@lapxo/bound 0.1.0

package/dist/host/capsule-process.js

@@ -0,0 +1,54 @@
+import { spawnSync } from 'node:child_process';
+import { PROTOCOL } from '@lapxo/topos/wire';
+/** Operational process failure, distinct from a valid contract refusal or abstention. */
+export class CapsuleProcessError extends Error {
+    constructor(reason, result) {
+        const stdout = result.stdout ?? '';
+        const stderr = result.stderr ?? '';
+        super(`REFUSE·capsule process ${reason}\n${stderr}${stdout}`);
+        this.name = 'CapsuleProcessError';
+        this.stdout = stdout;
+        this.stderr = stderr;
+        this.status = result.status;
+        this.signal = result.signal;
+        this.cause = result.error;
+    }
+}
+export function validResponse(value, request) {
+    if (value === null || typeof value !== 'object' || Array.isArray(value))
+        return false;
+    const one = value;
+    if (one['protocol'] !== PROTOCOL)
+        return false;
+    if (one['kind'] === 'refuse' || one['kind'] === 'abstain')
+        return typeof one['why'] === 'string';
+    if (one['kind'] !== 'fact')
+        return false;
+    if (request.verb === 'render')
+        return Array.isArray(one['lines']) && one['lines'].every((line) => typeof line === 'string');
+    if (request.verb === 'read')
+        return Array.isArray(one['claims']);
+    return true;
+}
+/** Last-line JSON is the wire framing. No partial batch, failed exit or synthetic missing response is accepted. */
+export function executeCapsule(command, args, requests, limits = {}) {
+    const run = spawnSync(command, args, { input: JSON.stringify(requests), encoding: 'utf8', maxBuffer: 1 << 26, ...limits });
+    if (run.error)
+        throw new CapsuleProcessError(`failed: ${run.error.message}`, run);
+    if (run.signal !== null || run.status !== 0)
+        throw new CapsuleProcessError(`exited ${run.status ?? `with signal ${run.signal}`}`, run);
+    const last = /(?:^|\n)([^\n]*)$/.exec(run.stdout.trimEnd())?.[1] ?? '';
+    let values;
+    try {
+        values = JSON.parse(last);
+    }
+    catch (error) {
+        throw new CapsuleProcessError('returned malformed or absent JSON', { ...run, error });
+    }
+    if (!Array.isArray(values) || values.length !== requests.length || !values.every((value, i) => validResponse(value, requests[i]))) {
+        throw new CapsuleProcessError(`returned an invalid batch; expected ${requests.length} responses`, run);
+    }
+    if (run.stderr)
+        process.stderr.write(run.stderr);
+    return values;
+}

package/dist/host/capsule.d.ts

@@ -0,0 +1,13 @@
+import type { Declaration } from '@lapxo/topos/capsule';
+import type { Request, Response } from '@lapxo/topos/contract';
+export interface Capsule {
+    readonly digest: string;
+    readonly declaration: Declaration;
+    readonly lines: readonly string[];
+    readonly ask: (requests: readonly Request[]) => readonly (Response | undefined)[];
+}
+/** A blob is loaded once in an act. A later ask for the same digest reads that capsule, and does not hash or unpack it again. */
+export declare function capsuleAt(digest: string, entry: string, store?: string): Capsule | undefined;
+export declare const childFlags: (argv?: readonly string[]) => readonly string[];
+/** The host may supply its cache store independently of the located executable. */
+export declare function locatedAt(tree: string, place: string, cacheStore?: string): Capsule | undefined;

package/dist/host/capsule.js

@@ -0,0 +1,149 @@
+import { sha } from "./hash.js";
+import { wireLinesOf as linesOf } from "../fold/claims.js";
+import { createHash } from 'node:crypto';
+import { mkdtempSync, rmSync, statSync } from 'node:fs';
+import { tmpdir } from 'node:os';
+import { basename, join, resolve, relative, isAbsolute, sep } from 'node:path';
+import { CAPSULE } from '@lapxo/topos/wire';
+import { declarationOf } from '@lapxo/topos/capsule';
+import { unpack } from "./archive.js";
+import { executeCapsule, validResponse } from "./capsule-process.js";
+import { blobAt, holdStore, replaceWhole, storeAt } from "../land/ledger.js";
+import { coordinatesUnder, observeFile, observeText } from "../observe/files.js";
+import { hostOf } from "../observe/run.js";
+import { ownLock, ownRoot, ownStore, processOf } from "../observe/runner.js";
+import { said } from "../fold/wire.js";
+const declared = new Map();
+const laid = new Map();
+process.on('exit', () => { for (const at of laid.values())
+    rmSync(at, { recursive: true, force: true }); });
+/** A blob is unpacked once in a process, where every run of it the process asks for reads it. */
+function unpacked(digest, bytes) {
+    const held = laid.get(digest);
+    if (held !== undefined)
+        return held;
+    const at = mkdtempSync(join(tmpdir(), `${basename(ownRoot())}-capsule-`));
+    try {
+        unpack(bytes, at);
+    }
+    catch (error) {
+        rmSync(at, { recursive: true, force: true });
+        throw error;
+    }
+    laid.set(digest, at);
+    return at;
+}
+/**
+ * A capsule is the bytes a digest names in the instrument's own store, and only when they hash to it: its own lock is
+ * read from them, and the coordinate a lock names runs as a process of its own, like a reader. Each answer is kept in one
+ * slot of the capsule, the place and the region; the body of the request is the hit, so a file that moved misses and
+ * overwrites the slot, and a request asked again for the same bytes is read back and never run twice. Operational failures never enter the cache; refusals and abstentions are asked again.
+ */
+const capsules = new Map();
+/** A blob is loaded once in an act. A later ask for the same digest reads that capsule, and does not hash or unpack it again. */
+export function capsuleAt(digest, entry, store) {
+    const identity = `${store ?? ownStore()}\0${digest}\0${entry}`;
+    const held = capsules.get(identity);
+    if (held !== undefined)
+        return held;
+    const bytes = observeFile(blobAt(store ?? ownStore(), digest));
+    if (bytes === undefined || `sha256:${createHash('sha256').update(bytes).digest('hex')}` !== digest)
+        return undefined;
+    const known = declared.get(digest) ?? ((lines) => ({ lines, declaration: declarationOf(lines) }))(linesOf(observeText(join(unpacked(digest, bytes), CAPSULE))));
+    declared.set(digest, known);
+    const names = Object.keys(known.declaration.regions);
+    const root = unpacked(digest, bytes);
+    const module = resolve(root, entry);
+    const coordinate = relative(root, module);
+    if (!entry || isAbsolute(entry) || (coordinate === '..' || coordinate.startsWith(`..${sep}`)) || entry.split(/[\\/]/).includes('..')) {
+        throw new Error(`REFUSE·capsule ${digest} declared entry ${entry || '(absent)'} unavailable`);
+    }
+    const capsule = { digest, ...known, ask: (requests) => {
+            if (!statSync(module, { throwIfNoEntry: false })?.isFile())
+                throw new Error(`REFUSE·capsule ${digest} declared entry ${entry} unavailable`);
+            return answered(digest, bytes, requests, names, root, store ?? ownStore(), module);
+        } };
+    capsules.set(identity, capsule);
+    return capsule;
+}
+const layoutsOf = () => said(ownLock(), 'release/layout')
+    .map((token) => token.split(':')).filter((pair) => pair.length === 2 && pair[0] !== undefined && pair[1] !== undefined);
+const oneModule = (at) => {
+    const files = coordinatesUnder(at, at).filter((one) => one.endsWith('.js'));
+    return files.length === 1 ? files[0] : undefined;
+};
+const split = new Map();
+const spawnOf = (at, names) => {
+    const held = split.get(at);
+    if (held !== undefined)
+        return held;
+    const layout = names.length === 0 ? undefined : layoutsOf().find(([dir, ext]) => names.some((name) => observeText(join(at, dir, `${name}${ext}`)) !== undefined));
+    const child = layout !== undefined ? [processOf('located', 'host'), at, layout[0], layout[1]]
+        : ((file) => (file === undefined ? [] : [processOf('located', 'host'), at, file, 'render']))(oneModule(at));
+    split.set(at, child);
+    return child;
+};
+export const childFlags = (argv = process.execArgv) => argv.filter((flag, i) => !/^(-e|-p|--eval|--print)$/.test(argv[i - 1] ?? '') && !/^(-e|-p|--eval|--print|--input-type)(=|$)/.test(flag));
+function answered(digest, bytes, requests, names, tree, cacheStore = ownStore(), entry) {
+    const child = entry === undefined ? spawnOf(tree ?? unpacked(digest, bytes), names) : [entry];
+    if (!child.length) {
+        process.stderr.write(`LOAD     regions · none of ${names.length} under the directories release/layout names\n`);
+        return requests.map(() => undefined);
+    }
+    const loader = entry !== undefined ? `${createHash('sha256').update(`${relative(tree, entry)}\n`).digest('hex')}\n` : child.length > 1 ? `${createHash('sha256').update(observeFile(child[0]) ?? new Uint8Array()).digest('hex')}\n` : '';
+    const slotOf = (request) => sha(`${digest}\n${loader}${request.verb}\n${request.rootScope}\n${request.region ?? ''}`);
+    const hitOf = (request) => sha(`${digest}\n${loader}${JSON.stringify(request)}`);
+    const kept = requests.map((request) => storeAt(cacheStore, 'cas', 'answers', slotOf(request)));
+    const hits = requests.map(hitOf);
+    const held = kept.map((at, i) => {
+        const text = observeText(at);
+        if (text === undefined)
+            return undefined;
+        try {
+            const got = JSON.parse(text);
+            return got.format === 'capsule-answer/2' && got.hit === hits[i] && validResponse(got.said, requests[i]) && got.said.kind === 'fact' ? got.said : undefined;
+        }
+        catch (error) {
+            throw new Error(`${at}: ${error instanceof Error ? error.message : String(error)}`);
+        }
+    });
+    const missing = requests.filter((_, i) => held[i] === undefined);
+    if (missing.length)
+        process.stderr.write(`CAPSULE  ${digest.slice(7, 19)} · ${requests.length} asked · ${missing.length} run · ${missing.map((one) => `${one.rootScope}${one.region}`).join(' ')}\n`);
+    // Execute and validate the entire batch before committing any answer to the cache.
+    const ran = !missing.length ? [] : executeCapsule(process.execPath, [...childFlags(), hostOf(), ...child], missing);
+    return requests.map((request, i) => {
+        if (held[i] !== undefined)
+            return held[i];
+        const said = ran[missing.indexOf(request)];
+        if (said?.kind === 'fact') {
+            const text = JSON.stringify({ format: 'capsule-answer/2', hit: hits[i], said });
+            replaceWhole(kept[i], text);
+            holdStore(cacheStore, 'answers', slotOf(request), Buffer.byteLength(text));
+        }
+        return said;
+    });
+}
+/** The host may supply its cache store independently of the located executable. */
+export function locatedAt(tree, place, cacheStore = ownStore()) {
+    const at = join(tree, place);
+    const lines = linesOf(observeText(join(at, CAPSULE)));
+    if (!lines.length)
+        return undefined;
+    const known = { lines, declaration: declarationOf(lines) };
+    const names = Object.keys(known.declaration.regions);
+    if (!spawnOf(at, names).length)
+        return undefined;
+    const hash = createHash('sha256');
+    hash.update(observeFile(join(at, CAPSULE)) ?? new Uint8Array());
+    for (const name of names)
+        for (const [dir, ext] of layoutsOf()) {
+            const bytes = observeFile(join(at, dir, `${name}${ext}`));
+            if (bytes !== undefined) {
+                hash.update(bytes);
+                break;
+            }
+        }
+    const digest = `sha256:${hash.digest('hex')}`;
+    return { digest, ...known, ask: (requests) => answered(digest, new Uint8Array(), requests, names, at, cacheStore) };
+}

package/dist/host/cell-receipts.d.ts

@@ -0,0 +1,2 @@
+/** Native count/bytes receipt lines; carried render blobs are separate verified cache payloads. */
+export declare function cellsWithReceipts(root: string, history: readonly string[], emit: (text: string) => void): Promise<void>;

package/dist/host/cell-receipts.js

@@ -0,0 +1,124 @@
+import { readFileSync, writeFileSync, existsSync, mkdirSync } from 'node:fs';
+import { join, dirname } from 'node:path';
+import { performance } from 'node:perf_hooks';
+import { fileURLToPath } from 'node:url';
+import { canonical, objectHistory, parse, byBytes, wireAt, RECEIPTS } from '@lapxo/topos/wire';
+import { cellInputs, cellReceiptContract } from '@lapxo/topos/cell-inputs';
+import { renderCells } from '@lapxo/topos/cells-view';
+import { admittedObjects } from "./objects.js";
+import { objectFold } from "../fold/object.js";
+import { fullDigest, bytesDigest } from "./digest.js";
+import { closeReceipts, noteIdle } from "../fold/closed.js";
+import { authorityFor, rootSigner } from "../fold/signers.js";
+import { signaturesOf } from "../fold/digests.js";
+import { storeOf } from "../land/ledger.js";
+import { ownLock } from "../observe/runner.js";
+import { toposAt } from "./selected-topos.js";
+const fields = (line) => { const p = parse(line); return p.kind === 'fact' ? p.value.fields : {}; };
+/** Only Topos input/render entry bytes enter region identity; host locations do not. */
+function implementation(algorithm) {
+    return ['@lapxo/topos/cell-inputs', '@lapxo/topos/cells-view'].map(member => bytesDigest(readFileSync(fileURLToPath(import.meta.resolve(member))), algorithm)).sort(byBytes);
+}
+/** Native count/bytes receipt lines; carried render blobs are separate verified cache payloads. */
+export async function cellsWithReceipts(root, history, emit) {
+    const started = performance.now(), store = storeOf(root), parsed = objectHistory(history);
+    if (parsed.kind !== 'fact')
+        throw Error(`REFUSE·wire ${parsed.why}`);
+    const authority = authorityFor(history, rootSigner(root), signaturesOf(store).admitted);
+    for (const record of parsed.value.objects)
+        if (authority.of(canonical(record.fields)).kind !== 'admitted')
+            throw Error(`REFUSE·authority receipt input ${record.fields.id}`);
+    const config = parsed.value.configuration.filter(f => authority.of(canonical(f)).kind === 'admitted');
+    cellReceiptContract(config);
+    const instrument = ownLock().map(fields);
+    const wire = wireAt(instrument, Number.MAX_SAFE_INTEGER);
+    if (!wire)
+        throw Error('REFUSE·receipt no admitted digest algorithm');
+    const algorithm = [...wire.digests][0];
+    if (!algorithm)
+        throw Error('REFUSE·receipt no digest algorithm');
+    const code = implementation(algorithm);
+    const inputs = cellInputs(parsed.value.objects), semantic = new Map(), inputBytes = new Map();
+    const pins = new Map();
+    for (const record of parsed.value.objects.filter(r => r.record === 'cell')) {
+        const pin = record.fields.topos;
+        if (!pins.has(pin)) {
+            const top = toposAt(pin);
+            pins.set(pin, [pin, ...top.dependencies]);
+        }
+        const scope = `receipts/cells/${record.fields.scope}`;
+        const bytes = [...inputs.get(record.fields.scope), ...pins.get(pin), ...code, 'resolution=1'].sort(byBytes).join('\n');
+        inputBytes.set(scope, bytes);
+        semantic.set(scope, fullDigest(bytes, algorithm));
+    }
+    // The context stamp is a cache validity guard, not any cell's semantic receipt identity.
+    const contextStamp = fullDigest([...history, ...code].sort(byBytes), algorithm);
+    const at = join(root, RECEIPTS), raw = existsSync(at) ? readFileSync(at, 'utf8').split('\n').filter(Boolean) : [], native = raw.filter(l => parse(l).kind === 'fact');
+    const headers = native.filter(l => fields(l).scope === 'receipts' && fields(l).measure === 'digest');
+    const carried = (digest) => join(store, 'cas', 'carried', digest.slice(digest.indexOf(':') + 1));
+    const readVerified = (digest) => {
+        if (!digest.startsWith(algorithm + ':') || !/^[a-f0-9]+$/.test(digest.split(':')[1] ?? ''))
+            return;
+        const file = carried(digest);
+        if (!existsSync(file))
+            return;
+        const bytes = readFileSync(file);
+        const got = bytesDigest(bytes, algorithm);
+        if (got !== digest) {
+            emit(`RECEIPT invalid ${digest} · got ${got} · recompute`);
+            return;
+        }
+        return bytes.toString('utf8');
+    };
+    const opened = new Set(await closeReceipts(root, store, semantic));
+    const bodyLines = native.filter(l => fields(l).scope !== 'receipts').sort(byBytes).join('\n') + '\n';
+    const intact = raw.length === native.length && headers.length === 1 && readVerified(fields(headers[0]).at.replace(/^place:/, '')) === bodyLines;
+    if (!intact)
+        for (const scope of semantic.keys())
+            opened.add(scope);
+    const cached = new Map();
+    for (const [scope, digest] of semantic) {
+        const bytes = native.filter(l => fields(l).scope === scope && fields(l).measure === 'bytes');
+        const counts = native.filter(l => fields(l).scope === scope && fields(l).measure === 'count');
+        if (bytes.length !== 1 || counts.length !== 1 || fields(bytes[0]).value !== digest || fields(counts[0]).value !== '1..1') {
+            opened.add(scope);
+            continue;
+        }
+        const output = readVerified(fields(counts[0]).at.replace(/^place:/, ''));
+        if (output === undefined) {
+            opened.add(scope);
+            continue;
+        }
+        cached.set(scope, output);
+    }
+    const idle = headers.length === 1 && fields(headers[0]).value === contextStamp && readVerified(fields(headers[0]).at.replace(/^place:/, '')) !== undefined && opened.size === 0;
+    let readings;
+    if (!idle) {
+        const held = await admittedObjects(root, history, emit);
+        readings = objectFold(held.records, held.context);
+    }
+    const newLines = [], outputs = [];
+    const save = (text) => { const digest = bytesDigest(Buffer.from(text), algorithm); const path = carried(digest); mkdirSync(dirname(path), { recursive: true }); if (!existsSync(path) || readFileSync(path, 'utf8') !== text)
+        writeFileSync(path, text); return digest; };
+    for (const [scope, digest] of semantic) {
+        const cellName = scope.slice('receipts/cells/'.length);
+        const output = (!opened.has(scope) && cached.has(scope)) ? cached.get(scope) : renderCells([readings.find(c => c.cell === cellName)]).join('\n') + '\n';
+        outputs.push(output.trimEnd());
+        const payload = save(output);
+        if (save(inputBytes.get(scope)) !== digest)
+            throw Error('REFUSE·receipt input closure hash mismatch');
+        newLines.push(canonical({ scope, role: 'writes', form: 'interval', measure: 'count', value: '1..1', at: `place:${payload}`, by: 'bound' }), canonical({ scope, role: 'writes', form: 'alphabet', measure: 'bytes', value: digest, at: `place:${digest}`, by: 'bound' }));
+        emit(`RECEIPT ${scope}@1 · ${digest} · ${opened.has(scope) ? 'opened' : 'same'}`);
+    }
+    const nativeBody = newLines.sort(byBytes).join('\n') + '\n', body = save(nativeBody);
+    // One native header names carried count/bytes lines; at closes the exact carried bytes.
+    const next = [canonical({ scope: 'receipts', role: 'writes', form: 'alphabet', measure: 'digest', value: contextStamp, at: `place:${body}`, by: 'bound' }), ...newLines.sort(byBytes)].join('\n') + '\n';
+    if (!existsSync(at) || readFileSync(at, 'utf8') !== next)
+        writeFileSync(at, next);
+    if (idle)
+        noteIdle();
+    emit(`RECEIPTS ${semantic.size} read · ${opened.size} opened · ${idle ? 'idle' : 'context checked'} · provider ${idle ? 0 : pins.size}`);
+    for (const output of outputs)
+        emit(output);
+    emit(`COST cells@1 · ${(performance.now() - started).toFixed(3)} ms · admission/context/receipt/render included`);
+}

package/dist/host/digest.d.ts

@@ -0,0 +1,3 @@
+/** Sorted by UTF-8 bytes; the algorithm is a field (`sha256:…`), never bare hex. */
+export declare function fullDigest(input: string | readonly string[], algorithm: string): string;
+export declare function bytesDigest(bytes: Uint8Array, algorithm: string): string;

package/dist/host/digest.js

@@ -0,0 +1,15 @@
+import { createHash } from 'node:crypto';
+import { byBytes } from '@lapxo/topos/wire';
+import { selfName } from "../fold/claims.js";
+/** Sorted by UTF-8 bytes; the algorithm is a field (`sha256:…`), never bare hex. */
+export function fullDigest(input, algorithm) {
+    if (!algorithm)
+        throw new Error(`${selfName()}: REFUSE·runtime a digest was asked for before the lock said which algorithm`);
+    const text = typeof input === 'string' ? input : [...input].sort(byBytes).join('\n');
+    return `${algorithm}:${createHash(algorithm).update(text).digest('hex')}`;
+}
+export function bytesDigest(bytes, algorithm) {
+    if (!algorithm)
+        throw new Error(`${selfName()}: REFUSE·runtime a digest was asked for before the lock said which algorithm`);
+    return `${algorithm}:${createHash(algorithm).update(bytes).digest('hex')}`;
+}

package/dist/host/hash.d.ts

@@ -0,0 +1,2 @@
+/** SHA-256 byte hashing for host formats that explicitly name this algorithm. */
+export declare const sha: (bytes: string | Uint8Array) => string;

package/dist/host/hash.js

@@ -0,0 +1,3 @@
+import { createHash } from 'node:crypto';
+/** SHA-256 byte hashing for host formats that explicitly name this algorithm. */
+export const sha = (bytes) => createHash('sha256').update(bytes).digest('hex');

package/dist/host/io.d.ts

@@ -0,0 +1,9 @@
+/** The host's node surface: kernel folders import here, never `node:`. World reads still go through observeFile. */
+export { spawn, spawnSync } from 'node:child_process';
+export { createHash } from 'node:crypto';
+export { appendFileSync, closeSync, existsSync, linkSync, lstatSync, mkdirSync, mkdtempSync, openSync, readFileSync, readSync, readdirSync, renameSync, rmSync, statSync, writeFileSync, } from 'node:fs';
+export { tmpdir } from 'node:os';
+export { basename, dirname, join, relative, resolve } from 'node:path';
+export { fileURLToPath } from 'node:url';
+export { parentPort, workerData } from 'node:worker_threads';
+export { gzipSync } from 'node:zlib';

package/dist/host/io.js

@@ -0,0 +1,9 @@
+/** The host's node surface: kernel folders import here, never `node:`. World reads still go through observeFile. */
+export { spawn, spawnSync } from 'node:child_process';
+export { createHash } from 'node:crypto';
+export { appendFileSync, closeSync, existsSync, linkSync, lstatSync, mkdirSync, mkdtempSync, openSync, readFileSync, readSync, readdirSync, renameSync, rmSync, statSync, writeFileSync, } from 'node:fs';
+export { tmpdir } from 'node:os';
+export { basename, dirname, join, relative, resolve } from 'node:path';
+export { fileURLToPath } from 'node:url';
+export { parentPort, workerData } from 'node:worker_threads';
+export { gzipSync } from 'node:zlib';

package/dist/host/located.d.ts

@@ -0,0 +1,4 @@
+type Module = Readonly<Record<string, unknown>>;
+export declare const locate: (root: string, dir: string, ext: string) => Promise<Module>;
+export declare const load: () => Promise<Module>;
+export {};

package/dist/host/located.js

@@ -0,0 +1,105 @@
+var __rewriteRelativeImportExtension = (this && this.__rewriteRelativeImportExtension) || function (path, preserveJsx) {
+    if (typeof path === "string" && /^\.\.?\//.test(path)) {
+        return path.replace(/\.(tsx)$|((?:\.d)?)((?:\.[^./]+?)?)\.([cm]?)ts$/i, function (m, tsx, d, ext, cm) {
+            return tsx ? preserveJsx ? ".jsx" : ".js" : d && (!ext || !cm) ? m : (d + ext + "." + cm.toLowerCase() + "js");
+        });
+    }
+    return path;
+};
+import { readFileSync } from 'node:fs';
+import { join } from 'node:path';
+import { pathToFileURL } from 'node:url';
+import { pinExport, provide } from "./provide.js";
+const wanted = (role) => role === 'reader' ? ['observe', 'run'] : [role];
+const foreign = (role) => ['render', 'receipt', 'observe', 'run'].filter((name) => !wanted(role).includes(name));
+const isFn = (module, name) => typeof module[name] === 'function';
+const text = (error) => (error instanceof Error ? error.message : String(error)).replace(/\s+/g, ' ').trim();
+/**
+ * Wire and capsule of the world, from `dep/topos` (or the lock's `uses/topos` pin). The host never spells where that
+ * package lies.
+ */
+const sdk = async () => {
+    provide();
+    const [wireAt, capsuleAt] = [pinExport('topos', './wire'), pinExport('topos', './capsule')];
+    if (!wireAt || !capsuleAt)
+        throw new Error('REFUSE·pin dep/topos names no wire or capsule');
+    const [wire, capsule] = await Promise.all([import(__rewriteRelativeImportExtension(pathToFileURL(wireAt).href)), import(__rewriteRelativeImportExtension(pathToFileURL(capsuleAt).href))]);
+    return {
+        CAPSULE: String(wire['CAPSULE'] ?? ''),
+        PROTOCOL: String(wire['PROTOCOL'] ?? ''),
+        parse: wire['parse'],
+        declarationOf: capsule['declarationOf'],
+        readers: capsule['readers'],
+        receiptShell: capsule['receiptShell'],
+        shell: capsule['shell'],
+    };
+};
+/**
+ * The host loads a world from its lock: the lock read once, each region imported from its one file by name and role into
+ * the shell of its kind. A region that fails is one line on stderr and is left out; the regions that loaded still form
+ * the shell. A world with no region of a kind has no shell of it. `load` is the host's child entry, the same load with
+ * its places read from the arguments the host spawned it with.
+ */
+/** A capsule that ships one render module: the host calls it per region and hands it the lines. The module does not read. */
+const pagesOf = async (root, file) => {
+    const { CAPSULE, PROTOCOL, declarationOf, shell } = await sdk();
+    const lines = readFileSync(join(root, CAPSULE), 'utf8').split('\n').filter((line) => line.startsWith(PROTOCOL));
+    const { regions } = declarationOf(lines);
+    const module = await import(__rewriteRelativeImportExtension(pathToFileURL(join(root, file)).href));
+    const render = module['render'] ?? module['default']?.['render'];
+    if (typeof render !== 'function')
+        return {};
+    const held = Object.fromEntries(Object.entries(regions).map(([name, reads]) => [name, {
+            reads,
+            region: (asked) => render({ ...asked, region: name }),
+        }]));
+    return held && Object.keys(held).length ? { render: shell(held) } : {};
+};
+export const locate = async (root, dir, ext) => {
+    if (ext === 'render')
+        return pagesOf(root, dir);
+    const { CAPSULE, PROTOCOL, parse, declarationOf, readers, receiptShell, shell } = await sdk();
+    const lines = readFileSync(join(root, CAPSULE), 'utf8').split('\n').filter((line) => line.startsWith(PROTOCOL));
+    const field = (line, name) => ((got) => (got.kind === 'fact' ? got.value.fields[name] ?? '' : ''))(parse(line));
+    const { regions, writes } = declarationOf(lines);
+    const reader = new Set(lines.filter((line) => field(line, 'measure') === 'writes').map((line) => field(line, 'scope').slice('region/'.length)));
+    const kind = (name) => (reader.has(name) ? 'reader' : writes[name] ?? '');
+    const region = async (name, reads, role) => {
+        let module;
+        try {
+            module = await import(__rewriteRelativeImportExtension(pathToFileURL(join(root, dir, `${name}${ext}`)).href));
+        }
+        catch (error) {
+            process.stderr.write(`LOAD     ${name} · module error · ${text(error)}\n`);
+            return undefined;
+        }
+        const has = wanted(role).filter((key) => isFn(module, key));
+        const exported = foreign(role).filter((key) => isFn(module, key));
+        if (!has.length && exported.length) {
+            process.stderr.write(`LOAD     ${name} · role mismatch · ${role} exports ${exported.join('|')}\n`);
+            return undefined;
+        }
+        if (!has.length) {
+            process.stderr.write(`LOAD     ${name} · missing export · ${wanted(role)[0]}\n`);
+            return undefined;
+        }
+        const picked = role === 'reader' ? { observe: module['observe'], run: module['run'] } : { region: module[role] };
+        return [name, { reads, ...picked }];
+    };
+    const loaded = async (role) => {
+        const held = [];
+        for (const [name, reads] of Object.entries(regions)) {
+            if (kind(name) !== role)
+                continue;
+            const row = await region(name, reads, role);
+            if (row)
+                held.push(row);
+        }
+        return held.length ? Object.fromEntries(held) : undefined;
+    };
+    const render = await loaded('render');
+    const receipt = await loaded('receipt');
+    const reading = await loaded('reader');
+    return { render: render && shell(render), receipt: receipt && receiptShell(receipt), ...(reading ? readers(reading) : {}) };
+};
+export const load = () => locate(process.argv[3] ?? '', process.argv[4] ?? '', process.argv[5] ?? '');

package/dist/host/objects.d.ts

@@ -0,0 +1,5 @@
+/** Bound supplies host authority and I/O; topos owns grammar, selection and context validation. */
+export declare function admittedObjects(root: string, lines: readonly string[], emit?: (text: string) => void): Promise<{
+    records: readonly import("@lapxo/topos/wire").ObjectRecord[];
+    context: import("@lapxo/topos/wire").ObjectContext;
+}>;

package/dist/host/objects.js

@@ -0,0 +1,18 @@
+import { canonical, objectHistory, validateObjectContext } from '@lapxo/topos/wire';
+import { objectProvider } from '@lapxo/topos/object-provider';
+import { authorityFor, rootSigner } from "../fold/signers.js";
+import { signaturesOf } from "../fold/digests.js";
+import { storeOf } from "../land/ledger.js";
+import { toposAt, contextModuleAt } from "./selected-topos.js";
+/** Bound supplies host authority and I/O; topos owns grammar, selection and context validation. */
+export async function admittedObjects(root, lines, emit = () => { }) {
+    const history = objectHistory(lines);
+    if (history.kind !== 'fact')
+        throw Error(`REFUSE·wire ${history.why}`);
+    const authority = authorityFor(lines, rootSigner(root), signaturesOf(storeOf(root)).admitted);
+    const context = await objectProvider(history.value.objects, history.value.configuration, { admit: fields => authority.of(canonical(fields)).kind === 'admitted', emit, topos: toposAt, module: contextModuleAt });
+    const checked = validateObjectContext(history.value.objects, context);
+    if (checked.kind !== 'fact')
+        throw Error(`REFUSE·context ${checked.why}`);
+    return { records: checked.value, context };
+}

package/dist/host/ports/store.d.ts

@@ -0,0 +1,2 @@
+export declare function storeRoot(from: string): string;
+export declare const storeDirs: (store: string) => number;

package/dist/host/ports/store.js

@@ -0,0 +1,18 @@
+/** The store root is the tree that holds a TARGET.bound beside its .bound store. */
+import { existsSync, readdirSync } from 'node:fs';
+import { dirname, join, resolve } from 'node:path';
+import { EXTENSION, LOCK } from '@lapxo/topos/wire';
+export function storeRoot(from) {
+    const abs = resolve(from || '.');
+    let at = abs;
+    for (let i = 0; i < 64; i += 1) {
+        if (existsSync(join(at, LOCK)) && existsSync(join(at, EXTENSION)))
+            return at;
+        const parent = dirname(at);
+        if (parent === at)
+            break;
+        at = parent;
+    }
+    return abs;
+}
+export const storeDirs = (store) => existsSync(store) ? readdirSync(store, { withFileTypes: true }).filter((entry) => entry.isDirectory()).length : 0;

package/dist/host/provide.d.ts

@@ -0,0 +1,23 @@
+interface ResolveContext {
+    parentURL?: string;
+}
+interface ResolveResult {
+    url: string;
+}
+type NextResolve = (specifier: string, context: ResolveContext) => ResolveResult;
+/**
+ * Where a named package or world lies: `dep/<name>` for a library the instrument installs, `uses/<name>` for a world
+ * pinned by its GitHub release. Both are the digest, laid. Nothing here spells a path.
+ */
+export declare function pinPlace(name: string): string;
+export declare function pinExport(name: string, sub: string): string;
+export declare function pinName(name: string): string;
+/** Node package resolution at a digest-laid library; exports remain authoritative. */
+export declare function resolvePinned(specifier: string, context: ResolveContext, nextResolve: NextResolve, pin: {
+    readonly at: string;
+    readonly pkg: string;
+    readonly json: string;
+    readonly exports: boolean;
+}): ResolveResult;
+export declare function provide(): void;
+export {};