@lapxo/bound 0.2.0 → 0.2.2

package/dist/host/reference-authenticated.js

@@ -1,42 +1,61 @@
+import { BoundRefusal } from "./refusals.js";
 import { parse, canonical, authorityOf, authorityAtEpoch, signedBytes, objectHistory, validateObjectContext } from '@lapxo/topos/wire';
-import { cellInputs } from '@lapxo/topos/cell-inputs';
-import { semanticStandingBytes } from '@lapxo/topos/standing';
 import { decodeReference } from "./reference-profile.js";
-function fail(why) { throw Error('REFUSE·authenticated-reference ' + why); }
+import { referenceStanding, referenceContracts, referenceContextBytes } from "./reference-standing.js";
+function fail(code, why) { throw new BoundRefusal('authenticated-reference/' + code, 'REFUSE·authenticated-reference ' + why); }
 const utf8 = (s) => new TextEncoder().encode(s);
 /** Prospective authenticated-standing@1 host composition; no effects and no authority from transport. */
 export async function inspectAuthenticatedReference(fragment, trust) {
     if (new Set(trust.signers.map(s => s.id)).size !== trust.signers.length)
-        fail('duplicate host signer');
+        fail('context', 'duplicate host signer');
     const reference = decodeReference(fragment);
     if (!Number.isSafeInteger(trust.maxBytes) || trust.maxBytes < 1 || !Number.isSafeInteger(trust.maxRecords) || trust.maxRecords < 1)
-        fail('resource budget');
-    const received = await trust.fetchBytes(reference.source, reference.blob);
+        fail('budget', 'resource budget');
+    if (trust.contracts !== undefined) {
+        if (!referenceContracts(trust.contracts))
+            fail('context', 'contract identities');
+        const snapshot = await trust.digestBytes(referenceContextBytes({ ...trust, semanticIdentity: 'sha256:' + reference.digest, contracts: trust.contracts }));
+        if (snapshot !== trust.snapshot)
+            fail('context', 'context snapshot');
+    }
+    let received;
+    try {
+        received = await trust.fetchBytes(reference.source, reference.blob);
+    }
+    catch {
+        return fail('transport', 'content port failed');
+    }
     if (received.byteLength > trust.maxBytes)
-        fail('bytes budget');
+        fail('budget', 'bytes budget');
     if (typeof SharedArrayBuffer !== 'undefined' && received.buffer instanceof SharedArrayBuffer)
-        fail('shared transport bytes');
+        fail('transport', 'shared transport bytes');
     const bytes = new Uint8Array(received);
     if (await trust.digestBytes(bytes) !== reference.blob)
-        fail('blob integrity');
-    const text = new TextDecoder('utf-8', { fatal: true }).decode(bytes);
+        fail('integrity', 'blob integrity');
+    let text;
+    try {
+        text = new TextDecoder('utf-8', { fatal: true }).decode(bytes);
+    }
+    catch {
+        return fail('framing', 'carrier UTF-8');
+    }
     let packet;
     try {
         packet = JSON.parse(text);
     }
     catch {
-        fail('carrier framing');
+        fail('framing', 'carrier framing');
     }
     if (!Array.isArray(packet) || packet.length !== 3 || packet[0] !== 'authenticated-standing@1' || !Array.isArray(packet[1]) || packet[1].length < 1 || packet[1].length > trust.maxRecords || packet[1].some((x) => typeof x !== 'string') || typeof packet[2] !== 'string' || JSON.stringify(packet) + '\n' !== text)
-        fail('carrier framing');
+        fail('framing', 'carrier framing');
     const originals = packet[1], proofLine = packet[2];
     const parsed = [...originals, proofLine].map(line => { const p = parse(line); if (p.kind !== 'fact' || canonical(p.value.fields) !== line)
-        fail('original canonical'); return p.value.fields; });
+        fail('wire', 'original canonical'); return p.value.fields; });
     const proof = parsed[parsed.length - 1];
     if (proof.scope !== trust.proofScope || proof.at !== 'witness:' + trust.snapshot || proof.role !== 'writes' || proof.form !== 'alphabet' || proof.measure !== 'digest' || proof.epoch !== String(trust.epoch))
-        fail('untrusted snapshot binding');
+        fail('context', 'untrusted snapshot binding');
     if (proof.value !== await trust.digestBytes(utf8(JSON.stringify(['authenticated-standing@1', originals]) + '\n')))
-        fail('snapshot commitment');
+        fail('integrity', 'snapshot commitment');
     // Async crypto port is called on exact native signed bytes; authorityOf consumes only those results.
     const verifiedCrypto = new Set();
     const key = (f, pub) => JSON.stringify([signedBytes(f), pub, f.sig, trust.algorithms]);
@@ -47,38 +66,35 @@ export async function inspectAuthenticatedReference(fragment, trust) {
     const verifies = (f, pub) => verifiedCrypto.has(key(f, pub));
     const authentic = authorityOf(proof, trust.signers, verifies);
     if (authentic.kind !== 'admitted')
-        fail('proof ' + authentic.kind + ' ' + authentic.why);
+        fail('authority', 'proof ' + authentic.kind + ' ' + authentic.why);
     const signer = trust.signers.find(s => s.id === proof.by);
     if (!signer)
-        fail('proof signer');
+        fail('authority', 'proof signer');
     const current = authorityAtEpoch(proof, signer, trust.epoch, trust.proofScope, 'authority');
     if (current.kind !== 'admitted')
-        fail('current proof ' + current.kind + ' ' + current.why);
+        fail('authority', 'current proof ' + current.kind + ' ' + current.why);
     const verified = new Set();
     for (let i = 0; i < originals.length; i++) {
         const admitted = authorityOf(parsed[i], trust.signers, verifies);
         if (admitted.kind !== 'admitted')
-            fail('original ' + admitted.kind + ' ' + admitted.why);
+            fail('authority', 'original ' + admitted.kind + ' ' + admitted.why);
         verified.add(originals[i]);
     }
     const history = objectHistory(originals);
     if (history.kind !== 'fact')
-        fail('wire ' + history.why);
+        fail('wire', 'wire ' + history.why);
     if (history.value.configuration.some(f => f.value === 'withdraw'))
-        fail('configuration history requires admitted standing fold');
+        fail('history', 'configuration history requires admitted standing fold');
     const context = { ...trust.objects, admit: (r) => verified.has(canonical(r.fields)) && trust.objects.admit(r) };
     const checked = validateObjectContext(history.value.objects, context);
     if (checked.kind !== 'fact')
-        throw Error('REFUSE·' + checked.why);
-    const membership = new Set([...cellInputs(checked.value, 'semantic-live@2').values()].flat().map(l => semanticStandingBytes([l])));
-    const fields = (line) => { const p = parse(line); if (p.kind !== 'fact')
-        fail('original parse'); return p.value.fields; };
-    const effective = [...originals].sort((a, b) => Number(fields(a).epoch) - Number(fields(b).epoch));
-    const live = effective.filter(line => { const f = fields(line); return f.type === undefined || membership.has(semanticStandingBytes([line])); });
-    const semantic = semanticStandingBytes(live), semanticIdentity = await trust.digestBytes(utf8(semantic));
+        throw new BoundRefusal('authenticated-reference/object-context', 'REFUSE·' + checked.why);
+    const semantic = referenceStanding(originals, checked.value), semanticIdentity = await trust.digestBytes(utf8(semantic));
     if (semanticIdentity !== 'sha256:' + reference.digest)
-        fail('standing identity');
-    const authorityContextIdentity = await trust.digestBytes(utf8(JSON.stringify(['reference-inspection-trust@1', trust.snapshot, trust.epoch, trust.proofScope, trust.policy, trust.formImplementation, trust.signers, trust.algorithms])));
-    return { reference, records: checked.value, semanticIdentity, authorityContextIdentity, semanticStanding: semantic, originalRecords: originals };
+        fail('identity', 'standing identity');
+    const authorityContextIdentity = await trust.digestBytes(utf8(JSON.stringify(trust.contracts ? ['reference-inspection-trust@2', trust.snapshot, trust.epoch, trust.proofScope, trust.policy, trust.formImplementation, trust.signers, trust.algorithms, trust.contracts] : ['reference-inspection-trust@1', trust.snapshot, trust.epoch, trust.proofScope, trust.policy, trust.formImplementation, trust.signers, trust.algorithms])));
+    return { reference, records: checked.value, semanticIdentity, authorityContextIdentity, semanticStanding: semantic, originalRecords: originals, ...(trust.contracts ? { contracts: { ...trust.contracts } } : {}) };
 }
 export { encodeReference, decodeReference } from "./reference-profile.js";
+export { BoundRefusal, readRefusalCatalog, describeRefusal } from "./refusals.js";
+export { readContent, retainContent, invokeSigningPort } from "../engine/ports.js";

package/dist/host/reference-contracts.js

@@ -0,0 +1,6 @@
+import { readFileSync } from 'node:fs';
+import { sha256 } from "./hash.js";
+/** Exact shipped interpretation contracts; this helper grants no authority. */
+export function installedReferenceContracts() {
+    return { refusals: sha256(readFileSync(new URL('../../docs/contracts/refusals.bound', import.meta.url))), standing: sha256(readFileSync(new URL('../../docs/contracts/standing.bound', import.meta.url))) };
+}

package/dist/host/reference-export.d.ts

@@ -0,0 +1,33 @@
+import type { SigningPort } from '../engine/ports.ts';
+export { BoundRefusal as ReferenceExportRefusal } from './refusals.ts';
+/** Signs a public snapshot proof; never lands, refreshes evidence or changes the Root. */
+export declare function exportAuthenticatedReference(root: string, source: string, options?: {
+    readonly key?: string;
+    readonly keyFile?: string;
+    readonly signer?: string;
+    readonly hostSigner?: {
+        readonly name: string;
+        readonly sign: SigningPort;
+    };
+}): Promise<{
+    profile: string;
+    reference: string;
+    carrier: string;
+    context: {
+        snapshot: string;
+        profile: string;
+        semanticIdentity: string;
+        epoch: number;
+        proofScope: string;
+        policy: string;
+        formImplementation: string;
+        signers: readonly import("@lapxo/topos/wire").Signer[];
+        algorithms: readonly string[];
+        contracts: {
+            refusals: string;
+            standing: string;
+        };
+        maxBytes: number;
+        maxRecords: number;
+    };
+}>;

package/dist/host/reference-export.js

@@ -0,0 +1,81 @@
+import { installedReferenceContracts } from "./reference-contracts.js";
+import { BoundRefusal, describeRefusal, readRefusalCatalog } from "./refusals.js";
+import { readFileSync } from 'node:fs';
+import { authorityAtEpoch, canonical, parse } from '@lapxo/topos/wire';
+import { sha256 as hash } from "./hash.js";
+import { signerFor } from "./signing.js";
+import { signConsentLot } from "../land/sign.js";
+import { underRootAuthority } from "../land/act.js";
+import { storeOf } from "../land/ledger.js";
+import { authorityFor, rootSigner } from "../fold/signers.js";
+import { admissionAnchor, admissionHistoryAt } from "../fold/admission-history.js";
+import { authenticatedRootStanding } from "./admitted-place.js";
+import { eraOf } from "../fold/digests.js";
+import { epochOf } from "../cli/owner.js";
+import { fieldOf } from "../fold/claims.js";
+import { prepareNativeReference } from "./reference-native.js";
+import { referenceContextBytes, referenceContracts, referenceStanding } from "./reference-standing.js";
+import { encodeReference } from "./reference-profile.js";
+const catalog = () => readFileSync(new URL('../../docs/contracts/refusals.bound', import.meta.url), 'utf8');
+export { BoundRefusal as ReferenceExportRefusal } from "./refusals.js";
+function fail(code) {
+    const refusal = new BoundRefusal('reference-export/' + code, 'REFUSE·reference-export/' + code);
+    const entry = describeRefusal(refusal, readRefusalCatalog(catalog()));
+    throw new BoundRefusal(entry.code, 'REFUSE·' + entry.code + ' ' + entry.meaning);
+}
+/** Signs a public snapshot proof; never lands, refreshes evidence or changes the Root. */
+export async function exportAuthenticatedReference(root, source, options = {}) {
+    try {
+        encodeReference({ class: 'standing', algorithm: 'sha256', digest: '0'.repeat(64), blob: 'sha256:' + '0'.repeat(64), source });
+    }
+    catch {
+        fail('source');
+    }
+    return underRootAuthority(storeOf(root), 'reference export', async () => {
+        const history = admissionHistoryAt(root, Number.MAX_SAFE_INTEGER), standing = authenticatedRootStanding(root), epoch = epochOf(history), era = eraOf(standing);
+        const authority = authorityFor(history, admissionAnchor(root), era.admitted);
+        const one = (scope, measure = 'id', form = 'alphabet') => { const rows = standing.filter(line => fieldOf(line, 'scope') === scope && fieldOf(line, 'value') !== 'withdraw'); if (rows.length !== 1 || fieldOf(rows[0], 'role') !== 'writes' || fieldOf(rows[0], 'measure') !== measure || fieldOf(rows[0], 'form') !== form || authority.of(rows[0]).kind !== 'admitted')
+            fail('context'); return fieldOf(rows[0], 'value'); };
+        if (one('reference/authentication') !== 'authenticated-standing@1')
+            fail('context');
+        const proofScope = one('reference/proof-scope'), contracts = { refusals: one('reference/contracts/refusals'), standing: one('reference/contracts/standing') };
+        const installed = installedReferenceContracts();
+        if (!referenceContracts(contracts) || contracts.refusals !== installed.refusals || contracts.standing !== installed.standing)
+            fail('context');
+        const count = one('reference/records'), maxRecords = Number(count), range = /^(0|[1-9][0-9]*)\.\.(0|[1-9][0-9]*)$/.exec(one('reference/export-bytes', 'bytes', 'interval'));
+        if (!/^(0|[1-9][0-9]*)$/.test(count) || !Number.isSafeInteger(maxRecords) || maxRecords < 1 || !range || Number(range[1]) > Number(range[2]) || !Number.isSafeInteger(Number(range[2])) || Number(range[2]) < 1)
+            fail('budget');
+        const maxBytes = Number(range[2]);
+        const originals = standing.filter(line => fieldOf(line, 'value') !== 'withdraw' || fieldOf(line, 'type') !== '');
+        if (!originals.length || originals.length > maxRecords || Buffer.byteLength(originals.join('\n')) > maxBytes)
+            fail('budget');
+        if (originals.some(line => authority.of(line).kind !== 'admitted'))
+            fail('history');
+        const key = options.key ?? rootSigner(root).id, signer = authority.admitted.find(s => s.id === key);
+        const stamp = canonical({ scope: proofScope, role: 'writes', form: 'alphabet', measure: 'digest', value: hash(JSON.stringify(['authenticated-standing@1', originals]) + '\n'), by: 'target', at: 'witness:' + 'sha256:' + '0'.repeat(64) });
+        const probe = parse(stamp);
+        if (!signer || probe.kind !== 'fact' || authorityAtEpoch({ ...probe.value.fields, by: key, epoch: String(epoch) }, signer, epoch, proofScope, 'authority').kind !== 'admitted')
+            fail('authority');
+        const held = await prepareNativeReference(root), semantic = referenceStanding(originals, held.records), semanticIdentity = hash(semantic);
+        const context = { profile: 'reference-export-context@1', semanticIdentity, epoch, proofScope, policy: held.policy, formImplementation: held.formImplementation, signers: authority.admitted, algorithms: era.admitted, contracts, maxBytes, maxRecords };
+        const snapshot = hash(referenceContextBytes(context));
+        if (Buffer.byteLength(JSON.stringify({ originals, context, snapshot }) + '\n') > maxBytes)
+            fail('budget');
+        const drafted = canonical({ ...probe.value.fields, at: 'witness:' + snapshot });
+        let signed;
+        try {
+            signed = await signConsentLot([drafted], { epoch, by: key, algorithm: era.era }, signer.publicKey, era.admitted, signerFor(standing, key, options.signer, options.keyFile, options.hostSigner));
+        }
+        catch {
+            fail('signer');
+        }
+        if (signed.kind !== 'fact')
+            fail('signer');
+        const carrier = JSON.stringify(['authenticated-standing@1', originals, signed.lines[0]]) + '\n';
+        const reference = encodeReference({ class: 'standing', algorithm: 'sha256', digest: semanticIdentity.slice(7), blob: hash(carrier), source });
+        const result = { profile: 'reference-export@1', reference, carrier, context: { ...context, snapshot } };
+        if (Buffer.byteLength(JSON.stringify(result) + '\n') > maxBytes)
+            fail('budget');
+        return result;
+    });
+}

package/dist/host/reference-native-api.d.ts

@@ -0,0 +1,3 @@
+/** Native host boundary. The platform-free reference inspector remains /reference. */
+export { openAuthenticatedReference } from './reference-native.ts';
+export { exportAuthenticatedReference } from './reference-export.ts';

package/dist/host/reference-native-api.js

@@ -0,0 +1,3 @@
+/** Native host boundary. The platform-free reference inspector remains /reference. */
+export { openAuthenticatedReference } from "./reference-native.js";
+export { exportAuthenticatedReference } from "./reference-export.js";

package/dist/host/reference-native.d.ts

@@ -1,6 +1,26 @@
+import { type ContentReadPort } from '../engine/ports.ts';
 export declare function authenticatedReferenceSelected(standing: readonly string[]): boolean;
-export declare function openAuthenticatedReference(root: string, fragment: string): Promise<{
+/** One context preparation shared by native export and native inspection. */
+export declare function prepareNativeReference(root: string): Promise<{
+    policy: string;
+    formImplementation: string;
+    records: readonly import("@lapxo/topos/wire").ObjectRecord[];
+    context: import("@lapxo/topos/wire").ObjectContext;
+    configuration: Readonly<Record<string, string>>[];
+}>;
+export declare function openAuthenticatedReference(root: string, fragment: string, options?: {
+    readonly signal?: AbortSignal;
+    readonly content?: {
+        readonly name: string;
+        readonly read: ContentReadPort;
+    };
+}): Promise<{
+    backend: string;
     readings: readonly import("../engine/object.ts").ObjectReading[];
+    contracts?: {
+        refusals: string;
+        standing: string;
+    } | undefined;
     reference: import("./reference-profile.ts").StandingReference;
     records: readonly import("@lapxo/topos/wire").ObjectRecord[];
     semanticIdentity: string;

package/dist/host/reference-native.js

@@ -1,3 +1,7 @@
+import { readContent } from "../engine/ports.js";
+import { installedReferenceContracts } from "./reference-contracts.js";
+import { BoundRefusal } from "./refusals.js";
+import { foldObjectsWithWasm } from "../wasm/object.js";
 /** Native ports for authenticated #bound opening; trusted policy belongs to the selected local place. */
 import { sha256 as hash, isSha256 } from "./hash.js";
 import { canonical, parse, transportSelection } from '@lapxo/topos/wire';
@@ -22,29 +26,49 @@ export function authenticatedReferenceSelected(standing) {
         throw Error('REFUSE·reference conflicting or unknown authentication profile');
     return true;
 }
-export async function openAuthenticatedReference(root, fragment) {
+/** One context preparation shared by native export and native inspection. */
+export async function prepareNativeReference(root) {
+    const store = storeOf(root), held = await admittedObjects(root, signedOwnerLines(store), () => { }, true);
+    const policy = held.configuration.map(fields => canonical(fields));
+    const implementations = [...new Set(held.records.filter(r => r.record === 'cell').map(r => r.fields.topos))].sort().map(pin => { const selected = toposAt(pin, store), selectors = selected.parts.filter(f => f.scope === 'wire/topos/context-view'); if (selectors.length !== 1)
+        throw Error('REFUSE·reference host context selector'); const offers = selected.parts.filter(f => f.kind === 'check' && f.view === selectors[0].value); if (offers.length !== 1)
+        throw Error('REFUSE·reference host context offer'); const offer = offers[0], closure = [...new Set((offer.restsOn ?? '').split('|').filter(Boolean))].sort(); for (const digest of closure)
+        contentAt(digest, store); return [pin, offer.value, closure]; });
+    return { ...held, policy: hash(semanticStandingBytes(policy)), formImplementation: hash(JSON.stringify(implementations)) };
+}
+export async function openAuthenticatedReference(root, fragment, options = {}) {
     const store = storeOf(root), standing = lockStanding(store), era = eraOf(standing), authority = authorityFor(lockLines(store), rootSigner(root), era.admitted);
     if (!authenticatedReferenceSelected(standing))
         throw Error('REFUSE·reference no admitted authenticated-standing@1 profile');
-    const one = (scope) => { const found = standing.flatMap(line => { const p = parse(line); return p.kind === 'fact' && p.value.fields.scope === scope ? [{ line, fields: p.value.fields }] : []; }); if (found.length !== 1 || found[0].fields.role !== 'writes' || found[0].fields.measure !== 'id' || authority.of(found[0].line).kind !== 'admitted')
-        throw Error('REFUSE·reference missing, conflicting or unauthenticated ' + scope); return found[0].fields.value; };
+    const one = (scope) => { const found = standing.flatMap(line => { const p = parse(line); return p.kind === 'fact' && p.value.fields.scope === scope ? [{ line, fields: p.value.fields }] : []; }); if (found.length !== 1 || found[0].fields.role !== 'writes' || found[0].fields.measure !== 'id' || found[0].fields.form !== 'alphabet' || authority.of(found[0].line).kind !== 'admitted')
+        throw new BoundRefusal(scope === 'engine/object' ? 'reference/backend' : 'authenticated-reference/context', 'REFUSE·reference missing, conflicting or unauthenticated ' + scope); return found[0].fields.value; };
     if (one('reference/authentication') !== 'authenticated-standing@1')
         throw Error('REFUSE·reference authentication profile');
     const snapshot = one('reference/snapshot'), epochText = one('reference/epoch'), proofScope = one('reference/proof-scope'), recordsText = one('reference/records');
     if (!isSha256(snapshot) || !/^\d+$/.test(epochText) || !Number.isSafeInteger(Number(epochText)) || !/^\d+$/.test(recordsText) || !Number.isSafeInteger(Number(recordsText)) || Number(recordsText) < 1 || !proofScope)
         throw Error('REFUSE·reference authority snapshot or resource contract');
+    const backend = one('engine/object');
+    if (!['esm@1', 'wasm@1'].includes(backend))
+        throw new BoundRefusal('reference/backend', 'REFUSE·reference unsupported declared backend');
+    if (options.signal?.aborted)
+        throw new BoundRefusal('reference/cancelled', 'REFUSE·reference cancelled');
     const reference = decodeReference(fragment);
     // Provider selection is made from HOST-declared cells/configuration, never carrier-picked code.
-    const held = await admittedObjects(root, signedOwnerLines(store), () => { }, true);
+    const held = await prepareNativeReference(root);
     if (!held.records.some(r => r.record === 'cell'))
         throw Error('REFUSE·reference host has no declared object interpretation');
     const context = held.context, policy = held.configuration.map(fields => canonical(fields)), selection = transportSelection(held.configuration, new URL(reference.source).protocol.slice(0, -1));
     if (!selection)
         throw Error('REFUSE·reference no admitted transport policy');
-    const implementations = [...new Set(held.records.filter(r => r.record === 'cell').map(r => r.fields.topos))].sort().map(pin => { const selected = toposAt(pin, store), selectors = selected.parts.filter(f => f.scope === 'wire/topos/context-view'); if (selectors.length !== 1)
-        throw Error('REFUSE·reference host context selector'); const offers = selected.parts.filter(f => f.kind === 'check' && f.view === selectors[0].value); if (offers.length !== 1)
-        throw Error('REFUSE·reference host context offer'); const offer = offers[0], closure = [...new Set((offer.restsOn ?? '').split('|').filter(Boolean))].sort(); for (const digest of closure)
-        contentAt(digest, store); return [pin, offer.value, closure]; });
-    const result = await inspectAuthenticatedReference(fragment, { snapshot, epoch: Number(epochText), proofScope, policy: hash(semanticStandingBytes(policy)), formImplementation: hash(JSON.stringify(implementations)), signers: authority.admitted, algorithms: era.admitted, objects: context, maxBytes: selection.responseBytes, maxRecords: Number(recordsText), digestBytes: hash, verifyBytes, fetchBytes: (source, blob) => transportBytes(source, blob, policy) });
-    return { ...result, readings: objectFold(result.records, context) };
+    if (options.content && options.content.name !== selection.name)
+        throw new BoundRefusal('authenticated-reference/transport', 'REFUSE·reference injected content binding conflicts with declaration');
+    const contracts = { refusals: one('reference/contracts/refusals'), standing: one('reference/contracts/standing') }, expectedPolicy = one('reference/policy'), expectedImplementation = one('reference/form-implementation');
+    const installed = installedReferenceContracts();
+    if (contracts.refusals !== installed.refusals || contracts.standing !== installed.standing || !isSha256(expectedPolicy) || expectedImplementation !== held.formImplementation)
+        throw new BoundRefusal('authenticated-reference/context', 'REFUSE·reference expected interpretation differs');
+    const result = await inspectAuthenticatedReference(fragment, { snapshot, epoch: Number(epochText), proofScope, contracts, policy: expectedPolicy, formImplementation: expectedImplementation, signers: authority.admitted, algorithms: era.admitted, objects: context, maxBytes: selection.responseBytes, maxRecords: Number(recordsText), digestBytes: hash, verifyBytes, fetchBytes: (source, blob) => options.content ? readContent(source, blob, { read: options.content.read, digestBytes: hash }, { timeoutMs: selection.timeoutMs, maxBytes: selection.responseBytes }, options.signal) : transportBytes(source, blob, policy) });
+    if (options.signal?.aborted)
+        throw new BoundRefusal('reference/cancelled', 'REFUSE·reference cancelled');
+    const readings = backend === 'wasm@1' ? await foldObjectsWithWasm(root, result.records, context, held.configuration, options.signal) : objectFold(result.records, context);
+    return { ...result, backend, readings };
 }

package/dist/host/reference-profile.js

@@ -1,5 +1,6 @@
+import { BoundRefusal } from "./refusals.js";
 const hex = /^[0-9a-f]{64}$/;
-const refuse = (cause) => { throw Error(`REFUSE·reference ${cause}`); };
+const refuse = (cause) => { throw new BoundRefusal('reference/format', `REFUSE·reference ${cause}`); };
 const keys = ['class', 'algorithm', 'digest', 'blob', 'source'];
 function check(reference) {
     if (Object.keys(reference).length !== keys.length || keys.some(key => !Object.prototype.hasOwnProperty.call(reference, key)))

package/dist/host/reference-standing.js

@@ -0,0 +1,18 @@
+import { parse } from '@lapxo/topos/wire';
+import { cellInputs } from '@lapxo/topos/cell-inputs';
+import { semanticStandingBytes } from '@lapxo/topos/standing';
+/** Shared projection after admission; transport order never replaces effective order. */
+export function referenceStanding(originals, records) {
+    const membership = new Set([...cellInputs(records, 'semantic-live@2').values()].flat().map(line => semanticStandingBytes([line])));
+    const fields = (line) => { const p = parse(line); if (p.kind !== 'fact')
+        throw Error('REFUSE·authenticated-reference original parse'); return p.value.fields; };
+    const effective = [...originals].sort((a, b) => Number(fields(a).epoch) - Number(fields(b).epoch));
+    return semanticStandingBytes(effective.filter(line => fields(line).type === undefined || membership.has(semanticStandingBytes([line]))));
+}
+export function referenceContracts(value) {
+    return value !== null && typeof value === 'object' && !Array.isArray(value) && Object.keys(value).length === 2 && /^sha256:[a-f0-9]{64}$/.test(value.refusals) && /^sha256:[a-f0-9]{64}$/.test(value.standing);
+}
+/** This versioned context frame binds interpretation contracts without changing wire fields. */
+export function referenceContextBytes(context) {
+    return new TextEncoder().encode(JSON.stringify(['reference-export-context@1', context.semanticIdentity, context.epoch, context.proofScope, context.policy, context.formImplementation, context.signers, context.algorithms, context.contracts.refusals, context.contracts.standing, context.maxBytes, context.maxRecords]) + '\n');
+}

package/dist/host/refusals.d.ts

@@ -0,0 +1,14 @@
+export interface RefusalEntry {
+    readonly code: string;
+    readonly category: string;
+    readonly meaning: string;
+    readonly next: string;
+}
+/** Stable code assigned at the cause. Details are diagnostic, never parsed as policy. */
+export declare class BoundRefusal extends Error {
+    readonly code: string;
+    constructor(code: string, diagnostic: string);
+}
+/** Pure machine contract reader. A catalog is data, never an authority grant. */
+export declare function readRefusalCatalog(text: string): readonly RefusalEntry[];
+export declare function describeRefusal(error: BoundRefusal, catalog: readonly RefusalEntry[]): RefusalEntry;

package/dist/host/refusals.js

@@ -0,0 +1,43 @@
+import { parse, canonical } from '@lapxo/topos/wire';
+/** Stable code assigned at the cause. Details are diagnostic, never parsed as policy. */
+export class BoundRefusal extends Error {
+    constructor(code, diagnostic) { super(diagnostic); this.name = 'BoundRefusal'; this.code = code; }
+}
+/** Pure machine contract reader. A catalog is data, never an authority grant. */
+export function readRefusalCatalog(text) {
+    const groups = new Map();
+    let profile = false;
+    for (const line of text.trimEnd().split('\n')) {
+        const parsed = parse(line);
+        if (parsed.kind !== 'fact' || canonical(parsed.value.fields) !== line)
+            throw new BoundRefusal('catalog/invalid', 'REFUSE·invalid refusal catalog line');
+        const f = parsed.value.fields;
+        if (f.scope === 'refusal/catalog' && f.measure === 'id' && f.value === 'bound-refusals@1' && f.role === 'writes' && f.form === 'alphabet' && !profile) {
+            profile = true;
+            continue;
+        }
+        if (f.role !== 'writes' || f.form !== 'alphabet' || !f.scope?.startsWith('refusal/') || !['code', 'class', 'next'].includes(f.measure ?? ''))
+            throw new BoundRefusal('catalog/invalid', 'REFUSE·invalid refusal catalog record');
+        const group = groups.get(f.scope) ?? new Map();
+        if (group.has(f.measure))
+            throw new BoundRefusal('catalog/invalid', 'REFUSE·duplicate refusal catalog field');
+        group.set(f.measure, f);
+        groups.set(f.scope, group);
+    }
+    const entries = [];
+    for (const [scope, group] of groups) {
+        const code = group.get('code')?.value, category = group.get('class')?.value, meaning = group.get('class')?.about, next = group.get('next')?.value;
+        if (group.size !== 3 || !code || scope !== 'refusal/' + code || !category || !meaning || !next)
+            throw new BoundRefusal('catalog/invalid', 'REFUSE·incomplete refusal catalog entry');
+        entries.push(Object.freeze({ code, category, meaning, next }));
+    }
+    if (!profile || !entries.length)
+        throw new BoundRefusal('catalog/invalid', 'REFUSE·missing refusal catalog profile');
+    return Object.freeze(entries);
+}
+export function describeRefusal(error, catalog) {
+    const entry = catalog.find(row => row.code === error.code);
+    if (!entry)
+        throw new BoundRefusal('catalog/invalid', 'REFUSE·undeclared refusal code');
+    return entry;
+}

package/dist/host/signing.js

@@ -1,3 +1,4 @@
+import { invokeSigningPort } from "../engine/ports.js";
 import { readFileSync } from 'node:fs';
 import { parse, signerSelection, signerRequestBytes, signerResponseBytes, signerResponseOf } from '@lapxo/topos/wire';
 import { invokeSigner, SigningFailure } from "./ports/signing.js";
@@ -31,11 +32,16 @@ function binding(name, keyFile) {
     }
 }
 /** Resolve data before acquisition; all mechanisms use one wire protocol and verification path. */
-export function signerFor(lines, keyId, selected, keyFile) {
+export function signerFor(lines, keyId, selected, keyFile, injected) {
     const fields = lines.flatMap(line => { const got = parse(line); return got.kind === 'fact' ? [got.value.fields] : []; });
     const declaration = signerSelection(fields, keyId);
     if (selected !== undefined && selected !== declaration.name)
         throw new SigningFailure(`REFUSE·signer ${keyId} CLI selection conflicts with declaration`);
+    if (injected) {
+        if (injected.name !== declaration.name || keyFile)
+            throw new SigningFailure('REFUSE·signer injected host binding conflicts with declaration or key file');
+        return (lot) => invokeSigningPort(lot, injected.sign, { timeoutMs: declaration.timeoutMs, maxBytes: declaration.responseBytes });
+    }
     const mechanism = binding(declaration.name, keyFile);
     const protocol = { request: signerRequestBytes, response: signerResponseBytes, reply: signerResponseOf };
     return (lot) => invokeSigner(lot, mechanism, protocol, declaration);

package/dist/observe/files.js

@@ -24,7 +24,17 @@ function bytesAt(at) {
     const held = seen.get(at);
     if (held?.stamp === stamp)
         return held.bytes;
-    const bytes = readFileSync(at);
+    let bytes;
+    try {
+        bytes = readFileSync(at);
+    }
+    catch (error) {
+        // A concurrent act can retire a coordinate after its stamp was read.
+        if (error.code !== 'ENOENT')
+            throw error;
+        seen.delete(at);
+        return undefined;
+    }
     seen.set(at, { stamp, bytes });
     return bytes;
 }

package/dist/wasm/object.js

@@ -10,9 +10,9 @@ export function usesWasmObject(configuration) {
     const rows = configuration.filter(f => f.scope === 'engine/object' && f.value !== 'withdraw');
     if (!rows.length)
         return false;
-    if (rows.length !== 1 || rows[0].role !== 'writes' || rows[0].measure !== 'id' || rows[0].form !== 'alphabet' || rows[0].value !== 'wasm@1')
+    if (rows.length !== 1 || rows[0].role !== 'writes' || rows[0].measure !== 'id' || rows[0].form !== 'alphabet' || !['esm@1', 'wasm@1'].includes(rows[0].value ?? ''))
         refuse('unique declared backend required');
-    return true;
+    return rows[0].value === 'wasm@1';
 }
 function limit(configuration, name, measure) {
     const rows = configuration.filter(f => f.scope === 'engine/wasm/' + name && f.value !== 'withdraw');

package/docs/contracts/authenticated-reference.publication.json

@@ -4,7 +4,7 @@
     {
       "role": "contract",
       "path": "docs/contracts/reference-port.md",
-      "digest": "sha256:ae500aaec7e94dc9bc7c4d45e3294b212b0ad5ade7647e3ce24807ca7a0ea7cc"
+      "digest": "sha256:d6198b9ab177086cb334e9e9cd7adb5c67b0af7165a79d23812aa2496d17674c"
     },
     {
       "role": "yes",
@@ -14,7 +14,7 @@
     {
       "role": "vector",
       "path": "vectors/native/authenticated-reference.vector.json",
-      "digest": "sha256:297c4942a847c42eb9d2cf000ab38d8a5f38b64e2e4a469919f0dfc88c9d8bd1"
+      "digest": "sha256:9aba7121fbbb98e63259dea78e52377cd71c628e0d17be20c9a51da27f2b31de"
     },
     {
       "role": "no",

package/docs/contracts/host-ports.md

@@ -0,0 +1,23 @@
+# Public host ports
+
+`/engine` and `/reference` export `readContent`, `retainContent` and `invokeSigningPort`, with `ContentReadPort`, `PersistencePort`, `SigningPort`, `DigestPort` and `PortLimits`. There is no default network, store, account or signer. `objectFold` remains pure and never calls a port.
+
+Every operation takes an explicit positive safe-integer `timeoutMs` and `maxBytes`, and an optional AbortSignal. Invalid limits and pre-cancellation refuse before the callback. Acquisition, digest calculation and retention share the operation lifetime. A timeout aborts the supplied signal and returns no successful result. This is a cooperative host boundary, not preemption of synchronous JavaScript or sandbox confinement.
+
+`readContent(source, digest, ports, limits, signal)` invokes the supplied read callback and SHA-256 callback, checks byte bounds before copying/hashing, rejects shared buffers, and verifies an owned snapshot against the requested digest. Location carries no authority.
+
+`retainContent(digest, bytes, ports, limits, signal)` checks identity before calling the host's atomic byte-retention callback. Its acknowledgement contains only digest and byte count. It is not a signed receipt, admission or permission to reuse a response. The host must implement atomic retention and cooperate with cancellation. A callback that ignores cancellation may finish retaining bytes after the caller has refused; no success, act or authority follows from those bytes. Opening and projection never retain automatically.
+
+`invokeSigningPort(lot, sign, limits, signal)` uses the existing Topos signing request/response framing. It acquires protocol-shaped signatures; it does not decide authority or certify them cryptographically. Native export can receive `hostSigner: {name, sign}` through `/reference/native`. The name must match the admitted signer selection, and cannot be combined with a key-file override. The existing consent path verifies every returned signature against the admitted key, era, scope and epoch before returning a carrier. No key material enters the engine.
+
+Native opening accepts `content: {name, read}`. Its name must match the admitted transport selection, with that selection's existing byte and lifetime bounds. The host callback cannot be chosen by a carrier, reference or repository. The existing inspector verifies the returned carrier again and the selected backend projects only verified records. There is no backend fallback.
+
+Public port failures use the machine refusal catalog: `host-port/budget`, `cancelled`, `timeout`, `failed`, `integrity`, `response`. Native acquisition failures retain their enclosing reference refusal. Host diagnostics are not returned as authority or parsed as codes.
+
+Native vector output, in two real admitted places:
+
+```text
+PORTS owned content · verified retention · signer content persistence failures · budget integrity cancellation timeout refused
+HOST host-sensor · declared signer and content injected · real signature verified · wrong binding refused · no commit
+HOST host-editorial · declared signer and content injected · real signature verified · wrong binding refused · no commit
+```

package/docs/contracts/host-ports.publication.json

@@ -0,0 +1,25 @@
+{
+  "scope": "contract/published/host-ports",
+  "members": [
+    {
+      "role": "contract",
+      "path": "docs/contracts/host-ports.md",
+      "digest": "sha256:f3d646da2399c719469a37293b329d53b72b0478ca97f961b90c1f4e6adc2ae6"
+    },
+    {
+      "role": "yes",
+      "path": "samples/host-ports/yes.json",
+      "digest": "sha256:f8dc3c6939bd8f4bb91cb57e3e9b52a865645cc80ee0f5ce5a11570ef3f31ce3"
+    },
+    {
+      "role": "vector",
+      "path": "vectors/native/host-ports.vector.json",
+      "digest": "sha256:58425f81fb4f1ef6e392d8fa3a5ee3a287ef6fbcbfb11e512fd2e30f24f465e6"
+    },
+    {
+      "role": "no",
+      "path": "samples/host-ports/no.json",
+      "digest": "sha256:ffc9dbb29743d4faa16c5c29eb73a7e0f24cf4da3255a979f628f5c3d8f4b7c1"
+    }
+  ]
+}

package/docs/contracts/native-publication.inventory.json

@@ -3,6 +3,12 @@
   "scope": "contract/published/native",
   "surface": [
     "contract/published/optional-wasm-adapter",
-    "contract/published/authenticated-reference"
+    "contract/published/authenticated-reference",
+    "contract/published/reference-export",
+    "contract/published/reference-backend",
+    "contract/published/standing",
+    "contract/published/refusals",
+    "contract/published/host-ports",
+    "contract/published/readme"
   ]
 }

package/docs/contracts/optional-wasm-adapter.publication.json

@@ -14,7 +14,7 @@
     {
       "role": "vector",
       "path": "vectors/wasm-object.cli.json",
-      "digest": "sha256:5f761fabd0592d7f8e9b95a9fc80583424a8e83fb7cb3c4b4905b62eca43db9e"
+      "digest": "sha256:f0b970ede31b99e00e94f249970aa8c714880dccb03ed7952a3cf01bf24a7c17"
     },
     {
       "role": "no",