@lapxo/bound 0.2.0 → 0.2.1

package/dist/host/native/native-binary.d.ts

@@ -1,54 +0,0 @@
-import { type RootStanding } from './reading.ts';
-import { type ParentExecution } from './generated.ts';
-interface NativeBinaryFields {
-    coordinate: string;
-    alias: string;
-    selector: {
-        port: string;
-        binding: string;
-        implementation: string;
-    };
-    entry: {
-        path: string;
-        digest: string;
-        bytes: number;
-    };
-    limits: {
-        bytes: number;
-    };
-    condition: string;
-}
-export type NativeBinaryProfile = NativeBinaryFields & ({
-    profile: 'host-native-binary@1';
-} | {
-    profile: 'host-native-binary-origin@1';
-    origin: string;
-});
-export interface NativeBinaryOrigin {
-    readonly coordinate: string;
-    readonly line: string;
-    readonly path: string;
-}
-/** A Root-selected local origin is a location constraint, not a World hint. */
-export declare function hostOriginPath(root: RootStanding, coordinate: string): NativeBinaryOrigin;
-export declare function nativeBinaryOrigin(root: RootStanding, p: NativeBinaryProfile, portLine: string): NativeBinaryOrigin | undefined;
-export interface VerifiedNativeBinary {
-    readonly identity: string;
-}
-export interface NativeBinaryProjection {
-    kind: 'native-binary';
-    alias: string;
-    entry: string;
-    entryDigest: string;
-    entryBytes: number;
-    condition: string;
-}
-/** Call under the existing Root guard; privateBinding is from the already
- * prepared host image, never the candidate profile's own expected digest. */
-export declare function verifyNativeBinary(root: RootStanding, coordinate: string, parent: ParentExecution, privateBinding: {
-    coordinate: string;
-    path: string;
-    digest: string;
-}): VerifiedNativeBinary;
-export declare const nativeBinaryProjection: (handle: VerifiedNativeBinary) => NativeBinaryProjection;
-export {};

package/dist/host/native/native-program.d.ts

@@ -1,56 +0,0 @@
-import { type RootStanding } from './reading.ts';
-import { type ParentExecution } from './generated.ts';
-export interface NativeProgramProfile {
-    profile: 'host-native-program@1';
-    coordinate: string;
-    alias: string;
-    selector: {
-        port: string;
-        binding: string;
-        implementation: string;
-    };
-    interpreter: {
-        path: string;
-        digest: string;
-        bytes: number;
-    };
-    root: string;
-    entry: string;
-    members: readonly {
-        coordinate: string;
-        digest: string;
-        bytes: number;
-    }[];
-    limits: {
-        members: number;
-        bytes: number;
-    };
-    condition: string;
-}
-export interface VerifiedNativeProgram {
-    readonly identity: string;
-}
-export interface NativeProgramProjection {
-    alias: string;
-    interpreter: string;
-    interpreterDigest: string;
-    entry: string;
-    root: string;
-    members: readonly {
-        path: string;
-        digest: string;
-    }[];
-    condition: string;
-}
-export declare function verifyNativeProgram(root: RootStanding, coordinate: string, parent: ParentExecution, runtimeBinding: {
-    coordinate: string;
-    path: string;
-    digest: string;
-    members: readonly {
-        coordinate: string;
-        path: string;
-    }[];
-}): VerifiedNativeProgram;
-/** Only the guarded instrument can obtain this from a verified opaque handle.
- * Put it in the signed native image; never accept it from a world proposal. */
-export declare const nativeProgramProjection: (handle: VerifiedNativeProgram) => NativeProgramProjection;

package/dist/host/native/node-jobs.d.ts

@@ -1,84 +0,0 @@
-import type { CommandPort } from '@lapxo/topos/contract';
-import type { Declaration } from './loader.ts';
-import { type Handoff } from './jobs.ts';
-export interface Location {
-    member: string;
-    path: string;
-    kind: 'binary' | 'module' | 'data';
-}
-export interface NodeImage {
-    cwd: string;
-    condition: string;
-    runtime: string;
-    preload?: string;
-    nativePreloadMembers: readonly string[];
-    commandPort?: CommandPort;
-    hostLoader?: {
-        declaration: Declaration;
-        entries: readonly string[];
-        preload: string;
-    };
-    locations: readonly Location[];
-}
-/** Observation of a completed inner command. A nonzero exit is data, never
- * silently converted into effect success; its meaning belongs to the reader. */
-export interface CapturedCommand {
-    exitStatus: number;
-    stdout: string;
-    stderr: string;
-}
-export interface PreparedNodeImage {
-    readonly identity: string;
-}
-/** Image/runtime condition and locations are instrument-admitted inputs, selected
- * before requests. Condition includes trusted Node builtins/platform libraries;
- * a binary's file digest alone does not seal every dynamic platform library. */
-export declare function prepareNodeImage(input: Handoff, inputImage: NodeImage): PreparedNodeImage;
-/** Exact expectations from the same opaque host image used by execution. */
-export declare function plannedJobs(handle: PreparedNodeImage, request: Uint8Array): readonly {
-    id: string;
-    identity: string;
-}[];
-/** Instrument-only producer lineage from the SAME private planned job used by
- * executeJobs. No fixture may invent an identity or reset shared custody. */
-export interface ParentExecution {
-    identity: string;
-    port: string;
-    binding: string;
-    implementation: string;
-    instrument: string;
-    policy: string;
-    authority: string;
-    inputs: readonly (readonly [string, string])[];
-    environment: readonly (readonly [string, string])[];
-    argv: readonly string[];
-    cwd: string;
-    runtime: string;
-    timeoutMs: number;
-    responseBytes: number;
-}
-export declare function plannedParentExecutions(handle: PreparedNodeImage, request: Uint8Array): readonly ParentExecution[];
-/** Root-owned execution resource, constructed from authenticated producer selection
- * under the authority guard. This is not a packet verifier or world callback. */
-export interface RootJobCustody {
-    open(parent: ParentExecution): Promise<{
-        assertClosed(): void;
-        close(): Promise<void>;
-        descendant?: unknown;
-    }>;
-}
-/** No partial member escapes a failed batch. Uses the existing bounded async
- * child-group executor; worker launcher is itself an exact selected module. */
-export declare function executeJobs(handle: PreparedNodeImage, request: Uint8Array, options: {
-    phase: 'act' | 'selection' | 'help' | 'check' | 'preview' | 'sign';
-    signal?: AbortSignal;
-    trace?: (event: {
-        id: string;
-        phase: 'start' | 'end';
-    }) => void;
-    custody?: RootJobCustody;
-}): Promise<readonly {
-    id: string;
-    identity: string;
-    responses: readonly CapturedCommand[];
-}[]>;

package/dist/host/native/node-launch.d.ts

@@ -1,72 +0,0 @@
-/** Parse the actual Node launch without rewriting argv or evaluating text.
- * Selection/authority and generated-member sealing belong to the Root host.
- * This is a deliberately finite native profile, not a JS sandbox. */
-export type NodeLaunch = {
-    kind: 'eval';
-    mode: 'commonjs' | 'module';
-    text: string;
-    args: readonly string[];
-    imports: readonly string[];
-} | {
-    kind: 'file';
-    entry: string;
-    args: readonly string[];
-    imports: readonly string[];
-    test: boolean;
-};
-export declare function nodeLaunch(args: readonly string[]): NodeLaunch;
-import type { NativeProgramProjection } from './native-program.ts';
-export interface SelectedInterpreter {
-    readonly path: string;
-    readonly digest: string;
-}
-export interface NativeProgramLaunch {
-    readonly interpreter: string;
-    readonly interpreterDigest: string;
-    readonly entry: string;
-    readonly args: readonly string[];
-}
-/** Only an exact, unique declared alias selects a native program. No PATH,
- * filename heuristics, option rewriting or consumer-specific names occur here. */
-export declare function projectNativeProgramLaunch(programs: readonly NativeProgramProjection[], program: string, args: readonly string[], runtime: SelectedInterpreter): NativeProgramLaunch;
-export interface NativeProgramParent {
-    readonly parent: string;
-    readonly root: string;
-    readonly members: readonly {
-        readonly path: string;
-        readonly digest: string;
-    }[];
-}
-/** Select a package-resolution context only for the exact reached parent member.
- * Root must validate the supplied parent digest against actual bytes first.
- * Node still performs actual resolution; Root checks the returned target digest
- * before handing it back. Merely sharing a path prefix grants no membership. */
-export declare function selectNativeProgramParent(programs: readonly NativeProgramProjection[], parent: {
-    readonly path: string;
-    readonly digest: string;
-}): NativeProgramParent;
-/** The fixed host receives this record only from the actual Root custodian's
- * retained before-fork evidence. This projection grants no new executable. */
-export interface NativeEvalActual {
-    readonly argv: readonly string[];
-    readonly rootPrefix: readonly string[];
-    readonly cwd: string;
-    readonly environment: readonly (readonly [string, string])[];
-    readonly runtime: string;
-}
-export interface NativeEvalParent {
-    readonly url: string;
-    readonly context: string;
-    readonly digest: string;
-    readonly mode: 'module' | 'commonjs';
-}
-import type { DerivedExecutable } from './generated.ts';
-export declare function retainedNativeEvalMatches(record: DerivedExecutable, actual: NativeEvalActual): boolean;
-/** Exact Node CLI eval origin, not a file-pattern exception. A different URL
- * continues through ordinary physical-parent verification and refuses if absent.
- * Node's module and CommonJS CLI forms have distinct observed synthetic names. */
-export declare function nativeEvalParent(record: DerivedExecutable, actual: NativeEvalActual): NativeEvalParent;
-/** Non-authoritative discovery from Node's actual runtime options only. A false
- * result confers no permission: physical-parent/load checks remain unchanged.
- * Before-fork argv validation and exact retained-record matching are separate. */
-export declare function actualNodeEvalOptions(execArgv: readonly string[]): boolean;

package/dist/host/native/preload.d.ts

@@ -1 +0,0 @@
-export {};

package/dist/host/native/reading.d.ts

@@ -1,91 +0,0 @@
-import type { Signer } from '@lapxo/topos/wire';
-import type { Request, Response } from '@lapxo/topos/contract';
-import type { Asked } from '@lapxo/topos/capsule';
-import type { CommandPort } from '@lapxo/topos/contract';
-import { type NodeImage, type RootJobCustody } from './node-jobs.ts';
-import type { Handoff, Proposal } from './jobs.ts';
-export declare const canonicalJson: (value: unknown) => string;
-export interface RootStanding {
-    readonly history: readonly string[];
-    readonly live: readonly string[];
-    readonly signer: Signer;
-    readonly eras: readonly string[];
-    readonly epoch: number;
-    readonly budget: {
-        readonly lines: number;
-        readonly bytes: number;
-    };
-}
-export interface PortProfile {
-    readonly profile: 'host-native-reading@1';
-    readonly port: CommandPort;
-    readonly selection: {
-        readonly archive: string;
-        readonly entry: string;
-        readonly reader: string;
-        readonly loaderConfig: string;
-        readonly runtime: string;
-        readonly preload: string | null;
-        readonly nativePreloadMembers: readonly string[];
-        readonly condition: string;
-        readonly budget: Handoff['budget'];
-        readonly members: readonly {
-            coordinate: string;
-            digest: string;
-        }[];
-        readonly bindings: Handoff['bindings'];
-        readonly loads: Handoff['loads'];
-    };
-}
-export interface NativeReadingModule {
-    readonly commands?: (asked: Asked) => readonly Proposal[];
-    readonly receipt?: (asked: Asked) => readonly unknown[];
-    readonly render?: (asked: Asked) => readonly string[];
-}
-export interface NativeReadingHandle {
-    readonly identity: string;
-}
-export declare function authenticateSignedPort(root: RootStanding, coordinate: string): {
-    line: string;
-    profile: unknown;
-};
-export interface AuthenticatedNativeSelection {
-    readonly identity: string;
-}
-/** One synchronous authentication supplies both the opaque boundary and its
- * immutable signed profile. Fresh Root checks still run at load and answer. */
-export declare function authenticateNativeProfile(root: RootStanding, coordinate: string): {
-    readonly selection: AuthenticatedNativeSelection;
-    readonly line: string;
-    readonly profile: PortProfile;
-};
-export declare function validateSignedNativeProfile(root: RootStanding, coordinate: string, expected: PortProfile): AuthenticatedNativeSelection;
-/** Root must hold its real authority protection across the callback. A guard
- * method is instrument code, never supplied by a command or its JSON profile. */
-export interface RootAuthorityGuard {
-    withCurrent<T>(body: (root: RootStanding) => Promise<T>): Promise<T>;
-}
-/** Fixed instrument loader, never a callback supplied by module/request/profile.
- * Root's REAL await-safe lease must cover verification, load and completion.
- * The handoff image is verified before the fixed loader receives an entry. */
-export declare function loadSignedNativeReading(selection: AuthenticatedNativeSelection, resolved: {
-    profile: PortProfile;
-    handoff: Handoff;
-    image: NodeImage;
-    archive: Uint8Array;
-    custody?: RootJobCustody;
-}, guard: RootAuthorityGuard): Promise<NativeReadingHandle>;
-export declare function answerNativeReading(handle: NativeReadingHandle, requests: readonly Request[], self: string, options: {
-    phase: 'act' | 'selection' | 'help' | 'check' | 'preview' | 'sign';
-    signal?: AbortSignal;
-    guard: RootAuthorityGuard;
-}): Promise<readonly Response[]>;
-/** Executable resources belong to the currently authenticated parent command
- * declaration, not to the separate authority-history/clock parsing budget. */
-export declare function nativeParentInputBytes(root: RootStanding, parent: {
-    port: string;
-}): number;
-/** Exact schema field names, shared by the host's selected native formats. */
-export declare function fieldNames(value: object): string;
-/** Retain each verifier's private map and return a fresh canonical projection. */
-export declare function retainedProjection<H extends object, T>(verified: WeakMap<H, T>, fail: (why: string) => never): (handle: H) => T;

package/dist/host/native/receipt-environment.d.ts

@@ -1,3 +0,0 @@
-import type { ReadingIdentityContext } from '@lapxo/topos/contract';
-import { type ReadingReference } from '../reading-context.ts';
-export declare function currentReadingEnvironment(store: string, root: string, hash: (text: string) => string, flags: readonly string[]): (context: ReadingIdentityContext) => readonly ReadingReference[] | undefined;

package/dist/host/native/references.d.ts

@@ -1,5 +0,0 @@
-import type { ReadingReference } from '../reading-context.ts';
-/** Existing leaf folds wrap parent names in the context namespace. Resolve that
- * namespace without dropping any inherited identity, and never pick a duplicate.
- */
-export declare function nativeReferenceInputs(inputs: readonly ReadingReference[], required: readonly ReadingReference[]): void;

package/dist/host/native/root.d.ts

@@ -1,17 +0,0 @@
-import { type RootAuthorityProtection } from '../../land/act.ts';
-import type { RootStanding, RootAuthorityGuard } from './reading.ts';
-import type { RootContext } from '@lapxo/topos/core';
-/** Values come from the fixed parent argv chain while it retains actual Root
- * protection. No world packet supplies the store, parent, cursor or verifier.
- */
-export interface NativeRootInheritance {
-    readonly store: string;
-    readonly parent: number;
-    readonly expected: RootContext;
-}
-export declare function currentNativeRoot(store: string, parent: number, proof: RootAuthorityProtection): {
-    readonly context: RootContext;
-    readonly root: RootStanding;
-};
-export declare function inheritedNativeRoot(inherited: NativeRootInheritance, proof: RootAuthorityProtection): RootStanding;
-export declare function inheritedNativeGuard(inherited: NativeRootInheritance, proof: RootAuthorityProtection): RootAuthorityGuard;

package/dist/host/native/route.d.ts

@@ -1,66 +0,0 @@
-import { type NativeBinaryOrigin } from './native-binary.ts';
-import { type HostControlSelection } from './control-selection.ts';
-export { materializeNativeRoute } from './materialize.ts';
-import { type PortProfile, type RootStanding } from './reading.ts';
-import type { ReadingExecution, ReadingReference } from '../reading-context.ts';
-import type { Request, Response } from '@lapxo/topos/contract';
-import type { ReaderLifetime } from '@lapxo/topos/wire';
-export interface NativeBinaryBinding {
-    readonly line: string;
-    readonly coordinate: string;
-    readonly profile: import('./native-binary.ts').NativeBinaryProfile;
-    readonly origin?: NativeBinaryOrigin;
-}
-export interface NativeRoute {
-    readonly identity: string;
-    readonly profile: PortProfile;
-    readonly binaries: readonly NativeBinaryBinding[];
-    readonly control?: HostControlSelection;
-    readonly inputs: readonly ReadingReference[];
-}
-/** Shared origins are one exact input; individual signed selectors remain separate. */
-export declare function nativeBinaryOriginInputs(binaries: readonly NativeBinaryBinding[]): readonly ReadingReference[];
-/** Inputs are semantic logical references. Fixed instrument/host graph and
- * runtime-supervisor chain must also be supplied by the calling identity builder.
- * Locations and lock-token/PID are operational custody, never these inputs.
- */
-export declare function prepareNativeRoute(store: string, coordinate: string, readerMapping?: string): NativeRoute;
-/** Recheck authority before both a current retained answer and fresh execution.
- * Historical public --check uses the existing receipt-inspection path, not this
- * command authorization route.
- */
-export declare function assertNativeRouteCurrent(route: NativeRoute): void;
-export declare function invokeNativeRoute(route: NativeRoute, input: {
-    archive: string;
-    locations: readonly {
-        member: string;
-        path: string;
-        kind: 'module' | 'data' | 'binary';
-    }[];
-    requests: readonly Request[];
-    execution: ReadingExecution;
-    limits: ReaderLifetime;
-}): readonly Response[];
-/** This predicate only schedules an outer lease. It grants no command. */
-export declare function declaredNativeReaderPorts(lines: readonly string[]): boolean;
-export declare function prepareNativeReaderRoute(store: string, reader: {
-    id: string;
-    module: string;
-}): NativeRoute | undefined;
-export declare function nativeRouteStore(route: NativeRoute): string;
-/** Quiet-pass gate: authenticate grants/cursor only, no image/materialization or
- * program execution. Historical --check remains its separate receipt path. */
-export declare function assertNativeReaderGrantsCurrent(store: string): void;
-/** Executable kinds come only from current authenticated Root declarations. A
- * matching JSON hint identifies a candidate, but is never permission to execute. */
-export declare function authenticatedNativeBinaries(root: RootStanding, profile: PortProfile): readonly NativeBinaryBinding[];
-/** Same semantic image identity for preparation, retained mount and quiet checks. */
-export declare function nativeMountIdentity(profile: PortProfile, binaries: readonly NativeBinaryBinding[], control?: HostControlSelection): string;
-export interface CurrentNativeReaderSelection {
-    readonly profile: PortProfile;
-    readonly binaries: readonly NativeBinaryBinding[];
-    readonly control?: HostControlSelection;
-}
-/** Current eligibility only: no executor graph, image load or materialization. */
-export declare function currentNativeReaderSelections(store: string): readonly CurrentNativeReaderSelection[];
-export declare function currentNativeReaderProfiles(store: string): readonly PortProfile[];

package/dist/host/native/runtime.d.ts

@@ -1,4 +0,0 @@
-/** Environment identity is not permission to bootstrap arbitrary executable
- * preloads. The fixed native entry currently has no ambient loader contract.
- */
-export declare function assertNativeRuntime(environment: Readonly<Record<string, string | undefined>>, flags: readonly string[]): void;

package/dist/host/native-reader-context.d.ts

@@ -1,3 +0,0 @@
-import type { NativeRoute } from './native/route.ts';
-export declare const nativeReaderRoute: () => NativeRoute | undefined;
-export declare function withNativeReaderRoute<T>(route: NativeRoute | undefined, run: () => T): T;

package/dist/host/objects.d.ts

@@ -1,6 +0,0 @@
-/** Bound supplies host authority and I/O; topos owns grammar, selection and context validation. */
-export declare function admittedObjects(root: string, lines: readonly string[], emit?: (text: string) => void, requireContextClosure?: boolean): Promise<{
-    records: readonly import("@lapxo/topos/wire").ObjectRecord[];
-    context: import("@lapxo/topos/wire").ObjectContext;
-    configuration: Readonly<Record<string, string>>[];
-}>;

package/dist/host/place-clock-selection.d.ts

@@ -1,55 +0,0 @@
-import { PLACE_ACT_CONTEXT, type ClockBudget, type TrustedClockContract } from '@lapxo/topos/core';
-import { type Signer } from '@lapxo/topos/wire';
-import { type PlaceActTrust, type PlaceActBudget, type PlaceActHead } from './ports/place-act.ts';
-export interface HostClockSelection {
-    readonly profile: typeof PLACE_ACT_CONTEXT;
-    readonly namespace: string;
-    readonly regionFamily: string;
-    readonly receiptSigner: string;
-    readonly receiptScope: string;
-    readonly digestAlgorithm: 'sha256';
-    readonly budget: ClockBudget;
-    readonly storageBudget: PlaceActBudget;
-    readonly initial: readonly {
-        place: string;
-        receiver: {
-            identity: string;
-            epoch: string;
-        };
-        origin: {
-            prefix: string;
-            epoch: string;
-        };
-    }[];
-}
-export interface HostClockInput {
-    readonly store: string;
-    readonly selector: string;
-    readonly profileSelector: string;
-    readonly history: readonly string[];
-    readonly anchor: Signer;
-    readonly algorithms: readonly string[];
-    readonly legacyOriginals: readonly string[];
-    /** Actual protected Root authority cursor: an authenticated signed Root config
-     * checkpoint, never a sibling receipt/evidence max epoch. */
-    readonly authorityCheckpoint: string;
-    /** Fixed host historical predecessor proof, never taken from a packet. */
-    readonly authenticatedReceiverHeads?: readonly PlaceActHead[];
-    readonly readCurrent: () => Pick<HostClockInput, 'history' | 'anchor' | 'algorithms' | 'legacyOriginals' | 'authorityCheckpoint'>;
-    readonly resources: {
-        bytes: number;
-        lines: number;
-        places: number;
-    };
-    readonly inherited: {
-        clock: ClockBudget;
-        storage: PlaceActBudget;
-    };
-    readonly historical: (encoded: string) => TrustedClockContract;
-}
-/** Root chooses selector and anchors/resources from its authenticated standing.
- * Selection must be ROOT signed; a world's signature grants no host capability. */
-export declare function hostClockSelection(input: HostClockInput): {
-    selection: HostClockSelection;
-    trust: PlaceActTrust;
-};

package/dist/host/ports/ingress.d.ts

@@ -1,24 +0,0 @@
-/** Prepared by the admitted Topos contract and receiver signer. The host does not infer origins, coverage or epochs. */
-export interface IngressBundle {
-    readonly evidence: string;
-    readonly receipt: string;
-}
-export interface IngressResult extends IngressBundle {
-    readonly kind: 'landed' | 'once';
-    readonly evidenceBytes: number;
-    readonly receiptBytes: number;
-}
-export interface IngressStorage {
-    publish(staged: string, committed: string): void;
-}
-/** Directory publication makes the pair visible together; there is no later ledger append that can expose half. */
-export declare const nativeIngressStorage: IngressStorage;
-/** Native signed receipt lines only. Foreign bytes are never added to the local ledger or epoch allocator. */
-export declare function ingressReceipts(store: string): readonly string[];
-/** Private staging directories are invisible to readers and may be discarded after host recovery. */
-export declare function ingressEvidence(store: string, identity: string): IngressBundle | undefined;
-export declare function ingressBundles(store: string): readonly IngressBundle[];
-/** Verification and signing complete before staging. Replay performs no signer invocation or persistent write. */
-export declare function commitIngress(store: string, identity: string, prepare: (localImportReceipts: readonly string[]) => Promise<IngressBundle>, verify: (bundle: IngressBundle) => boolean, storage?: IngressStorage): Promise<IngressResult>;
-/** Costs distinguish delivered bytes from newly committed bytes; no count is called information or freedom. */
-export declare function ingressCost(result: IngressResult, deliveredBytes: number, protocolBytes: number): string;

package/dist/host/ports/local-act.d.ts

@@ -1,44 +0,0 @@
-import type { PublicationStorage } from './publication.ts';
-/** Prepared and verified by the selected Topos admission/result contract. */
-export interface LocalActBundle {
-    readonly records: string;
-    readonly receipt: string;
-    readonly placements?: readonly {
-        place: string;
-        records: string;
-    }[];
-}
-export type LocalActVerification = (identity: string, bundle: LocalActBundle) => boolean;
-export declare const actLines: (bytes: string) => readonly string[];
-/** Journal integrity is not authority. Signature/coverage checks remain the
- * same admission boundary; the hash algorithm here is the stored seal's named
- * algorithm, not a new selection of the place's wire.
- */
-export declare function intactLocalAct(identity: string, bundle: LocalActBundle): boolean;
-/** Internal integrity key only, not an act identity or a wire profile. */
-export declare function committedInventoryFingerprint(rows: readonly {
-    identity: string;
-    bundle: LocalActBundle;
-}[]): string;
-/** Committed segments are part of this ledger, not a second authority source. */
-export declare function committedLocalActs(store: string): readonly {
-    identity: string;
-    bundle: LocalActBundle;
-}[];
-/** Fixed host observation only: one synchronous, coherent committed inventory.
- * It supplies no authority, verifier or async lifetime. Each outer invocation
- * rereads exact bodies before entering; current authorization still runs inside.
- */
-export declare function withCommittedLocalActObservation<T>(store: string, body: () => T): T;
-/** A public result is available only as a verified committed pair.
- * No writer-tail guess, newest-result selection or implicit authority.
- */
-export declare function localActResult(store: string, identity: string, verify: LocalActVerification): LocalActBundle | undefined;
-/** One publication point for records and their native result. Re-delivery
- * reads the original pair without preparation, signing or a new local epoch.
- * The caller must also integrate this boundary into admission-history readers;
- * this storage port alone does not activate a grammar or land authority.
- */
-export declare function commitLocalAct(store: string, identity: string, regions: readonly string[], prepare: () => Promise<LocalActBundle>, verify: LocalActVerification, storage?: PublicationStorage): Promise<LocalActBundle & {
-    readonly kind: 'landed' | 'once';
-}>;

package/dist/host/ports/place-act.d.ts

@@ -1,46 +0,0 @@
-import { type TrustedClockContract, type PlaceReceipt, type RootContext } from '@lapxo/topos/core';
-import { type PublicationStorage } from './publication.ts';
-export interface PlaceActBudget {
-    readonly acts: number;
-    readonly bytes: number;
-}
-export interface PlaceActHead {
-    readonly place: string;
-    readonly identity: string;
-    readonly epoch: string;
-}
-export interface PlaceActSnapshot {
-    readonly root: RootContext;
-    readonly heads: readonly PlaceActHead[];
-}
-/** Fixed instrument construction, never supplied by world JSON. Historical
- * authentication permits inspection only; current() is read under Root guards. */
-export interface PlaceActTrust {
-    readonly contract: TrustedClockContract;
-    readonly initialHeads: readonly PlaceActHead[];
-    readonly current: () => PlaceActSnapshot;
-    readonly historical: (encoded: string) => TrustedClockContract;
-}
-export interface PlaceActBundle {
-    readonly context: string;
-    readonly receipts: readonly PlaceReceipt[];
-    readonly originals: readonly (readonly string[])[];
-}
-/** Historical result reads never produce a current authorization permit. */
-export declare function placeActResult(store: string, id: string, trust: Pick<PlaceActTrust, 'historical'>, limits: PlaceActBudget): PlaceActBundle | undefined;
-/** Each receiver chain advances independently. Initial heads are explicit,
- * authenticated host inputs, not inferred zero or legacy global epochs. */
-export declare function placeActHeads(store: string, initial: readonly PlaceActHead[], trust: Pick<PlaceActTrust, 'historical' | 'contract'>, limits: PlaceActBudget): readonly PlaceActHead[];
-/** Context, exact original bytes and complete signed receipts have one visibility
- * point. Real Root guard exclusion spans final authority/head comparison and
- * publication; this does not activate a CLI profile or reinterpret local-act@1. */
-export declare function commitPlaceAct(store: string, encoded: string, receipts: readonly PlaceReceipt[], trust: PlaceActTrust, limits: PlaceActBudget, storage?: PublicationStorage): Promise<PlaceActBundle & {
-    readonly kind: 'landed' | 'once';
-    readonly identity: string;
-}>;
-/** Enumerates only committed, historically authenticated carriers. Namespace
- * projection is a caller's separate pure operation, never current permission. */
-export declare function committedPlaceActResults(store: string, trust: Pick<PlaceActTrust, 'historical'>, limits: PlaceActBudget): readonly {
-    identity: string;
-    bundle: PlaceActBundle;
-}[];

package/dist/host/ports/publication.d.ts

@@ -1,10 +0,0 @@
-export interface PublicationStorage {
-    publish(staged: string, committed: string): void;
-}
-export declare const nativePublicationStorage: PublicationStorage;
-/** Publish prepared bytes as one directory. No identity, grammar or authority
- * is inferred here. Readers address the committed name, never staging files.
- * A failure after rename is not evidence of rollback: the caller must retain
- * the uncertainty and allow a verified read of the committed name.
- */
-export declare function publishBundle(committed: string, files: Readonly<Record<string, string>>, storage?: PublicationStorage): void;