@lapxo/head 0.0.0-stage → 0.1.3

package/dist/src/access/contract.d.ts

@@ -0,0 +1,71 @@
+import type { Fields } from '../core/read.ts';
+export type { Fields };
+export interface Field {
+    readonly name: string;
+    readonly label: string;
+    readonly secret: boolean;
+    readonly options?: readonly {
+        readonly value: string;
+        readonly label: string;
+    }[];
+}
+export type Held = Readonly<Record<string, string>>;
+export interface Choice {
+    readonly name: string;
+    readonly label?: string;
+    readonly options?: readonly {
+        readonly value: string;
+        readonly label: string;
+    }[];
+}
+export interface Attachment {
+    readonly headers: Held;
+    readonly query: Held;
+}
+/** A secret obtained by a declared flow: the secret, when it stops holding and what renews it, when the flow says; manual when a person entered it with no flow declared. */
+export interface Obtained {
+    readonly secret: string;
+    readonly expires?: number;
+    readonly renew?: string;
+    readonly manual?: true;
+}
+export type Answered = {
+    readonly status: number;
+    readonly json: unknown;
+} | undefined;
+/**
+ * What the host hands an access adapter to run its flow with: the declared lines of its scheme — by the step below it they
+ * are said under — the origin the source is reached at, how many secrets the place's root lets it ask, the values a flow
+ * may name, and the person; never a shell, never a file.
+ */
+export interface Want {
+    readonly place: string;
+    readonly source: string;
+    readonly scheme: string;
+    readonly params: Fields;
+    readonly scopes: readonly string[];
+    readonly now: number;
+    readonly renew?: string;
+    readonly declared: Readonly<Record<string, Fields>>;
+    readonly origin: string;
+    readonly secrets: number;
+    readonly values: readonly string[];
+    readonly host: Readonly<Record<string, string>>;
+    readonly enter: (title: string, fields: readonly Field[]) => Promise<Held | undefined>;
+    readonly consent: (message: string) => Promise<boolean>;
+    readonly choose: (message: string, choices: readonly Choice[]) => Promise<Held | undefined>;
+    readonly visit: (message: string, to: (back: string) => string | undefined | Promise<string | undefined>) => Promise<Held | undefined>;
+    readonly form: (source: string, operation: string) => Fields;
+    readonly call: (source: string, operation: string, body: unknown, attachment?: Attachment) => Promise<Answered>;
+    readonly post: (url: string, body: Readonly<Record<string, unknown>>, as?: 'form' | 'json') => Promise<Answered>;
+}
+/** A kind of access, executed by the host: how its secret rides a request, and the flow that obtains it. */
+export interface AccessAdapter {
+    readonly attach: (secret: string, params: Fields) => Attachment;
+    readonly obtain: (want: Want) => Promise<Obtained | {
+        readonly refused: string;
+        readonly input?: string;
+    }>;
+    readonly discover?: (resource: string, challenge: string, get: (url: string) => Promise<unknown>) => Promise<Readonly<Record<string, Fields>> | undefined>;
+}
+export declare const jsonOf: (body: Uint8Array | string) => unknown;

package/dist/src/access/contract.js

@@ -0,0 +1,6 @@
+export const jsonOf = (body) => { try {
+    return JSON.parse(typeof body === 'string' ? body : Buffer.from(body).toString('utf8'));
+}
+catch {
+    return undefined;
+} };

package/dist/src/access/obtain.d.ts

@@ -0,0 +1,19 @@
+import type { Attachment } from './contract.ts';
+import type { Context } from '../core/answer.ts';
+import type { Said } from '../core/lock.ts';
+import type { Call } from '../core/read.ts';
+/** Whom a call is made as, never its secret: anonymous, or the access account and when the secret it holds now was obtained — still holding, unless what was made as it is only being looked back on; none while no secret is kept, or one is kept without saying when. */
+export declare const principalOf: (context: Context, plan: Call, current?: boolean) => string | undefined;
+/**
+ * What a call's access attaches: nothing when it is anonymous; the kept secret while it holds; else the flow its kind's
+ * adapter runs — found by the line, never by a name head knows — its secret kept in the place's keychain entry and its
+ * obtaining landed as a receipt without the secret. What a person enters goes only to the origin of the source in use:
+ * a step of another source is sent there too, where that source declares it among its own, and refused by name where not. A kind no adapter carries, or a flow that does not finish, is no call.
+ */
+export declare const attachmentFor: (context: Context, place: string, lines: readonly Said[], plan: Call) => Promise<{
+    readonly attachment: Attachment | undefined;
+    readonly principal: string | undefined;
+} | {
+    readonly said: string;
+    readonly input?: string;
+}>;

package/dist/src/access/obtain.js

@@ -0,0 +1,70 @@
+import { canonical } from '@lapxo/topos/wire';
+import { jsonOf } from "./contract.js";
+import { placeNameOf } from "../core/answer.js";
+import { members, valueOf } from "../core/lock.js";
+import { fieldsOf, stepOf, vocabOf } from "../core/read.js";
+const sealed = (got) => Buffer.from(JSON.stringify(got)).toString('base64url');
+const opened = (kept) => { try {
+    return kept === undefined ? undefined : JSON.parse(Buffer.from(kept, 'base64url').toString('utf8'));
+}
+catch {
+    return undefined;
+} };
+const holds = (held, now) => held !== undefined && (held.expires === undefined || held.expires > now);
+const asOf = (account, held) => (held.at === undefined ? undefined : `${account}@${held.at}`);
+/** Whom a call is made as, never its secret: anonymous, or the access account and when the secret it holds now was obtained — still holding, unless what was made as it is only being looked back on; none while no secret is kept, or one is kept without saying when. */
+export const principalOf = (context, plan, current = true) => ((account) => (account === undefined ? 'anonymous'
+    : ((held) => (held !== undefined && (!current || holds(held, context.now())) ? asOf(account, held) : undefined))(opened(context.keys.read(account)))))(plan.access.account);
+/**
+ * What a call's access attaches: nothing when it is anonymous; the kept secret while it holds; else the flow its kind's
+ * adapter runs — found by the line, never by a name head knows — its secret kept in the place's keychain entry and its
+ * obtaining landed as a receipt without the secret. What a person enters goes only to the origin of the source in use:
+ * a step of another source is sent there too, where that source declares it among its own, and refused by name where not. A kind no adapter carries, or a flow that does not finish, is no call.
+ */
+export const attachmentFor = async (context, place, lines, plan) => {
+    const access = plan.access;
+    if (access.account === undefined)
+        return { attachment: undefined, principal: 'anonymous' };
+    const adapter = await context.access(access.kind);
+    if (adapter === undefined)
+        return { said: 'no-adapter' };
+    const held = opened(context.keys.read(access.account));
+    if (holds(held, context.now()))
+        return { attachment: adapter.attach(held.secret, access.params), principal: asOf(access.account, held) };
+    const [v, most] = [vocabOf(context.lock), Number((lines.find((l) => l.scope === 'read/response-bytes')?.value ?? '0..0').split('..')[1])];
+    const origin = (url) => (URL.canParse(url) ? new URL(url).origin : '');
+    let crossed = false;
+    const step = async (source, operation, body, attachment) => {
+        const declares = (fieldsOf(lines, `${v.region}/${source}`)[v.origins] ?? []).includes(plan.origin);
+        const call = stepOf(declares ? [...lines.filter((l) => l.scope !== `${v.pick}/${source}`), { scope: `${v.pick}/${source}`, value: plan.origin }] : lines, context.lock, source, operation);
+        if (call.kind !== 'call' || origin(call.origin) !== origin(plan.origin)) {
+            crossed = call.kind === 'call' || !declares;
+            return undefined;
+        }
+        const transport = call.kind === 'call' ? await context.adapter(call.origin) : undefined;
+        const prepared = call.kind === 'call' && transport ? transport.prepare(call, { body }, context.lock) : undefined;
+        const got = prepared && 'send' in prepared ? await prepared.send(attachment, most) : undefined;
+        return got?.kind === 'got' ? { status: got.status, json: jsonOf(got.bytes) } : undefined;
+    };
+    const reads = new Set(lines.filter((l) => l.scope?.startsWith(`${v.offers}/${plan.source}/`) && l.measure === v.class && l.value === v.callable).map((l) => l.scope));
+    const [scheme, root] = [access.from ?? `${v.keys}/${access.flow}`, valueOf(context.lock, 'founding/root').split('/')[1]];
+    const want = {
+        place: placeNameOf(place), source: plan.source, scheme: access.scheme, params: access.params, now: context.now(), origin: plan.origin, renew: held?.renew,
+        declared: Object.fromEntries([...new Set(lines.filter((l) => l.scope === scheme || l.scope?.startsWith(`${scheme}/`)).map((l) => l.scope))].map((at) => [at.slice(scheme.length + 1), fieldsOf(lines, at)])),
+        secrets: Number((lines.find((l) => l.scope === valueOf(context.lock, 'access/secrets') && l.by === root)?.value ?? '0..0').split('..')[1]),
+        values: members(valueOf(lines, 'wire/access-values') || valueOf(context.lock, 'wire/access-values')),
+        host: Object.fromEntries(context.lock.filter((l) => l.scope?.startsWith('host/')).map((l) => [l.scope.slice('host/'.length), l.value ?? ''])),
+        scopes: [...new Set(lines.filter((l) => reads.has(l.scope) && l.measure === 'scopes').flatMap((l) => (l.value ?? '').split('|')))].sort(),
+        enter: (title, fields) => context.person.enter(title, fields), consent: async (message) => (await context.person.consent(message, valueOf(context.lock, 'said/elicit/yes'))) === 'yes', choose: (message, choices) => context.person.choose(message, choices), visit: (message, to) => context.person.visit(message, to),
+        form: (source, operation) => fieldsOf(lines, `${v.offers}/${source}/${operation}/${v.form}`), call: step,
+        post: async (url, body, as) => ((transport) => (transport === undefined ? undefined : transport.post(url, body, most, Number(valueOf(context.lock, 'adapter/request/wait').split('..')[1]), as)))(await context.adapter(url)),
+    };
+    const got = await adapter.obtain(want);
+    if ('refused' in got)
+        return { said: crossed ? 'cross-origin' : got.refused, ...(got.input === undefined ? {} : { input: got.input }) };
+    const when = new Date(context.now()).toISOString();
+    context.keys.write(access.account, sealed({ ...got, at: when }));
+    const receipt = canonical({ at: `${valueOf(context.lock, 'receipt/at')}:${when}`, by: 'target', form: 'alphabet', measure: 'status', role: 'writes', scope: `${valueOf(context.lock, 'access/family')}/${access.flow}/${got.manual ? 'entered' : held === undefined ? 'obtained' : 'renewed'}`, value: 'present' });
+    await context.landAs(place, [receipt], 'head', lines);
+    return { attachment: adapter.attach(got.secret, access.params), principal: `${access.account}@${when}` };
+};

package/dist/src/adopt/adopt.d.ts

@@ -0,0 +1,12 @@
+import type { Context, Outcome } from '../core/answer.ts';
+import type { Said } from '../core/lock.ts';
+import type { Line } from '../compile/pin.ts';
+/**
+ * Every world head adopts, once per place: its standing and blob pinned where they are published, for bound to
+ * fetch and verify, and each of its readers told where head lays what it reads — read off the standing head reads from
+ * the same address once per device, kept by its digest and answered only when it hashes to the pin. A world whose
+ * standing cannot be read so is no adoption.
+ */
+export declare const adopted: (context: Context, place: string, lands: (lot: readonly string[]) => Promise<Outcome>, line: Line) => Promise<Outcome>;
+/** The name of a lock the place pins as its parent, when it pins one: composing a parent's policy with a child's is bound's, so head reads nothing of such a place and signs nothing for it. */
+export declare const adoptsIn: (lock: readonly Said[], lines: readonly Said[]) => string | undefined;

package/dist/src/adopt/adopt.js

@@ -0,0 +1,40 @@
+import { EXTENSION } from '@lapxo/topos/wire';
+import { members, valueOf } from "../core/lock.js";
+import { linesOf } from "../core/worlds.js";
+/**
+ * What a place declares of a world it adopts, read off the world's own standing: each region that writes readings is a
+ * reader, given the coordinates of what is connected when the place's view reads it — else of what was answered, when
+ * only the view of answers does — and what it writes as its receipts. head names none of a world's regions.
+ */
+const readersOf = (lock, standing) => {
+    const region = valueOf(lock, 'vocab/region');
+    const reads = (view) => members(standing.find((l) => l.scope === `${region}/${valueOf(lock, view)}` && l.measure === 'reads')?.value ?? '');
+    const [connected, answered] = [reads('place/view'), reads('place/answer')];
+    return standing.filter((l) => l.scope?.startsWith(`${region}/`) && l.measure === 'writes' && l.role === 'writes').flatMap((l) => ((coordinates) => (coordinates
+        ? [{ scope: l.scope, measure: 'coordinates', value: coordinates }, { scope: l.scope, measure: 'receipts', value: l.value }] : []))(connected.includes(l.scope) ? valueOf(lock, 'place/connected/coordinates') : answered.includes(l.scope) ? valueOf(lock, 'place/answers/coordinates') : ''));
+};
+/**
+ * Every world head adopts, once per place: its standing and blob pinned where they are published, for bound to
+ * fetch and verify, and each of its readers told where head lays what it reads — read off the standing head reads from
+ * the same address once per device, kept by its digest and answered only when it hashes to the pin. A world whose
+ * standing cannot be read so is no adoption.
+ */
+export const adopted = async (context, place, lands, line) => {
+    const [word, held] = [(k) => valueOf(context.lock, k), await context.policy(place)];
+    if ('refused' in held)
+        return held;
+    const own = held.lines, [wait, most] = ['adapter/request/wait', 'world/standing-bytes'].map((k) => Number(word(k).split('..')[1]));
+    const lot = [];
+    for (const w of members(word('world/adopts')).filter((w) => !own.some((l) => l.scope === `uses/${w}`))) {
+        const [standing, blob, at, blobAt] = [word(`world/${w}/standing`), word(`world/${w}/blob`), word(`sources/${w}`), word(`sources/${w}-blob`)];
+        const bytes = context.cache.held(standing) ?? ((got) => (got === undefined ? undefined : (context.cache.keep(got), got)))(await (await context.adapter(at))?.published(at, standing, most, wait));
+        if (bytes === undefined)
+            return { refused: `REFUSE·world ${w}: ${at} answered no bytes that hash to its pin ${standing}` };
+        const laid = `${word('place/worlds')}/${w}${EXTENSION}`;
+        context.files.lay(place, laid, bytes);
+        lot.push(line(`uses/${w}`, 'digest', standing, { needs: laid }), line(`sources/${w}`, 'id', at), line(`dep/${w}-blob`, 'digest', blob, { shape: word('world/shape') }), line(`sources/${w}-blob`, 'id', blobAt), ...readersOf(context.lock, linesOf(bytes)).map((r) => line(r.scope, r.measure, r.value, { role: 'reads' })));
+    }
+    return lot.length ? lands(lot) : { lines: [] };
+};
+/** The name of a lock the place pins as its parent, when it pins one: composing a parent's policy with a child's is bound's, so head reads nothing of such a place and signs nothing for it. */
+export const adoptsIn = (lock, lines) => lines.find((l) => l.scope?.startsWith('uses/') && l.needs?.startsWith(`${valueOf(lock, 'place/adopted')}/`))?.scope?.slice('uses/'.length);

package/dist/src/compile/pin.d.ts

@@ -0,0 +1,26 @@
+import type { Context, Outcome } from '../core/answer.ts';
+import type { Said } from '../core/lock.ts';
+export type Line = (scope: string, measure: string, value: string, more?: Readonly<Record<string, string>>) => string;
+export type Pinned = {
+    readonly pin: string;
+    readonly lines: readonly Said[];
+} | {
+    readonly said: readonly string[];
+    readonly open?: true;
+    readonly dropped?: true;
+};
+/**
+ * A source pinned in a place: compiled once per digest of what it read — the place's other pins and what was laid for it
+ * — so the same input finds its compiled standing by name, and pinned from the place's store: a new pin lands with the old
+ * one's withdraw, said at its own time, since a withdrawn saying stays withdrawn.
+ */
+export declare const pinIn: (context: Context, place: string, lands: (lot: readonly string[]) => Promise<Outcome>, line: Line) => (source: string, read: readonly string[]) => Promise<Pinned>;
+/**
+ * The demands a document laid in a place pays: every other pin whose compile named a reference to it unresolved, as it
+ * was not there yet, recompiled now that it is — the input its old pin read and the place's pins as they now stand — and
+ * never reconnected. What each answers is said by the pin; one still unresolved stays a demand.
+ */
+export declare const paidBy: (context: Context, place: string, pin: ReturnType<typeof pinIn>, laid: string) => Promise<readonly {
+    readonly source: string;
+    readonly pinned: Pinned;
+}[]>;

package/dist/src/compile/pin.js

@@ -0,0 +1,74 @@
+import { basename, join } from 'node:path';
+import { canonical, EXTENSION } from '@lapxo/topos/wire';
+import { members, under, valueOf } from "../core/lock.js";
+import { fieldsOf, vocabOf } from "../core/read.js";
+import { sayIn } from "../core/surface.js";
+import { digestIn, linesOf, pinnedOf } from "../core/worlds.js";
+/**
+ * One compile, by the fold: the place view asked once, this source's lines kept with a region of its own — and the flow
+ * of each issuer the source declares, so a flow is pinned once, by whoever declares it — and the standing bound selects
+ * from them pinned and laid where its input names it.
+ */
+const compiledOf = async (context, place, source, file) => {
+    const say = sayIn(context.lock), v = vocabOf(context.lock);
+    const compiled = await context.world(place, valueOf(context.lock, 'place/view'));
+    if ('refused' in compiled)
+        return { said: [say('unsettled', { source, why: compiled.refused })] };
+    const issued = (fieldsOf(compiled.lines, `${v.region}/${source}`)[v.issuers] ?? []).map((issuer) => `${v.keys}/${issuer}`);
+    const mine = compiled.lines.filter((l) => l.scope === `${v.region}/${source}` || l.scope?.startsWith(`${v.keys}/${source}/`) || l.scope?.startsWith(`${v.offers}/${source}/`) || /^(read|write)\//.test(l.scope ?? '')
+        || issued.some((at) => l.scope === at || l.scope?.startsWith(`${at}/`)));
+    if (!mine.some((l) => !/^(read|write)\//.test(l.scope ?? '')))
+        return { said: [], open: true };
+    const refused = ['unparsed', 'unsupported', 'collision'].find((word) => fieldsOf(compiled.lines, `${v.region}/${source}`)[v[word]] !== undefined);
+    if (refused)
+        return { said: [say(`document-${refused}`, { source, why: fieldsOf(compiled.lines, `${v.region}/${source}`)[v[refused]].join('; ') })], dropped: true };
+    if (!mine.some((l) => l.measure === v.class && l.scope?.split('/').length === 3))
+        return { said: [say('nothing-offered', { source })] };
+    return drafted(context, place, source, file, [...mine.map((l) => canonical(l)), canonical({ at: 'policy:head/connect', by: 'target', form: 'alphabet', measure: 'reads', role: 'render', scope: `${v.region}/${source}`, value: [`${v.keys}/${source}/**`, ...issued.flatMap((at) => [at, `${at}/**`]), `${v.offers}/${source}/**|read/**|${v.region}/${source}|write/**`].join('|') })]);
+};
+const drafted = async (context, place, source, file, lines) => {
+    const say = sayIn(context.lock), draft = file.replace(new RegExp(`${EXTENSION.replace('.', '\\.')}$`), `.draft${EXTENSION}`);
+    context.files.lay(place, draft, new TextEncoder().encode(`${lines.join('\n')}\n`));
+    const pinned = await context.pinned(place, draft);
+    context.files.drop(place, draft);
+    if (pinned === undefined || 'refused' in pinned)
+        return { said: [pinned === undefined ? say('nothing-offered', { source }) : say('unsettled', { source, why: pinned.refused })] };
+    context.files.lay(place, file, new TextEncoder().encode(pinned.bytes));
+    return { pin: pinned.pin, lines: pinned.lines };
+};
+/**
+ * A source pinned in a place: compiled once per digest of what it read — the place's other pins and what was laid for it
+ * — so the same input finds its compiled standing by name, and pinned from the place's store: a new pin lands with the old
+ * one's withdraw, said at its own time, since a withdrawn saying stays withdrawn.
+ */
+export const pinIn = (context, place, lands, line) => async (source, read) => {
+    const [say, digest, held] = [sayIn(context.lock), digestIn(context.lock), await context.policy(place)];
+    if ('refused' in held)
+        return { said: [say('unsettled', { source, why: held.refused })] };
+    const own = held.lines;
+    const input = digest([...own.filter((l) => l.scope?.startsWith('uses/') && l.scope !== `uses/${source}`).map((l) => `${l.scope} ${l.value}`), ...read].sort().join('\n'));
+    const file = `${members(valueOf(context.lock, 'place/compiled'))[0]}/${source}/${input.split(':')[1].slice(0, 16)}${EXTENSION}`;
+    const old = own.find((l) => l.scope === `uses/${source}`);
+    const pinned = ((kept) => (kept !== undefined && kept.pin === old?.value ? kept : undefined))(pinnedOf(context.lock, old?.needs === file ? context.files.take(join(place, file)) : undefined)) ?? await compiledOf(context, place, source, file);
+    if ('said' in pinned || (old?.needs === file && old.value === pinned.pin))
+        return pinned;
+    const withdraw = old === undefined ? [] : [canonical({ ...Object.fromEntries(Object.entries(old).filter(([k]) => !['sig', 'epoch'].includes(k))), by: 'target', value: 'withdraw' })];
+    const landed = await lands([...withdraw, line(`uses/${source}`, 'digest', pinned.pin, { needs: file, at: `policy:head/connect/${new Date(context.now()).toISOString()}` })]);
+    return 'refused' in landed ? { said: [say('not-landed', { why: landed.refused })] } : pinned;
+};
+/**
+ * The demands a document laid in a place pays: every other pin whose compile named a reference to it unresolved, as it
+ * was not there yet, recompiled now that it is — the input its old pin read and the place's pins as they now stand — and
+ * never reconnected. What each answers is said by the pin; one still unresolved stays a demand.
+ */
+export const paidBy = async (context, place, pin, laid) => {
+    const [v, held] = [vocabOf(context.lock), await context.policy(place)];
+    if ('refused' in held)
+        return [];
+    const owed = held.lines.filter((l) => l.scope?.startsWith('uses/') && under(context.lock, 'place/compiled', l.needs)
+        && linesOf(context.files.take(join(place, l.needs)) ?? new Uint8Array()).some((r) => r.measure === v.unresolved && basename((r.value ?? '').split('#')[0]) === basename(laid)));
+    const paid = [];
+    for (const l of owed)
+        paid.push({ source: l.scope.slice('uses/'.length), pinned: await pin(l.scope.slice('uses/'.length), [`${l.scope} ${l.needs}`]) });
+    return paid;
+};

package/dist/src/core/act.d.ts

@@ -0,0 +1,18 @@
+import type { Said } from './lock.ts';
+/** How many times the person allows an operation: their line for it, never more than their line for the whole source; none, none. */
+export declare const allowedOf: (lines: readonly Said[], family: string, api: string, operation: string) => number;
+/** Whether the person granted head to read a source, by the one sentence they signed for the place: the sources it names, until the day it names. */
+export declare const grantedOf: (lines: readonly Said[], family: string, source: string, now: number) => boolean;
+export declare const untilOf: (period: string, now: number) => string;
+export declare const cappedOf: (lines: readonly Said[], family: string, source: string, operation: string) => boolean;
+export declare const askedOf: (lines: readonly Said[], family: string, api: string, operation: string) => boolean;
+export declare const isOpen: (lines: readonly Said[], intent: string, ends: readonly string[]) => boolean;
+/**
+ * The acts of an operation as its receipts say them: every end it got, a receipt or a look that closed an intent — a
+ * call that may have happened counts against the allowance as one that did, even when the same request ran again —
+ * and whether this request has an intent still open.
+ */
+export declare const actsOf: (lines: readonly Said[], family: string, ends: readonly string[], api: string, operation: string, request: string) => {
+    done: number;
+    open: boolean;
+};

package/dist/src/core/act.js

@@ -0,0 +1,18 @@
+const hi = (lines, scope) => ((line) => (line === undefined ? undefined : Number((line.value ?? '').split('..')[1])))(lines.find((l) => l.scope === scope && l.measure === 'calls'));
+/** How many times the person allows an operation: their line for it, never more than their line for the whole source; none, none. */
+export const allowedOf = (lines, family, api, operation) => Math.min(hi(lines, `${family}/${api}/${operation}`) ?? 0, hi(lines, `${family}/${api}`) ?? Infinity);
+/** Whether the person granted head to read a source, by the one sentence they signed for the place: the sources it names, until the day it names. */
+export const grantedOf = (lines, family, source, now) => (lines.find((l) => l.scope === family && l.measure === 'sources')?.value ?? '').split('|').includes(source) && Date.parse(lines.find((l) => l.scope === family && l.measure === 'until')?.value ?? '') > now;
+export const untilOf = (period, now) => new Date(now + Number(period) * 86_400_000).toISOString().slice(0, 10);
+export const cappedOf = (lines, family, source, operation) => hi(lines, `${family}/${source}/${operation}`) !== undefined || hi(lines, `${family}/${source}`) !== undefined;
+export const askedOf = (lines, family, api, operation) => lines.some((l) => l.scope === `${family}/${api}/${operation}` && l.value === 'present');
+export const isOpen = (lines, intent, ends) => lines.filter((l) => l.scope === intent && l.value === 'present').length > lines.filter((l) => ends.some((end) => l.scope === `${intent}/${end}`)).length;
+/**
+ * The acts of an operation as its receipts say them: every end it got, a receipt or a look that closed an intent — a
+ * call that may have happened counts against the allowance as one that did, even when the same request ran again —
+ * and whether this request has an intent still open.
+ */
+export const actsOf = (lines, family, ends, api, operation, request) => {
+    const under = `${family}/${api}/${operation}/`;
+    return { done: lines.filter((l) => l.scope?.startsWith(under) && ends.some((end) => l.scope.endsWith(`/${end}`))).length, open: isOpen(lines, `${under}${request.slice(0, 16)}`, ends) };
+};

package/dist/src/core/answer.d.ts

@@ -0,0 +1,102 @@
+import { type Said } from './lock.ts';
+import type { Printed } from '../ports/bound.ts';
+export type Outcome = {
+    readonly lines: readonly string[];
+} | {
+    readonly refused: string;
+};
+import type { KeyStore } from '../ports/keychain.ts';
+import type { Fetched, Prepared } from '../ports/adapters/request.ts';
+import type * as Documents from '../ports/documents.ts';
+import type { Call } from './read.ts';
+import type { AccessAdapter, Answered, Attachment, Choice, Field, Held } from '../access/contract.ts';
+export type Asked = Readonly<Record<string, string | undefined>>;
+export interface Context {
+    readonly lock: readonly Said[];
+    readonly bound: (cwd: string, args: readonly string[]) => Promise<Printed | undefined>;
+    readonly roots: () => Promise<readonly string[]>;
+    readonly keys: KeyStore;
+    readonly device: (role: string) => string | undefined;
+    readonly standing: (place: string) => Promise<{
+        readonly lines: readonly Said[];
+    } | {
+        readonly refused: string;
+    }>;
+    readonly policy: (place: string) => Promise<{
+        readonly lines: readonly Said[];
+    } | {
+        readonly refused: string;
+    }>;
+    readonly world: (place: string, view: string) => Promise<{
+        readonly lines: readonly Said[];
+    } | {
+        readonly refused: string;
+    }>;
+    readonly adapter: (origin: string) => Promise<{
+        readonly prepare: (call: Call, args: Readonly<Record<string, unknown>>, lock: readonly Said[]) => Prepared;
+        readonly post: (url: string, body: Readonly<Record<string, unknown>>, most: number, wait: number, as?: 'form' | 'json') => Promise<Answered>;
+        readonly published: (url: string, digest: string, most: number, wait: number) => Promise<Uint8Array | undefined>;
+        readonly fetched: (url: string, attachment: Attachment | undefined, accept: string | undefined, most: number, wait: number) => Promise<Fetched>;
+        readonly get: (url: string, wait: number) => Promise<{
+            readonly bytes: Uint8Array;
+            readonly type: string;
+        } | undefined>;
+    } | undefined>;
+    readonly access: (kind: string) => Promise<AccessAdapter | undefined>;
+    readonly person: {
+        readonly consent: (message: string, word: string) => Promise<'yes' | 'no' | 'none'>;
+        readonly enter: (title: string, fields: readonly Field[]) => Promise<Held | undefined>;
+        readonly choose: (message: string, choices: readonly Choice[]) => Promise<Held | undefined>;
+        readonly visit: (message: string, to: (back: string) => string | undefined | Promise<string | undefined>) => Promise<Held | undefined>;
+    };
+    readonly files: {
+        readonly lay: (place: string, rel: string, bytes: Uint8Array) => void;
+        readonly drop: (place: string, rel: string) => void;
+        readonly has: (place: string, rel: string) => boolean;
+        readonly list: (place: string, rel: string) => readonly string[];
+        readonly read: typeof Documents;
+        readonly take: (path: string) => Uint8Array | undefined;
+        readonly own: (rel: string) => Uint8Array | undefined;
+    };
+    readonly home: () => string;
+    readonly personal: () => string;
+    readonly found: (place: string, account: string) => Promise<Outcome>;
+    readonly signRoot: (place: string, lot: readonly string[], account: string) => Promise<Outcome>;
+    readonly landRoot: (place: string, lot: readonly string[], account: string) => Promise<Outcome>;
+    readonly settle: () => Promise<readonly string[]>;
+    readonly pinned: (place: string, file: string) => Promise<{
+        readonly pin: string;
+        readonly bytes: string;
+        readonly lines: readonly Said[];
+    } | {
+        readonly refused: string;
+    } | undefined>;
+    readonly cache: {
+        readonly keep: (bytes: Uint8Array) => string;
+        readonly held: (digest: string) => Uint8Array | undefined;
+    };
+    readonly signAs: (place: string, lot: readonly string[], role: string, lines: readonly Said[]) => Promise<Outcome>;
+    readonly landAs: (place: string, lot: readonly string[], role: string, lines: readonly Said[]) => Promise<Outcome>;
+    readonly land: (place: string, signed: readonly string[]) => Promise<Outcome>;
+    readonly told: (place: string, signed: readonly string[]) => Promise<readonly string[]>;
+    readonly elicit: (message: string) => Promise<'yes' | 'no' | 'none'>;
+    readonly now: () => number;
+    readonly machine: () => number;
+}
+export type Answer = (asked: Asked, context: Context) => Promise<readonly string[]>;
+/** What answers a line of the surface: the module named as the line, in the folder of its family. */
+export declare const answerOf: (family: "tools" | "resources", name: string) => Promise<Answer>;
+export declare const placeOf: (asked: Asked, context: Context) => Promise<string | undefined>;
+export declare const inPlace: (asked: Asked, context: Context, then: (place: string) => Promise<readonly string[]>) => Promise<readonly string[]>;
+/** The person's yes to exactly what a message says; anything else is what head says of it, and nothing is done. */
+export declare const unless: (context: Context, message: string) => Promise<readonly string[] | undefined>;
+export declare const printedOr: (context: Context, printed: Printed | undefined) => readonly string[];
+/** The lines a place stands on, or what head says when bound refused to fold them: a refusal is never an empty standing. */
+export declare const standingOr: (context: Context, place: string, of?: Context["standing"]) => Promise<{
+    readonly lines: readonly Said[];
+} | {
+    readonly said: readonly string[];
+}>;
+export declare const baseOf: (lines: readonly Said[]) => string;
+export declare const placeNameOf: (place: string) => string;
+export declare const within: (context: Context, place: string, at: string) => Promise<boolean>;

package/dist/src/core/answer.js

@@ -0,0 +1,26 @@
+var __rewriteRelativeImportExtension = (this && this.__rewriteRelativeImportExtension) || function (path, preserveJsx) {
+    if (typeof path === "string" && /^\.\.?\//.test(path)) {
+        return path.replace(/\.(tsx)$|((?:\.d)?)((?:\.[^./]+?)?)\.([cm]?)ts$/i, function (m, tsx, d, ext, cm) {
+            return tsx ? preserveJsx ? ".jsx" : ".js" : d && (!ext || !cm) ? m : (d + ext + "." + cm.toLowerCase() + "js");
+        });
+    }
+    return path;
+};
+import { createHash } from 'node:crypto';
+import { canonical, LOCK } from '@lapxo/topos/wire';
+import { valueOf } from "./lock.js";
+import { basename, isAbsolute, resolve, sep } from 'node:path';
+import { sayIn } from "./surface.js";
+/** What answers a line of the surface: the module named as the line, in the folder of its family. */
+export const answerOf = async (family, name) => (await import(__rewriteRelativeImportExtension(new URL(`../${family}/${name}${import.meta.url.slice(import.meta.url.lastIndexOf('.'))}`, import.meta.url).href))).answer;
+export const placeOf = async (asked, context) => asked['place'] || (await context.roots())[0] || ((held) => ('refused' in held ? undefined
+    : ((named) => (named.length === 1 ? named[0] : undefined))(held.lines.filter((l) => l.scope?.startsWith(`${valueOf(context.lock, 'home/family')}/`) && l.value !== 'withdraw').map((l) => l.value))))(context.files.has(context.home(), LOCK) ? await context.policy(context.home()) : { refused: '' });
+export const inPlace = async (asked, context, then) => ((place) => (place === undefined ? [sayIn(context.lock)('no-place')] : then(place)))(await placeOf(asked, context));
+/** The person's yes to exactly what a message says; anything else is what head says of it, and nothing is done. */
+export const unless = async (context, message) => ((consent) => (consent === 'yes' ? undefined : [sayIn(context.lock)(consent === 'none' ? 'cannot-ask' : 'no-yes')]))(await context.elicit(message));
+export const printedOr = (context, printed) => (printed === undefined ? [sayIn(context.lock)('unreachable')] : [...printed.out, ...printed.err]);
+/** The lines a place stands on, or what head says when bound refused to fold them: a refusal is never an empty standing. */
+export const standingOr = async (context, place, of = context.standing) => ((held) => ('refused' in held ? { said: [sayIn(context.lock)('unfolded', { place, why: held.refused })] } : held))(await of(place));
+export const baseOf = (lines) => createHash('sha256').update(lines.map((l) => canonical(l)).sort().join('\n')).digest('hex').slice(0, 16);
+export const placeNameOf = (place) => basename(place);
+export const within = async (context, place, at) => isAbsolute(at) && [place, ...(await context.roots())].some((root) => resolve(at).startsWith(`${resolve(root)}${sep}`));

package/dist/src/core/device.d.ts

@@ -0,0 +1,26 @@
+import type { Said } from './lock.ts';
+export interface Device {
+    readonly account: string;
+    readonly service: string;
+    readonly signer: string;
+}
+export declare const deviceOf: (lock: readonly Said[], role?: string) => Device;
+/**
+ * The drafted lines a place signs to admit a key: each device/<role>/<measure> line of head-s lock, said of keys/<id>, and
+ * its public half. The id is the role's own unless whoever admits names it; so is the coverage, unless they give it.
+ */
+export declare const admissionOf: (lock: readonly Said[], publicKey: string, role?: string, as?: {
+    readonly id?: string;
+    readonly coverage?: string;
+    readonly at?: string;
+}) => readonly string[];
+export declare const algorithmOf: (lines: readonly Said[]) => string;
+/** The id a place admits a public key under, as its own lines say: a key is who the place says it is, and a key it never admitted is no one there. */
+export declare const idIn: (lines: readonly Said[], publicKey: string | undefined) => string | undefined;
+export declare const coverageOf: (lines: readonly Said[], id: string | undefined) => readonly string[];
+export declare const covers: (lines: readonly Said[], id: string | undefined, scope: string) => boolean;
+/**
+ * What head says instead of asking, when this device's key may not sign every line it would ask for in a place: what the
+ * place admits it for and the first scope outside that, then the lines whoever configures the place can sign themselves.
+ */
+export declare const uncoveredIn: (lock: readonly Said[], lines: readonly Said[], publicKey: string | undefined, place: string, lot: readonly string[], scopes?: readonly string[]) => readonly string[] | undefined;

package/dist/src/core/device.js

@@ -0,0 +1,27 @@
+import { canonical, matches, parse } from '@lapxo/topos/wire';
+import { members, said, valueOf } from "./lock.js";
+import { sayIn } from "./surface.js";
+const HEAD = 'head';
+export const deviceOf = (lock, role = HEAD) => ({ account: valueOf(lock, `device/${role}/account`), service: valueOf(lock, 'device/service'), signer: valueOf(lock, `device/${role}/signer`) });
+/**
+ * The drafted lines a place signs to admit a key: each device/<role>/<measure> line of head-s lock, said of keys/<id>, and
+ * its public half. The id is the role's own unless whoever admits names it; so is the coverage, unless they give it.
+ */
+export const admissionOf = (lock, publicKey, role = HEAD, as = {}) => ((id, at) => [
+    ...['class', 'coverage', 'resolution', 'signer'].flatMap((measure) => ((line) => (line === undefined ? [] : [canonical({ at, by: 'target', form: line.form ?? 'alphabet', measure, role: 'writes', scope: `keys/${id}`, value: measure === 'coverage' && as.coverage ? as.coverage : line.value ?? '' })]))(said(lock, `device/${role}/${measure}`))),
+    canonical({ at, by: 'target', form: 'alphabet', measure: 'public-key', role: 'writes', scope: `keys/${id}`, value: publicKey }),
+])(as.id ?? valueOf(lock, `device/${role}/account`), as.at ?? 'policy:head/device');
+export const algorithmOf = (lines) => ((era) => (lines.find((l) => l.scope === 'wire/signature-algorithms')?.value ?? '').split('|').find((one) => one.endsWith(`:${era}`)) ?? '')(valueOf(lines, 'wire/era'));
+/** The id a place admits a public key under, as its own lines say: a key is who the place says it is, and a key it never admitted is no one there. */
+export const idIn = (lines, publicKey) => publicKey === undefined ? undefined : lines.find((l) => l.scope?.startsWith('keys/') && l.measure === 'public-key' && l.value === publicKey)?.scope.slice('keys/'.length);
+export const coverageOf = (lines, id) => id === undefined ? [] : lines.filter((l) => l.scope === `keys/${id}` && l.measure === 'coverage').flatMap((l) => members(l.value ?? ''));
+export const covers = (lines, id, scope) => coverageOf(lines, id).some((glob) => matches(glob, scope));
+/**
+ * What head says instead of asking, when this device's key may not sign every line it would ask for in a place: what the
+ * place admits it for and the first scope outside that, then the lines whoever configures the place can sign themselves.
+ */
+export const uncoveredIn = (lock, lines, publicKey, place, lot, scopes = []) => {
+    const id = idIn(lines, publicKey);
+    const outside = [...scopes, ...lot.map((line) => ((got) => (got.kind === 'fact' ? got.value.fields['scope'] ?? '' : ''))(parse(line)))].find((scope) => !covers(lines, id, scope));
+    return outside === undefined ? undefined : [sayIn(lock)('not-covered', { place, coverage: coverageOf(lines, id).join('|') || 'nothing', scope: outside }), ...lot];
+};

package/dist/src/core/lock.d.ts

@@ -0,0 +1,11 @@
+export type Said = Readonly<Record<string, string>>;
+/** The lines head's own lock declares, decoded and nothing more: a withdraw has no place in it, and one there is refused, never folded here. */
+export declare const declaredOf: (text: string) => readonly Said[];
+export declare const said: (lock: readonly Said[], scope: string) => Said | undefined;
+export declare const valueOf: (lock: readonly Said[], scope: string) => string;
+export declare const aboutOf: (lock: readonly Said[], scope: string) => string;
+export declare const members: (value: string) => readonly string[];
+/** Whether a path a line needs lies under one of the folders a lock word names: a place's own, or one an older head kept. */
+export declare const under: (lock: readonly Said[], scope: string, path: string | undefined) => boolean;
+/** The lines exactly one step below a family: tool/look under tool, never tool/look/place. */
+export declare const below: (lock: readonly Said[], family: string) => readonly Said[];

package/dist/src/core/lock.js

@@ -0,0 +1,13 @@
+import { alphabet, parse, steps } from '@lapxo/topos/wire';
+/** The lines head's own lock declares, decoded and nothing more: a withdraw has no place in it, and one there is refused, never folded here. */
+export const declaredOf = (text) => text.split('\n').flatMap((line) => ((got) => (got.kind === 'fact' ? [got.value.fields] : []))(parse(line)))
+    .map((f) => { if (f.value === 'withdraw')
+    throw Error(`REFUSE·lock head's own lock withdraws ${f.scope}: its lines are declared, never folded by head`); return f; });
+export const said = (lock, scope) => lock.find((f) => f.scope === scope);
+export const valueOf = (lock, scope) => said(lock, scope)?.value ?? '';
+export const aboutOf = (lock, scope) => said(lock, scope)?.about ?? '';
+export const members = (value) => (value === '' ? [] : alphabet(value).members);
+/** Whether a path a line needs lies under one of the folders a lock word names: a place's own, or one an older head kept. */
+export const under = (lock, scope, path) => members(valueOf(lock, scope)).some((at) => path?.startsWith(`${at}/`) === true);
+/** The lines exactly one step below a family: tool/look under tool, never tool/look/place. */
+export const below = (lock, family) => lock.filter((f) => ((at) => at.length === 2 && at[0] === family)(steps(f.scope ?? '')));