@opetope/runtime 0.1.1 → 0.2.0

package/dist/feature-port.js.map

@@ -1 +1 @@
-{"version":3,"file":"feature-port.js","sources":["../src/feature-port.ts"],"sourcesContent":["import type { Call, ModelOf, Port, PortRef } from '@opetope/core';\nimport type { ModelIdentity, PortIdentity, PortInput, PortOutput } from '@opetope/core/internal';\nimport { bindPortRef, isPort, isPortRefFor } from '@opetope/core/internal';\n\nimport { isAttachmentCallRef } from './attachment-call-declaration';\nimport type {\n  FeatureContribution,\n  FeaturePipeBuilder,\n  FeatureRegisterBuilder,\n  FeatureSlotBuilder,\n} from './feature-contribution';\nimport { isFeatureDataRef } from './feature-model';\nimport type { FeatureModelRef } from './feature-model';\nimport { assertExactDataKeys, assertPlainRecord, dataEntries } from './feature-record';\nimport type { ModuleCallRef, ModuleCallRefIdentity } from './public-module';\n\ndeclare const optionalPortBrand: unique symbol;\ndeclare const portProviderBrand: unique symbol;\n\ntype AnyPort = PortIdentity;\n\n/**\n * `optional(port)` is the weak edge of a port: the application may have no provider, and a call without one\n * settles with `CallError` code `unavailable` instead of failing the consumer (D105).\n */\ninterface OptionalPort<PortType extends AnyPort> {\n  readonly [optionalPortBrand]: readonly [PortType];\n}\n\ntype PortRequirementRecord = Readonly<Record<string, AnyPort | OptionalPort<AnyPort>>>;\ntype RequiredPortValues<Requires extends PortRequirementRecord> = {\n  readonly [Key in keyof Requires]: Requires[Key] extends OptionalPort<infer PortType>\n    ? PortRef<PortInput<PortType>, PortOutput<PortType>> | undefined\n    : Requires[Key] extends AnyPort\n      ? PortRef<PortInput<Requires[Key]>, PortOutput<Requires[Key]>>\n      : never;\n};\n/** Every requirement is a `Call` of this feature: the application chooses the provider, the author calls the ref. */\ntype FeatureRequiredCalls<Id extends string, Requires extends PortRequirementRecord> = {\n  readonly [Key in keyof Requires]: Requires[Key] extends OptionalPort<infer PortType>\n    ? ModuleCallRef<PortInput<PortType>, PortOutput<PortType>, Id>\n    : Requires[Key] extends AnyPort\n      ? ModuleCallRef<PortInput<Requires[Key]>, PortOutput<Requires[Key]>, Id>\n      : never;\n};\n\ninterface PortProviderBinding<PortType extends AnyPort, Id extends string> {\n  readonly [portProviderBrand]: readonly [PortType, Id];\n}\n\ninterface FeaturePortBuilder<Id extends string> {\n  <PortType extends AnyPort>(\n    port: PortType,\n    target: ModuleCallRef<PortInput<NoInfer<PortType>>, PortOutput<NoInfer<PortType>>, Id>,\n  ): PortProviderBinding<PortType, Id>;\n  <PortType extends AnyPort, Declaration extends ModelIdentity>(\n    port: PortType,\n    projection: {\n      readonly from: FeatureModelRef<Declaration, Id>;\n      readonly select: (\n        model: ModelOf<NoInfer<Declaration>>,\n      ) => Call<PortInput<NoInfer<PortType>>, PortOutput<NoInfer<PortType>>>;\n    },\n  ): PortProviderBinding<PortType, Id>;\n}\n\ntype PortProviderTarget =\n  | { readonly kind: 'call'; readonly ref: ModuleCallRefIdentity }\n  | { readonly kind: 'model'; readonly ref: object; readonly select: (model: unknown) => unknown };\n\ntype PortProviderDescriptor = {\n  readonly key: string;\n  readonly port: AnyPort;\n  readonly target: PortProviderTarget;\n};\n/** One section for every extension point: `port` for ports, `slot`, `pipe` and `register` for contributions. */\ntype FeatureProvidesFactory<\n  Id extends string,\n  Context,\n  Evaluation,\n  Runtime extends Readonly<Record<string, object>>,\n  Provided extends FeatureProvidedRecord<Id>,\n> = (context: {\n  readonly own: Runtime;\n  readonly pipe: FeaturePipeBuilder<Evaluation>;\n  readonly port: FeaturePortBuilder<Id>;\n  readonly register: FeatureRegisterBuilder<Context, Evaluation>;\n  readonly slot: FeatureSlotBuilder<Context, Evaluation>;\n}) => Provided;\n\ntype FeatureProvidedRecord<Id extends string> = Readonly<\n  Record<string, FeatureContribution | PortProviderBinding<AnyPort, Id>>\n>;\n\nconst requiredPorts = new WeakMap<object, AnyPort>();\nconst optionalPorts = new WeakSet<object>();\nconst portProviders = new WeakMap<object, Readonly<{ port: AnyPort; target: PortProviderTarget }>>();\n\n/** An explicit wrapper marks the weak requirement; an authentic bare Port is the strong requirement. */\nfunction optionalPort<PortType extends AnyPort>(port: PortType): OptionalPort<PortType> {\n  if (!isPort(port)) throw new TypeError('optional expects an authentic Port.');\n\n  const requirement = Object.freeze({}) as OptionalPort<PortType>;\n  requiredPorts.set(requirement, port);\n  optionalPorts.add(requirement);\n\n  return requirement;\n}\n\n/** Tolerant on purpose: the caller may hold any requirement declaration or none at all. */\nfunction isOptionalPortRequirement(requirement: unknown): boolean {\n  return typeof requirement === 'object' && requirement !== null && optionalPorts.has(requirement);\n}\n\nfunction getRequiredPort(requirement: unknown): AnyPort {\n  if (isPort(requirement)) return requirement;\n\n  if (typeof requirement !== 'object' || requirement === null) {\n    throw new TypeError('Feature requirement is not an authentic required Port.');\n  }\n\n  const port = requiredPorts.get(requirement);\n\n  if (port === undefined) throw new TypeError('Feature requirement is not an authentic required Port.');\n\n  return port;\n}\n\nfunction createPortBuilder<Id extends string>(): FeaturePortBuilder<Id> {\n  return <PortType extends AnyPort>(port: PortType, value: unknown) => {\n    if (!isPort(port)) throw new TypeError('provides.port takes a port created by definePort.');\n\n    let target: PortProviderTarget;\n\n    if (isAttachmentCallRef(value)) {\n      target = Object.freeze({ kind: 'call', ref: value as unknown as ModuleCallRefIdentity });\n    } else {\n      assertPlainRecord(value, 'Feature port model projection');\n      assertExactDataKeys(\n        value,\n        dataEntries(value, 'Feature port model projection'),\n        ['from', 'select'],\n        'Feature port model projection',\n      );\n\n      if (!isFeatureDataRef(value['from']) || typeof value['select'] !== 'function') {\n        throw new TypeError('provides.port takes an owned Call ref or a model projection with from and select.');\n      }\n\n      target = Object.freeze({\n        kind: 'model',\n        ref: value['from'] as object,\n        select: value['select'] as (model: unknown) => unknown,\n      });\n    }\n\n    const binding = Object.freeze({}) as PortProviderBinding<PortType, Id>;\n    portProviders.set(binding, Object.freeze({ port, target }));\n\n    return binding;\n  };\n}\n\nfunction snapshotPortProviders(\n  runtimeValues: ReadonlySet<object>,\n  entries: readonly (readonly [string, unknown])[],\n): readonly PortProviderDescriptor[] {\n  const descriptors = entries.map(([key, binding]) => {\n    if (typeof binding !== 'object' || binding === null) {\n      throw new TypeError(`Feature provider ${key} is not an authentic Port provider.`);\n    }\n\n    const definition = portProviders.get(binding);\n\n    if (definition === undefined) throw new TypeError(`Feature provider ${key} is not an authentic Port provider.`);\n\n    if (!runtimeValues.has(definition.target.ref)) {\n      throw new TypeError(`Feature provider ${key} must select a call or model ref from its public own.`);\n    }\n\n    return Object.freeze({ key, port: definition.port, target: definition.target });\n  });\n\n  return Object.freeze(descriptors);\n}\n\nfunction bindProvidedPort(descriptor: PortProviderDescriptor, target: Call<never, unknown>): PortRef<never, unknown> {\n  return bindPortRef(descriptor.port as Port<never, unknown>, target);\n}\n\nfunction assertRequiredPortValue(\n  port: AnyPort,\n  value: unknown,\n  key: string,\n  isOptional: boolean,\n): asserts value is PortRef<never, unknown> | undefined {\n  if (isOptional && value === undefined) return;\n\n  if (!isPortRefFor(port as Port<never, unknown>, value)) {\n    throw new TypeError(`openFeature requirement ${key} must be a PortRef for ${port.id}.`);\n  }\n}\n\nexport {\n  assertRequiredPortValue,\n  bindProvidedPort,\n  createPortBuilder,\n  getRequiredPort,\n  isOptionalPortRequirement,\n  optionalPort,\n  snapshotPortProviders,\n};\nexport type {\n  AnyPort,\n  FeatureProvidedRecord,\n  FeatureProvidesFactory,\n  FeatureRequiredCalls,\n  OptionalPort,\n  PortProviderDescriptor,\n  PortRequirementRecord,\n  RequiredPortValues,\n};\n"],"names":["requiredPorts","optionalPorts","portProviders","optionalPort","port","isPort","requirement","isOptionalPortRequirement","getRequiredPort","createPortBuilder","value","target","isAttachmentCallRef","assertPlainRecord","assertExactDataKeys","dataEntries","isFeatureDataRef","binding","snapshotPortProviders","runtimeValues","entries","descriptors","key","definition","bindProvidedPort","descriptor","bindPortRef","assertRequiredPortValue","isOptional","isPortRefFor"],"mappings":"kTA8FA,MAAMA,EAAgB,IAAI,QACpBC,EAAgB,IAAI,QACpBC,EAAgB,IAAI,QAG1B,SAASC,EAAuCC,EAAc,CAC5D,GAAI,CAACC,EAAOD,CAAI,EAAG,MAAM,IAAI,UAAU,qCAAqC,EAE5E,MAAME,EAAc,OAAO,OAAO,EAAE,EACpC,OAAAN,EAAc,IAAIM,EAAaF,CAAI,EACnCH,EAAc,IAAIK,CAAW,EAEtBA,CACT,CAGA,SAASC,EAA0BD,EAAoB,CACrD,OAAO,OAAOA,GAAgB,UAAYA,IAAgB,MAAQL,EAAc,IAAIK,CAAW,CACjG,CAEA,SAASE,EAAgBF,EAAoB,CAC3C,GAAID,EAAOC,CAAW,EAAG,OAAOA,EAEhC,GAAI,OAAOA,GAAgB,UAAYA,IAAgB,KACrD,MAAM,IAAI,UAAU,wDAAwD,EAG9E,MAAMF,EAAOJ,EAAc,IAAIM,CAAW,EAE1C,GAAIF,IAAS,OAAW,MAAM,IAAI,UAAU,wDAAwD,EAEpG,OAAOA,CACT,CAEA,SAASK,GAAiB,CACxB,MAAO,CAA2BL,EAAgBM,IAAkB,CAClE,GAAI,CAACL,EAAOD,CAAI,EAAG,MAAM,IAAI,UAAU,mDAAmD,EAE1F,IAAIO,EAEJ,GAAIC,EAAoBF,CAAK,EAC3BC,EAAS,OAAO,OAAO,CAAE,KAAM,OAAQ,IAAKD,EAA2C,MAClF,CASL,GARAG,EAAkBH,EAAO,+BAA+B,EACxDI,EACEJ,EACAK,EAAYL,EAAO,+BAA+B,EAClD,CAAC,OAAQ,QAAQ,EACjB,+BAA+B,EAG7B,CAACM,EAAiBN,EAAM,IAAO,GAAK,OAAOA,EAAM,QAAc,WACjE,MAAM,IAAI,UAAU,mFAAmF,EAGzGC,EAAS,OAAO,OAAO,CACrB,KAAM,QACN,IAAKD,EAAM,KACX,OAAQA,EAAM,MACf,CAAA,CACH,CAEA,MAAMO,EAAU,OAAO,OAAO,EAAE,EAChC,OAAAf,EAAc,IAAIe,EAAS,OAAO,OAAO,CAAE,KAAAb,EAAM,OAAAO,CAAM,CAAE,CAAC,EAEnDM,CACT,CACF,CAEA,SAASC,EACPC,EACAC,EAAgD,CAEhD,MAAMC,EAAcD,EAAQ,IAAI,CAAC,CAACE,EAAKL,CAAO,IAAK,CACjD,GAAI,OAAOA,GAAY,UAAYA,IAAY,KAC7C,MAAM,IAAI,UAAU,oBAAoBK,CAAG,qCAAqC,EAGlF,MAAMC,EAAarB,EAAc,IAAIe,CAAO,EAE5C,GAAIM,IAAe,OAAW,MAAM,IAAI,UAAU,oBAAoBD,CAAG,qCAAqC,EAE9G,GAAI,CAACH,EAAc,IAAII,EAAW,OAAO,GAAG,EAC1C,MAAM,IAAI,UAAU,oBAAoBD,CAAG,uDAAuD,EAGpG,OAAO,OAAO,OAAO,CAAE,IAAAA,EAAK,KAAMC,EAAW,KAAM,OAAQA,EAAW,OAAQ,CAChF,CAAC,EAED,OAAO,OAAO,OAAOF,CAAW,CAClC,CAEA,SAASG,EAAiBC,EAAoCd,EAA4B,CACxF,OAAOe,EAAYD,EAAW,KAA8Bd,CAAM,CACpE,CAEA,SAASgB,EACPvB,EACAM,EACAY,EACAM,EAAmB,CAEnB,GAAI,EAAAA,GAAclB,IAAU,SAExB,CAACmB,EAAazB,EAA8BM,CAAK,EACnD,MAAM,IAAI,UAAU,2BAA2BY,CAAG,0BAA0BlB,EAAK,EAAE,GAAG,CAE1F"}
+{"version":3,"file":"feature-port.js","sources":["../src/feature-port.ts"],"sourcesContent":["import type { Call, Port, PortRef } from '@opetope/core';\nimport type { PortIdentity, PortInput, PortOutput } from '@opetope/core/internal';\nimport { bindPortRef, isPort, isPortRefFor } from '@opetope/core/internal';\n\nimport type { FeatureOwnValues } from './feature-authoring-types';\nimport type {\n  FeatureContribution,\n  FeaturePipeBuilder,\n  FeatureRegisterBuilder,\n  FeatureSlotBuilder,\n} from './feature-contribution';\nimport type { ModuleCallRef } from './public-module';\n\ndeclare const optionalPortBrand: unique symbol;\ndeclare const portProviderBrand: unique symbol;\n\ntype AnyPort = PortIdentity;\n\n/**\n * `optional(port)` is the weak edge of a port: the application may have no provider, and a call without one\n * settles with `CallError` code `unavailable` instead of failing the consumer (D105).\n */\ninterface OptionalPort<PortType extends AnyPort> {\n  readonly [optionalPortBrand]: readonly [PortType];\n}\n\ntype PortRequirementRecord = Readonly<Record<string, AnyPort | OptionalPort<AnyPort>>>;\ntype RequiredPortValues<Requires extends PortRequirementRecord> = {\n  readonly [Key in keyof Requires]: Requires[Key] extends OptionalPort<infer PortType>\n    ? PortRef<PortInput<PortType>, PortOutput<PortType>> | undefined\n    : Requires[Key] extends AnyPort\n      ? PortRef<PortInput<Requires[Key]>, PortOutput<Requires[Key]>>\n      : never;\n};\n/** Every requirement is a `Call` of this feature: the application chooses the provider, the author calls the ref. */\ntype FeatureRequiredCalls<Id extends string, Requires extends PortRequirementRecord> = {\n  readonly [Key in keyof Requires]: Requires[Key] extends OptionalPort<infer PortType>\n    ? ModuleCallRef<PortInput<PortType>, PortOutput<PortType>, Id>\n    : Requires[Key] extends AnyPort\n      ? ModuleCallRef<PortInput<Requires[Key]>, PortOutput<Requires[Key]>, Id>\n      : never;\n};\n\ninterface PortProviderBinding<PortType extends AnyPort, Id extends string> {\n  readonly [portProviderBrand]: readonly [PortType, Id];\n}\n\ntype FeaturePortBuilder<Id extends string, Own> = <PortType extends AnyPort>(\n  port: PortType,\n  select: (context: { readonly own: Own }) => Call<PortInput<NoInfer<PortType>>, PortOutput<NoInfer<PortType>>>,\n) => PortProviderBinding<PortType, Id>;\n\ntype PortProviderTarget = (context: { readonly own: Readonly<Record<string, unknown>> }) => unknown;\n\ntype PortProviderDescriptor = {\n  readonly key: string;\n  readonly port: AnyPort;\n  readonly target: PortProviderTarget;\n};\n/** One section for every extension point: `port` for ports, `slot`, `pipe` and `register` for contributions. */\ntype FeatureProvidesFactory<\n  Id extends string,\n  Context,\n  Evaluation,\n  Runtime extends Readonly<Record<string, object>>,\n  Provided extends FeatureProvidedRecord<Id>,\n> = (context: {\n  readonly pipe: FeaturePipeBuilder<Evaluation>;\n  readonly port: FeaturePortBuilder<Id, FeatureOwnValues<Id, Runtime>>;\n  readonly register: FeatureRegisterBuilder<Context, Evaluation>;\n  readonly slot: FeatureSlotBuilder<Context, Evaluation>;\n}) => Provided;\n\ntype FeatureProvidedRecord<Id extends string> = Readonly<\n  Record<string, FeatureContribution | PortProviderBinding<AnyPort, Id>>\n>;\n\nconst requiredPorts = new WeakMap<object, AnyPort>();\nconst optionalPorts = new WeakSet<object>();\nconst portProviders = new WeakMap<object, Readonly<{ port: AnyPort; target: PortProviderTarget }>>();\n\n/** An explicit wrapper marks the weak requirement; an authentic bare Port is the strong requirement. */\nfunction optionalPort<PortType extends AnyPort>(port: PortType): OptionalPort<PortType> {\n  if (!isPort(port)) throw new TypeError('optional expects an authentic Port.');\n\n  const requirement = Object.freeze({}) as OptionalPort<PortType>;\n  requiredPorts.set(requirement, port);\n  optionalPorts.add(requirement);\n\n  return requirement;\n}\n\n/** Tolerant on purpose: the caller may hold any requirement declaration or none at all. */\nfunction isOptionalPortRequirement(requirement: unknown): boolean {\n  return typeof requirement === 'object' && requirement !== null && optionalPorts.has(requirement);\n}\n\nfunction getRequiredPort(requirement: unknown): AnyPort {\n  if (isPort(requirement)) return requirement;\n\n  if (typeof requirement !== 'object' || requirement === null) {\n    throw new TypeError('Feature requirement is not an authentic required Port.');\n  }\n\n  const port = requiredPorts.get(requirement);\n\n  if (port === undefined) throw new TypeError('Feature requirement is not an authentic required Port.');\n\n  return port;\n}\n\nfunction createPortBuilder<Id extends string, Own>(): FeaturePortBuilder<Id, Own> {\n  return <PortType extends AnyPort>(port: PortType, value: unknown) => {\n    if (!isPort(port)) throw new TypeError('provides.port takes a port created by definePort.');\n\n    if (typeof value !== 'function') throw new TypeError('provides.port takes a selector of an owned Call.');\n\n    const target = value as PortProviderTarget;\n\n    const binding = Object.freeze({}) as PortProviderBinding<PortType, Id>;\n    portProviders.set(binding, Object.freeze({ port, target }));\n\n    return binding;\n  };\n}\n\nfunction snapshotPortProviders(entries: readonly (readonly [string, unknown])[]): readonly PortProviderDescriptor[] {\n  const descriptors = entries.map(([key, binding]) => {\n    if (typeof binding !== 'object' || binding === null) {\n      throw new TypeError(`Feature provider ${key} is not an authentic Port provider.`);\n    }\n\n    const definition = portProviders.get(binding);\n\n    if (definition === undefined) throw new TypeError(`Feature provider ${key} is not an authentic Port provider.`);\n\n    return Object.freeze({ key, port: definition.port, target: definition.target });\n  });\n\n  return Object.freeze(descriptors);\n}\n\nfunction bindProvidedPort(descriptor: PortProviderDescriptor, target: Call<never, unknown>): PortRef<never, unknown> {\n  return bindPortRef(descriptor.port as Port<never, unknown>, target);\n}\n\nfunction assertRequiredPortValue(\n  port: AnyPort,\n  value: unknown,\n  key: string,\n  isOptional: boolean,\n): asserts value is PortRef<never, unknown> | undefined {\n  if (isOptional && value === undefined) return;\n\n  if (!isPortRefFor(port as Port<never, unknown>, value)) {\n    throw new TypeError(`openFeature requirement ${key} must be a PortRef for ${port.id}.`);\n  }\n}\n\nexport {\n  assertRequiredPortValue,\n  bindProvidedPort,\n  createPortBuilder,\n  getRequiredPort,\n  isOptionalPortRequirement,\n  optionalPort,\n  snapshotPortProviders,\n};\nexport type {\n  AnyPort,\n  FeatureProvidedRecord,\n  FeatureProvidesFactory,\n  FeatureRequiredCalls,\n  OptionalPort,\n  PortProviderDescriptor,\n  PortRequirementRecord,\n  RequiredPortValues,\n};\n"],"names":["requiredPorts","optionalPorts","portProviders","optionalPort","port","isPort","requirement","isOptionalPortRequirement","getRequiredPort","createPortBuilder","value","target","binding","snapshotPortProviders","entries","descriptors","key","definition","bindProvidedPort","descriptor","bindPortRef","assertRequiredPortValue","isOptional","isPortRefFor"],"mappings":"mFA6EA,MAAMA,EAAgB,IAAI,QACpBC,EAAgB,IAAI,QACpBC,EAAgB,IAAI,QAG1B,SAASC,EAAuCC,EAAc,CAC5D,GAAI,CAACC,EAAOD,CAAI,EAAG,MAAM,IAAI,UAAU,qCAAqC,EAE5E,MAAME,EAAc,OAAO,OAAO,EAAE,EACpC,OAAAN,EAAc,IAAIM,EAAaF,CAAI,EACnCH,EAAc,IAAIK,CAAW,EAEtBA,CACT,CAGA,SAASC,EAA0BD,EAAoB,CACrD,OAAO,OAAOA,GAAgB,UAAYA,IAAgB,MAAQL,EAAc,IAAIK,CAAW,CACjG,CAEA,SAASE,EAAgBF,EAAoB,CAC3C,GAAID,EAAOC,CAAW,EAAG,OAAOA,EAEhC,GAAI,OAAOA,GAAgB,UAAYA,IAAgB,KACrD,MAAM,IAAI,UAAU,wDAAwD,EAG9E,MAAMF,EAAOJ,EAAc,IAAIM,CAAW,EAE1C,GAAIF,IAAS,OAAW,MAAM,IAAI,UAAU,wDAAwD,EAEpG,OAAOA,CACT,CAEA,SAASK,GAAiB,CACxB,MAAO,CAA2BL,EAAgBM,IAAkB,CAClE,GAAI,CAACL,EAAOD,CAAI,EAAG,MAAM,IAAI,UAAU,mDAAmD,EAE1F,GAAI,OAAOM,GAAU,WAAY,MAAM,IAAI,UAAU,kDAAkD,EAEvG,MAAMC,EAASD,EAETE,EAAU,OAAO,OAAO,EAAE,EAChC,OAAAV,EAAc,IAAIU,EAAS,OAAO,OAAO,CAAE,KAAAR,EAAM,OAAAO,CAAM,CAAE,CAAC,EAEnDC,CACT,CACF,CAEA,SAASC,EAAsBC,EAAgD,CAC7E,MAAMC,EAAcD,EAAQ,IAAI,CAAC,CAACE,EAAKJ,CAAO,IAAK,CACjD,GAAI,OAAOA,GAAY,UAAYA,IAAY,KAC7C,MAAM,IAAI,UAAU,oBAAoBI,CAAG,qCAAqC,EAGlF,MAAMC,EAAaf,EAAc,IAAIU,CAAO,EAE5C,GAAIK,IAAe,OAAW,MAAM,IAAI,UAAU,oBAAoBD,CAAG,qCAAqC,EAE9G,OAAO,OAAO,OAAO,CAAE,IAAAA,EAAK,KAAMC,EAAW,KAAM,OAAQA,EAAW,OAAQ,CAChF,CAAC,EAED,OAAO,OAAO,OAAOF,CAAW,CAClC,CAEA,SAASG,EAAiBC,EAAoCR,EAA4B,CACxF,OAAOS,EAAYD,EAAW,KAA8BR,CAAM,CACpE,CAEA,SAASU,EACPjB,EACAM,EACAM,EACAM,EAAmB,CAEnB,GAAI,EAAAA,GAAcZ,IAAU,SAExB,CAACa,EAAanB,EAA8BM,CAAK,EACnD,MAAM,IAAI,UAAU,2BAA2BM,CAAG,0BAA0BZ,EAAK,EAAE,GAAG,CAE1F"}

package/dist/public-module-types.d.ts

@@ -292,4 +292,4 @@ type ModuleScopeHandleState<Value> = {
     record: ModuleInstanceRecord | undefined;
     readonly runtime: ModuleScopeInstance<Value>;
 };
-export type { Awaitable, CleanupFailurePolicy, ErrorReporter, ExactInput, ExactNonUnionRuntime, InternalModuleRuntimeRecord, InternalModuleRuntimeRef, ModuleAttachmentCleanupFailureDiagnostic, ModuleAttachmentCloseContext, ModuleAttachmentOpenContext, ModuleAttachmentOptions, ModuleAttachmentRef, ModuleAttachmentRefIdentity, ModuleAttachmentRetirementFailure, ModuleCallBuilder, ModuleCallContext, ModuleCallOptions, ModuleCallRef, ModuleCallRefIdentity, ModuleCleanupErrorDiagnostic, ModuleCleanupFailureDiagnostic, ModuleDefinition, ModuleDefinitionOptions, ModuleDefinitionRecord, ModuleDrainOutcome, ModuleInstance, ModuleInstanceOptions, ModuleInstanceRecord, ModuleInstanceRef, ModuleParticipantRetirementFailure, ModuleRetirement, ModuleRetirementFailure, ModuleRetirementHandleState, ModuleRetirementParticipant, ModuleRetirementParticipantHandle, ModuleRetirementQuarantinedOutcome, ModuleRetirementRecord, ModuleRuntimeBuilder, ModuleRuntimeRecord, ModuleRuntimeRef, ModuleRuntimeRefIdentity, ModuleScopeBuilder, ModuleScopeDefinitionEntry, ModuleScopeDrainOutcome, ModuleScopeHandleState, ModuleScopeInstance, ModuleScopeNotReadyOutcome, ModuleScopeOpenOutcome, ModuleScopeRef, ModuleScopeRefIdentity, ModuleScopeRetirement, ModuleScopeRetirementFailure, ParticipantFenceFrontier, ParticipantHandleFrontier, RegisteredParticipant, RetirementFrontier, ScopeFenceFrontier, ScopeFrontier, };
+export type { Awaitable, CleanupFailurePolicy, ErrorReporter, ExactInput, ExactNonUnionRuntime, InternalModuleRuntimeRecord, InternalModuleRuntimeRef, ModuleAttachmentCleanupFailureDiagnostic, ModuleAttachmentCloseContext, ModuleAttachmentOpenContext, ModuleAttachmentOptions, ModuleAttachmentRef, ModuleAttachmentRefIdentity, ModuleAttachmentRetirementFailure, ModuleCallBuilder, ModuleCallContext, ModuleCallOptions, ModuleCallRef, ModuleCleanupErrorDiagnostic, ModuleCleanupFailureDiagnostic, ModuleDefinition, ModuleDefinitionOptions, ModuleDefinitionRecord, ModuleDrainOutcome, ModuleInstance, ModuleInstanceOptions, ModuleInstanceRecord, ModuleInstanceRef, ModuleParticipantRetirementFailure, ModuleRetirement, ModuleRetirementFailure, ModuleRetirementHandleState, ModuleRetirementParticipant, ModuleRetirementParticipantHandle, ModuleRetirementQuarantinedOutcome, ModuleRetirementRecord, ModuleRuntimeBuilder, ModuleRuntimeRecord, ModuleRuntimeRef, ModuleRuntimeRefIdentity, ModuleScopeBuilder, ModuleScopeDefinitionEntry, ModuleScopeDrainOutcome, ModuleScopeHandleState, ModuleScopeInstance, ModuleScopeNotReadyOutcome, ModuleScopeOpenOutcome, ModuleScopeRef, ModuleScopeRefIdentity, ModuleScopeRetirement, ModuleScopeRetirementFailure, ParticipantFenceFrontier, ParticipantHandleFrontier, RegisteredParticipant, RetirementFrontier, ScopeFenceFrontier, ScopeFrontier, };

package/dist/public-module.d.ts

@@ -1,4 +1,4 @@
 export { defineModule, getModuleScopeEntries, getModuleTemplateIR } from './public-module-definition.js';
 export { instantiateModule, registerModuleRetirementParticipant, resolveModuleCallTarget, } from './public-module-instance.js';
 export { projectModuleCleanupFailures } from './public-module-retirement-diagnostics.js';
-export type { CleanupFailurePolicy, ErrorReporter, ExactNonUnionRuntime, ModuleAttachmentCleanupFailureDiagnostic, ModuleAttachmentCloseContext, ModuleAttachmentOpenContext, ModuleAttachmentOptions, ModuleAttachmentRef, ModuleAttachmentRefIdentity, ModuleCallContext, ModuleCallRef, ModuleCallRefIdentity, ModuleCleanupErrorDiagnostic, ModuleCleanupFailureDiagnostic, ModuleDefinition, ModuleDefinitionOptions, ModuleDrainOutcome, ModuleInstance, ModuleInstanceOptions, ModuleInstanceRef, ModuleParticipantRetirementFailure, ModuleRetirement, ModuleRetirementFailure, ModuleRetirementParticipant, ModuleRetirementParticipantHandle, ModuleRetirementQuarantinedOutcome, ModuleRuntimeBuilder, ModuleRuntimeRecord, ModuleRuntimeRef, ModuleRuntimeRefIdentity, ModuleScopeDrainOutcome, ModuleScopeInstance, ModuleScopeOpenOutcome, ModuleScopeRef, ModuleScopeRetirement, ModuleScopeRetirementFailure, } from './public-module-types.js';
+export type { CleanupFailurePolicy, ErrorReporter, ExactNonUnionRuntime, ModuleAttachmentCleanupFailureDiagnostic, ModuleAttachmentCloseContext, ModuleAttachmentOpenContext, ModuleAttachmentOptions, ModuleAttachmentRef, ModuleAttachmentRefIdentity, ModuleCallContext, ModuleCallRef, ModuleCleanupErrorDiagnostic, ModuleCleanupFailureDiagnostic, ModuleDefinition, ModuleDefinitionOptions, ModuleDrainOutcome, ModuleInstance, ModuleInstanceOptions, ModuleInstanceRef, ModuleParticipantRetirementFailure, ModuleRetirement, ModuleRetirementFailure, ModuleRetirementParticipant, ModuleRetirementParticipantHandle, ModuleRetirementQuarantinedOutcome, ModuleRuntimeBuilder, ModuleRuntimeRecord, ModuleRuntimeRef, ModuleRuntimeRefIdentity, ModuleScopeDrainOutcome, ModuleScopeInstance, ModuleScopeOpenOutcome, ModuleScopeRef, ModuleScopeRetirement, ModuleScopeRetirementFailure, } from './public-module-types.js';

package/docs/agent-guide.md

@@ -44,10 +44,17 @@ A feature whose implementation is heavy is written as a header and a body: the h
 the body loads when an instance opens (D186, D207). `defineFeature.preload(feature)` fetches that code early without
 opening anything; on a feature with no body it is a successful no-op (D208).
 
-Declaration stages (`own` and outer `provides`) see refs. Instance stages (`exports`, nested contribution
-factories and model factories) receive materialized values. Compose model dependencies with a readonly map of
+The `own` builder sees refs for imports and requirements. The outer `provides` receives only `{ port, register, slot, pipe }`.
+Instance stages (`exports`, port selectors, contribution factories and model factories) receive materialized values.
+Use a nested factory's `own` to register a private
+model call: `register(target, ({ own }) => ({ key: 'submit', value: own.order.submit }))`; no export is required.
+`register` receives `{ own, imports }`; `slot` receives `{ own, imports, model }`, with `model` declaring a
+per-mount UI model. Their `own` belongs to that exact instance. Keep `exports` for the API other features import;
+contribution contexts have no `exports` or `instance` field (D255).
+Compose model dependencies with a readonly map of
 current-feature imports and call refs, including `requires.x`; optional imports keep their lookup projection.
-Use `port(Port, { from: own.model, select: value => value.call })` for a model's call. `calls(imports.x, keys)`
+Use `port(Port, ({ own }) => own.model.call)` or `port(Port, ({ own }) => own.call)`; the selector receives only
+`{ own }` and runs once during instance preparation, before readiness and publication (D255). `calls(imports.x, keys)`
 accepts host methods, exported calls of a hard feature import, and exported calls over `optional(feature)`, where
 they answer `CallError` `unavailable` while nothing provides them. Read the data of a weak edge with
 `fromOptional(source, select, { missing })` instead of unfolding `lookup.kind` by hand (D187). For resources and streams, `target` selects a
@@ -61,7 +68,7 @@ destructuring and custom context types together; factory `call`, `calls` and the
 The nested invocation inherits cancellation, authority and the lane stack; it does not choose a new policy.
 
 A contribution's `when` is either a `Readable<boolean>` or a pure, synchronous predicate of the instance —
-`({ exports, imports, own, read }) => boolean`. Its `read` only records what the answer depends on: do not write,
+`({ own, imports, read }) => boolean`. Its `read` only records what the answer depends on: do not write,
 call or await inside it, and expect it to run again whenever a source it read changes. In that context `own` is
 materialized, so a model field is a `Readable` and not the declaration ref (D220). A `pipe` declares its handler as
 a descriptor with one key — `pipe(target, { fold: (value, meta, context) => next })` — whose `context` is that same

package/docs/agent-guide.ru.md

@@ -41,10 +41,17 @@ policy?, within })`; данные по ключу → `resource`; поток →
 загружается при открытии экземпляра (D186, D207). `defineFeature.preload(feature)` подтягивает этот код заранее,
 ничего не открывая; для фичи без тела это успешный no-op (D208).
 
-Стадии декларации (`own` и внешняя `provides`) видят refs. Стадии экземпляра (`exports`, вложенные фабрики
-вкладов и фабрики моделей) получают материализованные значения. Зависимости модели собираются readonly-записью
+Builder `own` видит refs импортов и требований. Внешняя `provides` получает только `{ port, register, slot, pipe }`.
+Стадии экземпляра (`exports`, селекторы портов, фабрики вкладов и моделей) получают материализованные значения.
+Для регистрации вызова внутренней модели
+берите `own` вложенной фабрики: `register(target, ({ own }) => ({ key: 'submit', value: own.order.submit }))`;
+экспорт не нужен. `register` получает `{ own, imports }`, а `slot` — `{ own, imports, model }`, где `model`
+объявляет UI-модель на каждое монтирование. Их `own` принадлежит конкретному экземпляру. Оставляйте `exports`
+для API, который импортируют другие фичи; в контекстах вкладов нет полей `exports` и `instance` (D255).
+Зависимости модели собираются readonly-записью
 импортов и call refs текущей фичи, включая `requires.x`; optional-импорты сохраняют lookup-проекцию.
-Для вызова модели используется `port(Port, { from: own.model, select: value => value.call })`.
+Используйте `port(Port, ({ own }) => own.model.call)` или `port(Port, ({ own }) => own.call)`; селектор получает
+только `{ own }` и выполняется один раз при подготовке экземпляра, до readiness и публикации (D255).
 `calls(imports.x, keys)` принимает методы хоста, экспортированные вызовы жёсткого импорта фичи и экспортированные
 вызовы поверх `optional(feature)` — там они отвечают `CallError` `unavailable`, пока провайдера нет. Данные слабого
 ребра читайте через `fromOptional(source, select, { missing })`, а не разворачивая `lookup.kind` руками (D187). У ресурсов
@@ -58,7 +65,7 @@ policy?, within })`; данные по ключу → `resource`; поток →
 Вложенный вызов наследует отмену, авторитет и стек lane; новую политику он не выбирает.
 
 `when` у вклада это либо `Readable<boolean>`, либо чистый синхронный предикат экземпляра —
-`({ exports, imports, own, read }) => boolean`. Его `read` только записывает, от чего зависит ответ: внутри нельзя
+`({ own, imports, read }) => boolean`. Его `read` только записывает, от чего зависит ответ: внутри нельзя
 писать, вызывать и ждать, а сам предикат выполнится снова при смене любого прочитанного источника. В этом контексте
 `own` материализован: поле модели это `Readable`, а не ref декларации (D220). `pipe` объявляет обработчик
 дескриптором с одним ключом — `pipe(target, { fold: (value, meta, context) => next })`, — где `context` это тот же

package/docs/cookbook.md

@@ -20,7 +20,7 @@ const feature = defineFeature({
   requires: { resolve: resolveItemPort },
   own: ({ imports, requires, calls, attach, call, lane, effect, event, resource, stream, scope, model }) => ({ … }),
   exports: ({ own }) => ({ x: own.x }),  // Call | Readable | Resource out of own; a whole model is not allowed
-  provides: ({ slot, pipe, register, port, own }) => ({ … }),
+  provides: ({ slot, pipe, register, port }) => ({ … }),
 });
 ```
 
@@ -46,7 +46,7 @@ const catalogResolveFeature = defineFeature({
   id: catalogResolveFeatureId,
   imports: { platform: catalogResolveSource },
   own: ({ calls, imports }) => ({ ...calls(imports.platform, ['resolveItem']) }), // host methods as Call
-  provides: ({ own, port }) => ({ catalog: port(resolveItemPort, own.resolveItem) }),
+  provides: ({ port }) => ({ catalog: port(resolveItemPort, ({ own }) => own.resolveItem) }),
 });
 ```
 
@@ -180,15 +180,16 @@ parameters are supported. A single parameter is always the input: for a signal-o
 with `context.call({ run: (_input: void, { signal }) => deps.load(signal) })` or use an explicit adapter.
 
 A model can compose a host import and a required call without receiving the feature context. Its factory declares
-its own dependency interface. A model call may also implement a port; the projection runs once before publication
-and the provider's lifetime fences the selected call even when it is passed through from a dependency (D169).
+its own dependency interface. A model call may also implement a port; the selector receives `{ own }` and runs once
+during instance preparation, before readiness and publication. The provider's lifetime fences the selected call
+even when it is passed through from a dependency (D169, D255).
 
 ```ts
 own: ({ imports, model, requires }) => ({
   order: model(OrderModel, { platform: imports.platform, lookup: requires.lookup }, createOrderModel),
 }),
-provides: ({ own, port }) => ({
-  submit: port(SubmitPort, { from: own.order, select: order => order.submit }),
+provides: ({ port }) => ({
+  submit: port(SubmitPort, ({ own }) => own.order.submit),
 }),
 ```
 
@@ -624,7 +625,7 @@ const paymentMethods = defineRegistry<string, PaymentMethodEntry>({ id: 'checkou
 
 // feature.ts — the entry is a contribution, so it opens and closes with the instance that made it
 provides: ({ register }) => ({
-  card: register(paymentMethods, ({ exports }) => ({ key: 'card', value: { submit: exports.submit, title: 'Card' } })),
+  card: register(paymentMethods, ({ own }) => ({ key: 'card', value: { submit: own.order.submit, title: 'Card' } })),
 }),
 
 // UI reads the target, never the provider's module
@@ -632,6 +633,7 @@ const method = useReadable(paymentMethods.select(selectedKey));
 const methods = useReadable(paymentMethods.list);
 ```
 
+`own.order` is the ready model of this feature; registering its `submit` Call requires no public export (D255).
 The publication is atomic and owned: the entry lands when the instance is ready, the fence withdraws it on close, a
 duplicate key is refused before anything moves, the order is `priority` and then id, and the inspector lists the
 entry with the feature that owns it (D127, D196). `select(key)` answers the same `Lookup` as a weak edge, so an

package/docs/cookbook.ru.md

@@ -19,7 +19,7 @@ const feature = defineFeature({
   requires: { resolve: resolveItemPort },
   own: ({ imports, requires, calls, attach, call, lane, effect, event, resource, stream, scope, model }) => ({ … }),
   exports: ({ own }) => ({ x: own.x }),  // Call | Readable | Resource из own; модель целиком — нельзя
-  provides: ({ slot, pipe, register, port, own }) => ({ … }),
+  provides: ({ slot, pipe, register, port }) => ({ … }),
 });
 ```
 
@@ -44,7 +44,7 @@ const catalogResolveFeature = defineFeature({
   id: catalogResolveFeatureId,
   imports: { platform: catalogResolveSource },
   own: ({ calls, imports }) => ({ ...calls(imports.platform, ['resolveItem']) }), // методы хоста как Call
-  provides: ({ own, port }) => ({ catalog: port(resolveItemPort, own.resolveItem) }),
+  provides: ({ port }) => ({ catalog: port(resolveItemPort, ({ own }) => own.resolveItem) }),
 });
 ```
 
@@ -179,15 +179,16 @@ exports: ({ own }) => ({ tasks: own.tasks }),   // Resource наружу; вла
 `context.call({ run: (_input: void, { signal }) => deps.load(signal) })` или используйте явный адаптер.
 
 Модель может соединить импорт хоста и требуемый вызов, не получая контекст фичи. Фабрика объявляет свой интерфейс
-зависимостей. Вызов модели также может реализовать порт; проекция выполняется один раз до публикации, а время
-жизни провайдера ограничивает выбранный вызов, даже переданный напрямую из зависимости (D169).
+зависимостей. Вызов модели также может реализовать порт; селектор получает `{ own }` и выполняется один раз при
+подготовке экземпляра, до readiness и публикации. Время жизни провайдера ограничивает выбранный вызов, даже
+переданный напрямую из зависимости (D169, D255).
 
 ```ts
 own: ({ imports, model, requires }) => ({
   order: model(OrderModel, { platform: imports.platform, lookup: requires.lookup }, createOrderModel),
 }),
-provides: ({ own, port }) => ({
-  submit: port(SubmitPort, { from: own.order, select: order => order.submit }),
+provides: ({ port }) => ({
+  submit: port(SubmitPort, ({ own }) => own.order.submit),
 }),
 ```
 
@@ -620,7 +621,7 @@ const paymentMethods = defineRegistry<string, PaymentMethodEntry>({ id: 'checkou
 
 // feature.ts — запись это вклад, поэтому она открывается и закрывается с экземпляром, который её сделал
 provides: ({ register }) => ({
-  card: register(paymentMethods, ({ exports }) => ({ key: 'card', value: { submit: exports.submit, title: 'Card' } })),
+  card: register(paymentMethods, ({ own }) => ({ key: 'card', value: { submit: own.order.submit, title: 'Card' } })),
 }),
 
 // UI читает цель, а не модуль провайдера
@@ -628,6 +629,7 @@ const method = useReadable(paymentMethods.select(selectedKey));
 const methods = useReadable(paymentMethods.list);
 ```
 
+`own.order` — готовая модель этой фичи; регистрация её Call `submit` не требует публичного экспорта (D255).
 Публикация атомарна и принадлежит владельцу: запись ложится, когда экземпляр готов, fence снимает её на закрытии,
 дубль ключа отвергается до того, как что-то сдвинулось, порядок это `priority`, затем id, а инспектор показывает
 запись вместе с фичей-владельцем (D127, D196). `select(key)` отвечает тем же `Lookup`, что и слабое ребро, поэтому

package/docs/decisions.md

@@ -1435,3 +1435,17 @@ Schema 11 заменяет смешанный метод [D252](#d252): для
 ## D254 — npm поставляет минифицированный ESM с исходными картами
 
 Пакеты собирают JavaScript с `minify: true` и `keepNames: false`; декларации `.d.ts` сохраняются отдельно, source maps включают исходный TypeScript в `sourcesContent`. Значения `fn.name` и `constructor.name`, полученные через рефлексию, не входят в стабильный API. Явные ID деклараций, публичные `error.name`/`error.code` и проверки `instanceof` с экспортируемыми классами ошибок сохраняют контракт и проверяются на реальных tarball-потребителях. Source-map-aware инструменты позволяют найти исходный TypeScript; карты раскрывают реализацию, а не скрывают её. Политика уменьшает несжатый JavaScript, не обещая уменьшения tarball или итогового бандла хоста: эти размеры измеряются отдельно.
+
+<a id="d255"></a>
+
+## D255 — `provides` объявляет цели, вложенные колбэки выбирают готовый `own`
+
+Внешняя `provides` получает ровно `{ port, register, slot, pipe }`: только builders, без `own` или других значений экземпляра. Цели, ids и приоритеты фиксируются синхронно при объявлении и известны компилятору до открытия. `port(Port, ({ own }) => own.model.call)` и `port(Port, ({ own }) => own.call)` используют единственную форму селектора: он получает только `{ own }` и один раз выбирает подлинный Call текущего экземпляра при подготовке, после создания моделей, до readiness и публикации вкладов. Прямые refs и дескрипторы `{ from, select }` больше не принимаются. Выбранный вызов сохраняет фенс провайдера, включая переданный напрямую вызов зависимости.
+
+Результат селектора должен быть подлинным Call из прочитанных им значений `own`, включая поля моделей. Подлинный, но чужой Call, обычная функция и другое значение отвергаются. Чтение для этой проверки остаётся ленивым: соседние lifecycle-only поля не раскрываются. Актуальность экземпляра проверяется до и после пользовательского селектора; синхронный retirement внутри него не допускает следующие селекторы, а уже владеемая работа дренируется.
+
+Вложенная фабрика `register` получает `{ own, imports }`, фабрика `slot` — `{ own, imports, model }`, а предикат `when` и обработчик `pipe.fold` — `{ own, imports, read }`. Это точные поверхности без aliases: `exports` и `instance` удалены из контекстов вкладов, `model` доступен только фабрике `slot`, где объявляет UI-модель на каждое монтирование. `exports` остаётся секцией публичного API фичи для её потребителей; внутренней композиции доступны `own` и объявленные `imports`.
+
+Все вложенные контексты получают тот же материализованный `own`, что секция `exports`: модель становится записью её полей, call ref — готовым `Call`, resource/stream ref — ресурсом. Регистрация вызова внутренней модели не требует публикации этого вызова в `exports`. Модели создаются до селекторов портов и фабрик вкладов, каждый экземпляр получает свои значения, запись раскрывает поля лениво, а lifetime вызовов и read-only проекция owned state сохраняются. Builder секции `own` по-прежнему использует refs импортов и требований для декларации зависимостей.
+
+Миграция меняет исходный код: внешний `own` убирается из `provides`, выбор вызова переносится во второй аргумент `port` как `({ own }) => own.call` или `({ own }) => own.model.call`. Вместо `context.exports.submit` выбирается исходный `context.own.order.submit`; только внутренние экспорты удаляются из секции `exports`. Вместо `context.instance` с внутренним bind/resolve выбирается готовое значение из `own`. План модели монтирования объявляется через `model` фабрики `slot`. Уточняет [D88](#d88), [D169](#d169), [D220](#d220), [D223](#d223).

package/docs/how-it-works.md

@@ -104,8 +104,11 @@ to these nodes:
 
 `exports` is a factory of the form `({ own }) => …`. It runs when the instance opens, against a live `own`, and every
 field of the record it returns must be a live value form — a `Call`, a `Readable` or a `Resource` — checked key by key
-(D88). `provides` runs once, synchronously, and is split into ports and contributions by the builder that produced each
-entry. Every attachment of a feature is critical: the instance is not ready until all of them are.
+(D88). `provides` runs once, synchronously, with exactly `{ port, register, slot, pipe }`, and is split into ports and
+contributions by the builder that produced each entry. Its outer context contains no `own` or instance values.
+Every target remains known to the compiler before opening; a `port` selector is recorded for preparation, while
+contribution values are recorded for publication (D255). Every attachment of a feature is critical: the instance is
+not ready until all of them are.
 
 ### 2.2 Opening an instance
 
@@ -181,8 +184,13 @@ that.
 
 The dependency descriptor is a map of authentic current-feature import and call refs. Materialization resolves
 it once to a readonly map before calling the factory; optional imports stay lookup readables. The zero-dependency
-form is `model(Decl, factory)`. Model-to-model refs are not a dependency graph. A model-backed port selects its
-call once after model creation and wraps even a passthrough call with the provider instance's fence (D169).
+form is `model(Decl, factory)`. Model-to-model refs are not a dependency graph. `port(Port, ({ own }) => own.model.call)`
+or `port(Port, ({ own }) => own.call)` receives only `{ own }` and selects an authentic Call of the current instance
+once during preparation, after model creation and before readiness or contribution publication. The binding wraps
+even a passthrough call with the provider instance's fence (D169, D255).
+The result must be a Call exposed by the `own` values the selector accessed. Reading only those values keeps
+lifecycle-only entries lazy. The runtime checks currentness before and after each selector; retirement inside one
+skips later selectors and drains the work already owned.
 
 The kernel owns rollback before entering user code, so a factory that creates nodes and then throws still drains
 them. The same rule holds for per-mount UI models. A fence synchronously closes every owned state and rejects
@@ -375,6 +383,13 @@ closing waits for the disposer and for the queue to drain.
 | 5    | **after `ready`** the factories run with the instance context, the value is marked with its owner, and `when` is resolved: a predicate becomes one computed readable of that instance |
 | 6    | every affected target is updated **in one transaction**, and listeners are called afterwards                                                                                          |
 
+The factories receive only the capabilities needed by their target: `register` gets `{ own, imports }`, while
+`slot` gets `{ own, imports, model }` for declaring per-mount UI models. The `own` record is the same lazy
+materialization used by `exports`: model records, Calls and resources belong to the concrete instance, and
+unselected lifecycle-only keys do not prevent access to them. A factory can therefore register its own model's Call without
+making it part of the feature's public exports. `when` and `pipe.fold` use `{ own, imports, read }`; these
+contribution contexts carry no `exports` or instance handle (D255).
+
 Entry order: `priority` ascending, ties broken by id. `when` (a `Readable<boolean>`, or a predicate of the instance
 that the runtime lowers to one): an entry whose value is `false`
 is not part of `entries`, so `Slot`, `fold`, `select` and emptiness checks never see it; a flip publishes in one
@@ -402,7 +417,7 @@ include both the entry list and everything the handlers read through their `{ re
 their sources change rather than only when contributions are re-registered. Without a reader the reads are untracked.
 
 A handler is declared as a descriptor, `pipe(target, { fold })`, and the runtime binds one evaluation context to it
-when the contribution publishes: `exports`, `imports` and the materialized `own` are resolved once and the reader is
+when the contribution publishes: `imports` and the materialized `own` are resolved once and the reader is
 the only thing that changes from call to call, so folding over many handlers allocates no per-handler context
 (D223). A `fold` is the only thing that runs a handler: declaring, preloading and publishing do not.
 

package/docs/how-it-works.ru.md

@@ -99,8 +99,10 @@ Reconciler группы это один сериализованный worker с
 | `requires.x`                                              | один call на скрытом attachment-е требований, который пересылает в провайдера порта; у `optional(port)` он оседает `CallError` `unavailable`, пока провайдера нет (D105) |
 | `model(...)`                                              | **не узел kernel-а**, а описатель данных; фабрика модели здесь не выполняется; владеемое состояние живёт только в модели (`ctx.state`, D139)                             |
 
-`exports` проверяется по форме каждого поля (`Call`, `Readable` или `Resource`), идентичность с `own` намеренно не проверяется; фасад экспортов вычисляется при открытии экземпляра с живым `own` (D88). `provides` выполняется один раз, синхронно, и делится на порты и вклады по тому,
-какой builder породил запись. Каждый attachment фичи критичен: экземпляр не готов, пока не готовы все.
+`exports` проверяется по форме каждого поля (`Call`, `Readable` или `Resource`), идентичность с `own` намеренно не проверяется; фасад экспортов вычисляется при открытии экземпляра с живым `own` (D88). `provides` выполняется один раз, синхронно, с ровно `{ port, register, slot, pipe }` и делится на порты и вклады по тому,
+какой builder породил запись. Во внешнем контексте нет `own` или значений экземпляра. Все цели остаются известны
+компилятору до открытия: селектор `port` записывается для подготовки экземпляра, значения вкладов — для публикации
+(D255). Каждый attachment фичи критичен: экземпляр не готов, пока не готовы все.
 
 ### 2.2 Открытие экземпляра
 
@@ -174,8 +176,13 @@ Retire идемпотентен и не может быть запущен из
 
 Описатель зависимостей — запись подлинных импортов и call refs текущей фичи. Материализация один раз разрешает
 её в readonly-запись перед фабрикой; optional-импорты остаются lookup-readable. Форма без зависимостей —
-`model(Decl, factory)`. Refs моделей не образуют граф зависимостей. Порт из модели один раз выбирает вызов после
-создания модели и ограничивает фенсом экземпляра-провайдера даже переданный напрямую вызов (D169).
+`model(Decl, factory)`. Refs моделей не образуют граф зависимостей. `port(Port, ({ own }) => own.model.call)` или
+`port(Port, ({ own }) => own.call)` получает только `{ own }` и один раз выбирает подлинный Call текущего экземпляра
+при подготовке, после создания моделей и до readiness или публикации вкладов. Привязка оборачивает даже переданный
+напрямую вызов фенсом экземпляра-провайдера (D169, D255).
+Результат должен быть Call из значений `own`, к которым обратился селектор. Чтение только выбранных значений
+сохраняет ленивость полей для lifecycle. Runtime проверяет актуальность до и после каждого селектора; retirement
+внутри одного из них пропускает последующие селекторы и дренирует уже владеемую работу.
 
 Kernel получает владельца отката до входа в пользовательский код, поэтому узлы фабрики дренируются, даже если
 она после их создания бросила. То же правило держат per-mount UI-модели. Фенс синхронно закрывает каждое
@@ -365,6 +372,13 @@ disposer и слив очереди.
 | 5   | **после `ready`** фабрики выполняются с контекстом экземпляра, значение помечается владельцем, `when` резолвится: предикат становится одним computed-readable этого экземпляра |
 | 6   | все затронутые цели обновляются **в одной транзакции**, слушатели зовутся после                                                                                                |
 
+Фабрики получают только возможности, нужные их цели: `register` — `{ own, imports }`, а `slot` —
+`{ own, imports, model }` для объявления UI-моделей на каждое монтирование. Запись `own` использует ту же ленивую
+материализацию, что `exports`: записи моделей, Calls и ресурсы принадлежат конкретному экземпляру, а невыбранные
+поля только для lifecycle не мешают обращаться к ним. Поэтому фабрика может зарегистрировать Call своей модели без его
+включения в публичные экспорты фичи. `when` и `pipe.fold` используют `{ own, imports, read }`; в этих контекстах
+вкладов нет `exports` или handle экземпляра (D255).
+
 Порядок записей: `priority` по возрастанию, при равенстве по id. `when` (`Readable<boolean>` либо предикат
 экземпляра, который рантайм понижает в такой readable): запись с `false` не
 входит в `entries`, поэтому `Slot`, `fold`, `select` и проверки пустоты её не видят; переключение публикует одной
@@ -391,7 +405,7 @@ disposer и слив очереди.
 при смене их источников, а не только при перерегистрации вкладов. Без читателя чтение нетрекаемое.
 
 Обработчик объявляется дескриптором, `pipe(target, { fold })`, и рантайм связывает с ним один контекст вычисления в
-момент публикации вклада: `exports`, `imports` и материализованный `own` разрешаются один раз, от вызова к вызову
+момент публикации вклада: `imports` и материализованный `own` разрешаются один раз, от вызова к вызову
 меняется только читатель, поэтому свёртка по многим обработчикам не аллоцирует контекст на обработчик (D223).
 Обработчик запускает только свёртка: объявление, предзагрузка и публикация его не вызывают.
 

package/docs/spec.md

@@ -57,8 +57,8 @@ const catalogCatalogFeature = defineFeature({
     ...calls(imports.platform, ['resolveItem']), // host methods as Calls, one to one
   }),
   exports: ({ own }) => ({ resolveItem: own.resolveItem }), // for features that import this definition
-  provides: ({ port, own }) => ({
-    resolve: port(resolveItemPort, own.resolveItem), // the port for whoever requires it
+  provides: ({ port }) => ({
+    resolve: port(resolveItemPort, ({ own }) => own.resolveItem), // the port for whoever requires it
   }),
 });
 ```
@@ -105,17 +105,18 @@ const createFormFeature = defineFeature({
     order: model(OrderModel, { platform: imports.platform }, (ctx, { platform }) => createOrderModel(ctx, platform)),
     lookup: requires.resolveItem, // inside `own` a port stays a ref
   }),
-  // here `own` is already materialized: both the port and the model field arrived as live `Call`s
-  exports: ({ own }) => ({ lookup: own.lookup, submit: own.order.submit }),
+  // consumers get the public lookup Call; submit stays inside this feature
+  exports: ({ own }) => ({ lookup: own.lookup }),
   provides: ({ slot, pipe }) => ({
     // a contribution is a value, an instance factory or a pipe descriptor; `priority` and `when` go in the options
-    content: slot(orderFormContentSlot, ({ exports, model }) => ({
+    content: slot(orderFormContentSlot, ({ own, model }) => ({
       Component: CreateForm,
       // the contribution's UI model: created per mount, and it sees the `props` of exactly that mount
       models: [
         model(OrderActions, (ctx, props: Readable<OrderFormProps>) => ({
           submit: ctx.call({
-            run: (amount: number, { invoke }) => invoke(exports.submit, { amount, itemId: props.getSnapshot().itemId }),
+            run: (amount: number, { invoke }) =>
+              invoke(own.order.submit, { amount, itemId: props.getSnapshot().itemId }),
           }),
         })),
       ],
@@ -181,7 +182,7 @@ publication barrier. All of it belongs to the runtime and its integration layer.
 | `id`        | What the feature is called             | `'feature.entity'`, dots only, no suffixes                                                                                                                       |
 | `imports`   | What the outside gives me              | a record of `defineHostContract` contracts and other feature definitions; `optional(x)` is a weak edge, `onDemand(hostContract)` defers binding to the first use |
 | `requires`  | Which port I need                      | a record of `port` or `optional(port)`; each `requires.x` is a ref, and the `Call` appears on the instance                                                       |
-| ref vs Call | What is visible at which stage         | `own` and the outer `provides` factory see refs; `exports` and nested contribution factories see materialized instance values                                    |
+| ref vs Call | What is visible at which stage         | the `own` builder sees dependency refs; `provides` sees only builders; `exports`, port selectors and contribution factories see materialized instance values     |
 | `own`       | What I own                             | builder: `model`, `call`, `calls`, `lane`, `effect`, `event`, `resource`, `stream`, `scope`, `attach`                                                            |
 | `exports`   | What I hand to features that import me | `({ own }) => a record of Call, Readable and Resource` computed when the instance opens                                                                          |
 | `provides`  | What I offer to extension points       | `({ port, slot, pipe, register, own }) => ...`                                                                                                                   |
@@ -269,14 +270,18 @@ the second factory argument is a readonly map of resolved values with inferred t
 source, or `model(Decl, create)` for none. Only authentic imports and call refs of the current feature are accepted;
 optional imports retain `Readable<Lookup<…>>`. Raw host objects, port declarations, foreign refs and model refs do
 not form dependency entries. A named factory may declare its own dependency interface without seeing the feature
-context. `provides.port(SubmitPort, { from: own.order, select: order => order.submit })` selects an authentic call
-once from the materialized model before publication and adds the provider's lifetime fence, including passthrough
-calls. A local call ref still uses `port(SubmitPort, own.submit)` (D169).
+context. `port(SubmitPort, ({ own }) => own.order.submit)` selects an authentic call from the current instance's
+`own` once during preparation, before readiness and contribution publication, and adds the provider's lifetime
+fence, including passthrough calls. `port(SubmitPort, ({ own }) => own.submit)` selects a call declared directly in
+`own`. The selector receives only `{ own }`; its result must be an authentic Call exposed by a value it selects
+from this `own`, including a model field. Foreign Calls and plain functions are rejected. Direct refs and
+`{ from, select }` descriptors are not accepted. Retirement during a selector prevents later selectors from running
+and drains the work already owned (D255).
 
 A contribution has two kinds of model, both declared with the same `defineModel`. `own` models live with the feature
 instance and are served to a mount automatically. A contribution's UI model lives with the mount: it is listed in the
 contribution's `models`, its factory receives the `Readable` of that mount's props as its second argument and either
-takes fields as they are (`submit: exports.submit`) or wraps them in `ctx.call` when the UI contract differs in
+takes fields as they are (`submit: own.order.submit`) or wraps them in `ctx.call` when the UI contract differs in
 input, in result shape or in the number of feature calls. There is no separate View concept.
 
 ### 2.3 UI
@@ -437,17 +442,26 @@ remain. Resource retry and feature-demand retry keep their own meaning. The form
 `event` the source and the carrier of type inference are positional: `resource(from, target, {…})`,
 `stream(from, target, {…})`, `event(from, subscribe, {…})`; the key order inside the options object is free. One
 option carries the same word for both: a stream requires `backpressure: latest()` and an `event` admits it. The
-methods of `provides`: `port`, `slot`, `pipe`, `register`; contributions take the target first, a value or an
+outer `provides` factory receives exactly `{ port, slot, pipe, register }`: only builders, with no `own` or other
+instance values. `port(Port, ({ own }) => own.model.call)` records the target at declaration and selects a Call
+when the instance prepares. Contributions take the target first, a value or an
 instance factory second, and options third: `slot(target, contribution, { priority, when })`,
 `pipe(target, { fold }, { priority, when })`, `register(target, entry, { priority, when })`, where `pipe`'s second
 argument is a descriptor because a bare function would be indistinguishable from the instance factory. The
-contribution factory context is `{ exports, imports, instance, model, own }`, and its `model(Decl, create)` builds
-the mount's UI model, where `create` receives `(ctx, props)`. `when` is a `Readable<boolean>` or a predicate of the
-instance — `({ exports, imports, own, read }) => boolean` — whose `read` records what the answer depends on: while
+`register` factory receives `{ own, imports }`; a `slot` factory receives `{ own, imports, model }`, where
+`model(Decl, create)` builds the mount's UI model and `create` receives `(ctx, props)`. These contexts contain only
+the fields named here: there is no `exports` or `instance`, and `register` has no model builder (D255).
+In either nested factory, `own` contains this instance's materialized models, calls and resources, just as in `exports`.
+`register(target, ({ own }) => ({ key: 'submit', value: own.order.submit }))` can publish a private model call
+without an `exports` section. Both port selectors and contribution factories select live values through their
+own callback context. Attachments, scopes, effects and events
+have no readable value form; unselected entries do not prevent access to the model or call alongside them.
+`when` is a `Readable<boolean>` or a predicate of the
+instance — `({ own, imports, read }) => boolean` — whose `read` records what the answer depends on: while
 the answer is `false` the contribution does not enter the target's `entries`. In that evaluation context `own` is
-the materialized form `exports` sees, so a model field is a `Readable` and not the ref the factory context carries.
+the materialized form `exports` sees, so a model field is a `Readable` and not the ref returned by the `own` builder.
 A `pipe` descriptor's `fold` receives that same evaluation context as its third argument —
-`(value, meta, { exports, imports, own, read }) => …` — bound to the instance once when the contribution publishes
+`(value, meta, { own, imports, read }) => …` — bound to the instance once when the contribution publishes
 and called only by a `fold`, never at declaration or preload; `target.fold(value, meta, read?)` accepts the reader
 as its third parameter, so `computed({ read: read => target.fold(0, undefined, read) })` subscribes both to
 `entries` and to everything the handlers read; without a reader the handlers read the current snapshot. Contexts: