Projects typed external artifact blocks into verified presentation receipts.
Blocks keep the four-key documentation AST and store their closed envelope
inside meta.artifact. Their child AST is a complete safe textual fallback.
Each invocation receives its own profiles, manifests, projections, local
assets, capability declaration and runtime constraints. Loading this module
starts nothing and registers nothing.
Integrity and compatibility
The fallback digest covers block identity, source binding, wording, language and fallback AST. Variant bytes have separate original-byte SHA-256 digests. Projection checks all advertised bytes before producer callbacks and refuses altered content. Unknown optional profiles can retain a verified fallback; essential unknown profiles refuse. Receipts are versioned separately from v1 collection, page and capability records.
project/2 performs no file or network I/O. Publication and actual renderer
behavior remain separate checks in DocShell.Presentation.StaticExporter.
Summary
Functions
Computes the canonical complete fallback binding for one typed AST block.
Finds typed blocks recursively and returns verified selections and local asset closure.
Projects a page batch with one immutable descriptor set per invocation.
Verifies a previously admitted receipt against its exact page and runtime declarations.
Functions
Computes the canonical complete fallback binding for one typed AST block.
@spec project([DocShell.Ast.ast_node()], keyword()) :: {:ok, map()} | {:error, term()}
Finds typed blocks recursively and returns verified selections and local asset closure.
@spec project_many(%{required(String.t()) => [DocShell.Ast.ast_node()]}, keyword()) :: {:ok, %{required(String.t()) => map()}} | {:error, term()}
Projects a page batch with one immutable descriptor set per invocation.
All page/input bounds, anchors, fallback bindings and advertised asset bytes are checked before the first profile callback. Descriptors are then loaded once and shared only within this call. A later invalid page cannot cause an earlier page's producer callback to run. Errors retain the page and block locations; no partial receipt batch is returned.
@spec verify_receipt([DocShell.Ast.ast_node()], map(), keyword()) :: {:ok, map()} | {:error, term()}
Verifies a previously admitted receipt against its exact page and runtime declarations.
Checks closed records, page/constraint/fallback digests, block identities,
anchors, checked subject bindings and the selected variant's declared feature.
It performs no callbacks, negotiation, byte retrieval or rendering. The
descriptor-set digest remains an opaque binding to the host's original
admission; this function does not re-establish producer semantics or source
authenticity. A renderer must additionally check selected media bytes and
implement the declared state/runtime. Positive limits use ArtifactLimits.