@lapxo/bound 0.1.0 → 0.1.2

package/dist/cli/accept.js

@@ -1,20 +1,22 @@
+import { selectedWireAt } from "../host/selected-topos.js";
 import { timing } from "../host/timing.js";
 import { admittedObjects } from "../host/objects.js";
 import { existsSync, rmdirSync, rmSync } from 'node:fs';
 import { dirname, join, basename } from 'node:path';
 import { closeReceipts, instrumentKeep, instrumentKept } from "../fold/closed.js";
 import { bytesDigest, fullDigest, instrumentOf, signaturesOf } from "../fold/digests.js";
-import { canonical, fromLine, LOCK, parse, wireAt } from '@lapxo/topos/wire';
+import { canonical, fromLine, LOCK, parse } from '@lapxo/topos/wire';
 import { fieldOf, isConfig, foldClaims, sayingOf, selfName } from "../fold/claims.js";
 import { isReaderLock } from "../fold/observed.js";
 import { authorityFor, publicKeyOf, rootSigner, writerFor } from "../fold/signers.js";
 import { lockLines, lockStanding } from "../fold/keys.js";
 import { keepVerdict, keptVerdict, land, landBlob, storeOf } from "../land/ledger.js";
-import { signConsentLine, verifiesOwnerLine } from "../land/sign.js";
-import { appliedIn } from "../fold/signed.js";
+import { signConsentLot, verifiesOwnerLine } from "../land/sign.js";
+import { signerFor } from "../host/signing.js";
+import { appliedIn, ownLockOf } from "../fold/signed.js";
 import { wordOf } from "../fold/wire.js";
 import { hasVouchedTree, landCoordinates, locationsOf, vouchedCoordinates } from "../land/vouched.js";
-import { entriesIn, observeFile, observeText } from "../observe/files.js";
+import { entriesIn, observeFile } from "../observe/files.js";
 import { coneOf, standingOf } from "./place.js";
 import { ownLock, ownRoot, ownStore } from "../observe/runner.js";
 import { widenedWithoutWitness } from "../judge/widening.js";
@@ -85,40 +87,47 @@ export async function signedBatch(root, args, files) {
     }
     const keyFile = valueOf(args, FLAGS.keyFile);
     const keyId = valueOf(args, FLAGS.key) ?? ownerOf(store);
-    if (drafted.length && (!keyFile || !existsSync(keyFile))) {
-        process.stderr.write(`${selfName()}: a drafted batch is signed with --key-file (PKCS8 PEM)\n`);
-        return { kind: 'exit', code: 2 };
-    }
     const publicKey = drafted.length ? publicKeyOf(root, keyId) : undefined;
     if (drafted.length && !publicKey) {
         process.stderr.write(`${selfName()}: unknown key ${keyId} — name it in ${selfName()}.keys\n`);
         return { kind: 'exit', code: 2 };
     }
-    const privateKeyPem = keyFile ? observeText(keyFile) ?? '' : '';
-    const signed = proposed.filter((line) => fieldOf(line, 'sig'));
-    for (const line of drafted) {
-        const got = signConsentLine(line, privateKeyPem, { epoch, by: keyId, algorithm: signaturesOf(store).era });
-        if (got.kind === 'refuse') {
-            process.stderr.write(`${selfName()}: ${got.why}\n`);
+    let signed = proposed.filter((line) => fieldOf(line, 'sig'));
+    if (drafted.length) {
+        let invoke;
+        try {
+            invoke = signerFor([...lockStanding(store), ...destinations.flatMap(place => ownLockOf(root, place))], keyId, valueOf(args, FLAGS.signer), keyFile);
+        }
+        catch (error) {
+            process.stderr.write(`${selfName()}: ${error instanceof Error ? error.message : 'REFUSE·signer unavailable'}\n`);
             return { kind: 'exit', code: 1 };
         }
-        if (!verifiesOwnerLine(got.line, publicKey, signaturesOf(store).admitted)) {
-            process.stderr.write(`${selfName()}: REFUSE·accept the signature does not hold for ${keyId}\n`);
+        const got = await signConsentLot(drafted, { epoch, by: keyId, algorithm: signaturesOf(store).era }, publicKey, signaturesOf(store).admitted, invoke);
+        if (got.kind === 'refuse') {
+            process.stderr.write(`${selfName()}: ${got.why}\n`);
             return { kind: 'exit', code: 1 };
         }
-        signed.push(got.line);
+        let index = 0;
+        signed = proposed.map(line => fieldOf(line, 'sig') ? line : got.lines[index++]);
     }
     const wireLines = [...signedOwnerLines(store), ...signed].flatMap((line) => {
         const got = parse(line);
         return got.kind === 'fact' ? [got.value.fields] : [];
     });
     for (const line of signed) {
-        const got = fromLine(line, wireAt(wireLines, Number(fieldOf(line, 'epoch'))));
+        const got = fromLine(line, selectedWireAt(wireLines, Number(fieldOf(line, 'epoch')), foldClaims(signedOwnerLines(store)).standing.filter(one => fieldOf(one, 'scope').startsWith('uses/') && fieldOf(one, 'value') !== 'withdraw')));
         if (got.kind !== 'fact') {
             process.stderr.write(`${selfName()}: REFUSE·wire ${fieldOf(line, 'scope')} · ${got.why} · nothing landed\n`);
             return { kind: 'exit', code: 1 };
         }
     }
+    const authority = authorityFor([...lockLines(store), ...signed], rootSigner(root), signaturesOf(store).admitted);
+    const ownership = ownedOf(root, signed, line => authority.of(line).kind === 'admitted', by => authority.admitted.find(one => one.id === by)?.coverage ?? [], named, line => { const heads = byFile.flatMap(([heads, lines]) => lines.some(draft => sayingOf(draft) === sayingOf(line)) ? heads : []); return heads.length ? heads : undefined; });
+    if (ownership.nowhere.length) {
+        for (const line of ownership.nowhere)
+            process.stderr.write(`${selfName()}: REFUSE·signer ${keyId} uncovered ${fieldOf(line, 'scope')} · nothing signed for delivery\n`);
+        return { kind: 'exit', code: 1 };
+    }
     if (signed.some(line => !isConfig(line))) {
         try {
             await admittedObjects(root, [...signedOwnerLines(store), ...signed], text => process.stdout.write(text + '\n'));

package/dist/cli/args.js

@@ -1,7 +1,7 @@
 import { relative, sep } from 'node:path';
 import { observeText } from "../observe/files.js";
 import { sourceOf } from "../observe/runner.js";
-import { PROTOCOL } from '@lapxo/topos/wire';
+import { PROTOCOL, parse } from '@lapxo/topos/wire';
 import { FLAGS, VALUED } from "./names.js";
 export { VALUED };
 /** What the loop runs that is not source: its entry, the packages it imports and the readers it loads, read by where they lie. */
@@ -30,5 +30,12 @@ export function positionalsOf(args) {
 export const placesOfFile = (file) => (observeText(file) ?? '').split('\n').map((line) => line.trim())
     .filter((line) => line.startsWith('# place ')).map((line) => line.slice('# place '.length).trim().replace(/\/$/, '')).filter(Boolean);
 export function claimLinesIn(file) {
-    return (observeText(file) ?? '').split('\n').map((line) => line.trim()).filter((line) => line.startsWith(PROTOCOL));
+    const lines = (observeText(file) ?? '').split('\n').map(line => line.trim())
+        .filter(line => line.startsWith(`${PROTOCOL.split('/')[0]}/`));
+    for (const line of lines) {
+        const got = parse(line);
+        if (got.kind !== 'fact')
+            throw new Error(`REFUSE·wire batch ${got.why} · nothing signed or landed`);
+    }
+    return lines;
 }

package/dist/cli/names.d.ts

@@ -7,7 +7,7 @@ export declare const FLAGS: {
     readonly check: "--check";
     readonly key: "--key";
     readonly keyFile: "--key-file";
-    readonly out: "--out";
+    readonly signer: "--signer";
     readonly place: "--place";
 };
 export declare const VALUED: readonly string[];

package/dist/cli/names.js

@@ -1,8 +1,8 @@
 /** The verbs bound answers by name: fold reads, land writes signed lines, sign is a key's act. A directory with no verb is a fold of that place. */
 export const VERB_NAMES = ['fold', 'land', 'sign'];
 /** Every flag the CLI reads, spelled once; a valued flag takes the argument after it. */
-export const FLAGS = { as: '--as', check: '--check', key: '--key', keyFile: '--key-file', out: '--out', place: '--place' };
-export const VALUED = [FLAGS.keyFile, FLAGS.key, FLAGS.out, FLAGS.as, FLAGS.place];
+export const FLAGS = { as: '--as', check: '--check', key: '--key', keyFile: '--key-file', signer: '--signer', place: '--place' };
+export const VALUED = [FLAGS.keyFile, FLAGS.key, FLAGS.signer, FLAGS.as, FLAGS.place];
 /** Views the CLI renders from these names, never from a handwritten usage string. */
 export const NAMED_VIEWS = { help: 'help', lines: 'lines', because: 'because' };
 export const EXIT = { closed: 0, refuse: 1, usage: 2 };

package/dist/cli/verb.js

@@ -20,7 +20,8 @@ import { rolesOf } from "../fold/roles.js";
 import { authorityFor, releaseSigner, rootSigner, writerFor } from "../fold/signers.js";
 import { land, ledgerLines, storeOf } from "../land/ledger.js";
 import { lockLines, releaseOf } from "../fold/keys.js";
-import { signConsentLine } from "../land/sign.js";
+import { signConsentLot } from "../land/sign.js";
+import { signerFor } from "../host/signing.js";
 import { admittedIn, ownLockOf, tellOwn } from "../fold/signed.js";
 import { hasVouchedTree, landCoordinates, coordinatesOf, locationsOf, vouching, sourced } from "../land/vouched.js";
 import { observeText } from "../observe/files.js";
@@ -39,7 +40,7 @@ import { claimLinesIn, entryOf, namedPlaces, positionalsOf, valueOf } from "./ar
 import { EXIT, FLAGS, NAMED_VIEWS, helpLines } from "./names.js";
 import { accept, signedBatch } from "./accept.js";
 /** The first land of a lock: TARGET.bound into an empty owner ledger, then the sources that lock names. */
-function firstLand(root, args) {
+async function firstLand(root, args) {
     const started = Date.now();
     const store = storeOf(root);
     const today = claimLinesIn(targetFile(root));
@@ -63,24 +64,6 @@ function firstLand(root, args) {
         keyId = valueOf(args, FLAGS.key) ?? owner;
         if (ledgerLines(store, owner).length)
             throw new Error('REFUSE·bootstrap the owner ledger already holds claims; the first land happens once');
-        const keyFile = valueOf(args, FLAGS.keyFile);
-        if (keyFile !== undefined) {
-            const pem = observeText(keyFile);
-            if (pem === undefined)
-                throw new Error('REFUSE·bootstrap the requested signing key is unreadable');
-            const signed = [];
-            for (const line of today) {
-                if (/\bsig=/.test(line)) {
-                    signed.push(line);
-                    continue;
-                }
-                const got = signConsentLine(line, pem, { epoch: 1, by: keyId, algorithm: config.era });
-                if (got.kind === 'refuse')
-                    throw new Error(got.why);
-                signed.push(got.line);
-            }
-            today.splice(0, today.length, ...signed);
-        }
         const said = (measure) => {
             const values = new Set(today.filter((line) => fieldOf(line, 'scope') === `keys/${owner}` && fieldOf(line, 'measure') === measure && fieldOf(line, 'value') !== 'withdraw').map((line) => fieldOf(line, 'value')));
             if (values.size !== 1)
@@ -93,6 +76,15 @@ function firstLand(root, args) {
         const coverage = said('coverage').split('|').filter(Boolean);
         if (!publicKey || !coverage.length)
             throw new Error('REFUSE·bootstrap the root key must declare its public key and coverage');
+        const drafted = today.filter(line => !fieldOf(line, 'sig'));
+        if (drafted.length) {
+            const invoke = signerFor(today, keyId, valueOf(args, FLAGS.signer), valueOf(args, FLAGS.keyFile));
+            const got = await signConsentLot(drafted, { epoch: 1, by: keyId, algorithm: config.era }, publicKey, config.admitted, invoke);
+            if (got.kind === 'refuse')
+                throw new Error(got.why);
+            let i = 0;
+            today.splice(0, today.length, ...today.map(line => fieldOf(line, 'sig') ? line : got.lines[i++]));
+        }
         const authority = authorityFor(today, { ...releaseSigner(today), id: owner, publicKey, coverage }, config.admitted);
         for (const line of today) {
             const verdict = authority.of(line);
@@ -395,8 +387,10 @@ function foldVerb(_root, rest) {
 }
 async function foldAt(root, under, argv) {
     const as = valueOf(argv, FLAGS.as);
-    if (as !== NAMED_VIEWS.help && signedOwnerLines(storeOf(root)).length)
-        await resolveSources(standingOf(root, under).standing);
+    // Public content is authenticated by its digest, independently of owner history.
+    // A named view does not request mounting every release of the instrument.
+    if (as !== NAMED_VIEWS.help && lockLines(storeOf(root)).length)
+        await resolveSources(standingOf(root, under).standing, as === undefined);
     if (as === OBJECT_VIEW) {
         const inputs = positionalsOf(argv).filter(one => existsSync(resolve(one)) && !lstatSync(resolve(one)).isDirectory());
         if (inputs.length > 1)
@@ -446,6 +440,22 @@ const VERBS = {
     sign: (root, rest) => signVerb(root, rest),
 };
 function main(argv) {
+    for (let i = 0; i < argv.length; i += 1) {
+        const arg = argv[i];
+        if (!arg.startsWith('--'))
+            continue;
+        if (!Object.values(FLAGS).includes(arg)) {
+            process.stderr.write(`${selfName()}: REFUSE·flag unknown option ${arg}\n`);
+            return EXIT.usage;
+        }
+        if (arg !== FLAGS.check) {
+            if (argv[i + 1] === undefined || argv[i + 1].startsWith('--')) {
+                process.stderr.write(`${selfName()}: REFUSE·flag ${arg} needs a value\n`);
+                return EXIT.usage;
+            }
+            i += 1;
+        }
+    }
     const verb = argv[0] ?? '';
     const run = verb in VERBS ? VERBS[verb] : undefined;
     const places = positionalsOf(run === undefined ? argv : argv.slice(1)).filter((one) => existsSync(resolve(one)) && lstatSync(resolve(one)).isDirectory());

package/dist/fold/configures.js

@@ -3,6 +3,7 @@ import { fieldOf, isConfig } from "./claims.js";
 import { isReaderLock } from "./observed.js";
 import { isRoleLock } from "./roles.js";
 import { isSignerLock } from "./signers.js";
+import { isReleaseBinding } from "../host/release.js";
 function isEffectLock(line) {
     const got = parse(line);
     return got.kind === 'fact' && got.value.fields['measure'] === 'effect';
@@ -10,7 +11,7 @@ function isEffectLock(line) {
 /** A lock line the instrument itself consumes — an effect it runs, a reader it loads, a role it walks by, a signer it admits, the wire it reads by. */
 function configures(line) {
     const got = parse(line);
-    return isEffectLock(line) || isReaderLock(line) || isRoleLock(line) || isSignerLock(line) || (got.kind === 'fact' && isWireClaim(got.value.fields));
+    return isReleaseBinding(line) || isEffectLock(line) || isReaderLock(line) || isRoleLock(line) || isSignerLock(line) || (got.kind === 'fact' && isWireClaim(got.value.fields));
 }
 /** Every reads line that configures nothing is a ceiling: a bound some reading has to meet. */
 export function isCeiling(line) {

package/dist/fold/kept.js

@@ -1,10 +1,10 @@
 import { createHash, dirname, existsSync, join, mkdirSync, readdirSync, renameSync, writeFileSync } from "../host/io.js";
 import { bytesDigest, coordinateDigest } from "./digests.js";
 import { viewsOf } from "./views.js";
-import { landMemo, ledgerLines, memoAt } from "../land/ledger.js";
-import { observeText } from "../observe/files.js";
+import { landMemo, ledgerLines, memoAt, shardFile, writerFile } from "../land/ledger.js";
+import { coordinatesUnder, observeFile, observeText } from "../observe/files.js";
 import { EXTENSION, fieldOf } from "./claims.js";
-import { keyFor, lockSigners } from "./keys.js";
+import { keyFor, keyOf, lockSigners } from "./keys.js";
 import { sourceOf, vouching } from "../land/vouched.js";
 import { wordsOf } from "./wire.js";
 import { ownLock } from "../observe/runner.js";
@@ -45,6 +45,7 @@ export function foldPoints(store, standing, under, keeper, instrument = '', obse
     return [
         `place ${under ?? '.'}`,
         `instrument ${instrument}`,
+        `reading context ${readingContext(store)}`,
         ...written,
         ...lined,
         ...[...new Set(coordinates)].sort(),
@@ -93,6 +94,14 @@ export const foldsElsewhere = () => elsewhere.folds;
 const joined = (lines) => lines.join('\n');
 const split = (text) => (text === '' ? [] : text.split('\n'));
 const linesOf = (value) => value === undefined ? [] : typeof value === 'string' ? split(value) : value;
+/** Operational reader history guards file-fold reuse, never cell-region identity. */
+function readingContext(store) {
+    const speaker = keyOf(store, 'read');
+    const files = speaker === undefined ? [] : [writerFile(store, speaker), ...coordinatesUnder(dirname(shardFile(store, speaker, '')), store)
+            .filter(file => file.endsWith(EXTENSION)).map(file => join(store, file))];
+    return bytesDigest(store, text(files.filter(file => existsSync(file)).sort()
+        .map(file => bytesDigest(store, observeFile(file) ?? new Uint8Array())).join('\n')));
+}
 export function keptPlace(store, under) {
     const key = observeText(memoAt(store, lastOf([`place ${under ?? '.'}`])))?.trim();
     if (key === undefined || key === '')
@@ -101,6 +110,8 @@ export function keptPlace(store, under) {
     if (held === undefined)
         return undefined;
     const blob = JSON.parse(held);
+    if (blob.readingContext !== readingContext(store))
+        return undefined;
     const fold = blob.fold;
     return {
         ...fold,
@@ -134,7 +145,7 @@ export function keepFold(store, key, fold, points, instrument = '') {
         signed: [...fold.signed],
         kept: false,
     };
-    landMemo(store, `fold/${key}`, text(JSON.stringify({ fold: packed, points, instrument })));
+    landMemo(store, `fold/${key}`, text(JSON.stringify({ fold: packed, points, instrument, readingContext: readingContext(store) })));
     const at = memoAt(store, lastOf(points));
     mkdirSync(dirname(at), { recursive: true });
     writeFileSync(`${at}.${process.pid}.part`, `${key}\n`);

package/dist/fold/observed.js

@@ -389,7 +389,11 @@ export function observedClaims(root, store, options = {}) {
                     ? asked.ask(due.map((d) => ({
                         protocol: PROTOCOL, verb: 'read', rootScope: d.place, region: reader.capsule.region, held: heldOf(d.place, d.region),
                         files: (reader.capsule.reads.some((read) => read.includes('@')) ? handedAt(root, reader, roleOf, look, d.place) : [d.place]).map((coordinate) => ({ place: coordinate, text: observeText(resolve(root, coordinate)) ?? '' })),
-                    }))).map((answer) => (answer?.claims ?? []))
+                    }))).map((answer) => {
+                        if (answer?.kind !== 'fact')
+                            throw new Error(`REFUSE·reader ${reader.module} · ${answer?.why ?? 'no capsule answer'}`);
+                        return (answer.claims ?? []);
+                    })
                     : runReader(module, root, due.map((d) => ({ place: d.place, ...(reader.kind === 'js' ? { text: new TextDecoder().decode(d.bytes) } : {}), held: heldOf(d.place, d.region) })));
             }
             catch (error) {

package/dist/fold/reach.d.ts

@@ -7,6 +7,11 @@ export declare const selectionLines: (fold: {
     readonly standing: readonly string[];
     readonly under?: string;
 }) => readonly string[];
+export declare const projectionLines: (fold: {
+    readonly root: string;
+    readonly standing: readonly string[];
+    readonly under?: string;
+}) => readonly string[];
 export declare function capsulesFor(standing: readonly string[], place: string, root?: string): readonly {
     readonly capsule: Capsule;
     readonly offer: string;

package/dist/fold/reach.js

@@ -1,6 +1,6 @@
 import { selectedCapsules } from "../host/selected-capsules.js";
 import { basename } from "../host/io.js";
-import { matches } from '@lapxo/topos/wire';
+import { canonical, matches, parse } from '@lapxo/topos/wire';
 import { fieldOf } from "./claims.js";
 import { spoken, worldsIn } from "./places.js";
 import { wordOf, wordsOf } from "./wire.js";
@@ -57,9 +57,27 @@ export const selectionLines = (fold) => {
     const qualified = fold.standing.filter((line) => fieldOf(line, 'scope').startsWith(`${fold.under ?? ''}uses/`));
     return [...new Set([...local, ...qualified])].filter((line) => fieldOf(line, 'value') !== 'withdraw');
 };
+/** Host bindings belong to the selected place, never to another sibling's lock. */
+const relativeProjections = (standing, prefix) => standing.filter(line => fieldOf(line, 'scope').startsWith(`${prefix}dep/`)).map(line => {
+    const got = parse(line, { preserveKeys: true });
+    if (got.kind !== 'fact')
+        throw Error(`REFUSE·wire ${got.why}`);
+    // An unsigned host projection of admitted fields, never a newly signed claim.
+    const { sig, by, epoch, expires, repo, ...fields } = got.value.fields;
+    return canonical({ ...fields, scope: fields.scope.slice(prefix.length) }, got.value.version);
+});
+export const projectionLines = (fold) => {
+    const place = fold.under?.replace(/\/$/, '') ?? '';
+    const prefix = place ? `${place}/` : '';
+    const local = ownLockOf(fold.root, place).filter(line => fieldOf(line, 'scope').startsWith('dep/'));
+    const qualified = relativeProjections(fold.standing, prefix);
+    return [...new Set([...ownLock(), ...local, ...qualified])];
+};
 export function capsulesFor(standing, place, root) {
     const prefix = place ? `${place}/` : '';
     const pins = root === undefined ? standing.filter(line => fieldOf(line, 'scope').startsWith(`${prefix}uses/`) && fieldOf(line, 'value') !== 'withdraw')
         : selectionLines({ root, standing, ...(prefix ? { under: prefix } : {}) });
-    return selectedCapsules(pins);
+    const host = root === undefined ? [...ownLock(), ...relativeProjections(standing, prefix)]
+        : projectionLines({ root, standing, ...(prefix ? { under: prefix } : {}) });
+    return selectedCapsules(pins, undefined, undefined, host);
 }

package/dist/fold/readers.js

@@ -8,6 +8,7 @@ import { capsuleAt, placesIn } from "./places.js";
 import { capsulesFor } from "./reach.js";
 import { ownLockOf } from "./signed.js";
 import { ownLock } from "../observe/runner.js";
+import { selectedWireList } from "../host/selected-topos.js";
 import { entriesIn, coordinatesUnder, observeFile, stampOf } from "../observe/files.js";
 export function lookOf(root, roleOf) {
     const walked = new Map();
@@ -42,7 +43,10 @@ const reachOfLine = (module, where) => {
  */
 export function capsuleReadersOf(root, store, standing, lines, resolve = capsulesFor) {
     const reaching = new Set(lines.flatMap((reader) => reachOfLine(reader.module, reader.where)));
-    const measures = wordsOf(standing, 'region-measures');
+    const localMeasures = wordsOf(standing, 'region-measures');
+    const pins = standing.filter(line => fieldOf(line, 'scope').startsWith('uses/') && fieldOf(line, 'value') !== 'withdraw');
+    const measures = localMeasures.length || !pins.length ? localMeasures
+        : selectedWireList(standing, Number.MAX_SAFE_INTEGER, pins, 'region-measures');
     const world = fields(fieldOf(wireLine(standing, 'offers/world') ?? '', 'value')).map(([region, globs]) => canonical({ scope: `region/${region}`, measure: wordOn(standing, 'region-coordinate', ownLock()), value: globs }));
     const groups = new Map();
     for (const place of ['', ...placesIn(root)]) {

package/dist/fold/signed.js

@@ -6,7 +6,7 @@ import { signaturesOf } from "./digests.js";
 import { lockLines, lockStanding } from "./keys.js";
 import { wordOf } from "./wire.js";
 import { authorityFor, rootSigner } from "./signers.js";
-import { shardLines, storeOf } from "../land/ledger.js";
+import { ledgerLines, shardLines, storeOf } from "../land/ledger.js";
 import { verifiesFields } from "../land/sign.js";
 import { observeText } from "../observe/files.js";
 const held = new Map();
@@ -20,14 +20,16 @@ function verified(root, place) {
     const hasAuthority = lock.some(line => fieldOf(line, 'sig') !== '');
     const algorithms = hasAuthority ? signaturesOf(store).admitted : [];
     const signers = algorithms.length ? authorityFor(lock, rootSigner(root), algorithms).admitted : [];
-    const history = signers.flatMap(signer => shardLines(store, signer.id, `${place}/${LOCK}`));
+    const history = signers.flatMap(signer => place ? shardLines(store, signer.id, `${place}/${LOCK}`) : ledgerLines(store, signer.id)).filter(line => fieldOf(line, 'sig') !== '');
     const text = [publicText, ...history, ...(told.get(place) ?? [])].join('\n');
     const key = `${root} ${place}`;
     const last = held.get(key);
     if (last !== undefined && last.text === text && last.lock === lock)
         return last;
     const lines = [...new Set(text.split('\n').filter(isWire))];
-    const family = signers.length ? wordOf(lockStanding(store), 'families', 'region') : '';
+    // Unrestricted coverage does not construct a region coordinate. Restricted
+    // coverage still requires the lock's declared namespace before comparison.
+    const family = signers.some(signer => !signer.coverage.includes('*')) ? wordOf(lockStanding(store), 'families', 'region') : '';
     const stands = (line) => {
         const got = parse(line);
         if (got.kind !== 'fact' || got.value.fields['sig'] === undefined)

package/dist/fold/wire.js

@@ -1,5 +1,6 @@
 import * as topos from '@lapxo/topos/wire';
 import { fieldOf, selfName } from "./claims.js";
+import { selectedWireList } from "../host/selected-topos.js";
 const spoken = topos;
 export const namesAt = (spoken['namesAt'] ?? spoken['namesLeaf']);
 export const roleAt = (spoken['roleAt'] ?? spoken['leafRoleOf']);
@@ -17,7 +18,11 @@ export function wordsOf(standing, list) {
  * refusal. The older `audit/wire/` prefix is one era of `wire/`, not a fall-back to another lock.
  */
 export function wordOf(standing, list, name) {
-    const held = wordsOf(standing, list);
+    const local = wordsOf(standing, list);
+    const pins = standing.filter(line => fieldOf(line, 'scope').startsWith('uses/') && fieldOf(line, 'value') !== 'withdraw');
+    // A required word may come from selected standing without copying foreign claims.
+    const held = wireLine(standing, list) === undefined && pins.length
+        ? selectedWireList(standing, Number.MAX_SAFE_INTEGER, pins, list) : local;
     const eras = typeof name === 'string' ? [name] : name;
     const found = eras.find((one) => held.includes(one));
     if (found !== undefined)

package/dist/host/ports/signing.d.ts

@@ -0,0 +1,31 @@
+/** Contains only host-controlled diagnostics, never child output. */
+export declare class SigningFailure extends Error {
+}
+export interface SigningLot {
+    readonly bytes: readonly string[];
+    readonly keyId: string;
+    readonly algorithm: string;
+}
+export interface SignatureRecord {
+    readonly keyId: string;
+    readonly signature: string;
+}
+export interface SigningProtocol {
+    readonly request: (lot: SigningLot) => string;
+    readonly response: (records: readonly SignatureRecord[]) => string;
+    readonly reply: (text: string, lot: SigningLot) => readonly SignatureRecord[];
+}
+export type SigningMechanism = {
+    readonly kind: 'file';
+    readonly path: string;
+} | {
+    readonly kind: 'command';
+    readonly executable: string;
+    readonly args: readonly string[];
+};
+export interface SigningLimits {
+    readonly timeoutMs: number;
+    readonly responseBytes: number;
+}
+/** Host-approved mechanism only. Repository declarations do not authorize execution. */
+export declare function invokeSigner(lot: SigningLot, mechanism: SigningMechanism, protocol: SigningProtocol, limits: SigningLimits): Promise<readonly SignatureRecord[]>;

package/dist/host/ports/signing.js

@@ -0,0 +1,74 @@
+import { spawn } from 'node:child_process';
+import { readFileSync } from 'node:fs';
+import { signBytes } from "../adapters/keys/ed25519.js";
+/** Contains only host-controlled diagnostics, never child output. */
+export class SigningFailure extends Error {
+}
+/** Host-approved mechanism only. Repository declarations do not authorize execution. */
+export async function invokeSigner(lot, mechanism, protocol, limits) {
+    if (!Number.isSafeInteger(limits.timeoutMs) || limits.timeoutMs <= 0
+        || !Number.isSafeInteger(limits.responseBytes) || limits.responseBytes <= 0) {
+        throw new SigningFailure(`REFUSE·signer ${lot.keyId} has no valid declared limits`);
+    }
+    const request = protocol.request(lot);
+    let output;
+    if (mechanism.kind === 'file') {
+        try {
+            const key = readFileSync(mechanism.path, 'utf8');
+            output = protocol.response(lot.bytes.map(bytes => ({ keyId: lot.keyId, signature: signBytes(bytes, key, lot.algorithm) })));
+        }
+        catch {
+            throw new SigningFailure(`REFUSE·signer ${lot.keyId} file mechanism failed`);
+        }
+    }
+    else
+        output = await new Promise((resolve, reject) => {
+            const child = spawn(mechanism.executable, [...mechanism.args], { stdio: ['pipe', 'pipe', 'pipe'], shell: false });
+            let size = 0;
+            const chunks = [];
+            let failure;
+            const refuse = (why) => {
+                if (failure)
+                    return;
+                failure = why;
+                child.kill('SIGKILL');
+                clearTimeout(timer);
+                child.stdin.destroy();
+                child.stdout.destroy();
+                child.stderr.destroy();
+                reject(new SigningFailure(`REFUSE·signer ${lot.keyId} ${why} · status=none · signal=SIGKILL`));
+            };
+            const timer = setTimeout(() => refuse('timeout'), limits.timeoutMs);
+            child.stdout.on('data', (chunk) => {
+                size += chunk.length;
+                if (size > limits.responseBytes)
+                    refuse('response exceeds declared limit');
+                if (!failure)
+                    chunks.push(chunk);
+            });
+            // Drain, never forward or retain signer diagnostics.
+            child.stderr.on('data', () => { });
+            child.stdin.on('error', () => refuse('input delivery failed'));
+            child.on('error', () => {
+                clearTimeout(timer);
+                reject(new SigningFailure(`REFUSE·signer ${lot.keyId} command could not start`));
+            });
+            child.on('close', (status, signal) => {
+                clearTimeout(timer);
+                if (failure || status !== 0) {
+                    reject(new SigningFailure(`REFUSE·signer ${lot.keyId} ${failure ?? 'command failed'} · status=${status ?? 'none'} · signal=${signal ?? 'none'}`));
+                }
+                else
+                    resolve(Buffer.concat(chunks).toString('utf8'));
+            });
+            child.stdin.end(request);
+        });
+    if (Buffer.byteLength(output) > limits.responseBytes)
+        throw new SigningFailure(`REFUSE·signer ${lot.keyId} response exceeds declared limit`);
+    try {
+        return protocol.reply(output, lot);
+    }
+    catch {
+        throw new SigningFailure(`REFUSE·signer ${lot.keyId} invalid response`);
+    }
+}

package/dist/host/provide.d.ts

@@ -6,8 +6,8 @@ interface ResolveResult {
 }
 type NextResolve = (specifier: string, context: ResolveContext) => ResolveResult;
 /**
- * Where a named package or world lies: `dep/<name>` for a library the instrument installs, `uses/<name>` for a world
- * pinned by its GitHub release. Both are the digest, laid. Nothing here spells a path.
+ * Resolve declared library bytes for this host. A library's shape may select an
+ * archive coordinate; world selection remains the standing contract.
  */
 export declare function pinPlace(name: string): string;
 export declare function pinExport(name: string, sub: string): string;

package/dist/host/provide.js

@@ -10,8 +10,8 @@ import { theWord } from "../fold/wire.js";
 const registerHooks = nodeModule.registerHooks;
 const taken = (exp) => (typeof exp === 'string' ? exp : exp && typeof exp === 'object' && 'default' in exp && typeof exp.default === 'string' ? exp.default : '');
 /**
- * Where a named package or world lies: `dep/<name>` for a library the instrument installs, `uses/<name>` for a world
- * pinned by its GitHub release. Both are the digest, laid. Nothing here spells a path.
+ * Resolve declared library bytes for this host. A library's shape may select an
+ * archive coordinate; world selection remains the standing contract.
  */
 export function pinPlace(name) {
     const lock = ownLock();
@@ -20,7 +20,7 @@ export function pinPlace(name) {
     if (line === undefined)
         return '';
     const digest = fieldOf(line, 'value');
-    return digest ? runtimeTreeAt(ownStore(), ownRoot(), digest, ownStore()) ?? '' : '';
+    return digest ? runtimeTreeAt(ownStore(), ownRoot(), digest, ownStore(), fieldOf(line, 'role') === 'reads' ? fieldOf(line, 'shape') : '') ?? '' : '';
 }
 export function pinExport(name, sub) {
     const at = pinPlace(name);

package/dist/host/release.d.ts

@@ -1,4 +1,6 @@
 export declare const laidAt: (store: string, digest: string) => string;
+/** A host artifact binding, not a measured ceiling or an object act. */
+export declare const isReleaseBinding: (line: string) => boolean;
 export declare const releasesOf: (lock: readonly string[]) => readonly string[];
 /**
  * What the host does before anything runs: each release the instrument's own lock names by digest is a snapshot of
@@ -9,4 +11,4 @@ export declare const releasesOf: (lock: readonly string[]) => readonly string[];
 export declare function layReleases(store: string, own: string, lock: readonly string[], contentStore?: string): number;
 export declare const resolvedOf: (store: string, own: string, lock: readonly string[], contentStore?: string) => readonly string[];
 /** A host loads verified release bytes from a runtime tree, never interprets a snapshot file as a directory. */
-export declare function runtimeTreeAt(store: string, own: string, digest: string, contentStore?: string): string | undefined;
+export declare function runtimeTreeAt(store: string, own: string, digest: string, contentStore?: string, root?: string): string | undefined;