@lapxo/bound 0.1.3 → 0.1.5

package/dist/host/reading-closures.js

@@ -0,0 +1,146 @@
+import { actCosts } from "./act-cost.js";
+import { mkdirSync, readFileSync, existsSync } from 'node:fs';
+import { join, dirname } from 'node:path';
+import { canonical, parse, PROTOCOL, byBytes } from '@lapxo/topos/wire';
+import { replaceWhole, landShard, shardLines } from "../land/ledger.js";
+import { fieldOf } from "../fold/claims.js";
+import { readOnly } from "./read-only.js";
+const fields = (line) => { const got = parse(line); if (got.kind !== 'fact')
+    throw Error('REFUSE·input projection contains a non-wire line'); return got.value.fields; };
+export const inputLines = (files) => files.map(file => canonical({ scope: file.place, form: 'alphabet', measure: 'text', role: 'writes', value: 'lock', shape: file.place, about: file.text, by: 'host', at: 'policy:handed-input' }));
+/** The selected world owns input projection and reading. The host only verifies closures and keeps native count/bytes receipts. */
+export function readingClosures(options) {
+    const { root, store, reader, speaker, digest: hash, capsule, region, projection, files } = options, emit = options.emit ?? (() => { });
+    const algorithm = hash('').split(':')[0], handed = new Map(files.map(file => [file.place, file.text]));
+    if (handed.size !== files.length)
+        throw Error('REFUSE·input projection has duplicate handed coordinates');
+    const verify = () => { for (const file of files)
+        if (!readFileSync(join(root, file.place)).equals(Buffer.from(file.text)))
+            throw Error('REFUSE·input changed ' + file.place); };
+    verify();
+    const projected = capsule.ask([{ protocol: PROTOCOL, verb: 'render', rootScope: '', region: projection, at: 1, reads: ['**'], lines: inputLines(files), files: [] }])[0];
+    if (projected?.kind !== 'fact' || !Array.isArray(projected.lines))
+        throw Error('REFUSE·input projection ' + (projected?.why ?? 'no lines'));
+    const plans = new Map();
+    for (const line of projected.lines) {
+        const f = fields(line), scope = f.scope ?? '', resolution = /^receipt:(\d+)$/.exec(f.at ?? '');
+        if (!scope || plans.has(scope) || f.form !== 'alphabet' || f.measure !== 'reads' || f.role !== 'reads' || !resolution)
+            throw Error('REFUSE·input projection ambiguous reading ' + scope);
+        const inputs = (f.value ?? '').split('|').filter(Boolean), needs = (f.needs ?? '').split('|').filter(Boolean);
+        if (!inputs.length || new Set(inputs).size !== inputs.length || inputs.some(input => !handed.has(input)) || new Set(needs).size !== needs.length)
+            throw Error('REFUSE·input projection has unhanded or duplicate dependencies ' + scope);
+        const n = Number(resolution[1]);
+        if (!Number.isSafeInteger(n))
+            throw Error('REFUSE·input projection invalid resolution ' + scope);
+        plans.set(scope, { scope, inputs, needs, resolution: n, line: canonical({ scope, form: f.form, measure: f.measure, role: f.role, value: inputs.join('|'), needs: needs.join('|'), at: f.at }) });
+    }
+    if (!plans.size)
+        throw Error('REFUSE·input projection returned no readings');
+    const ordered = [], visiting = new Set(), done = new Set();
+    const visit = (scope) => { if (done.has(scope))
+        return; if (visiting.has(scope))
+        throw Error('REFUSE·input projection dependency cycle ' + scope); const p = plans.get(scope); if (!p)
+        throw Error('REFUSE·input projection missing reading ' + scope); visiting.add(scope); for (const need of p.needs)
+        visit(need); visiting.delete(scope); done.add(scope); ordered.push(p); };
+    for (const scope of plans.keys())
+        visit(scope);
+    const identity = hash([capsule.selection ?? '', capsule.digest, region, projection].join('\n')), by = speaker + ':' + identity.split(':')[1].slice(0, 12), journal = 'reading-closures/' + identity.split(':')[1];
+    const prior = shardLines(store, speaker, journal), results = new Map(), out = [];
+    const carried = (digest) => join(store, 'cas', 'carried', digest.split(':')[1] ?? '');
+    const saved = (text) => { const digest = hash(text), path = carried(digest); mkdirSync(dirname(path), { recursive: true }); if (!existsSync(path) || hash(readFileSync(path, 'utf8')) !== digest)
+        replaceWhole(path, text); return digest; };
+    const load = (digest) => { if (!digest.startsWith(algorithm + ':') || !/^[a-f0-9]+$/.test(digest.split(':')[1] ?? ''))
+        return; const path = carried(digest); if (!existsSync(path))
+        return; const text = readFileSync(path, 'utf8'); return hash(text) === digest ? text : undefined; };
+    let read = 0, opened = 0, executed = 0;
+    for (const plan of ordered) {
+        actCosts.measure(() => {
+            const closure = [plan.line, canonical({ scope: 'implementation', role: 'writes', form: 'alphabet', measure: 'digest', value: identity, by: 'host', at: 'policy:input-identity' }), ...plan.inputs.map(input => canonical({ scope: input, role: 'writes', form: 'alphabet', measure: 'digest', value: hash(handed.get(input)), by: 'host', at: 'policy:input-identity' })), ...plan.needs.map(need => canonical({ scope: need, role: 'writes', form: 'alphabet', measure: 'digest', value: results.get(need).digest, by: 'host', at: 'policy:input-identity' }))].sort(byBytes).join('\n') + '\n';
+            const input = hash(closure), scope = 'receipts/readings/' + hash(plan.scope).split(':')[1] + '/' + input.split(':')[1], matching = prior.filter(line => fieldOf(line, 'scope') === scope && fieldOf(line, 'measure') === 'bytes' && fieldOf(line, 'value') === input).at(-1);
+            const count = matching && prior.filter(line => fieldOf(line, 'scope') === scope && fieldOf(line, 'measure') === 'count' && fieldOf(line, 'by') === by).at(-1);
+            const heldOutput = count && load(fieldOf(count, 'at').replace(/^place:/, ''));
+            const heldLines = heldOutput?.split('\n').filter(Boolean);
+            const output = heldLines !== undefined && fieldOf(count, 'value') === `${heldLines.length}..${heldLines.length}` && heldLines.every(line => { const f = fields(line); return f.by === by && f.at === 'place:' + input; }) ? heldOutput : undefined;
+            let lines, payload;
+            if (output !== undefined && load(input) === closure) {
+                if (output === '' && !options.allowsEmpty)
+                    throw Error('REFUSE·reading empty response is not admitted ' + plan.scope);
+                lines = output.split('\n').filter(Boolean);
+                for (const line of lines)
+                    fields(line);
+                payload = fieldOf(count, 'at').replace(/^place:/, '');
+            }
+            else {
+                if (readOnly())
+                    throw Error('REFUSE·preview reading closure is unpaid ' + plan.scope);
+                const started = process.hrtime.bigint();
+                const dependencies = plan.needs.flatMap(need => results.get(need).lines), answer = capsule.ask([{ protocol: PROTOCOL, verb: 'read', rootScope: plan.scope, name: plan.scope, region, at: plan.resolution, reads: ['**'], lines: [...inputLines(plan.inputs.map(place => ({ place, text: handed.get(place) }))), ...dependencies], files: [] }])[0];
+                if (answer?.kind !== 'fact' || !Array.isArray(answer.claims))
+                    throw Error('REFUSE·reading ' + plan.scope + ' · ' + (answer?.why ?? 'no claims'));
+                lines = answer.claims.map((unknown) => { if (typeof unknown?.scope !== 'string' || typeof unknown?.measure !== 'string' || typeof unknown?.role !== 'string' || !unknown.bound || !['interval', 'enumerated'].includes(unknown.bound.kind))
+                    throw Error('REFUSE·reading malformed claim ' + plan.scope); const span = unknown.bound; const text = canonical({ scope: unknown.scope, measure: unknown.measure, role: unknown.role, form: span.kind === 'interval' ? 'interval' : 'alphabet', value: span.kind === 'interval' ? `${span.lo}..${span.hi}` : Array.isArray(span.values) ? span.values.join('|') : '', by, at: 'place:' + input }); fields(text); return text; });
+                if (!lines.length && !options.allowsEmpty)
+                    throw Error('REFUSE·reading empty response is not admitted ' + plan.scope);
+                executed++;
+                verify();
+                payload = saved(lines.length ? [...lines].sort(byBytes).join('\n') + '\n' : '');
+                if (saved(closure) !== input)
+                    throw Error('REFUSE·receipt input closure mismatch');
+                const seconds = (Number(process.hrtime.bigint() - started) / 1e9).toFixed(6);
+                landShard(store, speaker, journal, [canonical({ scope, role: 'writes', form: 'interval', measure: 'count', value: `${lines.length}..${lines.length}`, by, at: 'place:' + payload }), canonical({ scope, role: 'writes', form: 'alphabet', measure: 'bytes', value: input, by, at: 'place:' + input }), canonical({ scope, role: 'writes', form: 'interval', measure: 's', value: seconds + '..' + seconds, by, at: 'place:' + input })]);
+                if (plan.resolution === 1)
+                    opened++;
+            }
+            results.set(plan.scope, { digest: payload, lines });
+            out.push(canonical({ scope: plan.scope, role: 'writes', form: 'alphabet', measure: 'observed', value: input, by, at: 'place:' + input }), ...lines);
+            if (plan.resolution === 1) {
+                read++;
+                const native = shardLines(store, speaker, journal).filter(line => fieldOf(line, 'scope') === scope && ((fieldOf(line, 'measure') === 'bytes' && fieldOf(line, 'value') === input) || (fieldOf(line, 'measure') === 'count') || (fieldOf(line, 'measure') === 's' && fieldOf(line, 'at') === 'place:' + input))).map(line => {
+                    const f = fields(line), id = f.measure === 'bytes' ? f.value : f.measure === 'count' ? (f.at ?? '').replace(/^place:/, '') : undefined;
+                    if (id === undefined)
+                        return line;
+                    const bytes = load(id);
+                    if (bytes === undefined)
+                        throw Error('REFUSE·receipt missing verified carrier ' + id);
+                    // The full-resolution native row carries the actual verified UTF-8 bytes.
+                    // Its semantic count/digest is unchanged; a public copy needs no private CAS.
+                    return canonical({ ...f, about: bytes });
+                });
+                out.push(canonical({ scope, role: 'writes', form: 'alphabet', measure: 'observed', value: payload, by, at: 'place:' + payload }), ...native);
+            }
+        });
+    }
+    verify();
+    emit(`RECEIPTS ${read} read · ${opened} opened · reading closures`);
+    return { lines: out, read, opened, executed };
+}
+/** Verify the native reading carriers before a file seal may reuse them. These are semantic receipts, not file-region seals. */
+export function verifiedReadingReceipts(store, lines, digest) {
+    const units = lines.filter(line => fieldOf(line, 'scope').startsWith('receipts/readings/') && fieldOf(line, 'measure') === 'bytes' && fieldOf(line, 'role') === 'writes');
+    const load = (id, row) => {
+        const hex = id.split(':')[1];
+        if (!hex || !/^[a-f0-9]+$/.test(hex))
+            return;
+        const supplied = fields(row).about;
+        // A supplied carrier must authenticate even if an old local copy still exists.
+        if (supplied !== undefined)
+            return digest(supplied) === id ? supplied : undefined;
+        const path = join(store, 'cas', 'carried', hex);
+        if (!existsSync(path))
+            return;
+        const bytes = readFileSync(path, 'utf8');
+        return digest(bytes) === id ? bytes : undefined;
+    };
+    for (const unit of units) {
+        const input = fieldOf(unit, 'value'), scope = fieldOf(unit, 'scope'), by = fieldOf(unit, 'by'), counts = lines.filter(line => fieldOf(line, 'scope') === scope && fieldOf(line, 'measure') === 'count' && fieldOf(line, 'by') === by && fieldOf(line, 'role') === 'writes');
+        if (counts.length !== 1 || load(input, unit) === undefined)
+            return;
+        const count = counts[0], output = load(fieldOf(count, 'at').replace(/^place:/, ''), count);
+        if (output === undefined)
+            return;
+        const rows = output.split('\n').filter(Boolean);
+        if (fieldOf(count, 'value') !== `${rows.length}..${rows.length}` || rows.some(line => fieldOf(line, 'by') !== by || fieldOf(line, 'at') !== 'place:' + input))
+            return;
+    }
+    return units.length;
+}

package/dist/host/release.js

@@ -48,11 +48,33 @@ function layDir(from, into) {
         writeFileSync(dest, bytes, { flag: 'wx' });
     }
 }
-function swapPlace(place, next, digest) {
+function swapPlace(place, next, digest, ready) {
     const old = `${next}.old`;
     if (lstatSync(old, { throwIfNoEntry: false }) !== undefined)
         throw new Error(`REFUSE·release recovery required for ${old}`);
     writeFileSync(join(next, laidMark), digest, { flag: 'wx' });
+    if (ready !== undefined) {
+        // Digest-addressed trees publish once. A verified concurrent winner is reused,
+        // never moved aside while another process may be importing its members.
+        if (ready()) {
+            rmSync(next, { recursive: true, force: true });
+            return;
+        }
+        try {
+            renameSync(next, place);
+            return;
+        }
+        catch (error) {
+            const code = error.code;
+            if (code !== 'EEXIST' && code !== 'ENOTEMPTY')
+                throw error;
+            if (ready()) {
+                rmSync(next, { recursive: true, force: true });
+                return;
+            }
+            // An existing invalid cache retains the repair/rollback path below.
+        }
+    }
     let moved = false;
     try {
         if (lstatSync(place, { throwIfNoEntry: false }) !== undefined) {
@@ -224,7 +246,7 @@ export function runtimeTreeAt(store, own, digest, contentStore = own, root = '')
     const next = nextPlace(place);
     try {
         layFiles(store, own, files, next);
-        swapPlace(place, next, digest);
+        swapPlace(place, next, digest, () => observeText(join(place, laidMark)) === digest && layoutMatches(place, files));
     }
     catch (error) {
         rmSync(next, { recursive: true, force: true });

package/dist/host/selected-capsules.js

@@ -1,5 +1,7 @@
 import { capsuleAt } from "./capsule.js";
-import { capsuleOffers } from '@lapxo/topos/standing';
+import { capsuleOffers, providerInputs, providerInputRegions, capsuleDescriptor, assertCapsuleDescriptor } from '@lapxo/topos/standing';
+import { fullDigest } from "./digest.js";
+import { wireAt, parse } from '@lapxo/topos/wire';
 import { selectedTopoi, toposAt } from "./selected-topos.js";
 import { canonical } from '@lapxo/topos/wire';
 import { fieldOf } from "../fold/claims.js";
@@ -8,16 +10,40 @@ import { archiveCoordinate } from "./archive.js";
 /** Only explicit capsule offers request execution. Forms/classes/views do not need an executable alias. */
 export function selectedCapsules(pins, resolve = capsuleAt, select = toposAt, host = ownLock()) {
     return selectedTopoi(pins, select).flatMap(({ digest, topos }) => capsuleOffers(topos).map(offer => {
-        const projections = host.filter(line => fieldOf(line, 'scope').startsWith('dep/') && fieldOf(line, 'role') === 'writes' && fieldOf(line, 'value') === offer.value);
-        if (!projections.length || projections.some(line => !fieldOf(line, 'shape')))
-            throw Error(`REFUSE·pin ${digest} capsule ${offer.value} needs one host projection`);
-        const entries = [...new Set(projections.map(line => archiveCoordinate(fieldOf(line, 'shape'))))];
-        if (entries.length !== 1)
-            throw Error(`REFUSE·pin ${digest} capsule ${offer.value} has conflicting host projections`);
-        const projected = { ...offer, shape: entries[0] };
-        const capsule = resolve(offer.value, projected.shape);
-        if (capsule === undefined)
-            throw Error(`REFUSE·pin ${digest} · ${offer.scope} · offered capsule ${offer.value} unavailable`);
-        return { capsule, offer: canonical(projected) };
+        const load = () => {
+            const projections = host.filter(line => fieldOf(line, 'scope').startsWith('dep/') && fieldOf(line, 'role') === 'writes' && fieldOf(line, 'value') === offer.value);
+            if (!projections.length || projections.some(line => !fieldOf(line, 'shape')))
+                throw Error(`REFUSE·pin ${digest} capsule ${offer.value} needs one host projection`);
+            const entries = [...new Set(projections.map(line => archiveCoordinate(fieldOf(line, 'shape'))))];
+            if (entries.length !== 1)
+                throw Error(`REFUSE·pin ${digest} capsule ${offer.value} has conflicting host projections`);
+            const loaded = resolve(offer.value, entries[0]);
+            if (loaded === undefined)
+                throw Error(`REFUSE·pin ${digest} · ${offer.scope} · offered capsule ${offer.value} unavailable`);
+            return { capsule: loaded, offer: canonical({ ...offer, shape: entries[0] }) };
+        };
+        const descriptor = capsuleDescriptor(topos, offer.scope ?? '');
+        const loaded = descriptor === undefined ? load() : undefined;
+        const capsule = loaded?.capsule ?? {
+            digest: offer.value, selection: `${digest} ${offer.scope}`, ...descriptor, ask: requests => {
+                if (!requests.length)
+                    return [];
+                const actual = load();
+                assertCapsuleDescriptor(descriptor.lines, actual.capsule.lines);
+                return actual.capsule.ask(requests);
+            },
+        };
+        const projected = loaded?.offer ?? canonical(offer);
+        if (!providerInputRegions(topos, offer.scope ?? '').length)
+            return { capsule, offer: projected };
+        const fields = ownLock().flatMap(line => { const p = parse(line); return p.kind === 'fact' ? [p.value.fields] : []; });
+        const wire = wireAt(fields, Number.MAX_SAFE_INTEGER), algorithm = wire && [...wire.digests][0];
+        if (!algorithm)
+            throw Error('REFUSE·input instrument has no admitted digest algorithm');
+        const selected = { ...capsule, selection: `${digest} ${offer.scope}`, ask: requests => capsule.ask(requests.map(request => {
+                const provider = providerInputs(topos, digest, offer.scope ?? '', offer.value, request.region ?? '', bytes => fullDigest(bytes, algorithm));
+                return provider === undefined ? request : { ...request, provider };
+            })) };
+        return { capsule: selected, offer: projected };
     }));
 }

package/dist/host/selected-topos.d.ts

@@ -6,10 +6,10 @@ export interface SelectedTopos {
 }
 export type ToposResolver = (digest: string) => StandingTopos;
 /** Resolve content using the instrument wire's admitted digest algorithms. No transport interpretation. */
-export declare function toposAt(digest: string): StandingTopos;
-export declare function contentAt(digest: string): Uint8Array;
-/** A declared JS context offer uses this host adapter only after selection; execution is not selection. */
-export declare function contextModuleAt(digest: string): string;
+export declare function toposAt(digest: string, store?: string): StandingTopos;
+export declare function contentAt(digest: string, store?: string): Uint8Array;
+/** The declared module runs from the store that supplied its verified bytes. No copy or live-checkout fallback. */
+export declare function contextModuleAt(digest: string, store?: string): string;
 /** Selection verifies standing identity. Requested capabilities verify their artifact bytes separately. */
 export declare function selectedTopoi(pins: readonly string[], resolve?: ToposResolver): readonly SelectedTopos[];
 /** Read a declared wire list without copying a world's claims or executing its offers.

package/dist/host/selected-topos.js

@@ -1,40 +1,18 @@
-import { ContentNeeded } from "./content-needed.js";
-import { createHash } from 'node:crypto';
+import { verifiedContent } from "./content-store.js";
 import { readStanding } from '@lapxo/topos/standing';
 import { parse, wireAt } from '@lapxo/topos/wire';
 import { fieldOf } from "../fold/claims.js";
-import { blobAt } from "../land/ledger.js";
-import { observeFile } from "../observe/files.js";
-import { ownStore, ownLock } from "../observe/runner.js";
 /** Resolve content using the instrument wire's admitted digest algorithms. No transport interpretation. */
-export function toposAt(digest) {
-    const topos = readStanding(Buffer.from(contentAt(digest)).toString('utf8'));
+export function toposAt(digest, store) {
+    const topos = readStanding(Buffer.from(contentAt(digest, store)).toString('utf8'));
     return topos;
 }
-export function contentAt(digest) {
-    const fields = ownLock().flatMap(line => { const got = parse(line); return got.kind === 'fact' ? [got.value.fields] : []; });
-    const wire = wireAt(fields, Number.MAX_SAFE_INTEGER);
-    if (wire === null)
-        throw Error('REFUSE·pin instrument has no admitted wire');
-    const algorithms = wire.digests;
-    const bytesAt = (name) => {
-        const split = name.indexOf(':');
-        const algorithm = name.slice(0, split), hex = name.slice(split + 1);
-        if (split < 1 || !algorithms.has(algorithm) || !/^[a-f0-9]+$/.test(hex))
-            throw Error(`REFUSE·pin ${name} digest is not admitted`);
-        const bytes = observeFile(blobAt(ownStore(), name));
-        if (bytes === undefined)
-            throw new ContentNeeded(name);
-        if (createHash(algorithm).update(bytes).digest('hex') !== hex)
-            throw Error(`REFUSE·pin ${name} content hash mismatch · not laid`);
-        return bytes;
-    };
-    return bytesAt(digest);
+export function contentAt(digest, store) {
+    return verifiedContent(digest, store).bytes;
 }
-/** A declared JS context offer uses this host adapter only after selection; execution is not selection. */
-export function contextModuleAt(digest) {
-    contentAt(digest);
-    return blobAt(ownStore(), digest);
+/** The declared module runs from the store that supplied its verified bytes. No copy or live-checkout fallback. */
+export function contextModuleAt(digest, store) {
+    return verifiedContent(digest, store).path;
 }
 /** Selection verifies standing identity. Requested capabilities verify their artifact bytes separately. */
 export function selectedTopoi(pins, resolve = toposAt) {

package/dist/host/source-content.d.ts

@@ -2,7 +2,7 @@ export interface ContentPort {
     readonly algorithms: ReadonlySet<string>;
     readonly read: (digest: string) => Uint8Array | undefined;
     readonly write: (digest: string, bytes: Uint8Array) => void;
-    readonly fetch: (url: string) => Promise<Uint8Array>;
+    readonly fetch: (url: string, digest?: string) => Promise<Uint8Array>;
 }
 /** Transport uses declared locations; only the requested digest admits bytes into the cache. */
 export declare function resolveSelectedContent(lines: readonly string[], port: ContentPort, requested: readonly string[]): Promise<readonly string[]>;

package/dist/host/source-content.js

@@ -1,9 +1,10 @@
+import { transportBytes } from "./ports/transport.js";
+import { contentStore, verifiedContent } from "./content-store.js";
 import { ContentNeeded } from "./content-needed.js";
 import { createHash } from 'node:crypto';
 import { parse, wireAt } from '@lapxo/topos/wire';
-import { blobAt, landBlob } from "../land/ledger.js";
-import { observeFile } from "../observe/files.js";
-import { ownLock, ownStore } from "../observe/runner.js";
+import { landBlob } from "../land/ledger.js";
+import { ownLock } from "../observe/runner.js";
 /** Transport uses declared locations; only the requested digest admits bytes into the cache. */
 export async function resolveSelectedContent(lines, port, requested) {
     const fields = lines.flatMap(line => { const p = parse(line); return p.kind === 'fact' && p.value.fields.value !== 'withdraw' ? [p.value.fields] : []; });
@@ -44,12 +45,9 @@ export async function resolveSelectedContent(lines, port, requested) {
             throw Error(`REFUSE·pin ${digest} content unavailable · no declared source · not laid`);
         let last;
         for (const url of urls) {
-            const parsed = new URL(url);
-            if (!['https:', 'http:'].includes(parsed.protocol))
-                throw Error(`REFUSE·source ${url} needs an explicit transport adapter`);
             let bytes;
             try {
-                bytes = await port.fetch(url);
+                bytes = await port.fetch(url, digest);
             }
             catch (error) {
                 last = error;
@@ -81,14 +79,16 @@ export async function resolveSources(standing, requested) {
     });
     const received = await resolveSelectedContent([...standing, ...bindings], {
         algorithms: wire.digests,
-        read: digest => observeFile(blobAt(ownStore(), digest)),
-        write: (digest, bytes) => { landBlob(ownStore(), digest, bytes); },
-        fetch: async (url) => {
-            const response = await fetch(url, { signal: AbortSignal.timeout(30000) });
-            if (!response.ok)
-                throw Error(`HTTP ${response.status}`);
-            return new Uint8Array(await response.arrayBuffer());
-        },
+        read: digest => { try {
+            return verifiedContent(digest).bytes;
+        }
+        catch (error) {
+            if (error instanceof ContentNeeded)
+                return undefined;
+            throw error;
+        } },
+        write: (digest, bytes) => { landBlob(contentStore(), digest, bytes); },
+        fetch: async (url, digest) => transportBytes(url, digest, [...ownLock(), ...standing]),
     }, requested);
     for (const digest of received)
         process.stdout.write(`FETCHED  ${digest} · verified\n`);

package/dist/host/walk.d.ts

@@ -0,0 +1,6 @@
+/** Verified foreign histories stay separate from the local authority and local epoch inputs. */
+export declare function foreignWalkLines(root: string): Promise<readonly string[]>;
+/** A declared origin exports its own signed history. Foreign packets are retained with their contexts, never re-signed as local history. */
+export declare function renderWalk(root: string, resolution: number | undefined, peer: readonly string[], key?: string, keyFile?: string, signer?: string): Promise<readonly string[]>;
+/** The SDK proves the foreign prefix; the host admits the pair at one publication point. */
+export declare function landWalk(root: string, lines: readonly string[], key?: string, keyFile?: string, signer?: string): Promise<readonly string[]>;

package/dist/host/walk.js

@@ -0,0 +1,193 @@
+import { walkProjection, walkAt, walkSnapshot, walkHeaders, readWalkHeaders, readForeignWalk, walkAuthority, walkOrigin, walkInventory, walkSelection, isWalkHeader } from '@lapxo/topos/walk';
+import { canonical, parse, fromLine, wireAt, matches, objectHistory, validateObjectContext } from '@lapxo/topos/wire';
+import { objectProvider } from '@lapxo/topos/object-provider';
+import { standingBytes } from '@lapxo/topos/standing';
+import { fieldOf } from "../fold/claims.js";
+import { lockStanding, lockLines } from "../fold/keys.js";
+import { authorityFor, rootSigner } from "../fold/signers.js";
+import { publicKeyOf } from "../fold/signers.js";
+import { signaturesOf } from "../fold/digests.js";
+import { fullDigest } from "./digest.js";
+import { toposAt, contextModuleAt } from "./selected-topos.js";
+import { signerFor } from "./signing.js";
+import { signConsentLot, verifiesFields } from "../land/sign.js";
+import { storeOf } from "../land/ledger.js";
+import { signedOwnerLines, epochOf, localActLines, ownerOf } from "../cli/owner.js";
+import { commitIngress, ingressBundles, ingressCost } from "./ports/ingress.js";
+const refuse = (why) => { throw Error('REFUSE·walk ' + why); };
+const fields = (line) => { const p = parse(line); if (p.kind !== 'fact')
+    return refuse('not a wire line'); return p.value.fields; };
+const one = (lines, scope, measure) => {
+    const rows = lines.filter(line => fieldOf(line, 'scope') === scope && fieldOf(line, 'measure') === measure && fieldOf(line, 'value') !== 'withdraw');
+    if (rows.length !== 1)
+        return refuse('missing or conflicting ' + scope + ' ' + measure);
+    return fieldOf(rows[0], 'value');
+};
+function policy(root) {
+    const store = storeOf(root), standing = lockStanding(store), contract = walkSelection(standing);
+    const view = one(standing, 'view/walk', 'id');
+    if (view !== 'walk@*')
+        refuse('view/walk must declare walk@*');
+    const masks = standing.filter(line => fieldOf(line, 'scope') === 'view/walk').flatMap(line => fieldOf(line, 'needs').split('|')).filter(Boolean);
+    if (!masks.length)
+        refuse('view/walk has no declared history inputs');
+    const wire = wireAt(standing.map(fields), Number.MAX_SAFE_INTEGER), algorithm = wire?.digests.values().next().value;
+    if (!algorithm)
+        refuse('no admitted digest algorithm');
+    return { store, standing, contract, masks, digest: (bytes) => fullDigest(bytes, algorithm) };
+}
+function context(root, pin, own = false) {
+    const p = policy(root);
+    if (!own && !p.standing.some(line => fieldOf(line, 'scope').startsWith('uses/') && fieldOf(line, 'value') === pin))
+        refuse('origin context is not selected by digest');
+    const topos = toposAt(pin, p.store), authority = walkAuthority(topos.parts, verifiesFields);
+    const configuration = topos.parts.map(f => canonical({ ...f, by: 'target', epoch: '0' }));
+    return { pin, topos, authority, configuration, origin: walkOrigin(topos.parts), contract: walkSelection(topos.lines) };
+}
+function local(root) {
+    const p = policy(root), authority = authorityFor(lockLines(p.store), rootSigner(root), signaturesOf(p.store).admitted);
+    const history = signedOwnerLines(p.store).filter(line => p.masks.some(mask => matches(mask, fieldOf(line, 'scope'))));
+    if (history.some(line => authority.of(line).kind !== 'admitted'))
+        refuse('local history is not authenticated');
+    const selected = context(root, one(p.standing, 'walk/context', 'digest'), true);
+    return walkSnapshot(history, selected.contract.fields, p.digest, selected.origin, selected.contract.partition);
+}
+const headerInfo = (lines) => {
+    const roots = lines.filter(line => isWalkHeader(line) && fieldOf(line, 'scope') === 'walk/root');
+    if (roots.length !== 1)
+        return refuse('one signed root is required');
+    const at = fieldOf(roots[0], 'at');
+    if (!at.startsWith('receipt:'))
+        return refuse('root has no declared context');
+    return { pin: at.slice(8), base: fieldOf(roots[0], 'condition') };
+};
+async function validateHistory(root, selected, history) {
+    if (!selected.authority.authenticate(history))
+        refuse('origin history is not authenticated');
+    for (const line of history) {
+        const f = fields(line), decoded = fromLine(line, wireAt(selected.topos.parts, Number(f.epoch)));
+        if (decoded.kind !== 'fact')
+            refuse('origin wire ' + decoded.why);
+    }
+    const decoded = objectHistory([...selected.configuration, ...history]);
+    if (decoded.kind !== 'fact')
+        return refuse('origin history ' + decoded.why);
+    if (!decoded.value.objects.length)
+        return;
+    const pinned = new Set(selected.topos.lines);
+    const admit = (f) => Boolean(f.sig) ? selected.authority.of(canonical(f)).kind === 'admitted' : pinned.has(standingBytes([canonical(f)]).trim());
+    const provider = await objectProvider(decoded.value.objects, decoded.value.configuration, { admit, emit: () => { }, topos: pin => toposAt(pin, storeOf(root)), module: pin => contextModuleAt(pin, storeOf(root)) });
+    const checked = validateObjectContext(decoded.value.objects, provider);
+    if (checked.kind !== 'fact')
+        refuse('origin context ' + checked.why);
+}
+async function readBundle(root, bundle, earlier = []) {
+    const lines = bundle.evidence.split('\n').filter(Boolean), info = headerInfo(lines), p = policy(root);
+    const receipts = bundle.receipt.split('\n').filter(Boolean), authority = authorityFor(lockLines(p.store), rootSigner(root), signaturesOf(p.store).admitted);
+    if (receipts.length !== 1 || fieldOf(receipts[0], 'scope') !== 'receipts' || fieldOf(receipts[0], 'role') !== 'writes' || fieldOf(receipts[0], 'form') !== 'alphabet' || fieldOf(receipts[0], 'measure') !== 'digest' || fieldOf(receipts[0], 'at') !== 'receipt:' + info.pin || authority.of(receipts[0]).kind !== 'admitted')
+        refuse('retained import receipt is not authenticated');
+    const selected = context(root, info.pin);
+    const got = readForeignWalk(lines, { origin: selected.origin, regionOrigin: selected.origin, context: info.pin, base: info.base, fields: selected.contract.fields, partition: selected.contract.partition, digest: p.digest, previousPrefixes: [], authenticatePrefix: selected.authority.authenticate, authenticateEvidence: selected.authority.authenticate, validateOriginHistory: () => true });
+    if (fieldOf(receipts[0], 'value') !== got.identity)
+        refuse('retained import receipt does not authenticate this ingress');
+    await validateHistory(root, selected, [...new Set([...earlier, ...got.records])]);
+    return { ...got, context: info.pin, regions: walkSnapshot(got.records, selected.contract.fields, p.digest, got.origin, selected.contract.partition).regions };
+}
+async function verifiedIngress(root) {
+    const result = [], history = new Map();
+    const bundles = [...ingressBundles(storeOf(root))].sort((a, b) => epochOf(a.receipt.split('\n')) - epochOf(b.receipt.split('\n')));
+    for (const bundle of bundles) {
+        const info = headerInfo(bundle.evidence.split('\n').filter(Boolean)), origin = context(root, info.pin).origin;
+        if (result.some(prior => prior.origin === origin && prior.context !== info.pin))
+            refuse('origin context changed without declared lineage');
+        const prior = history.get(origin) ?? new Set();
+        const got = await readBundle(root, bundle, [...prior]);
+        for (const line of got.records)
+            prior.add(line);
+        history.set(origin, prior);
+        result.push(got);
+    }
+    return result;
+}
+async function inventory(root) {
+    const p = policy(root), regions = new Map(local(root).regions.map(region => [region.scope, region]));
+    for (const got of (await verifiedIngress(root)).sort((a, b) => a.senderEpoch - b.senderEpoch))
+        for (const region of got.regions)
+            regions.set(region.scope, region);
+    return walkInventory([[...regions.values()]], p.digest, context(root, one(p.standing, 'walk/context', 'digest'), true).contract.partition);
+}
+/** Verified foreign histories stay separate from the local authority and local epoch inputs. */
+export async function foreignWalkLines(root) {
+    const verified = await verifiedIngress(root);
+    return [...new Set(verified.flatMap(got => got.records))];
+}
+/** A declared origin exports its own signed history. Foreign packets are retained with their contexts, never re-signed as local history. */
+export async function renderWalk(root, resolution, peer, key, keyFile, signer) {
+    const p = policy(root), pin = one(p.standing, 'walk/context', 'digest'), selected = context(root, pin, true), own = local(root);
+    const known = peer.length ? (() => { const info = headerInfo(peer), remote = context(root, info.pin); return readWalkHeaders(peer, info.pin, info.base, remote.authority.authenticate); })() : walkSnapshot([], p.contract.fields, p.digest);
+    const projection = walkProjection(selected.contract.projections, resolution);
+    const ownInventory = projection === 'history' ? own : await inventory(root);
+    const selectedPacket = walkAt(ownInventory, known, resolution, selected.contract.projections), by = key ?? ownerOf(p.store), publicKey = publicKeyOf(root, by);
+    if (!publicKey)
+        refuse('unknown local signer ' + by);
+    const drafted = walkHeaders(selectedPacket, pin, known.root, projection !== 'inventory'), epoch = epochOf(localActLines(root));
+    const got = await signConsentLot(drafted, { by, epoch, algorithm: signaturesOf(p.store).era }, publicKey, signaturesOf(p.store).admitted, signerFor(p.standing, by, signer, keyFile));
+    if (got.kind !== 'fact')
+        return refuse(got.why);
+    if (!selected.authority.authenticate(got.lines) || !selected.authority.authenticate(selectedPacket.records))
+        refuse('local context does not authenticate exported history');
+    return [...got.lines, ...selectedPacket.records, `EXCHANGE ${selectedPacket.touched} touched regions · ${selectedPacket.open} open regions · ${Buffer.byteLength(selectedPacket.records.join('\n') + (selectedPacket.records.length ? '\n' : ''))} payload bytes`];
+}
+/** The SDK proves the foreign prefix; the host admits the pair at one publication point. */
+export async function landWalk(root, lines, key, keyFile, signer) {
+    const p = policy(root), info = headerInfo(lines), selected = context(root, info.pin);
+    const retained = await verifiedIngress(root);
+    if (retained.some(prior => prior.origin === selected.origin && prior.context !== info.pin))
+        refuse('origin context changed without declared lineage');
+    const previous = (verified) => { const prefixes = new Map(); for (const prior of verified.filter(got => got.origin === selected.origin).sort((a, b) => a.senderEpoch - b.senderEpoch))
+        for (const region of prior.regions)
+            prefixes.set(region.scope, { ...region, senderEpoch: prior.senderEpoch }); return [...prefixes.values()]; };
+    const payload = lines.filter(line => !isWalkHeader(line));
+    const proof = (prefixes) => readForeignWalk(lines, { origin: selected.origin, regionOrigin: selected.origin, context: info.pin, base: info.base, fields: selected.contract.fields, partition: selected.contract.partition, digest: p.digest, previousPrefixes: prefixes, authenticatePrefix: selected.authority.authenticate, authenticateEvidence: selected.authority.authenticate, validateOriginHistory: () => true });
+    const raw = proof([]), known = retained.find(prior => prior.identity === raw.identity), got = known ? raw : proof(previous(retained));
+    const history = (prior) => [...new Set([...prior.filter(item => item.origin === selected.origin).flatMap(item => item.records), ...payload])];
+    await validateHistory(root, selected, history(retained));
+    if (!known && info.base !== (await inventory(root)).root)
+        refuse('stale receiver base');
+    if (!payload.length && !readWalkHeaders(lines, info.pin, info.base, selected.authority.authenticate).regions.length)
+        return ['ONCE 0 new evidence lines · 0 import receipts · no regions offered', `EXCHANGE 0 payload bytes · ${Buffer.byteLength(lines.join('\n') + '\n')} protocol bytes · 0 new evidence bytes · 0 new receipt bytes`];
+    const by = key ?? ownerOf(p.store), pub = publicKeyOf(root, by);
+    if (!pub)
+        refuse('unknown receiver signer ' + by);
+    const result = await commitIngress(p.store, got.identity, async () => {
+        if (info.base !== (await inventory(root)).root)
+            refuse('receiver changed before ingress');
+        const current = await verifiedIngress(root);
+        proof(previous(current));
+        await validateHistory(root, selected, history(current));
+        const next = epochOf(localActLines(root)) + 1;
+        const signed = await signConsentLot([got.importReceiptProposal], { by, epoch: next, algorithm: signaturesOf(p.store).era }, pub, signaturesOf(p.store).admitted, signerFor(p.standing, by, signer, keyFile));
+        if (signed.kind !== 'fact')
+            return refuse(signed.why);
+        const authority = authorityFor(lockLines(p.store), rootSigner(root), signaturesOf(p.store).admitted);
+        if (authority.of(signed.lines[0]).kind !== 'admitted')
+            refuse('receiver signer does not cover the import receipt');
+        const grammar = fromLine(signed.lines[0], wireAt(p.standing.map(fields), next));
+        if (grammar.kind !== 'fact')
+            refuse('receiver receipt wire ' + grammar.why);
+        return { evidence: lines.join('\n') + '\n', receipt: signed.lines.join('\n') + '\n' };
+    }, bundle => {
+        try {
+            const retainedLines = bundle.evidence.split('\n').filter(Boolean), retainedInfo = headerInfo(retainedLines);
+            if (retainedInfo.pin !== info.pin)
+                return false;
+            const retainedProof = readForeignWalk(retainedLines, { origin: selected.origin, regionOrigin: selected.origin, context: info.pin, base: retainedInfo.base, fields: selected.contract.fields, partition: selected.contract.partition, digest: p.digest, previousPrefixes: [], authenticatePrefix: selected.authority.authenticate, authenticateEvidence: selected.authority.authenticate, validateOriginHistory: () => true });
+            const receipts = bundle.receipt.split('\n').filter(Boolean), receipt = receipts[0] ?? '';
+            return receipts.length === 1 && retainedProof.identity === got.identity && fieldOf(receipt, 'scope') === 'receipts' && fieldOf(receipt, 'value') === got.identity && fieldOf(receipt, 'at') === 'receipt:' + info.pin && authorityFor(lockLines(p.store), rootSigner(root), signaturesOf(p.store).admitted).of(receipt).kind === 'admitted';
+        }
+        catch {
+            return false;
+        }
+    });
+    return [`${result.kind === 'once' ? 'ONCE' : 'INGRESS'} ${result.kind === 'once' ? 0 : got.records.length} new evidence lines · 1 ${result.kind === 'once' ? 'retained' : 'signed local'} import receipt`, result.receipt.trim(), ingressCost(result, Buffer.byteLength(payload.join('\n') + (payload.length ? '\n' : '')), Buffer.byteLength(lines.filter(isWalkHeader).join('\n') + '\n'))];
+}

package/dist/observe/identity.d.ts

@@ -1,3 +1,4 @@
+import type { ReaderLifetime } from '@lapxo/topos/wire';
 import type { Kind } from './run.ts';
 /** Where a reader's vectors lie: in its package, beside its source, under the name of its module, the folder the wire's vector family names. */
 export declare const vectorsOf: (module: string, standing: readonly string[]) => string;
@@ -13,6 +14,7 @@ export declare function identityOf(input: {
     readonly code: string;
     readonly lineage: readonly string[];
     readonly kept: readonly string[];
+    readonly lifetime?: ReaderLifetime;
 }): {
     readonly by: string;
     readonly lines: readonly string[];