@fangorn-network/westmarch 2026.11.3 → 2026.11.4-dev

package/src/agent/tools.js

@@ -29,7 +29,8 @@ const PLUMBING = new Set(["text", "vector", "norm", "id", "owner", "embed"]);
 export const brief = (r, roles, fields = []) => {
     const out = briefOf(r, roles, fields);
     const link = linkOf(r, roles);
-    return link ? { ...out, url: link } : out;
+    // Whose it is, and its price when sold: what an agent needs to cite or buy a hit.
+    return { ...out, ...(link ? { url: link } : {}), ...(r.owner ? { publisher: r.owner } : {}), ...(r.sale ? { sale: r.sale } : {}) };
 };
 
 /**

package/src/agent/view-tools.js

@@ -11,7 +11,7 @@
 //   - a search goes to the 3 views whose coverage sketch best matches the query,
 //     not to all of them (Kingsfoil: ~3 of 23 views, ~92% of the true top 10 with
 //     a 32-vector sketch). The result names what was searched and what was not.
-//   - `warm()` starts the embedder before the first query (fangorn-mcp: on find-apps), and a search
+//   - `warm()` starts the embedder before the first query, and a search
 //     never waits on a first-time model download.
 //
 // `get`/`similar`/`count` answer over what is loaded, and say so.
@@ -86,6 +86,7 @@ export function viewTools(app, { fetchCatalog = fetch, queryVector: embedQ = que
             view, name: label(view),
             description: domains.map((d) => d.description).filter(Boolean).join(" "),
             count: domains.reduce((s, d) => s + (d.count ?? 0), 0),
+            repos: domains.filter((d) => d.publisher).map((d) => ({ publisher: d.publisher, repo: d.repo, rows: d.count ?? 0, description: d.description ?? "" })),
             coverage: { vectors: domains.flatMap((d) => d.coverage?.vectors ?? []) },
         };
     })).catch((e) => { surveyed = null; throw e; }));
@@ -112,7 +113,8 @@ export function viewTools(app, { fetchCatalog = fetch, queryVector: embedQ = que
     const run = {
         describe: async () => ({
             app: app.name, description: app.desc,
-            views: (await survey()).map((v) => ({ view: v.name, rows: v.count, description: v.description, loaded: loaded.has(v.view) })),
+            views: (await survey()).map((v) => ({ view: v.name, rows: v.count, description: v.description, loaded: loaded.has(v.view),
+                                                  ...(v.repos.length ? { repos: v.repos } : {}) })),
         }),
         search: async ({ query, limit = 10, views, where: w }) => {
             if (!query) throw new Error("query is required");

package/src/agent/x402.js

@@ -19,7 +19,7 @@
 //
 // `maxPrice` (USDC base units) is checked before anything is signed.
 
-import { concat, createPublicClient, http, keccak256, parseAbiItem, parseSignature, toHex } from "viem";
+import { concat, createPublicClient, http, keccak256, parseSignature, toHex } from "viem";
 import { privateKeyToAccount } from "viem/accounts";
 import { openField, recordKey, registerNonce, repoId, subjectOf } from "@fangorn-network/sdk";
 
@@ -66,18 +66,6 @@ export async function signPayment(req, account, { subject, commitment, salt, now
              v: Number(v ?? 27n + BigInt(yParity)), r, s };
 }
 
-const REGISTERED = parseAbiItem("event Registered(bytes32 indexed subject, address indexed publisher, address indexed referrer, uint256 commitment, uint256 price, uint256 referrer_cut)");
-
-/** Every commitment registered for `subject`, in the order the contract added them to its group. */
-async function membersOf(pub, registry, subject, { fromBlock, window = 1000n }) {
-    const head = await pub.getBlockNumber(), out = [];
-    for (let from = BigInt(fromBlock); from <= head; from += window) {
-        const to = from + window - 1n < head ? from + window - 1n : head;
-        out.push(...await pub.getLogs({ address: registry, event: REGISTERED, args: { subject }, fromBlock: from, toBlock: to }));
-    }
-    return out.map((l) => l.args.commitment);
-}
-
 /** A Semaphore proof that `identity` is in the group, naming `reader`, scoped to `subject`, as `settle` checks it. */
 async function prove({ identity, members, reader, subject }) {
     const { Group, generateProof } = await semaphore();
@@ -99,10 +87,16 @@ export async function buyRecord(quoteUrl, { privateKey, account = privateKeyToAc
     if (terms.publisher.toLowerCase() !== record.publisher.toLowerCase() || terms.repo !== repoId(record.repo) || terms.key !== recordKey(record.id))
         throw new Error("the quote's terms are for another record");
     const subject = subjectOf(terms.publisher, terms.repo, terms.key);
+    // Every sealed field must be readable before anything is paid: a sale we can't open is money lost.
+    const storage = fangorn.getStorage(), held = new Map();
+    for (const h of Object.values(fields)) {
+        try { held.set(h.cid, await storage.getFile(h.cid)); }
+        catch (e) { throw new Error(`not buying: the record's sealed data (${h.cid}) can't be read: ${e.message}`); }
+    }
 
     const config = fangorn.getConfig(), settlement = fangorn.getSettlementRegistry();
     const pub = deps.pub ?? createPublicClient({ transport: http(config.rpcUrl) });
-    const members = deps.members ?? ((s) => membersOf(pub, settlement.getAddress(), s, { fromBlock: config.fromBlock, window: config.logWindow ?? 1000n }));
+    const members = deps.members ?? ((s) => settlement.membersOf(s).then((m) => [...m]));
     const { identity, reader } = await identityOf(account);
 
     let tx = null;
@@ -116,7 +110,7 @@ export async function buyRecord(quoteUrl, { privateKey, account = privateKeyToAc
             tx = JSON.parse(unb64(paid.headers.get("PAYMENT-RESPONSE") ?? b64("{}"))).transaction || null;
             if (tx) await pub.waitForTransactionReceipt({ hash: tx });
         }
-        // A load-balanced RPC can answer getLogs from a node behind the one that mined `register`:
+        // A load-balanced RPC can answer from a node behind the one that mined `register`:
         // our commitment is registered, so read until it shows up.
         const has = (g) => !!deps.members || g.some((c) => BigInt(c) === identity.commitment);
         let group = await members(subject);
@@ -124,7 +118,7 @@ export async function buyRecord(quoteUrl, { privateKey, account = privateKeyToAc
             await new Promise((r) => setTimeout(r, 3000));
             group = await members(subject);
         }
-        if (!has(group)) throw new Error("our commitment is registered but the RPC's logs don't show it yet; retry the purchase");
+        if (!has(group)) throw new Error("our commitment is registered but the RPC doesn't show it yet; retry the purchase");
         const proof = await (deps.prove ?? prove)({ identity, members: group, reader: reader.address, subject });
         const res = await fetchImpl(`${relay}/relay/settle`, { method: "POST", headers: { "content-type": "application/json" },
             body: JSON.stringify({ subject, reader: reader.address, ...proof }) });
@@ -135,7 +129,7 @@ export async function buyRecord(quoteUrl, { privateKey, account = privateKeyToAc
 
     const opened = {};
     for (const [field, handle] of Object.entries(fields)) {
-        const bytes = await openField({ handle, deposit, key: terms.key, field, signer: reader, storage: fangorn.getStorage(), fetch: fetchImpl });
+        const bytes = await openField({ handle, deposit, key: terms.key, field, signer: reader, storage: { getFile: async (cid) => held.get(cid) ?? storage.getFile(cid) }, fetch: fetchImpl });
         opened[field] = JSON.parse(new TextDecoder().decode(bytes));
     }
     return { record, fields: opened, price: req.amount, tx };
@@ -188,6 +182,10 @@ if (typeof process !== "undefined" && import.meta.url === `file://${process.argv
     await buyRecord(quoteUrl, { account: buyer, fangorn, fetchImpl, deps, maxPrice: 9999n }).then(() => { throw new Error("over the cap must refuse"); },
         (e) => { if (!/exceeds the cap/.test(e.message)) throw e; });
     eq(signed, null, "nothing is signed over the cap");
+    const gone = { ...fangorn, getStorage: () => ({ getFile: async () => { throw new Error("HTTP 404"); } }) };
+    await buyRecord(quoteUrl, { account: buyer, fangorn: gone, fetchImpl, deps }).then(() => { throw new Error("unreadable data must refuse"); },
+        (e) => { if (!/can't be read/.test(e.message)) throw e; });
+    eq(signed, null, "nothing is paid for data that can't be read");
 
     const got = await buyRecord(quoteUrl, { account: buyer, fangorn, fetchImpl, deps, maxPrice: 10000n });
     eq([got.fields, got.price, got.tx], [{ body: { text: "the body" } }, "10000", "0xabc"], "paid, settled, and the field opens as JSON");
@@ -212,5 +210,5 @@ if (typeof process !== "undefined" && import.meta.url === `file://${process.argv
         { status: 402, headers: { "PAYMENT-REQUIRED": b64(JSON.stringify({ x402Version: 2, accepts: [other] })) } }) : fetchImpl(url, init);
     await buyRecord(quoteUrl, { account: privateKeyToAccount(generatePrivateKey()), fangorn, fetchImpl: lying, deps }).then(() => { throw new Error("must refuse"); },
         (e) => { if (!/another record/.test(e.message)) throw e; });
-    console.log("x402.js self-check ok — the cap holds before signing, the payment is an ERC-3009 authorization bound to this purchase, the proof names a reader that isn't the wallet, a retry pays nothing, a quote for another record is refused, and the field opens");
+    console.log("x402.js self-check ok — the cap holds before signing, the payment is an ERC-3009 authorization bound to this purchase, the proof names a reader that isn't the wallet, a retry pays nothing, a quote for another record is refused, nothing is paid when the sealed data can't be read, and the field opens");
 }

package/src/publish/devnet.js

@@ -30,8 +30,10 @@ const ADMIN_KEY = "0xac0974bec39a17e36ba4a6b4d238ff944bacb478cbed5efcae784d7bf4f
  * answers. Its own process group, so `kill` takes workerd down with wrangler. Local bindings only.
  */
 export async function wranglerDev(dir, vars = {}, { config, probe = "/", name = dir, log = () => {} } = {}) {
-    const port = await new Promise((ok) => { const s = createServer().listen(0, "127.0.0.1", () => { const p = s.address().port; s.close(() => ok(p)); }); });
-    const w = spawn("npx", ["wrangler", "dev", ...(config ? ["--config", config] : []), "--port", String(port), "--ip", "127.0.0.1",
+    const free = () => new Promise((ok) => { const s = createServer().listen(0, "127.0.0.1", () => { const p = s.address().port; s.close(() => ok(p)); }); });
+    // Its own inspector port too: two workers started at once both take wrangler's default (9229), and one dies.
+    const [port, inspector] = await Promise.all([free(), free()]);
+    const w = spawn("npx", ["wrangler", "dev", ...(config ? ["--config", config] : []), "--port", String(port), "--inspector-port", String(inspector), "--ip", "127.0.0.1",
         "--persist-to", mkdtempSync(join(tmpdir(), "devnet-wrangler-")), ...Object.entries(vars).flatMap(([k, v]) => ["--var", `${k}:${v}`])],
         { cwd: dir, detached: true, stdio: ["ignore", "pipe", "pipe"], env: { ...process.env, NO_D1_WARNING: "true" } });
     let out = "";

package/src/publish/init.js

@@ -41,7 +41,7 @@ export function init(app, dir = app, { install = true, log = console.log } = {})
     }
     log(`${app} is in ${dir}. Next:
   1. app.json: the description, and the type's fields (role_map)
-  2. npx westmarch-ship app.json           # claims ${app} if it isn't yet, deploys the Worker, registers its agent`);
+  2. npx westmarch-ship app.json           # creates the repo ${app}, deploys the Worker, registers its agent`);
     return dir;
 }
 

package/src/publish/ship.js

@@ -53,7 +53,7 @@ const log = (s) => console.error(`[ship] ${s}`);
 //                                 //   (pages/intro.html, a fragment, replaces the description on the front page)
 //             "nav": [{ "href": "coverage.html", "label": "Coverage" }],   // optional: header links to them
 //             "examples": ["…"],  // optional: questions to start from, on the front page
-//             "plugin": {"marketplace": "owner/repo", "name": "…"},   // optional: its Claude Code plugin (hooks), offered by open-app
+//             "plugin": {"marketplace": "owner/repo", "name": "…"},   // optional: its Claude Code plugin (hooks), named in its card
 //             "skill": "skill/SKILL.md",   // optional: the app's agent skill, served at skill/<app>/SKILL.md and named
 //                                          //   in the card with its sha256; fangorn-index offers it to whoever opens the app
 //             "agent": "app/agent.js" },   // optional: the module whose registerAgent the card lists, when
@@ -240,8 +240,8 @@ export async function buildForDeploy(configPath, wranglerPath = join(dirname(res
 
 export async function ship(configPath, { crawl = true, deploy = true, dry = false, replace = false, only = null, register = false } = {}) {
     const cfg = loadConfig(configPath);
-    // No sources is fine: the app then presents whatever its members commit (repos: [] = all of them).
-    if (!register && !Object.keys(cfg.types).length)
+    // No sources is fine: the app then presents every repo on chain (repos: [] = all of them), as the explorer does.
+    if (!register && cfg.sources.length && !Object.keys(cfg.types).length)
         throw new Error(`${configPath}: no types yet, so nothing to build; --register sets up the app alone`);
     if (!cfg.network) throw new Error(`${configPath}: "network" is required, e.g. "baseSepolia"`);
     if (cfg.paid && !cfg.facilitator) throw new Error(`${configPath}: "paid" needs "facilitator", the URL of the x402 facilitator (Barliman) its quotes settle through`);
@@ -266,8 +266,9 @@ export async function ship(configPath, { crawl = true, deploy = true, dry = fals
     const chain = createPublicClient({ transport: http(FangornConfig.rpcUrl) });
     const repoDir = join(dir, "repo");
     if (!(await fangorn.onChainTip(me, cfg.app))) {
-        state.fromBlock = String(await chain.getBlockNumber());
-        log(`creating the app's repo ${me}:${cfg.app} (fromBlock ${state.fromBlock})`);
+        // Its own records start now; an app presenting every repo (the explorer) reads from the deployment's start.
+        if (presentedRepos(cfg).length) state.fromBlock = String(await chain.getBlockNumber());
+        log(`creating the app's repo ${me}:${cfg.app}`);
         mkdirSync(repoDir, { recursive: true });
         fangornCli(["repo", "init", cfg.app], { cwd: repoDir, dry });
         save();

package/src/publish/view.js

@@ -19,7 +19,7 @@
 //
 // The layout is fixed, so any reader (shard.js, a tab, an agent) reads any app's view:
 //   - URL layout, domain names (`domainFor`: the publisher's address prefix and the repo),
-//     row shape {track_id, fields, v}, manifest and catalog keys;
+//     row shape {track_id, owner, fields, v}, manifest and catalog keys;
 //   - a record is a row: track_id = its CID, fields = payload + entityType (its type);
 //   - the schema: a declared type is embedded and shipped with exactly its role map;
 //   - the embedded text (`composeText`).
@@ -146,11 +146,10 @@ export async function network(name = process.env.FANGORN_NETWORK || "baseSepolia
     return SupportedNetworks[name];
 }
 
-/** The IPFS gateway to read contents through: FANGORN_IPFS_GATEWAY, else the one in
- *  ~/.fangorn/config.json (what the fangorn CLI reads through), else none (the SDK default). */
+/** The IPFS gateway to read contents through: FANGORN_IPFS_GATEWAY, else none (the SDK
+ *  default, Fangorn's gateway). Not the deployer's CLI config: that would ship into the Worker. */
 export function ipfsGateway() {
-    let gateway = process.env.FANGORN_IPFS_GATEWAY ?? process.env.IPFS_GATEWAY;
-    try { gateway ??= JSON.parse(readFileSync(`${process.env.HOME}/.fangorn/config.json`, "utf8")).pinataGateway || undefined; } catch { /* no CLI config */ }
+    const gateway = process.env.FANGORN_IPFS_GATEWAY || process.env.IPFS_GATEWAY;
     return gateway && !/^https?:\/\//.test(gateway) ? `https://${gateway}` : gateway;
 }
 
@@ -447,7 +446,7 @@ async function publishDomain({ fangorn, store, schema, schemaHash, publisher, re
         const ids = fresh.slice(i, i + 32);
         try {
             const vs = await embedBatch(ids.map((id) => composeText(fieldsOf(id), rolesOf.get(fieldsOf(id).entityType))));
-            ids.forEach((id, j) => lines.push(JSON.stringify({ track_id: id, fields: fieldsOf(id), v: packVec(vs[j]) })));
+            ids.forEach((id, j) => lines.push(JSON.stringify({ track_id: id, owner: publisher, fields: fieldsOf(id), v: packVec(vs[j]) })));
         } catch (e) {
             // The encoder gave out (Workers AI's free daily allowance, say): keep what is embedded
             // and come back for the rest. Nothing served yet, nothing to save: fail as before.
@@ -543,6 +542,8 @@ export async function writeCatalog(store) {
         generated_at: Math.floor(Date.now() / 1000), embedding_model: EMBED_MODEL,
         domains: domains.map((m) => ({
             name: m.name, description: m.description, count: m.count, dim: m.dim,
+            // Whose it is: a reader can list publishers without opening a manifest.
+            ...(m.filter?.owner?.length === 1 ? { publisher: m.filter.owner[0], repo: m.filter.repo?.[0] } : {}),
             bytes: m.shards.reduce((s, x) => s + x.bytes, 0), shard_count: m.shards.length,
             entity_types: m.entity_types.map((e) => e.type), manifest: `${m.name}/manifest.json`,
             ...(m.link_hosts?.length ? { link_hosts: m.link_hosts } : {}),

package/template/README.md

@@ -9,15 +9,13 @@ indexes it every 5 minutes, and serves the site, the view, `/mcp` and the agent
 
 [![Deploy to Cloudflare](https://deploy.workers.cloudflare.com/button)](https://deploy.workers.cloudflare.com/?url=https://github.com/fangorn-network/westmarch/tree/main/template)
 
-1. Claim the app at [fangorn.network](https://fangorn.network).
-2. Press the button. Name the Worker after the app (`my-app`) and its R2 bucket
+1. Press the button. Name the Worker after the app (`my-app`) and its R2 bucket
    `my-app-view`. Cloudflare copies this repo into your GitHub, makes the bucket and
    deploys; every push to `main` deploys again.
-3. Back at fangorn.network, give the app its Worker's URL. Your wallet registers the
-   app's agent and binds its card there.
+2. At fangorn.network, give the app its Worker's URL. Your wallet creates the app's repo,
+   `<your wallet>:my-app`, and binds its card there.
 
-An app name with a dot or an underscore can't be a Worker name: set `"app"` in
-`app.json` to the name you claimed.
+An app name with a dot or an underscore can't be a Worker name.
 
 `npm run build` (`westmarch build`) is what Cloudflare runs: it builds the site and writes
 the app's config into `wrangler.json`, without signing or deploying anything.
@@ -33,9 +31,9 @@ Any wallet commits records of its type, from anywhere:
 
 ```sh
 echo '{"records":[{"id":"first","type":"my-app.item.v1","payload":{"id":"first","title":"Hello","text":"The first item.","tags":["demo"]}}]}' > items.json
-fangorn --app my-app repo init items
-fangorn --app my-app commit items.json -m "first items"
-fangorn --app my-app push
+fangorn repo init items
+fangorn commit items.json -m "first items"
+fangorn push
 ```
 
 The view picks it up within 5 minutes at `<url>/view`. A source that crawls something

package/plugin/scripts/fx.mjs

@@ -1,266 +0,0 @@
-#!/usr/bin/env node
-// The Fangorn app index, headless. One command per verb, JSON on stdout.
-//
-// WHY THERE IS NO MCP SERVER HERE
-// -------------------------------
-// An index that POINTS AT apps rather than hosting them needs no runtime of its
-// own. Every verb below is a function `@fangorn/westmarch` already exports, and
-// the agent's shell is the transport. Nobody has to stand up a server to be in
-// the index — a publisher bakes a view, and that is the whole obligation.
-//
-// WHY THIS IS A PLUGIN AND NOT A PAGE
-// -----------------------------------
-// One thing here is not stateless: the taste kernel. It lives in
-// ~/.fangorn/taste.json — on the filesystem, between the human and the agent —
-// because it has to outlive any one app, any one tab and any one ORIGIN.
-// localStorage cannot do that: a taste learned in fangorn.tv is invisible to the
-// next app by construction, which is the whole reason apps keep rebuilding it.
-// A file the agent can read is the shortest thing that carries it across.
-//
-// ponytail: a plaintext file, no wallet, no sync. `src/taste/vault.js` is the
-// upgrade path — same object, sealed to a signature, kept in the graph — and it
-// is worth doing the day the kernel needs to travel between machines, not now.
-// ponytail: every command re-fetches its view. Fine at 917 rows, ~seconds at
-// 42k; add a disk cache keyed by view URL when a big corpus makes it hurt.
-
-import { homedir } from "node:os";
-import { mkdirSync, readFileSync, writeFileSync } from "node:fs";
-import { join } from "node:path";
-import { configure, domainManifests, loadShard, trimView } from "../../src/core/shard.js";
-import { findCorpora, sourcesFromChain } from "../../src/discover/directory.js";
-import { linkOf, rolesFrom, textOf, titleOf } from "../../src/core/roles.js";
-import { exportTaste, recommend, taste } from "../../src/taste/taste.js";
-import { EMBED_MODEL, embedQuery, packVec, unpackVec } from "../../src/core/embed.js";
-import { browse, describe, facet, getRow, neighbors, search } from "../../src/agent/tools.js";
-
-const HOME = process.env.FANGORN_HOME ?? join(homedir(), ".fangorn");
-const TASTE = join(HOME, "taste.json");
-
-// ── the kernel on disk ───────────────────────────────────────────────────────
-const store = () => { try { return JSON.parse(readFileSync(TASTE, "utf8")); } catch { return { model: EMBED_MODEL, likes: [], dislikes: [] }; } };
-const save = (s) => { mkdirSync(HOME, { recursive: true }); writeFileSync(TASTE, JSON.stringify(s, null, 1)); };
-/** Picks are stored PACKED (base64 int8, the shard encoding) and unpacked here.
- *  Storing the picks rather than only the derived vector is what keeps the
- *  kernel correctable: you can read what it was built from and drop one. */
-const picks = (l = []) => l.map((p) => ({ ...p, vector: unpackVec(p.v) })).filter((p) => p.vector);
-const kernel = (s = store()) => taste(picks(s.likes), picks(s.dislikes));
-
-// ── args ─────────────────────────────────────────────────────────────────────
-const argv = process.argv.slice(2);
-const [cmd, ...rest] = argv;
-const pos = rest.filter((a) => !a.startsWith("--"));
-const flag = (n, d) => { const a = rest.find((x) => x.startsWith(`--${n}=`)); return a === undefined ? d : a.slice(n.length + 3); };
-const num = (n, d) => { const v = flag(n); return v === undefined ? d : Number(v); };
-const pairs = (s) => s ? Object.fromEntries(String(s).split(",").map((p) => p.split("=").map((x) => x.trim()))) : undefined;
-const list = (s) => String(s ?? "").split(",").map((x) => x.trim()).filter(Boolean);
-const out = (o) => console.log(JSON.stringify(o, null, 1));
-const die = (m) => { console.error(m); process.exit(1); };
-
-// ── a view, loaded ───────────────────────────────────────────────────────────
-let roles = rolesFrom([], []);
-async function load(view) {
-    if (!view) die("need a view URL");
-    const base = trimView(view);
-    configure({
-        resolveView: () => base,
-        // Roles must be ready BEFORE the first row is parsed: rowText runs during
-        // parsing, so deriving them afterwards leaves every row with empty text
-        // and lexical search silently matching nothing.
-        onManifests: (ms) => { roles = rolesFrom(ms); },
-        rowText: (f) => textOf(f, roles),
-    });
-    const rows = await loadShard(base);
-    roles = rolesFrom(domainManifests(), rows);
-    let model = null;
-    try { model = (await (await fetch(`${base}/cdn/catalog`)).json()).embedding_model ?? null; } catch { /* unranked, not fatal */ }
-    return { rows, roles, base, model };
-}
-
-/** A query vector, or null with the reason. Never throws: every verb here
- *  degrades to lexical and SAYS so rather than returning confident nonsense. */
-const qvOf = async (q) => { try { return { qv: await embedQuery(q), why: null }; } catch (e) { return { qv: null, why: e?.message ?? String(e) }; } };
-
-/** The corpus and the kernel must share an embedding space or cosine between
- *  them is noise that still looks like a score. */
-const mismatch = (model, s) => model && s.model && model !== s.model
-    ? `taste was built with ${s.model}, this corpus is ${model} — scores would be noise` : null;
-
-const sources = async () => {
-    const f = flag("sources"); if (f) return list(f);
-    if (process.env.FANGORN_SOURCES) return list(process.env.FANGORN_SOURCES);
-    try { return JSON.parse(readFileSync(join(HOME, "sources.json"), "utf8")); } catch { /* none pinned */ }
-    return chainSources();
-};
-
-// Every app with a verified card, the scan fangorn-mcp's list-apps runs, on FANGORN_NETWORK
-// (default baseSepolia). From the DataRegistry's deployment; --from-block overrides.
-async function chainSources() {
-    const [{ Fangorn }, { generatePrivateKey }, { network }] = await Promise.all([
-        import("@fangorn-network/sdk"), import("viem/accounts"), import("../../src/publish/view.js")]);
-    const config = await network();
-    const fangorn = Fangorn.create({ privateKey: generatePrivateKey(), config });   // reads only
-    const { sources } = await sourcesFromChain(fangorn, { fromBlock: BigInt(flag("from-block", String(config.fromBlock))) });
-    return sources;
-}
-
-// ── verbs ────────────────────────────────────────────────────────────────────
-switch (cmd) {
-
-// WHICH app has this. Downloads no corpus — coverage centroids only, ~4KB each.
-case "find": {
-    const src = await sources();
-    if (!src.length) die("no apps found on chain; pass --sources=a,b or write ~/.fangorn/sources.json");
-    out(await findCorpora(pos.join(" "), { sources: src, embed: embedQuery, model: EMBED_MODEL, limit: num("limit", 10) }));
-    break;
-}
-
-case "describe": {
-    const { rows, roles: r, model } = await load(pos[0]);
-    out({
-        ...describe(rows), model,
-        shape: r.declared ? "declared" : "sniffed",
-        title: r.title, subtitle: r.subtitle, tags: r.tags, text: r.text,
-        entityTypes: r.entityTypes, gates: r.gates,
-        // Where the reader goes next. The index's job ends here.
-        launch: r.launch, externalUrl: r.externalUrl, actions: r.actions,
-    });
-    break;
-}
-
-case "browse": {
-    const { rows, roles: r } = await load(pos[0]);
-    out(browse(rows, r, { type: flag("type"), where: pairs(flag("where")), sort: flag("sort"),
-                          desc: flag("asc") === undefined, limit: num("limit", 20), offset: num("offset", 0), fields: list(flag("fields")) }));
-    break;
-}
-
-case "search": {
-    const { rows, roles: r } = await load(pos[0]);
-    const q = pos.slice(1).join(" ");
-    const { qv, why } = await qvOf(q);
-    out({ query: q, mode: qv ? "semantic where rows have vectors" : "lexical", ...(why ? { why } : {}),
-          hits: search(rows, q, r, { qv, limit: num("limit", 10), where: pairs(flag("where")), fields: list(flag("fields")) }) });
-    break;
-}
-
-case "facet": {
-    const { rows } = await load(pos[0]);
-    out(facet(rows, pos[1], { limit: num("limit", 20), where: pairs(flag("where")) }));
-    break;
-}
-
-case "row": {
-    const { rows, roles: r } = await load(pos[0]);
-    const g = getRow(rows, pos[1], r);
-    out(g ? { ...g, url: linkOf(rows.find((x) => x.id === g.id) ?? {}, r) } : null);
-    break;
-}
-
-case "similar": {
-    const { rows, roles: r } = await load(pos[0]);
-    out(neighbors(rows, pos[1], r, { limit: num("limit", 10), fields: list(flag("fields")) }));
-    break;
-}
-
-// ── the kernel ───────────────────────────────────────────────────────────────
-case "like": case "dislike": {
-    const { rows, roles: r, base, model } = await load(pos[0]);
-    const s = store();
-    const into = cmd === "like" ? s.likes : s.dislikes;
-    const added = [];
-    for (const id of pos.slice(1)) {
-        const row = rows.find((x) => x.id === id);
-        if (!row) { console.error(`no row ${id}`); continue; }
-        if (!row.vector) { console.error(`${id} has no vector — nothing to learn from`); continue; }
-        // Newest last: taste() weights by recency, so order in the file is signal.
-        const at = into.findIndex((p) => p.id === id);
-        if (at >= 0) into.splice(at, 1);
-        into.push({ id, title: titleOf(row, r), view: base, at: new Date().toISOString().slice(0, 10), v: packVec(Array.from(row.vector)) });
-        added.push(id);
-    }
-    s.model ??= model ?? EMBED_MODEL;
-    save(s);
-    const t = kernel(s);
-    out({ added, likes: s.likes.length, dislikes: s.dislikes.length, taste: t && exportTaste(t), file: TASTE });
-    break;
-}
-
-case "forget": {
-    const s = store();
-    const drop = new Set(pos);
-    const before = s.likes.length + s.dislikes.length;
-    s.likes = s.likes.filter((p) => !drop.has(p.id));
-    s.dislikes = s.dislikes.filter((p) => !drop.has(p.id));
-    save(s);
-    out({ removed: before - s.likes.length - s.dislikes.length, likes: s.likes.length, dislikes: s.dislikes.length });
-    break;
-}
-
-case "taste": {
-    const s = store();
-    const t = kernel(s);
-    out(t ? { model: s.model, n: t.n, from: t.from, rejected: t.rejected, drift: t.drift,
-              // Where each pick was learned. A kernel built in one publisher's
-              // corpus is meant to be pointed at another's — this is the record
-              // of whether it actually has been.
-              views: [...new Set([...s.likes, ...s.dislikes].map((p) => p.view))],
-              export: exportTaste(t), file: TASTE }
-            : { n: 0, file: TASTE, note: "nothing liked yet — `fx like <view> <id>`" });
-    break;
-}
-
-// The headline: rank a corpus by a taste learned somewhere else entirely.
-case "recommend": {
-    const { rows, roles: r, model } = await load(pos[0]);
-    const s = store();
-    const t = kernel(s);
-    if (!t) die("no taste yet — `fx like <view> <id>` first");
-    const warn = mismatch(model, s);
-    if (warn) die(warn);
-    const seen = new Set([...s.likes, ...s.dislikes].map((p) => p.id));
-    out({ from: t.from, against: pos[0],
-          hits: recommend(rows, t, { limit: num("limit", 10), exclude: seen })
-              .map(({ row, score }) => ({ id: row.id, title: titleOf(row, r), score, url: linkOf(row, r) })) });
-    break;
-}
-
-// ── the handoff. The index points; the app does the work. ────────────────────
-case "launch": {
-    const { rows, roles: r } = await load(pos[0]);
-    const id = flag("row");
-    if (id) {
-        const row = rows.find((x) => x.id === id);
-        if (!row) die(`no row ${id}`);
-        out({ url: linkOf(row, r), title: titleOf(row, r) });
-        break;
-    }
-    if (!r.launch) die("this corpus declares no presentation.launch — nowhere to hand off to");
-    const t = kernel();
-    const fill = { taste: t ? JSON.stringify(exportTaste(t)) : "", q: pos.slice(1).join(" ") };
-    const url = String(r.launch).replace(/\{(\w+)\}/g, (_, k) => encodeURIComponent(fill[k] ?? ""));
-    const u = new URL(url);
-    if (u.protocol !== "https:" && u.protocol !== "http:") die(`refusing a ${u.protocol} launch URL`);
-    // The kernel travels in the URL because that is the only channel a page on
-    // someone else's origin can receive it on. It is the app's copy from here.
-    out({ url: u.toString(), carries: t ? { n: t.n, from: t.from } : null });
-    break;
-}
-
-default:
-    console.log(`fx <verb>
-
-  find <query> [--sources=a,b|--from-block=N]       which app has this. No corpus downloaded.
-  describe <view>                                  rows, field coverage, roles, where it hands off
-  browse <view> [--type= --where=k=v --sort= --asc --limit= --offset=]
-  search <view> <query> [--where=k=v --limit=]     semantic where rows have vectors, else lexical
-  facet <view> <field> [--where=k=v --limit=]      count a field's values
-  row <view> <id>                                  one record, whole
-  similar <view> <id> [--limit=]                   nearest by vector
-
-  like|dislike <view> <id...>                      teach the kernel. Writes ${TASTE}
-  forget <id...>                                   drop picks from it
-  taste                                            what it is, and what it was built from
-  recommend <view> [--limit=]                      rank ANY corpus by it
-
-  launch <view> [query] | launch <view> --row=<id> the handoff URL, carrying the kernel`);
-}