@lapxo/head 0.1.7 → 0.2.0

package/dist/src/ahead/read.d.ts

@@ -4,7 +4,7 @@ import type { Cell } from '../ports/surface.ts';
  * What an answer leaves to do before the next call, done after it is answered; another call coming gives up what is not
  * begun, never what is, so no land is cut halfway:
  * the reads a known next asks for, read in a context that asks the person nothing — a read only, never an act, nothing it
- * would need a yes or a secret for — and then every place the answer names folded again where it moved, so the next
- * question finds it folded. A fold calls no source, so it spends nothing of a place's rate.
+ * would need a yes or a secret for. Each question obtains a fresh native snapshot; speculative recapture cannot validate it.
+ * Reading ahead spends only the source-call budget the place declares.
  */
 export declare const readAhead: (cells: readonly Cell[], context: Context, signal: AbortSignal) => Promise<void>;

package/dist/src/ahead/read.js

@@ -4,8 +4,8 @@ const none = async () => 'none', nothing = async () => undefined;
  * What an answer leaves to do before the next call, done after it is answered; another call coming gives up what is not
  * begun, never what is, so no land is cut halfway:
  * the reads a known next asks for, read in a context that asks the person nothing — a read only, never an act, nothing it
- * would need a yes or a secret for — and then every place the answer names folded again where it moved, so the next
- * question finds it folded. A fold calls no source, so it spends nothing of a place's rate.
+ * would need a yes or a secret for. Each question obtains a fresh native snapshot; speculative recapture cannot validate it.
+ * Reading ahead spends only the source-call budget the place declares.
  */
 export const readAhead = async (cells, context, signal) => {
     const quiet = { ...context, elicit: none, person: { consent: none, enter: nothing, choose: nothing, visit: nothing } };
@@ -13,6 +13,4 @@ export const readAhead = async (cells, context, signal) => {
         if (!signal.aborted && 'tool' in next && next.tool === 'ask' && next.args['source'] && next.args['operation'] && !next.args['why'] && !next.args['history'])
             await readSource({ ...next.args, ahead: 'true' }, quiet);
     await quiet.settle();
-    for (const place of new Set(cells.flatMap((c) => [c.fields['place'] ?? '', 'tool' in c.next ? c.next.args['place'] ?? '' : '']).filter((p) => p && !signal.aborted)))
-        await Promise.all([context.standing(place), context.policy(place)]).catch(() => undefined);
 };

package/dist/src/core/answer.d.ts

@@ -1,4 +1,5 @@
 import { type Said } from './lock.ts';
+import type { authorityAt } from '../ports/host.ts';
 import type { Printed } from '../ports/bound.ts';
 export type Outcome = {
     readonly lines: readonly string[];
@@ -23,6 +24,7 @@ export interface Context {
     } | {
         readonly refused: string;
     }>;
+    readonly authority: (place: string, key: string, kind: string, records: readonly string[], presented?: string) => ReturnType<typeof authorityAt>;
     readonly policy: (place: string) => Promise<{
         readonly lines: readonly Said[];
     } | {

package/dist/src/core/package.js

@@ -5,6 +5,7 @@ import { members, under, valueOf } from "./lock.js";
 import { fieldsOf, vocabOf } from "./read.js";
 import { sayIn } from "./surface.js";
 import { digestIn, linesOf } from "./worlds.js";
+import { sharedBirth } from "../links/birth.js";
 import { linkOf } from "../links/link.js";
 /** A line no package carries: one that is not a world, or a source's document, overlay or pin, said once by digest — with, beside a digest that names bytes, the encrypted address they are read at. */
 export const foreignIn = (lines) => lines.find((l) => !/^(sources\/[a-z0-9-]+(\/overlay)?|uses\/[a-z0-9-]+)$/.test(l.scope ?? '') || lines.some((o) => o !== l && o.scope === l.scope && o.measure === l.measure)
@@ -34,7 +35,8 @@ export const shared = (asked, context) => inPlace(asked, context, async (place)
     catch {
         return {};
     } })()), pack = packed(context, place, held.lines, urls), bytes = new TextEncoder().encode(`${pack.lines.join('\n')}\n`);
-    return !pack.names.length ? [say('share-none', { place })] : ([...pack.files, [LOCK, bytes]].forEach(([at, laid]) => context.files.lay(to, at, laid)), [say('shared', { place, to, sources: pack.names.join(', '), digest: digestIn(context.lock)(bytes) }), ...linkOf(context, to, pack.lines, urls), ...pack.lines]);
+    const birth = sharedBirth(context, to, held.lines);
+    return !pack.names.length ? [say('share-none', { place }), ...birth] : ([...pack.files, [LOCK, bytes]].forEach(([at, laid]) => context.files.lay(to, at, laid)), [say('shared', { place, to, sources: pack.names.join(', '), digest: digestIn(context.lock)(bytes) }), ...linkOf(context, to, pack.lines, urls), ...birth, ...pack.lines]);
 });
 /** What a package names, checked whole before anything is asked: every line a world or a source's document, overlay or pin, by digest; each world the one this head pins; an order its pins rest in. A source whose bytes did not arrive, or did not hash to their line, is open, and so is every source resting on it: absence is not a refusal, and the rest arrives. */
 export const unpacked = (context, document, bytes, read) => {

package/dist/src/doors/head.js

@@ -13,7 +13,7 @@ import { aboutOf, members, valueOf } from "../core/lock.js";
 import { sayIn } from "../core/surface.js";
 import { matchTemplate, refusedOn, shapeOf, surfaceOf } from "../ports/surface.js";
 import { birth, closing, founded, land, landAct, limits, pinnedAt, policyAt, run, settledView, sign, standingAt, told, words } from "../ports/bound.js";
-import { configureHost } from "../ports/host.js";
+import { configureHost, authorityAt } from "../ports/host.js";
 import { held, keep } from "../ports/cache.js";
 import { dropAt, hasAt, layAt, listAt, takeAt } from "../ports/place.js";
 import * as documents from "../ports/documents.js";
@@ -68,10 +68,15 @@ export const headOf = (lock, root, ext, door) => {
         const acted = (place, root, done) => done.then((got) => { if ('lines' in got && !got.lines.every((l) => ((f) => f.kind === 'fact' && read(f.value.fields['at']))(parse(l))))
             moved.add(place); return got; }).finally(() => { forget(place); if (root)
             touched.add(place); });
+        const covered = async (place, lot, then) => {
+            const checked = await authorityAt(place, valueOf(lock, 'founding/root').split('/')[1], 'record-coverage', lot, Date.now(), signal);
+            return 'refused' in checked ? { refused: checked.refused } : checked.decision !== 'allow' ? { refused: `REFUSE·authority-preflight/${checked.decision} ${checked.needs.join('|')}` } : then();
+        };
         return {
             lock,
             bound: (cwd, args) => run(runs, cwd, args, {}, signal),
             standing: (place) => once('standing', place, () => standingAt(runs, place, (lines) => ['head', 'person'].flatMap((role) => ((id) => (id === undefined ? [] : [id]))(idIn(lines, device(role)))), (line) => read(line.at), signal)),
+            authority: (place, key, kind, records, presented) => authorityAt(place, key, kind, records, Date.now(), signal, presented),
             policy: (place) => once('policy', place, () => policyAt(runs, place, signal)),
             world: (place, view) => once(`world/${view}`, place, () => settledView(runs, place, view, signal)),
             adapter: async (origin) => ((name) => (!/^[a-z-]+$/.test(name) ? undefined : import(__rewriteRelativeImportExtension(new URL(`../ports/adapters/${name}${ext}`, import.meta.url).href))))(URL.canParse(origin) ? valueOf(lock, `adapter/${new URL(origin).protocol.slice(0, -1)}`) : ''),
@@ -79,8 +84,8 @@ export const headOf = (lock, root, ext, door) => {
             home: () => home,
             personal: () => process.env[valueOf(lock, `platform/${process.platform}/home`)] ?? '',
             found: (place, account) => acted(place, true, founded(runs, place, ...asRoot(account), signal)),
-            signRoot: (place, lot, account) => sign(runs, place, lot, ...asRoot(account), signal),
-            landRoot: (place, lot, account) => acted(place, true, landAct(runs, place, lot, ...asRoot(account), signal)),
+            signRoot: (place, lot, account) => covered(place, lot, () => sign(runs, place, lot, ...asRoot(account), signal)),
+            landRoot: (place, lot, account) => acted(place, true, covered(place, lot, () => landAct(runs, place, lot, ...asRoot(account), signal))),
             moved: (place) => moved.has(place),
             settle: async () => { const red = []; for (const place of touched) {
                 const why = await closing(runs, place, signal);

package/dist/src/flows/device.d.ts

@@ -17,6 +17,9 @@ export declare const rootIn: (context: Context, place: string) => {
  * lock as its parent has nothing signed here: what the parent would cut is bound's to judge.
  */
 type By = {
+    readonly key: string;
+    readonly root: boolean;
+    readonly records: (lot: readonly string[]) => readonly string[];
     readonly sign: (lot: readonly string[]) => Promise<Outcome>;
     readonly land: (lot: readonly string[]) => Promise<Outcome>;
 };

package/dist/src/flows/device.js

@@ -17,7 +17,7 @@ export const widening = (context, place, lines, lot) => {
     const witnessed = (signed) => signed.map((line) => ((got) => (got.kind === 'fact' ? canonical({ ...got.value.fields, [field]: witness }) : line))(parse(line)));
     if ('account' in root && witness !== undefined) {
         if (admits || lot.every((line) => / scope=wire\/fields /.test(line)))
-            return { sign: (signed) => context.signRoot(place, admits ? witnessed(signed) : signed, root.account), land: (signed) => context.landRoot(place, admits ? witnessed(signed) : signed, root.account) };
+            return { key: valueOf(context.lock, 'founding/root').split('/')[1], root: true, records: (signed) => admits ? witnessed(signed) : signed, sign: (signed) => context.signRoot(place, admits ? witnessed(signed) : signed, root.account), land: (signed) => context.landRoot(place, admits ? witnessed(signed) : signed, root.account) };
         const [named, bare] = [[...new Set([...wire.flatMap((l) => members(l.value ?? '')), field])].join('|'), (l) => Object.fromEntries(Object.entries(l).filter(([k]) => !['sig', 'epoch'].includes(k)))];
         return { said: [sayIn(context.lock)('unwitnessed', { place }), ...wire.map((l) => canonical({ ...bare(l), by: 'target', value: 'withdraw' })),
                 canonical({ at: `policy:head/wire/${new Date(context.now()).toISOString()}`, by: 'target', form: 'alphabet', measure: 'id', role: 'reads', scope: 'wire/fields', value: named })] };
@@ -26,5 +26,5 @@ export const widening = (context, place, lines, lot) => {
     if (stopped)
         return { said: stopped };
     const again = lot.flatMap((line) => ((got) => (got.kind === 'fact' && lines.some((l) => l.scope === got.value.fields.scope && l.measure === got.value.fields.measure) ? [got.value.fields.scope ?? ''] : []))(parse(line)))[0];
-    return again !== undefined ? { said: [sayIn(context.lock)('attested-again', { place, scope: again })] } : { sign: (signed) => context.signAs(place, signed, 'person', lines), land: (signed) => context.landAs(place, signed, 'person', lines) };
+    return again !== undefined ? { said: [sayIn(context.lock)('attested-again', { place, scope: again })] } : { key: witness, root: false, records: (signed) => signed, sign: (signed) => context.signAs(place, signed, 'person', lines), land: (signed) => context.landAs(place, signed, 'person', lines) };
 };

package/dist/src/flows/plan.d.ts

@@ -1,4 +1,6 @@
 import type { Asked, Context } from '../core/answer.ts';
+/** Bound observes exact configuration records; Q4 domain checks remain in Head's existing card. */
+export declare const authorityFor: (context: Context, place: string, key: string, kind: string, records: readonly string[], observe?: boolean, presented?: string) => Promise<readonly string[] | undefined>;
 /**
  * A proposal the person signs: drafted lines shown to the person with the place and the base they are made against; on
  * their yes to exactly those, signed by their key; what bound prints folding it as if landed comes back as it printed it. Nothing lands; the lot is kept by its digest.

package/dist/src/flows/plan.js

@@ -3,6 +3,13 @@ import { sayIn } from "../core/surface.js";
 import { widening } from "./device.js";
 import { parse } from '@lapxo/topos/wire';
 const moved = async (context, place, base) => ((now) => ('said' in now ? now.said : baseOf(now.lines) !== base ? [sayIn(context.lock)('base-moved', { base })] : undefined))(await standingOr(context, place));
+/** Bound observes exact configuration records; Q4 domain checks remain in Head's existing card. */
+export const authorityFor = async (context, place, key, kind, records, observe = false, presented) => {
+    const result = await context.authority(place, key, kind, records, presented), say = sayIn(context.lock);
+    if ('refused' in result)
+        return [say('authority-refused', { place, key, kind, why: result.refused, code: result.code })];
+    return observe || result.decision !== 'allow' ? [say(observe ? 'authority-card' : result.decision === 'deny' ? 'authority-refused' : 'authority-needed', { place, key, kind, decision: result.decision, authority: result.authority, request: result.request, needs: result.needs.join('|'), why: result.decision })] : undefined;
+};
 /**
  * A proposal the person signs: drafted lines shown to the person with the place and the base they are made against; on
  * their yes to exactly those, signed by their key; what bound prints folding it as if landed comes back as it printed it. Nothing lands; the lot is kept by its digest.
@@ -19,6 +26,9 @@ export const planLot = (asked, context) => inPlace(asked, context, async (place)
     const by = widening(context, place, held.lines, lot);
     if ('said' in by)
         return by.said;
+    const initial = by.root ? await authorityFor(context, place, by.key, 'record-coverage', by.records(lot)) : undefined;
+    if (initial)
+        return initial;
     const consent = await context.elicit(say('elicit', { count: String(lot.length), place, base, lines: lot.join('\n') }));
     if (consent === 'none')
         return [say('sign-yourself', { place }), ...lot];
@@ -30,7 +40,7 @@ export const planLot = (asked, context) => inPlace(asked, context, async (place)
     const stale = await moved(context, place, base);
     if (stale)
         return stale;
-    const kept = context.cache.keep(Buffer.from(JSON.stringify({ place, base, signed: signed.lines })));
+    const kept = context.cache.keep(Buffer.from(JSON.stringify({ place, base, signed: signed.lines, root: by.root })));
     return [say('planned', { lot: kept, base }), ...(await context.told(place, signed.lines))];
 });
 /** A planned lot landed by its digest, only while the place stands on the base it was planned against. */
@@ -43,6 +53,10 @@ export const landLot = async (asked, context) => {
     const stale = await moved(context, kept.place, kept.base);
     if (stale)
         return stale;
+    const author = parse(kept.signed[0] ?? '');
+    const checked = kept.root ? await authorityFor(context, kept.place, author.kind === 'fact' ? author.value.fields.by ?? '' : '', 'admission', kept.signed) : undefined;
+    if (checked)
+        return checked;
     const landed = await context.land(kept.place, kept.signed);
     return 'refused' in landed ? [landed.refused] : [say('landed', { count: String(landed.lines.length) }), ...landed.lines];
 };

package/dist/src/links/birth.d.ts

@@ -0,0 +1,6 @@
+import { type Asked, type Context } from '../core/answer.ts';
+import { type Said } from '../core/lock.ts';
+/** A separate public birth artifact. The source package, authority and personal birth journal are not its payload. */
+export declare const sharedBirth: (context: Context, to: string, standing: readonly Said[]) => readonly string[];
+/** Inline or client-shared local birth bytes are inspected only; no transport, signer, file write or admission is acquired. */
+export declare const receivedBirth: (asked: Asked, context: Context) => Promise<readonly string[] | undefined>;

package/dist/src/links/birth.js

@@ -0,0 +1,48 @@
+import { basename, join } from 'node:path';
+import { canonical, parse } from '@lapxo/topos/wire';
+import { PORTABLE_BIRTH_PROFILE, decodePortableBirth, encodePortableBirth, inspectPortableBirth } from '@lapxo/topos/contract';
+import { semanticStandingBytes } from '@lapxo/topos/standing';
+import { inStanding } from "../core/answer.js";
+import { members, valueOf } from "../core/lock.js";
+import { sayIn } from "../core/surface.js";
+import { digestIn } from "../core/worlds.js";
+const budget = (context) => ({ bytes: Number(valueOf(context.lock, 'bound/printed').split('..')[1]), items: Number(valueOf(context.lock, 'share/birth-items').split('..')[1]) });
+const refused = (context, error) => [sayIn(context.lock)('birth-refused', { why: error instanceof Error ? error.message : String(error) })];
+/** A separate public birth artifact. The source package, authority and personal birth journal are not its payload. */
+export const sharedBirth = (context, to, standing) => {
+    const say = sayIn(context.lock), scopes = members(valueOf(context.lock, 'share/birth-scopes')), file = valueOf(context.lock, 'share/birth-file');
+    const declarations = standing.filter(line => scopes.includes(line.scope ?? '')).map(({ by: _by, sig: _sig, epoch: _epoch, ...line }) => canonical(line));
+    if (!declarations.length)
+        return [say('birth-empty')];
+    try {
+        const record = encodePortableBirth({ origin: digestIn(context.lock)(semanticStandingBytes(standing.map(line => canonical(line)))), declarations }, budget(context)), bytes = new TextEncoder().encode(record);
+        context.files.lay(to, file, bytes);
+        return [say('birth-shared', { document: join(to, file), digest: digestIn(context.lock)(bytes), record })];
+    }
+    catch (error) {
+        return refused(context, error);
+    }
+};
+/** Inline or client-shared local birth bytes are inspected only; no transport, signer, file write or admission is acquired. */
+export const receivedBirth = async (asked, context) => {
+    const document = asked['document'] ?? '', inline = document.startsWith(PORTABLE_BIRTH_PROFILE.split('/')[0] + '/');
+    if (!inline && !(document.startsWith('/') && basename(document) === valueOf(context.lock, 'share/birth-file')))
+        return undefined;
+    return inStanding(asked, context, async (place, standing) => {
+        const say = sayIn(context.lock), bytes = inline ? new TextEncoder().encode(document) : (await context.files.read.documentOf(context, place, document))?.bytes;
+        if (!bytes)
+            return [say('birth-needs', { document })];
+        if (asked['digest'] && digestIn(context.lock)(bytes) !== asked['digest'])
+            return [say('document-digest', { document: inline ? PORTABLE_BIRTH_PROFILE : document, digest: asked['digest'], got: digestIn(context.lock)(bytes) })];
+        try {
+            const pack = decodePortableBirth(new TextDecoder().decode(bytes), budget(context)), allowed = members(valueOf(context.lock, 'share/birth-scopes'));
+            if (pack.declarations.some(line => ((p) => p.kind !== 'fact' || !allowed.includes(p.value.fields.scope ?? ''))(parse(line))))
+                return [say('birth-refused', { why: 'declaration outside the public birth selection' })];
+            const inspected = inspectPortableBirth(pack, [...new Set(standing.flatMap(line => line.scope ?? []))], budget(context));
+            return [say('birth-inspected', { inspection: inspected.status, collisions: inspected.collisions.join(', ') || 'none', origin: pack.origin, declarations: pack.declarations.join('\n') })];
+        }
+        catch (error) {
+            return refused(context, error);
+        }
+    }, context.policy);
+};

package/dist/src/links/inspect.d.ts

@@ -1,6 +1,6 @@
 import { type Asked, type Context } from '../core/answer.ts';
 /**
- * A #bound: link connected: inspected by the instrument in the person's place, never authenticated — its bytes are the
+ * A legacy or located reference connected: inspected by the instrument in the person's place, never authenticated — its bytes are the
  * link's, and nothing shows who shared it — and what it names is shown; nothing is connected or granted, since a package
  * is received by the digest its sharer sent apart. A place that admits no content transport is handed the lines that admit
  * one, to sign; bytes that do not arrive are owed by the link until they do; bytes that are not what it names are refused.

package/dist/src/links/inspect.js

@@ -1,4 +1,5 @@
 import { decodeReference } from '@lapxo/bound/reference';
+import { decodeLocatedReference, locatedReferenceIdentity } from '@lapxo/topos/contract';
 import { canonical } from '@lapxo/topos/wire';
 import { inStanding } from "../core/answer.js";
 import { members, valueOf } from "../core/lock.js";
@@ -6,7 +7,7 @@ import { sayIn } from "../core/surface.js";
 import { linesOf } from "../core/worlds.js";
 import { rootIn } from "../flows/device.js";
 /**
- * A #bound: link connected: inspected by the instrument in the person's place, never authenticated — its bytes are the
+ * A legacy or located reference connected: inspected by the instrument in the person's place, never authenticated — its bytes are the
  * link's, and nothing shows who shared it — and what it names is shown; nothing is connected or granted, since a package
  * is received by the digest its sharer sent apart. A place that admits no content transport is handed the lines that admit
  * one, to sign; bytes that do not arrive are owed by the link until they do; bytes that are not what it names are refused.
@@ -18,25 +19,35 @@ export const linked = (asked, context) => inStanding(asked, context, async (plac
         return [...standing.filter((l) => admits.includes(l.scope ?? '') || l.scope?.startsWith('transport/')).map((l) => canonical(l)), say('why-transport', { place })];
     const lines = context.lock.filter((l) => admits.some((s) => l.scope === `birth/${s}`)).map(({ about: _about, scope, ...l }) => canonical({ ...l, scope: scope.slice('birth/'.length), at: 'policy:person/transport', by: 'target' }));
     let reference;
+    const legacy = link.startsWith(word('link/prefix'));
     try {
-        reference = decodeReference(link);
+        reference = legacy ? (({ source, ...held }) => ({ ...held, location: source, 'location-class': 'holder' }))(decodeReference(link)) : decodeLocatedReference(link);
     }
     catch (refused) {
         return [say('link-refused', { link, why: refused instanceof Error ? refused.message : String(refused) })];
     }
-    if (![admits[0], `transport/${new URL(reference.source).protocol.slice(0, -1)}`].every((s) => standing.some((l) => l.scope === s)))
+    const identity = legacy ? link : locatedReferenceIdentity(reference), source = reference.location;
+    if (!source || reference['location-class'] === 'viewer')
+        return [say('reference-needs', { identity, needs: 'bytes/holder-location' })];
+    if (![admits[0], `transport/${new URL(source).protocol.slice(0, -1)}`].every((s) => standing.some((l) => l.scope === s)))
         return [say('transport-missing', { place, lines: lines.join('\n') })];
-    const [printed, scope] = [await context.bound(place, [word('bound/read'), link]), `${word('place/needs')}/bytes/${reference.blob.slice(reference.algorithm.length + 1, reference.algorithm.length + 17)}`];
-    const [owed, root, why] = [standing.find((l) => l.scope === scope && l.role === 'demands' && l.value === link), rootIn(context, place), printed?.err.filter((l) => !l.startsWith('{')).at(-1) ?? ''];
-    if ('said' in root)
-        return root.said;
+    const [printed, scope] = [await context.bound(place, [word('bound/read'), link]), `${word('place/needs')}/bytes/${reference.blob.slice(reference.algorithm.length + 1, legacy ? reference.algorithm.length + 17 : undefined)}`];
+    const [owed, why, absent] = [standing.find((l) => l.scope === scope && l.role === 'demands' && l.value === identity), printed?.err.filter((l) => !l.startsWith('{')).at(-1) ?? '', printed?.out.some((line) => line.startsWith('NEEDS '))];
     if (printed?.code !== 0 && !why.includes(word('link/unarrived')))
         return [say('link-refused', { link, why })];
-    const settled = (lot) => (lot.length ? context.landRoot(place, lot, root.account).then((got) => ('refused' in got ? say('not-landed', { why: got.refused }) : got.lines)) : Promise.resolve([]));
-    const due = { at: 'policy:head/link', by: 'target', form: 'alphabet', measure: 'id', role: 'demands', scope, value: link };
-    if (printed?.code !== 0)
-        return [say('link-owed', { place, source: reference.source }), ...await settled(owed ? [] : [canonical(due)])];
+    const settled = async (lot) => {
+        if (!lot.length)
+            return [];
+        const root = rootIn(context, place);
+        if ('said' in root)
+            return root.said;
+        const got = await context.landRoot(place, lot, root.account);
+        return 'refused' in got ? [say('not-landed', { why: got.refused })] : got.lines;
+    };
+    const due = { at: 'policy:head/link', by: 'target', form: 'alphabet', measure: 'id', role: 'demands', scope, value: identity };
+    if (printed?.code !== 0 || absent)
+        return [say('link-owed', { place, source }), ...await settled(owed ? [] : [canonical(due)])];
     const named = linesOf(new TextEncoder().encode(printed.out.filter((l) => l.startsWith('TOPOS ')).map((l) => l.slice('TOPOS '.length)).join('\n')));
     const sources = named.filter((l) => /^sources\/[^/]+$/.test(l.scope ?? '')).map((l) => l.scope.split('/')[1]);
-    return [say('inspected', { source: reference.source, sources: sources.join(', ') || '—', digest: reference.digest }), say('sharer-unverified', {}), ...await settled(owed ? [canonical({ ...due, value: 'withdraw' })] : [])];
+    return [say('inspected', { source, sources: sources.join(', ') || '—', digest: reference.digest }), say('sharer-unverified', {}), ...await settled(owed ? [canonical({ ...due, value: 'withdraw' })] : [])];
 }, context.policy);

package/dist/src/links/link.d.ts

@@ -1,7 +1,7 @@
 import type { Context } from '../core/answer.ts';
 /**
  * A package's link: its lines as one standing document, laid in its folder as it is to be published — the link names that
- * document's bytes, never the package's files — and the #bound: link to it at the address the person publishes it at.
- * With no address there is no link, said so: a link needs where its bytes are published, and the digest still goes apart.
+ * document's bytes, never the package's files. The separate located profile keeps retrieval apart from content identity.
+ * Without a location the reference still names its content; it does not invent a holder or transfer authority.
  */
 export declare const linkOf: (context: Context, to: string, lines: readonly string[], urls: Readonly<Record<string, string>>) => readonly string[];

package/dist/src/links/link.js

@@ -1,25 +1,22 @@
-import { createHash } from 'node:crypto';
 import { join } from 'node:path';
-import { encodeReference } from '@lapxo/bound/reference';
+import { encodeLocatedReference } from '@lapxo/topos/contract';
 import { semanticStandingBytes } from '@lapxo/topos/standing';
 import { members, valueOf } from "../core/lock.js";
 import { sayIn } from "../core/surface.js";
-const sha = (bytes) => createHash('sha256').update(bytes).digest('hex');
+import { digestIn } from "../core/worlds.js";
 /**
  * A package's link: its lines as one standing document, laid in its folder as it is to be published — the link names that
- * document's bytes, never the package's files — and the #bound: link to it at the address the person publishes it at.
- * With no address there is no link, said so: a link needs where its bytes are published, and the digest still goes apart.
+ * document's bytes, never the package's files. The separate located profile keeps retrieval apart from content identity.
+ * Without a location the reference still names its content; it does not invent a holder or transfer authority.
  */
 export const linkOf = (context, to, lines, urls) => {
-    const say = sayIn(context.lock), [name, profile, [kind, algorithm]] = [valueOf(context.lock, 'link/document'), valueOf(context.lock, 'link/profile'), members(valueOf(context.lock, 'link/reference'))];
+    const say = sayIn(context.lock), digest = digestIn(context.lock), [name, profile, [kind, algorithm]] = [valueOf(context.lock, 'link/document'), valueOf(context.lock, 'link/profile'), members(valueOf(context.lock, 'link/reference'))];
     const standing = semanticStandingBytes(lines), bytes = new TextEncoder().encode(JSON.stringify({ profile, standing })), at = urls[name], document = join(to, name);
     context.files.lay(to, name, bytes);
-    if (at === undefined || !URL.canParse(at))
-        return [say('shared-unlinked', { document })];
     try {
-        return [say('shared-link', { document, at, link: encodeReference({ class: kind, algorithm, digest: sha(standing), blob: `${algorithm}:${sha(bytes)}`, source: new URL(at).href }) })];
+        return [say(at === undefined ? 'shared-unlinked' : 'shared-link', { document, at: at ?? '', link: encodeLocatedReference({ class: kind, algorithm, digest: digest(standing).slice(7), blob: digest(bytes), ...(at === undefined ? {} : { location: new URL(at).href, 'location-class': 'holder' }) }) })];
     }
     catch (refused) {
-        return [say('link-refused', { link: at, why: refused instanceof Error ? refused.message : String(refused) })];
+        return [say('link-refused', { link: name, why: refused instanceof Error ? refused.message : String(refused) })];
     }
 };

package/dist/src/ports/bound.d.ts

@@ -14,7 +14,6 @@ export type Folded = {
 } | {
     readonly refused: string;
 };
-/** Read normative standing plus authenticated device evidence; ambiguous device history refuses. */
 export declare const policyAt: (name: string, place: string, signal?: AbortSignal) => Promise<Folded>;
 export declare const standingAt: (name: string, place: string, devicesOf: (lines: readonly Said[]) => readonly string[], isHistory: (line: Said) => boolean, signal?: AbortSignal) => Promise<Folded>;
 /** A sign or a land: in a host of its own for this one call, signed by head's signer through the port of the key it names, the lot handed in as the host's input. */

package/dist/src/ports/bound.js

@@ -4,10 +4,9 @@ import { dirname, join } from 'node:path';
 import { canonical, LOCK, parse } from '@lapxo/topos/wire';
 import { factsOf } from "../core/lock.js";
 import { spawned } from "./process.js";
-import { hosted, hosting, signedIn } from "./host.js";
+import { capturedViews, hosted, hosting, signedIn } from "./host.js";
 import { cleared, scratchOf } from "./scratch.js";
 import { folded } from "../ahead/fold.js";
-import { readingOf } from "./reading.js";
 const binOf = (name) => {
     try {
         const manifest = createRequire(import.meta.url).resolve(join(name, 'package.json'));
@@ -40,21 +39,21 @@ const isRecord = (line) => line.startsWith('{') && recordOf(line) !== undefined;
 const apart = (printed) => ((record) => (record === undefined ? printed : { ...printed, refusal: recordOf(record) }))([...printed.err].reverse().find(isRecord));
 const why = (printed) => printed?.err.filter((line) => !isRecord(line)).at(-1);
 const readOf = (printed) => (printed === undefined || printed.code !== 0 ? { refused: why(printed) ?? '' } : { lines: factsOf(printed.out) });
-/** Native identities and expected-identity results come from the same public CLI contract. Without it, read fresh. */
-const nativeView = (name, place, view, signal) => {
-    const read = async (expected) => {
-        if (expected === undefined)
-            return readOf(await run(name, place, [words.read, words.view, view], {}, signal));
-        const result = readingOf(await run(name, place, [words.read, words.view, `${words.identity}@${view}@${expected}`], {}, signal), view, expected);
-        return 'refused' in result ? result : { lines: factsOf(result.text.split('\n')) };
-    };
-    return !words.identity ? read() : folded(`${name}/${view}`, place, async () => { const result = readingOf(await run(name, place, [words.read, words.view, `${words.identity}@${view}`], {}, signal), view); return 'refused' in result ? undefined : result.identity; }, read);
+/** Only the requested views are captured by Bound; every result binds its text to the actual current native identity. */
+const nativeViews = async (name, place, views, signal) => {
+    const captured = capturedViews(place, views, signal);
+    if (captured?.kind === 'refuse' && captured.code === 'host/instrument-pin')
+        return views.map(() => ({ refused: captured.diagnostic }));
+    return Promise.all(views.map(async (view) => {
+        const result = captured?.kind === 'fact' ? captured.views.find((one) => one.view === view) : undefined;
+        const read = result ? await folded(`${name}/${view}`, place, async () => result.identity, async () => ({ lines: factsOf(result.text.split('\n')) })) : readOf(await run(name, place, [words.read, words.view, view], {}, signal));
+        return 'refused' in read || view !== words.standing || read.lines.some((line) => line.scope === words.profile) ? read
+            : { refused: `REFUSE·act the place declares no ${words.profile}: land would print nothing of what it admits, so head lands nothing there; its root can land the local-act@1 profile and view/act` };
+    }));
 };
-/** Read normative standing plus authenticated device evidence; ambiguous device history refuses. */
-export const policyAt = async (name, place, signal) => ((folded) => ('refused' in folded || folded.lines.some((line) => line.scope === words.profile) ? folded
-    : { refused: `REFUSE·act the place declares no ${words.profile}: land would print nothing of what it admits, so head lands nothing there; its root can land the local-act@1 profile and view/act` }))(await nativeView(name, place, words.standing, signal));
+export const policyAt = async (name, place, signal) => (await nativeViews(name, place, [words.standing], signal))[0];
 export const standingAt = async (name, place, devicesOf, isHistory, signal) => {
-    const [folded, evidence] = await Promise.all([policyAt(name, place, signal), nativeView(name, place, words.evidence, signal)]);
+    const [folded, evidence] = await nativeViews(name, place, [words.standing, words.evidence], signal);
     if ('refused' in folded)
         return folded;
     if ('refused' in evidence)

package/dist/src/ports/host.d.ts

@@ -10,6 +10,11 @@ export declare const hosting: {
     bytes: number;
     heap: number;
     queued: number;
+    authority: {
+        clock: string;
+        unit: string;
+        items: number;
+    };
     http: NativeHostOptions["http"];
 };
 /** Receiver permissions and work budgets are declared by head's own lock, never inferred from a redirect. */
@@ -21,6 +26,8 @@ export declare const configureHost: (lock: readonly Said[], bounds: {
 export declare const cooled: () => void;
 /** The process a place's fold host runs as, while one is held for it. */
 export declare const hostOf: (place: string) => number | undefined;
+/** Native read-only snapshots use Bound's actual caller environment; their identities are not borrowed from a different CLI context. */
+export declare const capturedViews: (place: string, views: readonly string[], signal?: AbortSignal, from?: string) => import("@lapxo/bound/host").NativeViewIdentitiesResult | undefined;
 /**
  * A read of a place's view through the place's own fold host, which only folds and never holds a signer: started on the first
  * read, kept while it is asked within its idle and its life, the installed bound checked file by file before every call.
@@ -33,3 +40,14 @@ export declare const hosted: (place: string, args: readonly string[], signal?: A
  * host at a time; the lot goes in as the host's input, never a file of head's.
  */
 export declare const signedIn: (place: string, args: readonly string[], lot: readonly string[] | undefined, signers: NonNullable<NativeHostOptions["signers"]>, keyId?: string, signal?: AbortSignal, from?: string) => Promise<Printed>;
+export type AuthorityObservation = {
+    readonly refused: string;
+    readonly code: string;
+} | {
+    readonly authority: string;
+    readonly request: string;
+    readonly decision: 'allow' | 'ask' | 'deny' | 'open';
+    readonly needs: readonly string[];
+};
+/** Configuration-only observations at an explicit receiver clock; no signing, admission or API execution occurs here. */
+export declare const authorityAt: (place: string, key: string, kind: string, records: readonly string[], now: number, signal?: AbortSignal, presented?: string) => Promise<AuthorityObservation>;

package/dist/src/ports/host.js

@@ -1,20 +1,21 @@
 import { createHash } from 'node:crypto';
-import { mkdtempSync, readdirSync, readFileSync, realpathSync, rmSync, statSync } from 'node:fs';
+import { mkdtempSync, readdirSync, readFileSync, realpathSync, rmSync } from 'node:fs';
 import { createRequire } from 'node:module';
 import { tmpdir } from 'node:os';
 import { dirname, join, relative, sep } from 'node:path';
-import { installedHostInstrument, nativeHostEnvironment, startNativeHost } from '@lapxo/bound/host';
+import { installedHostInstrument, nativeHostEnvironment, prepareNativeViewIdentities, prepareNativeAuthorityCard, answerNativeAuthorityCard, nativeAuthorityRequestIdentity, startNativeHost } from '@lapxo/bound/host';
+import { decodeAuthorityCard } from '@lapxo/topos/contract';
 import { members, valueOf } from "../core/lock.js";
 /** What a place's fold host is held to, from head's lock: the installed instrument it must be, how long it stays idle and lives, and its limits. */
-export const hosting = { installed: '', idle: 0, life: 0, wait: 0, bytes: 0, heap: 0, queued: 0, http: undefined };
+export const hosting = { installed: '', idle: 0, life: 0, wait: 0, bytes: 0, heap: 0, queued: 0, authority: { clock: '', unit: '', items: 0 }, http: undefined };
 /** Receiver permissions and work budgets are declared by head's own lock, never inferred from a redirect. */
-export const configureHost = (lock, bounds) => { Object.assign(hosting, { installed: valueOf(lock, 'dep/bound/installed'), wait: bounds.wait, bytes: bounds.most, ...Object.fromEntries(['idle', 'life', 'heap', 'queued'].map((k) => [k, Number(valueOf(lock, `bound/host/${k}`).split('..')[1])])), http: { origins: members(valueOf(lock, 'bound/receiver/origins')), redirects: { maxRedirects: Number(valueOf(lock, 'bound/receiver/redirects').split('..')[1]), headerBytes: Number(valueOf(lock, 'bound/receiver/header-bytes').split('..')[1]) } } }); };
+export const configureHost = (lock, bounds) => { Object.assign(hosting, { installed: valueOf(lock, 'dep/bound/installed'), wait: bounds.wait, bytes: bounds.most, ...Object.fromEntries(['idle', 'life', 'heap', 'queued'].map((k) => [k, Number(valueOf(lock, `bound/host/${k}`).split('..')[1])])), authority: { clock: valueOf(lock, 'bound/authority/clock'), unit: valueOf(lock, 'bound/authority/unit'), items: Number(valueOf(lock, 'bound/authority/items').split('..')[1]) }, http: { origins: members(valueOf(lock, 'bound/receiver/origins')), redirects: { maxRedirects: Number(valueOf(lock, 'bound/receiver/redirects').split('..')[1]), headerBytes: Number(valueOf(lock, 'bound/receiver/header-bytes').split('..')[1]) } } }); };
 const root = dirname(createRequire(import.meta.url).resolve('@lapxo/bound/package.json'));
-const walk = (at) => (statSync(at).isDirectory() ? readdirSync(at).flatMap((e) => walk(join(at, e))) : [at]);
+const walk = (at) => readdirSync(at, { withFileTypes: true }).flatMap((e) => e.isDirectory() ? walk(join(at, e.name)) : [join(at, e.name)]);
 /** Every file of the installed bound by its coordinate and digest: what its identity is computed from, and what is checked again before each call. */
 const inventory = (at) => walk(at).map((f) => ({ coordinate: relative(at, f).split(sep).join('/'), digest: `sha256:${createHash('sha256').update(readFileSync(f)).digest('hex')}` })).sort((a, b) => (a.coordinate < b.coordinate ? -1 : 1));
-/** The hosts held, those starting, those closing — a place gets its next host once its last one is gone — and the folders head made for their scratch, each removed once its host is. */
-const [live, starting, closing, scratches] = [new Map(), new Map(), new Map(), new Set()];
+/** Held, starting and closing hosts, their owned scratch, and one instrument descriptor reused only after its complete current byte inventory matches. */
+const [live, starting, closing, scratches, selected] = [new Map(), new Map(), new Map(), new Set(), { root: '', members: '', instrument: undefined }];
 const cleared = (dir) => { rmSync(dir, { recursive: true, force: true }); scratches.delete(dir); };
 const shut = (at) => { const one = live.get(at); live.delete(at); if (one) {
     clearTimeout(one.idle);
@@ -27,13 +28,34 @@ export const cooled = () => { for (const at of [...live.keys()])
 export const hostOf = (place) => live.get(realpathSync(place))?.host.pid;
 process.once('exit', () => { cooled(); for (const dir of [...scratches])
     cleared(dir); });
+/** One verified installed descriptor, reused only after hashing every current installed member. */
+const instrumentAt = (from) => {
+    const members = inventory(from), current = JSON.stringify(members);
+    const instrument = selected.root === from && selected.members === current ? selected.instrument : Object.assign(selected, { root: from, members: current, instrument: installedHostInstrument({ directory: from, shape: 'package', members, exports: [['exports', './engine', 'default']], pins: [], limits: { members: 4096, bytes: 1 << 27, responseBytes: 1 << 22 } }, join(from, 'dist/cli/verb.js')) }).instrument;
+    return { members: current, instrument };
+};
+const pinnedInstrument = (from) => { const { instrument } = instrumentAt(from); if (instrument.installed?.digest !== hosting.installed)
+    throw Error('REFUSE·host/instrument-pin'); return instrument; };
+/** Native read-only snapshots use Bound's actual caller environment; their identities are not borrowed from a different CLI context. */
+export const capturedViews = (place, views, signal, from = root) => {
+    try {
+        if (signal?.aborted)
+            return undefined;
+        const instrument = pinnedInstrument(from);
+        return prepareNativeViewIdentities({ place, views, instrument });
+    }
+    catch (error) {
+        cooled();
+        return { kind: 'refuse', code: 'host/instrument-pin', diagnostic: error.message };
+    }
+};
 /** A host started on a place, on the installed instrument the lock pins and in a scratch folder of head's own; with signers only for one call's sign or land. */
 const opened = async (at, from, signers) => {
-    const members = inventory(from), instrument = installedHostInstrument({ directory: from, shape: 'package', members, exports: [['exports', './engine', 'default']], pins: [], limits: { members: 4096, bytes: 1 << 27, responseBytes: 1 << 22 } }, join(from, 'dist/cli/verb.js'));
+    const { members, instrument } = instrumentAt(from);
     const scratch = mkdtempSync(join(tmpdir(), 'head-host-'));
     scratches.add(scratch);
     const host = await startNativeHost({ place: at, instrument, expectedInstrument: hosting.installed, environment: nativeHostEnvironment({ ...process.env }), scratchParent: scratch, ...(hosting.http ? { http: hosting.http } : {}), ...(signers ? { signers } : {}), limits: { requestBytes: hosting.bytes, responseBytes: hosting.bytes, timeoutMs: hosting.wait, heapMiB: hosting.heap, queuedRequests: hosting.queued } }).catch((e) => { cleared(scratch); throw e; });
-    return { host, members: JSON.stringify(members), born: Date.now(), scratch, busy: 0 };
+    return { host, members, born: Date.now(), scratch, busy: 0 };
 };
 const started = async (at, from) => ((one) => (live.set(at, one), one))(await opened(at, from));
 const lines = (text) => text.split('\n').filter(Boolean), refused = (why) => ({ code: -1, out: [], err: [why] });
@@ -106,3 +128,30 @@ export const signedIn = async (place, args, lot, signers, keyId, signal, from =
         cleared(one.scratch);
     }
 };
+/** Configuration-only observations at an explicit receiver clock; no signing, admission or API execution occurs here. */
+export const authorityAt = async (place, key, kind, records, now, signal, presented) => {
+    const current = () => { if (signal?.aborted)
+        throw Error('REFUSE·authority-preflight/cancelled'); };
+    try {
+        current();
+        const instrument = pinnedInstrument(root);
+        const action = { kind, records }, clock = { name: hosting.authority.clock, unit: hosting.authority.unit, now };
+        const context = { root: realpathSync(place), place: '.', key, instrument, clock, horizon: { clock: clock.name, unit: clock.unit, from: now, through: now }, limits: { bytes: hosting.bytes, items: hosting.authority.items }, actions: ['record-coverage', 'admission'].includes(kind) ? [action] : [] };
+        if (!clock.name || !clock.unit || !Number.isSafeInteger(now) || hosting.authority.items < 1)
+            throw Error('REFUSE·authority-preflight/context');
+        const prepared = await prepareNativeAuthorityCard(context);
+        if (prepared.kind !== 'fact')
+            return { refused: prepared.diagnostic, code: prepared.code };
+        const request = nativeAuthorityRequestIdentity(action), card = presented ? decodeAuthorityCard(presented, context.limits) : prepared.value.card;
+        const answer = await answerNativeAuthorityCard(card, request, context);
+        current();
+        if ('kind' in answer)
+            return { refused: answer.diagnostic, code: answer.code };
+        if (answer.status === 'refused')
+            return { refused: `REFUSE·${answer.code}`, code: answer.code };
+        return { authority: prepared.value.line, request, decision: answer.status === 'observed' ? answer.decision : 'open', needs: answer.status === 'open' ? answer.needs : prepared.value.needs };
+    }
+    catch (error) {
+        return { refused: error instanceof Error ? error.message : String(error), code: 'authority-preflight/context' };
+    }
+};

package/dist/src/sources/connect.js

@@ -1,6 +1,6 @@
 import { canonical, EXTENSION } from '@lapxo/topos/wire';
 import { inPlace, placeOf, unless } from "../core/answer.js";
-import { valueOf } from "../core/lock.js";
+import { members, valueOf } from "../core/lock.js";
 import { fieldsOf, vocabOf } from "../core/read.js";
 import { redIn, sayIn } from "../core/surface.js";
 import { digestIn, linesOf } from "../core/worlds.js";
@@ -9,6 +9,7 @@ import { paidBy, pinIn } from "../compile/pin.js";
 import { adopted } from "../adopt/adopt.js";
 import { firstRun } from "../onboard/first.js";
 import { resolved } from "../onboard/site.js";
+import { receivedBirth } from "../links/birth.js";
 import { linked } from "../links/inspect.js";
 import { rootIn } from "../flows/device.js";
 import { attachedFor } from "./access.js";
@@ -23,7 +24,7 @@ import { attachedFor } from "./access.js";
  * its pins rest in, its pin held to the package's; one that differs is refused by name, and the place holds what it
  * compiled. Nothing the sharing place was granted comes with it: access is asked here, issuer by issuer.
  */
-export const connected = async (asked, context, covered = false) => ((asked['document'] ?? '').startsWith(valueOf(context.lock, 'link/prefix')) ? linked(asked, context)
+export const connected = async (asked, context, covered = false) => (await receivedBirth(asked, context)) ?? (members(valueOf(context.lock, 'link/prefixes')).some(prefix => (asked['document'] ?? '').startsWith(prefix)) ? linked(asked, context)
     : ((got) => ('said' in got ? got.said : connectedAs(got.asked, context, covered)))(await resolved(asked, context)));
 const connectedAs = async (asked, context, covered = false) => (asked['source'] && !(await placeOf(asked, context)) ? firstRun(asked, context, (dir, covered) => connected({ ...asked, place: dir }, context, covered))
     : ((started) => inPlace(asked, context, async (place) => {