@lapxo/bound 0.1.9 → 0.2.0

package/dist/observe/regions.js

@@ -1,3 +1,11 @@
+import { childFlags } from "../host/capsule.js";
+import { readingProfile, readingExecution, withReadingBoundary } from "../host/reading-context.js";
+import { readingIdentityBytes } from '@lapxo/topos/contract';
+import { portableReadingReceipt, verifiedReadingReceipts } from "../host/reading-closures.js";
+import { bytesDigest, instrumentCoordinates } from "../fold/digests.js";
+import { ownRoot, processOf } from "./runner.js";
+import { contentPolicy } from "../host/content-store.js";
+import { carriedFrom } from "../fold/resolved.js";
 import { selectedCapsules } from "../host/selected-capsules.js";
 import { selectionLines, projectionLines } from "../fold/reach.js";
 export { selectionLines } from "../fold/reach.js";
@@ -22,6 +30,7 @@ import { ownLock } from "./runner.js";
 import { nameOf } from "../render/page.js";
 import { placeLines, takenFor } from "../fold/place-inputs.js";
 import { isRegionDeclaration } from "../fold/region-declarations.js";
+const receiptHasher = (store) => (text) => bytesDigest(store, new TextEncoder().encode(text));
 const fact = (scope, value, form = 'alphabet', measure = 'fact') => canonical({ scope, role: 'writes', form, measure, value, by: 'fold', at: 'place:fold' });
 const described = (local = []) => {
     const lock = ownLock();
@@ -164,12 +173,30 @@ function capsuleReadings(fold) {
     return known.get(place) ?? known.set(place, readingsAt(fold, place)).get(place);
 }
 function readingsAt(fold, place) {
-    const asking = askingOf(fold);
     const speaker = keyFor(fold.store, 'read');
     return capsulesOf(fold).flatMap((capsule) => {
         const writing = new Set(capsule.lines.filter((line) => fieldOf(line, 'scope').startsWith('region/') && fieldOf(line, 'measure') === 'writes').map((line) => fieldOf(line, 'scope').slice('region/'.length)));
         const receipts = Object.keys(capsule.declaration.writes).filter((name) => capsule.declaration.writes[name] === 'receipt' && !writing.has(name)).sort();
+        const target = modernReceiptInputs(fold, capsule.selection ?? capsule.digest);
+        const asking = askingOf({ ...fold, observed: target.current });
         const requests = receipts.flatMap((name) => ((request) => (request === undefined ? [] : [request]))(asking(capsule.declaration, { name, at: 3 }, 'read', '')));
+        const modern = readingProfile(fold.standing, fieldOf);
+        if (modern && requests.length) {
+            const hash = receiptHasher(fold.store);
+            const batch = hash(JSON.stringify([capsule.selection ?? capsule.digest, capsule.digest, receipts]));
+            const coordinates = instrumentCoordinates(fold.store, processOf('verb'), [], ownRoot(), ownLock(), true), instrument = hash([...coordinates.values()].sort().join('\n'));
+            const legacy = target.legacy;
+            return requests.flatMap(request => {
+                const execution = readingExecution({ instrument, implementation: capsule.digest, policy: hash(JSON.stringify([contentPolicy(), capsule.selection ?? null, capsule.lines])), inputs: [['world', capsule.selection ?? capsule.digest], ['batch', batch], ['request', hash(JSON.stringify(request))], ...legacy, ...[...coordinates].map(([name, id]) => ['host/' + relative(ownRoot(), name), id])] }, hash, { env: process.env, cwd: fold.root, flags: childFlags() });
+                const closure = new TextDecoder().decode(readingIdentityBytes(execution.context)), input = hash(closure), said = withReadingBoundary(input, execution, () => capsule.ask([request]))[0];
+                if (said?.kind !== 'fact')
+                    throw Error(`REFUSE·capsule ${capsule.digest} · ${request.region} · ${said?.why ?? 'no answer'}`);
+                const by = speaker + ':' + batch.slice(7), at = 'place:' + input;
+                const lines = (said.claims ?? []).map((row) => canonical({ scope: row.scope, role: row.role, measure: row.measure, form: row.bound.kind === 'interval' ? 'interval' : 'alphabet', value: row.bound.kind === 'interval' ? `${row.bound.lo ?? 0}..${row.bound.hi ?? 0}` : (row.bound.values ?? []).join('|'), by, at }));
+                const output = lines.join('\n') + (lines.length ? '\n' : ''), scope = 'receipts/readings/' + hash(request.region ?? '').slice(7) + '/' + input.slice(7);
+                return [canonical({ scope: place, role: 'writes', form: 'alphabet', measure: 'observed', value: input.slice(7, 23), by, at }), ...lines, ...portableReadingReceipt(scope, by, closure, output, hash)];
+            });
+        }
         const answers = capsule.ask(requests);
         const refused = requests.filter((_, i) => answers[i]?.kind !== 'fact');
         if (refused.length)
@@ -196,3 +223,84 @@ export function capsuleReadingsOver(fold) {
     return [...capsuleReadings(fold), ...places.flatMap((place) => capsuleReadings({ ...fold, under: `${place}/`,
             standing: [...new Set([...said.filter((one) => one.place === place).map((one) => one.line), ...fold.standing])] }))];
 }
+/** Current judgement excludes authenticated outcomes of the selected producer batches; retained evidence stays in its carrier. */
+export const currentReceiptObservations = (fold) => modernReceiptInputs(fold).current;
+/** Preserve prior producer outcomes in the owning place's public carrier, independently of current judgement. */
+export const retiredReceiptHistory = (fold) => { const carried = carriedFrom(fold.store, (observeText(join(fold.root, fold.under ?? '', 'receipts.bound')) ?? '').split('\n').filter(line => line.startsWith('bound-lock/'))) ?? []; const all = [...new Set([...fold.observed, ...carried])], current = new Set(modernReceiptInputs({ ...fold, observed: all }).current); return all.filter(line => !current.has(line)); };
+/** A modern capsule batch cannot consume its own retained outcomes. Full context units bind history; legacy conversion never supplies a current answer. */
+function modernReceiptInputs(fold, target) {
+    if (!readingProfile(fold.standing, fieldOf))
+        return { current: fold.observed, legacy: [] };
+    const observed = [...new Set(fold.observed)];
+    const hash = receiptHasher(fold.store), allSelected = capsulesOf(fold), selected = allSelected.filter(c => { const writing = new Set(c.lines.filter(l => fieldOf(l, 'measure') === 'writes').map(l => fieldOf(l, 'scope').slice(7))); return Object.keys(c.declaration.writes).some(n => c.declaration.writes[n] === 'receipt' && !writing.has(n)); });
+    if (!selected.length)
+        return { current: fold.observed, legacy: [] };
+    const speaker = keyFor(fold.store, 'read'), removed = new Set(), refs = [];
+    const units = observed.filter(l => fieldOf(l, 'scope').startsWith('receipts/readings/') && fieldOf(l, 'measure') === 'bytes' && fieldOf(l, 'role') === 'writes');
+    if (verifiedReadingReceipts(fold.store, observed, hash, undefined, true) === undefined)
+        throw Error('REFUSE·capsule receipt carrier context invalid');
+    for (const capsule of selected) {
+        if (target !== undefined && (capsule.selection ?? capsule.digest) !== target)
+            continue;
+        const writing = new Set(capsule.lines.filter(l => fieldOf(l, 'measure') === 'writes').map(l => fieldOf(l, 'scope').slice(7))), receipts = Object.keys(capsule.declaration.writes).filter(n => capsule.declaration.writes[n] === 'receipt' && !writing.has(n)).sort();
+        if (!receipts.length)
+            continue;
+        const batch = hash(JSON.stringify([capsule.selection ?? capsule.digest, capsule.digest, receipts])), knownLegacy = new Set();
+        for (const unit of units) {
+            const about = fieldOf(unit, 'about');
+            if (!about)
+                continue;
+            let c;
+            try {
+                c = JSON.parse(about);
+            }
+            catch {
+                continue;
+            }
+            if (!Array.isArray(c) || c[0] !== 'reading-context@1' || c[2] !== capsule.digest || !Array.isArray(c[4]) || !c[4].some(([n, id]) => n === 'batch' && id === batch) || !c[4].some(([n, id]) => n === 'world' && id === (capsule.selection ?? capsule.digest)))
+                continue;
+            const expectedBy = speaker + ':' + batch.slice(7);
+            if (fieldOf(unit, 'by') !== expectedBy)
+                continue;
+            if (fold.standing.some(line => fieldOf(line, 'scope') === 'keys/' + expectedBy && fieldOf(line, 'value') !== 'withdraw'))
+                throw Error('REFUSE·modern capsule receipt producer ambiguous');
+            const namedScope = fieldOf(unit, 'scope'), inputIdentity = fieldOf(unit, 'value');
+            if (!receipts.some(name => namedScope === 'receipts/readings/' + hash(name).slice(7) + '/' + inputIdentity.slice(7)))
+                throw Error('REFUSE·modern capsule receipt scope differs from declared region');
+            for (const [n, id] of c[4])
+                if (typeof n === 'string' && n.startsWith('legacy/output/') && n === 'legacy/output/' + id) {
+                    knownLegacy.add(id);
+                    refs.push([n, id]);
+                }
+            const by = fieldOf(unit, 'by'), input = fieldOf(unit, 'value'), scope = fieldOf(unit, 'scope'), output = observed.find(l => fieldOf(l, 'scope') === scope && fieldOf(l, 'by') === by && fieldOf(l, 'measure') === 'count');
+            const payload = output ? fieldOf(output, 'at') : '';
+            for (const l of observed)
+                if (fieldOf(l, 'by') === by && (fieldOf(l, 'at') === 'place:' + input || fieldOf(l, 'at') === payload || fieldOf(l, 'scope') === scope || fieldOf(l, 'scope') === [scope, 'identity'].join('/')))
+                    removed.add(l);
+        }
+        const alias = capsule.digest.slice(7, 19), by = speaker + ':' + alias, groups = new Map();
+        for (const l of observed)
+            if (fieldOf(l, 'by') === by) {
+                const at = fieldOf(l, 'at');
+                groups.set(at, [...(groups.get(at) ?? []), l]);
+            }
+        if (groups.size) {
+            if (selected.filter(c => c.digest === capsule.digest).length !== 1 || receipts.length !== 1 || new Set(allSelected.filter(c => c.digest.slice(7, 19) === alias).map(c => c.digest)).size !== 1 || fold.standing.some(l => fieldOf(l, 'scope') === 'keys/' + by && fieldOf(l, 'value') !== 'withdraw'))
+                throw Error('REFUSE·legacy capsule receipt producer ambiguous');
+            for (const [at, group] of groups) {
+                if (!/^place:sha256:[a-f0-9]{64}$/.test(at) || group.filter(l => fieldOf(l, 'measure') === 'observed' && fieldOf(l, 'scope') === (fold.under || './')).length !== 1)
+                    throw Error('REFUSE·legacy capsule receipt occurrence ambiguous');
+                const id = hash(group.join('\n'));
+                if (!knownLegacy.has(id)) {
+                    const candidate = observed.filter(l => !removed.has(l) && !group.includes(l)), request = askingOf({ ...fold, observed: candidate })(capsule.declaration, { name: receipts[0], at: 3 }, 'read', '');
+                    if (!request || at !== 'place:' + hash(JSON.stringify(request)))
+                        throw Error('REFUSE·legacy capsule receipt context unavailable · expected ' + at + ' · current ' + (request ? hash(JSON.stringify(request)) : 'absent'));
+                }
+                refs.push(['legacy/output/' + id, id]);
+                for (const l of group)
+                    removed.add(l);
+            }
+        }
+    }
+    return { current: observed.filter(l => !removed.has(l)), legacy: [...new Map(refs.map(([n, id]) => [n + ' ' + id, [n, id]])).values()] };
+}

package/dist/wasm/adapter.d.ts

@@ -0,0 +1,51 @@
+export interface WasmLimits {
+    readonly memoryBytes: number;
+    readonly stackBytes: number;
+    readonly executionMs: number;
+}
+export interface WasmTrust {
+    readonly runtime: string;
+    readonly wasm: string;
+    readonly modules: Readonly<Record<string, string>>;
+    readonly entry: string;
+    readonly aliases: Readonly<Record<string, string>>;
+    readonly limits: WasmLimits;
+    readonly byteLengths: {
+        readonly runtime: number;
+        readonly wasm: number;
+        readonly modules: Readonly<Record<string, number>>;
+    };
+}
+export interface WasmRequest {
+    readonly trusted: WasmTrust;
+    readonly assets: {
+        readonly runtime: Uint8Array | ArrayBuffer;
+        readonly wasm: Uint8Array | ArrayBuffer;
+    };
+    readonly modules: Readonly<Record<string, string>>;
+    readonly entry: string;
+    readonly aliases?: Readonly<Record<string, string>>;
+    readonly limits: WasmLimits;
+}
+export interface WasmResult {
+    readonly output: string;
+    readonly initializedMs: number;
+    readonly executionMs: number;
+}
+export interface WorkerPort {
+    postMessage(message: WasmRequest): void;
+    terminate(): unknown;
+    addEventListener?(type: string, listener: (event: {
+        data?: unknown;
+        message?: string;
+    }) => void): void;
+    on?(type: string, listener: (value: unknown) => void): void;
+}
+export declare function digest(bytes: Uint8Array): Promise<string>;
+export declare function preflight(request: WasmRequest): void;
+export declare function runWasmRequest(request: WasmRequest): Promise<WasmResult>;
+export declare function evaluateWasm(request: WasmRequest, { workerFactory, signal, lifetimeMs }: {
+    readonly workerFactory?: () => WorkerPort;
+    readonly signal?: AbortSignal;
+    readonly lifetimeMs: number;
+}): Promise<WasmResult>;

package/dist/wasm/adapter.js

@@ -0,0 +1,180 @@
+var __rewriteRelativeImportExtension = (this && this.__rewriteRelativeImportExtension) || function (path, preserveJsx) {
+    if (typeof path === "string" && /^\.\.?\//.test(path)) {
+        return path.replace(/\.(tsx)$|((?:\.d)?)((?:\.[^./]+?)?)\.([cm]?)ts$/i, function (m, tsx, d, ext, cm) {
+            return tsx ? preserveJsx ? ".jsx" : ".js" : d && (!ext || !cm) ? m : (d + ext + "." + cm.toLowerCase() + "js");
+        });
+    }
+    return path;
+};
+const owns = (object, key) => Object.prototype.hasOwnProperty.call(object, key);
+const assetNames = ['runtime', 'wasm'], limitNames = ['memoryBytes', 'stackBytes', 'executionMs'];
+// Host adapter only. Source integrity grants neither admission nor authority.
+function refuse(cause) { throw Error('REFUSE·wasm ' + cause); }
+export async function digest(bytes) { return 'sha256:' + Array.from(new Uint8Array(await crypto.subtle.digest('SHA-256', bytes.slice().buffer))).map(x => x.toString(16).padStart(2, '0')).join(''); }
+async function verified(bytes, expected) { if (typeof SharedArrayBuffer !== 'undefined' && (bytes instanceof SharedArrayBuffer || (ArrayBuffer.isView(bytes) && bytes.buffer instanceof SharedArrayBuffer)))
+    refuse('shared assets unsupported'); const copy = (bytes instanceof Uint8Array ? new Uint8Array(bytes) : new Uint8Array(bytes)).slice(); if (!/^sha256:[a-f0-9]{64}$/.test(expected) || await digest(copy) !== expected)
+    refuse('integrity'); return copy; }
+const text = new TextEncoder();
+// Exact host-declared sizes bound copies, hashing and worker handoff before work.
+export function preflight(request) {
+    if (!request || Object.keys(request).some(k => !['trusted', 'assets', 'modules', 'aliases', 'entry', 'limits'].includes(k)))
+        refuse('request fields');
+    const { trusted, assets, modules, entry, aliases = {}, limits } = request, sizes = trusted?.byteLengths;
+    if (!sizes || !modules || !assets)
+        refuse('declared byte sizes');
+    if (Object.keys(assets).length !== 2 || Object.keys(assets).some(k => !['runtime', 'wasm'].includes(k)))
+        refuse('asset fields');
+    if (!limits || Object.keys(limits).length !== 3 || Object.keys(limits).some(k => !['memoryBytes', 'stackBytes', 'executionMs'].includes(k)))
+        refuse('limit fields');
+    for (const name of limitNames)
+        if (!Number.isSafeInteger(limits[name]) || limits[name] <= 0 || limits[name] !== trusted.limits?.[name])
+            refuse('limit ' + name);
+    if (typeof entry !== 'string' || entry !== trusted.entry || !aliases || Object.values(aliases).some(v => typeof v !== 'string') || JSON.stringify(Object.entries(aliases).sort()) !== JSON.stringify(Object.entries(trusted.aliases ?? {}).sort()))
+        refuse('entry or aliases differ from trusted context');
+    const names = Object.keys(modules), expected = Object.keys(trusted.modules ?? {});
+    if (names.length !== expected.length || names.some(n => !owns(trusted.modules, n)))
+        refuse('module count');
+    const size = (n, want) => { if (!Number.isSafeInteger(want) || want < 0)
+        refuse('declared size ' + n); return want; };
+    for (const name of assetNames) {
+        const v = assets[name];
+        if (typeof SharedArrayBuffer !== 'undefined' && (v instanceof SharedArrayBuffer || (ArrayBuffer.isView(v) && v.buffer instanceof SharedArrayBuffer)))
+            refuse('shared assets unsupported');
+        if (!(v instanceof Uint8Array || v instanceof ArrayBuffer) || v.byteLength !== size(name, sizes[name]))
+            refuse('asset bytes ' + name);
+    }
+    for (const name of names) {
+        const source = modules[name], want = size(name, sizes.modules?.[name]);
+        if (typeof source !== 'string' || source.length > want)
+            refuse('module bytes ' + name);
+        let bytes = 0;
+        for (let i = 0; i < source.length; i++) {
+            const c = source.charCodeAt(i);
+            bytes += c < 128 ? 1 : c < 2048 ? 2 : c >= 55296 && c <= 56319 && i + 1 < source.length && source.charCodeAt(i + 1) >= 56320 && source.charCodeAt(i + 1) <= 57343 ? (i++, 4) : 3;
+            if (bytes > want)
+                refuse('module bytes ' + name);
+        }
+        if (bytes !== want)
+            refuse('module bytes ' + name);
+    }
+}
+export async function runWasmRequest(request) {
+    preflight(request);
+    try {
+        request = structuredClone(request);
+    }
+    catch {
+        refuse('request is not cloneable');
+    }
+    const { trusted, assets, modules, aliases = {}, entry, limits } = request;
+    for (const name of limitNames)
+        if (!Number.isSafeInteger(limits?.[name]) || limits[name] <= 0 || limits[name] !== trusted?.limits?.[name])
+            refuse('limit ' + name);
+    if (entry !== trusted.entry || JSON.stringify(Object.entries(aliases).sort()) !== JSON.stringify(Object.entries(trusted.aliases ?? {}).sort()))
+        refuse('entry or aliases differ from trusted context');
+    const runtime = await verified(assets.runtime, trusted.runtime), wasm = await verified(assets.wasm, trusted.wasm), sources = {};
+    for (const [id, source] of Object.entries(modules)) {
+        if (!owns(trusted.modules, id))
+            refuse('undeclared module ' + id);
+        sources[id] = new TextDecoder('utf-8', { fatal: true }).decode(await verified(text.encode(source), trusted.modules[id]));
+    }
+    if (Object.keys(trusted.modules).some(id => !owns(sources, id)))
+        refuse('missing module');
+    if (!owns(sources, entry))
+        refuse('entry');
+    // The runtime is a closed esbuild ESM bundle: no imports and no second fetch.
+    const url = 'data:text/javascript;base64,' + bytesBase64(runtime), factory = await import(__rewriteRelativeImportExtension(url));
+    const started = performance.now(), quick = await factory.createQuickJS(wasm);
+    const rt = quick.newRuntime();
+    let context;
+    try {
+        context = rt.newContext();
+        const memory = rt.computeMemoryUsage();
+        let initializedMemory;
+        try {
+            initializedMemory = context.dump(memory);
+        }
+        finally {
+            memory.dispose();
+        }
+        const used = typeof initializedMemory === 'object' && initializedMemory !== null ? initializedMemory.memory_used_size : undefined;
+        if (typeof used !== 'number' || !Number.isSafeInteger(used) || used < 0)
+            refuse('initialized memory measurement unavailable');
+        if (used > limits.memoryBytes)
+            refuse('initialized memory ' + used + ' exceeds declared memory ' + limits.memoryBytes);
+        const initializedMs = performance.now() - started;
+        rt.setMemoryLimit(limits.memoryBytes);
+        rt.setMaxStackSize(limits.stackBytes);
+        const start = performance.now();
+        rt.setInterruptHandler(() => performance.now() - start > limits.executionMs);
+        rt.setModuleLoader(id => { if (!owns(sources, id))
+            refuse('undeclared import ' + id); return sources[id]; }, (parent, name) => { if (owns(aliases, name))
+            return aliases[name]; if (name.startsWith('.'))
+            return new URL(name, new URL(parent, 'file:///')).pathname; if (owns(sources, name))
+            return name; refuse('undeclared import ' + name); });
+        const result = context.evalCode(sources[entry], entry, { type: 'module' });
+        if (result.error) {
+            const e = context.dump(result.error);
+            result.error.dispose();
+            refuse('guest ' + JSON.stringify(e));
+        }
+        result.value.dispose();
+        const value = context.evalCode('globalThis.result');
+        if (value.error) {
+            const e = context.dump(value.error);
+            value.error.dispose();
+            refuse('result ' + JSON.stringify(e));
+        }
+        const output = context.dump(value.value);
+        value.value.dispose();
+        if (typeof output !== 'string')
+            refuse('result must be declared text');
+        return { output, initializedMs, executionMs: performance.now() - start };
+    }
+    finally {
+        context?.dispose();
+        rt.dispose();
+    }
+}
+function bytesBase64(bytes) { let binary = ''; for (const b of bytes)
+    binary += String.fromCharCode(b); return btoa(binary); }
+// A separate worker makes external abort possible while synchronous WASM executes.
+export async function evaluateWasm(request, { workerFactory = () => new Worker(new URL('./worker.js', import.meta.url), { type: 'module' }), signal, lifetimeMs }) {
+    if (!Number.isSafeInteger(lifetimeMs) || lifetimeMs <= 0)
+        refuse('worker lifetime');
+    if (signal?.aborted)
+        refuse('cancelled');
+    preflight(request);
+    return new Promise((resolve, reject) => { const worker = workerFactory(); let done = false; const finish = (error, value) => { if (done)
+        return; done = true; clearTimeout(timer); signal?.removeEventListener('abort', abort); worker.terminate(); error ? reject(error) : resolve(value); }; const abort = () => finish(Error('REFUSE·wasm cancelled')); const timer = setTimeout(() => finish(Error('REFUSE·wasm worker lifetime')), lifetimeMs); signal?.addEventListener('abort', abort, { once: true }); const message = (raw) => { const data = raw; if (!data || typeof data !== 'object' || typeof data.ok !== 'boolean') {
+        finish(Error('REFUSE·wasm malformed worker result'));
+        return;
+    } if (data.ok) {
+        if (!data.result || typeof data.result.output !== 'string') {
+            finish(Error('REFUSE·wasm malformed worker output'));
+            return;
+        }
+        finish(null, data.result);
+    }
+    else
+        finish(Error(typeof data.error === 'string' ? data.error : 'REFUSE·wasm worker failure')); }; if (typeof worker.addEventListener === 'function') {
+        worker.addEventListener('message', e => message(e.data));
+        worker.addEventListener('error', e => finish(Error('REFUSE·wasm worker ' + e.message)));
+    }
+    else {
+        if (!worker.on) {
+            finish(Error('REFUSE·wasm worker event port'));
+            return;
+        }
+        worker.on('message', message);
+        worker.on('error', e => finish(e instanceof Error ? e : Error(String(e))));
+    } if (signal?.aborted) {
+        abort();
+        return;
+    } try {
+        worker.postMessage(request);
+    }
+    catch {
+        finish(Error('REFUSE·wasm request is not cloneable'));
+    } });
+}

package/dist/wasm/node-worker.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/wasm/node-worker.js

@@ -0,0 +1,13 @@
+import { parentPort } from 'node:worker_threads';
+import { runWasmRequest } from "./adapter.js";
+if (!parentPort)
+    throw Error('REFUSE·wasm worker port missing');
+const port = parentPort;
+port.once('message', async (request) => {
+    try {
+        port.postMessage({ ok: true, result: await runWasmRequest(request) });
+    }
+    catch (error) {
+        port.postMessage({ ok: false, error: error instanceof Error ? error.message : String(error) });
+    }
+});

package/dist/wasm/object.d.ts

@@ -0,0 +1,8 @@
+import type { ObjectRecord, ObjectContext } from '@lapxo/topos/wire';
+import type { ObjectReading } from '../engine/index.ts';
+type Fields = Readonly<Record<string, string>>;
+/** Configuration is the caller's already authenticated, live standing; selection grants no authority. */
+export declare function usesWasmObject(configuration: readonly Fields[]): boolean;
+/** The installed instrument owns the asset/form closure; place input cannot choose executable bytes. */
+export declare function foldObjectsWithWasm(root: string, records: readonly ObjectRecord[], context: ObjectContext, configuration: readonly Fields[], signal?: AbortSignal): Promise<readonly ObjectReading[]>;
+export {};

package/dist/wasm/object.js

@@ -0,0 +1,76 @@
+import { readFileSync } from 'node:fs';
+import { Worker } from 'node:worker_threads';
+import { sha256 } from "../host/hash.js";
+import { toposAt } from "../host/selected-topos.js";
+import { storeOf } from "../land/ledger.js";
+import { evaluateWasm } from "./adapter.js";
+function refuse(cause) { throw Error('REFUSE·wasm object ' + cause); }
+/** Configuration is the caller's already authenticated, live standing; selection grants no authority. */
+export function usesWasmObject(configuration) {
+    const rows = configuration.filter(f => f.scope === 'engine/object' && f.value !== 'withdraw');
+    if (!rows.length)
+        return false;
+    if (rows.length !== 1 || rows[0].role !== 'writes' || rows[0].measure !== 'id' || rows[0].form !== 'alphabet' || rows[0].value !== 'wasm@1')
+        refuse('unique declared backend required');
+    return true;
+}
+function limit(configuration, name, measure) {
+    const rows = configuration.filter(f => f.scope === 'engine/wasm/' + name && f.value !== 'withdraw');
+    if (rows.length !== 1 || rows[0].form !== 'interval' || rows[0].measure !== measure || rows[0].role !== 'writes')
+        refuse('missing or ambiguous ' + name + ' limit');
+    const span = /^(0|[1-9][0-9]*)\.\.(0|[1-9][0-9]*)$/.exec(rows[0].value ?? '');
+    if (!span || !Number.isSafeInteger(Number(span[1])) || !Number.isSafeInteger(Number(span[2])) || Number(span[1]) > Number(span[2]) || Number(span[2]) < 1)
+        refuse('invalid ' + name + ' limit');
+    return Number(span[2]);
+}
+/** The installed instrument owns the asset/form closure; place input cannot choose executable bytes. */
+export async function foldObjectsWithWasm(root, records, context, configuration, signal) {
+    if (!usesWasmObject(configuration))
+        refuse('backend not selected');
+    const limits = { memoryBytes: limit(configuration, 'memory', 'bytes'), stackBytes: limit(configuration, 'stack', 'bytes'), executionMs: limit(configuration, 'execution', 'milliseconds') }, lifetimeMs = limit(configuration, 'worker-lifetime', 'milliseconds'), responseBytes = limit(configuration, 'response', 'bytes');
+    const assets = new URL('../../assets/wasm/', import.meta.url), manifest = JSON.parse(readFileSync(new URL('manifest.json', assets), 'utf8'));
+    if (!manifest.forms)
+        refuse('installed form closure missing');
+    const codecs = {};
+    for (const record of records.filter(r => r.record === 'cell')) {
+        const pin = record.fields.topos, binding = manifest.forms[pin];
+        if (!binding || !['intervalForm', 'alphabetOfForm'].includes(binding.export) || binding.form !== record.fields.form)
+            refuse('unsupported form standing ' + pin);
+        const standing = toposAt(pin, storeOf(root)), selector = standing.parts.filter(f => f.scope === 'wire/topos/context-view');
+        if (selector.length !== 1)
+            refuse('context selection ' + pin);
+        const offers = standing.parts.filter(f => f.kind === 'check' && f.view === selector[0].value);
+        if (offers.length !== 1 || offers[0].value !== binding.contextArtifact || !(offers[0].restsOn ?? '').split('|').includes(binding.contextArtifact))
+            refuse('context implementation differs ' + pin);
+        const selected = context.resolve(record);
+        if (selected.digest !== pin || selected.form.id !== binding.form)
+            refuse('prepared form differs ' + record.fields.scope);
+        codecs[record.fields.scope] = { digest: pin, export: binding.export, params: selected.params };
+    }
+    const guestNames = Object.keys(manifest.modules);
+    if (guestNames.length !== 1)
+        refuse('installed guest module map');
+    const guestName = guestNames[0];
+    let program;
+    try {
+        program = `import{objectFold,intervalForm,alphabetOfForm}from${JSON.stringify(guestName)};const forms={intervalForm,alphabetOfForm},codecs=${JSON.stringify(codecs)},records=${JSON.stringify(records)};const context={resolve:cell=>{const c=codecs[cell.fields.scope];if(!c)throw Error('REFUSE unknown prepared cell');return{digest:c.digest,form:forms[c.export],params:c.params}}};globalThis.result=JSON.stringify(objectFold(records,context));`;
+    }
+    catch {
+        return refuse('context is not serializable');
+    }
+    const entry = guestName + '.entry', programDigest = sha256(program);
+    const guest = readFileSync(new URL('guest.js', assets), 'utf8'), modules = { [guestName]: guest, [entry]: program }, request = { trusted: { ...manifest, modules: { ...manifest.modules, [entry]: programDigest }, entry, aliases: {}, limits, byteLengths: { ...manifest.byteLengths, modules: { ...manifest.byteLengths.modules, [entry]: Buffer.byteLength(program) } } }, assets: { runtime: new Uint8Array(readFileSync(new URL('runtime.js', assets))), wasm: new Uint8Array(readFileSync(new URL('runtime.wasm', assets))) }, modules, entry, aliases: {}, limits };
+    const result = await evaluateWasm(request, { workerFactory: () => new Worker(new URL('./node-worker.js', import.meta.url)), lifetimeMs, ...(signal ? { signal } : {}) });
+    if (Buffer.byteLength(result.output) > responseBytes)
+        refuse('response bytes limit');
+    let readings;
+    try {
+        readings = JSON.parse(result.output);
+    }
+    catch {
+        return refuse('invalid projection text');
+    }
+    if (!Array.isArray(readings) || readings.some(r => !r || typeof r.cell !== 'string' || typeof r.state !== 'string'))
+        refuse('invalid projection shape');
+    return readings;
+}

package/dist/wasm/worker.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/wasm/worker.js

@@ -0,0 +1,7 @@
+import { runWasmRequest } from "./adapter.js";
+self.onmessage = async ({ data }) => { try {
+    self.postMessage({ ok: true, result: await runWasmRequest(data) });
+}
+catch (error) {
+    self.postMessage({ ok: false, error: String(error) });
+} };

package/docs/contracts/authenticated-reference.publication.json

@@ -0,0 +1,25 @@
+{
+  "scope": "contract/published/authenticated-reference",
+  "members": [
+    {
+      "role": "contract",
+      "path": "docs/contracts/reference-port.md",
+      "digest": "sha256:ae500aaec7e94dc9bc7c4d45e3294b212b0ad5ade7647e3ce24807ca7a0ea7cc"
+    },
+    {
+      "role": "yes",
+      "path": "samples/authenticated-reference/yes/weather-reading/inputs/yes.json",
+      "digest": "sha256:f285a014cc9e9453aebd4c4ed94354fba5cac55c05929f4ad7cdd1b3348a9717"
+    },
+    {
+      "role": "vector",
+      "path": "vectors/native/authenticated-reference.vector.json",
+      "digest": "sha256:297c4942a847c42eb9d2cf000ab38d8a5f38b64e2e4a469919f0dfc88c9d8bd1"
+    },
+    {
+      "role": "no",
+      "path": "samples/authenticated-reference/yes/weather-reading/inputs/signature.json",
+      "digest": "sha256:2049bbbf88077727911a0cfec3193ab6ce7bccb8d4e3bb22fc537c59f5addf58"
+    }
+  ]
+}

package/docs/contracts/engine-object-projection.publication.json

@@ -0,0 +1,25 @@
+{
+  "scope": "contract/published/engine-object-projection",
+  "members": [
+    {
+      "role": "contract",
+      "path": "docs/contracts/engine.md",
+      "digest": "sha256:2d54ddc75386a0706a3bc500e36deedc85ca9e7dc965eff5c795f02b1a716078"
+    },
+    {
+      "role": "yes",
+      "path": "samples/engine-interval/inputs/sample.json",
+      "digest": "sha256:ef476bda8c15b4967a88dc27a188ab25cfac42bdf381fb82f4e57a482d2fd27d"
+    },
+    {
+      "role": "no",
+      "path": "samples/no/engine-order/inputs/sample.json",
+      "digest": "sha256:f2104a661541baf7f8e6d9224590210b272e24519dafce94ca7c588e5a78a20d"
+    },
+    {
+      "role": "vector",
+      "path": "vectors/engine-object.cli.json",
+      "digest": "sha256:191920f597e2d8bafc9aeeff13934645c64a790dcad94b22c562b30c5fe6baa0"
+    }
+  ]
+}

package/docs/contracts/engine.md

@@ -0,0 +1,39 @@
+# Pure object projection
+
+`@lapxo/bound/engine` exports `objectFold` and the existing `ObjectReading`, `ObjectRecord` and `ObjectContext` types. The CLI and receipt paths use that same implementation. Its Obligations 0.3.5 algebra is unchanged.
+
+The input is authenticated and context-admitted effective history with selected deterministic forms and parameters. This function does not admit records, verify signatures, resolve content, run commands, select clocks or write storage. Applications must perform preparation before projection.
+
+Within each epoch, a cell declaration precedes its uses in effective order. A same-epoch act before its cell refuses in preparation by name: `object context: cell not declared before <act-id>`. Lower-epoch cell declarations remain eligible even when their envelope arrives later. Effective sign/join order is preserved; transport arrival does not authorize arbitrary semantic reordering. The consumed Topos contract must be published before this export is admitted for release.
+
+Outputs preserve existing attributed origins, local and travelling marks, exact withdrawals, floor and ceiling parts and REQUIRED/FREE/FORBIDDEN/CONFLICT decisions. Raw object JSON is not a new canonical identity. Byte identity requires the existing declared reading projection.
+
+Malformed or unauthenticated records are outside this pure projector's input contract. Refusal, authority and interrupted-admission vectors exercise the host boundary; they do not claim cryptographic admission inside WASM. No host callback calculates an algebraic result in a WASM comparison.
+
+## Public conformance samples
+
+`samples/engine-interval` and `samples/engine-alphabet` are formed places: TARGET.bound, receipts.bound, package.json, the declared reader.js and inputs/sample.json. The instrument exercises the same projector against prepared fixtures; its reader is not a command users invoke. `fold <sample-directory> --check` verifies each portable receipt. Cold native `fold --as receipts` recomputes the declared conformance reading without a private store.
+
+`samples/no/engine-interval.json` and `samples/no/engine-alphabet.json` are negative data fixtures. Their captured native preparation refusal is `cell not declared before s-B`; no closed receipts are asserted for refusing input. The actual CLI vector is `vectors/engine-object.cli.json`. This conformance reader does not authenticate arbitrary signatures, coverage or clocks.
+
+
+## Optional WASM host adapter
+
+The optional `@lapxo/bound/wasm` entry evaluates the existing pure projection in QuickJS WASM. It performs no admission, signature verification, state calculation of its own, transport, key discovery or effects. Host authentication must finish before records become projection inputs. A valid digest identifies bytes; it grants no authority or confinement guarantee.
+
+The host supplies the trusted runtime/WASM/module digests, exact byte lengths, entry, aliases and limits. These expectations must come from its accepted configuration, independently of fetched place bytes. Closed request metadata and exact lengths are checked before copying, hashing or worker handoff. Shared assets refuse. Every supplied byte is verified and copied before execution; the closed runtime bundle has no imports and receives the already verified WASM binary. Guest imports resolve only within the verified module map. No second fetch occurs.
+
+`runWasmRequest` returns declared text, without inventing a JSON canonicalization or number policy. The caller's declared entry chooses the serialization contract. Memory and stack limits govern the guest; they do not describe total host/WASM initialization memory. Guest memory, stack and execution budgets are explicit host inputs. Initialization and execution times are separate readings, not a speed guarantee.
+
+`evaluateWasm` runs in a host worker. It accepts an AbortSignal and an explicit worker lifetime. Cancellation, timeout, malformed messages, failed serialization and worker errors terminate the worker and return no successful result. Guest state remains provisional until success; no host write port is supplied. A terminated computation produces no successful receipt. The direct `runWasmRequest` entry has deadline interruption but cannot asynchronously receive an external abort while synchronously executing; callers needing that contract use `evaluateWasm`.
+
+
+### Native optional WASM projection
+
+The existing object view consumes an optional, authenticated live declaration `engine/object form=alphabet measure=id value=wasm@1`. With no selector it retains the ESM projection; a conflicting or unknown selector refuses. This profile selects only the explicit object view, not every other view of the place. The host admits and folds configuration with the existing authority and withdrawal rules before selecting execution.
+
+The place declares five interval limits: `engine/wasm/memory`, `engine/wasm/stack` and `engine/wasm/response` in bytes; `engine/wasm/execution` and `engine/wasm/worker-lifetime` in milliseconds. Missing, ambiguous or invalid limits refuse; there is no inferred fallback. The installed instrument binds the guest module and supported form standings to their context implementation artifacts. A place cannot choose another verifier or executable through this selection; an unsupported form or different implementation refuses.
+
+Context initialization is measured before place execution. If observed initialized guest memory exceeds the declared memory budget, the operation refuses without running place code. Host initialization memory is outside that guest execution limit; the worker lifetime bounds the entire attempt. During execution the unchanged declared memory, stack and execution limits apply. SIGINT reaches the worker cancellation port; cancellation or failure emits no successful object result.
+
+For the opt-in `wasm@1` profile, the host verifies the selected context implementation before importing it. Every SHA-256 member declared by the context offer’s `restsOn` is checked by digest, and the existing `moduleClosure` validates the imported closure. Missing, altered, undeclared or unresolved imported members refuse before context code executes. This establishes content identity and import closure, not correctness, authority or sandbox confinement. Admission still precedes projection, and this check grants no permission to reuse a retained answer as current.

package/docs/contracts/native-publication.inventory.json

@@ -0,0 +1,8 @@
+{
+  "profile": "quartet-process@1",
+  "scope": "contract/published/native",
+  "surface": [
+    "contract/published/optional-wasm-adapter",
+    "contract/published/authenticated-reference"
+  ]
+}

package/docs/contracts/optional-wasm-adapter.publication.json

@@ -0,0 +1,25 @@
+{
+  "scope": "contract/published/optional-wasm-adapter",
+  "members": [
+    {
+      "role": "contract",
+      "path": "docs/contracts/engine.md",
+      "digest": "sha256:2d54ddc75386a0706a3bc500e36deedc85ca9e7dc965eff5c795f02b1a716078"
+    },
+    {
+      "role": "yes",
+      "path": "samples/wasm/water-level/TARGET.bound",
+      "digest": "sha256:d2f3efc176a6fa7f695dcaab93ed6f35fac4e601d0b7e47f485ac15109d11a0c"
+    },
+    {
+      "role": "vector",
+      "path": "vectors/wasm-object.cli.json",
+      "digest": "sha256:5f761fabd0592d7f8e9b95a9fc80583424a8e83fb7cb3c4b4905b62eca43db9e"
+    },
+    {
+      "role": "no",
+      "path": "samples/wasm/water-level/no-memory.bound",
+      "digest": "sha256:4c30cb6c77a9079a5961f0ff50c53830ad2c7ca8526ef63aa7c3eb4fa2af4554"
+    }
+  ]
+}

package/docs/contracts/publication-additions.inventory.json

@@ -0,0 +1,8 @@
+{
+  "profile": "quartet-process@1",
+  "scope": "contract/published/additions",
+  "surface": [
+    "contract/published/engine-object-projection",
+    "contract/published/reference-port"
+  ]
+}