@lapxo/bound 0.2.4 → 0.2.5

package/docs/contracts/reading-identity.md

@@ -0,0 +1,37 @@
+# Public reading identity
+
+`prepareNativeReadingIdentity` from `@lapxo/bound/host` prepares the adopted input-projection readings of an authenticated place. `fold --as reading-identity` calls that same operation. This contract covers adopted input-projection readings; other reading forms refuse.
+
+The receiver supplies the place, explicit native instrument, optional adopted reader selector, finite resource limits and cancellation signal. The place must declare one interval `0..N` for each of `reading-identity/bytes`, `/files`, `/readings` and `/probes`. Caller limits can reduce these bounds. They count handed UTF-8 input bytes, handed files, projected reading plans and input-projection requests across the selected readers; native image, response and execution limits also remain in force. The projection request is a probe, even when its implementation reuses a valid result. It is separate from final reading execution.
+
+A fact contains preparations with ready reading identities or named unpaid receipt dependencies. Each ready entry gives its scope, canonical `reading-context@1` and digest. When a verified existing carrier is available it also gives the `reading-receipt@1` digest. A missing physical input produces `needs`; a dependent reading without its predecessor's verified receipt stays open. No complete digest is invented for an unpaid dependency. These names are supplied by the selected world's projection; application region names are not built into Bound.
+
+Preparation uses the same projection, dependency order, contextual framing, transitive instrument inputs, policy, effective environment and carrier verification as execution. It can run the declared input projection under its native port. It never runs the final reading, signs, admits an act, renders public receipts or renews a reading receipt. Operational image/cache maintenance is separate. A subsequent execution under identical inputs and context commits the same identity; preparation does not reserve that identity or authorize a future answer.
+
+Instrument, implementation, policy, transitive inputs and the actual environment participate under the existing Topos contracts. Current-answer authorization also retains the existing principal, grant, snapshot and freshness checks when that profile is selected. Retained evidence grants no current authority. Environment values are committed by digest, not exposed as secret strings. Receipt identity and typed-content identity remain distinct.
+
+Relevant input or dependency changes produce another identity. Unconsumed maintenance does not. Bytes stored under a digest must verify; altered selected bytes or carriers refuse rather than becoming an alternative identity. The existing execution path may recompute an invalid retained answer; public inspection refuses a corrupt carrier. Missing bytes and failed integrity are different outcomes.
+
+Refusals are typed data from the public API: `reading-identity/context`, `/budget`, `/selection`, `/projection`, `/integrity`, `/failed`, and the existing `host/context`, `/budget`, `/cancelled`. A non-projection reader is unsupported, not silently executed. Cancellation and handed-input budgets are checked before the projection; native process budgets remain authoritative during execution. Synchronous projection cannot observe a JavaScript abort callback while it occupies the host thread; its declared native timeout still bounds that work.
+
+## Quartet
+
+The native test forms two unrelated disposable admitted places, counts and catalogue. Counts reads a physical file. Catalogue adds a dependent aggregate. Both use receiver-selected native images and the real CLI; a separate consumer imports the compiled public `/host` export. Preparation leaves final reading receipts absent; execution commits the same identity; subsequent preparation verifies existing receipts without changing the public receipt file. Catalogue's aggregate is open until the leaf receipt exists.
+
+The negative places retain a receipt but withdraw the current native grant, and alter the archive bytes under their selected digest. Both refuse. Focused vectors also cover missing physical input, changed dependency, stale handed bytes, cancellation, resource exhaustion and unrelated maintenance. Existing environment, authority and descendant-receipt vectors remain applicable and are reused.
+
+Two places on this Mac do not establish another-machine portability. L6 stays pending. This quartet neither admits Root's new reader bindings nor certifies the full 0.2.5 release.
+
+## Native lines and evidence
+
+`prepareNativeViewIdentity({place, instrument, view, expectedIdentity?})` from `@lapxo/bound/host` prepares the local native `lines` or `evidence` projection. `fold --as reading-identity@lines` and `fold --as reading-identity@evidence` print its identity without the result text. `fold --as reading-identity@lines@<digest>` (or `reading-identity@evidence@<digest>`) returns JSON with `kind`, `view`, `identity` and `text`. The text and identity use the same captured inputs; an obsolete expected identity returns no result. Ordinary views keep their existing output and require no reading-identity budgets.
+
+This operation performs configuration authentication and projection, not the region fold, executable readings or source resolution. It takes no Root exclusion and performs no persistent writes. One synchronous committed-journal observation fixes native acts; selected legacy sources are captured by exact bytes and checked again. Changed committed inputs, selected bytes, effective environment or expiration day refuse rather than publishing a mixed result. No lease reserves a later answer: the caller supplies the expected identity when requesting the result.
+
+Identity commits the native view, local place, authenticated configuration, selected authority/evidence histories and source bytes (including selected receipt inputs), exact implementation closure and instrument lock, effective runtime/environment, and UTC expiration-policy day. Input names and values are framed; no consumer directory fingerprint is accepted. Unconsumed fold caches, stamp memos and exclusion bookkeeping do not participate. The local execution identity is distinct from portable semantic standing identity.
+
+The existing admitted preparation limits remain required for identity requests; inputs and implementation sources count against their byte/file budgets. Preparation does not execute projection probes or final readings. Only unqualified local native lines and a single unshaped native evidence view are supported. Foreign evidence needing an asynchronous transport snapshot and unsupported views refuse by name. No fallback executes their fold.
+
+Existing catalog codes apply: `reading-identity/selection` for unsupported selections, `reading-identity/context` for changed or mismatched snapshots, `reading-identity/budget` for missing/exhausted limits, and `reading-identity/failed` for unavailable implementation inputs. Public CLI machine records carry those codes.
+
+Seven native vectors cover repeated identity, added evidence, changed configuration, unchanged fold maintenance, distinct places, unsupported selections and identity-to-result binding with a stale refusal. Both unrelated places also answer while a Root writer holds exclusion; complete store comparison verifies no writes. Existing view/landing behavior without identity budgets is retained. These vectors do not establish L6.

package/docs/contracts/reading-identity.publication.json

@@ -0,0 +1,25 @@
+{
+  "scope": "contract/published/reading-identity",
+  "members": [
+    {
+      "role": "contract",
+      "path": "docs/contracts/reading-identity.md",
+      "digest": "sha256:0db77ff0553ea92ed4f47f587f1a026a59279c3a4abb00a662eefd5952e6de1c"
+    },
+    {
+      "role": "yes",
+      "path": "samples/reading-identity/yes.json",
+      "digest": "sha256:5b40b3546e99bf7c646a15fc04241400199b6130b5ff35c142d70a4f68bf12fb"
+    },
+    {
+      "role": "vector",
+      "path": "vectors/native/reading-identity.vector.json",
+      "digest": "sha256:42bac03e64bd525398e9843cb8e8a256c46041a0c22e0d6774f523b1b283cb9d"
+    },
+    {
+      "role": "no",
+      "path": "samples/reading-identity/no.json",
+      "digest": "sha256:77b63c1eb80a98e66d38cf357698166b178ae1d344939ec2bcaf74e5a2fd96c4"
+    }
+  ]
+}

package/docs/contracts/refusals.bound

@@ -92,3 +92,54 @@ bound-lock/1 at=policy:bound-host-ports by=target form=alphabet measure=next rol
 bound-lock/1 at=policy:bound-host-ports by=target form=alphabet measure=code role=writes scope=refusal/host-port/response value=host-port/response
 bound-lock/1 about="A host response has an unsupported shape or shared mutable bytes." at=policy:bound-host-ports by=target form=alphabet measure=class role=writes scope=refusal/host-port/response value=host
 bound-lock/1 at=policy:bound-host-ports by=target form=alphabet measure=next role=writes scope=refusal/host-port/response value=inspect-host-port
+bound-lock/1 at=policy:public-reading-identity by=target form=alphabet measure=code role=writes scope=refusal/reading-identity/context value=reading-identity/context
+bound-lock/1 about="The reading lacks its complete declared execution context." at=policy:public-reading-identity by=target form=alphabet measure=class role=writes scope=refusal/reading-identity/context value=interpretation
+bound-lock/1 at=policy:public-reading-identity by=target form=alphabet measure=next role=writes scope=refusal/reading-identity/context value=inspect-reading-context
+bound-lock/1 at=policy:public-reading-identity by=target form=alphabet measure=code role=writes scope=refusal/reading-identity/budget value=reading-identity/budget
+bound-lock/1 about="The place lacks one finite declared preparation limit." at=policy:public-reading-identity by=target form=alphabet measure=class role=writes scope=refusal/reading-identity/budget value=resource
+bound-lock/1 at=policy:public-reading-identity by=target form=alphabet measure=next role=writes scope=refusal/reading-identity/budget value=inspect-resource-lines
+bound-lock/1 at=policy:public-reading-identity by=target form=alphabet measure=code role=writes scope=refusal/reading-identity/selection value=reading-identity/selection
+bound-lock/1 about="The requested reader is not adopted by this place." at=policy:public-reading-identity by=target form=alphabet measure=class role=writes scope=refusal/reading-identity/selection value=interpretation
+bound-lock/1 at=policy:public-reading-identity by=target form=alphabet measure=next role=writes scope=refusal/reading-identity/selection value=inspect-reader-selection
+bound-lock/1 at=policy:public-reading-identity by=target form=alphabet measure=code role=writes scope=refusal/reading-identity/projection value=reading-identity/projection
+bound-lock/1 about="The adopted reader has no supported input projection." at=policy:public-reading-identity by=target form=alphabet measure=class role=writes scope=refusal/reading-identity/projection value=interpretation
+bound-lock/1 at=policy:public-reading-identity by=target form=alphabet measure=next role=writes scope=refusal/reading-identity/projection value=declare-input-projection
+bound-lock/1 at=policy:public-reading-identity by=target form=alphabet measure=code role=writes scope=refusal/reading-identity/integrity value=reading-identity/integrity
+bound-lock/1 about="Current input or retained carrier bytes differ from their committed bytes." at=policy:public-reading-identity by=target form=alphabet measure=class role=writes scope=refusal/reading-identity/integrity value=input
+bound-lock/1 at=policy:public-reading-identity by=target form=alphabet measure=next role=writes scope=refusal/reading-identity/integrity value=resolve-verified-bytes
+bound-lock/1 at=policy:public-reading-identity by=target form=alphabet measure=code role=writes scope=refusal/reading-identity/failed value=reading-identity/failed
+bound-lock/1 about="The existing native preparation boundary refused; the diagnostic retains its cause." at=policy:public-reading-identity by=target form=alphabet measure=class role=writes scope=refusal/reading-identity/failed value=operation
+bound-lock/1 at=policy:public-reading-identity by=target form=alphabet measure=next role=writes scope=refusal/reading-identity/failed value=inspect-native-diagnostic
+bound-lock/1 at=policy:bound/public-operations by=target form=alphabet measure=code role=writes scope=refusal/engine/input value=engine/input
+bound-lock/1 about="The object byte request is not a supported canonical profile." at=policy:bound/public-operations by=target form=alphabet measure=class role=writes scope=refusal/engine/input value=input
+bound-lock/1 at=policy:bound/public-operations by=target form=alphabet measure=next role=writes scope=refusal/engine/input value=inspect-request
+bound-lock/1 at=policy:bound/public-operations by=target form=alphabet measure=code role=writes scope=refusal/engine/context value=engine/context
+bound-lock/1 about="The receiver-selected context does not admit the requested object history." at=policy:bound/public-operations by=target form=alphabet measure=class role=writes scope=refusal/engine/context value=interpretation
+bound-lock/1 at=policy:bound/public-operations by=target form=alphabet measure=next role=writes scope=refusal/engine/context value=inspect-context
+bound-lock/1 at=policy:bound/public-operations by=target form=alphabet measure=code role=writes scope=refusal/computation/context value=computation/context
+bound-lock/1 about="The question, implementation, policy, input or result does not match the receiver-selected computation context." at=policy:bound/public-operations by=target form=alphabet measure=class role=writes scope=refusal/computation/context value=interpretation
+bound-lock/1 at=policy:bound/public-operations by=target form=alphabet measure=next role=writes scope=refusal/computation/context value=inspect-context
+bound-lock/1 at=policy:bound/public-operations by=target form=alphabet measure=code role=writes scope=refusal/computation/budget value=computation/budget
+bound-lock/1 about="The computation lacks or exceeds its declared byte or execution budget." at=policy:bound/public-operations by=target form=alphabet measure=class role=writes scope=refusal/computation/budget value=resource
+bound-lock/1 at=policy:bound/public-operations by=target form=alphabet measure=next role=writes scope=refusal/computation/budget value=inspect-resource-lines
+bound-lock/1 at=policy:bound/public-operations by=target form=alphabet measure=code role=writes scope=refusal/computation/signature value=computation/signature
+bound-lock/1 about="The computation signature does not verify with the receiver-selected signer." at=policy:bound/public-operations by=target form=alphabet measure=class role=writes scope=refusal/computation/signature value=authority
+bound-lock/1 at=policy:bound/public-operations by=target form=alphabet measure=next role=writes scope=refusal/computation/signature value=inspect-signer
+bound-lock/1 at=policy:bound/public-operations by=target form=alphabet measure=code role=writes scope=refusal/computation/authority value=computation/authority
+bound-lock/1 about="The selected computation signer is absent, retired or outside coverage." at=policy:bound/public-operations by=target form=alphabet measure=class role=writes scope=refusal/computation/authority value=authority
+bound-lock/1 at=policy:bound/public-operations by=target form=alphabet measure=next role=writes scope=refusal/computation/authority value=inspect-authority
+bound-lock/1 at=policy:bound/public-operations by=target form=alphabet measure=code role=writes scope=refusal/conformance/context value=conformance/context
+bound-lock/1 about="The receiver supplied missing or invalid suite, implementation or contract identities." at=policy:bound/public-operations by=target form=alphabet measure=class role=writes scope=refusal/conformance/context value=interpretation
+bound-lock/1 at=policy:bound/public-operations by=target form=alphabet measure=next role=writes scope=refusal/conformance/context value=inspect-context
+bound-lock/1 at=policy:bound/public-operations by=target form=alphabet measure=code role=writes scope=refusal/conformance/budget value=conformance/budget
+bound-lock/1 about="The suite exceeds its declared byte or case budget." at=policy:bound/public-operations by=target form=alphabet measure=class role=writes scope=refusal/conformance/budget value=resource
+bound-lock/1 at=policy:bound/public-operations by=target form=alphabet measure=next role=writes scope=refusal/conformance/budget value=inspect-resource-lines
+bound-lock/1 at=policy:bound/public-operations by=target form=alphabet measure=code role=writes scope=refusal/conformance/coverage value=conformance/coverage
+bound-lock/1 about="The suite omits a required rule or refusal, or names undeclared coverage." at=policy:bound/public-operations by=target form=alphabet measure=class role=writes scope=refusal/conformance/coverage value=interpretation
+bound-lock/1 at=policy:bound/public-operations by=target form=alphabet measure=next role=writes scope=refusal/conformance/coverage value=complete-suite
+bound-lock/1 at=policy:bound/public-operations by=target form=alphabet measure=code role=writes scope=refusal/conformance/integrity value=conformance/integrity
+bound-lock/1 about="The supplied suite bytes do not match the digest chosen by the receiver." at=policy:bound/public-operations by=target form=alphabet measure=class role=writes scope=refusal/conformance/integrity value=integrity
+bound-lock/1 at=policy:bound/public-operations by=target form=alphabet measure=next role=writes scope=refusal/conformance/integrity value=verify-suite-bytes
+bound-lock/1 at=policy:bound/public-operations by=target form=alphabet measure=code role=writes scope=refusal/conformance/suite value=conformance/suite
+bound-lock/1 about="The suite is malformed, empty, duplicated or uses an unsupported byte profile." at=policy:bound/public-operations by=target form=alphabet measure=class role=writes scope=refusal/conformance/suite value=input
+bound-lock/1 at=policy:bound/public-operations by=target form=alphabet measure=next role=writes scope=refusal/conformance/suite value=inspect-suite

package/docs/contracts/refusals.md

@@ -37,11 +37,26 @@ Source of truth: `refusals.bound` (`bound-refusals@1`), read through the existin
 | host-port/failed | host | A declared host callback failed; no successful result is returned. | inspect-host-port |
 | host-port/integrity | integrity | Content bytes differ from the requested SHA-256 identity. | resolve-exact-bytes |
 | host-port/response | host | A host response has an unsupported shape or shared mutable bytes. | inspect-host-port |
-
-Native quartet: `refusals.publication.json`. `vectors/native/refusals.vector.json` checks the wire catalog, its derived page, duplicate/missing records, and real export/inspection refusals in two places. No failed operation becomes a successful receipt. The captured semantic marker is:
+| reading-identity/context | interpretation | The reading lacks its complete declared execution context. | inspect-reading-context |
+| reading-identity/budget | resource | The place lacks one finite declared preparation limit. | inspect-resource-lines |
+| reading-identity/selection | interpretation | The requested reader is not adopted by this place. | inspect-reader-selection |
+| reading-identity/projection | interpretation | The adopted reader has no supported input projection. | declare-input-projection |
+| reading-identity/integrity | input | Current input or retained carrier bytes differ from their committed bytes. | resolve-verified-bytes |
+| reading-identity/failed | operation | The existing native preparation boundary refused; the diagnostic retains its cause. | inspect-native-diagnostic |
+| engine/input | input | The object byte request is not a supported canonical profile. | inspect-request |
+| engine/context | interpretation | The receiver-selected context does not admit the requested object history. | inspect-context |
+| computation/context | interpretation | The question, implementation, policy, input or result does not match the receiver-selected computation context. | inspect-context |
+| computation/budget | resource | The computation lacks or exceeds its declared byte or execution budget. | inspect-resource-lines |
+| computation/signature | authority | The computation signature does not verify with the receiver-selected signer. | inspect-signer |
+| computation/authority | authority | The selected computation signer is absent, retired or outside coverage. | inspect-authority |
+| conformance/context | interpretation | The receiver supplied missing or invalid suite, implementation or contract identities. | inspect-context |
+| conformance/budget | resource | The suite exceeds its declared byte or case budget. | inspect-resource-lines |
+| conformance/coverage | interpretation | The suite omits a required rule or refusal, or names undeclared coverage. | complete-suite |
+| conformance/integrity | integrity | The supplied suite bytes do not match the digest chosen by the receiver. | verify-suite-bytes |
+| conformance/suite | input | The suite is malformed, empty, duplicated or uses an unsupported byte profile. | inspect-suite |
 
 ```text
 REFUSALS lines · unique codes · exact metadata · duplicate refused
 ```
 
-Specific producers cover reference syntax, standing query/view, native export usage/source/context/budget/authority/signer/history, and authenticated inspection context/budget/transport/integrity/framing/wire/authority/history/object-context/identity. Numeric CLI usage and uncoded legacy failures use the explicitly generic codes above; diagnostics remain unclassified. B2/B5 may add codes only by changing these versioned contract bytes and their vectors.
+Specific producers cover reference syntax, standing query/view, native export usage/source/context/budget/authority/signer/history, and authenticated inspection context/budget/transport/integrity/framing/wire/authority/history/object-context/identity. Numeric CLI usage and uncoded legacy failures use the explicitly generic codes above; diagnostics remain unclassified. Additional public operations may add codes only by changing these versioned contract bytes and their vectors.

package/docs/contracts/refusals.publication.json

@@ -4,7 +4,7 @@
     {
       "role": "contract",
       "path": "docs/contracts/refusals.md",
-      "digest": "sha256:ed549322f385e184b0defe705eac62cf546b8617ecb7f9fbe3f727431820f10c"
+      "digest": "sha256:2255340c9bad55a9c6b97542840d0efee0f9cecc9d032a0e810b96e5f891c38e"
     },
     {
       "role": "yes",
@@ -14,7 +14,7 @@
     {
       "role": "vector",
       "path": "vectors/native/refusals.vector.json",
-      "digest": "sha256:2e2833bc6388784e030b50232bd99f84ccb05b0fd6ed86f6db0a5a0b1dc38e05"
+      "digest": "sha256:957f2b4a8e97a2dd851c7cdb210579cc9d3ab0822efa9bf18c3a676b92636663"
     },
     {
       "role": "no",

package/docs/contracts/views.md

@@ -27,3 +27,11 @@ The programs view asks the selected Topos demand-status projection at resolution
 # Demand card
 
 The declared card view asks the selected Topos demand-card projection at resolution 8. It reads the selected demand coordinates, their explicit dependencies and the handed evidence region under selectors declared by that Topos. It does not infer progress from files or convert a declaration into proof. A requirement without evidence is unread; an unpaid predecessor blocks its dependant. The next coordinate is an unblocked unpaid demand. Deadline is unread when no elapsed receipt is handed; absence is not zero. These labels describe program evidence, not Obligations cell states. The sample pins the implementation member from the published Topos SDK, folds two unrelated places twice with equal stdout and refuses a declared dependency cycle. This sample intentionally has no evidence to close either program; it certifies the projection of absence and order, not stage acceptance.
+
+## Computation statements
+
+`fold --as computation --key <key> [--key-file <host-file>]` computes the existing authenticated object projection. It requires an admitted `view/computation=computation@1`, one digest each for `computation/contract` and `computation/numeric-policy`, and explicit `0..N` limits for `computation/bytes` and `computation/milliseconds`. The key must be current and cover `computation`. No implicit key or delivery approval is used.
+
+The CLI uses the same `executeComputation` operation exported by `/engine`. Its signer is the existing host-selected file or command mechanism; the original signed history is not modified. The returned `bound-computation-delivery@1` contains the public context, request bytes, signed statement and result bytes. Relevant environment values are committed as digests. Verification must use an independently chosen context and public key, not trust the supplied context merely because it was delivered.
+
+The implementation identity covers the native instrument closure and, when selected, the WASM assets. The selected form standings and their executable closures are transitive inputs. A statement names what ran; its signature authenticates that observation, not mathematical correctness, independence, a Root admission or permission to publish.

package/docs/reference.md

@@ -22,6 +22,7 @@
 - [engine](contracts/engine.md)
 - [evidence-view](contracts/evidence-view.md)
 - [host-ports](contracts/host-ports.md)
+- [reading-identity](contracts/reading-identity.md)
 - [reference-backend](contracts/reference-backend.md)
 - [reference-export](contracts/reference-export.md)
 - [refusals](contracts/refusals.md)

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@lapxo/bound",
-  "version": "0.2.4",
+  "version": "0.2.5",
   "type": "module",
   "description": "Read the bounds you already wrote, fold them, and name the contradictions.",
   "main": "dist/cli/verb.js",
@@ -36,13 +36,16 @@
     "./host": {
       "types": "./dist/host/index.d.ts",
       "default": "./dist/host/index.js"
-    }
+    },
+    "./conformance": "./docs/contracts/conformance.json",
+    "./determinism": "./docs/contracts/determinism.bound"
   },
   "scripts": {
     "test": "node --import ./test/setup.ts --test --test-concurrency=2 test/*.test.ts",
     "clean": "rm -rf dist .tsbuildinfo* tsconfig.tsbuildinfo",
     "build": "node --experimental-strip-types tools/build.ts",
-    "prepack": "npm run build"
+    "prepack": "npm run build",
+    "compact-archive": "node --experimental-strip-types tools/compact-archive.ts"
   },
   "files": [
     "LICENSE",
@@ -51,13 +54,8 @@
     "dist/**/*.js",
     "dist/cli/verb.d.ts",
     "dist/engine/index.d.ts",
-    "dist/engine/object.d.ts",
     "dist/host/reference-authenticated.d.ts",
-    "dist/host/reference-export.d.ts",
     "dist/host/reference-native-api.d.ts",
-    "dist/host/reference-native.d.ts",
-    "dist/host/reference-profile.d.ts",
-    "dist/host/refusals.d.ts",
     "dist/wasm/adapter.d.ts",
     "TARGET.bound",
     "receipts.bound",
@@ -162,7 +160,6 @@
     "samples/reference-backend/world-fixture.json",
     "vectors/native/reference-backend.vector.json",
     "samples/authenticated-reference/compatibility.json",
-    "dist/engine/ports.d.ts",
     "docs/contracts/host-ports.publication.json",
     "samples/host-ports/yes.json",
     "samples/host-ports/no.json",
@@ -173,49 +170,41 @@
     "vectors/native/readme.vector.json",
     "samples/engine-place/inputs/closure.json",
     "dist/host/native/module-delivery.d.ts",
-    "dist/host/native/module-closure.d.ts",
     "docs/contracts/closure-delivery.md",
     "docs/contracts/closure-delivery.publication.json",
     "samples/module-delivery/inputs/delivery.json",
     "samples/no/module-delivery/delivery.json",
     "vectors/native/module-delivery.vector.json",
     "dist/host/index.d.ts",
-    "dist/host/in-process.d.ts",
-    "dist/host/in-process-context.d.ts",
-    "dist/host/in-process-act.d.ts",
-    "dist/host/in-process-root.d.ts",
-    "dist/host/native-receiver.d.ts",
-    "dist/host/call-context.d.ts",
-    "dist/host/ports/place-act.d.ts",
-    "dist/host/place-act-transaction.d.ts",
-    "dist/host/ports/publication.d.ts",
-    "dist/host/root-clock-source.d.ts",
-    "dist/fold/claims.d.ts",
-    "dist/host/ports/local-act.d.ts",
-    "dist/host/place-clock-selection.d.ts",
-    "dist/host/commit-result.d.ts",
     "docs/contracts/native-host.publication.json",
     "samples/native-host/yes.json",
     "samples/native-host/no.json",
     "vectors/native/native-host.vector.json",
-    ".github/workflows/release.yml",
-    ".github/workflows/test.yml",
     "CITATION.cff",
     "docs/contracts/publication.inventory.json",
     "docs/guide.md",
     "docs/reference.md",
-    "docs/why.md"
+    "docs/why.md",
+    "docs/contracts/reading-identity.publication.json",
+    "samples/reading-identity/yes.json",
+    "samples/reading-identity/no.json",
+    "vectors/native/reading-identity.vector.json",
+    "dist/vendor/",
+    "vendor/syntax/parser.js",
+    "vendor/syntax/LICENSE.md",
+    "dist/public-types.d.ts",
+    "docs/contracts/conformance.json",
+    "docs/contracts/determinism.bound"
   ],
   "author": "Lapxo",
   "license": "MIT",
-  "dependencies": {
-    "@lapxo/obligations": "0.4.3",
-    "@lapxo/topos": "^0.2.1",
-    "acorn": "8.19.0"
-  },
   "devDependencies": {
-    "@types/node": "^20.0.0",
-    "typescript": "^5.0.0"
+    "@types/node": "20.19.43",
+    "typescript": "5.9.3",
+    "@lapxo/topos": "0.2.1",
+    "@lapxo/obligations": "0.4.4",
+    "esbuild": "0.28.2",
+    "dts-bundle-generator": "9.5.1"
   },
   "sideEffects": false,
   "engines": {