@lapxo/bound 0.1.0

package/dist/host/provide.js

@@ -0,0 +1,81 @@
+import * as nodeModule from 'node:module';
+import { realpathSync } from 'node:fs';
+import { join, relative, isAbsolute, sep } from 'node:path';
+import { pathToFileURL } from 'node:url';
+import { fieldOf } from "../fold/claims.js";
+import { observeText } from "../observe/files.js";
+import { ownLock, ownStore, ownRoot } from "../observe/runner.js";
+import { runtimeTreeAt } from "./release.js";
+import { theWord } from "../fold/wire.js";
+const registerHooks = nodeModule.registerHooks;
+const taken = (exp) => (typeof exp === 'string' ? exp : exp && typeof exp === 'object' && 'default' in exp && typeof exp.default === 'string' ? exp.default : '');
+/**
+ * Where a named package or world lies: `dep/<name>` for a library the instrument installs, `uses/<name>` for a world
+ * pinned by its GitHub release. Both are the digest, laid. Nothing here spells a path.
+ */
+export function pinPlace(name) {
+    const lock = ownLock();
+    const line = lock.find((one) => fieldOf(one, 'scope') === `dep/${name}` && fieldOf(one, 'role') === 'reads')
+        ?? lock.find((one) => fieldOf(one, 'scope') === `uses/${name}`);
+    if (line === undefined)
+        return '';
+    const digest = fieldOf(line, 'value');
+    return digest ? runtimeTreeAt(ownStore(), ownRoot(), digest, ownStore()) ?? '' : '';
+}
+export function pinExport(name, sub) {
+    const at = pinPlace(name);
+    const file = taken(JSON.parse(observeText(join(at, manifestOf())) ?? '{}').exports?.[sub]);
+    return at && file ? join(at, file) : '';
+}
+export function pinName(name) {
+    const at = pinPlace(name);
+    return at ? (JSON.parse(observeText(join(at, manifestOf())) ?? '{}').name ?? '') : '';
+}
+const manifestOf = () => `${theWord(ownLock(), 'pin-shape')}.json`;
+/** Node package resolution at a digest-laid library; exports remain authoritative. */
+export function resolvePinned(specifier, context, nextResolve, pin) {
+    if (pin.exports)
+        return nextResolve(specifier, { ...context, parentURL: pin.json });
+    const sub = specifier === pin.pkg ? '' : specifier.slice(pin.pkg.length + 1);
+    const requested = join(pin.at, sub);
+    const coordinate = relative(pin.at, requested);
+    if (isAbsolute(coordinate) || coordinate === '..' || coordinate.startsWith(`..${sep}`))
+        throw new Error('REFUSE·pin library import leaves its laid tree');
+    const file = nodeModule.createRequire(pin.json).resolve(requested);
+    const entry = relative(realpathSync(pin.at), realpathSync(file));
+    if (isAbsolute(entry) || entry === '..' || entry.startsWith(`..${sep}`))
+        throw new Error('REFUSE·pin library entry leaves its laid tree');
+    return nextResolve(pathToFileURL(file).href, context);
+}
+/**
+ * A blob stays self-contained. The one thing it does not carry is the SDK the host provides: an import whose package
+ * the instrument's own lock names at dep/<name> resolves at the place pinPlace delivers. Nothing is linked into the
+ * blob's folder.
+ */
+let hooked = false;
+export function provide() {
+    if (hooked)
+        return;
+    hooked = true;
+    const pins = ownLock()
+        .filter((line) => fieldOf(line, 'scope').startsWith('dep/') && fieldOf(line, 'role') === 'reads')
+        .flatMap((line) => {
+        const name = fieldOf(line, 'scope').slice('dep/'.length);
+        const at = pinPlace(name);
+        const pkg = pinName(name);
+        const file = manifestOf();
+        const manifest = JSON.parse(observeText(join(at, file)) ?? '{}');
+        return at && pkg ? [{ at, pkg, exports: Object.prototype.hasOwnProperty.call(manifest, 'exports'), href: pathToFileURL(at).href, json: pathToFileURL(join(at, file)).href }] : [];
+    });
+    registerHooks({
+        resolve(specifier, context, nextResolve) {
+            if (specifier.startsWith('.') || specifier.startsWith('/') || specifier.includes(':'))
+                return nextResolve(specifier, context);
+            const parent = context.parentURL ?? '';
+            const pin = pins.find((one) => specifier === one.pkg || specifier.startsWith(`${one.pkg}/`));
+            if (pin === undefined || parent.startsWith(pin.href))
+                return nextResolve(specifier, context);
+            return resolvePinned(specifier, context, nextResolve, pin);
+        },
+    });
+}

package/dist/host/release.d.ts

@@ -0,0 +1,12 @@
+export declare const laidAt: (store: string, digest: string) => string;
+export declare const releasesOf: (lock: readonly string[]) => readonly string[];
+/**
+ * What the host does before anything runs: each release the instrument's own lock names by digest is a snapshot of
+ * lines and digests, kept by digest, and the place the line needs is a materialization of verified CAS bytes. Materialized files do not share writable inodes with the store. A blob is laid only when its bytes hash to the digest that names it. What stands laid is
+ * said by resolvedOf: a line for each release whose blob hashes to its name and whose place, or the cas when its line
+ * needs none, holds it.
+ */
+export declare function layReleases(store: string, own: string, lock: readonly string[], contentStore?: string): number;
+export declare const resolvedOf: (store: string, own: string, lock: readonly string[], contentStore?: string) => readonly string[];
+/** A host loads verified release bytes from a runtime tree, never interprets a snapshot file as a directory. */
+export declare function runtimeTreeAt(store: string, own: string, digest: string, contentStore?: string): string | undefined;

package/dist/host/release.js

@@ -0,0 +1,213 @@
+import { createHash } from 'node:crypto';
+import { existsSync, lstatSync, mkdirSync, realpathSync, renameSync, rmSync, writeFileSync } from 'node:fs';
+import { dirname, join, sep } from 'node:path';
+import { canonical } from '@lapxo/topos/wire';
+import { fieldOf, isWire } from "../fold/claims.js";
+import { archiveCoordinate, archiveDestination, members } from "./archive.js";
+import { blobAt, holdStore, landBlob, replaceWhole, storeAt } from "../land/ledger.js";
+import { coordinatesUnder, observeFile, observeText } from "../observe/files.js";
+export const laidAt = (store, digest) => storeAt(store, 'cas', 'laid', digest.replace(/^[^:]*:/, ''));
+export const releasesOf = (lock) => lock.filter((line) => fieldOf(line, 'scope').startsWith('dep/') && fieldOf(line, 'role') === 'reads' && fieldOf(line, 'value') !== 'withdraw');
+const laidMark = '.laid';
+const digestOf = (bytes) => `sha256:${createHash('sha256').update(bytes).digest('hex')}`;
+const hashed = (digest, bytes) => createHash(digest.includes(':') ? digest.slice(0, digest.indexOf(':')) : 'sha256').update(bytes).digest('hex') === digest.replace(/^[^:]*:/, '');
+const snapshotOf = (text) => text.split('\n').filter(isWire).filter((line) => fieldOf(line, 'measure') === 'digest' && fieldOf(line, 'scope').startsWith('file/'))
+    .map((line) => [fieldOf(line, 'scope').slice('file/'.length), fieldOf(line, 'value')]);
+function snapshotLines(files) {
+    return files.map(([coord, digest]) => canonical({
+        scope: `file/${coord}`, role: 'writes', form: 'alphabet', measure: 'digest', value: digest, at: `place:${digest}`, by: 'target',
+    })).join('\n') + (files.length ? '\n' : '');
+}
+function layDir(from, into) {
+    for (const coord of coordinatesUnder(from, from)) {
+        if (coord === laidMark)
+            continue;
+        const src = join(from, coord);
+        const dest = archiveDestination(into, coord);
+        mkdirSync(dirname(dest), { recursive: true });
+        if (existsSync(dest))
+            continue;
+        const bytes = observeFile(src);
+        if (bytes === undefined)
+            throw new Error(`REFUSE·release unreadable historical member ${coord}`);
+        writeFileSync(dest, bytes, { flag: 'wx' });
+    }
+}
+function swapPlace(place, next, digest) {
+    const old = `${next}.old`;
+    if (lstatSync(old, { throwIfNoEntry: false }) !== undefined)
+        throw new Error(`REFUSE·release recovery required for ${old}`);
+    writeFileSync(join(next, laidMark), digest, { flag: 'wx' });
+    let moved = false;
+    try {
+        if (lstatSync(place, { throwIfNoEntry: false }) !== undefined) {
+            renameSync(place, old);
+            moved = true;
+        }
+        renameSync(next, place);
+    }
+    catch (error) {
+        if (moved && lstatSync(place, { throwIfNoEntry: false }) === undefined)
+            renameSync(old, place);
+        throw error;
+    }
+    if (moved)
+        rmSync(old, { recursive: true, force: true });
+}
+function nextPlace(place) {
+    const next = `${place}.${process.pid}`;
+    mkdirSync(dirname(place), { recursive: true });
+    mkdirSync(next); // An abandoned staging directory is never silently reused.
+    return next;
+}
+function layFiles(store, own, files, into) {
+    const held = files.map(([coordinate, digest]) => {
+        const coord = archiveCoordinate(coordinate);
+        const dest = archiveDestination(into, coord);
+        const src = [blobAt(own, digest), blobAt(store, digest)].find(existsSync);
+        if (src === undefined)
+            throw new Error(`REFUSE·release missing blob ${digest} for ${coord}`);
+        const bytes = observeFile(src);
+        if (bytes === undefined || !hashed(digest, bytes))
+            throw new Error(`REFUSE·release blob ${digest} for ${coord} does not hold`);
+        return { dest, bytes };
+    });
+    for (const { dest, bytes } of held) {
+        mkdirSync(dirname(dest), { recursive: true });
+        // Materialized files may be edited by their consumer; never share writable inodes with the CAS.
+        writeFileSync(dest, bytes, { flag: 'wx' });
+    }
+}
+function layoutMatches(place, files) {
+    return files.every(([coord, digest]) => {
+        const path = join(place, archiveCoordinate(coord));
+        const st = lstatSync(path, { throwIfNoEntry: false });
+        const bytes = st?.isFile() ? observeFile(path) : undefined;
+        return bytes !== undefined && hashed(digest, bytes);
+    });
+}
+function sameSnapshot(actual, expected) {
+    const named = new Map(actual);
+    return named.size === actual.length && actual.length === expected.length && expected.every(([name, digest]) => named.get(name) === digest);
+}
+function keepSnapshot(store, digest, bytes) {
+    const files = members(bytes).map((one) => {
+        const file = digestOf(one.bytes);
+        landBlob(store, file, one.bytes);
+        return [one.name, file];
+    });
+    const text = snapshotLines(files);
+    replaceWhole(laidAt(store, digest), text);
+    holdStore(store, 'laid', digest, Buffer.byteLength(text));
+    return files;
+}
+/**
+ * What the host does before anything runs: each release the instrument's own lock names by digest is a snapshot of
+ * lines and digests, kept by digest, and the place the line needs is a materialization of verified CAS bytes. Materialized files do not share writable inodes with the store. A blob is laid only when its bytes hash to the digest that names it. What stands laid is
+ * said by resolvedOf: a line for each release whose blob hashes to its name and whose place, or the cas when its line
+ * needs none, holds it.
+ */
+export function layReleases(store, own, lock, contentStore = own) {
+    let laid = 0;
+    for (const line of releasesOf(lock)) {
+        const digest = fieldOf(line, 'value');
+        const at = laidAt(store, digest);
+        const dir = lstatSync(at, { throwIfNoEntry: false })?.isDirectory() ?? false;
+        const bytes = observeFile(blobAt(contentStore, digest));
+        const named = digest.replace(/^[^:]*:/, '');
+        if (bytes !== undefined && !hashed(digest, bytes)) {
+            throw new Error(`REFUSE·release ${fieldOf(line, 'scope')} · blob ${named.slice(0, 12)} hashes to ${digestOf(bytes).slice(7, 19)} · not laid`);
+        }
+        if (bytes !== undefined && !dir && observeText(at) === undefined)
+            keepSnapshot(store, digest, bytes);
+        const current = observeText(at);
+        if (bytes !== undefined && current !== undefined && !dir && !sameSnapshot(snapshotOf(current), members(bytes).map((one) => [one.name, digestOf(one.bytes)])))
+            throw new Error(`REFUSE·release snapshot for ${digest} omits or changes archive members; explicit rebuild required`);
+        if (bytes === undefined && !dir && current === undefined)
+            throw new Error(`REFUSE·release ${fieldOf(line, 'scope')} has no available archive or snapshot`);
+        const needs = fieldOf(line, 'needs');
+        if (!needs)
+            continue;
+        const place = join(own, archiveCoordinate(needs));
+        const link = lstatSync(place, { throwIfNoEntry: false });
+        if (link?.isSymbolicLink() && !realpathSync(place).includes(`${sep}cas${sep}laid${sep}`))
+            continue;
+        if (dir) {
+            const files = bytes === undefined ? undefined : members(bytes).map((one) => [one.name, digestOf(one.bytes)]);
+            if (!lstatSync(place, { throwIfNoEntry: false })?.isSymbolicLink() && observeText(join(place, laidMark)) === digest && files !== undefined && layoutMatches(place, files))
+                continue;
+            const next = nextPlace(place);
+            try {
+                layDir(at, next);
+                swapPlace(place, next, digest);
+            }
+            catch (error) {
+                rmSync(next, { recursive: true, force: true });
+                throw error;
+            }
+            laid += 1;
+            continue;
+        }
+        const snap = observeText(at);
+        if (snap === undefined)
+            throw new Error(`REFUSE·release ${fieldOf(line, 'scope')} has no available snapshot`);
+        if (!lstatSync(place, { throwIfNoEntry: false })?.isSymbolicLink() && observeText(join(place, laidMark)) === digest && layoutMatches(place, snapshotOf(snap)))
+            continue;
+        const next = nextPlace(place);
+        try {
+            layFiles(store, contentStore, snapshotOf(snap), next);
+            swapPlace(place, next, digest);
+        }
+        catch (error) {
+            rmSync(next, { recursive: true, force: true });
+            throw error;
+        }
+        laid += 1;
+    }
+    return laid;
+}
+export const resolvedOf = (store, own, lock, contentStore = own) => releasesOf(lock).flatMap((line) => {
+    const digest = fieldOf(line, 'value');
+    const bytes = observeFile(blobAt(contentStore, digest));
+    const ok = bytes !== undefined && hashed(digest, bytes);
+    const needs = fieldOf(line, 'needs');
+    const place = needs ? join(own, archiveCoordinate(needs)) : '';
+    const at = laidAt(store, digest);
+    const laid = needs
+        ? observeText(join(place, laidMark)) === digest || (existsSync(place) && existsSync(at) && realpathSync(place) === realpathSync(at))
+        : existsSync(at);
+    const expected = ok ? members(bytes).map((one) => [one.name, digestOf(one.bytes)]) : undefined;
+    const historicalDirectory = lstatSync(at, { throwIfNoEntry: false })?.isDirectory() === true;
+    const snapshot = observeText(at);
+    const complete = expected !== undefined && (needs
+        ? layoutMatches(place, expected)
+        : historicalDirectory ? layoutMatches(at, expected) : snapshot !== undefined && sameSnapshot(snapshotOf(snapshot), expected));
+    return ok && laid && complete ? [canonical({ scope: `resolved/${fieldOf(line, 'scope').slice('dep/'.length)}`, role: 'writes', form: 'alphabet', measure: 'digest', value: digest, at: `place:${digest}`, by: 'target' })] : [];
+});
+/** A host loads verified release bytes from a runtime tree, never interprets a snapshot file as a directory. */
+export function runtimeTreeAt(store, own, digest, contentStore = own) {
+    const named = /^([a-zA-Z0-9-]+):([a-fA-F0-9]+)$/.exec(digest);
+    if (named === null)
+        throw new Error(`REFUSE·release invalid digest ${digest}`);
+    const bytes = observeFile(blobAt(contentStore, digest));
+    if (bytes === undefined)
+        return undefined;
+    if (!hashed(digest, bytes))
+        throw new Error(`REFUSE·release ${digest} does not name its available bytes`);
+    const files = members(bytes).map((one) => [one.name, digestOf(one.bytes)]);
+    const place = storeAt(store, 'cas', 'runtime', named[1], named[2]);
+    if (observeText(join(place, laidMark)) === digest && layoutMatches(place, files))
+        return place;
+    for (const member of members(bytes))
+        landBlob(store, digestOf(member.bytes), member.bytes);
+    const next = nextPlace(place);
+    try {
+        layFiles(store, own, files, next);
+        swapPlace(place, next, digest);
+    }
+    catch (error) {
+        rmSync(next, { recursive: true, force: true });
+        throw error;
+    }
+    return place;
+}

package/dist/host/selected-capsules.d.ts

@@ -0,0 +1,8 @@
+import { capsuleAt } from './capsule.ts';
+import type { Capsule } from './capsule.ts';
+import type { ToposResolver } from './selected-topos.ts';
+/** Only explicit capsule offers request execution. Forms/classes/views do not need an executable alias. */
+export declare function selectedCapsules(pins: readonly string[], resolve?: typeof capsuleAt, select?: ToposResolver): readonly {
+    readonly capsule: Capsule;
+    readonly offer: string;
+}[];

package/dist/host/selected-capsules.js

@@ -0,0 +1,19 @@
+import { capsuleAt } from "./capsule.js";
+import { capsuleOffers } from '@lapxo/topos/standing';
+import { selectedTopoi, toposAt } from "./selected-topos.js";
+import { canonical } from '@lapxo/topos/wire';
+import { fieldOf } from "../fold/claims.js";
+import { ownLock } from "../observe/runner.js";
+/** Only explicit capsule offers request execution. Forms/classes/views do not need an executable alias. */
+export function selectedCapsules(pins, resolve = capsuleAt, select = toposAt) {
+    return selectedTopoi(pins, select).flatMap(({ digest, topos }) => capsuleOffers(topos).map(offer => {
+        const projections = ownLock().filter(line => fieldOf(line, 'scope').startsWith('dep/') && fieldOf(line, 'role') !== 'reads' && fieldOf(line, 'value') === offer.value);
+        if (projections.length !== 1 || !fieldOf(projections[0], 'shape'))
+            throw Error(`REFUSE·pin ${digest} capsule ${offer.value} needs one host projection`);
+        const projected = { ...offer, shape: fieldOf(projections[0], 'shape') };
+        const capsule = resolve(offer.value, projected.shape);
+        if (capsule === undefined)
+            throw Error(`REFUSE·pin ${digest} · ${offer.scope} · offered capsule ${offer.value} unavailable`);
+        return { capsule, offer: canonical(projected) };
+    }));
+}

package/dist/host/selected-topos.d.ts

@@ -0,0 +1,17 @@
+import type { StandingTopos } from '@lapxo/topos/standing';
+export interface SelectedTopos {
+    readonly digest: string;
+    readonly topos: StandingTopos;
+}
+export type ToposResolver = (digest: string) => StandingTopos;
+/** Resolve content using the instrument wire's admitted digest algorithms. No transport interpretation. */
+export declare function toposAt(digest: string): StandingTopos;
+export declare function contentAt(digest: string): Uint8Array;
+/** A declared JS context offer uses this host adapter only after selection; execution is not selection. */
+export declare function contextModuleAt(digest: string): string;
+/** Selection verifies the standing and its directly declared closure. It does not request any capability. */
+export declare function selectedTopoi(pins: readonly string[], resolve?: ToposResolver): readonly SelectedTopos[];
+/** Read a declared wire list without copying a world's claims or executing its offers.
+ * Independent declarations must agree; selection order cannot choose a contract.
+ */
+export declare function selectedWireList(local: readonly string[], epoch: number, pins: readonly string[], list: string, resolve?: ToposResolver): readonly string[];

package/dist/host/selected-topos.js

@@ -0,0 +1,61 @@
+import { createHash } from 'node:crypto';
+import { readStanding } from '@lapxo/topos/standing';
+import { parse, wireAt } from '@lapxo/topos/wire';
+import { fieldOf } from "../fold/claims.js";
+import { blobAt } from "../land/ledger.js";
+import { observeFile } from "../observe/files.js";
+import { ownStore, ownLock } from "../observe/runner.js";
+import { replaceWhole } from "../land/ledger.js";
+import { join } from 'node:path';
+/** Resolve content using the instrument wire's admitted digest algorithms. No transport interpretation. */
+export function toposAt(digest) {
+    const topos = readStanding(Buffer.from(contentAt(digest)).toString('utf8'));
+    for (const dependency of topos.dependencies)
+        contentAt(dependency);
+    return topos;
+}
+export function contentAt(digest) {
+    const fields = ownLock().flatMap(line => { const got = parse(line); return got.kind === 'fact' ? [got.value.fields] : []; });
+    const wire = wireAt(fields, Number.MAX_SAFE_INTEGER);
+    if (wire === null)
+        throw Error('REFUSE·pin instrument has no admitted wire');
+    const algorithms = wire.digests;
+    const bytesAt = (name) => {
+        const split = name.indexOf(':');
+        const algorithm = name.slice(0, split), hex = name.slice(split + 1);
+        if (split < 1 || !algorithms.has(algorithm) || !/^[a-f0-9]+$/.test(hex))
+            throw Error(`REFUSE·pin ${name} digest is not admitted`);
+        const bytes = observeFile(blobAt(ownStore(), name));
+        if (bytes === undefined)
+            throw Error(`REFUSE·pin ${name} content unavailable · not laid`);
+        if (createHash(algorithm).update(bytes).digest('hex') !== hex)
+            throw Error(`REFUSE·pin ${name} content hash mismatch · not laid`);
+        return bytes;
+    };
+    return bytesAt(digest);
+}
+/** A declared JS context offer uses this host adapter only after selection; execution is not selection. */
+export function contextModuleAt(digest) {
+    const bytes = contentAt(digest);
+    const at = join(ownStore(), 'cas', 'runtime', digest.replace(':', '_') + '.mjs');
+    replaceWhole(at, bytes);
+    return at;
+}
+/** Selection verifies the standing and its directly declared closure. It does not request any capability. */
+export function selectedTopoi(pins, resolve = toposAt) {
+    return [...new Set(pins.map(pin => fieldOf(pin, 'value')))].map(digest => ({ digest, topos: resolve(digest) }));
+}
+/** Read a declared wire list without copying a world's claims or executing its offers.
+ * Independent declarations must agree; selection order cannot choose a contract.
+ */
+export function selectedWireList(local, epoch, pins, list, resolve = toposAt) {
+    const records = local.flatMap(line => { const got = parse(line); return got.kind === 'fact' ? [got.value.fields] : []; });
+    const contracts = [{ name: 'place', wire: wireAt(records, epoch) }, ...selectedTopoi(pins, resolve).map(({ digest, topos }) => ({ name: digest, wire: wireAt(topos.parts, Number.MAX_SAFE_INTEGER) }))]
+        .flatMap(({ name, wire }) => { const words = wire?.lists.get(list); return words === undefined ? [] : [{ name, words: [...words] }]; });
+    if (!contracts.length)
+        throw Error(`REFUSE·wire wire/${list} has no declared contract in the place or its selected topoi`);
+    const first = contracts[0];
+    if (contracts.some(({ words }) => words.length !== first.words.length || words.some(word => !first.words.includes(word))))
+        throw Error(`REFUSE·wire wire/${list} has conflicting contracts · ${contracts.map(one => one.name).join(' · ')}`);
+    return first.words;
+}

package/dist/host/source-content.d.ts

@@ -0,0 +1,10 @@
+export interface ContentPort {
+    readonly algorithms: ReadonlySet<string>;
+    readonly read: (digest: string) => Uint8Array | undefined;
+    readonly write: (digest: string, bytes: Uint8Array) => void;
+    readonly fetch: (url: string) => Promise<Uint8Array>;
+}
+/** Transport uses declared locations; only the requested digest admits bytes into the cache. */
+export declare function resolveSelectedContent(lines: readonly string[], port: ContentPort): Promise<readonly string[]>;
+/** Exact resource URLs; no repository checkout or inferred release. */
+export declare function resolveSources(standing: readonly string[]): Promise<void>;

package/dist/host/source-content.js

@@ -0,0 +1,94 @@
+import { createHash } from 'node:crypto';
+import { readStanding } from '@lapxo/topos/standing';
+import { parse, wireAt } from '@lapxo/topos/wire';
+import { blobAt, landBlob } from "../land/ledger.js";
+import { observeFile } from "../observe/files.js";
+import { ownLock, ownStore } from "../observe/runner.js";
+/** Transport uses declared locations; only the requested digest admits bytes into the cache. */
+export async function resolveSelectedContent(lines, port) {
+    const fields = lines.flatMap(line => { const p = parse(line); return p.kind === 'fact' && p.value.fields.value !== 'withdraw' ? [p.value.fields] : []; });
+    const selectionIndex = (scope) => { const match = /(^|\/)uses\//.exec(scope); return match === null ? -1 : match.index + match[1].length; };
+    const bindings = fields.filter(f => selectionIndex(f.scope ?? '') >= 0 || f.scope?.startsWith('dep/'));
+    const locations = new Map();
+    for (const binding of bindings) {
+        const scope = binding.scope ?? '';
+        const index = selectionIndex(scope);
+        const sourceScope = index >= 0 ? scope.slice(0, index) + 'sources/' + scope.slice(index + 5) : 'sources/' + scope.slice(4);
+        const urls = fields.filter(f => f.scope === sourceScope).map(f => f.value ?? '');
+        if (urls.length)
+            locations.set(binding.value ?? '', [...new Set([...(locations.get(binding.value ?? '') ?? []), ...urls])]);
+    }
+    const roots = [...new Set(bindings.filter(f => selectionIndex(f.scope ?? '') >= 0).map(f => f.value ?? ''))];
+    const received = [];
+    const validate = (digest) => {
+        const split = digest.indexOf(':');
+        const algorithm = digest.slice(0, split), hex = digest.slice(split + 1);
+        if (split < 1 || !port.algorithms.has(algorithm) || !/^[a-f0-9]+$/.test(hex))
+            throw Error(`REFUSE·pin ${digest} digest is not admitted`);
+        return { algorithm, hex };
+    };
+    // Refuse malformed declared selections before materializing any dependency.
+    for (const binding of bindings)
+        validate(binding.value ?? '');
+    const ensure = async (digest) => {
+        const { algorithm, hex } = validate(digest);
+        const verify = (bytes) => {
+            if (createHash(algorithm).update(bytes).digest('hex') !== hex)
+                throw Error(`REFUSE·pin ${digest} content hash mismatch · not laid`);
+            return bytes;
+        };
+        const cached = port.read(digest);
+        if (cached !== undefined)
+            return verify(cached);
+        const urls = locations.get(digest) ?? [];
+        if (!urls.length)
+            throw Error(`REFUSE·pin ${digest} content unavailable · no declared source · not laid`);
+        let last;
+        for (const url of urls) {
+            const parsed = new URL(url);
+            if (!['https:', 'http:'].includes(parsed.protocol))
+                throw Error(`REFUSE·source ${url} needs an explicit transport adapter`);
+            let bytes;
+            try {
+                bytes = await port.fetch(url);
+            }
+            catch (error) {
+                last = error;
+                continue;
+            }
+            verify(bytes);
+            port.write(digest, bytes);
+            received.push(digest);
+            return bytes;
+        }
+        throw Error(`REFUSE·source ${digest} ${last instanceof Error ? last.message : 'declared sources unavailable'}`);
+    };
+    for (const digest of new Set(bindings.filter(f => f.scope?.startsWith('dep/') && f.role === 'reads').map(f => f.value ?? '')))
+        await ensure(digest);
+    for (const digest of roots) {
+        const topos = readStanding(Buffer.from(await ensure(digest)).toString('utf8'));
+        for (const dependency of topos.dependencies)
+            await ensure(dependency);
+    }
+    return received;
+}
+/** Exact resource URLs; no repository checkout or inferred release. */
+export async function resolveSources(standing) {
+    const instrument = ownLock().flatMap(line => { const p = parse(line); return p.kind === 'fact' ? [p.value.fields] : []; });
+    const wire = wireAt(instrument, Number.MAX_SAFE_INTEGER);
+    if (wire === null)
+        throw Error('REFUSE·pin instrument has no admitted wire');
+    const received = await resolveSelectedContent([...standing, ...ownLock().filter(line => { const p = parse(line); return p.kind === 'fact' && (p.value.fields.scope?.startsWith('dep/') || p.value.fields.scope?.startsWith('sources/')); })], {
+        algorithms: wire.digests,
+        read: digest => observeFile(blobAt(ownStore(), digest)),
+        write: (digest, bytes) => { landBlob(ownStore(), digest, bytes); },
+        fetch: async (url) => {
+            const response = await fetch(url, { signal: AbortSignal.timeout(30000) });
+            if (!response.ok)
+                throw Error(`HTTP ${response.status}`);
+            return new Uint8Array(await response.arrayBuffer());
+        },
+    });
+    for (const digest of received)
+        process.stdout.write(`FETCHED  ${digest} · verified\n`);
+}

package/dist/host/timing.d.ts

@@ -0,0 +1,2 @@
+/** Record completed synchronous host work without changing its result or refusal. */
+export declare const timing: (spent: string[]) => <T>(what: string, fn: () => T) => T;

package/dist/host/timing.js

@@ -0,0 +1,7 @@
+/** Record completed synchronous host work without changing its result or refusal. */
+export const timing = (spent) => (what, fn) => {
+    const at = Date.now();
+    const got = fn();
+    spent.push(`${what} ${Date.now() - at}`);
+    return got;
+};

package/dist/judge/late.d.ts

@@ -0,0 +1,7 @@
+/**
+ * A demand that landed after its coordinates. A take judges what moved, because it assumes the demand came first and the
+ * tree after it; a demand that arrives second has nothing left to move — its cone is already in the ledger, every coordinate
+ * of it vouched at a digest. Judging that is reading, not observing, so it is answered where it lands and no file is
+ * touched to force it. A demand whose cone holds no vouched coordinate is not late, it is unlanded, and it waits for a take.
+ */
+export declare function lateFacts(store: string, signed: readonly string[], answered: ReadonlySet<string>): readonly string[];

package/dist/judge/late.js

@@ -0,0 +1,33 @@
+import { canonical } from '@lapxo/topos/wire';
+import { fieldOf } from "../fold/claims.js";
+import { fullDigest } from "../fold/digests.js";
+import { inside, locationsOf, vouchedCoordinates } from "../land/vouched.js";
+import { wordOf } from "../fold/wire.js";
+import { holdsCases } from "../fold/paid.js";
+/**
+ * A demand that landed after its coordinates. A take judges what moved, because it assumes the demand came first and the
+ * tree after it; a demand that arrives second has nothing left to move — its cone is already in the ledger, every coordinate
+ * of it vouched at a digest. Judging that is reading, not observing, so it is answered where it lands and no file is
+ * touched to force it. A demand whose cone holds no vouched coordinate is not late, it is unlanded, and it waits for a take.
+ */
+export function lateFacts(store, signed, answered) {
+    const vouched = [...vouchedCoordinates(store)];
+    const views = `${wordOf(signed, 'families', 'view')}/`;
+    const out = [];
+    for (const line of signed) {
+        const scope = fieldOf(line, 'scope');
+        const value = fieldOf(line, 'value') || 'present';
+        if (fieldOf(line, 'role') !== 'demands' || value === 'withdraw' || answered.has(scope))
+            continue;
+        const asked = locationsOf(fieldOf(line, 'needs')).locations;
+        if (!asked.length || (!scope.startsWith(views) && !asked.some(holdsCases)))
+            continue;
+        const cone = asked.map((where) => vouched.filter(([coordinate]) => inside(coordinate, where)));
+        if (cone.some((held) => !held.length))
+            continue;
+        const held = cone.flat();
+        const at = `cone:${fullDigest(store, held.map(([coordinate, digest]) => `${coordinate} ${digest}`).sort()).replace(/^sha256:/, '')}`;
+        out.push(canonical({ scope, role: 'writes', form: 'alphabet', measure: fieldOf(line, 'measure') || 'status', value, by: 'judge', at }), canonical({ scope, role: 'writes', form: 'alphabet', measure: 'cone', value: held.map(([coordinate]) => coordinate).join('|'), by: 'judge', at }));
+    }
+    return out;
+}

package/dist/judge/take.d.ts

@@ -0,0 +1,57 @@
+export interface Gate {
+    readonly kind: string;
+    readonly status: 'green' | 'red';
+    readonly ms: number;
+    readonly at: string;
+    readonly admitted: boolean;
+    readonly why: string;
+}
+interface Effect {
+    readonly kind: string;
+    readonly status: 'green' | 'red';
+    readonly ms: number;
+    readonly at: string;
+    readonly admitted: boolean;
+}
+/** E: the demand, its cone, the coordinates before and after by digest, and the effects that ran over the cone; an effect the ledger has never seen green answers for nothing yet: it runs, it lands, and it refuses nothing. */
+interface Envelope {
+    readonly scope: string;
+    readonly cone: readonly string[];
+    readonly before: Readonly<Record<string, string>>;
+    readonly after: Readonly<Record<string, string>>;
+    readonly effects: readonly Effect[];
+}
+type Verdict = {
+    readonly kind: 'fact';
+    readonly why: string;
+    readonly envelope: Envelope;
+    readonly digest: string;
+    readonly changed: readonly string[];
+} | {
+    readonly kind: 'refuse';
+    readonly why: string;
+    readonly envelope: Envelope;
+    readonly digest: string;
+    readonly changed: readonly string[];
+};
+export declare function judgeTake(input: {
+    readonly root: string;
+    readonly scope: string;
+    readonly value: string;
+    readonly locations: readonly string[];
+    readonly before: ReadonlyMap<string, string>;
+    readonly after: ReadonlyMap<string, string>;
+    readonly law?: readonly string[];
+    readonly template: string;
+    readonly shape?: string;
+    readonly restsOn?: string;
+    readonly witnessOf?: (coordinate: string) => string | undefined;
+}): Verdict & {
+    readonly notOwned: readonly string[];
+};
+/** A take that met its cone carries the gates its batch passed: their runs join its envelope, and its receipt is sealed with them. */
+export declare function sealed<V extends {
+    readonly envelope: Envelope;
+    readonly digest: string;
+}>(root: string, verdict: V, gates: readonly Gate[]): V;
+export {};