@lapxo/bound 0.1.0

package/docs/usage.md

@@ -0,0 +1,53 @@
+# Using Bound
+
+This guide covers the current CLI in a place whose wire and authority are already admitted. A fresh unsigned TARGET is a proposal, not a trusted project. The prepared repository is not yet a certified empty-clone bootstrap.
+
+## Before the first fold
+
+You need the team's accepted TARGET and trust context, authentic bytes for each selected digest, and the readers/views that TARGET names. Do not borrow a neighbouring repository's ledger or copy node_modules to make a missing pin look available.
+
+The published repository carries exactly TARGET.bound and receipts.bound as bound files. Local admission history lives in the ignored .bound/ store. Published standing excludes the signature envelope; owner public keys retain their signatures.
+
+Start by asking for help and folding the project. If a selected view is unavailable, use the named refusal and its fix; do not invent an output with a similar name.
+
+## Keys and coverage
+
+Use a named key already admitted by the project. The authority contract declares its public key, class and scope coverage. The private key is a matching PKCS8 PEM file outside the repository. Point `--key-file` at that file and `--key` at the admitted identifier.
+
+A new device must have its public key and coverage admitted by an authority that already covers the intended scope. The CLI does not currently certify silent key creation or tap-to-sign. This guide does not substitute a self-authorized fixture key for the team's authority.
+
+For automation, supply the private key through the runner's secret storage to a temporary external file with restricted permissions. Do not print, commit or upload it. A source-control token and a Bound authority key have different purposes. Key rotation and revocation are changes to the admitted authority contract, not edits that erase prior signatures.
+
+## Proposal → signature → admission → reading
+
+Prepare the proposed lines outside the repository. Each line must use the current wire's fields, forms and required set. Configuration retains its legacy required fields, including `at`. Typed cells, claims and marks use their exact row grammar; `role=reads` or `at` cannot repair an incomplete typed record.
+
+A proposal names `by=target` and omits epoch/signature. The CLI assigns epoch from admitted history when signing. Never copy an epoch from an example or change a signed line's body.
+
+Use the signing and admission transaction in the README. Shell `&&` prevents a failed sign from being followed by land. Successful signing alone does not mean admission. Successful admission alone does not mean every requirement is paid. Fold after land and inspect its states, receipts and exit status.
+
+CLI sign authenticates wire inscriptions. It is different from the object's travelling ceiling sign. The selected Topos decodes spans and supplies origin/witness context; Bound must not guess those from by, widens or a path.
+
+## Reading and withdrawing
+
+Ask only for a view admitted by the project, such as cells. A local join widens that cell with a witness; it leaves the travelling ceiling live. A travelling require supplies a floor. Claims carry distinct origins; their signatures do not by themselves establish independent origins.
+
+For typed histories, a negative record names the exact id in takes. Withdrawing a claim removes that live observation; withdrawing a join removes that local widening, not the sign. A fresh claim with the same content is a new identity, not resurrection of a withdrawn id. Re-delivery of the same signed bytes is idempotent.
+
+For configuration, the negative line preserves the exact non-envelope selectors and changes value to withdraw. Do not withdraw and replace identical selectors in the same batch. Use a new epoch when superseding an alphabet declaration. Never withdraw evidence merely to obtain a green verdict.
+
+## Receipts and refusals
+
+receipts.bound is native fold output. Do not write it by hand, use JSON from a test as a receipt, or copy receipts from another tree. Unchanged inputs can reuse verified region receipts; missing bytes require recomputation or a refusal. A duplicate receipt does not create another origin.
+
+REFUSE·wire means the current grammar does not admit the record. REFUSE·pin/release means named authentic content or its closure is unavailable or does not match. REFUSE·view means the requested view cannot be rendered under its contract. Authority refusal means the signer is not covered. Keep the line and the failed exit status; follow an explicit fix without changing the named digest or dropping a conflicting statement.
+
+release/blocks is policy read by the fold. The existing policy is incomplete because it has no admitted category links. An incomplete policy is not READY and is not permission to fabricate selectors.
+
+## Repository and PR review
+
+The accepted TARGET is independent of a contributor's scan. Commit native receipts and admitted renders, not local .bound/ state. A page disagreeing with TARGET must be re-rendered; a ceiling is not lowered to fit the page.
+
+A contribution is a proposed lot with the leaf changes rendered from it. Send that lot for admission by the team's coverage. Do not submit hand-edited lock output as already accepted. Check secrets, extra bound files, foreign vendoring and uncaptured page claims before review.
+
+A review includes the product fold, meaningful suites and verification of the rendered bytes. Preserve their actual output and exit status.

package/package.json

@@ -0,0 +1,48 @@
+{
+  "name": "@lapxo/bound",
+  "version": "0.1.0",
+  "type": "module",
+  "description": "Read the bounds you already wrote, fold them, and name the contradictions.",
+  "main": "dist/cli/verb.js",
+  "types": "dist/cli/verb.d.ts",
+  "exports": {
+    ".": {
+      "types": "./dist/cli/verb.d.ts",
+      "default": "./dist/cli/verb.js"
+    },
+    "./package.json": "./package.json"
+  },
+  "scripts": {
+    "test": "node --import ./test/setup.ts --test test/*.test.ts",
+    "clean": "rm -rf dist .tsbuildinfo* tsconfig.tsbuildinfo",
+    "build": "node tools/build.mjs",
+    "prepack": "npm run build"
+  },
+  "files": [
+    "LICENSE",
+    "README.md",
+    "CONTRIBUTING.md",
+    "dist/**/*",
+    "TARGET.bound",
+    "receipts.bound",
+    "docs/usage.md",
+    "docs/readme-assets/atlas.svg"
+  ],
+  "author": "Lapxo",
+  "license": "MIT",
+  "dependencies": {
+    "@lapxo/obligations": "0.3.5",
+    "@lapxo/topos": "0.1.7"
+  },
+  "devDependencies": {
+    "@types/node": "^20.0.0",
+    "typescript": "^5.0.0"
+  },
+  "sideEffects": false,
+  "engines": {
+    "node": ">=22.15"
+  },
+  "bin": {
+    "bound": "./dist/cli/verb.js"
+  }
+}

package/receipts.bound

@@ -0,0 +1,59 @@
+bound-lock/1 at=place:sha256:5b992d51db7b5a0fa1109ad3286a346ad024e31fa5f5aa67819698db86e06e34 by=reader:bbff6b8fc616 form=alphabet measure=observed role=writes scope=./ value=5b992d51db7b5a0f
+bound-lock/1 at=place:sha256:5b992d51db7b5a0fa1109ad3286a346ad024e31fa5f5aa67819698db86e06e34 by=reader:c448c64e0bac form=alphabet measure=observed role=writes scope=./ value=5b992d51db7b5a0f
+bound-lock/1 at=place:sha256:98c2c50b1adf553235dabd55a808b78518dc0d1465c7e0fdbabdc69d73bd56c1 by=reader:2c507e7fe764 form=alphabet measure=observed role=writes scope=./ value=98c2c50b1adf5532
+bound-lock/1 at=place:sha256:f1e4c278d0e13d0524a44579172a98d05afa08a7aa3bc86e39b7b254ff1cd35d by=reader:0f5306d0e183 form=alphabet measure=observed role=writes scope=./ value=f1e4c278d0e13d05
+bound-lock/1 at=place:sha256:5b992d51db7b5a0fa1109ad3286a346ad024e31fa5f5aa67819698db86e06e34 by=reader:bbff6b8fc616 form=alphabet measure=text role=reads scope=capture/help value="bound: verbs fold land sign · flags --as --check --key --key-file --out --place\n"
+bound-lock/1 at=place:sha256:5b992d51db7b5a0fa1109ad3286a346ad024e31fa5f5aa67819698db86e06e34 by=reader:bbff6b8fc616 form=alphabet measure=text role=reads scope=capture/meeting value="INPUT [[\"Ana\",10,14],[\"Luis\",12,16],[\"room\",10,13],[\"boss\",18,20]]\nMEET {\"lo\":12,\"hi\":13}\nCONFLICT boss\nWITHDRAW boss {\"lo\":12,\"hi\":13}\n"
+bound-lock/1 at=place:sha256:5b992d51db7b5a0fa1109ad3286a346ad024e31fa5f5aa67819698db86e06e34 by=reader:c448c64e0bac form=interval measure=cli-exit-closed role=reads scope=cli/exit/closed value=0..0
+bound-lock/1 at=place:sha256:5b992d51db7b5a0fa1109ad3286a346ad024e31fa5f5aa67819698db86e06e34 by=reader:c448c64e0bac form=interval measure=cli-exit-refuse role=reads scope=cli/exit/refuse value=1..1
+bound-lock/1 at=place:sha256:5b992d51db7b5a0fa1109ad3286a346ad024e31fa5f5aa67819698db86e06e34 by=reader:c448c64e0bac form=interval measure=cli-exit-usage role=reads scope=cli/exit/usage value=2..2
+bound-lock/1 at=place:sha256:5b992d51db7b5a0fa1109ad3286a346ad024e31fa5f5aa67819698db86e06e34 by=reader:c448c64e0bac form=interval measure=cli-flags role=reads scope=cli/flags value=6..6
+bound-lock/1 at=place:sha256:5b992d51db7b5a0fa1109ad3286a346ad024e31fa5f5aa67819698db86e06e34 by=reader:c448c64e0bac form=interval measure=count role=reads scope=idempotent value=0..0
+bound-lock/1 at=place:sha256:5b992d51db7b5a0fa1109ad3286a346ad024e31fa5f5aa67819698db86e06e34 by=reader:c448c64e0bac form=interval measure=count role=reads scope=nothing-deleted value=0..0
+bound-lock/1 at=place:sha256:5b992d51db7b5a0fa1109ad3286a346ad024e31fa5f5aa67819698db86e06e34 by=reader:c448c64e0bac form=interval measure=count role=reads scope=offline value=0..0
+bound-lock/1 at=place:sha256:5b992d51db7b5a0fa1109ad3286a346ad024e31fa5f5aa67819698db86e06e34 by=reader:c448c64e0bac form=interval measure=count role=reads scope=one-writer value=0..0
+bound-lock/1 at=place:sha256:5b992d51db7b5a0fa1109ad3286a346ad024e31fa5f5aa67819698db86e06e34 by=reader:c448c64e0bac form=interval measure=count role=reads scope=resolve-by-url value=0..0
+bound-lock/1 at=place:sha256:5b992d51db7b5a0fa1109ad3286a346ad024e31fa5f5aa67819698db86e06e34 by=reader:c448c64e0bac form=interval measure=count role=reads scope=the-stranger value=0..0
+bound-lock/1 at=place:sha256:98c2c50b1adf553235dabd55a808b78518dc0d1465c7e0fdbabdc69d73bd56c1 by=reader:2c507e7fe764 form=interval measure=unreceipted role=reads scope=door/unreceipted value=0..0
+bound-lock/1 at=place:sha256:f1e4c278d0e13d0524a44579172a98d05afa08a7aa3bc86e39b7b254ff1cd35d by=reader:0f5306d0e183 form=alphabet measure=id role=reads scope=source/locations/duplicate/src value=none
+bound-lock/1 at=place:sha256:f1e4c278d0e13d0524a44579172a98d05afa08a7aa3bc86e39b7b254ff1cd35d by=reader:0f5306d0e183 form=alphabet measure=id role=reads scope=source/locations/literal/host value=none
+bound-lock/1 at=place:sha256:f1e4c278d0e13d0524a44579172a98d05afa08a7aa3bc86e39b7b254ff1cd35d by=reader:0f5306d0e183 form=alphabet measure=id role=reads scope=source/locations/literal/key value=none
+bound-lock/1 at=place:sha256:f1e4c278d0e13d0524a44579172a98d05afa08a7aa3bc86e39b7b254ff1cd35d by=reader:0f5306d0e183 form=alphabet measure=id role=reads scope=source/locations/literal/org value=none
+bound-lock/1 at=place:sha256:f1e4c278d0e13d0524a44579172a98d05afa08a7aa3bc86e39b7b254ff1cd35d by=reader:0f5306d0e183 form=alphabet measure=id role=reads scope=source/locations/literal/path value=none
+bound-lock/1 at=place:sha256:f1e4c278d0e13d0524a44579172a98d05afa08a7aa3bc86e39b7b254ff1cd35d by=reader:0f5306d0e183 form=interval measure=count role=reads scope=literal/host value=0..0
+bound-lock/1 at=place:sha256:f1e4c278d0e13d0524a44579172a98d05afa08a7aa3bc86e39b7b254ff1cd35d by=reader:0f5306d0e183 form=interval measure=count role=reads scope=literal/key value=0..0
+bound-lock/1 at=place:sha256:f1e4c278d0e13d0524a44579172a98d05afa08a7aa3bc86e39b7b254ff1cd35d by=reader:0f5306d0e183 form=interval measure=count role=reads scope=literal/org value=0..0
+bound-lock/1 at=place:sha256:f1e4c278d0e13d0524a44579172a98d05afa08a7aa3bc86e39b7b254ff1cd35d by=reader:0f5306d0e183 form=interval measure=count role=reads scope=literal/path value=0..0
+bound-lock/1 at=place:sha256:f1e4c278d0e13d0524a44579172a98d05afa08a7aa3bc86e39b7b254ff1cd35d by=reader:0f5306d0e183 form=interval measure=duplicate-bodies role=reads scope=duplicate/src value=0..0
+bound-lock/1 at=place:sha256:c79ca8df7075ce8184e5c142b8736c3d8d71206340f2fe7256c28f47f5b2f5a2 by=bound form=alphabet measure=digest role=writes scope=instrument/implementation value=sha256:c79ca8df7075ce8184e5c142b8736c3d8d71206340f2fe7256c28f47f5b2f5a2
+
+bound-lock/1 at=place:sha256:b69abaed2f8fd7ffe47440d07772cea4deda0aeb15510dc17e82fc3c17c7a2d5 by=bound form=alphabet measure=digest role=writes scope=receipts value=sha256:d49abf8330de0c773dabb9b576bcf3c964092b49bcb3a4e3b63fffe7623a417e
+
+bound-lock/1 at=place:sha256:163a61fad086853b97bc7f015450b77fb0af4ae9def3b017afdf1eb723b0f5ec by=bound form=interval measure=count role=writes scope=receipts/. value=3..3
+bound-lock/1 at=place:sha256:3c4f8985bdc904206591218e06d583b809383f72675ca89b12b56c0d2402de16 by=bound form=alphabet measure=bytes role=writes scope=receipts/. value=sha256:3c4f8985bdc904206591218e06d583b809383f72675ca89b12b56c0d2402de16
+bound-lock/1 at=place:sha256:a58ed17b0bd1fbc66b0e5d9e944a3962554504ce5662b96aaf2aa57a01702103 by=bound form=interval measure=count role=writes scope=receipts/capture value=2..2
+bound-lock/1 at=place:sha256:754d29b44755bdf832af5d16f8a5edf1f25469ec0baa6c67ab77b88ed7a9857e by=bound form=alphabet measure=bytes role=writes scope=receipts/capture value=sha256:754d29b44755bdf832af5d16f8a5edf1f25469ec0baa6c67ab77b88ed7a9857e
+bound-lock/1 at=place:sha256:7a94b284b78622a8266d3184c05bd1ef0ae05875aae91cb82be63d9d4c444837 by=bound form=interval measure=count role=writes scope=receipts/cli value=4..4
+bound-lock/1 at=place:sha256:754d29b44755bdf832af5d16f8a5edf1f25469ec0baa6c67ab77b88ed7a9857e by=bound form=alphabet measure=bytes role=writes scope=receipts/cli value=sha256:754d29b44755bdf832af5d16f8a5edf1f25469ec0baa6c67ab77b88ed7a9857e
+bound-lock/1 at=place:sha256:57889257661e4363f6230eabd865d4b20031b010bc744f136f26bfc7f885b7cd by=bound form=interval measure=count role=writes scope=receipts/door value=1..1
+bound-lock/1 at=place:sha256:754d29b44755bdf832af5d16f8a5edf1f25469ec0baa6c67ab77b88ed7a9857e by=bound form=alphabet measure=bytes role=writes scope=receipts/door value=sha256:754d29b44755bdf832af5d16f8a5edf1f25469ec0baa6c67ab77b88ed7a9857e
+bound-lock/1 at=place:sha256:92e39ad2038863fddac360186d7ec3a8d8326b681f1f456a69fcbd8365b77f42 by=bound form=interval measure=count role=writes scope=receipts/duplicate value=1..1
+bound-lock/1 at=place:sha256:754d29b44755bdf832af5d16f8a5edf1f25469ec0baa6c67ab77b88ed7a9857e by=bound form=alphabet measure=bytes role=writes scope=receipts/duplicate value=sha256:754d29b44755bdf832af5d16f8a5edf1f25469ec0baa6c67ab77b88ed7a9857e
+bound-lock/1 at=place:sha256:92a934dc6b14f970a00946db53d0ccd355bf602d283e994fe0619217d6d6efd7 by=bound form=interval measure=count role=writes scope=receipts/idempotent value=1..1
+bound-lock/1 at=place:sha256:754d29b44755bdf832af5d16f8a5edf1f25469ec0baa6c67ab77b88ed7a9857e by=bound form=alphabet measure=bytes role=writes scope=receipts/idempotent value=sha256:754d29b44755bdf832af5d16f8a5edf1f25469ec0baa6c67ab77b88ed7a9857e
+bound-lock/1 at=place:sha256:c6ac0b874a67119868119a991d6f35053815e3090e81f6fd62d823b3c614b903 by=bound form=interval measure=count role=writes scope=receipts/instrument value=1..1
+bound-lock/1 at=place:sha256:754d29b44755bdf832af5d16f8a5edf1f25469ec0baa6c67ab77b88ed7a9857e by=bound form=alphabet measure=bytes role=writes scope=receipts/instrument value=sha256:754d29b44755bdf832af5d16f8a5edf1f25469ec0baa6c67ab77b88ed7a9857e
+bound-lock/1 at=place:sha256:8ee3da4501d16a7c00df3f6e75d6961b669404d710be9e3746e327f884c1b4c2 by=bound form=interval measure=count role=writes scope=receipts/literal value=4..4
+bound-lock/1 at=place:sha256:754d29b44755bdf832af5d16f8a5edf1f25469ec0baa6c67ab77b88ed7a9857e by=bound form=alphabet measure=bytes role=writes scope=receipts/literal value=sha256:754d29b44755bdf832af5d16f8a5edf1f25469ec0baa6c67ab77b88ed7a9857e
+bound-lock/1 at=place:sha256:68a26b7f40f75c01ddb2d81a0a083118149271a50b60d04f897c352213cdba99 by=bound form=interval measure=count role=writes scope=receipts/nothing-deleted value=1..1
+bound-lock/1 at=place:sha256:754d29b44755bdf832af5d16f8a5edf1f25469ec0baa6c67ab77b88ed7a9857e by=bound form=alphabet measure=bytes role=writes scope=receipts/nothing-deleted value=sha256:754d29b44755bdf832af5d16f8a5edf1f25469ec0baa6c67ab77b88ed7a9857e
+bound-lock/1 at=place:sha256:7e9968645901416b748ce76613be1e831235db8a9a42f73cfb4589383c21da35 by=bound form=interval measure=count role=writes scope=receipts/offline value=1..1
+bound-lock/1 at=place:sha256:754d29b44755bdf832af5d16f8a5edf1f25469ec0baa6c67ab77b88ed7a9857e by=bound form=alphabet measure=bytes role=writes scope=receipts/offline value=sha256:754d29b44755bdf832af5d16f8a5edf1f25469ec0baa6c67ab77b88ed7a9857e
+bound-lock/1 at=place:sha256:9cbca4de8b7fe581e061672efc9bc4c6dd7ea4858ef29d7ee6a8f797e85f414e by=bound form=interval measure=count role=writes scope=receipts/one-writer value=1..1
+bound-lock/1 at=place:sha256:754d29b44755bdf832af5d16f8a5edf1f25469ec0baa6c67ab77b88ed7a9857e by=bound form=alphabet measure=bytes role=writes scope=receipts/one-writer value=sha256:754d29b44755bdf832af5d16f8a5edf1f25469ec0baa6c67ab77b88ed7a9857e
+bound-lock/1 at=place:sha256:75627fbb29f2e386b6e283de4f9dbeff43919f11b040a03ce1e41a4b22f68792 by=bound form=interval measure=count role=writes scope=receipts/resolve-by-url value=1..1
+bound-lock/1 at=place:sha256:754d29b44755bdf832af5d16f8a5edf1f25469ec0baa6c67ab77b88ed7a9857e by=bound form=alphabet measure=bytes role=writes scope=receipts/resolve-by-url value=sha256:754d29b44755bdf832af5d16f8a5edf1f25469ec0baa6c67ab77b88ed7a9857e
+bound-lock/1 at=place:sha256:169485811afaaae5f9fe796d0893199fe9ee1a06059b9baa18f0cc0724d7fd35 by=bound form=interval measure=count role=writes scope=receipts/source value=5..5
+bound-lock/1 at=place:sha256:754d29b44755bdf832af5d16f8a5edf1f25469ec0baa6c67ab77b88ed7a9857e by=bound form=alphabet measure=bytes role=writes scope=receipts/source value=sha256:754d29b44755bdf832af5d16f8a5edf1f25469ec0baa6c67ab77b88ed7a9857e
+bound-lock/1 at=place:sha256:3a1f97e2c6b1b58959bf30c851c5914dec622e94cf7cb48563bcef650eb04805 by=bound form=interval measure=count role=writes scope=receipts/the-stranger value=1..1
+bound-lock/1 at=place:sha256:754d29b44755bdf832af5d16f8a5edf1f25469ec0baa6c67ab77b88ed7a9857e by=bound form=alphabet measure=bytes role=writes scope=receipts/the-stranger value=sha256:754d29b44755bdf832af5d16f8a5edf1f25469ec0baa6c67ab77b88ed7a9857e