@lapxo/bound 0.1.9 → 0.2.1

package/dist/host/reference-export.js

@@ -0,0 +1,81 @@
+import { installedReferenceContracts } from "./reference-contracts.js";
+import { BoundRefusal, describeRefusal, readRefusalCatalog } from "./refusals.js";
+import { readFileSync } from 'node:fs';
+import { authorityAtEpoch, canonical, parse } from '@lapxo/topos/wire';
+import { sha256 as hash } from "./hash.js";
+import { signerFor } from "./signing.js";
+import { signConsentLot } from "../land/sign.js";
+import { underRootAuthority } from "../land/act.js";
+import { storeOf } from "../land/ledger.js";
+import { authorityFor, rootSigner } from "../fold/signers.js";
+import { admissionAnchor, admissionHistoryAt } from "../fold/admission-history.js";
+import { authenticatedRootStanding } from "./admitted-place.js";
+import { eraOf } from "../fold/digests.js";
+import { epochOf } from "../cli/owner.js";
+import { fieldOf } from "../fold/claims.js";
+import { prepareNativeReference } from "./reference-native.js";
+import { referenceContextBytes, referenceContracts, referenceStanding } from "./reference-standing.js";
+import { encodeReference } from "./reference-profile.js";
+const catalog = () => readFileSync(new URL('../../docs/contracts/refusals.bound', import.meta.url), 'utf8');
+export { BoundRefusal as ReferenceExportRefusal } from "./refusals.js";
+function fail(code) {
+    const refusal = new BoundRefusal('reference-export/' + code, 'REFUSE·reference-export/' + code);
+    const entry = describeRefusal(refusal, readRefusalCatalog(catalog()));
+    throw new BoundRefusal(entry.code, 'REFUSE·' + entry.code + ' ' + entry.meaning);
+}
+/** Signs a public snapshot proof; never lands, refreshes evidence or changes the Root. */
+export async function exportAuthenticatedReference(root, source, options = {}) {
+    try {
+        encodeReference({ class: 'standing', algorithm: 'sha256', digest: '0'.repeat(64), blob: 'sha256:' + '0'.repeat(64), source });
+    }
+    catch {
+        fail('source');
+    }
+    return underRootAuthority(storeOf(root), 'reference export', async () => {
+        const history = admissionHistoryAt(root, Number.MAX_SAFE_INTEGER), standing = authenticatedRootStanding(root), epoch = epochOf(history), era = eraOf(standing);
+        const authority = authorityFor(history, admissionAnchor(root), era.admitted);
+        const one = (scope, measure = 'id', form = 'alphabet') => { const rows = standing.filter(line => fieldOf(line, 'scope') === scope && fieldOf(line, 'value') !== 'withdraw'); if (rows.length !== 1 || fieldOf(rows[0], 'role') !== 'writes' || fieldOf(rows[0], 'measure') !== measure || fieldOf(rows[0], 'form') !== form || authority.of(rows[0]).kind !== 'admitted')
+            fail('context'); return fieldOf(rows[0], 'value'); };
+        if (one('reference/authentication') !== 'authenticated-standing@1')
+            fail('context');
+        const proofScope = one('reference/proof-scope'), contracts = { refusals: one('reference/contracts/refusals'), standing: one('reference/contracts/standing') };
+        const installed = installedReferenceContracts();
+        if (!referenceContracts(contracts) || contracts.refusals !== installed.refusals || contracts.standing !== installed.standing)
+            fail('context');
+        const count = one('reference/records'), maxRecords = Number(count), range = /^(0|[1-9][0-9]*)\.\.(0|[1-9][0-9]*)$/.exec(one('reference/export-bytes', 'bytes', 'interval'));
+        if (!/^(0|[1-9][0-9]*)$/.test(count) || !Number.isSafeInteger(maxRecords) || maxRecords < 1 || !range || Number(range[1]) > Number(range[2]) || !Number.isSafeInteger(Number(range[2])) || Number(range[2]) < 1)
+            fail('budget');
+        const maxBytes = Number(range[2]);
+        const originals = standing.filter(line => fieldOf(line, 'value') !== 'withdraw' || fieldOf(line, 'type') !== '');
+        if (!originals.length || originals.length > maxRecords || Buffer.byteLength(originals.join('\n')) > maxBytes)
+            fail('budget');
+        if (originals.some(line => authority.of(line).kind !== 'admitted'))
+            fail('history');
+        const key = options.key ?? rootSigner(root).id, signer = authority.admitted.find(s => s.id === key);
+        const stamp = canonical({ scope: proofScope, role: 'writes', form: 'alphabet', measure: 'digest', value: hash(JSON.stringify(['authenticated-standing@1', originals]) + '\n'), by: 'target', at: 'witness:' + 'sha256:' + '0'.repeat(64) });
+        const probe = parse(stamp);
+        if (!signer || probe.kind !== 'fact' || authorityAtEpoch({ ...probe.value.fields, by: key, epoch: String(epoch) }, signer, epoch, proofScope, 'authority').kind !== 'admitted')
+            fail('authority');
+        const held = await prepareNativeReference(root), semantic = referenceStanding(originals, held.records), semanticIdentity = hash(semantic);
+        const context = { profile: 'reference-export-context@1', semanticIdentity, epoch, proofScope, policy: held.policy, formImplementation: held.formImplementation, signers: authority.admitted, algorithms: era.admitted, contracts, maxBytes, maxRecords };
+        const snapshot = hash(referenceContextBytes(context));
+        if (Buffer.byteLength(JSON.stringify({ originals, context, snapshot }) + '\n') > maxBytes)
+            fail('budget');
+        const drafted = canonical({ ...probe.value.fields, at: 'witness:' + snapshot });
+        let signed;
+        try {
+            signed = await signConsentLot([drafted], { epoch, by: key, algorithm: era.era }, signer.publicKey, era.admitted, signerFor(standing, key, options.signer, options.keyFile, options.hostSigner));
+        }
+        catch {
+            fail('signer');
+        }
+        if (signed.kind !== 'fact')
+            fail('signer');
+        const carrier = JSON.stringify(['authenticated-standing@1', originals, signed.lines[0]]) + '\n';
+        const reference = encodeReference({ class: 'standing', algorithm: 'sha256', digest: semanticIdentity.slice(7), blob: hash(carrier), source });
+        const result = { profile: 'reference-export@1', reference, carrier, context: { ...context, snapshot } };
+        if (Buffer.byteLength(JSON.stringify(result) + '\n') > maxBytes)
+            fail('budget');
+        return result;
+    });
+}

package/dist/host/reference-native-api.d.ts

@@ -0,0 +1,3 @@
+/** Native host boundary. The platform-free reference inspector remains /reference. */
+export { openAuthenticatedReference } from './reference-native.ts';
+export { exportAuthenticatedReference } from './reference-export.ts';

package/dist/host/reference-native-api.js

@@ -0,0 +1,3 @@
+/** Native host boundary. The platform-free reference inspector remains /reference. */
+export { openAuthenticatedReference } from "./reference-native.js";
+export { exportAuthenticatedReference } from "./reference-export.js";

package/dist/host/reference-native.d.ts

@@ -0,0 +1,30 @@
+import { type ContentReadPort } from '../engine/ports.ts';
+export declare function authenticatedReferenceSelected(standing: readonly string[]): boolean;
+/** One context preparation shared by native export and native inspection. */
+export declare function prepareNativeReference(root: string): Promise<{
+    policy: string;
+    formImplementation: string;
+    records: readonly import("@lapxo/topos/wire").ObjectRecord[];
+    context: import("@lapxo/topos/wire").ObjectContext;
+    configuration: Readonly<Record<string, string>>[];
+}>;
+export declare function openAuthenticatedReference(root: string, fragment: string, options?: {
+    readonly signal?: AbortSignal;
+    readonly content?: {
+        readonly name: string;
+        readonly read: ContentReadPort;
+    };
+}): Promise<{
+    backend: string;
+    readings: readonly import("../engine/object.ts").ObjectReading[];
+    contracts?: {
+        refusals: string;
+        standing: string;
+    } | undefined;
+    reference: import("./reference-profile.ts").StandingReference;
+    records: readonly import("@lapxo/topos/wire").ObjectRecord[];
+    semanticIdentity: string;
+    authorityContextIdentity: string;
+    semanticStanding: string;
+    originalRecords: readonly string[];
+}>;

package/dist/host/reference-native.js

@@ -0,0 +1,74 @@
+import { readContent } from "../engine/ports.js";
+import { installedReferenceContracts } from "./reference-contracts.js";
+import { BoundRefusal } from "./refusals.js";
+import { foldObjectsWithWasm } from "../wasm/object.js";
+/** Native ports for authenticated #bound opening; trusted policy belongs to the selected local place. */
+import { sha256 as hash, isSha256 } from "./hash.js";
+import { canonical, parse, transportSelection } from '@lapxo/topos/wire';
+import { semanticStandingBytes } from '@lapxo/topos/standing';
+import { authorityFor, rootSigner } from "../fold/signers.js";
+import { eraOf } from "../fold/digests.js";
+import { lockStanding, lockLines } from "../fold/keys.js";
+import { signedOwnerLines } from "../cli/owner.js";
+import { admittedObjects } from "./objects.js";
+import { storeOf } from "../land/ledger.js";
+import { objectFold } from "../engine/index.js";
+import { toposAt, contentAt } from "./selected-topos.js";
+import { transportBytes } from "./ports/transport.js";
+import { decodeReference } from "./reference-profile.js";
+import { inspectAuthenticatedReference } from "./reference-authenticated.js";
+import { verifyBytes } from "./adapters/keys/ed25519.js";
+export function authenticatedReferenceSelected(standing) {
+    const selected = standing.flatMap(line => { const p = parse(line); return p.kind === 'fact' && p.value.fields.scope === 'reference/authentication' ? [p.value.fields] : []; });
+    if (!selected.length)
+        return false;
+    if (selected.length !== 1 || selected[0].value !== 'authenticated-standing@1')
+        throw Error('REFUSE·reference conflicting or unknown authentication profile');
+    return true;
+}
+/** One context preparation shared by native export and native inspection. */
+export async function prepareNativeReference(root) {
+    const store = storeOf(root), held = await admittedObjects(root, signedOwnerLines(store), () => { }, true);
+    const policy = held.configuration.map(fields => canonical(fields));
+    const implementations = [...new Set(held.records.filter(r => r.record === 'cell').map(r => r.fields.topos))].sort().map(pin => { const selected = toposAt(pin, store), selectors = selected.parts.filter(f => f.scope === 'wire/topos/context-view'); if (selectors.length !== 1)
+        throw Error('REFUSE·reference host context selector'); const offers = selected.parts.filter(f => f.kind === 'check' && f.view === selectors[0].value); if (offers.length !== 1)
+        throw Error('REFUSE·reference host context offer'); const offer = offers[0], closure = [...new Set((offer.restsOn ?? '').split('|').filter(Boolean))].sort(); for (const digest of closure)
+        contentAt(digest, store); return [pin, offer.value, closure]; });
+    return { ...held, policy: hash(semanticStandingBytes(policy)), formImplementation: hash(JSON.stringify(implementations)) };
+}
+export async function openAuthenticatedReference(root, fragment, options = {}) {
+    const store = storeOf(root), standing = lockStanding(store), era = eraOf(standing), authority = authorityFor(lockLines(store), rootSigner(root), era.admitted);
+    if (!authenticatedReferenceSelected(standing))
+        throw Error('REFUSE·reference no admitted authenticated-standing@1 profile');
+    const one = (scope) => { const found = standing.flatMap(line => { const p = parse(line); return p.kind === 'fact' && p.value.fields.scope === scope ? [{ line, fields: p.value.fields }] : []; }); if (found.length !== 1 || found[0].fields.role !== 'writes' || found[0].fields.measure !== 'id' || found[0].fields.form !== 'alphabet' || authority.of(found[0].line).kind !== 'admitted')
+        throw new BoundRefusal(scope === 'engine/object' ? 'reference/backend' : 'authenticated-reference/context', 'REFUSE·reference missing, conflicting or unauthenticated ' + scope); return found[0].fields.value; };
+    if (one('reference/authentication') !== 'authenticated-standing@1')
+        throw Error('REFUSE·reference authentication profile');
+    const snapshot = one('reference/snapshot'), epochText = one('reference/epoch'), proofScope = one('reference/proof-scope'), recordsText = one('reference/records');
+    if (!isSha256(snapshot) || !/^\d+$/.test(epochText) || !Number.isSafeInteger(Number(epochText)) || !/^\d+$/.test(recordsText) || !Number.isSafeInteger(Number(recordsText)) || Number(recordsText) < 1 || !proofScope)
+        throw Error('REFUSE·reference authority snapshot or resource contract');
+    const backend = one('engine/object');
+    if (!['esm@1', 'wasm@1'].includes(backend))
+        throw new BoundRefusal('reference/backend', 'REFUSE·reference unsupported declared backend');
+    if (options.signal?.aborted)
+        throw new BoundRefusal('reference/cancelled', 'REFUSE·reference cancelled');
+    const reference = decodeReference(fragment);
+    // Provider selection is made from HOST-declared cells/configuration, never carrier-picked code.
+    const held = await prepareNativeReference(root);
+    if (!held.records.some(r => r.record === 'cell'))
+        throw Error('REFUSE·reference host has no declared object interpretation');
+    const context = held.context, policy = held.configuration.map(fields => canonical(fields)), selection = transportSelection(held.configuration, new URL(reference.source).protocol.slice(0, -1));
+    if (!selection)
+        throw Error('REFUSE·reference no admitted transport policy');
+    if (options.content && options.content.name !== selection.name)
+        throw new BoundRefusal('authenticated-reference/transport', 'REFUSE·reference injected content binding conflicts with declaration');
+    const contracts = { refusals: one('reference/contracts/refusals'), standing: one('reference/contracts/standing') }, expectedPolicy = one('reference/policy'), expectedImplementation = one('reference/form-implementation');
+    const installed = installedReferenceContracts();
+    if (contracts.refusals !== installed.refusals || contracts.standing !== installed.standing || !isSha256(expectedPolicy) || expectedImplementation !== held.formImplementation)
+        throw new BoundRefusal('authenticated-reference/context', 'REFUSE·reference expected interpretation differs');
+    const result = await inspectAuthenticatedReference(fragment, { snapshot, epoch: Number(epochText), proofScope, contracts, policy: expectedPolicy, formImplementation: expectedImplementation, signers: authority.admitted, algorithms: era.admitted, objects: context, maxBytes: selection.responseBytes, maxRecords: Number(recordsText), digestBytes: hash, verifyBytes, fetchBytes: (source, blob) => options.content ? readContent(source, blob, { read: options.content.read, digestBytes: hash }, { timeoutMs: selection.timeoutMs, maxBytes: selection.responseBytes }, options.signal) : transportBytes(source, blob, policy) });
+    if (options.signal?.aborted)
+        throw new BoundRefusal('reference/cancelled', 'REFUSE·reference cancelled');
+    const readings = backend === 'wasm@1' ? await foldObjectsWithWasm(root, result.records, context, held.configuration, options.signal) : objectFold(result.records, context);
+    return { ...result, backend, readings };
+}

package/dist/host/reference-profile.d.ts

@@ -0,0 +1,23 @@
+/** reference-profile@1: platform URL parsing, no authority or transport effects. */
+export interface StandingReference {
+    readonly class: 'standing';
+    readonly algorithm: 'sha256';
+    readonly digest: string;
+    readonly blob: string;
+    readonly source: string;
+}
+interface InspectionPort {
+    readonly maxBytes: number;
+    readonly readSemanticStanding: (bytes: string) => readonly string[];
+    readonly semanticStandingBytes: (lines: readonly string[]) => string;
+    readonly digestBytes: (bytes: Uint8Array) => string;
+}
+export declare function encodeReference(reference: StandingReference): string;
+export declare function decodeReference(fragment: string): StandingReference;
+export declare function inspectReferenceBytes(reference: StandingReference, bytes: Uint8Array, { maxBytes, readSemanticStanding, semanticStandingBytes, digestBytes }: InspectionPort): {
+    reference: StandingReference;
+    lines: readonly string[];
+    standing: string;
+    authentication: string;
+};
+export {};

package/dist/host/reference-profile.js

@@ -0,0 +1,63 @@
+import { BoundRefusal } from "./refusals.js";
+const hex = /^[0-9a-f]{64}$/;
+const refuse = (cause) => { throw new BoundRefusal('reference/format', `REFUSE·reference ${cause}`); };
+const keys = ['class', 'algorithm', 'digest', 'blob', 'source'];
+function check(reference) {
+    if (Object.keys(reference).length !== keys.length || keys.some(key => !Object.prototype.hasOwnProperty.call(reference, key)))
+        refuse('fields');
+    if (reference.class !== 'standing')
+        refuse('unknown class');
+    if (reference.algorithm !== 'sha256')
+        refuse('unknown algorithm');
+    if (!hex.test(reference.digest) || !/^sha256:[0-9a-f]{64}$/.test(reference.blob))
+        refuse('digest');
+    let source;
+    try {
+        source = new URL(reference.source);
+    }
+    catch {
+        return refuse('source URL');
+    }
+    if (source.username || source.password || source.hash)
+        refuse('source credentials or fragment');
+    if (source.href !== reference.source)
+        refuse('noncanonical source URL');
+    return reference;
+}
+export function encodeReference(reference) {
+    check(reference);
+    return '#bound:1?' + keys.map(key => key + '=' + encodeURIComponent(reference[key])).join('&');
+}
+export function decodeReference(fragment) {
+    if (!fragment.startsWith('#bound:1?'))
+        refuse('profile');
+    const parameters = new URLSearchParams(fragment.slice('#bound:1?'.length));
+    if ([...parameters].length !== keys.length || new Set(parameters.keys()).size !== keys.length)
+        refuse('duplicate or missing field');
+    const reference = check(Object.fromEntries(parameters));
+    if (encodeReference(reference) !== fragment)
+        refuse('noncanonical encoding');
+    return Object.freeze(reference);
+}
+export function inspectReferenceBytes(reference, bytes, { maxBytes, readSemanticStanding, semanticStandingBytes, digestBytes }) {
+    if (bytes.byteLength > maxBytes)
+        refuse('bytes budget');
+    if (digestBytes(bytes) !== reference.blob.slice(7))
+        refuse('blob integrity');
+    let document;
+    try {
+        document = JSON.parse(new TextDecoder('utf-8', { fatal: true }).decode(bytes));
+    }
+    catch {
+        refuse('document');
+    }
+    if (document === null || typeof document !== 'object' || document.profile !== 'semantic-standing@1' || typeof document.standing !== 'string' || Object.keys(document).length !== 2)
+        refuse('document profile');
+    if (new TextDecoder('utf-8', { fatal: true }).decode(bytes) !== JSON.stringify({ profile: document.profile, standing: document.standing }))
+        refuse('noncanonical document wrapper');
+    const lines = readSemanticStanding(document.standing);
+    const semantic = semanticStandingBytes(lines);
+    if (digestBytes(new TextEncoder().encode(semantic)) !== reference.digest)
+        refuse('standing identity');
+    return { reference, lines, standing: semantic, authentication: 'not demonstrated; inspect only' };
+}

package/dist/host/reference-standing.js

@@ -0,0 +1,18 @@
+import { parse } from '@lapxo/topos/wire';
+import { cellInputs } from '@lapxo/topos/cell-inputs';
+import { semanticStandingBytes } from '@lapxo/topos/standing';
+/** Shared projection after admission; transport order never replaces effective order. */
+export function referenceStanding(originals, records) {
+    const membership = new Set([...cellInputs(records, 'semantic-live@2').values()].flat().map(line => semanticStandingBytes([line])));
+    const fields = (line) => { const p = parse(line); if (p.kind !== 'fact')
+        throw Error('REFUSE·authenticated-reference original parse'); return p.value.fields; };
+    const effective = [...originals].sort((a, b) => Number(fields(a).epoch) - Number(fields(b).epoch));
+    return semanticStandingBytes(effective.filter(line => fields(line).type === undefined || membership.has(semanticStandingBytes([line]))));
+}
+export function referenceContracts(value) {
+    return value !== null && typeof value === 'object' && !Array.isArray(value) && Object.keys(value).length === 2 && /^sha256:[a-f0-9]{64}$/.test(value.refusals) && /^sha256:[a-f0-9]{64}$/.test(value.standing);
+}
+/** This versioned context frame binds interpretation contracts without changing wire fields. */
+export function referenceContextBytes(context) {
+    return new TextEncoder().encode(JSON.stringify(['reference-export-context@1', context.semanticIdentity, context.epoch, context.proofScope, context.policy, context.formImplementation, context.signers, context.algorithms, context.contracts.refusals, context.contracts.standing, context.maxBytes, context.maxRecords]) + '\n');
+}

package/dist/host/reference.js

@@ -0,0 +1,24 @@
+/** Host composition. Location supplies bytes, never identity or authority. No store writes. */
+import { createHash } from 'node:crypto';
+import { readSemanticStanding, semanticStandingBytes } from '@lapxo/topos/core';
+import { parse, transportSelection } from '@lapxo/topos/wire';
+import { transportBytes } from "./ports/transport.js";
+import { decodeReference, inspectReferenceBytes } from "./reference-profile.js";
+export async function inspectReference(fragment, policy) {
+    const reference = decodeReference(fragment), scheme = new URL(reference.source).protocol.slice(0, -1);
+    const fields = policy.flatMap(line => { const got = parse(line); return got.kind === 'fact' ? [got.value.fields] : []; });
+    const selected = transportSelection(fields, scheme);
+    if (selected === undefined)
+        throw Error(`REFUSE·transport ${scheme} no admitted content-request/1 policy`);
+    let bytes;
+    try {
+        bytes = await transportBytes(reference.source, reference.blob, policy);
+    }
+    catch (error) {
+        const cause = error instanceof Error ? error.message : 'transport failed';
+        if (cause.startsWith('REFUSE·'))
+            throw error;
+        throw Error(`REFUSE·transport ${scheme} ${cause}`);
+    }
+    return inspectReferenceBytes(reference, bytes, { maxBytes: selected.responseBytes, readSemanticStanding, semanticStandingBytes, digestBytes: value => createHash('sha256').update(value).digest('hex') });
+}

package/dist/host/refusals.d.ts

@@ -0,0 +1,14 @@
+export interface RefusalEntry {
+    readonly code: string;
+    readonly category: string;
+    readonly meaning: string;
+    readonly next: string;
+}
+/** Stable code assigned at the cause. Details are diagnostic, never parsed as policy. */
+export declare class BoundRefusal extends Error {
+    readonly code: string;
+    constructor(code: string, diagnostic: string);
+}
+/** Pure machine contract reader. A catalog is data, never an authority grant. */
+export declare function readRefusalCatalog(text: string): readonly RefusalEntry[];
+export declare function describeRefusal(error: BoundRefusal, catalog: readonly RefusalEntry[]): RefusalEntry;

package/dist/host/refusals.js

@@ -0,0 +1,43 @@
+import { parse, canonical } from '@lapxo/topos/wire';
+/** Stable code assigned at the cause. Details are diagnostic, never parsed as policy. */
+export class BoundRefusal extends Error {
+    constructor(code, diagnostic) { super(diagnostic); this.name = 'BoundRefusal'; this.code = code; }
+}
+/** Pure machine contract reader. A catalog is data, never an authority grant. */
+export function readRefusalCatalog(text) {
+    const groups = new Map();
+    let profile = false;
+    for (const line of text.trimEnd().split('\n')) {
+        const parsed = parse(line);
+        if (parsed.kind !== 'fact' || canonical(parsed.value.fields) !== line)
+            throw new BoundRefusal('catalog/invalid', 'REFUSE·invalid refusal catalog line');
+        const f = parsed.value.fields;
+        if (f.scope === 'refusal/catalog' && f.measure === 'id' && f.value === 'bound-refusals@1' && f.role === 'writes' && f.form === 'alphabet' && !profile) {
+            profile = true;
+            continue;
+        }
+        if (f.role !== 'writes' || f.form !== 'alphabet' || !f.scope?.startsWith('refusal/') || !['code', 'class', 'next'].includes(f.measure ?? ''))
+            throw new BoundRefusal('catalog/invalid', 'REFUSE·invalid refusal catalog record');
+        const group = groups.get(f.scope) ?? new Map();
+        if (group.has(f.measure))
+            throw new BoundRefusal('catalog/invalid', 'REFUSE·duplicate refusal catalog field');
+        group.set(f.measure, f);
+        groups.set(f.scope, group);
+    }
+    const entries = [];
+    for (const [scope, group] of groups) {
+        const code = group.get('code')?.value, category = group.get('class')?.value, meaning = group.get('class')?.about, next = group.get('next')?.value;
+        if (group.size !== 3 || !code || scope !== 'refusal/' + code || !category || !meaning || !next)
+            throw new BoundRefusal('catalog/invalid', 'REFUSE·incomplete refusal catalog entry');
+        entries.push(Object.freeze({ code, category, meaning, next }));
+    }
+    if (!profile || !entries.length)
+        throw new BoundRefusal('catalog/invalid', 'REFUSE·missing refusal catalog profile');
+    return Object.freeze(entries);
+}
+export function describeRefusal(error, catalog) {
+    const entry = catalog.find(row => row.code === error.code);
+    if (!entry)
+        throw new BoundRefusal('catalog/invalid', 'REFUSE·undeclared refusal code');
+    return entry;
+}

package/dist/host/selected-topos.js

@@ -2,6 +2,8 @@ import { verifiedContent } from "./content-store.js";
 import { readStanding } from '@lapxo/topos/standing';
 import { parse, wireAt, fromLine } from '@lapxo/topos/wire';
 import { fieldOf } from "../fold/claims.js";
+import { moduleClosure } from "./native/module-closure.js";
+import { sha256, isSha256 } from "./hash.js";
 /** Local grammar is sufficient for locally declared records. Resolve selected
  * contracts only when a reader is missing; a local refusal remains a refusal. */
 export function admittedLine(line, local, epoch, pins, resolve = toposAt) {
@@ -26,7 +28,13 @@ export function contentAt(digest, store) {
     return verifiedContent(digest, store).bytes;
 }
 /** The declared module runs from the store that supplied its verified bytes. No copy or live-checkout fallback. */
-export function contextModuleAt(digest, store) {
+export function contextModuleAt(digest, store, dependencies) {
+    if (dependencies !== undefined) {
+        if (!isSha256(digest) || !dependencies.includes(digest) || dependencies.some(pin => !isSha256(pin)))
+            throw Error('REFUSE·context module closure requires declared SHA-256 members');
+        const pins = [...new Set(dependencies)].sort(), members = new Map(pins.map(pin => [pin.slice(pin.indexOf(':') + 1), { digest: pin, source: new TextDecoder('utf-8', { fatal: true }).decode(contentAt(pin, store)) }]));
+        moduleClosure({ identity: sha256(JSON.stringify(pins)), entry: digest.slice(digest.indexOf(':') + 1), members }, () => undefined);
+    }
     return verifiedContent(digest, store).path;
 }
 /** Selection verifies standing identity. Requested capabilities verify their artifact bytes separately. */

package/dist/host/signing.js

@@ -1,3 +1,4 @@
+import { invokeSigningPort } from "../engine/ports.js";
 import { readFileSync } from 'node:fs';
 import { parse, signerSelection, signerRequestBytes, signerResponseBytes, signerResponseOf } from '@lapxo/topos/wire';
 import { invokeSigner, SigningFailure } from "./ports/signing.js";
@@ -31,11 +32,16 @@ function binding(name, keyFile) {
     }
 }
 /** Resolve data before acquisition; all mechanisms use one wire protocol and verification path. */
-export function signerFor(lines, keyId, selected, keyFile) {
+export function signerFor(lines, keyId, selected, keyFile, injected) {
     const fields = lines.flatMap(line => { const got = parse(line); return got.kind === 'fact' ? [got.value.fields] : []; });
     const declaration = signerSelection(fields, keyId);
     if (selected !== undefined && selected !== declaration.name)
         throw new SigningFailure(`REFUSE·signer ${keyId} CLI selection conflicts with declaration`);
+    if (injected) {
+        if (injected.name !== declaration.name || keyFile)
+            throw new SigningFailure('REFUSE·signer injected host binding conflicts with declaration or key file');
+        return (lot) => invokeSigningPort(lot, injected.sign, { timeoutMs: declaration.timeoutMs, maxBytes: declaration.responseBytes });
+    }
     const mechanism = binding(declaration.name, keyFile);
     const protocol = { request: signerRequestBytes, response: signerResponseBytes, reply: signerResponseOf };
     return (lot) => invokeSigner(lot, mechanism, protocol, declaration);

package/dist/observe/files.js

@@ -24,7 +24,17 @@ function bytesAt(at) {
     const held = seen.get(at);
     if (held?.stamp === stamp)
         return held.bytes;
-    const bytes = readFileSync(at);
+    let bytes;
+    try {
+        bytes = readFileSync(at);
+    }
+    catch (error) {
+        // A concurrent act can retire a coordinate after its stamp was read.
+        if (error.code !== 'ENOENT')
+            throw error;
+        seen.delete(at);
+        return undefined;
+    }
     seen.set(at, { stamp, bytes });
     return bytes;
 }

package/dist/observe/regions.js

@@ -1,3 +1,11 @@
+import { childFlags } from "../host/capsule.js";
+import { readingProfile, readingExecution, withReadingBoundary } from "../host/reading-context.js";
+import { readingIdentityBytes } from '@lapxo/topos/contract';
+import { portableReadingReceipt, verifiedReadingReceipts } from "../host/reading-closures.js";
+import { bytesDigest, instrumentCoordinates } from "../fold/digests.js";
+import { ownRoot, processOf } from "./runner.js";
+import { contentPolicy } from "../host/content-store.js";
+import { carriedFrom } from "../fold/resolved.js";
 import { selectedCapsules } from "../host/selected-capsules.js";
 import { selectionLines, projectionLines } from "../fold/reach.js";
 export { selectionLines } from "../fold/reach.js";
@@ -22,6 +30,7 @@ import { ownLock } from "./runner.js";
 import { nameOf } from "../render/page.js";
 import { placeLines, takenFor } from "../fold/place-inputs.js";
 import { isRegionDeclaration } from "../fold/region-declarations.js";
+const receiptHasher = (store) => (text) => bytesDigest(store, new TextEncoder().encode(text));
 const fact = (scope, value, form = 'alphabet', measure = 'fact') => canonical({ scope, role: 'writes', form, measure, value, by: 'fold', at: 'place:fold' });
 const described = (local = []) => {
     const lock = ownLock();
@@ -164,12 +173,30 @@ function capsuleReadings(fold) {
     return known.get(place) ?? known.set(place, readingsAt(fold, place)).get(place);
 }
 function readingsAt(fold, place) {
-    const asking = askingOf(fold);
     const speaker = keyFor(fold.store, 'read');
     return capsulesOf(fold).flatMap((capsule) => {
         const writing = new Set(capsule.lines.filter((line) => fieldOf(line, 'scope').startsWith('region/') && fieldOf(line, 'measure') === 'writes').map((line) => fieldOf(line, 'scope').slice('region/'.length)));
         const receipts = Object.keys(capsule.declaration.writes).filter((name) => capsule.declaration.writes[name] === 'receipt' && !writing.has(name)).sort();
+        const target = modernReceiptInputs(fold, capsule.selection ?? capsule.digest);
+        const asking = askingOf({ ...fold, observed: target.current });
         const requests = receipts.flatMap((name) => ((request) => (request === undefined ? [] : [request]))(asking(capsule.declaration, { name, at: 3 }, 'read', '')));
+        const modern = readingProfile(fold.standing, fieldOf);
+        if (modern && requests.length) {
+            const hash = receiptHasher(fold.store);
+            const batch = hash(JSON.stringify([capsule.selection ?? capsule.digest, capsule.digest, receipts]));
+            const coordinates = instrumentCoordinates(fold.store, processOf('verb'), [], ownRoot(), ownLock(), true), instrument = hash([...coordinates.values()].sort().join('\n'));
+            const legacy = target.legacy;
+            return requests.flatMap(request => {
+                const execution = readingExecution({ instrument, implementation: capsule.digest, policy: hash(JSON.stringify([contentPolicy(), capsule.selection ?? null, capsule.lines])), inputs: [['world', capsule.selection ?? capsule.digest], ['batch', batch], ['request', hash(JSON.stringify(request))], ...legacy, ...[...coordinates].map(([name, id]) => ['host/' + relative(ownRoot(), name), id])] }, hash, { env: process.env, cwd: fold.root, flags: childFlags() });
+                const closure = new TextDecoder().decode(readingIdentityBytes(execution.context)), input = hash(closure), said = withReadingBoundary(input, execution, () => capsule.ask([request]))[0];
+                if (said?.kind !== 'fact')
+                    throw Error(`REFUSE·capsule ${capsule.digest} · ${request.region} · ${said?.why ?? 'no answer'}`);
+                const by = speaker + ':' + batch.slice(7), at = 'place:' + input;
+                const lines = (said.claims ?? []).map((row) => canonical({ scope: row.scope, role: row.role, measure: row.measure, form: row.bound.kind === 'interval' ? 'interval' : 'alphabet', value: row.bound.kind === 'interval' ? `${row.bound.lo ?? 0}..${row.bound.hi ?? 0}` : (row.bound.values ?? []).join('|'), by, at }));
+                const output = lines.join('\n') + (lines.length ? '\n' : ''), scope = 'receipts/readings/' + hash(request.region ?? '').slice(7) + '/' + input.slice(7);
+                return [canonical({ scope: place, role: 'writes', form: 'alphabet', measure: 'observed', value: input.slice(7, 23), by, at }), ...lines, ...portableReadingReceipt(scope, by, closure, output, hash)];
+            });
+        }
         const answers = capsule.ask(requests);
         const refused = requests.filter((_, i) => answers[i]?.kind !== 'fact');
         if (refused.length)
@@ -196,3 +223,84 @@ export function capsuleReadingsOver(fold) {
     return [...capsuleReadings(fold), ...places.flatMap((place) => capsuleReadings({ ...fold, under: `${place}/`,
             standing: [...new Set([...said.filter((one) => one.place === place).map((one) => one.line), ...fold.standing])] }))];
 }
+/** Current judgement excludes authenticated outcomes of the selected producer batches; retained evidence stays in its carrier. */
+export const currentReceiptObservations = (fold) => modernReceiptInputs(fold).current;
+/** Preserve prior producer outcomes in the owning place's public carrier, independently of current judgement. */
+export const retiredReceiptHistory = (fold) => { const carried = carriedFrom(fold.store, (observeText(join(fold.root, fold.under ?? '', 'receipts.bound')) ?? '').split('\n').filter(line => line.startsWith('bound-lock/'))) ?? []; const all = [...new Set([...fold.observed, ...carried])], current = new Set(modernReceiptInputs({ ...fold, observed: all }).current); return all.filter(line => !current.has(line)); };
+/** A modern capsule batch cannot consume its own retained outcomes. Full context units bind history; legacy conversion never supplies a current answer. */
+function modernReceiptInputs(fold, target) {
+    if (!readingProfile(fold.standing, fieldOf))
+        return { current: fold.observed, legacy: [] };
+    const observed = [...new Set(fold.observed)];
+    const hash = receiptHasher(fold.store), allSelected = capsulesOf(fold), selected = allSelected.filter(c => { const writing = new Set(c.lines.filter(l => fieldOf(l, 'measure') === 'writes').map(l => fieldOf(l, 'scope').slice(7))); return Object.keys(c.declaration.writes).some(n => c.declaration.writes[n] === 'receipt' && !writing.has(n)); });
+    if (!selected.length)
+        return { current: fold.observed, legacy: [] };
+    const speaker = keyFor(fold.store, 'read'), removed = new Set(), refs = [];
+    const units = observed.filter(l => fieldOf(l, 'scope').startsWith('receipts/readings/') && fieldOf(l, 'measure') === 'bytes' && fieldOf(l, 'role') === 'writes');
+    if (verifiedReadingReceipts(fold.store, observed, hash, undefined, true) === undefined)
+        throw Error('REFUSE·capsule receipt carrier context invalid');
+    for (const capsule of selected) {
+        if (target !== undefined && (capsule.selection ?? capsule.digest) !== target)
+            continue;
+        const writing = new Set(capsule.lines.filter(l => fieldOf(l, 'measure') === 'writes').map(l => fieldOf(l, 'scope').slice(7))), receipts = Object.keys(capsule.declaration.writes).filter(n => capsule.declaration.writes[n] === 'receipt' && !writing.has(n)).sort();
+        if (!receipts.length)
+            continue;
+        const batch = hash(JSON.stringify([capsule.selection ?? capsule.digest, capsule.digest, receipts])), knownLegacy = new Set();
+        for (const unit of units) {
+            const about = fieldOf(unit, 'about');
+            if (!about)
+                continue;
+            let c;
+            try {
+                c = JSON.parse(about);
+            }
+            catch {
+                continue;
+            }
+            if (!Array.isArray(c) || c[0] !== 'reading-context@1' || c[2] !== capsule.digest || !Array.isArray(c[4]) || !c[4].some(([n, id]) => n === 'batch' && id === batch) || !c[4].some(([n, id]) => n === 'world' && id === (capsule.selection ?? capsule.digest)))
+                continue;
+            const expectedBy = speaker + ':' + batch.slice(7);
+            if (fieldOf(unit, 'by') !== expectedBy)
+                continue;
+            if (fold.standing.some(line => fieldOf(line, 'scope') === 'keys/' + expectedBy && fieldOf(line, 'value') !== 'withdraw'))
+                throw Error('REFUSE·modern capsule receipt producer ambiguous');
+            const namedScope = fieldOf(unit, 'scope'), inputIdentity = fieldOf(unit, 'value');
+            if (!receipts.some(name => namedScope === 'receipts/readings/' + hash(name).slice(7) + '/' + inputIdentity.slice(7)))
+                throw Error('REFUSE·modern capsule receipt scope differs from declared region');
+            for (const [n, id] of c[4])
+                if (typeof n === 'string' && n.startsWith('legacy/output/') && n === 'legacy/output/' + id) {
+                    knownLegacy.add(id);
+                    refs.push([n, id]);
+                }
+            const by = fieldOf(unit, 'by'), input = fieldOf(unit, 'value'), scope = fieldOf(unit, 'scope'), output = observed.find(l => fieldOf(l, 'scope') === scope && fieldOf(l, 'by') === by && fieldOf(l, 'measure') === 'count');
+            const payload = output ? fieldOf(output, 'at') : '';
+            for (const l of observed)
+                if (fieldOf(l, 'by') === by && (fieldOf(l, 'at') === 'place:' + input || fieldOf(l, 'at') === payload || fieldOf(l, 'scope') === scope || fieldOf(l, 'scope') === [scope, 'identity'].join('/')))
+                    removed.add(l);
+        }
+        const alias = capsule.digest.slice(7, 19), by = speaker + ':' + alias, groups = new Map();
+        for (const l of observed)
+            if (fieldOf(l, 'by') === by) {
+                const at = fieldOf(l, 'at');
+                groups.set(at, [...(groups.get(at) ?? []), l]);
+            }
+        if (groups.size) {
+            if (selected.filter(c => c.digest === capsule.digest).length !== 1 || receipts.length !== 1 || new Set(allSelected.filter(c => c.digest.slice(7, 19) === alias).map(c => c.digest)).size !== 1 || fold.standing.some(l => fieldOf(l, 'scope') === 'keys/' + by && fieldOf(l, 'value') !== 'withdraw'))
+                throw Error('REFUSE·legacy capsule receipt producer ambiguous');
+            for (const [at, group] of groups) {
+                if (!/^place:sha256:[a-f0-9]{64}$/.test(at) || group.filter(l => fieldOf(l, 'measure') === 'observed' && fieldOf(l, 'scope') === (fold.under || './')).length !== 1)
+                    throw Error('REFUSE·legacy capsule receipt occurrence ambiguous');
+                const id = hash(group.join('\n'));
+                if (!knownLegacy.has(id)) {
+                    const candidate = observed.filter(l => !removed.has(l) && !group.includes(l)), request = askingOf({ ...fold, observed: candidate })(capsule.declaration, { name: receipts[0], at: 3 }, 'read', '');
+                    if (!request || at !== 'place:' + hash(JSON.stringify(request)))
+                        throw Error('REFUSE·legacy capsule receipt context unavailable · expected ' + at + ' · current ' + (request ? hash(JSON.stringify(request)) : 'absent'));
+                }
+                refs.push(['legacy/output/' + id, id]);
+                for (const l of group)
+                    removed.add(l);
+            }
+        }
+    }
+    return { current: observed.filter(l => !removed.has(l)), legacy: [...new Map(refs.map(([n, id]) => [n + ' ' + id, [n, id]])).values()] };
+}