@lapxo/bound 0.2.0 → 0.2.2

package/dist/cli/place.js

@@ -1,3 +1,4 @@
+import { refreshRetainedJudgment } from "./retained-judgment.js";
 import { timing } from "../host/timing.js";
 import { attestationObservations } from "../fold/evidence.js";
 import { parse as parseEvidenceFields } from '@lapxo/topos/wire';
@@ -11,7 +12,7 @@ import { meets, instrumentKept } from "../fold/closed.js";
 import { foldPoints, keepFold, keptPlace } from "../fold/kept.js";
 import { openCells } from "../render/open.js";
 import { boundOf, packRegions, regionsNamed, regionsOf, unlikeReplay } from "../fold/region.js";
-import { answersElsewhere, foldCeilings } from "../fold/ceilings.js";
+import { answersElsewhere, foldCeilings, ceilingSummary } from "../fold/ceilings.js";
 import { keyOf, keyFor, lockLines, lockStanding } from "../fold/keys.js";
 import { wordFrom, wordOf, wordOn } from "../fold/wire.js";
 import { bytesDigest, instrumentOf, signaturesOf } from "../fold/digests.js";
@@ -21,7 +22,7 @@ import { classDefaults, kindsOf, placesIn, spoken } from "../fold/places.js";
 import { isCeiling } from "../fold/configures.js";
 import { observedClaims, placedReadings } from "../fold/observed.js";
 import { capsuleReadingsOver, currentReceiptObservations, retiredReceiptHistory } from "../observe/regions.js";
-import { costReadings, ownReadings } from "../fold/own.js";
+import { costReadings, ownReadings, currentActReadings } from "../fold/own.js";
 import { paidOf } from "../fold/paid.js";
 import { rolesOf } from "../fold/roles.js";
 import { secondHead } from "../fold/second.js";
@@ -45,12 +46,6 @@ const costsOf = (store) => ledgerLines(store, 'take').filter((line) => fieldOf(l
 function effectStates(_store) {
     return 'none';
 }
-function listed(misses) {
-    const by = new Map();
-    for (const o of misses)
-        by.set(o.ceiling, [...(by.get(o.ceiling) ?? []), o.question === o.ceiling ? o.got : `${o.question}=${o.got}`]);
-    return [...by].map(([scope, got]) => `${scope} · ${got.length > 4 ? `${got.slice(0, 4).join(' ')} +${got.length - 4}` : got.join(' ')}`);
-}
 /**
  * The fold of a place: the standing lock and what readers saw, narrowed to the place when one is named. A demand is the
  * place's when every place it asks about lies there; a SHORT on a question also read outside it is not the place's to
@@ -170,7 +165,7 @@ export function coneOf(root, entry, ceilings, descent) {
     if (meets(root, store, '') && instrumentKept(store) === instrumentOf(store, entry, standing, root, ownLock())) {
         const held = keptPlace(store);
         if (held !== undefined)
-            return { standing, observed: held.observed, own: held.own, kept: true };
+            return { standing, observed: held.observed, own: { ...held.own, ...currentActReadings() }, kept: true };
     }
     const named = regionsNamed(standing);
     const reach = descent !== undefined && descent.length ? [...descent] : [...new Set(ceilings.map((line) => boundOf(named, line).region))];
@@ -199,7 +194,7 @@ export function foldPlace(root, entry, under, look = true, given) {
         const prior = keptPlace(store, under, instrumentOf(store, entry, standingOf(root).standing, root, ownLock()));
         if (prior !== undefined) {
             process.stderr.write(`CLOSED   ${under || '.'} · digest ${digestMs} ms\n`);
-            return { ...prior, kept: true };
+            return refreshRetainedJudgment(prior, [...prior.standing.filter((line) => isCeiling(line) && !(under && fieldOf(line, 'measure') === 'unread')), ...ownCeilings(under)]);
         }
     }
     const { standing, lock: attested, rendered, owned } = given?.standing ?? standingOf(root, under);
@@ -244,14 +239,7 @@ export function foldPlace(root, entry, under, look = true, given) {
         history: live.history.filter((line) => fieldOf(line, 'needs').split('|').filter(Boolean).some(inside)),
         observed,
         receiptHistory: retiredReceiptHistory({ root, store, ...(under ? { under } : {}), standing, observed: read }),
-        ceilings: {
-            read: folded.read.length,
-            total: ceilings.length,
-            unread: folded.unread.map((line) => fieldOf(line, 'scope')),
-            vacuous: folded.vacuous.map((line) => fieldOf(line, 'scope')),
-            short: listed(folded.over.filter((o) => o.side === 'short' && !shared.has(o.question))),
-            over: listed(folded.over.filter((o) => o.side === 'over')),
-        },
+        ceilings: ceilingSummary(folded, ceilings.length, shared),
         orphans,
         lock,
         signed: signedByKey(store, standing, everywhere),
@@ -284,14 +272,7 @@ export function foldPlace(root, entry, under, look = true, given) {
         release: releasePolicy({ standing: policyStanding, demands, paid: finalPaid, ceilings, readings: again, faults, verdicts: attestationObservations(policyStanding.map(line => { const r = parseEvidenceFields(line); return r.kind === 'fact' ? r.value.fields : {}; }), second), snapshot: { fold: taken, instrument: self } }),
         missing: owed,
         own: { ...place.own, ...docs },
-        ceilings: {
-            ...place.ceilings,
-            read: again.read.length,
-            unread: again.unread.map((line) => fieldOf(line, 'scope')),
-            vacuous: again.vacuous.map((line) => fieldOf(line, 'scope')),
-            short: listed(again.over.filter((o) => o.side === 'short' && !shared.has(o.question))),
-            over: listed(again.over.filter((o) => o.side === 'over')),
-        },
+        ceilings: ceilingSummary(again, ceilings.length, shared),
     };
     if (folder !== undefined && meets(root, store, under ?? '', true, whole.observed))
         took('keep', () => keepFold(store, taken, whole, points, self));

package/dist/cli/retained-judgment.js

@@ -0,0 +1,25 @@
+import { foldCeilings, ceilingSummary } from "../fold/ceilings.js";
+import { currentActReadings } from "../fold/own.js";
+import { placedReadings } from "../fold/observed.js";
+import { placesIn } from "../fold/places.js";
+import { releasePolicy, releaseFaults } from "../fold/release-policy.js";
+import { attestationObservations } from "../fold/evidence.js";
+import { parse } from '@lapxo/topos/wire';
+import { point, region, within } from '@lapxo/obligations/field';
+/** A verified semantic fold can be reused. Its previous act's measurements cannot.
+ * Keep history intact and judge current measurements with the ordinary interpreters.
+ */
+export function refreshRetainedJudgment(prior, ceilings, current = currentActReadings(prior.under)) {
+    const own = { ...prior.own, ...current };
+    const readings = foldCeilings({ standing: prior.standing, ceilings, observed: prior.observed,
+        own, epoch: prior.epoch, ...(prior.under ? { under: prior.under, places: new Set(placesIn(prior.root)) } : {}) });
+    const standing = prior.standing.filter(line => !prior.grey.includes(line) && !prior.refused.includes(line));
+    const shared = new Set(prior.under ? placedReadings(prior.observed)
+        .filter(reading => !within(point(reading.place.replace(/\/\*$/, '')), region(prior.under)))
+        .map(reading => reading.question) : []);
+    return { ...prior, kept: true, own, ceilings: ceilingSummary(readings, ceilings.length, shared),
+        release: releasePolicy({ standing, demands: prior.demands, paid: prior.paid, ceilings, readings,
+            faults: releaseFaults(prior),
+            verdicts: attestationObservations(standing.map(line => { const got = parse(line); return got.kind === 'fact' ? got.value.fields : {}; }), prior.second),
+            snapshot: { fold: prior.key, instrument: prior.instrument } }) };
+}

package/dist/cli/standing-result.js

@@ -1,5 +1,6 @@
+import { BoundRefusal } from "../host/refusals.js";
 import { hasContextualPlace, contextualStanding } from "../host/contextual-place.js";
-import { authenticatedStanding } from "../host/admitted-place.js";
+import { publicStandingLines } from "../host/admitted-place.js";
 import { viewsOf } from "../fold/views.js";
 import { lockStanding } from "../fold/keys.js";
 import { storeOf } from "../land/ledger.js";
@@ -10,11 +11,11 @@ import { storeOf } from "../land/ledger.js";
 export function printStandingResult(root) {
     const store = storeOf(root), view = viewsOf(lockStanding(store)).get('standing');
     if (!view || view.shape || !view.regions.some(region => region.name === 'standing'))
-        throw Error('REFUSE·view standing requires a declared standing view');
+        throw new BoundRefusal('standing/view', 'REFUSE·view standing requires a declared standing view');
     if (hasContextualPlace(root)) {
         process.stdout.write(JSON.stringify(contextualStanding(root)) + '\n');
         return;
     }
-    const standing = authenticatedStanding(root);
+    const standing = publicStandingLines(root);
     process.stdout.write(standing.length ? standing.join('\n') + '\n' : '');
 }

package/dist/cli/verb.js

@@ -1,6 +1,10 @@
 #!/usr/bin/env node
+import { BoundRefusal, describeRefusal, readRefusalCatalog } from "../host/refusals.js";
+import { readFileSync as readCatalogFile } from 'node:fs';
+import { sha256 as catalogDigest } from "../host/hash.js";
 import { printReleaseApproval } from "./release-result.js";
 import { inspectReference } from "../host/reference.js";
+import { exportAuthenticatedReference } from "../host/reference-export.js";
 import { authenticatedReferenceSelected, openAuthenticatedReference } from "../host/reference-native.js";
 import { printActResult } from "./act-result.js";
 import { printStandingResult } from "./standing-result.js";
@@ -209,7 +213,7 @@ async function view(root, under, asked, told = [], coord, key, includePolicy = t
     }
     if (name === 'standing') {
         if (under || told.length || coord || depth !== undefined)
-            throw Error('REFUSE·standing local committed projection only');
+            throw new BoundRefusal('standing/query', 'REFUSE·standing local committed projection only');
         printStandingResult(root);
         return EXIT.closed;
     }
@@ -374,6 +378,15 @@ async function view(root, under, asked, told = [], coord, key, includePolicy = t
     return shown(fold);
 }
 async function signVerb(root, rest) {
+    const as = valueOf(rest, FLAGS.as);
+    if (as !== undefined) {
+        const sources = positionalsOf(rest);
+        if (as !== 'reference' || sources.length !== 1 || rest.includes(FLAGS.check))
+            throw new BoundRefusal('reference-export/usage', 'REFUSE·reference-export usage: sign --as reference <source-url>');
+        const result = await exportAuthenticatedReference(root, sources[0], { key: valueOf(rest, FLAGS.key), keyFile: valueOf(rest, FLAGS.keyFile), signer: valueOf(rest, FLAGS.signer) });
+        process.stdout.write(JSON.stringify(result) + '\n');
+        return EXIT.closed;
+    }
     const batch = await signedBatch(root, rest, positionalsOf(rest));
     if (batch.kind === 'exit')
         return batch.code;
@@ -633,18 +646,38 @@ function main(argv) {
     process.stderr.write(`${selfName()}: ${helpLines().join(' · ')}\n`);
     return EXIT.usage;
 }
+function printRefusal(error) {
+    try {
+        const text = readCatalogFile(new URL('../../docs/contracts/refusals.bound', import.meta.url), 'utf8');
+        const entry = describeRefusal(error, readRefusalCatalog(text));
+        process.stderr.write(JSON.stringify({ profile: 'bound-refusal@1', ...entry, catalog: catalogDigest(text) }) + '\n');
+    }
+    catch {
+        // A missing/invalid catalog cannot supply trustworthy metadata. Keep the
+        // failure named instead of recursively failing while formatting a refusal.
+        process.stderr.write(JSON.stringify({ profile: 'bound-refusal@1', code: 'catalog/invalid', unmeasured: ['category', 'meaning', 'next', 'catalog'] }) + '\n');
+    }
+}
+// Legacy numeric refusals receive a generic code by exit result, never by parsing
+// a diagnostic. Specific causes retain their own typed code in the error path.
+function finished(code) {
+    if (code === EXIT.refuse || code === EXIT.usage)
+        printRefusal(new BoundRefusal(code === EXIT.usage ? 'operation/usage' : 'operation/failed', ''));
+    process.exitCode = code;
+}
 // The same refusal boundary covers synchronous operations and asynchronous processes.
 const refused = (error) => {
     const message = error instanceof Error ? error.message : String(error);
     process.stderr.write(`${selfName()}: ${message.startsWith('REFUSE·') ? message : `REFUSE·crash ${message}`}\n`);
+    printRefusal(error instanceof BoundRefusal ? error : new BoundRefusal('operation/failed', message));
     process.exitCode = EXIT.refuse;
 };
 try {
     const ran = main(process.argv.slice(2));
     if (ran instanceof Promise)
-        ran.then((code) => { process.exitCode = code; }).catch(refused);
+        ran.then(finished).catch(refused);
     else
-        process.exitCode = ran;
+        finished(ran);
 }
 catch (error) {
     refused(error);

package/dist/engine/encoding.js

@@ -0,0 +1,2 @@
+/** Shared, host-free UTF-8 encoding for protocol byte budgets. */
+export const encodeUTF8 = (text) => new TextEncoder().encode(text);

package/dist/engine/index.d.ts

@@ -9,3 +9,5 @@
 export { objectFold } from './object.ts';
 export type { ObjectReading } from './object.ts';
 export type { ObjectRecord, ObjectContext } from '@lapxo/topos/wire';
+export { readContent, retainContent, invokeSigningPort } from './ports.ts';
+export type { PortLimits, ContentReadPort, PersistencePort, DigestPort, SigningPort, SigningLot, SignatureRecord } from './ports.ts';

package/dist/engine/index.js

@@ -7,3 +7,5 @@
  * Object operations delegate to the existing Obligations implementation.
  */
 export { objectFold } from "./object.js";
+// Optional host operations are explicit and injected; objectFold itself never invokes them.
+export { readContent, retainContent, invokeSigningPort } from "./ports.js";

package/dist/engine/ports.d.ts

@@ -0,0 +1,32 @@
+export interface PortLimits {
+    readonly timeoutMs: number;
+    readonly maxBytes: number;
+}
+export interface SigningLot {
+    readonly bytes: readonly string[];
+    readonly keyId: string;
+    readonly algorithm: string;
+}
+export interface SignatureRecord {
+    readonly keyId: string;
+    readonly signature: string;
+}
+export type SigningPort = (lot: SigningLot, signal: AbortSignal) => Promise<readonly SignatureRecord[]>;
+export type ContentReadPort = (source: string, digest: string, signal: AbortSignal) => Promise<Uint8Array>;
+/** Atomic byte retention supplied by the host. This is neither admission nor a current-answer cache. */
+export type PersistencePort = (digest: string, bytes: Uint8Array, signal: AbortSignal) => Promise<void>;
+export type DigestPort = (bytes: Uint8Array) => string | Promise<string>;
+export declare function readContent(source: string, digest: string, ports: {
+    readonly read: ContentReadPort;
+    readonly digestBytes: DigestPort;
+}, limits: PortLimits, signal?: AbortSignal): Promise<Uint8Array>;
+/** Verify before invoking retention; no operation automatically writes the projected result. */
+export declare function retainContent(digest: string, bytes: Uint8Array, ports: {
+    readonly retain: PersistencePort;
+    readonly digestBytes: DigestPort;
+}, limits: PortLimits, signal?: AbortSignal): Promise<{
+    readonly digest: string;
+    readonly bytes: number;
+}>;
+/** Acquire protocol-shaped signatures only; the existing consent path verifies them and decides authority. */
+export declare function invokeSigningPort(lot: SigningLot, sign: SigningPort, limits: PortLimits, signal?: AbortSignal): Promise<readonly SignatureRecord[]>;

package/dist/engine/ports.js

@@ -0,0 +1,103 @@
+import { signerRequestBytes, signerResponseBytes, signerResponseOf } from '@lapxo/topos/wire';
+import { BoundRefusal } from "../host/refusals.js";
+import { encodeUTF8 as encoded } from "./encoding.js";
+class PortFault extends BoundRefusal {
+}
+const fail = (code) => { throw new PortFault('host-port/' + code, 'REFUSE·host-port/' + code); };
+function limitsOf(limits) { if (!limits || !Number.isSafeInteger(limits.timeoutMs) || limits.timeoutMs < 1 || limits.timeoutMs > 2147483647 || !Number.isSafeInteger(limits.maxBytes) || limits.maxBytes < 1)
+    fail('budget'); }
+/** The callback must cooperate with cancellation; JavaScript callbacks are not a sandbox. */
+async function bounded(limits, signal, run) {
+    limitsOf(limits);
+    if (signal?.aborted)
+        fail('cancelled');
+    return new Promise((resolve, reject) => {
+        const controller = new AbortController();
+        let done = false;
+        const finish = (code, value) => { if (done)
+            return; done = true; clearTimeout(timer); signal?.removeEventListener('abort', abort); if (code) {
+            controller.abort();
+            reject(new BoundRefusal('host-port/' + code, 'REFUSE·host-port/' + code));
+        }
+        else
+            resolve(value); };
+        const abort = () => finish('cancelled'), timer = setTimeout(() => finish('timeout'), limits.timeoutMs);
+        signal?.addEventListener('abort', abort, { once: true });
+        if (signal?.aborted) {
+            abort();
+            return;
+        }
+        Promise.resolve().then(() => { if (done)
+            fail('cancelled'); return run(controller.signal); }).then(value => finish(undefined, value), error => finish(error instanceof PortFault ? error.code.slice('host-port/'.length) : 'failed'));
+    });
+}
+function owned(bytes, maxBytes) { if (!(bytes instanceof Uint8Array))
+    fail('response'); if (bytes.byteLength > maxBytes)
+    fail('budget'); if (typeof SharedArrayBuffer !== 'undefined' && bytes.buffer instanceof SharedArrayBuffer)
+    fail('response'); return new Uint8Array(bytes); }
+const identity = (digest) => { if (!/^sha256:[a-f0-9]{64}$/.test(digest))
+    fail('integrity'); };
+export async function readContent(source, digest, ports, limits, signal) {
+    limitsOf(limits);
+    identity(digest);
+    return bounded(limits, signal, async (s) => { const bytes = owned(await ports.read(source, digest, s), limits.maxBytes); if (s.aborted)
+        fail('cancelled'); if (await ports.digestBytes(new Uint8Array(bytes)) !== digest)
+        fail('integrity'); if (s.aborted)
+        fail('cancelled'); return bytes; });
+}
+/** Verify before invoking retention; no operation automatically writes the projected result. */
+export async function retainContent(digest, bytes, ports, limits, signal) {
+    limitsOf(limits);
+    identity(digest);
+    if (signal?.aborted)
+        fail('cancelled');
+    const copy = owned(bytes, limits.maxBytes);
+    return bounded(limits, signal, async (s) => { if (await ports.digestBytes(new Uint8Array(copy)) !== digest)
+        fail('integrity'); if (s.aborted)
+        fail('cancelled'); const result = await ports.retain(digest, copy, s); if (result !== undefined)
+        fail('response'); return Object.freeze({ digest, bytes: copy.byteLength }); });
+}
+/** Acquire protocol-shaped signatures only; the existing consent path verifies them and decides authority. */
+export async function invokeSigningPort(lot, sign, limits, signal) {
+    limitsOf(limits);
+    if (!lot || !Array.isArray(lot.bytes))
+        fail('budget');
+    let size = 0;
+    for (const bytes of lot.bytes) {
+        if (typeof bytes !== 'string' || bytes.length > limits.maxBytes - size)
+            fail('budget');
+        size += encoded(bytes).length + 1;
+        if (size > limits.maxBytes)
+            fail('budget');
+    }
+    let request;
+    try {
+        request = signerRequestBytes(lot);
+    }
+    catch {
+        return fail('response');
+    }
+    if (encoded(request).length > limits.maxBytes)
+        fail('budget');
+    const input = Object.freeze({ ...lot, bytes: Object.freeze([...lot.bytes]) });
+    return bounded(limits, signal, async (s) => {
+        const records = await sign(input, s);
+        if (!Array.isArray(records) || records.length !== lot.bytes.length || records.some(r => !r || typeof r.signature !== 'string' || r.signature.length > limits.maxBytes))
+            fail('response');
+        let response;
+        try {
+            response = signerResponseBytes(records);
+        }
+        catch {
+            return fail('response');
+        }
+        if (encoded(response).length > limits.maxBytes)
+            fail('budget');
+        try {
+            return Object.freeze(signerResponseOf(response, lot).map(record => Object.freeze({ ...record })));
+        }
+        catch {
+            return fail('response');
+        }
+    });
+}

package/dist/fold/admission-history.js

@@ -1,7 +1,6 @@
-import { join } from 'node:path';
-import { readFileSync } from 'node:fs';
+import { bootstrapAnchor } from "./bootstrap-anchor.js";
 import { rootLedgerLines, storeOf } from "../land/ledger.js";
-import { fieldOf, isConfig, selfName } from "./claims.js";
+import { fieldOf, isConfig } from "./claims.js";
 /** Local admission history only. Foreign ingress is evidence, never coverage.
  * The clock cutoff is meaningful for configuration; object clocks stay intact. */
 export function admissionHistoryAt(root, epoch) {
@@ -9,14 +8,10 @@ export function admissionHistoryAt(root, epoch) {
     return [...new Set(rootLedgerLines(store))]
         .filter(line => fieldOf(line, 'sig') !== '' && (!isConfig(line) || Number(fieldOf(line, 'epoch')) <= epoch));
 }
-/** The existing bootstrap's public root of trust, not today's key selection. */
+/** The original local bootstrap, never today's key selection. */
 export function admissionAnchor(root) {
-    const at = join(storeOf(root), `${selfName()}.keys`);
-    const keys = JSON.parse(readFileSync(at, 'utf8'));
-    const anchors = Object.values(keys);
-    if (anchors.length !== 1 || !anchors[0]?.publicKey || !anchors[0].coverage.length)
+    const anchor = bootstrapAnchor(root);
+    if (!anchor)
         throw Error('REFUSE·act historical admission requires one bootstrap anchor');
-    const anchor = anchors[0];
-    return { id: anchor.id, keyClass: 'authorize', publicKey: anchor.publicKey, coverage: anchor.coverage,
-        depth: { lo: 1, hi: 16 }, admittedBy: [] };
+    return { id: anchor.id, keyClass: 'authorize', publicKey: anchor.publicKey, coverage: anchor.coverage, depth: { lo: 1, hi: 16 }, admittedBy: [] };
 }

package/dist/fold/bootstrap-anchor.js

@@ -0,0 +1,28 @@
+import { join } from 'node:path';
+import { existsSync, readFileSync, readdirSync } from 'node:fs';
+import { storeOf } from "../land/ledger.js";
+/** Read the existing place-local root of trust. Names and current claims select no authority. */
+export function bootstrapAnchor(root) {
+    const store = storeOf(root);
+    const files = existsSync(store) ? readdirSync(store).filter(name => name.endsWith('.keys')).sort() : [];
+    if (!files.length)
+        return undefined;
+    const candidates = files.map(name => {
+        let keys;
+        try {
+            keys = JSON.parse(readFileSync(join(store, name), 'utf8'));
+        }
+        catch {
+            throw Error('REFUSE·act bootstrap anchor is unreadable');
+        }
+        const anchors = Object.values(keys ?? {}), anchor = anchors[0];
+        if (anchors.length !== 1 || !anchor || typeof anchor.id !== 'string' || !anchor.id || typeof anchor.publicKey !== 'string' || !anchor.publicKey || !Array.isArray(anchor.coverage) || !anchor.coverage.length || anchor.coverage.some(scope => typeof scope !== 'string' || !scope))
+            throw Error('REFUSE·act historical admission requires one bootstrap anchor');
+        return anchor;
+    });
+    const identities = new Set(candidates.map(anchor => JSON.stringify([anchor.id, anchor.publicKey, [...new Set(anchor.coverage)].sort()])));
+    if (identities.size !== 1)
+        throw Error('REFUSE·act conflicting bootstrap anchors');
+    const anchor = candidates[0];
+    return { id: anchor.id, publicKey: anchor.publicKey, coverage: anchor.coverage };
+}

package/dist/fold/ceilings.js

@@ -127,3 +127,16 @@ export function foldCeilings(input) {
         readings: said,
     };
 }
+function listed(misses) {
+    const by = new Map();
+    for (const o of misses)
+        by.set(o.ceiling, [...(by.get(o.ceiling) ?? []), o.question === o.ceiling ? o.got : `${o.question}=${o.got}`]);
+    return [...by].map(([scope, got]) => `${scope} · ${got.length > 4 ? `${got.slice(0, 4).join(' ')} +${got.length - 4}` : got.join(' ')}`);
+}
+/** One summary for fresh and retained judgments over the same declared bounds. */
+export function ceilingSummary(fold, total, shared = new Set()) {
+    return { read: fold.read.length, total, unread: fold.unread.map(line => fieldOf(line, 'scope')),
+        vacuous: fold.vacuous.map(line => fieldOf(line, 'scope')),
+        short: listed(fold.over.filter(one => one.side === 'short' && !shared.has(one.question))),
+        over: listed(fold.over.filter(one => one.side === 'over')) };
+}

package/dist/fold/own.js

@@ -27,6 +27,12 @@ import { writtenIn } from "./signed.js";
 import { laidDiffers } from "./laid.js";
 import { heldBytes } from "../land/held.js";
 import { capsuleAt, placesIn, worldAt } from "./places.js";
+/** Measurements of this invocation; never evidence of an earlier kept fold. */
+export function currentActReadings(under) {
+    const receipts = receiptsSeen();
+    return placeOnly({ idle: idleCount(), s: actSeconds(), 'walk-read': receipts.count, 'walk-ms': receipts.ms,
+        'kept-folds-read-under-another-instrument': foldsElsewhere() }, under);
+}
 const entered = { foreign: 0 };
 /** Host and instrument measurements. Domain contracts require their selected readers; missing readings are not fabricated zeroes. */
 function shipped(root, store, standing, under) {
@@ -193,12 +199,8 @@ export function ownReadings(input) {
         ...Object.fromEntries(standing.filter((line) => isCeiling(line) && (fieldOf(line, 'measure') === 'reader-modules' || fieldOf(line, 'scope').split('/').pop() === 'reader-modules'))
             .flatMap((line) => ((place) => place === undefined ? [] : [[fieldOf(line, 'scope'), tree(() => exporting(observed, `${place}/`, ['observe', 'run']))]])(fieldOf(line, 'scope').split('/').find((step) => capsuleAt(root, step))))),
         ...ownFrom(ceilingsNamed(standing, 'world-lines-outside-their-capsule').find((line) => fieldOf(line, 'form') === 'interval'), 'world-lines-outside-their-capsule', tree(() => outsideTheirCapsule(root, standing, standing).length)),
-        idle: idleCount(),
-        s: actSeconds(),
+        ...currentActReadings(),
         'cli-verbs': VERB_NAMES.length,
-        'walk-read': receiptsSeen().count,
-        'walk-ms': receiptsSeen().ms,
-        'kept-folds-read-under-another-instrument': tree(() => foldsElsewhere()),
         'accepts-that-refolded': tree(() => counted(store, standing, 'beat/accept', 'folded')),
         ...(keyOf(store, 'attest') === undefined ? {} : { [`${keyOf(store, 'attest')}-ms`]: tree(() => attestBeat(store, standing)) }),
         ship: took('ship', () => shipped(root, store, standing, under)),

package/dist/fold/signers.js

@@ -1,11 +1,9 @@
-import { existsSync, join } from "../host/io.js";
+import { bootstrapAnchor } from "./bootstrap-anchor.js";
 import { authorityOf, isKeyClaim, signersOf } from '@lapxo/topos/wire';
 import { verifiesFields } from "../land/sign.js";
-import { fieldOf, selfName, parsedLine as parse } from "./claims.js";
+import { fieldOf, parsedLine as parse } from "./claims.js";
 import { keyFor, lockStanding } from "./keys.js";
-import { storeRoot } from "../host/ports/store.js";
 import { storeOf } from "../land/ledger.js";
-import { observeText } from "../observe/files.js";
 /** A lock line about the signers: the authority fold reads it. */
 export function isSignerLock(line) {
     const got = parse(line);
@@ -38,11 +36,9 @@ export function writerFor(standing, kind) {
     return undefined;
 }
 export function publicKeyOf(root, keyId) {
-    const at = [join(storeRoot(root), `${selfName()}.keys`), join(storeOf(root), `${selfName()}.keys`)].find((one) => existsSync(one));
-    const keys = at === undefined ? {} : JSON.parse(observeText(at) ?? '{}');
-    const anchored = keys[keyId]?.publicKey;
-    if (anchored !== undefined)
-        return anchored;
+    const anchor = bootstrapAnchor(root);
+    if (anchor?.id === keyId)
+        return anchor.publicKey;
     const said = lockStanding(storeOf(root))
         .find((line) => fieldOf(line, 'scope') === `keys/${keyId}` && fieldOf(line, 'measure') === 'public-key' && fieldOf(line, 'value') !== 'withdraw');
     return said === undefined ? undefined : fieldOf(said, 'value');

package/dist/host/admitted-place.js

@@ -55,3 +55,9 @@ export function authenticatedRootStanding(root) {
 }
 /** Legacy Root lines remain unchanged; contextual public output has its own carrier. */
 export const authenticatedStanding = authenticatedRootStanding;
+/** Public current configuration omits withdrawal markers; typed effective history
+ * remains intact for the existing typed-object projection. Internal readers keep
+ * authenticatedStanding, including its historical markers. */
+export function publicStandingLines(root) {
+    return authenticatedRootStanding(root).filter(line => !isConfig(line) || fieldOf(line, 'value') !== 'withdraw');
+}

package/dist/host/contextual-place.js

@@ -5,7 +5,7 @@ import { commitPlaceAct, placeActResult, committedPlaceActResults } from "./port
 import { placesIn } from "../fold/places.js";
 import { appliedHistoryIn } from "../fold/signed.js";
 import { storeOf } from "../land/ledger.js";
-import { authenticatedRootStanding } from "./admitted-place.js";
+import { publicStandingLines } from "./admitted-place.js";
 import { foldClaims, fieldOf } from "../fold/claims.js";
 const fail = (s) => { throw Error('REFUSE·contextual place ' + s); };
 function read(path, limit) {
@@ -73,5 +73,5 @@ export function contextualStanding(root) {
         }
     }
     const legacyPlaces = placesIn(root).map(place => { const history = appliedHistoryIn(root, place), folded = foldClaims(history); return { namespace: 'legacy-global', place: [place, 'TARGET.bound'].join('/'), standing: folded.standing.filter(line => fieldOf(line, 'value') !== 'withdraw'), history }; });
-    return { profile: PLACE_ACT_CONTEXT, root: authenticatedRootStanding(root), legacyPlaces, contexts: acts.map(a => ({ identity: a.identity, context: a.bundle.context, receipts: a.bundle.receipts, authority: selected.authority(a.bundle.context) })), places: [...groups.values()].map(group => { const folded = foldClaims(group.lines); return { namespace: group.namespace, place: group.place, standing: folded.standing.filter(line => fieldOf(line, 'value') !== 'withdraw'), retracted: folded.retracted, superseded: folded.superseded, forks: folded.forks, contexts: group.contexts }; }) };
+    return { profile: PLACE_ACT_CONTEXT, root: publicStandingLines(root), legacyPlaces, contexts: acts.map(a => ({ identity: a.identity, context: a.bundle.context, receipts: a.bundle.receipts, authority: selected.authority(a.bundle.context) })), places: [...groups.values()].map(group => { const folded = foldClaims(group.lines); return { namespace: group.namespace, place: group.place, standing: folded.standing.filter(line => fieldOf(line, 'value') !== 'withdraw'), retracted: folded.retracted, superseded: folded.superseded, forks: folded.forks, contexts: group.contexts }; }) };
 }

package/dist/host/io.js

@@ -7,5 +7,5 @@ export { basename, dirname, join, relative, resolve } from 'node:path';
 export { fileURLToPath } from 'node:url';
 export { parentPort, workerData } from 'node:worker_threads';
 export { gzipSync } from 'node:zlib';
-/** UTF-8 encoding for host byte formats. */
-export const encodeUTF8 = (text) => new TextEncoder().encode(text);
+/** UTF-8 encoding is shared with host-free protocol ports. */
+export { encodeUTF8 } from "../engine/encoding.js";

package/dist/host/native/module-syntax.js

@@ -18,12 +18,12 @@ export function moduleImportSyntax(source, coordinate) {
     }
     const found = new Set(), unresolved = new Set();
     const literal = stringLiteral;
-    const visit = (node, parent, key) => {
+    const visit = (node, parent, key, reexportSource = false) => {
         if (!node || typeof node !== 'object')
             return;
         if (Array.isArray(node)) {
             for (const child of node)
-                visit(child, parent, key);
+                visit(child, parent, key, reexportSource);
             return;
         }
         const n = node;
@@ -32,7 +32,11 @@ export function moduleImportSyntax(source, coordinate) {
         if (n['type'] === 'Identifier' && n['name'] === 'require') {
             const direct = parent?.['type'] === 'CallExpression' && key === 'callee';
             const namedProperty = (parent?.['type'] === 'MemberExpression' && key === 'property' && !parent['computed']) || ((parent?.['type'] === 'Property' || parent?.['type'] === 'MethodDefinition') && key === 'key' && !parent['computed'] && !parent['shorthand']);
-            if (!direct && !namedProperty)
+            // Declaration names are not loader references. This does not resolve shadowing:
+            // references to a binding named require remain conservative, including local calls.
+            const declarationName = ((parent?.['type'] === 'ImportSpecifier' || parent?.['type'] === 'ImportDefaultSpecifier' || parent?.['type'] === 'ImportNamespaceSpecifier') && (key === 'imported' || key === 'local')) || (parent?.['type'] === 'FunctionDeclaration' && key === 'id');
+            const reexportName = parent?.['type'] === 'ExportSpecifier' && (key === 'exported' || (key === 'local' && reexportSource));
+            if (!direct && !namedProperty && !declarationName && !reexportName)
                 unresolved.add('require reference at ' + String(n['start']));
         }
         let specifier;
@@ -52,7 +56,7 @@ export function moduleImportSyntax(source, coordinate) {
         if (specifier !== undefined)
             found.add(specifier);
         for (const [childKey, child] of Object.entries(n))
-            visit(child, n, childKey);
+            visit(child, n, childKey, n['type'] === 'ExportNamedDeclaration' ? n['source'] !== null && n['source'] !== undefined : reexportSource);
     };
     visit(tree);
     return { imports: [...found], unresolved: [...unresolved] };

package/dist/host/reference-authenticated.d.ts

@@ -9,6 +9,10 @@ export interface ReferenceTrust {
     readonly formImplementation: string;
     readonly signers: readonly Signer[];
     readonly algorithms: readonly string[];
+    readonly contracts?: {
+        readonly refusals: string;
+        readonly standing: string;
+    };
     readonly objects: ObjectContext;
     readonly maxBytes: number;
     readonly maxRecords: number;
@@ -18,6 +22,10 @@ export interface ReferenceTrust {
 }
 /** Prospective authenticated-standing@1 host composition; no effects and no authority from transport. */
 export declare function inspectAuthenticatedReference(fragment: string, trust: ReferenceTrust): Promise<{
+    contracts?: {
+        refusals: string;
+        standing: string;
+    } | undefined;
     reference: import("./reference-profile.ts").StandingReference;
     records: readonly import("@lapxo/topos/wire").ObjectRecord[];
     semanticIdentity: string;
@@ -26,3 +34,7 @@ export declare function inspectAuthenticatedReference(fragment: string, trust: R
     originalRecords: readonly string[];
 }>;
 export { encodeReference, decodeReference } from './reference-profile.ts';
+export { BoundRefusal, readRefusalCatalog, describeRefusal } from './refusals.ts';
+export type { RefusalEntry } from './refusals.ts';
+export { readContent, retainContent, invokeSigningPort } from '../engine/ports.ts';
+export type { PortLimits, ContentReadPort, PersistencePort, DigestPort, SigningPort, SigningLot, SignatureRecord } from '../engine/ports.ts';