@lapxo/bound 0.2.3 → 0.2.4

package/dist/observe/run.js

@@ -1,3 +1,4 @@
+import { hostOutput } from "../host/call-context.js";
 import { boundedProcess } from "../host/process-lifetime.js";
 import { spawnSync } from 'node:child_process';
 import { existsSync } from 'node:fs';
@@ -31,7 +32,7 @@ export function runReader(module, root, inputs, limits) {
     if (ran.status !== 0)
         throw new Error(`${module}: reader exited ${ran.status ?? `with signal ${ran.signal}`}\n${ran.stderr ?? ''}${ran.stdout ?? ''}`);
     if (ran.stderr)
-        process.stderr.write(ran.stderr);
+        hostOutput('error', ran.stderr);
     return responsesOf(ran.stdout ?? '', inputs.length).map((answer) => {
         if (answer.kind !== 'fact')
             throw new Error(`REFUSE·reader ${module} · ${answer.why ?? 'no reading answered'}`);

package/dist/observe/runner.js

@@ -1,3 +1,4 @@
+import { hostInstrumentRuntime } from "../host/call-context.js";
 import { spawnSync } from 'node:child_process';
 import { sha } from "../host/hash.js";
 import { existsSync, mkdirSync, realpathSync, rmSync, statSync, writeFileSync } from 'node:fs';
@@ -10,17 +11,21 @@ import { landBlob } from "../land/ledger.js";
 import { EXTENSION, LOCK, publicLock } from '@lapxo/topos/wire';
 import { foldClaims, isWire } from "../fold/claims.js";
 const self = () => process.argv[1] ?? '';
-const fromBlob = () => extname(existsSync(self()) ? realpathSync(self()) : self()) === '';
+const fromBlob = () => hostInstrumentRuntime() !== undefined ? false : extname(existsSync(self()) ? realpathSync(self()) : self()) === '';
 /**
  * Where the instrument lies and what it is run from: from source or compiled modules, bound is two steps above this runner module; as a blob, the command is a blob of the tree's store, named by the digest bound's own lock names for
  * it, and bound lies beside that store. Other processes use the same runtime directory and extension; only source readers receive source conditions. A name that resolves to no blob beside it is refused by name
  * before anything is started, never handed to the runtime as the store's own directory.
  */
 // Blob bundles have no module URL; source and compiled modules carry their own entry location.
-const moduleAt = fromBlob() ? undefined : fileURLToPath(import.meta.url);
-const runtimeAt = moduleAt === undefined ? '' : resolve(dirname(moduleAt), '..');
-const runtimeExtension = moduleAt === undefined ? '' : extname(moduleAt);
-export const ownRoot = () => (fromBlob() ? join(resolve(dirname(self()), '..', '..', '..'), 'bound') : resolve(runtimeAt, '..'));
+// Native library imports do not inspect the embedding application's argv.
+// The CLI discovers its default runtime only when a CLI operation requests it.
+const moduleAt = () => fromBlob() ? undefined : fileURLToPath(import.meta.url);
+const runtimeAt = () => { const explicit = hostInstrumentRuntime(); if (explicit)
+    return explicit.directory; const at = moduleAt(); return at === undefined ? '' : resolve(dirname(at), '..'); };
+const runtimeExtension = () => { const explicit = hostInstrumentRuntime(); if (explicit)
+    return explicit.extension; const at = moduleAt(); return at === undefined ? '' : extname(at); };
+export const ownRoot = () => hostInstrumentRuntime()?.root ?? (fromBlob() ? join(resolve(dirname(self()), '..', '..', '..'), 'bound') : resolve(runtimeAt(), '..'));
 /** A published instrument carries its own content store even before any ledger
  * exists. Public-lock recognition grants no authority; legacy signed delivery
  * trees retain their historical colocated-ledger or sibling-store layout. */
@@ -34,6 +39,9 @@ export const ownStore = () => instrumentStoreAt(ownRoot());
 // An act is judged by the instrument it started with, even when that act changes its colocated lock.
 let instrumentLock;
 export const ownLock = () => {
+    const explicit = hostInstrumentRuntime();
+    if (explicit)
+        return explicit.lock;
     if (instrumentLock !== undefined)
         return instrumentLock;
     const lines = (observeText(join(ownRoot(), LOCK)) ?? '').split('\n').filter(isWire);
@@ -43,10 +51,10 @@ export const ownLock = () => {
         : foldClaims(published).standing;
     return instrumentLock;
 };
-export const sourceOf = () => (fromBlob() ? join(ownRoot(), 'src', 'cli', 'verb.ts') : self());
+export const sourceOf = () => hostInstrumentRuntime()?.entry ?? (fromBlob() ? join(ownRoot(), 'src', 'cli', 'verb.ts') : self());
 export function processOf(name, folder) {
     if (!fromBlob())
-        return join(runtimeAt, folder ?? 'cli', `${name}${runtimeExtension}`);
+        return join(runtimeAt(), folder ?? 'cli', `${name}${runtimeExtension()}`);
     const named = ownLock().find((line) => fieldOf(line, 'scope') === `runner/${name}`);
     const blob = fieldOf(named ?? '', 'value').replace(/^[^:]*:/, '');
     if (!blob || !existsSync(join(dirname(self()), blob))) {
@@ -87,7 +95,7 @@ export function bundleOf(module) {
 }
 /** A reader run by a blob is a blob itself: its bundle, with everything it imports but the compiler. */
 export function readerOf(module) {
-    const source = { path: module, flags: runtimeExtension === '.ts' ? ['--disable-warning=ExperimentalWarning', '--disable-warning=MODULE_TYPELESS_PACKAGE_JSON'] : [] };
+    const source = { path: module, flags: runtimeExtension() === '.ts' ? ['--disable-warning=ExperimentalWarning', '--disable-warning=MODULE_TYPELESS_PACKAGE_JSON'] : [] };
     const hex = fromBlob() ? bundleOf(module) : undefined;
     return hex === undefined ? source : { path: join(ownStore(), 'cas', 'blobs', hex), flags: [] };
 }

package/docs/contracts/native-host.md

@@ -0,0 +1,21 @@
+# Native in-process host
+
+The public `@lapxo/bound/host` entry offers authenticated Root and contextual standing reads, Root-lot and contextual-act admission, historical recovery, and explicit native instrument and receiver adapters. Node is required for this native host. The pure `/engine` and reference backends retain their separate contracts.
+
+## Classic Root lot
+
+`landRootLotInProcess(context, ports)` accepts LF-framed, canonical, unsigned target configuration records. The receiver supplies the admitted place, exact history snapshot, implementation runtime, reading identity, byte/record/time bounds, content port and canonical-line signer. The lot cannot choose those capabilities. It calls the same admission judges and atomic result implementation as the CLI; a signed line is not automatically an admitted line.
+
+The snapshot is checked before acquisition and before admission. Coverage is checked before invoking the signer. A change while signing refuses instead of rebasing. A fresh repeated held lot does not acquire another signature. `rootLotSnapshot` names complete admission history; it is not a signature or permission.
+
+## Effects and recovery
+
+Cancellation before visibility leaves no partial act. A publication error whose visibility is unknown returns `uncertain` with the native act identity. A failure after commit retains that identity and reports incomplete conformance, not rollback. `recoverRootActInProcess` authenticates the historical result without signing or reviving current grants. Root and contextual admission remain distinct operations; the latter consumes already signed contextual originals and acquires receiver receipts.
+
+The host selects context explicitly on every call. Calls do not interpret consumer argv or print to its console. Diagnostics are bounded returned data. Native storage shares the CLI exclusion protocol. Returned reading commitments are unsigned data and do not pay release demands.
+
+## Public quartet
+
+The two positive places are a seed accession library and a coastal tide survey. Each installs the public host boundary, bootstraps disposable fixture authority through the real CLI, admits a domain-specific Root lot, compares native result recovery and repeats the held lot without signing again. Negatives alter bytes, remove signer coverage, cancel before commit and offer a noncanonical lot; no negative may create a visible act. Test keys are created only for the disposable fixture, never shipped.
+
+The executable vector captures the instrument output. The quartet proves this declared public boundary; it does not certify all remaining host views, another machine, a release policy or an owner admission. Head, browser hosts, algebra, wire and ceilings are outside this change.

package/docs/contracts/native-host.publication.json

@@ -0,0 +1,25 @@
+{
+  "scope": "contract/published/native-host",
+  "members": [
+    {
+      "role": "contract",
+      "path": "docs/contracts/native-host.md",
+      "digest": "sha256:e7821cd2641caa4725aa20095027d903693756a8568a2163a79d7bb665b7643b"
+    },
+    {
+      "role": "yes",
+      "path": "samples/native-host/yes.json",
+      "digest": "sha256:6c02edaea00db315e20b15f96b281cf605db2c7499f3d1b9839096a704492c44"
+    },
+    {
+      "role": "vector",
+      "path": "vectors/native/native-host.vector.json",
+      "digest": "sha256:b62d77a3de11d960657fa9e7b58d4e88c68d0c389d683937bba4fa6c04a9d952"
+    },
+    {
+      "role": "no",
+      "path": "samples/native-host/no.json",
+      "digest": "sha256:27f323ca2a0d1547197e6beab3427bdcda45c0318fac52bc58b2b0164a2df38d"
+    }
+  ]
+}

package/docs/contracts/native-publication.inventory.json

@@ -9,6 +9,7 @@
     "contract/published/standing",
     "contract/published/refusals",
     "contract/published/host-ports",
-    "contract/published/readme"
+    "contract/published/readme",
+    "contract/published/native-host"
   ]
 }

package/docs/contracts/publication.inventory.json

@@ -0,0 +1,29 @@
+{
+  "profile": "quartet-process@1",
+  "scope": "contract/published",
+  "surface": [
+    "contract/published/attest-evidence-view",
+    "contract/published/cli/fold",
+    "contract/published/cli/land",
+    "contract/published/cli/sign",
+    "contract/published/pipeline/archive",
+    "contract/published/typed-object-sample",
+    "contract/published/view/card",
+    "contract/published/view/citation-file",
+    "contract/published/view/explanation",
+    "contract/published/view/guide",
+    "contract/published/view/help",
+    "contract/published/view/lines",
+    "contract/published/view/manifest-render",
+    "contract/published/view/programs",
+    "contract/published/view/readme-historical",
+    "contract/published/view/receipts",
+    "contract/published/view/reference",
+    "contract/published/view/release-workflow-render",
+    "contract/published/view/tsconfig",
+    "contract/published/view/usage-profile",
+    "contract/published/view/walk",
+    "contract/published/view/why"
+  ],
+  "note": "Explicit public-surface inventory. A selected coordinate without a descriptor is unpaid. Outstanding capability demands are not advertised implementations."
+}

package/docs/guide.md

@@ -0,0 +1,10 @@
+## First session
+
+1. fold --as readme --check prints SAME when that page's cone did not move.
+2. the digest at zero
+3. fold --as help prints the three verbs and no fourth.
+4. Land the batch with the key that covers it.
+5. Write the line as by=target.
+6. the lines at eight
+7. Preview with fold --as before it lands.
+8. the regions at one

package/docs/reference.md

@@ -0,0 +1,39 @@
+**line** — the lock a place is bound by, and the fold that reads it
+
+| | |
+|---|---|
+| pin | closure-delivery |
+| pin | ep-closure-reader |
+| pin | native-publication |
+| pin | process-readings |
+| pin | programs |
+| pin | prose-render |
+| pin | publication-additions |
+| pin | publication-readings |
+| pin | published-dependencies |
+| pin | rendering |
+| pin | source-readings |
+| pin | wire |
+
+- [closure-delivery](contracts/closure-delivery.md)
+- [archive](contracts/archive.md)
+- [cli](contracts/cli.md)
+- [documents](contracts/documents.md)
+- [engine](contracts/engine.md)
+- [evidence-view](contracts/evidence-view.md)
+- [host-ports](contracts/host-ports.md)
+- [reference-backend](contracts/reference-backend.md)
+- [reference-export](contracts/reference-export.md)
+- [refusals](contracts/refusals.md)
+- [standing](contracts/standing.md)
+- [typed-object](contracts/typed-object.md)
+- [views](contracts/views.md)
+- [view-walk](contracts/view-walk.md)
+- [why](why.md)
+- [guide](guide.md)
+- [native-host](contracts/native-host.md)
+- [publication](contracts/publication.md)
+- [README](../README.md)
+- [reference](reference.md)
+- [reference-port](contracts/reference-port.md)
+- [usage](usage.md)

package/docs/why.md

@@ -0,0 +1,109 @@
+## How Bound reads a project
+
+Bound reads a project's admitted statements and observations through its selected Topos, then renders the declared views and records their inputs in receipts. The example below explains the object; a file-fold alone does not calculate its intervals.
+
+## Use Bound in a project
+
+From a project with an admitted lock and selected views, inspect its standing, ask for its evidence, then verify the committed outputs:
+
+```sh
+npx @lapxo/bound@0.1.8 fold --as lines
+npx @lapxo/bound@0.1.8 fold --as receipts@1
+npx @lapxo/bound@0.1.8 fold --check
+```
+
+Use this flow to review a project change or check a dependency's declared contract. `--check` verifies existing evidence; it does not execute a missing reading. A file fold names readings and explicitly says that it computed no encounters.
+
+Independent observations are judged through the declared typed cells view. The selected topos supplies the form, origin evidence and bounds. Bound keeps attribution and exact-ID withdrawals through the fold.
+
+A selected form can instead describe a set of artifacts, a delivery interval or another domain's values. The project declares the form, origin evidence and views; Bound does not infer them from filenames or units.
+
+
+## A meeting everyone can understand
+
+Ana is available from 10 to 14, Luis from 12 to 16, and the room from 10 to 13. Their common availability is 12 to 13. A boss available from 18 to 20 makes the encounter incompatible. Withdrawing that exact reading restores the overlap; Ana, Luis and the room remain.
+
+With an interval form, those are object operations: observe independent claims, meet them, withdraw by id, and read the state. A narrower compatible meet is not a fork. Folding a file of declarations alone does not calculate meeting availability.
+
+The same pattern applies to a delivery window, a sensor's allowed range, or an agreed performance budget. The chosen topos determines the units and how evidence is obtained. Bound does not supply a meeting-specific rule.
+
+## See how information holds together
+
+![Cells, travelling bounds and a local join](https://raw.githubusercontent.com/Lapxo/bound/2053bb6d6188f04538114eae6a0add5166944ed3/docs/readme-assets/atlas.svg)
+
+A travelling ceiling on B reaches C and G through their declared rest. A local join widens B alone. D is independent. The figure shows those relations; point size and camera distance do not measure information.
+
+| State | Meaning |
+| --- | --- |
+| REQUIRED | Compatible bounds, fewer than two independent origins. |
+| FREE | Independent origins meet and their encounter fits the bounds. |
+| CONFLICT | Bounds conflict, or eligible claims have no common encounter. |
+| FORBIDDEN | An inhabited encounter does not fit the bounds. |
+
+Bounds are checked before origins and claims. A receipt is evidence of a reading, not another origin. Duplicating one does not add freedom.
+
+## Change a project without erasing evidence
+
+Work in the project's directory. Use an existing admitted key identifier and its matching private key stored outside every repository. The admitted key also names its signer with `keys/<who> measure=signer value=file`; `signer/timeout` and `signer/response-bytes` declare its limits. Your public key and coverage belong to the authority contract; possession of a private key alone does not authorize a scope.
+
+```sh
+export BOUND_KEY_ID='your-admitted-key-id'
+export BOUND_KEY_FILE="$HOME/Private/keys/your-device.pem"
+lot_dir="$(mktemp -d)"
+```
+
+Have the selected view produce a proposal at `$lot_dir/proposal.bound`, or prepare the project's permitted lines there for review. Unsigned proposals use `by=target`, without a preassigned epoch or `sig`. Lots stay outside the repository; the committed bound files are only `TARGET.bound` and `receipts.bound`.
+
+```sh
+npx @lapxo/bound@0.1.8 sign "$lot_dir/proposal.bound" \
+  --key "$BOUND_KEY_ID" --key-file "$BOUND_KEY_FILE" \
+  > "$lot_dir/signed.bound" &&
+npx @lapxo/bound@0.1.8 land "$lot_dir/signed.bound" &&
+npx @lapxo/bound@0.1.8 fold
+```
+
+`sign` assigns the admitted epoch and writes the signed lot to stdout. `land` validates the whole lot before admission. A refusal is evidence to inspect; it is not success. Do not proceed after a failed signature or admission. The key file is a PKCS8 private key matching the admitted public key; do not put it in the lot, source tree, package or CI artifacts.
+
+For typed object withdrawals, `takes` names the exact claim or mark id. Removing a local join leaves the travelling sign live. For untyped configuration, use the wire's exact withdrawal selectors; do not combine withdrawal and replacement with identical selectors in one lot. Wire alphabet updates supersede by epoch.
+
+[Authority, withdrawals, receipts and PR review](https://github.com/Lapxo/bound/blob/2053bb6d6188f04538114eae6a0add5166944ed3/docs/usage.md).
+
+## Select a topos by what it declares
+
+`sources/<name>` says where a world can be obtained. An admitted `uses/<name>` names the digest of that topos's folded standing: canonical live claims in wire byte order, excluding signature envelopes and host shape. Re-signing the same standing preserves the pin. A changed live form, class, view or offer changes it.
+
+`restsOn` closes artifact bytes separately. A capsule is one offer. Forms, classes and views need no capsule merely to be selected. Runtime and packing do not define standing identity. npm dependency ranges remain package metadata; they are not standing pins.
+
+| Responsibility | Owner |
+| --- | --- |
+| Meet, state, live acts and rest | Obligations |
+| Wire, forms, classes, views and offer contracts | Topos |
+| Admission, folding and evidence | Bound |
+| Domain measurement and representation | Selected topos |
+| Storage, transport and execution | Host |
+
+Cell `restsOn` is the object's relation. Directory prefixes and file summaries are host coordinates, not object rest. Wire tokens are protocol constants, not organization, host, path or key literals.
+
+## Repository rules
+
+Commit `TARGET.bound`, `receipts.bound` and the outputs the forge reads. Ignore `.bound/` from the first line of `.gitignore`. Keep proposals, signed lots, keys, ledgers, caches and dependency blobs outside the published tree.
+
+The lock is the project's own contract and pins. Read a dependency's declarations from its selected standing; do not copy its lines into your lock. README, package metadata and workflows must be renders of admitted declarations. A scan is an observation, not permission to lower a ceiling.
+
+A PR proposes lines and the leaf changes they render. The judge uses the team's accepted contract independently of the proposed revision. Preserve refusals, conflicting origins and unpaid demands. [Repository and contribution rules](https://github.com/Lapxo/bound/blob/2053bb6d6188f04538114eae6a0add5166944ed3/docs/usage.md#repository-and-pr-review).
+
+## An atlas you can question
+
+Information can share a history without sharing a single presentation. The same admitted cells can support a compact status view, a spatial view of their relations, or a focused reading of one disagreement. Each view asks for a region and resolution; its selected topos determines the representation.
+
+This makes changes inspectable. A local act can remain local, travelling bounds can reach dependent cells, and a receipt can name the inputs of the reading you saw. You can ask what changed and what depends on it without turning a drawing into the algebra.
+
+A pin names standing, not a download URL or runtime entry. Its declared artifact dependencies close the bytes needed for an offered operation. The boundary lets a form or view remain meaningful even when it has no executable capsule.
+
+Use Bound where independently attributed observations must be judged against an accepted contract: compatibility between components, operational limits, or a team's project requirements. The selected topos must supply the actual measurements; a digest identifies the evidence without declaring it true.
+
+[Contribute a counterexample or a proposed lot](CONTRIBUTING.md).
+
+## Foundations and related libraries
+
+The two-sided constraint object is described in Nahum Ochoa's [Two-Sided Constraints on a Valued Lattice](https://doi.org/10.5281/zenodo.21858428), DOI `10.5281/zenodo.21858428`. Bound uses the object through [Obligations](https://github.com/Lapxo/obligations); [Topos](https://github.com/Lapxo/topos) supplies the wire and contracts for forms, views and selected worlds. Bound admits, folds and retains evidence across those declared boundaries. A digest identifies bytes; it does not certify that an observation is true.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@lapxo/bound",
-  "version": "0.2.3",
+  "version": "0.2.4",
   "type": "module",
   "description": "Read the bounds you already wrote, fold them, and name the contradictions.",
   "main": "dist/cli/verb.js",
@@ -32,6 +32,10 @@
     "./closure/native": {
       "types": "./dist/host/native/module-delivery.d.ts",
       "default": "./dist/host/native/module-delivery.js"
+    },
+    "./host": {
+      "types": "./dist/host/index.d.ts",
+      "default": "./dist/host/index.js"
     }
   },
   "scripts": {
@@ -174,7 +178,33 @@
     "docs/contracts/closure-delivery.publication.json",
     "samples/module-delivery/inputs/delivery.json",
     "samples/no/module-delivery/delivery.json",
-    "vectors/native/module-delivery.vector.json"
+    "vectors/native/module-delivery.vector.json",
+    "dist/host/index.d.ts",
+    "dist/host/in-process.d.ts",
+    "dist/host/in-process-context.d.ts",
+    "dist/host/in-process-act.d.ts",
+    "dist/host/in-process-root.d.ts",
+    "dist/host/native-receiver.d.ts",
+    "dist/host/call-context.d.ts",
+    "dist/host/ports/place-act.d.ts",
+    "dist/host/place-act-transaction.d.ts",
+    "dist/host/ports/publication.d.ts",
+    "dist/host/root-clock-source.d.ts",
+    "dist/fold/claims.d.ts",
+    "dist/host/ports/local-act.d.ts",
+    "dist/host/place-clock-selection.d.ts",
+    "dist/host/commit-result.d.ts",
+    "docs/contracts/native-host.publication.json",
+    "samples/native-host/yes.json",
+    "samples/native-host/no.json",
+    "vectors/native/native-host.vector.json",
+    ".github/workflows/release.yml",
+    ".github/workflows/test.yml",
+    "CITATION.cff",
+    "docs/contracts/publication.inventory.json",
+    "docs/guide.md",
+    "docs/reference.md",
+    "docs/why.md"
   ],
   "author": "Lapxo",
   "license": "MIT",