.key, FLAGS.signer, FLAGS.as, FLAGS.place];
 /** Views the CLI renders from these names, never from a handwritten usage string. */
 export const NAMED_VIEWS = { help: 'help', lines: 'lines', because: 'because' };
 export const EXIT = { closed: 0, refuse: 1, usage: 2 };

package/dist/cli/verb.js

@@ -20,7 +20,8 @@ import { rolesOf } from "../fold/roles.js";
 import { authorityFor, releaseSigner, rootSigner, writerFor } from "../fold/signers.js";
 import { land, ledgerLines, storeOf } from "../land/ledger.js";
 import { lockLines, releaseOf } from "../fold/keys.js";
-import { signConsentLine } from "../land/sign.js";
+import { signConsentLot } from "../land/sign.js";
+import { signerFor } from "../host/signing.js";
 import { admittedIn, ownLockOf, tellOwn } from "../fold/signed.js";
 import { hasVouchedTree, landCoordinates, coordinatesOf, locationsOf, vouching, sourced } from "../land/vouched.js";
 import { observeText } from "../observe/files.js";
@@ -39,7 +40,7 @@ import { claimLinesIn, entryOf, namedPlaces, positionalsOf, valueOf } from "./ar
 import { EXIT, FLAGS, NAMED_VIEWS, helpLines } from "./names.js";
 import { accept, signedBatch } from "./accept.js";
 /** The first land of a lock: TARGET.bound into an empty owner ledger, then the sources that lock names. */
-function firstLand(root, args) {
+async function firstLand(root, args) {
     const started = Date.now();
     const store = storeOf(root);
     const today = claimLinesIn(targetFile(root));
@@ -63,24 +64,6 @@ function firstLand(root, args) {
         keyId = valueOf(args, FLAGS.key) ?? owner;
         if (ledgerLines(store, owner).length)
             throw new Error('REFUSE·bootstrap the owner ledger already holds claims; the first land happens once');
-        const keyFile = valueOf(args, FLAGS.keyFile);
-        if (keyFile !== undefined) {
-            const pem = observeText(keyFile);
-            if (pem === undefined)
-                throw new Error('REFUSE·bootstrap the requested signing key is unreadable');
-            const signed = [];
-            for (const line of today) {
-                if (/\bsig=/.test(line)) {
-                    signed.push(line);
-                    continue;
-                }
-                const got = signConsentLine(line, pem, { epoch: 1, by: keyId, algorithm: config.era });
-                if (got.kind === 'refuse')
-                    throw new Error(got.why);
-                signed.push(got.line);
-            }
-            today.splice(0, today.length, ...signed);
-        }
         const said = (measure) => {
             const values = new Set(today.filter((line) => fieldOf(line, 'scope') === `keys/${owner}` && fieldOf(line, 'measure') === measure && fieldOf(line, 'value') !== 'withdraw').map((line) => fieldOf(line, 'value')));
             if (values.size !== 1)
@@ -93,6 +76,15 @@ function firstLand(root, args) {
         const coverage = said('coverage').split('|').filter(Boolean);
         if (!publicKey || !coverage.length)
             throw new Error('REFUSE·bootstrap the root key must declare its public key and coverage');
+        const drafted = today.filter(line => !fieldOf(line, 'sig'));
+        if (drafted.length) {
+            const invoke = signerFor(today, keyId, valueOf(args, FLAGS.signer), valueOf(args, FLAGS.keyFile));
+            const got = await signConsentLot(drafted, { epoch: 1, by: keyId, algorithm: config.era }, publicKey, config.admitted, invoke);
+            if (got.kind === 'refuse')
+                throw new Error(got.why);
+            let i = 0;
+            today.splice(0, today.length, ...today.map(line => fieldOf(line, 'sig') ? line : got.lines[i++]));
+        }
         const authority = authorityFor(today, { ...releaseSigner(today), id: owner, publicKey, coverage }, config.admitted);
         for (const line of today) {
             const verdict = authority.of(line);
@@ -446,6 +438,22 @@ const VERBS = {
     sign: (root, rest) => signVerb(root, rest),
 };
 function main(argv) {
+    for (let i = 0; i < argv.length; i += 1) {
+        const arg = argv[i];
+        if (!arg.startsWith('--'))
+            continue;
+        if (!Object.values(FLAGS).includes(arg)) {
+            process.stderr.write(`${selfName()}: REFUSE·flag unknown option ${arg}\n`);
+            return EXIT.usage;
+        }
+        if (arg !== FLAGS.check) {
+            if (argv[i + 1] === undefined || argv[i + 1].startsWith('--')) {
+                process.stderr.write(`${selfName()}: REFUSE·flag ${arg} needs a value\n`);
+                return EXIT.usage;
+            }
+            i += 1;
+        }
+    }
     const verb = argv[0] ?? '';
     const run = verb in VERBS ? VERBS[verb] : undefined;
     const places = positionalsOf(run === undefined ? argv : argv.slice(1)).filter((one) => existsSync(resolve(one)) && lstatSync(resolve(one)).isDirectory());

package/dist/fold/observed.js

@@ -389,7 +389,11 @@ export function observedClaims(root, store, options = {}) {
                     ? asked.ask(due.map((d) => ({
                         protocol: PROTOCOL, verb: 'read', rootScope: d.place, region: reader.capsule.region, held: heldOf(d.place, d.region),
                         files: (reader.capsule.reads.some((read) => read.includes('@')) ? handedAt(root, reader, roleOf, look, d.place) : [d.place]).map((coordinate) => ({ place: coordinate, text: observeText(resolve(root, coordinate)) ?? '' })),
-                    }))).map((answer) => (answer?.claims ?? []))
+                    }))).map((answer) => {
+                        if (answer?.kind !== 'fact')
+                            throw new Error(`REFUSE·reader ${reader.module} · ${answer?.why ?? 'no capsule answer'}`);
+                        return (answer.claims ?? []);
+                    })
                     : runReader(module, root, due.map((d) => ({ place: d.place, ...(reader.kind === 'js' ? { text: new TextDecoder().decode(d.bytes) } : {}), held: heldOf(d.place, d.region) })));
             }
             catch (error) {

package/dist/fold/readers.js

@@ -8,6 +8,7 @@ import { capsuleAt, placesIn } from "./places.js";
 import { capsulesFor } from "./reach.js";
 import { ownLockOf } from "./signed.js";
 import { ownLock } from "../observe/runner.js";
+import { selectedWireList } from "../host/selected-topos.js";
 import { entriesIn, coordinatesUnder, observeFile, stampOf } from "../observe/files.js";
 export function lookOf(root, roleOf) {
     const walked = new Map();
@@ -42,7 +43,10 @@ const reachOfLine = (module, where) => {
  */
 export function capsuleReadersOf(root, store, standing, lines, resolve = capsulesFor) {
     const reaching = new Set(lines.flatMap((reader) => reachOfLine(reader.module, reader.where)));
-    const measures = wordsOf(standing, 'region-measures');
+    const localMeasures = wordsOf(standing, 'region-measures');
+    const pins = standing.filter(line => fieldOf(line, 'scope').startsWith('uses/') && fieldOf(line, 'value') !== 'withdraw');
+    const measures = localMeasures.length || !pins.length ? localMeasures
+        : selectedWireList(standing, Number.MAX_SAFE_INTEGER, pins, 'region-measures');
     const world = fields(fieldOf(wireLine(standing, 'offers/world') ?? '', 'value')).map(([region, globs]) => canonical({ scope: `region/${region}`, measure: wordOn(standing, 'region-coordinate', ownLock()), value: globs }));
     const groups = new Map();
     for (const place of ['', ...placesIn(root)]) {

package/dist/fold/signed.js

@@ -6,7 +6,7 @@ import { signaturesOf } from "./digests.js";
 import { lockLines, lockStanding } from "./keys.js";
 import { wordOf } from "./wire.js";
 import { authorityFor, rootSigner } from "./signers.js";
-import { shardLines, storeOf } from "../land/ledger.js";
+import { ledgerLines, shardLines, storeOf } from "../land/ledger.js";
 import { verifiesFields } from "../land/sign.js";
 import { observeText } from "../observe/files.js";
 const held = new Map();
@@ -20,14 +20,16 @@ function verified(root, place) {
     const hasAuthority = lock.some(line => fieldOf(line, 'sig') !== '');
     const algorithms = hasAuthority ? signaturesOf(store).admitted : [];
     const signers = algorithms.length ? authorityFor(lock, rootSigner(root), algorithms).admitted : [];
-    const history = signers.flatMap(signer => shardLines(store, signer.id, `${place}/${LOCK}`));
+    const history = signers.flatMap(signer => place ? shardLines(store, signer.id, `${place}/${LOCK}`) : ledgerLines(store, signer.id)).filter(line => fieldOf(line, 'sig') !== '');
     const text = [publicText, ...history, ...(told.get(place) ?? [])].join('\n');
     const key = `${root} ${place}`;
     const last = held.get(key);
     if (last !== undefined && last.text === text && last.lock === lock)
         return last;
     const lines = [...new Set(text.split('\n').filter(isWire))];
-    const family = signers.length ? wordOf(lockStanding(store), 'families', 'region') : '';
+    // Unrestricted coverage does not construct a region coordinate. Restricted
+    // coverage still requires the lock's declared namespace before comparison.
+    const family = signers.some(signer => !signer.coverage.includes('*')) ? wordOf(lockStanding(store), 'families', 'region') : '';
     const stands = (line) => {
         const got = parse(line);
         if (got.kind !== 'fact' || got.value.fields['sig'] === undefined)

package/dist/fold/wire.js

@@ -1,5 +1,6 @@
 import * as topos from '@lapxo/topos/wire';
 import { fieldOf, selfName } from "./claims.js";
+import { selectedWireList } from "../host/selected-topos.js";
 const spoken = topos;
 export const namesAt = (spoken['namesAt'] ?? spoken['namesLeaf']);
 export const roleAt = (spoken['roleAt'] ?? spoken['leafRoleOf']);
@@ -17,7 +18,11 @@ export function wordsOf(standing, list) {
  * refusal. The older `audit/wire/` prefix is one era of `wire/`, not a fall-back to another lock.
  */
 export function wordOf(standing, list, name) {
-    const held = wordsOf(standing, list);
+    const local = wordsOf(standing, list);
+    const pins = standing.filter(line => fieldOf(line, 'scope').startsWith('uses/') && fieldOf(line, 'value') !== 'withdraw');
+    // A required word may come from selected standing without copying foreign claims.
+    const held = wireLine(standing, list) === undefined && pins.length
+        ? selectedWireList(standing, Number.MAX_SAFE_INTEGER, pins, list) : local;
     const eras = typeof name === 'string' ? [name] : name;
     const found = eras.find((one) => held.includes(one));
     if (found !== undefined)

package/dist/host/ports/signing.d.ts

@@ -0,0 +1,31 @@
+/** Contains only host-controlled diagnostics, never child output. */
+export declare class SigningFailure extends Error {
+}
+export interface SigningLot {
+    readonly bytes: readonly string[];
+    readonly keyId: string;
+    readonly algorithm: string;
+}
+export interface SignatureRecord {
+    readonly keyId: string;
+    readonly signature: string;
+}
+export interface SigningProtocol {
+    readonly request: (lot: SigningLot) => string;
+    readonly response: (records: readonly SignatureRecord[]) => string;
+    readonly reply: (text: string, lot: SigningLot) => readonly SignatureRecord[];
+}
+export type SigningMechanism = {
+    readonly kind: 'file';
+    readonly path: string;
+} | {
+    readonly kind: 'command';
+    readonly executable: string;
+    readonly args: readonly string[];
+};
+export interface SigningLimits {
+    readonly timeoutMs: number;
+    readonly responseBytes: number;
+}
+/** Host-approved mechanism only. Repository declarations do not authorize execution. */
+export declare function invokeSigner(lot: SigningLot, mechanism: SigningMechanism, protocol: SigningProtocol, limits: SigningLimits): Promise<readonly SignatureRecord[]>;

package/dist/host/ports/signing.js

@@ -0,0 +1,74 @@
+import { spawn } from 'node:child_process';
+import { readFileSync } from 'node:fs';
+import { signBytes } from "../adapters/keys/ed25519.js";
+/** Contains only host-controlled diagnostics, never child output. */
+export class SigningFailure extends Error {
+}
+/** Host-approved mechanism only. Repository declarations do not authorize execution. */
+export async function invokeSigner(lot, mechanism, protocol, limits) {
+    if (!Number.isSafeInteger(limits.timeoutMs) || limits.timeoutMs <= 0
+        || !Number.isSafeInteger(limits.responseBytes) || limits.responseBytes <= 0) {
+        throw new SigningFailure(`REFUSE·signer ${lot.keyId} has no valid declared limits`);
+    }
+    const request = protocol.request(lot);
+    let output;
+    if (mechanism.kind === 'file') {
+        try {
+            const key = readFileSync(mechanism.path, 'utf8');
+            output = protocol.response(lot.bytes.map(bytes => ({ keyId: lot.keyId, signature: signBytes(bytes, key, lot.algorithm) })));
+        }
+        catch {
+            throw new SigningFailure(`REFUSE·signer ${lot.keyId} file mechanism failed`);
+        }
+    }
+    else
+        output = await new Promise((resolve, reject) => {
+            const child = spawn(mechanism.executable, [...mechanism.args], { stdio: ['pipe', 'pipe', 'pipe'], shell: false });
+            let size = 0;
+            const chunks = [];
+            let failure;
+            const refuse = (why) => {
+                if (failure)
+                    return;
+                failure = why;
+                child.kill('SIGKILL');
+                clearTimeout(timer);
+                child.stdin.destroy();
+                child.stdout.destroy();
+                child.stderr.destroy();
+                reject(new SigningFailure(`REFUSE·signer ${lot.keyId} ${why} · status=none · signal=SIGKILL`));
+            };
+            const timer = setTimeout(() => refuse('timeout'), limits.timeoutMs);
+            child.stdout.on('data', (chunk) => {
+                size += chunk.length;
+                if (size > limits.responseBytes)
+                    refuse('response exceeds declared limit');
+                if (!failure)
+                    chunks.push(chunk);
+            });
+            // Drain, never forward or retain signer diagnostics.
+            child.stderr.on('data', () => { });
+            child.stdin.on('error', () => refuse('input delivery failed'));
+            child.on('error', () => {
+                clearTimeout(timer);
+                reject(new SigningFailure(`REFUSE·signer ${lot.keyId} command could not start`));
+            });
+            child.on('close', (status, signal) => {
+                clearTimeout(timer);
+                if (failure || status !== 0) {
+                    reject(new SigningFailure(`REFUSE·signer ${lot.keyId} ${failure ?? 'command failed'} · status=${status ?? 'none'} · signal=${signal ?? 'none'}`));
+                }
+                else
+                    resolve(Buffer.concat(chunks).toString('utf8'));
+            });
+            child.stdin.end(request);
+        });
+    if (Buffer.byteLength(output) > limits.responseBytes)
+        throw new SigningFailure(`REFUSE·signer ${lot.keyId} response exceeds declared limit`);
+    try {
+        return protocol.reply(output, lot);
+    }
+    catch {
+        throw new SigningFailure(`REFUSE·signer ${lot.keyId} invalid response`);
+    }
+}

package/dist/host/provide.d.ts

@@ -6,8 +6,8 @@ interface ResolveResult {
 }
 type NextResolve = (specifier: string, context: ResolveContext) => ResolveResult;
 /**
- * Where a named package or world lies: `dep/<name>` for a library the instrument installs, `uses/<name>` for a world
- * pinned by its GitHub release. Both are the digest, laid. Nothing here spells a path.
+ * Resolve declared library bytes for this host. A library's shape may select an
+ * archive coordinate; world selection remains the standing contract.
  */
 export declare function pinPlace(name: string): string;
 export declare function pinExport(name: string, sub: string): string;

package/dist/host/provide.js

@@ -10,8 +10,8 @@ import { theWord } from "../fold/wire.js";
 const registerHooks = nodeModule.registerHooks;
 const taken = (exp) => (typeof exp === 'string' ? exp : exp && typeof exp === 'object' && 'default' in exp && typeof exp.default === 'string' ? exp.default : '');
 /**
- * Where a named package or world lies: `dep/<name>` for a library the instrument installs, `uses/<name>` for a world
- * pinned by its GitHub release. Both are the digest, laid. Nothing here spells a path.
+ * Resolve declared library bytes for this host. A library's shape may select an
+ * archive coordinate; world selection remains the standing contract.
  */
 export function pinPlace(name) {
     const lock = ownLock();
@@ -20,7 +20,7 @@ export function pinPlace(name) {
     if (line === undefined)
         return '';
     const digest = fieldOf(line, 'value');
-    return digest ? runtimeTreeAt(ownStore(), ownRoot(), digest, ownStore()) ?? '' : '';
+    return digest ? runtimeTreeAt(ownStore(), ownRoot(), digest, ownStore(), fieldOf(line, 'role') === 'reads' ? fieldOf(line, 'shape') : '') ?? '' : '';
 }
 export function pinExport(name, sub) {
     const at = pinPlace(name);

package/dist/host/release.d.ts

@@ -9,4 +9,4 @@ export declare const releasesOf: (lock: readonly string[]) => readonly string[];
 export declare function layReleases(store: string, own: string, lock: readonly string[], contentStore?: string): number;
 export declare const resolvedOf: (store: string, own: string, lock: readonly string[], contentStore?: string) => readonly string[];
 /** A host loads verified release bytes from a runtime tree, never interprets a snapshot file as a directory. */
-export declare function runtimeTreeAt(store: string, own: string, digest: string, contentStore?: string): string | undefined;
+export declare function runtimeTreeAt(store: string, own: string, digest: string, contentStore?: string, root?: string): string | undefined;

package/dist/host/release.js

@@ -13,6 +13,15 @@ const digestOf = (bytes) => `sha256:${createHash('sha256').update(bytes).digest(
 const hashed = (digest, bytes) => createHash(digest.includes(':') ? digest.slice(0, digest.indexOf(':')) : 'sha256').update(bytes).digest('hex') === digest.replace(/^[^:]*:/, '');
 const snapshotOf = (text) => text.split('\n').filter(isWire).filter((line) => fieldOf(line, 'measure') === 'digest' && fieldOf(line, 'scope').startsWith('file/'))
     .map((line) => [fieldOf(line, 'scope').slice('file/'.length), fieldOf(line, 'value')]);
+/** Mount an explicitly declared archive coordinate; never infer a package root. */
+function mountedFiles(files, root) {
+    if (!root)
+        return files;
+    const prefix = archiveCoordinate(root) + '/';
+    if (!files.length || files.some(([name]) => !name.startsWith(prefix)))
+        throw new Error(`REFUSE·release archive root ${root} does not contain every member`);
+    return files.map(([name, digest]) => [archiveCoordinate(name.slice(prefix.length)), digest]);
+}
 function snapshotLines(files) {
     return files.map(([coord, digest]) => canonical({
         scope: `file/${coord}`, role: 'writes', form: 'alphabet', measure: 'digest', value: digest, at: `place:${digest}`, by: 'target',
@@ -128,17 +137,18 @@ export function layReleases(store, own, lock, contentStore = own) {
         const needs = fieldOf(line, 'needs');
         if (!needs)
             continue;
+        const root = fieldOf(line, 'shape');
         const place = join(own, archiveCoordinate(needs));
         const link = lstatSync(place, { throwIfNoEntry: false });
         if (link?.isSymbolicLink() && !realpathSync(place).includes(`${sep}cas${sep}laid${sep}`))
             continue;
         if (dir) {
-            const files = bytes === undefined ? undefined : members(bytes).map((one) => [one.name, digestOf(one.bytes)]);
+            const files = bytes === undefined ? undefined : mountedFiles(members(bytes).map((one) => [one.name, digestOf(one.bytes)]), root);
             if (!lstatSync(place, { throwIfNoEntry: false })?.isSymbolicLink() && observeText(join(place, laidMark)) === digest && files !== undefined && layoutMatches(place, files))
                 continue;
             const next = nextPlace(place);
             try {
-                layDir(at, next);
+                layDir(root ? join(at, archiveCoordinate(root)) : at, next);
                 swapPlace(place, next, digest);
             }
             catch (error) {
@@ -151,11 +161,12 @@ export function layReleases(store, own, lock, contentStore = own) {
         const snap = observeText(at);
         if (snap === undefined)
             throw new Error(`REFUSE·release ${fieldOf(line, 'scope')} has no available snapshot`);
-        if (!lstatSync(place, { throwIfNoEntry: false })?.isSymbolicLink() && observeText(join(place, laidMark)) === digest && layoutMatches(place, snapshotOf(snap)))
+        const mounted = mountedFiles(snapshotOf(snap), root);
+        if (!lstatSync(place, { throwIfNoEntry: false })?.isSymbolicLink() && observeText(join(place, laidMark)) === digest && layoutMatches(place, mounted))
             continue;
         const next = nextPlace(place);
         try {
-            layFiles(store, contentStore, snapshotOf(snap), next);
+            layFiles(store, contentStore, mounted, next);
             swapPlace(place, next, digest);
         }
         catch (error) {
@@ -180,12 +191,12 @@ export const resolvedOf = (store, own, lock, contentStore = own) => releasesOf(l
     const historicalDirectory = lstatSync(at, { throwIfNoEntry: false })?.isDirectory() === true;
     const snapshot = observeText(at);
     const complete = expected !== undefined && (needs
-        ? layoutMatches(place, expected)
+        ? layoutMatches(place, mountedFiles(expected, fieldOf(line, 'shape')))
         : historicalDirectory ? layoutMatches(at, expected) : snapshot !== undefined && sameSnapshot(snapshotOf(snapshot), expected));
     return ok && laid && complete ? [canonical({ scope: `resolved/${fieldOf(line, 'scope').slice('dep/'.length)}`, role: 'writes', form: 'alphabet', measure: 'digest', value: digest, at: `place:${digest}`, by: 'target' })] : [];
 });
 /** A host loads verified release bytes from a runtime tree, never interprets a snapshot file as a directory. */
-export function runtimeTreeAt(store, own, digest, contentStore = own) {
+export function runtimeTreeAt(store, own, digest, contentStore = own, root = '') {
     const named = /^([a-zA-Z0-9-]+):([a-fA-F0-9]+)$/.exec(digest);
     if (named === null)
         throw new Error(`REFUSE·release invalid digest ${digest}`);
@@ -195,9 +206,11 @@ export function runtimeTreeAt(store, own, digest, contentStore = own) {
     if (!hashed(digest, bytes))
         throw new Error(`REFUSE·release ${digest} does not name its available bytes`);
     const files = members(bytes).map((one) => [one.name, digestOf(one.bytes)]);
+    mountedFiles(files, root); // Validate the same declared projection used for installation.
     const place = storeAt(store, 'cas', 'runtime', named[1], named[2]);
+    const selected = root ? join(place, archiveCoordinate(root)) : place;
     if (observeText(join(place, laidMark)) === digest && layoutMatches(place, files))
-        return place;
+        return selected;
     for (const member of members(bytes))
         landBlob(store, digestOf(member.bytes), member.bytes);
     const next = nextPlace(place);
@@ -209,5 +222,5 @@ export function runtimeTreeAt(store, own, digest, contentStore = own) {
         rmSync(next, { recursive: true, force: true });
         throw error;
     }
-    return place;
+    return selected;
 }

package/dist/host/selected-topos.d.ts

@@ -1,4 +1,5 @@
 import type { StandingTopos } from '@lapxo/topos/standing';
+import { wireAt } from '@lapxo/topos/wire';
 export interface SelectedTopos {
     readonly digest: string;
     readonly topos: StandingTopos;
@@ -15,3 +16,6 @@ export declare function selectedTopoi(pins: readonly string[], resolve?: ToposRe
  * Independent declarations must agree; selection order cannot choose a contract.
  */
 export declare function selectedWireList(local: readonly string[], epoch: number, pins: readonly string[], list: string, resolve?: ToposResolver): readonly string[];
+/** Complete an admission snapshot from the selected standing. Local declarations
+ * govern their own lists; independent selected contracts cannot choose by order. */
+export declare function selectedWireAt(local: readonly Readonly<Record<string, string>>[], epoch: number, pins: readonly string[], resolve?: ToposResolver): ReturnType<typeof wireAt>;

package/dist/host/selected-topos.js

@@ -59,3 +59,26 @@ export function selectedWireList(local, epoch, pins, list, resolve = toposAt) {
         throw Error(`REFUSE·wire wire/${list} has conflicting contracts · ${contracts.map(one => one.name).join(' · ')}`);
     return first.words;
 }
+/** Complete an admission snapshot from the selected standing. Local declarations
+ * govern their own lists; independent selected contracts cannot choose by order. */
+export function selectedWireAt(local, epoch, pins, resolve = toposAt) {
+    const own = wireAt(local, epoch);
+    const worlds = selectedTopoi(pins, resolve).map(({ digest, topos }) => ({ digest, parts: topos.parts, wire: wireAt(topos.parts, Number.MAX_SAFE_INTEGER) }));
+    const key = (scope) => scope.startsWith('wire/') ? scope.slice(5) : scope.startsWith('audit/wire/') ? scope.slice(11) : undefined;
+    const declared = new Set(local.filter(f => Number(f.epoch ?? 0) <= epoch).map(f => key(f.scope ?? '')).filter((k) => k !== undefined));
+    const selected = new Map();
+    for (const world of worlds)
+        for (const f of world.parts) {
+            const name = key(f.scope ?? '');
+            if (name === undefined || declared.has(name))
+                continue;
+            const list = world.wire?.lists.get(name);
+            const value = list ? [...list].sort().join('|') : f.value ?? '';
+            const previous = selected.get(name);
+            if (previous && previous.value !== value)
+                throw Error(`REFUSE·wire wire/${name} has conflicting selected contracts · ${previous.digest} · ${world.digest}`);
+            if (!previous)
+                selected.set(name, { value, fields: f, digest: world.digest });
+        }
+    return selected.size ? wireAt([...selected.values()].map(one => one.fields).concat(local), epoch) : own;
+}

package/dist/host/signing.d.ts

@@ -0,0 +1,3 @@
+import type { SigningLot } from './ports/signing.ts';
+/** Resolve data before acquisition; all mechanisms use one wire protocol and verification path. */
+export declare function signerFor(lines: readonly string[], keyId: string, selected?: string, keyFile?: string): (lot: SigningLot) => Promise<readonly import("./ports/signing.ts").SignatureRecord[]>;

package/dist/host/signing.js

@@ -0,0 +1,42 @@
+import { readFileSync } from 'node:fs';
+import { parse, signerSelection, signerRequestBytes, signerResponseBytes, signerResponseOf } from '@lapxo/topos/wire';
+import { invokeSigner, SigningFailure } from "./ports/signing.js";
+/** An explicitly supplied host registry; a repository cannot supply executable bindings. */
+function binding(name, keyFile) {
+    if (name === 'file') {
+        if (!keyFile)
+            throw new SigningFailure('REFUSE·signer file needs --key-file');
+        return { kind: 'file', path: keyFile };
+    }
+    if (keyFile)
+        throw new SigningFailure('REFUSE·signer command cannot use --key-file');
+    const path = process.env['BOUND_SIGNERS'];
+    if (!path)
+        throw new SigningFailure('REFUSE·signer no host binding registry');
+    try {
+        const registry = JSON.parse(readFileSync(path, 'utf8'));
+        if (!registry || typeof registry !== 'object' || !Object.prototype.hasOwnProperty.call(registry, name))
+            throw Error();
+        const record = registry[name];
+        if (!record || typeof record !== 'object')
+            throw Error();
+        const f = record;
+        if (f['kind'] !== 'command' || typeof f['executable'] !== 'string' || !f['executable']
+            || !Array.isArray(f['args']) || !f['args'].every(a => typeof a === 'string'))
+            throw Error();
+        return { kind: 'command', executable: f['executable'], args: f['args'] };
+    }
+    catch {
+        throw new SigningFailure('REFUSE·signer host binding unavailable or invalid');
+    }
+}
+/** Resolve data before acquisition; all mechanisms use one wire protocol and verification path. */
+export function signerFor(lines, keyId, selected, keyFile) {
+    const fields = lines.flatMap(line => { const got = parse(line); return got.kind === 'fact' ? [got.value.fields] : []; });
+    const declaration = signerSelection(fields, keyId);
+    if (selected !== undefined && selected !== declaration.name)
+        throw new SigningFailure(`REFUSE·signer ${keyId} CLI selection conflicts with declaration`);
+    const mechanism = binding(declaration.name, keyFile);
+    const protocol = { request: signerRequestBytes, response: signerResponseBytes, reply: signerResponseOf };
+    return (lot) => invokeSigner(lot, mechanism, protocol, declaration);
+}