@lapxo/bound 0.2.2 → 0.2.4

package/dist/host/native/module-delivery.js

@@ -0,0 +1,151 @@
+import { posix } from 'node:path';
+import { sha256, isSha256 } from "../hash.js";
+import { archiveCoordinate } from "../archive.js";
+import { compareStrings as compare } from "../order.js";
+import { moduleClosures } from "./module-closure.js";
+export { moduleSnapshot } from "./module-closure.js";
+const fail = (why) => { throw Error('REFUSE·closure delivery ' + why); };
+const key = (identity, coordinate) => JSON.stringify([identity, coordinate]);
+const pathOf = (identity, coordinate) => {
+    if (!isSha256(identity))
+        return fail('snapshot identity is not SHA-256');
+    return 'modules/' + identity.slice(7) + '/' + coordinate;
+};
+const urlOf = (path) => './' + path.split('/').map(encodeURIComponent).join('/');
+const resourceLimits = (limits) => {
+    if (!limits || !Number.isSafeInteger(limits.members) || limits.members < 1 || !Number.isSafeInteger(limits.bytes) || limits.bytes < 1 || !Number.isSafeInteger(limits.responseBytes) || limits.responseBytes < 1)
+        fail('missing resources');
+    if (limits.signal?.aborted)
+        fail('cancelled');
+};
+/** The host selects already authenticated snapshots and resolution, never the
+ * offered program. This prepares unchanged ESM files, not a JS sandbox, signer,
+ * browser host or symbol-pruning bundler. Existing native/Acorn routes remain.
+ */
+export function deliverModuleClosure(needs, entries, library, limits, notices = []) {
+    resourceLimits(limits);
+    if (!Array.isArray(notices) || notices.length >= limits.members)
+        fail('notice resources');
+    let noticeBytes = 0;
+    const noticePaths = new Set();
+    const retainedNotices = notices.map(n => {
+        if (!n || typeof n.coordinate !== 'string' || archiveCoordinate(n.coordinate) !== n.coordinate || typeof n.source !== 'string' || !isSha256(n.digest) || sha256(n.source) !== n.digest || (noticeBytes += Buffer.byteLength(n.source)) >= limits.bytes)
+            fail('notice bytes/resources');
+        const path = 'notices/' + pathOf(n.snapshot, n.coordinate).slice('modules/'.length);
+        if (noticePaths.has(path))
+            fail('duplicate notice');
+        noticePaths.add(path);
+        return { snapshot: n.snapshot, coordinate: n.coordinate, digest: n.digest, path };
+    }).sort((a, b) => compare(a.path, b.path));
+    if (!Array.isArray(needs) || !needs.length || needs.length > limits.members || needs.some(n => typeof n !== 'string' || !n || Buffer.byteLength(n) > limits.bytes))
+        fail('missing/oversized needs');
+    const requested = [...new Set(needs)].sort(compare), snapshots = new Map(), bindings = new Map();
+    const hold = (one) => {
+        if (!one || !isSha256(one.identity))
+            return fail('snapshot identity is not SHA-256');
+        const old = snapshots.get(one.identity);
+        // Different entry points may share one immutable snapshot, not different members.
+        if (old && old.members !== one.members)
+            fail('ambiguous snapshot members');
+        snapshots.set(one.identity, one);
+        return one;
+    };
+    const roots = requested.map(name => { const one = entries.get(name); if (!one)
+        return fail('unknown need ' + name); return hold(one); });
+    const reached = moduleClosures(roots, (specifier, parent) => {
+        const found = library(specifier, parent);
+        if (!found)
+            return;
+        const one = hold(found), at = key(parent.identity, specifier), binding = { parent: parent.identity, specifier, snapshot: one.identity, entry: one.entry }, old = bindings.get(at);
+        if (old && (old.snapshot !== one.identity || old.entry !== one.entry))
+            fail('ambiguous library resolution');
+        if (!old && bindings.size >= limits.members)
+            fail('library resources');
+        bindings.set(at, binding);
+        return one;
+    }, { ...limits, members: limits.members - notices.length, bytes: limits.bytes - noticeBytes, portableESM: true });
+    if (notices.some(n => !reached.some(r => r.snapshot === n.snapshot)))
+        fail('notice outside reached snapshots');
+    const modules = [...reached].sort((a, b) => compare(key(a.snapshot, a.coordinate), key(b.snapshot, b.coordinate))).map(r => ({ ...r, path: pathOf(r.snapshot, r.coordinate) }));
+    const files = modules.map(r => {
+        const source = snapshots.get(r.snapshot)?.members.get(r.coordinate)?.source;
+        if (source === undefined || sha256(source) !== r.digest)
+            fail('snapshot changed during delivery');
+        return { path: r.path, source: source };
+    });
+    for (const n of retainedNotices)
+        files.push({ path: n.path, source: notices.find(one => one.snapshot === n.snapshot && one.coordinate === n.coordinate).source });
+    const manifest = { format: 'esm-file-closure/1', needs: requested.map((name, i) => ({ name, snapshot: roots[i].identity, entry: posix.normalize(roots[i].entry) })), modules, libraries: [...bindings.values()].sort((a, b) => compare(key(a.parent, a.specifier), key(b.parent, b.specifier))), notices: retainedNotices };
+    const closure = sha256(JSON.stringify(manifest));
+    const bytes = Buffer.from(JSON.stringify({ manifest, files }), 'utf8');
+    if (bytes.length > limits.responseBytes)
+        fail('response resources');
+    if (limits.signal?.aborted)
+        fail('cancelled');
+    const imports = Object.fromEntries(manifest.needs.map(n => [n.name, urlOf(pathOf(n.snapshot, n.entry))]));
+    const scopes = {};
+    for (const b of manifest.libraries) {
+        const scope = './modules/' + b.parent.slice(7) + '/';
+        const values = scopes[scope] ?? (scopes[scope] = Object.create(null));
+        values[b.specifier] = urlOf(pathOf(b.snapshot, posix.normalize(b.entry)));
+    }
+    return { closure, digest: sha256(bytes), bytes: new Uint8Array(bytes), manifest, files, importMap: { imports, scopes } };
+}
+/** Verify exact pinned delivery bytes and run the same pre-execution closure
+ * verifier again over the delivered set. No callbacks, install paths or verifier
+ * chosen by the payload. The returned import map is derived, never trusted input.
+ */
+export function verifyModuleDelivery(bytes, expected, limits) {
+    resourceLimits(limits);
+    if (!(bytes instanceof Uint8Array) || bytes.byteLength > limits.responseBytes || !isSha256(expected) || sha256(bytes) !== expected)
+        fail('bundle bytes differ or exceed resources');
+    let value;
+    try {
+        value = JSON.parse(new TextDecoder('utf-8', { fatal: true }).decode(bytes));
+    }
+    catch {
+        return fail('invalid JSON bytes');
+    }
+    const manifest = value?.manifest;
+    if (manifest?.format !== 'esm-file-closure/1' || !Array.isArray(manifest.needs) || !Array.isArray(manifest.modules) || !Array.isArray(manifest.libraries) || !Array.isArray(manifest.notices) || !Array.isArray(value.files) || manifest.modules.length + manifest.notices.length > limits.members || value.files.length !== manifest.modules.length + manifest.notices.length || manifest.needs.length > limits.members || manifest.libraries.length > limits.members)
+        fail('invalid manifest resources');
+    const snapshots = new Map(), files = new Map();
+    let size = 0;
+    for (const file of value.files) {
+        if (typeof file?.path !== 'string' || typeof file.source !== 'string' || files.has(file.path) || (size += Buffer.byteLength(file.source)) > limits.bytes)
+            fail('invalid/duplicate file resources');
+        files.set(file.path, file.source);
+    }
+    for (const m of manifest.modules) {
+        if (!m || typeof m.coordinate !== 'string' || typeof m.path !== 'string' || m.path !== pathOf(m.snapshot, m.coordinate) || !isSha256(m.digest))
+            fail('invalid module');
+        const source = files.get(m.path);
+        if (source === undefined || sha256(source) !== m.digest)
+            fail('module bytes differ');
+        const members = snapshots.get(m.snapshot) ?? new Map();
+        if (members.has(m.coordinate))
+            fail('duplicate module');
+        members.set(m.coordinate, { source, digest: m.digest });
+        snapshots.set(m.snapshot, members);
+    }
+    const snapshot = (identity, entry) => { const members = snapshots.get(identity); if (!members || typeof entry !== 'string')
+        return fail('unknown snapshot/entry'); return { identity, entry, members }; };
+    const entries = new Map();
+    for (const n of manifest.needs) {
+        if (typeof n?.name !== 'string' || entries.has(n.name))
+            fail('invalid/duplicate need');
+        entries.set(n.name, snapshot(n.snapshot, n.entry));
+    }
+    const bindings = new Map();
+    for (const b of manifest.libraries) {
+        if (typeof b?.parent !== 'string' || typeof b.specifier !== 'string' || bindings.has(key(b.parent, b.specifier)))
+            fail('invalid/duplicate library');
+        bindings.set(key(b.parent, b.specifier), snapshot(b.snapshot, b.entry));
+    }
+    const notices = manifest.notices.map(n => { if (!n || typeof n.path !== 'string' || !files.has(n.path))
+        return fail('missing notice'); return { snapshot: n.snapshot, coordinate: n.coordinate, digest: n.digest, source: files.get(n.path) }; });
+    const prepared = deliverModuleClosure([...entries.keys()], entries, (specifier, parent) => bindings.get(key(parent.identity, specifier)), limits, notices);
+    if (prepared.digest !== expected)
+        fail('noncanonical, extra or unresolved delivery members');
+    return prepared;
+}

package/dist/host/native/module-syntax.js

@@ -7,7 +7,7 @@ const require = nodeModule.createRequire(import.meta.url);
 const { parse } = require('acorn');
 const stripTypeScriptTypes = nodeModule.stripTypeScriptTypes;
 /** Syntax inventory is not an execution-closure certificate: unresolved expressions stay explicit. */
-export function moduleImportSyntax(source, coordinate) {
+export function moduleImportSyntax(source, coordinate, options) {
     const code = extname(coordinate) === '.ts' ? stripTypeScriptTypes(source, { mode: 'transform' }) : source;
     let tree;
     try {
@@ -48,6 +48,8 @@ export function moduleImportSyntax(source, coordinate) {
         if (n['type'] === 'CallExpression') {
             const callee = n['callee'];
             if (callee?.['type'] === 'Identifier' && callee['name'] === 'require') {
+                if (options?.esmOnly)
+                    throw Error('REFUSE·module closure CommonJS load in ESM delivery ' + coordinate);
                 specifier = literal(n['arguments'][0]);
                 if (specifier === undefined)
                     unresolved.add('require expression at ' + String(n['start']));

package/dist/host/native-receiver.d.ts

@@ -0,0 +1,19 @@
+import { type HostInstrumentRuntime } from './call-context.ts';
+export interface NativeHostInstrument {
+    readonly name: string;
+    readonly runtime: HostInstrumentRuntime;
+}
+/** Explicit installed/source ESM selection, never consumer argv or packet data.
+ * Identity and public configuration do not certify implementation correctness. */
+export declare function nativeHostInstrument(root: string, entry: string): NativeHostInstrument;
+/** Bind existing native authority construction to an explicit instrument for
+ * every later current/historical observation, not only the constructor call. */
+export declare function nativePlaceActReceiver(root: string, instrument: NativeHostInstrument): {
+    selection: import("./place-clock-selection.ts").HostClockSelection;
+    trust: {
+        current: () => import("./ports/place-act.ts").PlaceActSnapshot;
+        historical: (encoded: string) => import("@lapxo/topos/wire").TrustedClockContract;
+        contract: import("@lapxo/topos/wire").TrustedClockContract;
+        initialHeads: readonly import("./ports/place-act.ts").PlaceActHead[];
+    };
+};

package/dist/host/native-receiver.js

@@ -0,0 +1,25 @@
+import { readFileSync, realpathSync } from 'node:fs';
+import { basename, dirname, extname, isAbsolute, join, relative } from 'node:path';
+import { publicLock } from '@lapxo/topos/wire';
+import { foldClaims, wireLinesOf } from "../fold/claims.js";
+import { declaredRootClockSource } from "./root-clock-source.js";
+import { withHostCall } from "./call-context.js";
+import { BoundRefusal } from "./refusals.js";
+/** Explicit installed/source ESM selection, never consumer argv or packet data.
+ * Identity and public configuration do not certify implementation correctness. */
+export function nativeHostInstrument(root, entry) {
+    const at = realpathSync(root), file = realpathSync(entry), inside = relative(at, file), extension = extname(file);
+    if (!isAbsolute(root) || !isAbsolute(entry) || inside.startsWith('..') || isAbsolute(inside) || !['.ts', '.js'].includes(extension))
+        throw new BoundRefusal('host/context', 'REFUSE·host/context');
+    const published = publicLock(wireLinesOf(readFileSync(join(at, 'TARGET.bound'), 'utf8')));
+    if (!published)
+        throw new BoundRefusal('host/context', 'REFUSE·host requires a public instrument lock');
+    return { name: basename(at), runtime: { root: at, entry: file, directory: dirname(dirname(file)), extension: extension, lock: foldClaims(published).standing } };
+}
+/** Bind existing native authority construction to an explicit instrument for
+ * every later current/historical observation, not only the constructor call. */
+export function nativePlaceActReceiver(root, instrument) {
+    const call = { instrumentName: instrument.name, runtime: structuredClone(instrument.runtime), output: () => { } };
+    const selected = withHostCall(call, () => declaredRootClockSource(root)), original = selected.trust;
+    return { selection: selected.selection, trust: { ...original, current: () => withHostCall(call, () => original.current()), historical: (encoded) => withHostCall(call, () => original.historical(encoded)) } };
+}

package/dist/host/order.js

@@ -0,0 +1,2 @@
+/** Locale-independent UTF-16 code-unit ordering, shared by host delivery formats. */
+export const compareStrings = (a, b) => a < b ? -1 : a > b ? 1 : 0;

package/dist/host/place-act-transaction.d.ts

@@ -0,0 +1,24 @@
+import { type PlaceReceipt } from '@lapxo/topos/core';
+import type { PlaceActTrust, PlaceActBudget, PlaceActBundle, PlaceActHead } from './ports/place-act.ts';
+export { ActCommitUnknown as PlaceActCommitUnknown } from './commit-result.ts';
+/** Host-selected persistence, never supplied by offered content. exclusive must
+ * share the CLI's region/authority/projection protocol. publish is synchronous
+ * with exactly one atomic visibility point; a thrown reply may follow commit. */
+export interface PlaceActPersistence {
+    readonly exclusive: <T>(regions: readonly string[], run: () => Promise<T>) => Promise<T>;
+    readonly result: (identity: string, trust: PlaceActTrust, limits: PlaceActBudget) => PlaceActBundle | undefined;
+    readonly inventory: (limits: PlaceActBudget) => {
+        readonly names: readonly string[];
+        readonly bytes: number;
+    };
+    readonly heads: (trust: PlaceActTrust, limits: PlaceActBudget) => readonly PlaceActHead[];
+    readonly publish: (identity: string, files: Readonly<Record<string, string>>) => void;
+}
+export type PlaceActReceiptSource = readonly PlaceReceipt[] | (() => Promise<readonly PlaceReceipt[]>);
+/** Shared transaction, including historical replay, current authorization and
+ * atomic publication. Signing may await; current Root and receiver heads are
+ * checked again afterwards while the same exclusion remains held. */
+export declare function transactPlaceAct(encoded: string, source: PlaceActReceiptSource, trust: PlaceActTrust, limits: PlaceActBudget, persistence: PlaceActPersistence, signal?: AbortSignal): Promise<PlaceActBundle & {
+    readonly kind: 'landed' | 'once';
+    readonly identity: string;
+}>;

package/dist/host/place-act-transaction.js

@@ -0,0 +1,78 @@
+import { readPlaceActContext, verifyPlaceActContext, placeActReceiptsOf } from '@lapxo/topos/core';
+import { requireEffects } from "./read-only.js";
+import { BoundRefusal } from "./refusals.js";
+import { ActCommitUnknown } from "./commit-result.js";
+import { assertHostNotCancelled as cancelled, receiverClock, placeRegionOf } from "./host-controls.js";
+export { ActCommitUnknown as PlaceActCommitUnknown } from "./commit-result.js";
+/** The visibility point may have happened. Only an authenticated result query
+ * or replay can resolve this; the error never asserts rollback. */
+const fail = (why) => { throw new BoundRefusal('host/act', 'REFUSE·place act ' + why); };
+const rootBytes = (r) => JSON.stringify([r.namespace, r.snapshot, r.epoch, r.prefix, r.head, r.policies]);
+/** Shared transaction, including historical replay, current authorization and
+ * atomic publication. Signing may await; current Root and receiver heads are
+ * checked again afterwards while the same exclusion remains held. */
+export async function transactPlaceAct(encoded, source, trust, limits, persistence, signal) {
+    requireEffects('place act commitment');
+    cancelled(signal);
+    if (!limits || !Number.isSafeInteger(limits.acts) || limits.acts < 1 || !Number.isSafeInteger(limits.bytes) || limits.bytes < 1)
+        fail('missing storage budget');
+    const decoded = readPlaceActContext(encoded, trust.contract.budget), id = trust.contract.digest(encoded);
+    const regions = decoded.places.map(p => placeRegionOf(p.place));
+    return persistence.exclusive(regions, async () => {
+        cancelled(signal);
+        const prior = persistence.result(id, trust, limits);
+        if (prior) {
+            if (prior.context !== encoded)
+                fail('replay bytes differ');
+            // A signing callback is never invoked for a historically authenticated replay.
+            if (typeof source !== 'function')
+                placeActReceiptsOf(encoded, source, trust.historical(encoded));
+            return { ...prior, identity: id, kind: 'once' };
+        }
+        const verified = verifyPlaceActContext(encoded, trust.contract);
+        const originals = decoded.places.map(p => p.records);
+        const capacity = (size) => {
+            const inventory = persistence.inventory(limits);
+            if (inventory.bytes + size > limits.bytes)
+                fail('publication byte budget');
+            if (inventory.names.length >= limits.acts)
+                fail('publication act budget');
+        };
+        const sizeOf = (files) => Object.values(files).reduce((n, v) => n + new TextEncoder().encode(v).length, 0);
+        capacity(sizeOf({ 'context.json': encoded, 'originals.json': JSON.stringify(originals) + '\n' }));
+        const assertCurrent = () => {
+            const current = trust.current();
+            if (rootBytes(current.root) !== rootBytes(verified.dependencies))
+                fail('authority changed before publication');
+            if (new Set(current.heads.map(h => h.place)).size !== current.heads.length)
+                fail('ambiguous receiver heads');
+            const stored = persistence.heads(trust, limits);
+            for (const p of decoded.places) {
+                const actual = stored.find(h => h.place === p.place), selected = current.heads.find(h => h.place === p.place);
+                if (!actual || !selected || actual.identity !== selected.identity || actual.epoch !== selected.epoch)
+                    fail('receiver snapshot is not committed head ' + p.place);
+                if (selected.identity !== p.previous)
+                    fail('receiver head moved ' + p.place);
+                const next = receiverClock(selected.epoch, fail) + 1;
+                if (!Number.isSafeInteger(next) || receiverClock(p.epoch, fail) !== next)
+                    fail('receiver epoch not next ' + p.place);
+            }
+        };
+        assertCurrent();
+        cancelled(signal);
+        const receipts = structuredClone(typeof source === 'function' ? await source() : source);
+        cancelled(signal);
+        placeActReceiptsOf(encoded, receipts, trust.contract);
+        const files = { 'context.json': encoded, 'receipts.json': JSON.stringify(receipts) + '\n', 'originals.json': JSON.stringify(originals) + '\n' };
+        capacity(sizeOf(files));
+        assertCurrent();
+        cancelled(signal);
+        try {
+            persistence.publish(id, files);
+        }
+        catch (error) {
+            throw new ActCommitUnknown(id, error);
+        }
+        return { context: encoded, receipts, originals, identity: id, kind: 'landed' };
+    });
+}

package/dist/host/place-clock-selection.d.ts

@@ -0,0 +1,55 @@
+import { PLACE_ACT_CONTEXT, type ClockBudget, type TrustedClockContract } from '@lapxo/topos/core';
+import { type Signer } from '@lapxo/topos/wire';
+import { type PlaceActTrust, type PlaceActBudget, type PlaceActHead } from './ports/place-act.ts';
+export interface HostClockSelection {
+    readonly profile: typeof PLACE_ACT_CONTEXT;
+    readonly namespace: string;
+    readonly regionFamily: string;
+    readonly receiptSigner: string;
+    readonly receiptScope: string;
+    readonly digestAlgorithm: 'sha256';
+    readonly budget: ClockBudget;
+    readonly storageBudget: PlaceActBudget;
+    readonly initial: readonly {
+        place: string;
+        receiver: {
+            identity: string;
+            epoch: string;
+        };
+        origin: {
+            prefix: string;
+            epoch: string;
+        };
+    }[];
+}
+export interface HostClockInput {
+    readonly store: string;
+    readonly selector: string;
+    readonly profileSelector: string;
+    readonly history: readonly string[];
+    readonly anchor: Signer;
+    readonly algorithms: readonly string[];
+    readonly legacyOriginals: readonly string[];
+    /** Actual protected Root authority cursor: an authenticated signed Root config
+     * checkpoint, never a sibling receipt/evidence max epoch. */
+    readonly authorityCheckpoint: string;
+    /** Fixed host historical predecessor proof, never taken from a packet. */
+    readonly authenticatedReceiverHeads?: readonly PlaceActHead[];
+    readonly readCurrent: () => Pick<HostClockInput, 'history' | 'anchor' | 'algorithms' | 'legacyOriginals' | 'authorityCheckpoint'>;
+    readonly resources: {
+        bytes: number;
+        lines: number;
+        places: number;
+    };
+    readonly inherited: {
+        clock: ClockBudget;
+        storage: PlaceActBudget;
+    };
+    readonly historical: (encoded: string) => TrustedClockContract;
+}
+/** Root chooses selector and anchors/resources from its authenticated standing.
+ * Selection must be ROOT signed; a world's signature grants no host capability. */
+export declare function hostClockSelection(input: HostClockInput): {
+    selection: HostClockSelection;
+    trust: PlaceActTrust;
+};

package/dist/host/place-clock-selection.js

@@ -4,7 +4,7 @@ import { createHash } from 'node:crypto';
 import { PLACE_ACT_CONTEXT } from '@lapxo/topos/core';
 import { canonical, signedBytes, wireAt } from '@lapxo/topos/wire';
 import { foldClaims, isConfig, fieldOf, parsedLine as parse } from "../fold/claims.js";
-import { eraOf } from "../fold/digests.js";
+import { signatureEraOf as eraOf } from "./signature-era.js";
 import { authorityFor } from "../fold/signers.js";
 import { verifyBytes } from "./adapters/keys/ed25519.js";
 import { verifiesOwnerLine } from "../land/sign.js";

package/dist/host/ports/local-act.d.ts

@@ -0,0 +1,44 @@
+import type { PublicationStorage } from './publication.ts';
+/** Prepared and verified by the selected Topos admission/result contract. */
+export interface LocalActBundle {
+    readonly records: string;
+    readonly receipt: string;
+    readonly placements?: readonly {
+        place: string;
+        records: string;
+    }[];
+}
+export type LocalActVerification = (identity: string, bundle: LocalActBundle) => boolean;
+export declare const actLines: (bytes: string) => readonly string[];
+/** Journal integrity is not authority. Signature/coverage checks remain the
+ * same admission boundary; the hash algorithm here is the stored seal's named
+ * algorithm, not a new selection of the place's wire.
+ */
+export declare function intactLocalAct(identity: string, bundle: LocalActBundle): boolean;
+/** Internal integrity key only, not an act identity or a wire profile. */
+export declare function committedInventoryFingerprint(rows: readonly {
+    identity: string;
+    bundle: LocalActBundle;
+}[]): string;
+/** Committed segments are part of this ledger, not a second authority source. */
+export declare function committedLocalActs(store: string): readonly {
+    identity: string;
+    bundle: LocalActBundle;
+}[];
+/** Fixed host observation only: one synchronous, coherent committed inventory.
+ * It supplies no authority, verifier or async lifetime. Each outer invocation
+ * rereads exact bodies before entering; current authorization still runs inside.
+ */
+export declare function withCommittedLocalActObservation<T>(store: string, body: () => T): T;
+/** A public result is available only as a verified committed pair.
+ * No writer-tail guess, newest-result selection or implicit authority.
+ */
+export declare function localActResult(store: string, identity: string, verify: LocalActVerification): LocalActBundle | undefined;
+/** One publication point for records and their native result. Re-delivery
+ * reads the original pair without preparation, signing or a new local epoch.
+ * The caller must also integrate this boundary into admission-history readers;
+ * this storage port alone does not activate a grammar or land authority.
+ */
+export declare function commitLocalAct(store: string, identity: string, regions: readonly string[], prepare: () => Promise<LocalActBundle>, verify: LocalActVerification, storage?: PublicationStorage, signal?: AbortSignal): Promise<LocalActBundle & {
+    readonly kind: 'landed' | 'once';
+}>;

package/dist/host/ports/local-act.js

@@ -1,4 +1,6 @@
 import { hashText } from "../hash.js";
+import { ActCommitUnknown } from "../commit-result.js";
+import { assertHostNotCancelled } from "../host-controls.js";
 import { existsSync, readFileSync, readdirSync } from 'node:fs';
 import { join } from 'node:path';
 import { createHash } from 'node:crypto';
@@ -154,19 +156,28 @@ export function localActResult(store, identity, verify) {
  * The caller must also integrate this boundary into admission-history readers;
  * this storage port alone does not activate a grammar or land authority.
  */
-export async function commitLocalAct(store, identity, regions, prepare, verify, storage = nativePublicationStorage) {
+export async function commitLocalAct(store, identity, regions, prepare, verify, storage = nativePublicationStorage, signal) {
     requireEffects('local act commitment');
+    assertHostNotCancelled(signal);
     return underTheRegions(store, regions, 'land', async () => {
+        assertHostNotCancelled(signal);
         const prior = localActResult(store, identity, verify);
         if (prior)
             return { kind: 'once', ...prior };
         const bundle = await prepare();
+        assertHostNotCancelled(signal);
         if (!bundle.records || !bundle.receipt || verify(identity, bundle) !== true)
             throw Error('REFUSE·act prepared result does not verify');
         const files = { 'records.bound': bundle.records, 'receipt.bound': bundle.receipt };
         for (const p of bundle.placements ?? [])
             files['place-' + encodeURIComponent(p.place) + '.bound'] = p.records;
-        publishBundle(atOf(store, identity), files, storage);
+        assertHostNotCancelled(signal);
+        try {
+            publishBundle(atOf(store, identity), files, storage);
+        }
+        catch (error) {
+            throw new ActCommitUnknown(identity, error);
+        }
         return { kind: 'landed', ...bundle };
     });
 }

package/dist/host/ports/place-act.d.ts

@@ -0,0 +1,49 @@
+import { type TrustedClockContract, type PlaceReceipt, type RootContext } from '@lapxo/topos/core';
+import { type PlaceActPersistence } from '../place-act-transaction.ts';
+import { type PublicationStorage } from './publication.ts';
+export interface PlaceActBudget {
+    readonly acts: number;
+    readonly bytes: number;
+}
+export interface PlaceActHead {
+    readonly place: string;
+    readonly identity: string;
+    readonly epoch: string;
+}
+export interface PlaceActSnapshot {
+    readonly root: RootContext;
+    readonly heads: readonly PlaceActHead[];
+}
+/** Fixed instrument construction, never supplied by world JSON. Historical
+ * authentication permits inspection only; current() is read under Root guards. */
+export interface PlaceActTrust {
+    readonly contract: TrustedClockContract;
+    readonly initialHeads: readonly PlaceActHead[];
+    readonly current: () => PlaceActSnapshot;
+    readonly historical: (encoded: string) => TrustedClockContract;
+}
+export interface PlaceActBundle {
+    readonly context: string;
+    readonly receipts: readonly PlaceReceipt[];
+    readonly originals: readonly (readonly string[])[];
+}
+/** Historical result reads never produce a current authorization permit. */
+export declare function placeActResult(store: string, id: string, trust: Pick<PlaceActTrust, 'historical'>, limits: PlaceActBudget): PlaceActBundle | undefined;
+/** Each receiver chain advances independently. Initial heads are explicit,
+ * authenticated host inputs, not inferred zero or legacy global epochs. */
+export declare function placeActHeads(store: string, initial: readonly PlaceActHead[], trust: Pick<PlaceActTrust, 'historical' | 'contract'>, limits: PlaceActBudget): readonly PlaceActHead[];
+/** Context, exact original bytes and complete signed receipts have one visibility
+ * point. Real Root guard exclusion spans final authority/head comparison and
+ * publication; this does not activate a CLI profile or reinterpret local-act@1. */
+/** Native persistence adapter. The transaction below is also the CLI path. */
+export declare function nativePlaceActPersistence(store: string, storage?: PublicationStorage): PlaceActPersistence;
+export declare function commitPlaceAct(store: string, encoded: string, receipts: readonly PlaceReceipt[], trust: PlaceActTrust, limits: PlaceActBudget, storage?: PublicationStorage): Promise<PlaceActBundle & {
+    readonly kind: "landed" | "once";
+    readonly identity: string;
+}>;
+/** Enumerates only committed, historically authenticated carriers. Namespace
+ * projection is a caller's separate pure operation, never current permission. */
+export declare function committedPlaceActResults(store: string, trust: Pick<PlaceActTrust, 'historical'>, limits: PlaceActBudget): readonly {
+    identity: string;
+    bundle: PlaceActBundle;
+}[];

package/dist/host/ports/place-act.js

@@ -1,13 +1,12 @@
 import { existsSync, readdirSync, statSync, openSync, fstatSync, readSync, closeSync } from 'node:fs';
 import { join } from 'node:path';
-import { readPlaceActContext, verifyPlaceActContext, placeActReceiptsOf } from '@lapxo/topos/core';
-import { underAuthorityRegions, underTheRegions, underRootProjection } from "../../land/act.js";
+import { readPlaceActContext, placeActReceiptsOf } from '@lapxo/topos/core';
+import { transactPlaceAct } from "../place-act-transaction.js";
+import { canonicalActStore, underAuthorityRegions, underTheRegions, underRootProjection } from "../../land/act.js";
 import { requireEffects } from "../read-only.js";
+import { receiverClock } from "../host-controls.js";
 import { publishBundle, nativePublicationStorage } from "./publication.js";
 const fail = (why) => { throw Error('REFUSE·place act ' + why); };
-const clock = (n) => { if (!/^(0|[1-9][0-9]*)$/.test(n) || !Number.isSafeInteger(Number(n)))
-    fail('unknown receiver clock'); return Number(n); };
-const rootBytes = (r) => JSON.stringify([r.namespace, r.snapshot, r.epoch, r.prefix, r.head, r.policies]);
 const budget = (b) => { if (!b || !Number.isSafeInteger(b.acts) || b.acts < 1 || !Number.isSafeInteger(b.bytes) || b.bytes < 1)
     fail('missing storage budget'); };
 const base = (store) => join(store, 'ledger', 'place-acts');
@@ -86,7 +85,7 @@ export function placeActHeads(store, initial, trust, limits) {
     budget(limits);
     if (!initial.length || new Set(initial.map(h => h.place)).size !== initial.length)
         fail('missing/ambiguous initial heads');
-    const heads = new Map(initial.map(h => { clock(h.epoch); if (!h.identity)
+    const heads = new Map(initial.map(h => { receiverClock(h.epoch, fail); if (!h.identity)
         fail('missing initial head'); return [h.place, { ...h }]; }));
     if (!existsSync(base(store)))
         return [...heads.values()];
@@ -100,8 +99,8 @@ export function placeActHeads(store, initial, trust, limits) {
         const act = pending.splice(next, 1)[0];
         for (const p of act.context.places) {
             const prior = heads.get(p.place);
-            const epoch = clock(prior.epoch) + 1;
-            if (!Number.isSafeInteger(epoch) || clock(p.epoch) !== epoch)
+            const epoch = receiverClock(prior.epoch, fail) + 1;
+            if (!Number.isSafeInteger(epoch) || receiverClock(p.epoch, fail) !== epoch)
                 fail('receiver chain clock mismatch');
             heads.set(p.place, { place: p.place, identity: act.id, epoch: p.epoch });
         }
@@ -111,54 +110,20 @@ export function placeActHeads(store, initial, trust, limits) {
 /** Context, exact original bytes and complete signed receipts have one visibility
  * point. Real Root guard exclusion spans final authority/head comparison and
  * publication; this does not activate a CLI profile or reinterpret local-act@1. */
+/** Native persistence adapter. The transaction below is also the CLI path. */
+export function nativePlaceActPersistence(store, storage = nativePublicationStorage) {
+    store = canonicalActStore(store);
+    return {
+        exclusive: (regions, run) => { const enter = regions.includes('') ? underTheRegions : underAuthorityRegions; return enter(store, regions, 'place act', () => underRootProjection(store, 'place act publication', run)); },
+        result: (identity, trust, limits) => placeActResult(store, identity, trust, limits),
+        inventory: limits => storedInventory(store, limits),
+        heads: (trust, limits) => placeActHeads(store, trust.initialHeads, trust, limits),
+        publish: (identity, files) => publishBundle(at(store, identity), files, storage),
+    };
+}
 export async function commitPlaceAct(store, encoded, receipts, trust, limits, storage = nativePublicationStorage) {
     requireEffects('place act commitment');
-    budget(limits);
-    const decoded = readPlaceActContext(encoded, trust.contract.budget), id = trust.contract.digest(encoded);
-    const regions = decoded.places.map(p => { if (p.place === '.')
-        return ''; const parts = p.place.split('/'); if (parts.length < 2 || parts.pop() !== 'TARGET.bound' || parts.some(s => s === '' || s === '.' || s === '..'))
-        fail('unknown place namespace'); return parts.join('/'); });
-    const enter = regions.includes('') ? underTheRegions : underAuthorityRegions;
-    return enter(store, regions, 'place act', () => underRootProjection(store, 'place act publication', () => {
-        const prior = placeActResult(store, id, trust, limits);
-        if (prior) {
-            if (prior.context !== encoded)
-                fail('replay bytes differ');
-            // Replay authenticates the supplied evidence too. Historical authentication
-            // grants no current authority and leaves the committed result unchanged.
-            placeActReceiptsOf(encoded, receipts, trust.historical(encoded));
-            return { ...prior, identity: id, kind: 'once' };
-        }
-        const verified = verifyPlaceActContext(encoded, trust.contract);
-        placeActReceiptsOf(encoded, receipts, trust.contract);
-        const originals = decoded.places.map(p => p.records), files = { 'context.json': encoded, 'receipts.json': JSON.stringify(receipts) + '\n', 'originals.json': JSON.stringify(originals) + '\n' };
-        const inventory = storedInventory(store, limits);
-        if (inventory.bytes + Object.values(files).reduce((n, v) => n + Buffer.byteLength(v), 0) > limits.bytes)
-            fail('publication byte budget');
-        if (inventory.names.length >= limits.acts)
-            fail('publication act budget');
-        const current = trust.current();
-        if (rootBytes(current.root) !== rootBytes(verified.dependencies))
-            fail('authority changed before publication');
-        if (new Set(current.heads.map(h => h.place)).size !== current.heads.length)
-            fail('ambiguous receiver heads');
-        const storedHeads = placeActHeads(store, trust.initialHeads, trust, limits);
-        for (const p of decoded.places) {
-            const actual = storedHeads.find(h => h.place === p.place), selected = current.heads.find(h => h.place === p.place);
-            if (!actual || !selected || actual.identity !== selected.identity || actual.epoch !== selected.epoch)
-                fail('receiver snapshot is not committed head ' + p.place);
-        }
-        for (const p of decoded.places) {
-            const head = current.heads.find(h => h.place === p.place) ?? fail('missing receiver head ' + p.place);
-            if (head.identity !== p.previous)
-                fail('receiver head moved ' + p.place);
-            const next = clock(head.epoch) + 1;
-            if (!Number.isSafeInteger(next) || clock(p.epoch) !== next)
-                fail('receiver epoch not next ' + p.place);
-        }
-        publishBundle(at(store, id), files, storage);
-        return { context: encoded, receipts, originals, identity: id, kind: 'landed' };
-    }));
+    return transactPlaceAct(encoded, receipts, trust, limits, nativePlaceActPersistence(store, storage));
 }
 /** Enumerates only committed, historically authenticated carriers. Namespace
  * projection is a caller's separate pure operation, never current permission. */

package/dist/host/ports/publication.d.ts

@@ -0,0 +1,10 @@
+export interface PublicationStorage {
+    publish(staged: string, committed: string): void;
+}
+export declare const nativePublicationStorage: PublicationStorage;
+/** Publish prepared bytes as one directory. No identity, grammar or authority
+ * is inferred here. Readers address the committed name, never staging files.
+ * A failure after rename is not evidence of rollback: the caller must retain
+ * the uncertainty and allow a verified read of the committed name.
+ */
+export declare function publishBundle(committed: string, files: Readonly<Record<string, string>>, storage?: PublicationStorage): void;