@lapxo/bound 0.1.0

package/dist/cli/accept.d.ts

@@ -0,0 +1,23 @@
+export type Batch = {
+    readonly kind: 'signed';
+    readonly signed: readonly string[];
+    readonly epoch: number;
+    readonly keyId?: string;
+} | {
+    readonly kind: 'once';
+    readonly proposed: readonly string[];
+} | {
+    readonly kind: 'exit';
+    readonly code: number;
+};
+/** A batch signed as accept signs it: at the next epoch, by the key it names, each line read by the wire it would land under. */
+export declare function signedBatch(root: string, args: readonly string[], files: readonly string[]): Promise<Batch>;
+/**
+ * accept is one act under the descent of its lines. Every place, then the root where they join, only when those lines
+ * rest on every place; a line in one place's own lock is that place. It signs the batch at the epoch the lock
+ * stands at, folds it, judges every take of it, and lands only when all of it holds. A batch refused lands nothing.
+ * What a batch would move is read before it with `--as rank <batch>`. A cycle's lanes each sign
+ * their batch with `bound sign` at the epoch the act lands at, and one land takes them all, each line in its signer's
+ * ledger once it verifies against that signer: one signer never forks itself, and one act never forks itself.
+ */
+export declare function accept(root: string, args: readonly string[]): Promise<number>;

package/dist/cli/accept.js

@@ -0,0 +1,423 @@
+import { timing } from "../host/timing.js";
+import { admittedObjects } from "../host/objects.js";
+import { existsSync, rmdirSync, rmSync } from 'node:fs';
+import { dirname, join, basename } from 'node:path';
+import { closeReceipts, instrumentKeep, instrumentKept } from "../fold/closed.js";
+import { bytesDigest, fullDigest, instrumentOf, signaturesOf } from "../fold/digests.js";
+import { canonical, fromLine, LOCK, parse, wireAt } from '@lapxo/topos/wire';
+import { fieldOf, isConfig, foldClaims, sayingOf, selfName } from "../fold/claims.js";
+import { isReaderLock } from "../fold/observed.js";
+import { authorityFor, publicKeyOf, rootSigner, writerFor } from "../fold/signers.js";
+import { lockLines, lockStanding } from "../fold/keys.js";
+import { keepVerdict, keptVerdict, land, landBlob, storeOf } from "../land/ledger.js";
+import { signConsentLine, verifiesOwnerLine } from "../land/sign.js";
+import { appliedIn } from "../fold/signed.js";
+import { wordOf } from "../fold/wire.js";
+import { hasVouchedTree, landCoordinates, locationsOf, vouchedCoordinates } from "../land/vouched.js";
+import { entriesIn, observeFile, observeText } from "../observe/files.js";
+import { coneOf, standingOf } from "./place.js";
+import { ownLock, ownRoot, ownStore } from "../observe/runner.js";
+import { widenedWithoutWitness } from "../judge/widening.js";
+import { retractedTogether, withdrawal } from "../land/withdraw.js";
+import { isCeiling } from "../fold/configures.js";
+import { inertIn, rankedIn } from "../land/inert.js";
+import { landSaid } from "./pass.js";
+import { underTheLock, underTheRegions } from "../land/act.js";
+import { openedBy } from "../fold/opened.js";
+import { touchedBy } from "../fold/reach.js";
+import { landOwned, ownedOf } from "../land/owned.js";
+import { layReleases } from "../host/release.js";
+import { foundableIn, placesIn } from "../fold/places.js";
+import { outsideTheirCapsule } from "../fold/own.js";
+import { lateFacts } from "../judge/late.js";
+import { paidOf } from "../fold/paid.js";
+import { aliasPinned } from "../land/alias.js";
+import { coordinatesWithdrawn } from "../land/leaving.js";
+import { ownerOf, epochOf, forksItself, forksJoinedBy, renderInto, sideOf, signedDemands, signedOwnerLines } from "./owner.js";
+import { claimLinesIn, entryOf, namedPlaces, placesOfFile, positionalsOf, valueOf } from "./args.js";
+import { FLAGS } from "./names.js";
+import { judgeDemand, landTake } from "./takes.js";
+/** A batch signed as accept signs it: at the next epoch, by the key it names, each line read by the wire it would land under. */
+export async function signedBatch(root, args, files) {
+    const byFile = files.map((file) => [placesOfFile(file), claimLinesIn(file)]);
+    const proposed = byFile.flatMap(([, lines]) => lines);
+    if (!proposed.length) {
+        process.stderr.write(`${selfName()}: a batch is a file with claim lines\n`);
+        return { kind: 'exit', code: 2 };
+    }
+    const drafted = proposed.filter((line) => !fieldOf(line, 'sig'));
+    const bare = drafted.filter((line) => fieldOf(line, 'epoch') || !['', 'target'].includes(fieldOf(line, 'by')));
+    if (bare.length) {
+        for (const line of bare)
+            process.stderr.write(`BARE     ${fieldOf(line, 'scope')} · by=${fieldOf(line, 'by') || '∅'}${fieldOf(line, 'epoch') ? ` epoch=${fieldOf(line, 'epoch')}` : ''}\n`);
+        process.stderr.write(`${selfName()}: REFUSE·bare nothing landed · ${bare.length} lines name a signer or an epoch they were not signed with: a drafted line proposes by=target and sign signs it, a line a lane signed carries its sig\n`);
+        return { kind: 'exit', code: 1 };
+    }
+    const store = storeOf(root);
+    const destinations = [...new Set([...namedPlaces(args), ...byFile.flatMap(([heads]) => heads)])];
+    const epoch = epochOf([...lockLines(store), ...destinations.flatMap((place) => appliedIn(root, place))]) + 1;
+    const stale = proposed.filter((line) => fieldOf(line, 'sig')).flatMap((line) => ((by, key) => (key === undefined || !verifiesOwnerLine(line, key, signaturesOf(store).admitted)
+        ? [`${fieldOf(line, 'scope')} · the signature does not hold for ${by || '∅'}`]
+        : isConfig(line) && Number(fieldOf(line, 'epoch')) !== epoch ? [`${fieldOf(line, 'scope')} · signed by ${by} at epoch ${fieldOf(line, 'epoch')}, and this act lands at ${epoch}: sign it again`] : []))(fieldOf(line, 'by'), publicKeyOf(root, fieldOf(line, 'by'))));
+    if (stale.length) {
+        for (const one of stale)
+            process.stderr.write(`SIGNED   ${one}\n`);
+        process.stderr.write(`${selfName()}: REFUSE·signed nothing landed · ${stale.length} lines a lane signed stand at no epoch this act\n`);
+        return { kind: 'exit', code: 1 };
+    }
+    const [named, places] = [namedPlaces(args), placesIn(root)];
+    const inLock = new Set(lockLines(store).map(sayingOf));
+    const inPlace = new Map(places.map((place) => [place, new Set(appliedIn(root, place).map(sayingOf))]));
+    const held = (line, at = named.length ? named : byFile.flatMap(([heads, lines]) => (lines.includes(line) ? heads : []))) => at.length
+        ? at.every((place) => inPlace.get(place)?.has(sayingOf(line)))
+        : inLock.has(sayingOf(line)) || places.some((place) => inPlace.get(place)?.has(sayingOf(line)));
+    if (proposed.every((line) => held(line))) {
+        if (proposed.some(line => !isConfig(line))) {
+            try {
+                await admittedObjects(root, [...signedOwnerLines(store), ...proposed]);
+            }
+            catch (e) {
+                process.stderr.write(`${selfName()}: ${String(e)} · nothing landed\n`);
+                return { kind: 'exit', code: 1 };
+            }
+        }
+        return { kind: 'once', proposed };
+    }
+    const keyFile = valueOf(args, FLAGS.keyFile);
+    const keyId = valueOf(args, FLAGS.key) ?? ownerOf(store);
+    if (drafted.length && (!keyFile || !existsSync(keyFile))) {
+        process.stderr.write(`${selfName()}: a drafted batch is signed with --key-file (PKCS8 PEM)\n`);
+        return { kind: 'exit', code: 2 };
+    }
+    const publicKey = drafted.length ? publicKeyOf(root, keyId) : undefined;
+    if (drafted.length && !publicKey) {
+        process.stderr.write(`${selfName()}: unknown key ${keyId} — name it in ${selfName()}.keys\n`);
+        return { kind: 'exit', code: 2 };
+    }
+    const privateKeyPem = keyFile ? observeText(keyFile) ?? '' : '';
+    const signed = proposed.filter((line) => fieldOf(line, 'sig'));
+    for (const line of drafted) {
+        const got = signConsentLine(line, privateKeyPem, { epoch, by: keyId, algorithm: signaturesOf(store).era });
+        if (got.kind === 'refuse') {
+            process.stderr.write(`${selfName()}: ${got.why}\n`);
+            return { kind: 'exit', code: 1 };
+        }
+        if (!verifiesOwnerLine(got.line, publicKey, signaturesOf(store).admitted)) {
+            process.stderr.write(`${selfName()}: REFUSE·accept the signature does not hold for ${keyId}\n`);
+            return { kind: 'exit', code: 1 };
+        }
+        signed.push(got.line);
+    }
+    const wireLines = [...signedOwnerLines(store), ...signed].flatMap((line) => {
+        const got = parse(line);
+        return got.kind === 'fact' ? [got.value.fields] : [];
+    });
+    for (const line of signed) {
+        const got = fromLine(line, wireAt(wireLines, Number(fieldOf(line, 'epoch'))));
+        if (got.kind !== 'fact') {
+            process.stderr.write(`${selfName()}: REFUSE·wire ${fieldOf(line, 'scope')} · ${got.why} · nothing landed\n`);
+            return { kind: 'exit', code: 1 };
+        }
+    }
+    if (signed.some(line => !isConfig(line))) {
+        try {
+            await admittedObjects(root, [...signedOwnerLines(store), ...signed], text => process.stdout.write(text + '\n'));
+        }
+        catch (e) {
+            process.stderr.write(`${selfName()}: ${e instanceof Error ? e.message : String(e)} · nothing landed\n`);
+            return { kind: 'exit', code: 1 };
+        }
+    }
+    return { kind: 'signed', signed, epoch, ...(drafted.length ? { keyId } : {}) };
+}
+/**
+ * accept is one act under the descent of its lines. Every place, then the root where they join, only when those lines
+ * rest on every place; a line in one place's own lock is that place. It signs the batch at the epoch the lock
+ * stands at, folds it, judges every take of it, and lands only when all of it holds. A batch refused lands nothing.
+ * What a batch would move is read before it with `--as rank <batch>`. A cycle's lanes each sign
+ * their batch with `bound sign` at the epoch the act lands at, and one land takes them all, each line in its signer's
+ * ledger once it verifies against that signer: one signer never forks itself, and one act never forks itself.
+ */
+export async function accept(root, args) {
+    const started = Date.now();
+    const named = namedPlaces(args);
+    const placed = positionalsOf(args).reduce((all, file) => ((places) => (places.length ? claimLinesIn(file).reduce((got, line) => got.set(sayingOf(line), [...new Set([...(got.get(sayingOf(line)) ?? []), ...places])]), all) : all))(placesOfFile(file)), new Map());
+    const rooted = lockStanding(storeOf(root));
+    const stray = [...new Set([...named, ...[...placed.values()].flat()])].filter((one) => !placesIn(root).includes(one) && !foundableIn(root, rooted, wordOf(rooted, 'families', 'region'), one));
+    if (stray.length) {
+        process.stderr.write(`${selfName()}: REFUSE·place nothing landed · ${stray.join(', ')} is no place of the tree, and no line of the root founds it: --place names the own lock a line lands in\n`);
+        return 2;
+    }
+    const batch = await signedBatch(root, args, positionalsOf(args));
+    if (batch.kind === 'exit')
+        return batch.code;
+    if (batch.kind === 'once')
+        return underTheLock(storeOf(root), 'land', () => repaid(root, batch.proposed, started));
+    const taken = retractedTogether(batch.signed);
+    if (taken.length) {
+        for (const pair of taken) {
+            process.stderr.write(`WITHDRAW ${sayingOf(pair.withdraw)}\n`);
+            process.stderr.write(`NEW      ${sayingOf(pair.line)}\n`);
+        }
+        process.stderr.write(`${selfName()}: REFUSE·withdraw nothing landed · a withdraw matches a new line in this batch, so it takes that line too\n`);
+        return 1;
+    }
+    const store = storeOf(root);
+    const authority = authorityFor([...lockLines(store), ...batch.signed], rootSigner(root), signaturesOf(store).admitted);
+    const owned = ownedOf(root, batch.signed, (line) => authority.of(line).kind === 'admitted', (by) => authority.admitted.find((one) => one.id === by)?.coverage ?? [], named, (line) => placed.get(sayingOf(line)));
+    if (owned.nowhere.length) {
+        for (const line of owned.nowhere)
+            process.stderr.write(`NOWHERE  ${fieldOf(line, 'scope')} · ${((got) => (got.kind === 'admitted' ? 'admitted' : got.why))(authority.of(line))}, and ${named.length ? `no place of ${named.join(', ')} takes it` : 'no one own lock it covers takes it: name the places with --place'}\n`);
+        process.stderr.write(`${selfName()}: REFUSE·nowhere nothing landed · ${owned.nowhere.length} lines neither the ledger nor an own lock admits: a line is landed signed where it stands, never written in bare\n`);
+        return 1;
+    }
+    if (owned.forked.length) {
+        for (const one of owned.forked)
+            process.stderr.write(`FORKED   ${one.place}/${LOCK} · ${one.key} · the lot would leave two standing claims where the lock had one\n`);
+        process.stderr.write(`${selfName()}: REFUSE·forked nothing landed · ${owned.forked.length} claims an own lot would fork: a lot for many places lands the same lines at each, and lines meant for one place go in a lot of their own\n`);
+        return 1;
+    }
+    const places = placesIn(root);
+    const pinned = [...new Set([...owned.own.keys(), ...named])];
+    const touched = pinned.length === 0 && owned.ledger.length ? touchedBy(root, places, owned.ledger, lockStanding(store)) : [];
+    const every = pinned.length === 0 && touched.length === places.length && places.length > 0;
+    const regions = (pinned.length ? pinned : every ? places : touched).filter((one) => places.includes(one));
+    const where = every ? 'every place · then the root, where the places join' : regions.length ? regions.map((one) => `${one}/`).join(' · ') : 'the root alone, where the places join';
+    process.stdout.write(`ACTS     ${where} · ${owned.ledger.length} lines to the ledger${[...owned.own].map(([place, lines]) => ` · ${lines.length} to ${place}'s own lock`).join('')} · before the lock\n`);
+    const asked = Date.now();
+    return underTheRegions(store, every ? [...regions, ''] : regions, 'land', () => acceptNow(root, { ...batch, signed: owned.ledger }, started, owned, asked, regions));
+}
+async function acceptNow(root, batch, started, owned, asked = started, descent = []) {
+    const waited = Date.now() - asked;
+    if (waited > 60000)
+        process.stdout.write(`RED      wait ${Math.round(waited / 1000)} s for the lock before the act · a wait over a minute is a red\n`);
+    const spent = [`sign ${asked - started}`, `wait ${waited}`];
+    const took = timing(spent);
+    const { signed, epoch } = batch;
+    const store = storeOf(root);
+    if (signed.some(line => !isConfig(line))) {
+        try {
+            await admittedObjects(root, [...signedOwnerLines(store), ...signed]);
+        }
+        catch (e) {
+            process.stderr.write(`${selfName()}: ${e instanceof Error ? e.message : String(e)} · nothing landed\n`);
+            return 1;
+        }
+    }
+    const reads = !signed.some(isReaderLock) && signed.some(isCeiling);
+    const fold = reads ? took('cone', () => coneOf(root, entryOf(root), signed.filter(isCeiling), descent)) : { ...took('lines', () => standingOf(root)), observed: [], own: {}, kept: true };
+    const inert = inertIn(signed, { standing: fold.standing, ceiling: isCeiling, signsReader: !reads, observed: fold.observed, own: fold.own, epoch });
+    const widened = widenedWithoutWitness(signed, fold.standing, isCeiling, wordOf(fold.standing, 'at-classes', 'witness'));
+    if (widened.length) {
+        for (const line of widened)
+            process.stderr.write(`WIDER    ${fieldOf(line, 'scope')} · ${fieldOf(line, 'value')}\n`);
+        process.stderr.write(`${selfName()}: REFUSE·widening nothing landed · a ceiling that admits more than it did gives back freedom the lock had spent: sign it under a witness that names what made the old ceiling wrong\n`);
+        return 1;
+    }
+    if (inert.length) {
+        for (const line of inert)
+            process.stderr.write(`INERT    ${fieldOf(line, 'scope')} measure=${fieldOf(line, 'measure')}\n`);
+        process.stderr.write(`${selfName()}: REFUSE·inert nothing landed · no reading meets these ceilings: sign the reader that meets them in this batch, or leave them out\n`);
+        return 1;
+    }
+    const outside = outsideTheirCapsule(root, fold.standing, signed);
+    for (const line of outside)
+        process.stderr.write(`OUTSIDE  ${fieldOf(line, 'scope')} · ${fieldOf(line, 'value')}\n`);
+    if (outside.length) {
+        process.stderr.write(`${selfName()}: REFUSE·outside nothing landed · a reader or a capsule lands in the capsule of its world, never in the wire or the instrument\n`);
+        return 1;
+    }
+    const forks = took('fork', () => forksJoinedBy(store, signed).filter((fork) => forksItself(fork.lines) || fork.lines.filter((line) => signed.includes(line)).length > 1));
+    if (forks.length) {
+        for (const fork of forks) {
+            process.stderr.write(`FORK     ${fork.key}\n`);
+            for (const line of fork.lines)
+                process.stderr.write(`  ${signed.includes(line) ? 'new ' : 'held'}  by=${fieldOf(line, 'by')} ${sideOf(line, lockLines(store))}\n`);
+        }
+        process.stderr.write(`${selfName()}: REFUSE·fork nothing landed · one signer never forks itself, and one act never forks itself: withdraw the held side in this batch, or sign the other reading under its own scope\n`);
+        return 1;
+    }
+    if (reads)
+        for (const line of rankedIn(signed.filter(isCeiling), fold))
+            process.stdout.write(`${line}\n`);
+    const authority = took('authority', () => authorityFor([...lockLines(store), ...signed], rootSigner(root), signaturesOf(store).admitted));
+    for (const line of signed) {
+        const verdict = authority.of(line);
+        if (verdict.kind !== 'admitted') {
+            process.stderr.write(`${selfName()}: ${verdict.kind === 'refuse' ? verdict.why : `REFUSE·authority grey: ${verdict.why}`}\n`);
+            return 1;
+        }
+    }
+    const coordinates = coordinatesWithdrawn(root, store, signed, [...signed, ...fold.standing]);
+    if (coordinates.refused.length) {
+        for (const one of coordinates.refused)
+            process.stderr.write(`RUN      ${one.path} · still read by ${one.by}\n`);
+        process.stderr.write(`${selfName()}: REFUSE·withdraw nothing landed · a file a block still reads cannot leave: withdraw what reads it first, or keep it\n`);
+        return 1;
+    }
+    const withdraws = signed.filter((line) => fieldOf(line, 'value') === 'withdraw');
+    const withdrawn = withdraws.length ? withdrawal(withdraws, lockLines(store)) : null;
+    const view = `${wordOf(fold.standing, 'families', 'view')}/`;
+    const lot = fullDigest(store, signed);
+    const tree = hasVouchedTree(store)
+        ? fullDigest(store, [...vouchedCoordinates(store)].sort(([a], [b]) => a.localeCompare(b)).map(([coordinate, digest]) => `${coordinate} ${digest}`))
+        : 'key' in fold && typeof fold.key === 'string' ? fold.key : fullDigest(store, fold.standing);
+    const cached = keptTakes(keptVerdict(store, tree, lot));
+    const judged = cached ?? took('takes', () => signed.filter((one) => fieldOf(one, 'role') === 'demands' && fieldOf(one, 'value') !== 'withdraw' && !fieldOf(one, 'scope').startsWith(view))
+        .map((line) => judgeDemand(root, line)));
+    if (!cached)
+        keepVerdict(store, tree, lot, judged.map(packTake));
+    const refused = judged.filter((one) => one.kind === 'refused' || (one.kind === 'judged' && one.verdict.kind === 'refuse'));
+    if (refused.length) {
+        for (const one of refused)
+            process.stdout.write(`REFUSE   take ${one.scope} · ${one.kind === 'judged' ? one.verdict.why : one.kind === 'refused' ? one.why : ''}\n`);
+        process.stderr.write(`${selfName()}: REFUSE·takes nothing landed · ${refused.length} takes refused: a batch lands whole or not at all\n`);
+        return 1;
+    }
+    const held = aliasPinned(root, signed);
+    if (held.length) {
+        for (const one of held)
+            process.stderr.write(`ALIAS    ${one.scope} · ${one.digest} · ${one.by.join(' ')}\n`);
+        process.stderr.write(`${selfName()}: REFUSE·alias nothing landed · an alias is withdrawn only when no pin names its digest\n`);
+        return 1;
+    }
+    const told = took('told', () => standingOf(root, undefined, signed));
+    for (const name of openedBy(descent, told.standing, signed))
+        process.stderr.write(`OPEN     ${name}\n`);
+    if (owned.own.size)
+        layReleases(store, ownRoot(), ownLock(), ownStore());
+    const landed = took('land', () => [...new Set(signed.map((line) => fieldOf(line, 'by')))].map((by) => land(store, by, signed.filter((line) => fieldOf(line, 'by') === by))));
+    for (const [place, lines] of owned.own)
+        landOwned(root, place, lines);
+    landSaid(store, writerFor(told.standing, 'fold'), []);
+    for (const line of signed) {
+        const value = fieldOf(line, 'value');
+        if (!/^[a-z0-9-]+:[0-9a-f]{32,}$/.test(value))
+            continue;
+        for (const need of locationsOf(fieldOf(line, 'needs')).locations) {
+            const at = join(root, need);
+            const bytes = observeFile(at);
+            if (bytes === undefined)
+                continue;
+            if (bytesDigest(store, bytes) === value)
+                landBlob(store, value, bytes);
+        }
+    }
+    if (coordinates.taken.length) {
+        for (const path of coordinates.taken) {
+            if (existsSync(join(root, path)))
+                rmSync(join(root, path), { recursive: true });
+            for (let dir = dirname(path); dir !== '.' && existsSync(join(root, dir)) && !entriesIn(join(root, dir)).length; dir = dirname(dir))
+                rmdirSync(join(root, dir));
+        }
+        landCoordinates(store, new Map(), coordinates.taken, `withdraw:epoch-${epoch}`);
+        for (const path of coordinates.taken)
+            process.stdout.write(`GONE     ${path} · withdrawn by its line\n`);
+    }
+    for (const one of judged)
+        landTake(root, one, []);
+    const standingAsked = [...signed, ...fold.standing].filter((line) => fieldOf(line, 'role') === 'demands' && fieldOf(line, 'value') !== 'withdraw');
+    const paidScopes = new Set(paidOf(store, standingAsked, fold.observed, view).paid.map((line) => fieldOf(line, 'scope')));
+    const late = lateFacts(store, [...signed, ...fold.standing], paidScopes);
+    if (late.length) {
+        land(store, 'judge', late);
+        for (const line of late)
+            if (fieldOf(line, 'measure') !== 'cone')
+                process.stdout.write(`LATE     ${fieldOf(line, 'scope')} · answered from the landed cone\n`);
+    }
+    if (signed.some((line) => fieldOf(line, 'scope').startsWith(`${basename(ownRoot())}/`) && !fieldOf(line, 'scope').split('/').slice(1, -1).includes('uses'))) {
+        const code = instrumentOf(store, entryOf(root), told.standing, root, ownLock());
+        if (instrumentKept(store) !== code) {
+            const open = await closeReceipts(root, store);
+            instrumentKeep(store, code);
+            process.stderr.write(`open by instrument · ${open.length}\n`);
+        }
+    }
+    const rendered = took('render', () => renderInto(root, store));
+    process.stdout.write(`RENDER 0\n`);
+    const own = new Set([...owned.own.values()].flat()).size;
+    const perLine = Math.round((Date.now() - started) / Math.max(1, signed.length + own));
+    const folder = writerFor(fold.standing, 'fold');
+    const beat = (ms, at) => canonical({ scope: 'beat/accept', role: 'writes', form: 'interval', measure: 'ms', value: `${ms}..${ms}`, by: folder ?? '', at: `place:${at}` });
+    if (folder !== undefined)
+        land(store, folder, [beat(perLine, 'line'), beat(1, fold.kept ? 'kept' : 'folded'), beat(Date.now() - started, 'total')]);
+    process.stdout.write(`FACT     signed ${signed.length + own} · landed ${landed.length ? landed.map((one) => `${one.appended} in ${one.at}`).join(' · ') : '0'}${[...owned.own].map(([place, lines]) => ` · ${lines.length} in ${place}/${LOCK}`).join('')} · epoch ${epoch}\n`
+        + `TARGET   ${rendered.standing} claims · ${rendered.forks.length} forks · ${rendered.vacuous.length} vacuous · ${rendered.grey.length} grey · ${rendered.refused.length} refused · ${Date.now() - started} ms\n`
+        + `SPENT    ${spent.join(' ms · ')} ms · ${signed.length} lines\n`);
+    if (withdrawn) {
+        process.stdout.write(`WITHDRAW ${withdrawn.taken.length} taken · ${withdrawn.exact.length} exact on distributive scales · ${withdrawn.open.length} on open scales, not computed\n`);
+        for (const line of withdrawn.inexact)
+            process.stdout.write(`INEXACT  ${fieldOf(line, 'scope')} · its scale is not distributive: what the others hold is not what they held without it\n`);
+    }
+    return 0;
+}
+/**
+ * A batch landed twice is one: nothing of it lands again. What it left unpaid is judged again, the way it would be now:
+ * each of its demands the fold counts unpaid is taken, and the takes land only when all of it holds.
+ */
+function repaid(root, proposed, started) {
+    const store = storeOf(root);
+    const asked = new Set(proposed.filter((line) => fieldOf(line, 'role') === 'demands').map((line) => fieldOf(line, 'scope')));
+    const view = `${wordOf(foldClaims(signedOwnerLines(store)).standing, 'families', 'view')}/`;
+    const standingAsked = signedDemands(store).filter((line) => asked.has(fieldOf(line, 'scope')) && !fieldOf(line, 'scope').startsWith(view));
+    const owed = paidOf(store, standingAsked, [], view).missing;
+    if (!owed.length) {
+        process.stdout.write(`ONCE     ${proposed.length} lines · every one already landed and every demand of it paid: a batch landed twice is one, nothing landed\n`);
+        return 0;
+    }
+    const judged = owed.map((line) => judgeDemand(root, line));
+    process.stdout.write(`ONCE     ${proposed.length} lines · every one already landed · ${owed.length} of its demands unpaid, judged again\n`);
+    if (judged.every((one) => one.kind === 'owed')) {
+        for (const one of judged)
+            landTake(root, one, []);
+        return 0;
+    }
+    const refused = judged.filter((one) => one.kind === 'refused' || (one.kind === 'judged' && one.verdict.kind === 'refuse'));
+    if (refused.length) {
+        for (const one of refused)
+            process.stdout.write(`REFUSE   take ${one.scope} · ${one.kind === 'judged' ? one.verdict.why : one.kind === 'refused' ? one.why : ''}\n`);
+        process.stderr.write(`${selfName()}: REFUSE·takes nothing landed · ${refused.length} takes refused: what a batch left unpaid is paid whole or not at all\n`);
+        return 1;
+    }
+    const standing = standingOf(root);
+    for (const one of judged)
+        landTake(root, one, []);
+    landSaid(store, writerFor(standing.standing, 'fold'), []);
+    const unpaidStanding = standing.standing.filter((line) => fieldOf(line, 'role') === 'demands' && fieldOf(line, 'value') !== 'withdraw');
+    const paidScopes = new Set(paidOf(store, unpaidStanding, [], `${wordOf(standing.standing, 'families', 'view')}/`).paid.map((line) => fieldOf(line, 'scope')));
+    const late = lateFacts(store, standing.standing, paidScopes);
+    if (late.length) {
+        land(store, 'judge', late);
+        for (const line of late)
+            if (fieldOf(line, 'measure') !== 'cone')
+                process.stdout.write(`LATE     ${fieldOf(line, 'scope')} · answered from the landed cone\n`);
+    }
+    const rendered = renderInto(root, store);
+    process.stdout.write(`RENDER 0\n`);
+    process.stdout.write(`TARGET   ${rendered.standing} claims · ${rendered.forks.length} forks · ${rendered.vacuous.length} vacuous · ${rendered.grey.length} grey · ${rendered.refused.length} refused · ${Date.now() - started} ms\n`);
+    return 0;
+}
+function packTake(one) {
+    return one.kind === 'judged'
+        ? { kind: one.kind, scope: one.scope, demand: one.demand, locations: one.locations, before: [...one.before], after: [...one.after], verdict: one.verdict, ignored: [...one.ignored] }
+        : one;
+}
+function keptTakes(raw) {
+    if (raw === undefined)
+        return undefined;
+    const out = [];
+    for (const one of raw) {
+        if (one === null || typeof one !== 'object' || !('kind' in one) || !('scope' in one))
+            return undefined;
+        const row = one;
+        if (row.kind !== 'judged') {
+            out.push(row);
+            continue;
+        }
+        out.push({
+            kind: 'judged', scope: row.scope, demand: row.demand, locations: row.locations,
+            before: new Map(row.before), after: new Map(row.after), verdict: row.verdict, ignored: new Map(row.ignored), started: Date.now(),
+        });
+    }
+    return out;
+}

package/dist/cli/args.d.ts

@@ -0,0 +1,10 @@
+import { VALUED } from './names.ts';
+export { VALUED };
+/** What the loop runs that is not source: its entry, the packages it imports and the readers it loads, read by where they lie. */
+export declare function entryOf(root: string): string;
+export declare function valueOf(args: readonly string[], flag: string): string | undefined;
+export declare const valuesOf: (args: readonly string[], flag: string) => readonly string[];
+export declare const namedPlaces: (args: readonly string[]) => readonly string[];
+export declare function positionalsOf(args: readonly string[]): string[];
+export declare const placesOfFile: (file: string) => readonly string[];
+export declare function claimLinesIn(file: string): string[];

package/dist/cli/args.js

@@ -0,0 +1,34 @@
+import { relative, sep } from 'node:path';
+import { observeText } from "../observe/files.js";
+import { sourceOf } from "../observe/runner.js";
+import { PROTOCOL } from '@lapxo/topos/wire';
+import { FLAGS, VALUED } from "./names.js";
+export { VALUED };
+/** What the loop runs that is not source: its entry, the packages it imports and the readers it loads, read by where they lie. */
+export function entryOf(root) {
+    return relative(root, sourceOf()).split(sep).join('/');
+}
+export function valueOf(args, flag) {
+    const i = args.indexOf(flag);
+    return i >= 0 ? args[i + 1] : undefined;
+}
+export const valuesOf = (args, flag) => args.flatMap((arg, i) => (arg === flag && args[i + 1] !== undefined ? [args[i + 1]] : []));
+export const namedPlaces = (args) => valuesOf(args, FLAGS.place).map((one) => one.replace(/\/$/, ''));
+export function positionalsOf(args) {
+    const out = [];
+    for (let i = 0; i < args.length; i += 1) {
+        const arg = args[i] ?? '';
+        if (VALUED.includes(arg)) {
+            i += 1;
+            continue;
+        }
+        if (!arg.startsWith('--'))
+            out.push(arg);
+    }
+    return out;
+}
+export const placesOfFile = (file) => (observeText(file) ?? '').split('\n').map((line) => line.trim())
+    .filter((line) => line.startsWith('# place ')).map((line) => line.slice('# place '.length).trim().replace(/\/$/, '')).filter(Boolean);
+export function claimLinesIn(file) {
+    return (observeText(file) ?? '').split('\n').map((line) => line.trim()).filter((line) => line.startsWith(PROTOCOL));
+}

package/dist/cli/host.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/cli/host.js

@@ -0,0 +1,32 @@
+var __rewriteRelativeImportExtension = (this && this.__rewriteRelativeImportExtension) || function (path, preserveJsx) {
+    if (typeof path === "string" && /^\.\.?\//.test(path)) {
+        return path.replace(/\.(tsx)$|((?:\.d)?)((?:\.[^./]+?)?)\.([cm]?)ts$/i, function (m, tsx, d, ext, cm) {
+            return tsx ? preserveJsx ? ".jsx" : ".js" : d && (!ext || !cm) ? m : (d + ext + "." + cm.toLowerCase() + "js");
+        });
+    }
+    return path;
+};
+import { readFileSync } from 'node:fs';
+import { resolve } from 'node:path';
+import { pathToFileURL } from 'node:url';
+import { respond } from '@lapxo/topos/contract';
+import { provide } from "../host/provide.js";
+/**
+ * The host end of the contract, a process of its own: it loads the one module a lock names, or the blob built from it
+ * with the module named beside it, hands it the requests on its standard input and prints on its last line what the
+ * contract answers. The instrument never loads a reader or a
+ * capsule into itself; this process is theirs, and the only one that reads a request off standard input.
+ */
+void (async () => {
+    try {
+        provide();
+        const loaded = (await import(__rewriteRelativeImportExtension(pathToFileURL(resolve(process.argv[2] ?? '')).href)));
+        const self = resolve(process.argv[3] ?? process.argv[2] ?? '');
+        process.stdout.write(`\n${respond(typeof loaded['load'] === 'function' ? await loaded['load']() : loaded, readFileSync(0, 'utf8'), self)}\n`);
+    }
+    catch (error) {
+        const message = (error instanceof Error ? error.message : String(error)).replace(/\s+/g, ' ').trim();
+        process.stderr.write(`LOAD     index · module error · ${message}\n`);
+        process.exitCode = 1;
+    }
+})();

package/dist/cli/names.d.ts

@@ -0,0 +1,25 @@
+/** The verbs bound answers by name: fold reads, land writes signed lines, sign is a key's act. A directory with no verb is a fold of that place. */
+export declare const VERB_NAMES: readonly ["fold", "land", "sign"];
+export type VerbName = (typeof VERB_NAMES)[number];
+/** Every flag the CLI reads, spelled once; a valued flag takes the argument after it. */
+export declare const FLAGS: {
+    readonly as: "--as";
+    readonly check: "--check";
+    readonly key: "--key";
+    readonly keyFile: "--key-file";
+    readonly out: "--out";
+    readonly place: "--place";
+};
+export declare const VALUED: readonly string[];
+/** Views the CLI renders from these names, never from a handwritten usage string. */
+export declare const NAMED_VIEWS: {
+    readonly help: "help";
+    readonly lines: "lines";
+    readonly because: "because";
+};
+export declare const EXIT: {
+    readonly closed: 0;
+    readonly refuse: 1;
+    readonly usage: 2;
+};
+export declare const helpLines: () => readonly string[];

package/dist/cli/names.js

@@ -0,0 +1,12 @@
+/** The verbs bound answers by name: fold reads, land writes signed lines, sign is a key's act. A directory with no verb is a fold of that place. */
+export const VERB_NAMES = ['fold', 'land', 'sign'];
+/** Every flag the CLI reads, spelled once; a valued flag takes the argument after it. */
+export const FLAGS = { as: '--as', check: '--check', key: '--key', keyFile: '--key-file', out: '--out', place: '--place' };
+export const VALUED = [FLAGS.keyFile, FLAGS.key, FLAGS.out, FLAGS.as, FLAGS.place];
+/** Views the CLI renders from these names, never from a handwritten usage string. */
+export const NAMED_VIEWS = { help: 'help', lines: 'lines', because: 'because' };
+export const EXIT = { closed: 0, refuse: 1, usage: 2 };
+export const helpLines = () => [
+    `verbs ${VERB_NAMES.join(' ')}`,
+    `flags ${Object.values(FLAGS).join(' ')}`,
+];

package/dist/cli/observe.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/cli/observe.js

@@ -0,0 +1,6 @@
+import { resolve } from 'node:path';
+import { observedClaims } from "../fold/observed.js";
+import { storeOf } from "../land/ledger.js";
+/** One reader, run to the end behind a fold that did not wait for it: what it lands, the next fold reads. */
+const [root = '.', only] = process.argv.slice(2);
+observedClaims(resolve(root), storeOf(resolve(root)), { wait: true, ...(only === undefined ? {} : { only }) });

package/dist/cli/owner.d.ts

@@ -0,0 +1,35 @@
+import { renderTarget } from '../render/target.ts';
+export declare const ownerOf: (store: string, told?: readonly string[]) => string;
+/** The signed lines standing in the lock: the owner's, and those of every key it admits to authorize, each in its own ledger. */
+export declare function signedOwnerLines(store: string): string[];
+export declare function standingDemands(store: string): string[];
+/**
+ * A demand is history when it asks about a place that is gone: one the tree once held and holds no more. It paid, or
+ * did not, in its own time; whoever wants it again signs it against the region as it is. A place never held is not
+ * gone — it is still to be made, and its demand stays live.
+ */
+export declare function historyOf(root: string, store: string, demands: readonly string[]): {
+    readonly live: string[];
+    readonly history: string[];
+};
+export declare function signedDemands(store: string, root?: string): string[];
+export declare function forkedScopes(store: string): Set<string>;
+export declare function epochOf(lines: readonly string[]): number;
+export declare function targetFile(root: string): string;
+export declare function renderInto(root: string, store: string): {
+    readonly standing: number;
+    readonly superseded: readonly string[];
+    readonly forks: readonly {
+        readonly key: string;
+    }[];
+    readonly grey: readonly string[];
+    readonly refused: readonly string[];
+    readonly vacuous: readonly string[];
+};
+export declare function renderedLock(root: string, store: string, told?: readonly string[]): ReturnType<typeof renderTarget>;
+export declare function forksJoinedBy(store: string, signed: readonly string[]): readonly {
+    readonly key: string;
+    readonly lines: readonly string[];
+}[];
+export declare function forksItself(lines: readonly string[]): boolean;
+export declare function sideOf(line: string, landed: readonly string[]): string;