@lapxo/bound 0.1.5 → 0.1.6

package/dist/host/reading-closures.js

@@ -18,7 +18,7 @@ export function readingClosures(options) {
         if (!readFileSync(join(root, file.place)).equals(Buffer.from(file.text)))
             throw Error('REFUSE·input changed ' + file.place); };
     verify();
-    const projected = capsule.ask([{ protocol: PROTOCOL, verb: 'render', rootScope: '', region: projection, at: 1, reads: ['**'], lines: inputLines(files), files: [] }])[0];
+    const projected = capsule.ask([{ protocol: PROTOCOL, verb: 'render', rootScope: '', region: projection, at: 1, reads: ['**'], lines: inputLines(files), files: [] }], options.readerReference)[0];
     if (projected?.kind !== 'fact' || !Array.isArray(projected.lines))
         throw Error('REFUSE·input projection ' + (projected?.why ?? 'no lines'));
     const plans = new Map();
@@ -44,7 +44,7 @@ export function readingClosures(options) {
         visit(need); visiting.delete(scope); done.add(scope); ordered.push(p); };
     for (const scope of plans.keys())
         visit(scope);
-    const identity = hash([capsule.selection ?? '', capsule.digest, region, projection].join('\n')), by = speaker + ':' + identity.split(':')[1].slice(0, 12), journal = 'reading-closures/' + identity.split(':')[1];
+    const identity = hash([capsule.selection ?? '', capsule.digest, region, projection, ...(options.lifetime === undefined ? [] : [JSON.stringify(options.lifetime)])].join('\n')), by = speaker + ':' + identity.split(':')[1].slice(0, 12), journal = 'reading-closures/' + identity.split(':')[1];
     const prior = shardLines(store, speaker, journal), results = new Map(), out = [];
     const carried = (digest) => join(store, 'cas', 'carried', digest.split(':')[1] ?? '');
     const saved = (text) => { const digest = hash(text), path = carried(digest); mkdirSync(dirname(path), { recursive: true }); if (!existsSync(path) || hash(readFileSync(path, 'utf8')) !== digest)
@@ -74,7 +74,7 @@ export function readingClosures(options) {
                 if (readOnly())
                     throw Error('REFUSE·preview reading closure is unpaid ' + plan.scope);
                 const started = process.hrtime.bigint();
-                const dependencies = plan.needs.flatMap(need => results.get(need).lines), answer = capsule.ask([{ protocol: PROTOCOL, verb: 'read', rootScope: plan.scope, name: plan.scope, region, at: plan.resolution, reads: ['**'], lines: [...inputLines(plan.inputs.map(place => ({ place, text: handed.get(place) }))), ...dependencies], files: [] }])[0];
+                const dependencies = plan.needs.flatMap(need => results.get(need).lines), answer = capsule.ask([{ protocol: PROTOCOL, verb: 'read', rootScope: plan.scope, name: plan.scope, region, at: plan.resolution, reads: ['**'], lines: [...inputLines(plan.inputs.map(place => ({ place, text: handed.get(place) }))), ...dependencies], files: [] }], options.readerReference)[0];
                 if (answer?.kind !== 'fact' || !Array.isArray(answer.claims))
                     throw Error('REFUSE·reading ' + plan.scope + ' · ' + (answer?.why ?? 'no claims'));
                 lines = answer.claims.map((unknown) => { if (typeof unknown?.scope !== 'string' || typeof unknown?.measure !== 'string' || typeof unknown?.role !== 'string' || !unknown.bound || !['interval', 'enumerated'].includes(unknown.bound.kind))

package/dist/host/selected-capsules.js

@@ -25,12 +25,12 @@ export function selectedCapsules(pins, resolve = capsuleAt, select = toposAt, ho
         const descriptor = capsuleDescriptor(topos, offer.scope ?? '');
         const loaded = descriptor === undefined ? load() : undefined;
         const capsule = loaded?.capsule ?? {
-            digest: offer.value, selection: `${digest} ${offer.scope}`, ...descriptor, ask: requests => {
+            digest: offer.value, selection: `${digest} ${offer.scope}`, ...descriptor, ask: (requests, reader) => {
                 if (!requests.length)
                     return [];
                 const actual = load();
                 assertCapsuleDescriptor(descriptor.lines, actual.capsule.lines);
-                return actual.capsule.ask(requests);
+                return actual.capsule.ask(requests, reader);
             },
         };
         const projected = loaded?.offer ?? canonical(offer);
@@ -40,10 +40,10 @@ export function selectedCapsules(pins, resolve = capsuleAt, select = toposAt, ho
         const wire = wireAt(fields, Number.MAX_SAFE_INTEGER), algorithm = wire && [...wire.digests][0];
         if (!algorithm)
             throw Error('REFUSE·input instrument has no admitted digest algorithm');
-        const selected = { ...capsule, selection: `${digest} ${offer.scope}`, ask: requests => capsule.ask(requests.map(request => {
+        const selected = { ...capsule, selection: `${digest} ${offer.scope}`, ask: (requests, reader) => capsule.ask(requests.map(request => {
                 const provider = providerInputs(topos, digest, offer.scope ?? '', offer.value, request.region ?? '', bytes => fullDigest(bytes, algorithm));
                 return provider === undefined ? request : { ...request, provider };
-            })) };
+            }), reader) };
         return { capsule: selected, offer: projected };
     }));
 }

package/dist/land/ledger.d.ts

@@ -10,6 +10,7 @@ export declare function writerFile(store: string, writer: string): string;
 export declare function ledgerLines(store: string, writer: string): readonly string[];
 export declare function shardFile(store: string, writer: string, region: string): string;
 export declare const shardLines: (store: string, writer: string, region: string) => readonly string[];
+export declare function ledgerWriters(store: string): readonly string[];
 export declare function landShard(store: string, writer: string, region: string, lines: readonly string[]): number;
 export declare function signedLines(store: string, writer: string): string[];
 export declare function blobAt(store: string, digest: string): string;

package/dist/land/ledger.js

@@ -1,3 +1,5 @@
+import { actLines, committedLocalActs } from "../host/ports/local-act.js";
+import { readdirSync } from 'node:fs';
 import { requireEffects } from "../host/read-only.js";
 import { appendFileSync, closeSync, dirname, existsSync, join, linkSync, mkdirSync, openSync, readFileSync, readSync, renameSync, rmSync, statSync, writeFileSync } from "../host/io.js";
 import { storeRoot } from "../host/ports/store.js";
@@ -21,12 +23,29 @@ export function writerFile(store, writer) {
 }
 const held = new Map();
 export function ledgerLines(store, writer) {
-    return linesAt(writerFile(store, writer));
+    return journalLines(store, writer, '.', linesAt(writerFile(store, writer)));
 }
 export function shardFile(store, writer, region) {
     return storeAt(store, 'ledger', writer.replace(/[^a-zA-Z0-9_-]/g, ''), `${region.replace(/\/+$/, '') || '@'}${EXTENSION}`);
 }
-export const shardLines = (store, writer, region) => linesAt(shardFile(store, writer, region));
+export const shardLines = (store, writer, region) => journalLines(store, writer, region, linesAt(shardFile(store, writer, region)));
+const journalMemo = new Map();
+function journalLines(store, writer, place, legacy) {
+    const fresh = committedLocalActs(store).flatMap(act => act.bundle.placements?.filter(p => p.place === place).flatMap(p => actLines(p.records).filter(line => fieldOf(line, 'by') === writer)) ?? []);
+    if (!fresh.length)
+        return legacy;
+    const lines = [...new Set([...legacy, ...fresh])], key = store + '\0' + writer + '\0' + place, last = journalMemo.get(key);
+    if (last?.length === lines.length && last.every((line, i) => line === lines[i]))
+        return last;
+    journalMemo.set(key, lines);
+    return lines;
+}
+export function ledgerWriters(store) {
+    const at = join(store, 'ledger');
+    const legacy = existsSync(at) ? readdirSync(at).filter(name => name.endsWith(EXTENSION)).map(name => name.slice(0, -EXTENSION.length)) : [];
+    const committed = committedLocalActs(store).flatMap(act => act.bundle.placements?.filter(p => p.place === '.').flatMap(p => actLines(p.records).map(line => fieldOf(line, 'by'))) ?? []);
+    return [...new Set([...legacy, ...committed])];
+}
 export function landShard(store, writer, region, lines) {
     return appendNew(shardFile(store, writer, region), lines);
 }

package/dist/land/owned.d.ts

@@ -20,4 +20,4 @@ export type Owned = {
  */
 export declare function ownedOf(root: string, signed: readonly string[], admits: (line: string) => boolean, coverage: (by: string) => readonly string[], named?: readonly string[], placedAt?: (line: string) => readonly string[] | undefined): Owned;
 /** A place's own lock gains the lines a batch landed there, appended whole: a reader never meets half of it, and every line already there keeps its bytes as they were. */
-export declare function landOwned(root: string, place: string, lines: readonly string[]): void;
+export declare function landOwned(root: string, place: string, lines: readonly string[], committed?: boolean): void;

package/dist/land/owned.js

@@ -51,14 +51,15 @@ export function ownedOf(root, signed, admits, coverage, named = [], placedAt = (
     return { ledger, own, nowhere: [...placed, ...rest.filter((line) => !lands(line))], forked };
 }
 /** A place's own lock gains the lines a batch landed there, appended whole: a reader never meets half of it, and every line already there keeps its bytes as they were. */
-export function landOwned(root, place, lines) {
+export function landOwned(root, place, lines, committed = false) {
     if (!lines.length)
         return tellOwn(place, []);
     const at = join(root, place, LOCK);
     const text = observeText(at) ?? '';
-    for (const by of new Set(lines.map(line => fieldOf(line, 'by')))) {
-        landShard(storeOf(root), by, `${place}/${LOCK}`, lines.filter(line => fieldOf(line, 'by') === by));
-    }
+    if (!committed)
+        for (const by of new Set(lines.map(line => fieldOf(line, 'by')))) {
+            landShard(storeOf(root), by, `${place}/${LOCK}`, lines.filter(line => fieldOf(line, 'by') === by));
+        }
     writeFileSync(`${at}.${process.pid}.landing`, `${text.replace(/\n*$/, '\n')}${lines.join('\n')}\n`);
     renameSync(`${at}.${process.pid}.landing`, at);
     tellOwn(place, []);

package/dist/observe/files.js

@@ -1,4 +1,4 @@
-import { existsSync, lstatSync, readFileSync, readdirSync, readlinkSync } from 'node:fs';
+import { existsSync, lstatSync, statSync, readFileSync, readdirSync, readlinkSync } from 'node:fs';
 import { join, relative, sep } from 'node:path';
 /**
  * The one place the instrument reads the world: a coordinate's bytes, the entries of a directory, the coordinates under a place,
@@ -7,7 +7,17 @@ import { join, relative, sep } from 'node:path';
 const seen = new Map();
 /** A coordinate read once is kept by its stamp — its inode, size and time — and read again only when the stamp moves. */
 function bytesAt(at) {
-    const st = stampable(at);
+    // Reading follows a link, so its cache stamp must describe the same target.
+    // Directory links have no file bytes; traversal keeps its separate link policy.
+    let st = stampable(at);
+    if (st?.isSymbolicLink()) {
+        try {
+            st = statSync(at);
+        }
+        catch {
+            return undefined;
+        }
+    }
     if (st === undefined || st.isDirectory() || !existsSync(at))
         return undefined;
     const stamp = `${st.ino}-${st.size}-${st.mtimeMs}`;

package/docs/contracts/cli.md

@@ -9,3 +9,11 @@
 # sign
 
 `bound sign <lot>` returns canonical signed lines after validating the whole lot. The admitted key selects a declared signer; `--signer` selects the same port explicitly. File and command mechanisms use one port. Topos signing-lot/1 frames canonical bytes in lot order, one invocation per lot, and returns signatures and public-key IDs. Verification checks the admitted public key, independently of the mechanism. A command is invoked without a shell and under declared bounds. No secret output is disclosed in refusals. Missing, invalid, partial, timed-out or failed responses refuse; `land` cannot commit their partial output. The sample compares file and command signatures and landed lines, checks invocation count and ledger hashes, and refuses an unknown wire version. The sample uses ephemeral keys outside the place; no owner key is included.
+
+# Committed act results
+
+The opt-in `local-act@1` contract is selected by `wire/act-result`, `wire/act-result-scope` and `wire/act-result-context`. An admitted `view/act measure=id value=act` makes `bound fold --as act <identity>` available. Missing or conflicting declarations refuse; an absent profile preserves the historical interface. Topos defines the canonical record and result contract.
+
+Admission publishes the original signed records, their logical placements and one native result receipt atomically. A failure before commit writes no partial act. The result names the committed digest and local epoch; replay returns the original result without another epoch or origin. A post-commit error is not a rollback. Read the committed result before deciding whether to retry.
+
+The query verifies the record signatures and coverage against the authority snapshot at admission, and the native receipt against its retained provenance. Later key retirement or profile replacement cannot authorize a new act but does not erase a verifiable historical result. Admission is not conformance: the output says `admitted · conformance not asserted`. Missing or corrupt results refuse by name. Host paths and delivery counts are not identity inputs.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@lapxo/bound",
-  "version": "0.1.5",
+  "version": "0.1.6",
   "type": "module",
   "description": "Read the bounds you already wrote, fold them, and name the contradictions.",
   "main": "dist/cli/verb.js",
@@ -33,7 +33,7 @@
   "license": "MIT",
   "dependencies": {
     "@lapxo/obligations": "0.3.5",
-    "@lapxo/topos": "^0.1.11",
+    "@lapxo/topos": "^0.1.12",
     "acorn": "8.19.0"
   },
   "devDependencies": {