@lapxo/bound 0.1.9 → 0.2.1

package/dist/engine/ports.js

@@ -0,0 +1,103 @@
+import { signerRequestBytes, signerResponseBytes, signerResponseOf } from '@lapxo/topos/wire';
+import { BoundRefusal } from "../host/refusals.js";
+import { encodeUTF8 as encoded } from "./encoding.js";
+class PortFault extends BoundRefusal {
+}
+const fail = (code) => { throw new PortFault('host-port/' + code, 'REFUSE·host-port/' + code); };
+function limitsOf(limits) { if (!limits || !Number.isSafeInteger(limits.timeoutMs) || limits.timeoutMs < 1 || limits.timeoutMs > 2147483647 || !Number.isSafeInteger(limits.maxBytes) || limits.maxBytes < 1)
+    fail('budget'); }
+/** The callback must cooperate with cancellation; JavaScript callbacks are not a sandbox. */
+async function bounded(limits, signal, run) {
+    limitsOf(limits);
+    if (signal?.aborted)
+        fail('cancelled');
+    return new Promise((resolve, reject) => {
+        const controller = new AbortController();
+        let done = false;
+        const finish = (code, value) => { if (done)
+            return; done = true; clearTimeout(timer); signal?.removeEventListener('abort', abort); if (code) {
+            controller.abort();
+            reject(new BoundRefusal('host-port/' + code, 'REFUSE·host-port/' + code));
+        }
+        else
+            resolve(value); };
+        const abort = () => finish('cancelled'), timer = setTimeout(() => finish('timeout'), limits.timeoutMs);
+        signal?.addEventListener('abort', abort, { once: true });
+        if (signal?.aborted) {
+            abort();
+            return;
+        }
+        Promise.resolve().then(() => { if (done)
+            fail('cancelled'); return run(controller.signal); }).then(value => finish(undefined, value), error => finish(error instanceof PortFault ? error.code.slice('host-port/'.length) : 'failed'));
+    });
+}
+function owned(bytes, maxBytes) { if (!(bytes instanceof Uint8Array))
+    fail('response'); if (bytes.byteLength > maxBytes)
+    fail('budget'); if (typeof SharedArrayBuffer !== 'undefined' && bytes.buffer instanceof SharedArrayBuffer)
+    fail('response'); return new Uint8Array(bytes); }
+const identity = (digest) => { if (!/^sha256:[a-f0-9]{64}$/.test(digest))
+    fail('integrity'); };
+export async function readContent(source, digest, ports, limits, signal) {
+    limitsOf(limits);
+    identity(digest);
+    return bounded(limits, signal, async (s) => { const bytes = owned(await ports.read(source, digest, s), limits.maxBytes); if (s.aborted)
+        fail('cancelled'); if (await ports.digestBytes(new Uint8Array(bytes)) !== digest)
+        fail('integrity'); if (s.aborted)
+        fail('cancelled'); return bytes; });
+}
+/** Verify before invoking retention; no operation automatically writes the projected result. */
+export async function retainContent(digest, bytes, ports, limits, signal) {
+    limitsOf(limits);
+    identity(digest);
+    if (signal?.aborted)
+        fail('cancelled');
+    const copy = owned(bytes, limits.maxBytes);
+    return bounded(limits, signal, async (s) => { if (await ports.digestBytes(new Uint8Array(copy)) !== digest)
+        fail('integrity'); if (s.aborted)
+        fail('cancelled'); const result = await ports.retain(digest, copy, s); if (result !== undefined)
+        fail('response'); return Object.freeze({ digest, bytes: copy.byteLength }); });
+}
+/** Acquire protocol-shaped signatures only; the existing consent path verifies them and decides authority. */
+export async function invokeSigningPort(lot, sign, limits, signal) {
+    limitsOf(limits);
+    if (!lot || !Array.isArray(lot.bytes))
+        fail('budget');
+    let size = 0;
+    for (const bytes of lot.bytes) {
+        if (typeof bytes !== 'string' || bytes.length > limits.maxBytes - size)
+            fail('budget');
+        size += encoded(bytes).length + 1;
+        if (size > limits.maxBytes)
+            fail('budget');
+    }
+    let request;
+    try {
+        request = signerRequestBytes(lot);
+    }
+    catch {
+        return fail('response');
+    }
+    if (encoded(request).length > limits.maxBytes)
+        fail('budget');
+    const input = Object.freeze({ ...lot, bytes: Object.freeze([...lot.bytes]) });
+    return bounded(limits, signal, async (s) => {
+        const records = await sign(input, s);
+        if (!Array.isArray(records) || records.length !== lot.bytes.length || records.some(r => !r || typeof r.signature !== 'string' || r.signature.length > limits.maxBytes))
+            fail('response');
+        let response;
+        try {
+            response = signerResponseBytes(records);
+        }
+        catch {
+            return fail('response');
+        }
+        if (encoded(response).length > limits.maxBytes)
+            fail('budget');
+        try {
+            return Object.freeze(signerResponseOf(response, lot).map(record => Object.freeze({ ...record })));
+        }
+        catch {
+            return fail('response');
+        }
+    });
+}

package/dist/fold/closed.js

@@ -10,9 +10,10 @@ import { bytesDigest as hashBytes, fullDigest as hashFull } from "../host/digest
 import { mountedCoordinatesIn, worldAt } from "./places.js";
 import { ownLockOf } from "./signed.js";
 import { viewsOf } from "./views.js";
+import { keptPlace } from "./kept.js";
 import { storeAt, storeOf } from "../land/ledger.js";
 import { coordinatesUnder, observeFile, observeText } from "../observe/files.js";
-import { carriedFrom } from "./resolved.js";
+import { bytesOnly, carriedFrom } from "./resolved.js";
 import { takenFor } from "../fold/place-inputs.js";
 /** A region is closed when the digest of its bytes is the one its receipt names. Folding a closed region is idle: idleCount is how many were already closed, actSeconds the largest measured act or unpartitioned host work, receiptsSeen how many receipts were read and how long that took. */
 let idle = 0;
@@ -178,7 +179,7 @@ export async function closeReceipts(root, store, semantic) {
     return open;
 }
 /** One comparison. A place meets its receipt; the root meets when every receipt it names meets. */
-export function meets(root, store, place, current = true) {
+export function meets(root, store, place, current = true, active) {
     const name = place.replace(/\/$/, '');
     if (name === '') {
         const at = Date.now();
@@ -192,12 +193,28 @@ export function meets(root, store, place, current = true) {
             return bytes !== undefined && hashBytes(bytes, algorithm) === expected && meets(root, store, `${one}/`, current);
         });
         if (closed && carried) {
-            const algorithm = algorithmIn(own.join('\n'));
+            const algorithm = algorithmIn(own.join('\n')), hash = (text) => hashFull(text, algorithm);
             const profile = readingProfile((observeText(join(root, LOCK)) ?? '').split('\n').filter(isWire), fieldOf);
-            const readings = verifiedReadingReceipts(store, carried, text => hashFull(text, algorithm), current && profile ? currentReadingEnvironment(store, root, text => hashFull(text, algorithm), childFlags()) : undefined, profile);
+            // History keeps its canonical identity and bytes. It does not become a
+            // current execution merely because it shares a public carrier with one.
+            const readings = verifiedReadingReceipts(store, carried, hash, undefined, profile);
             if (readings === undefined)
                 closed = false;
-            else if (readings)
+            else if (current && profile && readings) {
+                const stamp = instrumentKept(store);
+                const snapshot = active ?? (stamp ? keptPlace(store, undefined, stamp)?.observed : undefined);
+                if (snapshot === undefined)
+                    closed = false;
+                else {
+                    const units = snapshot.filter(line => fieldOf(line, 'scope').startsWith('receipts/readings/') && fieldOf(line, 'role') === 'writes');
+                    const supplied = new Set(carried);
+                    const present = units.length > 0 && units.every(line => supplied.has(line) || (fieldOf(line, 'measure') === 'observed' && supplied.has(bytesOnly(line))));
+                    const fresh = present ? verifiedReadingReceipts(store, snapshot, hash, currentReadingEnvironment(store, root, hash, childFlags()), profile) : undefined;
+                    if (!fresh)
+                        closed = false;
+                }
+            }
+            if (closed && readings)
                 process.stderr.write(`RECEIPTS ${readings} read · 0 opened · reading closures\n`);
         }
         seen = { count: named.size + (own.length > 0 ? 1 : 0), ms: Date.now() - at };

package/dist/fold/digests.js

@@ -160,8 +160,9 @@ const importsOf = (store, at, digest) => {
  * A fold is a function of its points and the instrument is one of them, so a fold kept by another bound is another
  * origin's fold — readable as history, never as this instrument's own state.
  */
-export function instrumentOf(store, entry, standing = [], root = dirname(resolve(entry)), releases = []) {
-    return instrumentDigest(store, entry, standing, root, releases).replace(/^[^:]*:/, '').slice(0, 12);
+export function instrumentOf(store, entry, standing = [], root, releases = []) {
+    const coordinate = root === undefined ? resolve(entry) : resolve(root, entry);
+    return instrumentDigest(store, coordinate, standing, root ?? dirname(coordinate), releases).replace(/^[^:]*:/, '').slice(0, 12);
 }
 export function instrumentDigest(store, entry, standing = [], root = dirname(resolve(entry)), releases = []) {
     const seen = instrumentCoordinates(store, entry, standing, root, releases);

package/dist/fold/object.js

@@ -1,38 +1,2 @@
-import { cell, sign, join, require as requireFloor, observe, mark, parts, state, live, restOf } from '@lapxo/obligations/views/field';
-import { restCoordinates } from '@lapxo/topos/wire';
-export function objectFold(records, context) {
-    let world = new Map();
-    const definitions = new Map(records.filter(r => r.record === 'cell').map(r => [r.fields.scope, r]));
-    const codecs = new Map([...definitions].map(([name, c]) => [name, context.resolve(c)]));
-    const ids = new Map(records.map(r => [r.fields.id, r]));
-    for (const record of [...records].sort((a, b) => Number(a.fields.epoch) - Number(b.fields.epoch))) {
-        const f = record.fields, name = f.scope, at = Number(f.epoch);
-        if (record.record === 'cell') {
-            world = new Map([...world, [name, cell(name, at, [], restCoordinates(f.restsOn))]]);
-            continue;
-        }
-        const codec = codecs.get(name), L = codec.form.lattice(codec.params), held = world.get(name);
-        if (record.record === 'claim') {
-            const target = f.sign === '-1' ? ids.get(f.takes).fields : f;
-            const changed = observe(held, { id: f.id, at, origin: target.origin, span: codec.form.parse(codec.params, target.value), ...(f.takes ? { takes: f.takes } : {}) }, f.sign === '-1' ? -1 : 1);
-            const seen = [...changed.seen];
-            seen[seen.length - 1] = { ...seen.at(-1), id: f.id };
-            world = new Map([...world, [name, { ...changed, seen }]]);
-        }
-        else if (f.sign === '-1') {
-            const target = ids.get(f.takes).fields;
-            world = new Map([...world, [name, { ...held, marks: [...(held.marks ?? []), mark({ id: f.id, at, takes: f.takes, pole: target.pole, reach: 'local', span: codec.form.parse(codec.params, target.value) })] }]]);
-        }
-        else if (f.widens !== undefined) {
-            const changed = join(L, held, codec.form.parse(codec.params, f.value), f.widens, at);
-            const marks = [...(changed.marks ?? [])];
-            marks[marks.length - 1] = { ...marks.at(-1), id: f.id };
-            world = new Map([...world, [name, { ...changed, marks }]]);
-        }
-        else {
-            const span = codec.form.parse(codec.params, f.value);
-            world = f.pole === 'floor' ? requireFloor(L, world, name, span, { id: f.id, at }) : sign(L, world, name, span, { id: f.id, at });
-        }
-    }
-    return [...world].map(([name, c]) => { const codec = codecs.get(name), L = codec.form.lattice(codec.params); return { cell: name, state: state(L, c, world), parts: parts(L, c, world), rest: restOf(c, world), ownMarks: live(c.marks ?? []).map(m => m.id), ownClaims: live(c.seen).map(s => ({ id: s.id, origin: s.origin })), marks: live(c.marks ?? []), claims: live(c.seen) }; });
-}
+/** Compatibility path; the engine owns the single object projection. */
+export { objectFold } from "../engine/index.js";

package/dist/fold/resolved.js

@@ -60,7 +60,7 @@ export function receiptsOf(fold) {
         return canonical({ scope: `${sourced(fold.standing)}/${place}${shape}`, role: 'writes', form: 'alphabet', measure: 'digest', value: digest, by: writerFor(fold.standing, 'fold') ?? '', at: `place:${digest}` });
     });
     const place = under.replace(/\/$/, '');
-    const lines = [...named, ...[...cones].sort(), ...[...ran].sort(), ...paid]
+    const lines = [...new Set([...named, ...[...cones].sort(), ...[...ran].sort(), ...paid, ...(fold.receiptHistory ?? [])])]
         .map((line) => (place && !fieldOf(line, 'sig') ? zoomed(line, place) : line));
     if (!lines.length) {
         const shipped = (observeText(join(fold.root, under, RECEIPTS)) ?? '').split('\n').filter(isWire);

package/dist/host/admitted-place.js

@@ -35,7 +35,10 @@ export function authenticatedRootStanding(root) {
             const snapshot = history.filter(record => !isConfig(record) || Number(fieldOf(record, 'epoch')) <= epoch);
             // The signature vocabulary is configuration, not the as-yet
             // unauthenticated evidence whose values are about to be folded.
-            const wire = snapshot.filter(record => fieldOf(record, 'scope').startsWith('wire/'));
+            const wire = snapshot.filter(record => {
+                const scope = fieldOf(record, 'scope');
+                return scope.startsWith('wire/') || scope.startsWith('audit/wire/');
+            });
             authority = authorityFor(snapshot, anchor, eraOf(foldClaims(wire).standing).admitted);
             snapshots.set(epoch, authority);
         }
@@ -52,3 +55,9 @@ export function authenticatedRootStanding(root) {
 }
 /** Legacy Root lines remain unchanged; contextual public output has its own carrier. */
 export const authenticatedStanding = authenticatedRootStanding;
+/** Public current configuration omits withdrawal markers; typed effective history
+ * remains intact for the existing typed-object projection. Internal readers keep
+ * authenticatedStanding, including its historical markers. */
+export function publicStandingLines(root) {
+    return authenticatedRootStanding(root).filter(line => !isConfig(line) || fieldOf(line, 'value') !== 'withdraw');
+}

package/dist/host/cell-receipts.js

@@ -6,7 +6,7 @@ import { canonical, objectHistory, parse, byBytes, wireAt, RECEIPTS } from '@lap
 import { cellInputs, cellReceiptContract, cellInputProfile } from '@lapxo/topos/cell-inputs';
 import { renderCells } from '@lapxo/topos/cells-view';
 import { admittedObjects } from "./objects.js";
-import { objectFold } from "../fold/object.js";
+import { objectFold } from "../engine/index.js";
 import { fullDigest, bytesDigest } from "./digest.js";
 import { closeReceipts, noteIdle } from "../fold/closed.js";
 import { authorityFor, rootSigner } from "../fold/signers.js";

package/dist/host/contextual-place.js

@@ -5,7 +5,7 @@ import { commitPlaceAct, placeActResult, committedPlaceActResults } from "./port
 import { placesIn } from "../fold/places.js";
 import { appliedHistoryIn } from "../fold/signed.js";
 import { storeOf } from "../land/ledger.js";
-import { authenticatedRootStanding } from "./admitted-place.js";
+import { publicStandingLines } from "./admitted-place.js";
 import { foldClaims, fieldOf } from "../fold/claims.js";
 const fail = (s) => { throw Error('REFUSE·contextual place ' + s); };
 function read(path, limit) {
@@ -73,5 +73,5 @@ export function contextualStanding(root) {
         }
     }
     const legacyPlaces = placesIn(root).map(place => { const history = appliedHistoryIn(root, place), folded = foldClaims(history); return { namespace: 'legacy-global', place: [place, 'TARGET.bound'].join('/'), standing: folded.standing.filter(line => fieldOf(line, 'value') !== 'withdraw'), history }; });
-    return { profile: PLACE_ACT_CONTEXT, root: authenticatedRootStanding(root), legacyPlaces, contexts: acts.map(a => ({ identity: a.identity, context: a.bundle.context, receipts: a.bundle.receipts, authority: selected.authority(a.bundle.context) })), places: [...groups.values()].map(group => { const folded = foldClaims(group.lines); return { namespace: group.namespace, place: group.place, standing: folded.standing.filter(line => fieldOf(line, 'value') !== 'withdraw'), retracted: folded.retracted, superseded: folded.superseded, forks: folded.forks, contexts: group.contexts }; }) };
+    return { profile: PLACE_ACT_CONTEXT, root: publicStandingLines(root), legacyPlaces, contexts: acts.map(a => ({ identity: a.identity, context: a.bundle.context, receipts: a.bundle.receipts, authority: selected.authority(a.bundle.context) })), places: [...groups.values()].map(group => { const folded = foldClaims(group.lines); return { namespace: group.namespace, place: group.place, standing: folded.standing.filter(line => fieldOf(line, 'value') !== 'withdraw'), retracted: folded.retracted, superseded: folded.superseded, forks: folded.forks, contexts: group.contexts }; }) };
 }

package/dist/host/io.js

@@ -7,5 +7,5 @@ export { basename, dirname, join, relative, resolve } from 'node:path';
 export { fileURLToPath } from 'node:url';
 export { parentPort, workerData } from 'node:worker_threads';
 export { gzipSync } from 'node:zlib';
-/** UTF-8 encoding for host byte formats. */
-export const encodeUTF8 = (text) => new TextEncoder().encode(text);
+/** UTF-8 encoding is shared with host-free protocol ports. */
+export { encodeUTF8 } from "../engine/encoding.js";

package/dist/host/objects.js

@@ -1,18 +1,38 @@
-import { canonical, objectHistory, validateObjectContext } from '@lapxo/topos/wire';
+import { canonical, parse, objectHistory, validateObjectContext } from '@lapxo/topos/wire';
 import { objectProvider } from '@lapxo/topos/object-provider';
 import { authorityFor, rootSigner } from "../fold/signers.js";
 import { signaturesOf } from "../fold/digests.js";
 import { storeOf } from "../land/ledger.js";
 import { toposAt, contextModuleAt } from "./selected-topos.js";
+import { foldClaims } from "../fold/claims.js";
+import { usesWasmObject } from "../wasm/object.js";
 /** Bound supplies host authority and I/O; topos owns grammar, selection and context validation. */
-export async function admittedObjects(root, lines, emit = () => { }) {
+export async function admittedObjects(root, lines, emit = () => { }, requireContextClosure = false) {
     const history = objectHistory(lines);
     if (history.kind !== 'fact')
         throw Error(`REFUSE·wire ${history.why}`);
     const authority = authorityFor(lines, rootSigner(root), signaturesOf(storeOf(root)).admitted);
-    const context = await objectProvider(history.value.objects, history.value.configuration, { admit: fields => authority.of(canonical(fields)).kind === 'admitted', emit, topos: digest => toposAt(digest, storeOf(root)), module: digest => contextModuleAt(digest, storeOf(root)) });
+    const admittedConfiguration = history.value.configuration.filter(fields => authority.of(canonical(fields)).kind === 'admitted').map(fields => canonical(fields));
+    const configuration = foldClaims(admittedConfiguration).standing.flatMap(line => { const got = parse(line); return got.kind === 'fact' ? [got.value.fields] : []; });
+    const verifyClosure = requireContextClosure || usesWasmObject(configuration), declaredModules = new Map();
+    const context = await objectProvider(history.value.objects, history.value.configuration, { admit: fields => authority.of(canonical(fields)).kind === 'admitted', emit, topos: digest => {
+            const selected = toposAt(digest, storeOf(root));
+            if (verifyClosure)
+                for (const offer of selected.parts.filter(fields => fields.kind === 'check' && fields.value)) {
+                    const dependencies = [...new Set((offer.restsOn ?? '').split('|').filter(Boolean))].sort(), prior = declaredModules.get(offer.value);
+                    if (prior && JSON.stringify(prior) !== JSON.stringify(dependencies))
+                        throw Error('REFUSE·context module has conflicting declared closures');
+                    declaredModules.set(offer.value, dependencies);
+                }
+            return selected;
+        }, module: digest => {
+            const dependencies = declaredModules.get(digest);
+            if (verifyClosure && dependencies === undefined)
+                throw Error('REFUSE·context module has no declared closure');
+            return contextModuleAt(digest, storeOf(root), verifyClosure ? dependencies : undefined);
+        } });
     const checked = validateObjectContext(history.value.objects, context);
     if (checked.kind !== 'fact')
         throw Error(`REFUSE·context ${checked.why}`);
-    return { records: checked.value, context };
+    return { records: checked.value, context, configuration };
 }

package/dist/host/reading-closures.js

@@ -11,6 +11,11 @@ const receiptScope = (scope) => [scope, 'identity'].join('/');
 const fields = (line) => { const got = parse(line); if (got.kind !== 'fact')
     throw Error('REFUSE·input projection contains a non-wire line'); return got.value.fields; };
 export const inputLines = (files) => files.map(file => canonical({ scope: file.place, form: 'alphabet', measure: 'text', role: 'writes', value: 'lock', shape: file.place, about: file.text, by: 'host', at: 'policy:handed-input' }));
+/** One portable native receipt carrier shared by file plans and native capsule batches. */
+export function portableReadingReceipt(scope, by, closure, output, hash, modern = true, costs = []) {
+    const input = hash(closure), payload = hash(output), rows = output.split('\n').filter(Boolean);
+    return [...(modern ? [canonical({ scope: receiptScope(scope), role: 'writes', form: 'alphabet', measure: 'digest', value: readingReceiptIdentity(input, payload, bytes => hash(new TextDecoder().decode(bytes))), by, at: 'place:' + input })] : []), canonical({ scope, role: 'writes', form: 'alphabet', measure: 'observed', value: payload, by, at: 'place:' + payload }), canonical({ scope, role: 'writes', form: 'alphabet', measure: 'bytes', value: input, by, at: 'place:' + input, about: closure }), canonical({ scope, role: 'writes', form: 'interval', measure: 'count', value: `${rows.length}..${rows.length}`, by, at: 'place:' + payload, about: output }), ...costs];
+}
 /** The selected world owns input projection and reading. The host only verifies closures and keeps native count/bytes receipts. */
 export function readingClosures(options) {
     const { root, store, reader, speaker, digest: hash, capsule, region, projection, files } = options, emit = options.emit ?? (() => { });
@@ -135,7 +140,7 @@ export function readingClosures(options) {
                     opened++;
             }
             const receipt = context ? readingReceiptIdentity(input, payload, bytes => hash(new TextDecoder().decode(bytes))) : payload;
-            if (context)
+            if (context && plan.resolution !== 1)
                 out.push(canonical({ scope: receiptScope(scope), role: 'writes', form: 'alphabet', measure: 'digest', value: receipt, by, at: 'place:' + input }));
             results.set(plan.scope, { digest: receipt, lines });
             out.push(canonical({ scope: plan.scope, role: 'writes', form: 'alphabet', measure: 'observed', value: input, by, at: 'place:' + input }), 
@@ -147,18 +152,11 @@ export function readingClosures(options) {
             ...plan.inputs.map(coordinate => canonical({ scope: coordinate, role: 'writes', form: 'alphabet', measure: 'observed', value: hash(handed.get(coordinate)), by, at: 'witness:' + input })), ...lines);
             if (plan.resolution === 1) {
                 read++;
-                const native = shardLines(store, speaker, journal).filter(line => fieldOf(line, 'scope') === scope && ((fieldOf(line, 'measure') === 'bytes' && fieldOf(line, 'value') === input) || (fieldOf(line, 'measure') === 'count') || (fieldOf(line, 'measure') === 's' && fieldOf(line, 'at') === 'place:' + input))).map(line => {
-                    const f = fields(line), id = f.measure === 'bytes' ? f.value : f.measure === 'count' ? (f.at ?? '').replace(/^place:/, '') : undefined;
-                    if (id === undefined)
-                        return line;
-                    const bytes = load(id);
-                    if (bytes === undefined)
-                        throw Error('REFUSE·receipt missing verified carrier ' + id);
-                    // The full-resolution native row carries the actual verified UTF-8 bytes.
-                    // Its semantic count/digest is unchanged; a public copy needs no private CAS.
-                    return canonical({ ...f, about: bytes });
-                });
-                out.push(canonical({ scope, role: 'writes', form: 'alphabet', measure: 'observed', value: payload, by, at: 'place:' + payload }), ...native);
+                const output = load(payload);
+                if (output === undefined)
+                    throw Error('REFUSE·receipt missing verified carrier ' + payload);
+                const costs = shardLines(store, speaker, journal).filter(line => fieldOf(line, 'scope') === scope && fieldOf(line, 'measure') === 's' && fieldOf(line, 'at') === 'place:' + input);
+                out.push(...portableReadingReceipt(scope, by, closure, output, hash, !!context, costs));
             }
         });
     }

package/dist/host/reference-authenticated.d.ts

@@ -0,0 +1,40 @@
+import { authorityOf, validateObjectContext } from '@lapxo/topos/wire';
+type ObjectContext = Parameters<typeof validateObjectContext>[1];
+type Signer = Parameters<typeof authorityOf>[1][number];
+export interface ReferenceTrust {
+    readonly snapshot: string;
+    readonly epoch: number;
+    readonly proofScope: string;
+    readonly policy: string;
+    readonly formImplementation: string;
+    readonly signers: readonly Signer[];
+    readonly algorithms: readonly string[];
+    readonly contracts?: {
+        readonly refusals: string;
+        readonly standing: string;
+    };
+    readonly objects: ObjectContext;
+    readonly maxBytes: number;
+    readonly maxRecords: number;
+    readonly digestBytes: (bytes: Uint8Array) => string | Promise<string>;
+    readonly verifyBytes: (bytes: string, key: string, signature: string, algorithms: readonly string[]) => boolean | Promise<boolean>;
+    readonly fetchBytes: (source: string, blob: string) => Promise<Uint8Array>;
+}
+/** Prospective authenticated-standing@1 host composition; no effects and no authority from transport. */
+export declare function inspectAuthenticatedReference(fragment: string, trust: ReferenceTrust): Promise<{
+    contracts?: {
+        refusals: string;
+        standing: string;
+    } | undefined;
+    reference: import("./reference-profile.ts").StandingReference;
+    records: readonly import("@lapxo/topos/wire").ObjectRecord[];
+    semanticIdentity: string;
+    authorityContextIdentity: string;
+    semanticStanding: string;
+    originalRecords: readonly string[];
+}>;
+export { encodeReference, decodeReference } from './reference-profile.ts';
+export { BoundRefusal, readRefusalCatalog, describeRefusal } from './refusals.ts';
+export type { RefusalEntry } from './refusals.ts';
+export { readContent, retainContent, invokeSigningPort } from '../engine/ports.ts';
+export type { PortLimits, ContentReadPort, PersistencePort, DigestPort, SigningPort, SigningLot, SignatureRecord } from '../engine/ports.ts';

package/dist/host/reference-authenticated.js

@@ -0,0 +1,100 @@
+import { BoundRefusal } from "./refusals.js";
+import { parse, canonical, authorityOf, authorityAtEpoch, signedBytes, objectHistory, validateObjectContext } from '@lapxo/topos/wire';
+import { decodeReference } from "./reference-profile.js";
+import { referenceStanding, referenceContracts, referenceContextBytes } from "./reference-standing.js";
+function fail(code, why) { throw new BoundRefusal('authenticated-reference/' + code, 'REFUSE·authenticated-reference ' + why); }
+const utf8 = (s) => new TextEncoder().encode(s);
+/** Prospective authenticated-standing@1 host composition; no effects and no authority from transport. */
+export async function inspectAuthenticatedReference(fragment, trust) {
+    if (new Set(trust.signers.map(s => s.id)).size !== trust.signers.length)
+        fail('context', 'duplicate host signer');
+    const reference = decodeReference(fragment);
+    if (!Number.isSafeInteger(trust.maxBytes) || trust.maxBytes < 1 || !Number.isSafeInteger(trust.maxRecords) || trust.maxRecords < 1)
+        fail('budget', 'resource budget');
+    if (trust.contracts !== undefined) {
+        if (!referenceContracts(trust.contracts))
+            fail('context', 'contract identities');
+        const snapshot = await trust.digestBytes(referenceContextBytes({ ...trust, semanticIdentity: 'sha256:' + reference.digest, contracts: trust.contracts }));
+        if (snapshot !== trust.snapshot)
+            fail('context', 'context snapshot');
+    }
+    let received;
+    try {
+        received = await trust.fetchBytes(reference.source, reference.blob);
+    }
+    catch {
+        return fail('transport', 'content port failed');
+    }
+    if (received.byteLength > trust.maxBytes)
+        fail('budget', 'bytes budget');
+    if (typeof SharedArrayBuffer !== 'undefined' && received.buffer instanceof SharedArrayBuffer)
+        fail('transport', 'shared transport bytes');
+    const bytes = new Uint8Array(received);
+    if (await trust.digestBytes(bytes) !== reference.blob)
+        fail('integrity', 'blob integrity');
+    let text;
+    try {
+        text = new TextDecoder('utf-8', { fatal: true }).decode(bytes);
+    }
+    catch {
+        return fail('framing', 'carrier UTF-8');
+    }
+    let packet;
+    try {
+        packet = JSON.parse(text);
+    }
+    catch {
+        fail('framing', 'carrier framing');
+    }
+    if (!Array.isArray(packet) || packet.length !== 3 || packet[0] !== 'authenticated-standing@1' || !Array.isArray(packet[1]) || packet[1].length < 1 || packet[1].length > trust.maxRecords || packet[1].some((x) => typeof x !== 'string') || typeof packet[2] !== 'string' || JSON.stringify(packet) + '\n' !== text)
+        fail('framing', 'carrier framing');
+    const originals = packet[1], proofLine = packet[2];
+    const parsed = [...originals, proofLine].map(line => { const p = parse(line); if (p.kind !== 'fact' || canonical(p.value.fields) !== line)
+        fail('wire', 'original canonical'); return p.value.fields; });
+    const proof = parsed[parsed.length - 1];
+    if (proof.scope !== trust.proofScope || proof.at !== 'witness:' + trust.snapshot || proof.role !== 'writes' || proof.form !== 'alphabet' || proof.measure !== 'digest' || proof.epoch !== String(trust.epoch))
+        fail('context', 'untrusted snapshot binding');
+    if (proof.value !== await trust.digestBytes(utf8(JSON.stringify(['authenticated-standing@1', originals]) + '\n')))
+        fail('integrity', 'snapshot commitment');
+    // Async crypto port is called on exact native signed bytes; authorityOf consumes only those results.
+    const verifiedCrypto = new Set();
+    const key = (f, pub) => JSON.stringify([signedBytes(f), pub, f.sig, trust.algorithms]);
+    for (const f of parsed)
+        for (const s of trust.signers)
+            if (s.id === f.by && await trust.verifyBytes(signedBytes(f), s.publicKey, f.sig, trust.algorithms))
+                verifiedCrypto.add(key(f, s.publicKey));
+    const verifies = (f, pub) => verifiedCrypto.has(key(f, pub));
+    const authentic = authorityOf(proof, trust.signers, verifies);
+    if (authentic.kind !== 'admitted')
+        fail('authority', 'proof ' + authentic.kind + ' ' + authentic.why);
+    const signer = trust.signers.find(s => s.id === proof.by);
+    if (!signer)
+        fail('authority', 'proof signer');
+    const current = authorityAtEpoch(proof, signer, trust.epoch, trust.proofScope, 'authority');
+    if (current.kind !== 'admitted')
+        fail('authority', 'current proof ' + current.kind + ' ' + current.why);
+    const verified = new Set();
+    for (let i = 0; i < originals.length; i++) {
+        const admitted = authorityOf(parsed[i], trust.signers, verifies);
+        if (admitted.kind !== 'admitted')
+            fail('authority', 'original ' + admitted.kind + ' ' + admitted.why);
+        verified.add(originals[i]);
+    }
+    const history = objectHistory(originals);
+    if (history.kind !== 'fact')
+        fail('wire', 'wire ' + history.why);
+    if (history.value.configuration.some(f => f.value === 'withdraw'))
+        fail('history', 'configuration history requires admitted standing fold');
+    const context = { ...trust.objects, admit: (r) => verified.has(canonical(r.fields)) && trust.objects.admit(r) };
+    const checked = validateObjectContext(history.value.objects, context);
+    if (checked.kind !== 'fact')
+        throw new BoundRefusal('authenticated-reference/object-context', 'REFUSE·' + checked.why);
+    const semantic = referenceStanding(originals, checked.value), semanticIdentity = await trust.digestBytes(utf8(semantic));
+    if (semanticIdentity !== 'sha256:' + reference.digest)
+        fail('identity', 'standing identity');
+    const authorityContextIdentity = await trust.digestBytes(utf8(JSON.stringify(trust.contracts ? ['reference-inspection-trust@2', trust.snapshot, trust.epoch, trust.proofScope, trust.policy, trust.formImplementation, trust.signers, trust.algorithms, trust.contracts] : ['reference-inspection-trust@1', trust.snapshot, trust.epoch, trust.proofScope, trust.policy, trust.formImplementation, trust.signers, trust.algorithms])));
+    return { reference, records: checked.value, semanticIdentity, authorityContextIdentity, semanticStanding: semantic, originalRecords: originals, ...(trust.contracts ? { contracts: { ...trust.contracts } } : {}) };
+}
+export { encodeReference, decodeReference } from "./reference-profile.js";
+export { BoundRefusal, readRefusalCatalog, describeRefusal } from "./refusals.js";
+export { readContent, retainContent, invokeSigningPort } from "../engine/ports.js";

package/dist/host/reference-contracts.js

@@ -0,0 +1,6 @@
+import { readFileSync } from 'node:fs';
+import { sha256 } from "./hash.js";
+/** Exact shipped interpretation contracts; this helper grants no authority. */
+export function installedReferenceContracts() {
+    return { refusals: sha256(readFileSync(new URL('../../docs/contracts/refusals.bound', import.meta.url))), standing: sha256(readFileSync(new URL('../../docs/contracts/standing.bound', import.meta.url))) };
+}

package/dist/host/reference-export.d.ts

@@ -0,0 +1,33 @@
+import type { SigningPort } from '../engine/ports.ts';
+export { BoundRefusal as ReferenceExportRefusal } from './refusals.ts';
+/** Signs a public snapshot proof; never lands, refreshes evidence or changes the Root. */
+export declare function exportAuthenticatedReference(root: string, source: string, options?: {
+    readonly key?: string;
+    readonly keyFile?: string;
+    readonly signer?: string;
+    readonly hostSigner?: {
+        readonly name: string;
+        readonly sign: SigningPort;
+    };
+}): Promise<{
+    profile: string;
+    reference: string;
+    carrier: string;
+    context: {
+        snapshot: string;
+        profile: string;
+        semanticIdentity: string;
+        epoch: number;
+        proofScope: string;
+        policy: string;
+        formImplementation: string;
+        signers: readonly import("@lapxo/topos/wire").Signer[];
+        algorithms: readonly string[];
+        contracts: {
+            refusals: string;
+            standing: string;
+        };
+        maxBytes: number;
+        maxRecords: number;
+    };
+}>;