@lapxo/head 0.0.0-stage → 0.1.0

package/dist/src/flows/read.js

@@ -0,0 +1,85 @@
+import { planRead } from "../core/read.js";
+import { basisOf, draftOf, receiptsOf, scopeOf, spentOf } from "../core/receipt.js";
+import { redIn, sayIn } from "../core/surface.js";
+import { grantedOf, isOpen } from "../core/act.js";
+import { canonical } from '@lapxo/topos/wire';
+import { called } from "./call.js";
+import { principalOf } from "../access/obtain.js";
+/** An intent an earlier act left open, closed by the read that looked at what it would have changed: a line naming that read-s digest, signed by head. */
+const closeWith = async (intent, source, digest, { word, lines, lands }, context) => {
+    const say = sayIn(context.lock);
+    if (!intent)
+        return [];
+    if (!intent.startsWith(`${word('act/family')}/${source}/`) || !isOpen(lines, intent, [word('act/done'), word('act/closed')]))
+        return [say('nothing-open', { intent })];
+    const landed = await lands(draftOf('', word('receipt/at'), `${intent}/${word('act/closed')}`, digest, new Date(context.now()).toISOString()));
+    return 'refused' in landed ? [say('not-landed', { why: landed.refused })] : [...landed.lines, say('closed', { intent, digest })];
+};
+/**
+ * A read of one offer the place declares of the class head reads: the response comes back once, typed by the world,
+ * and both are kept — the body's digest and the typed answer's, receipts the device key signs. Asked again as the same
+ * principal, while the place stands on what typed it, the person's grant holds now and the newest read is younger than
+ * the reuse the place allows, it answers from what was kept: nothing called. Asked for history, it shows what was kept
+ * of that request as of when it was read — evidence of that read, never a current answer — where the place allows it.
+ */
+export const readSource = (asked, context) => ((started) => called(asked, context, planRead, async ({ word, say, place, lines, source, operation, plan, prepared, most, typed, attach, send, lands, widen, uncovered }) => {
+    const [family, at, when] = [word('receipt/family'), word('receipt/at'), new Date(context.now()).toISOString()];
+    const closing = (digest) => closeWith(asked['closes'], source, digest, { word, lines, lands }, context);
+    const scopes = (principal) => [scopeOf(family, source, operation, prepared.key, principal), `${scopeOf(word('receipt/kept'), source, operation, prepared.key, principal)}/${basisOf(lines, word, source)}`];
+    const held = (digest) => ((bytes) => (bytes === undefined || digest === undefined ? undefined : { digest, bytes }))(digest === undefined ? undefined : context.cache.held(digest));
+    const keeping = (kept, answer) => (answer.length > 1 ? [draftOf(word('receipt/kept'), at, kept, context.cache.keep(Buffer.from(answer.join('\n'))), when)] : []);
+    const allowed = (key, measure) => lines.find((l) => l.scope === `${word(key)}/${source}` && l.measure === measure)?.value;
+    if (asked['history'] === 'true') {
+        const asOf = principalOf(context, plan, false);
+        if (allowed('history/family', 'status') !== 'present')
+            return [...say('history-undeclared', { place, source }), canonical({ at: 'policy:person/history', by: 'target', form: 'alphabet', measure: 'status', role: 'writes', scope: `${word('history/family')}/${source}`, value: 'present' })];
+        const [newest, ...earlier] = asOf === undefined ? [] : receiptsOf(lines, at, scopes(asOf)[0]);
+        if (newest === undefined)
+            return say('history-none', { source, operation });
+        const keptThen = receiptsOf(lines, at, scopeOf(word('receipt/kept'), source, operation, prepared.key, asOf), true).find((k) => k.at === newest.at);
+        const typedThen = held(keptThen?.digest);
+        return [...say('history', { source, operation, at: newest.at, digest: newest.digest }), ...(typedThen ? new TextDecoder().decode(typedThen.bytes).split('\n') : say(keptThen ? 'history-gone' : 'history-untyped')),
+            ...earlier.flatMap((r) => say('history-earlier', { source, at: r.at, digest: r.digest }))];
+    }
+    const principal = principalOf(context, plan);
+    const stopped = uncovered('head', scopes(principal ?? ''));
+    if (stopped)
+        return stopped;
+    if (!grantedOf(lines, word('grant/family'), source, context.now())) {
+        const sources = [...new Set(lines.filter((l) => l.scope?.startsWith(`${word('vocab/region')}/`) && l.measure === word('vocab/origins')).map((l) => l.scope.split('/')[1]))].sort();
+        const until = new Date(context.now() + Number(word('access/period')) * 86_400_000).toISOString().slice(0, 10);
+        const line = (measure, value) => canonical({ at: 'policy:person/grants', by: 'target', form: 'alphabet', measure, role: 'writes', scope: word('grant/family'), value });
+        const granted = await widen(say('grant', { sources: sources.join(', '), place, until })[0], [line('sources', sources.join('|')), line('until', until)]);
+        if ('said' in granted)
+            return granted.said;
+    }
+    const reuse = Number(/^\d+\.\.(\d+)$/.exec(allowed('reuse/family', 'seconds') ?? '')?.[1] ?? Number.NaN);
+    const [newest] = principal === undefined ? [] : receiptsOf(lines, at, scopes(principal)[0]);
+    if (principal !== undefined && newest !== undefined && context.now() - Date.parse(newest.at) <= reuse * 1000) {
+        const [scope, kept] = scopes(principal);
+        const answered = held(receiptsOf(lines, at, kept).find((k) => k.at >= newest.at)?.digest);
+        if (answered !== undefined)
+            return [...new TextDecoder().decode(answered.bytes).split('\n'), ...say('reused', { scope: kept, digest: answered.digest, at: newest.at }), ...(await closing(newest.digest)), ...redIn(context.lock)('answer/kept', `answer/${source}/${operation}@${word('look/call')}`, started, context.machine())];
+        const body = held(newest.digest);
+        if (body !== undefined) {
+            const cut = body.bytes.indexOf(10);
+            const answer = await typed(Buffer.from(body.bytes.subarray(0, cut)).toString('utf8'), body.bytes.subarray(cut + 1));
+            const keptLines = keeping(kept, answer);
+            const landed = keptLines.length ? await lands(...keptLines) : { lines: [] };
+            return [...answer, ...say('reread', { scope, digest: body.digest, at: newest.at }), ...('lines' in landed ? landed.lines : []), ...(await closing(body.digest))];
+        }
+    }
+    if (spentOf(lines, family, at, source, context.now()) >= most('read/rate'))
+        return say('rate', { source });
+    const attached = await attach();
+    if ('said' in attached)
+        return attached.said;
+    const [scope, kept] = scopes(attached.principal ?? '');
+    const got = await send(attached.attachment);
+    if (got.kind !== 'got')
+        return say(got.kind === 'over' ? 'too-large' : 'unreachable-source', { source });
+    const digest = context.cache.keep(Buffer.concat([Buffer.from(`${got.status}\n`), got.bytes]));
+    const answer = await typed(String(got.status), got.bytes);
+    const landed = await lands(draftOf(family, at, scope, digest, when), ...(attached.principal === undefined ? [] : keeping(kept, answer)));
+    return [...answer, ...('lines' in landed ? [...landed.lines, ...(await closing(digest))] : say('not-landed', { why: landed.refused }))];
+}))(context.machine());

package/dist/src/flows/world.d.ts

@@ -0,0 +1,12 @@
+import type { Context } from '../core/answer.ts';
+import type { Said } from '../core/lock.ts';
+/**
+ * The lines a place stands on with what its sources compile to. A source the place pins is read from the standing it
+ * pins, checked by hashing the bytes it holds — compiled once, never folded again; a file that no longer hashes to its pin
+ * is no standing. A place that pins a lock as its parent stands on nothing head may read: composing the two is bound's, never head's. A place that pins none and names a view has bound compile it, asked once; a fold bound refused is no standing either.
+ */
+export declare const standingFor: (context: Context, place: string) => Promise<{
+    readonly lines: readonly Said[];
+} | {
+    readonly unsettled: string;
+}>;

package/dist/src/flows/world.js

@@ -0,0 +1,29 @@
+import { join } from 'node:path';
+import { valueOf } from "../core/lock.js";
+import { sayIn } from "../core/surface.js";
+import { pinnedOf } from "../core/worlds.js";
+import { adoptsIn } from "../adopt/adopt.js";
+/**
+ * The lines a place stands on with what its sources compile to. A source the place pins is read from the standing it
+ * pins, checked by hashing the bytes it holds — compiled once, never folded again; a file that no longer hashes to its pin
+ * is no standing. A place that pins a lock as its parent stands on nothing head may read: composing the two is bound's, never head's. A place that pins none and names a view has bound compile it, asked once; a fold bound refused is no standing either.
+ */
+export const standingFor = async (context, place) => {
+    const [held, view, compiled] = [await context.standing(place), valueOf(context.lock, 'place/view'), valueOf(context.lock, 'place/compiled')];
+    if ('refused' in held)
+        return { unsettled: held.refused };
+    const own = held.lines;
+    const parent = adoptsIn(context.lock, own);
+    if (parent !== undefined)
+        return { unsettled: sayIn(context.lock)('parent-lock', { place, parent }) };
+    const pins = own.filter((l) => l.scope?.startsWith('uses/') && l.needs?.startsWith(`${compiled}/`)).map((l) => [l, pinnedOf(context.lock, context.files.take(join(place, l.needs)))]);
+    const moved = pins.find(([l, p]) => p?.pin !== l.value);
+    if (moved)
+        return { unsettled: sayIn(context.lock)('compiled-moved', { file: moved[0].needs }) };
+    if (pins.length)
+        return { lines: [...own, ...pins.flatMap(([, p]) => p.lines)] };
+    if (!own.some((line) => line.scope === `view/${view}`))
+        return { lines: own };
+    const world = await context.world(place, view);
+    return 'refused' in world ? { unsettled: world.refused } : { lines: [...own, ...world.lines] };
+};

package/dist/src/index.d.ts

@@ -0,0 +1,2 @@
+#!/usr/bin/env node
+export {};

package/dist/src/index.js

@@ -0,0 +1,119 @@
+#!/usr/bin/env node
+var __rewriteRelativeImportExtension = (this && this.__rewriteRelativeImportExtension) || function (path, preserveJsx) {
+    if (typeof path === "string" && /^\.\.?\//.test(path)) {
+        return path.replace(/\.(tsx)$|((?:\.d)?)((?:\.[^./]+?)?)\.([cm]?)ts$/i, function (m, tsx, d, ext, cm) {
+            return tsx ? preserveJsx ? ".jsx" : ".js" : d && (!ext || !cm) ? m : (d + ext + "." + cm.toLowerCase() + "js");
+        });
+    }
+    return path;
+};
+import { basename, join } from 'node:path';
+import { fileURLToPath } from 'node:url';
+import { Server } from '@modelcontextprotocol/sdk/server/index.js';
+import { StdioServerTransport } from '@modelcontextprotocol/sdk/server/stdio.js';
+import { CallToolRequestSchema, GetPromptRequestSchema, ListPromptsRequestSchema, ListResourcesRequestSchema, ListResourceTemplatesRequestSchema, ListToolsRequestSchema, ReadResourceRequestSchema } from '@modelcontextprotocol/sdk/types.js';
+import { answerOf } from "./core/answer.js";
+import { valueOf } from "./core/lock.js";
+import { fill, matchTemplate, refusedOn, surfaceOf } from "./core/surface.js";
+import { founded, land, landAct, limits, pinnedAt, run, settledView, sign, standingAt, told, words } from "./ports/bound.js";
+import { held, keep } from "./ports/cache.js";
+import { registryFor } from "./ports/signers.js";
+import { dropAt, folderOf, hasAt, layAt, lockAt, takeAt } from "./ports/place.js";
+import { keychain } from "./ports/keychain.js";
+import { algorithmOf, deviceOf, idIn } from "./core/device.js";
+import { publicOf } from "./core/keys.js";
+import { personOf } from "./ports/access/person.js";
+import { inTurn } from "./flows/call.js";
+const [ext, root] = ((self) => [self.slice(self.lastIndexOf('.')), fileURLToPath(new URL(self.endsWith('.ts') ? '..' : '../..', self))])(import.meta.url);
+const lock = lockAt(root);
+const surface = surfaceOf(lock);
+const runs = valueOf(lock, 'runs');
+Object.assign(words, Object.fromEntries(['read', 'view', 'sign', 'land', 'key', 'signer', 'pin', 'topos', 'standing', 'evidence', 'act', 'profile'].map((w) => [w, valueOf(lock, `bound/${w}`)])));
+Object.assign(limits, { wait: Number(valueOf(lock, 'bound/wait').split('..')[1]), most: Number(valueOf(lock, 'bound/printed').split('..')[1]) });
+const offered = (n) => (n ? { listChanged: false } : undefined);
+const server = new Server({ name: surface.name, version: surface.version }, { capabilities: { tools: offered(surface.tools.length), resources: offered(surface.resources.length), prompts: offered(surface.prompts.length) } });
+/** The person, asked as the client lets head ask; every wait on them is counted, so a time ceiling measures head's work and never the person's. */
+let waited = 0;
+const timed = (ask) => async (...args) => { const t = Date.now(); try {
+    return await ask(...args);
+}
+finally {
+    waited += Date.now() - t;
+} };
+const asked = personOf(lock, { can: () => ((e) => ({ url: Boolean(e?.url), form: e !== undefined && (e.form !== undefined || Object.keys(e).length === 0) }))(server.getClientCapabilities()?.elicitation), elicit: (params) => server.elicitInput(params, { timeout: Number(valueOf(lock, 'access/wait').split('..')[1]) }) });
+const person = { consent: timed(asked.consent), enter: timed(asked.enter), choose: timed(asked.choose), visit: timed(asked.visit) };
+/** head is its home: the folder of its index of places, and the keychain service its keys live under, one per home, so two heads on one keychain never share a key. A place's root is told to bound by the key id its lock names, its secret kept there under the place's account. */
+const home = process.env[valueOf(lock, 'home/env')] || join(process.env[valueOf(lock, `platform/${process.platform}/home`)] ?? '', valueOf(lock, 'home/folder'));
+const service = `${deviceOf(lock).service}/${basename(home).replace(/[^\w.-]+/g, '-')}`;
+const store = valueOf(lock, `platform/${process.platform}/store`);
+const keys = keychain(service, store);
+const devices = new Map();
+const device = (role) => devices.get(role) ?? ((secret) => (secret === undefined ? undefined : ((key) => { devices.set(role, key); return key; })(publicOf(secret))))(keys.read(deviceOf(lock, role).account));
+const asRoot = (account) => ((device, key) => [key, device.signer, { BOUND_SIGNERS: registryFor(device.signer, service, account, key, valueOf(lock, 'founding/algorithm'), store) }])(deviceOf(lock), valueOf(lock, 'founding/root').split('/')[1]);
+/** What a call is answered with, one call at a time as when bound blocked head: every bound process it starts is stopped when the client cancels it, and a call cancelled while it waits its turn is never begun. */
+const contextOf = (signal) => {
+    const signRoot = (place, lot, account) => sign(runs, place, lot, ...asRoot(account), signal);
+    const signAs = (place, lot, role, lines) => ((one, id) => sign(runs, place, lot, id, one.signer, { BOUND_SIGNERS: registryFor(one.signer, service, one.account, id, algorithmOf(lines), store) }, signal))(deviceOf(lock, role), idIn(lines, device(role)) ?? deviceOf(lock, role).account);
+    return {
+        lock,
+        bound: (cwd, args) => run(runs, cwd, args, {}, signal),
+        standing: (place) => standingAt(runs, place, (lines) => ['head', 'person'].flatMap((role) => ((id) => (id === undefined ? [] : [id]))(idIn(lines, device(role)))), (line) => line.at?.startsWith(`${valueOf(lock, 'receipt/at')}:`) === true, signal),
+        world: (place, view) => settledView(runs, place, view, signal),
+        adapter: async (origin) => ((name) => (!/^[a-z-]+$/.test(name) ? undefined : import(__rewriteRelativeImportExtension(new URL(`./ports/adapters/${name}${ext}`, import.meta.url).href))))(URL.canParse(origin) ? valueOf(lock, `adapter/${new URL(origin).protocol.slice(0, -1)}`) : ''),
+        files: { lay: layAt, drop: dropAt, has: hasAt, take: takeAt, own: (rel) => takeAt(join(root, rel)) },
+        home: () => home,
+        found: (place, account) => founded(runs, place, ...asRoot(account), signal),
+        signRoot,
+        landRoot: (place, lot, account) => landAct(runs, place, lot, ...asRoot(account), signal),
+        pinned: (place, file) => pinnedAt(runs, place, file, signal),
+        access: async (kind) => (kind !== valueOf(lock, 'access/adapter') || !/^[a-z0-9-]+$/.test(kind) ? undefined : import(__rewriteRelativeImportExtension(new URL(`./ports/access/${kind}${ext}`, import.meta.url).href)).then((m) => m.adapter)),
+        person,
+        cache: { keep, held },
+        signAs,
+        landAs: (place, lot, role, lines) => ((one, id) => landAct(runs, place, lot, id, one.signer, { BOUND_SIGNERS: registryFor(one.signer, service, one.account, id, algorithmOf(lines), store) }, signal))(deviceOf(lock, role), idIn(lines, device(role)) ?? deviceOf(lock, role).account),
+        land: (place, signed) => land(runs, place, signed, signal),
+        told: (place, signed) => told(runs, place, signed, words.standing, signal),
+        elicit: (message) => person.consent(message, valueOf(lock, 'said/elicit/yes')),
+        now: () => Date.now(),
+        machine: () => Date.now() - waited,
+        keys,
+        device,
+        roots: async () => (server.getClientCapabilities()?.roots ? (await server.listRoots()).roots.flatMap((root) => folderOf(root.uri) ?? []) : []),
+    };
+};
+const askedOf = (raw) => Object.fromEntries(Object.entries(raw ?? {}).map(([k, v]) => [k, v === undefined ? undefined : typeof v === 'object' ? JSON.stringify(v) : String(v)]));
+const schemaOf = (fields) => ({ type: 'object',
+    properties: Object.fromEntries(fields.map((f) => [f.name, { type: f.type, description: f.about }])), required: fields.filter((f) => f.required).map((f) => f.name) });
+if (surface.tools.length)
+    server.setRequestHandler(ListToolsRequestSchema, () => ({ tools: surface.tools.map((tool) => ({ name: tool.name, description: tool.about,
+            inputSchema: schemaOf([...tool.fields]), annotations: Object.fromEntries(tool.hints.map((hint) => [`${hint}Hint`, true])) })) }));
+if (surface.tools.length)
+    server.setRequestHandler(CallToolRequestSchema, async (request, extra) => inTurn('', async () => {
+        const tool = surface.tools.find((one) => one.name === request.params.name);
+        if (tool === undefined)
+            return { isError: true, content: [] };
+        const refused = refusedOn(lock, process.platform);
+        if (refused !== undefined)
+            return { content: [{ type: 'text', text: refused }] };
+        return { content: [{ type: 'text', text: extra.signal.aborted ? '' : (await (await answerOf('tools', tool.name))(askedOf(request.params.arguments), contextOf(extra.signal))).join('\n') }] };
+    }));
+if (surface.resources.length)
+    server.setRequestHandler(ListResourcesRequestSchema, () => ({ resources: [] }));
+if (surface.resources.length)
+    server.setRequestHandler(ListResourceTemplatesRequestSchema, () => ({ resourceTemplates: surface.resources.map((r) => ({ name: r.name, uriTemplate: r.template, description: r.about, mimeType: r.mime })) }));
+if (surface.resources.length)
+    server.setRequestHandler(ReadResourceRequestSchema, async (request, extra) => inTurn('', async () => {
+        const found = surface.resources.flatMap((r) => ((vars) => (vars === undefined ? [] : [{ r, vars }]))(matchTemplate(r.template, request.params.uri)))[0];
+        if (found === undefined)
+            return { contents: [] };
+        const refused = refusedOn(lock, process.platform);
+        if (refused !== undefined)
+            return { contents: [{ uri: request.params.uri, mimeType: found.r.mime, text: refused }] };
+        const lines = await (await answerOf('resources', found.r.name))(askedOf(found.vars), contextOf(extra.signal));
+        return { contents: [{ uri: request.params.uri, mimeType: found.r.mime, text: lines.join('\n') }] };
+    }));
+if (surface.prompts.length)
+    server.setRequestHandler(ListPromptsRequestSchema, () => ({ prompts: surface.prompts.map((p) => ({ name: p.name, description: p.about, arguments: p.fields.map((f) => ({ name: f.name, description: f.about, required: f.required })) })) }));
+if (surface.prompts.length)
+    server.setRequestHandler(GetPromptRequestSchema, (request) => ((p) => ({ messages: p === undefined ? [] : [{ role: 'user', content: { type: 'text', text: [p.text, p.line].filter(Boolean).map((t) => fill(t, askedOf(request.params.arguments))).join('\n') } }] }))(surface.prompts.find((one) => one.name === request.params.name)));
+await server.connect(new StdioServerTransport());

package/dist/src/places/admit.d.ts

@@ -0,0 +1,7 @@
+import type { Asked, Context } from '../core/answer.ts';
+/**
+ * Another device admitted into a place by whoever holds its root, once they said yes: the public key its own lines hand
+ * over — what those lines claim it may sign is not read — admitted under the name given here, covering what is given here
+ * or, without it, what a member is covered for: it asks, keeps what it read and proves access, and widens nothing.
+ */
+export declare const admitted: (asked: Asked, context: Context) => Promise<readonly string[]>;

package/dist/src/places/admit.js

@@ -0,0 +1,32 @@
+import { parse } from '@lapxo/topos/wire';
+import { inPlace, standingOr, unless } from "../core/answer.js";
+import { admissionOf, idIn } from "../core/device.js";
+import { valueOf } from "../core/lock.js";
+import { sayIn } from "../core/surface.js";
+import { rootIn } from "../flows/device.js";
+/**
+ * Another device admitted into a place by whoever holds its root, once they said yes: the public key its own lines hand
+ * over — what those lines claim it may sign is not read — admitted under the name given here, covering what is given here
+ * or, without it, what a member is covered for: it asks, keeps what it read and proves access, and widens nothing.
+ */
+export const admitted = (asked, context) => inPlace(asked, context, async (place) => {
+    const say = sayIn(context.lock), word = (k) => valueOf(context.lock, k);
+    const name = (asked['name'] ?? '').toLowerCase().replace(/[^a-z0-9-]+/g, '-');
+    const key = (asked['key'] ?? '').split('\n').map((line) => parse(line.trim())).flatMap((got) => (got.kind === 'fact' && got.value.fields['measure'] === 'public-key' ? [got.value.fields['value'] ?? ''] : []))[0];
+    if (!name || !key)
+        return [say('no-key')];
+    const [root, held] = [rootIn(context, place), await standingOr(context, place)];
+    if ('said' in root)
+        return root.said;
+    if ('said' in held)
+        return held.said;
+    if (held.lines.some((l) => l.scope === `keys/${name}`) || idIn(held.lines, key) !== undefined)
+        return [say('key-taken', { name, place })];
+    const coverage = asked['coverage'] || word('member/coverage');
+    const refused = await unless(context, say('elicit-admit', { name, place, coverage }));
+    if (refused)
+        return refused;
+    const lot = admissionOf(context.lock, key, 'head', { id: name, coverage, at: `policy:head/admit/${new Date(context.now()).toISOString()}` });
+    const landed = await context.landRoot(place, lot, root.account);
+    return 'refused' in landed ? [say('not-landed', { why: landed.refused })] : [say('admitted', { name, place, coverage }), ...landed.lines];
+});

package/dist/src/places/found.d.ts

@@ -0,0 +1,6 @@
+import type { Asked, Context } from '../core/answer.ts';
+/**
+ * A place born where the person names, once they said yes: founded with its own root and the prelude head declares,
+ * and named in head's own index of places — itself a place, founded the first time — by a line its root signs.
+ */
+export declare const bornPlace: (asked: Asked, context: Context) => Promise<readonly string[]>;

package/dist/src/places/found.js

@@ -0,0 +1,59 @@
+import { isAbsolute, basename } from 'node:path';
+import { canonical, LOCK } from '@lapxo/topos/wire';
+import { unless } from "../core/answer.js";
+import { admissionOf } from "../core/device.js";
+import { newKey } from "../core/keys.js";
+import { valueOf } from "../core/lock.js";
+import { deviceKey } from "../flows/device.js";
+import { walkable } from "../walk/context.js";
+import { fill, sayIn } from "../core/surface.js";
+/**
+ * The lines a place is born with, every one drafted by target: its root, by the public half of a key kept only in the
+ * keychain and the signer that reaches it; this device's keys admitted; and the prelude head's lock declares under
+ * birth/ — the wire, the regions and views a world is read through, and the lifetime every reader is bounded by.
+ */
+const birthOf = (lock, root, head, person, place) => [
+    ...[['class', 'authorize'], ['coverage', '*'], ['signer', valueOf(lock, 'device/head/signer')], ['public-key', root]].map(([measure, value]) => canonical({ at: 'policy:head/birth', by: 'target', form: 'alphabet', measure: measure, role: 'writes', scope: valueOf(lock, 'founding/root'), value: value })),
+    ...admissionOf(lock, head, 'head'), ...admissionOf(lock, person, 'person'),
+    ...lock.filter((l) => l.scope?.startsWith('birth/')).map(({ about: _about, scope, ...line }) => canonical({ ...line, value: fill(line.value ?? '', { place }), scope: scope.slice('birth/'.length), at: 'policy:head/birth', by: 'target' })),
+];
+/** A place founded in a folder: a root key made in the keychain under the place's name — never a file — the birth lines written, and the first land signed by that root. */
+const founded = async (context, dir, name) => {
+    const account = fill(valueOf(context.lock, 'founding/root-account'), { place: name });
+    const [head, person] = [deviceKey(context, 'head'), deviceKey(context, 'person')];
+    if (head === undefined || person === undefined)
+        return { refused: 'no-keychain' };
+    if (context.keys.read(account) !== undefined)
+        return { refused: 'place-taken' };
+    const root = newKey();
+    context.keys.write(account, root.secret);
+    context.files.lay(dir, LOCK, new TextEncoder().encode(`${birthOf(context.lock, root.publicKey, head, person, name).join('\n')}\n`));
+    const born = await context.found(dir, account);
+    return ((got) => ('refused' in got ? { refused: 'not-landed', why: got.refused } : got))('refused' in born ? born : await walkable(context, dir, account));
+};
+/**
+ * A place born where the person names, once they said yes: founded with its own root and the prelude head declares,
+ * and named in head's own index of places — itself a place, founded the first time — by a line its root signs.
+ */
+export const bornPlace = async (asked, context) => {
+    const say = sayIn(context.lock);
+    const dir = asked['dir'] ?? '';
+    if (!isAbsolute(dir))
+        return [say('place-absolute')];
+    const name = (asked['name'] || basename(dir)).toLowerCase().replace(/[^a-z0-9-]+/g, '-');
+    if (context.files.has(dir, LOCK))
+        return [say('place-exists', { dir })];
+    const refused = await unless(context, say('elicit-place', { name, dir }));
+    if (refused)
+        return refused;
+    const born = await founded(context, dir, name);
+    if ('refused' in born)
+        return [say(born.refused, { name, dir, why: born.why ?? '' })];
+    const home = context.home();
+    const homed = context.files.has(home, LOCK) ? { lines: [] } : await founded(context, home, valueOf(context.lock, 'home/name'));
+    if ('refused' in homed)
+        return [say(homed.refused, { name: valueOf(context.lock, 'home/name'), dir: home, why: homed.why ?? '' })];
+    const line = canonical({ at: 'policy:head/places', by: 'target', form: 'alphabet', measure: 'id', role: 'writes', scope: `${valueOf(context.lock, 'home/family')}/${name}`, value: dir });
+    const indexed = await context.landRoot(home, [line], fill(valueOf(context.lock, 'founding/root-account'), { place: valueOf(context.lock, 'home/name') }));
+    return 'refused' in indexed ? [say('not-landed', { why: indexed.refused })] : [say('born', { name, dir }), ...indexed.lines];
+};

package/dist/src/ports/access/flow.d.ts

@@ -0,0 +1,13 @@
+import type { AccessAdapter } from '../../access/contract.ts';
+/**
+ * Access as its document declares it, one way for every kind: the steps its flow names, in order — an operation of a
+ * source, an address its authorizer names, or a page the person is sent to and comes back from, opened first so every
+ * step before it knows where the person comes back — each sent what its payload says, with the token so far when it
+ * says so, keeping what its outputs point at — whatever its status, since an answer that calls for a next step may come
+ * as an error; a step whose when holds nothing is passed over, one whose answer holds nothing its outputs name stops the
+ * flow by its name, and so does one that answers an error and names nothing to keep. What the person is asked is asked the first time a step needs it, as the
+ * flow says: a form, a one-time code, a choice among what an answer listed, or a secret on head's own page as far as the
+ * place's root allows. What the person gives travels only to the source's origin or one its own document names. Only
+ * the token is kept, and it rides a request as the flow's template says.
+ */
+export declare const adapter: AccessAdapter;

package/dist/src/ports/access/flow.js

@@ -0,0 +1,120 @@
+import { createHash, randomBytes } from 'node:crypto';
+const one = (f, measure) => f?.[measure]?.[0];
+const pointed = (json, pointer) => pointer.split('/').slice(1).map((s) => s.replaceAll('~1', '/').replaceAll('~0', '~'))
+    .reduce((at, step) => at.flatMap((v) => (v === null || typeof v !== 'object' ? [] : step === '*' ? Object.values(v) : [v[step]])), [json])
+    .flatMap((v) => (typeof v === 'string' || typeof v === 'number' || typeof v === 'boolean' ? [String(v)] : []));
+const transforms = { s256: (s) => createHash('sha256').update(s).digest('base64url'), base64url: (s) => Buffer.from(s).toString('base64url'), base64: (s) => Buffer.from(s).toString('base64') };
+const empty = (v) => v === undefined || v === '' || (Array.isArray(v) && v.length === 0);
+const originOf = (url) => (URL.canParse(url) ? new URL(url).origin : '');
+/**
+ * Access as its document declares it, one way for every kind: the steps its flow names, in order — an operation of a
+ * source, an address its authorizer names, or a page the person is sent to and comes back from, opened first so every
+ * step before it knows where the person comes back — each sent what its payload says, with the token so far when it
+ * says so, keeping what its outputs point at — whatever its status, since an answer that calls for a next step may come
+ * as an error; a step whose when holds nothing is passed over, one whose answer holds nothing its outputs name stops the
+ * flow by its name, and so does one that answers an error and names nothing to keep. What the person is asked is asked the first time a step needs it, as the
+ * flow says: a form, a one-time code, a choice among what an answer listed, or a secret on head's own page as far as the
+ * place's root allows. What the person gives travels only to the source's origin or one its own document names. Only
+ * the token is kept, and it rides a request as the flow's template says.
+ */
+export const adapter = {
+    attach: (secret, params) => ((into, name, value) => (into === 'header' ? { headers: { [name]: value }, query: {} } : into === 'query' ? { headers: {}, query: { [name]: value } } : { headers: {}, query: {} }))(one(params, 'attach-in'), one(params, 'attach-name') ?? '', (one(params, 'attach-template') ?? '{token}').split('{token}').join(secret)),
+    obtain: async (want) => {
+        const [d, gen, inputs, outputs] = [want.declared, { state: randomBytes(24).toString('base64url'), verifier: randomBytes(32).toString('base64url') }, new Map(), new Map()];
+        let [callback, secrets, refused] = ['', 0, undefined];
+        const stop = (why) => { refused ??= why; return undefined; };
+        const ask = async (name) => {
+            const [f, label] = [d[`inputs/${name}`], one(d[`inputs/${name}`], 'label') ?? name];
+            const how = one(f, 'ask');
+            const got = how === 'secret' ? (++secrets > want.secrets ? stop({ refused: 'secret-unallowed', input: name }) : (await want.enter(`${want.source} in ${want.place} · ${label}`, [{ name, label, secret: true }]))?.[name])
+                : how === 'choice' ? await (async () => {
+                    const [values, labels] = [[(await resolve(one(f, 'from') ?? '')) ?? []].flat(), [(await resolve(one(f, 'label') ?? '')) ?? []].flat()];
+                    return (await want.choose(`Choose ${name} for ${want.source} in ${want.place}`, [{ name, options: values.map((value, i) => ({ value, label: labels[i] ?? value })) }]))?.[name];
+                })()
+                    : how === 'form' || how === 'one-time' ? (await want.choose(how === 'form' ? `${want.source} in ${want.place} asks for ${label}` : `${want.source} in ${want.place} sent you a one-time code: enter it within ${one(f, 'ttl') ?? '?'} seconds`, [{ name, label }]))?.[name]
+                        : stop({ refused: 'carry-unsettled', input: name });
+            if (got !== undefined)
+                inputs.set(name, got);
+            return got ?? stop({ refused: 'entry-unfinished', input: name });
+        };
+        const resolve = async (expr, response) => {
+            const [fn, head] = [/^(\w+)\((.*)\)$/.exec(expr), expr.split(/[.#(]/)[0]];
+            if (fn !== null)
+                return want.values.includes(fn[1]) && transforms[fn[1]] ? transforms[fn[1]](String(await resolve(fn[2], response) ?? '')) : stop({ refused: 'carry-unsettled', input: fn[1] });
+            if (/\{[^}]+\}/.test(expr)) {
+                let out = expr;
+                for (const [m, ref] of expr.matchAll(/\{([^}]+)\}/g))
+                    out = out.replace(m, String((await resolve(ref, response)) ?? ''));
+                return out;
+            }
+            if (/^'.*'$/.test(expr))
+                return expr.slice(1, -1);
+            if (!expr.startsWith('$'))
+                return expr;
+            if (!want.values.includes(head))
+                return stop({ refused: 'carry-unsettled', input: head });
+            const [, a = '', , b = ''] = expr.split('.');
+            return head === '$callback' ? callback : head === '$state' ? gen.state : head === '$verifier' ? gen.verifier : head === '$scopes' ? want.scopes.join(' ')
+                : head === '$client' ? one(d[''], 'client') ?? stop({ refused: 'no-client' }) : head === '$host' ? want.host[a] ?? stop({ refused: 'host-input', input: a }) : head === '$inputs' ? inputs.get(a) ?? (await ask(a)) : head === '$steps' ? outputs.get(a)?.get(b)
+                    : ((all) => (expr.includes('*') ? all : all[0]))(pointed(response, expr.slice(expr.indexOf('#') + 1)));
+        };
+        const gather = async (k, kind, response) => {
+            const held = {};
+            for (const key of Object.keys(d).filter((one_) => one_.startsWith(`${k}/${kind}/`)))
+                held[key.slice(k.length + kind.length + 2)] = d[key]['items'] ? (await Promise.all(d[key]['items'].map((e) => resolve(e, response)))).flatMap((v) => (v === undefined ? [] : [v].flat())) : await resolve(one(d[key], 'value') ?? '', response);
+            return held;
+        };
+        const kept = async (k, response, status = 200) => {
+            const held = await gather(k, 'outputs', response);
+            if (Object.values(held).every(empty) && (status >= 400 || Object.keys(held).length))
+                return Boolean(stop({ refused: 'step-unanswered', input: one(d[k], 'id') ?? k }));
+            outputs.set(one(d[k], 'id') ?? k, new Map(Object.entries(held)));
+            return true;
+        };
+        const guarded = (k) => ((at) => !(at !== undefined && d[k]['overlay'] && originOf(at) !== originOf(want.origin)
+            && Object.keys(d).some((key) => key.startsWith(`${k}/payload/`) && (d[key]['value'] ?? d[key]['items'] ?? []).some((e) => e.includes('$inputs.')))) || Boolean(stop({ refused: 'cross-origin' })))(one(d[k], 'url') ?? one(d[k], 'page'));
+        const run = async (k) => {
+            const f = d[k];
+            if (one(f, 'when') !== undefined && empty(await resolve(one(f, 'when'))))
+                return true;
+            if (!guarded(k))
+                return false;
+            const [sent, token] = [await gather(k, 'payload'), one(f, 'token') === undefined ? undefined : await resolve(one(f, 'token'))];
+            if (refused)
+                return false;
+            const answered = one(f, 'operation') !== undefined ? await want.call(one(f, 'source') ?? want.source, one(f, 'operation'), sent, typeof token === 'string' ? adapter.attach(token, d[''] ?? {}) : undefined)
+                : await want.post(one(f, 'url'), sent, one(f, 'encoding') === 'json' ? 'json' : 'form');
+            return refused ? false : answered === undefined ? Boolean(stop({ refused: 'login-refused' })) : kept(k, answered.json, answered.status);
+        };
+        const steps = Object.keys(d).filter((key) => /^steps\/\d+$/.test(key)).sort((a, b) => Number(a.slice(6)) - Number(b.slice(6)));
+        const page = steps.findIndex((k) => one(d[k], 'page') !== undefined);
+        if (page >= 0) {
+            const back = await want.visit(`Sign in to ${want.source} at its provider`, async (address) => {
+                callback = address;
+                for (const k of steps.slice(0, page))
+                    if (!(await run(k)))
+                        return undefined;
+                if (!guarded(steps[page]))
+                    return undefined;
+                const to = new URL(one(d[steps[page]], 'page'));
+                for (const [name, v] of Object.entries(await gather(steps[page], 'payload')))
+                    if (!empty(v))
+                        to.searchParams.set(name, String(v));
+                return refused ? undefined : to.href;
+            });
+            if (!refused && (back === undefined || (back['state'] !== undefined && back['state'] !== gen.state)))
+                stop({ refused: 'login-refused' });
+            if (!refused)
+                await kept(steps[page], back);
+        }
+        for (const k of page >= 0 ? steps.slice(page + 1) : steps)
+            if (refused || !(await run(k)))
+                break;
+        const [token, expires] = [(await Promise.all((d['']?.['token'] ?? []).map((e) => resolve(e)))).find((v) => !empty(v)), (await Promise.all((d['']?.['expires'] ?? []).map((e) => resolve(e)))).find((v) => !empty(v))];
+        if (refused)
+            return refused;
+        if (typeof token !== 'string' || !token)
+            return { refused: 'login-refused' };
+        return { secret: token, ...(typeof expires === 'string' && Number.isFinite(Number(expires)) ? { expires: want.now + Number(expires) * 1000 } : {}), ...(steps.length ? {} : { manual: true }) };
+    },
+};

package/dist/src/ports/access/page.d.ts

@@ -0,0 +1,12 @@
+import type { Field, Held } from '../../access/contract.ts';
+/**
+ * One page on this device, for one person, once: served on a loopback port under a path no one can guess, it takes the
+ * fields it was opened with — a secret one as a password, never echoed, a choice among its options — or, as a return
+ * address, what a visit sends back.
+ * It answers the first submission and closes; a wait that runs out closes it with nothing.
+ */
+export declare const open: (title: string, fields: readonly Field[] | "return", wait: number) => Promise<{
+    readonly url: string;
+    readonly held: Promise<Held | undefined>;
+    readonly close: () => void;
+}>;

package/dist/src/ports/access/page.js

@@ -0,0 +1,50 @@
+import { randomBytes } from 'node:crypto';
+import { createServer } from 'node:http';
+const escape = (text) => text.replace(/[&<>"']/g, (c) => `&#${c.charCodeAt(0)};`);
+const box = 'style="width:100%;font:inherit;padding:.4rem"', press = 'style="font:inherit;padding:.4rem 1rem;margin-right:.5rem"';
+/** One field as the page asks it: a secret as a password, a choice as a list of its options — or, when it is the page's only question, as one button an option — anything else as text. */
+const asked = (f, alone) => (f.options && alone ? `<p>${escape(f.label)}</p>${f.options.map((o) => `<button name="${escape(f.name)}" value="${escape(o.value)}" ${press}>${escape(o.label)}</button>`).join('')}`
+    : `<label style="display:block;margin:1rem 0">${escape(f.label)}<br>${f.options ? `<select name="${escape(f.name)}" required ${box}>${f.options.map((o) => `<option value="${escape(o.value)}">${escape(o.label)}</option>`).join('')}</select>`
+        : `<input name="${escape(f.name)}" type="${f.secret ? 'password' : 'text'}" autocomplete="off" required ${box}>`}</label>`);
+const form = (title, fields) => `<!doctype html><meta charset="utf-8"><meta name="viewport" content="width=device-width"><title>${escape(title)}</title>
+<body style="font:16px system-ui;max-width:28rem;margin:3rem auto;padding:0 1rem"><h1 style="font-size:1.2rem">${escape(title)}</h1><form method="post">${fields.map((f) => asked(f, fields.length === 1)).join('')}
+${fields.length === 1 && fields[0].options ? '' : `<button ${press}>Send</button>`}</form></body>`;
+const done = `<!doctype html><meta charset="utf-8"><title>done</title><body style="font:16px system-ui;margin:3rem">Received. You can close this page.</body>`;
+/**
+ * One page on this device, for one person, once: served on a loopback port under a path no one can guess, it takes the
+ * fields it was opened with — a secret one as a password, never echoed, a choice among its options — or, as a return
+ * address, what a visit sends back.
+ * It answers the first submission and closes; a wait that runs out closes it with nothing.
+ */
+export const open = async (title, fields, wait) => {
+    const nonce = randomBytes(24).toString('base64url');
+    let settle = () => undefined;
+    const held = new Promise((resolve) => { settle = resolve; });
+    const server = createServer((request, response) => {
+        const url = new URL(request.url ?? '/', 'http://127.0.0.1');
+        if (url.pathname !== `/${nonce}`) {
+            response.writeHead(404).end();
+            return;
+        }
+        if (fields === 'return' && request.method === 'GET') {
+            response.writeHead(200, { 'content-type': 'text/html' }).end(done);
+            finish(Object.fromEntries(url.searchParams));
+            return;
+        }
+        if (fields !== 'return' && request.method === 'GET') {
+            response.writeHead(200, { 'content-type': 'text/html', 'cache-control': 'no-store' }).end(form(title, fields));
+            return;
+        }
+        let body = '';
+        request.on('data', (chunk) => { body += chunk.toString('utf8'); if (body.length > 65536)
+            request.destroy(); });
+        request.on('end', () => { response.writeHead(200, { 'content-type': 'text/html' }).end(done); finish(Object.fromEntries(new URLSearchParams(body))); });
+    });
+    let closed = false;
+    const finish = (got) => { if (closed)
+        return; closed = true; server.close(); settle(got); };
+    const signal = AbortSignal.timeout(wait);
+    signal.addEventListener('abort', () => finish(undefined), { once: true });
+    await new Promise((resolve) => server.listen(0, '127.0.0.1', resolve));
+    return { url: `http://127.0.0.1:${server.address().port}/${nonce}`, held, close: () => finish(undefined) };
+};

package/dist/src/ports/access/person.d.ts

@@ -0,0 +1,25 @@
+import type { Choice, Field, Held } from '../../access/contract.ts';
+import type { Said } from '../../core/lock.ts';
+/** What the client lets head ask of the person: whether it sends addresses and asks forms, and the asking itself. */
+export interface Client {
+    readonly can: () => {
+        readonly url: boolean;
+        readonly form: boolean;
+    };
+    readonly elicit: (params: Readonly<Record<string, unknown>>) => Promise<{
+        readonly action: string;
+        readonly content?: Readonly<Record<string, unknown>>;
+    }>;
+}
+/**
+ * The person at this device, asked through the richest channel the client declares, in the order head's lock lines name:
+ * the client's own form; head's one-time page, sent by the client as an address; the same page opened by this device's
+ * browser. A secret goes only through the page — never a form the model could see — and a yes only through what the
+ * client can ask, else it is the person's to sign. A visit to a provider comes back to such a page.
+ */
+export declare const personOf: (lock: readonly Said[], client: Client) => {
+    consent: (message: string, word: string) => Promise<"yes" | "no" | "none">;
+    enter: (title: string, fields: readonly Field[]) => Promise<Held | undefined>;
+    choose: (message: string, choices: readonly Choice[]) => Promise<Held | undefined>;
+    visit: (message: string, to: (back: string) => string | undefined | Promise<string | undefined>) => Promise<Held | undefined>;
+};