@jossuealcala/madre 1.0.1 → 1.0.3

package/src/files.mjs

@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: AGPL-3.0-only
+// MADRE · © 2026 Jossue Alcalá · GNU AGPL v3 with additional terms (Section 7): ADDITIONAL-TERMS.md
 import { createHash, randomUUID } from 'node:crypto';
 import { mkdir, readdir, readFile, realpath, stat, writeFile } from 'node:fs/promises';
 import { dirname, extname, join, resolve, sep } from 'node:path';
@@ -96,6 +98,36 @@ export async function walkProject(root, { maxFiles = 20000, ttlMs = 15000 } = {}
   return files;
 }
 
+// What changed on disk since a moment, by modification time (2026-10-14). A restore point sees
+// only what git sees, so a PDF a command wrote into an ignored `output/` was there and nobody said
+// so: the Finder did not refresh and nothing told whose it was. This looks at the files
+// themselves, skipping the same heavy folders the search skips and MADRE's own `.pulse`/`.madre`,
+// bounded so a large project costs a fraction of a second. Newest first.
+const UNWATCHED = new Set([...SHALLOW, '.pulse', '.madre']);
+export async function filesChangedSince(root, since, { maxFiles = 8000, limit = 40 } = {}) {
+  const from = Number(since) - 250;
+  if (!Number.isFinite(from)) return [];
+  const found = [];
+  let seen = 0;
+  async function walk(dir, prefix, depth) {
+    if (seen >= maxFiles || depth > 14) return;
+    let entries = [];
+    try { entries = await readdir(dir, { withFileTypes: true }); } catch { return; }
+    const files = [];
+    for (const entry of entries) {
+      if (SKIP.has(entry.name)) continue;
+      const rel = prefix ? `${prefix}/${entry.name}` : entry.name;
+      if (entry.isDirectory()) { if (!UNWATCHED.has(entry.name)) await walk(join(dir, entry.name), rel, depth + 1); continue; }
+      if (entry.isFile()) files.push(rel);
+    }
+    seen += files.length;
+    const stats = await Promise.all(files.map((rel) => stat(join(root, rel)).then((info) => [rel, info.mtimeMs], () => null)));
+    for (const one of stats) if (one && one[1] >= from) found.push({ path: one[0], at: one[1] });
+  }
+  await walk(root, '', 0);
+  return found.sort((a, b) => b.at - a.at).slice(0, limit).map((one) => one.path);
+}
+
 export function scoreFile(path, query) {
   const q = query.toLowerCase();
   if (!q) return 1;

package/src/github.mjs

@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: AGPL-3.0-only
+// MADRE · © 2026 Jossue Alcalá · GNU AGPL v3 with additional terms (Section 7): ADDITIONAL-TERMS.md
 // GitHub, as the GITHUB module and its MCP server both speak to it.
 //
 // Two ways in, and the order matters. First the `gh` CLI, if this computer has it and it is

package/src/heartbeat.mjs

@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: AGPL-3.0-only
+// MADRE · © 2026 Jossue Alcalá · GNU AGPL v3 with additional terms (Section 7): ADDITIONAL-TERMS.md
 // «Still in use»: once a day, every copy of MADRE tells madre.run it is on (2026-10-13).
 //
 // What goes, and nothing else: a random identifier this copy made for itself once

package/src/i18n.mjs

@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: AGPL-3.0-only
+// MADRE · © 2026 Jossue Alcalá · GNU AGPL v3 with additional terms (Section 7): ADDITIONAL-TERMS.md
 // The room's language, on this side of the wire.
 //
 // The catalogue is the page's: public/es.js, one file for the whole product, because a sentence
@@ -24,9 +26,37 @@ export function setLanguage(id) {
   return current;
 }
 
+// «Mac» only on a Mac (2026-10-15): MADRE installs on Linux too, and a sentence about the machine
+// it runs on says «computer» there. Same rule as public/i18n.js (hostWords); hardware named on
+// purpose («a Mac with an M chip») has no article in front and is left alone.
+let hostIsMac = process.platform === 'darwin';
+export const setHostIsMac = (value) => { hostIsMac = Boolean(value); return hostIsMac; };
+export function hostWords(text) {
+  if (hostIsMac || typeof text !== 'string' || !text.includes('Mac')) return text;
+  return text
+    .replace(/\b(this|your|the|This|Your|The) Mac\b/g, '$1 computer')
+    .replace(/(^|[^\p{L}])(esta|tu|la|Esta|Tu|La) Mac\b/gu, '$1$2 computadora');
+}
+
+// A sentence MADRE wrote in one language, quoted in the other. A failure is recorded in the
+// language the room spoke when it happened, and @madre's round summary quoted it as it was: a
+// Spanish summary said «(Google rejected the Gemini credentials…)» (manual tests, 2026-10-17).
+// Only whole sentences of the catalogue are swapped, never a word inside one, so ids, commands and
+// whatever an agent wrote stay as they are.
+let sentencePairs = null;
+export function inLanguage(text, lang) {
+  let out = String(text ?? '');
+  sentencePairs ??= Object.entries(ES).filter(([en, es]) => typeof es === 'string' && en !== es && en.length >= 24 && /[.!?»)]$/.test(en));
+  for (const [en, es] of sentencePairs) {
+    const [from, to] = lang === 'es' ? [en, hostWords(es)] : [hostWords(es), en];
+    if (out.includes(from)) out = out.split(from).join(to);
+  }
+  return out;
+}
+
 export function t(text, vars = null) {
   if (typeof text !== 'string' || !text) return text;
-  const said = CATALOGUES[current]?.[text] ?? text;
+  const said = hostWords(CATALOGUES[current]?.[text] ?? text);
   if (!vars) return said;
   return said.replace(/\{(\w+)\}/g, (whole, name) => (Object.hasOwn(vars, name) ? String(vars[name]) : whole));
 }

package/src/image-studio.mjs

@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: AGPL-3.0-only
+// MADRE · © 2026 Jossue Alcalá · GNU AGPL v3 with additional terms (Section 7): ADDITIONAL-TERMS.md
 import { fileURLToPath } from 'node:url';
 import { resolveGeminiKey } from './mcp/image-server.mjs';
 

package/src/json-file.mjs

@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: AGPL-3.0-only
+// MADRE · © 2026 Jossue Alcalá · GNU AGPL v3 with additional terms (Section 7): ADDITIONAL-TERMS.md
 // Small files that more than one thing changes at once (2026-10-12, Lote 2 of the 1.0 review): the
 // tour, the review ask, a project's record of where it is, the list of a room's conversations.
 // Each was read, changed and written with nothing between two changes, so the second one wrote

package/src/launch.mjs

@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: AGPL-3.0-only
+// MADRE · © 2026 Jossue Alcalá · GNU AGPL v3 with additional terms (Section 7): ADDITIONAL-TERMS.md
 // What is shown of a command, and what is never shown.
 //
 // THE LAUNCH floor in the core prints the exact command MADRE would run, because a person who is

package/src/lease.mjs

@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: AGPL-3.0-only
+// MADRE · © 2026 Jossue Alcalá · GNU AGPL v3 with additional terms (Section 7): ADDITIONAL-TERMS.md
 import { mkdir, readdir, realpath, stat } from 'node:fs/promises';
 import { join, relative, sep } from 'node:path';
 import { declaredTypeFor } from './files.mjs';
@@ -119,7 +121,9 @@ export function leaseInstructions({ outDir, agentId, scopes = { write: true, ima
       : canImage ? `You can generate images; save them${create ? ' where images live in this project, or in the scratch folder,' : ' into the lease directory'} with a descriptive file name.`
       : couldImage ? 'Image generation is switched off for this request; if asked for an image, say so and do not attempt it.'
         : 'You cannot generate images from this CLI; if asked for one, say so plainly instead of attempting it.',
-    'Do this work yourself. Do not hand it to a subagent or spawn another agent: a subagent writes outside this lease, so nothing it did would be checked, shown to the human or undoable — and the tools for it are blocked, which can leave you waiting instead of answering.',
+    // «Do not hand it to another agent» read as «do not plan»: with a lease, agents stopped proposing
+    // pulse plans altogether (2026-10-14). What is barred is the CLI's own subagents, not the room's.
+    'Do this work yourself rather than through your CLI\'s own subagents or spawned agents: a subagent writes outside this lease, so nothing it did would be checked, shown to the human or undoable — and the tools for it are blocked, which can leave you waiting instead of answering. A pulse plan that puts the room\'s other agents to work is different and still allowed.',
     'List the files you created (or "none") before any plan block; nothing may follow a plan block.',
   ].filter(Boolean).join('\n');
 }

package/src/lobby-work.mjs

@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: AGPL-3.0-only
+// MADRE · © 2026 Jossue Alcalá · GNU AGPL v3 with additional terms (Section 7): ADDITIONAL-TERMS.md
 // What was worked on last on this Mac, for the lobby (2026-10-10): the newest conversations of
 // every room the lobby knows, open or asleep, each with its last few lines, and the summary MADRE
 // writes of them with its local model. Everything here READS: a room's list of conversations

package/src/local-ai.mjs

@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: AGPL-3.0-only
+// MADRE · © 2026 Jossue Alcalá · GNU AGPL v3 with additional terms (Section 7): ADDITIONAL-TERMS.md
 // Which projects use the local AI (Ollama), decided from Home (2026-10-13).
 //
 // Ollama is one per computer and its switches live in ~/.pulse/config.json, which every project

package/src/looks.mjs

@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: AGPL-3.0-only
+// MADRE · © 2026 Jossue Alcalá · GNU AGPL v3 with additional terms (Section 7): ADDITIONAL-TERMS.md
 // How the person wants MADRE to look, once for every page (2026-10-12). Each project is its own
 // origin — another port — and Home is one more, so what a browser keeps for one is invisible to
 // the others: the dark theme chosen in Home left every project light. The choices live here, in
@@ -6,9 +8,10 @@
 // so a page paints in the last known look before it hears from here.
 //
 // Only what the pages share: the theme, the accent, the wallpaper and its dials, the bubbles and
-// the text of the conversation. How Home lays out its own cards stays in Home's browser.
+// the text of the conversation. How Home is arranged lives beside it, in home.json (below).
 
-import { readFile } from 'node:fs/promises';
+import { createHash } from 'node:crypto';
+import { readFile, rm } from 'node:fs/promises';
 import { join } from 'node:path';
 import { oneAtATime, writeWhole } from './json-file.mjs';
 
@@ -23,6 +26,8 @@ export const LOOK_KEYS = {
   'pulse.wallpaper.blur': NUMBER,
   'pulse.bubbles': CHOICE,
   'pulse.text': CHOICE,
+  // The maps drawn as neurons (public/neural.js): 'on', or nothing.
+  'pulse.neural': CHOICE,
 };
 const looksFile = (stateRoot) => join(stateRoot, 'looks.json');
 
@@ -86,3 +91,123 @@ export function changeLooks(stateRoot, patch, now = new Date()) {
     return { looks, saved: true };
   });
 }
+
+// HOME, ARRANGED ONCE (2026-10-16). Home is shown by whichever process answers /salas — the
+// Coordinator's, or any project's — and each is another port, so the arrangement Home kept in the
+// browser was lost on every other page and whenever MADRE came back on another port. What the
+// person arranged lives here, in ~/.pulse/home.json: the tiles and their sizes, the order of the
+// projects, the projects on the bar, and how the cards read. Kept as the page keeps them (the same
+// keys, the same text), each checked for its shape before it is written.
+const homeFile = (stateRoot) => join(stateRoot, 'home.json');
+const HOME_TEXT = 8000;
+const isIds = (value) => Array.isArray(value) && value.length <= 500 && value.every((id) => typeof id === 'string' && id.length <= 200);
+export const HOME_KEYS = {
+  'pulse.home.layout': (value) => { try { const raw = JSON.parse(value); return Boolean(raw) && typeof raw === 'object' && !Array.isArray(raw) && (raw.order === undefined || isIds(raw.order)); } catch { return false; } },
+  'pulse.home.projects': (value) => { try { return isIds(JSON.parse(value)); } catch { return false; } },
+  'pulse.lobbyBar': (value) => { try { return isIds(JSON.parse(value)); } catch { return false; } },
+  'pulse.home.cards': (value) => CHOICE.test(value),
+  'pulse.home.text': (value) => CHOICE.test(value),
+  'pulse.home.order': (value) => CHOICE.test(value),
+};
+export async function readHome(stateRoot) {
+  const raw = await readFile(homeFile(stateRoot), 'utf8').then((text) => JSON.parse(text)).catch(() => null);
+  const home = {};
+  for (const [key, valid] of Object.entries(HOME_KEYS)) {
+    const value = raw?.home?.[key];
+    home[key] = typeof value === 'string' && value.length <= HOME_TEXT && valid(value) ? value : null;
+  }
+  return { home, saved: Boolean(raw && typeof raw.home === 'object') };
+}
+export function changeHome(stateRoot, patch, now = new Date()) {
+  return oneAtATime(homeFile(stateRoot), async () => {
+    if (!patch || typeof patch !== 'object' || Array.isArray(patch)) return { error: 'home' };
+    for (const [key, value] of Object.entries(patch)) {
+      if (!Object.hasOwn(HOME_KEYS, key)) return { error: 'key' };
+      if (value !== null && (typeof value !== 'string' || value.length > HOME_TEXT || !HOME_KEYS[key](value))) return { error: 'value' };
+    }
+    const { home } = await readHome(stateRoot);
+    Object.assign(home, patch);
+    await writeWhole(homeFile(stateRoot), `${JSON.stringify({ home, at: new Date(now).toISOString() }, null, 2)}\n`);
+    return { home, saved: true };
+  });
+}
+
+// YOUR OWN WALLPAPER (1.0.3). One picture of the person's, for every page that chooses it (the
+// choice is still each page's own: `pulse.wallpaper` = 'custom'). The page reads the picture,
+// fits it (no longer side than WALLPAPER_SIDE), encodes it and takes its colours for the veil, the
+// mesh and the tint, the way the wallpapers that ship were made by hand; here it is kept as it
+// came: the picture, and beside it what it is (`custom.json`). Only a picture is kept: its first
+// bytes say WebP, JPEG or PNG, or nothing is written. Never an SVG: it can carry a script.
+export const WALLPAPER_BYTES = 8 * 1024 * 1024;
+const wallDir = (stateRoot) => join(stateRoot, 'wallpaper');
+const wallMeta = (stateRoot) => join(wallDir(stateRoot), 'custom.json');
+const PICTURES = [
+  { type: 'image/webp', ext: 'webp', is: (b) => b.length > 12 && b.toString('latin1', 0, 4) === 'RIFF' && b.toString('latin1', 8, 12) === 'WEBP' },
+  { type: 'image/jpeg', ext: 'jpg', is: (b) => b.length > 3 && b[0] === 0xff && b[1] === 0xd8 && b[2] === 0xff },
+  { type: 'image/png', ext: 'png', is: (b) => b.length > 8 && b.toString('latin1', 1, 4) === 'PNG' && b[0] === 0x89 },
+];
+const RGB = (value) => Array.isArray(value) && value.length === 3 && value.every((n) => Number.isInteger(n) && n >= 0 && n <= 255);
+const SCHEME = (value) => Boolean(value) && RGB(value.veil) && RGB(value.tint) && Array.isArray(value.mesh) && value.mesh.length === 3 && value.mesh.every(RGB);
+const PERCENT = (value) => Number.isFinite(value) && value >= 0 && value <= 100;
+// What a page sends about the picture, checked one field at a time.
+function wallShape(meta) {
+  if (!meta || typeof meta !== 'object') return null;
+  const w = Number(meta.w);
+  const h = Number(meta.h);
+  if (!Number.isInteger(w) || !Number.isInteger(h) || w < 1 || h < 1 || w > 20000 || h > 20000) return null;
+  if (!SCHEME(meta.palette?.dark) || !SCHEME(meta.palette?.light)) return null;
+  const x = Number(meta.focus?.x ?? 50);
+  const y = Number(meta.focus?.y ?? 50);
+  if (!PERCENT(x) || !PERCENT(y)) return null;
+  const pick = (one) => ({ veil: one.veil, tint: one.tint, mesh: one.mesh });
+  return { w, h, focus: { x: Math.round(x * 10) / 10, y: Math.round(y * 10) / 10 }, palette: { dark: pick(meta.palette.dark), light: pick(meta.palette.light) } };
+}
+// The picture kept, as a page reads it: its version (a hash of its bytes), its type, its size, where
+// it is framed and its colours. `null` when there is none, or what is there cannot be trusted.
+export async function readWallpaper(stateRoot) {
+  const raw = await readFile(wallMeta(stateRoot), 'utf8').then((text) => JSON.parse(text)).catch(() => null);
+  const shape = wallShape(raw);
+  const kind = PICTURES.find((one) => one.type === raw?.type);
+  if (!shape || !kind || typeof raw.v !== 'string' || !/^[0-9a-f]{8,64}$/.test(raw.v)) return null;
+  return { v: raw.v, type: kind.type, ...shape };
+}
+export async function wallpaperBytes(stateRoot) {
+  const meta = await readWallpaper(stateRoot);
+  if (!meta) return null;
+  const kind = PICTURES.find((one) => one.type === meta.type);
+  const bytes = await readFile(join(wallDir(stateRoot), `custom.${kind.ext}`)).catch(() => null);
+  return bytes ? { bytes, type: meta.type, v: meta.v } : null;
+}
+export function saveWallpaper(stateRoot, bytes, meta) {
+  return oneAtATime(wallMeta(stateRoot), async () => {
+    if (!Buffer.isBuffer(bytes) || !bytes.length) return { error: 'empty' };
+    if (bytes.length > WALLPAPER_BYTES) return { error: 'size' };
+    const kind = PICTURES.find((one) => one.is(bytes));
+    if (!kind) return { error: 'type' };
+    const shape = wallShape(meta);
+    if (!shape) return { error: 'meta' };
+    const v = createHash('sha256').update(bytes).digest('hex').slice(0, 16);
+    await writeWhole(join(wallDir(stateRoot), `custom.${kind.ext}`), bytes);
+    for (const other of PICTURES) if (other !== kind) await rm(join(wallDir(stateRoot), `custom.${other.ext}`), { force: true });
+    await writeWhole(wallMeta(stateRoot), `${JSON.stringify({ v, type: kind.type, ...shape, at: new Date().toISOString() }, null, 2)}\n`);
+    return { custom: { v, type: kind.type, ...shape } };
+  });
+}
+// Where the picture is framed: the point of it that stays in view when the screen crops it.
+export function frameWallpaper(stateRoot, focus) {
+  return oneAtATime(wallMeta(stateRoot), async () => {
+    const raw = await readFile(wallMeta(stateRoot), 'utf8').then((text) => JSON.parse(text)).catch(() => null);
+    if (!raw) return { error: 'none' };
+    const shape = wallShape({ ...raw, focus });
+    if (!shape) return { error: 'value' };
+    await writeWhole(wallMeta(stateRoot), `${JSON.stringify({ ...raw, focus: shape.focus, at: new Date().toISOString() }, null, 2)}\n`);
+    return { custom: await readWallpaper(stateRoot) };
+  });
+}
+export function dropWallpaper(stateRoot) {
+  return oneAtATime(wallMeta(stateRoot), async () => {
+    for (const kind of PICTURES) await rm(join(wallDir(stateRoot), `custom.${kind.ext}`), { force: true });
+    await rm(wallMeta(stateRoot), { force: true });
+    return { custom: null };
+  });
+}

package/src/market-key.mjs

@@ -0,0 +1,8 @@
+// SPDX-License-Identifier: AGPL-3.0-only
+// MADRE · © 2026 Jossue Alcalá · GNU AGPL v3 with additional terms (Section 7): ADDITIONAL-TERMS.md
+// The public half of the Market's key (scripts/market-key.mjs). The catalog at madre.run/mercado/
+// is signed with the private half, which lives only on the author's computer; a catalog this key
+// does not verify is not read, and nothing in it is installed (src/market-remote.mjs).
+export const MARKET_PUBLIC_KEY = `-----BEGIN PUBLIC KEY-----
+MCowBQYDK2VwAyEA4/DXYprFh2wfiOPpkJheWR0uEtJA+Wl3+AnJXE1YGt0=
+-----END PUBLIC KEY-----`;

package/src/market-remote.mjs

@@ -0,0 +1,239 @@
+// SPDX-License-Identifier: AGPL-3.0-only
+// MADRE · © 2026 Jossue Alcalá · GNU AGPL v3 with additional terms (Section 7): ADDITIONAL-TERMS.md
+// THE MARKET, from madre.run (2026-10-18). What the Market shows and the modules it hands out do
+// not wait for a new MADRE: they live in a catalog the author publishes at madre.run/mercado/,
+// signed with a key only the author holds (scripts/market-key.mjs). MADRE reads it when it opens —
+// at most every ten minutes, however many projects open at once — and keeps the last one it could
+// verify, so the Market works without internet with what it knew.
+//
+//   catalogo.json      the catalog: shelves, the featured order, and one entry per module — the
+//                      words and drawings of MADRE's own, and for a new module its file, pinned by
+//                      its sha256 and size.
+//   catalogo.json.sig  the Ed25519 signature of those exact bytes, in base64.
+//
+// A catalog the key does not verify is not read. A module file whose sha256 is not the one the
+// signed catalog names is not installed. A catalog older than the one already kept is refused, so
+// an old signed catalog cannot be served again to roll a module back. What a module may do once
+// installed is the same as any module installed by hand: the checks of src/modules/index.mjs.
+//
+// A module got from the Market is remembered in market/installed.json. When the catalog names a
+// newer file for it, MADRE installs that one on its own and says so, once, in the room (the author
+// signed it; the person chose the module). A module installed by hand is never touched.
+
+import { createHash, createPublicKey, verify } from 'node:crypto';
+import { mkdir, readFile, rename, writeFile } from 'node:fs/promises';
+import { join } from 'node:path';
+import { t } from './i18n.mjs';
+import { MARKET_PUBLIC_KEY } from './market-key.mjs';
+
+export const MARKET_URL = 'https://madre.run/mercado/catalogo.json';
+const MAX_CATALOG = 1024 * 1024;
+const MAX_SIGNATURE = 1024;
+const MAX_MODULE = 512 * 1024;
+const FRESH_MS = 10 * 60 * 1000;
+const TIMEOUT_MS = 8000;
+const ID = /^[a-z][a-z0-9-]{1,40}$/;
+const SHA = /^[0-9a-f]{64}$/;
+const COLOR = /^#[0-9a-f]{6}$/i;
+
+export const marketUrl = (env = process.env) => env.PULSE_MARKET_URL || MARKET_URL;
+const folder = (stateRoot) => join(stateRoot, 'market');
+const readJson = (file) => readFile(file, 'utf8').then((raw) => JSON.parse(raw)).catch(() => null);
+async function writeAtomic(file, data) {
+  const temp = `${file}.${process.pid}.${Date.now()}.tmp`;
+  await writeFile(temp, data);
+  await rename(temp, file);
+}
+
+export function verifySigned(bytes, signature, publicKeyPem = MARKET_PUBLIC_KEY) {
+  try { return verify(null, Buffer.from(bytes), createPublicKey(publicKeyPem), Buffer.from(String(signature ?? '').trim(), 'base64')); } catch { return false; }
+}
+export const sha256 = (bytes) => createHash('sha256').update(bytes).digest('hex');
+
+// MADRE's version against what a module asks for: «1.0.3» ≥ «1.0.2».
+export function fitsVersion(have, need) {
+  if (!need) return true;
+  const parts = (value) => String(value).replace(/^v/, '').split(/[.-]/).slice(0, 3).map((part) => Number.parseInt(part, 10) || 0);
+  const [a, b] = [parts(have), parts(need)];
+  for (let at = 0; at < 3; at += 1) if (a[at] !== b[at]) return a[at] > b[at];
+  return true;
+}
+
+// Words in both languages, or one for both. Anything else is dropped.
+const words = (value, max = 400) => {
+  if (typeof value === 'string') return value.slice(0, max);
+  if (!value || typeof value !== 'object') return null;
+  const out = {};
+  for (const lang of ['en', 'es']) if (typeof value[lang] === 'string') out[lang] = value[lang].slice(0, max);
+  return Object.keys(out).length ? out : null;
+};
+// The address a module file may come from: https, on the catalog's own host (a local catalog,
+// for a test, may name its own local files).
+function fileUrl(raw, catalogUrl) {
+  let url;
+  let base;
+  try { url = new URL(raw, catalogUrl); base = new URL(catalogUrl); } catch { return null; }
+  if (url.host !== base.host) return null;
+  if (url.protocol !== 'https:' && !(url.protocol === 'http:' && ['127.0.0.1', 'localhost'].includes(url.hostname))) return null;
+  return url.href;
+}
+
+// The catalog, read whole or not at all where it matters (its shape), entry by entry where it
+// does not (an entry MADRE cannot read is left out, so a newer catalog still works here).
+export function readCatalog(text, { url = MARKET_URL } = {}) {
+  const data = JSON.parse(text);
+  if (data?.schema !== 1 || !Array.isArray(data.modules)) throw new Error(t('This is not a Market catalog MADRE can read.'));
+  const issued = Date.parse(data.issued);
+  if (!Number.isFinite(issued)) throw new Error(t('The Market catalog does not say when it was made.'));
+  const shelves = (Array.isArray(data.shelves) ? data.shelves : []).filter((shelf) => ID.test(shelf?.id ?? '')).map((shelf) => ({ id: shelf.id, title: words(shelf.title, 80), about: words(shelf.about, 200) })).slice(0, 20);
+  const modules = [];
+  for (const raw of data.modules.slice(0, 200)) {
+    if (!ID.test(raw?.id ?? '')) continue;
+    const entry = {
+      id: raw.id,
+      shelf: ID.test(raw.shelf ?? '') ? raw.shelf : null,
+      scope: raw.scope === 'project' ? 'project' : 'everywhere',
+      price: Number.isFinite(raw.price) && raw.price >= 0 ? raw.price : 0,
+      name: words(raw.name, 60),
+      line: words(raw.line, 140),
+      pitch: words(raw.pitch, 240),
+      summary: words(raw.summary, 1200),
+      hue: Array.isArray(raw.hue) && raw.hue.length === 2 && raw.hue.every((one) => COLOR.test(one)) ? raw.hue : null,
+      // Drawings are markup: they travel signed, and the page keeps only the shapes it knows (market.js).
+      icon: typeof raw.icon === 'string' && raw.icon.length <= 8000 ? raw.icon : null,
+      art: typeof raw.art === 'string' && raw.art.length <= 60000 ? raw.art : null,
+      version: typeof raw.version === 'string' && /^\d+\.\d+\.\d+$/.test(raw.version) ? raw.version : null,
+      minMadre: typeof raw.minMadre === 'string' && /^\d+\.\d+\.\d+$/.test(raw.minMadre) ? raw.minMadre : null,
+      changes: words(raw.changes, 400),
+      file: null,
+    };
+    if (raw.file) {
+      const href = fileUrl(raw.file.url, url);
+      if (!href || !SHA.test(raw.file.sha256 ?? '') || !entry.version) continue;
+      entry.file = { url: href, sha256: raw.file.sha256, size: Number(raw.file.size) || null };
+    }
+    modules.push(entry);
+  }
+  const featured = (Array.isArray(data.featured) ? data.featured : []).filter((id) => modules.some((one) => one.id === id)).slice(0, 8);
+  // What the author has to say to everyone who opens MADRE: one line each, said once, and the
+  // module it is about when there is one.
+  const news = (Array.isArray(data.news) ? data.news : []).filter((one) => ID.test(one?.id ?? '')).map((one) => ({ id: one.id, text: words(one.text, 240), module: ID.test(one.module ?? '') ? one.module : null })).filter((one) => one.text).slice(0, 10);
+  return { schema: 1, issued: new Date(issued).toISOString(), shelves, featured, modules, news };
+}
+
+async function bytesFrom(url, { fetchImpl, max }) {
+  const controller = new AbortController();
+  const timer = setTimeout(() => controller.abort(), TIMEOUT_MS);
+  try {
+    const response = await fetchImpl(url, { signal: controller.signal, headers: { accept: 'application/json, text/javascript, */*' } });
+    if (!response.ok) throw new Error(`${response.status}`);
+    const buffer = Buffer.from(await response.arrayBuffer());
+    if (buffer.length > max) throw new Error('too large');
+    return buffer;
+  } finally { clearTimeout(timer); }
+}
+
+// The catalog kept on this computer, checked again before it is believed.
+export async function keptCatalog({ stateRoot, publicKey = MARKET_PUBLIC_KEY } = {}) {
+  const [bytes, signature, state] = await Promise.all([readFile(join(folder(stateRoot), 'catalogo.json')).catch(() => null), readFile(join(folder(stateRoot), 'catalogo.json.sig'), 'utf8').catch(() => null), readJson(join(folder(stateRoot), 'state.json'))]);
+  if (!bytes || !signature || !verifySigned(bytes, signature, publicKey)) return null;
+  try { return readCatalog(bytes.toString('utf8'), { url: state?.url ?? MARKET_URL }); } catch { return null; }
+}
+
+// Ask madre.run for the catalog. Answers with the newest one this computer can trust, and why it
+// is not newer when it could not be.
+export async function refreshCatalog({ stateRoot, env = process.env, fetchImpl = globalThis.fetch, publicKey = MARKET_PUBLIC_KEY, force = false, now = Date.now } = {}) {
+  const dir = folder(stateRoot);
+  const state = (await readJson(join(dir, 'state.json'))) ?? {};
+  const kept = await keptCatalog({ stateRoot, publicKey });
+  if (!force && kept && state.checkedAt && now() - Date.parse(state.checkedAt) < FRESH_MS) return { catalog: kept, fresh: false };
+  const url = marketUrl(env);
+  try {
+    const [bytes, signature] = await Promise.all([bytesFrom(url, { fetchImpl, max: MAX_CATALOG }), bytesFrom(`${url}.sig`, { fetchImpl, max: MAX_SIGNATURE })]);
+    if (!verifySigned(bytes, signature.toString('utf8'), publicKey)) throw new Error(t('The Market catalog is not signed with MADRE\'s key, so MADRE did not read it.'));
+    const catalog = readCatalog(bytes.toString('utf8'), { url });
+    if (kept && Date.parse(catalog.issued) < Date.parse(kept.issued)) throw new Error(t('The Market served a catalog older than the one this computer has, so MADRE kept its own.'));
+    await mkdir(dir, { recursive: true });
+    await writeAtomic(join(dir, 'catalogo.json'), bytes);
+    await writeAtomic(join(dir, 'catalogo.json.sig'), signature);
+    await writeAtomic(join(dir, 'state.json'), JSON.stringify({ url, checkedAt: new Date(now()).toISOString(), issued: catalog.issued }, null, 2));
+    return { catalog, fresh: true };
+  } catch (error) {
+    await mkdir(dir, { recursive: true }).catch(() => {});
+    await writeAtomic(join(dir, 'state.json'), JSON.stringify({ ...state, url: state.url ?? url, checkedAt: new Date(now()).toISOString(), failed: error.name === 'AbortError' ? 'timeout' : String(error.message).slice(0, 200) }, null, 2)).catch(() => {});
+    return { catalog: kept, fresh: false, error: error.name === 'AbortError' ? 'timeout' : error.message };
+  }
+}
+
+export const installedFromMarket = async (stateRoot) => (await readJson(join(folder(stateRoot), 'installed.json'))) ?? {};
+
+// One module from the catalog onto this computer, for every project (each one turns it on).
+// `verify` and `install` are src/modules/index.mjs's own checks and writer.
+export async function installFromMarket({ stateRoot, projectRoot, id, catalog, madre, fetchImpl = globalThis.fetch, verifyText, installText }) {
+  const entry = catalog?.modules.find((one) => one.id === id && one.file);
+  if (!entry) throw new Error(t('The Market has no module «{id}» to install.', { id }));
+  if (!fitsVersion(madre, entry.minMadre)) throw new Error(t('This module needs MADRE {version} or newer.', { version: entry.minMadre }));
+  const bytes = await bytesFrom(entry.file.url, { fetchImpl, max: MAX_MODULE });
+  if (sha256(bytes) !== entry.file.sha256) throw new Error(t('The module file is not the one the Market signed, so MADRE did not install it.'));
+  const text = bytes.toString('utf8');
+  const checked = await verifyText({ text, name: `${id}.mjs`, replace: true });
+  if (checked.id !== id) throw new Error(t('The file says it is «{found}», not «{id}», so MADRE did not install it.', { found: checked.id, id }));
+  const done = await installText({ text, name: `${id}.mjs`, scope: 'user', stateRoot, projectRoot, source: { kind: 'market', from: entry.file.url }, replace: true });
+  const dir = folder(stateRoot);
+  await mkdir(dir, { recursive: true });
+  const installed = await installedFromMarket(stateRoot);
+  installed[id] = { version: entry.version, sha256: entry.file.sha256, at: new Date().toISOString() };
+  await writeAtomic(join(dir, 'installed.json'), JSON.stringify(installed, null, 2));
+  return { ...done, version: entry.version };
+}
+
+// A module removed by hand is no longer the Market's to update: it is forgotten here too, or the
+// next catalog would bring it back.
+export async function forgetFromMarket(stateRoot, id) {
+  const installed = await installedFromMarket(stateRoot);
+  if (!installed[id]) return false;
+  delete installed[id];
+  await writeAtomic(join(folder(stateRoot), 'installed.json'), JSON.stringify(installed, null, 2));
+  return true;
+}
+
+// THE MARKET'S NEWS, told once to each computer: what the author wrote in the catalog, and every
+// module that arrived in it that this computer does not have. Kept in market/announced.json.
+export async function marketAnnouncements(stateRoot, catalog, have = []) {
+  if (!catalog) return { news: [], modules: [] };
+  const told = new Set((await readJson(join(folder(stateRoot), 'announced.json'))) ?? []);
+  return {
+    news: (catalog.news ?? []).filter((one) => !told.has(`news:${one.id}`)),
+    modules: catalog.modules.filter((one) => one.file && !have.includes(one.id) && !told.has(`module:${one.id}`)).map(({ id, name, line }) => ({ id, name, line })),
+  };
+}
+export async function marketAnnounced(stateRoot, keys = []) {
+  const told = new Set((await readJson(join(folder(stateRoot), 'announced.json'))) ?? []);
+  for (const key of keys) if (/^(news|module):[a-z][a-z0-9-]{1,40}$/.test(String(key))) told.add(key);
+  await mkdir(folder(stateRoot), { recursive: true });
+  await writeAtomic(join(folder(stateRoot), 'announced.json'), JSON.stringify([...told].slice(-500)));
+}
+
+// What the Market updated on its own and the person has not been told yet.
+export const marketNews = async (stateRoot) => (await readJson(join(folder(stateRoot), 'updates.json'))) ?? [];
+export async function marketNewsSeen(stateRoot) { await writeAtomic(join(folder(stateRoot), 'updates.json'), '[]').catch(() => {}); }
+
+// Every module got from the Market whose signed file changed: the new one, installed, and a line
+// for the person. One that fails stays as it was and is tried again next time.
+export async function updateFromMarket({ stateRoot, projectRoot, catalog, madre, fetchImpl = globalThis.fetch, verifyText, installText, names = {} }) {
+  const installed = await installedFromMarket(stateRoot);
+  const updated = [];
+  for (const [id, have] of Object.entries(installed)) {
+    const entry = catalog?.modules.find((one) => one.id === id && one.file);
+    if (!entry || entry.file.sha256 === have.sha256 || !fitsVersion(madre, entry.minMadre)) continue;
+    try {
+      await installFromMarket({ stateRoot, projectRoot, id, catalog, madre, fetchImpl, verifyText, installText });
+      updated.push({ id, name: names[id] ?? (typeof entry.name === 'string' ? entry.name : entry.name?.en) ?? id, from: have.version ?? null, to: entry.version, changes: entry.changes ?? null, at: new Date().toISOString() });
+    } catch { /* tried again the next time MADRE opens */ }
+  }
+  if (updated.length) {
+    const news = [...(await marketNews(stateRoot)).filter((one) => !updated.some((fresh) => fresh.id === one.id)), ...updated];
+    await writeAtomic(join(folder(stateRoot), 'updates.json'), JSON.stringify(news, null, 2));
+  }
+  return updated;
+}

package/src/maturity.mjs

@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: AGPL-3.0-only
+// MADRE · © 2026 Jossue Alcalá · GNU AGPL v3 with additional terms (Section 7): ADDITIONAL-TERMS.md
 // How grown a room is, and how far from being worth training on.
 //
 // Pure functions. The room hands in what it has; nothing here reads a file or calls a model.
@@ -45,7 +47,7 @@ export function maturity({ readiness = null, notes = [], links = [], stats = nul
       next: t('Memories nobody has needed may be noise, or may simply not have come up yet. Ask the project about older decisions and see which ones answer.'),
     },
     {
-      id: 'weave', label: t('HOW WOVEN IT IS'),
+      id: 'weave', label: t('HOW CONNECTED IT IS'),
       value: round(share(connected, standing.length)),
       detail: t('{connected} of {total} memories share a subject with another', { connected, total: standing.length }),
       next: t('An archive of unrelated notes is a list. Depth comes from returning to the same subjects.'),