@rhizomes/rhizomatic 0.1.0

package/src/eval.ts

@@ -0,0 +1,401 @@
+// Term evaluation: select/union/mask over DSet (SPEC-2 §4.1-4.3), group into HView (§4.4),
+// prune over HView (§4.6). eval is a pure function; order-blind; deterministic (SPEC-2 §5).
+// Sorts are checked at evaluation time in v0 (ERRATA-2 E9).
+
+import { array, encode, map, tstr } from "./cbor.js";
+import { bytesToHex } from "./hash.js";
+import { hviewCanonicalHex, type HVEntry, type HView } from "./hview.js";
+import { resolveView, viewCanonicalHex, type Policy, type View } from "./policy.js";
+import {
+  comparePrimitives,
+  evalPred,
+  strMatch,
+  substituteHoles,
+  type Bindings,
+  type Pred,
+  type StrMatch,
+} from "./pred.js";
+import { VOCAB_PREFIX } from "./vocab.js";
+import { SchemaRegistry } from "./schema.js";
+import { DeltaSet, fork, merge } from "./set.js";
+import type { Delta } from "./types.js";
+
+export type MaskPolicy =
+  | { readonly kind: "drop" }
+  | { readonly kind: "annotate" }
+  | { readonly kind: "trust"; readonly pred: Pred };
+
+export type SchemaRefT =
+  | { readonly kind: "name"; readonly name: string }
+  | { readonly kind: "pinned"; readonly hash: string };
+
+export type GroupKey =
+  | { readonly kind: "byTargetContext" }
+  | { readonly kind: "byRole" }
+  | { readonly kind: "const"; readonly prop: string };
+
+export type Term =
+  | { readonly kind: "input" }
+  | { readonly kind: "select"; readonly pred: Pred; readonly of: Term }
+  | { readonly kind: "union"; readonly left: Term; readonly right: Term }
+  | { readonly kind: "mask"; readonly policy: MaskPolicy; readonly of: Term }
+  | { readonly kind: "group"; readonly key: GroupKey; readonly of: Term }
+  | { readonly kind: "prune"; readonly keep: "all" | StrMatch; readonly of: Term }
+  | {
+      readonly kind: "expand";
+      readonly role: StrMatch;
+      readonly schema: SchemaRefT;
+      readonly of: Term;
+    }
+  | {
+      readonly kind: "fix";
+      readonly schema: SchemaRefT;
+      readonly entity: string;
+      readonly bindings?: Bindings;
+    }
+  | { readonly kind: "resolve"; readonly policy: Policy; readonly of: Term };
+
+interface DSetResult {
+  readonly sort: "dset";
+  readonly set: DeltaSet;
+  // Negation tags from mask(annotate); consumed by group (E7) or surfaced at top level (E2).
+  readonly negated: ReadonlySet<string>;
+  readonly annotated: boolean;
+}
+
+interface HViewResult {
+  readonly sort: "hview";
+  readonly hview: HView;
+}
+
+// The terminal sort: no operator consumes a View (SPEC-2 §4.7, ERRATA-5 R7).
+interface ViewResult {
+  readonly sort: "view";
+  readonly view: View;
+}
+
+export type EvalResult = DSetResult | HViewResult | ViewResult;
+
+const dsetResult = (set: DeltaSet): DSetResult => ({
+  sort: "dset",
+  set,
+  negated: new Set(),
+  annotated: false,
+});
+
+function expectDSet(r: EvalResult, op: string): DSetResult {
+  if (r.sort !== "dset") throw new Error(`${op} requires a DSet operand (E9)`);
+  return r;
+}
+
+function expectHView(r: EvalResult, op: string): HViewResult {
+  if (r.sort !== "hview") throw new Error(`${op} requires an HView operand (E9)`);
+  return r;
+}
+
+// negated(d, D) per SPEC-2 §4.3, over candidate negations restricted by `trusted` (E4).
+// Memoized with an in-progress default of "not negated" (E5 recursion guard).
+function computeNegated(d: DeltaSet, trusted?: (n: Delta) => boolean): Set<string> {
+  const negators = new Map<string, string[]>(); // target delta id -> negation delta ids
+  for (const n of d) {
+    if (trusted !== undefined && !trusted(n)) continue;
+    for (const ptr of n.claims.pointers) {
+      if (ptr.role === "negates" && ptr.target.kind === "delta") {
+        const list = negators.get(ptr.target.deltaRef.delta);
+        if (list === undefined) negators.set(ptr.target.deltaRef.delta, [n.id]);
+        else list.push(n.id);
+      }
+    }
+  }
+  const memo = new Map<string, boolean>();
+  const isNegated = (id: string): boolean => {
+    const cached = memo.get(id);
+    if (cached !== undefined) return cached;
+    memo.set(id, false); // guard: cycles are impossible with verified ids, but degrade safely
+    const result = (negators.get(id) ?? []).some((nid) => !isNegated(nid));
+    memo.set(id, result);
+    return result;
+  };
+  const out = new Set<string>();
+  for (const delta of d) if (isNegated(delta.id)) out.add(delta.id);
+  return out;
+}
+
+// --- the aliased closure (SPEC-9 §4.1) -----------------------------------------------------------
+
+const ALIAS_FRAGMENT = `${VOCAB_PREFIX}.alias.fragment`;
+const ALIAS_SLOT = `${VOCAB_PREFIX}.alias.slot`;
+const ALIAS_CONCEPT = `${VOCAB_PREFIX}.alias.concept`;
+
+export interface AliasedSpec {
+  readonly name: string;
+  readonly via?: string;
+  readonly trust?: Pred;
+}
+
+// closure(A, D): name → slots → fragments, one hop, computed against the AMBIENT evaluation
+// input. The trust predicate restricts every participant — mappings, slot declarations, and the
+// negations of both — and negation chains are walked within the trusted set only (mask(trust)
+// semantics). Returns the closure sorted by the canonical string order; the name is always a
+// member, so an aliased with no surviving mappings degrades to exact(name).
+export function aliasClosure(input: DeltaSet, spec: AliasedSpec, root?: string): string[] {
+  const trustPred = spec.trust;
+  const trusted = trustPred === undefined ? undefined : (n: Delta) => evalPred(trustPred, n, root);
+  const negated = computeNegated(input, trusted);
+  const mappings: { fragment: string; slot: string }[] = [];
+  const slotConcepts = new Map<string, Set<string>>();
+  for (const d of input) {
+    if (trusted !== undefined && !trusted(d)) continue;
+    if (negated.has(d.id)) continue;
+    const fragments: string[] = [];
+    const slots: string[] = [];
+    const concepts: string[] = [];
+    for (const ptr of d.claims.pointers) {
+      if (ptr.role === ALIAS_FRAGMENT && ptr.target.kind === "primitive") {
+        if (typeof ptr.target.value === "string") fragments.push(ptr.target.value);
+      } else if (ptr.role === ALIAS_SLOT && ptr.target.kind === "entity") {
+        slots.push(ptr.target.entity.id);
+      } else if (ptr.role === ALIAS_CONCEPT && ptr.target.kind === "entity") {
+        concepts.push(ptr.target.entity.id);
+      }
+    }
+    // Mapping claim: ≥1 fragment × ≥1 slot, cross product (SPEC-9 §3). Anything else with the
+    // alias roles is not a mapping and is ignored here (graceful degradation).
+    for (const fragment of fragments) for (const slot of slots) mappings.push({ fragment, slot });
+    // Slot declaration: ≥1 slot × ≥1 concept (SPEC-9 §2).
+    for (const slot of slots) {
+      for (const concept of concepts) {
+        let set = slotConcepts.get(slot);
+        if (set === undefined) {
+          set = new Set();
+          slotConcepts.set(slot, set);
+        }
+        set.add(concept);
+      }
+    }
+  }
+  const eligible =
+    spec.via === undefined
+      ? mappings
+      : mappings.filter((m) => slotConcepts.get(m.slot)?.has(spec.via!) ?? false);
+  const slotsOfName = new Set(eligible.filter((m) => m.fragment === spec.name).map((m) => m.slot));
+  const closure = new Set<string>([spec.name]);
+  for (const m of eligible) if (slotsOfName.has(m.slot)) closure.add(m.fragment);
+  return [...closure].sort(comparePrimitives);
+}
+
+// Expand an aliased StrMatch to its inSet form against the ambient input; other forms pass.
+function expandStrMatch(m: StrMatch, input: DeltaSet, root: string | undefined): StrMatch {
+  if (m.kind !== "aliased") return m;
+  return { kind: "inSet", values: aliasClosure(input, m, root) };
+}
+
+// Expand every aliased StrMatch in a predicate (ppred role/context) against the ambient input.
+// Applied where predicates meet data (select / mask-trust), after hole substitution (SPEC-9 §4.1).
+export function expandAliased(pred: Pred, input: DeltaSet, root: string | undefined): Pred {
+  switch (pred.kind) {
+    case "true":
+    case "false":
+    case "match":
+      return pred;
+    case "hasPointer": {
+      const p = pred.ppred;
+      const role = p.role === undefined ? undefined : expandStrMatch(p.role, input, root);
+      const context = p.context === undefined ? undefined : expandStrMatch(p.context, input, root);
+      if (role === p.role && context === p.context) return pred;
+      return {
+        kind: "hasPointer",
+        ppred: {
+          ...p,
+          ...(role === undefined ? {} : { role }),
+          ...(context === undefined ? {} : { context }),
+        },
+      };
+    }
+    case "and":
+      return {
+        kind: "and",
+        left: expandAliased(pred.left, input, root),
+        right: expandAliased(pred.right, input, root),
+      };
+    case "or":
+      return {
+        kind: "or",
+        left: expandAliased(pred.left, input, root),
+        right: expandAliased(pred.right, input, root),
+      };
+    case "not":
+      return { kind: "not", pred: expandAliased(pred.pred, input, root) };
+  }
+}
+
+// group(key, D) @ root — filing rules per ERRATA-2 E6; annotate tags thread into entries (E7).
+function evalGroup(key: GroupKey, operand: DSetResult, root: string): HView {
+  const buckets = new Map<string, Map<string, HVEntry>>(); // prop -> deltaId -> entry
+  const file = (prop: string, d: Delta) => {
+    let bucket = buckets.get(prop);
+    if (bucket === undefined) {
+      bucket = new Map();
+      buckets.set(prop, bucket);
+    }
+    if (!bucket.has(d.id)) bucket.set(d.id, { delta: d, negated: operand.negated.has(d.id) });
+  };
+  for (const d of operand.set) {
+    if (key.kind === "const") {
+      file(key.prop, d);
+      continue;
+    }
+    for (const ptr of d.claims.pointers) {
+      if (ptr.target.kind !== "entity" || ptr.target.entity.id !== root) continue;
+      if (key.kind === "byTargetContext") {
+        const ctx = ptr.target.entity.context;
+        if (ctx !== undefined) file(ctx, d);
+      } else {
+        file(ptr.role, d);
+      }
+    }
+  }
+  const props = new Map<string, HVEntry[]>();
+  for (const [prop, bucket] of buckets) {
+    props.set(
+      prop,
+      [...bucket.values()].sort((a, b) => (a.delta.id < b.delta.id ? -1 : 1)),
+    );
+  }
+  return { id: root, props };
+}
+
+export function evalTerm(
+  term: Term,
+  input: DeltaSet,
+  root?: string,
+  registry?: SchemaRegistry,
+  bindings?: Bindings,
+): EvalResult {
+  switch (term.kind) {
+    case "input":
+      return dsetResult(input);
+    case "select": {
+      const of = expectDSet(evalTerm(term.of, input, root, registry, bindings), "select");
+      const pred = expandAliased(substituteHoles(term.pred, bindings), input, root);
+      return dsetResult(fork(of.set, (d) => evalPred(pred, d, root)));
+    }
+    case "union": {
+      const left = expectDSet(evalTerm(term.left, input, root, registry, bindings), "union");
+      const right = expectDSet(evalTerm(term.right, input, root, registry, bindings), "union");
+      return dsetResult(merge(left.set, right.set));
+    }
+    case "mask": {
+      const of = expectDSet(evalTerm(term.of, input, root, registry, bindings), "mask");
+      switch (term.policy.kind) {
+        case "drop": {
+          const negated = computeNegated(of.set);
+          return dsetResult(fork(of.set, (d) => !negated.has(d.id)));
+        }
+        case "annotate": {
+          const negated = computeNegated(of.set);
+          return { sort: "dset", set: of.set, negated, annotated: true };
+        }
+        case "trust": {
+          const pred = expandAliased(substituteHoles(term.policy.pred, bindings), input, root);
+          const negated = computeNegated(of.set, (n) => evalPred(pred, n, root));
+          return dsetResult(fork(of.set, (d) => !negated.has(d.id)));
+        }
+      }
+      break;
+    }
+    case "group": {
+      if (root === undefined) throw new Error("group requires an ambient root entity (E9)");
+      const of = expectDSet(evalTerm(term.of, input, root, registry, bindings), "group");
+      return { sort: "hview", hview: evalGroup(term.key, of, root) };
+    }
+    case "prune": {
+      const of = expectHView(evalTerm(term.of, input, root, registry, bindings), "prune");
+      if (term.keep === "all") return of;
+      const keep = expandStrMatch(term.keep, input, root);
+      const props = new Map<string, readonly HVEntry[]>();
+      for (const [prop, entries] of of.hview.props) {
+        if (strMatch(keep, prop)) props.set(prop, entries);
+      }
+      return { sort: "hview", hview: { id: of.hview.id, props } };
+    }
+    case "expand": {
+      const of = expectHView(evalTerm(term.of, input, root, registry, bindings), "expand");
+      const role = expandStrMatch(term.role, input, root);
+      const props = new Map<string, readonly HVEntry[]>();
+      for (const [prop, entries] of of.hview.props) {
+        props.set(
+          prop,
+          entries.map((e) => {
+            let expanded: Map<number, HView> | undefined;
+            e.delta.claims.pointers.forEach((ptr, i) => {
+              // Only role-matching EntityRef pointers expand; everything else passes through
+              // as written (E11, SPEC-3 §7 graceful degradation).
+              if (ptr.target.kind !== "entity" || !strMatch(role, ptr.role)) return;
+              const nested = evalSchema(
+                term.schema,
+                input,
+                ptr.target.entity.id,
+                registry,
+                bindings,
+              );
+              expanded = expanded ?? new Map(e.expanded ?? []);
+              expanded.set(i, nested);
+            });
+            return expanded === undefined ? e : { ...e, expanded };
+          }),
+        );
+      }
+      return { sort: "hview", hview: { id: of.hview.id, props } };
+    }
+    case "fix":
+      // The invocation instruction: ambient root is set explicitly (E10); bindings, when
+      // present, become the ambient hole environment for the invoked body (E15).
+      return {
+        sort: "hview",
+        hview: evalSchema(term.schema, input, term.entity, registry, term.bindings ?? bindings),
+      };
+    case "resolve": {
+      const of = expectHView(evalTerm(term.of, input, root, registry, bindings), "resolve");
+      return { sort: "view", view: resolveView(term.policy, of.hview) };
+    }
+  }
+}
+
+// Evaluate a named schema at a root over the SAME delta set the enclosing evaluation received
+// (SPEC-2 §4.5). Termination is the schema DAG's, enforced at registry build (SPEC-3 §3).
+function evalSchema(
+  ref: SchemaRefT,
+  input: DeltaSet,
+  root: string,
+  registry: SchemaRegistry | undefined,
+  bindings?: Bindings,
+): HView {
+  const label = ref.kind === "name" ? ref.name : `pinned:${ref.hash.slice(0, 12)}…`;
+  if (registry === undefined)
+    throw new Error(`schema ${label} referenced but no registry supplied (E10)`);
+  const schema = registry.resolve(ref);
+  if (schema === undefined) throw new Error(`unknown schema: ${label} (E10/E13)`);
+  const result = evalTerm(schema.body, input, root, registry, bindings);
+  if (result.sort !== "hview") {
+    throw new Error(`schema ${label} body must be an HView-sort term (E10)`);
+  }
+  return result.hview;
+}
+
+// Canonical serialization of an evaluation result (ERRATA-2 E2, E7).
+export function resultCanonicalHex(result: EvalResult): string {
+  if (result.sort === "view") return viewCanonicalHex(result.view);
+  if (result.sort === "hview") return hviewCanonicalHex(result.hview);
+  const ids = result.set.ids().map(tstr);
+  if (!result.annotated) return bytesToHex(encode(array(ids)));
+  const negated = [...result.negated].sort().map(tstr);
+  return bytesToHex(
+    encode(
+      map([
+        ["ids", array(ids)],
+        ["negated", array(negated)],
+      ]),
+    ),
+  );
+}

package/src/hash.ts

@@ -0,0 +1,19 @@
+import { blake3 } from "@noble/hashes/blake3";
+import { bytesToHex } from "@noble/hashes/utils";
+
+// BLAKE3 multicodec code (https://github.com/multiformats/multicodec). Both it and the 32-byte
+// length fit in a single-byte varint, so the multihash prefix is simply [0x1e, 0x20].
+const BLAKE3_MULTICODEC = 0x1e;
+const DIGEST_LEN = 32;
+
+// id = multihash(BLAKE3-256(data)) as lowercase hex (SPEC-1 §4, ERRATA D7).
+export function contentAddress(data: Uint8Array): string {
+  const digest = blake3(data, { dkLen: DIGEST_LEN });
+  const mh = new Uint8Array(2 + digest.length);
+  mh[0] = BLAKE3_MULTICODEC;
+  mh[1] = digest.length;
+  mh.set(digest, 2);
+  return bytesToHex(mh);
+}
+
+export { bytesToHex };

package/src/http.ts

@@ -0,0 +1,124 @@
+// The blessed HTTP federation binding (ERRATA-6 F5): POST /rhz/v0/sync over the Peer protocol.
+// Transport only — partitioning, the signature boundary, and admission all live in Peer (F3/§5).
+
+import { createServer, type Server } from "node:http";
+import { claimsToJson, parseClaims } from "./json-profile.js";
+import { Peer } from "./peer.js";
+import { manifestMemberIds } from "./reactor.js";
+import { makeDelta } from "./set.js";
+import { verifyDelta } from "./sign.js";
+import type { Delta } from "./types.js";
+
+interface WireDelta {
+  claims: unknown;
+  sig?: string;
+}
+
+interface SyncResponse {
+  bundles: Array<{ manifest: WireDelta; members: WireDelta[] }>;
+  loose: WireDelta[];
+}
+
+function toWire(d: Delta): WireDelta {
+  // No id on the wire: the receiver recomputes content addresses (F5; never trust the wire).
+  return d.sig === undefined
+    ? { claims: claimsToJson(d.claims) }
+    : { claims: claimsToJson(d.claims), sig: d.sig };
+}
+
+function fromWire(w: WireDelta): Delta {
+  return makeDelta(parseClaims(w.claims), w.sig);
+}
+
+// Compute the OFFER for a WANT, partitioned per the signature boundary (F3).
+export function offerFor(peer: Peer, have: ReadonlySet<string>): SyncResponse {
+  const offered = peer.offeredSet().filter((d) => !have.has(d.id));
+  const offeredIds = new Set(offered.map((d) => d.id));
+  const isSignedManifest = (d: Delta) =>
+    d.sig !== undefined && verifyDelta(d) === "verified" && manifestMemberIds(d).length > 0;
+  const covered = new Set<string>();
+  const bundles: SyncResponse["bundles"] = [];
+  for (const m of offered.filter(isSignedManifest)) {
+    const members = manifestMemberIds(m)
+      .filter((id) => offeredIds.has(id))
+      .map((id) => offered.find((d) => d.id === id)!)
+      .filter((d) => !isSignedManifest(d));
+    bundles.push({ manifest: toWire(m), members: members.map(toWire) });
+    for (const mem of members) covered.add(mem.id);
+    covered.add(m.id);
+  }
+  const loose = offered
+    .filter((d) => !covered.has(d.id) && d.sig !== undefined && verifyDelta(d) === "verified")
+    .map(toWire);
+  return { bundles, loose };
+}
+
+// Serve a peer's offered lens over HTTP. Returns the server; close it when done.
+export function servePeer(peer: Peer, port: number): Promise<Server> {
+  const server = createServer((req, res) => {
+    if (req.method !== "POST" || req.url !== "/rhz/v0/sync") {
+      res.writeHead(404).end();
+      return;
+    }
+    const chunks: Buffer[] = [];
+    req.on("data", (c: Buffer) => chunks.push(c));
+    req.on("end", () => {
+      try {
+        const body = JSON.parse(Buffer.concat(chunks).toString("utf8")) as { have?: string[] };
+        const have = new Set<string>(Array.isArray(body.have) ? body.have : []);
+        const response = offerFor(peer, have);
+        res.writeHead(200, { "content-type": "application/json" });
+        res.end(JSON.stringify(response));
+      } catch (e) {
+        res.writeHead(400, { "content-type": "application/json" });
+        res.end(JSON.stringify({ error: e instanceof Error ? e.message : String(e) }));
+      }
+    });
+  });
+  return new Promise((resolve) => server.listen(port, "127.0.0.1", () => resolve(server)));
+}
+
+// Pull from a remote peer over HTTP: WANT(my ids) -> verify -> admission -> ingest (§5).
+export async function pullFromUrl(
+  peer: Peer,
+  baseUrl: string,
+): Promise<{ accepted: number; rejected: number }> {
+  const have = peer.reactor.arrivalLog().map((d) => d.id);
+  const res = await fetch(`${baseUrl}/rhz/v0/sync`, {
+    method: "POST",
+    headers: { "content-type": "application/json" },
+    body: JSON.stringify({ have }),
+  });
+  if (!res.ok) throw new Error(`sync failed: HTTP ${res.status}`);
+  const offer = (await res.json()) as SyncResponse;
+  let accepted = 0;
+  let rejected = 0;
+  // Reuse the local admission machinery by reconstructing deltas and handing them to the
+  // same ingest paths pullFrom uses: bundles atomically, loose individually.
+  for (const b of offer.bundles) {
+    const manifest = fromWire(b.manifest);
+    if (verifyDelta(manifest) !== "verified") {
+      rejected += 1 + b.members.length;
+      continue;
+    }
+    const members = b.members.map(fromWire);
+    if (!peer.admits(manifest) || !members.every((m) => peer.admits(m))) {
+      rejected += 1 + members.length;
+      continue;
+    }
+    const result = peer.reactor.ingestBundle(manifest, members);
+    if (result.status === "accepted") accepted += 1;
+    else if (result.status === "rejected") rejected += 1;
+  }
+  for (const w of offer.loose) {
+    const d = fromWire(w);
+    if (verifyDelta(d) !== "verified" || !peer.admits(d)) {
+      rejected += 1;
+      continue;
+    }
+    const result = peer.reactor.ingest(d);
+    if (result.status === "accepted") accepted += 1;
+    else if (result.status === "rejected") rejected += 1;
+  }
+  return { accepted, rejected };
+}

package/src/hview.ts

@@ -0,0 +1,91 @@
+// The HyperView: the output sort of group/expand/prune — SPEC-3 §4, encoded per ERRATA-2 E7/E11.
+// Provenance-complete: every entry carries the full delta; expansion is view structure keyed by
+// pointer index, never a mutation of the delta.
+
+import { type CborValue, array, bool, encode, float, map, tstr } from "./cbor.js";
+import { bytesToHex } from "./hash.js";
+import type { Claims, Delta, Target } from "./types.js";
+
+export interface HVEntry {
+  readonly delta: Delta;
+  // Annotate tag threaded through group from a mask(annotate) operand (E7).
+  readonly negated: boolean;
+  // expand replacements: pointer index (authored order) -> nested HView (E11).
+  readonly expanded?: ReadonlyMap<number, HView>;
+}
+
+export interface HView {
+  readonly id: string;
+  readonly props: ReadonlyMap<string, readonly HVEntry[]>;
+}
+
+function targetToCborWithExpansion(t: Target, expansion: HView | undefined): CborValue {
+  if (expansion !== undefined) return hviewToCbor(expansion);
+  switch (t.kind) {
+    case "primitive": {
+      const v = t.value;
+      if (typeof v === "string") return tstr(v);
+      if (typeof v === "boolean") return bool(v);
+      return float(v);
+    }
+    case "entity": {
+      const entries: Array<[string, CborValue]> = [["id", tstr(t.entity.id)]];
+      if (t.entity.context !== undefined) entries.push(["context", tstr(t.entity.context)]);
+      return map(entries);
+    }
+    case "delta": {
+      const entries: Array<[string, CborValue]> = [["delta", tstr(t.deltaRef.delta)]];
+      if (t.deltaRef.context !== undefined) entries.push(["context", tstr(t.deltaRef.context)]);
+      return map(entries);
+    }
+  }
+}
+
+// Claims rendered for an HVEntry: identical to the L1 canonical claims encoding, except that
+// expanded pointer targets are replaced by nested HView maps (E11). Never used for hashing.
+function claimsToCborWithExpansions(
+  claims: Claims,
+  expanded: ReadonlyMap<number, HView> | undefined,
+): CborValue {
+  return map([
+    ["author", tstr(claims.author)],
+    [
+      "pointers",
+      array(
+        claims.pointers.map((p, i) =>
+          map([
+            ["role", tstr(p.role)],
+            ["target", targetToCborWithExpansion(p.target, expanded?.get(i))],
+          ]),
+        ),
+      ),
+    ],
+    ["timestamp", float(claims.timestamp)],
+  ]);
+}
+
+export function hvEntryToCbor(e: HVEntry): CborValue {
+  const entries: Array<[string, CborValue]> = [
+    ["id", tstr(e.delta.id)],
+    ["claims", claimsToCborWithExpansions(e.delta.claims, e.expanded)],
+  ];
+  if (e.delta.sig !== undefined) entries.push(["sig", tstr(e.delta.sig)]);
+  if (e.negated) entries.push(["negated", bool(true)]);
+  return map(entries);
+}
+
+export function hviewToCbor(h: HView): CborValue {
+  const props: Array<[string, CborValue]> = [...h.props.entries()].map(([prop, entries]) => [
+    prop,
+    array(entries.map(hvEntryToCbor)),
+  ]);
+  return map([
+    ["id", tstr(h.id)],
+    ["props", map(props)],
+  ]);
+}
+
+// HyperViews are content-addressable (SPEC-3 §4): same (schema, DSet) => byte-identical form.
+export function hviewCanonicalHex(h: HView): string {
+  return bytesToHex(encode(hviewToCbor(h)));
+}