@lapxo/bound 0.1.7 → 0.1.9

package/dist/land/act.js

@@ -59,7 +59,7 @@ const lockFiles = (locks) => coordinatesUnder(locks, locks).filter((file) => {
 });
 const overlaps = (a, b) => !a || !b || a === b || a.startsWith(`${b}/`) || b.startsWith(`${a}/`);
 const treeAt = (store) => join(store, 'lock');
-const named = (at) => (basename(at) === 'lock' ? 'the store' : `region ${basename(at) === ROOT ? '.' : basename(at)}`);
+const named = (at) => (basename(at) === 'lock' ? 'the store' : basename(at).startsWith('@authority-') ? 'root authority' : basename(at) === '@projection' ? 'root projection' : `region ${basename(at) === ROOT ? '.' : basename(at)}`);
 const owns = (at) => {
     for (let frame = context.getStore(); frame !== undefined; frame = frame.parent) {
         const token = frame.locks.get(at);
@@ -69,6 +69,8 @@ const owns = (at) => {
     return false;
 };
 const ownsRegion = (store) => [...held.keys()].some((at) => at.startsWith(`${join(store, 'locks')}/`) && owns(at));
+const ownsAuthority = (store) => [...held.keys()].some((at) => dirname(at) === join(store, 'locks') && basename(at).startsWith('@authority-') && owns(at));
+const projectionAt = (store) => join(store, 'locks', '@projection');
 /** Reentry belongs to an awaited act's context. Another process or async act has no inherited authority. */
 async function hold(at, what) {
     if (owns(at))
@@ -142,10 +144,12 @@ async function framed(takes, act) {
         }
     });
 }
-export function underTheRegions(store, regions, what, act) {
+function guardedRegions(store, regions, what, act, rootAuthority) {
     return framed(async () => {
         const tree = treeAt(store);
         const asked = [...new Set((regions.length ? regions : ['']).map((one) => one.replace(/\/+$/, '')))];
+        if (rootAuthority && (asked.includes('') || (ownsRegion(store) && !owns(tree) && !ownsAuthority(store))))
+            throw new Error(`${selfName()}: REFUSE·lock authority dependencies and child regions must be declared together`);
         if (owns(tree) || asked.every((region) => owns(regionAt(store, region)))) {
             for (const region of asked)
                 await hold(regionAt(store, region), what);
@@ -159,18 +163,32 @@ export function underTheRegions(store, regions, what, act) {
         try {
             const locks = join(store, 'locks');
             for (;;) {
-                const conflict = lockFiles(locks).find((file) => asked.some((region) => overlaps(region, file) || overlaps(region, coordinateOf(file))) && !owns(join(locks, file)));
+                const conflict = lockFiles(locks).find((file) => !owns(join(locks, file))
+                    && (file.startsWith('@authority-') || file === '@projection' ? asked.includes('')
+                        : asked.some((region) => overlaps(region, file) || overlaps(region, coordinateOf(file)))));
                 if (conflict === undefined)
                     break;
                 const at = join(locks, conflict);
                 const began = Date.now();
+                let told = false;
                 for (let holder = holderOf(at); holder !== undefined; holder = holderOf(at)) {
                     if (!alive(holder.pid))
                         throw new Error(`${selfName()}: REFUSE·stale ${named(at)} belongs to exited process ${holder.pid}; host recovery required`);
                     overAMinute(at, began, holder);
+                    if (!told) {
+                        process.stderr.write(`WAIT     ${named(at)} is held by ${holder.pid} · ${holder.what} since ${holder.since}\n`);
+                        told = true;
+                    }
                     await pauseFor(250);
                 }
+                if (told)
+                    process.stderr.write(`HELD     ${named(at)} after ${Date.now() - began} ms waiting\n`);
             }
+            // Registered under the same acquisition gate as every legacy writer.
+            // Root writes overlap all locks; siblings keep distinct region locks.
+            // '@' is encoded for real region coordinates, so this is host bookkeeping.
+            if (rootAuthority)
+                await hold(join(store, 'locks', `@authority-${randomUUID()}`), what);
             for (const region of asked.filter(Boolean).sort())
                 await hold(regionAt(store, region), what);
             if (asked.includes(''))
@@ -188,6 +206,81 @@ export function underTheRegions(store, regions, what, act) {
         }
     }, act);
 }
+export function underTheRegions(store, regions, what, act) {
+    return guardedRegions(store, regions, what, act, false);
+}
+/** Protect the root authority/policy read through child publication. This is
+ * exclusion only: callers must authenticate contexts and compare prepared heads
+ * while held. It creates no grant, clock advance, lease or automatic recovery. */
+export function underAuthorityRegions(store, regions, what, act) {
+    return guardedRegions(store, regions, what, act, true);
+}
+/** Protect an authority snapshot without taking a child region. The acquisition
+ * gate and temporary root marker exclude a root mutation while registering the
+ * shared read; existing child acts continue independently. This is exclusion,
+ * never authorization or a clock advance. */
+export function underRootAuthority(store, what, act) {
+    return framed(async () => {
+        const tree = treeAt(store), root = regionAt(store, '');
+        if (owns(tree) || owns(root) || ownsAuthority(store))
+            return;
+        if (ownsRegion(store))
+            throw new Error(`${selfName()}: REFUSE·lock authority dependencies must be declared before entering a region act`);
+        await hold(tree, what);
+        try {
+            await hold(root, what);
+            await hold(join(store, 'locks', `@authority-${randomUUID()}`), what);
+        }
+        finally {
+            const frame = context.getStore();
+            for (const at of [root, tree]) {
+                const token = frame.locks.get(at);
+                if (token !== undefined) {
+                    release(at, token);
+                    frame.locks.delete(at);
+                }
+            }
+        }
+    }, act);
+}
+/** The fixed host may hand its child evidence of an actual held exclusion.
+ * It is an operational envelope, not a grant, signer or receipt identity. */
+export function rootAuthorityProtection(store) {
+    const locks = [treeAt(store), regionAt(store, ''), ...held.keys()].filter(at => at === treeAt(store) || at === regionAt(store, '') || dirname(at) === join(store, 'locks') && basename(at).startsWith('@authority-'));
+    const lock = locks.find(owns);
+    if (lock === undefined)
+        throw Error(`${selfName()}: REFUSE·lock root authority is not protected`);
+    const holder = holderOf(lock);
+    if (holder?.pid !== process.pid || holder.token !== held.get(lock))
+        throw Error(`${selfName()}: REFUSE·lock authority protection changed`);
+    return Object.freeze({ store, lock, pid: holder.pid, token: holder.token });
+}
+/** expectedStore and expectedParent come from the fixed host's inheritance
+ * channel, never from world data. Matching a live lock proves exclusion only;
+ * signature, coverage and current context still require verification. */
+export function assertRootAuthorityProtection(proof, expectedStore, expectedParent) {
+    if (!proof || proof.store !== expectedStore || !Number.isSafeInteger(expectedParent) || expectedParent <= 0 || proof.pid !== expectedParent
+        || typeof proof.lock !== 'string' || typeof proof.token !== 'string' || !proof.token
+        || !(proof.lock === treeAt(expectedStore) || proof.lock === regionAt(expectedStore, '')
+            || dirname(proof.lock) === join(expectedStore, 'locks') && basename(proof.lock).startsWith('@authority-'))) {
+        throw Error(`${selfName()}: REFUSE·lock invalid inherited authority protection`);
+    }
+    const holder = holderOf(proof.lock);
+    if (!alive(expectedParent) || holder?.pid !== proof.pid || holder.token !== proof.token)
+        throw Error(`${selfName()}: REFUSE·lock inherited authority protection ended`);
+}
+/** A child can publish independently, but the joined root projection and its
+ * derived ledger appends have one writer. Authority protection already excludes
+ * root mutations, so this lock needs no acquisition-gate upgrade. */
+export function underRootProjection(store, what, act) {
+    return framed(async () => {
+        if (owns(treeAt(store)) || owns(regionAt(store, '')))
+            return;
+        if (!ownsAuthority(store))
+            throw new Error(`${selfName()}: REFUSE·lock root projection requires authority protection`);
+        await hold(projectionAt(store), what);
+    }, act);
+}
 export const holdRoot = async (store, what) => {
     if (!owns(treeAt(store)))
         await hold(regionAt(store, ''), what);

package/dist/land/ledger.d.ts

@@ -11,6 +11,10 @@ export declare function ledgerLines(store: string, writer: string): readonly str
 export declare function shardFile(store: string, writer: string, region: string): string;
 export declare const shardLines: (store: string, writer: string, region: string) => readonly string[];
 export declare function ledgerWriters(store: string): readonly string[];
+/** One synchronous root-history read, not a retained authority snapshot.
+ * Preserve writer order and each writer's legacy-before-committed ordering.
+ * Every call rereads the complete committed inventory exactly once. */
+export declare function rootLedgerLines(store: string): readonly string[];
 export declare function landShard(store: string, writer: string, region: string, lines: readonly string[]): number;
 export declare function signedLines(store: string, writer: string): string[];
 export declare function blobAt(store: string, digest: string): string;

package/dist/land/ledger.js

@@ -40,12 +40,30 @@ function journalLines(store, writer, place, legacy) {
     journalMemo.set(key, lines);
     return lines;
 }
-export function ledgerWriters(store) {
+function legacyWriters(store) {
     const at = join(store, 'ledger');
-    const legacy = existsSync(at) ? readdirSync(at).filter(name => name.endsWith(EXTENSION)).map(name => name.slice(0, -EXTENSION.length)) : [];
+    return existsSync(at) ? readdirSync(at).filter(name => name.endsWith(EXTENSION)).map(name => name.slice(0, -EXTENSION.length)) : [];
+}
+export function ledgerWriters(store) {
+    const legacy = legacyWriters(store);
     const committed = committedLocalActs(store).flatMap(act => act.bundle.placements?.filter(p => p.place === '.').flatMap(p => actLines(p.records).map(line => fieldOf(line, 'by'))) ?? []);
     return [...new Set([...legacy, ...committed])];
 }
+/** One synchronous root-history read, not a retained authority snapshot.
+ * Preserve writer order and each writer's legacy-before-committed ordering.
+ * Every call rereads the complete committed inventory exactly once. */
+export function rootLedgerLines(store) {
+    const legacy = legacyWriters(store), acts = committedLocalActs(store);
+    const fresh = acts.flatMap(act => act.bundle.placements?.filter(p => p.place === '.').flatMap(p => actLines(p.records)) ?? []);
+    const writers = [...new Set([...legacy, ...fresh.map(line => fieldOf(line, 'by'))])];
+    return writers.flatMap(writer => {
+        // Authority-history identity needs actual bytes. A writer's size and mtime
+        // cannot distinguish a same-size edit or stand in for an admission proof.
+        const at = writerFile(store, writer), prior = existsSync(at) ? readFileSync(at, 'utf8').split('\n').filter(line => line.startsWith(PROTOCOL)) : [];
+        const committed = fresh.filter(line => fieldOf(line, 'by') === writer);
+        return committed.length ? [...new Set([...prior, ...committed])] : prior;
+    });
+}
 export function landShard(store, writer, region, lines) {
     return appendNew(shardFile(store, writer, region), lines);
 }

package/dist/observe/runner.d.ts

@@ -1,4 +1,8 @@
 export declare const ownRoot: () => string;
+/** A published instrument carries its own content store even before any ledger
+ * exists. Public-lock recognition grants no authority; legacy signed delivery
+ * trees retain their historical colocated-ledger or sibling-store layout. */
+export declare function instrumentStoreAt(root: string): string;
 export declare const ownStore: () => string;
 export declare const ownLock: () => readonly string[];
 export declare const sourceOf: () => string;

package/dist/observe/runner.js

@@ -21,8 +21,15 @@ const moduleAt = fromBlob() ? undefined : fileURLToPath(import.meta.url);
 const runtimeAt = moduleAt === undefined ? '' : resolve(dirname(moduleAt), '..');
 const runtimeExtension = moduleAt === undefined ? '' : extname(moduleAt);
 export const ownRoot = () => (fromBlob() ? join(resolve(dirname(self()), '..', '..', '..'), 'bound') : resolve(runtimeAt, '..'));
-export const ownStore = () => existsSync(join(ownRoot(), EXTENSION, 'ledger'))
-    ? join(ownRoot(), EXTENSION) : join(ownRoot(), '..', EXTENSION);
+/** A published instrument carries its own content store even before any ledger
+ * exists. Public-lock recognition grants no authority; legacy signed delivery
+ * trees retain their historical colocated-ledger or sibling-store layout. */
+export function instrumentStoreAt(root) {
+    const lines = (observeText(join(root, LOCK)) ?? '').split('\n').filter(isWire);
+    const published = lines.length > 0 && publicLock(lines) !== undefined;
+    return published || existsSync(join(root, EXTENSION, 'ledger')) ? join(root, EXTENSION) : join(root, '..', EXTENSION);
+}
+export const ownStore = () => instrumentStoreAt(ownRoot());
 /** The colocated public artifact is read without an unrelated parent's authority store. */
 // An act is judged by the instrument it started with, even when that act changes its colocated lock.
 let instrumentLock;

package/docs/contracts/cli.md

@@ -25,3 +25,16 @@ The query verifies the record signatures and coverage against the authority snap
 ## Standing admission
 
 A uses/ selection admits canonical standing bytes, never an archive. The bytes must already be held under their verified digest or in the single local coordinate explicitly named by needs. Admission checks identity and canonical form without fetching, executing or writing the content store. Missing or corrupt bytes refuse the whole lot. A corrupt held copy cannot be hidden by another source. Archives remain separate dependency declarations.
+
+
+## Declared reading identity
+
+A place selects both `wire/reading-context value=reading-context@1` and `wire/reading-receipt value=reading-receipt@1`. Partial or conflicting selections refuse. Every reader under this profile declares an input projection; a legacy reader is refused by name instead of receiving a new identity without its closure.
+
+The host commits the full instrument reference, the verified capsule implementation, effective reader policy, declared transitive references, each input's actual bytes and dependent receipt identities. The process environment is captured explicitly: inherited variable values (hashed, never printed), the place working directory, child flags, runtime bytes and platform conditions. The same captured boundary is handed to execution and keys the capsule cache. These references grant neither authority nor independence and cannot prove undeclared inputs absent.
+
+An unchanged cross-process fold reads retained receipts with zero opened readings. Changed input reopens that reading and its dependents; changing shared implementation, policy or execution conditions invalidates the readings that depend on them. The semantic receipt names the reading and result together; elapsed time and signature envelopes remain separate. Old receipts are not promoted.
+
+Retained evidence may be inspected without asserting a current response. Reusing a current response also requires the existing snapshot-access contract: matching principal, authorization, request, implementation and snapshot, declared freshness, and both inspection and reuse permission. Unknown or expired freshness, withdrawn permission or changed context refuse before running a provider. A new observation needs its own admitted act.
+
+`fold --check` verifies the retained published evidence and instrument. It opens no reader and grants no permission to assert an old response today. A live fold additionally compares the current captured execution boundary.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@lapxo/bound",
-  "version": "0.1.7",
+  "version": "0.1.9",
   "type": "module",
   "description": "Read the bounds you already wrote, fold them, and name the contradictions.",
   "main": "dist/cli/verb.js",
@@ -33,7 +33,7 @@
   "license": "MIT",
   "dependencies": {
     "@lapxo/obligations": "0.3.5",
-    "@lapxo/topos": "0.1.13",
+    "@lapxo/topos": "^0.1.17",
     "acorn": "8.19.0"
   },
   "devDependencies": {