@lapxo/bound 0.2.0 → 0.2.1

package/dist/engine/index.d.ts

@@ -9,3 +9,5 @@
 export { objectFold } from './object.ts';
 export type { ObjectReading } from './object.ts';
 export type { ObjectRecord, ObjectContext } from '@lapxo/topos/wire';
+export { readContent, retainContent, invokeSigningPort } from './ports.ts';
+export type { PortLimits, ContentReadPort, PersistencePort, DigestPort, SigningPort, SigningLot, SignatureRecord } from './ports.ts';

package/dist/engine/index.js

@@ -7,3 +7,5 @@
  * Object operations delegate to the existing Obligations implementation.
  */
 export { objectFold } from "./object.js";
+// Optional host operations are explicit and injected; objectFold itself never invokes them.
+export { readContent, retainContent, invokeSigningPort } from "./ports.js";

package/dist/engine/ports.d.ts

@@ -0,0 +1,32 @@
+export interface PortLimits {
+    readonly timeoutMs: number;
+    readonly maxBytes: number;
+}
+export interface SigningLot {
+    readonly bytes: readonly string[];
+    readonly keyId: string;
+    readonly algorithm: string;
+}
+export interface SignatureRecord {
+    readonly keyId: string;
+    readonly signature: string;
+}
+export type SigningPort = (lot: SigningLot, signal: AbortSignal) => Promise<readonly SignatureRecord[]>;
+export type ContentReadPort = (source: string, digest: string, signal: AbortSignal) => Promise<Uint8Array>;
+/** Atomic byte retention supplied by the host. This is neither admission nor a current-answer cache. */
+export type PersistencePort = (digest: string, bytes: Uint8Array, signal: AbortSignal) => Promise<void>;
+export type DigestPort = (bytes: Uint8Array) => string | Promise<string>;
+export declare function readContent(source: string, digest: string, ports: {
+    readonly read: ContentReadPort;
+    readonly digestBytes: DigestPort;
+}, limits: PortLimits, signal?: AbortSignal): Promise<Uint8Array>;
+/** Verify before invoking retention; no operation automatically writes the projected result. */
+export declare function retainContent(digest: string, bytes: Uint8Array, ports: {
+    readonly retain: PersistencePort;
+    readonly digestBytes: DigestPort;
+}, limits: PortLimits, signal?: AbortSignal): Promise<{
+    readonly digest: string;
+    readonly bytes: number;
+}>;
+/** Acquire protocol-shaped signatures only; the existing consent path verifies them and decides authority. */
+export declare function invokeSigningPort(lot: SigningLot, sign: SigningPort, limits: PortLimits, signal?: AbortSignal): Promise<readonly SignatureRecord[]>;

package/dist/engine/ports.js

@@ -0,0 +1,103 @@
+import { signerRequestBytes, signerResponseBytes, signerResponseOf } from '@lapxo/topos/wire';
+import { BoundRefusal } from "../host/refusals.js";
+import { encodeUTF8 as encoded } from "./encoding.js";
+class PortFault extends BoundRefusal {
+}
+const fail = (code) => { throw new PortFault('host-port/' + code, 'REFUSE·host-port/' + code); };
+function limitsOf(limits) { if (!limits || !Number.isSafeInteger(limits.timeoutMs) || limits.timeoutMs < 1 || limits.timeoutMs > 2147483647 || !Number.isSafeInteger(limits.maxBytes) || limits.maxBytes < 1)
+    fail('budget'); }
+/** The callback must cooperate with cancellation; JavaScript callbacks are not a sandbox. */
+async function bounded(limits, signal, run) {
+    limitsOf(limits);
+    if (signal?.aborted)
+        fail('cancelled');
+    return new Promise((resolve, reject) => {
+        const controller = new AbortController();
+        let done = false;
+        const finish = (code, value) => { if (done)
+            return; done = true; clearTimeout(timer); signal?.removeEventListener('abort', abort); if (code) {
+            controller.abort();
+            reject(new BoundRefusal('host-port/' + code, 'REFUSE·host-port/' + code));
+        }
+        else
+            resolve(value); };
+        const abort = () => finish('cancelled'), timer = setTimeout(() => finish('timeout'), limits.timeoutMs);
+        signal?.addEventListener('abort', abort, { once: true });
+        if (signal?.aborted) {
+            abort();
+            return;
+        }
+        Promise.resolve().then(() => { if (done)
+            fail('cancelled'); return run(controller.signal); }).then(value => finish(undefined, value), error => finish(error instanceof PortFault ? error.code.slice('host-port/'.length) : 'failed'));
+    });
+}
+function owned(bytes, maxBytes) { if (!(bytes instanceof Uint8Array))
+    fail('response'); if (bytes.byteLength > maxBytes)
+    fail('budget'); if (typeof SharedArrayBuffer !== 'undefined' && bytes.buffer instanceof SharedArrayBuffer)
+    fail('response'); return new Uint8Array(bytes); }
+const identity = (digest) => { if (!/^sha256:[a-f0-9]{64}$/.test(digest))
+    fail('integrity'); };
+export async function readContent(source, digest, ports, limits, signal) {
+    limitsOf(limits);
+    identity(digest);
+    return bounded(limits, signal, async (s) => { const bytes = owned(await ports.read(source, digest, s), limits.maxBytes); if (s.aborted)
+        fail('cancelled'); if (await ports.digestBytes(new Uint8Array(bytes)) !== digest)
+        fail('integrity'); if (s.aborted)
+        fail('cancelled'); return bytes; });
+}
+/** Verify before invoking retention; no operation automatically writes the projected result. */
+export async function retainContent(digest, bytes, ports, limits, signal) {
+    limitsOf(limits);
+    identity(digest);
+    if (signal?.aborted)
+        fail('cancelled');
+    const copy = owned(bytes, limits.maxBytes);
+    return bounded(limits, signal, async (s) => { if (await ports.digestBytes(new Uint8Array(copy)) !== digest)
+        fail('integrity'); if (s.aborted)
+        fail('cancelled'); const result = await ports.retain(digest, copy, s); if (result !== undefined)
+        fail('response'); return Object.freeze({ digest, bytes: copy.byteLength }); });
+}
+/** Acquire protocol-shaped signatures only; the existing consent path verifies them and decides authority. */
+export async function invokeSigningPort(lot, sign, limits, signal) {
+    limitsOf(limits);
+    if (!lot || !Array.isArray(lot.bytes))
+        fail('budget');
+    let size = 0;
+    for (const bytes of lot.bytes) {
+        if (typeof bytes !== 'string' || bytes.length > limits.maxBytes - size)
+            fail('budget');
+        size += encoded(bytes).length + 1;
+        if (size > limits.maxBytes)
+            fail('budget');
+    }
+    let request;
+    try {
+        request = signerRequestBytes(lot);
+    }
+    catch {
+        return fail('response');
+    }
+    if (encoded(request).length > limits.maxBytes)
+        fail('budget');
+    const input = Object.freeze({ ...lot, bytes: Object.freeze([...lot.bytes]) });
+    return bounded(limits, signal, async (s) => {
+        const records = await sign(input, s);
+        if (!Array.isArray(records) || records.length !== lot.bytes.length || records.some(r => !r || typeof r.signature !== 'string' || r.signature.length > limits.maxBytes))
+            fail('response');
+        let response;
+        try {
+            response = signerResponseBytes(records);
+        }
+        catch {
+            return fail('response');
+        }
+        if (encoded(response).length > limits.maxBytes)
+            fail('budget');
+        try {
+            return Object.freeze(signerResponseOf(response, lot).map(record => Object.freeze({ ...record })));
+        }
+        catch {
+            return fail('response');
+        }
+    });
+}

package/dist/host/admitted-place.js

@@ -55,3 +55,9 @@ export function authenticatedRootStanding(root) {
 }
 /** Legacy Root lines remain unchanged; contextual public output has its own carrier. */
 export const authenticatedStanding = authenticatedRootStanding;
+/** Public current configuration omits withdrawal markers; typed effective history
+ * remains intact for the existing typed-object projection. Internal readers keep
+ * authenticatedStanding, including its historical markers. */
+export function publicStandingLines(root) {
+    return authenticatedRootStanding(root).filter(line => !isConfig(line) || fieldOf(line, 'value') !== 'withdraw');
+}

package/dist/host/contextual-place.js

@@ -5,7 +5,7 @@ import { commitPlaceAct, placeActResult, committedPlaceActResults } from "./port
 import { placesIn } from "../fold/places.js";
 import { appliedHistoryIn } from "../fold/signed.js";
 import { storeOf } from "../land/ledger.js";
-import { authenticatedRootStanding } from "./admitted-place.js";
+import { publicStandingLines } from "./admitted-place.js";
 import { foldClaims, fieldOf } from "../fold/claims.js";
 const fail = (s) => { throw Error('REFUSE·contextual place ' + s); };
 function read(path, limit) {
@@ -73,5 +73,5 @@ export function contextualStanding(root) {
         }
     }
     const legacyPlaces = placesIn(root).map(place => { const history = appliedHistoryIn(root, place), folded = foldClaims(history); return { namespace: 'legacy-global', place: [place, 'TARGET.bound'].join('/'), standing: folded.standing.filter(line => fieldOf(line, 'value') !== 'withdraw'), history }; });
-    return { profile: PLACE_ACT_CONTEXT, root: authenticatedRootStanding(root), legacyPlaces, contexts: acts.map(a => ({ identity: a.identity, context: a.bundle.context, receipts: a.bundle.receipts, authority: selected.authority(a.bundle.context) })), places: [...groups.values()].map(group => { const folded = foldClaims(group.lines); return { namespace: group.namespace, place: group.place, standing: folded.standing.filter(line => fieldOf(line, 'value') !== 'withdraw'), retracted: folded.retracted, superseded: folded.superseded, forks: folded.forks, contexts: group.contexts }; }) };
+    return { profile: PLACE_ACT_CONTEXT, root: publicStandingLines(root), legacyPlaces, contexts: acts.map(a => ({ identity: a.identity, context: a.bundle.context, receipts: a.bundle.receipts, authority: selected.authority(a.bundle.context) })), places: [...groups.values()].map(group => { const folded = foldClaims(group.lines); return { namespace: group.namespace, place: group.place, standing: folded.standing.filter(line => fieldOf(line, 'value') !== 'withdraw'), retracted: folded.retracted, superseded: folded.superseded, forks: folded.forks, contexts: group.contexts }; }) };
 }

package/dist/host/io.js

@@ -7,5 +7,5 @@ export { basename, dirname, join, relative, resolve } from 'node:path';
 export { fileURLToPath } from 'node:url';
 export { parentPort, workerData } from 'node:worker_threads';
 export { gzipSync } from 'node:zlib';
-/** UTF-8 encoding for host byte formats. */
-export const encodeUTF8 = (text) => new TextEncoder().encode(text);
+/** UTF-8 encoding is shared with host-free protocol ports. */
+export { encodeUTF8 } from "../engine/encoding.js";

package/dist/host/reference-authenticated.d.ts

@@ -9,6 +9,10 @@ export interface ReferenceTrust {
     readonly formImplementation: string;
     readonly signers: readonly Signer[];
     readonly algorithms: readonly string[];
+    readonly contracts?: {
+        readonly refusals: string;
+        readonly standing: string;
+    };
     readonly objects: ObjectContext;
     readonly maxBytes: number;
     readonly maxRecords: number;
@@ -18,6 +22,10 @@ export interface ReferenceTrust {
 }
 /** Prospective authenticated-standing@1 host composition; no effects and no authority from transport. */
 export declare function inspectAuthenticatedReference(fragment: string, trust: ReferenceTrust): Promise<{
+    contracts?: {
+        refusals: string;
+        standing: string;
+    } | undefined;
     reference: import("./reference-profile.ts").StandingReference;
     records: readonly import("@lapxo/topos/wire").ObjectRecord[];
     semanticIdentity: string;
@@ -26,3 +34,7 @@ export declare function inspectAuthenticatedReference(fragment: string, trust: R
     originalRecords: readonly string[];
 }>;
 export { encodeReference, decodeReference } from './reference-profile.ts';
+export { BoundRefusal, readRefusalCatalog, describeRefusal } from './refusals.ts';
+export type { RefusalEntry } from './refusals.ts';
+export { readContent, retainContent, invokeSigningPort } from '../engine/ports.ts';
+export type { PortLimits, ContentReadPort, PersistencePort, DigestPort, SigningPort, SigningLot, SignatureRecord } from '../engine/ports.ts';

package/dist/host/reference-authenticated.js

@@ -1,42 +1,61 @@
+import { BoundRefusal } from "./refusals.js";
 import { parse, canonical, authorityOf, authorityAtEpoch, signedBytes, objectHistory, validateObjectContext } from '@lapxo/topos/wire';
-import { cellInputs } from '@lapxo/topos/cell-inputs';
-import { semanticStandingBytes } from '@lapxo/topos/standing';
 import { decodeReference } from "./reference-profile.js";
-function fail(why) { throw Error('REFUSE·authenticated-reference ' + why); }
+import { referenceStanding, referenceContracts, referenceContextBytes } from "./reference-standing.js";
+function fail(code, why) { throw new BoundRefusal('authenticated-reference/' + code, 'REFUSE·authenticated-reference ' + why); }
 const utf8 = (s) => new TextEncoder().encode(s);
 /** Prospective authenticated-standing@1 host composition; no effects and no authority from transport. */
 export async function inspectAuthenticatedReference(fragment, trust) {
     if (new Set(trust.signers.map(s => s.id)).size !== trust.signers.length)
-        fail('duplicate host signer');
+        fail('context', 'duplicate host signer');
     const reference = decodeReference(fragment);
     if (!Number.isSafeInteger(trust.maxBytes) || trust.maxBytes < 1 || !Number.isSafeInteger(trust.maxRecords) || trust.maxRecords < 1)
-        fail('resource budget');
-    const received = await trust.fetchBytes(reference.source, reference.blob);
+        fail('budget', 'resource budget');
+    if (trust.contracts !== undefined) {
+        if (!referenceContracts(trust.contracts))
+            fail('context', 'contract identities');
+        const snapshot = await trust.digestBytes(referenceContextBytes({ ...trust, semanticIdentity: 'sha256:' + reference.digest, contracts: trust.contracts }));
+        if (snapshot !== trust.snapshot)
+            fail('context', 'context snapshot');
+    }
+    let received;
+    try {
+        received = await trust.fetchBytes(reference.source, reference.blob);
+    }
+    catch {
+        return fail('transport', 'content port failed');
+    }
     if (received.byteLength > trust.maxBytes)
-        fail('bytes budget');
+        fail('budget', 'bytes budget');
     if (typeof SharedArrayBuffer !== 'undefined' && received.buffer instanceof SharedArrayBuffer)
-        fail('shared transport bytes');
+        fail('transport', 'shared transport bytes');
     const bytes = new Uint8Array(received);
     if (await trust.digestBytes(bytes) !== reference.blob)
-        fail('blob integrity');
-    const text = new TextDecoder('utf-8', { fatal: true }).decode(bytes);
+        fail('integrity', 'blob integrity');
+    let text;
+    try {
+        text = new TextDecoder('utf-8', { fatal: true }).decode(bytes);
+    }
+    catch {
+        return fail('framing', 'carrier UTF-8');
+    }
     let packet;
     try {
         packet = JSON.parse(text);
     }
     catch {
-        fail('carrier framing');
+        fail('framing', 'carrier framing');
     }
     if (!Array.isArray(packet) || packet.length !== 3 || packet[0] !== 'authenticated-standing@1' || !Array.isArray(packet[1]) || packet[1].length < 1 || packet[1].length > trust.maxRecords || packet[1].some((x) => typeof x !== 'string') || typeof packet[2] !== 'string' || JSON.stringify(packet) + '\n' !== text)
-        fail('carrier framing');
+        fail('framing', 'carrier framing');
     const originals = packet[1], proofLine = packet[2];
     const parsed = [...originals, proofLine].map(line => { const p = parse(line); if (p.kind !== 'fact' || canonical(p.value.fields) !== line)
-        fail('original canonical'); return p.value.fields; });
+        fail('wire', 'original canonical'); return p.value.fields; });
     const proof = parsed[parsed.length - 1];
     if (proof.scope !== trust.proofScope || proof.at !== 'witness:' + trust.snapshot || proof.role !== 'writes' || proof.form !== 'alphabet' || proof.measure !== 'digest' || proof.epoch !== String(trust.epoch))
-        fail('untrusted snapshot binding');
+        fail('context', 'untrusted snapshot binding');
     if (proof.value !== await trust.digestBytes(utf8(JSON.stringify(['authenticated-standing@1', originals]) + '\n')))
-        fail('snapshot commitment');
+        fail('integrity', 'snapshot commitment');
     // Async crypto port is called on exact native signed bytes; authorityOf consumes only those results.
     const verifiedCrypto = new Set();
     const key = (f, pub) => JSON.stringify([signedBytes(f), pub, f.sig, trust.algorithms]);
@@ -47,38 +66,35 @@ export async function inspectAuthenticatedReference(fragment, trust) {
     const verifies = (f, pub) => verifiedCrypto.has(key(f, pub));
     const authentic = authorityOf(proof, trust.signers, verifies);
     if (authentic.kind !== 'admitted')
-        fail('proof ' + authentic.kind + ' ' + authentic.why);
+        fail('authority', 'proof ' + authentic.kind + ' ' + authentic.why);
     const signer = trust.signers.find(s => s.id === proof.by);
     if (!signer)
-        fail('proof signer');
+        fail('authority', 'proof signer');
     const current = authorityAtEpoch(proof, signer, trust.epoch, trust.proofScope, 'authority');
     if (current.kind !== 'admitted')
-        fail('current proof ' + current.kind + ' ' + current.why);
+        fail('authority', 'current proof ' + current.kind + ' ' + current.why);
     const verified = new Set();
     for (let i = 0; i < originals.length; i++) {
         const admitted = authorityOf(parsed[i], trust.signers, verifies);
         if (admitted.kind !== 'admitted')
-            fail('original ' + admitted.kind + ' ' + admitted.why);
+            fail('authority', 'original ' + admitted.kind + ' ' + admitted.why);
         verified.add(originals[i]);
     }
     const history = objectHistory(originals);
     if (history.kind !== 'fact')
-        fail('wire ' + history.why);
+        fail('wire', 'wire ' + history.why);
     if (history.value.configuration.some(f => f.value === 'withdraw'))
-        fail('configuration history requires admitted standing fold');
+        fail('history', 'configuration history requires admitted standing fold');
     const context = { ...trust.objects, admit: (r) => verified.has(canonical(r.fields)) && trust.objects.admit(r) };
     const checked = validateObjectContext(history.value.objects, context);
     if (checked.kind !== 'fact')
-        throw Error('REFUSE·' + checked.why);
-    const membership = new Set([...cellInputs(checked.value, 'semantic-live@2').values()].flat().map(l => semanticStandingBytes([l])));
-    const fields = (line) => { const p = parse(line); if (p.kind !== 'fact')
-        fail('original parse'); return p.value.fields; };
-    const effective = [...originals].sort((a, b) => Number(fields(a).epoch) - Number(fields(b).epoch));
-    const live = effective.filter(line => { const f = fields(line); return f.type === undefined || membership.has(semanticStandingBytes([line])); });
-    const semantic = semanticStandingBytes(live), semanticIdentity = await trust.digestBytes(utf8(semantic));
+        throw new BoundRefusal('authenticated-reference/object-context', 'REFUSE·' + checked.why);
+    const semantic = referenceStanding(originals, checked.value), semanticIdentity = await trust.digestBytes(utf8(semantic));
     if (semanticIdentity !== 'sha256:' + reference.digest)
-        fail('standing identity');
-    const authorityContextIdentity = await trust.digestBytes(utf8(JSON.stringify(['reference-inspection-trust@1', trust.snapshot, trust.epoch, trust.proofScope, trust.policy, trust.formImplementation, trust.signers, trust.algorithms])));
-    return { reference, records: checked.value, semanticIdentity, authorityContextIdentity, semanticStanding: semantic, originalRecords: originals };
+        fail('identity', 'standing identity');
+    const authorityContextIdentity = await trust.digestBytes(utf8(JSON.stringify(trust.contracts ? ['reference-inspection-trust@2', trust.snapshot, trust.epoch, trust.proofScope, trust.policy, trust.formImplementation, trust.signers, trust.algorithms, trust.contracts] : ['reference-inspection-trust@1', trust.snapshot, trust.epoch, trust.proofScope, trust.policy, trust.formImplementation, trust.signers, trust.algorithms])));
+    return { reference, records: checked.value, semanticIdentity, authorityContextIdentity, semanticStanding: semantic, originalRecords: originals, ...(trust.contracts ? { contracts: { ...trust.contracts } } : {}) };
 }
 export { encodeReference, decodeReference } from "./reference-profile.js";
+export { BoundRefusal, readRefusalCatalog, describeRefusal } from "./refusals.js";
+export { readContent, retainContent, invokeSigningPort } from "../engine/ports.js";

package/dist/host/reference-contracts.js

@@ -0,0 +1,6 @@
+import { readFileSync } from 'node:fs';
+import { sha256 } from "./hash.js";
+/** Exact shipped interpretation contracts; this helper grants no authority. */
+export function installedReferenceContracts() {
+    return { refusals: sha256(readFileSync(new URL('../../docs/contracts/refusals.bound', import.meta.url))), standing: sha256(readFileSync(new URL('../../docs/contracts/standing.bound', import.meta.url))) };
+}

package/dist/host/reference-export.d.ts

@@ -0,0 +1,33 @@
+import type { SigningPort } from '../engine/ports.ts';
+export { BoundRefusal as ReferenceExportRefusal } from './refusals.ts';
+/** Signs a public snapshot proof; never lands, refreshes evidence or changes the Root. */
+export declare function exportAuthenticatedReference(root: string, source: string, options?: {
+    readonly key?: string;
+    readonly keyFile?: string;
+    readonly signer?: string;
+    readonly hostSigner?: {
+        readonly name: string;
+        readonly sign: SigningPort;
+    };
+}): Promise<{
+    profile: string;
+    reference: string;
+    carrier: string;
+    context: {
+        snapshot: string;
+        profile: string;
+        semanticIdentity: string;
+        epoch: number;
+        proofScope: string;
+        policy: string;
+        formImplementation: string;
+        signers: readonly import("@lapxo/topos/wire").Signer[];
+        algorithms: readonly string[];
+        contracts: {
+            refusals: string;
+            standing: string;
+        };
+        maxBytes: number;
+        maxRecords: number;
+    };
+}>;

package/dist/host/reference-export.js

@@ -0,0 +1,81 @@
+import { installedReferenceContracts } from "./reference-contracts.js";
+import { BoundRefusal, describeRefusal, readRefusalCatalog } from "./refusals.js";
+import { readFileSync } from 'node:fs';
+import { authorityAtEpoch, canonical, parse } from '@lapxo/topos/wire';
+import { sha256 as hash } from "./hash.js";
+import { signerFor } from "./signing.js";
+import { signConsentLot } from "../land/sign.js";
+import { underRootAuthority } from "../land/act.js";
+import { storeOf } from "../land/ledger.js";
+import { authorityFor, rootSigner } from "../fold/signers.js";
+import { admissionAnchor, admissionHistoryAt } from "../fold/admission-history.js";
+import { authenticatedRootStanding } from "./admitted-place.js";
+import { eraOf } from "../fold/digests.js";
+import { epochOf } from "../cli/owner.js";
+import { fieldOf } from "../fold/claims.js";
+import { prepareNativeReference } from "./reference-native.js";
+import { referenceContextBytes, referenceContracts, referenceStanding } from "./reference-standing.js";
+import { encodeReference } from "./reference-profile.js";
+const catalog = () => readFileSync(new URL('../../docs/contracts/refusals.bound', import.meta.url), 'utf8');
+export { BoundRefusal as ReferenceExportRefusal } from "./refusals.js";
+function fail(code) {
+    const refusal = new BoundRefusal('reference-export/' + code, 'REFUSE·reference-export/' + code);
+    const entry = describeRefusal(refusal, readRefusalCatalog(catalog()));
+    throw new BoundRefusal(entry.code, 'REFUSE·' + entry.code + ' ' + entry.meaning);
+}
+/** Signs a public snapshot proof; never lands, refreshes evidence or changes the Root. */
+export async function exportAuthenticatedReference(root, source, options = {}) {
+    try {
+        encodeReference({ class: 'standing', algorithm: 'sha256', digest: '0'.repeat(64), blob: 'sha256:' + '0'.repeat(64), source });
+    }
+    catch {
+        fail('source');
+    }
+    return underRootAuthority(storeOf(root), 'reference export', async () => {
+        const history = admissionHistoryAt(root, Number.MAX_SAFE_INTEGER), standing = authenticatedRootStanding(root), epoch = epochOf(history), era = eraOf(standing);
+        const authority = authorityFor(history, admissionAnchor(root), era.admitted);
+        const one = (scope, measure = 'id', form = 'alphabet') => { const rows = standing.filter(line => fieldOf(line, 'scope') === scope && fieldOf(line, 'value') !== 'withdraw'); if (rows.length !== 1 || fieldOf(rows[0], 'role') !== 'writes' || fieldOf(rows[0], 'measure') !== measure || fieldOf(rows[0], 'form') !== form || authority.of(rows[0]).kind !== 'admitted')
+            fail('context'); return fieldOf(rows[0], 'value'); };
+        if (one('reference/authentication') !== 'authenticated-standing@1')
+            fail('context');
+        const proofScope = one('reference/proof-scope'), contracts = { refusals: one('reference/contracts/refusals'), standing: one('reference/contracts/standing') };
+        const installed = installedReferenceContracts();
+        if (!referenceContracts(contracts) || contracts.refusals !== installed.refusals || contracts.standing !== installed.standing)
+            fail('context');
+        const count = one('reference/records'), maxRecords = Number(count), range = /^(0|[1-9][0-9]*)\.\.(0|[1-9][0-9]*)$/.exec(one('reference/export-bytes', 'bytes', 'interval'));
+        if (!/^(0|[1-9][0-9]*)$/.test(count) || !Number.isSafeInteger(maxRecords) || maxRecords < 1 || !range || Number(range[1]) > Number(range[2]) || !Number.isSafeInteger(Number(range[2])) || Number(range[2]) < 1)
+            fail('budget');
+        const maxBytes = Number(range[2]);
+        const originals = standing.filter(line => fieldOf(line, 'value') !== 'withdraw' || fieldOf(line, 'type') !== '');
+        if (!originals.length || originals.length > maxRecords || Buffer.byteLength(originals.join('\n')) > maxBytes)
+            fail('budget');
+        if (originals.some(line => authority.of(line).kind !== 'admitted'))
+            fail('history');
+        const key = options.key ?? rootSigner(root).id, signer = authority.admitted.find(s => s.id === key);
+        const stamp = canonical({ scope: proofScope, role: 'writes', form: 'alphabet', measure: 'digest', value: hash(JSON.stringify(['authenticated-standing@1', originals]) + '\n'), by: 'target', at: 'witness:' + 'sha256:' + '0'.repeat(64) });
+        const probe = parse(stamp);
+        if (!signer || probe.kind !== 'fact' || authorityAtEpoch({ ...probe.value.fields, by: key, epoch: String(epoch) }, signer, epoch, proofScope, 'authority').kind !== 'admitted')
+            fail('authority');
+        const held = await prepareNativeReference(root), semantic = referenceStanding(originals, held.records), semanticIdentity = hash(semantic);
+        const context = { profile: 'reference-export-context@1', semanticIdentity, epoch, proofScope, policy: held.policy, formImplementation: held.formImplementation, signers: authority.admitted, algorithms: era.admitted, contracts, maxBytes, maxRecords };
+        const snapshot = hash(referenceContextBytes(context));
+        if (Buffer.byteLength(JSON.stringify({ originals, context, snapshot }) + '\n') > maxBytes)
+            fail('budget');
+        const drafted = canonical({ ...probe.value.fields, at: 'witness:' + snapshot });
+        let signed;
+        try {
+            signed = await signConsentLot([drafted], { epoch, by: key, algorithm: era.era }, signer.publicKey, era.admitted, signerFor(standing, key, options.signer, options.keyFile, options.hostSigner));
+        }
+        catch {
+            fail('signer');
+        }
+        if (signed.kind !== 'fact')
+            fail('signer');
+        const carrier = JSON.stringify(['authenticated-standing@1', originals, signed.lines[0]]) + '\n';
+        const reference = encodeReference({ class: 'standing', algorithm: 'sha256', digest: semanticIdentity.slice(7), blob: hash(carrier), source });
+        const result = { profile: 'reference-export@1', reference, carrier, context: { ...context, snapshot } };
+        if (Buffer.byteLength(JSON.stringify(result) + '\n') > maxBytes)
+            fail('budget');
+        return result;
+    });
+}

package/dist/host/reference-native-api.d.ts

@@ -0,0 +1,3 @@
+/** Native host boundary. The platform-free reference inspector remains /reference. */
+export { openAuthenticatedReference } from './reference-native.ts';
+export { exportAuthenticatedReference } from './reference-export.ts';

package/dist/host/reference-native-api.js

@@ -0,0 +1,3 @@
+/** Native host boundary. The platform-free reference inspector remains /reference. */
+export { openAuthenticatedReference } from "./reference-native.js";
+export { exportAuthenticatedReference } from "./reference-export.js";

package/dist/host/reference-native.d.ts

@@ -1,6 +1,26 @@
+import { type ContentReadPort } from '../engine/ports.ts';
 export declare function authenticatedReferenceSelected(standing: readonly string[]): boolean;
-export declare function openAuthenticatedReference(root: string, fragment: string): Promise<{
+/** One context preparation shared by native export and native inspection. */
+export declare function prepareNativeReference(root: string): Promise<{
+    policy: string;
+    formImplementation: string;
+    records: readonly import("@lapxo/topos/wire").ObjectRecord[];
+    context: import("@lapxo/topos/wire").ObjectContext;
+    configuration: Readonly<Record<string, string>>[];
+}>;
+export declare function openAuthenticatedReference(root: string, fragment: string, options?: {
+    readonly signal?: AbortSignal;
+    readonly content?: {
+        readonly name: string;
+        readonly read: ContentReadPort;
+    };
+}): Promise<{
+    backend: string;
     readings: readonly import("../engine/object.ts").ObjectReading[];
+    contracts?: {
+        refusals: string;
+        standing: string;
+    } | undefined;
     reference: import("./reference-profile.ts").StandingReference;
     records: readonly import("@lapxo/topos/wire").ObjectRecord[];
     semanticIdentity: string;

package/dist/host/reference-native.js

@@ -1,3 +1,7 @@
+import { readContent } from "../engine/ports.js";
+import { installedReferenceContracts } from "./reference-contracts.js";
+import { BoundRefusal } from "./refusals.js";
+import { foldObjectsWithWasm } from "../wasm/object.js";
 /** Native ports for authenticated #bound opening; trusted policy belongs to the selected local place. */
 import { sha256 as hash, isSha256 } from "./hash.js";
 import { canonical, parse, transportSelection } from '@lapxo/topos/wire';
@@ -22,29 +26,49 @@ export function authenticatedReferenceSelected(standing) {
         throw Error('REFUSE·reference conflicting or unknown authentication profile');
     return true;
 }
-export async function openAuthenticatedReference(root, fragment) {
+/** One context preparation shared by native export and native inspection. */
+export async function prepareNativeReference(root) {
+    const store = storeOf(root), held = await admittedObjects(root, signedOwnerLines(store), () => { }, true);
+    const policy = held.configuration.map(fields => canonical(fields));
+    const implementations = [...new Set(held.records.filter(r => r.record === 'cell').map(r => r.fields.topos))].sort().map(pin => { const selected = toposAt(pin, store), selectors = selected.parts.filter(f => f.scope === 'wire/topos/context-view'); if (selectors.length !== 1)
+        throw Error('REFUSE·reference host context selector'); const offers = selected.parts.filter(f => f.kind === 'check' && f.view === selectors[0].value); if (offers.length !== 1)
+        throw Error('REFUSE·reference host context offer'); const offer = offers[0], closure = [...new Set((offer.restsOn ?? '').split('|').filter(Boolean))].sort(); for (const digest of closure)
+        contentAt(digest, store); return [pin, offer.value, closure]; });
+    return { ...held, policy: hash(semanticStandingBytes(policy)), formImplementation: hash(JSON.stringify(implementations)) };
+}
+export async function openAuthenticatedReference(root, fragment, options = {}) {
     const store = storeOf(root), standing = lockStanding(store), era = eraOf(standing), authority = authorityFor(lockLines(store), rootSigner(root), era.admitted);
     if (!authenticatedReferenceSelected(standing))
         throw Error('REFUSE·reference no admitted authenticated-standing@1 profile');
-    const one = (scope) => { const found = standing.flatMap(line => { const p = parse(line); return p.kind === 'fact' && p.value.fields.scope === scope ? [{ line, fields: p.value.fields }] : []; }); if (found.length !== 1 || found[0].fields.role !== 'writes' || found[0].fields.measure !== 'id' || authority.of(found[0].line).kind !== 'admitted')
-        throw Error('REFUSE·reference missing, conflicting or unauthenticated ' + scope); return found[0].fields.value; };
+    const one = (scope) => { const found = standing.flatMap(line => { const p = parse(line); return p.kind === 'fact' && p.value.fields.scope === scope ? [{ line, fields: p.value.fields }] : []; }); if (found.length !== 1 || found[0].fields.role !== 'writes' || found[0].fields.measure !== 'id' || found[0].fields.form !== 'alphabet' || authority.of(found[0].line).kind !== 'admitted')
+        throw new BoundRefusal(scope === 'engine/object' ? 'reference/backend' : 'authenticated-reference/context', 'REFUSE·reference missing, conflicting or unauthenticated ' + scope); return found[0].fields.value; };
     if (one('reference/authentication') !== 'authenticated-standing@1')
         throw Error('REFUSE·reference authentication profile');
     const snapshot = one('reference/snapshot'), epochText = one('reference/epoch'), proofScope = one('reference/proof-scope'), recordsText = one('reference/records');
     if (!isSha256(snapshot) || !/^\d+$/.test(epochText) || !Number.isSafeInteger(Number(epochText)) || !/^\d+$/.test(recordsText) || !Number.isSafeInteger(Number(recordsText)) || Number(recordsText) < 1 || !proofScope)
         throw Error('REFUSE·reference authority snapshot or resource contract');
+    const backend = one('engine/object');
+    if (!['esm@1', 'wasm@1'].includes(backend))
+        throw new BoundRefusal('reference/backend', 'REFUSE·reference unsupported declared backend');
+    if (options.signal?.aborted)
+        throw new BoundRefusal('reference/cancelled', 'REFUSE·reference cancelled');
     const reference = decodeReference(fragment);
     // Provider selection is made from HOST-declared cells/configuration, never carrier-picked code.
-    const held = await admittedObjects(root, signedOwnerLines(store), () => { }, true);
+    const held = await prepareNativeReference(root);
     if (!held.records.some(r => r.record === 'cell'))
         throw Error('REFUSE·reference host has no declared object interpretation');
     const context = held.context, policy = held.configuration.map(fields => canonical(fields)), selection = transportSelection(held.configuration, new URL(reference.source).protocol.slice(0, -1));
     if (!selection)
         throw Error('REFUSE·reference no admitted transport policy');
-    const implementations = [...new Set(held.records.filter(r => r.record === 'cell').map(r => r.fields.topos))].sort().map(pin => { const selected = toposAt(pin, store), selectors = selected.parts.filter(f => f.scope === 'wire/topos/context-view'); if (selectors.length !== 1)
-        throw Error('REFUSE·reference host context selector'); const offers = selected.parts.filter(f => f.kind === 'check' && f.view === selectors[0].value); if (offers.length !== 1)
-        throw Error('REFUSE·reference host context offer'); const offer = offers[0], closure = [...new Set((offer.restsOn ?? '').split('|').filter(Boolean))].sort(); for (const digest of closure)
-        contentAt(digest, store); return [pin, offer.value, closure]; });
-    const result = await inspectAuthenticatedReference(fragment, { snapshot, epoch: Number(epochText), proofScope, policy: hash(semanticStandingBytes(policy)), formImplementation: hash(JSON.stringify(implementations)), signers: authority.admitted, algorithms: era.admitted, objects: context, maxBytes: selection.responseBytes, maxRecords: Number(recordsText), digestBytes: hash, verifyBytes, fetchBytes: (source, blob) => transportBytes(source, blob, policy) });
-    return { ...result, readings: objectFold(result.records, context) };
+    if (options.content && options.content.name !== selection.name)
+        throw new BoundRefusal('authenticated-reference/transport', 'REFUSE·reference injected content binding conflicts with declaration');
+    const contracts = { refusals: one('reference/contracts/refusals'), standing: one('reference/contracts/standing') }, expectedPolicy = one('reference/policy'), expectedImplementation = one('reference/form-implementation');
+    const installed = installedReferenceContracts();
+    if (contracts.refusals !== installed.refusals || contracts.standing !== installed.standing || !isSha256(expectedPolicy) || expectedImplementation !== held.formImplementation)
+        throw new BoundRefusal('authenticated-reference/context', 'REFUSE·reference expected interpretation differs');
+    const result = await inspectAuthenticatedReference(fragment, { snapshot, epoch: Number(epochText), proofScope, contracts, policy: expectedPolicy, formImplementation: expectedImplementation, signers: authority.admitted, algorithms: era.admitted, objects: context, maxBytes: selection.responseBytes, maxRecords: Number(recordsText), digestBytes: hash, verifyBytes, fetchBytes: (source, blob) => options.content ? readContent(source, blob, { read: options.content.read, digestBytes: hash }, { timeoutMs: selection.timeoutMs, maxBytes: selection.responseBytes }, options.signal) : transportBytes(source, blob, policy) });
+    if (options.signal?.aborted)
+        throw new BoundRefusal('reference/cancelled', 'REFUSE·reference cancelled');
+    const readings = backend === 'wasm@1' ? await foldObjectsWithWasm(root, result.records, context, held.configuration, options.signal) : objectFold(result.records, context);
+    return { ...result, backend, readings };
 }

package/dist/host/reference-profile.js

@@ -1,5 +1,6 @@
+import { BoundRefusal } from "./refusals.js";
 const hex = /^[0-9a-f]{64}$/;
-const refuse = (cause) => { throw Error(`REFUSE·reference ${cause}`); };
+const refuse = (cause) => { throw new BoundRefusal('reference/format', `REFUSE·reference ${cause}`); };
 const keys = ['class', 'algorithm', 'digest', 'blob', 'source'];
 function check(reference) {
     if (Object.keys(reference).length !== keys.length || keys.some(key => !Object.prototype.hasOwnProperty.call(reference, key)))

package/dist/host/reference-standing.js

@@ -0,0 +1,18 @@
+import { parse } from '@lapxo/topos/wire';
+import { cellInputs } from '@lapxo/topos/cell-inputs';
+import { semanticStandingBytes } from '@lapxo/topos/standing';
+/** Shared projection after admission; transport order never replaces effective order. */
+export function referenceStanding(originals, records) {
+    const membership = new Set([...cellInputs(records, 'semantic-live@2').values()].flat().map(line => semanticStandingBytes([line])));
+    const fields = (line) => { const p = parse(line); if (p.kind !== 'fact')
+        throw Error('REFUSE·authenticated-reference original parse'); return p.value.fields; };
+    const effective = [...originals].sort((a, b) => Number(fields(a).epoch) - Number(fields(b).epoch));
+    return semanticStandingBytes(effective.filter(line => fields(line).type === undefined || membership.has(semanticStandingBytes([line]))));
+}
+export function referenceContracts(value) {
+    return value !== null && typeof value === 'object' && !Array.isArray(value) && Object.keys(value).length === 2 && /^sha256:[a-f0-9]{64}$/.test(value.refusals) && /^sha256:[a-f0-9]{64}$/.test(value.standing);
+}
+/** This versioned context frame binds interpretation contracts without changing wire fields. */
+export function referenceContextBytes(context) {
+    return new TextEncoder().encode(JSON.stringify(['reference-export-context@1', context.semanticIdentity, context.epoch, context.proofScope, context.policy, context.formImplementation, context.signers, context.algorithms, context.contracts.refusals, context.contracts.standing, context.maxBytes, context.maxRecords]) + '\n');
+}