@lapxo/bound 0.2.5 → 0.2.6

package/dist/public-types.d.ts

@@ -4,9 +4,67 @@ declare class BoundRefusal extends Error {
 	constructor(code: string, diagnostic: string);
 }
 declare const PLACE_ACT_CONTEXT = "place-act-context@1";
+declare const nativeAuthorityRequestIdentity: (action: NativeAuthorityAction) => string;
+declare const profileDigest: (bytes: string) => string;
 /** Snapshot identity, not a new wire, authority algorithm or current permit. */
 declare const rootLotSnapshot: (root: string) => string;
+/** The verifier is the actual rerun above, never a callback from card bytes. */
+declare function answerNativeAuthorityCard(card: AuthorityCard, request: string, context: NativeAuthorityCardContext): Promise<{
+	kind: "refuse";
+	code: string;
+	diagnostic: string;
+} | {
+	status: "refused";
+	code: "not-in-card";
+	next: "request-card-entry";
+	needs?: undefined;
+	decision?: undefined;
+	source?: undefined;
+} | {
+	status: "open";
+	needs: readonly [
+		"authority-card/verified-judgment"
+	];
+	code?: undefined;
+	next?: undefined;
+	decision?: undefined;
+	source?: undefined;
+} | {
+	status: "observed";
+	decision: "allow" | "ask" | "deny";
+	source: "consumer-verified-judgment";
+	code?: undefined;
+	next?: undefined;
+	needs?: undefined;
+} | {
+	status: "refused";
+	code: "card-stale";
+	next: "refresh-card";
+}>;
+/** Exact result bindings, declared producer authorization, and proof verification are independent checks. */
+declare function authenticatePhysicalLinesWitness(reading: PhysicalLinesReading, line: string, authority: PhysicalLinesWitnessAuthority): string;
 declare function authorityOf(fields: Readonly<Record<string, string>>, signers: readonly Signer[], verify: Verify, published?: Published): SignerVerdict;
+/** Resolve pinned declarations, then reuse the consumer's current signature,
+ * window, region coverage and widening judge. This prepares a lot; it never lands it. */
+declare function composeProfile(request: ProfileCompositionRequest): {
+	status: "prepared";
+	digest: string;
+	inspection: {
+		status: "declared";
+		fields: {
+			coordinate: string;
+			composition: "compatible" | "incompatible" | "unread";
+			transition: string;
+			witness: boolean;
+		}[];
+		pins: CategoryPin[];
+		needs: string[];
+		authority: "not established";
+	};
+	lines: string[];
+	pins: CategoryPin[];
+	releases: readonly string[];
+};
 declare function decodeReference(fragment: string): StandingReference;
 /** The host selects already authenticated snapshots and resolution, never the
  * offered program. This prepares unchanged ESM files, not a JS sandbox, signer,
@@ -76,15 +134,96 @@ declare function inspectAuthenticatedReference(fragment: string, trust: Referenc
 	semanticStanding: string;
 	originalRecords: readonly string[];
 }>;
-declare function inspectReference(fragment: string, policy: readonly string[]): Promise<{
+declare function inspectReference(fragment: string, policy: readonly string[], options?: HTTPOptions): Promise<{
 	reference: StandingReference;
 	lines: readonly string[];
 	standing: string;
 	authentication: string;
+} | {
+	kind: "needs";
+	reference: LocatedReference;
+	identity: string;
+	needs: string;
+	authentication: "not demonstrated; inspect only";
+} | {
+	reference: LocatedReference;
+	authentication: "not demonstrated; inspect only";
+	kind: "present";
+	identity: string;
+	standing: string;
+	lines: readonly string[];
 }>;
+/** A declared preview is inspected independently of content and authority; never fetched or substituted. */
+declare function inspectReferencePreview(line: string, budget: RecordBudget, maxInlineBytes: number): {
+	status: "declared";
+	referenceIdentity: string;
+	projection: {
+		readonly profile: string;
+		readonly text: string;
+		readonly digest: string;
+	} | null;
+	relations: readonly {
+		readonly relation: string;
+		readonly target: string;
+	}[];
+	needs: string[];
+	projectionCompleteness: "not demonstrated";
+	authentication: "not verified";
+	fragmentPrivacy: "not promised";
+};
+/** Receiver-selected complete installed bytes; the physical root never enters this digest. */
+declare function installedHostInstrument(request: InstalledPackageRequest, entry: string): NativeHostInstrument & {
+	readonly digest: string;
+};
+/** Identity of a complete installed byte snapshot and its selected consumed module
+ * closure. Reuses the package export proof, file closure and verified inventory;
+ * no compiler, execution, archive reconstruction or package discovery. */
+declare function installedPackageIdentity(request: InstalledPackageRequest): {
+	format: "bound-installed-package/1";
+	digest: string;
+	lines: string;
+	snapshot: string;
+	manifest: string;
+	members: number;
+	bytes: number;
+	exportInventory: readonly string[];
+	modules: ModuleInventory;
+	delivery: ClosureDelivery;
+	consumedPins: {
+		specifier: string;
+		parent: string;
+		snapshot: string;
+		source: string;
+		version: string;
+	}[];
+};
 /** Acquire canonical line signatures only. The line protocol is not widened
  * for contextual receipt frames. Both operations share bounds and response checks. */
 declare function invokeSigningPort(lot: SigningLot, sign: SigningPort, limits: PortLimits, signal?: AbortSignal): Promise<readonly SignatureRecord[]>;
+/** This adapter delegates all threshold and widening decisions to the existing Bound judges. */
+declare function judgePhysicalLines(input: {
+	readonly reading: PhysicalLinesReading;
+	readonly standing: readonly string[];
+	readonly proposed: readonly string[];
+	readonly witness?: string;
+	readonly authority?: PhysicalLinesWitnessAuthority;
+}): {
+	status: "BLOCK" | "UNMEASURED" | "READY";
+	rejected: string[];
+	unmeasured: {
+		scope: string;
+		cause: string;
+		selectors: readonly string[];
+	}[];
+	stray: any[];
+	observations: {
+		scope: string;
+		file?: string;
+		value: string;
+	}[];
+	thresholds: CeilingFold[];
+	reading: string;
+};
 /** Signs receiver receipts through the bounded existing signer protocol. Exact
  * original declarations/proofs remain unchanged. Replay is historical recovery,
  * never a new permission. A refusal after visibility is not a rollback claim. */
@@ -181,11 +320,29 @@ declare function landRootLotInProcess(context: RootLotContext, ports: RootLotPor
 	value?: undefined;
 	identity?: undefined;
 }>;
+/** Project a verified delivery without a second traversal, I/O, compilation,
+ * source transformation or execution. Notices remain in the delivery, separate
+ * from executable module units. Extra source declarations cannot add modules.
+ */
+declare function moduleInventory(bytes: Uint8Array, expected: string, limits: ClosureDeliveryLimits, sources: readonly ModuleInventorySource[], context: ModuleInventoryContext): ModuleInventory;
 /** Host-selected archive and entry, never a verifier assertion from the program.
  * This proves content identity only; standing admission and runtime capabilities
  * are separate prerequisites. Binary resources are not executable text members.
  */
 declare function moduleSnapshot(archive: Uint8Array, expected: string, entry: string): ModuleClosureSnapshot;
+/** The receiver supplies Root and implementation. Only authenticated selection
+ * chooses a bounded local request; document bytes supply neither authority. */
+declare function nativeAuthorityCardView(root: string, instrument: NativeHostInstrument, scope: string): Promise<{
+	kind: "fact";
+	value: NativeAuthorityCardValue;
+} | {
+	kind: "refuse";
+	code: string;
+	diagnostic: string;
+}>;
+/** The consumer supplies the environment. Ambient preload/loader and libuv
+ * controls cannot cross the fixed host boundary. Values are never logged. */
+declare function nativeHostEnvironment(input: Readonly<Record<string, string | undefined>>): Record<string, string>;
 /** Explicit installed/source ESM selection, never consumer argv or packet data.
  * Identity and public configuration do not certify implementation correctness. */
 declare function nativeHostInstrument(root: string, entry: string): NativeHostInstrument;
@@ -229,9 +386,28 @@ declare function openAuthenticatedReference(root: string, fragment: string, opti
 	semanticStanding: string;
 	originalRecords: readonly string[];
 }>;
+declare function parseNativeAuthorityCardRequest(text: string, expectedDigest: string, limits: RecordBudget): NativeAuthorityCardRequest;
+/** Projects region selectors from already admitted standing; parsing grants no authority. */
+declare function physicalLinesRegions(standing: readonly string[]): readonly PhysicalLinesRegion[];
 declare function preflight(request: WasmRequest): void;
+/** Read-only, freshly authenticated native preflight. This does not grant an act. */
+declare function prepareNativeAuthorityCard(context: NativeAuthorityCardContext, issuedAt?: number): Promise<{
+	kind: "fact";
+	value: NativeAuthorityCardValue;
+} | {
+	kind: "refuse";
+	code: string;
+	diagnostic: string;
+}>;
+/** A recognized public reading of the existing captured native projection.
+ * No fold, evaluator, retained-result cache or persistent receipt is entered.
+ * A charged attempt stays charged even if the selected projection refuses. */
+declare function prepareNativeProbe(context: NativeProbeContext): NativeProbeResult;
 /** Receiver-selected instrument and admitted Root; no consumer-owned verifier or directory fingerprint. */
 declare function prepareNativeReadingIdentity(context: NativeReadingIdentityContext): Promise<NativeReadingIdentityResult>;
+/** Each view retains its own input identity. A batch shares one fresh observation,
+ * never a persistent cache, and returns nothing if any selection or check fails. */
+declare function prepareNativeViewIdentities(context: NativeViewIdentitiesContext): NativeViewIdentitiesResult;
 /** Prepare only native configuration projections. No foldPlace, observation,
  * executable reader, resolver, persistence, lease or Root exclusion is entered.
  * The returned text and identity share one immutable committed observation. */
@@ -284,7 +460,295 @@ declare function readContextualStandingInProcess(context: RootStandingHostContex
 	diagnostic: string;
 	value?: undefined;
 }>;
-/** Pure machine contract reader. A catalog is data, never an authority grant. */
+/** Reads an actual finite inventory. Links and special files are named rather than silently omitted. */
+declare function readPlacePhysicalLines(input: PhysicalLinesPlaceInput): {
+	status: "unmeasured";
+	cause: "region-measure/budget";
+	required: string;
+	workUnit: "declared-input-rows";
+	model?: undefined;
+	unit?: undefined;
+	arithmetic?: undefined;
+	readings?: undefined;
+	union?: undefined;
+	sumOfRegions?: undefined;
+	overlapExcess?: undefined;
+	disjointBySupport?: undefined;
+	overlaps?: undefined;
+	unassigned?: undefined;
+	work?: undefined;
+} | {
+	status: "unmeasured";
+	cause: "physical-lines/byte-budget";
+	required: string;
+	workUnit: "input-bytes";
+	profile?: undefined;
+	snapshot?: undefined;
+	model?: undefined;
+	policy?: undefined;
+	textDomain?: undefined;
+	inputFiles?: undefined;
+	regions?: undefined;
+	valuation?: undefined;
+	work?: undefined;
+	verification?: undefined;
+} | {
+	status: "unmeasured";
+	cause: "physical-lines/selection-budget";
+	required: string;
+	workUnit: "selector-code-units-times-candidates";
+	profile?: undefined;
+	snapshot?: undefined;
+	model?: undefined;
+	policy?: undefined;
+	textDomain?: undefined;
+	inputFiles?: undefined;
+	regions?: undefined;
+	valuation?: undefined;
+	work?: undefined;
+	verification?: undefined;
+} | {
+	status: "read";
+	identity: string;
+	bindings: {
+		contract: "sha256:636ace16eeaa46eafb7b07c28d1d57916bc9108b188e96b5a8bf7bed6dc15707";
+		model: string;
+		params: string;
+		inputs: string;
+		selection: string;
+		unit: string;
+		scale: string;
+		resolution: string;
+		reader: string;
+		implementation: string;
+		context: string;
+		run: string;
+		result: string;
+		reading: string;
+	};
+	reading: {
+		status: "read";
+		profile: "topos-physical-lines/1";
+		snapshot: string;
+		model: {
+			readonly name: "finite-nonnegative-atomic-valuation@1";
+			readonly contract: "sha256:636ace16eeaa46eafb7b07c28d1d57916bc9108b188e96b5a8bf7bed6dc15707";
+			readonly implementation: "sha256:ef7e39d0ac44b0dd3d4b68220d3c381f737eb2729d0017ed3271ce119d408b13";
+		};
+		policy: {
+			byteBudget: string;
+			rowBudget: string;
+		};
+		textDomain: "utf8-lf-crlf-reject-isolated-cr@1";
+		inputFiles: {
+			name: any;
+			digest: any;
+		}[];
+		regions: ({
+			status: "measured";
+			value: Readonly<{
+				numerator: string;
+				denominator: string;
+			}>;
+			scope: string;
+			selectors: string[];
+			selections: ({
+				selector: string;
+				members: any[];
+				status: "selected";
+				cause?: undefined;
+			} | {
+				selector: string;
+				members: any[];
+				status: "unmeasured";
+				cause: "selector-no-match";
+			})[];
+			members: any[];
+		} | {
+			status: "unmeasured";
+			cause: "selector-no-match";
+			scope: string;
+			selectors: string[];
+			selections: ({
+				selector: string;
+				members: any[];
+				status: "selected";
+				cause?: undefined;
+			} | {
+				selector: string;
+				members: any[];
+				status: "unmeasured";
+				cause: "selector-no-match";
+			})[];
+			members: any[];
+		})[];
+		valuation: {
+			status: "measured";
+			model: "finite-nonnegative-atomic-valuation@1";
+			unit: string;
+			arithmetic: "exact-rational";
+			readings: {
+				region: any;
+				members: string[];
+				value: Readonly<{
+					numerator: string;
+					denominator: string;
+				}>;
+			}[];
+			union: {
+				members: string[];
+				value: Readonly<{
+					numerator: string;
+					denominator: string;
+				}>;
+			};
+			sumOfRegions: Readonly<{
+				numerator: string;
+				denominator: string;
+			}>;
+			overlapExcess: Readonly<{
+				numerator: string;
+				denominator: string;
+			}>;
+			disjointBySupport: boolean;
+			overlaps: {
+				atom: string;
+				regions: string[];
+			}[];
+			unassigned: string[];
+			work: {
+				unit: "declared-input-rows";
+				required: string;
+			};
+			cause?: undefined;
+			required?: undefined;
+			workUnit?: undefined;
+		};
+		work: {
+			inputBytes: string;
+			selectionUnits: string;
+		};
+		verification: "supplied inventory and snapshot; authority and completeness are consumer obligations";
+		cause?: undefined;
+		required?: undefined;
+		workUnit?: undefined;
+	};
+	perFile: {
+		status: "read";
+		profile: "topos-physical-lines/1";
+		snapshot: string;
+		model: {
+			readonly name: "finite-nonnegative-atomic-valuation@1";
+			readonly contract: "sha256:636ace16eeaa46eafb7b07c28d1d57916bc9108b188e96b5a8bf7bed6dc15707";
+			readonly implementation: "sha256:ef7e39d0ac44b0dd3d4b68220d3c381f737eb2729d0017ed3271ce119d408b13";
+		};
+		policy: {
+			byteBudget: string;
+			rowBudget: string;
+		};
+		textDomain: "utf8-lf-crlf-reject-isolated-cr@1";
+		inputFiles: {
+			name: any;
+			digest: any;
+		}[];
+		regions: ({
+			status: "measured";
+			value: Readonly<{
+				numerator: string;
+				denominator: string;
+			}>;
+			scope: string;
+			selectors: string[];
+			selections: ({
+				selector: string;
+				members: any[];
+				status: "selected";
+				cause?: undefined;
+			} | {
+				selector: string;
+				members: any[];
+				status: "unmeasured";
+				cause: "selector-no-match";
+			})[];
+			members: any[];
+		} | {
+			status: "unmeasured";
+			cause: "selector-no-match";
+			scope: string;
+			selectors: string[];
+			selections: ({
+				selector: string;
+				members: any[];
+				status: "selected";
+				cause?: undefined;
+			} | {
+				selector: string;
+				members: any[];
+				status: "unmeasured";
+				cause: "selector-no-match";
+			})[];
+			members: any[];
+		})[];
+		valuation: {
+			status: "measured";
+			model: "finite-nonnegative-atomic-valuation@1";
+			unit: string;
+			arithmetic: "exact-rational";
+			readings: {
+				region: any;
+				members: string[];
+				value: Readonly<{
+					numerator: string;
+					denominator: string;
+				}>;
+			}[];
+			union: {
+				members: string[];
+				value: Readonly<{
+					numerator: string;
+					denominator: string;
+				}>;
+			};
+			sumOfRegions: Readonly<{
+				numerator: string;
+				denominator: string;
+			}>;
+			overlapExcess: Readonly<{
+				numerator: string;
+				denominator: string;
+			}>;
+			disjointBySupport: boolean;
+			overlaps: {
+				atom: string;
+				regions: string[];
+			}[];
+			unassigned: string[];
+			work: {
+				unit: "declared-input-rows";
+				required: string;
+			};
+			cause?: undefined;
+			required?: undefined;
+			workUnit?: undefined;
+		};
+		work: {
+			inputBytes: string;
+			selectionUnits: string;
+		};
+		verification: "supplied inventory and snapshot; authority and completeness are consumer obligations";
+		cause?: undefined;
+		required?: undefined;
+		workUnit?: undefined;
+	};
+	stray: any[];
+} | {
+	status: "unmeasured";
+	cause: string;
+	unavailable: {
+		name: string;
+		cause: string;
+	}[];
+};
 declare function readRefusalCatalog(text: string): readonly RefusalEntry[];
 /** Uses the existing bounded content port, authority evaluator and projection.
  * It projects the Root component of a complete signed Root wire snapshot; it has no persistence callback,
@@ -332,6 +796,8 @@ declare function recoverRootActInProcess(identity: string, ports: Pick<RootLotPo
 	diagnostic: string;
 	value?: undefined;
 };
+/** Exact declared category selection, with no code-family or scope-prefix rule. */
+declare function releaseCategoryPins(pins: readonly CategoryPin[], categories: readonly ReleaseCategory[], standing: readonly string[]): readonly string[];
 /** Verify before invoking retention; no operation automatically writes the projected result. */
 declare function retainContent(digest: string, bytes: Uint8Array, ports: {
 	readonly retain: PersistencePort;
@@ -349,6 +815,9 @@ declare function runConformance(bytes: Uint8Array, receiver: ConformanceReceiver
 	readonly maxCases: number;
 }, signal?: AbortSignal): Promise<ConformanceReport>;
 declare function runWasmRequest(request: WasmRequest): Promise<WasmResult>;
+/** One consumer-owned native dispatcher, not a daemon or a second interpreter.
+ * The child exits on IPC disconnect, including an ungraceful client exit. */
+declare function startNativeHost(options: NativeHostOptions): Promise<NativeCommandHost>;
 declare function validateObjectContext(records: readonly ObjectRecord[], context: ObjectContext): Outcome<readonly ObjectRecord[]>;
 /** The receiver supplies the expected implementation, question, policy,
  * environment and verification port. The carrier cannot choose any of them. */
@@ -367,6 +836,45 @@ interface ActResult {
 	readonly records: readonly string[];
 	readonly receipt: string;
 }
+interface AuthorityCard {
+	readonly place: string;
+	readonly snapshot: string;
+	readonly key: string;
+	readonly authority: string;
+	readonly coverage: string;
+	readonly policy: string;
+	readonly budget: string;
+	readonly catalog: string;
+	readonly standingContract: string;
+	readonly grants: readonly string[];
+	readonly retirements: readonly string[];
+	readonly demands: readonly string[];
+	readonly horizon: RegistryHorizon;
+	readonly issuedAt: number;
+	readonly actions: readonly {
+		readonly request: string;
+		readonly decision: "allow" | "ask" | "deny";
+	}[];
+	readonly evidence: string;
+}
+interface CategoryPin {
+	readonly category: string;
+	readonly class: string;
+	readonly algorithm: "sha256";
+	readonly digest: string;
+}
+interface CeilingFold {
+	readonly read: readonly string[];
+	readonly over: readonly {
+		readonly ceiling: string;
+		readonly question: string;
+		readonly got: string;
+		readonly side: Side;
+	}[];
+	readonly unread: readonly string[];
+	readonly vacuous: readonly string[];
+	readonly readings: ReadonlyMap<string, readonly string[]>;
+}
 interface Cell<T> {
 	readonly floor: T;
 	readonly ceiling: T;
@@ -495,6 +1003,10 @@ interface Fork {
 	readonly lines: readonly string[];
 	readonly state?: string;
 }
+interface HTTPOptions {
+	readonly signal?: AbortSignal;
+	readonly allowedOrigins?: readonly string[];
+}
 interface HostClockSelection {
 	readonly profile: typeof PLACE_ACT_CONTEXT;
 	readonly namespace: string;
@@ -524,6 +1036,28 @@ interface HostInstrumentRuntime {
 	readonly extension: ".ts" | ".js";
 	readonly lock: readonly string[];
 }
+interface InstalledPackageMember {
+	readonly coordinate: string;
+	readonly digest: string;
+}
+interface InstalledPackagePin extends ModuleInventorySource {
+	readonly specifier: string;
+	readonly parent: string;
+	readonly snapshot: string;
+	readonly module: ModuleClosureSnapshot;
+}
+interface InstalledPackageRequest {
+	readonly directory: string;
+	/** Shape selected by the receiving instrument's admitted pin-shape contract. */
+	readonly shape: string;
+	/** Complete authenticated file inventory, relative to the selected package root. */
+	readonly members: readonly InstalledPackageMember[];
+	/** Explicit package export selectors; symbols are never pruning units. */
+	readonly exports: readonly (readonly string[])[];
+	/** Already authenticated snapshots and resolution selected by the host. */
+	readonly pins: readonly InstalledPackagePin[];
+	readonly limits: ClosureDeliveryLimits;
+}
 interface JoinSemilattice<T> extends Poset<T> {
 	readonly bottom: T;
 	join(a: T, b: T): T;
@@ -538,6 +1072,14 @@ interface LocalActBundle {
 		records: string;
 	}[];
 }
+interface LocatedReference {
+	readonly class: "standing";
+	readonly algorithm: "sha256";
+	readonly digest: string;
+	readonly blob: string;
+	readonly location?: string;
+	readonly "location-class"?: "viewer" | "holder";
+}
 interface Mark<T> {
 	readonly pole: "floor" | "ceiling";
 	readonly reach: "local" | "travels";
@@ -568,9 +1110,134 @@ interface ModuleClosureSnapshot {
 	readonly entry: string;
 	readonly members: ReadonlyMap<string, ModuleClosureMember>;
 }
+interface ModuleInventory {
+	readonly format: "verified-module-inventory/1";
+	readonly delivery: string;
+	readonly closure: string;
+	readonly modules: readonly ModuleInventoryLine[];
+	/** Existing canonical wire; descriptive module metadata stays in about. */
+	readonly lines: string;
+}
+interface ModuleInventoryContext {
+	readonly scope: string;
+	readonly by: string;
+	readonly at: string;
+}
+interface ModuleInventoryLine extends ModuleInventorySource {
+	readonly unit: "module";
+	readonly module: string;
+	readonly digest: string;
+	/** The verified closure which reached this module, not an immediate importer. */
+	readonly reachedFrom: string;
+}
+/** Source names and versions are declarations supplied by the receiving host.
+ * The snapshot pins their bytes; this projection does not authenticate a
+ * publisher's version claim or infer symbol reachability.
+ */
+interface ModuleInventorySource {
+	readonly snapshot: string;
+	readonly source: string;
+	readonly version: string;
+}
+interface NativeAuthorityAction {
+	readonly kind: "record-coverage" | "admission";
+	readonly records: readonly string[];
+}
+interface NativeAuthorityCardContext {
+	readonly root: string;
+	readonly place: string;
+	readonly key: string;
+	readonly instrument: NativeHostInstrument;
+	readonly authorityEpoch: number;
+	readonly clock: {
+		readonly name: string;
+		readonly unit: string;
+		readonly now: number;
+	};
+	readonly horizon: RegistryHorizon;
+	readonly limits: RecordBudget;
+	readonly actions: readonly NativeAuthorityAction[];
+}
+interface NativeAuthorityCardValue {
+	readonly card: AuthorityCard;
+	readonly line: string;
+	readonly identity: string;
+	readonly judgments: readonly NativeAuthorityJudgment[];
+	readonly needs: readonly string[];
+}
+interface NativeAuthorityJudgment {
+	readonly request: string;
+	readonly decision: "allow" | "ask" | "deny" | "open";
+	readonly evidence: readonly unknown[];
+	readonly needs: readonly string[];
+}
+interface NativeCommand {
+	readonly verb: "fold" | "sign" | "land";
+	readonly args: readonly string[];
+	readonly signer?: string;
+	readonly inputs?: readonly {
+		readonly name: string;
+		readonly text: string;
+	}[];
+}
+interface NativeCommandHost {
+	readonly pid: number;
+	readonly environment: Readonly<Record<string, string>>;
+	readonly flags: readonly string[];
+	request(command: NativeCommand, signal?: AbortSignal): Promise<NativeCommandResult>;
+	close(): Promise<void>;
+}
+interface NativeCommandResult {
+	readonly status: number;
+	readonly stdout: string;
+	readonly stderr: string;
+}
 interface NativeHostInstrument {
 	readonly name: string;
 	readonly runtime: HostInstrumentRuntime;
+	readonly installed?: {
+		readonly digest: string;
+		readonly request: InstalledPackageRequest;
+	};
+}
+interface NativeHostLimits {
+	readonly requestBytes: number;
+	readonly responseBytes: number;
+	readonly timeoutMs: number;
+	readonly heapMiB: number;
+	readonly queuedRequests: number;
+}
+interface NativeHostOptions {
+	readonly place: string;
+	readonly instrument: NativeHostInstrument;
+	readonly expectedInstrument: string;
+	readonly limits: NativeHostLimits;
+	readonly environment: Readonly<Record<string, string | undefined>>;
+	readonly scratchParent?: string;
+	readonly signer?: {
+		readonly keyId: string;
+		readonly name: string;
+		readonly sign: SigningPort;
+	};
+	readonly signers?: ReadonlyMap<string, {
+		readonly name: string;
+		readonly sign: SigningPort;
+	}>;
+}
+interface NativeProbeContext extends NativeViewIdentityContext {
+	readonly port: NativeProbePort;
+	readonly counter: NativeProbeCounter;
+	readonly signal?: AbortSignal;
+}
+/** This meter belongs to the consumer's operation. Keep it across calls and
+ * share it between requests using the same port. It is never persisted by Bound. */
+interface NativeProbeCounter {
+	readonly used: Map<string, number>;
+}
+interface NativeProbePort {
+	readonly coordinate: string;
+	readonly probes: number;
+	readonly responseBytes: number;
 }
 interface NativeReadingIdentityContext {
 	readonly place: string;
@@ -578,6 +1245,12 @@ interface NativeReadingIdentityContext {
 	readonly limits: ReadingPreparationLimits;
 	readonly reader?: string;
 }
+interface NativeViewIdentitiesContext {
+	readonly place: string;
+	readonly instrument: NativeHostInstrument;
+	readonly views: readonly string[];
+	readonly expectedIdentities?: Readonly<Record<string, string>>;
+}
 interface NativeViewIdentityContext {
 	readonly place: string;
 	readonly instrument: NativeHostInstrument;
@@ -609,6 +1282,36 @@ interface ObjectRecord {
 	readonly record: "cell" | "claim" | "mark";
 	readonly fields: Readonly<Record<string, string>>;
 }
+interface PhysicalLinesPlaceInput {
+	readonly root: string;
+	/** Explicit inventory boundaries, also bound into the reading identity. No implicit exclusions. */
+	readonly inventory: readonly string[];
+	readonly regions: readonly PhysicalLinesRegion[];
+	readonly policy: PhysicalLinesPolicy;
+	readonly context: string;
+	readonly reader: string;
+	readonly implementation: string;
+	readonly run: string;
+}
+interface PhysicalLinesPolicy {
+	readonly byteBudget: string;
+	readonly rowBudget: string;
+	readonly entryBudget: number;
+}
+interface PhysicalLinesRegion {
+	readonly scope: string;
+	readonly selectors: readonly string[];
+}
+interface PhysicalLinesWitnessAuthority {
+	/** Supplied by the host from its admitted, current producer policy, never from the witness. */
+	readonly producers: readonly ReadingProducerPolicy[];
+	/** Must verify actual signature/coverage or CI evidence bytes over this exact statement. URL presence is insufficient. */
+	readonly verify: (input: {
+		readonly witness: ReadingWitness;
+		readonly statementBytes: string;
+		readonly producer: ReadingProducerPolicy;
+	}) => boolean;
+}
 interface PlaceActBudget {
 	readonly acts: number;
 	readonly bytes: number;
@@ -679,6 +1382,15 @@ interface PlaceReceipt {
 	readonly place: string;
 	readonly signature: string;
 }
+interface PolicyField<T> {
+	readonly coordinate: string;
+	readonly mode: "meet" | "exact" | "own";
+	/** Values are interpreted by the selected form. Algebra is supplied by
+	 * Obligations, never reconstructed with interval endpoints here. */
+	readonly decode: (value: string) => T;
+	readonly lattice: MeetSemilattice<T>;
+	readonly inhabited: (value: T) => boolean;
+}
 interface PortLimits {
 	readonly timeoutMs: number;
 	readonly maxBytes: number;
@@ -697,6 +1409,39 @@ interface Poset<T> {
 	leq(a: T, b: T): boolean;
 	show(x: T): string;
 }
+interface ProfileComposition {
+	readonly name: string;
+	readonly parents: readonly string[];
+	readonly fields: readonly {
+		readonly coordinate: string;
+		readonly contract: string;
+		readonly value: string;
+	}[];
+	readonly pins: readonly CategoryPin[];
+	readonly witnesses: readonly {
+		readonly coordinate: string;
+		readonly reading: ReadingWitness;
+	}[];
+}
+interface ProfileCompositionRequest {
+	readonly root: string;
+	readonly place: string;
+	readonly profile: ProfileComposition;
+	readonly profiles: ReadonlyMap<string, string>;
+	readonly fields: readonly ProfileFieldBinding[];
+	/** Original signed lines; drafts and parent bytes supply no authority. */
+	readonly statements: readonly string[];
+	readonly budget: RecordBudget;
+	readonly categories: readonly ReleaseCategory[];
+}
+interface ProfileFieldBinding {
+	readonly contract: string;
+	readonly field: PolicyField<unknown>;
+	readonly scope: string;
+	readonly role: "reads" | "writes";
+	readonly form: "interval" | "alphabet";
+	readonly measure: string;
+}
 interface PublicationStorage {
 	publish(staged: string, committed: string): void;
 }
@@ -704,6 +1449,23 @@ interface Published {
 	readonly digest: string;
 	readonly pins: readonly string[];
 }
+interface ReadingContext {
+	readonly class: "attest";
+	readonly reading: string;
+	readonly contract: string;
+	readonly model: string;
+	readonly params: string;
+	readonly inputs: string;
+	readonly selection: string;
+	readonly unit: string;
+	readonly scale: string;
+	readonly resolution: string;
+	readonly reader: string;
+	readonly implementation: string;
+	readonly context: string;
+	readonly run: string;
+	readonly result: string;
+}
 interface ReadingIdentityContext {
 	readonly instrument: string;
 	readonly implementation: string;
@@ -726,6 +1488,10 @@ interface ReadingPreparationLimits {
 	readonly probes: number;
 	readonly signal?: AbortSignal;
 }
+interface RecordBudget {
+	readonly bytes: number;
+	readonly items: number;
+}
 interface ReferenceTrust {
 	readonly snapshot: string;
 	readonly epoch: number;
@@ -751,6 +1517,19 @@ interface RefusalEntry {
 	readonly meaning: string;
 	readonly next: string;
 }
+interface RegistryHorizon {
+	readonly clock: string;
+	readonly unit: string;
+	readonly from: number;
+	readonly through: number;
+}
+interface ReleaseCategory {
+	readonly category: string;
+	readonly class: string;
+	readonly scope: string;
+	readonly role: "reads" | "writes";
+	readonly measure: "digest";
+}
 interface RootContext {
 	readonly namespace: string;
 	readonly snapshot: string;
@@ -924,6 +1703,22 @@ type ContentReadPort = (source: string, digest: string, signal: AbortSignal) =>
 type DigestPort = (bytes: Uint8Array) => string | Promise<string>;
 type KeyClass = "attest" | "authorize";
 type Library = (specifier: string, parent: ModuleClosureSnapshot) => ModuleClosureSnapshot | undefined;
+type NativeAuthorityCardRequest = Omit<NativeAuthorityCardContext, "root" | "instrument"> & {
+	readonly profile: "native-authority-card-request/1";
+};
+type NativeProbeForm = "lines" | "evidence";
+type NativeProbeResult = {
+	readonly kind: "fact";
+	readonly form: NativeProbeForm;
+	readonly port: string;
+	readonly identity: string;
+	readonly text: string;
+	readonly probes: 1;
+} | {
+	readonly kind: "refuse";
+	readonly code: string;
+	readonly diagnostic: string;
+};
 type NativeReadingIdentityResult = {
 	readonly kind: "fact";
 	readonly preparations: readonly ReadingPreparationResult[];
@@ -932,6 +1727,14 @@ type NativeReadingIdentityResult = {
 	readonly code: string;
 	readonly diagnostic: string;
 };
+type NativeViewIdentitiesResult = {
+	readonly kind: "fact";
+	readonly views: readonly Extract<NativeViewIdentityResult, {
+		kind: "fact";
+	}>[];
+} | Extract<NativeViewIdentityResult, {
+	kind: "refuse";
+}>;
 type NativeViewIdentityResult = {
 	readonly kind: "fact";
 	readonly view: "lines" | "evidence";
@@ -956,6 +1759,9 @@ type Outcome<T> = {
 };
 /** Atomic byte retention supplied by the host. This is neither admission nor a current-answer cache. */
 type PersistencePort = (digest: string, bytes: Uint8Array, signal: AbortSignal) => Promise<void>;
+type PhysicalLinesReading = Extract<ReturnType<typeof readPlacePhysicalLines>, {
+	status: "read";
+}>;
 type PreparedReading = {
 	readonly scope: string;
 	readonly kind: "ready";
@@ -981,6 +1787,31 @@ type ReadingPreparationResult = {
 	readonly code: string;
 	readonly diagnostic: string;
 };
+type ReadingProducerPolicy = {
+	readonly authentication: "key-covered";
+	readonly key: string;
+	readonly coverage: string;
+} | {
+	readonly authentication: "ci-run-unkeyed";
+	readonly repository: string;
+	readonly commit: string;
+	readonly workflow: string;
+	readonly run: string;
+	readonly attempt: string;
+};
+type ReadingWitness = ReadingContext & ({
+	readonly authentication: "key-covered";
+	readonly key: string;
+	readonly coverage: string;
+	readonly evidence: string;
+} | {
+	readonly authentication: "ci-run-unkeyed";
+	readonly repository: string;
+	readonly commit: string;
+	readonly workflow: string;
+	readonly attempt: string;
+	readonly evidence: string;
+});
 type RootStandingHostResult = {
 	readonly kind: "fact";
 	readonly value: {
@@ -995,6 +1826,7 @@ type RootStandingHostResult = {
 	readonly code: string;
 	readonly diagnostic: string;
 };
+type Side = "short" | "over";
 type SignatureVerificationPort = (bytes: string, signature: SignatureRecord, algorithm: string, signal: AbortSignal) => Promise<boolean>;
 type Signer$1 = Parameters<typeof authorityOf>[1][number];
 type SignerVerdict = {
@@ -1012,12 +1844,12 @@ type SigningPort = (lot: SigningLot, signal: AbortSignal) => Promise<readonly Si
 type Verify = (fields: Readonly<Record<string, string>>, publicKey: string) => boolean;
 
 export {
-	BoundRefusal as public4_BoundRefusal,
+	BoundRefusal as public7_BoundRefusal,
 	ByteComputationPort as public1_ByteComputationPort,
-	ClosureDelivery as public3_ClosureDelivery,
-	ClosureDeliveryLimits as public3_ClosureDeliveryLimits,
-	ClosureDeliveryManifest as public3_ClosureDeliveryManifest,
-	ClosureNotice as public3_ClosureNotice,
+	ClosureDelivery as public4_ClosureDelivery,
+	ClosureDeliveryLimits as public4_ClosureDeliveryLimits,
+	ClosureDeliveryManifest as public4_ClosureDeliveryManifest,
+	ClosureNotice as public4_ClosureNotice,
 	ComputationContext as public1_ComputationContext,
 	ComputationStatement as public1_ComputationStatement,
 	ConformanceCase as public1_ConformanceCase,
@@ -1025,90 +1857,163 @@ export {
 	ConformanceReport as public1_ConformanceReport,
 	ConformanceSuite as public1_ConformanceSuite,
 	ContentReadPort as public1_ContentReadPort,
-	ContentReadPort as public4_ContentReadPort,
+	ContentReadPort as public7_ContentReadPort,
 	DigestPort as public1_DigestPort,
-	DigestPort as public4_DigestPort,
+	DigestPort as public7_DigestPort,
 	HostInstrumentRuntime as public2_HostInstrumentRuntime,
-	ModuleClosureSnapshot as public3_ModuleClosureSnapshot,
+	InstalledPackageMember as public2_InstalledPackageMember,
+	InstalledPackageMember as public3_InstalledPackageMember,
+	InstalledPackagePin as public2_InstalledPackagePin,
+	InstalledPackagePin as public3_InstalledPackagePin,
+	InstalledPackageRequest as public2_InstalledPackageRequest,
+	InstalledPackageRequest as public3_InstalledPackageRequest,
+	ModuleClosureSnapshot as public4_ModuleClosureSnapshot,
+	ModuleInventory as public4_ModuleInventory,
+	ModuleInventoryContext as public4_ModuleInventoryContext,
+	ModuleInventoryLine as public4_ModuleInventoryLine,
+	ModuleInventorySource as public4_ModuleInventorySource,
+	NativeAuthorityAction as public2_NativeAuthorityAction,
+	NativeAuthorityCardContext as public2_NativeAuthorityCardContext,
+	NativeAuthorityCardRequest as public2_NativeAuthorityCardRequest,
+	NativeAuthorityCardValue as public2_NativeAuthorityCardValue,
+	NativeAuthorityJudgment as public2_NativeAuthorityJudgment,
+	NativeCommand as public2_NativeCommand,
+	NativeCommandHost as public2_NativeCommandHost,
+	NativeCommandResult as public2_NativeCommandResult,
 	NativeHostInstrument as public2_NativeHostInstrument,
+	NativeHostLimits as public2_NativeHostLimits,
+	NativeHostOptions as public2_NativeHostOptions,
+	NativeProbeContext as public2_NativeProbeContext,
+	NativeProbeCounter as public2_NativeProbeCounter,
+	NativeProbeForm as public2_NativeProbeForm,
+	NativeProbePort as public2_NativeProbePort,
+	NativeProbeResult as public2_NativeProbeResult,
 	NativeReadingIdentityContext as public2_NativeReadingIdentityContext,
 	NativeReadingIdentityResult as public2_NativeReadingIdentityResult,
+	NativeViewIdentitiesContext as public2_NativeViewIdentitiesContext,
+	NativeViewIdentitiesResult as public2_NativeViewIdentitiesResult,
 	NativeViewIdentityContext as public2_NativeViewIdentityContext,
 	NativeViewIdentityResult as public2_NativeViewIdentityResult,
 	ObjectContext as public1_ObjectContext,
 	ObjectReading as public1_ObjectReading,
 	ObjectRecord as public1_ObjectRecord,
 	PersistencePort as public1_PersistencePort,
-	PersistencePort as public4_PersistencePort,
+	PersistencePort as public7_PersistencePort,
+	PhysicalLinesPlaceInput as public2_PhysicalLinesPlaceInput,
+	PhysicalLinesPlaceInput as public5_PhysicalLinesPlaceInput,
+	PhysicalLinesPolicy as public2_PhysicalLinesPolicy,
+	PhysicalLinesPolicy as public5_PhysicalLinesPolicy,
+	PhysicalLinesReading as public2_PhysicalLinesReading,
+	PhysicalLinesReading as public5_PhysicalLinesReading,
+	PhysicalLinesRegion as public2_PhysicalLinesRegion,
+	PhysicalLinesRegion as public5_PhysicalLinesRegion,
+	PhysicalLinesWitnessAuthority as public2_PhysicalLinesWitnessAuthority,
+	PhysicalLinesWitnessAuthority as public5_PhysicalLinesWitnessAuthority,
 	PlaceActBudget as public2_PlaceActBudget,
 	PlaceActHostContext as public2_PlaceActHostContext,
 	PlaceActHostPorts as public2_PlaceActHostPorts,
 	PlaceActPersistence as public2_PlaceActPersistence,
 	PlaceActTrust as public2_PlaceActTrust,
 	PortLimits as public1_PortLimits,
-	PortLimits as public4_PortLimits,
+	PortLimits as public7_PortLimits,
 	PreparedReading as public2_PreparedReading,
+	ProfileCompositionRequest as public2_ProfileCompositionRequest,
+	ProfileCompositionRequest as public6_ProfileCompositionRequest,
+	ProfileFieldBinding as public2_ProfileFieldBinding,
+	ProfileFieldBinding as public6_ProfileFieldBinding,
 	PublicationStorage as public2_PublicationStorage,
 	ReadingPreparationLimits as public2_ReadingPreparationLimits,
 	ReadingPreparationResult as public2_ReadingPreparationResult,
-	ReferenceTrust as public4_ReferenceTrust,
+	ReadingProducerPolicy as public2_ReadingProducerPolicy,
+	ReadingProducerPolicy as public5_ReadingProducerPolicy,
+	ReferenceTrust as public7_ReferenceTrust,
 	RefusalEntry as public1_RefusalEntry,
-	RefusalEntry as public4_RefusalEntry,
+	RefusalEntry as public7_RefusalEntry,
+	ReleaseCategory as public2_ReleaseCategory,
+	ReleaseCategory as public6_ReleaseCategory,
 	RootLotContext as public2_RootLotContext,
 	RootLotPorts as public2_RootLotPorts,
 	RootStandingHostContext as public2_RootStandingHostContext,
 	RootStandingHostResult as public2_RootStandingHostResult,
 	SignatureRecord as public1_SignatureRecord,
-	SignatureRecord as public4_SignatureRecord,
+	SignatureRecord as public7_SignatureRecord,
 	SignatureVerificationPort as public1_SignatureVerificationPort,
 	SigningLot as public1_SigningLot,
-	SigningLot as public4_SigningLot,
+	SigningLot as public7_SigningLot,
 	SigningPort as public1_SigningPort,
-	SigningPort as public4_SigningPort,
-	WasmLimits as public6_WasmLimits,
-	WasmRequest as public6_WasmRequest,
-	WasmResult as public6_WasmResult,
-	WasmTrust as public6_WasmTrust,
-	WorkerPort as public6_WorkerPort,
-	decodeReference as public4_decodeReference,
-	deliverModuleClosure as public3_deliverModuleClosure,
-	describeRefusal as public4_describeRefusal,
-	digest as public6_digest,
-	encodeReference as public4_encodeReference,
-	evaluateWasm as public6_evaluateWasm,
+	SigningPort as public7_SigningPort,
+	WasmLimits as public9_WasmLimits,
+	WasmRequest as public9_WasmRequest,
+	WasmResult as public9_WasmResult,
+	WasmTrust as public9_WasmTrust,
+	WorkerPort as public9_WorkerPort,
+	answerNativeAuthorityCard as public2_answerNativeAuthorityCard,
+	authenticatePhysicalLinesWitness as public2_authenticatePhysicalLinesWitness,
+	authenticatePhysicalLinesWitness as public5_authenticatePhysicalLinesWitness,
+	composeProfile as public2_composeProfile,
+	composeProfile as public6_composeProfile,
+	decodeReference as public7_decodeReference,
+	deliverModuleClosure as public4_deliverModuleClosure,
+	describeRefusal as public7_describeRefusal,
+	digest as public9_digest,
+	encodeReference as public7_encodeReference,
+	evaluateWasm as public9_evaluateWasm,
 	executeComputation as public1_executeComputation,
-	exportAuthenticatedReference as public5_exportAuthenticatedReference,
-	inspectAuthenticatedReference as public4_inspectAuthenticatedReference,
-	inspectReference as public5_inspectReference,
+	exportAuthenticatedReference as public8_exportAuthenticatedReference,
+	inspectAuthenticatedReference as public7_inspectAuthenticatedReference,
+	inspectReference as public8_inspectReference,
+	inspectReferencePreview as public8_inspectReferencePreview,
+	installedHostInstrument as public2_installedHostInstrument,
+	installedPackageIdentity as public2_installedPackageIdentity,
+	installedPackageIdentity as public3_installedPackageIdentity,
 	invokeSigningPort as public1_invokeSigningPort,
-	invokeSigningPort as public4_invokeSigningPort,
+	invokeSigningPort as public7_invokeSigningPort,
+	judgePhysicalLines as public2_judgePhysicalLines,
+	judgePhysicalLines as public5_judgePhysicalLines,
 	landPlaceActInProcess as public2_landPlaceActInProcess,
 	landRootLotInProcess as public2_landRootLotInProcess,
-	moduleSnapshot as public3_moduleSnapshot,
+	moduleInventory as public4_moduleInventory,
+	moduleSnapshot as public4_moduleSnapshot,
+	nativeAuthorityCardView as public2_nativeAuthorityCardView,
+	nativeAuthorityRequestIdentity as public2_nativeAuthorityRequestIdentity,
+	nativeHostEnvironment as public2_nativeHostEnvironment,
 	nativeHostInstrument as public2_nativeHostInstrument,
 	nativePlaceActPersistence as public2_nativePlaceActPersistence,
 	nativePlaceActReceiver as public2_nativePlaceActReceiver,
 	objectFold as public1_objectFold,
 	objectFoldBytes as public1_objectFoldBytes,
-	openAuthenticatedReference as public5_openAuthenticatedReference,
-	preflight as public6_preflight,
+	openAuthenticatedReference as public8_openAuthenticatedReference,
+	parseNativeAuthorityCardRequest as public2_parseNativeAuthorityCardRequest,
+	physicalLinesRegions as public2_physicalLinesRegions,
+	physicalLinesRegions as public5_physicalLinesRegions,
+	preflight as public9_preflight,
+	prepareNativeAuthorityCard as public2_prepareNativeAuthorityCard,
+	prepareNativeProbe as public2_prepareNativeProbe,
 	prepareNativeReadingIdentity as public2_prepareNativeReadingIdentity,
+	prepareNativeViewIdentities as public2_prepareNativeViewIdentities,
 	prepareNativeViewIdentity as public2_prepareNativeViewIdentity,
+	profileDigest as public2_profileDigest,
+	profileDigest as public6_profileDigest,
 	readContent as public1_readContent,
-	readContent as public4_readContent,
+	readContent as public7_readContent,
 	readContextualStandingInProcess as public2_readContextualStandingInProcess,
+	readPlacePhysicalLines as public2_readPlacePhysicalLines,
+	readPlacePhysicalLines as public5_readPlacePhysicalLines,
 	readRefusalCatalog as public1_readRefusalCatalog,
-	readRefusalCatalog as public4_readRefusalCatalog,
+	readRefusalCatalog as public7_readRefusalCatalog,
 	readRootStandingInProcess as public2_readRootStandingInProcess,
 	recoverPlaceActInProcess as public2_recoverPlaceActInProcess,
 	recoverRootActInProcess as public2_recoverRootActInProcess,
+	releaseCategoryPins as public2_releaseCategoryPins,
+	releaseCategoryPins as public6_releaseCategoryPins,
 	retainContent as public1_retainContent,
-	retainContent as public4_retainContent,
+	retainContent as public7_retainContent,
 	rootLotSnapshot as public2_rootLotSnapshot,
 	runConformance as public1_runConformance,
-	runWasmRequest as public6_runWasmRequest,
+	runWasmRequest as public9_runWasmRequest,
+	startNativeHost as public2_startNativeHost,
 	verifyComputation as public1_verifyComputation,
-	verifyModuleDelivery as public3_verifyModuleDelivery,
+	verifyModuleDelivery as public4_verifyModuleDelivery,
 };
 
 export {};