@lapxo/bound 0.1.9 → 0.2.0

package/dist/fold/object.js

@@ -1,38 +1,2 @@
-import { cell, sign, join, require as requireFloor, observe, mark, parts, state, live, restOf } from '@lapxo/obligations/views/field';
-import { restCoordinates } from '@lapxo/topos/wire';
-export function objectFold(records, context) {
-    let world = new Map();
-    const definitions = new Map(records.filter(r => r.record === 'cell').map(r => [r.fields.scope, r]));
-    const codecs = new Map([...definitions].map(([name, c]) => [name, context.resolve(c)]));
-    const ids = new Map(records.map(r => [r.fields.id, r]));
-    for (const record of [...records].sort((a, b) => Number(a.fields.epoch) - Number(b.fields.epoch))) {
-        const f = record.fields, name = f.scope, at = Number(f.epoch);
-        if (record.record === 'cell') {
-            world = new Map([...world, [name, cell(name, at, [], restCoordinates(f.restsOn))]]);
-            continue;
-        }
-        const codec = codecs.get(name), L = codec.form.lattice(codec.params), held = world.get(name);
-        if (record.record === 'claim') {
-            const target = f.sign === '-1' ? ids.get(f.takes).fields : f;
-            const changed = observe(held, { id: f.id, at, origin: target.origin, span: codec.form.parse(codec.params, target.value), ...(f.takes ? { takes: f.takes } : {}) }, f.sign === '-1' ? -1 : 1);
-            const seen = [...changed.seen];
-            seen[seen.length - 1] = { ...seen.at(-1), id: f.id };
-            world = new Map([...world, [name, { ...changed, seen }]]);
-        }
-        else if (f.sign === '-1') {
-            const target = ids.get(f.takes).fields;
-            world = new Map([...world, [name, { ...held, marks: [...(held.marks ?? []), mark({ id: f.id, at, takes: f.takes, pole: target.pole, reach: 'local', span: codec.form.parse(codec.params, target.value) })] }]]);
-        }
-        else if (f.widens !== undefined) {
-            const changed = join(L, held, codec.form.parse(codec.params, f.value), f.widens, at);
-            const marks = [...(changed.marks ?? [])];
-            marks[marks.length - 1] = { ...marks.at(-1), id: f.id };
-            world = new Map([...world, [name, { ...changed, marks }]]);
-        }
-        else {
-            const span = codec.form.parse(codec.params, f.value);
-            world = f.pole === 'floor' ? requireFloor(L, world, name, span, { id: f.id, at }) : sign(L, world, name, span, { id: f.id, at });
-        }
-    }
-    return [...world].map(([name, c]) => { const codec = codecs.get(name), L = codec.form.lattice(codec.params); return { cell: name, state: state(L, c, world), parts: parts(L, c, world), rest: restOf(c, world), ownMarks: live(c.marks ?? []).map(m => m.id), ownClaims: live(c.seen).map(s => ({ id: s.id, origin: s.origin })), marks: live(c.marks ?? []), claims: live(c.seen) }; });
-}
+/** Compatibility path; the engine owns the single object projection. */
+export { objectFold } from "../engine/index.js";

package/dist/fold/resolved.js

@@ -60,7 +60,7 @@ export function receiptsOf(fold) {
         return canonical({ scope: `${sourced(fold.standing)}/${place}${shape}`, role: 'writes', form: 'alphabet', measure: 'digest', value: digest, by: writerFor(fold.standing, 'fold') ?? '', at: `place:${digest}` });
     });
     const place = under.replace(/\/$/, '');
-    const lines = [...named, ...[...cones].sort(), ...[...ran].sort(), ...paid]
+    const lines = [...new Set([...named, ...[...cones].sort(), ...[...ran].sort(), ...paid, ...(fold.receiptHistory ?? [])])]
         .map((line) => (place && !fieldOf(line, 'sig') ? zoomed(line, place) : line));
     if (!lines.length) {
         const shipped = (observeText(join(fold.root, under, RECEIPTS)) ?? '').split('\n').filter(isWire);

package/dist/host/admitted-place.js

@@ -35,7 +35,10 @@ export function authenticatedRootStanding(root) {
             const snapshot = history.filter(record => !isConfig(record) || Number(fieldOf(record, 'epoch')) <= epoch);
             // The signature vocabulary is configuration, not the as-yet
             // unauthenticated evidence whose values are about to be folded.
-            const wire = snapshot.filter(record => fieldOf(record, 'scope').startsWith('wire/'));
+            const wire = snapshot.filter(record => {
+                const scope = fieldOf(record, 'scope');
+                return scope.startsWith('wire/') || scope.startsWith('audit/wire/');
+            });
             authority = authorityFor(snapshot, anchor, eraOf(foldClaims(wire).standing).admitted);
             snapshots.set(epoch, authority);
         }

package/dist/host/cell-receipts.js

@@ -6,7 +6,7 @@ import { canonical, objectHistory, parse, byBytes, wireAt, RECEIPTS } from '@lap
 import { cellInputs, cellReceiptContract, cellInputProfile } from '@lapxo/topos/cell-inputs';
 import { renderCells } from '@lapxo/topos/cells-view';
 import { admittedObjects } from "./objects.js";
-import { objectFold } from "../fold/object.js";
+import { objectFold } from "../engine/index.js";
 import { fullDigest, bytesDigest } from "./digest.js";
 import { closeReceipts, noteIdle } from "../fold/closed.js";
 import { authorityFor, rootSigner } from "../fold/signers.js";

package/dist/host/objects.d.ts

@@ -1,5 +1,6 @@
 /** Bound supplies host authority and I/O; topos owns grammar, selection and context validation. */
-export declare function admittedObjects(root: string, lines: readonly string[], emit?: (text: string) => void): Promise<{
+export declare function admittedObjects(root: string, lines: readonly string[], emit?: (text: string) => void, requireContextClosure?: boolean): Promise<{
     records: readonly import("@lapxo/topos/wire").ObjectRecord[];
     context: import("@lapxo/topos/wire").ObjectContext;
+    configuration: Readonly<Record<string, string>>[];
 }>;

package/dist/host/objects.js

@@ -1,18 +1,38 @@
-import { canonical, objectHistory, validateObjectContext } from '@lapxo/topos/wire';
+import { canonical, parse, objectHistory, validateObjectContext } from '@lapxo/topos/wire';
 import { objectProvider } from '@lapxo/topos/object-provider';
 import { authorityFor, rootSigner } from "../fold/signers.js";
 import { signaturesOf } from "../fold/digests.js";
 import { storeOf } from "../land/ledger.js";
 import { toposAt, contextModuleAt } from "./selected-topos.js";
+import { foldClaims } from "../fold/claims.js";
+import { usesWasmObject } from "../wasm/object.js";
 /** Bound supplies host authority and I/O; topos owns grammar, selection and context validation. */
-export async function admittedObjects(root, lines, emit = () => { }) {
+export async function admittedObjects(root, lines, emit = () => { }, requireContextClosure = false) {
     const history = objectHistory(lines);
     if (history.kind !== 'fact')
         throw Error(`REFUSE·wire ${history.why}`);
     const authority = authorityFor(lines, rootSigner(root), signaturesOf(storeOf(root)).admitted);
-    const context = await objectProvider(history.value.objects, history.value.configuration, { admit: fields => authority.of(canonical(fields)).kind === 'admitted', emit, topos: digest => toposAt(digest, storeOf(root)), module: digest => contextModuleAt(digest, storeOf(root)) });
+    const admittedConfiguration = history.value.configuration.filter(fields => authority.of(canonical(fields)).kind === 'admitted').map(fields => canonical(fields));
+    const configuration = foldClaims(admittedConfiguration).standing.flatMap(line => { const got = parse(line); return got.kind === 'fact' ? [got.value.fields] : []; });
+    const verifyClosure = requireContextClosure || usesWasmObject(configuration), declaredModules = new Map();
+    const context = await objectProvider(history.value.objects, history.value.configuration, { admit: fields => authority.of(canonical(fields)).kind === 'admitted', emit, topos: digest => {
+            const selected = toposAt(digest, storeOf(root));
+            if (verifyClosure)
+                for (const offer of selected.parts.filter(fields => fields.kind === 'check' && fields.value)) {
+                    const dependencies = [...new Set((offer.restsOn ?? '').split('|').filter(Boolean))].sort(), prior = declaredModules.get(offer.value);
+                    if (prior && JSON.stringify(prior) !== JSON.stringify(dependencies))
+                        throw Error('REFUSE·context module has conflicting declared closures');
+                    declaredModules.set(offer.value, dependencies);
+                }
+            return selected;
+        }, module: digest => {
+            const dependencies = declaredModules.get(digest);
+            if (verifyClosure && dependencies === undefined)
+                throw Error('REFUSE·context module has no declared closure');
+            return contextModuleAt(digest, storeOf(root), verifyClosure ? dependencies : undefined);
+        } });
     const checked = validateObjectContext(history.value.objects, context);
     if (checked.kind !== 'fact')
         throw Error(`REFUSE·context ${checked.why}`);
-    return { records: checked.value, context };
+    return { records: checked.value, context, configuration };
 }

package/dist/host/reading-closures.d.ts

@@ -14,6 +14,8 @@ type File = {
     readonly text: string;
 };
 export declare const inputLines: (files: readonly File[]) => readonly string[];
+/** One portable native receipt carrier shared by file plans and native capsule batches. */
+export declare function portableReadingReceipt(scope: string, by: string, closure: string, output: string, hash: (text: string) => string, modern?: boolean, costs?: readonly string[]): readonly string[];
 /** The selected world owns input projection and reading. The host only verifies closures and keeps native count/bytes receipts. */
 export declare function readingClosures(options: {
     root: string;

package/dist/host/reading-closures.js

@@ -11,6 +11,11 @@ const receiptScope = (scope) => [scope, 'identity'].join('/');
 const fields = (line) => { const got = parse(line); if (got.kind !== 'fact')
     throw Error('REFUSE·input projection contains a non-wire line'); return got.value.fields; };
 export const inputLines = (files) => files.map(file => canonical({ scope: file.place, form: 'alphabet', measure: 'text', role: 'writes', value: 'lock', shape: file.place, about: file.text, by: 'host', at: 'policy:handed-input' }));
+/** One portable native receipt carrier shared by file plans and native capsule batches. */
+export function portableReadingReceipt(scope, by, closure, output, hash, modern = true, costs = []) {
+    const input = hash(closure), payload = hash(output), rows = output.split('\n').filter(Boolean);
+    return [...(modern ? [canonical({ scope: receiptScope(scope), role: 'writes', form: 'alphabet', measure: 'digest', value: readingReceiptIdentity(input, payload, bytes => hash(new TextDecoder().decode(bytes))), by, at: 'place:' + input })] : []), canonical({ scope, role: 'writes', form: 'alphabet', measure: 'observed', value: payload, by, at: 'place:' + payload }), canonical({ scope, role: 'writes', form: 'alphabet', measure: 'bytes', value: input, by, at: 'place:' + input, about: closure }), canonical({ scope, role: 'writes', form: 'interval', measure: 'count', value: `${rows.length}..${rows.length}`, by, at: 'place:' + payload, about: output }), ...costs];
+}
 /** The selected world owns input projection and reading. The host only verifies closures and keeps native count/bytes receipts. */
 export function readingClosures(options) {
     const { root, store, reader, speaker, digest: hash, capsule, region, projection, files } = options, emit = options.emit ?? (() => { });
@@ -135,7 +140,7 @@ export function readingClosures(options) {
                     opened++;
             }
             const receipt = context ? readingReceiptIdentity(input, payload, bytes => hash(new TextDecoder().decode(bytes))) : payload;
-            if (context)
+            if (context && plan.resolution !== 1)
                 out.push(canonical({ scope: receiptScope(scope), role: 'writes', form: 'alphabet', measure: 'digest', value: receipt, by, at: 'place:' + input }));
             results.set(plan.scope, { digest: receipt, lines });
             out.push(canonical({ scope: plan.scope, role: 'writes', form: 'alphabet', measure: 'observed', value: input, by, at: 'place:' + input }), 
@@ -147,18 +152,11 @@ export function readingClosures(options) {
             ...plan.inputs.map(coordinate => canonical({ scope: coordinate, role: 'writes', form: 'alphabet', measure: 'observed', value: hash(handed.get(coordinate)), by, at: 'witness:' + input })), ...lines);
             if (plan.resolution === 1) {
                 read++;
-                const native = shardLines(store, speaker, journal).filter(line => fieldOf(line, 'scope') === scope && ((fieldOf(line, 'measure') === 'bytes' && fieldOf(line, 'value') === input) || (fieldOf(line, 'measure') === 'count') || (fieldOf(line, 'measure') === 's' && fieldOf(line, 'at') === 'place:' + input))).map(line => {
-                    const f = fields(line), id = f.measure === 'bytes' ? f.value : f.measure === 'count' ? (f.at ?? '').replace(/^place:/, '') : undefined;
-                    if (id === undefined)
-                        return line;
-                    const bytes = load(id);
-                    if (bytes === undefined)
-                        throw Error('REFUSE·receipt missing verified carrier ' + id);
-                    // The full-resolution native row carries the actual verified UTF-8 bytes.
-                    // Its semantic count/digest is unchanged; a public copy needs no private CAS.
-                    return canonical({ ...f, about: bytes });
-                });
-                out.push(canonical({ scope, role: 'writes', form: 'alphabet', measure: 'observed', value: payload, by, at: 'place:' + payload }), ...native);
+                const output = load(payload);
+                if (output === undefined)
+                    throw Error('REFUSE·receipt missing verified carrier ' + payload);
+                const costs = shardLines(store, speaker, journal).filter(line => fieldOf(line, 'scope') === scope && fieldOf(line, 'measure') === 's' && fieldOf(line, 'at') === 'place:' + input);
+                out.push(...portableReadingReceipt(scope, by, closure, output, hash, !!context, costs));
             }
         });
     }

package/dist/host/reference-authenticated.d.ts

@@ -0,0 +1,28 @@
+import { authorityOf, validateObjectContext } from '@lapxo/topos/wire';
+type ObjectContext = Parameters<typeof validateObjectContext>[1];
+type Signer = Parameters<typeof authorityOf>[1][number];
+export interface ReferenceTrust {
+    readonly snapshot: string;
+    readonly epoch: number;
+    readonly proofScope: string;
+    readonly policy: string;
+    readonly formImplementation: string;
+    readonly signers: readonly Signer[];
+    readonly algorithms: readonly string[];
+    readonly objects: ObjectContext;
+    readonly maxBytes: number;
+    readonly maxRecords: number;
+    readonly digestBytes: (bytes: Uint8Array) => string | Promise<string>;
+    readonly verifyBytes: (bytes: string, key: string, signature: string, algorithms: readonly string[]) => boolean | Promise<boolean>;
+    readonly fetchBytes: (source: string, blob: string) => Promise<Uint8Array>;
+}
+/** Prospective authenticated-standing@1 host composition; no effects and no authority from transport. */
+export declare function inspectAuthenticatedReference(fragment: string, trust: ReferenceTrust): Promise<{
+    reference: import("./reference-profile.ts").StandingReference;
+    records: readonly import("@lapxo/topos/wire").ObjectRecord[];
+    semanticIdentity: string;
+    authorityContextIdentity: string;
+    semanticStanding: string;
+    originalRecords: readonly string[];
+}>;
+export { encodeReference, decodeReference } from './reference-profile.ts';

package/dist/host/reference-authenticated.js

@@ -0,0 +1,84 @@
+import { parse, canonical, authorityOf, authorityAtEpoch, signedBytes, objectHistory, validateObjectContext } from '@lapxo/topos/wire';
+import { cellInputs } from '@lapxo/topos/cell-inputs';
+import { semanticStandingBytes } from '@lapxo/topos/standing';
+import { decodeReference } from "./reference-profile.js";
+function fail(why) { throw Error('REFUSE·authenticated-reference ' + why); }
+const utf8 = (s) => new TextEncoder().encode(s);
+/** Prospective authenticated-standing@1 host composition; no effects and no authority from transport. */
+export async function inspectAuthenticatedReference(fragment, trust) {
+    if (new Set(trust.signers.map(s => s.id)).size !== trust.signers.length)
+        fail('duplicate host signer');
+    const reference = decodeReference(fragment);
+    if (!Number.isSafeInteger(trust.maxBytes) || trust.maxBytes < 1 || !Number.isSafeInteger(trust.maxRecords) || trust.maxRecords < 1)
+        fail('resource budget');
+    const received = await trust.fetchBytes(reference.source, reference.blob);
+    if (received.byteLength > trust.maxBytes)
+        fail('bytes budget');
+    if (typeof SharedArrayBuffer !== 'undefined' && received.buffer instanceof SharedArrayBuffer)
+        fail('shared transport bytes');
+    const bytes = new Uint8Array(received);
+    if (await trust.digestBytes(bytes) !== reference.blob)
+        fail('blob integrity');
+    const text = new TextDecoder('utf-8', { fatal: true }).decode(bytes);
+    let packet;
+    try {
+        packet = JSON.parse(text);
+    }
+    catch {
+        fail('carrier framing');
+    }
+    if (!Array.isArray(packet) || packet.length !== 3 || packet[0] !== 'authenticated-standing@1' || !Array.isArray(packet[1]) || packet[1].length < 1 || packet[1].length > trust.maxRecords || packet[1].some((x) => typeof x !== 'string') || typeof packet[2] !== 'string' || JSON.stringify(packet) + '\n' !== text)
+        fail('carrier framing');
+    const originals = packet[1], proofLine = packet[2];
+    const parsed = [...originals, proofLine].map(line => { const p = parse(line); if (p.kind !== 'fact' || canonical(p.value.fields) !== line)
+        fail('original canonical'); return p.value.fields; });
+    const proof = parsed[parsed.length - 1];
+    if (proof.scope !== trust.proofScope || proof.at !== 'witness:' + trust.snapshot || proof.role !== 'writes' || proof.form !== 'alphabet' || proof.measure !== 'digest' || proof.epoch !== String(trust.epoch))
+        fail('untrusted snapshot binding');
+    if (proof.value !== await trust.digestBytes(utf8(JSON.stringify(['authenticated-standing@1', originals]) + '\n')))
+        fail('snapshot commitment');
+    // Async crypto port is called on exact native signed bytes; authorityOf consumes only those results.
+    const verifiedCrypto = new Set();
+    const key = (f, pub) => JSON.stringify([signedBytes(f), pub, f.sig, trust.algorithms]);
+    for (const f of parsed)
+        for (const s of trust.signers)
+            if (s.id === f.by && await trust.verifyBytes(signedBytes(f), s.publicKey, f.sig, trust.algorithms))
+                verifiedCrypto.add(key(f, s.publicKey));
+    const verifies = (f, pub) => verifiedCrypto.has(key(f, pub));
+    const authentic = authorityOf(proof, trust.signers, verifies);
+    if (authentic.kind !== 'admitted')
+        fail('proof ' + authentic.kind + ' ' + authentic.why);
+    const signer = trust.signers.find(s => s.id === proof.by);
+    if (!signer)
+        fail('proof signer');
+    const current = authorityAtEpoch(proof, signer, trust.epoch, trust.proofScope, 'authority');
+    if (current.kind !== 'admitted')
+        fail('current proof ' + current.kind + ' ' + current.why);
+    const verified = new Set();
+    for (let i = 0; i < originals.length; i++) {
+        const admitted = authorityOf(parsed[i], trust.signers, verifies);
+        if (admitted.kind !== 'admitted')
+            fail('original ' + admitted.kind + ' ' + admitted.why);
+        verified.add(originals[i]);
+    }
+    const history = objectHistory(originals);
+    if (history.kind !== 'fact')
+        fail('wire ' + history.why);
+    if (history.value.configuration.some(f => f.value === 'withdraw'))
+        fail('configuration history requires admitted standing fold');
+    const context = { ...trust.objects, admit: (r) => verified.has(canonical(r.fields)) && trust.objects.admit(r) };
+    const checked = validateObjectContext(history.value.objects, context);
+    if (checked.kind !== 'fact')
+        throw Error('REFUSE·' + checked.why);
+    const membership = new Set([...cellInputs(checked.value, 'semantic-live@2').values()].flat().map(l => semanticStandingBytes([l])));
+    const fields = (line) => { const p = parse(line); if (p.kind !== 'fact')
+        fail('original parse'); return p.value.fields; };
+    const effective = [...originals].sort((a, b) => Number(fields(a).epoch) - Number(fields(b).epoch));
+    const live = effective.filter(line => { const f = fields(line); return f.type === undefined || membership.has(semanticStandingBytes([line])); });
+    const semantic = semanticStandingBytes(live), semanticIdentity = await trust.digestBytes(utf8(semantic));
+    if (semanticIdentity !== 'sha256:' + reference.digest)
+        fail('standing identity');
+    const authorityContextIdentity = await trust.digestBytes(utf8(JSON.stringify(['reference-inspection-trust@1', trust.snapshot, trust.epoch, trust.proofScope, trust.policy, trust.formImplementation, trust.signers, trust.algorithms])));
+    return { reference, records: checked.value, semanticIdentity, authorityContextIdentity, semanticStanding: semantic, originalRecords: originals };
+}
+export { encodeReference, decodeReference } from "./reference-profile.js";

package/dist/host/reference-native.d.ts

@@ -0,0 +1,10 @@
+export declare function authenticatedReferenceSelected(standing: readonly string[]): boolean;
+export declare function openAuthenticatedReference(root: string, fragment: string): Promise<{
+    readings: readonly import("../engine/object.ts").ObjectReading[];
+    reference: import("./reference-profile.ts").StandingReference;
+    records: readonly import("@lapxo/topos/wire").ObjectRecord[];
+    semanticIdentity: string;
+    authorityContextIdentity: string;
+    semanticStanding: string;
+    originalRecords: readonly string[];
+}>;

package/dist/host/reference-native.js

@@ -0,0 +1,50 @@
+/** Native ports for authenticated #bound opening; trusted policy belongs to the selected local place. */
+import { sha256 as hash, isSha256 } from "./hash.js";
+import { canonical, parse, transportSelection } from '@lapxo/topos/wire';
+import { semanticStandingBytes } from '@lapxo/topos/standing';
+import { authorityFor, rootSigner } from "../fold/signers.js";
+import { eraOf } from "../fold/digests.js";
+import { lockStanding, lockLines } from "../fold/keys.js";
+import { signedOwnerLines } from "../cli/owner.js";
+import { admittedObjects } from "./objects.js";
+import { storeOf } from "../land/ledger.js";
+import { objectFold } from "../engine/index.js";
+import { toposAt, contentAt } from "./selected-topos.js";
+import { transportBytes } from "./ports/transport.js";
+import { decodeReference } from "./reference-profile.js";
+import { inspectAuthenticatedReference } from "./reference-authenticated.js";
+import { verifyBytes } from "./adapters/keys/ed25519.js";
+export function authenticatedReferenceSelected(standing) {
+    const selected = standing.flatMap(line => { const p = parse(line); return p.kind === 'fact' && p.value.fields.scope === 'reference/authentication' ? [p.value.fields] : []; });
+    if (!selected.length)
+        return false;
+    if (selected.length !== 1 || selected[0].value !== 'authenticated-standing@1')
+        throw Error('REFUSE·reference conflicting or unknown authentication profile');
+    return true;
+}
+export async function openAuthenticatedReference(root, fragment) {
+    const store = storeOf(root), standing = lockStanding(store), era = eraOf(standing), authority = authorityFor(lockLines(store), rootSigner(root), era.admitted);
+    if (!authenticatedReferenceSelected(standing))
+        throw Error('REFUSE·reference no admitted authenticated-standing@1 profile');
+    const one = (scope) => { const found = standing.flatMap(line => { const p = parse(line); return p.kind === 'fact' && p.value.fields.scope === scope ? [{ line, fields: p.value.fields }] : []; }); if (found.length !== 1 || found[0].fields.role !== 'writes' || found[0].fields.measure !== 'id' || authority.of(found[0].line).kind !== 'admitted')
+        throw Error('REFUSE·reference missing, conflicting or unauthenticated ' + scope); return found[0].fields.value; };
+    if (one('reference/authentication') !== 'authenticated-standing@1')
+        throw Error('REFUSE·reference authentication profile');
+    const snapshot = one('reference/snapshot'), epochText = one('reference/epoch'), proofScope = one('reference/proof-scope'), recordsText = one('reference/records');
+    if (!isSha256(snapshot) || !/^\d+$/.test(epochText) || !Number.isSafeInteger(Number(epochText)) || !/^\d+$/.test(recordsText) || !Number.isSafeInteger(Number(recordsText)) || Number(recordsText) < 1 || !proofScope)
+        throw Error('REFUSE·reference authority snapshot or resource contract');
+    const reference = decodeReference(fragment);
+    // Provider selection is made from HOST-declared cells/configuration, never carrier-picked code.
+    const held = await admittedObjects(root, signedOwnerLines(store), () => { }, true);
+    if (!held.records.some(r => r.record === 'cell'))
+        throw Error('REFUSE·reference host has no declared object interpretation');
+    const context = held.context, policy = held.configuration.map(fields => canonical(fields)), selection = transportSelection(held.configuration, new URL(reference.source).protocol.slice(0, -1));
+    if (!selection)
+        throw Error('REFUSE·reference no admitted transport policy');
+    const implementations = [...new Set(held.records.filter(r => r.record === 'cell').map(r => r.fields.topos))].sort().map(pin => { const selected = toposAt(pin, store), selectors = selected.parts.filter(f => f.scope === 'wire/topos/context-view'); if (selectors.length !== 1)
+        throw Error('REFUSE·reference host context selector'); const offers = selected.parts.filter(f => f.kind === 'check' && f.view === selectors[0].value); if (offers.length !== 1)
+        throw Error('REFUSE·reference host context offer'); const offer = offers[0], closure = [...new Set((offer.restsOn ?? '').split('|').filter(Boolean))].sort(); for (const digest of closure)
+        contentAt(digest, store); return [pin, offer.value, closure]; });
+    const result = await inspectAuthenticatedReference(fragment, { snapshot, epoch: Number(epochText), proofScope, policy: hash(semanticStandingBytes(policy)), formImplementation: hash(JSON.stringify(implementations)), signers: authority.admitted, algorithms: era.admitted, objects: context, maxBytes: selection.responseBytes, maxRecords: Number(recordsText), digestBytes: hash, verifyBytes, fetchBytes: (source, blob) => transportBytes(source, blob, policy) });
+    return { ...result, readings: objectFold(result.records, context) };
+}

package/dist/host/reference-profile.d.ts

@@ -0,0 +1,23 @@
+/** reference-profile@1: platform URL parsing, no authority or transport effects. */
+export interface StandingReference {
+    readonly class: 'standing';
+    readonly algorithm: 'sha256';
+    readonly digest: string;
+    readonly blob: string;
+    readonly source: string;
+}
+interface InspectionPort {
+    readonly maxBytes: number;
+    readonly readSemanticStanding: (bytes: string) => readonly string[];
+    readonly semanticStandingBytes: (lines: readonly string[]) => string;
+    readonly digestBytes: (bytes: Uint8Array) => string;
+}
+export declare function encodeReference(reference: StandingReference): string;
+export declare function decodeReference(fragment: string): StandingReference;
+export declare function inspectReferenceBytes(reference: StandingReference, bytes: Uint8Array, { maxBytes, readSemanticStanding, semanticStandingBytes, digestBytes }: InspectionPort): {
+    reference: StandingReference;
+    lines: readonly string[];
+    standing: string;
+    authentication: string;
+};
+export {};

package/dist/host/reference-profile.js

@@ -0,0 +1,62 @@
+const hex = /^[0-9a-f]{64}$/;
+const refuse = (cause) => { throw Error(`REFUSE·reference ${cause}`); };
+const keys = ['class', 'algorithm', 'digest', 'blob', 'source'];
+function check(reference) {
+    if (Object.keys(reference).length !== keys.length || keys.some(key => !Object.prototype.hasOwnProperty.call(reference, key)))
+        refuse('fields');
+    if (reference.class !== 'standing')
+        refuse('unknown class');
+    if (reference.algorithm !== 'sha256')
+        refuse('unknown algorithm');
+    if (!hex.test(reference.digest) || !/^sha256:[0-9a-f]{64}$/.test(reference.blob))
+        refuse('digest');
+    let source;
+    try {
+        source = new URL(reference.source);
+    }
+    catch {
+        return refuse('source URL');
+    }
+    if (source.username || source.password || source.hash)
+        refuse('source credentials or fragment');
+    if (source.href !== reference.source)
+        refuse('noncanonical source URL');
+    return reference;
+}
+export function encodeReference(reference) {
+    check(reference);
+    return '#bound:1?' + keys.map(key => key + '=' + encodeURIComponent(reference[key])).join('&');
+}
+export function decodeReference(fragment) {
+    if (!fragment.startsWith('#bound:1?'))
+        refuse('profile');
+    const parameters = new URLSearchParams(fragment.slice('#bound:1?'.length));
+    if ([...parameters].length !== keys.length || new Set(parameters.keys()).size !== keys.length)
+        refuse('duplicate or missing field');
+    const reference = check(Object.fromEntries(parameters));
+    if (encodeReference(reference) !== fragment)
+        refuse('noncanonical encoding');
+    return Object.freeze(reference);
+}
+export function inspectReferenceBytes(reference, bytes, { maxBytes, readSemanticStanding, semanticStandingBytes, digestBytes }) {
+    if (bytes.byteLength > maxBytes)
+        refuse('bytes budget');
+    if (digestBytes(bytes) !== reference.blob.slice(7))
+        refuse('blob integrity');
+    let document;
+    try {
+        document = JSON.parse(new TextDecoder('utf-8', { fatal: true }).decode(bytes));
+    }
+    catch {
+        refuse('document');
+    }
+    if (document === null || typeof document !== 'object' || document.profile !== 'semantic-standing@1' || typeof document.standing !== 'string' || Object.keys(document).length !== 2)
+        refuse('document profile');
+    if (new TextDecoder('utf-8', { fatal: true }).decode(bytes) !== JSON.stringify({ profile: document.profile, standing: document.standing }))
+        refuse('noncanonical document wrapper');
+    const lines = readSemanticStanding(document.standing);
+    const semantic = semanticStandingBytes(lines);
+    if (digestBytes(new TextEncoder().encode(semantic)) !== reference.digest)
+        refuse('standing identity');
+    return { reference, lines, standing: semantic, authentication: 'not demonstrated; inspect only' };
+}

package/dist/host/reference.d.ts

@@ -0,0 +1,6 @@
+export declare function inspectReference(fragment: string, policy: readonly string[]): Promise<{
+    reference: import("./reference-profile.ts").StandingReference;
+    lines: readonly string[];
+    standing: string;
+    authentication: string;
+}>;

package/dist/host/reference.js

@@ -0,0 +1,24 @@
+/** Host composition. Location supplies bytes, never identity or authority. No store writes. */
+import { createHash } from 'node:crypto';
+import { readSemanticStanding, semanticStandingBytes } from '@lapxo/topos/core';
+import { parse, transportSelection } from '@lapxo/topos/wire';
+import { transportBytes } from "./ports/transport.js";
+import { decodeReference, inspectReferenceBytes } from "./reference-profile.js";
+export async function inspectReference(fragment, policy) {
+    const reference = decodeReference(fragment), scheme = new URL(reference.source).protocol.slice(0, -1);
+    const fields = policy.flatMap(line => { const got = parse(line); return got.kind === 'fact' ? [got.value.fields] : []; });
+    const selected = transportSelection(fields, scheme);
+    if (selected === undefined)
+        throw Error(`REFUSE·transport ${scheme} no admitted content-request/1 policy`);
+    let bytes;
+    try {
+        bytes = await transportBytes(reference.source, reference.blob, policy);
+    }
+    catch (error) {
+        const cause = error instanceof Error ? error.message : 'transport failed';
+        if (cause.startsWith('REFUSE·'))
+            throw error;
+        throw Error(`REFUSE·transport ${scheme} ${cause}`);
+    }
+    return inspectReferenceBytes(reference, bytes, { maxBytes: selected.responseBytes, readSemanticStanding, semanticStandingBytes, digestBytes: value => createHash('sha256').update(value).digest('hex') });
+}

package/dist/host/selected-topos.d.ts

@@ -12,7 +12,7 @@ export declare function admittedLine(line: string, local: readonly Readonly<Reco
 export declare function toposAt(digest: string, store?: string): StandingTopos;
 export declare function contentAt(digest: string, store?: string): Uint8Array;
 /** The declared module runs from the store that supplied its verified bytes. No copy or live-checkout fallback. */
-export declare function contextModuleAt(digest: string, store?: string): string;
+export declare function contextModuleAt(digest: string, store?: string, dependencies?: readonly string[]): string;
 /** Selection verifies standing identity. Requested capabilities verify their artifact bytes separately. */
 export declare function selectedTopoi(pins: readonly string[], resolve?: ToposResolver): readonly SelectedTopos[];
 /** Read a declared wire list without copying a world's claims or executing its offers.

package/dist/host/selected-topos.js

@@ -2,6 +2,8 @@ import { verifiedContent } from "./content-store.js";
 import { readStanding } from '@lapxo/topos/standing';
 import { parse, wireAt, fromLine } from '@lapxo/topos/wire';
 import { fieldOf } from "../fold/claims.js";
+import { moduleClosure } from "./native/module-closure.js";
+import { sha256, isSha256 } from "./hash.js";
 /** Local grammar is sufficient for locally declared records. Resolve selected
  * contracts only when a reader is missing; a local refusal remains a refusal. */
 export function admittedLine(line, local, epoch, pins, resolve = toposAt) {
@@ -26,7 +28,13 @@ export function contentAt(digest, store) {
     return verifiedContent(digest, store).bytes;
 }
 /** The declared module runs from the store that supplied its verified bytes. No copy or live-checkout fallback. */
-export function contextModuleAt(digest, store) {
+export function contextModuleAt(digest, store, dependencies) {
+    if (dependencies !== undefined) {
+        if (!isSha256(digest) || !dependencies.includes(digest) || dependencies.some(pin => !isSha256(pin)))
+            throw Error('REFUSE·context module closure requires declared SHA-256 members');
+        const pins = [...new Set(dependencies)].sort(), members = new Map(pins.map(pin => [pin.slice(pin.indexOf(':') + 1), { digest: pin, source: new TextDecoder('utf-8', { fatal: true }).decode(contentAt(pin, store)) }]));
+        moduleClosure({ identity: sha256(JSON.stringify(pins)), entry: digest.slice(digest.indexOf(':') + 1), members }, () => undefined);
+    }
     return verifiedContent(digest, store).path;
 }
 /** Selection verifies standing identity. Requested capabilities verify their artifact bytes separately. */

package/dist/observe/regions.d.ts

@@ -27,3 +27,7 @@ type Ask = (declaration: Declaration, one: Asking, verb: 'render' | 'read', shap
  */
 export declare const askingOf: (fold: Placed) => Ask;
 export declare function capsuleReadingsOver(fold: Placed): readonly string[];
+/** Current judgement excludes authenticated outcomes of the selected producer batches; retained evidence stays in its carrier. */
+export declare const currentReceiptObservations: (fold: Parameters<typeof capsulesOf>[0]) => readonly string[];
+/** Preserve prior producer outcomes in the owning place's public carrier, independently of current judgement. */
+export declare const retiredReceiptHistory: (fold: Parameters<typeof capsulesOf>[0]) => readonly string[];