@lapxo/bound 0.1.4 → 0.1.5

package/dist/host/capsule.js

@@ -38,9 +38,9 @@ function unpacked(digest, bytes) {
 }
 /**
  * A capsule is the bytes a digest names in the instrument's own store, and only when they hash to it: its own lock is
- * read from them, and the coordinate a lock names runs as a process of its own, like a reader. Each answer is kept in one
- * slot of the capsule, the place and the region; the body of the request is the hit, so a file that moved misses and
- * overwrites the slot, and a request asked again for the same bytes is read back and never run twice. Operational failures never enter the cache; refusals and abstentions are asked again.
+ * read from them, and the coordinate a lock names runs as a process of its own, like a reader. Each answer is kept by the
+ * digest of its complete declared request and implementation; distinct views retain distinct answers, and the same
+ * request reads its verified answer without running again. Operational failures never enter the cache; refusals and abstentions are asked again.
  */
 const capsules = new Map();
 /** A blob is loaded once in an act. A later ask for the same digest reads that capsule, and does not hash or unpack it again. */
@@ -93,10 +93,9 @@ function answered(digest, bytes, requests, names, tree, cacheStore = ownStore(),
         return requests.map(() => undefined);
     }
     const loader = entry !== undefined ? `${createHash('sha256').update(`${relative(tree, entry)}\n`).digest('hex')}\n` : child.length > 1 ? `${createHash('sha256').update(observeFile(child[0]) ?? new Uint8Array()).digest('hex')}\n` : '';
-    const slotOf = (request) => sha(`${digest}\n${loader}${request.verb}\n${request.rootScope}\n${request.region ?? ''}`);
     const hitOf = (request) => sha(`${digest}\n${loader}${JSON.stringify(request)}`);
-    const kept = requests.map((request) => storeAt(cacheStore, 'cas', 'answers', slotOf(request)));
     const hits = requests.map(hitOf);
+    const kept = hits.map(hit => storeAt(cacheStore, 'cas', 'answers', hit));
     const held = kept.map((at, i) => {
         const text = observeText(at);
         if (text === undefined)
@@ -123,7 +122,7 @@ function answered(digest, bytes, requests, names, tree, cacheStore = ownStore(),
         if (said?.kind === 'fact') {
             const text = JSON.stringify({ format: 'capsule-answer/2', hit: hits[i], said });
             replaceWhole(kept[i], text);
-            holdStore(cacheStore, 'answers', slotOf(request), Buffer.byteLength(text));
+            holdStore(cacheStore, 'answers', hits[i], Buffer.byteLength(text));
         }
         return said;
     });

package/dist/host/ports/ingress.d.ts

@@ -0,0 +1,24 @@
+/** Prepared by the admitted Topos contract and receiver signer. The host does not infer origins, coverage or epochs. */
+export interface IngressBundle {
+    readonly evidence: string;
+    readonly receipt: string;
+}
+export interface IngressResult extends IngressBundle {
+    readonly kind: 'landed' | 'once';
+    readonly evidenceBytes: number;
+    readonly receiptBytes: number;
+}
+export interface IngressStorage {
+    publish(staged: string, committed: string): void;
+}
+/** Directory publication makes the pair visible together; there is no later ledger append that can expose half. */
+export declare const nativeIngressStorage: IngressStorage;
+/** Native signed receipt lines only. Foreign bytes are never added to the local ledger or epoch allocator. */
+export declare function ingressReceipts(store: string): readonly string[];
+/** Private staging directories are invisible to readers and may be discarded after host recovery. */
+export declare function ingressEvidence(store: string, identity: string): IngressBundle | undefined;
+export declare function ingressBundles(store: string): readonly IngressBundle[];
+/** Verification and signing complete before staging. Replay performs no signer invocation or persistent write. */
+export declare function commitIngress(store: string, identity: string, prepare: (localImportReceipts: readonly string[]) => Promise<IngressBundle>, verify: (bundle: IngressBundle) => boolean, storage?: IngressStorage): Promise<IngressResult>;
+/** Costs distinguish delivered bytes from newly committed bytes; no count is called information or freedom. */
+export declare function ingressCost(result: IngressResult, deliveredBytes: number, protocolBytes: number): string;

package/dist/host/ports/ingress.js

@@ -0,0 +1,81 @@
+import { randomUUID } from 'node:crypto';
+import { closeSync, existsSync, fsyncSync, mkdirSync, openSync, readFileSync, readdirSync, renameSync, rmSync, writeFileSync } from 'node:fs';
+import { join } from 'node:path';
+import { requireEffects } from "../read-only.js";
+import { underTheLock } from "../../land/act.js";
+const syncDirectory = (path) => { const fd = openSync(path, 'r'); try {
+    fsyncSync(fd);
+}
+finally {
+    closeSync(fd);
+} };
+const durableFile = (path, text) => { const fd = openSync(path, 'wx', 0o600); try {
+    writeFileSync(fd, text);
+    fsyncSync(fd);
+}
+finally {
+    closeSync(fd);
+} };
+/** Directory publication makes the pair visible together; there is no later ledger append that can expose half. */
+export const nativeIngressStorage = { publish(staged, committed) { renameSync(staged, committed); syncDirectory(join(committed, '..')); } };
+const directory = (store) => join(store, 'ingress');
+const nameOf = (identity) => {
+    if (!identity || identity.includes('\0'))
+        throw Error('REFUSE·ingress missing import identity');
+    return 'committed-' + encodeURIComponent(identity);
+};
+const read = (at) => ({ evidence: readFileSync(join(at, 'evidence.bound'), 'utf8'), receipt: readFileSync(join(at, 'receipt.bound'), 'utf8') });
+const measured = (kind, bundle) => ({ kind, ...bundle, evidenceBytes: Buffer.byteLength(bundle.evidence), receiptBytes: Buffer.byteLength(bundle.receipt) });
+/** Native signed receipt lines only. Foreign bytes are never added to the local ledger or epoch allocator. */
+export function ingressReceipts(store) {
+    const root = directory(store);
+    if (!existsSync(root))
+        return [];
+    return readdirSync(root).filter(name => name.startsWith('committed-')).sort().flatMap(name => read(join(root, name)).receipt.split('\n').filter(Boolean));
+}
+/** Private staging directories are invisible to readers and may be discarded after host recovery. */
+export function ingressEvidence(store, identity) {
+    const at = join(directory(store), nameOf(identity));
+    return existsSync(at) ? read(at) : undefined;
+}
+export function ingressBundles(store) {
+    const root = directory(store);
+    if (!existsSync(root))
+        return [];
+    return readdirSync(root).filter(name => name.startsWith('committed-')).sort().map(name => read(join(root, name)));
+}
+/** Verification and signing complete before staging. Replay performs no signer invocation or persistent write. */
+export async function commitIngress(store, identity, prepare, verify, storage = nativeIngressStorage) {
+    requireEffects('foreign evidence ingress');
+    return underTheLock(store, 'ingress', async () => {
+        const root = directory(store), at = join(root, nameOf(identity));
+        if (existsSync(at)) {
+            const prior = read(at);
+            if (verify(prior) !== true)
+                throw Error('REFUSE·ingress committed bytes do not verify');
+            return measured('once', prior);
+        }
+        const bundle = await prepare(ingressReceipts(store));
+        if (!bundle.evidence || !bundle.receipt || verify(bundle) !== true)
+            throw Error('REFUSE·ingress evidence and receipt do not verify');
+        mkdirSync(root, { recursive: true });
+        const staged = join(root, '.stage-' + randomUUID());
+        mkdirSync(staged, { mode: 0o700 });
+        try {
+            durableFile(join(staged, 'evidence.bound'), bundle.evidence);
+            durableFile(join(staged, 'receipt.bound'), bundle.receipt);
+            syncDirectory(staged);
+            storage.publish(staged, at);
+        }
+        finally {
+            rmSync(staged, { recursive: true, force: true });
+        }
+        return measured('landed', bundle);
+    });
+}
+/** Costs distinguish delivered bytes from newly committed bytes; no count is called information or freedom. */
+export function ingressCost(result, deliveredBytes, protocolBytes) {
+    if (!Number.isSafeInteger(deliveredBytes) || deliveredBytes < 0 || !Number.isSafeInteger(protocolBytes) || protocolBytes < 0)
+        throw Error('REFUSE·ingress invalid exchange byte measurement');
+    return `EXCHANGE ${deliveredBytes} payload bytes · ${protocolBytes} protocol bytes · ${result.kind === 'once' ? 0 : result.evidenceBytes} new evidence bytes · ${result.kind === 'once' ? 0 : result.receiptBytes} new receipt bytes`;
+}

package/dist/host/reading-closures.d.ts

@@ -0,0 +1,28 @@
+import type { Capsule } from './capsule.ts';
+type File = {
+    readonly place: string;
+    readonly text: string;
+};
+export declare const inputLines: (files: readonly File[]) => readonly string[];
+/** The selected world owns input projection and reading. The host only verifies closures and keeps native count/bytes receipts. */
+export declare function readingClosures(options: {
+    root: string;
+    store: string;
+    reader: string;
+    speaker: string;
+    digest: (text: string) => string;
+    capsule: Capsule;
+    region: string;
+    projection: string;
+    allowsEmpty?: boolean;
+    files: readonly File[];
+    emit?: (line: string) => void;
+}): {
+    lines: readonly string[];
+    read: number;
+    opened: number;
+    executed: number;
+};
+/** Verify the native reading carriers before a file seal may reuse them. These are semantic receipts, not file-region seals. */
+export declare function verifiedReadingReceipts(store: string, lines: readonly string[], digest: (text: string) => string): number | undefined;
+export {};

package/dist/host/reading-closures.js

@@ -0,0 +1,146 @@
+import { actCosts } from "./act-cost.js";
+import { mkdirSync, readFileSync, existsSync } from 'node:fs';
+import { join, dirname } from 'node:path';
+import { canonical, parse, PROTOCOL, byBytes } from '@lapxo/topos/wire';
+import { replaceWhole, landShard, shardLines } from "../land/ledger.js";
+import { fieldOf } from "../fold/claims.js";
+import { readOnly } from "./read-only.js";
+const fields = (line) => { const got = parse(line); if (got.kind !== 'fact')
+    throw Error('REFUSE·input projection contains a non-wire line'); return got.value.fields; };
+export const inputLines = (files) => files.map(file => canonical({ scope: file.place, form: 'alphabet', measure: 'text', role: 'writes', value: 'lock', shape: file.place, about: file.text, by: 'host', at: 'policy:handed-input' }));
+/** The selected world owns input projection and reading. The host only verifies closures and keeps native count/bytes receipts. */
+export function readingClosures(options) {
+    const { root, store, reader, speaker, digest: hash, capsule, region, projection, files } = options, emit = options.emit ?? (() => { });
+    const algorithm = hash('').split(':')[0], handed = new Map(files.map(file => [file.place, file.text]));
+    if (handed.size !== files.length)
+        throw Error('REFUSE·input projection has duplicate handed coordinates');
+    const verify = () => { for (const file of files)
+        if (!readFileSync(join(root, file.place)).equals(Buffer.from(file.text)))
+            throw Error('REFUSE·input changed ' + file.place); };
+    verify();
+    const projected = capsule.ask([{ protocol: PROTOCOL, verb: 'render', rootScope: '', region: projection, at: 1, reads: ['**'], lines: inputLines(files), files: [] }])[0];
+    if (projected?.kind !== 'fact' || !Array.isArray(projected.lines))
+        throw Error('REFUSE·input projection ' + (projected?.why ?? 'no lines'));
+    const plans = new Map();
+    for (const line of projected.lines) {
+        const f = fields(line), scope = f.scope ?? '', resolution = /^receipt:(\d+)$/.exec(f.at ?? '');
+        if (!scope || plans.has(scope) || f.form !== 'alphabet' || f.measure !== 'reads' || f.role !== 'reads' || !resolution)
+            throw Error('REFUSE·input projection ambiguous reading ' + scope);
+        const inputs = (f.value ?? '').split('|').filter(Boolean), needs = (f.needs ?? '').split('|').filter(Boolean);
+        if (!inputs.length || new Set(inputs).size !== inputs.length || inputs.some(input => !handed.has(input)) || new Set(needs).size !== needs.length)
+            throw Error('REFUSE·input projection has unhanded or duplicate dependencies ' + scope);
+        const n = Number(resolution[1]);
+        if (!Number.isSafeInteger(n))
+            throw Error('REFUSE·input projection invalid resolution ' + scope);
+        plans.set(scope, { scope, inputs, needs, resolution: n, line: canonical({ scope, form: f.form, measure: f.measure, role: f.role, value: inputs.join('|'), needs: needs.join('|'), at: f.at }) });
+    }
+    if (!plans.size)
+        throw Error('REFUSE·input projection returned no readings');
+    const ordered = [], visiting = new Set(), done = new Set();
+    const visit = (scope) => { if (done.has(scope))
+        return; if (visiting.has(scope))
+        throw Error('REFUSE·input projection dependency cycle ' + scope); const p = plans.get(scope); if (!p)
+        throw Error('REFUSE·input projection missing reading ' + scope); visiting.add(scope); for (const need of p.needs)
+        visit(need); visiting.delete(scope); done.add(scope); ordered.push(p); };
+    for (const scope of plans.keys())
+        visit(scope);
+    const identity = hash([capsule.selection ?? '', capsule.digest, region, projection].join('\n')), by = speaker + ':' + identity.split(':')[1].slice(0, 12), journal = 'reading-closures/' + identity.split(':')[1];
+    const prior = shardLines(store, speaker, journal), results = new Map(), out = [];
+    const carried = (digest) => join(store, 'cas', 'carried', digest.split(':')[1] ?? '');
+    const saved = (text) => { const digest = hash(text), path = carried(digest); mkdirSync(dirname(path), { recursive: true }); if (!existsSync(path) || hash(readFileSync(path, 'utf8')) !== digest)
+        replaceWhole(path, text); return digest; };
+    const load = (digest) => { if (!digest.startsWith(algorithm + ':') || !/^[a-f0-9]+$/.test(digest.split(':')[1] ?? ''))
+        return; const path = carried(digest); if (!existsSync(path))
+        return; const text = readFileSync(path, 'utf8'); return hash(text) === digest ? text : undefined; };
+    let read = 0, opened = 0, executed = 0;
+    for (const plan of ordered) {
+        actCosts.measure(() => {
+            const closure = [plan.line, canonical({ scope: 'implementation', role: 'writes', form: 'alphabet', measure: 'digest', value: identity, by: 'host', at: 'policy:input-identity' }), ...plan.inputs.map(input => canonical({ scope: input, role: 'writes', form: 'alphabet', measure: 'digest', value: hash(handed.get(input)), by: 'host', at: 'policy:input-identity' })), ...plan.needs.map(need => canonical({ scope: need, role: 'writes', form: 'alphabet', measure: 'digest', value: results.get(need).digest, by: 'host', at: 'policy:input-identity' }))].sort(byBytes).join('\n') + '\n';
+            const input = hash(closure), scope = 'receipts/readings/' + hash(plan.scope).split(':')[1] + '/' + input.split(':')[1], matching = prior.filter(line => fieldOf(line, 'scope') === scope && fieldOf(line, 'measure') === 'bytes' && fieldOf(line, 'value') === input).at(-1);
+            const count = matching && prior.filter(line => fieldOf(line, 'scope') === scope && fieldOf(line, 'measure') === 'count' && fieldOf(line, 'by') === by).at(-1);
+            const heldOutput = count && load(fieldOf(count, 'at').replace(/^place:/, ''));
+            const heldLines = heldOutput?.split('\n').filter(Boolean);
+            const output = heldLines !== undefined && fieldOf(count, 'value') === `${heldLines.length}..${heldLines.length}` && heldLines.every(line => { const f = fields(line); return f.by === by && f.at === 'place:' + input; }) ? heldOutput : undefined;
+            let lines, payload;
+            if (output !== undefined && load(input) === closure) {
+                if (output === '' && !options.allowsEmpty)
+                    throw Error('REFUSE·reading empty response is not admitted ' + plan.scope);
+                lines = output.split('\n').filter(Boolean);
+                for (const line of lines)
+                    fields(line);
+                payload = fieldOf(count, 'at').replace(/^place:/, '');
+            }
+            else {
+                if (readOnly())
+                    throw Error('REFUSE·preview reading closure is unpaid ' + plan.scope);
+                const started = process.hrtime.bigint();
+                const dependencies = plan.needs.flatMap(need => results.get(need).lines), answer = capsule.ask([{ protocol: PROTOCOL, verb: 'read', rootScope: plan.scope, name: plan.scope, region, at: plan.resolution, reads: ['**'], lines: [...inputLines(plan.inputs.map(place => ({ place, text: handed.get(place) }))), ...dependencies], files: [] }])[0];
+                if (answer?.kind !== 'fact' || !Array.isArray(answer.claims))
+                    throw Error('REFUSE·reading ' + plan.scope + ' · ' + (answer?.why ?? 'no claims'));
+                lines = answer.claims.map((unknown) => { if (typeof unknown?.scope !== 'string' || typeof unknown?.measure !== 'string' || typeof unknown?.role !== 'string' || !unknown.bound || !['interval', 'enumerated'].includes(unknown.bound.kind))
+                    throw Error('REFUSE·reading malformed claim ' + plan.scope); const span = unknown.bound; const text = canonical({ scope: unknown.scope, measure: unknown.measure, role: unknown.role, form: span.kind === 'interval' ? 'interval' : 'alphabet', value: span.kind === 'interval' ? `${span.lo}..${span.hi}` : Array.isArray(span.values) ? span.values.join('|') : '', by, at: 'place:' + input }); fields(text); return text; });
+                if (!lines.length && !options.allowsEmpty)
+                    throw Error('REFUSE·reading empty response is not admitted ' + plan.scope);
+                executed++;
+                verify();
+                payload = saved(lines.length ? [...lines].sort(byBytes).join('\n') + '\n' : '');
+                if (saved(closure) !== input)
+                    throw Error('REFUSE·receipt input closure mismatch');
+                const seconds = (Number(process.hrtime.bigint() - started) / 1e9).toFixed(6);
+                landShard(store, speaker, journal, [canonical({ scope, role: 'writes', form: 'interval', measure: 'count', value: `${lines.length}..${lines.length}`, by, at: 'place:' + payload }), canonical({ scope, role: 'writes', form: 'alphabet', measure: 'bytes', value: input, by, at: 'place:' + input }), canonical({ scope, role: 'writes', form: 'interval', measure: 's', value: seconds + '..' + seconds, by, at: 'place:' + input })]);
+                if (plan.resolution === 1)
+                    opened++;
+            }
+            results.set(plan.scope, { digest: payload, lines });
+            out.push(canonical({ scope: plan.scope, role: 'writes', form: 'alphabet', measure: 'observed', value: input, by, at: 'place:' + input }), ...lines);
+            if (plan.resolution === 1) {
+                read++;
+                const native = shardLines(store, speaker, journal).filter(line => fieldOf(line, 'scope') === scope && ((fieldOf(line, 'measure') === 'bytes' && fieldOf(line, 'value') === input) || (fieldOf(line, 'measure') === 'count') || (fieldOf(line, 'measure') === 's' && fieldOf(line, 'at') === 'place:' + input))).map(line => {
+                    const f = fields(line), id = f.measure === 'bytes' ? f.value : f.measure === 'count' ? (f.at ?? '').replace(/^place:/, '') : undefined;
+                    if (id === undefined)
+                        return line;
+                    const bytes = load(id);
+                    if (bytes === undefined)
+                        throw Error('REFUSE·receipt missing verified carrier ' + id);
+                    // The full-resolution native row carries the actual verified UTF-8 bytes.
+                    // Its semantic count/digest is unchanged; a public copy needs no private CAS.
+                    return canonical({ ...f, about: bytes });
+                });
+                out.push(canonical({ scope, role: 'writes', form: 'alphabet', measure: 'observed', value: payload, by, at: 'place:' + payload }), ...native);
+            }
+        });
+    }
+    verify();
+    emit(`RECEIPTS ${read} read · ${opened} opened · reading closures`);
+    return { lines: out, read, opened, executed };
+}
+/** Verify the native reading carriers before a file seal may reuse them. These are semantic receipts, not file-region seals. */
+export function verifiedReadingReceipts(store, lines, digest) {
+    const units = lines.filter(line => fieldOf(line, 'scope').startsWith('receipts/readings/') && fieldOf(line, 'measure') === 'bytes' && fieldOf(line, 'role') === 'writes');
+    const load = (id, row) => {
+        const hex = id.split(':')[1];
+        if (!hex || !/^[a-f0-9]+$/.test(hex))
+            return;
+        const supplied = fields(row).about;
+        // A supplied carrier must authenticate even if an old local copy still exists.
+        if (supplied !== undefined)
+            return digest(supplied) === id ? supplied : undefined;
+        const path = join(store, 'cas', 'carried', hex);
+        if (!existsSync(path))
+            return;
+        const bytes = readFileSync(path, 'utf8');
+        return digest(bytes) === id ? bytes : undefined;
+    };
+    for (const unit of units) {
+        const input = fieldOf(unit, 'value'), scope = fieldOf(unit, 'scope'), by = fieldOf(unit, 'by'), counts = lines.filter(line => fieldOf(line, 'scope') === scope && fieldOf(line, 'measure') === 'count' && fieldOf(line, 'by') === by && fieldOf(line, 'role') === 'writes');
+        if (counts.length !== 1 || load(input, unit) === undefined)
+            return;
+        const count = counts[0], output = load(fieldOf(count, 'at').replace(/^place:/, ''), count);
+        if (output === undefined)
+            return;
+        const rows = output.split('\n').filter(Boolean);
+        if (fieldOf(count, 'value') !== `${rows.length}..${rows.length}` || rows.some(line => fieldOf(line, 'by') !== by || fieldOf(line, 'at') !== 'place:' + input))
+            return;
+    }
+    return units.length;
+}

package/dist/host/release.js

@@ -48,11 +48,33 @@ function layDir(from, into) {
         writeFileSync(dest, bytes, { flag: 'wx' });
     }
 }
-function swapPlace(place, next, digest) {
+function swapPlace(place, next, digest, ready) {
     const old = `${next}.old`;
     if (lstatSync(old, { throwIfNoEntry: false }) !== undefined)
         throw new Error(`REFUSE·release recovery required for ${old}`);
     writeFileSync(join(next, laidMark), digest, { flag: 'wx' });
+    if (ready !== undefined) {
+        // Digest-addressed trees publish once. A verified concurrent winner is reused,
+        // never moved aside while another process may be importing its members.
+        if (ready()) {
+            rmSync(next, { recursive: true, force: true });
+            return;
+        }
+        try {
+            renameSync(next, place);
+            return;
+        }
+        catch (error) {
+            const code = error.code;
+            if (code !== 'EEXIST' && code !== 'ENOTEMPTY')
+                throw error;
+            if (ready()) {
+                rmSync(next, { recursive: true, force: true });
+                return;
+            }
+            // An existing invalid cache retains the repair/rollback path below.
+        }
+    }
     let moved = false;
     try {
         if (lstatSync(place, { throwIfNoEntry: false }) !== undefined) {
@@ -224,7 +246,7 @@ export function runtimeTreeAt(store, own, digest, contentStore = own, root = '')
     const next = nextPlace(place);
     try {
         layFiles(store, own, files, next);
-        swapPlace(place, next, digest);
+        swapPlace(place, next, digest, () => observeText(join(place, laidMark)) === digest && layoutMatches(place, files));
     }
     catch (error) {
         rmSync(next, { recursive: true, force: true });

package/dist/host/walk.d.ts

@@ -0,0 +1,6 @@
+/** Verified foreign histories stay separate from the local authority and local epoch inputs. */
+export declare function foreignWalkLines(root: string): Promise<readonly string[]>;
+/** A declared origin exports its own signed history. Foreign packets are retained with their contexts, never re-signed as local history. */
+export declare function renderWalk(root: string, resolution: number | undefined, peer: readonly string[], key?: string, keyFile?: string, signer?: string): Promise<readonly string[]>;
+/** The SDK proves the foreign prefix; the host admits the pair at one publication point. */
+export declare function landWalk(root: string, lines: readonly string[], key?: string, keyFile?: string, signer?: string): Promise<readonly string[]>;

package/dist/host/walk.js

@@ -0,0 +1,193 @@
+import { walkProjection, walkAt, walkSnapshot, walkHeaders, readWalkHeaders, readForeignWalk, walkAuthority, walkOrigin, walkInventory, walkSelection, isWalkHeader } from '@lapxo/topos/walk';
+import { canonical, parse, fromLine, wireAt, matches, objectHistory, validateObjectContext } from '@lapxo/topos/wire';
+import { objectProvider } from '@lapxo/topos/object-provider';
+import { standingBytes } from '@lapxo/topos/standing';
+import { fieldOf } from "../fold/claims.js";
+import { lockStanding, lockLines } from "../fold/keys.js";
+import { authorityFor, rootSigner } from "../fold/signers.js";
+import { publicKeyOf } from "../fold/signers.js";
+import { signaturesOf } from "../fold/digests.js";
+import { fullDigest } from "./digest.js";
+import { toposAt, contextModuleAt } from "./selected-topos.js";
+import { signerFor } from "./signing.js";
+import { signConsentLot, verifiesFields } from "../land/sign.js";
+import { storeOf } from "../land/ledger.js";
+import { signedOwnerLines, epochOf, localActLines, ownerOf } from "../cli/owner.js";
+import { commitIngress, ingressBundles, ingressCost } from "./ports/ingress.js";
+const refuse = (why) => { throw Error('REFUSE·walk ' + why); };
+const fields = (line) => { const p = parse(line); if (p.kind !== 'fact')
+    return refuse('not a wire line'); return p.value.fields; };
+const one = (lines, scope, measure) => {
+    const rows = lines.filter(line => fieldOf(line, 'scope') === scope && fieldOf(line, 'measure') === measure && fieldOf(line, 'value') !== 'withdraw');
+    if (rows.length !== 1)
+        return refuse('missing or conflicting ' + scope + ' ' + measure);
+    return fieldOf(rows[0], 'value');
+};
+function policy(root) {
+    const store = storeOf(root), standing = lockStanding(store), contract = walkSelection(standing);
+    const view = one(standing, 'view/walk', 'id');
+    if (view !== 'walk@*')
+        refuse('view/walk must declare walk@*');
+    const masks = standing.filter(line => fieldOf(line, 'scope') === 'view/walk').flatMap(line => fieldOf(line, 'needs').split('|')).filter(Boolean);
+    if (!masks.length)
+        refuse('view/walk has no declared history inputs');
+    const wire = wireAt(standing.map(fields), Number.MAX_SAFE_INTEGER), algorithm = wire?.digests.values().next().value;
+    if (!algorithm)
+        refuse('no admitted digest algorithm');
+    return { store, standing, contract, masks, digest: (bytes) => fullDigest(bytes, algorithm) };
+}
+function context(root, pin, own = false) {
+    const p = policy(root);
+    if (!own && !p.standing.some(line => fieldOf(line, 'scope').startsWith('uses/') && fieldOf(line, 'value') === pin))
+        refuse('origin context is not selected by digest');
+    const topos = toposAt(pin, p.store), authority = walkAuthority(topos.parts, verifiesFields);
+    const configuration = topos.parts.map(f => canonical({ ...f, by: 'target', epoch: '0' }));
+    return { pin, topos, authority, configuration, origin: walkOrigin(topos.parts), contract: walkSelection(topos.lines) };
+}
+function local(root) {
+    const p = policy(root), authority = authorityFor(lockLines(p.store), rootSigner(root), signaturesOf(p.store).admitted);
+    const history = signedOwnerLines(p.store).filter(line => p.masks.some(mask => matches(mask, fieldOf(line, 'scope'))));
+    if (history.some(line => authority.of(line).kind !== 'admitted'))
+        refuse('local history is not authenticated');
+    const selected = context(root, one(p.standing, 'walk/context', 'digest'), true);
+    return walkSnapshot(history, selected.contract.fields, p.digest, selected.origin, selected.contract.partition);
+}
+const headerInfo = (lines) => {
+    const roots = lines.filter(line => isWalkHeader(line) && fieldOf(line, 'scope') === 'walk/root');
+    if (roots.length !== 1)
+        return refuse('one signed root is required');
+    const at = fieldOf(roots[0], 'at');
+    if (!at.startsWith('receipt:'))
+        return refuse('root has no declared context');
+    return { pin: at.slice(8), base: fieldOf(roots[0], 'condition') };
+};
+async function validateHistory(root, selected, history) {
+    if (!selected.authority.authenticate(history))
+        refuse('origin history is not authenticated');
+    for (const line of history) {
+        const f = fields(line), decoded = fromLine(line, wireAt(selected.topos.parts, Number(f.epoch)));
+        if (decoded.kind !== 'fact')
+            refuse('origin wire ' + decoded.why);
+    }
+    const decoded = objectHistory([...selected.configuration, ...history]);
+    if (decoded.kind !== 'fact')
+        return refuse('origin history ' + decoded.why);
+    if (!decoded.value.objects.length)
+        return;
+    const pinned = new Set(selected.topos.lines);
+    const admit = (f) => Boolean(f.sig) ? selected.authority.of(canonical(f)).kind === 'admitted' : pinned.has(standingBytes([canonical(f)]).trim());
+    const provider = await objectProvider(decoded.value.objects, decoded.value.configuration, { admit, emit: () => { }, topos: pin => toposAt(pin, storeOf(root)), module: pin => contextModuleAt(pin, storeOf(root)) });
+    const checked = validateObjectContext(decoded.value.objects, provider);
+    if (checked.kind !== 'fact')
+        refuse('origin context ' + checked.why);
+}
+async function readBundle(root, bundle, earlier = []) {
+    const lines = bundle.evidence.split('\n').filter(Boolean), info = headerInfo(lines), p = policy(root);
+    const receipts = bundle.receipt.split('\n').filter(Boolean), authority = authorityFor(lockLines(p.store), rootSigner(root), signaturesOf(p.store).admitted);
+    if (receipts.length !== 1 || fieldOf(receipts[0], 'scope') !== 'receipts' || fieldOf(receipts[0], 'role') !== 'writes' || fieldOf(receipts[0], 'form') !== 'alphabet' || fieldOf(receipts[0], 'measure') !== 'digest' || fieldOf(receipts[0], 'at') !== 'receipt:' + info.pin || authority.of(receipts[0]).kind !== 'admitted')
+        refuse('retained import receipt is not authenticated');
+    const selected = context(root, info.pin);
+    const got = readForeignWalk(lines, { origin: selected.origin, regionOrigin: selected.origin, context: info.pin, base: info.base, fields: selected.contract.fields, partition: selected.contract.partition, digest: p.digest, previousPrefixes: [], authenticatePrefix: selected.authority.authenticate, authenticateEvidence: selected.authority.authenticate, validateOriginHistory: () => true });
+    if (fieldOf(receipts[0], 'value') !== got.identity)
+        refuse('retained import receipt does not authenticate this ingress');
+    await validateHistory(root, selected, [...new Set([...earlier, ...got.records])]);
+    return { ...got, context: info.pin, regions: walkSnapshot(got.records, selected.contract.fields, p.digest, got.origin, selected.contract.partition).regions };
+}
+async function verifiedIngress(root) {
+    const result = [], history = new Map();
+    const bundles = [...ingressBundles(storeOf(root))].sort((a, b) => epochOf(a.receipt.split('\n')) - epochOf(b.receipt.split('\n')));
+    for (const bundle of bundles) {
+        const info = headerInfo(bundle.evidence.split('\n').filter(Boolean)), origin = context(root, info.pin).origin;
+        if (result.some(prior => prior.origin === origin && prior.context !== info.pin))
+            refuse('origin context changed without declared lineage');
+        const prior = history.get(origin) ?? new Set();
+        const got = await readBundle(root, bundle, [...prior]);
+        for (const line of got.records)
+            prior.add(line);
+        history.set(origin, prior);
+        result.push(got);
+    }
+    return result;
+}
+async function inventory(root) {
+    const p = policy(root), regions = new Map(local(root).regions.map(region => [region.scope, region]));
+    for (const got of (await verifiedIngress(root)).sort((a, b) => a.senderEpoch - b.senderEpoch))
+        for (const region of got.regions)
+            regions.set(region.scope, region);
+    return walkInventory([[...regions.values()]], p.digest, context(root, one(p.standing, 'walk/context', 'digest'), true).contract.partition);
+}
+/** Verified foreign histories stay separate from the local authority and local epoch inputs. */
+export async function foreignWalkLines(root) {
+    const verified = await verifiedIngress(root);
+    return [...new Set(verified.flatMap(got => got.records))];
+}
+/** A declared origin exports its own signed history. Foreign packets are retained with their contexts, never re-signed as local history. */
+export async function renderWalk(root, resolution, peer, key, keyFile, signer) {
+    const p = policy(root), pin = one(p.standing, 'walk/context', 'digest'), selected = context(root, pin, true), own = local(root);
+    const known = peer.length ? (() => { const info = headerInfo(peer), remote = context(root, info.pin); return readWalkHeaders(peer, info.pin, info.base, remote.authority.authenticate); })() : walkSnapshot([], p.contract.fields, p.digest);
+    const projection = walkProjection(selected.contract.projections, resolution);
+    const ownInventory = projection === 'history' ? own : await inventory(root);
+    const selectedPacket = walkAt(ownInventory, known, resolution, selected.contract.projections), by = key ?? ownerOf(p.store), publicKey = publicKeyOf(root, by);
+    if (!publicKey)
+        refuse('unknown local signer ' + by);
+    const drafted = walkHeaders(selectedPacket, pin, known.root, projection !== 'inventory'), epoch = epochOf(localActLines(root));
+    const got = await signConsentLot(drafted, { by, epoch, algorithm: signaturesOf(p.store).era }, publicKey, signaturesOf(p.store).admitted, signerFor(p.standing, by, signer, keyFile));
+    if (got.kind !== 'fact')
+        return refuse(got.why);
+    if (!selected.authority.authenticate(got.lines) || !selected.authority.authenticate(selectedPacket.records))
+        refuse('local context does not authenticate exported history');
+    return [...got.lines, ...selectedPacket.records, `EXCHANGE ${selectedPacket.touched} touched regions · ${selectedPacket.open} open regions · ${Buffer.byteLength(selectedPacket.records.join('\n') + (selectedPacket.records.length ? '\n' : ''))} payload bytes`];
+}
+/** The SDK proves the foreign prefix; the host admits the pair at one publication point. */
+export async function landWalk(root, lines, key, keyFile, signer) {
+    const p = policy(root), info = headerInfo(lines), selected = context(root, info.pin);
+    const retained = await verifiedIngress(root);
+    if (retained.some(prior => prior.origin === selected.origin && prior.context !== info.pin))
+        refuse('origin context changed without declared lineage');
+    const previous = (verified) => { const prefixes = new Map(); for (const prior of verified.filter(got => got.origin === selected.origin).sort((a, b) => a.senderEpoch - b.senderEpoch))
+        for (const region of prior.regions)
+            prefixes.set(region.scope, { ...region, senderEpoch: prior.senderEpoch }); return [...prefixes.values()]; };
+    const payload = lines.filter(line => !isWalkHeader(line));
+    const proof = (prefixes) => readForeignWalk(lines, { origin: selected.origin, regionOrigin: selected.origin, context: info.pin, base: info.base, fields: selected.contract.fields, partition: selected.contract.partition, digest: p.digest, previousPrefixes: prefixes, authenticatePrefix: selected.authority.authenticate, authenticateEvidence: selected.authority.authenticate, validateOriginHistory: () => true });
+    const raw = proof([]), known = retained.find(prior => prior.identity === raw.identity), got = known ? raw : proof(previous(retained));
+    const history = (prior) => [...new Set([...prior.filter(item => item.origin === selected.origin).flatMap(item => item.records), ...payload])];
+    await validateHistory(root, selected, history(retained));
+    if (!known && info.base !== (await inventory(root)).root)
+        refuse('stale receiver base');
+    if (!payload.length && !readWalkHeaders(lines, info.pin, info.base, selected.authority.authenticate).regions.length)
+        return ['ONCE 0 new evidence lines · 0 import receipts · no regions offered', `EXCHANGE 0 payload bytes · ${Buffer.byteLength(lines.join('\n') + '\n')} protocol bytes · 0 new evidence bytes · 0 new receipt bytes`];
+    const by = key ?? ownerOf(p.store), pub = publicKeyOf(root, by);
+    if (!pub)
+        refuse('unknown receiver signer ' + by);
+    const result = await commitIngress(p.store, got.identity, async () => {
+        if (info.base !== (await inventory(root)).root)
+            refuse('receiver changed before ingress');
+        const current = await verifiedIngress(root);
+        proof(previous(current));
+        await validateHistory(root, selected, history(current));
+        const next = epochOf(localActLines(root)) + 1;
+        const signed = await signConsentLot([got.importReceiptProposal], { by, epoch: next, algorithm: signaturesOf(p.store).era }, pub, signaturesOf(p.store).admitted, signerFor(p.standing, by, signer, keyFile));
+        if (signed.kind !== 'fact')
+            return refuse(signed.why);
+        const authority = authorityFor(lockLines(p.store), rootSigner(root), signaturesOf(p.store).admitted);
+        if (authority.of(signed.lines[0]).kind !== 'admitted')
+            refuse('receiver signer does not cover the import receipt');
+        const grammar = fromLine(signed.lines[0], wireAt(p.standing.map(fields), next));
+        if (grammar.kind !== 'fact')
+            refuse('receiver receipt wire ' + grammar.why);
+        return { evidence: lines.join('\n') + '\n', receipt: signed.lines.join('\n') + '\n' };
+    }, bundle => {
+        try {
+            const retainedLines = bundle.evidence.split('\n').filter(Boolean), retainedInfo = headerInfo(retainedLines);
+            if (retainedInfo.pin !== info.pin)
+                return false;
+            const retainedProof = readForeignWalk(retainedLines, { origin: selected.origin, regionOrigin: selected.origin, context: info.pin, base: retainedInfo.base, fields: selected.contract.fields, partition: selected.contract.partition, digest: p.digest, previousPrefixes: [], authenticatePrefix: selected.authority.authenticate, authenticateEvidence: selected.authority.authenticate, validateOriginHistory: () => true });
+            const receipts = bundle.receipt.split('\n').filter(Boolean), receipt = receipts[0] ?? '';
+            return receipts.length === 1 && retainedProof.identity === got.identity && fieldOf(receipt, 'scope') === 'receipts' && fieldOf(receipt, 'value') === got.identity && fieldOf(receipt, 'at') === 'receipt:' + info.pin && authorityFor(lockLines(p.store), rootSigner(root), signaturesOf(p.store).admitted).of(receipt).kind === 'admitted';
+        }
+        catch {
+            return false;
+        }
+    });
+    return [`${result.kind === 'once' ? 'ONCE' : 'INGRESS'} ${result.kind === 'once' ? 0 : got.records.length} new evidence lines · 1 ${result.kind === 'once' ? 'retained' : 'signed local'} import receipt`, result.receipt.trim(), ingressCost(result, Buffer.byteLength(payload.join('\n') + (payload.length ? '\n' : '')), Buffer.byteLength(lines.filter(isWalkHeader).join('\n') + '\n'))];
+}

package/dist/observe/regions.js

@@ -5,13 +5,11 @@ import { createHash } from 'node:crypto';
 import { basename, dirname, join, relative } from 'node:path';
 import { CAPSULE, LOCK, canonical, matches, PROTOCOL } from '@lapxo/topos/wire';
 import { handed, readsOf } from '@lapxo/topos/capsule';
-import { STATES } from '@lapxo/obligations';
 import { foldCeilings } from "../fold/ceilings.js";
 import { fieldOf, wireLinesOf as linesOf } from "../fold/claims.js";
 import { isCeiling } from "../fold/configures.js";
 import { keyFor } from "../fold/keys.js";
 import { casesHeld, placedReadings } from "../fold/observed.js";
-import { verdictsFor } from "../fold/paid.js";
 import { capsuleAt as isWorld, placesIn, spoken } from "../fold/places.js";
 import { rolesOf } from "../fold/roles.js";
 import { ownLockOf } from "../fold/signed.js";
@@ -71,9 +69,8 @@ function askedOf(fold) {
     return fold.under ? [...new Set(capsuleOf(fold).filter((line) => fieldOf(line, 'scope').startsWith('region/') && fieldOf(line, 'role') === 'render').map((line) => fieldOf(line, 'scope').slice('region/'.length)))]
         .map((name) => ((n) => fact(`asked/${name}`, `${n}..${n}`, 'interval', 'count'))(pinnersOf(fold).map(at).filter((names) => names.has(name)).length)) : [];
 }
-/** The place's verdict line as counts: what the fold lands, forks and refuses, each of the object's four states, and the ceilings it meets. */
+/** File-fold readings and their ceilings; this path computes no object encounters. */
 function verdictOf(fold) {
-    const states = Object.values(verdictsFor(fold));
     const named = (line) => ((cut) => [line.slice(0, cut < 0 ? line.length : cut).trim(), line.slice(cut < 0 ? line.length : cut + 3).trim() || line])(line.indexOf(' · '));
     const here = (fold.under ?? '').replace(/\/$/, '');
     const others = new Set(here ? placesIn(fold.root).filter((place) => place !== here) : []);
@@ -86,7 +83,8 @@ function verdictOf(fold) {
         return !others.has(head);
     };
     return [['claims', fold.claims], ['forks', fold.forks.length + (fold.second.verdict === 'forks' ? 1 : 0)], ['refused', fold.refused.length], ['vacuous', fold.vacuous], ['history', fold.history.length],
-        ['met', fold.ceilings.read], ['short', fold.ceilings.short.length], ['over', fold.ceilings.over.length], ...STATES.map((one) => [one, states.filter((state) => state === one).length])].map(([name, n]) => fact(`verdict/${name}`, `${n}..${n}`, 'interval', 'count'))
+        ['met', fold.ceilings.read], ['short', fold.ceilings.short.length], ['over', fold.ceilings.over.length]].map(([name, n]) => fact(`verdict/${name}`, `${n}..${n}`, 'interval', 'count'))
+        .concat([fact('verdict/computation', 'readings'), fact('verdict/encounters', 'uncomputed')])
         .concat(fold.ceilings.short.filter((one) => mine(named(one)[0])).map((one) => (([scope, reading]) => fact(`unpaid/${scope}`, reading))(named(one))))
         .concat(fold.ceilings.over.filter((one) => mine(named(one)[0])).map((one) => (([scope, reading]) => fact(`outside/${scope}`, reading))(named(one))))
         .concat(fold.ceilings.unread.filter(mine).map((scope) => fact(`unpaid/${scope}`, 'unread')))

package/dist/render/field.d.ts

@@ -1,9 +1,3 @@
 import type { PlaceFold } from '../cli/place.ts';
-/**
- * The field of a place at resolution N: every bound placed at the place or at none, in the state its poles give, and
- * every coordinate cut to its first N steps in the worst state it holds. Interval poles with no value in common
- * conflict, as two signers on one key do; an alphabet that permits none is a ceiling like any other. A value read
- * outside the poles is forbidden; a bound nothing read, a reader that refused and a demand unpaid are required; the
- * rest is free. It is read off the region summaries and the landed readings, and no reader runs.
- */
+/** Host file-region readings, grouped by coordinate prefix. These statuses do not compute object encounters. */
 export declare function field(fold: PlaceFold, at: number): readonly string[];